From c84ef0a9177e437abacd3870d710125fa74418dc Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 17:20:47 -0400
Subject: [PATCH 001/130] Additional test and log msg

---
 build.sh                       | 7 +++++++
 src/ngx_http_auth_jwt_module.c | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/build.sh b/build.sh
index c9f8047..f8d3242 100755
--- a/build.sh
+++ b/build.sh
@@ -31,3 +31,10 @@ if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
 else
   echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_EXPECT_200}${NONE}";
 fi
+
+TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
+if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
+  echo -e "${GREEN}Secure test with jwt pass ${TEST_SECURE_EXPECT_200}${NONE}";
+else
+  echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_EXPECT_200}${NONE}";
+fi
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 5863b80..84878b8 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -109,6 +109,8 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 //			jwtcf->auth_jwt_key.data, 
 //			jwtcf->auth_jwt_enabled);
 	
+	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header %s", r->headers_in.authorization);
+
 	// get the cookie
 	// TODO: the cookie name could be passed in dynamicallly
 	n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &jwtCookieName, &jwtCookieVal);

From caee28d6b02e87d1d6387d2ce75a1181bcd792ce Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 17:28:09 -0400
Subject: [PATCH 002/130] test

---
 src/ngx_http_auth_jwt_module.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 84878b8..307829b 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -109,7 +109,8 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 //			jwtcf->auth_jwt_key.data, 
 //			jwtcf->auth_jwt_enabled);
 	
-	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header %s", r->headers_in.authorization);
+//	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header %s", r->headers_in.authorization);
+	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header");
 
 	// get the cookie
 	// TODO: the cookie name could be passed in dynamicallly

From 049ba37b41f8bb325cc5d4b37cb28d1d6422135b Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 17:43:25 -0400
Subject: [PATCH 003/130] Added search headers function

---
 src/ngx_http_auth_jwt_module.c | 63 ++++++++++++++++++++++++++++++++--
 1 file changed, 61 insertions(+), 2 deletions(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 307829b..b0add55 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -23,6 +23,7 @@ static char * ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, voi
 static int hex_char_to_binary( char ch, char* ret );
 static int hex_to_binary( const char* str, u_char* buf, int len );
 static char * ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str);
+static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len);
 
 static ngx_command_t ngx_http_auth_jwt_commands[] = {
 
@@ -109,8 +110,16 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 //			jwtcf->auth_jwt_key.data, 
 //			jwtcf->auth_jwt_enabled);
 	
-//	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header %s", r->headers_in.authorization);
-	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header");
+	ngx_table_elt_t *h;
+	ngx_str_t authorizationHeaderName = ngx_string("Authorization");
+	h = search_headers_in(&r, authorizationHeaderName.data, authorizationHeaderName.len);
+	if (h != NULL)
+	{
+		char* authvalue = ngx_str_t_to_char_ptr(r->pool, h.value);
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header %s", authvalue);
+	}
+
+	
 
 	// get the cookie
 	// TODO: the cookie name could be passed in dynamicallly
@@ -364,4 +373,54 @@ static char* ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str)
 	return char_ptr;
 }
 
+static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len)
+{
+	ngx_list_part_t            *part;
+	ngx_table_elt_t            *h;
+	ngx_uint_t                  i;
+
+	/*
+	Get the first part of the list. There is usual only one part.
+	*/
+	part = &r->headers_in.headers.part;
+	h = part->elts;
+
+	/* Headers list array may consist of more than one part,
+	* so loop through all of it
+	*/
+	for (i = 0; /* void */ ; i++)
+	{
+		if (i >= part->nelts)
+		{
+			if (part->next == NULL)
+			{
+				/* The last part, search is done. */
+				break;
+			}
+
+			part = part->next;
+			h = part->elts;
+			i = 0;
+		}
+
+		/*
+		* Just compare the lengths and then the names case insensitively.
+		*/
+		if (len != h[i].key.len || ngx_strcasecmp(name, h[i].key.data) != 0)
+		{
+			/* This header doesn't match. */
+			continue;
+		}
+
+		/*
+		* a-da, we got one!
+		* Note, we'v stop the search at the first matched header
+		* while more then one header may fit.
+		*/
+		return &h[i];
+	}
+
+	/* No headers was found */
+	return NULL;
+}
 

From 8c643f27b89f81e536cfc6e7dc1bf891da894ed8 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 17:46:18 -0400
Subject: [PATCH 004/130] debug

---
 src/ngx_http_auth_jwt_module.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index b0add55..48a845c 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -112,7 +112,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	
 	ngx_table_elt_t *h;
 	ngx_str_t authorizationHeaderName = ngx_string("Authorization");
-	h = search_headers_in(&r, authorizationHeaderName.data, authorizationHeaderName.len);
+	h = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
 	if (h != NULL)
 	{
 		char* authvalue = ngx_str_t_to_char_ptr(r->pool, h.value);

From dba2163cb2cd2ffa9dafa265ebda5e782397ef4d Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 17:49:43 -0400
Subject: [PATCH 005/130] debug

---
 src/ngx_http_auth_jwt_module.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 48a845c..55fc208 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -115,7 +115,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	h = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
 	if (h != NULL)
 	{
-		char* authvalue = ngx_str_t_to_char_ptr(r->pool, h.value);
+		char* authvalue = ngx_str_t_to_char_ptr(r->pool, h->value);
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header %s", authvalue);
 	}
 

From 9aad8e0c8afe21f6891c7f2659172bf122474134 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 18:18:12 -0400
Subject: [PATCH 006/130] Check length and content of strings and fixed test

---
 build.sh                       |  6 +++++-
 src/ngx_http_auth_jwt_module.c | 34 ++++++++++++++++++++++++----------
 2 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/build.sh b/build.sh
index f8d3242..6be9eb8 100755
--- a/build.sh
+++ b/build.sh
@@ -32,7 +32,11 @@ else
   echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_EXPECT_200}${NONE}";
 fi
 
-TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
+TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer
+eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"
+--cookie "rampartjwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.
+eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.
+eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
 if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
   echo -e "${GREEN}Secure test with jwt pass ${TEST_SECURE_EXPECT_200}${NONE}";
 else
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 55fc208..365d944 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -98,6 +98,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	jwt_alg_t alg;
 	time_t exp;
 	time_t now;
+	int BEARER_LEN = 7; // strlen("Bearer ");
 	
 	jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
 	
@@ -110,16 +111,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 //			jwtcf->auth_jwt_key.data, 
 //			jwtcf->auth_jwt_enabled);
 	
-	ngx_table_elt_t *h;
-	ngx_str_t authorizationHeaderName = ngx_string("Authorization");
-	h = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
-	if (h != NULL)
-	{
-		char* authvalue = ngx_str_t_to_char_ptr(r->pool, h->value);
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header %s", authvalue);
-	}
-
-	
 
 	// get the cookie
 	// TODO: the cookie name could be passed in dynamicallly
@@ -175,6 +166,29 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		goto redirect;
 	}
 	
+	// if an Authorization header exists, it must match the cookie
+	ngx_table_elt_t *authorizationHeader;
+	ngx_str_t authorizationHeaderName = ngx_string("Authorization");
+	authorizationHeader = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
+	if (authorizationHeader != NULL)
+	{
+		// compare lengths first
+		if (authorizationHeader->value.len != jwtCookieVal.len + BEARER_LEN)
+		{
+			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization and Cookie do not match lengths");
+			goto redirect;
+		}
+
+		if (0 != strncmp(authorizationHeader->value.data + BEARER_LEN, jwtCookieVal.data))
+		{
+			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization and Cookie do not match content");
+			goto redirect;
+		}
+
+		char* authvalue = ngx_str_t_to_char_ptr(r->pool, authorizationHeader->value);
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header %s", authvalue);
+	}
+
 	return NGX_OK;
 	
 	redirect:

From 3dbb129c0faef7e9eab022c043d191f3eddaa574 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 18:19:12 -0400
Subject: [PATCH 007/130] debug

---
 src/ngx_http_auth_jwt_module.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 365d944..7b05063 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -179,7 +179,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			goto redirect;
 		}
 
-		if (0 != strncmp(authorizationHeader->value.data + BEARER_LEN, jwtCookieVal.data))
+		if (0 != strncmp(authorizationHeader->value.data + BEARER_LEN, jwtCookieVal.data, jwtCookieVal.len))
 		{
 			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization and Cookie do not match content");
 			goto redirect;

From db46b07781512c34ce715c7dc1da52f6ce91d4d8 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 18:21:27 -0400
Subject: [PATCH 008/130] debug

---
 src/ngx_http_auth_jwt_module.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 7b05063..4453f61 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -179,7 +179,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			goto redirect;
 		}
 
-		if (0 != strncmp(authorizationHeader->value.data + BEARER_LEN, jwtCookieVal.data, jwtCookieVal.len))
+		if (0 != strncmp(authorizationHeader->value.data + BEARER_LEN, jwtCookieVal.data, jwtCookieVal.len)) 
 		{
 			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization and Cookie do not match content");
 			goto redirect;

From 1f38838f895927a61c7bb3dbd72039374b7ca481 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 19:17:22 -0400
Subject: [PATCH 009/130] strncmp doesn't work with u_char *

---
 src/ngx_http_auth_jwt_module.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 4453f61..c3f3bc1 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -179,7 +179,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			goto redirect;
 		}
 
-		if (0 != strncmp(authorizationHeader->value.data + BEARER_LEN, jwtCookieVal.data, jwtCookieVal.len)) 
+		if (0 != strncmp((const char *)(authorizationHeader->value.data + BEARER_LEN), (const char *)jwtCookieVal.data, jwtCookieVal.len)) 
 		{
 			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization and Cookie do not match content");
 			goto redirect;

From dd5c1783dd201178391baebcb7441610360b77eb Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 19:24:16 -0400
Subject: [PATCH 010/130] Test had bad newlines

---
 build.sh | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/build.sh b/build.sh
index 6be9eb8..20d044f 100755
--- a/build.sh
+++ b/build.sh
@@ -32,11 +32,7 @@ else
   echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_EXPECT_200}${NONE}";
 fi
 
-TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer
-eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"
---cookie "rampartjwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.
-eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.
-eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
+TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4" --cookie "rampartjwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.  eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.  eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
 if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
   echo -e "${GREEN}Secure test with jwt pass ${TEST_SECURE_EXPECT_200}${NONE}";
 else

From 8c77e171ae4b86957e309c8d0a4dfdb5dd508b8f Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 19:49:20 -0400
Subject: [PATCH 011/130] remove spaces from tests

---
 build.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sh b/build.sh
index 20d044f..466ca7a 100755
--- a/build.sh
+++ b/build.sh
@@ -32,7 +32,7 @@ else
   echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_EXPECT_200}${NONE}";
 fi
 
-TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4" --cookie "rampartjwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.  eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.  eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
+TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4" --cookie "rampartjwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
 if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
   echo -e "${GREEN}Secure test with jwt pass ${TEST_SECURE_EXPECT_200}${NONE}";
 else

From 0e01b3635d6e15156c0a46c4129347c4ab5d3347 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 19:49:33 -0400
Subject: [PATCH 012/130] clean up

---
 src/ngx_http_auth_jwt_module.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index c3f3bc1..fc483ef 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -85,9 +85,11 @@ ngx_module_t ngx_http_auth_jwt_module = {
 
 static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 {
+	static const ngx_str_t jwtCookieName = ngx_string("rampartjwt");
+	static const ngx_str_t passportKeyCookieName = ngx_string("PassportKey");
+	static const ngx_str_t authorizationHeaderName = ngx_string("Authorization");
+	static const int BEARER_LEN = 7; // strlen("Bearer ");
 	ngx_int_t n;
-	ngx_str_t jwtCookieName = ngx_string("rampartjwt");
-	ngx_str_t passportKeyCookieName = ngx_string("PassportKey");
 	ngx_str_t jwtCookieVal;
 	char* jwtCookieValChrPtr;
 	char* return_url;
@@ -98,7 +100,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	jwt_alg_t alg;
 	time_t exp;
 	time_t now;
-	int BEARER_LEN = 7; // strlen("Bearer ");
+	ngx_table_elt_t *authorizationHeader;
 	
 	jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
 	
@@ -167,8 +169,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	}
 	
 	// if an Authorization header exists, it must match the cookie
-	ngx_table_elt_t *authorizationHeader;
-	ngx_str_t authorizationHeaderName = ngx_string("Authorization");
 	authorizationHeader = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
 	if (authorizationHeader != NULL)
 	{
@@ -179,14 +179,12 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			goto redirect;
 		}
 
+		// compare content
 		if (0 != strncmp((const char *)(authorizationHeader->value.data + BEARER_LEN), (const char *)jwtCookieVal.data, jwtCookieVal.len)) 
 		{
 			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization and Cookie do not match content");
 			goto redirect;
 		}
-
-		char* authvalue = ngx_str_t_to_char_ptr(r->pool, authorizationHeader->value);
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "authorization header %s", authvalue);
 	}
 
 	return NGX_OK;

From 060185de78a07e66c3ce737c0b151a6e0f0a45d5 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 19:54:57 -0400
Subject: [PATCH 013/130] didn't like the static const strings

---
 src/ngx_http_auth_jwt_module.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index fc483ef..d031d46 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -85,10 +85,11 @@ ngx_module_t ngx_http_auth_jwt_module = {
 
 static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 {
-	static const ngx_str_t jwtCookieName = ngx_string("rampartjwt");
-	static const ngx_str_t passportKeyCookieName = ngx_string("PassportKey");
-	static const ngx_str_t authorizationHeaderName = ngx_string("Authorization");
 	static const int BEARER_LEN = 7; // strlen("Bearer ");
+	
+	ngx_str_t jwtCookieName = ngx_string("rampartjwt");
+	ngx_str_t passportKeyCookieName = ngx_string("PassportKey");
+	ngx_str_t authorizationHeaderName = ngx_string("Authorization");
 	ngx_int_t n;
 	ngx_str_t jwtCookieVal;
 	char* jwtCookieValChrPtr;

From db01184205e816828cea064b5486c16e39a7906e Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 19:57:05 -0400
Subject: [PATCH 014/130] name test better

---
 build.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/build.sh b/build.sh
index 466ca7a..c6b3c6c 100755
--- a/build.sh
+++ b/build.sh
@@ -34,7 +34,7 @@ fi
 
 TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4" --cookie "rampartjwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
 if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with jwt pass ${TEST_SECURE_EXPECT_200}${NONE}";
+  echo -e "${GREEN}Secure test with jwt and auth header pass ${TEST_SECURE_EXPECT_200}${NONE}";
 else
-  echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_EXPECT_200}${NONE}";
+  echo -e "${RED}Secure test with jwt and auth header fail ${TEST_SECURE_EXPECT_200}${NONE}";
 fi

From 358c168395534ec8bf4487301236d4574f851819 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 30 Oct 2017 19:59:25 -0400
Subject: [PATCH 015/130] pointing at branch to test

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 3a8a83d..170d240 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -48,7 +48,7 @@ RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
 ARG TESLA_REPO_NAME=ngx-http-auth-jwt-module
 # ARG TESLA_REPO_URL_PREFIX=joefitz/
 # ARG TESLA_REPO_FILE_PREFIX=joefitz-
-# ARG TESLA_REPO_FILENAME=match-rh-nginx110-version
+# ARG TESLA_REPO_FILENAME=validate-authorization-header
 ARG TESLA_REPO_URL_PREFIX=
 ARG TESLA_REPO_FILE_PREFIX=
 ARG TESLA_REPO_FILENAME=master

From 9927fb944ef25f3aaeb80f78fdb2bcbd62cc343a Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 31 Oct 2017 13:21:30 -0400
Subject: [PATCH 016/130] Corrected comments

---
 src/ngx_http_auth_jwt_module.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index d031d46..dcc092e 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -392,15 +392,11 @@ static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, s
 	ngx_table_elt_t            *h;
 	ngx_uint_t                  i;
 
-	/*
-	Get the first part of the list. There is usual only one part.
-	*/
+	// Get the first part of the list. There is usual only one part.
 	part = &r->headers_in.headers.part;
 	h = part->elts;
 
-	/* Headers list array may consist of more than one part,
-	* so loop through all of it
-	*/
+	// Headers list array may consist of more than one part, so loop through all of it
 	for (i = 0; /* void */ ; i++)
 	{
 		if (i >= part->nelts)
@@ -416,9 +412,7 @@ static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, s
 			i = 0;
 		}
 
-		/*
-		* Just compare the lengths and then the names case insensitively.
-		*/
+		//Just compare the lengths and then the names case insensitively.
 		if (len != h[i].key.len || ngx_strcasecmp(name, h[i].key.data) != 0)
 		{
 			/* This header doesn't match. */
@@ -426,9 +420,9 @@ static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, s
 		}
 
 		/*
-		* a-da, we got one!
-		* Note, we'v stop the search at the first matched header
-		* while more then one header may fit.
+		* Ta-da, we got one!
+		* Note, we've stopped the search at the first matched header
+		* while more then one header may match.
 		*/
 		return &h[i];
 	}

From 4ef1890ca1da49b151f09bd841d57c99939fb8e4 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 31 Oct 2017 13:43:26 -0400
Subject: [PATCH 017/130] Cleaner tests

---
 build.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/build.sh b/build.sh
index c6b3c6c..af912ae 100755
--- a/build.sh
+++ b/build.sh
@@ -11,6 +11,8 @@ RED='\033[01;31m'
 GREEN='\033[01;32m'
 NONE='\033[00m'
 
+VALIDJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4
+
 TEST_INSECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000`
 if [ "$TEST_INSECURE_EXPECT_200" -eq "200" ];then
   echo -e "${GREEN}Insecure test pass ${TEST_INSECURE_EXPECT_200}${NONE}";
@@ -25,14 +27,14 @@ else
   echo -e "${RED}Secure test without jwt fail ${TEST_SECURE_EXPECT_302}${NONE}";
 fi
 
-TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
+TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${VALIDJWT}"`
 if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
   echo -e "${GREEN}Secure test with jwt pass ${TEST_SECURE_EXPECT_200}${NONE}";
 else
   echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_EXPECT_200}${NONE}";
 fi
 
-TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4" --cookie "rampartjwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4;PassportKey=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4"`
+TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer ${VALIDJWT}" --cookie "rampartjwt=${VALIDJWT}"`
 if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
   echo -e "${GREEN}Secure test with jwt and auth header pass ${TEST_SECURE_EXPECT_200}${NONE}";
 else

From 3852372579b947f48b46fc79dba1cd99f133b7f0 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 6 Nov 2017 20:43:18 -0500
Subject: [PATCH 018/130] use epel7 yum repo to get nginx and associated tweaks

use epel7 yum repo to get nginx and associated tweaks
---
 Dockerfile           | 33 +++++++++++++++++++++++++--------
 resources/nginx.conf |  4 ++--
 resources/nginx.repo |  5 -----
 3 files changed, 27 insertions(+), 15 deletions(-)
 delete mode 100644 resources/nginx.repo

diff --git a/Dockerfile b/Dockerfile
index 170d240..e697a98 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,13 +2,12 @@ FROM centos:7
 
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
 
-ARG NGINX_VERSION=1.12.0
-
-COPY resources/nginx.repo /etc/yum.repos.d/nginx.repo
+ARG NGINX_VERSION=1.10.2
 
 ENV LD_LIBRARY_PATH=/usr/local/lib
 
-RUN yum -y update && \
+RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm && \
+    yum -y update && \
 	yum -y groupinstall 'Development Tools' && \
 	yum -y install pcre-devel pcre zlib-devel openssl-devel wget cmake check-devel check && \
 	yum -y install nginx-$NGINX_VERSION
@@ -16,6 +15,9 @@ RUN yum -y update && \
 # for compiling for rh-nginx110
 # yum -y install libxml2 libxslt libxml2-devel libxslt-devel gd gd-devel perl-ExtUtils-Embed
 
+# for compiling for epel7
+RUN yum -y install libxml2 libxslt libxml2-devel libxslt-devel gd gd-devel perl-ExtUtils-Embed geoip geoip-devel google-perftools google-perftools-devel
+
 RUN mkdir -p /root/dl
 WORKDIR /root/dl
 
@@ -59,6 +61,7 @@ RUN unzip ${TESLA_REPO_FILENAME}.zip && \
 
 # after 1.11.5 use this command
 # ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module --with-cc-opt='-std=gnu99'
+# cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /etc/nginx/modules/.
 # build nginx module against nginx sources
 #
 # 1.10.2 from nginx by default use config flags... I had to add the -std=c99 and could not achieve "binary compatibility"
@@ -66,15 +69,29 @@ RUN unzip ${TESLA_REPO_FILENAME}.zip && \
 #
 # rh-nginx110 uses these config flags
 # ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/opt/rh/rh-nginx110/root/usr/share/nginx --sbin-path=/opt/rh/rh-nginx110/root/usr/sbin/nginx --modules-path=/opt/rh/rh-nginx110/root/usr/lib64/nginx/modules --conf-path=/etc/opt/rh/rh-nginx110/nginx/nginx.conf --error-log-path=/var/opt/rh/rh-nginx110/log/nginx/error.log --http-log-path=/var/opt/rh/rh-nginx110/log/nginx/access.log --http-client-body-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/scgi --pid-path=/var/opt/rh/rh-nginx110/run/nginx/nginx.pid --lock-path=/var/opt/rh/rh-nginx110/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=c99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
+#
+# epel7 version uses these config flags
+# ./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
+#
+#RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
+#	tar -xzf nginx-$NGINX_VERSION.tar.gz && \
+#	rm nginx-$NGINX_VERSION.tar.gz && \
+#	ln -sf nginx-$NGINX_VERSION nginx && \
+#	cd /root/dl/nginx && \
+#    ./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
+#	make modules && \
+#	cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
+
+# ARG CACHEBUST=1
 
 RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
 	tar -xzf nginx-$NGINX_VERSION.tar.gz && \
 	rm nginx-$NGINX_VERSION.tar.gz && \
 	ln -sf nginx-$NGINX_VERSION nginx && \
-	cd /root/dl/nginx && \
-	./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module --with-cc-opt='-std=gnu99' && \
-	make modules && \
-	cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /etc/nginx/modules/.
+    cd /root/dl/nginx && \
+    ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
+    make modules && \
+	cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
 
 # Get nginx ready to run
 COPY resources/nginx.conf /etc/nginx/nginx.conf
diff --git a/resources/nginx.conf b/resources/nginx.conf
index cef43ce..5bfb041 100644
--- a/resources/nginx.conf
+++ b/resources/nginx.conf
@@ -5,7 +5,7 @@ worker_processes  1;
 error_log  /var/log/nginx/error.log warn;
 pid        /var/run/nginx.pid;
 
-load_module modules/ngx_http_auth_jwt_module.so;
+load_module /usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so;
 
 events {
     worker_connections  1024;
@@ -32,4 +32,4 @@ http {
     include /etc/nginx/conf.d/*.conf;
 }
 
-daemon off;
\ No newline at end of file
+daemon off;
diff --git a/resources/nginx.repo b/resources/nginx.repo
deleted file mode 100644
index c8393c9..0000000
--- a/resources/nginx.repo
+++ /dev/null
@@ -1,5 +0,0 @@
-[nginx]
-name=nginx repo
-baseurl=http://nginx.org/packages/centos/7/x86_64/
-gpgcheck=0
-enabled=1

From 1439114af94bc573637b8292e5b0266b69c9fb3e Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 13 Nov 2017 18:49:12 -0500
Subject: [PATCH 019/130] optionally redirect or return unauthorized

---
 resources/test-jwt-nginx.conf  |  1 +
 src/ngx_http_auth_jwt_module.c | 24 ++++++++++++++++++++++--
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/resources/test-jwt-nginx.conf b/resources/test-jwt-nginx.conf
index ab79472..8129f6b 100644
--- a/resources/test-jwt-nginx.conf
+++ b/resources/test-jwt-nginx.conf
@@ -2,6 +2,7 @@ server {
     auth_jwt_key                 "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
     auth_jwt_loginurl            "https://teslagov.com";
     auth_jwt_enabled             off;
+    auth_jwt_redirect            on;
 
     listen       8000;
     server_name  localhost;
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index dcc092e..9435765 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -14,6 +14,7 @@ typedef struct {
 	ngx_str_t   auth_jwt_loginurl;
 	ngx_str_t   auth_jwt_key;
 	ngx_flag_t  auth_jwt_enabled;
+	ngx_flag_t  auth_jwt_redirect;
 } ngx_http_auth_jwt_loc_conf_t;
 
 static ngx_int_t ngx_http_auth_jwt_init(ngx_conf_t *cf);
@@ -48,6 +49,13 @@ static ngx_command_t ngx_http_auth_jwt_commands[] = {
 		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_enabled),
 		NULL },
 
+	{ ngx_string("auth_jwt_redirect"),
+		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+		ngx_conf_set_flag_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_redirect),
+		NULL },
+
 	ngx_null_command
 };
 
@@ -272,7 +280,14 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			r->headers_out.location->value.data = jwtcf->auth_jwt_loginurl.data;
 		}
 
-		return NGX_HTTP_MOVED_TEMPORARILY;
+        if (jwtcf->auth_jwt_redirect)
+        {
+    		return NGX_HTTP_MOVED_TEMPORARILY;
+        }
+        else
+        {
+    		return NGX_HTTP_UNAUTHORIZED;
+        }
 }
 
 
@@ -308,6 +323,7 @@ ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf)
 	
 	// set the flag to unset
 	conf->auth_jwt_enabled = (ngx_flag_t) -1;
+	conf->auth_jwt_redirect = (ngx_flag_t) -1;
 
 	ngx_conf_log_error(NGX_LOG_DEBUG, cf, 0, "Created Location Configuration");
 	
@@ -324,11 +340,15 @@ ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 	ngx_conf_merge_str_value(conf->auth_jwt_loginurl, prev->auth_jwt_loginurl, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_key, prev->auth_jwt_key, "");
 	
-	
 	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1)) 
 	{
 		conf->auth_jwt_enabled = (prev->auth_jwt_enabled == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_enabled;
 	}
+
+    if (conf->auth_jwt_redirect == ((ngx_flag_t) -1))
+    {
+		conf->auth_jwt_redirect = (prev->auth_jwt_redirect == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_redirect;
+    }
 	
 	ngx_conf_log_error(NGX_LOG_DEBUG, cf, 0, "Merged Location Configuration");
 

From 10bd80d6c99f5ac139e8bbeee151d751a7eca7b5 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 13 Nov 2017 20:44:48 -0500
Subject: [PATCH 020/130] Testing no redirect

---
 build.sh                      | 23 +++++++++++++++--------
 resources/test-jwt-nginx.conf |  6 ++++++
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/build.sh b/build.sh
index af912ae..1af4b45 100755
--- a/build.sh
+++ b/build.sh
@@ -27,16 +27,23 @@ else
   echo -e "${RED}Secure test without jwt fail ${TEST_SECURE_EXPECT_302}${NONE}";
 fi
 
-TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${VALIDJWT}"`
-if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with jwt pass ${TEST_SECURE_EXPECT_200}${NONE}";
+TEST_SECURE_COOKIE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${VALIDJWT}"`
+if [ "$TEST_SECURE_COOKIE_EXPECT_200" -eq "200" ];then
+  echo -e "${GREEN}Secure test with jwt pass ${TEST_SECURE_COOKIE_EXPECT_200}${NONE}";
 else
-  echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_EXPECT_200}${NONE}";
+  echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_COOKIE_EXPECT_200}${NONE}";
 fi
 
-TEST_SECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer ${VALIDJWT}" --cookie "rampartjwt=${VALIDJWT}"`
-if [ "$TEST_SECURE_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with jwt and auth header pass ${TEST_SECURE_EXPECT_200}${NONE}";
+TEST_SECURE_HEADER_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer ${VALIDJWT}" --cookie "rampartjwt=${VALIDJWT}"`
+if [ "$TEST_SECURE_HEADER_EXPECT_200" -eq "200" ];then
+  echo -e "${GREEN}Secure test with jwt and auth header pass ${TEST_SECURE_HEADER_EXPECT_200}${NONE}";
 else
-  echo -e "${RED}Secure test with jwt and auth header fail ${TEST_SECURE_EXPECT_200}${NONE}";
+  echo -e "${RED}Secure test with jwt and auth header fail ${TEST_SECURE_HEADER_EXPECT_200}${NONE}";
+fi
+
+TEST_SECURE_NO_REDIRECT_EXPECT_401=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-no-redirect/index.html`
+if [ "$TEST_SECURE_NO_REDIRECT_EXPECT_401" -eq "401" ];then
+  echo -e "${GREEN}Secure test with jwt and auth header pass ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
+else
+  echo -e "${RED}Secure test with jwt and auth header fail ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
 fi
diff --git a/resources/test-jwt-nginx.conf b/resources/test-jwt-nginx.conf
index 8129f6b..4bd5847 100644
--- a/resources/test-jwt-nginx.conf
+++ b/resources/test-jwt-nginx.conf
@@ -7,6 +7,12 @@ server {
     listen       8000;
     server_name  localhost;
 
+    location ~ ^/secure-no-redirect/ {
+        auth_jwt_enabled   on;
+        auth_jwt_redirect  off;
+        alias  /usr/share/nginx/secure/;
+    }
+
     location ~ ^/secure/ {
         auth_jwt_enabled   on;
         root   /usr/share/nginx;

From 20026b68ae0573483d25c6cc803cc227a52dd9be Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 13 Nov 2017 21:34:31 -0500
Subject: [PATCH 021/130] fix text for test

---
 build.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/build.sh b/build.sh
index 1af4b45..4f04a74 100755
--- a/build.sh
+++ b/build.sh
@@ -43,7 +43,7 @@ fi
 
 TEST_SECURE_NO_REDIRECT_EXPECT_401=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-no-redirect/index.html`
 if [ "$TEST_SECURE_NO_REDIRECT_EXPECT_401" -eq "401" ];then
-  echo -e "${GREEN}Secure test with jwt and auth header pass ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
+  echo -e "${GREEN}Secure test without jwt no redirect pass ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
 else
-  echo -e "${RED}Secure test with jwt and auth header fail ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
+  echo -e "${RED}Secure test without jwt no redirect fail ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
 fi

From 85e2a1cbf06f22b24d431c989747ea871250cf26 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Fri, 1 Dec 2017 15:44:23 -0500
Subject: [PATCH 022/130] EPEL upgraded nginx from 1.10.2 to 1.12.2

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index e697a98..83ae747 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@ FROM centos:7
 
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
 
-ARG NGINX_VERSION=1.10.2
+ARG NGINX_VERSION=1.12.2
 
 ENV LD_LIBRARY_PATH=/usr/local/lib
 

From 629149b64d90e98ef1d9a34a7eba63d40a39af65 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 16 Jan 2018 15:47:01 -0500
Subject: [PATCH 023/130] Log userid and email in nginx access logs.

---
 Dockerfile                     | 19 +++++----
 resources/nginx.conf           | 18 ++++++---
 src/ngx_http_auth_jwt_module.c | 74 ++++++++++++++++++++++++++++++++++
 3 files changed, 98 insertions(+), 13 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 83ae747..d5854ed 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -47,17 +47,19 @@ RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
 
 # get our JWT module
 # change this to get a specific version?
-ARG TESLA_REPO_NAME=ngx-http-auth-jwt-module
+#ARG TESLA_REPO_NAME=ngx-http-auth-jwt-module
 # ARG TESLA_REPO_URL_PREFIX=joefitz/
 # ARG TESLA_REPO_FILE_PREFIX=joefitz-
 # ARG TESLA_REPO_FILENAME=validate-authorization-header
-ARG TESLA_REPO_URL_PREFIX=
-ARG TESLA_REPO_FILE_PREFIX=
-ARG TESLA_REPO_FILENAME=master
-ADD https://github.com/TeslaGov/$TESLA_REPO_NAME/archive/${TESLA_REPO_URL_PREFIX}${TESLA_REPO_FILENAME}.zip .
-RUN unzip ${TESLA_REPO_FILENAME}.zip && \
-	rm ${TESLA_REPO_FILENAME}.zip && \
-	ln -sf ${TESLA_REPO_NAME}-${TESLA_REPO_FILE_PREFIX}${TESLA_REPO_FILENAME} ${TESLA_REPO_NAME}
+#ARG TESLA_REPO_URL_PREFIX=
+#ARG TESLA_REPO_FILE_PREFIX=
+#ARG TESLA_REPO_FILENAME=master
+#ADD https://github.com/TeslaGov/$TESLA_REPO_NAME/archive/${TESLA_REPO_URL_PREFIX}${TESLA_REPO_FILENAME}.zip .
+#RUN unzip ${TESLA_REPO_FILENAME}.zip && \
+#	rm ${TESLA_REPO_FILENAME}.zip && \
+#	ln -sf ${TESLA_REPO_NAME}-${TESLA_REPO_FILE_PREFIX}${TESLA_REPO_FILENAME} ${TESLA_REPO_NAME}
+
+ADD . /root/dl/ngx-http-auth-jwt-module
 
 # after 1.11.5 use this command
 # ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module --with-cc-opt='-std=gnu99'
@@ -99,5 +101,6 @@ COPY resources/test-jwt-nginx.conf /etc/nginx/conf.d/test-jwt-nginx.conf
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure
 
 ENTRYPOINT ["/usr/sbin/nginx"]
+#ENTRYPOINT ["while true; do echo hello world; sleep 1; done"]
 
 EXPOSE 8000
diff --git a/resources/nginx.conf b/resources/nginx.conf
index 5bfb041..7ea8afb 100644
--- a/resources/nginx.conf
+++ b/resources/nginx.conf
@@ -2,7 +2,7 @@
 user  nginx;
 worker_processes  1;
 
-error_log  /var/log/nginx/error.log warn;
+error_log  /var/log/nginx/error.log info;
 pid        /var/run/nginx.pid;
 
 load_module /usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so;
@@ -16,11 +16,14 @@ http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
 
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
+    log_format  upstream_time  '$remote_addr $sent_http_x_userid [$time_local] "$request" '
+            '$status $body_bytes_sent "$http_referer" '
+            '"$http_user_agent" "$http_x_forwarded_for" '
+            'rt="$request_time" uct="$upstream_connect_time" '
+            'uht="$upstream_header_time" urt="$upstream_response_time" '
+            '$sent_http_x_email';
 
-    access_log  /var/log/nginx/access.log  main;
+    access_log  /var/log/nginx/access.log  upstream_time;
 
     sendfile        on;
     #tcp_nopush     on;
@@ -29,6 +32,11 @@ http {
 
     #gzip  on;
 
+    proxy_set_header Host                  $host;
+    proxy_set_header X-Forwarded-For       $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto     $scheme;
+    proxy_set_header X-Forwarded-Server    $remote_addr;
+
     include /etc/nginx/conf.d/*.conf;
 }
 
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 9435765..a750f40 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -24,7 +24,9 @@ static char * ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, voi
 static int hex_char_to_binary( char ch, char* ret );
 static int hex_to_binary( const char* str, u_char* buf, int len );
 static char * ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str);
+static ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr);
 static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len);
+static ngx_int_t set_custom_header_in_headers_out(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value);
 
 static ngx_command_t ngx_http_auth_jwt_commands[] = {
 
@@ -98,6 +100,8 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	ngx_str_t jwtCookieName = ngx_string("rampartjwt");
 	ngx_str_t passportKeyCookieName = ngx_string("PassportKey");
 	ngx_str_t authorizationHeaderName = ngx_string("Authorization");
+	ngx_str_t useridHeaderName = ngx_string("x-userid");
+	ngx_str_t emailHeaderName = ngx_string("x-email");
 	ngx_int_t n;
 	ngx_str_t jwtCookieVal;
 	char* jwtCookieValChrPtr;
@@ -107,6 +111,10 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	jwt_t *jwt;
 	int jwtParseReturnCode;
 	jwt_alg_t alg;
+	const char* sub;
+	const char* email;
+	ngx_str_t sub_t;
+	ngx_str_t email_t;
 	time_t exp;
 	time_t now;
 	ngx_table_elt_t *authorizationHeader;
@@ -196,6 +204,23 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		}
 	}
 
+	// extract the userid
+	sub = jwt_get_grant(jwt, "sub");
+	if (sub == NULL)
+	{
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain a subject");
+	}
+	sub_t = ngx_char_ptr_to_str_t(r->pool, (char *)sub);
+	set_custom_header_in_headers_out(r, &useridHeaderName, &sub_t);
+
+	email = jwt_get_grant(jwt, "emailAddress");
+	if (email == NULL)
+	{
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain an email address");
+	}
+	email_t = ngx_char_ptr_to_str_t(r->pool, (char *)email);
+	set_custom_header_in_headers_out(r, &emailHeaderName, &email_t);
+
 	return NGX_OK;
 	
 	redirect:
@@ -406,6 +431,22 @@ static char* ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str)
 	return char_ptr;
 }
 
+/** copies a character pointer string to an nginx string structure */
+static ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr)
+{
+	int len = strlen(char_ptr);
+
+	ngx_str_t str_t;
+	str_t.data = ngx_palloc(pool, len);
+	ngx_memcpy(str_t.data, char_ptr, len);
+	str_t.len = len;
+	return str_t;
+}
+
+/**
+ * Sample code from nginx.
+ * https://www.nginx.com/resources/wiki/start/topics/examples/headers_management/?highlight=http%20settings
+ */
 static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len)
 {
 	ngx_list_part_t            *part;
@@ -451,3 +492,36 @@ static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, s
 	return NULL;
 }
 
+/**
+ * Sample code from nginx
+ * https://www.nginx.com/resources/wiki/start/topics/examples/headers_management/#how-can-i-set-a-header
+ */
+static ngx_int_t set_custom_header_in_headers_out(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value) {
+    ngx_table_elt_t   *h;
+
+    /*
+    All we have to do is just to allocate the header...
+    */
+    h = ngx_list_push(&r->headers_out.headers);
+    if (h == NULL) {
+        return NGX_ERROR;
+    }
+
+    /*
+    ... setup the header key ...
+    */
+    h->key = *key;
+
+    /*
+    ... and the value.
+    */
+    h->value = *value;
+
+    /*
+    Mark the header as not deleted.
+    */
+    h->hash = 1;
+
+    return NGX_OK;
+}
+

From 203e43e5899ec339c03c4268fec4057eecd11111 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Fri, 26 Jan 2018 13:01:41 -0500
Subject: [PATCH 024/130] copy so out of container

---
 build.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/build.sh b/build.sh
index 4f04a74..5515201 100755
--- a/build.sh
+++ b/build.sh
@@ -7,6 +7,8 @@ CONTAINER_ID=$(docker run --name "${DOCKER_IMAGE_NAME}-cont" -d -p 8000:8000 ${D
 
 MACHINE_IP=`docker-machine ip`
 
+docker cp ${CONTAINER_ID}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
+
 RED='\033[01;31m'
 GREEN='\033[01;32m'
 NONE='\033[00m'

From a0a4bfaa173df70f9efcdc2083766e108ff0f069 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Wed, 31 Jan 2018 11:28:03 -0500
Subject: [PATCH 025/130] removed authorization header check

removed authorization header check
---
 build.sh                       |  7 ----
 src/ngx_http_auth_jwt_module.c | 72 ----------------------------------
 2 files changed, 79 deletions(-)

diff --git a/build.sh b/build.sh
index 5515201..6da50d7 100755
--- a/build.sh
+++ b/build.sh
@@ -36,13 +36,6 @@ else
   echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_COOKIE_EXPECT_200}${NONE}";
 fi
 
-TEST_SECURE_HEADER_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer ${VALIDJWT}" --cookie "rampartjwt=${VALIDJWT}"`
-if [ "$TEST_SECURE_HEADER_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with jwt and auth header pass ${TEST_SECURE_HEADER_EXPECT_200}${NONE}";
-else
-  echo -e "${RED}Secure test with jwt and auth header fail ${TEST_SECURE_HEADER_EXPECT_200}${NONE}";
-fi
-
 TEST_SECURE_NO_REDIRECT_EXPECT_401=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-no-redirect/index.html`
 if [ "$TEST_SECURE_NO_REDIRECT_EXPECT_401" -eq "401" ];then
   echo -e "${GREEN}Secure test without jwt no redirect pass ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index a750f40..a548996 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -25,7 +25,6 @@ static int hex_char_to_binary( char ch, char* ret );
 static int hex_to_binary( const char* str, u_char* buf, int len );
 static char * ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str);
 static ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr);
-static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len);
 static ngx_int_t set_custom_header_in_headers_out(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value);
 
 static ngx_command_t ngx_http_auth_jwt_commands[] = {
@@ -95,11 +94,8 @@ ngx_module_t ngx_http_auth_jwt_module = {
 
 static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 {
-	static const int BEARER_LEN = 7; // strlen("Bearer ");
-	
 	ngx_str_t jwtCookieName = ngx_string("rampartjwt");
 	ngx_str_t passportKeyCookieName = ngx_string("PassportKey");
-	ngx_str_t authorizationHeaderName = ngx_string("Authorization");
 	ngx_str_t useridHeaderName = ngx_string("x-userid");
 	ngx_str_t emailHeaderName = ngx_string("x-email");
 	ngx_int_t n;
@@ -117,7 +113,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	ngx_str_t email_t;
 	time_t exp;
 	time_t now;
-	ngx_table_elt_t *authorizationHeader;
 	
 	jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
 	
@@ -184,25 +179,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt has expired");
 		goto redirect;
 	}
-	
-	// if an Authorization header exists, it must match the cookie
-	authorizationHeader = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
-	if (authorizationHeader != NULL)
-	{
-		// compare lengths first
-		if (authorizationHeader->value.len != jwtCookieVal.len + BEARER_LEN)
-		{
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization and Cookie do not match lengths");
-			goto redirect;
-		}
-
-		// compare content
-		if (0 != strncmp((const char *)(authorizationHeader->value.data + BEARER_LEN), (const char *)jwtCookieVal.data, jwtCookieVal.len)) 
-		{
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization and Cookie do not match content");
-			goto redirect;
-		}
-	}
 
 	// extract the userid
 	sub = jwt_get_grant(jwt, "sub");
@@ -443,54 +419,6 @@ static ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr)
 	return str_t;
 }
 
-/**
- * Sample code from nginx.
- * https://www.nginx.com/resources/wiki/start/topics/examples/headers_management/?highlight=http%20settings
- */
-static ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len)
-{
-	ngx_list_part_t            *part;
-	ngx_table_elt_t            *h;
-	ngx_uint_t                  i;
-
-	// Get the first part of the list. There is usual only one part.
-	part = &r->headers_in.headers.part;
-	h = part->elts;
-
-	// Headers list array may consist of more than one part, so loop through all of it
-	for (i = 0; /* void */ ; i++)
-	{
-		if (i >= part->nelts)
-		{
-			if (part->next == NULL)
-			{
-				/* The last part, search is done. */
-				break;
-			}
-
-			part = part->next;
-			h = part->elts;
-			i = 0;
-		}
-
-		//Just compare the lengths and then the names case insensitively.
-		if (len != h[i].key.len || ngx_strcasecmp(name, h[i].key.data) != 0)
-		{
-			/* This header doesn't match. */
-			continue;
-		}
-
-		/*
-		* Ta-da, we got one!
-		* Note, we've stopped the search at the first matched header
-		* while more then one header may match.
-		*/
-		return &h[i];
-	}
-
-	/* No headers was found */
-	return NULL;
-}
 
 /**
  * Sample code from nginx

From c861b1e227360e3821ba183e13ebb2634886c236 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Fri, 2 Feb 2018 10:43:02 -0500
Subject: [PATCH 026/130] Create LICENSE

---
 LICENSE | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 LICENSE

diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..96b4973
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 Tesla Government
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

From 6c6077676b4fa9ba2964a9079ce15e02a0ca5f3d Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 5 Feb 2018 04:24:26 -0500
Subject: [PATCH 027/130] Joefitz/optional auth header (#24)

* created more tests, exit if docker fails

* copy files to support more tests

* Added cookie vs auth header feature, refactored code
---
 Dockerfile                                |   2 +
 build.sh                                  |  44 +++--
 config                                    |   2 +-
 ngx_http_auth_jwt_module.so               | Bin 0 -> 177360 bytes
 resources/test-jwt-nginx.conf             |  12 +-
 src/ngx_http_auth_jwt_binary_converters.c |  49 +++++
 src/ngx_http_auth_jwt_binary_converters.h |  18 ++
 src/ngx_http_auth_jwt_header_processing.c |  95 ++++++++++
 src/ngx_http_auth_jwt_header_processing.h |  14 ++
 src/ngx_http_auth_jwt_module.c            | 213 ++++++++--------------
 src/ngx_http_auth_jwt_string.c            |  32 ++++
 src/ngx_http_auth_jwt_string.h            |  18 ++
 12 files changed, 347 insertions(+), 152 deletions(-)
 create mode 100755 ngx_http_auth_jwt_module.so
 create mode 100644 src/ngx_http_auth_jwt_binary_converters.c
 create mode 100644 src/ngx_http_auth_jwt_binary_converters.h
 create mode 100644 src/ngx_http_auth_jwt_header_processing.c
 create mode 100644 src/ngx_http_auth_jwt_header_processing.h
 create mode 100644 src/ngx_http_auth_jwt_string.c
 create mode 100644 src/ngx_http_auth_jwt_string.h

diff --git a/Dockerfile b/Dockerfile
index d5854ed..4d61a23 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -99,6 +99,8 @@ RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
 COPY resources/nginx.conf /etc/nginx/nginx.conf
 COPY resources/test-jwt-nginx.conf /etc/nginx/conf.d/test-jwt-nginx.conf
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure
+RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-auth-header
+RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-no-redirect
 
 ENTRYPOINT ["/usr/sbin/nginx"]
 #ENTRYPOINT ["while true; do echo hello world; sleep 1; done"]
diff --git a/build.sh b/build.sh
index 6da50d7..019e89a 100755
--- a/build.sh
+++ b/build.sh
@@ -1,42 +1,62 @@
 #!/bin/bash
 
+RED='\033[01;31m'
+GREEN='\033[01;32m'
+NONE='\033[00m'
+
 # build
 DOCKER_IMAGE_NAME=jwt-nginx
 docker build -t ${DOCKER_IMAGE_NAME} .
+if [ $? -ne 0 ]
+then
+  echo -e "${RED}Build Failed${NONE}";
+  exit 1;
+fi
+
 CONTAINER_ID=$(docker run --name "${DOCKER_IMAGE_NAME}-cont" -d -p 8000:8000 ${DOCKER_IMAGE_NAME})
 
 MACHINE_IP=`docker-machine ip`
 
 docker cp ${CONTAINER_ID}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
 
-RED='\033[01;31m'
-GREEN='\033[01;32m'
-NONE='\033[00m'
-
 VALIDJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4
 
-TEST_INSECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000`
+TEST_INSECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000 -H 'cache-control: no-cache'`
 if [ "$TEST_INSECURE_EXPECT_200" -eq "200" ];then
   echo -e "${GREEN}Insecure test pass ${TEST_INSECURE_EXPECT_200}${NONE}";
 else
   echo -e "${RED}Insecure test fail ${TEST_INSECURE_EXPECT_200}${NONE}";
 fi
 
-TEST_SECURE_EXPECT_302=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html`
-if [ "$TEST_SECURE_EXPECT_302" -eq "302" ];then
-  echo -e "${GREEN}Secure test without jwt pass ${TEST_SECURE_EXPECT_302}${NONE}";
+TEST_SECURE_COOKIE_EXPECT_302=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache'`
+if [ "$TEST_SECURE_COOKIE_EXPECT_302" -eq "302" ];then
+  echo -e "${GREEN}Secure test without jwt cookie pass ${TEST_SECURE_COOKIE_EXPECT_302}${NONE}";
 else
-  echo -e "${RED}Secure test without jwt fail ${TEST_SECURE_EXPECT_302}${NONE}";
+  echo -e "${RED}Secure test without jwt cookie fail ${TEST_SECURE_COOKIE_EXPECT_302}${NONE}";
 fi
 
 TEST_SECURE_COOKIE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${VALIDJWT}"`
 if [ "$TEST_SECURE_COOKIE_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with jwt pass ${TEST_SECURE_COOKIE_EXPECT_200}${NONE}";
+  echo -e "${GREEN}Secure test with jwt cookie pass ${TEST_SECURE_COOKIE_EXPECT_200}${NONE}";
+else
+  echo -e "${RED}Secure test with jwt cookie fail ${TEST_SECURE_COOKIE_EXPECT_200}${NONE}";
+fi
+
+TEST_SECURE_HEADER_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-auth-header/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer ${VALIDJWT}"`
+if [ "$TEST_SECURE_HEADER_EXPECT_200" -eq "200" ];then
+  echo -e "${GREEN}Secure test with jwt auth header pass ${TEST_SECURE_HEADER_EXPECT_200}${NONE}";
+else
+  echo -e "${RED}Secure test with jwt auth header fail ${TEST_SECURE_HEADER_EXPECT_200}${NONE}";
+fi
+
+TEST_SECURE_HEADER_EXPECT_302=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-auth-header/index.html -H 'cache-control: no-cache'`
+if [ "$TEST_SECURE_HEADER_EXPECT_302" -eq "200" ];then
+  echo -e "${GREEN}Secure test without jwt auth header pass ${TEST_SECURE_HEADER_EXPECT_302}${NONE}";
 else
-  echo -e "${RED}Secure test with jwt fail ${TEST_SECURE_COOKIE_EXPECT_200}${NONE}";
+  echo -e "${RED}Secure test without jwt auth header fail ${TEST_SECURE_HEADER_EXPECT_302}${NONE}";
 fi
 
-TEST_SECURE_NO_REDIRECT_EXPECT_401=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-no-redirect/index.html`
+TEST_SECURE_NO_REDIRECT_EXPECT_401=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-no-redirect/index.html -H 'cache-control: no-cache'`
 if [ "$TEST_SECURE_NO_REDIRECT_EXPECT_401" -eq "401" ];then
   echo -e "${GREEN}Secure test without jwt no redirect pass ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
 else
diff --git a/config b/config
index 17c6762..317aeea 100644
--- a/config
+++ b/config
@@ -2,7 +2,7 @@ ngx_addon_name=ngx_http_auth_jwt_module
 
 ngx_module_type=HTTP
 ngx_module_name=ngx_http_auth_jwt_module
-ngx_module_srcs="$ngx_addon_dir/src/ngx_http_auth_jwt_module.c"
+ngx_module_srcs="$ngx_addon_dir/src/ngx_http_auth_jwt_binary_converters.c $ngx_addon_dir/src/ngx_http_auth_jwt_header_processing.c $ngx_addon_dir/src/ngx_http_auth_jwt_string.c $ngx_addon_dir/src/ngx_http_auth_jwt_module.c"
 ngx_module_libs="-ljansson -ljwt"
 
 . auto/module
diff --git a/ngx_http_auth_jwt_module.so b/ngx_http_auth_jwt_module.so
new file mode 100755
index 0000000000000000000000000000000000000000..6125fcaeabe4ccf751860dbcaed1a637ff216ebe
GIT binary patch
literal 177360
zcmeFad3Y36_CH)zNjf)BBu&=tBqRkLNCP2sAWNr#kgzroAZ!{HBq0d|WyyqqQBhGA
zi7|?fqqvQ@jDpLE>)?(nxQ)0Dj*ey=ok?_D$5B+2-{*6xIz&dk-{12-?;r2;KGT}2
zv)yygJ@?#mZ{1tnoHx00ilOUT<P)WpX~Y7FHl^HQxbHL^NYl!-pcad(PqRcerib&N
z!2Ld(7P)IE!w>6l;crJCG2X48-M@$^rI36qxzY-f_B!SEI^`mFEn=o~S5ivTqH*Wn
zepdVo_Z*w7Meda4r|P4Ydcyy-i2dii-X?32d!*bPl<P6wk@=r)ZihM7sqc7xsfn@$
zBX_4c(zax<$eucDftI<%U*SqN=3lY<+ynV*et2s3^Cvg4B>5Kp=$=^oov)cnTNss~
zqNDY#^;$G}gYh>Uf9Yx8#7>y}=06|)+vV$T-+tTtJ5mz9%xin{!N7(-53IQAtKaQ@
z{=i=k{;E3jp^h)(KYso5_|T8{4%(gh!T5Q9d1^k2ANLcb#c5Wg!H!fW?$$4q=zyWe
zh>Fxe(47$dS*bIQBYz?s^-J=7LH{NFd!Y4~<Uc=-{5z2UB|V3aBR}Oh_Cs8=@OSJd
z1jaAflXsl<)*nazImfXl@i=-OK92mz<ItBMr{2qtBY)~~=<gnfUJJ)q$2tdi@Hq6-
zj-zMpaqOH6J%fHh|5ng`$^X|KhyJn9`)XQ>t!#mP(+-KBQ?+fQEQey>`eI<ZwKQ$V
zG4ux@-(O4BnjCs0#-4NN8;+qr4|R!JU#*GB0H4kFO}ia;()T9Wgu5O3T8C~q^vfN(
z7k;CBjbnelLq8(+r~QZhv@7u!#&xRDO|2!%QQ+KegnqV53s^$g@6aopdbc_Cj&<m_
zNPE+??M{0md0kt)c-hL;s}`?mscmjqyjWYjeAV(6ZShjvw8hir&s<#J(A=<W`I?r7
z=J_)xu2{XQVSeqB6%97;mpO~;T5GAGcE$3uAUJ*9;<=87i7RT?tZ7)IH8!*^u4}Aq
zUfi;J@e&9&p9wSSTFz{00A<DMGa8x~uUK8zLt7#k3-y+V#dW7c&FPDm)-GS6t!b!j
zu4`P}*iZ|L*Pt2Ns%5QcR&!nLnufZSO%P~VT(@>j%j%Vm5M+A9SFddm`4wpC;-<B0
z8Y86_x3E$%wyC9As7<viXx++&m32*L3MIm(C~92XqT#xt!8W0(&X%V+b*on`MPrsN
zZfI^^ZEI_6X=wtzxnc3j)%9!PS<2NmH`ktd)DDrUUE9*Q__Q-xddmr;skV6yO0Qkf
zvOLnV70Xw_&D7LWnbaYq#@aQFi%)N`O&1Nz;F@){&C8`{S*l@8T`f9eZS!)CHP$!O
zt**B%6ZuHzE^co4)!K$NEh0oEwJVnOz{{FzSGB;$En3U+l?^{9+g_tH*ei6|niZ?<
z9uOCix^zYDvZG|%Ig3{}qj#mWLs(V2(rKwpSfj02zT~vpRcqF)UX{OQb$+4XXS5Iw
z5UwLstSxS+uWhMCh%H&O#twdvR@G}$E2mAExOi0l=pLw`um?N}jmj@_29|Tf@RGGb
zgvxacX}|n2v>5!S|BwIKC3UP!K9ihb<4Mbx_tQ|;E%{E<uDI+<ER&+ObO%osev~%Y
z!PllQkE10cf%6ktCq~A9r<0U-I_tm)eTPHea|}I#2b{dqBX5a%EqDyQ)4|J+p<4xZ
zfv#id<!QDax5JO<?_?sx$8!w*fRpF^$IusM+wwKX&{sM1?Z?p1cIXF=p<nFK)iHVV
zw+=lruSD!TVA=KVA87+z!}gAY1HI_Z5?l&I<{_kStvCH(FL`u)&!@8&y?+l?)4F=m
zy}jsP^rENtq95u-AJB^)bo@YjB99VeHywxWar|?v{LWtTP6$dZoyVac%(sNkwY3ci
zs&)3FbA288boHV~o*l^hq8GjQbHt%ubk@=Har{79q%X-+z33Q7Js)>3dY>LD;<FbW
ztCyaS)r)TSP&Lipi$0_mJ<yBZyWfMo=p%Z`m-nK__o9b;(Q|vzt9sEBdeN(U(cQi1
zHNEJ)*Kv)#=*|*IN;UPO`+MnW?L~K%Si;@Vi|!0*p>OR)cT#}RxAmesDMRSnd(k~Y
zu`fG%(KC9{clM(587lJG-HYCPT<qyZ@4Y13+l%g`22mB>_)isXkGU(`(!!hfw#0P3
z2y%GiGwNx(rXxicWLesg!JBYR$Swy&yphcA&Lj8?K8rYqRrdkGn~5`}bng}XG~ygu
z-Ma-}LYzaPdxzjB6Xy`_-X{25;v5p)8w8(DoMGSHB=`j490J`nf`^DR^t-DBA4QxY
z-(4>FFyajL?ttKfh%>~yEy2@?GlaX{f+rG>C$0(Jhd4v9`-`7I7;F${=yi7r{`~;p
zOmW=@1pkUSL$G_V;2#rb=ymTF`~%_)t?nIy|Cu;Ls(YK@uMuY`b#D;-1>y{$?k2&X
zBF@n1t`YoU;!LI8Rf6A3oGG-sT=3h8Go-o$g5N|ulei`LHN+W0-EQFFj+hz?vCuJY
zE^Z6LLl1@9J_>I<6n}=X=xGE>3#1t+UoAS)$#{VLP+NXbFZm}AMTOg*3P1Vr_^^H;
z{OX~#QaEL?6n+hb!)?zU`GDm&jO#||X=`)C8^=ur8&$S_)MBFk@4c4RH4Yx{YQ$yH
zb1{1%sQ>F}mRg#hki7{eGgQazhoIIn1jc=vX&aZm0Ojum8M=-fSk!$Y6eMJCpnUfX
zz(<R3Lv{b27fyKmeGY`K_vnFktvz#l*WYXqtk=JpRHdu6<2okZFg9jgR>#CAaGUzv
zWLEx+D%g9<qNk54-1y0fdvw&Zb&+t%OURz2X&XNY9EV<V4E^Wrt2m+U)hD~ND;8AD
zUoa0gy6eO3(Sw<>!flgsP<uyopN*Y*>Hf8?n_oM3!N!mE%8nH|v6UV5Ij&bf4!8X)
z-1cK-M@y>iv_IkTbF|8~&%zs@*25d0HM-0n;hM+KIa1m7_byG~Njb4kc1HJ^l;f%_
z{nyrsN7lYnus7UZnWO5%qfM!KZ893}K4nqG!iq%|r#`(09zF8OyIlo`j~v-napJVL
zKUJJCt?e5zIoz?jX<orQbZ%w)>ZVUT;g0B2!q7jnqdrEPS-L()wV>-^%$P;0`Gau#
zN_Tkkr!A$G?JKo{y#?<a6<hoEwDy)9cV*kRU0pw*mp1QRyN~{_Z0n3zQnC2yZIcT=
z{G@B!(f(KvK7St<IN`Q8=g}MN<yO0V%gAv1=y3blD%{qDzgBm+eXSO5KSzc4Vd2Xn
zO&*XfG#~Y#C&T;pN>jf$s-E#<EAChaheCM<ybx~ta~M8u+t+nHs(LQk(-RBZD&|jX
zI~;ENR^qPfz3(Ahcd)YUAK|w5x;klBPthfUJsEC0cnXHg3l$3`^1~a?Qg~p&&7&o3
zI+tc{JS(WRjK|G7(qiG}Ke9G4+&;@syT3aUPM8cG6M)&}+h<9GdKlIxFUdG=pAzJ_
zo{f?L$Opr1(*vK}zAfB7MUj4n)EI7$2M^Bbvv#W;*Wi1|FF`psc<|VCcQ;3@!|#Zh
zgJd1vHz5F9;nNAh?m6K0jNgu!0-G<hIW=?-`#HbA@MV$8$|WsBxjp{j#~&Xrhh`2A
z%w*?zx}K*~H}4I%J>B9Dcl5hgikC~W5AQ4YvkMDeL;pMh27;{XA<CnN#nW&SM(fcI
zwzW<ThTBsv^H>NE{15MrJ%G6CM3i*Ruxo4SkE*hzg&34n*Ap&ZE$tPL6(?4l;0)%r
zAHwJVb32Ok8q%9`wu(_mt1n{?4DXwi6QG#{$~g&g)Ca-cLoVPj(q31Z1*;IgQ~j0g
zg$EF(2%RI-HlB+qd((UvIjwz4U|RbL=+j9#H4sBn=jSwr+ncJw8_S{+F3jZsX(w;<
z-h@pnQ34siU&5xTHlz}^yh*5?g*wKag{mL2ZF%cow<c_UNTi;M4R^FaL&qb#iAx0?
z^K+WQ8@pnq-mbqMqMr}_kg(}O(ROxq7$drgYFoSBAhYdR4E}^oTun@CUxx-k<kio*
z_JcRA{ajB)`w0lK=ccti)0F}eZ5@Y&MYw$;IzG~tvq|ZAgk!$z(r=we*w_R#Vbcxd
zZG5B}Hv`?3D;~DT`o3}{er^l96E>BI0jc4(Di7QSZ&g|Fre6<x_ipU03&-S({TEAL
z^<>3_&38sa{rS(ZOM9iH$T+c`r?Ap_h^vion>g=InRAPdpy<Ok`Tee)-#BJJ+k)Qe
z-MGi4qb6I(R37n8M^$Wi<7cs5zhO(^zTVPX?iSts?t$)UZCwSgJpq6LzX!tImxGy*
z{d4DSdD<?q1A<4z+bF(E#LKlx36qX~>(P#*B1<XqFs6@f2+g-qn(^AiMOS6V;P0eI
z#yth{<0LT}TBo(Uct;<jeH-`e0G(@z*CAV(FsU=#zVRTP+!mb!kOPg<s_QTRMmrH_
zO<Z2Iz2EgI@y&auwLRP7PI#~?YU2l08@@*mrod5^?T@sw>h?P}P;1-w3{>d(tl&u3
zWV#sPHM1jcDyGA(2H?Vmn4P*=pQmd8=*Z4pMXaZ8MUHz~+rDr+jY4R4wD=QX9b>Cf
z|EW?(#&7a;rK1R<S50e20PRDkbZtlBX~>)pk8f^hS=+p7F(%t^-IE)iG{bsVxbC~Q
zO8BA89o9cb?FhuR%`3)r)u9k(U3X=BPR_%jk!(jxj;hdKnO3*2V&lFj6rEOgWT{i^
zgXhYPkzFHEh8^UY*fBP@vhCw=-4RjxTvrP1w@nSVHCo*xIMp-LO=H^bSfAssZ2N!>
zf3>@-^lN);T}E&HETC@T+}6?WN;LRr-=7B6-4}r)`oP`=Zy#mPAp3N%?Qu}qJ{fC(
zev5u4lS`Q#n6z};<6lc(zu&bHRyY=Shei7a*aL%LYnKbmjfeCWWX^dQ`^|P9+Y)Wt
z*9Z1hwCz1=!#;?2{{u;J>9+O&yYBqIbBgI&4f^EvbKr!v8074$iu3<L4*H?%gMXpW
zb1+J(40ja00?WFtLy-awwXUzg50^fBPTtRbw1LxhN55MkeAIv`G+-$?G#|RIr7jIr
znW&yk*mRAw4MBxqtfpoJd4O3IVKzUf3bD?Btm<0-)lnrUQ^_L~=4|(DOQA$16r?!{
z%Bi503NT(oK~vWlC@9$5Jr2fnohQnUCYW`P!}8G2diP?e`sB8sH*r2(1i|i~HL(tY
z-63$$N1TZ{1ENjbkHv;Mu3GDewQCxhm)8SmSjjE%iUsq-v*%7b8Ec~1v$P8AAFpm+
zepYSE^3|(;j#>7udB_^PMw>W$_Kazh$7$SDZ>YCgR$JKZt+#3|Yy|fr%BHi>makfe
zoqkBHSO)bijVrC?tH`hh*J}-}O<GH1gP_=Uwtz2hZm8GRtX-msjTQCv%?)eTXqBt$
zY`dHtW!ZY}+406E_VQI2wOS8_+t)ov!zylE*B>RI3RF|qa+D$_N)3y7%%Eu#n;U9d
z(7s5;)<o<^FJHE{**4?2CG)YZ&z4PDy_R0-?Ni5#mLtK@gq2Q@8=09P(rUqWxCoAQ
zjy^;#;-&i44Qs4bt6MDWgSXVeleHF{bs8J<zsRk!#G_WN<5F8bm{*t=%nJkx0tNE1
z0pJA@iri)K$P(QBmp%R-?>fg4;OQArV`^~cBs2f>BS+TbUWgFC1@|{_{~GsA2-C3$
z++>Wsi*awk{ZZU+!Tm$rKg2y5Bj9VKB%Zy_M>e02`z^S);2zl%($AW!>8)-(!;Dqi
zP%a0$Gx2xevm-~o0ItQmr^I`vC-gl-ZP3Q2j~O;PXAr1bCH|0hwXI(sIdVA(74hyZ
z#-w=9#;9<-)zT;4Gcn#>5wB+SoedaFz*Bz?N60KKx~{<eAoSf$!i0GDCC1cvPe;^*
zc<bWmig^E)n2PwoM%SeHa-*$Jd;pY+cxytu2a*%wRRz6e+x0H)<?z#H62QIGm>lo9
zBx-WJ)e$`*-hVOmY;jGF4{nT|0%a%mi4RT^eW<BN-vnD<9#rJP4;!Fw0rg2cXRw`9
z<E?c)ZF8y@|1E_4Zpi2N$ctZQ#9OEIw3&K0L2eJ^#!?P;Ud;AxiJBB|ZH#Ud$;t6t
z%<;qix*ziUAs>r-<iq}Y3HV;b!yFRDzG<`%dd`XWOcK{ipK?k%1UdGb20E;dxJ~+#
z@#06^e1P?&?KgPi68gWl-zw<0>G22jsMmFP4!%TB^!D6T+jFeszn}kl;J+UDuLu6?
zf&Y5ozaIFn2mb%-fynzEk@q<wEsea#5m~amhBX#H5&VN=aK3}Wk7?g}-aqA@8b6Wu
z(<1L2MBX!roV7;Qi;;H^BJZ1UP0vq+|L>oUtR^mNeB7}OCZD}r`{Co<v}(tm$l3cC
zY<Tb!S>t(ZwCA0iz4?|<oMPGm2Z%gxaKDwG$XRlg)36AAw^LEX&K*wq$U6a%`XYB*
zo2FqKK-v@WE4KLruW|I@f&ORwFC6@^qxd@qPlzb|fBD|?-uE$jPmtpRJij{kb<TZ@
zbHCEL-|E~SbneeN_qUw;-<|t6&fVp_tdi>7hdB3Q=RU=`pWxh=I`?(XeT#Fy(z)O2
z+#huA&pG$EocrIM`!~+r<-EL*>fDDo_hXv>e~qI5e)c(D!9l;WdvJ$kOGMs_io6FE
zo<G0pcxC^;K##na^}pE?c~2|yUY6r_E%H7Vh7HgDdp=HB^xzR7l4m0CYaOrLvE?Ip
z<b5ujQ~Y9mR-_{59<ej>zSr@}`Hv|V8Sjzz!H#EV;Fxm%PtgO`|6FqF#EBuxk8dyx
zwF>it`9;>KKtWNUc+_aiKNs6w;o26PKBAy_sJv)q=P^62MP6c_9m!V5)WyvKLrX$V
zw&f!)Nq=;VTm-e{({@JWBQHa*hzJ~Wx8>iwFCrfaqMPjMj*+%EgbeM>WqQx_@pF*`
zSQ;%PrCVr|{x&YRqs70}P$LaYBP$5`C|!+#RFo0>E^pDXeZY!Ru`#^qu5rSPnFdLt
z2=k8NUkNZeI)*R1MyZ%@$rwS##VrI2Aa8UKgpP%{#VD8BK~#55BF{^`14n>jTsjn*
z-k3?Iisft!eP02KWu7`1^Gzk>)v3AA@hvOW)b$|59Om}6QgE~u^CMxm;t4>^PlP>c
zGi8ntw&FHXM$?J-<Hiut1qsAmPQ(x-821p1L<v$Jw~@MH1PRBDC*l&MDvn!8F|mSF
z$K60APTz#0HF5ECfb`Wb0@4_F8O!w3X>n8B0wVndX^9)mdXn_B!D)?q8SRZp)5inZ
z5Z6L6k3JvB1#vtBit*~(aN8Jn5R-Du0G(6t*0`bM4AHkhY+KytL`Le{fozZahDbn=
z9dSPrDG+35Tr^dW5@dHAzc~;yTE7=%_QaJ;08%8j?Tx#FWlHp0aeGGV^DyPEjXevP
zC+0>rQYDgf6G2U7;~H}_o2yhDcCun_V{6@-OU(n#rCtQqcLy#s+q?__sq9XnJ{X}U
zf%+(remg{9A3-`KJ~}SoM|}yW<Fdg>cpZ!l(FwN`Qwa}1VuL$j5s6kpH?h5%%s3l1
z=n3<Pqs*Uh*Auw1FcKPYjZWyqRcXdDlyi-q0>q_m!!=4pd!X3O)tl~OLn0%FLBfxI
z-Qy7GU)Ko!4xs?U@f%Qv)+6{!9O1kW7+I6;Mv0`y!O;~}UVz?C9_7e%a-1fQbFjn2
z+|R-)J(;3=9s1pX`O&Yt84~^R;y488x-9(lU$S;7(9x)615v(!Zx`ocHia+i>uKbk
zguhgL%|O$=JD|+CY)Trx)~2W1*wmEO_4S&b$%<cqXyPYM?I(f2&u>t7%5qH~M2R{e
zo*ZWxS<bpa@apr8bMOVQKrcFJ>ro(iwL|QO?4)JPMv>T^jGK)62<{Sa6<Ess3{<%k
zd%Z6&ZvxHKGM*u?{|i6{Ohd7_xu1yGmva3U*M3VNF(4Zy;;Ld%iAy~RxvZ-}(6pPG
z68VCFlM?SY?UZ<IE<X<<|Cthvdq;wtJspbvFS6q?De-~XD7(2DWsQrdW(!h;W*i)Z
z%Y_17GyvdM5$J%Ej5Yy(JOSWEB5+eNz;>bjPx;lj8Y9NIqJ`=QB1IWj5{yyCMaZtk
zO+x>%AHdrL{Jsp}0|I8v2e^lzOYtjOkqn(i)1MZRdP+Yh=Jd+j_oG2kgE&x)i_wax
zQ5;4F-@1>gex2Z96pLD!M6X^8vFI5ek;-%*^M*92gtE^tq>Kwa0H0-Tv3u~QqC2|v
z4R%=GWRyFL<uC>006sg5WG%KN2q9P2cM&0%Wear<K|2P1LHT2*lQ=dm4N=kOJ#e$N
zzFssiwy$0ca^IyeH8xS_SBdOtM}5PgE7OkZHSMUwLs_FtJL*Tm_OzpZB5Y4P>Ih-W
z+$2WmMEoYF9i<BrFqu)5AxO~Vw4<T~DK|Oos2D-QCZ`?c5~RvRpK2;rkZSV=B5`^b
z1Zqr9JF2h#8IVSk(~fec9h1|Ja;6=V(~e5g_oHa5$!SNW=?v-(CZ`?c(H8@`z~r=}
zy!zLmZ8SOUr~!I3M%Y%9(~cUVvun4RoOTc{KLFWoa@tV=L3Ws&c2t2NJ55eIYLp<m
zO-?&%w0;Td-eYpwQO>kua@tWPdLPvDjMk6Sj&i0Qbt4-o(~i1{pgrxVo7r4@+EG2z
z&L2QS5JQ=CHqDmKCY9YO)bt3I(~boso`K<#{OnQ%AS5s%Cj)TzT)>|JLjOd}U%0yz
zdo`(^GIRk5CjpLKh;ylJarwhzVB3ZBP+{O~a+Ng^aM5)H)jB+H$Blaouv@L03%HE)
zut%-U1YFKZJyX?|0Is+Uu%%9e;<$-4DM!VR06dvG{c2SL;OXqnfVvpNByQG^fP*Tf
z5O9@(edX##JaWgKayQ_xx&uQnZXw}n^(PG7xJ85;)$QqkPov4LS{z5$7=Yq7Lo@D9
z2As(-iM?(#Ebe>d>1^A^Nf<NRDX6JoCj!2jWW#pw*^%=7;Fc*sV*5@-QS-CM0jusA
zSPOh%7Y$SZ{xaT$qN+R$_^W?IBwCI01OE5Lpktz*KOE^jfZ?tgFTjv~1++${?|!2t
zB?TbY?<`3uQ}N7UX1~EYE1)mhw5VJygR9IzAA^jNpCP8rb<YDycAIZZ1V80GxXFA=
zz{jA{JUEZk+t7jL+jRi7IGRqP_$5J$V{vi>kJaK><(dc{rN!QlhcdVMnl$0>tneK#
z^=NTy$8`}w6lA~N8Ns8qWGg=BMW87+VtB+4iA5-<yfheKE>ojsyf_fBp9PFVm59{T
zrKFyK=^`Ob{L+EmNJtmI{H+S$0Q8DxJd5B@kYpK~T!g@I&%T`_`-Ew*a*hE|Q#WE8
z%RTp>(5%!1Uj#PQ%k1_O{tCKVZATJvpZFHwM0G(3a5d$V)m!K<_sP`bQ70z>K83KQ
zCcpys!fzqtS5?%xnDl@uLnykJuxwDhMS3IQv6}IwhijUC5HjN6{lr<!*G3r<b>i&z
z;bNmN=7z*7p+1OCOG@}FWMg*$+@Jhj29|kB&w@qo?*$nd1@<O)5>_e~A)EXGhpk(U
z%LV))=^izS@JEC#wHwtZ|AVk!^+B7GyO=BjsdX)_TJpyn=t1@MBG5ni63=tx>N;4H
z{7=e<Rhk0)*%|21DixwvzPK20wYmaBIr%HXHOe&z@V^K*Dle8+$zNX&xJgZ8z5gcM
zs_uhtlD{RqLA{S*n*1FbzEyof_<O?J)VG9xAiP~gA>@+}6W*Z`2>(cUr^+Dw6XD$|
zm+%q7d(6><HJ!*_&3FqgOL7mvHTESatx0Klnogv%Qr6O0n(CMdc-{3GbmF`ez^#?I
zy46SMxRf)O!v!97FB+C|7GX=pV!WoDy#x*LW5u~lOIiO7l8EiZlyhw-Mh}I|d30R4
z+Ky5w8*C^3I3Mr@C!%bXnmz>ZM%qxV8CP4dv;QAqTUrOeCL?voO02Qf!g#D}bGty&
z#Gq6^jZji?>M&O9R&Py!%<xz&`aJ3<44TvttgKP(N7ST_{GRI6n>m03`H0<Cb?sol
z1(eyKhAaU*TEnQ@sxG9SLejUX4RAqf5#jA>!~(!2*JAwaP$!}G)FA1*)jrx5N=16z
zqaH@0PaQ+J({mUON*za7>7Mn-`l)4H><4sD-WVX`IfBBv=V_W(u@hoVx@VOe$OIxg
zb<YkOIEj^X>Yl$v0hvssOZWVl&6vt&e4%^#!9l5E6UZUmbKg85(}-w>XEv>$!ERKB
zhy9g0b1_|Ict+&{nMK4hJlhI@%q9{rJij4QMWo#DoE8Eyhe#C^(5G{W)L_P#RD_;N
zY(?F%r2wnaO8-PV>b11cYB)zrU0K_zrH$btz*76l(V=76Wqy@_q?I=AEWiQPglk&a
zFkFMG2uriH@n6H(a_QEza&~K2GZyBdrlb#8Qx!nBXAJu|m5)T8vCpNUE|mo5ctj^A
zl1`+?q~t`%#J&Zv$~)>R!0IH#y>~PnsHu1iN^jw9bc}i!1KL|$2#>i{9s0r>+z6XJ
z>c{zjLvtZxsS(iQ9mAORtJkLk9=9I!fSNP|aG4$JHC2G8FpkT`9&gyO|5J?gq?DUz
z&tCxgQ%-u1_Ajm1QcivoO>~CgDfFyTN$9|oMg1@|JW_4SsZ?)iMkA73QffEV6ruZr
zDKpFZMaoJ~YLcf?X0wUzRD91^OR4&H1@#oyK<6CNEj7#lJeROveGJE^%%lE*W&}q;
zf7&$Yj2!{+K)QP$V49iU|EQViiME+HAkfp3I$^R$RHmo!-S3_1E0jr3CA?dDG2KHi
z>`AR%zFJEk^p6Z=Bk$ELJD77<w4S}+dk317KEy_|_G`w?D3IiNjfPwWuqGpGNdg+m
zKFG+Xv6^>FCE$UM2IZX_4b<moP~OL819cP*P~I^WK=W*Frt&^L257#GW+?9!L<?**
zU3mwwtgJVpb+7VH#{kGEwz(da-mrS9mJzhkH051{)Rj?cqp8YUOEbpUXo~XIAUHC{
z+Gw)!K8#MwD6`Qd<()?1avM!l-r;Cs#zY(Kue>XebTcN~s9SmONdr37MiZ3x_ekm)
z(`_^!=vbgLY_y;9n&`cZnKo)F?^}q}jMHtjuadCNSoK9B!=3YH##+XLM>;Fx40e{K
z&dvq>Oy(!QN)7{F&#YI4$J*iO8t+Qj8oLhQ{){VM25fiDRnj%K{_WJSWSC`Ky%)y2
z8Alm6FpfN_cr8-Pxak(eh^3N>p#FBQQv7Nto-Q-)VAM5g#@~=IlhO~es@DK^WuEy#
zf2XR<v+Sy(Fim8h&0MDxBO-G>VW}$f+!3rwJqS-_ZirdMs-~kqGS5E=uwPw_L7#cS
zNWcNr2foSNSPwWTxjb|8z9tUhFZ+UiAwxMV-pOpEcdBIm$!upbtCkU$*|8EaS);gc
z&b*YX;zl(ejmX^Q!&qxlJU7U^jKii?4Vw-4*MzsKJ@9Pi6<oM(PhGQSg_e2M%cysU
zx{`XXp`M*;7WG_9J-bzR2H@+N@b*ZrWZuAD*{iOo2K`1Rumh@JG2oloqX)g`fSdU{
z>3HSo^geY8(Axx!O6inf&D<rZp4=&+oO!#ACUtrXU}5GRHk#P!?V?F{*=YYxFTbas
z`Fk66cY67i#>~5IG@;Ymfq={0ZKLs>UQagAdu_B|r}rkLz|8w>)a>*w83*)!L5)70
z-Zr8S*r@9C<{%I=|6mKpc522hu#+-B?T?_i0ib6<X%+%a)@=hq^U*+Vel61mjA2hH
zwE#geU@WH~w`QDPfU*OILO%8cfZ+k<5~NK311kQC2|-gw3IR``9;J?;rv^-V0G@Qq
zR5M^QJ@2t~PO+!8ALm0RoCweR)mMb4Q)NKynF)9X;h@)tx&}C-F}vLRI+m>iX3aru
z(Rx<7mwh^5wv7%b_nw207*J)SndRP$F+k_oXhymBuT(qNM$^kR<9DObqU;|~jZ5h;
zB1ytu=6;vrFfx4LC0PT&b15GsxMXni0s@Dw@zw%tpDjTIX~qn6RMu(J!OUPV8GnRr
z*>1*?QIDo)CpUl^+lnQfKRfkdz^QyyIXi7OKs@i~LBvC{Qnm1VwwJJ5)u4QKI$@9c
z2JOktsFZ=vbe^3_cpz*!8GK_Y#&fpyBEZ;_0D7_q9|o)zmVi8j8Z`APCi?7L!b)w1
zC$jw%LGKn10x~ET-R@HTa7`M7i<^Q+FPiZ>BGq!!V51MF`hopdLTRRZkozP^r*c<y
zP=9u<ozey+lB}SSW*XD5KpB)21PLWFU%)+GN(_)5$&A*#!_c{dvh5Cv(!72&eUN3N
zhUR?~P8{S+TDs;<tpGa6=0+;au`4uwq@uy6p$elFz2I}xPGbk`_VwpJf$<E%#3eAx
zrMMc(4CJ^gFz(bIv@oYX)oAMG34jyX9{aH<Cy9y2Ekh(H*-rJFFdTDI*vWo8G9v<V
zQV&DOrTBbcEXc=XJ7N(OyHp*n2~^CbkDH~%Yi{wEk>!VE{)HmR1dznVl`Tc(y+mD#
z%Q52`Oj>DK+*vW^PXuT^jRLV106l4gxC)e+B+YjhK)XBAa(*Bvi>tK36yXuX9^8$K
zp)qY}3=(bZ*#O;X!?~ukCG!YsYVQ<?j1Ubd^*u^uT4@FH6v3gMHcEV!${$Ke8!g>n
z7cZoUTirYoGV&ncL2*8l7+niMDh`0{Qe68Qe`V0hK9TVjsGh_tagBWmmnu&(XTj8_
z)oV0QirqV`)st%16f=p<=2YWW-;?ekj0GU_fhV0ZmRRP=AnZ?Vsa>XdGB-eTKqgtw
z0ICnF%Ss`i#Y9!^4I{ukPJCsDy=xH|9={!KSz+&-X+VeD=zy^IK0I-FM%ZX(*xLsK
z)e~7Gg}q#pdPdsZ^sx62Q-KC-)Eo8=%?0YLpgdvk0NOCh=B9<c7ZWYC(bTZ_H3}Em
zXi7MB)!LPsr-ad62`_R%>r(A#R;Jri@hLqf0uz{q?RfS~lz2w67y(6-UV@AfLJIdx
zjq<?RK7dW0S>FM+9}s5C141f(Gs#oMXAY&xhC+G{VYeE5BH+1%Ju**u=G&HKTe2$k
zEU?im%lj9WI>AN<Sl)}~0zJ`2GcE7F0YIy5G{Z{gV%Kw$jiy^F&>!4|Szb;P>8!Dl
zy&I5)gy%HIS5RHTo<5!JELS7YD9;KuKWz8(O7?WMYKD6}tJ$_1b^36?O$=wOl|IY^
zGA$YvxKtlp6R3yvNie$EKFwG)8A3CLiqJ@0lg3j(E({(NJ%n4P-_vpt7^(c(D9>6c
zDs!P{9m)3NlIIMWN9+c)vH>2&Db8~y8)iWj%NgG=0?(R^V#X|t_QCF30me=M=pLN-
zBDKAW3^h23pgmXzCkq)0xU|Xi4{^)m^L@}Zq(2+0se1`0GN&j>a6^(95E!6{;33JR
zd&I6GDYVPdj1#a>7?S!b^chD$$#v&JGWK(Tp4`MmfECr}CLL9uD{AaSlbb>jCYph`
zX9jb<d^i`6<ffAa!wXP6gKXQP+)P?ziAA{sB(;h~xmmObPg+001G(9C)aUlQJ6Uk@
zR0N0JLYapAiTqVUJ8k=uDAGrZ<1F+A!T0D1&1gch^e1!ZLQh&|1`5O=P5C_p?cw70
zil<=yAkbWj#f=+FAe8<C%X$0*=CfP|Rb~05oY*1{T9{Y$LNKh+U}ReU5f}H!=G(Fd
zP62x)$!@iBG2j4Urbwza)*x2>1&aZ?6nio=;9vMIFuT4*w9Q^c_)q23q-;MdChSoI
zF&p`7B;jesRT$X*+M7ia9|w(B=41XHaYzV1;hMk+zh5Q{`9YkcFecLT$v4(l036Aw
zCbK4e)ON_o##j1i)?-im>4kO_ErS2jizwnzze9>lFZmQ20_rUc|MVc$2bGo!xYPp}
zL-j<!A=Vg{4YBmGw6{u~feAc)9NSl|#ZmQ6h(|Wt|BM}k^fDhP18_1swF1dQvUqx!
z2@pH&Snj7!<4`)Fe#>S|r^rDGqVyRIqE6L{wO@KAcN@A?)G)xaSlJg|?sBBtD@f%z
z<n5px&I&T^khhtooE2p1A@6yWK<C+cD&-LRh*lbEFsSqI1L#upP~UFMPD6|JdKi)Q
zA>iy8i1_lM%k}p`F&D!fLr>GI>2-7V7$B$1Igm2>z&dn=aNH)B4?|Z9$78;QiifU}
z@|L-}KakZT<~I+I2GXQ|49x-4i!3|zS5hVjV?F{gK8R`%#{gZ5a9<iTv{_#+6x4{p
zFf45-+O6h{)3jk8f|{y=)G+Tzl2Nc)gulVnxMM09=?V;&D#A6>J>0#FVsFEr!~2iN
zLQ7LuBHIp6BCIr{3jP_MGKI3`!##iKkxeJ)$Yu&zMI}O1QUEt(R%*kuxasdvry&A{
z=dj1vF6uQFVF5dQa5GdG8&N9H%_oJ}H2^(%iP0De>N2<{FNqtvcCyS%7P2JKycE)z
zruL&)rj_TN$RfMY>b!K;qp6i+0cQ|a>M<+^@@%`*bTlU~i*yfO*O><-yAR4{?#~;P
zZb6uS$n()9n)-7T;KBA#c^_8i4I%7NXZr#BX^thSF>fegzs$9H!)Q`Ky;2UDJgN+<
zM_H$A&sNDACvPN&O|`6X@&bfw)QcE?d7~af*+%sPdNQw&^qs1Lbrmre?)F}Z$j>Wb
zr$_5)yJa-ym2x!hk%e%cjLg083cX=$u7dQKS!|p&VtO?!k!SW1Gx)5n$us+iN<M4b
zd3VH2Mn7`kv|>#gF>5&F5jnUTFF-!k+X6855r9>x10Dk`)u(2$dM$NL<4P?xTbAVN
z0?cx$7Da+GpQjF_Ou4$u2l^m-K8)=*jJMQ`{Sb1gKjJEL_y+*oauKaAwOsh0$@Ocw
zlHpREk6p?&kk_}M(C80BzCR6wGy|Y!<X^EF5hi;q`B%y_qI!1>WMtdM-bl~iE~|R=
z1EMqkTCO2HiaX8uzh&;WRKJ;kZxDOct}?(kazDFDy#U4eH}Mg!QLV!hL;fwKZ&Pzo
zD*tz+?^N%N0(=|k2h?lWHp|~hdY9*+$$)R?Z12`Rr;~995li>n%G&NEf*teobAkMx
zNV)F02$tpFO{7Zq_>l1OcN3}6J^d#FxsMh$>7F~O`hHf~s(W6H0`dUs+@^bC!$2Nn
znLWB^19EQuABgPNJ@+6n<v+{~;Dfs7eT@42M~HOlo_Gl4KS~7q?|jh9e~ic%x`!z@
z{|Q!lNQe8)f$;YBsh|a~gkxei1MJLy`UW4o&wc9rXC48lDel_kKP#Q0V%QVU%|i3t
zw)da6z5f(F_#$CTrmXyz7?OUaP)GjDgo8?Kd4;xwRbqe8573k<l|=Z}`OsM{gCYMl
z7y7a$bq&_S`LCakxZSF}MUZ)u^4rz9g@E58yhEKw_)jOJ>`r+M%YU2Z+XF2B&kVUe
zDhLhv?{L=Ls}dL`e_`4E>TK5g9^nIaw7t)0JE$2?j0YohI~3uR9@ixL!7a|fq93lx
z^yiPGjWR0p%Z`r9{P9OeWq!GgN;PjTv{i7GWU0wW<oOc_57La&X#2z`p*z!)KV>@g
z@t7-rD$8khxiDqjcDZSU6V*P(#B{>RnlYdP$c+9dn;FcX^>~jCIV5p(RQ1v^r<abo
zqC@ti^5?U49wptl!0txrq7&&JzuiUEbrwQgGd{*rBLAcXs4H3JH~oZr3Lob4f5r3c
z6zR=op?*CZ)HO_oDbi0Z(Sy-2m!h0YvBAmi{Bwqam~v(xh@Q&>>y(EW%;%8`AyP8;
z<S(3v9=3yT5r>8*`-=IeaxnO9uhp`ipb|w5ELN`W<QQpWE31?X3i6i|o~yp)pg5iK
z)#^^9%>0#vYf{&0`D>qtRgE$s=bypU-DHPqD@!)pp?4<X7Ig=;pGA0G>e^y0e?uRb
z+^Y7_{0m6ls$?i`X2fr^qkjwG?Wrv-E42Izc|^Y>y``>6%Wt!1hU{Cs-(aH1Z@1B`
zTkK4B2|Hn@ywH)qjUBaHGg7g*%D-$Rs>Gauwjrm&a+hKV#16q4#~L|d7wGa_I#S-&
zu=D=NN%NxNKQ#&?YUJdV@TFTlItB0)!pZ7;%w{8}4u=e8*}r;#glnM3s4Yk5&wB!3
zELU8fg3k{FR>NRU!51uQpXwBRNjO@jn1Zjk`caAtuYyA@pkt1D3WWpnsmEB4ssalH
z9E-6SI6=T=nEV1K3Ydr4G*B(zU1(|GBmtkY0G=%1Ye+kRQv~b`09+{Gca&Wu;MZ_R
z;8X!S;O@X;0soBkSfED0(-#1&74Y#B04@>m{tSS1Y>9De2w=T{-@|2rWly0su?15R
zcm=PeV2V#&vq~#?o#*mcp+`WKx@vj7R`3SPxos!CNjTYd%v)TLdThu1iF8Xd>I$K~
z)q=+C4-k%?QKkAyAXdFLDx`0lOre(5P1>lj@@A|uPamjhqsjy^tyK-nv{B;)amzw?
zRJkBX5iemv3!K>sRaw8r$Tecv;<L6A|1=DIGkP#^_IBXe9k?`(nxub*yM^B!9yM8%
zXx7}h+NdcyTdS;D+Nh}lTGlLxgar;-s{-1n>H3whv&uGLrj)J0vlYAfobOn{lM~sn
zMf!-Ls9;?~vo`8fow2T2wasY2VtYMq)h*FRHR!iO7XqfV6vfXAqC{+fQ8{|%a=_x#
z(X+U!v*UX7Y(8TsIn5niB`ZJ8_&wWtehcKY&xgCJ3rqCj7+@AVr!Z(Y&OAIx(+c5i
zXo@yZK*Sf05k#3oMgXz>ZAzmG%bbUV3nqY5uK#Nq3^ETxb>T#v@4HwgPlpSq=y^c=
zrWZ9AhDBSztVd84PS-2J37QkpD}|MUl$!(Nfy~mIzzLhXFtQ7)#1mE63CKeWE+`&`
z7IZ^uXW=ut3mL{d!aAST*P)1J&RYoNIekYM4lqANoEPqwI^AYL9FXS)Nw!umU#Atm
zpr4O29*gjc0{bnVP#3<WUj_y`5<6XmFH4bX+n7I!F*UYtUJ*{C?T!QDjwW*j5>DZ(
zBGzgy!+N3cH4)ojet<43d|i-D=7Up!ydm{$)r<*nbzozEv?lfr1V?M(Ew2HVld8hs
zu{Sg|7DKY|R_Phlfq_^kZ`RovrEn)I#o&^z*!5?$-J@<}ZMT01*ius29ZBdRzxr?n
z=ywJI2juv^@Gi;+)lw|63-4YEdbxU*e!u4mz+v^f(SYygYf)87!s7wjP_LvvA0*tU
zve;>R_CUS~3vEn9flYsb{n-=PV})+L6nFDYHlV-$IHa6zN_4u3NwF~52`2;XFH8~t
zdCV3zG);dVWh_%#<ki_Ezh*4M_z7&D1kJIR%tr$XH{S!;cG(u&WiKJ*3oo=?b`4|-
zw-Q$BL7Ln48|ZN>iI<BQE*|wKq}#%)Lx3&Si2atrYbftm7t-=;p8!38S7b4h2QGXR
zb!A;tjGS>Ud=<FpCE}?ga6B<7tOYK9hh{yG@ZVN+(H>A!n`-N|qD!exlQ)@)wh@j_
zZPJP^y9=?VQkQ8(mlLv6WYMo%!1t*2Sbr5=LAs^NQC-n*2>T^n7F|gl0re=BVMSMs
zN52MBf29>&O^Nc<)3l;%2!+)&4C<n5Isa5C{y1OJbu3q{`XYxHT~C=BMfVi_mh?uo
zh5BxIyMi<R_2qzf{I-(s+t5`-H_}yz*jF*=0v%6}Ks%SiBjKXfvH55QS8YXS$_$`l
zW&u7s4P}+ujgBl@Ukuo-1|pdio!bJ~BN1D4K4mP$UEiV$2s`cDXt$49plB0QT2P&Z
zb$ij4?T{&ltLIf{flH^N-dJvkY%Tt+3AXsU_-2;1eO-JDeW}z$taXZIG`ZpT;#=8r
z4?I?U8zBolP`s0nU%Xzti*P`^UVJ;@pc)Au7T-a*JhfRXzLQW``l9$Q)>kEcQG7T1
zqFQ`fyqokI@oDir^l78`wD?{ZywfT^Exw;V-JlsWG1LOv($I$3-&rVCyos-Ii%*L;
z+di#<Wbu~o(SD^$PXc^l&P@7rOf=xOFkp{r&jH-N8L%b3F20m!n||?i@ntUq4v4Rd
zFDD$d?f>;k*jcXV>*6cu>#*X%fAN(X?5tAFNMyy=QodRnIG29E{0Z8rGLeW&Ha(6N
zhxomuje2aqmt17~oiS9>{t0|y54VyI8E&bow318cK^&84C6^NN<5i@RZG-~op%NJx
zjOh{?8Rcr;FlhR<?e!gmWn@&TFAzB;GBT>g(<N8Y({@ysY^Oy{(#n#n3Ad<!Q~p}^
zQmcwW>MgmB@CMbN@b!eZs$?XClAGv>ZR(GNZ~g}K?dnCsw-DZ;8Rub027diKS|9s%
zB5EmFaBhLqV<jipJ;rxSN=|$iZBpv@=%tdA2)otE@My^?ggxqMWY>~Kge^4=S)-(;
zKlJ;h_ez#b1{{#yD`_|xa8P=$WEtUdyIsrKuCVl8$?3GYN-aS?FKPKTWUAGZ=+%<e
zCjr-}FfvNX`5ysp#MjFZDuHX-U~_gyp{DH*#_LaFHa5RSyMhV&N3)^UyfzkyTR)5<
z%H*q;!T$PHSoFC~KE?(UWk&OuOd-J}K{8F|fnc({5pS7HD8Uq+ed0IsQGYN^XJ`b?
z`K-qyNV&P3VqTdB!e#;77EBkU%AA}GBtwvDbA$yXQ;-_7ikt!Z^)RQ=+}s~Xmi`H>
zZZhYfQ-az0mq1$0(eXemJrRAk!MqNh2@cc?fNZr^)oH;&dI{id=19z<!5qCB$aeE%
zOk=^p`W7HN%v4M^LBD=6ke&FItyV2KOur7uUd@=!HQBXXS;l^bM!SQTehFB;!b-Mr
zA3;->_XT{}6ovpc^3m6U>kdOE`#XTG!DsZBG48E8{GM3wIlTt$c3i%%x6AiCE*CG`
zs~C?gJc2JcE|=E7B(1ls<@HTk@MV1|wE4{^N1%Rtu@W$U7zX5klqoc~vBj_H?JzTF
z@{26N*99rJTl}W9IBYJQ3(lYPUqM@qd3`yMgZddj8qM$e19@9!YfSwwVM`=%{XsM*
z>nfxT<9uig+`t!6Vi%$x{K5MQ3gLw3rl8RM=R-nM%T2(tq)@6F(HQ*0g`m6DmIA<!
za?--H0jB@pV+?UiGya0E4D1*SJ+ZHX?g?JMk~;lt)^8c3nz~{f;2RjCO6K(7jwRHo
z8E>Og0ynm@?6;VZwv|3S2XmkroTO=`k5a#;o<fbKkF}t|N}YpFDt!XK`~`bTaslt%
z0N5kTqtd6Z1#GEHJ)l4P0ARm5cRt{Ke+C>-W6J?Q{~h3<Y8nXmMaq|}f1d#O<*a!e
zt|z4cekBOFO6@}Mm%e%;U`!lvW9e(Z0$ihB7z+6H%K$gZa;@|Y>S>ZRSNbN0RI5xh
zrEk%GOw3=yae<o_qFu4?p`nLL|Je^q8QIz>{q!p6!FNlLdP+a1yi(Uq0Q{8~(~4WY
z0>71heKR`Nqh4jb-?T&CvfKVG+wNCXR{Gr!C>yZ-aG3T4Z9n`(Ka`u|2Ti9V!lpRF
z(CLXPQ#=u^vq-fmu5jt}MU5%GP&%E_Xo@rX==4UDSww65N|{zuTx06=%?49^(@&>!
zw#vgsX}pMSlf+bNf4OG6`2w3|C#LJn1hlR+MQ0;-nD=8PQkte;4+T5TC^)XvD+6P<
zsk50Gg4}QNmBG?XLH3yUV;GkX(CM+g=5vVZ(riKYn|p@?8K_?m)d$RnkR3{WQs$s}
zGCOpzJl?%)*2DtI)qevYbV_P0^-F5(!Z)#?A#jfeb!VMjj<w{xd6in=UO(_b_vWEK
zBeXPzr?Mtrh7X+{BOz<@P501BL88rF7Le63H!nixnp2RhL+fJhVqP*g;9)4#Du~By
zL#T$%62vlp%m;FzDDaze+(6m{$ulP)zCstpOgI^KnRC(d(65CPG*27_<QhT7nlmvb
zL)QsXZu-#J&~F8qWO5fRv_p`vnTUKBx=D~qb3Ggsx;ciUy~=EW&qBAvFs!Q0h44b?
zRuQW)cT?;(LF&zSqJiv+VOD4~dGHguJq9JUCTq<oEp$gr#u5w%Yt3jabZ5*z>k%SW
zeSsFbE9Q=+jF1<xY6|^cR3SoG$vrWLPGzn)kf%cTN%cFdM*M?Qq5DN_r^#U-dLV|e
zzuSD3&3q(gAiS~1yq8XURFJ*qDHMBB%Ir5w<A6LB^C_~^0W+Ch@N~=@2$zFqF+KQf
z%nHmVon{le;CT`2GQ$giydYv<nAi0M@{))h@^OHMUXOVmhHAPmnf^Q|jaItv8Yl|A
z9m9uJQ};cMG!uF!=8x$5fbM$<HHQ8YvwR^&r|$b0ZVvrT3@q1ue`gnc6vNRP)_s4a
zBmWVz2Q^gbJ_dWJTO_M>-wceM&?kZ|)O}wgDTF?Yxd-m7(S1Xv0Q)lL4~x+oy6>AH
zuy11C0oJ7F@LL(7?_>B{UaRi=JOJJi(Xv7J4abZb(p@cR&{o~Y#X-n$F_Uf6ebva&
zp=j6Ruw@6@M;FD&7k+o@zWiapVqNGfZMW_V(l2p>?a_S?l>_S|I``^6els=HSIX_z
zeRT}geuBNE`wr8C@h*nV0o}KU1F6639kl46?%Pc}lUxkLPTj{J`wJzzxSZ<JeLDL)
zL$rLM`_fo@mSA7&K7M~FWC?ai_x(5?*dW*U(22MC^!~tnE^QeGq~Uv(u`$@i2zDF3
zDJ(Zc%6SamCA8BoSf=6ofx$M+#oZgr@YPXgo|N+&z70vhMhGup_-?0`k-`fazK?yt
zilhzYhA#tCOsH5S!-lVoI)g43Y^gGQk0b*Nx$Zd$gU;~Xg>Vgxk#aSL?;}R)IM+YG
zYczb9qH{uJ!fP^oeB&}S-X(o&_|j-~SZd#3_#S1rPjev_w5^73DH3aFrmL(5eQWr}
zQRi%ziQ2atzRO1fJ3;zkhv9pheOoQqErzdx@p-afI}P9UBY@S3U+#n_SZ=x0x7+Z&
zg?TP?nn>=!7aX2KxCZV!2`O?=E#hQ{5o(QER*uoJ%YxjQQA~@PJ&w<c;y70JI9@M^
z+uX}8KPT$<5c8P-V4R*Cbw3cxoXb$$7{%c8n<X=WY>KMG*b0~#ZXlZl37W$g7wu6@
z%;hFuVhdds)dD1J_T?zMHtG#%t1|yZhh7);1(0fUGh2IoR5D_|#(bq5$lXzWz-g2v
zb?6?^c7^!?#qN*FhuC)WW=sd62cj6MJ4_G5{n4mGaCVvxk@JLbcAFzOoSuq037kD<
zJ%)Se*{D_^d(9i@xaXs;0<vFbq0mcF9D@hUYi5A+$0+X8bXqIxi?q-yf^?b77+MDe
z`NBNHar;^nC(=W{_2YoN9(6smX-+~p7{!F5oFV;A6o<6i8N?rmA3e?>{+nQyGl)MF
zfBAJg@%=rDi7%l0BzgZsToKfLlD$8UV)icAeUiTaDNPPLsqQn8ta1|O=TRK)^PPnG
zMHCZeweAZex<g+@F%7ml3G?4kOqd&VpCtZoqnP-&>OPs^eiEJAoD>orO`TWhzDF4u
zeWLkHyIuF4O}{2Yr!AHQ=FI@+j%GLQ)P0?FSz<Id9d{#5U|J6)3APtjPXU%J*a6*_
z+Xq-`^bBa})P1wrBLkuvfOYA<7)d>%^9$WK4ojHO!00yc4(Yx`47`v}c$(qc$-$o+
z%><?lJ6-#unXcW2ovuejGhHL~cuYtZN{cMRcOQGRDEjZ<`3+wUy;Lk%!0-i`J|{-^
zsll{j`1)Wq8=5Tjl|v`zt?AK0@WO_#kyFkr;Z-@QU`})yct|#LFpfe?qE`T`F?=U;
zWwJ~p8=V2ZGMXu}$r<3Q#IjZ=DK<wlDQ<9*;u?|M>LkS$;cau0;#%QtM`BnEvjYz_
zmt$4jRED4#)Bk<IvRgPNk)ze#W*L*jhjt|o+hdZOF}=FwVS7x<M!+7$nR!g=oq#RH
z$$X5LFdo#ASjS}l0dPPKpo~R0s2M2;lE6bBqpqwi$V$dt$SHw`zbAg*5a4srVSz{c
zVBlq6g$VGBb?M`Qm|M`TV`JsHRx>X^gpF1Dqo>0(GYPI68z)a`c%pe|0m?r<o#kWD
z+t%26{Z^Le+f`#5^q){fGks|M*rl=-Rpu58$TC4pbKZC$jn1RxTFfJ3mkY;ZR=~Qk
zrwNj&8B-Hb%@g;qnx#2#%GgR-vYM+$Lu#g;y@J(Dj|DPI5IpC8IuJ#k{g6dIMV0Px
zIeK42uC?ZLZQNk}TY#F$ml?+8+J<S_Ct(CNl}*;)1y2%o*%W;t{Gge+=#;Xsei0BH
z)g$K0rpeZV+q?j>Wz!v-x$-QVVcRUv#$}a)Smt&lvoiY>CP#Ml%Vr73Z}DHzESoJ4
zumST^^hQ~g{uBGobPokGN04&K#AS1(OxS!9Jzq9Yb|9+EHM4=t7o=JeY1sntO^ufQ
zFneU&P-(3BclZr34<dOu$wnGEg$R`dh3aB&!WamS@ht)@8-!zW9s{VUmuEm^F!~%(
z`S38nJkUf`J~bF{E@6*)9aHcaKVeIr3&#wVtrq*c@?31Xc|oN=qEeS)9Z8Jm2)Pxo
ze6OCtEJU{~P?+G3LMYh={$NgLE_E+Jms(bir<4iPW@}}iv2*+S**8V{pTSI`7u|B<
z_;Pb#$t&@0Dv%2luvGRZkgO^T>Q_ucU-N0E%szrb$AeN9(q&MZ9~J`{qu&Rb+x!zE
zw`{Eb8W4}km&nV;>Hh>`nNw&(nQ;7aoK!YmcO!BF=8Rl$%JsoOf~Lm@q(YE#lVi4Q
zf<7Ibu<Z(YW|B*f;V}1USn5)=Q~br+-6F&sE3E_jp$MDy*lg+m=O8)Kd{ks}#5Y3v
z0V0t3DpHzeiVTRUfTiH12+?*WQLz6gW(^0@HwDGZChF0+xl~o87)Q?k+80Y8gqNkD
zF^(6WIm+9Qx;8|Os?qlY&z*~jY19(^FNCuT0oUsW@|KoFifxm$$Y~7Ah^G$!oJ|yU
z@o?3p{sttr0*TQoxM?7iDGrr_n<68H=fl|r=q*oyt}g`NYQUylfuS=-HU7N4RuCmy
zh|1({QbDu~Q@7SPoB=FG&qbNOKSl!{uD1Zr`g9!LE>;Ec#(7hbyqN(C5)AfW?t4gK
z1#aU;1WNAh5H090GPxrM0ZufyotJwNTu_i?aL+9F<}|>`#$|-xz@oe$#o)G6E?<W)
zNHw@EnR_alSCD4hOt>GCMS;iIMR?;(z+U5S!gG)&3(}1T2;WYtGmJ+F{|R}wAk%n~
za5wc2F!m9St^%B8yiE9Ewk+Fto$!@Gz?ShgU_ZZ1S}@qQ{|R(e!4MlR2eTm8cpo=7
z|H@om{~*`<hY;qw4ETbIP!i=jK(2ndj+SegT<6Pmnp}B?=Td9sx<Rh(a&3ecv#%>a
za1@wEKV*0r;065*hKXkKz2ySGaVDgc)^|)Yu%X6BAi5NH(zCxTVpw>icqk_+6tEo_
z$*Qou71W{Zzru^zeM6hq)M|y72(_NzW#>|$zELZ@ViTc;I<4@kO94SWk1t$`hes~O
z<GQS|2zr;g2wc3$j%z&66Y<3)EYo5iLYlII@AC*yqBHn@Bsy;eNg|w2_-<ZMhKIK<
z^=yR26H8&)zgZ#&^)A&JVe?$pW=ll7)R72hL=T4$RF1|i-q!8~C>8U_)*g8rDej|5
z+sFdy48*dCG!J!;l|EX|kzNsz=8>*#nvCk+L;D)AT<RHI<9P~?A9aGe#2{{bxaA^>
z<s!Z9QhejUrCx!6Nb)rSTT<p5k#xNCT||a&4~Ps34gf3#xtDGiBm@p4%cVv|_<Vi9
z=KqJ?+{JRK^|;3K<q7%G4?Yh_s>82`U<7G5MsWNR(V93-8^6`C<ASe!hyiawqL&-R
z{2m(g^We^<?t_$wYna8|JhyTSB$9nWgNzHec<RMBl;rwBq|o@E7m|{4VM#Z+D8u(u
zTq+HSRKznOH`RkUBSPFtqB!DcPm9G8A>=~(65Qf#vuh#+d17>I!J{gif>%eRd8Q<F
z+eM_gPNLrjmP>t!Ydnt%UFsY$n`cd8cK=Eg<pr!)W!M=&ge7OjVy(2@5gHI-F9+b3
z%Tf3KvZq!<GTv4`Hd2}g$x^RvviQg``7E$p>J}E_34ZLI$OG=;^IiafXTKX*9bS0S
ziq9v61@AvGYZYIx3;cx7aN(c3C-&W61BE^ocPSo~yVRS2rHNTHAxZ(a^sJz~K!&<q
zN&_O2JmBr6RO)av4~xj~;MdkB9y#u%cNEQv6y{0sv4wxxo$Zk#JQR*J@9_wcr^dFP
zm1svVlLuqAa`P1~x8vv6Q3NmGLO!0S_cHzl0+aE0o;H}}@kJg`VlTlg><(_916VB|
zhDF@f1T}RxW{Ti7LWbyRn0Ji#F);_P%>&z|O7mD2TTxc<ZXP<>8T{@@2Iq6COYt?V
z*j7vdR&ejFJwkhJA!A%3)V**I=&>P8RaWq&7kXq~iYWRE9)|EERhVjHe}zbI41Tq2
zHfrNueehpgF5qji{Q!SWSjmsr1pmzwE4;WfAM|gi)1%(>0{)go@pYtFz=ufp%NKWp
z-yHxPP@kfz;P+f=1XVoN3&9@<m#a&$5DXq(iLzn5mye^(AGu(vf>|e`oJ+9<#=qgl
z;7@M>%svY->kqp0mr=s>3<f<`V9hL|CMAe6FT_j|jMKTSaLc1<u#Y^NddzbXpTWNR
z>$Dd7v%{=Kq0YYB0R~O|TyXI2s$7qh6aF06?90*X*4QXHk(GHJaKw+_LO8Y|mjdtd
zkXHI@?7I=R2PBu`Q*Jh2aJI%)MDfJd)>7fD4qR#+XxV3E!{V_iQ9Q*puZHy4)TldG
zpeL;6`sERXUoJTn0up*W)s@iWFOa<rOR`hoBP%#Ue~db~GzDzil6`kyvL4hA_OKp|
zur5acRs|o@`L%I5t_eOY&+N|G?jz3Gu5|pPI(yh{HnU?M(;3Jfb1FmPaX~Ee?06tg
zh%&z^oxE3PF9&2T9DGvN#r#?djqKZwXQSX#VimsA1q1MP6}T(wb(rf?D}-<kuJJs0
z&fe}~Bi@yBE4zK~_H+f0vR&#XD2@F!Lf0zY`V`7Zhm>x$oe=v5!p16Xd#8udW;2XE
z&|Z4O-$BocM?}P445+;Hwz|2{zz4h1om{kOYCEE<bQfO-Rw@~-F1;PY5QBnC%F;Us
zd(@NIv?;xFC3{XWPD|x|n;aF3tX%qg(*0^A>${tw97x4WjitL;6P-fSj6>KdDZS?t
zfG)*GxD<a#0pHGmkmT0i0C4jHB9Db#YD<Lm09mXg!oM-Xd4n9eNO7JDq9AWB^+-gB
zXP;8iO@>^+?u@WK^CE14934DH#8NOK#Dh^=2N~exfFO4Bl=LVkqP>i4ZqD+k)Mhit
zP;e1BJlN&m&o~!Im1lsAwFuIfOTAx?aGD0A%Qx$HvmBl9GRyTm@Y;Tng=5<I0`!kw
zF=G&VF?D6VR#7Q$`>CcR{DVs~xo%bJENqHY%px3A8xhtOvk5n<<bHtVOK{sI)m6;t
z4|}iEj8ideE9SCNV;556gi9We0r(r(H{r6Y5j4iH5Dya`3ZhP=aa?0-5HrDv9Zv#Q
z`!QfAUTO#0qsU(qw-Lq;AHrnfWzq^2dlKNw344?UQz!nKu%*^P@x&`8LXBVEv7PuE
zHa}0yn|S3c&;y$BBpxOwUNs*Gei{|g*mo7Y7+R~p2TFF51y@ZP6y-wjnS4Kdk}nDw
z69~VAI4MW=tnuJ8gk{$0i4e;^l8J5J(1ZHb*vGIBdjB8~w3_)R<do1Jou{$NtPKKr
zNS_D9ZH6#=g&r2fW9DIOg&q+x%e)EB4LvG|-#ns#Jf=6JOu#%m2FT-r1kGufPD4-V
zmw{7mt||wzSIUIVt49ENQjjWBVKE$fN|0)EJ+(cpKY=ne=4|*m^sL?m1aE~PYD4>U
z^Av38nM;sgLi?pmt9fP!$n$ytoDJqE_#pIxeln1)Cg1A~y{MlBWSe<LI*^z2D}Zb_
z#}5SZvVK319p*QQK>nx?L2T?azePNRUeTWiXSdmjzzQAEyMgR6A3(kcy{dB;cCUGw
z2gqys*Wm0o?<DfNC^%qx`vQ4GPr{!6LGwm>^i6#fkWQ`d2k6((8T#+g3)#<CW7j%#
zlRgUu%ew`ko1HFU9t+)KZ&2Z-8!hxZ*$H%;m-hkVc0oMmN_y%JK`irn6Ud!{_|5%@
ziO^kw1k8!kfc##Npm`%h;%-68&GE57b_)_V%Mt&fd&Gb$^FcTwbgv-uwZ1#p3$6Oe
zuyfEG{khd1`by_9hu!RdIadFHE&WE`M~F5*NBRwYt6z+6Qf5Dl!q6cRbDQamgYWbp
z9FlCFO0gfL%p~(oq=e96d3!l*%9*rbz+N6%!Q-JQgHKc|%)h~eP>gUcHqXI`3%QIi
zv~9DGCgNn%1qUksVEFbC3`Zz;v*rC|gJ6g5y9$rqp(JAwis1<5g%V)t26H5iP~;>z
z+h{?}dz{l^OUmIug<o|F4HVvf9Lo?JBp8lYu3*D_V%I_4$M?rWImT*)2M$|4#F8O2
zm`6%HZ26wymTT~+5Qi;tR_!;qyNbgWei1%2!r&>OGJO1+n1i_u`|Nn6v<Sy5a+X_Q
z^ghcSW$>BC?;Kl<7GA(PwkQ-Hj#sih&{-lFj#t(X0TvX=u;JSUBSNLpqAEknejDLx
zh1TnJ>};-506VLcEf^*4(0TerWJ$nokbu=BV9%GRLJs;0vwY|RQIOpY*a~gZc{Xfo
z+vI5LJA(nYMSlz&?1$nia{_;h$1Rtmk32uXg^(G5F6;ZNXq0Nx|0Siqi<F{U?NXF=
z%d>&da>;PYGklTQL2)VOM5&KCP)dS08gP>2LHR`>mkNU*QcQHc^fP-y{-g+-+0JH9
zhIulPf!#_rLyC#bX0xC@&k01P7z^pEBFdQgdP&O@Yfm`{J{u8aR_rC%yXwy<L+#9u
zy=0_9#~q1ai44!*-Eui<lq17;gj}kal8kEp$s-tuYXQg8jV@I~KFeM~z6jB3a5h9Z
zyU5`M#Jh2eXJ@+9HRQ7ZGq3D8f%q_q@8QC~h%-L~9M5SDyFLK3x-q5V5dfgHfr+<Q
zJ7=OB!2UkMW-9L0M2GDKRo3cEC9+l@Y2(!q{D_uyGa?w9*`VNuijWTbu0}=*)km!r
z%GtQuO$Q(iw9h%XA)@ttuOCF0MeP7Dy9y2Vgieoo1Bi^56><vf45XD&+}T&oTUSv$
zvT<wKZ=$>vS{wB_%Gjf4t@ButeN_(L`VXy>^L;t~0?aPJ_u2D8H^}=5=KWq&zr(2}
zlf&&sL88r1Igi{Vh%(R50CKY+rdh(t?-oJa<|mx<e<w(?S&6<5-71L3+|P;mHbFAY
zPhom!ry%%2>_Q;B1j#WUXFk4N5I_94YY{q;OBf6eh@t<`FmWH>HFCc+9~VO4aE3%E
z07?3oJh?bLzLw!qe+D^$6u$3ZmpwXGm;oU34Q1$-e9Fkm`Uha(q=Vp6H)Am<{CVU{
z+L1LlQLy>8r%Q!^h!9_Ru!W=|>0|s#LWIp%AbPPmjiL0ppt=-$J&Erz*fBzrB9VQw
z2y~#Ttep~T&w!A`Hxhbf3Mn8XoVnkw#c9bakQDRys({U5>myn3rwDs;4_mC4i)^k6
zLt+O%6oM{5riG}e<eLINt87k$!}kP^a^!cQA~l{)8Ma>D5D=#_xb2lb=|4LPyfh-s
zHwbKvA}#hgK70(UteY?<T<WhBr?Gu%BH}#i`9GY!d3aRS9X@{Vogq0PH!#`nO(w~N
zVHuW$NeIa#VHuVr!!nbBAt5Me6qO)?QBi{{s3<N}P^ze?h+1)}Qbna!EAG@4H$-bS
zb*Z@2qP2=u>-T*>XQ=%?-{<$wkLO|XzMpgMSwH7<)_bn+f7htLIP53#Uq8H3LPz_{
zvSYgZeDH+ri^E;XN&kID!j)wFKhI2ur{aCnF)lJ&ZslP?b)gTpiQgursJ_C`zvXsf
zui`~tEx#egv1Djli@a@RtH#N|cS~ugT(pQ5nUfaCy=*PNWrU8ZW|%T34X78<6kG0N
zIGC%p0Pi3UscNiAwcJlUM)jiYwmd)_R;^jUJDK{33YP;vNE}t`;M(#KaZLGwz`K|R
z+-3~bYxzC#JQbk)5r)&HhA`egP`*&zhJja$9B=Mc91yoW#&CMnex~P-#Jy?_Mt?1j
z6ZffqFb%tjSF0T?lP8GRsb|o(Tb^Q=8`M9mfuH6mZ<G4VY~W`o->KGOoYnFyPq^$-
zPokh(o}+w^+J$jc%N~v-UvwUU4Qb(!8fS%^%c?-0CsF3;mCJjLmbdbjpwjtP{;Ay<
z#va1Zcel6ouO<(4%C3Iv2eR8|*gizu`k@R~mCaCFKaydrZC{J5wSFuv1@@^>wAR0w
z-!4Vv*o?3B6Y<t%|2zZafOzY+`SxAwr{e86`<uZapUD9CHv9WFkk5rYZJ##_<nQv#
zM|J~LqxDN62kbY)AP0qfVY4DzzcLs1VBi>JO}2h5M47>VO#=I;SqP_q8Jvz%YW+r7
zml<5bEPZcgoQOg;gI|Tf{w-r}95gD0&b0nu;>|7|H2MHF*7~EkZ83w?%hvx0!<d<x
z+4{4j<Tf+diqdU0WL%69G_|nR6n2jp<b8szmPN(Ic>4WPFt5cO?OkSYIP7(6mNgvl
zVLW|eGuU8x4&&)>S&TkmI8&KGt+(nCJ4V+BSrbL#_J$dJ52NJPVv9N2Z^~J|R=>Et
zi^E_n|1x11c}LMXwU!I}$PC_61Xdvo<M0=uZ>_^DwtbAl`_L)34wsSeAv1W<Ot2B+
zX5btna~l#jWeuf9wI;2TQPvohUseLQltoPlc!S3Tz~)&IgxT#4W)BDJ5VvEz!G-8G
zTRX+=7H{z33b6T-mfO6+Q<(Qf!nS*Z9cUG;ODuk;;2v-A*JzKeD`mvK!y7z$7})7D
z&)DUKLRZ4%6mP9WWAd~;boU9+`8BBFwujk940SQ_E)HtE&JdJL+wTRNPJATDBlP68
zoXOC#w%y1wCLPXz91tEyF$P)=&swxSwFCu?%c8$0d4?o_JEc)0ZO_pgE{mQ?vWKMB
za#lit+x|pSXE|$;v9=dD5v;eI&uT$l>RkrwV>w@tyi9^SrEfq9x9uH+pt~(63Ds_U
zjikqNo`ThE+fQ%3*68IcPdD1$W~x_P&N0x)ws-yjZ|f{)8uRmKl77qKJgx0rKc0zr
zoSY~~Kff*#^Eg+cpxU?_W^{QRHjK7Us6|J39JY(L0}Ohh$6>Q*`}AxC(Cu;9D%w7y
z%Sj%m7FF8D6+ffb<BUg7-FA><rN_AiCb#Wtl0J`f?hufFlAPml6qEDqa*)*?XEJo7
z?K_f-JgB~}VSzFfmzDB)U|9Ehbk#jRt)xcjF6v=;%DkWzRS<iLr-5bNH1?97mZ49C
z2n*Rr7j}#hC^nzboB3lcFWd|ZsLkq&OqQWOg2K1FMC?^1DE^k0iB-|!(@rv4ULm&C
z@kngTUSglD{kObITu`)lG5ownQ|+h^THxn($|H&s`j$6{C#WS*x0W}Fqv{GIqGccP
zbS!@3u}JIHVxDB@zV%u$D|$7n^#-vx-oVKxoM5!xEJVrDR_m>DJi}*Sg8*9Z5aQVX
zMl`K=3kld$XfE{vN67w1J;(!MmcvH&$LK9ucbY7Qiu<4iPU}NrJmu}|)?E^SKKar5
zh<vg{*}Q+N^-)Qi&*r_Rt$!3!U}P_2>wVm;gbf(uvsy=5Z!Sf7ZGjH8j<&eSXxKlY
z)?2HDtPXximuhL>h8a9Wr?KMXg*BsFSlli$gHO<2*2r4HI-EL>g4K!}Z1=2eusT^)
z*lZ5P8HCn)i<_4)&-FB4jgkx)WNKXN1bGZ5xDbQ?)``M);uPv=u*t$;kY`K<iwb)b
zMsOI|6zk8(49xQ#G|y8lp0b4rZt;Ol6Q3};#q7VP3xm-egG98ph>3#HT|>j#YMp^<
zf|>o@D6lq*tF|z+bu@x8c@AcF+bpmd!hS@`*m2CVK1b{@x(Rk-?c$~^C^9$D<%2GC
zmnj-IS-t`pv<dc2W^ZiE;xt)v_G`jT&4(Z6Y<fIcVcp|5j2W#BkYjrXzvXvBkojT_
zG`?*$O&xAL=r!8bpn;%qd=8aryHJ+3@bL;-rnOVyC$rwh0Icm2njgh?Fxu8}IBh7t
zg3)#<Bf?uzsJynz<>;K^YZYx*a>n8)>TKJFneZMkGQ-e?uC}Xby5t~f+a|O?;B!$G
zZNFwB6fO`u#b{$2z<$O`RBhX}lsoF0@xYsj1L}I(pX=D*LTXzS`1(_kwy=@;Bx=!a
z+ZJa8t56qhx6zZKc>iPDZ-~9>QfNWjc4B;ZX*(3e*LF7zuukedjM=~&v~9noiN-GV
z?I^Ogdl{ru!sP%`=-Ed4BWu>X*{}$&a+j?@P56k1P77xtg%ds&xW@tf8@EwW30J`}
z^I>SSGvR}O0!uMW_>d-1Z}Cj{<VK3siL>z3r?SgsSfeqfobcI`aL7=6s^SN9LV*c0
z<>aW$mw^u(N$*LRkbi-Z!Gugt4RFP7@vJ<vL9}O;o?H)C69#)$Ks@3=G5q^9e!CGk
z*Mn<j7~ef3_&baNSzZ*@gdERS2E<c`69&nQ*9e?$Ovsb)u`2cev}i)U=PY>2Q1mJ{
zIz9;?#a5yDYlrz@V=(s)J_q;7&sRk0{(#>=$x!@|01Q6l`8g;l-+wRNh4d##{Raw<
zoec-MUa)YnzFv@bP8S}>H{|y!&luq2iTBH$g@q^V&g7D{b>@6HEXl{SRtlO>*vl^o
z;38xQ<Yuxn86B?+gAiApY2g(V@^cdqo(r6R<NpY*0`~XJJn|d-Rrj|T#>|Dhn@iv6
zJX7u;a@55+kjwo;QT1FDxSQ!o%Jm~Nk0I_-jc9)}kL4a;w_)w616h14!pu+%+4=_R
zF)QD<f&#o2ZVc{&M_%+U*Ixh6J;c@vRq$ERBtD~uee!yE?UPrS`gjSWVa=$9&mx9t
zl`#0?lL4{*h2O#S_A7w@=b_pr<kxo{oHB<19`xt&T6x}s@6YGu^w98e@KMO+WTh{R
zFXA;<K6NST)?dt7zN0UXcX)MGKw5;q1ewI-?gsji@A%cJ9)?p!c|`pND(WvMo}fOW
zJU|>(SrdUPiKnZltAU3Q$K-Y||8QPmo>bppNb3(#!MgN?_oH~Vbhr8k+NpmuD|?6P
zX82W1+b*>ggB1T*;@#>`FdP1wA@H+DoiQ7D9CN!@zOLb~<Mnj=)w{3*{(4a`w+m*#
zpZ=0U#Q}E^jK057%#c}r!2KW!+N5dO0r!~^py@9u_z$?BwS!L7uB8Xu9k7x9^oJEn
z4!9hT`6p{v_kcSQ+Ut*M>KxFQ(@)W~_<%be8s(p=Y0&{U1-tE^rfJ~;*J6RRYFco>
z4Gjm4X_|k)9ZEVw)4T)jH6uZ13blL(<ogc(+1hn5QpGIrj$GVSIOu@OBO-q8=Y!@P
zQ1e(C^I0QbK(DAy8HzXCTNSYFvwiQOD2J4z#=8f^Pcnn6U}X62e0;gd%dQOj5e0Ix
z$x>DUzAhI(#r!4!RkFYChRdl!96OifG$8@ImSm-nkbNd<GJb|RYaLX}Zh}U~&lD1|
z`95>}EOS0wqV{HFB7Uy92qb2&83%Hnc_XYz(&k5k;%iLaP1<GeVrUnbv?|?pM=r=k
z=GzxyR3H3oAjn!Xy4FD6f{)jNU1Baqa1l?i482MGQj_gE>In{k4#h7M7V`wZq1)vq
z)hp=<-WdQ}Z;CbW1OuqE_^*U@dx8t;bA!nS)8iR>`l(Be_(oxUp5Xd8+^!O~&J)}S
z#fV=mY_lhLGju$@N!WIT33ZHLBW#x^IGABxD{PNvC@)5iUuUx2@Am|K^m)CxWwl}S
zdxG6ir}z!R4tRq1jt1Lees&33zb9DCyx(XpMQ#syf*JK-H<?4h3~%tCEU~TTgLqtd
zgGVyVTg*{#^Lc}}j{@5!`E$I%yB31oW`2P9Fzp=I0(OVEg}lK!vh609{=(kizrtX5
zn!JN8;tf845qkU{8Q?~}!KZV;ek&~I4Ne;hwnJFb8!TicV;2zh(B%!j4F!wu)TQeU
zKB&MRGEYXzdc48mP~!N*=ILO)-r(mRu-}{8k+ME-koPsk|6s<D_toAi-ZL1-X%uGG
z=UeBkn$N<(i4+Qyg5WDOrugG&fw9h8%{#Q?PiTQzafP?)Xc*D>Q(E9Hg`mfU;Muf~
z5(ws2Lhz@wz=dE8EAGX#z=5C$Z7TjsT2KtZ+9(9CrUgY1oWpW@JuN7N;3F8z_#0_K
z0R-1kQ{GGq@*y~if_-U09t0El$Xi<A9R$H4%o^fvr+wr=@FQE*J86Lp!Q55|{+t$M
zLvR{v{oS-+AOu&iLHs2x$bz74EClaqfhPlk>sW;Er+o~7;FSgl{+bqeAsCDn8UG+H
z@IY`XtKs9cz=Gf)T66qwX@LpBv((ei(gFj5G3Wr}pQi;C8@yF{2?)MO3(6r_T?4^C
z(t<Jwc&<5qFfH&y@N)oyuhN222tJ$#!J)LE1cH00lHaEVE(A}ovVTqs90-2J0>VpA
z)F88%J}`@jn`uE21T@HTy_f7Y3n4hl2Z1N;qX2?$DDb8Q`4GHI-PfDUUNaAZ7B-ZO
zw2xc}&Z42qObdJvbkPi|v|um<M<yZ2N(%--FqMisFfGVo7_j8=?6km!;InK9?6e>o
zg3ah<<2h-;KnQqed3;b>kOhHF9UGh$C<snt!hC5#CItNaOFT~tydDV7n+rif+J^<f
zg%lK~1ttU&s18MGfdRn*w&LQnpkkA^D#&_q(t>gb{zJue(}FSx7TFM#qy>Hm%GoMQ
z(}Ge6A}n=(T2KPPVz$b%w7`Yni#7-<(gJ6bH^^82<3WoSf3r9E1#QwWVOzbyu`G$<
z!nS*Z&D8l3*8L}8u;LBw%>Wx|(FX3t(%S^EQNs3ngGYtIMholr20vj%j}dmj8=Msa
z8z=0bH+Tk2eY{TCA#d;&^wsh4!i)jI=R3jbg{c8SzUdHe5at^Yyp1tLggFC(=M4jE
z6c!i|9L_e;BrG%_*ntGbn}vl31T*G?O%N6t5X@%YCkl%W2!2N^J4sk<K=2Og{A6Lt
z0aatEc~f+;`Fvdis;*+!I5jOWx&|1Q7rHn*w|W)E69=JVjyKV0es(s75F7y{n#`xK
zMthPGK%!ZQvUyA*G0}VhR^Dd^5Jh6Lx&I2RDcirT1DPT{;byzP3uKzfZwPD+@*8Q1
z>E;Hgpbu*l-C(We-w<}h3~~^WXfrc@g?`=)p5p_XA)|<x8RTFgG25(y&!ibV7xk4$
zm|uWxwt{|Cej;h|b(pPIkdv6iTww>TAdf>OQqpH(>~K4*Nuop2g|Wjb^!kZTVHi7{
zh+HS;3+wU(PsbP_vA{GpVWi>-UJX4=9ATD%^>~8EqxVi6DR1-jdV=R8Ux}m4dXz$+
zC%AGtShuj%p5TMfoy0N1)?w^04(wQA8!!f7S{9pKYmo;}aKJHO$C)*VVXG&&ECP0d
znFQPJ2|mx*d(0ETc6j8-Nn)9dcy@V2{}ap2UbyYn<DbOI>G4Q#6Z9(4D{Q|W@gz<W
zcEA%n6^${mQrIDn^vQ`c%`*^+@>V@F8*Z!87PZ3Xts2b&J}WIKhoC+R!P#j+na^9z
zuT&+@Nele&QAe#gPYXOQ1mCdA)}(zn5YPxGE=UWCA$XU?b75Lg1i?tAacx>q2*Elu
zo5aOwK>-9bkBLjtf_$GBC-$hudH;gq7B>V?cUJq9mh+G+e%G&ks-EU%9|1g#H&^df
zPr_`qPv>Cykes+{Z{e)_M~9=g_EuusbiP6bw8uU#z{tvURzgqOXK*kYGM!l|keMW5
z(;0>)&_0VKf-NT)nD*H+W;LCuDAD#fNz8O6Oaqbof|I6Gj6SkmKC0MlIvFsT?Q<Au
zuj$YVwWm0TT8+D`vGdYCk7OP0n1)WbcW@ZC!E|=d1?eQ&Y&u=Ya(fqz;a1b(9UJWn
zNVc1fgRZyz2$CJ9GZTv6ek92*b2RUwY+uA7`EJv>h-o|e&{j;=OlLqdNcVq0_L|OJ
z7^$?Mz;QP2zdix2v3&_izv;|~g7lCaKs+e__N62TO=l>SpnchMXatAMvAiw5eYx(H
zE4r+){9JN7k1?W`E(gc^okn}F=4Iep(ZjU!GAOwF!TCL+_ER-41?Tr-+E3HG1iW<+
z_)5)P@L(nQ>6$y>*Rwp&(7YJ@1&ln~&(yq#?u>7h=7r$%S$t<{UeJZNyE|a|XXhuO
zO_@0uVXbSwF?2qr?Wgq^?Kkz^f^@3y`N+-ZYyy<eGqm5r&olVcMMpz^E9=NnGhsB_
zZ(~gcWWA#OH&ly|dI=TKzMVKM-z9Coi}e#xpTLl}-%T8q3-sIXVd2KqK#X$Qe@l#O
zou~u%5_hQ)tic`h->qh0IMMz)%6rry;`@nl!!j#&=LZ2;EcNR#zz@;?YQs7KiZQ!z
z9I};}0(53K9|tVARL`D3Kl<AtvnMhyN{*|}o<xk7#Fr!J*+nPwS#t_POa5ldYIr&u
z4JmmCp&?WL<o1I%@>wcZ^3J_CvwU90=pre3bks65%jEC4G!sx?pxGqvXIX_*1lA$B
zlWH1PS7P*@eCTOB8&Lz%9Fq@o&J|TO;mKXZF}bfg`3Uc;PO2yjcJfiqN4wQ_Xk+q^
z46{c*n~~hjscElEbxb~~tGlAl<*Xwq+tAR?K6el4)7rJH&%GDPNXlk3bhFQWdlu-k
z+O@RLErcc}WlP#?mh`#nSps{stJ~+g(6b~LMWEMCAExuK_i|FtkDpjuVQ6NTJb=Q&
z3%>Z3uWG#o;9~*m9}Zd4pVm4D-Nc++es2ulnSuwuZ%#C84N7-0k~?RLt}uSeagKZ^
z2@A6cl*gQD2k19Er*#4S{uvcLr!87;0CUzjC&uTL;(T(>40^$R)yUDDnUp(nsD92Y
zS$9ITjLtd<LzX$S3jlHA1;2i0ZtjivtG@2W_1}5l1Q>QMaXvBb!X_>thT^QN04eN+
z|FX?y{C8XrP?P6jd~!cOsAH(7+kkg&Tg}>*^^6CJqw3{W$R8q(sfH@xhl!KQQwzL{
zxJ#V}jfnrAxLfffb@4}td(^GSZu}3#z3N*OK>ShSKJ^Sbl=x%BtL4?n_#cVasR2yG
zZsHAUAG9g{1o387iH;-w6!BKImwuim-mch}#h)SGp>k2E@jb-5iq2Si3?`z)yHzR*
z`HRGR6x(9_W#YYR35q%XD!Zrs&h1Rko0J>)I6(u*dnC$qMmr$yllV-h2r3ZoCvkLV
z6aOnoz;s3+nD|Gmt&r*Pjm!AQB<P^nDB_<mnwaVEeZ}~vbm=vn07LtX&3d)ze8K=e
zr(IfSj(rq%FaCGYU8{V9Iaa1xUkW$Nz@LHs#{Z$YAAIyMaM=#^nx)_^6T!dI?j_*E
zVBF%eLyB*zg7YHDxNMT5ZGay$AN(8bzZkr~75rbC7i}<c_g?~nZ?{u-B4+%1E+1*#
z`M1`cCfMKjk5pV-kjFaziFu4F$?wlBqomEwIc}IFUA8ELDWu!(f{l$^LVE1a(2n9B
zA-(oH0T8c{KAT;Ae1MSEwrEg>kahM|j6PGy276c(L<!k!Phd{7glx4rB8U$ZvfciG
z&)DW%{MljeU;z!11(;nn-{p-DmNDCI`*V8p3E6AEMb*od6`g)N2m=$(lZBZBwyzST
zz+^Qa3`)fo$za$qgU?|^7B3bSFoTb<bvUxD7BYj&sn@QsuxVs}%VI7uKSI;Y{-g`I
zOvbHvqX`9`zZ5@Wn~YJhc!hZY)MoD-4+zF<2r!rNN*P)!*<Fnfku^Y{ox`HT1$Iy`
z$Bx0A#fRzy+58w=e3(2FviUW(_;4X%Ta<2u`6Z%>*bOkQ@sK$iBns=(hEl;B66l1o
zKV@-`G?}>U(e=P%O#5PVPDQ{@>XV~@)l8^;>eDB$H-ML5#Gm>+_XfZc4rfzZ&&>*-
zd--rUrPaLL=f=_fq|#bm<}*e`<JIPe2+rn57~*3E8#X^o9uJ$JG9LQ{7T`FkRG<AK
z4bFJ;L};y}v(_kC3)n-M&n8*z3+WP=pfeq2isF;fBi)Kf4bu>xoaW_x|Hwc@8H#2%
z`#m2Vqb9SMy+8p^Gx?3H?7?jREoS~D*qHhe%H+h`WF5}_X&xM6<_~y4zcdn`A=4XN
z1ml6rO!38U2xa2Y>_0a_mN1V1#`#|S%D&Gk0Nq3VfKYr~u{1{c;&aR!;h<xfYbJox
zF{E@1M)quK@;sBzXCFNUc)s}{a79%eQ@B7@No@`z;z!8(sS%Kc)+424(kWahzL>&0
z8O&|D@ZD|x$Y3r5_Qj7ixuB|pS*(N6c{@%VxN&@tPtM1vFy13`G`vBJM<j1t{?;0v
zUB=2=npS^Kkn#Q0Rs8)1iiYw>AUL`zb-}TdKQwRZPCPB&FPk@w)(78f8jh26(<$~T
z2R+5S78aSKwm}`|wGsyq2(6YiwiKeav*8s7Uh!*f?=*~#qJ4mwR{^f>7`pdT1j&xE
zV;I-@_3lx}h+lS(IzoE)XavfzV<ZiWqh7&ixMMV<z|EWJN;<}HXc#J5g8Ljgsu^Th
zzR}b%_6OjIdN2e(;mXTsJo#2pM-7u1Qz_^|N8K36lj@I^z~dW$yHx%H;K<?tJ6>*k
zb~G)A{~p<q>S!iDNp_MtCUW<v*X4R+M|y7t!>=Qeu#WWJ42EC)LUD)QeX;y~hUI~Y
z>u~;zl;MC2ex;KB1>ln(CJioJn6O+_e@96M5{37F@te;){Nhc%VvE<Rk%$gIeOX&a
z0+usu%R3n`Fjbz7@!78b>siCvnPnKAxr-q!z7^0hJKYDaKn-vuqq9WU#t?+pSt>g)
z>U^ZTvy1~&A3r?VSx)GvcTtg@6_;UbhMSqub~`I656PDnJA=f!GCGG6N95y_ox_Nu
zic1rnV;E~py)y<_zGRBKv~z&Rz6W`in$r#(W~p?${4{oFdOxkA$K}+%GrgZy-s7qO
zXtVBM%X(Z6s5=jDul2Z{rJ#qm*LvJ98$b_lui;r3yw1bhYd!7(D0%1M?X@0v85&mS
z6diJLkDFpiOx3ig$9;hXc6fWOM?RC;IbFLJ^vEYLJ6mZ{dgT+Coo)OCW}kdAt24$=
zV6Icm6A{8p&KowUr7(`2v)QR^mN`l%_QN<ryAKVZvz>Um`eQk8lKyw7aRY$ovH|Q;
z56lKm5${%?j{=@YKYL`Z(Amkk!d_9_&iPc_{c0Fe(z$?j(XaNv$aWsVxy1oh5(7Sx
z^Ob{&TP&T6C_m(I`>OLOj;9RMVK3R)%?=aiQu!T-&STj$a4yw)6b-90|Bt9Y+<$>z
zQE{%W`Q(QI!-WcIjn0PGLVo1aA4xQ~u19Db_axFYw%e+KCo)G0XBB}b5&P5?Gk_-(
zJ1UocqAZz!>cW^KF@-p!WQlJYO$J^<{0k~1G5u4d!Rl!Pj4wn~nX>?U5@-IE(TexJ
zqke_7$#_4pier37_Ky>1a{?BS7j6^h((;64XrDNbMiKkgsI<iSoZUp_z(Ha){lw(+
zONll77<y7&hFm8upu9^av5B=DICtY)ee>ba{sq#219bS6(&9p*J|95@mpO2;iW}f{
zPBA1n%Z^|1T0^f}R^vy!`kh1vbD^#t0neSxn<3Y=CFa`{iwR70u|;75W1-0=7BC1r
zciA=c!0$69E~oj^mOpXDGcZO<(XJ)r^Fny;C|HKXhNbXd)^8@RzI`Kn&~hX;Ng~uc
z3E*pV#ZfI2*XoL+x+XU3iu*?)@O8uiQP;!`RI`wLj6AW0I4tUyxRE%bb|6WKn~9^+
z91>fJW6~TFw-6`Q04DNQ;x6?)Mnwr(uIN^e!x|)Rr@Tj+Vd4%p!(LUyTDg<8vRdt7
zdSvNho%)ISlWF}1^#uBx#69%0S;<o1Z(ji3s-8m=OWaG0CW+s~eZ)J|BbdY`b`bAU
z&thDdxSx2ps;&WkfOwCh(Maqh-mA9O0Y6B*UtKo__+c)+^s5`u<P*Q=CrJ;eY#aCy
zYT+R#if%XY2Vyisc2<eUr2I`Mfu@|;O})az>MmBn6RbN-tmd-po?;#XI4;Y;o+iP>
zYGexJ8IrK+JcOZr;yJb-%(7mGEb%9%D{4BoVWyjSo|T0uS9dPR3nWR?sb}@RL~mWD
zb0(j8nWWovu7OQSyh7501vMCw#H&m-rfI_mfxJf2XF7LQfxJ$#+H`(qLf;@+XF7Sz
z>02ZlOlQkXko_c^G5g8~`SWrVf!8YEirE_z@fXeg;CCqS_vX;uECv7j1n~DYFWG92
zmPOwW?%pU1j6)gnhfL=V(~;HXk6CQHOlMaRE`OuTZqqq_9>^yodrar0ZjjH|{P*%C
zK3h(P`T*r({e{{2@)iinVrJq8F8j;8F7czD*UcRP_y4fK^}H_eGee2mV)yj)O;79+
zdivHS_ev-9^sQTtMI`j}tw*L}2|Z)$m8n=l&)E9xI@Y9~v8}cjFoSx=w$8qr6`^Nr
z8)ROVu+tMeP9PIG>4_a@hKa%Hi5(}937?Q1GBZr%3fUzy!$h8t-8PpL68S>**jye?
z6bRWX)6qn+ko_{TOO(jOu0P1Re4<o{GG&^VD3f_qSWo2=<ua9vm{pi37>U5)c|_Ed
z-O@zm;fX{Plf7oD#SrsR)a$6O#4vLg3g6};Ok%i9Hw~L##7m4YX_I}n*yNB*Hyt|<
zm6sSLBw**0j5hh9!H~@(O^GU#qtdWFF9)O=cdDZP<Ym#sSP42RXH*h3CO^8CG_v!C
zz+bJ|h!kWmqXijn?ghq|Eb*JqZ6j^8dF}+#-yzBP?mNU{)VX<c_*C52hlQnwg+BJ{
z@SX`lKKEU8P%>}9A$kZT5bnWfmu;(oX#Ma|!(nG`%KYLCmre*W6g%Mz#raf*3Iw3g
zE73=%Ca;HMMJHf5^|I;tHOh6|7|35SSKfeN?PJgYQ+tIdxi&uast})@2g{Lq-Mk1h
zRlHwU0`i8CfW4>^WS_}T=Y`~&y3|`jMoPJ+_M83iJ<70V!APf~gAnJCTEMMVYP|W}
zb%>O+f>eFFX1N%cYLuy|ujWsv^VEdHy5iJSRe?`DtSU~;$J4+M&q>Ring{6~O}qP@
zn)dPFQ_{TDsga~kOY;(^rhFLOTQs+@L-EQa@YXaha_nOC4XGJY0s;F|bVR9H=6NWA
zkQ`A;waXEuu-!NaE_39-Q^cM;A7rk$L}k*MnkUC)VsgDqYQ8?pVlQlfw=T(am(6|o
z)B+(r_9k>-sUv0EvCn=S%`df3$ZER_-C61=A?xh*Xw0djO?E6B>=#-<x+Q?E_L~@N
zr;e4@x5K{M23ag*mz~SB9VcYB{ca7&36h*WHV2xiB|@;6(*@EaWWUX!V`{08ew&AL
zQYQ*IVBZbnms%#|pxip2I!VZ(;ApDE3X@%nVFo#JNS!PUw&4s6?oz$Nu>Z=FRjE^i
zVL|A%dazT4VL|AlPO#I2VL|9#*#6Y%CO=9FoASXFurt#(CHM&jlBreF=&^76XU2Y(
zu$UP<0yZLbwlM75@|;EL9ARB%kPEn}bA@%o=Nz!}g!P!gPe*{AFRa%Lu17Ja)|l)z
z`f%=?#c-jp)n?FP)3`|3I&&xw2c^~u+klsunA?kmZ8n3KVv3NuMA%j{cr4jEVcT)(
zJm$cuONH&g?Z?dRWx{sh^(E^0<-&I3<)RL-D}?PagV``tsrAD4;&48iI=1YX&i!U^
z7us3sN@4wGu!pt3LD&H^xGV&=QP@E<_y)!*sjDQnhj7t5Y-H+cal=_SE)J$P3Bv^d
zJX4dpRv2D2DrH)(ljm>&z&M!Y)b+vwR`7b}{YFt&TmbNl0@LTgZ~?&aY%<$TcF?#0
z;B=<tZt)qlg5R+o?lI4TMZyIDf6N8D*W_R-X$8+`T6UN}FUL5=3YJhee<xbdZ3Sb@
z`~4Doj}?4#F4zN-&R*QF%<|kRtPj@@PzxS1Ie%Jh1=r95?vm%$S;3vO8NU~{!3vhM
zUHrj(0aF{?uk7EPdXVj3-Nd4Nm}{E)lOw4|xXKn%kFqiz)zgU%3|3RJ&l6SS#{xf2
z(;ZW7Y!17LlPZXCQ%`ab+og`7@;}Ws)1$)kfS+Y8_Nq9I!*il}>Sh+(9^%z<m^Ae~
z$_j&{ighke*rnt>8tfOXQ%hK(uQ0J2&;!tHXDHfxE1z1omxk9LNbTdwqin#W_Mf;0
zLCLyw>KzfwMoa3?%njGIE`wKVA8Ya5UjzEXsrL<3k-DoHqW-JUKn&H-hWLRDP<5yu
z(hFa%-ovMBXm3Ay9S|1+!eLY>HQMX}u(=488Y3ED*j$B5RS8kLcc>QA=Bt^*#D}$k
z9#|Bp$-&w~swQpF3j;>>umup*n#Bk+LtU_mzYO1cGlk+Fe>q^Wi80k`GkMDIw;;h>
zwMw3<*GYJSFnJme5GvJ!fRm>)BR;($cqS{%(Hnw&!~yjy=y!4zaY+3eW;S^?aag|E
znmm^qe-YWZOrBqLGb=tHttz?Z_rU!Q52YqA<YYc%I<lL%mb-~z4C@*5#Y_<f?`NZV
zCD%O<m#FDnN^%*!#Y|^Cx~k+Avb%^+Lqma*>q)vXc*mp3E1C3Ob8I&%FS${aL^*xt
z*e_WQS81gw2A5sNt2HkIKL9I~+@yIS#wS)SOkJ}6X_QrF1z=BdbL>VaJ??->UdK2L
z#qGW1_1s5QsvDBz4SG+tAO^gJiNc;Ly7=Uc#32<%?Iv#`j;PzvNR#Q$cJoWg$*l}C
zsid{v!nZcM6pwNyxA7!rw_%0&Ktl>i$TR^X$(No5mXB8_UuMx5Y8|WP6|RRU*{@FS
zCHBd2^5m<Z!H=WEe1l;IWPK+2rc|TebbU)_zam_60+z^<`!y}c`oj;k2)gN2#E9)q
z{L1bqcawecBO9aqf%9spnm>@7RD2WC!4Xb!G8>Yfj3@PnqH$ORhA27ZTZG`>oSaTI
z!8fo`v@N=5dCnr)%A_fI9Xi=Y>~oJE0l7ZytsKX_fR(I|cbmnI+s~(FrR&sj?__zW
z&vO?#?q!(HCEK-Yf#XW;B{j`=)cPn~=P=O$y-_`vF-Fy+C6K2$#*3-<P<6?9%x6+X
zU^|l?#9b;AJ#Dg+{=4<Y_I&Dhk1p&5auiqbY*g|{9x&-svC+T_=^r!odBBTUmm3Ug
zR}IKfLy!o6EP3p2saemWr%o;=G}I+9zRBZRLf9jQVNISu>{GKUftL_FvS63&A;#^3
z7`P=*WIQ2RQBE!+4y*G5ke|e~M~Zq+KFvtVN1>yryax~uZW~1ctly1*rxg(qQ1des
zwHuq`Xc00zr$XuK7xlx;00Mts`-s16MFM%qpgnX1nxy`Kb^AzZ1p1`UXnKjbJb~O^
zEmcrpN8N=;R{L0?1Ffhl=Vrp17EO2MOihiZ_H<Xyq|^#Ev!}aqWM!PD1E;&8HUw3t
zY1VXC4ycURR83cMs3^iiMKSqqb$cTh1(Qn77c~)gDLMAjtm{+``b^-mLXVmeMaZ(G
z*Q;L*`a7~BuL@;iq+bQcNe88zc=jnn(G_K~arrGM2fkp_e$_88*tB2G@^R$AMEfR|
zPgFe+gP&hdhCHdxtOve^xJ&A?{aU7>TfPwAzL|C0qrMvlKVp!24XX!A*?zqjap8hD
z`Q@CwHj#_bX#Td<FpS7E|E<-340Fq%ZH6)KR5)*0jj0KmNFCd(nNRI_8+07+-!}7E
z5PXw&e0~jF3l|~SYeDOK46}#<zeKXsFpHTg586Y+{&ZCP5kbW4uuvRE?VAJf^mLi%
z73w6ww97wi45d>tohi8lL5y2={3`h766ikAx)xNbrsEL_qi$i;n?M?zbZ}qm*fRcU
zb_7==`Hk%!!<fJQOZ+xIKzOIX6^OITcMCk@)k7pbi$C{+HW`gi(=GQ7kj8(t7{-E{
zJ%FVgo;2nlDM$EOfz1;tFrB-ZIboFg6(*LMF=53-yrGu-0nm3I>cB7_$;L><coL~m
zW&q`AKD)p$?y^vm=|saQ$iGa5c2^7^9&9V(*Hq2$<*_o~<sWb6Ksu?+0sLcTOcb{P
z7<d?7?|`K%R>Ez-cVO0o?eM^BVh!sum<i9tt%UoB0A3>SGUUUvPCWe733!=Ew?W-J
zy!O?ws!&v(E0z-0Fq-v*h<YI<*G&fAM9BbUT{aSAoA~@G2k;Jo<?{e{5n}MAlRF*Z
zST3-)vWlUMMHJqy#|UpgfCFZ|LU<*D%Xoun$lL`R>Ko8^Bpy*?P!R*pq7OqIH5B;l
zuL+qXgTbo-<e7Q+*`N9CXNXE2H3EX~j)eptT!0|+$Dat*cKl}kMC?<GkcQ0v5Ibru
z{rpTE$hwGr43i|31w)2DS4cSPDiTXbB<uHl#3Lk{bs@tVAS9MGnIuC<G7G~5BQsM-
zR~Br8k(p%<frsv_K`=>~*=7i&Cu<|0$uXJY-mDIiTp=s7hB2Oe^M1JWWxa&_W)_<$
zGGletN_ulll(um}RxiD|W;J9NX6=V&W|o<gK-OiAq|0#gF?idM^$(J<<~typv%Vz>
z3)!0W6G@Gb?O9$1T`OcqRyN5vb2Q@KmDMm6WW1zpch)98(_l`Aho_B!kI>%@nP)-h
zWZuF|syvFe5gMw3o^NG#mCBk9e8;g6bBz5JTyR$>!q29@FxmDVxKYaL6zROfQr_Kq
z1V|43W~k!<2Ms<2zdq&)k`sV47s9q|P}LDOyh~E}3HQ=f1*YL={6<1`1_qF7;vK*~
zb;exaN$B374X68oqh|yA)iDjgQ!WM$s1q63G^To}8U#I7EetcHRtyH7$r=i)E1;|@
z@h)&g71jYKKLL)aTVVXuk@ZM&Ox=z8Qwxc^)LUqyY7uddx(kL?oya8j;l?&R76X)$
zz%j@rD2S|a(pJM6fM>CtSd-e(0kx;#&ze3SC6%`lFtZUbX*a$OoO_&MH+>3yFmjh4
z(`VSttj2)6%4tvd5b}^33`Mjjeghm<y=Zs#q}zZa@<mE}@(SQ+?nx&vG3@BGh&X0g
z3(?bL=fB68l7POPW)CcAE>E=POo(P7E*YBUNSHYN){mh}cEKR{$=nB+98`NXuv&nu
z4;ptAg3;%M2h~*~E_?|EmT*x0X^6|G7Ngh(;p48X7LJw%HN6OVKsJH~HM7D)if7vg
zP5c(}u$n##coO9i)r~3SpjNiysHA65ES>(pqx`cAZ(@4>0vH;+;2oy_gyW3CN9;f_
zdgwa%$lHOH%7^w0UbGn5awOWpM=|(-VMS^YO!3DIrV4Pc&$k#4Fc@F%FTwcobTBv1
zMSk-C03VJTg}U?=79v;M)z>+|MZ`O#lzk3Uxht0|D!w7SX=Zocb$oVME271ucTXNy
zw|v7jE#G5U7h_17?XJLM`DXxH`=I-|$5KBEe0jc`A<tz;o|ntIHzX5zc@*>b1^X3i
z#w5eY%RdhytFIKn_^9O8R`hlGxo4s|!H^@HRtK!vpsKgvEkpeUzl98h1@B{;B_^N5
zVU>sAv)V*`Vx<?qgITrO7c2aKyk;mWgLVA`C|)_6u{94()DBF<1DR6*9eW6MP^#Y!
zjsVnIu!pi9P(OIa9!4*;CAIi#U4a6!N1hLuc{a<+9!-tbKF1ImYIiHVR7nVUY9(X^
z0lS6`LZ(l4Ewg6i9=`(ZXPlIke!PxeeCk%{u05Vvaq#$3{Iw3C)b0Aa;Ec1S6#Nx+
zmm@~W+J|P9ljnnCXTAuS%qeJsV=l+vIZ}u^)|?_8(}3ylUQC_vsehw|=QzYrzZh@{
z{RAXsIi<v*+?B^HF>?I>M$}<Bai3Gh;3H~dBm9@MMMm>tXh}IkkZbBtEbny8!E!>H
zmdEnu%m5v&X<01qffCRvP5rUFf#?Qvsx>W*<*`NNjMcOxmiKTQXjoG>mN#+)XpN>$
zEU%1dsMWMMmUjhdou);xJnqEjjMua<mdm~PoCYf2Y?LBfWriAnQp-?mTIov+2D2^t
z{;N=MOhHieI0jZ$m^JF*yV%8d{FfK65O_2crTAWfqNL77U~>=+#Nojhdu#qPw{)Vo
zT&`D`gIMFw<A2F%D=}6c#OCZlno4it<32uq3aEc6B0arO9ybQ*KZcpxgmB8PgwrPY
zDZ2>ZVS-fve5(Ay^b_2us4(YQXW(~^bsC;8KOERbaq943SW6$LQ59A)?qVioLplJo
zANgl)X@Gy7^kOFc9Yo_wT8o+1;fPr_EKHZ>d@5+^MGUQ!q5T0=a<U^GY_1N~Fw49M
zR&wHFmY9=P0_Nm=fbu{7f99leTiWSv1mV}YK}L=8!;z$OXq_WPz|0Tf(7j+gM+-wZ
zbT7D5;0ibu`nnJVE&@dx%jVBg(4aBoX}aYe1u~SXKt*7<(g1y|d*2?2jA1+BXwRiH
zljD>2Ec!5<H}n);E(0AOhZ~p^J%Hw7JdT1<W&q`G_8+N7?|aiZ+J?gAzY3JV|2ulO
z?uVK1RLq2j|GxwIE<Bqa$fKJ+JdhWt2lC=!eF0*)RG=Qyiw8ZX7pWf8uVe^%Oi%cK
zkLks+5-q@U4dH)>_afKBdx8H(U*UOBpdRTHW+>i~g^7ub^owD$JWq+2<LFz?=>PBd
zpPwS}4&gA?x}prQ_6|ZlD|nsoM?B_To{uoo6NHZ`)e{8CPy_16`}A^3FL3~$VQhz|
z4ZLG2J#FA~ho=qY6l1^|LA7U=e}C9hW<Y!DAC3?z57Ix2#(;ZzZXvhb6r<BlUkj4$
zB7-X1<ghLK1SD1EnNxuE93<=89Y~zaL9)JM3iTW$>qlN5qURu4KN0IWNY;Od^&BMY
zXJTB~iHEWb`3zpjhVeDBOd(<WDiTXb#O53%%OfOea}JU<KuFBy93(44NRn@+8d;e_
zy6l@tvdjbU&~0-Ll9g?8THIrE4w98)GR3_%=O9`7Bik!&&Ox&BO}3vtn{$w?Vv|a}
z+U6W2%Q24zxxnTeB+E6wf$Tz?bC9eu(~AbW&gL8>Yq-g(-C%PLf)f1!WV6jVNLE<L
zR-1E>tQsNPZO%cmYK82uIS0uaCmU_MY|cTl#!EtX+nj@BHJAet&(lT@=O9_>IY`zm
z%%sdgvbGWGIY`#6%&wk;WZl8sa@_DRWKd!TMonh2rLrkyb&8aiV2YG;kO0Ua`o(e!
z0>Q^YAdqV?TLAReporiy3x9I+a9IofW++y1J`V;T-X!NcFnYo=uzEE5JejZz44;i>
z^@L^M_$`DoVHr5_F<?Dm893>FU_D_O7`+%+Pgn*{*$AvBECZ)8b$Y@wu!Ujj3CqBl
ztWG^)8JJ+tpeHN?lM3n66PAHT-UqBFECUx3>j}%iMZ|i-GVnwuxzEUA>uLs+0>Xsl
zz5+B3Kh-3YhY)aE*fQqr!s#%-o9WR|qc9t=ucO$~1<Yd#@_Y`;sTCwMyA6-#e96xO
zs845Muy9a68lD3D6^}w#DjEa+`d{$kRTD$N|GI(}8zaflsG=~MyJ0<#gbb=-YGfug
zNR|sN&ZGvNB?hG}j0Y>Y6qGpy;dyfc3|uW44Dpc9AjXqlLZ@@i_!CHhFXxSEa4%%n
zm$OgcV`xk{`%{$Okpg_1V-_QeNvBZqg>O*tak>c4)T>XN><IT5nL9Bu^X0rIS@;_x
z{4>8mjewYsEr&hgLDuU%hq)Ky*TF+y04=-)&13NJOsI0<i^Bj%&@>v>3zfhjK42Z1
zjVOvvptQ3Ske})@to5i3Uy1Y_A0`3IP%DP@43ys|#xk>DJQO3hokLvJIRh#^#{x9e
zEiUlfFA%a)Q-g=Gt@s6!+|Iv3?o*p#gmUNa1I|+yGy!+fe}USE`pP|m;W&y5qPa&B
z2h>!gAa~(+@Dox=hIusQIFE}?BllQ78&Ufx?;)Omy)FkqADaVDRu)P>KS6sf^W*&X
z_fh0lHU{4LNs&H;N-G%rSNP4m6L3%Ad!-n~D6<?z_C6Oe_5My_Ke3XHjKUAJ#hy3<
zem<hyQPYV(CJxAlfC@h$4#~%V3J=g&go}9jOW|j<brJQ=BKZIO9MoG>4rdpBLH{vT
ztRVlg5`!Du`HI{W9;^rMQkxopzb5Wh8AE{oN!+7cj8h7~X#?(6Gm!1Ve-Zbo2T(SJ
z-x04?@1ut;{GJ(Kr#>hCH}MAb9q|vuo0SJDU-%>ORyCOTC*tj@l=wfyJJbl`pNV(b
z<A@EDWH)A+D6#?{hm)BvBGB%ll~1t{N1%NdozB8C6z_K_I)kSjluBX5RMa;gzdqR~
zDO$A>72>G-k+Gt)hyyAU?X~FazoURca@e=%925R^Ar_sd3(-3ge$HpXMb&0JRg^xj
z%GH6Q3qHWJNi}mg@P$l67gj6-NN4WLNL%rGz+S6(_;L*V6kil69&s94g&_$l4lxl*
zA}$`qh<$3`RQMUqOP3t=A2gccDn{HRZ;BR=U5jUX)tf^h4|D6XPu(yKxQ2dKtKr82
zkGmXx)~QPvP95bN)M|uWJf3*7s_Fo4_zl|6R<!`J7e^@Hp`K&fnkq|B>go|p{)?N5
z`<)+AK*bY@mFb*=axI?p0wTr+>X>Gb$;X3WoAfCtb@3EV;(ASIg%4yZ$#&D($^=el
zB>krIA)0ovY`PsVop+dxHfH0X>Exh*ieom&A=7yv1u}!gz-^;U{VY}^ZYX7a6~|A6
zp~t19wIe_hBmv9WPy^CVf=fw%O_C&uTF!}0Aah7?+h``sbS_CZdJL{$73B3HZoPu#
zG`<B~bR6zz=Vm5v0PHgy*_Y8PSk44inO?ziCawk6D_G8?@xXco%bEN$5*w9jb)u}+
z^a@r%{s)XnR<PV=)^QP6u-pl+7E>j-tl&zR=@qPkf;{-qD_AA9*8<B5R>?S)re47+
zsk@&ABP&=X_1wGBD_A8F?knjPtdgch@S|6-N}8$DdIhUw;w6yl6|9m;TGzRPRnkg5
z)+<;gv2^;mf>ltsjp>mUtfB?Hc#c<@6&=x!(o8qQBU!R~1*>S$W;6}Gf>m@BgAW*1
zPc?!m`jo+pNA*XF;(SwIH({wsywrk%ENW*KeYo#%rBRf;K*Fi-hI|g?*h{v6=Msn1
zXY`+9_}Dq-3Ryw%41}py$Vz>DDV@nI&HW{rrFlA;Tp=sX=gyp7AuBE9j+b5`D=i}4
zA+=cQuoQL`afPgO$f;-ryIro3l@4Ry#T7D_D`cg^HRTG~tq8Qhd5sCV7O>l2e(Ydm
zlyB7dE0|cry?8coWjX}q&h>%@(;+DLv3AgOfMv>Uo&q{XyZV*;R5PgF%QQ=syNOiq
zR+=Ts9l~eR+mo(xXQBc4>-DpaDmnh-6aIVeTCtLy&cpYv6)E=^CL{e~NTG7OXMv_)
z3@K3VBdD~)7p>(heZyJ$)sH;ojz$&_-<_7L+>_8-`df6oKIQWCguhMG!OFcCMm>F5
znmGt`0%&?SJx94VD)R7UX|{6rq5S>J^t0JYR_6RG4(3taxwGz<BP5Pgmj6svRzRIS
z0`gU~Pa)az^q)hkm(+`w1@3aBHIs{%d;Hh%+G<@j*Gkps@HaDjCCgj>>s~<OF@V9%
zeK%8&oT5{YKh5xOyA3)LQ2FB#)m<E=gw#mPF8y~?>v|09L#RqY$$m!l8sLGlRXp@8
zQI(ygqvC5iWoOgYDMgJaJBL`JDmyPCs`(H~s%-UrD;U*G)JNGG&&iDH3iRS-7rYI5
zSPewklwCLo@`%{-vbCq2!bbcREKb=aROOhIPT8d_ouu?XWtY>KbxDgWTfZDSiC4JB
z!T*&U75B)6gk>9ecDGk9AuQX-X49uewZqTV#Ou^9j9kk$ap1bSh{wdsu00d+ZdKPX
zoa-6Rc9lS3l-<B^cF4hmvKwjec1f+2-OO6qtu}SR&n+}ydsR+7@U3j!`(0jPRCYTu
zhmp3^FYkwy-67Od*e}XjcBfFYpkGwE>@H37``sF(u<UM4^ZMNbOww;P&Fy!WGFA6#
z>g#uV&}o(3r|IB+xg@Y`ho*!2U7kHGyI<3ses>$JVc7$k+Wjt17?$l6Y7OjndHk^K
zK}}V^I~0mo_OSMx*>6~P!nwfz_gpB&&45mMBk%c>aa(!Q`$r<HQd8y4tSKcgc$81z
zj=0aTmet_dvXStg*$EgckBX9V1EYM(Nk`yW^>ZEYREDF^<&?_?xKFy8@)nl7qr;Q~
zF9FeYtjD6{L+a~!cy=a(3@d)SvwRkD#0?^@^7tIqf>{xDU&pYuJfUfM)a7B5@^($j
zqVBm+iSneT{-|5p3_3^C(y04a20K^Nk|=JFtwoM1en2!C%0wdaMg67k&robeI0^|L
zfik$^4NUsrkU{R+gn&)gx(FGskh`*FCn9hxl*zDWq0Ry)cEEEf^~!n~$*h#u0IlOt
z3Y7)?j$CFRMt7mgqGy2Rv`A&KK1IUw+LaE)O7XaMrAzFSqgRzB#E$wFS*tANX&v3W
zR{Du6k*wq4Zk>RpT^ZO1n7IJZsT`IGjZ{36TsfQ}=!;J)M-VHu7KKt7q8C(j{Sc5L
zc_10e!LQsG>Z8YBehlk%DD4m*6KoB{2rQVp9D(|MLw(2Lks@xv49%tHXp=KEk791Y
zFqyIiGc<o1M0mpgCjOSl6J=64ey`z<LOl<y&~@c8+z?vi(150v;XaB&9GdRGOvB|j
zE`|=#u7@KWsw1?1VnD-AM-;N#GfdYNcYB8Aa*xw`nlSHJBn!JYHc}KGF1N_a`&Gkp
z8H^!^QikU-KYE5VJfAkmC#_|8fwuZQs587!Mh2KYLj#5vWuh73+ft|j*-k2{>Jh;T
z{0?To90mFKw3J%<#tm*Kl~i9PJ~!hxpW`g;i-G@-SA4Vy36||7r<{u{vYq4vUd97@
zJINWs0iiTBC%6kxSBEq72SOS5Im76M%R*1#uWTndBYm*WdOOJ(&Eci?IfhVgCpq#8
zC@XXTWd49tBNK|BVV|8^DKlK%j=}6WsRsRc9lhx7BuC~1+)m>3M7EQh`er!e)Ex!f
zPI6_*NVb#QJbpw$Zzs70>=5NRms_Z7hq1avIwo!>xy9^t^mdZ#5bNzEw}gHIk}|iH
zI3(|Px_;j4rMHvZG6t`=liYIJtf<TFBsZ;J6)~6FNp481TY1doc9J_<)3TV$$%k8|
zsXyj&JIOsfT#C8ePIAX;*OHja?Ibs>sT*^-o#dtmQ%=m~c9NSu`c)irxt-*u&w3Tb
zTy7`1>9byiu_A6KxeaWE+)m=y7H>NtTYjHAh4-Rq4{}M1)@OH`=rfE(6#|;hZ!%g<
zu;y;tAP0pV1nhMaeC1Qm71~)CI2XFYaFd*VC^>59&LQ^6`@-&AVn@0xcb?8wML-6q
zZilAj0rxK>5l5${WdZlHxuEkk^#|PN%0Rm`Ee*(9y6yr^O9CpK3)h7sk*1I;nGf8<
z+6~K?!ab4t6_JC1?lK-&ipnd5?n%skOxN^s)^wM=x$K_IymhN(qY+Lo8w7?;AHnvz
zGX}#UL-7WCIRMD`L>Ya|pJA<Nfu~t@;;9M0`7`N3eyBWn)PoZAhuoFFhJ(Cf?Vc`=
z%6_YR2E}^j<en*Aiq1eEGvFxpcJ3->EP$Z+ob@d=@T?>rvl1Asj_~~sFmo!PZ$#cc
zhW6@Ii1P_`V;xZ-Vg$fZjz1Lg$xQkIgcizWW^qc7IFB|(iGd5r;Wso;XmF^2a!1k?
zDrC9>hSiBNL#XIoglGK>$w*%Vd}jUw&>5N61FRVQ$oyY|A1T3TLo>3FUTA1|pQJxB
zQksgC$jA~pA>lQ6yp+y5MI-%G(SW3AWSN*&Nzur1rU;X+|DXg$R;*xnzEQr<`5+I^
zjnX-kZfI2Ae1xIR_NaV%8K}=Q{y_L1OTw^vr{ST3Kk9IbN0j1$0b?O@2z7HA<w{8*
z`BjkN#VdHWZfSt0k_-s^&Zx4Z`CKW3Djz4$Nm^vig?`nngF|2v{RT!=UHf0Z)!Ogg
zBjG%jVxL-mG;o-hCX&Hgr$M7e)tm_E-#%)VEHf?chG;fZr5ANZC0Hs-R+&b%6Z;hJ
zp&K=aRqv?Mg}`(9XjHv;B=9`S@k&3#>7cw<EoIE}DeqI076Errz7?sU%$iNF3$`;A
z;ZX~hz)9zKk)%RKF{6&sGhE60(Zr6bL~l5%TMVvYT?@l9>X>Rgiw~R)Mxd|E!#Jtx
zLJ?ew-@#RQXfuGcIm1$Dlcm*kx6YXYIF?<Vzq_<H2wNc&_|kEVM-Mwn>!>r>ZbJQ)
zj;9w#-3}97+R%p(!fGGPPicg~N0c!FxbaqCm<pJa(xx8}Oib41N+&SAIGc(AMCnB4
zugl0{(BlxK=nYnJ-kAx<N%tavGHfchy~qUd8o<(+z6Ox11*J3Cl=sSQZKX5mWxptK
z=`2=Jzv{y<v~)HXJ`O0)DBuJmJLvMrP^liwD(8^9p6N&rW{VHGr}C-vV7BOxd;V<D
zl(v(FhfuOirKN^JI&Tsnz9x^{WPgg@adf@;4@k;C0<M^a78f18)I1TP%QvY;pJ;Lj
zYuN40@VZR4q?FCM^XQYr#b+<ZIAQd1adGT@h<Nl0c|KsDoC|WYcnjG-jsxj6Pe;gM
z+l7@MeTqC2L1K7M(x3>U$xvqlW+>upCT2A53zzgFMl|X%#XI4y_*TdmhY*L%;A@Qg
z2*r5tL-D)@%(}Y`4kcFuW~klx_4}%PU(?&$D9@_gnHcC9>Ka)4s(fNBbtO?gRfVt8
zZ?wvp3N6)sO9<0`{UTPLJa`oo#I>R2MpZfY9~^ZeG@xoIYmE6~xYi;JpsR*);Avfm
zr>cENA+*fX0G;Z*D;dc~6iszL*Os-ht}YO<81d>t%4sH3@ahj#yD#&RJCW<^62@bw
z<r9EQiIsW`gOO^TE;SR`sV=A7!3oq9NX4%i#-8dSw+G;v<xm}Dkr?V7EcsOr(@o`l
zq`G=Iv7^q$=(9S+<OIYtSC1st$Lgy`F-c+dN)&#^FvysClyS;RaZ--#RF7q|>5?&4
zb(pwYy@2LdT^qx*J?aP4WOW_o+tn1tHJ&qq9qu*I{OSf)IxbY+A+52xk*#r;48*IY
zW$s3)ur#c-N%(Gl8_*vZJM%-NM3xW6&f>J+kmZB1vpMb8c7Lp1x5dPx9-m`KJOuyH
z9Q<0(!+){+GhpT)0F%XKu}VBeV^Cbq=z00#a-+C{AC|z!wx>cKpqGe@CyFcSC#p7L
zy{UKzOFo8`K$wH#(iA-56Rr4_F~o8JpZrLuxXTA|W~f!->wNj8Lx$pbAVX~w$vy;V
z<w6h+ZG)iL0yM1fCLf}c<(}|0GF?^gHp7psAn7&z@Mf7+s2`x6;Tt#>augT6!#B~4
z2UJcRIQ>@6os)oX;nI3iJwF6^8>f&x>I|%Ig>R#LgPMz{!naetUA<Qed<W%w)oa*%
z2ydtSfb;tn;JY~5@R`msI^0bXFrD8pwtGmhc)w-@{@hCv#SNxNS@=GZBrYI@!3*yo
z={B8Qbfe)1SfahAa}R^w$tZCR!3)sb@PmwV1MaJffjq=#a0|fd9FT`e_TY^v7^d(e
zT#MdsI`5;^hyOs*Z#skEA^a!_wgNcO3_nJ4&~#{W!;dr4L%b~D+Der6<~GP8l_>Gd
zwSfKMr$(V5WkwTzx)sn+TtEyzBb6ergM^=b8`<~i(*Kh#eO@9Ret|e3T~_!-8sv~t
zh$H+GaYRX4USV2dDlZrEy-Z3{<rBa9KEmvh#t?pOBjWAGi$p7o@at=!x9j9piSV2B
zzgeAE2mkwsx2p4r-})HOZkK6b_-!U%H?Z(KRJmP>?>mJ5%wBi58VuL)U-;}EbvEOD
zk9e=vw)d%R`wi>y$#7`mGJ1w;#&15$!6$`*@1CHj{GsqfrcqjDc+xMeGCcX0RvC^m
z+dh?=i_oTUlon8YMJzm(c!*)0$h1$Jjd1)<xRrZPy6D>YoS~nK(XUTGH-k7&ZgUCG
zBrY(lvMC5-))s~l2`6R@I~<1W*QCQp{!bWl{wIvN5{4{~h37GMj=b#`?$FgJRWzT)
z6Vg@G^<@B&8P;d89^nQ3c%T4BvH4-6LSEJqK80KBg;JZRiu9XyNKd0NER=d$c_sX!
zOzAH}Hron(;d6H~fK>zG^*rvK7yh2gd_JY{M2UY_c;U;aVXb_N*fjLJNa3T{7(%+#
zj$u3zB>^4J$D-;Uwvis@GO02UKzJ$fT=g9r#WMQuQun}QhL;m}7oBc|PoIZ)d!$1S
zpGnh=t6r%leSGp%t$M47SE{=i`dP$h6rEmggjfF>kM^luO#THFualRO!fUDV8?^Rc
zOuV^h<;s(c@FhH;u(f36;$9<s=^W$<D}cAT-=d=kU#@BSZQ7E_Z8zKHwaoAaR@4r|
zD#G9@yzvo4i9Q2)gH44)hN22&4#yZLP&2h|1nfH}&NXsyMBDwE={#bN3q;2oMor6d
z#EZ*GTY+1N3lzWoR?{{be$dPQ)d7ipj_|ExqImBoH4{N*K7by;8TXG%faT@GaR>RR
z-e4N{6|q;km~mfo^rPgyqH%{-LXLUDlX$px9>cNDK~%LJ0w<u5YdZxlLFZRHU*H(@
zrnOxHe~Wz8E)e)+0PqNbufgop9x1Rt47gC>_w>6+;5R6g+M@)n9{_l?z;`entL+xJ
ztOM{Efq(1-JXYY&QozN`iS?T%z~cn|8%0*TB#v%9v!)G-H}18qz(uF6Fvh*kBLWzq
zABOlm($eFMac}TBpDv^~i3@bW?Bjsc(FOAs<pIN5T!+y6?na0eA3z<Qx<>O5NZ>f5
zuE{J#4H<!zC-)k46Xdj%vX@ojU8+e!?7)iSml$=Eh4^HkTNf1q6Y(NCwAxi3%nQn|
zM$5GZFvn-*lm9&iz7__p_Us^d#d^foQ#ajQ1rosLUFupS5F;>mu2I)&GPf#_FzVU_
z1_B9qi3yGbR)meZnPw%@nbZl0%d_2>+s!}(=U&7Jo|wjrEi!j8f-{ak)u=m4-hDO#
z$DE1`9IeOWfyKufb;p}E2n!0+*oeo^e+o}zhN+d~<KF;FnT}6zRHyZNd^_hDN;a0q
zCuQVkSobooYkp?bYfxNW^$q4jXkY<WPJKjY&i-*a-a=~>;<Y=W@%7C@ls&u(M3=WM
znW~?Zo+Mm=ky3rsJP!j9$NmvP*H1I~)_1_>$64xI&4)okwu_kSV-i}}J`PG%Kht~*
zE)jbgYNdX*kf>cb2qa;0I1{t)M9Z#EN=YQK5-|ojxZsIV$ib)ZwY~mnb0aK_{WIfy
z#^k%;hMign@~k;}1`5Fb2zp+>N8<F^HCZ5k5>gO2dFdHO{qv@cXPf}>3xY#(p=kY!
zrXLQdNEnRzm*kNyotT#;G2OasUJ;ibT^xI*IC|}qU~uYR6>oj^5{wt>UlVVu?GI38
z^{)%L$bJYlTK|T`v(B)lqNr;x+=AR>QtSKbZ(D@S%BETU?Q9f=nt&!*{~KbjT91ZU
zFNgfJMXBG8NYS{YD(*ZUd3V$ujP0(AfCEY*yZa{KkopKYtH0+d;IO<4Q~z7~kEjzc
z#IC>ZE8wVlhUNY{p74#S+s6U#<O!{$67_hHX*f<veLh6oqsm!nyQaZ^F9zD^h-xq5
zdz%$g@e{81nNQ=d{U$SzYtDeLbT#FrtBJ2b*B7MK$wL0?3#I%VdnGekY|g_o0b6q9
zn#@uN=iShLYS+GkkTZWZ4;iRmJE7`ukzLGW8R|u-eElWFUUfbE)UP8}>LDig(g4E2
zkc9ej8P&y6Z^7KwU-wLmMb^^*d_Db#)Fn*$4Kv{<jMKX4$!jlZtAfqAtR6PwJd{=K
zW%J34@KZTGX4GE6h1SeJLH##0TsEy5*0A@O<BWzYmm@es4plX5AodpZ8VwsGs1a4P
z#AvvRNSnxpt5?F^QRiU%)v$^3fQllzhF=qh#9TI9!!W|?Q4Hl9u6-WzNYN=q!*%o#
zEjrO?xSlAcW}s0w+`#@Pspcr)Eqty^Wy6Ly+(<v&QalYeQQo62W_ULrhi2WYZj1tN
z9U14*9~M=^Ei5W%?5k*Wwd)heTjo-fNUWjnIba!oG^~;yKn+O1|JmDSv&eU#A{)+m
z0@$Z2TY%5|8Q2kxZCFD;0mWMg8!jMD=kG$DKU#r?i)hj!>a4NA7YC7^D2h5Y#i+gV
zHKu_JBI_bIT?=O^>&UHqR+n|;HkPGQ(@+8tX-z(qd*nCFxq}jm+(8sT4MesRg{0IY
zcM^xC)FXEhN7Pu1StEB7M~hB1BKHu*q%I=AWqe7gi^zSfi!LeC$PUW8rA#BgW103y
znMUs4h|=kkGL7tHnXWdhIGS4RhHc10=IsGI6}f0KdU7e#$XZ>d-B8ZR#cPp&r5YCi
zUveL?Pc@^pM=pIG*in}c1-{&e@B>oTkt?SGhor0{8@qtRQr3~Hh$A}vS2LYa#j=iU
zVp+!&ck3e8Tn<0D02GESas&N$8I^Nc?pMu3+A@_NhPd&f88zv0Z@iS@=yGqoOqV-#
zsPXbMr0%Ihjq9bk6|FEDf5j5SHjUAEB~b{cq8c|4g;7I|(lV&ijnXorDm4mEU#&}h
zE3veUq&f)AX_S`HB_-W>ElXN!bt6v*L6d1@8m}W>ss2U(H?WraWC6c%3-M}|3p3n!
zBk?*_0AtX&jU}-`y-a-T8suQJdV%;h;;n{tKAL3h)$@@1%(wFpOJheCIy0%U#!g*h
zJm%6ke+j}=>R!}R;{sxzIszrycqFl-o`Q94Tttj3TVXXCySD&`r1lz*-3uI++G{-i
zW8jF?UgHwtsLt0?<|`((*SL&nPO4*J&l^{kBb{C93Djz1-)!J+6@x`-T+<8OV_4--
zmD=kIkmic@b%wF0X^=S^N@#zFd^HU=dy!Yez9AFDXI_Fwlzb4dDc2kVJ@na}#x~_i
zkLK94uub_w{BqMvQ-K`L57;y)O@$`wBxF}3{-$D+su8j0F&;-q)Lu$&u5<%2n|otT
zB|?&RO94o!kS@C_0OA+YZ71ncW`>ZQ9(!#rNV$0iQr&CM34>Ia=YaIt;|75Q%o{;g
z+gngFO_k=OAnO7v78^}N%qM|2*kjR)HVrjD1leqVhHk8Bn3;=oY_*Hf*))aBVvy~D
zV@~fgnnsx;Kz19}OpeKJn2%D+{Bk-9rRmCZfYmFEWP=asGSpSsz#CshC#JBGfV!^T
zatZuYd=J>y^t9Pkhl*c(>Pbe^v*zarHC^P-{cn-)Nf)`4vL3}aGVo}6K3(LJ`xhnm
zfxyz^dX1)+%&!ny$bO;<@$11#*!}_SrfIJ{Q)h2rj$bp2XjSaXNnRHc)j57savZZ4
z&V|cc=8p)i+rBXhvfs2I>#@Jj1$kR~YjpiDVsWbWMvmUguZ5|w)*!^%n@<DJT!>C0
z)bzlkz;Xdd(@q-_LoKxtfD9>=>Vh^lJ)8%*PhDIC{3tsu%ne{3n;xTz2XL7qs<L+L
za}4uU$epGe4>8OTvvm`7)KHr+S8BSMDypPUZ`%5Iq{e4hTt=+D#e;q?^E-4%8=4<^
z7g!C;#~J@e89u&F0u$f-*w4tEQs<&wG(SEd#q>15d^GRQ26kk4)cn+N;DEZ)f&7^$
za7dju5BRy`fx~J-6!=dU0pm`|O5hjhKdS!K3H;KXz%jL;5crj+fbrE8D1Y;-9{{7{
zKruGI_9Jk&dVVDE>wbjXBg3`kHyBQ@n7QUR*`)fUqiNp9^rK_`1_f8U?GxtlJrvBL
z<}Ws5C?iW7&3_+)a12!p)6@J9`p0LZ5km9Vx1p^54`J^C9#yrqkDq;JGT9`DWI_rj
zkTP&6p$9^V$q<H`32i0=1A`z2QHTYN3K|s!R5VyYQL!U(6+8CWW4mI<j#sbpS+22T
zxr&wF`>t~ax!?W%&p*$TGwWS@?Y{Qf_3RVWucF*)e;kUu+xj)e`%@9*aiur&{xkDl
zp}Qim+FyQy-%7U}erI~B-E#Po<q)x?91O*Rh+0w*reaCNEh!1VqL-8<MG;UeizZ9T
zLMs+Vvn7R*rC1s*)+nYnTl}<IQZ$xg*{rstY`Q8IPMb_NYI8(vy%?ri_dTCY)(gy*
zYnZOFa-qYug^HQnEVm-oc2^Y$V4LMb!POQ^!`N;qX0xY&`z+qmQd=UR-MSCWxVBWW
z#5%0MLsx6d1?;do1_AU^yw+%^^$?6mExtv7g4$&r%nI!*)4TVrCYaOO{wjnl>=x5l
zTOp>g6EB4!gb{b&h`7s6i(o7{Yu0pQ#69-{_r7N^;xofbGTudTSlgj>;iEG|W!(=!
zFB9OmZVAEVxQw9-QMuNX3V@R`sxjaSTB|V`3bzWdt#!z9_*4NQ>yM!T=Slz-R$~xg
zoq)mCgz*69WxRYas#`8S4PPoQ)z)0Jjqp_h!qyD5$?!D-B9?>9hOZMa$>L&Yc(Z`0
z)eZJ8yhXrti-tLTV+LD$+&Tia65g6YwMtnFPzvFjM6Ai$PO+N>9B#db{xf__2CYJ~
zH44x0tr_rXw1iF^VT5nXxalx7htP>tM)>xOlaGLkgbp8Wgzv~0y_6dAB8)@$P6-Mc
z!btAUIO|Z_dJ}dke6K{mIn;dQawB}7h;6f|`r-RCsQcTk*O<*mGHyp{v|IPE&>j`g
zVa=!5lj3KGbx;?8r!rchC_AkJR>9L5G-11}(O`w2&G;F;$!@EKRq(usbz0FRzzZU_
z$Kt2l!!L>0UWW}d{6@xXB-Bt&0n2ljWLhidDg+dMH-nQ^OF8`Nd-%PKd8qnI<-7z1
z4gWLa#|3De%K2g@(8rR%h;shLD*7~otu?Bg|6xIXmN5}A#Fay34}UI_DdkK<+X;Uu
zXaVjugi#28lMzO7HYtbi>W9C}n9zjUP|i=)KtE+H0cufw_<~6I*NhM6qe7JPZ6)0H
zNhqt8GYCCqSOu0NLv708;2>-UXvx+qCj|=~_6Hh}md(f?izp*NHQ%P3p)m2`%mC^N
zw*ouWESD~V+LiNA1Sm_w?7+>5)RS!Sw?jFLsj6KCy`-GqS%NtMs?AR2w6h`Q1(qO3
zyOgt?>C6vM4R<RC$7_smL4d=lPUR@pcTWjrk8-**_A)^~;*Lcsc1X}(<@_-YsCQs3
z!o<Nsl?UVm&Ii)CIgz^2H$V*zn$8sZ>nHwj<Kjh3XN8~=)A^0cHZZ`|n~>=&W|)J;
zUxn$c&IcMIZk4zJk)aF|H{8GYg#$E7@({tDj_6{-qeU`mI_nr_bzlS15;vVk3V><?
zVW>0iU%Uev8m<+8O{ViHHFa#@1h_Su&c)+_>cp+ZboPw|8W)hdHJ$EEbyQ+sZ90!q
z-5UbX1*6S$mO#P6GXl>yp>9oQEW?Ziu0ZUYOy`neKy#!XHk;17tlN~Jt)?@c`gyRR
zZKiYW5TM0UF1Mp3=<i60Z#(XSL_ZfkN+jE{OaBzqb;P}&z(n?51U=bohFg8#N6<QM
z2|?}@AI+lSw&PQMY{%Md$14Q{tqxZC>Ar&?W?P?8PtWj;0|;3Os^VEbDqn>)W(L67
zzHiXBDy^PDfVBdut%1~w^L^CVh&2$y?(hcRa)79njVcdc?K>2q#jPJ$px5|L14vnG
zncHi9*8?<JuSNjw@?CZaO`Pce-4fbH>m!QY=X(fZo2(nr9fa@qQByZtHr4%6-xF}z
zW<5lgC&XpDHH6LSDc>h>X}1nf06gpSp>1_o*R$ZB_w@$YA-z!eB_G@1PU|XIlkh7(
zuG8!eEjxUa5q?!br?r%-wNt<zYhQ1G*M00r_c|+SCf@K>AT+}>D7$<#DB5e%@A=rI
zgI**4NXpUn8u7=1LS7^OM9Ql|xrXmwJ{rDC<%seAOp2mfIbyxP@X>llaPc#0CH$3S
zIqI3ZZ$vWg8O(2eZ0@r?gSp2?gPBrJbRPVD@1q%P^$g~}eKeS>l_Q4#XCDoJn{uRs
z`%}VP@0k$4pJ8rP&ZE?fEI;S8o0M}J%Qe@(1u5GM!_X5b=w~%;Q_gM{SvNly9k;_w
zpj!{;3+h0sX-o?Q?Nm<xETAI)+X!X1a$>BJQvV*HPFyET6)Tf4_b6v9`u1=ye?b#>
zGM#Q{cwtA}4Aa@h#^2vh1Ex*aTvzxfKr(2$=6Z;q=GrzL+k)gs$x+C3?qzL`@*fYk
z3e#y~DUB9XX*$(3pA-F;!L8bKvM`zrPnP&12s0aKs{d)YMNOxfUCvB#i+iS^(f>T$
zQl`_$8avGYGf<Q19Gn5PR3w|d2ENQs6WQW5@M9%qt)5Xl!B3;O+B1qLie#H-6qk$J
zde11X5I0=*Y95MYkGTJj2u8&%bx@kIc}JlM$^z@yZfvdYq<w5YC++U;|JZ^*(7gs_
zvOTsiXA(!n?3u?FjR76f?99g&lg30HhIMTD1kjbblrkaG)rMIJB^mM13dB`*4y=-S
z2W-lShu0F{+Yh)A6*l70%Ye(TfCkug0rdiabq=bvE>q^UhIJ-1tWK-?V~{i}A4ON!
zMP_N3(L9ud|Ht2={|wZ2s19F!g??CnLh<U3Q0w5uupDH*Zi$RVwRKJiV5tDhnl%of
zS-G?M73fFmjuaQ$8jsY~9VMW|Fza&>%@bjST)w0a3Z-tk3|Xz?svtE(-73*c%><Y!
zKpW=Qz2N29<LKpUL>U~{M_mpOI`L>@Twir2iq^1rm|<LhH(^HkJd9XcB9j$YcEw;v
zrl`+Q4!Bj^k1E4kVkjYP^@7et8f0l9Xq|~5BU8OJbL1JB=B8QZ#*yg)Le?fU&WO7U
z(??eIBQwRNBGiK0Pa-jyz*bscqc$ROwT^XX1qT2$3W$g$jwHlS)Or#%ADJa95OM27
z3}7R(1*F7~Mv_uCO-A{{tdVg8B(v7PP;Q{P5y{O-X43345~`AWDagz%Xam(_olelQ
zKsdHf6sa)u%V_&!`=ZXFl@AXD%?(Xx<x_n@_a|-ZH_!!-tsotedEwXrvee?fw$H(4
zkPk%KhM$0D9QoAeG}{MSUh$_g3o|GK6dJg{DEKUZd*9^})L4-CI!XkylnD(nBk~O^
zH@kv$GfEu+$9$GzP#$bwK{hNok{@IM@<0IeRsJOs6pvJ^a#Xg=W+LtulzW|gq((`j
zv_2V)z-v_<q=MEv(A-E^9Rgrm8ASkN)yV)MYYNj)CoUDTofH|Tu7*pcH4SASiKy)W
z)t2o5j295G*k&UW)LU?gx<w&#CVA{nIFdV4a?Nx~c`^2&2+_t$?jSTN?acJJ&I|)C
zi|NAbGd-@0l#P@KI|;~~p7zaTiVT=Hq&>cxX1Ya52<Lf{tOo$H3qeLEs*8p5UfLU5
z&i`*+d<|)Q1PCE^;e&gQa{5sj{q)EtH4C_ZA`3gMhpA@L<s(5Kt}X;^<dfs3Npj?6
zhJK`^&izkkLd3<*)qp-0AagtnW2kD&?VvTAO4XKhOX2=-`Eb;hU8U4#a1R}UMY}3f
zQAgcNf2w@4gs3g9CRO>RnFeu<PEVi=br1Yx|KSHcNbLh%_BHyqe!42h%!0+KparPP
zHCcoGKY$6V3Yvp4itT?ZM62>drvI?spu3q|&g*|3il8dr<eFLk8@q!pFiS|knGd?q
zq%G~wv*%SsCYL4qFGR6cbvK8S?h0d3Wt$^OpEUz?u~|d95eB@fhZ!M#D^uOmoI?5?
z*xjlUb2{nI8GfmmAnlKXE;Cc4A7;+V&4r{duLd154+mYr_gbs^y6JxcRaMo`r6cvA
z`<q8W28G|Ng3k%^9EbK1&^*f!(3i;bT6u1h=e_cLT%OO%^Fw*QDbFwDiH$k<&6a18
zJbyqbmR~a*%28#Ro1$I=uj*=2O$>`?hpQ?~KYlbm7E%B-z-)mSJ_ZY`R{q^6sztGn
zn{r}8LA#1kphutYgIOQI`Wt-#t8c&wCoVEZUnJbaNp9#ufy0}P(Hr@-!U0DtHb!63
z0~CVi_C-K*^9Xk<4uMvLq4ana0ImVu56>L#Ck8ZE&oUo^nF`f>$Spw8&YBO?+BqC7
z(QwZ2gM7dbH*W(vo_6Anr8v3Qr^rTqKp&lU=Dw`!EE<j5+0!oV`&~#O$j9-M<A%O9
zEyOKbx8<>=1phMHJV)#vtPbes)6(43{om4m`SY6X&uM9H>AFc{b-DgLnZ9re=op?k
z+=a*cUMMap2`+pD<skvfgWe&-69>5G5&|O0V*;+E^fw~umCo5|8J->x8F<{5W^ygv
z^+*aX)U1GhEbY$Y1FrjjrTd?7!uwz7R&%(VA@`4PJ|LzJ7nz_18H3Zf+{iw$i(!m!
zGhMylu@6c4B1jxijFSBQJcQ4UJG`3%DG@)P;@r0i3MG=4143p4esUOYK=X_X-jf1D
zJaHfD08ipm9`qTcE2M4YA)vRU{cukx$l$?zJI&0W4yF{uUo|Z$77d{*q>J&B<0kvd
zv`6k3{cn$d1>t$@10hK-_mm`V*NbG=GxP~K1@uZhbGTI)&{~qsy(aN`4ZZRKrv=cX
zfW8nwoMg{fQY(4)gtn!ff22=&{8haFcS-#U$s9NE=hD8pku34LNtQD5lAHl2T%Ckx
z4tMY~Z-*TSR<BBe!M)$rj1C8$jOsO{FyQ?Py;k*^BjKKV3Lg9q?$`a`DnNus?|9`@
ztWFbX$>J>(r9e<>Rv;gcWY_`C8;nJg8@vYuDsgxr-=CJ@#;+Til*s?*<3KHXH|?1_
z#sAy$|6QC#kd!oWQ#hTyhBTAA#%?&vkdFhB+!wu7kVm+JUO6v>Bo5%>nZw<CX@9o^
zNqbyn^rioRCMWYE^uocKP49!&M-Idu&y^$%eHT=!<|<)B^xx=-%n#8q*IfM|obkcK
z!Sp+e7W^)5I=L47uCxXJL4<e=E3*|{K&Yl;_<o@dSI8XO4Z*z-20ya~X%E%Bl-w`#
zQaYe!bg}`>9j?sdQEkmN-+xabuGQE4z~KU3%k2vKN77pE)2aD4cdT%5XEyjhF-%*(
zRSf!Pdd2HdnV|QQUm>sD)ci6Zbfx|p4X5T;4mGNE4#o>LzmbmUi!qX}`F$^BqBxh2
zt<66;V2UGIA4x8m1M}Y~#+pADfh<22I$Kc_P$`TjEW0oGnL^_hP==%hX!+VvO&7&s
zMNp=uHCZw>wJo0ds>xOh;Xi~}ZiNJ{K1H0_w8%A<>H?R5{u7a*U&AOTpijlK{1PZ!
zsLm%lveK`EPM71E@RE51YB5yzJ~wHlzUtmjJKrcFa+X_uJw}D0y74~l*t(&N_eKZ!
zNC|l5Czm6|b%j3e;#yZix~|A4Z%&3zIQ+;o;L9bSLt0diySk!!ybSGdhEa$z3e^lz
zQHH^xDQGt><#%P%=>fHPztaP0r%RxK@tTL!yL1v2cv$A_-rnvb-rlZM{G*CB9JEeg
z#XP2{$hK8am3Ul0$T}?t;0Xz=!jekvP^{%j84K4uDdS?kmcm44pO3jw%~O)9faWLm
z0-B2oWp5z40sXTubOH^I8_(sN0?fqwvTx<)@BRH%!L4k(1_vLRmqK+zwQV!tPb#Fg
z%`Jq?H=#D6+I36zJFIgZ%yxLLz5aOc%W|L*nHM0KNbSwvP_X|bxNYO0&Cr`LPN}_x
z$APsjK(1?VMKeUB;E9de+eq8`$vV)t(-wp@^|V&b+w{?yu*$V}l3$^RF}}N~%9Z@4
zN$qyV#6n@x%)MACslA&QVh1!c5zr&$`6HfU$G9OE<O5FJ77pk<0CD09q1!`v?t{}V
zhtfqJ;+?yK@W>zB^p+Ol-lv2dq=P)*e019R#{JGhd0}uH5ltp7#Enrm3_8H&uCxnx
zN&j+5hyFaBxj4(MQrDSE29KR|;l?ii|HGxLL}`MJvB*e1xk#4XfJ9GNt7^b^4L<$t
zpYXcnB7?&2<A$St)Wm6bK%!{b;l{-2a@tSx5`>8}<Vd4F6^kMhXOgbgXF;te#z;5o
z0_fMoI8+3O!ugeiiH+Bw9b99W3(;&RCQ=B}yalFl(nY*_&b(|S$PHIQY0TrH50f5x
z8UpxSAD)>_(3$GV7fwfw>m6vYlP`7^?a_MB>q%pU4}~##gXBVI&I5f3X<LVo)XA5U
z4(XE+@Z^oJAjk?iV>|gWD%xO4-sH>Q1s~@DpTuNx@)aLS?A)o%J{EZhuTV!K_VWA?
zifT%4-v$6{ATlz=@xfvO@V%ocePqoV6Q6$cbCTlMz{>ZPV3{}kfa(JYccb?~na~;*
zU)&D2EAGZ>Yf&}8L+S&7pjCt3EBvqk+Zv3v6@Em-Le`c+0FMf&u=Z(y$J8J2Q)&HP
z3-GvrYO4X=Y4{0MG9OLUIyM5(A%3FPl|ulY6cD#`7l5Y(q^y+;?P)a?ewwTp$~pY3
zIuQV;LZC?D=hPJdE!JVMFX0{Hr`0;82H<)12wYZMBap-J3+hvVHfuCf@S@7V^80%0
z<Q@Posd9i#*0^2(FRO6?o2{R^0lcE_hHh-Leuh4TUsbc=vfbKU2!QV$0<>HA!(N16
zQ(T4Zu#U0;URSH&vctNa;0+02r&SD#7=BY-2bW#e4J^^O)MEg<jqH!O2!67vL>kMV
zPhr(MyhXjsDj5iK6~57{656rwR(F94hi;7U-()2)XkC&8hg${M)-smVZ305pwHCnb
z0xGN>(24LJ0xGSE4FGovsJ3pPO57zNVvWlL*e)PyMWFxTyCnf}>j4x*_#OeXjqJ^=
zg;w<`(%JjXJTA3|zgKTSz1?j8;HCOO=JY2ykKnhyWqy8E7oeK7)fKHUyjR46RuAgI
zFY0L&NP)GGV!w%>N!D913E|)6^m5daJ!#WKdbwpa5iUNHGpb{(kCB9MhPYf{osJe4
z4w!EswDs=RL>F0f!G_9bRNpK?*h0CBInR>?0&JmNfsQ_$Z+5~PwoqOe1JuK$jl>p;
z>?D_)%Mo+Cw_6+%f7nprt4`rw;<f|ZGDN)vVS8mGGv-LTb}5JF$HRThU!jKBZ21I3
zhHzhQDRHyqSE^folUs$@Y>~a{3X`j=*lgj8_~9WYcLBBO@Mbj+1x<JFc$nk}+bgn{
zJKQ{QFL#8=IZcJPZBZp|mEN|+NO8mVO1X_N#|Xmq%F2E~)gl=+om<8O9V9u5n@0J&
zP}fj+rTT`I%~1+yZ<KNlT1haxN);j#axgEvS`^k0g<T_B1sn7|I?nK!5<oeJL!t25
zihILuXlHw&Wly8Roui^~!Fnj3(kC1PA}Ei)raZr)2qCi#RhE6cAHLS9GsG9K(h*-Q
zR@WD0gEBV|-aT~i{8N2l*u^JpqWGi@6rXT<9CW_eK_&o<H}E4;G;{}qPwNfmPtwk`
zcCPbeBu_drIQzhrMOqp**O?yOeoiRrn<N&}y(vvDE#CpsGGpEE4}$TuAg$s7f(J%@
z3S}5N?c)J565(&)Bb;l~GTeU;%Hyv@c``gB6wpsnl3LAwnSz07KwEQIi~;>6-RYNR
zHYh?&HC(d65SNj3;RDPX{N%7Q1G+EW>4BD4R-C|`Oy-ez@IPIc$AQjaw}w?8kY%5v
zOT`obq~w!^_keuPKsCU5ZQ7Zp_<$^W&RfBiu{uqOjMay^_~SI*XOy|K1abnJ<}mv>
z^t<81ea0c=1n_jT4ni{M?sITK#K``jD@2$22Ena7jttx3qkV@0NP9U(c7eTyw9Myj
zP23WKkK=sYvI!dHZ^3^kyux=X{J5=Wg*PoJzoHLL{fAGI{e9W~0?jJGMG1q$*UR|?
z>pryC@MbTX5;nIR1o*A5*^g`ypsh7M0d5pvS!3AwZ50r-zGR>OHvt9KbZm!&ZxVoy
z{jy`eSwM;PHA*|YO#trZ9tm)ZfIimaw8ys!s6c6rT!>2K5C)B76raqP6yH3!1n0sf
zND40OA)yKY`77uq56_LqGH`1Z*tz8Jyo2lav@%dEg><7@Lm4t2qKu5Je*=Q=zkz`_
zr)PWaAJARQj*P(x;mp&X0sSn11i}Lku8>3|b&NMJ)6P5saey<sG5GERE-vIiM)P@&
z!POB-qf{5tAObczwX$unmRJe}BcCS{4zLvBL0UL%zZ;8}lY=2C$>UK0*G24~=e#cM
zymP;^q+TAfxGD}_VmRQ2rA_<Uv)_*w+WTpjf~It2bdh_g(suSI$}sm6_RGlDmyD6g
z|BtP}9uN}gCI2Zc>GR4k3a7Fy7!U;XF%)NFFWWE9t)Ae4Yt$#FWuD$I!z(4+X#ZMv
z^s;m{gs^>)w&g$X_aos-GXBfYs}Sn`HX3P4)!)d&g8HnWVbpJxQq<pJ=wJUg(tgd0
z#_De(jbq7}FxAW3R+c_!9B8@jFR1gN_w_O-Es!hX>hEBLwjRnbWlkE>FQF;c-^Fk+
zSDg%cJLw8N6my>Xdq@w~Erp=(C0(hfV1QkJA5&kgEAgzqpL9gG!L|MY(oy+(WPLl!
z7#Ax;_39rYJzIw`maKo6;iPnL#`_5Q3-ng#XuTY7Zqg5;HtHW^IL&$&)AKm#7QF_e
zzxpRgx9V@1h7QuJ^>&uYlcd}9vuNA(PczK*`iG&QpW!HPqyFb~(9e>8pI(~*`tLm9
z(ypIELDxS={tn%aaa8>djwD~QA07#sLu#BAvd<d=@B)EWgO)FAG3wvBb}1^IZ{`2d
zgkkJn41GKN(f?6A&?&q6(T`-e&#;1sIQp>+R<*@Yqo2qy*0QcZ)}o(^OM!I)6fOEM
zwdN>Pj>Y(*pNUw?+SdTkDPm1l9*QjbxriNZ{g?~zg$!`FTEEl-d@0}=>kQ;A`nCA^
z#2N$Dh<+oW(|W5CV2^;WELLRnJM~R7296GEGWxv$t(<??0sWvh!zrYkNhqc0kAhOl
zS;{Q^qBbC{7#Dw60rabkxpB~_Cv+zIo4NsRo0RhrYApJ@xLu<h>Sgp#K^QYrGo$+?
zC0ms<1*ID`WL%69G_^3Q1l^9WQ8S;WNyWu@`oo?;ev>=e?Ks~FdmZg!-i`P$o<6D;
zC|CSpJpB`kF(?RUDraT@xg&OruJ^Deip1?r<$Qoqa<se29PPsQuIaBt+}_7wFqVI*
zAdI{t=$xWuf<93W?}3Y!3&J@3CFonUugSKLad;~_<!C<{3GY=7w~C_u#m&GuM&`Cc
z+_c$;8WoM3zoM)$DnG9W+-8~7gpl7^6at!URwK+Nzmwe$C@F4>{LTXOn$bDpc7xw}
zupDTvq-Cq$Ii7hqM9?<BlSHeCE;aedgxmejWoVDl<uYR5?spFD3$#M!8SQ>3^zAS?
z-8c6_WAZgTFdAyE*Pw<Q9%LIa^f{#4IjHg5y-_j^4+)LW2oC^wm_mNj<`zvu2eOPw
zhn>+CfX7jcEYtoIZM)&=?~ys&Tm1{cvjibrZ;cvhc#dMYw|XkU4uTP;y&MYM@I1jt
z(_V{=HN41);AqqSVg$g;za0(hW7=O4yh4EMt*=H2H|%^6K{uIp9GcVcIzh8(KMkwd
zu!~|X=AdQER~QXk{=`u&dl59U;U81r(q`HdnV<IvcAGZmX$|k+3{dT}yG8(Z^Ft?5
zpM5b3s^KH1E#<S>Fd9Ci79H%f*)AG78T105&1TW?dEgi%$7i!uG<-pqV|?}qRB3~}
zP}AbGM`2LVu!k<oefAA7xeebFwEFDRdjtGHu+nF1Cg-PR0IPlWIOs;h&je@tP<^K#
z!7hi(O8Go6>~`98b$fhTNtg1vs0k3tJaY=FVCu^}4J_-XQ(tzcW#|*Z!uK^`ov~w#
zK(YCZ-mD~A|KdQXt7}$YVzLbV2^7BmWzv4#1I1te3Ta)m7`Nfpze?KDM<B8FJ4pv+
z?Z5st(gj6}7enTCnrd5rG#N5)kYBAip|5|FbXYHiy4Al$I-)PYe5?L#(vz_GjpDD4
zUMl8Ej^;$K5VPX0W<{?Si{lR+w`7SCy<UKprLE|Vay$c{$3Otln+4d`uZSjkn}Cot
zp61eB;Ha>^9Sv}=nB__%`&0B5(fbsOq5LjrfgOE7jHkSv9c`BY+>;;Chvn-j+T#6N
z(MKh1L5ugQMjsbYU}PW7*87CI9ia^ln$ZDf6ST;>209cSWO9+wu>L@;M~4Vl?R-p^
zq0+t$<?N-?Fmdw3n$fLN+|E|cleCw^Wv!qMr_LilBg751ds;ToNLf|br260tLUgpr
z%}bc)(KKHNNitxNsd3S;c!LQp#Na<VR?vMog*pgmoFEwF2Aa}{phsZ@`vQ$Ommo7R
z&o|RNPcV7P7AAOd5NM)E!svFd2bv@ZMt3k05uGe13PyJg4eJzBK|Nq*?;Z$LZ*tWZ
zW_BcvU{w6U%yN%8+92q6q>LTMH1j0H4x`I+QPG&VX%mXf4Rrao4Bcgl#!Z%$06FCt
zQp@a(ZCRYgxtRT$VC7==JA&Etc(B5}y~Hr4O?e7@Z13P%b{iO(FAayrH>{?q!;J?m
zM#CC35HyZ2p;8TJ$+8x{qe08G_GQRqj<zrWYdDwYNAn$whBgkT4b4|D8rCr)ycLxV
z`g}P$r}<h%!^QI!vi(qJ8`e`iWMo!C7g7zE(sao|(uR#_fuK)ERWw}2L}*+fcD&KR
zHh}$%<*3?*E6BI?<)c7vA|29K(f(Y?23MiCL_lBl2hv$-WIlyjv>LYTVg#q4E*iE{
z$k5{$&`qTMdL6W&VH;_D18N%-B-n5p4X~Tk+ZnS_gf!ei6OCQ!zoEz)?qrZs2}Q?v
zg`918-=Q<#&&D>{Yn(q9=(<mM=(KPeQdsw?kUMOU|B`q20=g8AnGZsn?YfW704>E(
z_c2YPyTw!YSq0hpsA=%^x$JTo<{*qI>%N!)hk&N9^54)2h3clt$x)dvgH9XCiy@Hx
z6-EYinZ8FU+#$l+_YQz7ti8!~KV6sW`vvU&o!ucHbm?~w0-fjE2R`B(gF3^fj~I~Y
zM`6`<^$kLD#kAGs$c)zrtuX4kN%&Y5yBAtim+#}dD*;W>F1!k71_;s3au*+x#<@l=
z=SwF62j#)<qNHb7{2WU_e_-)RANiZ;xc|~$aNEEr=`1>o7oo`Yf<=q#y0S2N{dLjd
zyq9&S_6-Jo1nFIJXJOHjj!Z6Dn<vkO!_w>E*PI1SC~7$qB<|Uj=P!6l+PWQ^PTOw?
z*-e{VT-J*YyiE*#C?w3$WX^S&{XysRLo8`V7<5VV^!eA}S3U(keZh;UT=&Z9>2f`h
zt<UL-i)!V1qKJMj0=kLGjmzyM(-)CW>4V0De;Bs_n+$UY1}M`P&p?;~&5+F>p*=J5
z9~MRjp1G|Md>4dV(0#x)$>xhgAX)H<NPdx)<VE(b<k})oyra=D8-_x%h+&#N7<~6)
zNCk8`p1BmO{=YnpsKND*!HICn><w~HX}9B#M>#J!+$hbjE?~y5se(iySDUqawS5t9
z!3yeisQS|GTm-P)Ywm5{Y!#9QQ`!SngSp?;lqn%SQa3Z4QqtA>CTMVJ8R@Y8g!~Zc
zi0(2LbT87A^fSm#X>Za|x%{iNA1_;v>mM=VEv;Zhr`)Ug2lD3YCjBj%ap@pd_IBOG
z@P{yM?Rs-5=wYNg^z*PPrNeny*bdFN_e-mo+nw?qkkXO7y>6F&A7-L-wCG=P3Ra@D
znx+WXH+2^CgmLLXE-dRT{wM-i<HFL;;%EB<df$8~=`8*t1~}Gr?b%tp9VWE2&V@ZX
zi#c2?9p}R0&f>99?$U@0?N0X^{qZjB-dQ{f8dW;Mg+-mkvyy-lU0B#zY_dS6xUitJ
zxB^4OQf`_f&H0_heFz&|*sZhp@&SNT1)9N5`4UCxbk{W(sbUs*g)jW(bQTYxuy<j7
z*G@f~r7@Q^@)h)o>J-qtgWoJ4Wf(JqZO3D7TZS5M%7`7KUOojjC=0eJwoLIZEW>(O
z101JV$~wfi>0-w#ULF{<zHfrd2?A^@kKjZBA!`J|asd_A$*9TLN$QSuP%Wzl8XY@X
zK()o!onxn}hu{*iHX#$S)729IQEN>Vz!|C(eMH>))B#wdcy(#YYG-I?DjJ<8E13sy
zwyIr=LBI1w7QkAy<s78ibe<Ribgp_9!BzVl1{7PT*sdc!r#EyccAlW9&-syV=PRmL
z+~?d90=iI%HSjqh)LHBzK}|kq0VUTfHkf8#pB1=_DYijStIy%Lm|~X*YV$c8pct`B
z1#R*<*F(o+8wG7cm{7;q<$~IMPA<c|LeLIhpW{|6H)2;Rw)<T^CrHVw)RZ-bvD@b~
zL7ie(3+nVacMbx&MomZl_V}Fc%=@+KMWDStComf5I&}_^;dg#uiEUQ*!@Kr7^BLw1
z>H@e0{m$P80&S7}*?#BN1wdQX1&9x`(yGZoH;Y?^-x*1?O>t$g((n8m!;jc4O0IYF
zJNIG$AG=+~zY)LlOjn>g1V#PM#6CdV1;zbNAuAc1gs6v<-+31b7Q4?aUB7cb73~4_
z8dBEmclr$gdQiOs)Z%x(^Z`Aj5=dFA-{Eymu}9RcZI~PRhZIANV~@Gx|6s7qKV&Wo
z<8havH5lKaF~y$n7)G0aC_ilzd(vg7@(cV!4uuhoJ?%35J;7)$2IKFZL=P|$y})?h
zV-$lim=*Vu$FRXDLYs=c>M^>5u{Hw6YaXKrjFl{>H#|lm7@xpc#@_T81z=oBO?k^>
z<b$!0jJG{TH!#N1%R4T^p998TOe$jUdJ<j1_?@llA0ER3BQXVx_dG^67$>sU-}e|<
zU|hfk@lTJ@1&sP(V0_>*d;u`7WD$PoNo0WW>KHKo$7A@x$VH2cedIBGV4T2e_|#*V
zVC=!rA@(nip}_b%_4EsmVSvHWdhAP&QNG?kq}xm|zVaAlV5}Yv#<w1$6pWjqVC?Z2
zC1C7h1OCoq^aSJM*<kGT7(Kwaohtc@$0!ElNmlkgk70vx5eo?KM6vy-?v%&{LwSrM
zFldlt?pCv36@sx4L*$sxlPCb=M>6~#BOi?Ssr&98v|n`tV=@~`z>~-W<5U{DOpg%+
zBSkZ)Jw`4V^U=%2x_FEnFeXrOvphyuhS3F#Y>#1q@kKTmmdD5jV-tGWSXYmc1qLra
zkL7rbE@1GBrm<X)p}{zj2@86ROfdMNnpiiN;rD@YMgoiiPr?M_EHVl`h5{o@btv)}
z1{j@e#oawd`9}W`hxKB6j509(q~aEPj8ZTT!H^-=!()_yQN~u;(_{1mqnf2&;xT%F
zv6!v0)MFHb@l`z-<sQS{=y!NCK+G{|@i+OMuV|C{3fk;<hOs323EJj&YN_-6&9Uf9
zxBH!)0iXdUZQxF<%!Ppl3fkp&7FGfc613aze8!3%EU44(OsfE@612zfoCH%J8!2e7
z-?;&Ob!?O%Bg1)N4$x>pI>X7N{)`b6%y70chH61}hI2+=po0X3GMs*F6E%V=GMpq5
z7^@Xjnc)QH0)+)tXE@o+`&dDd4CiNB**Zbd4CiL*{5V1Jj3L9QdE?z;3kFjeLoQ+0
zIKg8WsSLyPLl<Y}?K%bHi9OIU+aEtjZCr^V1V;ez8rAPIv?mz>#A^j;i>D~!W7UxJ
zIGzY0iugEHa}k!Dtvf~njF+BpleIeqFj4tn3^zM(Oa+*vu7(N*v4qhCG(|-bcC~Ui
zh=|v#=8MtKD`#a8s6j>%QRQ&35TC9t-iRONoR0d6&r~zvZ<Fbipz`B!bvY_yv*~b-
z6Hf@*V>&!76`v)27RC;Ln+=qdbYbkkbI<WPf-rVC3c1F`uI#;2K4%5S0P%ThF=D{j
z;Zo>f{9tuDP_xfD0=;*9zI$7Z&shc28DFS2p|5N8Im;&jH3?enbMA-k#1{!_!`J}^
zA%2*k^%w&%EsNE|=O7P0Cu0%N;p$Svu-WGvT@AEE-2=4E=e)q!o7GD|+kJ8(C4RJw
zc-noU|M6w&b+~o7<Dd9(-gv~>2)&B82-@Y2c;d$k>hw7$pfSdm3)<_GJ~@7}+J#WG
zf5@}wP~xX}7PUO+A2Nsqe5%JN17maqjMF?uY0y8E-_we(^cW?O7)h-;!)5r2!T6C?
zw#JjN!JrY2pXo8WgYiC#=PZv=1jYcSajnNF1fvbjCVq~`C;)@zF@CPc$PfB)ppR<Y
z?RqF~_c0;Vo!L14+cS_WUb5df!JP&38wZUOd9n3Q{S?er<0KB2_sW61#>t$N|88^i
z);NW<rR?ue0gch03NW%#_HyV+V*>}H70RAA3t%cirLy~?2{cY4sK$;I3{2y68M7*T
z0!p-T20>KW;fVlpop4;)-O)!j%I6=OlpTP{Y;0ttEy|`9YMjM6)M{LHJq}<tL7TFv
z(~U_E!`3UiBLOgnV3V>_$Z}(f#&EN;c?Cz~Jc4b?w$b%A9!#)Z*;8i#%qM79gZN#?
z#zQzH?@;#HOxvLow_>uU><mnw8k-sbb}IW;j8qzzaGZ_nv6rAVHZCRDt?ULULt`^R
zC*nc*Hy%l_N7;R#1dT^O*Olj-hVe4_#$|4=T%IzA@x#uIJmrX9x(pbve;SP~E-nS$
zj2@=(co&xd^K(g!C%CvLFh6J0c%qAY08hyQUhd*zV5b-G3K!eJSFt=#a&dRy7e@h~
z?BXK2Grm(?TnIdu#doTU3sQLbI|<W2Gyhj;Q)bs;sEEdEUtfi3`-#m)<8@D?kPQ6`
zy<GnRTakRdq45TOy&<U2J{0^LSx2^>3ZvP$l{FcX^@_%us1_CaWmG`pHqw>y1=Yq|
zSwGeKGZ^y5+ek;`e*MPVS-4T1g;7r99i(yV6LsKD(kb1aHMpJfO?n!J6ODJ1->mnN
zzK1j}U}nYM$IIng^<{%WKS24___7ZaV`kw$k*&;GAnlp8IjfNwcCs_WlyN_8GIK2R
zqUAK}%sSF|hkO}=o>^23`Ajt)p(SqO)JLB-2^U1)Owy1ke_~th4fIRpO5D=(MwZVj
zS)e74wmuqhCGO_ZOh|u)W|O#wWmTc8VI30pQB5oL#U-F0$c5i(orUI@c#u{*qG`et
z?WCjf#lFPDyv{nVBQV&BM>&mb(%YboiN_gcvwT$}(ZQ){OEJ|k@swNL<*mh>btGh$
z8rs=fyo2x=*R`~@_)a7vA$!$+Rnl7g?li!^yRJQ3iwmKN3E8pss~)Yz7qSF)xUR*m
z#l_IG1Q$i1_jW6$^QRxrN&Ql!&fE+`GqcAbYsgrPr+oBl4TvBM(0y>o;(hsRCAx`O
zdAwjTpea=noE5njzj`r}J8QgKVf^UiEcuKR)@^5^JZ4S2gtC>hrufc;?0cx_S@kcL
zv4S{joE4=%tvR2Z)j$zkXN?@qno7PcXYOZBlXWLV%jnEwFl3oE{c(^u@d6Je_UycR
zhW&jLP84+Gf`g&+NavHrRoSEqWFf*Z+sXk7d(dBGw*3hG^;-m1@e3dgeFy0tq_zH%
z{z^UsjhhdVzS*U}fVTC63qhBYAJW;B3H`8)N^?2s-sD&6!K5AXtKBt81}UqnNHt^4
z{mn2837bo<VD2Q7>#&T(U5BLzTs{TE9K}fcBtVvKQn9<aj-kiR#<=Ppe$va(&(wpy
zZ~7W)sjS1?PdcJsnF9U;q@#Mw5YP{jj%(it(CwsC`V44t>><)k@`1kC!=#(_ji{#B
zBcxmOPcuM2O1f1)i;gh%80pn|H)<pHIO#T>!8CM`Ua#LqD~LTwdXw&j4lnjJ>CJj4
zWu76uO|uV<JxhAK&Vw?<c93o_I_bzom_U>6(6b`ozeIY6{wM_c71BHPQm9AlHFm4J
z?7uNRZ;@}{n+q^`u@4BevIk)p82gYQsO%!BZfrM!?RJu}{~-t|yFY@7eL^j(Q1&qm
z0G|?|V`XEGea2{_%1&T78T*_rEy@ltv@d9mRxA562Jj{AX`34MDC~9Y>qex;Z<eiB
z!(@v1jbK#@{4CmC>{}O?01xU5yvM~ofhUgz<}HY5vps<O!YIdN<JYf>fiIl~EPKCb
z)4+@70{`gBcL(0hD*v~Oi`FY#X*d&%pR&$^?o_MTFI@I=b>~-CcWTgY#C~Uk!@Ym3
z^FNr!h?e~BV;RLQ4k}`XB1l=H3`#(gl|tVTGX*qTU!eWRd;(gmf3Uv%0$ME&QDPYa
zR$HP$0Re5+C5%2(z<R511V9VeWQCd2E&?`N9LdD81Z=ZDq905B6F=Ln?JS@iSvYF9
zL?Lr!tl43GNwJ`Soz^>4y*yco+HE;?0NrFksnZJf0w_?d<~@#7Y>^D&ZRI={hEsPz
zA>}-r4`j=7V1;s)QLl>yRVpL<Cl+%LHDxV!e?CirE|u{%KKFwH&wmjQv8l$uXsldK
zJr{#Ljw)gyq49PF%zUhuObN7X8pnFe+GWt{%A&))d{8gjioy)X`nU<Q>M*R0^%XxA
zR$uBtKLM4NC|!RQM>N$I@5qQ%s5_B_2n@>WC>1=>@n(O{;vS%wxa>irK@V2P!b@fm
zXgm2?2WUMNYM=bP>vd2_y>tTTFBgE;Jva<cx_Yk4gT?3fgOjJ`Wx?VZ=wgzdmX`*N
zfsxoyHMtF${<9CF878!0Er6|$RjO%l(AJAAz$&TKp!E_B&L~v?i)Xu8J4mt?vUn0W
zRwJvF6>bTH-Aq?9MX@?>gkD}foN0)S^Kcnot2zuB3TSp0*&hVq7*Wh(_B;)GqT;8!
zvia71Y_eK`B$fXjMeMP9SwFP+UHe#69RdgUU6@#dOv`Y;jSnu^3xo?ljdUb_v)`)$
zZ>D+_bU;6ar)*8VM-k~>Y21TcX*C80V~uJb9NZWZYCC8zhFNY5M)q`S@@z%_*@un?
zJy&&KhZGJO$rR3$)m@9jpV+~&?rVf(fq1@@jF-X%BE=MD!)x}|JV-aGg$(9A(81VY
zvJmVBv)B#B&D-JP!2R$9ea^*bHr6b2OKf+6BYESpy{qBbrL4RoJ@x0r9v`GVh0i%s
z{>*GZH_9_-HM-)8ITMP`g9`9!g*g*xeefA7=+m4@WCyj4o?^~q7MZR20{)ySq(caV
zR?8gL6Ri4wBL09bfd_Nj9K)DfR1Gro5|FFs_8D<Lf@H@yw=ef6++DA^{r}qanp@%S
zdi6&c&K*F*V(V8iik~}(QQ$&RbR}~Kb4XiJv=rA=%pJ-gE9EnjbB7%Qx?0~~0h!9P
zK)YXTn>(DzjOtm?g}Eay0za-Fhpm}A>PpZloj(tB^*14Qy!^cT+?r*OZ<d|3xwWK^
zksYwPW4Y_qQp|PIx!#@<hK=))u({rz5{8XW%?EUMjm(l(!}P(#&9%oOrhuM^r&Q8h
z5J7n`X>j3!idl^6pWCBZM32QYpLzI8Og;{bx5bh9xh0e`HxB?=#;{HQIFO;OAn`6O
zp7{^s@t0r2ysr!Ln)fWY-ERbGt5k8}MW_L;z@&P(wb2{lrFzQFkzR##r%E}n4)S}R
zsWOtbejgQ?D!&Y4N?bUNwwvljeuaF%GUbqVD<jp1bhUi*Gu4-LL~}_cHJGvDgMyfY
zq~rs!xFWnO=wT7?Q@SyRXC+IeshA%hPkH-*<;}%hl1O>`fMw0aIs{njcCe+*#heJF
z(%XW~#dCTBrnd!~i@zBInBEqI-yFd7wqSE{CzL#u-WF^wJ{k=xHQo)mdvozDmc#@X
z7Bv^Y$O21m3pUHwM^lqr*MesGvS?}wElP`gSu|D8FN?Oym%vg{-tN+-YsVslshsbu
z*GIxQrlzw~*(7tT)C|&_^<8KHDeUQSg!XtD=s4xK>nikisRSE9yS^8rfz&M09s0|G
zpl4HNhs<$Ob2!J@DT<q#OU2!#`ywT&d8~`wdIyYb>R`@^I(3gI==q#y?a|yCN*zM}
zUYpx)sf8R*8OmlanQCH(iQ~5XyhZ9THVquNH6KO8O67-8f4KhyPf>BM3I^rDfZ;-g
zGzVovw2<FUEvb&zZi9^GxF_z-G`9`~J(fArID!efj&x98&;WWIX<O$}Cc=^l=@iBs
z@$sZ9v@A_dq{+a$mH$MA#3xNd_-1oG$Qh4=%$x?YIezlQixIwvw|0PZ=PB`1I5)9n
z-#dO9CypU`k2rohEl-6E?c-<AC}O`IuJKizl||$nMSL}7qViR#_!@q0KCaJ0uH$Et
zpOVRUd@U#6P51=iTsXvLBI1Caji;0r7eL+V1}V7Q%cOT71JTA)M08bJ^iqmS=Ov;g
zc09>k=u7)Ucn<Ss$d&K$xyO<%-^z)n*rG6FH_>F{^B4sDowt_){OnZx{BJ_^N6R0-
zpg)X}*0gJJ`DzmUErex=uYVEprMp%9(#%UCA#1lAB@y}`GvR)@TX9s&_!Vx&QC;Jk
z+=}}aN*KSAbV$@Sel^vsLO%B%zlL<Bs9*eA($#u9k`%w5bVQm%d^72&G>7;Nq~kh+
ziM)|?O8<gUQCyZ;n)DN}2Jyd<-z?2Aelwe4i!NfV+`?K}t#>dzvgFdH|6u-PIbywj
z68%m5cFJthvV?iZi=a2_=g`FBcalbv#4~;u>FxSqOyc6(Nw@32V_X=&hjfP?Ivn)9
zq<3f<jre_}ck0a}LEle$m%b8aF#aHyjCSj5(d6R~@k_6rI@<#MFtu>69YMDne}pue
zAv>%1V^aRgo{6R$@1R~`Vs$I4;7QgUCRPcS-P6oN2&aG<*fRu}SPhs3@GL>4vLBcR
z@EqF@W?6557k{4ViYR+4X6W%3SXr2IHRS=kNDx={Xjbpb6iX@lWcqo9ph?-6!=}Vv
zC1}P%APh<THKrQVw0=1NuM@N?`<5X9ZxF0j_C6-`O@cOMcVkZ9Ay}{MYo-G1BG`o4
zS3badG&q>eZN}`4iTJ0BOMq|2m?HiG8a-xfJ%PUt1M>m{&fYewL9$r=QP)dlVYClJ
z{+Q|9u54Kq|CGhnuIzRPF8`uShq8~D4e%Mk4rRaG1n>o$|4zPOz?OrnF;Fh%Kbf6x
zeCyFPqALCyw<}~`7ysRz*CqPH{ZAISJFkoHlX;ybcF&!@xf8p%JAF&Zb=h%u`qm`J
zIpXg0ty!jGad*bnB2%%rJ7a6LMzSW|8QW@W9y939*xIbySP|}wZN1FP;+8kD;{-C^
z)tlIHW*E=)CU%@a#)AU3%givIC!k$shVgC!IxH?J#PbF0u(+%pFA%U(rlaxh0(Qy7
zF5W{XcDo(U<>NgCXeHCUc&W^zD&47EyiBHY)oKV{IW*#-^gJS>WS2MID?O2jV6s<B
zwdk$NP_F}1@xH3ZWf-z^5hmVGrkjTK9Qw9+e?^-dw8SP?$aK@Tx>2bI3J6*G1cMa6
zpIBk>C{}!k;;6LJn%xy(D6Wb{{mDD9@nI5lM9$X4hpQ><r;O}wz40?bU5)C`KAIL}
zlp2B5-~bPv`P}YujW*BAfSZpb2Q<?w_Me+h>BD}r(@gF?2{Xuk9pXoVk<a}iHz=96
z1oT;HdF~y#E?gjR7YqaX%Cs{#lm2o>aP45=-LH%I<a{ciZwo=8m!pqPj{6pl<#Rw*
zCSOrUT#j<(+34h}>WS-+7Hbh2U~;DbEw|w(UlS0ty1{ZJ-%zh!3qxe>z+^u8rht%j
z2n<#7ZN+1d6`^B}IMztMBVd4(YjT(3m$wHR<}?`TWTXXg_8tLpvzZ*F23(CuIV(tx
z_G*@kn8|}=Y8o8=JnB3dPV0(2d<Yt4a%@^v?BSnc*&>;qla|`U@27jjb1$)n$3_8<
z_i#^pxFmI=hkMw=%lg87vWrdZth`zWJjKIBw$*(gaD$XU$od=|QF5Ak9wksAN2`)C
zIa*a|9h3u?MmeZeZH=1?kPw%MOgfXZ<(N-YZp}%~b<f~f3&ub!C7DiHJWr6EC!pEd
zSO_p*wo6;BC(!(o3k0mTQs~Z-3k9@U7Y+qDRIy`OZ@oAfph*JQY`ql&I80jKcI!3^
zV6lL9E01YATtJ8Q{&0XLlAIkD2b#&H0<f5a1(sy9fL#`cj>#hh?6!EQD0!5CPU|)p
zzvR&Z_Q+-W$zufUbp}x-j+LEFLpdBdB##pW+i+4YP>Ue!8?z%w9xn(BLa&boIzbQ?
zgg%)AbfO?E2=P;^$rXy<T7^ydXgtu#o=tH+YXCY$8a?)#-(&2j3W_S{VAzP{X@aod
z%=011m4Z^r;R0^*bU{s!Yy>((P_uGA?+>&}P>XUdL@_7VD0UmII8M)EI7`rK<=AW*
zXA5dmeR!xTxmM76yrae3o+D_Ja@LInI#<wU<s3%TCTJV((#IS)xlYh_T<Xl+o+qds
zZ)H)>&ll8zcczj+7YN#+oNN?G@<Ks7@y-F7dh#McyOh(8c9y(Y&~D{4v-Z~u>Qv6r
z6+jyV?NQE~r9hWRZujDvYS_r+rQ(J&d|Vt%ZWM%j4R{tPd4(XnLDiFKxl;V$UV|!_
z<>Xa@LZ)*S^M0+UEABOTRs-EEZn)Rr2sW8*iXAlWHCVy4+$NF{)A^b8aJzaI776zn
zJPsS4yi;*76*rw#Ov`q4%dr@zm`)Gs=G~$NO{NoN-tUnZnoZ}e1kk;b&K6u7&GNiY
zP%Ca#pcXu!IDcAgI%{YF+r?j->D)I8=pjMtO{a|Q;t};WrZ%`XdW1iD%yO8ls+*c%
zEvsUOVC+^EJQ&uss_z2B@Kr4X$6vK~p<!fH{Rw`cDv4)i)%S;D_)xVL{4P~jEy7uG
z!yJR3<my!jE%RZx+R3%sLF?s^NuEQ}kb}F)b9qKk%U6e!Z5(f4++I5$LT5e#A-vU(
zr*t-Nfp9wlQgC5POYGzY`WggK#ON**7ySoPnUpzz)_I6Kd9fGn3v^ij9{p7$FRj?`
zZzET4k;`=q<g$G5OShTHP2W*~CyJ9-ih!Q60QA+2uR_1UfUl)_is*v*psyz#m))r3
z4U})vH&T8J={DK1O5VtXY}ZFNf&Vws?fM#qa}((fy@K>M(mV8h^ebcjomw3X`ZgwK
zm;RV(yn}XSw_I(Nyo>Ukx}5yGe}>E+l#K)TF3e!&wcg2nR0%JFNZwNgZpo(P{WSFY
zI<}byC3o`4oaDn?POZ?7veiB6&Kr}Ml_X^&GNMNf1O0?Mqp7Fe>u_f@4iqT)6lW_b
zy@*!s8IHS~b>(c(f2Ub#(KFZ!JSQebU(fcjgY;@S?VNl8jRK?I^0s0g0Zqz#VA#-X
z(@RSMUu9y~BVX*F@lHKDSu=ku9CmgCqa>7kn@h~HLzvvfWnV)!Ad>$Ow(JBZ-(zmL
zfcX}@m~XSWzQ3EkE0Z5iqwia5!P<Q-YSGZUX>mVd$%foeKc)yT2gt{-IlM2NKPdx=
zrARynRwM_hdqG%SZA=c9rfyhVZcGjlpxt4>Q0c>h!yB3SO1CG@Dhdtnibba6aIfbs
z3>n#dF=I-OP=`qrpIpX>7{2+|ENse-dK+YSzQeRyC64!RMuNFKnK;2+5aSWo#ECrN
zs&z90POM-?g6@v>$*eHj-LY;Z9nu%UkR?tbU7>$Pf0{UrbftWCIB`06rmJOVJ+Z2F
z3#YRAFrSGv{u`l!Hcw3_&f=;~g|cP4do8!SD=~j#%;zvgn5CTtJDO-KgiA!(>j=)H
zSX9{;)&X1~+u!)KITR>yAwd&nY4DnmrrV;1HKFnn8$?O8-KvIt!*aO9RhsU=vJHNz
zi;I9e(cL6Ay0{PnQF8?Pw8ZFKlvQRq$mYbROF{GEw8WJx9z%2gIdK&?`n7HXCvmmA
z>0b~9eGL<ZO@EB#64#Qh(3Pm&#C4>r^;THpg!kEbe(5{0nPJBDc+xlUt)rCYS>wbO
z9yM+<Ox|ji7;_zyqd-<CUe3D#5py>n@d}H^&~2=iSGn+|<v>MZC+VP=&BSY?AY;2>
zzR55{vJjVeORCX574VLm{qo8lORyH2*yX}9EHwQ#0zuc5AV%Eif~RcX*MbPjLw4@@
zfb)w`wUSVx?l2~gL)pYQHY9h|CE<SP9H*Jk<0Qt9hfK+)#3ZT-zTu9do$MAZ4+15o
zFlky|=TFp=4i+EUAAI+91Z~^JXR?yr_YYKeyLdN!P4nv1F2053?Y(eNXcwR72aLI{
z1$MF2UfhNGw!Sa|*G48f<esERFvf^}6vj9)i-Y;7{s2{%n9Y2~bu~K4M3Qt$XJSZ|
zm_zv{_vFP~>UXnS*z@G9xV)g0n9mbXtvZUyVPXO0u_QAa^dYRv^@iC#9AM!xfRbq9
zu)Qc1`4(JaF-b$83*(zOf+d7Q3^1&TC8UFTS})K`N!zkAn`kDD+c77Ae-z`XkgbEn
z(WEQ&86ohGVcM&UT8=x>NXSRcBdEMT5f3)5kO1@U{t!C$EMZXd1De_$(0<U;zfz&x
z>KFCHT@zrGv^Msy*op+o5vz(L&?Matus05nM&KSr8$^-nVjhui94b{%U`2`-AX$yW
z1ZJ6$Vma7V>B6E(#d7FtxC^aG#d2tBgg})&saVcbRk<*0QgKB+f*R?<E|ZF<p!aAT
z<w8A4%c-|&o_dSQch?&a;_7c)%K^9=(kU(H(rVp0?LdQT40HXcSvN#L%i3*=`)XS?
zvLdg#WnxM<1desJQcgUahiNffQ6?MOStj?Or)s?9uQ$LNFJ<}Ia-yekBg-eE?}hPb
zylg7?aeeY=(3g`=NnJKx!89~!DYs3m<7WMH6=cL9wHRhIl(O-v7~;aTSDsv)F{d;c
z#=Ktt0Au7)CoeZf?V69Sb6%gJf5Vuq&mpLxs<#$#<hEoXgsX1B(^plGr@!hNi~usK
zHbFj6^)~3ts*CW{RfmGprRo~UV3;s*0fMjm5W$y3RN)y2RWF0PDstQX<%mIbm(Elt
z;X~Q%#-W|$7n82gt0>=tGB7sBFfk<uA)L`q%tMM~pTzeF@R*zT<1xnyIoS{HokFs%
zjOrf9tC}KTzt~v_2L3YXfIoGOa}&Ppxp)Z$coIe>Ynl)}&~J2}UGpkq_E2Lj?=MqP
zMNevW?dT@_G`Oe{<;#3lpH1d)@xB{Po`2Lb{;6y3gvT&r8!oYJ$--ACB$O%%<s0C-
zpFLmuwj0KokRPXJn>u1d`lDmxU-8}KB~>*YP6FAeD#xir7hik1D}Y1{LY1ge*`tnl
z-X?jD>YD7Ey+o8sBF12;V|=rr$`u`2fX4p7Iti&f;G2La9N~pgi>Q%L4!3b1__c;H
zF^q~<3#4q-T8K|Nfsl*zlcfR|$Y5oP!^&JJ5>r~3wnJrwY|2gKH;MNt>sa}VL>@0p
zs>3ApQ_7f>#lkgms14Cu>Hiom0j>9v#TyLxr>>cTGHXB*j$sO3N7ASAW-WCrJ^D86
zK4a<=tj^<HxaW+i5`PPiJ*hd<YMbzLJi%~`V5YrEcmk_>DPfXHJ&_iYw-HWft5M4t
zpKrsiGp0>oqOdoFrK7HRHF6OyDo`h}H6;m8TydD8PUh7>*8xtupE+$M{1tF&oM}46
zP1EXCQ};5(r@C<Ssu@SLwixO(TA(>FSu>73?qox)B)kA{=84r1?)W!GD*TIeM-_DQ
z02ylSSGT}yi~!rWVg0Jc3J_1hAFP*wLvBE27$MA>17azN*@ubX=2f$f1#u8M<YX&|
zWE~!L{A?%x;!uJC2o*Z$J8`=YTF9WGhQ1A(R~Zv{StS3CgIHaAu?yA#G`W7v6XA1q
z7vHUAt`qfltTEwBPg1<uJzTeK@OF*sO^rN2(f4~zp#k8VI|qnA``_Zb((NL0OUYm1
zvI!j!=H9dr$~g|H>+V2Bt)%k3vJ7wm%3|7Ags)OTE+^#qB(;+j^%CGzUX!L?OV``9
zXQ&acQ%w)fgYc!S)i*9!V;H9c&fqI~>P-s2OILmcOua>TQa46K;kQ4`z~qkb5r+Ib
zlkpy4Y#r3<q@He0R^vzg_WG?bGIxP}Bszx1tspKSaU}?<a-_|ZejeqCe6!HpV9xg(
zwlkPNGH&yNxhoya8|h$v1L1nP%=5B`UiKZH_HsJXE-`N=!I+;05qa!CW6s&oamGf!
z4)xKYekU2dX~9+^MUCbvgf^EM<NXl)!-*zC`P9?t@cY7YOZZU|41YC<$anu4e)cN7
z`uSJj{tfMC1Q`5Egebv3>&dTX@Jjuh4*tV*@IF{y34RdGu=q*G(Lp~MYToUTU}0~g
zC=2_=w4Xg7BH5mjd4-*`%2;Xi{?AnHa8q?UVvySGTMCMQCSv&PrgQ{J*f)uwl?3yA
zHHb)^C;eA#rc1Ey4X-8aLq)%UU{Kjzd~r{;QQE53sQcKHDZa-rK6ho@HYx45uBTT*
z)o{*3BVap0|KfEus3`O`YPeB1$dg+Dxd9?K+eC)yCLZ8_w(H-&K{EVbK}_>RPeKsK
zxT377y0mgL==E;UIVT$dD9q_b?^Q-`C)b$J%PR!R7!!EK0{@8W-t)i(08e`<W3b9I
zF}H#Lz8jtI#MOSIuKob~k#VP+<pWH^yPml*>c)6g+kp@Ux`MR+f0YiSS>g%Nc+L9n
z(7xFp+S&sISN^wPC?r`zh>v-KUm)76T|uwLvVK&?gnxL>#=Vg3;*|?yf9<~mHPdFU
zZnh^_1YdhZ5JtIdzw<)Rxf0HqcX?`H)SY)g@Rc6>fTHTX-#_1q=ifB=kBK0HAHCn1
zFGut52skfwoyC-Mk(Ga|z`xK9Kdqd*QO@XNR<FXn8V3Y^dphu%{ek~-K;X|D5O|?i
z^bGuq{|tPO8#p_#UY^u-kgA*H0TyQnR`P%K8Z9A7EgI#r0|ft<P&6%sLDQ>SF-qoj
z77GxV%n>q-sUIDJX5VKzI9+_9;jZ-5R~LXeW8ax%?yhv1shAJl$+mCsOx;WJ79o#C
zBIXBghW~)(+dW<QXa}5Uq@JN$-W>p`e@{lV!(Rc}lPhbft|+EMN;vm8_=zU;@@3}R
z=&k1Srct$kWEY>|MZBQfLd;5L|AxRg{0wq3>u$3h^3Z%t)C&}chH_5JJ<Kr@q00Bm
z78(maJ{05mp7hJ1Ly+r^#)5h<XD(s)$R1yqK^|d|hp}M8Ji}Nh=g~QIaN}e5Xe^kS
zXBdZObDxiO;;!a$ROTk<(2)qYM~bG=O$`^Yg9oIhiSq}h<zEyb;eKK015n1I-0QlI
zJK>1sD^57}&=n^fGuBuXxXxcQY#53SRWz`L^DCOo1MbgQFlP~(`51QWw3u#sBqJ0y
z7F>w*^x4U-oVLmJxIej)L}S5yNRpjkT4)ImDBQ!&gG<x-vSmbTCM9YtcoyBnBDpq;
zrp*0JoP@cInOJb_SXksZgQJ}aJ`a^M7QBTDoVSDmpO7gJxvP@**hyGW9u8*@{k;h_
za~h3_n;F?`J#07qw<r#2X)%HnH5PP3vCO+=IY`<GVR~ug9&$zp$ElO)!UrNCUho`)
z+Qi7&`VaK9oV6ZgJ+q0r1;ODKl8>3up%#<EW_ds<v#5>5SE4b<?Wleu2aQXs5PYf6
z7a7K_D62vF=vljyQ&s^vpVGD9`pnGt`Qy*bf|E~YX7EP^#)?};10?<aj3bX-4!4Y-
zfz1132x2Wt*D%i;2J)QIBzN@&d9IMOj;c)r{+I*uJmGG^Q=Ko|AxNj<ZDCmdMKtO{
zl872j&M>bW2hK)u>@^hR<s>t-dENkkEyDk!D@e|G4fEGJkoOB&HXCF+NxYKcW?~XT
zH@h>vPm9Rml;&IPhFJ^=Q@T%c7?NYA&=nfy?+`GTeNFOeq{BDu36d8hYX6&(^f8ou
zCIN0{dl9O@*LooW(t}}Ce5X>_&<p#3K5Z{aBXdkOgfhzRNeg9!T%q0lkf~lTh!Apa
zFugkCd*Cj`NN*rp;bfiBWeL&~=%#vt&g=%qU70`4Lkjf5{$TvfWElEdWHR%2A7jwl
zz{vcAbWk4x!OTBN+j=c!_K^-{olO~zDq)YZY6+Bp%B)KWOaawd57CQHKqTudhLs^8
znl+9fARwNFDl#%N1*EdBC+MO!K%glrrx74qT>;RXMOJ24F3=h+SxJIC0n4-cGM;?3
z1um^wFC$Tz-4)czSe><;Vz!zDaAsBu#fsIn;GLDV3oRhCRNVp4mNkGb{S@nOeb%=G
z!_-><o3ef)s1&d{>koqA0=8xO8T1GN+q1F>sxY2Icab$_0>CIqTSwML`Wd6x$vk6Z
zKTNr+GfxH6&b)y+(%s0~LekLX6uyz!)w&B3oq02J%YBk2@B(@l!ndfHOm^3HxRJ~1
z6z<b$F25i1JU|X*an@VJ{sBfVNp^L?{SUbR2u5Bve7y+2xMmrC^1J#W!y*8KmsMph
zNTO`?&^JNrb7$dE*+f?znuy1!H6-;(7*y-ASAY&`e(XfoT>#qFE6`Et$kCun^rA7K
z$Daf`q>o}?6PctwI%f#z$xWau^s%|1r)~jVsV_jY&@<lwU9Ag8f{uR#I-+lY9n<rh
zk=CfbZ5-$Yq*MAGRJ=ZfbhEw{!%=+{liX@pY)zkllw!k+nRmfBb}6BnWb(95FzfOH
zSXzD7Bn&4uQP9u>=YqbHY||~^J|M+^R}{;)kTGWuGK}m>8bkAisUU|lKyxYTF}q5P
zL?xC~vQL$U{|!{mI%yQbu;}6VbYPi=#WGlv#&{vQ3re`_%nszjtc!t+O@pKP0P>uZ
z%dfR&-U4z*?g#H9bgjxzu^(Olw!3eVyPLF@4T9W{Se-#V7Og$^6Y_06iS(zWL-K*B
z+|Ni?$VZ`aJE=sK1-$hq_X{dOwf^xC$bWhC!7O&3ZqNOS@=@JggZ}0_@NpL~5|X<o
zFrQVh5mlV~J?SPL=neV@(#^UU1~m7_?x0(AgAMxMq+9j9sJ`5vNw3x)qWp4yVQ$;>
zm!y9sy<Y!J`Zv;>w67BM@1!^DT+)A#-llt!{*&}}-JkS6((PGQqzy&Tfz8G)D8%4r
zNN?s#2(&4<{A|>V6jpEr3(L^F*e7_>9r-N8S%sim3xg~~?ym(;8Ii|AyayQzo=Q5T
zGob{*)80oxR1_R@+)^XBG8gi0AqLNI3(=1bAh?PJ7txz&_E)=w$UTbSnXgG9PVEQ!
zET$oaPAr6U=3R`m6<!Fk#mwtB6iL^7(<ZO~+en-t3CgQrBD6%DH;@qr_1hC5GiV3I
zZT;tT&_ftmv%DglH>?wWTl8Cfz^{B6p|$F(`+^=$nbo@AVW6wNflQk|m*I>gf4$}^
zLEb3RoAi(*=rNadV-3thX7Z}Z->#oy+G>LE+pZsmPUqE<-d*%N3Mg+ZX|0M@!W!h&
z#d1+Xs%UU6z_`!hFRF^3hEnH^-vY4~Rdg(Jk~e{1n=0De7hn=2*{zB`hKA-%Cg@Z}
z|6n%inT<WFsB1Pr^frLKs_5QX01X6&SrlXHr?DEfS;YFvoAC`&5HyQMpf%*pBnX*B
z>xTox2rA8@%Lw8G5wqy18h}QEI09gqCJ35fNhXa#O?5j6rJZ>Y$auGdHi0fU+~`(Q
zjjAyUmMv;Ey4A9C2+1vU-NLN03Z2`CMaHocL09S)6l1r#ACSOm&C8Cuje87qM5?u0
zgw={`lot#}O!<8IA~Oy$m|x2}F5t`f`QeLE9qy)OzJ!SvcXz{p<rKU@`L{vF3r3_+
z#CqN^c&cInx>p<&jBH`S$i8*K=r>SeLA@A)1=aOPvn~5*1vNb(6Oyyw1+{O%D~?@E
zh0Ivq_gSeYO#@v=ezk6jgPuY?j>slzLDWnC*J$ZEg$z3LpCBuO^R8z!OAa@J2mgZ7
z^qS#(mMo5;paO%3oQtMmOSHj-3_fI-%|j7P(X9+-6so^EIAb4Zw+Ty4;;kSyu^6)$
zEa1mzgYn}foY76-G?I@!S`&1FbcOzc^0OE|Hc6^SApGuGP^QcwAa@o9+dwm!g?WD^
zv#^_+%<G}(h53Gzf-ON777j<wx9RV@f?q^>yVPQ#%~EJD;GwO;-uFVWJGx&<zkNp|
zS{%37(VYkA3j4XRY=>dqh(0REz7&z$SAaCn83bH>Bk@Tf&5zNPa(dhgocTJ)&Z1Ku
zL!?qzMW-?|hUObEMW?Y9XnhXUwrC~kATv{R#-k`_TR(sjC|X?#`y0|zr-5E`Jm?C2
z0qlFxnf0J6brw{$=&Y5XtEH6}t^E+aLPURuxQotZCZm$cqIJw<Tr5-3`Bd|i)J4&S
z$SL{*cC|$pvmb4iI|_@|zXZQ6axY=g1{P?m9vFknrKH<*dldA>IgsB}z!TU-SA2?i
zH|xt8&Q%O&o1Te07hTP8w!3##UdyJ?E?a*^*Z)8EzC66G>e~05BU?T>35gOrwrnSg
zVkaJD#~Cd{0?y!IlgSxz7^=v&JT$gtB-wFj3xP70QpN%WTEbAuSjIBnHqb)D)H0X8
z%WYFi+jO9%Kp8sme!sQ%k>mjP-FLt5zVH1}J|eGm_Pq9*_F7v<)KdHGOFK~KTC(<Y
z_F*7!;q~12SBv;oqrz_r#cltAB7XI%@LPg<rXMJZ!o(NetoEbeKoQfVg|{d)|3J}v
zY)Rp*3Y~VK=pd(byF#ZPDC*~|zO7K-fucT;rSJ}gPB~C?{&b*sDs=LJBL6I)cPsR;
z14Y+CI12gpPq4+L14X>NS9q_WmUEzpH~R{|qfq-m(HtnS!uwU_yaR@{b3T}2=6(#H
zw+&!xQS$}deO^i_TK>7C$rK+g0=(jnpsl*iP_&B9hffqqQ46W(m+w>*tyW5lMyjaw
zE_736zfJfUcG+M*unzDV!r`KFj8(KwO=DJb(Ti|Oiq<PM&|Jj#>lAHJ=*;G#FJS1R
zc7@JpE-F0&=thN>HW&SZ-ELB7Ni*IXy8tVibtQ)J+I#VtFDxvY9j`3~2jZq6Y6SVh
z0enZ3HE0lg{J?{oSmTwgSQH6qSU<vCihbOFtGftb!MmuJH&%_+6&JRF?F#rCaK%MG
zV{@B#mW%y-Y}>rDTwF}pC%00HO9=bz_b~tB(h6{(Qjo<n2+zjYv}{%nWUx4R9IEDR
z2k0-Jdmg*vwcO$g_Ml!`T3o3{IddbPSFwuEu$GhoDZ31a*S;E``FHWTOd<VYSTBOR
zN_?EK<v<mdPThn~i+wYE2T{9#7o}%R<yI=)Fk>1Y^IM>trqu>>Gb8_pcw~)%G&6l{
zZ0&`DnmIKe5`Y&TW7b}qev-Ad9v#+IU_88O8J|<w6-|JTf-mFwWF(6rf`a;XsksfG
z`7|=B7HOYV6+irrNn2Mgh1m=6<Y8^WsbX62%V?0d9H4(%8LgohqG{!$0M$aK&7qQ0
z7Z#_@Wfh*4PQzd8%TT4$s(%D9?{ffs(`sp3#T-ow5j5<5t5Ky+dO)l1<5_WV+I;b*
zKH7ky1zeg@5F3IeUnmq)%@?tX&%S;h>WD++M|1jS)<H1Yv?U*+C;TcjAN&Fz`Eri3
zUMU1PErO<b&j4)CFE|%WTfjRa`O{@2xmc86s7A_Nh3Z9AtUmj%m`%Q)Fbp9iC%=Ss
zf-<xGQo>aQsc5f}KcfxZH^^&?@@KO9uzgVz>IW#&%|)%Ca(<bTt68l@BbaA?l|lop
zMH}0I^1I_uIx|~~?kNFUr_dR#MLg!`*DJKNwTQMkf1W~1T8r+7TFGxvXmM*%HB?gm
ze1-a3i)L~T3lv(^TJ&Y2ixgVeTJ!=dFIMRE)&hPpFu##3xE55TVaJ!;uq<mm*dyTM
z%TDrE0Q3c>@dXSvZxRIZ398)<6v$(=qUJBIn&lI}^PWOvl&5mDaaV-!G%}$rcRyz3
zlVh=?Sn{j_KKF|On>C#~9W<<M&>OP~pGJSyM`#=LRX{lM{shn;oOUc=o81TVGu;QJ
z8^xKy>8wJ|EXCjAaIlzOt?YKNghiP6d^9g*v6@kEhElwoQE(<_R3$SC1~?<QDE|Zn
zg0oIU1Fy~Xf#0Czy!Q71Pln(Dd`ccGc!@lDO`g0ipPVYb%ngl!^S?Z~9HZn_z)l8d
zuUHAwCOa`(j^|3+X0Q4?Ja4>*WifPH%O-Sycf3G`X0Ik(VDk<8vyXlWb^PFbKakeH
zqGv1GjIUvA-i|Kw?wNtY@;_Y$Sgy#Gzs07?T`T`H;T-W^%HQVfZTb3S`3Kwa9IEg!
zG%nl1eyq=9sIsjBE(Jl#wh7qV4)9n3L)fvh4gqhU3vj!Dj|Bl9C*TX9Y}xSw9%uk~
zf`A{g?ui1vI|txr1Uw&<DT@gBzrp}_2)J`Az^H)V-3G8zz<Z%V%euG{>&C+Yb_@7d
zkgTltgy|r`e27X_`3rXdE=Ud;<uCHU4IS-*cEM18w^9BQ+xZlcc)c9-<<EAOzw#gm
z<5z_F37-cIt7{Q@AA1Nrmb?z?_~$g4dEm#=Zez~jX3auWDow?QjX6stCS^N2XCvZr
zq#%<@hhn|P9Hb&SoWnbSbD9MyFsx@5px@oo(3SrZjBVv^1%7fF@i(D{tTW4je{KQr
zlJmi5eREcs=Wtx4<ma?VCr0U}O~#znCRb~ht~cf!Enu*8J*u<{94;MdFy<U%HejCZ
zY69z|?GD3Aa+|+!2?uy|B^P$0`9lsc8cP^+K4UJyoQ=|G0t<*pAkHrB>NMuW%x3fj
zhG~MLDLeHAw8(3KRq@YV=YhQ!n$BIHF^6;Uq7yupW7=H21W?+3n`=F7GU}I{26A;&
zG@6eCDdpx=gw^7lze7n^GzpU9Yy-zv93hD9RMY`c^qwS(syGstGf3jop|2{M&GQ>E
zA?NStx?-hy7m%RCV_(H;^9dkTPH{DmR_U$5=>}6(9Ao|(C1GbJcBNviAkEHf2yn%E
z(*awyIyYmb741Tac4#U%E@h`bSA-SN3%RM{2j*T((fNpDK5qKZ#BesB0OSetaFEh=
z-T<Fh?3Xcp&in~Lo)n~@G~PdIR6J#tqK&_l@Y4cUmGbCW@r+rE0&FBycg3^Pq(e>S
zM>3fmiZ(x%l0HR_=Y$-?&Oir-d0wiGIla(o6)#A&J<jXcvWgc4Im5XRdZywf8Rs0s
zTH(jizIZD>^KJ#>jaA$*P>coe&{y$Ia<XAB-3ItZ!a4T&5X1@zr7De5ag%I?e8;)s
z<`mZMx4*^FZn*?-(3Zh&r7K@$zp)0-Z+ii7gPhANZfE_l-2;!k;tm5l(riCo2>7mg
zz^(Q-!Fm<<GPc)l3wwNrbLh5ZKkp;lX9u`x4{SpHVT27a^RhE`;j?4~cC4YoXTAu;
zd3hTuO*K1EOK;OOy-gI-iUQ3}7S>-eUFhd`Qe0?}*@ZSiM^;p9a!FMPNkV?g&g3oI
zysvD*0xHg20}ZH1c9tU9Ghq3OvlYp%M4gIr2;263obI_a_C8zq<x6B2zx@-a+lsHf
zw3sC8!;lqMvVN6)HfMg-cGPJ=;sd@*+1cALmY+!+>y$#^U+N)V2pO5Ns?{j_@(9qp
zC&B&~R(@#{c)ega+HF)`pr*wiFt5B&rd2R(R9<v+7?UdKH7YMAq*P?(CEGEy-~K!f
zPL-GPdC+dgaFt&rTqWwV@-p_(U_Szny7Ka$;(55>B%|_ctkGQXS)=kwLalZigu3!7
z+MjlNqYe0Kw(GDbVxg5^XPq53$y50aKJT;7Vt>~p=kXZ(^=80(!-q4FMp9K?OHzSj
zpNG(uoqr<Mme&u8v{sJ20$4&8mAl0P*tzRb|8sXWk>q!xhsw`C2iRxNZUKDCWIXW;
z$5x)kIzju1B0N8xuwLI6)%vIfD$k%w3)?4SR+VQhK-*@Jdh>Fl?1Eo#4x2Y(R#o4)
z5f)WwU3ER%8WIk!x?wv(dnHbARU%D3(7ozLuG|lbReg(45IazH6QL@hdezN@8-(gr
zw-657^Jb#-R>I8%38U&ZLankFRkw4zcG-)nJGd7eLer`{`Fw}awCXO>v`=VSb@$#Q
z7#bi=tL`OD_ZZeXh+5f&cVP{A-wdKv)fwwCpwP7HOhwZjt*C$2rC7ghH(^;-XMY#4
z&prauUUly4Leul+06uRP`VR`Nt1j3CxJqbUbx|+i2BCG;#e~CZ{+Do`%{FOWbt!4x
zYV(bHRhM0fI(Q$+QovWSeupt*6X|~OcFZl$#$<1*KBEJq6}nfSo1uF(bJUn8d8qol
zGqJBq+^WwPaVr=ys=q=C!tXb#FCbKf7-RK?gc`6z)gl?>>1vUTW_xoDdb&hWeJ^2=
zjCT7ia89*IMu$+k`f^fQadq_-oYAnXvYO#3BW3@E^{?VCjoEx5Z}ruL_t;Yjf1U6-
zb^(+@^>w7gh4zmKUw<K1aE1Le;Ts6=HLO#yab=fuVfA@GorY1Ww=(b{J663-?HFIj
zQhn?w`n2tDW0$J86UK}CK+)>s3H$BudjX$F7;lh))~McbE8r^Gz3R@N18$JrtB$=3
zI4rwY-AlMxt*f8wYL(rq-pM()+ntz5b*c{Y?64oju2zp74|s>&dKBQ(P6ga&SOKs~
z*_Gv}T5|p(!`NRl**rc7_5428RWrprm1f1cDi4UyybMijhrg>(Gu50A-Qja;u<)8`
zV$u8#RY*;~ATylGRX_?P1sZgyP->=|+><J&9^=;(ncLBG*xABy{DL$){j63jW}wyK
z<^7rxLE4=baAHlVARSH}CRj5=kR47tOJ<slm`<N_COqewfaKwaosA7ZW=VE^%vlJH
zUlTNM!+Q2OS7W&~v(2Z0oKrf~Wz^txW`Hkr=5?T8j`=o_E1cgI1DR_Eu^oGzLKvHx
zDzgH}O{LM1F{7r&TmodDVI2dqlwH+>N#*?!i}uxAa2{a$#~kFsS(uk$UyPGX%|!=b
zQEbDy7JFTG^<}72@*%*nnje_Gv*CwzB?gR|Crl>qHOYUNP4fMk<U(cT#rVbXsCi10
zTvq>#tUg%U-#u*9Aae|2S2>TuF4ZV!rNQ|d<fi61X|u?=kSl({oQr9Oo%4viC`hwf
z@yoK}R_6q;SItk%iRf*I^YvyRubNYV^f@1r<UbW_4b%S&^h4R#6IhP_awva`KOR+f
z&FR4NPS}8%)ZFtlVELL#&Ap`%0K@J_ETcwT3j8)GxUuH`*?8`=&zcYT5gIL=4d6A`
z{2N(3h<8h1E6eu2!akqJbAQd(^T0QD6_@o5@~B~7iVdu}hAe7}O|RMecTCJ@SU;VG
zw%78t1bOd6RbE*8(C^uHE=H++g#F_suQLJv+vH}p{lWsk-zxy@vm4=~)b1+*>=*Z_
z_WO$g2W{Scu6=w1;41qRNI>lmQ-B-nrTDCU@)CUF6&ILn?bEE^Z2x5&;AbBI+-h&1
z4*16}0LIH}F_GHm{|p$01GBAtVd8R%>r-%>YhSDd+$Zi@?Mv)uSkzqY%M__GF*LQW
zaQ-mN?}Bh;*S*Iz{%jHQMzw$V7RW03&)PTVqaVXA0)=b;#QOMgt`&gaz6Z4O**^x|
zYTsRkjrH5lbKLjlqCVa*#<joCwO84PH3I(dWwdQjboe{x6IOKiC+X1a2pw<-9!RSr
zgs@CfqTLZn<d|&I;Rq?bCTX$55n9+LiP7f>F&vZB7<LwOwiBhzm?NZ_WRf;}9HGr&
zCW&*795!kvOSKC{G1aQu6jwM;aal?+UF|SMRXg3}BKJD?!V{@2G8@ssO^yeIt1TA6
zxYIGY%u+$_br>eEogv5r&b`L~nQ4+@`<y4h)wQz(+3)PD1v1-gMAy$b55i2;mP?yg
zo#VKnbLDvVnzIAyw6@Zmhs7Nb)mU34s_`K1*Pw^8yY9w*`9Fu^8Jjn+HOlVh%eiOX
z4Oe=f73#@7h>daRLWXwc3d=e?C4>eA$#HHD0*U7?gO_hRtD&qzqq#?ekA2RbTp(kD
z_?>gXs-cqw2|E9%2XeM_P~~j&0XbKYkh21m34JN|wWG1!4sW%GE|HS3b1eD{T`9;?
zXB}iRbhRMOPB|7E`i3B@9KJI-v{#T;XBzZf=sH2xI-duDLf7X~+S{ENb|rK}F4?NX
zIRR7%-6+*|ICrwzw*={S{yhiC&AHSHea_+lkXv$>pv`b;a)A-LHJ8`0#!8b5jnHkm
zJOk`0?VfLhZqIGOYR_?=UW*3bmaf1d9OSOti}CCV$Laubj|{)Jw68y9gzlAUH#ube
z(06jl`*%9ebD0n4J`8F+;M`53JtD|H=Xh3oRNCx!m^ckRmU}i>=sBl=Tk!qdAx!gC
zX9+3zc&-<mcEI7!<%OP<Y6qRxtw5fVYHvCG!MxBjQtg8P1vK<xZWktsTWSTQ=c}@4
zT$8vGW-0X3Tpm^@nSt-m2KMi{ec1X2Gw@6+u>Z*QV92l;_}zM7zmy3!n}J_*i++_$
zX>BzFzaSxhle-Bcw3`7kd+4`Pv%?Imf$W5SFW3oY;9c-u=#RN;F!LQ|pkg(!Kj&^-
zhuts(?_m<5_i{&o4V$xg-6HhYTxMj(%)p--Q1+4Zvd0Y6LP>{A?{+Nc95X=YAY^%|
z$u7hj(4nD2Io=M;WiQr866Jcy<~Nyv`Wj$)Ud#wDDGG#1mkEMBU<Mw<QbLaOxz7x|
zOg@<??e?32F0$%jf<0pf{!R)`_L6O$GXoF!flc*}V4zpcz@40DzL#ux0GCiOiBN%;
z?$kjuU~<1prI)wNKoLg|2==ZSC?;bE1^d7Z`~wOgROY=DeZs>srvfYYaw)bIc$~a3
z*GmreS%KATS0U~ER^Tg~XO&<xtia#MY&Bj9n_7V`_8F3PRaRgRnuqG7ticN0!d~V{
zS=b8vt{m86SwpiGD4h;$iPUVh0_U>Nuy-%!(ryJFE&z78mv4aUumZQY0Xst4?XUvB
zBBw6%o`$kMD{ukTz>!imYz3HX3mxT^y|n^GoOP>=zQ+nYLUwQS;uF738|c{#Y@PR2
z@Wh2yU>W<|;Jp!}Utt9<#)gNs$v*700zc*6b_jNZ6<ALGJWjBitN?%JIMgL{xeb(H
zyM7t(PAl-rVql+@nh)US!ed~LvU}bEo6d}OfQ78kn1>su)Z%Ur)uN%~_+$^|*j94<
zc|m;6K5qFJJgunacYZ@YJ;k#gNYL4YS%<#pA@fx^jaX3V49`D6vId9O2tsEH5_W3H
z7w37%vCU2m74t<NGJ2~sky3V*X9&HuJMWO7S9`t$q{BIrtNps?+dy_WKW+wchvx>+
zs!v?%&|T8orOxZDcCTkYs$Jn+9|H0n4>@(O<0rd6;`tFuZgL)E$@iq>PN$CI^qA)z
zlsw=tavOTwGYxCp=UhX=J?WVbWWQLU&@&#&;B(HEs2uu{hjE$%rGwpzjnIz;Iq39~
zwVo5?E$1W3?F$|n(hmZkr<!=t(}>;-tx#U|P@&jbr2pMRk@jgJeqHG3*FyYD!Gc<d
z-w=9LnM(2f+C#<HU<O2a|3*j=HUpx)f9JUvWzA+l)b}4`$*o$|{ZVSRYlZnI55;|p
zR+w*js4zRsKr418^tNXMNIs?&=3hKin0w5CDE{|7B`7<`42XgIr}TNDRv|e#?DJAH
z@CZ4>$>Evy3N!FI(sfGCU6|QkD27sCz8r4TO=jQ#Nj5EqLB~6xCP3g&zF_+>Ybw(M
z!Jab%l@74NoL`}r17=_YcVuSHN5Br6fm~5N(&t-dU>RJP(CnOYaO4MOU>dp(l}njn
z1#X%StTKlR%(j%euF9dh_E}0@*X2-ML-qJ4q2?l4QP2w9!`)n*vj=5WR$vFIv_!B5
zD-fpoT$ytN%AjnVZNOS&yk_({5!f*~FQBZ|3iPc9wqDBGwJO+{LsbA}v#|qZojG1q
z*<l5aqi519HT$%H59Uxs4r>7)l9`QZrI^T}Qrx4JVp3|Jqm^Px$}ZGOaYV}S?inkB
zX_tLx5>!Fn@R4Aex~aPXOSG_V8l_bo+UxRpXt(9CT~{y(cG@S0?YikR0sG~rZ0ibF
z0}k3W=5@t{aZsNOc-BV14fae>p)N=`Y*^DbV%!JMz*zpX;OSVmL#LEIbSd$BDu8dq
zhLt_ScYKyy4i50wd(EE$an8cF*5}E&)^JV-ht=EWHf)6L<b!ne6XcYJ6U~EL(f+${
zuzfCeJ6PXsHbaV?e}eJqW9AiTVmReke0`7jqPBBZ5J;~elbp?v-uga$v>bsQsqdE(
zzq1^(tN*MZGYsqKDH!H^YtVB^54=%d{aSHZo%ll3T4z2e!yJ<bWW69b=e{``O&&jm
zP2R+izIk)ZZvrVz?lk7jH7|mtHJsO=(&kmFi5Vr^;VcX{w3wqP6NTNd+I$bz#c(R2
z;2K)ZIT+1$W`pM%+9b4~k`E2X=sDB#Y*?e_ENA0}wSoklE2ybe7G{n_^&8epNmc1^
zDq%EikOORk^Cotqq20WKd*}FIMH)5=(kz;|VUx6JbsojeH*D6iiR1<#TXbxK&P>Br
zq0J7XgbA$RylPpj^J~xzFcXnXQF4*ioJC-jDc1qa<0aT|UHSWfC16%J=UB|bu%CtO
z*UhEb!F9G8z!ijj_G5DaR}%KyFM>#QRfL0bF08ATP>Z@8O=r``4-9%adiUBKBcJ^2
zKAr|xE>e@3<)Kd;6lgRf1ED3a#00t5_~CYdUYoXc#)`HLM#CSuxf80mH;c^_3iC-t
zpL|fhd=xC7K<vQB4|Kp*CBI(@o7fOG>#+_w%`~VK6gGYp`a9edp>*EBd>W20*P)ir
z`3X3;VW~L)#P8%50$FCB1tjRK<{XZck}63j;X8`AprpZBQ;E-JlRv8&cKk4A4a)^-
zb||wAE6g`g(yB-yXD0bbPaM-dQC7`)3cWbGPbyKz%IZ*Qvs=vhsABekk_1b*a?VGU
zYyu|4a4)BSnRWP-)08@BcqbpS;m_QMij+iA+$Ym|9LR*}q}WRH8}j6LZZk^G|8Xz=
zj@n+EY&3}<%sI;4aMPG=&)H#i0x#PH!!)PU+(md6xOYys$s2G+KA)&LZ35~phHYdq
zyxx{oOcY}=xr$$Y0g|`8342$5-NS%wic0x)uB0$OTrwZK<u5nQ_fTFML(s0=GRdPx
zDenT6dnANtJB%ik=ZKj4j0vq!g5|m9qi8eXA31<)&B>Uv|4l4!wp~8iDqf6-)BxpE
zEbd_0&!ED}ebx~W+_GDskISb@ow9k5>+)&xYqMov0tw3VEym2st}g;yVAT?S3DYT`
zZZYgsb{-a1UT85aS@s#I^70~U8R5gAEXw`XO2S`+DJ(Cx+6Zr44!FePD;LXd;jByX
zf=9qVnF4r*bv)tUvj3S@lyFWv;DFUj_#v)rmNiKDGAOX}pp^t%&Re48bJhI6hh>*n
zD7g7(z?If+)B*7urt@>7e6BAb%)1O;`&#+DO+N3J&&TBRS^0cbKL046zm(4p<#USk
zQzD;p<<nY(-MgBqpnQ_`t;Jfv%MY{2CWgbeE0<SU`KV<Z6OKS9<<-`ysOGg9NiX>`
zz+ic?he<h6p@0=*%&{xZo3_L-=5qfkzRc~Ln@C2Dim%AiZh{y2S)sensJJvhDAr|E
zTwV<b-7|gRwV6Ef+DzB^m%^}m?Kvp*+Pu9pnfXMo&FER)gYdb6H9uzxP`I<^=Pq|L
zDJLAx6TXihXv5^K*N(VF%veg1`jUzy>b>^KZZY$+s#rK0uP1d&ewZ#Hgf5@OpUJBC
zd)!J)*(%YZr1)4-DedQoz6=x%Uv+CUse5ScOgmlMi%PO6rgYWRM5?nzdl8Df_Gj=p
znOS(ReLTn|jTrdw$%k|-AF|tCn>P;d&Q?^An!F~UYKpy4HL;PXbBSArw+EyS9^UUh
zWGr1ZB!m)jme+p9E$8(CRsOMg{{eNpb|ETE=H&_b<_gaPqUxq7{0JAvFVZI`;8h9d
zSc)%r?L%fh%mJitnY2tl{S5sxap$$yp_Wv?lGT~F@(Cn0zX=p|_TtZE_KWwX6!Mcl
zXC;l8hstUsE#-qPeJn-oN@;VK+lDzIAG=4<uiS@a(5+dMJ%mG8irQ89Gg(dhuWmzT
zj1Fxm>y<8a!-c3M^JPv+##T*axmwXjQRKDH!{=nC3cYrbO#AqtZh9-5@&iRXMeMEy
zBE3q^Sm-Nj*Ol&fi#>;<rF>+_`^l7=fSQw4=dZY}nMjs#)s$sJ^^^-x<h74vBWCdP
zZUf)=s!r|3g97A!_i#8|crvO^BLs){4^R|Ur>{i$lymUGf4(&D`@RAc{js^%W~$t4
z#{tU{A7E8h@X5{!$`90G-(LGlw<Z(3S)Ixly5}Fbb(r{7y$MA=^&^{$4!Vt*DL%CE
zCzEq7YRc@H6n2-_;XY)XUiFg^5`lgMPsqnBTs}?bLDclxH{x?Lv-cv84+9f<Jk<!Y
z6@HlvPx8J3E9|Se;`e~<e)z&QUn6MPcfh>VTq%!HH3za}{T!lQbJY_l_S(FClJ}L(
z)Zlk8>7+FH9j*qq@W^Zb5Db|&*1<~qn$wl`sY=$eY3S~$HF%zPINX9@%`@HUI?uQr
z?V8PwnBmGh30`|&&D%T`$Q6W|cjzwQhV)_R=Uu|Kd^@e?FU(l^Y@YCH-eaGB`(;eG
z=6yEBYp>vs)O^6_RdR>B=EKhdZm{130c-wBS0ijsE(QEI!p-&tD*^vK4{cj<nHH(d
zf4qm9?U>e|g%n(Y^%sz_=AXj=OHL-w)_Bccv~c`5Qq<%LY&eVAlP!qtoDG?+nPAeb
z@X67%1_=@%e&>{9P%_aR<ZLm@gLvq*ufv!VuE1%o2EQ7L60d!je0~k51+RTB533i$
z`3cs0BqJ+!9k5Hsi%>Z)R>=ylF-a@?RsWh>e7E$)Q*OyM@Ct+V%RS84s$Q0B@4##S
z1kXx#!H4kGPxmm3>wFEh>kB=rkHb!sCc67wg!jfjKy6_?W_5-2_?6Qn`<M<I1#9Ze
zW7!8?Q^0C2C3oQ15Ujb+Or(qMbBitp1Gd*ZXdYw{(={~@$(dc}b|2QcUD^0YOzyDH
zNpNHS%_JlHoukPT-xVb2d~Pz3?@4D>j%@Nile^p?zHrT>;urI0q&Ue5=izKr^O(%a
zYyS~Xyf%Xh{ueP_ukA%C6fiy~Gx1z<1&;l}n%5+6rPlXadMnNgvhGrJk#`ALH&}bl
z31}x9QhSafLf%VYn_%s^Bk6*3Re|*Y*r4{BJ$UY)457*U@<y;|?Y9^nmm3nbH_>Us
zk7fi=?`D28%eD)!>e^edG6)5)h1K3l*l$0IDb(IZT@bX%r?qn5W{#Z)tz7$UKCiOp
zalAXo$_)j$)L45bM<P);HS2?|D81`UfL@!6z)ug!r>9x#v3US|{6G=Y!d^S*7Hwb=
z2XV`fa7%_*A|KM6SwS@9AFsXDt#k=1rOSP~(#dY|-RWY1bTQM2a0T5;FQhB6043jb
zOa45r#O?i67Be`@RH+)AOooQ<vxJFV{u@^^Lx!A+$M8jj0t}K(XoDm#IMZyybEWXv
zE`8utba@$F8`F=1A`Y4h*F1t61%utj!nJbS&mPXlYXjHOZ?)}{rvqM3IBb6rY`t&;
z;Xb?IFu?K+nkz)rE!=o3<lt(<`V7Q&;ig`6Y2A#Pi@s8m3-GIp0A6&W3GgKF!=eXY
zKn19AeCF+d8V@f%|M(RcZ$AWf@db*}9>HN_@r8sD;loL6@kO!<J8wJSiwXPfAf~$b
z62d`y6df<V^gqyLmE5si{8jQmNT#>=vV(Yz`+$#v-xgo~M<Dp74hEYr1U3(im}3~d
zBtHmJEh+Qt1>*2MrAx{^P+UNG_j$=2iCN>|Q^7W)=51{A(F}xnL-&~rS82@=x?c{o
zhVv8Xl+Xhvv$3`l4Fh@5d=rSzIUKR7&_jawoe&y^9+qlB=ek-Tj|fubd}IUpH**p;
zw87z>h|qTh2|H~tr=jnewJ2$J$j_mD(x%n<S{;x_1!;F|IK!dG1nF=-&)&XoGHkcQ
z*?^^o9yd=1f?FY=Q|O20jX;K-PUx4=erYr2?1rNedeVFfC3~C&ph4&<^Iah4I7>K#
zr_F*k<cgeKB|x4r>w#S195oxrv*vmrd!6^D0r`=+50k&ic^~```mx!Ck~^IPV64z{
z<`;oH;Cu)ABJ{k;DC|DxvrxaG7tF7qWWU3=(1l)<4xV$0p%Ftbnaq8?>Rd~TzHB}N
z<bW~Zb?j?smw6P3S@L8DqSm47%!Aw#UU~{$ueXE&s?ZH8K!r;;M(CRo3G_J^J1DqC
z5Wh2M1G!a@p!0RaC_=XhQswLiPlRq4q`_H<kwf1WB<x&EmbgQZX6L9pAa@GV>NJD@
zLwCsp+MWB>1G!s}Eyjes+=VgoUCe6cOH&zY54~-^4&|$s{f?gX{aopLavveb`4iXk
zz8OWYwsRPyF!X^`^EoBtgAdIYFs%aTGpzPEX|u|C8Cw?myWC!GbtETkSv(UUWwjC|
z9*ZZc0q2*PLMT^CzU+Jf5*PAXucNmMRcc~_1YM9&`As#79Kn!6xq~a8DggqdP%ei|
zgz~NT(F`dR{zO%%#G;Nw3Z=FQ*ena;i(jfy+2WwILqa7?D$SO%{Yc9YD-#Uql}ov>
za+%kwW`Os{LvySN7y-$aH)a8wYtif=+45JiTcyQRA(AbUtFE#bT}85mU(^ZJS<C|3
zR)8;8)|k&yx#M}VBBWO&mpk9e&gCw!c&4e+X^VwY)}YfCi=+(cm05oD*(ey&E1$0b
z7M7Z=R^Vo6oKTajsNFJ3eu@bPL!USQ!Of<Z0$6(~XF*DQp;OH{ScF7WLwkf_4Pn^R
zgsY%~-bPF*bh>m<@>{^c&>1Fk!>YG4bZ-;Zkm1fUk3|XMq4*S=z^`HY<Rf$B5u1QR
zJ0>&Xq#U$5*F0ZZUE;PPSye06^~u>lo;}I}-Ja|V#V#$W6J<Q=Kxv7hX94Gn9^?e@
z;C1|wT2ypd{X;9U_#L;H+D;YA%R_YWG(449D;1k6W=Ylwk^Cl;MQ8I_o8{DeS+(WF
znr?@R5w{|>VphfMq0eC*_D=nnRYwNY<haeP!~DBXK4h5eI=mx<A8uw%ay9?SsSywP
zBchW@Mz8%>ma{F@tWPR&)+i~#11X_K^6>)?+wf;HH`8k`VmTXh;h#jD@Nf$sj^Ts<
zgj#rb3gF2!Yl!*)^#67)!E*u1I;nWG*7+V}2*sDW#Z<*vOVq{p;HmiPR3+l8&r|r@
zF8-0>zaAXywfO{J2g7nF#E$_7c6+AakJp}#PqlOavcOEp3~ynh672OHj<S+=C>(!i
zr)LO=$jg9afwdqFdQ@uS<{(<cJxtm7jFOkpJ{TJDoQpO}dPelIq~vnYFDEoA`F%-$
z0p=Fq3kIRkHF7_}xwjad?bXA~ptxNtNRIQS4dgmOZ0EF6AlC~r$!VMp<OV@}&hKgS
zzbQz8vvwPh8wK$@`!QDNTY}7R-pm1VlOT8l68x#q&4SEvzFQ6C7D1{&t(9xAiF9GS
zHt$Yi|FAG2AMYCZdQjpcgc4dvumX_$Ggu}cx{TK{@WUE-JcUnq-$Av_$O<(8>RiY=
zB+Gu*nb(XD&HeY{0df@3eNz4=%SG*o4^9-t^lb3HJ0Mbt7amk48Hiy~6o2Rz^9n>(
zG0hl?{dnrNx$F77$DnwGQ*t?bnN+BRPwl@+c<nQIkk1<lS(-u`C<!;+QS?gsQB$VJ
zs{(3#uHIef6>jm*)5S7-`H<kM6mS5{lMXjDt=s0KbQ?X`@7)sK6HtS(M84SUj+l$0
zDO|nW5D=nD>PviNJ|C9~tafYj27&5PYRmjI4Ua{U|GJf&+UHoEljX$$Rh_9GUv`Z8
zEVm9X5U4soz+S0gGhs))q+3u4=?hnv^D04BzcP)FwfPy^On(I|+F>?c&&z`L7kzjo
z_zglu`_CAx@tcHm>_QN<@kYY9mb@9TeA{Z0-Gn1j<E=ssd+JueawaXXpPd5ub`I#b
z>)EHANrUz?wSeznKRBzl0KSuOm0ceKd^h2cJv<%oJ%k(V)e`{U%h`wR26$YJ-yz&=
zpM%oI`v|wnZyYo}z&YSGMPR+g2MKSngXMtvmKt0kF5|cl^Z5z(4OnQSTyNfC-;dpB
z{5ST~XTQq%e3$UBeVP~W_Xv;Kf8reW5#D3piO<GI37=y>4tKrr`|R^V`<;5gKcJU)
zsr?^duExjt{9gM^_*sol@P^9+_G2J)qa-f&+k9Jb<9>RQ&lElcRnzz+9W28v{8Akd
z-q6KWp~}?Yu+jLF+Ykfr@fQUrVNYj%kOvn&C;SWZEUZkj`r+3l+h;gF3>^NYIIFh9
zUc+yQ8#~Fl97_xTN=gcx1RRL)ugwcFeZRx;!oQJf9nMFXPxzoz+u=+F$-=*tYTeGe
z*w66q#KFD6`4CJN{=FbSa87~V2)`+9-f$W>1NoyM2c4H2fV?Hh9~^FE_|N7)z$0%3
zxRc?x1+mS*UycO!j(G=)f@WY9s1$xzunsfO%O!ni?!{c;7yr2m*k8rx#zmu2@J#q`
z=A9_J!VK`$=Hb6f+0|x%d>Q_yVDOpAnc<IQCO4RY)g8bL@r&U>lMBP9V7Hk8@@?3%
z$hh#Qe-4up&as%$egOA7q1(a}tbG^{{`6;|RKruG9sKF{NJgJvxKp_vyB<~^JG|?+
zxD$m^_L3R+8LUIN$l{7#HRUc}c!rd{hRa~2|4hN)c{gK&!vVqGFay^X0-Gfm{P1VM
zZ{fMt%it6E;bV=!D#R21zzm!LB^|DmG6VM*x!Nizv#nX=sBpVAVH;S=3VaF2%J623
zoDj?jM1#P#@cV|wj-0^63Se8MESeKI0S&_2r0m+9!2LKAgpZZE+>jGEiEBSmu$yuM
zThUp#*O~zRep^o9tB}WVN<8*Ea{`gMz((Yp@jwn3`e8`o^u4noOrECucq!RF4Wl>7
zyG{)IEW!`asmUoU!)Mcj0-J^Fs)0O20n4!pj{=u9?VAS#FMi5B49KHI9INo3knN`L
zn^-^I0`(!0$BE!AP#dr#O+REcyannQBKwIfunJRP;HD>uEV2sE#KM}M=0R|YRmi&o
zP0u=TEAg_ZKM?s55xgwwDs<ZP+!I*$4y&*otljhikv^;N`_P(Aud>>(RXLa%F`9nL
zS?{q5qu|J<|Fsn@&#?+uay|b}<bYMkb6V4D_W=oe3J+@ra)7UoZ1ogg075mr&bf7X
z3Mm*(zabYL=P9IIG#zBuCwK}e7EQmMjzM>L3Mmy$zhlXOr*HwbwCVRmhCPLgp-h_I
zB9ihHUOOGg+eF4Zg<pVA)ASCJ&wC1OPUk&vqOr$QcvKk3`$W$0VEeud2zgF0bUrT(
zD|5qAW$~#c6+|{g&5fv(clv5<!Qs#HHn7A^4}Vr2%U~1n$ZIp%fQ&IZMe-Snrnt57
z=_XK1snusVEyI4J5n7VTUzny6kgD-VgzbW^<bcumW5Sc{7$)2J9ATft{u`esTu{)}
zg*q=#Rr~GNTTtgkJ`dYG&^NwBc&XhBc58f@aI?*qkT$+Tcol-*l&$b3qMqbxPWW<B
zD=L~5zDhJsPHDWS#|U2|h%KS5@bz*%11}+D2j3FJ@B9_Rgl`oj=q#tYQ~{1E=T8_f
ze2=K*24ljnrUARxBpFKX02lbf_lfe9Z)b-ekPg(%kMKkCj!N6%yRX8J$lQDmUvU%u
zt{?@*gq@V$@0kyyw<@0%uD0UfBIj!GP`K7&kkN4dfn5*R39={fOP17&d>dxq0~XDb
zBK&07&sf$VWoMXyN2xF8ORV4=+&XUtwm{0DyVpzvwn(B1SD3SK2O+$~V)7E|c?oti
z+$7V0LMF$Bmr66J;OWJ{mI-z*ZlTg99VHkPavPW=+$`85P=a%TEw@In7^vrOQ9ZA)
zIv^%c!F+#Bc%{^Y(k-I>S|u2iZU|MvEux~JbWfvVU2XZm9#FG))c`x%V$>FDcF{Iq
zt<nx^_BtBAHo^XmnN0z<#yS(DL+P%k5!)bTwgpCJ0$twV$#OZOG0AcskjeF62syn`
zmZj(@h10GHZYrF1M{tTBFIHH$Au@Wz>gVws=^cFfZ^eVWXL#sp+Cx=`Hy#WdO{a-#
zVN>v%z9?ZW!+M#T>CD&AC~wIm@IlkrR6jPqgVA&j-D$(-S1_8+<v{pW6gIEvJh?h&
z^J^7N7x2X5x5=|j7g8k!jXb_3v!m$}sxG-m+H@%%0R95DqUo#R(%@BXCmBtbv4PJ{
zVQZT%=X1Y(*<!#~5DwZ`mI3CS5BP=GH3PnK61r?K@*cx3PHMXDHymL1HWb{zO86;d
zc61}*9Q#~wLDNly@n+qdz#zV+Td9E6RBz+R2EIYtbURfvvee%M$(p{+E@cz=OK?Ku
ziH66{@q0k!*Rb~b=b2@jW7ogIOQ+RqFvI#^3Ao=6@YnL)J-jaog?YS`;je$4FDw=^
z)c=wyQKfk5f78gv_Gdx8`rk^H3qN=dJz4*|6Hwr_*{bAkFharlW8~(joR<N+O7a`1
zFyRmAu|Ci9G%N3u%C_g%KvZR0AFgNH^;10dakvI`un6^i3jS#m;HjR;c#iQ_Pv<A!
z^j%`*fLQg1c@9U3sJ8maa^f{gM~wPu(m$eNyk=9M?<qhfug$7ccpi!Y@X5zcLN9Z{
zUYjp3_1b&`Anr%vc|KqD=S#mO3Qu?8LGeLf=M(rVZ#D9D@r6K!yynf<eF5~|bG8TC
z%NHa3s=W(J+SkMP<s2}qUD!fj@A+tJZRSo7^A&(zo1IPJ`_BFhK;B1%hp)R2`KnSM
z-xG<4@8e-U-%IK~m;~5*7n`#*zX~AU`h?FZOR++}B~RWrmi1aI>uER$OA9th%?`IF
z->s)=^2Lw7`DkodZBQ#q3)!bt!tRUCmPY5Z5v$$!NsV|LqtJI3it@?;zEwDl@8pv=
z`{nb^e&DZ#s4<;y$+Okl_6qryJfD5;1UxTdeATbsyyxfJ_JYEXg(c+22Ky@3nL&7w
z-N$}r5)Rupf<X!cgqPZH@VQ($XtpOn0t#pI`6~MdSWaOX;Z}KPS78O;9oH_u-&t72
z?e9=;3#{Rr#dg?#f|L~2@&#gd+B?{P9q0Cdy>}+yd4%`bPi_P}pKm|gZ;wJJ7cS&#
zpOg366)t)f{l99z){f^(Wc!OcAcTcsk$Q91!J^4fxrI#%4IC_by%{LKgTR+v9V~jh
z66jKe&Nx`~yA42>DYW!p(Va&CJyM}12aD(p6&|I~;)6xYz*~j9*M_eA2i2SXmMgUA
zVA0|{l&(-{;lZNKTY;`r==6g{RteD63N1KTR0R*LuvMY?2aDzqZByv9gGHBB13gAi
z%XhG-4FXxXR+Ub{thj`A3Y~ngsE(D_EA+5~_7+m(SnkLlz_w&3ug!Nw*6@cAmfgfx
zPS@}q)yr-ca0nHT^iBE<t1*8vi61k8)*3ZGVA)juj=?0pI4TT4+o4cdCw|x=uL@5l
zc=jv^q9Q6$0i2jssh*W4t&>W_x>5~)E8(bIzJf~XpYPVkfqyFNPyK?_ze3kH%&F$w
z$@vpKlS?O0HK*nIpuwy{!!!BtiAPLq!>l}WjENJEL^*avgEn55J_S#)CjMb9yfoZ1
zdE!JiGJ)EMrF#gY+60Z}w&fFb-2RayHqEwtwwN^AXv?36!ow;6z+C5;neL`kp}QF%
zvajAes#wjfvbZgu6K?ijzM_~tOwENQQM0zNh-nkCvT1oN!6i?3JuE3W_jJ?1n*>mT
z_h4tYDa=A4NJUxgfcnu6ea@Hp7JmtySpJLn0-X}K0Fl~ElcS247UPooZ0y|3dLw(<
zd>&AbDvK9Mwf{HU;1b($i9J#81U3d+Fn*T~%k0u*wI@@io1{8P>dTc~nhLoxrcF00
zv7&sIvaFyeYwM<GI0144L~jxKph%b|*JT=irYg^7#Tj(s#KR^|n#d+4nI19^OBc&z
zX5?p$I}=E{=RiIffK;EAX472GG^l&id^sB{*3*M6Pft#&mh0KDDke84t0hoeIVNQg
zOxJ6dHkFw+aIrEi;MizHWC!oA5LTBqwV4u*6Vl6&vbs!vdhw`HpXoRAaGtJ-{xc67
zK2{S1o&T{u@o>R^B4!K6i`gQeT31lE7H9aM=#ngf0@|1nlyH{(G-Vnop*fsFbHw;b
zEEV2bdgwz`{Qp&hQ8q+mvIR!(0XBy0JnduqgopVqw-#hG^z@AI6^<uDaN;7NO;Khm
z=oo*xro<1$XYX0b_#MqsVcfzQGokUQNjoNP7u`NH*O;Hrl0arRXJzeXaQvRnc59Ie
zWryx`Id^)FnkyxU+K?6Jj-S4ISdo61%eoZk|2LceFTMFMy*cp+sQ!%2`DDGB?X)a(
zofiDmlgB2rF3uU}BrQp^^F*?<E5?l(>4Z;Mk0vmX!tmqVohB`{n3V+|<Z#_eqeo~#
z)9BKy%8=Y;S*1Xa%ofq3vP8MrEx^yQYN=+2XtDw&+J{=1J;k7?h*g>4@Ji#%%nW07
zW@H@oGJWEFqq`AWj9Y1&?hQJVLnDlw)?Qfnnk*EhYjvNjjM8;kC`#8my6sfB(i^DR
zHkn(CT+P-lnhmWsx+-qdL=@x4v=(WVw?zQd*h;`Kwy~W0>e#Hl#8!7?rloA!c51rg
z^ixn#Jv~0V8Yg_hc&1Q_@5J;&@PT^t8Pqi*>F1!DdcH$F%GRaPC2&*?qcdGuYfsL*
z>(kxP|Cy6Ow!`UUd=DB!*BJ#k$<?@rxt{9(r3*UV%uY}Ha>AZ;L$%LBAFC*XX5`!N
z8sXw>BV00G50>g-u$^4MjBNiA4k%7UbU}q50(uZu#hCa>UU4-w8g%`~+1dVMS*8uX
zo|b6=i<#|W&($Shc{rfi&LkaB*WbpVRoTuYUC{I)uO^!fsj6zpt)c9vWFg~o5F5)V
z!>4KfZSrCGGyxmL>+9zY^^Vo`rBcIn(UDYN9e$3uZZO_GG7y`WOmrFZMv{qn{X<;?
zBi*rio&Blg_$SHT`oTbd=e*vou6bkOC6OhI>JqW;zG$j$pnqs&Y~G^!aQ$MplX2}0
z3^A`Oo`@L+W)a~mBAi78vxs!|4@DEZBVF+!yzVv?OC;;NIOWvt;aIZ14+~0zIJYNL
z-QBSsJVsCebLo!*1nuw`zq^)!^<xg!mFQZy03}|C6Z=$^aO$;qr<ecvpS;~}7~QqD
zwZU`p{^grjc*gdx^z80f^@F3fHrwkK1N_E^m`9Ge-kO`g>(uR!+}9jlM0}q2ZLeo^
zzsE^gxgho#7{W5b`1~IuzuqB5-2dKQ%o~cO`tfhv2F;5m2kUxcL$O5vA-o`4EBhBu
z&Knu(AIt0|H#IgI!|&aV<DU3%Y=}Q$G4A2cMCW2@$-Pel^F|kZ5=ZpKqTR7XWH=G;
ziY1f%L%shQN2K}(xu@WVG;e?*^iwbo=8OVW!{r#M93{V?LNea9Guqvq$Y3#D(m#Y}
z*v>R}v0V(wgg&scst&HJ8yHx!2p9rj_{oz<w6h-wf-q!0p&nVgr@t3Z5d;*LbaBLZ
z6)xRrOi3kbr%Q)=B0c>B9MOHWyDJ+Vjt&gOyE4UiS#buz4>e_w@!iPgp%BVZPirXF
zmFkak*?J_Y646_lsTxhi2m3jqUQwbmm560cP?KMmlEOk$7f&U)sp&yDD~h^X+&35-
z%%CTY#745ZjwTY(-I=xn*xd})7ftplY`9BkiXG$960zRcSf*OCZ!ndO4n#XMg%pkq
zmWU<e15ixrNir4f+6fT3qBwXw0)?WmXmV)2f;ve(lw%Wmq#5AYsIJz{+2H}chO7X5
zHCX{;iyN9UP-L`+YeY?qqJXaWpzefKM;Gd+iQU5~YCDc7+K|I>XYhAe$OxcsFsdI>
z4pE3;-OhB+sez=PJ04M0q6Hv5LU*P(-j&o-7<M-WRY_kmi128nE85kUwOjG5eWmE5
zcZ4e0M2tWphK^(dv!9L(C&5lp@<8@ux9jX@qns~d<>?+rqlx}#r{bsVifI`f|1c4Y
zq~$HUB-xedA0`{<he{662_*!NwaBQ)!~J4b@Qj**yP?_6wLMyxC>5l~IN9Puau-_D
zC=D0zF9N&y=I=ZwALDU?p3(Y^p8Qul!w;?PyS#S+4UhLBug7Nx?Ya*uJSV5_-X8hw
z+3|Ddc?MI~1lXPeC^gIYkN-(G;J;~y(ry3&*PdkdF6|Ov`_o!q!DPlPPaq3~Q=qkt
zXm#x#zyy4<vUeQ?cZXb63^h+4qLYH5G?rGZ8dr){BTBKR+hvrrex!A+#?l%SW`YCh
zC8mdRbs&mAg^AEnx)EkiX4!!Z4gd2@#`jy+<XE2a4jf`5udKav`w`oZ2VV3F@IiZ;
zH4%KlZ|PXZFVN4w{FDE>e<E%S%xiQY?b?0<$7&@ap6h>`V>KUxx&P&~9O51vqBWJi
zR01n1`M=_{#1e@iDrfCxq$N`0|MFq}<-`2ThcOJC$sr`Tqwpzq=)dU9q&>1jt$H6%
z_a86)_@PfKW}Cc^H~M(&KpN3DKIhuTCoHpY<o40sqxKxnt`yxT8}B5?XM&#>@#9#2
zT!RnGs><gd`<Lp|(`&!6ZtL+E9kI+aq5h;Vo?%b-oM4~6-Y$6O#J%%8CwF+BIK@83
zUTV*K=Ys8?DG%9m5}sd~cFOL9dzP{)3O0P_#4VR@-|IQ^6uaZ{cWzzwlxMyjeB|&^
z&xD>miIFd^^*m<ujGWEUZNJy<@p_&$(E1L0*%8Yc?6Ng$k6yF(49}&fSPPKNhTCTc
zy`KLt?fsrVoMOM>neg_QC;3q147=Cv-~Ja|^=6fNuV>QRui3NP)|_FF+RNJP?QjDg
zJcWM256y1~ycF=0W(VN=Pa*u2xqsOaM*_X~loZfs%%uXe=vng(!1tVTjKHrfTh_*U
zcS^J8q@IGGH|=RCxI-$wAO+t(r3Z~(GEet><y6q9_YA!P`QsV0U*SsL@Vv^Ebl7iP
zb6k3bj~n(Yc0Rg$R=T^}Of3_HlY1MtV)E;jZBN&>ziQ_nvFx)CAG`gu?Z**Zpg_-S
zxX^pesU6bmD_#uPqX)oU6w~|=Zlh(qgU^roLgV5V|4At9zv%;y>)wsUjB||TP%$p#
zGOo?1$5-N=pG{_>WrxJjRG8$D5SsQlP&MswpoZ%?OJxa@ph8xdL}PMHChYpus4pQC
zIN#bdtFVW5fyevS>0?*A^kW`$mkx928vk`~e7x(ePi@LY(0v^m*U(;h+9%NQo3u}$
zn`wIK(sW$I#of4uuI>8ty4XE4>ryw6p-~;k0Okf6;Fn|t8Gz{^10V@9@UI(W0IY%x
z03^u3zY<#jpn?nlbdW(qI>-P_g#rNRAcL+TK?Xi`gA9OGkO6=M8SqyH835=Y10Wq_
zfT7Sq20YVI1VB2-pdg;>0J%X1fI7$kC>>+~On#DB0%+;lC9s>YSth{yaRZ^aOrP-?
zS>`c2(zbaR2h0?KuAvluVI$JEA+ow{ZHv(t!x^wInuw(0IxsC|$>?Y-!XL<F#a)U1
zl){n-1g3(zr``ktgGRFd<QT)u?0a}*s4JD3V<g4EL_`{8b;K9dv0LnAq%)dC%fV=3
zC*t7p6mgJlJ@V%6{$9L<K7wdg^3Yxv;MH^(v2!3gw39$|fIm_OAUPcEiWvj(q28c;
zaIzU}WGLC+I~40yYlw`<+Kr>vZw;;tN;p5bpke;vh9wIY2CFuqT5B|=p4ZJ^QXQ-t
zT(Srssga@BG95ey8clTdEkk~wj)lGQ|At`Qh6TYoY}~Tmp^>JhU|mmp+e&=K#=2s|
zj5sEN2;bKs>YGB0C7wX_1gBkBHylkw2ZPDvaGm1!IuaRK(!T!QJ|ogKlEATjU}SK}
z_&;Phm;(7PBp)J43}Zy%1KkmPfr0N!j1X9|D3XGj)C41w;JKs}z$^ptU5HrYm`IwB
zsf`)|trsppBemtyDfU_IF6z0Qq&9tIXe1fyULen9)5#a}67hIyUiScI-aj-ZWn>d_
zA~`jiNjJ+B48@Y^X$o&f@H1ocF<JaU|NOI1{aK{`EH)xTv9XlV9UlRM;+a}ir&<r!
z&P7Dh%OSHO4mvWd_*L}35$PF-_9nCDua?!ed1QDv22zbG?sqAQK18TgEo#c4IK~hj
z02l6z^hEn9m*C{#z9?lrK7vW08Hl`7<}-r(OAOpEi6oJPK-hM`80;U4kU0!dy^$fX
zdT*pJI@CRYDGWncIY1(1EZ^ML%{D##vBb*0cz+kf66=rkL`McvAW$;7s~e%rfdQ_Q
zS~h}^v{Xq(Bi-=`0>b@0yV(GT%2;<K+C@G#c18O!k6sB#sri!F4OD)ZBT^Z0OfQDW
zbSl!-8R;1^z}d-IWHdT35;G*cDTM7!#7Bm@BO}Az(Nv7uJ2E`d8R^DrDo6X1{S0o3
zp)rONG2s-w;zW{DXQ<ui6e0~q@m6JytD>@zo{@n8EPeg_$hPHcx3(DEbP@!E^s%AQ
z)i*M<6U#{@qC-h64UE<mM`o?pka1}JxC<CQHq?vsop?t*(NuIG5(R}*1~!W;9Do3G
zh5X6NfheX0HB4HgXLMogf)RnK85)Y<)hIHbqg&RuY+Amy?YNdzTiVvOh#dkKGE9a^
zMRCL*z!bVhMeQMaA2~Tbge@D7rVMO`tY;)?VCJ-15EIEIF);vBg(da$BO%lm!E1;x
zA&5AXX$mwJDqx>nl8huHv9V#SBi3zDkRgp=I<%F=AZ^M`Wo6ncb~4O2&L*R&{v;R!
zHZIcL58a#U>eHm@AL{PM5>hKStu+vik6>@3<B6jTKNb+_K!iWSih7LLzyPAr{asLX
zqcJ)PiYXHPqrw$>jYH8vvN8FaET8O)?u<ox64Bm4uzG~klYa4wQY35VNOCuA4z?N0
z37L^JmC=)k4@SBM`kB@niYvyU*%C>M4Dt6>qXWHhn83cl1qSptGsfMUM<fB1G=y`&
z)oeZ%>4_(HMH46|q!}Fh&OC2~lZKN!N-~2m5%G>-K6^p0UL!fu`B@MP+&k1wS%%i6
zVFr6bX28%oaUi|WR4U;i*BhPj_&_W=BnoRuWCVK_5y?kqNNNawh_q+iLaa9qyQ?-A
z><V2W{>DgZcm#ah7eyDsjGz3Nvy4H*3`w!%HISZ*4naSH0n^lyjJI$`FXSJYfMm26
z(haUwLr80-Bx6uQWH!u%dL^=`0mhC=^URzLu$OWtb`K)UxKqi3R7%FcC5ecz1LsEh
zSBZ;AZ#)j7gE=YB8o&?Z##8-J0+>b&^h+B_m&Qp^fLtGhN?MW{MuG-yFgk=)K<Wl!
zv0-VdTxKns8c7)~D<f-Kwqv!D?}<Q*fV7IIQj{WYFGrxhh0d0qGRYO)Th@b=D;jC>
zlO|XvZ55Y5rHvm82PV3UKXva;Hq{4t?Sp-nipq;eJ^VyD)Zs{{o}@bh<PIt|f)1e4
zXjrf-u$NS3u|aSaE-x6+b@R!yx@nTT0}}>)t2CalXScFeV9b#v5gM+rY%$1}#Uz8A
zDCPl0GAPs29<175jiiip!Yyft;9xUpR7R3W%xa;4y>`We^j7o{UKR%yP80O2rjAfH
zDGcFSJru(+CMC1TuJ(;lG7<sYJrvs&>FOWu(;_4M2PwqtVd|I@jts@ST}}OIr64^$
zych+KClKsT650d%HW2B@Z2=}-(`s>3%eD<`T2|41q^Q?msvt(`I@*#%)-PYzvf0)C
z^beG^qjwq4SSYxVn4Qv}N$9?qXxB71y6h_L<&1(!iHaM99Z)tyX&(4)#Gxl$xg3gT
z%$^XI@+kBihJuO=z&5&c$$F5jFCcB`jWz@3^8eno)mCBLEecoz+6a0`yCSjScvl~U
zf(lRA8v+QcE_0Nv8eQ<Q-E$vl?KBh}fQto|iBO6tz)(K@(Sh|NgPqvSL~KNqlrfHP
zw9__T?~mK#wHr39+1l>z-atR7jlM)byTU0CvH4J2(H=5Rngj6bXpxm0)}@=%S;qaP
zj4$6guoI^~u)dpTj>O_UbOFE@;FCdkeq?>^kL{+t!4Y@>Kb@!sRfiU1cmzAx4e{%T
z<R$w?;GymsB3t%|dUW|9sr54~aeNS~7>&cjGGJMuLS26Y{4Vk$ng(YK+<r+iT9V9?
zVS@sK%}FP?F&pgM5WO=cfw*k~yDm1qed`LUTZ9C(baFT_s5@e;Yd8+`0;@b2O|co3
zFZZ4|SVTP-y|4vwxJ+<chI)lUBI{Z_F<pZq21>8ryk*n!w)I;!8=bpTm@*hP)<23h
zCPm3nnF+(~goTI>phQ$6HBwJMh_1};F1SbWT}JQ8{lj#e#N!aF&E0cFo#$$?5}LK+
zLj${wU7RAdJwsTqd&%g4c8>?*;`+%^fP6`#2yM}gZAja=Gz*AtsH`QoLT!GEXAm_2
z&MjoIlu(B>r^M4W=c^>BX<d&C+X98e{Izx~;D_;ufCEIFmV);q;3vTZ#Udn_);^gj
zLB#a>#G#GzSlNpql+6GKodoj&&YADhk^9O84dQ44u1>EFWYhO~@DxPtf-4s3jCb#L
zxj<|utS@W}&5<%OO50NvMuaAGVZapbAxhl!4J)^_Y>8ms+twcq%JRhTDp7E3mNOQi
zivt!zxfa+Md{{EO5#0&rKRs94UJxm*a6h#K=K*m}Wg%jLapnQz(y2)wu~HI((rzs7
zks(wod_xIRj(7SRmjRYdf#sk;7%8E^jU@VI_$>PA)zjjMe6@6JX<5Iy4ZJT#1BX?(
z+L`*Wq-2$h>XrVIxMqaOrqzB1rx4K9RCYD9_N>z@ho%bxVv2?}29y2t9#t@^D<0oT
z6#OV_1V=y(E{tqyS-D};DoVyl1_DA_8K{khdXbw=uB+yvpfLGW7}Z$Sws}jWeFMZ>
zENW(IX~EIPlY~>8G9+q%@{!>7yBc*&9d?q~^-nw1xJrmzL8(QbJ#qA^)=0;Q2V&(>
zrR#8QsDq;@<bYzQf&hK}Jy7r|*iKkoy5l&$fz>HKym6%12XmHjM3KayAC&5I^^MYr
zh$3|J#2w!aohIzRWqW%Ijy{pGoiJ~7KFG>R$n{`ULNjul=oZ_lNbOov9-O0tm@OC*
zigW-Tj~r9t5?kVul=NjwB6Ly|{59A=up13Qx-^?>$CU0f98*Ml!CbKKAUUXkIGY44
zGM&O9LChj8)NPwLZ-w|qvUWIQAL7GNkO>UjgFPT;D$|aWgo<=PP}9c-gMl&$)#IoR
zqk$W@G@iJUh<0+y<w-%zuhB1NPkFJ)2m@XSSW!J140P%JPio6%48w<pe}*_sYImd$
z_9|oKN8{8UT)NAMMsyU~S_}uzSJVd-1)O)rRdbc5(TQa#Ix}zu(vnhXnGmlvV-DQN
zhvG!FNv=jzrh)+pFqiUovQ+_tQ1tZ-s1@OkmTm2kc39`g$}Js;cBeR5#kgH?JtTGv
zzLY~tbQso<aRS6YFj>wbiI{}QIk=S}D9)PXRZEdWPv%%9M;fUjHXiJOu@1pi)CxNQ
zmVwLR>hW}N30<lt!o>7S7=hyo-9bO0KvPqK0?LQv-bIFZQl)yK7*n1RVW5@I1SUk{
z!G|%hZ;aj@<^^la^Le)f^XOLhFgynDfq@)@aYCgMxaIIsRA-2Ap(V~Ga2@+kf{oVP
zz)%#nBpVxFc9N@}C|)A@xS!7B44Dt~6NSP(T(=5309r?DdC|@k6Yeu(R&)+ArG*Tl
z3C$UU0^J6YwC3Rv(@TlmtDU3_BM{h+xZe;q3hNa^#6_Wkm`trVyJMXra4tH*ZUdMZ
zZeY773m9sgL=h(4yk$Aw&e$7|?uzav*@jV<2SiSufypce#UdDg5#B|ZMTaHS@kE<i
z?T&yG7%bB2Sc^m!Z^$KE1T)nIOiV-RxG`A=<51KAI%P%LBoNTxc}xyC2+}0tqKvWo
zbU4T!Oe7(|1`&amkqKiMyl@FtiWzDjM3RJdP!u|>C!1v?db$=iHa10~G&@ua`mEYN
zJi0`bejm^LazX&%=_6}Dn1!@pN-xnzz>GzaaK>@Ew%8Q}`)DaUC62|zg9M>@_=v1)
z+0wdU6{Zd6R6DoSquNvNL@a>`1RQlo`{Rf;YDz1f=1_8_o1p?p3t)Fd!@5CBx)%&s
zA^MgC11Ph!b$#2mmQ9<Nuhotj9c~2E=yA)rjBEsF4Ceq&$_)&<p|-7Ut6a`kzOuxR
z7{R5A(K1e(HKyX#*k3V*E$dfqSVce3Rm6yoV`s>1%vUO##G}39lpb=vY^IKxXS;I{
zbzb*}<yX9BbPn<=Fpav5wPM4DwJpon8=6bixkB`|(lm6CvV)(x7p0+9I6Xm6I3=ea
zQKR5CS(|Jt(nwkEyGZ&lD4gvSri0IN8iiAahGVd*<O()-{R?4FQR14Tz-J?1Lh4P#
zIJ-v%5jB=sYY&nqbA%x1_J}-V$K&wVRT5NEzuHXD-Pe@gx(-qEEeM8?1{wEL>-ek(
z)V@?+JR*pztV|=jVpC<%xL%x))TEfoP|uB>{X?VLrzhVbxDLe=*%d?fE$g&#Nc0T*
zz-4sPScv*$E2c8}g^~1Wf=MNMc&=ALt(jDTIQ>X%q1tJ!hj7A>n+_6#1IsWB2bPla
zT?(h`p`<}yF2T?arHmOo<dAS)OPg#6Iu4w%F^Kf8v_AzoPKVX>0Z^0*@)bB;s?3V3
zACw~?{uZ2lE=ltwF?E`ULP>8usm3pZNEn^^kf}R}W)zF1a_2#wnGU*7!gdK}mY{yd
z#Nk4?h%pceci_MR))78YlaRx8#vh}l5-aKk^29Jvj^WYa0LuMN>uAY5f&Q_vXjZTt
z7GqZz=|vr^<+F=1dr*kYA(AZa0@;bGOB3itS6#VWNfsOmbqZOrb@l3&O<>wg(hXj0
z7Vn5Np~8{Tft0Ynl36g1A_&6;qPDV_8g^82Q|So1vizI3Y}kYhk_080V3HXlW%P01
zKcj0t&9BBJq3?#0T)lLp^dQgh5VAwLh1o|K4eaTssC6;~BoQ%V_=7YtAQh)4y4{sp
zUV6b~>CbBi_G76UCI33qskJ@NgYX)0aEDWrQT_Vz2C^*TNebC@T1R9CsZTB2peznK
z1Jo4YG{`E|Znk#T7GLy-jtfDi#fd*@1ZG@0EV%9$M{^apG`eALG+#6HrBp$7TnZG{
z{X!?g;UoL1=!V!h&R3i$R}TQ?T?{Q`SOPb8RjX@nGeIUdinMam_Vz6sA}t+}Rm-<5
zM~*w~12C7zI1Dl&+yvR$v=P%M0a`048>XUIN9Qy8hoElY`5}ab5Wnzi55lPA2dO6C
zFG5QYU9#eG^xdk`xpaXed<mxB5yi9+L@u=-o<LVp9Tjj`RYHg3l*l~8#4vq4)4+>`
z%7OSn#nPNB$0HKyh0;j}`RKq(TvsNja*A#1S7Ts=up{gn?f|(4IcnK#eatlyPzH)y
zv;rGv=s8b1X!Izdb8)jE8(Uzsu3NrRJTjc@=8G<eKLa0>{xGyM;#rJ=7%SFC)@?vo
zfu|rIJite^a=5jEjmN}cFWcIeBP<1Vx>}CE!gyNG%aYQ9kElqOJByxf#r;Ap?J*yE
zoTU|JXiVu^L~!Bhr$;5BvT`{p!JwQMIJC$ibwg6MDH7dF7hP<d3VftSp)g=(4-Jo!
zZevXB%C1I7BpxeLj{SraZVbo)0qbT2dvnWX#+TrZh~kf(gl*;xg@Gu;5c0($SALbh
zAQ8Kac9aklmbGg0^2p}4qm{;x+&V*ja(ok3%~%ugO#=C&aWPmp4E?bs8SxnHPoze`
zsw96BoW{eKB8_5s9B{xKnM(k)|Bwms<8cg<!>#6EI^B#>$i)H7R>CLB7s{*xj;ruq
z+w#R)%?)#%VBulz13ZBU%_t1bxb2H<SaD3t$}LKBFlnh3sr0pV%SxfcNt{_)Q)|9T
zJK&%aHWf@M=hIBqNA7n}bw^XUpX0^_F=Gi2Lvss@L!}O<MsTWPf}4VZ$x5Eib+IX%
z9G^;OfzbmelTl&Ud1R0l$7byXQxA*uwr^P5wi0oJ<ttlT$W5`az9@DK{2+Up)&t-`
zOuQ@Ok;`=uR7>`WRH(psdNhy@*3BJTi@Z2ja(9Ey57(zWd4@?7u?F>LzCO!~&47n9
zgyTh*R(a_S$<D}$u19vAYHM8nN4#lQ`I60XV!+)7I6({!rPVWI<8;KpWt|cPpyljG
z)Z6umunaL=D$bp4y<nR&u|5P^B(B2CT=320_zUM$Zi#R(242Oxk|Zab2Up%<e$dg$
zu|ypCZ=~hu$|?G#=P08n_k~oIcsFkkrd6Lfj5s!`m~H2fQsz2ABgz5ZD?@d-qY@h$
z#UF0A3g2a&K@scFiF+kv)WYJZj=SX|@+UHuKJm#TH<Qe(iWCCe<-wgCCW)9FWGYJq
zE6G}!ji9O%0Zc$M;AT}f6SfRJOP>_)tayOCopJ;~j7GLmTTq=9jzo}*<A^9tn{KJ6
z1EDxYN*2O(s$p^o!V^V6kT)6QyoQE|Bb+Yg;}VE<i$Va`WQPysCaMG<>3$(+hznat
z>**Acy1jsXgji-BSj4`-%cE10%nBbMZ=;UyB!{pG{G4G3gHB09<EUFx*s~QeB-t2U
z86S3*3nIdh@Q&ot6-^{$9%&+Ub`p%L%n)4CjjS<FDZ-nKsL&uvLO<Q7#AT=@w7Kg;
zngJSzPek*;osUAhcMUHw`n!2qDVpShM5xKFI-*0_h1!6wGj?e$z)en{BZM_EsNQn9
z76JiPVO-vk3S$>VkZHxUGa5p83W(ZOa;oB!46eeEM$7u6+t#;;rN{JWqs4<5Mo0l_
zfNCze#DGZgf{_H8Rd$Z5w7*B0YA#d^yE-#uV%Bo`g^SkbZ{ag0k8r(?tV4f}3Vr;=
zDY@qY_C`8ET^OU`(qgG)mMc@YgtVI=w=A*_3|T5cETjmE?5JEd5Rrq%&Pr!7@~gD~
zk8Wf%=zveTpvWCah(1$9$FyW^Ab`Z2WIC7w^ZZyNgJvt++FM&TDK`z?es^qCobq8t
zQ1q&Bxr}5T7(^UktPAZx;E^Hd4Rw<bdJsp4PttlicFrQ`Bf1Hhz!{Ymn2i1MUZ6g~
zQaIR~@}$ywO&?5TcVO)3l}avAxL7&X90WR6U!mga(lbh{AK`QIS7Jzc8{#;{5@LlU
zSOt*+hhYOW+v6T84QL#^fZ4mJVHGjRgm<;$L))&$r3kw&fqvw=jL=(j1ypcFq7J(U
zB{H1h1?|C}gnT8ei#sI=2V^DqseEv%rMAQ^2KRvWF%MTF7inDvC4+z>QvA?FyQt@4
zh{N()Q<l2UW>V!)jI+?Lwvo#!!m;iX@m8cY*FON69#B4@Hop=ZQ<oFumN<j|I&y;e
zX7-5%RyL99M0P+NOGvzO1aR#hSJTzKd94+okyWaM+btVRhZn4iTT|kpMEYPFw3{L@
z?q|_+5qLosyf6!1lm+8;CF%N0vfxGo*J9=73>*RRyQrezgg|f@7f2rs#H;!^H)iq2
zI0Djp17niuc%#fMqqZ3r_m_xlcH#@ytomVgMe)kfPPxo0*0pPwS@H$0N19ZQ54ILl
zX7)m+&I?#6oqmuQVOkF|{{p=s*AT^p!P$p~LMsWrW&`R02TBn<3UJmAX$cwsP=`!0
zp&@J{<X#yf*tH(KT}EQYlnLs)R2)~T==m&{D?Vvr!VMHAhH$D_0kXe%Eeo4uyL@iU
zfF6xF&=MLFr3YQ6R0(F$g+mo@xQ^FS>Q1EcJ%zc|Vg$q?>660SnOLGb4Tjtq(GYVl
z8c4Yjj2@^n39@?X9x+b@=oA|Rqo;jdWgfFQX58IZxypfKG*8fI#sd*ep75krG)N_>
zm+0Uimgwrvl6HF1Xn|YXR9?y{QreH<D|zvbc6t?elf|$_5-pKgD33TP2TYyp0BvYu
zaE5{l2AU_jMwLUFz!?^6O5YMrt7h3nNG>)2YSz6+#ubPFATI^oDp7s<sj`PiakQ=8
z9%)~`Y5BScau#$Z2JkOFEUwbXFusQamx=nZAIn2XC5gBvvm0=NVz}>=&{tfUjoZ~f
z&@I<uNCNnx2sgqn>WnNfB#9%j2`CtqAwa4~{16x%<;;Pc6vVWwWXzedq77f7Stl|9
zO|I@)Xk{@3L%<^d922^*5)uI8${885wh+g`IONTZJGg_<l!7QYrQpW{l)0ol92$d6
zcStW+3#oGd5fGF6=%OibM~|fty%CBxsfggNU>OVQ4h`ZUNvnBM>3^vtAS^D1!s~T1
z?XnmvbC6JJA<gXSv@HfW?OsZTkRC^t@1qYFm|Dh6!l@8R5gWw&!s_c1pJH;vhXI?Z
zh>`>VbZ}t&m7^@tkbTlNC9QHY52?T48!<M{QoXB)<_&kzndAzz64Hl8H*U(q27Pj*
z=-hB6FX#z>i`vtX5imnUrOKh-u+@p(OQ6y-v2*o>6&0t^nMni{^_??!uugR@QR%*u
zBJ{|`e`jhyhvB+$wY<-Wr;sEUUP!MsEuJdJ#q%U|M63(HR^s|XYH3ENY=YAI$Vy=5
zyvIRVLL^c}YQ@s4{GTSvp}vZ2ks3-V9>qzNPlR?={EA&?-Bgj-8Xoa%m>sKwNp|nq
zQN@yJGEoo}naNVO5wT?4Nd53*Gjo|!zR5z;!mUCSMcwtJ<Ed^sF5ik|@20jb+j+?y
znnno1J4X;$<>ICT;%Op(EC(}^>Iv&)r?kgeJUzTzNTnWx^>>|AeP2TpHQLF06vE%z
z+BUbXSlgnlzo;l4?s**6Q7*UNtkh%r-iP?*pragU41ETH4#O9t3?y>Ex$CgMTAoBB
zFJF7~hD|i$?rp=2izq=!(Ok+OWmF2L7lxnT=)ko=eJQLj%G;mH_TdyHF|FiKH?4;Z
zksbN^!~~f5fN&n#x|16cn^YQ6#|*M0JI&ai^h}*VRY;h-l)hf8&#D<b6D(6V9N<ke
z-L1z{`DC$dv}yPn0FT(i)V6A05znX5!ea#7dEHoqD9spd=t%Z*{noW>LE1r_<MfRg
z%uKljyaa&=C{K9W@aiK++FE6OnSlbVEe#C=M2Dv|m;yCBH>-`OSOy#km&duS?s=Id
zD$$_D1#t%ckWDf*f^emrKi!jgI>Z1|fcuX6_#$_g7*e2)luKGLg7oB}-)Y%+RYk>f
zBsb9&RdHraYDi2ol$`rbJDuI>R_uYVO1T;piS@zV<4lPAEk0!D@g*c~0kp<WBiaeG
zOsb|u)1ABy7H7<QcQ5FrlC#=f=4L@N<BFW(Bn5*ncnOczfo`q%K`J`JFh9hXSM#(x
zpl7Zbd&{O4iRiLlksfgv)fb3d|G_<2sNgA%1=t$-288}f<)NN{a0$E_wFM9*#A;}M
zT;7Iq6(?yZHLAYnA$%hjym(X<1E@91mL>DGHjz}M@GFLc)32hMDoBO7%Xiw*F+(t9
zFk~w-;|(LoExep@eWjW_$2S}q$aSqMw@Hzf5JVI6m&hZf&{!jP{NeVBvVsT0#0C75
zv|f^O32|tZ$nQIn>v=+@B$5b9jL3)XMQ2>()EDkt+R8~ph2GRxx@3!ahYZR}dV$Ku
z{IdKUWo8gUP~V6^A>~)EnR5`On27F@=m?IujMaf(=wV|4NFm5g71=7r$+aubdAi0O
z5fOMV2-EhlzwAr%2-VX6Re4n2A=;JpBVn!JS3uw-+L|GN<Wmm~vdWnrvw=;aXQTa^
zU34Qvck#QvLJG~*%!nirymSR$Ylx41&j3-{PT6E!ol7G6AljYci^SvxOphxB#i09D
z&=Q`+Af90oIIF6!stDCxp~ybO;M-R^m75U-#X}h!teN$-&3>MU=)${%&3qZg*tKhy
zd}EI~4{2*8ClQdv#a6kaA%_ZPHJOUQlnuV*249LiSrJ}TH||Wg9F1!a!piQ~LlA<&
zEfDS+F4f?agq#B=4JU>?f<+~TPsDR#{^^kK8qu2*FHWRD>nk!1Gr4GtysExHDt9@B
zQX<u^CokKY6(f^_G{}al!bS{V5P-Wx#z<3_iU7L-Ga+d(9PAKb!F{ugZtTH34xr2N
z=GgT2F4#lb28};4si7t2szdLvOV|<DcH%GN&kXM~&Y|~;M`M`d9=x~~+#wf%l{&-e
z@PBu9EiiUg$N8)mzX-vY5J-Xp8;3?!i?@D&O9-O&E^A{j_VwP~1&ZO?-nFp-KjO8G
z9T6ZRRH9NUgQ-f?R_j(OMXgk5S~YH?C{CreRui?PPgD|0Q#DOg(l%)uiMERSeKYf&
z|9J`Nm3Ghk^UrzDnKNh3obzWF*;^(ycUSdBHci~IzEkWasCf_L^hMz|zzHYPX5(S!
zs+3z`Om~baJ-mT1?9o2OWaJkLn{LfIo5W<x#G<;gS&IHH&D7L(lW)Or*9<I(nZcHX
z>|PF2TR)dwz{oQwny+JA@0!2?jFHKSG26faBR|Z2D<p&Y+m?KoYp^cMMnHG|%UflZ
zhwDvrhomF+DhwycXbd{IWnnMR&vsIO;nLH*Aa>(SrSV8*n(|>*LAjloj?T`8ROkI%
zYcU$#U}m+a9sv1=0TGJQ8j8m(@>%=rmVoO|dSE#)3EQM}+7*17XLC-IGrX>(BzZ#@
zrme_5?I1-_vHdvUixvA;=@79FV+uBU-4)F?A|!9HWdd=^bHBc<iUF4A<X{7c3ut-R
ztdP^Q=%5d{Pd_!TJrvWNap-<iK9T6%!BJoBHSl+F5=83($QhZ%*jPL~N$Z@8Slh~C
zbNS5x#$LX4!tEZfAe9#1x3WD+pW?8WOr`xmY-ne5Ro|r&SH}nJ7;`LUI5a9d5u89U
z>`@1<5ova@EkG6-jxBi;%Ethg*K0Kgn(71LL=HEVEANQdXnk0IEAsxL!l~x55gHpu
zX5zF37;LUKmTFcdwiMS(vAD|XrRo68r+`p&6o*ye#yzEFcItEex>mJfAa5P*c5q6k
z+rg@_wu)pK%q$S?XzFCROkm={9#j~9Valv-$~<`R0Ez=o8woiRpgZBQLG>!U-s0RW
zW-zm0U<8n<oITtS=+<}YAyy1`gUY4C?1f7!vaBzbR?;0^CfG#KeCZQGo@X%TL*1*O
zL`5lvk$wVG4Tn3g>!9N{WiiL7uN(8&Go39A6;zrZ!VaHJ+p^2VA;4g*GCNV^z<teD
zY;m9mT@HzCIu`7r$8m{;&4-K(^TU4VMz}15p1PP*C~Z(IYWwgrqjN#gKrV|}=AQZ1
z<`tHCdPBj`T4ro~qPKqXE}W(`JFCk`EMBmoU2!$`DLL<`XsW`PDl4y)mC&sH6epWZ
zle1PBrEU@m(qsBqc2F=QJmjjj<xEf)u2&E{30_gS76O&`MW77(T;^Hx%+T8lejuYG
zu{W_PpB^mP$S{hI;6nfyE7+da>{HPWvW+}z2>Y>uJMKdmnk6}yb#!}Vb|^rSHaxlI
z4WCuF$kYW5>ahld=5&oTOlynfsXM2+i9H`%Fdor{tWQGOTQ^TavxhLQP;t3)_0R%l
zaMQF^7o(62T%X(Eg2A26%kJK##i{8B^qZncv71R&t;N`|I{CE~rd{>Xs<3m)ZKliw
z(Eq?JvfDT-m~{2+Y)ENi{DTkXs-YENmB%3v>uS<U$b{ZR)e34Fu7se!+94aDW_g%~
z>Ct+JS0}(<2WPr;27#+ooQ}qh0Y=XLnd?oLsdtduMK~Fn=+b%atT>~kG0o_#(DcDW
zChGDu3%*D19^=dtsvkv&70=eGrfwWMNcRX+v|v8u#FvF)Y(~RXhH5((1XU}qYowvL
znQMI2>&BEcp7pS^znJOVKwFtP$WuL<vvF?29aN?da1h0mr&WqA0gO?6&fLjClzh(R
z;OD(Mn)a;DaR3Es<*K!|1g5hAu2jNO)tAr(6BNAB*nE<N@s6-OF^A&BMQDU>KZq-Y
z%3?*g3gtUzuv@wF`k2<BdE2_z72Cqb8~a#g>CBaCv|HB0e4NtvKa>ORL=?*t^$Pk_
zQZXjCEI2tQ8ke&&7?)UsMRR}^B=peRNVICo>S0)v*Dh7*gxj4=-GtCC-#B3_jXeHb
z`q=>!IfvqQo?;)so7$&Zh+MyL$&N~fgs4{EI$wUR+zSlztuI_8`IRY03kJj5RnZf6
z!<XN41p6$u+heCTA8zsU{46}ZeGu1=)ZjLQa5RBo#k48w3QmN$XDQBLLSi|?+dfwe
z9jc1c=8s|rB5m0mdx=?>6C?Lv+TdaozSl>%XPdo%e1lJ;k@CTf7hFNb2|#M;Hqvc?
z(P*S4D~M)n0Usx3O{&qd8kQ}J0OM=;_CudK9L&SHF3fHabv)6HMCrk4r(n29#tdfF
z>EMj~#QMS<Z~GkJN*iZ>0-V=@)VyYc4Y`MbvRWLToy(H|uW+KJF2OlRvwPx3Qi3Xi
zy92p`#O-KVUG0uf;Lz##)(LpU!mF5|U3XZ>dhfWBIg&>=v><}|6-S-TzzGu$?VD!6
z$GV)ib5P|$Nwahge*_qN6V~N<`kUA^dOL0ofa1)4<Wje(eIpra7f24n&+a3^kxxj#
zqx)@_KHr`LQ5LOj&IuBZd2AI*C;eT>>5x@qfRbp!{Krv%c?gCDm_UxhUDK~%dH|Km
zNma;zx9L}+!So?;GVjDX5!=nPW`Tx?fhaNeNX&{@9@seKYLn&QR=JKa#io@_Em%Kb
ziw<+#gAmnrgGF&)5$ARs5`(>j+-<T-^{%a|-QRQ;Ot@*L*b#v()wLgYRc8f#B%23v
z!IPZJ(PA;>+7L$TROW2o&y}gt=1K^o)jh0X{nk94@AM`wM6#`geBXdWx?oac1>4yh
z+cGhJH+VSiNy3)6mpV+^nXOBet8`W|ouLxYL+G^4qw6Ive|aT$Cr4;}r=$qSWelAY
zFoogjrdeK;i4<a|t!l9Y7r}55hdQcLqjwJ4+QlzcYSYo|v~AFk8!~Gb_vP{)Fc{yD
zeL=e6a1r<tasr&hojnWyQ(-0MOa*XbqSf4#J{fGF;`p%vwu9+mK66^j%Q69td}Q;c
zEp~L%EdfyUeIhi0hq9aN3YA|DJWYyZ_gH*;r<ln|juh-oXrtLX*ks`3#D*JU|A2#f
z=YCFjJbh>8dsH+;?9K-uV(r$KvLUB%S4_=23w)2+R{vz?IEoh26ES9!qEtseHe^j{
zhOV9HwP~8mIX_B=b8oP&Q6nw9QFfst!;fP>`jhNRk))$vVVBZ@0#0MDt;K*v$KnLR
zzFk<rxIi)!e2H`0v9Ti)%}M16f|4s#+&Kyhgf}Tv;k=HPd?4HLW`>?gA+&}aeO6qk
ziI}teECsI%Ob58rgVqf{c`!5A=(Z2-yydqb(YQ#?*u$esP<3{JRj>xzxd*4fP17tc
zMKeAnsR>~e08400%xE@@@0fng_E#A6N|HKDb9WTrejJ7<JsPDTu(!Fr<B<rt1kWu&
zW437~n5Rm9&DPcEEx5$EEidMHNtxmhIhXt}D8(u>1`S;dN+(`u2H>s7)?Db1*!ncR
zLMi(Fj+At`?+%(cx`jq$-k9b3Dzx0vaZ)?jT3;v{KUqG0&=Fa2Hl(>dtZjuv3~kHQ
zq8R>RfWutp#tw8Ns&Bh2^&@ebHqo3m%R?GcrW`$#jc=i4W-FQ9_rYB*+opg##Rmr2
zJLoccl3>5gW_KhAalmoGmjHX1b8tK_sK6OKkcL1cegQakI`&UvareXDh=wdM5e(xR
zRedCieL0)9Y`m*?>jX5U4UmVt(Q3n{jlIsT>$_t`8|JSVnCTwhNa%2FK8|)cd|;IO
z0y&Y+)-DV<qoX*$6^T?fhi>)#9#$F4FSNmJcY=KL#@<+W4L&QVr*V5Cl}Y2Ay~H=&
zkW~#g6D#IemzP23n6{y7I){zDBSk?gWmH;lO5+wlOOdzG)RvR29H<U%8nG`q<|>SJ
zuV1y=QnK$nVnpIIk#v60mmgy#jTyyvtyF_?i-<NJHRWk)=R>1=4|j0fin&`YIJ$kG
zbq2H1!_&6S!!K7rg5CfB;0)i20cVgOyajT9j*s05*PgNHONi0i@D+*33f<=o5mT`V
zr`*_f2hzS7@9}E$<u>q~A+Ftk9No%k1m3W@hi6MH%l?68Q24;*KB*;YJ1M@a=O=`?
z(ZQugg?DUS#OiQ@z}_(yc2Eg(CvMq_;~16$v*ijSTAX*I)mo}MHV!*F%-Q7z%k606
zqWTWm<}NPSf|=y1WK)_I9__>dhZFR;8FHrNa#-#K)UeqkFcb0UCMRr@r*h14MTGQ+
zD8FD=XV!Tu*ZZy;yyq)H`)X=w;EvmX%O%EjEKrwbatq#SBiRhl5b!n%DA01dK;Gao
zG2F6c0!L$DVr=}5QW6|V*v#QVM$Q?=gSpe}30Fi@6sb2k7R-u`#q$2?Jw=wC@v+L_
zr}XEN6<Vh2bj4AJ;2&$zJnAqAvG&Z3>}JaS@DSS<`>j|N!h%p{l{y1+rD%FGQ}Imv
zzMInQZ|v31>Q(Wh^SFLrBIOrTb!QawF3F9Jb%kB@FVP&U_t>*2s+4=v39^<`@SnAE
za9RuvZX@I4lsq%CHx_8dYaC)ORiHwas$G@r(Y-mVT;>=!>u;&gNiN!r9a$Rma7h~a
z*o;IAk(4`4UfOwO5i<*H7?3dNJcuC5+I{!ySbmOLZG6n)FbI^!9C=dHNlS~Wg5@Zl
zVrg#Lyj3$WwVG-<OcIoYs_n6s#tNrDt|G98!Us`WF8z0zOFbC(c=MwWtXUwjlY>!O
zAY7Y_m)4Q?#XbI88qh$R6nINUbp>w7sBHqf8PyfIE2Fjvd@!TB0zZ~f+XOz5QC)%0
zWYo5R8iC3?kR}9<<ycb!Ro)BIe+*2_>1k&{C{RUqLOq=*2nDLtPN=7+3qpaagA>O4
z9Pne;{HcuxQdgx@g90URhtVc{lymlP)0|4DHU*);<3Tu>W>?OsaB5Z12|QWQ{p4K0
zIXE5Aw;}|02pq-7a`<DVCg=2YTVO#baBGFoBNhKo2dHGxi2{|TH=CZ6EC>abbC~E`
zhrfuN2GTZxuLWu_eRN<>56XzyZfmL7wzh1yHM0F;r2VCwZC4fhp8_TDl4vCK)?;&e
zxF$DdSA|mE=)g!M2g*>DTbw?cR$q46l~*mB6G~OYtAThWlrp%GwT^efDbrGlLaFJ?
z(Q=6bPz$K~^U}&W!RLc!VLC=WTGnVrB{mcQ7)#)jfpQLvhejZ3@Qc7lf@mP!C-AXA
zIj`wSIe;+UH-e$SfU5*Pno&K0O3-;qPet;*h?0YM1vHY=n%WrP{sI+H4z3DF!+jv#
z+sy0UOdfz@4aGD2NAT@|1HTE}S|SsCPbTXKJepD6W*HjHD=G9`jx{Op*8_DyI{Nq{
zb9(xxjHURAha4z5QKRz({#_8EMgqTDN^4?HPs*WXs5O({rsQAE$xjJXg5LRhDw3bd
z#SY+w2>&{#)lsZ}EKmV8g81e#K1?_%a5#wGdZdK3N%PahsYRz2=@DPWw%-Dxx1Cy~
zXC*#Abx9syC`{L8a-gS9;S*QYpXincdLVVG1SyF`NwxHVNLJ)j8m+i8UfqyMCIvp2
zQQHMR6sYzlQd;YCMBKjQzdac>C9s@Ub3W3L*4RM<2;801>Izg^EzP8M(}13zPA%%3
zTC_6~Q3}yNdQ^h*6KI>=qeMlHwil?FZ&4Jrz(9JNjiKyRhnBQ88!iuq1YZl>kx^3u
zcLu7xA6LZN@f@)uu$NI?fl8~TP=|v0sT^xk;O_>iy#zlWZ=cT*JHHv=X9`qwVGbUP
zS5HQGA?Ef4YpywZ!-54GN166)(A+)GQD`rLFANIR75JGzd1>|Zt1)a_M&9qt_cT5m
zAsR>E?F*EAV=#U&3iDzv!F|oV?(^uy{{=yPVUE=i_#+v$UD^IY&VKuw0p7e&CE7k4
z;O1Pl?b`w@YP-G2+oAg-q1l{vM`<t4X^V+-<O}1~bp?sQ8#3xHmFS6#Y9#bG@#?Du
ziNGs!J*JKY__2)Y2rR1B=n^IH{vwvZqK&51Mw11VKxK=;o@*Y!Q&HYe73CJFDz(J=
zxuE`qBGwlI{PO};&+GbNEirkC-=E4%(iOKARqLv1MH@BLl7Ec^{xc`k5qOn-wjQ5c
zO;cjL*D{kd8szpU<ljd~9ZPV*%2O((5+|A9<vGKSz&kQ(>X88FB4o_wz-SbeWMb%I
zuuO?H)sHQm^@XU(s}Z&c$(N%nuY{-=Oi!PERJkY%L)QEBpCjgfWg)Y@9&aEu2J3et
z)|(N=6sO1U2YNwz7&GOmMS7kWnJhFsW<?>?ev9qJ(`Oz%wWwZ-(yMwM1|!)^a~&GP
z`@Qk%!v%@JZbsd!JUhi05U56kqF>K`buI1rsmDqy{m0|=0-~X&>G_Gk2YD~@+!JBw
z7<$|vXiEhxr)QN*sn-j4Pvmkqm*QU2UG%J$UzC7<`Wza*o`Tv(lr1grxk&tt2nW)*
zz<DuJjrsKOfjoSB0)H$}3({lhk+ghH&ucR2q`;5VNb3b|&YRnQFv&!nM0HZN=cSt(
zi=R5pg7n?b?GB}&oSx|ZEZXOybT};<x@OVPhmN7D!hWTAd!%?PtQr)fU!aP%l%xIG
z3vOCg#46`bSb3-i22!sdNl6m)BYCYTX{jE<s(6?l1gfM<yrlihxj6b(5n5!ANQN?J
zObApgFx#0&>xEamcSpR7z-dK6gjG@~yg;Q|jZjZsEi3AIX-$J)>NMb&FSqfF=v3rt
z&KX-&<l{v}E()wl4}KA-q9M6bgnC6ZB1PRY-s>c2?{kgz7LkVS5+B(`N%i8!+>w(4
zm3Jdfy|5CG5`!&#EfPsgSSb3XQjl~676~^rjggwBaVAukPRxFfM|e8Ivr*62BdnJ~
zbQ|LRx)Av)LY@Bk7=<rID7kkgp6m3ILVpzRr7XM}&;JnNH~Yj_ymRqh<Gmj5+kN7H
zC-4$5{~gcgBh(OlPt<=|gkq$6ed_5f3HnPTtfy0tuXH~Y^qO*3#IyKQ^G!YeWc1JW
z2*qgq`YR3Nqi%4WL3re_hkFI#vZ~#~`1sE7uA?~lw*see?8%%ehG$M3K+I$zwv_FS
z{OrmPJ-p+`JxCbPAzZ&PY`!PM_8p^PI+o$xLGvsc-VN_Xb7JL{ocYOP_^xEK7=j;|
z1{tF=AEaVs!Y#|wC=}cP?Nu7y1-G_g?wr#jY}mg$f=>*==?Zv%G-p-4+Jz(7$Ml9<
zz=F{_0<rxkFjA^_N9}nK>xFYIbMauBm;SvKKbY={5nWDd5c@6~xmEo9^uLSC7>5Vb
zg0utQu&@6H)57#pD}GVxyt7W7(jY!?KXgeO{=&4b75|R3^3pc?i_(#++VJm8kGJA4
zPHzmg(Jx7z547PgNvE%EMi|6K=L@a)OVdlO_;;l<t@z8**;f3!)7jy+d@oOFWgGsA
zbaHhY{ynMfH<;erhDN`<uMhspKKNyQ@bB+~Z|M|J4yLOc^km};(s$0+Ut9#lKx(!#
zYcwx4`Gi($;&;^eXMNyL*YI~*`bB$cIPEcfv)?}z>AYS`=hH^t<exLZx7F*lKKKhz
zfHwN8``~W`p7nh>jN1#N0`~;|b+8bBS~q+=@awK{{4E}&X9IsS@L!La<F|kxNSCMA
zgAdmQ{g(niv}(vO9X#{*4TNpw=j%57V#uk1v?RUsL5rUMU19iUzmuRX9oh;9Qghs`
zG<<X1ec14qH^$MJ;hW>}9^fxUJ8Pd|GD`Xg@IwKYgXe&65pC(kNas-OgghCMzG(E#
z@|-jJa>@?>WuNrFW%Nxs`EPyF8HA?SR?els*I3*#UeSmC#y<E>eek_L=|5=rccini
znfYQ={RHq!!H1HE=K}u>@IwKYgI|esPR6*nDPDfo@MTJe|1{`_BHw3%<ZHk$O;@Dn
zLf*=zKqFsUyDfr-+}3XI1HO&^C;H%T?t|Z9=|jFny|hbrtPlMs41YyBU7Ig{#?ooF
z!?VD%oeu@Q%KU4QPJQ0_?Vx|WM*n%EZ>Im{KKNJq;Qs~qp=L7ad>=fmV=8kw+O@#9
z^~=q`FE0}Y{L@C?)LVA+N$0UXc=#+H!S!H!_Q1)i*Sl?WytkPj6z#!v9A~uo*&}#B
z<FlkVXakk91qC1QgT4D7!nuNndNVj04HvtkytUFlo;fqTcFlFy(NVlf1i$tJ`@#p1
zS0&)XaHb&p1!28Vm+c7-uee>v-36UAySimRKzwY7XI<fm28A8PmfKj>hi|Vrck>_w
zua|dc^JZGmhWov8N3(EAtEOG^L~JHocOYz1*!rP~mQQ)}P58a>SVr?@cByT?ig+Hd
zsd~K)xUY4rHwFj$Ua*4TnOS{aIQ4G18^<Cxje=t0j!{u>+`M&U{pQ}*4I8>RJZPsW
zdpy?l*5AAD;VK}UAP`d_J#yKE9U^3j&5@j`*!Mqi){95Q>Yp<1?Y8w5J!-?bwh|RR
z$x~uDq+rW2Ji@hi-MWpNH;s(;Ru8Wp#!+@;#d8q2WFCI0I1FKT_)PD`y@2qbE@-dw
z7M7PaqanHSceacjD$bQ<N8i1?BLiQ6a36d|ud$E&iQ*eU_;!$=8A4B3Z5qci{DehO
zwpG{R9*sD^QOzSdy6~E`OdGzXJcLvvr)DwQvJ)#yQ}PAQmFVkWObYfv_23AxaaIHe
zRcEq4w0XB%m8011&xwyv;LNw5gksd-S|cp^5L>F@BTl&H4c)u#SZ_RJ+9(dT(S_Dn
z@U0mzr&2AY`QZ0@)5md75PFo?DOcOiWER-TzNv$b$9*S|rC3}SWNY&4UG*0&BL9a%
zafL)<3Dhe4X??Enn!qc-bXECr-u~YC^9L1Q>v)BGgBogv{iJuqW1?3Iw9%Zu*82+g
zMurTShvI96xDGg`t^8#dQ1}sL3>yBZzn6cv;^BO${IVY?yf28AjPg-P{rUT)__8x7
z>_mK)pLwhNflf03R5#*ek5G6zGE)AEulgT|_#=#rpX?S2UoOR`siPkMIB+aiER(W*
zV<?o5`pTMRE&pcmP>#PY;wcm#D2{X*g^$+a%U+^zgbU}=Pw|BMB!F`Mva2Ypn}h1*
z|JjJYIuexqMd3bmbi7ylF;D)eUlSJD8$)=&PvML|=KuBlPvcEFzU(;)XOwWHp!}8K
zZveO$f8r0>eNJEN6m|Og^Y4LdNh!YULod9|_<xAFEWh%X9qFaF8UIge@nvs1^ETuE
z72=b3mA~v#XCuBkM(wWpi;uom%U|}Zv#}sqr;Y|4e~Pd0>%f)kuXSBoY2@i-t^bA`
zo&SFm5YtlmwJtds45@M|g7Ve#w*fH!$WCb30~}nDF%GCY3cm-m;4<mwBmV1UWDD(l
zL~e`!%WFL1vOliAtv+Fm)+he&zv+}K$lRr0JwEM8bsWjRvCtd-N5c-JB<i$39`Wn#
zck$I8|EG2-riY5JaBak|Ql)gqCp`XFen9@~`^3NM(;lC8pYl)n3bz!1ct<#fTYk|a
v%12%A>hbwp%fd)c|B_>02?4qsSlS-Mf0}>zx-I|X&wKpmu%0ac>iPd4&Paf_

literal 0
HcmV?d00001

diff --git a/resources/test-jwt-nginx.conf b/resources/test-jwt-nginx.conf
index 4bd5847..c0acdf2 100644
--- a/resources/test-jwt-nginx.conf
+++ b/resources/test-jwt-nginx.conf
@@ -10,12 +10,20 @@ server {
     location ~ ^/secure-no-redirect/ {
         auth_jwt_enabled   on;
         auth_jwt_redirect  off;
-        alias  /usr/share/nginx/secure/;
+        root  /usr/share/nginx;
+        index  index.html index.htm;
     }
 
     location ~ ^/secure/ {
         auth_jwt_enabled   on;
-        root   /usr/share/nginx;
+        auth_jwt_validation_type COOKIE=rampartjwt;
+        root  /usr/share/nginx;
+        index  index.html index.htm;
+    }
+
+    location ~ ^/secure-auth-header/ {
+        auth_jwt_enabled on;
+        root  /usr/share/nginx;
         index  index.html index.htm;
     }
 
diff --git a/src/ngx_http_auth_jwt_binary_converters.c b/src/ngx_http_auth_jwt_binary_converters.c
new file mode 100644
index 0000000..8aea970
--- /dev/null
+++ b/src/ngx_http_auth_jwt_binary_converters.c
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2018 Tesla Government
+ *
+ * This software may be modified and distributed under the terms
+ * of the MIT license.  See the LICENSE file for details.
+ *
+ * https://github.com/TeslaGov/ngx-http-auth-jwt-module
+ */
+
+#include "ngx_http_auth_jwt_binary_converters.h"
+
+#include <ngx_core.h>
+
+int hex_char_to_binary( char ch, char* ret )
+{
+	ch = tolower( ch );
+	if( isdigit( ch ) )
+		*ret = ch - '0';
+	else if( ch >= 'a' && ch <= 'f' )
+		*ret = ( ch - 'a' ) + 10;
+	else if( ch >= 'A' && ch <= 'F' )
+		*ret = ( ch - 'A' ) + 10;
+	else
+		return *ret = 0;
+	return 1;
+}
+
+int hex_to_binary( const char* str, u_char* buf, int len ) 
+{
+	u_char	
+		*cpy = buf;
+	char
+		low,
+		high;
+	int
+		odd = len % 2;
+	
+	if (odd) {
+		return -1;
+	}
+
+	for (int i = 0; i < len; i += 2) {
+		hex_char_to_binary( *(str + i), &high );
+		hex_char_to_binary( *(str + i + 1 ), &low );
+		
+		*cpy++ = low | (high << 4);
+	}
+	return 0;
+}
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_binary_converters.h b/src/ngx_http_auth_jwt_binary_converters.h
new file mode 100644
index 0000000..6709ab1
--- /dev/null
+++ b/src/ngx_http_auth_jwt_binary_converters.h
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) 2018 Tesla Government
+ *
+ * This software may be modified and distributed under the terms
+ * of the MIT license.  See the LICENSE file for details.
+ *
+ * https://github.com/TeslaGov/ngx-http-auth-jwt-module
+ */
+
+#ifndef _NGX_HTTP_AUTH_JWT_BINARY_CONVERTERS_H
+#define _NGX_HTTP_AUTH_JWT_BINARY_CONVERTERS_H
+
+#include <ngx_core.h>
+
+int hex_char_to_binary( char ch, char* ret );
+int hex_to_binary( const char* str, u_char* buf, int len );
+
+#endif /* _NGX_HTTP_AUTH_JWT_BINARY_CONVERTERS_H */
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_header_processing.c b/src/ngx_http_auth_jwt_header_processing.c
new file mode 100644
index 0000000..e368c84
--- /dev/null
+++ b/src/ngx_http_auth_jwt_header_processing.c
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2018 Tesla Government
+ *
+ * This software may be modified and distributed under the terms
+ * of the MIT license.  See the LICENSE file for details.
+ *
+ * https://github.com/TeslaGov/ngx-http-auth-jwt-module
+ */
+
+#include <ngx_core.h>
+#include <ngx_http.h>
+
+#include "ngx_http_auth_jwt_header_processing.h"
+
+/**
+ * Sample code from nginx.
+ * https://www.nginx.com/resources/wiki/start/topics/examples/headers_management/?highlight=http%20settings
+ */
+ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len)
+{
+	ngx_list_part_t            *part;
+	ngx_table_elt_t            *h;
+	ngx_uint_t                  i;
+
+	// Get the first part of the list. There is usual only one part.
+	part = &r->headers_in.headers.part;
+	h = part->elts;
+
+	// Headers list array may consist of more than one part, so loop through all of it
+	for (i = 0; /* void */ ; i++)
+	{
+		if (i >= part->nelts)
+		{
+			if (part->next == NULL)
+			{
+				/* The last part, search is done. */
+				break;
+			}
+
+			part = part->next;
+			h = part->elts;
+			i = 0;
+		}
+
+		//Just compare the lengths and then the names case insensitively.
+		if (len != h[i].key.len || ngx_strcasecmp(name, h[i].key.data) != 0)
+		{
+			/* This header doesn't match. */
+			continue;
+		}
+
+		/*
+		* Ta-da, we got one!
+		* Note, we've stopped the search at the first matched header
+		* while more then one header may match.
+		*/
+		return &h[i];
+	}
+
+	/* No headers was found */
+	return NULL;
+}
+
+/**
+ * Sample code from nginx
+ * https://www.nginx.com/resources/wiki/start/topics/examples/headers_management/#how-can-i-set-a-header
+ */
+ngx_int_t set_custom_header_in_headers_out(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value) {
+    ngx_table_elt_t   *h;
+
+    /*
+    All we have to do is just to allocate the header...
+    */
+    h = ngx_list_push(&r->headers_out.headers);
+    if (h == NULL) {
+        return NGX_ERROR;
+    }
+
+    /*
+    ... setup the header key ...
+    */
+    h->key = *key;
+
+    /*
+    ... and the value.
+    */
+    h->value = *value;
+
+    /*
+    Mark the header as not deleted.
+    */
+    h->hash = 1;
+
+    return NGX_OK;
+}
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_header_processing.h b/src/ngx_http_auth_jwt_header_processing.h
new file mode 100644
index 0000000..0b64133
--- /dev/null
+++ b/src/ngx_http_auth_jwt_header_processing.h
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) 2018 Tesla Government
+ *
+ * This software may be modified and distributed under the terms
+ * of the MIT license.  See the LICENSE file for details.
+ */
+
+#ifndef _NGX_HTTP_AUTH_JWT_HEADER_PROCESSING_H
+#define _NGX_HTTP_AUTH_JWT_HEADER_PROCESSING_H
+
+ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len);
+ngx_int_t set_custom_header_in_headers_out(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value);
+
+#endif /* _NGX_HTTP_AUTH_JWT_HEADER_PROCESSING_H */
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index a548996..9819791 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -1,6 +1,10 @@
 /*
- * Tesla Government
- * @author joefitz
+ * Copyright (C) 2018 Tesla Government
+ *
+ * This software may be modified and distributed under the terms
+ * of the MIT license.  See the LICENSE file for details.
+ *
+ * https://github.com/TeslaGov/ngx-http-auth-jwt-module
  */
 
 #include <ngx_config.h>
@@ -10,22 +14,24 @@
 
 #include <jansson.h>
 
+#include "ngx_http_auth_jwt_header_processing.h"
+#include "ngx_http_auth_jwt_binary_converters.h"
+#include "ngx_http_auth_jwt_string.h"
+
 typedef struct {
-	ngx_str_t   auth_jwt_loginurl;
-	ngx_str_t   auth_jwt_key;
-	ngx_flag_t  auth_jwt_enabled;
-	ngx_flag_t  auth_jwt_redirect;
+	ngx_str_t    auth_jwt_loginurl;
+	ngx_str_t    auth_jwt_key;
+	ngx_flag_t   auth_jwt_enabled;
+	ngx_flag_t   auth_jwt_redirect;
+	ngx_str_t    auth_jwt_validation_type;
+
 } ngx_http_auth_jwt_loc_conf_t;
 
 static ngx_int_t ngx_http_auth_jwt_init(ngx_conf_t *cf);
 static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r);
 static void * ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf);
 static char * ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child);
-static int hex_char_to_binary( char ch, char* ret );
-static int hex_to_binary( const char* str, u_char* buf, int len );
-static char * ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str);
-static ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr);
-static ngx_int_t set_custom_header_in_headers_out(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value);
+static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type);
 
 static ngx_command_t ngx_http_auth_jwt_commands[] = {
 
@@ -57,6 +63,13 @@ static ngx_command_t ngx_http_auth_jwt_commands[] = {
 		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_redirect),
 		NULL },
 
+	{ ngx_string("auth_jwt_validation_type"),
+		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+		ngx_conf_set_str_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_validation_type),
+		NULL },
+
 	ngx_null_command
 };
 
@@ -94,12 +107,8 @@ ngx_module_t ngx_http_auth_jwt_module = {
 
 static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 {
-	ngx_str_t jwtCookieName = ngx_string("rampartjwt");
-	ngx_str_t passportKeyCookieName = ngx_string("PassportKey");
 	ngx_str_t useridHeaderName = ngx_string("x-userid");
 	ngx_str_t emailHeaderName = ngx_string("x-email");
-	ngx_int_t n;
-	ngx_str_t jwtCookieVal;
 	char* jwtCookieValChrPtr;
 	char* return_url;
 	ngx_http_auth_jwt_loc_conf_t *jwtcf;
@@ -121,30 +130,13 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		return NGX_DECLINED;
 	}
 	
-//	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Key: %s, Enabled: %d", 
-//			jwtcf->auth_jwt_key.data, 
-//			jwtcf->auth_jwt_enabled);
-	
-
-	// get the cookie
-	// TODO: the cookie name could be passed in dynamicallly
-	n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &jwtCookieName, &jwtCookieVal);
-	if (n == NGX_DECLINED) 
+	jwtCookieValChrPtr = getJwt(r, jwtcf->auth_jwt_validation_type);
+	if (jwtCookieValChrPtr == NULL)
 	{
-		// if we can't find the first cookie, check the legacy location
-		n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &passportKeyCookieName, &jwtCookieVal);
-		if (n == NGX_DECLINED)
-		{
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a jwt");
-			goto redirect;
-		}
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a jwt");
+		goto redirect;
 	}
 	
-	// the cookie data is not necessarily null terminated... we need a null terminated character pointer
-	jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, jwtCookieVal);
-
-//	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "rampartjwt: %s %d", jwtCookieValChrPtr, jwtCookieVal.len);
-	
 	// convert key from hex to binary
 	keyBinary = ngx_palloc(r->pool, jwtcf->auth_jwt_key.len / 2);
 	if (0 != hex_to_binary((char *)jwtcf->auth_jwt_key.data, keyBinary, jwtcf->auth_jwt_key.len))
@@ -161,8 +153,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		goto redirect;
 	}
 	
-//	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "parsed jwt:\n%s", jwt_dump_str(jwt, 1));
-	
 	// validate the algorithm
 	alg = jwt_get_alg(jwt);
 	if (alg != JWT_ALG_HS256)
@@ -281,14 +271,14 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			r->headers_out.location->value.data = jwtcf->auth_jwt_loginurl.data;
 		}
 
-        if (jwtcf->auth_jwt_redirect)
-        {
-    		return NGX_HTTP_MOVED_TEMPORARILY;
-        }
-        else
-        {
-    		return NGX_HTTP_UNAUTHORIZED;
-        }
+		if (jwtcf->auth_jwt_redirect)
+		{
+			return NGX_HTTP_MOVED_TEMPORARILY;
+		}
+		else
+		{
+			return NGX_HTTP_UNAUTHORIZED;
+		}
 }
 
 
@@ -340,116 +330,65 @@ ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 
 	ngx_conf_merge_str_value(conf->auth_jwt_loginurl, prev->auth_jwt_loginurl, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_key, prev->auth_jwt_key, "");
+	ngx_conf_merge_str_value(conf->auth_jwt_validation_type, prev->auth_jwt_validation_type, "");
 	
 	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1)) 
 	{
 		conf->auth_jwt_enabled = (prev->auth_jwt_enabled == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_enabled;
 	}
 
-    if (conf->auth_jwt_redirect == ((ngx_flag_t) -1))
-    {
+	if (conf->auth_jwt_redirect == ((ngx_flag_t) -1))
+	{
 		conf->auth_jwt_redirect = (prev->auth_jwt_redirect == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_redirect;
-    }
-	
-	ngx_conf_log_error(NGX_LOG_DEBUG, cf, 0, "Merged Location Configuration");
+	}
 
-//	ngx_conf_log_error(NGX_LOG_ERR, cf, 0, "Key: %s, Enabled: %d", 
-//			conf->auth_jwt_key.data, 
-//			conf->auth_jwt_enabled);
 	return NGX_CONF_OK;
 }
 
-static int
-hex_char_to_binary( char ch, char* ret )
+static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 {
-	ch = tolower( ch );
-	if( isdigit( ch ) )
-		*ret = ch - '0';
-	else if( ch >= 'a' && ch <= 'f' )
-		*ret = ( ch - 'a' ) + 10;
-	else if( ch >= 'A' && ch <= 'F' )
-		*ret = ( ch - 'A' ) + 10;
-	else
-		return *ret = 0;
-	return 1;
-}
+	static const ngx_str_t authorizationHeaderName = ngx_string("Authorization");
+	ngx_table_elt_t *authorizationHeader;
+	char* jwtCookieValChrPtr = NULL;
+	ngx_str_t jwtCookieVal;
+	ngx_int_t n;
+	ngx_str_t authorizationHeaderStr;
 
-static int
-hex_to_binary( const char* str, u_char* buf, int len ) 
-{
-	u_char	
-		*cpy = buf;
-	char
-		low,
-		high;
-	int
-		odd = len % 2;
-	
-	if (odd) {
-		return -1;
+	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "auth_jwt_validation_type.len %d", auth_jwt_validation_type.len);
+
+	if (auth_jwt_validation_type.len == 0 || (auth_jwt_validation_type.len == sizeof("AUTHORIZATION") - 1 && ngx_strncmp(auth_jwt_validation_type.data, "AUTHORIZATION", sizeof("AUTHORIZATION") - 1)==0))
+	{
+		// using authorization header
+		authorizationHeader = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
+		if (authorizationHeader != NULL)
+		{
+			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Found authorization header len %d", authorizationHeader->value.len);
+
+			authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
+			authorizationHeaderStr.len = authorizationHeader->value.len - (sizeof("Bearer ") - 1);
+
+			jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
+
+			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization header: %s", jwtCookieValChrPtr);
+		}
 	}
+	else if (auth_jwt_validation_type.len > sizeof("COOKIE=") && ngx_strncmp(auth_jwt_validation_type.data, "COOKIE=", sizeof("COOKIE=") - 1)==0)
+	{
+		auth_jwt_validation_type.data += sizeof("COOKIE=") - 1;
+		auth_jwt_validation_type.len -= sizeof("COOKIE=") - 1;
 
-	for (int i = 0; i < len; i += 2) {
-		hex_char_to_binary( *(str + i), &high );
-		hex_char_to_binary( *(str + i + 1 ), &low );
-		
-		*cpy++ = low | (high << 4);
+		// get the cookie
+		// TODO: the cookie name could be passed in dynamicallly
+		n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &auth_jwt_validation_type, &jwtCookieVal);
+		if (n != NGX_DECLINED) 
+		{
+			jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, jwtCookieVal);
+		}
 	}
-	return 0;
-}
 
-/** copies an nginx string structure to a newly allocated character pointer */
-static char* ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str)
-{
-	char* char_ptr = ngx_palloc(pool, str.len + 1);
-	ngx_memcpy(char_ptr, str.data, str.len);
-	*(char_ptr + str.len) = '\0';
-	return char_ptr;
+	return jwtCookieValChrPtr;
 }
 
-/** copies a character pointer string to an nginx string structure */
-static ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr)
-{
-	int len = strlen(char_ptr);
-
-	ngx_str_t str_t;
-	str_t.data = ngx_palloc(pool, len);
-	ngx_memcpy(str_t.data, char_ptr, len);
-	str_t.len = len;
-	return str_t;
-}
 
 
-/**
- * Sample code from nginx
- * https://www.nginx.com/resources/wiki/start/topics/examples/headers_management/#how-can-i-set-a-header
- */
-static ngx_int_t set_custom_header_in_headers_out(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value) {
-    ngx_table_elt_t   *h;
-
-    /*
-    All we have to do is just to allocate the header...
-    */
-    h = ngx_list_push(&r->headers_out.headers);
-    if (h == NULL) {
-        return NGX_ERROR;
-    }
-
-    /*
-    ... setup the header key ...
-    */
-    h->key = *key;
-
-    /*
-    ... and the value.
-    */
-    h->value = *value;
-
-    /*
-    Mark the header as not deleted.
-    */
-    h->hash = 1;
-
-    return NGX_OK;
-}
 
diff --git a/src/ngx_http_auth_jwt_string.c b/src/ngx_http_auth_jwt_string.c
new file mode 100644
index 0000000..186121f
--- /dev/null
+++ b/src/ngx_http_auth_jwt_string.c
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2018 Tesla Government
+ *
+ * This software may be modified and distributed under the terms
+ * of the MIT license.  See the LICENSE file for details.
+ *
+ * https://github.com/TeslaGov/ngx-http-auth-jwt-module
+ */
+#include <ngx_core.h>
+
+#include "ngx_http_auth_jwt_string.h"
+
+/** copies an nginx string structure to a newly allocated character pointer */
+char* ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str)
+{
+	char* char_ptr = ngx_palloc(pool, str.len + 1);
+	ngx_memcpy(char_ptr, str.data, str.len);
+	*(char_ptr + str.len) = '\0';
+	return char_ptr;
+}
+
+/** copies a character pointer string to an nginx string structure */
+ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr)
+{
+	int len = strlen(char_ptr);
+
+	ngx_str_t str_t;
+	str_t.data = ngx_palloc(pool, len);
+	ngx_memcpy(str_t.data, char_ptr, len);
+	str_t.len = len;
+	return str_t;
+}
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_string.h b/src/ngx_http_auth_jwt_string.h
new file mode 100644
index 0000000..594785b
--- /dev/null
+++ b/src/ngx_http_auth_jwt_string.h
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) 2018 Tesla Government
+ *
+ * This software may be modified and distributed under the terms
+ * of the MIT license.  See the LICENSE file for details.
+ *
+ * https://github.com/TeslaGov/ngx-http-auth-jwt-module
+ */
+
+#ifndef _NGX_HTTP_AUTH_JWT_STRING_H
+#define _NGX_HTTP_AUTH_JWT_STRING_H
+
+#include <ngx_core.h>
+
+char* ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str);
+ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr);
+
+#endif /* _NGX_HTTP_AUTH_JWT_STRING_H */
\ No newline at end of file

From 6e1f280420a79e96f052e8589def9a26e8dbc676 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 6 Feb 2018 18:05:28 -0500
Subject: [PATCH 028/130] Typo for test status

Typo for test status
---
 build.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sh b/build.sh
index 019e89a..0362e60 100755
--- a/build.sh
+++ b/build.sh
@@ -50,7 +50,7 @@ else
 fi
 
 TEST_SECURE_HEADER_EXPECT_302=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-auth-header/index.html -H 'cache-control: no-cache'`
-if [ "$TEST_SECURE_HEADER_EXPECT_302" -eq "200" ];then
+if [ "$TEST_SECURE_HEADER_EXPECT_302" -eq "302" ];then
   echo -e "${GREEN}Secure test without jwt auth header pass ${TEST_SECURE_HEADER_EXPECT_302}${NONE}";
 else
   echo -e "${RED}Secure test without jwt auth header fail ${TEST_SECURE_HEADER_EXPECT_302}${NONE}";

From 6aa585fac5197ea8b84bf1c1bf84bf6b0263419a Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 6 Feb 2018 18:12:18 -0500
Subject: [PATCH 029/130] Update README.md

---
 README.md | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 217f7cd..7e07429 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,18 @@ auth_jwt_loginurl "https://yourdomain.com/loginpage";
 auth_jwt_enabled on;
 ```
 
-So, a typical use would be to specify the key and loginurl on the main level and then only turn on the locations that you want to secure (not the login page).
+So, a typical use would be to specify the key and loginurl on the main level and then only turn on the locations that you want to secure (not the login page).  Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
+
+```
+auth_jwt_redirect            off;
+```
+If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
+
+```
+auth_jwt_validation_type AUTHORIZATION;
+auth_jwt_validation_type COOKIE=rampartjwt;
+```
+By default the authorization header is used to provide a JWT for validation.  However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
 
 The Dockerfile builds all of the dependencies as well as the module, downloads a binary version of nginx, and runs the module as a dynamic module.
 

From 8fcda49aea4f4cf9ad3ac6589fc82fdc012d357e Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 9 Apr 2018 20:52:35 -0400
Subject: [PATCH 030/130] only set headers for sub and email if they exist in
 the jet (#29)

---
 build.sh                       | 18 ++++++++++++++++++
 src/ngx_http_auth_jwt_module.c | 14 ++++++++++----
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/build.sh b/build.sh
index 0362e60..4abe819 100755
--- a/build.sh
+++ b/build.sh
@@ -20,6 +20,8 @@ MACHINE_IP=`docker-machine ip`
 docker cp ${CONTAINER_ID}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
 
 VALIDJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4
+MISSING_SUB_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
+MISSING_EMAIL_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
 
 TEST_INSECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000 -H 'cache-control: no-cache'`
 if [ "$TEST_INSECURE_EXPECT_200" -eq "200" ];then
@@ -62,3 +64,19 @@ if [ "$TEST_SECURE_NO_REDIRECT_EXPECT_401" -eq "401" ];then
 else
   echo -e "${RED}Secure test without jwt no redirect fail ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
 fi
+
+TEST_WITH_NO_SUB_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${MISSING_SUB_JWT}"`
+if [ "$TEST_WITH_NO_SUB_EXPECT_200" -eq "200" ];then
+  echo -e "${GREEN}Secure test with jwt cookie pass ${TEST_WITH_NO_SUB_EXPECT_200}${NONE}";
+else
+  echo -e "${RED}Secure test with jwt cookie fail ${TEST_WITH_NO_SUB_EXPECT_200}${NONE}";
+fi
+
+TEST_WITH_NO_EMAIL_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${MISSING_EMAIL_JWT}"`
+if [ "$TEST_WITH_NO_EMAIL_EXPECT_200" -eq "200" ];then
+  echo -e "${GREEN}Secure test with jwt cookie pass ${TEST_WITH_NO_EMAIL_EXPECT_200}${NONE}";
+else
+  echo -e "${RED}Secure test with jwt cookie fail ${TEST_WITH_NO_EMAIL_EXPECT_200}${NONE}";
+fi
+
+
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 9819791..d217cf5 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -176,16 +176,22 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain a subject");
 	}
-	sub_t = ngx_char_ptr_to_str_t(r->pool, (char *)sub);
-	set_custom_header_in_headers_out(r, &useridHeaderName, &sub_t);
+	else
+	{
+		sub_t = ngx_char_ptr_to_str_t(r->pool, (char *)sub);
+		set_custom_header_in_headers_out(r, &useridHeaderName, &sub_t);
+	}
 
 	email = jwt_get_grant(jwt, "emailAddress");
 	if (email == NULL)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain an email address");
 	}
-	email_t = ngx_char_ptr_to_str_t(r->pool, (char *)email);
-	set_custom_header_in_headers_out(r, &emailHeaderName, &email_t);
+	else
+	{
+		email_t = ngx_char_ptr_to_str_t(r->pool, (char *)email);
+		set_custom_header_in_headers_out(r, &emailHeaderName, &email_t);
+	}
 
 	return NGX_OK;
 	

From 2ab3fd32dddd93b6f4afb025273e1952ca0e5605 Mon Sep 17 00:00:00 2001
From: Tim Underhay <15734900+citizentim@users.noreply.github.com>
Date: Wed, 25 Apr 2018 16:16:27 -0600
Subject: [PATCH 031/130] RSA Key Validation Support (#30)

* First stab at RSA validation.

* Fix for build errors

* Another build fix

* Fix for key copy

* Key length fix

* Logging

* Logging fix

* Remove debug logs.
Make validation of email optional with auth_jwt_validate_email

* Fix for email validation option, now auth_jwt_email_validation

* Changed back to auth_jwt_validate_email and additional conf merging code

* One more email validation fix

* More fixes to email validate

* Another fix

* Set getJwt logs to NGX_LOG_DEBUG

* Updated README.
Rearranged some code.

* Added else error condition to avert compiler warning.
---
 README.md                      | 30 ++++++++++++++
 src/ngx_http_auth_jwt_module.c | 76 ++++++++++++++++++++++++++--------
 2 files changed, 89 insertions(+), 17 deletions(-)

diff --git a/README.md b/README.md
index 7e07429..7de9088 100644
--- a/README.md
+++ b/README.md
@@ -13,6 +13,8 @@ This module requires several new nginx.conf directives, which can be specified i
 auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
 auth_jwt_loginurl "https://yourdomain.com/loginpage";
 auth_jwt_enabled on;
+auth_jwt_algorithm HS256; # or RS256
+auth_jwt_validate_email on;  # or off
 ```
 
 So, a typical use would be to specify the key and loginurl on the main level and then only turn on the locations that you want to secure (not the login page).  Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
@@ -28,6 +30,34 @@ auth_jwt_validation_type COOKIE=rampartjwt;
 ```
 By default the authorization header is used to provide a JWT for validation.  However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
 
+
+
+The default algorithm is 'HS256', for symmetric key validation.  Also supported is 'RS256', for RSA 256-bit public key validation.
+
+If using "auth_jwt_algorithm RS256;", then the 'auth_jwt_key' field must be set to your public key.  That is the public key, rather than a PEM certificate.  I.e.:
+
+```
+auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0aPPpS7ufs0bGbW9+OFQ
+RvJwb58fhi2BuHMd7Ys6m8D1jHW/AhDYrYVZtUnA60lxwSJ/ZKreYOQMlNyZfdqA
+rhYyyUkedDn8e0WsDvH+ocY0cMcxCCN5jItCwhIbIkTO6WEGrDgWTY57UfWDqbMZ
+4lMn42f77OKFoxsOA6CVvpsvrprBPIRPa25H2bJHODHEtDr/H519Y681/eCyeQE/
+1ibKL2cMN49O7nRAAaUNoFcO89Uc+GKofcad1TTwtTIwmSMbCLVkzGeExBCrBTQo
+wO6AxLijfWV/JnVxNMUiobiKGc/PP6T5PI70Uv67Y4FzzWTuhqmREb3/BlcbPwtM
+oQIDAQAB
+-----END PUBLIC KEY-----";
+```
+
+
+
+By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the session, and will log an error if it isn't found.  To disable this behavior, for instance if you are using a different user identifier property such as 'sub', set:
+
+```
+auth_jwt_validate_email off;
+```
+
+
+
 The Dockerfile builds all of the dependencies as well as the module, downloads a binary version of nginx, and runs the module as a dynamic module.
 
 Have a look at build.sh, which creates the docker image and container and executes some test requests to illustrate that some pages are secured by the module and requre a valid JWT.
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index d217cf5..b64c12b 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -24,6 +24,8 @@ typedef struct {
 	ngx_flag_t   auth_jwt_enabled;
 	ngx_flag_t   auth_jwt_redirect;
 	ngx_str_t    auth_jwt_validation_type;
+	ngx_str_t    auth_jwt_algorithm;
+	ngx_flag_t   auth_jwt_validate_email;
 
 } ngx_http_auth_jwt_loc_conf_t;
 
@@ -70,6 +72,20 @@ static ngx_command_t ngx_http_auth_jwt_commands[] = {
 		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_validation_type),
 		NULL },
 
+	{ ngx_string("auth_jwt_algorithm"),
+		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+		ngx_conf_set_str_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_algorithm),
+		NULL },
+
+	{ ngx_string("auth_jwt_validate_email"),
+		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+		ngx_conf_set_flag_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_validate_email),
+		NULL },
+
 	ngx_null_command
 };
 
@@ -122,6 +138,8 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	ngx_str_t email_t;
 	time_t exp;
 	time_t now;
+	ngx_str_t auth_jwt_algorithm;
+	int keylen;
 	
 	jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
 	
@@ -137,16 +155,34 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		goto redirect;
 	}
 	
-	// convert key from hex to binary
-	keyBinary = ngx_palloc(r->pool, jwtcf->auth_jwt_key.len / 2);
-	if (0 != hex_to_binary((char *)jwtcf->auth_jwt_key.data, keyBinary, jwtcf->auth_jwt_key.len))
+	// convert key from hex to binary, if a symmetric key
+
+	auth_jwt_algorithm = jwtcf->auth_jwt_algorithm;
+	if (auth_jwt_algorithm.len == 0 || (auth_jwt_algorithm.len == sizeof("HS256") - 1 && ngx_strncmp(auth_jwt_algorithm.data, "HS256", sizeof("HS256") - 1)==0))
+	{
+		keylen = jwtcf->auth_jwt_key.len / 2;
+		keyBinary = ngx_palloc(r->pool, keylen);
+		if (0 != hex_to_binary((char *)jwtcf->auth_jwt_key.data, keyBinary, jwtcf->auth_jwt_key.len))
+		{
+			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to turn hex key into binary");
+			goto redirect;
+		}
+	}
+	else if ( auth_jwt_algorithm.len == sizeof("RS256") - 1 && ngx_strncmp(auth_jwt_algorithm.data, "RS256", sizeof("RS256") - 1) == 0 )
 	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to turn hex key into binary");
+		// in this case, 'Binary' is a misnomer, as it is the public key string itself
+		keyBinary = ngx_palloc(r->pool, jwtcf->auth_jwt_key.len);
+		ngx_memcpy(keyBinary, jwtcf->auth_jwt_key.data, jwtcf->auth_jwt_key.len);
+		keylen = jwtcf->auth_jwt_key.len;
+	}
+	else
+	{
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "unsupported algorithm");
 		goto redirect;
 	}
 	
 	// validate the jwt
-	jwtParseReturnCode = jwt_decode(&jwt, jwtCookieValChrPtr, keyBinary, jwtcf->auth_jwt_key.len / 2);
+	jwtParseReturnCode = jwt_decode(&jwt, jwtCookieValChrPtr, keyBinary, keylen);
 	if (jwtParseReturnCode != 0)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse jwt");
@@ -155,7 +191,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	
 	// validate the algorithm
 	alg = jwt_get_alg(jwt);
-	if (alg != JWT_ALG_HS256)
+	if (alg != JWT_ALG_HS256 && alg != JWT_ALG_RS256)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm in jwt %d", alg);
 		goto redirect;
@@ -182,15 +218,18 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		set_custom_header_in_headers_out(r, &useridHeaderName, &sub_t);
 	}
 
-	email = jwt_get_grant(jwt, "emailAddress");
-	if (email == NULL)
+	if (jwtcf->auth_jwt_validate_email == 1)
 	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain an email address");
-	}
-	else
-	{
-		email_t = ngx_char_ptr_to_str_t(r->pool, (char *)email);
-		set_custom_header_in_headers_out(r, &emailHeaderName, &email_t);
+		email = jwt_get_grant(jwt, "emailAddress");
+		if (email == NULL)
+		{
+			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain an email address");
+		}
+		else
+		{
+			email_t = ngx_char_ptr_to_str_t(r->pool, (char *)email);
+			set_custom_header_in_headers_out(r, &emailHeaderName, &email_t);
+		}
 	}
 
 	return NGX_OK;
@@ -321,6 +360,7 @@ ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf)
 	// set the flag to unset
 	conf->auth_jwt_enabled = (ngx_flag_t) -1;
 	conf->auth_jwt_redirect = (ngx_flag_t) -1;
+	conf->auth_jwt_validate_email = (ngx_flag_t) -1;
 
 	ngx_conf_log_error(NGX_LOG_DEBUG, cf, 0, "Created Location Configuration");
 	
@@ -337,6 +377,8 @@ ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 	ngx_conf_merge_str_value(conf->auth_jwt_loginurl, prev->auth_jwt_loginurl, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_key, prev->auth_jwt_key, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_validation_type, prev->auth_jwt_validation_type, "");
+	ngx_conf_merge_str_value(conf->auth_jwt_algorithm, prev->auth_jwt_algorithm, "HS256");
+	ngx_conf_merge_off_value(conf->auth_jwt_validate_email, prev->auth_jwt_validate_email, 1);
 	
 	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1)) 
 	{
@@ -360,7 +402,7 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 	ngx_int_t n;
 	ngx_str_t authorizationHeaderStr;
 
-	ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "auth_jwt_validation_type.len %d", auth_jwt_validation_type.len);
+	ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "auth_jwt_validation_type.len %d", auth_jwt_validation_type.len);
 
 	if (auth_jwt_validation_type.len == 0 || (auth_jwt_validation_type.len == sizeof("AUTHORIZATION") - 1 && ngx_strncmp(auth_jwt_validation_type.data, "AUTHORIZATION", sizeof("AUTHORIZATION") - 1)==0))
 	{
@@ -368,14 +410,14 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 		authorizationHeader = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
 		if (authorizationHeader != NULL)
 		{
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Found authorization header len %d", authorizationHeader->value.len);
+			ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Found authorization header len %d", authorizationHeader->value.len);
 
 			authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
 			authorizationHeaderStr.len = authorizationHeader->value.len - (sizeof("Bearer ") - 1);
 
 			jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
 
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "Authorization header: %s", jwtCookieValChrPtr);
+			ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtCookieValChrPtr);
 		}
 	}
 	else if (auth_jwt_validation_type.len > sizeof("COOKIE=") && ngx_strncmp(auth_jwt_validation_type.data, "COOKIE=", sizeof("COOKIE=") - 1)==0)

From 4aab233940df5faefb61ee22f96b12a86e132339 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Wed, 25 Apr 2018 18:17:22 -0400
Subject: [PATCH 032/130] Test for RSA Support

* test for rs256
---
 Dockerfile                     |  1 +
 build.sh                       |  8 ++++++++
 resources/rsa_key_2048-pub.pem |  9 +++++++++
 resources/rsa_key_2048.pem     | 28 ++++++++++++++++++++++++++++
 resources/test-jwt-nginx.conf  | 17 +++++++++++++++++
 5 files changed, 63 insertions(+)
 create mode 100755 resources/rsa_key_2048-pub.pem
 create mode 100755 resources/rsa_key_2048.pem

diff --git a/Dockerfile b/Dockerfile
index 4d61a23..963f559 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -99,6 +99,7 @@ RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
 COPY resources/nginx.conf /etc/nginx/nginx.conf
 COPY resources/test-jwt-nginx.conf /etc/nginx/conf.d/test-jwt-nginx.conf
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure
+RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-auth-header
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-no-redirect
 
diff --git a/build.sh b/build.sh
index 4abe819..0225715 100755
--- a/build.sh
+++ b/build.sh
@@ -22,6 +22,7 @@ docker cp ${CONTAINER_ID}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
 VALIDJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4
 MISSING_SUB_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
 MISSING_EMAIL_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
+VALID_RS256_JWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
 
 TEST_INSECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000 -H 'cache-control: no-cache'`
 if [ "$TEST_INSECURE_EXPECT_200" -eq "200" ];then
@@ -79,4 +80,11 @@ else
   echo -e "${RED}Secure test with jwt cookie fail ${TEST_WITH_NO_EMAIL_EXPECT_200}${NONE}";
 fi
 
+TEST_SECURE_RS256_COOKIE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-rs256/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${VALID_RS256_JWT}"`
+if [ "$TEST_SECURE_RS256_COOKIE_EXPECT_200" -eq "200" ];then
+  echo -e "${GREEN}Secure test with rs256 jwt cookie pass ${TEST_SECURE_RS256_COOKIE_EXPECT_200}${NONE}";
+else
+  echo -e "${RED}Secure test with rs256 jwt cookie fail ${TEST_SECURE_RS256_COOKIE_EXPECT_200}${NONE}";
+fi
+
 
diff --git a/resources/rsa_key_2048-pub.pem b/resources/rsa_key_2048-pub.pem
new file mode 100755
index 0000000..01f59bf
--- /dev/null
+++ b/resources/rsa_key_2048-pub.pem
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
+uqNuffp4+4aUCwuFE9B5s9MJr63gyf8jW0oDr7Mb1Xb8y9iGkWfhouZqNJbMFry+
+iBs+z2TtJF06vbHQZzajDsdux3XVfXv9v6dDIImyU24MsGNkpNt0GISaaiqv51NM
+ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
+6swiIasEU3qNLKaJAZEzfywroVYr3BwM1IiVbQeKgIkyPS/85M4Y6Ss/T+OWi1Oe
+K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
+BwIDAQAB
+-----END PUBLIC KEY-----
diff --git a/resources/rsa_key_2048.pem b/resources/rsa_key_2048.pem
new file mode 100755
index 0000000..0f58120
--- /dev/null
+++ b/resources/rsa_key_2048.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDC2kwAziXUf33m
+iqWp0yG6o259+nj7hpQLC4UT0Hmz0wmvreDJ/yNbSgOvsxvVdvzL2IaRZ+Gi5mo0
+lswWvL6IGz7PZO0kXTq9sdBnNqMOx27HddV9e/2/p0MgibJTbgywY2Sk23QYhJpq
+Kq/nU0xlBfSaI5ddZ2RC9ZNkVeGawUKYksTruhAVJqviHN8BoK6VowP5vcxyyOWH
+TK9KruDqzCIhqwRTeo0spokBkTN/LCuhVivcHAzUiJVtB4qAiTI9L/zkzhjpKz9P
+45aLU54rj011gG8U/6E1USh5nMnPkr+d3oLfkhfS3Zs3kJVdyFQWZpQxiTaI92Fd
+2wLvbS0HAgMBAAECggEAD8dTnkETSSjlzhRuI9loAtAXM3Zj86JLPLW7GgaoxEoT
+n7lJ2bGicFMHB2ROnbOb9vnas82gtOtJsGaBslmoaCckp/C5T1eJWTEb+i+vdpPp
+wZcmKZovyyRFSE4+NYlU17fEv6DRvuaGBpDcW7QgHJIl45F8QWEM+msee2KE+V4G
+z/9vAQ+sOlvsb4mJP1tJIBx9Lb5loVREwCRy2Ha9tnWdDNar8EYkOn8si4snPT+E
+3ZCy8mlcZyUkZeiS/HdtydxZfoiwrSRYamd1diQpPhWCeRteQ802a7ds0Y2YzgfF
+UaYjNuRQm7zA//hwbXS7ELPyNMU15N00bajlG0tUOQKBgQDnLy01l20OneW6A2cI
+DIDyYhy5O7uulsaEtJReUlcjEDMkin8b767q2VZHb//3ZH+ipnRYByUUyYUhdOs2
+DYRGGeAebnH8wpTT4FCYxUsIUpDfB7RwfdBONgaKewTJz/FPswy1Ye0b5H2c6vVi
+m2FZ33HQcoZ3wvFFqyGVnMzpOwKBgQDXxL95yoxUGKa8vMzcE3Cn01szh0dFq0sq
+cFpM+HWLVr84CItuG9H6L0KaStEEIOiJsxOVpcXfFFhsJvOGhMA4DQTwH4WuXmXp
+1PoVMDlV65PYqvhzwL4+QhvZO2bsrEunITXOmU7CI6kilnAN3LuP4HbqZgoX9lqP
+I31VYzLupQKBgGEYck9w0s/xxxtR9ILv5XRnepLdoJzaHHR991aKFKjYU/KD7JDK
+INfoAhGs23+HCQhCCtkx3wQVA0Ii/erM0II0ueluD5fODX3TV2ZibnoHW2sgrEsW
+vFcs36BnvIIaQMptc+f2QgSV+Z/fGsKYadG6Q+39O7au/HB7SHayzWkjAoGBAMgt
+Fzslp9TpXd9iBWjzfCOnGUiP65Z+GWkQ/SXFqD+SRir0+m43zzGdoNvGJ23+Hd6K
+TdQbDJ0uoe4MoQeepzoZEgi4JeykVUZ/uVfo+nh06yArVf8FxTm7WVzLGGzgV/uA
++wtl/cRtEyAsk1649yW/KHPEIP8kJdYAJeoO8xSlAoGAERMrkFR7KGYZG1eFNRdV
+mJMq+Ibxyw8ks/CbiI+n3yUyk1U8962ol2Q0T4qjBmb26L5rrhNQhneM4e8mo9FX
+LlQapYkPvkdrqW0Bp72A/UNAvcGTmN7z5OCJGMUutx2hmEAlrYmpLKS8pM/p9zpK
+tEOtzsP5GMDYVlEp1jYSjzQ=
+-----END PRIVATE KEY-----
diff --git a/resources/test-jwt-nginx.conf b/resources/test-jwt-nginx.conf
index c0acdf2..b39eb95 100644
--- a/resources/test-jwt-nginx.conf
+++ b/resources/test-jwt-nginx.conf
@@ -27,6 +27,23 @@ server {
         index  index.html index.htm;
     }
 
+    location ~ ^/secure-rs256/ {
+        auth_jwt_enabled on;
+        auth_jwt_validation_type COOKIE=rampartjwt;
+        auth_jwt_algorithm RS256;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
+uqNuffp4+4aUCwuFE9B5s9MJr63gyf8jW0oDr7Mb1Xb8y9iGkWfhouZqNJbMFry+
+iBs+z2TtJF06vbHQZzajDsdux3XVfXv9v6dDIImyU24MsGNkpNt0GISaaiqv51NM
+ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
+6swiIasEU3qNLKaJAZEzfywroVYr3BwM1IiVbQeKgIkyPS/85M4Y6Ss/T+OWi1Oe
+K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
+BwIDAQAB
+-----END PUBLIC KEY-----";
+        root  /usr/share/nginx;
+        index  index.html index.htm;
+    }
+
     location / {
         root   /usr/share/nginx/html;
         index  index.html index.htm;

From 7593b72696aabf81aadb9f180e791313273458e4 Mon Sep 17 00:00:00 2001
From: Tim Underhay <15734900+citizentim@users.noreply.github.com>
Date: Thu, 24 May 2018 12:46:24 -0600
Subject: [PATCH 033/130] build.sh fix for MacOS Docker. Removed memcpy op for
 RSA validation and use pointer instead

---
 build.sh                       |   4 +++-
 ngx_http_auth_jwt_module.so    | Bin 177360 -> 178096 bytes
 src/ngx_http_auth_jwt_module.c |   3 +--
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/build.sh b/build.sh
index 0225715..7e6bdc4 100755
--- a/build.sh
+++ b/build.sh
@@ -15,7 +15,9 @@ fi
 
 CONTAINER_ID=$(docker run --name "${DOCKER_IMAGE_NAME}-cont" -d -p 8000:8000 ${DOCKER_IMAGE_NAME})
 
-MACHINE_IP=`docker-machine ip`
+if ! MACHINE_IP=`docker-machine ip 2>/dev/null`; then
+  MACHINE_IP='0.0.0.0' # fix for MacOS
+fi
 
 docker cp ${CONTAINER_ID}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
 
diff --git a/ngx_http_auth_jwt_module.so b/ngx_http_auth_jwt_module.so
index 6125fcaeabe4ccf751860dbcaed1a637ff216ebe..8d9c0840a8d03e1e9ec6607771e610f99fd6653e 100755
GIT binary patch
delta 89688
zcmZ_130zdw`#*lqodJ$|fnl9HFu=ed3<@|X%P;~CDljMmsEBBqm>ce7SftfxYPlA5
zS}Zd)&1^Tdvc*!%vYpnC?Y4cwRx2yb%K!U0cPzi3-|Nrolk>cv^PK0L^K9qbd*{xl
z`*`nNKlbi&S$938D(C)uibsi1d`hO`ykSUs<?y~n!?{mIaYzQkzv1|ASFVKkbV%ad
zXCpP@ul0tl)|l>)P<KeE`-Yb$$6k?PNc{ULyzIjC|6heBL%dNu!O|+<yl?#^?~Gfl
zm5#5Tin?ol#i>8}5Nao(H2g>FiNJr$6pbqrP0`$JW~-(tW@^jCfBl3_9Vb?)Zs9hW
z#lZpbqFZfce~1Fp02U#(s#b9T{3dg}=rXyPM;tWOuoU9&ahNL@)5PR3>qx7j401r(
zzkhu&zD3a$%m45n#e8BEt8#3hLke3$U0w+BPl$tI2{uh>k2e}thT8ALXRM-$AH%F@
zb;KF$8$+!&IDuNz!mY{r|1%dFBUb69xW%aO1Y4xCi`IVL-&XX-oJ26(YS)ym1f!`e
zB(Yu2Ojr1zJ-fsIV!dWx)-ie7^r;J`i3hnSV&?RY$y4Ue6yI{ENb2>S;JrtS*4~Y5
zmw2SNHD_PQ%{-)QORPa0`5*of@l$WB>dp|o`&6@TF{+PMZMTZqee#3PIE)^x1qN|W
zQ+J5J;eYrahxpz9!~Y?~=OMeF)1#y-^3V4_e4D`!DxLq+kQ?f7&VlC?wPqNKjtnqH
zqNs;m|M}}akKg|vuA-a>=_lFq`A4NZB9|0tVxDHTksr_f^_-_p7n?MzxI@z-Po2lL
zi`US{e69mN+e0>?q0Hhh&027NYvXwnIiJ7tyk4rvi?kLXApZGVbzZOY`91j#DMP83
zCe}w<ZIo>1{!X3OY7+a=8g{M;pFFe*>KiV;M=Me1{`B)&xk!n!iti$|NY{DX-XZ|5
zJxYu8oX71eu8gwULiI-~^PkrmDIP?hI`nBdj~gXEMxW?&L*ujUyw(^I8EuUWg|w9E
z6kDOiAFT;3T4Sq3L9|tLMr)Cwl#((V#1wFMMr$@yjeq`jo~JiSycTV>CI8c=DErQ9
zO%Z>g|DVxXoPYUu+`l$#Q<_8ZuRPEZ*7G6TGsyBOv+YiCC^Ndw_I+7?`qzhbJ0P;Y
z{E!$N>*BW=;6^bgwq*Qx0A*3Oe|dQggq5-W)n9dJ5bd4hP<p1HJ$tsN4gXAfA<PXy
z_RDk8X+C8}estOjIXiSaYD2e<EX?C~yD^WXv2v(0v4gbN|2})xzgAgm-_Y~+9&cO$
zW0hiVd>cC@-i;pu`y?c+W<Q9{3B?7`EAECy|MJDU620P(L3%)bYLI@VqYaIXXFDqK
z;W*ooAx<RNgEOMjhNIWodPl(l|MJsk{n1qi{i}yMzI~bI34Y@~CKdeC)cEaAbPCOW
zZM7eUi(avuWY*UE(ADo>J;HZ<G1fez%fGgo%l7AtN$3!Yf(-Ys?j5~y_}R0;v*#vI
zt&<0Wn45<*Ss<lDlO=j(4pf~tpoip2AmWCI2O{p{5j2>wko93Np`Q3(9O|Qdpy?bx
z0Tceye|^|PM!Or$ia!Vy$6xxt0@oP=vR2S6j^Fuz+vm%6nW|{!$2-vck451Azn*D<
z>M=%a1@)fNKj6ZZ2mGs_>u~$mNAB)L^Yb|{=d=E%7kw^Cyy$DB&w{u7tABVF11JRt
zdeW)m^5<c!qZdp<+$;qf4yKT;@%Yy!Fx>%D;eWCIwPoG@WiK9st9qU~Ev8z>smmk8
z(^h+MJ`&%*dU&QE;niX#c?){G>ed!^`(He821C{^zsi9y8IHcSYpdP0Ynx%z;hC)v
z!^lmUZT_|GjsE2o5z*Jafkpe*QXBbv5_<TTpNfoLQDRU$`kHsmBtf0lm%A}^)Du*A
z{Hx#lWk>YNC(L5Ho)sK*ik5ZiO!SItrSy^(|JshscIwvIGn^V%ANH^OK6*tPnlT+8
zriCbbD|$tP9OsWPggQ}chrtqZZl>sK=a8=TPtj?mC+&AAA&W0>2aH~EJ+&==ss$$s
z)o)%O*(*Y%+N|t%QEV$#*My1rwv6GgBVL|}{CBcX!>j)FMTfzD(qMnu<M}P5_i*%z
zxlnfA3}Bu6OrqOn4aU&mSi!%ui-^AFDXA^;5@@Sk-Ba+^ITsf~I22z?F*cTaDf|PA
zy!k`r>R<g+f9rV*W7e*{O0QhojGTC(cJ=c;1HeKKOh0c3Q}i|08AAjQVY|ZsSTe=X
zJCKzTdM<p{mp_80CyeZP;g=m9>*1<cTKqq(=#>S~6<9k%uUb3b;$MG7rfc}><8`Y)
zM{M>C`jrNcUeQO!!g(IJCQ44=qR7vo|KABT(F9KZMJXs(SSRCWedIeB?q56PlT<9E
z{z)X%+%x317l&uI_rY4~*7rS2CSPCvrC6Jk$=(;clG0)yJV{=n=vjTpzxvaj{U^m|
zNr@~>oJvX?7>22mF$3#!Yw9rdzQ9i)aFn{$e_$#8)h|+@>pdSsN!{wNd%{kN+T@)0
z4*=l@Ub{9?iX84~IVrA59;7-?il>qXsz3fBeoWSb@BTvCWrX=xw>gf_`;*o<oT35-
z>$wKa%TJl3SA=22<)>Kmia#;3f9)8=>_W;Xxa@1>A1VT+Rpsgf|Jtk{W^nvvG=}t@
zZ{<BkpXMMs{oCU-Mmv6+?BRorBFFrn)(@$530jRJS+}-Ihs>2Q=f56!oMb#$!;G$H
zPEvNknsMNTmUz5HDwi%?>xNZ(w=DZFsz-FskY7YvN^)@b&*=Z2^z%6zAbtLXrk<Hl
zQ$RV<vmZkK(!*Eg{@>7jg$mvJ$hRT<?~-C@LXS`j*%P{skgiuq1A>2v%#zhF^z<Xf
z`i@{Gwu7e37XSLD%tp+eJloiF;ZL%@HL{L~f&<52I#1bBQWgv;8-GsOCy=Lb@{z7i
z(uKg1y4rhU(FP?eq>_I<a_MHwe7-vA{HeD<@3*UZ3P{_(WdIKEgvB7<M&3E+Z@B^}
z&V^!%5UTGe`p<!;KmVA4Ma3eRx*&NpQOctEmn>>;U$C%a`ZNbF8x|~_)zLOje4qMq
z-jqchZIkKR;vcs159`t?b7xJP(lLGV^m$We&4t=MkEIP|qu=@d?Aa@Twx2kAb~`?Y
zW5y@(c@m#xu+R!DWF0=g#OKrajE7IY#Ag#e<FSa72-IABHX*Z`@VWh0F(N%HtPyIv
z#iDeldg@1UdwRX<KOw$JuU2=R5Cb#n)e|Sg)fxG!<0r8@BTIGtBtFQ<AL_x7w?g%~
zzf2IX0w2K8<B3@rWw}PJjnbE!hDSNnswjPUl%+C?+tEbvdg^B}!kHF^iLH+i^PO4j
zxji>K*G7mfxjH){p2!`N?v^{cqEI!bzjGIHHUlcVge@<P?GvSW1K3V6D{n|lcj%Cf
zmC3&?;)%SpjINLZ+S%x@tGDq<ySDr@i9hlxm`{}Er^S4U-JbqVpFO*PK4Ziq&T+Uv
zJD6`3$MTPfBLmv#s%@bAF}2$&rm(D}_RyiWJ9OlYp>Ftl#v%F@6sz6zkt&uJ=<3G~
zaXUCa&_}8`0gjR`dJoL+eeOVQODEYRpX~qdKj%)(x#`rAHDXFNYHJ2YPZeDQbJT$z
z@zlWk*vGe~Z&Kq#J2UqoBdf}1Gnv96l^`|^(t6X@$_ik4RqPqmmkUrPHKI@)8x*hJ
z%*1bl^7B?x>-r9KHt~pw_z2_Sd<#Jqeh0PDRktZU4;*!+7*&`V)szjP-{*m$@L!o&
zUYMbN%)~u~1uRCqU+80IkyMlwbtSrm#jz!j>g?55)EC);R2;%=tP7J`-s>n_6PCiZ
z0Ice@j9RkTH4yIVRRdPo0JZ^OL$7)QZV9&Z8cU!+f}Oo45*R4Ku3l3K3}U;{XJ4<p
zp#VjUW_Y02cci+6?NF5h<$0y|lPIWR8zbHVR}b5|0^Rs*>U$TF3crk`x2+*IKRZlV
zi!ZYF2Uu#3z7HLj^5{n)wbT;*C=*@9#erub9zLiVyl{RG{xxy44mnFQXck2i_}_aN
z?2cz35Hqz6?OV`Je=!TEcL0jG5+}2Wl9Il`6pYF2ashFM%)`cq!tU5+MvqH67DC`L
zh^6Acn2Q$8031Y9Bsh2a{80DL0TZUSU#_q;Y8{XN66Y?sOkwF;pisS`+Umd(ScZXW
z5*AFGrm#%$VM#jcC;lo~rfy|osi$nH45Ympx<KK%yEb2i=0x68t@KZ-2P_klfu`;p
z08ZKn;`|$Pw@%*3^kMfmplKx?!PTWCb<HRuU(dil*GlrL6p*W=z%tw;Qddjzmu8S_
zq`(HTpfsWX{}a6G^+O<X6NR&C&Bs5t5E;hRrQ+ezgy4w^upX7I@l7E25gE=0VD9I_
zJ(8yOoD`Wr(l5y2&P#&(Fkw>$hQZu1OVdDdygC4uHMP7=<j?44niog*xB+73kz^-z
zWsahVVcyu<B|4f9(*O|<BqCPKo$o-DXH-FSu{0@fLSZ#8NhP)tk>`O>c<SkMLg5ZW
z=sj_#x8J~MOgEwrD@JRdi5NH{mQ{j|pz?B*|F#R$;*_xb--P|cD-$+#FePl`U`p5<
z2503^!tywF1RXoIz67j{oVQf#ASF7R3~;q}go$H=^&t72XE9oEmqr;2Bc1`+pi#zh
zw**@>%2-|?!A^}bmJgI*mqr=O2eIp*XP-tH%R?EfQO5ET)*EsDyb?(X%R>pvxAqW1
z!dex67tuz>@@+p5pECBkvh~5yW2ubf_YVW_$}x)4%S}~C;fcdQ7u`W5pN#_Bt9(Cb
z3!gh0bOqH8ozFrU?d79FWar~bKv&)X+QDaIHob;XMrLwz9_T94>EiRFL60D#x%t&_
zVXykXaJE-GypPyYZnbSi0Q8#pFjmyUUqj&ZnnZLPzf*LV+cUStD@t!W89Cy{L6}LO
zTjtQ5FCPwPZWs(w;SOP`$Oy6;v}!**L#>~V#GSGeMr&3j=%1o6qRNZ?pnv`qB4$3w
z1^U-@;B!SCfg5g-ZbXry9>7?U1vH>ar7Lof3~o2%A{WaHE5{|bmPY6Ph!W^CYYtK_
z9;wK+?18LybPQm^CKy!{4}V`Ka)y)zZ-w)svLfKmghPEnW>ah{>cMo-t_L8m{!oW2
zyu=yAtwRb&TjdOvj{}(`XYhU_$P~IRR1d?G(K6a2dKW2*&(d&T1eQ@(3k!@=K`Q)a
zoCYkTzk_DZJ<i}cpz-I(h|Qm&!NRXY_FKli2RfE_dO^2Phj{)fOk<fqigaEd2l@h{
z9o&N{SSJ1s85gg1f}Tu#H!p+-Ef-N=4}X>TZA6zT>PyJun2RDKQ0vvRh@jYdE6u+U
z2^rh)DJ-a-O%PZ49Kl~vCE`ClAg7*(S;ZeCn)4L6IsWq;_`$*lWrO~b_&WCz{T0y;
zz8!<ae@(QDE0}qFPZ9#rojA3lQ;GkE63)XDF9iSFpKxOI@h()9`0q&G&#fHv50{CQ
z%9!99gmV1P>kz-K{7*P0{uiR#cr=b}@h3NdZs+AR)~`f&@_VuB_}__M%HKuY#-FAY
zt>T{%{Rh!q{ClF$5WRt)Ci+jJx9~8;Q2bv+@8mH=|NSXlyYAvC1kO^!J}pN)Td9vY
zgl??~9nawaCe4wsh|Hnz<pBiKrJG<{&TDYSO6aV^zZU)>9FTDNEG$yzJ2OBpCfdRO
z>L=2NW|aQ{3nc_;^*+814GBvPOZ?IV`s#65O(XYZfnH9-v?%IwhoZ#AypG|mmx-lA
z^}aMfqKlMr?2|K<#D2daM=ku-q2TwAzy_%ElVbl+YwatU;JEV<L7n`DzMu<etfkz4
z5$Hh*Y`ltJNxce*-^DwyfW#uAH*n`z&?OrY##?wmqztoW??M124o*x`lw<nO$k)Vj
zqB+ysQI8TU4qzBJ(=)^c!?KcZq0xqurejS1!URx7poi(*;*Mdq;JstOs@2d%QT1Uo
z>`1a6SM|U80R$$~id5Z|4Ny<Oq3YKZ05lMAtNL03jRbtE-iq8w97UiJ3Q&6zM-ymO
z71dh=>&15VL9rMBve8=lAJC$3xV7(oA52<Cc69MDq`0+wF=#iRhJURU{qV1c_ZRKM
z^`_CeP!jh!DX9i&(Fc>26X`^wm%V^0t?)T2%q|t6n!Sgr5f>i|nTS_GHrfW>3Ys?{
zl5B&>4hlDmkA^#g<aC>NG*<55PDt7YQ@XhLODI0J@+-i1b1&9ot1!~283n*rO@ZN)
zBij7rdcUH6fn117xQj-78>A~?{3kTS8Pk-63GYHA6uK9XSvc<n>nBW#oEM}}p>Y!~
zB>fIWy%4z{mw24?^hfY`5&{*G=Q>M2C^CH$8fX=k#7l4}OlbUlF6n7$g`QEwckrt*
z!-Ua9yZ9$CWWpHI?^e|OfzWTQh0X})KqX)4PO`iRKod=h`FEm8vBpGiM#v?_9mAw`
z=oI~{^V#)cLUn59tzgCJZ;_t0AX}4DFN(%IX)VcVG?rq!LflcE65P`OP8Jn#GfUyN
zf=a+#1KPRmiNS#R22AF*H3SO`n8a;5^_AO?nc29_hbT)fHd=L_G=0GgCD~&@E4Ph7
z&L)={Fp=A)padol9))s+ffKl`8D2~-Gn(VMZI@`Q$+cXBOir#cm=<okTdb=|32rX~
zbELtH<Te!+OAZ)N<F=O(6UlQ7*oSippyc@{Vk!TrZYM7yqwBIRBwt3s;oui%gMax1
z<eH23_Jh8Hvbs@GujmgW+UCJ<5pzKvNxtQ^XeBvh#apEnjR7{$030zp%%4%)3u%;m
zA8mLpo`P*7`F`?Xo1*>)Wgsr;D5-k^WRLyw&tpP9u`f2XnNY>-ODOF*zd}6Z&%o8~
zn|>V2#c}@t8x=PDT1v<k8D;kM^I*PKexoR;wc6eR-+lwdMJIQ_Gj>7rD*lj|QfqBl
zHwc{Dm!NL%<n@@3eWMc@xr=|C40;pg=svl4`(|4F0luaM{H=wUNjEnYgWg7lJ8HWa
zt@gX6eYt+jwoi1|rlgT??e`f*k2_}Ti*fDu8!+~m?GvGm$ep<ij<N4Dm{G@US{mSP
z14bURZ9r1m>2!i<(2m(!$^rLEsP;Z)3le<Pfc%&(2@bPAZU{#lQ`F69j<bIs1H;}d
zHji+YkE~OalrlP&S`>9k0a{aX;Gu{*kp2{(^wyKuSyL)M8;>FRuZ5t8HeEnw|5cnF
zVGT+R)uh28U7X^NmGRNj1j!Mkz|9{DfF4P-$7X}(lu#6=`D`zy0@ja`%SrXw$jB)T
z22AnUE<uo`G#b$Ev&9Ss9A&^{pY1<T8<R5Hz)3zu-8c{n5N&^?ix)?x245YE>&1)U
z9Yq}i8>Y@4fr%xPqtrtfCe1>AQd{8AwD{@ZM$FGaB&H=k2|97k^vjhrYXeAy=j1{}
zCpPEfV6ZeB(H7o{{%J`>>-;-REiJiDnt^IZnq5q*%gh>G0y2w46#gbQue5AK%@RyH
z&Gjd#QPf=VP+dbj^~#7HkBH#7NFz<^5D^ndpOXp`WuzIaG$}S0M$K>-P*rTZF#n8n
z12V;?RRU%h5SpaYOhc*q6DjID8zZQ5VF0Ivl0v-+lW@k+iC^6(HU%;xZ^J&G8A~3;
zsZG2du%<0W%w;B!xm=2R6t>Jv{1aNjIUQxxk-}V`!{SALy}PUnCC8dNjg*ZT2Ga2y
zf;plDq;AbP30lU8)%hSuV|LceGelw&61Ug8B5C)t=F*m_@W;d(^+}#zk)hUsv;-w_
z`uu5%b&y<++_kKQl;akD+W^SO<A#n|&Fh2VKN0B-$^MtotjFGhe<KdypGH0Y0PL06
zzTgr?Pmnq}>DLntooD1k=V9p<euDTq(b(C<iUwz-87ZKrkOB|CR_txa3D(qt)8DXm
zir;n*PBD6(0quU9f|$_H?FoJx?UnifqczEId$0!3Z9tpfmX-||+A(y$Ev^)BpwVje
z+pZ>9Xuw3j?Fb1MjS>?Zi=xO~`Y`D(MV%-%H+pP^2xNT}ok1)-8DXW5CR(>?;zVOg
z+S}CHZ0JgH*p`k49A`kg!}gTO9hKA9LcQ8(@osqx)n}8TJ$wZcQlIlEBEiSg#o|%U
zs41xTdOP_Lh5G|>|ENqhO>~d)_LX+Mbd8OiOC?0VjE;}SsaEeKbvhp=28>SWI~+mN
z*RlhW5gw41zOk=RuNSefzHvm-p-5aj+7`SAy|Q9xFoo|RI+lWxbFx8J9NECaZ-o=G
z;)$=zsb?k7SPoo_q4;Gbz6pKmFW_Wbav>S<1xP(Rb`oe#>a*kiRi7=@P;7#qFezyo
z^dr8~A#3+!+jdePT4r_<bys+=0?^6SY)mQJPE&HoDP^a~{E<`2PNgZ~5OWgC%}$$2
z`YbNXG3q#2%o}4Zr>iAb95H$;y{HzPAo3GhxT4NLl)B>g7`?3aWb`_N9owZ7sqovx
z!7+O9))H`%&XADqN@*gY80weml0t)PK+E$D3efL^033tRV0XCk*8L-!Z^*uI0h$L8
z+rqD(4BAaJWg4kfXX0q$Dwqs1oYOhp?siT5C=8Ith)GS>NIBGG+G2H{AeJ?yu)|_=
zQ(D^Jh@7PSQ>0>HCCC9(HtelQ12@>wH${BhWUU>8#7-(AhR!!4*^)}WhrFA=iWpAv
zM1t?(zhO^JD%C;zWW7uBo`D(sxJ&}Sj1s$%&k^Ng?ZIvwhLb9skW5inQcYzF#-XH6
z^3&N=k%!HsT8jE^eiMp*(g+ecDt(qTl6-cI&&M8<R7VHr9)6l;QBQt7VWT5?lCf2B
z{giDPYHd<ztFoT5wNbBNXsb#*Wm|-8Bx#J1bP1<mxSg1k`gbO{O?yCwbFx>TPZ0(=
z#cUd8k@^AXv`R#nFJ~6}6dY}AHd<#h+Tj$fYB0bYdAo^g<<OinSGHKRaj3O9^U#7L
zjjp{aCN|rmeul?$+SxZy<JO|Z^5)EJQk}Dq%>pZ&)6DFae%2f;gV&VfD|I@N3a=Kg
zH|uPx__{eWY8@QdKW+%Jnk#Cxu#HP)>x5^VGrkpe?w?6^@jw>|sAI%}ap}HmF>G!e
zT@xGEIl1xlojop7JvV{)lwU_MlHHMO8%AxLF|FJr(xvdJqI;Y*%GVd1RO0B08ZCYu
z*Dv@shRDsLWYhV@F3>L0>yXKrn?tmVQ&G(AN4nkoun%-@l7qrzH>t}bb&cGK@|HV*
zLZ(ITHMwr0TlqnRUhcsC=-bABf;DmriNBMV&{#!vK@7ahwhr-@TSAsIGwUuHin*l}
ziu?FJ3z}qD9>Dr&UFs5CfaMOZ2WfZYjcCDCINcS?8%ZZm+{Hvd=GD>3)3|k#XI#kQ
zOi+x5`u>m)=hRDmIZP2L<Kru6t4~a&@sz|%+U6;VX_d6!@=nyoM8|%JdJ;RP;37Yr
zWPJQuC-@n(Za*DC7L2bChQW;aE^9hA)8Aqtq~_nWG6Op3aGrmQyvF8l4F)Zb^u|4d
z{0+uEgP-8@{Ef6T=)4<ooPQ_P0tYwYke0t$4#PKBfZj@%_l^7j6zAVH0dyOmi|UoX
z{lF-IE?$jp`FB&pPW}$kCjTDl(9Mq^&GUB>zej(#3iN$+{<biE3N_qMz`^u8Xt)Om
z;10rNV*LbLvJIJ;zl&I{Opibf%-=)PX=nOf;@||E`d5wkXo4QR2Pv8V<Z`(3DAV6X
zXy-pg;26_Ybj^R70PZ@_X)J#~ffG!pq|bkrw4Gw`hn5bTT~`C1=N2q4VhPA&`Oj^J
zrR5%y|NK)R6;2ms`G=)x`57<h7wWT$sJcoczGN8jF|xxeL_6f&qWo8>B)Is`@MQjL
zM0<Fu*m=R=`O)Z`|1Qm91MesV{T|U<_#&eJGXdt=DUV(G@6$|-$jtx1h)fTnE&sy|
zXgk2e$Za1}-y?iU4CqgY?l#>2DY^eBo+pS=6LW$Ts`(ZFhHCzhe?v9jN0YPg+R>1y
z90yA|cqv8DP@*#wwUy>I>>%c1*Ym4KU{qs)HPlZr`uR!LV)UyeI+pK8a^{a9I)1dG
z##I81j6r9+C%^ugf0W4EIw2*E=P4O=o|4g0iM*|t-$X9aan>9;DU%%&?UP*EHw{pI
z31xV~BC&l^KlZSAW0K7#JvE5}P>~ma`4>`5;nG#G3$4MsD16#TaU=f|B_)3r(WCjd
z6fbjRN#S=Pck}1Tl9ISc$zSvmX5A*sYyM@l$+z=ZGJ7ZWTxhuRa-uu<R?@zh=t~n9
z6)X8mdt-=B{t$)f)x?fo#bubTq{!?-VC=Xs%kmv6QvO<_BBgHUCh^gQdayUPvHTkb
zpg$@RVk4Y~V;bR{Oc-IuX5tty^j`22=P#P443G~2jFb9+;bY8LI(H%522{<187zEv
zHRx)h<M{~`$pJO}A%nX7E)E3){H@TVj`JZI$2<!%;vTya#3}d3KLNM{hA%ileT`c|
z1wRpOmW8w6=M#t+&S{G)IMo3@jwz2}V{|u>B6T6ga*vf{8BFGGmgFSVRQEVZW}r&D
zTO_#+OLdQz<O2?j@17v(7m#1>3nclT8{|Yu{z$@;B>4>t;=WLl>%%}!mSndFWUC~n
zj0HJGl6#v$UL?t#$sniFQq((;+wN(SJOQJ*XCBH{OiDzy=xEI=kjsCU8sm*6zek(8
zZY=pf#CIs_c%+KE(}8U!?LF~UYi84wbVV6hA)oeYj``DPDg%c|V3DVRfj$Z1afOS@
z>At)Z9aC3hV^GgD0WV%f_zUEbx&+2|FWEqfmx~coYLdv(0|T;qtD?>#`(AmPnjaVU
zPZ`7ph)<^^25HWN>S>=fLSj$@9fWw|yeXZ^phkKAR@CiemSr6|=zAGv+frD<`Xdk>
z^Jh&{3O#ZJJh~aKD21gGn6(iImcqdjaLt|vP$q#U7gbmhI>>a+!d8Yy?!RDiy7n`4
z7Y<|ebj6|d$Ien%&2j-;S~P|(^h*tHtp)BV9Kq_);?YWBmBKm+d|G-GKs{?mi(lJ>
ztSD@h$EQX`{Z)K?ku~a98sRXz6atDiRj5<P7fG?#rC6&m?Kk8&ZN^Ny<xJZ(y6aH*
zrWEVcCW)@8w&n+_!Fq??0A;HbwHPaQFONa`Mr?(VI}5kJ1zO&#D!iL~k4J|HslpvZ
zoB47CQsF&B8!1t^69XXqI>p(k)}T~<e;lmh;vbBJ<O3eiZZ3`T;0JKGhflykqwwJw
z;QRO!wAM#%0`2D;QOFDT-Vsh^OZwzd8f6-nHhhfeHl9j`+P4q#?TY#gZLKRl#%$9(
zxgZNIgIOsE?G>7D40{G*u+~I?ShfXYbHg<8At#<foE0WW)9Bi4(LF6GIB6L4tQ-y{
z5i1a;p2C%nfHsVA4NXDehY(YR*Ai{!U63hUMKtG+(bQJojA1NXj=6@0)cI?u1ckSG
zK|A<`xDqP7o#b8oN}A-xXTf*lAvNl}``V{7F<9!-VkE^v7{<NkRl-`HqNES^EADk4
z(!8D(>!(}Uc5(OgG?}<Xq67MLzHo@56y5Y7oa*4kP*HR<(Jq<9MYqtHZoXUmIz25o
z1OZ>Pk*ZoFAH_l6L9H#Ep)eF}qF$|XWkq)qzm3z2Gew)<ucTc;_&{&DvyPs)&?<|z
z(kc-~FCs$S>z~71BPL@p{-Vw@9Hr!LT68%*JHwS>0P;($_2|s`4#ZK>6~&+}+*$?t
zst(Y)JR=q@vx0W;C#~RLO>}4(%V|PxPN844g7V$N+r?)ytbJ>-v#ct<Q^O%Bv3<%k
zrFa`j;&_ALF5XTC;=Dwp%*?TonTqeFMY^S#iti)ZgZnCzXC?%x^b|ixeH;01EW7yO
zA&6q!xrL*PcM-o;nxps;GDn*<NAd3PdfEZW9L0Od97`2-7=qc|WyO3Vu6LkU@ru2m
zr8$aM8s=z*WbrkBV0D}i7!Uf|O!3RinBcNZ&}&x)$O2@U;_LT;c1g<=-|!k}x3o<0
zjYNB-gNwyH%*`h)Q+yLy#?N1hN8ei%%&n2Pm4V(!@-0gG=rNUw`^IN!ZhxXA?JQaG
z40au9x02QKa7YLlu4Ij2IP!VP+HYY9M7G%4RvxVF2aX`a`S~qG%eZUgU&3J}GVWTW
znM!UYGa1oTvVo@9E~i^^8_^y7ILU7$6L<38iN1sAr92F7E7?T!D&8CUQ*swAsf#~P
z^tRuEXxP9H64?G5=q-whlL%fwdI{@@;OQ8qWb9Q1A$ylJ8}_C<S|#H?!lXHW2mx6#
zo@fhigl$SLAX?|oq570eBHF<Rp^%rf#z4PI`k~~aD$s8DA&7?Q697EY5hXK;_8BXi
zMJw}5N0iK=SvT@#6ugoS0ht#5C_=ZS^C0L}UV%_7S@sp^Hbsqx*WI_T#-!7h7vk9K
ziDCz_MQGn+VV-FARRh#&8zTTLEchq-a1FOW6;BMiwFaxu=wiSVD|Y~0qj2@aNnqFL
z29775(OeuF<+3M%ky~6^CMMvqGV-!V8$ko<68N;qBxaL!(ywL1aGoRy8nx1RT#|W`
zC2G;E4m8;%Xw`;`pJv-wjp#GSHnR(B_N21{_-K`5{#3=2!Ad}PX??L>crsZFzy|FT
zRB%sUb`8K5O+)SVxY#;?osKDsIu%bpb_c)#MfH`!I2&JuJtDruYAl}Xe*(?NOcZP9
z)Fw+i90}P$F8!sD9ma|u=VS#R&x2xPb98Gz^#kaZ?S<MkG?};9T3FDdEhF%@1U_Rj
z@5;&ewb7%|@*j3F?9i$SAHY#|89<wMItJi<xrJauIy4y5+;kMFpSm7tr(On)?#;m-
zFd|07fiBOU0{E6cjSbkdcNs(!K1%~FcRJ4N5d)sbuLa-2uP6ZhG!<!_!?2Ng_ETUv
z6!qgMDBV&9JrOU0uX{GlBb}+Vt~)6(6ut&0PS0kF3y$q42(aZMQi|_a!7c8soz(ez
z6yUDXCr6>^b6cFEls-)Z;8r(=EZyIMC3AiWtX%r+V$gUJmks)WyhSUw?b7Eqg74tV
zb?^^A3fjdxnn1t!0cbZL=mY)I>CrgmdiacVfLEx4kAK??`nA+ClqP`$&~JD^H}cJh
zxzabsfkwTBB}?DB7<4N?kOTVd8$h?ob42Moq^DgLn9_GCk~?L6E`5&{fUW2on9hCI
zL@X@g9jsKu%#RO7BFRgCBmvHE918kp8_KVRABL$)Pi})Vb^am^^xIkt<S<tIJFV8m
zO(o!;K7+n)W95I+1U$yd|E87uG`Vtx(bD~zT)N7zcBN61OAneE^=Z-M;=>uOzEzW}
z=Zu!$rpe{^X0-lxtv^k-kL=T_Nn>b?tg%#+)`(<ej#cukSsEq9x?}|?jggVPK|4U}
zGAh6wTG%MWKxqP_Wp2^#!=6%VW%OO5o!V(PfK7JVrTvZ)P?{{kUX7j)mf9uQr`?B&
zSenAfW(TyV5z3`$5**PU>kp95HbHf__At`5)G7NM)f&l%eHj{*kLGEu5kT3D9)2H_
zRjAY@t56TVtOphDM|4;@^<p2+I%CGvDem1a;EbKQ7*O@j2&;!dG}_I*bHZetYV?g8
z?>q_2ns5Lt2-`LZ{?*Dvbh~X<5V7c89QGjUg+u!#AK+Rk?9xVA09H$ot9cMV-Zf!E
zCtwbmAItO#+2YXx0|9QApiB!O>%4bJ;L~hanfFc!hHH<B8`^C{7h>h!ZDEwVjoJlR
zvv+$KMNEq}8msf}kixCn4idXZf@#`^W`KLcD979Iy`1mb-9-m+8t^_O+q*Oe^?W4k
z)P+<kPmKfEBXw?Zw9V>JynChCPAyN2y4V)nNh^FhEFJ4Opp8PVdJoF>BU))MfJ0&5
zqgZrny|HI_p9^~jjy$T-HH!Ce*jyCeW7-U|*Gp2YN2?eM@Uj#;q2193;8iJh%1O!N
zeLL(WOiE!+o&<ChUo=60apvrTChz-UbY-D2=MzYJ?}uTp!zpg&JcJ>=ABWAFh}2=u
zV=$EW3pqm{bAChy{VI%7$<LhcVk`509kvfcG%_c}q4&6yY+=qy#I^TZi6%1VH^^A;
z4`GkYP~vb$&1pwn_5Kw0_+%KAIlmK27A8;q$_?IG*<mSjreh=VvhWT}eid`lX6RMJ
zsf2VfXB}#z*Bt%~hTVdtkU7G_Db{u}XJ$X3h;Y<%WfybilMQ-Fw2wI-7N-{`j~!3Z
z5-H_hWlnlV;*AQY*zab}2Pkf1!atlrH}sr4Xhw126dlKylg=;R_;A{tdzkb0JfLK$
z<pgs^idmN=vtPu@OG?-ZvHz0f((yyko*Paf<5Ha+aX@+Dbg}DJo%e+U4Ulaf)p^Vb
zR3u07sm^E-(~%r}I37H2_#-%Mwy4f+2ng?BDbcDrKcrYF5C0l%ZK`u6OyaGOZSAU)
z9<_UigwwP3PSqJnEA`89ma5L(6i~I{9;{}S>YRw8;thmXw8EmQa}eol2-jvJfK}(J
zAWod#W@(fys`CvpX^TYLRc8rBzyyhQs!l;>m@3Wifa)Ai{btDlcd5=-QP;h*rQ|+*
z7iu2@!o6oa%0tFDxMz#%?KI8wA^wB|a+jN^Bq-XOl)k~mCQ1*k$y~WY0*m$-rQDUK
zhajhGA5(l>W!eki(EJnv%T45TmzEa*SYe_=zFSMS0IZb2qd6!V)|x0%d|E11r5j8g
z0DkRk3cyCwJJ8ms9j`==c<(Ts0BX^e(0VtS;t_1E+F>8S!=~P7X_IF+?;}#(P1;cs
z+iS{)*aq!36hrT$rZdpJMboKxJZ&mO%TDcKYI#<+?9$RHjt`l}qh+5q0V(A@Z0ZC!
z5Y%oa+r4DE73hd8!roU+6#d;=7lq;LCc0!k=9o9FNb$ZQL60_x0;yYq6WXtoF>je@
zBRS<<SPt;EX%n<5p{zY>qO9eiWctuV$z%zo&*wpDN<EZ6Ur6LY{?O{blqPdAqrUvt
zMD@kZoU$H%Esfz}PFWDYF;PMEF{iAE-^oS$Lj~mrDcKmROFx<@|C&N&>4Yhh>QW1H
zRv^Z`Kbxr9bcX8EuO_NXOPMoIjJPa$tW00CnY!P^oVzIwdYkFWZUb{(Og4-*TPMph
z5t$5RF_TYrGUt0_o>=oTjI)b5f58ssjg#mACMceSX1av%rkJOrcMo%(p)^aCy-zUb
zAZ*Oubn|Moox&23QeLNQQ&i_22|(FqDid5a3Z2VLh0da)(Dmy~?td?NqsaVU@La01
znbue=ky~}r<7MwKbMIEvUe&3H_Ri$sg;as-rT)fH;*K&`Kmw(q1~Kow$UGMarC~xC
z&`c@W7RttXW-3ALp=_KlErrr>hSF@InF<n0gDh5;NXb>9V$~trx=^e{@5`f_#$aCV
zM;H2VQkzi$rw)$!6tukEGB}nJ%D7@497k7h#`B}W@e8rZSmcG*;DqI%bxs@9;KT<&
zJ9w^`dwFKC4_xPd;u|PSy#l2{-G;n&Kluk?x}mJrz_{+Gd&B%`>#=F*W#McHfOZ93
zP!_>9)nI6?6Miq_?CCieTk8drl=YHV2RKJRJQn?*8A1I|$79&CX>14e{~6&>Hl3ya
zjXsKI#q!E#$m0;#+8qEhCD625;a+UZF2PjFW=obGbBcz}XCEP*6Em^IvO0M{(x!{{
z#Yw?0($RYOOKSZOG+D|sSsxT0$0c)=^1keMkcvhR#LBac@szX%#A|y+75fNnvKm%Y
zvx!)rqGiLH6@In`fNR!ffLeKZXwm2iUBw8gL6^szijl_jqUEi#iaLoL+I2!-k`?>{
zR;*}bf5Y$|EgXAs#V84UvWQiTmcoARail}V7<rM{sLg5sXp*2smY|BUa+$44+CzwO
zM|qB1jP?;s0Ghl-j|6BDYEmKm9L+IY#9fF<v406K7e4SZ_k*YK=a5{3=>ik6vJ2bG
z;4Gpod|zMC*+lF7CG1{<T|_(ZZ9VmhEAd{}(kqIBpFu-og@@fV90sDZWrcA|SdrJy
z6<#JoQ2U@5ErZz}NLjSkh5(eYw*YkQG-h8>&b|Y1Xk}#73fbb4cXum>FbmA>)+%u{
ztMIYD03I#M2~bHu6khon>m$^wX5$UAc~{jrN)WM*g1gcYot$h@aMw9g(7pMzZ1Mh8
zg{(|O1+DB0krnJ4+ycph7&VB{&F-54I#yjt^qStF<5arF&A!zNI$phj=p#5h6eOs0
zm6#pGdJ7U&3j6FP%&fqwZX?<RXW`Acdx^dr8(@J=eVFJPgkeFF`Y6$NBIFB_)#9fJ
z{0A{yU{?<k{V@%YqP|G<AEYQ%eU0cR&7jlNw~1bN<5Fwnqi}0MmND~Uk-2oC|HcBC
zw?I=P5yH|L1(B*O2O52YqrjzJPG(X13_$J`<fvbP8P4g3PukZ-WHy_L?zd_miBFbJ
zVgp6lvgF8z5kL;lr*yxSf3#=XvfoVXE^)z12m5@_6)UH(;0l<`;@L0?Rgq6d?09Y?
zQsH+)tLJvf#u&4+5r%KWik^+RXb$Iezd2$BPCX9K!*oF}edT%hoUhuXP##hvVm@Nd
z;W@D5AE5(=kXjxKb#X60f`$k;*5&ZL`mz)f3$E46XCkKCJU`Eb0p;CH&oAUjg-?t`
zuaiV``GSJySGxAcefTEue<KBmb@BYQPTLoQ!1;sx?BOb$<vByNkFUIORc7E@EZg(<
zdk{}+N0hld;p{aGr9~lSJQ0#swEoBq50`*zOHu)PvG<|FBI~86x2%`C)*&ulWn<Tg
zwX0Hss}L=YG82n!BtJki=yOK-9RoyMkWB&~(G4PLv$BuQHS1u7b1J84HzPkBWtAqn
zTV!adG@TPG2QO_-8fH<JV4^!n+VzkwOEf(&7o{P4b#7E24D0aZvHh~Qn6f&lk!Ip~
zEHsm}Yv9O6&l8Nk^eHbcJx|I4AG*=@6f^F#Ns~U!$fg#pjSRM*Q9$Tgxp-x@jja@4
zt#+_wB7BXPeIzQ^^bOK5rK^mYM!XDDI!af6h(Y8^OII5W>O*i$>E{1}pK6BRBd!MJ
zE4^nb&L#3jap_Ll?iIcc7B9V*o~Cl%8}2Q=&nRnjv%2(tqpUrS?X&a&$`J>T(lKJG
zyo;U5|3bkkeTW)dys!9cO$z&APx9JQ#)gQo>vC9;2(Gh6PD83z2IO-eK3{BG=MFZ(
zmX)JlLtv|$Y>G1UI(h|4U5iW|dc$p)i8>Qw41L0b>4ft<{2S4XiFk&sKL}brz#VqI
zG5g&Jlwn=+;KDoM`C&H@ZQ*}Ge%Osf>pULg4--T?_*^I+7QAT~^tj}M*<m-+>~rP!
zV29mO4?Z54JYEi|TblsFIo&DfGY!V`E@Gd6llB)y#qbPMICg1`9uy9Dny?1}&^J?t
zXUa1p%7>l$T*_i0miCJsCo=D2>^4+xZF^8h%j0tY!s8@_iFY5PTLfGi=K*+vjRCM|
zZX~w%NeOf<V>rN5Qp}-k=nwF;1TO6?2iVURqK{kq8Jo2C83{bv5L6oPv+M@6__S$0
zfCI9R$*)~6#$1;btU@Gt53?Q!v}r#gGQ2M`?E<<*bWu3K5h>lNE${-o#N23Es=2U8
z@5^igz$z`5MtFrS2I$h}Bmun2ZUWe#6{Q2b#`Xei(Y`?u^1jZp5Y{`jZ{cz88|<YE
za9O`gdj}hvx0@Y@+&=Ao#F_U^_V_Tm&2S-E=`D5=El0F11m2b!x;0xLfOl9N4%J7s
zTghbavVj1{ls-q{IqzlcZrC~P*%ll(y?3#C%vj#P@@@;+oNiisw=;3s^`*(rz=Pfg
z<&nXymDU10B!Ne}RlIV2R`dgyw0F1c*rfEi<;E^sP)_ETkgf-5{NLn_D6{qjlF9o!
zTL<fLEiw||loYdQ7Bc^7=D{@Mwb3MYM)n!5y@E}{`=@+h>eu8g4^>6z(8U_;;5Dgq
zVKG<xA_gFgTBa-Ov`Y}{-f-0qbzR2sy_ZT6-o>0BQ`q#D2p1Ie#e8p!+~2k^=X&f@
z-Z*s<y5WN2KnYNiO84DxK_Ty6q^TVkdLOQ8#9v)G)7H?eopL%ynUkIqdo$Gq@W?Ud
zd>wh<?W@Abbg}URxj0*;OJH1V$a^0ym9GA9u|Z#O_2#K`b&Jaj`jTk~SybGi5NmEo
z3d+;`K=u4v4};Y6Z#@*sHe6rC>F8b}kxz9l%mVUANx$mcjPbmsatV#9lJ*9I!Qs7v
zO&yN_psESlsE%oi5rh_RkgcJnl;O0@rScG_IPmn|yG(`vlDG%e-FvmvkoGBPhj#^|
zI~<0(6(MzfD)&siv0P=Jimf-b#oh)vd}j@-4d)XOdwr&h<eQ5pRm0l4caG^DG{`~b
z%Iitv2<V+>GLC@4fdLno=*VeN(%wY~IlPNZKcbH@<f70Pm9`%1F?%nS*Y(<4;-Q-p
zC+@_eyjwzAV<~R8N?_K$ry6mW1YBE`46scCP3uqjw_O5@_8HZcyCsO%h9ZZ&J0#Gx
zXN2PxTh!u0u<n(tOl|L;np^T2yK~Q_x7r!oAjF2Q5w9Y#T3FS#<cr|y<rYP$+D_$F
z;a{N!SKUptnQQP;)efTZPy%~Em3-i@@c}sSR>_w{EIdNYyUkgC2=l3Wm?W{)Ky{UT
zNb2JBB)e)i@pJh!ETC!+(QaPd3-n$JA`j0Luia*?4M%oY?W1&R<Zk$->ItHocp~wi
zq+Tstr%|3F{zQH|@~TQct7zp9!Ut9RNn0C#UF6;FEZ<J6I7pmT{3&?0>N)Dw#gFHM
zexCC5CjNFE=)=U{%U5Dst9pSh*zwg!vHo^z)Gk=C>Ltn<h3QMh?%VSx(neeTxqLLH
zXyNEx{e`R<TqEJ?FJ(2+wDna0U&)qut*sj1zwEbJbWT{B2k^BNYtep11*`6nVy#+)
zDBEar{fIrX`de9Gp4U1?0(>vqztr+z{puei=+RygS8lY`WTG@x|IDVg!8^?PEedk=
zFDwDb!JJ;Wp!%dlEzCKIrh1x%&z4o^YZuTTvZUdrMvVA)V{(ujTK%`=q4q>zBdk6v
z2iwk^Ww1fDBI^<=5jnS-N%R17;+-m`T2<*%1a;|cgln}~rCaT&OZGCLUTPLbJ;0o;
zgMp%DzazLOONOvWguA5m;<7s;ga0KPCQ9Br%=r!~QMFa2IisG@jlgQVZ2Jhek;rl>
z5}~>kj|NJW=u76jIT0vLBGkG=aCdcI^$eVdS~nkgU7aOM5Nh3GIJ-Jqw&BLgwjeFj
zB^$Y#*)gwOscuvkz?>+3S7E=b9;1>I9cJf92T+shfznp9lcBCvkCkmx%+AqB#p-6+
zw$<#sABDGioSe*dvvVdbVv<BVp#@P{JyWHhK6t?FTuYDVsyk${++}u-#o?!Vk*wzX
z%qULj$WrSq>4;`i&13h^fX6R`7i%7;;8pk)MDL>=#;ohGP0bUMX8N!kfG0`Ftm;K>
z0D1wP-b4+H1UN{bx2m5+`qTuUn>m{ntN%#oFad|ESHUSYFOnSIOZ5>rLSUe(&qhSn
z(7T*Up{g&z(rR9z&9qq6j|~KPt$hy8GOGSLf!7J(_0=0-<C^YVsBTsD;fUXww+OVU
z`V*C6>79CT93rpggQvh-rRt?L`ws~mQ+4`QXw64<=<%3zlMmn+{cMBZq_2coYCa!<
ziL{t>3iX<=DQYH|bc*zv9$NlHlOB@`aC`|Aw3_tKG1HoFsAaB6cfo@--xBb&oAmyu
z#x*Ahb(r*<QL<`&CeUfpFUbJ-g}@aiozr}Nn+LGeq!)>X&BG!)t6?(#Yk$mug+CIT
zH|G|}3iB%UQ1}N3zN*)VHggN?Q1v>|JaOtJbCs$$h}QT8;?K>_x}&HcRc{l=!|D7{
z^$yWxd=gw+^)Asqel>Qss`rQ<uB7$B;yu+urn|gMuD(?!ucA4`oGrEnI_*|(V^j?-
z+ByhV-y?yp(HA7E@0Y-#l^{T>AC~*6OZ%!AV2><SZl%xru|Rv-=9xIG-7VhUk~NUt
zf~|g94r9^ib+qbdB#2k~Os1%RmZc+iaxH3gj{5E_Ebd0pf2*zZeYm7LU*>><TemP`
z^#C;nCO0GHsm(3hRxszIR7?uwp=A|wqU3FLjm@P5E|vOFipT}kWl|o+rx&)=>T-$p
z;{I)apdk{W6b+$b;*;oUl!3lLmFkC>6$;ZP@yFKWnn<d=!=(fYOa>LqDw&KZFqcsg
zsaEMrcPJ_M^aH9<=?*zcN<YeXzwC#SvO!F|E13-!op((SZn5K+>Z(g-)7hdN|E6vR
zBjQj2d{DELvI}2PY*%WQArue>pTXQU%jIcQQD3P9SUD6j5ycuVe`>C!B;fR9u4WZI
zzf(9pn5$V$kMFp=?OC&yp59qFJ!`AE9*^3l<8q1|TGKTG@(v{;3)XF^5tKpl#%j$?
zRKOH|2?}$~%`^*+SDr6cYHpzp7TyMX*4#>bov$kby@6;4@1iWYjUvy*H;9AV^x6fm
zLCtpJ;0Hyh*AAl1JP142>?9h$qH-r(V5zyE3V|`N2WS{25d%I*HGnJXZ6afPVXzYV
z%f6zUtqD)-Apa}B9}&)P1SjG_1b|-l`7h@dQT7F8pmCX8_Vp%W^VX5*bzEMh<L7U1
z4k-KP5E{Zc^-B8*Wy?`Ef~Cz3ozp-YC(Uqf1~0kK=h#omB1{DUX^%;1ZmN^g;>7mE
z$d9aOwwUIFll_K>ySr}^-6brGl4mW&u}CS4mEt&(-YZ7my||oS=Si4qyw3A6f;wRu
zy|LTPPxl8so#>-{4$?ef#(@aBGE(P_1DF|ym8rF&*N!pxp{+?foNT{Xw!@k>0I@OR
zBDx9Cif=xmAdi^34U*yfB*}jx9^a9}4vNoq<Y+?>wj&cQ^TD==#Cvj_E?gYiEw_OY
zp@TeOkA1Nn9>DAA_PD%wGUJWnqI;Y{`7*Lj-+YI+u{L`W8QIM@_5v+`6seG3I0$qK
z@jd*GQqZYHm+=pX?;zU8&*A`JPbYdfe-e|iXAtd|U;MXc(L1?~yazk0-9`Izi+r!!
z-Y+7kVQu^i_}<>1UgX%tn`wYNy2jYYZ$c5X4<Pyge-^Q2FUWw*5k9vL^dMSLw|uwH
zUP$lu9p!H|f?q5xYpX|S*+Xx&r}fy(IH%Y{Z?&iP*pB)Dz48$@UZ?M|J(Ud{daK>u
zV>^cPrk&nmLa9pbvF$+G*eeW})MKNK!al@+wjSFcM7!N*K)uH%-=D5DptZ+V1V7t{
z8ZfcPR*PJ=4>Mpwk1hW<<dD7E!0|n{RBTUnzX9WVY)J&^dybe#Y>#c7aNnDfb}P*_
z^a^uSkIk6_NO!X!6WPN@h`IObNeM{eI?E@pP(~^|*%}s@%bb@Z3lwqZy;;HdDT)$U
z$WA)wpgO1(;1UTOS`&c|30&G7*gtS78@Y<^VdNt^0+&hP(df%VfyHbbT724dm{8zK
zHVMG5U520tT*Wpa_!~8P5k9bt(W`4M+5@ERYK9~b!|qEBK8nLa;952ny*wso3<_po
zHKSPfnVdQt99Scf-{kC}wzZ6W-)M3QOggZhk(XOc&P3QVaGgZ0CTAl_b}<U)HdE%J
zg|n2v4H9*loXZ1fyHTQ5Cg-*N;I)8|a08Sg0s}Wmv=d4ZEP-1j+Glc_MDP2PgW<%x
zo!zk%X=`$}V)Vd9iF!=V?a1!H9qgNHk!U8TwKvcvHVX?oWpe%rPXz8{nLvu!`8C;K
z3wspZx!F02bZ%w+&}K0^H}(U%OD;t>JD;2gw4Hs9@o)^y=~o4Kk8E_Aof7S2ea&!;
z+4-#-ZTGVAShdIOyhpr#e{ytbCV0E#FFrMzoqfcq`*Zr+5h;Pk*&+<rj$S69C)iF5
z&}nwkm$d^=F+Y~D)SMSB>K;gEUyJz<q!*4w`3O8GFBi<_<aOq}i3r)i3kHKFf#FXF
z<E0S828KgC_dt4Zi4W{IL+nJb+fn!eZ-*EOV0?f=5qKxWhzDamx#8UqBMyww#CR{n
zhy`O1b@`9MFh_y$ISwF!_d^nqV4R@P{D9HdpO6t6IR0vIJ`9QU0b>?f`lAq|HyBq_
zynP&E^a7)N02rSb3{yB5*CP`HpN1sDz&Kn2#%Cdh84MGOd*JgB!?eyUK7TMa_$AUH
z@ZS)VLF(yZFun;f6fiPIg7IyLk=A9-<Mm*C7h<G>acKb<KZY17VBFyc<3xyI2jjQ{
zjGsb`WH8=u0^<}Ll`CzK1kPO)52r&SHZUF~FP;rCbTC$k%@3vH4a$QL4P<YLlMkgA
zwo~>-$O{uQvp}Sta+`-3(O`^1!432ZF`~fmh}wq-2CpjxJ2J%X4YmW7KM)mS^a4XA
zH%5mT9E@2smL<f90E2$NA`ojZ%qB4C+lhhrkc0}x<-|w`F&G$Slz541Xw?chpHNg=
zLn3K6ne%L920g?`1>>a1+Lex95Ag3A82fn*8q-3J`b}o%V`AN|<kG%0*DRF^4ld;i
z$nV+e?zz~k%+Bs`pd6J_uiNZ=unef5L`TieCUI<6a<I|`-XO_4VRp`@B3dZXDYNrd
z>`{RtiIgzsfo7m$iFlavFABI4i7a8x+bP9866s;i4ji@ur4l*9oOTKauSBjeXDy}@
z7%Y)H%=u?DDJ_%G6XrZ?6RRI_1^bfQDvgC&EG=PqtEh?&4Kb9KFh%_XF06~mzZ@IL
ze?jWz`cn4I5^Nx}C)9h{^8%qI_k{Yv5^#;~Th^DeS5~2#X^9x3eh53d4!0q+ZG`}p
zjD7`RgZ5qvEK)y=okG5BaneO){czR=Z(EqNr4^`}{TIqT%z2$?*_{)-1V*i|XWxOh
z0pEgv7wQ|?TBzEhI_Zd2KU$&_s*~>e*N<WJ0yXxKjmUxev2sxCAq!Cb>zgIQ9@2^>
z)sK^?#pIlWt)PB9V>i*|qEo~IO<>7DZ6@ahcGULz3yg33nw*zl()AazVyv;#<eV++
zdy@O(2dI?#izKfLdjSnQm9?zIbWP4|Y_#>$SOJu6F*&D*i}vKC(3_R@^H@802aN5k
zeu3O;j+mTl#LhiA(Nv7<FJqTN0>6LvlsL90y*bwh-jYzhrdZ7Rm*85m{)!O8ZZYS%
z$TL?N43iCvZ^&}X&ZRgQ>#zaTUmapt!FWrI+ndg=5|{7I2(Cq)uZ#T^KDMSiU<tLM
zvg#_Dz<5Pz7-}48*#ywT=*`-0z7MI?Fr0q9?v#8?(@=E?Iq|1X8)ZW^(Hhggf-xKX
z-^ODTWBP1Zy`h%2co)+v#{i5VfH!568}ZbkVI(0B)7K!W8tUXxfa#t(fB*qM(+3U%
zkgr%aGCdN7vO)fGRx8v0#QxYYiblnYwN1#DhB0(*T*`FY5P&8EtML2q2$6=d6d_$q
ze+&hrp_#x2rn`n>(G4w><y)9eUqEaaFH@fBQ7FI-6A0{Lx=$Q@)Yh<=CNlZd7Mw<z
zPH$#5wEhjy&Gb95A2rONvkKnhoe={tlfW^i5AgxC5$J(V>NAVL38w2J=ds*^Avkn4
zv>OMxlooZsEr@~!`u;h#F*`8*3`)a711AF?5!XDH7PO^<yU5_`;C9j4FEy|g_#n<7
z4fMrzXi21Y(t5dp6MzG>(!~ajZ^4)AMj}1y;u_)l2orX}RSlb5*h=wEx6*KD=T_+9
zKT?;?SKI`W7tjwCG;FOz>{<AZ$)LB9L3Qp!HE7sQW_R!bm7sT!4_*AA82h+W{yIm)
z1GIcUSFjs5JV-RY4^A$5i0Br)*t+R)XOIsDXYc0@BphE$V?9QWSgNQKk<oPtgD|&<
zT9A6(;Ax;aWmjDp$>66bkl1zQG#@UXD%MpHjj!@d!2orM3#jk!K4@#)LFYPtF+#WT
z9wHTaUD3Gngc!0fY#uqd@!syuw8q!5$u!<i`gJ}TV>Ld~37ro9IpVZ&H?7yj^HC8R
z_tMp#n=iM6e(ZVl^>76V(D*o&K_90Q)VPmmzkHpy@kx4}w~-f%NA_83>EPUWfX>bB
zw((}rhYSy;b=tm$^&90KZZk{mv^_)cd80L@({>jIZIt)95j35)H$==6DVF85t|Nww
zt<x4QDxMe-T<B4hQ86#W65;$mShC$R%GYZdRz4mYM^zdYq@Us%HB=r~6?G^kIBHlA
z$+|~Xk0;qTVfj%tzErYU4pMNGpZeh!S0;k4B@qjMItug%!(#M^Z`4RSpZ9iPTpCZk
zNW?s;SJNfQ=-87E(ln?QbR5x~HxV6AH2ii&8bCrjdZlb&fk)n74vC^B>|ML*$57xj
zvEWH-?eo>(Ja*SoGHqTS=*Nj}<fjWj?<2Z}cfkCCCx~w4<KsX-Npu^(6-x;`MRYs=
zPQ3A?)%KnroM(u$il3<leSqjL{;D{O))#8Pd7d~s`CD*%;4sm<@T6qGQ`X2@A2_cP
z=LqD-Je3)wNArPCh{KtlMyK0P30Rok8%7BnBcK~qFYp-w2dX317Wk5k=3@FqwE$lc
zK&33k<`npv>am~c^hNf-acXI2dOT_ShQfU*(?28y-%|d?uVMps)7kcW84YS`7aOob
z^nN-mCcQ7X@>VD=dBGhlyicbESC0f&-Uc-@9o%u_fKM8cWCeb&8u(WOCw4Ks{(_<$
z_-!Y7$io7seJjs-=num~`6v{DKPebId>YyMFPgBA%gLXm1vhF`@&gJ3=#R_B?+{`E
zMhM@Utw*g0s1mek#}J$We5D61?b`Fgv_Grp8d4u2SzTJP4}eRsK^sUb=_SDyjrNg1
zZwYp4?}-cd+k(=~(Q+R?pwTmqfJK6CjlRGXh>@39$2407K&-qD>(Tyj0K_x0{|TqG
zc%nRg=*+nvdvCxhk%KuOq6pLF^{k6I=Y;{;ByuyQ&v#@pp2WUHH23*f{Jp<#)RAnk
z9IOY{Q?ztZ@Jv=w1=2N;X(-g_$3y~s<@v>>(N8P|vLtY8E670E><9Gp;4Oi5&)6>b
zl+2LBW`Wfwox(4dY1g3gX`uBnUtb8C`w%;0jvu-m<MBzTnq$6=*$6U;4jE&NSYc@v
z+p;V){b0B|)nco>@mW21G7~BXurHuS(Iz6-18#PlbZQ4_VT0Ic7}KI1A~zPX*@z6?
zm~yF{vO`Ov`FrIxvCCLlnXwo*jUK27ombL41(m3!fgvHBN<Z$RTqACMHr*daNm0e(
zuElM<pOLS6phjNGYV@;$0Y5t<Cr7u&1GVxf$2EH19T*{{=to~7(6!H-Hy#)?QFa;4
z>cKF+I}#XUbW!^FC@h-T<s>_{67)FsC=KZ>q#?)48vq(@B7q6=)_~$zu&6@`Tp*W2
zLyGGU^v{q2Qw;%Q8q*lv9-!Y{J3*=g;-do&7AO8XP%@Xk`_?p!azx?R!un0a_d?Xd
zqfl#_s?LC|^9^ubQ#H|4Qz^GpXEIndOCTD~pTxiFoz3`vVoH1uWW*|vOUGt*uZBwc
zWvsD%>Fycb5ZrRmYNHB0Hivws^TRkxjO|Yf9ryv!?t|8`6nJ9?oIzI)zuyJgoxX<B
zmrOghfTrN*wO-JLx!^bQz3HHfN<g>pUgJS~raGwP(yhj^-g%I3;}?puLq)OsE&#{4
zF{au(74>wvSbnHMr=QFmYY&G4^%fdC^+SxU{!t;mIaK1N8&Azi#_V;pHYXF!`647~
za|-RPmc&`}mF83;b^ewZ^_(-3me8C@91l+x%bv5^x^b*%&ZEgU@`aJ02Yj-QCR`&P
zc`hgaXY4u6gN>L^X|vJ3-F)s&VVi9P4BdS0PGOtvOTnK{Y54?>YCd;Iu+2852(U6#
zG}~;oG`pdpn%QPMNQ*dkN3bnv%B%%S^KhdzzD@q(S#vdQ!0q_Ovn!vs1`Em|KY|V&
zU3?M}qPdQ${04czX$}y*h2IS)Ha8HxlkY~AZEhs_U3?HKPxELxUhU)eqRKXpA^HIS
ztRLtmk~t!OZK}DMjvn3eE^YHTx-ol{+pLfozgWZ_j>)q4L0>=zoD=*W(m#m~KBsiL
zZ`XVwZ8QqgkBAY6lh|%C{cw4Z%6@(5RCYVcc6~Vw%=sytbLuOIw(zTKK@TDN|0C->
zz@w_tK0aqA<t9vE5>h541A$ONpCpik%q0v`G6Bh*Oc)7LjM%Va$2x!w#R3MoxQY~A
zd%=#1ie1-+9sMk<Wp#JewU@Ph|NnV!k~=KV!{mL>J?)<Qo^$U#zo3y#KT+O5h0)Ou
z@>I%IhF)V%W9!8GV0>)WI{lxhEAQfFh;tTRisn5P;?maB{tj8ZFJF9F3K`N?MeFIb
zB!YS?y7f$MQda0scw5hAE3YyhVm#-tyM>L*QMj!sF70tfEpD>aIpCNF!L+XIo5kjG
z4vL_46~lHIv{YNq{|NDSdc0fFAzH03kclkg+e^E)JQGrRU5`F9ru3o_xNrb-=h0tx
zx6bol#*(P)@;y6RMY_g68%)hb6K!34B-}%LRcqH@*TDnZdh7ZuxOt4-t&lfJ39=en
zZ7D%kZ|g=W!H<g|Uq!h>S8wapVw>{7%+_lthjrDpZlc^^`~~@L-Ap-}((R{p3l$tt
z#arJ>Ic{X)Mq96=++q9&(?qK_@H>tB&?#E~O82G4U>3=ZU*dO}kxThz7S9S}Co^;l
z<<-V_yg_Y5uQeXPAk%sq-8UL~#d>?{1t?pLN6;u+@1T5>@hE;<@1(rl*j@v9JLMh5
zPRxp}cT?VF46TNI59Q~K$45ZEm-237!vx6pQQl)*J_hmwT&?Uiy3k2lALJQxpBsJr
zkRM`u_&Hd&0Ap+G!&K0UIcl{&qN_j!_d~B}-Nh<~!M269@c7fK(VkS$Wbr-8yQomX
zIgIToDlpgvwL^KDN>~MN>l*ZYY1u{$DXo8F-N0<?%!l#<mADFy>1uy|_(4Gy`K!zT
zEV<!*p}a<Axe9I`3*~hxD^&2GO!EyYt5wiorr)NrRt2w^1!WJFjcPpi>RbQsSlms9
zci<K^{^71Y&kw>2<Uc=Oo*F=pAG2(>tKf;u_NTm|9V&PSd*(lQWtR#rm<#1ID$l9l
ze>$Q3i+yA_Po3I;CYfdMgk10I%-vU8;Sh?c)?deVp{>$9Z~aY-zt{-Kf3PUT_-jr5
zsjWZ19v;NT6Z5ZCY`hNrb!MyBc%6RER;?M@Y+I@gy4EbMEYk*EtJr<Z{i9&&wTj)h
z!f){o#qL|}-^_v)yKk)@7GEDvt6#^k(f>tP=!McUnv|^p?X=xbW3n}0D?9vUU2QLv
z)^X3FwNN|l*2ZXSiB|S#Td;M2wgvZA(k^c;(~6-g3%j<wFlIkmX03y}jh844zwxY?
zA!;YO_o$B6VIb|m;?N_|aBX^e{CcPvp*YqA{O5G_eQ|i%6}1R7R`Kksu%E}YwT@Ff
z{Hnnp>at!OkY@~mQ;nL0xcVI2b?S?6?#BoA?XReluSN^-&)Xl$Zmk&ltKjxmwG!}W
zp;5NKuFiuE81(OiN!$L0Rx14MU6;O8nxbLQzDMoFl~Fhc4n4a)+V@KA4-SX8#oInn
zJ$n@r(BA5t{BwEOK1myWf$GPap_tv)T(G(lt)+c(cYy?}|8E-fZfh?TtiF}kqt5m6
zRIqx+L^w=!9Lj>#?Sr9DbMyhh>cU~rXNc|%2CJWLf<DvHi-Z0=)IfWSzTFD{hZw%v
zXRC8?yH)zBSG%R3df{!;zPQq+xU<#ZpEwUn0#`7FM725DK36}miRqW(+vmw67C%qg
zZST;x-Qnl9c>8><EcLI(xYxcwKM-5)zYp!FeW6xX_**dwwlCJoYX7-tdF=-&4o7SK
zkI#V8sUz6pe*ybK?Mu2UUn!iJ&D<QS7XiEcuVK7vKU}B(oS!pz`w?2filqa}QmyRq
z-`I7`E5pnAQC<5n+Ue)Y!7RAr6vrIAm~nI09j}xn`2eo{1nq|9%X4+mPShHfFYg`z
z?If*X`NHGl+D}nDKQ62)_e_O$nqJIc%l3WD;q9mE<xx~szS=c#_sC{0$J@`=Zk?(!
z-UjU)tu0lRA7VskPibwLs$7YiZ(pf6&Ma4zGtju(&(+!rRq5}#Z1>0%514MhP`hnW
zl^xVpYwadg`8ih8?H6fnJ3h0EK)YCLJ5=S9Y+GxzwhM2VC81rSwdYi&!bsPCsn&L@
z%Ev08U8c1?_=*>8yZv&l?NybFm$3ZTYV~tfd2ki9bz1uxMTXI${R(|6KdZ`8w4U}Z
zeGS$)*PHF@wT4%1`Glw4)*9Y7%V%b;(&2*M%8^|gU#;(VG-JM1w~VN_^2@FdUM)+V
z!Z^08Kaa)a>#gjIk*xhLUF@BRpP9Z}3e{Wr0yfdw@6quu!`FJOu6wn%9N*vtpxv)%
z(yj1Tp2neJhYp9Y^=@JRdQfX?y_JP*Q4gyZN->FeJ>@wY+wWs%G1hmje61vTHw$g2
z7)rA-`?o*J**|KG#^yr%W0YgYWVX3ol;cJTqG^AERzZg`kB#dow!Wpta7+*F&#=aq
z;W*weUn@C;PuJW3hE{?N%R#G4`KYs9zgC6quGPi@mhvmi$Xd)g9IUbo-<6nqa@ZDj
za|kN0Xn%_<S-m;czUQcwh)VA-w7;vJv9Wl>>%&r8*g*DPfhOlM-eR-;NYCC9>SNE<
z7#9%tbBM@0Vi+!e^14ne3l~OJwU1UyA^5orYagR4%H!uctbMFj3>gQ<=`I|o<`Jgt
zVHt^Xiz})@`0eWRM&Ds&^Wk2jN)T0+v1&bk8Ljt)c9hw~H4saFn$^|x#`rwF)p#1q
zGH86%b;cXxhjXJdo*KKECEXvbExz(W$a{l&>+oFK?=U{j?Rw>n($ooPV)4~~!{w+7
zrl?%Z4M`Xu=VFMAU!r#&Rq(H<o%p3xI#uxK{!lJwkt|c==c2CS>vWwM!R2cFC(Pd!
zQb#4w^`2yx=*7_ALsyKi7rkhC*AZ_HQ)9a>eX}IRWBcRRFo~dXFea4vCdyUDa1>qq
zTFS6Q(R}01k)4xJ-SI8VMckN3dFz^^*@XBgJHCxivO597Vu1SgP29~znho)no`I~7
zyo|rh8}%5gv4)7haz-6W1t-U2K#lL#%R~KsO8nJ-!BbEoeS?u!=+#vGO_q06>1SQ@
z-x{dC>016)eIBQ`_!PE#o|U}wt<f|2NFhFxJ`IEKHOHGN2TJ(@aa>;IFoMC-Q(1(w
zoFWUBzD1w2oe~R{ZtfcUb|}T&);I@9H2wZT<J>6Jwvua^pPMik#uJP=YHVlCxAVlt
znDH8lEIyZul(;bty*Zww++k#Md2#^#cj^^gd>&iGQn|<Z`V|0;6o@b2Gn3^;6D*cg
zd?5qCJfDlei&%(jJ>EO2p)4MPT$IP+OKwL=>9cI&hfoCb2}5H1FxHS^Y(eLbA5J-7
zOdSmQ2+Bddh>b6$T%q^m<3}+aITJU2H07|dw8GOB+cQMn*md-trWAMFt*Qgj2Ia6z
zYou-`@}Oz-`&&@Ur95}k8mCLE&>t<GSpikfH_!D(OZ7vWu)dmGJY7>QtZGsH(@XWU
zlp3w7KGRF}qn27xbElUM?5cVvbfA8A)xc+0F@3nDHHiz`xS=0oHB#;{^uwiy6tjMu
zWOALl)R+=QX7n0&nH-?~C9<p!(9ZUFr*>_AXCPkmdi0%=S?mzjdfr^rxS8^mJg+!z
z9E&m1+CaHO7nx-<;!Z=~^hOrtQsc{7__>PmGOU2R2E99d5Syp!&nECr2F^;<Y&v}~
zIbW%rnA5fD-7~Pp{Qcb%Qvb%dI=}k4ZFmcgBk?2^!fUkUJnJ?R9t5jyGxr?6#pM8F
z(?1^b(8+iaF8-?r4(DveujipYXsezlkd~n|wr=Nq3}0U4w1}7S%B}qI<QQ--!7cc(
zZ-?Jp;nwX7t4k49=i@nO9u2GWT>#_3qhWQv3$;jCosVA{;u!S<AYQCpH=?+FYqaZF
zAH++Jq=$=`-lY^B+@dDd`PS2gn7Wa;uuc2?9o@@!<B=YWTi(LCkay4-Qww7to3U%>
zd!^$^n9H2~3Zp(BVYA*~g4wsBV+AsoFMwAKmdiYYK5&L|SH}CpHNY|ZrzP420LO;+
zH4kp#`{co0_I?yRxL4j69$a>RjZ_4{5iw<#C?w`tkwYF_c2FTto>e*E!43RCcyQUn
z)gy2df@Ai0^)3`4IA({nA_T|mYOM&tF}p@9LU7EkRilxR5FE27DrQj#j@k8UI#P82
zj@b?mE_>?`I0_FgdmClp!DU}pMR)SxUi_f*V9kRw#x<}>oZXI}@G|(s`=-<IGjSb7
z&4V*0-w0WFa7NQLkc9_lM9+jQJUC<O1(1aYXG~)T!Gr6%^uv<8RcO6N>w9n^{Ozs}
z1^#9%B$`j)Z^k0Zgung$!}75Nu;plWq?Z7;oHKM&AwDeEYDZQzUa3#P$q=*0ca7RR
zc-SLROz-B$=mY{)@=yLAvOtymP1i%#P^G;BRqE6K0|wPlrM!p_olRpR^UP=t@~Eex
zJRJdEeI-<>Phns95vWq%nl8v1s?@i3F`~gU_pbN$R%)nH-^Le_-wM6K+Bd>V7N}C+
z$v?tfph|t4=-yxus?>Mp?~t)!g+ACf_6+>QJQ}Lhr|4RysG&;z=D*7v;$_f&2X2QK
zd8fADg1<r*s8YX0hvcA$1gg|;G2^cg=uw}NPZ<xON1ok*z#$01cmnyo@dOGa9v=G?
z=>IT$Xy(xie<$<kzkeT?e-`GNKBdRuLjPkRdSC1s`O&}#w~z}8HZu$8c)6%B?-W=k
z1^v%~lO~4r53mVnVo3k|)6nS9Kam#@KvsQ30?2J22?4}E@C01c1Q374WYm-pK>S0<
ze%F(mzj6dbIYib!ly|2IAi<A?0OB9R`XvEm&c{Lk@z*e8o_rEO{Ixohx`_P~*g}K=
z;-ARMBbVSv`~?AI^T$E}$twt8^b-O|UST6zL_P^1c||%-ZI0v>OPnNt<dqcR=7j)~
z7o<!Ai1!mAfaHZ30SO>Ap9ldYZ}d!L4X?4r3T_;L;A2HCj}>?#P{)Z{7AqhDByYT^
z17ZcYH$&ye=LlOGD<A<RuUga~C_0m%)`(gXD<A<RZ-S`Bu>wAz%9}W|>)lVL*WSk=
zKg>e(@vY&KO+9+ap;|l$wNY}t7CGX0f){qReOfVyhN|kz^7|Y9573m=zHB-^lvdgL
zuC<?@sgCOM|Dz(HeU{MYySP-kzRUbaNS)Dj;6Gkb_jQf>tUPrKBKIelg<CNp1$3S0
zq=v7+mEtveqzlYNK2WRoa>{xP={Qr?`wNhNbeG-El=VKlEdCA7g}ZCYa*<YjJ)~8H
z^JR2>TH6nZ-(K9R@B9u#;LKn&E1Vfji!y_04=XXX`g(DzzKgYoja}8B3vSitW(7Nw
z*U5~IxK-Z<iW;|i!smip_1&kh$_z&Fe{rk6C$$&iR(;Rt<cM3%7(ABI61SQ$gcFa(
zt!DJ%Rx^5Ws~Nqx)y!Vp>Vm8{^exq+kTae-mQfJCn(;J~>z*U|6^}DVehO#Ikwb9@
zY4FwTUifNu4}7)rp8{VsT<}%H4PVXag|FuP#Kbi%dFMa%WV`pDoNNpJ#mTn)U&B*p
zBNsVt_-c+DzM9huUxl|)^*wIrT>l<4zMPQCK+j(7CyzD9&121R^H_7-Jk}gHk2Od0
zSUd22^&x0CIc^|pjvL6DlLlnXaVFrLt)C++nxLHH;<4uR@>t{lzEtMl++H4QZkY3_
z%)hx4InT=co9p7S=DK*SxzP*YN9NyL7mqb}8jF?lZ_^hgDbBySt(<Bw|4x7$H&7-~
zV=MYh?gC<0W5!mrqg)q`HMbkbia{#(sL>d?mwR%^-HkxhwlUs5BBixYIaY%XrPbd{
zY4vwgTIYGX-uR+IIIVfToYp)Sr!~*TY0YzSTJzkT*1o-**1pwDQgd4S>UDrN6Z-aY
zTJv0-);!^~p7iAy|2^nIc@C$w>((#N(tOr_y?oYwBiQ^s-p2>yjQn0cYoM3U8tCP-
z1_tQ<NIq+zm(Ln-@mceG`K<XaK5M?4&nk-WS@T_d)_fPAHQ&W&&3Exx^Id$_d>5ZJ
z-^FLmU-AXUPT{lWyZNjIE<S7jUOsF89zJXIKf-4%`jBfDkLLUpx%jL_n8i8qk<VK6
z3H=D4wdhmI!e=dV@mY&peAc3W{fa1s&sy~Fv(Q$f`XO_Xi_cp0)!?oV|08_XqHpVt
z<9g~hR7}x#l!eb)^nEjA;j<R~Kw0>#ML$s%K5LPS&syZ-vlhAdtVJ$9Ymtl3TIA-l
z7WMF1SAOmAS&Mu5ti>)qYw@X}a`s&ES&NqwsUsw-;?qyY>O=Uf#b;2~eAbV@9+D!T
zwK&C+i)ub=v5U`Iyy_#AknmZH-F((UhtFDpGVqoRKNhp8!FM`JMx2C#^60IEk}9Sn
z_?41TO6P^h){<^yE4KYg#&(_eO@ZdNmbkdBB`$7jN$na$Dcsf)7q?YFY8y4TwWR)r
zQa%ct)Aivu!fh>ykZ&d2){@DZbtT-^lBO51b`6u;8v0hattHcW_j{G*wwBDG@;SM!
zi@z0aYl)lNS~8oZ>Tp|2<{X7_2;aw6jljLMQmGJbYl%e#-^Z@0#+5jgs8@4aOWLU5
z!`I(u<4S@`Ck8ZfTMJ#>)}U}(fBd#2#U)12WMRq@BRKhd$g;!;Hcf<#B?ji{;FLd+
zwWxj?AB?iVVbc@kTIfQ#miD4tOU+lYlP9Z=QXQwW>L_%fTnE$?^srn9^srp7{Z5u0
z0~!}08CiA=aIstmOui8Avg{b(Vz~}*v0MkloGg;%TIgcA7Wc4Rix1>`9kT2wUcjP~
zWk>O%jmM_gp1Bw(cC%ayT`bq)UY2XIt{ac;>cuXWYjJ!P8o01ri(M?&Vi(J`xSc}=
z-XkE(wb0FSE$d;qmgV<mw5&if%5_ayf9?zEb<LOGb6r#ZgRoo+T`bq~UY2Y5Af`o@
z>*60m`;+BbKAeMn56iVYo#k3C`&!Cjxt7b$m2z0F<<3?WS*~5r{tz11J{%D`U$;5T
z)^g{S6$jbc{c)Q{wif&-$ky^1k_U}!ZT(S@t>w<Hq=Rhj{?g1rww50)K^$ajxeM7^
z?n1VfpT;&I$ky`HiMJGFYx!C1&~d!UiG^RG3)x!kLbjH>kgerC$kxoC1ld~dLbjH>
zk*$R;WNWAw*%~@S7rjAbYp4g=y6mSRrBQU$&`RI&%-khdScF!+gE2mAc)D)=X?%){
zj?fzRPJy_FE~Np~sWDlh%lZ6usm5f5*7EV|GUE;S46S1mS+23Jp)Sh6y2jwXo{w-h
z7W0L+kbT+-9McGT4Y@$CAs6U1wCU9py0DO5Lz`J<LV68t<(8n3UPCU@YlsKRcrrBU
zbphhNQLDb9y_(+}x>+i%aIfA64c#KDLx2t4Dk=%E%+u{!?b`G65Y2)OZI{aq3pRAO
zs16G@L<<Pb*kQqj?$xT-VZny(6V+kChV&T*87h0PuwV<jS+EEHQd!CuQwEycN)6xz
z?P@d+hXvcU>6encA12`HejnoANPd0%7a_k6)cfugdQCsjMSdOVBEJrFkzWVSk=#1u
z*MZJwlMeZHU^@AAptBS2kY5M3Nmz&cnl~^Z`hY0NuU&`!cUtO<1Mx0kfUU&)ViK)?
ziCz#9{#tQV64h45y3_F2!M*U;!G+7<D)86A#ZN=lo7{s-Wb>O3?*|9zEb!OCrIZ62
z{yKO7Wr4pAF55o~MTZf)Ys{}BHTZS#a9$Sh>);U*#hJ+S;HqpiOce5%t}}lX@axcm
zL*e8CzkcxRU^VcH-$HZ9cO5!d?$qJC4jm#Y0&tifI#j}HzU$CorywG|TQf{bf_&Fu
z-F(-hej7SX!!o=1uG0z5WIqY$*==~C3>(~@AMPf;4lmBec+x|Bef2l)_x$>s?DqtF
ziLb$mm*G$LdxAqaZR)lWtlR-n@*5n=@j&nQ9PzvC_XNjqvgLlyHNVS#Pq2nJCB)ZY
zt-e9M-xHj`0YUbAg8LF*zxrMFdrAwo!jtUxlos+NF-?3eEz)u7{hrcdiIe+1r6t_j
zm;Ij79^z};AF|(58e#<8?^*eW?Dv$8mhyLqucc!}b%?K}-7|*}UrW=8uch)t1p7Uj
z_*&}BD-Q9s)OjM}5MN6tNX!oLwG_nHk$(#DwX~P`dd#0fd@XIG^&-UA(gbA^Umy8X
zh_9vT#Mjb!PNqqG{pC*~zLvU(ucb$^poREa+D&}DvRMi7wX}!$dgXEj;_H>0ln`G_
zPrVXjr4V0BUBuVY<%|x**DHThLVO(&xC=go_&TECEr#NOSR?vVr0rxkDJ96)s(hJ2
zh<vSbAz!QXlNCX}R=JR`RYgp!!lRL|RmJZiLXCVK8K{TtD#+K71xq1o<m<@(z0r?!
zAzw!pEgfLLrBweEA6SkYzyJby9a+Z1eFgG5vYbPvKwd|>Ag?0_G83?F2zebj=r{xb
zQ8Vyw2INb{qvWQF`G{y#!92tvq{mVH>BYgmlHZ#90gMa$)7;llg^x-^B_qlZg51|p
zL5ld;#=gvpr^^Jtjv9~!r}E&a5V5Qp{5oo2t@fpp*2WM9Ac9{<RW#9W#i+4%kKb|P
z_n8H_Jf6-1ejOF2%nepXtHH0Ms*i$Le$%MgdVO?$C#=U&`_s~wwaTbgmV#m2Gz9Jz
z<$%GD*haN+=@2x63n3>MHflVv0P<YA$Bf@PAt&j+%vf^}<au;oZnQ3f+(Gv($OhfK
z$I<J2V%N&UqZW=j0@vh@7wK&1(R|cmF&*{YA4C}}TKi?60*u!F!lwqM{(wDHHjW<)
zc}b%!b7-_>HI*U6$H#hQwG8Lc6;?Ju&yxoEv}F_NMfkL3^~({1@M+5$HbNFYZP}#j
zAV>9hUDo(3q7goAnaN=Yd|LZrd@iH`wPj6rz$*Z?Wz8=#>5TbE!Ud=;a{+40X3>iP
zYRhJ`bOlgb<^t4~xd63gGNX0_YRjA%)dAF&^>JoY0&4AWrYcJPf$hPvxlKp}$FL%&
znn*jkPW=ZiE+XydBh^s@u>;IU?xWpA+R<(z?PxcVb~K5!C^r9#Fgr#cr^8qHkI#p4
zyyCoF<^Q(U4{ez`1yO@iYwylfL!(ox;f9kFbe1@Vl?TR@+zTI?qc|o=5tv%|8dLfZ
zossj8wPzxEy<6=GSxV5gWBU^bkCoX>`*6TP)Ft-$S$J2l6B|)uhqCGL`v!XPw%a?i
zl+bI(x#+dy3NIgo2=uTuu7_UR4!81(aiuTw8tJv;y6LrcC|e1>c3cm>*4{5$3BPvS
za5gF7*N&@V%)+l7H<GeEs~<Otu?xR;+?c;suo>Mw3`w~7wd2OKNeRDpT$pmF=GTs^
zi6N};YsXEXyYOqrP28W4ID}t2uAW6I{MrqM8aRoV+HsM05VE{t{H%|WqPD-syD+um
zU6|VOvTnzdBYU2qMyN_VWvG(jJmI>eg2xmHgSKQa>s}bNB|QvUd#9mVhh?I~!&Teh
z*MZQ6*9Wi?&=k^eH-y$6pQB1r-=M0(F6M0bS`G-poDDlKu#h<$-pZ{BVa|rP9R^vL
zv*GLMF38#NU+FH$+3<~Y7vyaCCb|o9Hhc>g0s%qJhHq`5Rw2yU@NHDE`*9k&K==+S
zQG7^?RusOIN*v$8Vyp;nr_w1L+Hent*6y2&sqXh?c(|V)@cQqHJSY!P!5hCfqK|~#
zY}&A!O&fNzX~S+dZTK;^<DdDKu#E!MY}#<cU=*jYX~R#BLI>A|Rro1uCS-xrhM(3&
zuHm%dXWqg5BW&8Ri%lDLv1!9Ea&QnfZTKb1VAI+^<f=$D-<Jrx;Iv^EoHqRSr-=F{
zZ6Su=VO9XAwGZxt7Ly4j>|)V|T`byg4~y2mwvQ4RZP*2)4ZC2p;V5$>Fxs#SMjLj+
zXv5R?M{?!C@XR;yR}c2#W`+}vY}f^(4ZC2pVS&*$dNhnSJo_3((hzQKL64M3^j?({
zi3>&>?uOCYEBvZN-EVL7!-(2zKjK$HpADbH{#kU2{f%D%KWmrgDdEqC7qK<UD>>oC
zY#rdw+O2u2B(jZd#08)Yy8yJ|qxG1e0kq*`^_Wn6iYI)^T;vo0T6+s3Fi)O<2wc3`
za4&B*yy8mu6y9uD^JWD%8}7!<+TZ1=;WNpb4X=?AguK}~P%mQ(yvg7<wBfaEVcR`k
zB51?w9zv8^#>;2{S;jhC$TC=P+2!^@ebKkMvZ;0vXRBv$T_?oZ>Y0><I9u%|&Q{0%
zjp)4dqBu0KebxxX2I8zISo@y~A?sJlYQJVs*{`bohOz)>Yro|Y+d|i@1#mWnw1hZY
zGnWx*;%rS)izLq09H2!KXKUtZk;K`W4lR;6TQgsaw^cwqP>auCY^qtHMFMAQ7HW~e
z*_uUKByhH7u@*0#lL`4CEt5D~)2T%gXKN1D;=KnzT%tvqJ~fB%UNmvG=1?t?I9qeX
z9Be{okFX!_r-V3L`z9|6aklm?PTE48t#uP;YnJoVvO#azg91vBvtY0?oFHc>xRJBq
zvFaGHuEs82&FQ|8unc;Tvo&Y*r~WavU^H^J=1iWJH0WI04k%&HPDo?U)|`DFuRmb_
z98k4G$4^3xsVCu*9Y*^JPMq^SWL=LFyD7A`l@Fu$dKS#eKN(gtXY1<K{b-DuIa}vu
z&epk^vvqFfY@M4qTi3&!#mrR~Rp(%)5#(&$G_?(iAZP1lDsmR8j?~QAIyZB+ZkBo*
zmxMW6x4%}Rno3aDs(!^4Vb0d|GH1u&7FInz3b*i2Z1~?)_mo-(o7B(Kh3lSH3VUVX
zs@hh85)5sf8$(;?#?aQeF|>6(7+U-N0!%Wu%|vu>sB%QNS~#>d=U#(!vbUnjm)Bjt
z2-(oPxpn$jTH(;v-M~5)4sD%_LtEF)p=BxEd{_%x(~YR9x?9eJTw&<MZoL+=kZJ2~
zOFaoi(6n{8Gk~CJ>+bvpvY=_}?&8CJLDSZ`(6n{;F%yEOt-GJHplR!NOoRVrf~KuG
zZz*m-(6n^{^%N9Mrmf3YE%4<TsnN7`1!^?X6Etm|8%<l+gQm4Zg-Y18HRr#AXoO8$
zcfL8cyMQiW9)wL>=VH^=x!AOI7gZn~Vbj)K%ru2fTX)sd=n}%Ft@{h(5jJhz)wAFy
zENt4E3!76&td~t&bMZXte*BP4TXV_bkg^|xg|oK);%Qh43QqL$V|Bg=ZmVBQIiq-)
zr+!@ns@y0(!c%_*rGV~6^)8NW{d&3!$F}}T%2kGDv(|55BmmhCL4@|-aG|021W)}{
z^b##T%2WRrN-<-~bX>oh<ES8R>#t$B4vo02-$Xy1ni*K{LfqDGJ``<75V!SPM$X|Q
zJ|2i&zm<ixIwg$TnoC=8cfz=>U;Zp)J-^nw7`OFjasm{@ZT(sN+CmVw_2>KvSrE7N
zE9s{~_@S#P3*xr^T)9CaZtJ@dx3JdgFR*KiRe^wR8?LqCq)WKrI{J6e5Z$0#`>0~r
zA}3Bk>D<hF71C|PEtDG!E)g4Ur5r6j(bI4nrI`NmvB5>YZMc)AE9BdT?M$Ro6Birq
zVkrsvw&Ct|t(=QlN)7k2lva4WB;VGo-8LT6R`%r;2-a}k6wEQYlp0*<+lCAHYNw!Y
z8!o&Pa=?h7!!}&>I^>|Sawz0A0VE(8+=k1iK^6>d!@3U0g28RLg0f(68(bLNaSbjG
zZo`H(@FX1EhN~IC;o#O>F$<Xk2iJbAL=~5^p-ysPZzrueRaf63_E#lJxVMwKq`=6%
zouu2TaBnB+b}HQ4Nj3{fn%E>4_jZztdpqfB7O-${CtX8XxVMuwQ5Np)q-}f(F5KHm
z*R3Qid86juPP%?2<SoLzt?8PJwViNpCna+*_vyl()XlxM_Xc6b#7*RP0dXRNxt+9#
za)rj+PU^e{vS4l}E!hp3m|OTijC5L|+)g@zvQTa(xhS`jT$I~MCl5rngmOD+`TmfF
zayx0|vJ{l1c%c@xTJx7e<WVrUjeXVrXfPUc+t^PngApV2jmChw5J7};+nBG0V2~2Z
zZKIoV+vuj;Ho7UdjYW!;Ae7t25`620s0DM|=*HYOx-qwnZp>|?n{wOOL%Fq^24M1P
zMzd)gq|QQym-}n`La9)jpser{ecL!#?S!Jyw~a&86OaXc+c;Ex3`Nkljl)zvOw=u!
zHrrUGN}ve(wsDjqb$6G?8>QiK^*of3pl=&5KMS(qZC_~b8K7D;{1zApDIN_i?1A6f
zW|<mpJunv8ano<XayS-6A@p0|8;Vh~4Vr!nd;^uJ<mXMDAEDnizO8;kemebK_FZL|
zi=K!eSDOxjnchpft=W7MbOGHq-m??3{y3oVUcZIpH0ZWb&zl0eZG4~r?gF}P+{vL@
zK(~#LFn1LKx~<vrEaTLm+r~{lGfskTQ;pZMaR}+QaWik8q+8tRmM_t_VJ<(3N~qcD
zgW)Nl+sH%jLDrz#h(0`CK(~=c{=^ep0o_I(%WP+c2)d2z>H|5baj%glheH<7ZRF`F
z<f@b=-A0~042qC$BhM28B%s^K3k)Ej+sI2dLl)3&<dr8O3+OiT>PL_TbQ^i?H^>6I
zjl5nym%}Tc^+(=dJOa9nyvfEapxek>DHaiICX#MzwtdFCd;?|kbL5MS*m5mC<mBa^
z$d^M9k;fqTHsS)`M!vnCJxPOaBj1n1-3$0O@?$al3-~tj6YpNYw-FckHu4)Y1n_MN
z!(`+S7KM;+BOb+~h-va|#H&~qLcWb;D25U6Z6r&vGz5GbF%*kKz_*cH#qtpFZKRJ5
zBjDSJU$JynXz*<$PqBDbr!@IC(pUQv@@>RTzK!&fZ;{a=#oH9{ZKOn1AqD~8M%>`r
zh#Pzxaf5FoA;mHi@NHxe6wGZxzKsl4Rft>2w-Gn_HsX+PHTX6%LRH`<1biE*(gV}y
z0=})e>pE1~z!Rb{qzJyPx%(dI4*1qQJo6pYpJo%8F7R#8W4g(==JA>17Nf5Hro9kc
zUX8vr&&X_;feO{=ThoocHQnf2^Ww~x4n!l?A6J`h^sVVe-<odpt=WUVwLd^|Rb=0q
z*JZLh3;Wh|vv18F_N_grLY1nK_M{3Wq+8QXx;5|0Jog}ujO03+ZqlvUL%OxEMGP8s
zYwpav4fz(-t?5SHnonddhj}fiTl2}xgJ6~j>ehTZ^CvuG6V$Ewy!IxjTk~()o1kvZ
z7qvG*-I}jw&PA>~N~3Pgbkwc+P9_&GenH)u|Cc!*wGbAhr1^g4_cV)?M%|ies9W>X
zO!l3aKr_wHGN&PlxYDRwGYxfXrlD@luQJUeupiJVs9W=!%>6pigMd}Qy4?IR^KfX(
z)KGSR^S_yVK)zg6ej3KLGytxd2EaAFSsYr{Dh<FjGqPHcnJr2KaLqITt|<WA)OMu_
zxMnW_7me4<)l}VGxF;BKW}hq$QTU>kTwF7ai)*HFan1a!!;e4>2^ZH)<KmiWTwK%P
z;tm2B7a2AO>Lk9$_qAEjDzt{LZNIZ$18ZKLXXjQb0p^-xvN*j|34_v11Lm6J^|b~8
z=9<00TzfHsYhte1m}R1=;X_*zbImkjt~oi2RHvmv%r(=9x#pBCT?InSHDfv<d}vEz
zu9-&6HRohKkE+9mwj}17R+fzt+2{~+%`{@JnMTYt(}=ld8Zp;AQYW}w7@cN1F}LQP
zPcW`H#9VW^?_1QMzpDa?pRQrELd-Qm%w;bVVy=0XR)m;qp6#22#xBHM^Bmt4C_>CN
z-Nan;Jl|L71wza<&)13&b4@of*K`we&8vL}AvTAYYhL3!6Pgfn%}u_|P=uIk-s!t?
z5hoB@J*JzOYu@X75Z;8CYr2WK=1$*ZxFW<{(@o4ZpYVNxD?-dQpZ59C3wD)jVy^kT
zZwNFY=9(}1*j+%(wbu>9U_?Bwx!cDTz2I@p*L<9A1dnUJ?yEvj3?GDAn|plh>4wwQ
z{?Es*768{|6s~>brsJAvbX+ryj%)tI#~~@K>9{G6nTE$T|K;N-8dVyPYo_6G%``l&
znTE$TzxHt`>kvAw`K^xw6h@CHF!7l`_&AiUP?a=|%%6O;4pys5GSO4!A3pYU3?GE%
znrYBnGdF{a!i`EpbIpDk+mN*_=)Tw`G}EBDW<iD@$zx<8G}r8}wOtrHu|;GSYHhcw
z9FYsHIO8qEvKMCpAb^<)Wqb|wb7AS4X)IlHa7JM#pE+oju9?QtHPcwSW>p49(g0Yx
z97)G!a3l?SD}#P$6Ea}=;+@Y*5_Zjr87JTx#u5^C&AJk;h6S-}PRqCw7aM@swI3OQ
zr>11=nrVz(vn}I!c<B(vuDK-RCusO;pNw5Ijj?MUo54|Q8Tzk1s7jUfBY?|1Nju^L
z{gdsMDphWhpj&g_?@?HQnxH#5|EQ^GVLVf7vWuWQ*+tNuT=+X?K@fE9typrXG4_L1
zN{G2N51xX+y~Ny_hsXi%CFa)byb`()bDOf%-=Js$WK*`PLOT&+Zj+&!kKvd>Vs2B8
zUQxgxCo#9?(Ki|XmqHY06HdZKKhnh9CJ=KkLKq?DHo1wpO+Cb1`|OcQkhx81$lRL8
zOvEF|T<~exIsJ#(kBr1Bh0NTVr;q35w<~bVQ--PyP{_=kGEA*PDF`!nN;)$)Izt_S
zYkEA4&Qzblj1p#U6mPSlK?*ZB>SpFf-OSu*8Z$TA!_2i08>IxA8;z@rrlX-~Xl}Gk
zD^Wd;McvTcs2iFabwhKbNqwW84m5YlNPRb&KL&XMx+x!G@GdkocXGcjh#HzZqhWI8
z=TMBUD4NL77_uSY+{rF*?qnA@ck&3-BNhqIV<Mm24bHW#(F){T`=!xpqNUNf(FQdL
z1*I`GQ8zj_>PF{ABdQ6$1f3f-)gmZ@&W%o1r$MQJ4cj(GmG+&Adx%EWcDR9)YcC(8
z-co&RYpenw*M4ZMatOJ#+qki-xtg`xy6>CM5(bU1hmTVeN==M4wVCQ}`0DdJER)*N
z>QBf6KekUAr*QHE<l1~MKfTt}+}Z*!4>Z%%+}i$LE{8QWx3<vBv$Zufx3<X36{n`=
z))sr&^ffiNw!}M*GO4+>LGJ|0q~_L^dWoae)ZE$u-Y8{Kb8E}IcFA~^KkWVfP(t1W
zFOZa5JJ8!fnWWs>LEgobFR^j3qOfvnhf99z>=VW-2bNpw_iltYUHr9fSZ-~VH=`LP
zB(U7tk=|wShSOG2n*z(NE%k8&*#DkAI;=p;wJ!=Q2bbIUA-8~y_a3+_tjNo?Z<?S0
z%zfbb396fz+qm&PjB%Qn+jtd4A?7yzMLQ#*A5f2)nA>>u1Gt=Ja35TVxs7*nXF%6o
z<DK1g_nr2%V<bFjVs7KE>K;$K#FHlGHunFUi3>u^ZG17QJ=r_!a2B*i<~Dx&EuF5n
z|6ZqX;7Aqr27ch4fe>;Ve`EkOYCFFk2IR-JxcpyMsvvS3f29mWu05w-2_(1ikAo3H
zAi0fMN)u@b$!*NmvOsbh4Xp?yw=qW@idY1a+nB3|NI-J!N9(Z)y3F2FuN+KnlTYs)
z>D~*uyCha&StXd<ruVp+qzkI)z3$7`!70n&7%G_Drl~&eEJ-X=ecj%kgPUM-n~Hqg
zZPJ+Brea?`rfvJ=2IX*a8^<ahP=RJ}M+1gV&0@UY$%}w;K|OtkKDb8;=qbB~vsL%7
zvsFh>E}*9@S^?z(ddhYHP%f`Ls+9`=nSG%=rX#EJpO3K!(9@q0CR}mYaff&sA6K8v
z^rI$lcg#_rl{Suz0$JC-Y!W&wGZtAbcPD7w$VG?4-qNKLxkxT(v~Fbc32=9zbt5-^
zMUQ-eD&j)xMsDW$4T9E<xX`*07g{&sM(ajgXx+#iw0?lrwP!Wr4X&>qSlXxv*R{7r
z)W~5It1+UfX|r#~?H3<=sAt;#`pJ)RC_4PKIr{mQah&~iL<w+rTA~9UHE?%&FK~By
zFK~DIgHOUkmazlB0^FT(>He5lHE?%^3%EPO1>BwC0`AUm0e5G(fV(qN>t9BkRr*QH
zj4OFh0^FUkf&2(O1tM^FhW(*Vo;ws8xNDxGjzsbT+?_eZw+@O1?#^@rcW0&ncg<7P
zCWg_#UGsi56w7`8^;6NPOgC`X+@ZKJA;4YpLG=L?0q&X)X+?m$=EK?>fV=iVld%`^
zZ3OW=s(y!Wq3fEDsqzKfr#du>E4#FBz;*2{lQ9?1Kw~nWRwu!O&~?pcl?_Gcy5@7*
zx6pOX=hefwB6MBzZ|YMhLf184P?<1~g|2J9s0Kk1x~}<>ngT`Wy5`I3F7ySV>zc2q
zxeIZmvCwr*9Kr^FLf184Rr{fZ3SHNHO{H+<IsX=WS(7TANR+Pmrg{W!dj+Lyo~FVm
zK|$%7+tfQO&VgKP^q_R@N1N0XP0=;o6kW52qH71ID8cBOy%=2^r|XuMZDGB*LAquS
zNY`Eo4-*3{)?d_<$dOQUO*b{y{7paJ6>6^8L(R2cLC_^6<eFLD*AY|*xn>$6*Gwbi
znrVbwv%mLq1iMLTLasT$%MCiL9!SVFdkMMrtSBCYUCb<|A#%;3-v6Thu!!KRab_AK
z*Bs&Hn)hp^5xHiSmlh?~5PT!p9P8zB)(}LlqhZzXBbOrMy?j`MRl~0s-^^-Fl*FoG
zeqY+{HQw$mhz(O!*<2!W&3f$?6-2I?hR8MdLFAfesjsl!(1SZ<8RZ0#Yo=5Y^6L-T
z$4^BE_#ETCxk~#M9Iknu;`W6EJ<kc+XX*pnrz-Mr?XRY(ZXoW*xVJ3hQ?#HyhuKS~
zt2#B)-aK6emvYE7-TYhgcpojtZvL%#ith|8#U+hXoViE%x8|vOmF|Bnf+$YaYel>x
zJI36s_Zj>I;+k8;*<WA}nt>*DN*UbT^jp(Szct<TTeF9LYaffC8h>l{;BOyTKSPm!
z`@oYk6#=;R-e$E{y=b3+)2^yN#TeY|;@vjiz)??lx6LlzZL|I)2E1GQp_r;n5qR6|
z0^T<3XQKkVZFT`~n_a-$=6hNB0N&!a`98`~V>J?MzMpbT9~IT?Lf|$(h<VRJ;5NGu
zxXll@!N0@6ZPt%5gn`@q2qOXm*FK{~RW7-nxAr)l1cKZAB;ykZZu3)I=L-b4S;GMY
zg4_HI7vO;4qFS4urT^!Q9R-k|W7mE$NYZU{4;I({vqg>5Pvm26E^f@t#f`bSxG^^u
zH}(&;@+g`GE5_pX-CW#Q4;L539Q&vCcBudReo+3UN0RIPWaY;GO(o?KSZ>S>%Z>HG
za>MZVwSLs~g`e2r*f;8{rRdm|tcKXPS}_Em8~aXe!KDfT=*GU+T8991W51|%$n08G
z`B@dh^#XLq*rR8w0b|Cad&mCJ=ecbWgl;Sip&J9(52cBr>i6mP2?&vT9ql`o;pO)H
z4#DNda=dpTja{m;6Wt`1hRcoh;&L-_O@={ih7g+@OT*^IO1#YJ9>M0u(y+O)kj@20
zyt<h%f?{dh+*lenH<rfDjiqsOW4+v5JH9_QNJ+?zwR>5eK$Fd`fR;wcjV1Lphmadf
zBjm=?2)VIEQcgn1jkyT9i1TDUR06U@KyIuTkUP`3Z3*7a-GGJuYG2F!bw{8FlaSl;
z09&vSa$9zAh7m$;%Y#}LLT<}L^h83g9iD@&JmPR$p8OWKg0Fo^!)<w*N`=sHTb`W-
z-}u@$ih^%(({Nj!=M{&B+v29-w!HM~(dg_#!)<w)3O))Z4Yy_Y1Bkj)Xt*t}QOO_<
z*M1Q>SvU^{Qp>wD;oZUEw)`KJy@JDSdGAIj4i2})jl*sEh&gd^xGkTtH8?ojmd|;w
z#NpagTUF_PWZ$;@n{E#Jw&iOo4*Is`TPhCvw&go24*IsG2YqW_)2bZy?W~v1XTiT`
zf6=POloEd1?1JAmzr^r>-`dp{_L~;iEf&VnJ!t*Suk(t)ZkykrEU??=Hz^D3w)ri}
z-LTtOm+qQ+nH%eY-BzMaTrDRmRvdr$;hxxLtr&j3xf#1oaU>J~ZtO;_1pO09z>VFi
zwF*tZjkyW9u`~j1>|Qkr!^5Dz+7)qFjYQza+z8xQ8Ui==n7R$VfxwN8^md{O{8w<`
z8120V=AXy^JA3h1t*odd7B`lL#f^>EmmDl^EDehr(^%Y0?!CTX|1GYnQUv41Ch1f#
zz!;1=4U8L`tUHwh#*L+cabr<^%>m=arg{%YUNHo1;t;f-mwVF~W@ZGSP18Oxu;g*@
z?ZxGi&JmlT`zA&f@^WJ{y?j0JbK&L2n!S2sTzI*$US6(!bDIJ%*M7Q99achO?(CUQ
zAa$IviC>49Yfnw!wG{$#Tik%$mh)eN9|7dHT*z*r0l6)!`P5GUxh)s*p`QS9Th{QI
zp8#@OE}y@ctA6rvTh`Khg~P{f>0+1C+omlpK5omE_2{d3RgHk$78fA5#RbT1aRG8$
zu3~EiAlL5Ou7r@=ay^|qnvmP#BILH*ME7n&Zp*D493*Ewgxr?fIW8C=<l4u#D?#Ko
zeahWcjmT~Khkmmn%Lu_GTO)FtJ~{`ozK^DlIqk@Dx9PJgI%`C3(?9k4ToAcU|C)mf
zSq4K1BDZOlx&?}CBh2dAjJO<bO&XEgl<nI|-x`tIWcc3h@ohMU-*BU;pYInqk03L*
zDIoGIcIR9r(A=h8Xl_%1j)2fyd-Gf+)ZAhhHMjUs9$+BU+~UJ13pKa+@Lkzl1Ziq+
z@ezEF&)Z@jkW?qCo9yS4ILh}C`^%&faPIzYaPIzx%sGztd@X*x|FSC&P$1{pbMQx_
zbLSL4#0vp?6<jnsHx!t5JPKH|b3+9uoPf1FjyVhUZzyE>USYp{06NAS*l`a9`KEq_
zvDW_M09Dem7`sZL5NknLxuJoSg_Rp}v2sI$=`O6?&=ATo{T)K6o0V%Xo`;@5GHz%z
zKZ+GHZpcN(4Y|m;p=v^Xg^U}jWp;&(8*-6xLoPCID4mQOa?TEL$he_KHdCBUkP<R(
zsGD~oWZY0U??TA9p>#5CD4mQO>gHew88<XlqISr*q5VX4$he_tqJoS|Fm7mMIvF>_
zy&>ewA>)QzWL*224i#!38aL#8<L#hvL(VteMB@&@)p;!IFVGYkP`_EmK$yGUBKw;T
z6;vKOcRq&t!h><F=7}l=`$FKj)=63sIIeZFRs@b~ovLoX2nK=%AzG(tMc}yB8R|h?
z5jd`Owt5VTz;Uf}6u%!7IIgu)@v}LB<65f}+PZz`d?j>T>q7N3f;9*o*Gi+~T4{7#
zYmH+4J9JztjgD)j(Q&P{itW{*<67&q29)8sb8ypFXl*s<xJ$6`wYszliXrK^)_Seo
zBy?PBgVuI{j*EM-Y^^=#8%o}db(P}Rzk7U@8U^?lHFG68t*^2Zeb>5LYoCLYXx{<I
zVv2ZN>soaI?$aZ9Tq_NaYi(7R;95ZNxK<h-*ScO^f~aAG5<O<6(Q&ObI<9rI;#VgP
zpyR?Uux``mphq(*pR!{MRGx<ATD`Db`_Kg#9?I>@7T^gSU&^u`R=2FiJ`ljT_KpP#
zWL*1Q{LyG!YhN_3wJ#diN<-t?;}<Gn<68T&ajkvXxYoXGTx(x8uC*^4*V>njYwgR%
zwf={VYwgR%wf1G>TKlqbtq;WX>S5zrABuzOX5(7>vT-dJ8`o}Kqy&y@?F+}X_J!kG
z`@(Upec`y)zHnS?UpTI{FC5qUA2_bHFC5qU)43xJ$F=(`M!jERk6o;Q$F)15X+EyC
zFCW+1myc_u@p0|@5Wx`y<XZaza;<#<xz@gbTx(xIuC*^9*GdEA+N}qv!7~WKwf2SJ
zT4@kmJP@-=y)w9lK*e3;hr<BJp&Sl{_PqzGn!`V8hI<+z7fV5_QnPV4W>kIwThtn+
zwJjNy<mOsw++1sfcQS@wEa`S<;o3+qJLPWS=31k)wg=o?d;d<13{znyTeaHpYXRq4
z6SVfTfOD;hT64g;R-M)yaIRIaH3yt)HE7KN=US7r=74jpMy)yETq~lrZg8$;YE^@C
z?H@W}dy|}N?Mu$J{)e2~n!o3CylNxl-1sE5{w!EmB<IE()$l7Z)aeN$9?^=BbK{fM
z*o(PjAvrfbMKxZ=?d9txK$)t?Q-_=zpQd~mj)j~XpRRaxbU;;hbi(6I6+`3=Am`do
z9gHFDB>Ss_@kYY?*n5a4)CLU7UkfESo<_-yCv^fbq2$I7(3(TZ#b<*Y%sW8Iwc|@v
z*&z!?BeFCeZhW!Yh#`78c(~X{ig#*lg|G6yJZJ}N4O0p!xrl&19ZGKe5cSXn*ftkR
zZv0Tyh0Jg9RUT}=yhI5mH-4;o4UW46lN&$YnPw_4whIqY!pV)FruM)KIl1=!hoFy+
zv5&)_38dl1&v8bnZW?ZUUm9*ajfQJK$q3G|KRrYV54W{oGit76a0Qp`ZBzeq4ilOW
zgr$pz+cu3~{R$7a&BeoQn=uD%U3j={GbuYf+_u<{X!aGt!)<HfgQzOu;kKpmaNFEG
z+%`84x6RGNZPQ<Q;sal@Y1;IOWSzppZEIty%Y=v9=H}tHxp}y4ZXRx18V|S4&BJYT
z^KjdGc)0f1!|=?2K-{*2rd<ysRDif`oh?vy1Bh!MOb=6{@UWCt%I8AAZ99_6*P!3p
zS01Luq=>(5Tjq>G0MqhJ_O=s5@5bM@ohZ7--@?{wJ4y5b@ISLJ^piy|g<cB#t!*DL
zZriDHy&H_%cADq_<Brp0+_uxjp_`1`c82IZWZc&N|3xFn_SwfBu8JrB2RkZln?GRt
zGYG<M+sXqG1ccjm9glSp5N@01WC;kjts8`EKYq9p5^mdVED9mvw%x8RIZeWCyMr=F
zxOUDF*ghd(tnJ=oabJSMZF8e=TZ`ULA!99bkY;P7?+RpzgotkF8c*G6b)j%u-6-7F
z;!^k*6mH@Mnrj+`o4AppKmrptMN(UNn>?96adX*qyiKxj6D}5R!o|W(xLCM}d%1=a
z7H;DHeh4cp+{6PMTZDz1*g;uXxQU1OX)##17;6$cX)SjGfMAbWs&X|MH?fOGvygEU
zPe=_pWZZ<__U<9$CZ3Y34jDJ0H@}69YoEPT2^u%?oOmJ{*S=+`5;kso{+lTLEMq0g
zpghnXy@$m@Hg5aWU9e>3_{w%S8@GMh74#c!pXpnL>#w3J+M8b(NWU~t+g)tj_7-{(
zHg3C%joUt()_HCP(q($yCHC1z;`>rAN#+)CMS?wrPRRW!3mkWDA!WR6ML6!<q5+7v
zJUTb{FtZS2xYEBt^cb&D9zfYJ@+g;o2svOJwGeXX7sx^5oyCv`(H$QJFrA9;FoIO|
zHFi)L!V6&ow7H{HJT;GghbG_z7O!<z<a|U-*q3$pJ!p4mHMAA(-G3!3o8T_%KFU#p
zI3VkO%0lP09-u6AUTX(sq4Qb~QWiR|^$=yD^I8v6UY0VxK>1obsVq01?gRM|$}5bw
zVvrxDyjlZ$tzDD>>_uy`9;dv~7)(p$Ny=LcB7Ci<C=0^ZdYUp2zNj<nIm$bVPd)Nr
zkM%s|T}De3?k{Fj0oB(&?P$D7N35^)0i6t`vA))aR04wawf0g8IxzFUQ^D|0tgrP6
z>l?%Wk`^eRQfUyZuk{(Hm6%|Ct$*?gM)E@ZvD{c+D-G*weW_crV14az$0*_YT3<^8
z*IZwFF`PBn*V3E3y<lJKd-2u{_O<o}`&vKdo{Q>kP}VQoFmp?F|5vJ;2sg_G_O*Uz
zmZKWHWBtin7P6b=QBb<UzLuiqfPF2mR+eh8ujSJUz`pi~W3ehHjLpi{ZbJ6846O*+
z*UHg~kbSLOt$^&yFn;wu{%rSe#{(s+uU`4>Ap6Z@_0#6WE=~Kj0$LH;FTUxfWh%5^
zeDRF_KGq|+U#n2DUIh1RrQv?9Ufi$!%dx6Fk6>SGfSQS((dT`8$Z=|z2K!nSYSxA5
zA^yR3@;D`AU&~GQwT5Y%OUS;~aIFa0*BYVX2nw>Vz5O^<TKyrL;z;!ZDnp}vtug92
zTo<%&^0Qr#HQG1%&%A5dCl}fOJx&c6xe}vT@++xqVtg^cCjTR9DBu|twZ^F#tC7L)
z?a9aE*(^D}R;?~Z;rLn;RUyX<&GEG+=?n_T*XrT;+G~!-^Vg~NO~<PVn$K&^P{hs%
zpVw;ED{2i?vtnuyE(mPba`SmD>`USb`MgKsZ=YA~q05vIdaZ=o-Ww>5&}+?A|3}}+
zsmL}q(O_{3q1T$P_J^Vgz1D$xBSHwh)&hMCB=p+%EK`E$wGI&<8qsSVs<$Y3noj~z
z^qI5a1iTg3-yVE|s!#D$rvs+3xeKHBfa%4w<PE~14w&&PoQ2VQz)Z><+c|+~M(+X5
z?<2Y_qZ|P=qjz3$14Lo;&Kp{@22pbGoY&3hMU?YK@bF0t{&|qAD!rKY1NsH0c_Z1<
z1=~BX8{3Pu!n`pwBdUszIP7H4ym5>(Y><LGZ~P+20`i>~J{Pi_5H-&Q@|`!~GPn!K
zcizOSAPdNMUc*-v9G&sfajs`xH_6xTJW&bCcb@FzIVfNI#uJsLS-$himm&_$@|`zu
zGR6Nk*?mt^^`!)ycDP`^9o;Zrd+|xC7;ElRPJ+3_e0L0`sQ`NKJjlbugy_OPUdNcC
z%Q&m-wjVhO51pFrH&0T+@9jwE_jYveX9~Z!qkBIS{9b#^$tpCCN1k<bZ(It%w_~a^
zI10eGqkH2L0AKqwgvmQEhA`cvUVH1w*u5pHx5I_%?Qo%bJ6x#V4i~Do!-eYYNU-7r
z)!WfdSx~(lE>v&F0knk#)!Q+TJH>+P?U;YQU4M!aR&U1w8eqce?QpSrJ9=2X_Hm~u
zz<TYAPQfS79LwV_T5o(Z(-vB9yos{VdgD_l3#~WqqV>jIwBGnMHcGrq#^-+V>9bKo
zn${bi^C(22^~O(|b~)nTRSzG_cU_JKEoM&qbiE0yX}$3?X$K0eH}0bK#?N8L6IyRP
z#bF!p6WCmF7p*t$qV>jCvGWP7H-0{i=}w{b#;sOlBFmV2x&73sc&#tb{^(RZ*(9$w
zegN|)yx#b{<Cs?*6g1*AHCp%m_$4FIXANTkB97|=XJCzy;TvE30{nvE8}G{Qf)6(F
z`1++fE;4-M8>C#x@QvG2u4MSeH%hsZ;Tyk-vM_w(E{1RX8lKmc5{Pfy1@Vmw#8)$X
z<1U78d@BP8!#D0?_{R0xL>Rtt7sEGx<IiX_!tjl|7`|~A!#7^xg80T=5a0OiFQ72M
z@U@pM$5Rm^d*d!-Z`_6Kjk}P&aTl^T?n3s)AK<zQ$X<IlqMKO9y@ZF^9y|i*jX$Ex
zR{*{7U944@UIg^UA7|ab^fK-8(^YBJpmw<R(0FG<d6vsG7+tTk_MT_9qbj)3UIgFR
zOE~RxHCzSlYoX29JQhA)XR<2<z8imo%4((IyYaWFtQGifd=C`|z8iPLckSO!SD^3O
z<!7k!iNx>5-T2-3r_AmS!SBZ1_}zF9e%C(s47|8N)^7YO-&(Y<n2P^;`FgZ3n&0u?
z#2zDSH|}EX#{bmzm`3f!#p)7+EG|};pmyV8bqQ)Wo}uk1LG8w~v?8e8c($oEVeNwb
zKqF3AyK%9^gtZ$NOH8wNVgG4wK<(O7&%_;&wHps;H(~9@^R)ujZWLDvw6e=jQ$5~a
zE6@44#}O~oitu;iC0Y^wZhU|?&V;`kFVl*FGxgAc;vr2<4Xesy8Q(y4uKmuLszg(H
z<NrhDjSo=+(P2k*#D}Q?Slw$XZ+y5m5rxVd@1gSAHD{^e`w`0<cVl_uJy>3DijCJn
zqZRy2GhVHD5LMjMhpgUsjk+3j*XLmSFJ~!%^(J3YkI`Jyu-@cutq80)`Knd~)|-4?
zy|M{yTf=&jZ)gRuUi+@IQMi12FS$qYEKi5ln~W~ofIUf}^(H5(kyj%H?XAwaFD_V<
zleB3kwBF=CwBF=CwBF=CwBF>twBF=CwBF=CwBF=CwBF=CwBBTkzTXN>>rKv9&*OfD
z)|<5SV>qGpCf&5&WCB+(g$S)TIafbFifLMJ(oO44cIev{T5oc`R)p4@T%e!O39UD|
zP%A>~O)l1o(0Y>xsoFAb(vsGj?9>qmtv9)(MYp!?{#&t;o;*Y=JN%^gCf)Sjq?_KG
zbklp2J@j6CZ3?R&9w?J^<9o4k;Jn}gzL%Gd*BaXTsr{fW(;9Y#^Dzh|PtaOWX{c}V
zM6Fc_)HivO)~W>Rn><DF+&%OWLVc4is4pzd<mnm=8wJ(Z-fx8xtZy<6>zho&`X<w`
zzR5JKZ?YHbYu}B?G}kwo#`R66aeb3%T;F6G*EgBQ^-ZR6eUoWi-((usH<`}$O{Q^u
zlWAPvWE$5una1@^rg43fX<XmrRl3mde(*?p=SnOU2=-0hsv8mB0p@Bwd7F9~ojvBQ
zd^8{09f~tu+*?W9Z*sf3`8XIWg8NOT;eL~8xZh+N?l+l+`%T`jXcn#j?zemlB2DA{
zCLh!}TnpZ>ec38ioO-Skt*Z8*MQB>JSqH*cs~xh?<MGv=4VR4C0SAHCRQo;LvubDK
zH@mhF{*Brj7kj`n+IcWf4))H+pX7=Z#+U5(;6Io=e>-Gj1N<Z}peToOCoklaT^_^@
z_tmt@U^c00d+52UCe^?=E`3vb9>jp!t}={TM3~fAT6q2fc}lMRKX@vyN_JIUgV=Pq
z^<1JO>$ftJEBnJebdxu^@f&*h9G8+;X%EIC+*$H!1I|^(4~%#dJ9N~@U66vZnM&Mv
zh@Q4GK&NpJ<!zK#>n**cK7xO{u?B^Z{3~x^hw&&Qx`Fa8!=`)_<>!p27*^X+yN#dl
z3?X?d^RvguTmt!anhSdk-5~CS{|wLP##FoGJT;{7-2-v`?ppXQ-<Z6QBcQR~zU(|K
zFUVj{?iBNv4CbVZ!JKq4n3FCBbMgsVb;4jyKE)wK7|h9T1~Z;MC7-1gwA|R-7xHtI
zSCo><oJ^-O`;#s#vmHKP1;-G=oZMZ2JeF4^-{PKw-UUtW;dTMGBVq0&-__38(?0op
zev21@)80)eX`wJDKVoTBNU)D*BZey2<o)qiQ<#&V41}0vwBdJDRdTet2ZE+BC&%bs
zB^2i5Sgi<!IXO-b%|c;Lrc;>h-~~!B%*h(HL`VGz=6meELe?1O#KgBC0>f<2zCa0w
zInm8wwl9Q}1~Dg6%eQgqNf2{lWyW==ObudAoXgc2_V>=U-@5?QGD*yd)kU}tBa<ZN
z#KqhW$2K2H%!y0%zPFH=6PHry6cTg7O=3>0(@W7F5_94Tt*dSlbD~T1ZW421z34^D
z?UOG=nG-Xd_zSo2@pc$WJ8`va=ktTe#5GJ+;LM3llm*V5xR$cOnG??0wuCb$TyW;Z
z*5YH>w#u>eNo;!?ox4-u%!&GIw_q^%3E5~!yp)~46)9t@WzcF>T>XOu&%3#Z59k-5
z60c4~#stQkc!QBt=ns?<-7seR@YOgi`5XKE)k<*8i7B%660x6Ot%S#%aPgQEE*^72
zULfk`F(=Y_%!%1fxq-)QH(rF-pL9vZ#nk~aC)$=E`vPQ6B)Fs!AalY6WKPWGI#htn
zi6mtKGACR>=EOX<3;{AH=JP(6X&`fA0Uz2qK<30kCa_uxW)aJ6tpJ%5i;sm;9!o6w
z8SPG=xs*7Bq5zo_hp`t4kU4QUWdSlLTtMc;Qo2`Yx^Th;WKQ$~nQct8ATry_FIIwN
zZma4&|FvzTZXNo3^S04dc-SXM<~9KkbR(JD(vi$<VO^TtNanU`Q5__6TaA>pgJf>2
z6_rTl1Do;iYl7%G(@XW!zKNn5(+#qk+Zy;>Ranh!E>?4!i`CrbVl}sQvzqP8*XXUv
z+t%R4tD9iVwOzpjm@#(wAb0VWg9bZC+j`!zfSTK`<k{Q;YHr&=SwPKgE>Lru3)I}!
z18T+`-1Zj><%Mth^e-1|-ld)3F%Nz>1(yj&op!Qk;>!y#;m#jA?ys1RCoDpCYJWPI
zlk)1t@Ll@?etoq^;y0uA3d|6hwU@zvR_%+Bvun@8uTh(XOHS>h@PkP?is@&5_(Mcr
z-l2*%AXeiLTvx@?c^*Xys^q9bOnd?3Gz3vW4*V6y3%pQDxym?&0S3r~GYj#lGRjfo
z2Kp(dpEwSAW-bR#LIQO{2K^Oz_q`6iUdW)->kpley9m$7fOx$Y+0Z==W~vjRv26#f
zo5yMM3jV2UA~$$ElMXqY9!^CkQOQOQU(gt(n%npdlXkSW2tVFZrzi$eb0Zy{_;adg
zZ76z{K*J4mT%?09!?cKhaSw8%|EX)9K}eIyEz-$t%f-j=I+}xYG+#k)x=@07j=0O?
z`3w9{QFFaUhbQ`&<G#}V<5G<DvB6HPo`%7w8`YxjL(X?Qo~HLCS$U(AWQ$I+zK_Q<
zb*V?q#;esBAfQbyf=QwFS0ka{0DZq7oH(vS25?(6sj`ghO&-s*NvxqYx+qg>6Z}s<
zkvgC0&d@cvM$d~gOBcZ3rP{~L!<o6u^pbk!HFUpRho5;BYgk?#1P4#8)7hUHWjm3V
z20eY*6k=N#{w&^G1vZ}f?^4J-&KT8q$9BAejXa#iEWC!y&pMr1)Ejudb$id5^>@}^
ziV^wNeSOX>oq-i>3hIE_i#qXVC6#JFULF6D>MGXl5maY0ujg{4-2`=ib|7^g)AOy{
zbI$CB6ti_cnv7=<mNIh=KIRCIx_~_^N%f>tmUz^K1JD+)g*tl&?{ziRH=xcsk(s(k
zGPNQ#%iz_EMctB`bJ+4_C{(_~kqc{S&T+?|=24eWZHGErcalqWueyl(Tg>KV$08p|
ztkYVLY=HX3DHv1u&l-<9+U67+9h5!f7PQD&aQ3ZRn`(<fcpKpoyx6`3T5SNraS+ae
zF!v1YaZ9TG0tl`7NMtR9<N-IL{F??jsq8>IIp}6K)THmE?LM?u#yv%~`POYodG<3M
zZ*Rj}Q^NqJ<neq1WrKwAp2Q}e<NJD$TtYxK*|XpAj!zxz8b=A-jcV4xQc2Z7pW!Jg
zk>mTLCv1oJR3x*lOyZ*dUnLp0_oaj7vL{+Pu-7B<@AkC1+Y=tS#Nq3`+fm%tvVHy+
z#hvn;fZ~|lmwo3~wxL_8(i~O4u`2%#byk2itDjo3C}uyzHuDFY^6{8lW?#pq`sXDp
zJ)SF|PCezsBR$HaJJ46qC(mNkO6zMd7fk+*-tnnrrpNPAf22S8ea2p;KTZ1@9_DRD
z>$|^P?q>!5fL4%qD`tjg;eHOX)V34CRtk4PV4IIV=XkG1IpOwMb`sAE&IPo05BlrW
z?s%T+j%WYRyCVt|bq9LW3G_7sjaFN`16=_hI`R7`F!4PQqQCbfZr^)_s+`RHs}REC
zUl=8-#w*Wl2*CU|!m`m(ETX_Du7nV+cDz^LZ5MXo4J$^G>A0<66l2wd?kK+Rjv|Qh
zO-B*sK&OkXJDyz(Q>`|1hk1lvS!{c|!(^g2MQ8UUtBb8~%5#=yh*2@rzOM`GT^(c6
zX;>aFV(hOz>5lOzgx4`%N`W`BoiQHgc<-$UG;ThJ^ECB$is=Z{k%2adddl(LU4cvZ
zhn}M%o~BC2&r0~I7$KgdU+F&Bw7|K(1=lV6$n~mh*wK#DQ*b&$hnVX<8_AvP@_L1R
z^LiLCYaFK!;Pn<K^0VNzyRk8fmnDk6r+KnY^$a=NGbH61QrXY5pZ?So8Koaj(@JM7
z_#WC15|i(w6&ao;GJyDx-umC6@5?wF2cr))Du!dIdDXd`a}QW4a@orq{N@@L=4$t(
z!eQ>+!@~B#604_ajx!)sA%c{6<T%c`^;8sM8)Cyiq6^?G*Vu6ry{0fOxFU^LIFasm
zl+z3nh_vYjN8yn3!T)CE(C$!8Z@WBZ->K`<9sQslk3TpbQ;ahFzdjp#e2#Tm&r)Q>
z5|2*p=YFp|O&2+r&%x#6^kodUD|$kAIhQx$^7&3OVNcUzj&mS|<nQ?3<j?Dg;7!Np
zJ&53??)W!$U*7K@&gGYIxykE{)Sp2CIf1RYyP@tybzsg|f%+co_+pHMQra7`d`(Z3
zHO_S%WveU7M0%88OO%*~nwC4hSeR#uFL$x;>250fr5ul0_o83k0Hqx{^)MLn>JH)=
z!VCPDWxR4d4C4>{XuybClc%#ivoaQ=?+?EhE;+u6>I&_3)`tt>xXAvOjYoa`?qb+C
zGU0(g6;S7UI-Y{Z1^Go#I{rNaUt3n!K`i6O3O-2jcovm&DRJQ6J24Rt^uC4JWWmLZ
z^B9UbK2KN@S~vlz2j~8Z$W|hJfNR5mHi;MAxd7iD6{_pz(_Js+X!`~xAld+pl*OKf
znTWlrjDb132e_ByS$O0@Fai$e{KZLGI|leDR{wYwUN|2?`*AM(#{P1nDvh$t0<_Em
zG@~T(gAPC>13Ea)Nz&X%bSK?O6Q2pU-fhpk3U6^vU4)I9Wy~f=H&;{(mmiGEspkaB
zaZOUv`Jrde!aI@D(A}IbIjTs&o{Z?kJqvF^V!;HH<KX5hq$MkGrE`tCEQR~waHUJe
zv+&T#IC4ME033?~&!gTw3qu&>4-TLVJse-OPf3nWo`pZ5CgvYbd4FEkKP=|}Pngod
z&<bc;F7YDE^Oq^wk?hL>IHq7+4aAMMp2_YjH_0mSEF6M@nSb-i5ZQC-w>y)3n<H}<
zZN}Sqg+EAv`oe!QFB_RU`;I%%QLMfIZ5Q@UDGF3(KLmOc>ym@~Of~CX`;Wh<p(B=Y
zTI;g}D=r8Z_s8E7#I6QnGuq=*Mi&&HH+w?YUYvM!rLqsY8gHuIYQe|(C_j&P#dwGp
z)KPqS2*eAucuol7YVF~>10Y_kT{qfyUag8oU&Qz?MIJpqBOC4A<Gp+eT-MXYTQUyf
z28x-6cZK~Q1W0||1UEJ&kGF6x#2plIWEHcfvaZ1&Zys~>r1o+keLtfUEaj!a$cx82
z9?Nxa$L$oqg$M7kUs7C$gnhFgqj>&EESKNVS+1wwrxI|@zO5J*OTf4MQp98oK_B*=
zLEj!@?oh~Q{!G!6J+=YGoH_9BZcmvN;^{5>k!#d|ntsS!Rv#6><(!2`JgWfTx+3xd
zgx-_=<9sA%%pC!TpO~h{_(9n@o752R`^p}>2}Vr5eb6QqRT=h{O=|eavl+C%+6JG?
zbB9qWQK$sZirkYCQFc&Ghq5a7Ic5K66IPci>0`L!ov+PpMjdC5S8qbunA=Jvtd%Xf
zNh;M^xhZ!cl^U&V&pm`ntx6!C9l2xogECPupSyCuVAS>M9whser_V!7{p#%3;26x_
zx{fz>l-E;&Q|2h+Gkp5K&ZfKZ=QMlMwd&GTB8glX<K93cHqLIxPq-6a@qO(y{7hU)
z(KreQn=#pj959YS!ba02kb}mN7|D$2(U8lHdG(N|o(j3bIEs-?V-APn#ec{%Iw4mX
z$Mu6eYa8USu?jV5w7#7MrNQW9-?<q_f^9`xFcvOFE<22uP@u*l%1e!F?GHDr@}bwE
zJLQzKptJcrH;}ub5Pj1)9i^SS@e`y88^<2BMGXng8jVM`VfG*IF03N@R5OtGF=fx+
zqNezHzIa|M%~S6L`}!?va0{)2eji?f*yO$8etRhkak1Y=KKK;ueZNoWF4+5ipHdd=
zeZS8rR~a6=?^c`$SG*X}{rhOFP@?$ov}UWSOkIrP>Gy5c0*r$iYTxfW$^y0T_k9Uu
zf!g=`fwDmD`~5^&p!WTKnT-@y8-K^0^!qR6wZ@l}f2F+9_=WOsl(!g}VaUHzzRAd^
z{KxDRl<h`{%AdTjBX=ZaY+XRv<?+6i<MH$je1_V{egZLd22MT?1C)MkEpQ6&-(&C-
z#K5VyV|WtIePDS}faO9EbKvxve3lD2j)5~MlXDOG%=b_TRfWgc?b}qz0c73>QY<QA
z-Un7tmM?1qt6qgyVcrMMWs)5p@3|GoR{rJ4O3`T$mwEGtk3&v1^FDvXTgVGIlJ+jd
zog(5sfAn*>8Z^G&AM#knz0`OP!)^Zf&*62M@xoBZ;g|ZdfY%L!TunbKjMx&$wO_%H
z@b2>`(0#3OGN#k~iIjzRpI?7v0SkBzhNS!kx^Fk0MQr(vfiVcY!`P0Nl^+Q}-dp@F
z+F<@<%7!XlhMtn&WcA}>taymM>N-3$-Y^Vq(;3TNRs1nJW&R8*pR3~C%x5$6`L!y}
z>jNcrE0mvAG0$qxZ=vGx7EfdLX0sLyZ!wEIf6iA(A>b{p!cdmqN~OYEd_gr7i%QsA
zyoO4g%BZNfxU&&j8?`uMm<=UCrPJ&2Hcmv*7feEVW{<bqu2+Lok3>D50+W?nWn{KN
zo;(e5*f<oWQPA`qveBT=$S;`k2;^wtF~=X_DTwxijPq6!V-Q{c>lockh=KkQR#oAW
zQx5m^H!nx23TLjrjuW5Pzcmm33ty-I7a_(AYYIA0lZG`Op=w!9_|(Vt{S{s7J4{H0
zjb%uuLK8F#BX8nrmBAxG3Mcchgs{<wdn;_BdxOCZh{Bm{VR#kI3pwWG@nZ}>eTxo3
zGTE;~tP0HE47m^=mIn^}1;yg@hXpJm!^lBZ1QuO*V2Uk{r&<ISGyV#^KQ|8X6yL&l
zMx!Ph0(1U^ES*VLikt=zuy`AR!jtgcXCQt8T7S^!=!8of-7Ab$$YCHsxytweWgKW{
z{9%uGTn*wc$wj-!uB`El!%l2qH56vFD8DzOMFo=4E72&6`e&dVf{4>j+<*g^F1J_S
zpa#ZmjHrEsT?iap15sn&`<7lu{g~0v-$t|TJK!GZ+0Q`yy!iD0uj@<TqbRcfyQ-6+
zQ*unMnMpz>!z3h=nI?oIWClTlf<#aVcMw=$1pyUB4T=}xR1{f*L5dX>1VofGfCd#c
z>bjz!B8Z}*#yjG!2Y9c?|NE-CgUfIK^Z6wGUe&AX)vH%WAK$0ip(WH>-wjk7L*cgj
zZX}DetefQ58<_@f_szcwzDonQ`xXoY4d8YeeTZq~cHdI6BaPhdTZRh4Es{_7-C2P4
zYUFlb-2rGoBe(mOQ(H80yRV*Tjoj{AF&gr#G6=cdCqJD)qw@~R=N`&ulQjg@^{u9S
zcBtDozWeS>z}Pf$yKfB*XN}zMd*Cpdppn~s>q+TH{a0ln@q@ikIYMst?~$pSSZ>~k
zLWDk|LRosVzccja+pO8NX8-&0!cELp$n3ryI<$SWzil3bc51d=vwsz=%ePCjZJYho
zSn~LGE0&99e=V_(YSwD@XJah;8ntknW<z1Gx6j>&hPAmsHgAIK`@SdcfS&Ue?tlP%
zeJJSu^HG1V8eIMXG`Ip5!MFR*qZNdPWA|4!puG{RWhBA}-3hwX+6E8rA53)IpVbZY
zg}T(d3jd2iutPK(tnkw-i~gaS&Fxm<zXoOdt2E!S!k>C3*kPK@sqnu=`3~1?b_L+r
z<wFm%bI&6X_P}4!Sb)PJzbr3lomcxoW_*WAXwda6-}&h6jLW884<zpQ5sbHW;6Snh
z6b#UHS^5ZO+<&3OteisCynH$G5gfA(mva%*o*>n;B1<8RClYMA{t-5`AK7omv=+($
zi&#p<&&Hy#WBQ8-Qt0TpUb0C}=;*nr=~!CeGbr#y9*d?$K3MkHj1n^Bgw0H2oTmlb
zL5L5+qA4wO2Zox)I8O_cD^&Lf)AFwcsmD%Q0gWAcv_ihLnQ4&oG@Cpq-U^eyZ)O_h
zJgqxb(a4y3#S|m0hpMh}SZO_J@Mx6tG&MaD=rT=={C!!qg=v`c^t6eP(lF=g8Mna-
zGG<+Qjgg+IGF66>?$enP%z3)M8}y)I&eH=#!>h?%Tksu?BrNLFb14VloXd~5;DMll
z=OZZQ7(k`}p=_{Soc^!$8|aPn5~u$w{p2aryE^?}>EAjKY^i3mD*bt|@APh(4OIHm
z6JWb*)?evgKx|LV`YQeVNVu$*T)LHY>fFB%K1}0Xi+X9C@L<{tpcUY5Fr7$s8~gRG
zxUv6`4`&~#+G7z;cwQPAn}+DlOQ&I>al-R5C_JDRHF=q8A!8_<@I2psWT<e$L*7D|
zg~kaFrHuitaKc0Br?L;JZ1l4;q0BMqut9oDA_uZr@le(}N<$+xlugMsYIrDzqIH!*
z9rZ|+&}%4{suWRG3I(Z3m;%0&Pi$jjYCBdVzSBA9!UttsF?*)bNiDjyk#*|-E7la2
z6)7`}P6LLc7!8lvi9R;wz+-kA_y%MG20s#jP~|VEfP%*ij~I(AH9Thi*DFD*oBa9T
zP*Od6<$pVzw$mCPGylZPs_umFoc|Ndg$5g)Xog2pMhYG?JW7!Sj~O1VNP@=<k5Ob8
zZXjH(NP@=<k5%NB5Xg%ZN${BAaf&2(%<y<3YdPU#h9{_C!p98%MUl&(u<%4h5<F&j
zk|GHnGdx+51dkd1t0D;=Gkh_%OTlA?rzn!(F~ifwXF>@@FxN=_q3xhEuDQa<Km0sY
zW@KCrQvPiROYauSN28BurIKgKfAeuDLjz~#zeV98gOBZr4Cg$7OtRmUhjuu?nFVL5
zeO%j|E2d5}3UFu&VXq)97E~xE1HQ34QeK}1qYbnIXNGSG6aO*Xt^&>s-`E{|_Ch(R
z!2!-JxKO2^Wbhdns^OdKDZWu|ZeTrFSNTB$j@GH(orjR2X@lvEce+4k%$z*O=!_TA
zRVNa3W_W&kIOS{womp7UUI3GG#f&LNVO*7Ah!gz{qcEYEBryo4RCuOhEYYzGm_CYW
ztJ+m~7Vbw;Bj?P(g1xYUEh|Su#EDK|&Sec?LV~{OQFtEvCzy!nPz<J0<xncB(OHFq
z*k_1|iv$!?c!6RnL?_G)g+rJ?cUKBR>MN{Lo98Nne=pzLiHYEQD&hs^g@hq4mVB3k
zlv((y5}c$f{+cRjx~}U%Ro7YKuhmHUx)PfsCdj&7ENe7<<Gk<<7DIMRG*V`G;pPDB
z<pFGR<`izYJj)p<g%47%YNX7<jYMmt%)*C=)|j$|o0L+lIr5KPn9x<;o459&VgJrx
zl(Xd!XpM_mxU~kf#>Fh$Za@<n7qhUT1hmG*EZlt+MnILN`sGn7M&n`@K1Q_0#Vp)2
z9P+a?E@pVqb*OH3920A4q4!L77@XKY8YQQ)YKTE$<H4k{-YDDB%E@p#@+VkpVWv_}
zKwK&h?#Aa7C!7nbS^Pe7(YTm}iw9%;s&8Nw-a>WIxR`~v5}l-A9}AZdZCQ^|N8U!W
zg~r7!yq(I_xR`~1f1?ZrV*LeGD!hl}H7;i1>amc4TU-pE8oqUO0SXJuLlD2(hk)BJ
zA-*k4v19*ABYekfux*}^%O1sBNE_sXkFq>9hKuUQBFBJ5AdN*U2BKp%+GWw*L~AU_
zqLoxCz%J$YNLG6`48LeK`96(lS#&Q&S1U}*qWdV>B-Oa0`zd_7LTfBqb4^!T*49@b
z?b>*6+JKUFiyokc!j@iyp@x@DfT?Rp%c41Nf>zsyqU)9OvHpV<Rnd(NLlUI1jmV<t
zrh}k0re)FG_6X6KmPPX$5Uw#Tixv>=v}2)e2aS}XMKtc?)-3tqW6ZDNEF<@Cg!j&v
zHF=5=Sx=%G&N4y|gP_QAncK*Uvq)2shpCww&NA`{(SWm*6B}`8NPaA`l~PwJbkNB5
zw-K%JD<ia3hIVcWL#BZ=qVX#uJL!=_jb9nrO&XbJ@N;`WBXtd^k%q5~EE<yQXe6>&
zYh*NBVdRz-Xt;*2jNJOPJlV)nYv*HHh%C)RrW&&{a_4Z+8nZI8d>UwtSsA&DXpLDJ
zsi(?SSfriE3erxc^%CZr$jW;lqaiCJt4Y4v=s0{tKO=nCSX2m*mDqC>FRI33S*fo0
zw&5Th-4)-ibw~YPymT?T0tPN0*yCVW7T1&RDlNjWELPU1F)WLf^=S;tVo8e9CRMzO
z>Nrb*gckpu=o;$_KhmxyC2I`J;(LkK7?#EN5v?&Si`P+`G=^pI`np=wMPpbNZ>R&k
zR%2L(>n}#_HHKyJs6d{h@#4{1<Me1)@tA9osby_T0zH;!uT|9t^f;n5sAcg4qC*PQ
zvUt*F&>GaT_^%&;CQwT(BZ{Yf2S%e>7EdEuqgocvpq5pto+!SIYF%ZGMoo%qx}c&O
z)v|cbIM5o^vUol<W;#x((e2@T@*$eN5L55IXnQs;1V8p~SX8tFqdk@(R<{A;Wwk4j
z#u9jx)rh9DZg4SPL7(f6rm4vwAPCJUny#3Rg5Jr9W-zKtNRatPGZ}SDL=>D2#?Qtg
z>$n(11qBpSAtsVomU5Vtf>0!**@~$W37C~XnxnXC;YSst9ThW4^q1d0ftQ>H$}^s1
zS<?u@GTMplN5z-q;G6u>Fnb+zogj>mXaPF`W|bh98|}<OXQ3BGTX^AUgcX9>lrwqu
z93vWKy}&dXoFFX2t1m%uZ9YMJywN+Cg0_HQx%5c~!7{qfQH5&#OO7f=$*-Tp*;ON)
zX;jaZrQ%zdZ1kWK=qYZY>KtO7p~bkEPt0M(ROsp)QPrsw!_lwNx7Zm_*(5<jB6^gi
zf|)LUP6hL}nolr05vpbQzN<UInwAZLL%$9=hS$_CK!Ap|jPBYGT0LSJ-JJv5)3BCN
zHSK9w%V=XKglkyK=w9;H8rCxU6d6}Y!&-*dzDap1Sj*^rZO~x~)-rlO8HYx-jIJTu
zAXLj*RB`REsG3*9T81A;LjnzJ8GGVON}PpaVtc6o4Qm;Ds(l3|zNS0EpUD8NVJ%}#
z*`PJ7W$gJf&>Ge<_QFum5rt|Qd$9(zMzxH+1Z~w~s9b{T#`aSJ4Qm;DWe;c#YZ-g(
z5NHi+8GHR(&>Ge<cIb?LG*p_fsEQqqf!45=u{S6m4Qm-YLe{KdEn{y|1288Ms%3cH
z57bCPwUnt(vy9qy&}!^!lCZ41&H;U57mXc-V;TFdFM3nsSjK+njFRxl3d{$wAE~(-
z$1?Ww5u`0uh@P=usRqEY3_#|0YI=pJ!LW-NjM`o)y5oP0GcuJbq1s-X#3)U*_;NI&
zJdBz@NnDr-#$wd|>0%8k921NbFiXU!x@V{~b3`3FFV>ckI_3$bj&_Xnu|%ytW9^k#
zopJ-QRAt($L=%QsOuK=5Me;BhK`fI|GuMho27vLia^$c{{EQ7sEK4QYA%5%yCPy*5
z1)UwmIx1$5cw`WmTt+%;5_^Y&$y3Ze@fgnDVx3qyvOXxbSAoe_X^x62s&;3FJdI;B
z#U%KzSP|=r<~1u<6pJWV)S_`L!woy(1p`+hx+CFOhIc*(K6evVc}?8DB)J7vAP73d
zzARZ8s=({whCNd;NuoXk=E~&0Sb$ohkL=Loz*yQhBoFLP&hKOi1a4K*5i!gQ<~GIH
zA`U&+w<jMPi0&2i9G6|MV&dXLq_po*OdmmLW%j*_sSsIcnti`w`isZpaujzC!C2bs
zlWF)?iE+cgY)B@XsTRYbB738fo+LJs*h7k$BHm2`^Kdc^^XZ~k{;SDBwzRh?fjSYQ
zqz%b;T|f?#kS*<9D$}(&(`VEe_HHG%Npz9Jp2f+*CTir~<R{UTCNT^aY(J|6_6a&0
zx1USCwVZlMVDhk^Prd>@b5z*W;un%V7&Oh|5?HbQk`ikXXN>~$vJ(47+<OL?14`_t
zAPpe<aPq~d6>j}n+2D>Q_o6Mf#e#M4<o4UiwApCOf{%9s_iplZbWAA=K8KZ${a&((
zGUF`R3@2%StZG=ng2zawpC;3As$@ZWw8Z{Ac{qxwVnMP+`wJym&4T@4+xC}=8_$Br
zVHx&U$%984>3GE<*b#dj``hGU7eb{h_%C_mbNJHOr=<w|L#3F<f`sy5GtXGm9?$>N
zv}kh=Ig&aSydV!;lBXKwu0>l&AITmvxJ@ibID2**4@w7CM6iUEkfOLfEVy0%jDkiH
zT&3MkB{;x>1Ziit_s|G9$bwtQdQ&~Kk>^ns+(=bQ_mG7&vmhZr*cl$0s9RX@$1dP<
zR4(7JU^_YEdE5a$DHlJlfGM8>ml%ujX4@XJoCpur;9__2&_1}72Osf(>#E}7JlKq_
zvt6bNs^Gy6GW8$$BHs241orj}hNV>VAOTa_XDX3NJoqkIL|@N*#7*bH#WXz5QgO3*
zkdANdvpsZvJBJ6`QEMwzLGyT!fGO?sJ@}8$jt9q&0C%D1DEgs}2ML(c9_rbMwy)yB
zCACntJz6PdEf2m%daYL61|BRYJGe-3n|QFERB^FV#TFhMOX+5)0(bD>0eB<(QYE<u
zcY*exW5T;m!W?qPRHOU2J;!7i5!yLiZ<2E`#OpMU0Zd7Q#1d-6+@u(<cnqCx-)vSw
zE+F0`BbjRs0TU9HsJFe)q@It6E@+ay$ovgTD;0Dr$6l<MxCoI+EH%koDnyX{({hun
ztWx}u3ud)>1#+trU-ZLBvF|l+2Ujg_r1sutZUZw(yifsVySV}Cny!{|c7w`pg*ZxL
zyUl$NTP6N(gL%{><5?>L<V5zGuOeoX*iJFesF)pso~E*&GfyIBkGKfcvR^RM(8#7*
zaX0DiC9@m2eaao%2TU3Q2SpvE?N?3ON;l`soKj}kuPLTQ5LTsqP%+<#?`hZ^GHFWr
zDR?zBV;?rlk(=R+-J>RrUCS9!@0v8Cyv`W<s8*>m;0&UV6&J!FqSk++R2E^{%Y0^%
zmnmgIdTrJITqz^Yg32!*H_0znu%L2`|5A;vbll2UO0vrFPG6fe21h#1=^L|vyi+v`
zo`v4APnbhd?i|NEeQ%O?n#Y1&<e(QZqSY8qN}}|5ByuMif=Hsh-YOQnij>$PsR6ZE
zi*cF*&YMJ?vWW%XB>ki%<)EM)EJ(1FcDmx4P(%3yWlac_c5c!iNZ!JN|Dk~vRLQ?#
z!5)~T?M_Mgu(hAi2;^ett2l!P@67~Pltj+L;@aUwlE~qCIUF9=!Z|U*nzYN3<{>b`
zgM>9{_flLb58C9F&Q02YIJgHx&O(A(f||64s1mB2!8<I81~1&hK#V5)uSp(=z&#Mu
zq&-bZPIpG+%p~$dvz!rmg;EyW0|D9CS0|BIf_qRN>l!7w#PL`)Dy|M5ONy6R`;jA1
zv+$#BOR#cNXp~)2uLrG;V!EW!sM043UD9b+XJI#H7+o^jV&(!Gr5|)=F6e+ob5$4L
zd7wj<EiZq`fu{^Vz6iMmZo&l3*JE^tpIAZs!<bt*?PtS#H-OJxh6yB4;$d%t5jUY5
zO4_h;bhIG|pRB}Uq)kf@JY`9W+Ad&WP4JZAr$3?eKWCuak}0eLqe+~AO_Tthauw1T
z!jJZqT%wjomY5X+GfgpV#rd-IWe1+J<Wd#Z5tZtIOrIHye6q)5G2|_|K&_a>R5|Nq
z2c9zg!d!}e3we3F7O)4w<N%(sYiG6`^NS%4!E1Ca(j^+%L*ce(l@4InB2Ib5((~94
z@Zp9if)6RJWCcB_Y5vh*&R4reoP9#crGr!s0k!Ta9jxouK^?7?UZA*;_?ryu$7bte
zD6+JQt%CC7!UJDiI!rMY%A1uASJIWD5o4@$gtM=lF%-;5XIn|rap@@4&`C!2Hkf*-
zYq4sLAnZ2KbO(WMZ&520JY|;->p&`aO8L}&X7#PFfB_VYK^-(UWtYz6xh-o4CYmmV
zM0>40ok157t+6S)M2HUIzA!(auqo#qU}d!*Vlh)y8fSDHTdg=t_0h4Rw$`P+nX*Lj
z4*WssnT!^UUhxWCVrd_CIhcU>84W1y%WeS^5`9RqXQ`NoIt9i{438kDRP-yt{|fdD
zn7C*UKU><57}@g`_6l$-`Kt=Ia^|ZpZe{+uC#kDQBl+uGh0sxcc9DGhRo0XBk?mi@
zk>SU(@HKih7B-!q%Clg`;m%NSej3js`gQ?2ozn(5EHQ%eGkA>XeaI<4lhYP5T<Zhv
z<1_@qBQYHE{k$*H1XGzG;O7!eFqQdP{CuJZ!jI)=^PxoF5A)B@;k`x?L+_j9cjV)U
zevb;s<&%jf$jba6pGNc(u)}=7$q;?V%7YGKWqzTqdM{aUkU5Bz`EB__kW!tJ-;NJQ
z=NaNmOzQa&p57C>F;cq1Q1Xj;EyO$)oe5=s4l<OVWzx~CI40jes1PdwndTr?Mn9m#
zSs+$Ud0it`jyu8#vGS%Pt%#M;RbOIEDa6X?--*<SmC<`tFbYb_gjpVjGNY^iiD-{S
z2h<v|GP<2M{i@fZ+udH{2=Z7jLdzPlGTKzpD%7Nf6k=sG{pG=k(1?}M15=ccyz(s;
z=sOJ)$@J(68bKEAk)kK5NAc)UJJ8<|ZCUEX=zBUK&=8i<A1DWcu>8kc4uoa&7wT{g
zVHy1o(SWdAd6a1c%joa3kRW>&OfC}juxThv5Q1g2jiL<^!&r%0im}9vSieV8*fq$+
ztGsAbC@&fiHS(&X3c+&eQM?wr1eOyjG1(T%j?5XftC{5p(+HL&$LK6cDX!$08@&@j
z9*f*;_T3mUp^|<k9W3cw`kAiSTL{a(4889y$u#M(N!$tP5}$eAMK~NNdfP>?jCNsT
zDE63~{5H$3qPj#MbLx_P3;MGv`Z#ML38msEl<RlS<(_2vSdM0h=w3#e^@`~jXwjz_
z*+oF~mHXdDs~5{p--boam!5YNCS|{OFgmHI*b-e|jY%21Z8n^UYH#c|9icEOV{7Ii
zJdlLp+-AWr^iS-e-$;<o`C^-BL10*SK=ZMO2h!re5~xq?5hwtiPAA;4%|r*RMl>U~
zg~m+CY9Bx+#?;YwfkhvmjBTR`!leA|9fe7m^RC9E9CZv25|qi>V;GhMLD}O%b>j#S
zl<SW<5R^TJPs8w65R^Ut7EK1Z6l1aH@(HL8pN4{ZK7I%Suy_2|5R_%h#$k$45R_$i
z>L%>OFfOZ8>l<qhyhGV?qP^B{m~+eSB06AYpaNy}M2D=)k#Sk=iuaIbMBV%?yPKL|
zt0ytaR<<A<H(VOg_A>bu7>`AV3n^2eL3=i%87})bGLT+jb1fJ_cN=@<o3Jb}beptS
zfm&R`r*xz=*Rm~?MnO>8kFg%mzSvNUfoC_W`3?7@U@!I_Mu!TP7=t;{ew_Uqj8~Lm
zPPCs;OhAN@(tc8jg~X~Dn7xXLh(9baPqDU`u}j4Xn2`OnV&dX#Ok(ykEQXj0F{J`b
zlS*S&iaX_q_b~?(ET#PdTL6jag3i3`7uiNIxH;$nvrmc75m)vG^AdX*G4n(Ot+Zce
z-+@^oY${?u%fJq&PF#jXi+zBVfLSHVI)QnG4FR)O98UxDDr-XRHi<9c<?Pqk#pmM~
zV25}k6Wl?z5ORCOW>}jIgaXXRP2w-4rbFy+h}kFB5_4GPa8P7n*=E1Nwj$=JAf!tB
z2s;3#*+@BxuCuRWXG2}t&s1YkYOiB0q;)#_w%0pKr%_;UVDh>TSVG}d+FRA4qEsZ1
zjlE4VaUtdY4;;Kod#6e|(nwjkvKa>`sy-*3?6y)Beo*IEN#bKF=tnjgCT)p!@T>Mu
zO3W*~)CE7YLntCc&^;9UKPpXsu^-B`e^s|#D}_2G;T+?Oc6M-;w#jK1a=G|86-+Y4
zOf~KhglcJf_(#aDPOtP+I9Yie3%*y3D4{rPJ{}}XOjQ#fHXqAikajx%5y`OmXetMn
z&FQ!fn-6u~k;liP=snm1$={k;@s!)C+WD$JM_G_=INJq01<9LP@Kp>3yE7+WfsM&m
z)XhblHq6+VsN<3dr@bOJCiG&o-G$R$7+Vo~Leb&89A_Hx_7Aa6RSW;_{Le=fJ@}uG
zDtf9o>_rIH(k@qA1rJ_b2rjN9D|v7Y#;u)Dji};A_G_qI$i9jF23M#&K4|SIvu}VU
zdhJ?PfC^)oM(v!Z)@eo#9t5!GD>J}QCa6n$fyyEK1JEIR5u*bUo!ufQyOe&77k{Lo
zE+6=$73%T?8tk#YgTbXtl{ufXUK7rP$^-Ug<`sjm1gCN?S36L>P_$>7dZAb!LYY^Z
zv^4b^*+*bUA$zuY8`9`fXFJnY_Ob%pY__jeCjsJ+-1aH+jVG{6d##gg+7K`gC?-k#
z+XAyrF_xH}17^Kq+KLzr#0`q^iVw-dJgArqan5Kk8x<1}Ps`9}4*sS6unH>>yBi07
zhQ}{~e|hca8vnAsh1Cr@fJRrd^7W6xP_2btdh32T48^br5wrY3qLZw)=&kaNL~BIM
za`gZ~TdON(t8(=OA|YbV`~q)(5+Y{#b`r((gS^Yt-Byi=S-z9PZEFfzQND}lQj4${
z%XgDC0TENa@&&#L=z+g3-$O&I$|^-qmOoDPNXtjzPf)UID?r6ON#WzIdr<Xqb-zR7
zUzR^b*%AI_m*c1r;a`?NOF<g{vix~UrtvS!|3QOR<6oA)K;atyvizU4(+B>gTy`7}
za1h*O`Aal_4Cb3BcOGXY<7onpf28iR8N!22fBa+RLM%bj@lTX<X)Bfu0Q0Ge$q>_F
z-to^^9lUcu%<BT?b0t<SzJ~?ITa?%&(MI<9l4V5*+cN&8ayb7GHG{$YTM2w3x{Ltx
zm10`Net9#b2NI5D`~>@L6gr6ozdQ@vNk$vl5DWH3N5sEVTr~?$pvwNt)}j`0Lxf`)
z|3&#YoQR~#_rApW0d;KrcNGY4)CRf4|4_wkV8K4s;P6;AlmXvFeH>?s+romcbO6UW
zZC&804#RZgNt}-C;i)=e85K|AO(?dB1t(#eiFZ)x_TgZcbm3JT4qAuE>;A>s)e@#<
z+@}KHV8J)wo8o>>wT6eIgT#186?Y8BP^7(F#lhe8Le=6y#eKqpcl*HQDGuK6Iqd1<
zo%s<|9^UVYa&U#pC&ByOfN>iyQgJwzSzk--jHpP9=he)dWyGs^%4iIA9wea4_y|rN
z8A=Kc4uKoVp-5v=Qjo#X#Yd^Q$w|TCNDv>b;vPr}ZiXw4k5QG`kQAIojhLXgO~?hA
z#i#KU%nn<Uf=lU6U%W<n&mBp@QCJhjXDk1{CkejlN!WbmO1SwYX5z5{BhlvsbeT{O
z>l)TgMDL+VC&?GU|HR{pX1;Ta!8}2Bp2U4+rC^%6g26-l$?d>AON`(?!oEz@KF^>5
zJkn3#mx&jM!6W?x&?$)*Ne++n6ZmCfA2Hpz?@}0L;w55wa^H<;T4F!Vuf4dh83vGe
zMPSClga029^C~fT@Sngh69@l^mQUio{;=T0A!4R;-{bw{ysz*E(-_!Z;+;{DTf%(_
zs{XsgG;?1ZnJ11t1}1L$%nC5g^rBX!>01oFBtD{=RGU7s_QdC8HW!&bGWJ9ZwST<n
zOSQp#k%^j2GJPL;z#ONT%S|8QVJ5yLCO*sb#o(J0-w;=0`tHsIbAp&Trtg|Cn3KfZ
zWcmniG4TUz&zNWW$|SId96-$8udJXBIwseA&FpT6QJ?Yyl*X{$DF^)u(E!9mL&{$z
z+RC{2n#+yy*NARwjg!BA&GIiGgv|286r>R{%ikbcBV?8zAzCA3mcL1Ke<S-0vgUZb
z8uV&g9hYhZV?8V{`-Wu=rIm1eJtN2H6?c&ILy8FqLc@%2R!m3`JYsyinq?#6Q)C|B
zrF>SYk@9vLxZNy)F3NsT9{z?EcBeN7;(Jv=UO`Vw$DdYAhLJLnZ2uYdB%~u=9xvus
zq5|SB8T*!HB?$U5UZRGAffHb;GTxPMhK~SX!y6P=s^S*0;G^VJx~bL75*CE>`<6vU
z5%Og`p>l*zqMnHNQ3>FMQZUcP`zmfX&Vey;#Lre7eA3zER4Np=7w(`lxPE*#>IDyV
zpZw)pVC1wTFWg^=z|(}$d+`BkRKn8`#%26GP7n6Mw>%UDH;~g&JA6xYG`LEY4!&iT
z9DhP#T+TVcrq-_QXc%Xn_d3e)Sa0EfU=0G=JV(oj#5@{kcoK4!k(jS$9P2|UJ+V-&
zRq^Gqeqa_KLm~}&nYfjPg95!wETJ2M8uT)88{H4opqGiIbURRkUMB9uy}PN{a8b7=
z>S&CF9MsE1J&h%GJeybnm4m(p9gw)2YGL7Bk*kcvN=o3hrbDF(N#OzOjxx}zhz?nG
zG#>trg0XR1C7(U%fL<mxP!PU5M9DT1on+NQ*NII;;}y#L(GA|jW^xL;Vq2&jBLgLF
zC4XQM=w<jj2lTS!Q#!LP-W$Na|1<U6g~zfHqCqc9KBBivRWnLHrqQVP(<PsmQ?LTP
zEcrrh=?$I-+b=mj9uXdkQe}S&9~LSZ#2yEuPaX!fo?qOLu$+{SkY!05b3aKxrlc+N
zGbJs*`3|p45y)kU*R*gN5q?dkfA4@?mb6#PFe7KSQIe(-V9ENh9R5AKs4qR_?!A~^
z)G^eXBHk(V;)Djd^iCyOgIszqp~tbC4Fz)Powf``0OazE@9`0!<Ff1r?B<`96LC?%
zm3@4XaftWI6$nwll|F9+LNsutFYSW~&@W!w@ulzWKn33=n}2YCD}4ca%LTnDy+1m@
zmA+ikqz10^1&P+cmA(+s71ke^+kKsg*1(m%Fwy$;I$t5Z?@?v7$XUov0ayBB^xl&O
zuJm=G&BGpRMJ}@FN_3O;3^qf)ZVjk~2Cnq=pz3PiN?%WUJME}-s0uQ@lt%nRV0XT_
zGAx$Y;!nbw#Fx-)u*HA00xaF*finScrT<B++<bjB-?7EtJQQqS&E~ZDH^Sz9XK6OO
z#ZUg;ceZA;TKqj=slE!$23q{{DYl<x{Vo2oHek=utgpp?K3tveT+L>-_zAeuSA3r4
zGg|yX%rd@8&8D~bvxz-lvuQ2<JLI;X@XikbSNbm0q3v7z`IrHHLo`dkmGbycY-+py
zf5le~+C=_>{fqgH9RD*5_^K$V?S(3+xqAqW$MMze^7fxuc3KaLOTAgeSv@FD_Wci=
zE}MU6JsOAo!tQRzZf^X%4e!NFvps7Jrtr@#YibJ2$@tJCziPwB$to`|Z(NhcCwOX4
za^~B*b?fYFufNtRFt4jKcoMT_ssA6V{~yx-m+0RZ`nN^}4sPY21jTttI$bPE(fZ%K
z#QNmIQR9}M+1C^$vlcE~WM!J;th6Ck#>ok5yP7vtn~%)3dJVGrSY1!vIo3>l!Ya7h
zT)?dwYr5&RYItGB&_^eXTrqa7*>ba0y=oy9>8bOWY4@AG<<cx39C^@y@OG>3nSG~Q
z;lURS9DKndbKYDueDL|x7H;l)mr7xU)Wy8PIzfaftP*R+U^8Wq)pe00;4$B3)(P{A
zxje$;8(BP7yKHVXL{GB&leoETZXeL!vue;w75xL-*Z0h`z%H3vgQ%ZaA4QYc&+HS>
zx6U1;=r{ZJJ)h(jsbs$@IZgk@tTaR{RD!>&hy`;mL85tlfw`=<)*7@1Uy-I3TOp4*
zhKHHMsEe6p?K8h%)+gqXx%d~dKC#k~+XE`M_gPI}#ZcYuW>&~b@6vbdMQ&!+-B$Wv
zo*XlF{@8I8WVWv{Yiit}@#dv92+d=jH$CPFOibo#ETnZc)WuA(2JtqH?Q?i2x$(^q
zuVS(!#0z-$xEvYc3mOZ<{MinTC%f_EZ5uy7iw|IDTz$>ti8H6xOrLm7O=GNrKi}Jf
zSF$djdWC#8#(T)njr`2C$+HoSZ+lI|2fVJldPdFknT;3S$Vaet*G|5C#+1o5QzuTH
zIeA9?<#~9<dg_!JS5LjTrg7g*yr@IhwQxA}+v!{xKB?-EKeYypcFCXRj)gq8^eHFi
zc&kK}Oa9mzG{Pl+X0qWfo|TK?qkdV=6-BvZe=Zvq@{YNkov2=|B2{NP<T(&QE~10O
zXL9-59Xxy<j!)F@i`FEgTr!fRqnI(mCA&L8NybSwYK_aimm+^(gc_d2BA9+ZI#*^?
zx#ZF|lHCfCT~0AwTl4<QpK^J98PA&Ws}p5lwxS<$amjA2LE|rR$c9rvOW{80_pWng
z#`yJ?4tfOMhkgj!?vU@Ltb{%~-t45mtu>!2H=n=D*Z;<|OYd>Ad%ZQ=DwjOc8dU9;
zw8zrDmFyIg*;;bdVu!pfMT-n`_{pb4+{*3JBBf6|^?%N}LKiN1s!5~WROkn#<mVmf
z1E*4b=a5M{<Jy}{t&n-nH5uQdwCXLFt#^Vw6kLTEhkx+D#b0;2>fg@Q$;Iua^BtYK
zxw!nL$=ICI&yjEIR4&W8I>9bm-~_iZ<~A8rOP%=C|IeJ_zi_V180nI3RhTj1Ql~a#
zF|^QyF-&l~`jp8`a69spekc4%za3WataD%Z|BsoJ)+&r}?fO(kBmR^T4Vcm^9O*f&
zsj6IZU2D+jsMFvfmg?Txcb(#|bUK3@rE6T;?I321cFT8jA~BcV*qVElOP(4?qh0bX
zM`M)ol%{%X#iInb-`ol!$R&q3b*7}QMxWO87ek$TUuLRtFvjb+i-0qlOk;V|+!;;=
zZekU9s>?N1<fNp96a6r}Po<;bUEAG}NI2JIgRI$d*|VHrk8z!{ESEpW32&pqk;Dyf
z)sUhhmhYKcZ=EVpSK?1mhFo<Q?;y@~avSbZ4L*0Q!(Z=QF{)j%zBOoqo9{eF6OeMr
z^_C<<tiAfQjFOFs)H*k_CMViM!K3Rfmw(;~cf{{>3Rvk}lc5SU*=6r@f>kaEclq^J
zg>JB$z2;8+U+omLv$Yx%RK_lkIpNcK9ujVw!K+sN$C0;Ndv&-=p7UoDahb`jauZ$h
zQYXlR`%m~N-x`;{rd4#5OWt^zs39L(fj&Dmm&qom`p^7pt9Vwzt)y!Z+~~9BRMRze
zx{Sv-k$;JN_FkSIaiiKhrMES%#+$12ojZItZ;cz8+D6X0n`h*vI#RA0U<xh?r9E&r
zFHUijoFg}{;@Pcinfzlp&py+Q4gSyK+)y`9tSnp-*$-aHi&D;a5-wHw)w=8?Cm0^r
zC0&JJ!0wrQx<=e|qgv}x`=@5Rp>9^FhfBJ-wnc~HTR9n$2NG`oyK&s;@qfDDbQyF(
zPp1pqD7Q{JYqtyB&<ong*Co2(0;k4qh0p~q2^~SCK)A-|*zv`uc&!F#WZ(bMh%4lp
zV+U=qr)<HExS>_mqg)aN-MESu33sHzEo^~pw(|E`l592Cjdw>b>h6+ALQ96;hfbSQ
z;?4wd)Vc0)rh;bYif>}5UzJrqnfbEa;9HzZ&T^tR>FCd#5&eyGbqCi^9!ec`2Sc)x
z+MNh;9KMrtjkHnXu9)QnyXJdJOxLZ867Sv35pySr-VT4Zb9Jq*+Tq7L*U7rH(~}K#
zqK7-zQ^{22-2S}8iFQ5DOow;7^G20>_F_j-cQ{wKtDv}s{9bbJz5If#O^()dtMq>p
zYo||Sr~B~1wF)`xKAvf|G3to$XVu{-{`8+|q!^`gK8aV+CDS~^2+0QUa>sq#cX2yo
z2aZ=y|CvU6qv?N!cQEMA@994iw=tXlXLzcyL-xBLrSG9jrkQRu$*YLpr}<3dpeB4E
z9)LtH&cRAUrx#$D22SmIgyfg^^GEAvaSsd0JJ;a*Y?R-#Yj|dDTcb4Xzf<La<wjd$
z(rMv1dsX3UPYdslaHfk<895s=1BZ18Pc!z|Ar<cay8#5{-%R-wxS_b-f<I=U<)<Zh
zP(HAR^uCxU$qj3G1|SCz5RlKV<^I|t6i2xo#K{o-q*HvQ6YhLX93P0(ze`<t=!<?-
zd-~Cr+bEw9^hH1QwQO8hBb?#GYR!&vD<~4bJvuzi2z3jofF=ac@35+uT#Fj!{h)-r
zMnz{G=l)NE^I%4L{WB$*^1uT;V}@4+WElHSYkIB<M`xcFUWjn|sMqO6l~D3%T91%h
zmbwm5;bbe_*6~c%Rt{Xp2jX()I_^&*arwwP-am<~TAo<P_abWhdRUuZzPO%u1@|K^
z9ig3co$Xyt?(bn`nu@-+ddPD&@H-&*+6LY=DPVYeNd6$VO(;%wdyr@5C^P)8IyJyk
zrb4sd$jJ}#*RpPeuF`1K;iU4<zl$W>h?-n4CvW5f<l`H8n3t6`zPFLT$-D!HjG8#0
za^iWz`&~F-VrBo~jXO5+d{e%?naAbO)qJjJ*5x%N)2@^+uLgc|w|n{0`lkE>d^d%!
zZC8cT=|>kPf7`<IQ(U*PNfvMA<*A=IyG-{wUS748cTK6Fb7TA}<in6kt8-ZQYMAoG
zR$h|pIu-Z2R`nP@V~C_a*>@Ytb6Z*}XKX`xRZhd*>p|JDjdx8AIm6ApdS$mAJdfQf
zU*E>_`rX`4Ri^ddY05K}A%+ao^@y(5a<3`!sx3UPQ@tbB-O0#xV(#^EdDV7^t#-tm
zwzQg`Ylc%)ZrKl?Cg!@h=CC}zofjtWLVSC9_YU5po#VxgXAsmu9zjqiH)y|;i?jJL
znw&AvB#U?OqO60bMY}_1pN@VH(bQ-+wL5|i%HjrI)M>$KsSlQf5P~yr@^bi<%Bvcn
z<<I1DTsS&4bPM;@H+8c*{R^>FMK|Ntq1J=a;m(5YpKoRAPVUDFOGbC{LiURsMr@ZJ
z@={_`<Z`en?QlPrev4$oPL!6ZLizGv<Z%+p*FsNQTHUwGZo43aPqghq(g7hII$2&t
zp}m!C=Eem&^fSkcsobgPbT&X|e#dHgd>1d2Rl9j0v*|u9jyIy!FO2_Z$(wicSjxVK
Zbktq4VK>i{UWlh$v{i?VklhgW{{YPZe&GNB

delta 88739
zcmZ_133yXQ_dkB;CT$0}ZPPV3ZQ7)yv;o?ZLYFkOB?a21&~$-Pih>r|ih%ajq7~7A
zh_Wg;h$x_CQBhG*PytaZilU<8jyvL3Tv1U`RQ{hcH+<!Nf6t%iu{obJXU@!=Ip@rB
zbK{O5dmldDdzIU2*{&*Q|M?ZK5~cVRm*QMKETdwV%P2VesVGj#VE7w}|GIJ{#HUjd
zXFpFw7<^^*CTm=GSg1QJ)V=zp3*)~tDk%Sc3Lm>5<Nr@#tI1H<D)ul(h5aITMP#Dd
zv}VV(hx0B!y}$mY^V+GLgq-+~#uJ7A7AhK7CYoZo+02$qRm@b@5C07mHg)`Mo-Q@g
z+)Hs<#6@a3%Mg=IR<T=c6<w-XWSSF&$E35rM26YQs!&!fT1{qg(v&E=O&%7%^C#0d
zHoA|ZBtakkjWa%!Q)t_wBrB^1JHs5~qYwIKQLIYW|L`A!d>rK4#p;M8Te7ksTy6>1
zehHuPN+0n|gw@tZ=}s`%4~I+VhD(2pu!j05t>M1pg-g%KzF7aCzL4&Cg+?A041Xj`
zzNU1f|2KaVrknbxc$~7}V7RyfeDqCOMeT~kk#T0LvTpFsJ0kyPVlyv_oH}jFrBkPg
zPr1u9dG-wP2me)k*Q?2J4Kb{DBkK~Ydt2kSh5dqu)pm(Zy{&Awc%!#f?Q)85dRH;O
z$nRrSk0y&zeeyyR9fn|QzEcus>s=D&ulpbV)nWeO|KYC)^Lg0hXZ73}=C}V3|FF?q
zvvP2dK~V&dtDXIK_#A%N=Vj5^Ii;vMmw)6O`Dk&CX0^qgRfW%<b4qREL6oMPQ+n#0
z(lqfgO3#KI3AKlZN-ai+=x8g85M|NU$>AuHdXAnWb1wf#o>P`n02!2o%F%Q96hvqL
z^_;^ui;dA%8`<UTzf<RwMu}IWts*Bzi{|0pQyaa+-{4LJS3if_N94v>ZQ5Bi_;jCB
znk6R1Sj9fn@t(uY6)VC0E=FSkQ4wnu2V*o_>^T}*&XKi<@1Z~boYJ;)N)tp{tTozw
zPHCt34>Y#KYSG~!lVwZ9CUBR;YBuXRvg^*#q>Be*t+v#2O1GU;Y8M})zGl&)cb~&e
z7tt20BkYB;W?<2GJg_|CL5EWbEbi`z=y^riIl}TO>%Te8skGT4bKLpQnKNhl-9b2w
zumw1<GNRRqDl5yzh@tUr-roRy#jN<^3CE#KnVTJ0R91~j%DBMNFFQ1d{%Lb6J!MeV
z(}q8jUWn+1Ap7OHSchMko)_!59@-TJ)eb^X>BvIAezzO_N*RaxkBZarL$pt*`Q^%T
z`?{Xbclr|Y8Os;56Wdsicqeff>l8^zOW7yluB4(+$IQT@dAbsN{k2l<Jg?F*3>@c~
z4ktd`XXeHSme;xSy90~<I1`Aid^WIjIFRfP3Y`B{;QaOwbu+NM%1d^thkyt2-oVmP
zo^S781wJSKm9oXa@)(qbcwlMoxl5+UI!0nt%d2z}C`LsK3UySp949-3%U4D;B25Hd
z9PW`ufa>FoDE&XHtc=Jv$}Qn?{rG_YE{~JtGHsv%emtZY+6}W}7XE(PkGf-xDG%vA
zFZ~HiF76I2eXheDSQ-7OtnYWC)|tSIem8yQzZqEi!!syQ^1FNXko=<OF{~r!PlA~+
ztaGQ09I4tHSe~?6$D}P+;sVQI;L^i^g)bgOy674Gr})J>UVSxE)av%oZp3n6>B!6g
zX1T{o6)dRku3cVmIPhZkX|!Fl=vpTxuL*T)mREUdmN&!NBQskehAuQ^wgr~AHv|@y
zn__Rw#;60!scdm~?Dca{Be3XHbnNxj2E}7<c!#LvRB2_|JTx7%hcZN9>ASz&6T5g1
z6Tj+Nq0dgy_)eXUz5YfieRWG<c}HeDRqO0|n+lg62rT|S_WCvy*DSvR9frsoKlB_#
zS<Uim^@`=qnA;a>mOkH;1QzwB3<)r>d<0B$wy#$cXXTTW-+ONU9ZG2i7PYHNA_jXG
z6)t+R1s^J=Bs)^vX|u9o@wlx>-EI~?*!qSz((#_?e>=ZjhGXFwv!d)Z*q`=n`z@^Z
zKnKiqZtG7=OI11p%jfE{`zsrw0*ii#>baG=g7KXzeZ#|2cl0CBU9+?&|IKI2N=UlG
zZb%=$1*Nf${~q2A&ly#^P({j1@uehwpA`2iwQ{0XM$gAU{uP-{B76Tnb7mEC%loJu
zcyVNAJGMbe?aF?CNSl@I2V1<Bn!(-@CsG~pAODIjucR4Tx<9b=)1L2t6&dzqmL$A(
z$KXmb0p=&TGN-zB=?^{AfcIeDl-i|#!lwgEUnFPJd(yzKUHWxT;jdz;y?<f~Af}er
zEKimq2YS~1DqgS;QK$SWPTL2ogMJl*()3UgHNBi>4L;Q7Jf4e=%Ydk%@LoAT(_Opt
z7&Y_8@t%^ChAXV5Ir}g3ZvBe}5WN;!{x!tKP<?zEN{qa*GWtFY{@>!!R2-UxawBon
zF0a&~W72;KWs^`Q`ZRsj(<jN7VVy<jM!3tz15*70bO=2{XL}-1xabt?m>O6<7QT9!
z5mz^ujSluk2P>9#|J#X_7a@QAYeebvRm(kO=7nD&Vq<$QJt^wbQ~MtK1;sC*eW^XL
zvha0uqGtmt<&%^3{QQepot_k000rp#Jt+KFcNM9gP9@Yc)Ll<?6>w#w9EiRC4%uyl
z9;USgEs+l(88>CN1Xea>Hej$cwGBP<fBsj=d8Fh?5~grF&{2R+M@bFVUxdez5*iBO
z{O;prXt*aNEB+fcS3Heg`u=N{RzTIa_x|^EHo*iCJpNz9nL?)Up#-L;wHEpFIrP7+
zqoe(D`B&-8oqPE-@vh?n(cpY(XLUve8`JdTnKSbtRe+9c#pm1jJc-Zip{x|@6Jd=N
z`0T*vK74M)=NI_=0-uTK=Sj?e4nCXU%}w~+`kVNmZ&t+NAI_XPAtGEZb;(a+fU8bD
z@{^e7s#5(wi~T?geireWdFqaz#qi85b@$KW;>^6^2hnsCRG<Bq3E~iNH@ebD%!(Mx
z4Qfq{zQ{B(#(7PQJ~GBq5yKTbipcd&{UScdbVQ(I$0Ef)nOW?uo&EYPkJ{PLZvhiK
za&&CRU&<MlarVSO8I1m&Jt^1>sC0?`xem5X)Z`9g-Qud;VR7Bz{U3%W{~Z=D<vRK{
zgcVSBr++(o8=tg<(Z4QL^v)}1t)eE+5%*UwgZamqGnWz-D=PYphx#}2tZK7G9LxKP
zWr=48T}p?A!Jfxezg0|TSt&>9ID>zO!yC4<d+Uh~F(AK4y@Wo}#e#fYz1kt}0A~e#
zq>B^a-02X#2j_`~eqQyk6WY>m8PZ?PFA@WX+^=rtU?hun)f}ZNSIuAw;Up1Vp!Igb
zlI(r_xnH;n`thL{v`LNn=(davEKw~}#q@%_+<Y+Al^y7qiAPPuM+A@LT?AR=NGh|T
zz9}OY9Q9`LY(Zws1=$e#eGV83->8aT3i_&xRbeg6XM03Vp`XQwWrbNW{ZKa|fn5!$
z&R(yIrweT%%6kzuwhAAMdL4nSBhpwGz>;45sU(Zt0O3`=ek3r6tpixs>o)=(3A%dy
zO(0)_ZN1FMT@iyN*wKrQvk^nsqo}jHSMhLwLPkC8?zM*M6tjC&C0}`7>AjZ(*GJ6*
zSC80qJwA9mu{IN_a0f|mSw?K$Yoxfb=pyS|01M2q_d{v{k9`bM3oNmd)LV*+f-_JQ
zIiw1#NPaK=nz&hqn1#02ERx!Hh7ZWMfTn+J!_yFmo6?5zF3AD9Y+47PSXAs{T-;mS
zFLVHUS)%O!{~WN{hAmjl;x6yF3<8fsEFJ&FT{L$(;1KE|!P(O;30FS`m^7vRDur38
zbOQcMo_*<+3bRq;>gp=%L2{84163zoI(4eT>|(SxgY^}2ybIMDRh;ma4wsI!3#Xs^
zp|CyC==hh$hZ2Gc)k=TTy<nM`bTswRLEtz>5$9Z=yXGT(#AEd+THJynbs0(BKq)~z
z(ieYjl;koT8Pp|GU?o~pmrC;QW{}IIz-IAjNz%ao$9L7+he2cwd9#|4hd*nHjNs}r
z;qWDe{wxRUF<F}41adc#k$ez&c-Y&m)V1fN$W)SkK{j_z4D3ROO?}afqOL$MO@nFT
z)j_bVspTyq|3Wp>oCLDRdWe}vlbzI?`(qQb(-&WJqmJSO)Iij3WCV-3^KFRooJxq!
zlP2XCAX}QRPA9e!RqTaOWcnXxg(97X&`}XHbiiO6x*OGp6`{1xbTk|l&*&B;iVl)T
z_-{MVEl%;u|Bcs+hst=pX(+{O_fU#gR+`nH;*}?`gQ(c4y-KZF8BN{-t%H>4>_UL+
zw02cAl<FZ0SdOd=-YSg(7DhY`uuh|Z<sJ#TGzwUrFTpmA0+tV!V24Hl%ZIR=(9mv;
z0+xpZR-=IB#jH2{{COps;+2Qvm2c`Hgm|?od^6ET!166W5T63}pVF0~iQ_1X<PD4f
z@5Zq>(0eEeDcm^%bm0af`4u=H_bPh|w1r<W26Q>44xP`%0@TY-dC1Nu7lW=?4cf^s
zMsIqJpoq-mF}a{CNvE4%5(|118O_62U<!NH{T&J5<w?R)ZnZrC2k15NVGOc`zX!+Z
zHHqjpe!uXS+cO_dRFvL!GIG?0A?Qh;wX>+ti$-EH*9`@!@Bv~$dEZc<YLsd}JWZv?
zM=OeU!YK7rfc_~4Evnof0R8i?5Ha&IH|SqifX@}RX`rG+d*DTi`ZC&z&Zh=dN?p-I
zq;q>97d=l#ST&B3n&WLKiK>7;v*sk_B4b#N<tfN&N5%ps-3y~?!tq0?xP4e@XcHzc
zCJSqil60sa$ZYa$MSUd$w0k?`)l;=tB$KBTw;3TEYn44%IUZz+?7`;^Ak*k<qaMIa
z#!7FGN-R_qzoq{EC=8>y1{P>kK`ML`R(H#o@1U9U;jYkGpz&A9h|Qm&z{1xd`Yq$%
z1s%_?^MP)m3W@w(n8tD*Dbo3Q382p>+R2Bb3zmt$L&nV;T%a!`zK54%1}zs+T`zx^
z_-#a&D(X9k<G72Wqmb*>UNA^}ot64uj)07>{}dKf`y`7W{LT<dN4uYP%dQurSBXc7
z<~$qIoOrB1{K3M@vO#}Ae4URZ`b(mnd<Pmy{F-Pt?~R@(_N2fOJ;_r#I+et4DB!&O
z<RtLF{b@Fg#Wx_MBz{No0dD1>f4EYttcVM(fh#BeyaN8)$|L)N{)Ol^Zkqu5<VMi#
zyoTEPmFP~s6QfT2o#+MpQ}}J-A2gyR{9B^`BzhJ9o#@j<uj3~8P2yifckx)F|0a4H
zPbK=FPvZf0@N5ESs9?7?L<}0Pk2(Yutw|lvVM8U&ku;agq41SKIMWpyVOq||V!M>o
zS&P3G{v{?L>8hC+q|P73Fp}mG?c`Ad#p>aG%go5JNg*1&pRYqf(gMR0e>Z`?ZahZQ
zz(-|)UPR5bDC+G_MM;Qz4b59uiW9^2e$+s+o0M{_lQWd$0ly(eE&Sc#;17(#0;uzU
zMD7S{%{!Ukc=F&uoqT;i(D~HX0-kjd=phQ6e+j>lY84QF6<>e>Bo`9Bj^~a8UA!J{
z+{Gt|l_RX#dy#^YhbH4f^{D<A;x)O9XwLNc$VbWLbj|KzdX9KyL{@4SwKkG89cB9G
zCV)x;Jxu>VXd`W*op8qF8VywxRj;RJN0arqsz;IL;Dt0IRUe!UP)ES2>Z|er>IryM
z{Z;}E1pKOgF=8jVkw60!Adr*C5NK5ubz~u|7vI?j$)W^ggSF&6&|>RIYrhx$Fli~-
z(amEK;?}Zxpgp`Df34*M@Yl-=#nF*^)5IJoNjOGI8bDg~p=9M`+R^BxFCa@}QNkE?
zsQ}sRD6&REVmxG`-UZoU8+;pRJ^`L&8$xzac#Np6bcOzI0>?K7BX{y#NZN){xVZUS
zNItf*`QUr_$kCw7jWB9$09{3n;g>Di0yOmjMg1PJkdU;QTKpKKJ88lv)Whjhm8A3D
zfk@bO&nL5Ro&f77O^TiqB3GeylP)0rPDO1)>?b52Cq0F59&b{xJo;>9IS+~q-=umP
zg(dlNYzmVaexFTxidvzkk@!wNKm|R9XgB``hD;hu`aO#39Sr@}8t9D59jxRjhf^#s
z0#HX&;{NSuO1#n0yWnyu2}jXs9XiGOsyuePc)2P)a|>7r`kSQZHju5U=@-SKpEQ<K
z2eqZxZV*~^TIi{IaIz?Yn^_vS4XpsoF`%8>o*N37XTVf$TSGA4fGOP8m+H#p$INWp
zHVR&rT4a>!JZ0LY)0I@O0j=CN2{D^mV!&i>n~W5gI<yh#3JoW5TPtQUwbUq1<hH${
zyE?}*8<Ct^X)rC^_K5fkJ$|SZ%+Urjn%gv3EH!9AjoaRZPo&N=U?0xOfl@Cy5l`_?
zc{_D38C{ooA@xdf4ky1l8~m$i9dYwSESRbDDXJT=qa6q%+UCG;QCEOGn7a1WSS2-V
z#oMG6jRw|H0~|iPGtjptp%5zWrv(pp<JerLK0q_rrl_AI4J4!-A$4zp?6F^UEG|4J
z_IZXj6SA27Y6^SKZxHD<ec32cQDbGj#e|wcHcD*v<rI)D(#z~C=fHfee1q6jW3|!I
z)V`YhqLUB6%-99dOE{i+)mU5B4gu$mtC6?2@jCR!zTO2N+`*5hg5F3mx?2w3eiseC
zo3CjBe^UW^a+pUKf!;!fJ7T*ArS`j}eYt+rwqN*1r8#JB?e`l-PdIAJN4xe13>bgZ
z)+6SR%9*he6Jy_DFk_C|bO+$028=#x+l-*J?=+xx)OJxB;4TT(-bZaq2|i{(e$<wU
z39~<82uB@N)ca7JVE;Z2hP_L~j&_xet5uY=QrebU6m?cUO4IsdhN7B52Gaa;w)SFW
zO{@590xZbS6o4MybUvB=jJR~PH6%4ukp`!n;<P}#^pBsLAUTQ@c=+xh=+Q)bZ7yg|
z3wxo%Z+i>dg|xax>D=jl8yPvR-hgR-+cj{qv<3s({kGJhfQ<%B_1iv!+PJha22SxS
z>fM7e0CD8c3{hO09(s2i&Wjgeb`*6qY?yxWD0D29CQ5w`%{VMHPwG@ms3UP2xKW*0
zP~DE?y`Yn4O}k2QSnEMz-<|^zo!FdDhQS;*qAk1?^&Kfh>-;x#&5>Fw%|N-sVHa=L
zW@b$+2AM@73V#EM-H~mmS&U9Q+<%c8MJ*EP!TLn1)i-_uJc8qpMw-+bu`rl1YXD5t
z*I|s(q}beOwXf5Fs$$!R{`bu=AX99~6@YyW2u)IHrlC~*n-ulC7%ixsFo4TKL7{e`
z6RtSg@vF~^=(^14Em+4h<7q~*YZK*lR>$@5xy&Roms?SPfGsnV|ALlCPFopuoam_Q
z&(g)6b)M2YkaDc)Q%PCV2$0U_;LK4KAa!fslc1%KSX~c-G<s*vJWV7PA<?_u9ZjpB
zHHVf=g?Ec#^(o#nh*0Zb8iJBM?UJdAb%-2}T(ztP6yp}YWe{ZKc0)(6=JY}HJz{lz
zYT#WI>+x&xH|h}nH0X)luvc>XrI#yulGMpbzn*O9j2KBBrAH$c{wMKuqOr1xll89X
z7=(bHMhd)qwa9GfA8M=tXP{y2w190Vb}@Rc0qp@>Z}^0Mc1;M_Xsy%-8Ko%!+Y{A*
z9s}9}w*J|G;T1y<*wRV>2OFi<fNcfA0s|%oY;TfqVWT+IP#8ngrH_!)rKr<IY@^p!
z4oB7-X%AxI{oq#m7@~EXE?OJY93N9@v!N@^X<If1aJ&KSPTPxOLu3DbDO9VC2JeyE
zQ2k;uw3pw6fYfI_22b$ADBm=?VrC)V>+Lj$NZenD)G?Xt65$`?>nH7c#WEXBE~OCt
zO4>deyIQ@I)ag7Z?i!QUuMSSr&vFkWqlSaD^oxImYQ2Gh^-Ca<HbvsIG1%;(R#qG}
zrtn9Jjwh$&oNSPlAk!G%f=S3qB)%@Yo|QyxITf`T$uBGU4d_$PfRk;>fn?N=Aoc9{
zNuW8Y&rbMPeYR9Xz6pNPq?D=X9Q-Q-vUYE_Z5!30VP>aLb@VbHbSf1aUCOo_d6Bx5
zohIW)b}2iZx`a*4KNxPdV+xAx7PsXnRjd>rkF}Q3X~~^HjNVEw$^|Eg{DcOssO<<R
zcOp3(YFX{6s1<<#aO*@We2d6$(nFhy!AUtyLb^MxiG)(AUb<TfRaS$R`x_)6Rsi4}
zf&#nKox9@yWb+K!!{?)T5V0+M&V`^oL{p@ZTJ>^lP2Bkxf{f&}kGFf=6F-Uo<f-D-
zCTp~8>Oxv#b)F%9YD#0Ti`a1v2S-{>$vZ_V=2w6mL}|m`nlgBu9d)xsaGbSf62_HM
zNDQ6djbKYD{vPrk{w{nt#TyO2mn+$zOLWliN%(Dw?=;L1z%dDQDFt=|zfwFn&K~*z
zo8gpl7bMeg3s_x|hIS~ZQv$R%#r1;<x`w>|Fu#*}H;P1#$T>?HO>=gXcVdl6silo`
z4>t_}T}ShJ!bV&26l1C4`YGE=<l2<*Qe{15yNqgu!b?^1DO(83NXl3v=#oysaNE!+
zmE)|F(zFv~Bqw|IISx1IU&N-O7wKPsc8rFH`TNggpMs-Zh=KRNn9&NSX!Sz@X36U&
zu2n;G|Jky{qD?`r?LP-4*wX0QyW&u@E#|Kw;I*@FpvI%w#4pX6*`&JvWo#x`k(_#F
zw+yiM$1r$fnW7BPiBx!lC?Bu02gLaCnK5f&;DHIl5Y=2!8^qG_>1?goHr|zZG3-1r
zlkDP!E)q~DiBHF8_*bLZoCG=(8|R#yL^D<sE<-&hiTD&>2hoz<nPVG4W%r?5IVq$|
z;d6w)#TqjTR?0~yj*jbkF|B1l=u<S2lSRR%^Q+yU-K5tkgEOZ;(QZyjF=qhj_VCyJ
zpmS23<R<$_T`s9>;JHX|IfKY$TI5=j;~~10zXI3G8T=ILw(--jMot0oxA6*UtFV@?
zgm>81!W(jm$#Q09-635ur-WQ_H{WeRk#x&$jE}~pF2(^YXJ{QryEAuG3%bJTRxEck
z?K~CU1c%J6rJbj7b&?w-hd`{>6rrGQAmk%C)ly%MP{hg!iRI+_$?4Rdl6-mF93|ON
zLF+BQ4!JSe`4mLG$sLn%$j=}dKVR(vzb}nDfYX%tbV6My4ra`ATQjhjsvs3LZ_VPq
z&_SE?ytVR-%|99nT5jo$JA=G+#+|`w%z55=S{ZcyK_=)sDHk|-bP)7ivKf9~Ip|Gv
zyl>zyLvh~b^FX)pD{$V(+uGd-u!@gCwY<BjU>pAgVUu?+RXEJw#MU`)8}WPeJ(ZyE
zr~S8u>9eTd0Rm2@-$Tu9Cx9D-h2rn?Y^g3pX5J2BwK6>pIWTW0b*G)_+eQBQHZ>|B
zYR}h0k02!T_AbIy9%1^YaP7P&2^?j5465esBY;~6+KuHsMc@R}Dd_W_A#JA^=0nSX
z&DK?e=Ut28MJ)z-H1D~)U}?FA<URi+NQKkEEbo9cEsr33zEGD{h_P^K#Fq>s?k79E
zLbOxf7Udlx4{&piM)F=I+Kc;Aed5qdY^a;}4)tOkzqSDMyF_>K5Yg|Q2lH%`+pfI#
zsV9bK=6yh3u$z0~ZFwK|g|==UOVjo-)ji0sjsyJ((T9!c|CFZxh@w6to}Jh~M6Q}w
z{;#X%4g1$s^Ze3P`B-c$@+!u|Qchk;9yFZjzKVJ=^=rhl=!;#?s~Uw?jR96uJ;kUO
zAX$r1uZHM&{vv`iZxqpqV-z*50%&v`D%-tzbx;4F5_zo?R?={elE!nCjFC#@wPIcq
zO^MF;izg>#vTwxENp9_AJyc&#5uOwhi5CpOgM(og*lcp9CXoXw@&K530r`|0E7gB4
zu!gpi`?Qhb1|CTsIg{uy{CDz~Su&;Y?TFpHIWnar&sFl~zJy-4$@H3cB`xypJf6(n
zNi{Dsrt&JHJNN^neIC(QB+o5U@)q<)*6QTD$xW{#cI*-^-E=W|<|;Tw@`YKJ-;j~=
zmKzx<eJhU^wHNB4WGrKOs|TSzG7&l&$s^H?NKPh<%EDse95nns@RKi@J4YEL9|9OV
z^+6-YnlW@f816Qxat_R3;rpsUR}r1a|3s1;R6P(f$jhH$Q!psd3O(v%KZ0@WGa#d|
zw1u$C{qZjVJ^+T#KS6bktDyX!h&Ic_ng8<%cns&X#O0sr03WGuKNdz$6Dd;Xqb<)k
zNtVK7o@PnTKu-0Hmt+pIw5LUq4`QgE36k9JMEjoeB>g7h%X7XYk9t5(l;j^IJV}x#
zVGz#+l3W=9@<K^|;04(#$ywt-PL|};%^)w5<gQeZQ)npaJwA|ACHW_e=9#fSTQMn7
z`QnS#+<ZCwcc?JY81lQcsO!d%-y^<LQKukOJe^J~Gmc|o_~gu{Ss98lxLiK$)tr}1
zo1qLICV@rn1_t{jNL18A$ef<5I#DrQU|~=rsIT*u5dI!<q%MZ>Jy)+I#Vf_$$<--j
z>A^u+y%l>pvhOv2Q1P=O^`arHMAToD9HKrCsiSq)aET%Hv=QRTb0&8xLmK4%TTvgP
zrWSVeN8N?!ZA(Eh8wf{qUNUp4Qs9*>DB52m6{Vm=0<+c(XDJve0oSr}0ZJv%<e&=5
z!yB3FW@0HT@UvggIbHh;x(h}ydb;A&3bC>jRIwZYw`N1r1p%qSqfNzh6pUiEDDi3|
zV3mSe3H(|{3_u-gM@c}t4^dIjAh%BqI3I}M6l=^GYT*F80s@LQR$Mk^LZK9UO^US|
z-F{uR(`NMau<U8OHXC77@P-uY)Mnf=)z<uY6*zCR)zGy>QHNu|o<(tp-lzv)<IaMu
zZ-SOrRRwp`)GNFc9#wD;(Pq99epGNT(MCiRY=eG8-*w{Bsn(EG{XhbY;^tqBhU9iH
zXb+b*dGG_wwwF)GKBM5_>EQeM0UGKfYd{D1-N@qwyEa5p){;~57_~B$OA|g$bQ@16
zJMG>L`F89!Xl1?rWAxTBJO^ZfWhg5Fp}j->jbl$k491!W5YM{MHa9Gj7@k8F!!1aX
zmeI8i;h&ZgnlS=;7LSCIsGFM5*@DH7fHsVA19d^+hu~5LHxg~;cR;3K3DKNCPF-7i
zE1I!z+2%58Qs?g>5ft3+1MTE(I0zNoLGo^XBXx59GvIshj2da)bK|~DG?u=s2r+Rj
z4C7gLh;VYQqGXH=D4rD`Qomjje^0Zr9U^JEL&j~Ppp>NZ`NI^YaLt35R44aCMd7VP
zyJZX)uBA3Te4m&$-4UvRzZb5jq}IUcJFJBpsI-OmL0%}_NVQt!$O`WyejC35`-j52
z-mjoVVWS^(*PXTWz=cLxxQRvyH+lmO>RI_5`WiJ8g9#LNmSQI*7t_M4=+PMthINp?
z+FFOoobP}i70xdLZQ&V}ps(!!t;;Q9;X*5DC#MU}!t00*4`Y!r4D$TK>nYs5e4c2W
zVeLo9mnB7aYS;rMw@;p`6m20%MLxwV+DZoEe1upzqrZ*JRCFH=(j(1ObU)EvK1jSi
zBPm3gr|3bd+ral>*hLQygBQ0*a}@0$eycP`(IaGzHffHcM<X$?PHB#!U1W|0iW-D7
zdsbP|pQyW?s8w`5eS1NgqiC^Vj#fw(-S8(y$9c&F&^Km^DQ$6~<(Z(DFAkCg$TCGY
z)19STTBd0AtDrs7GDWu#?UfT;B<7%ReomGtT0@ozaC-1iv{pgi8u(?{<rS?b`4%N(
z%-9OWbIUW-H;!d&Tk-WzW6_azD_%MWdxWszikBINqd6~L{w)jv&lYhr%R*xZfFsCo
z0p3Nl^t%Rr0uxp&{jNotsrWWBli^Lp>!^$Evb)8%6WzgoCHeJa;!bWt9xC2I^a377
z^hTnW@I=H<@n#y*D*hVLTYd|nU>$#jz}DYDcPVNJ9`6w^VH{EK$D^6zao6UD?Ooh#
z*n22^q<H*C=rrdK!6Az$5N+Y-!8XO`6Rq>-kbR0L5$)t<$m7MWanSFU^H6+IC1?-k
zA%ucy=K*--L=?{;+HZ_(CXFm0C!%;3^}2yy<bZsKfJ_U2786w5`7G#G9)K$rFZ>d8
z8@|AUS@+zr6rFagEWobU8^fN(3Zeaufq7%um-SGqt;ZhNYhj_kP={;uSlS!MZmY&9
zG&&1-<K+UNYm}F~2@=>fy1(%zGU|&{qgeJPF`5>)mWK{_t&C>bt2I$Wx&(f0CW+Z(
zo(yPo6X;Emph2rl#EHzCDp8A;>qL=Vf>y0TOrB+9jpFKAwiz2RW_*<?A9J+CdC3&T
z+m{uCUZoAfa^cNnEdcAZZ;-*g{n!lvU0O17uh-310Bmzkp4+K-2e1tQ-HJM@1jboU
z`-rF?FdB>Z=AS_G*B#>YteRA5hl61|$f3U!w!?+u!r57&XLF(0SQ|as=>Y(TWqE<N
ziaPTqTMi3)wdDlflE80t<{jCYfHrXqO5S7tfgM`4jedY5>`H((?T<Ks_vI3T1?dpZ
zPo9lO5c=u2A?(zJ(CE1<)B{G;L`<ODyE7ki%U{3(?A^5xA_||WftD*B=PmF7?-MtI
zZ{auOgWg9;8rv`|WZtL9v7CzfaSW7pl|oO{8{q5SjdMt+o5pn~Ifla5V8iLXi~NFP
z`3V7ZT|`P1^?gi>XHzFt{v8Q;Rmt8)Bz@j5K~YNfQ3DF!k0wi=>cEgWzXnz=d1fAH
zJc!E%-Ms*`E|=|+=hlOE@|$(=4?G6i&97|&{o)6pJ-pNp`lUa{V3+IV?HK^CPz68#
zwHfrQ>0>EOCM1D=-3z*b-v^&7d1E|i<Xc#><jwzpZsjlc2mRJ+&~0)bQSvtFX_pD6
z<Q?+lPMM!e-lYLxDLM($c{WePz@k3ENX5cS5<^x5dC89?!1;#ZpntX@{aX0zFjdLP
zEtpK5zd;TCwj2#PjnV#2qjmFWtlA}ioJL)bG4j8t172g~|Io<&njE>pXy^e=4qas!
zyV9V^p@+<j>a=Kb@R5v0->S*cb4J5&)8z1bGa7%pR!H6LBkOc((ij>eYb?;DHKG}r
zV~N~qmc&T0RWbvV#7WOyr@c($GBUshEw&LpP?E%Gm|fZ~tSKc{wh<b(X(rgJ#3n24
z&=?IgRf1g_JsvEvOR!tpg^XB|#>i&f+6!>y5{Co_weEoc8Ehj|AJ+CDTuWTC&JpcA
zn!|n!1<FTrwALt~Y<4TGa8zcY61U7kJ@~F3RCpfI(RljRe(ZI|j;&QZkGg^TKAM9D
zRp0aox|i4JJ2}2t5z<dJ`ofKGjs#}yJ}1DX5nCo<ezhtQYPZc?3Sacii+B+E!m0h8
z2XLblc596mfTa@TXv5(@zGV@^&qE)yF&L&#$P%wMelWlt5|nB|M4fMg1b)qhk@@bF
zV5GKRu>aVG&&SApTOufS8?<Q{vu|qzc}$Bo5u@|nBZXVF9VB+I1XHyS%>egBP>i=}
zg<|4=JcX}dH{g3nmSaMx<|7fOE}&GYBA57fN}XNKwwWD@Z<iF?rWK24|6>b1N+aAC
zk%4h^Yv&_Yeb37BgIY;1fc+8QBUv2Q60v6Zo{M-J6L~}{qTwEhn2p4HRBI=Dy(GnY
zw7@ukm!;SVZ9^Y`LsIONi-O1ZR>Vu_l)_wzDL_Xe8WH69&W!60X!5-uK_?51xt>GN
z`#y|#4U^(wu0v?j_i@C`i3lC$`UZybeJ*?GXRfcvpkGE%C<U17vvi=ZBX*;S2Ie9^
z^c|OyEzC6<e(n2KqKV9P5)teBA>xtgN&+s_Tv^DgzMmqVxDW<quHVGBm!(em(F5KY
zSz!Tl4a7p?W04)`{1WD(#n7ilQVLncTrJ3rK6B*LXtoPOA#+5?ZxU}~uDk(2QIVJf
zWe0P4$p*b7+Ra>h#LUZ6$4wz`iI(z*nCmaHOH3sB{$b|YO@12}`QdaJow;^Uj}juu
zJB~7!LNlHiNvm@Yb1|C5RH@|zb6Lgvm#4D7#jlqavztV2M{3EGVJOduB$sikt_2A|
zxsi0%^{B4<BY_6VGOz0T#syR;Tk)%|RI#ulHS}a6c)rL-CcrOM*Mo2f-%u&hs=B@;
zUnq<G8f9&&>t>k5S1!xiRTn*J_YI4rN9~=e%Ss~+$aWT}u6^WCHIZJjsOp-Iq~Z%k
zmbb#9s;i82)<<eH;J~WumJoKFzGi8ZF4grunY2Zst*WbnJm5TuwyCa-xj<8-8Mdpg
zDO7K!Y;cF_dKY=!cd?Y*jjuxOheLRFPC$C-I~mi{rTRKeGyL$s`<#%w%0wwa(cXvw
z2+cE5cyLX|%6thdS~pF=HKvCkr)yu6e_U(Y1>n@ikP9p_(WJYz;vm5FrYUe=kCtiy
zSS*288$jN$+(cQ)uhG+D-)d6_KtSt5j=bLVHncTpzf>Sbd>c$BfLgT0G~SJ-L^xZk
z_PQV7VN-9Ew8_1j?-8kPjdqO0cA4@ZwocoEWaxX$bQ-$5G@X*iK2rfowrP8)<QZAA
zL(3&U-fx<KlHJ-=gp}`qsS}_(q}@ffd&zVg&_S7meTPis{fD(XMx*346CIh4I_FF+
zRD7>X(4);DM>;IQ3GEC;%$p`!NKU!tmjS$G+6Zk*IBJiWC~A2)m_9U7Fj>Okb1WoH
zsfXj|bBUaY9~%7^(qwLC<d?5ZlwUl|CG+9e(imRmk_qt}6D34HbIFYOog8!^oKSv{
zk`3X!^rMO5uPL0CPM9(&FSRgN06y;f*+ki<Gn|)xHBnw#z+A;*@0F?JWcZrRRDBI|
z?IS<vZKjjmI_A2XY#3{{UMSN9z0d2jm}yS7G1pNtPrP{{+S$Qee`5vnB}mkb4vGPt
zspIO&&S~apsNKU{5#&1Qvi1q)D#OC;%P=oR*(v6VM@acxvP@B3+me8?&6Fm%Y9u<h
znG&5vMWVZ-Gj-rjnvFv9SKzr-S1XONNFtBw@=`h)VeZ|E+^f2Ji=&;Xp*G6Eby9yr
zIB*-y<&Z#XXoS!EE;7#sLTWfK0%(SmYzs%@95bb$_HZ;_A}xi~aGJvGGBYJ4qz0L+
zE|-!^!pW*bmaRgv67#N#X}S>o@;r8#A3L@7a!l&bxKBaL>z1MM6i~*Ad1wNi;Ecyd
zLlZB<B4d#Uuc1kcK<k_qsG-T*K|6Vo_~@$4P!gujv*#NqOTPiBL46Q$?b-V$;hk7d
z)J7QBv#&Q?-*Foj4ZSpy4Fk|_z!a25v5nPeTDuPOUdq|NS!i2JfJsVw$<qP$(R;?B
z{?ntVegtO5Svr;7L-qfGJCsgi8ULV;qPZ}<(&=(L#I+lo05c@eaD&%1&z4<*u9RLZ
zS$0LOj)l%=9wD96Gcm-{TDd{eE)_@TrG&oEK<R-msPubivXo`AKJXsr<+GHse(ZOU
zibl`F%Ce326vqVkYkPSm`v_$+8<tnGi5Q=vWy6}~0k#YP&xx=dFRziuLyLADWXnfM
z4Z7Usl#e#L7b~yM%4;QZYU{+3tFuDi!;0k%>>n83t68uXmp4k_mr1OAj1&%N&mtVk
z$I3%ugLZj6K$8S5G6j{7lf!IP9DB)<W&Pz~w69<S&~*DxPXuTXYGwiEIhLcjsLk+6
zkvpH4ZS;ee`4o5xe-*(sv>zr4zOom~%TRiR0AJbP4|F!sI)4kR*HAanPJCJKvia9A
zw>UAsF!U`nG?aVUnvpON?JdiV8(~-roN^zNE~tG`1Td8C1ka+qHw>VZy$PUe5mcv)
zeFxyws>rD2vcxSfcgu${3(W1&Mq_JM?q~e~yqfL;s30J=Uh^tm9lPw>i<v`wd~L0>
z0v_wk-<$#O<YbHd&1X$PSM!d1Q4=b_j~iSYva;{R+EBmH{gBL$Q$ujw>_L4&$E)<r
zFMC;U&<QG?akIBrK_{xKiGCZKhx{a!PKnve(f9mhmE1o20`x53s%{}V8k2>0;O--O
z5f;FFoBA-(jc~*K6!kHp?}y9hr>aFy5_k_joNrg3CHgoukfy#!w7CIvy80^7d(EI7
z>RUvw73~YG(a&IB^RtYu`^B0CmjyQD!@l{N8Vw(ovymUI%6y>FH#qX$>Q!VHrO(hr
zp#JKYU`BGf@p1fANOrTC=)zU|O4Kc!#7f2Xg{jed;6YCBr*z@UzuNis!rx46yLe@>
zlYO`IyTy}P=qA|A;$7E>w8&?|dAzq1sqlxP)q96zqm7HR;fJ5XjNbJ*D30WG;T&}n
zwmnYo!*rsTljVK*>|{}vjpVtAji^pIozvTW&;JQ^8$xPXJk%w;{0Iu7d>EJ0d+22;
zBtE@SFZ&Oiy3PCZ3`~W*&h-95Q>pNY(WrHjXf9t+@cv4Ne_X^PYk7Yo1v-C66fAMs
zz8?b4pES{49)sEPo+jGQZx-!KGK0Tj+}?lQg}h@P{LJl*WUrzvO-Impqa>|pg@_I>
zmw;<GrUUe1??Z`2W=wBynK5<kTJhNu8(Sw%FG&mC0)KIqnpixhUPd$MvsU>X4Ma`L
zCV`LWibxu*^rN%II#`jM5~_oq5<5#POmtslXsIxr6)OYJais&jC`~fa9g=oCq)U@c
z+h-#=+_p3)CJ6&_dUM%RvbK0*X-WgdlK1g&PaL;kCL6qa7=7zg9xuInWr`19wLQs<
zn>K0FeT<B1(Jmu{J;lf)bgfzpU1no9i*d`GY`M5%nU8%X9$D5eM9q{eF?t&HHcaU(
zS^6Owks~cxY80ruF*7B1eFc7c3?@Em1t@>Xy;HC=kyphf+i1a8_&Qj;<UV?w%6TH@
zx8!~!vC(yP$pc1Wdln05$#x17C)a86O5{CuCXd24q~swgaO0MH&hj*NYUlFhC5+XG
z11tKoVdBRX*64NwYei5#`N5TX!b(r*0@$)*%&YKh^*)=T48Muqfl_Zps19F!J9?u2
z2W<@B<3)Gi;P@NWijH_ktb7(UKZx;<xY_9aJ~+yVRdVaXufxobSWUErM`4dL;ufNH
z?nL_|1kp}@1r(16tr-D5Zuw+(#I4l(9Qj4q5o_zf$0L(x%OG`I6F?-VyMjKKz<9p7
z>=SSt2~IRHvacx;>$FBs3P-w3ScL%St0^Nh<*pI=Ba7->!Qvt2IAh12%=b9E9l2ZE
z5z<legj~TC?LD}OZ#Sb$0<KN=0_<U90W6vik?q?nfv)9@1b9-4Ikn9L0rpAY*3NK%
zr`Tnv<I(=YGVOa>0<TtsRO5SwtwxDoyTlLBE$f&9+U?@Go3cXnu%zz*>wy678{rwg
z7nycGT@qas32;zKcWPJp0A6Aqlq}E&W01a=*?9m<v?6NZ6*doGm3Czcz#+B<V4XHB
z1K?G*3!qE;4Oz(d8q0!PZ_|FqjQd_^FP)Er{SNIY7G~dJb{ulMwa4IRzBkwtBj}>x
zVzSbk>?BGKYTF6CB{dw@@Do*v?`@WVZS@gt6PfHCHW=Wj(&rdv&UYod8+LZQ)PfDC
zZ!@bykL3-PZ%f$bwCwt}GV%4zC8-B7gT4plrop3)r~!CL0<X473|*BK`#3u7dsJ3z
zQu=g>_Eol!?9DG>WlvBCev@}mX6;8rlka!70_NjdbTq&zDQ3}9$o_vYFZ!9NT|i=|
zWu1}QJ6JY+f5~U20Zra|s49Gi&TBA)&!p1XVz%~q96$t>OjA~9*TC6*k!k?yRvA0^
zUMjixD(3o{{HC`=I8!`KZWt$5xGv_p4J(x|L7jwZI8(e_43whM)f>(f@&d!5cA)9q
zIM|3etNTw~L%nv%?i^t*dQ$AmR4>Jp9A&OAkRE;g=%_^JjX!CQvsF3;<GdlSKin!E
z0CC=+uekbhRXX6}gh5|34I_(+OA7Jl>XeY&&<|G6y?q#>o_qUHAj@#XaOkLBERkPz
z&CdezO38rgx)1I7O5_k4RK@W=yus<4&!!+7$P5qKNRN&i;Dr`nh%KX{?2$Cg1#%yz
zIPv`6w@~^3qWEW|ci(kVgX1`8r|)`3mmG$=>%;2$jNbXyEoCY@F5+%&i{An{d}|G(
zjpXOS`TATcmfu=5sR7p3eX~q&qd+z?TOKKmU7&A{$=C(n=R|{-nrPQ)Q5^5Ug`B>*
zrXNwqXmW0NjdI+E;5GZMkVkv%Bayx~dEzb%%GVXvYA46tB!OA`o|4373AnZ}6<~`5
znpR8!xK#p+_AMoryCq1}Y7s=fdnC}cgJRWMTg>$ZVBIHKncCAkpIDp6*tVTt-DYQO
zvoPJhYSg=ktQJ<eCG{dq^&*R+RBomGs_>tXge&hR+RW+8`<3?)jpq_r1S;h-e~p)5
z&s!;96S43(@$v1hvP0-k<-;V2wWboZd`{}-dDt0MK1%!?-i`rO?j+j7t9pUnMNZ`9
z9#M9OwZ?+*uG~%G)WCh1m&!dvH*qKN_foAE-j`Z=lK2z(R>W1Md|c7WDGyaXMcUf<
z5wY<OSJ@64#k0g&!Vh3(E1#oUtN1T@pr5BWUBf@F1$}_{yZB<PYn3n1nSD3DdiD1m
z)|kDpU?pWH+-vB|MBnv!6KSQbIwqfvDVhbft3H=GgKH#Q^@YqPnsyt;U-hLdNz^W@
z0{DvkHj_3A%W?s}mSQd18KkhP9x2wU#R+^z(ESG%$*ON<f_YxMb~M2Eviu9J7}l@)
zL4qFb9r68oTeSzNsp@Aor46&gT)!eCSN+10fSk-V60=)%Qlb{-nn7LtgGF8}v(8U$
zpg(0w!@WkT2yRFX(S%n0BYDU@aaakf&dA2LGFKIBP^HMcgiJ(}Tg4>W&Rlq_N~uy+
zI*lMNeF}H2GOKjkj=Ypr3e-!@LaW`(b@5Q3SXu8Nu4Ty(7Kw0CS|`5V5FI)}HcXbh
zx0&k`WTGmoN_|E?qr1Q=yDa+%H%Vl<G>MSi{8$dF(k1$Wxi%#OIV3`^JA~=3>ZhK@
zBqG;!BCe~lWC}vAyB?EWl`YF~xAI_!hUu1tT+Qs5)2>uCsF%W=NPWw&U{;M)X%d}g
z*JLM9lj?=iR<o-Q@><n6SvJ}1nut)WYL;c2%&sSpc&o<C&TKWi{zHS9B+)jrYaG0?
zYKBTbez4u_x|N>LRdvW@xx?(bupiJ|nay{bk(@FRrPi(tc(bYc@du`3#us81tDhj}
zRrn1=@1_;TtoMa&s`p5m>B0U0dr8Qw>ccz$-54~ziy9FPKxcBLx2n_Gy*l*V4A>fP
zrv5?b00AdnV8x_VzesX;Gj$Y!g9HYvdIvnR`XvGds=gRQtA2$R(;`*>W-!33?X$3%
zQT6W#yhZ>ou&#%Vs}JWub*rj3z<;aXB+#bn&sB&Mcj}?Z@Vx2|o&;}+s*j-Fe@Nh{
zs?+yEt3R?skJqF}`vH#94>tr%`pqy)^|4XtNQ+4)SFiq>yyiTUPM%)fL&KkF(o=H)
zj$aK0ttR~#dRqMrmCQEjgE52E-xBb)oAg3t<LVQHI!yW|q^#<n33QtDYx)BGLSVj0
zryumH{%sDx0+T*WJagBG=<BLrvcRi<PKSlR60u!5`7*;Cq8bYS0?t?YD$!=10y|W`
zMl?^Ja`|kf@^zv$K26N-a@8I~h*iEt951K+N9Ef@m+~2y+RAr`_VX23*(%>9dZgk=
z!r;ACLWa9MC|BJkgBP1A@nM&(p0>MHTNq_Si?$ZRRrgAuYxEV#ss|)+Y87yhs)yxz
z>ehZN0@x{2l}G9GCH4$eyVzYbuv>drjM$Vlm|jh&+9#W_X!Jr_)zcCrDt%^=*FVED
z5IZ>*wW`1R&P)t$gIK@GR`NNfq$*FwfWlm-V8p6HY8*^%M#xi{N0wdBT+dQ6$(Ng!
zCCr7Cx5+)Ohyu7o>O(4`DX1!y@<={OSW>IXB-({5+<`#DBtj~x84l!^Xdlu*KcEWr
zL-Y!X>0WX1=G1B{W!{le0tqIE5@w|gMkJVpltijj`q~{*$|D1Ss#UrqM@lK6cn`>W
zNGY4eq0OnRPV{V^7TRvd&#zS#Urc+8GW<<{0F0<Z`Iv+11r%NQl4843y%4SdH~1Fj
zu3jW}qxfxu3V_AKArn=k;rvs5BLxAchjZ0S=n<a6>DgTMQhI`iN7;QqFQ*517EX`b
zs&B^AwrMy|(S%m78U=Z$66Jw)TdD;`ki1*1UPB2?;nyHBSKms#;CSizKT0(@2sCxT
zp4GPzU*~HJL9Zj)$?u>jxSc%D%{Pnut$NK>utD`!;wXF=)w+jhGhYfjS8pR4zoW7Z
zQ(&onfD(bxukF-~l8go)q#VHUwxqaaYe8r<^p}1~_pM0>b&y}luSi7lTfm8W0uG>;
z9{c6&AWA={2sF;grC)C(Hotf@Y8{uybVVJAeL(3q`%w_dsg~n3(w4Jy6m!fD@6$jV
zJIzRL1~0YGcUVtKqfGe#j&3Q<O|?>5wBDT@-D5?u#dHZc+3$-*clS%7i^9?vxz|#h
zbCuF~DUL1aPO<;)d1drMPtp|Qg&umHG-)b*rR^{`<$#_>^bvj~!aQkucN86s)GNmW
z%t*k<)Uo2Kd&aUy#jE$Y*o)$)d#sKU_{OM<=oX+=Q4b;^kD9Utl9Bu*$)6P2_x5M6
zh{k*SYc+7&(aDxez)lf2+}qzZ7^g$K<#sTl`hq-RkAJZpGcbLsVo%6TBr|RhZ{F()
z$=8u}`tG|^dWt=TjO^j-d!fFa=mOq01aunFUVcvr=yak>`4_}@67A=`%0OojJ(53<
z&e;1B9gtuBw`b8?xefdzR#v;4*5?-aX19GnR7k_v_>Y)-`#^e?V+U`g26E|)v72`x
ziP;Ac-OXQuZ`t$vLgpa9q89WJ8qi_+cAvd~-tIfXKWYHKNLtp`0@t#K-)ndD*kZ6x
zv4`JlPw%lE^8@<iQ*69Y-(x$F4IF;2-QHvS2K!BWne=Ry+GE>+u(6jLFr~*v3x$1{
z0c}0DGI+b)Z$Q1rCf}g0Frc-^R)~4F4>w?Pk8Lbs**?O6Nj<ham26UF;KUxA8_SbD
zV8DbPTPDF81IG8*){3tC(j1$pui=-NV|r|K)o7>dETq-w9^NEAx=&AWAc$)%pTI(W
z(=n5+5y9EabrqtZw}`nvEA(@#q69BvC!L5eEsntD5;(QN1Ue*eYgfYl!7JG4C3K15
zgXagYl)$Ue_lJV>*m#uqwRPxF@ESG=AfPRTQv|PN8{zy78odf1T*zjkYKyj;v|Yy#
z1Y+m?>7i$^SqR?9rl6MB<Vr)r3@&Bl>wc4~FD5v+Orn6vb&|@KGn)Gblj}ZoI=GV2
zEVr0kPS`VelSHj1*F=(B#mJr8Oqp{po2dj>OVnv{tqh{<7KxUaT&w9JZcs?L&g8la
z9vECB(KaZBvjo>lwA<v074sfQ4OxhH2ivd!VQX@=qV?c<iF!<~hXw*|VBg$`Kr^|l
zy@58enHbn9lPj_a=uVaiq?ld5kPW)nW2nx}uJcLfCN=<N7PIT_0YIDOP;|5F{)s?a
z*)g<-ZRn5zm4NrkLbusfKxiB5XU4>sUB7yO?ql?7hu7@dDayB}#*WAYZ-@NNrv|et
zNwjV6KQIfP5`2QqMRV<D*S991J!~5q=rp_N``W=LSpY*=V9vFPecLnGPvVp983h+2
zeFUGA#|5)Fb%i;%%?8E`27{%5F(w0ym%<Di7&&6dgBhX4ez4yNvy;J|kHi;zE6hj&
z;|nB;;M-wFA{e*RG`tgLB!F=NG2RU`;=w4RD(@K#a|{@#umK6aAC`y)gWhWoe!%D(
zP>2W(oH144d>9t#1IFcK>5syU-e9aCfBQJh=mkdgATT~L7^X-tZbu{rKMhMnfbn`U
z7@vh1W-wxr+=Iu$4ATm;81qnk=mf$b_*Iz6AoT*d!#81u0!9v2u;900hGUgEH@*&x
z@4}39Fc##4@ne{g2F5)BFiwOSb}-I3!T2f6NCo5bCNNI1#vEyb6mYhaKl~9Ev4Qa{
z&ElCbLkHs~5&Lik-l5EYcrg1&Ono?`U>-$plsuT2nFS&(6x%$^hy~+(B-~)HFe3(x
z;bPCjgG1|(!-LUbc5krhW#?c_n9&Oijixa+%-~>LPHkDjj3_YZ7c7GD2E%Lu<611$
z!NjnH3dSO0B!w9aj8Y1`WHmf$1)Lu8YHL`;vBsS1A~Wb=MmiY(h_yR1@cRL~cMOjI
zt{R1oaG}1&?AkB>+L2l^i29nPQo_MeZYa%rw)*I7ELLXM;YgtVDuv!*905y#21s<o
z?82{wK9U+5?FMg%<ef0PuAn4ZAkitaYZKO}V4*}xgzM#IpdyKQgexi=s8}LPglj8>
zxK|=Q!gVb+Tfq{EoDr@patEJ8?g-a7bR{@cB2R=XG8X%bV5x-O2v?sJ@y8?X&>)(&
z3S*!aOG`xVEtExvhZ#ysgrb@e^|f(%S78A;f!Wl}btUYZtFeI4no#Fs&kMMgTodYs
zO29R`x2!8;uOPixG$)#<8^(^Tz%_*SU;#h{qu&8oryXs9Me0VdQ;3%?7yU#~-AJ|y
zvu$CnqE?_PJW)X=W3F}L;G_LR*TATCb?iIv)~PN#W}&Wu(eukL)kRyZx-k-+P+fHG
zUpJP~E7Vv+?nVsMjgyUH4Y>;0zphy#tRWX;NOj{SYB9OyVkxMbz}Ol(F1kcK(0MEs
zsLkY>W=C$XJKy-iugMicr|T|YMHpkJ$<-lN>`Wc#L{!vWBzdc_7ErTOSj%E`*W`+r
z3^bMHLs^%}HA}p?vws@BTUj@UwS(7fEN69>%C+X8$+br4yZXmcGOoLlT>%Mh&OIO+
zc4agd`N6w79It5>bKd1ROV-T~Gwc>~ZUN2AwFbjv1LGuFZsFMw2V*T3fV%6#3@aEP
zi5GWeuqER7uD+pLX~yG!#T;9Uov?&jUr~82IzU_6`r*cww$FK>N6@>qhxvYlQvFE!
z{kl`~IZb`#e#FFIIxUp-RYYq{{|Uyd4}6=5MU3ekuzGzBE%9!qj~)v!iU8h~?bm?E
z4)vo6d2s=UpsKHxTLGpIuLTGa2r#{L1b}?WvVrMVB+7dE+gYtlk3^2IZ=_c7YV8Gx
zmin=@Z(P81*D!!40!#1$EnK929C^qprgtNO)Hf4Y$8>iK23_AmQQpOL`VM0K1R3&7
z*O7qh&m*vd>7zvc<F@+isUsJj>cVc6=@CN#TK@q!%=G)Q9@S5$y$assogN1;gTPUy
z*Z2Y22=qWFtX)5ozzL>jirXL0$*;ktv%bAip=B$rMIF=yFQ})lpaa{1>4#A2FEel|
z@SEbd#~mS82Doz#t`6=UH1;bDYz2O$5SYHZ4lT)4PFk-ra1!u%8tFU(C$`}Gb>k48
zwFwQF`lx8Ef=lW*y0Mhvt!}0M&dyEH!~dWvcg<e|lIPP;71VE{pDM8M>n{Yog$%0m
zQOE}MTgmKBPUo2VduR^b{8e$_377nRj{5C1`~dHb)wupaqVbh*nv#czZo#Xq(Ysxt
zcrxy;V@?Ddzm?j0oF-y{qE1Id*Cq`?-=fBX)N6-M1<fhCYD-B5KSqJTt}UbfaQRrV
zww!2un`aIhs7=0<>N50gLBl<?uj5z4bsO#_QjzD1hHWRr!@DEq&;&Q!cla(E<7-%C
z8Xh41I-iBM8XoC{PAC5ke%kOTjn~b+$OsL)=(OkIH`_r!{yge>d2a+j!xNMS{hU%z
z!)~Gj@`c`pz4StF1NV!JJ=Pl9I5%|DzPa5t!3=u8F++|{+fT55gS_E3v-D2eL4wa4
zrD>hEhtOz)yyu3~blTn*3-_d1R?@f*8Zx#{n@v2lXH;muS5X?{UWO$i`Fj|$-O}jq
zwGbnp0*#Foh6U-zxEhDc?W&^Ip@WShdPvsOST%uUKZNBQtNrO@u_4%$HU_93=d^om
ztRWG+rW*r#lwmP?#@9HS_UFBwXqVbkXN!e<^{Ss+@xpTaNhfKFBRYX-yzonOBGH()
zB@Te3cGOB+$AXW%zX%e;ny_{~N<W99@aM&+d#yFERe|&P<^^Qh;#|;A5Z%B{gF){m
zx`kg0^9T13-OB0rmx6nVZsS`pl;D#@xAWh`uqW|@T>)^OCe9KbQ4PAA=vDk(aVbg<
z6X$v2Y~vqc+Jgs(-hn42cRgv19_t6^5OEIjW8%3dGec1bi{K~3;Y=S$yW39*SeTv+
zqXdr<(2cAY{EUE;>Dd@t@C!1Uo9VM_0KO!EOzFqs6#Sa<ae(RcUH0H{DrslBleB$9
z?!JKOUz37wDgF|dutEE1Z~MLU1~q*Z8+4PHx6ctbkoFYvD%8wU!L1bc?{kFc9j2hX
z1~oGs+{xpCPs+N?3VgH*_*VlbuVQ!u21z;i+cugZFAM(R$1-Tl(4WQ(`H(1re~~lb
z9TBqi-_&70mz_UD18&eL<p&i8Fc8Pa-{4|FJjp^)tJZ>C5mY5;)4qXo22B#QYafWq
zpUNt{h15q$)+()^AAn1+PAjF6^pc=Uqje<MTY_!cG4a|{wve3WSh)^&Yu}O@iv)+Y
z_h^da<nijL<|+q>m*=n^&5{9-$jJUDT+-sna`&M#*Na$tgI0;0%(a(1Oqb_bH*?Lw
zni;f7<Y7vm-^gS<g?#~U?(?;{<mrAf^b<=#C+mUr@C633>FKP(0KzqxX(-g_=R|`2
z<o?C2(T^+zvn23nH<5v|*$=4c#ft)eJ#9PxIGLe8n+aB*fkmKmn05m)UovQY?AI57
z=A+;{V~_8@1MTq{$eLrnjav^gg*F*u4PRjni*0!piheMrJKbUniuPyp&_9{bIf#7@
zJ&HCF!5;Lm<D^u3g+?}njiJRsJ4EwX$S#I!=tiGQWS^Z{CJn$R55;a{Xr;zzJk)%!
zJiK9Xc=Lluromxhj9<Wx<jM^qsyibPOHonD5^lsj-d_k<Jy<QzvfAHGC<w6AvU7Ad
z9;}gjIefp<1TacU(eJ)Qp=zHGMSJ&<iL%ZZRtJvp^^xFMqmI(2mK>vrT}8qdR)8MQ
z9-}sM3#iQr@(MtsWh8i>yc|%Rm(J}_g6GTeP@CdR_rShVV2UAN^kXWc3j+G>wG*Uz
zyr_NF$<oA}XNzak_uraEP?RWqHSFIsau-A`Tt~KPsyq$0&NpNFnyQGVtV+?P4oU^9
z`f7+q^1b-0ZfnN>=qLGIkWsgQTre*4@KUIxU&k8PkM7UtO3<?3YNH%Iu0Kth&R@rF
zV%$Jdh&QB!f4_Acx!$-zr%~0*A9I8DWGtfqCfkn7r!EBeSRd$u9Pk_X(}<CAg~gy-
zc)|qG-YHH>x^$5`&Nm10ZM;ov-(MKN|9o(at1;Eysi>xM@yq^t{X2|&oIMf>)Glf}
z{X?{^num$=o-6jy)l+kd(fhtAZB8Yc^AN(cIgM6VOY+Q1l;(6Ib^eif_BmHH4WT)c
zI9}dQ{PdjF_5n5)&AHThyg3^UdeA2;sKbpS<N5x1935^RYIuEGn~hfP=CgN&ZMJ3@
zy7}x~VVms-(fNE@OAjWh`Rtuwn{5_0Va*lcwAp4GOT8N&&YEquS7;E%!0}ioW%A5R
zmFAH~X=0oF)wAX*T7uj0t7qRoZw(DCgZwDkcC6wv5fRO`l;_vUElzWg=q~;+Cb7Am
z=xzLI<k{v1lHb9HAonznp$*n<z7u)2c`VW0{M!Mbn@HxM{Kcu}X4-rlmiM&H<LPSl
z2=8Zw%!GMj(Sf+ElmO`SX^V4$?<D<`XzO!Ir<=Rx3uviPnEs~Ndmx4F6Ym@-3sK^)
z3-8OeB5~K1QNtXMUqP1>ZQ(0wKo28Y=W!(CrvW&5ODyOLqTO7cGDnbi;wxbv!%B4{
zk7KUXwrY^Ui7VmWqd~USUHKVkL%j2Xo3Pb0_7!zk(OyEAm(g`s(>0}2zQ<d44SBhn
zKTmqDrEtR~IE-5tqQkvk-rCoNf8>~c45n@&{akkgUj`G@T}O3WIPF#I79WHDRz-aP
z0Z~`~9Xb)oe_kmpFQzf8$a^uzCbCh`OubX&E8cbEwVTKix#IE{2eL|W*Nb}S0=Q`1
zs+r)Y9mO-IyH`Vie7$Z>BzOw{pbqp}!-6!8b+;K7r0K0&XISvZB+$1L?Ud77x8B&D
z(vN1=Z6Mksr><@z(O$j-{jU4}$T|=3sH(J&&zVWNgh`l$WF{enKq#SwNdl>tFiOb;
zB==^*NRVPgMeMjXEbD+33kw+Zq96k5+7;W19oyO!J9gHtyZWiCtFG<)|Ia%~?yx)$
zllMLMocEsI?!D)CHRVV`*Pr&SRHC~6v~Qzq8|g@B`!$rijGwt~)>Hg$;}JB9_Uq`r
z%$UF|x&ABsE;oXdZ)EnYG@fRJZlb)}_>BqF)97`^qv&MXZ=w4}L$6tHO*{u>tML>n
zW&3TEQHk-}emmtI#{HPcweO(3)A&2a#r8WX?=q^YA>T#$X@iZb{cg&;jjfX)-$Qwi
zam9GZ_j0|m*SHFer2RggGxxbM&=2{3)`y=8BMZ>Cwm(1xwV1tD`$M`2RAD<>Mf)xm
zF{W%cu@oMCay9A`reDmy$C-+9JdCHcC#Yb`Hl`EGlT^a0@NYe9pD8N778BX_XIVCw
zxOL}3d5(&$3hR0ve`eIdBhaMUUuFa_mm8G><rOL`RN;*ipu9?Dr7HY`_k4}YYE_uW
zNWV#CohsZs3(6iU8`VVa*0;ZNEK-x^E!(OlKG_p}b|~H=U-oQCVgx;Y#Jt&|3jf4t
zf5HUqRE0Y$pnS?JyHw%fbD?}j<!M#;LN}Bz*+zEr<f+U5!aDvTQsI4%vHN-(97?0A
z{g(+nsH>cyxBn{Bzu0KVzcVXj`q!TLgJvRr-95-GPbPrvGRy1IpJ=wrEU(+o(W*U7
zPu!O2DP4PpR+j52UAxTuR`@4jvezy%zm@*^OrgyDR{L*e#>&iZogZ_)fu451wg8$!
z&zk3oiaDul4``<yeoiObbG5S5KeFf1=ZfmM>(HLBop$T#XnRO2d-QCueTbe7?yca=
zyuDZ}hN>v<2|Pc3f6mR?hxN{0BAEI$vtWj+2iN0_yRP<;Anjnrp?jcFdh+S<>#k<B
zVqX*RU(|Ef^P`G+{8jq|#q+Pieje4<UWIR?kfZ+5J&!y;Bs*_7oN91r4ki*u_k8;N
z>-+POedkN+q)n&+ejXy*xmzoS{xrDrWvvAKd8m|~uc~t~3&g8snACQ@rj>I4qMqMg
zC`xc*(78wL#g(xh?`*W}&PdK>*deTexYgS^Sv_?HZlJx@CF9QpVrQeC^#!V*X@z3;
zPUi}%C!n@;PU+2%!s<_^LGPXJl@?at!|Rdc^^!zkwKW+I`z0NU3#%6mgFY>(4=JoJ
z8wq`e=w9sGywn1HW>OCp`a>vz&NiLga{m|TzB*^Cvyj|M{oJe5($BrZ{>B_!=}_F;
zYVc2;2PK9p7(ya?KG``}KeCDH_u@O}$wL-DPuuP6(#h`fb7Q=7zE+m`H=y6^T%aF`
zt?)mB`qQ~kD=Yn7=mk3$Yh|^64QgKJ!HV6{I{$Mspmb{kTm7$NXQ*>YPtQyFlXDrH
z!}Ky>m;YV#cb!Z1{h#)81n)dTD_FC1L0P7iJ^s6T-hF9Q3BRoCJVrbHR56YjcbsCM
zgI6=|>M7e@9Oomr&J(m77BH{WLHm=|uz>maKxijw4GS0^A=i1b;u&&bRq^3|&`#CM
z8Eo2qhB3VJG`&EIsET)b{<3>aD;MOQf7Wi@s^XvyXlH3{nX32#Jwj(fYs*!|8YI4R
zm0~}$LRHK_<?cL3Yb#YnVbAZo$0T^jbms-yZL6x_3DljdwRQu(4#s-A^Fpodz_)gc
z<waWCiMQ8Sw=UM&F1%wFhjxk9o>mnD(bILV(b{gjeo_wYFIwB9Dt4l7cdpgiURAMd
z3G;uQRzFu2M^{2yueEPf#cSv-Ixp2p`AJn2q4sq4=xcc8j4RI04O+v?wtU9Z>1Yja
zoE0-NSLkqs-iq2D<CXeBC)4uHx@O>g+8=w`Unx!`Xk&-^<5&#7-ijgU$vW@Q+1~A~
zh%(Z5N~U@%UdJ|C=Uv+Va(uGKjJR8CEASy+0NURar*td56|2}a?9}1#$==;;U-xNk
zowuTlHR=KNToDElucu_d#?E`#Sd1+_-@X!xKgdjbP$o)ojQ*VubM%iGld-+f`3U8x
z(aJivi?VH0z)a_3oE3B#hp=)z!P>XX2+xK5cb52a9Lc-r)zG1QzTWvPY6-S1hpsN-
z!_H3qVih*LRvSk!mtSH;)?w6PXO&_2F2mR}m~~+{yP%Tt&NsN0)!S2@dyZNKQ+kJ?
z^KI>nt;IKA#RpW)2(b53R5_2am(}(|J$g&1k35^uFTnQGFyyTsiOV0qs&AHo3u7xg
z$Ejry{9J~0j@Jd{@pB#4IYBFi^n+Ep2?we>7`d?YL|MV|>g+sE&l#`fj2t;1?lmd|
zQyIqD8~97J-q$;kXOl067*ex)ZhLKFw%%+!m3dic{Hy27*CvkQR;Qhqa5Zy!Flw8<
z>ORPO3-#vVIh?;^^0BsO>gz>`Gf>6s)z9K`L=|30<sxoLV)C&DU8H@9-g{Jqcc66a
zHB`D);i-e6tYwxgR};HYR`z;bCPv{3HSuf4?@}qF5OlpO*&})o`sZkh_6E@lR`k62
z`baP`e|tTY;L-i|X5Iq(rx;M|t0-3*VPu`Xg>r*&Evm1bJhqdEH`-en3)|qV&E9tL
z(X2vzm~C(8v+Qn<w~_(sJFnt?F2n}=g}+1A$6nemGNB%0HP#UJOQ+W%S8#efI#heN
zULNW<RP2|(gr`C=`WlS_{($;zzs~%wEc&+RnK#PRFFl{XQJ>A>&7R77&-0SUzd3HE
z_BoS24TEns+pUxXMSO+WmX|s3flkrc%)(j8EGsP9OP{loIaXM7W6xD@mL|C0YTM#C
zxX@S=f!Yz;!uZ^P&d`q0a>RI$CEv+Y8>7bi$TE8_7b&*UfYxlsDR&u}T%H_A|J`~;
zXU}7eSSD$luU`VtSOI$hpPH;NqL{HH?1c<~>G@m)Uc^jX=ke~WhO&4#Vo?&cm)we+
z(g)huhf)Oh30<OnI7<lozG(dRQpy2i_AtmtP%hMqSbG`ea=j~WAI1B~xw!Vxl*7hZ
z<({6Mdxon!dfwU7lF$!TDi1;(lmjoVF}j|}qo#51ZAB>;@$6BnO6OL-KT@=?9O^`^
zW_cq;`ms$|)ZlbYwy>&21-nH*O{vkU8aTa3KWwQLHEViNWzWX9N)OUcuNwIDDyk2-
zv>LgvwGI6stBG=#p&u_bOE&8VN+#E-%Z#=NBBR&1%jFR5uMlN@h;}CCPCbL(F2k!{
zRd0u8u|ZfHn7D{>7v;-%W-(5UMjvTiPPt2GndQ)Mx1kfgky*LS_^}p#uAsc!<6YLX
z_U-9ISv}QYR)M$Da9*P3)9J&>`BLrV!9Cx-eLB{d$G&qy;s^Ar^Q)iUj`!f$6E|j;
z;zin$UASShITW+HtGVa!9WDoGP5*ez<EG$MIQth59M0N?U(fvm(M@|E!@UeujtHv1
z&lhxEFOeRVOaIF>(5;2w!-tJK{ALNeZeL(sg1|Z-4?`1Ro$q{19y}UY=et0Q1lIXh
zYY(K<`7Y9~+mT(qi?!<nAH++JWH3_ed}}BsiHn+A=i5LRqUz9z__k}GzoB{gu0PU)
ze#=`n7xGRzV`yQF39RcG|6b8VQs&ZUzeLk(5jNvB-caCj=_?k%tA@*^pH3g3!S$T<
z-YCs*%=~eQb^*ijhW9iR?)mq~g!}!y2$*nF-xnra=3q@#1j7-QGD8YC^Q;^|CR}Er
zLYzEj4*(PHFYgNzE_0N62yOy#%$%s+h9VHh%&=Aj;+R>j6@fTr)@Vf_j+wP;9Bw2K
z$IQu!Q51+{X1$t@yCxZqnMo#G=C<K*6ee8ecFMwp%e<zN?qtH5A9NqG5W~wlqpE>b
z;(|{6gqOpoFyV~J>nUm`oH6Bk$ijp(S~f!#CY%vD1F|sTjQ!4sEKE3K8Y2iMT+eSG
zgtAG1Guq#U3juJ$_6h*bSV%md0N{*8lnH?A*jqB;2-JiDnjh&6XFxn%R}~_}vMe4g
zs}V~B^G<@8+1PXC-eDu3iePv*KSCoAu#$hu_mBmw<ZrnavIZ;d6|mC4!S6GujUG6V
z-RwhS)2PU7Gco{i)I(9WHh`C3304}Ip94PvR?4aAfvmwwIkk&n22b644)}+Fm2#S%
zM|{im25U|;3t7NQIaB@vcL6Kqw9vi5=*F@mXXbB^Bl?ax(Z9n_)T6;l0}HnBjvA~q
zX#U%b;nKrAgAUpOFY;FHpas`K7O>KwMTZVR7718s&|=yz_h|6Zz|beO1Mrb&cOY;m
zLeNeix8F`6PwbF;6d3#fd}!`b^M~Xf9ra;ZE|EP0i;lyE!9@0W-{`sG!?I>>A?M{?
z%_yMZWufrAZJ3?p4L%D_ni?`Vz$)O~iau&^?y0DBXrG7+C?MZ~?pD@Q@{v$L{ADNL
zqNafO%cr2EgaYCpejH>yxcMtaLzIJL{Uew<O#xZ`kx)SV<5|8QP(U8~NGKrw8b-{M
zOA3g;R!352v40Y4h)_WMlUaCV6C8=ZpnweeSSTRbc>(l(LIKInZ$gd8B?TnAK-<*Q
zk?f$@OrH)yV5k6z7YayrA!SlP{`9d>K(b3|fE1AJ9}5K}d)!P!4Q~xZ^9W|ho*-&T
zG%u?eYL%$Pfa9P!W=|A#NHp)>R;Xc7i=ug?fMi#TS{ThE1thyh)KD~!6p-vmq6VXR
zd_<K!d1lY7Po~#Cf-c`1W+wXh-f-ypK0S1t77s>ggl^L!dmK;U`kqHWDIdy-s>)&h
zJ&XTCG-)-5RmX?iD&BJGr)Q{>dd~c`JfJ;>=<#h_DcaI=%crI4+@5DYeMvpibLD3x
ziMwIjA7cz|#&{IaMWXLCik}h&FV-DhU@oG8or=3SVm*S}7&2n*T_7XY?gC!+c(&sn
z{5LcU$#RWYF4(HC54MVK#h2!c+N=hV^4m*X^_|xR1Dd$%JD;<P<N&5c8Njp$5?6iw
z#8ux#+QasqZJ!Hq)#s)KC&#XnXl@uLioVM!YU1iYJ{RJu?;d?s1~7{MOI-CmuDy`B
z>ifIC9f_-H!zR!y&n!(F&T&T*SJV25t7-kj)wF)%YI;9$bwS2!I!X1&<g_P_rHKnL
zn5Mb-tLgpx)pQqsH9dvDn%U1^&Ftf^?*2mftA>leYPk8U1N!-^1AgSqH7|MmmwK$V
zzvNhZ_Lm%MAOCVxg8bD1ZvN^3H-B|NKYtb8iq!W=&^dlGln0cmG&Jnhej-^1xRI;_
z+(^~|ZY1jfH<ERLMzVI{3+sU}I>60j9pGlN4oG3L4oHr_1Ge=tSv><>NY(-UNY-8d
zTqDD8RzH$8E6m|khTp8o9A;(s&2k}Gvs&(iy9~csk@F$T@SEjAvSv+VwsQEr?O&k;
zhu^Grjx-p4CqcFi)S`&74Q(cC0m-XTgGAOW7m+oqm&l4fD(fgRV^??vl)-B=L_Iae
z>qi8&4lKc9FbQh)_k&vfy`a{4o}TGnl?$phyC2n>?LxI?yHKs!E>vr_8`YZAk7~`S
z<}Ed<HAgQ4^eiE#AJv-eLbYa>YgFq;Uyb)agcg*YM78!5e|@G#v<~V=v<`A1S_kzb
zS_A!v)<8d^H84cC$B!_I2l^4M0T-e*w;$1(>q4~Vx)H6S2%<IDg=o!nAzE`?h}K*e
zqBYlrXw7vYT60~9*4!okLf<Kf)?7EDHP3};9o&y-9o&a#-SK~dXf61FOBRra(TNqf
z5Um9m#5wK}(OU2^{RpD9;1kM%Xf1FdS_@o=)`Bm8(Up;i)`EYYiMkrm&zK8bh}MFy
zhxJ(B2%@#%ySn4JoXQvu|No{eh}MGdTOkXgwcrQJf@m%Hk+L9K3tWiS0vDpSz=dcn
za3NX?T!_{JH=?zm57GMVH%UZmupiMHbRk-Ur*M1L(1_OHig_5R1ZEXH?If(~1<@Kj
zow7!>c78iNkv0Y+UxGOo(TLWd3(*=p`$OcAAX<ZNL~DK$(OQl?@P<Ymi_z5JI~}3X
zCk|tgaU>2^@;*Xf35``cE~K`Gda11kKnAt!+dPeK4Y|;*As4zeRC_T@3c5AqLbnP_
zZKFoFhU!V?BD&T3PSCBPW+JWx-5Q#raaV$F4YfRnX<?Y?)-~S=x-~SNso$$Kx-~R|
z%I8G4zWAM>TSIPiYiKreHHmHw%^|4{AIR2>Mq1jblnc5wWKqEfvX@okicKXV=+;mN
z6@2-c$@IslbfZHfx;5X0ZY>ma>(YOR5>G`?bS5)XRv3j-&Vwu~jKY@5kg>wRI9)jP
z4@51ZAI29(nBkbxljfT5qPZ6J(_D+pm$8v2i;f~~Gr8!<chOvj)a3QyT!-}GTywsc
zRmYH~MYxTuI)=D#u0y6=0C!n+3~}LHhq!RAL!!wj66c!l!np?faIV3F_9A;^)e&64
ztddnnaM8wN6Rgi%3k2Ob*L)YwHQ0}H4eGMNt1HN?pbO_3w9iHb7o2O*g>wzMaIV2l
zb{Tk$paDynd^gUuxDV%AoZBDK;yj5cmo>$Mxh<rZHH&`WvgVQ>1m~LX!nv08<6KKL
z?u<Cs7k?-{fH>EZQS9vdaIPieMNQ&dOJrM16${R_L^iHe66acy+^HhYwWt0+rB!@i
zx%cz7B(}9A`Nm3;+S>bdo2Is&{U4#WmducwYHI7l{}F0yNpe#%Np0=@)GSGDEje0(
zB&n?>E^2Fui`rUpD(iqyTT4#k8<v#<E<KYC+7@bSzKhyg;-a>exTviqebm;Ie;lr<
zttBpMYl)lMn(v~vmiALyOHXGpdkj)rOZ%v;dw(2WG;20oR{4%+<SxOazx3?4(8q_3
zte)bZCMMX`m0rx&DIC|*HJkw9&81qnujS*{Wtx;#x{gm@mmB<)vUEMG$O=t%E$yKU
zvTGFX8#rUw7~~6WrOv4*uumiFwbaFWEp@S8ORsvFpBf14we)J{nZRC4w{b^MV6UYv
z*lX!^x>z*qbph;NuT@{cUXAcAy-^A+f3MyKExk$9Bm}nfW>E=&Wt?u+YESg%;Ti{9
zx<f7}aj>O#ikig1mfj_55(is)w^qGL9Bk=5q9$>$rTP$qG?lqmaIpEkIM|net|;Pr
zDP<;iQUe~1gUwIkV0*Iv8_MR9v}OB$fV2_*TK!*vzn1B3cY(i_x!|v5F8FJi3;tR*
zM`D|Vzm_Gxn@qxA%PhH?guj+0H{z4<*Rl?|nuNb*m&HUM65;2}ul;vg;@pF<XcVw1
z`LE?m^nz&iP>4sxQEbI5JI#L`*3W+(md~TOg#S7$_#|Y#$2}}0d*6I^Kdg|>!haoB
zL^+`Oufv8=7XIt7;sY{}b?C8sHvck4vtNge;$>mK4jU~d&O@AsRc4}MB9rTS{`rfr
zUq|E}1}7K$wf)y&YHZK)UrXnZ@j7CdBsIx+9Wh)~gkV2CVuS?NjMot(PlhGETQgF!
zg1a>%dl|29|2krt24?m$Ua{RVYA_p0Ko4)D@}=M4_WUR}^>tJ*6CFw)^>x4BxZiX1
zZ?fN0*iU^eEPoOHWWT3yILA%B-&0tz6Qaboa0EL9z2EcZZ?fN0IG&>|_j~-m%YIK`
z4HG5Q*TPzzK)v5nIEg)i?DrJzOMPAZyX^NA<?(0|+3zXJe-1gQsjo!^+NR#`DGG{B
z?)MbAsINtR)YnIUm;IiiQX1fX&$qwJeoxUj$^RtvwP=E<N$P7+@6aLC*CKf$qLS3t
zB6%W$!`wCXwJ15TB&n}O$tNO7>TA&?v7Ds77J>SD#UDa_E$XMfzWawzUyC|8eG%$w
zQH(OEua`|wLVYbdFd1o~z81|(MjF)D%Z^k+eJyfPUyF`nMho?|sF(VB*}Y1ruSI>-
z*ULUvpuRfUN(uJ0=#<OQTMG8I$c23^T0wijzB<P!CEVB1fji(;xUZx0-e52uiZyyL
zMNXfb+msUUYh|tsA_Tuyy1=iM`q>Jq116=FF7Rt*0q<7s(cst0;JYxW!LMTi_3$a+
z*D-m^AZzgJn8E$#$GE_+WAHwxGt;XEC-}&6%n$}Z#Ht||^P@^Zy^bkiuZbsXa2ex5
zy^bkkBrw4t>UGS}<8T>V&A>kykgpYwl|%*kkZ5ckNp8Y>96Oj^lJHkjT(jQC`~v?p
z{dH{q!(u2jx)>oye;r#$5g*(*zk8M7U&ju~fKy4~*iyn-HU4#MS*`Y^Z>{G;=!4WG
z1TSx)-}12&oIbx*;+Oc>u@mVm_}8&v%G_e5S&e@kTYVJ7k{ia()=Q*AyD@<rdjKc<
zvRoP4&Rj5zJF(ImYf%mu{E%&I2Uib;M)5+(F@}v8&o6*Hm+n#H?QY2Wt(fJ;kq1Mb
zNB0#*3s#t8yXb!_qCq$B0rWcm21X-1cH!6~a7|LYNJm3==wlbl>`|xwV9FrUIxUz0
zs+XLFc+(+apsO#gItPI@leRd?q%E$gD1|*f*ekAOIFBx{;z@d_G)So}o=h)7sV%Nw
z0SiK@Ep8yawn0;BiyN<j9ML^?anmm_Bb3@=lN}MBH#+~tCqo)jTikLRyaH2O-1<Ck
z%})S}U6|Tp7pAs&7QG0jws<ykS1`53E=+B)3sYMxgK96Pwm3PcCNZ_e1CxU)F}2Rt
zbXAZbm$rCr3vPnLSP@grr5#tN{tqrLF73D@)lp^G1m;8cac(Z{I5(GeoSREKj$B$~
zoBs{WJjNZT!<YMy&xLY)@?@M}YyHrctCL|GtXe0Mp+-bzqxp@)=?OYY?8Qm~<3o4D
zho&ixFQf=qEqskHx}VO7`A6FGDrnxDooiu518gS@CKeuxGuwFsj1YCX^Fs#CGCvA?
zQ4>b6>hKc>dhsrD#%C&F*jBk1wpICSF}o0kZB-w`wi9k8<yA#5^4g7vM^!Jw)>)IO
z1Y%p&2eEbT%v3_Lts2EDB^2ALN?I0*ZPggc^0dBcEUgR0wrc!!<*Y`e*jBkHwp9~Z
zrG#Qz6{ai{+p3x<!V1N<Y7*UrVp}!&06ydpifvUrvs5Uy&T>PQHIi0a)l8C2N%_QC
zAK{jI4nEOEtDWeg)lQVPyT{w+JY}fSYJ&5Bh6;^38$EldJUR@Ss!_C|VJv(>(T4g^
zw9fbes(mC`wBgF_@S9}OhBxrV4h<s>_p)f6s|To1g4EQo3q2d&!X81;v*F}BEJV+S
zw{d$y(6iy~heH<hZ1`Hb3wbtt9o>aI8@`_ILY@uZKzAX}hHv6xARy$~@Xc-1$^|_e
zzJ&^QKvtm*gm0q~!Pm5?M&aA3*!UP0oke&Dm2Sb&hWl`|&RJO)>oT!e3IB~A@CNY8
zY$*3q!ArkH)P~)N+OQi@8+IdV!)`=v_z_m*pZKD%gACP(+Hk`#WTzl%!;g<0fvn}{
zIN>L(nUIB18-7w}xn|Uc|Na&RAVJiIU5MJS3sD<>p1p%0YQry3ZZO6=hYwWE)qG_l
z>|)f0U5wiBo1eh6FlxhZF)CoxIxi1IjTr<b>_XCpT}aw+AClI|@hf4{hFwhBu!~6>
zjxaVrsbSwB>|)Y}-Avl>v;%OvlEU!J*YQ{P_Tg5B6P#?=#iR|pn6zPG(l!Z`HavSX
zjWmSY+t4J%h~BSC8gVgc!@W#e=NrEYsmB~68}q0yoe9}WAhh8V*+2^t&LP<f6k6w!
zY$X`l@FLbmc`GNpn6(2KTIb<x6>27jHtgcihFu)m@X@+c&>Y(EvAR<Lhc<ljT*MR{
zS|^aBLgrbMV8Df)4fkVb!z(X?Pr=THHFj30v*BLqtaE6N8a0#H+3>~Eg%CSC2kKu~
z18*?+A#HdaYuFBtH^`aM`ukxr!*~%jAj4RX3mFD8E_0Og5@M6!;-=aKo~@q29RPgM
zIuq_QDGPYE+6|tqj{XzoG<deAa~4`6!Ly#i+W)%%vVN<q_8SJ3J*!$5ceeJsGdNo4
z&rxcBItib|bCE{yY|UI6(%{*exE2YXtvOJO1kcvY(;~sMHC<XHc(!J~79T5zc#sy!
zovm4*#l2yO3$^$&{VviXxwAEkwYX+ZI^=`3Oz><?w-yPWtvN)C4<86|i53Z-tvQtG
z(%{*e!?Z~7Y|RmKDv=4*PIW*Dc((R+$vS3l?He4m1w32(Cf&;gJX^DZaMGb4I%@+;
z$g@DP^16^`C%MV9z_MzKLY}QT&4-=ue)4S1>4T~Fk!NepsDM6njgy(H1U)+`1wC8y
z=W}`eQD<4MsvXhTh$JK)hf8J{^`~(195RS>IZp0{(K?UhV%AIaY|W}a7<Lspx~{r<
z^*2;Tjh?M@qi5^f=-E0qdbZAuo~`Rc&tl}Ni>R|O(g=CBZkpnorb3>ro2l-FQhB6C
z&(^uovvsr7o46$C*}4O?647*mx^~5ZOVG1*{pi{8NW$5Vjzto_z^4BVbx)}Ect69>
zBZljqR0{iL;Hx^1<SC)i*12i4b#5AMots8m*GHpu<_yLlLuhQ>YpMk1R(rhU(bk-^
z8TSz$ZQZqt5DmSfTc^*a6&`KfUs=Y&qpj0t(@IOJ>*dihmu@_~jkW1|lvLeK=Rz(w
z^v!PG0$B*Pb+;rQha!mDx?34Q5Vdu;e+yX<wRLy!0ly$>>s*N1x_cN2LDbg$jj|wW
z>vm3q|K%QysI57784@6f+PZ*x0*WTo*5#@;`0|X=h}yb5H4gU^L~UKZo^S^IMAX*x
zA!?m9`AQhIHRrtqGs38?JI|cZn?dI@4#KFdyMVGVYU^B#+PVwNaUWsS)?LJV3Zu5}
ziYGDH3!}E~N`@6iZQZ6>@DmnBZOsL(3EZroQCoA-JnFrS+L}w2Ld|>zGn{qx7fq|;
zPRAjKdFt2Fp70Cm*HKOjF89>0Z$Ob7!6Q8Nmr@GoW>oLu+178Md$|U+)?Y@s($I|7
z`pan~tQoEK&a=4C5In(Ce+9inf=7AkucQ<;h`O!c#C}vzxAmJDPEfb?SJ6)rPU=G4
z)?a-X>W-jp>$i@X!^eC?-PUhoX01*L>$YZ1J5ndC+xitxLDu7Iy^D2Qf5!F$;H*)%
z^=Cc`Sx~q2XZ-<LP`CA~=%-vbqGwYU)NTDalE51=F4gy<ZZTV{Ki|0~sPY7O+pxuf
zlg{CWYv?~oi0B30I&TLt7a{Ss;YOx4tTVFVCdwe*Vhz%8Gv!F|Po9QbC`I*X)8HcD
zHr&qK6#{O<4&FovxD9tOmxO@ZaOe7Vj>XKShP#<dD?OTkTeEKaL=0P**Oen!!?`?$
zR_9WK3xV5kKHu&X1a89xw?hsX&1kR<7rqL)&>#-C;o<;pAUNEHwbLLA4!2=_7i7WV
zHe5<saJUUUjHuvns~TK9+=k09h9}|SHf&;mBoDXd(piWcc(~5QLKQ3`X|U0Sziqsj
zhYX_8IExFF@NXM?B*V6%du-J8RQR`zx}FOEw$WiGNfm2!@oyVl{M*J&%wXZ)Hg2Z8
zQuA*cucEwK^KTos>to|J|F-d(RdtAq@NXNhT?Kio@Na8+=3;Rt{M*L(06fLgncdjS
zzjf>)%wmYUZCr2!YzywTaS>&~-8Ob_hAg<-#wEKU6L$;$hm%q(wA;obC=2bj(M7v$
zbkS}bPbx#Sx-{*!am4|Ug?8JxYIy?6GQr)}T$ztJ3huTkM;%a$j`7Dj99}+1EypCr
zqj9%Q0d)a_2<^5hR}DueCA8ZnH|@5`O}lM!({7sz6bnIUw@o2@?gi6=yKQpgZkyb=
z+a@>ew#iMqZR(@lI=2nM;MIX@(==3(|G2_mn**g>T?J*Op9tKhVd_CB8iCt1Ts;O^
z5V%bv)JISRf!j1v<zk8|2;8Ph6@nrN+@`T=G?ZN)jliwhG!J<s2;8Q%XF@i-FAa5~
z#Y!N!fI&$1Xn0{C1lPHxSdFqCoq*`LDYzgyu$2e}7Z8Uaa#kp~fH+VQ3NE+}jE_)o
zo8DBvLIDNW8CHU^==o+0)>j>hX?j2Lw&v;+p$qV~>8=MM>+b`a?)F=_od(`E>2Xtl
zw@vrv!Cip2O%JlG7T|5uLyTRy0B>uyK1G`vc-wT<PqazkZK7!lD~Awoo33W!NxVfu
zw|<4Tjp;JC32L_aF!2=NZS(!_Le{|BW_^OZ0B@Tg`U9&m0p2!0lHSP(5qR6YYanC+
z-Znoz3bFuio1ct8u1sj+ZSzxyLlNR_^E2l{7T|63a||HB+vXQ;ge<_@=9eCaEWq35
zmp_Coz}x0meuXT++vZnG=CXU`^Zw@7Xh(pz&9AdE3-Gr2jRdm@bEfaBk;?6#F_rHl
zZ+>e2*T#Ab42Pby!qfcKa2WC!1mHHi0JzQHUCWlF0l3ZIS0VKRz-|6d5dLwz15^Ja
zQ!fDAW)}dr`Bz2=0Nez+$>!gg6+*ym_9$kB5OABlig_Uf+~zdJFap4B&QQz^0pK<p
zirFCm+~zFB{15<c^FSR&0JzP5#oQ49ZgaL`_N-250&X)FdblJ6+-5fcx4EByi-;B|
zCQ|^o%^_6@3j)Axb^~ym-2mKXHvqS}R58y4fZIG23dXjlH37GInBqrALcncy6L6c8
z1Y8ZkZ62-45mN!+HdpG7>2m?#*4%LoimV@iTXW}K(31dMb7}fpC_haoGF<@NLXYVt
z;F`y$S1m?a`)4}OgU_oGxaR5U4Kq-n8i8xN5xAxsfooor{=z}1#QOVc(~ZD2-3VOM
zjlebg5V%fzxhkq;A81~a&gLu(T+_|KHTxL2&RY0ZlbsvOl@M=DH}TfIBmJC%*)w{(
zV9rgvHT#ISPR=lNy?0i@!-MI!Al`z!HQmTt^Re_5m|hF=)_gpj5N$!;nop+xIE|&i
zQ?<=!v^PQCn$K!)g1j}K*WLtqYrdL37qRjPTGC8K-kNWvbMfL=8hLBJlRh7%5Eitg
z`Cj_>oE8b8(o8|#nxCYz?L?JE-kP7KPs1&2rIEL03i8%WLEf5Qr<+G$KcHJ_5~TTU
z`u^Q$L0~I1AVL30UkYux8o}mo{x_Wu$ycZff^f|g5U!a5!Zp1a>{`|-4Z=0kGTIQC
ztpdU|Q$V<;fN&E#lqTVt{UqE7ZjqI767p#mKAgoQ&K#J*E(#yj9$Et}g^z2d@Nv!D
zjHO4Qgp}svnkjr-Glh?9Ci%ES0mwy!%`$z9@9~Lk2DEam;e*@Xoc${lxVg^h6-vOl
z=J*T_FO^;m&NWlOx#mQDtwF%KW<NOBc@e=iIoE8;Fj3X;tu4v9W(qmioRUGd(=s9F
znknR5b83bz0wL#`QGFwPYfEyjnL^Gr=VUyCqQkegB<Gq|hJzg0m?Y<#Ddb!;g`8`q
zkaNuxa;|x#zTpmGb(*Q<+?u;SM!%9I=b9^g-=PFGE7CkoLuZAYYl581Rwm?J^GvM-
zG&$G&v#$}AUC6oSS-z=Igq&--$+_mazOT^=gq&-hrxhXRnr?Eg=_cozn|ueuT9TY=
zZuXr4O~|?CRlcjC2szih-FMj{4j`QMm~L{edAILAcoTB2=_coz5BeU#6(Q%EZgQ^q
znD1j;5pu5iq|b*|u&YFqbIoUb!=VW|*L>c`<^poAqeh`KA|}_|?c<7GFuCR{J`Oj6
z$u(c~RU)V-+0ys;*wT$;Q+vn9rWR0|GHrh7rsSF_lw31~l52kIW0w@xl-z{JOu^)u
zU;5aKMg)^<reJc-6ilv}g2^?%@v$rGQks%$e&=Hch2DeoZu18pyRwx)EMRhA{^;ZE
zV700s8$DtE?qf?w_d$5BnF7x>v(mUI+^94>*Bq3#9Z}ng28&%nGX<V&=B4>@d-N=X
z=bD4HwhMhHwusDpt?gD7qqCp|)82rUy{dvpT{BUd_6^j}g{f<%Fm=sgY58bY=o84)
zHB*?nW(rf+tW0B18URz5J}0EHCoS|=6#Ah}O2f<-?|oL>g>6-Ha@q;FhQ5TPU9&Ev
z)v%y;&1q?u;bH?&yUv74JT@f-(oA9PnjL9u>RrOxHJ7CQ2n`?ZleKH6uy)O3)7Wb*
zNBecw!q^~ExXcr^BfimJ>D*VTN=%Y;Ywr0if*GJD=}yT#YCqI4z6UwQMbe$(BI!=a
z{|%!cNV-n$7;O31Ib+5sA?McIcQOL^lXGkCKacudqdXo>&aHXyGU!6iZOKs2LeU(^
zmP}QNdg9UK+!jN%9>YF^<lL44dPRW=Imx*-55Lavnw;B$<8aZAG&#5Ba5d~ggz;!{
zZi}0o+tNqQb-o&-1fAQGg3hgZ#DpC|=Ymtq#_2!anJ^Zs6tZ(`o;;qHzbZ$Pr;bpU
zLm@kN>PU4qa>1k7xl>cwxse&_2wc<sVPvNI4AUqaXM#~Jf;U=GAq~yWjkwvl5jQ(G
zlETi7^s#fD*T*V>=SFOG;dE3K4bP2qXhq<;5jQ+H;)dr&-0<8;Tqm?U3D2E6MyEzY
z$RJNbGvz}Jrb5GWrwr<WsNuOY8m3fy4#l`Cf+{j1if9NxcZv(3JH-XioiZBbh(!Vc
zx>I@qy3Qlx6bQP`l<{h^r4hQ31~n8JrCBr)H$pe!M(9SGRSSFxLN{WnMNkBx8=0a`
zg;I_=?4#pVQO<0nAretL;09i<^Z9u7hAMC#nV<m5b;eeyBq_Ic`z<VyPe<Sx!uH;D
z^I5{sYUlDQHK{0yzNR)^-3ea<e?uA8j#Ga?F8j*)s7eVvw>H<Ch3c#6xwU!T0A<p1
zYX^I|9M<&Q+I(*bWzutN3%p!$YI<&M(95c?>AAHbZxv<Ib88E|lPI4v2Xc{@R9a2X
ztsUZxP$oUMw%F@jFj3`>{DMYHy)j-OF}JqN+eMkg+}feu#gs319-62GnOi$b;u~@P
zF;OL%xwU@pMtIZNU+ZS()>eAcT9HG-%&i^cT@G(Jauua1%-q@{A2)#gpE{eu3ea5V
z=ddakYHrg9+yXW}y?0o(A~x44oQzN9{&jETWYr7KZQA%Q`Zx{FZMuS@fODI!)Xuok
z4=6_s&TZOsFD_>o+y@tMZqx1D8PH|dbbD{v{abt5IR>6IIJaq6b)TnQ;z@&Zn+88?
z;(~y4o1TwrPtN#yRhWGO28Lx#-+f1?9ZpBR3KeBlVsGFF?imOux9L9&08p;8svhGJ
zNx4n`WuXcwx9JzkAmus_)hj{eHvN7GLI^6iDMM*4EorMwnOYW9Zj+%ELFG0LP=~>a
zpmLkCbQcL!u2a>3RnSH!+MtrK+!mkSInu2ca&JzYjhY~^+?IE_nWQtS<=x)P*T5;m
zU>_>5+?M@(+*uMU`}umkJq<U3<+c>~xZ9**xh+9oJ%(-P;|7(a<u*-FJfi~DpsW#H
zCmR%)sA5HMxnQ5ZMIYQF1^SdtBe_-gKys_@Y)r&}K4sPlE*I!i)&t;jdF5fPl>5)f
zf%1qpR_R}hz6j{kpAaToe)w^RdYT?ppUw26B#=7BXyC=p<BbY@UFY{kG+0Kgd9}n#
z0K3f>F2#IH=T7s5azO)jo3B0r?k>P?^YvfTBj2EEb^&&qZ{!gUh6e05y8ye*F2HWH
z8?f8#0_-;T0(PDIoA3(PPxtO=Qbg=Jc_v<FoLY?@O--A9E0P~P_At-11N4(0gRlBd
zo1>p^8K*nlrV{M#v{)BBYV7Xxe(dh_e(dh_`yPjf3}YvL1-m<A%>fu#HFkG~3%fhR
zh25Ru!tTy+VRvV^u)8x78(xG>!S2quj59jH?#{UUEx6+;(4(0A%y2%?x91Lp#_pOY
zt0QrH!S2o+?pqH<V|Qn|vAZ)<u)F3dipMSqcGvuy;<2y(9s8kDnQrW^xl?gtLa@8$
zed>KEg55Rm*NR|w%?GqMV0WFDreH7P*JjvxSp5dy!q_z*Q6&q|mNjG7+@*a3vFij{
zFcy=sYd)z?ga={lnolVQiZFJ~r?qck?3&N02XI9gyXLd%6DY#iHJ?-Im>vsb*L+?L
zg(8ey^93~(iZFJ~7u6kT3&PknUs7`y;#}h$nz3u*95(n9#;*CY+8;Gk7`x^xDuF9t
z>^gf}RMF&Z4T$jT>LIx86`-zpstO|q1*mIoS8p*p$6^39`+&Mm)l@ZAvvf^2OV{jU
z={l>YDuL;m{V-kUp{c5<m^59}P17~|Xu8g~@GyBu1Rj1?k0VBc&NbcWT=Q4`cvsN5
zW*<7&nHo_=ONhxeGrX@Ns9<u<6ilv}g2^>gFuCSn@8<}1gJ5#aAzp6KVf8>vuGx>t
zb?%SgLD&XHF@=+Bj`02$<%dNCIk{#EC)XV9<(l^!;pCc?Ud|}7hTto~<^(U7vxabT
zlNweH9t<qzL{0U@s^J&(Z)UZ|N@CS;Xb$J?HQwGW2xs|zs(9{D=4-unj0h;#OabMZ
z`+#!IGu78vaOmD0a<X4OzX*-OOsE1x*gx9&U_Z0~LUGNrwQqsqn&&F+Ur5k%lR*d0
zzPEgTMJledc)IGv;(mn0Wf-5J3JpBo*)v_$Dccz|LlrJ#pJ}=&xaRRbP91wGxaP^e
z)3Fwpdz_pce1w8)o}!oOdZG=PT?^il9dBN(HyZqRBMIhKarT!uYiFQNtty6_n}KV(
z8MvmKfot|LaGm!MR6}shJ_zo;X)_fmxcAn!Dq?UQJF3>HH=KXq#H(sjZ(Ci|+t$A_
zZbH3n)o&IE^|n=i7X#|8Gqz1tB#6CjbzyH?^}|uY-nP21x2<>4oM3NT?`G)(dyC)J
zdniYY)wtUFH_B0cTvV$Igxh)_2EHT+xAlJ75fE<c10C?6B;mH|=NLl5ZGDJ_K*Dvt
zL>!k8h1>clodkv3`Z(<g3b*wMF7yS3+o}-(g2HY6J6GU9;i6bupQ8V#jh%UrpJv;B
zzL31z);>6{bNnn-r60*h-E`cjn~ocG({ZD2I&Sn+wdyF&3oe>~<h$v((LOpZvN`&N
z_I8;6`$15?)LqH7eiCz||D=-e2r@V7M&?HQkhx*_`$j+O`j?;Z;pn&O>t$%!6)cA6
zcUr+-%nvQl{;js+Qn}I?-RSpP>rxd*pkYUUR_hVjb*kdqN@)EU-SN(**=opmf^?(5
z>oeW93P?Aa0@95FG=bbiUzIt-`3FKI2+fVAdAUEo6I;0^v;p2baF1O|Lvy1k(A;Q0
zG&dbSr60s@2;sTW6nJhl<Yi3v2s}5M0?&>1!*ge178FgP=SEZLxzQAQZZw6S8||m(
zI=c?Q4k<ag(M~Um6M(Wq%Auuja-(s5Ey>A^rf_njDV*GB3MV(};^e~SNxG{9YKfTK
zXg?-*rg6&>yq+tZ+_t~f9f20S3dPiRFKe)Ha@%%th!IY1+kILVPHx-%^h8dsvvm&k
z@(9Ikd;B{j1)uzqiQD!hm2zR?wz-+OZEhxR+cUFZC&|QZb2D+<Uijr`G<IR)w!KIN
zUj~zj+qU~&nC=!PZrdwV(g?+M%yw0@kWk#Vw`an85{ldQ4wbzE#cg}{dMHUKZkrp5
z+x8)2l7!;6ea705gyOb+&a@JW>)e4m>`wx2+dt`+1mL!PLnR5oZTpT&5`f$GZz@Ru
zZd)G!*YR5_Nx+@;!g<X2Po0I98ec>NZmSD{+xh~-1A*&ov#{ZGxO1O{e)L1s{?=D{
zMUc0xuTd7{ZL14;+xiCGdy%)%9^EwcIyc&fysbc;*d(VamLI=#sV921Rt!JiEsS2H
z*b@o{H+sER3jLGG!HwRmHR0e!-5lI#3I{iOw;GG?Vd(A7IvdkQf^eg55N<RDgd2TC
z-2&eL;YP=JyHN!G&FnbFc{gMJ=kfo>Ry;u~D=R+Yl@vH`bfUhLgyTk2;J8r@$4%$v
z>+4QahpJ2vj~i{&cR>eZ&~yqOH=2USji%snqY>RPCGoh?{k%&NS9C$wH^a*QUT#jK
zo0$=SHck6P#}Z=a+YilcVE;Hnx6Qpm&5hzSrP+Ez_KvZ**6P(e<4RL=qy5xerzoa?
z&2=Wn)Zrm=b7#+d40p#loA^y~bDcY4cyEQ6+%`8Rx9z+a;72gIZ5OavXiRR~YCiV!
zXiRR~g?#EKnB2CD`Or@=xovCbFXpm;KMW0R>*&4QBb3~>9yTexZ`$Uf<hET_kG7h`
z<hHpmxor;J1(Vz6!sNDH!P*K;u5(r=SWo2Swp~jn9Dt3PPTOB83n#bj2Fksh+_sz9
zIY`X<IJs@NvR^RpVX5;$rxH+Z%O~7k)u7y#PxY%68Ad5w1eDwI;aQM%I$A#Bup{f;
zmd`5btU<XgU+4w8fO1>DoP!G)215xbw`G>P35x6^%<9{XSPQon4a#lF^gT%5yE>75
zEr##SKHo-i;y21@8RYvJ&Z9}rZ3&3{ma}`V5_E1$KRUN1Pa7aQ*BJy(n`Y+*UF_W8
zVLZh^*tx;ODGNI{xO7)0S3#Pc8$5z9@_9R*zsJ>|)SXV_feQ3oXVHO5@VN)L@wo>a
zI_Eg1c?*8M-#a}AD)4iihww)Obms)`=Y=88cW}`J-O|9c<B`Fdpj(=E!U<T+<EXRJ
z!43J$-_1_TJXMjczxyuatNP_|I&Pi{wJoc~=Tk0XZfO}yM2NYiE@E!!FuDsdw{$pV
zA?B9$5_6pwVJ<;FZs|CF7`sFBaZ6o%+)@`Gx3rpQU*Y4H)-t-n$1Qd7aZ6o%+|pD&
zZfT>gqbkYAEo~CDG$DN4(q86;@Nr9fnHR#xEluU)mZtJ?OM6)u!pAM$PfREIxTU=;
z4B_LJPLr$P<9ad4C>=9X^duj*l$%4IG?nDzmb&=3j(@%?ZP+#%fs!A3Cjq&o$q&5=
z$Q_QW^O)EFLRDx$`DPepnC^OqI)}_xg(}NAeLlMS@49ic=ATpoPZ9)?Yn`YSLF8H|
zX+;pZ)+y@N3o+x@I7I7Itq3C5I$hm|D}u<i{;VE>B8Xh;EX6Mf1(9p5Qv7gE5V_Xb
z3U%EXdXN%Eu62QW62TgTk!z(ea;+3bu640u`6n5<Rth86N@3($>lEv2l96kz*BXF^
zWaL_xYHc+bxl6F}wR*G)mf_W?h1LeG-5`uy>vFB_1S1z|u^g>E?HfVnjdg|M7r=Xb
z6&eV5rJA`4jn-GujkarT(%R>sB|2pbFqb4G*V>}aM>>;`Tq^~VYi(1P;95W+xmF4!
z*Sc0+0@H-#Vq#%kuTQT|GIFgHMy_?E;%6rfVB}(2VBMn6LXV_XJmKtIpt3bG*Xl>+
zI<GB2_b|%&9TC(-M(Y7}(`sx40gvlcE>z&-I<xRc19Gi>0lC(`fLtpDkn3EHkeZNd
z?MukD_9f(6`x0`keF?eNzJy$BUqY_6FCo|ZA40CRFCo|3mym1iOUSj}m#J4DA=mmq
z98@nM*V>nmYq<!y&cln8AabpJ5xLgBh+J!5M6R_jBG=j%k!$UX$hG!G<XZoO$hG!G
z<XV3uQ=}2O&KZkQ?w31PEmnZ!I=i81O0KmpCD+=Ql53?<a-ER}tC}N-$+h;y<XZb;
za;<$axz@gzTx(xUu9bqxbsj!g4Vys}uC*@;*GfU*;^~-G<dx2~6l~l@emD$CI+Vbn
z%o)+GYL=3dYo%~<(MwwunvlCOt>Rypi&`VKwl%GS^js^2o@<TvPC@sJCEe}}TpQzM
zqued@Tx+b>_JE%2JlKt%VK%18R;_mYM)0}TB(41<_*`qU){^*Kt4?c4e6CfmwIn{*
zYS3Dt;B&1;ttIifR+H9}_*|=5YrXhf%hYNE@wv|7hhXkaey+7IKiB#ner|j2p40HI
zjqr2rMz!Hg%&y4KwVTwa%h1*70mE+AituyoDQdz+T(Xd#Yfn{8f5HBP=I7e`>Hc)1
z@N?~H%7^Y)___9U#p9y`s-g~qmOWENVZ1?AY;-0qK^OLCXYmrel0a6j9aER1Q~pL+
zxpoRG*N*EOM1_@WAE>n?D;M7lvNP`jE7#ctV}~9-4#rZbxb|YT5nc2OP;s%3WOr+A
zrLW?iY-opQ4MPf9x%LvRC0V)lq3Ztgv2QM{T>CK9gUD|ME7xf`R0%BCK32T~$6W%;
zwU18@GZh=0bKynz&GxBk54@0;>pXZU+Gw5gKK@K16W2Z~*-P~@aqWGXxONH?*Qq@W
z239-q!<0~Q+w-nQ$%X36xoq#)@Bhxijrd7?hl`5aF^!-73Kh4*MaAuyF$Z;BsJI<7
zDJQA89Z?b(%7u#C(Z(lHl|sesNTK3(xT&}uZYpkvn~K|^Kl8*FzU0$%=wr#cg^JtJ
z!MiRODsBhB78t_tAu#r?I_6SYEmYhNHx;)dg^JtZrs8(Eskj||R9xq(!|~97Slo_-
zr(KIls9<qBy4#@a1}e#UnI76A@UV=tl+T5M+i@h7Z@|EH(wD072|{o?mM8ll;Awd-
zd&dc)_d;+x{v^7F;9{=VaiZu$;D2Tg^piv{f=)bc$3A%6j#K1%FCMq!RMCOQt<rql
zj?=`Umyg?Vy6Am;-1fo$MJ340cHUpAf>X%D?YR1V)<1(d+>UKL5<zgd9WEShhYN?>
z(Tl@%s*g~@!|k|*Ss^^!j$8FiPV;a(Zleqyu5%i^Y9MaM-Nzzb0>tfb19966-b)~2
z8i?E8oU;;9A|;|1yvCDv+Fd~0b~g~WJy-<)0>q8|mD4p1#Eo4~Q9yyQ8=4c_m`t9|
zAG@*m8YYuO+?b1q8*>qHV=f|Y>~5~%goqpa+aQD$B5v$n_ANrhjqRiy)klTJ?&r6~
zwn3Cq>_N_!y8%IPu3V<FG#@v%i<4&I<HjD75=!!MV|v@WkB=Km<>SWm=C|;1ov)TD
z0p!M>783;IIzx_BLdfmReI1#fVXQ(Plmt2>cQIQ?$nD&37iO|@hGnOlklQ)!Qu+;d
z&h(v)>l%R6`dk_Pa)R3FBII_q(TfmrJ6(j_&e@!uXO-i=yr1_N=c^;}f$4YMcr=j5
z6^Wqi<_@MTh}^mPl<~S15xH{<hQMw~WNzUDjKZix;8gT1M2~SR<sp;}<Daxw@&V+4
zanM4@r9VS1H11stc_`h>je+!2{%`akl{v=cREG0H*ck6zdX%yglj(Ov3{D{OT6Z*`
z2g3w@S$FazY7lujSGfCtRV?iL4aoOUju=D&S%0G}j9%+r%EIWic2X8buXP_~Vf0$}
zQx-<A^#JAN3FAL=VCX?AD~u-xLVk$yN@H&n^23w`+iUHj3~VoIll3U&jm9v}R34|i
z)!5C5K0#SPzSfhJ0rEweSx-~m89e34Lp;_qly@1O5x75}Nd;_Q=d+{nDjngz*86la
z1nz5nKqVk>Uu!QFkmB|~0N(yVrCi{?*2gUGN`d=YpHOK~8t!X-#$hEYa9`^SUO`V@
zjz5+g?rWvMeXXx_O%}MXv*j2ibYJTmso<LK>%0hOjrX<mCT~C9*ZN+(_2PZ4eeu55
zf3nU&aW^RI=j|A|rMUkq#Z8Qx<-+?~zcI>!_qG0Dl7;SOc@&ghysxFGCGozNS1W?|
zwR~Cu-q!*CVpM`aHY-!R3E$T;v?6?8Yk*dS?`vgg1$<wI@vHanXNP|W9w=EkdgZs1
z{5Ov^NKYq(`D+EVBFtYaS1%X$YUZz%$93fdk3fH|e8qAR=&zLm{k8g`zs`}zsgi8s
zeXSvCCR)b8&zwt-Q-b%k%GIn3&_etZoF|V{!uPe@d|zv%o^uJ`*BYf2;rm*nm5rd_
z`#R;vtD@>JSQW98g~HH)Uu(QN4%Y?n8~<z<WDWR@f04a~ZSn}`sN>a;F@*WXzm~!#
z%oiPO{QpEP4S2>ztSU8QH6r-Cb1UvLnJ{0gR%fHYe67hUpZ$e~`C5%Sf&%lk`e44!
zFURBg>l~+WxtgRQz19px^o&4ytyaCF)=)Josutmb0Cz1nq}Rf}B(4zBdnEo2e8<_a
zTnVMuim4s_fl?^F)?D=teUs8_VG|8=Q=#-)^VI=RG^N)%NN+?4rPo@ZlR!$ZQ*nY4
zOs{pQ_|TYM>oC1V!Sj4#FfnkRv-||S7gy@6KS9+ec(Buf(^%gH)O+CcAgA&g)O(-{
z)O+Cnf_e{ZeGm3Bj1mOUpx$}G28aUcoj0Q9Vwhy_Ij<Mgi)r+{(L93E&___ttE}*1
z+z;qioaT*TRTp;eyk2%M77O#na~@F{JmT<^JoBn(Gi(rrJ8$A5$U^g-7d{8F91=CJ
z`WGZ6s%gISCjABOLi3$B`3lHF^PSi5bve6dymp-Bnb(A20{!zcXZN3!@O<aVR$h|l
z>x52J0`#3%vJ5sf(05+h6pCq6owH6<^+lwdcDabYUA;tK=fx9M5R2|lPQ-kP@$MSI
zxdITr^B|9uIYbXO^18+s{Dtv;+nI0@o;r0nGfq+h@$E{5_;&SfXbQx)t9L^a5MO8W
zNvgDp6yL7iolBwkcI}t!9fjiC)w^>Eim&q-!esv?iZH#nUMKftY~PaC+vVc*cDZ=H
zT`pd4my6fi<>K{r#aM8{>+R~KEWF+>7q7SLKu(5)*V{FZTgAfb?V5j{bN$ImfW2J{
zI0F-4Z<h<$+tml`b>2T&f!OQ(d@??IW@m1@kiGU4-dm8pb_-=e_S#b^3$oXCA$x5X
zve%x*N{QFWi0rke&qfJpWUoEvVTgk4wNIV47WPT_wO8y~iwZ6C9Q!oA3#*a6_8FWA
zmg}$9Z5OiFK8p=ckiB+-I|_pAwOz<w+lB14&*t<^kiGVKoK1J*WG>Vs+iFK7GK{%v
zok^$S#lDaeI~9*Mdr&Ry0~tSo_S*A~V_b1mkaMaUr`x`L$!N4$!&m^rwmxzO(=md4
z?RC$=FF?L_Pi7B%u!`FomT6lA`P!FDz7phXJCd&i`Pv&LUkUQHub?a-U)u%pwKsDO
zmk^S#?IQWwLh{uhU)u%pwYM>VfP8Hi$k%p(d~FxV*S`KI)ENQ!+Aff<?E?AQ<t~!1
z?IQWww?2o=0La(by8@3z$nCXV++N$o?X_LpUfad(wO!m^`(7@r!0mM+r>W572saZR
zV14iirPqE)=dVzD?OiNY%)LnIwI5~KVD1%jE;&sVRgUR|TOX2lHk7AG*TSspRhHf}
zjCMp7UhBL7-`Gs}>@<AyGs4L^T@}qBf!BVOw_Pa&Ui&pFtA)U8ze#1C5P0o9RFVW<
z+fCqgjyYWc!RuUdx+<AW2CwaA@Y<g+x;urzYr7e|b{~V+c@L3E5V&i9?OTWX6;<{x
zYd4^NasF-pDibmScWoDN*ZxCK$TV-)mT8yF$ZVN*32)byX_xSJ?KC}+65g(zp%vln
z+L@--1h@+V1ZQyq+_hyYCcs@=ref>#gv<78Z{Y1ZcbtI~5V&gxw3`5T?Od$@xEsNh
zJgw~VbFOX=*2>d<ZgSZ9S`i4Z9ny+Gc<mv2b|w&ByI3oD-G{SgyHul7!>Zy~+ACA%
zIBjRDkVf;`|AXeWhvSS{9`<ODR70@5*JxgQl%69Bn%C|_^E%tlRHOFi+0eF|&1?6u
zdATb#Q3s8b^FvL$TFo2*H_yPl;rLUdHlgeW9_?iPSqZT>4!8~HYns>_->nrP_Qqe<
ziV%C_ud0`>;xvrJ-uP=;0kPK^b`~<1ukXe8C?4mTME1rb%P+^Kq#%3alhv3_xP$gq
zmrNH|tno%Yw-aP<d>>?Qd>>?Qd>>?Qd|za5d>>?Qd>>?Qd>>?Qd>>?QyiKQ9kiGHQ
z>KUY0kiBtBKZg@!Z`_USjmK~WLx>=I<8$=`BtiDZ-N@c}mrk}Id*k!9vP>g;;|ug7
zIzjfv7ivY2z466b5oB-tV8x?K1=$<#)&>OG8(-3<YugV0&DcqgAF7p|ej<Fax5)lR
z5WaCY!Z+?l_{RGXzL&4W>W2v5xEtXcKTbdK^8n$?OUG*sRsEDf(3WcryTa^);wNaW
zP{6+NKWVL8z`pSlwN@!$-}uRj2k)VYe7GONxxl{JP*2m3*CHVMI(M#Ag7%H4pnc;h
zXy14W+Bcqp_Ko+WeVyT}@V+kDzVQ^cZ#;$V8&6^T##7k7@f5aiJcaEWPhtDUQ`o-o
zRJLzCh3y+pVf)4})rtQ}*uL=;wr@Oz?Hf;F`^K-(;qZcRtuy{?tQ1bJL^^NQbqMbO
z|A-k;{1){j+IrMm@o+A*+Y|>n+gm~8Z+wTk@i@#?1o<0JLH@??)TWmS@;9D>{Eep|
zf8&2soE5GF^0#C>jHWPu<M(MZ>%jbVem`3U6MyYS$5U%9!pK@1I0$pK+K~%A9$)RT
za7nBE37bCYwZFqXqc)D;%-Zh`#<){^9^41iUU>-it~}m){E4qjpnJ)@A6E<G=k0)O
zoCH7d^C`-~-0=(eWS56=!+kX;WtcUoW@p1WswNSnjWw@}XWTljr&WfL3xjcuriJHc
zd12i<@KjP6@2T7jYdYKpF3}P73u)xC!Ei6V!5iQBEj@gXOYtkT2V)LW7T;vR8DKpc
zzKZQRV&pGKK)ITVZQMjp+ZdqRxQ6m}%B%I3UR<BUzr#4P8}8RJ2|JC=H1t=>yNr`5
z-$40k<8Fr4)2Q8sItcR3jL#n9BS!L8w$#0bt`N7wf12lWW2p1=xoUX+$Mkz=E&P^j
zjNii!(AeVqelAuQ<S@q{l-Vyi%yAcoIqu>x$6Xxe_+y;Z35PlU1ZS4QVUGWu6CZGx
z@$@PF6y+7h)j5!#ro6If8){JeSy=%k$;|$^3(f3oJrDd9f|%pG^AN|9^7tFvbI`k>
z@jcuw5D;_xZS9Ob?T^pn$9T;MvG*$Ev`3Se;~z4&$|cxGvtgkUQ}V(1t4Yl9kINut
z7#;W>TNxjx?t-96%<=KMRSAhXj-$tsp+aJgSLvQvNX+q660@`Vd?hI6c#T@3O@EBx
z9=orQHHtYl`3;CbF*^^OuY|=M>t!)JKf-Agx7lNf72CP;B#b$>D(xB+riL-c&f($=
z`+IAh11`X*Od4}+bpftpj!7DG>>_T5W1DYH3zSRrzPHerV{52%3ynGErZLCX>vHI$
zF~=^Ia_OZp$9hEXr7_1gh+eS5`S=3lIpIsOE4hVlXqZ53lWgacM;qJBy9%H=b`@m-
zG{?437C>_>dAKbB%`q3CIkqi$4C@vF&9UuoqH%Y7G@v<Fzhx^r0}W`7y^xu^4R^*?
z%i7f{Sk2STW4pPA59s6iV=qre#01D3dyPiQ^;vPTULdpc#%i3G{EPF$Y9&bK*i_kh
znc*~EsD#NJb1|7?E+%tKULfjaGRI~mGftSyvDwLd1C!ag=|X&~r*p~{*CdoV*0BW9
z7btVg1!a!8pv<wkT!spiIToiZQ0ABm${d@=njui;*nFmQxrQ>w7Vx2663QG~sGrkG
z#w=pKt@CIob8PXkP)ee)B|o9w=|h)dhf)+MbL?=oB7ri;mQofdbIb*0j=7-BF&C6M
zb~Nv)q0G*c7b#GgozE{)f@SWg>^}guV~nmH`h@e2ag})3Cs^hVfe`d!nLARk%pGB!
zn^{RLb4RtPNi1_mjpTI_%iK{bDzVH5wc_#GB+&;<FVau@CW~rJH^^)5Xy9{I;Wc--
zc+DLyUUP?w*WA&|Yj*y)7+aOIosvuN;?<oqVChnxz%2NTjvgktP(PRI*uW$UthwVd
zp3W_>=8nrL3#_>VyVV>jc=B+E3)bAx2W!R{+;OFa{K7|l`j_i9@62v6nTNfdfXk$#
zPCdypdCvk2xbsI;U5DX##3Dqe_Vq(JC@)<M-?ca5*H_z$-?ZAz7$MSYH^P5L?HiCY
zYyW~@qxN9945-}<KNys!Erk8>2QXg(j?`JOY8;E}DkzQTa@;|Mj>^Zt7ck-oq6*pZ
zmmAmcLJ?)0$H)Lf^nim$Q;bbXBMj9E1@srh(f0uKdZB<)uRm@+VjG^32Jtp6vT}JE
zhIAwFOuV9iovQ*k;9n*$@Z?*yx#F)LPvfCW>EjeM1{H7W#{Hquq?+6G5^tT<I-2>F
zmWnC{QgfT@y731e#8B%%7Bi&{=h9JdjC^O4|5$bSPi?*pUQOPu8h69}w`bw2cWtIt
zoB0}g%a6%mf9&vh&PIT#YOdFacp{@Qn(|-K9dwJU23|M?VuuP(Rj~oSokPU~VlfV-
zf_<fXkd{a?*!1K@wRzz6Iu;4~V4~{>dOZ6r^I)rhSC&JY@^2PPxypt9SLpj6o;1>o
zdn2WsO=TFFS9v_sOcb_SsIym{2k+DWM3ql-XXr9qs7J(^6)exi+Q-c0jNHL0!G-+H
zzw$!24nOlkR)9lv0C4cs5*`1UWsJ+A+SQZ88WFvT299Ck)+OWhVTPnmZJvo-YeO84
zVH93L+-Duh7#_!fzV&<0n)L`v^mwQV=--?*OGjWitA{#pc5^rWoIs`8kGIBOqxvTn
z@DWtwjH^De`YNagu<fXmcthX%J!j3{pRqa_`RN&&?eWYx<d`Eo>J+xAIMowRUgA-w
z4nghQ0(JI1i*SFng8F}<&$1b-(<G8B6SIC|oKF{ZYhupfE0%lI8GL=?Kunb89C!Sw
z9(5+wOQ5!&*Z|MFe!%WK|5+iFLS9m#gF5eDH=_F>W!1NSU818B!ea=Ri1BLYEU0Bz
z%5@$H;RpzGmuR0`6P?FFXbd0$D<H&M@YAw3Y1l?Z7z4AYh`tkd_)ryT8+FmQerv+B
zKR@i`zvJPpWhZ(v{<{!Lw}kPY=$V>Oa|iftDwAuh#Zx@{|1;@ThbtT+*KR<#%@R)G
zNanuk-WRkB&A`)gl*{{*|Lc8EZ|jKMSfcGFJT%Of<TCnGuP<b^4R2d+MPZ%E8u;R|
zP!}RMX8()oOROZ9Q;p4nx|?P7Jk(hpR^pd?i*EK4tQD`Yt{#*N&pj;IS1(!R@%%Xf
zea^{$I?|(FqwlwPnaBC4*QuU@VP^Kf==+Ti(lObm`T$M;%6Pm3)w&RM>y%=h7SBrj
zQNO%$6MCE5;d~?piH>U_TteXr2&~VM)k)vaFyRRmXTFJ@i<4J&(9Un^Hz)1f-fQR8
zUOT@)kRX>OgM7mve;n2u<j;t_zV%iLy!GP{A`iK5t>QWBcR5G)sNyM1#G}b;VPvWD
zsmFUwjYNN~O+_it)Jh1EZ~II+kM^kH37U8^>9&$4l=`vP#0R}5eCSoRiE->+=P^vL
zom~u*uIAqYAI!WP=#`oGTyL0fAVdaAwejf8Lkbd}Gd;tN@)6FG4Oq<T(im9^+x+K+
z#n1lQYcP&pN*i23f$7);Awt{;|0NAdU(QEto|adWb@>kz)Uz;yS~|dIC+j8}n`-v7
ze3bN4bf?Gj#lhl<?TSqiZLp;{nI#Rlo{MVCnvQ`YIcDHK7&KJ1r)6By-$M8sqy5eG
z{uyzY<_bU8nRgjxEVGkNr@-qmV$ypiy!O^Ynph_$a!&PRoZ=b&XV372XL!XR&;G-b
zsihy!{!b@62x=|wB$Z2`Jf4gJ&8lQ?a5LQBg**Be^foKgJT0xRww`{Qq|Mce-%553
zo|gJ#q3wc+vEq@Pb$>SSK1-9H*dKKMueGmxttDE{bNM{;e|?shBW?WG@=(&_m$>gH
z@t7=|tnZa)|F@HuJ$J$HfMm|__AmdhQEzXT)RLH+^ch63Z?sQzp=Ev77bh==aXIt$
zWQluPhyv$7+7Bn4U70n!FZ|Y|$Jq#PX^${p*LQhmB6<CATt7mt>z?<uq<aGHYvcyK
z6>%@J8e_sr)W=U;)^F*x-qdIPXP5COT*eEMxewz$&zHA5cm*hw*ne2kbqj9UGCip<
zf#vAISkqkzTwbn|j}~{V%i}(tqP?Clv3coQ%x2&Bqq~PO&5Ta>%=&N<+VqG6;4;8B
zsJvRd&w6PgT<18CZN&4r>v1i^cr6`1__Gu0d{5UCxcP$ITcLFQFasv5UxZl9?U1f)
zBzaK@7XSx6(v1<e%=-q$i3O+A=0b`Ce4en}Xkp%BEDh%V0%M&21-POM=n3wk`xfAf
zp?vIS9diY~{{84+OrMMCk3)2TdlR08t#E8#%0Y+&t9A_VQK|m%EL=a|<5@h20~&{D
zvCT2av#>qa<2iUBCu+>w0OwQzE;8lT2Ty|CAzkdhG-@z_GnCS=RD-fOOJ@{5y~8QH
zQjMQpjl3JXoQp$tRxS$*4?F}-uAbu|yD7PWju}0B7Oue!M(pMQxX}5_mDts|8<q=W
zw9P)ql?_WS!j<le^-DMGM*^H$c@{p2p7@Z!u@KpbXh*p{ojePVn}R;ira5*HfoD+g
zo`tU?tLHDJhmYx~e`qamRM~9&>W~=*=Y0qN+Kr4ogRNMi&MfvU*-Hb<73Y3zsR4TR
zEX+eD%)jv@h-{yMna&BDRDRtI%KSmq;f!wKQw+S3_hU2DVUuY&iNzFP!6cjqHmM@-
zmb;ucHmMP#%Mng}ft<VvsU0^M!%v7VW!M4s_>|EMSD!cYU1!*4mG7P6?fLV&g^7DC
z_&5*A_joUw2=V+nihG7byg-ZWHPmYD;kN@JUZh>O<5yj*T_^Y;UV=DbzYKR!Ybg4R
zOw?YF_ll`-*`O~DtAcnr#dO1a(HJP(=X+qm`&%|-F5o=g|F%H9M~h{1A?~DzbEJ?A
zpURjH^WG36{J8dVm^1JyRi5}2fxO3l#qgVOJKyX_D6YjF(q7XstVayJPsHGwxig5o
z^sQI}gT{C?L*ME2>@gOPfPBVJ6g`>s4e*p+c4x1r^m6gEcNF42>{;yz3G^^lMtc2s
za2Qa8Xk`pk0k{oViU?)o;mcFpFb@~^Wd3J9qF^i@4Tm2Y4;+l<b^dXc8ty&M>!feN
zI`BTHev68z9B0KAH7aK$QkpqfZHLblSuZ%ZY(bS@PPZa;6)c^TwFea}vsB#*Wp&mV
zUKyosh3|D)|3_t_dL7Eftp896Yh`QJZ&a$aazj=cLT1)zWk=RPDz%sfpts7Z-yh0k
z?womcWo=-XdUco2Q|)=eGw^<T+?07bTnjU|t%qjh(P=wHk1>?KuW{&X44Ceme6?DW
zSQtmFjH=gAk&O#F@e}TbSC3IX4L_4tQ8Z4$G{~6ZKn@tE;KoMFC6Eh^lhJD#k)t7(
z7>CqD-tQF1<;GDoHjObHVdPAJJfj<OrE%OK$g{RX4jY%CbdB~m6HpqAf=N*94<Sd4
zZCQ{PEJIqO#?4b9FQnXMyou^>ETX*3xC!$L<0!^?g~!iY@iD~goe%)oz8x)ZKnZ+%
zGWiHLkac-JIws?s=@=w7(j$m1^B`YA=gYULqQbf3@U%6|X6StutAv5o4D3C^>r`)3
zQ~d*wE7|S4aAR+abLKXDtEI|3o<Sd6g5dJb@1VVug_k(!Lmzw!w|>yabQf;@pid|Z
zw|>xPlq(G$NH*y6$59^Pd_D#q^d+lBgF$Znpno2H5VM1aI1c(3{YQ<E0r~51os#WJ
z!1aT^%UHmzC4%b*{hP9Y>j!-wf-K<rK|fFyaQ&bkDGRuM(9g4BbhYtMBzDk$DX%kr
zr2GrzjfO7_`B%zYjX{)uqkMx=O!@cOc~Ev3qpAGC3p=xForkxpB)L9t(z$2>`W3Xm
z$;=Rs!S4wJr`$T28P$pDeqcpGfEh)!a^SQYj9@~p51dY!<a($48Z~?h(e;4@GeFSw
zft8XOzo7#Poc%H~NznCyb9kRF^l9ZDPfqSy+`nLrleh*iOY;`Fl{9PQA9MT>p4_p6
z^sNc1&mH&l0N(od10YYJ>1D>#sDil@KSxxT8?TRm9DX5(S-5E=<ZAj^X^dI|x%O-L
z5o&$zB)YFNxb(@LOj)S)x%HP#&to3WM?vN`@WKw`DVWP`3Lx-K<9@W0+-AyqgTJC8
z=1!q(sNk7sUAZmRAk+>O9Pb=-EnYj>>a4mJFQL5cY{H+!U7hgJb~B85yg`dMp3OWp
zyunNwn)5Zn2E0LX>vP+wlzW5gs-aj^!rtIzRBS2{Z}6xlC>>O67+`k9sC1)Akz1dW
z*NBYDY=mg%HEx9L)Ly4TBcF<3AH!tk3b;OR$~4FVuFq@vH{t_uy>t9^s&MYY@h~&^
z8k(^o1_n1X@AH?Oywo$;T#H=dLjaFwu(p5?-uI%J=H$Oh|8GFF^J}`;In1AkK()+C
ze0$@(a~(c}U}eZ}D#p#qHPkY{`E^{yGdwis{3$%WKrr?BEp%@%x^1}6WQB?7Tjobu
zBXCFyG4(kGhvGJw??J2#%)c6P{?fxdfrEZVZY1mU0_F@JRH6U^i!L|_y_jI?1B+?D
z+~Zw_(KIJ`6YWe!4QdF?`2(^v2wfETWSnE2#bgBXPsDqe0s910X2H}4I_Qq)99~?F
zQLZ$;r2kIZ4|_DGJ|~nl5cVh3c&e~x8dwd55iQ8=k7z-jMD%J@vVy^BNFy=z&e-d5
zBGMJk{OeU&!!_tGa|(M9xX^*<Js(vkr|25$r$F?6gld>G<Syu$uR#1fc-lkRNXZ1}
z_UrLR<@wH2*DIl?2Uned&PC|y!LwT-gP!hqZ%~3y4_?eVBKY*+8pMaMiq>N4wRQxO
zC;0T>y5~_O%QZedxSmlLe0s2lvf$H$8xDm3jrqi<2c1vQRSG^mcqQ%JV6-E4!A-QY
zLq9$VUbVInRZH;c!K*KWEco=`wpY<|1fL$fhIzav^yeZ3zOD|DO9MVV^qBL-4L}wz
z!o(tYlXg{u_lByGO~IQ*&D$IL+!=WzzE)aO0M{MjnzJ`lI27ugqGs<6ZAWDa-X*Gk
zZ)gc7KEb=S>do34;>!-fdqg$%hDM;l2JaQmnR`7NfSyzOG!mA1AX;oR6j_Uy>$iYI
z`<>B>*cyK%CgGXn{$EESYo>H)`YNO-pc_|c1{+tQL8^LaCZ`cXNe@NufSpR?ySZ?m
zMVnz`C%Wm-Y|0Ix3fwF-N8&Lw5_%QGUZ`EvvPkIv+q&|=D2lA#Rdb|MTp`Cy&So-!
z$z-Mz!VxmzkRXTQ4yQq3fzJaxP!v>Lm4KovvM2~zhzAi7Q9uGB0YQzrC@LzTAl`^q
zyjBFn3+4O0s_x*jJAX{SSM{pu)vH&pyQ+^Ly+jxsuGzfG(%?;KJ6Nsx+{$2153nON
zn^PJ5l<FO++3ZUCm__Xqtna0Sjh;!?&{*hMDKrlJ!XTC)>Bpgj#zM~u48-`SUv|;;
zz{ma=$+(w+0FsqS$r=kiD~sq9b^9_an`n)No|O|({VkUETBfnkvm%tOZ{}nb>M95e
zJuA9^sxWvrdBa*ZybpahCO5SSY4nsgRl^73(lIyf6(lKC^Sl)DV_t`Vo!2%EmlpVR
z38IzXq_ZC%BU`M)j=3ev)-jDuo@%v%5FgzaAv5$(%tnn(o*I4@w7RF4T5v5$OfR&Z
z+MXsmJq{rsUdN(QijAo@MO1*34**@P^3mK&NXrVPc2cLfQ}V}kEO?HR?n)^dpgdKb
zln5=k1S;|-7(TVzuPEp@DVXz5@t2lDHSz-ikf{?<G-<aSz8*oI?#ZSFlqpPKKhVKW
zFh`2{8>MFwjrb=Qtj8xX=xxZfy!miAz?94F>+vklh=E9o>#@(P3ew%Jv|`QXRs{td
zC9OoWIaNW5sc9WGn_U%bfP1HvYBsAXScIvO)=9IORl&Rpu$?s<tP1{<*shulR0a2u
za9KBb!IQXX8`cvW=qYv3OM`q{sXIX{kZ&uENPY6L(p567LXjdX+Ac+%j-LwPenDHZ
zj$sn+ce_+_R1LY^E{&#?#{F)WPU)HIs-|5ASwCbb-0wuY!0V_`0e^>5BJdau{2fX?
z7qkNY4yB#0KcwnWW8Y%~%Q}k&Ae2p_P_q;0oE$1<(p!9?Ts@@;@;j7A?MGGnA&c6_
z$>L9W_Xc)uEq%{9lz(<#gs=1~a0et`U7~AW%kOs*-i7za$_yjF|41~Wp)K?2J7EsA
zW&SzuKqeEek_n-z-=KhkwhWINhblF+Wx)^kf>!tE3yx4xeV!}$aimd1L6!Wv;OJ{g
zcY<dw_yz7lbB>@b!=tGpexqDm53py#vJ9WAQfvf>aE&6@cK|s~kuQcoo~KB{vJ9WE
z$U~(d$19SsEW;BNNm!QQzbSGd3>2QINP@BqPf{d7S%xPo^0~1f|F2Ndgk>4NfI6bE
zEW;NnlCUhpQ^seY*PY~$jSiM&!G3Kk)yD(d&_|7BS@15UhcuRDc-Av0mVH=0v5~cB
zm&vy_vaIf8iT0IhO_#2LE5p~P!pkz3z+Bu%s{K7od^2!m_=e8lvlq(nCI`5({ZLhY
zlEG(Sx`l6ALisPqTQ;#SRRmlauHA<e4P4n_s3+)*QioyWJlY95;1w&7>C-09GCJV>
za5XRlWf`8^8uHn5<)52y*?AHHAX1@P^NO+Xg-8#@m?BaPrl(?B3hGqkEZi<aHR5LY
zX{3@ZEJr8A$$T(<*+wuSK_Eww0qkWkQIQ2FiBzcyO2vh+ePj^(5;+Ocw=<X_#K?P}
zVkun-8!u9=7Rc3@RX7`jZ{8Dxk_xOc@-J2g#l$IUX(vm;I2&S=eE%snu2z+NQ<a>g
z)qhJhI8|%BM`=7=Twa5sdzIKMF$KXRvQLT45r+}OBX28ao*+oc$U7{K7H&5<;a7%l
zS&M&-Um00-d6qK;B9D?67-ntHu_&>c7!6<<d5mZcU>RAX%%yPGB9G7PMlSRiHTT34
z&>FxpvUWXa4PY5rw-2<&uZ*lGd5vEg*<iqG8ox5Ku>`cnuZ(QIsuu2FZK^SRni|#s
zmXR$)YXHm0){!VM9gAV;9-em{{<F`9flDJP>}@b&|5#|$meoKCRvix}m32qkrnX?Z
zGv<U}8Ocx<%oH=bg9)+=%5kk65~@#Gj5-y?O1m%Gx%FdItwAj#w+_a9Ru{;T+ej}B
zY8m+l(Hhh;ay!wcxdj&kk@<AG(4dx)J4g`?Y8kojoiZ}oROlI5PVxk5ISkDG;~<2<
zco(8-_#b1@SSIb8@!0|JcU(+7fm-JFt1`m>yaucWwJf}2BwR9`KrIXJ(t6d)o3^la
zoni&}&ef7}Xd=@j$i>2?=fELC3UaaV9-=j}W8uA24A7PG4HUx{qQBpQZSodSv+zNZ
z(rAH&50TVV^R_V3SIp>0m&6ZNg04$+r?n@UyzpV_C|qtYTs*vR0u<ADl!dbnfL1Gw
z!s}^o!7zR3bKwmeE68B=sG;!2J)l#}{QjV4w;qNh4M<rymxMwJkh1V*q8+tw(Q4Dw
zDV#?^B4Pd=Y8Bqr8D%SBs8M~4@Livh5~Jka27IHQJ`f&VHIAA$`^ujha2Y^`i9Sx<
zELDbyK0&m`qKvL3x-$K0Bf5?#jYSz<PwiGKq|fMv_mHl!D5Le1uCXYi8_7T#i!!>Y
zt_Q6d$UxD}WS}{Q!lDc>+L#N+(^!<zdBgG?3q^0$7Mg@>*XV6a(HV_J8U4p|pfwg{
zbpBywpatzAv!ERs2r0`&?-~hOV^KyIPXVp5D5G~1t+6PhOGr_TMVS#@N|viK=`Hf;
zy~`m4EK1pF8w++abFp+OnpcA>Y~@}>^QoLh^emz+bLd4LP_*Dy3<^O}Ucb$OqAXgX
z?L|<OMau0o6lIZeI}JryB*{kFxr&xi)zj5mQ$_a?J=6Rth_d&SeKizi(E~(lD9WM-
ziPlh*MJuTXixd=P(Ibm$p^Jv1ELyb)be+L#Ve{~k3(yY@MOie47DCD!i^ghO(~EaS
z=U$6SP4h{_wxV%F<F)gipwA~-V^bDQAX;Nn7EM|UI;!km^nag#CTz;fQQ)HEU^F;o
z(G;R9b<ZxLo>iITu|=1W*45_!L6f4H#ZXj(Qx?rSAG8LiESgK5nX0iV!^;aGn!T{A
zVeE>vX6J_x=6;r;?Kt<*mR+nZ>x3DbBIpa-u~c;;$P@%X6iZV~uArAFV(GX^jt&T#
z#<2`WLl6}uy}<<8IB1s;qhYOBreZ3^B_x)mVrP}0r{H4Qim4X;;V`irV)`33q8RGL
za#hwOQB7HStQ`7G6}RGYFJ`IR1=9s#Q^wk<n*g&!7lg@Jh^<2vbHoGkkL@for(+G$
z+OwlbTPD8A0@Hzoa5AnF0a?0(WoHe7MZ))AjOH}zWbCd5piO{IUa-Rfos8{rOrd)J
zs$+_Y@|7J9=wwWvTT8|7aL?EtCD2tYqNew;4$wLw77+8cVk$)dr-Imi7J(jBVm!t$
z_AYAylT8v2%AU`%>?nawh9A5-A6_C6*7#hM4zIWwyat_&J@q<h;M&Z77LX4$n6t5l
ze0Y||n2hb9OHW*u$tRIryBAkVnXw0xV0i^88GGnn^jRZH##YcEYedOd-AOcyt5iai
z3_naS>1agB_%q*9*$${QzJokYBTB}fZCy!aZ|aQn=hH!JM9Fw#HfW6~8Gos)7L10J
zjPD!{I;s#Q<FCvFtq~>TuPy<t5hdfVmx0!ZlJPgTg4T$V@wfJY)`*hvy+4B1h?4Pr
zE&7mqzlLk7_}g*N8c{O-4%I`5lC{X#Pj0CpCF2LE2RNl1?}T2iJVCuwh?4Q|9)lg#
z7IpmlPN+yDO2&U6d3<2=Y}9k~DVh=rQ8IqK7e-7YO2$ugfV@VOjQ>o%*NBqwU-#qw
z7<#!A6EuF3Gy<e#Cg?xO5|v^$rc)fxZGov0J@FssjBHUYrssq4GAdFdei{qL&&V2+
z#JCJFCL?o96^}#xxL{<D>7ooC5O1N%%n}rN<1JZ>KIs1(q0G~Yk$rAg7o+jkN^X&w
z-to4|WtWN9FiqlmdOslAi~y6tsGD_SGtQ#%AS*`&YlH`;i)X1a^@5dy$x+N^L7PbN
zT*Yh^n+Ji(>&VDxjpF6u;Myr>muSSMTRfkYqwYOoTQ!&hRp_8NPhQ!G5Jcf59#!F_
z3AfZB9^SYK<CA#<x|%y`)DQqiz6d^V6Rz1BxqY#(2_7Kmglu2tQ%)*q@6n#77_WFd
z1m;R#ufZ5hF#rM1zSegRJU2zm@qwA8m`pJrBVzyEmqb}1@rP{v0+cx$y|(Z0eRvK$
zR?s6>_7YWVLYxaRd%0qI3PK69A5cuCD1iO#hZNIK(6jP(onop)svpcs#S9UIC}}_9
zqsdz>E`r7FRX#Wk27NsGY_BFU3!`37a*wG(7m5$OU>^6;ET1aM<iB2ErMdK~l>MX<
zz@SpujlR2)woLFEnermbj1r`o{j`tVvtH~aUAOzTqf1)_!A#ma6w@fqm(?$_tY|u!
z=q2A3-LPXQx>28Z`urI8LxM0R?N@#Oz_>SwD!CZawKO~Iw|y6&LEP(2r|ur~p(wWa
zt>uVz_Io~BJhWuiOK@!a1K(7PLn*Tebj|+A=Ry4mW_^QLXMd*pP|2(>$%0?_Xr@##
z>r<SD?5}(y(Lyz|$j|Jrm1GUG2G_!G?Qa!3o>|A?3HHBzgQ4dnW<{`ev48Z97z$%C
z>jbp0Px!6@H=VVk`%(69KH5;6#Vo>)v`?v8<}ix@7HsAphfd(hd-6w{`zekrVpdH%
za9)26l&M1pM^l47KZXk5KDSC@;FA1M2{;W_f-IA)xUJ0ECilL?a>fu;q}@st*v%}0
zle1gXCn53SC~GUZa9jU1(EcE^>Pe?GKe@yq+>t|rcDkR=xJ`H)fQBtc)pCScLD}bD
zxZV4QobWGJ9>0@Xh^o9?ZV^s{9rLRl6mDIBS!dgRa-S%-=E&z!uFW^NxVOtxLzUdh
zkzXTGfkN8d{e$5pHQXXlNV|s;nZ&Ix$R~RF=OS+^x9*}Ta+b=Q&aG2j!S(hlyK*Z?
zx>Tw5=5UKZA?<;F{Nsz?*2Sa14fP+ycr4-;fkN8D{j1UUW!$>^3Rv47s|-`et@p^T
zHHurstv=)(=P7Otw;n78cY*5eI&_fAU7{MS=hgv)ANx`zxfQp0Uc|tJpE`yi%bQ$-
z@#FR^4_Q(?E`QvK&wi-MaHEH2Mv7=8gWu$-g12UhugD{2dxn7tiILFJzQseM92MoV
z_sc+|jnP;y@Q@!=iWo(o#UApXD$#<x_kPb6C|WI!k*yx^+ySOW+)Dj;(DNjiN#d<a
zFdICpV1}vcTFc(3YFjD}lh|g@E{H7?kH{C$+}Yb~q&@E;->4VG<dQFXjzM6npbZ>*
zrzaKKH;NV1|5rVo!0b|&Y4&ap`SBjHT;{%l$xFbF_8t$dbdQKr<mmf66!m|xZlrnj
zwx=9L4QC1-^w1PEojLG<hvq<v<MfA>IWirm|4eZqI6d|1b7hGrvs9?~(nF!5lvxN{
zwV2ncmkDO6!1ayiZe&(6V1uFHcdCO`PIUOUlB{-O%nu%#G^3pubHqb2riNKnFuHxz
zGaT*Ca$?L+9*Qw@n5ClN&z@}L-Oelp>}da~DqZBvM6Z`BUCOK-G{nM7E39SAx`E8t
z#=8-!)iH~J9qkk^*?tYP4w2DPy*X&Uo>>I!Xs0Qz5o%NXNmtw+W)ZNX9q@jES`IOb
zfE{fBJDvjD#4I2AkEJR-!mM66<=Xk)0!)oxm_@*jc7e(>xV0t&T%nf&fys4<i+U-<
zrEneMioF!#GPy;-j&@hor4Y9W*wHTY&Ou(3TLkQAcN?zQQf?(E4)yh}LS}+nVl24+
zs=-QB+5+4l?>^*Jaf{F%?O`gf+L^;6yflXqB}T|OuM&nM&B1A23Nq6%2jvq;tW}X`
zhDy90kq3G9OfN;HMcjIVPK(#5yk(fC1os$zx+Ny2hI=e-dp&5iT~eG%Gfc0yiqmMl
zWvacT;`Ej{K>_YDXc)yAd7v}R2cUOxU;yZl*-iF)&B1>RZ<~kOGH=6am#@dP4nMP$
z_-6da@QzjBvn9qZv&7Hd10!z3c$6fmRfr)70IbAhV_`v45dLFHvbwm(<ul<whM)VK
z%KI=(p^^((C5$2dgv*p%#A=tJj3Elpzmkj9MUN?N3xS!Un3iG`re4WZXUTC5tWt7`
z%E=UcB4936Os>JtX@hp2AB?KAFUFNnO34s)xg@Ua0;!>Fn`&lI5}09%F>&KJAL@p8
z&ZaWo%PU@InU{Wuz|yf$>tSS%!<le;X@7PtPCM$7sdNB4f$(jJLR@o{R<ZV|+!Xon
zjnaW?<)?Q&O9weB(q&KSV6CFsC@USJn2=Z|kGzgoy1$1XmsYc77?FfXK@=_>p_ob)
z?@C81=_>I8W^3svXK6TNIGE9jsZkNEbd2iiBqN*lnL{0m*kV%nOPB#P?fugoAL@hx
zg)DBf5~KqPSzPcl7`4$*-2Pmsp+O;wJ5VS$&1Yh8m<Z7+=8GLb7ZR;OA&a9#hs@jL
z`@0n=WX&5cC}e4ZmB3EwnzK}I8^dP(pm%qsJXCy+FjCrs4TV&Sco$<_+LK)lCR6wV
zV0y9Jz=XsA`QaN5C}e3Rdmd>CktscIDp1Jx-&CNG{oisyAq!S+rvagk7p!#qO`G!B
zo#e*198kytAA12($pi{n5NEBsqS5c=pKq}at)75`7qsQ{)>gQqEZu|U;v<+n1?fCa
zNrVAekilt<7+wG^3j&-L;o-kwDij2HFQN$pvLKW9CHfYGfPySOkmwOO%N1nv;Y1S#
zWI+xeL-f0CK<D!Fi6%J6f;>K%Xo7<*u(*7A4{##yg_jhB_zYwe&|?Dy9kh<mL-&G+
zrYq&iJ<I`xENICegRC-tK`TBI!(<5hK2<@Kr=g5#B=>+<6cq7Vi1|(0ugU%qWT+s^
zLmQ~#OSxq)n^4pfQ`v8}$5{EzGW@ruO<KQ6OT(mX2+yI|C$y~!q(}gko$!R$A=alv
zYcK4Mr6acW=Fm2kkv_wS&Ls*{?z@K32k;)zz&mk@NQo``7V|@4NXG6XQe#NQmaAm6
z<IRA}eu5E*-TyMO{U&WiYYfTQh8#pIAdmd{E}r&Lh>@|zN|glVVvTzA6=G!UwZTZ&
zfRVA?7dFf6c0J@e!~wradk9GiLNa!gCYMR8r`R#tu)qUptw0|q+EkBl#eSk)1C1#e
zJCQ_{5~$<@2OUt!*l*+|8dNg&JJAFxdGH_t?oa4??9b^ak^Oh58jbnc6f`FYR5F&N
zXhW1?l@K!(V~T&^aw(R~X!ui9+>K$G2_{p_MqG%sVAD`Ogf47DqTgIe-c6vOF??$l
zIexR1`o9k`*l%{3Poem3xMrvX(4N#X%@@$FITj;L<4=}+_&R79`N{WKX2%t{Fbb9Q
z@zCy(F4M>3mU$Ox+1J61Qc5yBw4)^MlRv%3y7kLI-Jw`9JD1X^A<()|_6D4cLa{CE
z>gKF1Zr0rx^Xk|(MqjNK_43O1aV1LUnAi?RrcM!8lM$a~<S3bfKqh0)DJCQcWHR==
zDj5~P@qC|!*aG?S`wB@i>jMW#GJd;OLL*7W=U;;eq~b<=zRplclJOODke=BZVIk?C
zBQS>X$NnHeie&LMbh&}AIa#0|KL@l%l8iqAQ@}ImR#<#3(V6B8=tg`UO~a6x*$v|y
zSDW1JP5NSF{7K4)njJB0@eSk(rRkSkXvFKODFVYJ-S{sJ$3D;ilf@r3159=qyrU21
z7XT)^3{iJx6u@Mcq3Q+{048tv$N`w_GI9z86~JWIJ7YeO_aF>(T|5D5^Q)jx*KPYC
z;5T2vzXq5rTX;SuxB{3gyGwU<2O>z>B6XEz-i$a`wwUM?GYRL`vb%}SG((7CWlM+-
znb)G?vf8B|p-v4jS#}R~)m9I6l-=8ebli}60X;60{|4hXX%8d$3Rv2{hRs6r*=Zp(
z&@Jq#10(2;OSb|~N7P{my5ridy}BAkIEzr3YuP#~b1D~?kM<VU1*0VDYcY%M26Y}a
z#Jlh-dn==@3sX!+NV2!F@4=*q?zCuqMlqSfMoD|S5(|lyaWFd+6BVaSFwe4<m|dlU
zHVEzK6q67Gai+ANXL00IiYqF?G^#S5Dolm=CwPLGKqu{;>}E(z6~D@fpJ1_ZJtC$3
zDtirSb3|u!$$pI;2XnjVM)keU(y_{1B(6i)wRf`;Fv~>md@ygYVPNXSiBvFevPP(~
zM*NKMXuriSKu*0llmTWBy9LZv@iaWp2Gjsf@Qvb9GRZ!6=Rm`YHPAZwJ2X)UllFeL
z8{&tI<ii*g`#RPehR7!Dw;FpTYa)Bn{<r;zW6nZ3@Q{NrX|GooB&DJ+DzKkaOhP;?
zA34M#eYXrl+9p+Kw2@p#c9_MEqq@9z+R|0BeUu%>924|zqJ7M%yn%-21jFgY@QNQ~
z%THmhY_jXGY#-W47k?vFepdqh#C{mfKB?}>RtdG^!Z{Vi!V#g=_HbGZT`oRDd$v#I
z{8JDPrS0d3QQIQDhDhe*xmfyqRfH^|I4pKHkaxA^BVj#S?MQf;oyLDgIjnZ*dv$g;
zr)@o~cGNyeJB}HF?{`_t<^E4`7i=l1U7%V$$Sk@+ZMWyiD2_!B0a4l=I0Xu<d48ke
zEabG@#+pZMvqU*9PqF5qSDfu){s+ool|#?^I9v+XTOl2lzF6g`4USIS-QXY~O1m>}
z-r-nq7>f@AqO{9ZA{I0^;#%5Hs1jJvJdVj|SEx=@b0hmbC>OGCWPi{YQ49y|#PHkT
zaVd5!YY&Ch1)e=eUEmox2x0bI<p!9ZgiVQ0-%thFUxN<Wfq9JfQFL|loa&MXH}v>S
zgHvArMKd_%QFPdElDi~dDUW@@x)oN#<eBzmo-1(rQw?3NmaL8j(>(eT^Kn`IrGsc}
zU*nvqvL)2_+SjU01wmK)peZQf4zX>o@X&^+*i6%?&Z#n&eD`6+c*XZ7n3ak##oQb)
zk0_?4D5u%BN--(oTM8MEDki;~7%~>zYQ<%WU1-dHOfk9QdoP$ZiV2B%h{*QiifJ#N
zYiRcsp4S9|<*+7=V0qcs3c>Q^*A9YZ`J<$^*9>5+%2yMu5iHBqqXinlvRpl}NC=kw
zzhMO(2*I*^1Bv3y(;u|DrK%Au%QsQFZBCa9zhS}2gp^qRG<l2$tSsL`v<9p!-%1m!
z+U$;jEZ;`-XfuS+TuzTQ<3>c7n%Pe2<IPo=V&&>CiN>oef0pVYyh`7<(5N0v`3sb!
z@hZz-qGB4avix5(Wr0^Ihkna~kry%k<*!h-hNmpwMNwdPfZ!?1U#00|u)rPij&B`!
z%EV!HkIfJ%*iA@$rh<woNILO3n~YOnOCe!{#1|?jU0e;{Onk`}AqHm(f~QP;rNnB)
zDYTPlQeu-tTXZggp@7(hg5W6=->9IoN)S9{;#*<>Pbp>(2KT)x^tmV>1?Jz1X%hQO
z!5mS{cY@$46F;&)#$di%Wc0*Q#hA<@c*?{vwgFioX7xk&6UP--!z_ZQO#I5~pap^z
z!BZxFQ-KisG&wf)<abt&%w^1?_wN%YRptZCs-SC%KNW{S))sXqPAOGZF>62#I76)#
z5Y~WMdGb4!9Vg7ngqPDDfUVd*#?@CMnKz>DMrK`#`IBg)O6<aBvh4Fc0t>-YCITw)
z9cF!upp^)6()1ux8<UA#mG>cb$;hyIibEi*g!d#Y#eL4KhXdf+DGp(AH?CO|9r%6>
zGQ#4la&Qq9tbSqEJOqJ6p~}Nn(0cg+DM9FziBX(}Dde>#hro@dXH$$xUaLg}+!&QN
z*=vm-3vR5+d)R9=AQ~smRn4yQT33-9Oi<h!uQdjhC8ltC^J$&ex(D8$n5p7tz1Jdi
z%EUD)!f*8&{sHE8IDUpkr>xl0e>7(2Tr^*yp77P^loea)#N!Qw@n5k`(JU~u2+T9&
z<z61>Ew}$0Cp|)^tayoGbnsw5p;K1uBnA)m4~MBMUcuRc9_$}P%r0U&^T14aT*a%z
zbmf6t(T$4N$>+QAz&9AkiZ=vKP<a0TJ7V4>2G9Q!I%UP4m(j~fJWvf^tk_3Pd@2vT
zgdkIKkmRQG!f7+FF)H389p~@>0ajMLKL$l_=YhU*_7Av}XjO@{L-aydl_zjlKA6L#
zNsT8!ep~SsIm3CL0J&{N6V)@`6UdRfQ8Y^Eloj7n+H_B#457E;2r)A~0s8h-#Zh8r
zc>*`dR!8toL~mJm#D${l{>D<W@|W_uBh2nZP?Y7nN!l<!F9-bw(SV|aqUCQAZKhu^
z<8q_?EuveR7s+>yFpW)F{x&6PY|8R?h}PJY<@<@QH0iy%@&iQoGqN+t`4UUiyj08W
zgjCZ>U#uqXS2N9<L)esw6^b#{m22V=Mo|whDp3WGDJD}WY|6x1#f3y43KSdEDKsj6
zK!b^=R75H@lD|j=x0zMI_}Lre+8<eD2)#Ct*r6Iv5%i>V;yJ~n8_AcEQ$NqPLpqwm
z6Gi+=41geP%0!&6#T+&SVN)iG6*I^BOy(VBIe8zGK&kTndCYo&;y@>LopL*~_RBFx
zSrlJJoejy_j4b5!Qj(jor%WNTx8e{n22ud1RNM|sU79C-_%%=f@q+*-6K8YUG~dH4
zdSxTgS4kpN1Sy>MQyfBt4Ut5DHQNv>=2AEq!08b`1c!}@7}#^T+OcO=*RkNLR6#_C
zl@x~uD()myYXfdDzZK0RRt%HX$Jj+Z35Bx9fW1iboA2U3b1f2*cH?3%rD6`vG&~$R
z-KdzW&M_uAXT>cvnXsL)U;cQE1;)}nz>3@H7NCZqte8(X3N;L6#R9rds9`88?xGug
z8iulB5zUE^p<yU1mTW;oYCpGPDeMmVCOP3aHlSw0wiS}v)}WIW%ZLt{%fm>&56xh0
zwXzcQ@|LKf)JS>}W^7rp@++$Edf1|36$#<9uvF1%qBRU<#Tuer7|M#ZG`kfHWyLzu
z%t*h=s967U5)6WlJ}Q4Z?%+_Cd_mj1Mf90~k}qi!24=I7qH!oo4%5q~sv{+zA)<q(
z)pE&K<&>;&C`-OpYj}-AS@O+zWcW=gmHj)SR;Xl<+Mm@s41=62Lx46y;H>2DP-RJy
z=XH`+IFu!(=SwhJ+H|h+^39Sq9`ihGqY(~eNs6Z5li&WtI<N<1+Y>C4Jtbo&*m(+d
zGUWn#QO8iPj-*_87v`2molLoiXpK6Vaxpz*eaKL#lPOacqH>^4zHovKX2)f#pYhE9
z>#`gNg(TTC5IrCH+46Eqq37iSDI1ZJ6qXPFjIWqKAh-UEXmcolj7)mXC8P`%$R>l~
zBi6}C&n3F6Nl=o3Jfaik>I%>n(HcrJ5F)zLOom4U@`=_^l7TSM8cH${q4zzi)fW!~
z(fvrTQSZYAV!OJbnMo#rO9tZfDpb7!mkbosvSF)PmxuI@L^qnRV*L~7v=NE|Tv9Ij
z1#bCaHIlk1n*?j%ih+dkEY_|m*c#&<sL-s{6g*rBmhKuEUY6Gs+*t^=r)G1Tg5L}W
z+e@=KO~HCZguq#v&29=(&=2(1Y*tgS7h*}El2|_gE1H4}B^HBuwWAQ&0)4eqMpKaE
z+#eXA+4QDh6sMFxm1fhLg6)YNsM*w};JrBE1_mjXr!)lzdch9SxoyxsDeJrq)4C~G
zOv1x-t^*|*ICrGn^(&h=CH#N*x<OL(Z&;;x=5!80M@&OnO-?|PdQX)Zb_of!9IAw-
zJ3=w~s6cO@gnKFZg|0j<$J>&8+nbd9G9@poPqF(OihgJJv|=|jJa6)DjAb_blFYv{
znb~kCm7nm}zRX$Rn)TOSf34ZxgAXBbFEgjB|EuYLG5wuOe=G3Ec{Gg<=4blfGsXOT
z=$P{t_vqzGF1hNKd1i)Zym|95GyT|vx{jW|*LYr@Z4NSfnjMebHO|xK8MFP>o-dd=
z)12x_F=z5f`tYYGq>NrVuFiAoY_molTife3Pbaw`n_KZW@bOP`gW0P`uTnESc*r?}
zhs^UVoy|KlQpInE{GN}Pxy$q2Z1Z#ZM>dbwZkt`>Wu8~qLtgILHoGV2S6L0{21UQd
zcJ=CU7TC?RXCiAi>#1lGdxL!r`l;E26n&squYn|2uZrzaa+==D%v5A-P=fnZ#*?!z
zMxl4u&7M1JYthju^BnEe!86M|Kw5t8IS4I1HRk6l&TH0wr(qs2(@@_Vs=iHZW-rB%
zc1JOB(u#YHYnC?eG1GeVx^(-w<K~V#kI2rN^n8eGofWlsrPbS(`49Nf;>Au2JiDQP
zE)V&9=L{PY>bpdAX~#QtlOKfn%?%gj^J>;Gp@6^8rp47WCQqDp(afn6XUuHK>%zZn
znT*d}U3v8-Gp9~#NUG!mSi`tJ{Kf7vd?TOMu<}M+Ma!16dBAtkw8@uT-jF|=7q%&-
zSLW##c8<&#<C2q_lg7H_WF{xg=eecDP8P)s`Z2<r)8xeFq){%3QuzybR^D_cYkso`
zKJ%+fZPpd%-Q)19n?<VEI^-r@i>P(@TbUetCl3#3bog;xSA`z9<Qi<8(2p6TTym3>
z<TZ}5F)Lhdr70WlhK5gJX40?0Iig=KIoL1r@8DUr1x_;?n(O}C=~{GYW?&Zo=g;p*
zi{?_*F4>_uY5ZWnF7=FaWXAYk9rCOsoz)I$GaPz|snd`&!Xa16X-j!_?i8ogjOL1}
z-HMXsr+4w}j>4&<t8+w8T{6*}RO7aEiz?KYzJ@}-51S>bT{5Rxm$BD6<lmc<s$CLx
zCL{KBrSndUxa8?hjdeRU=CqVcUaKq0o9}3{@U%uQc_2x(m3ya?B~Oby?~rflZk0Jh
z>blKeJZOIN;EZxd`Lu$gTm>EXDgC!2eZ09;wM$w!+t800W8KmH*zu^rPV=8QM{bm^
zaOu;|G1hJ0t%<~3I^0})wM!0dP8xfoL#}X+RPwZ|;gaRQ6w^s0=emvSf6(7`iuu~W
z;(15!54f7<=k9TuIp|CxkFmIMwp-pUtP*uIr~kilO8(S5{l=dzC$CtF>37r-`PDi4
zjOr!k64Pb>bdvqXbq1xoJa=kLQt2q-Cb)J;RvC-8&R$}kZc=OZmn=j2@8NBP$EhvV
zr+VBs%i$}U^{#fwQO!vc+<L1|JEBX@NRo?gNAEhHQIXG>NWE|?o8x5rDS7M?)8%h*
z(jD=MP6HP^M;}aqF1zeBCt1~kbeErzbgAyJTm9*Q(bV})GgmjOF+o-A@~$mS1L=!*
z!IWp#;93L0RP}eeQ`2|Okr^Xhk~^VGIf~2VH^;MyE*W!@{Md`br{Gq&e3xd?F)rET
z3{gX7NQ~y`pf5`#&-yDr0(^z5q}x4i^jvXf$Ig`T8%MWagm297G~s5w>649;r}uc%
z>FZwS*wVOqCO%+ih9dY<+X^?;H3Q<ZOTuVvmhqxuw*uEF%$RtlI<Cl1J~eBE%YUqO
z$ou%e>^|l%t!!Jy3q`VHEVN1!FVE#e&2}B_k`M{q$8(yCWccNg`*?a@h9m0AA+EY4
zijauB<365J;dbP-fxG;dfzOnIfp<FwcC(UoojqJlTRP3RG-_`;ZD2Rm)dU81NhsBO
zId3mq*8)#o`XBsqo^zI)@A_36?Rux%a5K6$+iHwUqRy|E^TK3zGR}~Fmho)iveS|z
z`CQ&<UJos_JUva-d9C}|XPh>+IwzfKCj`!Mj&;tl(NX4*f5~JP$aa$lILVbxRG5*Z
zvR6AEQtuqyNwU>P*)i9tcRJZ_tpC8_KXr~xTHF=e<s`fQcUnw$^Lr)U{YOX4JrDfm
z@TZ)k>sXnN?zzq}Uv({ZX0bL-Ha&k%zthE3U)<r0IN5FlDRy{wG<#^njd2V$-Z{EM
zr3@F8=db6p<>B>wqG!sLGiC25`9k^OgM3JqYksYQ{`VL@<D~5K5WW;PNnZ63&+sG}
z^+W`-s$2b4&=pTMLh@k}ucSkUr-e}}_ky21)B0cHt&BPUGrhI(UFd(ww=t^o|5tj7
zQ70#_KznVCHADpEq!m2iNi(*}#o$<@%FW6!8cY7WUJt(G@dKo?g2p0e9sJieJa`Ry
zGCo<CTgO+)(9_&2Kdj@~wW&tE{hxJZp%gdJ<J7+v$DWUqKIx3~K2Cbw8R^*N!d2L5
zWt`=Maj{BA52;<+>vDe!K~Teo&Zy`<q%*uWRCk7=Tjj=wVU&;c!7CqL39g+wELr67
z)>2)2u-idD{Sj<@ZV+0iHUc^wyD;i^lapSF%`N)%(+51HtL4x9^zxHPXGXv{R2ou}
zm5%)DPI{<Q2zx~MRU?6ZUy@!O^OF%wn9;_lFVM;Ee^8}kFyxObdEp3J{4fLKenyu|
zReHM7ct(1KN)P<k!1q__@E1Av5uU+XNcjjq2Zv7{;XyBn%ikX1{k$!WnYaVLitj+y
zsa3FIKn5S>9l@Q0Lv9O$9zmhs-TGjBgc#TsW4o-gy!%o9PYAYK%{zL7MqOt)ay7R-
z0b{zHyP9X@oF0FtsId`ovMo$EM{Zor-^w}<u_o2Pgu`~(Uw@P2h{vEwt=#w+?=L@l
zjF<7QT^q93@B^&D^8^ohyq8>Y$xNBQo_Al;w?l7v<VjxFYN`{1>A>ZK8+bvo8xI=g
zs~dQE+mqO#qn~^Hn`~RpJ0?$}-Aeo>$$|B}Jhk3o-D4e>ch~chJU3dn$33tw{pge+
z<VW>r&+SJ@CT~Q0l}@+Z;}JPxBkw31H}aHLXSY;^_1}_Cp0xaVpvhsJh=^g)neH)J
zw%x$n<=^3mb=JAf(Z`KKm&g&DAV#A_wK+;Q2cz#oy4;1Tw(L4^e-(3MQ+2+4Z4-~=
zKY@I5X6L-uJP+$|M}&T+T)YvjZ2^hx%w{n)zrnBh4>8}1NMiD*O}tAhQ0n&z{+TR$
zig(F(QjB*%kP+NAU59U!$(wm${zp{euh~vKY@{HCU!@$enYUwy<yAQFMO;??g9ny0
zb~5vtkV}`#ZpCh>Ttv2{F_3i_8o<c?xS0nzCWv^NN7xD3>1nXfc9w&P^~tNiCO_B(
zW$??Di=ReoZB;7Y_N#o2gxYDLFO#(Sqq6N52*qWmEhyT$olfm7M^I`vEjx6sPTi|z
z`{)X-`{Zj|ctlQb;F+Fb_wyx{T{2`{15c4hw(!i1x(9TjgN|p1p;1qn*TCb+vsUY@
KWpYFVZ}<Nrj>pXa

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index b64c12b..e5677e4 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -171,8 +171,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	else if ( auth_jwt_algorithm.len == sizeof("RS256") - 1 && ngx_strncmp(auth_jwt_algorithm.data, "RS256", sizeof("RS256") - 1) == 0 )
 	{
 		// in this case, 'Binary' is a misnomer, as it is the public key string itself
-		keyBinary = ngx_palloc(r->pool, jwtcf->auth_jwt_key.len);
-		ngx_memcpy(keyBinary, jwtcf->auth_jwt_key.data, jwtcf->auth_jwt_key.len);
+		keyBinary = jwtcf->auth_jwt_key.data;
 		keylen = jwtcf->auth_jwt_key.len;
 	}
 	else

From e5df258a19ed859b89ada77638427b3cd9a4cae1 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Fri, 25 May 2018 11:59:23 -0400
Subject: [PATCH 034/130] I had checked this in by mistake at some point.

---
 ngx_http_auth_jwt_module.so | Bin 178096 -> 0 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100755 ngx_http_auth_jwt_module.so

diff --git a/ngx_http_auth_jwt_module.so b/ngx_http_auth_jwt_module.so
deleted file mode 100755
index 8d9c0840a8d03e1e9ec6607771e610f99fd6653e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 178096
zcmeFad3Y36_CH)zNjf)BBn{cRlaLg2AdQ63fh?V7>##NuAhJkYFaZ(>$`V7OaT}un
zCB|r6Msd^;mr-0saK{~2aGSw(m~qSKI1^lP$CdZ<IaM7ZU-^CC=Y8JydEP&!HC1Q3
z=bn4+x#!-xx4JoJTE%oj*R|*;Mw_S+3k<R;VTZB(F2jK|EvyB#cwBQepUB4ba{ebU
zb(l?y-Zjk<0_$+$Z+pI=xLX25@0DcYQ{&vD<!A*-dz^B6oO02-7B$nkD=NV!*7@7*
zH1+U%u1INUll`GQKb0Rg)e=5ysG$GjUTc%J=sjBQXq4+U-I4h}-P{gyzEj^3{Sspf
zRyud5Inurqut=UUcaiqW?VU?PE3Qm0w?2F%@y4|i5B#Jiu_XC9_@jH`@prCfD(!@r
zBo!O0Z>rT|$;-vxQTWS9|2BT|v^PF^_=C&Nx_$Gl3-3rx`Xaym$p-?h{qA3V)t7(T
z{`{VQ?meX{>!Hps5<hzF^Tg24_YB>h_5P#<?>w~-#eegY1*-KMoK6@N^+8|u=V+i4
zihar2X-AM>d<6Oap#PTs9nkt)`hPfr{9BO!Ej{r^uqPk%-_j5DnuWi^KOr!FOFno6
z{k2EXfA$gVAAAHo4<A8(^bzQ*j!^GqN02}92=up)Kwk>SScf|Yc<>1Hla8Qg{t@h)
z4?RPFL;ohwe#`&Y9)bRm&`nKCwUsThZ`uLzbGoLDwH%6l>yH8G);yZ~F#7$FAE>2k
z-D7O|XpBAQ(Dxrke;(=vX{Oe|L66Ty`=;HFJLx-<ZNfH(-t5pVhkltu_rh<KuW{@z
zaOelce$W4~pLPw>60|_nKu11J=mWIvOdx$eH$Xqzr3EaZ?sj<PPQ6`Dz2hDF&C*_v
zrX2r7^S4%Ay>iXEwbkpJmNqt3S8LU))~;&Os#oBqRnJ^Fr@FSTv2Nw6^-Xn+3+GH(
zy>4yY!llbr*V(+^=2S0lSxN;<SFbt)g0oJop6_UwvU=(I^>ypD`ns0t<@HM&tDDwU
zFN0v?=`dq?)9DR$psZeZT3uuH>UGO|Y0Cs-p}z94c=^dtb8_{HrK?tJ>+6;_F0Zey
zuUiU>*P|KQ+LbM6R^#%e>+6=UX@Ede_44NRP3zV;LXhbdU)S6u@~hF(>W1d^_0iJR
zO{`RmZD?u~YQxgiv~Eq^n&l0r3nj{?C~B;3(r{f}XPeNl+?J;~%h#=4fyS(?u4`;u
zXKSl(YH9$zv95Z}y4q%VmU2rQ8<(Db$PSTN+T2uMebQ-7edUDFu(WYKN;j`=S`}^C
z>Q!suW@_rKOzO~BzP4`px>~!Q`lajZt52@8TOrC;!b_(vZCoXtOa*o8moG)XG&io2
z!sIVqy;5{bfoMlpH`blfT(`cdS88SB(zQ+Sag)}xYE9j*$+p+%4E73Lwtn?Gy9dNY
zq^?-Kbmbwk?VRd$jp$t|?GV;3UE{RWCal+1uUdA}(zWZ?uUlKNeqBM4;HNba4iH{W
zs6?x-t6kc(6d|^3{dzn2L0Vg@&8V0;c}n$|g0a0&VNox52pUsR><lcqVQ|R`AWGwE
zg|y%P7+M_u)Bl(MVztjCSJ*m|SFIYLp_E(loTgoI>6KUp#cCN2o+A7hZJ2{MXRJz~
z4Wohc6J7sB$9?x8o4&(Y=SAsT9Qy9V=utf2<eR8`V5qGpco@Cg!NZ5qtwKu*^c+Ut
zgH*<k+u=v`H#l_9Ve~yte)Atjf7}u^TFqhfJq~^IVf1$#`kuq+pE-2p%nwm}v>~?s
z@L_bXLvJ~Zp6}43^G{SyjpMi7qwR{grbX)R{p{&OAK6RQwCH?A*}n9>edIA~_I|qi
z(A~XMP3!4H$86O5+24om?WJnkfj)GuHKU)P<2Tw9U89rNa0I%?@z3G%l}Dg&?W3pf
zi0VE9eN!JjedT)!ESe>2^S)E*{yucB&!e9Medx{*vRRHFxW@1Me5U%)`#ztz`_Ne?
z`tkIkM`MCKs}CImxcB4lL+{s1#q{5Y-oFn$*oW>sDhfB;hweP;2|dz>jzrV@sq8}^
z-b>ZAsy_6@KJ=PC^rSxY`abl5edrB+=uYYpZc86}ULX0^KJ?^1^i6%}&eBb|U47_I
z$`JbIK6I|JqMt2&=uYYp*494sjHoc~+xyTn`_Omvp%3mu-`R(r-G?4&`$R=L;;zfF
zw8+MtO>sSMVT455o>5QRLI;b_%eJ(G!#3cWloJL-yq?T`-3Rd*b_Q_{t9^R}ZzRqk
zuy3c}ClO~T@7pf;GU6Pv`?d&v9C3#9zAnM%6K5#zYZZJJafa}|2Eiv2XXx&$5j;ek
zA-k_q@G-<0s{6u%A4QxYx-TI3P~uEg`z*mTh%@x|xdk6YJdwC2ct7F{seSu@0b!Uy
z+)cb&@E-;PXK3x)BlwrZ8B+Up3jPsshRnY0g1=9kp|Wp_;Qt`b5ZTuy_^ZSj8v9xW
ze}OndVqb&cPZ4M8+*c#`!^D{~_f-mh4{?UdzOdl86K9C*3-t0=bR8T<y(_vRopF0C
z^nK@qr*K;o8F3)e{$Zr;K;mh}lBW?EO^{+>e7WRcH~Sy*SKIQJ^^t$_Kuo0lsmPNb
zO^WDyBCi~1mcpskQutLAj<i2_@O_qVop3D5Y0Y_&wh1%9MwRU!HkqiuUxuai)WO3&
z^|&l~E-nB;{i~;0YDGa(&IUArp*dl%7sZ-}!?^FVY~wN((SDGj>)@Ux`xZk%Qcf%7
z_ss@;sCXBu`({BT>GAg%_&tAtM<N|sN7m+^*K821*S?)vsjKD*ol~wKA9reY=aeUK
zoAKN<R{o4C+<E+xrw=J?`*`sV9rbKlB3$y4a;9op+sA<;&`S@a|GItU$F#rl<i4Ep
zMdb?@Er5;g+DJ$2Fh6RDv`@`N?VYjx+Pd|!-OVi<U;W*pwvY6R&egf`6`i%Yu2(*a
zw0{+8|GA>GDNT3UpY-_IT1ES3k+!GxNZYeUkNGoP^Z3~ZE873vqX|4UH~z`)*nU%U
zT@__tZJKhh`K7|0k&cR7RT~*=O3lqFXt?|MCFLiSFDXCq=^gOs!H?hWDgWu<!LIVf
zGu!`Ge$34FZ^h(D=emXkg>TWh6&>puKK4X9V~>wO|D4X+IBibZS-GkST@Pc%Em4i{
zM>^KHBO5<$Dy!&NqZRHfeCv={^WSH7H08Q0+P~{L@FRL@<Id(?^nXQrchr*d>ZiM=
z75?kvo~}dvu_$uxE-ry1?QblgH`vRY?D9>cBOPNS9cQXYdjtMj+>wrEEz)teitLgl
z5Xc^oEi@nXpeG}{c1lzCA5zcwu@!fo3Wq{@CcF@7|3?HqZr{~&9jbaR*3%mcUF8dB
zw*M4q|4!nr=d&LmynJs(`+p+s@Ah=luHK@{1bZ^lzV~<xmlw)UkjRg;ouRa(4S!+)
zw4LDr_>>I>0lsI05v{2n%*umJ<+xb~n}*`%KiE7d(lOW1)_i|3k~9sPCj)ch6D(<H
zFU$J)1sUHRb1Nl4`;@Bucq@Y18GjwqBj}5y4Q;HuV{RB)Ba!x5;eBUtpmjw$rYqrd
z{t$~J9f^>E!}}#|oJtuPACU7fubcy!AQibG1ozK!Cv6-7sXp}uDOU=S07QZi3G9nM
zq^C3Pc}xb8U6aF{LuifU>E804ad+AL0NCUQ_dSoH-iLp&&1Xs{-?Q(JzvizMzAWm%
zR{NU3?)3-y_2<W{P?CccGwC^=o-%gw#+{M&r<($i&H?veZi?&*%VdMQAEqC~T_&r-
zR}nW)KtF=NX9&w7@+1P#`K=(sh15DD80kpWJr*2=|Ix4G_aM%@k$8F@`Ce*k8i=ZL
zSfCwAf@*rh_sbQ1#z*<$@?)Ij(*9%Q+)p;6NS_q5A$Jo9P|z9IhB-H~Yie$Q<`D>U
z5@r?(g1eSnz!9Y3s&orhVK~k3S9BEZ!LUInADr3tJ1iMCOofp%JEjL_b{vDgo0?k#
zF*I>uZhfSqp)%4oF+S;nzjDBKkjKbcf)bd41|)4LwIP*s{u@{@L^@cgb3y=BKV;kT
z=2y2QZG4Elwx{AFolVft`N(#bk_tK(<~Bsydg7(to}&-YzXyIy+HiqrJF_Z+4AVfh
zEj?4oY=0KXC}{&%Cone*vk~jBCT*A}cKi^BaY(3R3c5sWk4d`VWa{dCggK`t=R4_(
zNPAlY(4-BQh-HsdVfAC6dlKj~C)ex>EAeZ4#GSO^J7}HRkrrvM^q^jNr_zG={CdQ@
zv#oo1B(6Yey-50|H!CM?ybuu|IrkZMVV{&39bdMy{sNhYxVnk7i?bf(G}l@DEXWVr
z<o9}l-#TVLo3vpyZ0*xPbk6NUnPwqddXPP<BAu1-k+#p`dj_(#aM>Yu#3!Bqi0B`%
z9{Ojt_Y}Sw4elZcI|Hi~)}XnkB4D8HmCwrCzlkjWw&zt?F|*@$p7M@kkPDuh+5Sw=
zXpk`W>-tm?lXU*Yb`?)yjR^g4F$d4<5S5V`9XFj5?gr~2*ny@$_th;;od}&l^hPf!
zX=5Q&&FNU-nbxt^9qBwP*FUv=Uq$=-7?eF@zhT`;8~RIZ_UZBS6Ycunhx$YHFJ%2+
zb3(PpZH0t$=YZEy+aWI$P-+mQdh-W{(vOT1jIRbRQY$)#9i+oMC;SWK$4O%Jw#@8s
z@eZHCl(rpPK!;G=-yvI(G_^a@(YBXC(jJ=&kcolPs^`yNv%4APSe~`N*Yg<hjXP(y
zKilL^dZ03<?fuHu9}t0YXk|smBQ4U`ceGM#`wtI64fK3gc(5l9-e7ml>CB&j<wVag
z;KGKOJ@v6ZPtQBhkJ+s!j`b{Go$H?2zAMr}qZl|%{v=q(u~DJ_QlVqUZ1D8_1EPoq
zB?Dj=0;;D<D2b7WCpFeJH8-xU#$qM1{K>W_&4}I;S^j-{1^m$Nj_9AGb_}HE#?=#g
zd?<ufi@TyDH}~PtXc&&ct;+Sk&Ro8$ylqzuiq2eqaD`Ls{pZ5Q=$_BNg0<)<&y>#b
zc@^y+MV22FrO)-e0ghv8q`ltSw+6GkGjAbEdd>&C?LaL21{bv*(33X&L|1hzKw@ZQ
zQbU;jhx2*o0Oq#x_ML|!<tP}s?*%X&eSJggUc1aOD08U5_o!^&)lwjgJ|D2)SKPPA
zJri7e+*fo=!<uWr+33MTVfP?qf@s2uuE)QY*m$oe88oMb`>I5FE1IBn1lU#Q{u>EA
zsb>;orgfZ+!P<<Z#J(v%_dn#o?>+Z?38imJ#7|}0;TI&9pP;^HCCU{tH}pIPp-9=Y
zXXpQV2*1dwu5-X^5I)q-fwb~&avWVe)9rbY8ju9eln`ovuIDHc5Yku;EX+kvEzGS%
zWHbCKdrtg9=ABBtDZX&$zUTYsYNf7o99_pob-fFD>Izd=3w2?jh^~g7LEu5j22paT
zlTN)JhOhlq7gRy*$D4Wzsq9cPL<qESs_z`Yr(rB^?OY}HLvKFxGG;ixbGD}Q@rf)L
zQ(U5Pha1NgxN0q<n%CDguBru4w}uA}<%<?Z=FOjZ99EX|=4$2GonP0u>WrmLtJbak
zHD=jo5+Q5YdTq+Qd9!Cuo1pQ?qOR6zT4!PZyw+N3VPjsKFLgGrUEkc$u&%KQeC)JC
zX;b~0J_TgEU*uP<Jr!pxeWa{aYss*N)oOJu4OorV35s2Q3;3$Wx>{|0^D<5BFR!g_
ztXscct5~<(w%OUgm!1CJvj!X=tXhk4t@ToPTF{Hst>rmE?I8lHKsC#o4pGEJsiB$&
zJck&E+SaSik*%w?J<NWX(pa~Yo`{-hO~I+bs+G-+w$X>w9ac{Pj$i19>Fb*5-@d)$
z^oQk0uokV4f0^kZ(qf^da45RSIieD|s84Ix)vdSIu4}SzUeUA^eqU<AwI{LZ|BKvO
zOIl|wbvnS759Sx;2lE4g!a$*XYyfy+lp=RoJhKFkX5{>(*LlwI5qNrL%(xodIcdHA
z>A{0%;ePY}g9mTMeJTdW*SLR;`*@7S4Hz>Q;r=h&AH_Wdga2Q+FT_0s<K=5)NuISY
z#6+_Y_nUEV!acgjrk^oi(_7qnrWvogP%am`v+!4mdiMa=65Z1iJ+qSfpQc*1Ng3mg
z8k;*5RILJkNLSi{&kr8FjD+$;_xZ-uL{D2xB++W>m*|<2=q^uGv-{5j3?|?izlNh^
zmKI%C;2uFcw~;V8(S5NoBhk|tGda<^D7HM&e|}tfVxY}6H8E_o_e%_bQl4l{PV_)>
za-u4yw`{xK#(g{VY$O5PON?oWo{M9qC0d=alN0?HQP26VX^FwM_~}r#xL;y$s^~*a
zz4|8G`nboM4?paOzD3k0?VQba&PcRQ?QNS=z4-40$Xn>2f?j#?%j`t!_}(^C?*_>E
z*^iWiofoma=f_M<wAy0pMRHmq7q|SdzwU#45b{^y9{sStUIM-o{eLWpV&6>K2R&@~
zRPjCglvCCL$g$rvkYRn)ZPK5N7eC^rlMe;rH+bV>`oFK=%IUXRiF@>zr*(J^zC=&-
z_1p~GbFAdQpZ|K`zaIFn2mb4U|9arR9{B&#1JU<EqVIo1>x#bj5nVF8iaDO2DE|Io
zINw>}$Fy&~@3TeEl%wylMc*xmzL%2e$Vb;J(KFWQ`zc(1@Dt^K^UJ|?#P>Ufa5IUY
zt<K@QbJMCEd!lFN<M2SvPjrppvC-bQclH!mLUD>|TO1&|-sRGUpXk|em(#E)z00X6
zYG+h&^ejJGU-WKk(=<H!OM9Yz#om_SVMiaHV1LEOa#HYrIf}9SEO_6u^{DRuH}1Xf
zfgh%9g>2Vr+NsX{eCK|pbHBy8Kj7S-bM9|C_kTP0Z=Ji#X+WBDAMV^socna=evETp
z;oMJk?&mxAE1ml-&iw)B{+x4v)4BiKxqs{2UCv7gX?<TtIIPY8cTn`#uRcdAGxU@s
zVMX7gioQ1$eNQT~aAD<<%Kra>9(`}?f3qd}9#{0eEyvy3<Ca|#!;EMBy&oqWdhsX_
z%`1B>n{uRbhnJ7y?>OafPVk%cMcKA?zGG{DK8rGrP|hDM;M{x1_Yj+KBs&9#m5YX*
z_kSrDKCE0cA4T6cJ5u{94=eZo6pg;WcBJw%rc4Q0etctMgjG}!EGV|d1PY4-C1b`~
z{`uI>i7aih>7&L3M`(PQwezf<Hlr_7^StM`KDK-^a=tAeeOdd%-x3DRmQUXrm5;uZ
zz54$s|Hi#h`DoC-6V2j>mE+`OX#ZTP_fAj07D$4nu|iThcir_uG|T|-TMaeR$;=Ky
zK1NrU1Bo%>iy#~m8{dzZisx>3jPClq@Zx5&_F~LyhJOvf*w{F}bQ`1Mz9VB485cDX
zY=^wjNf0_tz%5R>)E1(;>ss>o(t6C0QJ@$bM?ll-bI4Tjob93SOJMN~(7kcrR=^;&
zFb_JuW2Kt<1~PF!{ehr@qqVr73A@!2)F1Z?VUK!;G6xA;2^%P*=|ubq<A~^j1QISI
zVh9pU7>Ih}Vgv~%v{6@_Ad!SgL|lSYCUC1HE?$tTgzJeU=o?V9CL#7{ApP|Vfz&5l
z$}$6VTHKJZh{!-eniBZEj<{s~OmJEfh7n2ECjn_qXrh=$UkK#91a5`LdG#)6YfIRR
zNk49|z6HppgmcLmuAdLFu7nvN#f{cC1KFG~mq<X6EeVT=6biC6;RGUM1lgXjoXA-H
z9+cUUFlsW8VzF&!!Y5Q+s^0>EXS99~)1GVMUj@+<cLN)#PGZp;32N#z3g5)$Ds^xQ
z;9J>Rx8_njuW+dsf%V^l3(Yn!1wbmhQ>YI_smY)|3S__*5!gkL4oQqn2>4+_(#g2A
z8c8F;XpK$c>13-)x*rm)?xg!+M5~pwkJwI4X1LZ?J!t`Pl=&O(dJ+edkyM9kY*II_
zN;957IoH_fKwRopTw_$M2a4TX9qNf}NOZ(7NchpOeH;P<m)C>8MJT{<Tm_V&^$7k3
zjdETTjIQ~%qeSxK;OK6uJP(zojB#YTIZjh1IM`3b-285jo<-4}4t*P7e)MZ^g2X_)
zzzzYrE*pOXmo={dI+h+G$}a-g#kp8c<(CHZ9CDAvUmCvdpy@-lK$&sr^mGfh=tFI6
zM(VoST20So#V<f~(8o^gvQG!%?@@Q^DosC%63c;ja-C&rn015T)fXCP;|phjK6KK~
zLV=WZ4sigola@ITMdG(IZZhvBc$<K0!BXyLpvtA#>-~A*O8{9~<}>6Cd;!Q{ej6oW
z{>LKrg<QYGb-*%649-D`gvxkS;!;mSefHHLXxdHacI^U`b5i1cCOiQ4;klgS>VKw0
zW9w*;b7n!&|BdW;SW3KO9?EX4LRq7gYR*TB(2Tzf#pMD4e>WK5CJ{InPBPjB{OTBh
z7mC2<5`Y~-{XgYb;}VP*<BBG#Pe+O}t|S<zj8<e<<3^$XJOJRW0`8v(@O}YP76RNs
z(53iQv1o=KK+~TVk>e=+oS4%mZ{Lmv#SG;@HCoY%m@yni2EPRmQ}r6bFHtOJO)|ZD
zDa2xDe@H6RecbEPpi;^{!;mu0^Z<O8wZ-3wHzD1zEw8h~hE7AdGguB&KrY}jvq{$C
zM+G6|%Kkno<g#p`H;1DgL-tetu<0a$jY~(j_j?!I9Iby68W`VSF9Es#2{1K&kX{bh
zo_5r?9J(^?s6Nw<`e_7flxau(OxT`w)GvhXX-6F-Y?&Lx2%U)E<g}x7K>{W-iZTQV
znw)l2j38l?(~gQ0Bw}*fQ7%C$P4uaz;svQPuP2hA_duY=<g}yu>z@IsH#zMnXWB72
z?I>s3F*)t1WPLY^wwRoDRJzWfZZ$dWD34wZ<UEtpj`HeXgVttp+EIh`Sd6euCWnU_
zuCr^qOinupmmh&_HaYF6fFN5;PCKelkgX=C9W_Rf?Ix!kHCDeEdUlwcc9b*in4ET0
zsooFuJfjWZw4<D9N8P|i%Cw_yBxp}N>LxbVo_194wDTZn2x3$tolUc)vq@!l3N<52
z<+Nh~Nn~KS6vNP^3PDIBI1PZi_X5sr5C#sy{Dr$qu~(C8DMJ^4a4g{X`8ap!N+=i^
z2iwkGfC>X=lB?3D04~0kpgIZb=Y$E50d}j^^8rufJnT`cu(V4Eb5hSzi%S8QUkcb#
zCqZ$-6q=N)Vn+d<MxB1OHVN=7c4t7HhhdU1_h-OC)xQXErGkB7bpsyh6OP{oIHGRA
z5KK6MaFu!)LpNaw;d=GQ48SMR<Q6S~qiY;MahstTH>Cj1Vwl8VHWn85zw%_Z?ewV_
zGn*->DQhv{t4TI&2cH=&KLBo-4kTWmfuiPTj{{ck&Bj__zg={AIp8l6T_~zbB7ndA
z1|qR)tRL_<7lDq6de%s!_W*{wX6%F^0}5%4Oy2{>N=gbqZonCmP$u9R$IRgiIPs;>
z7i(Hnu2#ZT=FpEoM#;|*)8?tq14(h4uTKF#^&Gg#d{e-Cq0-#DfYj^If#%<r1Jn{|
zI*H<!BrSo($q_tWOJJ4jqj-!Kf1jHzepQ<AZ&vu0mwL1Ww&U8UAPTZy?~LNHT8fpJ
z`y$ZPt1vtghx04RsZR|9n8(zp8BY!Y>}LVvvkF9N+6q!DFkK|2i(lH%8%Y`Bm%rly
zENL)$MKhj7@Fz*KjPF;Bz;MsIog=$qCagT#0H~?oW1Gx9{}X6dD(H*Crh1y)e#}2X
zcdLt$gxrhY1UyK!gaB7jK1IER{&F8jJsveT8SwFhEfs_X?i0R)j9*Qs&T7&FstBRz
zUdFOP^%CjzgvV>f^B%5g20+L-h@mlPF7vffghV}P-g|JdaWEBNrBEM0rzI!-6SDEQ
z0o<MPZYGv_>KjZ&DevtBSyQ86Z%Q{|r3NEpQ{LyWb*r&?fd56hM}-J~NZ3+0qxzKp
z5cVq#ZA$53vIwLtZ)(v}KH@+Rs<ab9|M&|$&xKVNW~!7=C?8Sj3h-yAp+75Ch+f%$
z5#TCyA%=3wmxOE7Pw2gruL#$xBrL5`zP=7{gPOp4zaiYBZi8=9z9ZbK-oP+T`JN5m
zr2a|x2f|(IQ^G$I-mJbS{1f3VDh}bF@-yMBY9QfX2ya(|2_Gc9!yG|a(~0cVj5p!3
zWcP4f<DY_}n$)JJ=|nm!wVBS+RNEZDr(TyyC(eNTQ(G!<b*s0~ajB=Tf(txq>rlXF
z5Vq9MM*%)_85-cnigTrwde*l{BDND#e`h=K2RJwN96BznE<&l)R@;eREd+etVw9~^
z;o*SWXhW4|v{|ro;9p={`e^_gjI`lvu*Oy=Bw}5g*8`F!2BrCFgp!KWj$*}b_0nX>
zjEu*k&!fJ^ph+9W%Iei_L`~Z0AE-{fm<u>ifY@zOmktA5NSRg@Sq6BlhJM?m&ZeFs
z(z{d>T#!~wc(d{?0$h3x#?KZt2eqdKN#Cw^(Y8<;((4Yj9nqXNj&Qf<OC+?k351pI
zX+YLbo5;m}K=%wC2V~N5Kq9*5X_{BQ6=Ds#XRRB^WFlL2&y_TADl6&MJs-pXnMR~X
z_v~RaX0RFib<Y4eC@o?FIiP!PTL5Gx5zX*Sq4l%bjmq$_ztZMZ(^ZDYp9f?v5zFwL
zUkGF#k$~apAW}&rY<OxyK#nF-2?eu(%qLQV86#ATo*LAGy5mO!tV}Qa8||po(nIUu
z94&3l(iSa!92WtWdMu0%9nUWFt2iXB^a*DG4yamO(<dH<Yfz2E(ky+_*Dy9L-I^X|
zw?;H$em-hSexEf>2k7>UV;`sSk;pUtxpdT}PBzf#q7xIzn@EkxDT5#r{}RAT@0hCq
zt9gif?^rreQ?VG7-lALS81*m)w6~-P9&@YZ=nHSK4K{leW7Hd(4;f4OpvOCoG3{5+
z&jLK*EYJfg1ebUx+Od92CE)3d<FMG{jX3syfRUb@dL!+54WK{u*mr6Fidrr8xHr&5
zXBZw&&nlIG4oqD#07Jtg)ux_E^_FIwh$NSswvTE?qWgoXb0!XmmX)5=Bu}NzV-wwJ
z_`b82TKU~->Zz)M&Z9}U6dz4f=M(m;cj5Td1=JtVjDj)HpFR^h<9z`4WVm+$rkNQ7
z51E-U$Tsu$2=t8PZkX&5l^LmPpm?kL5@j;d2yd5O%<#|)JJOb}TBl_U{ZA&ck@pgo
z9mcsUR?pe(y#r0k7;dB4yEWq~6iD{GN<%sT)?{WcOF~202bnoER`Z@!0eFa`L3!uL
z0`)l>l=t3wKplmHmA9}QXui$OQr?Hg0WGl6Oy#|hXrYZ}D6fZQWxWxrdzCkg0gzc@
zb3H1fZrutkGiamf%DVumE3?c-)0B59%@}8+smgl{f+KUhjixB?c63_iL>o<3-kB5*
z+vp(W9f>ApPO;H}%DW6nH*=bex|R1&=|E@LXp-{Yg`}Q2%SIEG_vZ0HXWQri<u%ZI
znR9H^RNfa5shKC+Xn!SPow;`ZAci~V&CF)Tf=4<l^E7srrB2BM{dDFhzv>qOd=|4_
zrDmKp5?$k616$))1Kgc?<;#HWuDMFO#@4@?`jrf`%&T|8csJuH^LoaSCk-zNYMD3Q
zj2N+0LNV0e&Q*$E4aSt7c?YAeUNioNgqfVNmsLFnuqW&E_Xj#vWu0MH6@zIa>rCc4
zr5F)eXAzdFvVJ#;RjCKysjSwxwX7<P{>VD_SipXD5e9wMd7}a2I}q?qR$DFLpycwb
zjk_8+h`;C$`UMQ-h<GQfo!+UG`6sJ`$*f97Tvq2A#AJ=)!a3^_u8Ql`LNp?)%ZIeo
zpk9Y$)}<UaEy|h)_;SLV)Lrmw))id1Zcbajezlf$)yt@Ni@Jz<{y;rj)m-YihI+QE
zcQOHA$Aq^-dL`?6_R3CmVHM~%FoEq+F(rU+Vvp|io&s*xpQPiJr`x;Zc%Zim8k5>B
z!J2iOpn6KTgmTvHHk#b+9R>@t?y%88-QIU;(w}W~V7GS_t-8xb-Q8Y(Wio4<jV5(_
z&qcsxZMV_HZm*dG^d1`>(Cyuf6qv=;HwM4i?X8*s^gcn2e%;=4h~96bs@t1^K+Jm3
z7LM=MjO)Qp&iZs9g5vi8J%h`#5ooe*8ys4Q26FRjr8amRdrGO<2#UeuIR&{jV`(AE
z4juvd_zHlL!C?tfrvJg^|HOoVHDwXt$<(9NH|VLsQ}2f--7?h-o<`4mY@O5XX^m6F
z;K(3&-miKH&!WnJx@!*L*@S~$FX|fXjK-X>cULyhxkpR$v%_BY>EL-bIymfIkB}H#
zX`@+T@4#_DkG9dwu=j6NJKsh#!kTf-7_=zoM^xidI*dq`@RzyYr8tZXA9%^uVDMbZ
zM+q(&+`NFmp=-Rf2-|1N5J8$T2_2Pv(kw7D8BE4gur0^USTd^6^qiDBP~+E*Kx=c-
z9tNDo7k6{g=K<8zh<u26NLFew{GQ__>{c}>pOZn@qdq}<axyDq;4_`)WDy<$TaE+Y
zSb_1JW4#D4{#byXoMAr!R`W|i9!?FKdIhVXoIJuxoe59m_$h+k%^wP6Xgs>zr3T=d
zJQNo<1rJ>`<26L8<)*<#KTP#Q2Cjk9Eca0Nv5-#VuIkW%>{>ge4IM<Xf<~HYOu_<X
zXmSuFl*oDk_Y5g9Sb8KYR`X_~bBE^G9TcN^{b>47%SH{&yB$s(>P%X?<~7TK4z;<_
z3UloWjW4KZ*h#3uSdCur$)>V#1?=_><UWD1gW#ZLFw3R58p;afy2~-{)DE;TcOcbh
z>gvgW2eCc&V^MB06OUVlNN$Rq>d(M%%uQt{`!!=PA|N;ICkVL|pAU@L1(<9{ErDW}
zT8?WH6?5t1W@+)7Tl{6D_#s(vfk<}Zn#{$OEk)&hL|ux@F{2BUR(dvfR*YFw09sF@
zKzu1cPx?@<0%ayi_x%~5-5u$<KN6J1Rr)ZB@CafD?#4yXm_8y7i8lUBfbR5>TvOVT
z`2;ofz;uX=5)CNz14?CC>4owX!J(c$MtqjWA8bh<E8SohFQSNBT|F8y@*v<raXyn6
z?=AwVBmlNcaqVmTlR+!{M8*rCdInvIYy3`JDm^Kj1=AYVt=BxMcJHuOPnuoRkJ4;T
zHEy+^bPr)H0Fe(o8I-ZaGEXL9e_GShm6|836`BJw$$AD;eNbIc2Kj6zs<1bL0QWfY
zl@swcBQQLEJKVA(-WfB2j<nIi5$~;d;_!^J(X5D9!$9>!*GLgB*QB1&Ha8>U{qqc<
z0UPy3yg7M5ofVWP;!UOvV{C4E#CsmmA{$MMcz08{*hW($X=|I;Xr5Az!U}ki3tE@z
zK(n&kp7KxWF%g)|G;GJSXNttLW}Gkzil)8<86$)g?wJvThwFGBzy{CU?*ZEn2=n9t
zAq~IX<f-H{hf+l&Abm7px5``$cs^l|%u}9)wq-e%tV%tLY&6^QzQ$6=*yv!(+d3cU
zVjIn}ypIe9T4ke|Rt6Wlo?~q^!%~5P;GU4}<uu`DjrHu^fGi|DCo#T)Y6E-vWVSP`
zhM-ZN)ogym?&&q`=_=I-_juN^Z8d7?NWcvYXRMX}kq=~MEGlrRez+!459^a)bhCY$
zQ9BJnvqy-~Xk3#gQ9v#X9uz%*TbAF`bRigN{P`+RvlNxN&~qxu_T!T0G?_>22DGpN
z9>uk*=X5sAf-06XzGVcSF%89xsTl3U+_wOX4+3-#8}uTz?LvkcmQ2tdtiw`-3<X@;
zWci1?<?;DeXd6C|jn&jGga<LFC`oX`lNk_hbrm9bcnawrv1@oL?Xs|GhK0iLv{#_d
z_zILfcRnQJKLF^-8?*$lqWZk#L+bNHjh$%nQYpejGX(dnV4jx`=i-sP46?94Ux?zF
zWZM?yWzix_EXo@!sZ}h>%cezm()t=6$jezyeQv+In+3<sKycVClxfI6XfbryY1^Mn
zk$zeNXQBNB-=!xsV+FE?KjmIqPkL4+3jBzK?e`G0hl}4Uo`U&9L31e<H?As$P{xle
z=kX6-$Z`XzD%&sR#1?tb!o2$3STL-yU}RbTQ5W^f7TB`S9S`<slHKZ(YQO=)Op#P;
ztVFE(3#$RT6nio&;6LGQV0L{=Xq&x?@SkWuR!ZH~ggq)1vys0>5*}>E!1gb_Ni^|s
z(0Fzs=HF2VgzyWlNu2NpWWkUh#W}xVfMgVqZ#0$z9L=dFt0rU2X2{6KSH@V@V^8}T
zMRpV|K$_1erie#fgA|!j`YAL7)Jqut89}NKs&Dbsmr>>c9F`}aj1X&#$c9+Pc-mX3
zPR0bDF@f!?(h{h8E5xIl?R&6;kTKB*%3w{;m{E@8Az3^l!UU+<&(kwGl=i4AFtjsf
zQDm<KQO0ZrQMX!)wO>XBcN==t_cU%UE8FkoE=PvFf>fRZ-g9Y(vw}=N;H_sVX9byd
zz}s8_bb+0xQV*byXr=K>E~pFd1?W=rQ2+O)YTAery%t7f{{wJNIU+thVwL_LDCVL(
za8J^!=yh}2I3Op>Igm0ZK=X*z!f~66G2@O{BOH(U5-J|CR?1uEx`9B}iJ0H~67e>o
zLH`Jv17;Gk?1)pOOc2I=2x4Lo)gX=mx)kC5G-gDjzDg*l5rgWe^bu&cnlS-Cj_M((
zsp*h9$~&556s!{AZ*etlm;pwH0>h<>am{j%bg!h?-{H@Z11DjjrKyV$Oe2#CE6tcb
z3`pv9%7#aJ9_*FPAn3?u30cJqf~cebZpf_BMrL!<-=k^}0V8wSV{8}o8Vj(19XYHK
zDvUOi%6Gp8Fn&EiPyQhO)~mVzuE|g4hOV6~^HYQ@Ni;u|bf&4@D3)dAd#A9-^=Nf|
z2J6w(^6`K(2`lv&76bXVT`G*`<Y$xa!MhU+faLT;*{t39Lo+N0(+~MRx<pg|hygsz
z9xAWF>ipq^J?a!cU_Z^VBsJ!bAncd9HvcG^6j0BGA(Ky)5p@sil<nC{S>xo7=CG-f
zHBNqjaE*Er!!Li#V<=m%zCcgr7m>bIm9nm4=ECjXi;e<Z%1)2f)3?iL%rE0;+#w6$
zd>NTL;T3wrII|Mc<L0t))~H!kutc8ON6qH5HqL-C_(oOmS=-LLqwLL6Ec{Erm^%{k
zh#Xvv7a*VJZ2}no2*Ap;!H)r!>eI4Wy_U8fU$9KektMlm!7P_%Q6wnydD;-lgw+K;
z(1+6V5j?<PyrpIChLB7B1y`BF-v{89i)eMJRl@&Fu3yWQ442}3>{6~FyuJyAMjQwQ
z{&W!1zeNmTd+&;kh%nh>DY#Oe5!I{XAS2s0_C|WaW?9v%FA$vt*KiHtQQT=R_#<<-
zrDEm)zFzEA*G~j|1NXBl)lMibxRH-=^=dUHpn{u8?^4rIs^CwgZ&k040emazd(>_u
z(1NX`_jtBV1AIGYd$;acO2!>TEZuW0YrB&OcFa%919BIUu<p4KmKAIxQmK2qNO%R?
ziPY$x_$ff{rG*W;=SHf&k5#tlo)=?)+|N3@bkEN-fIPr5J9JMgy1n2*BD;0Ztw>A-
z4|4-}ukLvRqrTt~BHg;jfIz{cM6mzP2fc#Fi0s!rOt}S5u+jrM+;0wnw=ZT5!7JgI
z_%i`^7d(Bv58mfKb-^=_0MrzB?FyciPEkLG06#Yu&3D`0f8O@~1N7jFge{q}3SMGD
z_Ny<^^#v~z4l1$bue2qi1`Py#4^635$%J272%S|j7z$o>p)YIF)?+PP@Y=bE+f6E|
z7&32AezR&S0{kZ7EvlLD-;P7st@0RF@OPST53quNFywZqAT$)b#aVZ!ier?#!?L^8
znXLC+!h7s!dymn!7q6jA0wZ)g6ycN}*JS#^EzZEAAFj&s7fhgyGAauu9vYPelMao_
zf-sxyRx{^ATRB%rmMTLcFPKbtsAkmA_9;(7cb2DM`Yh_>F;~G1mecHV5z4ylax)1J
zQjbL-GmCJFW+aybnLQ9?vw{V4AMe#6ha`@U%04=d?xSPA=#V|Bf`x1yb|Kk~i|lTc
zE?P|Y`0XyLT8_@ds<3-8gpOT=x>8g@11I5BKFk-K!t?A@>CHx=el!o%^-PAT(oapX
z!_Y97qMS>y!71*7vqylKdU`*I{*DLMsoNOL=a32^QnGdwoG=AFYzN;G4h>EA6$?(}
zV8C|lRFqiCdV)$6)v;Ju-N-Rg&sJ8dpP;W`72)~nV-AXwDPN^-M9M5!L%1fbSu1FM
z9#+-Mgj{eMQ+I<Msx2(pXoueEgqze2)P4rxQ`4GDw1U=tsG>#PMf1-id6SZ%xRDXx
zWk>({gg2)(HLcbPF5nUUmW-z54O&6FJu~Fo?EM52ML~y+X5VaQvWwXXTjhn0f-ZK{
zcI*maaaC~XXjF+g1I|HCh2<{A5Qxvh8pj$v`8LqyxpcI=tzqZ=(Nh=1!hgz-5jA?+
z8u-$!?wJmFI^h(xAG6u$86zQsS@sPNkVp;m7>mQ``~^<{jK38#fT!^Dp8zWh<`nK{
zQTtS<@C(ARGQ|{r$<>ciTzC~8XaXJU^aoHlu#kF;MpPA8B;a_A#lSHFF2Up%SS;XB
z%%*`V0dGP}1IG$@rv>mh0iQ#>296i-%>cj?1pJ(`O9cD~?g*SHU?<!is1|S!)?<Mh
z0hcZUxKzOVjsdt#z^$18m$N0twa9pZS^@XNWr3AXp*8V&GZ1)%ucl&(Pg}oMD}0UT
z@>roqL6x?4RjpR|I?K6jC%r*9#dge_T#$Nf$NY_SOEZowg7y{*8gt%6IC{pE>1%*k
zwc41F-ZhOvP3s!8G2`XUSY<99qG@9$3SwGo>sD%GCJEw}h3=TJAV?8UVL}U>-U3zG
z?HIYnj|+jHv5EKx5#VQ{2Loqr2A<P~OZ}Ls`e(RX_|fAr(?p48&7ZH0nXa?7%9^W<
znIWKM&4oxr;GnfOppBWOUkN)aZ3E^=*&5AQ#cn?Pdsgt^6gF&$K57IiI2FHUJmy55
zv94K58_|Gjdp&L~U#5+z({F(;1kC6%6h8-V%4_ifM&;N!s{o5n$Ij)d&W`J`^Z1OR
z<TQ6|rL6ok<7W2mxlNGIISuZrDk{}SVt`rfoT8xJIP=S?npOm7LsP6d3lU#5P7q~g
zjRIo(+muEXO>`a-xKb(#>tD@;LFSiGT{K1K`!1Hr)8V4&dOi@pnS`2)BBCu|Rw1a0
zX6Y5+1kEz^N>PO%VRJ|#khyvTI1%$YjO?OH@kFI&e3OqBoL6!bTCfjNTZ^92UC1!z
zH>~qn{Ztgu%;hHlc~0LFfdkBcA<m0-OPy}BFagN(f}~jMR-LL9y`Z0qG9HWYivs&C
zo=_LPq+bdKIubiwMK4Q{D%+U9h%q&`Z~iKrdfOd)#2pPL_vMRT5wR9?3DyfmuZmc!
z$zLccdQFfG=AF}lye{=@(u@+gI?y%{t%<(@!O>E5^Q(a6q^jso><zrAhap*Xi}Z|Y
z!$2&OH|y+-QnVG7VsJ@U-1ZN&-J@=0ZMT09*ius29m(h+zxu~)(C-Wa4#@F+(Vr<F
zRL5b7U9@cl=wbB`{eJfqfFtUfv4HR6Yf+U-!sCA0P^+XrA0S+>ve{`nc0j&CGako8
z6xi?%?9U0Z$BNu~8SdtbY`{SMaY#AcG|1^DCdHx@C!7utNfrNj%#+yAbp3ghu}o=^
zS7(#_nz01qC$MoUG{<kiFb)=Nyc@9Xvh!`1J%x}jy1;f>7i5Yy5mxE}n%n++=)v0q
zjF$@;E*|wV(rwYzA;6Y85&JDgf1tcyolVQHc>?qRUXjI29=PC9)Ro;@f}GI^Uj;6F
ziMTlm#}iW{THvC$Xx0-5|E}T-cYvDKu(VbyzJ%(qh(u=>cM*<FYtV`>{WD@srLEM8
zFC%29$l}YJ!1t&|tiOt{Al*_WsIK_;g#D5(i?5`PfVv0Eu;QyGp<jb(r)b4jQzD#p
zl2-f&LJ>6ygSz+{&OepvXa)FMma9@aa(MA|l&Mj4Pw^i~uUGuHSc<RzdpT$P%fo=T
z{IP=X+t5|TH_%mx*j*TOfzGE#p`F$6NTj%Bd;yxl^+)mPG6Sd|=Kwx49c7ie1sz#@
zRtaFYN=Gs){#_Gbk3?+oxs<Wg!|9-(N7!j!8|?`wW`W`jOld*YfOUKE`I{jVhN~Bp
zYk^B<px*eINS&KX{%C?NzAm|mWo=)V+)Q68Rf@GviHs&U{9bYkTke6!N^T`&p$AH~
z67q}JOKu|^5U-cqPB^H1@L|avgu`i#TFIS+BGMNne`bA^(ibJ$*cUiwhEGejlU^e}
zExDUMtrwq`+~b<dB@%sFavy!#su@!-)B;`UXhZxZ7D|<DxDT-Sv}B|0(_<i6a{do!
zzfz-*1$;s79Qt$|Mtezn1h7Y)n+v#OBVbE>U2@3|z<%*{$)zs?4v4QyE+ZVY?Z12t
z><o*qORk`=BkK7S=($pZot3H{iLB%r%2#Pa=F{(&JwZEvLL%Q<y5VuGIK=Oz?bKuY
zz4Suc?~I|+j*sCJd$^T$%5Y0ttCe0%58{|aE4_q}AFm>nb`c7ohe~B+Fs4goWQ5hs
zqoC<>+v`^nmXT4Z{)NaXm61^;o-VzLp0=a9bTch#kXDvnO}I(zqx?1Or55!a;cE%E
zsyK|y((4FsQvHw&N^hhmy3{j-Z~7MW&FV?QHxu5X8CdLUfy<vq>*LiB)Ka?WcZE)m
zl^$dFSRo>_bn)A0lTvq~mr9Q%>{gZVXzB5UJ?d#>*U}|~Ej1QdqqJrq^!ugvN|#Lo
z9FX2Ctve2IP<pR)CE>8$u2pPTM0&6EWZGP*jzK;zZMqyXRqB3>pwgBn0oSOB$S9@f
zeh9c;Gg1&Lfj_jv=A5=7P1_wz)Stv`Y<`M%1(Wm-=RvJ`O*{~{{u7EQ6RB4V4%Dy0
zqR(yeF*Z0zW;Bn<a1SO6l4UXv1XJXVc*|r$38w1o6Tg{@`h)2@LnCO;Vm%%~!e%wa
zyfO_$%sjX)m?21|S(XAMQ;;e%-2##&NR2s_oWc5aFsI(!I1os-{xPg>FlV4sf;svZ
zKw8YPi9jrU5c;mw?1E>4L-ax*o2<3Vwct>_6mXY046|r3SFZxH*?bq%Sa6trK9DV@
ziODAD*DnIH6~7|Yq6LrAuLZJGGs0YxUGoyW7XL3a+8w;)3&3gt26nJ(BkaPXaeu&<
zPG<;U?-G3-xb`Q=<a`gXCHRc~GRD2N9KWs=d`_=HyB(MB>g)2|j?2Z%_A16B3y<In
zj?1O>FG=eyYgKK77JOM>0d0Qs!BME+UaSPnFOCATN6HkL=d;DH>K!mMXr4>tH9^95
zi{FqIM@+1Fwcy|MQ=qNJygUqKuYMYkdh`2%K>jYXHKzWj#-VN3?L~94JCQbw)1WbM
zeGl;X`RE6K@ZQ2AIN{OhD0JVskkHgB6R<2Pl$wiZ3_f@P=x%jZA>c<jY2n!b(|_<W
zhPb5}@1QFKTgF3A{4UTv!RyvgXEvMlN5-h8E}Q`PdWNWyIX$>#8Fk_tGwAui4J|DD
zDJG<@vWJhx9H_j>npXBG_2bAHHI_Zrga#|M9-UP71b*2H_KeB{yi<-4WqDNg^fjPc
zs?7uXv-bn`tEPp3cl`r!K#d6le*SyFLA3&@q3lJ<ht<c&0Dd`p0f+0HRKR}?0<Kio
zBlyc+SqvBx2i#cp>M4M0)XourU%M1=y)4(tUZ<W0Npodya7eYtL{s)A?Z?FY5gZq|
z@dUIh{&h6;K-nh)N|BuTnsnKxS3wWHf`Zgj_BrL1x@<DwFTI#n-0E5Qt?cWY(6Ju1
zi}iln0eQ=A`*&=+U&TOK+4n!9Y{2%zPqZg!`{5V*A#92tG@Xu!nBoXSrza{+@kFf7
zB2}ii!lly}HKzDN>2yZDDbDDp(;E%uNLt%p%Cwl`8dIllT21lI0G-a+Bo7;9i6Yh|
ziK)!~a?NIQC!1v_rfbbOw5}{wXCt?mw__zzmabn11zXMU13<hoFt(fDAu*L@3UZ&x
zR|d<n1leKUj$vFjSf|H!nvWu?%W?$SZ9Xs($PoQHsNQ34Lv|?hNtwN7B|CJOJl?%+
z*2DwJ)A=%Hx1`20zof<<d=m>A0(X1h;_OqxSW7NgP@x6x@dF>aH6QgEp%rm+;SQ5a
z$k54g60#=WbPuf&B-Xs#0<tddrX}cHb3BrD=+wABGcTE~co+(`2;wo%L8yk#5X3US
zDgbhUDDay{yMeR|l5YkPU!e=*CLag8%m`W@x?DIxbIuqbe-LE6IR|4hbgdv^(~HK2
z{wT;)le=i4ErLYMLCANZ8wIH_8{wePO>rFUmFDsAS?K0ChE<h0A6^LEB4Rb>Efl*|
zkXrMtSRl8>F)P%YJR=I-&i>RIEDY7q9dVh<FdVG)W3|woai7#8M6B9EE%fKOJ6144
zp2VstbeE{=GA&kecie#!nd=WM26C@dzs0Iw)ue^)6S1u(hkfY&IL7{V^A$Gpk+>o7
z#tw5Uo%X08JI$jh_N0{AZI&efc`EKxWT!o5KX$>>ajzp>_L_VW4m}&U8na2axq@Br
zyomLf6Bhw_LB#f(*Y*eUl87Dfae#(ii+di1YPwI+pL?azO80d^QRwe+d{{Mg-$O_<
zp||4xg02tfzNb)Q=$*J#oQHH@H{2ZhKnx7)zPH&$AI5RCMs(jBbmV{HcA$nz-N#@L
z?Gwo=-B*sW6Z%-N6LjB4ND86P;_ik!Yjj`MbYNe^Jy?z2(0!i-fqfhI7O)0Am+2<-
zLmXerYtell2EaQgT3U7A5X_h%-PME!ZPI;Q9E1!PGg+7Jt3ZYh#kwAcEnCn&x+u=Y
zFyE^Ca*qNQ@4}p-ZP$GT^h<(ZJ9OW+FtC22b0=EFIO#9tcI&=l8L9&Wdr9~4G(D8)
zV%Y4_eRpyo4RpPQ7VXu2x6saH7sIey_i>FEN^x;H)ua2q8wD&=wCvY?16X^uU|;J#
zet#%r33fpDeKiT#P}dL8iMRRmfxvt&Z6yYz;d_>`G0epXb{oFwEH_-rc?{nM+UXZ8
z%kcfkU^~ji-5bmB9ZQ}0QqFJqnv#Ky5?;XY-A*l|g%>n@-9BK&(uT0%OTrWrDiO(u
z;cKVPpvwhYDh=PZ6ks9O-FS?sGJH27TtnleT#ey-i;+6P^&jx+4c|s|PH3X=8Vn!b
zxC~8lN#7d20kk?IwYM6+dl>FBU5Ev3li@o7i8VCGHL(VLYxu@e=RB8*+BX}%O{0Mw
zBmJ<&@cos2TP4`dhOd<Id7NNd4d3PT{BrTjo$v(9t&;k-8@`t?&xKAB$sPED!w!UN
z;ND}AB8M(UoNO^dEio&@7#){ekUKqwX;HJs@fk53$I2eZX9?mqA7F|&JLWEkdCYeh
zr@xE24~S((7>aE%3_ia(Y7USMF?@Inn3--M8wClP7UQBLW(~x`W;PS^r7=xFBId!t
zK(2{-9oj0*eRSxxG5dj3nP;-K*TtkD=4;Gn!$7vh^aH0}meirUMcWnTUW(lpQvk8e
z=GB-ELifioQn#2MhWn#2Mc`~Tw~_ONaJHL6IGmn}IToB9=5h0ZJR8#jWT*LiI_~+H
ztAOm5St#^U49DOevx{N>ml*ETbX#j`i?z^S1?e%DFtqjvvfuoM<M!1UPNWBXjT3;p
z7IPi6X--1f8^eU6oFV;I42QJa8N~04A3e?>{y;Fx8N~k*fBAJg@%=l7i7%l0BzgZw
zToKfLlD$8QVfGH|K1tu7NRuN@s{2eNE1iV-c?^g9LMLJFk72^B(tQ&V-JvgIm<C&%
zg!xSj6K1RKlf?gB3={t*-6s>=FQT){Ng=WPYOi*M?z@MP(Jz+Iw3~I`DfDYnY<jgM
zumPFC+_CJYt-9|`x@=G^HyyVlO<-CNB@4C_R!;|(BG?|?m)8$iTI_6S>DGOG01OR|
ztpnDh`+j8XWQ)%Ix^FC&Frgu_?cg0iYccRbKH+JG?^+K2yjUhMW!UN3AIo&@Htcjg
zDwgRQsmEhNvPfEF8NS=to5ivJ2G4K!j-i)I1Pd5GzK9i?65Fo^(~9BKu$m1`llsDj
z?_17WvtonbMGW7GoO0$0uhK~cN5@VC56NZ*#!+Zl>}p^&hVMA8Oje3yy)(eq#4<%T
zI0JmGSk~es#l~1B#a1UNt{2HoPEu?VUYC;;n}xR-iD3cE4&2`u#;SP5L<G&af$ss9
z-NJE$I9ly(mT}2^Xjk&EJuamY)2mw^w#TKm0rn`)%;VDT1Z*iz=HtAC{ffKR<77)e
zpaxUM;`V+}Gx{S)0uOzJy0XtgRx)lvP6<5x192Wn88gsffk*qHOLICA0iN+LeG(A!
zEOhJmczLeX%oar0c%?sjGE6fQ;JWb%@|1=rnr(|v{_$BX|9uLq8egm5!t!4t@W$8a
zzo3X_rlaxWSIAmanGF_@m4cY&%t=7%okz=N%p>Dh3CClW!n*M%36cdflTghQce9!k
za^aNm6|!VC>&8NAj-Ioc)y#?qGFK2h=YB8*MV|c^i~J2$x+mo7{gE84^(Si+hUwn{
z)J(q2Fd@%2Ov{;v5!5hon*KI;lCURE*H3^SG&2vKGBKiG2t=9bh`EU~WoyB0a>sk(
zEXQW9JSWb!ZI)-_i4}ra=EX>66YW!&T-nv1I9E7+i~pME#Ch@n8!$gWZ%nMze_`L5
zt`R_v79=d0c;b916EPn|&re(+I}nxTs(C;b3Q{GBbmAiMO^udw7sj78VT3f+d>eiP
z%wFf=BpYdD6d_cS6sn8A5n~`Y&c|JC*&rO3`xrn?Jv|#D+?YUAZa)g}aKdi2V;JB(
z!XEYf7{GqQmOK}Z8zEaQ_IKsE*mU!PN`FSBF2y>M8P8F23t;(PJ%d?@Zdsr(!5xB7
zvK{<kO`_@^fG)K%jHi^zGv{d&KV#?i&t~5g>;C{VnO=0uh2zW3fhDiRyQx4fP{2|-
z|Ab`a#Grn~RP;5UW+vK4P?~HbO$_NWD9wMAfHO|N7gBEXWkl}8@%pPkJm&Xs^u!7J
zCqOK7JZ+dL9KReVO`N2=5jg>~JP(|(J`70EO!NUM7bI+Q%ubxF&jKf6yF#9s<kD+6
z%zYY`x)kjcf3bGA2r<V>>%e{}%BDRwn>xVROO7-j71<o|jgWqX2xNH1BFbr|$bgsz
zSPD*!5^Yx!1^X{z)<_`z`=j{8DS9k!E>#&V#*y>C_Qf&?;bkdkWRB5z<|uDJ>e_HM
zrbgclJa0ZGrZLO(cL=8z0j|{z<Si|k6x$|gk<%EKk;eS=Yc^5T#luyX`T$6LDH5Yq
zc;gT#QyeOVH%3Pa&xdpJ&|98DT|WVQs}7rXg@(=;)%f%6T49WAAu5x*Nrka8Ox;@l
z@tMHl^gNX5|8p$hk$My0><=d3?P67!Xq+<x$(tFVFv(yK=Dmv)R_HcvK%nGpfoS1C
zk;xl26!0K}+j)5x!UcuN2KUVJu1W`-Vq8jiHx}iEsRp;5^3FjJ7p589mdsm-<`t$J
zHxZ6OvMBTzw-G*l4q&gbjqnVl$-)fde!_pG)tSa4g#U)TTbN}$N%$S=A8hO*`~&r5
z8!r=nm@UgOUL$-_5U^$Z9k8EYCM_Ih+kZd0s&Kdsmw;KAXS|0SoPT8=uMf)gzTt%V
zE(5-xB9uXL9V}OV{n#a6&&Nyu0xy*7Ou1IewOOvMa_x|7J-nE6Ss{X>&@=`h!^;3K
z9AGd^G;`bx7~?lihm_L#k4^zL!uSwGm*P%(&VPy-7Ty>h%1H_ZYzIb)D(Ywfbp-pb
z=puICh{p9xwW5oKT1)WK-%+5pUMsqS@9K}JTdoydbqOG-=kbM0@$kr{cwCn~20`yq
z7lMm7*>O$ec_O};gk@U%Hl!&l_#Te{B|3xeMWgc;kR-zSgzx4BWq5e&QqM+NJh2p(
z{hK9nQ14RRQ8v$IZMH<TOC5}IM)h(CLFHK75^e2XfKoA!Z0(W9k>Wm-w2f?_&On?P
zmFA)D;nIi7Int}6(mc|&O_NdGcWD0sESGu)*F>Je<42v~E-{E3A8xsbV!23fyA<Cz
zaH+pSKqUE^fGsKWjYvA)`93PcWtPaG;9$T~kbCKNK|<g#vRrCRl+V`(Z2teSdp=k$
zbr!CPe0f5C^n=d>lIrm5As9j04N)AwM6^CZ(<W^)?6}}-A7a3pkm%z^F~64v{XDpH
zse2(M;u>agH_xry0*PdQ&>-W&Es=Wh4JEn0A1%als6K_Hq+D3iO)koGN||&ZQW4LD
z+*A+N>?m;)iQ<SuJuMbXgpdpAi*ZY|&8~?S<cZPY1rMok3SJ$R=9!YzZ5NT|I*EQ4
zST6Miu8BM<bg8q&Y@RiV*#j$3lozmGkzr>55tf`8i?z~rM`&=Ay$XO^E{ELv+n!nn
z$wXWE_-JV!Bul-v$>Jl&<TJo>she4dC;0I<A`iGr&Upa@p8dA6I=t|tm7Gfm3*PrJ
zYn7aL8~925`4|4Vdt=|tAGd%$7I!HgmAlj%fTfAqb0A6qxAd%_yg-J!T}lHYl04w;
zqg3i}G#?d};lZ!1O+0eMOW!D(8!gO};=>F7wmUnbMR+J2ZQkQiB2SHNJ!{a8J|+*t
zY~|)FTyDqDub~KDz=eDwPw!>?4FM+O@f>X!%j1hYpu}&$EbI<$J{qv9J_?Jts|jlA
zPnao!e-JW6Pr|%oyoQN6cuhXoE>)J#ve=5Ug4=lLWM}Yg(F|TMLVOJ?el4Z|E4cHP
zUZI_~kTGEp)V**w=<xweRaWq&7kXu0iYj^s4@3BoDonNUD-r4S!7o>0nwHl+f?sjD
zfS*Je06kw5R`Me@!EbnCg%@`gg8nUaVm0pt{2hy0>ZW+W2T1qJ7k7i-?*SZ8AE2t>
z4_s;lm4Wp_@JGU7wGj)!;7@B%HiGx^akTj}7fh8fYca~X6kA|?3^xXUc@tnx17g-6
zbm=dngqb)D^mu_ab0jq>L6mtWW|Cln&SiyL9!-P&<k8e)HX%NP{q@&qE%fI^Sc^iP
z{VxU>H1*$sgLhZudN54*b6j&aq1UbPF>)d+^E%+DAHRce{PB4dc$<f`(qH4>j<P)<
zxfGvrbAFFip*6ldh9|bRmU3rx;8GJn%Q-m*7LQMj;VG_p38crT#oW0XJz+K0u8Jc3
za><DhkkI3)u7n<cf$Z<FB&R=oWCcg*k5LDgrhsi*a<=s+>j8alFYAFQ>wE-YW$+<=
zF6Lu7t_eOY&+N|G?jz3Gu5|pPI(yh{*0W<C(;3Jfa{@!+aX~Ee%tRnhh%&z^oxD?L
zF9&2T9DGvN#r#?djqHCeo{fS}iB<Sc7YxAHRp74d*I=$otro)BxF+)8IcKwrjd)wm
zt?c%_-P;vB%66$6p)~$-gsxS#=_!<x4k_DYJ0boBgpF0!{#Gxe-DVhfL3`Qt{{}rf
z77-DD9-wg9t;^>_1K$rQ+sZ{7zI=n|D!YxZ11r@JtuDJA!w`dluZ5M}LD-`n#HLNz
zoom>0ig8*d@7v_6pYcpsb{FY>HH`IbV<-pG@KR&hcGg6v&@|&S?39$<{V_n7Vk2CN
zKcs+fXFy1D>+b=$c>$5f!Y*}wlyyH@tR%|6A<B839Jxqwo(iHMZ!YynRETGvQqoO^
zT)^&*vONo;Y=ImdJVwM)Fe=1@QCkNY;N*fJcJq|<5GSgABH7%W<x#24W{{!a5^{L3
z%fDZ7*g-CJ8pv3SAdR`ydtrprBp4musBdFAI^kuO>wVz0{UQs;^x{JFk6u1|D0(q%
zO|4d5A#eMs+GPBLLUXuoRcbAs)ywA+#-TC7x_lntdX+K&uzU$_v!uH6qX)v?Yc*pb
zhHd$LR%%>_)HwO#$KwEYz`n_sUX7qJRw5oIKNLirE;S0*_+t<=!6}_j0+yG+r(9wO
z+C9i$Q@RLahYw*g<x**d`Wf<5E+gzwDKK@)<%BJ@8j7b}F$HS;@{aA4-?RDoV&0T1
z=Yk&4j0f>BIpwN_K=9M3SR?eWg%?B3`n#ay{LK6_b!dzW!Dm`%$W&hpGA0oIl)}_p
z*|WxjPZrCZst<x#&R1F3<_$fdUyXeX`=Iwhd7#A`l*lQe9Xd~AmAN<w<RN_l5Vsk?
z>=k-g5RW+&V=MHCh*{=lI5+gDAb#_p0`i#Nh%y25%W*&+7bIv-!gLyXLcbK8uvr@h
zvQx@L%u7ZAc~X!{Q(-Y2dP)#%c2V2Y`V%NqV@^Y23_Yv&0I4@WN7ROP>E`j+&@-1I
zzl3&6nHF<h2*~q#0Gw9S4<CeH(2oPM$;_t(FY0Fi=`v5w0P>Q41(3~V@em*{>-PcK
zVtzCT$Y1o~h>fl0$B2i}U-jp~*>1j$zzXfr_W{{q-hq4(dPV0h>`wDU50F>&uff@E
zZXxoTDA;3q`vZAhPsX1AUh^t?^bLIskZ!I2Ui53|H2qKLg`6j<uxlN<QJ)Kg<=ukN
zO-`3EkA-fwH>mK^jTZWo>;$^a%ld(FyC5EO4Lx;-AeMQZ3FJ;e{O03`iO`<~37BOw
zf!rlX(7cKvu}zS$IVm2<c0nR$81WyvTMVc)?}Q^l_Xx63>whJCp+!Fqb`E`gAh+5>
zU+R%#VYM{-E63_Tv!&n4`v|e-2S~r6@AQk%P0AdAQ5ZTPVs6vTIQU)<!XYW<e2V=j
zWu}@hA|-@=lDC&5rkqI|2JGdL6+9k_G5AEa+WY_}gyMvAk;yec$Yn&Jt;;@|NRUkz
z9H_j*@a-oUj!^!@mJgH-f-SnQ6OZ1ZWMc`6;Rt1CDX<KKITA-Ga*~{5G@<4l&S|kF
z<#3?FuR4W>2yeIU<M)z6Lj}X}%7tv0Pwd*O`}qENDA!nr@W5fqUod1t!wmE|4_iKC
zxaAo<D#T%noK^b`?ylmng<pgZjWT!&s0<&!Cgxyn9EHpVHd<QbagHqtjlO5OV+=mi
z_?=^mvBC>D#}-Ax3mU#;544mDhU1mS;lP3-88Lj<!-!Csw5Zb1a{h{NwL)j<%h}mn
zr2uwTDQ94mxI^dY7m_6b+bRL8Nx+^fQH31TgIPXwo+!w953m*5p!00l*0#aX*1wzq
zcfS4@IM@%xRptc#7LQvlhaP!;gbN`v7+u!?lvtE%*T0fd-$zT)t#&EOy5-qGXnABf
z<r%(6?4Y<5bE4G894IA091A#E@*oWWAp(L(G12wW&+HBMu~9a&oz0#G^JF3eyM=6q
z6cd}xW<h(N6NpSP7SdNml`-@6k(MXc-f|FpHY&)h*hjE$)t^y@+L<5w$Vi2bI|hLz
zG7BjqmqSK5GJHqKrAjEtsOFzMf`Ql!IFW92sT%TG_6qVvh*pEs8s*$Z4lf{X!!41W
z=~90np9PqCWycA`he>=F7yd<^`7gkUoYt`G12FqNOsRMT04Qx>;_cJUIp_wke~7Y~
ziu*LtVS7Q9wK`LYtkp-`cvTcXh+h{+1Y<KB6#P&T(qaEPWTa4SOtVnV#MN#(0BN9o
z&cO{4t^d0NAi6SU3wSxx(O^&L<e1li$aq;Tr@+oYS`)*aedWA$6~iMNx0dq;%3Go4
zn9oth9zD&@V@XbDF5dbNohs-1a{L9DU4ZYi=ZCJB_Y=&mUR1xusb&y|+YN%mnxAqW
zxls^hHfI94Nf6T<$;t0#LEPp)Ip_aLkQ8$=`Z{!rARhB^PRzFol4X7h(?eSYvCK1y
zfZQfX?*GNvpNB_LrSIc#RVAcPpb|QJRnkd1G)uE2bV5ivVQYjW&C;EQCLsuD5Y&Kz
z5mAG<L~+4wjEahiil`%w%P@+H+YBly<BA)iGb-aU;xaSnxZtSc@4lbY8U0+}>;32D
zy6D{Zb55Q0InP<^l)Z!Y_;*5rD8IWFqY^oULF0fo)E_b?#mBQo-WTWLhX^k0A)yK&
zd7sfueo}5cmXV>}fp{<_Jnx{N{iUtY0>IC=^uuDQq8}Mq{{RM;VhA$SZ5RxSdy?*A
zc4Q1r3TK}7%utOW;)w?yv?qy3>KL~q^gHti#IKy$jp6CDA<a;%^*o+q&^p2-^=tNR
z;(^Cp%Wf83+YLb;PbB=xQpf|+!fE?;EUBEl0-usR9u?3o%zeMr`)|K<)Bl_$_3|T&
ztKuNKgNs5?1+cX6Dnat3!2gMCPQMG!3H;(B_dxZ>cmn+}_i{o&3YE&ONBWfipRGV%
z93sAXf<T8Tz9oIBGJFC~Wt-3@GSuJborxXT+3%fOJ>FlhQGe0zC;UG@yi!6(`^&Op
zs{Fk0gzby|uH?l3JtN^tGX9@uro&Uwi_<YKGMjGWVL`Rti`&F+mr_(8W9Z*>2XVTx
z(YrSNmKev9p>0j_ww0~MP657KN<(?jBAR4QnlJaVHQmby9aY6JWlri>PoXI`{hr}q
zu8N48wi5@{P^?Kc-A_D5EkoOFdVn~jnlpiSF!f<Iv<&z`;)vP+*QSSvqbdVq#-^Q2
zLqdh1dQFcI&r^kzKgw`Al*4!*qkNIN0RyilIo{l<?nP}hJ;89g)XPo4e<bc!=VJ8N
z^e5sT^)IGj7jdt;on`VQ@dou6+IG{^46{#tS_QnDqr8pk_1VDBP`*Q5fN@sSvpnH~
z+Z>qR=P2K!c48dWw1*?f7oF{}Ax(eg0Lw6)-b#??Nt8Ky&B|`0>8;%3QR#due|0B@
zv4=7A-Id<_H<JfCWmmuX1KI5}><mQQ{Gkk1mCaC_KaydrZC{S8HGeEF`8Kzpn*VNo
zyBw8cGrs0e#9N2`%?yx(;;qy6pvam(6>rPzuLpyCCIj5t?SHj^d@f|Sy=E53KjfK@
z>`JIc^FM_gv|k8;91`+{&5CUP(p=hwfn$I*+5D9dWd=T<4EArc08V~0(1=oM{#sav
z8Cc9LeQ##0Kp~rfPl90okuf(88s$J|ntw3yW)}|{eSjKk{!!dEn*r)&^M8e5%uLN}
z{#jCTyBU~>(rq?mT#OMkwXoR~c8?k0eS*!FMa9K<`t=g9bc;LMJ8`}f_PROK8jkod
zp6;9gHdvm+c=`(#qgNQtRK`*3&3eR+(e>Y16NTdTh8cJRqvYlyi#ghF%2~c<pSb-M
zhrw9>rNS`su0!Y4Tqf)zGjL5ISh+Ba!=Hk_H4n4c_Aw4$g-*G7xQv7kn}IWCf{hS2
z1Lqi-+n~59YbZ6UIbofIvc{<V>|(ejEoy>4Juu4;HqQzp%+B<HIUKA_+?J#V=AzeZ
zZWp&((*t*xgUy$;+@2mdo_Sv^Y#TyBt7tyn;&%$}Ne^6#_Sn2eM(o?u18u{=PL+Aa
z&U7er1x!xSwH0VgX)O=keH?WDbkuOm!)zmlI+J)O2Q}%AgOX`^M6l^h8wv6#J*8XD
zcxYJ*FWcw+&;znSo+KG)IbWk~w>*9P3TD;$7s)due#>b>jkG*RZ@4TvLb8XX#&T9b
zfm?VxvQcX}>yWXQ7dR2Dvz!ApATM>F0PABpACSCEf;*+JL<zU-9fP1dEoVAZyX7^K
zF3WiYR<mV4y>(loSFSnLXnC8d?zNox(8!i|9)q_Hmeaue{DtIz<#3+X@>d_838y(}
z5s(A?x=1w5xc~*#!rd^VBh6vMX!(R%bYz;tcF}T>K`%;k*eqH;U55ZV(;T*nme1&N
zVww{~m9}uj&*)BbMx&>0IYhE1&AA39x8*C6o;2r_At3)IIWx^sOwP9}L3-1i@z9Ny
z??}#1L-l<H3zVU_tdz$C!@Ad_tM2h>B{fQQQ4hnDr>7ZJ5PgZKfo0t^`jVcOp-+Se
z3)x5)c8n1yHlNX(`JzoP+yV=z&FYIx7VhwY!Z*D{oUXhm{-&3SRpHW8PBfZcA-2^*
zB(`ZUu~*jqn_eZ(FI>75eqN)gcGUhR_<5c3u;PTi=?&tEYBAKU=}qE@IuD6x+DAMc
zi{E%G+<di|C)v4gzD~@FA*)%<H;Tnc_n&m!aYpkkLX<3RHQy%3Graa?2%z~+A&$)p
z6`JoB;<xK*F7*OO(Ehj%<N-0uA!E?n=q;Lem@J0!JD>$l^Fv}h<?Za|of3dP`O*BS
ze6mE@ydt~#aY>uk=DnuPe-x5$3_6;v_fKX8Y`_?=)jZOAb2-ZED(F!2Xp4)ChW!(2
zy}43IZ{TgZR7v|b%)ntfjTNVKSTnkX#O-`D@F4AFwX79vFas|{z-q(|wtLnfuv%GF
z*klgH8HDCKi<_4)&tqu58YCGo$ke#ziSigsa3%)-&69-fz$w(xU{i#_AWxwwjR<=j
zMsOI|RO>Iu49xRQG|xv^JY@?L+~ftDCO%<wv)F%47Y3s{1c_*F5)%cZdpZqkvvnG(
z31;@rQD7|=S8ZWtN6`pI<vEzyO|!se2>a0t)U)H5Wqpp=VRWanQ)v}9WkHd-fi53(
zp}S1cxXJP*NcKk9H<`V$EsN6>&DpOBH#HyL&)M{Nu)^BnGmII{^^jwG2ft;vK;U_*
z8XDiyOH+p%54w$(bJ0N1IQ|BeYFRJKT88z)RFDgffFDntjR9E8MKnK(?_jiS;BeYd
zd<CQBVn(FooM+3Wa&%7dwThN2IAd`Xb+)B%CcOI%&v58MN6XbTU2>4LWg}W3@F}Q@
zmTQ;@g$u+^Hd?Ob176jIs%^QBaz|Y@9(WV6U-i-cT+ap<RGT8eH>^h5LdY3v(Qerq
zV+1FmE?RD<Cw!)d0sWRZU7Z6hXxT=L4=>#e1@X4rO#`fxdJkhZ@CI$my)@C-rM@0T
z)^Z<%luEc1Kni`3k^0D*_18hL2(NONEniLih=)!KrXqzCKNk471Ne7tqoNY7f}`hN
zXtOi%gMR}{F--iBCQ)zkO#I{~iWN^3O#D=Kx$wCzj43C6_7og46rU>p5}lBL;!HU?
zD)VLFej}NFA|~V?U}P}SlU5B}{*ZW9X|qAJXO)^<4_6Zhr>%l`#9xcx->dN}4Zt~R
zxMqg&-7|u}!x)g2j>4Llm9~We@zmkOY?<*I{!@*Kxe`8B#qNR@P0UL>1D-Mzy~>S_
zPXS1=m23W5KObxi=H9{Q;9mLR$4L5TSo{V`hT?|=VDKT&%R)(c|99ywq(4FGJ6Lec
zY&gjEf(1+U^@8uh(iAM?y{LQD_oIQ2CEhQ078V@0%Y&{IBfR-=I6e>0S~H*t1>N5v
zI9!Abf!s`XI-~nGUkU<OooV4^6!LQu@Oc(+-c7#}Tm|gwnz`_6{8ihU3}faZ-p!@&
zbe<{q4>{_>EXd{lp@@7mVrD1PlaT92W-cM_P-D^lW*);mzE0c_Q46y4HiVg>7_#*l
z)MHkjcNGPAE!-H~1CPAuU9P?U)jh=4la=t9-zYvK{XTg;y!Oc}Ouf8>5f{K!!Dk`E
zw7d+y=p;a_f8lp9z5NE@|9L3bi2Qo5hm*$vJmkxLt{d&=xMhYfkC)TyYp#3+TuxT{
z!uUd7bLCYRqi%ggoaH<E@_2_=SD|quDqk@&iOJoK^dlb-tW`&i11_aJtTsbMePzTG
z)jO2?i6iRgiNF=a)77I@z(a_ma=VvrIIl2IsDl{N`hq_|-k~qNAH}PsJJpA1r@qmw
z?Cq+Z;a4(kJJm)EQhZ~Hcd0+YZ1}2&z|S6a;%wk?%<W$Jx`wZo*VFA+ufY!Z>O{fZ
zILv@A^(BS!gD%gQ`WnOxnPmsv{SnYcO-m2DkBtCLeM!N0&^>@jsBe;XEjj4^7B<qC
z`mjRrL6_q(-xTfY9(2b+dwmg2orC&v`l*^09dyS-qkKnbT6oZ%0lV#+rfI=J_gff8
zU$dt92i>yapixcp4!XspyetBj59S_pFB=IuQ>f)dP%sI;+1hpRLH9alA*N~eK{r6p
z+|S3eSqIfjmd1S6$QRHns#AvI&GuFSZ2N5Qdnn2wWvKDa0kIR!z*-m?zB?aVY4Wlw
z!{#0Kv6D=evhwqFx!B3(*M6vyoxcPwtA#lBxK5B$g!t`wBx{5O?GsRwvD3_18=zWt
z71S(tx{$EV_nBj7nDgNhv44Y1#LhAogGBAq$AO$}-UMrsu>TSOIoIUfq#gD>4DCFV
zR;AN!%K<sxe0x1c^?}a@f?QxmE<mcSz=N0x#4a+IBDio`AP2ok>|&GcI+7M}phK}s
zghkT=2kCaHN%cyk1+GTcVwam@4blRIsI%B_gmtC`67<<;vcYtv4Lx=BawB%7u%5KQ
z`WW1<61E{Na1j(EcD1lg2opLU+bC=s!h|};t`)X3Es(}AuM@T>Z745Bj$LoE-S1Be
zWYFgg=H_0*IFJ_TggV7;6m~Eza661^Y_s{<MQHtLfg<MpCUZG*dpIrdBPup_vpE#Z
zNDq9%65C=vh{siWU=G8))f@#kZ+hUyQD9poe@=Sf(M4dln;#%POgl%yjK=O1w_ti;
z6xlYDOMjvCz~>>byUYbBiEw)0PK?lF_s9S@k{;Nd1$M8nXnLSwDA;ykiS)oARx)-0
zQ4byIfw!Sxu^qZ}(*qAGu!qc(kg~4yfDcL>d)Pb`tQ+yAfjwewL&|#61H7*(_Lvz(
z-h0z4dCy=Br%{+$uXjUw<$M+fPNYzv6a=53F~$Cr5*QoOt9XZY>`5&!%P&i>Y=aSv
zJ*@@lB@iq^>x?~{@=**yv;u-ZrvxqpepcLzDS-n)A=*^zm6V_ef^`uHUQG!KA?Ri~
zy`B;jK=2NXW$cZVARmIusVQ%!1bGn5rC?u5kPE>$KJu0pq-R6$0cH)cw^Kf{AUMQU
z^-fA)LlA9-;4dk`APAPT*8iFk420l3Hi&mqf=mb|jfLPnElA6N;0hMu`zap-Ab6%8
zg1@B%=@6u$MaDiz3DO`~&1(2KC9oj)2(3Bx_msed;PE;LK1&G<2!@~ojD4OGl=r1q
zsyGB+qy%LUoK_9Nzfyuy2sTF{IFu6jAo$b|!IvpP2?TG?gWzyVPz=FVs^s@6feXQd
ztn8mt0tbTgSwM!Yhv4p42%f|&B4(xpg%Hpn$Mjxux>*3hQC<krQa<t__?m+Blpqg+
z*Qon?lNmN0f+jYUjFgWY2)b$LJSl+}f;i2fN(lx-Fed>)W=fC^L70j=FeS)>;0##u
z*r1fahTyY75ZEcfAP9cb06|ttFc1Piy5?ARN{|VGMI9TQ5-13kGhyD8zykq4{}Rj9
zg7h>9*35+<Kjp)MU@Zj&DS-*WM5;q!N?<_n9$RryN>IKrz0zg9I4MCH1Yc8e-ISmd
zg2grj#VLUgf_%2hl9ZqXf-p<nml701u#~N`G$n8$_@D)X@|3{Ym>%G(|FM8Yi@zy7
z@C9wsFkxHL1H)Jn!-Z{24^&g<M_Bith`~yFU~dN4NQ*XbZ+hU~iD09I?N1NP3xSOm
zb^sQb6+K4S!Suk?AlNuzhtdNp*df*mJDeW44t;fOyf9-xU{^a>oiH^Z@DrP0y)f^9
zzzvKcEX)}YSThW)L70C)z{fVxC@eT2FarsUO%N6u5crW{P81d%5crw(I7wJ!K;S!C
z*~!A90|Iwa=cfou45%DN&6}!=&Fk$LP`QC!;}I!=(J{cV{sYCDol~_I<B7imI_dES
z^RsmrLU05SZ!~vb4T~%zfcOL<%H}bN_$2d%4IEDtB8vDFbN^*nQ?_rb1(_;6;U;@u
z2go#&-w@am;3{Bzy4i=Md(A*cCs?!jcZ3}_0~|!eTg;5#pr1DbXL`YA$S5Le1~^!V
z&o(RJGhqf!L4C#J<`-a_@XjeJKb|o8b%-rifRmW`Tw#Z-0FOh(lhS8l>~JHjNxV(c
zg|Wj)==J06!Z3E|M6ToWg>|F_PQVx-zQ8m$Vx)pG0Q4|^q*(&il@?ft-aEcfUq_P`
zI0gBNA7$2|6nfGEE2e{W3hPY^JP6&1FA=r@V~25I#|Z1g7=US6YIa<JJfsCiECE|)
zRwITjX@MnSu;a`G*tWF5^NhXATmiN{O^%$zPmmGM&NR{g_)4=IZoBmOCw@|DJQBDB
zdKK>$wqK8U;wK9`m=;)##u#5C>~Na&$??<8(+~>2F#FhSxUEfD)N*fn<!Bc087V;-
z1Y^)S#@D3;rQY-^ex)jYW=i0Lk07<?Y%NH0A^40{c5cdt0|AY2{JfN)2!hvGJnK_}
zLI_4OjTfW@1rVH#W)r_KCCG<><}rRzN|5JG$B8|d)Y-Y;KyiyI{HQytb!yYu%+&(J
zXgxwtbIl`xrxn6->{UBqwpyoiuzXlf+_g4w*8QWy(OYXXv28jZqXJr^pXXy_WjZUM
zC#^F$7!8`v)FjAEl91_?pb50jA_<$$B``3pvt`U`I$@M(Ym6jnIyKWk<i6kpKG7Hl
zk&h~Nnhp=Ex6Wat-KIk;)SBcRsuy=zW9OxH9?1sNp-#89aTwNTIuFeSX(!oaI!7SO
ztsOLmTTF*{Y_u*Q*=9P~=z3d^B-w5{5h#A^LXw^4Xx>HHx|l=qU8Zve({}XXEtssC
z4)30B?ffsuUemc5BbC<UIL^lX*T<nXwjNJ%z;vcWK)Of{A|5`ooaB({I8cJt6P`mO
zIBbr68_~6{oMUieQ{G{X<>!)HS7}}bJ_U2P)^5#9!LLOR)5^=B;NJ(%?-8}G*1QCK
z&j|2SG%p5k&IVtjxeM-AfS;<l1K!8-JWcZ=@Fy|yY&~7`Lb@})wVD@z$5?!4XrAAJ
zx4UP-^v}*qK$|>i7-4N_y(xGOrtPP68Lc<>+=_InfANu9&fEwnpJ!;jm7izus^1<B
z`E9HtM@3*XTW@Dg`enVM^|w@upn4J&(7KH{B;O@%{T=HktUiGuZ@rs1A{Xel-owI;
zDg&dO)_aL@trK<NKH?5l${O5G|D9?Uh7+xSpu9^RCcdAzTd4`aJ3jEkVyR2V06#?k
zy@s_2iZQ!j9J1w^0qD%0unbsksh&NNe)P9PW=~>XlpI%`J((CUi7!FWvkOn+v)@G!
zTH?2xd*SJ1G^E6xgoaG{6Wb2m#Am5oiM#gR!t!|;ql<*((NRaEStkC#r5V5a0L><G
zKg%kps$d-wJE*21wH~AQ#6!FBY*-m+j){jk=ZYwr@Wf8ysN7ebc$D{5CsZ8_cH(i)
zM?2LvXk+4!46{o<n~~VXscE-Mbxb^^tGm3%<*Xwi+tBG|S&#ci(%ss%w8!0wWF%xW
z8oJrzzA_8+S?yZV;}$>@6S5_pZWi~r>sbPOw5!|W4u+m3{;a9fgX#S1-JI0_6{)kf
zz|hPtegK7q7ku$6U)6dGz{>*EKOC~8KCQJH-Nc-n=OMs%rr^QnofFAC7p1!Z$(=J*
zS6F2guzV*83$sU{JmyS0NWY;u%?s%FRaEqxmPnZa%vs}{D4)aUd=>%Epck)t966dZ
zlX6E6)z6tF>rRN4(OJh}$TDYkJ|IrK;MeEO&AADG6&D%i=6>yG*yB2Z^N6vgMVwCz
z#W}Maq@WxAOE;OZKX5%jjh~0{$^F})3(%St;2m3gS=+Ln@gQ+T?QVwrA>yd2tOS0T
zIHA6;2Hr{Bq1HenVvi7ass(w#j}mvO>yX{pW5nI+3lu=?apE5J3_6t96U4o0A95A@
zBk>0HLo@I$;y(2vv?=x^@g`M)jwALo@fP(g)47{?n_^!Udxm(s@}N*-dx&=yp0<1m
zCZfc<)Qkw^FB0!jFZzLBCf=)#M={4<W%sn-xr6C>lX3$eC#VB?k3^YHxdZY(iPv-n
zLIq+6NF3eS#QsL&N1udXVjr=#f~IrK43LjW&_S_L#6Dp(QPYWHSQh(~F5RY+&(J<&
zv+gyWzc7H$X_q#bWABIEi~U1%*DC8X$I4XepIVno!JmQt#{Q+b54>U+xNL`}n<d~A
zCV_vc-HXA8!MMd_hZNsb1;2O}xNMT9n-2K=`QTq`|3%>Yn!&%(ys*#2-G6ZizTHOM
z37fI+xqPH`=RaC^s$hR(KT>hSY8mVNC+0DtB)>nij1o3G=a^xVbl9Q{rjSlM4jUV@
zgml>l(2inhLb~nUevot_JvO`g*Z?8DwrEg>kPY^QjNT)p&n}68C?T8d8s;=p$QGL;
zg4jSI+w6UO#y02T&vtt|3n*I_V0PM~kb`B+w#(*WikMf(UYoCI$8uyv=YZ|Pz{GN8
zVdkLyA0{;4WHlcONW~V)VAwGOPhdnAD-z~61NX6YII^r3Gy^LKfVsj#rZMOX7IU%r
z5t`<pcRPSfW!#E4no!_*%kd+&$ru%lm751aZT8MFzhJ|zfVqrS$k1BJ?rLm^tO0uM
zEEXLuu!DLz_GFl|*ifAyyB5R4*f4n}X!C1qvEf2OwkX{Q^Ph+&Y*)g##)9T-kO-_#
z3rYoVNT3rM^gfGwq{+k$s$k0*W7-#@bFzV*<R?b~s|eIS`RP+P7{H4$;!l2_b0c6e
zhqFno=VrOrJ$E>qQfgl2b*G~HNv5>C)N722#H!2>5uE+?P((9UuwnDV<gt+XDdVx9
zWC4zoO7+@L(cp|XS3qkWowWwZn%^#FJ{x7VFQ`jkqRw=PDT+-_jdaVy)l5TdN{W~9
z{UZYrWhk26LGO9t7%`c}K?@Y{G;<lcw?PBg{+rCai?A{E6|9>RYms$0o1ZI<Ma>`Z
zfPQHtHbbU2%I1Od*i7-oZwPtt=%7~{A&Z+w0^@uyer4ZhEr9N!en2Q*u2>qQys<gv
zO>odL%r)b{sTh(v24hf!nmo_s^Ml%^0?#)e1TGKMGKC9dmDJ`iB6g&#pBjEyXk92J
zlS<(t@x>J0#b9pFf$vW9M+S2Vus3#$$puv%%u*eU&f79^;KuPGJ{cR2C%a^hhBs*O
zh~$mS-&(^5<+1XXr_`SlWPCq$Eq}j;qM`f|2#&5wU2yE=3(h-Y2cDMixXqhJ>x1t#
z4aZ5k=@ffaHhPMAO)N4;ZGt+^YbN$15LzuOPy$iQI(Wr_SNvKxw;M)V;XXjm2Eg97
zp?fbzkn9-ShH;%=?;f>{_+|H~EvR>ocq+ebBn^wBp229iZ8W3stI_C6+Qx8b7%V&<
z_c^pxG02d7qp5A|55Qq{cMyI;6_?O>2B4*F)l6no&44bn)sBHYp>|XNkFN*rP?-yW
z!%O|_c)2^(*0>V>yJSbIZ36L$vXj&{iMvPLF4r5|QhPHPel0}8+ERNn7=G~!#cg``
z#q#wS*7uXZoxdPuIN*X`sibcJyz;}O!G#MGmW%3dE6zZo@cu7;^O%QUyvbK=4eJ0B
z(dMHs>)MfkWenT;4=ib${|I?D%4a+N&$EWLBhxV2bCyC{bQ_>!w!05ph8o~XMtiZY
z4F}=1mk=v;DgtaT<p9;o4^Ot25jyHMRAhVkB`zyt654Ki1?55c(qemnSXV~-P~xzB
zoU(lwaYS)xqJ0cwjjFw4faOc33Hc;s``Gs&?@%qRkcU_*oi0C(-JaS{EAMhSwQo=D
zr<HZNUtuiPK0$Y|rClxu)b0J-YhCWl643tbwJ!IgdeHvuwJuk|;I;Q}uXVZaLCM?u
zx7WJdC1_afQ+3EiUG5B)#1WbncDYZo!1}k>y5uvN?bEeuewTa#v%Q%XrCYHtX>Z{t
zFni>aS?y7N0&|0^hDx;0<h-FzErxMypUqBXlgv@tu^+|}+8t;B?XASy)cs|^3Hslz
z#ti_T%LcGh@zwhFB=Iiww^6|J=x2}2724Z5SJ*3x+diL)yI;9X&jQxP0ksE4w*5%X
zEe<Mg6nG)$D~A-fSlSm;e%RsmRr^sKPZ_4eUb4ND9VX7D@;eai$FOPOT&i_H8diJW
zA5nj}{{p|F;#^(x$`1pE3l-8DjX`320YCET3&$rkUyjf??un;nY&TQ^PhyUgIvfC=
zOzc(X%>bT4>?jZYL|8I@)qycbd@6BJ?WzZ!Mw5Y;5P764KK)aq!8)o1Ft!L$d8Pt(
z#ZUhmqZRKxNBstAlkt9hEywtd>>tP1aRTO-7jENc(eeakXdgeDMlqzWK&8dc;p`?N
z2M*%B^b?iOFU8Nz&Y*=k8@Z03M|p=#V&fNlfbctU-}QVrw0?m!-~b(drL?$^sLw|b
z!DS9yEMBz|pHl=0&a&fIyjIie=3e}WSDzDaV=mOiBjCB6c{Aj?w)lLTVljd74z?&v
zU@SD*_yPuj=PtRH9{7Ex_@y*|+VaOQdj`fxDcZHTd|n98&4Xo#_brG2(gSAv>N~E4
z4_O1<D2Y&f3qO9Xt~jb?{5oB6RM+?>U2z{40AEk+7j=!_NHq(}$H?QGi9@1(@tcUl
z>INh!ehYC#nnQdGF}}M86^-9YoKORp$lHiJ)W0w)ipz3Er+N_9AbtnsUD6EWcd{9F
ztAVVQyI3o|>T#w=mM%7^e=~nFt?yG0qrZvYLqD68ECt^C0`L~~1e#d<KH_cakNA!M
zo_M?3UIV<Hc&B<C<HGp;#JkkcYTyTm_oydF0Pi5)tFEmDevo*-x?&9Q!(4hfpsq%f
zk3Ygsk{(opY~V+!g@>Iwbi47#h|vt$S;e1_^2Zt)nsR&>^$HWKEv$kkS$CLNO=Q_U
z%{=%`C&s{blVD<1o&<S@BxE}GU}ztIj_n7ttk)rn|C#BEn9e3x*ZA|SEKIpNb3k4o
zNtn(UR_{yn)`3sj@tK!NI!)(V*p&DyBwbigV=cYPRAZVpJR9USk{;8!r4r<Il3vsK
zlnH%<WP|A_=JYL+KGV5sCdhu0P3Bnc;K%>65=D@1m2EM{%DV5nn)|@-RB(R}jUFp-
zCEy=U1b<)i;w|QAS@iwj?ki=1v6vx$$aHQu9a&xen8mi!bnc_g`8!>9na;v_AfJ%z
zF`a*Pf_%p2zn3TR*>W<}2PhZob!O+Ew?a@FHRC^U*<a>$@gMcPE;<74|7C&ed0qTx
znb+B3_w@8lPwe7)`qm-$O2_r|ty7Lg#P#&8OQvFRJ!9*ZsaRak*m~?ytVum%>$O{%
zK|N#JVBf-u&@;9^nU}@w)WnVx$aq$2V#k?bd~j-F#|dQID`dOO4C6UMcFN2!o-1UR
z%_W6+o{&8@mxtr|LiWmZG+rcRzfA1n#WJxw5a3)sULr)9GR=#Z$~-Ehr*iQ!naYLD
zO3V|CxW9iM5iw=AG+xm^k%(ZjH<oHK#C#m}I;tZ+%-o5>x48%tA1>2P!{!(9;v-Dj
zWUnnYIVjUj$IeCN#YYM8+j%6TO@3%FXkRrBq|)T5G-S`q0;w`NEDg)cqVcg3bVSam
z#H-E6pfd?$kQxGiHD&`+FlY%a$ar%vFur7o-#l&`X`{_^Cy@RDNyc~IAr_;~&71yH
zabNWdOZtUg_UrKOfgq3jE;=Zgx8M*x1QH1MV6@BDULaaOJXGKB%uShJoZ-?AL55-{
zoS`_M%20kk6nYK%=;V~k;aJ`d7)riurd@+_<sstaE9ROT5v)BQRv@`oh>~mLldlT#
z+8MAM$=A*EF;jKy$BRMU5aPF!6(IXeemXBG*VHB75;9WCHM!qB0N<l<QVm8r8OcVR
zLxuxxv6AD>=dMSjoE0SNQZ>uPz+{6=O}*8BLY*fk_UnpM9jFAK)UPT|^<Soe_s>a7
zo$9;k9!a_Toa(0W;8Rn)#Hp5~PD}A(r#gQa+?zDF9H;u3$>7Z?Ug+3a=o^wVqy+r-
z`{;<0v&^$m0zo;Vlx&qFN_e3?8!mI?z*E>BKObbSxI|>qnVcubWukJuOme<H%VN*1
zhqn&NbcfA-`Q!p2UG@faV9ABD?bu^Kh~}4EB&64lqdQ9;C1iuW9*sG9w8@U8&wjEA
zq*DUeV!wdFcJdf$ecSE3ZIGoxcG@1MZJCf=_G{H3$4PSb*c@mkj~9Z)oDPsKA^U9(
z9h1w29I$yfC%Hn%LHlkPzvKx*4#}<a$rFVf4pdMjR+;Qt3^TxyL-HhHunnhSaF^^B
zhW%HbtV*6N3=2Yg>cCbD!-CK|?O>+}!-5dMNt!&><VQ(iQ}#~<J3VDn0`FoVnOrN4
z9{aYhGWIisMa{sGuo201!mw}4a~8=ng>{$#F5o8564q%35_7=L7S?43-X8&Wj<9Ys
za4w2Dd9KNBqX*~CSq$ri^_l^jP2+rF8_c0R9F)93Sf3dvVQw!Jw#f{fGYRY>VOz{V
z2iXQ;+swd0%z={^3)_y{k0*d#B5bD_;C-CQONH&i%SCNqmkHZr222>L<mJNlnt?x|
zsbkBI>D-TN-_g#JR|q?RytDTEgdH>kOM+lm3Oj_7$5<tKmE`s?E_#QJOkOQ+SODPS
zU~;1{TmZl`HOcFQ;Z>s?rsaBh4i^B7gjr7BAk1$CZeZST5_QD|0M95eeI5)K036FE
zv(01&jSB!yU|Q}LpAjp-Wv}Et<{7X^xB%dfIbiph984vwz^P2jcJt?z7^hf)Z0hD8
zL<>5RPUii7iM`7Tyf7E+0ZC^!?pLPv>=4$2>j$U>51E`l^;&_`X#sc2a~t4BoAHRS
zJ}Z#VcJY|`0;V>&U)i@Q`5@cB+Q_1Om}{E)lOxGTxylw)_p>q{*VBnv7_25`pC_V5
zj|Kh{O?OmHVsqF<oKQswH~AC?u^nnYm47$eOqUuy5BOQuVz-(`<M5nlp1Os_wuiV^
z4wELIM_F+@bA!thc1d}U2Kz-D)IwJ1D@<%3dH|a33`KiyWm4<*((wBH$$eaTlnt2V
z{uSpUC|Q?Iz9VAUXi5Hsx#7CjCGcwPV=eym8bDtt`M!ZFQd_912d*mN)BD&EKac^c
z4)sHN;mg%~`1A<c+mBuc#D#!x7!^#8HoE|9E<z>8hz1xoSD})XLX_?us>HN;tNGdV
zWJnw6frb9+EUY~wt5XKOz;6sHSpY$eS%fe%)Oj2E%kZrik|^%+mjV`jhtPY?#L16r
zMuNF&l~}FUNqB-VaS9I*D%FL66Q?pGUcDiBIxEc48-hK=e)SvZcVaDZQ2hsHHnEO4
zBwuY!oW+g5uxwl=&Z)eG6`zMzl{ohi-~$d1r6$&MG9NS@*-gBFyNMwT>lyQfOc4g}
zC!={KHariPi0Pa|atXaf@eI1E#AUL(XgYU5ffARKbehfycr<YZliqEPorlUxTq#PT
zoE~%RM=Xb{w9*uTe=;2WYRwD5{|YOV*r<5{#wS({OkJXGH_FOW4%n606uk*bk2_!z
z*E0@7aeFUu1NTw!0t6(98}***z$ox$CdyGu(8VWiA`YtIDF4LG#Fz}CktR}~?QVd^
zCblrlgc?tL>!l~KUGOMpVk=K_b{bY0AE-|v37+qe%5dVPXMyG8)rpr`G=|#1YI%k0
zAxieE6MKoha-2Nz>Syrd=rG@4n0{HGNxUi5s5f2T(%CN$6(5Hsvc!H(%dq~yd%_Zp
zuOdclcj8xeN4cBql^@v{<qw>Dp=v&VVsg>VNC!tai79MIdNQ8SABr}tYhZ{HQ@=$B
zzD<egR1<sy8%5isi<ajs63tASlGmXVEyP}zSB53@X>a8??rE%KeZ1Q&a@>7<YL-rQ
zq2u1d@=l%SE^ypSFr7=ZYS(<nmD*#^2P=~2sPz%J&S9ecdZT(SV~nWn#gHdC#*3=g
zP<4rU%x6MX!FDFvh&z-AJ#C_${yX)?_I&DhmoDrDauip+TLM1|dBCJcO~#xdv55XL
zQ=bRCn047_Soc+f95n=q@I@2H+)K@R96fbnDWRdxg7Hlp%Mwy*3k+-GIAX7wS^<1K
zu_Ft1i7sNlx*h|!#0tg}lojQ~3B)1Q<%j%4rafHPebOmLLOu!|LFGMwcrp}A!Mbw<
zJgo|gfSRA7sNL8cM~jf*ITcD*zo;K(1`zmqT1ULQ1qtLKgVx}YXp;H^)~zF@5$KaX
zqv<8=@&s~gl~h5#9dVnHtk$tY2U-y~8->vt(zI~8D`#q|HMOU^awerls5xl5D@Rtw
zX*zJaTh@YSYc<WB?#cm`@tUgXN)8o;d8jBV->q(K;G$qc$@!v2;tnOpekSNTm4iML
zxvbEorbH03Ea`RYSA+h6tjMcE9>bbi3CGEYq?~y6DMQf}Wpd@pTTu>t!KU@9UtX|j
zy_)6Y$bpI0jVzytx+@Al*Gz#tp;p!bUrXE}b=i6y)6gkjh;QA*I_^^c7zaOMkh-xp
z2&HVjAsunyf;ai)oV_NVgVAW-)?OG!<eC32(0>ebbM{ul7`GbEn|m=eK@+KEn>F*O
z9dCn<<Ne!a9t(nR@{Z4}hHJrM1bZE5U6)}NGT@g;mK$afQ<aAHP`^JF)qX?}Hrp%|
zhf(w9Ks-HNCVB-r2{7&Q4;w?NluTzzE<zCFPB?Zgd~*qOA873aRH~-q5ecJiV$>T!
z>YY?@U+LH~{%y7edXfBw)-=PIzwMv+ZFqq2E`h5MXNUJzc*d)TNO~rJ?gwo&8g|ny
z=T4A@&zlTmLG>QM5)MxqOeEz<A1iP|s2tO|TbL6@sb67YnHdw8O~M;$i5~#HXQK`b
z<5A2y(~YN)8fA7{$iw3c(7pgVQ;CLAkbjv9@*<RU8nzYjYpSbBEKe;wr=@!ak}1ys
z{xLJI5jSou8tLf+makd^w*lXQS$DU>1FwlStX`Ojv<sUFUmgN@k-)Q&k2GG<X;}Ym
z2fRe2o1kuKy!O?wDp6Evmn|o}n9*ELh^QA)a>W$jjg$;fR_{oVt>W{iEWkSj=FbD%
zNr=IhPVQ#>v0VJ5S5z{Tv4|qQ;|anm5#WGXuMl2<;4<D|8a(&FhI$9|EW{&f2r6R0
z8T4VOc|(EMeMQJ584O+xAot|rXTRs$&rn=y-UxP;$3SAJZ{WxC<4=TY8-6`M5qs5Q
zq`~uFVn@A8KR*-uGtZ|V!z2l2P9QObgfg!pv4n&(a}bXwO-LkjJ;NFxB$_#eBtu9d
z6T<|<;}O!43EN<JGR-0I(3zPIljIp>20^+qujDgXCR5y<*+!BhWKHH-Oj@3KKU{h;
zhmjPSC^Dlra}B*YCQ92lFLMuFT(b(Y^_lyjnVwQ}GRTI^bLleNd;;G3GFzDHvF1A<
zn=<1hAt75b+eoT~Y|C6kQX^!0=2DVz=4gboGqdstknxhXU724n=z4QH;@NEse3a?A
z(eoOFj^|cpQmx>lTM2O+0zKcx>?-y1G~hdrftX|LFX0P!b;5lR^@Yi{_rQ%(R;Nhk
z^-Fno>yaQ?^qZlM1<W3NGJd_x6(q+2d*;Hn^r@;a8{Sz-{DivcstTv!XZ)3fY6S+6
zYSNv+UUlMJ;K}ITpbg7?z>#&pJ~h7{c<P0~ezk&uO=GHu;<zqw6T=LuRfB<NvW7zH
zJSeM*{}ni_2Gs&5J^_xXTVedv!a5{5s%}O7sYS#c>Ls*MwV1d|-3-I3Rxrsu#-Ok8
zSQJo70>>c#1TUH6q^*WB0MB4Mv1(h<0ktOK&uScxlFD5J=ot%`up3?n&RJ&Ijh{jv
zjGUEAdT=K{tI;p7a@rF=ggmJD!8v=<*T5mQ4DHUId^>PhzDQ|LSp^))Iq{_94LkBI
zB90o?T=X=9^4?=i&4Avl32CsPIXuytH8GNjxMXOWC1K+9+dd3k2IXhNkLN|eM0U;9
zz^WBl&mMOag3;%Mvui657f!&z5@y$(g1GQWVH8_7KJLnD;b<wl@kPk}vJsR$ffXK9
zJlmc<>08J{s&N+ZWXi*;9aG5cX0~JOY(b5(qp9?Ni1Hs)a5K~MI$&_{f_IpHya+n@
z$n6M54_yZ@yaQONOlZ&G#Y>SbN1`2k6odC0R#gpxDf*bf1OWGXy-V=`gYoA45{x%j
z2O}3<<vj);j^cd=-hu-BZc|@n0T&W)ms0jROy$lTuBdp2@TQqvxmV1EpJC027L(pR
zxm?}y4%f774^Hx7NIA$|g~#$v1hig+?&lms{mA#`dT)U|haGut4(r~KOyuTL%;OjA
zSF9<M4I?-2Y>2EAF;>m<Qpv52=<D)wPDgWsAxAc?S+Hi=m2bgYhI$vj1q_4*?`4`L
zCa=U{<p<%j%0zu)r5C@0S+&|1EBsepGZdA<>YE6~D`PXZW}=DO{z-ViQxAwcPpN}a
z{dQmkpw5Cll=YybYVBe4LR(UUzt&|aAbaFFfSz?MD|<9GTKgPBh_kiL@KPxu;Hfo`
z<@@bwHVBzM*)`0Xk#p=Sw4ZTOR{HT;dhx33p}Y2YX2rqd%kkHG52bF`{SMAJTS~#-
zP<L5kl&t5`tg>>wP;AdGz(iJlBOG%${?3v@)Ujq2>X?2&wzG<;6JB))Ej-I1hWbT;
zi|NNNDa$G$4(6;`a=ek{`wyZH$%*@{QU)JZ7d60t8Czr|H;R^&H3Ye)4n=cM#T+av
zsA*X=w`B(CXiZC_xpx+WR%+^t<{Ib*v#K;LiRQ9JWR2CdIGTHJ3n*_+N62n8w|oR>
zwWdxqH;-wk(X=R<dmd@6riIa5?!;$}*R&v-!@c;ddMe*+lp<SYh8loU%TR1usY?t7
zvn_i6r%-TALQwc12Ua20Xd2(eF1qP|yl9!gqoG_yw+j>{buI!nvuPmu2V?B5`On<k
zj^c8;USVdl#-GRk;#1aOtenl}oQ5=&Y~<r!K7KN&Z#g18wLl&>vh^Rs%xOe8rB}dd
zBm9(}5AZO-S^z#(wm$U)H!8}_dDdz8onxJX=gay7yHcFm(lD&0k5i}$D;ReXlhT(8
z0PRQqnVak3UnjkYNq+~?xRTZ)rgb=CmJJKjWjU_~Ejfdsl`yo&KqV*JQ^DrwPz|#*
z9l=UYyv!1F(oDddoC8qy$N!%>so0uwx*I|GbZ(GQqpUxYR1U2(r3je$Aso8rZ{uiT
z2#4<ZcL`htrvh&Wg1|+fXk&x;vm7*F4B1V$oTEU7QWdBO3|AVUmv!&m1CcT8cW|`l
z(wWKeN_!T47~Tt)!b@eK<K=JzwqOU8+V~R+CN+A0cOjGveaYTbj^0J?`L6;c@c)k9
zt!*$9Y2`EF;s4)(d<ULQ4dl^H_YdR+>Vdp?I5!_LTr5zJ>BWN{(~DG(>DMp>J*Fr8
zzhioFEJ6!NyO!{O!+VkI;l02^=qu756sSk~gc*u=WMN_=BmFGcthA@a%aQagXY_wP
z{{J1yC4C5ou~u&>V9lL`dRFi{;a7MpePtfPOid6zrc_T5Bt!M6pY+`;DP89PKEv4h
zrwzPgDm883bN$nXGKvjPWf;}&Df_<PlgF<;?Hi5|Dh|;<i^hO^YHlI7-4vnPQ`dqF
z8jK98K_-W7gBBsFD%YF}tmhz^-)=|ZWDb(~9aE_1AeldoWQ;Ng$^3~}&p|T(ORVQ0
znLiWz?ep<arXiof3)(QgMy4qwWM4&M2?^VrgJh-&iP)TjWDXD#wK)gL%n*{WY1J}4
zLOSeQNHWcX@X%><4w5;@<g~cU<{Tt5%VdhXZO%b5^+&eX*qno8=9z3iJvQecnMEd*
zy4U6$B-1gE2072>93;~<zlLnR%{fSBshN%jy20igBy+gQs_nBm2SJJc0J6#E93(R&
zWQ)x?NM^N=Z8qm1nKeST+nj@Bj+2eHoi^tnnd2p)yKK%uGV9HOh-bHv#W_f3Y7UZl
zD>Er`kj$-wdJd9#8?&qDAenOWBgYL7Lk1;gG}L4!TPmAUR;NgL38qLn2l0bs(=V1=
z5H>yz0)bqE*#w}!21NvyS@@Hai_2Q@H$$<C^LQ}0f0LZ=z~~9fz^c*c^JKy@FtiTO
z>Iuuh@tX-{!ZL8u6To`HGH~+!z<R<mFmfTVp0Es@dL^))une5W)aeP!z$S*NCoBVJ
zvO4vIWni2=gPyPqOemyJPgn*n{5`Oqunb&8tS2l37Zd9V%fJ;(a*vV8)-?f83J4RH
z+w##kd{h$;4<UH%YfoU_)=r1{-9(Ru@?$n&Ur({63z)|g<oPU=Q!|LiY{8>h|NJAc
zdVdxM3y1Wh!>0m&$)gaKs*3`D^$onFt8qc#Z!V+7HmsSWQAHs%cf;C+gk)DUH8PXR
zmgPc=GpXz|#Gp(H;lXk)1$pWbUV4_Ffve*OLp<a&i1Fk<q0?EX{TU?RoAt&txEHYN
z%i1UK0W_wp{Ygr1N&>#kF^iGOq*EyQ!Z)b+I9-H$^y(8QJHpcp&kl^tyjibF7XHo%
z|Kc(neWlapevf#N^?FY~PsjLm@X!}P3$8=+7(CnqRW5jH7~lw+M#Flt0yxMAEcvuh
z;c=ACZbxiIQZDOJ8{T5+Io?hHmZDY+>lrA&SB#}+;CLuTPAiAFYW57M^c)M&P}jJ?
zbH6~yN`(Xc*j7)Y+H>0f2Dw-L21Y1n{yyMb)zb*vLI3&cMbuZ$kqpOC@jT###C{b<
z3UU^G2R}j8%rK9p9OrS-Y2+NkXT$16%Dads8rGlD3*;V?1y2^gtC1I{y_WfLUhDfP
za_eVw*?9?(K7>lkAN)7?_1p!xr{KL3^yBIqbVUX4a}iVT?-U#$R<e;%@PW42<3_;G
zN0d9Nk@#a`zkCR&;1lAYeEg^2AdN++ke9y{d`4RrR)t5w|L13--Xd~1yWk7@kE$XC
z`9CW#xJjr+<fh<I9dL)bq#pPy;!gD=YOmnm#9eAI#wi6~w*YsmNyv7=H^e>aE|g8d
zcf`HwP4ut@-!tPI)Zd8zL)@qSLHq;pCiOk>kHlNl0H}Y#PsH0)4)K49x2sa(pNV(c
zBZ&=@WEW=jD6)Jnhm)SC5Kw2~nx|QaTtO~8m4$^1cw@k)mHJqSEhzrNp85Fo%05Zq
z+BKL7IcnPw$j>15tDi;zulolIC@6=03(qv+Ul(HG*}4$_1BEF(hXof=m*J_x)Ol5|
z4iujE0iI2$$Z+8GOhboZt@k6HIWHq^MW+LHTSdcHV&JFvqDaw*Q&6skB&aCJL@0^4
zXcQy%suz!dpV7Q@$x-|iS5YM+?vgh}i^lQ}%Wn0;P{>2vy6jO`4g;>HpI#L`26)`1
z@Uuak#c*mV?^A0Ka?yC=O)Ag^T>o3NpDike*o(rHZ&%MTZH*PhD0Q_R+FUe&_<-{j
z3|i47Vr4qrDA%INFCb!UpbnV;GUZqhY?D3>r7oKK0K9dZ&MGg+5hUAitdR+v&PWcJ
z&WC8)MY8F3&~)}P8!gPnA-o=q0xF8yAcsxot|Z6|62o$)G4-=pjkuwd^;HyG0Yi^V
zNrNLm;v{~{xv(0fl?0cPUP_W6iC9i&Bgh;Q+&22tEReY*o#-*Rf|Z}!gShnymecSS
zaN#oC(az0G-T>HRII=IJSFoIktTMfV<xIK&Sg&9?lg9(=6)a~88-7Hp)rqiLQ!7~c
zc^@z)S;2BAu#OA4g5^$pwTLRg6(d)|Os!z$=jXzYUcoA^xei!Xu!_gAH1!Hraqayq
z7+Jw8uH)W~Uco93b6-iXU==qmh9A9xRXl+@tyi#$CtU=&UcoA!taY6$SjElMW4(e^
z98IO4D_HpjTbUkN!75z9i|2TiS>cg<ry|u17qVpa3RdCbO=uc=1*`BV2JbhlqpA>0
z;in8{G^#&b7~`Azx(Q278e*pkTbV^K?mJv#6eiA-a5_2>-yF*QvYb^ompG{2L%|m&
z89sK7xk8p-Gy`Gk6|xd9UrJ{(OLBfmW=XD2CRfNx^0+gnSI9~VxZ|Z)$Vv){w@WRS
zI4p&og<K&k8L}F!V3*4kvXWu!ySPH;a)qp9xTahoyAFZoJFhVzmjZVB%8nU~j0Vu-
z`O2AC!##60a78Kv<<3n94WvR)?gOo$sQ^orTRjzYjCS=Y_mK&pdN0!~QSK$AdbiRn
zR<6TmQ`?iSawBK}zB>J^ql%9`>A3&hyH=!Rr?dawwL;}CVKP!Lh7>5b9qpz6-nD$?
zZbzl{U$mB|^bKdJS3h!<I~rN+zdJ2QxyPWl^fl>ty~^e3315q*gOz(9jC$&_G&5Vd
zJa^_x?WSib*Fr`1UzTPo_j#1R?*#qqASEkvzEy{EsqWla_sJ0wM=HyAIxEYsP96dI
zTH2?eY<c?5q}5C4#mjtmCDQ8Q;^iLSwY;`kSIu=&H9GuF3}4CemhXCgEXgZ3_uWE0
zatc=;dy3)PdOLK)uQJCYs^4*x5>%z=(tUSR>$(i<EvQO<@qR}2Ea1V?wLJ7JQI(#d
zqvC5irR!+xl%htIo=GfGm7X0I)qDsgRoeUeRg5Zv`Y1g&?IcEZ8G7;3^WKI$qzsfz
z>H2KQ!(z)zFF5&RHsUW~aY`?uDo3SsN-t*VB&7c-y_CkRLt0$v<tw3+or(kJ(knPB
z?ve`$OZ#|sw_7eDEWMJ=rbqc(;pb}N4eGuq@J0??Hx=@jc<FVgBi=3QGKO;l!`Y_d
zD2&n@8P0Y&m{58X4c<<vmC{>SE4$Ps7!sG>N&~i6rPTr7#@4;x<rPMycOY{ZX*&nx
z{jkzIg{Bo85M?dphu6>u^ACtBm;O%EyaVnqq_FgEO>+;p?=eaDYMOJvUCvb9r>XaV
z+l5Z6^!J($J|LF_mTuQH`+&={ho$#xnsvb41Z!Bz(Kq6?54b#GSh_=~HSmDT<A<dW
zYN`&n#Zbi3hqY(V0mHfl&iTH7<UlE|0d&e5c+a1V+sYc>Ux+}ZrphL;rj)$kQ8tk~
z;$GanP>p9xN5a2nHej?YB1*~)jIyaG9*JkwH?_b=FdTg@r%X1$z0%c`HL>I!9i|+3
z@r$lwJr*S&R0rqb*_jM7r0$CW&ms=HF5)VS&5`_;N8IPiKvPFu$|5cgo0PR`*V2f4
z3RI#jb=1WdadRes&e5(V5%(<yJ6F@<h+*AWgB+FrfM_z5iA3ay`b*!Rq1cS90NnEZ
zrEtR=nDoIRgWR<V0h_LM1~OhQcV){?g#Q>Q6Sf#oXZ{s!@LWQ@vYtXRE95mms{^G_
zk>3reXVpk#yrS?KU^y*PQKV0i@Vs_~L$Ojku3h00d*$d=MKQ6XzChM0N_bjF_pTK_
z;tC||Sh!oqp=nq6_W^nq06G=JJkUtRBgqxR8G^p}v|<FYQtMDC6+wDIMUNQ*G9(uy
zLpk`B`$E0+_{$I8o`BL0@iM{IK#afwIV%yU&pXt+4389Y3ub5zHAkDAp}7=u3x>&*
zEtsKs(;&hVzBlo=Se_`A%JHQeZW-!%Xt}PdG{X&|MGp0AY8mc!6ynfS|79AkJr#6_
zcI}UFsE*M3k^v1n6;a4;&oEtA-0c~b!#z%GCt>a}NEUW)Y@{eOTyBw-_p65IFc^I!
z$?#m}N6(Ok=g|gvrL_#t*H)hgb%qzn$iT4nLj#5vdeDsUZ7I}%Y$p|0c8OpWeg`vP
zj)J^=T1qW-;|8~rimR>?pPTTT$8nbS#lU~%6(4Ovf@M3&DdQrGY$rMXm+^q!PI88D
zKqw8(3G4*a)!_{Nfl$VM&M<o6ve47`E89uVNH46j-cE8xb9kwJjv>_BNshb%$_gC-
zna}T3%Y@<^*k`9k$_!VxV=y~TszE<qOD}pm$&on$x05(Mk?ka>ZUUTf>W%_#C%Lj@
zB-=@D?yYds+evOdJ489o<re7LVXSVUj)~hzZV`JOy`AJb#Cki)Ev6s8q|7ZL4$AwT
zu8;S6>Fp%9l)>xmB)5z<E8=oH$xZ23dDP{0k{i_ORu*-+o#c+zv^45+JISro)E9NR
zo#gfpm!dAWliab|wK(c>JIU2Yzp$O;ay!XQ4W^u^%k3mLb@Zz!>T)~DO`Y{BjJn)T
za#Lr$3ZjMFPIBwn3b~!cu`S+qLbiOkOn~>IX%BKqi`Hj%n&`7(EviI7)8B$0s}a`R
zZOO(w+Y<oncH?~IQ_mGzWv;+?iroaKA4-nexpRoU^1iS;m)Mam%blk)S?-qss@tY%
zncsbVB;sh-wAAnR&IO&Xsn72|RtnmoX^CIn(sdVTTI^S$9JnqTi8KY3cRp|zYd0ig
z3U>wdD=Y^C-4l3VDWWQnDfdKXKdNhbC2P7v-duK1V%|E{lF{(f%?5#C(>t)e?u@~3
z$WR6Nl>>l`Pn6Ni{2A7=CU}}vE1nwhn>Ujl<cG?GN7GP(zM#8?t3~pPwR@^OD*LVO
zX%y?3lY6>!DLMl^%z&e&A-nEcX3USE_?-1EHSmlC9<!!nv^v832S864&^sb`A4B6e
z{6^#v>c%=EU&IK2qa0r_=#`oDod_+M!^|4$x5T-$DN0V=1?BLYS6v4U4(3ztNV<Xr
zOqU<)XBaaC3;&Antbao?(pwLoo(}<?k-1&KiouV}`z8315{x!9BMaz-hGq=@`obe!
z&eNqtMi$e_P&{)tvV_h$MI(JwQNN^UWT}`|NzuqMrU;X+uTcUc%U3Zx?<nu*e2|Cd
zM(G?%H#91DKElvudsH614Akcte;|C1C4v4DR%2BDA9XlIBTDeV4;b8!atL*E8Rbez
zA^DY%;l(R>wyvv(r{W9<e9oxSqxoD8gDM**&q-Qj&V_#UyK!*vPo`i0sLJd9=eJ7x
zeRd(7$5QN7R~!u-BBqICu-5U=s8Q7`0Dap=&5~uN3pyd1%~a_{ol$X?3N~HPfsbk>
z_A1^(H);;6-cimX;JJJ>qMlj^Jdg6I`jO$ZQQoaCWz6#_?@{r^z#WutK`JP-R?+K%
zZA?XI)S~0zr1QI2QX!+5QAe?B#H-V+hogxdRe;`bRHqnRlo<@ms3lc+79Tj{80wjM
z7$;Toh<t{+7{7ygLHQ;CX>*44Uo_B?D!N;%rvi>;SLf?2sR_VV$OOJ*9OKc$j*?pH
zj8`Sc!s~c?any}4(Ixdg2qC0ig!w56Gx)Ij7HelE4YvVDWM)*-_ydB8%GzAXM5Z?(
z?}?X8V*WaeOa?s;L5kjB6=&~E1TgtN1W<}i<(3zjp!5ZhMQMNySuH4;!KS=dZfh%<
zNiX|FiA!d&iVmn%7>1V2=EBE8^*s|8XJm(59vLdpgIVPqcF)B?rX)3(EjsLW@u}2c
zw(zifD#nQ=No^+!4x=EMO6$LvGndSp42ZAEBR7NIpKchV>&$;aQuYpT`Bb#H$mr$f
z3WP4-q#C`#<Pg@dn<l{P39==nY+lGP`b2T@+FTGDy;58p`$a@NdX+ryw@=CeIZ3<)
z?XRHkqr1&h5pu{L3@bnSWO*ix#PFiy>@cFqQ2Zo&h9Vxs#Eiy$;gVj&h(<l8Xb0R?
z%Ot}X;}9CE8NSB2k5Y^WKNQa_9P3tS+?e940W;Jt{QA6=-mmEGZIowa&P)vS@QrRL
zQ)M18mb#jUffT$-zmZDk2xzJHTTGbp>l3j`%Y|1lL0lVJX;hYR|G`n6(16OJtTE<`
z;aW+wzsg}hAyjKUo~rU5h0r{w06JB<S1^)`P&8F}TwB)0x+-79V#KQoD5sfB!mH0;
z<-W{EZb7cAiW!fgmQDmNAy(=M3`VMSx>N+&sVbw~F|5H!kn(F7#-6GnclhC%<xmx1
zk>Eo-X~4sDQ+XY!t{P74sFN}JtO_zYelg8eBZ>8~`l?Y(Qb;`$fuAu95-;^LPFX2V
z$dR3@v1~RSGRCS35qGL5(fq1vqIkATeTkZ^s-=9Js%Ko|IV0HaUN#E2o|TRZmA6Z4
ztZHCu#OK$TMQNG4P%119Yh41O32y`X{9|W+h?L0k!Pr@x_G3F5jc@F1PW!dpAFJ1G
zG4ZH_L;NB5hvwkddLI6Z+@AqGj{zo%N~0Bcii>4MWsIJeFRnC-%K2dld~Ev&$o=#Z
zmhnVU1^q<SMFGf%u;indK*1aomGDhee4-V<GKN?Q;FTW<6?gd{&J49ye4Qh|bjVN~
z4`iq-MY0b8S_2>m1-C*_^euGAutFQXh)$M!Lf6W4RlPO=eq;qnujz+2$*e+s3GEEs
z$gz;4xab|anP%Lt(qh1=w{mWo416n>))Q*i5a6xH0(Yqs(E)~Tr@T)!<EhXcly6gS
z)BxW}`ChdL1~jyd@`KLrn}C1E(T3M_meApD62IweW^DJ6VDbL+5%_Z-Ndz~TB4wf9
zlO%8fDGXj{J4vVMc+ic89$<-fo6c4Sy@OHW8iE&~xuFLcXCLmXYXNzP&)^n-UQ~PN
zVUj(jb0-W_=uxgk?>C({(dt8wksL4`3m!s`lVB@=6V1>QB!^6gCO7maMtYc+1zcBw
z(*6x&2v?xQJ?j7ugq|LSf|MCeXm>N9p}2q;dPXWmUIz(1`!=%g)usPuUHT8P1YaQb
zOP3XTkp?-azJeNrULp=FNy{rtOH}3NK)#nrNvJ&HSKmjN9nu&=uU(0FJMkjXDkJpz
zxzO7U@~TAWP5R%Y*3`oPKH@FvRN}Wj#<SaG8W?(;$=3}m^bS>Sr{en#p}(-#-K7S=
zHS{i@-J{kq-uH<2YHfR;+P2@Y9-IP)#_{l)p(fxrkLBQ%!oYV=P*lEPXcE&Xtui$E
zmsS~?@=L1>MVM``nlTrlP30)fulR~s=m_E=hSkZmPn(T!d`_tOO@_xEw@?e8GxT#&
z`t|DPW)SDfZ7!ji#QBDmHx&=e+RQM*q4<np{b9&{O)8AUufmw~t1#wD7_vMTn#bHZ
z^0r^7O;@8-(R>z9P*+jMKUtZEbpX~QwBP_9$j4FaixFo5ZCL1JZmkzcZLSvSXRVN)
zLStAU^|a;+_(hr0Uxs3a^Sz<7b})do1L5^-?wuF>p2~a<rSL?FZ)a%H%cx<ke2dvM
z^t(u*qu3a*GCUnmEMYuhB>^4F$0BMg+ejC4nNU9>ywGyux$1K^iWBI+Lv4l046P*Y
zEIic+ojMQxx}-x6oleu;tyQ&$Pp;Ogx0ZN~x|N}yL3~=_sdYxE_ZmFfqwZt!&!c#Q
zyp$BWfEwSYwf{omO@(XLoM?nD;sJ#%#cP&!8=;GJ&rp85`vp3R(50G|-L5T}+;+1~
zUds&iv7)wPRSJWv(3OuOO7s~h9N1JiWGJeD$A>YFzxs&U5wP!^I9JQT5pDOYr}K!p
zQo-?tQQfo>W$9J-Hv=~l=c_~L&8k~Q!w-7dHyx1Z=Lp}LAHjP+$(ab!b0>NLXWYLo
z0+yE##~tFMdV^`)m&EDP#f<xkqaP*r6^%Q*26D_39>T*l^B9h`8d24>37m+wSko?W
zF*?7R`2vTaH?8RqcpLInvq0cIe!wFIJ`1x`vryo^5a1$#|DxZ;0zX5c)Ep)7@&SNH
z3*3wGSWTzEC2fF91ny`DJVqd=05waQ6KiuL;4*=SP-Hd7$Iz{NMzlcj#=W)$xbT!!
z#<<scL;xf7eu&Q_EnjAgdxOt;bs@b;oUaRJ9|xq4E||9{_Z!xNT7=$nH$p7m2X%C6
z8_dHX{$)mOqgjF)GW=^!>NaX8%4sQOFR8%0RFj3+{#C~wZ`4i^;+27JZA1u6#8c?d
zYSyM<=v{U(TCVlOJn%E}$UlsNuY*CWS;vp&l&?p8UA5EAwIF_c-leul0x|q^=Nh%m
zCUdL&aig|Hpx+;dm#E;de^tn+ooQAeoe7<Qm^|BQSj%T1g0s$N1P@PR#ul498Nq4C
zt~P3ql6RjC|B}_nz|nd<?q7P0QG2Xejj*6FV;k`JIZxvWPl#GMKK3=Rl<D|5M|E1S
z$G38hp=4uud_qQkhIKn@_uQWu_30?Cj=FmDAv7>QE2l23GiQG_9dDsE2uZhRLgVWu
z2vN4L5=57`Et#sDoSGzXq*NC%&&B}6vA;slb<@nPAby)4XQ^v89|j59gAsFGR6+~c
z9Z;&endVz?3EK^*mActNB6dYKNZkAZE>Zg?wCuWsltjX?z8QlYocH7?<ls~I+E%yQ
zyb>11{)TZrW16#&e|za7kY~-&Gf)8bN6_=SJrbwauFeGcvygoMNy|?&>Yg`kJmdI@
zUl1IW3q|W*G<|SDMZ#dzy(Eux=)}A%iRsj3^NP51>EhTc#nEkZU!d+)@z!H6#(1Ib
zHSyMKe}F2hdtJ!+_C2W4x;G@A4Te>RqOMuL8M*P?3eD=NyL~Y-E1PC@cd$_yss>H6
z?zhD0YCRfaogDJh7Nu?*B1Pkps<`V|<lRwsGPd8H5A0VG+1)n-2h}^sS=~KP1Bc{Y
zn7VuEKdg?#5WDX8Ujj$eBP{nn@Puzv-8c?-2Ty1vl&HspOv5rI_4yESmnvhW?VJYx
z-S|`*I-;8MyO93!Fn&UHUUN78+AlBzIpz%bN>x*Cs+!th0qgQp>U5Z-K+4atS1_YR
z<~%&(w<Sle$t(p8YcbkS%>}O@WY76%#^JgPCRX+r*@aA&p`L=u*Ih)MuKM7oZUeDW
z4>7qH`w<QfGEiSGp}IKgC79c~>z{!o@T;Thfp4JypgM~wzi}q~gm79HJ$cPVEtRkt
zy>+k|t5H@pm&_-(@l!E9YSdhI9FXTvQ2)OAOQu!98g?&PX4GG?62V~*iOR0;BTg^u
zHtMeoqefKW@kaesMA}5wU%dwIj#`cJSN%rH{i+Vp)n7v#6mwaBEyD<@`!STSzwUX+
z!-Xds_1Du!q;Q2%e*;leO+llszmfe<Ld{XYoB3RaGGW8(Z=#=0DW3Y9DeqEeGQ3-s
zp;>pUt0TZ$M#gybhecI?D~k#m`y3iw&E;|A&2uzLBwF9|9I%W(>eosSpnkwp_3JqD
zQ0lj+$oey%1oo<;Cg8Jw26jYa>(8Yhzk0L?^7DvO`CHHQgcPkn{rNO$Vbwhr_`(1}
zj-aTMQ;nJ{USk^geY6eXo3Dejly&$vKC8<*d^^ihsd|(^SXz@8<sSYmbMBzT!gmt+
zQ3K&^L_sO_@Lj|qDfRI0h{K9&OyRqUBZaGt@I6FPsf+Nvj4vT|5&k{v0$bix%k7kR
zN|}cLz%uQUG7aB<Wt>AKmT7ng%e2?9rlG0T^le2RJXiSfRQUWU=*gu_!x!i>ZHID(
zFT4QxS8D76;ER3_>{S!c+QS#W4(zCNhXP;fMfiRx>+luRfP+%j;VV0ULsHh^tBAuo
z{Z})c5h?5NMwWF{{W%}5*Io)g3DpHd7QT`GJB*6CEcdHsB5j@@VaT^NoIj&FRqhQJ
zGaOy+4VUP0rw%n-dYaTd^V@K_G`GT4M#FDdg4m`p8m=G;;#5>aA5jQ3)F3T`I^7^G
zBcf)E!qZplQooj1T1G;B1kGuXmeC<4-EbXCT5EL!PY6MiX=EC%CtjmIrT-gQOFim4
z;?2apY5-bh!%f5+)Ib=6hOI1#KDC?pwsVn#P3lSF+ljXr76!XU&DHaedyhhc=x%7s
zL}w;7*3hnNjGH_S^N&ZEO5KNAYFI$*RSA@6!$M+5Jq_#Hu$b7d#=&YdbZ!O?O6@fq
zvllodwbyX$$H2I_o@qXwIHL2locW4M?KPahG$&L$?0LhQGNiLZJ%|?6&@&sjQ%#0N
zX*jnVxXZBep(-^u<Ri`H>uU{TPh++@8%k*Z1NmwkY<45BhJB+4#A{xJN0fXJurbFR
z0zLHFoW?fhN{{B)RQJX_AwIe3r7>R)=lg9Ml*R&+brQ6PBL2oAld2K6XEGi~NW?yx
z-dyPhqV@<BTVt^hyz`k4QX-_oF7ku;gml`|=~8M2k(@63f*g=C^E9No+inSgl$&RQ
z^w{IFLHy=TAiZ`UN~W>Gd>mwhf7Mc>afta8aGyO4y=dc5^FxqL_Iv2Y8i$!VNXHi2
zMrYF)G>bsC`Ins9V>FI3nZjL$72%ld#`!2U&qvcyD2-Q~39OP(^u|8k+ls02AmA%s
zMJJ}Pc8R*K+01pp^6vqA8h4u=wW#=|t4}l<pEW;6sHq}<?$<@WCspK9%6b&z$iSoV
z`Bafh?q8JL`~Az8bsLQ@nO`Ebp#5+q;@5+fko_gvP2*m9rq;fYIeyJ7q*bxcC3#&)
zMCbTT$#K-inAd20%lr|cb=p@)K=zv!WL@_6IUsLKZ;h`1sR_v2O-qrTvddvAtkV%<
z%`K;Zd*-5(2sS?OIIvs*^8XR`9^g?`TiEc~XC{+Pa!3Xe!U?1d9LgXq5K2sjFw{(F
zGZ`2d1T-jOENB$aSP9nHK`c>G5gT^wsEDy$v17+;<65q<T;<xpcKzOWoioV&?)N`G
z&%?=j*Iv7?y>^|ws~@z$G4zoZ0+1nv*0Z3E)sJ)sKd4U|0eUMtEzAvI9;=_AiiZsI
zLsaF+4bL;o=fStDuiMKo%b2a}siTIz0CT148>pgM`t<4z|3YelhWQL?e&mfl^n2O=
zLWi`b=CKbzYhGPhvz6gv%Nr)X<_Vs))_OVGMa`30vzeZuFdsD?xu9(s9@RWE0CY&7
zWrP1*6m(dxm;?Ix!$DW*kx|euoDI54FNJBSd5Q8-{q<bXuiOqgrf2p5{n|62@#+ec
zzvlH%K%?V8G1k2CJLpE;F$naVB?!4mhHEu%F`Q;Gb2V?XNwr8vQ}YhfkB<2(6x_&-
zUoekvp<wpbeA7M_#+fI!YyQ<2;TXCrOi#^sl-K$)gi!PS%_ys&eh%eU^W!k&-PX@D
z-k*ygA9C})hj|Zc9|EiS<u~}PaLeI$rl-m+hySn~qL!3{p;!<xOA5kNEQy3ACE-`}
zlD4EM0*YnPXh~UU#lmQ^q%d+6OQYEu%+%(JpB77s#!@VsR!hpJt774_$z-D@PsG-U
zVXAR|=hJR=Fk7x+T5n}F0Q6AI<OaDFv8JaABY;iTFBNbpmWHv}+5^K>(_6rU7Vl}P
zDG{*6x&zI)rc|-SI;^eG)tYhv+pUKO1N2d01iiz$7e=H8ZxNuNc3KHmXn&dBePA`h
zoYo9fA!K2fn8up0n8r^0C=4NtyzeFyaoO=vj3sB!o?(o<{{i5>n}#4hGqN=6Jrsw<
zA!Ov}EKynaA?RfS{MNb<T#m~cb}%Z}ii819%&NkGD`>T1G8AbMU|Xw@<;W=lLe>w%
z0M3&D!d62N;Cul?tf~nB7i7J15UN`)J&mjrmnv)KNVr@hAY#o#n~ba%5VeYt*~s+*
zCR<z#jcgDQv%16HMK%hUVV!^iirkdN)}F8ypjIL`XHl)vRuZKUxmCm(ty?K}n}8+O
z`{+L-w`b8RG+Bf2joiWdG@3(bs*yXhZaoyuA+)^Gh}@NR(&12%(2@~G<nF97M^HmJ
z`i$HoL9MYujO4zovksxH-#ZWB0f~M?sOiWRM&v;e+hnoXM;^+e?r*kUXEq<tx(lVT
z#oEL|+bW>LYM|It;%B>cU>AU=vs$1iJFFa5!82Khz*OzDhJY1$E^7~ZlU>$QR>2D*
z)@ku2_sEMPw%b~t3-Gdt?RD5dBX4HSK|&4XXqM+r$+T9^8Uz%1FN>2^OF56i%tYSL
znvbflP|nj((8z~bKcXM1QqHbfK%YtiqssY!RrGllTWd@?Z?ho3$eM&063U^nN4^xv
zv~nh(?L@v7v`{%;!6-z&&5EEn8<kTs73kkt6B|(*%K4@W=;y4ZK+UQj%}wOjtdAF<
zLX`7)1>F9WP+FDK2R&v)1y&$KZOY-`AYuk+$<`=m1}t>MAE-xKHXwg2qO1Vbe3Nqe
z!Nf<h1L#w5E3h++<<dpa7UkR<1<H{yJCGylNv`<YuAKQ))vkhGR?cpgU|xV~vjev(
zvLST~EJcoXD(6<Fvmih<+@+kKQLK@|0EbhZ%Gom%sJDc&TRB}BdzqjgamOMRJ0xhY
za();O)HiSr!o<Ns)eXoATnMCbb0T%4e}EbsG@YsRH$eR1#>KOl&aj{o)A^0cc0hou
zHzCuR&oGCGzp&}7C;%ENZWXxYkf970H{8Ft%K;iKd5D@$KDwC57?F&b&iM?pDzFx5
zNtn*Pg+SGT2-F$(FWv+Vjns(0M$>tpnmR6U0^FKR=bQ;Zwc^%nIz0Rt86S|kHJz?Z
zbxdM!HJ$sZ?)3rag3)F=3!z|<nSmD?QMaa3$uQ%As}Os;>9h?8nk)6N!E|0@-KGWI
zY&v79p9cxrWIF3u@`p*e+=Y^$zau5S&A1B^{aoZIk=%k^`Ylk`kq>+Z6WMnj^kjn>
zY4Lp@MeA4>g51eInnlBH$EWz%j<ws4PZJQd9;S&n-FG0wZ0ken=^4K903j<zRXoc_
z<qKOwX9Aq<`xb4h!s;CaI7dL06{22T=vxM{s8v=3u-3N%AZGnp3UICO5QLVnzGQ)}
z_niumwoYYkuk+mi&}cmu1-RFD#Uh$G(f|7-w9BoX6noJ3D8$;WtI-`q9`aFBH&`~+
zeXH+DxNNfSrOT7zvf1jx=Jd4hGq`NA4oU(%=kuX$by!!h;9l_c1=udVP~>GF+u#ms
z4b}ctAJ=Jig_bQDZA4xZ&}l8AYV8oP+xn?5z#Bexq<ftcXeQqDg%O(J8I+wq8Wim{
z>GyqX(m}5ge<I~*dyV*0K_RaZe<tM>R<7aur;moOLOEi*zmTG+QjS>fuY700Evg(b
z-`_}<W1gw|RwNUi!Tiq0=03+Wn7e&6m}%wI&PS@h_t6Ztcn0$)9}Q-!a>VfO@zL<N
zDMvcE|45i?JQL#QuZ)e$m2*EeBgfA<ZM$-gXSwG4HzH*lU?zG41^uk1P0D$PMb_QV
zMaRuB6X@0>1%f(|Y8ul*K|7Q)FbAl}{|-XgrJO0Oky8I|piW#TOWi4xFn24b5`BB5
zkH4^yJDCnoS413fGfZba8~;E*4VcEmri>x%p9smI>6+`Iewu6BbZiT5qa;Tm)483s
zIof|b+`^_am!&jDP=)F6$W~;M{|dNOnT~<cY-EbW7d4%qbAhJ$pMhJ<bPi^hGfUhO
zo+)VXzW}$i>C~YeMGp1v0ctdzgR+2*5XmO5fiLsZL^gX3{8&j@i)R#1@Y5)^dPZ@%
zNVa)KafP_8@r>e1al>V==4>Q;<U@Z%F)ChK3#A#??I;wZEU=F2&erNq+Q$`e((dm5
zk1PBG-D^-L+v9rVP3EYWJ@dGtv7kemo%y(8(qYY2>v821L09Nf%7jQ)8D=h&WaOhO
z5m(u1uuA4luqh)SqdhIVeE@JBDs1G|D}c){M*Y~e0ret)bsDO*He2SkhSdTMtJSLR
z7$nW=f}*SKBC|BiXzoqH|F*a3|Cd6fsur)lq7_@;L-A@4SLefvVf94jYnRGcR9np<
zfFlH0R{eN@CgslNR|Wu%6c^hXi`3N~C7=Y!%ttg&Mi6rO!hR@}+8HurwGOX@)J%1U
zL^CZLV3q)Fn4k86m*<Y7mv<3maC|>?B|vET(Z=}x>P!@^Vev4-_<?T1jPf`}EX~m=
z>Ik@r!H!N<U!WWeYoH%hhF^)HgtXNYIv1^%rG=oy74PUYFU=fzMyI=Jmbr0shJcWD
z2^weA-G%8VtNPJd;t~!u<MxwiTqdv;)~BeAXhNOOy0Zd<02%~D#S%x8;wNTtLnAs{
zRv;4Akr=>6=LkrPA&sV_Y#NR7d(i$u;|ED*tq)Lcpt%vr%}Hj`>@^CilD`gQ_C~aU
zs&P&yXjvc}*Dr=t82TBs{c&8FfL3lk0Q3OTLA|9v=z*kd{lZAlVbUR)7mgbwOD*ot
z_Bq%L@`Fg*@F$=dM*;OY!}fuepZHUmg&C9q3Ju&}6nqxKz5facY8*(sjuOQzWnz8Y
zh<?k;%`Icyj8=!kv4Eu*ln>iikPS<Y<Odmmd=LPAmHz_?N<^zvIVxLbGf{U7%DqlL
zTCJo}T7Msdz-v@3q=MEf(A;Q5EdsEuUr^A|aq1+1kQHGXYQ-fi+ey*!>RPx|SQAk8
z(Wu%CP-W#g022g6Ew<U{MD;dYVs25$oJl_W5{~4~l3X*LQeKQbC_=Qck~;`Z&NwqY
zt~0}c%VBh3_L&~nMao7>gq;LrPS5yeGDQZ=8#5kX%P`%dB!u&PN!G&vxw#;tlhmcc
zc|YTgE$9EYF8&2+JOYFeX=AVp?wx*A#sEF4QOyP(n9RXW>!GTNbdOP>mnhmTqktSY
zO_C!oGxQ@Rb>4qF6Cy5dt_Jk60NG<<7(<mCxl^UtR4O-SS_=1v%Lk&i>`JA+fP3h0
zEZS9?iaP3E`cvtXB}8p;HL21s%`|A_MtTEfDQ@ZK{^18bSp5mQ>{Ik_19WAc$!m?n
zv;dX)CTnouM=)WPL30R3u>&_iw6dGX4D8<*ba#`>c>^y%5mXkKTr(SZRZq}`CSO?}
zxV->$50kcZ;Ho0fMJAUe2hKsUR`xW9k@mq@RNCe!(kIUZU2Im9u7d%u>}5ttU(Zzc
zHm8z)7k0O@#GFC;Lxx{!CQ1LwaLUXy>BpF}a`Rx)7gd1{nM**2`McK2{%-moLRD1`
zaOp91pa+^qK?a52C(Q3e`Hn~X2xy*V2<Xe?d!2kY$@c;IZj<i|^8Hx8Z^`#7`C?-Z
zeskqpB;OxUishG$fO1q?W_!$Q;FVoXstGRct3zVKrXPPa9t$Z18e}#@43ELWs+Dsc
zD^ywR<EEULP|&Vo6zVY-`e4=vvHr$f#OfP#!t%w&m`jAagyh;T6j;(^jJZ6Y)ZvF2
zW3K823c+*xBA~f>gu4}oLMui>>G4wlxCZn9eDk=U7|>ij%f1(8DpdV3w*W;ut3S?Y
z=LoPw!#Tqb@&iBIybb6?#)&(Y;^bbRA{+GqeRRf|`?9XHXf$qT&$w*a=RyiWZo{8E
zH}sn`Lfo=-TOM0V@Gql%F`?HGU&u&vQ}_Rt{>z^yy(c5hEnPQhtS;A|C(|EJ0nK-8
z^0;h;-+Q6Bq$IfT5tNSvEFXG@3{M>3o=XUbB##NWlG5LZq*pp;XJpvfiVQq%$}qW>
z?s_Bz7iv~OKap|g@d4NUf71OSobdZEbgOwhJkbR$2EPgROdT#VAs&*!<woxEE`~9o
z&2;sG$37(Giy^UJF-r3H@en>Y?(o|jNQwA`6z9HGP$-eS5)d+L@h6Yr1~kvO;CE7B
zh$rqt?dM5+%7;FKbcM8yJOuQ{j34d^1sOb;?_`(-Gr*LB_^YNR#iAi}g>*6g<hjZI
zI^&T$M*p|Rzk={Q_Jfe5mwQSQx9df+>lykaoC5OG<2-H^2DFxBbFWFfuBTUi;It5W
z6wns~h!ZD%?jS_+?g?$mIP?CBpnU!+-v4(={R+uEH}K~(zPXVs@w!QtGV+p~1t(mc
zgl`^q@Uu6<4g{-KrNH3cZ!4q2fhVJCH7N{uKS8fmb>=9z=hL+Fe{i4f2Uh_iJbK4Z
zPQ~gpf|e}aPEiU3rDg^414)J*(7eG|B)P%6U!W3)7xF_H8E*W#p-GASe}4AYqW3bM
zxl{aqd;WhHXAvYNP23dDWUoHM<gT$B&NAd<za;lZZx!SbuAo=WoF?J`F1~r(y_fcP
z7m)n$VwKUK{sWqv?6c7e2dmpZ0Id%>0DC-FlQi@#P^s!`gbmT3&=Z+&qGPVU_7OPa
z!NVc+JDV2#UT!+M7X03f1^+>WcnmB1SaboQ>W&fnggRUyb6j@>_hJP6><XkkRQ+;l
zpUlgdfSS<B1~hlLvbmMpRQ>(;6yjQa^$#2_;C7a-pnoK-<vyM2pSWX%gFAD;|CwQ8
zG+zvQ550!;P1&ILk{_0z+*JRv0Ca`^6b+~PR}M9*w2ART^>3u3`W%d;tAF1MnHbLH
zV{7vd4ww>1)+drn=D_?K#aR8H#URU@p|j!YfJ!IOz2@}?KU-+S8qAQi04=W_Rd-Pw
zRs>~gTAd?PQ`=erYg(PF4u<~_Vz~nnxcU@v=3WA_+EQKM643uaWa!s0$_eOG@Ga*}
z-Jx2a?8r*L4mwkgXTnSN0@Pxt_5*IxN`2LSka50ALgXyB{0fW;L$wop+_7~-nc$5M
z@JI=G<wutz#kD<r+{Lvng>-F^PkuQWI$_C?8NeTxd<kh$J?`p?>hUtPB@81MWfZC&
zs`y5OL;~7POZmOIbb44Fw$JI|jMKSLz(n<<>ODG%3Opurc5iR@ac^%|Dt@bC4F|0z
zR?HKMifmiss1n-*gsfBZ0G^b<!j@EWhhi;P$XK}gDH#{@XDLi%?rO}9s-Kor1vH=7
z3urDXl)Z`M2J{|b=p-5(H=fJe1I)w+vTx<)?}L3+!L4lk3=TfB*FkkdHElEDPb#FQ
z%`JrN7oj$xn)8?Lb2#61Fz<oqnj4M>zswJf$UYOnL~CyQmV!K|T(gOTHvISo<CL1)
zc^p{l9OSy@4m3kF3ZB@gxs$Z5AE^a>7i~dEQ%`H;yiGsNSL|!<AwR79GroJN$`yRm
zq-HZ?Vxcf;=C@cWsk!e&kO9q11oSBR{)n&GF>c5O`GFI+g#)@9fH-l5(Cr~S_aPaV
zL+BzO@y=aAc;p}4^p+8#?U9g!bdV36kIp#Xw9i>6FAQ!YqRC{0xH0O6K?k_pn{nYT
z>0d6H&|jc47iYOu>N-=&;IWe~+}P#+|8nUnQJP?5EHa8;E|TSrN1`X5qpHDo4L<$t
zoAA2jB7?%7qeq~A)THTmL!xNe5@XT~Iqj#H6d1;&nR292^C$6>W|79GG1PieoOF{e
zgnmtuAHlVYshiZW9_?VgVa`Fbos>)?Nb@?F#>toP>N)emQ6Se|4W%)UfIduq^ce`?
zxjuZe=R#+yrd&J&HLkaz^-j6eRkZu-K(8T<6+RTkl(muz{RiZyTt?c~g-Gg@b)-Z3
z7z8}!@>daLSkBl^xq^x|M3Oh<%J;y>dB8_7nVfRf#}YetYIB!B%_A$-k%+zg589up
zeSK>IEWQ9U)$ze%0`PZ7Q~Sx9H6}hK^mC%Rj(&b9!7^{;Vbu>3?ndt;GNHu@O4yXh
z7RB9IZOy9!cvO7^5VR`Ldqo}-fQzNkwjz&<SjcK046s!|*!oigJfZ%8p9<^y8h~vA
zs;u$oP9smMk_Bj@){-bdhxmzEmktGZN<hNWT>zdIfW<C`_KcbaKaJKDlyl@cwH%<y
z`VNW|d0t%wfCI6xFOluyr^Pz18sG)>I9yt-Fmf1qQGE{3W({EqUQ$_DeqUo9-3#Dl
zRSwW@jqU^RiW(2F!TPE@z^m#$=*A}NYv@DdH8lq=o2|Ec0N}ktfGyUYuoscn6<1+9
ztb=WUH`FS)Y_~QLyeR?fu!><3BX6ne;j+`ZiY5BCdIDgVk-L+N;3ugHq_O<TG*+!6
z8`XQP5*~Vr+~idW?O5bycYz9rZj8t+vJx1yF3W+#9Rh4?8B6L;0U_%;3*asRVQU+7
zB67C?yggVCaF2j0>nf_my#k`v_-ug90%BGa`X9MZ5|FSsFpAtSV2+V{C2OHYeU5bY
zeXARn+9ThqH|HbOlI<V7RNu{<{w(Ja{MM(;&mMIVs!3a2(F!AbMJ#9qsRzHPXHX!8
zR+3`BiJ!^VOE3wM-{tgj%#uB6(?oi?Wi<&dK9e)5W2{e+gh-aSTx2ari;D!zHxb$z
zcWa`HEV^Jr<wL4(jv#EI+`^o9lLZ27p<IlPK2l(I!W*_wI>rL^GHD~Rg(5r2<>m^+
zyv5rs4v9Z(sPLywkv`(KT{-++QlzgSY_D9vj5(67oyy_)@kl@OSEwO2TllNPNPiPG
z&dru@scr*JZWUs)MfR%0CRbOn*}@;<M~0f*1=M)=&fJHB*a|`ZBf}*}wzq9D!rXr^
zccjS~SlHXPs1&yfZ`)#&xK)`>fsIhc3c~iv2?KztL^5VNH%tIJP;!(ojq=x^uA#_j
z>RVPe7tla^qm)z7N`jG9ss}P52lFDWqOgW2>}t^}*q}~yoRKpnfbx$)hazVy?hU)4
zo$ZB|JAn#!u8P40>!J8cpKuI_pnU$C^8AJ(gv=&XS?=+E_&Q&mA->Me_+qiTz9<`%
zxq<NRr-SF8>I=gzK4}vrKH5O>38!tK3&ajG0bsm|KO#j#w_o_Q-f;db<4kMkI!{6J
zq$7i~4_sNKrD1cO>Cx@ygrdGlVj<m^(&W<e?I$hs>wW$pn8*myD()w^f7B;ahN06w
z?k6J={sun6xh^Ba{r8}J{z{Z5!!tqw{S+ms)%-70Ffa{hYaWX+pueU&{nE?^MTn_}
zOD-7VGKwzzfLV<{d92KU?oW4mpyibnCordwc_cpkpDE1aK<BYr!>SL+vX9ZFVhR9K
z@=3$HUp{A|8sL0R#+jygzbtyrH-jr<b(#_xs}Fbary2aGQFb*n7{B}lC!lE#a}P(q
z8(HEr7LgOc*UdTz$)LN$zy%Q__oJ>5J;FB_Zsk*vVLNiP?+^fKFUQC(u-A~5`P{9E
zbs_jT&c`jApi%xd{D&edeW$>W+j>@d(~|Ow`{C4o<V4xum+ddmtO8t=FeGw=oKLVe
zp}j^nc+qrcbGuQ1-})E(k&ObhwX!$BO#&=yFgw4S1q7{su+P6mK%q4e+aZx#1=!ZM
zB*1L~O00jOv?H4Ygsf9W0o*R2pY<T^@f`xfD6LTkqY^oULE{+BFEb{^Hy<v+d2k7m
zf(v^{r~*L2O1jC%bK|iL+*$>8J~=$^;QBqa3=~Tt)2LQchKxrkBO~kIfZ+QUF!0Oi
zIiCARbQiNDV{k$^^R#C`KL;Rz@W6vBBoRp+<Cm8iXC8sr&zapAe0KpC7jht@1w6;#
z>WHLKstail0p5aGcD?9Y9E<{<NZ8L(hzDumwEb=@UQP~zq$H0=1zZ=gf1dOC8Rs4Q
zoF(=0k;PSU@DjrTH!N+&4^ImGS7aY#TnZcacaeLjGIsW7$}sm6_sPiCmyD6g|F5mU
zUJw%LrT;B0>GR4k2B)%i3<v`H7>YBoSL_q#R!?yMHR_WxGSBRj;gu3@w0|u-dIfYX
zgs^>)vE_UA`H^rX8UN$wH3;>58I3fp>Tcp;L48)xFzRlWQq-Sg=wEjWX}`A6yVl)G
z8po0`VXBi~TUmPec+huBY3OX|eVxon3+0Nqy1N;nt%os8nUjX}(`bry_c9#JRS|LB
zX3}BZ4|ATn`$-ScOL~BQfOLhPiUD@rgG_yu?uT#PL!_g+4X$+$la9&jk#$>`hJ>zw
z>eW3;dXD@YyY4ZDlh!uleVqJ-`WonHog8m&)OVvc>YiXYP5RX-ptq53)~hl4t9z1k
zi~f#j=pfyyZ)TZ1MY>Htj<#L*48vTbzZ?eoS&s59*Kf`M{T%rZ>T@v8s{0#HxZpMi
z=J$E>x9cq!N7ZfTNb+TS^C-|SaDZhfyLBkQiv(H?Ua_p%sC)OiBT(u5RsJ817{>0!
z(6_@M`-kFzPTAFueImPkh7~}>u}@{Nsx5{Z`%H$hmUS_*7W-UW3N3C;#{Q{RABD=X
z7+>rQ5ldS?)dO^jSfiDVB8z<~VoR(a^8vn+0q)J#cXa??3wYLAfxN~3C4N4$hC(%B
z-wNooUaA1tE#MoA6&d@t`nCxJM~5{T`(A)n&eyd-Kd23G3Mr==r4;*7P+B>Qn5AFT
zTBH@@;xEELzsi^!2aUQxXJWsp8{yWjoKH|=vERjQy>h6RvHu9dn3<Xx`%_YKvvMLR
z-IyWcVvL}vg)t@QF6HoQ!<cDOaWS5Lvp106<c{_hobQCaj&(8bLwp!dH`V~<i$9E~
zzhN;31>sEPEYy0;9kF9{{ZH0Jk+{93oVPGaj`cK|qn&u~n*K_}?E@SJWBHc~!pM6J
zI;U8fpwE<Z1-4LQ<$^E{e;WE0>u<8{V;p`gI_1~^842%I&MDJ?28x@3bBxSwSlqPP
zj~W$An7^W|F)BZ!7u;r>)P#`VnH~a~V^$%|M!%y50HwrjvENCe*Nn{-w;TP=o#jCD
zBrP}log<isMS?aV6ts%i5hkBZxXbTci1rv;AtUz9ekau*Xr;_Ew)mmYcfsWJys{4(
zldt~aF;H`T5^A{q5w;OSpGJBM2Q_}%M#<DaDzvgE4FY(KLVnX84K1thK$dw`byin^
zrwDRP`$x3x`e(jJ=5TNIcLdK7giL!1YNY;ois9bsD8Y7uk*0kV6u6#GjTxg%`&4AC
z{v}QX$C&o6kpQp!b~LPyX@5fSDgmyyUW*d0-|+~7ZZz%5(46`=2%1d$QCQ9TofK;}
z2QOQ((x~V1Cyr{_93#~KeJWhqO#49Q=Y4`*rp<X;{Rg)JRQYUQ6kr!0I*IvgUPNC1
z3DcJL*=!i~Ur>t<^4V+`^_>iQq0eTssQ)r>43gus*(&P4qRTNpJB%u=mmkzL`|QCO
z6x8pg%L<=;1x#-J_XI6IdwE}g9|%tK*_z4uc^N>f&mIlksNX|ywhz^J`r+(yxU5vb
z1H*0)OINqYr<HUmuZx-pq3o8asDf#)@HDWjn@)ShotB|b1PkwLz&c~c7=dE*8NFFa
ztnQ@)psuc2l}EsFhYu9K?iD7{uY)N5x>rf-qQh_-Zry97ExiDVt=mC5C~N<9uahn;
zI_xmWyg^fK>zz{|^CtOKniKlEw@63yBB)#4+oYrVOw70H-XT31i{B{zs@OU)PjWOT
zc9obFLsqk5*NVmQhmKpi)QH_6K+Dor>?S#$5wtEs0I}Ny*cLBTh}|h5WR0b{bQd_n
z*5_jY9uTu!VdTDt-Xiv(VlkB80xhs(4~y}XUuVa*NC581kJw}KdWyErq|R)Wv;{5R
zs~X!TpwP%Ygst~Ubr(V#5;S9j%tmODbs2OhHrV7MqhbAlT8|AC(CWNLmtoSr4dv{m
z({OR}!<x~pLfp<)&O@}9BV?_hO*t<`fkuiOZ1?nBpi#1_(60L73_@&-$<0fc=OHv-
z2TC$vkg0L8h<Jku?t;O8Y@DD6aSC-X(0D;G$m3~Bqk^`=2=)h>U@k>wV4km|d7fz2
zA0o%vrv!l}i6o3}*E*odf?#y}A`!7EVxnMlPoiO+YAUD)%<OFk0M(gXwS}2IfJQJT
z{$OU?Arh+>^t*D#vg4R;o`~3CbSJY@iHn;yp~&1om$zl;E>kpavYZBxSB@dI%--0R
z#c8~Y*{=y!E@r<Ym`#rdE6fcghB1BW)8J!!2j8+Az{q}j1T?<Bm8K3i9yA;EtI<Hv
zIQ{{Zsy|DXweV*A1b}m1flT%o3j?tF^JsoFe}hrq#^E%c$)t%opAl&}=UIQD9G%nr
zSw;P&^ABeGq0ZK?p?C<dk3tvH_3LQ5<REGN<!FJRm!m4`uV5lHE)YB3sK1gPg1QM+
zTYnY#w!UaI=yuW}y@vMZYBspAZjXY#<`1N^0y#r1TJ;-uGJ@k!7xgz&$k3Gx=vLBx
zy$V`Tzlk*7fVv(E60E<I2G~vNU5wc%LK^O-iN-GV)hM$1dl;ltLeVi^A?F(2J9Op;
zx!5Lqox5y>y7n_3I_)t5DXjfm$gMWWf68z70=g8A*>^*m?b=Vy04>E(`zcMLyTw!c
zMVM^eI32#elwB^vEXSC#_N$q22x$5$|2I0JQ0+81IV$sI&>16nDFkvq!N{OC+qad%
z4~ww&y$j$9Yj1KrK-cE`egS*n2R$Jlbm`X)1l`T|C-{hu7m?xVBL-ypQCPKIeS?u)
zF>SSZGUGKuD~;Oj5<XVNZig1t7WlFt6wnmy!mDs*f)L#-ck!YO&NuQoUpf&uC?CFy
zl9^%gIhKI_$l{ki3fk$o@6umz+rTL4EIO1Ip~&@uMTgaPWnq2@OH;Ij_p<KLzYGR_
zIO&~oXJOIOj%;+L7~#!>!x7iRuUQXGC~7_vB<|Uj?=SdD+PWW`N!xD-*-e{VT-JvU
zyiE*#C?rh2%@X82fM5;;UBHJ}GK>i5lBO98uE$?_3Vg;wUftzhIXy$JC$jaqU2##Z
zTu&602U=$|GPw!4on*#h(rG<>0%Q*57GNVTkiY<C#$huNW<WD!^DAi2%!0>+(SdJ%
z3k2T-As2M-cTKYS)KEwkekPJ%Wh8l#y(`HZR)f5w5%<FlgJcoIG=mJjXECG#x*Xqp
zidFr;JcX-q{bO(voU(0@yGy$te>}>0=@O%~fY<1|w_ug_;A*pWueLAZEm%Q)KB~U7
zCl>*1_nLeAD9EGjBdXF~s2a@uuBA)~=~4RNO3<aGtMqzkaA_Ioi2ghIA<|L(X9RQ~
z(v$UL$WCcr(lNRGt8@S_TTkfDUf_pW(P{T;{sVaPb))_i&A4<hD|@q^%kYOXZCmu^
zrJ#qC?$A%ds+5l4WntU(F*86{GPgVA9gxydyuEIxegkHrbd2a<@hn)0(khxFyjIa!
z>_?wadY}u-I*WHk0jphD+FAVgK){F#OFD~p#Q}NuB>eX7EWQ;cw6xZRy*i6ITq_;#
z!s5>2N+@@!_acPd>0YBh!FBD~Sv(pVRXWjyMV-a<DZoiC?9o~LGi+z+R2LR@7MEd&
zSjtUv#9Po=+>4NRNdR{5EWT(E;530|5JACWl+JKn^E->LVisn)Ft4+i*9Mi&a$(m_
zJ&mO?k2UfQ^or^f(7c1+>@nIfW(C`h$K19IHQtyNKSsTBGHehJPsW$2x1c<R^_T`Y
zPO+4Ah`*+bAFp_MV9+XD43`rG*j8mDz;Xd0YYxE*0b%QC)MWfbb@%yDEo&ImEPj%J
zDvLjNj-R3)g-g`B1eu7RuAT&lStnHjoS{n5M<lHG9e~w}SC^)(yBOM;ibki=N_7J`
zTh*L{LBI1=4!}8T<GDz+={$sqLi{}S9D=LzIo%LY{CvfB9rZajbSQp-pqS6;q}zpx
z>Xq<0>q0;mE3pPXrwDZxzeG@@&q+{njbejo^7UJZ%b4P81-1B`vu48WGC^%V=R7Dz
ze4U_ngb5vwUoL19!h|};uN1V!=lB@rRf4wr`W?4&g%Q76vEA?VIRQ#uqo%Glj9osb
z5$Y7bR#2zUxf!-MzFy5h{&xGEp3M7o>LsAPKIeB-Z2Wq4E|B4OzF>)MP!GYo_B#y>
z^G0<M+=71R+5><#O8#uW^VmY5o7F{#53|xiQ-E$0x3J$ifM}EA%3y`x`MLt=cC`d0
zQRR1T!vH>hmyCa-e&^Y)Kz9p@`JDs%0c{qP@H@GzWNZ?m9@2j2Jt$cGLAP}M&O=nR
zht=yyS(D!>83go*dKah}@%exrRY|0*#qSKR1$tcF(T2H^e`r2)`-D6G4+h)(L+7zD
zwz&+g!T17=DgLC#FxvdX__R&@DVL$jFY*sf!HCA6aT)&JU@S!IjQ`D(=mkcs4;U|a
zjAAfCthkpwh7Cp$+En~CkI@s1Q=?$K?lFqM;1#s-H$6rVF#Zl>8Gp-T6oPRvHRWxO
zQ2<7gjCVXncQ7jH<z1KI&jaHVOe*5<c@ka0*v(e;caLF#5t|Ce`yL|~j3Zg=A9#!$
zFwSIy_|Ri?0b|^7Fg|h_z5p1PvIsx+B(lJGZY&u8@ECqDd}xvJPdtVXj1yQ5pL+}w
zjL$H1i2u`LC@{8;0plx=VSv#W9bo)xk5RtHKUB{G;~S4r2F8ga!1&H%l!CE72F7lW
zQ3A%7Y{38a7`?&Z@rd|dkI@T^ja12BJVr4X53#cU^cXf6XS09|SuVlVuwXou4~Fs>
zMPSe%$K9=Fzv=<T!9g&5o<t!SKa%117zJRwLEU%vpkdR&n8Jn<@Fco{(M&^^?J<I2
z%%U089wQ%&h6EU0JVqWERaD#@kI@y3Q@VhW>oF`azRCr|@))^bTyh{7T|Gt)7$J1c
z@jQ>w1q_oqmhUk%7)LT;L64CQ1|O=4cXt_n9~di=U=(^1CKxA^(ZgdXFd|fkB9CE!
z@ex~bPmfW4xqoOe>&5mMWnlbB#Vz(2rC=<=kRjg7W0ZhV$X40gWAp~2iltuSF?xY<
z7+Ynj$0!EllR7ZUJ%)X`-{H*wamS>^Z}&Uj&?fa4w88K6XGshYw8`&`pw168$DuFX
z?00qqfCibgfjj)p-4UPz1nu-Yb1Hxa3)%$>%!(c&sMGIE2m@6L+U<9aVuv_N&|bfD
z75eJ<XhBAn(=iulj3Axm{J|zTR!}g@xrQ-R39_@C75#w@6coyG_$!cjwV-g8Q;!73
zYXntfIlnW^h@h%0=TFw-I6=`YXAiAxt)N(za~pMjyr4wZ(EilC32w0kgXyfHZR{E+
zdJH3-WthK0v1WDKc{0Wm{{(6K69=lxPs0#`BY;G;8gK>rBN+iCY6NJDrzjHR)X)n!
zo+v^TiSerX5+1y{X%xT&=?UAdchUfpln=&mgTqC_#AJ0Xk{(n}x)ErqiXrSO<!}&@
zs8dasqMyepi6BtDj3Q#n;b0*#LtT0~{wQZT>MJoz&4Ryn{3I2XpGYV^Ua`S+ILApO
z1?@H+o|a0?mOcw(him5mr6gS#I~+F?Xs#fP9U75qT<pr;JMD9h#uy+mUmb=RFm_l6
zJxm;=P6ul8ISbHxCl<K3)%cv{FrA5mRXh5+7N2v}WS~Yttv=@==uTp>pf-#hU=R|A
z3R;6P0Ml}qdhA@}!RHKI475b8Lkt^y&f+SdrRsj5O+M#E#@?h}2HNbC6Df(KWyG_^
zC;FdQrrv;ChdcgB9OsQkoC}~=iDp4N-4RdXctM>$=L9sy#0o)sebOf<PEtD&iuMnE
z934vHWY40O2mM0_vw%<W7-e7#LFbq_)nk+f{loa4R^l{|Q38oDwdM?$;VTB?D^}TR
zPr?R+MmTY%$LI;h8!Vo)JVp^1gP6v1JVp;N&OozCoa-?P!Jv6eoaZqLf_@z6gGrs$
z{RSv*&psj4o!KzqyEB-p`G(Oj(VYeJje~|syx4k&-U74LFqwnpy>cM0VG1YZzuO$W
zHB2RKDf@F&Ktt^3LX51GeH8Shp`L@$u(Bu22AD=rq3qsh0u9p%s+4^J3{1le8M7+8
z3MJYwlOU$-k&^)AI^hH!lbi)0&p$RQ`}ZjT4UDu|*|b6pvpI)q#Z}ki0p<|2DVsXo
zkm4|Gjj|t30?Z|7SN23?xgkwsxIx*xf}>$R!6s$rq3dlph+wm_qcZ^(5NuI{`L1Kb
zA`Zzrlzj@*cF3fgF<DdgZz#)##(IDq%Dx^Wm4>ApXXAS8rD%-}M-c2%_IM~mLlZ$K
z;-Q}-33e;nh7vR!{d`vxt{TqE<QtYX7@QQ9r_JGf*ty|Y7ncE#j{`TmxD@zG^e_#_
zySN0H&m}dS;NsrEe9op}xr=)NPt5~f;o@T8;y%DDU2FrdVR@eD;-0`yjRro+#YJ>y
zd?&lO2k=Z5-zhFGOykGj(_#8&75oZq%JvOMMKoOZ#wtwPmp2&=*FS?oGW2)!a>GY#
zMe=$>!;O5sA*gRX1pJ#=N4Ac_Xg1u;nheQ$MZ>LBi?DtQ70|GWbcMX2+HeQ!r%HbT
zL*8&F>8RYV-*6WTH>M4YavJU?ja#3n1NV?l>r&R>X396}=@?El+(&+s-b?y^(#?2l
z1N4KuT)stLI0W>=ly5c6g;0!HJw8OXvg<+Gvug5Mkr{Tfvm%snpEj8_j(O2?nsrt!
zY5azKF@l~|R1Ep-JyC>~yp>ZQef(rx5Pcg-L#F)6O*J>tFO@5Kd+(cAKCkA0mOR?}
z5X6<dk4rNl{Rx^)@_v?8SPz4BNIpn4t<ZehBl&PX{8niL%`y21t#(w?geSL<j>(IC
z$;Wt|bwZDU!A@@Fe6&$-f;J|%G0Y};RU_HKscCaD)iL?BTixX?#hi5{WtZBo%36xI
z5kBj>mbMgcL^6`HSM66NEyb@*2mG7s+PkH=2Q)D$JJx>HtEKoXmcVw`wYa4?A9|L2
z!G(4Urt_yC&q@6eNS(O>hGtf;MXSj;3}1QlYc+@<3();=$l|^HbppDH+1>aYT0m2(
zBse?z0RHOvNbc+jZiVsD$=ULZ6V`1fqC93#x{R_Fv#0vbgzW36=-G8Im9c_2Yn&aU
zKfE@y5Oh67f_f`*G<zEPww$@2JzdtF5G|uK55<sW_Ka;HapDCYO6)n^>KHZ`8Rm57
zf&-SD8$lP4#+nxCLRp9~%+tyNdi0{d=p6fT`is$D@rxi0{Tk_Bq_yr!y5wWfL46d`
zH>dO$(6)Z>V9@2{<C-ys9r|Gzm1Ya+zT{WvS)?8EtK2n71}UqnNHt^4{|(Ve*j#c2
za|fARhh-%0IxI!t@;MmhJVx3t39__Z#qZ-fh8{f!<Es1lP7$=d4)lXFR#Qu59p)j@
zQT^;x@E;}}(?f@XeuQ*F|1tvf7Sd_G0-79ulysw>UjX_s(oOm*R8#zM(#`stnV`3l
zZqd)7BaA;mx>di!0pvE)ZTdIH)j@iVei^MG{uJqU-3J|B{29_4^xv4yXGw3;?1SUa
zk>0Gcp$zfuq_-5Ec;sSCph<V=`Y8A>lisdh4uO7^^bUOl)Fb{nyVafcElkhb<QsT%
zVGO`W1X|hU7zV~aCI~7!2dW$2MPR#~Wc(ilA@rpPCjJ?<EUfH9>j6F|K*!3)9RGsR
z#FQPwa5DZSU7D3$$k4u`Icin*`wZY~+S4{Q{C?Q$_`jshnPqF#aG4^0>$bsC;OEfp
z;@`Qr1h`Ls;N33n4O}x0_}?z>1>7G-IW8N&epL*7{&Zm3`}Hduc-}nVA6@yL!0)gc
zesXcq8igwjXMyo^&RNi%Di!~Q%U-VT{Oan?F!USo-`U`*^b*$jAIxJ^OMd@k86_+Z
zD&mGBNL!)|N<gDE3w=Y}6wqYtLi>;V1T<UEvcCKRS}YDx;#mS(EzzKWfHvz~MxQNU
zjn$j=tp&7OBbn1K0ybD2$;5L6Y_i^=A4`3RKbx)1ETBADIND-~Lgvd@v%~tBVnG2r
ztXHUd-DD+dmsMN~&|MakI;~%s&_cy(-t9=m7ReyqR?ZU<IQ0}1QqDbW9kwh7hLy97
zdR;82LK(T=u$X(Pspnw#=fgDUQW<aKxgQjG!AtmvO*IaP#mm*S^Dx-ss3IN`+OYb-
z%*Xr4lt9a-alEgrT?VbLEIQoF2lcY8TA1N@KQ}?vC=6@k{l!n%>P<ZuAfUn$r5mUc
zh^ERKicTROR`(zYQ5cjrP%8MM<IVk;#XU$dak+iia)zj5;U(JwZKuBI0Ij1?`_z|R
zuQxz1nh5&qg`jmW4#QKfo~!a;@#+C^^3=Qx&-$T@NqJgc8Z-`w#)qjXZOHVG{SeJ?
zp$&^qzsD=obU0}1DHdR*RBF(Ang(aIDul(e-K-rbSqoXcn9piir3||z5OFhI!4$=7
zy%BnO)d;2`KHkG+{8`nZ$WTDDyU6`02*;>m7IWuo(38{>bj!I}Z2wc#N+hZL`xs)6
z*U9>!#dq!FF|`N|?r&k@^)fBf7SGYgu@?vzK8<uF{^q`34c;uZ6?8y9jjwD?y-yM8
zUTNHeTxm592*w-KpKx$vNUF`Cy%=V@F&Mc~YVsUK|GB9Npy#Qc=OcyAD5h|}tnOMI
z{=^TGbzdVS3&abgWV{qE6e*@K7hZF3?gr^bbufdu0CX^Zs4N7#!5roW<K}INIB-8a
zNuM(@nvFNf+!EVe;7H!MZ0~A#ZUHOrNKgGavB!h7C-Xa3%Ac7H=mz=bwW2Ey&z)Fw
z0aSojE6kll>w{;gpigrrlO5D~=qct-VUgLo9qKrDD(Mgcq17^--eA>zi1-7#1Rl)m
z=NiVmqAHNtZ6I6c^&5F1f@H@yuRr%E++DAE1OM9fniqC=z4+^xd4p(JZ2cTY@$&{V
zijW?Ru4LX24r#+hN8p-@dBYfFg*-DkZ}=k6Rr<~_WGc=A?Y`JHZv>MW)Ai7Wd7~}?
zKcOG&1A6q;pwqg`e9%?jhS>3PS8ZPPGRQZ{PTIU0(#OaS*t~Jv^=dBWI_W%bPYJ`u
z1xVODZ%+xs#w`l~-CZNIq{T3Q83$~SLreiZ316wCc_4!FVbb8j1r@Ux)jzLSlZYOR
zZvpf0mzX>bY?!-{`FSOjGOrv2vW#JyzrvEv3*8J7zoo^u;4ysu@@tq6c0pddJqK>j
zn?TwsUEJdm)Bsmt(!Jc;;FSRB-m-I~S0cc4DF@a;zUP@PBWde5P?70!K290Z<Ir}~
zeaH{X1D0urv|AbJex$49&Chgy(oxMNmGltC8q+&42T98Vu?cx;Gd(;Cep=VX@vUH~
zG#2ym@wB%OSl(33C5g1R4_MYz{5{5y=^D3#Ep001L?E5n7Hle>)*CRhE!b52*;v5L
zwqR4S&I8PB3pN#h1SL;rwgsDt7o%aNC%7T^Y$~p2NlbKMQB(0#EU?VBV3WK)nx5>s
z7B<PtqUou$D9xIENxF_Ni?+y1VCfiN7H!ibpc3h6obRmBi(nknGuWxL%iJnGlk^6C
z3mQNgdwLw9-CqVeLHW(P61`nI$p)}R-;U8hdN%0}{f`4c&!NnAnd7AAa*ne@6gNGO
zin~)6Gd=TJ7rXR!7}@keoD+3wUQUx<z<Jhg&8?yIBJ%gz+;&SJ%<+_=Z1$4rMs}Du
zZp-H_(ucBX;JB@MKN?oLAcXqE{U`W}igQ&kC?5t47b>JVI2WQl_;zYZRib7SWHiS;
z32&x(%`nj8m?N$CI-qMw2lbitpvRN8bv9+9ESZo_W6Y75Ksu~D#)6(ilY!q>@}yc~
z@^pl69$W`<<~ESo6F@d4PMUNn!WZ$D4v_9VC2=z6CbsN*Cr;(WF(khuPMl856PBTU
z;tU$a3VkVD6RS8Yi^@5QL@Q-t@~Tu~bzT6j`V8bcaVGg`nS3YC;pDp!*Lcr^Lwpt@
z4(K`fN@;Nc)SYgSg3AL;dRJzt;bakAl@VP>QR%!yw8T!Nm<xUWKnTxe-VC|&Ju&ZC
zvgNIuM4BxMGj<bAHZh+;z~2RXDZpo^5*L0OqCZ;x#6<&PjI^d*OUSE9@HYpRA+hEq
z$d~R?iFMiQAR%kFmrEk_j#+TO(ychEW#THg;;62PcDLd_g%T#NCLI!WO<YSg3(Irw
ziS?u_MEw%ik*?C$AW4ZENJphPBsP%7bAnLO#EqmAI*W<CiF8_jhfz^NmRTD0L$C&k
zTgY#cW|+8*&9GVLuvTtot+eW`Oph$NwCNw1KUt1gqaQ(klemjA?OK*F?|upN2K@w@
zSmGYioAfq(6ZewdtT&GYy_xhDy%poa#Qmf@biWaxA0WM5KQ$2agQR!pD@TETi1bc<
zDa>Hv5iS|+((BOV6OUHHaCPcj3-n{u!oBtwbi0YiNuwFEvr0T6<&U*LH04AG^$HWK
z4XlEvSa+CMMOb#vFb^SR&tzcF5@2FgJ{#aUf(m8dH67r2wja#0-UKi40@D>$b~~(V
z;zd>#rd*BP0A3<UD0>L2_Z5nz@lqfCyh_lh>?>hY60Z?7VIh#U^g2_GY1)81fHw$Q
zlzqccfHw(RmHj0X`W8W(vNd!1F2NdQUp5V3CqcU!&XWg;_i1qaX4wWcT-K{Uba4sr
zZ5UG|K60&aZ{SZOz#qG~*9J9M7OOw$x=t2Gdokosna<71mR0f3S!`RBeGhHUKk3q;
z>;-cGz987H?C%-@zGCy=!5<i~<=|=zl#BT$v-7QQ4Vp$wC4S>}h0N;`zq|9g*g&}d
zhXwA=>k@y;yv`E4=T6_;iCw~-zNO{5?1VdgYn0<033vL|BvY}3J7a5>saV3Dv9(wS
zuqNFZTdT#pl@jiZt<AcD72(d<*2ugpVR;ifP9PIqy@?%XhKYP{V#f(&A}C<9%nTFV
z1Z<I+VWPW$4vR|)i2?!JEiP*(3I*(t>1d*-fSoe2OZ1Y7-7bf7`9yC4TFEpoQ7ZGO
z3U?}(D3hsNl^Tkl92$vGW*!k$vdf$3lbJ|FG1(hVwdkwLP_GB16a7`MD==i|B1~d{
zOg9bd3G{7=fr>UcXo*b@%XHJWx>KnS5D>Bo2nH*@pBT0-s{|OTI4Z5M=5z%ZrZ_CE
zlHb54hD*><Ia`w$p{DkOfRU^F;?GEREvi3vF)hewH4>@80Umq{xZUL%ZJw6_w*W~F
zXr@=}KR2B+hyCVcnB033W{~|l#E%4{fcr&mP%>``=(95N+&gkzxIo}87zXs!8E0-L
z{pF0{wt#`(eqF*Z=TiZFX9x<t0)2F9{C99Hp9``g^{P7jN|Y<lMyFm=PhO9-So2^7
zQac1_xeY({x`3b+faOTNsb0GdhRE8A$$aW90U?Xeou=MVGmx2Z=$ONgHB#>i7$oJI
z+Nt>R_5nCy2P2(|HY3iy13+#tQ=`?OYY{1D1*tJ!&2kYlb)Za5gCm|qou?uhU9m?v
zXq2gO8C9`IypLszRAx?EYLB>+?orRZ#2ztaH1Gru_qIn!QYU%1mp!7eKisFd*tG2t
z&(#7?^>C4Gbv*#MUP>TjeT<GMHC?@c5(vxDs#IK#R^fO0u!E@vIjB`-jh+XP6ql$>
zI#YAxm`_Y@%}LF3&)`_eu@Fm3rqdSB6Qt$~XtLUR04$L0(iZC>G{4kB0j<_7bZ4o9
z1+-ab4Ffntv13_dJv9ZOQ3BXty%YyHR9fF=>rM;cFacYvY^H6AfDY@85dcdiIomA`
zG*d?iz+w&-SW-;_c3K=drj8V_%i^J;)KLODtvg}-Qb!BeEtl!1juEie=|hz`R(3WG
z<#6PXI!+L5!-@Go&4RFR%oAa$;{{<sX!{tT69i#F=<joZmJ7my5T9C2tyFw#6*gt(
z1fY{Vo8o*}4|K9Ldh9p9&e%^86jRPYuo0<K1!2FL=R;Db2}&!63%IG%1vM%s(ExOY
zpeE(;GQ-p=LCwlpjbcu%R_r!fZ~-%m;VeO|%CXoq&KA_B`teXx>Ks99l+&BJJy%e>
za#oE4I#19B<)n$)1Z`4IC+5JZ^960jrOq`#7YN#-oM))#7YgdYZ>CZ}7YW*~9EAc&
zT`Xvaa-Kv}PhBEtCvLMxJ4;<EXczL%+Fv86Q#p&nKx+l<M#+}~T_(BRi~H+gBU9_d
z4GREV986s<2=^NBEKuqyLHGq#H>Txk@rQd22Ei<+t`QV6ookr)>qK2~ufcN~$UVn~
zdkqd}li8%$LE~P7qnVaFMKWqST=q)crJjRD!o3FDV8c`QC=R9)rn8c1*{p6q7ULAt
z$)j%GCtA>mbTaSvOYBXi^HLJ%0ZC^wu8pSlJSeCIw<=Hz9#)(`wVKXJw18X0UmM&;
z13fBejp-D!T|BPd!PExVMvwHTj#&YdRk^(p*0S=DMHstP1`dLCt?awdFnpD#gX6F4
zb%<ePRsINmpmI9C*_DNm*Oj*&jN{^!TNmT3INr3xpH%BAgqF=;<JzfnHiOnzLMC-C
zNkb0qrq1ITK`pNir`kB)z_@+H0tlV?IE3)4ete~~c^ib=5s-olQ(9uDF4F4}Koz6A
zSX^{D<B&Ok)|H4mb*UHbH%NYJ&HMBhPOS^?^LIH{Z;{J88ORj{;FoSPQ|<qz08bRB
zt`-5kXd&op8DCic#DK4(d5Y?s1)y&rosiwA)QyyH)DKX8Bk4BTu}a;<glyIqHiCZ(
z=`DI2!?~4ohrWvRCeqvWv-B%t{vCP`hR>-xnVg+E>rl{lbAY)^izeMm`A$87X}@m|
zWOk!$9JqI32D7j8PVS>h{(cZd?ym&5q&@Wz4ZXgcZRQclojjS7dW_4dVSPVa-Bx$r
zI32T+lx##s_2A*4pLAz5<7oFf+!;+zC{XHY&Q{WT9<AK79CtVA0dqkAjb^1;Phv0d
zyqFk$1KY=T(yemZIrSnM1^3(Aig^SyCBFm1hGv^yPzv}O6T1faV*iZa)T5I%yNrXw
zj_zQTgi`NtiCK0CQ#-lri=DY?aQ?fnWhXH8K6Aqb%(vmie22~TgI)Apk@|Q#eQ&4%
zYu9zCMMJ+si~9*nHspr-DMffWKmq=m1KF{DRt6GFk@y}EP7PKMfUvmQm>MEY-LSaa
zm>McTyTgEC(uV~{)G_fDZcm(36dKVLi%h8zUeDblWaRc{m5)@1N)(@6!H5{X`O<7`
z%8q^qWY0Yay;UWT_isRgxjdOX!CesJ5!d8$o^aK=2>~ZpG9y8E$ND5znC<RZw~!9$
zOJK;7CzB5AU(uf?PbFO;uMQ_q=gxGM?5rnOwQS^6wgBccx!QjdRM6(B>Eu~lwFxU*
zw!6>ac6SBlZ;bg|rU<jN<6%dWZ9U);RrV@^3n&(YpIU&6Wcyp$w?KiC7ZWrp`)GJg
zO4Dst!{?y#l50gtwB4eHf5vjS%vGA6z+YetoLuMPBH$0u-6St}aSsec&5`KSl4J5w
zR@vnso09G8K=b0X<kc)5Lv#N*c?~!E@dF-klGnPM{y8zw>zOE9FUD9dc^&Dn9)R*s
zUQZgceputA_w4+ErJy%3%!D3I`bPfhD6M(cIJuEWjT;TKj2^~b&*bbuDyx#Obh{A|
zb2lLQDvQR@ZLF5pxbUUrKt*x~>7ba+<m;m$W4mF##V|v%5SM&gs?j|a@UENv@`_$d
zu@;)#>B2HBH2r%dg03z>jJVMSU)jE|0TGms?A-GM=a-;rC81>Pp-di!vdQsmNbagj
z(tYUMFt0$5lbkRCG9~TF$y5`(;f|u6;ub9r0wt$1X<B~HpR6MtEasJWN%!Xn+O~^N
zWF@=5KTtjG;&<q4x|`}EyZ8o{xA%jC9(M5se!#fvT4)zb?Qw|1UpCnKtSDR?nCOsu
zk|N0%qk1!padI{X^D+GfsxCQ)`Aq0x=p>UV(rKNIAyslN<s03T7xSp!O>SY&m$TyX
z1Eu7GnajARU5m+Kav|lhBr^x}BG%;^!@Oq%z`@G^N@B@F_o7tfEx6=iBn^E!jBoOA
zmXOvPU|5q&NeA_WKA?{vZOh7RvWav^Up*20qZm(Ewhod<ldjNBA@Gl3+N+A1k6Uge
z<x%q}D(^pt2OC#NfO*?M2pxNtFsS(fP3;b7KWOP+sZeh9i~8ZN2{1}p8U}`MMgrxC
zRrs$5*c%2(BXEzR4W>v{F^|YM43jD-w4%jRk*tQ{0&~o0aUKezp~8hllZ)lh*9aF{
zlZ)lh)JTCUcXIKSunG;8F3g!+Tvi7-%7tAf7f(g+(J<PDda{;NZ&f_?7L#|^8xG{^
zZ$irfxN6dAE$7l|+&Yz$Xc4X-HR<tD1SM;?&F)Xzs*n}=sav*TP8bTu+8QY*9?rwG
z7_KOjwOd#wo6u7=T=v&5z#7)Ed~7+<({MS<C#r9U@o2bW8u$slYz*itNvEYQ8?Is+
z8nu*LJL|Yf|Em%*Vvw4#2n?lcxF(LcFzuBu7iY|-M#Grj=kH*QI_jhq#^_fUK<VfA
z8+HrEY@-$#`0iQEkz3or5UzX)Uti^s`1&g^!w4X&@)F1gDqjYjUCFztbY%*hE|uFL
zgJD8+A%d^?7{QmMRgWtXsy+<vs>p5k+Yp25DV?c42|kp~Zak!4BEOh)Sg)jfFUnNt
zX$VgBCLPtcQl^A53B$aEi7Y!1;g5M}K2loo8<OsO6L{=(`|#K$LQe66d$W+NL!&Cv
z2+zyqRg4`yz`(z&=zxD}ea)?gao}M~DZmplDplQxD1jJ*np6F6#_XYn8s2NBRw{Z@
zb86C!_;aF*8c^=cf7PvIE^-gjqKo1`q(%Oz^?!rM2xD6$v2D!3>l6~oAri{Bz_sUj
zzK*!hFs_08cs0kw(*w~bJ^pI&$E%d8qQi+G8&t)3mF(i<4?^63RlNH})yv-X4$s?U
z&rPj&Zu1gRFNqk7C6EbChMJDwIAiPuG_D5*msq$M1bi#-#Gkw{ZbH<^Cx_v<C;U3Y
zm~<d(>_RD9bsfYfpFqgP`zcbf7s?=JYViVyT`Uq)mojaa$jaH&_2geF-lty83U`0Y
zgdb9>wUYX&QL2smD<&h4ni1PT|EF<jD1?ri|1Jj2e`@_boADD~B;hos;0+{w+R03y
z>}vSd?mA=IKUkfs7>;l4?lY!I{H;6=rRGjw)QCT;2}WRKGyP}6Gg;L~5Kd=O&!Xkz
zErm1Kn$+2h&$o8x8PltnsB@q|21g7t7awzkq0VJ1OA#(#d8nbz<CQ_z15V$<oVF3Z
z1vu>lrs;e)O|7e@X}VtE!VRlt9^TT7BBf=@fhn7L>~SX<>LS9~fYYVLTukBf3EyEN
zFIk3Uq%b0wbz~LbH!F*Q@h?6c6|~VSGcwdweeXc?ng+IS?V42$Q4sHPBtgg7hXPfi
zubzD@2p(LYbBYLVST*}x5VN`=k~JVwbMdJy_afN>6*=T~(NN#=%|7TTgNBm&)^1p3
zOpJJ9??SA$suv?NjDG`M>H0C3Q{TJzc9*+O)b4S{#N#|k@wVOr!TV9it~WM@Of&e;
zKCfvs52JQtZ#O84|MtJ)O?_NvBU)Vcm!Q|cGGVr5gm3^L0jUq}Mqyu1)%=x(eLTuy
zdLA3iZ&aT<2|1}yzq4lk0XQwlT9pG&EQslkQD6Q;B|fe@gm0pj{&~@A!?+A^0)NP-
z3~4&NWpUgz2CW2Nh%RB=?-V!H$61E)3h{>wJgk@${?=;VjZnOYOWfSF;*T1ry55QY
z;d$`SK#Cf+g1C{yeITgq(e0l22$T{s&ysV)dC7BtrW<Ie6EfjEn+c~g6HbuERpNfz
z^Rt_N2CEx0elCNA#QhKn#=R3n^pF3JJ8x~r8JGKYsGklEIML`!Gj|%zoVh9!zA6QU
ze>e_hC|oad7eZs+s*Akv7m;B2yecO;!V~xMmb=Q>KXCurEoTH6{AmbLlAq<tw=#I#
zXq^fE$4u}x?4bl7rC}65nK(M=XN0;k<L3#Avbc9;{O~31==A?iQr;@#G^6i-r)s;K
zs?#$uq&)RBOvF&2KFh>#6vC4j_)|Se)n>+UtSA0gg=UJdw!kazBT&~GnvDAH;=4bD
zi0}`^t!j)~t_twqYRC+9W!$zY?YMS<=ez;Vao3r>kk=uhrqCm)5k~FNp4_vLJ3{2<
zn8;Brr+@rM|ChP`{c9!1{}aT8p6Evqy~9h%X$T^t;0*dzH|V^Ri~uy|bffPoqpy>1
zOl<H9figzzYR~xm2=tR1l5csd->BW@Srm#D+#_Y6Pxq7r7e08dT^=xu!LBQHrS|vz
z?9d$Hr_`vw?9k>ul0yj2^ej*q0jzQb*=hV$TvYF*l*?)R8LLhI8)hQpg*ovkPl1vM
zv-VaG(8PW8zrL1aeAT|YpJ4XAQuF&KxqP4CPx}d0{I6j3KEa`02{$1faaYjOlbj!w
zQG34Ud<LA46=xXt)_uO$dCu){KF5ou!l-@HV>3VZ{BP`M@ALn*C-?yTzmf^QJ>xv_
zpPut8aIQ7Ie&GuM1J;aIPI?;-3{Y*pwXLg++CH8XLo635BzXP45J!5>65_1=LQMX5
zh`Zeo(dE^)cv8&Fsjk%iWxg|`CKFeAf`JFod~e;)7dxZ<6wBy~49Gt$a@~y4IIqok
z79o3ck!k*eVIc-Q2u>GYXhcXvr+vH-%te2mN#?E!mzj?HaB0-0Z}Ck(K=O7WkA;r~
z!TkF;%Hywyy6_VMoNuI`rCYZi0O_x%;F75kV?g%i3SOF4c~J@HI0yZs5#xd~^BweW
z3oc;9$B^veGb-GO7xLard(LkNjKkR=C(Z75-lBUKU_qczai}Th!Q4Y5qY$dRlXkGN
zFbjc)d($rm8$qsb8Vip+1VfUg>`*yI5N41^W#nTlJa4{X94zPFIoNRHW8Z8n<T&P#
z+!?FEMFqL5#vJ9j$vI>$!tIr&5p`3;h4SEjscGbVglU;Y5fbi8MjwGP7Uy5zb^Hm3
zuUL7)v4^ZY;h1s8;=uL(>fytUg%cKGC9s+EI2zdf?&(<AvKT|Iu^bA}HoEDNj8NEE
zcrVh^ZwGsR8Y|c1zT`?0jfHn0Np_NHq0QW{a1U*TOXG#IHAN#RC2A~OG7b+wB`8l5
z7kmLaWh^X3H?vso?4sFn->8#_mci9nxCa$De<|r1be0cCw12&40_EZG_)rrmp5LrE
z7^aa3l4%@LhHTC{m1e=sB5TfA*cZhz|MnFiX%R%!OC$HHvpP8Ly_+ulAOhlrUot7}
zjGV1<e@{oT)`P5PHhQ-pI6yNNzKxmIAr>QLYum4sS=7d1SEDh=Ev$Yc4~<K!W|W4?
zJrq+<5Em5SZ%>4y%EFNIDZLKBXJ(IrqtBn6L!`5__(uh<5H}w8HT?dpBadAHx2!!t
z=ACf_aSjUKFk6R%Ja-JqSNnoIPslTn7}X{MKg<PrfpFXLRTm0(DAK7eLM{#Sd_<!z
zCW)xg<P7uD@!(u8jy;Egypm*=Hd_Y)Y!v<<T|wR^<nCIKRA$30oC9(TN&NK1&BS{A
zF}pIo&xpuDl>VC}r<hKCkW#}Oj^vnW^sI*YJp{~U|01~->F`Z|lH@sv+W(d$eJo|4
zO@f<!R}ref*K#oe(tTl6e5X*@&~y5MK6NiiBYS8SgtE%+&j@9OT%mUcAX9x_6d~js
z<7Src_rP89k={VA!U;a3%R;0l&|UQgo!uRdJF|bDj}+)R1HstCWElD<I{xm%SL;n+
zWdA`rs24#n`#+>@{UK%kBpu2*n=*zX2<OxgC;=5Yml2o(s&cwPE3$n8qB&<VtSkYs
zobdz!0f`(`k&&G(Af0mqK^L_a0*yKT27p|36+lxCS=n6`Q{0@BBIqVyMb7C=T7lXK
zmzJFV1U(hh%4p45K`~oR1~@ZkJ6(#^b>N+qvlA^KyHwo`(3Z2BE&~+nZ%s}eQ$1Y0
z4bYx5i=aZlhMW|^2mzaN77~mUusP>2f=Z11V48D=P6QY&Y3s=OhCz>2>|~xbavx)Q
zuFZY}OgsBV=13n!uNz6?=0^(O#O!MQ=Ooa#F}K{0X#_8zcf#GGVlvrXx4?~DR;O^E
z$#D5j%?ki|l*O5H5&JtB`6SuZ1^0d6{v#OOy5p53{Ka+7@KewgMkUB10E3reWhYZ8
z8$IkT(E9Y*_*68~RToXdXY^{4`Y4R_^|-4*2lX+CN!MNk+SW&+qtel%L6_)xV?j?i
z5p+l&#lR*pN&WCcWzbU^L5KCR`Jkt51YM!eM6=Md-UVHyb4P(rd;&VEZ-gDw3!0GD
zn7(m5=!K-y`V~~XUPQV{UypIBK8i_hF)X&G&p=AC;Rm2M!8mp)p_*j#R8TPI%0gIL
zeez@sC)z29VemZASCehJ1>6s$`0t8h`3^GXw81zOR6%2Cc3|F{JAwh4Pa^u<N-+`@
z0g$Ii!~Yg4XPr12VOaEVd?v7L!(th%&S3oT`A;yq&gwug=BPNx_;fg$4<pZc`Fs^N
z`*x7q^FR6kp=%CV^FO`_Y<GVqe-~*j8xi@RusVaf60JS|GxBX+P5N`vA$f=@{|nM#
zd3-9rlS))k$lHbTzoG(E>7s)n|Mk%avDkTvKK~oa$8=8(`rChlpU~AvNdE4?0#?BV
zsN($ZNjK`>`+)v|bd%190nPuhC+KE9&IbJx=@xxEsxN;J=~n$V$}j&H=C)1$gY>VY
z*XVzd{*83I{)P1Kq&MiS3ebO$-lV&c{txNRx|H;vq_^Y@B8_D}fDUYGc0nNqzd(Ak
zpGH89!4+qtUZk*sD_K~$0D2~h?8Lj#*=b$Z19VG|APbTEc)^oLV%%iwO?^S1LOP`X
zH~{piAD|$@g~uFsgb_R~AM$P?2G4K{@mExNa1{$KsxPA1Z*>cidm+IyUzb9R4gh@?
z(~vgIvqDH`w@Z<>9w&ipHoFZNhNNr$qNm%ycaS(k64WisL}-b)+X0L?s9&B4nZes3
zZfm}S*KH^xYm%QLcN^Xbzs>rke&AQUg3wy@+Ww$NP^MMK4h3ELEo9pC=?rHS`D^qF
z6hybtq}#QV0zLMM?yP~C$V|5?@;B?}nYQX6{BF^kp~Bs2Nbf589<8L?IMP}bHNzTo
ztBvP#6{Dzc4Z!#>;V-6&o`F(#o3IgL&8p~F<fPj~f=#OE%KiY88ObhH^eHs7+Z2LM
zRkVZIsAD#EtD>&C0I@p(_Nt=WX9Ls|7-rEVrhYoBQJY1quWmEHMGAsuQ5dbE+bn{R
zS#<6QfH*;gS#%*mf*@)ZHC6*O5F`-5bbus5BP>bvXw+2q15w)9!$BsxAJ`7MaEZ~q
zx(Zce6fRrbVsx)z=Ma+H?z%@<WnrDwU>M!UO#)q^m!KHC*ZzP6R%u?U)P4LDprcZ)
z-J`5lT-Tf&f|v^UBaiH<AcF-ptm8ud=)WLxDXPQW94(MA@dM#^V8HSU-=zG@AQOcn
z(<ovc9}Z8IEI{`vg~CzIEEw4zFC6nGN-U@kgJ5A*9nx&eeqCX8Z^(q?%z0tW+wdCJ
zy#Awb9Pbsa(A6lC!dmjHG*=1>r&5n`h~5Mp^V0t*T6$g&2A%yT$Z&A}4U7hN<pmG=
z1*PdV!v!o^t-GKCgNx4lKkU7Ed|XxCKYs6>baHxI+G&=_Bx$G9q)n#DBu&>$poMfL
zp<C!i%HnjAOctAsnMs=hLV+ShK#Cw#K&*m*EV77L7Nw#{6;Naop9i%9YTXf(#pUt$
zet*urGZU8Q>-TxRp6~1ThrH<I^Eul+=d+*BIdcc95s=6FKEmNcIP$5-F#g*)OfA?S
z^{xFUV6DQ!N&V7E-+C_5SHvH^^|hTT<Fs!>$;m7asS7Yc-v+{A^;4?kMvjk@-}-qN
zzr=<x<yQiHrr5U^FsE5OB|FXH0zJ)7L(q#0^FW1w3|U+}7X#m>-Z%#3e!}+%7mEX=
z!oeb54lAzs3IzL5$rbE7YY`rcYaNG6cu}voN~6KUhIK7`)TF>wczEDafYv#+z)No;
z-Vf0F5maeX*;jz)e+S@E|E{m&p+YSGSzL^v_)Q!C+0+6hzqRQ<hp>-}@t^w$=p0ZF
zfCB#A(_nu?s(Cfw^UnkvR+quP`!6^VaDy@+s{RYl0UQ-A_h0n0GsxaQ;o1I+xyTk-
zr2i5wvP~?L|5A#1yZ8+M<ya~F0bQ;C3i{Drc^9I8-&5#2Ebl+`UrB<Fs?d70xr*>!
z_2m}8S8qZ4{YAX#?Z5UHc<upp8OOPf<J_j!Va@*QInF)$otU4cDjbv}M*rt%r4Ff2
zw4=@EDca8{4+!kPiF|*lgl|vse^Dr|0!K>t6)*p-f_jRNl*HlU{e0Ue*i&?*gvYV|
z+cjEvq+}LY;=e<q1xHGL$|>EY(J4nt`Z%jEYt(n7q!(oI->uQfM@r5w26~T1Cmku_
z^+ErA8a?Jn$$lt@|0^1uc%+1v1pW65YS~9hc!SXYRgJ16C1o&R{;%oA`A6{ThPe=m
zX@~Ln{51euN}8`A_j&oHWa-%_QYiki0PwOufVTS9M9B&UA3iZ8B`Zn2fP8nOWR*5r
zbW$ZP_hOi^I!gE?4%wi-ycY0k!qJjaJga1_p2qa%k|%;d*J(7^T*CMGl&sh2wC0i&
z9$nI=(W%WPQ;q|AvPR3BOMb**H)yo1*|4skhZRk~4v+Dw1NbZy5f;mi*P}uLtx8OJ
zQiv}$z;{8}f)2sQ4;0+S7Ef))qB=l1!+H#JDfN;6R(lD+qCcZu{@`q^uGHTOu`Al1
z*kzQK{FL1l??#sfSgaJUMwgZn_Q~y+(lWvU^*hYJw7d!us10Q4RKhdxY<f1U8#-7T
zIu%Xxw*m~5&bpMt@%nFR6-U6WEcmq2YW<Y6PX-)j6Q5y4Du7g61H`Ltz-QsTESD){
zKJZNiNLQJU6Si!a!tyB_Flec7s_!UT7x6;&)G1`8whdDYSj=yma+=l&a5qy6pFok-
z57JEYv9onG4AitKh0p-JSQ)eSD#l6H>Us=VSB2-{jn4R-%%SK4d{lgSo==`+6@}5V
zzD-(g!Dk_zjBZ8R=QPC+%wy8lzQu5RLGC=Pla>PvU4{<%jQ|4$74(MUhzcrq0MrX9
zm`Nk2FGd#3ViWF_&c|QtGMLhW+2044e>Om0K`ni&xTAsyLA(fM6`It^2<Y`Kl$C}G
z=1Mg6m-VQc$E6uXi9vYs`9d+>eF2;J)Mw_PjRZsibZ2a4{S-o0u;^WkgkPU#!O!tg
zDElbudwzfgF?7v81hB2J=n@ER5$~cD7R!_50#l)1Kk08+c3}w(t53a-*%Sr{!x2Jr
z3d`6gBr_{4Cmb$H$9s&zsjV2kL0*qkIE}+c)x}L{AEZh*m$ZP&g%w(_rni)gV4j6x
zjRspvPHY8QtI=sKCAXFVt<&h#mJ$OZURbZu@|F_%=E6A|Eo&*c3udLTL8GNDCDUP&
z3g>Dx&{9&!In2{&NlVEEL>Fk(-%`S_9~LguXmLvszkpcSND*8ED$=pz%XC<lwF2T1
z^zo%C`B8wrV8P>n6>la43khoO28*N^y=eJM!_$2dci!qpT6+qaZKzua7f=Y5+%cJ6
zNQw2SYq8|%MJx}91Djq<PKOL@4eZ8r|C1QcdJ}y^zA7k3{;L23p@LHYD-Itj%nl!t
zVYFn1irIvcS&qM@(NHO)TH$u6j8%pjKNsE0S*>RjnyL*iXB3*o8HHs=p&)035arLH
zKxq0I=-^dcALI>I&Z`~;JPC>i@Ox6M;YCvNvXs0cpPVYbG!Bb_{lAo4i>KsIg`W(~
zShgIlO*k<_w&z;gW~}%-tdvsWg|KZaH(&stx(_-uV-?{d#W(rSIPrP32^iK3*x=1*
z`71`YPHD#1JvMH|komVxMP=n5uK_Gq@hV?uR~@cZ{)up&L@$+ZaP~^Rrdj#UR+PgO
z^4zOp6UVWVcvQt^0T+WH6<Y*6qYdCG0#<-y73~7vGz;KX0q+a}JXOH&fU*^*3HV|I
zz|#f%Bio)K;BOFFR(wRj%R!lnn1Ihj0d5m8z8PR#!27oV>=5uaSkQ`2uEe_GSb$vu
zz7CRA^qgJ{5>!J~!j;e74Y(*ZXjDGO4L5AG3#y{QzAmHkdG_;ZBE3MkNE7D82SJ#C
zCd`jm9x|-03o!cVLm08_MNlU&v&qbdJeGGEGmkZE=A%)0dT7{~xma>i%8t)K#^rcH
zCYBE-dW@Mkh2!IF-Zh-rEJzU?<vfhLs{lg<F2VM}`r9VpXH^h?6=ujfyAt@>^MIFK
z2s!JWxx(Db=i(55=1LjFDBrNbn7PX2YE}6<W9EqhhRWBWNsGYI^1%jU=1FD)=Gmqv
zuvYqRGps(c`D0h{0bg6rg`HtO!3XR}B#oILF&AOZMtMAm1;iu~r^-7!jF}0u8Dl|U
z=D^TYocAnx<Tt>p1ZJ(}n^A?Pv({zZ;VisR1;w&Wn}wGRO5d9|qwo2X(7tRZ$kkre
zXg&_4oXn|;>c!b_tT2qKCPDJ-lOXX`#|fhBsdYd!y(h||s*cBX4w85j_NuDcyu1+;
zvfseaRm;tLfrM;s`>Ix%-vJV~C(j1bBBM3f?GUP}lgwYDCTcf<D^+U*X|`uTfveV;
zHpH^U{w!8n)h3i^GpxTLaH+U}x1h=xh1^#4ZSw%8X#a)JeBAV*i(z-34&*!Lu^^?g
zUxS=i9hPVM?78ECd{>a7@}a&RM%DMsa`Xw56Mj<Qa5=Z0RZp3<r~o5jx~ra+F70|U
z-<Qd3)3o`4)bwg{JR{^7wmaJKm>){BQTq&7wW?>O*>3w4u&nAiLH5{p!p>AZFVER)
zSc?K!+J$%EGyn4tywR$g`%AF^Ca0>tNJ%!-ye)ulA)Kc!gd$c+DpgyQs@sGW@?Gkx
zFQu{efV!1WyZtJ_AtevHgQ0v_{l{vQ-}x-y2HBTa-Np7%bt)qEs=Ezvq**=a2Yhcm
z;1+c~M6c?8=Jwi@h{snshb|@je1LGT3X*9D8U799&Gwji#h#t`EQ^9;4OKq#IUx3v
zThM5V*^X8Yn+hB@QAw+c9C3PwNU_i_V1JYgEipUMCuGZtN=+^)Y*=SNe=08eDMrrU
z12v9TU9=h&P?PNAnq-eb<f|^$B-@8JReK35^#G@P37tLC0+g3eP+S7)X_(up&pf}7
zB>M;+S;Y(9Alb(_^Xs>wO#==-5W7@dyamq+>_&-|^aKAyH}Q$kk*O<MjEc)ffaX66
z@!wbdi4BnTqTzU#QO(UUp3fgjuihuqDjGJbuRJk|!lE9d`cs6oiLAbAE1CvW5*w%L
zt63gWi}1MWPZJJ{xvaj1V>GDy5K&iO`(u<xi_SEvKf@NyMISY)uOrl=PJmKZUr+zj
zrcPFXZ(zT6Wn!V#pJkhEisY%jk>$PW9FF(7)EsVOuWAN-fNuicEu^acJV^zKeF92X
zarqfoTYd}_X{jE45wN5zs&|P8P=CX&r~2%Bn@I9oFhcb?&j9wRl9hnZ<*OJ2BC*xy
zvrR}nRD$vg2s`V$P_K_xpn4BYT2u{VR@EP$hrZ1q^~R+}#T7s29QZo>z2O^gfkzcu
zhi_tEP3thPkYWyv*ujNGn|z>q_!h1_0E&fgB@_Y&!nY9$3)RD4BHSQU58qBWsw$_U
z_71|$MM)!kC!rSMMffg0uT6LnzMH&2ngBEnGiwO?lBVH%Nz-1TY4|>V@nlqJ8or-2
z-ECOQp=uTT?!_ANuLz-6c+WaKP-q&yNYiu++*J7ES7ZH3&B3z57k>k=PaOws4`1?%
z(DeM7fG?en@k2uE@D&>XhlSSRD|-Mp2(81PA{^E8zl!s0R-|?KYSOwzeYXhkHP@j{
zo9cxj3t!Ln?Z(s%r2D6~Vs80=FNYzXy{8?d6}r#9Bun?%pU`xt49&juBJfqK+w99l
z-HHZ{*`Fi@5%(LjuOJjgj&b%rLJi>1Y|#wL^lZ_LX4P7Qk*?BIzlN}AMw@yKk~3R0
zqg^OH`&v?3OZDvioYAnXa`tBkr`507{(5q0RJ~332Ew})FLcfREaAP%hB27^1yW+4
z`ZnR4_F)D4)i(*>O!$Cdjev0#S9N0b`3ed#JbQBhW>h#fdyD26Z@bSvWe3Jo>dWBL
z?5%`-stpvKeH!6_`j!{)8H7V>KCH&<ZFc|;3-@Ms{0wk|aBp_v&w%m1KF+y^aI;=l
zAJ^3)+?&0fb8b^xFp=5mI?S_OeHC1tJ$f48ZR&Vfl-cK>2e=pK!w{8<>nhQ-?7{_x
zakyrZd0GhO`S(~?&192_8N<FlABfMq23?d5(`(dBG3UZ|_-y`4cuj$Lw17=<uPGE{
zs?G0=)D+1PXvn7U*A$!NN!Xr==hu{&TQPFfK8eo>2-0lF*sN6CK#N@svelFc(q=b7
z5^Kr@X}3!-!J4UpY_nIeW}4ZE>GawcO#u>=bNFHV#0DVK<#c`2o)3#(6Eg3_dUo6U
zu-uv%=9577mJfCsHF#|r;C=S2c2vwX-vF}Tre~>{Wro0x1NKBXo0_m$1?0B!_{gYH
zQ)4aya>%fnL6(Z^yD_Q!*RW_`%@vmdRvS-8kA2fIFT6PlJDHj*k2C@_tj~kj6*pXi
zHf8Su9Ig4b*#prj?@aa^HQzD$awLc3PvnyPutRd8vW{W`5_r^n&mp<2{wY~~sJyRh
z*r<8hG(haI{WbWd8Xc@O*nfiF)I1}77T6!>ik~%SVVY5!KPgr7oFL75#V^Q;TWrL<
zM$M1R2^ejgO?9q$$(#bD*M65I|FL*$xc<jrA1XeZ#Bu_cuY+&gi4iM4cLDJH4eK$J
zny)+wSiTNZbALG$z)*e2Wz<MWf!`p7G}e4=2FiWvoVkD>q0_?N08w+z*D2y5!}<wW
zS#jV+j`;-212vz`huo+jmvtj$)KH%Q18Y7<5mn;TYYzM!6Z09?x4`*|&ljM5{_kNb
z_tif1TlVD}J8B={_{gD51N`+#&Fq_+2l&w<z&=%nu%z}-8Q_3~N44Kt2sorJ450k+
z^?<`F4GpM$A`Q4f&BJHycS)<L>c(VipJe-H_1i6gpFRk<MXfCc{DWr!<0ZM6NbL{*
z1Q?D3v#ou0!cwa1A%xAf&(#9%m2j>0d5$wIX0G-Hs??}Bn%WmRe>mpffN&LGc#CU%
zegV#nYJYbt$SUWbwZET>aSU|~C|vtTwpZ#?%K*Re70}A39tYiO|GWf@4X7vh+_z?-
zJ>FT$wZF}^hn1%h@VhUdZ-b`8-#MSCro(@c4$ZdE!7xdP7F!5mnWRLUEtJSJ*`?hU
zQg}_$Vw)|rP$r4dYYQ=KlhhctYdPBq(r45b(o8f-o87k1<`|R2*(;lk+DX!EpBScE
zeVbyxeTd7_hUo^IM^v@NCKq|Yz8#TBZHd{40dBM3Z2(d#igAzq_97tVg4}O2O<p@y
zkc0N^Cjpsel46JKM<CU;(*-$fKTr!~hS`XrpRw<515zn{Ub5TB&{?v*d)eLwb6Q(%
z&cWi2h-s`1i)lQH`!yJ$;@<nfufUn8p1N`48l&RA$AC|}4WaZQE7CpgC>Ucigp6z-
zCn9Temk=2cB+tGo1Y~I35=8mRUJPR$*)i_KdEl<SdmNBaK?3%95Y@<8f`sfh>w#P>
z1BC69eLyY|Bw|NFnaC%`y?i3rZSx*{<SMC&+G{ap<T^nX+iRhdksAbQwo9?t$c=)m
zu=#H0$N@oG>;l-k$QJ}zV<$nN$W7y@?QQmH;7a7?aTKd|djqHtxkZ|7vu|OuTLtN|
z|1%HBm&Va5^xCt7KyDugMj6B9P}RsC<Gu=ZjFzY78<9K5aSyP&ylbuzxog}?tah*c
z%{A!oWf^Lp9pXdo9rr1e?YG}K1;|(A@dwI#`_e|_era}_P0^2hbsS~?9{Yz}=ELJ2
z1~m@aw~=U%2y)0ina#c_eGc0^IE_3u?qX=lGqz0@d~4hwrumW`Aq5{F=Y@(MvAfBF
z?@F_y_VJs6d{3IaZr?Bg$Wzknogfu7^4z#iOcb}&6zTbrELxeteQ-;WACKc^b)p%3
za0amd9M=ohH<-c45Gh7}GR}iXM$O=nb--Sg2{xO-m&u}EjH9-;m_c5>jr?ld20Wq7
z3{u!5zm}HmW^gHVC-PgtPB(+Uf$T;8Fm5$wzRe6yT?On<<4#@+ZkWN}VG@zI#*F|Q
zHmCEtMdYvJcp@`u27l3jx_`<jyUpMX80m=V-HHY6HG>QeB9@nyY@Zoi0}CC=^R{Cy
z2e3YpXq*?E#F=?;W(}}>FJ^?7AqDG6m+^ufG=q0zDG^)7JcJcdP9{jd!)9<RMfDiL
zo-%{4lY*1H6q{$v;GI;YDc%u0=p{3F3+Gwrr5GMDgKvS5ks>d{siS7_?K)uPGRo^_
z@EATlDA=FPU?~MVB-lG<@J$$iNQL)mjES%Onp1#Pdanbftl;C6jagnwu+IvvV!tZs
z7qEhRIM1+PQ?20NC~P%eNt;^1tsFBV{lZo-jqZ^;scW!;w{w&^QWv#?M=F6Wlr=P4
z!O6wI7D>w%D|iXVjCv1XE^Suu?jm5vdRIf7+pXYDt-y|xe%q|ze^OGHc+W>&uNAzA
zX5e_K8@7TxY>S-W72aCGV>s&;dHQZEcpt^R)r(L325#{5jlkA=UxG~Rvx4(E=6dff
zc=~=TxEBnMY!N;ju!27zZ`%dC*$OsNK2H_wHY<1)Dc>n{xf7INzdm{1Jy!6kg}^>4
zEf3=6!a)c}#aH--v}vcbLxilzsK<n&YO}b@L$hdTJwD4rJyu$e&k@9DKLELle9Y5=
zW&!&rl+$xP>wtvp7R)+wp@+g3w(GE<$R5u>K(Yp#*9amP2@<tKl#5F}l-OoFNW*-k
zhl1W>|8p9U>pg=Qt<C;533`L)6F}PSv$@*OdcF)~oBen*kh?uMgI2u~Qb+EU(XO^%
zVzc`_htX`m{h0`muX-q{2kZdF{SnXiQFEJpH)|f1ntN>CfsZ`qc@s4U?Nc$U$m5;@
ztnrZjX%g<cp1D8{ix-MK<)IEfWA8)b$oD<W(;O)u=vrt*ejvzE`wWWKGlINs|Al({
ztcQ;DonR7li9F|N#At?NP+s!TpeRSB|I<U2_Bl%YiqJ9ODDkU;g&ZY*P3RRiwc-1v
zhla1g42tpom5?H82E}^+#zX7fYzD=A|4x?N;+VQWNXs_IVE&OO<i;k)V7~65!E85!
z$AdGGH$3Y>@=?cN{>4Lsx!Vki;eXpxhPu6GP#oNU$(Z{b6Oxz5F|Rg*_fazJJnm`t
zo53?l*U5SJVrB<mCdz^N^2ny!%;1Y8SwS9?j`zS!fWVPL!46^8G^Ry@J!1x|ZD9Vq
zUtp9YW^g4rGA-|)z>b>1zfpFAGUn@Ma6Uqq$c(&7NaQ<MEryO%N}XW^Zzu*<oks(v
zEN!mCc{JBPOPlMuJeq5mp1?%3Tp%k7S-~%nn+x-Hqb_U(w~$JU1Z%K@5t`5Cc{igD
z#>UtJY^6M}*$Tcj0oX}-&!Voy3VwtxXPwlwIi}#`JemR+n-kkn*OBK%lWkV;R7NH}
z(z4f4@PRy<$YDpp2W4iXj!{hJ(J1bAjABY!?sbe}TI%*WMsY;y@Qxd6Bc@&P)rl|#
z`Q6xIHP=nq1z56$bp_N`y=kv2<fdK8X1lIvBK)*ZHrsW@(*OtLCv)rks{n@-oq1g;
z;jm)Xx^DW(fE&~_P@yhFIBHlEPR4T|+=FKY&OxMO-2|Ib@zB-8zf=XBxr~ZOZU$a<
zIV2!Z?=^o6#6AaXt<RTztznNs!s?YtMksqcNLN2zc4^qr+`Sq7zwsLTzgvV^)pwcA
z&|>=y2wr`{+>b7XU4q5ecS|g)?BNiQ9ziDBt<c{3UT14L0zXpUCp7`P5wolRs321@
z&B=JoqpLA;+3AQzef4W3WVI9X(Q2*vpgiWJd?4!t!9MrZ8R+u(x$N>IJkmF3ruju6
z<*Dt)oLT0T@U({gEKJ&*YCSQdY(0X7;f9sw4%CUkZdhf$1@B_m)i7`kE#^!-4X?$7
z%r&%1YC#`9G@RtjnUQD1YCUJ!8#k;GBxHY*mRg^}%#^Ht!#b%6mk+0tM#Fm9z&6;g
zf*TEO=6>?d_QH!aoGeJQSmK5a(x=7#8aUsu(aBBptp~En$xSerY1k~Z*=Ce|8TuER
zGg}sGzYMwo=0PNnD7i?hYym`N@)rQ+^Ac>duJUcbk|3;`c?xD>sBb~{>t@mID0NQ_
z;3~pCb#NBoYQh2aT@a}*OgJR_!n)a#YSEXY8EpFafrnm;(Y=b#D5N~Q#RY)nA~l6s
z3VjlwEaH<g5PDXkK15#Q2jT&G6@BZ}Wv%OthCh(G<AdbQLNkrZLQ>HuAJi`&70V|O
z2k`L&1F%=w&zHj|Hbl*OtV4D)4f+VmkTg=mv8E`c{U4Z5!*M2e9zOeNNN&SovmZ#n
zeiwvpSYm!0NXTByIUFxFVL491w;69oO@qC(8lTPPqd=neBsjB%rGhlu)Y*n*=4+^F
z(WH<)lYC?*j_IButL8j~UVOSw8qvne>d<JTTh00CYL0=LBx|^G&PUg504Bt6FQ;F|
zHZ0{dr42gry{*#mr*5GpB~euO%CsH_GJe7etYo=)qm=x{?MBV{Kl0-5Xzf)Lqlx_B
znWNkdH;ox;<~Fkfc*O=drkNe)PQt~I-kDwI4S<b8mgqTc0O~G=ePl7$jIAb$XYp_q
zzc2$Nzp)9ttNg;lfE87x@(Zq}@O-$e8r%w0n&w-mFHaz8S817)OrxB4fhs+cLR2=h
zNtJn`raoi*Vi>{7appJCXZ$~4LMm&`NtkosRV;6Ys+?q%E<_<MK;>kM9IW^$OjxDQ
zIu7zwaRBzXa*DL6m<7GAEU=i)tM~*+P+4d(XI61-3E(2DmhfRrr?S{$+Nt6^EUeOR
zF)dlK38uWV#9Bhw17lGcu$B|v1y@*EYPAwRaVg+3Ydzr`IqPz~ND?r=!(TboI*ss8
zIQ}#%PWZ1JCusE$euyiZZVeE=3<j(+WTgOC@|I}jEIt3PV%e2d8eViF;A(3Z+JN{C
z#r!;3KGziyzD7RzopP_bQ$D{YpO4As)AIR}eEvZ`UzJaKAFtwe1Fs5|&sp+mEdcjE
zMN?2Y(Yke^qu`atSQHb(K8}+KTZL$)jPY|YNabwnJT&tvX41=k1u#@u>fxcBm{7o4
zFlMT%OABBTW|4nYmyvz5lBu{+^+_r1B6wwh4Z3=bs;h&95}iiXwX*?XcphJP6%UWR
zipO<<d2p;=H50X7#oIfRc%JB0%%0`ny$sW+`5BJ@MLKJK=1ONXibTS>!}sw6eRz25
zRWY}UCzevBzoa4u^<H(BTg`J>T`dxg*PyyJPh@HcVaTWPXObTMD{dnm*=o(Bruf)U
z8|`O^z5o;*UvgXXQ1`v9v;CabUNn+L@km!sO|&{!wHKhuE61dhcna@Tr-5A3iHQ%N
ze8|A^A>8&V-Z;R!VbMTZ@|u8dDPBgm1S8SrDz^=94@esne$6dpE?svdgc?egS3Tv{
z^ZJ0Uf8V@+hc;g2M}tYcJR#p);eJ3&-DHg)=i>O~`_y>6S7EQE<$~8fWah(sfQ&7Z
zmg#58Fg_3NylO34N%QO2oUxuyAZhtUplEXde<pEUyobfl&vQ^9op=tF(@A>D2YdQh
zi`LcB=U%rD&xCv&9#y|^3oBq-b0+&931KZ-hw*2Up7vkejyy4XZ%0|L4B>Q~k47?I
zo+-(*br)H#W9Z|k@~TVmIf+MwUR5H~J}u;Qy@Or(fvWAIcKkhf8CA}Vg}$<Or_tBk
zYR|FgDIZz#elVrRqva$$_=|3D9wf_i^^}F7&XkK#<yFVC6HoB-zW}-Mh0p6kK@rY=
zck^+$@MMI~Cxn3a6&Q-}1<O%Cc`rWr&zF&X-zR}$Ja+dg9+i955MWv2K{jOrpKw-C
zexMD<_NwdLmOS9i8C0I(jQnl44G(_xXhM+>{m7M~qi$!O6u-Cg2a|IaTFUHsDC{n;
z-7Vy)u^uO@Bm#XOk&us9xO@(s2hh^1Zo%gyp5BW-J`7Cs@jN5MUibwxl;rP$7xvZc
z|1Dq@Lo8hL8G?rTBHT;ObyAF`dC(>6IjDBc_1{6YSMl~q{+^Ar;CJ)TNn7x{T?=lZ
z$g7@!K;{p&v(cgEOrt}(k+q}%!+mcx%JUl#7KCb^>dLfv${mQ;s_^POeCGEcYVWOi
zgS!H`?osn5!v%cT=@^XjXTnOpomTS~o>=)5cX%~#aZE(>m~PG6>>5%xAs(rDhvi|p
z!(H?4M*%meS3$s<zcSQ_Dytmu-v~FWi<Sfadp`QM;4&?aHvjP!TDD<Ye-ct~1s2b|
zYW`~&VA(Kbw#IArpocvPTZ)=|fepKsBPl_YeKvHqX1vL;!Y5nP8e6ue0XuyXY9^Qi
zoGqU6AX<3U7x2vSpTusi2ER^<8m~G=K0kxqf>&L_&FWqRKcRY$oXCn_2kg@EN;J+t
zt(py9<{_={tNvxT`aT(pyWFx*BPtBlFZJ-mR*$mOi4MH#M<^@Xju^sMU+m#2u6+es
z*ZV!IP6a2*lU;o-!h7TIptXn|PjyA~_?6QX$Cv;bg=*@|Q#b}gQ^0yIWp`uS5UP2=
zOlGPcaH~EJ0c@*z&^*ejn*-?eknGu=v)zZCvt42QBPKcQvwO*yubUL)fW3qw@eM&j
z_SutwJSu~QZDH~ulU#0)Sh(h!5*PF5syNB<=VNbF^O(%atNwrzuVPXm@EoS=RbJG>
z0ONBK51z~RW7{99d0Eb_^!i@Tu;S7X+b+fs`By=7L$!NPM?Yam?OsiU{O>_*LbaES
zWGXJv71oy_2DP8tjq*SqlqUazlOdwDxBi0-c|V}`HU@2mx-1CzOD6(W%Eqc|Z^z1@
z6ucHzdk5iw`WmKCdnau{NKsB}<-W~K^$&QW+Ap&_tY-0fcT<!big2m1_8vZoMB&t|
zKWs+ry%z!WDlP&)aU`FfX2*`r0pQ~Ys;DAf6>_WAvx*OK>yLA523aE?(w(P*=*T}_
zwb^ZS6&q#heNLmZ-0J%>)dD%yJVrz)=r(#b(})$Q`G#Bbr!h6|=r6IF$ypwi>W5Rv
z(D7~7@L-q!#?(xeM@~U8ViBPLlVsyhfF{qo$ZSQqHu&t9+3;$*ynvyN;)O88A#?uf
zN6?~Zpv#!QMsEA5u0p(kY^_{rRD;EU*Ad2{F~oZQdcwV`=orBA4VwL8>gJz(2lU_u
z!`cM3oxh<6Lt39j%LSjT83*vv1pu!+!vxp^d06n^vuFS_j?erpFyqmMm!Gx_67>xz
z?7}OwpxuYf#=?Dsk>SG*YT=c#3iS`PU-&7)0ab*lF1(6xNcCgjg;)OsLx$y!?ZQt}
z1|l-Oh1VQKIqm~~4f3||+CKonH+Ar^@m&z}$cV{nv1R|54pJ?u@EibQ^L?m`D*5BQ
zKq^lGGE;Ka*!WCkpB?6%?DOVSq<JF`nDe0``k?n~vZ2KdO4yXhL6fJk%049u<U#ZI
zKzw!sa#fLs1PRy`=oooenuYBBwLl&bBy9gv0r|Q)5e#jx-vD_d-w-5fp8$6ndDN^$
zO|#wA4CIjXX|b=U1M*El+H8ejIP#bv?e;kw?OWzn^x0;w#L^>=n->7-wf_h@MV>Hk
z0fGy$urHCr(r46W%oF*p`90L^w!@%7<a_3yf$X&-oWYZ3Q7doaFieX)W!3}PZ!eqy
z<Y{vqkOTH_3V?jyJcP;LX8#uQ5cz@GiJE)t=OI{;XUq$M9JKF%y@>qKWES?2{gD8W
zXH6yn58K?VM4poYp0P_|5hKr=ccJDb`&v@;1@kE&M~v|=fv=IB<_REX*`w{qT1UQM
z9wke7=_zuP!xGxD$jv%Ig-bU^<cpFC^x2=XQE|H<0ee6JxkHeU&6f^F?i3_!e*-cR
zxl51+y9rN@d|8mFeJw@eZb6#u6Y_!FBS?$g4Ec}TD-&q5?_3AuK0!7a<F6qXM$JEC
zR@0uJ!c=?Y4f7QkU%l)%omt<-mA)nS5%TO;xt_PpI7U_WG0?)uJJQT&`zQzRn$Kcd
zMfL_Z`<wJxVLu6$MgA_gms@N(leR4G32<b!95o(`JF0&BRZJl=PHHZ*Q_#4G*Lnq`
z?bAmS<0a{W1C^i5MwKlXj!?eHl~0ib0gg~EhfYKat+&w)M<|CHft6XbkvKw;ljP~v
zRy_Hjb6OmdemGExl1ekA?ywo;OJ^b#g5h}O6I@uO%<CmH$ou1wnbvqb0f#N$hss7~
zS#&!%Z21Glt=i&IAr4#QtU7ElyNbgWeo-e<XYmwJSwVg;*ui`_3Rw+oj;sjBD{_`Q
z*UCN1oo8`R6LyX*=1X0Jb8N9d>TtYL7{Dlvg5h{2Sp_UAEnBSM=U{OnO|qgk%P9K+
zCLD^KWB!B8W|RWhiBisjmiQv)nKQ8n$*4wli@+Kpu;+_Z!3G^|L#GR5fU=(f4n_8u
zJR8=d?QupMzmx*^aq|?^ARmfP@d;-G@X1GZ%OgGkn|4fQ{F!;^b%}Yo^t#IJMY8H%
zZ0nP~fs}od6;6MOFATf%q)n9P(FRISR6Py2Q0yQlfPz=>M_SR)<%|!j#OgQQYFay8
z{Ra;qr@8>8l53@5)77lW*&$NiWU?4+E?cvnmM^EZ>{v7X&@kpUq*csmnEU9xY{SuM
zA9LEs108bQ>9*ndyH7skF}ZDcM+iR<&6bpE{*zrJ3MT`eL^68SUs=z-G_yWw#95=J
z3<XlNoHhJFVJrSjA~U^e0qfa;mRB-PDBQ%tQGD>9OU!ctPoi5x)(2qVXR`=i0#MdT
z!<)0tx4;HeU+q@Y6z43_ss0K|C03^?kyw3>#@}%9e;R?$K!UxBCHOiRmODOi5+tz8
zGZ}xpsu-Vo=>TMb*_0XH!bT(5<2e>}WvgIt0+H>WK_H?p{c;NIDAIsOA5B~pLXRO2
zk8FHK*$e0&ii~(JK_9I>BhI#@>~hdAFS0|<_vQEtFj;^v7(^nUlluwwZKW9Ofb*CF
zs@vxU$+Lg2fP6s^Wsj5txk-?Tc5N|`n+5UNKc~<Cq98@~vMoSv5hP%L1J8=wD#%p(
z_jy2W6C`Axg?K9RB|&D|_s<4$yCD4agXJ)0lNiEy74J@he^{81k9UoH-Kg;qLJd76
zL;*<Q9@fc+Q^#u=_yG?TPi6`4JLtYyU7-a)8(u+>@ei}joMwDD(tke+a7F>!C-uK)
zy_g+|!HJ@pw>|N`J0Q}C7anvYc@Wd0sD9V2<`syXYPvC02T<x&<a#0RF=!bfr(DVA
z4`CqvhL}2VqsZDvP*BJl2|1QRI%o|y-KRJ!=|fAI9<K`M=X3S$LifAXKg(3h?Bzp}
zt5PAd<5di}VQJkyyeXiEbRPCww}$rwvNiI>X7`EXP&JvWmm2~?R5|*R7@6f`jsj=9
zt$Bk$k0`BWehv*!K~-S?a!&1RHs@q{aX>fcQI9V-NBwcP4KEPrHs1!X^kcJWM`ua5
zqY;iTTwBho1Uci%G~U<er|47s6hyS$Y`lq=1=WQ<zG7UcsD6QmHGYwBo|*`PHr_%Q
z*OE5^mTy~4RCBOJYP>_Jq4GBamOW{adU`V8yZFF>s^^%pCk?5`Y60KPaj;j#gB$N5
z99A<UfbSz5QC-D=ze2b{tr`#be$GCsW+LKh{3_vQwHLLG4-jsV-%@Bi$T_sB28dqc
zgM>FJe<k3DI8M6?@VO7O{B(647TPG+o42XEz>UVQbDUoF{gr^fL3mi5?*;rQ;ZgNR
z&fyT@-Rfq1Hhz=vUiC1-^~P^;%zf(D^?<+4DDP_Z9E7X!ahBh&E<&8u_#NJGIj9bD
zy>f7ISRE_?e3+5sQ~rBkY8t=G0Lw7_yX$~_kBBm>(*wgs<B#q{4gha@^Qwv9>9lw9
z5yIz1e{OypE0a_G=qqyCXV_jmIQpsttIFo6(bpu5ooHW<rA2=sHAQwW0*L4@&3%}D
zz~=L!zmjI{_Fpic=uv65&CUnOqQ91AUG|^B&**O?z`fc2BZMsaTS2~U(|$#NFMVFK
z>ox-UgCIxkCmVpgF39g}GBWxn^B<6r*MsC_^bJ9j8T{?>z}_@@bt7a3j|G*Ye-^CW
z44%Oyy=xx8ToD)lDh%we5_99C(G<u`^l#=psM~J_UjfIWf0w!&%pm15`d@+}W~O9D
z|0y%M*$ggj2WCiIj0l=i7&QgE(+pB>qn1U%MLhi+TuL<0;)(V_-0y^Ki;lMr;dzLs
zx521JCrdxX)4wAbeS+am<vMUZsv~wp*S{nu{8IP48GIhzAzET_MK9sk57}?3)V++$
zV5I*v!4P>b0)wML!Co_ipY{WrE*RqQ#~^RfS=I}X6U5<zjlilT5`M=Fo&_Tvt(H0i
z_ZYd_u+%AQIwdOFW{uwhk+Op4Vp|#AXi*YEdBN2oV4Ez^*w~gAG^>DZmb!Rea05C-
zw@BUR^MZF^PY^vt=5ljhu!n0nL$KR03I>bzSmR;e@5~Ec3Vn>GC1SrPFSvOYuo2m3
z9L$42KMYMQzGeoL$<y=zFD0v;czTn(>%>s!5I)GDCeI(hXVZfMoBrjqfjmS7%d`9o
zA!SX6<^aKqpT->n<eNln%l~KScGI^^tRHWI`XiCYiQp|zE5VVbC)f;cfodjln8-ZK
z|4|5V(|3t1u>5CZVNFkRBe=-&AAt}wJ#8bb#LJ>yA@Y49cv;ky7_{k`?_k~AEdL6K
zcGI&&dM*Ehu$oOTvDvUyJ&+zTntse#@3#D>Kq8y|V>5d0wfs$7&wmm*V)?mGYkK(s
zAW@Is(+uPYUmw}x@m~Z&HNC>QwR`+jjHX{vica<TsTWO0IrQlsKh>h?*Ts0~HjkfL
z(exYE^n3hau(av7M20>7S{Re2*NLP({!bSJd4tHP$Dcw>)AS~hb3A^<>AVF=G<JLZ
z3!^~ZCbGu^_FV=D=bRAeLS7iw?uND6<I_rNh+>MCC!<mR=qj+_*r$0LSn{UFKCQQ9
z@QEn$DjqiA#2AC(@EL}tw59RMCQwV8)u%WuL;Xi1tRxSA;hKCPRpa*wtD??SztQ*u
z!V}eLm~7)Sgng3xZ~P(QqN2`Dw0V}MI-p)!i8jx%JgT^%Z+xEcVs!?@t?>oI&FTVB
zvhhX2E0FxAZbh#W^CVYuqSuO9(b=r%^<r`I%7?nUjp*kDQIgt<-XzyEeD-A=;8sBb
zHeaX^y+e?Y-AHq(6C7dt7kFOuD`J)#jPXA%0CvAgGL(H0QV@tfAjVU^ogF<W1L&I{
z(TC(6mCEM3ucD90+<Z1)aTEQ9AVtRb7`69N^I?n@_F2){))1t~{uE>=T5B=MXxRS%
z*Q0fU><<2zHT9z31}>MfYK~Olr^%jYU4zu^F@s;Fy__q#g1u(&$!1{lqz<-w^#ouG
zB&)FBoQ^vP(M1*yFJYb|;AXT*rU8RYiHk0lZZN^)OMxvB?0(!rrB6CRFc{<$XiA#}
zdjv*s7O<t(2o?kL{8^gkWfpJQ!UXgEHPPkL5=QqJ`mYs&!RS_?Npz){C>Y(HG_0#E
zAH)M@_SPC;CtA$f!pzoe0oEe@U}pEz@wE!}cQe>H8Q5y;B0L>NcLklwdZ|+u1epiu
z@&-@V%NC7?ESCbAR1blW-5YgTs!q^2{hHvW#_4wir|R)yg>?X#(c@PA5al@D!Drxe
zD9C?|o35taG<A66!LZSEzJwO)=jhUOp`^9&3u;S&T=X(J<u95DIcU0==11{67)^T_
zPUGF4kdLNI_#h?sJew|+t8<E9t7y7{JC=Z=%r@<#Nebcps*r{DrmJYW<RWR))hGa*
z0xOz6Eg=nF)pn-QbPYTBR4-WDbS=vR>avA^_Y)4OeY8Kk^MSZ<e>33gCSu42tPEV7
z*z|>8@c~0yP;oOG;g@?j&@F`X)OnDCrrQYP&AK;2KzvPi&;aYH-pMB$_y%p$T{O`+
zrTz>^*7Ri#DNLA!rb6TihDYTEJfQN+5ZwA7@|10+s(+1_PG>L04C{X(;3ENmzm)Ip
z;eAP{%)blN3)H{D7ZwW{>R+Wv)JHt^ziMQ$+6L;?|5{GD3~M^<Wc_bWM}=3hSJ|K7
zghKTv$<0yOF9UXs<c(-B{uPW^pYM5+jUSN4%JWMgy0LOL*E3Z8WRE%(*Pvc5L3^Ku
zf6xSYif0na@w`>V{Ct!H@hz~v`eQuDqDD+x{Uq7(8s#HKeSwURtk{=8+WJCI5gK_F
zn@;9_C;`AHAKMANzy*61Uta1}d;=ivN20utuln<4-V%k<ohT?h>g)Ip{>od8e4TtD
zkRh*m^L1STyZ4NGx0Ztweo1YIk@j`-eK|)AYXB_t^<0j=Rx3F@%vS(<6$hKl_nrL-
zfV__ig|E1Ud{wEB?}<d=+bAsLdr94biGZ!&fH{i`!vOKtCwxv`j1}@NdGfxooYz`e
z-$a10xM+j4Y<F9pnQ6%vKl=DqC%l3SW@WLTV_H5AUvjZ@x}2TZ?3NGe6h0O&e)HXn
zs{8=J*Zl>2C!f68uaIx{!#8Q?qeU^_lBe|B_WXQHo=;se9_1y>uLks+_X2#|9#qSZ
z@-oU}gSwt=rV?JDKEiRP5soU}H1YG7`QQitgXMDNpjrJBj@dth<tx-fSdPDfaErXN
z%U{KJ$F<4tg!;o|f4hELU=80awoSbXE%Dd#1!DK8EgZj&b33T6o(6ah;X~@tlL61=
z+s_WGe%NIHe6IExd9R&+0bgYFl6tlc<%@*<CF`Js{-|iZIsIr!9!##kNu$A|B`-At
z<#!P9X1{4iOCGKUx>%!AkCq%+4|It}%a4}uwuS$Ajg}oPVKn4FL8GNdOXfqi{JhtO
zp#n$soBft*wB%^X!hF;&)2RPwN$X~y%QaejwB)T)psO@mbhIRh2+ZH2(ZZu8Wkg#w
zT5z=Fve`iS6>!A0J`4qg^smvilaH2M%O$MU=%k}1m2A9DqsJUoCy^SbkR!i?*ixLl
zitmc7;SV7!xs9)!uHieXmwZXUK{PzxH}NBE#`BYj{Fnx`)~NY5>!uU{naCGMMFBW|
zD6*mhzb=s<MhSk%XkG{n(TE1%jGRVoY&3DLG&<rms^M=XoG^~Bppy2NyX~>zpU?JF
zJ|^wed_AaPPBCXqDxBb%R6c2nS&;981+)ByXVS3~j+@YmS$Sp}6DAywdJxM26<(J<
z8Kqbg|F9Ka8t$1iVFEjuK-Dps5u#`|-a*H;7814H@o`9OnyrQGF>!{`S~v%l$5a7;
zyUsJS!%YrjxTzqruiiYNRL`xtw6%~EZVp_#tdt{683#|IXKi5-1rxBcf_&EClBc^K
z))ZZWm<?|dKn-pZ=l1dEpirceoPIz9=!Y@q%6v;dfkCXmmCI03=2jq6o9%K!DSxSI
z>I`shTD_4wZI%ahQFZA8Y4-ny4KA^5m)H{=PJl6B!B{RGljYJR&6CN+CaF%6`o;;D
zra-TZf?}f@D=K6y>xxQpSXZ2t1n3PAheecw5)qnluFwRsO}RHK&7u<~95Z3!1a>LQ
zj*u-ZUnrBATA1_PX+Sa~2MZwpr26!Xn2zI2L(XW9T+YCXo$0}sXC^02E1lV}DJC~F
zrzcQcIVNS0On25UeX6s45MpI}Ah2-|(H*?ILPTBq)Mjh=oQSgwsjJJ5=PVvA>a*i!
z3+Fg3F@CnN;e9PZ(7Ep$6NU5s8#S9hR?QXwb!-K7YhhOYi7v`fD4>m5MTzF<PgAy&
zR+?j}G{=pd#A1=H#qTXd!~efpFzSY=Os>K>JOE=T&IRw|6ABAmX)VeX=;EyM`Nt9=
zG+}|zrX<S>2F4$5De;5!xjZWy%h4PYMix$;28%~a+CE{c*!F4TjJbuZ31+!DJ%^j2
zu{@vQwjvcO-plDqa(bqoD>aDLkPT;zoxU!t$`p=cTPpPb8|MGpZvNYDPB;#xKkIWo
z*ly+qE%V)=WdZbAQCJt|jR}$#WyE;`#o1Nk#;kTCCagynI7kurG2u>=qqUfog&5>m
zr<a2s=O~(kF3xET&0UgH3-tJ06+IzGm7CoP{Gg<x)f^CAmZ8Rpp_b=PF(f8pMfP!c
zrEzv<hOsL9WNh`aV`6{f3?sA{v(i>)G}uf&`XpxvqFDIq92B){oH3o+wK*ti*V&Hc
zn}Se!JuTY?b90Gn+1kXiVa$_V6SrXks_|o53mlWTNdUCiOu#U<u%7nnl$^1|SGQ-U
zrG45~TDnu6QczKso|fB;%Q=0lP-w$<My3#Qpo@65%!p;mK{Z{zO&8_b()c0-s`wSH
zOk>A-a^9UE9)|w!>;!THPCFZW&>6bHD8PxX#XZK2RR1qS(6Mf|I1|f>crpxiViv|&
zC0R79-vQSNm*zU*vaxos+<6Sx$puW!jUN$!Vn@UfROBJ(JcLd0O#H;JgqjW-a^uGt
zx$$E~whz9ZmhAzLnHyrya%v#*2tad#Nd};9yp4y3bAw5SpqWixO|BTyRMk>iBe|s%
zA>(6E8_TG`r)mCe(lPin0UN~Y>*oyijMnw0)5CS~k#uhze%`olV5n=PKQSkj>@?<#
zq>^*`20Qylx)O6b`qHVfC8=FbL4RMzoSx3kIit}<u|*5&l8LU~c)G5?Z*XLE&Vu@A
z{X%z;G5rlZVov8!GGQ2)MU1nEaTYPmBG%D27*Fnsbq)>Ub+_q6GF9KnDW`W0CsOsj
zSWpJUzCD%h>PmE@7)b%lrEdrzXoq6_?phXhiuth4Was>OsPRIbIHqodU9S}aL-?O(
zlKI`cRKt#)Yg!sSXB}R;ahYfI@N&<t_7&egVRN%uyAa@w?_wr-<~nOu;m-56KJq|w
zbOG@>-Z#9S9fv)3+8PIP@4-VXBZ|-eH3m35(&YW0abwP4BHf37V^}mNo*Jm@Nem{E
zeeaP5VXkm+C^ctfux~WWO|mtyBY|JM8zVnM!-+xuh{c$~?a7XX(v#fJ0CRTC`yiR<
zO~ktr$=Gmms56mD^$qs?cQTRg8z5I95gF-#NI0bsAIupQx`it<(l}0uL4(v#=k|D4
zS2BwwoSMEtl!2WY`C`8WjuUzz%(^+`uCBj-(E?ydf#F9_V)2eXAV|Yd{DgWG?(V)G
zlp+l%Lh0hj@@ia$b1<!!Xq~AY?2dK!_4A2t(XP&1bU5DMKh&A6#_Ni+2!5(5i;Nvc
zn1@Q3M`v1tiOzK25SQ&dNt(nQmS&sA(?bJ&e4?|WWJfxg$eEx+ey5fc7Mi+vI!UHx
z9>Q5s+1={ify6)-J#!>6k~4HXnT+qs_U#9EvsiCD)vK}LPN69{#-$|_J&Dn5vsCXu
zIv4GacVsK699b-xNDcMFH0hF5I^MY*AWn;hAmcHZ6ph7GgL5_1LF%C%Oz4(wfD=2M
zW?h^e3h+f_4dBbk8W>&J(3FK@JG!|>w8T?1&^a{V48o>6<~yayUBhYGJ3dkDAs<K1
z;P0@I5kT)i+$o|Sq7v!4?U|9&{V8YeD59}M4?xZny0X<nohfGu!!A?Ml=P*5h>XTM
z<DI=Z+#1T^D^(w(BU#BV;s%ll3?vN9Egcz7L7d{0f!tzu=-jd$oG-HFnGtuylYQ|H
zEl;@(Gdei7Fqw#D^ewk0)tT%YrWiPdS`RP?H3Y?u%IM<ZK5;B4qop7>9I<n~kE2Y~
z3esbYZn2Qkh2C^a!$tfHw^V5U#&gz59y{dOQGc?h@I}w?Lu-1k?U_f%<9*2M@hQB6
z@!cxVS?T+>#(sVA&?R#`18HkKd`}UKnq~ate=`vHANrw8AV9$NCt2QQf&#EVWA!ym
zVa$mIazKOyj<pf1?gR*M0UvDa-B7{hkZX!z<|#uAQ}8GU%NSM%*M`+Wv|-Kk%Nl8?
z$g#B!ma&*{6MT@f#LS~y8;I%;5h4tf>4e!+ShnGehW{akxv+J0p5>`*$2K<h;+m_s
z9=G*0;3Y2tA5aC>1jt1K_SG_ej&c4SpZx3biG(q5ukrp&aQgug>lhJ<UH``t>&P*L
z``<y!d%}bFSWRs&wZe)?{#SyQL^3%@<LrbP8I5%Cf5$NYj$!^C!x#p3<xmpbQuq)*
z^e+Z8nTYJYUcHz5`}fzrf72%ob6wv1JH0=9Af4zNpK*QTo0jRn>#n;-cI?`rW_ot+
zV*sUw<?~hf{5e0r%a2p|@i{46oxvXlWLfov{G-?-^XchUudUsD+LgyG@!0jl7hbqW
z6?;xo1?yDNn`a!D<2kF{bNjjKB(+%0dGm^`o+%HhnMuzDmP)H$L~m)Us%ZUJ&)9VJ
z)&riSA5-o7FXR)w`@Eil8$HLW&?Cq0@Qm-?ogBGvjps3=d*otPtAJN^dp*w>802oX
z<hUihs$%t;6IZX<<Jo<#wa8rE+H>I@OFktdsgV5foTc6%;IUP`>Ras@f0CNB$7$g8
z{Mb})cz%7Z6*fKN-x&3z9*XTzJ*sc(Uz$#kHuYZ5#5Z16Gg?>gQ9IO<R<#vT#pUNR
z%y`qhQQ*aZ|6;ZSzVuweZ<&Xe9Ctj>z2~NZzGE&Hm{sqZuK~XJ+>-=;amkWaw%a4!
z{x0n_{0~zVpyEPl_+L_S!MWY&wA;GCbNPAdq|d2}%o0wqkn<wx+y$4a!=7K8>NU>`
z=i(!zUQ>k_?DI0%PtEiaK{&Nfn~0$c>y~Ui)g4TIS`~ie;ZwGrzx6a0c_yVj>9kvP
zy62;5Y51bo^9HU7daggOeawT$tCOsJ1Xu4OCbf(=@%g?$YfMt)zsa=y4+HEm!@G%|
zF;TbdSjOaY#`O8{<jqjWM^o8k+<Q`VItTNf44o6splK$YK?^r5m&THVL4%wejDyJ@
zoUj|PqrK!~5ZOC^U*}Yu_<C&Mp4ro7YTp;0cRD!~r^UY>>W_`<oh_k`Kb*1Nn>2Ak
z{!GB(B!@BqhttiWms6Wbnz*=|G;vzH8wRJ^-H<!AZkEJBoh%73H-mwoCntje%*kK?
zk_-m_x)}_>I)ec~G8p_Ti3<Qag8{(FU^tMI!2qW73;>)AhSNYY7%X)&7=U#K1At^O
z@K<Lr05};8Ku!h&UdYK{pv*~80CF-I8serAkek5(=wvVeWil9mDNmB904-go2XPZI
z%jS>Y?|rnCISB+NuDOSgwQd~7?ln!Ib1;n`@QAgpkF9E5v(o5IV1wBkPsY+iPTpJU
zQt=&$7=M404R<E{(i%%4%a{&1BlRSabu?0aXC;`$=Gem{gPrN@9Ajx_Jz~-+XCS@@
zkHdnOv5t5OJqO~+?MSmrDUvK*&XYHG_4VK#_c5f(Qtusg9^QP1CwBD52e%W5_wzT<
z0HlWFoe86VXs{<FADnC!8yQUX^$aGu^crF#vUa1lucz0Db&e#l*X|z~7&QJ5hZ8)x
z_!rI$Vks=qhz<33#qhlYzUDASV9|nD8s^8D2#Jq!ISBw0`iFKR&5XSr*D|UJFoHGA
zpNCGGlrkvjr>TZ^E{8NRM+QeyiLQB4F2p3g=Ol-Q(sR1{G4sB`QK=*O$ze)BF7r3a
z6b#Mk%ru4PG5k8%Tuc^!Fh2jx*MAo1KMRf6U}7|FoVadtXn9CZUqbU5<}PelG;e+=
zya8lyiKlgW-Mr}RP~E_y1^7sh3?`O1nSP-0WM}UZ9Ou-rvPb@3AF5kFFH{FbSkf~%
z($o~H>uzgZj?ctsXJVM?;S><DBXvm8r;!jFN}_p^Vo+B%98bmvLaEen9TtrYXdQ(X
zhuU33BM?x`T~oh9)15pbv11vsQ&^E?9U0d0D)!%qb@#`6QaN<i<Zs<LGCZ6BOLu7L
zcR7zSM5%NuTFSv8JVWLTDcm0Gj`vY7A<4tNaq9fg2quAU5QgnCpAlS-;;F!*SPCZ`
z$O-ow1AT)rF2)ek8ykeE_r!YRgI)cY!Z4JT4@jnsr5jtj*r&TMkzC$8)Yl2MOdB}3
zijVZC!N^o<XBYCM{ry}gt!xbWZfTN=$GV1M$Ts(N?_vk+SQA~bcqi#@?2Pwe9zBxn
z((|QIG|>2AjyNY7!t@eId#7Wa9kK2~1Dr@DVmspfBMC!tr$X4C<j}}qS8QasE1pi!
zddG%GI$~XT3+9f#R39^^;%JQFWI`m`S#dJOsWXpnbO@0K;&^E@pQ}^8vF?%nek^_6
z+}M_-Yc{VmD4Zk+9@5K>MrZHH;C3u0os18rurw${=MWC=dJK6Ey&t)N$0r7Ra5^Z_
zQFlBY?~lbn;j{r}afSU5IIfVth}j><v|xrwYmAH`jGb^Ia5aO2F}!(2=5yl8bt^Y4
zUDJB%$`zYh*RB*l1Sw<=4wH%_f6$L9bnXzdhogbmSwn+h*;q7ffElu$k(7a%(`!MU
z<)DhE4scaiQg<Itn|fn-%Mm67Qv_q0291RZ;FC*|kyI=(I*fHBx(pf|SPcjr`pRN(
zDoduaG5r+>8RiRZQ}J|P3W5P27whVS?M-*~I;80v?CQf3(#tojF_7zzfw%Fo#L<o)
z3y8Jj_#noH&NCAI{YZ89b;2a?NH9>)LXqs-AyVP2aWFnWF{XS|<Ws%z?TJ`-GTt))
zQIBzYGA@3wie&8=N$sM~0h=M5&>1-cGrE&Q1F_EjKAss44r#%m+Y(KS4f5w(<NZBD
zaDlx8^9<M<9!Pg>9Ffzdlp&G>sb=@lSoctJXFQ2|LXLog?>t71ancBKcaY2=OiZF9
zxX&KYtH(%<bbJ)Vg7gk{QI}!e>6js&&>0A{b1EUD&{b;Xq0}24Lqq+E_@Ef9MX?d^
zEGC+d!Ej<C@*&!u4GXc}A^2U*T!<@dg~S^p>ERK`ac>+$h%kO|F=v^8g&CA;IW)o9
zUwjbu5dxT@mK>;yWb{D)am<j4_dvTL)%p?ATN}v)j1YwlGof9HEofL^=yCPw2JDCd
z@zUYMt^pijZr8dXjZz6nNirtlz`0TXb-!58&=80Y;iNu00DgCODBTAmfN3N^zl<|?
zX`B)R$n`;~q$jCiBq2PI<Uy<gTGyXQ3`<uXGCR8IAZcUe^4RK?Td`U>Op3vZfV5hs
z($pfdmrtO*h0T_cvL`prXgLLGS2Z%~Cta{k`YJAgMjO9H4oqy<_QbBtWYfLS*IvXS
z(oje7Xop`whdCVSa3<+K0eT0M8p8lEX>=^$3j8{aSz-W^g}V_3Y~5VStkX3`?!bk?
z-fD{{;@PFW6$Eo+QH+i&Dl7*1a)e}n6U97WNCsqjP6Vs@>mX?(bDEbjL~+1OI+c+W
zPJJDvfWLOtgY?$)5m}Z17Qr3tt3w^3Y)S;e^?ImAU`$HpkX`eQDL4`V(mj~i8SCsD
z?sZf~<PTbi*~8WGz&SQJ)a6?0532>~8IdHYc-(=2J1JNX@U1`AhpPxY(ao5}4J)^-
zU%he#{YRR14Xz4mlxgF5lGwVXYgcY`tv}-f?d=#14P`wPLS4*G+s_niUqY;FMjBml
zmHx6v!KB2*4Zsg*pP?-eVoc(&ldfJ44rSe*5SIEV^c;qPiuJ=cx^&4Y$h8;HHjGA}
z0eAU-AA&nxVayc`cmw(fMo2qjiQ%EnUMK|(o`^RT5MEv8D6HBs?|s~JiyZ4T81F}j
z1(AtSi>SabK7H~2bt3~EU}iEgB1Xy>BR5XaHrDQs;qjXF>sN1XbGg^w2Wn$1vCpn@
zN+FmJvlZ{A;AA8KKfV@QzJ6_{JA-;$kIL>jI{LR`*9Xye53ys3p>Bo%kPFDk03tt%
zz7vn_qQAiwxF5gFs2{3>Y-4x?9PEPn^+EGey(5TFcMei4yTv@Za*%TDGd%Io09LVM
z2oaV6&k7Uj#v71#(HF5a*bCumO^Vr)RE`cCR1h#Hb9#>1fOCV4&a?*NDhvF&`1rQX
z%V=(q5^%JWkAr}^PfT<U55c{_D-Xoe>_+2D-t&5lm<OW=zF-I;6T+6k9-)xvx}%=-
zKvXeMdfmoN8<w`N+qBW>*p<eVA+U+Q9av*Zj2w-b2;6pfh<HD0#3a%pb@zej+U@Q{
zcr>)r=sBxzn1Pc-9OAXfJy+GauNE)ii1yH6|1M)Er$}qh6c+qmD&Fse$NfVR`pH&+
za!IEMYtaQZWPDsk1SB@p-jb})%ujO<q91^L3q>p~)FI8O@eIxRrV3hGH{t?YV32q?
z?t~SH!?;Dj24aYwf|oB4C&2|JVkDSjeX>)6iaG0(fOd%6-yS?d`wU3XnQ$+VoVhL?
z$yY9D09y-4b!KfKn{!zRr66i2La|uKP}eS33dDE9`@*--9cdS%tvyX)OlZOo214O(
zq9j~jzkJimO)>Djb=`@eEO)4`5rxF&1Y<FVI1n+^I|`dX3`=1*;@c7YXXZ-Z3nFC<
z?uXW3KOn)WEJQpo_B;?=1~r*2R$5X}P8f?zYDm?J+)#sb;GMZ6W<X@q5IGnSW=g1V
zBgsB_d=CAb)zjmNeywcZv~u0XR>;0M4Qy5sYG>QSlTuW&rdP&G;SLifn=$)YoJzn@
zQ~TBI+H-cVd^AH45K}CyF_7wG^r(|jokK(0fx`67k8N1FeEo(M)P^$+B!L_QpqUGk
zB3Gr{@XSR)Rm!Lcr?H}S<EB{KdZ@H`(d=|G%HlXo5=%?Rpr}4|B1x9JR&-Qva8ls(
zhwWrs!$V1+ree(QA&jcm#bAh=U>!we+Hh@XgY73|pQ@%e{=I$OFzRXeOL$s_;MlT3
zys0w0!lXq8bC&0b@fd<l(B{syG1?9ybI`?I_RucaF%kJqTiaG*yAvDT4wuG&gW{Wl
zE)T>dZ6sTWF7cO|)UF5RW;s59*+K|mJo^#l$kt>?@?Kn$*0@~lgB^-PrUv@@ccCLl
zml16z7-h(eU=$f%2o!ueNDgWs7bHoF?4Srjkf+Efa_h#8o1wC?91drF!q9LWWP;Fk
zg9nsG?ar}#(Af<rXJ)HlFo`GWd2G+&C~%3F4ik4A(NA`^+#QI^HTuNW>Buz|V=@lO
zG@3+%NjQi9DaV@`!-$&^lOZ>g-WBVGkIFjs9YeGjT)HcWMtlb>v^Wdysb~YJ;@IPi
zY33SAqXWy*bY`*&q$Q;?Iw6s2)&;oP4lRkANv;*t?tw`N2$zm=a@C)SC&qUMOo>Rx
z$}MfNHhARN@=fi?aHlz0Ex4TsHzZ#Sxs;7cd>9^(xdG%nFj>wbg*=4p_#v%KJ8{+|
zuU?95bh2A1*~Ul{@#_!|JnKEU&QyT|5E+CSuI<hwlrW_3B0|hagjqL95IAFfK!rn1
zNd)M)k-Uoya(7DeLN%s7Bdb8qo=rxG#zPJh5Z?qNI?M|mn0xXrN#HS*?q*615d)Jq
z26KbjB#`BZOY~sKYN03gA_y1z&V*lfq=D%tup}27TX&{wo~T};`MC1VEewSZ^b><Z
z9<E&h8vv{0Saz|<R1@-<c`62kn9_VE&V=U7JArNkI0fg15z|YH-fK=$hmrj2L#}TS
zjKX@w`EXHaAa2sJn_Y>H5d;(+5VwBJ3|G3{-2|L7cArR%ZrrpKFMRA7itmi?BH4z~
zmYYIOp2^4@0mUMia}n7^YQ;%K=q-ukUY!sGlE4I!V~!n_$dL`XwTlF%zR`(kXd5>w
z>tODQHo!TiB5jiRVgdJHvZ+C0COIU=7~E%&LGj?>5t3?95kwZ*)P=ztoDijiq4^-1
zB(#H}a8h}~EF;<7Ilr;7DHf;Op;>VDr+vda7KzdC<vw3_1t2`*Vkh=xB|Vt7ON<LJ
zV=*M0@espVa0LlIddd#TU2(%8iDzy&Vry4!YFWPm(?&q*1hllHPITUZ`~eR)u)W>U
zH-!A6LuoD3e3aY~XL>-6EWjPHux_G~AqA6E$hf5-0NO2WUe~&1<%W$**Eqo#gKQ+w
z7-h>|jADcU46#2a<t78&^xEdu6|Us#_*imA%-Yh#I66+BHL7#e;IBBtmFt$TU%}YV
zHN?n?gEN#io>6L_#O=J6lx|ACFw@DC=Z0`lb$)*Uo?pwF(J{cg#dPZOtYz!huUUzg
z7duj__Yz{awWVQDl$-E$M$r~pr_hs(e$%q!5i<&DleGz3am1AqvWun<gTlFiU?$-#
zJ5U5-=r{_mN~vIXH@*<@6eI3P6y$6KLWtM`2jQ`<kpX0iW!6sA$lW;74h(xlpTY4V
z#OV6qQ;vHbH^C6!q5S5x$dqqF0)#ZkhMbOF&MBbvrSamnK*D3~8aWiZYKO-4VppUm
z#p4TIZfx%x+~LIWlshEUVR&LY6F3>n*<rjVV+KBO8C`T1Vm{f6$CvyDN@fSagCs_H
zZd5_5nbOHOr%1C<bK0>(*j32w2FbfYWSDw`NXecqjUDx1%3v&)WIBgh#?wWd8)1)@
zaoJFGY%&w0Q0bkScnW%)Nu@cPJ~1jdqri?*pQgC>K?ed7Zy~_vk{p>Nrg!i#C>hq1
zYW#MIq|Rv%d8`Q4jAOAh?%cfdbc5lOh+UGWNiaX75^y0!#Jq>3IIu~9=!l%?Nyvse
z8;{Xbi5GQ~cjB0+$B5{#=_J21Hd;=bK>x&OJSV{pkFm3p^r8)R^s|$BdQgbnp^~ib
z1lft|ixL>cX}Wx=)+_`RdKa>6^Qu)VH$Z5!2W^OAb7Y4~A=Vd?(4Q9Z*E$Q~(F9?N
zK+IN-P{WVPd6ewJHf~zK0cS;$e&kV-%oB%0?~nMi7UsjEX-o}PZZO3)%Rt)takmcD
zdasP|oDr@9ocs`DPBDP~Av=sHkd6fe;`GF#ySmEjEto8$cqeRq-=U1wdMByr*m&;z
z5G!Jfj!-CT@SSTKI8TxIQHbpv;E1N+kkip<&=Xr5*e&P5Y)UPc0F;I|*FHNwUo41|
z4T4rn7=Pvn9JvlzaD#9N-F3Rs=z_;_B%28@Z47d=QFx#;F03L#J_@kTX^5AT2{DXv
zEdl1o8yJq7VL4>-iWb-7W>ZUU?r8ajt!<mu$5yt-RxI7L6eru6D1aw;%)a3KgA5Ti
zXWW>x7ofj_x#0m6+c>8feS<JKi2abbLSkPewj0S)%7!$PuPmV_7$9fiviaSt4{;d;
z$M|MVhdVl8g(`BXeTW4*Q+l(2?W$HgY^X%*nH+}m<E{pAEQ}5m5Jr{`U56gASP#rj
zCbh>9R<gM=LD7@tt?O3d!AM-kI5q+TN)S$_MU|Y5u91W}(30bruraQl^JIv|m=abO
z_a1Vwc}C0HrOPEI!`^PLSaU=)h(Z|=!!9F>#mtAXY+Y>adL$OO58~DXazsCeyDDHj
zCJv9;+O`zQC>YdLvH^B7JDDS`+_RE+r#p-8F0BbdEhlDv?}nCsm<cg$ZIQP{te<%*
z36*n#qmLDI_=1oY$6Q^|TE`iQ^<|JQ-c6@I(mP;0;Ar2Q6eZn8d7LX;jgLqcRx}>`
zL>O-L%N7CaX5M<^%8kq_As`XcpEwh2=DmdeI1>@_T_snSb;KZfx~zSa#1odaV&l@-
z#?}+H^^g;FCir9nC!(75Cy<*YPL0N7UJ)|%B^G7XV@F>yJpxgsM5Q2U+<s}&XpzSj
zhekYe^v?(YIw6rfHbSz!btIT!H?tIST>!I{1d5J^va3MoDzewQbfIJNhPh6N@G$v+
zSRh763Rg3ReX;e+PFlHqQ)UC^8dVu<^QPrOhch{|jMa7`h)f6$DuJmGO4*@i&wAum
z2hDgqjoU+RHV`wGq%f?wh&asaaC!v$DjsW7Q7~CKopXb1>L#C0qchLwMwrQ5up2%y
zHH(e2WAtc;MSI)UuW4P5%)!#-Eh{NaiP7FTI0ktTo@VR-BoGtt%*Nz$2?Whjy`mL5
z9iDj_NC!{nKHE`w39sbF2E!k&Psj31jwTZg`p;ZvH!nT|G0q@17@dyE%P=JO98PRK
z&eUnP#+>>{Jnb4^iaGWSxY2+xi0Pq>d1gkOp%|pBL(%~BqJ7A9yHOFA5tm~M$!_O*
zFZk(fwhyTm$*l0I8KN`U03$q=yCHlS)2$L;$<ZbP30L3YelXBkiR2JYy>S@FU{2F7
zGe>!f4q!-C$#V0~V8--G$cT-j&eV1cYGdvk%ZPD6{K{k<Zl)v#ci<11trK`TyHI31
zoa1_}WVFH(s*btaBKjvfmf7=3k$Zm33yM?%+~C1Y93BnvNRS6uI$cT8$})ncP82W+
z%Yge-T|A~`!db?odgo*WTz1MP09hJgqvJuHv*1_^M{s;1YBR1|+BvCE>?7su!40e7
zatR_9MM{wO7l(NH3^_*xU_6COBHJwn0aBBjK$QEZl73_;hLb{E)52k%b1<auEP#(t
z%bYEXT-ZRw$DkyYlR&^}jo!eM93m!&bB3V|&OtORoxUpto-Iq@XpQ-mv59B779s+P
z=t!<w(M3Y%aX5s*&V*By8A3|Ba8`_cipVB&Ds+f)jGq}(GBdOij=Sr{;Q}lUOT_XZ
zppV14cMdNy`nq^UDW2kjM5!sQPELoq3$p=RXY6#W0GXWGNr-6Tp$^OCG6)n@Cvtf+
zDhe)&BGZfKo?{5%sUVuGlvFJzSzIR~jg{+8Y+bifJUymIA1x8YFp>%|12l7~MFv!g
z*NP<7tk2|VO8dICtL8$*vFlw!Hft?cUbtvy2QG5PBO_d@qv$Z6qd^~gT}p1ZK)i9F
zps$J1aXD(~=qy*J?*=(xg50gh**xT!1o4ofD8f;>U?3_7i=A_b#oVuB1-N;mpuq-w
z$hAarASw1t6CKl%wSfSVb&}~|4m{n*8ksg*-rCl(a)S=j5bbv*c1Tb@%p8idDqJZe
zS^Ec&2^j4}KM;6i5Ozb~--8{*HsXV<o|8Ri73>kigly`JMhim5ad{ii*~3yfIGT>6
zGIq_`qzHH5>=>2G38F}`4y^eQ*jVS{6jzs-QO5j;oKwD%gF4!fz$uXwFC^(Is1zg&
z3~<CAw@>Lnhad}>y}KXQIfHD1*9m;++nwi9h24<ADRM(b*e!+vI=v!!hg}1b8_vpt
z6TzN|Q%ZOjcS@2F$T`-h@xcz4))IFY+zs0MB3#K`WNaCX3{r|X*oP(BNjsN7CYG0(
za?EwEkm`V9jE8ouja*R?iFHdPT9Mvde?N4(U&nxs`<3jNzLFq!nVJ4~awo`e=I&VF
zWs~U+oDWD~360l*0503(Lb|>!?^p#`WPMmdb_;_U@IrKPS4tw3ST9_I6Q&4^TUm@;
z1fG`z&(DDu<iL0XN~Zmy9JtZIWmvf{gFryyE}AF=Ay6FV2r^p(iK^Z&jXCl$hJcLT
zAea<7-XnACXl=%1{v{`yd-R3NRef-~Vt8e1r$gptYulWVSxyYxh%}`GAFviv=J|z8
zo!73?&H;pE2{U$(Cor%Za`{j~80>xMC>$ffH+R51U_&X2M+MH|kfR}E3!S7XCNu~p
z@_0n}2fx;h7uHDDm^wjwmmb1JDn>p_<zi2Um<R(!h@qT1SAg?hyy=Bqazj2hXTXR?
z0%%DSiP3{C)20No=)|Uq_gcqVDSZ=C$DShGdNBfGlk`Ce?rb*Eod%Qc%xH+a7Yn4r
z2xbrTJ_zS}`t~q)1Q-;IfzxwhUhN)pBxcNwR|#>kjphy--MAs5%M+P&3=IyG^m}=*
z5leP<<!C!2Y4pHdZ5l5f6lv?nRF=HU#|e71bW_B@BFUD>EObPik`1PF+yUCq#b6JG
z5DYX=cJ9ytX%c%_tSNIhIAfZHi_ly!0A|*`J;oJ?0^no{wpH@_j8lb&IOJ$uwKdkZ
zbi>lMF`Qa3nCQp9p<xM?Muze28-z@>k9}AkQYtBAK6$=@ASi)bPD$rtE6?M0_Vstk
zWf+nGu_zLbh>JR6^9(u0k=z6fj6Ng4VUffka5y@c139UP8C}V`Gh<mRzUr}7bOM%K
z-?VUy#ULC3w*UxC7{W?Q0D>!fWa!#_YzK#+Z*JbfeHdLSh=N@Tevv@COX|aW^O2bW
z8Ra@ks>6RI#N-ybSPI<CV=Yu~gz8NyBE2hE)`Pl_261pq>&T?G|I$c6cw9URZ|uqT
z%Mq;XMnWG9Il``Y+v0#T;ia4rGUCXIeVok&rj~V+2r5KV#0T+~u>O+7hqxSxVIXEY
zqa+CcCpj?oqEU`&2%j9Ek})~iLfS9HM$C@0*5N9$dBdFyCb<H~2sxWZH*d<#24iv@
z(z)qMUdt2t7PIGMMj#9^eOM0r2399`ErLnUX3zE4RCJ!kIh#aM(Ya~nKCDCUOZ0)?
znK4G>62J3sz)8b(;X-+@F_gwJxyV9htr_*yr(E1m!bT)I@e?R+ETorabO;l))yKI6
zX3m=&)Foshb*5H4y*>eS$nxG;MOdUCr45gkB<d$pyE=cxp>yu4NNx>9+#BZR>fn;y
z+jTUt6q;-nL}zAl%xz3O85!vmzHer(aLV^rNLqwd$fD>Qo(w$o{l=x6aooG1b<<W}
zZHJ{1g7DT66jq10nS^+T$nQIa8A*3Xo#RgFkG**2@p287b`aj*4N{#O8xB$99lS{)
z^1Y>XW9zatD;@7ICW@PTZik&Lmpg9G;bZ3Jhs5QeqikplXAc4!hOa{zILd+Kt_6P`
zeG-ejbj^wDH_(Z@cMP*3q9i57a_M-KSt+<)IDUSQ1D64vYhk@{-ucwN54#}AX{83c
z=sn~SxtXsIJOYy#5Wz!hS89E7gFZ-fat1k?oe}I0D$_eqof0OOGM8$dy=oTECd>34
z2Sn36@OGZ3Pn5;8(Wl|^KeyP!w6>bB$mi2(p%@8wUNROX$_R#=Iuc&4+q`BCNIQUi
zoO5ReGt*%KuR$OK${n8Lc%3ar##`llg@Fp}cp5qes1A2&a0PmH?zuKfu?z$fu8fnd
z?tYmy`k=v47vvfE>o}?Zud-{6(X%?vXIX3(!o?<#Kp=EW$VC<2_yR5=h~izZFJRcu
z`|UcA*nF&aF*asx$LlNMmZT6xO;o^9n-)c;tw?C43KD+Q{gKpZ)XHk|!$}mSDy2ed
zi$t%asgg9QN}p$Dp7UNm0-v;d&O7g%`<yv*=FFV;z(J@hZU3pAc~&uCDS(w@Y+uZJ
zi7Ey1NHf#IB1lOd{GBTsja6KqV`meyGp=VwrS{m;3??W4x;WjLbMk<LlsGDm*5{8_
zmJs>w;d~yhM;rohjooQxJC<ekYMz>^ytCnwDq!v&^p_vchPceZ0%wMioKup=K^HW`
z<LW@M*5n}9j!?~y=}Y6h5C@{>LD*B1<EGJNzBYSIV05=3$q(9CxbhU+0t}7$J%l4=
zT@o-Vfi&YofT;vs4VNF$HkhjkNqY_)a_<hK8#D3ZR@D~3;3!k8R|Ge)V@ab|6bGT-
zwVJM^Lfy@i9T`&vLjuETMN!^9D7lT63(?om3=Y3WDsr`|a+thp8N<{>{Y~@8S(t7y
z%YKNx#;hR0@ZbXSN#;xT-c%gH66xhgs^<=sGm)L((};8^^JbWGhRL1!)^;MUdUHoE
zKPrtA8|DI*jrx`39A9RjLU2C_yyX0iHnR@K6!*^@Hth(uxYX5wUMOLs0XRZ1TNN8B
z>d8ZtXFavJLn8v|1!~%z%&%-J4^=JYUq45s717}=M`E>tT!9H^+SZ~2>^!xuWVJm#
zYJ)X}l1<1phbcxF@1lpVbwyA$Pec}=ywt=G4$<%~fR=W<4Kj@97NC7F?#}6pgUJb0
zk1a%xf%m)85|YF`V5kK4s_vj-W2Z?`-o(J?DvolCso*qJJcBe#&YHWpBcceejxAhZ
z(&590%}<X!569LxoP<IarmbeBVVeq`YVs%oRZhG&2d<F!d&e8=hSl`=dKf+!Da$DY
zDj3*-aMWN{gIyBN98hTpF{BYRYQgBlBqyFf)jW(S&6yNuvmp2tiH0Y+NQ`sUFd;Q-
zPU|U~)sp0GSW7xG+eo9^U@V;OhFbu{B@#yNT`~fU29^ms2E)b<8Wvcb6<eMixY+=_
z9GB5%Zwuy-*P!Z-$%{6fYpC9_E@4Epb|R$ynd*J&Iby81HO6wh19#zqI?NQ<*%@|+
z*+_Qn)TZu=-sr}uTi0}ovjlbTe)wDzW&>PsB5!scPOeI&1;k{>Skl8D2)a-7Pq7&J
zEyX5Vv(3gaOM9QnVJXJDv{F;rO@0K!Q!|htRtDP=a(FpSZU0<00wc|!YQB$gxoZk;
z7o*ct<92`pLO#rMD`bQ9+qQgIYp^fNN<cUN%SUBahRaPfh@>g@3QQ;PXiPd7X5lQ)
zJvu4BaO-JS5O>3q(rBczO!+jcfLzZ^Q)eebiu3NxTFgdQm|5#72Y~-!LWH1XCLfvQ
zv-R050hgZiKyn}w_DRXd6?B?cb1su}yriVWc|#VauE=fez(vupdARjr$37t$BKBd-
z!Dg=;quD`(_zjLsz)tDy>)WcBV0ldrG61`Pl!wC#nLP^+@_<|QQ{vh|Hq8}>rZ{Ck
zL>~^$`s%2Gz6<{k?FYbTq!wdm(Pfg_IcKqUl*R7y`v8o*{OE+oJ>EbHEq-ogXOeD|
zfU{%@?R(-tJFBbuZk4z@-eb<ov6<o2sGLM_0l~CK8@NZL+Qp6lS!Ecu<U=T*1KeJ(
z)*5J{5111v+(fQ?B4V@ku<TZ32}Xfa-D5K}4vtL4X&W%;Tx~AZv`XwL?w4Y7mG?{4
z37CC<P<2#?P2s^kxn(x%bNRZ~v|=JpjCDKk)9H4wYpm@eSqD=KL_eB187320cyI<4
zieIQQtA{eX_wGS;U}+;JXAE=(78?|=!U8V5WwC;p1_LvIMCIh+ia^)CQx36exEWNg
z6;>}?Rgrmpv9*%y=sdv|g62zK2=Y3EIUnL)1tctTG0gO%SZX-kc}WLNx5<k+M}6Oz
z=bp)Ip{StHd>>BuY}uAxCS3o5w94c}DHG;vwqpyI9t=4+vdLJ`iypz%6}BESG1L$9
zkd1If2yJz-rjXm9T9o!-XGY_KqJx|lv(7!UuFX3vv-O66p}oxb<Wz6X^zHDWG(D^H
zNNiqkpj|OG_9Z!=sA#FeoGJ^i<du-D-FK5+ro~x1jM6X(1nx0=C>to45*~b2$8yG~
zi@OZKb`q?ja2W&|@0&m=_PNco?wO;t7wkaBM&oQ^WA+&=>BumP4&dtom@7D**6LG{
z4zi9sO9=DW!5#4_49Sud%r?3{G8+^iOPiiN@`lx_Yh>z-2JKh{L^Hca9wxQL_SB8j
zT*aOp7mP-9AnS`zw%5&z(84~<D>Pi@Ts`!FDcrPd)!8UG1NY}Pxu9^T`LdgLX>)4w
z0qv&9QtUpG6{|5ftWADdg-KU^q$-@8@|Y<T0pvdri}W^53dUXiI2&Br2!HSH+%)t8
zwDNERv7siem`un`6s;hp;UWmytL?K1YMO^xs2*)}cwqwUb>P({F9hyV;S-G$1I(QH
zxob_9sSl9rMYtFm>yj6D7M#)3SZ3rcG`n}7vAVp>g6=W8hq&^D=tmY})w6vncVn1R
zG><Sr3+h8Ie3>c6VKhu-D7JG$P}TCfL>hvd8OK+xZcIp{w}*NBVx@BhZDr*kP4%eG
zhUbPGsLbx+B#I?ZyA<037@_!@Im1bme9h(L=WRM#_N>j}f&#H}#cJCE)7StPDPgPX
zTj+ua3fgEKK8eHlKv<brL*a7~5~1r4;^Lq(ThU!Y`KB41R?b`-%Nita+xNO)Tj+S>
z9IMQoxl@gP%W{~{Q`&@vaKMv@Vtb-d!I+9G#^RP4C)Y%yayAC@5__=d4v>PF9!49P
zR#jO&OpEf~rOKUfr;~}BVA|z-CTypX=bv*wb1{)|DDLDb&H=oueW?Y@^=p>QSu!|8
zwfQ#qvTNm8V5o0><08(lLOEM78CI`|k+6Hc{B|SgXK~yfC$-tV#l84hd0P7*tvl7=
z4udc>fnvp^DH{qdgt%QPyfDGBoZ#)8E2a)b#aXjQF_%c&Hpf|FmgPjqJ*YOg8HMfj
z0iM}rD<D7M(`+PvaODMeP~iheDcxqeO)x5rv}Fa-oNeI4XV$nHHLIc7A`39OhMhm;
zsr^AbT<b#Z23AKuZe&UePV<A|CK)T3HKzm5_^CC8I^NDXK$SMn-0z#0fYhvJgA93w
zfx226de7xWfEPDWQ<q?zqt!j}ASpo<!Ht33LE=udEUtDZr{H!vIWYyRSXdP^YL^@q
zyxs?{q>iNXhBibHzrxws6r51uP`_ykeC*44CkI6y)HHMFut$KhH(_6%m%pivW4GYG
z00_<;M{aeS(l@f9bb;(J{p=PJIDLWx9-OyR`g~^&SXuP887GK2=DAe}owRo$rGr<I
z07|S0>mO$U)*&bspaMApb4|Z^>0UG{XH`K1+?HRl29t+C$-D{cXdE{$m<Adw2CT%)
zBe5!CdtmdByG_=EN9A&2ibE?~TCjh>5gpdJ-C)&rZ$)uS5!ZIOi9ugN>NZ}bcGq^*
zZg08(BHTDvoQOb|>e7#!s<VMUlg$FTph>Rf=&@LGZ3?4zDr>f%=So#+YbBV`${zNx
zepjA6JiW^cmTY?=KR4i%E{N1f!A|zZZ=0ID12i1BBjHHgYaJ@>OxC5wRR*hA&d><R
zAvD^i^Lok3UslQ8=}{`*$tl8c8B^ydRAIQVX@S>cB8NC>t7_~(MNnLXQ%7}a^ua-2
zJNv~>Z8o}{x(zCFgJ*5$xm-R22I0Ho7q}Z7jX;;+6QCrX>|p|!2rD*cB7iFst>q^4
zNnryK$K3|l4<?8C%4t0>%>*R!(M=m~Gv`g$1VGUDh0qut>Taeh6n;7Jv?!9?WAp8U
zVk#pUQgAdOjb`g$<AKvt>#mFQ15WChc`kVLzcckc8X7Ei=3cN^yX&Q_$SKSfQ}fmW
zKV!DtKZ!Y<(PDWb#B@^R>KMlcuPLq2HJ@Hvrn#MSXF7PkLAyqYw6I3mj)4q2j(LnH
z$(1ZgZeXF8l0yNPF_+e2!eU_IL9lB(HZabROa)(}+;(W3$V7Kicmkv34iz_|LIdGl
z3Q;)kqs1RccD$RRXIu!qVb0G=3o#LEmitohlEAcwCq3xhu#*QdbB}K4&`w)^_Yswg
zq>LSOU4p2y9i)Oi*vt<2ft#dRT!m(IN>pRQr~tOmSeVgmnBTGdn(nVq=#@Bi=H_lF
z!1FjvQCc)gK;UTec*hel<{Uit1eMt)nP8nN*)`ixW3*rr<GQ?9<HcnPH*#+Ip-_rl
zW=tBI7?eC-s0QF&$JSjKk2v}?xk5Smt&Ze$xaAI#IEIBvWZskI@+zd<l0&IEJk>Xf
zMo(6bJ3XQ(u7*^%hqkTYh#_s6SQOJg6mVGUT-kwPMDy*GrS1}^WfR?Lt30?NdCI|k
zS@{-HX4aC~jUPPavSSMHQ+&0Mqk|!%B?->UY;{M5U<aHRe2HieYYyD=0t=KuhcpC2
z@oT?v(lI}a&D~qS2MtAFAsE5ssrv2|$8sUvw*L0shABu$>%b3rkJY-3>wBFIYr5k_
zALb7unCc#%UFdLcK8b$Vzh{i+0y&e;L>CI2u`xJsMJAQQp$&fC!zN?<g+93XBS7D@
zzBk@og)bHAY0{pEW!yLyFZN9{WHrOp#7a5d<rUC5r5)&+%wcoyKvB_39hDc1(s%^W
zQsvvIYRlPHT&jbbM(y*Exe4RlYgeqaob2O~n34GQB#j^RImy^bV@2^(E45(K5~7dC
zOnBNdbKls`{T;Ylv2<$%XSbiT&S5n=JZr~1{1^r}*gf2{lVsjHf%u6G2!v$e9g&B1
za{ME(@EMOG1vkC<@Bx*GQOu3Xnz8UYk44(pRvresA8FT|(?Ydlb4FenFmhKd$AEKz
zft_p~`-KuQbL1-4ae1_Anc5kPpZB@%5RX8(38_$(?U>l7Tsm;7j4dC8#XP*XO~6sZ
zN?@_*u@qy$yV7c%*BzgPh8>FTav$cdwHZ@=S04PLZ-Zc9am@M_a2B4Mn3Zo(<Y02b
z-yU~I&Xvp)opgO%(B@_*L8U}DPcH7pdu7DsLJRTtk=H>7&qDLDua9Oo=+t+O_Sx3b
zB%id&nd^$nTOeA^<v!hDv)+`|SPX2&kdkvxfj8m0G2F>z%t`ZQYJBq6QWl(bIQZeF
zM}{0msCgLe371HdZE1WtZ%pHjjrIKOj-trU<amWqaHZh(780q;e}!8_P?Ys(o}rkq
z*r(=Bc9rHltjTu8*(`RD&^DBbr%uw`RhmrAT)Ys!9j7EI7{Rp@f0b3qch_%JB(Gzx
zZn$EWD7mw-2eD59h>gciKh8IbCgss|ge(yi^k=;slopePN6z>*CjCox#%3-%HaqKq
zxLIm;brp!=%|+!p$5dLgw!VJ(GGOG$+F*oBoYQA(WLhw(JZQ4$&byFUg`n>M&%xk<
zDUmPlx<@YjIcc@?vEoB{P?~e3Ni97sJ*ozllX#A$b!^jwR%=Q?)p{7CD6v^Pk1fp=
zE|uJIV84Y=rnG#%z_~DGX5946&qlCi0mP{fW@!O%$unM(d*T}`@mm_<K$=!`Z3cA}
zU6(<d742qFSJCYmv{}*J8Prwu{tViz=%+KNtLT#%v^ippK=mC+Q;Lq~R9h5Pea}ok
z9+*0=r<np#QB~Oy^>nmAR8+NgL_IxGAS$XhIAXld0l&7*pZa(pbyYicC_swdWw;67
z1YP)HI<DHOPl2fDkw6?w3(JqIa_Uv!Df)PU_v^<ao`a_&_G*Nn4n@cCIUWAksOjT+
zx;dagRCJ<(=!uH|Pe)YQVh|Nop5ASGQno-;v|Pee-!^<NN*YL;75#?*4W^F|9M^*i
zVzHZB8n(Hu*v*Y%zZrRdI~Utk!+ueK6kQUXgwcBVxE`*`o!M2TR5k`MGRc7oRO8N0
zA5SYUy6CbiE<Y}inuu2e@k$^Sa1L7??*vn!r5puP*O!y!8bw4spyr>EmLFIA^}snR
z9U>iF-snbUHXIQUmZFaa$SE)$8iBAuFN!`8NCW9kMIR23)0&=C0ubYUBNz?{s7ld?
zGN`AhGIW~KQ;~fylH}m+5gW~UZCM}D`2rNN99$7GP4|Jcty$K#j2;oC8jfd<kK(rk
z4D_bxL<vptk7cxuq6agm+pI%_c*TXjm{UzF`jr5knGQbkz;QkObB2=r#6u30ov<<Z
zivC?7p+$=ReJQW0<9bpFEmN(T{bptVV$ObxqRP+*Ur$B$TXMA{@@#}Z$a!^?>K_YG
z#2P_-@)_SnoK|!skluKv1h+|x($uk`V?%nxN4f2{nBdLFhV-n=7o{%I;{%E5>WmKX
zmSgw`R`n;mD+4@`I#q;}grclkMnEXbaxRTtTpq8k%P7-|?#`gCiryEX_AXLhYjQ%|
z)a1V%8MH;wa$e2#NK;yK2OXg3-8rwWqROkKo78Wb(2LTsq0X_PnaD&r#Q5k@87@k|
zZ4Qqz6*~G}QKfu?s;CDB(wpoI6{j||<o$FI;@2VsT`T&t4BDdT{{*Og9KRlK|0O5v
zDEiY3>ME+dS}K*!@Ls+&LR3o8wE=3c!F%KF>YT9i;fRhFpcuj&ToA7=j_@3;?Tc4k
zb?~~yi?7T`5$OcZs}Z7VihjVp^o<WmrmmtZ1LU>U(@ST2W-T-C$BX^dPa{O<DEeDx
zDOF=Kz7Uo9V6MTP&9d%{7UbZ60~;*KejJF1uE?ORJ0kkk0;HO}m}|84kAf5ZNp9NK
z=OS9Pc55y=A`eEMpUru9l=tuDyhX%0@$bj0?-nSE{vd;HSB*|Y&05H8QPl9_T<OlE
z5&did%H>96bG(`<P}I~H3Q#@OH=-JUSyV^SqR+M{qoU6mWBskj;5$V|{~ggY`xpPf
zpjYUT2p1)+HOGeZcr3t+2`1-?=Vz+u-wlfS_Xr~wQOm{{M&+XCdjlTm=SFoejWED^
zyehzFrH4*}=Qf$>D^dEZ5pq)#QPl*ZnF=lFcAIFcpxbStl41<DHOD~gGmq(C^=ATS
z=Sp=o1&h49&Ac13+MdYZNY1FE=pSa#mS2lbx-CL13AuI=c`+)vH^z{Hr{Wq{BvUPw
zInfmVaxSo=XwjWp6#ZcgFH<(Vc#DQxRYsYLs`gB&k<dhGY0*TqWOsxuQ+i48%}at2
z45lYeKC~-3Nktg2-d*pHl-Fh!vbCOWAT>DH%1HI02xHyX<Bb7coDLf)>v=TbXBiw5
zP5|}a+4kaz6Av95s@J0Qs@{gN$aXTqmJYfjUL7q^6g`$f+f?QwnY=oRsuMBA>c#J`
z<-I8NIDeJ@$#}h(V92g|{#L*P{kNmc--$2;FFk%Kz?KVoPS2{Ba<5nJsVL=Zxfa`u
z)#+J1Ka>D};uJc*o`d>Fm@Pf<i^%-yOhl84j+QA>4>K9Br|7)_TAUtE52P!P>v<ug
zPAmF}8fv}5O<`j5FGrcGqo_@4_8IAh#*VO#vpD_Ndv=7#SI$p(=SR)YP5aZ(@Kr;@
z?>mI13c9p-d!TqLs5%tHt*ENDl(YQ{XWnpmk*Zue<0?ZVFpzrvP)eMjAIcR)O-t<%
zRMmrwsHkdsf!DNuJvT<qO3=c4gmPD)VjWaesle$@JXEi|(oN^eKU}K3pvnrBS5&#4
z3)1XgbM>sS&q%8p^iszGy<F2qFTzumt0fD%sc6W9MZE-7?LjY!s%prtl%U>Envue8
zneTNJ^!KSoe+x;|_5z>TMNReM{ydP=imL2JntEl$9>oS*=vpY^n4p(_xfCcJMT?9Z
zlE(LHlE!r*HvDabCqh7YIl|?^T00FE>-7=dW6>Y`0`J*A_^$-leJw)qy`RN%y_MoZ
ziz0ss3zx<7uSWQR2<z#UZYbVszSq+&>yv&(z{Oy$kLTZrP*d>sc-|VJ2&rD5dOj0@
zKN(>?pL%-byCd+m<jlvj=u_)WJ^iCGE}x4~gw}7o>gnsxgV;i!YFRx7p%-|q6+W15
z4;n1zHHhPrXIp4s5Zl~;ioH@5e{s4AAFHqb2Gd#T@mBaydi=aPc1nZk?6iDI8~mKq
zX@$Qn4PV%Xe{Ndd3O_GB|0`|y=ckjc@C(udSGM6VNiVm;m!{{h9&RKUOc$mTt?;*}
zldbTJ(y3PX#p!e_{2l4^NL#t@Olf%={F0PbwZSiK)SZCA^sYYe%lg1C?*o5#ANUo0
z;4Om!%)vC=z$ba1nSS(o{l&Qe45Vg1v!!RGCY`WFgx^)8A1bQ}f4T-=Yxx)bscFXj
z=|Ic4^ALpjyj;uYF~e`t&oh9xwd>n`;6LgEKNl5i%jf-ovp%Oocm2E3fDHlP2NL4%
z4iD13!Vfsx&)+8lK8&v5@AJU}p8|X!y)(TWba<1!P3c6yhgS?6<RqT?`#!?9dh&G}
z{3n*rl62F1EqVTTCiq(0xD%l*pCyLhoOkawcyr#p5Ac+l{NY1}kIt#huW^Gn=jq1)
zzYzVe<ArHvi{Ar)4_mDI?~8!9u)_3Q<g+ghKpu@`-!%MYeNGvEHE%wBzfb;D)?S#J
z{PREi<TD6eLt8zU0$wA1tHiQC_}BM=Z|no_^~s;Q5BBrPIKzA{ntl}UrJzso$x{J;
z67b=OmxDiud>)VaazniQGlQ2gJ^nX=KOE&g87MCSzBFBuhJsEcqWuTpZT&U`nXs+j
z-UWCYK2_Rn@EiNU@3Q>C_o7`ooIBJ9|C0v4BrS>htL2YbK6)y`F96PdetG4v0adqW
zBA@zv`D)<5R>S|g;TQQT_MJX(%F-%JxD5Xl@ZmBb;;;9CUkVw#EuX6aZyT2z0l%^(
z|4)ElUDzV$e6&wKNBh8Gs(1i5i0#+`+p1pg=CR4%CVq9a2kUaUar4_qFp|c%OW}(H
zdn(w3@9o`lAN&mN>&?Mc8fJ6{d5figPIGQ#^{Q*HZAXHg`<`84=f|rP@ToZS`tl3I
zdf@|RPcU=EZ9{Gn=&0G8E!+Cx^F#D~g|!*1-%&@IhE?tKcABv_9V2+%yc?f4^U8MV
z%~x(r7G`JFyld8m&9rqR!6t^;vNyr9F>k&J+cvssG+$=3+2*TA=K;H_*IS4CTgQ9j
zFu3o<xGO%lppOiv-r76hCb4l07`RWhH@+c~ZCE=A(A2GC%3%GbiP1HidK2r`b>UxV
z4wpT8e)VQ?GuYnz{Ra3I`H=Vx`aRqh1SbR08S*2QO_`q|8)3HQ%*8$u3U@Gilhwa*
z+`HSHJ7`E7Hno+c^lPw`Mu6e*aMMleH*Fjp>#ZDFIRbBY6h&7F+(Qp@RQOBSH9xaE
zadjZfoD1A*ywhcF&1A^E{4p-0kcv%Z*}iutuhGCqBHT=$$!iql=ArnE5I!&DZbcXz
zYfZy*!<{gSx~;edS8argN41O?`@&e#3T>E_(od<#PTgX-W!qKOrep$~8`0OUm>3*`
zs&5IQ;Z6cy*12p3ZD#J)<fyirapF4_a0_>5DJBg<HpG(Yu;m)2;f&XepnEqT>P-eu
z8-wo~EoY4c-<SY%F4bC^F@CQ%djwYrVMKZ3a<%{P&aOf^fQt_ggNwqLwm?_~I`h}t
z>o3v>zEls-AcP0@d$?0E+{JzO2)-^nvi%?~Hd=<uM(oLaMn>k2?m^0AA*|r-job*!
z4?Vo&*Gq{Qv3<B*bi~-v2%;nSut^%RFE)>mZ3AhqO|p@@;iYM8o1Y%ZPoC5{cCr+T
z-#ZI5CS`%h#VUudNzFPmjbL2U2ssy>-bVc6s`!pF{K^3LNAt(ktL?aD?vUQla$Rxs
zkfP{lMI)z{_4BQQxS!)z1Y)ZFq#sduRlpTs`LFya2mR#r*Y_&D^e75<1~$Yt`$>+A
z$8;ScZ^NI`OW&ff69qDWXpodXwo&OOz?iqvOE07F!zvg!{4tO6Zv!4)FV$cA8-+TV
zQ#L9`A@?KyS4uBEkHStAR<FP6Foy`=DL?6h6k6l(Ugg)@zbDd<BIHkcBZW^##!UYX
z{MFMR0gQbjb(Zu?3hSB;*0uawz(YB`^iT><*E(D>qC#r5%jt(hSX3xHm8tsc`7^cj
z(rYPv@H}C9SkLeCwe-?|DXgpW>g_)k=~qTE(vvCta}8{~SN+v3Pepp6NuQ>W^ilrR
z%l~7%WL`=yy_>>0y@*UyzVdtlk@N8<`jUR``KukHj<08he*v@$O6jG?JMkvdQ%}SC
zt9<GEPX3bgNMgU!_+L&hz2K=gnf@iDC+(|z=?_mwdUdS&UF{YfeX3Tz^o*xtgScD+
z4LtsoUg0Z%mFus4c3N)eMaANAI6?*gh6wXg{qsI?m1C%$!dJO^rap}2t2n_^q+gZ+
z9#L}?{v2S%%c#pD{mW%w3+~xS+?M{lYdqm^{&n?j^$BXBKIxzMxnnLPahHDe^zZ4D
z{u@I+aXu4zJY`W&|G`LK@4xY3PY-#g@>6<+*GKva5+1(%DNp~37P>%CI^mD^N&mU0
zJpFPHgx=_D=2t^8+>>8&=un(bTnXrn_!Ir8TI7$J_AI6UJM|S$|0MS3<zK!2OYyQT
Q{YU@Q(|2nLYLDsv0l<DW5&!@I


From 1b00254ffe3bac849c989430e55393d627908819 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Wed, 30 May 2018 19:40:27 -0400
Subject: [PATCH 035/130] call jwt_free

---
 src/ngx_http_auth_jwt_module.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index e5677e4..db803af 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -129,7 +129,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	char* return_url;
 	ngx_http_auth_jwt_loc_conf_t *jwtcf;
 	u_char *keyBinary;
-	jwt_t *jwt;
+	jwt_t *jwt = NULL;
 	int jwtParseReturnCode;
 	jwt_alg_t alg;
 	const char* sub;
@@ -231,9 +231,17 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		}
 	}
 
+	jwt_free(jwt);
+
 	return NGX_OK;
 	
 	redirect:
+
+		if (jwt)
+		{
+			jwt_free(jwt);
+		}
+
 		r->headers_out.location = ngx_list_push(&r->headers_out.headers);
 		
 		if (r->headers_out.location == NULL) 

From 0686f3a7aba0871040f0d2fcca62ec8c75feda68 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Fri, 8 Jun 2018 15:01:48 -0400
Subject: [PATCH 036/130] bump libjwt version

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 963f559..587c6a1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,7 +34,7 @@ RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
 	make install
 
 # build libjwt
-ARG LIBJWT_VERSION=1.8.0
+ARG LIBJWT_VERSION=1.9.0
 RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
 	unzip v$LIBJWT_VERSION.zip && \
 	rm v$LIBJWT_VERSION.zip && \

From 5f244f86366915b4b4c42de853415a24b7e96fb7 Mon Sep 17 00:00:00 2001
From: Maxime <maxime.tissier@gmail.com>
Date: Fri, 8 Jun 2018 22:04:30 +0200
Subject: [PATCH 037/130] 37: Removed auth_jwt_redirect and auth_jwt_loginurl
 directives

---
 .gitignore                     |   1 +
 README.md                      |  13 ++-
 resources/test-jwt-nginx.conf  |  31 +++----
 src/ngx_http_auth_jwt_module.c | 163 +++++----------------------------
 4 files changed, 47 insertions(+), 161 deletions(-)
 create mode 100644 .gitignore

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..a51369c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+ngx_http_auth_jwt_module.so
diff --git a/README.md b/README.md
index 7de9088..b74fb07 100644
--- a/README.md
+++ b/README.md
@@ -11,16 +11,23 @@ This module requires several new nginx.conf directives, which can be specified i
 
 ```
 auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
-auth_jwt_loginurl "https://yourdomain.com/loginpage";
 auth_jwt_enabled on;
 auth_jwt_algorithm HS256; # or RS256
 auth_jwt_validate_email on;  # or off
 ```
 
-So, a typical use would be to specify the key and loginurl on the main level and then only turn on the locations that you want to secure (not the login page).  Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
+So, a typical use would be to specify the key on the main level and then only turn on the locations that you want to secure (not the login page).  Unauthorized requests are given 401 "Unauthorized" responses, you can redirect them with the nginx's `error_page` directive.
 
 ```
-auth_jwt_redirect            off;
+location @login_redirect {
+  allow all;
+  return 302 https://yourdomain.com/loginpage;
+}
+
+location /secure-location/ {
+  auth_jwt_enabled   on;
+  error_page  401 = @login_redirect;
+}
 ```
 If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
 
diff --git a/resources/test-jwt-nginx.conf b/resources/test-jwt-nginx.conf
index b39eb95..b0f1f9d 100644
--- a/resources/test-jwt-nginx.conf
+++ b/resources/test-jwt-nginx.conf
@@ -1,33 +1,38 @@
 server {
     auth_jwt_key                 "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
-    auth_jwt_loginurl            "https://teslagov.com";
+    set $auth_jwt_login_url      "https://teslagov.com";
     auth_jwt_enabled             off;
-    auth_jwt_redirect            on;
 
     listen       8000;
     server_name  localhost;
 
+    root  /usr/share/nginx/html;
+    index  index.html index.htm;
+
+    location @login_redirect {
+      return 302 $auth_jwt_login_url?redirect=$request_uri&$args;
+    }
+
     location ~ ^/secure-no-redirect/ {
+        rewrite "" / break;
         auth_jwt_enabled   on;
-        auth_jwt_redirect  off;
-        root  /usr/share/nginx;
-        index  index.html index.htm;
     }
 
     location ~ ^/secure/ {
+        rewrite "" / break;
         auth_jwt_enabled   on;
         auth_jwt_validation_type COOKIE=rampartjwt;
-        root  /usr/share/nginx;
-        index  index.html index.htm;
+        error_page  401 = @login_redirect;
     }
 
     location ~ ^/secure-auth-header/ {
+        rewrite "" / break;
         auth_jwt_enabled on;
-        root  /usr/share/nginx;
-        index  index.html index.htm;
+        error_page  401 = @login_redirect;
     }
 
     location ~ ^/secure-rs256/ {
+        rewrite "" / break;
         auth_jwt_enabled on;
         auth_jwt_validation_type COOKIE=rampartjwt;
         auth_jwt_algorithm RS256;
@@ -40,13 +45,7 @@ ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
 K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
 BwIDAQAB
 -----END PUBLIC KEY-----";
-        root  /usr/share/nginx;
-        index  index.html index.htm;
     }
 
-    location / {
-        root   /usr/share/nginx/html;
-        index  index.html index.htm;
-    }
+    location / {}
 }
-
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index db803af..213d410 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -19,10 +19,8 @@
 #include "ngx_http_auth_jwt_string.h"
 
 typedef struct {
-	ngx_str_t    auth_jwt_loginurl;
 	ngx_str_t    auth_jwt_key;
 	ngx_flag_t   auth_jwt_enabled;
-	ngx_flag_t   auth_jwt_redirect;
 	ngx_str_t    auth_jwt_validation_type;
 	ngx_str_t    auth_jwt_algorithm;
 	ngx_flag_t   auth_jwt_validate_email;
@@ -37,13 +35,6 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type);
 
 static ngx_command_t ngx_http_auth_jwt_commands[] = {
 
-	{ ngx_string("auth_jwt_loginurl"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-		ngx_conf_set_str_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_loginurl),
-		NULL },
-
 	{ ngx_string("auth_jwt_key"),
 		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
 		ngx_conf_set_str_slot,
@@ -58,13 +49,6 @@ static ngx_command_t ngx_http_auth_jwt_commands[] = {
 		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_enabled),
 		NULL },
 
-	{ ngx_string("auth_jwt_redirect"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
-		ngx_conf_set_flag_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_redirect),
-		NULL },
-
 	{ ngx_string("auth_jwt_validation_type"),
 		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
 		ngx_conf_set_str_slot,
@@ -126,7 +110,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	ngx_str_t useridHeaderName = ngx_string("x-userid");
 	ngx_str_t emailHeaderName = ngx_string("x-email");
 	char* jwtCookieValChrPtr;
-	char* return_url;
 	ngx_http_auth_jwt_loc_conf_t *jwtcf;
 	u_char *keyBinary;
 	jwt_t *jwt = NULL;
@@ -140,21 +123,21 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	time_t now;
 	ngx_str_t auth_jwt_algorithm;
 	int keylen;
-	
+
 	jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
-	
-	if (!jwtcf->auth_jwt_enabled) 
+
+	if (!jwtcf->auth_jwt_enabled)
 	{
 		return NGX_DECLINED;
 	}
-	
+
 	jwtCookieValChrPtr = getJwt(r, jwtcf->auth_jwt_validation_type);
 	if (jwtCookieValChrPtr == NULL)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a jwt");
-		goto redirect;
+		return NGX_HTTP_UNAUTHORIZED;
 	}
-	
+
 	// convert key from hex to binary, if a symmetric key
 
 	auth_jwt_algorithm = jwtcf->auth_jwt_algorithm;
@@ -165,7 +148,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		if (0 != hex_to_binary((char *)jwtcf->auth_jwt_key.data, keyBinary, jwtcf->auth_jwt_key.len))
 		{
 			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to turn hex key into binary");
-			goto redirect;
+		    return NGX_HTTP_UNAUTHORIZED;
 		}
 	}
 	else if ( auth_jwt_algorithm.len == sizeof("RS256") - 1 && ngx_strncmp(auth_jwt_algorithm.data, "RS256", sizeof("RS256") - 1) == 0 )
@@ -177,32 +160,32 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	else
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "unsupported algorithm");
-		goto redirect;
+		return NGX_HTTP_UNAUTHORIZED;
 	}
-	
+
 	// validate the jwt
 	jwtParseReturnCode = jwt_decode(&jwt, jwtCookieValChrPtr, keyBinary, keylen);
 	if (jwtParseReturnCode != 0)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse jwt");
-		goto redirect;
+		return NGX_HTTP_UNAUTHORIZED;
 	}
-	
+
 	// validate the algorithm
 	alg = jwt_get_alg(jwt);
 	if (alg != JWT_ALG_HS256 && alg != JWT_ALG_RS256)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm in jwt %d", alg);
-		goto redirect;
+		return NGX_HTTP_UNAUTHORIZED;
 	}
-	
+
 	// validate the exp date of the JWT
 	exp = (time_t)jwt_get_grant_int(jwt, "exp");
 	now = time(NULL);
 	if (exp < now)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt has expired");
-		goto redirect;
+		return NGX_HTTP_UNAUTHORIZED;
 	}
 
 	// extract the userid
@@ -234,103 +217,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	jwt_free(jwt);
 
 	return NGX_OK;
-	
-	redirect:
-
-		if (jwt)
-		{
-			jwt_free(jwt);
-		}
-
-		r->headers_out.location = ngx_list_push(&r->headers_out.headers);
-		
-		if (r->headers_out.location == NULL) 
-		{
-			ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
-		}
-
-		r->headers_out.location->hash = 1;
-		r->headers_out.location->key.len = sizeof("Location") - 1;
-		r->headers_out.location->key.data = (u_char *) "Location";
-
-		if (r->method == NGX_HTTP_GET)
-		{
-			int loginlen;
-			char * scheme;
-			ngx_str_t server;
-			ngx_str_t uri_variable_name = ngx_string("request_uri");
-			ngx_int_t uri_variable_hash;
-			ngx_http_variable_value_t * request_uri_var;
-			ngx_str_t uri;
-			ngx_str_t uri_escaped;
-			uintptr_t escaped_len;
-
-			loginlen = jwtcf->auth_jwt_loginurl.len;
-
-			scheme = (r->connection->ssl) ? "https" : "http";
-			server = r->headers_in.server;
-
-			// get the URI
-			uri_variable_hash = ngx_hash_key(uri_variable_name.data, uri_variable_name.len);
-			request_uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
-
-			// get the URI
-			if(request_uri_var && !request_uri_var->not_found && request_uri_var->valid)
-			{
-				// ideally we would like the uri with the querystring parameters
-				uri.data = ngx_palloc(r->pool, request_uri_var->len);
-				uri.len = request_uri_var->len;
-				ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
-
-				// ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "found uri with querystring %s", ngx_str_t_to_char_ptr(r->pool, uri));
-			}
-			else
-			{
-				// fallback to the querystring without params
-				uri = r->uri;
-
-				// ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "fallback to querystring without params");
-			}
-
-			// escape the URI
-			escaped_len = 2 * ngx_escape_uri(NULL, uri.data, uri.len, NGX_ESCAPE_ARGS) + uri.len;
-			uri_escaped.data = ngx_palloc(r->pool, escaped_len);
-			uri_escaped.len = escaped_len;
-			ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
-
-			r->headers_out.location->value.len = loginlen + sizeof("?return_url=") - 1 + strlen(scheme) + sizeof("://") - 1 + server.len + uri_escaped.len;
-			return_url = ngx_palloc(r->pool, r->headers_out.location->value.len);
-			ngx_memcpy(return_url, jwtcf->auth_jwt_loginurl.data, jwtcf->auth_jwt_loginurl.len);
-			int return_url_idx = jwtcf->auth_jwt_loginurl.len;
-			ngx_memcpy(return_url+return_url_idx, "?return_url=", sizeof("?return_url=") - 1);
-			return_url_idx += sizeof("?return_url=") - 1;
-			ngx_memcpy(return_url+return_url_idx, scheme, strlen(scheme));
-			return_url_idx += strlen(scheme);
-			ngx_memcpy(return_url+return_url_idx, "://", sizeof("://") - 1);
-			return_url_idx += sizeof("://") - 1;
-			ngx_memcpy(return_url+return_url_idx, server.data, server.len);
-			return_url_idx += server.len;
-			ngx_memcpy(return_url+return_url_idx, uri_escaped.data, uri_escaped.len);
-			return_url_idx += uri_escaped.len;
-			r->headers_out.location->value.data = (u_char *)return_url;
-
-			// ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "return_url: %s", ngx_str_t_to_char_ptr(r->pool, r->headers_out.location->value));
-		}
-		else
-		{
-			// for non-get requests, redirect to the login page without a return URL
-			r->headers_out.location->value.len = jwtcf->auth_jwt_loginurl.len;
-			r->headers_out.location->value.data = jwtcf->auth_jwt_loginurl.data;
-		}
-
-		if (jwtcf->auth_jwt_redirect)
-		{
-			return NGX_HTTP_MOVED_TEMPORARILY;
-		}
-		else
-		{
-			return NGX_HTTP_UNAUTHORIZED;
-		}
 }
 
 
@@ -342,7 +228,7 @@ static ngx_int_t ngx_http_auth_jwt_init(ngx_conf_t *cf)
 	cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
 
 	h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
-	if (h == NULL) 
+	if (h == NULL)
 	{
 		return NGX_ERROR;
 	}
@@ -359,18 +245,17 @@ ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf)
 	ngx_http_auth_jwt_loc_conf_t *conf;
 
 	conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_auth_jwt_loc_conf_t));
-	if (conf == NULL) 
+	if (conf == NULL)
 	{
 		return NULL;
 	}
-	
+
 	// set the flag to unset
 	conf->auth_jwt_enabled = (ngx_flag_t) -1;
-	conf->auth_jwt_redirect = (ngx_flag_t) -1;
 	conf->auth_jwt_validate_email = (ngx_flag_t) -1;
 
 	ngx_conf_log_error(NGX_LOG_DEBUG, cf, 0, "Created Location Configuration");
-	
+
 	return conf;
 }
 
@@ -381,20 +266,14 @@ ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 	ngx_http_auth_jwt_loc_conf_t *prev = parent;
 	ngx_http_auth_jwt_loc_conf_t *conf = child;
 
-	ngx_conf_merge_str_value(conf->auth_jwt_loginurl, prev->auth_jwt_loginurl, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_key, prev->auth_jwt_key, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_validation_type, prev->auth_jwt_validation_type, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_algorithm, prev->auth_jwt_algorithm, "HS256");
 	ngx_conf_merge_off_value(conf->auth_jwt_validate_email, prev->auth_jwt_validate_email, 1);
-	
-	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1)) 
-	{
-		conf->auth_jwt_enabled = (prev->auth_jwt_enabled == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_enabled;
-	}
 
-	if (conf->auth_jwt_redirect == ((ngx_flag_t) -1))
+	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1))
 	{
-		conf->auth_jwt_redirect = (prev->auth_jwt_redirect == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_redirect;
+		conf->auth_jwt_enabled = (prev->auth_jwt_enabled == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_enabled;
 	}
 
 	return NGX_CONF_OK;
@@ -435,7 +314,7 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 		// get the cookie
 		// TODO: the cookie name could be passed in dynamicallly
 		n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &auth_jwt_validation_type, &jwtCookieVal);
-		if (n != NGX_DECLINED) 
+		if (n != NGX_DECLINED)
 		{
 			jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, jwtCookieVal);
 		}

From df7008a754cc4a64355b560a6ce6080bab787027 Mon Sep 17 00:00:00 2001
From: Maxime <maxime.tissier@gmail.com>
Date: Fri, 8 Jun 2018 22:08:50 +0200
Subject: [PATCH 038/130] Removed a deleted direcitve reference in readme.

---
 README.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README.md b/README.md
index b74fb07..83d0a33 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,6 @@ location /secure-location/ {
   error_page  401 = @login_redirect;
 }
 ```
-If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
 
 ```
 auth_jwt_validation_type AUTHORIZATION;

From cfea5700b629dc589cc4c0db01c57f9b4f6b9002 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Fri, 8 Jun 2018 23:51:55 -0400
Subject: [PATCH 039/130] allow options requests

I've started using a different subdomain for my front end and back end.  This has made my app perofrm CORS OPTIONS requests.  When the request is made, it does not pass the token!  I considered configuring NGINX to handle the OPTIONS requests, but I'd rather let my app handle it.
---
 src/ngx_http_auth_jwt_module.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index db803af..a44e3b9 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -147,6 +147,12 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	{
 		return NGX_DECLINED;
 	}
+
+	// pass through options requests without token authentication
+	if (r->method == NGX_HTTP_OPTIONS)
+	{
+		return NGX_DECLINED;
+	}
 	
 	jwtCookieValChrPtr = getJwt(r, jwtcf->auth_jwt_validation_type);
 	if (jwtCookieValChrPtr == NULL)

From 752ca9c81c200f45da0602358a40f3fbbc2048e6 Mon Sep 17 00:00:00 2001
From: Maxime <maxime.tissier@gmail.com>
Date: Mon, 4 Jun 2018 23:05:36 +0200
Subject: [PATCH 040/130] Use a bash function for tests

---
 .gitignore |  1 +
 build.sh   | 83 +++---------------------------------------------------
 test.sh    | 61 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 66 insertions(+), 79 deletions(-)
 create mode 100644 .gitignore
 create mode 100755 test.sh

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..a51369c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+ngx_http_auth_jwt_module.so
diff --git a/build.sh b/build.sh
index 7e6bdc4..44c5734 100755
--- a/build.sh
+++ b/build.sh
@@ -1,7 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env bash
+
+set -e
 
 RED='\033[01;31m'
-GREEN='\033[01;32m'
 NONE='\033[00m'
 
 # build
@@ -13,80 +14,4 @@ then
   exit 1;
 fi
 
-CONTAINER_ID=$(docker run --name "${DOCKER_IMAGE_NAME}-cont" -d -p 8000:8000 ${DOCKER_IMAGE_NAME})
-
-if ! MACHINE_IP=`docker-machine ip 2>/dev/null`; then
-  MACHINE_IP='0.0.0.0' # fix for MacOS
-fi
-
-docker cp ${CONTAINER_ID}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
-
-VALIDJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4
-MISSING_SUB_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
-MISSING_EMAIL_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
-VALID_RS256_JWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
-
-TEST_INSECURE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000 -H 'cache-control: no-cache'`
-if [ "$TEST_INSECURE_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Insecure test pass ${TEST_INSECURE_EXPECT_200}${NONE}";
-else
-  echo -e "${RED}Insecure test fail ${TEST_INSECURE_EXPECT_200}${NONE}";
-fi
-
-TEST_SECURE_COOKIE_EXPECT_302=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache'`
-if [ "$TEST_SECURE_COOKIE_EXPECT_302" -eq "302" ];then
-  echo -e "${GREEN}Secure test without jwt cookie pass ${TEST_SECURE_COOKIE_EXPECT_302}${NONE}";
-else
-  echo -e "${RED}Secure test without jwt cookie fail ${TEST_SECURE_COOKIE_EXPECT_302}${NONE}";
-fi
-
-TEST_SECURE_COOKIE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${VALIDJWT}"`
-if [ "$TEST_SECURE_COOKIE_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with jwt cookie pass ${TEST_SECURE_COOKIE_EXPECT_200}${NONE}";
-else
-  echo -e "${RED}Secure test with jwt cookie fail ${TEST_SECURE_COOKIE_EXPECT_200}${NONE}";
-fi
-
-TEST_SECURE_HEADER_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-auth-header/index.html -H 'cache-control: no-cache' --header "Authorization: Bearer ${VALIDJWT}"`
-if [ "$TEST_SECURE_HEADER_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with jwt auth header pass ${TEST_SECURE_HEADER_EXPECT_200}${NONE}";
-else
-  echo -e "${RED}Secure test with jwt auth header fail ${TEST_SECURE_HEADER_EXPECT_200}${NONE}";
-fi
-
-TEST_SECURE_HEADER_EXPECT_302=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-auth-header/index.html -H 'cache-control: no-cache'`
-if [ "$TEST_SECURE_HEADER_EXPECT_302" -eq "302" ];then
-  echo -e "${GREEN}Secure test without jwt auth header pass ${TEST_SECURE_HEADER_EXPECT_302}${NONE}";
-else
-  echo -e "${RED}Secure test without jwt auth header fail ${TEST_SECURE_HEADER_EXPECT_302}${NONE}";
-fi
-
-TEST_SECURE_NO_REDIRECT_EXPECT_401=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-no-redirect/index.html -H 'cache-control: no-cache'`
-if [ "$TEST_SECURE_NO_REDIRECT_EXPECT_401" -eq "401" ];then
-  echo -e "${GREEN}Secure test without jwt no redirect pass ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
-else
-  echo -e "${RED}Secure test without jwt no redirect fail ${TEST_SECURE_NO_REDIRECT_EXPECT_401}${NONE}";
-fi
-
-TEST_WITH_NO_SUB_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${MISSING_SUB_JWT}"`
-if [ "$TEST_WITH_NO_SUB_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with jwt cookie pass ${TEST_WITH_NO_SUB_EXPECT_200}${NONE}";
-else
-  echo -e "${RED}Secure test with jwt cookie fail ${TEST_WITH_NO_SUB_EXPECT_200}${NONE}";
-fi
-
-TEST_WITH_NO_EMAIL_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${MISSING_EMAIL_JWT}"`
-if [ "$TEST_WITH_NO_EMAIL_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with jwt cookie pass ${TEST_WITH_NO_EMAIL_EXPECT_200}${NONE}";
-else
-  echo -e "${RED}Secure test with jwt cookie fail ${TEST_WITH_NO_EMAIL_EXPECT_200}${NONE}";
-fi
-
-TEST_SECURE_RS256_COOKIE_EXPECT_200=`curl -X GET -o /dev/null --silent --head --write-out '%{http_code}\n' http://${MACHINE_IP}:8000/secure-rs256/index.html -H 'cache-control: no-cache' --cookie "rampartjwt=${VALID_RS256_JWT}"`
-if [ "$TEST_SECURE_RS256_COOKIE_EXPECT_200" -eq "200" ];then
-  echo -e "${GREEN}Secure test with rs256 jwt cookie pass ${TEST_SECURE_RS256_COOKIE_EXPECT_200}${NONE}";
-else
-  echo -e "${RED}Secure test with rs256 jwt cookie fail ${TEST_SECURE_RS256_COOKIE_EXPECT_200}${NONE}";
-fi
-
-
+./test.sh
diff --git a/test.sh b/test.sh
new file mode 100755
index 0000000..d4c8b62
--- /dev/null
+++ b/test.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+set -e
+
+RED='\033[01;31m'
+GREEN='\033[01;32m'
+NONE='\033[00m'
+
+DOCKER_IMAGE_NAME=jwt-nginx
+CONTAINER_ID=$(docker run --rm --name "${DOCKER_IMAGE_NAME}-cont" -d -p 8000:8000 ${DOCKER_IMAGE_NAME})
+
+if [[ "$OSTYPE" == "darwin"* ]] || [[ "$OSTYPE" == "linux"* ]]; then
+  # Mac OSX / Linux
+  MACHINE_IP='localhost'
+else
+  # Windows
+  MACHINE_IP=`docker-machine ip 2> /dev/null`
+fi
+
+docker cp ${CONTAINER_ID}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
+
+VALIDJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4
+MISSING_SUB_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
+MISSING_EMAIL_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
+VALID_RS256_JWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
+
+test_jwt () {
+  name=$1
+  path=$2
+  expect=$3
+  extra=$4
+
+  cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://$MACHINE_IP:8000$path -H 'cache-control: no-cache' $extra"
+
+  test=$( eval ${cmd} )
+  if [ "$test" -eq "$expect" ];then
+    echo -e "${GREEN}${name}: passed (${test})${NONE}";
+  else
+    echo -e "${RED}${name}: failed (${test})${NONE}";
+  fi
+}
+
+test_jwt "Insecure test" "/" "200"
+
+test_jwt "Secure test without jwt cookie" "/secure/" "302"
+
+test_jwt "Secure test with jwt cookie" "/secure/" "200" "--cookie \"rampartjwt=${VALIDJWT}\""
+
+test_jwt "Secure test with jwt auth header" "/secure-auth-header/" "200" "--header \"Authorization: Bearer ${VALIDJWT}\""
+
+test_jwt "Secure test without jwt auth header" "/secure-auth-header/" "302"
+
+test_jwt "Secure test without jwt auth header" "/secure-no-redirect/" "401"
+
+test_jwt "Secure test with jwt cookie - with no sub" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_SUB_JWT}\""
+
+test_jwt "Secure test with jwt cookie - with no email" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_EMAIL_JWT}\""
+
+test_jwt "Secure test with rs256 jwt cookie" "/secure-rs256/" "200" " --cookie \"rampartjwt=${VALID_RS256_JWT}\""
+
+docker stop ${CONTAINER_ID} > /dev/null

From 2958537d7f7f963c36c9c7b71a8ba88de5e29c46 Mon Sep 17 00:00:00 2001
From: Maxime <maxime.tissier@gmail.com>
Date: Mon, 4 Jun 2018 23:23:55 +0200
Subject: [PATCH 041/130] Using local for test function arguments

---
 test.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/test.sh b/test.sh
index d4c8b62..30df5b8 100755
--- a/test.sh
+++ b/test.sh
@@ -25,10 +25,10 @@ MISSING_EMAIL_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctd
 VALID_RS256_JWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
 
 test_jwt () {
-  name=$1
-  path=$2
-  expect=$3
-  extra=$4
+  local name=$1
+  local path=$2
+  local expect=$3
+  local extra=$4
 
   cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://$MACHINE_IP:8000$path -H 'cache-control: no-cache' $extra"
 

From 15a878aad71d337af85962361e053698031c3917 Mon Sep 17 00:00:00 2001
From: Maxime <maxime.tissier@gmail.com>
Date: Mon, 4 Jun 2018 23:37:57 +0200
Subject: [PATCH 042/130] Removed set -e for test

Removed set -e for test to contine tests even when one fails
---
 test.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/test.sh b/test.sh
index 30df5b8..0dc9072 100755
--- a/test.sh
+++ b/test.sh
@@ -1,7 +1,5 @@
 #!/usr/bin/env bash
 
-set -e
-
 RED='\033[01;31m'
 GREEN='\033[01;32m'
 NONE='\033[00m'

From 5ed9041165e01f537c3174d150bc61bb2cd2eba1 Mon Sep 17 00:00:00 2001
From: Maxime <maxime.tissier@gmail.com>
Date: Fri, 8 Jun 2018 21:23:08 +0200
Subject: [PATCH 043/130] Reverted OS selection block in tests

---
 test.sh | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/test.sh b/test.sh
index 0dc9072..c37d4de 100755
--- a/test.sh
+++ b/test.sh
@@ -7,12 +7,8 @@ NONE='\033[00m'
 DOCKER_IMAGE_NAME=jwt-nginx
 CONTAINER_ID=$(docker run --rm --name "${DOCKER_IMAGE_NAME}-cont" -d -p 8000:8000 ${DOCKER_IMAGE_NAME})
 
-if [[ "$OSTYPE" == "darwin"* ]] || [[ "$OSTYPE" == "linux"* ]]; then
-  # Mac OSX / Linux
-  MACHINE_IP='localhost'
-else
-  # Windows
-  MACHINE_IP=`docker-machine ip 2> /dev/null`
+if ! MACHINE_IP=`docker-machine ip 2>/dev/null`; then
+  MACHINE_IP='0.0.0.0' # fix for MacOS
 fi
 
 docker cp ${CONTAINER_ID}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .

From ae57c6ba216239f1c3cfdb1fcadbdbb1441e95c2 Mon Sep 17 00:00:00 2001
From: Kevin Chen <kevinmichaelchen@gmail.com>
Date: Sat, 9 Jun 2018 14:17:34 -0400
Subject: [PATCH 044/130] Dockerize tests

---
 .gitignore      |   1 +
 Dockerfile      | 123 +++++++++++++++++++++++++++++++-----------------
 Dockerfile-test |   4 ++
 Makefile        |  53 +++++++++++++++++++++
 README.md       |  63 ++++++++++++++++++-------
 build.sh        |  17 -------
 test.sh         |  43 +++++++----------
 7 files changed, 201 insertions(+), 103 deletions(-)
 create mode 100644 Dockerfile-test
 create mode 100644 Makefile
 delete mode 100755 build.sh

diff --git a/.gitignore b/.gitignore
index a51369c..95ee3bc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
+.idea
 ngx_http_auth_jwt_module.so
diff --git a/Dockerfile b/Dockerfile
index 587c6a1..29f7295 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,9 +8,9 @@ ENV LD_LIBRARY_PATH=/usr/local/lib
 
 RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm && \
     yum -y update && \
-	yum -y groupinstall 'Development Tools' && \
-	yum -y install pcre-devel pcre zlib-devel openssl-devel wget cmake check-devel check && \
-	yum -y install nginx-$NGINX_VERSION
+    yum -y groupinstall 'Development Tools' && \
+    yum -y install pcre-devel pcre zlib-devel openssl-devel wget cmake check-devel check && \
+    yum -y install nginx-$NGINX_VERSION
 
 # for compiling for rh-nginx110
 # yum -y install libxml2 libxslt libxml2-devel libxslt-devel gd gd-devel perl-ExtUtils-Embed
@@ -24,40 +24,26 @@ WORKDIR /root/dl
 # build jansson
 ARG JANSSON_VERSION=2.10
 RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
-	unzip v$JANSSON_VERSION.zip && \
-	rm v$JANSSON_VERSION.zip && \
-	ln -sf jansson-$JANSSON_VERSION jansson && \
-	cd /root/dl/jansson && \
-	cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
-	make && \
-	make check && \
-	make install
+    unzip v$JANSSON_VERSION.zip && \
+    rm v$JANSSON_VERSION.zip && \
+    ln -sf jansson-$JANSSON_VERSION jansson && \
+    cd /root/dl/jansson && \
+    cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
+    make && \
+    make check && \
+    make install
 
 # build libjwt
 ARG LIBJWT_VERSION=1.9.0
 RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
-	unzip v$LIBJWT_VERSION.zip && \
-	rm v$LIBJWT_VERSION.zip && \
-	ln -sf libjwt-$LIBJWT_VERSION libjwt && \
-	cd /root/dl/libjwt && \
-	autoreconf -i && \
-	./configure JANSSON_CFLAGS=/usr/local/include JANSSON_LIBS=/usr/local/lib && \
-	make all && \
-	make install
-
-# get our JWT module
-# change this to get a specific version?
-#ARG TESLA_REPO_NAME=ngx-http-auth-jwt-module
-# ARG TESLA_REPO_URL_PREFIX=joefitz/
-# ARG TESLA_REPO_FILE_PREFIX=joefitz-
-# ARG TESLA_REPO_FILENAME=validate-authorization-header
-#ARG TESLA_REPO_URL_PREFIX=
-#ARG TESLA_REPO_FILE_PREFIX=
-#ARG TESLA_REPO_FILENAME=master
-#ADD https://github.com/TeslaGov/$TESLA_REPO_NAME/archive/${TESLA_REPO_URL_PREFIX}${TESLA_REPO_FILENAME}.zip .
-#RUN unzip ${TESLA_REPO_FILENAME}.zip && \
-#	rm ${TESLA_REPO_FILENAME}.zip && \
-#	ln -sf ${TESLA_REPO_NAME}-${TESLA_REPO_FILE_PREFIX}${TESLA_REPO_FILENAME} ${TESLA_REPO_NAME}
+    unzip v$LIBJWT_VERSION.zip && \
+    rm v$LIBJWT_VERSION.zip && \
+    ln -sf libjwt-$LIBJWT_VERSION libjwt && \
+    cd /root/dl/libjwt && \
+    autoreconf -i && \
+    ./configure JANSSON_CFLAGS=/usr/local/include JANSSON_LIBS=/usr/local/lib && \
+    make all && \
+    make install
 
 ADD . /root/dl/ngx-http-auth-jwt-module
 
@@ -76,24 +62,73 @@ ADD . /root/dl/ngx-http-auth-jwt-module
 # ./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
 #
 #RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
-#	tar -xzf nginx-$NGINX_VERSION.tar.gz && \
-#	rm nginx-$NGINX_VERSION.tar.gz && \
-#	ln -sf nginx-$NGINX_VERSION nginx && \
-#	cd /root/dl/nginx && \
+#  tar -xzf nginx-$NGINX_VERSION.tar.gz && \
+#  rm nginx-$NGINX_VERSION.tar.gz && \
+#  ln -sf nginx-$NGINX_VERSION nginx && \
+#  cd /root/dl/nginx && \
 #    ./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
-#	make modules && \
-#	cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
+#  make modules && \
+#  cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
 
 # ARG CACHEBUST=1
 
 RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
-	tar -xzf nginx-$NGINX_VERSION.tar.gz && \
-	rm nginx-$NGINX_VERSION.tar.gz && \
-	ln -sf nginx-$NGINX_VERSION nginx && \
+    tar -xzf nginx-$NGINX_VERSION.tar.gz && \
+    rm nginx-$NGINX_VERSION.tar.gz && \
+    ln -sf nginx-$NGINX_VERSION nginx && \
     cd /root/dl/nginx && \
-    ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
+    ./configure \
+      --add-dynamic-module=../ngx-http-auth-jwt-module \
+      --prefix=/usr/share/nginx \
+      --sbin-path=/usr/sbin/nginx \
+      --modules-path=/usr/lib64/nginx/modules \
+      --conf-path=/etc/nginx/nginx.conf \
+      --error-log-path=/var/log/nginx/error.log \
+      --http-log-path=/var/log/nginx/access.log \
+      --http-client-body-temp-path=/var/lib/nginx/tmp/client_body \
+      --http-proxy-temp-path=/var/lib/nginx/tmp/proxy \
+      --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi \
+      --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi \
+      --http-scgi-temp-path=/var/lib/nginx/tmp/scgi \
+      --pid-path=/run/nginx.pid \
+      --lock-path=/run/lock/subsys/nginx \
+      --user=nginx \
+      --group=nginx \
+      --with-file-aio \
+      --with-ipv6 \
+      --with-http_ssl_module \
+      --with-http_v2_module \
+      --with-http_realip_module \
+      --with-http_addition_module \
+      --with-http_xslt_module=dynamic \
+      --with-http_image_filter_module=dynamic \
+      --with-http_geoip_module=dynamic \
+      --with-http_sub_module \
+      --with-http_dav_module \
+      --with-http_flv_module \
+      --with-http_mp4_module \
+      --with-http_gunzip_module \
+      --with-http_gzip_static_module \
+      --with-http_random_index_module \
+      --with-http_secure_link_module \
+      --with-http_degradation_module \
+      --with-http_slice_module \
+      --with-http_stub_status_module \
+      --with-http_perl_module=dynamic \
+      --with-mail=dynamic \
+      --with-mail_ssl_module \
+      --with-pcre \
+      --with-pcre-jit \
+      --with-stream=dynamic \
+      --with-stream_ssl_module \
+      --with-google_perftools_module \
+      --with-debug \
+      --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' \
+      --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
     make modules && \
-	cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
+    cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/. && \
+    mkdir /build && \
+    cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /build.
 
 # Get nginx ready to run
 COPY resources/nginx.conf /etc/nginx/nginx.conf
diff --git a/Dockerfile-test b/Dockerfile-test
new file mode 100644
index 0000000..adff57a
--- /dev/null
+++ b/Dockerfile-test
@@ -0,0 +1,4 @@
+FROM alpine:3.7
+RUN apk add --no-cache bash curl
+COPY test.sh .
+CMD ["./test.sh"]
\ No newline at end of file
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..25a0150
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,53 @@
+SHELL += -eu
+
+BLUE  := \033[0;34m
+GREEN := \033[0;32m
+RED   := \033[0;31m
+NC    := \033[0m
+
+DOCKER_ORG_NAME = teslagov
+DOCKER_IMAGE_NAME = jwt-nginx
+
+.PHONY: all
+all:
+	@$(MAKE) build-nginx
+	@$(MAKE) build-test-runner
+	@$(MAKE) start-nginx
+	@$(MAKE) test
+
+.PHONY: build-nginx
+build-nginx:
+	@echo "${BLUE}  Building...${NC}"
+	@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . ; \
+	if [ $$? -ne 0 ] ; \
+		then echo "${RED}  Build failed :(${NC}" ; \
+	else echo "${GREEN}✓ Successfully built NGINX module ${NC}" ; fi
+
+.PHONY: rebuild-nginx
+rebuild-nginx:
+	@echo "${BLUE}  Rebuilding...${NC}"
+	@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . --no-cache ; \
+	if [ $$? -ne 0 ] ; \
+		then echo "${RED}  Build failed :(${NC}" ; \
+	else echo "${GREEN}✓ Successfully rebuilt NGINX module ${NC}" ; fi
+
+.PHONY: stop-nginx
+stop-nginx:
+	docker stop $(shell docker inspect --format="{{.Id}}" "$(DOCKER_IMAGE_NAME)-cont") ||:
+
+.PHONY: start-nginx
+start-nginx:
+	docker run --rm --name "$(DOCKER_IMAGE_NAME)-cont" -d -p 8000:8000 $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME)
+	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
+
+.PHONY: build-test-runner
+build-test-runner:
+	docker image build -f Dockerfile-test -t $(DOCKER_ORG_NAME)/jwt-nginx-test-runner .
+
+.PHONY: frebuild-test-runner
+rebuild-test-runner:
+	docker image build -f Dockerfile-test -t $(DOCKER_ORG_NAME)/jwt-nginx-test-runner . --no-cache
+
+.PHONY: test
+test:
+	docker run --rm $(DOCKER_ORG_NAME)/jwt-nginx-test-runner
\ No newline at end of file
diff --git a/README.md b/README.md
index 7de9088..44b59d4 100644
--- a/README.md
+++ b/README.md
@@ -1,13 +1,43 @@
 # Intro
 This is an NGINX module to check for a valid JWT and proxy to an upstream server or redirect to a login page.
 
-# Build Requirements
+## Building and testing
+To build the Docker image, start NGINX, and run our Bash test against it, run
+```bash
+make
+```
+
+When you make a change to the module, run `make rebuild-nginx`.
+
+When you make a change to `test.sh`, run `make rebuild-test-runner`.
+
+| Command                    | Description                                 |
+| -------------------------- |:-------------------------------------------:|
+| `make build-nginx`         | Builds the NGINX image                      |
+| `make rebuild-nginx`       | Re-builds the NGINX image                   |
+| `make build-test-runner`   | Builds the image that will run `test.sh`    |
+| `make rebuild-test-runner` | Re-builds the image that will run `test.sh` |
+| `make start-nginx`         | Starts the NGINX container                  |
+| `make stop-nginx`          | Stops the NGINX container                   |
+| `make test`                | Runs `test.sh` against the NGINX container  |
+
+You can re-run tests as many times as you like while NGINX is up.
+When you're done running tests, make sure to stop the NGINX container.
+
+The Dockerfile builds all of the dependencies as well as the module,
+downloads a binary version of NGINX, and runs the module as a dynamic module.
+
+Tests get executed in containers. This project is 100% Docker-ized.
+
+## Dependencies
 This module depends on the [JWT C Library](https://github.com/benmcollins/libjwt)
 
-Transitively, that library depends on a JSON Parser called [Jansson](https://github.com/akheron/jansson) as well as the OpenSSL library.
+Transitively, that library depends on a JSON Parser called
+[Jansson](https://github.com/akheron/jansson) as well as the OpenSSL library.
 
-# NGINX Directives
-This module requires several new nginx.conf directives, which can be specified in on the `main` `server` or `location` level.
+## NGINX Directives
+This module requires several new `nginx.conf` directives,
+which can be specified in on the `main` `server` or `location` level.
 
 ```
 auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
@@ -17,7 +47,9 @@ auth_jwt_algorithm HS256; # or RS256
 auth_jwt_validate_email on;  # or off
 ```
 
-So, a typical use would be to specify the key and loginurl on the main level and then only turn on the locations that you want to secure (not the login page).  Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
+So, a typical use would be to specify the key and loginurl on the main level
+and then only turn on the locations that you want to secure (not the login page).
+Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
 
 ```
 auth_jwt_redirect            off;
@@ -28,13 +60,16 @@ If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
 auth_jwt_validation_type AUTHORIZATION;
 auth_jwt_validation_type COOKIE=rampartjwt;
 ```
-By default the authorization header is used to provide a JWT for validation.  However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
+By default the authorization header is used to provide a JWT for validation.
+However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
 
 
 
-The default algorithm is 'HS256', for symmetric key validation.  Also supported is 'RS256', for RSA 256-bit public key validation.
+The default algorithm is 'HS256', for symmetric key validation.
+Also supported is 'RS256', for RSA 256-bit public key validation.
 
-If using "auth_jwt_algorithm RS256;", then the 'auth_jwt_key' field must be set to your public key.  That is the public key, rather than a PEM certificate.  I.e.:
+If using "auth_jwt_algorithm RS256;", then the 'auth_jwt_key' field must be set to your public key.
+That is the public key, rather than a PEM certificate.  I.e.:
 
 ```
 auth_jwt_key "-----BEGIN PUBLIC KEY-----
@@ -48,16 +83,10 @@ oQIDAQAB
 -----END PUBLIC KEY-----";
 ```
 
-
-
-By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the session, and will log an error if it isn't found.  To disable this behavior, for instance if you are using a different user identifier property such as 'sub', set:
+By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the
+session, and will log an error if it isn't found.  To disable this behavior, for instance if you are using a different
+user identifier property such as 'sub', set:
 
 ```
 auth_jwt_validate_email off;
 ```
-
-
-
-The Dockerfile builds all of the dependencies as well as the module, downloads a binary version of nginx, and runs the module as a dynamic module.
-
-Have a look at build.sh, which creates the docker image and container and executes some test requests to illustrate that some pages are secured by the module and requre a valid JWT.
diff --git a/build.sh b/build.sh
deleted file mode 100755
index 44c5734..0000000
--- a/build.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-RED='\033[01;31m'
-NONE='\033[00m'
-
-# build
-DOCKER_IMAGE_NAME=jwt-nginx
-docker build -t ${DOCKER_IMAGE_NAME} .
-if [ $? -ne 0 ]
-then
-  echo -e "${RED}Build Failed${NONE}";
-  exit 1;
-fi
-
-./test.sh
diff --git a/test.sh b/test.sh
index c37d4de..955bb13 100755
--- a/test.sh
+++ b/test.sh
@@ -4,27 +4,13 @@ RED='\033[01;31m'
 GREEN='\033[01;32m'
 NONE='\033[00m'
 
-DOCKER_IMAGE_NAME=jwt-nginx
-CONTAINER_ID=$(docker run --rm --name "${DOCKER_IMAGE_NAME}-cont" -d -p 8000:8000 ${DOCKER_IMAGE_NAME})
-
-if ! MACHINE_IP=`docker-machine ip 2>/dev/null`; then
-  MACHINE_IP='0.0.0.0' # fix for MacOS
-fi
-
-docker cp ${CONTAINER_ID}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
-
-VALIDJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4
-MISSING_SUB_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
-MISSING_EMAIL_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
-VALID_RS256_JWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
-
 test_jwt () {
   local name=$1
   local path=$2
   local expect=$3
   local extra=$4
 
-  cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://$MACHINE_IP:8000$path -H 'cache-control: no-cache' $extra"
+  cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://host.docker.internal:8000$path -H 'cache-control: no-cache' $extra"
 
   test=$( eval ${cmd} )
   if [ "$test" -eq "$expect" ];then
@@ -34,22 +20,29 @@ test_jwt () {
   fi
 }
 
-test_jwt "Insecure test" "/" "200"
+main() {
+  local VALIDJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4
+  local MISSING_SUB_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
+  local MISSING_EMAIL_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
+  local VALID_RS256_JWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
+
+  test_jwt "Insecure test" "/" "200"
 
-test_jwt "Secure test without jwt cookie" "/secure/" "302"
+  test_jwt "Secure test without jwt cookie" "/secure/" "302"
 
-test_jwt "Secure test with jwt cookie" "/secure/" "200" "--cookie \"rampartjwt=${VALIDJWT}\""
+  test_jwt "Secure test with jwt cookie" "/secure/" "200" "--cookie \"rampartjwt=${VALIDJWT}\""
 
-test_jwt "Secure test with jwt auth header" "/secure-auth-header/" "200" "--header \"Authorization: Bearer ${VALIDJWT}\""
+  test_jwt "Secure test with jwt auth header" "/secure-auth-header/" "200" "--header \"Authorization: Bearer ${VALIDJWT}\""
 
-test_jwt "Secure test without jwt auth header" "/secure-auth-header/" "302"
+  test_jwt "Secure test without jwt auth header" "/secure-auth-header/" "302"
 
-test_jwt "Secure test without jwt auth header" "/secure-no-redirect/" "401"
+  test_jwt "Secure test without jwt auth header" "/secure-no-redirect/" "401"
 
-test_jwt "Secure test with jwt cookie - with no sub" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_SUB_JWT}\""
+  test_jwt "Secure test with jwt cookie - with no sub" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_SUB_JWT}\""
 
-test_jwt "Secure test with jwt cookie - with no email" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_EMAIL_JWT}\""
+  test_jwt "Secure test with jwt cookie - with no email" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_EMAIL_JWT}\""
 
-test_jwt "Secure test with rs256 jwt cookie" "/secure-rs256/" "200" " --cookie \"rampartjwt=${VALID_RS256_JWT}\""
+  test_jwt "Secure test with rs256 jwt cookie" "/secure-rs256/" "200" " --cookie \"rampartjwt=${VALID_RS256_JWT}\""
+}
 
-docker stop ${CONTAINER_ID} > /dev/null
+main "$@"
\ No newline at end of file

From 4ea3dcb582a48b231fa2b497220226014525a7d0 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 7 Jan 2019 11:45:31 -0500
Subject: [PATCH 045/130] Update README.md

---
 README.md | 44 ++++++++++++++++++++------------------------
 1 file changed, 20 insertions(+), 24 deletions(-)

diff --git a/README.md b/README.md
index 44b59d4..8a98a93 100644
--- a/README.md
+++ b/README.md
@@ -47,28 +47,9 @@ auth_jwt_algorithm HS256; # or RS256
 auth_jwt_validate_email on;  # or off
 ```
 
-So, a typical use would be to specify the key and loginurl on the main level
-and then only turn on the locations that you want to secure (not the login page).
-Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
-
-```
-auth_jwt_redirect            off;
-```
-If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
-
-```
-auth_jwt_validation_type AUTHORIZATION;
-auth_jwt_validation_type COOKIE=rampartjwt;
-```
-By default the authorization header is used to provide a JWT for validation.
-However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
+The default algorithm is 'HS256', for symmetric key validation.  When using HS256, the value for `auth_jwt_key` should be specified in binhex format.  It should represent 256 bits of data and so it should be represented by 32 pairs of hex characters which is 64 characters in total as in the example above.
 
-
-
-The default algorithm is 'HS256', for symmetric key validation.
-Also supported is 'RS256', for RSA 256-bit public key validation.
-
-If using "auth_jwt_algorithm RS256;", then the 'auth_jwt_key' field must be set to your public key.
+The configuration also supports the `auth_jwt_algorithm` 'RS256', for RSA 256-bit public key validation. If using "auth_jwt_algorithm RS256;", then the `auth_jwt_key` field must be set to your public key.
 That is the public key, rather than a PEM certificate.  I.e.:
 
 ```
@@ -83,10 +64,25 @@ oQIDAQAB
 -----END PUBLIC KEY-----";
 ```
 
-By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the
-session, and will log an error if it isn't found.  To disable this behavior, for instance if you are using a different
-user identifier property such as 'sub', set:
+A typical use would be to specify the key and loginurl on the main level
+and then only turn on the locations that you want to secure (not the login page).
+Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
+
+```
+auth_jwt_redirect            off;
+```
+If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
+
+```
+auth_jwt_validation_type AUTHORIZATION;
+auth_jwt_validation_type COOKIE=rampartjwt;
+```
+By default the authorization header is used to provide a JWT for validation.
+However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
 
 ```
 auth_jwt_validate_email off;
 ```
+By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the
+session, and will log an error if it isn't found.  To disable this behavior, for instance if you are using a different
+user identifier property such as 'sub', set `auth_jwt_validate_email` to the value `off`.

From ca93a9355d5ff68e2f9dfbd3d5ba5d9b25d2ad31 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 7 Jan 2019 11:46:15 -0500
Subject: [PATCH 046/130] Update README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 8a98a93..2bf5f60 100644
--- a/README.md
+++ b/README.md
@@ -40,7 +40,7 @@ This module requires several new `nginx.conf` directives,
 which can be specified in on the `main` `server` or `location` level.
 
 ```
-auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
+auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF"; # see docs for format based on algorithm
 auth_jwt_loginurl "https://yourdomain.com/loginpage";
 auth_jwt_enabled on;
 auth_jwt_algorithm HS256; # or RS256

From 80d89d91e3f58d3106af7174d83524d37ddecdc7 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 8 Jan 2019 11:39:25 -0500
Subject: [PATCH 047/130] Update README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 2bf5f60..c04a8fd 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ auth_jwt_algorithm HS256; # or RS256
 auth_jwt_validate_email on;  # or off
 ```
 
-The default algorithm is 'HS256', for symmetric key validation.  When using HS256, the value for `auth_jwt_key` should be specified in binhex format.  It should represent 256 bits of data and so it should be represented by 32 pairs of hex characters which is 64 characters in total as in the example above.
+The default algorithm is 'HS256', for symmetric key validation.  When using HS256, the value for `auth_jwt_key` should be specified in binhex format.  It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total) as in the example above.  Note that using more than 512 bits will not increase the security.  For key guidelines please see NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms, Section 5.3.2 The HMAC Key.
 
 The configuration also supports the `auth_jwt_algorithm` 'RS256', for RSA 256-bit public key validation. If using "auth_jwt_algorithm RS256;", then the `auth_jwt_key` field must be set to your public key.
 That is the public key, rather than a PEM certificate.  I.e.:

From bf24cbe3d06936ccb16e9d1c7aeab5c84005aa15 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Thu, 2 Jul 2020 17:05:57 -0400
Subject: [PATCH 048/130] Works for NGINX version 1.16.1 in EPEL

---
 Dockerfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 29f7295..ce3156d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@ FROM centos:7
 
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
 
-ARG NGINX_VERSION=1.12.2
+ARG NGINX_VERSION=1.16.1
 
 ENV LD_LIBRARY_PATH=/usr/local/lib
 
@@ -133,6 +133,8 @@ RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
 # Get nginx ready to run
 COPY resources/nginx.conf /etc/nginx/nginx.conf
 COPY resources/test-jwt-nginx.conf /etc/nginx/conf.d/test-jwt-nginx.conf
+RUN rm -rf /usr/share/nginx/html
+RUN cp -r /root/dl/nginx-1.16.1/html /usr/share/nginx
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-auth-header

From 820b1a42fab030784d2bcf4b7a052ed90621b82d Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 6 Jul 2020 17:32:06 -0400
Subject: [PATCH 049/130] Update for EPEL7 nginx 1.16.1, updated jansson,
 updated libjwt

---
 Dockerfile | 79 +++++++++++++++++-------------------------------------
 1 file changed, 25 insertions(+), 54 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index ce3156d..898cfe9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,11 +18,24 @@ RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.n
 # for compiling for epel7
 RUN yum -y install libxml2 libxslt libxml2-devel libxslt-devel gd gd-devel perl-ExtUtils-Embed geoip geoip-devel google-perftools google-perftools-devel
 
+# Jansson update requires new cmake
+RUN yum -y install cmake3 && \
+    alternatives --install /usr/local/bin/cmake cmake /usr/bin/cmake 10 \
+--slave /usr/local/bin/ctest ctest /usr/bin/ctest \
+--slave /usr/local/bin/cpack cpack /usr/bin/cpack \
+--slave /usr/local/bin/ccmake ccmake /usr/bin/ccmake \
+--family cmake && \
+    alternatives --install /usr/local/bin/cmake cmake /usr/bin/cmake3 20 \
+--slave /usr/local/bin/ctest ctest /usr/bin/ctest3 \
+--slave /usr/local/bin/cpack cpack /usr/bin/cpack3 \
+--slave /usr/local/bin/ccmake ccmake /usr/bin/ccmake3 \
+--family cmake
+
 RUN mkdir -p /root/dl
 WORKDIR /root/dl
 
 # build jansson
-ARG JANSSON_VERSION=2.10
+ARG JANSSON_VERSION=2.13.1
 RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
     unzip v$JANSSON_VERSION.zip && \
     rm v$JANSSON_VERSION.zip && \
@@ -34,7 +47,7 @@ RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
     make install
 
 # build libjwt
-ARG LIBJWT_VERSION=1.9.0
+ARG LIBJWT_VERSION=1.11.0
 RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
     unzip v$LIBJWT_VERSION.zip && \
     rm v$LIBJWT_VERSION.zip && \
@@ -58,8 +71,13 @@ ADD . /root/dl/ngx-http-auth-jwt-module
 # rh-nginx110 uses these config flags
 # ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/opt/rh/rh-nginx110/root/usr/share/nginx --sbin-path=/opt/rh/rh-nginx110/root/usr/sbin/nginx --modules-path=/opt/rh/rh-nginx110/root/usr/lib64/nginx/modules --conf-path=/etc/opt/rh/rh-nginx110/nginx/nginx.conf --error-log-path=/var/opt/rh/rh-nginx110/log/nginx/error.log --http-log-path=/var/opt/rh/rh-nginx110/log/nginx/access.log --http-client-body-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/scgi --pid-path=/var/opt/rh/rh-nginx110/run/nginx/nginx.pid --lock-path=/var/opt/rh/rh-nginx110/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=c99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
 #
-# epel7 version uses these config flags
-# ./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
+# epel7 version 1.12.1 uses these config flags
+# ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
+
+#
+# epel7 version 1.16.1 uses these config flags
+# ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-stream_ssl_preread_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-http_auth_request_module --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
+
 #
 #RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
 #  tar -xzf nginx-$NGINX_VERSION.tar.gz && \
@@ -77,64 +95,17 @@ RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
     rm nginx-$NGINX_VERSION.tar.gz && \
     ln -sf nginx-$NGINX_VERSION nginx && \
     cd /root/dl/nginx && \
-    ./configure \
-      --add-dynamic-module=../ngx-http-auth-jwt-module \
-      --prefix=/usr/share/nginx \
-      --sbin-path=/usr/sbin/nginx \
-      --modules-path=/usr/lib64/nginx/modules \
-      --conf-path=/etc/nginx/nginx.conf \
-      --error-log-path=/var/log/nginx/error.log \
-      --http-log-path=/var/log/nginx/access.log \
-      --http-client-body-temp-path=/var/lib/nginx/tmp/client_body \
-      --http-proxy-temp-path=/var/lib/nginx/tmp/proxy \
-      --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi \
-      --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi \
-      --http-scgi-temp-path=/var/lib/nginx/tmp/scgi \
-      --pid-path=/run/nginx.pid \
-      --lock-path=/run/lock/subsys/nginx \
-      --user=nginx \
-      --group=nginx \
-      --with-file-aio \
-      --with-ipv6 \
-      --with-http_ssl_module \
-      --with-http_v2_module \
-      --with-http_realip_module \
-      --with-http_addition_module \
-      --with-http_xslt_module=dynamic \
-      --with-http_image_filter_module=dynamic \
-      --with-http_geoip_module=dynamic \
-      --with-http_sub_module \
-      --with-http_dav_module \
-      --with-http_flv_module \
-      --with-http_mp4_module \
-      --with-http_gunzip_module \
-      --with-http_gzip_static_module \
-      --with-http_random_index_module \
-      --with-http_secure_link_module \
-      --with-http_degradation_module \
-      --with-http_slice_module \
-      --with-http_stub_status_module \
-      --with-http_perl_module=dynamic \
-      --with-mail=dynamic \
-      --with-mail_ssl_module \
-      --with-pcre \
-      --with-pcre-jit \
-      --with-stream=dynamic \
-      --with-stream_ssl_module \
-      --with-google_perftools_module \
-      --with-debug \
-      --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' \
-      --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
+    ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-stream_ssl_preread_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-http_auth_request_module --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
     make modules && \
     cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/. && \
     mkdir /build && \
-    cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /build.
+    cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /build/.
 
 # Get nginx ready to run
 COPY resources/nginx.conf /etc/nginx/nginx.conf
 COPY resources/test-jwt-nginx.conf /etc/nginx/conf.d/test-jwt-nginx.conf
 RUN rm -rf /usr/share/nginx/html
-RUN cp -r /root/dl/nginx-1.16.1/html /usr/share/nginx
+RUN cp -r /root/dl/nginx/html /usr/share/nginx
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-auth-header

From 638438123811551f433629a0f3acf8ac90dd5ad2 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 7 Jul 2020 00:58:01 -0400
Subject: [PATCH 050/130] upgrade libjwt, copy out all binaries

---
 .gitignore | 5 +++++
 Dockerfile | 7 +++++--
 Makefile   | 6 +++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 95ee3bc..8b6727d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,7 @@
 .idea
 ngx_http_auth_jwt_module.so
+libjwt.so.0.6.0
+libjwt.la
+libjwt.a
+libjansson.so.4.13.0
+libjwt.so.0.7.0
diff --git a/Dockerfile b/Dockerfile
index 898cfe9..9808ac3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,6 +5,7 @@ LABEL maintainer="TeslaGov" email="developers@teslagov.com"
 ARG NGINX_VERSION=1.16.1
 
 ENV LD_LIBRARY_PATH=/usr/local/lib
+# ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/share/pkgconfig
 
 RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm && \
     yum -y update && \
@@ -46,15 +47,17 @@ RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
     make check && \
     make install
 
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/share/pkgconfig
+
 # build libjwt
-ARG LIBJWT_VERSION=1.11.0
+ARG LIBJWT_VERSION=1.12.0
 RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
     unzip v$LIBJWT_VERSION.zip && \
     rm v$LIBJWT_VERSION.zip && \
     ln -sf libjwt-$LIBJWT_VERSION libjwt && \
     cd /root/dl/libjwt && \
     autoreconf -i && \
-    ./configure JANSSON_CFLAGS=/usr/local/include JANSSON_LIBS=/usr/local/lib && \
+    ./configure && \
     make all && \
     make install
 
diff --git a/Makefile b/Makefile
index 25a0150..3f70dab 100644
--- a/Makefile
+++ b/Makefile
@@ -39,6 +39,10 @@ stop-nginx:
 start-nginx:
 	docker run --rm --name "$(DOCKER_IMAGE_NAME)-cont" -d -p 8000:8000 $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME)
 	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
+	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjansson.so.4.13.0 .
+	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjwt.a .
+	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjwt.la .
+	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjwt.so.0.7.0 .
 
 .PHONY: build-test-runner
 build-test-runner:
@@ -50,4 +54,4 @@ rebuild-test-runner:
 
 .PHONY: test
 test:
-	docker run --rm $(DOCKER_ORG_NAME)/jwt-nginx-test-runner
\ No newline at end of file
+	docker run --rm $(DOCKER_ORG_NAME)/jwt-nginx-test-runner

From 02c4a990a76aaf8bb0bcff91fb9c17c073da040f Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 7 Jul 2020 10:29:04 -0400
Subject: [PATCH 051/130] rearrange dockerfile

---
 Dockerfile | 30 +++++++-----------------------
 1 file changed, 7 insertions(+), 23 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 9808ac3..1cd3f5d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,9 +3,11 @@ FROM centos:7
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
 
 ARG NGINX_VERSION=1.16.1
+ARG JANSSON_VERSION=2.13.1
+ARG LIBJWT_VERSION=1.12.0
 
 ENV LD_LIBRARY_PATH=/usr/local/lib
-# ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/share/pkgconfig
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/share/pkgconfig
 
 RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm && \
     yum -y update && \
@@ -19,7 +21,7 @@ RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.n
 # for compiling for epel7
 RUN yum -y install libxml2 libxslt libxml2-devel libxslt-devel gd gd-devel perl-ExtUtils-Embed geoip geoip-devel google-perftools google-perftools-devel
 
-# Jansson update requires new cmake
+# Jansson requires new cmake
 RUN yum -y install cmake3 && \
     alternatives --install /usr/local/bin/cmake cmake /usr/bin/cmake 10 \
 --slave /usr/local/bin/ctest ctest /usr/bin/ctest \
@@ -36,7 +38,6 @@ RUN mkdir -p /root/dl
 WORKDIR /root/dl
 
 # build jansson
-ARG JANSSON_VERSION=2.13.1
 RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
     unzip v$JANSSON_VERSION.zip && \
     rm v$JANSSON_VERSION.zip && \
@@ -47,10 +48,7 @@ RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
     make check && \
     make install
 
-ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/share/pkgconfig
-
 # build libjwt
-ARG LIBJWT_VERSION=1.12.0
 RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
     unzip v$LIBJWT_VERSION.zip && \
     rm v$LIBJWT_VERSION.zip && \
@@ -63,7 +61,7 @@ RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
 
 ADD . /root/dl/ngx-http-auth-jwt-module
 
-# after 1.11.5 use this command
+# after 1.11.5 when compiling for a server that was compiled with --with-compat use this command
 # ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module --with-cc-opt='-std=gnu99'
 # cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /etc/nginx/modules/.
 # build nginx module against nginx sources
@@ -76,21 +74,10 @@ ADD . /root/dl/ngx-http-auth-jwt-module
 #
 # epel7 version 1.12.1 uses these config flags
 # ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
-
 #
 # epel7 version 1.16.1 uses these config flags
 # ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-stream_ssl_preread_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-http_auth_request_module --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
 
-#
-#RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
-#  tar -xzf nginx-$NGINX_VERSION.tar.gz && \
-#  rm nginx-$NGINX_VERSION.tar.gz && \
-#  ln -sf nginx-$NGINX_VERSION nginx && \
-#  cd /root/dl/nginx && \
-#    ./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
-#  make modules && \
-#  cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
-
 # ARG CACHEBUST=1
 
 RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
@@ -100,9 +87,7 @@ RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
     cd /root/dl/nginx && \
     ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-stream_ssl_preread_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-http_auth_request_module --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
     make modules && \
-    cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/. && \
-    mkdir /build && \
-    cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /build/.
+    cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
 
 # Get nginx ready to run
 COPY resources/nginx.conf /etc/nginx/nginx.conf
@@ -115,6 +100,5 @@ RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-auth-header
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-no-redirect
 
 ENTRYPOINT ["/usr/sbin/nginx"]
-#ENTRYPOINT ["while true; do echo hello world; sleep 1; done"]
 
-EXPOSE 8000
+EXPOSE 8000
\ No newline at end of file

From 3f93751c9439dcb7caa12714052df8b3b7c4815c Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 13 Jul 2020 12:39:52 -0400
Subject: [PATCH 052/130] Copy the PC files out of the docker image

---
 Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Makefile b/Makefile
index 3f70dab..8a2290b 100644
--- a/Makefile
+++ b/Makefile
@@ -43,6 +43,8 @@ start-nginx:
 	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjwt.a .
 	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjwt.la .
 	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjwt.so.0.7.0 .
+	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/pkgconfig/jansson.pc .
+	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/pkgconfig/libjwt.pc .
 
 .PHONY: build-test-runner
 build-test-runner:

From f542086f9df71e2721f576a6f69e1b6f8df0f10a Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 13 Jul 2020 12:40:32 -0400
Subject: [PATCH 053/130] Ignore the PC files

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 8b6727d..6863045 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,5 @@ libjwt.la
 libjwt.a
 libjansson.so.4.13.0
 libjwt.so.0.7.0
+jansson.pc
+libjwt.pc

From 9908b1b1bc8eaa7564d963311dfdd41a0779a680 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Mon, 13 Jul 2020 12:45:14 -0400
Subject: [PATCH 054/130] Revert "Merge pull request #54 from TeslaGov/pr/42"

This reverts commit f6e84522b115829e65f20339fd27bebff0084af3, reversing
changes made to bf24cbe3d06936ccb16e9d1c7aeab5c84005aa15.
---
 README.md                      |  30 +++---
 resources/test-jwt-nginx.conf  |  31 ++++---
 src/ngx_http_auth_jwt_module.c | 161 +++++++++++++++++++++++++++++----
 3 files changed, 168 insertions(+), 54 deletions(-)

diff --git a/README.md b/README.md
index 0349933..c04a8fd 100644
--- a/README.md
+++ b/README.md
@@ -40,29 +40,13 @@ This module requires several new `nginx.conf` directives,
 which can be specified in on the `main` `server` or `location` level.
 
 ```
-auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
+auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF"; # see docs for format based on algorithm
+auth_jwt_loginurl "https://yourdomain.com/loginpage";
 auth_jwt_enabled on;
 auth_jwt_algorithm HS256; # or RS256
 auth_jwt_validate_email on;  # or off
 ```
 
-So, a typical use would be to specify the key on the main level and then only 
-turn on the locations that you want to secure (not the login page).  Unauthorized 
-requests are given 401 "Unauthorized" responses, you can redirect them with the 
-nginx's `error_page` directive.
-
-```
-location @login_redirect {
-  allow all;
-  return 302 https://yourdomain.com/loginpage;
-}
-
-location /secure-location/ {
-  auth_jwt_enabled   on;
-  error_page  401 = @login_redirect;
-}
-```
-
 The default algorithm is 'HS256', for symmetric key validation.  When using HS256, the value for `auth_jwt_key` should be specified in binhex format.  It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total) as in the example above.  Note that using more than 512 bits will not increase the security.  For key guidelines please see NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms, Section 5.3.2 The HMAC Key.
 
 The configuration also supports the `auth_jwt_algorithm` 'RS256', for RSA 256-bit public key validation. If using "auth_jwt_algorithm RS256;", then the `auth_jwt_key` field must be set to your public key.
@@ -80,7 +64,15 @@ oQIDAQAB
 -----END PUBLIC KEY-----";
 ```
 
-This module supports two ways of presenting the token.
+A typical use would be to specify the key and loginurl on the main level
+and then only turn on the locations that you want to secure (not the login page).
+Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
+
+```
+auth_jwt_redirect            off;
+```
+If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
+
 ```
 auth_jwt_validation_type AUTHORIZATION;
 auth_jwt_validation_type COOKIE=rampartjwt;
diff --git a/resources/test-jwt-nginx.conf b/resources/test-jwt-nginx.conf
index b0f1f9d..b39eb95 100644
--- a/resources/test-jwt-nginx.conf
+++ b/resources/test-jwt-nginx.conf
@@ -1,38 +1,33 @@
 server {
     auth_jwt_key                 "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
-    set $auth_jwt_login_url      "https://teslagov.com";
+    auth_jwt_loginurl            "https://teslagov.com";
     auth_jwt_enabled             off;
+    auth_jwt_redirect            on;
 
     listen       8000;
     server_name  localhost;
 
-    root  /usr/share/nginx/html;
-    index  index.html index.htm;
-
-    location @login_redirect {
-      return 302 $auth_jwt_login_url?redirect=$request_uri&$args;
-    }
-
     location ~ ^/secure-no-redirect/ {
-        rewrite "" / break;
         auth_jwt_enabled   on;
+        auth_jwt_redirect  off;
+        root  /usr/share/nginx;
+        index  index.html index.htm;
     }
 
     location ~ ^/secure/ {
-        rewrite "" / break;
         auth_jwt_enabled   on;
         auth_jwt_validation_type COOKIE=rampartjwt;
-        error_page  401 = @login_redirect;
+        root  /usr/share/nginx;
+        index  index.html index.htm;
     }
 
     location ~ ^/secure-auth-header/ {
-        rewrite "" / break;
         auth_jwt_enabled on;
-        error_page  401 = @login_redirect;
+        root  /usr/share/nginx;
+        index  index.html index.htm;
     }
 
     location ~ ^/secure-rs256/ {
-        rewrite "" / break;
         auth_jwt_enabled on;
         auth_jwt_validation_type COOKIE=rampartjwt;
         auth_jwt_algorithm RS256;
@@ -45,7 +40,13 @@ ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
 K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
 BwIDAQAB
 -----END PUBLIC KEY-----";
+        root  /usr/share/nginx;
+        index  index.html index.htm;
     }
 
-    location / {}
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
 }
+
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 2c49899..a44e3b9 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -19,8 +19,10 @@
 #include "ngx_http_auth_jwt_string.h"
 
 typedef struct {
+	ngx_str_t    auth_jwt_loginurl;
 	ngx_str_t    auth_jwt_key;
 	ngx_flag_t   auth_jwt_enabled;
+	ngx_flag_t   auth_jwt_redirect;
 	ngx_str_t    auth_jwt_validation_type;
 	ngx_str_t    auth_jwt_algorithm;
 	ngx_flag_t   auth_jwt_validate_email;
@@ -35,6 +37,13 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type);
 
 static ngx_command_t ngx_http_auth_jwt_commands[] = {
 
+	{ ngx_string("auth_jwt_loginurl"),
+		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+		ngx_conf_set_str_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_loginurl),
+		NULL },
+
 	{ ngx_string("auth_jwt_key"),
 		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
 		ngx_conf_set_str_slot,
@@ -49,6 +58,13 @@ static ngx_command_t ngx_http_auth_jwt_commands[] = {
 		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_enabled),
 		NULL },
 
+	{ ngx_string("auth_jwt_redirect"),
+		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+		ngx_conf_set_flag_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_redirect),
+		NULL },
+
 	{ ngx_string("auth_jwt_validation_type"),
 		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
 		ngx_conf_set_str_slot,
@@ -110,6 +126,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	ngx_str_t useridHeaderName = ngx_string("x-userid");
 	ngx_str_t emailHeaderName = ngx_string("x-email");
 	char* jwtCookieValChrPtr;
+	char* return_url;
 	ngx_http_auth_jwt_loc_conf_t *jwtcf;
 	u_char *keyBinary;
 	jwt_t *jwt = NULL;
@@ -123,10 +140,10 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	time_t now;
 	ngx_str_t auth_jwt_algorithm;
 	int keylen;
-
+	
 	jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
-
-	if (!jwtcf->auth_jwt_enabled)
+	
+	if (!jwtcf->auth_jwt_enabled) 
 	{
 		return NGX_DECLINED;
 	}
@@ -141,9 +158,9 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	if (jwtCookieValChrPtr == NULL)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a jwt");
-		return NGX_HTTP_UNAUTHORIZED;
+		goto redirect;
 	}
-
+	
 	// convert key from hex to binary, if a symmetric key
 
 	auth_jwt_algorithm = jwtcf->auth_jwt_algorithm;
@@ -154,7 +171,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		if (0 != hex_to_binary((char *)jwtcf->auth_jwt_key.data, keyBinary, jwtcf->auth_jwt_key.len))
 		{
 			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to turn hex key into binary");
-		    return NGX_HTTP_UNAUTHORIZED;
+			goto redirect;
 		}
 	}
 	else if ( auth_jwt_algorithm.len == sizeof("RS256") - 1 && ngx_strncmp(auth_jwt_algorithm.data, "RS256", sizeof("RS256") - 1) == 0 )
@@ -166,32 +183,32 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	else
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "unsupported algorithm");
-		return NGX_HTTP_UNAUTHORIZED;
+		goto redirect;
 	}
-
+	
 	// validate the jwt
 	jwtParseReturnCode = jwt_decode(&jwt, jwtCookieValChrPtr, keyBinary, keylen);
 	if (jwtParseReturnCode != 0)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse jwt");
-		return NGX_HTTP_UNAUTHORIZED;
+		goto redirect;
 	}
-
+	
 	// validate the algorithm
 	alg = jwt_get_alg(jwt);
 	if (alg != JWT_ALG_HS256 && alg != JWT_ALG_RS256)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm in jwt %d", alg);
-		return NGX_HTTP_UNAUTHORIZED;
+		goto redirect;
 	}
-
+	
 	// validate the exp date of the JWT
 	exp = (time_t)jwt_get_grant_int(jwt, "exp");
 	now = time(NULL);
 	if (exp < now)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt has expired");
-		return NGX_HTTP_UNAUTHORIZED;
+		goto redirect;
 	}
 
 	// extract the userid
@@ -223,6 +240,103 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	jwt_free(jwt);
 
 	return NGX_OK;
+	
+	redirect:
+
+		if (jwt)
+		{
+			jwt_free(jwt);
+		}
+
+		r->headers_out.location = ngx_list_push(&r->headers_out.headers);
+		
+		if (r->headers_out.location == NULL) 
+		{
+			ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+		}
+
+		r->headers_out.location->hash = 1;
+		r->headers_out.location->key.len = sizeof("Location") - 1;
+		r->headers_out.location->key.data = (u_char *) "Location";
+
+		if (r->method == NGX_HTTP_GET)
+		{
+			int loginlen;
+			char * scheme;
+			ngx_str_t server;
+			ngx_str_t uri_variable_name = ngx_string("request_uri");
+			ngx_int_t uri_variable_hash;
+			ngx_http_variable_value_t * request_uri_var;
+			ngx_str_t uri;
+			ngx_str_t uri_escaped;
+			uintptr_t escaped_len;
+
+			loginlen = jwtcf->auth_jwt_loginurl.len;
+
+			scheme = (r->connection->ssl) ? "https" : "http";
+			server = r->headers_in.server;
+
+			// get the URI
+			uri_variable_hash = ngx_hash_key(uri_variable_name.data, uri_variable_name.len);
+			request_uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
+
+			// get the URI
+			if(request_uri_var && !request_uri_var->not_found && request_uri_var->valid)
+			{
+				// ideally we would like the uri with the querystring parameters
+				uri.data = ngx_palloc(r->pool, request_uri_var->len);
+				uri.len = request_uri_var->len;
+				ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
+
+				// ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "found uri with querystring %s", ngx_str_t_to_char_ptr(r->pool, uri));
+			}
+			else
+			{
+				// fallback to the querystring without params
+				uri = r->uri;
+
+				// ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "fallback to querystring without params");
+			}
+
+			// escape the URI
+			escaped_len = 2 * ngx_escape_uri(NULL, uri.data, uri.len, NGX_ESCAPE_ARGS) + uri.len;
+			uri_escaped.data = ngx_palloc(r->pool, escaped_len);
+			uri_escaped.len = escaped_len;
+			ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
+
+			r->headers_out.location->value.len = loginlen + sizeof("?return_url=") - 1 + strlen(scheme) + sizeof("://") - 1 + server.len + uri_escaped.len;
+			return_url = ngx_palloc(r->pool, r->headers_out.location->value.len);
+			ngx_memcpy(return_url, jwtcf->auth_jwt_loginurl.data, jwtcf->auth_jwt_loginurl.len);
+			int return_url_idx = jwtcf->auth_jwt_loginurl.len;
+			ngx_memcpy(return_url+return_url_idx, "?return_url=", sizeof("?return_url=") - 1);
+			return_url_idx += sizeof("?return_url=") - 1;
+			ngx_memcpy(return_url+return_url_idx, scheme, strlen(scheme));
+			return_url_idx += strlen(scheme);
+			ngx_memcpy(return_url+return_url_idx, "://", sizeof("://") - 1);
+			return_url_idx += sizeof("://") - 1;
+			ngx_memcpy(return_url+return_url_idx, server.data, server.len);
+			return_url_idx += server.len;
+			ngx_memcpy(return_url+return_url_idx, uri_escaped.data, uri_escaped.len);
+			return_url_idx += uri_escaped.len;
+			r->headers_out.location->value.data = (u_char *)return_url;
+
+			// ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "return_url: %s", ngx_str_t_to_char_ptr(r->pool, r->headers_out.location->value));
+		}
+		else
+		{
+			// for non-get requests, redirect to the login page without a return URL
+			r->headers_out.location->value.len = jwtcf->auth_jwt_loginurl.len;
+			r->headers_out.location->value.data = jwtcf->auth_jwt_loginurl.data;
+		}
+
+		if (jwtcf->auth_jwt_redirect)
+		{
+			return NGX_HTTP_MOVED_TEMPORARILY;
+		}
+		else
+		{
+			return NGX_HTTP_UNAUTHORIZED;
+		}
 }
 
 
@@ -234,7 +348,7 @@ static ngx_int_t ngx_http_auth_jwt_init(ngx_conf_t *cf)
 	cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
 
 	h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
-	if (h == NULL)
+	if (h == NULL) 
 	{
 		return NGX_ERROR;
 	}
@@ -251,17 +365,18 @@ ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf)
 	ngx_http_auth_jwt_loc_conf_t *conf;
 
 	conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_auth_jwt_loc_conf_t));
-	if (conf == NULL)
+	if (conf == NULL) 
 	{
 		return NULL;
 	}
-
+	
 	// set the flag to unset
 	conf->auth_jwt_enabled = (ngx_flag_t) -1;
+	conf->auth_jwt_redirect = (ngx_flag_t) -1;
 	conf->auth_jwt_validate_email = (ngx_flag_t) -1;
 
 	ngx_conf_log_error(NGX_LOG_DEBUG, cf, 0, "Created Location Configuration");
-
+	
 	return conf;
 }
 
@@ -272,16 +387,22 @@ ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 	ngx_http_auth_jwt_loc_conf_t *prev = parent;
 	ngx_http_auth_jwt_loc_conf_t *conf = child;
 
+	ngx_conf_merge_str_value(conf->auth_jwt_loginurl, prev->auth_jwt_loginurl, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_key, prev->auth_jwt_key, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_validation_type, prev->auth_jwt_validation_type, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_algorithm, prev->auth_jwt_algorithm, "HS256");
 	ngx_conf_merge_off_value(conf->auth_jwt_validate_email, prev->auth_jwt_validate_email, 1);
-
-	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1))
+	
+	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1)) 
 	{
 		conf->auth_jwt_enabled = (prev->auth_jwt_enabled == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_enabled;
 	}
 
+	if (conf->auth_jwt_redirect == ((ngx_flag_t) -1))
+	{
+		conf->auth_jwt_redirect = (prev->auth_jwt_redirect == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_redirect;
+	}
+
 	return NGX_CONF_OK;
 }
 
@@ -320,7 +441,7 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 		// get the cookie
 		// TODO: the cookie name could be passed in dynamicallly
 		n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &auth_jwt_validation_type, &jwtCookieVal);
-		if (n != NGX_DECLINED)
+		if (n != NGX_DECLINED) 
 		{
 			jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, jwtCookieVal);
 		}

From 891467e26e3b5b38833a6f91da4dd0d2144dd841 Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Thu, 16 Jul 2020 22:38:15 -0400
Subject: [PATCH 055/130] downgrade libjwt and libjansson

---
 .gitignore | 2 ++
 Dockerfile | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 6863045..763f224 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,5 @@ libjansson.so.4.13.0
 libjwt.so.0.7.0
 jansson.pc
 libjwt.pc
+libjansson.so.4.10.0
+libjwt.so.0.4.0
diff --git a/Dockerfile b/Dockerfile
index 1cd3f5d..31f1342 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,8 +3,8 @@ FROM centos:7
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
 
 ARG NGINX_VERSION=1.16.1
-ARG JANSSON_VERSION=2.13.1
-ARG LIBJWT_VERSION=1.12.0
+ARG JANSSON_VERSION=2.10
+ARG LIBJWT_VERSION=1.9.0
 
 ENV LD_LIBRARY_PATH=/usr/local/lib
 ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/share/pkgconfig

From 758ff806949763c6fed6dbc23f9d5b19e256e59c Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 24 Aug 2021 17:16:08 -0400
Subject: [PATCH 056/130] Use nginx.org yum repo instead of epel

EPEL wasn't carrying the range of versions of NGINX that the official NGINX was carrying, so I changed from EPEL to NGINX.

Also, I changed the ./configure to use the "with-compat" option.  At the least, it makes the configure command much simpler... and possibly we might be able to use the module without recompiling (not sure).
---
 Dockerfile | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 31f1342..2097e5e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,14 +3,21 @@ FROM centos:7
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
 
 ARG NGINX_VERSION=1.16.1
-ARG JANSSON_VERSION=2.10
-ARG LIBJWT_VERSION=1.9.0
+ARG JANSSON_VERSION=2.13.1
+ARG LIBJWT_VERSION=1.12.0
 
 ENV LD_LIBRARY_PATH=/usr/local/lib
 ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/share/pkgconfig
 
-RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm && \
-    yum -y update && \
+RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
+RUN echo "" >>/etc/yum.repos.d/nginx.repo
+RUN echo "[nginx]" >>/etc/yum.repos.d/nginx.repo
+RUN echo "name=nginx repo" >>/etc/yum.repos.d/nginx.repo
+RUN echo "baseurl=https://nginx.org/packages/centos/7/x86_64/" >>/etc/yum.repos.d/nginx.repo
+RUN echo "gpgcheck=0" >>/etc/yum.repos.d/nginx.repo
+RUN echo "enabled=1" >>/etc/yum.repos.d/nginx.repo
+
+RUN yum -y update && \
     yum -y groupinstall 'Development Tools' && \
     yum -y install pcre-devel pcre zlib-devel openssl-devel wget cmake check-devel check && \
     yum -y install nginx-$NGINX_VERSION
@@ -85,7 +92,7 @@ RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
     rm nginx-$NGINX_VERSION.tar.gz && \
     ln -sf nginx-$NGINX_VERSION nginx && \
     cd /root/dl/nginx && \
-    ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-stream_ssl_preread_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-http_auth_request_module --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
+    ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module --with-cc-opt='-std=gnu99' && \
     make modules && \
     cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
 
@@ -101,4 +108,4 @@ RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-no-redirect
 
 ENTRYPOINT ["/usr/sbin/nginx"]
 
-EXPOSE 8000
\ No newline at end of file
+EXPOSE 8000

From 59ed4f97cf461401c901e49b0b951d2a39c339fd Mon Sep 17 00:00:00 2001
From: Joseph Fitzgerald <joefitz@alumni.princeton.edu>
Date: Tue, 24 Aug 2021 17:20:32 -0400
Subject: [PATCH 057/130] Fix possible overflow - thanks @eutychus

@eutychus contributed this fix that checks to make sure that the Authorization header contains at least "Bearer: "
---
 src/ngx_http_auth_jwt_module.c | 14 ++++++++++----
 test.sh                        |  4 +++-
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index a44e3b9..4395d5e 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -413,6 +413,7 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 	char* jwtCookieValChrPtr = NULL;
 	ngx_str_t jwtCookieVal;
 	ngx_int_t n;
+	ngx_int_t bearer_length;
 	ngx_str_t authorizationHeaderStr;
 
 	ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "auth_jwt_validation_type.len %d", auth_jwt_validation_type.len);
@@ -425,12 +426,17 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 		{
 			ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Found authorization header len %d", authorizationHeader->value.len);
 
-			authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
-			authorizationHeaderStr.len = authorizationHeader->value.len - (sizeof("Bearer ") - 1);
+			bearer_length = authorizationHeader->value.len - (sizeof("Bearer ") - 1);
 
-			jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
+			if (bearer_length > 0) 
+			{
+				authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
+				authorizationHeaderStr.len = bearer_length;
+
+				jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
 
-			ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtCookieValChrPtr);
+				ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtCookieValChrPtr);
+			}
 		}
 	}
 	else if (auth_jwt_validation_type.len > sizeof("COOKIE=") && ngx_strncmp(auth_jwt_validation_type.data, "COOKIE=", sizeof("COOKIE=") - 1)==0)
diff --git a/test.sh b/test.sh
index 955bb13..5b9faaa 100755
--- a/test.sh
+++ b/test.sh
@@ -36,6 +36,8 @@ main() {
 
   test_jwt "Secure test without jwt auth header" "/secure-auth-header/" "302"
 
+  test_jwt "Secure test with jwt auth header missing Bearer" "/secure-no-redirect/" "401" "--header \"Authorization: X\""
+
   test_jwt "Secure test without jwt auth header" "/secure-no-redirect/" "401"
 
   test_jwt "Secure test with jwt cookie - with no sub" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_SUB_JWT}\""
@@ -45,4 +47,4 @@ main() {
   test_jwt "Secure test with rs256 jwt cookie" "/secure-rs256/" "200" " --cookie \"rampartjwt=${VALID_RS256_JWT}\""
 }
 
-main "$@"
\ No newline at end of file
+main "$@"

From 1653ef1c34a3c18077e137b064da85143f667438 Mon Sep 17 00:00:00 2001
From: Branimir Malesevic <glbranimir@gmail.com>
Date: Wed, 25 Aug 2021 18:37:40 +0200
Subject: [PATCH 058/130] PEM key file support (#56)

* Fix newlines (sry win) in config

* Add reading key file name, minify docker image size

* Add key file path, minor name change

* Fix memory leak

* Fix indentation

* Add RS256 key file documentation

* Fix tests and config

* Fix newlines

* Add private keyfile fields inside location config

* Add tests for rsa256 keyfile scenarios

* Update readme

Co-authored-by: Branimir Malesevic <branimir.malesevic@bam.fan>
---
 Dockerfile                     | 22 ++-------
 README.md                      | 11 ++++-
 resources/test-jwt-nginx.conf  | 11 +++++
 src/ngx_http_auth_jwt_module.c | 90 ++++++++++++++++++++++++++++++++--
 test.sh                        |  5 ++
 5 files changed, 116 insertions(+), 23 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 2097e5e..dd5482d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,28 +19,12 @@ RUN echo "enabled=1" >>/etc/yum.repos.d/nginx.repo
 
 RUN yum -y update && \
     yum -y groupinstall 'Development Tools' && \
-    yum -y install pcre-devel pcre zlib-devel openssl-devel wget cmake check-devel check && \
+    yum -y install pcre-devel pcre zlib-devel openssl-devel wget cmake3 check-devel check && \
     yum -y install nginx-$NGINX_VERSION
 
-# for compiling for rh-nginx110
-# yum -y install libxml2 libxslt libxml2-devel libxslt-devel gd gd-devel perl-ExtUtils-Embed
-
 # for compiling for epel7
 RUN yum -y install libxml2 libxslt libxml2-devel libxslt-devel gd gd-devel perl-ExtUtils-Embed geoip geoip-devel google-perftools google-perftools-devel
 
-# Jansson requires new cmake
-RUN yum -y install cmake3 && \
-    alternatives --install /usr/local/bin/cmake cmake /usr/bin/cmake 10 \
---slave /usr/local/bin/ctest ctest /usr/bin/ctest \
---slave /usr/local/bin/cpack cpack /usr/bin/cpack \
---slave /usr/local/bin/ccmake ccmake /usr/bin/ccmake \
---family cmake && \
-    alternatives --install /usr/local/bin/cmake cmake /usr/bin/cmake3 20 \
---slave /usr/local/bin/ctest ctest /usr/bin/ctest3 \
---slave /usr/local/bin/cpack cpack /usr/bin/cpack3 \
---slave /usr/local/bin/ccmake ccmake /usr/bin/ccmake3 \
---family cmake
-
 RUN mkdir -p /root/dl
 WORKDIR /root/dl
 
@@ -50,7 +34,7 @@ RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
     rm v$JANSSON_VERSION.zip && \
     ln -sf jansson-$JANSSON_VERSION jansson && \
     cd /root/dl/jansson && \
-    cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
+    cmake3 . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
     make && \
     make check && \
     make install
@@ -99,12 +83,14 @@ RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
 # Get nginx ready to run
 COPY resources/nginx.conf /etc/nginx/nginx.conf
 COPY resources/test-jwt-nginx.conf /etc/nginx/conf.d/test-jwt-nginx.conf
+COPY resources/rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
 RUN rm -rf /usr/share/nginx/html
 RUN cp -r /root/dl/nginx/html /usr/share/nginx
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-auth-header
 RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-no-redirect
+RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256-file
 
 ENTRYPOINT ["/usr/sbin/nginx"]
 
diff --git a/README.md b/README.md
index c04a8fd..97e7d82 100644
--- a/README.md
+++ b/README.md
@@ -45,11 +45,13 @@ auth_jwt_loginurl "https://yourdomain.com/loginpage";
 auth_jwt_enabled on;
 auth_jwt_algorithm HS256; # or RS256
 auth_jwt_validate_email on;  # or off
+auth_jwt_use_keyfile off; # or on
+auth_jwt_keyfile_path "/app/pub_key";
 ```
 
 The default algorithm is 'HS256', for symmetric key validation.  When using HS256, the value for `auth_jwt_key` should be specified in binhex format.  It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total) as in the example above.  Note that using more than 512 bits will not increase the security.  For key guidelines please see NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms, Section 5.3.2 The HMAC Key.
 
-The configuration also supports the `auth_jwt_algorithm` 'RS256', for RSA 256-bit public key validation. If using "auth_jwt_algorithm RS256;", then the `auth_jwt_key` field must be set to your public key.
+The configuration also supports the `auth_jwt_algorithm` 'RS256', for RSA 256-bit public key validation. If using "auth_jwt_algorithm RS256;", then the `auth_jwt_key` field must be set to your public key **OR** `auth_jwt_use_keyfile` should be set to `on` with the `auth_jwt_keyfile_path` set to the public key path (nginx won't start if the `auth_jwt_use_keyfile` is set to `on` without a keyfile).
 That is the public key, rather than a PEM certificate.  I.e.:
 
 ```
@@ -64,6 +66,13 @@ oQIDAQAB
 -----END PUBLIC KEY-----";
 ```
 
+**OR**
+
+```
+auth_jwt_use_keyfile on;
+auth_jwt_keyfile_path "/etc/nginx/pub_key.pem";
+```
+
 A typical use would be to specify the key and loginurl on the main level
 and then only turn on the locations that you want to secure (not the login page).
 Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
diff --git a/resources/test-jwt-nginx.conf b/resources/test-jwt-nginx.conf
index b39eb95..cbb356c 100644
--- a/resources/test-jwt-nginx.conf
+++ b/resources/test-jwt-nginx.conf
@@ -44,6 +44,17 @@ BwIDAQAB
         index  index.html index.htm;
     }
 
+    location ~ ^/secure-rs256-file/ {
+        auth_jwt_enabled on;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_algorithm RS256;
+        auth_jwt_redirect  off;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
+        root  /usr/share/nginx;
+        index  index.html index.htm;
+    }
+
     location / {
         root   /usr/share/nginx/html;
         index  index.html index.htm;
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 4395d5e..fbd07ba 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -18,6 +18,8 @@
 #include "ngx_http_auth_jwt_binary_converters.h"
 #include "ngx_http_auth_jwt_string.h"
 
+#include <stdio.h>
+
 typedef struct {
 	ngx_str_t    auth_jwt_loginurl;
 	ngx_str_t    auth_jwt_key;
@@ -26,7 +28,10 @@ typedef struct {
 	ngx_str_t    auth_jwt_validation_type;
 	ngx_str_t    auth_jwt_algorithm;
 	ngx_flag_t   auth_jwt_validate_email;
-
+	ngx_str_t    auth_jwt_keyfile_path;
+	ngx_flag_t   auth_jwt_use_keyfile;
+	// Private field for keyfile data
+	ngx_str_t    _auth_jwt_keyfile;
 } ngx_http_auth_jwt_loc_conf_t;
 
 static ngx_int_t ngx_http_auth_jwt_init(ngx_conf_t *cf);
@@ -86,6 +91,20 @@ static ngx_command_t ngx_http_auth_jwt_commands[] = {
 		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_validate_email),
 		NULL },
 
+	{ ngx_string("auth_jwt_keyfile_path"),
+		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+		ngx_conf_set_str_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_keyfile_path),
+		NULL },
+
+	{ ngx_string("auth_jwt_use_keyfile"),
+		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+		ngx_conf_set_flag_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_use_keyfile),
+		NULL },
+
 	ngx_null_command
 };
 
@@ -129,6 +148,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	char* return_url;
 	ngx_http_auth_jwt_loc_conf_t *jwtcf;
 	u_char *keyBinary;
+	// For clearing it later on
 	jwt_t *jwt = NULL;
 	int jwtParseReturnCode;
 	jwt_alg_t alg;
@@ -177,8 +197,18 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	else if ( auth_jwt_algorithm.len == sizeof("RS256") - 1 && ngx_strncmp(auth_jwt_algorithm.data, "RS256", sizeof("RS256") - 1) == 0 )
 	{
 		// in this case, 'Binary' is a misnomer, as it is the public key string itself
-		keyBinary = jwtcf->auth_jwt_key.data;
-		keylen = jwtcf->auth_jwt_key.len;
+		if (jwtcf->auth_jwt_use_keyfile == 1)
+		{
+			// Set to global variables
+			// NOTE: check for keyBin == NULL skipped, unnecessary check; nginx should fail to start
+			keyBinary = (u_char*)jwtcf->_auth_jwt_keyfile.data;
+			keylen = jwtcf->_auth_jwt_keyfile.len;
+		}
+		else
+		{
+			keyBinary = jwtcf->auth_jwt_key.data;
+			keylen = jwtcf->auth_jwt_key.len;
+		}
 	}
 	else
 	{
@@ -239,6 +269,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 
 	jwt_free(jwt);
 
+	
 	return NGX_OK;
 	
 	redirect:
@@ -358,7 +389,6 @@ static ngx_int_t ngx_http_auth_jwt_init(ngx_conf_t *cf)
 	return NGX_OK;
 }
 
-
 static void *
 ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf)
 {
@@ -374,12 +404,43 @@ ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf)
 	conf->auth_jwt_enabled = (ngx_flag_t) -1;
 	conf->auth_jwt_redirect = (ngx_flag_t) -1;
 	conf->auth_jwt_validate_email = (ngx_flag_t) -1;
+	conf->auth_jwt_use_keyfile = (ngx_flag_t) -1;
 
 	ngx_conf_log_error(NGX_LOG_DEBUG, cf, 0, "Created Location Configuration");
 	
 	return conf;
 }
 
+// Loads the RSA256 public key into the location config struct
+static ngx_int_t
+loadAuthKey(ngx_conf_t *cf, ngx_http_auth_jwt_loc_conf_t* conf) {
+	FILE *keyFile = fopen((const char*)conf->auth_jwt_keyfile_path.data, "rb");
+
+	// Check if file exists or is correctly opened
+	if (keyFile == NULL)
+	{
+		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "failed to open pub key file");
+		return NGX_ERROR;
+	}
+
+	// Read file length
+	fseek(keyFile, 0, SEEK_END);
+	long keySize = ftell(keyFile);
+	fseek(keyFile, 0, SEEK_SET);
+	
+	if (keySize == 0)
+	{
+		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "invalid key file size, check the key file");
+		return NGX_ERROR;
+	}
+
+	conf->_auth_jwt_keyfile.data = ngx_palloc(cf->pool, keySize);
+	fread(conf->_auth_jwt_keyfile.data, 1, keySize, keyFile);
+	conf->_auth_jwt_keyfile.len = (int)keySize;
+
+	fclose(keyFile);
+	return NGX_OK;
+}
 
 static char *
 ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
@@ -391,6 +452,7 @@ ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 	ngx_conf_merge_str_value(conf->auth_jwt_key, prev->auth_jwt_key, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_validation_type, prev->auth_jwt_validation_type, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_algorithm, prev->auth_jwt_algorithm, "HS256");
+	ngx_conf_merge_str_value(conf->auth_jwt_keyfile_path, prev->auth_jwt_keyfile_path, "");
 	ngx_conf_merge_off_value(conf->auth_jwt_validate_email, prev->auth_jwt_validate_email, 1);
 	
 	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1)) 
@@ -403,6 +465,26 @@ ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 		conf->auth_jwt_redirect = (prev->auth_jwt_redirect == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_redirect;
 	}
 
+	if (conf->auth_jwt_use_keyfile == ((ngx_flag_t) -1))
+	{
+		conf->auth_jwt_use_keyfile = (prev->auth_jwt_use_keyfile == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_use_keyfile;
+	}
+
+	// If the usage of the keyfile is specified, check if the key_path is also configured
+	if (conf->auth_jwt_use_keyfile == 1)
+	{
+		if (ngx_strcmp(conf->auth_jwt_keyfile_path.data, "") != 0)
+		{
+			if (loadAuthKey(cf, conf) != NGX_OK)
+				return NGX_CONF_ERROR;
+		}
+		else
+		{
+			ngx_log_error(NGX_LOG_ERR, cf->log, 0, "auth_jwt_keyfile_path not specified");
+			return NGX_CONF_ERROR;
+		}
+	}
+
 	return NGX_CONF_OK;
 }
 
diff --git a/test.sh b/test.sh
index 5b9faaa..f73a03b 100755
--- a/test.sh
+++ b/test.sh
@@ -25,6 +25,7 @@ main() {
   local MISSING_SUB_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
   local MISSING_EMAIL_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
   local VALID_RS256_JWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
+  local INVALID_RSA256_JWT=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
 
   test_jwt "Insecure test" "/" "200"
 
@@ -45,6 +46,10 @@ main() {
   test_jwt "Secure test with jwt cookie - with no email" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_EMAIL_JWT}\""
 
   test_jwt "Secure test with rs256 jwt cookie" "/secure-rs256/" "200" " --cookie \"rampartjwt=${VALID_RS256_JWT}\""
+
+  test_jwt "Secure test rsa256 from file with valid jwt" "/secure-rs256-file/" "200" "--header \"Authorization: Bearer ${VALID_RS256_JWT}\""
+
+  test_jwt "Secure test rsa256 from file with invalid jwt" "/secure-rs256-file/" "401" "--header \"Authorization: Bearer ${INVALID_RSA256_JWT}\""
 }
 
 main "$@"

From 148987d81d31cf16cfb8ccc391056c6e2528ab39 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Fri, 20 May 2022 14:30:02 -0400
Subject: [PATCH 059/130] added NGINX_VERSION to Makefile to allow for
 overriding

---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 8a2290b..eb7a014 100644
--- a/Makefile
+++ b/Makefile
@@ -18,7 +18,7 @@ all:
 .PHONY: build-nginx
 build-nginx:
 	@echo "${BLUE}  Building...${NC}"
-	@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . ; \
+	@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . --build-arg NGINX_VERSION=${NGINX_VERSION} ; \
 	if [ $$? -ne 0 ] ; \
 		then echo "${RED}  Build failed :(${NC}" ; \
 	else echo "${GREEN}✓ Successfully built NGINX module ${NC}" ; fi
@@ -26,7 +26,7 @@ build-nginx:
 .PHONY: rebuild-nginx
 rebuild-nginx:
 	@echo "${BLUE}  Rebuilding...${NC}"
-	@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . --no-cache ; \
+	@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . --no-cache --build-arg NGINX_VERSION=${NGINX_VERSION} ; \
 	if [ $$? -ne 0 ] ; \
 		then echo "${RED}  Build failed :(${NC}" ; \
 	else echo "${GREEN}✓ Successfully rebuilt NGINX module ${NC}" ; fi

From e959c0c39cf5cb24b9161057ed23940fd1a11346 Mon Sep 17 00:00:00 2001
From: Tim Underhay <15734900+KensingtonTech@users.noreply.github.com>
Date: Tue, 7 Jun 2022 20:49:30 -0600
Subject: [PATCH 060/130] Docker / build refactor & update Nginx (#69)

* Build with latest nginx version (1.21.6)
Image builder now multi-stage
Image builder uses debian:bullseye-slim to build module (same as official nginx image's base)
Use nginx official image as final image base
Now using sed to modify OOTB nginx.conf to load the module.
Moved test-runner customisations into separate compose test stack
Updated Makefile to use docker compose for tests.

* Make org name, image name, compose project name, and nginx configurable via env vars.
Clean up dangling stage images during build.

* Removed copy of libjansson and libjwt from start-nginx target.
Updated Readme.

* Bumped default version to 1.22.0.
Fix for v1.16.1.
Test runner runs correct nginx version.

Co-authored-by: Josh McCullough <JoshMcCullough@users.noreply.github.com>
---
 .env                    |   1 +
 Dockerfile              | 127 +++++++++++-----------------------------
 Dockerfile-test         |   4 --
 Dockerfile-test-nginx   |  10 ++++
 Dockerfile-test-runner  |   4 ++
 Makefile                |  46 ++++++++-------
 README.md               |  32 +++++-----
 docker-compose-test.yml |  20 +++++++
 resources/nginx.conf    |  26 +++-----
 test.sh                 |   3 +-
 10 files changed, 121 insertions(+), 152 deletions(-)
 create mode 100644 .env
 delete mode 100644 Dockerfile-test
 create mode 100644 Dockerfile-test-nginx
 create mode 100644 Dockerfile-test-runner
 create mode 100644 docker-compose-test.yml

diff --git a/.env b/.env
new file mode 100644
index 0000000..1bb6443
--- /dev/null
+++ b/.env
@@ -0,0 +1 @@
+COMPOSE_PROJECT_NAME=jwt-nginx-test
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index dd5482d..648fbee 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,97 +1,40 @@
-FROM centos:7
+ARG NGINX_VERSION=1.22.0
 
-LABEL maintainer="TeslaGov" email="developers@teslagov.com"
-
-ARG NGINX_VERSION=1.16.1
-ARG JANSSON_VERSION=2.13.1
-ARG LIBJWT_VERSION=1.12.0
-
-ENV LD_LIBRARY_PATH=/usr/local/lib
-ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/share/pkgconfig
-
-RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
-RUN echo "" >>/etc/yum.repos.d/nginx.repo
-RUN echo "[nginx]" >>/etc/yum.repos.d/nginx.repo
-RUN echo "name=nginx repo" >>/etc/yum.repos.d/nginx.repo
-RUN echo "baseurl=https://nginx.org/packages/centos/7/x86_64/" >>/etc/yum.repos.d/nginx.repo
-RUN echo "gpgcheck=0" >>/etc/yum.repos.d/nginx.repo
-RUN echo "enabled=1" >>/etc/yum.repos.d/nginx.repo
-
-RUN yum -y update && \
-    yum -y groupinstall 'Development Tools' && \
-    yum -y install pcre-devel pcre zlib-devel openssl-devel wget cmake3 check-devel check && \
-    yum -y install nginx-$NGINX_VERSION
-
-# for compiling for epel7
-RUN yum -y install libxml2 libxslt libxml2-devel libxslt-devel gd gd-devel perl-ExtUtils-Embed geoip geoip-devel google-perftools google-perftools-devel
-
-RUN mkdir -p /root/dl
-WORKDIR /root/dl
 
-# build jansson
-RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
-    unzip v$JANSSON_VERSION.zip && \
-    rm v$JANSSON_VERSION.zip && \
-    ln -sf jansson-$JANSSON_VERSION jansson && \
-    cd /root/dl/jansson && \
-    cmake3 . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
-    make && \
-    make check && \
-    make install
+FROM debian:bullseye-slim as BASE_IMAGE
+LABEL stage=builder
+RUN apt-get update \
+	&& apt-get install -y curl build-essential
 
-# build libjwt
-RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
-    unzip v$LIBJWT_VERSION.zip && \
-    rm v$LIBJWT_VERSION.zip && \
-    ln -sf libjwt-$LIBJWT_VERSION libjwt && \
-    cd /root/dl/libjwt && \
-    autoreconf -i && \
-    ./configure && \
-    make all && \
-    make install
 
+FROM BASE_IMAGE as BUILD_IMAGE
+LABEL stage=builder
+ENV LD_LIBRARY_PATH=/usr/local/lib
+ARG NGINX_VERSION
 ADD . /root/dl/ngx-http-auth-jwt-module
-
-# after 1.11.5 when compiling for a server that was compiled with --with-compat use this command
-# ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module --with-cc-opt='-std=gnu99'
-# cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /etc/nginx/modules/.
-# build nginx module against nginx sources
-#
-# 1.10.2 from nginx by default use config flags... I had to add the -std=c99 and could not achieve "binary compatibility"
-# ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-file-aio --with-threads --with-ipv6 --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_ssl_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -std=c99'
-#
-# rh-nginx110 uses these config flags
-# ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/opt/rh/rh-nginx110/root/usr/share/nginx --sbin-path=/opt/rh/rh-nginx110/root/usr/sbin/nginx --modules-path=/opt/rh/rh-nginx110/root/usr/lib64/nginx/modules --conf-path=/etc/opt/rh/rh-nginx110/nginx/nginx.conf --error-log-path=/var/opt/rh/rh-nginx110/log/nginx/error.log --http-log-path=/var/opt/rh/rh-nginx110/log/nginx/access.log --http-client-body-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/opt/rh/rh-nginx110/lib/nginx/tmp/scgi --pid-path=/var/opt/rh/rh-nginx110/run/nginx/nginx.pid --lock-path=/var/opt/rh/rh-nginx110/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=c99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
-#
-# epel7 version 1.12.1 uses these config flags
-# ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
-#
-# epel7 version 1.16.1 uses these config flags
-# ./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-stream_ssl_preread_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-http_auth_request_module --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
-
-# ARG CACHEBUST=1
-
-RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
-    tar -xzf nginx-$NGINX_VERSION.tar.gz && \
-    rm nginx-$NGINX_VERSION.tar.gz && \
-    ln -sf nginx-$NGINX_VERSION nginx && \
-    cd /root/dl/nginx && \
-    ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module --with-cc-opt='-std=gnu99' && \
-    make modules && \
-    cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
-
-# Get nginx ready to run
-COPY resources/nginx.conf /etc/nginx/nginx.conf
-COPY resources/test-jwt-nginx.conf /etc/nginx/conf.d/test-jwt-nginx.conf
-COPY resources/rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
-RUN rm -rf /usr/share/nginx/html
-RUN cp -r /root/dl/nginx/html /usr/share/nginx
-RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure
-RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256
-RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-auth-header
-RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-no-redirect
-RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256-file
-
-ENTRYPOINT ["/usr/sbin/nginx"]
-
-EXPOSE 8000
+RUN set -x \
+	&& apt-get install -y libjwt-dev libjwt0 libjansson-dev libjansson4 libpcre2-dev zlib1g-dev libpcre3-dev \
+	&& mkdir -p /root/dl
+WORKDIR /root/dl
+RUN set -x \
+	&& curl -O http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz \
+	&& tar -xzf nginx-$NGINX_VERSION.tar.gz \
+	&& rm nginx-$NGINX_VERSION.tar.gz \
+	&& ln -sf nginx-$NGINX_VERSION nginx \
+	&& cd /root/dl/nginx \
+	&& ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module \
+	&& make modules
+
+
+FROM nginx:${NGINX_VERSION}
+LABEL stage=builder
+RUN apt-get update \
+    && apt-get -y install libjansson4 libjwt0 \
+		&& cd /etc/nginx \
+		&& cp nginx.conf nginx.conf.orig \
+		&& sed -ri '/pid\s+\/var\/run\/nginx\.pid;$/a load_module \/usr\/lib64\/nginx\/modules\/ngx_http_auth_jwt_module\.so;' nginx.conf
+
+
+LABEL stage=
+LABEL maintainer="TeslaGov" email="developers@teslagov.com"
+COPY --from=BUILD_IMAGE /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/
diff --git a/Dockerfile-test b/Dockerfile-test
deleted file mode 100644
index adff57a..0000000
--- a/Dockerfile-test
+++ /dev/null
@@ -1,4 +0,0 @@
-FROM alpine:3.7
-RUN apk add --no-cache bash curl
-COPY test.sh .
-CMD ["./test.sh"]
\ No newline at end of file
diff --git a/Dockerfile-test-nginx b/Dockerfile-test-nginx
new file mode 100644
index 0000000..10a1eae
--- /dev/null
+++ b/Dockerfile-test-nginx
@@ -0,0 +1,10 @@
+ARG BASE_IMAGE=teslagov/jwt-nginx:latest
+
+FROM ${BASE_IMAGE} as NGINX
+COPY resources/test-jwt-nginx.conf /etc/nginx/conf.d/test-jwt-nginx.conf
+COPY resources/rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
+RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure \
+  && cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256 \
+  && cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256-file \
+  && cp -r /usr/share/nginx/html /usr/share/nginx/secure-auth-header \
+  && cp -r /usr/share/nginx/html /usr/share/nginx/secure-no-redirect
diff --git a/Dockerfile-test-runner b/Dockerfile-test-runner
new file mode 100644
index 0000000..bd9fc59
--- /dev/null
+++ b/Dockerfile-test-runner
@@ -0,0 +1,4 @@
+FROM alpine:3.7
+COPY test.sh .
+RUN apk add curl bash
+CMD ["./test.sh"]
diff --git a/Makefile b/Makefile
index eb7a014..0661439 100644
--- a/Makefile
+++ b/Makefile
@@ -5,55 +5,61 @@ GREEN := \033[0;32m
 RED   := \033[0;31m
 NC    := \033[0m
 
-DOCKER_ORG_NAME = teslagov
-DOCKER_IMAGE_NAME = jwt-nginx
+DOCKER_ORG_NAME ?= teslagov
+DOCKER_IMAGE_NAME ?= jwt-nginx
+COMPOSE_PROJECT_NAME ?= jwt-nginx-test
+NGINX_VERSION ?= 1.22.0
 
 .PHONY: all
 all:
 	@$(MAKE) build-nginx
-	@$(MAKE) build-test-runner
 	@$(MAKE) start-nginx
 	@$(MAKE) test
 
 .PHONY: build-nginx
 build-nginx:
 	@echo "${BLUE}  Building...${NC}"
-	@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . --build-arg NGINX_VERSION=${NGINX_VERSION} ; \
-	if [ $$? -ne 0 ] ; \
+	@docker image pull debian:bullseye-slim
+	@docker image pull nginx:${NGINX_VERSION}
+	@docker image build -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:latest -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:${NGINX_VERSION} --build-arg NGINX_VERSION=${NGINX_VERSION} . ; \
+	SUCCESS=$$? ; \
+	docker rmi $$(docker images --filter=label=stage=builder --quiet); \
+	if [ "$$SUCCESS" -ne 0 ] ; \
 		then echo "${RED}  Build failed :(${NC}" ; \
 	else echo "${GREEN}✓ Successfully built NGINX module ${NC}" ; fi
 
 .PHONY: rebuild-nginx
 rebuild-nginx:
 	@echo "${BLUE}  Rebuilding...${NC}"
-	@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . --no-cache --build-arg NGINX_VERSION=${NGINX_VERSION} ; \
-	if [ $$? -ne 0 ] ; \
+	@docker image pull debian:bullseye-slim
+	@docker image pull nginx:${NGINX_VERSION}
+	@docker image build -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:latest -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:${NGINX_VERSION} --build-arg NGINX_VERSION=${NGINX_VERSION} . --no-cache ; \
+	SUCCESS=$$? ; \
+	docker rmi $$(docker images --filter=label=stage=builder --quiet); \
+	if [ "$$SUCCESS" -ne 0 ] ; \
 		then echo "${RED}  Build failed :(${NC}" ; \
 	else echo "${GREEN}✓ Successfully rebuilt NGINX module ${NC}" ; fi
 
 .PHONY: stop-nginx
 stop-nginx:
-	docker stop $(shell docker inspect --format="{{.Id}}" "$(DOCKER_IMAGE_NAME)-cont") ||:
+	docker stop $(shell docker inspect --format="{{.Id}}" "$(DOCKER_IMAGE_NAME)") ||:
 
 .PHONY: start-nginx
 start-nginx:
-	docker run --rm --name "$(DOCKER_IMAGE_NAME)-cont" -d -p 8000:8000 $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME)
-	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
-	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjansson.so.4.13.0 .
-	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjwt.a .
-	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjwt.la .
-	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/libjwt.so.0.7.0 .
-	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/pkgconfig/jansson.pc .
-	docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/local/lib/pkgconfig/libjwt.pc .
+	docker run --rm --name "${DOCKER_IMAGE_NAME}" -d -p 8000:8000 ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}
+	docker cp ${DOCKER_IMAGE_NAME}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
 
 .PHONY: build-test-runner
 build-test-runner:
-	docker image build -f Dockerfile-test -t $(DOCKER_ORG_NAME)/jwt-nginx-test-runner .
+	IMAGE_VERSION=${NGINX_VERSION} docker compose -f ./docker-compose-test.yml build
 
-.PHONY: frebuild-test-runner
+.PHONY: rebuild-test-runner
 rebuild-test-runner:
-	docker image build -f Dockerfile-test -t $(DOCKER_ORG_NAME)/jwt-nginx-test-runner . --no-cache
+	IMAGE_VERSION=${NGINX_VERSION} docker compose -f ./docker-compose-test.yml build --no-cache
 
 .PHONY: test
 test:
-	docker run --rm $(DOCKER_ORG_NAME)/jwt-nginx-test-runner
+	IMAGE_VERSION=${NGINX_VERSION} docker compose -f ./docker-compose-test.yml up --no-start
+	docker start ${COMPOSE_PROJECT_NAME}-nginx-1
+	docker start -a ${COMPOSE_PROJECT_NAME}-runner-1
+	docker compose -f ./docker-compose-test.yml down
\ No newline at end of file
diff --git a/README.md b/README.md
index 97e7d82..613ace6 100644
--- a/README.md
+++ b/README.md
@@ -11,23 +11,21 @@ When you make a change to the module, run `make rebuild-nginx`.
 
 When you make a change to `test.sh`, run `make rebuild-test-runner`.
 
-| Command                    | Description                                 |
-| -------------------------- |:-------------------------------------------:|
-| `make build-nginx`         | Builds the NGINX image                      |
-| `make rebuild-nginx`       | Re-builds the NGINX image                   |
-| `make build-test-runner`   | Builds the image that will run `test.sh`    |
-| `make rebuild-test-runner` | Re-builds the image that will run `test.sh` |
-| `make start-nginx`         | Starts the NGINX container                  |
-| `make stop-nginx`          | Stops the NGINX container                   |
-| `make test`                | Runs `test.sh` against the NGINX container  |
-
-You can re-run tests as many times as you like while NGINX is up.
-When you're done running tests, make sure to stop the NGINX container.
-
-The Dockerfile builds all of the dependencies as well as the module,
-downloads a binary version of NGINX, and runs the module as a dynamic module.
-
-Tests get executed in containers. This project is 100% Docker-ized.
+| Command                    | Description                                                       |
+| -------------------------- |:-----------------------------------------------------------------:|
+| `make build-nginx`         | Builds the NGINX image                                            |
+| `make rebuild-nginx`       | Re-builds the NGINX image                                         |
+| `make build-test-runner`   | Builds the images used by the test stack (uses Docker compose)    |
+| `make rebuild-test-runner` | Re-builds the images used by the test stack                       |
+| `make start-nginx`         | Starts the NGINX container                                        |
+| `make stop-nginx`          | Stops the NGINX container                                         |
+| `make test`                | Runs `test.sh` against the NGINX container (uses Docker compose)  |
+
+The image produced with `make build-nginx` only differs from the official Nginx image in two ways: the module itself and the nginx.conf configuration entry that loads it.
+
+The tests use a customized Nginx image, distinct from the main image, as well as a test runner image.  By running `make test`, the two test containers will be created up with Docker compose, started, and the tests run.  At the end, both containers will be automatically stopped and destroyed.
+
+This project is 100% Docker-ized.
 
 ## Dependencies
 This module depends on the [JWT C Library](https://github.com/benmcollins/libjwt)
diff --git a/docker-compose-test.yml b/docker-compose-test.yml
new file mode 100644
index 0000000..8d406f2
--- /dev/null
+++ b/docker-compose-test.yml
@@ -0,0 +1,20 @@
+version: '3.3'
+
+services:
+
+  nginx:
+    build:
+      context: .
+      dockerfile: Dockerfile-test-nginx
+      args:
+        BASE_IMAGE: ${IMAGE_NAME:-teslagov/jwt-nginx}:${IMAGE_VERSION:-latest}
+
+  runner:
+    build:
+      context: .
+      dockerfile: Dockerfile-test-runner
+    environment:
+      BASE_IMAGE: ${IMAGE_NAME:-teslagov/jwt-nginx}:${IMAGE_VERSION:-latest}
+    
+    depends_on:
+      - nginx-test
\ No newline at end of file
diff --git a/resources/nginx.conf b/resources/nginx.conf
index 7ea8afb..3981730 100644
--- a/resources/nginx.conf
+++ b/resources/nginx.conf
@@ -1,12 +1,12 @@
 
 user  nginx;
-worker_processes  1;
+worker_processes  auto;
 
-error_log  /var/log/nginx/error.log info;
+error_log  /var/log/nginx/error.log notice;
 pid        /var/run/nginx.pid;
-
 load_module /usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so;
 
+
 events {
     worker_connections  1024;
 }
@@ -16,14 +16,11 @@ http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
 
-    log_format  upstream_time  '$remote_addr $sent_http_x_userid [$time_local] "$request" '
-            '$status $body_bytes_sent "$http_referer" '
-            '"$http_user_agent" "$http_x_forwarded_for" '
-            'rt="$request_time" uct="$upstream_connect_time" '
-            'uht="$upstream_header_time" urt="$upstream_response_time" '
-            '$sent_http_x_email';
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
 
-    access_log  /var/log/nginx/access.log  upstream_time;
+    access_log  /var/log/nginx/access.log  main;
 
     sendfile        on;
     #tcp_nopush     on;
@@ -32,12 +29,5 @@ http {
 
     #gzip  on;
 
-    proxy_set_header Host                  $host;
-    proxy_set_header X-Forwarded-For       $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto     $scheme;
-    proxy_set_header X-Forwarded-Server    $remote_addr;
-
     include /etc/nginx/conf.d/*.conf;
-}
-
-daemon off;
+}
\ No newline at end of file
diff --git a/test.sh b/test.sh
index f73a03b..adeb777 100755
--- a/test.sh
+++ b/test.sh
@@ -10,7 +10,8 @@ test_jwt () {
   local expect=$3
   local extra=$4
 
-  cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://host.docker.internal:8000$path -H 'cache-control: no-cache' $extra"
+  cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://nginx:8000$path -H 'cache-control: no-cache' $extra"
+  
 
   test=$( eval ${cmd} )
   if [ "$test" -eq "$expect" ];then

From 16ea0fe374176d6f5315dbd85e542fc80d38ac4f Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 7 Jun 2022 23:04:56 -0400
Subject: [PATCH 061/130] Dockerfile formatting

---
 Dockerfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 648fbee..ad36f02 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,9 +30,9 @@ FROM nginx:${NGINX_VERSION}
 LABEL stage=builder
 RUN apt-get update \
     && apt-get -y install libjansson4 libjwt0 \
-		&& cd /etc/nginx \
-		&& cp nginx.conf nginx.conf.orig \
-		&& sed -ri '/pid\s+\/var\/run\/nginx\.pid;$/a load_module \/usr\/lib64\/nginx\/modules\/ngx_http_auth_jwt_module\.so;' nginx.conf
+	&& cd /etc/nginx \
+	&& cp nginx.conf nginx.conf.orig \
+	&& sed -ri '/pid\s+\/var\/run\/nginx\.pid;$/a load_module \/usr\/lib64\/nginx\/modules\/ngx_http_auth_jwt_module\.so;' nginx.conf
 
 
 LABEL stage=

From 9f8991f66a5e334f29a264fb862473556de25489 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 7 Jun 2022 23:05:53 -0400
Subject: [PATCH 062/130] Makefile cleanup

---
 Makefile | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Makefile b/Makefile
index 0661439..252f799 100644
--- a/Makefile
+++ b/Makefile
@@ -25,24 +25,24 @@ build-nginx:
 	SUCCESS=$$? ; \
 	docker rmi $$(docker images --filter=label=stage=builder --quiet); \
 	if [ "$$SUCCESS" -ne 0 ] ; \
-		then echo "${RED}  Build failed :(${NC}" ; \
-	else echo "${GREEN}✓ Successfully built NGINX module ${NC}" ; fi
+	then echo "${RED}  Build failed ${NC}"; \
+	else echo "${GREEN}✓ Successfully built NGINX module ${NC}"; fi
 
 .PHONY: rebuild-nginx
 rebuild-nginx:
 	@echo "${BLUE}  Rebuilding...${NC}"
 	@docker image pull debian:bullseye-slim
 	@docker image pull nginx:${NGINX_VERSION}
-	@docker image build -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:latest -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:${NGINX_VERSION} --build-arg NGINX_VERSION=${NGINX_VERSION} . --no-cache ; \
+	@docker image build -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:latest -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:${NGINX_VERSION} --build-arg NGINX_VERSION=${NGINX_VERSION} --no-cache .; \
 	SUCCESS=$$? ; \
 	docker rmi $$(docker images --filter=label=stage=builder --quiet); \
 	if [ "$$SUCCESS" -ne 0 ] ; \
-		then echo "${RED}  Build failed :(${NC}" ; \
-	else echo "${GREEN}✓ Successfully rebuilt NGINX module ${NC}" ; fi
+	then echo "${RED}  Build failed ${NC}"; \
+	else echo "${GREEN}✓ Successfully rebuilt NGINX module ${NC}"; fi
 
 .PHONY: stop-nginx
 stop-nginx:
-	docker stop $(shell docker inspect --format="{{.Id}}" "$(DOCKER_IMAGE_NAME)") ||:
+	docker stop "${DOCKER_IMAGE_NAME}"
 
 .PHONY: start-nginx
 start-nginx:

From 60b6f4bd3110a186983498b0810ba7aa8b6f421c Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 7 Jun 2022 23:06:14 -0400
Subject: [PATCH 063/130] add task to copy binaries from container

---
 .gitignore | 11 +----------
 Makefile   | 10 +++++++++-
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/.gitignore b/.gitignore
index 763f224..a676215 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,11 +1,2 @@
 .idea
-ngx_http_auth_jwt_module.so
-libjwt.so.0.6.0
-libjwt.la
-libjwt.a
-libjansson.so.4.13.0
-libjwt.so.0.7.0
-jansson.pc
-libjwt.pc
-libjansson.so.4.10.0
-libjwt.so.0.4.0
+bin
diff --git a/Makefile b/Makefile
index 252f799..4555781 100644
--- a/Makefile
+++ b/Makefile
@@ -47,7 +47,15 @@ stop-nginx:
 .PHONY: start-nginx
 start-nginx:
 	docker run --rm --name "${DOCKER_IMAGE_NAME}" -d -p 8000:8000 ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}
-	docker cp ${DOCKER_IMAGE_NAME}:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
+
+.PHONY: cp-bin
+cp-bin: start-nginx
+	rm -rf bin
+	mkdir -p bin
+	docker exec jwt-nginx sh -c "tar -chf - \
+		/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so \
+		/usr/lib/x86_64-linux-gnu/libjansson.so.* \
+		/usr/lib/x86_64-linux-gnu/libjwt.*" 2>/dev/null | tar -xf - -C bin &>/dev/null
 
 .PHONY: build-test-runner
 build-test-runner:

From aa024c58163b0639dbc95377c8c4cd95fcbf4cd0 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Wed, 8 Jun 2022 10:26:33 -0400
Subject: [PATCH 064/130] add option to not extract sub -- fixes #66 (#70)

* add option to not extract sub

* move email variables into block where they are used

* cleanup
---
 README.md                      | 15 ++++++++--
 src/ngx_http_auth_jwt_module.c | 55 ++++++++++++++++++++--------------
 test.sh                        |  5 ++--
 3 files changed, 46 insertions(+), 29 deletions(-)

diff --git a/README.md b/README.md
index 613ace6..718d7b5 100644
--- a/README.md
+++ b/README.md
@@ -41,9 +41,10 @@ which can be specified in on the `main` `server` or `location` level.
 auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF"; # see docs for format based on algorithm
 auth_jwt_loginurl "https://yourdomain.com/loginpage";
 auth_jwt_enabled on;
-auth_jwt_algorithm HS256; # or RS256
+auth_jwt_algorithm HS256;    # or RS256
+auth_jwt_extract_sub on;     # or off
 auth_jwt_validate_email on;  # or off
-auth_jwt_use_keyfile off; # or on
+auth_jwt_use_keyfile off;    # or on
 auth_jwt_keyfile_path "/app/pub_key";
 ```
 
@@ -87,9 +88,17 @@ auth_jwt_validation_type COOKIE=rampartjwt;
 By default the authorization header is used to provide a JWT for validation.
 However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
 
+```
+auth_jwt_extract_sub
+```
+By default, the module will attempt to extract the `sub` claim (e.g. the user's id) from the JWT. If successful, the 
+value will be set in the `x-userid` HTTP header. An error will be logged if this option is enabled and the JWT does not 
+contain the `sub` claim.
+
 ```
 auth_jwt_validate_email off;
 ```
 By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the
 session, and will log an error if it isn't found.  To disable this behavior, for instance if you are using a different
-user identifier property such as 'sub', set `auth_jwt_validate_email` to the value `off`.
+user identifier property such as `sub`, set `auth_jwt_validate_email` to the value `off`. _Note that this flag may be 
+renamed to `auth_jwt_extract_email` in a future release._
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index fbd07ba..f5ca357 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -27,6 +27,7 @@ typedef struct {
 	ngx_flag_t   auth_jwt_redirect;
 	ngx_str_t    auth_jwt_validation_type;
 	ngx_str_t    auth_jwt_algorithm;
+	ngx_flag_t   auth_jwt_extract_sub;
 	ngx_flag_t   auth_jwt_validate_email;
 	ngx_str_t    auth_jwt_keyfile_path;
 	ngx_flag_t   auth_jwt_use_keyfile;
@@ -84,6 +85,13 @@ static ngx_command_t ngx_http_auth_jwt_commands[] = {
 		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_algorithm),
 		NULL },
 
+	{ ngx_string("auth_jwt_extract_sub"),
+		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
+		ngx_conf_set_flag_slot,
+		NGX_HTTP_LOC_CONF_OFFSET,
+		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_extract_sub),
+		NULL },
+
 	{ ngx_string("auth_jwt_validate_email"),
 		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
 		ngx_conf_set_flag_slot,
@@ -152,10 +160,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	jwt_t *jwt = NULL;
 	int jwtParseReturnCode;
 	jwt_alg_t alg;
-	const char* sub;
-	const char* email;
-	ngx_str_t sub_t;
-	ngx_str_t email_t;
 	time_t exp;
 	time_t now;
 	ngx_str_t auth_jwt_algorithm;
@@ -175,6 +179,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	}
 	
 	jwtCookieValChrPtr = getJwt(r, jwtcf->auth_jwt_validation_type);
+
 	if (jwtCookieValChrPtr == NULL)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a jwt");
@@ -184,6 +189,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	// convert key from hex to binary, if a symmetric key
 
 	auth_jwt_algorithm = jwtcf->auth_jwt_algorithm;
+
 	if (auth_jwt_algorithm.len == 0 || (auth_jwt_algorithm.len == sizeof("HS256") - 1 && ngx_strncmp(auth_jwt_algorithm.data, "HS256", sizeof("HS256") - 1)==0))
 	{
 		keylen = jwtcf->auth_jwt_key.len / 2;
@@ -218,6 +224,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	
 	// validate the jwt
 	jwtParseReturnCode = jwt_decode(&jwt, jwtCookieValChrPtr, keyBinary, keylen);
+
 	if (jwtParseReturnCode != 0)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse jwt");
@@ -226,6 +233,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	
 	// validate the algorithm
 	alg = jwt_get_alg(jwt);
+
 	if (alg != JWT_ALG_HS256 && alg != JWT_ALG_RS256)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm in jwt %d", alg);
@@ -235,6 +243,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	// validate the exp date of the JWT
 	exp = (time_t)jwt_get_grant_int(jwt, "exp");
 	now = time(NULL);
+
 	if (exp < now)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt has expired");
@@ -242,38 +251,43 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	}
 
 	// extract the userid
-	sub = jwt_get_grant(jwt, "sub");
-	if (sub == NULL)
+	if (jwtcf->auth_jwt_extract_sub == 1)
 	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain a subject");
-	}
-	else
-	{
-		sub_t = ngx_char_ptr_to_str_t(r->pool, (char *)sub);
-		set_custom_header_in_headers_out(r, &useridHeaderName, &sub_t);
+		const char* sub = jwt_get_grant(jwt, "sub");
+
+		if (sub == NULL)
+		{
+			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain a subject");
+		}
+		else
+		{
+			ngx_str_t sub_t = ngx_char_ptr_to_str_t(r->pool, (char *)sub);
+
+			set_custom_header_in_headers_out(r, &useridHeaderName, &sub_t);
+		}
 	}
 
 	if (jwtcf->auth_jwt_validate_email == 1)
 	{
-		email = jwt_get_grant(jwt, "emailAddress");
+		const char* email = jwt_get_grant(jwt, "emailAddress");
+		
 		if (email == NULL)
 		{
 			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain an email address");
 		}
 		else
 		{
-			email_t = ngx_char_ptr_to_str_t(r->pool, (char *)email);
+			ngx_str_t email_t = ngx_char_ptr_to_str_t(r->pool, (char *)email);
+
 			set_custom_header_in_headers_out(r, &emailHeaderName, &email_t);
 		}
 	}
 
 	jwt_free(jwt);
-
 	
 	return NGX_OK;
 	
 	redirect:
-
 		if (jwt)
 		{
 			jwt_free(jwt);
@@ -303,7 +317,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			uintptr_t escaped_len;
 
 			loginlen = jwtcf->auth_jwt_loginurl.len;
-
 			scheme = (r->connection->ssl) ? "https" : "http";
 			server = r->headers_in.server;
 
@@ -318,15 +331,11 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 				uri.data = ngx_palloc(r->pool, request_uri_var->len);
 				uri.len = request_uri_var->len;
 				ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
-
-				// ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "found uri with querystring %s", ngx_str_t_to_char_ptr(r->pool, uri));
 			}
 			else
 			{
 				// fallback to the querystring without params
 				uri = r->uri;
-
-				// ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "fallback to querystring without params");
 			}
 
 			// escape the URI
@@ -350,8 +359,6 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			ngx_memcpy(return_url+return_url_idx, uri_escaped.data, uri_escaped.len);
 			return_url_idx += uri_escaped.len;
 			r->headers_out.location->value.data = (u_char *)return_url;
-
-			// ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "return_url: %s", ngx_str_t_to_char_ptr(r->pool, r->headers_out.location->value));
 		}
 		else
 		{
@@ -403,6 +410,7 @@ ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf)
 	// set the flag to unset
 	conf->auth_jwt_enabled = (ngx_flag_t) -1;
 	conf->auth_jwt_redirect = (ngx_flag_t) -1;
+	conf->auth_jwt_extract_sub = (ngx_flag_t) -1;
 	conf->auth_jwt_validate_email = (ngx_flag_t) -1;
 	conf->auth_jwt_use_keyfile = (ngx_flag_t) -1;
 
@@ -453,6 +461,7 @@ ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
 	ngx_conf_merge_str_value(conf->auth_jwt_validation_type, prev->auth_jwt_validation_type, "");
 	ngx_conf_merge_str_value(conf->auth_jwt_algorithm, prev->auth_jwt_algorithm, "HS256");
 	ngx_conf_merge_str_value(conf->auth_jwt_keyfile_path, prev->auth_jwt_keyfile_path, "");
+	ngx_conf_merge_off_value(conf->auth_jwt_extract_sub, prev->auth_jwt_extract_sub, 1);
 	ngx_conf_merge_off_value(conf->auth_jwt_validate_email, prev->auth_jwt_validate_email, 1);
 	
 	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1)) 
diff --git a/test.sh b/test.sh
index adeb777..55230b4 100755
--- a/test.sh
+++ b/test.sh
@@ -11,10 +11,9 @@ test_jwt () {
   local extra=$4
 
   cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://nginx:8000$path -H 'cache-control: no-cache' $extra"
-  
-
   test=$( eval ${cmd} )
-  if [ "$test" -eq "$expect" ];then
+
+  if [ "$test" -eq "$expect" ]; then
     echo -e "${GREEN}${name}: passed (${test})${NONE}";
   else
     echo -e "${RED}${name}: failed (${test})${NONE}";

From 8f39e48fbbeecf909c6c1b7e5dd894b9daee6c4b Mon Sep 17 00:00:00 2001
From: Harm van Tilborg <harm@zeroxcool.net>
Date: Mon, 15 Aug 2022 15:51:50 +0200
Subject: [PATCH 065/130] Do not respond with a "Location" header when
 redirects are disabled (#74)

* In the default nginx config (used in the Docker container), nginx listens on port 80

* Do not respond with a "Location" header when redirects are disabled
---
 Makefile                       |   4 +-
 src/ngx_http_auth_jwt_module.c | 143 ++++++++++++++++-----------------
 2 files changed, 73 insertions(+), 74 deletions(-)

diff --git a/Makefile b/Makefile
index 4555781..17c7aa2 100644
--- a/Makefile
+++ b/Makefile
@@ -46,7 +46,7 @@ stop-nginx:
 
 .PHONY: start-nginx
 start-nginx:
-	docker run --rm --name "${DOCKER_IMAGE_NAME}" -d -p 8000:8000 ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}
+	docker run --rm --name "${DOCKER_IMAGE_NAME}" -d -p 8000:80 ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}
 
 .PHONY: cp-bin
 cp-bin: start-nginx
@@ -70,4 +70,4 @@ test:
 	IMAGE_VERSION=${NGINX_VERSION} docker compose -f ./docker-compose-test.yml up --no-start
 	docker start ${COMPOSE_PROJECT_NAME}-nginx-1
 	docker start -a ${COMPOSE_PROJECT_NAME}-runner-1
-	docker compose -f ./docker-compose-test.yml down
\ No newline at end of file
+	docker compose -f ./docker-compose-test.yml down
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index f5ca357..f91e608 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -227,7 +227,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 
 	if (jwtParseReturnCode != 0)
 	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse jwt");
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse jwt, error code %d", jwtParseReturnCode);
 		goto redirect;
 	}
 	
@@ -293,88 +293,87 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			jwt_free(jwt);
 		}
 
-		r->headers_out.location = ngx_list_push(&r->headers_out.headers);
-		
-		if (r->headers_out.location == NULL) 
+		if (jwtcf->auth_jwt_redirect)
 		{
-			ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
-		}
+			r->headers_out.location = ngx_list_push(&r->headers_out.headers);
 
-		r->headers_out.location->hash = 1;
-		r->headers_out.location->key.len = sizeof("Location") - 1;
-		r->headers_out.location->key.data = (u_char *) "Location";
+			if (r->headers_out.location == NULL)
+			{
+				ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+			}
 
-		if (r->method == NGX_HTTP_GET)
-		{
-			int loginlen;
-			char * scheme;
-			ngx_str_t server;
-			ngx_str_t uri_variable_name = ngx_string("request_uri");
-			ngx_int_t uri_variable_hash;
-			ngx_http_variable_value_t * request_uri_var;
-			ngx_str_t uri;
-			ngx_str_t uri_escaped;
-			uintptr_t escaped_len;
-
-			loginlen = jwtcf->auth_jwt_loginurl.len;
-			scheme = (r->connection->ssl) ? "https" : "http";
-			server = r->headers_in.server;
-
-			// get the URI
-			uri_variable_hash = ngx_hash_key(uri_variable_name.data, uri_variable_name.len);
-			request_uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
-
-			// get the URI
-			if(request_uri_var && !request_uri_var->not_found && request_uri_var->valid)
+			r->headers_out.location->hash = 1;
+			r->headers_out.location->key.len = sizeof("Location") - 1;
+			r->headers_out.location->key.data = (u_char *) "Location";
+
+			if (r->method == NGX_HTTP_GET)
 			{
-				// ideally we would like the uri with the querystring parameters
-				uri.data = ngx_palloc(r->pool, request_uri_var->len);
-				uri.len = request_uri_var->len;
-				ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
+				int loginlen;
+				char * scheme;
+				ngx_str_t server;
+				ngx_str_t uri_variable_name = ngx_string("request_uri");
+				ngx_int_t uri_variable_hash;
+				ngx_http_variable_value_t * request_uri_var;
+				ngx_str_t uri;
+				ngx_str_t uri_escaped;
+				uintptr_t escaped_len;
+
+				loginlen = jwtcf->auth_jwt_loginurl.len;
+				scheme = (r->connection->ssl) ? "https" : "http";
+				server = r->headers_in.server;
+
+				// get the URI
+				uri_variable_hash = ngx_hash_key(uri_variable_name.data, uri_variable_name.len);
+				request_uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
+
+				// get the URI
+				if(request_uri_var && !request_uri_var->not_found && request_uri_var->valid)
+				{
+					// ideally we would like the uri with the querystring parameters
+					uri.data = ngx_palloc(r->pool, request_uri_var->len);
+					uri.len = request_uri_var->len;
+					ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
+				}
+				else
+				{
+					// fallback to the querystring without params
+					uri = r->uri;
+				}
+
+				// escape the URI
+				escaped_len = 2 * ngx_escape_uri(NULL, uri.data, uri.len, NGX_ESCAPE_ARGS) + uri.len;
+				uri_escaped.data = ngx_palloc(r->pool, escaped_len);
+				uri_escaped.len = escaped_len;
+				ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
+
+				r->headers_out.location->value.len = loginlen + sizeof("?return_url=") - 1 + strlen(scheme) + sizeof("://") - 1 + server.len + uri_escaped.len;
+				return_url = ngx_palloc(r->pool, r->headers_out.location->value.len);
+				ngx_memcpy(return_url, jwtcf->auth_jwt_loginurl.data, jwtcf->auth_jwt_loginurl.len);
+				int return_url_idx = jwtcf->auth_jwt_loginurl.len;
+				ngx_memcpy(return_url+return_url_idx, "?return_url=", sizeof("?return_url=") - 1);
+				return_url_idx += sizeof("?return_url=") - 1;
+				ngx_memcpy(return_url+return_url_idx, scheme, strlen(scheme));
+				return_url_idx += strlen(scheme);
+				ngx_memcpy(return_url+return_url_idx, "://", sizeof("://") - 1);
+				return_url_idx += sizeof("://") - 1;
+				ngx_memcpy(return_url+return_url_idx, server.data, server.len);
+				return_url_idx += server.len;
+				ngx_memcpy(return_url+return_url_idx, uri_escaped.data, uri_escaped.len);
+				return_url_idx += uri_escaped.len;
+				r->headers_out.location->value.data = (u_char *)return_url;
 			}
 			else
 			{
-				// fallback to the querystring without params
-				uri = r->uri;
+				// for non-get requests, redirect to the login page without a return URL
+				r->headers_out.location->value.len = jwtcf->auth_jwt_loginurl.len;
+				r->headers_out.location->value.data = jwtcf->auth_jwt_loginurl.data;
 			}
 
-			// escape the URI
-			escaped_len = 2 * ngx_escape_uri(NULL, uri.data, uri.len, NGX_ESCAPE_ARGS) + uri.len;
-			uri_escaped.data = ngx_palloc(r->pool, escaped_len);
-			uri_escaped.len = escaped_len;
-			ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
-
-			r->headers_out.location->value.len = loginlen + sizeof("?return_url=") - 1 + strlen(scheme) + sizeof("://") - 1 + server.len + uri_escaped.len;
-			return_url = ngx_palloc(r->pool, r->headers_out.location->value.len);
-			ngx_memcpy(return_url, jwtcf->auth_jwt_loginurl.data, jwtcf->auth_jwt_loginurl.len);
-			int return_url_idx = jwtcf->auth_jwt_loginurl.len;
-			ngx_memcpy(return_url+return_url_idx, "?return_url=", sizeof("?return_url=") - 1);
-			return_url_idx += sizeof("?return_url=") - 1;
-			ngx_memcpy(return_url+return_url_idx, scheme, strlen(scheme));
-			return_url_idx += strlen(scheme);
-			ngx_memcpy(return_url+return_url_idx, "://", sizeof("://") - 1);
-			return_url_idx += sizeof("://") - 1;
-			ngx_memcpy(return_url+return_url_idx, server.data, server.len);
-			return_url_idx += server.len;
-			ngx_memcpy(return_url+return_url_idx, uri_escaped.data, uri_escaped.len);
-			return_url_idx += uri_escaped.len;
-			r->headers_out.location->value.data = (u_char *)return_url;
-		}
-		else
-		{
-			// for non-get requests, redirect to the login page without a return URL
-			r->headers_out.location->value.len = jwtcf->auth_jwt_loginurl.len;
-			r->headers_out.location->value.data = jwtcf->auth_jwt_loginurl.data;
-		}
-
-		if (jwtcf->auth_jwt_redirect)
-		{
 			return NGX_HTTP_MOVED_TEMPORARILY;
 		}
-		else
-		{
-			return NGX_HTTP_UNAUTHORIZED;
-		}
+
+		// When no redirect is needed, no "Location" header construction is needed, and we can respond with a 401
+		return NGX_HTTP_UNAUTHORIZED;
 }
 
 

From 1cf8606dd89deb74f275d1e4b81c3d6d6913cefb Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Fri, 28 Oct 2022 14:17:34 -0400
Subject: [PATCH 066/130] update cookie name in README and test

---
 README.md                     | 2 +-
 resources/test-jwt-nginx.conf | 4 ++--
 test.sh                       | 8 ++++----
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 718d7b5..fe1a2e5 100644
--- a/README.md
+++ b/README.md
@@ -83,7 +83,7 @@ If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
 
 ```
 auth_jwt_validation_type AUTHORIZATION;
-auth_jwt_validation_type COOKIE=rampartjwt;
+auth_jwt_validation_type COOKIE=jwt;
 ```
 By default the authorization header is used to provide a JWT for validation.
 However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
diff --git a/resources/test-jwt-nginx.conf b/resources/test-jwt-nginx.conf
index cbb356c..53f512b 100644
--- a/resources/test-jwt-nginx.conf
+++ b/resources/test-jwt-nginx.conf
@@ -16,7 +16,7 @@ server {
 
     location ~ ^/secure/ {
         auth_jwt_enabled   on;
-        auth_jwt_validation_type COOKIE=rampartjwt;
+        auth_jwt_validation_type COOKIE=jwt;
         root  /usr/share/nginx;
         index  index.html index.htm;
     }
@@ -29,7 +29,7 @@ server {
 
     location ~ ^/secure-rs256/ {
         auth_jwt_enabled on;
-        auth_jwt_validation_type COOKIE=rampartjwt;
+        auth_jwt_validation_type COOKIE=jwt;
         auth_jwt_algorithm RS256;
         auth_jwt_key "-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
diff --git a/test.sh b/test.sh
index 55230b4..45d21ee 100755
--- a/test.sh
+++ b/test.sh
@@ -31,7 +31,7 @@ main() {
 
   test_jwt "Secure test without jwt cookie" "/secure/" "302"
 
-  test_jwt "Secure test with jwt cookie" "/secure/" "200" "--cookie \"rampartjwt=${VALIDJWT}\""
+  test_jwt "Secure test with jwt cookie" "/secure/" "200" "--cookie \"jwt=${VALIDJWT}\""
 
   test_jwt "Secure test with jwt auth header" "/secure-auth-header/" "200" "--header \"Authorization: Bearer ${VALIDJWT}\""
 
@@ -41,11 +41,11 @@ main() {
 
   test_jwt "Secure test without jwt auth header" "/secure-no-redirect/" "401"
 
-  test_jwt "Secure test with jwt cookie - with no sub" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_SUB_JWT}\""
+  test_jwt "Secure test with jwt cookie - with no sub" "/secure/" "200" " --cookie \"jwt=${MISSING_SUB_JWT}\""
 
-  test_jwt "Secure test with jwt cookie - with no email" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_EMAIL_JWT}\""
+  test_jwt "Secure test with jwt cookie - with no email" "/secure/" "200" " --cookie \"jwt=${MISSING_EMAIL_JWT}\""
 
-  test_jwt "Secure test with rs256 jwt cookie" "/secure-rs256/" "200" " --cookie \"rampartjwt=${VALID_RS256_JWT}\""
+  test_jwt "Secure test with rs256 jwt cookie" "/secure-rs256/" "200" " --cookie \"jwt=${VALID_RS256_JWT}\""
 
   test_jwt "Secure test rsa256 from file with valid jwt" "/secure-rs256-file/" "200" "--header \"Authorization: Bearer ${VALID_RS256_JWT}\""
 

From bd0911851838428a62537f988ffbf165e8d10e18 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Fri, 28 Oct 2022 14:28:45 -0400
Subject: [PATCH 067/130] update README

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index fe1a2e5..ab4f8cd 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,7 @@ This is an NGINX module to check for a valid JWT and proxy to an upstream server
 
 ## Building and testing
 To build the Docker image, start NGINX, and run our Bash test against it, run
+
 ```bash
 make
 ```

From 223a4e298c1e423efb98712ba6e887278880466a Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Fri, 28 Oct 2022 14:28:50 -0400
Subject: [PATCH 068/130] fix tests

---
 docker-compose-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker-compose-test.yml b/docker-compose-test.yml
index 8d406f2..021d191 100644
--- a/docker-compose-test.yml
+++ b/docker-compose-test.yml
@@ -17,4 +17,4 @@ services:
       BASE_IMAGE: ${IMAGE_NAME:-teslagov/jwt-nginx}:${IMAGE_VERSION:-latest}
     
     depends_on:
-      - nginx-test
\ No newline at end of file
+      - nginx
\ No newline at end of file

From d1507058a3385421ecb31ac379c7b3e8ec07c3d1 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 7 Nov 2022 21:09:30 -0500
Subject: [PATCH 069/130] rename variable for clarity

---
 src/ngx_http_auth_jwt_module.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index f91e608..4209e3c 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -152,7 +152,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 {
 	ngx_str_t useridHeaderName = ngx_string("x-userid");
 	ngx_str_t emailHeaderName = ngx_string("x-email");
-	char* jwtCookieValChrPtr;
+	char* jwtPtr;
 	char* return_url;
 	ngx_http_auth_jwt_loc_conf_t *jwtcf;
 	u_char *keyBinary;
@@ -178,9 +178,9 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		return NGX_DECLINED;
 	}
 	
-	jwtCookieValChrPtr = getJwt(r, jwtcf->auth_jwt_validation_type);
+	jwtPtr = getJwt(r, jwtcf->auth_jwt_validation_type);
 
-	if (jwtCookieValChrPtr == NULL)
+	if (jwtPtr == NULL)
 	{
 		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a jwt");
 		goto redirect;
@@ -223,7 +223,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	}
 	
 	// validate the jwt
-	jwtParseReturnCode = jwt_decode(&jwt, jwtCookieValChrPtr, keyBinary, keylen);
+	jwtParseReturnCode = jwt_decode(&jwt, jwtPtr, keyBinary, keylen);
 
 	if (jwtParseReturnCode != 0)
 	{
@@ -500,7 +500,7 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 {
 	static const ngx_str_t authorizationHeaderName = ngx_string("Authorization");
 	ngx_table_elt_t *authorizationHeader;
-	char* jwtCookieValChrPtr = NULL;
+	char* jwtPtr = NULL;
 	ngx_str_t jwtCookieVal;
 	ngx_int_t n;
 	ngx_int_t bearer_length;
@@ -523,9 +523,9 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 				authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
 				authorizationHeaderStr.len = bearer_length;
 
-				jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
+				jwtPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
 
-				ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtCookieValChrPtr);
+				ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtPtr);
 			}
 		}
 	}
@@ -539,11 +539,11 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 		n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &auth_jwt_validation_type, &jwtCookieVal);
 		if (n != NGX_DECLINED) 
 		{
-			jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, jwtCookieVal);
+			jwtPtr = ngx_str_t_to_char_ptr(r->pool, jwtCookieVal);
 		}
 	}
 
-	return jwtCookieValChrPtr;
+	return jwtPtr;
 }
 
 

From d7c3cb48a3ec7b11f0e5eda9f36a7b11c7bc2c7d Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Wed, 9 Nov 2022 10:25:33 -0500
Subject: [PATCH 070/130] add support for higher-bit HS/RS algorithms (#80)

* add support for higher-bit HS/RS algorithms
fixes #77

* add Git hooks

* use variable for Docker image name

* cleanup
---
 .bin/git/hooks-wrapper                        |  43 ++++++
 .bin/git/hooks/pre-push-build-and-test        |  12 ++
 .bin/git/init-hooks                           |  19 +++
 .bin/init                                     |   3 +
 Dockerfile                                    |  35 ++---
 Dockerfile-test-nginx                         |  10 --
 Makefile                                      |  73 ---------
 README.md                                     | 142 ++++++++++++------
 config                                        |   7 +-
 docker-compose-test.yml                       |  20 ---
 resources/nginx.conf                          |  22 +--
 resources/test-jwt-nginx.conf                 |  63 --------
 scripts.sh                                    |  89 +++++++++++
 src/ngx_http_auth_jwt_module.c                |  20 +--
 test.sh                                       |  55 -------
 test/Dockerfile-test-nginx                    |   5 +
 .../Dockerfile-test-runner                    |   0
 test/docker-compose-test.yml                  |  24 +++
 {resources => test}/rsa_key_2048-pub.pem      |   0
 {resources => test}/rsa_key_2048.pem          |   0
 test/test.conf                                | 134 +++++++++++++++++
 test/test.sh                                  | 139 +++++++++++++++++
 22 files changed, 598 insertions(+), 317 deletions(-)
 create mode 100755 .bin/git/hooks-wrapper
 create mode 100755 .bin/git/hooks/pre-push-build-and-test
 create mode 100755 .bin/git/init-hooks
 create mode 100755 .bin/init
 delete mode 100644 Dockerfile-test-nginx
 delete mode 100644 Makefile
 delete mode 100644 docker-compose-test.yml
 delete mode 100644 resources/test-jwt-nginx.conf
 create mode 100755 scripts.sh
 delete mode 100755 test.sh
 create mode 100644 test/Dockerfile-test-nginx
 rename Dockerfile-test-runner => test/Dockerfile-test-runner (100%)
 create mode 100644 test/docker-compose-test.yml
 rename {resources => test}/rsa_key_2048-pub.pem (100%)
 rename {resources => test}/rsa_key_2048.pem (100%)
 create mode 100644 test/test.conf
 create mode 100755 test/test.sh

diff --git a/.bin/git/hooks-wrapper b/.bin/git/hooks-wrapper
new file mode 100755
index 0000000..33cea38
--- /dev/null
+++ b/.bin/git/hooks-wrapper
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+# Runs all executable pre-commit-* hooks and exits after,
+# if any of them was not successful.
+#
+# Based on
+# https://github.com/ELLIOTTCABLE/Paws.js/blob/Master/Scripts/git-hooks/chain-hooks.sh
+# http://osdir.com/ml/git/2009-01/msg00308.html
+#
+# assumes your scripts are located at <repo-root>/bin/git/hooks
+
+exitcodes=()
+hookname=`basename $0`
+# our special hooks folder
+CUSTOM_HOOKS_DIR=$(git rev-parse --show-toplevel)/bin/git/hooks
+# find gits native hooks folder
+NATIVE_HOOKS_DIR=$(git rev-parse --show-toplevel)/.git/hooks
+
+# Run each hook, passing through STDIN and storing the exit code.
+# We don't want to bail at the first failure, as the user might
+# then bypass the hooks without knowing about additional issues.
+
+for hook in ${CUSTOM_HOOKS_DIR}/$(basename $0)-*; do
+    test -x "$hook" || continue
+
+    echo "Running custom hook '$hookname' ..."
+    out=`$hook "$@"`
+    exitcodes+=($?)
+    echo "$out"
+done
+
+# check if there was a local hook that was moved previously
+if [ -f "${NATIVE_HOOKS_DIR}/$hookname.local" ]; then
+    echo "Running native hook '$hookname' ..."
+    out=`${NATIVE_HOOKS_DIR}/$hookname.local "$@"`
+    exitcodes+=($?)
+    echo "$out"
+fi
+
+# If any exit code isn't 0, bail.
+for i in "${exitcodes[@]}"; do
+    [ "$i" == 0 ] || exit $i
+done
\ No newline at end of file
diff --git a/.bin/git/hooks/pre-push-build-and-test b/.bin/git/hooks/pre-push-build-and-test
new file mode 100755
index 0000000..9cf4682
--- /dev/null
+++ b/.bin/git/hooks/pre-push-build-and-test
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+REPO_ROOT_DIR=$(git rev-parse --show-toplevel)
+CHANGE_COUNT=$(cd ${REPO_ROOT_DIR}; git diff --name-only origin/HEAD..HEAD -- resources/ src/ test/ Dockerfile scripts.sh |wc -l)
+
+if [[ "0" -ne "${CHANGE_COUNT}" ]]; then
+	(cd ${REPO_ROOT_DIR}; ./scripts.sh rebuild_nginx rebuild_test_runner test)
+else
+  HOOK_NAME=$(basename $0)
+
+	echo "Skipping hook '${HOOK_NAME}' -- no changes detected which would require tests to be run."
+fi
diff --git a/.bin/git/init-hooks b/.bin/git/init-hooks
new file mode 100755
index 0000000..1513105
--- /dev/null
+++ b/.bin/git/init-hooks
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# based on http://stackoverflow.com/a/3464399/1383268
+# assumes that the hooks-wrapper script is located at <repo-root>/bin/git/hooks-wrapper
+
+HOOK_NAMES="applypatch-msg pre-applypatch post-applypatch pre-commit prepare-commit-msg commit-msg post-commit pre-rebase post-checkout post-merge pre-receive update post-receive post-update pre-auto-gc pre-push"
+# find git's native hooks folder
+REPO_ROOT_DIR=$(git rev-parse --show-toplevel)
+HOOKS_DIR=$(git rev-parse --show-toplevel)/.git/hooks
+
+for hook in ${HOOK_NAMES}; do
+    # If the hook already exists, is a file, and is not a symlink
+    if [ ! -h ${HOOKS_DIR}/${hook} ] && [ -f ${HOOKS_DIR}/${hook} ]; then
+        mv ${HOOKS_DIR}/${hook} ${HOOKS_DIR}/${hook}.local
+    fi
+    # create the symlink, overwriting the file if it exists
+    # probably the only way this would happen is if you're using an old version of git
+    # -- back when the sample hooks were not executable, instead of being named ____.sample
+    ln -s -f ${REPO_ROOT_DIR}/bin/git/hooks-wrapper ${HOOKS_DIR}/${hook}
+done
\ No newline at end of file
diff --git a/.bin/init b/.bin/init
new file mode 100755
index 0000000..9c59222
--- /dev/null
+++ b/.bin/init
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+source $(dirname $0)/git/init-hooks
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index ad36f02..b0712ea 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,9 @@
-ARG NGINX_VERSION=1.22.0
+ARG NGINX_VERSION
 
 
 FROM debian:bullseye-slim as BASE_IMAGE
 LABEL stage=builder
-RUN apt-get update \
+RUN  apt-get update \
 	&& apt-get install -y curl build-essential
 
 
@@ -11,30 +11,31 @@ FROM BASE_IMAGE as BUILD_IMAGE
 LABEL stage=builder
 ENV LD_LIBRARY_PATH=/usr/local/lib
 ARG NGINX_VERSION
-ADD . /root/dl/ngx-http-auth-jwt-module
-RUN set -x \
+RUN  set -x \
 	&& apt-get install -y libjwt-dev libjwt0 libjansson-dev libjansson4 libpcre2-dev zlib1g-dev libpcre3-dev \
-	&& mkdir -p /root/dl
-WORKDIR /root/dl
-RUN set -x \
-	&& curl -O http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz \
-	&& tar -xzf nginx-$NGINX_VERSION.tar.gz \
-	&& rm nginx-$NGINX_VERSION.tar.gz \
-	&& ln -sf nginx-$NGINX_VERSION nginx \
-	&& cd /root/dl/nginx \
-	&& ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module \
+	&& mkdir -p /root/build/ngx-http-auth-jwt-module
+WORKDIR /root/build/ngx-http-auth-jwt-module
+ADD config ./
+ADD src/*.h src/*.c ./src/
+WORKDIR /root/build
+RUN  set -x \
+  && mkdir nginx \
+	&& curl -O http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz \
+	&& tar -xzf nginx-${NGINX_VERSION}.tar.gz --strip-components 1 -C nginx \
+	&& rm nginx-${NGINX_VERSION}.tar.gz
+WORKDIR /root/build/nginx
+RUN  ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module \
 	&& make modules
 
 
 FROM nginx:${NGINX_VERSION}
 LABEL stage=builder
-RUN apt-get update \
-    && apt-get -y install libjansson4 libjwt0 \
+RUN  apt-get update \
+	&& apt-get -y install libjansson4 libjwt0 \
 	&& cd /etc/nginx \
-	&& cp nginx.conf nginx.conf.orig \
 	&& sed -ri '/pid\s+\/var\/run\/nginx\.pid;$/a load_module \/usr\/lib64\/nginx\/modules\/ngx_http_auth_jwt_module\.so;' nginx.conf
 
 
 LABEL stage=
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
-COPY --from=BUILD_IMAGE /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/
+COPY --from=BUILD_IMAGE /root/build/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/
diff --git a/Dockerfile-test-nginx b/Dockerfile-test-nginx
deleted file mode 100644
index 10a1eae..0000000
--- a/Dockerfile-test-nginx
+++ /dev/null
@@ -1,10 +0,0 @@
-ARG BASE_IMAGE=teslagov/jwt-nginx:latest
-
-FROM ${BASE_IMAGE} as NGINX
-COPY resources/test-jwt-nginx.conf /etc/nginx/conf.d/test-jwt-nginx.conf
-COPY resources/rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
-RUN cp -r /usr/share/nginx/html /usr/share/nginx/secure \
-  && cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256 \
-  && cp -r /usr/share/nginx/html /usr/share/nginx/secure-rs256-file \
-  && cp -r /usr/share/nginx/html /usr/share/nginx/secure-auth-header \
-  && cp -r /usr/share/nginx/html /usr/share/nginx/secure-no-redirect
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 17c7aa2..0000000
--- a/Makefile
+++ /dev/null
@@ -1,73 +0,0 @@
-SHELL += -eu
-
-BLUE  := \033[0;34m
-GREEN := \033[0;32m
-RED   := \033[0;31m
-NC    := \033[0m
-
-DOCKER_ORG_NAME ?= teslagov
-DOCKER_IMAGE_NAME ?= jwt-nginx
-COMPOSE_PROJECT_NAME ?= jwt-nginx-test
-NGINX_VERSION ?= 1.22.0
-
-.PHONY: all
-all:
-	@$(MAKE) build-nginx
-	@$(MAKE) start-nginx
-	@$(MAKE) test
-
-.PHONY: build-nginx
-build-nginx:
-	@echo "${BLUE}  Building...${NC}"
-	@docker image pull debian:bullseye-slim
-	@docker image pull nginx:${NGINX_VERSION}
-	@docker image build -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:latest -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:${NGINX_VERSION} --build-arg NGINX_VERSION=${NGINX_VERSION} . ; \
-	SUCCESS=$$? ; \
-	docker rmi $$(docker images --filter=label=stage=builder --quiet); \
-	if [ "$$SUCCESS" -ne 0 ] ; \
-	then echo "${RED}  Build failed ${NC}"; \
-	else echo "${GREEN}✓ Successfully built NGINX module ${NC}"; fi
-
-.PHONY: rebuild-nginx
-rebuild-nginx:
-	@echo "${BLUE}  Rebuilding...${NC}"
-	@docker image pull debian:bullseye-slim
-	@docker image pull nginx:${NGINX_VERSION}
-	@docker image build -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:latest -t ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}:${NGINX_VERSION} --build-arg NGINX_VERSION=${NGINX_VERSION} --no-cache .; \
-	SUCCESS=$$? ; \
-	docker rmi $$(docker images --filter=label=stage=builder --quiet); \
-	if [ "$$SUCCESS" -ne 0 ] ; \
-	then echo "${RED}  Build failed ${NC}"; \
-	else echo "${GREEN}✓ Successfully rebuilt NGINX module ${NC}"; fi
-
-.PHONY: stop-nginx
-stop-nginx:
-	docker stop "${DOCKER_IMAGE_NAME}"
-
-.PHONY: start-nginx
-start-nginx:
-	docker run --rm --name "${DOCKER_IMAGE_NAME}" -d -p 8000:80 ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}
-
-.PHONY: cp-bin
-cp-bin: start-nginx
-	rm -rf bin
-	mkdir -p bin
-	docker exec jwt-nginx sh -c "tar -chf - \
-		/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so \
-		/usr/lib/x86_64-linux-gnu/libjansson.so.* \
-		/usr/lib/x86_64-linux-gnu/libjwt.*" 2>/dev/null | tar -xf - -C bin &>/dev/null
-
-.PHONY: build-test-runner
-build-test-runner:
-	IMAGE_VERSION=${NGINX_VERSION} docker compose -f ./docker-compose-test.yml build
-
-.PHONY: rebuild-test-runner
-rebuild-test-runner:
-	IMAGE_VERSION=${NGINX_VERSION} docker compose -f ./docker-compose-test.yml build --no-cache
-
-.PHONY: test
-test:
-	IMAGE_VERSION=${NGINX_VERSION} docker compose -f ./docker-compose-test.yml up --no-start
-	docker start ${COMPOSE_PROJECT_NAME}-nginx-1
-	docker start -a ${COMPOSE_PROJECT_NAME}-runner-1
-	docker compose -f ./docker-compose-test.yml down
diff --git a/README.md b/README.md
index ab4f8cd..84913ee 100644
--- a/README.md
+++ b/README.md
@@ -1,58 +1,96 @@
 # Intro
+
 This is an NGINX module to check for a valid JWT and proxy to an upstream server or redirect to a login page.
 
 ## Building and testing
+
 To build the Docker image, start NGINX, and run our Bash test against it, run
 
 ```bash
-make
+./scripts.sh all
 ```
 
-When you make a change to the module, run `make rebuild-nginx`.
+When you make a change to the module or the NGINX test config, run `./scripts.sh rebuild_nginx` to rebuild the NGINX Docker image.
 
-When you make a change to `test.sh`, run `make rebuild-test-runner`.
+When you make a change to `test.sh`, run `./scripts.sh rebuild_test_runner test` to rebuild the test runner image and run the tests.
 
-| Command                    | Description                                                       |
-| -------------------------- |:-----------------------------------------------------------------:|
-| `make build-nginx`         | Builds the NGINX image                                            |
-| `make rebuild-nginx`       | Re-builds the NGINX image                                         |
-| `make build-test-runner`   | Builds the images used by the test stack (uses Docker compose)    |
-| `make rebuild-test-runner` | Re-builds the images used by the test stack                       |
-| `make start-nginx`         | Starts the NGINX container                                        |
-| `make stop-nginx`          | Stops the NGINX container                                         |
-| `make test`                | Runs `test.sh` against the NGINX container (uses Docker compose)  |
+The `./scripts.sh` file contains multiple commands to make things easy:
 
-The image produced with `make build-nginx` only differs from the official Nginx image in two ways: the module itself and the nginx.conf configuration entry that loads it.
+| Command               | Description                                                       |
+| --------------------- | ----------------------------------------------------------------- |
+| `build_nginx`         | Builds the NGINX image.                                           |
+| `rebuild_nginx`       | Re-builds the NGINX image.                                        |
+| `start_nginx`         | Starts the NGINX container.                                       |
+| `stop_nginx`          | Stops the NGINX container.                                        |
+| `cp_bin`              | Copies the compiled binaries out of the NGINX container.          |
+| `build_test_runner`   | Builds the images used by the test stack (uses Docker compose).   |
+| `rebuild_test_runner` | Re-builds the images used by the test stack.                      |
+| `test`                | Runs `test.sh` against the NGINX container (uses Docker compose). |
 
-The tests use a customized Nginx image, distinct from the main image, as well as a test runner image.  By running `make test`, the two test containers will be created up with Docker compose, started, and the tests run.  At the end, both containers will be automatically stopped and destroyed.
+You can run multiple commands in sequence by separating them with a space, e.g.:
 
-This project is 100% Docker-ized.
+```shell
+./scripts.sh rebuild_nginx rebuild_test_runner test
+```
 
-## Dependencies
-This module depends on the [JWT C Library](https://github.com/benmcollins/libjwt)
+The image produced with `./scripts.sh build_nginx` only differs from the official NGINX image in two ways:
+ - the JWT module itself, and
+ - the `nginx.conf` file is overwritten with our own.
 
-Transitively, that library depends on a JSON Parser called
-[Jansson](https://github.com/akheron/jansson) as well as the OpenSSL library.
+The tests use a customized NGINX image, distinct from the main image, as well as a test runner image. By running `./scripts.sh test`, the two test containers will be stood up via Docker compose, then they'll be started, and the tests will run. At the end of the test run, both containers will be automatically stopped and destroyed. See below to learn how to trace test failures across runs.
 
-## NGINX Directives
-This module requires several new `nginx.conf` directives,
-which can be specified in on the `main` `server` or `location` level.
+### Tracing test failures
+
+After making changes and finding that some tests fail, it can be difficult to understand why. By default, logs are written to Docker's internal log mechanism, but they won't be persisted after the test run completes and the containers are removed.
+
+In order to persist logs, you can configure the log driver to use. You can do this by setting the environment variable `LOG_DRIVER` before running the tests. On Linux/Unix systems, you can use the driver `journald`, as follows:
+
+```shell
+# need to rebuild the test runner with the proper log driver
+LOG_DRIVER=journald ./scripts.sh rebuild_test_runner
 
+# run the tests
+./scripts.sh test
+
+# check the logs
+journalctl -eu docker CONTAINER_NAME=jwt-nginx-test
 ```
-auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF"; # see docs for format based on algorithm
-auth_jwt_loginurl "https://yourdomain.com/loginpage";
-auth_jwt_enabled on;
-auth_jwt_algorithm HS256;    # or RS256
-auth_jwt_extract_sub on;     # or off
-auth_jwt_validate_email on;  # or off
-auth_jwt_use_keyfile off;    # or on
-auth_jwt_keyfile_path "/app/pub_key";
+
+Now you'll be able to see logs from previous test runs. The best way to make use of this  is to open two terminals, one where you run the tests, and one where you follow the logs:
+
+```shell
+# terminal 1
+./scripts.sh test
+
+# terminal 2
+journalctl -fu docker CONTAINER_NAME=jwt-nginx-test
 ```
 
-The default algorithm is 'HS256', for symmetric key validation.  When using HS256, the value for `auth_jwt_key` should be specified in binhex format.  It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total) as in the example above.  Note that using more than 512 bits will not increase the security.  For key guidelines please see NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms, Section 5.3.2 The HMAC Key.
+## Dependencies
+
+This module depends on the [JWT C Library](https://github.com/benmcollins/libjwt). Transitively, that library depends on a JSON Parser called [Jansson](https://github.com/akheron/jansson) as well as the OpenSSL library.
+
+## NGINX Directives
+This module requires several new `nginx.conf` directives, which can be specified at the `http`, `server`, or `location` levels.
+
+| Directive                  | Description                                                                                                        |
+| -------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| `auth_jwt_key`             | The key to use to decode/verify the JWT -- see below.                                                              |
+| `auth_jwt_redirect`        | Set to "on" to redirect to `auth_jwt_loginurl` if authentication fails.                                            |
+| `auth_jwt_loginurl`        | The URL to redirect to if `auth_jwt_redirect` is enabled and authentication fails.                                 |
+| `auth_jwt_enabled`         | Set to "on" to enable JWT checking.                                                                                |
+| `auth_jwt_algorithm`       | The algorithm to use. One of: HS256, HS384, HS512, RS256, RS384, RS512                                             |
+| `auth_jwt_extract_sub`     | Set to "on" to extract the `sub` claim (e.g. user id) from the JWT and into the `x-userid` header on the response. |
+| `auth_jwt_validate_email`  | Set to "on" to extract the `emailAddress` claim from the JWT and into the `x-email` header on the response.        |
+| `auth_jwt_use_keyfile`     | Set to "on" to read the key from a file rather than from the `auth_jwt_key` directive.                             |
+| `auth_jwt_keyfile_path`    | Set to the path from which the key should be read when `auth_jwt_use_keyfile` is enabled.                          |
+
+
+The default algorithm is `HS256`, for symmetric key validation. When using one of the `HS*` algorithms, the value for `auth_jwt_key` should be specified in binhex format. It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total) as in the example above. Note that using more than 512 bits will not increase the security. For key guidelines please see [NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms](https://csrc.nist.gov/publications/detail/sp/800-107/rev-1/final), Section 5.3.2 The HMAC Key.
+
+The configuration also supports RSA public key validation via (e.g.) `auth_jwt_algorithm RS256`. When using the `RS*` alhorithms, the `auth_jwt_key` field must be set to your public key **OR** `auth_jwt_use_keyfile` should be set to `on` and `auth_jwt_keyfile_path` should point to the public key on disk. NGINX won't start if `auth_jwt_use_keyfile` is set to `on` and a key file is not provided.
 
-The configuration also supports the `auth_jwt_algorithm` 'RS256', for RSA 256-bit public key validation. If using "auth_jwt_algorithm RS256;", then the `auth_jwt_key` field must be set to your public key **OR** `auth_jwt_use_keyfile` should be set to `on` with the `auth_jwt_keyfile_path` set to the public key path (nginx won't start if the `auth_jwt_use_keyfile` is set to `on` without a keyfile).
-That is the public key, rather than a PEM certificate.  I.e.:
+When using an `RS*` algorithm with an inline key, be sure to set `auth_jwt_key` to the _public key_, rather than a PEM certificate. E.g.:
 
 ```
 auth_jwt_key "-----BEGIN PUBLIC KEY-----
@@ -66,40 +104,44 @@ oQIDAQAB
 -----END PUBLIC KEY-----";
 ```
 
-**OR**
+When using an `RS*` algorithm with a public key file, do as follows:
 
 ```
 auth_jwt_use_keyfile on;
-auth_jwt_keyfile_path "/etc/nginx/pub_key.pem";
+auth_jwt_keyfile_path "/path/to/pub_key.pem";
 ```
 
-A typical use would be to specify the key and loginurl on the main level
-and then only turn on the locations that you want to secure (not the login page).
-Unauthorized requests are given 302 "Moved Temporarily" responses with a location of the specified loginurl.
+A typical use would be to specify the key and login URL at the `http` level, and then only turn JWT authentication on for the locations which you want to secure. Unauthorized requests result in a 302 "Moved Temporarily" response with the `Location` header set to the URL specified in the `auth_jwt_loginurl` directive, and a querystring parameter `return_url` whose value is the current / attempted URL.
+
+If you prefer to return `401 Unauthorized` rather than redirect, you may turn `auth_jwt_redirect` off:
 
 ```
-auth_jwt_redirect            off;
+auth_jwt_redirect off;
 ```
-If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
+
+By default the authorization header is used to provide a JWT for validation. However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT:
 
 ```
-auth_jwt_validation_type AUTHORIZATION;
 auth_jwt_validation_type COOKIE=jwt;
 ```
-By default the authorization header is used to provide a JWT for validation.
-However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
 
-```
-auth_jwt_extract_sub
-```
 By default, the module will attempt to extract the `sub` claim (e.g. the user's id) from the JWT. If successful, the 
 value will be set in the `x-userid` HTTP header. An error will be logged if this option is enabled and the JWT does not 
-contain the `sub` claim.
+contain the `sub` claim. You may disable this option as follows:
 
 ```
-auth_jwt_validate_email off;
+auth_jwt_extract_sub off
 ```
+
 By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the
-session, and will log an error if it isn't found.  To disable this behavior, for instance if you are using a different
+session, and will log an error if it isn't found. To disable this behavior, for instance if you are using a different
 user identifier property such as `sub`, set `auth_jwt_validate_email` to the value `off`. _Note that this flag may be 
-renamed to `auth_jwt_extract_email` in a future release._
+renamed to `auth_jwt_extract_email` in a future release._ You may disable this option as follows:
+
+```
+auth_jwt_validate_email off;
+```
+
+## Contributing
+
+If you'd like to contribute to this repository, please first initiate the Git hooks by running `./.bin/init` (note the `.` before `bin`) -- this will ensure that tests are run before you push your changes.
diff --git a/config b/config
index 317aeea..34154fb 100644
--- a/config
+++ b/config
@@ -1,8 +1,7 @@
-ngx_addon_name=ngx_http_auth_jwt_module
-
 ngx_module_type=HTTP
-ngx_module_name=ngx_http_auth_jwt_module
-ngx_module_srcs="$ngx_addon_dir/src/ngx_http_auth_jwt_binary_converters.c $ngx_addon_dir/src/ngx_http_auth_jwt_header_processing.c $ngx_addon_dir/src/ngx_http_auth_jwt_string.c $ngx_addon_dir/src/ngx_http_auth_jwt_module.c"
+ngx_addon_name=ngx_http_auth_jwt_module
+ngx_module_name=$ngx_addon_name
+ngx_module_srcs="${ngx_addon_dir}/src/ngx_http_auth_jwt_binary_converters.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_header_processing.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_string.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_module.c"
 ngx_module_libs="-ljansson -ljwt"
 
 . auto/module
diff --git a/docker-compose-test.yml b/docker-compose-test.yml
deleted file mode 100644
index 021d191..0000000
--- a/docker-compose-test.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-version: '3.3'
-
-services:
-
-  nginx:
-    build:
-      context: .
-      dockerfile: Dockerfile-test-nginx
-      args:
-        BASE_IMAGE: ${IMAGE_NAME:-teslagov/jwt-nginx}:${IMAGE_VERSION:-latest}
-
-  runner:
-    build:
-      context: .
-      dockerfile: Dockerfile-test-runner
-    environment:
-      BASE_IMAGE: ${IMAGE_NAME:-teslagov/jwt-nginx}:${IMAGE_VERSION:-latest}
-    
-    depends_on:
-      - nginx
\ No newline at end of file
diff --git a/resources/nginx.conf b/resources/nginx.conf
index 3981730..9b8feab 100644
--- a/resources/nginx.conf
+++ b/resources/nginx.conf
@@ -1,4 +1,3 @@
-
 user  nginx;
 worker_processes  auto;
 
@@ -6,28 +5,21 @@ error_log  /var/log/nginx/error.log notice;
 pid        /var/run/nginx.pid;
 load_module /usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so;
 
-
 events {
     worker_connections  1024;
 }
 
-
 http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
+    include  /etc/nginx/mime.types;
+    default_type application/octet-stream;
 
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+    log_format main  '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';
+    access_log /var/log/nginx/access.log  main;
 
-    access_log  /var/log/nginx/access.log  main;
-
-    sendfile        on;
-    #tcp_nopush     on;
-
-    keepalive_timeout  65;
-
-    #gzip  on;
+    sendfile on;
+    keepalive_timeout 65;
 
     include /etc/nginx/conf.d/*.conf;
-}
\ No newline at end of file
+}
diff --git a/resources/test-jwt-nginx.conf b/resources/test-jwt-nginx.conf
deleted file mode 100644
index 53f512b..0000000
--- a/resources/test-jwt-nginx.conf
+++ /dev/null
@@ -1,63 +0,0 @@
-server {
-    auth_jwt_key                 "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
-    auth_jwt_loginurl            "https://teslagov.com";
-    auth_jwt_enabled             off;
-    auth_jwt_redirect            on;
-
-    listen       8000;
-    server_name  localhost;
-
-    location ~ ^/secure-no-redirect/ {
-        auth_jwt_enabled   on;
-        auth_jwt_redirect  off;
-        root  /usr/share/nginx;
-        index  index.html index.htm;
-    }
-
-    location ~ ^/secure/ {
-        auth_jwt_enabled   on;
-        auth_jwt_validation_type COOKIE=jwt;
-        root  /usr/share/nginx;
-        index  index.html index.htm;
-    }
-
-    location ~ ^/secure-auth-header/ {
-        auth_jwt_enabled on;
-        root  /usr/share/nginx;
-        index  index.html index.htm;
-    }
-
-    location ~ ^/secure-rs256/ {
-        auth_jwt_enabled on;
-        auth_jwt_validation_type COOKIE=jwt;
-        auth_jwt_algorithm RS256;
-        auth_jwt_key "-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
-uqNuffp4+4aUCwuFE9B5s9MJr63gyf8jW0oDr7Mb1Xb8y9iGkWfhouZqNJbMFry+
-iBs+z2TtJF06vbHQZzajDsdux3XVfXv9v6dDIImyU24MsGNkpNt0GISaaiqv51NM
-ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
-6swiIasEU3qNLKaJAZEzfywroVYr3BwM1IiVbQeKgIkyPS/85M4Y6Ss/T+OWi1Oe
-K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
-BwIDAQAB
------END PUBLIC KEY-----";
-        root  /usr/share/nginx;
-        index  index.html index.htm;
-    }
-
-    location ~ ^/secure-rs256-file/ {
-        auth_jwt_enabled on;
-        auth_jwt_validation_type AUTHORIZATION;
-        auth_jwt_algorithm RS256;
-        auth_jwt_redirect  off;
-        auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
-        root  /usr/share/nginx;
-        index  index.html index.htm;
-    }
-
-    location / {
-        root   /usr/share/nginx/html;
-        index  index.html index.htm;
-    }
-}
-
diff --git a/scripts.sh b/scripts.sh
new file mode 100755
index 0000000..e41620d
--- /dev/null
+++ b/scripts.sh
@@ -0,0 +1,89 @@
+#!/bin/bash -eu
+
+BLUE='\033[0;34m'
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+NC='\033[0m'
+
+export ORG_NAME=${ORG_NAME:-teslagov}
+export IMAGE_NAME=${IMAGE_NAME:-jwt-nginx}
+export FULL_IMAGE_NAME=${ORG_NAME}/${IMAGE_NAME}
+export CONTAINER_NAME_PREFIX=${CONTAINER_NAME_PREFIX:-jwt-nginx-test}
+export NGINX_VERSION=${NGINX_VERSION:-1.22.0}
+
+all() {
+	build_nginx
+	start_nginx
+	test
+}
+
+fetch_headers() {
+	printf "${BLUE} Fetching NGINX headers...${NC}"
+	local files='src/core/ngx_core.h src/http/ngx_http.h'
+
+	for f in ${files}; do
+		curl "https://raw.githubusercontent.com/nginx/nginx/release-${NGINX_VERSION}/${f}" -o src/lib/$(basename ${f})
+	done
+}
+
+build_nginx() {
+	local dockerArgs=${1:-}
+
+	printf "${BLUE}  Building...${NC}"
+	docker image pull debian:bullseye-slim
+	docker image pull nginx:${NGINX_VERSION}
+	docker image build -t ${FULL_IMAGE_NAME}:latest -t ${FULL_IMAGE_NAME}:${NGINX_VERSION} --build-arg NGINX_VERSION=${NGINX_VERSION} ${dockerArgs} .
+	
+	if [ "$?" -ne 0 ]; then
+		printf "${RED}  Build failed ${NC}"
+	else
+		printf "${GREEN}✓ Successfully built NGINX module ${NC}"
+	fi
+
+	docker rmi -f $(docker images --filter=label=stage=builder --quiet)
+}
+
+rebuild_nginx() {
+	build_nginx --no-cache
+}
+
+start_nginx() {
+	docker run --rm --name "${IMAGE_NAME}" -d -p 8000:80 ${FULL_IMAGE_NAME}
+}
+
+stop_nginx() {
+	docker stop "${IMAGE_NAME}"
+}
+
+cp_bin() {
+	printf "${BLUE}  Copying binaries...${NC}"
+	rm -rf bin
+	mkdir bin
+	docker exec "${IMAGE_NAME}" sh -c "tar -chf - \
+		/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so \
+		/usr/lib/x86_64-linux-gnu/libjansson.so.* \
+		/usr/lib/x86_64-linux-gnu/libjwt.*" 2>/dev/null | tar -xf - -C bin &>/dev/null
+}
+
+build_test_runner() {
+	local dockerArgs=${1:-}
+
+	printf "${BLUE}  Building test runner...${NC}"
+	docker compose -f ./test/docker-compose-test.yml build ${dockerArgs}
+}
+
+rebuild_test_runner() {
+	build_test_runner --no-cache
+}
+
+test() {
+	printf "${BLUE}  Running tests...${NC}"
+	docker compose -f ./test/docker-compose-test.yml up --no-start
+	docker start ${CONTAINER_NAME_PREFIX}
+	docker start -a ${CONTAINER_NAME_PREFIX}-runner
+	docker compose -f ./test/docker-compose-test.yml down
+}
+
+for fn in $@; do
+	"$fn"
+done
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 4209e3c..cb3c055 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -182,7 +182,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 
 	if (jwtPtr == NULL)
 	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a jwt");
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a JWT");
 		goto redirect;
 	}
 	
@@ -190,7 +190,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 
 	auth_jwt_algorithm = jwtcf->auth_jwt_algorithm;
 
-	if (auth_jwt_algorithm.len == 0 || (auth_jwt_algorithm.len == sizeof("HS256") - 1 && ngx_strncmp(auth_jwt_algorithm.data, "HS256", sizeof("HS256") - 1)==0))
+	if (auth_jwt_algorithm.len == 0 || (auth_jwt_algorithm.len == 5 && ngx_strncmp(auth_jwt_algorithm.data, "HS", 2) == 0))
 	{
 		keylen = jwtcf->auth_jwt_key.len / 2;
 		keyBinary = ngx_palloc(r->pool, keylen);
@@ -200,7 +200,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 			goto redirect;
 		}
 	}
-	else if ( auth_jwt_algorithm.len == sizeof("RS256") - 1 && ngx_strncmp(auth_jwt_algorithm.data, "RS256", sizeof("RS256") - 1) == 0 )
+	else if ( auth_jwt_algorithm.len == 5 && ngx_strncmp(auth_jwt_algorithm.data, "RS", 2) == 0 )
 	{
 		// in this case, 'Binary' is a misnomer, as it is the public key string itself
 		if (jwtcf->auth_jwt_use_keyfile == 1)
@@ -218,7 +218,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 	}
 	else
 	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "unsupported algorithm");
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "unsupported algorithm %s", auth_jwt_algorithm);
 		goto redirect;
 	}
 	
@@ -227,16 +227,16 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 
 	if (jwtParseReturnCode != 0)
 	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse jwt, error code %d", jwtParseReturnCode);
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse JWT, error code %d", jwtParseReturnCode);
 		goto redirect;
 	}
 	
 	// validate the algorithm
 	alg = jwt_get_alg(jwt);
 
-	if (alg != JWT_ALG_HS256 && alg != JWT_ALG_RS256)
+	if (alg != JWT_ALG_HS256 && alg != JWT_ALG_HS384 && alg != JWT_ALG_HS512 && alg != JWT_ALG_RS256 && alg != JWT_ALG_RS384 && alg != JWT_ALG_RS512)
 	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm in jwt %d", alg);
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm in JWT (%d)", alg);
 		goto redirect;
 	}
 	
@@ -246,7 +246,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 
 	if (exp < now)
 	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt has expired");
+		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT has expired");
 		goto redirect;
 	}
 
@@ -257,7 +257,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 
 		if (sub == NULL)
 		{
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain a subject");
+			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT does not contain a subject");
 		}
 		else
 		{
@@ -273,7 +273,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
 		
 		if (email == NULL)
 		{
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the jwt does not contain an email address");
+			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT does not contain an email address");
 		}
 		else
 		{
diff --git a/test.sh b/test.sh
deleted file mode 100755
index 45d21ee..0000000
--- a/test.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-
-RED='\033[01;31m'
-GREEN='\033[01;32m'
-NONE='\033[00m'
-
-test_jwt () {
-  local name=$1
-  local path=$2
-  local expect=$3
-  local extra=$4
-
-  cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://nginx:8000$path -H 'cache-control: no-cache' $extra"
-  test=$( eval ${cmd} )
-
-  if [ "$test" -eq "$expect" ]; then
-    echo -e "${GREEN}${name}: passed (${test})${NONE}";
-  else
-    echo -e "${RED}${name}: failed (${test})${NONE}";
-  fi
-}
-
-main() {
-  local VALIDJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.TvDD63ZOqFKgE-uxPDdP5aGIsbl5xPKz4fMul3Zlti4
-  local MISSING_SUB_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
-  local MISSING_EMAIL_JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
-  local VALID_RS256_JWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
-  local INVALID_RSA256_JWT=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
-
-  test_jwt "Insecure test" "/" "200"
-
-  test_jwt "Secure test without jwt cookie" "/secure/" "302"
-
-  test_jwt "Secure test with jwt cookie" "/secure/" "200" "--cookie \"jwt=${VALIDJWT}\""
-
-  test_jwt "Secure test with jwt auth header" "/secure-auth-header/" "200" "--header \"Authorization: Bearer ${VALIDJWT}\""
-
-  test_jwt "Secure test without jwt auth header" "/secure-auth-header/" "302"
-
-  test_jwt "Secure test with jwt auth header missing Bearer" "/secure-no-redirect/" "401" "--header \"Authorization: X\""
-
-  test_jwt "Secure test without jwt auth header" "/secure-no-redirect/" "401"
-
-  test_jwt "Secure test with jwt cookie - with no sub" "/secure/" "200" " --cookie \"jwt=${MISSING_SUB_JWT}\""
-
-  test_jwt "Secure test with jwt cookie - with no email" "/secure/" "200" " --cookie \"jwt=${MISSING_EMAIL_JWT}\""
-
-  test_jwt "Secure test with rs256 jwt cookie" "/secure-rs256/" "200" " --cookie \"jwt=${VALID_RS256_JWT}\""
-
-  test_jwt "Secure test rsa256 from file with valid jwt" "/secure-rs256-file/" "200" "--header \"Authorization: Bearer ${VALID_RS256_JWT}\""
-
-  test_jwt "Secure test rsa256 from file with invalid jwt" "/secure-rs256-file/" "401" "--header \"Authorization: Bearer ${INVALID_RSA256_JWT}\""
-}
-
-main "$@"
diff --git a/test/Dockerfile-test-nginx b/test/Dockerfile-test-nginx
new file mode 100644
index 0000000..c1e4550
--- /dev/null
+++ b/test/Dockerfile-test-nginx
@@ -0,0 +1,5 @@
+ARG BASE_IMAGE
+
+FROM ${BASE_IMAGE} as NGINX
+COPY test.conf /etc/nginx/conf.d/test.conf
+COPY rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
\ No newline at end of file
diff --git a/Dockerfile-test-runner b/test/Dockerfile-test-runner
similarity index 100%
rename from Dockerfile-test-runner
rename to test/Dockerfile-test-runner
diff --git a/test/docker-compose-test.yml b/test/docker-compose-test.yml
new file mode 100644
index 0000000..2607e42
--- /dev/null
+++ b/test/docker-compose-test.yml
@@ -0,0 +1,24 @@
+version: '3.3'
+
+services:
+
+  nginx:
+    container_name: ${CONTAINER_NAME_PREFIX}
+    build:
+      context: .
+      dockerfile: Dockerfile-test-nginx
+      args:
+        BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION:-latest}
+    logging:
+      driver: ${LOG_DRIVER:-journald}
+
+  runner:
+    container_name: ${CONTAINER_NAME_PREFIX}-runner
+    build:
+      context: .
+      dockerfile: Dockerfile-test-runner
+    environment:
+      BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION:-latest}
+    
+    depends_on:
+      - nginx
\ No newline at end of file
diff --git a/resources/rsa_key_2048-pub.pem b/test/rsa_key_2048-pub.pem
similarity index 100%
rename from resources/rsa_key_2048-pub.pem
rename to test/rsa_key_2048-pub.pem
diff --git a/resources/rsa_key_2048.pem b/test/rsa_key_2048.pem
similarity index 100%
rename from resources/rsa_key_2048.pem
rename to test/rsa_key_2048.pem
diff --git a/test/test.conf b/test/test.conf
new file mode 100644
index 0000000..52c2829
--- /dev/null
+++ b/test/test.conf
@@ -0,0 +1,134 @@
+server {
+    listen 8000;
+    server_name localhost;
+    
+    auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
+    auth_jwt_loginurl "https://example.com/login";
+    auth_jwt_enabled off;
+
+    location / {
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/default {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validation_type COOKIE=jwt;
+        
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+        
+    location /secure/cookie/default/no-redirect {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_validation_type COOKIE=jwt;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/hs256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validation_type COOKIE=jwt;
+        auth_jwt_algorithm HS256;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/hs384 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validation_type COOKIE=jwt;
+        auth_jwt_algorithm HS384;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/hs512 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validation_type COOKIE=jwt;
+        auth_jwt_algorithm HS512;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/default {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validation_type AUTHORIZATION;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/default/no-redirect {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_validation_type AUTHORIZATION;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/rs256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
+uqNuffp4+4aUCwuFE9B5s9MJr63gyf8jW0oDr7Mb1Xb8y9iGkWfhouZqNJbMFry+
+iBs+z2TtJF06vbHQZzajDsdux3XVfXv9v6dDIImyU24MsGNkpNt0GISaaiqv51NM
+ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
+6swiIasEU3qNLKaJAZEzfywroVYr3BwM1IiVbQeKgIkyPS/85M4Y6Ss/T+OWi1Oe
+K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
+BwIDAQAB
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/rs256/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_algorithm RS256;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/rs384/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_algorithm RS384;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/rs512/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_algorithm RS512;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+}
+
diff --git a/test/test.sh b/test/test.sh
new file mode 100755
index 0000000..b6ec12c
--- /dev/null
+++ b/test/test.sh
@@ -0,0 +1,139 @@
+#!/bin/bash
+
+RED='\033[01;31m'
+GREEN='\033[01;32m'
+NONE='\033[00m'
+
+run_test () {
+  local name=$1
+  local path=$2
+  local expect=$3
+  local extra=$4
+
+  cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://nginx:8000${path} -H 'cache-control: no-cache' $extra"
+  result=$(eval ${cmd})
+
+  if [ "${result}" -eq "${expect}" ]; then
+    echo -e "${GREEN}${name}: passed (Received: ${result}; Path: ${path})${NONE}";
+    return 0
+  else
+    echo -e "${RED}${name}: failed (Expected: ${expect}; Received: ${result}; Path: ${path})${NONE}";
+    return 1
+  fi
+}
+
+main() {
+  local JWT_HS256_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.r8tG8IZheiQ-i6HqUYyJj9V6dipgcQ4ZIdxau6QCZDo
+  local JWT_HS256_MISSING_SUB=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
+  local JWT_HS256_MISSING_EMAIL=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
+  local JWT_HS384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.SS57j7PEybjbsp3g5W-IhhJHBmG5K-97qvgBKL16xj9ey-uMeEenWjGbB2vVp0kq
+  local JWT_HS512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.xtSU6EWN2LILVsYzJFJpKnRkqjn_3qjz-J2ttNKnhZ60_5YjFeC8io4k8k1u77zlohSWvWMdugD9ZaB3vjJo-w
+  local JWT_RS256_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
+  local JWT_RS256_INVALID=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
+  local JWT_RS384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.H35bTcZRhepWIoa8pKCbUMRuAOkVX9K5hJjc6tPmQwWmTw8lrktsvmMzJg_rgqnJLnAkciSIQw5EDj7fngS5zX2ThyRxrkPuE2Uiyw2Ect-mo9Kg1lrWgnyZCuCgq-Up9HQRAv0160mePlm8Gs4TOY6CPr38zwTcDZsy_Keq93igDQV8WuuWAGICaGd5ZyUOPjjzGShRjTU8Szz7fnpZpTtYRCYVo0pc5yfRWYm0fdn-4AseyGvd8JJ2xfnAEe4kZOkz7X1MLKtL0slKg3m2PH1lD7HwxIawXRTPWxArhJ9dcTNiDUrqtde2juGwOuMD_zTsb2Jj0_rmRb0Q6aljNw
+  local JWT_RS512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.iUupyKypfXJ5aZWfItSW-mOmx9a4C4X7Yr5p5Fk8W75ZhkOq0EeNfstTxx870brhkdPovBhO2LYI44_HoH9XicQNL6JnFprE0r61eJFngbuzlhRQiWpq0xYrazJWc9zB7_GgL2ZCwtw-Ts3G23Q0632wVm6-d7MKvG7RS8aEjN-MuVGdtLglH3forpItmFxw-if40EQsBL7hncN_XNcQTO4KPHkqmlpac_oKXRrLFDIIt2tB6OOpvY4QcpERoxexp4pi2f-JoINnWX_dU5JnIs3ypVJLQPfoJvxg8fsg3zYrOvMYnfsqOCYoHtZGK0O7jyfFmcGo5v2hLT-CpoF3Zw
+  local num_tests=0
+  local num_failed=0
+
+  run_test 'when auth disabled, should return 200' \
+           '/' \
+           '200'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with default algorithm and no JWT in Authorization header, returns 302' \
+           '/secure/auth-header/default' \
+           '302'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with default algorithm with no redirect and Authroization header missing Bearer, should return 401' \
+           '/secure/auth-header/default/no-redirect' \
+           '401' \
+           '--header "Authorization: X"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with default algorithm and no JWT cookie, returns 302' \
+           '/secure/cookie/default' \
+           '302'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with default algorithm with no redirect and no JWT cookie, should return 401' \
+           '/secure/cookie/default/no-redirect' \
+           '401'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with default algorithm and valid JWT cookie, returns 200' \
+           '/secure/cookie/default' \
+           '200' \
+           '--cookie "jwt=${JWT_HS256_VALID}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with default algorithm and valid JWT cookie with no sub, returns 200' \
+           '/secure/cookie/default' \
+           '200' \
+           ' --cookie "jwt=${JWT_HS256_MISSING_SUB}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with default algorithm and valid JWT cookie with no email, returns 200' \
+           '/secure/cookie/default' \
+           '200' \
+           ' --cookie "jwt=${JWT_HS256_MISSING_EMAIL}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with HS256 algorithm and valid JWT cookie, returns 200' \
+           '/secure/cookie/hs256/' \
+           '200' \
+           '--cookie "jwt=${JWT_HS256_VALID}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with HS384 algorithm and valid JWT cookie, returns 200' \
+           '/secure/cookie/hs384' \
+           '200' \
+           '--cookie "jwt=${JWT_HS384_VALID}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with HS512 algorithm and valid JWT cookie, returns 200' \
+           '/secure/cookie/hs512' \
+           '200' \
+           '--cookie "jwt=${JWT_HS512_VALID}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with RS256 algorithm and valid JWT cookie, returns 200' \
+           '/secure/cookie/rs256' \
+           '200' \
+           ' --cookie "jwt=${JWT_RS256_VALID}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with RS256 algorithm via file and valid JWT in Authorization header, returns 200' \
+           '/secure/auth-header/rs256/file' \
+           '200' \
+           '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with RS256 algorithm via file and invalid JWT in Authorization header, returns 401' \
+           '/secure/auth-header/rs256/file' \
+           '302' \
+           '--header "Authorization: Bearer ${JWT_RS256_INVALID}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with RS384 algorithm via file and valid JWT in Authorization header, returns 200' \
+           '/secure/auth-header/rs384/file' \
+           '200' \
+           '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  run_test 'when auth enabled with RS512 algorithm via file and valid JWT in Authorization header, returns 200' \
+           '/secure/auth-header/rs512/file' \
+           '200' \
+           '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
+  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
+
+  if [[ "${num_failed}" = '0' ]]; then
+    printf "\nRan ${num_tests} tests successfully.\n"
+    return 0
+  else
+    printf "\nRan ${num_tests} tests: ${GREEN}$((${num_tests} - ${num_failed})) passed${NONE}; ${RED}${num_failed} failed${NONE}\n"
+    return 1
+  fi
+}
+
+main '$@'

From 69e6e53f814a83b95b1cd06bf49ffcc3b079574f Mon Sep 17 00:00:00 2001
From: Orgad Shaneh <orgads@gmail.com>
Date: Wed, 9 Nov 2022 17:36:21 +0200
Subject: [PATCH 071/130] Fix link with jansson (#63)

jansson/lib/libjansson.a(value.o): In function `json_real':
value.c:(.text+0x3134): undefined reference to `__isnan'
value.c:(.text+0x314c): undefined reference to `__isinf'
jansson/lib/libjansson.a(value.o): In function `json_real_set':
value.c:(.text+0x3294): undefined reference to `__isnan'
value.c:(.text+0x32ac): undefined reference to `__isinf'
collect2: error: ld returned 1 exit status

Co-authored-by: Josh McCullough <JoshMcCullough@users.noreply.github.com>
---
 config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config b/config
index 34154fb..13c2325 100644
--- a/config
+++ b/config
@@ -2,6 +2,6 @@ ngx_module_type=HTTP
 ngx_addon_name=ngx_http_auth_jwt_module
 ngx_module_name=$ngx_addon_name
 ngx_module_srcs="${ngx_addon_dir}/src/ngx_http_auth_jwt_binary_converters.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_header_processing.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_string.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_module.c"
-ngx_module_libs="-ljansson -ljwt"
+ngx_module_libs="-ljansson -ljwt -lm"
 
 . auto/module

From 4cf353b3d1ab90c5786269270b6bc97f62fb070a Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Wed, 9 Nov 2022 15:17:19 -0500
Subject: [PATCH 072/130] update README with build-related info

---
 .gitignore |  1 +
 README.md  | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/.gitignore b/.gitignore
index a676215..fe4f0be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 .idea
+.vscode
 bin
diff --git a/README.md b/README.md
index 84913ee..6237985 100644
--- a/README.md
+++ b/README.md
@@ -145,3 +145,56 @@ auth_jwt_validate_email off;
 ## Contributing
 
 If you'd like to contribute to this repository, please first initiate the Git hooks by running `./.bin/init` (note the `.` before `bin`) -- this will ensure that tests are run before you push your changes.
+
+### Environment Set-up for Visual Studio Code
+
+1. Install the C/C++ extension from Microsoft.
+2. Add a C/C++ config file at `.vscode/c_cpp_properties.json` with the following (or similar) content:
+
+```json
+{
+    "configurations": [
+        {
+            "name": "Linux",
+            "includePath": [
+                "${workspaceFolder}/**",
+                "~/Projects/third-party/nginx/objs/**",
+                "~/Projects/third-party/nginx/src/**",
+                "~/Projects/third-party/libjwt/include/**",
+                "~/Projects/third-party/jansson/src/**"
+            ],
+            "defines": [],
+            "compilerPath": "/usr/bin/clang",
+            "cStandard": "c17",
+            "cppStandard": "c++14",
+            "intelliSenseMode": "linux-clang-x64"
+        }
+    ],
+    "version": 4
+}
+```
+
+Note the `includePath` additions above -- please update them as appropriate. Next we need to pull these sources.
+
+#### Building NGINX
+
+1. Download the NGINX release matching the version you're targeting.
+2. Extract the NGINX archive to wherever you'd like.
+3. Update the `includePath` entires shown above to match the location you chose.
+4. Enter the directory where you extracted NGINX and run: `./configure --with-compat`
+
+### Cloning libjwt
+
+1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:benmcollins/libjwt.git <target_dir>
+2. Enter the directory and switch to the latest tag: `git checkout $(git tag | sort -Vr | head -n 1)`
+3. Update the `includePath` entires shown above to match the location you chose.
+
+### Cloning lobjansson
+
+1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:akheron/jansson.git <target_dir>
+2. Enter the directory and switch to the latest tag: `git checkout $(git tag | sort -Vr | head -n 1)`
+3. Update the `includePath` entires shown above to match the location you chose.
+
+### Verify Compliation
+
+Once you save your changes to `.vscode/c_cpp_properties.json`, you should see that warnings and errors in the Problems panel go away, at least temprorarily. Hopfeully they don't come back, but if they do, make sure your include paths are set correctly.

From 829886f94a97fc3eb5f68f58db57b5fdb8dc42a4 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Thu, 10 Nov 2022 11:46:18 -0500
Subject: [PATCH 073/130] fix for #75 (#81)

---
 src/ngx_http_auth_jwt_module.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index cb3c055..508d781 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -422,31 +422,42 @@ ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf)
 static ngx_int_t
 loadAuthKey(ngx_conf_t *cf, ngx_http_auth_jwt_loc_conf_t* conf) {
 	FILE *keyFile = fopen((const char*)conf->auth_jwt_keyfile_path.data, "rb");
+	unsigned long keySize;
+	unsigned long keySizeRead;
 
 	// Check if file exists or is correctly opened
 	if (keyFile == NULL)
 	{
-		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "failed to open pub key file");
+		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "failed to open public key file");
 		return NGX_ERROR;
 	}
 
 	// Read file length
 	fseek(keyFile, 0, SEEK_END);
-	long keySize = ftell(keyFile);
+	keySize = ftell(keyFile);
 	fseek(keyFile, 0, SEEK_SET);
 	
 	if (keySize == 0)
 	{
-		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "invalid key file size, check the key file");
+		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "invalid public key file size of 0");
 		return NGX_ERROR;
 	}
 
 	conf->_auth_jwt_keyfile.data = ngx_palloc(cf->pool, keySize);
-	fread(conf->_auth_jwt_keyfile.data, 1, keySize, keyFile);
-	conf->_auth_jwt_keyfile.len = (int)keySize;
-
+	keySizeRead = fread(conf->_auth_jwt_keyfile.data, 1, keySize, keyFile);
 	fclose(keyFile);
-	return NGX_OK;
+	
+	if (keySizeRead == keySize)
+	{
+		conf->_auth_jwt_keyfile.len = (int)keySize;
+
+		return NGX_OK;
+	}
+	else {
+		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "public key size %i does not match expected size of %i", keySizeRead, keySize);
+
+		return NGX_ERROR;
+	}
 }
 
 static char *

From a5656b19673bdbb6557dade0c7a445418333748a Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Wed, 15 Mar 2023 17:04:58 -0400
Subject: [PATCH 074/130] fix cp_bin function

---
 scripts.sh | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index e41620d..01c307f 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -29,7 +29,7 @@ fetch_headers() {
 build_nginx() {
 	local dockerArgs=${1:-}
 
-	printf "${BLUE}  Building...${NC}"
+	printf "${BLUE}  Building NGINX...${NC}"
 	docker image pull debian:bullseye-slim
 	docker image pull nginx:${NGINX_VERSION}
 	docker image build -t ${FULL_IMAGE_NAME}:latest -t ${FULL_IMAGE_NAME}:${NGINX_VERSION} --build-arg NGINX_VERSION=${NGINX_VERSION} ${dockerArgs} .
@@ -44,10 +44,12 @@ build_nginx() {
 }
 
 rebuild_nginx() {
+	printf "${BLUE}  Rebuilding NGINX...${NC}"
 	build_nginx --no-cache
 }
 
 start_nginx() {
+	printf "${BLUE}  Starting NGINX...${NC}"
 	docker run --rm --name "${IMAGE_NAME}" -d -p 8000:80 ${FULL_IMAGE_NAME}
 }
 
@@ -56,13 +58,17 @@ stop_nginx() {
 }
 
 cp_bin() {
+	if [ "$(docker container inspect -f '{{.State.Running}}' ${IMAGE_NAME})" != "true" ]; then
+		start_nginx
+	fi
+
 	printf "${BLUE}  Copying binaries...${NC}"
 	rm -rf bin
 	mkdir bin
-	docker exec "${IMAGE_NAME}" sh -c "tar -chf - \
-		/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so \
-		/usr/lib/x86_64-linux-gnu/libjansson.so.* \
-		/usr/lib/x86_64-linux-gnu/libjwt.*" 2>/dev/null | tar -xf - -C bin &>/dev/null
+	docker exec "${IMAGE_NAME}" sh -c "cd /; tar -chf - \
+		usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so \
+		usr/lib/x86_64-linux-gnu/libjansson.so.* \
+		usr/lib/x86_64-linux-gnu/libjwt.*" | tar -xf - -C bin &>/dev/null
 }
 
 build_test_runner() {

From 8e5031b5b6a5767a2ad57ac9c852eb4b4554a489 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Wed, 19 Apr 2023 00:19:13 -0400
Subject: [PATCH 075/130] update README

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 6237985..546be26 100644
--- a/README.md
+++ b/README.md
@@ -75,7 +75,7 @@ This module requires several new `nginx.conf` directives, which can be specified
 
 | Directive                  | Description                                                                                                        |
 | -------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| `auth_jwt_key`             | The key to use to decode/verify the JWT -- see below.                                                              |
+| `auth_jwt_key`             | The key to use to decode/verify the JWT, *in binhex format* -- see below.                                          |
 | `auth_jwt_redirect`        | Set to "on" to redirect to `auth_jwt_loginurl` if authentication fails.                                            |
 | `auth_jwt_loginurl`        | The URL to redirect to if `auth_jwt_redirect` is enabled and authentication fails.                                 |
 | `auth_jwt_enabled`         | Set to "on" to enable JWT checking.                                                                                |

From 8014cdc01ac39406b75f26a61a0f6c77ea9244a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yoshi=20J=C3=A4ger?= <github@jaeger.berlin>
Date: Wed, 19 Apr 2023 13:55:18 +0200
Subject: [PATCH 076/130] Fix: Only call `docker rmi` if there are images to
 prune (#85)

* fix(scripts.sh): only call `docker rmi` if there are images to prune

* fix(docker-rmi): always return true after calling `docker rmi`
---
 scripts.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index 01c307f..89ec2ba 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -40,7 +40,7 @@ build_nginx() {
 		printf "${GREEN}✓ Successfully built NGINX module ${NC}"
 	fi
 
-	docker rmi -f $(docker images --filter=label=stage=builder --quiet)
+	docker rmi -f $(docker images --filter=label=stage=builder --quiet) || true
 }
 
 rebuild_nginx() {
@@ -92,4 +92,4 @@ test() {
 
 for fn in $@; do
 	"$fn"
-done
\ No newline at end of file
+done

From 850833443b3f616c5d250eb9b202266c8312f88c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yoshi=20J=C3=A4ger?= <github@jaeger.berlin>
Date: Wed, 19 Apr 2023 14:04:03 +0200
Subject: [PATCH 077/130] fix(docker-buildkit): Make stage names lowercase
 (#84)

---
 Dockerfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b0712ea..3fc5d9e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,13 @@
 ARG NGINX_VERSION
 
 
-FROM debian:bullseye-slim as BASE_IMAGE
+FROM debian:bullseye-slim as base_image
 LABEL stage=builder
 RUN  apt-get update \
 	&& apt-get install -y curl build-essential
 
 
-FROM BASE_IMAGE as BUILD_IMAGE
+FROM base_image as build_image
 LABEL stage=builder
 ENV LD_LIBRARY_PATH=/usr/local/lib
 ARG NGINX_VERSION
@@ -38,4 +38,4 @@ RUN  apt-get update \
 
 LABEL stage=
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
-COPY --from=BUILD_IMAGE /root/build/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/
+COPY --from=build_image /root/build/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/

From 583fffebe49871c2923c5e500046ba48f6ffe99c Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Thu, 20 Apr 2023 11:48:29 -0400
Subject: [PATCH 078/130] update to support extracting any claim to
 request/response headers + more (#87)

* update to support extracting any cookie

* fix tests

* fix tests more

* prefix log messages to find easier

* try to fix array offset

* fix test

* extracting claims to request headers is working

* add another test

* refactor and cleanup

* add claim extraction to response headers

* rename functions and such for clarity

* rename struct members for brevity _and_ clarity

* rm debugging

* update README

* update README

* update README

* formatting

* Update src/ngx_http_auth_jwt_header_processing.c

I *think* it might be moot since the compiler will probably optimize it anyway, but might as well do it that way.

Co-authored-by: Joan Marin <johnm7770@gmail.com>

* Update src/ngx_http_auth_jwt_module.c

Co-authored-by: Joan Marin <johnm7770@gmail.com>

* Update src/ngx_http_auth_jwt_module.c

Co-authored-by: Joan Marin <johnm7770@gmail.com>

---------

Co-authored-by: Joan Marin <johnm7770@gmail.com>
---
 Dockerfile                                |   50 +-
 README.md                                 |  242 +++--
 scripts.sh                                |   79 +-
 src/ngx_http_auth_jwt_binary_converters.c |   66 +-
 src/ngx_http_auth_jwt_header_processing.c |  113 +--
 src/ngx_http_auth_jwt_header_processing.h |    4 +-
 src/ngx_http_auth_jwt_module.c            | 1105 +++++++++++----------
 src/ngx_http_auth_jwt_string.c            |   12 +-
 src/ngx_http_auth_jwt_string.h            |    2 +-
 test/Dockerfile-test-nginx                |    8 +-
 test/Dockerfile-test-runner               |   10 +-
 test/docker-compose-test.yml              |    1 +
 test/docker-entrypoint.d/10-nginx-test.sh |    1 +
 test/{ => etc/nginx/conf.d}/test.conf     |   87 ++
 test/{ => etc/nginx}/rsa_key_2048-pub.pem |    0
 test/test.sh                              |  316 +++---
 16 files changed, 1227 insertions(+), 869 deletions(-)
 create mode 100755 test/docker-entrypoint.d/10-nginx-test.sh
 rename test/{ => etc/nginx/conf.d}/test.conf (59%)
 rename test/{ => etc/nginx}/rsa_key_2048-pub.pem (100%)

diff --git a/Dockerfile b/Dockerfile
index 3fc5d9e..328ea1e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,41 +1,41 @@
 ARG NGINX_VERSION
+ARG SOURCE_HASH
 
 
-FROM debian:bullseye-slim as base_image
-LABEL stage=builder
-RUN  apt-get update \
-	&& apt-get install -y curl build-essential
+FROM debian:bullseye-slim as ngx_http_auth_jwt_builder_base
+LABEL stage=ngx_http_auth_jwt_builder
+RUN apt-get update &&\
+	apt-get install -y curl build-essential
 
 
-FROM base_image as build_image
-LABEL stage=builder
+FROM ngx_http_auth_jwt_builder_base as ngx_http_auth_jwt_builder_module
+LABEL stage=ngx_http_auth_jwt_builder
 ENV LD_LIBRARY_PATH=/usr/local/lib
 ARG NGINX_VERSION
-RUN  set -x \
-	&& apt-get install -y libjwt-dev libjwt0 libjansson-dev libjansson4 libpcre2-dev zlib1g-dev libpcre3-dev \
-	&& mkdir -p /root/build/ngx-http-auth-jwt-module
+RUN set -x &&\
+	apt-get install -y libjwt-dev libjwt0 libjansson-dev libjansson4 libpcre2-dev zlib1g-dev libpcre3-dev &&\
+	mkdir -p /root/build/ngx-http-auth-jwt-module
 WORKDIR /root/build/ngx-http-auth-jwt-module
+ARG SOURCE_HASH
+RUN echo "Source Hash: ${SOURCE_HASH}"
 ADD config ./
 ADD src/*.h src/*.c ./src/
 WORKDIR /root/build
-RUN  set -x \
-  && mkdir nginx \
-	&& curl -O http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz \
-	&& tar -xzf nginx-${NGINX_VERSION}.tar.gz --strip-components 1 -C nginx \
-	&& rm nginx-${NGINX_VERSION}.tar.gz
+RUN set -x &&\
+  mkdir nginx &&\
+	curl -O http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz &&\
+	tar -xzf nginx-${NGINX_VERSION}.tar.gz --strip-components 1 -C nginx
 WORKDIR /root/build/nginx
-RUN  ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module \
-	&& make modules
-
-
-FROM nginx:${NGINX_VERSION}
-LABEL stage=builder
-RUN  apt-get update \
-	&& apt-get -y install libjansson4 libjwt0 \
-	&& cd /etc/nginx \
-	&& sed -ri '/pid\s+\/var\/run\/nginx\.pid;$/a load_module \/usr\/lib64\/nginx\/modules\/ngx_http_auth_jwt_module\.so;' nginx.conf
+RUN ./configure --with-debug --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module &&\
+	make modules
 
 
+FROM nginx:${NGINX_VERSION} AS ngx_http_auth_jwt_builder_nginx
 LABEL stage=
+RUN rm /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh /etc/nginx/conf.d/default.conf
+RUN apt-get update &&\
+	apt-get -y install libjansson4 libjwt0 &&\
+	cd /etc/nginx &&\
+	sed -ri '/pid\s+\/var\/run\/nginx\.pid;$/a load_module \/usr\/lib64\/nginx\/modules\/ngx_http_auth_jwt_module\.so;' nginx.conf
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
-COPY --from=build_image /root/build/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/
+COPY --from=ngx_http_auth_jwt_builder_module /root/build/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/
diff --git a/README.md b/README.md
index 546be26..3c7d0a7 100644
--- a/README.md
+++ b/README.md
@@ -1,98 +1,41 @@
-# Intro
+# Auth-JWT NGINX Module
 
-This is an NGINX module to check for a valid JWT and proxy to an upstream server or redirect to a login page.
-
-## Building and testing
-
-To build the Docker image, start NGINX, and run our Bash test against it, run
-
-```bash
-./scripts.sh all
-```
-
-When you make a change to the module or the NGINX test config, run `./scripts.sh rebuild_nginx` to rebuild the NGINX Docker image.
-
-When you make a change to `test.sh`, run `./scripts.sh rebuild_test_runner test` to rebuild the test runner image and run the tests.
-
-The `./scripts.sh` file contains multiple commands to make things easy:
-
-| Command               | Description                                                       |
-| --------------------- | ----------------------------------------------------------------- |
-| `build_nginx`         | Builds the NGINX image.                                           |
-| `rebuild_nginx`       | Re-builds the NGINX image.                                        |
-| `start_nginx`         | Starts the NGINX container.                                       |
-| `stop_nginx`          | Stops the NGINX container.                                        |
-| `cp_bin`              | Copies the compiled binaries out of the NGINX container.          |
-| `build_test_runner`   | Builds the images used by the test stack (uses Docker compose).   |
-| `rebuild_test_runner` | Re-builds the images used by the test stack.                      |
-| `test`                | Runs `test.sh` against the NGINX container (uses Docker compose). |
-
-You can run multiple commands in sequence by separating them with a space, e.g.:
-
-```shell
-./scripts.sh rebuild_nginx rebuild_test_runner test
-```
-
-The image produced with `./scripts.sh build_nginx` only differs from the official NGINX image in two ways:
- - the JWT module itself, and
- - the `nginx.conf` file is overwritten with our own.
-
-The tests use a customized NGINX image, distinct from the main image, as well as a test runner image. By running `./scripts.sh test`, the two test containers will be stood up via Docker compose, then they'll be started, and the tests will run. At the end of the test run, both containers will be automatically stopped and destroyed. See below to learn how to trace test failures across runs.
-
-### Tracing test failures
-
-After making changes and finding that some tests fail, it can be difficult to understand why. By default, logs are written to Docker's internal log mechanism, but they won't be persisted after the test run completes and the containers are removed.
-
-In order to persist logs, you can configure the log driver to use. You can do this by setting the environment variable `LOG_DRIVER` before running the tests. On Linux/Unix systems, you can use the driver `journald`, as follows:
-
-```shell
-# need to rebuild the test runner with the proper log driver
-LOG_DRIVER=journald ./scripts.sh rebuild_test_runner
-
-# run the tests
-./scripts.sh test
-
-# check the logs
-journalctl -eu docker CONTAINER_NAME=jwt-nginx-test
-```
-
-Now you'll be able to see logs from previous test runs. The best way to make use of this  is to open two terminals, one where you run the tests, and one where you follow the logs:
-
-```shell
-# terminal 1
-./scripts.sh test
-
-# terminal 2
-journalctl -fu docker CONTAINER_NAME=jwt-nginx-test
-```
+This is an NGINX module to check for a valid JWT and proxy to an upstream server or redirect to a login page. It supports additional features such as extracting claims from the JWT and placing them on the request/response headers.
 
 ## Dependencies
 
 This module depends on the [JWT C Library](https://github.com/benmcollins/libjwt). Transitively, that library depends on a JSON Parser called [Jansson](https://github.com/akheron/jansson) as well as the OpenSSL library.
 
-## NGINX Directives
+## Directives
+
 This module requires several new `nginx.conf` directives, which can be specified at the `http`, `server`, or `location` levels.
 
-| Directive                  | Description                                                                                                        |
-| -------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| `auth_jwt_key`             | The key to use to decode/verify the JWT, *in binhex format* -- see below.                                          |
-| `auth_jwt_redirect`        | Set to "on" to redirect to `auth_jwt_loginurl` if authentication fails.                                            |
-| `auth_jwt_loginurl`        | The URL to redirect to if `auth_jwt_redirect` is enabled and authentication fails.                                 |
-| `auth_jwt_enabled`         | Set to "on" to enable JWT checking.                                                                                |
-| `auth_jwt_algorithm`       | The algorithm to use. One of: HS256, HS384, HS512, RS256, RS384, RS512                                             |
-| `auth_jwt_extract_sub`     | Set to "on" to extract the `sub` claim (e.g. user id) from the JWT and into the `x-userid` header on the response. |
-| `auth_jwt_validate_email`  | Set to "on" to extract the `emailAddress` claim from the JWT and into the `x-email` header on the response.        |
-| `auth_jwt_use_keyfile`     | Set to "on" to read the key from a file rather than from the `auth_jwt_key` directive.                             |
-| `auth_jwt_keyfile_path`    | Set to the path from which the key should be read when `auth_jwt_use_keyfile` is enabled.                          |
+| Directive                            | Description                                                                                                                                          |
+| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `auth_jwt_key`                       | The key to use to decode/verify the JWT, *in binhex format* -- see below.                                                                            |
+| `auth_jwt_redirect`                  | Set to "on" to redirect to `auth_jwt_loginurl` if authentication fails.                                                                              |
+| `auth_jwt_loginurl`                  | The URL to redirect to if `auth_jwt_redirect` is enabled and authentication fails.                                                                   |
+| `auth_jwt_enabled`                   | Set to "on" to enable JWT checking.                                                                                                                  |
+| `auth_jwt_algorithm`                 | The algorithm to use. One of: HS256, HS384, HS512, RS256, RS384, RS512                                                                               |
+| `auth_jwt_validation_type`           | Indicates where the JWT is located in the request -- see below.                                                                                      |
+| `auth_jwt_validate_sub`              | Set to "on" to validate the `sub` claim (e.g. user id) in the JWT.                                                                                   |
+| `auth_jwt_extract_request_claims`    | Set to a space-delimited list of claims to extract from the JWT and set as request headers. These will be accessible via e.g: `$http_jwt_sub`        |
+| `auth_jwt_extract_response_claims`   | Set to a space-delimited list of claims to extract from the JWT and set as response headers. These will be accessible via e.g: `$sent_http_jwt_sub`  |
+| `auth_jwt_use_keyfile`               | Set to "on" to read the key from a file rather than from the `auth_jwt_key` directive.                                                               |
+| `auth_jwt_keyfile_path`              | Set to the path from which the key should be read when `auth_jwt_use_keyfile` is enabled.                                                            |
+
 
+## Algorithms
 
 The default algorithm is `HS256`, for symmetric key validation. When using one of the `HS*` algorithms, the value for `auth_jwt_key` should be specified in binhex format. It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total) as in the example above. Note that using more than 512 bits will not increase the security. For key guidelines please see [NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms](https://csrc.nist.gov/publications/detail/sp/800-107/rev-1/final), Section 5.3.2 The HMAC Key.
 
+### Additional Supported Algorithms
+
 The configuration also supports RSA public key validation via (e.g.) `auth_jwt_algorithm RS256`. When using the `RS*` alhorithms, the `auth_jwt_key` field must be set to your public key **OR** `auth_jwt_use_keyfile` should be set to `on` and `auth_jwt_keyfile_path` should point to the public key on disk. NGINX won't start if `auth_jwt_use_keyfile` is set to `on` and a key file is not provided.
 
 When using an `RS*` algorithm with an inline key, be sure to set `auth_jwt_key` to the _public key_, rather than a PEM certificate. E.g.:
 
-```
+```nginx
 auth_jwt_key "-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0aPPpS7ufs0bGbW9+OFQ
 RvJwb58fhi2BuHMd7Ys6m8D1jHW/AhDYrYVZtUnA60lxwSJ/ZKreYOQMlNyZfdqA
@@ -106,42 +49,76 @@ oQIDAQAB
 
 When using an `RS*` algorithm with a public key file, do as follows:
 
-```
+```nginx
 auth_jwt_use_keyfile on;
 auth_jwt_keyfile_path "/path/to/pub_key.pem";
 ```
 
-A typical use would be to specify the key and login URL at the `http` level, and then only turn JWT authentication on for the locations which you want to secure. Unauthorized requests result in a 302 "Moved Temporarily" response with the `Location` header set to the URL specified in the `auth_jwt_loginurl` directive, and a querystring parameter `return_url` whose value is the current / attempted URL.
+A typical use case would be to specify the key and login URL at the `http` level, and then only turn JWT authentication on for the locations which you want to secure (or vice-versa). Unauthorized requests will result in a `302 Moved Temporarily` response with the `Location` header set to the URL specified in the `auth_jwt_loginurl` directive, and a querystring parameter `return_url` whose value is the current / attempted URL.
 
 If you prefer to return `401 Unauthorized` rather than redirect, you may turn `auth_jwt_redirect` off:
 
-```
+```nginx
 auth_jwt_redirect off;
 ```
+## JWT Locations
 
-By default the authorization header is used to provide a JWT for validation. However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT:
+By default, the authorization header is used to provide a JWT for validation. However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT:
 
-```
+```nginx
 auth_jwt_validation_type COOKIE=jwt;
 ```
 
-By default, the module will attempt to extract the `sub` claim (e.g. the user's id) from the JWT. If successful, the 
-value will be set in the `x-userid` HTTP header. An error will be logged if this option is enabled and the JWT does not 
-contain the `sub` claim. You may disable this option as follows:
+## `sub` Validation
+
+Optionally, the module can validate that a `sub` claim (e.g. the user's id) exists in the JWT. You may enable this feature as follows:
 
+```nginx
+auth_jwt_validate_sub on;
 ```
-auth_jwt_extract_sub off
+
+## Extracting Claims from the JWT
+
+You may specify claims to be extracted from the JWT and placed on the request and/or response headers. This is especially handly because the claims will then also be available as NGINX variables.
+
+If you only wish to access a claim as an NGINX variable, you should use `auth_jwt_extract_request_claims` so that the claim does not end up being sent to the client as a response header. However, if you do want the claim to be sent to the client in the response, then use `auth_jwt_extract_response_claims` instead.
+
+### Using Request Claims
+
+For example, you could configure an NGINX location which redirects to the current user's profile. Suppose `sub=abc-123`, the configuration below would redirect to `/profile/abc-123`.
+
+```nginx
+location /profile/me {
+    auth_jwt_extract_request_claims sub;
+
+    return 301 /profile/$http_jwt_sub;
+}
 ```
 
-By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the
-session, and will log an error if it isn't found. To disable this behavior, for instance if you are using a different
-user identifier property such as `sub`, set `auth_jwt_validate_email` to the value `off`. _Note that this flag may be 
-renamed to `auth_jwt_extract_email` in a future release._ You may disable this option as follows:
+### Using Response Claims
+
+Response claims are used in the same way, with the only differences being:
+ - the variables are accessed via the `$sent_http_jwt_*` pattern, e.g. `$sent_http_jwt_sub`, and
+ - the headers are sent to the client.
 
+### Extracting Multiple Claims
+
+You may extract multiple claims by specifying all claims as arguments to a single directive, or by supplying multiple directives. The following two examples are equivalent.
+
+```nginx
+auth_jwt_extract_request_claims sub firstName lastName;
 ```
-auth_jwt_validate_email off;
+
+```nginx
+auth_jwt_extract_request_claims sub;
+auth_jwt_extract_request_claims firstName;
+auth_jwt_extract_request_claims lastName;
 ```
 
+## Versioning
+
+This module has historically not been versioned, however, we are now starting to version the module in order to add clarity. We will add releases here in GitHub with additional details. In the future we may also publish pre-built modules for a selection of NGINX versions.
+
 ## Contributing
 
 If you'd like to contribute to this repository, please first initiate the Git hooks by running `./.bin/init` (note the `.` before `bin`) -- this will ensure that tests are run before you push your changes.
@@ -158,10 +135,10 @@ If you'd like to contribute to this repository, please first initiate the Git ho
             "name": "Linux",
             "includePath": [
                 "${workspaceFolder}/**",
-                "~/Projects/third-party/nginx/objs/**",
-                "~/Projects/third-party/nginx/src/**",
-                "~/Projects/third-party/libjwt/include/**",
-                "~/Projects/third-party/jansson/src/**"
+                "~/Projects/nginx/objs/**",
+                "~/Projects/nginx/src/**",
+                "~/Projects/libjwt/include/**",
+                "~/Projects/jansson/src/**"
             ],
             "defines": [],
             "compilerPath": "/usr/bin/clang",
@@ -183,18 +160,83 @@ Note the `includePath` additions above -- please update them as appropriate. Nex
 3. Update the `includePath` entires shown above to match the location you chose.
 4. Enter the directory where you extracted NGINX and run: `./configure --with-compat`
 
-### Cloning libjwt
+#### Cloning libjwt
 
 1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:benmcollins/libjwt.git <target_dir>
 2. Enter the directory and switch to the latest tag: `git checkout $(git tag | sort -Vr | head -n 1)`
 3. Update the `includePath` entires shown above to match the location you chose.
 
-### Cloning lobjansson
+#### Cloning libjansson
 
 1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:akheron/jansson.git <target_dir>
 2. Enter the directory and switch to the latest tag: `git checkout $(git tag | sort -Vr | head -n 1)`
 3. Update the `includePath` entires shown above to match the location you chose.
 
-### Verify Compliation
+#### Verifing Compliation
 
 Once you save your changes to `.vscode/c_cpp_properties.json`, you should see that warnings and errors in the Problems panel go away, at least temprorarily. Hopfeully they don't come back, but if they do, make sure your include paths are set correctly.
+
+### Building and Testing
+
+The `./scripts.sh` file contains multiple commands to make things easy:
+
+| Command               | Description                                                       |
+| --------------------- | ----------------------------------------------------------------- |
+| `build_module`        | Builds the NGINX image.                                           |
+| `rebuild_module`      | Re-builds the NGINX image.                                        |
+| `start_nginx`         | Starts the NGINX container.                                       |
+| `stop_nginx`          | Stops the NGINX container.                                        |
+| `cp_bin`              | Copies the compiled binaries out of the NGINX container.          |
+| `build_test_runner`   | Builds the images used by the test stack (uses Docker compose).   |
+| `rebuild_test_runner` | Re-builds the images used by the test stack.                      |
+| `test`                | Runs `test.sh` against the NGINX container (uses Docker compose). |
+| `test_now`            | Runs `test.sh` without rebuilding.                                |
+
+You can run multiple commands in sequence by separating them with a space, e.g.:
+
+```shell
+./scripts.sh build_module test
+```
+
+To build the Docker images, module, start NGINX, and run the tests against, you can simply do:
+
+```shell
+./scripts.sh all
+```
+
+When you make a change to the module run `./scripts.sh build_module test` to build a fresh module and run the tests. Note that `rebuild_module` is not often needed as `build_module` hashes the module's source files which will cause a cache miss while building the container, causing the module to be rebuilt.
+
+When you make a change to the test NGINX config or `test.sh`, run `./scripts.sh test` to run the tests. Similar to above, the test sources are hashed and the containers will be rebuilt as needed.
+
+The image produced with `./scripts.sh build_module` only differs from the official NGINX image in two ways:
+ - the JWT module itself, and
+ - the `nginx.conf` file is overwritten with our own.
+
+The tests use a customized NGINX image, distinct from the main image, as well as a test runner image. By running `./scripts.sh test`, the two test containers will be stood up via Docker compose, then they'll be started, and the tests will run. At the end of the test run, both containers will be automatically stopped and destroyed. See below to learn how to trace test failures across runs.
+
+#### Tracing Test Failures
+
+After making changes and finding that some tests fail, it can be difficult to understand why. By default, logs are written to Docker's internal log mechanism, but they won't be persisted after the test run completes and the containers are removed.
+
+In order to persist logs, you can configure the log driver to use. You can do this by setting the environment variable `LOG_DRIVER` before running the tests. On Linux/Unix systems, you can use the driver `journald`, as follows:
+
+```shell
+# need to rebuild the test runner with the proper log driver
+LOG_DRIVER=journald ./scripts.sh rebuild_test_runner
+
+# run the tests
+./scripts.sh test
+
+# check the logs
+journalctl -eu docker CONTAINER_NAME=jwt-nginx-test
+```
+
+Now you'll be able to see logs from previous test runs. The best way to make use of this  is to open two terminals, one where you run the tests, and one where you follow the logs:
+
+```shell
+# terminal 1
+./scripts.sh test
+
+# terminal 2
+journalctl -fu docker CONTAINER_NAME=jwt-nginx-test
+```
diff --git a/scripts.sh b/scripts.sh
index 89ec2ba..873d170 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -12,44 +12,39 @@ export CONTAINER_NAME_PREFIX=${CONTAINER_NAME_PREFIX:-jwt-nginx-test}
 export NGINX_VERSION=${NGINX_VERSION:-1.22.0}
 
 all() {
-	build_nginx
-	start_nginx
+	build_module
+	build_test_runner
 	test
 }
 
-fetch_headers() {
-	printf "${BLUE} Fetching NGINX headers...${NC}"
-	local files='src/core/ngx_core.h src/http/ngx_http.h'
-
-	for f in ${files}; do
-		curl "https://raw.githubusercontent.com/nginx/nginx/release-${NGINX_VERSION}/${f}" -o src/lib/$(basename ${f})
-	done
-}
-
-build_nginx() {
+build_module() {
 	local dockerArgs=${1:-}
+	local sourceHash=$(get_hash config src/*)
 
-	printf "${BLUE}  Building NGINX...${NC}"
+	printf "${BLUE}Pulling images...${NC}\n"
 	docker image pull debian:bullseye-slim
 	docker image pull nginx:${NGINX_VERSION}
-	docker image build -t ${FULL_IMAGE_NAME}:latest -t ${FULL_IMAGE_NAME}:${NGINX_VERSION} --build-arg NGINX_VERSION=${NGINX_VERSION} ${dockerArgs} .
+
+	printf "${BLUE}Building module...${NC}\n"
+	docker image build -t ${FULL_IMAGE_NAME}:latest -t ${FULL_IMAGE_NAME}:${NGINX_VERSION} ${dockerArgs} \
+		--build-arg NGINX_VERSION=${NGINX_VERSION} \
+		--build-arg SOURCE_HASH=${sourceHash} \.
 	
 	if [ "$?" -ne 0 ]; then
-		printf "${RED}  Build failed ${NC}"
+		printf "${RED}✘ Build failed ${NC}\n"
 	else
-		printf "${GREEN}✓ Successfully built NGINX module ${NC}"
+		printf "${GREEN}✔ Successfully built NGINX module ${NC}\n"
 	fi
 
-	docker rmi -f $(docker images --filter=label=stage=builder --quiet) || true
+	docker rmi -f $(docker images --filter=label=stage=ngx_http_auth_jwt_builder --quiet) 2> /dev/null || true
 }
 
-rebuild_nginx() {
-	printf "${BLUE}  Rebuilding NGINX...${NC}"
-	build_nginx --no-cache
+rebuild_module() {
+	build_module --no-cache
 }
 
 start_nginx() {
-	printf "${BLUE}  Starting NGINX...${NC}"
+	printf "${BLUE}Starting NGINX...${NC}\n"
 	docker run --rm --name "${IMAGE_NAME}" -d -p 8000:80 ${FULL_IMAGE_NAME}
 }
 
@@ -62,7 +57,7 @@ cp_bin() {
 		start_nginx
 	fi
 
-	printf "${BLUE}  Copying binaries...${NC}"
+	printf "${BLUE}Copying binaries...${NC}\n"
 	rm -rf bin
 	mkdir bin
 	docker exec "${IMAGE_NAME}" sh -c "cd /; tar -chf - \
@@ -73,9 +68,13 @@ cp_bin() {
 
 build_test_runner() {
 	local dockerArgs=${1:-}
+	local configHash=$(get_hash $(find test -type f -not -name 'test.sh' -not -name '*.yml' -not -name 'Dockerfile*'))
+	local sourceHash=$(get_hash test/test.sh)
 
-	printf "${BLUE}  Building test runner...${NC}"
-	docker compose -f ./test/docker-compose-test.yml build ${dockerArgs}
+	printf "${BLUE}Building test runner...${NC}\n"
+	docker compose -f ./test/docker-compose-test.yml build ${dockerArgs} \
+		--build-arg CONFIG_HASH=${configHash}\
+		--build-arg SOURCE_HASH=${sourceHash}
 }
 
 rebuild_test_runner() {
@@ -83,13 +82,35 @@ rebuild_test_runner() {
 }
 
 test() {
-	printf "${BLUE}  Running tests...${NC}"
+	build_test_runner
+
+	printf "${BLUE}Running tests...${NC}\n"
 	docker compose -f ./test/docker-compose-test.yml up --no-start
 	docker start ${CONTAINER_NAME_PREFIX}
-	docker start -a ${CONTAINER_NAME_PREFIX}-runner
+	
+	if [ "$(docker container inspect -f '{{.State.Running}}' ${CONTAINER_NAME_PREFIX})" != "true" ]; then
+		printf "${RED}Failed to start NGINX test container. See logs below:\n"
+		docker logs ${CONTAINER_NAME_PREFIX}
+		printf "${NC}\n"
+	else
+		docker start -a ${CONTAINER_NAME_PREFIX}-runner
+	fi
+
 	docker compose -f ./test/docker-compose-test.yml down
 }
 
-for fn in $@; do
-	"$fn"
-done
+test_now() {
+	docker start -a ${CONTAINER_NAME_PREFIX}-runner
+}
+
+get_hash() {
+	sha1sum $@ | sed -E 's|\s+|:|' | tr '\n' ' ' | sha1sum | head -c 40
+}
+
+if [ $# -eq 0 ]; then
+	all
+else
+	for fn in "$@"; do
+		${fn}
+	done
+fi
diff --git a/src/ngx_http_auth_jwt_binary_converters.c b/src/ngx_http_auth_jwt_binary_converters.c
index 8aea970..8b60560 100644
--- a/src/ngx_http_auth_jwt_binary_converters.c
+++ b/src/ngx_http_auth_jwt_binary_converters.c
@@ -8,42 +8,56 @@
  */
 
 #include "ngx_http_auth_jwt_binary_converters.h"
-
 #include <ngx_core.h>
 
-int hex_char_to_binary( char ch, char* ret )
+int hex_char_to_binary(char ch, char *ret)
 {
-	ch = tolower( ch );
-	if( isdigit( ch ) )
+	ch = tolower(ch);
+
+	if (isdigit(ch))
+	{
 		*ret = ch - '0';
-	else if( ch >= 'a' && ch <= 'f' )
-		*ret = ( ch - 'a' ) + 10;
-	else if( ch >= 'A' && ch <= 'F' )
-		*ret = ( ch - 'A' ) + 10;
+	}
+	else if (ch >= 'a' && ch <= 'f')
+	{
+		*ret = (ch - 'a') + 10;
+	}
+	else if (ch >= 'A' && ch <= 'F')
+	{
+		*ret = (ch - 'A') + 10;
+	}
 	else
-		return *ret = 0;
-	return 1;
+	{
+		return -1;
+	}
+
+	return 0;
 }
 
-int hex_to_binary( const char* str, u_char* buf, int len ) 
+int hex_to_binary(const char *str, u_char *buf, int len)
 {
-	u_char	
-		*cpy = buf;
-	char
-		low,
-		high;
-	int
-		odd = len % 2;
-	
-	if (odd) {
+	int odd = len % 2;
+
+	if (odd)
+	{
 		return -1;
 	}
-
-	for (int i = 0; i < len; i += 2) {
-		hex_char_to_binary( *(str + i), &high );
-		hex_char_to_binary( *(str + i + 1 ), &low );
+	else
+	{
+		u_char *cpy = buf;
+		char low;
+		char high;
 		
-		*cpy++ = low | (high << 4);
+		for (int i = 0; i < len; i += 2)
+		{
+			if (hex_char_to_binary(*(str + i), &high) != 0 || hex_char_to_binary(*(str + i + 1), &low) != 0)
+			{
+				return -2;
+			}
+
+			*cpy++ = low | (high << 4);
+		}
+
+		return 0;
 	}
-	return 0;
 }
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_header_processing.c b/src/ngx_http_auth_jwt_header_processing.c
index e368c84..ff648b9 100644
--- a/src/ngx_http_auth_jwt_header_processing.c
+++ b/src/ngx_http_auth_jwt_header_processing.c
@@ -16,80 +16,73 @@
  * Sample code from nginx.
  * https://www.nginx.com/resources/wiki/start/topics/examples/headers_management/?highlight=http%20settings
  */
-ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len)
+ngx_table_elt_t *search_headers_in(ngx_http_request_t *r, u_char *name, size_t len)
 {
-	ngx_list_part_t            *part;
-	ngx_table_elt_t            *h;
-	ngx_uint_t                  i;
+  ngx_list_part_t *part;
+  ngx_table_elt_t *h;
+  ngx_uint_t i;
 
-	// Get the first part of the list. There is usual only one part.
-	part = &r->headers_in.headers.part;
-	h = part->elts;
+  // Get the first part of the list. There is usual only one part.
+  part = &r->headers_in.headers.part;
+  h = part->elts;
 
-	// Headers list array may consist of more than one part, so loop through all of it
-	for (i = 0; /* void */ ; i++)
-	{
-		if (i >= part->nelts)
-		{
-			if (part->next == NULL)
-			{
-				/* The last part, search is done. */
-				break;
-			}
+  // Headers list array may consist of more than one part, so loop through all of it
+  for (i = 0; /* void */; ++i)
+  {
+    if (i >= part->nelts)
+    {
+      if (part->next == NULL)
+      {
+        /* The last part, search is done. */
+        break;
+      }
 
-			part = part->next;
-			h = part->elts;
-			i = 0;
-		}
+      part = part->next;
+      h = part->elts;
+      i = 0;
+    }
 
-		//Just compare the lengths and then the names case insensitively.
-		if (len != h[i].key.len || ngx_strcasecmp(name, h[i].key.data) != 0)
-		{
-			/* This header doesn't match. */
-			continue;
-		}
+    // Just compare the lengths and then the names case insensitively.
+    if (len != h[i].key.len || ngx_strcasecmp(name, h[i].key.data) != 0)
+    {
+      /* This header doesn't match. */
+      continue;
+    }
 
-		/*
-		* Ta-da, we got one!
-		* Note, we've stopped the search at the first matched header
-		* while more then one header may match.
-		*/
-		return &h[i];
-	}
+    /*
+     * Ta-da, we got one!
+     * Note, we've stopped the search at the first matched header
+     * while more then one header may match.
+     */
+    return &h[i];
+  }
 
-	/* No headers was found */
-	return NULL;
+  /* No headers found */
+  return NULL;
 }
 
-/**
- * Sample code from nginx
- * https://www.nginx.com/resources/wiki/start/topics/examples/headers_management/#how-can-i-set-a-header
- */
-ngx_int_t set_custom_header_in_headers_out(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value) {
-    ngx_table_elt_t   *h;
+ngx_int_t set_request_header(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value)
+{
+  return set_header(ngx_list_push(&r->headers_in.headers), key, value);
+}
 
-    /*
-    All we have to do is just to allocate the header...
-    */
-    h = ngx_list_push(&r->headers_out.headers);
-    if (h == NULL) {
-        return NGX_ERROR;
-    }
+ngx_int_t set_response_header(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value)
+{
+  return set_header(ngx_list_push(&r->headers_out.headers), key, value);
+}
 
-    /*
-    ... setup the header key ...
-    */
+ngx_int_t set_header(ngx_table_elt_t *h, ngx_str_t *key, ngx_str_t *value)
+{
+  if (h == NULL)
+  {
+    return NGX_ERROR;
+  }
+  else
+  {
     h->key = *key;
-
-    /*
-    ... and the value.
-    */
     h->value = *value;
-
-    /*
-    Mark the header as not deleted.
-    */
     h->hash = 1;
 
     return NGX_OK;
+  }
 }
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_header_processing.h b/src/ngx_http_auth_jwt_header_processing.h
index 0b64133..acd1762 100644
--- a/src/ngx_http_auth_jwt_header_processing.h
+++ b/src/ngx_http_auth_jwt_header_processing.h
@@ -9,6 +9,8 @@
 #define _NGX_HTTP_AUTH_JWT_HEADER_PROCESSING_H
 
 ngx_table_elt_t* search_headers_in(ngx_http_request_t *r, u_char *name, size_t len);
-ngx_int_t set_custom_header_in_headers_out(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value);
+ngx_int_t set_request_header(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value);
+ngx_int_t set_response_header(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value);
+ngx_int_t set_header(ngx_table_elt_t *h, ngx_str_t *key, ngx_str_t *value);
 
 #endif /* _NGX_HTTP_AUTH_JWT_HEADER_PROCESSING_H */
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 508d781..3ecb0d3 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -20,543 +20,638 @@
 
 #include <stdio.h>
 
-typedef struct {
-	ngx_str_t    auth_jwt_loginurl;
-	ngx_str_t    auth_jwt_key;
-	ngx_flag_t   auth_jwt_enabled;
-	ngx_flag_t   auth_jwt_redirect;
-	ngx_str_t    auth_jwt_validation_type;
-	ngx_str_t    auth_jwt_algorithm;
-	ngx_flag_t   auth_jwt_extract_sub;
-	ngx_flag_t   auth_jwt_validate_email;
-	ngx_str_t    auth_jwt_keyfile_path;
-	ngx_flag_t   auth_jwt_use_keyfile;
-	// Private field for keyfile data
-	ngx_str_t    _auth_jwt_keyfile;
-} ngx_http_auth_jwt_loc_conf_t;
-
-static ngx_int_t ngx_http_auth_jwt_init(ngx_conf_t *cf);
-static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r);
-static void * ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf);
-static char * ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child);
-static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type);
-
-static ngx_command_t ngx_http_auth_jwt_commands[] = {
-
-	{ ngx_string("auth_jwt_loginurl"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-		ngx_conf_set_str_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_loginurl),
-		NULL },
-
-	{ ngx_string("auth_jwt_key"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-		ngx_conf_set_str_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_key),
-		NULL },
-
-	{ ngx_string("auth_jwt_enabled"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
-		ngx_conf_set_flag_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_enabled),
-		NULL },
-
-	{ ngx_string("auth_jwt_redirect"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
-		ngx_conf_set_flag_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_redirect),
-		NULL },
-
-	{ ngx_string("auth_jwt_validation_type"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-		ngx_conf_set_str_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_validation_type),
-		NULL },
-
-	{ ngx_string("auth_jwt_algorithm"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-		ngx_conf_set_str_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_algorithm),
-		NULL },
-
-	{ ngx_string("auth_jwt_extract_sub"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
-		ngx_conf_set_flag_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_extract_sub),
-		NULL },
-
-	{ ngx_string("auth_jwt_validate_email"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
-		ngx_conf_set_flag_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_validate_email),
-		NULL },
-
-	{ ngx_string("auth_jwt_keyfile_path"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
-		ngx_conf_set_str_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_keyfile_path),
-		NULL },
-
-	{ ngx_string("auth_jwt_use_keyfile"),
-		NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG,
-		ngx_conf_set_flag_slot,
-		NGX_HTTP_LOC_CONF_OFFSET,
-		offsetof(ngx_http_auth_jwt_loc_conf_t, auth_jwt_use_keyfile),
-		NULL },
-
-	ngx_null_command
+typedef struct
+{
+  ngx_str_t loginurl;
+  ngx_str_t key;
+  ngx_flag_t enabled;
+  ngx_flag_t redirect;
+  ngx_str_t validation_type;
+  ngx_str_t algorithm;
+  ngx_flag_t validate_sub;
+  ngx_array_t *extract_request_claims;
+  ngx_array_t *extract_response_claims;
+  ngx_str_t keyfile_path;
+  ngx_flag_t use_keyfile;
+  ngx_str_t _keyfile;
+} auth_jwt_conf_t;
+
+static ngx_int_t init(ngx_conf_t *cf);
+static void *create_conf(ngx_conf_t *cf);
+static char *merge_conf(ngx_conf_t *cf, void *parent, void *child);
+static char *merge_extract_request_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *c);
+static char *merge_extract_response_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *c);
+static ngx_int_t handle_request(ngx_http_request_t *r);
+static int validate_alg(auth_jwt_conf_t *jwtcf, jwt_t *jwt);
+static int validate_exp(auth_jwt_conf_t *jwtcf, jwt_t *jwt);
+static int validate_sub(auth_jwt_conf_t *jwtcf, jwt_t *jwt);
+static void extract_request_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt);
+static void extract_response_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt);
+static ngx_int_t free_jwt_and_redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt);
+static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf);
+static ngx_int_t load_public_key(ngx_conf_t *cf, auth_jwt_conf_t *conf);
+static char *get_jwt(ngx_http_request_t *r, ngx_str_t validation_type);
+
+static char *JWT_HEADER_PREFIX = "JWT-";
+
+static ngx_command_t auth_jwt_directives[] = {
+    {ngx_string("auth_jwt_loginurl"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_TAKE1,
+     ngx_conf_set_str_slot,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, loginurl),
+     NULL},
+
+    {ngx_string("auth_jwt_key"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_TAKE1,
+     ngx_conf_set_str_slot,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, key),
+     NULL},
+
+    {ngx_string("auth_jwt_enabled"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_FLAG,
+     ngx_conf_set_flag_slot,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, enabled),
+     NULL},
+
+    {ngx_string("auth_jwt_redirect"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_FLAG,
+     ngx_conf_set_flag_slot,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, redirect),
+     NULL},
+
+    {ngx_string("auth_jwt_validation_type"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_TAKE1,
+     ngx_conf_set_str_slot,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, validation_type),
+     NULL},
+
+    {ngx_string("auth_jwt_algorithm"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_TAKE1,
+     ngx_conf_set_str_slot,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, algorithm),
+     NULL},
+
+    {ngx_string("auth_jwt_validate_sub"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_FLAG,
+     ngx_conf_set_flag_slot,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, validate_sub),
+     NULL},
+
+    {ngx_string("auth_jwt_extract_request_claims"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_1MORE,
+     merge_extract_request_claims,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, extract_request_claims),
+     NULL},
+
+    {ngx_string("auth_jwt_extract_response_claims"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_1MORE,
+     merge_extract_response_claims,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, extract_response_claims),
+     NULL},
+
+    {ngx_string("auth_jwt_keyfile_path"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_TAKE1,
+     ngx_conf_set_str_slot,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, keyfile_path),
+     NULL},
+
+    {ngx_string("auth_jwt_use_keyfile"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_FLAG,
+     ngx_conf_set_flag_slot,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, use_keyfile),
+     NULL},
+
+    ngx_null_command};
+
+static ngx_http_module_t auth_jwt_context = {
+    NULL,        /* preconfiguration */
+    init,        /* postconfiguration */
+    NULL,        /* create main configuration */
+    NULL,        /* init main configuration */
+    NULL,        /* create server configuration */
+    NULL,        /* merge server configuration */
+    create_conf, /* create location configuration */
+    merge_conf   /* merge location configuration */
 };
 
+ngx_module_t ngx_http_auth_jwt_module = {
+    NGX_MODULE_V1,
+    &auth_jwt_context,   /* module context */
+    auth_jwt_directives, /* module directives */
+    NGX_HTTP_MODULE,     /* module type */
+    NULL,                /* init master */
+    NULL,                /* init module */
+    NULL,                /* init process */
+    NULL,                /* init thread */
+    NULL,                /* exit thread */
+    NULL,                /* exit process */
+    NULL,                /* exit master */
+    NGX_MODULE_V1_PADDING};
+
+static ngx_int_t init(ngx_conf_t *cf)
+{
+  ngx_http_core_main_conf_t *cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
+  ngx_http_handler_pt *h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
+
+  if (h == NULL)
+  {
+    return NGX_ERROR;
+  }
+  else
+  {
+    *h = handle_request;
+
+    return NGX_OK;
+  }
+}
 
-static ngx_http_module_t ngx_http_auth_jwt_module_ctx = {
-	NULL,                        /* preconfiguration */
-	ngx_http_auth_jwt_init,      /* postconfiguration */
+static void *create_conf(ngx_conf_t *cf)
+{
+  auth_jwt_conf_t *conf = ngx_pcalloc(cf->pool, sizeof(auth_jwt_conf_t));
+
+  if (conf == NULL)
+  {
+    return NULL;
+  }
+  else
+  {
+    // ngx_str_t fields are initialized by the ngx_palloc call above -- only need to init flags and arrays here
+    conf->enabled = NGX_CONF_UNSET;
+    conf->redirect = NGX_CONF_UNSET;
+    conf->validate_sub = NGX_CONF_UNSET;
+    conf->redirect = NGX_CONF_UNSET;
+    conf->validate_sub = NGX_CONF_UNSET;
+    conf->extract_request_claims = NULL;
+    conf->extract_response_claims = NULL;
+    conf->use_keyfile = NGX_CONF_UNSET;
+
+    return conf;
+  }
+}
 
-	NULL,                        /* create main configuration */
-	NULL,                        /* init main configuration */
+static char *merge_conf(ngx_conf_t *cf, void *parent, void *child)
+{
+  const auth_jwt_conf_t *prev = parent;
+  auth_jwt_conf_t *conf = child;
+
+  ngx_conf_merge_str_value(conf->loginurl, prev->loginurl, "");
+  ngx_conf_merge_str_value(conf->key, prev->key, "");
+  ngx_conf_merge_str_value(conf->validation_type, prev->validation_type, "");
+  ngx_conf_merge_str_value(conf->algorithm, prev->algorithm, "HS256");
+  ngx_conf_merge_str_value(conf->keyfile_path, prev->keyfile_path, "");
+  ngx_conf_merge_off_value(conf->validate_sub, prev->validate_sub, 0);
+  ngx_conf_merge_ptr_value(conf->extract_request_claims, prev->extract_request_claims, NULL);
+  ngx_conf_merge_ptr_value(conf->extract_request_claims, prev->extract_response_claims, NULL);
+
+  if (conf->enabled == NGX_CONF_UNSET)
+  {
+    conf->enabled = prev->enabled == NGX_CONF_UNSET ? 0 : prev->enabled;
+  }
+
+  if (conf->redirect == NGX_CONF_UNSET)
+  {
+    conf->redirect = prev->redirect == NGX_CONF_UNSET ? 0 : prev->redirect;
+  }
+
+  if (conf->use_keyfile == NGX_CONF_UNSET)
+  {
+    conf->use_keyfile = prev->use_keyfile == NGX_CONF_UNSET ? 0 : prev->use_keyfile;
+  }
+
+  // If the usage of the keyfile is specified, check if the key_path is also configured
+  if (conf->use_keyfile == 1)
+  {
+    if (ngx_strcmp(conf->keyfile_path.data, "") != 0)
+    {
+      if (load_public_key(cf, conf) != NGX_OK)
+      {
+        return NGX_CONF_ERROR;
+      }
+    }
+    else
+    {
+      ngx_log_error(NGX_LOG_ERR, cf->log, 0, "keyfile_path not specified");
+
+      return NGX_CONF_ERROR;
+    }
+  }
+
+  return NGX_CONF_OK;
+}
 
-	NULL,                        /* create server configuration */
-	NULL,                        /* merge server configuration */
+static char *merge_extract_claims(ngx_conf_t *cf, ngx_array_t *claims)
+{
+  ngx_str_t *values = cf->args->elts;
 
-	ngx_http_auth_jwt_create_loc_conf,      /* create location configuration */
-	ngx_http_auth_jwt_merge_loc_conf       /* merge location configuration */
-};
+  // start at 1 because the first element is the directive (auth_jwt_extract_X_claims)
+  for (ngx_uint_t i = 1; i < cf->args->nelts; ++i)
+  {
+    ngx_str_t *element = ngx_array_push(claims);
 
+    *element = values[i];
+  }
 
-ngx_module_t ngx_http_auth_jwt_module = {
-	NGX_MODULE_V1,
-	&ngx_http_auth_jwt_module_ctx,     /* module context */
-	ngx_http_auth_jwt_commands,        /* module directives */
-	NGX_HTTP_MODULE,                   /* module type */
-	NULL,                              /* init master */
-	NULL,                              /* init module */
-	NULL,                              /* init process */
-	NULL,                              /* init thread */
-	NULL,                              /* exit thread */
-	NULL,                              /* exit process */
-	NULL,                              /* exit master */
-	NGX_MODULE_V1_PADDING
-};
+  return NGX_CONF_OK;
+}
+
+static char *merge_extract_request_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *c)
+{
+  auth_jwt_conf_t *conf = c;
+  ngx_array_t *claims = conf->extract_request_claims;
+
+  if (claims == NULL)
+  {
+    claims = ngx_array_create(cf->pool, 1, sizeof(ngx_str_t));
+    conf->extract_request_claims = claims;
+  }
+
+  return merge_extract_claims(cf, claims);
+}
 
+static char *merge_extract_response_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *c)
+{
+  auth_jwt_conf_t *conf = c;
+  ngx_array_t *claims = conf->extract_response_claims;
+
+  if (claims == NULL)
+  {
+    claims = ngx_array_create(cf->pool, 1, sizeof(ngx_str_t));
+    conf->extract_response_claims = claims;
+  }
+
+  return merge_extract_claims(cf, claims);
+}
+
+static ngx_int_t handle_request(ngx_http_request_t *r)
+{
+  auth_jwt_conf_t *jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
+
+  if (!jwtcf->enabled)
+  {
+    return NGX_DECLINED;
+  }
+  else
+  {
+    // pass through options requests without token authentication
+    if (r->method == NGX_HTTP_OPTIONS)
+    {
+      return NGX_DECLINED;
+    }
+    else
+    {
+      char *jwtPtr = get_jwt(r, jwtcf->validation_type);
+
+      if (jwtPtr == NULL)
+      {
+        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a JWT");
+        return redirect(r, jwtcf);
+      }
+      else
+      {
+        ngx_str_t algorithm = jwtcf->algorithm;
+        int keyLength;
+        u_char *key;
+        jwt_t *jwt = NULL;
+
+        if (algorithm.len == 0 || (algorithm.len == 5 && ngx_strncmp(algorithm.data, "HS", 2) == 0))
+        {
+          keyLength = jwtcf->key.len / 2;
+          key = ngx_palloc(r->pool, keyLength);
+
+          if (0 != hex_to_binary((char *)jwtcf->key.data, key, jwtcf->key.len))
+          {
+            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to turn hex key into binary");
+            return redirect(r, jwtcf);
+          }
+        }
+        else if (algorithm.len == 5 && ngx_strncmp(algorithm.data, "RS", 2) == 0)
+        {
+          if (jwtcf->use_keyfile == 1)
+          {
+            keyLength = jwtcf->_keyfile.len;
+            key = (u_char *)jwtcf->_keyfile.data;
+          }
+          else
+          {
+            keyLength = jwtcf->key.len;
+            key = jwtcf->key.data;
+          }
+        }
+        else
+        {
+          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "unsupported algorithm %s", algorithm);
+          return redirect(r, jwtcf);
+        }
+
+        if (jwt_decode(&jwt, jwtPtr, key, keyLength) != 0)
+        {
+          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse JWT");
+          return redirect(r, jwtcf);
+        }
+
+        if (validate_alg(jwtcf, jwt) != 0)
+        {
+          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm specified");
+          return free_jwt_and_redirect(r, jwtcf, jwt);
+        }
+        else if (validate_exp(jwtcf, jwt) != 0)
+        {
+          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT has expired");
+          return free_jwt_and_redirect(r, jwtcf, jwt);
+        }
+        else if (validate_sub(jwtcf, jwt) != 0)
+        {
+          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT does not contain a subject");
+          return free_jwt_and_redirect(r, jwtcf, jwt);
+        }
+        else
+        {
+          extract_request_claims(r, jwtcf, jwt);
+          extract_response_claims(r, jwtcf, jwt);
+          jwt_free(jwt);
+
+          return NGX_OK;
+        }
+      }
+    }
+  }
+}
 
-static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
+static int validate_alg(auth_jwt_conf_t *jwtcf, jwt_t *jwt)
 {
-	ngx_str_t useridHeaderName = ngx_string("x-userid");
-	ngx_str_t emailHeaderName = ngx_string("x-email");
-	char* jwtPtr;
-	char* return_url;
-	ngx_http_auth_jwt_loc_conf_t *jwtcf;
-	u_char *keyBinary;
-	// For clearing it later on
-	jwt_t *jwt = NULL;
-	int jwtParseReturnCode;
-	jwt_alg_t alg;
-	time_t exp;
-	time_t now;
-	ngx_str_t auth_jwt_algorithm;
-	int keylen;
-	
-	jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
-	
-	if (!jwtcf->auth_jwt_enabled) 
-	{
-		return NGX_DECLINED;
-	}
-
-	// pass through options requests without token authentication
-	if (r->method == NGX_HTTP_OPTIONS)
-	{
-		return NGX_DECLINED;
-	}
-	
-	jwtPtr = getJwt(r, jwtcf->auth_jwt_validation_type);
-
-	if (jwtPtr == NULL)
-	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a JWT");
-		goto redirect;
-	}
-	
-	// convert key from hex to binary, if a symmetric key
-
-	auth_jwt_algorithm = jwtcf->auth_jwt_algorithm;
-
-	if (auth_jwt_algorithm.len == 0 || (auth_jwt_algorithm.len == 5 && ngx_strncmp(auth_jwt_algorithm.data, "HS", 2) == 0))
-	{
-		keylen = jwtcf->auth_jwt_key.len / 2;
-		keyBinary = ngx_palloc(r->pool, keylen);
-		if (0 != hex_to_binary((char *)jwtcf->auth_jwt_key.data, keyBinary, jwtcf->auth_jwt_key.len))
-		{
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to turn hex key into binary");
-			goto redirect;
-		}
-	}
-	else if ( auth_jwt_algorithm.len == 5 && ngx_strncmp(auth_jwt_algorithm.data, "RS", 2) == 0 )
-	{
-		// in this case, 'Binary' is a misnomer, as it is the public key string itself
-		if (jwtcf->auth_jwt_use_keyfile == 1)
-		{
-			// Set to global variables
-			// NOTE: check for keyBin == NULL skipped, unnecessary check; nginx should fail to start
-			keyBinary = (u_char*)jwtcf->_auth_jwt_keyfile.data;
-			keylen = jwtcf->_auth_jwt_keyfile.len;
-		}
-		else
-		{
-			keyBinary = jwtcf->auth_jwt_key.data;
-			keylen = jwtcf->auth_jwt_key.len;
-		}
-	}
-	else
-	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "unsupported algorithm %s", auth_jwt_algorithm);
-		goto redirect;
-	}
-	
-	// validate the jwt
-	jwtParseReturnCode = jwt_decode(&jwt, jwtPtr, keyBinary, keylen);
-
-	if (jwtParseReturnCode != 0)
-	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse JWT, error code %d", jwtParseReturnCode);
-		goto redirect;
-	}
-	
-	// validate the algorithm
-	alg = jwt_get_alg(jwt);
-
-	if (alg != JWT_ALG_HS256 && alg != JWT_ALG_HS384 && alg != JWT_ALG_HS512 && alg != JWT_ALG_RS256 && alg != JWT_ALG_RS384 && alg != JWT_ALG_RS512)
-	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm in JWT (%d)", alg);
-		goto redirect;
-	}
-	
-	// validate the exp date of the JWT
-	exp = (time_t)jwt_get_grant_int(jwt, "exp");
-	now = time(NULL);
-
-	if (exp < now)
-	{
-		ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT has expired");
-		goto redirect;
-	}
-
-	// extract the userid
-	if (jwtcf->auth_jwt_extract_sub == 1)
-	{
-		const char* sub = jwt_get_grant(jwt, "sub");
-
-		if (sub == NULL)
-		{
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT does not contain a subject");
-		}
-		else
-		{
-			ngx_str_t sub_t = ngx_char_ptr_to_str_t(r->pool, (char *)sub);
-
-			set_custom_header_in_headers_out(r, &useridHeaderName, &sub_t);
-		}
-	}
-
-	if (jwtcf->auth_jwt_validate_email == 1)
-	{
-		const char* email = jwt_get_grant(jwt, "emailAddress");
-		
-		if (email == NULL)
-		{
-			ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT does not contain an email address");
-		}
-		else
-		{
-			ngx_str_t email_t = ngx_char_ptr_to_str_t(r->pool, (char *)email);
-
-			set_custom_header_in_headers_out(r, &emailHeaderName, &email_t);
-		}
-	}
-
-	jwt_free(jwt);
-	
-	return NGX_OK;
-	
-	redirect:
-		if (jwt)
-		{
-			jwt_free(jwt);
-		}
-
-		if (jwtcf->auth_jwt_redirect)
-		{
-			r->headers_out.location = ngx_list_push(&r->headers_out.headers);
-
-			if (r->headers_out.location == NULL)
-			{
-				ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
-			}
-
-			r->headers_out.location->hash = 1;
-			r->headers_out.location->key.len = sizeof("Location") - 1;
-			r->headers_out.location->key.data = (u_char *) "Location";
-
-			if (r->method == NGX_HTTP_GET)
-			{
-				int loginlen;
-				char * scheme;
-				ngx_str_t server;
-				ngx_str_t uri_variable_name = ngx_string("request_uri");
-				ngx_int_t uri_variable_hash;
-				ngx_http_variable_value_t * request_uri_var;
-				ngx_str_t uri;
-				ngx_str_t uri_escaped;
-				uintptr_t escaped_len;
-
-				loginlen = jwtcf->auth_jwt_loginurl.len;
-				scheme = (r->connection->ssl) ? "https" : "http";
-				server = r->headers_in.server;
-
-				// get the URI
-				uri_variable_hash = ngx_hash_key(uri_variable_name.data, uri_variable_name.len);
-				request_uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
-
-				// get the URI
-				if(request_uri_var && !request_uri_var->not_found && request_uri_var->valid)
-				{
-					// ideally we would like the uri with the querystring parameters
-					uri.data = ngx_palloc(r->pool, request_uri_var->len);
-					uri.len = request_uri_var->len;
-					ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
-				}
-				else
-				{
-					// fallback to the querystring without params
-					uri = r->uri;
-				}
-
-				// escape the URI
-				escaped_len = 2 * ngx_escape_uri(NULL, uri.data, uri.len, NGX_ESCAPE_ARGS) + uri.len;
-				uri_escaped.data = ngx_palloc(r->pool, escaped_len);
-				uri_escaped.len = escaped_len;
-				ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
-
-				r->headers_out.location->value.len = loginlen + sizeof("?return_url=") - 1 + strlen(scheme) + sizeof("://") - 1 + server.len + uri_escaped.len;
-				return_url = ngx_palloc(r->pool, r->headers_out.location->value.len);
-				ngx_memcpy(return_url, jwtcf->auth_jwt_loginurl.data, jwtcf->auth_jwt_loginurl.len);
-				int return_url_idx = jwtcf->auth_jwt_loginurl.len;
-				ngx_memcpy(return_url+return_url_idx, "?return_url=", sizeof("?return_url=") - 1);
-				return_url_idx += sizeof("?return_url=") - 1;
-				ngx_memcpy(return_url+return_url_idx, scheme, strlen(scheme));
-				return_url_idx += strlen(scheme);
-				ngx_memcpy(return_url+return_url_idx, "://", sizeof("://") - 1);
-				return_url_idx += sizeof("://") - 1;
-				ngx_memcpy(return_url+return_url_idx, server.data, server.len);
-				return_url_idx += server.len;
-				ngx_memcpy(return_url+return_url_idx, uri_escaped.data, uri_escaped.len);
-				return_url_idx += uri_escaped.len;
-				r->headers_out.location->value.data = (u_char *)return_url;
-			}
-			else
-			{
-				// for non-get requests, redirect to the login page without a return URL
-				r->headers_out.location->value.len = jwtcf->auth_jwt_loginurl.len;
-				r->headers_out.location->value.data = jwtcf->auth_jwt_loginurl.data;
-			}
-
-			return NGX_HTTP_MOVED_TEMPORARILY;
-		}
-
-		// When no redirect is needed, no "Location" header construction is needed, and we can respond with a 401
-		return NGX_HTTP_UNAUTHORIZED;
+  const jwt_alg_t alg = jwt_get_alg(jwt);
+
+  if (alg != JWT_ALG_HS256 && alg != JWT_ALG_HS384 && alg != JWT_ALG_HS512 && alg != JWT_ALG_RS256 && alg != JWT_ALG_RS384 && alg != JWT_ALG_RS512)
+  {
+    return 1;
+  }
+
+  return 0;
 }
 
+static int validate_exp(auth_jwt_conf_t *jwtcf, jwt_t *jwt)
+{
+  const time_t exp = (time_t)jwt_get_grant_int(jwt, "exp");
+  const time_t now = time(NULL);
+
+  if (exp < now)
+  {
+    return 1;
+  }
+
+  return 0;
+}
 
-static ngx_int_t ngx_http_auth_jwt_init(ngx_conf_t *cf)
+static int validate_sub(auth_jwt_conf_t *jwtcf, jwt_t *jwt)
 {
-	ngx_http_handler_pt        *h;
-	ngx_http_core_main_conf_t  *cmcf;
+  if (jwtcf->validate_sub == 1)
+  {
+    const char *sub = jwt_get_grant(jwt, "sub");
 
-	cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
+    if (sub == NULL)
+    {
+      return 1;
+    }
+  }
 
-	h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
-	if (h == NULL) 
-	{
-		return NGX_ERROR;
-	}
+  return 0;
+}
 
-	*h = ngx_http_auth_jwt_handler;
+static void extract_claims(ngx_http_request_t *r, jwt_t *jwt, ngx_array_t *claims, ngx_int_t (*set_header)(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value))
+{
+  if (claims != NULL && claims->nelts > 0)
+  {
+    const ngx_str_t *claimsPtr = claims->elts;
+
+    for (uint i = 0; i < claims->nelts; ++i)
+    {
+      const ngx_str_t claim = claimsPtr[i];
+      const char *value = jwt_get_grant(jwt, (char *)claim.data);
+
+      if (value != NULL && strlen(value) > 0)
+      {
+        ngx_uint_t claimHeaderLen = strlen(JWT_HEADER_PREFIX) + claim.len;
+        ngx_str_t claimHeader = ngx_null_string;
+        ngx_str_t claimValue = char_ptr_to_ngx_str_t(r->pool, value);
+
+        claimHeader.data = ngx_palloc(r->pool, claimHeaderLen);
+        claimHeader.len = claimHeaderLen;
+        ngx_snprintf(claimHeader.data, claimHeaderLen, "%s%V", JWT_HEADER_PREFIX, &claim);
+
+        set_header(r, &claimHeader, &claimValue);
+      }
+    }
+  }
+}
 
-	return NGX_OK;
+static void extract_request_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt)
+{
+  extract_claims(r, jwt, jwtcf->extract_request_claims, set_request_header);
 }
 
-static void *
-ngx_http_auth_jwt_create_loc_conf(ngx_conf_t *cf)
+static void extract_response_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt)
 {
-	ngx_http_auth_jwt_loc_conf_t *conf;
-
-	conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_auth_jwt_loc_conf_t));
-	if (conf == NULL) 
-	{
-		return NULL;
-	}
-	
-	// set the flag to unset
-	conf->auth_jwt_enabled = (ngx_flag_t) -1;
-	conf->auth_jwt_redirect = (ngx_flag_t) -1;
-	conf->auth_jwt_extract_sub = (ngx_flag_t) -1;
-	conf->auth_jwt_validate_email = (ngx_flag_t) -1;
-	conf->auth_jwt_use_keyfile = (ngx_flag_t) -1;
-
-	ngx_conf_log_error(NGX_LOG_DEBUG, cf, 0, "Created Location Configuration");
-	
-	return conf;
+  extract_claims(r, jwt, jwtcf->extract_response_claims, set_response_header);
 }
 
-// Loads the RSA256 public key into the location config struct
-static ngx_int_t
-loadAuthKey(ngx_conf_t *cf, ngx_http_auth_jwt_loc_conf_t* conf) {
-	FILE *keyFile = fopen((const char*)conf->auth_jwt_keyfile_path.data, "rb");
-	unsigned long keySize;
-	unsigned long keySizeRead;
-
-	// Check if file exists or is correctly opened
-	if (keyFile == NULL)
-	{
-		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "failed to open public key file");
-		return NGX_ERROR;
-	}
-
-	// Read file length
-	fseek(keyFile, 0, SEEK_END);
-	keySize = ftell(keyFile);
-	fseek(keyFile, 0, SEEK_SET);
-	
-	if (keySize == 0)
-	{
-		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "invalid public key file size of 0");
-		return NGX_ERROR;
-	}
-
-	conf->_auth_jwt_keyfile.data = ngx_palloc(cf->pool, keySize);
-	keySizeRead = fread(conf->_auth_jwt_keyfile.data, 1, keySize, keyFile);
-	fclose(keyFile);
-	
-	if (keySizeRead == keySize)
-	{
-		conf->_auth_jwt_keyfile.len = (int)keySize;
-
-		return NGX_OK;
-	}
-	else {
-		ngx_log_error(NGX_LOG_ERR, cf->log, 0, "public key size %i does not match expected size of %i", keySizeRead, keySize);
-
-		return NGX_ERROR;
-	}
+static ngx_int_t free_jwt_and_redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt)
+{
+  if (jwt)
+  {
+    jwt_free(jwt);
+  }
+
+  return redirect(r, jwtcf);
 }
 
-static char *
-ngx_http_auth_jwt_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
+static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf)
 {
-	ngx_http_auth_jwt_loc_conf_t *prev = parent;
-	ngx_http_auth_jwt_loc_conf_t *conf = child;
-
-	ngx_conf_merge_str_value(conf->auth_jwt_loginurl, prev->auth_jwt_loginurl, "");
-	ngx_conf_merge_str_value(conf->auth_jwt_key, prev->auth_jwt_key, "");
-	ngx_conf_merge_str_value(conf->auth_jwt_validation_type, prev->auth_jwt_validation_type, "");
-	ngx_conf_merge_str_value(conf->auth_jwt_algorithm, prev->auth_jwt_algorithm, "HS256");
-	ngx_conf_merge_str_value(conf->auth_jwt_keyfile_path, prev->auth_jwt_keyfile_path, "");
-	ngx_conf_merge_off_value(conf->auth_jwt_extract_sub, prev->auth_jwt_extract_sub, 1);
-	ngx_conf_merge_off_value(conf->auth_jwt_validate_email, prev->auth_jwt_validate_email, 1);
-	
-	if (conf->auth_jwt_enabled == ((ngx_flag_t) -1)) 
-	{
-		conf->auth_jwt_enabled = (prev->auth_jwt_enabled == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_enabled;
-	}
-
-	if (conf->auth_jwt_redirect == ((ngx_flag_t) -1))
-	{
-		conf->auth_jwt_redirect = (prev->auth_jwt_redirect == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_redirect;
-	}
-
-	if (conf->auth_jwt_use_keyfile == ((ngx_flag_t) -1))
-	{
-		conf->auth_jwt_use_keyfile = (prev->auth_jwt_use_keyfile == ((ngx_flag_t) -1)) ? 0 : prev->auth_jwt_use_keyfile;
-	}
-
-	// If the usage of the keyfile is specified, check if the key_path is also configured
-	if (conf->auth_jwt_use_keyfile == 1)
-	{
-		if (ngx_strcmp(conf->auth_jwt_keyfile_path.data, "") != 0)
-		{
-			if (loadAuthKey(cf, conf) != NGX_OK)
-				return NGX_CONF_ERROR;
-		}
-		else
-		{
-			ngx_log_error(NGX_LOG_ERR, cf->log, 0, "auth_jwt_keyfile_path not specified");
-			return NGX_CONF_ERROR;
-		}
-	}
-
-	return NGX_CONF_OK;
+  if (jwtcf->redirect)
+  {
+    r->headers_out.location = ngx_list_push(&r->headers_out.headers);
+
+    if (r->headers_out.location == NULL)
+    {
+      ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+    }
+
+    r->headers_out.location->hash = 1;
+    r->headers_out.location->key.len = sizeof("Location") - 1;
+    r->headers_out.location->key.data = (u_char *)"Location";
+
+    if (r->method == NGX_HTTP_GET)
+    {
+      const int loginlen = jwtcf->loginurl.len;
+      const char *scheme = (r->connection->ssl) ? "https" : "http";
+      const ngx_str_t server = r->headers_in.server;
+      ngx_str_t uri_variable_name = ngx_string("request_uri");
+      ngx_int_t uri_variable_hash = ngx_hash_key(uri_variable_name.data, uri_variable_name.len);
+      ngx_http_variable_value_t *request_uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
+      ngx_str_t uri;
+      ngx_str_t uri_escaped;
+      uintptr_t escaped_len;
+      char *return_url;
+      int return_url_idx;
+
+      // get the URI
+      if (request_uri_var && !request_uri_var->not_found && request_uri_var->valid)
+      {
+        // ideally we would like the URI with the querystring parameters
+        uri.data = ngx_palloc(r->pool, request_uri_var->len);
+        uri.len = request_uri_var->len;
+        ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
+      }
+      else
+      {
+        // fallback to the querystring without params
+        uri = r->uri;
+      }
+
+      // escape the URI
+      escaped_len = 2 * ngx_escape_uri(NULL, uri.data, uri.len, NGX_ESCAPE_ARGS) + uri.len;
+      uri_escaped.data = ngx_palloc(r->pool, escaped_len);
+      uri_escaped.len = escaped_len;
+      ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
+
+      r->headers_out.location->value.len = loginlen + sizeof("?return_url=") - 1 + strlen(scheme) + sizeof("://") - 1 + server.len + uri_escaped.len;
+
+      return_url = ngx_palloc(r->pool, r->headers_out.location->value.len);
+      ngx_memcpy(return_url, jwtcf->loginurl.data, jwtcf->loginurl.len);
+
+      return_url_idx = jwtcf->loginurl.len;
+      ngx_memcpy(return_url + return_url_idx, "?return_url=", sizeof("?return_url=") - 1);
+
+      return_url_idx += sizeof("?return_url=") - 1;
+      ngx_memcpy(return_url + return_url_idx, scheme, strlen(scheme));
+
+      return_url_idx += strlen(scheme);
+      ngx_memcpy(return_url + return_url_idx, "://", sizeof("://") - 1);
+
+      return_url_idx += sizeof("://") - 1;
+      ngx_memcpy(return_url + return_url_idx, server.data, server.len);
+
+      return_url_idx += server.len;
+      ngx_memcpy(return_url + return_url_idx, uri_escaped.data, uri_escaped.len);
+
+      r->headers_out.location->value.data = (u_char *)return_url;
+    }
+    else
+    {
+      // for non-get requests, redirect to the login page without a return URL
+      r->headers_out.location->value.len = jwtcf->loginurl.len;
+      r->headers_out.location->value.data = jwtcf->loginurl.data;
+    }
+
+    return NGX_HTTP_MOVED_TEMPORARILY;
+  }
+
+  // When no redirect is needed, no "Location" header construction is needed, and we can respond with a 401
+  return NGX_HTTP_UNAUTHORIZED;
 }
 
-static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
+// Loads the public key into the location config struct
+static ngx_int_t load_public_key(ngx_conf_t *cf, auth_jwt_conf_t *conf)
 {
-	static const ngx_str_t authorizationHeaderName = ngx_string("Authorization");
-	ngx_table_elt_t *authorizationHeader;
-	char* jwtPtr = NULL;
-	ngx_str_t jwtCookieVal;
-	ngx_int_t n;
-	ngx_int_t bearer_length;
-	ngx_str_t authorizationHeaderStr;
-
-	ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "auth_jwt_validation_type.len %d", auth_jwt_validation_type.len);
-
-	if (auth_jwt_validation_type.len == 0 || (auth_jwt_validation_type.len == sizeof("AUTHORIZATION") - 1 && ngx_strncmp(auth_jwt_validation_type.data, "AUTHORIZATION", sizeof("AUTHORIZATION") - 1)==0))
-	{
-		// using authorization header
-		authorizationHeader = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
-		if (authorizationHeader != NULL)
-		{
-			ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Found authorization header len %d", authorizationHeader->value.len);
-
-			bearer_length = authorizationHeader->value.len - (sizeof("Bearer ") - 1);
-
-			if (bearer_length > 0) 
-			{
-				authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
-				authorizationHeaderStr.len = bearer_length;
-
-				jwtPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
-
-				ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtPtr);
-			}
-		}
-	}
-	else if (auth_jwt_validation_type.len > sizeof("COOKIE=") && ngx_strncmp(auth_jwt_validation_type.data, "COOKIE=", sizeof("COOKIE=") - 1)==0)
-	{
-		auth_jwt_validation_type.data += sizeof("COOKIE=") - 1;
-		auth_jwt_validation_type.len -= sizeof("COOKIE=") - 1;
-
-		// get the cookie
-		// TODO: the cookie name could be passed in dynamicallly
-		n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &auth_jwt_validation_type, &jwtCookieVal);
-		if (n != NGX_DECLINED) 
-		{
-			jwtPtr = ngx_str_t_to_char_ptr(r->pool, jwtCookieVal);
-		}
-	}
-
-	return jwtPtr;
+  FILE *keyFile = fopen((const char *)conf->keyfile_path.data, "rb");
+
+  // Check if file exists or is correctly opened
+  if (keyFile == NULL)
+  {
+    ngx_log_error(NGX_LOG_ERR, cf->log, 0, "failed to open public key file");
+    return NGX_ERROR;
+  }
+  else
+  {
+    u_long keySize;
+    u_long keySizeRead;
+
+    // Read file length
+    fseek(keyFile, 0, SEEK_END);
+    keySize = ftell(keyFile);
+    fseek(keyFile, 0, SEEK_SET);
+
+    if (keySize == 0)
+    {
+      ngx_log_error(NGX_LOG_ERR, cf->log, 0, "invalid public key file size of 0");
+      return NGX_ERROR;
+    }
+    else
+    {
+      conf->_keyfile.data = ngx_palloc(cf->pool, keySize);
+      keySizeRead = fread(conf->_keyfile.data, 1, keySize, keyFile);
+      fclose(keyFile);
+
+      if (keySizeRead == keySize)
+      {
+        conf->_keyfile.len = (int)keySize;
+
+        return NGX_OK;
+      }
+      else
+      {
+        ngx_log_error(NGX_LOG_ERR, cf->log, 0, "public key size %i does not match expected size of %i", keySizeRead, keySize);
+        return NGX_ERROR;
+      }
+    }
+  }
 }
 
+static char *get_jwt(ngx_http_request_t *r, ngx_str_t validation_type)
+{
+  char *jwtPtr = NULL;
+
+  ngx_log_debug(NGX_LOG_DEBUG, r->connection->log, 0, "validation_type.len %d", validation_type.len);
+
+  if (validation_type.len == 0 || (validation_type.len == sizeof("AUTHORIZATION") - 1 && ngx_strncmp(validation_type.data, "AUTHORIZATION", sizeof("AUTHORIZATION") - 1) == 0))
+  {
+    static const ngx_str_t authorizationHeaderName = ngx_string("Authorization");
+    const ngx_table_elt_t *authorizationHeader = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
+
+    if (authorizationHeader != NULL)
+    {
+      ngx_int_t bearer_length = authorizationHeader->value.len - (sizeof("Bearer ") - 1);
+
+      ngx_log_debug(NGX_LOG_DEBUG, r->connection->log, 0, "Found authorization header len %d", authorizationHeader->value.len);
 
+      if (bearer_length > 0)
+      {
+        ngx_str_t authorizationHeaderStr;
 
+        authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
+        authorizationHeaderStr.len = bearer_length;
 
+        jwtPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
+
+        ngx_log_debug(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtPtr);
+      }
+    }
+  }
+  else if (validation_type.len > sizeof("COOKIE=") && ngx_strncmp(validation_type.data, "COOKIE=", sizeof("COOKIE=") - 1) == 0)
+  {
+    ngx_int_t n;
+    ngx_str_t jwtCookieVal;
+
+    validation_type.data += sizeof("COOKIE=") - 1;
+    validation_type.len -= sizeof("COOKIE=") - 1;
+
+    n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &validation_type, &jwtCookieVal);
+
+    if (n != NGX_DECLINED)
+    {
+      jwtPtr = ngx_str_t_to_char_ptr(r->pool, jwtCookieVal);
+    }
+  }
+
+  return jwtPtr;
+}
diff --git a/src/ngx_http_auth_jwt_string.c b/src/ngx_http_auth_jwt_string.c
index 186121f..f472171 100644
--- a/src/ngx_http_auth_jwt_string.c
+++ b/src/ngx_http_auth_jwt_string.c
@@ -15,18 +15,22 @@ char* ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str)
 {
 	char* char_ptr = ngx_palloc(pool, str.len + 1);
 	ngx_memcpy(char_ptr, str.data, str.len);
+
 	*(char_ptr + str.len) = '\0';
+
 	return char_ptr;
 }
 
 /** copies a character pointer string to an nginx string structure */
-ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr)
+ngx_str_t char_ptr_to_ngx_str_t(ngx_pool_t *pool, const char* char_ptr)
 {
-	int len = strlen(char_ptr);
-
+	const int len = strlen(char_ptr);
 	ngx_str_t str_t;
+
+	str_t.len = len;
 	str_t.data = ngx_palloc(pool, len);
+
 	ngx_memcpy(str_t.data, char_ptr, len);
-	str_t.len = len;
+
 	return str_t;
 }
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_string.h b/src/ngx_http_auth_jwt_string.h
index 594785b..4440d8b 100644
--- a/src/ngx_http_auth_jwt_string.h
+++ b/src/ngx_http_auth_jwt_string.h
@@ -13,6 +13,6 @@
 #include <ngx_core.h>
 
 char* ngx_str_t_to_char_ptr(ngx_pool_t *pool, ngx_str_t str);
-ngx_str_t ngx_char_ptr_to_str_t(ngx_pool_t *pool, char* char_ptr);
+ngx_str_t char_ptr_to_ngx_str_t(ngx_pool_t *pool, const char* char_ptr);
 
 #endif /* _NGX_HTTP_AUTH_JWT_STRING_H */
\ No newline at end of file
diff --git a/test/Dockerfile-test-nginx b/test/Dockerfile-test-nginx
index c1e4550..5497d07 100644
--- a/test/Dockerfile-test-nginx
+++ b/test/Dockerfile-test-nginx
@@ -1,5 +1,9 @@
 ARG BASE_IMAGE
+ARG CONFIG_HASH
 
 FROM ${BASE_IMAGE} as NGINX
-COPY test.conf /etc/nginx/conf.d/test.conf
-COPY rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
\ No newline at end of file
+ARG CONFIG_HASH
+RUN echo "Config Hash: ${CONFIG_HASH}"
+COPY /docker-entrypoint.d/* /docker-entrypoint.d/
+COPY /etc/nginx/conf.d/test.conf /etc/nginx/conf.d/test.conf
+COPY /etc/nginx/rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
diff --git a/test/Dockerfile-test-runner b/test/Dockerfile-test-runner
index bd9fc59..0992d75 100644
--- a/test/Dockerfile-test-runner
+++ b/test/Dockerfile-test-runner
@@ -1,4 +1,10 @@
-FROM alpine:3.7
-COPY test.sh .
+ARG SOURCE_HASH
+
+FROM alpine:3.7 AS test-base
 RUN apk add curl bash
+
+FROM test-base AS test
+ARG SOURCE_HASH
+RUN echo "Source Hash: ${SOURCE_HASH}"
+COPY test.sh .
 CMD ["./test.sh"]
diff --git a/test/docker-compose-test.yml b/test/docker-compose-test.yml
index 2607e42..eff2460 100644
--- a/test/docker-compose-test.yml
+++ b/test/docker-compose-test.yml
@@ -9,6 +9,7 @@ services:
       dockerfile: Dockerfile-test-nginx
       args:
         BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION:-latest}
+    command: [nginx-debug, '-g', 'daemon off;']
     logging:
       driver: ${LOG_DRIVER:-journald}
 
diff --git a/test/docker-entrypoint.d/10-nginx-test.sh b/test/docker-entrypoint.d/10-nginx-test.sh
new file mode 100755
index 0000000..0bf8791
--- /dev/null
+++ b/test/docker-entrypoint.d/10-nginx-test.sh
@@ -0,0 +1 @@
+nginx -t
\ No newline at end of file
diff --git a/test/test.conf b/test/etc/nginx/conf.d/test.conf
similarity index 59%
rename from test/test.conf
rename to test/etc/nginx/conf.d/test.conf
index 52c2829..fcc3900 100644
--- a/test/test.conf
+++ b/test/etc/nginx/conf.d/test.conf
@@ -1,3 +1,6 @@
+error_log /var/log/nginx/debug.log debug;
+access_log /var/log/nginx/access.log;
+
 server {
     listen 8000;
     server_name localhost;
@@ -19,6 +22,16 @@ server {
         alias /usr/share/nginx/html/;
         try_files index.html =404;
     }
+
+    location /secure/cookie/default/validate-sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validate_sub on;
+        auth_jwt_validation_type COOKIE=jwt;
+        
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
         
     location /secure/cookie/default/no-redirect {
         auth_jwt_enabled on;
@@ -130,5 +143,79 @@ BwIDAQAB
         alias /usr/share/nginx/html/;
         try_files index.html =404;
     }
+
+    location /secure/extract-claim/request/sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_extract_request_claims sub;
+
+        add_header "Test" "sub=$http_jwt_sub";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/request/name-1 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_extract_request_claims firstName lastName;
+
+        add_header "Test" "$http_jwt_firstname $http_jwt_lastname";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/request/name-2 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_extract_request_claims firstName;
+        auth_jwt_extract_request_claims lastName;
+
+        add_header "Test" "$http_jwt_firstname $http_jwt_lastname";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/response/sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_extract_response_claims sub;
+
+        add_header "Test" "sub=$sent_http_jwt_sub";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/response/name-1 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_extract_response_claims firstName lastName;
+
+        add_header "Test" "$sent_http_jwt_firstname $sent_http_jwt_lastname";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/response/name-2 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_extract_response_claims firstName;
+        auth_jwt_extract_response_claims lastName;
+
+        add_header "Test" "$sent_http_jwt_firstname $sent_http_jwt_lastname";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
 }
 
diff --git a/test/rsa_key_2048-pub.pem b/test/etc/nginx/rsa_key_2048-pub.pem
similarity index 100%
rename from test/rsa_key_2048-pub.pem
rename to test/etc/nginx/rsa_key_2048-pub.pem
diff --git a/test/test.sh b/test/test.sh
index b6ec12c..6ab567b 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -1,24 +1,91 @@
 #!/bin/bash
 
-RED='\033[01;31m'
-GREEN='\033[01;32m'
-NONE='\033[00m'
+# set a test # here to execute only that test and output additional info
+DEBUG=
 
-run_test () {
-  local name=$1
-  local path=$2
-  local expect=$3
-  local extra=$4
+RED='\e[31m'
+GREEN='\e[32m'
+GRAY='\e[90m'
+NC='\e[00m'
 
-  cmd="curl -X GET -o /dev/null --silent --head --write-out '%{http_code}' http://nginx:8000${path} -H 'cache-control: no-cache' $extra"
-  result=$(eval ${cmd})
+NUM_TESTS=0;
+NUM_SKIPPED=0;
+NUM_FAILED=0;
 
-  if [ "${result}" -eq "${expect}" ]; then
-    echo -e "${GREEN}${name}: passed (Received: ${result}; Path: ${path})${NONE}";
-    return 0
+run_test () {
+  NUM_TESTS=$((${NUM_TESTS} + 1));
+
+  if [ "${DEBUG}" == '' ] || [ ${DEBUG} == ${NUM_TESTS} ]; then
+    local OPTIND;
+    local name=''
+    local path=''
+    local expectedCode=''
+    local expectedResponseRegex=''
+    local extraCurlOpts=''
+    local curlCommand=''
+    local exitCode=''
+    local response=''
+    local testNum="${GRAY}${NUM_TESTS}${NC}\t"
+
+    while getopts "n:p:r:c:x:" option; do
+      case $option in
+      n)
+        name=$OPTARG;;
+      p)
+        path=$OPTARG;;
+      c)
+        expectedCode=$OPTARG;;
+      r)
+        expectedResponseRegex=$OPTARG;;
+      x)
+        extraCurlOpts=$OPTARG;;
+      \?) # Invalid option
+        printf "Error: Invalid option\n";
+        exit;;
+      esac
+    done
+
+    curlCommand="curl -s -v http://nginx:8000${path} -H 'Cache-Control: no-cache' ${extraCurlOpts} 2>&1"
+    response=$(eval "${curlCommand}")
+    exitCode=$?
+    
+    printf "\n${testNum}"
+
+    if [ "${exitCode}" -ne "0" ]; then
+      printf "${RED}${name} -- unexpected exit code from cURL\n\tcURL Exit Code: ${exitCode}";
+      NUM_FAILED=$((${NUM_FAILED} + 1));
+    else
+      OKAY=1
+
+      if [ "${expectedCode}" != "" ]; then
+        local responseCode=$(echo "${response}" | grep -Eo 'HTTP/1.1 ([0-9]{3})' | awk '{print $2}')
+
+        if [ "${expectedCode}" != "${responseCode}" ]; then
+          printf "${RED}${name} -- unexpected status code\n\tExpected: ${expectedCode}\n\tActual: ${responseCode}\n\tPath: ${path}"
+          NUM_FAILED=$((${NUM_FAILED} + 1))
+          OKAY=0
+        fi
+      fi
+
+      if [ "${OKAY}" == "1" ] && [ "${expectedResponseRegex}" != "" ] && echo "${response}" | grep -Eq "${expectedResponseRegex}"; then
+        printf "${RED}${name} -- regex not found in response\n\tPath: ${path}\n\tRegEx: ${expectedResponseRegex}"
+        NUM_FAILED=$((${NUM_FAILED} + 1))
+        OKAY=0
+      fi
+      
+      if [ "${OKAY}" == "1" ]; then
+        printf "${GREEN}${name}";
+      fi
+    fi
+
+    if [ "${DEBUG}" == "${NUM_TESTS}" ]; then
+      printf '\n\tcURL Command: %s' "${curlCommand:---}"
+      printf '\n\tResponse: %s' "${response:---}"
+    fi
+
+    printf "${NC}\n"
   else
-    echo -e "${RED}${name}: failed (Expected: ${expect}; Received: ${result}; Path: ${path})${NONE}";
-    return 1
+    NUM_SKIPPED=$((${NUM_SKIPPED} + 1))
   fi
 }
 
@@ -32,108 +99,129 @@ main() {
   local JWT_RS256_INVALID=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
   local JWT_RS384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.H35bTcZRhepWIoa8pKCbUMRuAOkVX9K5hJjc6tPmQwWmTw8lrktsvmMzJg_rgqnJLnAkciSIQw5EDj7fngS5zX2ThyRxrkPuE2Uiyw2Ect-mo9Kg1lrWgnyZCuCgq-Up9HQRAv0160mePlm8Gs4TOY6CPr38zwTcDZsy_Keq93igDQV8WuuWAGICaGd5ZyUOPjjzGShRjTU8Szz7fnpZpTtYRCYVo0pc5yfRWYm0fdn-4AseyGvd8JJ2xfnAEe4kZOkz7X1MLKtL0slKg3m2PH1lD7HwxIawXRTPWxArhJ9dcTNiDUrqtde2juGwOuMD_zTsb2Jj0_rmRb0Q6aljNw
   local JWT_RS512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.iUupyKypfXJ5aZWfItSW-mOmx9a4C4X7Yr5p5Fk8W75ZhkOq0EeNfstTxx870brhkdPovBhO2LYI44_HoH9XicQNL6JnFprE0r61eJFngbuzlhRQiWpq0xYrazJWc9zB7_GgL2ZCwtw-Ts3G23Q0632wVm6-d7MKvG7RS8aEjN-MuVGdtLglH3forpItmFxw-if40EQsBL7hncN_XNcQTO4KPHkqmlpac_oKXRrLFDIIt2tB6OOpvY4QcpERoxexp4pi2f-JoINnWX_dU5JnIs3ypVJLQPfoJvxg8fsg3zYrOvMYnfsqOCYoHtZGK0O7jyfFmcGo5v2hLT-CpoF3Zw
-  local num_tests=0
-  local num_failed=0
-
-  run_test 'when auth disabled, should return 200' \
-           '/' \
-           '200'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with default algorithm and no JWT in Authorization header, returns 302' \
-           '/secure/auth-header/default' \
-           '302'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with default algorithm with no redirect and Authroization header missing Bearer, should return 401' \
-           '/secure/auth-header/default/no-redirect' \
-           '401' \
-           '--header "Authorization: X"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with default algorithm and no JWT cookie, returns 302' \
-           '/secure/cookie/default' \
-           '302'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with default algorithm with no redirect and no JWT cookie, should return 401' \
-           '/secure/cookie/default/no-redirect' \
-           '401'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with default algorithm and valid JWT cookie, returns 200' \
-           '/secure/cookie/default' \
-           '200' \
-           '--cookie "jwt=${JWT_HS256_VALID}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with default algorithm and valid JWT cookie with no sub, returns 200' \
-           '/secure/cookie/default' \
-           '200' \
-           ' --cookie "jwt=${JWT_HS256_MISSING_SUB}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with default algorithm and valid JWT cookie with no email, returns 200' \
-           '/secure/cookie/default' \
-           '200' \
-           ' --cookie "jwt=${JWT_HS256_MISSING_EMAIL}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with HS256 algorithm and valid JWT cookie, returns 200' \
-           '/secure/cookie/hs256/' \
-           '200' \
-           '--cookie "jwt=${JWT_HS256_VALID}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with HS384 algorithm and valid JWT cookie, returns 200' \
-           '/secure/cookie/hs384' \
-           '200' \
-           '--cookie "jwt=${JWT_HS384_VALID}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with HS512 algorithm and valid JWT cookie, returns 200' \
-           '/secure/cookie/hs512' \
-           '200' \
-           '--cookie "jwt=${JWT_HS512_VALID}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with RS256 algorithm and valid JWT cookie, returns 200' \
-           '/secure/cookie/rs256' \
-           '200' \
-           ' --cookie "jwt=${JWT_RS256_VALID}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with RS256 algorithm via file and valid JWT in Authorization header, returns 200' \
-           '/secure/auth-header/rs256/file' \
-           '200' \
-           '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with RS256 algorithm via file and invalid JWT in Authorization header, returns 401' \
-           '/secure/auth-header/rs256/file' \
-           '302' \
-           '--header "Authorization: Bearer ${JWT_RS256_INVALID}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with RS384 algorithm via file and valid JWT in Authorization header, returns 200' \
-           '/secure/auth-header/rs384/file' \
-           '200' \
-           '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  run_test 'when auth enabled with RS512 algorithm via file and valid JWT in Authorization header, returns 200' \
-           '/secure/auth-header/rs512/file' \
-           '200' \
-           '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
-  num_failed=$((${num_failed} + $?)); num_tests=$((${num_tests} + 1));
-
-  if [[ "${num_failed}" = '0' ]]; then
-    printf "\nRan ${num_tests} tests successfully.\n"
+
+  run_test -n 'when auth disabled, should return 200' \
+           -p '/' \
+           -c '200'
+  
+  run_test -n 'when auth enabled with default algorithm and no JWT in Authorization header, returns 302' \
+           -p '/secure/auth-header/default' \
+           -c '302'
+
+  run_test -n 'when auth enabled with default algorithm with no redirect and Authorization header missing Bearer, should return 401' \
+           -p '/secure/auth-header/default/no-redirect' \
+           -c '401' \
+           -x '--header "Authorization: X"'
+
+  run_test -n 'when auth enabled with default algorithm and no JWT cookie, returns 302' \
+           -p '/secure/cookie/default' \
+           -c '302'
+
+  run_test -n 'when auth enabled with default algorithm with no redirect and no JWT cookie, should return 401' \
+           -p '/secure/cookie/default/no-redirect' \
+           -c '401'
+
+  run_test -n 'when auth enabled with default algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/default' \
+           -c '200' \
+           -x "--cookie jwt=${JWT_HS256_VALID}"
+
+  run_test -n 'when auth enabled with default algorithm and valid JWT cookie with no sub, returns 200' \
+           -p '/secure/cookie/default' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_HS256_MISSING_SUB}"'
+
+  run_test -n 'when auth enabled with default algorithm and valid JWT cookie with no sub when sub validated, returns 302' \
+           -p '/secure/cookie/default/validate-sub' \
+           -c '302' \
+           -x ' --cookie "jwt=${JWT_HS256_MISSING_SUB}"'
+
+  run_test -n 'when auth enabled with default algorithm and valid JWT cookie with no email, returns 200' \
+           -p '/secure/cookie/default' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_HS256_MISSING_EMAIL}"'
+
+  run_test -n 'when auth enabled with HS256 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/hs256/' \
+           -c '200' \
+           -x '--cookie "jwt=${JWT_HS256_VALID}"'
+
+  run_test -n 'when auth enabled with HS384 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/hs384' \
+           -c '200' \
+           -x '--cookie "jwt=${JWT_HS384_VALID}"'
+
+  run_test -n 'when auth enabled with HS512 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/hs512' \
+           -c '200' \
+           -x '--cookie "jwt=${JWT_HS512_VALID}"'
+
+  run_test -n 'when auth enabled with RS256 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/rs256' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_RS256_VALID}"'
+
+  run_test -n 'when auth enabled with RS256 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/rs256/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
+
+  run_test -n 'when auth enabled with RS256 algorithm via file and invalid JWT in Authorization header, returns 401' \
+           -p '/secure/auth-header/rs256/file' \
+           -c '302' \
+           -x '--header "Authorization: Bearer ${JWT_RS256_INVALID}"'
+
+  run_test -n 'when auth enabled with RS384 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/rs384/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
+
+  run_test -n 'when auth enabled with RS512 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/rs512/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
+
+  run_test -n 'extracts single claim to request header' \
+           -p '/secure/extract-claim/request/sub' \
+           -r '^Test: sub=some-long-uuid$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (single directive) to request header' \
+           -p '/secure/extract-claim/request/name-1' \
+           -r '^Test: hello world$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (multiple directives) to request header' \
+           -p '/secure/extract-claim/request/name-2' \
+           -r '^Test: hello world$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts single claim to response header' \
+           -p '/secure/extract-claim/response/sub' \
+           -r '^Test: sub=some-long-uuid$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (single directive) to response header' \
+           -p '/secure/extract-claim/response/name-1' \
+           -r '^Test: hello world$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (multiple directives) to response header' \
+           -p '/secure/extract-claim/response/name-2' \
+           -r '^Test: hello world$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  if [[ "${NUM_FAILED}" = '0' ]]; then
+    printf "\nRan ${NUM_TESTS} tests successfully (skipped ${NUM_SKIPPED}).\n"
     return 0
   else
-    printf "\nRan ${num_tests} tests: ${GREEN}$((${num_tests} - ${num_failed})) passed${NONE}; ${RED}${num_failed} failed${NONE}\n"
+    printf "\nRan ${NUM_TESTS} tests: ${GREEN}$((${NUM_TESTS} - ${NUM_FAILED})) passed${NC}; ${RED}${NUM_FAILED} failed${NC}; ${NUM_SKIPPED} skipped\n"
     return 1
   fi
 }
 
-main '$@'
+if [ "${DEBUG}" != '' ]; then
+ printf "\n${RED}Some tests will be skipped since DEBUG is set.${NC}\n"
+fi
+
+main

From ac147ef0e7873b2becb2e68cf65b89c3c2848bcf Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Mon, 24 Apr 2023 08:05:03 -0400
Subject: [PATCH 079/130] update Dockerfile; update scripts.sh (#88)

---
 Dockerfile | 40 +++++++++++++++++++++++-----------------
 scripts.sh | 34 +++++++++++++++++++++++-----------
 2 files changed, 46 insertions(+), 28 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 328ea1e..94d829e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,38 +4,44 @@ ARG SOURCE_HASH
 
 FROM debian:bullseye-slim as ngx_http_auth_jwt_builder_base
 LABEL stage=ngx_http_auth_jwt_builder
-RUN apt-get update &&\
-	apt-get install -y curl build-essential
-
-
+RUN <<`
+apt-get update
+apt-get install -y curl build-essential
+`
 FROM ngx_http_auth_jwt_builder_base as ngx_http_auth_jwt_builder_module
 LABEL stage=ngx_http_auth_jwt_builder
 ENV LD_LIBRARY_PATH=/usr/local/lib
 ARG NGINX_VERSION
-RUN set -x &&\
-	apt-get install -y libjwt-dev libjwt0 libjansson-dev libjansson4 libpcre2-dev zlib1g-dev libpcre3-dev &&\
-	mkdir -p /root/build/ngx-http-auth-jwt-module
+RUN <<`
+apt-get install -y libjwt-dev libjwt0 libjansson-dev libjansson4 libpcre2-dev zlib1g-dev libpcre3-dev
+mkdir -p /root/build/ngx-http-auth-jwt-module
+`
 WORKDIR /root/build/ngx-http-auth-jwt-module
 ARG SOURCE_HASH
 RUN echo "Source Hash: ${SOURCE_HASH}"
 ADD config ./
 ADD src/*.h src/*.c ./src/
 WORKDIR /root/build
-RUN set -x &&\
-  mkdir nginx &&\
-	curl -O http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz &&\
-	tar -xzf nginx-${NGINX_VERSION}.tar.gz --strip-components 1 -C nginx
+RUN <<`
+mkdir nginx
+curl -O http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
+tar -xzf nginx-${NGINX_VERSION}.tar.gz --strip-components 1 -C nginx
+`
 WORKDIR /root/build/nginx
-RUN ./configure --with-debug --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module &&\
-	make modules
+RUN <<`
+./configure --with-debug --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module
+make modules
+`
 
 
 FROM nginx:${NGINX_VERSION} AS ngx_http_auth_jwt_builder_nginx
 LABEL stage=
 RUN rm /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh /etc/nginx/conf.d/default.conf
-RUN apt-get update &&\
-	apt-get -y install libjansson4 libjwt0 &&\
-	cd /etc/nginx &&\
-	sed -ri '/pid\s+\/var\/run\/nginx\.pid;$/a load_module \/usr\/lib64\/nginx\/modules\/ngx_http_auth_jwt_module\.so;' nginx.conf
+RUN <<`
+apt-get update
+apt-get -y install libjansson4 libjwt0
+cd /etc/nginx
+sed -ri '/pid\s+\/var\/run\/nginx\.pid;$/a load_module \/usr\/lib64\/nginx\/modules\/ngx_http_auth_jwt_module\.so;' nginx.conf
+`
 LABEL maintainer="TeslaGov" email="developers@teslagov.com"
 COPY --from=ngx_http_auth_jwt_builder_module /root/build/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/
diff --git a/scripts.sh b/scripts.sh
index 873d170..e5a2380 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -28,42 +28,54 @@ build_module() {
 	printf "${BLUE}Building module...${NC}\n"
 	docker image build -t ${FULL_IMAGE_NAME}:latest -t ${FULL_IMAGE_NAME}:${NGINX_VERSION} ${dockerArgs} \
 		--build-arg NGINX_VERSION=${NGINX_VERSION} \
-		--build-arg SOURCE_HASH=${sourceHash} \.
+		--build-arg SOURCE_HASH=${sourceHash} .
 	
 	if [ "$?" -ne 0 ]; then
 		printf "${RED}✘ Build failed ${NC}\n"
 	else
 		printf "${GREEN}✔ Successfully built NGINX module ${NC}\n"
 	fi
-
-	docker rmi -f $(docker images --filter=label=stage=ngx_http_auth_jwt_builder --quiet) 2> /dev/null || true
 }
 
 rebuild_module() {
+	clean_module
 	build_module --no-cache
 }
 
+clean_module() {
+	docker rmi -f $(docker images --filter=label=stage=ngx_http_auth_jwt_builder --quiet) 2> /dev/null || true
+}
+
 start_nginx() {
-	printf "${BLUE}Starting NGINX...${NC}\n"
-	docker run --rm --name "${IMAGE_NAME}" -d -p 8000:80 ${FULL_IMAGE_NAME}
+	printf "${BLUE}Starting NGINX container (${IMAGE_NAME})...${NC}\n"
+	docker run --rm --name "${IMAGE_NAME}" -d -p 8000:80 ${FULL_IMAGE_NAME} >/dev/null
 }
 
 stop_nginx() {
-	docker stop "${IMAGE_NAME}"
+	docker stop "${IMAGE_NAME}" >/dev/null
 }
 
 cp_bin() {
-	if [ "$(docker container inspect -f '{{.State.Running}}' ${IMAGE_NAME})" != "true" ]; then
+	local destDir=bin
+	local stopContainer=0;
+
+	if [ "$(docker container inspect -f '{{.State.Running}}' ${IMAGE_NAME} | true)" != "true" ]; then
 		start_nginx
+		stopContainer=1
 	fi
 
-	printf "${BLUE}Copying binaries...${NC}\n"
-	rm -rf bin
-	mkdir bin
+	printf "${BLUE}Copying binaries to: ${destDir}${NC}\n"
+	rm -rf ${destDir}/*
+	mkdir -p ${destDir}
 	docker exec "${IMAGE_NAME}" sh -c "cd /; tar -chf - \
 		usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so \
 		usr/lib/x86_64-linux-gnu/libjansson.so.* \
-		usr/lib/x86_64-linux-gnu/libjwt.*" | tar -xf - -C bin &>/dev/null
+		usr/lib/x86_64-linux-gnu/libjwt.*" | tar -xf - -C ${destDir} &>/dev/null
+	
+	if [ $stopContainer ]; then
+		printf "${BLUE}Stopping NGINX container (${IMAGE_NAME})...${NC}\n"
+		stop_nginx
+	fi
 }
 
 build_test_runner() {

From bb9534e013e7811f320e3b3bbfce7864710f8bfb Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 24 Apr 2023 08:35:08 -0400
Subject: [PATCH 080/130] update README

---
 README.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 3c7d0a7..f8cae3a 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,10 @@
 
 This is an NGINX module to check for a valid JWT and proxy to an upstream server or redirect to a login page. It supports additional features such as extracting claims from the JWT and placing them on the request/response headers.
 
+## Breaking Changes with v2
+
+The `v2` branch, which has now been merged to `master` includes breaking changes. Please see the initial v2 release for details,
+
 ## Dependencies
 
 This module depends on the [JWT C Library](https://github.com/benmcollins/libjwt). Transitively, that library depends on a JSON Parser called [Jansson](https://github.com/akheron/jansson) as well as the OpenSSL library.
@@ -160,19 +164,19 @@ Note the `includePath` additions above -- please update them as appropriate. Nex
 3. Update the `includePath` entires shown above to match the location you chose.
 4. Enter the directory where you extracted NGINX and run: `./configure --with-compat`
 
-#### Cloning libjwt
+#### Cloning `libjwt`
 
 1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:benmcollins/libjwt.git <target_dir>
 2. Enter the directory and switch to the latest tag: `git checkout $(git tag | sort -Vr | head -n 1)`
 3. Update the `includePath` entires shown above to match the location you chose.
 
-#### Cloning libjansson
+#### Cloning `libjansson`
 
 1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:akheron/jansson.git <target_dir>
 2. Enter the directory and switch to the latest tag: `git checkout $(git tag | sort -Vr | head -n 1)`
 3. Update the `includePath` entires shown above to match the location you chose.
 
-#### Verifing Compliation
+#### Verifying Compliation
 
 Once you save your changes to `.vscode/c_cpp_properties.json`, you should see that warnings and errors in the Problems panel go away, at least temprorarily. Hopfeully they don't come back, but if they do, make sure your include paths are set correctly.
 

From ab7407180bb6188a4666e2101372c36bd781bc30 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 24 Apr 2023 14:04:27 -0400
Subject: [PATCH 081/130] use next available port for testing

---
 scripts.sh                      | 25 +++++++++++++++++++------
 test/Dockerfile-test-nginx      |  3 +++
 test/Dockerfile-test-runner     |  5 ++++-
 test/etc/nginx/conf.d/test.conf |  2 +-
 test/test.sh                    |  6 ++++--
 5 files changed, 31 insertions(+), 10 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index e5a2380..bbb6fa8 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -47,8 +47,10 @@ clean_module() {
 }
 
 start_nginx() {
-	printf "${BLUE}Starting NGINX container (${IMAGE_NAME})...${NC}\n"
-	docker run --rm --name "${IMAGE_NAME}" -d -p 8000:80 ${FULL_IMAGE_NAME} >/dev/null
+	local port=$(get_port)
+
+	printf "${BLUE}Starting NGINX container (${IMAGE_NAME}) on port ${port}...${NC}\n"
+	docker run --rm --name "${IMAGE_NAME}" -d -p ${PORT}:80 ${FULL_IMAGE_NAME} >/dev/null
 }
 
 stop_nginx() {
@@ -82,11 +84,13 @@ build_test_runner() {
 	local dockerArgs=${1:-}
 	local configHash=$(get_hash $(find test -type f -not -name 'test.sh' -not -name '*.yml' -not -name 'Dockerfile*'))
 	local sourceHash=$(get_hash test/test.sh)
-
-	printf "${BLUE}Building test runner...${NC}\n"
+	local port=$(get_port)
+	
+	printf "${BLUE}Building test runner using port ${port}...${NC}\n"
 	docker compose -f ./test/docker-compose-test.yml build ${dockerArgs} \
 		--build-arg CONFIG_HASH=${configHash}\
-		--build-arg SOURCE_HASH=${sourceHash}
+		--build-arg SOURCE_HASH=${sourceHash} \
+		--build-arg PORT=${port}
 }
 
 rebuild_test_runner() {
@@ -105,7 +109,7 @@ test() {
 		docker logs ${CONTAINER_NAME_PREFIX}
 		printf "${NC}\n"
 	else
-		docker start -a ${CONTAINER_NAME_PREFIX}-runner
+		test_now
 	fi
 
 	docker compose -f ./test/docker-compose-test.yml down
@@ -119,6 +123,15 @@ get_hash() {
 	sha1sum $@ | sed -E 's|\s+|:|' | tr '\n' ' ' | sha1sum | head -c 40
 }
 
+get_port() {
+	for p in $(seq 8000 8100); do
+		if ! ss -ln | grep -q ":${p} "; then
+			echo ${p}
+			break
+		fi
+	done
+}
+
 if [ $# -eq 0 ]; then
 	all
 else
diff --git a/test/Dockerfile-test-nginx b/test/Dockerfile-test-nginx
index 5497d07..b70ca9e 100644
--- a/test/Dockerfile-test-nginx
+++ b/test/Dockerfile-test-nginx
@@ -1,9 +1,12 @@
 ARG BASE_IMAGE
 ARG CONFIG_HASH
+ARG PORT
 
 FROM ${BASE_IMAGE} as NGINX
 ARG CONFIG_HASH
+ARG PORT
 RUN echo "Config Hash: ${CONFIG_HASH}"
 COPY /docker-entrypoint.d/* /docker-entrypoint.d/
 COPY /etc/nginx/conf.d/test.conf /etc/nginx/conf.d/test.conf
 COPY /etc/nginx/rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
+RUN sed -i "s|%{PORT}|${PORT}|" /etc/nginx/conf.d/test.conf
diff --git a/test/Dockerfile-test-runner b/test/Dockerfile-test-runner
index 0992d75..c8cbff2 100644
--- a/test/Dockerfile-test-runner
+++ b/test/Dockerfile-test-runner
@@ -1,10 +1,13 @@
 ARG SOURCE_HASH
+ARG PORT
 
 FROM alpine:3.7 AS test-base
 RUN apk add curl bash
 
 FROM test-base AS test
 ARG SOURCE_HASH
+ARG PORT
+ENV PORT=${PORT}
 RUN echo "Source Hash: ${SOURCE_HASH}"
 COPY test.sh .
-CMD ["./test.sh"]
+CMD ./test.sh ${PORT}
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
index fcc3900..62624df 100644
--- a/test/etc/nginx/conf.d/test.conf
+++ b/test/etc/nginx/conf.d/test.conf
@@ -2,7 +2,7 @@ error_log /var/log/nginx/debug.log debug;
 access_log /var/log/nginx/access.log;
 
 server {
-    listen 8000;
+    listen %{PORT};
     server_name localhost;
     
     auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
diff --git a/test/test.sh b/test/test.sh
index 6ab567b..9516087 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -1,6 +1,7 @@
-#!/bin/bash
+#!/bin/bash -u
 
 # set a test # here to execute only that test and output additional info
+PORT=${1:-8000}
 DEBUG=
 
 RED='\e[31m'
@@ -45,7 +46,7 @@ run_test () {
       esac
     done
 
-    curlCommand="curl -s -v http://nginx:8000${path} -H 'Cache-Control: no-cache' ${extraCurlOpts} 2>&1"
+    curlCommand="curl -s -v http://nginx:${PORT}${path} -H 'Cache-Control: no-cache' ${extraCurlOpts} 2>&1"
     response=$(eval "${curlCommand}")
     exitCode=$?
     
@@ -224,4 +225,5 @@ if [ "${DEBUG}" != '' ]; then
  printf "\n${RED}Some tests will be skipped since DEBUG is set.${NC}\n"
 fi
 
+printf "\n${GRAY}Starting tests using port ${PORT}...${NC}\n"
 main

From 697551d9b24508ae22aaa8f327a073e1722f2b31 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 24 Apr 2023 14:54:35 -0400
Subject: [PATCH 082/130] fix port casing

---
 scripts.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts.sh b/scripts.sh
index bbb6fa8..00a81c7 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -50,7 +50,7 @@ start_nginx() {
 	local port=$(get_port)
 
 	printf "${BLUE}Starting NGINX container (${IMAGE_NAME}) on port ${port}...${NC}\n"
-	docker run --rm --name "${IMAGE_NAME}" -d -p ${PORT}:80 ${FULL_IMAGE_NAME} >/dev/null
+	docker run --rm --name "${IMAGE_NAME}" -d -p ${port}:80 ${FULL_IMAGE_NAME} >/dev/null
 }
 
 stop_nginx() {

From b888c93389a51cbe6c13c9c627d5ab2325028a47 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Mon, 24 Apr 2023 15:47:31 -0400
Subject: [PATCH 083/130] update to support NGINX 1.23.0+ (#89)

---
 Dockerfile                     | 14 +++++++++++++-
 src/ngx_http_auth_jwt_module.c | 17 ++++++++++++++---
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 94d829e..7b85a87 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,6 +8,8 @@ RUN <<`
 apt-get update
 apt-get install -y curl build-essential
 `
+
+
 FROM ngx_http_auth_jwt_builder_base as ngx_http_auth_jwt_builder_module
 LABEL stage=ngx_http_auth_jwt_builder
 ENV LD_LIBRARY_PATH=/usr/local/lib
@@ -29,7 +31,17 @@ tar -xzf nginx-${NGINX_VERSION}.tar.gz --strip-components 1 -C nginx
 `
 WORKDIR /root/build/nginx
 RUN <<`
-./configure --with-debug --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module
+BUILD_FLAGS=''
+MAJ=$(echo ${NGINX_VERSION} | cut -f1 -d.)
+MIN=$(echo ${NGINX_VERSION} | cut -f2 -d.)
+REV=$(echo ${NGINX_VERSION} | cut -f3 -d.)
+
+# NGINX 1.23.0+ changes `cookies` to `cookie` 
+if [ "${MAJ}" -gt 1 ] || [ "${MAJ}" -eq 1 -a "${MIN}" -ge 23 ]; then
+	BUILD_FLAGS="${BUILD_FLAGS} --with-cc-opt='-DNGX_LINKED_LIST_COOKIES=1'"
+fi
+
+./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module ${BUILD_FLAGS}
 make modules
 `
 
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 3ecb0d3..ef30437 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -19,6 +19,7 @@
 #include "ngx_http_auth_jwt_string.h"
 
 #include <stdio.h>
+#include <stdbool.h>
 
 typedef struct
 {
@@ -639,15 +640,25 @@ static char *get_jwt(ngx_http_request_t *r, ngx_str_t validation_type)
   }
   else if (validation_type.len > sizeof("COOKIE=") && ngx_strncmp(validation_type.data, "COOKIE=", sizeof("COOKIE=") - 1) == 0)
   {
-    ngx_int_t n;
+    bool has_cookie = false;
     ngx_str_t jwtCookieVal;
 
     validation_type.data += sizeof("COOKIE=") - 1;
     validation_type.len -= sizeof("COOKIE=") - 1;
 
-    n = ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &validation_type, &jwtCookieVal);
+#ifndef NGX_LINKED_LIST_COOKIES
+    if (ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &validation_type, &jwtCookieVal) != NGX_DECLINED)
+    {
+      has_cookie = true;
+    }
+#else
+    if (ngx_http_parse_multi_header_lines(r, r->headers_in.cookie, &validation_type, &jwtCookieVal) != NULL)
+    {
+      has_cookie = true;
+    }
+#endif
 
-    if (n != NGX_DECLINED)
+    if (has_cookie == true)
     {
       jwtPtr = ngx_str_t_to_char_ptr(r->pool, jwtCookieVal);
     }

From b2ec2bb02fbf654aa1879ab0a7d3e5da5daade40 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Tue, 25 Apr 2023 14:02:47 -0400
Subject: [PATCH 084/130] rename `auth_jwt_authorization_type` to
 `auth_jwt_location` and support pulling JWT from any header (#90)

---
 Dockerfile                      |  2 +-
 README.md                       |  7 ++--
 src/ngx_http_auth_jwt_module.c  | 59 ++++++++++++++++-----------------
 test/etc/nginx/conf.d/test.conf | 46 +++++++++++++++----------
 test/test.sh                    | 23 ++++++++++---
 5 files changed, 81 insertions(+), 56 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 7b85a87..4f2db13 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -36,7 +36,7 @@ MAJ=$(echo ${NGINX_VERSION} | cut -f1 -d.)
 MIN=$(echo ${NGINX_VERSION} | cut -f2 -d.)
 REV=$(echo ${NGINX_VERSION} | cut -f3 -d.)
 
-# NGINX 1.23.0+ changes `cookies` to `cookie` 
+# NGINX 1.23.0+ changes cookies to use a linked list, and renames `cookies` to `cookie`
 if [ "${MAJ}" -gt 1 ] || [ "${MAJ}" -eq 1 -a "${MIN}" -ge 23 ]; then
 	BUILD_FLAGS="${BUILD_FLAGS} --with-cc-opt='-DNGX_LINKED_LIST_COOKIES=1'"
 fi
diff --git a/README.md b/README.md
index f8cae3a..6a629d3 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ This module requires several new `nginx.conf` directives, which can be specified
 | `auth_jwt_loginurl`                  | The URL to redirect to if `auth_jwt_redirect` is enabled and authentication fails.                                                                   |
 | `auth_jwt_enabled`                   | Set to "on" to enable JWT checking.                                                                                                                  |
 | `auth_jwt_algorithm`                 | The algorithm to use. One of: HS256, HS384, HS512, RS256, RS384, RS512                                                                               |
-| `auth_jwt_validation_type`           | Indicates where the JWT is located in the request -- see below.                                                                                      |
+| `auth_jwt_location`                  | Indicates where the JWT is located in the request -- see below.                                                                                      |
 | `auth_jwt_validate_sub`              | Set to "on" to validate the `sub` claim (e.g. user id) in the JWT.                                                                                   |
 | `auth_jwt_extract_request_claims`    | Set to a space-delimited list of claims to extract from the JWT and set as request headers. These will be accessible via e.g: `$http_jwt_sub`        |
 | `auth_jwt_extract_response_claims`   | Set to a space-delimited list of claims to extract from the JWT and set as response headers. These will be accessible via e.g: `$sent_http_jwt_sub`  |
@@ -67,10 +67,11 @@ auth_jwt_redirect off;
 ```
 ## JWT Locations
 
-By default, the authorization header is used to provide a JWT for validation. However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT:
+By default, the`Authorization` header is used to provide a JWT for validation. However, you may use the `auth_jwt_location` directive to specify the name of the header or cookie which provides the JWT:
 
 ```nginx
-auth_jwt_validation_type COOKIE=jwt;
+auth_jwt_location HEADER=auth-token;  # get the JWT from the "auth-token" header
+auth_jwt_location COOKIE=auth-token;  # get the JWT from the "auth-token" cookie
 ```
 
 ## `sub` Validation
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index ef30437..0268dab 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -27,7 +27,7 @@ typedef struct
   ngx_str_t key;
   ngx_flag_t enabled;
   ngx_flag_t redirect;
-  ngx_str_t validation_type;
+  ngx_str_t jwt_location;
   ngx_str_t algorithm;
   ngx_flag_t validate_sub;
   ngx_array_t *extract_request_claims;
@@ -51,9 +51,9 @@ static void extract_response_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtc
 static ngx_int_t free_jwt_and_redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt);
 static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf);
 static ngx_int_t load_public_key(ngx_conf_t *cf, auth_jwt_conf_t *conf);
-static char *get_jwt(ngx_http_request_t *r, ngx_str_t validation_type);
+static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location);
 
-static char *JWT_HEADER_PREFIX = "JWT-";
+static const char *JWT_HEADER_PREFIX = "JWT-";
 
 static ngx_command_t auth_jwt_directives[] = {
     {ngx_string("auth_jwt_loginurl"),
@@ -84,11 +84,11 @@ static ngx_command_t auth_jwt_directives[] = {
      offsetof(auth_jwt_conf_t, redirect),
      NULL},
 
-    {ngx_string("auth_jwt_validation_type"),
+    {ngx_string("auth_jwt_location"),
      NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_TAKE1,
      ngx_conf_set_str_slot,
      NGX_HTTP_LOC_CONF_OFFSET,
-     offsetof(auth_jwt_conf_t, validation_type),
+     offsetof(auth_jwt_conf_t, jwt_location),
      NULL},
 
     {ngx_string("auth_jwt_algorithm"),
@@ -208,7 +208,7 @@ static char *merge_conf(ngx_conf_t *cf, void *parent, void *child)
 
   ngx_conf_merge_str_value(conf->loginurl, prev->loginurl, "");
   ngx_conf_merge_str_value(conf->key, prev->key, "");
-  ngx_conf_merge_str_value(conf->validation_type, prev->validation_type, "");
+  ngx_conf_merge_str_value(conf->jwt_location, prev->jwt_location, "HEADER=Authorization");
   ngx_conf_merge_str_value(conf->algorithm, prev->algorithm, "HS256");
   ngx_conf_merge_str_value(conf->keyfile_path, prev->keyfile_path, "");
   ngx_conf_merge_off_value(conf->validate_sub, prev->validate_sub, 0);
@@ -311,7 +311,7 @@ static ngx_int_t handle_request(ngx_http_request_t *r)
     }
     else
     {
-      char *jwtPtr = get_jwt(r, jwtcf->validation_type);
+      char *jwtPtr = get_jwt(r, jwtcf->jwt_location);
 
       if (jwtPtr == NULL)
       {
@@ -608,51 +608,50 @@ static ngx_int_t load_public_key(ngx_conf_t *cf, auth_jwt_conf_t *conf)
   }
 }
 
-static char *get_jwt(ngx_http_request_t *r, ngx_str_t validation_type)
+static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location)
 {
+  static const char *HEADER_PREFIX = "HEADER=";
+  static const char *BEARER_PREFIX = "Bearer ";
+  static const char *COOKIE_PREFIX = "COOKIE=";
   char *jwtPtr = NULL;
 
-  ngx_log_debug(NGX_LOG_DEBUG, r->connection->log, 0, "validation_type.len %d", validation_type.len);
+  ngx_log_debug(NGX_LOG_DEBUG, r->connection->log, 0, "jwt_location.len %d", jwt_location.len);
 
-  if (validation_type.len == 0 || (validation_type.len == sizeof("AUTHORIZATION") - 1 && ngx_strncmp(validation_type.data, "AUTHORIZATION", sizeof("AUTHORIZATION") - 1) == 0))
+  if (jwt_location.len > sizeof(HEADER_PREFIX) && ngx_strncmp(jwt_location.data, HEADER_PREFIX, sizeof(HEADER_PREFIX) - 1) == 0)
   {
-    static const ngx_str_t authorizationHeaderName = ngx_string("Authorization");
-    const ngx_table_elt_t *authorizationHeader = search_headers_in(r, authorizationHeaderName.data, authorizationHeaderName.len);
+    ngx_table_elt_t *jwtHeaderVal;
 
-    if (authorizationHeader != NULL)
-    {
-      ngx_int_t bearer_length = authorizationHeader->value.len - (sizeof("Bearer ") - 1);
+    jwt_location.data += sizeof(HEADER_PREFIX) - 1;
+    jwt_location.len -= sizeof(HEADER_PREFIX) - 1;
 
-      ngx_log_debug(NGX_LOG_DEBUG, r->connection->log, 0, "Found authorization header len %d", authorizationHeader->value.len);
+    jwtHeaderVal = search_headers_in(r, jwt_location.data, jwt_location.len);
 
-      if (bearer_length > 0)
+    if (jwtHeaderVal != NULL)
+    {
+      if (ngx_strncmp(jwtHeaderVal->value.data, BEARER_PREFIX, sizeof(BEARER_PREFIX) - 1) == 0)
       {
-        ngx_str_t authorizationHeaderStr;
-
-        authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
-        authorizationHeaderStr.len = bearer_length;
-
-        jwtPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
-
-        ngx_log_debug(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtPtr);
+        jwtHeaderVal->value.data += sizeof(BEARER_PREFIX) - 1;
+        jwtHeaderVal->value.len -= sizeof(BEARER_PREFIX) - 1;
       }
+
+      jwtPtr = ngx_str_t_to_char_ptr(r->pool, jwtHeaderVal->value);
     }
   }
-  else if (validation_type.len > sizeof("COOKIE=") && ngx_strncmp(validation_type.data, "COOKIE=", sizeof("COOKIE=") - 1) == 0)
+  else if (jwt_location.len > sizeof(COOKIE_PREFIX) && ngx_strncmp(jwt_location.data, COOKIE_PREFIX, sizeof(COOKIE_PREFIX) - 1) == 0)
   {
     bool has_cookie = false;
     ngx_str_t jwtCookieVal;
 
-    validation_type.data += sizeof("COOKIE=") - 1;
-    validation_type.len -= sizeof("COOKIE=") - 1;
+    jwt_location.data += sizeof(COOKIE_PREFIX) - 1;
+    jwt_location.len -= sizeof(COOKIE_PREFIX) - 1;
 
 #ifndef NGX_LINKED_LIST_COOKIES
-    if (ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &validation_type, &jwtCookieVal) != NGX_DECLINED)
+    if (ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &jwt_location, &jwtCookieVal) != NGX_DECLINED)
     {
       has_cookie = true;
     }
 #else
-    if (ngx_http_parse_multi_header_lines(r, r->headers_in.cookie, &validation_type, &jwtCookieVal) != NULL)
+    if (ngx_http_parse_multi_header_lines(r, r->headers_in.cookie, &jwt_location, &jwtCookieVal) != NULL)
     {
       has_cookie = true;
     }
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
index 62624df..3d84e19 100644
--- a/test/etc/nginx/conf.d/test.conf
+++ b/test/etc/nginx/conf.d/test.conf
@@ -17,7 +17,7 @@ server {
     location /secure/cookie/default {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
-        auth_jwt_validation_type COOKIE=jwt;
+        auth_jwt_location COOKIE=jwt;
         
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -27,7 +27,7 @@ server {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
         auth_jwt_validate_sub on;
-        auth_jwt_validation_type COOKIE=jwt;
+        auth_jwt_location COOKIE=jwt;
         
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -36,7 +36,7 @@ server {
     location /secure/cookie/default/no-redirect {
         auth_jwt_enabled on;
         auth_jwt_redirect off;
-        auth_jwt_validation_type COOKIE=jwt;
+        auth_jwt_location COOKIE=jwt;
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -45,7 +45,7 @@ server {
     location /secure/cookie/hs256 {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
-        auth_jwt_validation_type COOKIE=jwt;
+        auth_jwt_location COOKIE=jwt;
         auth_jwt_algorithm HS256;
 
         alias /usr/share/nginx/html/;
@@ -55,7 +55,7 @@ server {
     location /secure/cookie/hs384 {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
-        auth_jwt_validation_type COOKIE=jwt;
+        auth_jwt_location COOKIE=jwt;
         auth_jwt_algorithm HS384;
 
         alias /usr/share/nginx/html/;
@@ -65,7 +65,7 @@ server {
     location /secure/cookie/hs512 {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
-        auth_jwt_validation_type COOKIE=jwt;
+        auth_jwt_location COOKIE=jwt;
         auth_jwt_algorithm HS512;
 
         alias /usr/share/nginx/html/;
@@ -75,7 +75,7 @@ server {
     location /secure/auth-header/default {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -84,7 +84,7 @@ server {
     location /secure/auth-header/default/no-redirect {
         auth_jwt_enabled on;
         auth_jwt_redirect off;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -93,7 +93,7 @@ server {
     location /secure/auth-header/rs256 {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_key "-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
 uqNuffp4+4aUCwuFE9B5s9MJr63gyf8jW0oDr7Mb1Xb8y9iGkWfhouZqNJbMFry+
@@ -111,7 +111,7 @@ BwIDAQAB
     location /secure/auth-header/rs256/file {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_algorithm RS256;
         auth_jwt_use_keyfile on;
         auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
@@ -123,7 +123,7 @@ BwIDAQAB
     location /secure/auth-header/rs384/file {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_algorithm RS384;
         auth_jwt_use_keyfile on;
         auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
@@ -135,7 +135,7 @@ BwIDAQAB
     location /secure/auth-header/rs512/file {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_algorithm RS512;
         auth_jwt_use_keyfile on;
         auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
@@ -144,10 +144,20 @@ BwIDAQAB
         try_files index.html =404;
     }
 
+    location /secure/custom-header/hs256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Auth-Token;
+        auth_jwt_algorithm HS256;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
     location /secure/extract-claim/request/sub {
         auth_jwt_enabled on;
         auth_jwt_redirect off;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_extract_request_claims sub;
 
         add_header "Test" "sub=$http_jwt_sub";
@@ -159,7 +169,7 @@ BwIDAQAB
     location /secure/extract-claim/request/name-1 {
         auth_jwt_enabled on;
         auth_jwt_redirect off;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_extract_request_claims firstName lastName;
 
         add_header "Test" "$http_jwt_firstname $http_jwt_lastname";
@@ -171,7 +181,7 @@ BwIDAQAB
     location /secure/extract-claim/request/name-2 {
         auth_jwt_enabled on;
         auth_jwt_redirect off;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_extract_request_claims firstName;
         auth_jwt_extract_request_claims lastName;
 
@@ -184,7 +194,7 @@ BwIDAQAB
     location /secure/extract-claim/response/sub {
         auth_jwt_enabled on;
         auth_jwt_redirect off;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_extract_response_claims sub;
 
         add_header "Test" "sub=$sent_http_jwt_sub";
@@ -196,7 +206,7 @@ BwIDAQAB
     location /secure/extract-claim/response/name-1 {
         auth_jwt_enabled on;
         auth_jwt_redirect off;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_extract_response_claims firstName lastName;
 
         add_header "Test" "$sent_http_jwt_firstname $sent_http_jwt_lastname";
@@ -208,7 +218,7 @@ BwIDAQAB
     location /secure/extract-claim/response/name-2 {
         auth_jwt_enabled on;
         auth_jwt_redirect off;
-        auth_jwt_validation_type AUTHORIZATION;
+        auth_jwt_location HEADER=Authorization;
         auth_jwt_extract_response_claims firstName;
         auth_jwt_extract_response_claims lastName;
 
diff --git a/test/test.sh b/test/test.sh
index 9516087..af03de5 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -109,10 +109,15 @@ main() {
            -p '/secure/auth-header/default' \
            -c '302'
 
-  run_test -n 'when auth enabled with default algorithm with no redirect and Authorization header missing Bearer, should return 401' \
+  run_test -n 'when auth enabled with default algorithm with no redirect and Authorization header missing Bearer, should return 200' \
            -p '/secure/auth-header/default/no-redirect' \
-           -c '401' \
-           -x '--header "Authorization: X"'
+           -c '200' \
+           -x "--header \"Authorization: ${JWT_HS256_VALID}\""
+
+  run_test -n 'when auth enabled with default algorithm with no redirect and Authorization header with Bearer, should return 200' \
+           -p '/secure/auth-header/default/no-redirect' \
+           -c '200' \
+           -x "--header \"Authorization: Bearer ${JWT_HS256_VALID}\""
 
   run_test -n 'when auth enabled with default algorithm and no JWT cookie, returns 302' \
            -p '/secure/cookie/default' \
@@ -143,7 +148,7 @@ main() {
            -x ' --cookie "jwt=${JWT_HS256_MISSING_EMAIL}"'
 
   run_test -n 'when auth enabled with HS256 algorithm and valid JWT cookie, returns 200' \
-           -p '/secure/cookie/hs256/' \
+           -p '/secure/cookie/hs256' \
            -c '200' \
            -x '--cookie "jwt=${JWT_HS256_VALID}"'
 
@@ -182,6 +187,16 @@ main() {
            -c '200' \
            -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
 
+  run_test -n 'when auth enabled with HS256 algorithm and valid JWT in custom header without bearer, returns 200' \
+           -p '/secure/custom-header/hs256/' \
+           -c '200' \
+           -x '--header "Auth-Token: ${JWT_HS256_VALID}"'
+
+  run_test -n 'when auth enabled with HS256 algorithm and valid JWT in custom header with bearer, returns 200' \
+           -p '/secure/custom-header/hs256/' \
+           -c '200' \
+           -x '--header "Auth-Token: Bearer ${JWT_HS256_VALID}"'
+
   run_test -n 'extracts single claim to request header' \
            -p '/secure/extract-claim/request/sub' \
            -r '^Test: sub=some-long-uuid$' \

From da1c7ce1c897bd5398b6aa4e0c30b02dc015209e Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 25 Apr 2023 15:01:11 -0400
Subject: [PATCH 085/130] update scripts.sh to add release-related functions

---
 .gitignore |  1 +
 scripts.sh | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/.gitignore b/.gitignore
index fe4f0be..14c2591 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 .idea
 .vscode
 bin
+release
\ No newline at end of file
diff --git a/scripts.sh b/scripts.sh
index 00a81c7..66b8624 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -80,6 +80,31 @@ cp_bin() {
 	fi
 }
 
+make_release() {
+	printf "${BLUE}Making release for version ${NGINX_VERSION}...${NC}\n"
+
+	build_module
+	cp_bin
+
+	mkdir -p release
+	tar -czvf release/ngx_http_auth_jwt_module_${NGINX_VERSION}.tgz \
+		README.md \
+		-C bin/usr/lib64/nginx/modules ngx_http_auth_jwt_module.so > /dev/null
+}
+
+# Create releases for the current mainline and stable version, as well as the 2 most recent "legacy" versions.
+#   See: https://nginx.org/en/download.html
+make_releases() {
+	VERSIONS=(1.20.2 1.22.1 1.24.0 1.23.4)
+	
+	rm -rf release/*
+
+	for v in ${VERSIONS[@]}; do
+		NGINX_VERSION=${v} make_release
+	done
+}
+
+
 build_test_runner() {
 	local dockerArgs=${1:-}
 	local configHash=$(get_hash $(find test -type f -not -name 'test.sh' -not -name '*.yml' -not -name 'Dockerfile*'))

From d7a369188b1f8ebcf9ee275f5a716b655a17a2bc Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 25 Apr 2023 15:01:24 -0400
Subject: [PATCH 086/130] update default NGINX_VERSION to 1.24.0 (stable)

---
 scripts.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts.sh b/scripts.sh
index 66b8624..e115b27 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -9,7 +9,7 @@ export ORG_NAME=${ORG_NAME:-teslagov}
 export IMAGE_NAME=${IMAGE_NAME:-jwt-nginx}
 export FULL_IMAGE_NAME=${ORG_NAME}/${IMAGE_NAME}
 export CONTAINER_NAME_PREFIX=${CONTAINER_NAME_PREFIX:-jwt-nginx-test}
-export NGINX_VERSION=${NGINX_VERSION:-1.22.0}
+export NGINX_VERSION=${NGINX_VERSION:-1.24.0}
 
 all() {
 	build_module

From 08edb040f96142a72454f02fcaea4411b8c84698 Mon Sep 17 00:00:00 2001
From: "Lewis M. Kabui" <13940255+lewisemm@users.noreply.github.com>
Date: Wed, 26 Apr 2023 14:37:53 +0300
Subject: [PATCH 087/130] Add missing backticks to fix markdown format (#92)

Co-authored-by: Lewis M. Kabui <lewisemm@users.noreply.github.com>
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 6a629d3..d385f23 100644
--- a/README.md
+++ b/README.md
@@ -167,13 +167,13 @@ Note the `includePath` additions above -- please update them as appropriate. Nex
 
 #### Cloning `libjwt`
 
-1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:benmcollins/libjwt.git <target_dir>
+1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:benmcollins/libjwt.git <target_dir>`
 2. Enter the directory and switch to the latest tag: `git checkout $(git tag | sort -Vr | head -n 1)`
 3. Update the `includePath` entires shown above to match the location you chose.
 
 #### Cloning `libjansson`
 
-1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:akheron/jansson.git <target_dir>
+1. Clone this repository as follows (replace `<target_dir>`): `git clone git@github.com:akheron/jansson.git <target_dir>`
 2. Enter the directory and switch to the latest tag: `git checkout $(git tag | sort -Vr | head -n 1)`
 3. Update the `includePath` entires shown above to match the location you chose.
 

From 89346e183711197eacbd7c885162176ef563b88d Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Wed, 26 Apr 2023 10:46:42 -0400
Subject: [PATCH 088/130] fix extraction of claims in nested config block (#91)

---
 config                          |  2 +-
 src/arrays.c                    | 14 ++++++++
 src/arrays.h                    |  7 ++++
 src/ngx_http_auth_jwt_module.c  |  5 +--
 test/etc/nginx/conf.d/test.conf | 36 +++++++++++++++++---
 test/test.sh                    | 60 ++++++++++++++++++++++++---------
 6 files changed, 102 insertions(+), 22 deletions(-)
 create mode 100644 src/arrays.c
 create mode 100644 src/arrays.h

diff --git a/config b/config
index 13c2325..0271a79 100644
--- a/config
+++ b/config
@@ -1,7 +1,7 @@
 ngx_module_type=HTTP
 ngx_addon_name=ngx_http_auth_jwt_module
 ngx_module_name=$ngx_addon_name
-ngx_module_srcs="${ngx_addon_dir}/src/ngx_http_auth_jwt_binary_converters.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_header_processing.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_string.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_module.c"
+ngx_module_srcs="${ngx_addon_dir}/src/arrays.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_binary_converters.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_header_processing.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_string.c ${ngx_addon_dir}/src/ngx_http_auth_jwt_module.c"
 ngx_module_libs="-ljansson -ljwt -lm"
 
 . auto/module
diff --git a/src/arrays.c b/src/arrays.c
new file mode 100644
index 0000000..043c24e
--- /dev/null
+++ b/src/arrays.c
@@ -0,0 +1,14 @@
+#include "arrays.h"
+#include <ngx_core.h>
+
+void merge_array(ngx_pool_t *pool, ngx_array_t **dest, const ngx_array_t *src, size_t size)
+{
+  // only merge if dest is non-null and src is null
+  if (src != NULL && *dest == NULL)
+  {
+    *dest = ngx_array_create(pool, src->nelts, size);
+
+    ngx_memcpy((*dest)->elts, src->elts, src->nelts * size);
+    (*dest)->nelts = src->nelts;
+  }
+}
diff --git a/src/arrays.h b/src/arrays.h
new file mode 100644
index 0000000..5e17158
--- /dev/null
+++ b/src/arrays.h
@@ -0,0 +1,7 @@
+#ifndef _ARRAYS_H
+#define _ARRAYS_H
+#include <ngx_core.h>
+
+void merge_array(ngx_pool_t *pool, ngx_array_t **dest, const ngx_array_t *src, size_t size);
+
+#endif
\ No newline at end of file
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 0268dab..ffc8964 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -14,6 +14,7 @@
 
 #include <jansson.h>
 
+#include "arrays.h"
 #include "ngx_http_auth_jwt_header_processing.h"
 #include "ngx_http_auth_jwt_binary_converters.h"
 #include "ngx_http_auth_jwt_string.h"
@@ -212,8 +213,8 @@ static char *merge_conf(ngx_conf_t *cf, void *parent, void *child)
   ngx_conf_merge_str_value(conf->algorithm, prev->algorithm, "HS256");
   ngx_conf_merge_str_value(conf->keyfile_path, prev->keyfile_path, "");
   ngx_conf_merge_off_value(conf->validate_sub, prev->validate_sub, 0);
-  ngx_conf_merge_ptr_value(conf->extract_request_claims, prev->extract_request_claims, NULL);
-  ngx_conf_merge_ptr_value(conf->extract_request_claims, prev->extract_response_claims, NULL);
+  merge_array(cf->pool, &conf->extract_request_claims, prev->extract_request_claims, sizeof(ngx_str_t));
+  merge_array(cf->pool, &conf->extract_response_claims, prev->extract_response_claims, sizeof(ngx_str_t));
 
   if (conf->enabled == NGX_CONF_UNSET)
   {
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
index 3d84e19..71cbd55 100644
--- a/test/etc/nginx/conf.d/test.conf
+++ b/test/etc/nginx/conf.d/test.conf
@@ -172,7 +172,7 @@ BwIDAQAB
         auth_jwt_location HEADER=Authorization;
         auth_jwt_extract_request_claims firstName lastName;
 
-        add_header "Test" "$http_jwt_firstname $http_jwt_lastname";
+        add_header "Test" "firstName=$http_jwt_firstname; lastName=$http_jwt_lastname";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -185,12 +185,26 @@ BwIDAQAB
         auth_jwt_extract_request_claims firstName;
         auth_jwt_extract_request_claims lastName;
 
-        add_header "Test" "$http_jwt_firstname $http_jwt_lastname";
+        add_header "Test" "firstName=$http_jwt_firstname; lastName=$http_jwt_lastname";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
     }
 
+    location /secure/extract-claim/request/nested {
+        location /secure/extract-claim/request/nested {
+            auth_jwt_enabled on;
+            auth_jwt_redirect off;
+            auth_jwt_location HEADER=Authorization;
+            auth_jwt_extract_request_claims username;
+
+            add_header "Test" "username=$http_jwt_username";
+
+            alias /usr/share/nginx/html/;
+            try_files index.html =404;
+        }
+    }
+
     location /secure/extract-claim/response/sub {
         auth_jwt_enabled on;
         auth_jwt_redirect off;
@@ -209,7 +223,7 @@ BwIDAQAB
         auth_jwt_location HEADER=Authorization;
         auth_jwt_extract_response_claims firstName lastName;
 
-        add_header "Test" "$sent_http_jwt_firstname $sent_http_jwt_lastname";
+        add_header "Test" "firstName=$sent_http_jwt_firstname; lastName=$sent_http_jwt_lastname";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -222,10 +236,24 @@ BwIDAQAB
         auth_jwt_extract_response_claims firstName;
         auth_jwt_extract_response_claims lastName;
 
-        add_header "Test" "$sent_http_jwt_firstname $sent_http_jwt_lastname";
+        add_header "Test" "firstName=$sent_http_jwt_firstname; lastName=$sent_http_jwt_lastname";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
     }
+
+    location /secure/extract-claim/response/nested {
+        location /secure/extract-claim/response/nested {
+            auth_jwt_enabled on;
+            auth_jwt_redirect off;
+            auth_jwt_location HEADER=Authorization;
+            auth_jwt_extract_response_claims username;
+
+            add_header "Test" "username=$sent_http_jwt_username";
+
+            alias /usr/share/nginx/html/;
+            try_files index.html =404;
+        }
+    }
 }
 
diff --git a/test/test.sh b/test/test.sh
index af03de5..471f658 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -56,7 +56,7 @@ run_test () {
       printf "${RED}${name} -- unexpected exit code from cURL\n\tcURL Exit Code: ${exitCode}";
       NUM_FAILED=$((${NUM_FAILED} + 1));
     else
-      OKAY=1
+      local okay=1
 
       if [ "${expectedCode}" != "" ]; then
         local responseCode=$(echo "${response}" | grep -Eo 'HTTP/1.1 ([0-9]{3})' | awk '{print $2}')
@@ -64,17 +64,17 @@ run_test () {
         if [ "${expectedCode}" != "${responseCode}" ]; then
           printf "${RED}${name} -- unexpected status code\n\tExpected: ${expectedCode}\n\tActual: ${responseCode}\n\tPath: ${path}"
           NUM_FAILED=$((${NUM_FAILED} + 1))
-          OKAY=0
+          okay=0
         fi
       fi
-
-      if [ "${OKAY}" == "1" ] && [ "${expectedResponseRegex}" != "" ] && echo "${response}" | grep -Eq "${expectedResponseRegex}"; then
+      
+      if [ "${okay}" == '1' ] && [ "${expectedResponseRegex}" != "" ] && ! [[ "${response}" =~ "${expectedResponseRegex}" ]]; then
         printf "${RED}${name} -- regex not found in response\n\tPath: ${path}\n\tRegEx: ${expectedResponseRegex}"
         NUM_FAILED=$((${NUM_FAILED} + 1))
-        OKAY=0
+        okay=0
       fi
       
-      if [ "${OKAY}" == "1" ]; then
+      if [ "${okay}" == '1' ]; then
         printf "${GREEN}${name}";
       fi
     fi
@@ -197,34 +197,64 @@ main() {
            -c '200' \
            -x '--header "Auth-Token: Bearer ${JWT_HS256_VALID}"'
 
-  run_test -n 'extracts single claim to request header' \
+  run_test -n 'extracts single claim to request variable' \
            -p '/secure/extract-claim/request/sub' \
-           -r '^Test: sub=some-long-uuid$' \
+           -r '< Test: sub=some-long-uuid' \
            -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
 
-  run_test -n 'extracts multiple claims (single directive) to request header' \
+  run_test -n 'extracts multiple claims (single directive) to request variable' \
            -p '/secure/extract-claim/request/name-1' \
-           -r '^Test: hello world$' \
+           -r '< Test: firstName=hello; lastName=world' \
            -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
 
-  run_test -n 'extracts multiple claims (multiple directives) to request header' \
+  run_test -n 'extracts multiple claims (multiple directives) to request variable' \
            -p '/secure/extract-claim/request/name-2' \
-           -r '^Test: hello world$' \
+           -r '< Test: firstName=hello; lastName=world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts nested claim to request variable' \
+           -p '/secure/extract-claim/request/nested' \
+           -r '< Test: username=hello.world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts single claim to response variable' \
+           -p '/secure/extract-claim/response/sub' \
+           -r '< Test: sub=some-long-uuid' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (single directive) to response variable' \
+           -p '/secure/extract-claim/response/name-1' \
+           -r '< Test: firstName=hello; lastName=world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (multiple directives) to response variable' \
+           -p '/secure/extract-claim/response/name-2' \
+           -r '< Test: firstName=hello; lastName=world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts nested claim to response variable' \
+           -p '/secure/extract-claim/response/nested' \
+           -r '< Test: username=hello.world' \
            -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
 
   run_test -n 'extracts single claim to response header' \
            -p '/secure/extract-claim/response/sub' \
-           -r '^Test: sub=some-long-uuid$' \
+           -r '< JWT-sub: some-long-uuid' \
            -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
 
   run_test -n 'extracts multiple claims (single directive) to response header' \
            -p '/secure/extract-claim/response/name-1' \
-           -r '^Test: hello world$' \
+           -r '< JWT-firstName: hello' \
            -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
 
   run_test -n 'extracts multiple claims (multiple directives) to response header' \
            -p '/secure/extract-claim/response/name-2' \
-           -r '^Test: hello world$' \
+           -r '< JWT-firstName: hello' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts nested claim to response header' \
+           -p '/secure/extract-claim/response/nested' \
+           -r '< JWT-username: hello.world' \
            -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
 
   if [[ "${NUM_FAILED}" = '0' ]]; then

From f79e6603ae0ceefa545cb0eb80e5c1d05d96c77a Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Wed, 26 Apr 2023 11:11:21 -0400
Subject: [PATCH 089/130] update make_release to include module version number

---
 scripts.sh | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index e115b27..fa96940 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -81,13 +81,16 @@ cp_bin() {
 }
 
 make_release() {
-	printf "${BLUE}Making release for version ${NGINX_VERSION}...${NC}\n"
+	local moduleVersion=${1}
+	local nginxVersion=${2}
+
+	printf "${BLUE}Making release for version ${moduleVersion} for NGINX ${nginxVersion}...${NC}\n"
 
 	build_module
 	cp_bin
 
 	mkdir -p release
-	tar -czvf release/ngx_http_auth_jwt_module_${NGINX_VERSION}.tgz \
+	tar -czvf release/ngx_http_auth_jwt_module_${moduleVersion}_nginx_${nginxVersion}.tgz \
 		README.md \
 		-C bin/usr/lib64/nginx/modules ngx_http_auth_jwt_module.so > /dev/null
 }
@@ -95,12 +98,13 @@ make_release() {
 # Create releases for the current mainline and stable version, as well as the 2 most recent "legacy" versions.
 #   See: https://nginx.org/en/download.html
 make_releases() {
-	VERSIONS=(1.20.2 1.22.1 1.24.0 1.23.4)
+	local moduleVersion=$(git describe --tags --abbrev=0)
+	local nginxVersions=(1.20.2 1.22.1 1.24.0 1.23.4)
 	
 	rm -rf release/*
 
-	for v in ${VERSIONS[@]}; do
-		NGINX_VERSION=${v} make_release
+	for v in ${nginxVersions[@]}; do
+		make_release ${moduleVersion} ${v}
 	done
 }
 

From d4271623eade259f29fc0faab9c6166c32528e0b Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Wed, 3 May 2023 08:53:58 -0400
Subject: [PATCH 090/130] add note about string claims

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index d385f23..8c34d5c 100644
--- a/README.md
+++ b/README.md
@@ -88,6 +88,8 @@ You may specify claims to be extracted from the JWT and placed on the request an
 
 If you only wish to access a claim as an NGINX variable, you should use `auth_jwt_extract_request_claims` so that the claim does not end up being sent to the client as a response header. However, if you do want the claim to be sent to the client in the response, then use `auth_jwt_extract_response_claims` instead.
 
+_Please note that `number`, `boolean`, `array`, and `object` claims are not supported at this time -- only `string` claims are supported._ An error will be thrown if you attempt to extract a non-string claim.
+
 ### Using Request Claims
 
 For example, you could configure an NGINX location which redirects to the current user's profile. Suppose `sub=abc-123`, the configuration below would redirect to `/profile/abc-123`.

From a23ed3c88e71b39ac0eff99086c622f347f0195e Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Thu, 4 May 2023 08:22:20 -0400
Subject: [PATCH 091/130] properly set NGINX_VERSION when making releases (#97)

---
 scripts.sh | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index fa96940..3922a29 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -25,7 +25,7 @@ build_module() {
 	docker image pull debian:bullseye-slim
 	docker image pull nginx:${NGINX_VERSION}
 
-	printf "${BLUE}Building module...${NC}\n"
+	printf "${BLUE}Building module for NGINX ${NGINX_VERSION}...${NC}\n"
 	docker image build -t ${FULL_IMAGE_NAME}:latest -t ${FULL_IMAGE_NAME}:${NGINX_VERSION} ${dockerArgs} \
 		--build-arg NGINX_VERSION=${NGINX_VERSION} \
 		--build-arg SOURCE_HASH=${sourceHash} .
@@ -82,15 +82,16 @@ cp_bin() {
 
 make_release() {
 	local moduleVersion=${1}
-	local nginxVersion=${2}
+	
+	NGINX_VERSION=${2}
 
-	printf "${BLUE}Making release for version ${moduleVersion} for NGINX ${nginxVersion}...${NC}\n"
+	printf "${BLUE}Making release for version ${moduleVersion} for NGINX ${NGINX_VERSION}...${NC}\n"
 
 	build_module
 	cp_bin
 
 	mkdir -p release
-	tar -czvf release/ngx_http_auth_jwt_module_${moduleVersion}_nginx_${nginxVersion}.tgz \
+	tar -czvf release/ngx_http_auth_jwt_module_${moduleVersion}_nginx_${NGINX_VERSION}.tgz \
 		README.md \
 		-C bin/usr/lib64/nginx/modules ngx_http_auth_jwt_module.so > /dev/null
 }

From 2eaf11c65029bccde5a0d3da34e0e687dbcb9e8a Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Thu, 10 Aug 2023 12:21:29 -0400
Subject: [PATCH 092/130] fix issue with "Bearer" being removed from header
 (#106)

---
 src/ngx_http_auth_jwt_module.c  | 17 ++++++++++++-----
 test/etc/nginx/conf.d/test.conf | 11 +++++++++++
 test/test.sh                    |  6 ++++++
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index ffc8964..744b50d 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -612,7 +612,6 @@ static ngx_int_t load_public_key(ngx_conf_t *cf, auth_jwt_conf_t *conf)
 static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location)
 {
   static const char *HEADER_PREFIX = "HEADER=";
-  static const char *BEARER_PREFIX = "Bearer ";
   static const char *COOKIE_PREFIX = "COOKIE=";
   char *jwtPtr = NULL;
 
@@ -629,13 +628,21 @@ static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location)
 
     if (jwtHeaderVal != NULL)
     {
+      static const char *BEARER_PREFIX = "Bearer ";
+
       if (ngx_strncmp(jwtHeaderVal->value.data, BEARER_PREFIX, sizeof(BEARER_PREFIX) - 1) == 0)
       {
-        jwtHeaderVal->value.data += sizeof(BEARER_PREFIX) - 1;
-        jwtHeaderVal->value.len -= sizeof(BEARER_PREFIX) - 1;
-      }
+        ngx_str_t jwtHeaderValWithoutBearer = jwtHeaderVal->value;
+        
+        jwtHeaderValWithoutBearer.data += sizeof(BEARER_PREFIX) - 1;
+        jwtHeaderValWithoutBearer.len -= sizeof(BEARER_PREFIX) - 1;
 
-      jwtPtr = ngx_str_t_to_char_ptr(r->pool, jwtHeaderVal->value);
+        jwtPtr = ngx_str_t_to_char_ptr(r->pool, jwtHeaderValWithoutBearer);
+      }
+      else
+      {
+        jwtPtr = ngx_str_t_to_char_ptr(r->pool, jwtHeaderVal->value);
+      }
     }
   }
   else if (jwt_location.len > sizeof(COOKIE_PREFIX) && ngx_strncmp(jwt_location.data, COOKIE_PREFIX, sizeof(COOKIE_PREFIX) - 1) == 0)
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
index 71cbd55..00c990b 100644
--- a/test/etc/nginx/conf.d/test.conf
+++ b/test/etc/nginx/conf.d/test.conf
@@ -90,6 +90,17 @@ server {
         try_files index.html =404;
     }
 
+    location /secure/auth-header/default/proxy-header {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+
+        add_header "Test-Authorization" "$http_authorization";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
     location /secure/auth-header/rs256 {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
diff --git a/test/test.sh b/test/test.sh
index 471f658..29a0bf3 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -119,6 +119,12 @@ main() {
            -c '200' \
            -x "--header \"Authorization: Bearer ${JWT_HS256_VALID}\""
 
+  run_test -n 'when auth enabled with Authorization header with Bearer, should keep header intact' \
+           -p '/secure/auth-header/default/proxy-header' \
+           -c '200' \
+           -r "< Test-Authorization: Bearer ${JWT_HS256_VALID}" \
+           -x "--header \"Authorization: Bearer ${JWT_HS256_VALID}\""
+
   run_test -n 'when auth enabled with default algorithm and no JWT cookie, returns 302' \
            -p '/secure/cookie/default' \
            -c '302'

From 294db83fc613230958dc777edcc28cdde1a8056d Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Thu, 10 Aug 2023 12:42:30 -0400
Subject: [PATCH 093/130] update release versions; test before release

---
 scripts.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index 3922a29..253abfc 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -81,13 +81,17 @@ cp_bin() {
 }
 
 make_release() {
+	set -e
+	
 	local moduleVersion=${1}
 	
 	NGINX_VERSION=${2}
 
 	printf "${BLUE}Making release for version ${moduleVersion} for NGINX ${NGINX_VERSION}...${NC}\n"
 
-	build_module
+	rebuild_module
+	rebuild_test_runner
+	test
 	cp_bin
 
 	mkdir -p release
@@ -100,7 +104,7 @@ make_release() {
 #   See: https://nginx.org/en/download.html
 make_releases() {
 	local moduleVersion=$(git describe --tags --abbrev=0)
-	local nginxVersions=(1.20.2 1.22.1 1.24.0 1.23.4)
+	local nginxVersions=('1.25.1' '1.24.0' '1.22.1' '1.20.2')
 	
 	rm -rf release/*
 

From 5f9ffd20fec5fc31c90d5851c06747456a608e51 Mon Sep 17 00:00:00 2001
From: KnownEntity <42591012+KnownEntity@users.noreply.github.com>
Date: Wed, 23 Aug 2023 18:08:46 -0500
Subject: [PATCH 094/130] GitHub Action to automatically build master branch on
 commit (#108)

Co-authored-by: Josh McCullough <JoshMcCullough@users.noreply.github.com>
---
 .github/workflows/ci.yml | 133 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 133 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..d7f4b6b
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,133 @@
+name: CI
+
+on:
+  push:
+    branches: 
+      - 'master'
+  pull_request:
+    branches:
+      - 'master'
+  workflow_dispatch:
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        # Each nginx version to build against
+        nginx-version: ['1.20.2', '1.22.1', '1.24.0', '1.25.1']
+        # The following versions of libjwt are compatible:
+        #   * v1.0 - v1.12.0
+        #   * v1.12.1 - v1.14.0
+        #   * v1.15.0+
+        # At the time of writing this:
+        #   * Debian and Ubuntu's repos have v1.10.2
+        #   * EPEL has v1.12.1
+        # This compilles against each version prior to a breaking change and the latest release
+        libjwt-version: ['1.12.0', '1.14.0', '1.15.3']
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v3
+      with:
+        path: 'ngx-http-auth-jwt-module'
+
+    - name: Download jansson
+      uses: actions/checkout@v3
+      with:
+        repository: 'akheron/jansson'
+        ref: 'v2.14'
+        path: 'jansson'
+
+    - name: Build jansson
+      working-directory: ./jansson
+      run: |
+        cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
+        make && \
+        make check && \
+        sudo make install
+        
+    - name: Download libjwt
+      uses: actions/checkout@v3
+      with:
+        repository: 'benmcollins/libjwt'
+        ref: 'v${{matrix.libjwt-version}}'
+        path: 'libjwt'
+
+    - name: Build libjwt
+      working-directory: ./libjwt
+      run: |
+        autoreconf -i && \
+        ./configure && \
+        make all && \
+        sudo make install
+
+    - name: Download NGINX
+      run: | 
+        mkdir nginx
+        curl -O http://nginx.org/download/nginx-${{matrix.nginx-version}}.tar.gz
+        tar -xzf nginx-${{matrix.nginx-version}}.tar.gz --strip-components 1 -C nginx
+        
+    - name: Run configure
+      working-directory: ./nginx
+      run: |
+        BUILD_FLAGS=''
+        MAJ=$(echo ${{matrix.nginx-version}} | cut -f1 -d.)
+        MIN=$(echo ${{matrix.nginx-version}} | cut -f2 -d.)
+        REV=$(echo ${{matrix.nginx-version}} | cut -f3 -d.)
+        if [ "${MAJ}" -gt 1 ] || [ "${MAJ}" -eq 1 -a "${MIN}" -ge 23 ]; then
+        BUILD_FLAGS="${BUILD_FLAGS} --with-cc-opt='-DNGX_LINKED_LIST_COOKIES=1'"
+        fi
+        ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module ${BUILD_FLAGS}
+        
+    - name: Run make
+      working-directory: ./nginx
+      run: make modules
+
+    - name: Create release archive
+      run: |
+        cp ./nginx/objs/ngx_http_auth_jwt_module.so ./
+        tar czf ngx_http_auth_jwt_module_${{github.ref_name}}_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz ngx_http_auth_jwt_module.so
+
+    - name: Upload build artifact
+      uses: actions/upload-artifact@v3
+      with:
+        if-no-files-found: error
+        name: ngx_http_auth_jwt_module_${{github.ref_name}}_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz
+        path: ngx_http_auth_jwt_module_${{github.ref_name}}_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz
+
+  update_releases_page:
+    name: Upload builds to Releases
+    if: github.event_name != 'pull_request'
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Set up variables
+        id: vars
+        run: |
+          echo "date_now=$(date --rfc-3339=seconds)" >> "${GITHUB_OUTPUT}"
+          
+      - name: Download build artifacts from previous jobs
+        uses: actions/download-artifact@v3
+        with:
+          path: artifacts
+
+      - name: Upload builds to Releases
+        uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          artifactErrorsFailBuild: true
+          artifacts: artifacts/*/*
+          body: |
+            > [!WARNING]
+            > This is an automatically generated pre-release version of the module, which includes the latest master branch changes.
+            > Please report any bugs you find to the issue tracker.
+
+            - Build Date: `${{ steps.vars.outputs.date_now }}`
+            - Commit: ${{ github.sha }}
+          name: 'Development build: ${{ github.ref_name }}@${{ github.sha }}'
+          prerelease: true
+          removeArtifacts: true
+          tag: dev-build

From c843ce15f5b7c162e58c15c5aa01de33bbd8df66 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Fri, 25 Aug 2023 08:09:53 -0400
Subject: [PATCH 095/130] Update README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 8c34d5c..a5b7018 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,7 @@ This module requires several new `nginx.conf` directives, which can be specified
 
 ## Algorithms
 
-The default algorithm is `HS256`, for symmetric key validation. When using one of the `HS*` algorithms, the value for `auth_jwt_key` should be specified in binhex format. It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total) as in the example above. Note that using more than 512 bits will not increase the security. For key guidelines please see [NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms](https://csrc.nist.gov/publications/detail/sp/800-107/rev-1/final), Section 5.3.2 The HMAC Key.
+The default algorithm is `HS256`, for symmetric key validation. When using one of the `HS*` algorithms, the value for `auth_jwt_key` should be specified in binhex format. It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total). Note that using more than 512 bits will not increase the security. For key guidelines please see [NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms](https://csrc.nist.gov/publications/detail/sp/800-107/rev-1/final), Section 5.3.2 The HMAC Key.
 
 ### Additional Supported Algorithms
 

From e5d629e30b631ea363a82cd02a01d1a483f641a0 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Fri, 25 Aug 2023 08:22:24 -0400
Subject: [PATCH 096/130] update CI to only run if src dir is changed

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d7f4b6b..9177330 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,9 +4,13 @@ on:
   push:
     branches: 
       - 'master'
+    paths:
+      - src/**
   pull_request:
     branches:
       - 'master'
+    paths:
+      - src/**
   workflow_dispatch:
 
 jobs:

From 0b8e193c95ed881770545058b76099e87132edba Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Fri, 25 Aug 2023 08:23:56 -0400
Subject: [PATCH 097/130] add hex generation to README

---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index a5b7018..51c7196 100644
--- a/README.md
+++ b/README.md
@@ -33,6 +33,12 @@ This module requires several new `nginx.conf` directives, which can be specified
 
 The default algorithm is `HS256`, for symmetric key validation. When using one of the `HS*` algorithms, the value for `auth_jwt_key` should be specified in binhex format. It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total). Note that using more than 512 bits will not increase the security. For key guidelines please see [NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms](https://csrc.nist.gov/publications/detail/sp/800-107/rev-1/final), Section 5.3.2 The HMAC Key.
 
+To generate a 256-bit key (32 pairs of hex characters; 64 characters in total):
+
+```bash
+openssl rand -hex 32
+```
+
 ### Additional Supported Algorithms
 
 The configuration also supports RSA public key validation via (e.g.) `auth_jwt_algorithm RS256`. When using the `RS*` alhorithms, the `auth_jwt_key` field must be set to your public key **OR** `auth_jwt_use_keyfile` should be set to `on` and `auth_jwt_keyfile_path` should point to the public key on disk. NGINX won't start if `auth_jwt_use_keyfile` is set to `on` and a key file is not provided.

From 05a37988674aa3f2a63d80a3d43abb6684408cca Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Fri, 13 Oct 2023 18:51:48 -0400
Subject: [PATCH 098/130] clarify test logging

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 51c7196..ba3dde1 100644
--- a/README.md
+++ b/README.md
@@ -231,7 +231,7 @@ The tests use a customized NGINX image, distinct from the main image, as well as
 
 After making changes and finding that some tests fail, it can be difficult to understand why. By default, logs are written to Docker's internal log mechanism, but they won't be persisted after the test run completes and the containers are removed.
 
-In order to persist logs, you can configure the log driver to use. You can do this by setting the environment variable `LOG_DRIVER` before running the tests. On Linux/Unix systems, you can use the driver `journald`, as follows:
+If you'd like to persist logs across test runs, you can configure the log driver to use `journald` (on Linux/Unix systems for example). You can do this by setting the environment variable `LOG_DRIVER` before running the tests:
 
 ```shell
 # need to rebuild the test runner with the proper log driver

From 2062be55dd8624ab8f4d06d27fc455bbc51a730b Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 4 Dec 2023 11:21:01 -0500
Subject: [PATCH 099/130] update scripts.sh to clarify target NGINX versions

---
 scripts.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index 253abfc..175256c 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -5,11 +5,17 @@ GREEN='\033[0;32m'
 RED='\033[0;31m'
 NC='\033[0m'
 
+# supported NGINX versions -- for binary distribution
+NGINX_VERSION_MAINLINE='1.25.3'
+NGINX_VERSION_STABLE='1.24.0'
+NGINX_VERSION_LEGACY_1='1.22.1'
+NGINX_VERSION_LEGACY_2='1.20.2'
+
 export ORG_NAME=${ORG_NAME:-teslagov}
 export IMAGE_NAME=${IMAGE_NAME:-jwt-nginx}
 export FULL_IMAGE_NAME=${ORG_NAME}/${IMAGE_NAME}
 export CONTAINER_NAME_PREFIX=${CONTAINER_NAME_PREFIX:-jwt-nginx-test}
-export NGINX_VERSION=${NGINX_VERSION:-1.24.0}
+export NGINX_VERSION=${NGINX_VERSION:-${NGINX_VERSION_STABLE}}
 
 all() {
 	build_module
@@ -104,8 +110,8 @@ make_release() {
 #   See: https://nginx.org/en/download.html
 make_releases() {
 	local moduleVersion=$(git describe --tags --abbrev=0)
-	local nginxVersions=('1.25.1' '1.24.0' '1.22.1' '1.20.2')
-	
+	local nginxVersions=(${NGINX_VERSION_MAINLINE} ${NGINX_VERSION_STABLE} ${NGINX_VERSION_LEGACY_1} ${NGINX_VERSION_LEGACY_2})
+
 	rm -rf release/*
 
 	for v in ${nginxVersions[@]}; do

From 07f6f996975e6619a5e7a82ee7a42bc8177ef29f Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Mon, 4 Dec 2023 13:32:29 -0500
Subject: [PATCH 100/130] replace `sizeof` with `strlen` (#116)

---
 .github/workflows/ci.yml       |  9 +++++----
 src/ngx_http_auth_jwt_module.c | 30 +++++++++++++++---------------
 2 files changed, 20 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9177330..3c31403 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,10 +15,11 @@ on:
 
 jobs:
   build:
+    name: "NGINX: ${{ matrix.nginx-version }}; libjwt: ${{ matrix.libjwt-version }}"
     strategy:
       matrix:
         # Each nginx version to build against
-        nginx-version: ['1.20.2', '1.22.1', '1.24.0', '1.25.1']
+        nginx-version: ['1.20.2', '1.22.1', '1.24.0', '1.25.3']
         # The following versions of libjwt are compatible:
         #   * v1.0 - v1.12.0
         #   * v1.12.1 - v1.14.0
@@ -90,14 +91,14 @@ jobs:
     - name: Create release archive
       run: |
         cp ./nginx/objs/ngx_http_auth_jwt_module.so ./
-        tar czf ngx_http_auth_jwt_module_${{github.ref_name}}_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz ngx_http_auth_jwt_module.so
+        tar czf ngx_http_auth_jwt_module_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz ngx_http_auth_jwt_module.so
 
     - name: Upload build artifact
       uses: actions/upload-artifact@v3
       with:
         if-no-files-found: error
-        name: ngx_http_auth_jwt_module_${{github.ref_name}}_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz
-        path: ngx_http_auth_jwt_module_${{github.ref_name}}_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz
+        name: ngx_http_auth_jwt_module_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz
+        path: ngx_http_auth_jwt_module_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz
 
   update_releases_page:
     name: Upload builds to Releases
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 744b50d..edef14a 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -489,7 +489,7 @@ static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf)
     }
 
     r->headers_out.location->hash = 1;
-    r->headers_out.location->key.len = sizeof("Location") - 1;
+    r->headers_out.location->key.len = strlen("Location");
     r->headers_out.location->key.data = (u_char *)"Location";
 
     if (r->method == NGX_HTTP_GET)
@@ -526,21 +526,21 @@ static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf)
       uri_escaped.len = escaped_len;
       ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
 
-      r->headers_out.location->value.len = loginlen + sizeof("?return_url=") - 1 + strlen(scheme) + sizeof("://") - 1 + server.len + uri_escaped.len;
+      r->headers_out.location->value.len = loginlen + strlen("?return_url=") + strlen(scheme) + strlen("://") + server.len + uri_escaped.len;
 
       return_url = ngx_palloc(r->pool, r->headers_out.location->value.len);
       ngx_memcpy(return_url, jwtcf->loginurl.data, jwtcf->loginurl.len);
 
       return_url_idx = jwtcf->loginurl.len;
-      ngx_memcpy(return_url + return_url_idx, "?return_url=", sizeof("?return_url=") - 1);
+      ngx_memcpy(return_url + return_url_idx, "?return_url=", strlen("?return_url="));
 
-      return_url_idx += sizeof("?return_url=") - 1;
+      return_url_idx += strlen("?return_url=");
       ngx_memcpy(return_url + return_url_idx, scheme, strlen(scheme));
 
       return_url_idx += strlen(scheme);
-      ngx_memcpy(return_url + return_url_idx, "://", sizeof("://") - 1);
+      ngx_memcpy(return_url + return_url_idx, "://", strlen("://"));
 
-      return_url_idx += sizeof("://") - 1;
+      return_url_idx += strlen("://");
       ngx_memcpy(return_url + return_url_idx, server.data, server.len);
 
       return_url_idx += server.len;
@@ -617,12 +617,12 @@ static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location)
 
   ngx_log_debug(NGX_LOG_DEBUG, r->connection->log, 0, "jwt_location.len %d", jwt_location.len);
 
-  if (jwt_location.len > sizeof(HEADER_PREFIX) && ngx_strncmp(jwt_location.data, HEADER_PREFIX, sizeof(HEADER_PREFIX) - 1) == 0)
+  if (jwt_location.len > strlen(HEADER_PREFIX) && ngx_strncmp(jwt_location.data, HEADER_PREFIX, strlen(HEADER_PREFIX)) == 0)
   {
     ngx_table_elt_t *jwtHeaderVal;
 
-    jwt_location.data += sizeof(HEADER_PREFIX) - 1;
-    jwt_location.len -= sizeof(HEADER_PREFIX) - 1;
+    jwt_location.data += strlen(HEADER_PREFIX);
+    jwt_location.len -= strlen(HEADER_PREFIX);
 
     jwtHeaderVal = search_headers_in(r, jwt_location.data, jwt_location.len);
 
@@ -630,12 +630,12 @@ static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location)
     {
       static const char *BEARER_PREFIX = "Bearer ";
 
-      if (ngx_strncmp(jwtHeaderVal->value.data, BEARER_PREFIX, sizeof(BEARER_PREFIX) - 1) == 0)
+      if (ngx_strncmp(jwtHeaderVal->value.data, BEARER_PREFIX, strlen(BEARER_PREFIX)) == 0)
       {
         ngx_str_t jwtHeaderValWithoutBearer = jwtHeaderVal->value;
         
-        jwtHeaderValWithoutBearer.data += sizeof(BEARER_PREFIX) - 1;
-        jwtHeaderValWithoutBearer.len -= sizeof(BEARER_PREFIX) - 1;
+        jwtHeaderValWithoutBearer.data += strlen(BEARER_PREFIX);
+        jwtHeaderValWithoutBearer.len -= strlen(BEARER_PREFIX);
 
         jwtPtr = ngx_str_t_to_char_ptr(r->pool, jwtHeaderValWithoutBearer);
       }
@@ -645,13 +645,13 @@ static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location)
       }
     }
   }
-  else if (jwt_location.len > sizeof(COOKIE_PREFIX) && ngx_strncmp(jwt_location.data, COOKIE_PREFIX, sizeof(COOKIE_PREFIX) - 1) == 0)
+  else if (jwt_location.len > strlen(COOKIE_PREFIX) && ngx_strncmp(jwt_location.data, COOKIE_PREFIX, strlen(COOKIE_PREFIX)) == 0)
   {
     bool has_cookie = false;
     ngx_str_t jwtCookieVal;
 
-    jwt_location.data += sizeof(COOKIE_PREFIX) - 1;
-    jwt_location.len -= sizeof(COOKIE_PREFIX) - 1;
+    jwt_location.data += strlen(COOKIE_PREFIX);
+    jwt_location.len -= strlen(COOKIE_PREFIX);
 
 #ifndef NGX_LINKED_LIST_COOKIES
     if (ngx_http_parse_multi_header_lines(&r->headers_in.cookies, &jwt_location, &jwtCookieVal) != NGX_DECLINED)

From 736a95a2dabafa31e470c3938895d514f95585d5 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 20 Feb 2024 19:53:30 -0500
Subject: [PATCH 101/130] update NGINX mainline version

---
 scripts.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts.sh b/scripts.sh
index 175256c..e3fb254 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -6,7 +6,7 @@ RED='\033[0;31m'
 NC='\033[0m'
 
 # supported NGINX versions -- for binary distribution
-NGINX_VERSION_MAINLINE='1.25.3'
+NGINX_VERSION_MAINLINE='1.25.4'
 NGINX_VERSION_STABLE='1.24.0'
 NGINX_VERSION_LEGACY_1='1.22.1'
 NGINX_VERSION_LEGACY_2='1.20.2'

From 032fa5c14b93d309d88b585f084e4db7dbd2f53c Mon Sep 17 00:00:00 2001
From: Stephan Wurm <stephan.wurm@a-eberle.de>
Date: Mon, 18 Mar 2024 17:32:42 +0100
Subject: [PATCH 102/130] add support for ES algorithms (#118)

Signed-off-by: Stephan Wurm <stephan.wurm@a-eberle.de>
---
 src/ngx_http_auth_jwt_module.c    |   6 +-
 test/Dockerfile-test-nginx        |   3 +
 test/ec_key_256.pem               |   5 ++
 test/ec_key_384.pem               |   6 ++
 test/ec_key_521.pem               |   8 ++
 test/etc/nginx/conf.d/test.conf   | 123 ++++++++++++++++++++++++++++++
 test/etc/nginx/ec_key_256-pub.pem |   4 +
 test/etc/nginx/ec_key_384-pub.pem |   5 ++
 test/etc/nginx/ec_key_521-pub.pem |   6 ++
 test/test.sh                      |  39 ++++++++++
 10 files changed, 202 insertions(+), 3 deletions(-)
 create mode 100644 test/ec_key_256.pem
 create mode 100644 test/ec_key_384.pem
 create mode 100644 test/ec_key_521.pem
 create mode 100644 test/etc/nginx/ec_key_256-pub.pem
 create mode 100644 test/etc/nginx/ec_key_384-pub.pem
 create mode 100644 test/etc/nginx/ec_key_521-pub.pem

diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index edef14a..85a646d 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -337,7 +337,7 @@ static ngx_int_t handle_request(ngx_http_request_t *r)
             return redirect(r, jwtcf);
           }
         }
-        else if (algorithm.len == 5 && ngx_strncmp(algorithm.data, "RS", 2) == 0)
+        else if (algorithm.len == 5 && (ngx_strncmp(algorithm.data, "RS", 2) == 0 || ngx_strncmp(algorithm.data, "ES", 2) == 0))
         {
           if (jwtcf->use_keyfile == 1)
           {
@@ -394,7 +394,7 @@ static int validate_alg(auth_jwt_conf_t *jwtcf, jwt_t *jwt)
 {
   const jwt_alg_t alg = jwt_get_alg(jwt);
 
-  if (alg != JWT_ALG_HS256 && alg != JWT_ALG_HS384 && alg != JWT_ALG_HS512 && alg != JWT_ALG_RS256 && alg != JWT_ALG_RS384 && alg != JWT_ALG_RS512)
+  if (alg != JWT_ALG_HS256 && alg != JWT_ALG_HS384 && alg != JWT_ALG_HS512 && alg != JWT_ALG_RS256 && alg != JWT_ALG_RS384 && alg != JWT_ALG_RS512 && alg != JWT_ALG_ES256 && alg != JWT_ALG_ES384 && alg != JWT_ALG_ES512)
   {
     return 1;
   }
@@ -633,7 +633,7 @@ static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location)
       if (ngx_strncmp(jwtHeaderVal->value.data, BEARER_PREFIX, strlen(BEARER_PREFIX)) == 0)
       {
         ngx_str_t jwtHeaderValWithoutBearer = jwtHeaderVal->value;
-        
+
         jwtHeaderValWithoutBearer.data += strlen(BEARER_PREFIX);
         jwtHeaderValWithoutBearer.len -= strlen(BEARER_PREFIX);
 
diff --git a/test/Dockerfile-test-nginx b/test/Dockerfile-test-nginx
index b70ca9e..5f01436 100644
--- a/test/Dockerfile-test-nginx
+++ b/test/Dockerfile-test-nginx
@@ -9,4 +9,7 @@ RUN echo "Config Hash: ${CONFIG_HASH}"
 COPY /docker-entrypoint.d/* /docker-entrypoint.d/
 COPY /etc/nginx/conf.d/test.conf /etc/nginx/conf.d/test.conf
 COPY /etc/nginx/rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
+COPY /etc/nginx/ec_key_256-pub.pem /etc/nginx/ec-256-key.conf
+COPY /etc/nginx/ec_key_384-pub.pem /etc/nginx/ec-384-key.conf
+COPY /etc/nginx/ec_key_521-pub.pem /etc/nginx/ec-521-key.conf
 RUN sed -i "s|%{PORT}|${PORT}|" /etc/nginx/conf.d/test.conf
diff --git a/test/ec_key_256.pem b/test/ec_key_256.pem
new file mode 100644
index 0000000..4206969
--- /dev/null
+++ b/test/ec_key_256.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOlEBGcZxxhv8FkN0
+YIvax6fnhJbMeotzIEBxIglkNu6hRANCAATP1NpDzvZmKd2Mw6hIrv4nzUfNu7OK
+mT5VuL5LhvUgzTqVGuxwevA7DlFsNVSfCljIBG3geio3fcd4k0Z9SygL
+-----END PRIVATE KEY-----
diff --git a/test/ec_key_384.pem b/test/ec_key_384.pem
new file mode 100644
index 0000000..2aa5780
--- /dev/null
+++ b/test/ec_key_384.pem
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDADyrL6llSQoQOZ/PF/
+l761kAbrTwn4vu30Kr34ScW6bRKVXLq3cT3QssJ1nF9B63qhZANiAAQ48dOfIEd3
+0TCVE0JT4ZU0Db7Ftz+ex7lojP7uqTY9OI59yoMB01zUN4JK30BRXS9Yv0A9Bu1z
+fgLu93FSn0kd0zIPMvuu5LUt60M/miSt2lA0OrqFhKjx6FFdN/lNh64=
+-----END PRIVATE KEY-----
diff --git a/test/ec_key_521.pem b/test/ec_key_521.pem
new file mode 100644
index 0000000..10471dc
--- /dev/null
+++ b/test/ec_key_521.pem
@@ -0,0 +1,8 @@
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIAKkag6aVn4XAbaALo
+0b3pypdP5RBX7uKxHmKlkNCcpA0oVTdgjnM5NpJP8ZOM6NjVhEzsn6c/Tdn8hL8w
+SI55hFWhgYkDgYYABABpTipSvbs8fq44u4fA+v7DTNYViA58sqbrxjxdzwWZ8eEj
+CXsH7yzSGx3Y19NSyrX8HbjWmrj5uxiKeFCB8mGzTwDcFIKCMeMkHjZs/fmVOumR
+a2XSpj7BP6wqcN6Pf+UqECivGAZGRHoabo/dm5zF9M3gO+G9eOrf3G1wgFFM7Vzb
+Ow==
+-----END PRIVATE KEY-----
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
index 00c990b..3421b5b 100644
--- a/test/etc/nginx/conf.d/test.conf
+++ b/test/etc/nginx/conf.d/test.conf
@@ -72,6 +72,51 @@ server {
         try_files index.html =404;
     }
 
+    location /secure/cookie/es256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        auth_jwt_algorithm ES256;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz9TaQ872ZindjMOoSK7+J81Hzbuz
+ipk+Vbi+S4b1IM06lRrscHrwOw5RbDVUnwpYyARt4HoqN33HeJNGfUsoCw==
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/es384 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        auth_jwt_algorithm ES384;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOPHTnyBHd9EwlRNCU+GVNA2+xbc/nse5
+aIz+7qk2PTiOfcqDAdNc1DeCSt9AUV0vWL9APQbtc34C7vdxUp9JHdMyDzL7ruS1
+LetDP5okrdpQNDq6hYSo8ehRXTf5TYeu
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/es512 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        auth_jwt_algorithm ES512;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAaU4qUr27PH6uOLuHwPr+w0zWFYgO
+fLKm68Y8Xc8FmfHhIwl7B+8s0hsd2NfTUsq1/B241pq4+bsYinhQgfJhs08A3BSC
+gjHjJB42bP35lTrpkWtl0qY+wT+sKnDej3/lKhAorxgGRkR6Gm6P3ZucxfTN4Dvh
+vXjq39xtcIBRTO1c2zs=
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
     location /secure/auth-header/default {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
@@ -119,6 +164,48 @@ BwIDAQAB
         try_files index.html =404;
     }
 
+    location /secure/auth-header/es256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz9TaQ872ZindjMOoSK7+J81Hzbuz
+ipk+Vbi+S4b1IM06lRrscHrwOw5RbDVUnwpYyARt4HoqN33HeJNGfUsoCw==
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es384 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOPHTnyBHd9EwlRNCU+GVNA2+xbc/nse5
+aIz+7qk2PTiOfcqDAdNc1DeCSt9AUV0vWL9APQbtc34C7vdxUp9JHdMyDzL7ruS1
+LetDP5okrdpQNDq6hYSo8ehRXTf5TYeu
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es512 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAaU4qUr27PH6uOLuHwPr+w0zWFYgO
+fLKm68Y8Xc8FmfHhIwl7B+8s0hsd2NfTUsq1/B241pq4+bsYinhQgfJhs08A3BSC
+gjHjJB42bP35lTrpkWtl0qY+wT+sKnDej3/lKhAorxgGRkR6Gm6P3ZucxfTN4Dvh
+vXjq39xtcIBRTO1c2zs=
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
     location /secure/auth-header/rs256/file {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
@@ -155,6 +242,42 @@ BwIDAQAB
         try_files index.html =404;
     }
 
+    location /secure/auth-header/es256/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_algorithm ES256;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/ec-256-key.conf";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es384/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_algorithm ES384;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/ec-384-key.conf";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es512/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_algorithm ES512;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/ec-521-key.conf";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
     location /secure/custom-header/hs256 {
         auth_jwt_enabled on;
         auth_jwt_redirect on;
diff --git a/test/etc/nginx/ec_key_256-pub.pem b/test/etc/nginx/ec_key_256-pub.pem
new file mode 100644
index 0000000..3306ea0
--- /dev/null
+++ b/test/etc/nginx/ec_key_256-pub.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz9TaQ872ZindjMOoSK7+J81Hzbuz
+ipk+Vbi+S4b1IM06lRrscHrwOw5RbDVUnwpYyARt4HoqN33HeJNGfUsoCw==
+-----END PUBLIC KEY-----
diff --git a/test/etc/nginx/ec_key_384-pub.pem b/test/etc/nginx/ec_key_384-pub.pem
new file mode 100644
index 0000000..e642ed1
--- /dev/null
+++ b/test/etc/nginx/ec_key_384-pub.pem
@@ -0,0 +1,5 @@
+-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOPHTnyBHd9EwlRNCU+GVNA2+xbc/nse5
+aIz+7qk2PTiOfcqDAdNc1DeCSt9AUV0vWL9APQbtc34C7vdxUp9JHdMyDzL7ruS1
+LetDP5okrdpQNDq6hYSo8ehRXTf5TYeu
+-----END PUBLIC KEY-----
diff --git a/test/etc/nginx/ec_key_521-pub.pem b/test/etc/nginx/ec_key_521-pub.pem
new file mode 100644
index 0000000..0cb875c
--- /dev/null
+++ b/test/etc/nginx/ec_key_521-pub.pem
@@ -0,0 +1,6 @@
+-----BEGIN PUBLIC KEY-----
+MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAaU4qUr27PH6uOLuHwPr+w0zWFYgO
+fLKm68Y8Xc8FmfHhIwl7B+8s0hsd2NfTUsq1/B241pq4+bsYinhQgfJhs08A3BSC
+gjHjJB42bP35lTrpkWtl0qY+wT+sKnDej3/lKhAorxgGRkR6Gm6P3ZucxfTN4Dvh
+vXjq39xtcIBRTO1c2zs=
+-----END PUBLIC KEY-----
diff --git a/test/test.sh b/test/test.sh
index 29a0bf3..5671b8f 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -100,6 +100,10 @@ main() {
   local JWT_RS256_INVALID=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
   local JWT_RS384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.H35bTcZRhepWIoa8pKCbUMRuAOkVX9K5hJjc6tPmQwWmTw8lrktsvmMzJg_rgqnJLnAkciSIQw5EDj7fngS5zX2ThyRxrkPuE2Uiyw2Ect-mo9Kg1lrWgnyZCuCgq-Up9HQRAv0160mePlm8Gs4TOY6CPr38zwTcDZsy_Keq93igDQV8WuuWAGICaGd5ZyUOPjjzGShRjTU8Szz7fnpZpTtYRCYVo0pc5yfRWYm0fdn-4AseyGvd8JJ2xfnAEe4kZOkz7X1MLKtL0slKg3m2PH1lD7HwxIawXRTPWxArhJ9dcTNiDUrqtde2juGwOuMD_zTsb2Jj0_rmRb0Q6aljNw
   local JWT_RS512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.iUupyKypfXJ5aZWfItSW-mOmx9a4C4X7Yr5p5Fk8W75ZhkOq0EeNfstTxx870brhkdPovBhO2LYI44_HoH9XicQNL6JnFprE0r61eJFngbuzlhRQiWpq0xYrazJWc9zB7_GgL2ZCwtw-Ts3G23Q0632wVm6-d7MKvG7RS8aEjN-MuVGdtLglH3forpItmFxw-if40EQsBL7hncN_XNcQTO4KPHkqmlpac_oKXRrLFDIIt2tB6OOpvY4QcpERoxexp4pi2f-JoINnWX_dU5JnIs3ypVJLQPfoJvxg8fsg3zYrOvMYnfsqOCYoHtZGK0O7jyfFmcGo5v2hLT-CpoF3Zw
+  local JWT_ES256_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.WFfJXGr5whKHB7arjsTXPTJ6TAsS1LoRxu7Vj2_HrLaIQphWJM6BICf-M3cv52tFzt-XTZb6GxlDgAbHo8z9Zg
+  local JWT_ES256_INVALID=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
+  local JWT_ES384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._EFxXYOTAfT3gB3xUfgGR2UyXHeRTlDWqA94oZbB0DDa7YPZTEX9T4C_0ylnOFKZ6irGHZA8vxjgXDH3DZKWwBWcZ-XaQ_Q4Ws2J-AEeLqcl7_CS6q9mFo0Y7vUNEn-W
+  local JWT_ES512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.AFY4gNCtZNYkrTiijDkV4eKIt2UPMIuJBfZIk69jgI8FSGCQyUIMmIVg0fTvbaSiaryXzcjbG5TCm8a9Vu3KFJutAHGrgvZqcdklxx6Fbk3an3r_CH68n_ncwS3SUV58mDjf0OX8jRuNdudU1L5xYNQdodo-fxPIb1oHXfMJ0CmULDR9
 
   run_test -n 'when auth disabled, should return 200' \
            -p '/' \
@@ -173,6 +177,21 @@ main() {
            -c '200' \
            -x ' --cookie "jwt=${JWT_RS256_VALID}"'
 
+  run_test -n 'when auth enabled with ES256 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/es256' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_ES256_VALID}"'
+
+  run_test -n 'when auth enabled with ES384 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/es384' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_ES384_VALID}"'
+
+  run_test -n 'when auth enabled with ES512 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/es512' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_ES512_VALID}"'
+
   run_test -n 'when auth enabled with RS256 algorithm via file and valid JWT in Authorization header, returns 200' \
            -p '/secure/auth-header/rs256/file' \
            -c '200' \
@@ -193,6 +212,26 @@ main() {
            -c '200' \
            -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
 
+  run_test -n 'when auth enabled with ES256 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/es256/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_ES256_VALID}"'
+
+  run_test -n 'when auth enabled with ES256 algorithm via file and invalid JWT in Authorization header, returns 401' \
+           -p '/secure/auth-header/es256/file' \
+           -c '302' \
+           -x '--header "Authorization: Bearer ${JWT_ES256_INVALID}"'
+
+  run_test -n 'when auth enabled with ES384 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/es384/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_ES384_VALID}"'
+
+  run_test -n 'when auth enabled with ES512 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/es512/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_ES512_VALID}"'
+
   run_test -n 'when auth enabled with HS256 algorithm and valid JWT in custom header without bearer, returns 200' \
            -p '/secure/custom-header/hs256/' \
            -c '200' \

From 03d95531d14afea1a2acbd023fd1cd8ae234881a Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Tue, 19 Mar 2024 14:32:57 -0400
Subject: [PATCH 103/130] build custom SSL images; add SSL tests (#126)

---
 .../workflows/{ci.yml => make-releases.yml}   |  27 +--
 Dockerfile                                    |  59 -------
 nginx.dockerfile                              | 136 +++++++++++++++
 openssl.dockerfile                            |  37 ++++
 scripts.sh                                    | 165 ++++++++++++------
 test/Dockerfile-test-nginx                    |  15 --
 test/Dockerfile-test-runner                   |  13 --
 test/docker-compose-test.yml                  |  13 +-
 test/docker-entrypoint.d/10-nginx-test.sh     |   1 -
 test/etc/nginx/conf.d/test.conf               |  19 +-
 test/etc/nginx/test.crt                       |  23 +++
 test/etc/nginx/test.key                       |  28 +++
 test/test-nginx.dockerfile                    |  18 ++
 test/test-runner.dockerfile                   |  16 ++
 test/test.sh                                  |  64 ++++---
 15 files changed, 442 insertions(+), 192 deletions(-)
 rename .github/workflows/{ci.yml => make-releases.yml} (89%)
 delete mode 100644 Dockerfile
 create mode 100644 nginx.dockerfile
 create mode 100644 openssl.dockerfile
 delete mode 100644 test/Dockerfile-test-nginx
 delete mode 100644 test/Dockerfile-test-runner
 delete mode 100755 test/docker-entrypoint.d/10-nginx-test.sh
 create mode 100644 test/etc/nginx/test.crt
 create mode 100644 test/etc/nginx/test.key
 create mode 100644 test/test-nginx.dockerfile
 create mode 100644 test/test-runner.dockerfile

diff --git a/.github/workflows/ci.yml b/.github/workflows/make-releases.yml
similarity index 89%
rename from .github/workflows/ci.yml
rename to .github/workflows/make-releases.yml
index 3c31403..037823b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/make-releases.yml
@@ -3,12 +3,12 @@ name: CI
 on:
   push:
     branches: 
-      - 'master'
+      - master
     paths:
       - src/**
   pull_request:
     branches:
-      - 'master'
+      - master
     paths:
       - src/**
   workflow_dispatch:
@@ -18,8 +18,9 @@ jobs:
     name: "NGINX: ${{ matrix.nginx-version }}; libjwt: ${{ matrix.libjwt-version }}"
     strategy:
       matrix:
-        # Each nginx version to build against
+        # NGINX versions to build/test against
         nginx-version: ['1.20.2', '1.22.1', '1.24.0', '1.25.3']
+
         # The following versions of libjwt are compatible:
         #   * v1.0 - v1.12.0
         #   * v1.12.1 - v1.14.0
@@ -27,15 +28,16 @@ jobs:
         # At the time of writing this:
         #   * Debian and Ubuntu's repos have v1.10.2
         #   * EPEL has v1.12.1
-        # This compilles against each version prior to a breaking change and the latest release
+        # This compiles against each version prior to a breaking change and the latest release
         libjwt-version: ['1.12.0', '1.14.0', '1.15.3']
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout code
+    - name: Checkout Code
       uses: actions/checkout@v3
       with:
         path: 'ngx-http-auth-jwt-module'
 
+    # TODO cache the build result so we don't have to do this every time?
     - name: Download jansson
       uses: actions/checkout@v3
       with:
@@ -50,7 +52,8 @@ jobs:
         make && \
         make check && \
         sudo make install
-        
+
+    # TODO cache the build result so we don't have to do this every time?
     - name: Download libjwt
       uses: actions/checkout@v3
       with:
@@ -71,20 +74,22 @@ jobs:
         mkdir nginx
         curl -O http://nginx.org/download/nginx-${{matrix.nginx-version}}.tar.gz
         tar -xzf nginx-${{matrix.nginx-version}}.tar.gz --strip-components 1 -C nginx
-        
-    - name: Run configure
+
+    - name: Configure NGINX
       working-directory: ./nginx
       run: |
         BUILD_FLAGS=''
         MAJ=$(echo ${{matrix.nginx-version}} | cut -f1 -d.)
         MIN=$(echo ${{matrix.nginx-version}} | cut -f2 -d.)
         REV=$(echo ${{matrix.nginx-version}} | cut -f3 -d.)
+        
         if [ "${MAJ}" -gt 1 ] || [ "${MAJ}" -eq 1 -a "${MIN}" -ge 23 ]; then
-        BUILD_FLAGS="${BUILD_FLAGS} --with-cc-opt='-DNGX_LINKED_LIST_COOKIES=1'"
+          BUILD_FLAGS="${BUILD_FLAGS} --with-cc-opt='-DNGX_LINKED_LIST_COOKIES=1'"
         fi
-        ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module ${BUILD_FLAGS}
         
-    - name: Run make
+        ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module ${BUILD_FLAGS}
+
+    - name: Make Modules
       working-directory: ./nginx
       run: make modules
 
diff --git a/Dockerfile b/Dockerfile
deleted file mode 100644
index 4f2db13..0000000
--- a/Dockerfile
+++ /dev/null
@@ -1,59 +0,0 @@
-ARG NGINX_VERSION
-ARG SOURCE_HASH
-
-
-FROM debian:bullseye-slim as ngx_http_auth_jwt_builder_base
-LABEL stage=ngx_http_auth_jwt_builder
-RUN <<`
-apt-get update
-apt-get install -y curl build-essential
-`
-
-
-FROM ngx_http_auth_jwt_builder_base as ngx_http_auth_jwt_builder_module
-LABEL stage=ngx_http_auth_jwt_builder
-ENV LD_LIBRARY_PATH=/usr/local/lib
-ARG NGINX_VERSION
-RUN <<`
-apt-get install -y libjwt-dev libjwt0 libjansson-dev libjansson4 libpcre2-dev zlib1g-dev libpcre3-dev
-mkdir -p /root/build/ngx-http-auth-jwt-module
-`
-WORKDIR /root/build/ngx-http-auth-jwt-module
-ARG SOURCE_HASH
-RUN echo "Source Hash: ${SOURCE_HASH}"
-ADD config ./
-ADD src/*.h src/*.c ./src/
-WORKDIR /root/build
-RUN <<`
-mkdir nginx
-curl -O http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
-tar -xzf nginx-${NGINX_VERSION}.tar.gz --strip-components 1 -C nginx
-`
-WORKDIR /root/build/nginx
-RUN <<`
-BUILD_FLAGS=''
-MAJ=$(echo ${NGINX_VERSION} | cut -f1 -d.)
-MIN=$(echo ${NGINX_VERSION} | cut -f2 -d.)
-REV=$(echo ${NGINX_VERSION} | cut -f3 -d.)
-
-# NGINX 1.23.0+ changes cookies to use a linked list, and renames `cookies` to `cookie`
-if [ "${MAJ}" -gt 1 ] || [ "${MAJ}" -eq 1 -a "${MIN}" -ge 23 ]; then
-	BUILD_FLAGS="${BUILD_FLAGS} --with-cc-opt='-DNGX_LINKED_LIST_COOKIES=1'"
-fi
-
-./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module ${BUILD_FLAGS}
-make modules
-`
-
-
-FROM nginx:${NGINX_VERSION} AS ngx_http_auth_jwt_builder_nginx
-LABEL stage=
-RUN rm /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh /etc/nginx/conf.d/default.conf
-RUN <<`
-apt-get update
-apt-get -y install libjansson4 libjwt0
-cd /etc/nginx
-sed -ri '/pid\s+\/var\/run\/nginx\.pid;$/a load_module \/usr\/lib64\/nginx\/modules\/ngx_http_auth_jwt_module\.so;' nginx.conf
-`
-LABEL maintainer="TeslaGov" email="developers@teslagov.com"
-COPY --from=ngx_http_auth_jwt_builder_module /root/build/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/
diff --git a/nginx.dockerfile b/nginx.dockerfile
new file mode 100644
index 0000000..21c7460
--- /dev/null
+++ b/nginx.dockerfile
@@ -0,0 +1,136 @@
+ARG BASE_IMAGE
+ARG NGINX_VERSION
+
+
+FROM ${BASE_IMAGE} as ngx_http_auth_jwt_builder_base
+LABEL stage=ngx_http_auth_jwt_builder
+RUN <<`
+apt-get update
+apt-get install -y curl build-essential
+`
+
+
+FROM ngx_http_auth_jwt_builder_base as ngx_http_auth_jwt_builder_module
+LABEL stage=ngx_http_auth_jwt_builder
+ENV PATH "${PATH}:/etc/nginx"
+ENV LD_LIBRARY_PATH=/usr/local/lib
+ARG NGINX_VERSION
+RUN <<`
+	set -e
+	apt-get install -y libjwt-dev libjwt0 libjansson-dev libjansson4 libpcre2-dev zlib1g-dev libpcre3-dev
+	mkdir -p /root/build/ngx-http-auth-jwt-module
+`
+WORKDIR /root/build/ngx-http-auth-jwt-module
+ADD config ./
+ADD src/*.h src/*.c ./src/
+WORKDIR /root/build
+RUN <<`
+	set -e
+	mkdir nginx
+	curl -O http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
+	tar -xzf nginx-${NGINX_VERSION}.tar.gz --strip-components 1 -C nginx
+`
+WORKDIR /root/build/nginx
+RUN <<`
+	set -e
+	BUILD_FLAGS=''
+	MAJ=$(echo ${NGINX_VERSION} | cut -f1 -d.)
+	MIN=$(echo ${NGINX_VERSION} | cut -f2 -d.)
+	REV=$(echo ${NGINX_VERSION} | cut -f3 -d.)
+
+	# NGINX 1.23.0+ changes cookies to use a linked list, and renames `cookies` to `cookie`
+	if [ "${MAJ}" -gt 1 ] || [ "${MAJ}" -eq 1 -a "${MIN}" -ge 23 ]; then
+		BUILD_FLAGS="${BUILD_FLAGS} --with-cc-opt='-DNGX_LINKED_LIST_COOKIES=1'"
+	fi
+
+	./configure \
+    --prefix=/etc/nginx \
+		--sbin-path=/usr/sbin/nginx \
+		--modules-path=/usr/lib64/nginx/modules \
+		--conf-path=/etc/nginx/nginx.conf \
+		--error-log-path=/var/log/nginx/error.log \
+		--http-log-path=/var/log/nginx/access.log \
+		--pid-path=/var/run/nginx.pid \
+		--lock-path=/var/run/nginx.lock \
+		--http-client-body-temp-path=/var/cache/nginx/client_temp \
+		--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
+		--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
+		--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
+		--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
+		--user=nginx \
+		--group=nginx \
+		--with-compat \
+		--with-debug \
+		--with-file-aio \
+		--with-threads \
+		--with-http_addition_module \
+		--with-http_auth_request_module \
+		--with-http_dav_module \
+		--with-http_flv_module \
+		--with-http_gunzip_module \
+		--with-http_gzip_static_module \
+		--with-http_mp4_module \
+		--with-http_random_index_module \
+		--with-http_realip_module \
+		--with-http_secure_link_module \
+		--with-http_slice_module \
+		--with-http_ssl_module \
+		--with-http_stub_status_module \
+		--with-http_sub_module \
+		--with-http_v2_module \
+		--with-mail \
+		--with-mail_ssl_module \
+		--with-stream \
+		--with-stream_realip_module \
+		--with-stream_ssl_module \
+		--with-stream_ssl_preread_module \
+		--with-cc-opt='-g -O2 -ffile-prefix-map=/data/builder/debuild/nginx-1.25.4/debian/debuild-base/nginx-1.25.4=. -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' \
+		--with-ld-opt='-Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie' \
+		--add-dynamic-module=../ngx-http-auth-jwt-module \
+		${BUILD_FLAGS}
+		# --with-openssl=/usr/local \
+`
+RUN make modules
+RUN make install
+WORKDIR /usr/lib64/nginx/modules
+RUN	cp /root/build/nginx/objs/ngx_http_auth_jwt_module.so .
+RUN rm -rf /root/build
+RUN adduser --system --no-create-home --shell /bin/false --group --disabled-login nginx
+RUN mkdir -p /var/cache/nginx /var/log/nginx
+WORKDIR /etc/nginx
+
+FROM ngx_http_auth_jwt_builder_module AS ngx_http_auth_jwt_nginx
+LABEL maintainer="TeslaGov" email="developers@teslagov.com"
+ARG NGINX_VERSION
+RUN <<`
+	set -e
+
+	apt-get update
+	apt-get install -y libjansson4 libjwt0
+	apt-get clean
+`
+COPY <<` /etc/nginx/nginx.conf
+user nginx;
+pid /var/run/nginx.pid;
+
+load_module /usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so;
+
+worker_processes 1;
+
+events {
+	worker_connections 1024;
+}
+
+http {
+	include mime.types;
+	default_type application/octet-stream;
+
+	log_format main '$$remote_addr - $$remote_user [$$time_local] "$$request" '
+	                '$$status $$body_bytes_sent "$$http_referer" '
+	                '"$$http_user_agent" "$$http_x_forwarded_for"';
+
+	access_log /var/log/nginx/access.log main;
+	include conf.d/*.conf;
+}
+`
+ENTRYPOINT ["nginx", "-g", "daemon off;"]
diff --git a/openssl.dockerfile b/openssl.dockerfile
new file mode 100644
index 0000000..45140cc
--- /dev/null
+++ b/openssl.dockerfile
@@ -0,0 +1,37 @@
+ARG BASE_IMAGE
+
+FROM ${BASE_IMAGE}
+ARG SRC_DIR=/tmp/openssl-src
+ARG OUT_DIR=/usr/local/.openssl
+ARG SSL_VERSION
+RUN <<`
+    set -e
+    apt-get update
+    apt-get install -y curl build-essential libssl-dev libz-dev
+    apt-get remove -y openssl
+    apt-get clean
+`
+WORKDIR ${SRC_DIR}
+RUN <<`
+    set -e
+    curl --silent -O https://www.openssl.org/source/openssl-${SSL_VERSION}.tar.gz
+    tar -xf openssl-${SSL_VERSION}.tar.gz --strip-components=1
+`
+RUN ./config --prefix=${OUT_DIR} --openssldir=${OUT_DIR} shared zlib
+RUN <<`
+    set -e
+    make
+    make test
+    make install
+`
+RUN <<`
+    set -e
+    echo "${OUT_DIR}/lib" > /etc/ld.so.conf.d/openssl-${SSL_VERSION}.conf
+    ldconfig
+
+    ln -sf ${OUT_DIR}/bin/openssl /usr/bin/openssl
+    ln -sf ${OUT_DIR}/lib64/libssl.so.3 /lib/x86_64-linux-gnu/libssl.so.3
+    ln -sf ${OUT_DIR}/lib64/libcrypto.so.3 /lib/x86_64-linux-gnu/libcrypto.so.3
+`
+WORKDIR /
+#RUN rm -rf ${SRC_DIR}
\ No newline at end of file
diff --git a/scripts.sh b/scripts.sh
index e3fb254..421a4cb 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -1,40 +1,72 @@
 #!/bin/bash -eu
 
+MAGENTA='\u001b[35m'
 BLUE='\033[0;34m'
 GREEN='\033[0;32m'
 RED='\033[0;31m'
 NC='\033[0m'
 
+# supported SSL versions
+SSL_VERSION_1_1_1w='1.1.1w'
+SSL_VERSION_3_0_11='3.0.11'
+SSL_VERSION_3_2_1='3.2.1'
+SSL_VERSIONS=(${SSL_VERSION_3_2_1})
+SSL_VERSION=${SSL_VERSION:-$SSL_VERSION_3_0_11}
+
+declare -A SSL_IMAGE_MAP
+SSL_IMAGE_MAP[$SSL_VERSION_1_1_1w]="bullseye-slim:openssl-${SSL_VERSION_1_1_1w}"
+SSL_IMAGE_MAP[$SSL_VERSION_3_0_11]="bookworm-slim:openssl-${SSL_VERSION_3_0_11}"
+SSL_IMAGE_MAP[$SSL_VERSION_3_2_1]="bookworm-slim:openssl-${SSL_VERSION_3_2_1}"
+
 # supported NGINX versions -- for binary distribution
-NGINX_VERSION_MAINLINE='1.25.4'
+NGINX_VERSION_LEGACY_1='1.20.2'
+NGINX_VERSION_LEGACY_2='1.22.1'
 NGINX_VERSION_STABLE='1.24.0'
-NGINX_VERSION_LEGACY_1='1.22.1'
-NGINX_VERSION_LEGACY_2='1.20.2'
+NGINX_VERSION_MAINLINE='1.25.4'
+NGINX_VERSIONS=(${NGINX_VERSION_LEGACY_1} ${NGINX_VERSION_LEGACY_2} ${NGINX_VERSION_STABLE} ${NGINX_VERSION_MAINLINE})
+NGINX_VERSION=${NGINX_VERSION:-${NGINX_VERSION_STABLE}}
 
-export ORG_NAME=${ORG_NAME:-teslagov}
-export IMAGE_NAME=${IMAGE_NAME:-jwt-nginx}
-export FULL_IMAGE_NAME=${ORG_NAME}/${IMAGE_NAME}
-export CONTAINER_NAME_PREFIX=${CONTAINER_NAME_PREFIX:-jwt-nginx-test}
-export NGINX_VERSION=${NGINX_VERSION:-${NGINX_VERSION_STABLE}}
+IMAGE_NAME=${IMAGE_NAME:-nginx-auth-jwt}
+FULL_IMAGE_NAME=${ORG_NAME:-teslagov}/${IMAGE_NAME}
+
+TEST_CONTAINER_NAME_PREFIX="${IMAGE_NAME}-test"
 
 all() {
 	build_module
-	build_test_runner
-	test
+	build_test
+	test_all
+}
+
+verify_and_build_base_image() {
+	local image=${SSL_IMAGE_MAP[$SSL_VERSION]}
+	local baseImage=${image%%:*}
+	
+	if [ -z ${image} ]; then
+		echo "Base image not set for SSL version :${SSL_VERSION}"
+		exit 1
+	else
+		printf "${MAGENTA}Building base image for SSL ${SSL_VERSION}...${NC}\n"
+		docker image build \
+		  --build-arg BASE_IMAGE=debian:${baseImage} \
+			--build-arg SSL_VERSION=${SSL_VERSION} \
+			-f openssl.dockerfile \
+			-t ${image} .
+	fi
 }
 
 build_module() {
 	local dockerArgs=${1:-}
-	local sourceHash=$(get_hash config src/*)
-
-	printf "${BLUE}Pulling images...${NC}\n"
-	docker image pull debian:bullseye-slim
-	docker image pull nginx:${NGINX_VERSION}
+	local baseImage=${SSL_IMAGE_MAP[$SSL_VERSION]}
+	
+	verify_and_build_base_image
 
-	printf "${BLUE}Building module for NGINX ${NGINX_VERSION}...${NC}\n"
-	docker image build -t ${FULL_IMAGE_NAME}:latest -t ${FULL_IMAGE_NAME}:${NGINX_VERSION} ${dockerArgs} \
+	printf "${MAGENTA}Building module for NGINX ${NGINX_VERSION}...${NC}\n"
+	docker image build \
+		-f nginx.dockerfile \
+		-t ${FULL_IMAGE_NAME}:${NGINX_VERSION} \
+	  --build-arg BASE_IMAGE=${baseImage} \
 		--build-arg NGINX_VERSION=${NGINX_VERSION} \
-		--build-arg SOURCE_HASH=${sourceHash} .
+		${dockerArgs} .
 	
 	if [ "$?" -ne 0 ]; then
 		printf "${RED}✘ Build failed ${NC}\n"
@@ -55,7 +87,7 @@ clean_module() {
 start_nginx() {
 	local port=$(get_port)
 
-	printf "${BLUE}Starting NGINX container (${IMAGE_NAME}) on port ${port}...${NC}\n"
+	printf "${MAGENTA}Starting NGINX container (${IMAGE_NAME}) on port ${port}...${NC}\n"
 	docker run --rm --name "${IMAGE_NAME}" -d -p ${port}:80 ${FULL_IMAGE_NAME} >/dev/null
 }
 
@@ -72,7 +104,7 @@ cp_bin() {
 		stopContainer=1
 	fi
 
-	printf "${BLUE}Copying binaries to: ${destDir}${NC}\n"
+	printf "${MAGENTA}Copying binaries to: ${destDir}${NC}\n"
 	rm -rf ${destDir}/*
 	mkdir -p ${destDir}
 	docker exec "${IMAGE_NAME}" sh -c "cd /; tar -chf - \
@@ -81,7 +113,7 @@ cp_bin() {
 		usr/lib/x86_64-linux-gnu/libjwt.*" | tar -xf - -C ${destDir} &>/dev/null
 	
 	if [ $stopContainer ]; then
-		printf "${BLUE}Stopping NGINX container (${IMAGE_NAME})...${NC}\n"
+		printf "${MAGENTA}Stopping NGINX container (${IMAGE_NAME})...${NC}\n"
 		stop_nginx
 	fi
 }
@@ -93,7 +125,7 @@ make_release() {
 	
 	NGINX_VERSION=${2}
 
-	printf "${BLUE}Making release for version ${moduleVersion} for NGINX ${NGINX_VERSION}...${NC}\n"
+	printf "${MAGENTA}Making release for version ${moduleVersion} for NGINX ${NGINX_VERSION}...${NC}\n"
 
 	rebuild_module
 	rebuild_test_runner
@@ -110,61 +142,88 @@ make_release() {
 #   See: https://nginx.org/en/download.html
 make_releases() {
 	local moduleVersion=$(git describe --tags --abbrev=0)
-	local nginxVersions=(${NGINX_VERSION_MAINLINE} ${NGINX_VERSION_STABLE} ${NGINX_VERSION_LEGACY_1} ${NGINX_VERSION_LEGACY_2})
 
 	rm -rf release/*
 
-	for v in ${nginxVersions[@]}; do
+	for v in ${NGINX_VERSIONS[@]}; do
 		make_release ${moduleVersion} ${v}
 	done
 }
 
-
-build_test_runner() {
+build_test() {
 	local dockerArgs=${1:-}
-	local configHash=$(get_hash $(find test -type f -not -name 'test.sh' -not -name '*.yml' -not -name 'Dockerfile*'))
-	local sourceHash=$(get_hash test/test.sh)
 	local port=$(get_port)
+	local sslPort=$(get_port $((port + 1)))
+	local runnerBaseImage=${SSL_IMAGE_MAP[$SSL_VERSION]}
 	
-	printf "${BLUE}Building test runner using port ${port}...${NC}\n"
-	docker compose -f ./test/docker-compose-test.yml build ${dockerArgs} \
-		--build-arg CONFIG_HASH=${configHash}\
-		--build-arg SOURCE_HASH=${sourceHash} \
-		--build-arg PORT=${port}
+	export TEST_CONTAINER_NAME_PREFIX
+	export FULL_IMAGE_NAME
+	export NGINX_VERSION
+
+	printf "${MAGENTA}Building test NGINX & runner using port ${port}...${NC}\n"
+	docker compose \
+	  -p ${TEST_CONTAINER_NAME_PREFIX} \
+	  -f ./test/docker-compose-test.yml build \
+	  --build-arg RUNNER_BASE_IMAGE=${runnerBaseImage} \
+		--build-arg PORT=${port} \
+		--build-arg SSL_PORT=${sslPort} \
+		 ${dockerArgs}
 }
 
-rebuild_test_runner() {
-	build_test_runner --no-cache
+rebuild_test() {
+	build_test --no-cache
+}
+
+test_all() {
+	for SSL_VERSION in "${SSL_VERSIONS[@]}"; do
+		for NGINX_VERSION in "${NGINX_VERSIONS[@]}"; do
+			test
+		done
+	done
 }
 
 test() {
-	build_test_runner
+	build_module
+	build_test
 
-	printf "${BLUE}Running tests...${NC}\n"
-	docker compose -f ./test/docker-compose-test.yml up --no-start
-	docker start ${CONTAINER_NAME_PREFIX}
-	
-	if [ "$(docker container inspect -f '{{.State.Running}}' ${CONTAINER_NAME_PREFIX})" != "true" ]; then
-		printf "${RED}Failed to start NGINX test container. See logs below:\n"
-		docker logs ${CONTAINER_NAME_PREFIX}
-		printf "${NC}\n"
-	else
-		test_now
-	fi
+	printf "${MAGENTA}Running tests...${NC}\n"
+	docker compose \
+	  -p ${TEST_CONTAINER_NAME_PREFIX} \
+		-f ./test/docker-compose-test.yml up \
+		--no-start
+
+
+	trap 'docker compose -f ./test/docker-compose-test.yml down' 0
 
-	docker compose -f ./test/docker-compose-test.yml down
+	test_now
 }
 
 test_now() {
-	docker start -a ${CONTAINER_NAME_PREFIX}-runner
-}
+	nginxContainerName="${TEST_CONTAINER_NAME_PREFIX}-nginx"
+	runnerContainerName="${TEST_CONTAINER_NAME_PREFIX}-runner"
 
-get_hash() {
-	sha1sum $@ | sed -E 's|\s+|:|' | tr '\n' ' ' | sha1sum | head -c 40
+	docker start ${nginxContainerName}
+	
+	if [ "$(docker container inspect -f '{{.State.Running}}' ${nginxContainerName})" != "true" ]; then
+		printf "${RED}Failed to start container \"${nginxContainerName}\". See logs below:\n"
+		docker logs ${nginxContainerName}
+		printf "${NC}\n"
+		return
+	fi
+
+	docker start -a ${runnerContainerName}
+
+	echo
+	echo "Tests were executed with the following options:"
+	echo "    SSL Version: ${SSL_VERSION}"
+	echo "  NGINX Version: ${NGINX_VERSION}"
 }
 
 get_port() {
-	for p in $(seq 8000 8100); do
+	startPort=${1:-8000}
+	endPort=$((startPort + 100))
+
+	for p in $(seq ${startPort} ${endPort}); do
 		if ! ss -ln | grep -q ":${p} "; then
 			echo ${p}
 			break
diff --git a/test/Dockerfile-test-nginx b/test/Dockerfile-test-nginx
deleted file mode 100644
index 5f01436..0000000
--- a/test/Dockerfile-test-nginx
+++ /dev/null
@@ -1,15 +0,0 @@
-ARG BASE_IMAGE
-ARG CONFIG_HASH
-ARG PORT
-
-FROM ${BASE_IMAGE} as NGINX
-ARG CONFIG_HASH
-ARG PORT
-RUN echo "Config Hash: ${CONFIG_HASH}"
-COPY /docker-entrypoint.d/* /docker-entrypoint.d/
-COPY /etc/nginx/conf.d/test.conf /etc/nginx/conf.d/test.conf
-COPY /etc/nginx/rsa_key_2048-pub.pem /etc/nginx/rsa-key.conf
-COPY /etc/nginx/ec_key_256-pub.pem /etc/nginx/ec-256-key.conf
-COPY /etc/nginx/ec_key_384-pub.pem /etc/nginx/ec-384-key.conf
-COPY /etc/nginx/ec_key_521-pub.pem /etc/nginx/ec-521-key.conf
-RUN sed -i "s|%{PORT}|${PORT}|" /etc/nginx/conf.d/test.conf
diff --git a/test/Dockerfile-test-runner b/test/Dockerfile-test-runner
deleted file mode 100644
index c8cbff2..0000000
--- a/test/Dockerfile-test-runner
+++ /dev/null
@@ -1,13 +0,0 @@
-ARG SOURCE_HASH
-ARG PORT
-
-FROM alpine:3.7 AS test-base
-RUN apk add curl bash
-
-FROM test-base AS test
-ARG SOURCE_HASH
-ARG PORT
-ENV PORT=${PORT}
-RUN echo "Source Hash: ${SOURCE_HASH}"
-COPY test.sh .
-CMD ./test.sh ${PORT}
diff --git a/test/docker-compose-test.yml b/test/docker-compose-test.yml
index eff2460..3c0e9be 100644
--- a/test/docker-compose-test.yml
+++ b/test/docker-compose-test.yml
@@ -3,23 +3,20 @@ version: '3.3'
 services:
 
   nginx:
-    container_name: ${CONTAINER_NAME_PREFIX}
+    container_name: ${TEST_CONTAINER_NAME_PREFIX}-nginx
     build:
       context: .
-      dockerfile: Dockerfile-test-nginx
+      dockerfile: test-nginx.dockerfile
       args:
-        BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION:-latest}
-    command: [nginx-debug, '-g', 'daemon off;']
+        BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION}
     logging:
       driver: ${LOG_DRIVER:-journald}
 
   runner:
-    container_name: ${CONTAINER_NAME_PREFIX}-runner
+    container_name: ${TEST_CONTAINER_NAME_PREFIX}-runner
     build:
       context: .
-      dockerfile: Dockerfile-test-runner
-    environment:
-      BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION:-latest}
+      dockerfile: test-runner.dockerfile
     
     depends_on:
       - nginx
\ No newline at end of file
diff --git a/test/docker-entrypoint.d/10-nginx-test.sh b/test/docker-entrypoint.d/10-nginx-test.sh
deleted file mode 100755
index 0bf8791..0000000
--- a/test/docker-entrypoint.d/10-nginx-test.sh
+++ /dev/null
@@ -1 +0,0 @@
-nginx -t
\ No newline at end of file
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
index 3421b5b..229d545 100644
--- a/test/etc/nginx/conf.d/test.conf
+++ b/test/etc/nginx/conf.d/test.conf
@@ -3,7 +3,13 @@ access_log /var/log/nginx/access.log;
 
 server {
     listen %{PORT};
+    listen %{SSL_PORT} ssl;
     server_name localhost;
+
+    ssl_certificate /etc/nginx/test.crt;
+    ssl_certificate_key /etc/nginx/test.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
     
     auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
     auth_jwt_loginurl "https://example.com/login";
@@ -212,7 +218,7 @@ vXjq39xtcIBRTO1c2zs=
         auth_jwt_location HEADER=Authorization;
         auth_jwt_algorithm RS256;
         auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
+        auth_jwt_keyfile_path "/etc/nginx/rsa_key_2048-pub.pem";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -224,7 +230,7 @@ vXjq39xtcIBRTO1c2zs=
         auth_jwt_location HEADER=Authorization;
         auth_jwt_algorithm RS384;
         auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
+        auth_jwt_keyfile_path "/etc/nginx/rsa_key_2048-pub.pem";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -236,7 +242,7 @@ vXjq39xtcIBRTO1c2zs=
         auth_jwt_location HEADER=Authorization;
         auth_jwt_algorithm RS512;
         auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/rsa-key.conf";
+        auth_jwt_keyfile_path "/etc/nginx/rsa_key_2048-pub.pem";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -248,7 +254,7 @@ vXjq39xtcIBRTO1c2zs=
         auth_jwt_location HEADER=Authorization;
         auth_jwt_algorithm ES256;
         auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/ec-256-key.conf";
+        auth_jwt_keyfile_path "/etc/nginx/ec_key_256-pub.pem";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -260,7 +266,7 @@ vXjq39xtcIBRTO1c2zs=
         auth_jwt_location HEADER=Authorization;
         auth_jwt_algorithm ES384;
         auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/ec-384-key.conf";
+        auth_jwt_keyfile_path "/etc/nginx/ec_key_384-pub.pem";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -272,7 +278,7 @@ vXjq39xtcIBRTO1c2zs=
         auth_jwt_location HEADER=Authorization;
         auth_jwt_algorithm ES512;
         auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/ec-521-key.conf";
+        auth_jwt_keyfile_path "/etc/nginx/ec_key_521-pub.pem";
 
         alias /usr/share/nginx/html/;
         try_files index.html =404;
@@ -390,4 +396,3 @@ vXjq39xtcIBRTO1c2zs=
         }
     }
 }
-
diff --git a/test/etc/nginx/test.crt b/test/etc/nginx/test.crt
new file mode 100644
index 0000000..fb406ba
--- /dev/null
+++ b/test/etc/nginx/test.crt
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIUMG9M4Itu0cOyX0+La+7huiIoX6YwDQYJKoZIhvcNAQEL
+BQAwcTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMRUwEwYDVQQHDAxG
+YWxscyBDaHVyY2gxHzAdBgNVBAoMFlRlc2xhIEdvdmVybm1lbnQsIEluYy4xFzAV
+BgNVBAsMDk5HSU5YIEF1dGggSldUMB4XDTI0MDMxNTE4MTM1MloXDTM0MDMxMzE4
+MTM1MlowcTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMRUwEwYDVQQH
+DAxGYWxscyBDaHVyY2gxHzAdBgNVBAoMFlRlc2xhIEdvdmVybm1lbnQsIEluYy4x
+FzAVBgNVBAsMDk5HSU5YIEF1dGggSldUMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAih41Ct5XgcSTz7ZVAjBb0t0z9Qae08aseoMEKJf7AmNqKtsvzeAw
+/DJxOWJR5VPtUWhFAmXxPfG2B6aiSIVJVpG9yzcdQlCvyJG7Ub4QCm5GXwpU+zDC
+qmD5ksz9QMdOzvRLypAU1ciZiCXjwpUnW+BZyZ9Tpmsxm6/gOzkd3rxoIbc9uXxp
+5o4n6k02EPSzLzUhkZnhLQrOAGUB7+q11FAU5eNMlTWC9gQUsbNaTVtKmM2eV9BA
+UHdX2GbkfFbN22l3Wey4oyNZWmye1ZFOPyBR+tyU3pofhb+R+hTFmeNBzrJq3i30
+Qi0B8AnulKdOjnTysPYjDTrN6xcVDWNmPQIDAQABo1MwUTAdBgNVHQ4EFgQUczdy
+7s64NJHNGsQTf/zwFnQe6LMwHwYDVR0jBBgwFoAUczdy7s64NJHNGsQTf/zwFnQe
+6LMwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAfcxCiz6ShHof
+lXiE2j+s556SM2n8oW/S1BSjFC2wF1uKVeMJA1gAaWObC3ElqffFlqTdCorhgRS/
+knWa+Sqe/jWBSgwLG/e5DvxXWjD7b7kZdAZNy9evs5nhVfcLT+GyvB/z5GdAFY7s
+xYmLrC07ubhHIL9h7lhNKbRr++o+BcClQBZKRO4fxBwXxqx/rHudjH87Wr61Ov52
+90xNjwcqvevY0skmPao5+oyxkURdKZualNxiOGMPpywkpJkfl8Az5xKAJhUMAtFR
+smhQduejEkcxfxtsiYgVoulI29GAsMr9zHps9zb5k0+SWIiSixjQ0CpRhLcNYu4F
+QPgLQLGwUQ==
+-----END CERTIFICATE-----
diff --git a/test/etc/nginx/test.key b/test/etc/nginx/test.key
new file mode 100644
index 0000000..13ec754
--- /dev/null
+++ b/test/etc/nginx/test.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCKHjUK3leBxJPP
+tlUCMFvS3TP1Bp7Txqx6gwQol/sCY2oq2y/N4DD8MnE5YlHlU+1RaEUCZfE98bYH
+pqJIhUlWkb3LNx1CUK/IkbtRvhAKbkZfClT7MMKqYPmSzP1Ax07O9EvKkBTVyJmI
+JePClSdb4FnJn1OmazGbr+A7OR3evGghtz25fGnmjifqTTYQ9LMvNSGRmeEtCs4A
+ZQHv6rXUUBTl40yVNYL2BBSxs1pNW0qYzZ5X0EBQd1fYZuR8Vs3baXdZ7LijI1la
+bJ7VkU4/IFH63JTemh+Fv5H6FMWZ40HOsmreLfRCLQHwCe6Up06OdPKw9iMNOs3r
+FxUNY2Y9AgMBAAECggEAAkwEggGp/xb67FCyDJ8rdimTZFPi9U7coUCN8HNI/qrf
+lTnfvox0oOUUqMMmIIQeS/HJ4ANvZe8GO3QkE8R5Sg7F0yjZL2tyTCNPgOMCMK8E
+mmHS58brHdrbm658C1ILnfmssjNmNueNbuW00Koa8imCsY2ZEW+L7vTKuMFqg6c+
+BDJxC4yoCPwSTVfcajjzI6FVfphE0pd8Ho/sE8vTqdmovh23+vgfNUq1L9Smvf7R
+YLM+hS1ouRP2BI5AN0sm04Kxd8MKPzuwCxteoZ9Y9YHyr1JeWGTTL0T24+LwUee/
+24zXZFrzpTgmtDYeEuVWsF5bP/fMS4Fctda3pdJMsQKBgQDCANjGDwwfSCCev2kl
+WdrFJywhn5hWLWFwlo/FwLOsFJtejaBwIDRQCMPZ74H+KMHwUnO3vTanKJWqDRP9
+CdMh94C1BqobRV6rN4HgA4Opxim1EyRWHV6ui41zokk2mJrwUzKkR8t9lt9EZKrk
+ZPyKER9A4hBqBmYvaYxodN8U1QKBgQC2QXUQq9j7niT7t4xMi0e9vnPLs0z1yUK9
+0nzKwTHDPflk3o2sKvH7199qVkc15JQ9DQ7NuYD7ezLbE3DJuVzpNDAfNXmfWHmp
+7ukdnxyn6ZCmzQY7/fTpJTEGKVQMVCgf2f5ANgxm5EmN0yWRMcEt1VXIwCisY56p
+o6nwv/1fyQKBgQCJBnIVyjEEszwfBBEvCX0kvVtFUGUXkSv+isl3onkFNPTcXuoP
+6B8q3FYAy1MkggMhTAthnqpIfLjhCCWzFspidl8Y/WEOq/uGsUjxQWowcr+onqGO
+lWX3oKfDIb/WaQkeb5UYRYFr7jE6LGQrt0xL9HX/rOxtBqIMIN/EM7ARFQKBgDAJ
+zMtaIFUh9+mJFafPRleS7X6RggV+yOKzqkTe6zjlCuk1Z+4rW6Df43lpyFdCKnh1
+CqPa805VyK/Jzf69pumo4c44EBiZ/2d1G2i9WZZAj+oHPE9vvq/9J5DSL98YB4Nt
+uABAvsAYB/Mj5lEA5kQoaPYDADWABH/+LXrRf/1RAoGAUvxPvmpkGMC+KdmjLam7
+CPC3+y4MZOyZ11BhOxLhd1K2qcQd9K7tkjUhNxRn5GVzpzOKeFJFtiih2uN+PBNJ
+oylPR03uk/7D52b1OYaJhs9bQkth//Qk935nyRM26C2vG4tQLfT/cFi5F53n0ZCQ
+7e8O6+QY0lZnpvsfnt8YIsM=
+-----END PRIVATE KEY-----
diff --git a/test/test-nginx.dockerfile b/test/test-nginx.dockerfile
new file mode 100644
index 0000000..c4a6104
--- /dev/null
+++ b/test/test-nginx.dockerfile
@@ -0,0 +1,18 @@
+ARG BASE_IMAGE
+ARG PORT
+ARG SSL_PORT
+
+FROM ${BASE_IMAGE} as NGINX
+ARG PORT
+ARG SSL_PORT
+COPY etc/ /etc/
+RUN sed -i "s|%{PORT}|${PORT}|" /etc/nginx/conf.d/test.conf
+RUN sed -i "s|%{SSL_PORT}|${SSL_PORT}|" /etc/nginx/conf.d/test.conf
+COPY <<` /usr/share/nginx/html/index.html
+<html>
+  <head>Test</head>
+  <body>
+    <h1>NGINX Auth-JWT Module Test</h1>
+  </body>
+</html>
+`
diff --git a/test/test-runner.dockerfile b/test/test-runner.dockerfile
new file mode 100644
index 0000000..0aca095
--- /dev/null
+++ b/test/test-runner.dockerfile
@@ -0,0 +1,16 @@
+ARG RUNNER_BASE_IMAGE
+ARG PORT
+ARG SSL_PORT
+
+FROM ${RUNNER_BASE_IMAGE}
+ARG PORT
+ARG SSL_PORT
+ENV PORT=${PORT}
+ENV SSL_PORT=${SSL_PORT}
+RUN <<`
+  set -e
+  apt-get update
+  apt-get install -y curl bash
+`
+COPY test.sh .
+CMD ./test.sh ${PORT} ${SSL_PORT}
diff --git a/test/test.sh b/test/test.sh
index 5671b8f..f54e0de 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -1,7 +1,6 @@
-#!/bin/bash -u
+#!/bin/bash -eu
 
 # set a test # here to execute only that test and output additional info
-PORT=${1:-8000}
 DEBUG=
 
 RED='\e[31m'
@@ -18,35 +17,40 @@ run_test () {
 
   if [ "${DEBUG}" == '' ] || [ ${DEBUG} == ${NUM_TESTS} ]; then
     local OPTIND;
-    local name=''
-    local path=''
-    local expectedCode=''
-    local expectedResponseRegex=''
-    local extraCurlOpts=''
-    local curlCommand=''
-    local exitCode=''
-    local response=''
+    local name=
+    local path=
+    local expectedCode=
+    local expectedResponseRegex=
+    local extraCurlOpts=
+    local scheme='http'
+    local port=${PORT}
+    local curlCommand=
+    local exitCode=
+    local response=
     local testNum="${GRAY}${NUM_TESTS}${NC}\t"
 
-    while getopts "n:p:r:c:x:" option; do
+    while getopts "n:sp:r:c:x:" option; do
       case $option in
-      n)
-        name=$OPTARG;;
-      p)
-        path=$OPTARG;;
-      c)
-        expectedCode=$OPTARG;;
-      r)
-        expectedResponseRegex=$OPTARG;;
-      x)
-        extraCurlOpts=$OPTARG;;
-      \?) # Invalid option
-        printf "Error: Invalid option\n";
-        exit;;
+        n)
+          name=$OPTARG;;
+        s)
+          scheme='https'
+          port=${SSL_PORT};;
+        p)
+          path=$OPTARG;;
+        c)
+          expectedCode=$OPTARG;;
+        r)
+          expectedResponseRegex=$OPTARG;;
+        x)
+          extraCurlOpts=$OPTARG;;
+        \?) # Invalid option
+          printf "Error: Invalid option\n";
+          exit;;
       esac
     done
 
-    curlCommand="curl -s -v http://nginx:${PORT}${path} -H 'Cache-Control: no-cache' ${extraCurlOpts} 2>&1"
+    curlCommand="curl -skv ${scheme}://nginx:${port}${path} -H 'Cache-Control: no-cache' ${extraCurlOpts} 2>&1"
     response=$(eval "${curlCommand}")
     exitCode=$?
     
@@ -108,10 +112,20 @@ main() {
   run_test -n 'when auth disabled, should return 200' \
            -p '/' \
            -c '200'
+
+  run_test -s \
+           -n '[SSL] when auth disabled, should return 200' \
+           -p '/' \
+           -c '200'
   
   run_test -n 'when auth enabled with default algorithm and no JWT in Authorization header, returns 302' \
            -p '/secure/auth-header/default' \
            -c '302'
+  
+  run_test -n '[SSL] when auth enabled with default algorithm and no JWT in Authorization header, returns 302' \
+           -s \
+           -p '/secure/auth-header/default' \
+           -c '302'
 
   run_test -n 'when auth enabled with default algorithm with no redirect and Authorization header missing Bearer, should return 200' \
            -p '/secure/auth-header/default/no-redirect' \

From 02f4e17eb84dd2de78d5cedca8f0b4f8247470e3 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Wed, 28 Aug 2024 12:12:07 -0400
Subject: [PATCH 104/130] case-insenitive Bearer check #134 (#135)

---
 openssl.dockerfile             | 14 +++++++-------
 scripts.sh                     |  6 +++---
 src/ngx_http_auth_jwt_module.c |  2 +-
 test/docker-compose-test.yml   |  2 --
 test/test.sh                   |  6 ++++++
 5 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/openssl.dockerfile b/openssl.dockerfile
index 45140cc..d8bb293 100644
--- a/openssl.dockerfile
+++ b/openssl.dockerfile
@@ -1,9 +1,9 @@
-ARG BASE_IMAGE
+ARG BASE_IMAGE=debian:bookworm-slim
 
 FROM ${BASE_IMAGE}
-ARG SRC_DIR=/tmp/openssl-src
-ARG OUT_DIR=/usr/local/.openssl
-ARG SSL_VERSION
+ARG SSL_VERSION=3.2.1
+ENV SRC_DIR=/tmp/openssl-src
+ENV OUT_DIR=/usr/local/.openssl
 RUN <<`
     set -e
     apt-get update
@@ -13,8 +13,8 @@ RUN <<`
 `
 WORKDIR ${SRC_DIR}
 RUN <<`
-    set -e
-    curl --silent -O https://www.openssl.org/source/openssl-${SSL_VERSION}.tar.gz
+    set -ex
+    curl --silent -LO https://www.openssl.org/source/openssl-${SSL_VERSION}.tar.gz
     tar -xf openssl-${SSL_VERSION}.tar.gz --strip-components=1
 `
 RUN ./config --prefix=${OUT_DIR} --openssldir=${OUT_DIR} shared zlib
@@ -34,4 +34,4 @@ RUN <<`
     ln -sf ${OUT_DIR}/lib64/libcrypto.so.3 /lib/x86_64-linux-gnu/libcrypto.so.3
 `
 WORKDIR /
-#RUN rm -rf ${SRC_DIR}
\ No newline at end of file
+RUN rm -rf ${SRC_DIR}
\ No newline at end of file
diff --git a/scripts.sh b/scripts.sh
index 421a4cb..6f109d9 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -40,13 +40,13 @@ all() {
 verify_and_build_base_image() {
 	local image=${SSL_IMAGE_MAP[$SSL_VERSION]}
 	local baseImage=${image%%:*}
-	
+
 	if [ -z ${image} ]; then
 		echo "Base image not set for SSL version :${SSL_VERSION}"
 		exit 1
 	else
-		printf "${MAGENTA}Building base image for SSL ${SSL_VERSION}...${NC}\n"
-		docker image build \
+		printf "${MAGENTA}Building ${baseImage} base image for SSL ${SSL_VERSION}...${NC}\n"
+		docker buildx build \
 		  --build-arg BASE_IMAGE=debian:${baseImage} \
 			--build-arg SSL_VERSION=${SSL_VERSION} \
 			-f openssl.dockerfile \
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index 85a646d..e21560c 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -630,7 +630,7 @@ static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location)
     {
       static const char *BEARER_PREFIX = "Bearer ";
 
-      if (ngx_strncmp(jwtHeaderVal->value.data, BEARER_PREFIX, strlen(BEARER_PREFIX)) == 0)
+      if (ngx_strncasecmp(jwtHeaderVal->value.data, (u_char *)BEARER_PREFIX, strlen(BEARER_PREFIX)) == 0)
       {
         ngx_str_t jwtHeaderValWithoutBearer = jwtHeaderVal->value;
 
diff --git a/test/docker-compose-test.yml b/test/docker-compose-test.yml
index 3c0e9be..14c88da 100644
--- a/test/docker-compose-test.yml
+++ b/test/docker-compose-test.yml
@@ -1,5 +1,3 @@
-version: '3.3'
-
 services:
 
   nginx:
diff --git a/test/test.sh b/test/test.sh
index f54e0de..2bf9cb3 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -143,6 +143,12 @@ main() {
            -r "< Test-Authorization: Bearer ${JWT_HS256_VALID}" \
            -x "--header \"Authorization: Bearer ${JWT_HS256_VALID}\""
 
+  run_test -n 'when auth enabled with Authorization header with Bearer, lower-case "bearer" should be accepted' \
+           -p '/secure/auth-header/default/proxy-header' \
+           -c '200' \
+           -r "< Test-Authorization: bearer ${JWT_HS256_VALID}" \
+           -x "--header \"Authorization: bearer ${JWT_HS256_VALID}\""
+
   run_test -n 'when auth enabled with default algorithm and no JWT cookie, returns 302' \
            -p '/secure/cookie/default' \
            -c '302'

From 272c02e2302208993df4f99a7f1751a793d16662 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Wed, 28 Aug 2024 12:31:26 -0400
Subject: [PATCH 105/130] fix release script

---
 scripts.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index 6f109d9..f6863f0 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -61,7 +61,7 @@ build_module() {
 	verify_and_build_base_image
 
 	printf "${MAGENTA}Building module for NGINX ${NGINX_VERSION}...${NC}\n"
-	docker image build \
+	docker buildx build \
 		-f nginx.dockerfile \
 		-t ${FULL_IMAGE_NAME}:${NGINX_VERSION} \
 	  --build-arg BASE_IMAGE=${baseImage} \
@@ -88,7 +88,7 @@ start_nginx() {
 	local port=$(get_port)
 
 	printf "${MAGENTA}Starting NGINX container (${IMAGE_NAME}) on port ${port}...${NC}\n"
-	docker run --rm --name "${IMAGE_NAME}" -d -p ${port}:80 ${FULL_IMAGE_NAME} >/dev/null
+	docker run --rm --name "${IMAGE_NAME}" -d -p ${port}:80 ${FULL_IMAGE_NAME}:${NGINX_VERSION} >/dev/null
 }
 
 stop_nginx() {
@@ -128,7 +128,7 @@ make_release() {
 	printf "${MAGENTA}Making release for version ${moduleVersion} for NGINX ${NGINX_VERSION}...${NC}\n"
 
 	rebuild_module
-	rebuild_test_runner
+	rebuild_test
 	test
 	cp_bin
 

From c5882b0c2106bc478af174bb36ea956a99038127 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 14 Oct 2024 10:43:53 -0400
Subject: [PATCH 106/130] fix Docker warnings

---
 nginx.dockerfile           | 6 ++----
 test/test-nginx.dockerfile | 2 +-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/nginx.dockerfile b/nginx.dockerfile
index 21c7460..c0e6c02 100644
--- a/nginx.dockerfile
+++ b/nginx.dockerfile
@@ -1,16 +1,14 @@
 ARG BASE_IMAGE
 ARG NGINX_VERSION
 
-
-FROM ${BASE_IMAGE} as ngx_http_auth_jwt_builder_base
+FROM ${BASE_IMAGE} AS ngx_http_auth_jwt_builder_base
 LABEL stage=ngx_http_auth_jwt_builder
 RUN <<`
 apt-get update
 apt-get install -y curl build-essential
 `
 
-
-FROM ngx_http_auth_jwt_builder_base as ngx_http_auth_jwt_builder_module
+FROM ngx_http_auth_jwt_builder_base AS ngx_http_auth_jwt_builder_module
 LABEL stage=ngx_http_auth_jwt_builder
 ENV PATH "${PATH}:/etc/nginx"
 ENV LD_LIBRARY_PATH=/usr/local/lib
diff --git a/test/test-nginx.dockerfile b/test/test-nginx.dockerfile
index c4a6104..e12acb4 100644
--- a/test/test-nginx.dockerfile
+++ b/test/test-nginx.dockerfile
@@ -2,7 +2,7 @@ ARG BASE_IMAGE
 ARG PORT
 ARG SSL_PORT
 
-FROM ${BASE_IMAGE} as NGINX
+FROM ${BASE_IMAGE} AS NGINX
 ARG PORT
 ARG SSL_PORT
 COPY etc/ /etc/

From 867562a318abb5b6997d77300f30b942e7e964ff Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 14 Oct 2024 10:44:06 -0400
Subject: [PATCH 107/130] fix /tmp dir perms for containers

---
 nginx.dockerfile   | 1 +
 openssl.dockerfile | 1 +
 2 files changed, 2 insertions(+)

diff --git a/nginx.dockerfile b/nginx.dockerfile
index c0e6c02..360469b 100644
--- a/nginx.dockerfile
+++ b/nginx.dockerfile
@@ -3,6 +3,7 @@ ARG NGINX_VERSION
 
 FROM ${BASE_IMAGE} AS ngx_http_auth_jwt_builder_base
 LABEL stage=ngx_http_auth_jwt_builder
+RUN chmod 1777 /tmp
 RUN <<`
 apt-get update
 apt-get install -y curl build-essential
diff --git a/openssl.dockerfile b/openssl.dockerfile
index d8bb293..42f824f 100644
--- a/openssl.dockerfile
+++ b/openssl.dockerfile
@@ -4,6 +4,7 @@ FROM ${BASE_IMAGE}
 ARG SSL_VERSION=3.2.1
 ENV SRC_DIR=/tmp/openssl-src
 ENV OUT_DIR=/usr/local/.openssl
+RUN chmod 1777 /tmp
 RUN <<`
     set -e
     apt-get update

From b93b816c97937e6a60620165688f937bba8e4f91 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 14 Oct 2024 10:44:19 -0400
Subject: [PATCH 108/130] update NGINX versions to build against

---
 scripts.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index f6863f0..2ae02d4 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -21,9 +21,10 @@ SSL_IMAGE_MAP[$SSL_VERSION_3_2_1]="bookworm-slim:openssl-${SSL_VERSION_3_2_1}"
 # supported NGINX versions -- for binary distribution
 NGINX_VERSION_LEGACY_1='1.20.2'
 NGINX_VERSION_LEGACY_2='1.22.1'
-NGINX_VERSION_STABLE='1.24.0'
-NGINX_VERSION_MAINLINE='1.25.4'
-NGINX_VERSIONS=(${NGINX_VERSION_LEGACY_1} ${NGINX_VERSION_LEGACY_2} ${NGINX_VERSION_STABLE} ${NGINX_VERSION_MAINLINE})
+NGINX_VERSION_LEGACY_3='1.24.0'
+NGINX_VERSION_STABLE='1.26.2'
+NGINX_VERSION_MAINLINE='1.27.2'
+NGINX_VERSIONS=(${NGINX_VERSION_LEGACY_1} ${NGINX_VERSION_LEGACY_2} ${NGINX_VERSION_LEGACY_3} ${NGINX_VERSION_STABLE} ${NGINX_VERSION_MAINLINE})
 NGINX_VERSION=${NGINX_VERSION:-${NGINX_VERSION_STABLE}}
 
 IMAGE_NAME=${IMAGE_NAME:-nginx-auth-jwt}

From e8e60e652a14474dcef39fac95c79385813737a8 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 14 Oct 2024 10:44:53 -0400
Subject: [PATCH 109/130] rm redundant `-e`

---
 scripts.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index 2ae02d4..5c9b785 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -120,8 +120,6 @@ cp_bin() {
 }
 
 make_release() {
-	set -e
-	
 	local moduleVersion=${1}
 	
 	NGINX_VERSION=${2}

From 16b0369e8c369809de8bda8004c65b5d36fd2d56 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Mon, 14 Oct 2024 10:45:06 -0400
Subject: [PATCH 110/130] update scripts to support arts

---
 scripts.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index 5c9b785..4b46a85 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -233,7 +233,8 @@ get_port() {
 if [ $# -eq 0 ]; then
 	all
 else
-	for fn in "$@"; do
-		${fn}
-	done
+	fn=$1
+	shift
+	
+	${fn} "$@"
 fi

From d8974ebd93539d7961fdc552cf563701961a16a3 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 4 Feb 2025 10:03:35 -0500
Subject: [PATCH 111/130] no releases from PRs

---
 .github/workflows/make-releases.yml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.github/workflows/make-releases.yml b/.github/workflows/make-releases.yml
index 037823b..3a12f70 100644
--- a/.github/workflows/make-releases.yml
+++ b/.github/workflows/make-releases.yml
@@ -6,11 +6,6 @@ on:
       - master
     paths:
       - src/**
-  pull_request:
-    branches:
-      - master
-    paths:
-      - src/**
   workflow_dispatch:
 
 jobs:

From 27fcd3d6fbfb561966d7e03a70000566123aee17 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 4 Feb 2025 10:03:53 -0500
Subject: [PATCH 112/130] update NGINX versions to build against

---
 .github/workflows/make-releases.yml | 2 +-
 scripts.sh                          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/make-releases.yml b/.github/workflows/make-releases.yml
index 3a12f70..fdc5591 100644
--- a/.github/workflows/make-releases.yml
+++ b/.github/workflows/make-releases.yml
@@ -14,7 +14,7 @@ jobs:
     strategy:
       matrix:
         # NGINX versions to build/test against
-        nginx-version: ['1.20.2', '1.22.1', '1.24.0', '1.25.3']
+        nginx-version: ['1.20.2', '1.22.1', '1.24.0', '1.26.2', '1.27.3']
 
         # The following versions of libjwt are compatible:
         #   * v1.0 - v1.12.0
diff --git a/scripts.sh b/scripts.sh
index 4b46a85..af59e9b 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -23,7 +23,7 @@ NGINX_VERSION_LEGACY_1='1.20.2'
 NGINX_VERSION_LEGACY_2='1.22.1'
 NGINX_VERSION_LEGACY_3='1.24.0'
 NGINX_VERSION_STABLE='1.26.2'
-NGINX_VERSION_MAINLINE='1.27.2'
+NGINX_VERSION_MAINLINE='1.27.3'
 NGINX_VERSIONS=(${NGINX_VERSION_LEGACY_1} ${NGINX_VERSION_LEGACY_2} ${NGINX_VERSION_LEGACY_3} ${NGINX_VERSION_STABLE} ${NGINX_VERSION_MAINLINE})
 NGINX_VERSION=${NGINX_VERSION:-${NGINX_VERSION_STABLE}}
 

From 576fe71f0a693d5e380069a316ae5361fe73af30 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 4 Feb 2025 10:04:03 -0500
Subject: [PATCH 113/130] update workflow action version

---
 .github/workflows/make-releases.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/make-releases.yml b/.github/workflows/make-releases.yml
index fdc5591..7316e6b 100644
--- a/.github/workflows/make-releases.yml
+++ b/.github/workflows/make-releases.yml
@@ -94,7 +94,7 @@ jobs:
         tar czf ngx_http_auth_jwt_module_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz ngx_http_auth_jwt_module.so
 
     - name: Upload build artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         if-no-files-found: error
         name: ngx_http_auth_jwt_module_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz

From d29adbb2ced992961d8c9c01b3dcf162b4c3f851 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 4 Feb 2025 10:15:51 -0500
Subject: [PATCH 114/130] rename start/stop script functions

---
 scripts.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts.sh b/scripts.sh
index af59e9b..edbb186 100755
--- a/scripts.sh
+++ b/scripts.sh
@@ -85,14 +85,14 @@ clean_module() {
 	docker rmi -f $(docker images --filter=label=stage=ngx_http_auth_jwt_builder --quiet) 2> /dev/null || true
 }
 
-start_nginx() {
+start() {
 	local port=$(get_port)
 
 	printf "${MAGENTA}Starting NGINX container (${IMAGE_NAME}) on port ${port}...${NC}\n"
 	docker run --rm --name "${IMAGE_NAME}" -d -p ${port}:80 ${FULL_IMAGE_NAME}:${NGINX_VERSION} >/dev/null
 }
 
-stop_nginx() {
+stop() {
 	docker stop "${IMAGE_NAME}" >/dev/null
 }
 

From a774c4208141b77d3144ac1cd296a420fbfe4b85 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 4 Feb 2025 10:16:09 -0500
Subject: [PATCH 115/130] rename scripts.sh

---
 scripts.sh => scripts | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename scripts.sh => scripts (100%)

diff --git a/scripts.sh b/scripts
similarity index 100%
rename from scripts.sh
rename to scripts

From 7c9cb00f5e3bf86192c6fc7a2b6a11a706923106 Mon Sep 17 00:00:00 2001
From: Adrian Carreno <AdrianCarreno@users.noreply.github.com>
Date: Tue, 4 Feb 2025 12:30:37 -0300
Subject: [PATCH 116/130] Feature: Add support for ARM64 (#139)

---
 openssl.dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/openssl.dockerfile b/openssl.dockerfile
index 42f824f..9839d29 100644
--- a/openssl.dockerfile
+++ b/openssl.dockerfile
@@ -31,8 +31,8 @@ RUN <<`
     ldconfig
 
     ln -sf ${OUT_DIR}/bin/openssl /usr/bin/openssl
-    ln -sf ${OUT_DIR}/lib64/libssl.so.3 /lib/x86_64-linux-gnu/libssl.so.3
-    ln -sf ${OUT_DIR}/lib64/libcrypto.so.3 /lib/x86_64-linux-gnu/libcrypto.so.3
+    ln -sf ${OUT_DIR}/lib64/libssl.so.3 /lib/$(uname -m)-linux-gnu/libssl.so.3
+    ln -sf ${OUT_DIR}/lib64/libcrypto.so.3 /lib/$(uname -m)-linux-gnu/libcrypto.so.3
 `
 WORKDIR /
 RUN rm -rf ${SRC_DIR}
\ No newline at end of file

From edabc23442653cc82568dcd83b034408e4708815 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 4 Feb 2025 10:33:12 -0500
Subject: [PATCH 117/130] support ARM

---
 scripts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts b/scripts
index edbb186..9d90185 100755
--- a/scripts
+++ b/scripts
@@ -110,8 +110,8 @@ cp_bin() {
 	mkdir -p ${destDir}
 	docker exec "${IMAGE_NAME}" sh -c "cd /; tar -chf - \
 		usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so \
-		usr/lib/x86_64-linux-gnu/libjansson.so.* \
-		usr/lib/x86_64-linux-gnu/libjwt.*" | tar -xf - -C ${destDir} &>/dev/null
+		usr/lib/$(uname -m)-linux-gnu/libjansson.so.* \
+		usr/lib/$(uname -m)-linux-gnu/libjwt.*" | tar -xf - -C ${destDir} &>/dev/null
 	
 	if [ $stopContainer ]; then
 		printf "${MAGENTA}Stopping NGINX container (${IMAGE_NAME})...${NC}\n"

From 81a2b445d20518d264cc32fcb51350ccbf8a7214 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wilson=20J=C3=BAnior?= <wilsonpjunior@gmail.com>
Date: Tue, 4 Feb 2025 14:14:30 -0300
Subject: [PATCH 118/130] Support extracting claims to NGINX variables (#145)

Co-authored-by: Matt Gilham <7717048+mgilham@users.noreply.github.com>
Co-authored-by: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Co-authored-by: Josh McCullough <joshua.mccullough@gmail.com>
---
 README.md                       |  35 +--
 src/ngx_http_auth_jwt_module.c  | 387 +++++++++++++++++++++++++-------
 test/etc/nginx/conf.d/test.conf |  44 ++++
 test/test.sh                    |  34 ++-
 4 files changed, 393 insertions(+), 107 deletions(-)

diff --git a/README.md b/README.md
index ba3dde1..95c83af 100644
--- a/README.md
+++ b/README.md
@@ -14,19 +14,20 @@ This module depends on the [JWT C Library](https://github.com/benmcollins/libjwt
 
 This module requires several new `nginx.conf` directives, which can be specified at the `http`, `server`, or `location` levels.
 
-| Directive                            | Description                                                                                                                                          |
-| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `auth_jwt_key`                       | The key to use to decode/verify the JWT, *in binhex format* -- see below.                                                                            |
-| `auth_jwt_redirect`                  | Set to "on" to redirect to `auth_jwt_loginurl` if authentication fails.                                                                              |
-| `auth_jwt_loginurl`                  | The URL to redirect to if `auth_jwt_redirect` is enabled and authentication fails.                                                                   |
-| `auth_jwt_enabled`                   | Set to "on" to enable JWT checking.                                                                                                                  |
-| `auth_jwt_algorithm`                 | The algorithm to use. One of: HS256, HS384, HS512, RS256, RS384, RS512                                                                               |
-| `auth_jwt_location`                  | Indicates where the JWT is located in the request -- see below.                                                                                      |
-| `auth_jwt_validate_sub`              | Set to "on" to validate the `sub` claim (e.g. user id) in the JWT.                                                                                   |
-| `auth_jwt_extract_request_claims`    | Set to a space-delimited list of claims to extract from the JWT and set as request headers. These will be accessible via e.g: `$http_jwt_sub`        |
-| `auth_jwt_extract_response_claims`   | Set to a space-delimited list of claims to extract from the JWT and set as response headers. These will be accessible via e.g: `$sent_http_jwt_sub`  |
-| `auth_jwt_use_keyfile`               | Set to "on" to read the key from a file rather than from the `auth_jwt_key` directive.                                                               |
-| `auth_jwt_keyfile_path`              | Set to the path from which the key should be read when `auth_jwt_use_keyfile` is enabled.                                                            |
+| Directive                            | Description                                                                                                                                                |
+| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `auth_jwt_key`                       | The key to use to decode/verify the JWT, *in binhex format* -- see below.                                                                                  |
+| `auth_jwt_redirect`                  | Set to "on" to redirect to `auth_jwt_loginurl` if authentication fails.                                                                                    |
+| `auth_jwt_loginurl`                  | The URL to redirect to if `auth_jwt_redirect` is enabled and authentication fails.                                                                         |
+| `auth_jwt_enabled`                   | Set to "on" to enable JWT checking.                                                                                                                        |
+| `auth_jwt_algorithm`                 | The algorithm to use. One of: HS256, HS384, HS512, RS256, RS384, RS512                                                                                     |
+| `auth_jwt_location`                  | Indicates where the JWT is located in the request -- see below.                                                                                            |
+| `auth_jwt_validate_sub`              | Set to "on" to validate the `sub` claim (e.g. user id) in the JWT.                                                                                         |
+| `auth_jwt_extract_var_claims`        | Set to a space-delimited list of claims to extract from the JWT and make available as NGINX variables. These will be accessible via e.g: `$jwt_claim_sub`  |
+| `auth_jwt_extract_request_claims`    | Set to a space-delimited list of claims to extract from the JWT and set as request headers. These will be accessible via e.g: `$http_jwt_sub`              |
+| `auth_jwt_extract_response_claims`   | Set to a space-delimited list of claims to extract from the JWT and set as response headers. These will be accessible via e.g: `$sent_http_jwt_sub`        |
+| `auth_jwt_use_keyfile`               | Set to "on" to read the key from a file rather than from the `auth_jwt_key` directive.                                                                     |
+| `auth_jwt_keyfile_path`              | Set to the path from which the key should be read when `auth_jwt_use_keyfile` is enabled.                                                                  |
 
 
 ## Algorithms
@@ -92,19 +93,19 @@ auth_jwt_validate_sub on;
 
 You may specify claims to be extracted from the JWT and placed on the request and/or response headers. This is especially handly because the claims will then also be available as NGINX variables.
 
-If you only wish to access a claim as an NGINX variable, you should use `auth_jwt_extract_request_claims` so that the claim does not end up being sent to the client as a response header. However, if you do want the claim to be sent to the client in the response, then use `auth_jwt_extract_response_claims` instead.
+If you only wish to access a claim as an NGINX variable, you should use `auth_jwt_extract_var_claims` so that the claim does not end up being sent to the client as a response header. However, if you do want the claim to be sent to the client in the response, you may use `auth_jwt_extract_response_claims` instead.
 
 _Please note that `number`, `boolean`, `array`, and `object` claims are not supported at this time -- only `string` claims are supported._ An error will be thrown if you attempt to extract a non-string claim.
 
-### Using Request Claims
+### Using Claims
 
 For example, you could configure an NGINX location which redirects to the current user's profile. Suppose `sub=abc-123`, the configuration below would redirect to `/profile/abc-123`.
 
 ```nginx
 location /profile/me {
-    auth_jwt_extract_request_claims sub;
+    auth_jwt_extract_var_claims sub;
 
-    return 301 /profile/$http_jwt_sub;
+    return 301 /profile/$jwt_claim_sub;
 }
 ```
 
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index e21560c..fe428b4 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -31,6 +31,7 @@ typedef struct
   ngx_str_t jwt_location;
   ngx_str_t algorithm;
   ngx_flag_t validate_sub;
+  ngx_array_t *extract_var_claims;
   ngx_array_t *extract_request_claims;
   ngx_array_t *extract_response_claims;
   ngx_str_t keyfile_path;
@@ -38,18 +39,28 @@ typedef struct
   ngx_str_t _keyfile;
 } auth_jwt_conf_t;
 
+typedef struct
+{
+  ngx_int_t validation_status;
+  ngx_array_t *claim_values;
+} auth_jwt_ctx_t;
+
 static ngx_int_t init(ngx_conf_t *cf);
 static void *create_conf(ngx_conf_t *cf);
 static char *merge_conf(ngx_conf_t *cf, void *parent, void *child);
+static char *merge_extract_var_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *c);
+static ngx_int_t get_jwt_var_claim(ngx_http_request_t *r, ngx_http_variable_value_t *v, uintptr_t data);
 static char *merge_extract_request_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *c);
 static char *merge_extract_response_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *c);
+static auth_jwt_ctx_t *get_or_init_jwt_module_ctx(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf);
+static auth_jwt_ctx_t *get_request_jwt_ctx(ngx_http_request_t *r);
 static ngx_int_t handle_request(ngx_http_request_t *r);
 static int validate_alg(auth_jwt_conf_t *jwtcf, jwt_t *jwt);
 static int validate_exp(auth_jwt_conf_t *jwtcf, jwt_t *jwt);
 static int validate_sub(auth_jwt_conf_t *jwtcf, jwt_t *jwt);
+static ngx_int_t extract_var_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt, auth_jwt_ctx_t *ctx);
 static void extract_request_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt);
 static void extract_response_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt);
-static ngx_int_t free_jwt_and_redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt);
 static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf);
 static ngx_int_t load_public_key(ngx_conf_t *cf, auth_jwt_conf_t *conf);
 static char *get_jwt(ngx_http_request_t *r, ngx_str_t jwt_location);
@@ -106,6 +117,13 @@ static ngx_command_t auth_jwt_directives[] = {
      offsetof(auth_jwt_conf_t, validate_sub),
      NULL},
 
+    {ngx_string("auth_jwt_extract_var_claims"),
+     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_1MORE,
+     merge_extract_var_claims,
+     NGX_HTTP_LOC_CONF_OFFSET,
+     offsetof(auth_jwt_conf_t, extract_var_claims),
+     NULL},
+
     {ngx_string("auth_jwt_extract_request_claims"),
      NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_CONF_1MORE,
      merge_extract_request_claims,
@@ -194,6 +212,7 @@ static void *create_conf(ngx_conf_t *cf)
     conf->validate_sub = NGX_CONF_UNSET;
     conf->redirect = NGX_CONF_UNSET;
     conf->validate_sub = NGX_CONF_UNSET;
+    conf->extract_var_claims = NULL;
     conf->extract_request_claims = NULL;
     conf->extract_response_claims = NULL;
     conf->use_keyfile = NGX_CONF_UNSET;
@@ -213,6 +232,7 @@ static char *merge_conf(ngx_conf_t *cf, void *parent, void *child)
   ngx_conf_merge_str_value(conf->algorithm, prev->algorithm, "HS256");
   ngx_conf_merge_str_value(conf->keyfile_path, prev->keyfile_path, "");
   ngx_conf_merge_off_value(conf->validate_sub, prev->validate_sub, 0);
+  merge_array(cf->pool, &conf->extract_var_claims, prev->extract_var_claims, sizeof(ngx_str_t));
   merge_array(cf->pool, &conf->extract_request_claims, prev->extract_request_claims, sizeof(ngx_str_t));
   merge_array(cf->pool, &conf->extract_response_claims, prev->extract_response_claims, sizeof(ngx_str_t));
 
@@ -252,6 +272,108 @@ static char *merge_conf(ngx_conf_t *cf, void *parent, void *child)
   return NGX_CONF_OK;
 }
 
+static char *merge_extract_var_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *c)
+{
+  auth_jwt_conf_t *conf = c;
+  ngx_array_t *claims = conf->extract_var_claims;
+
+  if (claims == NULL)
+  {
+    claims = ngx_array_create(cf->pool, 1, sizeof(ngx_str_t));
+    conf->extract_var_claims = claims;
+  }
+
+  ngx_str_t *values = cf->args->elts;
+
+  // start at 1 because the first element is the directive (auth_jwt_extract_var_claims)
+  for (ngx_uint_t i = 1; i < cf->args->nelts; ++i)
+  {
+    // add this claim's name to the config struct
+    ngx_str_t *element = ngx_array_push(claims);
+    
+    *element = values[i];
+
+    // add an http variable for this claim
+    size_t var_name_len = 10 + element->len;
+    u_char *buf = ngx_palloc(cf->pool, sizeof(u_char) * var_name_len);
+    
+    if (buf == NULL)
+    {
+      return NGX_CONF_ERROR;
+    }
+    else
+    {
+      ngx_sprintf(buf, "jwt_claim_%V", element);
+      ngx_str_t *var_name = ngx_palloc(cf->pool, sizeof(ngx_str_t));
+      
+      if (var_name == NULL)
+      {
+        return NGX_CONF_ERROR;
+      }
+      else
+      {
+        var_name->data = buf;
+        var_name->len = var_name_len;
+        
+        // NGX_HTTP_VAR_CHANGEABLE simplifies the required logic by assuming a JWT claim will always be the same for a given request
+        ngx_http_variable_t *http_var = ngx_http_add_variable(cf, var_name, NGX_HTTP_VAR_CHANGEABLE);
+        
+        if (http_var == NULL)
+        {
+          ngx_log_error(NGX_LOG_ERR, cf->log, 0, "failed to add variable %V", var_name);
+          
+          return NGX_CONF_ERROR;
+        }
+        else
+        {
+          http_var->get_handler = get_jwt_var_claim;
+      
+          // store the index of this new claim in the claims array as the "data" that will be passed to the getter
+          ngx_uint_t *claim_idx = ngx_palloc(cf->pool, sizeof(ngx_uint_t));
+          
+          if (claim_idx == NULL)
+          {
+              return NGX_CONF_ERROR;
+          }
+          else
+          {
+            *claim_idx = claims->nelts - 1;
+            http_var->data = (uintptr_t) claim_idx;
+          }
+        }
+      }
+    }
+  }
+
+  return NGX_CONF_OK;
+}
+
+static ngx_int_t get_jwt_var_claim(ngx_http_request_t *r, ngx_http_variable_value_t *v, uintptr_t data)
+{
+  ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "getting jwt value for var index %l", *((ngx_uint_t*) data));
+  auth_jwt_ctx_t *ctx = get_request_jwt_ctx(r);
+  
+  if (ctx == NULL)
+  {
+    ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "no module context found while getting jwt value");
+    
+    return NGX_ERROR;
+  }
+  else
+  {
+    ngx_uint_t *claim_idx = (ngx_uint_t*) data;
+    ngx_str_t claim_value = ((ngx_str_t*) ctx->claim_values->elts)[*claim_idx];
+    
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+    v->len = claim_value.len;
+    v->data = claim_value.data;
+  
+    return NGX_OK;
+  }
+}
+
 static char *merge_extract_claims(ngx_conf_t *cf, ngx_array_t *claims)
 {
   ngx_str_t *values = cf->args->elts;
@@ -295,98 +417,169 @@ static char *merge_extract_response_claims(ngx_conf_t *cf, ngx_command_t *cmd, v
   return merge_extract_claims(cf, claims);
 }
 
-static ngx_int_t handle_request(ngx_http_request_t *r)
+static auth_jwt_ctx_t *get_or_init_jwt_module_ctx(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf)
+{
+  auth_jwt_ctx_t *ctx = ngx_http_get_module_ctx(r, ngx_http_auth_jwt_module);
+  
+  if (ctx != NULL)
+  {
+    return ctx;
+  }
+  else
+  {
+    ctx = ngx_pcalloc(r->pool, sizeof(auth_jwt_ctx_t));
+
+    if (ctx == NULL)
+    {
+      ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "error allocating jwt module context");
+      return ctx;
+    }
+    else {
+      if (jwtcf->extract_var_claims != NULL)
+      {
+        ctx->claim_values = ngx_array_create(r->pool, jwtcf->extract_var_claims->nelts, sizeof(ngx_str_t));
+
+        if (ctx->claim_values == NULL)
+        {
+          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "error initializing jwt module context");
+          return NULL;
+        }
+      }
+
+      ctx->validation_status = NGX_AGAIN;
+      ngx_http_set_ctx(r, ctx, ngx_http_auth_jwt_module);
+
+      return ctx;
+    }
+  }
+}
+
+// this creates the module's context struct and extracts claim vars the first time it is called,
+// either from the access-phase handler or an http var getter
+static auth_jwt_ctx_t *get_request_jwt_ctx(ngx_http_request_t *r)
 {
   auth_jwt_conf_t *jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
 
-  if (!jwtcf->enabled)
+  if(!jwtcf->enabled)
   {
-    return NGX_DECLINED;
+    return NULL;
+  }
+
+  auth_jwt_ctx_t *ctx = get_or_init_jwt_module_ctx(r, jwtcf);
+
+  if (ctx == NULL)
+  {
+    return NULL;
+  }
+  else if (ctx->validation_status != NGX_AGAIN)
+  {
+    // we already validated and extacted everything we care about, so we just return the already-complete context
+    return ctx;
+  }
+
+  char *jwtPtr = get_jwt(r, jwtcf->jwt_location);
+
+  if (jwtPtr == NULL)
+  {
+    ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a JWT");
+    ctx->validation_status = NGX_ERROR;
+    return ctx;
   }
   else
   {
-    // pass through options requests without token authentication
-    if (r->method == NGX_HTTP_OPTIONS)
+    ngx_str_t algorithm = jwtcf->algorithm;
+    int keyLength;
+    u_char *key;
+    jwt_t *jwt = NULL;
+
+    if (algorithm.len == 0 || (algorithm.len == 5 && ngx_strncmp(algorithm.data, "HS", 2) == 0))
     {
-      return NGX_DECLINED;
+      keyLength = jwtcf->key.len / 2;
+      key = ngx_palloc(r->pool, keyLength);
+
+      if (0 != hex_to_binary((char *)jwtcf->key.data, key, jwtcf->key.len))
+      {
+        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to turn hex key into binary");
+        ctx->validation_status = NGX_ERROR;
+        return ctx;
+      }
     }
-    else
+    else if (algorithm.len == 5 && (ngx_strncmp(algorithm.data, "RS", 2) == 0 || ngx_strncmp(algorithm.data, "ES", 2) == 0))
     {
-      char *jwtPtr = get_jwt(r, jwtcf->jwt_location);
-
-      if (jwtPtr == NULL)
+      if (jwtcf->use_keyfile == 1)
       {
-        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to find a JWT");
-        return redirect(r, jwtcf);
+        keyLength = jwtcf->_keyfile.len;
+        key = (u_char *)jwtcf->_keyfile.data;
       }
       else
       {
-        ngx_str_t algorithm = jwtcf->algorithm;
-        int keyLength;
-        u_char *key;
-        jwt_t *jwt = NULL;
-
-        if (algorithm.len == 0 || (algorithm.len == 5 && ngx_strncmp(algorithm.data, "HS", 2) == 0))
-        {
-          keyLength = jwtcf->key.len / 2;
-          key = ngx_palloc(r->pool, keyLength);
+        keyLength = jwtcf->key.len;
+        key = jwtcf->key.data;
+      }
+    }
+    else
+    {
+      ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "unsupported algorithm %s", algorithm);
+      ctx->validation_status = NGX_ERROR;
+      return ctx;
+    }
 
-          if (0 != hex_to_binary((char *)jwtcf->key.data, key, jwtcf->key.len))
-          {
-            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to turn hex key into binary");
-            return redirect(r, jwtcf);
-          }
-        }
-        else if (algorithm.len == 5 && (ngx_strncmp(algorithm.data, "RS", 2) == 0 || ngx_strncmp(algorithm.data, "ES", 2) == 0))
-        {
-          if (jwtcf->use_keyfile == 1)
-          {
-            keyLength = jwtcf->_keyfile.len;
-            key = (u_char *)jwtcf->_keyfile.data;
-          }
-          else
-          {
-            keyLength = jwtcf->key.len;
-            key = jwtcf->key.data;
-          }
-        }
-        else
-        {
-          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "unsupported algorithm %s", algorithm);
-          return redirect(r, jwtcf);
-        }
+    if (jwt_decode(&jwt, jwtPtr, key, keyLength) != 0 || !jwt)
+    {
+      ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse JWT");
+      ctx->validation_status = NGX_ERROR;
+    }
+    else if (validate_alg(jwtcf, jwt) != 0)
+    {
+      ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm specified");
+      ctx->validation_status = NGX_ERROR;
+    }
+    else if (validate_exp(jwtcf, jwt) != 0)
+    {
+      ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT has expired");
+      ctx->validation_status = NGX_ERROR;
+    }
+    else if (validate_sub(jwtcf, jwt) != 0)
+    {
+      ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT does not contain a subject");
+      ctx->validation_status = NGX_ERROR;
+    }
+    else
+    {
+      extract_request_claims(r, jwtcf, jwt);
+      extract_response_claims(r, jwtcf, jwt);
+      ctx->validation_status = extract_var_claims(r, jwtcf, jwt, ctx);
+    }
 
-        if (jwt_decode(&jwt, jwtPtr, key, keyLength) != 0)
-        {
-          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse JWT");
-          return redirect(r, jwtcf);
-        }
+    jwt_free(jwt);
+    return ctx;
+  }
+}
 
-        if (validate_alg(jwtcf, jwt) != 0)
-        {
-          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "invalid algorithm specified");
-          return free_jwt_and_redirect(r, jwtcf, jwt);
-        }
-        else if (validate_exp(jwtcf, jwt) != 0)
-        {
-          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT has expired");
-          return free_jwt_and_redirect(r, jwtcf, jwt);
-        }
-        else if (validate_sub(jwtcf, jwt) != 0)
-        {
-          ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "the JWT does not contain a subject");
-          return free_jwt_and_redirect(r, jwtcf, jwt);
-        }
-        else
-        {
-          extract_request_claims(r, jwtcf, jwt);
-          extract_response_claims(r, jwtcf, jwt);
-          jwt_free(jwt);
+static ngx_int_t handle_request(ngx_http_request_t *r)
+{
+  auth_jwt_conf_t *jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
+  auth_jwt_ctx_t *ctx = get_request_jwt_ctx(r);
 
-          return NGX_OK;
-        }
-      }
-    }
+  if (!jwtcf->enabled)
+  {
+    return NGX_DECLINED;
+  }
+  else if (r->method == NGX_HTTP_OPTIONS) // pass through options requests without token authentication
+  {
+    return NGX_DECLINED;
+  }
+  else if (!ctx)
+  {
+    return NGX_ERROR;
+  }
+  else if (ctx->validation_status == NGX_ERROR)
+  {
+    return redirect(r, jwtcf);
+  }
+  else
+  {
+    return ctx->validation_status;
   }
 }
 
@@ -394,8 +587,7 @@ static int validate_alg(auth_jwt_conf_t *jwtcf, jwt_t *jwt)
 {
   const jwt_alg_t alg = jwt_get_alg(jwt);
 
-  if (alg != JWT_ALG_HS256 && alg != JWT_ALG_HS384 && alg != JWT_ALG_HS512 && alg != JWT_ALG_RS256 && alg != JWT_ALG_RS384 && alg != JWT_ALG_RS512 && alg != JWT_ALG_ES256 && alg != JWT_ALG_ES384 && alg != JWT_ALG_ES512)
-  {
+  if (alg != JWT_ALG_HS256 && alg != JWT_ALG_HS384 && alg != JWT_ALG_HS512 && alg != JWT_ALG_RS256 && alg != JWT_ALG_RS384 && alg != JWT_ALG_RS512 && alg != JWT_ALG_ES256 && alg != JWT_ALG_ES384 && alg != JWT_ALG_ES512)  {
     return 1;
   }
 
@@ -430,6 +622,37 @@ static int validate_sub(auth_jwt_conf_t *jwtcf, jwt_t *jwt)
   return 0;
 }
 
+static ngx_int_t extract_var_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt, auth_jwt_ctx_t *ctx)
+{
+  ngx_array_t *claims = jwtcf->extract_var_claims;
+  
+  if (claims == NULL || claims->nelts == 0)
+  {
+    return NGX_OK;
+  }
+  else
+  {
+    const ngx_str_t *claimsPtr = claims->elts;
+  
+    for (uint i = 0; i < claims->nelts; ++i)
+    {
+      const ngx_str_t claim = claimsPtr[i];
+      const char *claimValue = jwt_get_grant(jwt, (char *)claim.data);
+      ngx_str_t value = ngx_string("");
+      
+      if (claimValue != NULL && strlen(claimValue) > 0)
+      {
+        value = char_ptr_to_ngx_str_t(r->pool, claimValue);
+      }
+      
+      ((ngx_str_t*) ctx->claim_values->elts)[i] = value;
+      ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "set var %V to JWT claim value %s", &claim, value.data);
+    }
+  
+    return NGX_OK;
+  }
+}
+
 static void extract_claims(ngx_http_request_t *r, jwt_t *jwt, ngx_array_t *claims, ngx_int_t (*set_header)(ngx_http_request_t *r, ngx_str_t *key, ngx_str_t *value))
 {
   if (claims != NULL && claims->nelts > 0)
@@ -467,16 +690,6 @@ static void extract_response_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtc
   extract_claims(r, jwt, jwtcf->extract_response_claims, set_response_header);
 }
 
-static ngx_int_t free_jwt_and_redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt)
-{
-  if (jwt)
-  {
-    jwt_free(jwt);
-  }
-
-  return redirect(r, jwtcf);
-}
-
 static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf)
 {
   if (jwtcf->redirect)
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
index 229d545..5359434 100644
--- a/test/etc/nginx/conf.d/test.conf
+++ b/test/etc/nginx/conf.d/test.conf
@@ -395,4 +395,48 @@ vXjq39xtcIBRTO1c2zs=
             try_files index.html =404;
         }
     }
+
+    location /secure/extract-claim/if/sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_var_claims sub;
+
+        if ($jwt_claim_sub = 'some-long-uuid') {
+            return 200;
+        }
+        return 401;
+    }
+
+    location /secure/extract-claim/body/sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_var_claims sub;
+
+        return 200 "sub: $jwt_claim_sub";
+    }
+
+    location /secure/extract-claim/body/multiple {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_validate_sub on;
+        auth_jwt_extract_var_claims firstName middleName lastName;
+
+        return 200 "you are: $jwt_claim_firstName $jwt_claim_middleName $jwt_claim_lastName";
+    }
+
+    location /profile {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_validate_sub on;
+
+        location /profile/me {
+            auth_jwt_extract_var_claims sub;
+
+            return 301 /profile/$jwt_claim_sub;
+        }
+    }
 }
diff --git a/test/test.sh b/test/test.sh
index 2bf9cb3..747124c 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -72,7 +72,7 @@ run_test () {
         fi
       fi
       
-      if [ "${okay}" == '1' ] && [ "${expectedResponseRegex}" != "" ] && ! [[ "${response}" =~ "${expectedResponseRegex}" ]]; then
+      if [ "${okay}" == '1' ] && [ "${expectedResponseRegex}" != "" ] && ! [[ "${response}" =~ ${expectedResponseRegex} ]]; then
         printf "${RED}${name} -- regex not found in response\n\tPath: ${path}\n\tRegEx: ${expectedResponseRegex}"
         NUM_FAILED=$((${NUM_FAILED} + 1))
         okay=0
@@ -279,7 +279,7 @@ main() {
 
   run_test -n 'extracts nested claim to request variable' \
            -p '/secure/extract-claim/request/nested' \
-           -r '< Test: username=hello.world' \
+           -r '< Test: username=hello\.world' \
            -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
 
   run_test -n 'extracts single claim to response variable' \
@@ -319,7 +319,35 @@ main() {
 
   run_test -n 'extracts nested claim to response header' \
            -p '/secure/extract-claim/response/nested' \
-           -r '< JWT-username: hello.world' \
+           -r '< JWT-username: hello\.world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'tests single claim with if statement' \
+           -p '/secure/extract-claim/if/sub' \
+           -c 200 \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'tests absence of single claim with if statement' \
+           -p '/secure/extract-claim/if/sub' \
+           -c 401 \
+           -x '--header "Authorization: Bearer ${JWT_HS256_MISSING_SUB}"'
+
+  run_test -n 'extracts single claim to response body' \
+           -p '/secure/extract-claim/body/sub' \
+           -c 200 \
+           -r 'sub: some-long-uuid$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims to response body' \
+           -p '/secure/extract-claim/body/multiple' \
+           -c 200 \
+           -r 'you are: hello  world$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'redirect based on claim' \
+           -p '/profile/me' \
+           -c 301 \
+           -r '< Location: http://nginx:8000/profile/some-long-uuid' \
            -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
 
   if [[ "${NUM_FAILED}" = '0' ]]; then

From 5c3d1b9565edb5ac1243d3ebbaa869246f82f0f6 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Tue, 4 Feb 2025 12:35:50 -0500
Subject: [PATCH 119/130] fix workflow

---
 .github/workflows/make-releases.yml | 56 ++++++++++++++++-------------
 1 file changed, 31 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/make-releases.yml b/.github/workflows/make-releases.yml
index 7316e6b..3e58bfa 100644
--- a/.github/workflows/make-releases.yml
+++ b/.github/workflows/make-releases.yml
@@ -1,11 +1,6 @@
-name: CI
+name: Make Releases
 
 on:
-  push:
-    branches: 
-      - master
-    paths:
-      - src/**
   workflow_dispatch:
 
 jobs:
@@ -27,14 +22,26 @@ jobs:
         libjwt-version: ['1.12.0', '1.14.0', '1.15.3']
     runs-on: ubuntu-latest
     steps:
+
     - name: Checkout Code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
-        path: 'ngx-http-auth-jwt-module'
+        fetch-depth: 0
+        path: ngx-http-auth-jwt-module
+
+    - name: Get Metadata
+      id: meta
+      run: |
+        set -eux
+        cd ngx-http-auth-jwt-module
+
+        tag=$(git describe --tags --abbrev=0)
+
+        echo "filename=ngx-http-auth-jwt-module-${tag}_libjwt-${{matrix.libjwt-version}}_nginx-${{matrix.nginx-version}}.tgz" >> $GITHUB_OUTPUT
 
     # TODO cache the build result so we don't have to do this every time?
     - name: Download jansson
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         repository: 'akheron/jansson'
         ref: 'v2.14'
@@ -50,7 +57,7 @@ jobs:
 
     # TODO cache the build result so we don't have to do this every time?
     - name: Download libjwt
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         repository: 'benmcollins/libjwt'
         ref: 'v${{matrix.libjwt-version}}'
@@ -82,44 +89,43 @@ jobs:
           BUILD_FLAGS="${BUILD_FLAGS} --with-cc-opt='-DNGX_LINKED_LIST_COOKIES=1'"
         fi
         
-        ./configure --with-compat --add-dynamic-module=../ngx-http-auth-jwt-module ${BUILD_FLAGS}
+        ./configure --with-compat --without-http_rewrite_module --add-dynamic-module=../ngx-http-auth-jwt-module ${BUILD_FLAGS}
 
     - name: Make Modules
       working-directory: ./nginx
       run: make modules
 
-    - name: Create release archive
+    - name: Create Release Archive
       run: |
         cp ./nginx/objs/ngx_http_auth_jwt_module.so ./
-        tar czf ngx_http_auth_jwt_module_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz ngx_http_auth_jwt_module.so
+        tar czf ${{steps.meta.outputs.filename}} ngx_http_auth_jwt_module.so
 
-    - name: Upload build artifact
+    - name: Upload Build Artifact
       uses: actions/upload-artifact@v4
       with:
         if-no-files-found: error
-        name: ngx_http_auth_jwt_module_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz
-        path: ngx_http_auth_jwt_module_libjwt_${{matrix.libjwt-version}}_nginx_${{matrix.nginx-version}}.tgz
+        name: ${{steps.meta.outputs.filename}}
+        path: ${{steps.meta.outputs.filename}}
 
   update_releases_page:
-    name: Upload builds to Releases
-    if: github.event_name != 'pull_request'
-    needs:
-      - build
+    name: Upload Release
+    needs: build
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-      - name: Set up variables
+
+      - name: Set-up Variables
         id: vars
         run: |
           echo "date_now=$(date --rfc-3339=seconds)" >> "${GITHUB_OUTPUT}"
           
-      - name: Download build artifacts from previous jobs
-        uses: actions/download-artifact@v3
+      - name: Download Build Artifacts from Previous Jobs
+        uses: actions/download-artifact@v4
         with:
           path: artifacts
 
-      - name: Upload builds to Releases
+      - name: Upload Builds to Release
         uses: ncipollo/release-action@v1
         with:
           allowUpdates: true
@@ -128,7 +134,7 @@ jobs:
           body: |
             > [!WARNING]
             > This is an automatically generated pre-release version of the module, which includes the latest master branch changes.
-            > Please report any bugs you find to the issue tracker.
+            > Please report any bugs you find.
 
             - Build Date: `${{ steps.vars.outputs.date_now }}`
             - Commit: ${{ github.sha }}

From c38ae696319e5106a6c171d4f6882d1ffffd58db Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Wed, 5 Feb 2025 14:23:23 -0500
Subject: [PATCH 120/130] fix release artifact upload

---
 .github/workflows/make-releases.yml | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/make-releases.yml b/.github/workflows/make-releases.yml
index 3e58bfa..8d7c906 100644
--- a/.github/workflows/make-releases.yml
+++ b/.github/workflows/make-releases.yml
@@ -105,10 +105,9 @@ jobs:
       with:
         if-no-files-found: error
         name: ${{steps.meta.outputs.filename}}
-        path: ${{steps.meta.outputs.filename}}
 
-  update_releases_page:
-    name: Upload Release
+  release:
+    name: Create/Update Release
     needs: build
     runs-on: ubuntu-latest
     permissions:
@@ -120,7 +119,7 @@ jobs:
         run: |
           echo "date_now=$(date --rfc-3339=seconds)" >> "${GITHUB_OUTPUT}"
           
-      - name: Download Build Artifacts from Previous Jobs
+      - name: Download Build Artifacts
         uses: actions/download-artifact@v4
         with:
           path: artifacts
@@ -128,9 +127,7 @@ jobs:
       - name: Upload Builds to Release
         uses: ncipollo/release-action@v1
         with:
-          allowUpdates: true
-          artifactErrorsFailBuild: true
-          artifacts: artifacts/*/*
+          name: 'Development Build: ${{ github.ref_name }}@${{ github.sha }}'
           body: |
             > [!WARNING]
             > This is an automatically generated pre-release version of the module, which includes the latest master branch changes.
@@ -138,7 +135,9 @@ jobs:
 
             - Build Date: `${{ steps.vars.outputs.date_now }}`
             - Commit: ${{ github.sha }}
-          name: 'Development build: ${{ github.ref_name }}@${{ github.sha }}'
           prerelease: true
+          allowUpdates: true
           removeArtifacts: true
+          artifactErrorsFailBuild: true
+          artifacts: artifacts/*
           tag: dev-build

From acbb12e3c83d9a1d33e673407530cc7bcc8031e6 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Wed, 5 Feb 2025 14:23:33 -0500
Subject: [PATCH 121/130] update redirect URL to include port (#146)

---
 README.md                       |  41 ++++++-----
 scripts                         |  17 +++--
 src/ngx_http_auth_jwt_module.c  | 119 +++++++++++++++++++++-----------
 test/docker-compose-test.yml    |   7 +-
 test/etc/nginx/conf.d/test.conf |   6 ++
 test/test-nginx.dockerfile      |  11 +--
 test/test-runner.dockerfile     |  14 ++--
 test/test.sh                    |  28 ++++++--
 8 files changed, 159 insertions(+), 84 deletions(-)

diff --git a/README.md b/README.md
index 95c83af..f6b09d6 100644
--- a/README.md
+++ b/README.md
@@ -192,41 +192,43 @@ Once you save your changes to `.vscode/c_cpp_properties.json`, you should see th
 
 ### Building and Testing
 
-The `./scripts.sh` file contains multiple commands to make things easy:
+The `./scripts` file contains multiple commands to make things easy:
 
 | Command               | Description                                                       |
 | --------------------- | ----------------------------------------------------------------- |
 | `build_module`        | Builds the NGINX image.                                           |
 | `rebuild_module`      | Re-builds the NGINX image.                                        |
-| `start_nginx`         | Starts the NGINX container.                                       |
-| `stop_nginx`          | Stops the NGINX container.                                        |
+| `start`               | Starts the NGINX container.                                       |
+| `stop`                | Stops the NGINX container.                                        |
 | `cp_bin`              | Copies the compiled binaries out of the NGINX container.          |
-| `build_test_runner`   | Builds the images used by the test stack (uses Docker compose).   |
-| `rebuild_test_runner` | Re-builds the images used by the test stack.                      |
-| `test`                | Runs `test.sh` against the NGINX container (uses Docker compose). |
+| `build_test`          | Builds the images used by the test stack.                         |
+| `rebuild_test`        | Re-builds the images used by the test stack.                      |
+| `test`                | Runs `test.sh` against the NGINX container.                       |
 | `test_now`            | Runs `test.sh` without rebuilding.                                |
 
 You can run multiple commands in sequence by separating them with a space, e.g.:
 
 ```shell
-./scripts.sh build_module test
+./scripts build_module
+./scripts test
 ```
 
-To build the Docker images, module, start NGINX, and run the tests against, you can simply do:
+To build the Docker images, module, start NGINX, and run the tests against it for all versions, you can simply do:
 
 ```shell
-./scripts.sh all
+./scripts all
 ```
 
-When you make a change to the module run `./scripts.sh build_module test` to build a fresh module and run the tests. Note that `rebuild_module` is not often needed as `build_module` hashes the module's source files which will cause a cache miss while building the container, causing the module to be rebuilt.
+When you make a change to the module, running `./scripts test` should build a fresh module and run the tests. Note that `rebuild_module` is not often needed as Docker will automatically rebuild the image if the source files have
+changed.
 
-When you make a change to the test NGINX config or `test.sh`, run `./scripts.sh test` to run the tests. Similar to above, the test sources are hashed and the containers will be rebuilt as needed.
+When you make a change to the test NGINX config or `test.sh`, run `./scripts test` to run the tests.
 
-The image produced with `./scripts.sh build_module` only differs from the official NGINX image in two ways:
+The image produced with `./scripts build_module` only differs from the official NGINX image in two ways:
  - the JWT module itself, and
  - the `nginx.conf` file is overwritten with our own.
 
-The tests use a customized NGINX image, distinct from the main image, as well as a test runner image. By running `./scripts.sh test`, the two test containers will be stood up via Docker compose, then they'll be started, and the tests will run. At the end of the test run, both containers will be automatically stopped and destroyed. See below to learn how to trace test failures across runs.
+The tests use a customized NGINX image, distinct from the main image, as well as a test runner image. By running `./scripts test`, the two test containers will be stood up via Docker Compose, then they'll be started, and the tests will run. At the end of the test run, both containers will be automatically stopped and destroyed. See below to learn how to trace test failures across runs.
 
 #### Tracing Test Failures
 
@@ -236,20 +238,23 @@ If you'd like to persist logs across test runs, you can configure the log driver
 
 ```shell
 # need to rebuild the test runner with the proper log driver
-LOG_DRIVER=journald ./scripts.sh rebuild_test_runner
+export LOG_DRIVER=journald
+
+# rebuild the test images
+./scripts rebuild_test
 
 # run the tests
-./scripts.sh test
+./scripts test
 
-# check the logs
-journalctl -eu docker CONTAINER_NAME=jwt-nginx-test
+# check the logs -- adjust the container name as needed
+journalctl -eu docker CONTAINER_NAME=nginx-auth-jwt-test-nginx
 ```
 
 Now you'll be able to see logs from previous test runs. The best way to make use of this  is to open two terminals, one where you run the tests, and one where you follow the logs:
 
 ```shell
 # terminal 1
-./scripts.sh test
+./scripts test
 
 # terminal 2
 journalctl -fu docker CONTAINER_NAME=jwt-nginx-test
diff --git a/scripts b/scripts
index 9d90185..59fc5c3 100755
--- a/scripts
+++ b/scripts
@@ -31,6 +31,7 @@ IMAGE_NAME=${IMAGE_NAME:-nginx-auth-jwt}
 FULL_IMAGE_NAME=${ORG_NAME:-teslagov}/${IMAGE_NAME}
 
 TEST_CONTAINER_NAME_PREFIX="${IMAGE_NAME}-test"
+TEST_COMPOSE_FILE='test/docker-compose-test.yml'
 
 all() {
 	build_module
@@ -162,7 +163,8 @@ build_test() {
 	printf "${MAGENTA}Building test NGINX & runner using port ${port}...${NC}\n"
 	docker compose \
 	  -p ${TEST_CONTAINER_NAME_PREFIX} \
-	  -f ./test/docker-compose-test.yml build \
+	  -f ${TEST_COMPOSE_FILE} \
+		build \
 	  --build-arg RUNNER_BASE_IMAGE=${runnerBaseImage} \
 		--build-arg PORT=${port} \
 		--build-arg SSL_PORT=${sslPort} \
@@ -188,12 +190,11 @@ test() {
 	printf "${MAGENTA}Running tests...${NC}\n"
 	docker compose \
 	  -p ${TEST_CONTAINER_NAME_PREFIX} \
-		-f ./test/docker-compose-test.yml up \
+		-f ${TEST_COMPOSE_FILE} up \
 		--no-start
 
-
-	trap 'docker compose -f ./test/docker-compose-test.yml down' 0
-
+	trap test_cleanup 0
+	
 	test_now
 }
 
@@ -218,6 +219,12 @@ test_now() {
 	echo "  NGINX Version: ${NGINX_VERSION}"
 }
 
+test_cleanup() {
+	docker compose \
+		-p ${TEST_CONTAINER_NAME_PREFIX} \
+		-f ${TEST_COMPOSE_FILE} down
+}
+
 get_port() {
 	startPort=${1:-8000}
 	endPort=$((startPort + 100))
diff --git a/src/ngx_http_auth_jwt_module.c b/src/ngx_http_auth_jwt_module.c
index fe428b4..59b84ac 100644
--- a/src/ngx_http_auth_jwt_module.c
+++ b/src/ngx_http_auth_jwt_module.c
@@ -290,13 +290,13 @@ static char *merge_extract_var_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *
   {
     // add this claim's name to the config struct
     ngx_str_t *element = ngx_array_push(claims);
-    
+
     *element = values[i];
 
     // add an http variable for this claim
     size_t var_name_len = 10 + element->len;
     u_char *buf = ngx_palloc(cf->pool, sizeof(u_char) * var_name_len);
-    
+
     if (buf == NULL)
     {
       return NGX_CONF_ERROR;
@@ -305,7 +305,7 @@ static char *merge_extract_var_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *
     {
       ngx_sprintf(buf, "jwt_claim_%V", element);
       ngx_str_t *var_name = ngx_palloc(cf->pool, sizeof(ngx_str_t));
-      
+
       if (var_name == NULL)
       {
         return NGX_CONF_ERROR;
@@ -314,31 +314,31 @@ static char *merge_extract_var_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *
       {
         var_name->data = buf;
         var_name->len = var_name_len;
-        
+
         // NGX_HTTP_VAR_CHANGEABLE simplifies the required logic by assuming a JWT claim will always be the same for a given request
         ngx_http_variable_t *http_var = ngx_http_add_variable(cf, var_name, NGX_HTTP_VAR_CHANGEABLE);
-        
+
         if (http_var == NULL)
         {
           ngx_log_error(NGX_LOG_ERR, cf->log, 0, "failed to add variable %V", var_name);
-          
+
           return NGX_CONF_ERROR;
         }
         else
         {
           http_var->get_handler = get_jwt_var_claim;
-      
+
           // store the index of this new claim in the claims array as the "data" that will be passed to the getter
           ngx_uint_t *claim_idx = ngx_palloc(cf->pool, sizeof(ngx_uint_t));
-          
+
           if (claim_idx == NULL)
           {
-              return NGX_CONF_ERROR;
+            return NGX_CONF_ERROR;
           }
           else
           {
             *claim_idx = claims->nelts - 1;
-            http_var->data = (uintptr_t) claim_idx;
+            http_var->data = (uintptr_t)claim_idx;
           }
         }
       }
@@ -350,26 +350,26 @@ static char *merge_extract_var_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *
 
 static ngx_int_t get_jwt_var_claim(ngx_http_request_t *r, ngx_http_variable_value_t *v, uintptr_t data)
 {
-  ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "getting jwt value for var index %l", *((ngx_uint_t*) data));
+  ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "getting jwt value for var index %l", *((ngx_uint_t *)data));
   auth_jwt_ctx_t *ctx = get_request_jwt_ctx(r);
-  
+
   if (ctx == NULL)
   {
     ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "no module context found while getting jwt value");
-    
+
     return NGX_ERROR;
   }
   else
   {
-    ngx_uint_t *claim_idx = (ngx_uint_t*) data;
-    ngx_str_t claim_value = ((ngx_str_t*) ctx->claim_values->elts)[*claim_idx];
-    
+    ngx_uint_t *claim_idx = (ngx_uint_t *)data;
+    ngx_str_t claim_value = ((ngx_str_t *)ctx->claim_values->elts)[*claim_idx];
+
     v->valid = 1;
     v->no_cacheable = 0;
     v->not_found = 0;
     v->len = claim_value.len;
     v->data = claim_value.data;
-  
+
     return NGX_OK;
   }
 }
@@ -420,7 +420,7 @@ static char *merge_extract_response_claims(ngx_conf_t *cf, ngx_command_t *cmd, v
 static auth_jwt_ctx_t *get_or_init_jwt_module_ctx(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf)
 {
   auth_jwt_ctx_t *ctx = ngx_http_get_module_ctx(r, ngx_http_auth_jwt_module);
-  
+
   if (ctx != NULL)
   {
     return ctx;
@@ -434,7 +434,8 @@ static auth_jwt_ctx_t *get_or_init_jwt_module_ctx(ngx_http_request_t *r, auth_jw
       ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "error allocating jwt module context");
       return ctx;
     }
-    else {
+    else
+    {
       if (jwtcf->extract_var_claims != NULL)
       {
         ctx->claim_values = ngx_array_create(r->pool, jwtcf->extract_var_claims->nelts, sizeof(ngx_str_t));
@@ -460,7 +461,7 @@ static auth_jwt_ctx_t *get_request_jwt_ctx(ngx_http_request_t *r)
 {
   auth_jwt_conf_t *jwtcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_jwt_module);
 
-  if(!jwtcf->enabled)
+  if (!jwtcf->enabled)
   {
     return NULL;
   }
@@ -587,7 +588,8 @@ static int validate_alg(auth_jwt_conf_t *jwtcf, jwt_t *jwt)
 {
   const jwt_alg_t alg = jwt_get_alg(jwt);
 
-  if (alg != JWT_ALG_HS256 && alg != JWT_ALG_HS384 && alg != JWT_ALG_HS512 && alg != JWT_ALG_RS256 && alg != JWT_ALG_RS384 && alg != JWT_ALG_RS512 && alg != JWT_ALG_ES256 && alg != JWT_ALG_ES384 && alg != JWT_ALG_ES512)  {
+  if (alg != JWT_ALG_HS256 && alg != JWT_ALG_HS384 && alg != JWT_ALG_HS512 && alg != JWT_ALG_RS256 && alg != JWT_ALG_RS384 && alg != JWT_ALG_RS512 && alg != JWT_ALG_ES256 && alg != JWT_ALG_ES384 && alg != JWT_ALG_ES512)
+  {
     return 1;
   }
 
@@ -625,7 +627,7 @@ static int validate_sub(auth_jwt_conf_t *jwtcf, jwt_t *jwt)
 static ngx_int_t extract_var_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf, jwt_t *jwt, auth_jwt_ctx_t *ctx)
 {
   ngx_array_t *claims = jwtcf->extract_var_claims;
-  
+
   if (claims == NULL || claims->nelts == 0)
   {
     return NGX_OK;
@@ -633,22 +635,22 @@ static ngx_int_t extract_var_claims(ngx_http_request_t *r, auth_jwt_conf_t *jwtc
   else
   {
     const ngx_str_t *claimsPtr = claims->elts;
-  
+
     for (uint i = 0; i < claims->nelts; ++i)
     {
       const ngx_str_t claim = claimsPtr[i];
       const char *claimValue = jwt_get_grant(jwt, (char *)claim.data);
       ngx_str_t value = ngx_string("");
-      
+
       if (claimValue != NULL && strlen(claimValue) > 0)
       {
         value = char_ptr_to_ngx_str_t(r->pool, claimValue);
       }
-      
-      ((ngx_str_t*) ctx->claim_values->elts)[i] = value;
+
+      ((ngx_str_t *)ctx->claim_values->elts)[i] = value;
       ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "set var %V to JWT claim value %s", &claim, value.data);
     }
-  
+
     return NGX_OK;
   }
 }
@@ -708,11 +710,16 @@ static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf)
     if (r->method == NGX_HTTP_GET)
     {
       const int loginlen = jwtcf->loginurl.len;
-      const char *scheme = (r->connection->ssl) ? "https" : "http";
+      const char *scheme = r->connection->ssl ? "https" : "http";
+      ngx_str_t port_variable_name = ngx_string("server_port");
+      ngx_int_t port_variable_hash = ngx_hash_key(port_variable_name.data, port_variable_name.len);
+      ngx_http_variable_value_t *port_var = ngx_http_get_variable(r, &port_variable_name, port_variable_hash);
+      char *port_str = "";
+      uint port_str_len = 0;
       const ngx_str_t server = r->headers_in.server;
       ngx_str_t uri_variable_name = ngx_string("request_uri");
       ngx_int_t uri_variable_hash = ngx_hash_key(uri_variable_name.data, uri_variable_name.len);
-      ngx_http_variable_value_t *request_uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
+      ngx_http_variable_value_t *uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
       ngx_str_t uri;
       ngx_str_t uri_escaped;
       uintptr_t escaped_len;
@@ -720,12 +727,12 @@ static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf)
       int return_url_idx;
 
       // get the URI
-      if (request_uri_var && !request_uri_var->not_found && request_uri_var->valid)
+      if (uri_var && !uri_var->not_found && uri_var->valid)
       {
         // ideally we would like the URI with the querystring parameters
-        uri.data = ngx_palloc(r->pool, request_uri_var->len);
-        uri.len = request_uri_var->len;
-        ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
+        uri.data = ngx_palloc(r->pool, uri_var->len);
+        uri.len = uri_var->len;
+        ngx_memcpy(uri.data, uri_var->data, uri_var->len);
       }
       else
       {
@@ -733,31 +740,59 @@ static ngx_int_t redirect(ngx_http_request_t *r, auth_jwt_conf_t *jwtcf)
         uri = r->uri;
       }
 
+      if (port_var && !port_var->not_found && port_var->valid)
+      {
+        const ngx_uint_t port_num = ngx_atoi(port_var->data, port_var->len);
+        const bool is_default_port_80 = !r->connection->ssl && port_num == 80;
+        const bool is_default_port_443 = r->connection->ssl && port_num == 443;
+        const bool is_non_default_port = !is_default_port_80 && !is_default_port_443;
+
+        if (is_non_default_port)
+        {
+          port_str = ngx_palloc(r->pool, NGX_INT_T_LEN + 2);
+
+          ngx_snprintf((u_char *)port_str, sizeof(port_str), ":%d", port_num);
+          port_str_len = strlen(port_str);
+        }
+      }
+
+
       // escape the URI
       escaped_len = 2 * ngx_escape_uri(NULL, uri.data, uri.len, NGX_ESCAPE_ARGS) + uri.len;
       uri_escaped.data = ngx_palloc(r->pool, escaped_len);
       uri_escaped.len = escaped_len;
       ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
 
-      r->headers_out.location->value.len = loginlen + strlen("?return_url=") + strlen(scheme) + strlen("://") + server.len + uri_escaped.len;
+      // Add up the lengths of: login URL, "?return_url=", scheme, "://", server, port, uri (path)
+      r->headers_out.location->value.len = loginlen + 12 + strlen(scheme) + 3 + server.len + port_str_len + uri_escaped.len;
 
       return_url = ngx_palloc(r->pool, r->headers_out.location->value.len);
-      ngx_memcpy(return_url, jwtcf->loginurl.data, jwtcf->loginurl.len);
 
+      ngx_memcpy(return_url, jwtcf->loginurl.data, jwtcf->loginurl.len);
       return_url_idx = jwtcf->loginurl.len;
-      ngx_memcpy(return_url + return_url_idx, "?return_url=", strlen("?return_url="));
 
-      return_url_idx += strlen("?return_url=");
-      ngx_memcpy(return_url + return_url_idx, scheme, strlen(scheme));
+      ngx_memcpy(return_url + return_url_idx, "?return_url=", 12);
+      return_url_idx += 12;
 
+      ngx_memcpy(return_url + return_url_idx, scheme, strlen(scheme));
       return_url_idx += strlen(scheme);
-      ngx_memcpy(return_url + return_url_idx, "://", strlen("://"));
 
-      return_url_idx += strlen("://");
-      ngx_memcpy(return_url + return_url_idx, server.data, server.len);
+      ngx_memcpy(return_url + return_url_idx, "://", 3);
+      return_url_idx += 3;
 
+      ngx_memcpy(return_url + return_url_idx, server.data, server.len);
       return_url_idx += server.len;
-      ngx_memcpy(return_url + return_url_idx, uri_escaped.data, uri_escaped.len);
+
+      if (port_str_len > 0)
+      {
+        ngx_memcpy(return_url + return_url_idx, port_str, port_str_len);
+        return_url_idx += port_str_len;
+      }
+
+      if (uri_escaped.len > 0)
+      {
+        ngx_memcpy(return_url + return_url_idx, uri_escaped.data, uri_escaped.len);
+      }
 
       r->headers_out.location->value.data = (u_char *)return_url;
     }
diff --git a/test/docker-compose-test.yml b/test/docker-compose-test.yml
index 14c88da..72ff710 100644
--- a/test/docker-compose-test.yml
+++ b/test/docker-compose-test.yml
@@ -1,20 +1,19 @@
 services:
 
   nginx:
-    container_name: ${TEST_CONTAINER_NAME_PREFIX}-nginx
+    container_name: ${TEST_CONTAINER_NAME_PREFIX:?required}-nginx
     build:
       context: .
       dockerfile: test-nginx.dockerfile
       args:
-        BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION}
+        BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION:?required}
     logging:
       driver: ${LOG_DRIVER:-journald}
 
   runner:
-    container_name: ${TEST_CONTAINER_NAME_PREFIX}-runner
+    container_name: ${TEST_CONTAINER_NAME_PREFIX:?required}-runner
     build:
       context: .
       dockerfile: test-runner.dockerfile
-    
     depends_on:
       - nginx
\ No newline at end of file
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
index 5359434..4e5d764 100644
--- a/test/etc/nginx/conf.d/test.conf
+++ b/test/etc/nginx/conf.d/test.conf
@@ -405,6 +405,7 @@ vXjq39xtcIBRTO1c2zs=
         if ($jwt_claim_sub = 'some-long-uuid') {
             return 200;
         }
+
         return 401;
     }
 
@@ -439,4 +440,9 @@ vXjq39xtcIBRTO1c2zs=
             return 301 /profile/$jwt_claim_sub;
         }
     }
+
+    location /return-url {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+    }
 }
diff --git a/test/test-nginx.dockerfile b/test/test-nginx.dockerfile
index e12acb4..1065558 100644
--- a/test/test-nginx.dockerfile
+++ b/test/test-nginx.dockerfile
@@ -1,13 +1,11 @@
 ARG BASE_IMAGE
-ARG PORT
-ARG SSL_PORT
 
-FROM ${BASE_IMAGE} AS NGINX
+FROM ${BASE_IMAGE:?required} AS NGINX
 ARG PORT
 ARG SSL_PORT
+
 COPY etc/ /etc/
-RUN sed -i "s|%{PORT}|${PORT}|" /etc/nginx/conf.d/test.conf
-RUN sed -i "s|%{SSL_PORT}|${SSL_PORT}|" /etc/nginx/conf.d/test.conf
+
 COPY <<` /usr/share/nginx/html/index.html
 <html>
   <head>Test</head>
@@ -16,3 +14,6 @@ COPY <<` /usr/share/nginx/html/index.html
   </body>
 </html>
 `
+
+RUN sed -i "s|%{PORT}|${PORT:?required}|" /etc/nginx/conf.d/test.conf
+RUN sed -i "s|%{SSL_PORT}|${SSL_PORT:?required}|" /etc/nginx/conf.d/test.conf
diff --git a/test/test-runner.dockerfile b/test/test-runner.dockerfile
index 0aca095..18fc3d3 100644
--- a/test/test-runner.dockerfile
+++ b/test/test-runner.dockerfile
@@ -1,16 +1,18 @@
 ARG RUNNER_BASE_IMAGE
-ARG PORT
-ARG SSL_PORT
 
-FROM ${RUNNER_BASE_IMAGE}
+FROM ${RUNNER_BASE_IMAGE:?required}
 ARG PORT
 ARG SSL_PORT
-ENV PORT=${PORT}
-ENV SSL_PORT=${SSL_PORT}
+
+ENV PORT=${PORT:?required}
+ENV SSL_PORT=${SSL_PORT:?required}
+
 RUN <<`
   set -e
   apt-get update
   apt-get install -y curl bash
 `
+
 COPY test.sh .
-CMD ./test.sh ${PORT} ${SSL_PORT}
+
+CMD ./test.sh
diff --git a/test/test.sh b/test/test.sh
index 747124c..c726a75 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -29,7 +29,7 @@ run_test () {
     local response=
     local testNum="${GRAY}${NUM_TESTS}${NC}\t"
 
-    while getopts "n:sp:r:c:x:" option; do
+    while getopts "n:asp:r:c:x:" option; do
       case $option in
         n)
           name=$OPTARG;;
@@ -73,7 +73,7 @@ run_test () {
       fi
       
       if [ "${okay}" == '1' ] && [ "${expectedResponseRegex}" != "" ] && ! [[ "${response}" =~ ${expectedResponseRegex} ]]; then
-        printf "${RED}${name} -- regex not found in response\n\tPath: ${path}\n\tRegEx: ${expectedResponseRegex}"
+        printf "${RED}${name} -- regex not found in response\n\tPath: ${path}\n\tRegEx: ${expectedResponseRegex//%/%%}"
         NUM_FAILED=$((${NUM_FAILED} + 1))
         okay=0
       fi
@@ -113,8 +113,8 @@ main() {
            -p '/' \
            -c '200'
 
-  run_test -s \
-           -n '[SSL] when auth disabled, should return 200' \
+  run_test -n '[SSL] when auth disabled, should return 200' \
+           -s \
            -p '/' \
            -c '200'
   
@@ -350,6 +350,26 @@ main() {
            -r '< Location: http://nginx:8000/profile/some-long-uuid' \
            -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
 
+  run_test -n 'returns 302 if auth enabled and no JWT provided' \
+           -p '/return-url' \
+           -c '302'
+
+  run_test -n 'redirects to login if auth enabled and no JWT provided' \
+           -p '/return-url' \
+           -r '< Location: https://example\.com/login.*'
+
+  run_test -n 'adds return_url to login URL when redirected to login' \
+           -p '/return-url' \
+           -r '< Location: https://example\.com/login\?return_url=http://nginx.*'
+
+  run_test -n 'return_url includes port when redirected to login' \
+           -p '/return-url' \
+           -r "< Location: https://example\.com/login\?return_url=http://nginx:${PORT}/return-url"
+
+  run_test -n 'return_url includes query when redirected to login' \
+           -p '/return-url?test=123' \
+           -r '< Location: https://example\.com/login\?return_url=http://nginx.*/return-url%3Ftest=123'
+
   if [[ "${NUM_FAILED}" = '0' ]]; then
     printf "\nRan ${NUM_TESTS} tests successfully (skipped ${NUM_SKIPPED}).\n"
     return 0

From a2e3e914998d4b82e91d2db9ec9e482f3b562c43 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Wed, 5 Feb 2025 14:37:41 -0500
Subject: [PATCH 122/130] fix artifact processing in workflow

---
 .github/workflows/make-releases.yml |  62 +++-
 test/docker-compose-test.yml        |  19 --
 test/ec_key_256.pem                 |   5 -
 test/ec_key_384.pem                 |   6 -
 test/ec_key_521.pem                 |   8 -
 test/etc/nginx/conf.d/test.conf     | 448 ----------------------------
 test/etc/nginx/ec_key_256-pub.pem   |   4 -
 test/etc/nginx/ec_key_384-pub.pem   |   5 -
 test/etc/nginx/ec_key_521-pub.pem   |   6 -
 test/etc/nginx/rsa_key_2048-pub.pem |   9 -
 test/etc/nginx/test.crt             |  23 --
 test/etc/nginx/test.key             |  28 --
 test/rsa_key_2048.pem               |  28 --
 test/test-nginx.dockerfile          |  19 --
 test/test-runner.dockerfile         |  18 --
 test/test.sh                        | 387 ------------------------
 16 files changed, 49 insertions(+), 1026 deletions(-)
 delete mode 100644 test/docker-compose-test.yml
 delete mode 100644 test/ec_key_256.pem
 delete mode 100644 test/ec_key_384.pem
 delete mode 100644 test/ec_key_521.pem
 delete mode 100644 test/etc/nginx/conf.d/test.conf
 delete mode 100644 test/etc/nginx/ec_key_256-pub.pem
 delete mode 100644 test/etc/nginx/ec_key_384-pub.pem
 delete mode 100644 test/etc/nginx/ec_key_521-pub.pem
 delete mode 100755 test/etc/nginx/rsa_key_2048-pub.pem
 delete mode 100644 test/etc/nginx/test.crt
 delete mode 100644 test/etc/nginx/test.key
 delete mode 100755 test/rsa_key_2048.pem
 delete mode 100644 test/test-nginx.dockerfile
 delete mode 100644 test/test-runner.dockerfile
 delete mode 100755 test/test.sh

diff --git a/.github/workflows/make-releases.yml b/.github/workflows/make-releases.yml
index 8d7c906..487c4bf 100644
--- a/.github/workflows/make-releases.yml
+++ b/.github/workflows/make-releases.yml
@@ -4,8 +4,29 @@ on:
   workflow_dispatch:
 
 jobs:
+  meta:
+    name: Get Metadata
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{steps.meta.outputs.tag}}
+    steps:
+
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get Metadata
+        id: meta
+        run: |
+          set -eu
+          tag=$(git describe --tags --abbrev=0)
+
+          echo "tag=${tag}" >> $GITHUB_OUTPUT
+
   build:
     name: "NGINX: ${{ matrix.nginx-version }}; libjwt: ${{ matrix.libjwt-version }}"
+    needs: meta
     strategy:
       matrix:
         # NGINX versions to build/test against
@@ -26,18 +47,17 @@ jobs:
     - name: Checkout Code
       uses: actions/checkout@v4
       with:
-        fetch-depth: 0
         path: ngx-http-auth-jwt-module
 
     - name: Get Metadata
       id: meta
       run: |
-        set -eux
-        cd ngx-http-auth-jwt-module
-
-        tag=$(git describe --tags --abbrev=0)
+        set -eu
+        artifact="ngx-http-auth-jwt-module-${{needs.meta.outputs.tag}}_libjwt-${{matrix.libjwt-version}}_nginx-${{matrix.nginx-version}}"
+        
+        echo "artifact=${artifact}" >> $GITHUB_OUTPUT
+        echo "filename=${artifact}.tgz" >> $GITHUB_OUTPUT
 
-        echo "filename=ngx-http-auth-jwt-module-${tag}_libjwt-${{matrix.libjwt-version}}_nginx-${{matrix.nginx-version}}.tgz" >> $GITHUB_OUTPUT
 
     # TODO cache the build result so we don't have to do this every time?
     - name: Download jansson
@@ -104,11 +124,14 @@ jobs:
       uses: actions/upload-artifact@v4
       with:
         if-no-files-found: error
-        name: ${{steps.meta.outputs.filename}}
+        name: ${{steps.meta.outputs.artifact}}
+        path: ${{steps.meta.outputs.filename}}
 
   release:
     name: Create/Update Release
-    needs: build
+    needs:
+      - meta
+      - build
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -119,25 +142,38 @@ jobs:
         run: |
           echo "date_now=$(date --rfc-3339=seconds)" >> "${GITHUB_OUTPUT}"
           
-      - name: Download Build Artifacts
+      - name: Download Artifacts
         uses: actions/download-artifact@v4
         with:
           path: artifacts
 
-      - name: Upload Builds to Release
+      - name: Flatten Artifacts
+        run: |
+          set -eu
+          
+          cd artifacts
+
+          for f in $(find . -type f); do
+            echo "Staging: ${f}"
+            mv "${f}" .
+          done
+
+          find . -type d -mindepth 1 -exec rm -rf "{}" +
+
+      - name: Create/Update Release
         uses: ncipollo/release-action@v1
         with:
-          name: 'Development Build: ${{ github.ref_name }}@${{ github.sha }}'
+          tag: ${{needs.meta.outputs.tag}}
+          name: "Pre-release: ${{needs.meta.outputs.tag}}"
           body: |
             > [!WARNING]
             > This is an automatically generated pre-release version of the module, which includes the latest master branch changes.
             > Please report any bugs you find.
 
             - Build Date: `${{ steps.vars.outputs.date_now }}`
-            - Commit: ${{ github.sha }}
+            - Commit: `${{ github.sha }}`
           prerelease: true
           allowUpdates: true
           removeArtifacts: true
           artifactErrorsFailBuild: true
           artifacts: artifacts/*
-          tag: dev-build
diff --git a/test/docker-compose-test.yml b/test/docker-compose-test.yml
deleted file mode 100644
index 72ff710..0000000
--- a/test/docker-compose-test.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-services:
-
-  nginx:
-    container_name: ${TEST_CONTAINER_NAME_PREFIX:?required}-nginx
-    build:
-      context: .
-      dockerfile: test-nginx.dockerfile
-      args:
-        BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION:?required}
-    logging:
-      driver: ${LOG_DRIVER:-journald}
-
-  runner:
-    container_name: ${TEST_CONTAINER_NAME_PREFIX:?required}-runner
-    build:
-      context: .
-      dockerfile: test-runner.dockerfile
-    depends_on:
-      - nginx
\ No newline at end of file
diff --git a/test/ec_key_256.pem b/test/ec_key_256.pem
deleted file mode 100644
index 4206969..0000000
--- a/test/ec_key_256.pem
+++ /dev/null
@@ -1,5 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOlEBGcZxxhv8FkN0
-YIvax6fnhJbMeotzIEBxIglkNu6hRANCAATP1NpDzvZmKd2Mw6hIrv4nzUfNu7OK
-mT5VuL5LhvUgzTqVGuxwevA7DlFsNVSfCljIBG3geio3fcd4k0Z9SygL
------END PRIVATE KEY-----
diff --git a/test/ec_key_384.pem b/test/ec_key_384.pem
deleted file mode 100644
index 2aa5780..0000000
--- a/test/ec_key_384.pem
+++ /dev/null
@@ -1,6 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDADyrL6llSQoQOZ/PF/
-l761kAbrTwn4vu30Kr34ScW6bRKVXLq3cT3QssJ1nF9B63qhZANiAAQ48dOfIEd3
-0TCVE0JT4ZU0Db7Ftz+ex7lojP7uqTY9OI59yoMB01zUN4JK30BRXS9Yv0A9Bu1z
-fgLu93FSn0kd0zIPMvuu5LUt60M/miSt2lA0OrqFhKjx6FFdN/lNh64=
------END PRIVATE KEY-----
diff --git a/test/ec_key_521.pem b/test/ec_key_521.pem
deleted file mode 100644
index 10471dc..0000000
--- a/test/ec_key_521.pem
+++ /dev/null
@@ -1,8 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIAKkag6aVn4XAbaALo
-0b3pypdP5RBX7uKxHmKlkNCcpA0oVTdgjnM5NpJP8ZOM6NjVhEzsn6c/Tdn8hL8w
-SI55hFWhgYkDgYYABABpTipSvbs8fq44u4fA+v7DTNYViA58sqbrxjxdzwWZ8eEj
-CXsH7yzSGx3Y19NSyrX8HbjWmrj5uxiKeFCB8mGzTwDcFIKCMeMkHjZs/fmVOumR
-a2XSpj7BP6wqcN6Pf+UqECivGAZGRHoabo/dm5zF9M3gO+G9eOrf3G1wgFFM7Vzb
-Ow==
------END PRIVATE KEY-----
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
deleted file mode 100644
index 4e5d764..0000000
--- a/test/etc/nginx/conf.d/test.conf
+++ /dev/null
@@ -1,448 +0,0 @@
-error_log /var/log/nginx/debug.log debug;
-access_log /var/log/nginx/access.log;
-
-server {
-    listen %{PORT};
-    listen %{SSL_PORT} ssl;
-    server_name localhost;
-
-    ssl_certificate /etc/nginx/test.crt;
-    ssl_certificate_key /etc/nginx/test.key;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers HIGH:!aNULL:!MD5;
-    
-    auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
-    auth_jwt_loginurl "https://example.com/login";
-    auth_jwt_enabled off;
-
-    location / {
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/cookie/default {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location COOKIE=jwt;
-        
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/cookie/default/validate-sub {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_validate_sub on;
-        auth_jwt_location COOKIE=jwt;
-        
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-        
-    location /secure/cookie/default/no-redirect {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location COOKIE=jwt;
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/cookie/hs256 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location COOKIE=jwt;
-        auth_jwt_algorithm HS256;
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/cookie/hs384 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location COOKIE=jwt;
-        auth_jwt_algorithm HS384;
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/cookie/hs512 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location COOKIE=jwt;
-        auth_jwt_algorithm HS512;
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/cookie/es256 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location COOKIE=jwt;
-        auth_jwt_algorithm ES256;
-        auth_jwt_key "-----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz9TaQ872ZindjMOoSK7+J81Hzbuz
-ipk+Vbi+S4b1IM06lRrscHrwOw5RbDVUnwpYyARt4HoqN33HeJNGfUsoCw==
------END PUBLIC KEY-----";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/cookie/es384 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location COOKIE=jwt;
-        auth_jwt_algorithm ES384;
-        auth_jwt_key "-----BEGIN PUBLIC KEY-----
-MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOPHTnyBHd9EwlRNCU+GVNA2+xbc/nse5
-aIz+7qk2PTiOfcqDAdNc1DeCSt9AUV0vWL9APQbtc34C7vdxUp9JHdMyDzL7ruS1
-LetDP5okrdpQNDq6hYSo8ehRXTf5TYeu
------END PUBLIC KEY-----";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/cookie/es512 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location COOKIE=jwt;
-        auth_jwt_algorithm ES512;
-        auth_jwt_key "-----BEGIN PUBLIC KEY-----
-MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAaU4qUr27PH6uOLuHwPr+w0zWFYgO
-fLKm68Y8Xc8FmfHhIwl7B+8s0hsd2NfTUsq1/B241pq4+bsYinhQgfJhs08A3BSC
-gjHjJB42bP35lTrpkWtl0qY+wT+sKnDej3/lKhAorxgGRkR6Gm6P3ZucxfTN4Dvh
-vXjq39xtcIBRTO1c2zs=
------END PUBLIC KEY-----";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/default {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/default/no-redirect {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/default/proxy-header {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-
-        add_header "Test-Authorization" "$http_authorization";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/rs256 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_key "-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
-uqNuffp4+4aUCwuFE9B5s9MJr63gyf8jW0oDr7Mb1Xb8y9iGkWfhouZqNJbMFry+
-iBs+z2TtJF06vbHQZzajDsdux3XVfXv9v6dDIImyU24MsGNkpNt0GISaaiqv51NM
-ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
-6swiIasEU3qNLKaJAZEzfywroVYr3BwM1IiVbQeKgIkyPS/85M4Y6Ss/T+OWi1Oe
-K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
-BwIDAQAB
------END PUBLIC KEY-----";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/es256 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_key "-----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz9TaQ872ZindjMOoSK7+J81Hzbuz
-ipk+Vbi+S4b1IM06lRrscHrwOw5RbDVUnwpYyARt4HoqN33HeJNGfUsoCw==
------END PUBLIC KEY-----";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/es384 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_key "-----BEGIN PUBLIC KEY-----
-MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOPHTnyBHd9EwlRNCU+GVNA2+xbc/nse5
-aIz+7qk2PTiOfcqDAdNc1DeCSt9AUV0vWL9APQbtc34C7vdxUp9JHdMyDzL7ruS1
-LetDP5okrdpQNDq6hYSo8ehRXTf5TYeu
------END PUBLIC KEY-----";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/es512 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_key "-----BEGIN PUBLIC KEY-----
-MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAaU4qUr27PH6uOLuHwPr+w0zWFYgO
-fLKm68Y8Xc8FmfHhIwl7B+8s0hsd2NfTUsq1/B241pq4+bsYinhQgfJhs08A3BSC
-gjHjJB42bP35lTrpkWtl0qY+wT+sKnDej3/lKhAorxgGRkR6Gm6P3ZucxfTN4Dvh
-vXjq39xtcIBRTO1c2zs=
------END PUBLIC KEY-----";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/rs256/file {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_algorithm RS256;
-        auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/rsa_key_2048-pub.pem";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/rs384/file {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_algorithm RS384;
-        auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/rsa_key_2048-pub.pem";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/rs512/file {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_algorithm RS512;
-        auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/rsa_key_2048-pub.pem";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/es256/file {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_algorithm ES256;
-        auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/ec_key_256-pub.pem";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/es384/file {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_algorithm ES384;
-        auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/ec_key_384-pub.pem";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/auth-header/es512/file {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_algorithm ES512;
-        auth_jwt_use_keyfile on;
-        auth_jwt_keyfile_path "/etc/nginx/ec_key_521-pub.pem";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/custom-header/hs256 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-        auth_jwt_location HEADER=Auth-Token;
-        auth_jwt_algorithm HS256;
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/extract-claim/request/sub {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_extract_request_claims sub;
-
-        add_header "Test" "sub=$http_jwt_sub";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/extract-claim/request/name-1 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_extract_request_claims firstName lastName;
-
-        add_header "Test" "firstName=$http_jwt_firstname; lastName=$http_jwt_lastname";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/extract-claim/request/name-2 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_extract_request_claims firstName;
-        auth_jwt_extract_request_claims lastName;
-
-        add_header "Test" "firstName=$http_jwt_firstname; lastName=$http_jwt_lastname";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/extract-claim/request/nested {
-        location /secure/extract-claim/request/nested {
-            auth_jwt_enabled on;
-            auth_jwt_redirect off;
-            auth_jwt_location HEADER=Authorization;
-            auth_jwt_extract_request_claims username;
-
-            add_header "Test" "username=$http_jwt_username";
-
-            alias /usr/share/nginx/html/;
-            try_files index.html =404;
-        }
-    }
-
-    location /secure/extract-claim/response/sub {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_extract_response_claims sub;
-
-        add_header "Test" "sub=$sent_http_jwt_sub";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/extract-claim/response/name-1 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_extract_response_claims firstName lastName;
-
-        add_header "Test" "firstName=$sent_http_jwt_firstname; lastName=$sent_http_jwt_lastname";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/extract-claim/response/name-2 {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_extract_response_claims firstName;
-        auth_jwt_extract_response_claims lastName;
-
-        add_header "Test" "firstName=$sent_http_jwt_firstname; lastName=$sent_http_jwt_lastname";
-
-        alias /usr/share/nginx/html/;
-        try_files index.html =404;
-    }
-
-    location /secure/extract-claim/response/nested {
-        location /secure/extract-claim/response/nested {
-            auth_jwt_enabled on;
-            auth_jwt_redirect off;
-            auth_jwt_location HEADER=Authorization;
-            auth_jwt_extract_response_claims username;
-
-            add_header "Test" "username=$sent_http_jwt_username";
-
-            alias /usr/share/nginx/html/;
-            try_files index.html =404;
-        }
-    }
-
-    location /secure/extract-claim/if/sub {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_extract_var_claims sub;
-
-        if ($jwt_claim_sub = 'some-long-uuid') {
-            return 200;
-        }
-
-        return 401;
-    }
-
-    location /secure/extract-claim/body/sub {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_extract_var_claims sub;
-
-        return 200 "sub: $jwt_claim_sub";
-    }
-
-    location /secure/extract-claim/body/multiple {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_validate_sub on;
-        auth_jwt_extract_var_claims firstName middleName lastName;
-
-        return 200 "you are: $jwt_claim_firstName $jwt_claim_middleName $jwt_claim_lastName";
-    }
-
-    location /profile {
-        auth_jwt_enabled on;
-        auth_jwt_redirect off;
-        auth_jwt_location HEADER=Authorization;
-        auth_jwt_validate_sub on;
-
-        location /profile/me {
-            auth_jwt_extract_var_claims sub;
-
-            return 301 /profile/$jwt_claim_sub;
-        }
-    }
-
-    location /return-url {
-        auth_jwt_enabled on;
-        auth_jwt_redirect on;
-    }
-}
diff --git a/test/etc/nginx/ec_key_256-pub.pem b/test/etc/nginx/ec_key_256-pub.pem
deleted file mode 100644
index 3306ea0..0000000
--- a/test/etc/nginx/ec_key_256-pub.pem
+++ /dev/null
@@ -1,4 +0,0 @@
------BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz9TaQ872ZindjMOoSK7+J81Hzbuz
-ipk+Vbi+S4b1IM06lRrscHrwOw5RbDVUnwpYyARt4HoqN33HeJNGfUsoCw==
------END PUBLIC KEY-----
diff --git a/test/etc/nginx/ec_key_384-pub.pem b/test/etc/nginx/ec_key_384-pub.pem
deleted file mode 100644
index e642ed1..0000000
--- a/test/etc/nginx/ec_key_384-pub.pem
+++ /dev/null
@@ -1,5 +0,0 @@
------BEGIN PUBLIC KEY-----
-MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOPHTnyBHd9EwlRNCU+GVNA2+xbc/nse5
-aIz+7qk2PTiOfcqDAdNc1DeCSt9AUV0vWL9APQbtc34C7vdxUp9JHdMyDzL7ruS1
-LetDP5okrdpQNDq6hYSo8ehRXTf5TYeu
------END PUBLIC KEY-----
diff --git a/test/etc/nginx/ec_key_521-pub.pem b/test/etc/nginx/ec_key_521-pub.pem
deleted file mode 100644
index 0cb875c..0000000
--- a/test/etc/nginx/ec_key_521-pub.pem
+++ /dev/null
@@ -1,6 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAaU4qUr27PH6uOLuHwPr+w0zWFYgO
-fLKm68Y8Xc8FmfHhIwl7B+8s0hsd2NfTUsq1/B241pq4+bsYinhQgfJhs08A3BSC
-gjHjJB42bP35lTrpkWtl0qY+wT+sKnDej3/lKhAorxgGRkR6Gm6P3ZucxfTN4Dvh
-vXjq39xtcIBRTO1c2zs=
------END PUBLIC KEY-----
diff --git a/test/etc/nginx/rsa_key_2048-pub.pem b/test/etc/nginx/rsa_key_2048-pub.pem
deleted file mode 100755
index 01f59bf..0000000
--- a/test/etc/nginx/rsa_key_2048-pub.pem
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
-uqNuffp4+4aUCwuFE9B5s9MJr63gyf8jW0oDr7Mb1Xb8y9iGkWfhouZqNJbMFry+
-iBs+z2TtJF06vbHQZzajDsdux3XVfXv9v6dDIImyU24MsGNkpNt0GISaaiqv51NM
-ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
-6swiIasEU3qNLKaJAZEzfywroVYr3BwM1IiVbQeKgIkyPS/85M4Y6Ss/T+OWi1Oe
-K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
-BwIDAQAB
------END PUBLIC KEY-----
diff --git a/test/etc/nginx/test.crt b/test/etc/nginx/test.crt
deleted file mode 100644
index fb406ba..0000000
--- a/test/etc/nginx/test.crt
+++ /dev/null
@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDwzCCAqugAwIBAgIUMG9M4Itu0cOyX0+La+7huiIoX6YwDQYJKoZIhvcNAQEL
-BQAwcTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMRUwEwYDVQQHDAxG
-YWxscyBDaHVyY2gxHzAdBgNVBAoMFlRlc2xhIEdvdmVybm1lbnQsIEluYy4xFzAV
-BgNVBAsMDk5HSU5YIEF1dGggSldUMB4XDTI0MDMxNTE4MTM1MloXDTM0MDMxMzE4
-MTM1MlowcTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMRUwEwYDVQQH
-DAxGYWxscyBDaHVyY2gxHzAdBgNVBAoMFlRlc2xhIEdvdmVybm1lbnQsIEluYy4x
-FzAVBgNVBAsMDk5HSU5YIEF1dGggSldUMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAih41Ct5XgcSTz7ZVAjBb0t0z9Qae08aseoMEKJf7AmNqKtsvzeAw
-/DJxOWJR5VPtUWhFAmXxPfG2B6aiSIVJVpG9yzcdQlCvyJG7Ub4QCm5GXwpU+zDC
-qmD5ksz9QMdOzvRLypAU1ciZiCXjwpUnW+BZyZ9Tpmsxm6/gOzkd3rxoIbc9uXxp
-5o4n6k02EPSzLzUhkZnhLQrOAGUB7+q11FAU5eNMlTWC9gQUsbNaTVtKmM2eV9BA
-UHdX2GbkfFbN22l3Wey4oyNZWmye1ZFOPyBR+tyU3pofhb+R+hTFmeNBzrJq3i30
-Qi0B8AnulKdOjnTysPYjDTrN6xcVDWNmPQIDAQABo1MwUTAdBgNVHQ4EFgQUczdy
-7s64NJHNGsQTf/zwFnQe6LMwHwYDVR0jBBgwFoAUczdy7s64NJHNGsQTf/zwFnQe
-6LMwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAfcxCiz6ShHof
-lXiE2j+s556SM2n8oW/S1BSjFC2wF1uKVeMJA1gAaWObC3ElqffFlqTdCorhgRS/
-knWa+Sqe/jWBSgwLG/e5DvxXWjD7b7kZdAZNy9evs5nhVfcLT+GyvB/z5GdAFY7s
-xYmLrC07ubhHIL9h7lhNKbRr++o+BcClQBZKRO4fxBwXxqx/rHudjH87Wr61Ov52
-90xNjwcqvevY0skmPao5+oyxkURdKZualNxiOGMPpywkpJkfl8Az5xKAJhUMAtFR
-smhQduejEkcxfxtsiYgVoulI29GAsMr9zHps9zb5k0+SWIiSixjQ0CpRhLcNYu4F
-QPgLQLGwUQ==
------END CERTIFICATE-----
diff --git a/test/etc/nginx/test.key b/test/etc/nginx/test.key
deleted file mode 100644
index 13ec754..0000000
--- a/test/etc/nginx/test.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCKHjUK3leBxJPP
-tlUCMFvS3TP1Bp7Txqx6gwQol/sCY2oq2y/N4DD8MnE5YlHlU+1RaEUCZfE98bYH
-pqJIhUlWkb3LNx1CUK/IkbtRvhAKbkZfClT7MMKqYPmSzP1Ax07O9EvKkBTVyJmI
-JePClSdb4FnJn1OmazGbr+A7OR3evGghtz25fGnmjifqTTYQ9LMvNSGRmeEtCs4A
-ZQHv6rXUUBTl40yVNYL2BBSxs1pNW0qYzZ5X0EBQd1fYZuR8Vs3baXdZ7LijI1la
-bJ7VkU4/IFH63JTemh+Fv5H6FMWZ40HOsmreLfRCLQHwCe6Up06OdPKw9iMNOs3r
-FxUNY2Y9AgMBAAECggEAAkwEggGp/xb67FCyDJ8rdimTZFPi9U7coUCN8HNI/qrf
-lTnfvox0oOUUqMMmIIQeS/HJ4ANvZe8GO3QkE8R5Sg7F0yjZL2tyTCNPgOMCMK8E
-mmHS58brHdrbm658C1ILnfmssjNmNueNbuW00Koa8imCsY2ZEW+L7vTKuMFqg6c+
-BDJxC4yoCPwSTVfcajjzI6FVfphE0pd8Ho/sE8vTqdmovh23+vgfNUq1L9Smvf7R
-YLM+hS1ouRP2BI5AN0sm04Kxd8MKPzuwCxteoZ9Y9YHyr1JeWGTTL0T24+LwUee/
-24zXZFrzpTgmtDYeEuVWsF5bP/fMS4Fctda3pdJMsQKBgQDCANjGDwwfSCCev2kl
-WdrFJywhn5hWLWFwlo/FwLOsFJtejaBwIDRQCMPZ74H+KMHwUnO3vTanKJWqDRP9
-CdMh94C1BqobRV6rN4HgA4Opxim1EyRWHV6ui41zokk2mJrwUzKkR8t9lt9EZKrk
-ZPyKER9A4hBqBmYvaYxodN8U1QKBgQC2QXUQq9j7niT7t4xMi0e9vnPLs0z1yUK9
-0nzKwTHDPflk3o2sKvH7199qVkc15JQ9DQ7NuYD7ezLbE3DJuVzpNDAfNXmfWHmp
-7ukdnxyn6ZCmzQY7/fTpJTEGKVQMVCgf2f5ANgxm5EmN0yWRMcEt1VXIwCisY56p
-o6nwv/1fyQKBgQCJBnIVyjEEszwfBBEvCX0kvVtFUGUXkSv+isl3onkFNPTcXuoP
-6B8q3FYAy1MkggMhTAthnqpIfLjhCCWzFspidl8Y/WEOq/uGsUjxQWowcr+onqGO
-lWX3oKfDIb/WaQkeb5UYRYFr7jE6LGQrt0xL9HX/rOxtBqIMIN/EM7ARFQKBgDAJ
-zMtaIFUh9+mJFafPRleS7X6RggV+yOKzqkTe6zjlCuk1Z+4rW6Df43lpyFdCKnh1
-CqPa805VyK/Jzf69pumo4c44EBiZ/2d1G2i9WZZAj+oHPE9vvq/9J5DSL98YB4Nt
-uABAvsAYB/Mj5lEA5kQoaPYDADWABH/+LXrRf/1RAoGAUvxPvmpkGMC+KdmjLam7
-CPC3+y4MZOyZ11BhOxLhd1K2qcQd9K7tkjUhNxRn5GVzpzOKeFJFtiih2uN+PBNJ
-oylPR03uk/7D52b1OYaJhs9bQkth//Qk935nyRM26C2vG4tQLfT/cFi5F53n0ZCQ
-7e8O6+QY0lZnpvsfnt8YIsM=
------END PRIVATE KEY-----
diff --git a/test/rsa_key_2048.pem b/test/rsa_key_2048.pem
deleted file mode 100755
index 0f58120..0000000
--- a/test/rsa_key_2048.pem
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDC2kwAziXUf33m
-iqWp0yG6o259+nj7hpQLC4UT0Hmz0wmvreDJ/yNbSgOvsxvVdvzL2IaRZ+Gi5mo0
-lswWvL6IGz7PZO0kXTq9sdBnNqMOx27HddV9e/2/p0MgibJTbgywY2Sk23QYhJpq
-Kq/nU0xlBfSaI5ddZ2RC9ZNkVeGawUKYksTruhAVJqviHN8BoK6VowP5vcxyyOWH
-TK9KruDqzCIhqwRTeo0spokBkTN/LCuhVivcHAzUiJVtB4qAiTI9L/zkzhjpKz9P
-45aLU54rj011gG8U/6E1USh5nMnPkr+d3oLfkhfS3Zs3kJVdyFQWZpQxiTaI92Fd
-2wLvbS0HAgMBAAECggEAD8dTnkETSSjlzhRuI9loAtAXM3Zj86JLPLW7GgaoxEoT
-n7lJ2bGicFMHB2ROnbOb9vnas82gtOtJsGaBslmoaCckp/C5T1eJWTEb+i+vdpPp
-wZcmKZovyyRFSE4+NYlU17fEv6DRvuaGBpDcW7QgHJIl45F8QWEM+msee2KE+V4G
-z/9vAQ+sOlvsb4mJP1tJIBx9Lb5loVREwCRy2Ha9tnWdDNar8EYkOn8si4snPT+E
-3ZCy8mlcZyUkZeiS/HdtydxZfoiwrSRYamd1diQpPhWCeRteQ802a7ds0Y2YzgfF
-UaYjNuRQm7zA//hwbXS7ELPyNMU15N00bajlG0tUOQKBgQDnLy01l20OneW6A2cI
-DIDyYhy5O7uulsaEtJReUlcjEDMkin8b767q2VZHb//3ZH+ipnRYByUUyYUhdOs2
-DYRGGeAebnH8wpTT4FCYxUsIUpDfB7RwfdBONgaKewTJz/FPswy1Ye0b5H2c6vVi
-m2FZ33HQcoZ3wvFFqyGVnMzpOwKBgQDXxL95yoxUGKa8vMzcE3Cn01szh0dFq0sq
-cFpM+HWLVr84CItuG9H6L0KaStEEIOiJsxOVpcXfFFhsJvOGhMA4DQTwH4WuXmXp
-1PoVMDlV65PYqvhzwL4+QhvZO2bsrEunITXOmU7CI6kilnAN3LuP4HbqZgoX9lqP
-I31VYzLupQKBgGEYck9w0s/xxxtR9ILv5XRnepLdoJzaHHR991aKFKjYU/KD7JDK
-INfoAhGs23+HCQhCCtkx3wQVA0Ii/erM0II0ueluD5fODX3TV2ZibnoHW2sgrEsW
-vFcs36BnvIIaQMptc+f2QgSV+Z/fGsKYadG6Q+39O7au/HB7SHayzWkjAoGBAMgt
-Fzslp9TpXd9iBWjzfCOnGUiP65Z+GWkQ/SXFqD+SRir0+m43zzGdoNvGJ23+Hd6K
-TdQbDJ0uoe4MoQeepzoZEgi4JeykVUZ/uVfo+nh06yArVf8FxTm7WVzLGGzgV/uA
-+wtl/cRtEyAsk1649yW/KHPEIP8kJdYAJeoO8xSlAoGAERMrkFR7KGYZG1eFNRdV
-mJMq+Ibxyw8ks/CbiI+n3yUyk1U8962ol2Q0T4qjBmb26L5rrhNQhneM4e8mo9FX
-LlQapYkPvkdrqW0Bp72A/UNAvcGTmN7z5OCJGMUutx2hmEAlrYmpLKS8pM/p9zpK
-tEOtzsP5GMDYVlEp1jYSjzQ=
------END PRIVATE KEY-----
diff --git a/test/test-nginx.dockerfile b/test/test-nginx.dockerfile
deleted file mode 100644
index 1065558..0000000
--- a/test/test-nginx.dockerfile
+++ /dev/null
@@ -1,19 +0,0 @@
-ARG BASE_IMAGE
-
-FROM ${BASE_IMAGE:?required} AS NGINX
-ARG PORT
-ARG SSL_PORT
-
-COPY etc/ /etc/
-
-COPY <<` /usr/share/nginx/html/index.html
-<html>
-  <head>Test</head>
-  <body>
-    <h1>NGINX Auth-JWT Module Test</h1>
-  </body>
-</html>
-`
-
-RUN sed -i "s|%{PORT}|${PORT:?required}|" /etc/nginx/conf.d/test.conf
-RUN sed -i "s|%{SSL_PORT}|${SSL_PORT:?required}|" /etc/nginx/conf.d/test.conf
diff --git a/test/test-runner.dockerfile b/test/test-runner.dockerfile
deleted file mode 100644
index 18fc3d3..0000000
--- a/test/test-runner.dockerfile
+++ /dev/null
@@ -1,18 +0,0 @@
-ARG RUNNER_BASE_IMAGE
-
-FROM ${RUNNER_BASE_IMAGE:?required}
-ARG PORT
-ARG SSL_PORT
-
-ENV PORT=${PORT:?required}
-ENV SSL_PORT=${SSL_PORT:?required}
-
-RUN <<`
-  set -e
-  apt-get update
-  apt-get install -y curl bash
-`
-
-COPY test.sh .
-
-CMD ./test.sh
diff --git a/test/test.sh b/test/test.sh
deleted file mode 100755
index c726a75..0000000
--- a/test/test.sh
+++ /dev/null
@@ -1,387 +0,0 @@
-#!/bin/bash -eu
-
-# set a test # here to execute only that test and output additional info
-DEBUG=
-
-RED='\e[31m'
-GREEN='\e[32m'
-GRAY='\e[90m'
-NC='\e[00m'
-
-NUM_TESTS=0;
-NUM_SKIPPED=0;
-NUM_FAILED=0;
-
-run_test () {
-  NUM_TESTS=$((${NUM_TESTS} + 1));
-
-  if [ "${DEBUG}" == '' ] || [ ${DEBUG} == ${NUM_TESTS} ]; then
-    local OPTIND;
-    local name=
-    local path=
-    local expectedCode=
-    local expectedResponseRegex=
-    local extraCurlOpts=
-    local scheme='http'
-    local port=${PORT}
-    local curlCommand=
-    local exitCode=
-    local response=
-    local testNum="${GRAY}${NUM_TESTS}${NC}\t"
-
-    while getopts "n:asp:r:c:x:" option; do
-      case $option in
-        n)
-          name=$OPTARG;;
-        s)
-          scheme='https'
-          port=${SSL_PORT};;
-        p)
-          path=$OPTARG;;
-        c)
-          expectedCode=$OPTARG;;
-        r)
-          expectedResponseRegex=$OPTARG;;
-        x)
-          extraCurlOpts=$OPTARG;;
-        \?) # Invalid option
-          printf "Error: Invalid option\n";
-          exit;;
-      esac
-    done
-
-    curlCommand="curl -skv ${scheme}://nginx:${port}${path} -H 'Cache-Control: no-cache' ${extraCurlOpts} 2>&1"
-    response=$(eval "${curlCommand}")
-    exitCode=$?
-    
-    printf "\n${testNum}"
-
-    if [ "${exitCode}" -ne "0" ]; then
-      printf "${RED}${name} -- unexpected exit code from cURL\n\tcURL Exit Code: ${exitCode}";
-      NUM_FAILED=$((${NUM_FAILED} + 1));
-    else
-      local okay=1
-
-      if [ "${expectedCode}" != "" ]; then
-        local responseCode=$(echo "${response}" | grep -Eo 'HTTP/1.1 ([0-9]{3})' | awk '{print $2}')
-
-        if [ "${expectedCode}" != "${responseCode}" ]; then
-          printf "${RED}${name} -- unexpected status code\n\tExpected: ${expectedCode}\n\tActual: ${responseCode}\n\tPath: ${path}"
-          NUM_FAILED=$((${NUM_FAILED} + 1))
-          okay=0
-        fi
-      fi
-      
-      if [ "${okay}" == '1' ] && [ "${expectedResponseRegex}" != "" ] && ! [[ "${response}" =~ ${expectedResponseRegex} ]]; then
-        printf "${RED}${name} -- regex not found in response\n\tPath: ${path}\n\tRegEx: ${expectedResponseRegex//%/%%}"
-        NUM_FAILED=$((${NUM_FAILED} + 1))
-        okay=0
-      fi
-      
-      if [ "${okay}" == '1' ]; then
-        printf "${GREEN}${name}";
-      fi
-    fi
-
-    if [ "${DEBUG}" == "${NUM_TESTS}" ]; then
-      printf '\n\tcURL Command: %s' "${curlCommand:---}"
-      printf '\n\tResponse: %s' "${response:---}"
-    fi
-
-    printf "${NC}\n"
-  else
-    NUM_SKIPPED=$((${NUM_SKIPPED} + 1))
-  fi
-}
-
-main() {
-  local JWT_HS256_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.r8tG8IZheiQ-i6HqUYyJj9V6dipgcQ4ZIdxau6QCZDo
-  local JWT_HS256_MISSING_SUB=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
-  local JWT_HS256_MISSING_EMAIL=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
-  local JWT_HS384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.SS57j7PEybjbsp3g5W-IhhJHBmG5K-97qvgBKL16xj9ey-uMeEenWjGbB2vVp0kq
-  local JWT_HS512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.xtSU6EWN2LILVsYzJFJpKnRkqjn_3qjz-J2ttNKnhZ60_5YjFeC8io4k8k1u77zlohSWvWMdugD9ZaB3vjJo-w
-  local JWT_RS256_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
-  local JWT_RS256_INVALID=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
-  local JWT_RS384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.H35bTcZRhepWIoa8pKCbUMRuAOkVX9K5hJjc6tPmQwWmTw8lrktsvmMzJg_rgqnJLnAkciSIQw5EDj7fngS5zX2ThyRxrkPuE2Uiyw2Ect-mo9Kg1lrWgnyZCuCgq-Up9HQRAv0160mePlm8Gs4TOY6CPr38zwTcDZsy_Keq93igDQV8WuuWAGICaGd5ZyUOPjjzGShRjTU8Szz7fnpZpTtYRCYVo0pc5yfRWYm0fdn-4AseyGvd8JJ2xfnAEe4kZOkz7X1MLKtL0slKg3m2PH1lD7HwxIawXRTPWxArhJ9dcTNiDUrqtde2juGwOuMD_zTsb2Jj0_rmRb0Q6aljNw
-  local JWT_RS512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.iUupyKypfXJ5aZWfItSW-mOmx9a4C4X7Yr5p5Fk8W75ZhkOq0EeNfstTxx870brhkdPovBhO2LYI44_HoH9XicQNL6JnFprE0r61eJFngbuzlhRQiWpq0xYrazJWc9zB7_GgL2ZCwtw-Ts3G23Q0632wVm6-d7MKvG7RS8aEjN-MuVGdtLglH3forpItmFxw-if40EQsBL7hncN_XNcQTO4KPHkqmlpac_oKXRrLFDIIt2tB6OOpvY4QcpERoxexp4pi2f-JoINnWX_dU5JnIs3ypVJLQPfoJvxg8fsg3zYrOvMYnfsqOCYoHtZGK0O7jyfFmcGo5v2hLT-CpoF3Zw
-  local JWT_ES256_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.WFfJXGr5whKHB7arjsTXPTJ6TAsS1LoRxu7Vj2_HrLaIQphWJM6BICf-M3cv52tFzt-XTZb6GxlDgAbHo8z9Zg
-  local JWT_ES256_INVALID=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
-  local JWT_ES384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._EFxXYOTAfT3gB3xUfgGR2UyXHeRTlDWqA94oZbB0DDa7YPZTEX9T4C_0ylnOFKZ6irGHZA8vxjgXDH3DZKWwBWcZ-XaQ_Q4Ws2J-AEeLqcl7_CS6q9mFo0Y7vUNEn-W
-  local JWT_ES512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.AFY4gNCtZNYkrTiijDkV4eKIt2UPMIuJBfZIk69jgI8FSGCQyUIMmIVg0fTvbaSiaryXzcjbG5TCm8a9Vu3KFJutAHGrgvZqcdklxx6Fbk3an3r_CH68n_ncwS3SUV58mDjf0OX8jRuNdudU1L5xYNQdodo-fxPIb1oHXfMJ0CmULDR9
-
-  run_test -n 'when auth disabled, should return 200' \
-           -p '/' \
-           -c '200'
-
-  run_test -n '[SSL] when auth disabled, should return 200' \
-           -s \
-           -p '/' \
-           -c '200'
-  
-  run_test -n 'when auth enabled with default algorithm and no JWT in Authorization header, returns 302' \
-           -p '/secure/auth-header/default' \
-           -c '302'
-  
-  run_test -n '[SSL] when auth enabled with default algorithm and no JWT in Authorization header, returns 302' \
-           -s \
-           -p '/secure/auth-header/default' \
-           -c '302'
-
-  run_test -n 'when auth enabled with default algorithm with no redirect and Authorization header missing Bearer, should return 200' \
-           -p '/secure/auth-header/default/no-redirect' \
-           -c '200' \
-           -x "--header \"Authorization: ${JWT_HS256_VALID}\""
-
-  run_test -n 'when auth enabled with default algorithm with no redirect and Authorization header with Bearer, should return 200' \
-           -p '/secure/auth-header/default/no-redirect' \
-           -c '200' \
-           -x "--header \"Authorization: Bearer ${JWT_HS256_VALID}\""
-
-  run_test -n 'when auth enabled with Authorization header with Bearer, should keep header intact' \
-           -p '/secure/auth-header/default/proxy-header' \
-           -c '200' \
-           -r "< Test-Authorization: Bearer ${JWT_HS256_VALID}" \
-           -x "--header \"Authorization: Bearer ${JWT_HS256_VALID}\""
-
-  run_test -n 'when auth enabled with Authorization header with Bearer, lower-case "bearer" should be accepted' \
-           -p '/secure/auth-header/default/proxy-header' \
-           -c '200' \
-           -r "< Test-Authorization: bearer ${JWT_HS256_VALID}" \
-           -x "--header \"Authorization: bearer ${JWT_HS256_VALID}\""
-
-  run_test -n 'when auth enabled with default algorithm and no JWT cookie, returns 302' \
-           -p '/secure/cookie/default' \
-           -c '302'
-
-  run_test -n 'when auth enabled with default algorithm with no redirect and no JWT cookie, should return 401' \
-           -p '/secure/cookie/default/no-redirect' \
-           -c '401'
-
-  run_test -n 'when auth enabled with default algorithm and valid JWT cookie, returns 200' \
-           -p '/secure/cookie/default' \
-           -c '200' \
-           -x "--cookie jwt=${JWT_HS256_VALID}"
-
-  run_test -n 'when auth enabled with default algorithm and valid JWT cookie with no sub, returns 200' \
-           -p '/secure/cookie/default' \
-           -c '200' \
-           -x ' --cookie "jwt=${JWT_HS256_MISSING_SUB}"'
-
-  run_test -n 'when auth enabled with default algorithm and valid JWT cookie with no sub when sub validated, returns 302' \
-           -p '/secure/cookie/default/validate-sub' \
-           -c '302' \
-           -x ' --cookie "jwt=${JWT_HS256_MISSING_SUB}"'
-
-  run_test -n 'when auth enabled with default algorithm and valid JWT cookie with no email, returns 200' \
-           -p '/secure/cookie/default' \
-           -c '200' \
-           -x ' --cookie "jwt=${JWT_HS256_MISSING_EMAIL}"'
-
-  run_test -n 'when auth enabled with HS256 algorithm and valid JWT cookie, returns 200' \
-           -p '/secure/cookie/hs256' \
-           -c '200' \
-           -x '--cookie "jwt=${JWT_HS256_VALID}"'
-
-  run_test -n 'when auth enabled with HS384 algorithm and valid JWT cookie, returns 200' \
-           -p '/secure/cookie/hs384' \
-           -c '200' \
-           -x '--cookie "jwt=${JWT_HS384_VALID}"'
-
-  run_test -n 'when auth enabled with HS512 algorithm and valid JWT cookie, returns 200' \
-           -p '/secure/cookie/hs512' \
-           -c '200' \
-           -x '--cookie "jwt=${JWT_HS512_VALID}"'
-
-  run_test -n 'when auth enabled with RS256 algorithm and valid JWT cookie, returns 200' \
-           -p '/secure/cookie/rs256' \
-           -c '200' \
-           -x ' --cookie "jwt=${JWT_RS256_VALID}"'
-
-  run_test -n 'when auth enabled with ES256 algorithm and valid JWT cookie, returns 200' \
-           -p '/secure/cookie/es256' \
-           -c '200' \
-           -x ' --cookie "jwt=${JWT_ES256_VALID}"'
-
-  run_test -n 'when auth enabled with ES384 algorithm and valid JWT cookie, returns 200' \
-           -p '/secure/cookie/es384' \
-           -c '200' \
-           -x ' --cookie "jwt=${JWT_ES384_VALID}"'
-
-  run_test -n 'when auth enabled with ES512 algorithm and valid JWT cookie, returns 200' \
-           -p '/secure/cookie/es512' \
-           -c '200' \
-           -x ' --cookie "jwt=${JWT_ES512_VALID}"'
-
-  run_test -n 'when auth enabled with RS256 algorithm via file and valid JWT in Authorization header, returns 200' \
-           -p '/secure/auth-header/rs256/file' \
-           -c '200' \
-           -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
-
-  run_test -n 'when auth enabled with RS256 algorithm via file and invalid JWT in Authorization header, returns 401' \
-           -p '/secure/auth-header/rs256/file' \
-           -c '302' \
-           -x '--header "Authorization: Bearer ${JWT_RS256_INVALID}"'
-
-  run_test -n 'when auth enabled with RS384 algorithm via file and valid JWT in Authorization header, returns 200' \
-           -p '/secure/auth-header/rs384/file' \
-           -c '200' \
-           -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
-
-  run_test -n 'when auth enabled with RS512 algorithm via file and valid JWT in Authorization header, returns 200' \
-           -p '/secure/auth-header/rs512/file' \
-           -c '200' \
-           -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
-
-  run_test -n 'when auth enabled with ES256 algorithm via file and valid JWT in Authorization header, returns 200' \
-           -p '/secure/auth-header/es256/file' \
-           -c '200' \
-           -x '--header "Authorization: Bearer ${JWT_ES256_VALID}"'
-
-  run_test -n 'when auth enabled with ES256 algorithm via file and invalid JWT in Authorization header, returns 401' \
-           -p '/secure/auth-header/es256/file' \
-           -c '302' \
-           -x '--header "Authorization: Bearer ${JWT_ES256_INVALID}"'
-
-  run_test -n 'when auth enabled with ES384 algorithm via file and valid JWT in Authorization header, returns 200' \
-           -p '/secure/auth-header/es384/file' \
-           -c '200' \
-           -x '--header "Authorization: Bearer ${JWT_ES384_VALID}"'
-
-  run_test -n 'when auth enabled with ES512 algorithm via file and valid JWT in Authorization header, returns 200' \
-           -p '/secure/auth-header/es512/file' \
-           -c '200' \
-           -x '--header "Authorization: Bearer ${JWT_ES512_VALID}"'
-
-  run_test -n 'when auth enabled with HS256 algorithm and valid JWT in custom header without bearer, returns 200' \
-           -p '/secure/custom-header/hs256/' \
-           -c '200' \
-           -x '--header "Auth-Token: ${JWT_HS256_VALID}"'
-
-  run_test -n 'when auth enabled with HS256 algorithm and valid JWT in custom header with bearer, returns 200' \
-           -p '/secure/custom-header/hs256/' \
-           -c '200' \
-           -x '--header "Auth-Token: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts single claim to request variable' \
-           -p '/secure/extract-claim/request/sub' \
-           -r '< Test: sub=some-long-uuid' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts multiple claims (single directive) to request variable' \
-           -p '/secure/extract-claim/request/name-1' \
-           -r '< Test: firstName=hello; lastName=world' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts multiple claims (multiple directives) to request variable' \
-           -p '/secure/extract-claim/request/name-2' \
-           -r '< Test: firstName=hello; lastName=world' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts nested claim to request variable' \
-           -p '/secure/extract-claim/request/nested' \
-           -r '< Test: username=hello\.world' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts single claim to response variable' \
-           -p '/secure/extract-claim/response/sub' \
-           -r '< Test: sub=some-long-uuid' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts multiple claims (single directive) to response variable' \
-           -p '/secure/extract-claim/response/name-1' \
-           -r '< Test: firstName=hello; lastName=world' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts multiple claims (multiple directives) to response variable' \
-           -p '/secure/extract-claim/response/name-2' \
-           -r '< Test: firstName=hello; lastName=world' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts nested claim to response variable' \
-           -p '/secure/extract-claim/response/nested' \
-           -r '< Test: username=hello.world' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts single claim to response header' \
-           -p '/secure/extract-claim/response/sub' \
-           -r '< JWT-sub: some-long-uuid' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts multiple claims (single directive) to response header' \
-           -p '/secure/extract-claim/response/name-1' \
-           -r '< JWT-firstName: hello' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts multiple claims (multiple directives) to response header' \
-           -p '/secure/extract-claim/response/name-2' \
-           -r '< JWT-firstName: hello' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts nested claim to response header' \
-           -p '/secure/extract-claim/response/nested' \
-           -r '< JWT-username: hello\.world' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'tests single claim with if statement' \
-           -p '/secure/extract-claim/if/sub' \
-           -c 200 \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'tests absence of single claim with if statement' \
-           -p '/secure/extract-claim/if/sub' \
-           -c 401 \
-           -x '--header "Authorization: Bearer ${JWT_HS256_MISSING_SUB}"'
-
-  run_test -n 'extracts single claim to response body' \
-           -p '/secure/extract-claim/body/sub' \
-           -c 200 \
-           -r 'sub: some-long-uuid$' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'extracts multiple claims to response body' \
-           -p '/secure/extract-claim/body/multiple' \
-           -c 200 \
-           -r 'you are: hello  world$' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'redirect based on claim' \
-           -p '/profile/me' \
-           -c 301 \
-           -r '< Location: http://nginx:8000/profile/some-long-uuid' \
-           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
-
-  run_test -n 'returns 302 if auth enabled and no JWT provided' \
-           -p '/return-url' \
-           -c '302'
-
-  run_test -n 'redirects to login if auth enabled and no JWT provided' \
-           -p '/return-url' \
-           -r '< Location: https://example\.com/login.*'
-
-  run_test -n 'adds return_url to login URL when redirected to login' \
-           -p '/return-url' \
-           -r '< Location: https://example\.com/login\?return_url=http://nginx.*'
-
-  run_test -n 'return_url includes port when redirected to login' \
-           -p '/return-url' \
-           -r "< Location: https://example\.com/login\?return_url=http://nginx:${PORT}/return-url"
-
-  run_test -n 'return_url includes query when redirected to login' \
-           -p '/return-url?test=123' \
-           -r '< Location: https://example\.com/login\?return_url=http://nginx.*/return-url%3Ftest=123'
-
-  if [[ "${NUM_FAILED}" = '0' ]]; then
-    printf "\nRan ${NUM_TESTS} tests successfully (skipped ${NUM_SKIPPED}).\n"
-    return 0
-  else
-    printf "\nRan ${NUM_TESTS} tests: ${GREEN}$((${NUM_TESTS} - ${NUM_FAILED})) passed${NC}; ${RED}${NUM_FAILED} failed${NC}; ${NUM_SKIPPED} skipped\n"
-    return 1
-  fi
-}
-
-if [ "${DEBUG}" != '' ]; then
- printf "\n${RED}Some tests will be skipped since DEBUG is set.${NC}\n"
-fi
-
-printf "\n${GRAY}Starting tests using port ${PORT}...${NC}\n"
-main

From c415b81e28b5fdacddc5716fb7e21728a4c40096 Mon Sep 17 00:00:00 2001
From: Josh McCullough <joshua.mccullough@gmail.com>
Date: Wed, 5 Feb 2025 16:07:30 -0500
Subject: [PATCH 123/130] fix incorrect function name

---
 .bin/git/hooks/pre-push-build-and-test | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.bin/git/hooks/pre-push-build-and-test b/.bin/git/hooks/pre-push-build-and-test
index 9cf4682..876ca32 100755
--- a/.bin/git/hooks/pre-push-build-and-test
+++ b/.bin/git/hooks/pre-push-build-and-test
@@ -4,7 +4,7 @@ REPO_ROOT_DIR=$(git rev-parse --show-toplevel)
 CHANGE_COUNT=$(cd ${REPO_ROOT_DIR}; git diff --name-only origin/HEAD..HEAD -- resources/ src/ test/ Dockerfile scripts.sh |wc -l)
 
 if [[ "0" -ne "${CHANGE_COUNT}" ]]; then
-	(cd ${REPO_ROOT_DIR}; ./scripts.sh rebuild_nginx rebuild_test_runner test)
+	(cd ${REPO_ROOT_DIR}; ./scripts.sh rebuild_nginx rebuild_test test)
 else
   HOOK_NAME=$(basename $0)
 

From a1662419010034a8230892489b083365bed4232c Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Tue, 18 Feb 2025 11:15:25 -0500
Subject: [PATCH 124/130] restore accidentally-deleted test dir :-|

---
 test/docker-compose-test.yml        |  19 ++
 test/ec_key_256.pem                 |   5 +
 test/ec_key_384.pem                 |   6 +
 test/ec_key_521.pem                 |   8 +
 test/etc/nginx/conf.d/test.conf     | 448 ++++++++++++++++++++++++++++
 test/etc/nginx/ec_key_256-pub.pem   |   4 +
 test/etc/nginx/ec_key_384-pub.pem   |   5 +
 test/etc/nginx/ec_key_521-pub.pem   |   6 +
 test/etc/nginx/rsa_key_2048-pub.pem |   9 +
 test/etc/nginx/test.crt             |  23 ++
 test/etc/nginx/test.key             |  28 ++
 test/rsa_key_2048.pem               |  28 ++
 test/test-nginx.dockerfile          |  19 ++
 test/test-runner.dockerfile         |  18 ++
 test/test.sh                        | 387 ++++++++++++++++++++++++
 15 files changed, 1013 insertions(+)
 create mode 100644 test/docker-compose-test.yml
 create mode 100644 test/ec_key_256.pem
 create mode 100644 test/ec_key_384.pem
 create mode 100644 test/ec_key_521.pem
 create mode 100644 test/etc/nginx/conf.d/test.conf
 create mode 100644 test/etc/nginx/ec_key_256-pub.pem
 create mode 100644 test/etc/nginx/ec_key_384-pub.pem
 create mode 100644 test/etc/nginx/ec_key_521-pub.pem
 create mode 100755 test/etc/nginx/rsa_key_2048-pub.pem
 create mode 100644 test/etc/nginx/test.crt
 create mode 100644 test/etc/nginx/test.key
 create mode 100755 test/rsa_key_2048.pem
 create mode 100644 test/test-nginx.dockerfile
 create mode 100644 test/test-runner.dockerfile
 create mode 100755 test/test.sh

diff --git a/test/docker-compose-test.yml b/test/docker-compose-test.yml
new file mode 100644
index 0000000..72ff710
--- /dev/null
+++ b/test/docker-compose-test.yml
@@ -0,0 +1,19 @@
+services:
+
+  nginx:
+    container_name: ${TEST_CONTAINER_NAME_PREFIX:?required}-nginx
+    build:
+      context: .
+      dockerfile: test-nginx.dockerfile
+      args:
+        BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION:?required}
+    logging:
+      driver: ${LOG_DRIVER:-journald}
+
+  runner:
+    container_name: ${TEST_CONTAINER_NAME_PREFIX:?required}-runner
+    build:
+      context: .
+      dockerfile: test-runner.dockerfile
+    depends_on:
+      - nginx
\ No newline at end of file
diff --git a/test/ec_key_256.pem b/test/ec_key_256.pem
new file mode 100644
index 0000000..4206969
--- /dev/null
+++ b/test/ec_key_256.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOlEBGcZxxhv8FkN0
+YIvax6fnhJbMeotzIEBxIglkNu6hRANCAATP1NpDzvZmKd2Mw6hIrv4nzUfNu7OK
+mT5VuL5LhvUgzTqVGuxwevA7DlFsNVSfCljIBG3geio3fcd4k0Z9SygL
+-----END PRIVATE KEY-----
diff --git a/test/ec_key_384.pem b/test/ec_key_384.pem
new file mode 100644
index 0000000..2aa5780
--- /dev/null
+++ b/test/ec_key_384.pem
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDADyrL6llSQoQOZ/PF/
+l761kAbrTwn4vu30Kr34ScW6bRKVXLq3cT3QssJ1nF9B63qhZANiAAQ48dOfIEd3
+0TCVE0JT4ZU0Db7Ftz+ex7lojP7uqTY9OI59yoMB01zUN4JK30BRXS9Yv0A9Bu1z
+fgLu93FSn0kd0zIPMvuu5LUt60M/miSt2lA0OrqFhKjx6FFdN/lNh64=
+-----END PRIVATE KEY-----
diff --git a/test/ec_key_521.pem b/test/ec_key_521.pem
new file mode 100644
index 0000000..10471dc
--- /dev/null
+++ b/test/ec_key_521.pem
@@ -0,0 +1,8 @@
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIAKkag6aVn4XAbaALo
+0b3pypdP5RBX7uKxHmKlkNCcpA0oVTdgjnM5NpJP8ZOM6NjVhEzsn6c/Tdn8hL8w
+SI55hFWhgYkDgYYABABpTipSvbs8fq44u4fA+v7DTNYViA58sqbrxjxdzwWZ8eEj
+CXsH7yzSGx3Y19NSyrX8HbjWmrj5uxiKeFCB8mGzTwDcFIKCMeMkHjZs/fmVOumR
+a2XSpj7BP6wqcN6Pf+UqECivGAZGRHoabo/dm5zF9M3gO+G9eOrf3G1wgFFM7Vzb
+Ow==
+-----END PRIVATE KEY-----
diff --git a/test/etc/nginx/conf.d/test.conf b/test/etc/nginx/conf.d/test.conf
new file mode 100644
index 0000000..4e5d764
--- /dev/null
+++ b/test/etc/nginx/conf.d/test.conf
@@ -0,0 +1,448 @@
+error_log /var/log/nginx/debug.log debug;
+access_log /var/log/nginx/access.log;
+
+server {
+    listen %{PORT};
+    listen %{SSL_PORT} ssl;
+    server_name localhost;
+
+    ssl_certificate /etc/nginx/test.crt;
+    ssl_certificate_key /etc/nginx/test.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    
+    auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
+    auth_jwt_loginurl "https://example.com/login";
+    auth_jwt_enabled off;
+
+    location / {
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/default {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/default/validate-sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_validate_sub on;
+        auth_jwt_location COOKIE=jwt;
+        
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+        
+    location /secure/cookie/default/no-redirect {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location COOKIE=jwt;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/hs256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        auth_jwt_algorithm HS256;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/hs384 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        auth_jwt_algorithm HS384;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/hs512 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        auth_jwt_algorithm HS512;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/es256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        auth_jwt_algorithm ES256;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz9TaQ872ZindjMOoSK7+J81Hzbuz
+ipk+Vbi+S4b1IM06lRrscHrwOw5RbDVUnwpYyARt4HoqN33HeJNGfUsoCw==
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/es384 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        auth_jwt_algorithm ES384;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOPHTnyBHd9EwlRNCU+GVNA2+xbc/nse5
+aIz+7qk2PTiOfcqDAdNc1DeCSt9AUV0vWL9APQbtc34C7vdxUp9JHdMyDzL7ruS1
+LetDP5okrdpQNDq6hYSo8ehRXTf5TYeu
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/cookie/es512 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location COOKIE=jwt;
+        auth_jwt_algorithm ES512;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAaU4qUr27PH6uOLuHwPr+w0zWFYgO
+fLKm68Y8Xc8FmfHhIwl7B+8s0hsd2NfTUsq1/B241pq4+bsYinhQgfJhs08A3BSC
+gjHjJB42bP35lTrpkWtl0qY+wT+sKnDej3/lKhAorxgGRkR6Gm6P3ZucxfTN4Dvh
+vXjq39xtcIBRTO1c2zs=
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/default {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/default/no-redirect {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/default/proxy-header {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+
+        add_header "Test-Authorization" "$http_authorization";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/rs256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
+uqNuffp4+4aUCwuFE9B5s9MJr63gyf8jW0oDr7Mb1Xb8y9iGkWfhouZqNJbMFry+
+iBs+z2TtJF06vbHQZzajDsdux3XVfXv9v6dDIImyU24MsGNkpNt0GISaaiqv51NM
+ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
+6swiIasEU3qNLKaJAZEzfywroVYr3BwM1IiVbQeKgIkyPS/85M4Y6Ss/T+OWi1Oe
+K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
+BwIDAQAB
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz9TaQ872ZindjMOoSK7+J81Hzbuz
+ipk+Vbi+S4b1IM06lRrscHrwOw5RbDVUnwpYyARt4HoqN33HeJNGfUsoCw==
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es384 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOPHTnyBHd9EwlRNCU+GVNA2+xbc/nse5
+aIz+7qk2PTiOfcqDAdNc1DeCSt9AUV0vWL9APQbtc34C7vdxUp9JHdMyDzL7ruS1
+LetDP5okrdpQNDq6hYSo8ehRXTf5TYeu
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es512 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_key "-----BEGIN PUBLIC KEY-----
+MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAaU4qUr27PH6uOLuHwPr+w0zWFYgO
+fLKm68Y8Xc8FmfHhIwl7B+8s0hsd2NfTUsq1/B241pq4+bsYinhQgfJhs08A3BSC
+gjHjJB42bP35lTrpkWtl0qY+wT+sKnDej3/lKhAorxgGRkR6Gm6P3ZucxfTN4Dvh
+vXjq39xtcIBRTO1c2zs=
+-----END PUBLIC KEY-----";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/rs256/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_algorithm RS256;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/rsa_key_2048-pub.pem";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/rs384/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_algorithm RS384;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/rsa_key_2048-pub.pem";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/rs512/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_algorithm RS512;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/rsa_key_2048-pub.pem";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es256/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_algorithm ES256;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/ec_key_256-pub.pem";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es384/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_algorithm ES384;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/ec_key_384-pub.pem";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/auth-header/es512/file {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_algorithm ES512;
+        auth_jwt_use_keyfile on;
+        auth_jwt_keyfile_path "/etc/nginx/ec_key_521-pub.pem";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/custom-header/hs256 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+        auth_jwt_location HEADER=Auth-Token;
+        auth_jwt_algorithm HS256;
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/request/sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_request_claims sub;
+
+        add_header "Test" "sub=$http_jwt_sub";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/request/name-1 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_request_claims firstName lastName;
+
+        add_header "Test" "firstName=$http_jwt_firstname; lastName=$http_jwt_lastname";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/request/name-2 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_request_claims firstName;
+        auth_jwt_extract_request_claims lastName;
+
+        add_header "Test" "firstName=$http_jwt_firstname; lastName=$http_jwt_lastname";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/request/nested {
+        location /secure/extract-claim/request/nested {
+            auth_jwt_enabled on;
+            auth_jwt_redirect off;
+            auth_jwt_location HEADER=Authorization;
+            auth_jwt_extract_request_claims username;
+
+            add_header "Test" "username=$http_jwt_username";
+
+            alias /usr/share/nginx/html/;
+            try_files index.html =404;
+        }
+    }
+
+    location /secure/extract-claim/response/sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_response_claims sub;
+
+        add_header "Test" "sub=$sent_http_jwt_sub";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/response/name-1 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_response_claims firstName lastName;
+
+        add_header "Test" "firstName=$sent_http_jwt_firstname; lastName=$sent_http_jwt_lastname";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/response/name-2 {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_response_claims firstName;
+        auth_jwt_extract_response_claims lastName;
+
+        add_header "Test" "firstName=$sent_http_jwt_firstname; lastName=$sent_http_jwt_lastname";
+
+        alias /usr/share/nginx/html/;
+        try_files index.html =404;
+    }
+
+    location /secure/extract-claim/response/nested {
+        location /secure/extract-claim/response/nested {
+            auth_jwt_enabled on;
+            auth_jwt_redirect off;
+            auth_jwt_location HEADER=Authorization;
+            auth_jwt_extract_response_claims username;
+
+            add_header "Test" "username=$sent_http_jwt_username";
+
+            alias /usr/share/nginx/html/;
+            try_files index.html =404;
+        }
+    }
+
+    location /secure/extract-claim/if/sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_var_claims sub;
+
+        if ($jwt_claim_sub = 'some-long-uuid') {
+            return 200;
+        }
+
+        return 401;
+    }
+
+    location /secure/extract-claim/body/sub {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_extract_var_claims sub;
+
+        return 200 "sub: $jwt_claim_sub";
+    }
+
+    location /secure/extract-claim/body/multiple {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_validate_sub on;
+        auth_jwt_extract_var_claims firstName middleName lastName;
+
+        return 200 "you are: $jwt_claim_firstName $jwt_claim_middleName $jwt_claim_lastName";
+    }
+
+    location /profile {
+        auth_jwt_enabled on;
+        auth_jwt_redirect off;
+        auth_jwt_location HEADER=Authorization;
+        auth_jwt_validate_sub on;
+
+        location /profile/me {
+            auth_jwt_extract_var_claims sub;
+
+            return 301 /profile/$jwt_claim_sub;
+        }
+    }
+
+    location /return-url {
+        auth_jwt_enabled on;
+        auth_jwt_redirect on;
+    }
+}
diff --git a/test/etc/nginx/ec_key_256-pub.pem b/test/etc/nginx/ec_key_256-pub.pem
new file mode 100644
index 0000000..3306ea0
--- /dev/null
+++ b/test/etc/nginx/ec_key_256-pub.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz9TaQ872ZindjMOoSK7+J81Hzbuz
+ipk+Vbi+S4b1IM06lRrscHrwOw5RbDVUnwpYyARt4HoqN33HeJNGfUsoCw==
+-----END PUBLIC KEY-----
diff --git a/test/etc/nginx/ec_key_384-pub.pem b/test/etc/nginx/ec_key_384-pub.pem
new file mode 100644
index 0000000..e642ed1
--- /dev/null
+++ b/test/etc/nginx/ec_key_384-pub.pem
@@ -0,0 +1,5 @@
+-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEOPHTnyBHd9EwlRNCU+GVNA2+xbc/nse5
+aIz+7qk2PTiOfcqDAdNc1DeCSt9AUV0vWL9APQbtc34C7vdxUp9JHdMyDzL7ruS1
+LetDP5okrdpQNDq6hYSo8ehRXTf5TYeu
+-----END PUBLIC KEY-----
diff --git a/test/etc/nginx/ec_key_521-pub.pem b/test/etc/nginx/ec_key_521-pub.pem
new file mode 100644
index 0000000..0cb875c
--- /dev/null
+++ b/test/etc/nginx/ec_key_521-pub.pem
@@ -0,0 +1,6 @@
+-----BEGIN PUBLIC KEY-----
+MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAaU4qUr27PH6uOLuHwPr+w0zWFYgO
+fLKm68Y8Xc8FmfHhIwl7B+8s0hsd2NfTUsq1/B241pq4+bsYinhQgfJhs08A3BSC
+gjHjJB42bP35lTrpkWtl0qY+wT+sKnDej3/lKhAorxgGRkR6Gm6P3ZucxfTN4Dvh
+vXjq39xtcIBRTO1c2zs=
+-----END PUBLIC KEY-----
diff --git a/test/etc/nginx/rsa_key_2048-pub.pem b/test/etc/nginx/rsa_key_2048-pub.pem
new file mode 100755
index 0000000..01f59bf
--- /dev/null
+++ b/test/etc/nginx/rsa_key_2048-pub.pem
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwtpMAM4l1H995oqlqdMh
+uqNuffp4+4aUCwuFE9B5s9MJr63gyf8jW0oDr7Mb1Xb8y9iGkWfhouZqNJbMFry+
+iBs+z2TtJF06vbHQZzajDsdux3XVfXv9v6dDIImyU24MsGNkpNt0GISaaiqv51NM
+ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
+6swiIasEU3qNLKaJAZEzfywroVYr3BwM1IiVbQeKgIkyPS/85M4Y6Ss/T+OWi1Oe
+K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
+BwIDAQAB
+-----END PUBLIC KEY-----
diff --git a/test/etc/nginx/test.crt b/test/etc/nginx/test.crt
new file mode 100644
index 0000000..fb406ba
--- /dev/null
+++ b/test/etc/nginx/test.crt
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIUMG9M4Itu0cOyX0+La+7huiIoX6YwDQYJKoZIhvcNAQEL
+BQAwcTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMRUwEwYDVQQHDAxG
+YWxscyBDaHVyY2gxHzAdBgNVBAoMFlRlc2xhIEdvdmVybm1lbnQsIEluYy4xFzAV
+BgNVBAsMDk5HSU5YIEF1dGggSldUMB4XDTI0MDMxNTE4MTM1MloXDTM0MDMxMzE4
+MTM1MlowcTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMRUwEwYDVQQH
+DAxGYWxscyBDaHVyY2gxHzAdBgNVBAoMFlRlc2xhIEdvdmVybm1lbnQsIEluYy4x
+FzAVBgNVBAsMDk5HSU5YIEF1dGggSldUMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAih41Ct5XgcSTz7ZVAjBb0t0z9Qae08aseoMEKJf7AmNqKtsvzeAw
+/DJxOWJR5VPtUWhFAmXxPfG2B6aiSIVJVpG9yzcdQlCvyJG7Ub4QCm5GXwpU+zDC
+qmD5ksz9QMdOzvRLypAU1ciZiCXjwpUnW+BZyZ9Tpmsxm6/gOzkd3rxoIbc9uXxp
+5o4n6k02EPSzLzUhkZnhLQrOAGUB7+q11FAU5eNMlTWC9gQUsbNaTVtKmM2eV9BA
+UHdX2GbkfFbN22l3Wey4oyNZWmye1ZFOPyBR+tyU3pofhb+R+hTFmeNBzrJq3i30
+Qi0B8AnulKdOjnTysPYjDTrN6xcVDWNmPQIDAQABo1MwUTAdBgNVHQ4EFgQUczdy
+7s64NJHNGsQTf/zwFnQe6LMwHwYDVR0jBBgwFoAUczdy7s64NJHNGsQTf/zwFnQe
+6LMwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAfcxCiz6ShHof
+lXiE2j+s556SM2n8oW/S1BSjFC2wF1uKVeMJA1gAaWObC3ElqffFlqTdCorhgRS/
+knWa+Sqe/jWBSgwLG/e5DvxXWjD7b7kZdAZNy9evs5nhVfcLT+GyvB/z5GdAFY7s
+xYmLrC07ubhHIL9h7lhNKbRr++o+BcClQBZKRO4fxBwXxqx/rHudjH87Wr61Ov52
+90xNjwcqvevY0skmPao5+oyxkURdKZualNxiOGMPpywkpJkfl8Az5xKAJhUMAtFR
+smhQduejEkcxfxtsiYgVoulI29GAsMr9zHps9zb5k0+SWIiSixjQ0CpRhLcNYu4F
+QPgLQLGwUQ==
+-----END CERTIFICATE-----
diff --git a/test/etc/nginx/test.key b/test/etc/nginx/test.key
new file mode 100644
index 0000000..13ec754
--- /dev/null
+++ b/test/etc/nginx/test.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCKHjUK3leBxJPP
+tlUCMFvS3TP1Bp7Txqx6gwQol/sCY2oq2y/N4DD8MnE5YlHlU+1RaEUCZfE98bYH
+pqJIhUlWkb3LNx1CUK/IkbtRvhAKbkZfClT7MMKqYPmSzP1Ax07O9EvKkBTVyJmI
+JePClSdb4FnJn1OmazGbr+A7OR3evGghtz25fGnmjifqTTYQ9LMvNSGRmeEtCs4A
+ZQHv6rXUUBTl40yVNYL2BBSxs1pNW0qYzZ5X0EBQd1fYZuR8Vs3baXdZ7LijI1la
+bJ7VkU4/IFH63JTemh+Fv5H6FMWZ40HOsmreLfRCLQHwCe6Up06OdPKw9iMNOs3r
+FxUNY2Y9AgMBAAECggEAAkwEggGp/xb67FCyDJ8rdimTZFPi9U7coUCN8HNI/qrf
+lTnfvox0oOUUqMMmIIQeS/HJ4ANvZe8GO3QkE8R5Sg7F0yjZL2tyTCNPgOMCMK8E
+mmHS58brHdrbm658C1ILnfmssjNmNueNbuW00Koa8imCsY2ZEW+L7vTKuMFqg6c+
+BDJxC4yoCPwSTVfcajjzI6FVfphE0pd8Ho/sE8vTqdmovh23+vgfNUq1L9Smvf7R
+YLM+hS1ouRP2BI5AN0sm04Kxd8MKPzuwCxteoZ9Y9YHyr1JeWGTTL0T24+LwUee/
+24zXZFrzpTgmtDYeEuVWsF5bP/fMS4Fctda3pdJMsQKBgQDCANjGDwwfSCCev2kl
+WdrFJywhn5hWLWFwlo/FwLOsFJtejaBwIDRQCMPZ74H+KMHwUnO3vTanKJWqDRP9
+CdMh94C1BqobRV6rN4HgA4Opxim1EyRWHV6ui41zokk2mJrwUzKkR8t9lt9EZKrk
+ZPyKER9A4hBqBmYvaYxodN8U1QKBgQC2QXUQq9j7niT7t4xMi0e9vnPLs0z1yUK9
+0nzKwTHDPflk3o2sKvH7199qVkc15JQ9DQ7NuYD7ezLbE3DJuVzpNDAfNXmfWHmp
+7ukdnxyn6ZCmzQY7/fTpJTEGKVQMVCgf2f5ANgxm5EmN0yWRMcEt1VXIwCisY56p
+o6nwv/1fyQKBgQCJBnIVyjEEszwfBBEvCX0kvVtFUGUXkSv+isl3onkFNPTcXuoP
+6B8q3FYAy1MkggMhTAthnqpIfLjhCCWzFspidl8Y/WEOq/uGsUjxQWowcr+onqGO
+lWX3oKfDIb/WaQkeb5UYRYFr7jE6LGQrt0xL9HX/rOxtBqIMIN/EM7ARFQKBgDAJ
+zMtaIFUh9+mJFafPRleS7X6RggV+yOKzqkTe6zjlCuk1Z+4rW6Df43lpyFdCKnh1
+CqPa805VyK/Jzf69pumo4c44EBiZ/2d1G2i9WZZAj+oHPE9vvq/9J5DSL98YB4Nt
+uABAvsAYB/Mj5lEA5kQoaPYDADWABH/+LXrRf/1RAoGAUvxPvmpkGMC+KdmjLam7
+CPC3+y4MZOyZ11BhOxLhd1K2qcQd9K7tkjUhNxRn5GVzpzOKeFJFtiih2uN+PBNJ
+oylPR03uk/7D52b1OYaJhs9bQkth//Qk935nyRM26C2vG4tQLfT/cFi5F53n0ZCQ
+7e8O6+QY0lZnpvsfnt8YIsM=
+-----END PRIVATE KEY-----
diff --git a/test/rsa_key_2048.pem b/test/rsa_key_2048.pem
new file mode 100755
index 0000000..0f58120
--- /dev/null
+++ b/test/rsa_key_2048.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDC2kwAziXUf33m
+iqWp0yG6o259+nj7hpQLC4UT0Hmz0wmvreDJ/yNbSgOvsxvVdvzL2IaRZ+Gi5mo0
+lswWvL6IGz7PZO0kXTq9sdBnNqMOx27HddV9e/2/p0MgibJTbgywY2Sk23QYhJpq
+Kq/nU0xlBfSaI5ddZ2RC9ZNkVeGawUKYksTruhAVJqviHN8BoK6VowP5vcxyyOWH
+TK9KruDqzCIhqwRTeo0spokBkTN/LCuhVivcHAzUiJVtB4qAiTI9L/zkzhjpKz9P
+45aLU54rj011gG8U/6E1USh5nMnPkr+d3oLfkhfS3Zs3kJVdyFQWZpQxiTaI92Fd
+2wLvbS0HAgMBAAECggEAD8dTnkETSSjlzhRuI9loAtAXM3Zj86JLPLW7GgaoxEoT
+n7lJ2bGicFMHB2ROnbOb9vnas82gtOtJsGaBslmoaCckp/C5T1eJWTEb+i+vdpPp
+wZcmKZovyyRFSE4+NYlU17fEv6DRvuaGBpDcW7QgHJIl45F8QWEM+msee2KE+V4G
+z/9vAQ+sOlvsb4mJP1tJIBx9Lb5loVREwCRy2Ha9tnWdDNar8EYkOn8si4snPT+E
+3ZCy8mlcZyUkZeiS/HdtydxZfoiwrSRYamd1diQpPhWCeRteQ802a7ds0Y2YzgfF
+UaYjNuRQm7zA//hwbXS7ELPyNMU15N00bajlG0tUOQKBgQDnLy01l20OneW6A2cI
+DIDyYhy5O7uulsaEtJReUlcjEDMkin8b767q2VZHb//3ZH+ipnRYByUUyYUhdOs2
+DYRGGeAebnH8wpTT4FCYxUsIUpDfB7RwfdBONgaKewTJz/FPswy1Ye0b5H2c6vVi
+m2FZ33HQcoZ3wvFFqyGVnMzpOwKBgQDXxL95yoxUGKa8vMzcE3Cn01szh0dFq0sq
+cFpM+HWLVr84CItuG9H6L0KaStEEIOiJsxOVpcXfFFhsJvOGhMA4DQTwH4WuXmXp
+1PoVMDlV65PYqvhzwL4+QhvZO2bsrEunITXOmU7CI6kilnAN3LuP4HbqZgoX9lqP
+I31VYzLupQKBgGEYck9w0s/xxxtR9ILv5XRnepLdoJzaHHR991aKFKjYU/KD7JDK
+INfoAhGs23+HCQhCCtkx3wQVA0Ii/erM0II0ueluD5fODX3TV2ZibnoHW2sgrEsW
+vFcs36BnvIIaQMptc+f2QgSV+Z/fGsKYadG6Q+39O7au/HB7SHayzWkjAoGBAMgt
+Fzslp9TpXd9iBWjzfCOnGUiP65Z+GWkQ/SXFqD+SRir0+m43zzGdoNvGJ23+Hd6K
+TdQbDJ0uoe4MoQeepzoZEgi4JeykVUZ/uVfo+nh06yArVf8FxTm7WVzLGGzgV/uA
++wtl/cRtEyAsk1649yW/KHPEIP8kJdYAJeoO8xSlAoGAERMrkFR7KGYZG1eFNRdV
+mJMq+Ibxyw8ks/CbiI+n3yUyk1U8962ol2Q0T4qjBmb26L5rrhNQhneM4e8mo9FX
+LlQapYkPvkdrqW0Bp72A/UNAvcGTmN7z5OCJGMUutx2hmEAlrYmpLKS8pM/p9zpK
+tEOtzsP5GMDYVlEp1jYSjzQ=
+-----END PRIVATE KEY-----
diff --git a/test/test-nginx.dockerfile b/test/test-nginx.dockerfile
new file mode 100644
index 0000000..1065558
--- /dev/null
+++ b/test/test-nginx.dockerfile
@@ -0,0 +1,19 @@
+ARG BASE_IMAGE
+
+FROM ${BASE_IMAGE:?required} AS NGINX
+ARG PORT
+ARG SSL_PORT
+
+COPY etc/ /etc/
+
+COPY <<` /usr/share/nginx/html/index.html
+<html>
+  <head>Test</head>
+  <body>
+    <h1>NGINX Auth-JWT Module Test</h1>
+  </body>
+</html>
+`
+
+RUN sed -i "s|%{PORT}|${PORT:?required}|" /etc/nginx/conf.d/test.conf
+RUN sed -i "s|%{SSL_PORT}|${SSL_PORT:?required}|" /etc/nginx/conf.d/test.conf
diff --git a/test/test-runner.dockerfile b/test/test-runner.dockerfile
new file mode 100644
index 0000000..18fc3d3
--- /dev/null
+++ b/test/test-runner.dockerfile
@@ -0,0 +1,18 @@
+ARG RUNNER_BASE_IMAGE
+
+FROM ${RUNNER_BASE_IMAGE:?required}
+ARG PORT
+ARG SSL_PORT
+
+ENV PORT=${PORT:?required}
+ENV SSL_PORT=${SSL_PORT:?required}
+
+RUN <<`
+  set -e
+  apt-get update
+  apt-get install -y curl bash
+`
+
+COPY test.sh .
+
+CMD ./test.sh
diff --git a/test/test.sh b/test/test.sh
new file mode 100755
index 0000000..c726a75
--- /dev/null
+++ b/test/test.sh
@@ -0,0 +1,387 @@
+#!/bin/bash -eu
+
+# set a test # here to execute only that test and output additional info
+DEBUG=
+
+RED='\e[31m'
+GREEN='\e[32m'
+GRAY='\e[90m'
+NC='\e[00m'
+
+NUM_TESTS=0;
+NUM_SKIPPED=0;
+NUM_FAILED=0;
+
+run_test () {
+  NUM_TESTS=$((${NUM_TESTS} + 1));
+
+  if [ "${DEBUG}" == '' ] || [ ${DEBUG} == ${NUM_TESTS} ]; then
+    local OPTIND;
+    local name=
+    local path=
+    local expectedCode=
+    local expectedResponseRegex=
+    local extraCurlOpts=
+    local scheme='http'
+    local port=${PORT}
+    local curlCommand=
+    local exitCode=
+    local response=
+    local testNum="${GRAY}${NUM_TESTS}${NC}\t"
+
+    while getopts "n:asp:r:c:x:" option; do
+      case $option in
+        n)
+          name=$OPTARG;;
+        s)
+          scheme='https'
+          port=${SSL_PORT};;
+        p)
+          path=$OPTARG;;
+        c)
+          expectedCode=$OPTARG;;
+        r)
+          expectedResponseRegex=$OPTARG;;
+        x)
+          extraCurlOpts=$OPTARG;;
+        \?) # Invalid option
+          printf "Error: Invalid option\n";
+          exit;;
+      esac
+    done
+
+    curlCommand="curl -skv ${scheme}://nginx:${port}${path} -H 'Cache-Control: no-cache' ${extraCurlOpts} 2>&1"
+    response=$(eval "${curlCommand}")
+    exitCode=$?
+    
+    printf "\n${testNum}"
+
+    if [ "${exitCode}" -ne "0" ]; then
+      printf "${RED}${name} -- unexpected exit code from cURL\n\tcURL Exit Code: ${exitCode}";
+      NUM_FAILED=$((${NUM_FAILED} + 1));
+    else
+      local okay=1
+
+      if [ "${expectedCode}" != "" ]; then
+        local responseCode=$(echo "${response}" | grep -Eo 'HTTP/1.1 ([0-9]{3})' | awk '{print $2}')
+
+        if [ "${expectedCode}" != "${responseCode}" ]; then
+          printf "${RED}${name} -- unexpected status code\n\tExpected: ${expectedCode}\n\tActual: ${responseCode}\n\tPath: ${path}"
+          NUM_FAILED=$((${NUM_FAILED} + 1))
+          okay=0
+        fi
+      fi
+      
+      if [ "${okay}" == '1' ] && [ "${expectedResponseRegex}" != "" ] && ! [[ "${response}" =~ ${expectedResponseRegex} ]]; then
+        printf "${RED}${name} -- regex not found in response\n\tPath: ${path}\n\tRegEx: ${expectedResponseRegex//%/%%}"
+        NUM_FAILED=$((${NUM_FAILED} + 1))
+        okay=0
+      fi
+      
+      if [ "${okay}" == '1' ]; then
+        printf "${GREEN}${name}";
+      fi
+    fi
+
+    if [ "${DEBUG}" == "${NUM_TESTS}" ]; then
+      printf '\n\tcURL Command: %s' "${curlCommand:---}"
+      printf '\n\tResponse: %s' "${response:---}"
+    fi
+
+    printf "${NC}\n"
+  else
+    NUM_SKIPPED=$((${NUM_SKIPPED} + 1))
+  fi
+}
+
+main() {
+  local JWT_HS256_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.r8tG8IZheiQ-i6HqUYyJj9V6dipgcQ4ZIdxau6QCZDo
+  local JWT_HS256_MISSING_SUB=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdE5hbWUiOiJoZWxsbyIsImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidGhpcyIsInRoYXQiLCJ0aGVvdGhlciJdLCJpc3MiOiJpc3N1ZXIiLCJwZXJzb25JZCI6Ijc1YmIzY2M3LWI5MzMtNDRmMC05M2M2LTE0N2IwODJmYWRiNSIsImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.lD6jUsazVtzeGhRTNeP_b2Zs6O798V2FQql11QOEI1Q
+  local JWT_HS256_MISSING_EMAIL=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwiaXNzIjoiaXNzdWVyIiwicGVyc29uSWQiOiI3NWJiM2NjNy1iOTMzLTQ0ZjAtOTNjNi0xNDdiMDgyZmFkYjUiLCJleHAiOjE5MDg4MzUyMDAsImlhdCI6MTQ4ODgxOTYwMCwidXNlcm5hbWUiOiJoZWxsby53b3JsZCJ9.tJoAl_pvq95hK7GKqsp5TU462pLTbmSYZc1fAHzcqWM
+  local JWT_HS384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.SS57j7PEybjbsp3g5W-IhhJHBmG5K-97qvgBKL16xj9ey-uMeEenWjGbB2vVp0kq
+  local JWT_HS512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.xtSU6EWN2LILVsYzJFJpKnRkqjn_3qjz-J2ttNKnhZ60_5YjFeC8io4k8k1u77zlohSWvWMdugD9ZaB3vjJo-w
+  local JWT_RS256_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwgImxhc3ROYW1lIjoid29ybGQiLCJlbWFpbEFkZHJlc3MiOiJoZWxsb3dvcmxkQGV4YW1wbGUuY29tIiwgInJvbGVzIjpbInRoaXMiLCJ0aGF0IiwidGhlb3RoZXIiXSwgImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwgImV4cCI6MTkwODgzNTIwMCwiaWF0IjoxNDg4ODE5NjAwLCJ1c2VybmFtZSI6ImhlbGxvLndvcmxkIn0.cn5Gb75XL-r7TMsPuqzWoKZ06ZsyF_VZIG0Ohn8uZZFeF8dFUhSrEOYe8WFN6Eon8a8LC0OCI9eNdGiD4m_e9TD1Iz2juqaeos-6yd7SWuODr4YS8KD3cqfXndnLRPzp9PC_UIpATsbqOmxGDrRKvHsQq0TuIXImU3rM_m3kFJFgtoJFHx3KmZUo_Ozkyhhc6Pukikhy6odNAtEyLHP5_tabMXtkeAuIlG8dhjAxef4mJLexYFclG-vl7No5VBU4JrMbfgyxtobcYoE-bDIpmQHywrwo6Li7X0hgHJ17sfS3G2YMHmE-Ij_W2Lf9kf5r2r12DUvg44SLIfM58pCINQ
+  local JWT_RS256_INVALID=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
+  local JWT_RS384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.H35bTcZRhepWIoa8pKCbUMRuAOkVX9K5hJjc6tPmQwWmTw8lrktsvmMzJg_rgqnJLnAkciSIQw5EDj7fngS5zX2ThyRxrkPuE2Uiyw2Ect-mo9Kg1lrWgnyZCuCgq-Up9HQRAv0160mePlm8Gs4TOY6CPr38zwTcDZsy_Keq93igDQV8WuuWAGICaGd5ZyUOPjjzGShRjTU8Szz7fnpZpTtYRCYVo0pc5yfRWYm0fdn-4AseyGvd8JJ2xfnAEe4kZOkz7X1MLKtL0slKg3m2PH1lD7HwxIawXRTPWxArhJ9dcTNiDUrqtde2juGwOuMD_zTsb2Jj0_rmRb0Q6aljNw
+  local JWT_RS512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.iUupyKypfXJ5aZWfItSW-mOmx9a4C4X7Yr5p5Fk8W75ZhkOq0EeNfstTxx870brhkdPovBhO2LYI44_HoH9XicQNL6JnFprE0r61eJFngbuzlhRQiWpq0xYrazJWc9zB7_GgL2ZCwtw-Ts3G23Q0632wVm6-d7MKvG7RS8aEjN-MuVGdtLglH3forpItmFxw-if40EQsBL7hncN_XNcQTO4KPHkqmlpac_oKXRrLFDIIt2tB6OOpvY4QcpERoxexp4pi2f-JoINnWX_dU5JnIs3ypVJLQPfoJvxg8fsg3zYrOvMYnfsqOCYoHtZGK0O7jyfFmcGo5v2hLT-CpoF3Zw
+  local JWT_ES256_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.WFfJXGr5whKHB7arjsTXPTJ6TAsS1LoRxu7Vj2_HrLaIQphWJM6BICf-M3cv52tFzt-XTZb6GxlDgAbHo8z9Zg
+  local JWT_ES256_INVALID=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._aQmIBL4CVBxU1fNMOHp0kkagFaaX2TvAEenizytwd0
+  local JWT_ES384_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzM4NCJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ._EFxXYOTAfT3gB3xUfgGR2UyXHeRTlDWqA94oZbB0DDa7YPZTEX9T4C_0ylnOFKZ6irGHZA8vxjgXDH3DZKWwBWcZ-XaQ_Q4Ws2J-AEeLqcl7_CS6q9mFo0Y7vUNEn-W
+  local JWT_ES512_VALID=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzUxMiJ9.eyJzdWIiOiJzb21lLWxvbmctdXVpZCIsImZpcnN0TmFtZSI6ImhlbGxvIiwibGFzdE5hbWUiOiJ3b3JsZCIsImVtYWlsQWRkcmVzcyI6ImhlbGxvd29ybGRAZXhhbXBsZS5jb20iLCJyb2xlcyI6WyJ0aGlzIiwidGhhdCIsInRoZW90aGVyIl0sImlzcyI6Imlzc3VlciIsInBlcnNvbklkIjoiNzViYjNjYzctYjkzMy00NGYwLTkzYzYtMTQ3YjA4MmZhZGI1IiwiZXhwIjoxOTA4ODM1MjAwLCJpYXQiOjE0ODg4MTk2MDAsInVzZXJuYW1lIjoiaGVsbG8ud29ybGQifQ.AFY4gNCtZNYkrTiijDkV4eKIt2UPMIuJBfZIk69jgI8FSGCQyUIMmIVg0fTvbaSiaryXzcjbG5TCm8a9Vu3KFJutAHGrgvZqcdklxx6Fbk3an3r_CH68n_ncwS3SUV58mDjf0OX8jRuNdudU1L5xYNQdodo-fxPIb1oHXfMJ0CmULDR9
+
+  run_test -n 'when auth disabled, should return 200' \
+           -p '/' \
+           -c '200'
+
+  run_test -n '[SSL] when auth disabled, should return 200' \
+           -s \
+           -p '/' \
+           -c '200'
+  
+  run_test -n 'when auth enabled with default algorithm and no JWT in Authorization header, returns 302' \
+           -p '/secure/auth-header/default' \
+           -c '302'
+  
+  run_test -n '[SSL] when auth enabled with default algorithm and no JWT in Authorization header, returns 302' \
+           -s \
+           -p '/secure/auth-header/default' \
+           -c '302'
+
+  run_test -n 'when auth enabled with default algorithm with no redirect and Authorization header missing Bearer, should return 200' \
+           -p '/secure/auth-header/default/no-redirect' \
+           -c '200' \
+           -x "--header \"Authorization: ${JWT_HS256_VALID}\""
+
+  run_test -n 'when auth enabled with default algorithm with no redirect and Authorization header with Bearer, should return 200' \
+           -p '/secure/auth-header/default/no-redirect' \
+           -c '200' \
+           -x "--header \"Authorization: Bearer ${JWT_HS256_VALID}\""
+
+  run_test -n 'when auth enabled with Authorization header with Bearer, should keep header intact' \
+           -p '/secure/auth-header/default/proxy-header' \
+           -c '200' \
+           -r "< Test-Authorization: Bearer ${JWT_HS256_VALID}" \
+           -x "--header \"Authorization: Bearer ${JWT_HS256_VALID}\""
+
+  run_test -n 'when auth enabled with Authorization header with Bearer, lower-case "bearer" should be accepted' \
+           -p '/secure/auth-header/default/proxy-header' \
+           -c '200' \
+           -r "< Test-Authorization: bearer ${JWT_HS256_VALID}" \
+           -x "--header \"Authorization: bearer ${JWT_HS256_VALID}\""
+
+  run_test -n 'when auth enabled with default algorithm and no JWT cookie, returns 302' \
+           -p '/secure/cookie/default' \
+           -c '302'
+
+  run_test -n 'when auth enabled with default algorithm with no redirect and no JWT cookie, should return 401' \
+           -p '/secure/cookie/default/no-redirect' \
+           -c '401'
+
+  run_test -n 'when auth enabled with default algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/default' \
+           -c '200' \
+           -x "--cookie jwt=${JWT_HS256_VALID}"
+
+  run_test -n 'when auth enabled with default algorithm and valid JWT cookie with no sub, returns 200' \
+           -p '/secure/cookie/default' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_HS256_MISSING_SUB}"'
+
+  run_test -n 'when auth enabled with default algorithm and valid JWT cookie with no sub when sub validated, returns 302' \
+           -p '/secure/cookie/default/validate-sub' \
+           -c '302' \
+           -x ' --cookie "jwt=${JWT_HS256_MISSING_SUB}"'
+
+  run_test -n 'when auth enabled with default algorithm and valid JWT cookie with no email, returns 200' \
+           -p '/secure/cookie/default' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_HS256_MISSING_EMAIL}"'
+
+  run_test -n 'when auth enabled with HS256 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/hs256' \
+           -c '200' \
+           -x '--cookie "jwt=${JWT_HS256_VALID}"'
+
+  run_test -n 'when auth enabled with HS384 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/hs384' \
+           -c '200' \
+           -x '--cookie "jwt=${JWT_HS384_VALID}"'
+
+  run_test -n 'when auth enabled with HS512 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/hs512' \
+           -c '200' \
+           -x '--cookie "jwt=${JWT_HS512_VALID}"'
+
+  run_test -n 'when auth enabled with RS256 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/rs256' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_RS256_VALID}"'
+
+  run_test -n 'when auth enabled with ES256 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/es256' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_ES256_VALID}"'
+
+  run_test -n 'when auth enabled with ES384 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/es384' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_ES384_VALID}"'
+
+  run_test -n 'when auth enabled with ES512 algorithm and valid JWT cookie, returns 200' \
+           -p '/secure/cookie/es512' \
+           -c '200' \
+           -x ' --cookie "jwt=${JWT_ES512_VALID}"'
+
+  run_test -n 'when auth enabled with RS256 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/rs256/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
+
+  run_test -n 'when auth enabled with RS256 algorithm via file and invalid JWT in Authorization header, returns 401' \
+           -p '/secure/auth-header/rs256/file' \
+           -c '302' \
+           -x '--header "Authorization: Bearer ${JWT_RS256_INVALID}"'
+
+  run_test -n 'when auth enabled with RS384 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/rs384/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
+
+  run_test -n 'when auth enabled with RS512 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/rs512/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_RS256_VALID}"'
+
+  run_test -n 'when auth enabled with ES256 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/es256/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_ES256_VALID}"'
+
+  run_test -n 'when auth enabled with ES256 algorithm via file and invalid JWT in Authorization header, returns 401' \
+           -p '/secure/auth-header/es256/file' \
+           -c '302' \
+           -x '--header "Authorization: Bearer ${JWT_ES256_INVALID}"'
+
+  run_test -n 'when auth enabled with ES384 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/es384/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_ES384_VALID}"'
+
+  run_test -n 'when auth enabled with ES512 algorithm via file and valid JWT in Authorization header, returns 200' \
+           -p '/secure/auth-header/es512/file' \
+           -c '200' \
+           -x '--header "Authorization: Bearer ${JWT_ES512_VALID}"'
+
+  run_test -n 'when auth enabled with HS256 algorithm and valid JWT in custom header without bearer, returns 200' \
+           -p '/secure/custom-header/hs256/' \
+           -c '200' \
+           -x '--header "Auth-Token: ${JWT_HS256_VALID}"'
+
+  run_test -n 'when auth enabled with HS256 algorithm and valid JWT in custom header with bearer, returns 200' \
+           -p '/secure/custom-header/hs256/' \
+           -c '200' \
+           -x '--header "Auth-Token: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts single claim to request variable' \
+           -p '/secure/extract-claim/request/sub' \
+           -r '< Test: sub=some-long-uuid' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (single directive) to request variable' \
+           -p '/secure/extract-claim/request/name-1' \
+           -r '< Test: firstName=hello; lastName=world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (multiple directives) to request variable' \
+           -p '/secure/extract-claim/request/name-2' \
+           -r '< Test: firstName=hello; lastName=world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts nested claim to request variable' \
+           -p '/secure/extract-claim/request/nested' \
+           -r '< Test: username=hello\.world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts single claim to response variable' \
+           -p '/secure/extract-claim/response/sub' \
+           -r '< Test: sub=some-long-uuid' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (single directive) to response variable' \
+           -p '/secure/extract-claim/response/name-1' \
+           -r '< Test: firstName=hello; lastName=world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (multiple directives) to response variable' \
+           -p '/secure/extract-claim/response/name-2' \
+           -r '< Test: firstName=hello; lastName=world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts nested claim to response variable' \
+           -p '/secure/extract-claim/response/nested' \
+           -r '< Test: username=hello.world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts single claim to response header' \
+           -p '/secure/extract-claim/response/sub' \
+           -r '< JWT-sub: some-long-uuid' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (single directive) to response header' \
+           -p '/secure/extract-claim/response/name-1' \
+           -r '< JWT-firstName: hello' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims (multiple directives) to response header' \
+           -p '/secure/extract-claim/response/name-2' \
+           -r '< JWT-firstName: hello' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts nested claim to response header' \
+           -p '/secure/extract-claim/response/nested' \
+           -r '< JWT-username: hello\.world' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'tests single claim with if statement' \
+           -p '/secure/extract-claim/if/sub' \
+           -c 200 \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'tests absence of single claim with if statement' \
+           -p '/secure/extract-claim/if/sub' \
+           -c 401 \
+           -x '--header "Authorization: Bearer ${JWT_HS256_MISSING_SUB}"'
+
+  run_test -n 'extracts single claim to response body' \
+           -p '/secure/extract-claim/body/sub' \
+           -c 200 \
+           -r 'sub: some-long-uuid$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'extracts multiple claims to response body' \
+           -p '/secure/extract-claim/body/multiple' \
+           -c 200 \
+           -r 'you are: hello  world$' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'redirect based on claim' \
+           -p '/profile/me' \
+           -c 301 \
+           -r '< Location: http://nginx:8000/profile/some-long-uuid' \
+           -x '--header "Authorization: Bearer ${JWT_HS256_VALID}"'
+
+  run_test -n 'returns 302 if auth enabled and no JWT provided' \
+           -p '/return-url' \
+           -c '302'
+
+  run_test -n 'redirects to login if auth enabled and no JWT provided' \
+           -p '/return-url' \
+           -r '< Location: https://example\.com/login.*'
+
+  run_test -n 'adds return_url to login URL when redirected to login' \
+           -p '/return-url' \
+           -r '< Location: https://example\.com/login\?return_url=http://nginx.*'
+
+  run_test -n 'return_url includes port when redirected to login' \
+           -p '/return-url' \
+           -r "< Location: https://example\.com/login\?return_url=http://nginx:${PORT}/return-url"
+
+  run_test -n 'return_url includes query when redirected to login' \
+           -p '/return-url?test=123' \
+           -r '< Location: https://example\.com/login\?return_url=http://nginx.*/return-url%3Ftest=123'
+
+  if [[ "${NUM_FAILED}" = '0' ]]; then
+    printf "\nRan ${NUM_TESTS} tests successfully (skipped ${NUM_SKIPPED}).\n"
+    return 0
+  else
+    printf "\nRan ${NUM_TESTS} tests: ${GREEN}$((${NUM_TESTS} - ${NUM_FAILED})) passed${NC}; ${RED}${NUM_FAILED} failed${NC}; ${NUM_SKIPPED} skipped\n"
+    return 1
+  fi
+}
+
+if [ "${DEBUG}" != '' ]; then
+ printf "\n${RED}Some tests will be skipped since DEBUG is set.${NC}\n"
+fi
+
+printf "\n${GRAY}Starting tests using port ${PORT}...${NC}\n"
+main

From 7085f5c91503a92861797a266724be5bf2f3df5f Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Tue, 18 Feb 2025 11:23:46 -0500
Subject: [PATCH 125/130] update example config

---
 README.md                          | 2 +-
 {resources => examples}/nginx.conf | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 rename {resources => examples}/nginx.conf (70%)

diff --git a/README.md b/README.md
index f6b09d6..0fb2ea8 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ This module depends on the [JWT C Library](https://github.com/benmcollins/libjwt
 
 ## Directives
 
-This module requires several new `nginx.conf` directives, which can be specified at the `http`, `server`, or `location` levels.
+This module requires several new `nginx.conf` directives, which can be specified at the `http`, `server`, or `location` levels. See the [example NGINX config file](examples/nginx.conf) for more info.
 
 | Directive                            | Description                                                                                                                                                |
 | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
diff --git a/resources/nginx.conf b/examples/nginx.conf
similarity index 70%
rename from resources/nginx.conf
rename to examples/nginx.conf
index 9b8feab..9795363 100644
--- a/resources/nginx.conf
+++ b/examples/nginx.conf
@@ -18,6 +18,15 @@ http {
                       '"$http_user_agent" "$http_x_forwarded_for"';
     access_log /var/log/nginx/access.log  main;
 
+    auth_jwt_enabled on;
+    auth_jwt_algorithm 'put_algo_here';
+    auth_jwt_key 'put_key_here';
+    auth_jwt_location 'COOKIE=auth-token';
+    auth_jwt_redirect on;
+    auth_jwt_loginurl 'put_login_url_here';
+    
+    # Include other auth_jwt_* directives as needed.
+
     sendfile on;
     keepalive_timeout 65;
 

From a110d0c34924d6af8b8602c37b64e41ee1bd2910 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Tue, 18 Feb 2025 12:35:01 -0500
Subject: [PATCH 126/130] update NGINX versions to build against

---
 .github/workflows/make-releases.yml |  9 ++++++++-
 scripts                             | 19 ++++++++++---------
 test/test-nginx.dockerfile          |  2 +-
 3 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/make-releases.yml b/.github/workflows/make-releases.yml
index 487c4bf..d285bd8 100644
--- a/.github/workflows/make-releases.yml
+++ b/.github/workflows/make-releases.yml
@@ -30,7 +30,14 @@ jobs:
     strategy:
       matrix:
         # NGINX versions to build/test against
-        nginx-version: ['1.20.2', '1.22.1', '1.24.0', '1.26.2', '1.27.3']
+        nginx-version:
+          - '1.20.2' # legacy
+          - '1.22.1' # legacy
+          - '1.24.0' # legacy
+          - '1.26.2' # stable
+          - '1.26.3' # stable
+          - '1.27.3' # mainline
+          - '1.27.4' # mainline
 
         # The following versions of libjwt are compatible:
         #   * v1.0 - v1.12.0
diff --git a/scripts b/scripts
index 59fc5c3..0d80ed5 100755
--- a/scripts
+++ b/scripts
@@ -19,17 +19,18 @@ SSL_IMAGE_MAP[$SSL_VERSION_3_0_11]="bookworm-slim:openssl-${SSL_VERSION_3_0_11}"
 SSL_IMAGE_MAP[$SSL_VERSION_3_2_1]="bookworm-slim:openssl-${SSL_VERSION_3_2_1}"
 
 # supported NGINX versions -- for binary distribution
-NGINX_VERSION_LEGACY_1='1.20.2'
-NGINX_VERSION_LEGACY_2='1.22.1'
-NGINX_VERSION_LEGACY_3='1.24.0'
-NGINX_VERSION_STABLE='1.26.2'
-NGINX_VERSION_MAINLINE='1.27.3'
-NGINX_VERSIONS=(${NGINX_VERSION_LEGACY_1} ${NGINX_VERSION_LEGACY_2} ${NGINX_VERSION_LEGACY_3} ${NGINX_VERSION_STABLE} ${NGINX_VERSION_MAINLINE})
-NGINX_VERSION=${NGINX_VERSION:-${NGINX_VERSION_STABLE}}
-
+NGINX_VERSIONS=(
+	'1.20.2' # legacy
+	'1.22.1' # legacy
+	'1.24.0' # legacy
+	'1.26.2' # stable
+	'1.26.3' # stable
+	'1.27.3' # mainline
+	'1.27.4' # mainline
+)
+NGINX_VERSION=${NGINX_VERSION:-${NGINX_VERSIONS[-1]}}
 IMAGE_NAME=${IMAGE_NAME:-nginx-auth-jwt}
 FULL_IMAGE_NAME=${ORG_NAME:-teslagov}/${IMAGE_NAME}
-
 TEST_CONTAINER_NAME_PREFIX="${IMAGE_NAME}-test"
 TEST_COMPOSE_FILE='test/docker-compose-test.yml'
 
diff --git a/test/test-nginx.dockerfile b/test/test-nginx.dockerfile
index 1065558..f8c323f 100644
--- a/test/test-nginx.dockerfile
+++ b/test/test-nginx.dockerfile
@@ -1,6 +1,6 @@
 ARG BASE_IMAGE
 
-FROM ${BASE_IMAGE:?required} AS NGINX
+FROM ${BASE_IMAGE:?required}
 ARG PORT
 ARG SSL_PORT
 

From 8e4f2af67c5bfd91bb0820d63443cf8a6a33bd48 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Tue, 18 Feb 2025 12:48:54 -0500
Subject: [PATCH 127/130] update array style

---
 .github/workflows/make-releases.yml | 19 +++++++++++--------
 scripts                             | 17 ++++++++---------
 2 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/make-releases.yml b/.github/workflows/make-releases.yml
index d285bd8..ab0aa87 100644
--- a/.github/workflows/make-releases.yml
+++ b/.github/workflows/make-releases.yml
@@ -31,13 +31,13 @@ jobs:
       matrix:
         # NGINX versions to build/test against
         nginx-version:
-          - '1.20.2' # legacy
-          - '1.22.1' # legacy
-          - '1.24.0' # legacy
-          - '1.26.2' # stable
-          - '1.26.3' # stable
-          - '1.27.3' # mainline
-          - '1.27.4' # mainline
+          - 1.20.2 # legacy
+          - 1.22.1 # legacy
+          - 1.24.0 # legacy
+          - 1.26.2 # stable
+          - 1.26.3 # stable
+          - 1.27.3 # mainline
+          - 1.27.4 # mainline
 
         # The following versions of libjwt are compatible:
         #   * v1.0 - v1.12.0
@@ -47,7 +47,10 @@ jobs:
         #   * Debian and Ubuntu's repos have v1.10.2
         #   * EPEL has v1.12.1
         # This compiles against each version prior to a breaking change and the latest release
-        libjwt-version: ['1.12.0', '1.14.0', '1.15.3']
+        libjwt-version:
+          - 1.12.0
+          - 1.14.0
+          - 1.15.3
     runs-on: ubuntu-latest
     steps:
 
diff --git a/scripts b/scripts
index 0d80ed5..7ed7557 100755
--- a/scripts
+++ b/scripts
@@ -20,13 +20,13 @@ SSL_IMAGE_MAP[$SSL_VERSION_3_2_1]="bookworm-slim:openssl-${SSL_VERSION_3_2_1}"
 
 # supported NGINX versions -- for binary distribution
 NGINX_VERSIONS=(
-	'1.20.2' # legacy
-	'1.22.1' # legacy
-	'1.24.0' # legacy
-	'1.26.2' # stable
-	'1.26.3' # stable
-	'1.27.3' # mainline
-	'1.27.4' # mainline
+	1.20.2 # legacy
+	1.22.1 # legacy
+	1.24.0 # legacy
+	1.26.2 # stable
+	1.26.3 # stable
+	1.27.3 # mainline
+	1.27.4 # mainline
 )
 NGINX_VERSION=${NGINX_VERSION:-${NGINX_VERSIONS[-1]}}
 IMAGE_NAME=${IMAGE_NAME:-nginx-auth-jwt}
@@ -139,8 +139,7 @@ make_release() {
 		-C bin/usr/lib64/nginx/modules ngx_http_auth_jwt_module.so > /dev/null
 }
 
-# Create releases for the current mainline and stable version, as well as the 2 most recent "legacy" versions.
-#   See: https://nginx.org/en/download.html
+# Create releases for all NGINX versions defined in `NGINX_VERSIONS`.
 make_releases() {
 	local moduleVersion=$(git describe --tags --abbrev=0)
 

From df75972a5554790aac25899e6ec654a8154bd995 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Tue, 18 Feb 2025 13:43:23 -0500
Subject: [PATCH 128/130] fix script function calls

---
 scripts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts b/scripts
index 7ed7557..943bebc 100755
--- a/scripts
+++ b/scripts
@@ -103,7 +103,7 @@ cp_bin() {
 	local stopContainer=0;
 
 	if [ "$(docker container inspect -f '{{.State.Running}}' ${IMAGE_NAME} | true)" != "true" ]; then
-		start_nginx
+		start
 		stopContainer=1
 	fi
 
@@ -117,7 +117,7 @@ cp_bin() {
 	
 	if [ $stopContainer ]; then
 		printf "${MAGENTA}Stopping NGINX container (${IMAGE_NAME})...${NC}\n"
-		stop_nginx
+		stop
 	fi
 }
 

From e019e2039ce9d1f6abb369ed8aa7179aaba95012 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Tue, 18 Feb 2025 17:25:06 -0500
Subject: [PATCH 129/130] clean up & fix build process

---
 .github/workflows/make-releases.yml |  23 +++---
 nginx.dockerfile                    |  96 +++++++++++++++++--------
 scripts                             | 106 +++++++++++++++++-----------
 test/test-runner.dockerfile         |   2 +-
 4 files changed, 143 insertions(+), 84 deletions(-)

diff --git a/.github/workflows/make-releases.yml b/.github/workflows/make-releases.yml
index ab0aa87..c77edcb 100644
--- a/.github/workflows/make-releases.yml
+++ b/.github/workflows/make-releases.yml
@@ -29,7 +29,6 @@ jobs:
     needs: meta
     strategy:
       matrix:
-        # NGINX versions to build/test against
         nginx-version:
           - 1.20.2 # legacy
           - 1.22.1 # legacy
@@ -39,14 +38,6 @@ jobs:
           - 1.27.3 # mainline
           - 1.27.4 # mainline
 
-        # The following versions of libjwt are compatible:
-        #   * v1.0 - v1.12.0
-        #   * v1.12.1 - v1.14.0
-        #   * v1.15.0+
-        # At the time of writing this:
-        #   * Debian and Ubuntu's repos have v1.10.2
-        #   * EPEL has v1.12.1
-        # This compiles against each version prior to a breaking change and the latest release
         libjwt-version:
           - 1.12.0
           - 1.14.0
@@ -80,9 +71,10 @@ jobs:
     - name: Build jansson
       working-directory: ./jansson
       run: |
-        cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
-        make && \
-        make check && \
+        set -e
+        cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF
+        make
+        make check
         sudo make install
 
     # TODO cache the build result so we don't have to do this every time?
@@ -96,9 +88,10 @@ jobs:
     - name: Build libjwt
       working-directory: ./libjwt
       run: |
-        autoreconf -i && \
-        ./configure && \
-        make all && \
+        set -e
+        autoreconf -i
+        ./configure
+        make all
         sudo make install
 
     - name: Download NGINX
diff --git a/nginx.dockerfile b/nginx.dockerfile
index 360469b..68c67f0 100644
--- a/nginx.dockerfile
+++ b/nginx.dockerfile
@@ -1,24 +1,42 @@
-ARG BASE_IMAGE
+ARG BASE_IMAGE=${:?required}
 ARG NGINX_VERSION
+ARG LIBJWT_VERSION
 
-FROM ${BASE_IMAGE} AS ngx_http_auth_jwt_builder_base
+FROM ${BASE_IMAGE} AS ngx_http_auth_jwt_builder
 LABEL stage=ngx_http_auth_jwt_builder
-RUN chmod 1777 /tmp
+ENV PATH="${PATH}:/etc/nginx"
+ENV LD_LIBRARY_PATH=/usr/local/lib
+ARG NGINX_VERSION
+ARG LIBJWT_VERSION
+
 RUN <<`
-apt-get update
-apt-get install -y curl build-essential
+	set -e
+	apt-get update
+	apt-get upgrade -y
 `
 
-FROM ngx_http_auth_jwt_builder_base AS ngx_http_auth_jwt_builder_module
-LABEL stage=ngx_http_auth_jwt_builder
-ENV PATH "${PATH}:/etc/nginx"
-ENV LD_LIBRARY_PATH=/usr/local/lib
-ARG NGINX_VERSION
+RUN	apt-get install -y curl git zlib1g-dev libpcre3-dev build-essential libpcre2-dev zlib1g-dev libpcre3-dev pkg-config cmake dh-autoreconf
+
+WORKDIR /root/build/libjansson
 RUN <<`
 	set -e
-	apt-get install -y libjwt-dev libjwt0 libjansson-dev libjansson4 libpcre2-dev zlib1g-dev libpcre3-dev
-	mkdir -p /root/build/ngx-http-auth-jwt-module
+	git clone --depth 1 --branch v2.14 https://github.com/akheron/jansson .
+	cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF
+	make
+	make check
+	make install
 `
+
+WORKDIR /root/build/libjwt
+RUN <<`
+	set -e
+	git clone --depth 1 --branch v${LIBJWT_VERSION} https://github.com/benmcollins/libjwt .
+	autoreconf -i
+	./configure
+	make all
+	make install
+`
+
 WORKDIR /root/build/ngx-http-auth-jwt-module
 ADD config ./
 ADD src/*.h src/*.c ./src/
@@ -29,6 +47,7 @@ RUN <<`
 	curl -O http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
 	tar -xzf nginx-${NGINX_VERSION}.tar.gz --strip-components 1 -C nginx
 `
+
 WORKDIR /root/build/nginx
 RUN <<`
 	set -e
@@ -89,30 +108,46 @@ RUN <<`
 		${BUILD_FLAGS}
 		# --with-openssl=/usr/local \
 `
+
 RUN make modules
 RUN make install
-WORKDIR /usr/lib64/nginx/modules
-RUN	cp /root/build/nginx/objs/ngx_http_auth_jwt_module.so .
+
+WORKDIR /usr/lib/nginx/modules
+RUN	mv /root/build/nginx/objs/ngx_http_auth_jwt_module.so .
 RUN rm -rf /root/build
-RUN adduser --system --no-create-home --shell /bin/false --group --disabled-login nginx
-RUN mkdir -p /var/cache/nginx /var/log/nginx
-WORKDIR /etc/nginx
 
-FROM ngx_http_auth_jwt_builder_module AS ngx_http_auth_jwt_nginx
-LABEL maintainer="TeslaGov" email="developers@teslagov.com"
-ARG NGINX_VERSION
 RUN <<`
 	set -e
-
-	apt-get update
-	apt-get install -y libjansson4 libjwt0
+  apt-get remove -y curl git zlib1g-dev libpcre3-dev build-essential libpcre2-dev zlib1g-dev libpcre3-dev pkg-config cmake dh-autoreconf
+  # apt-get install -y gnupg2 ca-certificates lsb-release debian-archive-keyring
 	apt-get clean
 `
+
+RUN <<`
+	set -e
+	groupadd nginx
+	useradd -g nginx nginx
+`
+
+# RUN <<`
+#   set -e
+#   curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor > /usr/share/keyrings/nginx-archive-keyring.gpg
+#   printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/debian `lsb_release -cs` nginx\n" > /etc/apt/sources.list.d/nginx.list
+#   printf "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" > /etc/apt/preferences.d/99nginx
+# `
+
+# RUN <<`
+#   set -e
+#   apt-get update
+#   apt-get install -y nginx
+# `
+
 COPY <<` /etc/nginx/nginx.conf
+daemon off;
 user nginx;
 pid /var/run/nginx.pid;
 
-load_module /usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so;
+load_module /usr/lib/nginx/modules/ngx_http_auth_jwt_module.so;
 
 worker_processes 1;
 
@@ -124,12 +159,17 @@ http {
 	include mime.types;
 	default_type application/octet-stream;
 
-	log_format main '$$remote_addr - $$remote_user [$$time_local] "$$request" '
-	                '$$status $$body_bytes_sent "$$http_referer" '
-	                '"$$http_user_agent" "$$http_x_forwarded_for"';
+	log_format main '\$remote_addr - \$remote_user [\$time_local] "\$request" '
+	                '\$status \$body_bytes_sent "\$http_referer" '
+	                '"\$http_user_agent" "\$http_x_forwarded_for"';
 
 	access_log /var/log/nginx/access.log main;
 	include conf.d/*.conf;
 }
 `
-ENTRYPOINT ["nginx", "-g", "daemon off;"]
+
+WORKDIR /var/cache/nginx
+RUN chown nginx:nginx .
+
+WORKDIR /
+CMD ["nginx"]
diff --git a/scripts b/scripts
index 943bebc..ca48984 100755
--- a/scripts
+++ b/scripts
@@ -8,14 +8,17 @@ NC='\033[0m'
 
 # supported SSL versions
 SSL_VERSION_1_1_1w='1.1.1w'
-SSL_VERSION_3_0_11='3.0.11'
+SSL_VERSION_3_0_15='3.0.15'
 SSL_VERSION_3_2_1='3.2.1'
-SSL_VERSIONS=(${SSL_VERSION_3_2_1})
-SSL_VERSION=${SSL_VERSION:-$SSL_VERSION_3_0_11}
+SSL_VERSIONS=(
+	${SSL_VERSION_1_1_1w}
+	${SSL_VERSION_3_0_15}
+	${SSL_VERSION_3_2_1}
+)
 
 declare -A SSL_IMAGE_MAP
 SSL_IMAGE_MAP[$SSL_VERSION_1_1_1w]="bullseye-slim:openssl-${SSL_VERSION_1_1_1w}"
-SSL_IMAGE_MAP[$SSL_VERSION_3_0_11]="bookworm-slim:openssl-${SSL_VERSION_3_0_11}"
+SSL_IMAGE_MAP[$SSL_VERSION_3_0_15]="bookworm-slim:openssl-${SSL_VERSION_3_0_15}"
 SSL_IMAGE_MAP[$SSL_VERSION_3_2_1]="bookworm-slim:openssl-${SSL_VERSION_3_2_1}"
 
 # supported NGINX versions -- for binary distribution
@@ -28,7 +31,27 @@ NGINX_VERSIONS=(
 	1.27.3 # mainline
 	1.27.4 # mainline
 )
+
+# The following versions of libjwt are compatible:
+#   * v1.0 - v1.12.0
+#   * v1.12.1 - v1.14.0
+#   * v1.15.0+
+# At the time of writing this:
+#   * Debian and Ubuntu's repos have v1.10.2
+#   * EPEL has v1.12.1
+# This compiles against each version prior to a breaking change and the latest release
+LIBJWT_VERSION_DEBIAN=1.12.0
+LIBJWT_VERSION_EPEL=1.14.0
+LIBJWT_VERSION_LATEST=1.15.3
+LIBJWT_VERSIONS=(
+	${LIBJWT_VERSION_DEBIAN}
+	${LIBJWT_VERSION_EPEL}
+	${LIBJWT_VERSION_LATEST}
+)
+
+SSL_VERSION=${SSL_VERSION:-$SSL_VERSION_3_0_15}
 NGINX_VERSION=${NGINX_VERSION:-${NGINX_VERSIONS[-1]}}
+LIBJWT_VERSION=${LIBJWT_VERSION:-${LIBJWT_VERSION_DEBIAN}}
 IMAGE_NAME=${IMAGE_NAME:-nginx-auth-jwt}
 FULL_IMAGE_NAME=${ORG_NAME:-teslagov}/${IMAGE_NAME}
 TEST_CONTAINER_NAME_PREFIX="${IMAGE_NAME}-test"
@@ -40,7 +63,7 @@ all() {
 	test_all
 }
 
-verify_and_build_base_image() {
+build_base_image() {
 	local image=${SSL_IMAGE_MAP[$SSL_VERSION]}
 	local baseImage=${image%%:*}
 
@@ -53,23 +76,24 @@ verify_and_build_base_image() {
 		  --build-arg BASE_IMAGE=debian:${baseImage} \
 			--build-arg SSL_VERSION=${SSL_VERSION} \
 			-f openssl.dockerfile \
-			-t ${image} .
+			-t ${image} \
+			.
 	fi
 }
 
 build_module() {
-	local dockerArgs=${1:-}
 	local baseImage=${SSL_IMAGE_MAP[$SSL_VERSION]}
-	
-	verify_and_build_base_image
 
-	printf "${MAGENTA}Building module for NGINX ${NGINX_VERSION}...${NC}\n"
+	build_base_image
+
+	printf "${MAGENTA}Building module for NGINX ${NGINX_VERSION}, libjwt ${LIBJWT_VERSION}...${NC}\n"
 	docker buildx build \
 		-f nginx.dockerfile \
 		-t ${FULL_IMAGE_NAME}:${NGINX_VERSION} \
 	  --build-arg BASE_IMAGE=${baseImage} \
 		--build-arg NGINX_VERSION=${NGINX_VERSION} \
-		${dockerArgs} .
+		--build-arg LIBJWT_VERSION=${LIBJWT_VERSION} \
+		.
 	
 	if [ "$?" -ne 0 ]; then
 		printf "${RED}✘ Build failed ${NC}\n"
@@ -79,12 +103,9 @@ build_module() {
 }
 
 rebuild_module() {
-	clean_module
-	build_module --no-cache
-}
-
-clean_module() {
 	docker rmi -f $(docker images --filter=label=stage=ngx_http_auth_jwt_builder --quiet) 2> /dev/null || true
+
+	build_module
 }
 
 start() {
@@ -111,9 +132,9 @@ cp_bin() {
 	rm -rf ${destDir}/*
 	mkdir -p ${destDir}
 	docker exec "${IMAGE_NAME}" sh -c "cd /; tar -chf - \
-		usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so \
-		usr/lib/$(uname -m)-linux-gnu/libjansson.so.* \
-		usr/lib/$(uname -m)-linux-gnu/libjwt.*" | tar -xf - -C ${destDir} &>/dev/null
+		usr/lib/nginx/modules/ngx_http_auth_jwt_module.so \
+		usr/local/lib/libjansson.so.* \
+		usr/local/lib/libjwt.*" | tar -xf - -C ${destDir} &>/dev/null
 	
 	if [ $stopContainer ]; then
 		printf "${MAGENTA}Stopping NGINX container (${IMAGE_NAME})...${NC}\n"
@@ -122,31 +143,30 @@ cp_bin() {
 }
 
 make_release() {
-	local moduleVersion=${1}
-	
-	NGINX_VERSION=${2}
+	local moduleVersion=$(git describe --tags --abbrev=0)
 
 	printf "${MAGENTA}Making release for version ${moduleVersion} for NGINX ${NGINX_VERSION}...${NC}\n"
 
 	rebuild_module
 	rebuild_test
-	test
+	test --no-build
 	cp_bin
 
 	mkdir -p release
-	tar -czvf release/ngx_http_auth_jwt_module_${moduleVersion}_nginx_${NGINX_VERSION}.tgz \
+	tar -czvf release/ngx-http-auth-jwt-module-${moduleVersion}_libjwt-${LIBJWT_VERSION}_nginx-${NGINX_VERSION}.tgz \
 		README.md \
-		-C bin/usr/lib64/nginx/modules ngx_http_auth_jwt_module.so > /dev/null
+		-C bin/usr/lib/nginx/modules ngx_http_auth_jwt_module.so > /dev/null
 }
 
 # Create releases for all NGINX versions defined in `NGINX_VERSIONS`.
 make_releases() {
-	local moduleVersion=$(git describe --tags --abbrev=0)
-
 	rm -rf release/*
 
-	for v in ${NGINX_VERSIONS[@]}; do
-		make_release ${moduleVersion} ${v}
+	for NGINX_VERSION in ${NGINX_VERSIONS[@]}; do
+		for LIBJWT_VERSION in ${LIBJWT_VERSIONS[@]}; do
+			export NGINX_VERSION LIBJWT_VERSION
+			make_release
+		done
 	done
 }
 
@@ -178,14 +198,21 @@ rebuild_test() {
 test_all() {
 	for SSL_VERSION in "${SSL_VERSIONS[@]}"; do
 		for NGINX_VERSION in "${NGINX_VERSIONS[@]}"; do
-			test
+			for LIBJWT_VERSION in ${LIBJWT_VERSIONS[@]}; do
+				export SSL_VERSION NGINX_VERSION LIBJWT_VERSION
+				test
+			done
 		done
 	done
 }
 
 test() {
-	build_module
-	build_test
+	if [[ ! "$*" =~ --no-build ]]; then
+		build_module
+		build_test
+	fi
+
+	trap 'test_cleanup' 0
 
 	printf "${MAGENTA}Running tests...${NC}\n"
 	docker compose \
@@ -193,8 +220,6 @@ test() {
 		-f ${TEST_COMPOSE_FILE} up \
 		--no-start
 
-	trap test_cleanup 0
-	
 	test_now
 }
 
@@ -202,21 +227,22 @@ test_now() {
 	nginxContainerName="${TEST_CONTAINER_NAME_PREFIX}-nginx"
 	runnerContainerName="${TEST_CONTAINER_NAME_PREFIX}-runner"
 
+	echo
+	echo "Executing tests with the following options:"
+	echo "  SSL Version:     ${SSL_VERSION}"
+	echo "  LIBJWT Version:  ${LIBJWT_VERSION}"
+	echo "  NGINX Version:   ${NGINX_VERSION}"
+
 	docker start ${nginxContainerName}
 	
 	if [ "$(docker container inspect -f '{{.State.Running}}' ${nginxContainerName})" != "true" ]; then
 		printf "${RED}Failed to start container \"${nginxContainerName}\". See logs below:\n"
 		docker logs ${nginxContainerName}
 		printf "${NC}\n"
-		return
+		return 1
 	fi
 
 	docker start -a ${runnerContainerName}
-
-	echo
-	echo "Tests were executed with the following options:"
-	echo "    SSL Version: ${SSL_VERSION}"
-	echo "  NGINX Version: ${NGINX_VERSION}"
 }
 
 test_cleanup() {
diff --git a/test/test-runner.dockerfile b/test/test-runner.dockerfile
index 18fc3d3..377c40e 100644
--- a/test/test-runner.dockerfile
+++ b/test/test-runner.dockerfile
@@ -15,4 +15,4 @@ RUN <<`
 
 COPY test.sh .
 
-CMD ./test.sh
+CMD ["./test.sh"]

From b128954b6c3fc95d8538e75abac637405bdbd562 Mon Sep 17 00:00:00 2001
From: Josh McCullough <JoshMcCullough@users.noreply.github.com>
Date: Tue, 29 Jul 2025 16:02:03 -0400
Subject: [PATCH 130/130] specify platform / fix spacing

---
 scripts                      | 336 ++++++++++++++++++-----------------
 test/docker-compose-test.yml |   8 +-
 2 files changed, 176 insertions(+), 168 deletions(-)

diff --git a/scripts b/scripts
index ca48984..7ce7024 100755
--- a/scripts
+++ b/scripts
@@ -11,9 +11,9 @@ SSL_VERSION_1_1_1w='1.1.1w'
 SSL_VERSION_3_0_15='3.0.15'
 SSL_VERSION_3_2_1='3.2.1'
 SSL_VERSIONS=(
-	${SSL_VERSION_1_1_1w}
-	${SSL_VERSION_3_0_15}
-	${SSL_VERSION_3_2_1}
+  ${SSL_VERSION_1_1_1w}
+  ${SSL_VERSION_3_0_15}
+  ${SSL_VERSION_3_2_1}
 )
 
 declare -A SSL_IMAGE_MAP
@@ -23,13 +23,13 @@ SSL_IMAGE_MAP[$SSL_VERSION_3_2_1]="bookworm-slim:openssl-${SSL_VERSION_3_2_1}"
 
 # supported NGINX versions -- for binary distribution
 NGINX_VERSIONS=(
-	1.20.2 # legacy
-	1.22.1 # legacy
-	1.24.0 # legacy
-	1.26.2 # stable
-	1.26.3 # stable
-	1.27.3 # mainline
-	1.27.4 # mainline
+  1.20.2 # legacy
+  1.22.1 # legacy
+  1.24.0 # legacy
+  1.26.2 # stable
+  1.26.3 # stable
+  1.27.3 # mainline
+  1.27.4 # mainline
 )
 
 # The following versions of libjwt are compatible:
@@ -44,9 +44,9 @@ LIBJWT_VERSION_DEBIAN=1.12.0
 LIBJWT_VERSION_EPEL=1.14.0
 LIBJWT_VERSION_LATEST=1.15.3
 LIBJWT_VERSIONS=(
-	${LIBJWT_VERSION_DEBIAN}
-	${LIBJWT_VERSION_EPEL}
-	${LIBJWT_VERSION_LATEST}
+  ${LIBJWT_VERSION_DEBIAN}
+  ${LIBJWT_VERSION_EPEL}
+  ${LIBJWT_VERSION_LATEST}
 )
 
 SSL_VERSION=${SSL_VERSION:-$SSL_VERSION_3_0_15}
@@ -58,216 +58,218 @@ TEST_CONTAINER_NAME_PREFIX="${IMAGE_NAME}-test"
 TEST_COMPOSE_FILE='test/docker-compose-test.yml'
 
 all() {
-	build_module
-	build_test
-	test_all
+  build_module
+  build_test
+  test_all
 }
 
 build_base_image() {
-	local image=${SSL_IMAGE_MAP[$SSL_VERSION]}
-	local baseImage=${image%%:*}
-
-	if [ -z ${image} ]; then
-		echo "Base image not set for SSL version :${SSL_VERSION}"
-		exit 1
-	else
-		printf "${MAGENTA}Building ${baseImage} base image for SSL ${SSL_VERSION}...${NC}\n"
-		docker buildx build \
-		  --build-arg BASE_IMAGE=debian:${baseImage} \
-			--build-arg SSL_VERSION=${SSL_VERSION} \
-			-f openssl.dockerfile \
-			-t ${image} \
-			.
-	fi
+  local image=${SSL_IMAGE_MAP[$SSL_VERSION]}
+  local baseImage=${image%%:*}
+
+  if [ -z ${image} ]; then
+    echo "Base image not set for SSL version :${SSL_VERSION}"
+    exit 1
+  else
+    printf "${MAGENTA}Building ${baseImage} base image for SSL ${SSL_VERSION}...${NC}\n"
+    docker buildx build \
+      --platform linux/amd64 \
+      --build-arg BASE_IMAGE=debian:${baseImage} \
+      --build-arg SSL_VERSION=${SSL_VERSION} \
+      -f openssl.dockerfile \
+      -t ${image} \
+      .
+  fi
 }
 
 build_module() {
-	local baseImage=${SSL_IMAGE_MAP[$SSL_VERSION]}
-
-	build_base_image
-
-	printf "${MAGENTA}Building module for NGINX ${NGINX_VERSION}, libjwt ${LIBJWT_VERSION}...${NC}\n"
-	docker buildx build \
-		-f nginx.dockerfile \
-		-t ${FULL_IMAGE_NAME}:${NGINX_VERSION} \
-	  --build-arg BASE_IMAGE=${baseImage} \
-		--build-arg NGINX_VERSION=${NGINX_VERSION} \
-		--build-arg LIBJWT_VERSION=${LIBJWT_VERSION} \
-		.
-	
-	if [ "$?" -ne 0 ]; then
-		printf "${RED}✘ Build failed ${NC}\n"
-	else
-		printf "${GREEN}✔ Successfully built NGINX module ${NC}\n"
-	fi
+  local baseImage=${SSL_IMAGE_MAP[$SSL_VERSION]}
+
+  build_base_image
+
+  printf "${MAGENTA}Building module for NGINX ${NGINX_VERSION}, libjwt ${LIBJWT_VERSION}...${NC}\n"
+  docker buildx build \
+    --platform linux/amd64 \
+    -f nginx.dockerfile \
+    -t ${FULL_IMAGE_NAME}:${NGINX_VERSION} \
+    --build-arg BASE_IMAGE=${baseImage} \
+    --build-arg NGINX_VERSION=${NGINX_VERSION} \
+    --build-arg LIBJWT_VERSION=${LIBJWT_VERSION} \
+    .
+
+  if [ "$?" -ne 0 ]; then
+    printf "${RED}✘ Build failed ${NC}\n"
+  else
+    printf "${GREEN}✔ Successfully built NGINX module ${NC}\n"
+  fi
 }
 
 rebuild_module() {
-	docker rmi -f $(docker images --filter=label=stage=ngx_http_auth_jwt_builder --quiet) 2> /dev/null || true
+  docker rmi -f $(docker images --filter=label=stage=ngx_http_auth_jwt_builder --quiet) 2> /dev/null || true
 
-	build_module
+  build_module
 }
 
 start() {
-	local port=$(get_port)
+  local port=$(get_port)
 
-	printf "${MAGENTA}Starting NGINX container (${IMAGE_NAME}) on port ${port}...${NC}\n"
-	docker run --rm --name "${IMAGE_NAME}" -d -p ${port}:80 ${FULL_IMAGE_NAME}:${NGINX_VERSION} >/dev/null
+  printf "${MAGENTA}Starting NGINX container (${IMAGE_NAME}) on port ${port}...${NC}\n"
+  docker run --rm --name "${IMAGE_NAME}" -d -p ${port}:80 ${FULL_IMAGE_NAME}:${NGINX_VERSION} >/dev/null
 }
 
 stop() {
-	docker stop "${IMAGE_NAME}" >/dev/null
+  docker stop "${IMAGE_NAME}" >/dev/null
 }
 
 cp_bin() {
-	local destDir=bin
-	local stopContainer=0;
-
-	if [ "$(docker container inspect -f '{{.State.Running}}' ${IMAGE_NAME} | true)" != "true" ]; then
-		start
-		stopContainer=1
-	fi
-
-	printf "${MAGENTA}Copying binaries to: ${destDir}${NC}\n"
-	rm -rf ${destDir}/*
-	mkdir -p ${destDir}
-	docker exec "${IMAGE_NAME}" sh -c "cd /; tar -chf - \
-		usr/lib/nginx/modules/ngx_http_auth_jwt_module.so \
-		usr/local/lib/libjansson.so.* \
-		usr/local/lib/libjwt.*" | tar -xf - -C ${destDir} &>/dev/null
-	
-	if [ $stopContainer ]; then
-		printf "${MAGENTA}Stopping NGINX container (${IMAGE_NAME})...${NC}\n"
-		stop
-	fi
+  local destDir=bin
+  local stopContainer=0;
+
+  if [ "$(docker container inspect -f '{{.State.Running}}' ${IMAGE_NAME} | true)" != "true" ]; then
+    start
+    stopContainer=1
+  fi
+
+  printf "${MAGENTA}Copying binaries to: ${destDir}${NC}\n"
+  rm -rf ${destDir}/*
+  mkdir -p ${destDir}
+  docker exec "${IMAGE_NAME}" sh -c "cd /; tar -chf - \
+    usr/lib/nginx/modules/ngx_http_auth_jwt_module.so \
+    usr/local/lib/libjansson.so.* \
+    usr/local/lib/libjwt.*" | tar -xf - -C ${destDir} &>/dev/null
+
+  if [ $stopContainer ]; then
+    printf "${MAGENTA}Stopping NGINX container (${IMAGE_NAME})...${NC}\n"
+    stop
+  fi
 }
 
 make_release() {
-	local moduleVersion=$(git describe --tags --abbrev=0)
+  local moduleVersion=$(git describe --tags --abbrev=0)
 
-	printf "${MAGENTA}Making release for version ${moduleVersion} for NGINX ${NGINX_VERSION}...${NC}\n"
+  printf "${MAGENTA}Making release for version ${moduleVersion} for NGINX ${NGINX_VERSION}...${NC}\n"
 
-	rebuild_module
-	rebuild_test
-	test --no-build
-	cp_bin
+  rebuild_module
+  rebuild_test
+  test --no-build
+  cp_bin
 
-	mkdir -p release
-	tar -czvf release/ngx-http-auth-jwt-module-${moduleVersion}_libjwt-${LIBJWT_VERSION}_nginx-${NGINX_VERSION}.tgz \
-		README.md \
-		-C bin/usr/lib/nginx/modules ngx_http_auth_jwt_module.so > /dev/null
+  mkdir -p release
+  tar -czvf release/ngx-http-auth-jwt-module-${moduleVersion}_libjwt-${LIBJWT_VERSION}_nginx-${NGINX_VERSION}.tgz \
+    README.md \
+    -C bin/usr/lib/nginx/modules ngx_http_auth_jwt_module.so > /dev/null
 }
 
 # Create releases for all NGINX versions defined in `NGINX_VERSIONS`.
 make_releases() {
-	rm -rf release/*
-
-	for NGINX_VERSION in ${NGINX_VERSIONS[@]}; do
-		for LIBJWT_VERSION in ${LIBJWT_VERSIONS[@]}; do
-			export NGINX_VERSION LIBJWT_VERSION
-			make_release
-		done
-	done
+  rm -rf release/*
+
+  for NGINX_VERSION in ${NGINX_VERSIONS[@]}; do
+    for LIBJWT_VERSION in ${LIBJWT_VERSIONS[@]}; do
+      export NGINX_VERSION LIBJWT_VERSION
+      make_release
+    done
+  done
 }
 
 build_test() {
-	local dockerArgs=${1:-}
-	local port=$(get_port)
-	local sslPort=$(get_port $((port + 1)))
-	local runnerBaseImage=${SSL_IMAGE_MAP[$SSL_VERSION]}
-	
-	export TEST_CONTAINER_NAME_PREFIX
-	export FULL_IMAGE_NAME
-	export NGINX_VERSION
-
-	printf "${MAGENTA}Building test NGINX & runner using port ${port}...${NC}\n"
-	docker compose \
-	  -p ${TEST_CONTAINER_NAME_PREFIX} \
-	  -f ${TEST_COMPOSE_FILE} \
-		build \
-	  --build-arg RUNNER_BASE_IMAGE=${runnerBaseImage} \
-		--build-arg PORT=${port} \
-		--build-arg SSL_PORT=${sslPort} \
-		 ${dockerArgs}
+  local dockerArgs=${1:-}
+  local port=$(get_port)
+  local sslPort=$(get_port $((port + 1)))
+  local runnerBaseImage=${SSL_IMAGE_MAP[$SSL_VERSION]}
+
+  export TEST_CONTAINER_NAME_PREFIX
+  export FULL_IMAGE_NAME
+  export NGINX_VERSION
+
+  printf "${MAGENTA}Building test NGINX & runner using port ${port}...${NC}\n"
+  docker compose \
+    -p ${TEST_CONTAINER_NAME_PREFIX} \
+    -f ${TEST_COMPOSE_FILE} \
+    build \
+    --build-arg RUNNER_BASE_IMAGE=${runnerBaseImage} \
+    --build-arg PORT=${port} \
+    --build-arg SSL_PORT=${sslPort} \
+     ${dockerArgs}
 }
 
 rebuild_test() {
-	build_test --no-cache
+  build_test --no-cache
 }
 
 test_all() {
-	for SSL_VERSION in "${SSL_VERSIONS[@]}"; do
-		for NGINX_VERSION in "${NGINX_VERSIONS[@]}"; do
-			for LIBJWT_VERSION in ${LIBJWT_VERSIONS[@]}; do
-				export SSL_VERSION NGINX_VERSION LIBJWT_VERSION
-				test
-			done
-		done
-	done
+  for SSL_VERSION in "${SSL_VERSIONS[@]}"; do
+    for NGINX_VERSION in "${NGINX_VERSIONS[@]}"; do
+      for LIBJWT_VERSION in ${LIBJWT_VERSIONS[@]}; do
+        export SSL_VERSION NGINX_VERSION LIBJWT_VERSION
+        test
+      done
+    done
+  done
 }
 
 test() {
-	if [[ ! "$*" =~ --no-build ]]; then
-		build_module
-		build_test
-	fi
+  if [[ ! "$*" =~ --no-build ]]; then
+    build_module
+    build_test
+  fi
 
-	trap 'test_cleanup' 0
+  trap 'test_cleanup' 0
 
-	printf "${MAGENTA}Running tests...${NC}\n"
-	docker compose \
-	  -p ${TEST_CONTAINER_NAME_PREFIX} \
-		-f ${TEST_COMPOSE_FILE} up \
-		--no-start
+  printf "${MAGENTA}Running tests...${NC}\n"
+  docker compose \
+    -p ${TEST_CONTAINER_NAME_PREFIX} \
+    -f ${TEST_COMPOSE_FILE} up \
+    --no-start
 
-	test_now
+  test_now
 }
 
 test_now() {
-	nginxContainerName="${TEST_CONTAINER_NAME_PREFIX}-nginx"
-	runnerContainerName="${TEST_CONTAINER_NAME_PREFIX}-runner"
-
-	echo
-	echo "Executing tests with the following options:"
-	echo "  SSL Version:     ${SSL_VERSION}"
-	echo "  LIBJWT Version:  ${LIBJWT_VERSION}"
-	echo "  NGINX Version:   ${NGINX_VERSION}"
-
-	docker start ${nginxContainerName}
-	
-	if [ "$(docker container inspect -f '{{.State.Running}}' ${nginxContainerName})" != "true" ]; then
-		printf "${RED}Failed to start container \"${nginxContainerName}\". See logs below:\n"
-		docker logs ${nginxContainerName}
-		printf "${NC}\n"
-		return 1
-	fi
-
-	docker start -a ${runnerContainerName}
+  nginxContainerName="${TEST_CONTAINER_NAME_PREFIX}-nginx"
+  runnerContainerName="${TEST_CONTAINER_NAME_PREFIX}-runner"
+
+  echo
+  echo "Executing tests with the following options:"
+  echo "  SSL Version:     ${SSL_VERSION}"
+  echo "  LIBJWT Version:  ${LIBJWT_VERSION}"
+  echo "  NGINX Version:   ${NGINX_VERSION}"
+
+  docker start ${nginxContainerName}
+
+  if [ "$(docker container inspect -f '{{.State.Running}}' ${nginxContainerName})" != "true" ]; then
+    printf "${RED}Failed to start container \"${nginxContainerName}\". See logs below:\n"
+    docker logs ${nginxContainerName}
+    printf "${NC}\n"
+    return 1
+  fi
+
+  docker start -a ${runnerContainerName}
 }
 
 test_cleanup() {
-	docker compose \
-		-p ${TEST_CONTAINER_NAME_PREFIX} \
-		-f ${TEST_COMPOSE_FILE} down
+  docker compose \
+    -p ${TEST_CONTAINER_NAME_PREFIX} \
+    -f ${TEST_COMPOSE_FILE} down
 }
 
 get_port() {
-	startPort=${1:-8000}
-	endPort=$((startPort + 100))
-
-	for p in $(seq ${startPort} ${endPort}); do
-		if ! ss -ln | grep -q ":${p} "; then
-			echo ${p}
-			break
-		fi
-	done
+  startPort=${1:-8000}
+  endPort=$((startPort + 100))
+
+  for p in $(seq ${startPort} ${endPort}); do
+    if ! ss -ln | grep -q ":${p} "; then
+      echo ${p}
+      break
+    fi
+  done
 }
 
 if [ $# -eq 0 ]; then
-	all
+  all
 else
-	fn=$1
-	shift
-	
-	${fn} "$@"
+  fn=$1
+  shift
+
+  ${fn} "$@"
 fi
diff --git a/test/docker-compose-test.yml b/test/docker-compose-test.yml
index 72ff710..cc570c5 100644
--- a/test/docker-compose-test.yml
+++ b/test/docker-compose-test.yml
@@ -5,8 +5,11 @@ services:
     build:
       context: .
       dockerfile: test-nginx.dockerfile
+      platforms:
+        - linux/amd64
       args:
         BASE_IMAGE: ${FULL_IMAGE_NAME}:${NGINX_VERSION:?required}
+    platform: linux/amd64
     logging:
       driver: ${LOG_DRIVER:-journald}
 
@@ -15,5 +18,8 @@ services:
     build:
       context: .
       dockerfile: test-runner.dockerfile
+      platforms:
+        - linux/amd64
+    platform: linux/amd64
     depends_on:
-      - nginx
\ No newline at end of file
+      - nginx