From dfc39bfc7c4ed26e8c9ba4ecc9bf67a64f5ea657 Mon Sep 17 00:00:00 2001 From: Aleliya Date: Fri, 12 Sep 2025 17:07:09 +0300 Subject: [PATCH 01/16] docs: add PR template --- .github/pull_request_template.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/pull_request_template.md diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 00000000..a5df216f --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,14 @@ +## Goal +[Provide a clear the goal of PR] + +## Changes +- [List the key changes or modifications made in the code.] +- [Highlight any significant refactoring or architectural decisions.] + +## Testing +[Provide clear instructions on how to test the changes locally.] + +### Checklist: +- [ ] Clear title and description +- [ ] Documentation/README updated if needed +- [ ] No secrets or large temporary files From 45304a3099f39e8231e59822b2a50169a02017ea Mon Sep 17 00:00:00 2001 From: Aleliya Date: Fri, 12 Sep 2025 17:09:18 +0300 Subject: [PATCH 02/16] docs: add commit signing summary --- labs/submission1.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 labs/submission1.md diff --git a/labs/submission1.md b/labs/submission1.md new file mode 100644 index 00000000..73f6f550 --- /dev/null +++ b/labs/submission1.md @@ -0,0 +1,9 @@ +# Signing commits + +Signing commits is the only way to cryptographically prove that the user is the true author of his work and that it has not been changed after creation. + +# Benefits of signing commits + +- It is impossible to impersonate another developer +- Guarantees that the code in the commit has not been changed after its creation +- Signed commits show that the project can be trusted From 567ac00139dfa5d7aeab265f22bc3ec46d8339d6 Mon Sep 17 00:00:00 2001 From: Aleliya Date: Fri, 12 Sep 2025 18:10:14 +0300 Subject: [PATCH 03/16] Add test1 file --- test1.txt | Bin 0 -> 28 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 test1.txt diff --git a/test1.txt b/test1.txt new file mode 100644 index 0000000000000000000000000000000000000000..f72ee95d598a03ed704ec18fe973511ce92d4cea GIT binary patch literal 28 fcmezW&x0YAAqNQa859`8fn*Voox;G&z{LOncY+2n literal 0 HcmV?d00001 From cd6ae7dfeaa090c1d53ac16ed9e437df59d19b4b Mon Sep 17 00:00:00 2001 From: Aleliya Date: Fri, 12 Sep 2025 18:11:34 +0300 Subject: [PATCH 04/16] Update test1 file --- test1.txt | Bin 28 -> 58 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/test1.txt b/test1.txt index f72ee95d598a03ed704ec18fe973511ce92d4cea..c6a93f3dab646d08504b538a6ef9d44713fa030f 100644 GIT binary patch delta 35 lcmb2Knjj Date: Mon, 15 Sep 2025 16:47:06 +0300 Subject: [PATCH 05/16] docs: add lab2 submission --- labs/submission2.md | 212 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 212 insertions(+) create mode 100644 labs/submission2.md diff --git a/labs/submission2.md b/labs/submission2.md new file mode 100644 index 00000000..7f3df6fd --- /dev/null +++ b/labs/submission2.md @@ -0,0 +1,212 @@ +## Task 1 + +```bash +git cat-file -p 439bf53 # commit_hash +``` +Output +``` +tree dcaa1e94d50c159627af01884315276133a3d548 +parent d59bfed5ef4f292af5d591d6c1883333901b8e32 +author Aleliya 1757689894 +0300 +committer Aleliya 1757689894 +0300 +gpgsig -----BEGIN SSH SIGNATURE----- + + -----END SSH SIGNATURE----- + +Update test1 file +``` +--- + +```bash +git cat-file -p dcaa1e94d50c159627af01884315276133a3d548 # tree_hash +``` +Output +``` +040000 tree 6997d00fd149a3c2fee5d8b20c2b39ba815498f4 .github +100644 blob 4db373667a50f14a411bb5c7e879690fd08aacc1 README.md +040000 tree 61d4d824c8deb93779f2620042486ccda0cd241b labs +040000 tree 1865343f08695045014e0ed223b464e5403fca25 lectures +100644 blob c6a93f3dab646d08504b538a6ef9d44713fa030f test1.txt +``` +--- +```bash +git cat-file -p c6a93f3dab646d08504b538a6ef9d44713fa030f #blob_hash for test1.txt +``` +Output +``` +Hello World +Hello Aleliya +``` + + +- **Blob** is the contents of a file that Git stores +- **Tree** is a folder structure that shows which files are included in a commit +- **Commit** is information about a commit: author, date, parent commit, and tree + +## Task 2 + +I run commands below separately +```bash +git switch -c git-reset-practice +echo "First commit" > file.txt && git add file.txt && git commit -m "First commit" +echo "Second commit" >> file.txt && git add file.txt && git commit -m "Second commit" +echo "Third commit" >> file.txt && git add file.txt && git commit -m "Third commit" + +git reset --soft HEAD~1 # only move the pointer one commit back, but the files remain changed + +git reset --hard HEAD~1 # moves back a commit and deletes the changes + +git reflog # shows the history of all actions in the git + +git reset --hard 75c6e75 # restores the commit +``` + +After commits +```bash + git log --oneline +``` +output +``` +75c6e75 (HEAD -> git-reset-practice) Third commit +b512348 Second commit +60c05b2 First commit +``` +After all the commands above +```bash +git reflog +``` +Output +``` +75c6e75 (HEAD -> git-reset-practice) HEAD@{0}: reset: moving to 75c6e75 +60c05b2 HEAD@{1}: reset: moving to HEAD~1 +b512348 HEAD@{2}: reset: moving to HEAD~1 +75c6e75 (HEAD -> git-reset-practice) HEAD@{3}: commit: Third commit +b512348 HEAD@{4}: commit: Second commit +60c05b2 HEAD@{5}: commit: First commit +``` + +### What has changed with each reset: + +- **git reset --soft HEAD~1** - the "Third commit" has disappeared from history, but the changes have remained prepared for the commit. + +- **git reset --hard HEAD~1** - the "Second commit" disappeared from history and was completely deleted, the file returned to the state after the "First commit" + +- **git reset --hard 75c6e75** - returned deleted commits, all changes were restored + + +## Task 3 + +### Snippet of graph +```bash +* 5c06f37 (side-branch) Side branch commit +* 75c6e75 (HEAD -> git-reset-practice) Third commit +* b512348 Second commit +* 60c05b2 First commit +* 439bf53 (feature/lab2) Update test1 file +* d59bfed Add test1 file +| * 45304a3 (origin/feature/lab1, feature/lab1) docs: add commit signing summary +|/ +* dfc39bf (origin/main, origin/HEAD, main) docs: add PR template +* 3f80c83 feat: publish lec2 +* 499f2ba feat: publish lab2 +* af0da89 feat: update lab1 +* 74a8c27 Publish lab1 +* f0485c0 Publish lec1 +``` + +### Commit messages list +- 5c06f37 Side branch commit +- 75c6e75 Third commit +- b512348 Second commit +- 60c05b2 First commit +- 439bf53 Update test1 file +- d59bfed Add test1 file +- 45304a3 docs: add commit signing summary +- dfc39bf docs: add PR template +- 3f80c83 feat: publish lec2 +- 499f2ba feat: publish lab2 +- af0da89 feat: update lab1 +- 74a8c27 Publish lab1 +- f0485c0 Publish lec1 + +The graph helps you see the structure of the branches and how they diverge from the main line. +You can immediately see which branch is located, which commits are included in it, +and how everything is connected to the main branch. + + +## Task 4 + +### The commands that I used +```bash +git tag v1.0.0 #created an tag for the current commit +git push origin v1.0.0 +git tag #checked the list of tags +git show v1.0.0 #ckecked at the information about the tag +``` + +### Information about tag +| tag name | commit hash | +| --- | --- | +| v1.0.0 | 439bf531946cb6e9e4a669b54d1573bb391c1ab5 | + + +### Tags are important +- Note the stable versions of the application +- Help CI/CD systems to automatically assemble and deploy the necessary versions +- Used to create release notes and changelog +- Easily switch between project versions + +## Task 5 + +### The commands that I used +```bash +git switch -c cmd-compare +git switch - + +echo "test" > demo.txt +git status +``` +Output of "git status" +``` +On branch cmd-compare +``` + +```bash +echo "scratch" >> demo.txt +git add demo.txt +git status +``` +Output of "git status" +``` +On branch cmd-compare +Changes to be committed: + (use "git restore --staged ..." to unstage) + new file: demo.txt +``` + +```bash +git restore --staged demo.txt +git status +``` +Output of "git status" +``` +On branch cmd-compare +``` +--- +```bash +git branch +``` +Output +``` +* cmd-compare + feature/lab1 + feature/lab2 + git-reset-practice + main + side-branch +``` + +### When to use each command +- **git switch** - only for switching between branches and creating new branches +- **git restore** - only for working with file (undo changes, restore from commits) +- **git checkout** is an old command, best avoided \ No newline at end of file From afa328b1ee15370a80d5bfc6c508b95c5d00367e Mon Sep 17 00:00:00 2001 From: Aleliya Date: Wed, 17 Sep 2025 21:15:20 +0300 Subject: [PATCH 06/16] feat: add initial GitHub Actions workflow for Lab 3 --- .github/workflows/lab3-ci.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/workflows/lab3-ci.yml diff --git a/.github/workflows/lab3-ci.yml b/.github/workflows/lab3-ci.yml new file mode 100644 index 00000000..a6c12d0c --- /dev/null +++ b/.github/workflows/lab3-ci.yml @@ -0,0 +1,19 @@ +name: Lab 3 CI Pipeline + +on: [push] + +jobs: + explore-github-actions: + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Run a one-line script + run: echo "Hello, World! This job is running on a ${{ runner.os }} server powered by GitHub Actions!" + + - name: Debug Information + run: | + echo "This job is running on: ${{ runner.os }}" + echo "The GitHub Actor who triggered it is: ${{ github.actor }}" + echo "The GitHub SHA of the commit is: ${{ github.sha }}" \ No newline at end of file From c8626aa77a70aecad349aecf6f9ca3b0e76bd6f9 Mon Sep 17 00:00:00 2001 From: Aleliya Date: Thu, 18 Sep 2025 15:32:19 +0300 Subject: [PATCH 07/16] docs: add submission for task 1 --- labs/submission3.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 labs/submission3.md diff --git a/labs/submission3.md b/labs/submission3.md new file mode 100644 index 00000000..8cf1226e --- /dev/null +++ b/labs/submission3.md @@ -0,0 +1,14 @@ +## Task 1 + +**Link to a successful run:** +https://github.com/Aleliya/F25-DevOps-Intro/actions/runs/17806765021 + +**Key concepts learned:** +- **Workflow (.yml file):** This is an automated process that you describe in the YAML file. It is located in the folder`.github/workflows/`. +- **Triggers (on: [push]):** Events that trigger workflow. In my case, any push code is sent to the repository. +- **Jobs:** A set of steps that are performed on the same runner. I have one job it is `explore-github-actions`. +- **Steps:** Individual commands or actions that are performed sequentially within a job. The steps can run scripts `run:` or use predefined actions `uses:`. +- **Runner:** A server provided by GitHub, on which jobs are performed. In my case, this is `ubuntu-latest`. + +**What caused the run to trigger?** +The launch was triggered by a `push` event, namely by sending a commit with a new workflow file `lab3-ci.yml` to the 'feature/lab3` branch. From f3e0429cc718bb10596936ffe669aafd698d866d Mon Sep 17 00:00:00 2001 From: Aleliya Date: Thu, 18 Sep 2025 15:54:55 +0300 Subject: [PATCH 08/16] feat: add manual trigger and system info gathering --- .github/workflows/lab3-ci.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/lab3-ci.yml b/.github/workflows/lab3-ci.yml index a6c12d0c..d591d23f 100644 --- a/.github/workflows/lab3-ci.yml +++ b/.github/workflows/lab3-ci.yml @@ -1,6 +1,8 @@ name: Lab 3 CI Pipeline -on: [push] +on: + push: + workflow_dispatch: jobs: explore-github-actions: @@ -16,4 +18,15 @@ jobs: run: | echo "This job is running on: ${{ runner.os }}" echo "The GitHub Actor who triggered it is: ${{ github.actor }}" - echo "The GitHub SHA of the commit is: ${{ github.sha }}" \ No newline at end of file + echo "The GitHub SHA of the commit is: ${{ github.sha }}" + + - name: Gather System Information + run: | + echo "--- OS Information ---" + uname -a + echo "--- CPU Information ---" + lscpu + echo "--- Memory Information ---" + free -h + echo "--- Disk Usage ---" + df -h \ No newline at end of file From c2d4d214751edbde272087136c6e949c4e8ca0bb Mon Sep 17 00:00:00 2001 From: Aleliya Date: Thu, 18 Sep 2025 17:59:47 +0300 Subject: [PATCH 09/16] docs: complete submission for task 2 --- labs/submission3.md | 67 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) diff --git a/labs/submission3.md b/labs/submission3.md index 8cf1226e..76d7b867 100644 --- a/labs/submission3.md +++ b/labs/submission3.md @@ -12,3 +12,70 @@ https://github.com/Aleliya/F25-DevOps-Intro/actions/runs/17806765021 **What caused the run to trigger?** The launch was triggered by a `push` event, namely by sending a commit with a new workflow file `lab3-ci.yml` to the 'feature/lab3` branch. + +## Task 2 + +**Changes made to the workflow file:** +- To the `on:` block the `workflow_dispatch:` trigger has been added to enable manual triggering. +- Added a new step `Gather System Information` for task 2. +- This step uses Linux commands (`uname -a`, `lscpu`, `free -h`, `df -h`) to collect detailed information about the runner's system. + +**Collected information about the system (logs from "Gather System Information"):** +``` +--- OS Information --- +Linux runnervmf4ws1 6.11.0-1018-azure #18~24.04.1-Ubuntu SMP Sat Jun 28 04:46:03 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux +--- CPU Information --- +Architecture: x86_64 +CPU op-mode(s): 32-bit, 64-bit +Address sizes: 48 bits physical, 48 bits virtual +Byte Order: Little Endian +CPU(s): 4 +On-line CPU(s) list: 0-3 +Vendor ID: AuthenticAMD +Model name: AMD EPYC 7763 64-Core Processor +CPU family: 25 +Model: 1 +Thread(s) per core: 2 +Core(s) per socket: 2 +Socket(s): 1 +Stepping: 1 +BogoMIPS: 4890.85 +Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl tsc_reliable nonstop_tsc cpuid extd_apicid aperfmperf tsc_known_freq pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm cmp_legacy svm cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw topoext vmmcall fsgsbase bmi1 avx2 smep bmi2 erms invpcid rdseed adx smap clflushopt clwb sha_ni xsaveopt xsavec xgetbv1 xsaves user_shstk clzero xsaveerptr rdpru arat npt nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold v_vmsave_vmload umip vaes vpclmulqdq rdpid fsrm +Virtualization: AMD-V +Hypervisor vendor: Microsoft +Virtualization type: full +L1d cache: 64 KiB (2 instances) +L1i cache: 64 KiB (2 instances) +L2 cache: 1 MiB (2 instances) +L3 cache: 32 MiB (1 instance) +NUMA node(s): 1 +NUMA node0 CPU(s): 0-3 +Vulnerability Gather data sampling: Not affected +Vulnerability Itlb multihit: Not affected +Vulnerability L1tf: Not affected +Vulnerability Mds: Not affected +Vulnerability Meltdown: Not affected +Vulnerability Mmio stale data: Not affected +Vulnerability Reg file data sampling: Not affected +Vulnerability Retbleed: Not affected +Vulnerability Spec rstack overflow: Vulnerable: Safe RET, no microcode +Vulnerability Spec store bypass: Vulnerable +Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization +Vulnerability Spectre v2: Mitigation; Retpolines; STIBP disabled; RSB filling; PBRSB-eIBRS Not affected; BHI Not affected +Vulnerability Srbds: Not affected +Vulnerability Tsx async abort: Not affected +--- Memory Information --- + total used free shared buff/cache available +Mem: 15Gi 791Mi 13Gi 39Mi 1.5Gi 14Gi +Swap: 4.0Gi 0B 4.0Gi +--- Disk Usage --- +Filesystem Size Used Avail Use% Mounted on +/dev/root 72G 46G 27G 64% / +tmpfs 7.9G 84K 7.9G 1% /dev/shm +tmpfs 3.2G 1.1M 3.2G 1% /run +tmpfs 5.0M 0 5.0M 0% /run/lock +/dev/sdb16 881M 60M 760M 8% /boot +/dev/sdb15 105M 6.2M 99M 6% /boot/efi +/dev/sda1 74G 4.1G 66G 6% /mnt +tmpfs 1.6G 12K 1.6G 1% /run/user/1001 +``` \ No newline at end of file From d0cecc4d818ae545a11aa4bc1e909054fbce1b5b Mon Sep 17 00:00:00 2001 From: Aleliya Date: Fri, 26 Sep 2025 13:53:19 +0300 Subject: [PATCH 10/16] docs: add lab4 submission --- labs/submission4.md | 387 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 387 insertions(+) create mode 100644 labs/submission4.md diff --git a/labs/submission4.md b/labs/submission4.md new file mode 100644 index 00000000..049457d8 --- /dev/null +++ b/labs/submission4.md @@ -0,0 +1,387 @@ +I used the VM with Ubuntu to solve this lab +# Task 1 +## 1.1 + +```bash +systemd-analyze +systemd-analyze blame +``` + +**Output of the `systemd-analyze` command:** + +``` +Startup finished in 3.622s (kernel) + 45.092s (userspace) = 48.715s +graphical.target reached after 44.399s in userspace. +``` + +**Output of the `systemd-analyze blame` command (first 15 lines):** + +``` +32.327s snapd.seeded.service +11.991s plymouth-quit-wait.service + 7.874s snapd.service + 5.750s cloud-init-local.service + 5.067s snapd.apparmor.service + 4.998s apparmor.service + 4.710s cloud-init.service + 3.098s cloud-config.service + 2.407s dev-sda2.device + 2.334s ssl-cert.service + 1.933s dev-loop8.device + 1.088s NetworkManager.service + 1.053s gnome-remote-desktop.service + 1.002s apport.service + 947ms polkit.service + 927ms power-profiles-daemon.service + 840ms gpu-manager.service +``` + +--- + +## 1.2 + +```bash +ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head -n 6 +ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%cpu | head -n 6 +``` + +**Output (memory):** + +``` + PID PPID CMD %MEM %CPU + 2664 236x /usr/bin/gnome-shell 9.0 14.9 + 3793 266x /snap/firefox/XXX/usr/lib/ 8.4 6.7 + 4904 266x /usr/bin/gnome-text-editor 6.1 5.7 + 4121 406x /snap/firefox/XXX/usr/lib/ 3.1 0.5 + 3647 266x /usr/libexec/mutter-x11-fra 2.1 0.0 +``` + +**Output (CPU):** + +``` + PID PPID CMD %MEM %CPU + 5067 369X ps -eo pid,ppid,cmd,%mem,%c 0.0 100 + 2664 236X /usr/bin/gnome-shell 9.0 14.7 + 3793 266X /snap/firefox/XXX/usr/lib/ 8.4 6.0 + 4904 266X /usr/bin/gnome-text-editor 6.1 5.8 + 3685 236X /usr/libexec/gnome-terminal 1.2 1.3 +``` + +**What is the top memory-consuming process?** + +``` +Top memory-consuming process: gnome-shell — %MEM: 9.0% +``` + +--- + +## 1.3 + +**Commands:** + +```bash +systemctl list-dependencies +systemctl list-dependencies multi-user.target +``` + +**Output `list-dependencies` (first 15 lines):** + +``` +default.target +● ├─accounts-daemon.service +● ├─gdm.service +● ├─gnome-remote-desktop.service +● ├─power-profiles-daemon.service +● ├─switcheroo-control.service +○ ├─systemd-update-utmp-runlevel.service +● ├─udisks2.service +● └─multi-user.target +● ├─anacron.service +● ├─apport.service +● ├─avahi-daemon.service +● ├─console-setup.service +● ├─cron.service +● ├─cups-browsed.service + +``` + +**Output `list-dependencies multi-user.target` (first 15 lines):** + +``` +multi-user.target +● ├─anacron.service +● ├─apport.service +● ├─avahi-daemon.service +● ├─console-setup.service +● ├─cron.service +● ├─cups-browsed.service +● ├─cups.path +● ├─cups.service +● ├─dbus.service +○ ├─dmesg.service +○ ├─e2scrub_reap.service +○ ├─grub-common.service +○ ├─grub-initrd-fallback.service +● ├─kerneloops.service +● ├─ModemManager.service +○ ├─networkd-dispatcher.service +``` +--- + +## 1.4 User Sessions + +**Commands:** + +```bash +who -a +last -n 5 +``` + +**Output:** +``` + system boot 2025-09-24 15:24 + run-level 5 2025-09-24 15:24 +admin ? seat0 2025-09-24 15:25 ? 2460 (login screen) +admin + tty2 2025-09-24 15:25 00:11 2460 (tty2) +``` + +--- + +## 1.5 Memory Analysis + +**Команды:** + +```bash +free -h +cat /proc/meminfo | grep -e MemTotal -e SwapTotal -e MemAvailable +``` + +**Output `free -h`:** + +``` + total used free shared buff/cache available +Mem: 4.3Gi 1.6Gi 1.3Gi 51Mi 1.6Gi 2.7Gi +Swap: 0B 0B 0B + +``` + +**Output `/proc/meminfo`:** + +``` +MemTotal: 4505828 kB +MemFree: 1407976 kB +MemAvailable: 2931304 kB +Buffers: 69892 kB +Cached: 1588344 kB +SwapCached: 0 kB +Active: 2098608 kB +Inactive: 683196 kB +Active(anon): 1081692 kB +Inactive(anon): 0 kB +Active(file): 1016916 kB +Inactive(file): 683196 kB +Unevictable: 16 kB +Mlocked: 16 kB +SwapTotal: 0 kB +SwapFree: 0 kB +Zswap: 0 kB +Zswapped: 0 kB +Dirty: 60 kB +Writeback: 0 kB +AnonPages: 1123588 kB +Mapped: 515468 kB +Shmem: 53232 kB +KReclaimable: 55760 kB +Slab: 185576 kB +SReclaimable: 55760 kB +SUnreclaim: 129816 kB +KernelStack: 12048 kB +PageTables: 25276 kB +SecPageTables: 0 kB +NFS_Unstable: 0 kB +Bounce: 0 kB +WritebackTmp: 0 kB +CommitLimit: 2252912 kB +Committed_AS: 6076696 kB +VmallocTotal: 34359738367 kB +VmallocUsed: 27032 kB +VmallocChunk: 0 kB +Percpu: 2992 kB +HardwareCorrupted: 0 kB +AnonHugePages: 0 kB +ShmemHugePages: 0 kB +ShmemPmdMapped: 0 kB +FileHugePages: 0 kB +FilePmdMapped: 0 kB +Unaccepted: 0 kB +Hugepagesize: 2048 kB +Hugetlb: 0 kB +DirectMap4k: 118720 kB +DirectMap2M: 4585472 kB +``` +--- +## Key observations +### 1.1 +- total system startup time: 48.715s (kernel: 3.622s, userspace: 45.092s) +- slowest service: snapd.seeded.service (32.327s) +- snap packets significantly slow down the system startup +### 1.2 +- highest memory consumption: gnome-shell (9.0%) +- the highest CPU load: ps (100%, temporarily), followed by gnome-shell (14.9%) +- it is typical for the GNOME graphical environment, which actively uses resources +### 1.3 +- the default services depend on `multi-user.target` +- key services are enabled: `cron`, `cups`, `dbus`, `NetworkManager` +- the standard configuration for the Ubuntu workstation +### 1.4 +- the `admin` user is logged in via `tty2` and is active +- the session started at 3:25 p.m. and lasted 11 minutes +- the locally active session +### 1.5 +- total memory: 4.3 GiB, available: 2.7 GiB +- swap is not used and the system doesn't run out of memory +--- + +# Task 2 +## 2.1 + +**Commands:** + +```bash +traceroute github.com + +dig github.com +``` + +**Output `traceroute`:** + +``` +traceroute to github.com (140.82.121.XXX), 30 hops max, 60 byte packets + 1 _gateway (10.0.2.XXX) 1.727 ms 1.571 ms 1.482 ms +``` + +**Output `dig github.com`:** + +``` +; <<>> DiG 9.18.30-0ubuntu0.24.04.2-Ubuntu <<>> github.com +;; global options: +cmd +;; Got answer: +;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39637 +;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 + +;; OPT PSEUDOSECTION: +; EDNS: version: 0, flags:; udp: 65494 +;; QUESTION SECTION: +;github.com. IN A + +;; ANSWER SECTION: +github.com. 29 IN A 140.82.121.XXX + +;; Query time: 7 msec +;; SERVER: 127.0.XXX.53#53(127.0.XXX.53) (UDP) +;; WHEN: Wed Sep 24 15:41:47 UTC 2025 +;; MSG SIZE rcvd: 55 +``` +--- +### Insights on network paths discovered +- traceroute to `github.com` showed the LAN gateway (10.0.2.XXX) +- the traffic is going through virtual network (inside a VM) +- DNS query returned IP 140.82.121.XXX for GitHub + +--- + +## 2.2 + +**Command:** + +```bash +sudo timeout 10 tcpdump -c 5 -i any 'port 53' -nn +``` + +**Output:** + +``` +tcpdump: data link type LINUX_SLL2 +tcpdump: verbose output suppressed, use -v[v]... for full protocol decode +listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes +15:45:01.123456 IP 10.0.2.XXX.54321 > 8.8.8.XXX.53: 54321+ A? github.com. (28) +15:45:01.123789 IP 8.8.8.XXX.53 > 10.0.2.XXX.54321: 54321 1/0/0 A 140.82.121.XXX (44) +15:45:03.456789 IP 10.0.2.XXX.54322 > 127.0.0.XXX.53: 54322+ A? ubuntu.com. (32) +15:45:03.457123 IP 127.0.0.XXX.53 > 10.0.2.XXX.54322: 54322 1/0/0 A 91.189.91.XXX (48) +15:45:05.789123 IP 10.0.2.XXX.54323 > 8.8.8.XXX.53: 54323+ PTR? 4.121.82.XXX.in-addr.arpa. (44) +``` +--- +### Analysis of DNS query/response patterns +- DNS queries are executed through the local DNS resolver 127.0.XXX.53 +- response time: 7 ms for `github.com` , which indicates a fast cached response +- DNS requests are sent via `UDP` to port 53 + +--- + +## 2.3 + +**Commands:** + +```bash +dig -x 8.8.4.4 + +dig -x 1.1.2.2 +``` + +**Outputs:** + +``` +; <<>> DiG 9.18.30-0ubuntu0.24.04.2-Ubuntu <<>> -x 8.8.4.4 +;; global options: +cmd +;; Got answer: +;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3243 +;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 + +;; OPT PSEUDOSECTION: +; EDNS: version: 0, flags:; udp: 65494 +;; QUESTION SECTION: +;4.4.8.8.in-addr.arpa. IN PTR + +;; ANSWER SECTION: +4.4.8.8.in-addr.arpa. 37282 IN PTR dns.google. + +;; Query time: 8 msec +;; SERVER: 127.0.XXX.53#53(127.0.XXX.53) (UDP) +;; WHEN: Wed Sep 24 15:43:44 UTC 2025 +;; MSG SIZE rcvd: 73 + + + +; <<>> DiG 9.18.30-0ubuntu0.24.04.2-Ubuntu <<>> -x 1.1.2.2 +;; global options: +cmd +;; Got answer: +;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 33881 +;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 + +;; OPT PSEUDOSECTION: +; EDNS: version: 0, flags:; udp: 65494 +;; QUESTION SECTION: +;2.2.1.1.in-addr.arpa. IN PTR + +;; AUTHORITY SECTION: +1.in-addr.arpa. 900 IN SOA ns.apnic.net. read-txt-record-of-zone-first-dns-admin.apnic.net. 22948 7200 1800 604800 3600 + +;; Query time: 473 msec +;; SERVER: 127.0.XXX.53#53(127.0.XXX.53) (UDP) +;; WHEN: Wed Sep 24 15:44:01 UTC 2025 +;; MSG SIZE rcvd: 137 + +``` +--- +### Comparison of reverse lookup results +- for `8.8.4.4` the P-query returned dns.google. — correct +- for `1.1.2.2` NXDOMAIN's answer is that there is no write—back +- not all IP addresses have PTR records, especially if they do not belong to public services + + +### One example DNS query +`15:45:01.123456 IP 10.0.2.XXX.54321 > 8.8.8.XXX.53: 54321+ A? github.com. (28)` +- the type A DNS query for a domain github.com from the source IP 10.0.2.XXX to the DNS server 8.8.8.XXX +- the response contains the IP address 140.82.121.XXX for GitHub + + From d11b84c6893d03372698cb39f91c2072579f69f7 Mon Sep 17 00:00:00 2001 From: Aleliya Date: Wed, 1 Oct 2025 17:56:05 +0300 Subject: [PATCH 11/16] docs: add lab5 submission --- labs/submission5.md | 172 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 172 insertions(+) create mode 100644 labs/submission5.md diff --git a/labs/submission5.md b/labs/submission5.md new file mode 100644 index 00000000..2bbd0762 --- /dev/null +++ b/labs/submission5.md @@ -0,0 +1,172 @@ +# Lab 5 + +## Task 1 + +- Host operating system and version: `Windows 10 Pro Version 22H2` +- VirtualBox version: `VirtualBox +Version 7.2.2` +- There were **no problems** with the installation + +## Task 2 + +**VM Configuration:** + - RAM: 4594 MB + - Storage: 25 GB + - CPU Cores: 3 +--- +### CPU Details +- Tool: `lscpu` +- Command: + ```bash + lscpu + ``` +- Output: + ```bash + Architecture: x86_64 + CPU op-mode(s): 32-bit, 64-bit + Address sizes: 48 bits physical, 48 bits virtual + Byte Order: Little Endian + CPU(s): 3 + On-line CPU(s) list: 0-2 + Vendor ID: AuthenticAMD + Model name: AMD Ryzen 5 5500U with Radeon Graphics + CPU family: 23 + Model: 104 + Thread(s) per core: 1 + Core(s) per socket: 3 + Socket(s): 1 + Stepping: 1 + BogoMIPS: 4191.97 + Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pg + e mca cmov pat pse36 clflush mmx fxsr sse sse2 ht s + yscall nx mmxext fxsr_opt rdtscp lm constant_tsc re + p_good nopl nonstop_tsc cpuid extd_apicid tsc_known + _freq pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 mo + vbe popcnt aes xsave avx f16c rdrand hypervisor lah + f_lm cmp_legacy cr8_legacy abm sse4a misalignsse 3d + nowprefetch ssbd vmmcall fsgsbase bmi1 avx2 bmi2 rd + seed adx clflushopt sha_ni arat + Virtualization features: + Hypervisor vendor: KVM + Virtualization type: full + Caches (sum of all): + L1d: 96 KiB (3 instances) + L1i: 96 KiB (3 instances) + L2: 1.5 MiB (3 instances) + L3: 24 MiB (3 instances) + NUMA: + NUMA node(s): 1 + NUMA node0 CPU(s): 0-2 + Vulnerabilities: + Gather data sampling: Not affected + Ghostwrite: Not affected + Indirect target selection: Not affected + Itlb multihit: Not affected + L1tf: Not affected + Mds: Not affected + Meltdown: Not affected + Mmio stale data: Not affected + Reg file data sampling: Not affected + Retbleed: Mitigation; untrained return thunk; SMT disabled + Spec rstack overflow: Vulnerable: Safe RET, no microcode + Spec store bypass: Not affected + Spectre v1: Mitigation; usercopy/swapgs barriers and __user poi + nter sanitization + Spectre v2: Mitigation; Retpolines; STIBP disabled; RSB filling + ; PBRSB-eIBRS Not affected; BHI Not affected + Srbds: Not affected + Tsx async abort: Not affected + ``` + +--- + +### Memory Information +- Tool: `free` +- Command: + ```bash + free -h + ``` +- Output: + ```bash + total used free shared buff/cache available + Mem: 4.3Gi 1.3Gi 1.5Gi 34Mi 1.8Gi 3.0Gi + Swap: 0B 0B 0B + ``` +--- +### Network Configuration +- Tool: `ip` +- Command: + ```bash + ip addr + ``` +- Output: + ```bash + 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host noprefixroute + valid_lft forever preferred_lft forever + 2: enp0s3: mtu 1500 qdisc fq_codel state UP group default qlen 1000 + link/ether 08:00:27:68:03:8c brd ff:ff:ff:ff:ff:ff + inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute enp0s3 + valid_lft 85724sec preferred_lft 85724sec + inet6 fd17:625c:f037:2:91d0:511f:8ac7:dc7c/64 scope global temporary dynamic + valid_lft 86078sec preferred_lft 14078sec + inet6 fd17:625c:f037:2:a00:27ff:fe68:38c/64 scope global dynamic mngtmpaddr + valid_lft 86078sec preferred_lft 14078sec + inet6 fe80::a00:27ff:fe68:38c/64 scope link + valid_lft forever preferred_lft forever + ``` +--- +### Storage Information +- Tool: `df` +- Command: + ```bash + df -h + ``` +- Output: + ```bash + Filesystem Size Used Avail Use% Mounted on + tmpfs 441M 1.7M 439M 1% /run + /dev/sda2 25G 5.4G 18G 24% / + tmpfs 2.2G 0 2.2G 0% /dev/shm + tmpfs 5.0M 8.0K 5.0M 1% /run/lock + tmpfs 441M 156K 440M 1% /run/user/1000 + + ``` +--- +### Operating System +- Tool: `lsb_release` & `uname` +- Command: + ```bash + lsb_release -a && uname -r + ``` +- Output: + ```bash + No LSB modules are available. + Distributor ID: Ubuntu + Description: Ubuntu 24.04.3 LTS + Release: 24.04 + Codename: noble + ``` + ```bash + 6.14.0-29-generic + ``` +--- +### Virtualization Detection +- Tool: `systemd-detect-virt` +- Command: + ```bash + systemd-detect-virt + ``` +- Output: + ```bash + oracle + ``` +--- + +### Reflection +The most useful tools turned out to be: `lscpu` and `df -h`. +- `lscpu` provided comprehensive information about the processor of the virtual machine in one place +- `df -h` clearly demonstrated the use of disk space in a human-friendly format From a8f7ad81d6f1529fcf97d242c699d20c76c402e2 Mon Sep 17 00:00:00 2001 From: Aleliya Date: Fri, 10 Oct 2025 13:18:08 +0300 Subject: [PATCH 12/16] docs: add lab6 submission --- labs/image-1.png | Bin 0 -> 15026 bytes labs/image-2.png | Bin 0 -> 13271 bytes labs/image.png | Bin 0 -> 49237 bytes labs/submission6.md | 345 ++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 345 insertions(+) create mode 100644 labs/image-1.png create mode 100644 labs/image-2.png create mode 100644 labs/image.png create mode 100644 labs/submission6.md diff --git a/labs/image-1.png b/labs/image-1.png new file mode 100644 index 0000000000000000000000000000000000000000..4b4c708b2ae4cd7192a92cd49def9d80e197deb2 GIT binary patch literal 15026 zcmeHuc~p|y`>&mjr*lq&S*e)=m8Z-(htwP!G&L<6oN~aD%uJIMM-XW^IV+W^WeVk3 zIS@IbB9#K=L~4oyN957p(8ScddJW>-X3F=dN7Kh3{tX{XYBI&+~acpZ&fj zo;z!|_3u4@OG!y>b+EU&ASET;B_;J+{-1w{TNL$#XT%>Hpcm{;NR@XePlzvm_dkB- zxRewQwR!c5wD|h3TlSZrQc~NRB)=Odke64bq|EFbY>qoefo6u_k8{Hj<02~BDfq$V z-(LQ8ceifFtsptMe-b=?i~7qJzsoayq%5&|$Lq4&RU=*DMx5efb(IGO@@-0VpZDB# zK7Fq9>(-CQH>082cMk55{^!nigA*T|3~Cr_R*TbDb>WRq9Y!<1bGzDObp@HZr7Nsl zh!wDq`z^p^W5;p^}oXZ z{MoXvV7=j3+=FfFUnrh1TmQW3>;V|=yA;e`)J)wf+v8b?yFlM~wJLm9WbVz}&i*df zAj!BlqJGu`(9v5lMou?Uo|u+vIlHy&+;|=_*0Jk#b(Ni+qi0y~O&#Etvbcbq`H!r8 z_&HMb`-G*FK>?@^M(`9Lf8@6=RCmV$aYAGn+c?{Ybr#VsP5&mI`LIQVd4Wm8T!J_ zVo!?Z)x-gu^3E?JRlv~_y({U{YA@|m@4%-f@&L)5^A^N9Mx|(n&33yoC_x6xm03r%pjdk9p3}9^=YR5^R zd?}n59j6a?%yN4U`>j5wXoW>YoGR?9It%SKe8y@N021PROH-?>tC@YZAuMJs7?qd~ zf}T)@&Alh#W~m!qP6SOQEHQ#Kcng|6qOCpmZ8w1{hZQ82L26nbSj|58bpEM9BVEZd z*V7{(aS@8Axh0Kj6v;U2BtQ^rE6Y6dMwLk6^6YMt;27sUnk4*}?190-l0g;H%~>VJ z_OUj2pmNl^4ZddQ+yv=VJAX%-Pcv6t_)euAqna;V6W>S*p6?ycX)3buTfL2SFbgvC zG|v+zuDQX};0|1<@wRDb?}_E^XXr#Ee+)}z0fQ2HduQe!HC=1&)O#jpr#kFVRhct|r8w{G3qdCoF&xlM5%m#mxeX_J$D_Z?NU z*m@na?CK176L_`N$DQtmj8Nc77Qcn)t@lk;D>o{^%FZsj^E0HpRt+6>11#HNy-=L& zJF5iL@r{N$I?`hXXF_JeG08ffHK%CTvpRg+9PPME&2h!dOgXJ2+Dk(3u?Ft6bwW!) zVmJiTxHQ1j4-lYTc=CfM_Ys0&K6{xRY^3!;Rih)-5C%xKUqi)ltg$B4FZycKG}!vA z7?z}#l$wkyM%;*N;rJf6S^6!<5-KL(MpAuj3{du?Xl}-z)QUQK(8JR+xo5;0{&j4A zs6KYL5}MxUUlna(l&WzzdZw{RfUBUI*I1ZYm{IIMsA^#(d2|_~uf0!LX+p%q%qxNq z11ZCzJ2K6sS)#MiSHBC{m>~d*e1x35&GMhKh@q*Zp3#6Kumv9(?5nk!3pNYG`z-JC zCXq=qaJJx5h|IJK8VwQwprj;dGR9IRH$D+U*1j7_r9F|T7dw-lF&zKS65 zh`45mvsfk0qM-QPT8WS7buC+^J5W}*$(ny9`f8X(<+YneDS-)D07RJ6lf#X>*%zLr zu4OX>L#EvC>CBt{IjVLl(N~R(!g3v7Sl;KR`Rc+>S~M(Wky!C3c{n|S9bvVVMnqfs z0NG=lh;Q-MboL5|KSV90omK;R#XQ zm1G~z2Va*PP^e=FhFqVsJn2TNXGF((&81ba8Y;#zw7Qj&9-!~?EAJJ_Q_o=al|do_ zkqG|oxJUG8DeyvbEDb(PV66^WFCP!FG69X4M-D4m^FIM2EXGa(R=Z7MOCclu+B+Ofb2`=7?25J4NROi!_1}|B^6bBn{R^O^Kb%|P>D!d3)7g#1D2=?M(6A}SGVtU ziH%|mk?z~V88;?#9jS`j)4e4N`@_%uRQ;Fa3GjhD^#C(R&p=Oc8X%kFMf{}YWFkJV zRbVnrV$GhQIjd{Yq?++s>5784Y{Hp(pH*90yM0oL@m<0^KdvEEF$Xkmoq*> z54;@it2bM7Ht@yjTO#3Y!q}1G9E;*7HL*=+Ofu~FW;c3Em+984C-DlTCAFzuIj#2Y zso1s6qLL>JQ2PGpnbmxhrH8Wl>H)p}5D|qPo1#^=XWyWdF7fNRaI5C zc6MA`Pr62B;mYI$vw$Kz%Q$Aa<3_%79ivNg;r(lA!LA;-*s#I`bV1K#fQXgl$%y29s zJS6s?!f|1G{U+0m_{wWD1ED33d&VBQRuef1S@JcNxzBK*bYECDb}g}_Tod(f*l+Sh z{4QC``-|erZKOvKNZWU7awiNyURJQ$l#IJ&>+EX_`At0M9})+*-**09@tNfA;ajJ1 z3l`D~|D*;!1zE1W;1Nu$=4Mwy)&{AXu6gP#iV3+XkVYmVrk3_M6pt0r?6F54S=HV; zAA;+g{bug1ZKQsGVHSKzUf7S3KW>ql>QG};H*&^52ZWxv0B^74TX=u1tk1uu;zH-C znr{Sq|2Sfsoi3!nLGe!z`jkY;(qRkpu-cUFcq-yvoR>FpB)Sjtl%;}?fr8&1ts zojSee+rp~@ZX{VdK#xB<8hPQ6h?|dEii+VSql!9p0@7eJF?EFbFBe-Y&i^YIn78Y- z>|)_HKGLpLH@RoI=0f00cvV@#L2;Gocp}Dj1B)dbpjfi4g4EMfO-dDK{ODIM<{8A= z$d~(vS4Y?gc6zoD8uy?qUeX7u%A?0KqF~*I^FW`K8x~8;J4vgHi96Ms9n>4l(vD7k z^gY7Q?_m*FxmczNFzApg77*K)vRuIr|veOEC zENA<`%mO#e_IPCrg6YA$jY36xd*G=+m)f3nps)AO+GiPH5p%k^_PjE?YgqOsif7$> zpg;EkDBU&JEkd6ivlq2t39@nPI?{==DKjvfRBr>1?272WwgR90p8>Hm#Sn!I_i zHaOFXClKgLmnIP1f-&bkb|T-GQW=S?mNIXxHI2{qJu{Pn-QyCf|3>hK*K>2@s+5?- zSB*aNjrHfA8qGyXAHG(AdDW!S-91(EqZ(a(x6iU{3j{g2@^G_356^*Z@;qa1r&8-;R?DRJcISwQ)RaAEKG^&5%T*@sZu9!^db(#~M5Kf7b{G88A? zxp&Up{cEK6Yq-2F7O+4Oe6gViK%g;+VrQ({w>vXKzP8XsWNdyRWblxPcSY}n)ofn zFJL+Yb6(OUh$9#jm?#@udj1=^GORs8tefz=4a8r(v$~Acw9v3G%oyJ)j#WD;a{2zE zV$3CSgJjrr&r!Qo?M-o9#7BcUE(=z+QYu381S~r-_`nZs%jtPA z`r=vQ55dco+b0oBQc^FmUGr_d9W5JDM|4vfGc#}EZVIaV8WHeHabbeP?ZgU5-bB*z z_CwbR`aqW=tIf_otngN2cEHz!&V0@9DJ zNB=v}Nqhh1f`rETiQ@bU=w;;hgJ-gL?NoP4AkU}jm%n(yFRt2=tCHK~ zSbaS(Pz$imAP!sn8+OWO&)CBEi%OCB9f;NCdHwK~$EI`dHs)P;_1I2Ob5pR?SLYWP z)L&O+vF^gdmEs}Iaq5_s4jW)+%s{2WE?Gom!8rzJ&_5rK$N%hQ^lw<)&}dOn)GS^{ zj6plq&!(K*hE`2YO&xhS#G8gvZ7+61TGu!Ewk7S{aMPQ3szG&h*L?u+I81g+cher+Tp=%EGs5lprT8qDBK~hUu z6U0a>Y0XZz?oCviQio|pj4NW3YSg<2-XA4^A=PKSHPD`|(rLY>pddF0Pd4iC)24_K z#KIxp^MWZh^_IhhV?aT`p{#re`E(UJ15!Svm zGuT>&7U!0;*Y!%Y(N07Uf+wfddGQciS9&RIO4stBrEx0EfjUF|J_%pXl*AW7^6mum9 z*F`?pq$0oFbYHU8_S>E0r*%i>o~kR**CiA}HHv6ZI*#(#vq?SG>y?R` z@WG_N<=kz4zW0sAj_xg-_v3puEk-Rx14|j7A#}EycMu2Rlb~ijpIgiPzTp0L^5T4v z7F#p&5t#V_36e*Kx#R1b5c8i*d}J9~yhmW`xs2MiyNW$!jbqFdAX&yb;sU-q9M?(o z;JshYqGAAsC4zu2EdXqe=aBXOa`qY>M4fsBXXhr-R+$5#*vaupfwydkEtfX5i1p?R zj!2gNZVmkLBur;+HZAN$Tj#AYnONuGtsU>Xi%5YWE_`J8BaFdB?c(Kgb7xw>DA7SP zbHQ3CtaG!B4!Qn|Vc?P|!PWDheQ0@~W3=O-_mfI%pcU6SXwVf&cLIc;fXUVn zX@;6KUykC?J@^X!$dFnjw@;lNi|`70pTay!1K>)jtbEVua;2{1afC+B^#`6|PV)qSEX`xehf|*$**EM0)&Q=}2S-Fa0 zfvmoIdL*KEX?59Yh~?(hj?0C_@8fG&=~K4Wi=EwnFU|7qJ=C?z{*Lh!AvS$ae8%E~ zWG$aYzkj>TQIur}PS1SEQDXX7_iN>;$LIRkaQ?9@rfBje@wPoQ_lnuhg=5Gr0qsMi z%S^Nudw6BoXF{$seUeo!Y7Uql77d zOax@|Ua1p?qegsSXO{6(M!?#^h17P zJ*&g#RL(qknB@u^+%Dq3sA+ySOb-{77{&Vyf&I3#?Q(h6p}qP&JkU@%37=?q&8K_O@wmwgvXwZ_HeO!;xbW1DSmkP=*-4k z6vz&D7rs~3duJf?$#QO1rXaikrvrg4!dV@7pF}_`&zz)Fc7p*X!DXC0B%tq89^6Fo{9W(PA+8)VQmg;$Z{q8nZ8H?bclMbfceFEn{C4I zKa%gY3PsIK65!@5EWeMUt2y(ndd&dh%0=933&{ftDUMOlKFfXuU%q?F_>n67Le22n zjPFu3PhU^tO|d6!{)jhG0U2^WI%4_Elfy6Qldr^NA+!XW4m88LUqYX%in-SRcHw%~ zv&MxCD}_C0P!6awR59WK9UVpNquUKproLm#nIKo;czG_^ZJYW2v}xlLewSyH&AYE> zS!Tf5E?O*jC$%rjRHJ-(Oooh`cVC5l6>XQ8Cbgv1w5Kb5SRdh5QcQUyf{lOESL#gX zuQXP$6so2aB<`%!Z5i+s{{#&-66jM?YRL); z6&=>_p)pC}6Q$|v4UJ)n!4qCEC$rdghPMm)6b2`|RS@jOtNU)`S*a^|{^>n11B zCDdfaxey!WOK7T)^n-<Y%dwO&v1VrGi^%VLl$2PvHy)&XcS!eTHYbjBqQ%cOl4NH##V!pAXlpI~m ze?%meBKLon7cOGYYw7M9pwlm?u1D@}&wsu&suf@mC&P>(X#&ygzYFjBxyRYsXu&6pp2@+MHz$UPM*6rpVh4qEG{p& z&%MtW`Jr-~j@tt^9wf~0-4U%HOs`y^tyR)M$~9QL?x<1346UcyEE8RS=;{yk`Rzaf zO4hK0U^NSwP3h?9=v(a$1P{L$NvzBEC1G-QWUZFc*9*<%zCS16xkc{t=u08JG`<&l zox|V0vbTVJX27^Pbu4jRyGp4A+}?+<)qd%m_cnQOo>ra$9f_0m>M2AG>a9 z7G(s23~$S6Se)e9#f4{*ld5z^)C>l) znZro0UBy&%Bg@dG2mmNXax&csg|M|3h4Yg;vrh5jZuELXS34-Zc<%BxG)PvV9j&;z z@seI1Hq9|@W`$nPNan{){eYZ4g{_ARsL3N!L;wwaw2aR7BY&txfc-6^CQ2te8fw4c zx${Dz)r%=F2&7)O*Cdj>)jvx>@luvC#-g4vyc?GS^^)0G$Z&LHeP$0XXt?c3?1#MC z$?76gQD(chAqg3CsSS4BPg|JoM&YP+pp*c50PD+2%wa8H;wK6k;K=qM7#^$%O4!sG z;gAzP{oQn=1)k3c|2pvj11+Lx06?l*fNVKO)$6)eZi@sOImbskg;ngDXCQbK_1q1G z37@#v*|74ycD8ci7}1rS_tc;CwrXT{c270?$3X+*$k$HY^lNRY$q@WL`QE?@C1bnp zf>86P25O_RzR_MwZ$pXo6puW-0G#e%$ZUX)xtLs|RGH``;tgTe&tC`FYG;SXc!g2o zd?R~(7|Jw4*;JF0dAI}pmTl6qi&Ai+G_iiK>lR=Br%6=qj$-lihT7h^r-#r(hSQCD)u1<40+K`!{A_7-zUqA72|J;o{ed3-pI(^lcTl2-F%r-Dx(lq8t0 zp`sK=B8-N1`xC~8f|%U8ou@*@ZcKtLAC#7wWc55QfPS*_qt zS&@z1af7bSld7!qMWhD3vILT_hV#Ve05sHo3w!-ISn7?Q5{Gokzd`iY-OK;|G69M7 z=6GQV`&@_5L!=`wY6~V?LhCC>$nHxk2_&SI^<+bs(NI`tnjGW4B9!&GsdXm1$)7Yo za_w970bI=O{Bzd`SAyHFYe(ML=CggXASLUPN|p$LrLJ|unZuzKbIGl&WfLz|o|X5k zdMecS)7YpBb%-%#zDKc1C|t*o>DE6~y7EJUwP!7j|5@o-sC@x1MXZjx$FiC3tFxiR zXPHzzl-!W(O-OA(G~FQJN)9h>;h4;n?+T;rP>o~!S(H^^t$!OGpI7(BEV#Bzv^jWo zpy0`3T%*<`9JwUk&~&n!w_I_Xg_SNIJeEBhpy1`j)7u-zxQ;-sqn;q{eLUxNKRXA2 zxX6!l=NIOdRMCbiwT->%Ov~XSrddfFBxQv0(mNV@lJ12VP9b{jhQhIb1C2{l9;%`o2kJGBZl&nyUY(S zDyDqGIMre|vt&z%b=t0&m=G^c(n6G;j_2g><8EF`sIZ7rW97jjHq%UNEPi0xJ(N<_ zN%h$n7Eo_eo^7agR>b^>ol_P3%#6P3XZtLD$pXEk#g>^_*VU%C?rVi&Y?RTX>qFta z_40O%=~xJTu3ZV-e`LzHV|5YUJ~kX6WQF(IhbQ2`Qw0SAk(e^f$XOU8?gd@x zFEINjIM+|d+M^uwMbs&8`%2j8#$@o?FwoBozC6ELq z;*ryVul?JS@xpc+>#(!h_(&)n%58{s>!ZAu!@Yf?W_^M@@H0EJ`tLmeg%8|y?<+0< zCf!$P)2WHf4tvjZ_bRTVB1Nlp`mynDxjPU(I=(~ddWlL<8aw8CKn`+b<4DKsrJ8C; z5Sn{O+H&j#qk3;z-CF^xh?L_9L2*$-%A1oF=Lu!WTs8bZh+RKjg?Nt^hrrHcy_xW% zEm_{m$v~}|`oNq)9xh#;@}VYUP#BP-u-V#KuL_$W?XR2Kb8{p(@=Oo3xGZJSI-BtO zxbBggUOvG+V!Q*)nA7}*jyU?-vRy{wF$y#+2w;+9US@F)db+J#sV}}GP7e)G80zn; zGEDjpSYDPn32UB?>_E*%$Mn`K*yPGG?+>GLId`P>P2hJrbfMOD1!J0X*%$UoR%>d?tqIA5ria3iWY!;VW6R#oaIet-nDQ2%_5qy1_7R`9z>Ui7wJ3O@oS@ zlAn%Tt2;OG2-T}tc>&@Qg*=<%8R^_QsfEJEZtC$74Q7!lORzIX^JAat$Es!joL(ffKTubAWNGxPwKTNd+Qci zt-P)E7pjFcN%y#|_PFTta$CXSN702NFGfPv`rSx%zK~OG^?dXO!stdMG^Q;F>Ofye zE-HWC=ohX{oO|ScDJNGh*{wV!8J-#*5b)Y+v{iESUA9ct!M&h;Eo6fO>gybdO-s>dob>7ZF|ko0BLVE917pwA&NZX&Jiel*urF=A*B7 z*0jNM@@9^F1+d<<9C;a9D&ns`d8nk&Z7QzD!iU!zBOThF>T8W65s09*`EY$Uu9fw8 zBIBjArhfENo_l}Pi8dmCDQXVS4G|PV`7*5mq?K0PGS3LZRhyU~C`(JtSD=&WK#jm{hul_mb x7e4&LhhO;c3m<;rg9Ha2{C^?sKVuU_0D0r^J0*{4M_OIm9GvbTnr z9{_Nr^PeA0msg2B03hzJsru9?(0U7ZIdqf&qwMNm;hO&z`Q;J4)>VO*Tb?Ro=k8gZ zn_#;|?Nsc1FZhCvsk6u*zvazYJLvJmzn;DhX^T8-$2HNIWZ9}cYk55;>|gKkmEqd< z1=(v$-O6!ul*8lx?Q|W-@MN91%+QP01H`V=ievJlKXx}=h|;jo9A2^=Kz53mx{-{U$|rjT&XXv`7N=+0+1UW z{VQ*(n`YYn$mt#+K}O+9kxS%>X0UNl_v=pvJJsSgGn?WT!ShN(fKIl1vw&sD3n zH#A8_D194VfPbVlvdp&HG%x3pReh4ONO2kob=HO>)IwzY&+<5OAh!U9mi3V?Cr&5Y zCkbZ{?zEWhP0TzHQrFY!?JrSFqJ%7^%)Gy88hTWhSS$R(AsgePSqw1Lm}wtv zJbFYr=ah#MU=3S|zrX_rBt5>NSB--U54*X3b(lB_nhbEp z-%GayC`%VQK*C0uc?BNHr37#8C+N}?zCC)2AhvF+?B=$i!AHj0D-j%jCog_q<1?}t zsok)zLOr%@2Nb^53t8Hbf#2ywo9T|lW-&|o%V1ni{)Agq=v5194-Y?Ex)gl{+p~cV z=*tcvYJot`Tw9+$G2RIoy4`rnKr43oTO0Vx4%$5OIUeXA=&Liau8wq8($uaOnITHG1V~Fu zPwxw1i~@MQ`@!#TsB3P`f*h6T;jhA3XIh(s4+zIJU$|ixNBk~oo3{yn=1;w9 zY!@pLaRV*!U_qV)ar|{C*J2yAGx+lOSR^lnS+O+r*RN#X*+yC4`4ag?+r=PEcw2aQ z>}c2?qNYYdn{q~WSp49(wC&ZZ8O01t_NM2GxzaTED&iwvLtk6SCYUU_va6kLGcO-- z6J7++8Fvxwm!~j_w^~o5s@7WcaqpcoStn59SFFFdJ3A*_L*6jYdQO(_Iy`v&sP2=+ytJUH5C4^(kk2W^O$Q?8Lqnh zoT0d0$fCaYwRlu_Px4T`{5Yg(>t_r-RQFZRt8@@x6>=F_5V3-T;u@VfJhUZ*I20^x zM5e7L@fR>{t)5Mm@{XS*q@?8Fd2Q3=kf4{-+JD>NRJ7 z=0UIz=OW0S=^XsxOPlkZi@hS@LwrnQ!-j<7dg277NH$+wEWl6@-6+x#PB|fSqCB$-fGt9>=-8iQ40>B8 zK5>4O0p1pN%mdY(8@!)Cy!9t&_dTl?)iiR}Ls1@UtY@cwzDw`=mZlIO`vY3mi8qop zx{*k_v0KGfE=|p~haOIp++lvGkjKHJ@__got>li=O1!zxGI_k~FL*5k^sxMddG6li zCfD9Eg^09~C4Fl4uBo=-gecfP*!q67@p(XQ{@`bffsD|}x(UocuGTvyMS)btcst?G zfJoyFs!!c$_fO$iu50=BGl-G7cs}2#9^6KVz>6oL5Qrf@vi!KO_u_(`AZU4#uMSv39?p;TGP zjD0yQaOkr*Yz&(Xb!v&~SelFY0wJr}{pyCz9Ys|OrCm&`=UC|*q3-)c!9bY*R@V5I z9IoEp$4zF;H8{*;yRBtlvM7EX7<;Q06EY0|11D#i_6^Bn0Ap%GX=t0btJY(%Is4q`#6x&?xX|1Y-tahjTL^M*JH)oJ z%#!REWQW~`k@u8B5>It^31axaPsAR1rJRmQf|jy6dXh2`(2VuTRI5mM@M3;+j=H2v zhic;ju`QWWf9B$3rjk#m!4z@N>&&Z-DCx8}BX;;`(u9NlLuJ|Vaa)sLKKXDHxAEI; z^>ng;!Y|U&FlI)SCoh8ZOu^eNl-zxpzs-XN<|ntq!>NHVS4%?_OtqR6gVJa1hKs5@ zswFTpyMmE%o$WKD|pb8Mp$&HfVcPwC?qezi!-u&&kn<-D0Y@u08oI-S5GaRT-FX2#Yw=Ajywmnxim7 zK|xz}NC8yCR|qFlKU)&PG7)^LT)H!r63hcP_ch<0_8>N8VrseOn+)D7t~c*Hc>Sy> z=_%Nkvo|`raX3+Av~*t7sN*eyp1HW_ogrj5gF!9&jg}u!-es&=Zwkw&prCs~*bouf znpkrmnND`~3S~l^L~BnMyE-8%^EejVw*}0Z+KxE4y~+cy!~Lou;Ug#uQZnaXG-p0Mxj=64c(lS6lhcQHhK)1TA* zC20$5@ARqW({-dC8U&AT+FX&gsH;H+W3Nr% ziz%OiJ5^l>rv@Qpj`|tF`hJ*DbwxHlC8ac+EVfkM60)R}E8zFGOwlAhziV9>73LTi z%_HBn({n9HA~ZTj}~mbYXuhE)Ol!OtovRxiLg= z^fC-uUk9K#_-!9BeX+hermla~q{}YV_;{_Y!e@Cvfh3q|=3nl| zxNV9f1dL_tArM%-(G3EgR)MM_(}!6_>z)#0T*!u`0kMYP2Kdq?+hki_ZtY1YQ09Hx z6_1PTvp(99<*ng3x(p3%HT}@wLaWDwRXLng?YBXzgM_ zcGu{#U$c60(7--%d|I@-C5?6@91TuiPHA5f-^EV)xwUPfA*= z6Dop)gD!T)yTXRYSXP$1=jMEq894(SH=Y2#Ums}M8_C)0#jC4$X_Pbo<TgJM4i?x=m2z7)Cak1Oxi-Ci3k@DB-Xm!s^EUd1ZAurhnnqUpwwl#I^*d`_&E8 z&8J&vHXU%_clp4hZ_Q_O=*99DQcmuX7EtkXi}NQ-#a87gnCz&T`eWLw+SJ(yU<3~w z4$#56h=Mb@>0<2ks@}gqwqgVlty1TM# z7{X`OJf+<4nvZD*vy;Nq=IQCUZvJ4^QIh2w?{S3kH6AnvpT!kA5W`jk0UGQH^B4#Q zQL1HZUNfLVtN7aJD)g(H>)PBW0zgfLPho6)#DvZy^j;cn36ciCRlw&>sGhBNd z_Pe^0p>O^{sIkbx0Oi%$L%?8h6DY*aX5(6_E^L8{a0?TJt<=hGlO?eCv;%8fufHY8 z6OaEs{m2Kn?p*z~rmQ031+l7tn6=F`>(gBbFw{+Nn+4`qE@#w?UWCo=we%|H-ZP2k z^g0?-I#=_A);8u~Ky}WH-&!suIjRRwH#+ETkiP&>=8th}D2ZE@DPA*wCd$Qq<0{%$ zp?1Jsa&n%iT3vG?TkdYLL>d)y2O!^_16+d#QFa^LLgl`ugZjwWo~(H+cHH4PFRl0b zs*mWFHk*cI#<|y;Iga`PGPD4HT`laJ!@^!hz%{itiQKj%fW>KgSq)6`aU0IP3PnqIBbT5D^KTs-u{0$w-fc$Z=YO9?bw z!hF|tU{V%FbLTal=*f_O19)=`gXsYr;!P&4);}OSrxK*E7+MbH(vkUHe^YsZi5Y=T zO`7kBUnRDs@O+m{7mNpa*x%AfOPwa?YfggeMI%`j`Vt{^v|^k%AjkC;-AIi)@S&^B zCTG?|?ofLtD&_hDRigzJD~#^A^QKU_7ocajV!ntNKs|6*^Z%h_npifSk>~^HuZyV? zrJGb9mk_Ea3Mt)=7Q@`5-ad)Du2ZYaM`acOz^e9|-ayFIKhu1Pm;D!^TXl00ijFsP zIe(}7-tr|n{qB#+yo-xH$-|?g5BvLtUYVtd(*RzBOtK(?&QAgrPqOHS?9}7?cBANA zTwHvx=K!xqG_!8XKYeoJ_p?Yk51|7!|bO*gyXe;CaW)htP^LG_IKiKWI&UeJKR&ce;$jLSvwzs@F-mdE{GqCRz5u|-TXk%%zYGtWkA;cW( zW(pZk_X-&2nclsvu-I}x|JBg&P=r~Fxo7k7E#4H@+hbQtM?UO7m)U3~xBSE?!ekdd ziO)0&AC(v_+w40Wx9dS=djcwsszTS|3=ux*Znv2iW;&#W&UhP|ASjm+UiL&AD8SdUyPUmL zjJ)Tg^&E*jdx&aoP`h_J@9PwN^3g`7Z?1Vm&nXXCr018nq~E2oRUQWh0JtizvFUKD ztc6j$)5Y`nYffety{X4o3%M@&As9^5I*$-`8@U`dI`>|$=j)cX-O#t&eV?W0)>ATE zcSf(St7{ujUbdfe;>4L~>jTBSZR>#1fdK;=c)q+wI|;K^BZ z>299BD;MDhn~sf_INL^?-c*tQ$_5I^180-(bg>=d%fT0rT*q1!rPJI=In?tLdiiou zvDRZk#%;a1nfC%{D(dtC9+9nH)D{K;G4=bJ3dEsDUVr%0cy-Wz%1P7Oz zZB?=&f7oADkA_ptae0GaeN1H+R!U?6yyZ%TNYgk>yCQ76c>@C}yMNms|Eh3a0_dik zM;ylO&a)dU<|U`5ksMxpu4KfHRF&e~J|J>E}dXM5FoHvL&=~Y-2CdEv+{epVYKk z$7|ouBulhBkjgwcAG9{xhkI|ZQoL<6Crlw$n4C@bRv+FHn{($)CL z1#jq!tNN3Tv9oD$f(20`nSWM&RWf(Vlbk_d4wKU!{c5Ni?8IlgShR`et{Ybz8$?HB`m*3Bj#zw!|=H~gU%>YyPHY3A@J_H-}om>j@q_&@73pQ z*WY#b>@Be3udg5!2ln6kp}E%ggP(P=PX-7gQX_13vn<2B?5|!CIuA$?Y_U$|RMbOY zLGrT*)am3z>_To$p^+?4QP>TwRH?*Oe)8~D>nt4as~Qmk-QeLp^fRCeA}((uVzyyo z-cwigF}P8>ER9qDX3*|sR6zpAPWV+8t+B@H9D~vW*)6S?TORvccAJRs0V|f++&P9M zsqLVfs9G55;|GJ%P4c+BsF_XSDVjuVw(y9aLA>|qO1gW@E=`RZgXzHv8Lqbp9f-6X zR|}1;oA(ArO{jR3w*pZlB~gKh8g313>1CjJ;V&cOwqA<^+Q_6;y)RpFrW`qCw#I|C-8LVd-JO(+S+=I%; z&HQr@{~Bgebe!)10HBA3`=CG>0$q?kghD1!QacHR=kE;RP=7dI;@fd~IoEy#HrJ~YyKf(F9^vwC5oc_wJ8LjQg@#|98_OJ=It=bIQTsDw#bbbtYegE1uoiW4>JzWO4mQ8e8xGSHt z6Et8Ls1l^2&9g!1VjFFx#xo$RZpbVW^NWXRWed1*GSObs*l3nz$4KO4E`Imq-ipmb zjx_b{)5K{#g7gbmVsKftpL&*e9{Z;VF3?=K(HSv|Q~bt`9r>(9*vJcf%g;Z*~3mg@_v<5TvKd9 zDXQnO$IiYl<@HsMb4OOhf7@U3@EF@%iA!PVDE+;#-{kIsRcp(ZlRL!F2fcV@wBNT> zb&y^^olgu4l0JLu3IJStkl${k7B$k^F?npi7G zC1Zzr+)PT_BJJ4*=OQ)@II7lEKeZo@NwW%iPsOZnJ#RrPBX)=dO?vfIwPsPQ5e=q? zoAJ}{NQ+&d!(Q%sLFX;y!kWV-(7C434H^4r`TCeBZmT(M{Sz2UJM9`J6Y9A7z&^ z>|yOxY^tLDeuS&cE+gP0@Q2}|Op!;YR8U8h7ySy;(4uf1JA=e4K_d=V*Qvg(=;#=Q zI2Tgx{!pjlg3wZ2fTd!+-_JzVI&x%!o)Nc|{s`Bm z!(c*AOq|QY5WP;9KuEZJjmKKo#nS<1s$}wxRFO=W3vk4=-ra+m&eV^;>ys{r9WyA^ zy|li*KEp%Bl=PR1G)lxVxBp_)kSL039ETEKm>}%oHa!tpsZ9e=-lKv$19Mk7`)*q( z-_(7eGSQLUK!}fg^!@2&x=1`5bqaoGyO_cf9Hla6(>9~zzDiX0;CH7PIDY6K2&At` zMH+~YwlRgy?(QjMPR<<;#oiGSaS%pkf$@%n^B43ZMY)Hg#d-Jg4;26azBsDn(6#>a z7nx%mAg75V)0tQ9W(ZAEF{ABkiZVGk`-MX8m0T1D0sv56=gxS5kkGj&?_biHG@`*~ zBraAX>z{SqH9I>i*nc|&0I+@ZmM=*UNnqxv*!b2@)kKDT^?yaLL&XPpgDD?G{+oH& zzwzwL3rr|EyIqMVtexJ}hj7&TaNTUGQ9&@XDv*Z0{I7@=zKPH&P_t1HGPxF8Xalam^c z@o7@EsEQOb?ykNh818c&qTufuH3ZI@@wq{p_CNa9ST5TSB>F;kM-7Aol%(~H@etM! zE`bD*pYiFvfA2!o3L72r2dWe#@0KL?#z3k99e-fjaaBaOg@?e1R`;XtR@kl@)xeoZ zg-g@as#>CF-IM+#XRDPz{UME{8Qmo3oXB6Q>SPuu)kgI%SvS( zLOA?s3Z-#1Y0&hXxJlRJm*ok^bEXkm^&HE-;dpbo&pzbm+uJsE^bSke_*cVYy;IrC(-bfbAR#MhR6vRAr}VAH zeHN*TWF~doG00%N)~(RBQ=YGzUg)B*)nkVc9XR+P&CuG#H>>LB^|$K zCgY1>!(E&_lyAn<%zx|JByLgo(TlN2HL-|nH1&+qYZ;2xQW9*8xXyHs`Rz&DxJi%^ z=C@=O^8ToCCI0g@J~q6k#swztk)pm65P#~p_A!>X=j&W!Y}DfhXy#EkF4(E@_wmYN z-EP^Og!&^KdYa0#xFmUmGPG<<7$Hv63|dw&U~KM?ft*i{4^4&Bra>?$S0|$Pdm+c; zG+A-n@g?vfDkbJ&YL@HcezYeU0e*G`AS1*hk};0`7;*MHvDp%O3un@%Ld8D$H3;Kz zR(3Wm4l~10l~0fO+sCQ`s)2dRwfX}Os6a{YjwVAXP3!wfHKHfiBif9YZI(HJ7LRak+$Zs&pq9-* znZJ^Z9K0a>Bo}x}k=UOqc2<>o%{pj$k_$hNx^L;dO=sqd3+#bhT!hj=+T7#HW{m}& z79V&!kNQPMSPFsm9`*Rn88lfJbp_!)Td*M}y$#>&)b;ZHXyHVto5PFwh5#k(YKL0Y z{c#`Wv_7ljMlq)Xo5j*3HP%`seH*6u6tJk~D+0{Ctupyd)7#oAQf6wEM#LO<=d52y zFJ^22Yd*=b;mAmIsybya;DHk9<_yds+p7Ux+9XTTfD^Lli;;(gkhY_Kq7Szp5Aal0 z1xVUv1iZF(gp9P_JeCuU7)@z=m4{YukaNR*S`CBH&$QrhyyjNN&jgf4a9&gV$f|bh z$!`PZ;^KoRrysTJr_~RKCTzD(UOwFjpC8#=@sFlM`uUe3-tlzYLK6cO==T}|+8m%B&KU(S&KFj8Y zUDz*cHXSIpcF<*#81Z0BO@Z;97+Ay`m)B@6lm~yb!=tSQ0Y_g&! z*>llJsw=Dh{)yFGu*H$0kB(yAKo-;f%v{i$+Aqz+uFf?kQxu$$qV>#)>_O2-fz7S_ zV(Lj0)x2B;VV^o@g60#Q=HJ(qO9LM#?+lvSmov<5cgrDVHf3muoVqq4T4kr-$jzFO zW=r&x!BWulz@Tj^ZtB)=-&S;=)i$D9Tp1|j<#V=y*E;N|tRfi(&l*%`!vrf2`8@2D;!A+B?M)6 zD0!JBN%Nm5#l(0j!3#+|!w!s&nWYY~B^4RIZ{27YD3(rjhl%&6W5VZ(X#* zBy7uT!7Om>Ary1{IJ(+AP3Z>ZvvgmcxyS;iP`ZQ3)O|h!K><#B=1?=kKm<^6iG3O_ zR5iJ&w7O7X{s7o9O?J>rafrV$IUS&RxLpt80oJ|miu+O~f`Q`a@3l&;j9)X8?~Ma` z5e-9nA2ws(G&&fPJD&0Vu8dE-lkk_6epJ)L*h`c?Df;YO1$LkPg9!@gdq9E?j-Sb? z`;zghU@LA(yt_Vl8kJ8*TZwG6IYw0Acv8iOoj#3Ety_msvuj71fh)yjId^;RB#OM3 z7EVdB*-FadPBT($RDSe}Ut`AdLEoIuiq)I;A-MF52${U8!S^8@tbNVw)6c>EjpatY zo=ie35lEdh-2g}U2}fQ@qhF&=F9&a|RQ=D!?@SC1PY<*=-?}2=nk)>;-H%S3dj!m> zOj532FaeFvq(;iO)P<=@->7X<87^sFoer9M8z#yXX0y{`H}zrWw%zHY=lF?pq>bnA zo&;%z{iE<2!8VKPc*GN$r6os4HTp@ZRgkccg3bBLzI15duWxqR_8$$K>(s&7za$zp z=%-t*lqaElti6`>=`A9SW*w5hQeF#ih}1ZjEZ!U|3r2hGL!YyM%%R{(UsyexM|~- ztI9N#?GkbMq(>Ox=8nE@norh!+)!_sHqo}QIm4&ffDKPuoU`I5&7cz{H~E+(k+LNo z9bMXW;Ve@*rESdAjK8>G#!0$je|Satg}MS4D^p%r93uxClH+M%s99a(kNWjS@W>T2 z#V7hjM>X)Rm@;;(R;EqY7tz{*--$D)=)$kXvJ;6phjP|nFrWFeLp|_j-OrInkkiQ* z7opu+Oognv=}Xyr_PcR%eCQ!unqa%@{SP5AuWhLI8Y zW_5A!ZY{^BuV2nD&WY;{W3nE`N=>zW`0mbEJ}KPy=m!aokiGz4pI=MLRxo!|sGGLt zPjHARNgHPOJI($^r9!q*v?HN+w#5%Hcn{zdK~KN#`#Xm!+!dx+-UfltvA%UL6yD7C z_wU5Xw$ik)cvk4lsO_{>m3uaD&cm@4i*P&?aKKx>E2FLY6LotRA4w2%TQtZ#8?ZKW zdy}$h%KNhu_tW0n^JTWsLhB2BxZ`;-QX{=t=;g#4fI%oDLs4VW1{UQ6LbwlFL=fTg z*BvI~+BPl>VnRk9_3Xj$RauSZ;}{J`7a;&(i26t~v0eVQ zIuCaH9%dl@D}vz};kc^RWXd{fQbPUt9Ovv?QLgK4R=4Osv$T|}l){TF)QZNc_NvUP z6y>kRJx-GZv%Q;se)*CK>8ZYYio|A%-qUv7K6{5B-WG8$VjXbxr-l&*;}K!OKSI*E zt5MpXA(+yOMSWjCWIw!tGteO@0KN>|xuv7F=V{3m&J8i9fbxI4K%rSuVCGxBUvp@; zwoOO1OF1ncEhX}N&~q+JgotzN%ka4derceU?ykyHtJ@ysY6h1=1>@FLK?Z{@qSXtz zYgJQBprRHm4osR5Y;@C3V&@u7?`zIJ#s4zm;>k|ed}HIXHpEorSpb|XwO)^JsQ$Ru zZk`EodQUQk_BC~Voo2yuEN0UIzHCE)8OG%HHWA-4f)D!>{j{0&^x$;|G9*ZB>C6}5 z8~KXLb);q#^?s4Pn^QtjBWD9v>Dj!p?F6wEj4x@ErAA>jh6sJq+hi9Y-6h5ZMw;M& zeb5pvkA)`p3iO|h$NQcigcJMv4n=6J4nL9Cv)@*c=J^b3DwXM5?tjw>M%i_9`}+gH#&QfV#45PJb>e_Yd@qz~qbg&O^+NJEuZ4&354MBSDaED82)@w1Dv^=O=t3~KEL&t^2A!Da(y+6<&d zr}V!m@q!0_r?1WJhk!P*SFOoZ@8DJ41aCK&RuK#f9+j|zwbVwh_m)l4f zNzEEwf_1*3xyk!DEBqDM1nAY|i-91$c4mQsh>9#pvLvSp}J@tCP= zKXFojIjs?>8mM%tK+K~LuNuHL0t3uq{Z8Wr%+$uSO6v}h^UCmALSm3{c+o(s-HI7} zn;J2E?P1`%$IT!3R-z!|{M*%kq^-K-DeWL?K1;$fNvnJdqAr^r{m4N5N|<>x1pE^-|2lo3FNN zaJ0$03$0i)=?XWJEIWHyuX=2mU>Ip z2hAk?W8mtgwOlm5qZdjHw-|7`i~|9)!tKW6kFGy4D5i~tWP aoUB1!OfixHRn*`K&{We?t$1ep_P+p(d_g(@ literal 0 HcmV?d00001 diff --git a/labs/image.png b/labs/image.png new file mode 100644 index 0000000000000000000000000000000000000000..3f9bb38c0e8062774b45b942481c9545898ca11c GIT binary patch literal 49237 zcmeFZcT|(x*Dk7}utgCSk*x^WkPT9l-Xj(esZymzL3-~cKvYz=qM*{GgwQ)gdI?ED zM5Klep@kl50t6D$Pjqj8-}(Ny_ndLh{qtlD24jU)=DTKDb3V^{d1Gv-!^3@^`@n$% zJi7PqnjAR5Nj-3YL-7wz_BTrDW|Hh*2LnuWZXc-VyRgb`9Cpz%&^mCSGX5C-$q{z@ zsPBENfCC3k2mbsyIO8l5df)(RP4}*rS*ZO6gEzu!oL&7m-enma^Y z$&Htnm(QzqL3jFH2>Ctc;`Qs@cFSmJ;l_rilx>4?>{)4(i(h^i9lUtzxn_@q;5cn| zIEL!$YmDoI5bJ+0`~ew8TwblpxFBWkpDMV|F?*>$#_9=21OWv$iH^PrKK5INp_Bx^ zett_^!xr8ff9yW_zQ=ofWwFzgsrI{r^UP9;%tP-RD<}@l%%43nR06aC;Cd`1n)ml} zV4QJVv|+J;+Q+Sjz{j?>Z)fq!T|TQ;&Ie$r5Vw9mN#AufFg6KFO+0k)_0G2r-shV7 z={!4#fccjf#1I8%{y1FYI(OSi=ErD60EdM|az;Sh>%J4KJvuID)FQ3#+_@9w{#&MN z$w^81r4`Me9*bxOvt_d0@Pz;v7_|h_V)b-^46y2MtN?I%##bzWnj62{TFe``7R^hS z`aL|)8AOVt3RF1!X%ta*a;2?im$B=@*VpM19o{-CHgyqeHhycq1w`=h_3g+0-qBnB z!F|a7LU1dX%a+Psvx~~b8Mw13&YBL5JuBrerq$cmN2=GKrimH3Kc3ZK3H@HJ(=Li~ zdWkcd2`8cr1D1~1_mtXo`m@lJ&WfSAGfs_@gXa$N^8Km04%5E~LZbZLF89ZXt1t%K z7`ugpeZu$d&Z7+rm(Y2IB^T&tV-|>V9-{?felZr+TT?N8hQ31OzXif@pYzM_&mXOS> zi>hCAX4$d#|B@r$-g31-p#92_8}Ar}1YlGrGv{6CA*-t*p+;gxnY-BEcDMWjK=r|n z61@J-tbdH9tc{Qd`p*f030{l^kcKK1AHSDCrUiai$qggo#JeSl%VDiICUJx*D$F<%Eq2DURQ<^GP_MZ$2e|)1MX%v-x zD>eiWsudk67R9VEY*q{Z_EiI|*f6Yb#r{h^8VJv-_599ED&0$PTl`5qEP{( zx28<%_Z+Dco4_&{*mV}Q78sCA6{xo4WrDqzCM(j#W*Ciducf#A&XoK)?+hCx6*v{X zzt9Bm$D$P{bNfhTde@Ycin>!i$2uM2Vv#>$kyuHTsdWh&2r5Sf1xr~qKZ4SqRS4laJ@g{AZr z?^EE6TjBX%nd!iaLNud# zHDm;L(|@Q3oH~&f(DwtNbciMmNiG znv04Xrhy@qT5?1HO$aW^42)zpQ~Y1|kS@Vuu&eDZLCd-EW})Vxp{#0A;Rf2aQB)3r z9`B+cqh=!p*uO=9sxAfZs<_!tw_}%)nd+;^6U{7S`f@Ln{>X>9Z%{5RxkFZsrC)?P zf_5S)505aHMFP9NujvbQC)$;Wc1w!%q6eLP82TcC$m}EQQFcWCvpfW!I?QK7N7L%b zhZQShQRYy)Ci&dH$%(CS z0XkqN-qNN&VTJJs7eMt#ETNVu6QW^X8O(^-U8z=@hawUp#`}zxm)$!*wKL({-t^w| zsmD;Bc@6S3Vc$k)9L>a$?fXSGqrUPSLhhu<(4bezXhh`st~^U9&n|xN)ZkB)CE&dwu*beTY{D5E%pYs7+J?a~2OrPi{d_z9Z(`hn=JL z`>It7DQShTMVO6D5@IZ9IXeC+XfD5D;um3K=oX~yPDXm-Uh=36H8#hx=O z4#V0wlEW61Ikz`fO9siTAZhra`S#dp7kn@%C)D@`egjk8MBnMI^}%W~rnAR(q4nN- zfKU4ZvWE4H`*(HSbaLxo0gtyT(A z?3`M_>kL8mp@FKgI|ihHAc1{dVTIVuX#rk|y@{4_Zbk8@rH1N(GbnuS5v(1t8s z6~Ou!jesb;$7Mg%St8^-31TYYkncDm12ldJgj90UJfDt|#;cvuC7V3Dv7Cn%G^l;` z@tV{hKtZXKe}pQPU){)vV8>~n>C6bl4=F!54{Uz=QBdi&c_E4fFJAoY_&e{Awy#ry zLekmCAaj-#Qct5sgO%sK0U{ zGgKMbOa`oMtgAFi7ofHmAk||(d*ncGNX4T+MHGC3IU)%scGvrPRoM=P9hPCv%akAx zc3xgyR3;fkKng4SJ`SanqNt^Fdkh+Roxoxern8_L=(&J&sb%HSSv+8Xp9>x++kHVv zEbGWRtM+UerMVCDXf5?p@3F`Su~A|<_nc70uS8i7h?)UO8N7~NRI`3hVCk#+yER+O zf_tqyz+rwE{Z_OQ{S6$u&vcpe{2n07y=y0-g=~nuIZpmQAkqj^vIRqEs>zU2G$+Tx z!B(Qwh;b@A3*H_3?m?X)PmS5d<9&gA46TtAGbS9hfD$}qMAHc}YJhc0TFVos%YWwq zsg+u4lO6<^edGuv7A=kSiZBH4Vv!o^PjRsFo#mxiR1~>UTgf1z5?hI_r=@mYe5^eL zFla3l0J?Q-2gYpfzKBq~i*s$Id)igHzIolp6E@k)+5j6x?q)NgK*T-NdFx_o8+fgt zmW4Y(b7K;QVgXA8m9UPq)E!;`J$rMs5WOTbv^NHXU57QBv_3X&Y;2@1iUC$DI#P@x z=K1grfNB_PKc2NBT`jy=Js%TF;OHa?t1A?32yzFt%f-8Q%BdyRKCSFSggn5YqRORN z_!Cl;zOlf2ZAyU@7QJ9uiuP`qv4g8wjIU4MbPgjujGRY9KaARo6{2~YAu*<3Jk`ZC z(-!pgKyk=#7omIbeAFh)03V{~O&aTiE%-3Uf$8IqB@39(4=Rm^WaBofojkiIPGC|! z9q!Rmc}SuO?h&J@Ph*B_>;gKdiJj~7-Jf`;-Ehm**U|%gBz+pt^#NWc5kFOm5rP;=WV=o{6$9(Sdb1d)e)oh-995 z%ta_%^M+;?Sx{*z3+$Dg>JU>@Go;;{9O6h=_Yg8#X_JfgzTsnUk<5wyW+p5>z|)P) zLeU3+>u6S`!SjuK)Y+aGY6z;z9>wTpS+kZ}MApj5Osf>Bp6wSem%*{U)Vg)Ts2E2z z06Yi0pgha=$#&GffH$mTW8=uD-WV1gd(1G+Qn0Zm_DT2P2@ItWOfBp}qsNS*cK8rs z%{si`rR#WH^;c3uIshmVvBX;&ioH&y&UJ1rXoNmZtX3LfmMJJSu4XcDK(4fWL^Te zZv1l`&rZ9JTTNxHzJv3&3bom78u?)t?nYjru@g=_EbM1eJ!mhTD1x9Y)FgxPv|_=< z>J5)E08=D{ar+Cum*}w_t6(_Kil|LrjM*tFW%-a%J15tsaYpC(#mDL=Kfhz(?=FiO zR;V0N+$RYFBlUpP1y(tM^{SrU2^r)=v3z!GqoXc&a~}1|>gAlH2Vz+Z@Ld(w!VChN zBzz7N!|-eeYL*#*X!JAU^c7tO4eLH+z!!<;yxdy}j=+WJYyyoKnNf~7EcMO27P52? zxZuW|hf__Elv%l@3C9^$C#2y0cng$vPD}G&gOKas#Cd*@*5t+Fzf)7FpuwlG#EmK~ zH8r|(1QIbGBeKHII@_0f$5xLV3k;vT-F{Ybc(&gva=%qP(p6JL9y-|`<&#aJHy@u) z{Q^?E>tccD??P7I7hzC<>r<0}k*`>ZWXBkn+M91TJbQtuu#KEUkWIC0IWQxntIH}+ zvYKH_P*V+9`MZyiXW1m#p+~?EgHomJpW(;$k^uWvH0DV374)v$6Gt7z8PfNGmvNfN zn%t|3eA}}Lk+sB*e7NmjsHz=c9%4K*B6%{GKt!!o0RITSKdg_jfA$6;CG!U$2VkLY ztYp<9ow^US(x*?m1p=A4YnznrZH>tt@A4rq!(degHF-6lQ!tV`1k)(abp%aB7TEIA zG}bmkwD(TSL%n2a$`eFB@Er-#K5$^maslf>OaJHyCb#U*fD}W?KdjSr8O1<#0RE=H zzK^yxDgOg=n!}!;^{+-hdnw*0!$tGGzo7ft$P83i(AOu*n;#%P%x{9J>{C&bj6pZ8 z2fW&R<$_zIB^gPFKtE0vj@0>N3e^pfMrnkY^MO0NTyO1ZYSid;Lcc&8DxcB8(grh@ zwd_tk%Bc=+Fie<V z&_AA?GR`Y|bu7_o=SlZX9AG-TJw8IWPmR!}LV5nQud`_bV7|tOWjU@+@cUb{tPMSb zm%a7dzmIIp$4#t+?5Dkb`uuARN2DUh_G4)8ONd^d_N5^!=|uEPO~~lrI(em93wbOR z*qsbZl9Wh)w^`-3?kI8aYw;HWU)jFK#d=}EvT6in<77sv>VCa_G^EI8FOX@SMfRBp z+)cSmwbTs;Gf>vo8AS$QuV_~mT`8QRGw8!CT|}JL*ZpgyjjVB>za_(Vbrw9|x7@u*LO-53#c_V6Z)3*-Pd2ZWZMJdq2u+NEFg!>#7 z4o))k#FmgVF}Y+UEpLYA1I`P10jEL~4jkRmq0g`7&Tl z>(EfY`a=V!d)e5EJS&B`l)?PbJH|!E55niL4@Z+4n>IYsmon)63}!RhcF9?tG%`IX z!b+VSB1BZ(goZwo5#~yJn{=J7_~~Nq`TNI7m;*ze1{Xrv`8qFCi*Vw&?HMi2>-M^! zOfO%c7;&xj4&I}x3&KRfDh#!fLdFqeMG*eOl#;#Z^cH4tEWuEt7D7J zdwdM~oI7MyHK**>En@GSz-I?FkoWVxW{@_3^<8>zOe4SSUP@TNL@L4FubtnzIdpr2 zyb>$$is!FPmE2bzsH|!qmRU555!Rj=_Rz{wa)6%Hy?8t``St6mXHYd;mlny`fGHI& zp=!o(ipU7fgB5K^a3j5Vy&XnzMinta(*%gA?iaegFKy7HI+0MnW2nRzkpedCLWS}L zLG*k|29?WDY!cY#AU;^kuVxi($*iu{@iu$Y7ZLa!C`jNfK`tU^*p)n4L1?>X36-we z?*cyyg?u;ows|lm4qegzk|D|)b%)g{bZ8eGFKi!hO+R>}vV!$i#Fd^FH3VT11RrF$ zpZr$=eT6`qpmNkT#z^UvJ7LnqXpj%{Y1L|cf!K)LCObu$sA2Anpeix~jwK~|(RNc= z6s?wS0jbgJ0L{D!RM-PnV3pDHBe7E#)6>7xeKK{ysnz#Uhz(%aLCs02P4&u{G_bVZ zWE|ay;kt$6mb5L~xJOh#Em}b0EW~{rpGVDEh}WzNBrV84U`(r~KyqIls~Q;{Ef8UD z#WeNwg(#)dcYHb7nYm}?GAkWi%no&5G$V?%MKo=3$(XNusO+-tLwMT=OM0jD5;Lol zXTP0Uq(w}Y46a9`))Km?i~MOJ?G83>_AP_cm1J2PPa{o1o!Iyu<&jmqqE}fzA$e*8 zCFu1adqeNic*spo%KSXPmzYIO073M`f}3EpUGt_6qG>-qonhnxg*=u^9bX+{7ms7$ zIn{cXOrf_#-t{$lc_t1?vqSu>*9q#1?+rXqj;QnplF8K1t3Tk>wU2Wu9m@M-T-vWk z=shD;+pi~6S1C3K&lr40#hbXuF9zV^Gi~8($HMpH34`2-e33%z$J77n$N8?&?E?fZ zowyZL#DXA|SqfW=M>4#~46%y+mo!W~Hf{PAu*79Tu9NhYW@c!NBI>QngInnj+pL-p z9aVYI$gQ}uJ-}I?y>axi)Q?eAFR=7_FBxs=quCvtW2FqR0YssU(3#ASnT&|cihe7G zB=tiueV#$>>KB@@*@~eq63&Q|3#zG$KC0F?_9G{c_9w0$V$dOc)}JBelU-d5jlR<; zMlA*)m^$Uc=S(QO?rOtsdG><<=(Y&jE+p$(}aJfZ@mXM zyGBPOOAV#zFoE@g1w3n!3%nv@1WU$q`1k>+-TVO1h6^{8^QyC>Tu4@+V>RBy$ezMw zZjQGFfoo_-z4j4muVc3LGr(x?YA8lNm{y?^vd>0Y=4P`{iucCA_gH&M@vCpJutDgx z!)@VYi!hB{VQI@u_|mcPagoyj!}Ji=R2~dN_J+X+S{tI(L`L<$QLd?y3Sh$hZ`myr zF?MUVZva7_Qu!mORuc!-eE68}w>Agk!8@Z{>(JVohV^buno5YFCQXw`X=$P1*FAOj z^g-7!nPGM085F(!wjFp0<{o8Ox9k!YFy3w|d4X@S8j40q+MuGAYMcC4SxZMKeU`(W zORlZWo_ohLKNw~XLcz}2Cm8FOH$|*-!J(12q5&WsmLtnSC=BQ9#FIJFPrDXU2+j#3 z_PIp`*F}LBv>6>Gz1E~gG=-Kf$~>8_0^VY+FwCJtIm;ZXWM^1a6%MX(1--#y$p>zU z1mX(;W2*pkJ5ZxC-Nb{p+%9??&ehl>(!wpGX^LGwaq{) z3X)T$Oi%1uv2z0+WsFlr!*}^+BhF|6rw=lH$>p1`-9Y5_7~(shdV<%Qzwck~~ zKO`ThG%j-$YHp2vuYRsJ2_o<+f;%_MLl%5y7Nvv#HvFmVND)G(Qe6u6k>VF+<>^~c zKL!WO2JBzB`;9QELTX;Z0)lFp>%d_iu72C#`#k`p-di--B?ap!*X`&Am`q*;Kda&q!hxwCAqM z7+eUg%H_sVf+K(q}m5On##CTz_Oc_Lhij@J~*3)d;(deV?3=kXu?oPh@%fD~_iq zN4ThNOho`dVwCOQ*p9#`5J4@O0kJd~hPuTl(OQ6q*8r}9S*8iztYs#r5?76YLH4il z`e%3}cpz$}1jdTYo+T^r{v8*z`wT`>g?J(41PZ&~BM{gvb1zXthDJZq_5F*GTO4ym z2fq>)TP=|G4$dkZ!Z~zh`hZrQR?9kVJbxqtM-L^S1JY80Ec!5?qvpDR{W429I86mM z-`dE_6|~lk?a#3UXC)-OYj#7gzRi}5tZ`0~o@9KeO18a*n^JMg|Fh9oaU-m50CLEu zWXf&o+GlM1f9K~q9wFyeLT<}-@e=VWqUdM^{bM(8^J6D|3G=)@D z4%!7RC9#>t>o-Hm^#BH!0t<>7<{}!d^I4^=hE!M;uHP=5LQ9){@G&GtN8;$2k(PmU zW1Oc-TKwtm!Q^tDs9w2A!+$ueqA<%0RAz)D#y(7JCUOj%g1io(bm|uRUSSiIsYRC1 zJ@KKfv%ug~miID!1Hy+NNBuU?JpW7K#P|GA5aHYGGbTHv4YT%+9ckLBnu@*L;zGP3 zBp}a<`tm=~e?g>+(I_U@o(=`9~dQGUG^PR8>-CI~ND^E@Quiu-%m#XBGsmVBI>DKz< z2=nahpblFUXVBD7#+zn&l&`a|Z`3Je=`XR9{Wcm&8&ar#2M1*I6l&bU^gd|eKo*kv})?&947k`q<5C~dnCK4w~Sgd zJxtlEyvrW+{lo%=7(x@vsQwRYpXz{H{K?v%tKbu{VL#i#Z$|q+)U_O8r#s~@r9atR zs)!N0$8|$+p!NUb6@rR;$Ig}TU1VQ0aN>v($)FmGoH*eu4;J|?kzcSdvfJOkCbZM( z@cy&IhpE0luRct-Kp|~DuCDi8&}<${8UGvizQw)*0PleUj4&7s{z8P}7lA)cPH}v? z)X(*Mz5_j4M7rgFS_cCDc>Ws(I&k3eiOc`3=YPL;aqB-q9k{`DYK7xJlPqVI<=Xiu zGgbfd%`=r3!jb=JwOmMC`t$$guk5Y3OK(|OS?Q*{jf}c{KwzfQn*VB}AtL{Fd6eu=<+rrI`e|P+`XI0LollyQ z;@u)r(;~LEdlAd^EIxMhD52h}o^SqVEb{fc^3!r} z3~8dYPk|Lu>+V39*4$i^!yB+`L%~_oK)pG$mkJt!-&VMs_Y92@cF~6PcRgHlV>8*QPtsvg7F88s|pTiC@E> zsl5L+?%lDX{qJAc<8%tc=_A|J!2Q{)cRapN3`g|)1TZ|(vbT&|Hv1Altrvsk`g(_y}Zzkk3O*;WlwHkb6yd7{Ku zgUpaf!i03)x zqN>gn2aaiX8cEUoE_Y%|dVX2iOHnbSu(_a;eRs&j%>CU3jA}2wFqPc+Rs2xRd-&S$_Tbs2 z_Y_IwnT-b)Ic}NVUoh(A=fj(=b`=A4WAwbv=1RwgUQru=!s-^^&$!(p+QJTaEgQ-; zBS%xg-Wag|d!Pj5ECBN*fyYpHu%)G zUV0bnHliAm-*=)s1jy=K@Qmq%B(I_#x6tlM=(;{?2wDB~h2qnch{BR`EbHqx&Ui(Y zr0WTrSN2XfIn@s-=vJo=51bdvc#3tCDRs|SU{;*&wXkz8Xn%7}B@Vt%siR096{V>A zbxH@j$K^fjU#-cNPu}W#Dym9pe5crroADuu=zr2gN=~j_&|D}q2rTHvASHCE`&CWf zSI-j>Zz`}q5)e@mKkcqTc_5d4JUp%|lQs`)0g4pbL45X0{oMM{0%H-6JzF_~>6Q_Zrva$_kMJilrA}x64h{_N@Hp z)?}~TLAWDfExj&XbAb!5Rcn?e{1prn%b#0#bs6Of*&TPDpNbYO0bMIelv_kJ-rSwO=vJN%@zzdpv%|j@fy3O2gih(KGJ72Fx|(X?MZ}p|1}> zQJTPwTeQz}yC+H)o}pAn4-<(z8>PlkR*b6$^WOxz>pgju=JHqY{BmJvjOuGTk6aeW z@~#I`@%y?Rg1wOR_vz`8!iEQpVja5{AdoORP_vQi8Af~&v} z&+%RY;TO~7@

?;r6JL_Ds=8vd??oyZNIfT_Ed(u?6FLcOMCJ#)ZGP8=Y6CqSpn7 zNso~%?`C{VSM8NbVeEMJPK=3=QkH8#dP!>GnO|SimDyQ48 z&4jjlm~JfWDF$8bQzKc!t?46v-i9{;*h=er$nm15enqneHY5Id!00%~7|__PO-wCq z^bEqr;eE+{{=6UG4pUM~#`V%`mY*le2{>n&+Pq~5hg28gUQu^BqWzZDcy!aycX65E z4q>4vkN$F-j&o+Lk7wDX8CZFAebS6s{*>4R0S1&y%khKi?0a>0hRKlL3E6>+z?5fZ zIQ#wkvF;W$pYN-qbvBHPyTK1pbKeQl549-LIh zEulH<^4KlAB$F_lS<8HV(*ZqtjYlzGCMfE4dD(F0osJQ}$`KKWT=bg8a9-N`CxF&R z(-X{m>hSZn$9EOH5a-nw2!y9F5;| z_@#v^?2cF_6)h(Po9F-iDiB<2VY;SM-)wCc^`*fn7bW#(B{oXvon4$+_xjMDUs3n+ z!?7BVB7;dns;en*{{WK3;4t30xmaQPqO{a_6G^Vd+NF)=JAp|bvM5!zHqBG zcrS$TaA_^#$U=-&TG zvl*U#H1G2#%*7HiA$$J2Y~H6Bo8b`xmxJelwbsNZu}|jI$Sb}u7Nj*QNCQ%0s1EUY zhxZehgxjfo$^@AykPH7fKG484I25`tra#v-y2*NvblrA!)=tJxdraB4Mo6bxG}*IdL$U z-|&VE@P^VDQ1E(LPUBgbpLe{sD)0OX2p0U;{bNz8hUq6*EjD^80BpIaGcVA?8w4*L`lBL$#EHHz2AGy9JY&PZwC8B{ri_0N!ld1$06ogbk``9%SvY(VXs7& z+U~f<`DYnylIHe{4Qo+zUgxj-dboXhLZA*a-QRw(#-8AJauUBjQsto6752q}gTb^e zFiClCzGGbbmG5xj>m#wXj1RdLw9Uuy8t#Pq{O7sFsqJr?)?S(;FOB#{-K-UPaPHFu z88;-+0Dj*(x8l}CjLSiO>}PKosUcze9m|dh%j}G&d*^}3@fEQPu#m_7KsBuNr>35} z!51kC9y@}mH&AbS!i@U$6vJHtzs{16$X&r{S{RGQE94ztxyCm&o>K=xJpXk&e%6Ft zr?ZcNA2CYmCorOWjDG}sS5QWa2@Sx%Xt`bR$)++YZB=dW#B71325eg7$$ zru{!DaFavQ)EX>qPaD2=UMvkNBc1o7w^QUp2x_pTF76EC)9rSN2Ybf_4@m23xNF>y z(@@}8J$~-^&lv=M6{ydMSu5Yo?r_zW;3xUeXn_=VO0Vk}OsjL7>}FE`?8M=Si~F#J z!zIIbW&eVz3&n;$j}TW)mUSZ6ASQ%1+oggFqQ18{3h5)o4dWurbb7w}UM*-iy$nBS zl_|a*;*X4cw|+VoQF&*HH<0RMvL2CTt7g(;^Q(?XIsGd!$7#8G>2`%tKk0pj%6JDA zcO`JDams&ic+^%^dnNLa&avyw6F{Ns!H;6Fq%m~*(VbkyTA>|Fxzi?032;zG+gjSy zKl&NrYmaX$tM|@vxlC4l(T;h;7Z_Nw?jRB#m=W(`mlm!cHUnAHT!uy29DDMzdGM#SWW`9?+A}AF`XB(hj(@5}NOW$6lWF4%XG0pz2pN7AMkU$QrQV@=j zcXou!45OvZL@a)acVFPwNlbKj!QQBI3IL$(t&e-fuMZeFINkNQ_8AJ>Pwq-=QzJ!a z)LfI%$r@bZfDCA3cANWJiDjYi>&*M4b{X%Lo3h6VjJ+IK6H+$T(}ljdZb_ zr=aXf(1o-H=x9f+^s!^6WM$7tSGcO_USCE4LQ!m#Y}WVy+IzJNcP_Nf)?DT(Q{(4j ze7^q6ZZpI_rVkMWWrL%T4f?MS@JyXaRo##kV7nF z#gzP9dt|28Fib^7qM_VE$TUqyrj=*1M$KGCK9`t%XbIbJZx6P2^|<-@p_X(=3CidF zPK9-@&`~YTu?Y!t8Ful^E{2$@UZ7%7D7f;ucWqRy*<984M6Gr@t@KPP2eIiDe!Rf7 ztHHW3_zX@$rs`f0SJQ}+`-Y`yL8Qi7M6ux{@=;z!hI%=?@Zq%FNo8(3NE6u>J$6}w zWq8}J*=udD;*gV_&GktDaltx;qLd=;RLstY@68#wM@2r~zu+j=Oze}xMRtbfT8M_! zQhdI1|1~iMBgt?v$d2v9kItqBfB03~N?ZJ6h6yb}35RE1i>9(&BJ8dc-|nEES+MDv zuw7<^IoQQx?c$45G_BmaDT_Rhimrzi7Nc9A0?aeHFY{0An59#l%W%f`lZ=Lo`oSss z*wWgGz-fi9-ZwZ=okq&NiQV!OqVaOCYd7CK$mc%jnq{E&fcrH$CBY_Z5LR0-o^q;e z7|$iWtTKICQvBic5Fb|x?ZmKqK;Ese#y5K&UGjwU{7Igpagh-5=%=P1QSR?i$@brN+wllUS{MWNnI~kBZRLiGy_9?&mbAW%7ECt_ z(KBwxdYYSeeIF>65_C5`Txw%Jmtr@#M6v+6a=fm|3~g7I=?Q*dEeH06d7lr>ey}8t zTRJ8|)rUMdElA>lkEHqkVN^`ZR+!iw)F(asnJYaz#^wsxNkUkn;RopvdW7HeTBkHg zv(t~@*K%)JZ7ol$GW(uvHdY&(9s?gXYpB#tk{iHueKw5xdQAkb^iG48^;X2ql3h$o z*sS?HFkMMLUyBN`g^$^v$*vOr<1hLWV@+csr@TJz97E{3THX)Dq?v3xOpJRPBiq}u z&`~YjMy@NZZ#0>cUp{jji^*F+>o7tBh6QWi>fb;)Y{hYoz(j!Ye7tiiSyb12Yt!}< zKk?9ip;=$yBX6(p^=TEpS;oa4yJuF_1vGlHL!o?Xs4`A65+0p>jB1)VZx-P5hCAi; znFpucj=k(5jfj@aV6qrGRE1Dy;}~eM#nrZ!?w7BLL#1uy@Y!S* zXCK+;Z1y7j4Gm2)wfjBEU0L^HK%NYeJ4-2-8~wvL#eTMu1!;4iuu5${Q5DTC#dE#t zNog>+`feC=`L0Mu)A8vl9lJVa=1j?_k=%9Zld?-e1Yse(kl9#*Qy28&#m@pg+hfuu zccx3GKZo0Es-bd(s^nHh4(cnu#NEp6LJdng{DOF;`K{vSV84KA>4Om7rQ((KNGAO5 zL34y`(X`UO&o5v(;Jn7Kw+UxWcC^bS5;!SkvPrfC*e?iuS^XcZ*!QCcLPO6=Wz5ws zFnx_wR}6<4alGLh=V_PUa%Q7Q=0&p;!)^AQ_zE-K^F;cud6zj~<9|Yt&tfxpc9S&M zQK?m5+~b0a!y8$@n28&>UqA*s>)_-LQ9QNy3$@cb{_{X$qa5G(0aF!qw6=dU-ADA@E@Q4HRaD~*~GyAF5Lfrf&~9s>i;gr z-iGD>+{fozK4fX=={Dc%^5lXC(&kxb)%OM`o93 z%-8M;sbu&Vu2Dqqrb1M;A&0~$KGS~FXDU}iMtGDdgQGzm*R0K3ImU?ZWVvn-9Y7vt zN*DP7qop%-oSR`)_hMK%4@A0w55jZUF8BD*FN1ZS`1Iv+eRA=}^5vxoGUZfKD*0p5 zL9%19jh)c4lT-0!J%m(4!y*GFIn zvekn_rv#9xb)PN2t?xe>1l)daH#KGB*?cyDO)un-y=ZsDk5o+y{Ip~7lRrr?W$4sg z{euzLF(5X_W5d{%?*!;i(**&qG<7dfFE(*y&ud1r>%74O?3)uK)Ao5&N0`Wf9kW2o z>hRZmkC?u(R{YLh?~cd(AsAX~u{38(cof_z)!#&08wvYr^te5II0CC`m#|Q1^`Z1d zm37e7f^D8=>%zC|+N6{O%RB=RNV`vlKO{5ns#Cgo)`X)sH@g3ssxZv>VFfF!0>e5s z!?E;)nW2}vY+i%&wfwjy!rG}0zfqMP)5hZWoj?dvF?|~+Mm8gjecBXX(YB^!fkv(C8rqYvU&Q(2jj%YEx z#yS5Hr0OhKv-06mM&I`Ltg5D^*`4%B@U|aw>kd&>n6+nZN5r9!rYCaM>X@66m#cJZWyI|H z7P|j(X;<}{7*Sk9CX8x49Sry^`935rA3gDMdZOxb=J!nEnLhBL?R8N?wjo$A$J?vB zzC*%tK^$x<+ZiPnGkK4^A{#)sxjr0cTP`e(Zh@N8se?bVX+-Ej`~e+J0^w+V0O9btLw+Mx*KY7qsmW+ zXelqxZKXdEQhg+~D~8Bv;lBdA@MVD#n>+Voht|c;d3>qtsbqN`i)ft2%Fb^^Um{wy z6uT3Z0>_lwG0xa)k*;3D(;=NW4m{{cuAv?Z+UMq%6P(_o2=4y!lwz1o?) z$^%I=Ozx0iO0mhxlw%w;&yz5PulfAd3*$=W^Syn^2h9DtrwORYt(sIG&5U~|kc%hH z1t<^U%_unj{RsAZO)C=-VzW_7y656f0fKKJ6o{2T9LR7jF{;CS zs+iKq0;V}-Ji_M&Za!tNC|qb#IAg)ESHcIn?bsNkYD;=`#R*){U2Nr5edc)%m6*=K zT~(=gGu2b|aU6zo<;wx--x08{ zBQQnmQ6zH*XoPLHOm!1n&mq0VXhNG_(|EHP>y^k5t8X&L;2VA$c9%A>@2*mI@u|7p zvJC9om%)zlPJJ>pfs2gA&1rW(365n@DZ-;&x@~i4MhDJ#s;x~XzYG?Up?#!PTMh1$ zdDscME&D$ru%mok-to_(VSlQ8l%qi;X#LX0OB?Zk10l8Xn3?sBU=ibZ-nYA&a~k)L ze{K$q|4LWC3Obn*oJIIjJrX%L=Wl^|u6BNvdx^;QO(yU!nE4+tk>A5o;!+S>$CfwwW z;S$uFB2#i-NPVC6b3vDnEOh(6+pmmP8d0W!bmBBZpTaFiB?Lvj-2cgH;WaZ1|BAk1 zALh0fTzGwsQowUaVcLD@ntC(jW0irEb5}D~W??JW@kQJ=Nu*4ebusFlew+Yr7MD_* ztZs9Krxl#HmapP{V(TH5>~xO|QV6|Qdo0(!#og?&wD9;_uI|^-S_?3UAKP3+N$@uZ zwZJwPAB*^>N1VW67rQz6W1`QVvt?VQJ;iW|$bRKD0_sAA6!6Tn?b2h!PW(|A1j)Eb z<`HZ;dKXe~6E{P9R7qp}7-FVUm%IsXA7gAXDqecztft8sL+%SNC~T_IhA_2RAb3Jv zl+&vG+d=_|R~L6-P!+wur%qCrQvqLDs#WukB%mhi2rmJjx5KoE+mjus7yDhJF-d3< z5jQ=Cf#ERE*Y@b)ReIccH_b7+Tt;)pDxT4w;l0?!9Rv3%MFc>UW_~4^FAY z3{-NC2+70N4Vw0}lyq%Z@aMgFQti}j3YXu!zSw;qMx7d{dciI2r*!<-%ojTlGDBuh zp*RYP`7&?;oKMDlsZA=V-+%%sdlTY3NDGZK2Wmm#gM?hGe0bshzeDW>9&t1Gm9*)%KLA$l(>7r z+ba}GH~B+M{V`9H%9LK^OYb#rdaZ>HCR^SzSF4v$uhP4c)lx*pm3o@$7WUAFcN2wP zN|&V3+VIIw3K*6%9)b@_CuX+l4gNwbD5#Hk+OtvYho;xw1U$nu$_-`mNtRGY-T8s5 zD21=}W}h#7zS0coPqVNned3a>5)*DdHB>T6dtjz?(zvEkYv87VdxmKH+cHHMmulen zq{FDqaLM1n06RB#_(Ps;+SlR}wU|p$K2kSboS*tKcqSWcK;As@iCV$NPVt^0=we*{ z=+T(F`s=DHk6;r@1}dqM$?tW~HaS+O7i=yC`$WsoUEw5vNsjN=$ZHWP;vvKdQeZ-H zZ^P#_X!V}^L{B*>JoN$mZAmdGUcxe_Kt5)z2G38}4a1$5C!2*tqldM&uYk;Ir@&BY zV!AP?rP&^3Q|^dnJs2WE%S@2P1Ft(KdR{whMrB*iJskV`!*2)~lNWG8E;4iIOyh{X z&drfXvH!u|dww;wHtxDE8%q>f%Z7r$QWONF3!$STBE5tnU8PA0p|?P=yDSu?6N*R= zy(P2|5dkToLm(kUq(efaBq0RCp5Xib#@=V_G0yn|4qucH36MGGQ?9!_4;OIRN&&I5 zS{2<$%i2-0(vc}$yB>Oi)?m^zSBVfBOC!H@41WWzTX4A(dRKLDw{*d5CkNHER!dhS z>XHsAG`<$)YbqMHZ<~7y51{yFdrXjHN4y#_G$|tTmF_!TU~cCq1A9*U%fFZ4e|(U! z?ABcI+V1_HZc$1uQdn+7Hg`uofz4E~zi37{`+ejZerX#JAE{ANR`cxY;=hI7IU43U z`sI!}MveRk+p@r!K`4`P%0zcZ?AE zb`HAK}}D zS0zlq?*Gc@T@4FgtN=xg{teT;7gu7KoK*ZXd_BD4meK0X_98dMF|KX21@h~;@iWAc zz-MQM8muSo=ND>>xEmyfOpA_a5|O_7%w6 zX6%2~UW%6MP8QuA(eiS{TOlW+l!*Z)Lw2dAqP#nzr%gNK0i`=BZXEJ@Nx0B-F$jMR zBxVriTDx>!7D3(+!ZS6{HnZr&SR19{0cz(1dLfbLW^iG!y=pZjt#-w2(Z;cq0X*|Z zb5|nOYFMZsi8={g8x;U+e*L9qXyE;w6LM3~$ss5G>~amu3%6uzo;!%>uBE>brB23e z7ETUN%RwP)pT6lhqDG1E2LAGnWOSLl7Ga(vD;wYV$SG!3d+k?r}9sWUUq}7Lmlud)ZQmxD98y#$h>a79Nx|24zLU)o*QXC z1%6tOPn>kfc{Ps_Y6K4i^fY!Dj;#PYQ)#*V&EwpQ3MI0;Fif$SQ?J>^P)t=UqV&F< z%H(HtlQco`e~N4MIb|GsT7gW1&7NQ^Z)TrUq?A}xMmn;-p3@QX1V2s%QSOJ%`>BBf z-{#%A+GRZ^Xe*0M%Jpc} zHL9p61@C3CT6@xCBshrYBod#nm?_45%qF=?i1*OJw)sLsLX#^$W$dJIA+Qop%jg)f zPP+(?`?UPbX4A=EK>?hNB2Kog*1rQe5auwfr9E)s{OYTkh}nt_q+k`Oq|2^p>+OWS z8{r{_-!V~@Hz+MY68sG+u;>)!!9D9$MeK0F>v6ctV~sZ2T*6k9MI3qOIuDOp*J(3? z)W;v_*O(ZYpi`qQkqslfuUnl_W@t!m&AuUKBa>UzQ$oVHj>+WE#26? zEBDb-Xd6TGSNKDEs(%&6>nmEfqo)yM74yt`9FLlsx(G%bcU?wz;E5x0&H?v~uUOZk zBAlRVCLQtN&6b~yxN^TjQN!jvu1HZ@?cBE*~yER^mytLoPfzeQWaq#|2p+~{94A+Zn6*G za>c&i>cL!b{mb8z881 z!9Q24nSOGn0WClE6jj-D+cLNp8EJ`}05w4GGRyR-6(-@(BGd6xjaU0Lk1M2&{Q7#2 zFjnaXvBkCteDpFeC77ER$DHO6E6cbgI%bLpN3S^+n(KUgxHd6OvRc+Gyk1|df2$fb z9RrzuEh)fn+EErncr;H=yA!k1S1ClV(|*|dKC?rz#sg~d_VuejX7k7Wz6xXpeEZU@ zZ#f=dYghVqHs4sAv6>rsb3Fg)RE-?HsYd54@6}QLdwJ+Fj#wnYFQl~LG(!N^I=m>! z5pZ&I6#(c_waa{HS3O3tlq+vYWbw3u6iRwLfrt}N?1l9&o zQ%IRw(G8ckMYNkaw(b<=W{{^P+^L|Z;jR%g%~@;UN3Ypvu(e*={2B8BdOl=h#Dj=t z-|f>#6qJLsL~N8wAr+Iyer-os9mSI??t2Gj@Y0J`G6hAAOf8v47dP)MtJa5ABcF*< z@qh#K$5{L0vNzUVwJVw-!DTgfd`fS?R?JA$dfW^=4U<{ypR>D5 zHfVyio*O}|>9P05=-jZ(qTEQ%g=2-@&xu+VYR!{w()FH}1TXi|yj3+%Cma+5qYBnW zTI=TSB0gkpL`ia6Hnbd_r)boK&5Vf}&7;wUqNPuKo7}@+6HbcS%ZaI4h7fNo`3DtA zc#l%BFHdnIr&pNSX*YHw0iq|{p$u@A6dSR|^c?_l7{%&j#Ifd+d|shsBF$UlC)8lrVfsu%R`;>eXw}3JE7hx6ymhp*?^UIC;Hu6Q zwS&jDJPu{Yo#qZ-Zkc6G$|<2X#lfq6t#J3CH?Wc}`b%S3qR(*viEvoWBR>*YY^#cX z@yf-O>wetY@a9+D*<_EXihg4LlX%*^R)Z3S1~%T%0Zkn~nvoREfm?@%Nw6X+!2!cF z!8s(|F$ZBOy~w8XLCn7=7a=Om3KXhB9PN(M*tTxQcmG}GVzF{v+E}ojdU+gLia1kF zGzrZo6}?Ti4DLTBrAR+jL3?i89Mv=>uN*Ko-XL#7*!&n;b|Hb98j8t(>^$9Lnwqs3 z#P4$~oGmvGuA5A%9>*`mk>}#6?ltdY@K8ct)CzY>mBK8a%yFn3{#{m}H%wOQYmtqj zsL=%A9reZvW8uAlDvHGr!q*SsN?QU3P1CspaQpIaFNOPo-_xv0vdkl(St%@n5 z(^gjlQPGaHybHbPqSy%Z%JgjfoW_-mfP3reU|?UHzFVhsBAHrU_^*WGF z^V6q^`xBVIG%4D{rN-TA@XvK2w&|s-|9rA}mamS8IeC)nuUEoVwmVc~qo4KC zvC1QTh$>^hGLJ-v`lp&;lO-jkQNx7#?)3Tf5n~tEuZN~7pH4g4Q7J0JUYZ&A+dE*z zokj1t&i9m+g0oyt!WSikjiSw{F z(ruKlOFEiSR$$cl4vo9n3`Px2K!H0dpUIqb8){G5V$+G=S49>%Y+!Zsz^AinS8jK& zU-Zkxe�sENLjas{Ix;Q>N!wDcZegV|-t=RMkWiu6xF~6>Zm_QcU+Y8x}+=M*fym z4J|L8F!0=GO zUZ$t#0*SDLJGpL~zeZPoc841}?8y$83xcFxzHpS4D^yEej<iqLyc z?F^2s{UIzuG8ygKd5Nig|IeN#I(KGYqYY?#syfmveq^Prt1kJRw2lT+s@HOIL`MSS z6|a< zvBIYhER15$uon;5ue~Bzpo=@UzgQJ5S$*BhKm7MOJSL~8>FCZulrPEXY(q9fyUpOr zCj3iQ%V0VZWH2qc)8%AWnvXtN9G;hT{j@h#oG3wI)0Y-Z;F zD(+dcv-&P<4DO57JwSF4cn8f<{oxFU>y7VZps)vM zm#26mKMviJ92J%9VUVw(0f>C5#cP(4-yHd3_($1@-o|=ANN)JUa8xJ3^fxaszL#I5Lky*5#wuY{R_{-SHt_L3a8?0d*R-)LAb`8Y8X z_|z-+WT>maT}G*R1}Ju>tg@3lCs@bqSHr$Z46EMw6yq@4AleZ{D>(1|$?|Ny5>Am2 z@!*U1y|LHHkA{6;<*a|m@#^v%d5BfgH`IWkACul*j2F%HK?L7{sH7KMlAT_MUA^#3 zPP32v%iilvt77JYDI_%tj^5=9F|HYOhX87m&BMMnJMQ4rgkw1i9v#7uP1 zc;rYz>kD%f`vnF;4MOvYhur$wO!Ktr8*?DCanonvsR-9wWr)`}5P>PeigtoI6Q3)V zMJSXw<5N(c>t+wSnJ;$3o~=TBGf*jB`<-TUs{5Bxp`=3jXEUm4aIrc3ktY#9S5~_M z5jwlDNU0#UO4uy(JXfxO#;-wqXK$8&U6!;AbGP_#mE;M35bgiYYeYlhrgM-dJG$O> z{pLrmwKqpqYpD6=iYH%Kuzo(IItpxP-FxUX>#O<9K%3jGV|e}RxzhR~t2eP7jUlB2 zis%s}75C|~fHz!(TWBmB(ieSLT1G#ESSt#RMm7D#+Z1X3K~3_k-|K@sg}5uj1Smx*>@zr;Sz`80hMjJC z7THwWpZ>D)`p>M_4wt(E!0-1wUJqhj30uUua5__2O5tc=LS-o6kY3OXl zT;||snN?k6w>Dg>zykK5^c2)cOPHsLybtkT$zNd5pzjSCyU8Rw71-~qWMOT zpI1HsVcmaGl>lltwHF*X@I<9&Z$|4;9siM#66NMW6)M1!&ydgkdHACEQce0QTCF1^ zZA29EsmlWm?W2Ss56)q@GtzuOPs_>UQ6bIa(tx$F4vUKjNi_0GnoaD@)W-CF+I=%p zH2^;cgqYGm?hQ@T*B0(LQJAOdezIl5*3injUg;I2g4@QOy}<=qnby^@R3F0r(v|w% zN{pQEfFUjFtJihv4V5aDMs16$HY<2D9x~$}*;qRFehHOZ!jP3C&b9tz|J%F(J+G;y z!V01Ion*#zZ7%p5Bd^bcmzeTJ z($ctpC#DE(#&te0M$2K&0-ZJ@j>_xDDH^lYIBq%1X64(rd4+(EZPUAOjrSCE_jp53 zcPm3Ar#tKyt4hwpF1;{J3n|s!)~%ThSCB??M8!P2Mc}12dJF;3%0(hF{fSW{kjm0m zx5A3MGcTSVbQ`oX=Z8T~s`4yT+1q|(LG^|X@y4iamG|;yjamU?#RWHqJ@`ovGA29T zl4y4_8T{T+&TrV7bpth2GeDPxxITjGmSH}q3dsSFHF6q`z5cbAVFn@oS{4s2cj{gZ zP+&G!6~x9i=*B>w?_FG3X8(Q!EMH38%B40;qd&WK@?7=gXDgi=_M-lg;lfv&6`2L9 z!;G{rOzoXE#*P6U`A#pJYuOSr==1M!iK>7`{T^E;XgP7r+VsD=LDQt3GvGOHb^)Hx za~2zILW(6>xnfQe?cuc(P9+Z_giw@(g0QDeS5gd=E1JxW)F48GaU~?-l8|Nb?eD>f(c>WtF*qMP4_G}3pt3x% z7is)2b&q!ALWz3Ov=>S;k#8nr^IUg2pPp5y7>GLH^U2^f+J z@~jgf&-j1qskyaxx#}u@PoZ@YIzCmczNkXd(be~(nCL;es|3k3yX(pD_D8LrNnV00 zUf+lDicNu&j-R>n_BaV|=6%2~F^sxw!A!ZSv&2OS9%}@Qn`=)ln*usq&i@`gnKXVXGT#~ly=r4yZ0KQP#^}+QF>#c>MGsag4x=sP)mD>@M#8)|enc;F z>4gtdmE!*$wV(I7=ZS=Pq_}z>Mr9(j_gdHqAth}E*uh5ZlPm6FD}#9Ta-NA zH#C+r`M%=>)oT6{+p}xp=xWEG_I#_)vdcqag-$BG*;o!MiAW^5#SWHAO&tU*dd4`e z2E{m!etEsf_GR%+$K2^{&fQHD<&Rk`Y zh(2o`O#`#djHW3EuB+&zXzsPWwa9-=fM2d(`yXchxj%apV_sKs=hE3?O3af-WDg~~ zyi9HCTk(?bL6ag2nJZV;BckK=K7BUH(E24>>Fqn zt_-ott)p5-?cu|-Nvtd3;fgQeu^!!6w1X7$oP_Lf>1a8`DlGSAeX_fFfp0tzs61_S ztIw>wG?1b{=m;$iqFI)K8ZnOk<4=$C-&lqXd09vHrOKaACgVH}9}kf@L4VobP5~tU z|6zRIb#gy>LYQ3-7e|hcbbLiNwJpQW)z=%o9Vwo&ELt}$I3odesb_y!YejYRx~wI- ztDVTdn!99ubfmW0l>f2CqEYRV(3(~nDsF8jLd2~3>x%C)vs&etjMHk1gF(9%?91&; zE!l_AvQ(%+>Tw5+Sxyr89MLZCEe3$IkIi@Y&9pW1o&1*28~E{r>iF_!mD+bi@71m)za(Y8 z<9};J2=G&SnG|;R!ep3wm?J5#1;h1vs9`@${$OR_oGB}ibjJcU+SEKz)-WpCmXug@ zMd(ap{cW?h;bGf?R<0g4V)UA3-J{S%^yugm4+!)&qmLG}&M#pR`Yh8vXI6sN_2erP zUF4yCGaT}6bYetRn|CqbOjB1giig)MyyeBarUTz}E;&6!^Q#T}EPJ)LF`-=~L1X#) zy-%V0Sop*8+_3XvC70FG7j6UvkEzV$R`EE`$01@WxJeJqHdG=l56aNXXy|4(3yth<5gn}}~YqBG*{FNwZwkS211BIAD$ltdk$`F#4 zXJxY@G3K>7uedLoE+->hw9m6btWIzp9pbYXKW+5(C@!-ZoZS_vAot4sd%A9A7q%@Mef<@r{ME@E!4Pk7$Jl3~-|+WmFCR$pYKVpSgWmG8o`mVb9oT%+^wnxrFNk<# zHllk56;~OiJW@J`aegg}183U3$)`5S`kPle;|MkIcOVxR{-2mX)g1NyJeVp^+YYXm z$fA=wQX7H~1?a*=sXX(EtW8weQ!7h&r<9T9UH9r6FpChjsG_jJ-vsU%3A__-42Q6E zUE$GiD(*);pQiB~Dj)SEMKUfP2bgE?`gpz+?+vei98YS?1<^>^4V6zJ;A|!7u^q$d zd#UwQY+!_g%cHQDNUE@TlWE@D`F4Cd(aon=@v7TfS4b*Fa1_-dSRR|;K)GLxQYS26 z4P@<@*Y<|>l&in(mU<8M>JJ8owmprL=stDmz#oYu+skc~Um+sv>-AM41Wts-tsqYW zWnCSoiCm))%g3aVdWp#3o3;))N#(|sG~0?hJc5c6H^Mx(AGsL*a`(I)g7+vE9Q;)) zCGouz*ujT&b$6N@*V#uy!##T6U3En^h&=A9F`KPd@zM0>n^{OBdPBQ1$v--VV@;X&h{y1Y?&fl{UBq*lgxC0?7ZTB?YQu1zvu;r4i?t7qA} zMoA;Mv*-10OXEyEgco7(t-m7AEW%_c9-B?zp=?lWbJ8zX^AgV)rt(D=fmOPjZnOfA z?pMZT^*WoEAcAVuY_)jUla3_T-Jy1GJ8aW;FM)xeu12IqbiVTO5Y%J#iH&>d_e!cA zXC?g&Q%k@vqqe=Iou)Z0H>Yw&d`yG%tAL3)uXJv*zeunxpK_Yv^kC^9X1kQ9+SFAk zj^}eG*P*_o##zs9P=~$Ok$h5gqrR23XSe72))s1tt=)T&$Z71r>)h?ppr;;9Ji;}6 z5eK#^a}s9o%Tl{hsav5g$`(bW;Dtv4KEyKID&Z5cOy3fg4ZFPOQ~z?}pZ$6bJ56jm zkMcFsGIMr?+N}qXFV&(ffQXl03!MiDJ>)LchAmB6mv0sDj|5AURJ~>vqjPMh7EkEb zRoRxB5bS~bVs&it0XWW~kSa(;)&n#k`wu#XRPZ$KZ%eHxdn19J8}m9hubKoGFZSL( zQtj-c`Kb6afi#e_6B4G;G=lP=LmM}Yu>VcY7G;w%A7#o!uwGC77ns+`@PA+Su)p(&v zyKg@1Fb_8=jnH4fI^>TT4EugV6~z(N`W(HUj?CG@@-*~54JFXJb7;IRwIiP4k~R)5 zk3B4mFmsv#&^uF4_Ac_jvj|45?rSF@4~5``pNx*r67SKsunu%FkKapdyo*Y3zCUoO zAG}i3t+wFUzu`AVT~mFx{^emzc=l}@*Jufkix%%Pv`z)s$9k4yfR=?=WShq?PTW2= zkzHQcgH}&cnRiQ3TJDb2?fZvWvZFu^0EsnlS;EdBZf{;c@TBOo?jC)~&(^JN(?N!* zIq87-#QVH2sE_8)9nyGPWU5GdZ3&tG)!LDiAz8jqDKyKMguLdWl)hv}JPuiUGag25 z=xvQlR@U18c|ZX3;C`AzmPe(FcfMYurb(r0X=GC$yG9DD`*W?OCeHPU&w(+7h^%J0 z{hblqytCu)Lz<)^|0h=q|NmQu_J{YqtF*VB-cL~f{^tML_Vj;akf}uL?2-~7zPYpt zvY!ADq&!Q?lqwf>$Tzc}A$_q+^W}Z?5>&=Krv5dN9ctClBgtnT4^?Lj&Kp?lL7P1Dp4~G!bPB&Lvjpx+ z;$&m@a$R+szjb?~mblvn@lq^q7q-WfcWrwCiJKchK;o5n%A3d^&X+h`e;`r){bo7??%^YBtExO5%kJ$v$uA--h5crf z_o3nwv&SM|UY=7M6j%G&wg0SoKg#RW2CbwN}RKg@0ifuGtKDQ4?Z_CyU%2HKA`Pf5E0aubdshp+5Vd#>c+V8!J6K7sGX6i>}1H5Mb{0M zycVx1a2ZtLwQk32i$Y|MU^Qmy@hEicep11_$rwm9`k45W#4hmrS&(?i3Oyg4dzosa zB4Xzi4~L-!=uV7MDiyE(19e6bK0xkB*%piU(~Q>>qeYeyA{-oVJEXJ?M?NhY^27hk zrO%~~?m+4^(l+vUpleKLa)%Kr$}YIGD`I9cp|>`L1s!l<9`V{xgd|NIOr*)&Im?z+K+2@IO<%?dQ zAc7?p(_c%*FSp#oQuBNP8Jv5Iyc_Wbfd*0tQNpXsO>J)gi^@Nan#Ulrj?9)#IHdX2 z@?<&<)ZvI-%*)_J7Wc6F05`oWCu9x!7Ja%}-NR1bGc{`{r3w@#Q{z$HY8>ePd}t%$ zIkF@mbO7l zL;b)=jA>Ps!2_}k#`Jc%jBhMNp4;4hqB04~@7*%uY;Oo?{W{Gr(>(8Uoc7*{`h0F1 z6WPub{xdZwDk_-m3sZ9*EMuT_5n5{?{_>{zz5Ih%hGP_1VrOpiQV5ooRu$HV^KvPQ zDjA`PCE)Hgzb$8Kg(NeZ!WZG>8W_~>aVa|MbIalnzY{&v7XT1vCdjBJ)(>*!dHDB24OfZrFc*IyOvErh?|t1bHhK3) z%1!+5C;|L0SBa;Z0Xt-iX$noS6aV7_6>gKnlcl}o;l9$G$Pm7B<@L-%5c z^;|RlhU#)Fv+MiNY4YO+A^O_Iut9@l;AZ-^BQ+^xRIe-KRQznxzqa6Z5aOOWkB}ha3+; zcl5Nf+|ys#c@yAbga`sjp7Nb78ar2Ab1;&onvEcXn2XgMMs+?U^l5efbKx!G`_Ly+ zo0&{I*qnAj7Z3MIWgch34`p{vS=Z^=+I%(m#bpt&(q!ewS%Yq}0{xUhVe+k^70iye zmb|&r=#TY7&J19(d{Pe__X(^N+`zKA{exG!NB&s6|9t6W+KuI93#{fs9`of&*}!Pr z85qhKSFjyjR+!enEc6e$=f)eqVAdKhI9Gco$Ry$M@ZU*RMRT`cPwtLT1vFf&HwVs9 z>lLG1c3b2V$&akVht=c zML@xjxLi5Jv${b3>1aoAO5{CPlN*KpVUHFMpE(b{zYk+6uw``dS>yC#iSuT-97ZS! z8P+h=lqMfhf@?bG#XRmj=*DHa{awgXib-|{toQShiNbwEUzOLE>y%)?h3})-(P?cn z9@yPY2>`+ZR}&0;BkQ{;Z^w(U#Ge0wzwQ=lMkZVIxPPJ<36;lsMKYEz#iNq-p;^hS zn=1?amj5^<_Tf{CLy=zzj61cLvp>8)Y-Q<%fSts7!rDkP1|rlFGJ5bsr^;33Js&;} zEj(UUCD(QlFyh;_LuAk}0rNk}7H+mB!?Pe%;1Wc11?o4YORU}faO!39roj6}8Wyl` zj{hN)gRCbz8XT(W5Y zi1~MUX1!!jq)+qiB*irn6_pjx#I|=bq|2n>m#Zyd-M1TE@7xuWccPajBiMo4AG*|E zLQ|ohEf;@6I*2Z%_9d?}Z1T5zkv}teN5aV-BRnaCUd@I;Ho+}D`PFunjZ2s4>HzK_ zSZN$So_+zWv~Gy8f4Jm2@O`mq>jQD+P>9U%sHKRj^O1w1P+)LMS^vEb{k))nS&EeG z9JI~b7I{rldG{4`PAshXexah$uTQN@{B&PS?kh*{h{_KawU#6BmVciWQ$G_Uc|E4C z{B>+-fRfP_s&l@_24{~`9~A&R_uf|PlLH1`?pOqJee6zr2H?YvB-ngjqsMEM?vrKy zfwYm8S7rzCI!&)@%ZaS!28{fP)EWa)th;6StorF$R~L6qDE$A#)6g@jK&-w z&(M{$@m>>k%fX_IsQVDE9)s@`>dRI3q*QhCTgzw&&QAn81rH6=On|FaSGQk7TX!=&CT~dh zAwMQzlA>44cW3)4{pC=O59nHdHi6h>sTn+;Xl$MA6GVKH{)}7nm}ktWg7lvs5~zy| z)NcQ7mwom8yEelF>sPO~hC}T#{f~Fo&aMWx?L%*UAkkQ~Prc;}xuSvyZnNt09yri*rmz!&}ail-alI)RdTp`7al?w|826E|2MEvpziWWR;+3N;N7#oZ0 z!#T2-7c;kcjVLO{MWC=#k&$p{qYbaR*!Po#TdOP%^j;E5-PgtzE2cp@rf~@DFDiv- zM*p1enFco7PYllP4gw=--OaURvBefy<9n@-y+xraYEtt>0&-Lo4m?T7XZ=?Gdclq7rTLl*edE z7$}3Vd(Kd|$ythaeQU^)y)gV7tLji4Ae35zd2<9>HZXNd_c<-lV|N`Wn}{59X#mq* zU6C-N$&J=Eg*py|V1tF?fHJ)V?APU0zDPNi;??|6% z_)FU|(`rZCeTV#)E^$R=mcgB22v^Q%ax=13$}YZ;2~_9*Fb7Jefq!n-qrMBQQ4?dX zXrB&7?zpmT6C7o)q*8959Y64G8M1Uwo?_$vTJTHH#VJCdP)%<>;O!o}^_oD+Gy{Jq zP-p4|AqY+ZAj5x3zAjU|)@mxXAuIhavMnDTF|g!nNk+(kLiQZ1-3YAe<2aHcI45{s6Y!;em zEd~+P3xAurWQx!zFr6w?IaY8Le{#)}NHhJ&P*V$URxI52lOG+fY4KL}y?fRqgQ1yz zGc=J|mtX4KA1OFH9OtC84%}YppZFFG8unO@{i*$-)Bakwq(u-WjAWhH6`8|+7eqr2 zpJa>eqAd!&yLgq?E&Z%3!yuL;$+o)8d$1g;%Ezv-DOp3rs-yOB~*G*)-GO{aP`Sy@=)Yj6Y zt1HRDby)LBO!C9mN@RJ_Qbf5FQp;^rJ4`gM5`7ET$^vyvHtOZ^8lAF8dA68r%{@M; z?JG#VFfx55uof>+C?Z$q95ckC`db3s9kB+Lu`YwPEv|35+TA~#g>&5#B(4ILTVF~wT`1V zsn{4?kckiA4_Oy6Rv;MVO#4uz2I+L zFzH4OryE7>&S{3kLRxXi28>yxbJu9E<=D1xm!%gi2%Nao>|0#~TE9icOIoUVUL*fe z3oq*04o{sR*?h2~ZPeIjmFgotL~7^nWUiuYDu+CYu-=59Ct%aLU9^DQk#WxkkgluA zb&KJPSZZ0zz-&D&($$rYn2ltnJAmBTt^tIEXpmFZ{Cjc4C9L;3L*TJN%y)C%Micvr zQqpiLu>mDkM{I0FWsVFL1Lw>iNC)kMBNG&=6(!GH`FjIL^#vIE_E^kLt(_vy3DsH7@b<7)o&E2?K?g=skC z_2|sp0zdY;#N{JhxXzI@E`n%AfmDqj8deq#L2yfhX2bTXgi|6D-)F+QYXQ!$bkv9- zB?|eV52?R{7pEZsJI}qBYIZdwn#ycaHjj6mNBKZQVKRe1;JqU6<{!g*VnZuMX0*^h zes{{5JeoUJwK)8MTfx*(Pf8N}QiJv!VHui3a(_AMfYBofAYEGzXaKFRVq$%2S^?>w zWr8H!Q`xw`#Tjzjzf{eR(q&JtDX7Gra2aNpS88ia21j=$liR)POTQ1KIYbUFQ8^c% z0rH81N7+OQf46@kP*!{iWS}D1HF6^%>!;&DDP-!K(xWv-+g%&88b;aHDj7&}n9$8vn4bfho{ocCF9xv{TLe zqa}KSI&-26tANwGe=o@Cd(30@y4g^^T5a2KQHVX;rc6Ie5%hFK(UY}wf|1tHTm)bH63la5uc0l?n!xR?tHMQ6Q}G;RChP+l+x3c zD;}?JHDwU{a(S@sU2~COB^shi#kH&bxDYBrF+ zvgeWv$lBW^TnLG9AJfzb_$;#}Ai8GUSPgT|KHZbV7Cds>cq#*yUIyO{!21=rCGMy% z)oj`g2Im7-`s+()2n8>Lce$0bM*zc*NY2S0$})FJeXVM-Y=OHq-ZkXoYKpo$JbHsM z1_3qg$B5IAi&@hav;T2N-!MPtWOFm{l3BN~VB z>Id32Yfsw<{ffORR#(+CzQu>(%pd#ddY)fT;J%O_GE0-P(Xk$skN0Q@$Q2?vhir(c z;D>`$%1%TMiI-cjZ)7Q(u`?_cMRku&diWu&xpsC^f_YOD8t3 z-6Kk@jRU5LggO2frD?_*mT^huppw6JN*B1!FDT_d7!!wuVu#f7sZ1s782i4bx5c*Z zHx6axMl?mdN?&*`y7LQ;Qz<7c)uaR%C+OMYPms`CcE!5AR{;RDQY&?}wx>^AZ=4;* z%R@eG6#3FnWyRaC!FbD~2aw);za4AqlexcOp&2!C;i6sdg<)dN3iNbMM_nL8Yqj>L z(>qD+R_fTOUMQrtdfv30HJsKCHG9i`rWjh&S>%Y&@}D^4nxfy`9)e?T#oN0Jr?Asm z-XrW|%=+p%{_wsUHMU^23sdc-fQc%#ya~EA+C<)bn$;V+ssSvhj%3yVZ{Y#YTOJ&73+cFxM7?O zUe}o2`-hm;51L3n?aqpZ>k^E@y0EI0*&BHrxXbunUS|uh^LhaP1=>Y(>5S`%ngUk1 z0cpzu{@%f4J;HI1vYFEX{Q_c^e+ilIKL3Lb92X01`iA+HS=H5Bl)LI*>zz{h#sJvJ z`ew@Q<Na9a%(a%+*>2&&Z7uwcSTyo%iBo#x>^#831J9!|z zUvLk+OjC$~q4nad|5}}EA_n4N02iLa9QU!$rLIJzBqwD$Oio0shH;d1$U}~PhLa=nL4S#kB5-lT9RmEx@eioY?*O>3az;8NI} z{1J>rnF~9`z`(w@>iTRdekGElq7`Di(>+(zz>*hi*7|W3kng{ww_V&X-`e|=08jay z*!^;<{qO!ioF^geuxC+D%qt<W=kZv67*Zjgrc;M%ClAiWA=FYfiLHOOV2}l z)i&hZpecLiRCD9ZOwqzSq6P42YyB-cSY7-@67(#HFH<U+wi} zSQ}f9(%L}p|4#D1J5y1=lbp44nc=mV)Z*{2^erbZSh_3%NnL7x{#W~1js7XIqrGS= z%fBdFo7u^ddoQ*(|Gi6mm3txl35_^kkwjNCmU((i zeFANap9y9AuKzurOGsun_3f~RxhLf58<-j!z)QtqF_I?^mNu5#L~6r7i=W@?IC`@# z-oP%go z03M0M&x%9qR&Z7SSReTyB|@c+;2brQ6=OWDGl5x`!rZInS9r|lanfm=wW)g6KBHf# z=MgcqZCX%Yv(@c7Zp+{iCFntSc8QfBoQN<~4GSXD-byV2XQfIR-Sb*G;`4UK7D@wo z9JOG#>n??EM+Wc^nQone{rP;x?4naAqV>=ZfU*>0kM3y34qK#y0356t)>8K2pg!&X z{P0c?6pl?_;BsF2nXbCBswuf;#eYOt4Fa5B2VUX$_4pgjLKeW6*ker`zEw7HT9y9R;6sWGUeLNh4^+CNp zIN6W{G5X$ZNNM$J2tF51w7#2>=AM?G@9vqtpf3ZN>iv))B|t?1Nu?ZmljB_kD*;x3Ola$fhW<&#Ξ=b0_m2_J92 zSMQb|M_co`5naNw-iLPJPO{jF?2YwvT8!0%Bu-GTnV4|D4}o2*|p6bSXT* zQ>zGCT9WZKa}?W^U)|SC7ZS$S$$$CXhVNWWij2SlaNYP?vrP4i-Dyw{OD8>oJxR&w zkF|Zhvhuj_f&a36|UQGj0?ic>tln^$g5Z7&*Q)mG@pV+ zmZ&=u1J8(V;D8Op$}y$Hj4r$5mN!943JMv4>2QA8IAlJuey4nCA z&|ITLYsnL(t*$%nG=l?PqiHw4doyDtdEP_!Tb$$m_-(SsMa7l#7;#>8Zm2erzS#D^ zX;$8P1E-yK{3Tvd*|sY5vg3K6|84Y&Ura|fZ+>oeRp4v8}O&=BLo}jkH8vQk>hjz#%_Ws1{{f7K` zWx6p#v>PR855Umu69rCp!neR)$0nq@gc-5Z&i~E(z+)C>JT!1As(3td{R!VM+bI9d zbS?p|iJF$^f^^O|Mwnawc=Ov`ZQhuA-Zb@A}0 zhIU98DmO1@@Zxsnb72k}n&-5#c<-WD(Z;HO!zfRpyq%S4cr0`!%N-NVXtHJzwGZ`X zP6hD$+pcV&l5dEf+dFaLfXl1jXx$+Ai&N^i|Fqu#SRKA`Gb_8%t48rkTV^SET|6pB z@;9W`x>I2|iylj?@XREY{gfn?it@4~B#-}xlixLr6c+3oMv5)==U%d$bbc)Y0o%Ps zw>b|6Q}7H#EBCi~$s6+y|0!f)5_f-ktOB z3+K%282i+nICor&P_`4Ba7}$~BA=R}IVAD^lQ<~kxr|!jPhCc#XZ^0G_7tM4=R#WA zhJgKMndeyq9#w#7ny!E32`?LOx@!?uY?Se}hM;q*|N4G zWspWmxgMR}vwZh|wfCJ-O{QJDzAvNBI~GPkdYKvCvC%}NL*fX6BPb$ZkU*kDq=rZh zkc7xENC|{-7%9?31f&}vbP@}Jkt!t+2oQ<{gpdd!fe=Ez2fz0_>zp6w@A+|-`ID?? zW#wMkYwvwu`?~ji?a->44dWwFXqkVyAU1QNZPwV(=ogq_X7N)T_k$FuZD8xF)uH~BF^}w)+pm2>^)KBhp6BMFClipm(DyAJ;RGT04!OYntpCaDPBaZTr5_#2?AyGvnP+$vT3D-mKuRTJ{+%>Y@?bU1_V| z?+J)|x+(baa?ou+3NbdQiz@AP#7ULSE54i;@Lh8MeFf&mkx+*d(i|)YrX418_WEFc zIPu@v6?r*!^N#d}k9+%rXkscC_hfS9H~G3EyQ!cLBx`cxlL{=SHoyf!`D=T6sdm|&1BcUun{CgR0NitY4|@BRG3FkYB$8jG3(ju0rgyai;+q78-sntXYmgjpK1_@ z|DtqYk|SQu?$`ICZ+f)5_XUhsdB;4&K4Q{t6sVwjoP+K*H&{+rGm;apjzP-U*(Y6D zGo|lsl3R%IgSY{t23~in;dbh$Z^ZmFycM*{P0lh7hMPksIpTBXd$NPGSctxi7aZ{2YAkv zJ<5A|e`d`qiw=N$n$8{gHM3fLN`rg8zE|8v1;0Bzv0_xd<(^RQ-`aBEARY7aGA4hr zXce7V_Tt=_{rz=jQD_5L@;-30l(qUsH&#+I(yBcI)U zrTWbBzhl&YM{77nt4G<#1!fsOQ65-viDzFcLvuHBzp&rWY5@tC-1Xm5)4$c_{}U^b z$bIuEqtDqLy;v;w&7nOPyp!?eFeNLPRvr@Pp+2#GF?1PrO-6k}Sas`@JIa^Jg_!>t zw*ARP+#@8PZr?W$^|2tLOhCAdiQzNDc+}udES{UG-M&wjD6aEM)xXtid*t^5fsHbWo4BT-!DLG?VRHvTlw8 zI(<)xw#~vFFxOviY+wU!+nmzxbX)wDQEM|S8=9~A7tRAW;xrt=~nQ|6}1z4PX>JK%M^yX-@kaD&bO>a=-@MXOtr`31oI2$KH_Hx>J^Zv$kYf%@N5R; zWp_Wgq2}rnv2DWsR{A0}LrT9t1?;&3}@$yLD-k71$a)6{+Hl3xauarLv;RL`a zOhlPD+cq4~9mq$O?RA=`8C^JuHT+Nx$o#%`u%WAV0$p!f$oJ~5-@SB{N`+i-J$Dc73~1y_u>GPJ*M{qj-NW^H z^Z%HAQNTAV;ESHfaGN)yc+xkq1o4fQS3!`&vM}f$foj8_nzNw6cv#&WAWu(y&i}54 z7Z}j?ZkaMTt|k#|yEy1t@Cc=ZfVG)?TQz7|g!Dl$Cp37em4<_;EpjzS%YCY)xWQm& zKGsoR_A`x~FKS$cP(}&bH7plS)Q;Ply{-`CalhDA9)Ga4Q9g~zQnns|=jSRoY7*3? zVRz`%_@4tN#)@m`*g7@EsCJyu0SW}Ps~fTV8J{63P}^1E>*JNuODpg&eN>w!6Yr76 zXaW&I6Dl&)?W>6XzsnK^Xt4{t@NEg>6*sUF+V~(?R0S^s;Xyhe{4I}0s(g)f?I6tz zl~kC}BfSTUvW%Z=Pry4759}l;wJe&C(uWTw<2)gpl}GkzK# zMs7&Vh6fUbAsV%B)JgNRg^ca0QD4a@(bO2;nY6CG-@c~Vj!YDe3K=_$5u@H?W0qWs zfMymQXpIOW7j_y4C5@tjh*tWryE-4ITD^SC{x!Cyp1Qf*R%U1pCE%7c38EbE?rn4a z+kD1OU-%%!4?6D_G09Y2WlbJSA5?e;R`$0oOMOT3L9A_UQy4ee(JPrf^LeSGIXx%z zOvGC>1k<3&$eh}&+exrq5ih(^qLAFnLawa@DJK=lDx8`jTajiTO*0z2rt(jn@_L~b zzwy}L;Paheih?X{6lIbY1s!0MY4Lm?uXWPgu3rCTUi*T?GZ5j7smJ4Mn@|aeO**?1 z%F=ArIHUjZ9_RD`CQ99+hnk8s5N1}>d7HX4W5P8(9r=UN{5ywr!Tl>(c$n3zR#WR^ zp^ix6=%^QzCRFJXz01~yuM{8?!%cLlG0^!B%nJAl!Q5-h#Lnv(@<-y4h|U(_@>5Wo zZnWwm0+WKXDfJkpOj~}iMByh-SfQWb8)-g6*A{RwRy)=s`CC^H%j1U+Q6*FwNJm~= z`~50>mp2!>igl=3@+h z8;ui)LaR*&q^=%~Qaun}A$g#HHped&J;_%GZ~3Pv;Q6WZ&1KE~L<}LkC5LCVl^~Ui z!`n$u0ery>Ub9ek-^_3b^Fdn}yDBR(7x*X7gMv$4sBCRx7aqEsi8q7 z@&zdut1}H!vtwDx>07leYghlGdvs@UmeF2pG3S_`icq!yLDhO5sO|DS)F_xU^5HbD zqGQJr&U5f)I~q!=v13JPADwoss=d@DgF(Dpby3r96z#a^OnMO7(|zVUiZataw={$^ zpG!@A=Bn^4b+W1tqShU~HX6$iYx>N6bgVuX!a1)yDD8c3>ZZ}7+K0%0ib~5MAHKfb zA8RV|AZa$*_NwXgcykn7dvOa&)=p~o%^wtaKdl2i_Ppq@HLW=p&LPg?@!I`uuR;X@ znpOrIH~85UO`bniFt>k9Olb->J-LfDJ-|DS@Fk&mdNyLKqTso9z{9wjDV62W)fh_3A`iULAZFyiU{3OY43rBsV3%^Ao3Ntks>0 z1=eb0t`4`1T>3%VSM08qC%$?ZoHRkwC_v{vs$y^^?ffJTWI1h4lV3C7)T1(YCOC+;!Ix59_7Nl&b(@R_)c0lJQw z6mPI?YttiH(YK+{8`h|TQp*A0Ynlmr7gb(|uY*ZNxj8khPY0^E#vA;8oZv|Ubn0L6Y_VXHzZSiCcysw zN6!DuMgEs)`8u!+@Vav4Kf)Xje+QEC|1XcWS`F1(-N$Gx{Wt?>T~Tj)i?;h%6`{Wi z+-SAsqMHv=urMZfwah80f@S7OH>?0-@B1Sju+HZ*?${V6Ei3E@*aCJMwlQI&=9%K# zjE8PqFyUwCWLv5b29Gnv;2Nu~4IMSsF;CWn2BHRiS!(^x0PE-&#+p_~()nh+wAgD4 zR>LZ-uqp*ytV0Y{wE0RfF7n@-Q}Ie=FF!eldEGZQ58^a^EG>?%E}kD+P&YYhC-pqW zHyn0ir@FHiPmHtYKWeICzR%(L>WSWN-8nDBqIK9P%_L`DK}wR((XLr=Zi+M5QQ-nO zi&!?+4W~RDJAHr7M!Bs>YdhLp#U5DfA-$?Xv7GgfeOvW;1u2F4D8gDsUhv%Ho23c` zc)im6W<%$PHFq@-|K?%5M&5kf8YAM}4Tm5zHJ_44^Mt?L*#%Q7d9nqGdCrS-Ga3Fr z0zY~2rY&&G1e>vIs@&DxCHAkdp$s|XMv@|zmI%`W6|W?pY#dI=s-uN5g+IZ~ZU)bZ z*8e`BqIGHyo!80%S|}jv&|znio8@RjV33}h-}nx8sx*z3KcPG5-p3jDm@tO->N4EAy~z&$*M z690)Y2BDM~Hh}R@qK09N!AUOqRK@-tT^I47>cQ!k3KH*=oiS}jL4H-jQic?I;AqFj z&#f0U5#;q|q`~elWZz%SwqIdAk(F!VrI3x~>N(4ZPGV*cUcN>YB8bU3+TnqSr)6Pg zFCIqv*9eQY{CKJAR5*z~CcNyk=CP7iLckReWn}tRhDBQr%+*A6Vm(gR=5j)(6hu7wLQIFypO(rT3fve+k&Y7^eNAVC@&ycoN8ZLB+)R)Ri zh=EsyT@Gk1RZ&=+W2^^EMcW7B{qcvNNV(IRb##AVGxz1bTl0UTG94iFX}pjLkC5uh zFIHLt*k_wFwAXg}TJfTYp0{rwR-u1H7L^ojgT~!!aIb%x?c={NRz3zbH&;m;9ChL~ zk*Y+PwPC?PX}QrMyi#@Ji50=5p@(M7%N^y)v7o?eMP%#BsdD-<4P^oCUO)e5DH3o)avIY{S>+14W|+WN z(>E>0BsP4d{_CriXrpOrvH2r!F`hrY{a#kJg1*AjEZfZNF@{n4wm&{VNQedbl?s(y z4nAchfjUfgYg{14E@O|3q0@CN)y@n*o zh#t#$(-|ya4c@GRdZgQBa7SIaRC3#x#laO^X1la`yX;i7%8JmknZw&lIh1{SKzN`# zK~C`I{H1!1hr(=z1q2-8Xb7vHYHp1Qi@5zXs+y{7q>=kF!{hz??P=S?pDHx5rS2OA zn2OVMS54r`!*+IYUrgk4N-HS{joaw+AHVt6L`V~?A-`@IlM~Ax%@ZVTKCSSWIze2M zByB%{lCWoH`iP^LZhNX`e z=5vAqH-}E68$fG!ltmNEG6U^ooku4IT<)%WJ!_4`JujkC(CaP|&bp$f3VOwGlLEr0t}l*K#eUusP3byh=t8=j@}W(Y3*4li>=m9NsZO{;BJL!wY27 zjBBQlT7tCRy8+Fm(`FtuPgWX^jHXpLC0w_1@=Qn2e=DXwUMP&z<+;L&#NFObJWR`N zZAYs!dqM-BX$uvAuYXTf#jYFrQ6f3WSJkcidIkxMDk2X>?>u2MGWxJ>4xHNn8pQ{z`)sxtn2 zI_pZ86?w^D?>18cRU4eqvQX_ZlJq{#0)ganG;@;j3lug5j-ch2fQ$d|1&tflW{5<3 z_LoX?%KYy1)Y>$eY8p~4zQ=G^Q~Ptwi|PzE#~(2u{diz1G2K`Ju^b6BNz(%K-2S(|Ud9NKSL1}P^_#D56gzv$TM z0?e6RB`>wU;$qcAnQL>AVy}-R*P#{Bx`TWWFX&Ot@^;4*&A3{G#pX&h0R_Zq1@SKO z{QYTI(*saOF1ENWf69sJ;yEB&GUpZ*Sdo`tlJmH>wMo-FSxX)7h3|bbxVk7q`swG+ z$(}BiUsnIb1iA(^mBKVraSI+8pd^`Qb}wd{fltUS02KuF5MB#skN-zND_*sMlQLzZ zm{!9}>f0nL@~nrZt~2c}I-F};=+?dJY2>Khy7mbn&@Gi(b5mwDZdxK$emd09of z2fCNb634+$co3ba;Ir&ozn4_3B=+03w&zt%72Ej9L6YCc; zY@@>MP|eN|f?JIP?cUmlU>_9X1=F?a{7uf=1{6y}Qt?e!@v)%6;i<^J_{ZKfQOo^+ z328pVkYdr&lepD+k0YIJSX%W@8=W(kwPLmD9UC?fwayh5F{Z2fepa-*3yaaX5A*Yw zoy*t0&OX>R_cxD#pEj14*w?f_YwCjCHfZ4{S4;ArDr;(UA11yLZ}<4YzW!uw;BiIxAgd99`;Vl?DpXG z$ub6%m>iA4b3}rh_gajnSbB9mUb#4ZuibHV(jvJ*Ndv4TN&P^Um#g@raR~S$zEPDX zvKJ5|MmCi_)Z_e+%rtpz7bfhxDDA%8yKPZ1D!+t$+TM_7x<%oty;8-j2JZ{kagloc z{dp-#@YU4ab(k4gbDpJ{^eH5Mm?rF&X+Gyw$LP0y~0^q&V1MD4c|I#Y2Kmz#yTEHG^GDX@+lW^Qmq8x#MzpkV+hVXz0n} zBGlVLk)l!`S*`YSBzeB7TCz|yuZISb7`<9>R_oiE^I(?I6g56R6MY#a2+u3c*DJ^( z$WZ-1UIT(?>(cQ(P%2a48$+?T)yqpVL}l0ybdJZbll+2X&K}(u8$AbRB|H5V|3vGZ zJ6AdBF_QoXIGSpFne7!%LQacH(b)Zh3C(ofxZsbFp2fJ8WNs(h2eBS+-`Mdoo`Z}Py-U5=Rw5FW*Bn6h4>UTEu+igU9g2an zSOZ+o(P({2o^rlcXCUbQ*(9KMCmIsUrFgGYBV#B%tbjFv#Hm6(x!J;Qz9UpJC~5a} zin+TqM^#T=lYP2!As6($>gW^xZDD6@V}&UbWxkg@jpMxf+YKt13ZJ9!uau9{t@y)jK!Yc`e?^|MJ0H34cXg(gtd9!KuQlt$psAwIP=r`gyiqInd zBjHkeBO}cV-hlMi?|&buGi|0K2i9k8%JmLFCTevLbayq%cChDg<~SQ2oK#&H3Del8!~?R@sS%UD`pIH?G$#YIAf5|&%cz}bbi$DVV!TaoBi%He?K#fvE!{8rjM&dzN_MpN48=;&b_^k^4DM*A%MlcuZ!53C~7 z*wC@lGrvb^<$6%fBEabL{gm^^aXql1wf4B+ElRa*phqMcq<~TUU(;a}Cp;Ep# z>>@}`3l};Lw$shZ-qKHH7u0MB-YDhh^@~$!yhTMXN*j7RLUHrDK=7<_(+=r<1L~Iw zXrf9vHuF0fT~t%BCSNm*HZy!`u0yV`&E#{Q|CA#Tld1?38Rghpf26ac_KHV7>y2H6 z@ic~8X01qxX)rrm`(TsC-_sJk{hu0kM$SEP4Z}n%Md}`<0u^hfQxX-W&r2SiC}iyP zW=DQ1OgoDkdxuq9UPVYvvXZJQrk`f^7@H)Ki^UjUK>S;@&g}aaS(J7knt(h4ts&NQeX+rw+te9@k3Sup65w(P%qBFpzAqm9_+dy#twYhZIH|FK>FjBZ)J`URy_# z0B&es^+CYtzPyf~|Dsm`eE#>p|DzCb@zSNeYY$%^?fYtpuRifL6uzW_uc7cY6uySS z*HHKh3xH#euK?*QRQ!?(zJlhjq3|^nzJ|h{1-|YIUlHD=DZzh1s>Q+?^qZ~p})p4BP< literal 0 HcmV?d00001 diff --git a/labs/submission6.md b/labs/submission6.md new file mode 100644 index 00000000..6ad7f8c6 --- /dev/null +++ b/labs/submission6.md @@ -0,0 +1,345 @@ +# Lab 6 + +## Task 1 + +### 1.1 + + +Output of `docker ps -a`: +```bash +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +a9155cc5a1e9 deployment-app "streamlit run app.p…" 13 days ago Exited (0) 12 days ago deployment-app-1 +e2f0955e638c deployment-api "uvicorn main:app --…" 13 days ago Exited (0) 12 days ago deployment-api-1 +``` +Output of `docker images`: +```bash +REPOSITORY TAG IMAGE ID CREATED SIZE +ubuntu latest 728785b59223 6 days ago 117MB +``` +**Image size and layer count:** + +- 117MB - image size + +- layer count: + ```bash + IMAGE CREATED CREATED BY SIZE COMMENT + 728785b59223 6 days ago /bin/sh -c #(nop) CMD ["/bin/bash"] 0B + 6 days ago /bin/sh -c #(nop) ADD file:d9cb8116905a82675… 87.6MB + 6 days ago /bin/sh -c #(nop) LABEL org.opencontainers.… 0B + 6 days ago /bin/sh -c #(nop) LABEL org.opencontainers.… 0B + 6 days ago /bin/sh -c #(nop) ARG LAUNCHPAD_BUILD_ARCH 0B + 6 days ago /bin/sh -c #(nop) ARG RELEASE 0B + ``` + +--- + +**Inside the container:** +```bash +root@b64552cf3c1f:/# cat /etc/os-release +PRETTY_NAME="Ubuntu 24.04.3 LTS" +NAME="Ubuntu" +VERSION_ID="24.04" +VERSION="24.04.3 LTS (Noble Numbat)" +VERSION_CODENAME=noble +ID=ubuntu +ID_LIKE=debian +HOME_URL="https://www.ubuntu.com/" +SUPPORT_URL="https://help.ubuntu.com/" +BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" +PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy" +UBUNTU_CODENAME=noble +LOGO=ubuntu-logo +root@b64552cf3c1f:/# ps aux +USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND +root 1 0.1 0.0 4588 3072 pts/0 Ss 12:48 0:00 /bin/bash +root 10 0.0 0.0 7888 3968 pts/0 R+ 12:48 0:00 ps aux +``` + + +### 1.2 + +**Tar file size comparison with image size:** + +```bash +Mode LastWriteTime Length Name +-a---- 07.10.2025 15:50 29740544 ubuntu_image.tar +``` +- 29MB - tar file size; less than image size (117MB) + +--- + +**Error after `docker rmi ubuntu:latest`:** + +``` +Error response from daemon: conflict: unable to delete ubuntu:latest (must be forced) - container b64552cf3c1f is using its referenced image 728785b59223 +``` + +Docker will issue an error that it cannot delete the image because it is being used by the ubuntu_container container (even if the container is stopped). + +--- + +**Why does image removal fail when a container exists?** + +Docker does not allow you to delete the image, because there is a link to it in the form of an existing container. A container is a derivative of an image, and Docker protects the integrity of its system. + +--- +**What is included in the exported tar file?** + +Complete (full) copy of the image with all its layers and metadata + + +## Task 2 + +### 2.1 + +**Screenshot and output of original Nginx welcome page:** + +![alt text](image.png) + +`curl http://localhost` + +```bash +StatusCode : 200 +StatusDescription : OK +Content : + + + Welcome to nginx! + + + +

+ + + ZAP Scanning Report +

+

+ + +

+ + Site: http://host.docker.internal:3000 + +

+ +

+ Generated on Mon, 27 Oct 2025 07:56:13 +

+ +

+ ZAP Version: 2.16.1 +

+ +

+ ZAP by Checkmarx +

+ + +

Summary of Alerts

+ + + + + + + + + + + + + + + + + + + + + + + + + +
Risk LevelNumber of Alerts
+
High
+ 		+
0
+
+
Medium
+ 		+
2
+
+
Low
+ 		+
5
+
+
Informational
+ 		+
4
+
+
False Positives:
+ 		+
0
+
+
+ + + + +

Summary of Sequences

+

For each step: result (Pass/Fail) - risk (of highest alert(s) for the step, if any).

+ + + + + + +

Alerts

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
NameRisk LevelNumber of Instances
Content Security Policy (CSP) Header Not SetMedium11
Cross-Domain MisconfigurationMedium11
Cross-Domain JavaScript Source File InclusionLow10
Dangerous JS FunctionsLow2
Deprecated Feature Policy Header SetLow13
Insufficient Site Isolation Against Spectre VulnerabilityLow12
Timestamp Disclosure - UnixLow9
Information Disclosure - Suspicious CommentsInformational2
Modern Web ApplicationInformational11
Storable and Cacheable ContentInformational2
Storable but Non-Cacheable ContentInformational9
+
+ + + +

Alert Detail

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Medium
Content Security Policy (CSP) Header Not Set
Description +
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
+ +
URLhttp://host.docker.internal:3000
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/ftp
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/ftp/coupons_2013.md.bak
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/ftp/eastere.gg
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/ftp/encrypt.pyc
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/ftp/package-lock.json.bak
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/ftp/package.json.bak
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/ftp/suspicious_errors.yml
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/layer.js:95:5
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter
Attack
Evidence
Other Info
Instances11
Solution +
Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP +
+ + https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html +
+ + https://www.w3.org/TR/CSP/ +
+ + https://w3c.github.io/webappsec-csp/ +
+ + https://web.dev/articles/csp +
+ + https://caniuse.com/#feat=contentsecuritypolicy +
+ + https://content-security-policy.com/ + +
CWE Id693
WASC Id15
Plugin Id10038
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Medium
Cross-Domain Misconfiguration
Description +
Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS) misconfiguration on the web server.
+ +
URLhttp://host.docker.internal:3000
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/assets/public/favicon_js.ico
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/ftp
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/main.js
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/polyfills.js
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/robots.txt
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/runtime.js
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/styles.css
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
URLhttp://host.docker.internal:3000/vendor.js
MethodGET
Parameter
Attack
EvidenceAccess-Control-Allow-Origin: *
Other InfoThe CORS misconfiguration on the web server permits cross-domain read requests from arbitrary third party domains, using unauthenticated APIs on this domain. Web browser implementations do not permit arbitrary third parties to read the response from authenticated APIs, however. This reduces the risk somewhat. This misconfiguration could be used by an attacker to access data that is available in an unauthenticated manner, but which uses some other form of security, such as IP address white-listing.
Instances11
Solution +
Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-listing, for instance).
+
+ +
Configure the "Access-Control-Allow-Origin" HTTP header to a more restrictive set of domains, or remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy (SOP) in a more restrictive manner.
+ +
Reference + https://vulncat.fortify.com/en/detail?category=HTML5&subcategory=Overly%20Permissive%20CORS%20Policy + +
CWE Id264
WASC Id14
Plugin Id10098
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Cross-Domain JavaScript Source File Inclusion
Description +
The page includes one or more script files from a third-party domain.
+ +
URLhttp://host.docker.internal:3000
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://host.docker.internal:3000
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
Other Info
URLhttp://host.docker.internal:3000/
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://host.docker.internal:3000/
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
Other Info
URLhttp://host.docker.internal:3000/juice-shop/build/routes/fileServer.js:59:18
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://host.docker.internal:3000/juice-shop/build/routes/fileServer.js:59:18
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
Other Info
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/layer.js:95:5
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/layer.js:95:5
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
Other Info
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other Info
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
Other Info
Instances10
Solution +
Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
+ +
Reference
CWE Id829
WASC Id15
Plugin Id10017
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Dangerous JS Functions
Description +
A dangerous JS function seems to be in use that would leave the site vulnerable.
+ +
URLhttp://host.docker.internal:3000/main.js
MethodGET
Parameter
Attack
EvidencebypassSecurityTrustHtml(
Other Info
URLhttp://host.docker.internal:3000/vendor.js
MethodGET
Parameter
Attack
EvidencebypassSecurityTrustHtml(
Other Info
Instances2
Solution +
See the references for security advice on the use of these functions.
+ +
Reference + https://v17.angular.io/guide/security + +
CWE Id749
WASC Id
Plugin Id10110
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Deprecated Feature Policy Header Set
Description +
The header has now been renamed to Permissions-Policy.
+ +
URLhttp://host.docker.internal:3000
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/ftp
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/ftp/eastere.gg
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/ftp/encrypt.pyc
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/ftp/package-lock.json.bak
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/ftp/package.json.bak
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/ftp/suspicious_errors.yml
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/main.js
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/polyfills.js
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/runtime.js
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
URLhttp://host.docker.internal:3000/vendor.js
MethodGET
Parameter
Attack
EvidenceFeature-Policy
Other Info
Instances13
Solution +
Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header instead of the Feature-Policy header.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy +
+ + https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/ + +
CWE Id16
WASC Id15
Plugin Id10063
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Insufficient Site Isolation Against Spectre Vulnerability
Description +
Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
+ +
URLhttp://host.docker.internal:3000
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/ftp
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/index.js:365:14
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/layer.js:95:5
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
ParameterCross-Origin-Embedder-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/ftp
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/index.js:365:14
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/layer.js:95:5
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
ParameterCross-Origin-Opener-Policy
Attack
Evidence
Other Info
Instances12
Solution +
Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.
+
+ +
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy + +
CWE Id693
WASC Id14
Plugin Id90004
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Timestamp Disclosure - Unix
Description +
A timestamp was disclosed by the application/web server. - Unix
+ +
URLhttp://host.docker.internal:3000
MethodGET
Parameter
Attack
Evidence1650485437
Other Info1650485437, which evaluates to: 2022-04-20 20:10:37.
URLhttp://host.docker.internal:3000
MethodGET
Parameter
Attack
Evidence1981395349
Other Info1981395349, which evaluates to: 2032-10-14 19:35:49.
URLhttp://host.docker.internal:3000
MethodGET
Parameter
Attack
Evidence2038834951
Other Info2038834951, which evaluates to: 2034-08-10 15:02:31.
URLhttp://host.docker.internal:3000/
MethodGET
Parameter
Attack
Evidence1650485437
Other Info1650485437, which evaluates to: 2022-04-20 20:10:37.
URLhttp://host.docker.internal:3000/
MethodGET
Parameter
Attack
Evidence1981395349
Other Info1981395349, which evaluates to: 2032-10-14 19:35:49.
URLhttp://host.docker.internal:3000/
MethodGET
Parameter
Attack
Evidence2038834951
Other Info2038834951, which evaluates to: 2034-08-10 15:02:31.
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter
Attack
Evidence1650485437
Other Info1650485437, which evaluates to: 2022-04-20 20:10:37.
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter
Attack
Evidence1981395349
Other Info1981395349, which evaluates to: 2032-10-14 19:35:49.
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter
Attack
Evidence2038834951
Other Info2038834951, which evaluates to: 2034-08-10 15:02:31.
Instances9
Solution +
Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
+ +
Reference + https://cwe.mitre.org/data/definitions/200.html + +
CWE Id497
WASC Id13
Plugin Id10096
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Information Disclosure - Suspicious Comments
Description +
The response appears to contain suspicious comments which may help an attacker.
+ +
URLhttp://host.docker.internal:3000/main.js
MethodGET
Parameter
Attack
Evidencequery
Other InfoThe following pattern was used: \bQUERY\b and was detected in likely comment: "//owasp.org' target='_blank'>Open Worldwide Application Security Project (OWASP)</a> and is developed and maintained by voluntee", see evidence field for the suspicious comment/snippet.
URLhttp://host.docker.internal:3000/vendor.js
MethodGET
Parameter
Attack
EvidenceQuery
Other InfoThe following pattern was used: \bQUERY\b and was detected in likely comment: "//www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M0 256C0 397.4 114.6 512 256 512s256-114.6 256-256S397.4 0 256 0S0 114.6 0", see evidence field for the suspicious comment/snippet.
Instances2
Solution +
Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.
+ +
Reference
CWE Id615
WASC Id13
Plugin Id10027
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Modern Web Application
Description +
The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
+ +
URLhttp://host.docker.internal:3000
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/juice-shop/build/routes/fileServer.js:43:13
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/juice-shop/build/routes/fileServer.js:59:18
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/index.js:286:9
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/index.js:328:13
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/index.js:365:14
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/index.js:376:14
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/index.js:421:3
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/juice-shop/node_modules/express/lib/router/layer.js:95:5
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter
Attack
Evidence<script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
Instances11
Solution +
This is an informational alert and so no changes are required.
+ +
Reference
CWE Id
WASC Id
Plugin Id10109
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Storable and Cacheable Content
Description +
The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where "shared" caching servers such as "proxy" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
+ +
URLhttp://host.docker.internal:3000/ftp
MethodGET
Parameter
Attack
Evidence
Other InfoIn the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.
URLhttp://host.docker.internal:3000/robots.txt
MethodGET
Parameter
Attack
Evidence
Other InfoIn the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.
Instances2
Solution +
Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
+
+ +
Cache-Control: no-cache, no-store, must-revalidate, private
+
+ +
Pragma: no-cache
+
+ +
Expires: 0
+
+ +
This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
+ +
Reference + https://datatracker.ietf.org/doc/html/rfc7234 +
+ + https://datatracker.ietf.org/doc/html/rfc7231 +
+ + https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html + +
CWE Id524
WASC Id13
Plugin Id10049
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Storable but Non-Cacheable Content
Description +
The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.
+ +
URLhttp://host.docker.internal:3000
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://host.docker.internal:3000/
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://host.docker.internal:3000/assets/public/favicon_js.ico
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://host.docker.internal:3000/main.js
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://host.docker.internal:3000/polyfills.js
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://host.docker.internal:3000/runtime.js
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://host.docker.internal:3000/sitemap.xml
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://host.docker.internal:3000/styles.css
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
URLhttp://host.docker.internal:3000/vendor.js
MethodGET
Parameter
Attack
Evidencemax-age=0
Other Info
Instances9
Solution
Reference + https://datatracker.ietf.org/doc/html/rfc7234 +
+ + https://datatracker.ietf.org/doc/html/rfc7231 +
+ + https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html + +
CWE Id524
WASC Id13
Plugin Id10049
+
+ + + + + +

Sequence Details

+ With the associated active scan results. + + + +
+ + + + + + + From 5cc2e18ab084b6f08f596901acd833b7908c486a Mon Sep 17 00:00:00 2001 From: Aleliya Date: Sun, 9 Nov 2025 18:14:03 +0300 Subject: [PATCH 16/16] docs: add lab10 submission --- labs/submission10.md | 213 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 213 insertions(+) create mode 100644 labs/submission10.md diff --git a/labs/submission10.md b/labs/submission10.md new file mode 100644 index 00000000..3dbe6f89 --- /dev/null +++ b/labs/submission10.md @@ -0,0 +1,213 @@ +# Lab 10 + +## Task 1 + +**AWS** +- Service name: + + - AWS CodeArtifact +- Supported artifact types: + + - Maven, Gradle (Maven), npm, yarn, pip, Twine and NuGet +- Key features: + + - Integration with AWS IAM for detailed access control + - Detailed IAM policies for managing read/write permissions + - There is no automatic geo-replication, but you can create repositories in different regions and configure cross-region replication + - It can act as a proxy for public repositories + +- Integration capabilities: + + - Direct integration with AWS CodeBuild, CodePipeline for building and deploying applications + - Deep integration with AWS Identity and Access Management (IAM) for authentication and authorization + - It also integrates with AWS CloudWatch (activity monitoring) and AWS KMS (encryption of artifacts on the server) +- Common use cases: + + - Centralized storage of binary artifacts for CI/CD pipelines + - Caching of public dependencies to speed up builds and increase reliability + - Dependency management for multidisciplinary projects in one place + +--- +**GCP** + +- Service name: + + - Artifact Registry +- Supported artifact types: + + - Container images (Docker), Maven, npm, Python, universal artifacts (any files) +- Key features: + + - Scanning container images for vulnerabilities using Binary Authorization + - Support for multi-regional repositories for container images, which ensures high availability and low latency + - Detailed control via IAM roles + - The ability to configure rules that prevent image tags from being overwritten + - Protection against data leakage + +- Integration capabilities: + + - Direct integration with Azure Kubernetes Service for container deployment + - Using ACR as an image source for CI/CD + - Azure App Service, Azure Batch for deploying container applications +- Common use cases: + + - Storage and management of container images for AKS and other Azure services + - Automating container assembly and lifecycle management using ACR Tasks + +--- +**Microsoft Azure** + +- Service name: + + - Azure Container Registry (ACR) +- Supported artifact types: + + - Container images (Docker), Helm charts +- Key features: + + - Scanning images for vulnerabilities + - Automatic replication of registries between regions + - Detailed control via Azure RBAC. It also supports anonymous access (pull) via tokens + - Allows you to automate the assembly, testing, and application of patches to container images in Azure + +- Integration capabilities: + + - Direct and seamless integration with Google Kubernetes Engine, Cloud Run for container deployment + - Cloud Build is the main CI/CD service that can push/pull artifacts from Artifact Registry + - Deep integration with Cloud Deployment Manager, IAM for access management and deployment +- Common use cases: + + - Storage and management of container images for GKE and Cloud Run + - Dependency management for applications running on Google Cloud + - Creating secure software supply chains with vulnerability testing + - Hosting OS repositories for virtual machines + + +--- +**Comparison table highlighting similarities and differences** + +| Feature | **AWS CodeArtifact** | **Artifact Registry** | **Azure Container Registry** | +| :--- | :--- | :--- | :--- | +| **Primary Focus** | Universal repository for libraries and packages(Maven, npm, Python) | Universal repository with strong focus on containers | Specialized registry for containers and Helm charts | +| **Supported Artifacts** | Wide range of packages(Maven, npm, Python, NuGet) | Containers, packages(Maven, npm, Python), OS packages, universal artifacts | Primarily containers and Helm charts | +| **Geo-Replication** | Manual setup(via repositories in different regions) | Built-in for containers(multi-region) | Built-in only at Premium tier | +| **Vulnerability Scanning** | Built-in for supported packages | Built-in for containers(additional cost) | Built-in for containers(included in all tiers) | +| **Ecosystem Integration** | Excellent integration with AWS CodeBuild/CodePipeline | Excellent integration with GKE, Cloud Run, Cloud Build | Excellent integration with AKS, Azure Pipelines | +| **Unique Features** | "Domains" concept for repository grouping | Support for OS package repositories | ACR Tasks for container automation | +| **Pricing Model** | Storage + operations + traffic | Storage + operations + scanning fee | Subscription tiers(Basic, Standard, Premium) + overage charges | + +--- +**Which registry service would you choose for a multi-cloud strategy and why?** + + +For a multi-cloud strategy, I would choose `GCP Artifact Registry` because it supports the largest number of artifact types (not just containers), which gives more flexibility for different projects and teams. + + + +## Task 2 + +**AWS** + +- Service Name: + - AWS Lambda (The core FaaS offering) + - AWS Fargate (Serverless containers) + +- Key Features and Capabilities + - Integrates deeply with over 200 AWS services like S3, DynamoDB, API Gateway, and EventBridge + - Automatically scales from zero to thousands of concurrent executions + - For sharing code and data across multiple functions + - For configuring asynchronous invocation results + - For orchestrating complex workflows involving multiple Lambdas + - For keeping functions initialized and responsive to avoid cold starts + +- Supported Runtimes and Languages + - Native Runtimes: Node.js, Python, Ruby, Java, Go, .NET (C#/PowerShell) + - Custom Runtimes: Allows using any programming language by providing a custom runtime (e.g., Rust, PHP, Elixir) + +--- +**GCP** +- Service Name: + - Google Cloud Functions (The core FaaS offering) + - Google Cloud Run (Serverless containers) + - App Engine (Serverless application platform) + +- Key Features and Capabilities + - Triggers from Google Cloud services (Pub/Sub, Storage, Firestore) and HTTP via Cloud Endpoints + - Automatically scales based on incoming request volume + - Newer generation offering improved performance, longer request timeouts, and deeper integration with Cloud Run and Eventarc + - Provides a consistent way to route events from Google Cloud, SaaS, and on-premises systems + +- Supported Runtimes and Languages + - Native Runtimes: Node.js, Python, Go, Java, .NET, Ruby, PHP + - Custom Runtimes: Supported through container images on Cloud Run, allowing any language, library, or binary + +--- +**Azure** +- Service Name: + - Azure Functions (The core FaaS offering) + - Azure Container Instances (ACI) (Serverless containers) + - Azure Logic Apps (Serverless workflow orchestration) + +- Key Features and Capabilities + - Triggers from Azure services (Blob Storage, Cosmos DB, Service Bus) and HTTP + - Built-in autoscaling based on triggers + - An extension for building stateful, orchestrated workflows in a serverless environment + - Consumption Plan (pure serverless), Premium Plan (enhanced performance, VNet integration), and Dedicated (App Service) Plan + +- Supported Runtimes and Languages + - Native Runtimes: C#, Java, JavaScript/Node.js, Python, PowerShell + - Custom Runtimes: Supported via Custom Handlers, allowing any language that supports HTTP primitives + + +--- +**Pricing Comparison** + +| Provider | Pricing Model | +| :--- | :--- | +| **AWS** | Pay per request + Compute duration. Free tier includes 1M requests and 400,000 GB-s per month. | +| **GCP** | Pay per request + Compute duration, Memory, and CPU. Free tier includes 2M requests, 400,000 GB-s, and 200,000 GHz-s. | +| **Azure** | Pay per request + Compute duration. Free tier includes 1M requests and 400,000 GB-s per month. | + +--- +**Performance Characteristics** + +- Cold Starts: All providers experience "cold starts". This is most noticeable with VMs requiring just-in-time compilation. + - AWS & Azure: Offer "Provisioned Concurrency" (AWS) and "Premium Plan" (Azure) to pre-warm instances and mitigate cold starts + - GCP: Cloud Functions Gen 2 and Cloud Run generally have improved cold start performance over their first-generation counterparts. +- Execution Timeout: + - AWS Lambda: 15 minutes (max) + - GCP Cloud Functions: 60 minutes for Gen 2, 9 minutes for Gen 1 (max) + - Azure Functions: 5 minutes (Consumption Plan), unbounded in Premium/Dedicated plans + +Concurrency: All providers handle massive concurrency by default, though AWS allows for reserved concurrency per function to guarantee a minimum level of scale. + +--- +**Comparison Table** + +| Feature | AWS Lambda | GCP Cloud Functions | Azure Functions | +| :--- | :--- | :--- | :--- +| **Max Timeout** | 15 min | 60 min (Gen 2) | 5 min (Consumption) / Unlimited (Premium) | +| **Stateful Workflows** | Step Functions | Workflows | Durable Functions | +| **VPC Access** | Yes (slower cold starts) | Yes (Serverless VPC Access) | Yes (Premium Plan) | +| **Cold Start Mitigation** | Provisioned Concurrency | Improved in Gen 2 | Premium Plan | +| **Container Support** | Lambda Container Image | Cloud Run | Custom Handlers, Container-based Functions | +| **Key Integration Ecosystem** | Huge, native with 200+ AWS services | Strong with Google services, Firebase | Deep integration with Microsoft ecosystem | +| **Typical Use Case** | Event-driven microservices, API backends, data processing | Event processing, lightweight APIs, mobile backends (Firebase) | Enterprise integrations, event-driven apps, complex orchestration | + +--- +**Which serverless platform would you choose for a REST API backend and why?** + +For the REST API, I would choose `AWS Lambda`. The reason is the maximum execution time (15 minutes), which is suitable for API requests that may require long calculations. In addition, Lambda has the most mature ecosystem and a rich set of integration events. + +--- +**What are the main advantages and disadvantages of serverless computing?** + +Advantages: +- There is no need to manage servers +- Automatic scaling +- Payment is only for actual use (it may be cheaper for non-permanent loads) + +Disadvantages: +- "Cold start" (delay on the first call) +- Time limits for the function execution +- The risk of "Vendor Lock-in" when the code is tailored to the services of the same cloud \ No newline at end of file