From 444e7a0044103348e545f6ce173fd34ce55026b6 Mon Sep 17 00:00:00 2001
From: Justin Vreeland <justin.vreeland@chainguard.dev>
Date: Wed, 28 Aug 2024 17:15:05 -0400
Subject: [PATCH] Update the python convert script for multiple versions of
 python.

To do this add data and vars to use for substitution as well as a
subapckage and remove the unversioned python dep since it will be
generated correctly as part of the build.
---
 pkg/convert/python/e2e_test.go                |  45 +++++---
 pkg/convert/python/python.go                  | 100 ++++++++++++++++--
 pkg/convert/python/python_test.go             |  17 +--
 .../generated/x86_64/shbang-test-1-r1.apk     | Bin 4522 -> 4593 bytes
 4 files changed, 131 insertions(+), 31 deletions(-)

diff --git a/pkg/convert/python/e2e_test.go b/pkg/convert/python/e2e_test.go
index f8143c6cc..678aade97 100644
--- a/pkg/convert/python/e2e_test.go
+++ b/pkg/convert/python/e2e_test.go
@@ -50,6 +50,7 @@ func TestGenerateManifest(t *testing.T) {
 		assert.EqualValues(t, got.Package.Epoch, 0)
 		assert.Equal(t, got.Package.Description, "Low-level, data-driven core of boto 3.")
 		assert.Equal(t, got.Package.Dependencies.Runtime, []string{"py" + versions[i] + "-jmespath", "py" + versions[i] + "-python-dateutil", "py" + versions[i] + "-urllib3", "python-" + versions[i]})
+		assert.Equal(t, "0", got.Package.Dependencies.ProviderPriority)
 
 		// Check Package.Copyright
 		assert.Equal(t, len(got.Package.Copyright), 1)
@@ -60,17 +61,40 @@ func TestGenerateManifest(t *testing.T) {
 			"build-base",
 			"busybox",
 			"ca-certificates-bundle",
+			"py3-supported-pip",
 			"wolfi-base",
 		})
 
 		// Check Pipeline
-		assert.Equal(t, len(got.Pipeline), 3)
+		assert.Equal(t, 1, len(got.Pipeline))
 
 		// Check Pipeline - fetch
 		assert.Equal(t, got.Pipeline[0].Uses, "fetch")
 
+		// Check Subpackages
+		assert.Equal(t, "py-versions", got.Subpackages[0].Range)
+		assert.Equal(t, "py3-${{vars.pypi-package}}", got.Subpackages[0].Dependencies.Provides[0])
+		assert.Equal(t, "py/pip-build-install", got.Subpackages[0].Pipeline[0].Uses)
+		var expectedRuntimeDeps []string = []string{
+			"py3.10-jmespath",
+			"py3.10-python-dateutil",
+			"py3.10-urllib3",
+			"python-3.10",
+		}
+		// Subpackages aren't added to this array in the same order every time causing spurious
+		// test failues. To fix this Just check what is seen and replace the deps with the version string.
+		var replacementPyVersion = got.Subpackages[0].Dependencies.Runtime[0][2:6]
+		for idx, dep := range expectedRuntimeDeps {
+			expectedRuntimeDeps[idx] = strings.Replace(dep, "3.10", replacementPyVersion, 1)
+		}
+
+		assert.Equal(t, expectedRuntimeDeps, got.Subpackages[0].Dependencies.Runtime)
+		assert.Equal(t, "${{range.value}}", got.Subpackages[0].Dependencies.ProviderPriority)
 		releases, ok := pythonctx.Package.Releases[pythonctx.PackageVersion]
 
+		assert.Equal(t, "python/import", got.Subpackages[0].Test.Pipeline[0].Uses)
+		assert.Equal(t, "${{vars.module_name}}", got.Subpackages[0].Test.Pipeline[0].With["import"])
+
 		// If the key exists
 		assert.True(t, ok)
 
@@ -89,9 +113,6 @@ func TestGenerateManifest(t *testing.T) {
 			"uri":             strings.ReplaceAll(tempURI, pythonctx.PackageVersion, "${{package.version}}"),
 		})
 
-		// Check Pipeline - runs
-		assert.Equal(t, got.Pipeline[1].Uses, "python/build-wheel")
-		assert.Equal(t, got.Pipeline[2].Uses, "strip")
 	}
 }
 
@@ -117,11 +138,8 @@ func TestGenerateManifestPreserveURI(t *testing.T) {
 		assert.Equal(t, got.Package.Description,
 			"Backported and Experimental Type Hints for Python 3.8+",
 		)
-		assert.Equal(t, got.Package.Dependencies.Runtime,
-			[]string{
-				"python-" + versions[i],
-			},
-		)
+		assert.Equal(t, []string{}, got.Package.Dependencies.Runtime)
+		assert.Equal(t, "0", got.Package.Dependencies.ProviderPriority)
 
 		// Check Package.Copyright
 		assert.Equal(t, len(got.Package.Copyright), 1)
@@ -132,11 +150,12 @@ func TestGenerateManifestPreserveURI(t *testing.T) {
 			"build-base",
 			"busybox",
 			"ca-certificates-bundle",
+			"py3-supported-pip",
 			"wolfi-base",
 		})
 
 		// Check Pipeline
-		assert.Equal(t, len(got.Pipeline), 3)
+		assert.Equal(t, 1, len(got.Pipeline))
 
 		// Check Pipeline - fetch
 		assert.Equal(t, got.Pipeline[0].Uses, "fetch")
@@ -160,8 +179,8 @@ func TestGenerateManifestPreserveURI(t *testing.T) {
 			"uri":             "https://files.pythonhosted.org/packages/df/db/f35a00659bc03fec321ba8bce9420de607a1d37f8342eee1863174c69557/typing_extensions-${{package.version}}.tar.gz",
 		})
 
-		// Check Pipeline - runs
-		assert.Equal(t, got.Pipeline[1].Uses, "python/build-wheel")
-		assert.Equal(t, got.Pipeline[2].Uses, "strip")
+		// Check Tests
+		assert.Equal(t, "python/import", got.Test.Pipeline[0].Uses)
+		assert.Equal(t, "${{vars.module_name}}", got.Test.Pipeline[0].With["import"])
 	}
 }
diff --git a/pkg/convert/python/python.go b/pkg/convert/python/python.go
index c73f4da46..28ba96e95 100644
--- a/pkg/convert/python/python.go
+++ b/pkg/convert/python/python.go
@@ -273,7 +273,11 @@ func (c *PythonContext) generateManifest(ctx context.Context, pack Package, vers
 	// Generate each field in the manifest
 	generated.GeneratedFromComment = pack.Info.ProjectURL
 	generated.Package = c.generatePackage(ctx, pack, version)
+	generated.Data = c.generateRange(ctx)
+	generated.Vars = c.generateVars(pack)
+	generated.Subpackages = c.generateSubpackages(ctx, pack)
 	generated.Environment = c.generateEnvironment(ctx, pack)
+	generated.Test = c.generateTest(ctx, pack)
 
 	pipelines, err := c.generatePipeline(ctx, pack, version, ghVersions)
 	if err != nil {
@@ -333,8 +337,6 @@ func (c *PythonContext) generatePackage(ctx context.Context, pack Package, versi
 
 	log.Infof("[%s] Run time Deps %v", pack.Info.Name, pack.Dependencies)
 
-	pack.Dependencies = append(pack.Dependencies, "python-"+c.PythonVersion)
-
 	pkg := config.Package{
 		Name:        fmt.Sprintf("py%s-%s", c.PythonVersion, pack.Info.Name),
 		Version:     version,
@@ -342,7 +344,8 @@ func (c *PythonContext) generatePackage(ctx context.Context, pack Package, versi
 		Description: pack.Info.Summary,
 		Copyright:   []config.Copyright{},
 		Dependencies: config.Dependencies{
-			Runtime: pack.Dependencies,
+			Runtime:          pack.Dependencies,
+			ProviderPriority: "0",
 		},
 	}
 
@@ -363,6 +366,7 @@ func (c *PythonContext) generateEnvironment(ctx context.Context, pack Package) a
 		"build-base",
 		"busybox",
 		"ca-certificates-bundle",
+		"py3-supported-pip",
 		"wolfi-base",
 	}
 
@@ -455,16 +459,90 @@ func (c *PythonContext) generatePipeline(ctx context.Context, pack Package, vers
 		})
 	}
 
-	pythonBuild := config.Pipeline{
-		Name: "Python Build",
-		Uses: "python/build-wheel",
+	return pipeline, nil
+}
+
+// generateVars handles generated variables for multi version python generateSubpackages
+func (c *PythonContext) generateRange(ctx context.Context) []config.RangeData {
+	return []config.RangeData{{
+		Name: "py-versions",
+		Items: map[string]string{
+			"3.10": "310",
+			"3.11": "311",
+			"3.12": "312",
+		}},
 	}
+}
 
-	strip := config.Pipeline{
-		Uses: "strip",
+// Generate the vars for pypi package name and pip
+// Set pypi-package and module_name to the same value because it's the most common case.
+// Someone else can fix it up if the build fails
+func (c *PythonContext) generateVars(pack Package) map[string]string {
+	return map[string]string{
+		"pypi-package": pack.Info.Name,
+		"module_name":  pack.Info.Name,
 	}
-	pipeline = append(pipeline, pythonBuild)
-	pipeline = append(pipeline, strip)
+}
 
-	return pipeline, nil
+// generateSubpackages handles generating suibpackages field of the melange manifest
+func (c *PythonContext) generateSubpackages(ctx context.Context, pack Package) []config.Subpackage {
+	log := clog.FromContext(ctx)
+
+	log.Infof("[%s] Generating Subpackages", pack.Info.Name)
+
+	importTest := config.Test{
+		Pipeline: []config.Pipeline{config.Pipeline{
+			Name: "Import Test",
+			Uses: "python/import",
+			With: map[string]string{
+				"python": "python${{range.key}}",
+				"import": "${{vars.module_name}}",
+			},
+		},
+		},
+	}
+
+	pythonSubpackages := config.Subpackage{
+		Range: "py-versions",
+		Name:  "py${{range.key}}-${{vars.pypi-package}}",
+		Dependencies: config.Dependencies{
+			Runtime:          pack.Dependencies,
+			Provides:         []string{"py3-${{vars.pypi-package}}"},
+			ProviderPriority: "${{range.value}}",
+		},
+		Pipeline: []config.Pipeline{config.Pipeline{
+			Name: "Python Build",
+			Uses: "py/pip-build-install",
+			With: map[string]string{
+				"python": "python${{range.key}}",
+			},
+		},
+		},
+		Test: &importTest,
+	}
+
+	return []config.Subpackage{pythonSubpackages}
+}
+
+// generate file-level package test.  When building python packages for multiple
+// python versions we want to ensure that we don't generate -support packages with
+// contents in /bin as well as ensuring that people installing the unversioned package
+// receive on and only one version of the library
+func (c *PythonContext) generateTest(ctx context.Context, pack Package) *config.Test {
+	log := clog.FromContext(ctx)
+
+	log.Infof("[%s] Generating Tests", pack.Info.Name)
+
+	importTest := config.Test{
+		Pipeline: []config.Pipeline{config.Pipeline{
+			Name: "Import Test",
+			Uses: "python/import",
+			With: map[string]string{
+				"import": "${{vars.module_name}}",
+			},
+		},
+		},
+	}
+
+	return &importTest
 }
diff --git a/pkg/convert/python/python_test.go b/pkg/convert/python/python_test.go
index eb12b7b51..e7b283936 100644
--- a/pkg/convert/python/python_test.go
+++ b/pkg/convert/python/python_test.go
@@ -136,7 +136,7 @@ func TestFindDependencies(t *testing.T) {
 	}
 }
 
-// TestGeneratePackage tests when a gem has multiple licenses
+// TestGeneratePackage tests when a python package has multiple licenses
 func TestGeneratePackage(t *testing.T) {
 	for i := range versions {
 		pythonctxs, err := SetupContext(versions[i])
@@ -157,11 +157,12 @@ func TestGeneratePackage(t *testing.T) {
 				},
 			},
 			Dependencies: config.Dependencies{
-				Runtime: []string{"py" + versions[i] + "-jmespath", "py" + versions[i] + "-python-dateutil", "py" + versions[i] + "-urllib3", "python-" + versions[i]},
+				Runtime:          []string{"py" + versions[i] + "-jmespath", "py" + versions[i] + "-python-dateutil", "py" + versions[i] + "-urllib3", "python-" + versions[i]},
+				ProviderPriority: "0",
 			},
 		}
 
-		assert.Equal(t, got, expected)
+		assert.Equal(t, expected, got)
 	}
 }
 
@@ -177,7 +178,7 @@ func SetupContext(version string) ([]*PythonContext, error) {
 	botocorepythonctx.PackageVersion = "1.29.78"
 	botocorepythonctx.PythonVersion = version
 
-	// Read the gem meta into
+	// Read the pypi meta into
 	data, err := os.ReadFile(filepath.Join(botocoreMeta, "json"))
 	if err != nil {
 		return nil, err
@@ -190,7 +191,7 @@ func SetupContext(version string) ([]*PythonContext, error) {
 	}
 
 	botocorepythonctx.Package = botocorePackageMeta
-	botocorepythonctx.Package.Dependencies = []string{"py" + version + "-jmespath", "py" + version + "-python-dateutil", "py" + version + "-urllib3"}
+	botocorepythonctx.Package.Dependencies = []string{"py" + version + "-jmespath", "py" + version + "-python-dateutil", "py" + version + "-urllib3", "python-" + version}
 
 	jsonschemapythonctx, err := New("jsonschema")
 	if err != nil {
@@ -203,7 +204,7 @@ func SetupContext(version string) ([]*PythonContext, error) {
 	jsonschemapythonctx.PackageVersion = "4.17.3"
 	jsonschemapythonctx.PythonVersion = version
 
-	// Read the gem meta into
+	// Read the pypi meta into
 	data, err = os.ReadFile(filepath.Join(jsonschemaMeta, "json"))
 	if err != nil {
 		return nil, err
@@ -238,7 +239,7 @@ func SetupContextPreserveURI(version string) ([]*PythonContext, error) {
 	typingextctx.PythonVersion = version
 	typingextctx.PreserveBaseURI = true
 
-	// Read the gem meta into
+	// Read the pypi package meta into
 	data, err := os.ReadFile(filepath.Join(typingextMeta, "json"))
 	if err != nil {
 		return nil, err
@@ -291,6 +292,7 @@ func TestGenerateEnvironment(t *testing.T) {
 				"build-base",
 				"busybox",
 				"ca-certificates-bundle",
+				"py3-supported-pip",
 				"wolfi-base",
 			},
 		},
@@ -314,6 +316,7 @@ func TestGenerateEnvironment(t *testing.T) {
 				"build-base",
 				"busybox",
 				"ca-certificates-bundle",
+				"py3-supported-pip",
 				"wolfi-base",
 			},
 		},
diff --git a/pkg/sca/testdata/generated/x86_64/shbang-test-1-r1.apk b/pkg/sca/testdata/generated/x86_64/shbang-test-1-r1.apk
index 76f402ed1ca19b7f146e9e714d6669957f71333d..8c23382b4c30927b7af5973c577dcc1544b97378 100644
GIT binary patch
literal 4593
zcmYk8i8~a2*T#p)5>b{G%ZM6FgUFgK6_Ty&l_fjbvS*u7)>H_g6hBLL#*#fV*<$Po
z*{3kZ&X}0N%zU4o=e^$deeOTtKIcByxvu*IeaQ-eu=ylFz*vfrC+P}zOuz(+`-@w)
zZBIsJl!>ng>nG^Q{7X&#nX!!M!k9t~S|wdUpG$*zx_MxC;BiX2=A5(@S7UPBWp>E*
zrGs{cU!!@w-F})&Sq{gqo)j0d`T@IzcY`1V7bP)cCI`gbT)N($WLfMRt2gkU;hJ|*
zHaER!6Do?_s8IKMf1}fqT`zpFr1wq>ZzO#m*pX~6+35`3AZu1S-S1Tui2ND2b>v~t
zE-0xL=o2yQIW(ZcVf&#7eRZj0EC>_kkTJ0YM>U_@xKTcm!{a|Az&A|*(HdM6N0UiD
zIgb0?olPs=qai+Z2ElJ{-^z)TYqMVY{I2AYrOtTS6^&CHHja}0Uj{hzD-<kPt<&A_
z+|^CVkT~H47j-V-#6NJgmMp)VS6!R>G4cR4+5>3`6~6*uf<U1Ecfk!?doRJBP-tqt
zQGdg&M!EcHk4Vj#7vpPNu3&IO-Ua?XHL_wa{%uKv`@(2lYh8%v+@^3a`Qqrahb(tq
zmc&IdNhf|bS$#NvILf%0&C%$=!yC)-r+qMOWFm^AQ0}Et)scz7z}$vkNH<UDC^5@v
znI#1`xIrG=8dAoQHwT6`K6gSkltf~<Js)J|%f!}Bf3kH(8puCq<^4P;8qBqMMU)|G
zXD|3{^SmoUxWV8&LhTOT`FrbA;~u8XD<xS~jmL(<dwv~S@fxil(+^Sbw0fyaN}L_?
z6)CzuxC%~tH{|c7E-JY{aD1{<4%5qH3P4{U6^Z+&Izz^}F=a*T?cNWj!ZZ9C_L7w!
zG{V;+rpnCL9VdM<hON#NhU)us*91NGkblEzdkJ<S>9utC*u_F^=JofNZo;94nc`RM
zZf_uaVOsxyO#l7lYIt<VZLi(pS&-b-!%ppT?5FsqR@<=`L^aiinLln+n%ZX5Xr1??
zTFIsBP;rZt<QL9j*uvVRgp)!Q?|a7*JRB^<to@wlOnG_k54D^7F*?O{(c`^#qxS%B
zdL6Q`v@8J>B!FS{IWwUBc${`)PFm#|4qkoy0zCYcbhz6J6v#Fg-fA=OSPs86Top14
ztj=X8fN%l8$z+ru#D;A#wqQBU%6IM#zr}^;QZU#(LB|KFJExsCF3A&-Phnb<6qFQU
z!~P~aKM{G0sO7;p)@t6X&SJA49VcB8{;D!O+)D`9%2pI-ZSnj~LZo0`IqP%*jU-TJ
zSW@xe_Pu}DIpaAGc^=9edAYN$*XBD&Jxo0r8-Lb`>&+xcF+x<6G3-NAm@?6e3m{=Z
zYaJBlBZ|qn&P6KB`(lSZ;P>9~u;8{uGAN5l`MbCvFw&7T<Sf12ktpN&{_#7QT%fyy
z;f4B?MTr*JyZrboLmDxLRNN<qC~pGNqtxwL5>2e+`YE8t3({a;55WNevSur#ikPW0
zSa5h`ugT$c4#X=GlcNRpAtb=d`H~Lo$iO@Q?5#ZWf?jhY_sg|K?@k7BaBAx-i}-m7
zIl8lAu6#q}5vcK=yV2bsU3P_<p<uzk4fJ;DNCRMB{5mdoxkYQK-1X=H=SU@sKcb#-
zDl}j%ExMp@{Z??i;Z%dOfoYBNJ;#*>$C6ueu>i+H|M$mS2PXF}scwUA%67>&B$BXH
znh6t!g{?~NFn=}eubcbhmxF;5p&!+S)Y+4whoi*Xk3pi2ef$DPijwKh8ACf%Ntuus
z+T?S@ac2+zSRR`ysOuE-Cy8I=_N5}TRdsJ;XUVL=kEpMtfIm>}j3WHxr&)=h)L-8s
zGAu*e;3lqk>s0LAlD{$`AW+mG?NI$I2(-%$4HI<su=9CMB6w^ChX*0)(Y>10-JuO?
zIQh(MJoECZT*@cx0b(z@ce!ltRMYvdst7b9EGq4OU-=pH^Hnd#?sUp1+MwDjAN;t-
zR*D~y?QaW<`eM`;vCNnial*!p@Vk)<_O)y8Sm`b-^jbT^JnxhrEI0jtySE{_P>5lN
zZ=dU8(2g)I9tN5(oy84%!NN<50^fbR1x2)SAt%KFE99T7q1z*m^)6W3dN&o-_u2S-
zp1xScVrf;WSi9CF?9t?V_v^{JJG#H{W(Kk{Redha6?=%wQr5N)RNEf^h?<zalHcC9
z+8ww3ozGE8!rHb{F)}$5J?%1=T4RRcd6ek!!qbb<@cHnk*_%gf<O`6Zs4fznDuDb0
zNqf(7U(I-fRr4FoMg|$J+%>g$pMEit#ys-Fb9DbKUFL0W6KkA6DYZ-K?7Ruygrpvq
zT}pjL+aYOXJ+5Q?UmZb#ALR_aI1JBnb-b|{R|>gHn_K_x98nO4N4d?r#A{bXq8P7J
zXK_{#73!EDw^q;SM{GNE{?(!iV#`DdqGE57DNdUi9Va8o!}fB^t>{5cq4>f;+e4qd
zX(|~4AugiKArzD12udj`m{R_88Ph%#?tMr;C#U&B7=_lbUC!LS8$sGJ^OZw~s8-r#
zi*Ni=+*CfN8rB*XRB$-NWnY3OVa<aU)W*p^dbwq24I04vFkB@X5q8YPmGDzEv?3t!
z?XQtCWz10nNX$T(j+It|a4A{?*~;;?vcOLeSG%Y}ANrHr2QmC|xb?eOeiv$&v`D$J
zx5hGlSu3mUa2Z&j8kEa^7J&us%PYRVv>%%)bc5ikZFF`S&h9lk>woK&@J5@J+m>EP
zy>ix5|20w%rS;R)YZb)nHo|PeBB~~&N5F4j9x6;DtI+u~fw}3B0O4!b^hQ@&vbqXs
z?}d+McnF4gPY{_Q_u*+Z3AS+`62%Uo?Cbf>h9aN3?|-_fhrsW2X1dKY%Bm9&?9FpF
zzi2w|+A~5T)(cdO=W8yJ7$z^iLV0x&1K>`-M>e*NWHb-IdM2x9E%R{yzb3b%l3fTw
zumE<go>j3AFdiW&9{aOtcKF$b`jmL+wbh3j?W;$msnBUG5jvNob~zr674LuroLY~l
zb(CizUen5f3pamT?ffA8`;VV7&l9;PFNZxp3=qX>-&s^?3dOmGZlt}{jUanM1Q&h?
zVEjH*#H>}%FRz}Hfsz7EhXvGWau^&~UR`P-vnvy>VuiVVSwxg&_we1_%^f7nma<@@
zNU2LRhXI3nAJQk(d`pNKUoEVwearA}a9hH0>AU;XgbYu+)>(EcKWBbWPW{e;sidgl
zh^nQygHZZrkgSbwum^8ovQ57B%Ap;s=6sa@b%7YUUHeMiF5^|*C>s1Hl{H<gh5uRY
zVwj8s3))DOvF|f_jj2%IYCX96-CAN*s))$C?Te+xwyifso(z_vm(QiQ;<FrB`!aA|
zrYMlfaJ-{))-`-HOv)fF=oDLOaON+!(3xDOsRPPE=z)k^Bb#P++IFL`2!rpkMs>}{
z<i$yoAuw19kIW#LL|4!*Q5aFt*blk4sojm*!RSARL-t>~BD<W2w#T@fX@;0XwN6-R
zVHH?Bc0WuagqEgysIw)ON`1Eqj}=kFsWsD?P^4=g2M#17udNq9-Ay`5Zlb<a#gMUq
z6R6sy;>Hx<Z71H=yij-leOENom#{GFVeA>#fOLX*FCQ2BeVUeL_9rZjF~vyy;HUp?
zf8F0H#ZM4T@mjrD%)WI7j981K0l7?*KP>F`ueH9W<}NQCRVJ^7(6#!pP+8|y=x#(x
zc_S0Ddxm1ZrTR-(^5L+E)wVtja6*1Pkunw^X4~GrOV>afJ4l^r3|r4@q6_z8#rF;s
z5x`8O6}@mRo5&1#nnNI~0dl}DHsG7I%y4-fii%lUa%<}R_-tyONwt{?x?7vNuGN80
z{<;x*dg=XD%7x*@4ULPtm=DfNOKJWv(-s4#*nVII4Sh!J%2)?;?+Gjl^$R3=iv9Uk
z8r_%uRvCrfFN_2_N*B#yQ||~G24ej=^lLfSB$ym5CKSr<CqxQnB<_KuN3{R+{x(Mc
z&eoBvRK_JDE%ROkz`t{2H?VtMYL`Vkn@!YMlp)$L!^y96Y`32RD`run|3HP(#YszE
zFE#m#)|qb#9b(TnJXXzkW)c6$?A{wu!5$U0r2nC#NDx#`k=;iMVd*FnEi>!2vj1|O
zTKZehMovdG9G?Ulpb0qSPd=81BT5_<?qwUjwLaD-yIWix-<4P^dF#kmC&etDb?SNZ
z8r-~k(2fQ&SW)`61(opI{*<NqH_M3aCIhM!PtK9fyn=t=Iwko(6zA)7GuV0UER&c~
z_wnahj*t8J>xIhHxSiHiGT?{cs2FG|q(QwvX5|7#^bi!R0P#7bg*EZ)Lt@*%V;j`W
zooRC6;srI6AQDAJHoEX-TVIt<@Sgd0H>27?vPJTqZ2<hl`xYa?iW9?fLpfpsAl`L1
zdJ{B^Q!uavAh7^`U?EYkfv2wqDLFMRRNqRyAl&8Hd)H?lv>~%`7yi1B0IN4yppifV
z35Fuyjr4RU%`b>ntfNY#zH=B#cPep|IXPdi0mFz%;P#hJe$i0}lw^g!AjJdBjxfR5
zQKlJ7(Uo8K@(C|XxsLHAvtNZeUByk%8xuk2H0L$B7ax;BxfCxEiCV<u@#xf*vKy84
zraGT%iBr(AWQ#jlFJz{3d;)%qz30leqzh+2h|4jGHyNq-l%%{4y?uM4i;8(O01Ud3
z4Iq3~eP)-&#I{a2lO5bnj3mOVQMt@nyPenAf*ocEA7`{;RFABxnY0~3bj4z6#haL7
zkhu9Ud+KI)109^Cm6sK<(UNVz+iIWFD9c25m4Q=H?R&}Gma%lQIhYdu-JEtp+&CAm
zym`xq`^n(R5pa_|LkIYxj*tzd0u9EJqnu`z|15BKYg>m@=dCf7Wtr;halfSFvdEyJ
z0UXI6aAe&Rv)I(4zw}?k$fxtw(8DjTW31MEte<o;o<K62vd-x`wT*~Q=$ID7_WPL2
z#vs!8SI*Z@pPF$|<z3eNwv1qrc_Z?1mXCu@75BWY4w9D+z-cxq&Yy;EoI=s-_V;*o
zR**4=sL9qzrY&t?&A+H6b`JdBx33wz<9;~!Coj+839X!!jkX<2uWO@^J-Mqd#cZnT
zHRXx_c@xMW{8=pOXh-$~Ehq8;rjdrke&^7y3H(u0Q!w3|Zc&kybv}bZ+M-sv|Hk<^
zNBoKkN^o!nq!=Pn=$MMR?;uk_{|gYp9^qu6aNa~hrU~`i=!*p#@=w*ZbmI@UU!EK;
zy?eVL7d$Iw)R&Yx(QS%;7N~0dh*H0$Je}rv$N&DS@Mp$5qCd$Q>OHbUe3O!CHjl3c
zW3TJ#ry3-F7R^&-C5XVaBTsfL)bOI9F@LM+jM`}I4Zm)(KtL?an;WHjVtD4yX>UP1
zW9$v0*IlukBV9sQKy3FlzqSY2O#3w*scw8~v0wTOe4F_9ZiMx57K~{~xZHP*@RhF;
zJ(@o%m4UV{bn95B_RXzdo<@(m+DB>Ke6Qejs=V`Fa=xXCRcZBm$s_GbQs;hUwc}pZ
zrw$bQIsAsSfoR!6$@%9awR|k1IyK(iH81q}V(-qSENvVZkBqR}r1@AHm>~P-PJK|T
z4@$uWzey%~^&wPCo7EoP#Epj4fBc-n+q0}qCnBooj+Uc-0tz-ex1DIOjh&v{7AtHk
zuu*)8c2k@Vj?a6#ywPz$5+AOFf7CD=xSI2iWi*p5`iH^g>>h7W`*Y_-WMAVoqkLa&
z#IFgP<obpM8#JHoj!YQc#kX#(dhW5JO$(1@zi%armlBQL_T^cSX^J1IPdF~@@u6U-
z=*H+B2Z`fjc?^5-mfNBaNYO!-1G^mymruy%+Gw;ras7=?BP8}Tq_502;F^afx~By_
zY%4yuDyQvJdfq*@6M1HlYyacBl<84=L+$*Ud+Yeg^WDNd+1UfFfm4dgWsQUB3~#-{
zB<1q`2VW<xpVc0ONhx{vT#s|)?#YuXY}vT(CB|~CCDyP^{YQ&+c?^GPb;E#{nk^?j
zXw-`%c>M!;JX*hO@nND@IQztON6XBb#Qu1+Z(`3UIfTt=?nx_(90URZ;27jor_3+N
H2n6ykRLXtJ

delta 4516
zcmYjUX*AS<+Z_qnDMDGYFIh{<Iw3LHmoO+hi4<9~&Ce3qvJ4@6LS-AfG%?AZwZ)b#
zhQ>aPF_xJzzrX)`-gDmfet5n-=iGDec|P3x5X7s*0g;q55D2q>A_V-EVeX4n=IVVq
z`HpLA#%pDuQRtsfF8iB3&gO$F$ja6a3QRC&7&IzC#s?`J&eDwEO<26BEm6UFeQ07H
zq|ER#KuXKCZa|zgR;+|@`ifUFyHdMh{S(d1+{bKR(%rRIbIFR(`?PK#iS|!YeV2bQ
zumcCslh!V{ZBF$q-TeIb&BR*1gjM3Xc_i){UlJc%hfml@Xhpa!GJfZg17EL}wcp;o
zpY5o33Jg!nspIVgZIt>|ta4C5K6x~Q)p}}sBMI)1)%5wVS3T>?H`>xGt)OyqI=~bm
zTyxMMG_S=wBh85|YlAJek0{Q(lC!+R?jEk&Fz$2JvRD4LpNffj`5g$0u|sb1Ur!F1
z3ZBNZ4z}tKdkT|>d6dpK$XyY=)ONm9HD0Ex%xY_E2*_Swf*iuse6w`u_yL2V)>~~V
zWxsubb!L+$)^@zWQAPT`GFf=P17M%@FhxpH8?719HaWlJ8fq>k^f9=!Iq~5cqwz8$
zN_OXJt&+lc=irk9HC@Yrn<8^s%#YXyZeD15fc*qEcg>9mhT3UmNf)K5dm$i4^TUY6
z;hjig)Z*yQu$d-HR~+MWE<nt5)2hSxO-+ao-^?OXOk9Acc|=TD@V8~EKEyQ<rK*KF
z-_aT-L*L*1vQ+3@VB=bm)?4@35FT6kF>`Nrp}0-w_^NSGhU5(I^Sv7@boREVeb-Ab
zu3pI>e!ZKLQ@$C^J%0wSo2Kb8|BZ|(*FCN4s&H>0?$i_@x9QFN$r7-)N3=Hw?#!*T
zdZNv?j4jddPK$dPe<cSe8r-=Yvl{#^$h9hm2zgx2ky^iClksNe%B|g)ps-U|27gdr
z?TGFelidWA>k0APcFTfdX@G=|?Voq&9s2-QLy{HGi|OhKtQERt5MlmDs)2Zj5|c?e
z#0(KcTnE2PrVJ#c0qkpH6F(H#9o4L^rSjOR`580>&1z@JnYj#q*#-urpwoxu-=FTM
zdoUy)LX!`{;h)+hkxL=kGQT=vFEWmt+UEM&*gxGEnm{9fjW3LQFoj;7hI?D#I6_Hd
z(jf*-Sp4;dA@lNjqbt`$Jinen0@Bpxy*{ri>t)4OKiIP*KxO~z>qDqkmdMr-N)ET>
zZ0BLn19JBQ3k-=sdqz9w$FtAb4eby39S`=WHE0nC8*`O;>F|&aECEw9l$;2n1;M)l
z=in{D1~GD~_sHWSnn+Jk>z|pTmoJDlDhOCSOH|qCnxnn&+l}i0?^=w~uEDYls3Mls
zcUaKo7amBZg?S}gyC{_bRFQ=TrQTDT08MHA6F-RGJzTWn`S~O0Zf=I#Kz`-#oOo0E
z-)Fdu{N{ss^|Rzv^!RbydQvoKDHCLN6#QXza7u_Wbq&T#0B#XVLg_SUV~b2&VBjG8
z?@sHp*Xbj6y<CP4p*2YW+i*S8GZ6K_C>0C^BB*$m-X0dw3*QwcV$;NY^H<MK{R)y1
zkm{*(zj@kpiLY;3X|E7`Vv49g<aE`c86%&8P~-vVNCq{0RAW`Ajzt$$XUD*^V*tQX
z4C=uqJYWGPLrBy4K+kT2jPduSy1edj{0Vx3Q)g)a=OHLsK!sqT2Cu9-OR*wr0MU5~
zG+YJ&+{${cl(ba%y6iuLo7O{3^Lqg~fRh_kBaHDGn;=sOoq5a)2!!$@Qk}fukuzFP
zm6Zz3qfN&m7(Ha6-ON%`oK1Vrt$6A;O9Ov?2r5>SZsZyMyK%XmDtK&|QQ@N=E_dCy
zNaCY<NyXhs#i1;?dVYCeTizT{dn8yiV6{+8nJ(%2ebt;8J~&jXLem<#=a1S}`YfVJ
zX?^dFCg;4KlfSHNo*pB=N;=-4G<4gb#g(r`6KgsV;n7*}Z~1&S7m6#YUnN*Se1?dq
zZT4D|yr*EO3*Tv>_lVl~HIw49Yx*Q^vRhHaBs%FL#cI{GQMF%Zl6M^lkQ*C{<oBS^
z;SC{?uW0n2*%u_iaSv$Q=~YVmhzI9Hw&KscwQl_0QaX7>gb~8?Q$VmbL@;JzBEfs6
z`qye-wdvN8OYp?~?&>-mHsL^nZcq7<hftwL$KLXCl~c};1HP>+cB10d)oKoA*hq@o
z*}6iw-)S9qmu+11#021Q^&fn_`rf31fabO)UFG|nygsQf5{FLTw3|!zgc)5}jO6iS
zm?J|@%MW20E$;q?{{sHv0*@}%h>r@7?GpE1^4&B?ea2f-@5z;*&m<Roi1fe6gRj_q
z2N&+GwL$bD?2jqdQMNb#7cO`#l;ijZXoI3XsU%PC0kgc2DoliUv5CJeibfjN+*3Ac
z#@j)RiYXKp$cr>VropGG^RES|U9}Q0B#u^oDw^^#DC`GD;a<c+Th$b;J)GoxJ;%=M
z&h>KqUDOyL0?E)K1TsW}K|?RnB5S*yJ9I!(2Rvzg@m&w~2BM5S8T7j7TlZkCzTrZ7
zBpy(9=+H@D@7nzR*eY<(jP(09X<MYjB8r0ju+bA*jbBKD-i`7lgG2MDypWDNZ^Wh5
zR@X_L>R<{ld4ovgtG2@d7L{+yeDVG1wu|`~YsNqO-z8xFnlNN!D7oJgB6U9uH=dbF
zWwJv`wA**=BS;&Z-lz@&FyXuXa)Sh{V{RC+l4obZAZZv4IZ5gWwc4KbwWRz1i1{AZ
zd9X2jyjHi*c+T83YKcFhO%<Iff%<V!coDW6OilyDVQZA`w_vfvqStQ8^6F=Vuu08`
znHFh{_WH3&5OEz%dC8fz(v-c_LmMrq_ojo$LH=lpNWlQy@lw}JE{8Dfm43R@>#%d5
z|E=&L;9;#qa>h460P=5}GwV6V9ZRHJlSoDROPpN8ed*5@-c(U%f4n+<$DGJ~=Kru2
z{H4E%$Z=HobxegU^ER>!>n?vJmqlU7D3Ye|7!w;NvQj&*mlVAlNe2(je!$iD00lMf
zoH2u%rorS$j%D_cLM7q$(KYc@VXr;r+v<7zA4mRPGy8jZ^ehPaw!~`>yYAPiQlyQ)
zn2KL=ItB|QA|-8JkT{ITl#iZQglRsm-!t3_2Ma2W!tm$)N4$~RYc(R#bDw`%r=&cM
z$C(#(JZrur>si4DA4M^-Pr1V@0E-<VhSm4Ny{@SW7W>q^=O;5RFWVP^o@0qS&x{Su
zY5BKoCEIsxT-~<cQYgD980zpi#78hB-AT%Ig#jVea3MC(=tAC=M(5hwCe?dxH-Q{q
zUAAv3@D$w{QY2?~_m?geMo%l}VEs9X>R{<PlVAh80RClC-Dz;UhVl_upNY;fGG<)$
zSGVPfX%tc|=)r^6qJ^;BUT-@PTCXZ1g-$c!y#=9TWU|D-C}wP|n@L@B_0Z3(bCC*g
zOx8w}js@!6K}Ju3wIAf8a#qdbYB~ZUGh4bmMwOm`|AaD%M6|ProJuMs%CCu6Nl|dj
z57hDK518x+BKW{L2M``E0zJ|YNk^xPp;wD4xIA#7L?Z6l%a-*M0)d}!Ob;^j9x%M(
zJbcui{;mm;Ed}j}r#@~{TOVOB8L`>{)$NIU^~G6A!+&Lla09%YojF-hoq`H#INd;H
z7>!g&-Sx{69+oW>+F9ZZ+(qdWS7_<%qiImDT_>P41E^@49RPh!+=S;LNFdyd_Ds|m
z%vg<cLI+TJH?h|3AAzRqN8TB}p$jyC9&#f)d5GHir$gu)W@u8<WOdo*@$tEzi~8ze
z3w6%kQ&5J+O<DhOf%}kX92|im0~uMk1KzgRTE3&5yC5>F#FZnI(QEA7%E}EL7f%8a
zdg6?;+fQ4teTNOvv&$dB=~SGFUI|k_Cp%wZ=@|>Qyq<96l&%l0UnK*mzf7XA+QZM#
zmE1mm4485%_--WVnTr9%3Xm0guwKQl2_EQ533aIe-Wu_{ld5Gi8pk)}xi`UsFXaEm
zp35STl}#lBybs-uL77PqN;GlRA4FMBuwE5*zuM^?sYlHf7>as((g7Ag)0j_E%b;RE
zz~r_f!xHEu;N~&#sa!NZFYO_^HOYog+}JYM;6_?Nh~Qin3!4aVZW+@!7z_*)^zBnH
zau$(b)D#Bvmr-nd<DPHy-Dc*MXLs|xShf+pE4G<_>d78r`h02bsX~ToG|rI~CJGHL
zaZ=122_^A>fjxoWk<fuXVf+@h!x#2*8UcnfY#8-`_tHR)E1q^zbxE0Z9|nGjiY3}N
znhNIfE8a>3KGrFu5Woci@V|7kpl9`Ade0%ig9UV`cJaLF4ZMq*I-)dR*;dM_rY%I!
z(8-#HM|Xf|@#+D+d{6zA8yvBX&rKXv<dgXGeP_q72yTh#KT8YP7o0hSs%DA!fo%%K
zpfNHLe47ZG6PY0S%2*XOY(!rU0n;Kp1<+%7dPVmil4wzg7cM#4H>q~PD&XTO9Ox>b
z?`L0EBW@h8QK=6Y+->j@b1O*mIZMAT#X|wN;*Ws@zg_wrFh3nMI!^#p3D6eMw~bZC
z6Q(oHq76lK=8=^x2=A4NDr&?>+d%b6g_<vIhiyetQB@W_;Cvcb8N)jQh{`o5iWwsx
zUC6JKZA|74TJHp^{KZDp-aKJ*-{KD>fH8g$%r*_L@tbPe&xB0lIZ-D;1g!`qJK+6K
zH`^kiF>lH7y_MEa;%?5dZmmbqRZ-ukbu-m(6Gyj2z7`%=vsmdab!oli*)M4Yi)ok5
zTpoLI^3IY$^d1UU1xV~c1CQ;>KE)q9$Vz=zE`hMs0p)8JYk(c8M2Nc>+WusDcrfti
zQea%PPe?SOr0x<t6%2`>;_MUF`Jb;P_zbexIMsaAxZ>nd#h4%`cI!$|V$b2@;eNnz
z7L0lw$@uGi@ZD{YYB#10z7j?Dknx!{;QbE~mR%_<sFt_D$7t5fsRuQD4%3~_eaoNp
zrfkN`JV2g;i-%}dqU8<0&h<~v;lFwcR%UUYj#~s}8>MzY!$1%ac=0O1yP_!}t&4=x
zV`e^1w*Yx@bRjVj<0sLS{y(2hQcdY=9aYs6L#CGTv`~F;#uC^Fuz<<MTd6-(_g$ST
z`(h68H7M+wHXT!(Z@pl3qhiolU?$siwl!$TlBcHn^zUR}{hF%Q$~$Q>3W=9`ka^&>
zQ6gq{A1aY0;z3n1evdmR1IgBeyHTOB1kjFyhozTwNE+e3ek-7kvZ)ndEIq1lU+d}a
z)*S-B_6}C+jbXs1mF%MKCqY$Zs>4CVHt;zQ>16wfX*=W3G%Hndkv;h-gM;LlB!_3N
z$!TK?Ib9!yJ5RYrbq|k5)0Z1~9&_F9ZU369@grU@K=RCmr}0ugE|}XaW11^hd;~pD
z#p@BA?7KS;!rv{oe{~azK-9j}$Jx6Mwxty5-FL0Hu2pczt-fs#uyG-~QQo@qx{Mu=
ziJ%+@<)#-Cmc`^@t2;-$MPK}XqPj|YP0zN}&o90254fCPZS!C#JFb56Xz6r_O+y6E
z%GKNX`y&%S$FEh(Rrwrmwq+E5@%9GrOm&^N<S}8hMmCX(E@cXZpP%u|DW>J1&7bT{
zPSS<U80@EdTkl`~yt=c)9%a1QqJ|d*WYb3Cw)ANx$GtV>o7aq*|6u#bn?<94mT%t*
zH+=o@JpH17a}kF=VXHl!mCvl$8Lko9n&+*hyT!<Xj`Ys4RZG|G;>B>g;DTI2Kiyi4
zjUBHJ)7gI1+a9U(Y0Y^z?lR5mgC%<6;WH2Envih^&UHUBZ{vAun$o*(qP{B3K-Am~
z^EuP_@>hD6Y)Qs?%d;Nb{pIJMZ#L(x#`os(nH4!{H$4ei`ZY-Gb$7fIq^P-8=)Gz6
zh@(yM?(g{&SOgVob4}^bc-<IEfLv9#FZ;-|W8!;AwUAn}cG~r6lpV)EoBl7!K^Vs0
rE0*)V!F4;Y=pQFWB&c+Hb8&G^U*tYyhCm=7NDpyb*oc9QLm>YFoAE{!