From 42a37035338eb56c44ee73bb84d38cb17e409c86 Mon Sep 17 00:00:00 2001 From: Allen Houchins <32207388+allenhouchins@users.noreply.github.com> Date: Tue, 16 Jun 2026 10:48:31 -0500 Subject: [PATCH] Add Sonos as a macOS & Windows FMA (#47671) Add Sonos to maintained apps across platforms. Introduces SonosVersionTransformer (converts Homebrew "90.0-77070" -> "90.0.77070") and registers it for the sonos/darwin slug so osquery version_compare and patch detection work. Add special patched query in the Homebrew ingester to compare bundle_version for Sonos. Add inputs for Homebrew and Winget (including a Win32 install PowerShell script and Winget manifest), outputs for darwin and windows with version metadata, installer URLs, sha256s, and install/uninstall script refs; include the actual install/uninstall script refs. Add a React SVG icon and map it in the icons index, and update the Sonos app image asset and apps.json entries. Also includes a couple punctuation cleanups in apps.json. --- .../ingesters/homebrew/external_refs/main.go | 1 + .../external_refs/version_shortener.go | 16 ++++++++++ .../ingesters/homebrew/ingester.go | 10 ++++++ ee/maintained-apps/inputs/homebrew/sonos.json | 10 ++++++ .../inputs/winget/scripts/sonos_install.ps1 | 29 ++++++++++++++++++ ee/maintained-apps/inputs/winget/sonos.json | 15 +++++++++ ee/maintained-apps/outputs/apps.json | 14 +++++++++ ee/maintained-apps/outputs/sonos/darwin.json | 22 +++++++++++++ ee/maintained-apps/outputs/sonos/windows.json | 23 ++++++++++++++ .../SoftwarePage/components/icons/Sonos.tsx | 14 +++++++++ .../SoftwarePage/components/icons/index.ts | 2 ++ .../assets/images/app-icon-sonos-60x60@2x.png | Bin 6862 -> 5247 bytes 12 files changed, 156 insertions(+) create mode 100644 ee/maintained-apps/inputs/homebrew/sonos.json create mode 100644 ee/maintained-apps/inputs/winget/scripts/sonos_install.ps1 create mode 100644 ee/maintained-apps/inputs/winget/sonos.json create mode 100644 ee/maintained-apps/outputs/sonos/darwin.json create mode 100644 ee/maintained-apps/outputs/sonos/windows.json create mode 100644 frontend/pages/SoftwarePage/components/icons/Sonos.tsx diff --git a/ee/maintained-apps/ingesters/homebrew/external_refs/main.go b/ee/maintained-apps/ingesters/homebrew/external_refs/main.go index 9eaa7b0d66..1b34a03ca5 100644 --- a/ee/maintained-apps/ingesters/homebrew/external_refs/main.go +++ b/ee/maintained-apps/ingesters/homebrew/external_refs/main.go @@ -42,6 +42,7 @@ var Funcs = map[string][]func(*maintained_apps.FMAManifestApp) (*maintained_apps "logitune/darwin": {LogiTunePKGInstaller}, "anka-virtualization/darwin": {AnkaVersionShortener}, "pd/darwin": {PdVersionTransformer}, + "sonos/darwin": {SonosVersionTransformer}, } func ChromePKGInstaller(app *maintained_apps.FMAManifestApp) (*maintained_apps.FMAManifestApp, error) { diff --git a/ee/maintained-apps/ingesters/homebrew/external_refs/version_shortener.go b/ee/maintained-apps/ingesters/homebrew/external_refs/version_shortener.go index 62378268d6..eaf2b8433a 100644 --- a/ee/maintained-apps/ingesters/homebrew/external_refs/version_shortener.go +++ b/ee/maintained-apps/ingesters/homebrew/external_refs/version_shortener.go @@ -75,6 +75,22 @@ func LensVersionTransformer(app *maintained_apps.FMAManifestApp) (*maintained_ap return app, nil } +// SonosVersionTransformer converts Homebrew's Sonos version scheme (e.g. +// "90.0-77070") to the dotted form macOS reports as bundle_version (e.g. +// "90.0.77070"). Sonos versions its cask by build number, which matches +// CFBundleVersion rather than CFBundleShortVersionString (the unrelated +// marketing version, e.g. "17.2.3"). The patch policy for Sonos compares +// bundle_version (see the ingester); without this transform osquery's +// version_compare treats "90.0-77070" and "90.0.77070" as different versions +// and patch policy detection breaks. +func SonosVersionTransformer(app *maintained_apps.FMAManifestApp) (*maintained_apps.FMAManifestApp, error) { + if app.Version == "" { + return app, errors.New("empty version for Sonos") + } + app.Version = strings.ReplaceAll(app.Version, "-", ".") + return app, nil +} + // PdVersionTransformer converts Homebrew's Pd version scheme (e.g. "0.56-3") to // the dotted form macOS reports as bundle_short_version (e.g. "0.56.3"). // Without this, osquery's version_compare treats "0.56-3" and "0.56.3" as diff --git a/ee/maintained-apps/ingesters/homebrew/ingester.go b/ee/maintained-apps/ingesters/homebrew/ingester.go index ee113a0b3b..9e6e698534 100644 --- a/ee/maintained-apps/ingesters/homebrew/ingester.go +++ b/ee/maintained-apps/ingesters/homebrew/ingester.go @@ -200,6 +200,16 @@ func (i *brewIngester) ingestOne(ctx context.Context, input inputApp) (*maintain out.UniqueIdentifier, out.Version, ) } + if input.Token == "sonos" { + // Sonos versions its cask by build number (matching CFBundleVersion, e.g. + // "90.0.77070" after SonosVersionTransformer), while bundle_short_version is + // the unrelated marketing version (e.g. "17.2.3"). Compare bundle_version so + // patch status reflects the actual installed build. + out.Queries.Patched = fmt.Sprintf( + "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = '%s' AND version_compare(bundle_version, '%s') < 0);", + out.UniqueIdentifier, out.Version, + ) + } return out, nil } diff --git a/ee/maintained-apps/inputs/homebrew/sonos.json b/ee/maintained-apps/inputs/homebrew/sonos.json new file mode 100644 index 0000000000..4f2f506b6e --- /dev/null +++ b/ee/maintained-apps/inputs/homebrew/sonos.json @@ -0,0 +1,10 @@ +{ + "name": "Sonos", + "unique_identifier": "com.sonos.macController2", + "token": "sonos", + "installer_format": "dmg", + "slug": "sonos/darwin", + "default_categories": [ + "Productivity" + ] +} diff --git a/ee/maintained-apps/inputs/winget/scripts/sonos_install.ps1 b/ee/maintained-apps/inputs/winget/scripts/sonos_install.ps1 new file mode 100644 index 0000000000..161c6897aa --- /dev/null +++ b/ee/maintained-apps/inputs/winget/scripts/sonos_install.ps1 @@ -0,0 +1,29 @@ +# Learn more about .exe install scripts: +# http://fleetdm.com/learn-more-about/exe-install-scripts + +$exeFilePath = "${env:INSTALLER_PATH}" + +try { + +# The Sonos installer is an InstallShield setup that wraps an MSI. The documented +# winget silent switches run the setup silently (/S) and pass /quiet /norestart +# through to the inner MSI (/V) for an unattended, machine-wide install. +$processOptions = @{ + FilePath = "$exeFilePath" + ArgumentList = "/S /V/quiet /V/norestart" + PassThru = $true + Wait = $true +} + +# Start process and track exit code +$process = Start-Process @processOptions +$exitCode = $process.ExitCode + +# Prints the exit code +Write-Host "Install exit code: $exitCode" +Exit $exitCode + +} catch { + Write-Host "Error: $_" + Exit 1 +} diff --git a/ee/maintained-apps/inputs/winget/sonos.json b/ee/maintained-apps/inputs/winget/sonos.json new file mode 100644 index 0000000000..de3c8d6134 --- /dev/null +++ b/ee/maintained-apps/inputs/winget/sonos.json @@ -0,0 +1,15 @@ +{ + "name": "Sonos", + "slug": "sonos/windows", + "package_identifier": "Sonos.Controller", + "unique_identifier": "Sonos", + "fuzzy_match_name": "Sonos%", + "installer_arch": "x86", + "installer_type": "exe", + "uninstall_type": "msi", + "installer_scope": "machine", + "default_categories": [ + "Productivity" + ], + "install_script_path": "ee/maintained-apps/inputs/winget/scripts/sonos_install.ps1" +} diff --git a/ee/maintained-apps/outputs/apps.json b/ee/maintained-apps/outputs/apps.json index 7ab88b5132..5d7b04b891 100644 --- a/ee/maintained-apps/outputs/apps.json +++ b/ee/maintained-apps/outputs/apps.json @@ -6994,6 +6994,20 @@ "unique_identifier": "com.Sonosaurus.SonoBus", "description": "SonoBus is a high-quality network audio streaming." }, + { + "name": "Sonos", + "slug": "sonos/darwin", + "platform": "darwin", + "unique_identifier": "com.sonos.macController2", + "description": "Sonos is an app to set up and control Sonos wireless speakers and home audio systems." + }, + { + "name": "Sonos", + "slug": "sonos/windows", + "platform": "windows", + "unique_identifier": "Sonos", + "description": "Sonos is an app to set up and control Sonos wireless speakers and home audio systems." + }, { "name": "PS Remote Play", "slug": "sony-ps-remote-play/darwin", diff --git a/ee/maintained-apps/outputs/sonos/darwin.json b/ee/maintained-apps/outputs/sonos/darwin.json new file mode 100644 index 0000000000..457ab0ca04 --- /dev/null +++ b/ee/maintained-apps/outputs/sonos/darwin.json @@ -0,0 +1,22 @@ +{ + "versions": [ + { + "version": "90.0.77070", + "queries": { + "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.sonos.macController2';", + "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.sonos.macController2' AND version_compare(bundle_version, '90.0.77070') < 0);" + }, + "installer_url": "https://update-software.sonos.com/software/rT0797IawE/Sonos_90.0-77070.dmg", + "install_script_ref": "85c8c855", + "uninstall_script_ref": "eb46b753", + "sha256": "3a3cc74fa35e79e0499e67712ee70cc3eb51836d00970b2139cb131fc20b4cf1", + "default_categories": [ + "Productivity" + ] + } + ], + "refs": { + "85c8c855": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath \"$INSTALLER_PATH\")\")\n# functions\n\nquit_and_track_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local timeout_duration=10\n\n # check if the application is running\n local app_running\n app_running=$(osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null)\n if [[ \"$app_running\" != \"true\" ]]; then\n eval \"export $var_name=0\"\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n eval \"export $var_name=0\"\n return\n fi\n\n # App was running, mark it for relaunch\n eval \"export $var_name=1\"\n echo \"Application '$bundle_id' was running; will relaunch after installation.\"\n\n echo \"Quitting application '$bundle_id'...\"\n\n # try to quit the application within the timeout period\n local quit_success=false\n SECONDS=0\n while (( SECONDS < timeout_duration )); do\n if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n echo \"Application '$bundle_id' quit successfully.\"\n quit_success=true\n break\n fi\n fi\n sleep 1\n done\n\n if [[ \"$quit_success\" = false ]]; then\n echo \"Application '$bundle_id' did not quit.\"\n fi\n}\n\n\nrelaunch_application() {\n local bundle_id=\"$1\"\n local var_name=\"APP_WAS_RUNNING_$(echo \"$bundle_id\" | tr '.-' '__')\"\n local was_running\n\n # Check if the app was running before installation\n eval \"was_running=\\$$var_name\"\n if [[ \"$was_running\" != \"1\" ]]; then\n return\n fi\n\n local console_user\n console_user=$(stat -f \"%Su\" /dev/console)\n if [[ -z \"$console_user\" || \"$console_user\" == \"root\" || \"$console_user\" == \"loginwindow\" ]]; then\n echo \"Not logged into a non-root GUI; skipping relaunching application ID '$bundle_id'.\"\n return\n fi\n\n echo \"Relaunching application '$bundle_id'...\"\n\n # Launch the app in the logged-in user's GUI session. Apps launched by root\n # won't register with the user's Dock/GUI, so run 'open' as the console user.\n # Use 'launchctl asuser' to bootstrap into the console user's Mach namespace\n # and GUI session — 'sudo -u' alone doesn't do this, which can cause\n # LSOpenURLsWithRole() failures even when 'open' exits 0.\n local open_status=0\n if [[ $EUID -eq 0 ]]; then\n local console_uid\n console_uid=$(id -u \"$console_user\")\n /bin/launchctl asuser \"$console_uid\" sudo -u \"$console_user\" open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n else\n open -b \"$bundle_id\" >/dev/null 2>&1 || open_status=$?\n fi\n\n if [[ $open_status -eq 0 ]]; then\n echo \"Application '$bundle_id' relaunched successfully.\"\n else\n echo \"Failed to relaunch application '$bundle_id'.\"\n fi\n}\n\n\n# extract contents\nMOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)\nyes | hdiutil attach -plist -nobrowse -readonly -mountpoint \"$MOUNT_POINT\" \"$INSTALLER_PATH\" || exit 1\nsudo cp -R \"$MOUNT_POINT\"/* \"$TMPDIR\"\nhdiutil detach \"$MOUNT_POINT\" || true\n# copy to the applications folder\nquit_and_track_application 'com.sonos.macController2'\nif [ -d \"$APPDIR/Sonos.app\" ]; then\n\tsudo mv \"$APPDIR/Sonos.app\" \"$TMPDIR/Sonos.app.bkp\"\nfi\nsudo cp -R \"$TMPDIR/Sonos.app\" \"$APPDIR\"\nrelaunch_application 'com.sonos.macController2'\n", + "eb46b753": "#!/bin/bash\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n local logged_in_user=\"$1\"\n local target_file=\"$2\"\n local timestamp=\"$(date +%Y-%m-%d-%s)\"\n local rand=\"$(jot -r 1 0 99999)\"\n\n # replace ~ with /Users/$logged_in_user\n if [[ \"$target_file\" == ~* ]]; then\n target_file=\"/Users/$logged_in_user${target_file:1}\"\n fi\n\n local trash=\"/Users/$logged_in_user/.Trash\"\n\n # If the target contains glob characters, expand it and move each match.\n if [[ \"$target_file\" == *[*?[]* ]]; then\n local file file_name\n local matched=false\n local i=0\n # compgen -G expands the (quoted) pattern itself, so paths containing\n # spaces glob correctly; reading line by line keeps each match intact.\n while IFS= read -r file; do\n [[ -n \"$file\" ]] || continue\n [[ -e \"$file\" || -L \"$file\" ]] || continue\n matched=true\n i=$((i + 1))\n file_name=\"$(basename \"$file\")\"\n echo \"removing $file.\"\n # The per-match counter keeps matches that share a basename from\n # overwriting each other in the trash.\n mv -f \"$file\" \"$trash/${file_name}_${timestamp}_${rand}_${i}\"\n done < <(compgen -G \"$target_file\" 2>/dev/null)\n if [[ \"$matched\" == false ]]; then\n echo \"$target_file doesn't exist.\"\n fi\n return\n fi\n\n local file_name=\"$(basename \"${target_file}\")\"\n\n if [[ -e \"$target_file\" ]]; then\n echo \"removing $target_file.\"\n mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n else\n echo \"$target_file doesn't exist.\"\n fi\n}\n\nsudo rm -rf \"$APPDIR/Sonos.app\"\ntrash $LOGGED_IN_USER '~/Library/Application Support/SonosV2'\n" + } +} diff --git a/ee/maintained-apps/outputs/sonos/windows.json b/ee/maintained-apps/outputs/sonos/windows.json new file mode 100644 index 0000000000..c7f9f097e7 --- /dev/null +++ b/ee/maintained-apps/outputs/sonos/windows.json @@ -0,0 +1,23 @@ +{ + "versions": [ + { + "version": "90.0.77070", + "queries": { + "exists": "SELECT 1 FROM programs WHERE name LIKE 'Sonos%' AND publisher = 'Sonos, Inc.';", + "patched": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM programs WHERE name LIKE 'Sonos%' AND publisher = 'Sonos, Inc.' AND version_compare(version, '90.0.77070') < 0);" + }, + "installer_url": "https://update-software.sonos.com/software/rT0797IawE/Sonos_90.0-77070.exe", + "install_script_ref": "109fa54d", + "uninstall_script_ref": "e97fd1a8", + "sha256": "041d3a74d60f94d2b2c4f63909e765efd9648fc5407e970ef6441e66db8bd8ca", + "default_categories": [ + "Productivity" + ], + "upgrade_code": "{97B3FE78-37EB-4ADA-817C-A8BE2E514454}" + } + ], + "refs": { + "109fa54d": "# Learn more about .exe install scripts:\n# http://fleetdm.com/learn-more-about/exe-install-scripts\n\n$exeFilePath = \"${env:INSTALLER_PATH}\"\n\ntry {\n\n# The Sonos installer is an InstallShield setup that wraps an MSI. The documented\n# winget silent switches run the setup silently (/S) and pass /quiet /norestart\n# through to the inner MSI (/V) for an unattended, machine-wide install.\n$processOptions = @{\n FilePath = \"$exeFilePath\"\n ArgumentList = \"/S /V/quiet /V/norestart\"\n PassThru = $true\n Wait = $true\n}\n\n# Start process and track exit code\n$process = Start-Process @processOptions\n$exitCode = $process.ExitCode\n\n# Prints the exit code\nWrite-Host \"Install exit code: $exitCode\"\nExit $exitCode\n\n} catch {\n Write-Host \"Error: $_\"\n Exit 1\n}\n", + "e97fd1a8": "# Fleet uninstalls app by finding all related product codes for the specified upgrade code\n$inst = New-Object -ComObject \"WindowsInstaller.Installer\"\n$timeoutSeconds = 300 # 5 minute timeout per product\n\n# MSI exit codes that indicate success. 3010 = ERROR_SUCCESS_REBOOT_REQUIRED,\n# 1641 = ERROR_SUCCESS_REBOOT_INITIATED. Treat these as success rather than failure.\n$successCodes = @(0, 3010, 1641)\n\nforeach ($product_code in $inst.RelatedProducts('{97B3FE78-37EB-4ADA-817C-A8BE2E514454}')) {\n $process = Start-Process msiexec -ArgumentList @(\"/quiet\", \"/x\", $product_code, \"/norestart\") -PassThru\n\n # Wait for process with timeout\n $completed = $process.WaitForExit($timeoutSeconds * 1000)\n\n if (-not $completed) {\n Stop-Process -Id $process.Id -Force -ErrorAction SilentlyContinue\n Exit 1603 # ERROR_UNINSTALL_FAILURE\n }\n\n # If the uninstall failed, bail\n if ($successCodes -notcontains $process.ExitCode) {\n Write-Output \"Uninstall for $($product_code) exited $($process.ExitCode)\"\n Exit $process.ExitCode\n }\n}\n\n# All uninstalls succeeded; exit success\nExit 0\n" + } +} diff --git a/frontend/pages/SoftwarePage/components/icons/Sonos.tsx b/frontend/pages/SoftwarePage/components/icons/Sonos.tsx new file mode 100644 index 0000000000..4c75b4a800 --- /dev/null +++ b/frontend/pages/SoftwarePage/components/icons/Sonos.tsx @@ -0,0 +1,14 @@ +import * as React from "react"; + +import type { SVGProps } from "react"; + +const Sonos = (props: SVGProps) => ( + + + +); +export default Sonos; diff --git a/frontend/pages/SoftwarePage/components/icons/index.ts b/frontend/pages/SoftwarePage/components/icons/index.ts index 0fecd4c77a..9edf686a86 100644 --- a/frontend/pages/SoftwarePage/components/icons/index.ts +++ b/frontend/pages/SoftwarePage/components/icons/index.ts @@ -822,6 +822,7 @@ import SnowflakeSnowsql from "./SnowflakeSnowsql"; import Sococo from "./Sococo"; import SonicVisualiser from "./SonicVisualiser"; import Sonobus from "./Sonobus"; +import Sonos from "./Sonos"; import SonyPsRemotePlay from "./SonyPsRemotePlay"; import Soulver from "./Soulver"; import Soundanchor from "./Soundanchor"; @@ -1861,6 +1862,7 @@ export const SOFTWARE_NAME_TO_ICON_MAP = { sococo: Sococo, "sonic visualiser": SonicVisualiser, sonobus: Sonobus, + sonos: Sonos, soulver: Soulver, "sound control": SoundControl, soundanchor: Soundanchor, diff --git a/website/assets/images/app-icon-sonos-60x60@2x.png b/website/assets/images/app-icon-sonos-60x60@2x.png index 5d463035e8dd7b43d14b93958471b33a0400e721..45cfa0e932928d3256808ba1d32096f9a32f9f5e 100644 GIT binary patch delta 5180 zcma);XCTy%fi=Av%cvE&Urn^#J!uio-3CWyMfO>ox|m=HTVa z-QAEoo2^nM7!@O|I)mAs2rKaC*W%(J7i9J+S0eG=hm->2Vu5B2;5?Fz@I)~B)@ zAX8TF)kngQc7nm(l@ax%>xdiz)&IBg;*h@jo4=X#Jx-5y`G1AcJVm&v$dp+2)Ru?j zXS@7S@##_CU)gcrm(Dh8y5EwWO?ni9nq86$TK|euuoQ@_b47g^%!mjy@pd=q2V2dD zkIeeyy}C+d>7#8++(jhq^7P2^mA}3pG<(CPj8LN}T0jKL9XHq=)+%ypT$^7z!q^Ex z{g{xS{ZXJYk`EEJFpKjf977{e^)&i%F1JuwJq0anDlAHef!R`FV!ELX}seHA|i}E(1|9%NntM#-%Z0 z&IJ}b-{g$UrjjT;#thDmX3W%8;W=65d06iOGzXV^_OnB$QDTiO0z4~y<%3tsirm{m z4{rbLI6JN`oe_!7WY~JmOeYHv@NH+`Gk9O<-XI=yz0@lZf`E58+7MKY|9CD&F1It{kHkVbLl!wXb!ZKC$ zC({dW*D4B43R(lQYy=DBcD4j1#XSp`xZUHQ!kmNw9{a8G=8C+uuuDrLG~NXxVy<4> zE9S&aC+Mav2D}h(Beq`SC6|Oli+t<+^y=%K<$b4=Lsvv>|HZ&Zt<~l1aOcK`hG!4{ z`&`qPVLK(oPJ6RP>{!6%^J4Na#dH(~XfV^h>5FpFcI&r+ZW{cOTaIB6hME5`EqbG# z|H@eGfs~J0sCIkw@4!w2K32I0)_PS=3K9>E$|h0fTL5U+_=q+Wh zeSdIudD(opoUT?GJUcPJqg3#BhpqCR^QEu?sWZ>`p*+hKPjoksFf?SbU5T;P?7Nb1 zM)#SM_L+>*%K$O@n~D)%1oaaQ?5sN{J*X(mG_h-_ihMy&^>TKAhHi+SW<`O*y$ru# zND2<)p@13fvO-liw*bC@o&7lZy#IQoX>HxgGaf=Wfkv-<6mxOPad+ltK@?=Uq`G>b zXrYCWSfmc507L=2ZQ?!pg$gPIZIoHAyhro;IV&l8F?1$tVpUCv_N(2a#*7kV5%s%x zY8fvtuN=ksD7PDKQfTPP6W-?#b_WLxXi-`Yia|PIMJD{zbz(?TS$TQ>*j;bMG+0%& zR58^ulkB-VkesXRA2a<62{tsRBYwAEGsc#9;*eu~h}m~3d%(5(Uuvh~8K4f#*+v;f z{8pz1T!5rx33J8k%hI&T^C)TjYiC!WM&s%De`$a>l_87p8iYGx_?56pBz(sT$_m14 z#is9$0!4+!PR+w)Xd0FPDU*Bd>b$aun> z@4e%qpEO<4O~%f@39hB=h# zhu=S+U28+vzuMhNGCy_{)KVUfYHrYbdSNUGV`H$vZB{e zf$nf9WEf6zwa$SeXP$h;c&tvR|717obAK!E^SGIm>0r~Vn|pW`^x@AQSc6p3pzZ0t zc%PFvgNaP(%R~NX97BW6M?a2!y1-8PdcVRCs;X8LzL28)AL6aXvLEdCx@Y-q5a)>J zZ+~aZk?i{F&5Y(|6|(t`IYB(dYu~#TYrayJ~`y zi#(6V572hosmk)N+wd%>(`Vb(unnc4(zGeu=K=K`h3ds(f3o1GNxr?^isK|MqIcNz z;vhZHN=kX5Sm!V^OBU}4S)7#$x&A1VQXJ@QaGOEwXXy!%QrZ5{Klqu@&m_?x z)J+aA-YNCY3RwoGy-^rS4SzFw&L5@maXDiT7`DVdL|{{TX?-}QUb0ZZ7P`8dU(&LN zexjpvJnVhs22M#Di!}MpqIn+)`A#WaIi5RHitVgA>Gl5{Ga=R6*8pWqpa~b$8n38U zp0N$yJ!Dx7FS+Qu%rfn|IyGjB9XE*~V`Q#-JBGT)YcA4WIJ)XoCS zFJ^9$vy=(Af^Mpqd@AV$7(?M(mgwV+oW5IKbAGeFAlK!e^i-D3%q1cU+4i-r>IlnU z7mZ-_>&~o>l&Y`&6O8d?Cl4c$v}&Gitn2D6A9Aw~}? z+Vm*eMd+G@FJC6*RUV)ql+frc9e59BHX3XqTTVfsd}G*B&}JrrDwpA zo-ooBdeSr10Ui}RMDvw{iku*@?|NH;1*QiQ2Gc*K(74<;UTv?(+~A`VY+52706}{~ z!xxI{x9W*qUp<}>BpYJqmTI$>s(8^G+C!z9Rb5b{($?? zqMSaZa%X0LencnFL1z~~MpiQOjiU&q#s5i`@HIIXDjEqJhnz%d=VaA=ZZ^X#UxwDK z$wMmi*fRq=EBBB%vNNdXV2KTYs!Wcg+y2$KGIcm#T{cbs!mE-KV+1{S z4VA`h4B&LL&jK6W6>cgbw*b-9Z>cSirqD0*oPtUEEU(=xqgklBEz~J~CM;YYXZHnN z1l{cAl=a?LGClWg^~x+~OgIUR_-8Ml8nb@*Djzgi*sAcVj}KZY`%^`-f;9`#ZoofY z;vtuY+>k6VjRad!ync)g`k4g@4qfP?nJpN%L7-9Z5is4C4gV`dca3kH|h=H zEx3IieJCO?EBMR3Oo@x6_zK?a7mnWfGLi*J_J#|QmsWB}_Bk!9Z-t3Zk6~4TvgxrO z#j6VN$e<`v?RL+mmI`Q{$u9kTEl=mB?4bxjzhm-&h?*wKec7NMNmi#V8#rBY+dn#sbx^oxS?r%oTTSZTNm-%rgYmxzs_m|#nV!(Wxu2&KV z^I(zu31~43Y$7@*U781G0Aq$Uabdn~?>luwSbKLX7SjmuQ3cb)1)*Im?O1{{UpK7``qzqjjmIKNVp?zKG9h!((hNUxCgFlZoO`(8wojyl%5n!o*TSK zz5H=cCQ!?N2o&22Ir%~g&zL#<#aLFE!BF0jN;?VYKzD;{nGbAi&QBF9!8vMHnl3=k zJtQp`de8=pztNJ*@nSz0p8W$e`1|c2ai7Id$ly15Jq}u>V?ZuXAz?@C9|lj& z%LtD&S+T=NY!k;mu(Q<}8}&ZvYRY$-TP_aWz-@5j;rC%9bV#xo2R8g#86jb1`n@6A z^G}lCEji$WAu{J);hnJy0uWEhaxOIA&cmX111xvPwi;T-5@5ROeWzWfC`Hs5{q&{C z8YFwapQdBdvXhd&3U4b*NfaJ9f7qot!M&-%CPRUg9>dKCpH&q z1eS`w%q?#FM|~w(K%K2R2x=v7A@Kd5Gla(R<6Cqp!R!yhQ(x&-h3O4L0kYN8w}JDawXKP=A?ae&FWFs!%KqLH!z`S);q9RGebKVWyqRy)K754@X zcG&0Y^z^FMB@P0tXob-f!c(2|EirZTVtSI6(OWu&;TeUi{O?;uBfQ! z38B_=y2@bJa^()K&{1q)nosIZmaXRkj2I7L$K&z6xw*MRr}`fP$;>5l@q&@KoT-VA za~qkI9)5Jzj{RIM1lQRU2$psDi>g zEmvWlZ|Nz79Rk;a0>eTB0_3$=5kvgyM_NxbkN{lfB*TW0_q+qd^(X>yrp0Nb{QVZ* zqUH{8AX}OJba)jku^k0ANDvjR2dBj8534mh_@i_8dn(e^RLdZ3ZtKeN#9L8uaW18h z9npXS`6I2WdWh0~_7Kxz_OuD8ypc1PQs;&)vD_3wub%CL+eB?f^Q6;&G}H0jYsK$m z0piCFOOchg;MIiizq@;*)-OBGc>TTFFUj@Svtl)9Z$mrIk5!3hkBpDK{-f2P#&wpd z9cejF!-0iDOFE6pr3uv!%hGntyCdS&I{BuZMzak;rV;yz)OX+J#|E(AaJYl`dyW+9 zm%&_EQUMR1-Rx9ZGu^{=>?ScvGxYGFrQ z_ZTT1rzuil4x3GMiR{&EKt_l=B12cAg0E-9eB^IayLa_CS#aQ}|NZ0hK_c?7CvdA} zN?Thy-0NETb$ZOd#8QjL)ASoZ36bYGhuNGSw1_`;oW$&n zxefWY*$6tka)7e$o_`N|G_Sbs6&}MEx@_>3XFQTk+&bZ_Htz*|*!s9M%sEU3iea0S zCheQ7;Sl+{Tu?)8xuI!Fe$e#a@ZXW%j~{{F-rzZoLZM8zx3@>MjH((09oMq`eX*sL zI0GjsX|v{i^6-bom}}{)apJ8{d`DA_U*$Rlb&roO7>oB6E@d;mOCUkfV!(tDPqO*#wB;RN%@`^G+J(-|$1IDVkF*I=t zRvA$j^pM&KX*CwHpBCnA6x1wm54?xze0Tfv$|uW-!4R`g$RBU`M>si6MUG)VWHQ-d&Ipxo@Al_;XWyZ8LWdYXM5 z26nd>`^A_1q~^0JmQN=g$$dkwT$GnWHt(t}g#P6&9AWkQ`G-Xw1v>dV^@uLIpeG*>cGDk>YD0Q I-*ArlKc1wt-v9sr literal 6862 zcmai3byQW|w%>>5P=`)A2T-~@4UNe5bIoDi!??2YsuQk;b3BWX9000P-mE^VVM${j{!MeM*!7cjk z1`JzSHCX^Ci^03Hz`V0zmP%S`0N}%XhYJOOi$C~H0C498fNgUC5KjaEO6S!2Cz5vo zd20h@8#Oh6{Z7XLKw&VK-aq?h=e>S&F$fO$DOIJt>?NiqI~5Wmy^xOo_1 ze?gEhq!#jkbKM@{2ZeE^$=Dwp!{_%=GL^vQ^wVf?2t>Ju< ze*yp9^{*;_qc!cltQ`#G?H#S1-0o%s7vkgp2kC!C{#T~qe`Nk!wf5c zh}?<)PQXUV$K)4dhQD^3vKDd%72Oa{`e|P-hCXZO4K|(%#xcG`$;mKeLNsw$G04!s zp#N;%NHdw&C59M_>`^H0nJu}Dk3&{I!ooVXD+Pt>zMgz8>tQR#o-X9}cKWzCb1~z_ z^mXP7`uu!T%`_)>O2>MkS>j7w=WS+Nj1eY#?ynf>*NjtFdr>1)>@w zyVS8QI?FNxECa6iV)cZA$PPIVJoo3G{WLZWex|F8d66_;S07eg$?HvundB#S3Dlyt z>U2N&Iwe;$6`L{#un)6^BMb#UDLTlX;iq(X=XE@5l)OJ>W1U4hKCAeXp@_-1lzmJHOxY*v8QcbPC3p^ zBT3=0HQ9K?=B6++@%FsptS#ijoE=1-1|@g>(w3S6W&Fty`52k`!rR$g(coRYkll&O zi&xCg=1w$Xc!;@$%~(Qqg`X*O=YK|Am2lV;o4n{8zAgp~HhhU4KVk+@B+BreYr~F`Q&fPKXGV>?XX)@26$; zdpT@Qt2-%ND6Xw_+I-dp=RVedp%=(!B!w_R)+ELfFB z|LQY8ZWmZqa~?910i`7s=CA5H2rpes8GfR$4jb-nU{=hRdeAD1e(_1Z`1+Y*@sRmt z2ihCx_~E&d;=bSmKR1k$HSn7T(Vt@h$?-?2C-oz48U858$Xs=`a2LO+RpiY0$zVR! z(f2lw5t}OEG>)RAfaA7;$<2c6l~K4MYAr@XHT*S>Kkj@J$xTd<&>@d`)Y%g&ukOCs zARfo_k3a~v`~WTy!FEZtPg8ia!5r4SSy&k6v4%=is^go7Zd`5P{rRshjrTluLcU5L zfAZIz#KwS_;}PNdICt!^+^4m+Gyq*NcMh7zR2D?+Q@@-)^=Y0bCV3y5OeWCAD)JD_ zds#dZx6~qA!&F?dxy%SqhrXKnl_=$n{1}%`rG-+q|IKuUrID-!FvVWhs54!nF>prq zOm>)AhgL9PDuv_T3p1|oJrqH!3*1?xptT}~uGP-t*fxSuwX&K@rS4=-CLCaV3>aQF zM)}ArQzKZ0C|V_I9VX9CzphC}g(Fx7Z5|>%`u5H`r$*6-yjch-ALA8Z!=P>mG-{^k z)5jR?-)k#gF%b4K9w`9GHcC78nN*gR`M4X4J|E=507C;#ZbhqnAw2|oJvj=h={(g< z^3mjPZuz1uUdUNe5N~7ArXCRBI`#^ij0}?k%`3Y;?yj8vUAb01yGHk;6Xg#g;ixgT z`Om{b631X|O1F>|&F}b(%~=+62O~K^uymdd>R7t6iL1-$k(&lMD0cnJF-UJ7D_v`zmeX{jIoLo_fBH)fXZQ|hq zAZw?XjOwj5v z=Z4~FsR_`=`6=mj-m881RcPUbPmok`meI{(7aA7VRHKh=xst?kaFxZG9xr^*^pT1d zt1I+^>Zxt)7P$Ew^tq|*wK|2)XkEEc9D0dwVMu+4u=Ka^$<*2G^{?I(>_vrnSJ~`e z@|_@(By|BbRAHJC(O~o?`%jA6L=$w z-}(ySX1}!&wq>rzr#m4S{xi`fjsfXzB$6!V4I|j0V_9|f_H*QUia>KpPS&;Q zIRM)+c~^{x*Em@g{wrH2zx}uJ+TO`CK0pW%1)nVzsBVu*1$R29bepY5@uJ^0EwSDc z(`7ze2wVXk|DsrO7Y%N+H~MA5j*>lh>Oi+cSdPsq){<9ch&JD47Vw zSqiMU734C_kX?ZCWP>}yGHO4afRkoSDwKdWMnG21L@6^+Z$OIHTij!L;l8rkT(^d_waySfeE3bwj#U&RP7*Yop z6f-`hsK@L(^3M%>a&n7bmk;U;v&?FMZ}f?NJ+fesrR+D_Ki^E@^jQn>FLZDjXW%}GCfbIJUMxgW5brH)cFLVaO8mZJBwuOlZd71d2Iut{dbi6>yd7mMygvG)nOyk2SddbJJ8b$EjQ}f zakImPRhM#Ebnthf5YnvoZa{xuF$HDDKVcV=t7;X z0Lp*)!~%&qw5XXLv>&5>=vtbpc2a(znCLKjXkgkWcQs3xg(?*^W3IO) z|1AlHE$z)gXJgDl){{8*wCo0gll{G zD?Dd>H$09G&oiQTi{KO6*hlo1bfXgSX5M!Ab3<^Fi@c65(;f|$TvotF#kGd}7dN-f zQ(#95i+<)=K->Zrv}u*OA7X&rZv(OIv;xIsZtk1&8CTK^O}Mc3%#mu_w|~ly4Xz#T4b;rEU6@w8t=I-qj8lw*jM%tCHH{aPpojriN^h@ia}RdXj`AGS1sB3G zsiofZqn(toA8Yz$ZLII?EgIFgedsf+GoV>KUiPiW!;7#WQaZ(;7z&t($Zc9;HefJ0 zW%!Ymf^JhZr80>pZ!9fvN~t8!FE%Y-t5rPTl=2CoisB>n*Rz6V9l3m5V!68S2w$Sg zTUO#j*B+vAmDtBj8KN{#zZ0E~1(W->pAZO?2+7f6b_lf!=BVNi-Owr?F9%eo=acq& z^(9&@wPy_ypWFkhylBS{bIvmvGyX}n>UqlfLsh_RN*+;k8C0&GfF})jC936CqNpdn z+1_sye1YF0`xc|*Z0+=0-quinas{O$F{-s7K9pLs+xNLL+Z@wu+CaDVaEg@gpdsuF zx&F8ox-o^#+6SAtx6C$qS0oc#)7A|ggy_D`2n=j8zZYKTfP0K*`0+QcvHsTr(+v1I z81rKx=H!bZ=5Ly@2kEb}Yr8dnOL=CLTaAT{)B(3_l2iTQGqqC8g zJkCDdn3p*%P5L!~hGEcl+2yfQjG2OyUOsX8s9lr9#!5GH3n+z0o%Fz>oi=gasdZgc_fJNL7Np-!^nZ(^D6i%)v&?uK_6aS^b^o@* zovrfh_l`aFp3lb)$xhk4J>&g2_bcxsIGS`7FxK(Sm#O~&(Df5Nagu097M(lNwMNSf zlK|1AJRVZxDcw+?a7KuhH1vXzu3=xZ0Yan7M_0{z5>H&xb>Yw2VDKK>P9#d*2Aa8h ziO2dT02MGa+pU=UbUycktXTi11aoQ)mC7WP;xX_7&BF54a)=v7{Y}r3t%J$~hF^6*SZ^wbjKZ2?+)trWj+5eLGo;q*Xe1c(mv5A}}Xn4=b5fCL4;!psDe98Q`9!9c#kno~ep%5wzpQr6A1^shB0eq6D}VO;#;B$G*7_%O z_biJV`hI7wR|>bMFCm8wjG7LJ#TE%kOH7VW;h{ZUjc{ZrMByJ~u8>lXSI+bOie*)0 z43;dpJ~8sytU`DZ6j9jRROw!BMG0ZEMNE!}&j(nTj*oKAyRCFWoG7*!&cIWM1rd9| z-Gbu~- zxdgK%nQr;Qb8um^bNO&ij7}3wF4(c@u8hdPeV0I?!Dcl7g4?Y>Wr4!e)4#klSz4Z@nX@JRpKcp z`}(caVXe??H$T5}HF@fDyih{y>sbVOf`xHox3|mEIU*SCru2?*;Xw=+xs!gMkMnBt z-auEU7AHqhHIe4Qjq(#g-xz6lY-zoj>*$mUt&9E>35X6k- zYWdNEY%N@-;Km{>3Uemrh`sbQoIeadm=azN7ljw1)5&g;J##$4Dvgi%iC(O%sB_u4 zA=dlQd6!LWnG&GC^f-$07aQTZA;5eB?VY8!kZU%=p?^bswloNP|FtnptMY3UJBkgC zs|M|iF_(9c7{ z;?~t%(4vs?-|Iy0Hb=Fhwb-f!cRQ*_WR!VKk3rmozd&POv`{GGmwWe?iZ~GR$8lPK zzZWLbK00P|K7th!$1W~;LF^N-Zu!HWEB`^}SSDfrt8o%YqATvE+2;qa%nr+djrVAY zF)lJSnPh*PN9?G`g>S=+lY)U%UoZ*K>Q{60L4v#aV=@n$yH|C<5Ie1(t2eBen^w&O z4$)A&G3%QV%0}=a|7dtph~8Ho8JPr<%_l%hqMOM+sek=UZD!bZ@GUWfC;P1~{Qk5B zXzK|uvg4Cbk(?3l*sfh4frbw14u(b`9G=^WX2gFAF&!%a;;&j~_;0qFx2w%sewojH zNz8yi$`?b~Fs+Y2^=nOzj~4*%Z%l8*0vf8rp#%D4Fr39SAfTpvvo9?#dExE%5uQ14 zsm0!B*MRtIuNTvT$jYLK3tZ4wo)(^NE2sIcI#1+VCrtAjcWYe&-%R(v=b*jd-`6O1 zt7nhhkgE?0^-N0Aum7;n;l@tB3F~F1Xp;=(j9z{3=xCqYCIP$`$p$8B^q^+A}yg0j16$mRZ#OMHv6E5bb$aTX?5{hj zVCp&?)GOhYh)IhsGjUZ2@^`X0Zit+`C&$k?R{=$B=>f&)q#@(_YJumQ!z6>FAENYA z$lbZoxTuFUntqRDb;M!@!bnZmp;E%^VuDkp9=3Xe#czUNUWt}#?}9-=0`tg5-Z#&0Jt?VYYE(q*XL0P ze%q@|H2A@z*y2vVCx9TvgHi_xlhV_LVpW><9+xG8msY?(v4Q9q?ixBOSH=QeP=7xTO|PDK&hmEuNSkp z;q?)pmZXUw(zB|b9-QhLX`=n^fonf;66AN=CJ-%&60j;w`i@7E&Njmqe zZH%$?=ZKe4M;F~=yOp<$7~ZiDOeGu0w(4)cajsG`2D2ph7LWpomiY;am2=4P*~YicQct1}q1r$M$Cu#*#lebD!1 z$i;JM?&0QHx8dHY*fZhfQ5qN%|9cRW6$_rlHkXtAh;W;xk8M6jw2}RNbMN#l*V$XH zkWJc<)dYB}O>hZIm4|8k;nn;h!mzlCNyC9bFnx>LTb;Y0;!AZgb4hKkgXbfQ->=84 zQ@f`cGrI7*Xo#{@S}xru1fGhVW15K6OlV}{Xi=9+b`uq65uMo$tqFN!go`3#G&?sr zM<$LX6&vQyp7+^bt{YMW`Ub#sya{|>64^AK?cdD5Cc1TGw*b=Aw1!1{i7v9PGc^tn zsWl3&_<(kL&ex3v$KTEgQPI)4qoaDzqK9H!JttQFLwnYSCJ75YZgihW7W1VNj#Z_5 zL5cI4v;=mSnNo`6L*Hi2N%x;BW6CHROAwvO<`c62pJ(w`P=&=nkT3Hz^4YgWr9Z!Z NloizFi{;FN{|l=BpacK_