From 4a2e56e03b1a84be0a1d3273cbca8b12c30558b9 Mon Sep 17 00:00:00 2001 From: Chad Retz Date: Thu, 26 Dec 2024 14:27:14 -0600 Subject: [PATCH] workflowcheck - initial support for Java static analyzer --- settings.gradle | 3 +- temporal-workflowcheck/README.md | 325 ++++++++++++++ temporal-workflowcheck/build.gradle | 44 ++ temporal-workflowcheck/samples/.gitignore | 3 + .../samples/gradle-multi-project/README.md | 18 + .../samples/gradle-multi-project/build.gradle | 9 + .../gradle/wrapper/gradle-wrapper.jar | Bin 0 -> 60756 bytes .../gradle/wrapper/gradle-wrapper.properties | 6 + .../samples/gradle-multi-project/gradlew | 234 ++++++++++ .../samples/gradle-multi-project/gradlew.bat | 89 ++++ .../project-app/build.gradle | 43 ++ .../sample/gradlemulti/app/App.java | 9 + .../gradlemulti/app/MyWorkflowImpl.java | 15 + .../project-workflows/build.gradle | 14 + .../gradlemulti/workflows/MyWorkflow.java | 10 + .../gradle-multi-project/settings.gradle | 6 + .../samples/gradle/README.md | 18 + .../samples/gradle/build.gradle | 42 ++ .../gradle/gradle/wrapper/gradle-wrapper.jar | Bin 0 -> 60756 bytes .../gradle/wrapper/gradle-wrapper.properties | 6 + temporal-workflowcheck/samples/gradle/gradlew | 234 ++++++++++ .../samples/gradle/gradlew.bat | 89 ++++ .../samples/gradle/settings.gradle | 5 + .../sample/gradle/MyWorkflow.java | 10 + .../sample/gradle/MyWorkflowImpl.java | 14 + .../samples/maven/README.md | 24 ++ temporal-workflowcheck/samples/maven/pom.xml | 102 +++++ .../sample/maven/MyWorkflow.java | 10 + .../sample/maven/MyWorkflowImpl.java | 15 + .../io/temporal/workflowcheck/ClassInfo.java | 274 ++++++++++++ .../workflowcheck/ClassInfoVisitor.java | 405 ++++++++++++++++++ .../io/temporal/workflowcheck/ClassPath.java | 118 +++++ .../io/temporal/workflowcheck/Config.java | 51 +++ .../workflowcheck/DescriptorMatcher.java | 153 +++++++ .../io/temporal/workflowcheck/Loader.java | 396 +++++++++++++++++ .../java/io/temporal/workflowcheck/Main.java | 143 +++++++ .../io/temporal/workflowcheck/Printer.java | 159 +++++++ .../workflowcheck/SuppressionStack.java | 59 +++ .../temporal/workflowcheck/WorkflowCheck.java | 158 +++++++ .../workflowcheck/workflowcheck.properties | 184 ++++++++ .../temporal/workflowcheck/ClassPathTest.java | 61 +++ .../workflowcheck/LoggingCaptureHandler.java | 50 +++ .../workflowcheck/WorkflowCheckTest.java | 373 ++++++++++++++++ .../workflowcheck/testdata/BadCalls.java | 173 ++++++++ .../workflowcheck/testdata/Configured.java | 129 ++++++ .../workflowcheck/testdata/Suppression.java | 171 ++++++++ .../testdata/UnsafeIteration.java | 87 ++++ .../separatepackage/SeparateClass.java | 23 + .../testdata/workflowcheck.properties | 31 ++ .../src/test/resources/logging.properties | 23 + 50 files changed, 4617 insertions(+), 1 deletion(-) create mode 100644 temporal-workflowcheck/README.md create mode 100644 temporal-workflowcheck/build.gradle create mode 100644 temporal-workflowcheck/samples/.gitignore create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/README.md create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/build.gradle create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/gradle/wrapper/gradle-wrapper.jar create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/gradle/wrapper/gradle-wrapper.properties create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/gradlew create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/gradlew.bat create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/project-app/build.gradle create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/project-app/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/app/App.java create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/project-app/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/app/MyWorkflowImpl.java create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/project-workflows/build.gradle create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/project-workflows/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/workflows/MyWorkflow.java create mode 100644 temporal-workflowcheck/samples/gradle-multi-project/settings.gradle create mode 100644 temporal-workflowcheck/samples/gradle/README.md create mode 100644 temporal-workflowcheck/samples/gradle/build.gradle create mode 100644 temporal-workflowcheck/samples/gradle/gradle/wrapper/gradle-wrapper.jar create mode 100644 temporal-workflowcheck/samples/gradle/gradle/wrapper/gradle-wrapper.properties create mode 100644 temporal-workflowcheck/samples/gradle/gradlew create mode 100644 temporal-workflowcheck/samples/gradle/gradlew.bat create mode 100644 temporal-workflowcheck/samples/gradle/settings.gradle create mode 100644 temporal-workflowcheck/samples/gradle/src/main/java/io/temporal/workflowcheck/sample/gradle/MyWorkflow.java create mode 100644 temporal-workflowcheck/samples/gradle/src/main/java/io/temporal/workflowcheck/sample/gradle/MyWorkflowImpl.java create mode 100644 temporal-workflowcheck/samples/maven/README.md create mode 100644 temporal-workflowcheck/samples/maven/pom.xml create mode 100644 temporal-workflowcheck/samples/maven/src/main/java/io/temporal/workflowcheck/sample/maven/MyWorkflow.java create mode 100644 temporal-workflowcheck/samples/maven/src/main/java/io/temporal/workflowcheck/sample/maven/MyWorkflowImpl.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassInfo.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassInfoVisitor.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassPath.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Config.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/DescriptorMatcher.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Loader.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Main.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Printer.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/SuppressionStack.java create mode 100644 temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/WorkflowCheck.java create mode 100644 temporal-workflowcheck/src/main/resources/io/temporal/workflowcheck/workflowcheck.properties create mode 100644 temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/ClassPathTest.java create mode 100644 temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/LoggingCaptureHandler.java create mode 100644 temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/WorkflowCheckTest.java create mode 100644 temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/BadCalls.java create mode 100644 temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/Configured.java create mode 100644 temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/Suppression.java create mode 100644 temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/UnsafeIteration.java create mode 100644 temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/separatepackage/SeparateClass.java create mode 100644 temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/workflowcheck.properties create mode 100644 temporal-workflowcheck/src/test/resources/logging.properties diff --git a/settings.gradle b/settings.gradle index cca3ef0b82..23d8368657 100644 --- a/settings.gradle +++ b/settings.gradle @@ -9,4 +9,5 @@ include 'temporal-kotlin' include 'temporal-spring-boot-autoconfigure' include 'temporal-spring-boot-starter' include 'temporal-remote-data-encoder' -include 'temporal-shaded' \ No newline at end of file +include 'temporal-shaded' +include 'temporal-workflowcheck' \ No newline at end of file diff --git a/temporal-workflowcheck/README.md b/temporal-workflowcheck/README.md new file mode 100644 index 0000000000..8d2e6a04cb --- /dev/null +++ b/temporal-workflowcheck/README.md @@ -0,0 +1,325 @@ +# Temporal Workflow Check for Java + +Temporal workflowcheck is a utility scans Java bytecode looking for workflow implementation methods that do invalid +things. This mostly centers around +[workflow logic constraints](https://docs.temporal.io/dev-guide/java/foundations#workflow-logic-requirements) that +require workflows are deterministic. Currently it will catch when a workflow method does any of the following: + +* Invokes a method that is configured as invalid (e.g. threading, IO, random, system time, etc) +* Accesses a static field configured as invalid (e.g. `System.out`) +* Accesses a non-final static field +* Invokes a method that itself violates any of the above rules + +With the last rule, that means this analyzer is recursive and gathers information transitively to ensure +non-deterministic calls aren't made indirectly. + +⚠️ BETA + +This software is beta quality. We are gathering feedback before considering it stable. + +## Running + +### Prerequisites + +* JDK 8+ + +### Running manually + +The all-in-one JAR is best for running manually. Either download the latest version `-all.jar` from +https://repo1.maven.org/maven2/io/temporal/temporal-workflowcheck or build via `gradlew :temporal-workflowcheck:build` +then obtain `-all.jar` in `temporal-workflowcheck/build/libs`. + +Simply running the following will show help text: + + java -jar path/to/temporal-workflowcheck--all.jar --help + +Replace `` with the actual version. The `check` call runs the workflow check and it accepts classpath entries +as arguments, for example: + + java -jar path/to/temporal-workflowcheck--all.jar check path/to/my.jar path/to/my/classes/ + +The `check` command accepts the following arguments: + +* `--config ` - Path to a `.properties` configuration file. Multiple `--config` arguments can be provided with + the later overriding the earlier. See the [Configuration](#configuration) section for details. +* `--no-default-config` - If present, the default configuration file will not be the implied first configuration file. +* `--show-valid` - In addition to showing invalid workflow methods, also show which workflow methods are valid. +* `` - All other arguments are classpath entries. This accepts the same values as `-cp` on `java` + commands. Each entry can be a set of entries separated by platform-specific path separator (i.e. `;` for Windows or + `:` for Nix), or prefixed with an `@` symbol saying it's a file with entries one per line, or just as separate + arguments. They are all combined to one large classpath when running. + +### Running in a Gradle project + +See the [Gradle sample](samples/gradle). + +### Running in a Maven project + +See the [Maven sample](samples/maven). + +### Running programmatically + +The workflowcheck utility is also a library. The `io.temporal.workflowcheck.WorkflowCheck` class can be instantiated +with a `io.temporal.workflowcheck.Config` and then `findWorkflowClasses` can be run with classpath entries. This will +return details about every workflow method implementation found, including invalid pieces. + +## Usage + +To use workflowcheck effectively, users may have to add configuration and warning-suppression to properly handle false +positives. + +### Configuration + +workflowcheck configuration is done via `.properties` file(s). The main use of configuration is to configure what the +system considers an "invalid" method or field. Each property is in the format: + +``` +temporal.workflowcheck.invalid.[[some/package/]ClassName.]memberName[(Lmethod/Descriptor;)V]=true|false +``` + +The key names after `temporal.workflowcheck.invalid.` are known as "descriptor patterns" and these patterns are checked +to see whether a call or field access is invalid. If the value is `true` the pattern is considered invalid and if it is +`false` it is considered valid. When supplying properties files as configuration, the later-provided configuration keys +overwrite the earlier keys. During checking, the more-specific patterns are checked first and the first, most-specific +one to say whether it is valid or invalid is what is used. This means that, given the following two properties: + +``` +temporal.workflowcheck.invalid.my/package/MyUnsafeClass=true +temporal.workflowcheck.invalid.my/package/MyUnsafeClass.safeMethod=false +``` + +Every method and static field on `my.package.MyUnsafeClass` is considered invalid _except_ for `safeMethod`. + +The [implied default configuration](src/main/resources/io/temporal/workflowcheck/workflowcheck.properties) contains a +good set of default invalid/valid configurations to catch most logic mistakes. Additional configurations can be more +specific. For example, the default configuration disallows any calls on `java.lang.Thread`. But if, say, a failure is +reported for `java.lang.Thread.getId()` but it is known to be used safely/deterministically by Temporal's definition, +then a configuration file with the following will make it valid: + +``` +temporal.workflowcheck.invalid.java/lang/Thread.getId=false +``` + +When the system checks for valid/invalid, it checks the most-specific to least-specific (kinda), trying to find whether +there is a key present (regardless of whether it is `true` or `false`) and it uses that value. For example, when the +system encounters a call to `myString.indexOf("foo", 123)`, it will check for the following keys in order (the +`temporal.workflowcheck.invalid.` prefix is removed for brevity): + +* `java/lang/String.indexOf(Ljava/lang/String;I)` +* `java/lang/String.indexOf` +* `String.indexOf(Ljava/lang/String;I)` +* `String.indexOf` +* `indexOf(Ljava/lang/String;I)` +* `indexOf` +* `String` +* `java/lang/String` +* `java/lang` +* `java` + +The class name is the binary class name as defined by the JVM spec. The method descriptor is the method descriptor as +defined by the JVM spec but with the return type removed (return types can be covariant across interfaces and therefore +not useful for our strict checking). + +Note, in order to support superclass/superinterface checking, if nothing is found for the type, the same method is +checked against the superclass and superinterfaces. So technically `java/lang/Object.indexOf` would match even though +that method does not exist. This is by intention to allow marking entire hierarchies of methods invalid (e.g. +`Map.forEach=true` but `LinkedHashMap.forEach=false`). + +There is advanced logic with inheritance and how the proper implementation of a method is determined including resolving +interface default methods, but that is beyond this documentation. Users are encouraged to write tests confirming +behavior of configuration keys. + +### Suppressing warnings + +Usually in Java when wanting to suppress warnings on source code, the `@SuppressWarnings` annotation in `java.lang` is +used. However, workflowcheck operates on bytecode and that annotation is not preserved in bytecode. As an alternative, +the `@WorkflowCheck.SuppressWarnings` annotation is available in `io.temporal.workflowcheck` that will ignore errors. +For instance, one could have: + +```java +@WorkflowCheck.SuppressWarnings +public long getCurrentMillis() { + return System.currentTimeMillis(); +} +``` + +This will now consider `getCurrentMillis` as valid regardless of what's inside it. Since the retention policy on the +`@WorkflowCheck.SuppressWarnings` annotation is `CLASS`, it is not even required to be present at runtime. So the +`workflowcheck` library can just be a compile-only dependency (i.e. `provided` scope in Maven or `compileOnly` in +Gradle), the library is not needed at runtime. + +the `@WorkflowCheck.SuppressWarnings` annotation provides an `invalidMembers` field that can be a set of the descriptor +patterns mentioned in the [Configuration](#configuration) section above. When not set, every invalid piece is accepted, +so users are encouraged to at least put the method/field name they want to allow so accidental suppression is avoided. +That means the above snippet would become: + +```java +@WorkflowCheck.SuppressWarnings(invalidMembers = "currentTimeMillis") +public long getCurrentMillis() { + return System.currentTimeMillis(); +} +``` + +_Technically_ there is an inline suppression approach that is a runtime no-op that is `WorkflowCheck.suppressWarnings()` +invocation followed by `WorkflowCheck.restoreWarnings()` later. So the above _could_ be: + +```java +public long getCurrentMillis() { + WorkflowCheck.suppressWarnings("currentTimeMillis"); + var l = System.currentTimeMillis(); + WorkflowCheck.restoreWarnings(); + return l; +} +``` + +However this is hard to use for a couple of reasons. First, the methods are evaluated when they are seen in bytecode, +not in the order they appear in logic. `javac` bytecode ordering is not the same as source ordering. Second, this does +require a runtime dependency on the workflowcheck library. Users are discouraged from ever using this and should use the +annotation instead. + +### Best practices + +#### False positives + +When encountering a false positive in a commonly used or third-party library, decide how far up the call stack the call +is considered deterministic by Temporal's definition. Then configure the method as "valid". + +When encountering a specific false positive in workflow code, consider moving it to its own method and adding +`@WorkflowCheck.SuppressWarnings` for just that method (or just add that annotation on the method but target the +specific call). Annotations can be better than using configuration files for small amounts of local workflow code +because the configuration file can get really cluttered with single-workflow-specific code and using configuration makes +it hard for code readers to see that it is intentionally marked as valid. + +#### Collection iteration + +By default, iterating any `Iterable` is considered unsafe with specific exceptions carved out for `LinkedHashMap`, +`List`, `SortedMap`, and `SortedSet`. But in many cases, static analysis code cannot detect that something is safe. For +example: + +``` +var map = new TreeMap<>(Map.of("a", "b")); +for (var entry : map.entrySet()) { + // ... +} +``` + +The implicit `Set.iterator` call on the `entrySet` will be considered invalid, because `entrySet`'s type is `Set`. The +same thing happens when a higher level collection type is used, for example: + +``` +Collection strings = new TreeSet<>(List.of("foo", "bar")); +for (var string : strings) { + // ... +} +``` + +In cases where the higher-level type can be used, try to use that. So in the above sample change to +`SortedSet strings`. If that is not available, wrapping as a list just for iteration is acceptable. Workflow +performance is not the same as general Java code performance, so it is often totally reasonable to accept the hit on +iteration. So for the first example, it could be written like so: + +``` +var map = new TreeMap<>(Map.of("a", "b")); +for (var entry : new ArrayList<>(map.entrySet())) { + // ... +} +``` + +In advanced situations, warning-suppression approaches can be applied. + +## Internals + +The following sections give some insight into the development of workflowcheck. + +### How it works + +Workflowcheck works by scanning all non-standard-library classes on the classpath. When scanning, in addition to some +other details, the following bits of information are collected for every method: + +* Whether the method is a workflow declaration (e.g. interface methods with `@WorkflowMethod`) +* Unsuppressed/unconfigured method invocations +* Field accesses configured as invalid +* Unsuppressed/unconfigured static field access + +This intentionally, to avoid eager recursion issues, does not traverse the call graph eagerly. + +Then for every method of every scanned class, it is checked whether it is a workflow method. This is done by checking if +it contains a body and overrides any super interface workflow declaration at any level. For every method that is a +workflow implementation, it is processed for invalidity. + +The invalidity processor is a recursive call that checks a method for whether it is invalid. Specifically, it: + +* Considers all invalid field accesses as invalid member accesses +* Resolves target of all static field accesses and if the fields are non-final static fields, considers them invalid + member accesses +* Checks all method calls to see if they are invalid by: + * Finding the most-specific configured descriptor pattern, using advanced most-specific logic when encountering + ambiguous interface depth. If it is configured invalid, mark as such. Regardless of whether invalid or valid, if it + was configured at all, do not go to the next step. + * Resolve the most specific implementation of a method. Just because `Foo.bar()` is the method invocation doesn't mean + `Foo` declares `bar()`, it may inherited. Advanced virtual resolution logic is used to find the first implementation + in the hierarchy that it refers to. If/when resolved, that method is recursively checked for invalidity via this + same processor (storing itself to prevent recursion) and if it's invalid, then so is this call. + +This algorithm ensures that configuration can apply at multiple levels of hierarchy but transitive code-based method +invalidity is only on the proper implementation. So if `Foo.bar()` is bad but `ExtendsFoo.bar()` is ok, the former does +not report a false positive (unless of course `ExtendsFoo.bar()` invokes `super.bar()` which would transitively mark it +as invalid). + +During this resolution, the call graph is constructed with access to the class/method details for each transitive +non-recursive invocation. Once complete, all the valid methods are trimmed to relieve memory pressure and all classes +with workflow implementations properly contain their direct and indirect invalid member accesses. + +The printer then prints these out. + +### FAQ + +**Why not use static analysis library X?** + +One of the primary features of workflowcheck is to find whether a method is invalid transitively (i.e. building a call +graph) across existing bytecode including the Java standard library. During research, no tool was found to be able to do +this without significant effort or performance penalties. Approaches researched: + +* Checkstyle, ErrorProne, PMD, etc - not built for transitive bytecode checking +* Custom annotation processor - Bad caching across compilation units, JDK compiler API hard to use (have to add-opens + for modules for sun compiler API, or have to use third party) +* Soot/SootUp - Soot is too old, SootUp is undergoing new development but was still a bit rough when tried (e.g. failed + when an annotation wasn't on the classpath) +* ClassGraph - Does not say which methods call other methods (so not a call graph) +* SemGrep - Does not seem to support recursive call-graph analysis on bytecode to find bad calls at arbitrary call + depths +* CodeQL - Too slow +* Doop, jQAssistant, java-callgraph, etc - not up to date + +Overall, walking the classpath using traditional, high-performance bytecode visiting via OW2 ASM is a good choice for +this project's needs. + +**Why use `.properties` files instead of a better configuration format?** + +A goal of the workflowcheck project is to have as few dependencies as possible. + +**Why not use more modern Java features in the code?** + +The code is optimized for performance, so direct field access instead of encapsulation, looping instead of streaming, +mutable objects instead of records, etc may be present. But the user-facing API does follow proper practices. + +### TODO + +Currently, this project is missing many features: + +* Accept environment variables to point to config files +* Accept environment variables to provide specific config properties +* Accept Java system properties to point to config files +* Accept Java system properties to provide specific config properties +* Check lambda contents but avoid SideEffect +* Module support +* Prevent field mutation in queries and update validators +* Config prebuilding where you can give a set of packages and it will generate a `.properties` set of invalid methods + and save from having to reread the class files of that package at runtime + * Also consider shipping with prebuilt config for Java standard library through Java 21 +* Support SARIF output for better integration with tooling like GitHub actions +* Change output to work with IntelliJ's console linking better (see + [this SO answer](https://stackoverflow.com/questions/7930844/is-it-possible-to-have-clickable-class-names-in-console-output-in-intellij)) +* Support an HTML-formatted result with collapsible hierarchy +* For very deep trees, support `[...]` by default to replace all but the two beginning and two end entries (with CLI + option to show more) \ No newline at end of file diff --git a/temporal-workflowcheck/build.gradle b/temporal-workflowcheck/build.gradle new file mode 100644 index 0000000000..2aca0745b6 --- /dev/null +++ b/temporal-workflowcheck/build.gradle @@ -0,0 +1,44 @@ +plugins { + id 'application' + id 'com.gradleup.shadow' version '8.3.3' +} + +description = 'Temporal Java WorkflowCheck Static Analyzer' + +dependencies { + implementation 'org.ow2.asm:asm:9.6' + compileOnly 'com.google.code.findbugs:jsr305:3.0.2' + testImplementation project(":temporal-sdk") + testImplementation "junit:junit:${junitVersion}" + // Only for testing external-JAR-based bad calls + testImplementation "com.google.guava:guava:$guavaVersion" +} + +application { + mainClass = 'io.temporal.workflowcheck.Main' +} + +// Need all-in-one JAR +shadowJar { + relocate 'org.objectweb.asm', 'io.temporal.workflowcheck.shaded.org.objectweb.asm' +} +build.dependsOn shadowJar + +// Access Java test source as resource +tasks.register('copyJavaSourcesToResources') { + doLast { + copy { + from('src/test/java') { + include '**/*.*' + } + into 'build/resources/test' + } + } +} +processTestResources.dependsOn copyJavaSourcesToResources + +spotless { + java { + toggleOffOn() + } +} \ No newline at end of file diff --git a/temporal-workflowcheck/samples/.gitignore b/temporal-workflowcheck/samples/.gitignore new file mode 100644 index 0000000000..c8214acb5c --- /dev/null +++ b/temporal-workflowcheck/samples/.gitignore @@ -0,0 +1,3 @@ +gradle/build +gradle-multi-project/project-app/build +gradle-multi-project/project-workflows/build \ No newline at end of file diff --git a/temporal-workflowcheck/samples/gradle-multi-project/README.md b/temporal-workflowcheck/samples/gradle-multi-project/README.md new file mode 100644 index 0000000000..e8f88b2f7a --- /dev/null +++ b/temporal-workflowcheck/samples/gradle-multi-project/README.md @@ -0,0 +1,18 @@ +# Temporal Workflow Check for Java - Gradle Sample + +This sample shows how to incorporate `workflowcheck` into a Gradle build that has multiple projects. Currently there are +no published releases, so this example includes the primary build in the [settings.gradle](settings.gradle) file. But +users may just want to reference a published JAR when it is available. + +To run: + + gradlew check + +This will output something like: + +``` +Analyzing classpath for classes with workflow methods... +Found 1 class(es) with workflow methods +Workflow method io.temporal.workflowcheck.sample.gradlemulti.workflows.MyWorkflowImpl.errorAtNight() (declared on io.temporal.workflowcheck.sample.gradlemulti.workflows.MyWorkflow) has 1 invalid member access: + MyWorkflowImpl.java:10 invokes java.time.LocalTime.now() which is configured as invalid +``` \ No newline at end of file diff --git a/temporal-workflowcheck/samples/gradle-multi-project/build.gradle b/temporal-workflowcheck/samples/gradle-multi-project/build.gradle new file mode 100644 index 0000000000..3c03539835 --- /dev/null +++ b/temporal-workflowcheck/samples/gradle-multi-project/build.gradle @@ -0,0 +1,9 @@ +plugins { + id 'java' +} + +allprojects { + repositories { + mavenCentral() + } +} \ No newline at end of file diff --git a/temporal-workflowcheck/samples/gradle-multi-project/gradle/wrapper/gradle-wrapper.jar b/temporal-workflowcheck/samples/gradle-multi-project/gradle/wrapper/gradle-wrapper.jar new file mode 100644 index 0000000000000000000000000000000000000000..249e5832f090a2944b7473328c07c9755baa3196 GIT binary patch literal 60756 zcmb5WV{~QRw(p$^Dz@00IL3?^hro$gg*4VI_WAaTyVM5Foj~O|-84 z$;06hMwt*rV;^8iB z1~&0XWpYJmG?Ts^K9PC62H*`G}xom%S%yq|xvG~FIfP=9*f zZoDRJBm*Y0aId=qJ?7dyb)6)JGWGwe)MHeNSzhi)Ko6J<-m@v=a%NsP537lHe0R* z`If4$aaBA#S=w!2z&m>{lpTy^Lm^mg*3?M&7HFv}7K6x*cukLIGX;bQG|QWdn{%_6 zHnwBKr84#B7Z+AnBXa16a?or^R?+>$4`}{*a_>IhbjvyTtWkHw)|ay)ahWUd-qq$~ zMbh6roVsj;_qnC-R{G+Cy6bApVOinSU-;(DxUEl!i2)1EeQ9`hrfqj(nKI7?Z>Xur zoJz-a`PxkYit1HEbv|jy%~DO^13J-ut986EEG=66S}D3!L}Efp;Bez~7tNq{QsUMm zh9~(HYg1pA*=37C0}n4g&bFbQ+?-h-W}onYeE{q;cIy%eZK9wZjSwGvT+&Cgv z?~{9p(;bY_1+k|wkt_|N!@J~aoY@|U_RGoWX<;p{Nu*D*&_phw`8jYkMNpRTWx1H* z>J-Mi_!`M468#5Aix$$u1M@rJEIOc?k^QBc?T(#=n&*5eS#u*Y)?L8Ha$9wRWdH^3D4|Ps)Y?m0q~SiKiSfEkJ!=^`lJ(%W3o|CZ zSrZL-Xxc{OrmsQD&s~zPfNJOpSZUl%V8tdG%ei}lQkM+z@-4etFPR>GOH9+Y_F<3=~SXln9Kb-o~f>2a6Xz@AS3cn^;c_>lUwlK(n>z?A>NbC z`Ud8^aQy>wy=$)w;JZzA)_*Y$Z5hU=KAG&htLw1Uh00yE!|Nu{EZkch zY9O6x7Y??>!7pUNME*d!=R#s)ghr|R#41l!c?~=3CS8&zr6*aA7n9*)*PWBV2w+&I zpW1-9fr3j{VTcls1>ua}F*bbju_Xq%^v;-W~paSqlf zolj*dt`BBjHI)H9{zrkBo=B%>8}4jeBO~kWqO!~Thi!I1H(in=n^fS%nuL=X2+s!p}HfTU#NBGiwEBF^^tKU zbhhv+0dE-sbK$>J#t-J!B$TMgN@Wh5wTtK2BG}4BGfsZOoRUS#G8Cxv|6EI*n&Xxq zt{&OxCC+BNqz$9b0WM7_PyBJEVObHFh%%`~!@MNZlo*oXDCwDcFwT~Rls!aApL<)^ zbBftGKKBRhB!{?fX@l2_y~%ygNFfF(XJzHh#?`WlSL{1lKT*gJM zs>bd^H9NCxqxn(IOky5k-wALFowQr(gw%|`0991u#9jXQh?4l|l>pd6a&rx|v=fPJ z1mutj{YzpJ_gsClbWFk(G}bSlFi-6@mwoQh-XeD*j@~huW4(8ub%^I|azA)h2t#yG z7e_V_<4jlM3D(I+qX}yEtqj)cpzN*oCdYHa!nm%0t^wHm)EmFP*|FMw!tb@&`G-u~ zK)=Sf6z+BiTAI}}i{*_Ac$ffr*Wrv$F7_0gJkjx;@)XjYSh`RjAgrCck`x!zP>Ifu z&%he4P|S)H*(9oB4uvH67^0}I-_ye_!w)u3v2+EY>eD3#8QR24<;7?*hj8k~rS)~7 zSXs5ww)T(0eHSp$hEIBnW|Iun<_i`}VE0Nc$|-R}wlSIs5pV{g_Dar(Zz<4X3`W?K z6&CAIl4U(Qk-tTcK{|zYF6QG5ArrEB!;5s?tW7 zrE3hcFY&k)+)e{+YOJ0X2uDE_hd2{|m_dC}kgEKqiE9Q^A-+>2UonB+L@v3$9?AYw zVQv?X*pK;X4Ovc6Ev5Gbg{{Eu*7{N3#0@9oMI~}KnObQE#Y{&3mM4`w%wN+xrKYgD zB-ay0Q}m{QI;iY`s1Z^NqIkjrTlf`B)B#MajZ#9u41oRBC1oM1vq0i|F59> z#StM@bHt|#`2)cpl_rWB($DNJ3Lap}QM-+A$3pe}NyP(@+i1>o^fe-oxX#Bt`mcQc zb?pD4W%#ep|3%CHAYnr*^M6Czg>~L4?l16H1OozM{P*en298b+`i4$|w$|4AHbzqB zHpYUsHZET$Z0ztC;U+0*+amF!@PI%^oUIZy{`L{%O^i{Xk}X0&nl)n~tVEpcAJSJ} zverw15zP1P-O8h9nd!&hj$zuwjg?DoxYIw{jWM zW5_pj+wFy8Tsa9g<7Qa21WaV&;ejoYflRKcz?#fSH_)@*QVlN2l4(QNk| z4aPnv&mrS&0|6NHq05XQw$J^RR9T{3SOcMKCXIR1iSf+xJ0E_Wv?jEc*I#ZPzyJN2 zUG0UOXHl+PikM*&g$U@g+KbG-RY>uaIl&DEtw_Q=FYq?etc!;hEC_}UX{eyh%dw2V zTTSlap&5>PY{6I#(6`j-9`D&I#|YPP8a;(sOzgeKDWsLa!i-$frD>zr-oid!Hf&yS z!i^cr&7tN}OOGmX2)`8k?Tn!!4=tz~3hCTq_9CdiV!NIblUDxHh(FJ$zs)B2(t5@u z-`^RA1ShrLCkg0)OhfoM;4Z{&oZmAec$qV@ zGQ(7(!CBk<5;Ar%DLJ0p0!ResC#U<+3i<|vib1?{5gCebG7$F7URKZXuX-2WgF>YJ^i zMhHDBsh9PDU8dlZ$yJKtc6JA#y!y$57%sE>4Nt+wF1lfNIWyA`=hF=9Gj%sRwi@vd z%2eVV3y&dvAgyuJ=eNJR+*080dbO_t@BFJO<@&#yqTK&+xc|FRR;p;KVk@J3$S{p` zGaMj6isho#%m)?pOG^G0mzOAw0z?!AEMsv=0T>WWcE>??WS=fII$t$(^PDPMU(P>o z_*0s^W#|x)%tx8jIgZY~A2yG;US0m2ZOQt6yJqW@XNY_>_R7(Nxb8Ged6BdYW6{prd!|zuX$@Q2o6Ona8zzYC1u!+2!Y$Jc9a;wy+pXt}o6~Bu1oF1c zp7Y|SBTNi@=I(K%A60PMjM#sfH$y*c{xUgeSpi#HB`?|`!Tb&-qJ3;vxS!TIzuTZs-&%#bAkAyw9m4PJgvey zM5?up*b}eDEY+#@tKec)-c(#QF0P?MRlD1+7%Yk*jW;)`f;0a-ZJ6CQA?E%>i2Dt7T9?s|9ZF|KP4;CNWvaVKZ+Qeut;Jith_y{v*Ny6Co6!8MZx;Wgo z=qAi%&S;8J{iyD&>3CLCQdTX*$+Rx1AwA*D_J^0>suTgBMBb=*hefV+Ars#mmr+YsI3#!F@Xc1t4F-gB@6aoyT+5O(qMz*zG<9Qq*f0w^V!03rpr*-WLH}; zfM{xSPJeu6D(%8HU%0GEa%waFHE$G?FH^kMS-&I3)ycx|iv{T6Wx}9$$D&6{%1N_8 z_CLw)_9+O4&u94##vI9b-HHm_95m)fa??q07`DniVjAy`t7;)4NpeyAY(aAk(+T_O z1om+b5K2g_B&b2DCTK<>SE$Ode1DopAi)xaJjU>**AJK3hZrnhEQ9E`2=|HHe<^tv z63e(bn#fMWuz>4erc47}!J>U58%<&N<6AOAewyzNTqi7hJc|X{782&cM zHZYclNbBwU6673=!ClmxMfkC$(CykGR@10F!zN1Se83LR&a~$Ht&>~43OX22mt7tcZUpa;9@q}KDX3O&Ugp6< zLZLfIMO5;pTee1vNyVC$FGxzK2f>0Z-6hM82zKg44nWo|n}$Zk6&;5ry3`(JFEX$q zK&KivAe${e^5ZGc3a9hOt|!UOE&OocpVryE$Y4sPcs4rJ>>Kbi2_subQ9($2VN(3o zb~tEzMsHaBmBtaHAyES+d3A(qURgiskSSwUc9CfJ@99&MKp2sooSYZu+-0t0+L*!I zYagjOlPgx|lep9tiU%ts&McF6b0VE57%E0Ho%2oi?=Ks+5%aj#au^OBwNwhec zta6QAeQI^V!dF1C)>RHAmB`HnxyqWx?td@4sd15zPd*Fc9hpDXP23kbBenBxGeD$k z;%0VBQEJ-C)&dTAw_yW@k0u?IUk*NrkJ)(XEeI z9Y>6Vel>#s_v@=@0<{4A{pl=9cQ&Iah0iD0H`q)7NeCIRz8zx;! z^OO;1+IqoQNak&pV`qKW+K0^Hqp!~gSohcyS)?^P`JNZXw@gc6{A3OLZ?@1Uc^I2v z+X!^R*HCm3{7JPq{8*Tn>5;B|X7n4QQ0Bs79uTU%nbqOJh`nX(BVj!#f;#J+WZxx4 z_yM&1Y`2XzhfqkIMO7tB3raJKQS+H5F%o83bM+hxbQ zeeJm=Dvix$2j|b4?mDacb67v-1^lTp${z=jc1=j~QD>7c*@+1?py>%Kj%Ejp7Y-!? z8iYRUlGVrQPandAaxFfks53@2EC#0)%mrnmGRn&>=$H$S8q|kE_iWko4`^vCS2aWg z#!`RHUGyOt*k?bBYu3*j3u0gB#v(3tsije zgIuNNWNtrOkx@Pzs;A9un+2LX!zw+p3_NX^Sh09HZAf>m8l@O*rXy_82aWT$Q>iyy zqO7Of)D=wcSn!0+467&!Hl))eff=$aneB?R!YykdKW@k^_uR!+Q1tR)+IJb`-6=jj zymzA>Sv4>Z&g&WWu#|~GcP7qP&m*w-S$)7Xr;(duqCTe7p8H3k5>Y-n8438+%^9~K z3r^LIT_K{i7DgEJjIocw_6d0!<;wKT`X;&vv+&msmhAAnIe!OTdybPctzcEzBy88_ zWO{6i4YT%e4^WQZB)KHCvA(0tS zHu_Bg+6Ko%a9~$EjRB90`P(2~6uI@SFibxct{H#o&y40MdiXblu@VFXbhz>Nko;7R z70Ntmm-FePqhb%9gL+7U8@(ch|JfH5Fm)5${8|`Lef>LttM_iww6LW2X61ldBmG0z zax3y)njFe>j*T{i0s8D4=L>X^j0)({R5lMGVS#7(2C9@AxL&C-lZQx~czI7Iv+{%1 z2hEG>RzX4S8x3v#9sgGAnPzptM)g&LB}@%E>fy0vGSa(&q0ch|=ncKjNrK z`jA~jObJhrJ^ri|-)J^HUyeZXz~XkBp$VhcTEcTdc#a2EUOGVX?@mYx#Vy*!qO$Jv zQ4rgOJ~M*o-_Wptam=~krnmG*p^j!JAqoQ%+YsDFW7Cc9M%YPiBOrVcD^RY>m9Pd< zu}#9M?K{+;UIO!D9qOpq9yxUquQRmQNMo0pT`@$pVt=rMvyX)ph(-CCJLvUJy71DI zBk7oc7)-%ngdj~s@76Yse3L^gV0 z2==qfp&Q~L(+%RHP0n}+xH#k(hPRx(!AdBM$JCfJ5*C=K3ts>P?@@SZ_+{U2qFZb>4kZ{Go37{# zSQc+-dq*a-Vy4?taS&{Ht|MLRiS)Sn14JOONyXqPNnpq&2y~)6wEG0oNy>qvod$FF z`9o&?&6uZjhZ4_*5qWVrEfu(>_n2Xi2{@Gz9MZ8!YmjYvIMasE9yVQL10NBrTCczq zcTY1q^PF2l!Eraguf{+PtHV3=2A?Cu&NN&a8V(y;q(^_mFc6)%Yfn&X&~Pq zU1?qCj^LF(EQB1F`8NxNjyV%fde}dEa(Hx=r7$~ts2dzDwyi6ByBAIx$NllB4%K=O z$AHz1<2bTUb>(MCVPpK(E9wlLElo(aSd(Os)^Raum`d(g9Vd_+Bf&V;l=@mM=cC>) z)9b0enb)u_7V!!E_bl>u5nf&Rl|2r=2F3rHMdb7y9E}}F82^$Rf+P8%dKnOeKh1vs zhH^P*4Ydr^$)$h@4KVzxrHyy#cKmWEa9P5DJ|- zG;!Qi35Tp7XNj60=$!S6U#!(${6hyh7d4q=pF{`0t|N^|L^d8pD{O9@tF~W;#Je*P z&ah%W!KOIN;SyAEhAeTafJ4uEL`(RtnovM+cb(O#>xQnk?dzAjG^~4$dFn^<@-Na3 z395;wBnS{t*H;Jef2eE!2}u5Ns{AHj>WYZDgQJt8v%x?9{MXqJsGP|l%OiZqQ1aB! z%E=*Ig`(!tHh>}4_z5IMpg{49UvD*Pp9!pxt_gdAW%sIf3k6CTycOT1McPl=_#0?8 zVjz8Hj*Vy9c5-krd-{BQ{6Xy|P$6LJvMuX$* zA+@I_66_ET5l2&gk9n4$1M3LN8(yEViRx&mtd#LD}AqEs?RW=xKC(OCWH;~>(X6h!uDxXIPH06xh z*`F4cVlbDP`A)-fzf>MuScYsmq&1LUMGaQ3bRm6i7OsJ|%uhTDT zlvZA1M}nz*SalJWNT|`dBm1$xlaA>CCiQ zK`xD-RuEn>-`Z?M{1%@wewf#8?F|(@1e0+T4>nmlSRrNK5f)BJ2H*$q(H>zGD0>eL zQ!tl_Wk)k*e6v^m*{~A;@6+JGeWU-q9>?+L_#UNT%G?4&BnOgvm9@o7l?ov~XL+et zbGT)|G7)KAeqb=wHSPk+J1bdg7N3$vp(ekjI1D9V$G5Cj!=R2w=3*4!z*J-r-cyeb zd(i2KmX!|Lhey!snRw z?#$Gu%S^SQEKt&kep)up#j&9}e+3=JJBS(s>MH+|=R(`8xK{mmndWo_r`-w1#SeRD&YtAJ#GiVI*TkQZ}&aq<+bU2+coU3!jCI6E+Ad_xFW*ghnZ$q zAoF*i&3n1j#?B8x;kjSJD${1jdRB;)R*)Ao!9bd|C7{;iqDo|T&>KSh6*hCD!rwv= zyK#F@2+cv3=|S1Kef(E6Niv8kyLVLX&e=U;{0x{$tDfShqkjUME>f8d(5nzSkY6@! z^-0>DM)wa&%m#UF1F?zR`8Y3X#tA!*7Q$P3lZJ%*KNlrk_uaPkxw~ zxZ1qlE;Zo;nb@!SMazSjM>;34ROOoygo%SF);LL>rRonWwR>bmSd1XD^~sGSu$Gg# zFZ`|yKU0%!v07dz^v(tY%;So(e`o{ZYTX`hm;@b0%8|H>VW`*cr8R%3n|ehw2`(9B+V72`>SY}9^8oh$En80mZK9T4abVG*to;E z1_S6bgDOW?!Oy1LwYy=w3q~KKdbNtyH#d24PFjX)KYMY93{3-mPP-H>@M-_>N~DDu zENh~reh?JBAK=TFN-SfDfT^=+{w4ea2KNWXq2Y<;?(gf(FgVp8Zp-oEjKzB%2Iqj;48GmY3h=bcdYJ}~&4tS`Q1sb=^emaW$IC$|R+r-8V- zf0$gGE(CS_n4s>oicVk)MfvVg#I>iDvf~Ov8bk}sSxluG!6#^Z_zhB&U^`eIi1@j( z^CK$z^stBHtaDDHxn+R;3u+>Lil^}fj?7eaGB z&5nl^STqcaBxI@v>%zG|j))G(rVa4aY=B@^2{TFkW~YP!8!9TG#(-nOf^^X-%m9{Z zCC?iC`G-^RcBSCuk=Z`(FaUUe?hf3{0C>>$?Vs z`2Uud9M+T&KB6o4o9kvdi^Q=Bw!asPdxbe#W-Oaa#_NP(qpyF@bVxv5D5))srkU#m zj_KA+#7sqDn*Ipf!F5Byco4HOSd!Ui$l94|IbW%Ny(s1>f4|Mv^#NfB31N~kya9!k zWCGL-$0ZQztBate^fd>R!hXY_N9ZjYp3V~4_V z#eB)Kjr8yW=+oG)BuNdZG?jaZlw+l_ma8aET(s+-x+=F-t#Qoiuu1i`^x8Sj>b^U} zs^z<()YMFP7CmjUC@M=&lA5W7t&cxTlzJAts*%PBDAPuqcV5o7HEnqjif_7xGt)F% zGx2b4w{@!tE)$p=l3&?Bf#`+!-RLOleeRk3 z7#pF|w@6_sBmn1nECqdunmG^}pr5(ZJQVvAt$6p3H(16~;vO>?sTE`Y+mq5YP&PBo zvq!7#W$Gewy`;%6o^!Dtjz~x)T}Bdk*BS#=EY=ODD&B=V6TD2z^hj1m5^d6s)D*wk zu$z~D7QuZ2b?5`p)E8e2_L38v3WE{V`bVk;6fl#o2`) z99JsWhh?$oVRn@$S#)uK&8DL8>An0&S<%V8hnGD7Z^;Y(%6;^9!7kDQ5bjR_V+~wp zfx4m3z6CWmmZ<8gDGUyg3>t8wgJ5NkkiEm^(sedCicP^&3D%}6LtIUq>mXCAt{9eF zNXL$kGcoUTf_Lhm`t;hD-SE)m=iBnxRU(NyL}f6~1uH)`K!hmYZjLI%H}AmEF5RZt z06$wn63GHnApHXZZJ}s^s)j9(BM6e*7IBK6Bq(!)d~zR#rbxK9NVIlgquoMq z=eGZ9NR!SEqP6=9UQg#@!rtbbSBUM#ynF);zKX+|!Zm}*{H z+j=d?aZ2!?@EL7C~%B?6ouCKLnO$uWn;Y6Xz zX8dSwj732u(o*U3F$F=7xwxm>E-B+SVZH;O-4XPuPkLSt_?S0)lb7EEg)Mglk0#eS z9@jl(OnH4juMxY+*r03VDfPx_IM!Lmc(5hOI;`?d37f>jPP$?9jQQIQU@i4vuG6MagEoJrQ=RD7xt@8E;c zeGV*+Pt+t$@pt!|McETOE$9k=_C!70uhwRS9X#b%ZK z%q(TIUXSS^F0`4Cx?Rk07C6wI4!UVPeI~-fxY6`YH$kABdOuiRtl73MqG|~AzZ@iL&^s?24iS;RK_pdlWkhcF z@Wv-Om(Aealfg)D^adlXh9Nvf~Uf@y;g3Y)i(YP zEXDnb1V}1pJT5ZWyw=1i+0fni9yINurD=EqH^ciOwLUGi)C%Da)tyt=zq2P7pV5-G zR7!oq28-Fgn5pW|nlu^b!S1Z#r7!Wtr{5J5PQ>pd+2P7RSD?>(U7-|Y z7ZQ5lhYIl_IF<9?T9^IPK<(Hp;l5bl5tF9>X-zG14_7PfsA>6<$~A338iYRT{a@r_ zuXBaT=`T5x3=s&3=RYx6NgG>No4?5KFBVjE(swfcivcIpPQFx5l+O;fiGsOrl5teR z_Cm+;PW}O0Dwe_(4Z@XZ)O0W-v2X><&L*<~*q3dg;bQW3g7)a#3KiQP>+qj|qo*Hk z?57>f2?f@`=Fj^nkDKeRkN2d$Z@2eNKpHo}ksj-$`QKb6n?*$^*%Fb3_Kbf1(*W9K>{L$mud2WHJ=j0^=g30Xhg8$#g^?36`p1fm;;1@0Lrx+8t`?vN0ZorM zSW?rhjCE8$C|@p^sXdx z|NOHHg+fL;HIlqyLp~SSdIF`TnSHehNCU9t89yr@)FY<~hu+X`tjg(aSVae$wDG*C zq$nY(Y494R)hD!i1|IIyP*&PD_c2FPgeY)&mX1qujB1VHPG9`yFQpLFVQ0>EKS@Bp zAfP5`C(sWGLI?AC{XEjLKR4FVNw(4+9b?kba95ukgR1H?w<8F7)G+6&(zUhIE5Ef% z=fFkL3QKA~M@h{nzjRq!Y_t!%U66#L8!(2-GgFxkD1=JRRqk=n%G(yHKn%^&$dW>; zSjAcjETMz1%205se$iH_)ZCpfg_LwvnsZQAUCS#^FExp8O4CrJb6>JquNV@qPq~3A zZ<6dOU#6|8+fcgiA#~MDmcpIEaUO02L5#T$HV0$EMD94HT_eXLZ2Zi&(! z&5E>%&|FZ`)CN10tM%tLSPD*~r#--K(H-CZqIOb99_;m|D5wdgJ<1iOJz@h2Zkq?} z%8_KXb&hf=2Wza(Wgc;3v3TN*;HTU*q2?#z&tLn_U0Nt!y>Oo>+2T)He6%XuP;fgn z-G!#h$Y2`9>Jtf}hbVrm6D70|ERzLAU>3zoWhJmjWfgM^))T+2u$~5>HF9jQDkrXR z=IzX36)V75PrFjkQ%TO+iqKGCQ-DDXbaE;C#}!-CoWQx&v*vHfyI>$HNRbpvm<`O( zlx9NBWD6_e&J%Ous4yp~s6)Ghni!I6)0W;9(9$y1wWu`$gs<$9Mcf$L*piP zPR0Av*2%ul`W;?-1_-5Zy0~}?`e@Y5A&0H!^ApyVTT}BiOm4GeFo$_oPlDEyeGBbh z1h3q&Dx~GmUS|3@4V36&$2uO8!Yp&^pD7J5&TN{?xphf*-js1fP?B|`>p_K>lh{ij zP(?H%e}AIP?_i^f&Li=FDSQ`2_NWxL+BB=nQr=$ zHojMlXNGauvvwPU>ZLq!`bX-5F4jBJ&So{kE5+ms9UEYD{66!|k~3vsP+mE}x!>%P za98bAU0!h0&ka4EoiDvBM#CP#dRNdXJcb*(%=<(g+M@<)DZ!@v1V>;54En?igcHR2 zhubQMq}VSOK)onqHfczM7YA@s=9*ow;k;8)&?J3@0JiGcP! zP#00KZ1t)GyZeRJ=f0^gc+58lc4Qh*S7RqPIC6GugG1gXe$LIQMRCo8cHf^qXgAa2 z`}t>u2Cq1CbSEpLr~E=c7~=Qkc9-vLE%(v9N*&HF`(d~(0`iukl5aQ9u4rUvc8%m) zr2GwZN4!s;{SB87lJB;veebPmqE}tSpT>+`t?<457Q9iV$th%i__Z1kOMAswFldD6 ztbOvO337S5o#ZZgN2G99_AVqPv!?Gmt3pzgD+Hp3QPQ`9qJ(g=kjvD+fUSS3upJn! zqoG7acIKEFRX~S}3|{EWT$kdz#zrDlJU(rPkxjws_iyLKU8+v|*oS_W*-guAb&Pj1 z35Z`3z<&Jb@2Mwz=KXucNYdY#SNO$tcVFr9KdKm|%^e-TXzs6M`PBper%ajkrIyUe zp$vVxVs9*>Vp4_1NC~Zg)WOCPmOxI1V34QlG4!aSFOH{QqSVq1^1)- z0P!Z?tT&E-ll(pwf0?=F=yOzik=@nh1Clxr9}Vij89z)ePDSCYAqw?lVI?v?+&*zH z)p$CScFI8rrwId~`}9YWPFu0cW1Sf@vRELs&cbntRU6QfPK-SO*mqu|u~}8AJ!Q$z znzu}50O=YbjwKCuSVBs6&CZR#0FTu)3{}qJJYX(>QPr4$RqWiwX3NT~;>cLn*_&1H zaKpIW)JVJ>b{uo2oq>oQt3y=zJjb%fU@wLqM{SyaC6x2snMx-}ivfU<1- znu1Lh;i$3Tf$Kh5Uk))G!D1UhE8pvx&nO~w^fG)BC&L!_hQk%^p`Kp@F{cz>80W&T ziOK=Sq3fdRu*V0=S53rcIfWFazI}Twj63CG(jOB;$*b`*#B9uEnBM`hDk*EwSRdwP8?5T?xGUKs=5N83XsR*)a4|ijz|c{4tIU+4j^A5C<#5 z*$c_d=5ml~%pGxw#?*q9N7aRwPux5EyqHVkdJO=5J>84!X6P>DS8PTTz>7C#FO?k#edkntG+fJk8ZMn?pmJSO@`x-QHq;7^h6GEXLXo1TCNhH z8ZDH{*NLAjo3WM`xeb=X{((uv3H(8&r8fJJg_uSs_%hOH%JDD?hu*2NvWGYD+j)&` zz#_1%O1wF^o5ryt?O0n;`lHbzp0wQ?rcbW(F1+h7_EZZ9{>rePvLAPVZ_R|n@;b$;UchU=0j<6k8G9QuQf@76oiE*4 zXOLQ&n3$NR#p4<5NJMVC*S);5x2)eRbaAM%VxWu9ohlT;pGEk7;002enCbQ>2r-us z3#bpXP9g|mE`65VrN`+3mC)M(eMj~~eOf)do<@l+fMiTR)XO}422*1SL{wyY(%oMpBgJagtiDf zz>O6(m;};>Hi=t8o{DVC@YigqS(Qh+ix3Rwa9aliH}a}IlOCW1@?%h_bRbq-W{KHF z%Vo?-j@{Xi@=~Lz5uZP27==UGE15|g^0gzD|3x)SCEXrx`*MP^FDLl%pOi~~Il;dc z^hrwp9sYeT7iZ)-ajKy@{a`kr0-5*_!XfBpXwEcFGJ;%kV$0Nx;apKrur zJN2J~CAv{Zjj%FolyurtW8RaFmpn&zKJWL>(0;;+q(%(Hx!GMW4AcfP0YJ*Vz!F4g z!ZhMyj$BdXL@MlF%KeInmPCt~9&A!;cRw)W!Hi@0DY(GD_f?jeV{=s=cJ6e}JktJw zQORnxxj3mBxfrH=x{`_^Z1ddDh}L#V7i}$njUFRVwOX?qOTKjfPMBO4y(WiU<)epb zvB9L=%jW#*SL|Nd_G?E*_h1^M-$PG6Pc_&QqF0O-FIOpa4)PAEPsyvB)GKasmBoEt z?_Q2~QCYGH+hW31x-B=@5_AN870vY#KB~3a*&{I=f);3Kv7q4Q7s)0)gVYx2#Iz9g(F2;=+Iy4 z6KI^8GJ6D@%tpS^8boU}zpi=+(5GfIR)35PzrbuXeL1Y1N%JK7PG|^2k3qIqHfX;G zQ}~JZ-UWx|60P5?d1e;AHx!_;#PG%d=^X(AR%i`l0jSpYOpXoKFW~7ip7|xvN;2^? zsYC9fanpO7rO=V7+KXqVc;Q5z%Bj})xHVrgoR04sA2 zl~DAwv=!(()DvH*=lyhIlU^hBkA0$e*7&fJpB0|oB7)rqGK#5##2T`@_I^|O2x4GO z;xh6ROcV<9>?e0)MI(y++$-ksV;G;Xe`lh76T#Htuia+(UrIXrf9?

L(tZ$0BqX1>24?V$S+&kLZ`AodQ4_)P#Q3*4xg8}lMV-FLwC*cN$< zt65Rf%7z41u^i=P*qO8>JqXPrinQFapR7qHAtp~&RZ85$>ob|Js;GS^y;S{XnGiBc zGa4IGvDl?x%gY`vNhv8wgZnP#UYI-w*^4YCZnxkF85@ldepk$&$#3EAhrJY0U)lR{F6sM3SONV^+$;Zx8BD&Eku3K zKNLZyBni3)pGzU0;n(X@1fX8wYGKYMpLmCu{N5-}epPDxClPFK#A@02WM3!myN%bkF z|GJ4GZ}3sL{3{qXemy+#Uk{4>Kf8v11;f8I&c76+B&AQ8udd<8gU7+BeWC`akUU~U zgXoxie>MS@rBoyY8O8Tc&8id!w+_ooxcr!1?#rc$-|SBBtH6S?)1e#P#S?jFZ8u-Bs&k`yLqW|{j+%c#A4AQ>+tj$Y z^CZajspu$F%73E68Lw5q7IVREED9r1Ijsg#@DzH>wKseye>hjsk^{n0g?3+gs@7`i zHx+-!sjLx^fS;fY!ERBU+Q zVJ!e0hJH%P)z!y%1^ZyG0>PN@5W~SV%f>}c?$H8r;Sy-ui>aruVTY=bHe}$e zi&Q4&XK!qT7-XjCrDaufT@>ieQ&4G(SShUob0Q>Gznep9fR783jGuUynAqc6$pYX; z7*O@@JW>O6lKIk0G00xsm|=*UVTQBB`u1f=6wGAj%nHK_;Aqmfa!eAykDmi-@u%6~ z;*c!pS1@V8r@IX9j&rW&d*}wpNs96O2Ute>%yt{yv>k!6zfT6pru{F1M3P z2WN1JDYqoTB#(`kE{H676QOoX`cnqHl1Yaru)>8Ky~VU{)r#{&s86Vz5X)v15ULHA zAZDb{99+s~qI6;-dQ5DBjHJP@GYTwn;Dv&9kE<0R!d z8tf1oq$kO`_sV(NHOSbMwr=To4r^X$`sBW4$gWUov|WY?xccQJN}1DOL|GEaD_!@& z15p?Pj+>7d`@LvNIu9*^hPN)pwcv|akvYYq)ks%`G>!+!pW{-iXPZsRp8 z35LR;DhseQKWYSD`%gO&k$Dj6_6q#vjWA}rZcWtQr=Xn*)kJ9kacA=esi*I<)1>w^ zO_+E>QvjP)qiSZg9M|GNeLtO2D7xT6vsj`88sd!94j^AqxFLi}@w9!Y*?nwWARE0P znuI_7A-saQ+%?MFA$gttMV-NAR^#tjl_e{R$N8t2NbOlX373>e7Ox=l=;y#;M7asp zRCz*CLnrm$esvSb5{T<$6CjY zmZ(i{Rs_<#pWW>(HPaaYj`%YqBra=Ey3R21O7vUbzOkJJO?V`4-D*u4$Me0Bx$K(lYo`JO}gnC zx`V}a7m-hLU9Xvb@K2ymioF)vj12<*^oAqRuG_4u%(ah?+go%$kOpfb`T96P+L$4> zQ#S+sA%VbH&mD1k5Ak7^^dZoC>`1L%i>ZXmooA!%GI)b+$D&ziKrb)a=-ds9xk#~& z7)3iem6I|r5+ZrTRe_W861x8JpD`DDIYZNm{$baw+$)X^Jtjnl0xlBgdnNY}x%5za zkQ8E6T<^$sKBPtL4(1zi_Rd(tVth*3Xs!ulflX+70?gb&jRTnI8l+*Aj9{|d%qLZ+ z>~V9Z;)`8-lds*Zgs~z1?Fg?Po7|FDl(Ce<*c^2=lFQ~ahwh6rqSjtM5+$GT>3WZW zj;u~w9xwAhOc<kF}~`CJ68 z?(S5vNJa;kriPlim33{N5`C{9?NWhzsna_~^|K2k4xz1`xcui*LXL-1#Y}Hi9`Oo!zQ>x-kgAX4LrPz63uZ+?uG*84@PKq-KgQlMNRwz=6Yes) zY}>YN+qP}nwr$(CZQFjUOI=-6J$2^XGvC~EZ+vrqWaOXB$k?%Suf5k=4>AveC1aJ! ziaW4IS%F$_Babi)kA8Y&u4F7E%99OPtm=vzw$$ zEz#9rvn`Iot_z-r3MtV>k)YvErZ<^Oa${`2>MYYODSr6?QZu+be-~MBjwPGdMvGd!b!elsdi4% z`37W*8+OGulab8YM?`KjJ8e+jM(tqLKSS@=jimq3)Ea2EB%88L8CaM+aG7;27b?5` z4zuUWBr)f)k2o&xg{iZ$IQkJ+SK>lpq4GEacu~eOW4yNFLU!Kgc{w4&D$4ecm0f}~ zTTzquRW@`f0}|IILl`!1P+;69g^upiPA6F{)U8)muWHzexRenBU$E^9X-uIY2%&1w z_=#5*(nmxJ9zF%styBwivi)?#KMG96-H@hD-H_&EZiRNsfk7mjBq{L%!E;Sqn!mVX*}kXhwH6eh;b42eD!*~upVG@ z#smUqz$ICm!Y8wY53gJeS|Iuard0=;k5i5Z_hSIs6tr)R4n*r*rE`>38Pw&lkv{_r!jNN=;#?WbMj|l>cU(9trCq; z%nN~r^y7!kH^GPOf3R}?dDhO=v^3BeP5hF|%4GNQYBSwz;x({21i4OQY->1G=KFyu z&6d`f2tT9Yl_Z8YACZaJ#v#-(gcyeqXMhYGXb=t>)M@fFa8tHp2x;ODX=Ap@a5I=U z0G80^$N0G4=U(>W%mrrThl0DjyQ-_I>+1Tdd_AuB3qpYAqY54upwa3}owa|x5iQ^1 zEf|iTZxKNGRpI>34EwkIQ2zHDEZ=(J@lRaOH>F|2Z%V_t56Km$PUYu^xA5#5Uj4I4RGqHD56xT%H{+P8Ag>e_3pN$4m8n>i%OyJFPNWaEnJ4McUZPa1QmOh?t8~n& z&RulPCors8wUaqMHECG=IhB(-tU2XvHP6#NrLVyKG%Ee*mQ5Ps%wW?mcnriTVRc4J`2YVM>$ixSF2Xi+Wn(RUZnV?mJ?GRdw%lhZ+t&3s7g!~g{%m&i<6 z5{ib-<==DYG93I(yhyv4jp*y3#*WNuDUf6`vTM%c&hiayf(%=x@4$kJ!W4MtYcE#1 zHM?3xw63;L%x3drtd?jot!8u3qeqctceX3m;tWetK+>~q7Be$h>n6riK(5@ujLgRS zvOym)k+VAtyV^mF)$29Y`nw&ijdg~jYpkx%*^ z8dz`C*g=I?;clyi5|!27e2AuSa$&%UyR(J3W!A=ZgHF9OuKA34I-1U~pyD!KuRkjA zbkN!?MfQOeN>DUPBxoy5IX}@vw`EEB->q!)8fRl_mqUVuRu|C@KD-;yl=yKc=ZT0% zB$fMwcC|HE*0f8+PVlWHi>M`zfsA(NQFET?LrM^pPcw`cK+Mo0%8*x8@65=CS_^$cG{GZQ#xv($7J z??R$P)nPLodI;P!IC3eEYEHh7TV@opr#*)6A-;EU2XuogHvC;;k1aI8asq7ovoP!* z?x%UoPrZjj<&&aWpsbr>J$Er-7!E(BmOyEv!-mbGQGeJm-U2J>74>o5x`1l;)+P&~ z>}f^=Rx(ZQ2bm+YE0u=ZYrAV@apyt=v1wb?R@`i_g64YyAwcOUl=C!i>=Lzb$`tjv zOO-P#A+)t-JbbotGMT}arNhJmmGl-lyUpMn=2UacVZxmiG!s!6H39@~&uVokS zG=5qWhfW-WOI9g4!R$n7!|ViL!|v3G?GN6HR0Pt_L5*>D#FEj5wM1DScz4Jv@Sxnl zB@MPPmdI{(2D?;*wd>3#tjAirmUnQoZrVv`xM3hARuJksF(Q)wd4P$88fGYOT1p6U z`AHSN!`St}}UMBT9o7i|G`r$ zrB=s$qV3d6$W9@?L!pl0lf%)xs%1ko^=QY$ty-57=55PvP(^6E7cc zGJ*>m2=;fOj?F~yBf@K@9qwX0hA803Xw+b0m}+#a(>RyR8}*Y<4b+kpp|OS+!whP( zH`v{%s>jsQI9rd$*vm)EkwOm#W_-rLTHcZRek)>AtF+~<(did)*oR1|&~1|e36d-d zgtm5cv1O0oqgWC%Et@P4Vhm}Ndl(Y#C^MD03g#PH-TFy+7!Osv1z^UWS9@%JhswEq~6kSr2DITo59+; ze=ZC}i2Q?CJ~Iyu?vn|=9iKV>4j8KbxhE4&!@SQ^dVa-gK@YfS9xT(0kpW*EDjYUkoj! zE49{7H&E}k%5(>sM4uGY)Q*&3>{aitqdNnRJkbOmD5Mp5rv-hxzOn80QsG=HJ_atI-EaP69cacR)Uvh{G5dTpYG7d zbtmRMq@Sexey)||UpnZ?;g_KMZq4IDCy5}@u!5&B^-=6yyY{}e4Hh3ee!ZWtL*s?G zxG(A!<9o!CL+q?u_utltPMk+hn?N2@?}xU0KlYg?Jco{Yf@|mSGC<(Zj^yHCvhmyx z?OxOYoxbptDK()tsJ42VzXdINAMWL$0Gcw?G(g8TMB)Khw_|v9`_ql#pRd2i*?CZl z7k1b!jQB=9-V@h%;Cnl7EKi;Y^&NhU0mWEcj8B|3L30Ku#-9389Q+(Yet0r$F=+3p z6AKOMAIi|OHyzlHZtOm73}|ntKtFaXF2Fy|M!gOh^L4^62kGUoWS1i{9gsds_GWBc zLw|TaLP64z3z9?=R2|T6Xh2W4_F*$cq>MtXMOy&=IPIJ`;!Tw?PqvI2b*U1)25^<2 zU_ZPoxg_V0tngA0J+mm?3;OYw{i2Zb4x}NedZug!>EoN3DC{1i)Z{Z4m*(y{ov2%- zk(w>+scOO}MN!exSc`TN)!B=NUX`zThWO~M*ohqq;J2hx9h9}|s#?@eR!=F{QTrq~ zTcY|>azkCe$|Q0XFUdpFT=lTcyW##i;-e{}ORB4D?t@SfqGo_cS z->?^rh$<&n9DL!CF+h?LMZRi)qju!meugvxX*&jfD!^1XB3?E?HnwHP8$;uX{Rvp# zh|)hM>XDv$ZGg=$1{+_bA~u-vXqlw6NH=nkpyWE0u}LQjF-3NhATL@9rRxMnpO%f7 z)EhZf{PF|mKIMFxnC?*78(}{Y)}iztV12}_OXffJ;ta!fcFIVjdchyHxH=t%ci`Xd zX2AUB?%?poD6Zv*&BA!6c5S#|xn~DK01#XvjT!w!;&`lDXSJT4_j$}!qSPrb37vc{ z9^NfC%QvPu@vlxaZ;mIbn-VHA6miwi8qJ~V;pTZkKqqOii<1Cs}0i?uUIss;hM4dKq^1O35y?Yp=l4i zf{M!@QHH~rJ&X~8uATV><23zZUbs-J^3}$IvV_ANLS08>k`Td7aU_S1sLsfi*C-m1 z-e#S%UGs4E!;CeBT@9}aaI)qR-6NU@kvS#0r`g&UWg?fC7|b^_HyCE!8}nyh^~o@< zpm7PDFs9yxp+byMS(JWm$NeL?DNrMCNE!I^ko-*csB+dsf4GAq{=6sfyf4wb>?v1v zmb`F*bN1KUx-`ra1+TJ37bXNP%`-Fd`vVQFTwWpX@;s(%nDQa#oWhgk#mYlY*!d>( zE&!|ySF!mIyfING+#%RDY3IBH_fW$}6~1%!G`suHub1kP@&DoAd5~7J55;5_noPI6eLf{t;@9Kf<{aO0`1WNKd?<)C-|?C?)3s z>wEq@8=I$Wc~Mt$o;g++5qR+(6wt9GI~pyrDJ%c?gPZe)owvy^J2S=+M^ z&WhIE`g;;J^xQLVeCtf7b%Dg#Z2gq9hp_%g)-%_`y*zb; zn9`f`mUPN-Ts&fFo(aNTsXPA|J!TJ{0hZp0^;MYHLOcD=r_~~^ymS8KLCSeU3;^QzJNqS z5{5rEAv#l(X?bvwxpU;2%pQftF`YFgrD1jt2^~Mt^~G>T*}A$yZc@(k9orlCGv&|1 zWWvVgiJsCAtamuAYT~nzs?TQFt<1LSEx!@e0~@yd6$b5!Zm(FpBl;(Cn>2vF?k zOm#TTjFwd2D-CyA!mqR^?#Uwm{NBemP>(pHmM}9;;8`c&+_o3#E5m)JzfwN?(f-a4 zyd%xZc^oQx3XT?vcCqCX&Qrk~nu;fxs@JUoyVoi5fqpi&bUhQ2y!Ok2pzsFR(M(|U zw3E+kH_zmTRQ9dUMZWRE%Zakiwc+lgv7Z%|YO9YxAy`y28`Aw;WU6HXBgU7fl@dnt z-fFBV)}H-gqP!1;V@Je$WcbYre|dRdp{xt!7sL3Eoa%IA`5CAA%;Wq8PktwPdULo! z8!sB}Qt8#jH9Sh}QiUtEPZ6H0b*7qEKGJ%ITZ|vH)5Q^2m<7o3#Z>AKc%z7_u`rXA zqrCy{-{8;9>dfllLu$^M5L z-hXs))h*qz%~ActwkIA(qOVBZl2v4lwbM>9l70Y`+T*elINFqt#>OaVWoja8RMsep z6Or3f=oBnA3vDbn*+HNZP?8LsH2MY)x%c13@(XfuGR}R?Nu<|07{$+Lc3$Uv^I!MQ z>6qWgd-=aG2Y^24g4{Bw9ueOR)(9h`scImD=86dD+MnSN4$6 z^U*o_mE-6Rk~Dp!ANp#5RE9n*LG(Vg`1)g6!(XtDzsov$Dvz|Gv1WU68J$CkshQhS zCrc|cdkW~UK}5NeaWj^F4MSgFM+@fJd{|LLM)}_O<{rj z+?*Lm?owq?IzC%U%9EBga~h-cJbIu=#C}XuWN>OLrc%M@Gu~kFEYUi4EC6l#PR2JS zQUkGKrrS#6H7}2l0F@S11DP`@pih0WRkRJl#F;u{c&ZC{^$Z+_*lB)r)-bPgRFE;* zl)@hK4`tEP=P=il02x7-C7p%l=B`vkYjw?YhdJU9!P!jcmY$OtC^12w?vy3<<=tlY zUwHJ_0lgWN9vf>1%WACBD{UT)1qHQSE2%z|JHvP{#INr13jM}oYv_5#xsnv9`)UAO zuwgyV4YZ;O)eSc3(mka6=aRohi!HH@I#xq7kng?Acdg7S4vDJb6cI5fw?2z%3yR+| zU5v@Hm}vy;${cBp&@D=HQ9j7NcFaOYL zj-wV=eYF{|XTkFNM2uz&T8uH~;)^Zo!=KP)EVyH6s9l1~4m}N%XzPpduPg|h-&lL` zAXspR0YMOKd2yO)eMFFJ4?sQ&!`dF&!|niH*!^*Ml##o0M(0*uK9&yzekFi$+mP9s z>W9d%Jb)PtVi&-Ha!o~Iyh@KRuKpQ@)I~L*d`{O8!kRObjO7=n+Gp36fe!66neh+7 zW*l^0tTKjLLzr`x4`_8&on?mjW-PzheTNox8Hg7Nt@*SbE-%kP2hWYmHu#Fn@Q^J(SsPUz*|EgOoZ6byg3ew88UGdZ>9B2Tq=jF72ZaR=4u%1A6Vm{O#?@dD!(#tmR;eP(Fu z{$0O%=Vmua7=Gjr8nY%>ul?w=FJ76O2js&17W_iq2*tb!i{pt#`qZB#im9Rl>?t?0c zicIC}et_4d+CpVPx)i4~$u6N-QX3H77ez z?ZdvXifFk|*F8~L(W$OWM~r`pSk5}#F?j_5u$Obu9lDWIknO^AGu+Blk7!9Sb;NjS zncZA?qtASdNtzQ>z7N871IsPAk^CC?iIL}+{K|F@BuG2>qQ;_RUYV#>hHO(HUPpk@ z(bn~4|F_jiZi}Sad;_7`#4}EmD<1EiIxa48QjUuR?rC}^HRocq`OQPM@aHVKP9E#q zy%6bmHygCpIddPjE}q_DPC`VH_2m;Eey&ZH)E6xGeStOK7H)#+9y!%-Hm|QF6w#A( zIC0Yw%9j$s-#odxG~C*^MZ?M<+&WJ+@?B_QPUyTg9DJGtQN#NIC&-XddRsf3n^AL6 zT@P|H;PvN;ZpL0iv$bRb7|J{0o!Hq+S>_NrH4@coZtBJu#g8#CbR7|#?6uxi8d+$g z87apN>EciJZ`%Zv2**_uiET9Vk{pny&My;+WfGDw4EVL#B!Wiw&M|A8f1A@ z(yFQS6jfbH{b8Z-S7D2?Ixl`j0{+ZnpT=;KzVMLW{B$`N?Gw^Fl0H6lT61%T2AU**!sX0u?|I(yoy&Xveg7XBL&+>n6jd1##6d>TxE*Vj=8lWiG$4=u{1UbAa5QD>5_ z;Te^42v7K6Mmu4IWT6Rnm>oxrl~b<~^e3vbj-GCdHLIB_>59}Ya+~OF68NiH=?}2o zP(X7EN=quQn&)fK>M&kqF|<_*H`}c zk=+x)GU>{Af#vx&s?`UKUsz})g^Pc&?Ka@t5$n$bqf6{r1>#mWx6Ep>9|A}VmWRnowVo`OyCr^fHsf# zQjQ3Ttp7y#iQY8l`zEUW)(@gGQdt(~rkxlkefskT(t%@i8=|p1Y9Dc5bc+z#n$s13 zGJk|V0+&Ekh(F};PJzQKKo+FG@KV8a<$gmNSD;7rd_nRdc%?9)p!|B-@P~kxQG}~B zi|{0}@}zKC(rlFUYp*dO1RuvPC^DQOkX4<+EwvBAC{IZQdYxoq1Za!MW7%p7gGr=j zzWnAq%)^O2$eItftC#TTSArUyL$U54-O7e|)4_7%Q^2tZ^0-d&3J1}qCzR4dWX!)4 zzIEKjgnYgMus^>6uw4Jm8ga6>GBtMjpNRJ6CP~W=37~||gMo_p@GA@#-3)+cVYnU> zE5=Y4kzl+EbEh%dhQokB{gqNDqx%5*qBusWV%!iprn$S!;oN_6E3?0+umADVs4ako z?P+t?m?};gev9JXQ#Q&KBpzkHPde_CGu-y z<{}RRAx=xlv#mVi+Ibrgx~ujW$h{?zPfhz)Kp7kmYS&_|97b&H&1;J-mzrBWAvY} zh8-I8hl_RK2+nnf&}!W0P+>5?#?7>npshe<1~&l_xqKd0_>dl_^RMRq@-Myz&|TKZBj1=Q()) zF{dBjv5)h=&Z)Aevx}+i|7=R9rG^Di!sa)sZCl&ctX4&LScQ-kMncgO(9o6W6)yd< z@Rk!vkja*X_N3H=BavGoR0@u0<}m-7|2v!0+2h~S2Q&a=lTH91OJsvms2MT~ zY=c@LO5i`mLpBd(vh|)I&^A3TQLtr>w=zoyzTd=^f@TPu&+*2MtqE$Avf>l>}V|3-8Fp2hzo3y<)hr_|NO(&oSD z!vEjTWBxbKTiShVl-U{n*B3#)3a8$`{~Pk}J@elZ=>Pqp|MQ}jrGv7KrNcjW%TN_< zZz8kG{#}XoeWf7qY?D)L)8?Q-b@Na&>i=)(@uNo zr;cH98T3$Iau8Hn*@vXi{A@YehxDE2zX~o+RY`)6-X{8~hMpc#C`|8y> zU8Mnv5A0dNCf{Ims*|l-^ z(MRp{qoGohB34|ggDI*p!Aw|MFyJ|v+<+E3brfrI)|+l3W~CQLPbnF@G0)P~Ly!1TJLp}xh8uW`Q+RB-v`MRYZ9Gam3cM%{ zb4Cb*f)0deR~wtNb*8w-LlIF>kc7DAv>T0D(a3@l`k4TFnrO+g9XH7;nYOHxjc4lq zMmaW6qpgAgy)MckYMhl?>sq;-1E)-1llUneeA!ya9KM$)DaNGu57Z5aE>=VST$#vb zFo=uRHr$0M{-ha>h(D_boS4zId;3B|Tpqo|?B?Z@I?G(?&Iei+-{9L_A9=h=Qfn-U z1wIUnQe9!z%_j$F_{rf&`ZFSott09gY~qrf@g3O=Y>vzAnXCyL!@(BqWa)Zqt!#_k zfZHuwS52|&&)aK;CHq9V-t9qt0au{$#6c*R#e5n3rje0hic7c7m{kW$p(_`wB=Gw7 z4k`1Hi;Mc@yA7dp@r~?@rfw)TkjAW++|pkfOG}0N|2guek}j8Zen(!+@7?qt_7ndX zB=BG6WJ31#F3#Vk3=aQr8T)3`{=p9nBHlKzE0I@v`{vJ}h8pd6vby&VgFhzH|q;=aonunAXL6G2y(X^CtAhWr*jI zGjpY@raZDQkg*aMq}Ni6cRF z{oWv}5`nhSAv>usX}m^GHt`f(t8@zHc?K|y5Zi=4G*UG1Sza{$Dpj%X8 zzEXaKT5N6F5j4J|w#qlZP!zS7BT)9b+!ZSJdToqJts1c!)fwih4d31vfb{}W)EgcA zH2pZ^8_k$9+WD2n`6q5XbOy8>3pcYH9 z07eUB+p}YD@AH!}p!iKv><2QF-Y^&xx^PAc1F13A{nUeCDg&{hnix#FiO!fe(^&%Qcux!h znu*S!s$&nnkeotYsDthh1dq(iQrE|#f_=xVgfiiL&-5eAcC-> z5L0l|DVEM$#ulf{bj+Y~7iD)j<~O8CYM8GW)dQGq)!mck)FqoL^X zwNdZb3->hFrbHFm?hLvut-*uK?zXn3q1z|UX{RZ;-WiLoOjnle!xs+W0-8D)kjU#R z+S|A^HkRg$Ij%N4v~k`jyHffKaC~=wg=9)V5h=|kLQ@;^W!o2^K+xG&2n`XCd>OY5Ydi= zgHH=lgy++erK8&+YeTl7VNyVm9-GfONlSlVb3)V9NW5tT!cJ8d7X)!b-$fb!s76{t z@d=Vg-5K_sqHA@Zx-L_}wVnc@L@GL9_K~Zl(h5@AR#FAiKad8~KeWCo@mgXIQ#~u{ zgYFwNz}2b6Vu@CP0XoqJ+dm8px(5W5-Jpis97F`+KM)TuP*X8H@zwiVKDKGVp59pI zifNHZr|B+PG|7|Y<*tqap0CvG7tbR1R>jn70t1X`XJixiMVcHf%Ez*=xm1(CrTSDt z0cle!+{8*Ja&EOZ4@$qhBuKQ$U95Q%rc7tg$VRhk?3=pE&n+T3upZg^ZJc9~c2es% zh7>+|mrmA-p&v}|OtxqmHIBgUxL~^0+cpfkSK2mhh+4b=^F1Xgd2)}U*Yp+H?ls#z zrLxWg_hm}AfK2XYWr!rzW4g;+^^&bW%LmbtRai9f3PjU${r@n`JThy-cphbcwn)rq9{A$Ht`lmYKxOacy z6v2R(?gHhD5@&kB-Eg?4!hAoD7~(h>(R!s1c1Hx#s9vGPePUR|of32bS`J5U5w{F) z>0<^ktO2UHg<0{oxkdOQ;}coZDQph8p6ruj*_?uqURCMTac;>T#v+l1Tc~%^k-Vd@ zkc5y35jVNc49vZpZx;gG$h{%yslDI%Lqga1&&;mN{Ush1c7p>7e-(zp}6E7f-XmJb4nhk zb8zS+{IVbL$QVF8pf8}~kQ|dHJAEATmmnrb_wLG}-yHe>W|A&Y|;muy-d^t^<&)g5SJfaTH@P1%euONny=mxo+C z4N&w#biWY41r8k~468tvuYVh&XN&d#%QtIf9;iVXfWY)#j=l`&B~lqDT@28+Y!0E+MkfC}}H*#(WKKdJJq=O$vNYCb(ZG@p{fJgu;h z21oHQ(14?LeT>n5)s;uD@5&ohU!@wX8w*lB6i@GEH0pM>YTG+RAIWZD;4#F1&F%Jp zXZUml2sH0!lYJT?&sA!qwez6cXzJEd(1ZC~kT5kZSp7(@=H2$Azb_*W&6aA|9iwCL zdX7Q=42;@dspHDwYE?miGX#L^3xD&%BI&fN9^;`v4OjQXPBaBmOF1;#C)8XA(WFlH zycro;DS2?(G&6wkr6rqC>rqDv3nfGw3hmN_9Al>TgvmGsL8_hXx09};l9Ow@)F5@y z#VH5WigLDwZE4nh^7&@g{1FV^UZ%_LJ-s<{HN*2R$OPg@R~Z`c-ET*2}XB@9xvAjrK&hS=f|R8Gr9 zr|0TGOsI7RD+4+2{ZiwdVD@2zmg~g@^D--YL;6UYGSM8i$NbQr4!c7T9rg!8;TM0E zT#@?&S=t>GQm)*ua|?TLT2ktj#`|R<_*FAkOu2Pz$wEc%-=Y9V*$&dg+wIei3b*O8 z2|m$!jJG!J!ZGbbIa!(Af~oSyZV+~M1qGvelMzPNE_%5?c2>;MeeG2^N?JDKjFYCy z7SbPWH-$cWF9~fX%9~v99L!G(wi!PFp>rB!9xj7=Cv|F+7CsGNwY0Q_J%FID%C^CBZQfJ9K(HK%k31j~e#&?hQ zNuD6gRkVckU)v+53-fc} z7ZCzYN-5RG4H7;>>Hg?LU9&5_aua?A0)0dpew1#MMlu)LHe(M;OHjHIUl7|%%)YPo z0cBk;AOY00%Fe6heoN*$(b<)Cd#^8Iu;-2v@>cE-OB$icUF9EEoaC&q8z9}jMTT2I z8`9;jT%z0;dy4!8U;GW{i`)3!c6&oWY`J3669C!tM<5nQFFrFRglU8f)5Op$GtR-3 zn!+SPCw|04sv?%YZ(a7#L?vsdr7ss@WKAw&A*}-1S|9~cL%uA+E~>N6QklFE>8W|% zyX-qAUGTY1hQ-+um`2|&ji0cY*(qN!zp{YpDO-r>jPk*yuVSay<)cUt`t@&FPF_&$ zcHwu1(SQ`I-l8~vYyUxm@D1UEdFJ$f5Sw^HPH7b!9 zzYT3gKMF((N(v0#4f_jPfVZ=ApN^jQJe-X$`A?X+vWjLn_%31KXE*}5_}d8 zw_B1+a#6T1?>M{ronLbHIlEsMf93muJ7AH5h%;i99<~JX^;EAgEB1uHralD*!aJ@F zV2ruuFe9i2Q1C?^^kmVy921eb=tLDD43@-AgL^rQ3IO9%+vi_&R2^dpr}x{bCVPej z7G0-0o64uyWNtr*loIvslyo0%)KSDDKjfThe0hcqs)(C-MH1>bNGBDRTW~scy_{w} zp^aq8Qb!h9Lwielq%C1b8=?Z=&U)ST&PHbS)8Xzjh2DF?d{iAv)Eh)wsUnf>UtXN( zL7=$%YrZ#|^c{MYmhn!zV#t*(jdmYdCpwqpZ{v&L8KIuKn`@IIZfp!uo}c;7J57N` zAxyZ-uA4=Gzl~Ovycz%MW9ZL7N+nRo&1cfNn9(1H5eM;V_4Z_qVann7F>5f>%{rf= zPBZFaV@_Sobl?Fy&KXyzFDV*FIdhS5`Uc~S^Gjo)aiTHgn#<0C=9o-a-}@}xDor;D zZyZ|fvf;+=3MZd>SR1F^F`RJEZo+|MdyJYQAEauKu%WDol~ayrGU3zzbHKsnHKZ*z zFiwUkL@DZ>!*x05ql&EBq@_Vqv83&?@~q5?lVmffQZ+V-=qL+!u4Xs2Z2zdCQ3U7B&QR9_Iggy} z(om{Y9eU;IPe`+p1ifLx-XWh?wI)xU9ik+m#g&pGdB5Bi<`PR*?92lE0+TkRuXI)z z5LP!N2+tTc%cB6B1F-!fj#}>S!vnpgVU~3!*U1ej^)vjUH4s-bd^%B=ItQqDCGbrEzNQi(dJ`J}-U=2{7-d zK8k^Rlq2N#0G?9&1?HSle2vlkj^KWSBYTwx`2?9TU_DX#J+f+qLiZCqY1TXHFxXZqYMuD@RU$TgcnCC{_(vwZ-*uX)~go#%PK z@}2Km_5aQ~(<3cXeJN6|F8X_1@L%@xTzs}$_*E|a^_URF_qcF;Pfhoe?FTFwvjm1o z8onf@OY@jC2tVcMaZS;|T!Ks(wOgPpRzRnFS-^RZ4E!9dsnj9sFt609a|jJbb1Dt@ z<=Gal2jDEupxUSwWu6zp<<&RnAA;d&4gKVG0iu6g(DsST(4)z6R)zDpfaQ}v{5ARt zyhwvMtF%b-YazR5XLz+oh=mn;y-Mf2a8>7?2v8qX;19y?b>Z5laGHvzH;Nu9S`B8} zI)qN$GbXIQ1VL3lnof^6TS~rvPVg4V?Dl2Bb*K2z4E{5vy<(@@K_cN@U>R!>aUIRnb zL*)=787*cs#zb31zBC49x$`=fkQbMAef)L2$dR{)6BAz!t5U_B#1zZG`^neKSS22oJ#5B=gl%U=WeqL9REF2g zZnfCb0?quf?Ztj$VXvDSWoK`0L=Zxem2q}!XWLoT-kYMOx)!7fcgT35uC~0pySEme z`{wGWTkGr7>+Kb^n;W?BZH6ZP(9tQX%-7zF>vc2}LuWDI(9kh1G#7B99r4x6;_-V+k&c{nPUrR zAXJGRiMe~aup{0qzmLNjS_BC4cB#sXjckx{%_c&^xy{M61xEb>KW_AG5VFXUOjAG4 z^>Qlm9A#1N{4snY=(AmWzatb!ngqiqPbBZ7>Uhb3)dTkSGcL#&SH>iMO-IJBPua`u zo)LWZ>=NZLr758j{%(|uQuZ)pXq_4c!!>s|aDM9#`~1bzK3J1^^D#<2bNCccH7~-X}Ggi!pIIF>uFx%aPARGQsnC8ZQc8lrQ5o~smqOg>Ti^GNme94*w z)JZy{_{#$jxGQ&`M z!OMvZMHR>8*^>eS%o*6hJwn!l8VOOjZQJvh)@tnHVW&*GYPuxqXw}%M!(f-SQf`=L z5;=5w2;%82VMH6Xi&-K3W)o&K^+vJCepWZ-rW%+Dc6X3(){z$@4zjYxQ|}8UIojeC zYZpQ1dU{fy=oTr<4VX?$q)LP}IUmpiez^O&N3E_qPpchGTi5ZM6-2ScWlQq%V&R2Euz zO|Q0Hx>lY1Q1cW5xHv5!0OGU~PVEqSuy#fD72d#O`N!C;o=m+YioGu-wH2k6!t<~K zSr`E=W9)!g==~x9VV~-8{4ZN9{~-A9zJpRe%NGg$+MDuI-dH|b@BD)~>pPCGUNNzY zMDg||0@XGQgw`YCt5C&A{_+J}mvV9Wg{6V%2n#YSRN{AP#PY?1FF1#|vO_%e+#`|2*~wGAJaeRX6=IzFNeWhz6gJc8+(03Ph4y6ELAm=AkN7TOgMUEw*N{= z_)EIDQx5q22oUR+_b*tazu9+pX|n1c*IB-}{DqIj z-?E|ks{o3AGRNb;+iKcHkZvYJvFsW&83RAPs1Oh@IWy%l#5x2oUP6ZCtv+b|q>jsf zZ_9XO;V!>n`UxH1LvH8)L4?8raIvasEhkpQoJ`%!5rBs!0Tu(s_D{`4opB;57)pkX z4$A^8CsD3U5*!|bHIEqsn~{q+Ddj$ME@Gq4JXtgVz&7l{Ok!@?EA{B3P~NAqb9)4? zkQo30A^EbHfQ@87G5&EQTd`frrwL)&Yw?%-W@uy^Gn23%j?Y!Iea2xw<-f;esq zf%w5WN@E1}zyXtYv}}`U^B>W`>XPmdLj%4{P298|SisrE;7HvXX;A}Ffi8B#3Lr;1 zHt6zVb`8{#+e$*k?w8|O{Uh|&AG}|DG1PFo1i?Y*cQm$ZwtGcVgMwtBUDa{~L1KT-{jET4w60>{KZ27vXrHJ;fW{6| z=|Y4!&UX020wU1>1iRgB@Q#m~1^Z^9CG1LqDhYBrnx%IEdIty z!46iOoKlKs)c}newDG)rWUikD%j`)p z_w9Ph&e40=(2eBy;T!}*1p1f1SAUDP9iWy^u^Ubdj21Kn{46;GR+hwLO=4D11@c~V zI8x&(D({K~Df2E)Nx_yQvYfh4;MbMJ@Z}=Dt3_>iim~QZ*hZIlEs0mEb z_54+&*?wMD`2#vsQRN3KvoT>hWofI_Vf(^C1ff-Ike@h@saEf7g}<9T`W;HAne-Nd z>RR+&SP35w)xKn8^U$7))PsM!jKwYZ*RzEcG-OlTrX3}9a{q%#Un5E5W{{hp>w~;` zGky+3(vJvQyGwBo`tCpmo0mo((?nM8vf9aXrrY1Ve}~TuVkB(zeds^jEfI}xGBCM2 zL1|#tycSaWCurP+0MiActG3LCas@_@tao@(R1ANlwB$4K53egNE_;!&(%@Qo$>h`^1S_!hN6 z)vZtG$8fN!|BXBJ=SI>e(LAU(y(i*PHvgQ2llulxS8>qsimv7yL}0q_E5WiAz7)(f zC(ahFvG8&HN9+6^jGyLHM~$)7auppeWh_^zKk&C_MQ~8;N??OlyH~azgz5fe^>~7F zl3HnPN3z-kN)I$4@`CLCMQx3sG~V8hPS^}XDXZrQA>}mQPw%7&!sd(Pp^P=tgp-s^ zjl}1-KRPNWXgV_K^HkP__SR`S-|OF0bR-N5>I%ODj&1JUeAQ3$9i;B~$S6}*^tK?= z**%aCiH7y?xdY?{LgVP}S0HOh%0%LI$wRx;$T|~Y8R)Vdwa}kGWv8?SJVm^>r6+%I z#lj1aR94{@MP;t-scEYQWc#xFA30^}?|BeX*W#9OL;Q9#WqaaM546j5j29((^_8Nu z4uq}ESLr~r*O7E7$D{!k9W>`!SLoyA53i9QwRB{!pHe8um|aDE`Cg0O*{jmor)^t)3`>V>SWN-2VJcFmj^1?~tT=JrP`fVh*t zXHarp=8HEcR#vFe+1a%XXuK+)oFs`GDD}#Z+TJ}Ri`FvKO@ek2ayn}yaOi%(8p%2$ zpEu)v0Jym@f}U|-;}CbR=9{#<^z28PzkkTNvyKvJDZe+^VS2bES3N@Jq!-*}{oQlz z@8bgC_KnDnT4}d#&Cpr!%Yb?E!brx0!eVOw~;lLwUoz#Np%d$o%9scc3&zPm`%G((Le|6o1 zM(VhOw)!f84zG^)tZ1?Egv)d8cdNi+T${=5kV+j;Wf%2{3g@FHp^Gf*qO0q!u$=m9 zCaY`4mRqJ;FTH5`a$affE5dJrk~k`HTP_7nGTY@B9o9vvnbytaID;^b=Tzp7Q#DmD zC(XEN)Ktn39z5|G!wsVNnHi) z%^q94!lL|hF`IijA^9NR0F$@h7k5R^ljOW(;Td9grRN0Mb)l_l7##{2nPQ@?;VjXv zaLZG}yuf$r$<79rVPpXg?6iiieX|r#&`p#Con2i%S8*8F}(E) zI5E6c3tG*<;m~6>!&H!GJ6zEuhH7mkAzovdhLy;)q z{H2*8I^Pb}xC4s^6Y}6bJvMu=8>g&I)7!N!5QG$xseeU#CC?ZM-TbjsHwHgDGrsD= z{%f;@Sod+Ch66Ko2WF~;Ty)v>&x^aovCbCbD7>qF*!?BXmOV3(s|nxsb*Lx_2lpB7 zokUnzrk;P=T-&kUHO}td+Zdj!3n&NR?K~cRU zAXU!DCp?51{J4w^`cV#ye}(`SQhGQkkMu}O3M*BWt4UsC^jCFUy;wTINYmhD$AT;4 z?Xd{HaJjP`raZ39qAm;%beDbrLpbRf(mkKbANan7XsL>_pE2oo^$TgdidjRP!5-`% zv0d!|iKN$c0(T|L0C~XD0aS8t{*&#LnhE;1Kb<9&=c2B+9JeLvJr*AyyRh%@jHej=AetOMSlz^=!kxX>>B{2B1uIrQyfd8KjJ+DBy!h)~*(!|&L4^Q_07SQ~E zcemVP`{9CwFvPFu7pyVGCLhH?LhEVb2{7U+Z_>o25#+3<|8%1T^5dh}*4(kfJGry} zm%r#hU+__Z;;*4fMrX=Bkc@7|v^*B;HAl0((IBPPii%X9+u3DDF6%bI&6?Eu$8&aWVqHIM7mK6?Uvq$1|(-T|)IV<>e?!(rY zqkmO1MRaLeTR=)io(0GVtQT@s6rN%C6;nS3@eu;P#ry4q;^O@1ZKCJyp_Jo)Ty^QW z+vweTx_DLm{P-XSBj~Sl<%_b^$=}odJ!S2wAcxenmzFGX1t&Qp8Vxz2VT`uQsQYtdn&_0xVivIcxZ_hnrRtwq4cZSj1c-SG9 z7vHBCA=fd0O1<4*=lu$6pn~_pVKyL@ztw1swbZi0B?spLo56ZKu5;7ZeUml1Ws1?u zqMf1p{5myAzeX$lAi{jIUqo1g4!zWLMm9cfWcnw`k6*BR^?$2(&yW?>w;G$EmTA@a z6?y#K$C~ZT8+v{87n5Dm&H6Pb_EQ@V0IWmG9cG=O;(;5aMWWrIPzz4Q`mhK;qQp~a z+BbQrEQ+w{SeiuG-~Po5f=^EvlouB@_|4xQXH@A~KgpFHrwu%dwuCR)=B&C(y6J4J zvoGk9;lLs9%iA-IJGU#RgnZZR+@{5lYl8(e1h6&>Vc_mvg0d@);X zji4T|n#lB!>pfL|8tQYkw?U2bD`W{na&;*|znjmalA&f;*U++_aBYerq;&C8Kw7mI z7tsG*?7*5j&dU)Lje;^{D_h`%(dK|pB*A*1(Jj)w^mZ9HB|vGLkF1GEFhu&rH=r=8 zMxO42e{Si6$m+Zj`_mXb&w5Q(i|Yxyg?juUrY}78uo@~3v84|8dfgbPd0iQJRdMj< zncCNGdMEcsxu#o#B5+XD{tsg*;j-eF8`mp~K8O1J!Z0+>0=7O=4M}E?)H)ENE;P*F z$Ox?ril_^p0g7xhDUf(q652l|562VFlC8^r8?lQv;TMvn+*8I}&+hIQYh2 z1}uQQaag&!-+DZ@|C+C$bN6W;S-Z@)d1|en+XGvjbOxCa-qAF*LA=6s(Jg+g;82f$ z(Vb)8I)AH@cdjGFAR5Rqd0wiNCu!xtqWbcTx&5kslzTb^7A78~Xzw1($UV6S^VWiP zFd{Rimd-0CZC_Bu(WxBFW7+k{cOW7DxBBkJdJ;VsJ4Z@lERQr%3eVv&$%)b%<~ zCl^Y4NgO}js@u{|o~KTgH}>!* z_iDNqX2(As7T0xivMH|3SC1ivm8Q}6Ffcd7owUKN5lHAtzMM4<0v+ykUT!QiowO;`@%JGv+K$bBx@*S7C8GJVqQ_K>12}M`f_Ys=S zKFh}HM9#6Izb$Y{wYzItTy+l5U2oL%boCJn?R3?jP@n$zSIwlmyGq30Cw4QBO|14` zW5c);AN*J3&eMFAk$SR~2k|&+&Bc$e>s%c{`?d~85S-UWjA>DS5+;UKZ}5oVa5O(N zqqc@>)nee)+4MUjH?FGv%hm2{IlIF-QX}ym-7ok4Z9{V+ZHVZQl$A*x!(q%<2~iVv znUa+BX35&lCb#9VE-~Y^W_f;Xhl%vgjwdjzMy$FsSIj&ok}L+X`4>J=9BkN&nu^E*gbhj3(+D>C4E z@Fwq_=N)^bKFSHTzZk?-gNU$@l}r}dwGyh_fNi=9b|n}J>&;G!lzilbWF4B}BBq4f zYIOl?b)PSh#XTPp4IS5ZR_2C!E)Z`zH0OW%4;&~z7UAyA-X|sh9@~>cQW^COA9hV4 zXcA6qUo9P{bW1_2`eo6%hgbN%(G-F1xTvq!sc?4wN6Q4`e9Hku zFwvlAcRY?6h^Fj$R8zCNEDq8`=uZB8D-xn)tA<^bFFy}4$vA}Xq0jAsv1&5!h!yRA zU()KLJya5MQ`q&LKdH#fwq&(bNFS{sKlEh_{N%{XCGO+po#(+WCLmKW6&5iOHny>g z3*VFN?mx!16V5{zyuMWDVP8U*|BGT$(%IO|)?EF|OI*sq&RovH!N%=>i_c?K*A>>k zyg1+~++zY4Q)J;VWN0axhoIKx;l&G$gvj(#go^pZskEVj8^}is3Jw26LzYYVos0HX zRPvmK$dVxM8(Tc?pHFe0Z3uq){{#OK3i-ra#@+;*=ui8)y6hsRv z4Fxx1c1+fr!VI{L3DFMwXKrfl#Q8hfP@ajgEau&QMCxd{g#!T^;ATXW)nUg&$-n25 zruy3V!!;{?OTobo|0GAxe`Acn3GV@W=&n;~&9 zQM>NWW~R@OYORkJAo+eq1!4vzmf9K%plR4(tB@TR&FSbDoRgJ8qVcH#;7lQub*nq&?Z>7WM=oeEVjkaG zT#f)=o!M2DO5hLR+op>t0CixJCIeXH*+z{-XS|%jx)y(j&}Wo|3!l7{o)HU3m7LYyhv*xF&tq z%IN7N;D4raue&&hm0xM=`qv`+TK@;_xAcGKuK(2|75~ar2Yw)geNLSmVxV@x89bQu zpViVKKnlkwjS&&c|-X6`~xdnh}Ps)Hs z4VbUL^{XNLf7_|Oi>tA%?SG5zax}esF*FH3d(JH^Gvr7Rp*n=t7frH!U;!y1gJB^i zY_M$KL_}mW&XKaDEi9K-wZR|q*L32&m+2n_8lq$xRznJ7p8}V>w+d@?uB!eS3#u<} zIaqi!b!w}a2;_BfUUhGMy#4dPx>)_>yZ`ai?Rk`}d0>~ce-PfY-b?Csd(28yX22L% zI7XI>OjIHYTk_@Xk;Gu^F52^Gn6E1&+?4MxDS2G_#PQ&yXPXP^<-p|2nLTb@AAQEY zI*UQ9Pmm{Kat}wuazpjSyXCdnrD&|C1c5DIb1TnzF}f4KIV6D)CJ!?&l&{T)e4U%3HTSYqsQ zo@zWB1o}ceQSV)<4G<)jM|@@YpL+XHuWsr5AYh^Q{K=wSV99D~4RRU52FufmMBMmd z_H}L#qe(}|I9ZyPRD6kT>Ivj&2Y?qVZq<4bG_co_DP`sE*_Xw8D;+7QR$Uq(rr+u> z8bHUWbV19i#)@@G4bCco@Xb<8u~wVDz9S`#k@ciJtlu@uP1U0X?yov8v9U3VOig2t zL9?n$P3=1U_Emi$#slR>N5wH-=J&T=EdUHA}_Z zZIl3nvMP*AZS9{cDqFanrA~S5BqxtNm9tlu;^`)3X&V4tMAkJ4gEIPl= zoV!Gyx0N{3DpD@)pv^iS*dl2FwANu;1;%EDl}JQ7MbxLMAp>)UwNwe{=V}O-5C*>F zu?Ny+F64jZn<+fKjF01}8h5H_3pey|;%bI;SFg$w8;IC<8l|3#Lz2;mNNik6sVTG3 z+Su^rIE#40C4a-587$U~%KedEEw1%r6wdvoMwpmlXH$xPnNQN#f%Z7|p)nC>WsuO= z4zyqapLS<8(UJ~Qi9d|dQijb_xhA2)v>la)<1md5s^R1N&PiuA$^k|A<+2C?OiHbj z>Bn$~t)>Y(Zb`8hW7q9xQ=s>Rv81V+UiuZJc<23HplI88isqRCId89fb`Kt|CxVIg znWcwprwXnotO>3s&Oypkte^9yJjlUVVxSe%_xlzmje|mYOVPH^vjA=?6xd0vaj0Oz zwJ4OJNiFdnHJX3rw&inskjryukl`*fRQ#SMod5J|KroJRsVXa5_$q7whSQ{gOi*s0 z1LeCy|JBWRsDPn7jCb4s(p|JZiZ8+*ExC@Vj)MF|*Vp{B(ziccSn`G1Br9bV(v!C2 z6#?eqpJBc9o@lJ#^p-`-=`4i&wFe>2)nlPK1p9yPFzJCzBQbpkcR>={YtamIw)3nt z(QEF;+)4`>8^_LU)_Q3 zC5_7lgi_6y>U%m)m@}Ku4C}=l^J=<<7c;99ec3p{aR+v=diuJR7uZi%aQv$oP?dn?@6Yu_+*^>T0ptf(oobdL;6)N-I!TO`zg^Xbv3#L0I~sn@WGk-^SmPh5>W+LB<+1PU}AKa?FCWF|qMNELOgdxR{ zbqE7@jVe+FklzdcD$!(A$&}}H*HQFTJ+AOrJYnhh}Yvta(B zQ_bW4Rr;R~&6PAKwgLWXS{Bnln(vUI+~g#kl{r+_zbngT`Y3`^Qf=!PxN4IYX#iW4 zucW7@LLJA9Zh3(rj~&SyN_pjO8H&)|(v%!BnMWySBJV=eSkB3YSTCyIeJ{i;(oc%_hk{$_l;v>nWSB)oVeg+blh=HB5JSlG_r7@P z3q;aFoZjD_qS@zygYqCn=;Zxjo!?NK!%J$ z52lOP`8G3feEj+HTp@Tnn9X~nG=;tS+z}u{mQX_J0kxtr)O30YD%oo)L@wy`jpQYM z@M>Me=95k1p*FW~rHiV1CIfVc{K8r|#Kt(ApkXKsDG$_>76UGNhHExFCw#Ky9*B-z zNq2ga*xax!HMf_|Vp-86r{;~YgQKqu7%szk8$hpvi_2I`OVbG1doP(`gn}=W<8%Gn z%81#&WjkH4GV;4u43EtSW>K_Ta3Zj!XF?;SO3V#q=<=>Tc^@?A`i;&`-cYj|;^ zEo#Jl5zSr~_V-4}y8pnufXLa80vZY4z2ko7fj>DR)#z=wWuS1$$W!L?(y}YC+yQ|G z@L&`2upy3f>~*IquAjkVNU>}c10(fq#HdbK$~Q3l6|=@-eBbo>B9(6xV`*)sae58*f zym~RRVx;xoCG3`JV`xo z!lFw)=t2Hy)e!IFs?0~7osWk(d%^wxq&>_XD4+U#y&-VF%4z?XH^i4w`TxpF{`XhZ z%G}iEzf!T(l>g;W9<~K+)$g!{UvhW{E0Lis(S^%I8OF&%kr!gJ&fMOpM=&=Aj@wuL zBX?*6i51Qb$uhkwkFYkaD_UDE+)rh1c;(&Y=B$3)J&iJfQSx!1NGgPtK!$c9OtJuu zX(pV$bfuJpRR|K(dp@^j}i&HeJOh@|7lWo8^$*o~Xqo z5Sb+!EtJ&e@6F+h&+_1ETbg7LfP5GZjvIUIN3ibCOldAv z)>YdO|NH$x7AC8dr=<2ekiY1%fN*r~e5h6Yaw<{XIErujKV~tiyrvV_DV0AzEknC- zR^xKM3i<1UkvqBj3C{wDvytOd+YtDSGu!gEMg+!&|8BQrT*|p)(dwQLEy+ zMtMzij3zo40)CA!BKZF~yWg?#lWhqD3@qR)gh~D{uZaJO;{OWV8XZ_)J@r3=)T|kt zUS1pXr6-`!Z}w2QR7nP%d?ecf90;K_7C3d!UZ`N(TZoWNN^Q~RjVhQG{Y<%E1PpV^4 z-m-K+$A~-+VDABs^Q@U*)YvhY4Znn2^w>732H?NRK(5QSS$V@D7yz2BVX4)f5A04~$WbxGOam22>t&uD)JB8-~yiQW6ik;FGblY_I>SvB_z2?PS z*Qm&qbKI{H1V@YGWzpx`!v)WeLT02};JJo*#f$a*FH?IIad-^(;9XC#YTWN6;Z6+S zm4O1KH=#V@FJw7Pha0!9Vb%ZIM$)a`VRMoiN&C|$YA3~ZC*8ayZRY^fyuP6$n%2IU z$#XceYZeqLTXw(m$_z|33I$B4k~NZO>pP6)H_}R{E$i%USGy{l{-jOE;%CloYPEU+ zRFxOn4;7lIOh!7abb23YKD+_-?O z0FP9otcAh+oSj;=f#$&*ExUHpd&e#bSF%#8*&ItcL2H$Sa)?pt0Xtf+t)z$_u^wZi z44oE}r4kIZGy3!Mc8q$B&6JqtnHZ>Znn!Zh@6rgIu|yU+zG8q`q9%B18|T|oN3zMq z`l&D;U!OL~%>vo&q0>Y==~zLiCZk4v%s_7!9DxQ~id1LLE93gf*gg&2$|hB#j8;?3 z5v4S;oM6rT{Y;I+#FdmNw z){d%tNM<<#GN%n9ox7B=3#;u7unZ~tLB_vRZ52a&2=IM)2VkXm=L+Iqq~uk#Dug|x z>S84e+A7EiOY5lj*!q?6HDkNh~0g;0Jy(al!ZHHDtur9T$y-~)94HelX1NHjXWIM7UAe}$?jiz z9?P4`I0JM=G5K{3_%2jPLC^_Mlw?-kYYgb7`qGa3@dn|^1fRMwiyM@Ch z;CB&o7&&?c5e>h`IM;Wnha0QKnEp=$hA8TJgR-07N~U5(>9vJzeoFsSRBkDq=x(YgEMpb=l4TDD`2 zwVJpWGTA_u7}?ecW7s6%rUs&NXD3+n;jB86`X?8(l3MBo6)PdakI6V6a}22{)8ilT zM~T*mU}__xSy|6XSrJ^%lDAR3Lft%+yxC|ZUvSO_nqMX!_ul3;R#*{~4DA=h$bP)%8Yv9X zyp><|e8=_ttI}ZAwOd#dlnSjck#6%273{E$kJuCGu=I@O)&6ID{nWF5@gLb16sj|&Sb~+du4e4O_%_o`Ix4NRrAsyr1_}MuP94s>de8cH-OUkVPk3+K z&jW)It9QiU-ti~AuJkL`XMca8Oh4$SyJ=`-5WU<{cIh+XVH#e4d&zive_UHC!pN>W z3TB;Mn5i)9Qn)#6@lo4QpI3jFYc0~+jS)4AFz8fVC;lD^+idw^S~Qhq>Tg(!3$yLD zzktzoFrU@6s4wwCMz}edpF5i5Q1IMmEJQHzp(LAt)pgN3&O!&d?3W@6U4)I^2V{;- z6A(?zd93hS*uQmnh4T)nHnE{wVhh(=MMD(h(P4+^p83Om6t<*cUW>l(qJzr%5vp@K zN27ka(L{JX=1~e2^)F^i=TYj&;<7jyUUR2Bek^A8+3Up*&Xwc{)1nRR5CT8vG>ExV zHnF3UqXJOAno_?bnhCX-&kwI~Ti8t4`n0%Up>!U`ZvK^w2+0Cs-b9%w%4`$+To|k= zKtgc&l}P`*8IS>8DOe?EB84^kx4BQp3<7P{Pq}&p%xF_81pg!l2|u=&I{AuUgmF5n zJQCTLv}%}xbFGYtKfbba{CBo)lWW%Z>i(_NvLhoQZ*5-@2l&x>e+I~0Nld3UI9tdL zRzu8}i;X!h8LHVvN?C+|M81e>Jr38%&*9LYQec9Ax>?NN+9(_>XSRv&6hlCYB`>Qm z1&ygi{Y()OU4@D_jd_-7vDILR{>o|7-k)Sjdxkjgvi{@S>6GqiF|o`*Otr;P)kLHN zZkpts;0zw_6;?f(@4S1FN=m!4^mv~W+lJA`&7RH%2$)49z0A+8@0BCHtj|yH--AEL z0tW6G%X-+J+5a{5*WKaM0QDznf;V?L5&uQw+yegDNDP`hA;0XPYc6e0;Xv6|i|^F2WB)Z$LR|HR4 zTQsRAby9(^Z@yATyOgcfQw7cKyr^3Tz7lc7+JEwwzA7)|2x+PtEb>nD(tpxJQm)Kn zW9K_*r!L%~N*vS8<5T=iv|o!zTe9k_2jC_j*7ik^M_ zaf%k{WX{-;0*`t`G!&`eW;gChVXnJ-Rn)To8vW-?>>a%QU1v`ZC=U)f8iA@%JG0mZ zDqH;~mgBnrCP~1II<=V9;EBL)J+xzCoiRBaeH&J6rL!{4zIY8tZka?_FBeQeNO3q6 zyG_alW54Ba&wQf{&F1v-r1R6ID)PTsqjIBc+5MHkcW5Fnvi~{-FjKe)t1bl}Y;z@< z=!%zvpRua>>t_x}^}z0<7MI!H2v6|XAyR9!t50q-A)xk0nflgF4*OQlCGK==4S|wc zRMsSscNhRzHMBU8TdcHN!q^I}x0iXJ%uehac|Zs_B$p@CnF)HeXPpB_Za}F{<@6-4 zl%kml@}kHQ(ypD8FsPJ2=14xXJE|b20RUIgs!2|R3>LUMGF6X*B_I|$`Qg=;zm7C z{mEDy9dTmPbued7mlO@phdmAmJ7p@GR1bjCkMw6*G7#4+`k>fk1czdJUB!e@Q(~6# zwo%@p@V5RL0ABU2LH7Asq^quDUho@H>eTZH9f*no9fY0T zD_-9px3e}A!>>kv5wk91%C9R1J_Nh!*&Kk$J3KNxC}c_@zlgpJZ+5L)Nw|^p=2ue}CJtm;uj*Iqr)K})kA$xtNUEvX;4!Px*^&9T_`IN{D z{6~QY=Nau6EzpvufB^hflc#XIsSq0Y9(nf$d~6ZwK}fal92)fr%T3=q{0mP-EyP_G z)UR5h@IX}3Qll2b0oCAcBF>b*@Etu*aTLPU<%C>KoOrk=x?pN!#f_Og-w+;xbFgjQ zXp`et%lDBBh~OcFnMKMUoox0YwBNy`N0q~bSPh@+enQ=4RUw1) zpovN`QoV>vZ#5LvC;cl|6jPr}O5tu!Ipoyib8iXqy}TeJ;4+_7r<1kV0v5?Kv>fYp zg>9L`;XwXa&W7-jf|9~uP2iyF5`5AJ`Q~p4eBU$MCC00`rcSF>`&0fbd^_eqR+}mK z4n*PMMa&FOcc)vTUR zlDUAn-mh`ahi_`f`=39JYTNVjsTa_Y3b1GOIi)6dY)D}xeshB0T8Eov5%UhWd1)u}kjEQ|LDo{tqKKrYIfVz~@dp!! zMOnah@vp)%_-jDTUG09l+;{CkDCH|Q{NqX*uHa1YxFShy*1+;J`gywKaz|2Q{lG8x zP?KBur`}r`!WLKXY_K;C8$EWG>jY3UIh{+BLv0=2)KH%P}6xE2kg)%(-uA6lC?u8}{K(#P*c zE9C8t*u%j2r_{;Rpe1A{9nNXU;b_N0vNgyK!EZVut~}+R2rcbsHilqsOviYh-pYX= zHw@53nlmwYI5W5KP>&`dBZe0Jn?nAdC^HY1wlR6$u^PbpB#AS&5L6zqrXN&7*N2Q` z+Rae1EwS)H=aVSIkr8Ek^1jy2iS2o7mqm~Mr&g5=jjt7VxwglQ^`h#Mx+x2v|9ZAwE$i_9918MjJxTMr?n!bZ6n$}y11u8I9COTU`Z$Fi z!AeAQLMw^gp_{+0QTEJrhL424pVDp%wpku~XRlD3iv{vQ!lAf!_jyqd_h}+Tr1XG| z`*FT*NbPqvHCUsYAkFnM`@l4u_QH&bszpUK#M~XLJt{%?00GXY?u_{gj3Hvs!=N(I z(=AuWPijyoU!r?aFTsa8pLB&cx}$*%;K$e*XqF{~*rA-qn)h^!(-;e}O#B$|S~c+U zN4vyOK0vmtx$5K!?g*+J@G1NmlEI=pyZXZ69tAv=@`t%ag_Hk{LP~OH9iE)I= zaJ69b4kuCkV0V zo(M0#>phpQ_)@j;h%m{-a*LGi(72TP)ws2w*@4|C-3+;=5DmC4s7Lp95%n%@Ko zfdr3-a7m*dys9iIci$A=4NPJ`HfJ;hujLgU)ZRuJI`n;Pw|yksu!#LQnJ#dJysgNb z@@qwR^wrk(jbq4H?d!lNyy72~Dnn87KxsgQ!)|*m(DRM+eC$wh7KnS-mho3|KE)7h zK3k;qZ;K1Lj6uEXLYUYi)1FN}F@-xJ z@@3Hb84sl|j{4$3J}aTY@cbX@pzB_qM~APljrjju6P0tY{C@ zpUCOz_NFmALMv1*blCcwUD3?U6tYs+N%cmJ98D%3)%)Xu^uvzF zS5O!sc#X6?EwsYkvPo6A%O8&y8sCCQH<%f2togVwW&{M;PR!a(ZT_A+jVAbf{@5kL zB@Z(hb$3U{T_}SKA_CoQVU-;j>2J=L#lZ~aQCFg-d<9rzs$_gO&d5N6eFSc z1ml8)P*FSi+k@!^M9nDWR5e@ATD8oxtDu=36Iv2!;dZzidIS(PCtEuXAtlBb1;H%Z zwnC^Ek*D)EX4#Q>R$$WA2sxC_t(!!6Tr?C#@{3}n{<^o;9id1RA&-Pig1e-2B1XpG zliNjgmd3c&%A}s>qf{_j#!Z`fu0xIwm4L0)OF=u(OEmp;bLCIaZX$&J_^Z%4Sq4GZ zPn6sV_#+6pJmDN_lx@1;Zw6Md_p0w9h6mHtzpuIEwNn>OnuRSC2=>fP^Hqgc)xu^4 z<3!s`cORHJh#?!nKI`Et7{3C27+EuH)Gw1f)aoP|B3y?fuVfvpYYmmukx0ya-)TQX zR{ggy5cNf4X|g)nl#jC9p>7|09_S7>1D2GTRBUTW zAkQ=JMRogZqG#v;^=11O6@rPPwvJkr{bW-Qg8`q8GoD#K`&Y+S#%&B>SGRL>;ZunM@49!}Uy zN|bBCJ%sO;@3wl0>0gbl3L@1^O60ONObz8ZI7nder>(udj-jt`;yj^nTQ$L9`OU9W zX4alF#$|GiR47%x@s&LV>2Sz2R6?;2R~5k6V>)nz!o_*1Y!$p>BC5&?hJg_MiE6UBy>RkVZj`9UWbRkN-Hk!S`=BS3t3uyX6)7SF#)71*}`~Ogz z1rap5H6~dhBJ83;q-Y<5V35C2&F^JI-it(=5D#v!fAi9p#UwV~2tZQI+W(Dv?1t9? zfh*xpxxO{-(VGB>!Q&0%^YW_F!@aZS#ucP|YaD#>wd1Fv&Z*SR&mc;asi}1G) z_H>`!akh-Zxq9#io(7%;a$)w+{QH)Y$?UK1Dt^4)up!Szcxnu}kn$0afcfJL#IL+S z5gF_Y30j;{lNrG6m~$Ay?)*V9fZuU@3=kd40=LhazjFrau>(Y>SJNtOz>8x_X-BlA zIpl{i>OarVGj1v(4?^1`R}aQB&WCRQzS~;7R{tDZG=HhgrW@B`W|#cdyj%YBky)P= zpxuOZkW>S6%q7U{VsB#G(^FMsH5QuGXhb(sY+!-R8Bmv6Sx3WzSW<1MPPN1!&PurYky(@`bP9tz z52}LH9Q?+FF5jR6-;|+GVdRA!qtd;}*-h&iIw3Tq3qF9sDIb1FFxGbo&fbG5n8$3F zyY&PWL{ys^dTO}oZ#@sIX^BKW*bon=;te9j5k+T%wJ zNJtoN1~YVj4~YRrlZl)b&kJqp+Z`DqT!la$x&&IxgOQw#yZd-nBP3!7FijBXD|IsU8Zl^ zc6?MKpJQ+7ka|tZQLfchD$PD|;K(9FiLE|eUZX#EZxhG!S-63C$jWX1Yd!6-Yxi-u zjULIr|0-Q%D9jz}IF~S%>0(jOqZ(Ln<$9PxiySr&2Oic7vb<8q=46)Ln%Z|<*z5&> z3f~Zw@m;vR(bESB<=Jqkxn(=#hQw42l(7)h`vMQQTttz9XW6^|^8EK7qhju4r_c*b zJIi`)MB$w@9epwdIfnEBR+?~);yd6C(LeMC& zn&&N*?-g&BBJcV;8&UoZi4Lmxcj16ojlxR~zMrf=O_^i1wGb9X-0@6_rpjPYemIin zmJb+;lHe;Yp=8G)Q(L1bzH*}I>}uAqhj4;g)PlvD9_e_ScR{Ipq|$8NvAvLD8MYr}xl=bU~)f%B3E>r3Bu9_t|ThF3C5~BdOve zEbk^r&r#PT&?^V1cb{72yEWH}TXEE}w>t!cY~rA+hNOTK8FAtIEoszp!qqptS&;r$ zaYV-NX96-h$6aR@1xz6_E0^N49mU)-v#bwtGJm)ibygzJ8!7|WIrcb`$XH~^!a#s& z{Db-0IOTFq#9!^j!n_F}#Z_nX{YzBK8XLPVmc&X`fT7!@$U-@2KM9soGbmOSAmqV z{nr$L^MBo_u^Joyf0E^=eo{Rt0{{e$IFA(#*kP@SQd6lWT2-#>` zP1)7_@IO!9lk>Zt?#CU?cuhiLF&)+XEM9B)cS(gvQT!X3`wL*{fArTS;Ak`J<84du zALKPz4}3nlG8Fo^MH0L|oK2-4xIY!~Oux~1sw!+It)&D3p;+N8AgqKI`ld6v71wy8I!eP0o~=RVcFQR2Gr(eP_JbSytoQ$Yt}l*4r@A8Me94y z8cTDWhqlq^qoAhbOzGBXv^Wa4vUz$(7B!mX`T=x_ueKRRDfg&Uc-e1+z4x$jyW_Pm zp?U;-R#xt^Z8Ev~`m`iL4*c#65Nn)q#=Y0l1AuD&+{|8-Gsij3LUZXpM0Bx0u7WWm zH|%yE@-#XEph2}-$-thl+S;__ciBxSSzHveP%~v}5I%u!z_l_KoW{KRx2=eB33umE zIYFtu^5=wGU`Jab8#}cnYry@9p5UE#U|VVvx_4l49JQ;jQdp(uw=$^A$EA$LM%vmE zvdEOaIcp5qX8wX{mYf0;#51~imYYPn4=k&#DsKTxo{_Mg*;S495?OBY?#gv=edYC* z^O@-sd-qa+U24xvcbL0@C7_6o!$`)sVr-jSJE4XQUQ$?L7}2(}Eixqv;L8AdJAVqc zq}RPgpnDb@E_;?6K58r3h4-!4rT4Ab#rLHLX?eMOfluJk=3i1@Gt1i#iA=O`M0@x! z(HtJP9BMHXEzuD93m|B&woj0g6T?f#^)>J>|I4C5?Gam>n9!8CT%~aT;=oco5d6U8 zMXl(=W;$ND_8+DD*?|5bJ!;8ebESXMUKBAf7YBwNVJibGaJ*(2G`F%wx)grqVPjudiaq^Kl&g$8A2 zWMxMr@_$c}d+;_B`#kUX-t|4VKH&_f^^EP0&=DPLW)H)UzBG%%Tra*5 z%$kyZe3I&S#gfie^z5)!twG={3Cuh)FdeA!Kj<-9** zvT*5%Tb`|QbE!iW-XcOuy39>D3oe6x{>&<#E$o8Ac|j)wq#kQzz|ATd=Z0K!p2$QE zPu?jL8Lb^y3_CQE{*}sTDe!2!dtlFjq&YLY@2#4>XS`}v#PLrpvc4*@q^O{mmnr5D zmyJq~t?8>FWU5vZdE(%4cuZuao0GNjp3~Dt*SLaxI#g_u>hu@k&9Ho*#CZP~lFJHj z(e!SYlLigyc?&5-YxlE{uuk$9b&l6d`uIlpg_z15dPo*iU&|Khx2*A5Fp;8iK_bdP z?T6|^7@lcx2j0T@x>X7|kuuBSB7<^zeY~R~4McconTxA2flHC0_jFxmSTv-~?zVT| zG_|yDqa9lkF*B6_{j=T>=M8r<0s;@z#h)3BQ4NLl@`Xr__o7;~M&dL3J8fP&zLfDfy z);ckcTev{@OUlZ`bCo(-3? z1u1xD`PKgSg?RqeVVsF<1SLF;XYA@Bsa&cY!I48ZJn1V<3d!?s=St?TLo zC0cNr`qD*M#s6f~X>SCNVkva^9A2ZP>CoJ9bvgXe_c}WdX-)pHM5m7O zrHt#g$F0AO+nGA;7dSJ?)|Mo~cf{z2L)Rz!`fpi73Zv)H=a5K)*$5sf_IZypi($P5 zsPwUc4~P-J1@^3C6-r9{V-u0Z&Sl7vNfmuMY4yy*cL>_)BmQF!8Om9Dej%cHxbIzA zhtV0d{=%cr?;bpBPjt@4w=#<>k5ee=TiWAXM2~tUGfm z$s&!Dm0R^V$}fOR*B^kGaipi~rx~A2cS0;t&khV1a4u38*XRUP~f za!rZMtay8bsLt6yFYl@>-y^31(*P!L^^s@mslZy(SMsv9bVoX`O#yBgEcjCmGpyc* zeH$Dw6vB5P*;jor+JOX@;6K#+xc)Z9B8M=x2a@Wx-{snPGpRmOC$zpsqW*JCh@M2Y z#K+M(>=#d^>Of9C`))h<=Bsy)6zaMJ&x-t%&+UcpLjV`jo4R2025 zXaG8EA!0lQa)|dx-@{O)qP6`$rhCkoQqZ`^SW8g-kOwrwsK8 z3ms*AIcyj}-1x&A&vSq{r=QMyp3CHdWH35!sad#!Sm>^|-|afB+Q;|Iq@LFgqIp#Z zD1%H+3I?6RGnk&IFo|u+E0dCxXz4yI^1i!QTu7uvIEH>i3rR{srcST`LIRwdV1P;W z+%AN1NIf@xxvVLiSX`8ILA8MzNqE&7>%jMzGt9wm78bo9<;h*W84i29^w!>V>{N+S zd`5Zmz^G;f=icvoOZfK5#1ctx*~UwD=ab4DGQXehQ!XYnak*dee%YN$_ZPL%KZuz$ zD;$PpT;HM^$KwtQm@7uvT`i6>Hae1CoRVM2)NL<2-k2PiX=eAx+-6j#JI?M}(tuBW zkF%jjLR)O`gI2fcPBxF^HeI|DWwQWHVR!;;{BXXHskxh8F@BMDn`oEi-NHt;CLymW z=KSv5)3dyzec0T5B*`g-MQ<;gz=nIWKUi9ko<|4I(-E0k$QncH>E4l z**1w&#={&zv4Tvhgz#c29`m|;lU-jmaXFMC11 z*dlXDMEOG>VoLMc>!rApwOu2prKSi*!w%`yzGmS+k(zm*CsLK*wv{S_0WX^8A-rKy zbk^Gf_92^7iB_uUF)EE+ET4d|X|>d&mdN?x@vxKAQk`O+r4Qdu>XGy(a(19g;=jU} zFX{O*_NG>!$@jh!U369Lnc+D~qch3uT+_Amyi}*k#LAAwh}k8IPK5a-WZ81ufD>l> z$4cF}GSz>ce`3FAic}6W4Z7m9KGO?(eWqi@L|5Hq0@L|&2flN1PVl}XgQ2q*_n2s3 zt5KtowNkTYB5b;SVuoXA@i5irXO)A&%7?V`1@HGCB&)Wgk+l|^XXChq;u(nyPB}b3 zY>m5jkxpZgi)zfbgv&ec4Zqdvm+D<?Im*mXweS9H+V>)zF#Zp3)bhl$PbISY{5=_z!8&*Jv~NYtI-g!>fDs zmvL5O^U%!^VaKA9gvKw|5?-jk>~%CVGvctKmP$kpnpfN{D8@X*Aazi$txfa%vd-|E z>kYmV66W!lNekJPom29LdZ%(I+ZLZYTXzTg*to~m?7vp%{V<~>H+2}PQ?PPAq`36R z<%wR8v6UkS>Wt#hzGk#44W<%9S=nBfB);6clKwnxY}T*w21Qc3_?IJ@4gYzC7s;WP zVQNI(M=S=JT#xsZy7G`cR(BP9*je0bfeN8JN5~zY(DDs0t{LpHOIbN);?T-69Pf3R zSNe*&p2%AwXHL>__g+xd4Hlc_vu<25H?(`nafS%)3UPP7_4;gk-9ckt8SJRTv5v0M z_Hww`qPudL?ajIR&X*;$y-`<)6dxx1U~5eGS13CB!lX;3w7n&lDDiArbAhSycd}+b zya_3p@A`$kQy;|NJZ~s44Hqo7Hwt}X86NK=(ey>lgWTtGL6k@Gy;PbO!M%1~Wcn2k zUFP|*5d>t-X*RU8g%>|(wwj*~#l4z^Aatf^DWd1Wj#Q*AY0D^V@sC`M zjJc6qXu0I7Y*2;;gGu!plAFzG=J;1%eIOdn zQA>J&e05UN*7I5@yRhK|lbBSfJ+5Uq;!&HV@xfPZrgD}kE*1DSq^=%{o%|LChhl#0 zlMb<^a6ixzpd{kNZr|3jTGeEzuo}-eLT-)Q$#b{!vKx8Tg}swCni>{#%vDY$Ww$84 zew3c9BBovqb}_&BRo#^!G(1Eg((BScRZ}C)Oz?y`T5wOrv);)b^4XR8 zhJo7+<^7)qB>I;46!GySzdneZ>n_E1oWZY;kf94#)s)kWjuJN1c+wbVoNQcmnv}{> zN0pF+Sl3E}UQ$}slSZeLJrwT>Sr}#V(dVaezCQl2|4LN`7L7v&siYR|r7M(*JYfR$ zst3=YaDw$FSc{g}KHO&QiKxuhEzF{f%RJLKe3p*7=oo`WNP)M(9X1zIQPP0XHhY3c znrP{$4#Ol$A0s|4S7Gx2L23dv*Gv2o;h((XVn+9+$qvm}s%zi6nI-_s6?mG! zj{DV;qesJb&owKeEK?=J>UcAlYckA7Sl+I&IN=yasrZOkejir*kE@SN`fk<8Fgx*$ zy&fE6?}G)d_N`){P~U@1jRVA|2*69)KSe_}!~?+`Yb{Y=O~_+@!j<&oVQQMnhoIRU zA0CyF1OFfkK44n*JD~!2!SCPM;PRSk%1XL=0&rz00wxPs&-_eapJy#$h!eqY%nS0{ z!aGg58JIJPF3_ci%n)QSVpa2H`vIe$RD43;#IRfDV&Ibit z+?>HW4{2wOfC6Fw)}4x}i1maDxcE1qi@BS*qcxD2gE@h3#4cgU*D-&3z7D|tVZWt= z-Cy2+*Cm@P4GN_TPUtaVyVesbVDazF@)j8VJ4>XZv!f%}&eO1SvIgr}4`A*3#vat< z_MoByL(qW6L7SFZ#|Gc1fFN)L2PxY+{B8tJp+pxRyz*87)vXR}*=&ahXjBlQKguuf zX6x<<6fQulE^C*KH8~W%ptpaC0l?b=_{~*U4?5Vt;dgM4t_{&UZ1C2j?b>b+5}{IF_CUyvz-@QZPMlJ)r_tS$9kH%RPv#2_nMb zRLj5;chJ72*U`Z@Dqt4$@_+k$%|8m(HqLG!qT4P^DdfvGf&){gKnGCX#H0!;W=AGP zbA&Z`-__a)VTS}kKFjWGk z%|>yE?t*EJ!qeQ%dPk$;xIQ+P0;()PCBDgjJm6Buj{f^awNoVx+9<|lg3%-$G(*f) zll6oOkN|yamn1uyl2*N-lnqRI1cvs_JxLTeahEK=THV$Sz*gQhKNb*p0fNoda#-&F zB-qJgW^g}!TtM|0bS2QZekW7_tKu%GcJ!4?lObt0z_$mZ4rbQ0o=^curCs3bJK6sq z9fu-aW-l#>z~ca(B;4yv;2RZ?tGYAU)^)Kz{L|4oPj zdOf_?de|#yS)p2v8-N||+XL=O*%3+y)oI(HbM)Ds?q8~HPzIP(vs*G`iddbWq}! z(2!VjP&{Z1w+%eUq^ '} + case $link in #( + /*) app_path=$link ;; #( + *) app_path=$APP_HOME$link ;; + esac +done + +APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit + +APP_NAME="Gradle" +APP_BASE_NAME=${0##*/} + +# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' + +# Use the maximum available, or set MAX_FD != -1 to use that value. +MAX_FD=maximum + +warn () { + echo "$*" +} >&2 + +die () { + echo + echo "$*" + echo + exit 1 +} >&2 + +# OS specific support (must be 'true' or 'false'). +cygwin=false +msys=false +darwin=false +nonstop=false +case "$( uname )" in #( + CYGWIN* ) cygwin=true ;; #( + Darwin* ) darwin=true ;; #( + MSYS* | MINGW* ) msys=true ;; #( + NONSTOP* ) nonstop=true ;; +esac + +CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar + + +# Determine the Java command to use to start the JVM. +if [ -n "$JAVA_HOME" ] ; then + if [ -x "$JAVA_HOME/jre/sh/java" ] ; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD=$JAVA_HOME/jre/sh/java + else + JAVACMD=$JAVA_HOME/bin/java + fi + if [ ! -x "$JAVACMD" ] ; then + die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +else + JAVACMD=java + which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." +fi + +# Increase the maximum file descriptors if we can. +if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then + case $MAX_FD in #( + max*) + MAX_FD=$( ulimit -H -n ) || + warn "Could not query maximum file descriptor limit" + esac + case $MAX_FD in #( + '' | soft) :;; #( + *) + ulimit -n "$MAX_FD" || + warn "Could not set maximum file descriptor limit to $MAX_FD" + esac +fi + +# Collect all arguments for the java command, stacking in reverse order: +# * args from the command line +# * the main class name +# * -classpath +# * -D...appname settings +# * --module-path (only if needed) +# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables. + +# For Cygwin or MSYS, switch paths to Windows format before running java +if "$cygwin" || "$msys" ; then + APP_HOME=$( cygpath --path --mixed "$APP_HOME" ) + CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" ) + + JAVACMD=$( cygpath --unix "$JAVACMD" ) + + # Now convert the arguments - kludge to limit ourselves to /bin/sh + for arg do + if + case $arg in #( + -*) false ;; # don't mess with options #( + /?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath + [ -e "$t" ] ;; #( + *) false ;; + esac + then + arg=$( cygpath --path --ignore --mixed "$arg" ) + fi + # Roll the args list around exactly as many times as the number of + # args, so each arg winds up back in the position where it started, but + # possibly modified. + # + # NB: a `for` loop captures its iteration list before it begins, so + # changing the positional parameters here affects neither the number of + # iterations, nor the values presented in `arg`. + shift # remove old arg + set -- "$@" "$arg" # push replacement arg + done +fi + +# Collect all arguments for the java command; +# * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of +# shell script including quotes and variable substitutions, so put them in +# double quotes to make sure that they get re-expanded; and +# * put everything else in single quotes, so that it's not re-expanded. + +set -- \ + "-Dorg.gradle.appname=$APP_BASE_NAME" \ + -classpath "$CLASSPATH" \ + org.gradle.wrapper.GradleWrapperMain \ + "$@" + +# Use "xargs" to parse quoted args. +# +# With -n1 it outputs one arg per line, with the quotes and backslashes removed. +# +# In Bash we could simply go: +# +# readarray ARGS < <( xargs -n1 <<<"$var" ) && +# set -- "${ARGS[@]}" "$@" +# +# but POSIX shell has neither arrays nor command substitution, so instead we +# post-process each arg (as a line of input to sed) to backslash-escape any +# character that might be a shell metacharacter, then use eval to reverse +# that process (while maintaining the separation between arguments), and wrap +# the whole thing up as a single "set" statement. +# +# This will of course break if any of these variables contains a newline or +# an unmatched quote. +# + +eval "set -- $( + printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" | + xargs -n1 | + sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' | + tr '\n' ' ' + )" '"$@"' + +exec "$JAVACMD" "$@" diff --git a/temporal-workflowcheck/samples/gradle-multi-project/gradlew.bat b/temporal-workflowcheck/samples/gradle-multi-project/gradlew.bat new file mode 100644 index 0000000000..107acd32c4 --- /dev/null +++ b/temporal-workflowcheck/samples/gradle-multi-project/gradlew.bat @@ -0,0 +1,89 @@ +@rem +@rem Copyright 2015 the original author or authors. +@rem +@rem Licensed under the Apache License, Version 2.0 (the "License"); +@rem you may not use this file except in compliance with the License. +@rem You may obtain a copy of the License at +@rem +@rem https://www.apache.org/licenses/LICENSE-2.0 +@rem +@rem Unless required by applicable law or agreed to in writing, software +@rem distributed under the License is distributed on an "AS IS" BASIS, +@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +@rem See the License for the specific language governing permissions and +@rem limitations under the License. +@rem + +@if "%DEBUG%" == "" @echo off +@rem ########################################################################## +@rem +@rem Gradle startup script for Windows +@rem +@rem ########################################################################## + +@rem Set local scope for the variables with windows NT shell +if "%OS%"=="Windows_NT" setlocal + +set DIRNAME=%~dp0 +if "%DIRNAME%" == "" set DIRNAME=. +set APP_BASE_NAME=%~n0 +set APP_HOME=%DIRNAME% + +@rem Resolve any "." and ".." in APP_HOME to make it shorter. +for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi + +@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" + +@rem Find java.exe +if defined JAVA_HOME goto findJavaFromJavaHome + +set JAVA_EXE=java.exe +%JAVA_EXE% -version >NUL 2>&1 +if "%ERRORLEVEL%" == "0" goto execute + +echo. +echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:findJavaFromJavaHome +set JAVA_HOME=%JAVA_HOME:"=% +set JAVA_EXE=%JAVA_HOME%/bin/java.exe + +if exist "%JAVA_EXE%" goto execute + +echo. +echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:execute +@rem Setup the command line + +set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar + + +@rem Execute Gradle +"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* + +:end +@rem End local scope for the variables with windows NT shell +if "%ERRORLEVEL%"=="0" goto mainEnd + +:fail +rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of +rem the _cmd.exe /c_ return code! +if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 +exit /b 1 + +:mainEnd +if "%OS%"=="Windows_NT" endlocal + +:omega diff --git a/temporal-workflowcheck/samples/gradle-multi-project/project-app/build.gradle b/temporal-workflowcheck/samples/gradle-multi-project/project-app/build.gradle new file mode 100644 index 0000000000..c9b8e15cd0 --- /dev/null +++ b/temporal-workflowcheck/samples/gradle-multi-project/project-app/build.gradle @@ -0,0 +1,43 @@ +plugins { + id 'application' +} + +group = 'io.temporal' +version = '1.0-SNAPSHOT' + +application { + mainClass = 'io.temporal.workflowcheck.sample.gradlemulti.app.App' +} + +dependencies { + implementation project(':project-workflows') + implementation 'io.temporal:temporal-sdk:1.22.3' +} + +// *** workflowcheck config *** + +// Create a configuration for workflowcheck dependency +configurations { + workflowcheckDependency +} + +// Set the dependency +dependencies { + // May want to add :all to the end of the dependency to get the shaded form + workflowcheckDependency 'io.temporal:temporal-workflowcheck:+' +} + +// Create the workflowcheck task +tasks.register('workflowcheck', JavaExec) { + // Set the classpath to the workflowcheck dependency + classpath = configurations.workflowcheckDependency + // Java 17+ is required for workflowcheck + javaLauncher = javaToolchains.launcherFor { + languageVersion = JavaLanguageVersion.of(17) + } + // The argument to workflowcheck is the classpath + mainClass = 'io.temporal.workflowcheck.Main' + args = ['check', sourceSets.main.runtimeClasspath.files.join(File.pathSeparator)] +} + +check.finalizedBy workflowcheck \ No newline at end of file diff --git a/temporal-workflowcheck/samples/gradle-multi-project/project-app/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/app/App.java b/temporal-workflowcheck/samples/gradle-multi-project/project-app/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/app/App.java new file mode 100644 index 0000000000..4b2c887090 --- /dev/null +++ b/temporal-workflowcheck/samples/gradle-multi-project/project-app/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/app/App.java @@ -0,0 +1,9 @@ +package io.temporal.workflowcheck.sample.gradlemulti.app; + +import io.temporal.workflowcheck.sample.gradlemulti.workflows.MyWorkflow; + +public class App { + public static void main(String[] args) { + System.out.println("Workflow class: " + MyWorkflow.class); + } +} \ No newline at end of file diff --git a/temporal-workflowcheck/samples/gradle-multi-project/project-app/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/app/MyWorkflowImpl.java b/temporal-workflowcheck/samples/gradle-multi-project/project-app/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/app/MyWorkflowImpl.java new file mode 100644 index 0000000000..a3dac4392c --- /dev/null +++ b/temporal-workflowcheck/samples/gradle-multi-project/project-app/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/app/MyWorkflowImpl.java @@ -0,0 +1,15 @@ +package io.temporal.workflowcheck.sample.gradlemulti.app; + +import java.time.LocalTime; +import io.temporal.failure.ApplicationFailure; +import io.temporal.workflowcheck.sample.gradlemulti.workflows.MyWorkflow; + +public class MyWorkflowImpl implements MyWorkflow { + @Override + public void errorAtNight() { + // Let's throw an application exception only after 8 PM local time + if (LocalTime.now().getHour() >= 20) { + throw ApplicationFailure.newFailure("Can't call this workflow after 8PM", "time-error"); + } + } +} diff --git a/temporal-workflowcheck/samples/gradle-multi-project/project-workflows/build.gradle b/temporal-workflowcheck/samples/gradle-multi-project/project-workflows/build.gradle new file mode 100644 index 0000000000..b4f95db60d --- /dev/null +++ b/temporal-workflowcheck/samples/gradle-multi-project/project-workflows/build.gradle @@ -0,0 +1,14 @@ +plugins { + id 'java' +} + +group = 'io.temporal' +version = '1.0-SNAPSHOT' + +repositories { + mavenCentral() +} + +dependencies { + implementation 'io.temporal:temporal-sdk:1.22.3' +} diff --git a/temporal-workflowcheck/samples/gradle-multi-project/project-workflows/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/workflows/MyWorkflow.java b/temporal-workflowcheck/samples/gradle-multi-project/project-workflows/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/workflows/MyWorkflow.java new file mode 100644 index 0000000000..d702c056de --- /dev/null +++ b/temporal-workflowcheck/samples/gradle-multi-project/project-workflows/src/main/java/io/temporal/workflowcheck/sample/gradlemulti/workflows/MyWorkflow.java @@ -0,0 +1,10 @@ +package io.temporal.workflowcheck.sample.gradlemulti.workflows; + +import io.temporal.workflow.WorkflowInterface; +import io.temporal.workflow.WorkflowMethod; + +@WorkflowInterface +public interface MyWorkflow { + @WorkflowMethod + void errorAtNight(); +} diff --git a/temporal-workflowcheck/samples/gradle-multi-project/settings.gradle b/temporal-workflowcheck/samples/gradle-multi-project/settings.gradle new file mode 100644 index 0000000000..ecc40db2a4 --- /dev/null +++ b/temporal-workflowcheck/samples/gradle-multi-project/settings.gradle @@ -0,0 +1,6 @@ +rootProject.name = 'temporal-workflowcheck-samples-gradle-multi-project' +include 'project-app', 'project-workflows' + +// Add the workflowcheck project as a composite build. We are only doing this +// for the sample, normally this is not needed. +includeBuild '../../../' \ No newline at end of file diff --git a/temporal-workflowcheck/samples/gradle/README.md b/temporal-workflowcheck/samples/gradle/README.md new file mode 100644 index 0000000000..f9888ebd3e --- /dev/null +++ b/temporal-workflowcheck/samples/gradle/README.md @@ -0,0 +1,18 @@ +# Temporal Workflow Check for Java - Gradle Sample + +This sample shows how to incorporate `workflowcheck` into a Gradle build. Currently there are no published releases, so +this example includes the primary build in the [settings.gradle](settings.gradle) file. But users may just want to +reference a published JAR when it is available. + +To run: + + gradlew check + +This will output something like: + +``` +Analyzing classpath for classes with workflow methods... +Found 1 class(es) with workflow methods +Workflow method io.temporal.workflowcheck.sample.gradle.MyWorkflowImpl.errorAtNight() (declared on io.temporal.workflowcheck.sample.gradle.MyWorkflow) has 1 invalid member access: + MyWorkflowImpl.java:10 invokes java.time.LocalTime.now() which is configured as invalid +``` \ No newline at end of file diff --git a/temporal-workflowcheck/samples/gradle/build.gradle b/temporal-workflowcheck/samples/gradle/build.gradle new file mode 100644 index 0000000000..8a02669e5a --- /dev/null +++ b/temporal-workflowcheck/samples/gradle/build.gradle @@ -0,0 +1,42 @@ +plugins { + id 'java' +} + +group = 'io.temporal' +version = '1.0-SNAPSHOT' + +repositories { + mavenCentral() +} + +dependencies { + implementation 'io.temporal:temporal-sdk:1.22.3' +} + +// *** workflowcheck config *** + +// Create a configuration for workflowcheck dependency +configurations { + workflowcheckDependency +} + +// Set the dependency +dependencies { + // May want to add :all to the end of the dependency to get the shaded form + workflowcheckDependency 'io.temporal:temporal-workflowcheck:+' +} + +// Create the workflowcheck task +tasks.register('workflowcheck', JavaExec) { + // Set the classpath to the workflowcheck dependency + classpath = configurations.workflowcheckDependency + // // Java 17+ is required for workflowcheck + // javaLauncher = javaToolchains.launcherFor { + // languageVersion = JavaLanguageVersion.of(17) + // } + // The argument to workflowcheck is the classpath + mainClass = 'io.temporal.workflowcheck.Main' + args = ['check', sourceSets.main.runtimeClasspath.files.join(File.pathSeparator)] +} + +check.finalizedBy workflowcheck \ No newline at end of file diff --git a/temporal-workflowcheck/samples/gradle/gradle/wrapper/gradle-wrapper.jar b/temporal-workflowcheck/samples/gradle/gradle/wrapper/gradle-wrapper.jar new file mode 100644 index 0000000000000000000000000000000000000000..249e5832f090a2944b7473328c07c9755baa3196 GIT binary patch literal 60756 zcmb5WV{~QRw(p$^Dz@00IL3?^hro$gg*4VI_WAaTyVM5Foj~O|-84 z$;06hMwt*rV;^8iB z1~&0XWpYJmG?Ts^K9PC62H*`G}xom%S%yq|xvG~FIfP=9*f zZoDRJBm*Y0aId=qJ?7dyb)6)JGWGwe)MHeNSzhi)Ko6J<-m@v=a%NsP537lHe0R* z`If4$aaBA#S=w!2z&m>{lpTy^Lm^mg*3?M&7HFv}7K6x*cukLIGX;bQG|QWdn{%_6 zHnwBKr84#B7Z+AnBXa16a?or^R?+>$4`}{*a_>IhbjvyTtWkHw)|ay)ahWUd-qq$~ zMbh6roVsj;_qnC-R{G+Cy6bApVOinSU-;(DxUEl!i2)1EeQ9`hrfqj(nKI7?Z>Xur zoJz-a`PxkYit1HEbv|jy%~DO^13J-ut986EEG=66S}D3!L}Efp;Bez~7tNq{QsUMm zh9~(HYg1pA*=37C0}n4g&bFbQ+?-h-W}onYeE{q;cIy%eZK9wZjSwGvT+&Cgv z?~{9p(;bY_1+k|wkt_|N!@J~aoY@|U_RGoWX<;p{Nu*D*&_phw`8jYkMNpRTWx1H* z>J-Mi_!`M468#5Aix$$u1M@rJEIOc?k^QBc?T(#=n&*5eS#u*Y)?L8Ha$9wRWdH^3D4|Ps)Y?m0q~SiKiSfEkJ!=^`lJ(%W3o|CZ zSrZL-Xxc{OrmsQD&s~zPfNJOpSZUl%V8tdG%ei}lQkM+z@-4etFPR>GOH9+Y_F<3=~SXln9Kb-o~f>2a6Xz@AS3cn^;c_>lUwlK(n>z?A>NbC z`Ud8^aQy>wy=$)w;JZzA)_*Y$Z5hU=KAG&htLw1Uh00yE!|Nu{EZkch zY9O6x7Y??>!7pUNME*d!=R#s)ghr|R#41l!c?~=3CS8&zr6*aA7n9*)*PWBV2w+&I zpW1-9fr3j{VTcls1>ua}F*bbju_Xq%^v;-W~paSqlf zolj*dt`BBjHI)H9{zrkBo=B%>8}4jeBO~kWqO!~Thi!I1H(in=n^fS%nuL=X2+s!p}HfTU#NBGiwEBF^^tKU zbhhv+0dE-sbK$>J#t-J!B$TMgN@Wh5wTtK2BG}4BGfsZOoRUS#G8Cxv|6EI*n&Xxq zt{&OxCC+BNqz$9b0WM7_PyBJEVObHFh%%`~!@MNZlo*oXDCwDcFwT~Rls!aApL<)^ zbBftGKKBRhB!{?fX@l2_y~%ygNFfF(XJzHh#?`WlSL{1lKT*gJM zs>bd^H9NCxqxn(IOky5k-wALFowQr(gw%|`0991u#9jXQh?4l|l>pd6a&rx|v=fPJ z1mutj{YzpJ_gsClbWFk(G}bSlFi-6@mwoQh-XeD*j@~huW4(8ub%^I|azA)h2t#yG z7e_V_<4jlM3D(I+qX}yEtqj)cpzN*oCdYHa!nm%0t^wHm)EmFP*|FMw!tb@&`G-u~ zK)=Sf6z+BiTAI}}i{*_Ac$ffr*Wrv$F7_0gJkjx;@)XjYSh`RjAgrCck`x!zP>Ifu z&%he4P|S)H*(9oB4uvH67^0}I-_ye_!w)u3v2+EY>eD3#8QR24<;7?*hj8k~rS)~7 zSXs5ww)T(0eHSp$hEIBnW|Iun<_i`}VE0Nc$|-R}wlSIs5pV{g_Dar(Zz<4X3`W?K z6&CAIl4U(Qk-tTcK{|zYF6QG5ArrEB!;5s?tW7 zrE3hcFY&k)+)e{+YOJ0X2uDE_hd2{|m_dC}kgEKqiE9Q^A-+>2UonB+L@v3$9?AYw zVQv?X*pK;X4Ovc6Ev5Gbg{{Eu*7{N3#0@9oMI~}KnObQE#Y{&3mM4`w%wN+xrKYgD zB-ay0Q}m{QI;iY`s1Z^NqIkjrTlf`B)B#MajZ#9u41oRBC1oM1vq0i|F59> z#StM@bHt|#`2)cpl_rWB($DNJ3Lap}QM-+A$3pe}NyP(@+i1>o^fe-oxX#Bt`mcQc zb?pD4W%#ep|3%CHAYnr*^M6Czg>~L4?l16H1OozM{P*en298b+`i4$|w$|4AHbzqB zHpYUsHZET$Z0ztC;U+0*+amF!@PI%^oUIZy{`L{%O^i{Xk}X0&nl)n~tVEpcAJSJ} zverw15zP1P-O8h9nd!&hj$zuwjg?DoxYIw{jWM zW5_pj+wFy8Tsa9g<7Qa21WaV&;ejoYflRKcz?#fSH_)@*QVlN2l4(QNk| z4aPnv&mrS&0|6NHq05XQw$J^RR9T{3SOcMKCXIR1iSf+xJ0E_Wv?jEc*I#ZPzyJN2 zUG0UOXHl+PikM*&g$U@g+KbG-RY>uaIl&DEtw_Q=FYq?etc!;hEC_}UX{eyh%dw2V zTTSlap&5>PY{6I#(6`j-9`D&I#|YPP8a;(sOzgeKDWsLa!i-$frD>zr-oid!Hf&yS z!i^cr&7tN}OOGmX2)`8k?Tn!!4=tz~3hCTq_9CdiV!NIblUDxHh(FJ$zs)B2(t5@u z-`^RA1ShrLCkg0)OhfoM;4Z{&oZmAec$qV@ zGQ(7(!CBk<5;Ar%DLJ0p0!ResC#U<+3i<|vib1?{5gCebG7$F7URKZXuX-2WgF>YJ^i zMhHDBsh9PDU8dlZ$yJKtc6JA#y!y$57%sE>4Nt+wF1lfNIWyA`=hF=9Gj%sRwi@vd z%2eVV3y&dvAgyuJ=eNJR+*080dbO_t@BFJO<@&#yqTK&+xc|FRR;p;KVk@J3$S{p` zGaMj6isho#%m)?pOG^G0mzOAw0z?!AEMsv=0T>WWcE>??WS=fII$t$(^PDPMU(P>o z_*0s^W#|x)%tx8jIgZY~A2yG;US0m2ZOQt6yJqW@XNY_>_R7(Nxb8Ged6BdYW6{prd!|zuX$@Q2o6Ona8zzYC1u!+2!Y$Jc9a;wy+pXt}o6~Bu1oF1c zp7Y|SBTNi@=I(K%A60PMjM#sfH$y*c{xUgeSpi#HB`?|`!Tb&-qJ3;vxS!TIzuTZs-&%#bAkAyw9m4PJgvey zM5?up*b}eDEY+#@tKec)-c(#QF0P?MRlD1+7%Yk*jW;)`f;0a-ZJ6CQA?E%>i2Dt7T9?s|9ZF|KP4;CNWvaVKZ+Qeut;Jith_y{v*Ny6Co6!8MZx;Wgo z=qAi%&S;8J{iyD&>3CLCQdTX*$+Rx1AwA*D_J^0>suTgBMBb=*hefV+Ars#mmr+YsI3#!F@Xc1t4F-gB@6aoyT+5O(qMz*zG<9Qq*f0w^V!03rpr*-WLH}; zfM{xSPJeu6D(%8HU%0GEa%waFHE$G?FH^kMS-&I3)ycx|iv{T6Wx}9$$D&6{%1N_8 z_CLw)_9+O4&u94##vI9b-HHm_95m)fa??q07`DniVjAy`t7;)4NpeyAY(aAk(+T_O z1om+b5K2g_B&b2DCTK<>SE$Ode1DopAi)xaJjU>**AJK3hZrnhEQ9E`2=|HHe<^tv z63e(bn#fMWuz>4erc47}!J>U58%<&N<6AOAewyzNTqi7hJc|X{782&cM zHZYclNbBwU6673=!ClmxMfkC$(CykGR@10F!zN1Se83LR&a~$Ht&>~43OX22mt7tcZUpa;9@q}KDX3O&Ugp6< zLZLfIMO5;pTee1vNyVC$FGxzK2f>0Z-6hM82zKg44nWo|n}$Zk6&;5ry3`(JFEX$q zK&KivAe${e^5ZGc3a9hOt|!UOE&OocpVryE$Y4sPcs4rJ>>Kbi2_subQ9($2VN(3o zb~tEzMsHaBmBtaHAyES+d3A(qURgiskSSwUc9CfJ@99&MKp2sooSYZu+-0t0+L*!I zYagjOlPgx|lep9tiU%ts&McF6b0VE57%E0Ho%2oi?=Ks+5%aj#au^OBwNwhec zta6QAeQI^V!dF1C)>RHAmB`HnxyqWx?td@4sd15zPd*Fc9hpDXP23kbBenBxGeD$k z;%0VBQEJ-C)&dTAw_yW@k0u?IUk*NrkJ)(XEeI z9Y>6Vel>#s_v@=@0<{4A{pl=9cQ&Iah0iD0H`q)7NeCIRz8zx;! z^OO;1+IqoQNak&pV`qKW+K0^Hqp!~gSohcyS)?^P`JNZXw@gc6{A3OLZ?@1Uc^I2v z+X!^R*HCm3{7JPq{8*Tn>5;B|X7n4QQ0Bs79uTU%nbqOJh`nX(BVj!#f;#J+WZxx4 z_yM&1Y`2XzhfqkIMO7tB3raJKQS+H5F%o83bM+hxbQ zeeJm=Dvix$2j|b4?mDacb67v-1^lTp${z=jc1=j~QD>7c*@+1?py>%Kj%Ejp7Y-!? z8iYRUlGVrQPandAaxFfks53@2EC#0)%mrnmGRn&>=$H$S8q|kE_iWko4`^vCS2aWg z#!`RHUGyOt*k?bBYu3*j3u0gB#v(3tsije zgIuNNWNtrOkx@Pzs;A9un+2LX!zw+p3_NX^Sh09HZAf>m8l@O*rXy_82aWT$Q>iyy zqO7Of)D=wcSn!0+467&!Hl))eff=$aneB?R!YykdKW@k^_uR!+Q1tR)+IJb`-6=jj zymzA>Sv4>Z&g&WWu#|~GcP7qP&m*w-S$)7Xr;(duqCTe7p8H3k5>Y-n8438+%^9~K z3r^LIT_K{i7DgEJjIocw_6d0!<;wKT`X;&vv+&msmhAAnIe!OTdybPctzcEzBy88_ zWO{6i4YT%e4^WQZB)KHCvA(0tS zHu_Bg+6Ko%a9~$EjRB90`P(2~6uI@SFibxct{H#o&y40MdiXblu@VFXbhz>Nko;7R z70Ntmm-FePqhb%9gL+7U8@(ch|JfH5Fm)5${8|`Lef>LttM_iww6LW2X61ldBmG0z zax3y)njFe>j*T{i0s8D4=L>X^j0)({R5lMGVS#7(2C9@AxL&C-lZQx~czI7Iv+{%1 z2hEG>RzX4S8x3v#9sgGAnPzptM)g&LB}@%E>fy0vGSa(&q0ch|=ncKjNrK z`jA~jObJhrJ^ri|-)J^HUyeZXz~XkBp$VhcTEcTdc#a2EUOGVX?@mYx#Vy*!qO$Jv zQ4rgOJ~M*o-_Wptam=~krnmG*p^j!JAqoQ%+YsDFW7Cc9M%YPiBOrVcD^RY>m9Pd< zu}#9M?K{+;UIO!D9qOpq9yxUquQRmQNMo0pT`@$pVt=rMvyX)ph(-CCJLvUJy71DI zBk7oc7)-%ngdj~s@76Yse3L^gV0 z2==qfp&Q~L(+%RHP0n}+xH#k(hPRx(!AdBM$JCfJ5*C=K3ts>P?@@SZ_+{U2qFZb>4kZ{Go37{# zSQc+-dq*a-Vy4?taS&{Ht|MLRiS)Sn14JOONyXqPNnpq&2y~)6wEG0oNy>qvod$FF z`9o&?&6uZjhZ4_*5qWVrEfu(>_n2Xi2{@Gz9MZ8!YmjYvIMasE9yVQL10NBrTCczq zcTY1q^PF2l!Eraguf{+PtHV3=2A?Cu&NN&a8V(y;q(^_mFc6)%Yfn&X&~Pq zU1?qCj^LF(EQB1F`8NxNjyV%fde}dEa(Hx=r7$~ts2dzDwyi6ByBAIx$NllB4%K=O z$AHz1<2bTUb>(MCVPpK(E9wlLElo(aSd(Os)^Raum`d(g9Vd_+Bf&V;l=@mM=cC>) z)9b0enb)u_7V!!E_bl>u5nf&Rl|2r=2F3rHMdb7y9E}}F82^$Rf+P8%dKnOeKh1vs zhH^P*4Ydr^$)$h@4KVzxrHyy#cKmWEa9P5DJ|- zG;!Qi35Tp7XNj60=$!S6U#!(${6hyh7d4q=pF{`0t|N^|L^d8pD{O9@tF~W;#Je*P z&ah%W!KOIN;SyAEhAeTafJ4uEL`(RtnovM+cb(O#>xQnk?dzAjG^~4$dFn^<@-Na3 z395;wBnS{t*H;Jef2eE!2}u5Ns{AHj>WYZDgQJt8v%x?9{MXqJsGP|l%OiZqQ1aB! z%E=*Ig`(!tHh>}4_z5IMpg{49UvD*Pp9!pxt_gdAW%sIf3k6CTycOT1McPl=_#0?8 zVjz8Hj*Vy9c5-krd-{BQ{6Xy|P$6LJvMuX$* zA+@I_66_ET5l2&gk9n4$1M3LN8(yEViRx&mtd#LD}AqEs?RW=xKC(OCWH;~>(X6h!uDxXIPH06xh z*`F4cVlbDP`A)-fzf>MuScYsmq&1LUMGaQ3bRm6i7OsJ|%uhTDT zlvZA1M}nz*SalJWNT|`dBm1$xlaA>CCiQ zK`xD-RuEn>-`Z?M{1%@wewf#8?F|(@1e0+T4>nmlSRrNK5f)BJ2H*$q(H>zGD0>eL zQ!tl_Wk)k*e6v^m*{~A;@6+JGeWU-q9>?+L_#UNT%G?4&BnOgvm9@o7l?ov~XL+et zbGT)|G7)KAeqb=wHSPk+J1bdg7N3$vp(ekjI1D9V$G5Cj!=R2w=3*4!z*J-r-cyeb zd(i2KmX!|Lhey!snRw z?#$Gu%S^SQEKt&kep)up#j&9}e+3=JJBS(s>MH+|=R(`8xK{mmndWo_r`-w1#SeRD&YtAJ#GiVI*TkQZ}&aq<+bU2+coU3!jCI6E+Ad_xFW*ghnZ$q zAoF*i&3n1j#?B8x;kjSJD${1jdRB;)R*)Ao!9bd|C7{;iqDo|T&>KSh6*hCD!rwv= zyK#F@2+cv3=|S1Kef(E6Niv8kyLVLX&e=U;{0x{$tDfShqkjUME>f8d(5nzSkY6@! z^-0>DM)wa&%m#UF1F?zR`8Y3X#tA!*7Q$P3lZJ%*KNlrk_uaPkxw~ zxZ1qlE;Zo;nb@!SMazSjM>;34ROOoygo%SF);LL>rRonWwR>bmSd1XD^~sGSu$Gg# zFZ`|yKU0%!v07dz^v(tY%;So(e`o{ZYTX`hm;@b0%8|H>VW`*cr8R%3n|ehw2`(9B+V72`>SY}9^8oh$En80mZK9T4abVG*to;E z1_S6bgDOW?!Oy1LwYy=w3q~KKdbNtyH#d24PFjX)KYMY93{3-mPP-H>@M-_>N~DDu zENh~reh?JBAK=TFN-SfDfT^=+{w4ea2KNWXq2Y<;?(gf(FgVp8Zp-oEjKzB%2Iqj;48GmY3h=bcdYJ}~&4tS`Q1sb=^emaW$IC$|R+r-8V- zf0$gGE(CS_n4s>oicVk)MfvVg#I>iDvf~Ov8bk}sSxluG!6#^Z_zhB&U^`eIi1@j( z^CK$z^stBHtaDDHxn+R;3u+>Lil^}fj?7eaGB z&5nl^STqcaBxI@v>%zG|j))G(rVa4aY=B@^2{TFkW~YP!8!9TG#(-nOf^^X-%m9{Z zCC?iC`G-^RcBSCuk=Z`(FaUUe?hf3{0C>>$?Vs z`2Uud9M+T&KB6o4o9kvdi^Q=Bw!asPdxbe#W-Oaa#_NP(qpyF@bVxv5D5))srkU#m zj_KA+#7sqDn*Ipf!F5Byco4HOSd!Ui$l94|IbW%Ny(s1>f4|Mv^#NfB31N~kya9!k zWCGL-$0ZQztBate^fd>R!hXY_N9ZjYp3V~4_V z#eB)Kjr8yW=+oG)BuNdZG?jaZlw+l_ma8aET(s+-x+=F-t#Qoiuu1i`^x8Sj>b^U} zs^z<()YMFP7CmjUC@M=&lA5W7t&cxTlzJAts*%PBDAPuqcV5o7HEnqjif_7xGt)F% zGx2b4w{@!tE)$p=l3&?Bf#`+!-RLOleeRk3 z7#pF|w@6_sBmn1nECqdunmG^}pr5(ZJQVvAt$6p3H(16~;vO>?sTE`Y+mq5YP&PBo zvq!7#W$Gewy`;%6o^!Dtjz~x)T}Bdk*BS#=EY=ODD&B=V6TD2z^hj1m5^d6s)D*wk zu$z~D7QuZ2b?5`p)E8e2_L38v3WE{V`bVk;6fl#o2`) z99JsWhh?$oVRn@$S#)uK&8DL8>An0&S<%V8hnGD7Z^;Y(%6;^9!7kDQ5bjR_V+~wp zfx4m3z6CWmmZ<8gDGUyg3>t8wgJ5NkkiEm^(sedCicP^&3D%}6LtIUq>mXCAt{9eF zNXL$kGcoUTf_Lhm`t;hD-SE)m=iBnxRU(NyL}f6~1uH)`K!hmYZjLI%H}AmEF5RZt z06$wn63GHnApHXZZJ}s^s)j9(BM6e*7IBK6Bq(!)d~zR#rbxK9NVIlgquoMq z=eGZ9NR!SEqP6=9UQg#@!rtbbSBUM#ynF);zKX+|!Zm}*{H z+j=d?aZ2!?@EL7C~%B?6ouCKLnO$uWn;Y6Xz zX8dSwj732u(o*U3F$F=7xwxm>E-B+SVZH;O-4XPuPkLSt_?S0)lb7EEg)Mglk0#eS z9@jl(OnH4juMxY+*r03VDfPx_IM!Lmc(5hOI;`?d37f>jPP$?9jQQIQU@i4vuG6MagEoJrQ=RD7xt@8E;c zeGV*+Pt+t$@pt!|McETOE$9k=_C!70uhwRS9X#b%ZK z%q(TIUXSS^F0`4Cx?Rk07C6wI4!UVPeI~-fxY6`YH$kABdOuiRtl73MqG|~AzZ@iL&^s?24iS;RK_pdlWkhcF z@Wv-Om(Aealfg)D^adlXh9Nvf~Uf@y;g3Y)i(YP zEXDnb1V}1pJT5ZWyw=1i+0fni9yINurD=EqH^ciOwLUGi)C%Da)tyt=zq2P7pV5-G zR7!oq28-Fgn5pW|nlu^b!S1Z#r7!Wtr{5J5PQ>pd+2P7RSD?>(U7-|Y z7ZQ5lhYIl_IF<9?T9^IPK<(Hp;l5bl5tF9>X-zG14_7PfsA>6<$~A338iYRT{a@r_ zuXBaT=`T5x3=s&3=RYx6NgG>No4?5KFBVjE(swfcivcIpPQFx5l+O;fiGsOrl5teR z_Cm+;PW}O0Dwe_(4Z@XZ)O0W-v2X><&L*<~*q3dg;bQW3g7)a#3KiQP>+qj|qo*Hk z?57>f2?f@`=Fj^nkDKeRkN2d$Z@2eNKpHo}ksj-$`QKb6n?*$^*%Fb3_Kbf1(*W9K>{L$mud2WHJ=j0^=g30Xhg8$#g^?36`p1fm;;1@0Lrx+8t`?vN0ZorM zSW?rhjCE8$C|@p^sXdx z|NOHHg+fL;HIlqyLp~SSdIF`TnSHehNCU9t89yr@)FY<~hu+X`tjg(aSVae$wDG*C zq$nY(Y494R)hD!i1|IIyP*&PD_c2FPgeY)&mX1qujB1VHPG9`yFQpLFVQ0>EKS@Bp zAfP5`C(sWGLI?AC{XEjLKR4FVNw(4+9b?kba95ukgR1H?w<8F7)G+6&(zUhIE5Ef% z=fFkL3QKA~M@h{nzjRq!Y_t!%U66#L8!(2-GgFxkD1=JRRqk=n%G(yHKn%^&$dW>; zSjAcjETMz1%205se$iH_)ZCpfg_LwvnsZQAUCS#^FExp8O4CrJb6>JquNV@qPq~3A zZ<6dOU#6|8+fcgiA#~MDmcpIEaUO02L5#T$HV0$EMD94HT_eXLZ2Zi&(! z&5E>%&|FZ`)CN10tM%tLSPD*~r#--K(H-CZqIOb99_;m|D5wdgJ<1iOJz@h2Zkq?} z%8_KXb&hf=2Wza(Wgc;3v3TN*;HTU*q2?#z&tLn_U0Nt!y>Oo>+2T)He6%XuP;fgn z-G!#h$Y2`9>Jtf}hbVrm6D70|ERzLAU>3zoWhJmjWfgM^))T+2u$~5>HF9jQDkrXR z=IzX36)V75PrFjkQ%TO+iqKGCQ-DDXbaE;C#}!-CoWQx&v*vHfyI>$HNRbpvm<`O( zlx9NBWD6_e&J%Ous4yp~s6)Ghni!I6)0W;9(9$y1wWu`$gs<$9Mcf$L*piP zPR0Av*2%ul`W;?-1_-5Zy0~}?`e@Y5A&0H!^ApyVTT}BiOm4GeFo$_oPlDEyeGBbh z1h3q&Dx~GmUS|3@4V36&$2uO8!Yp&^pD7J5&TN{?xphf*-js1fP?B|`>p_K>lh{ij zP(?H%e}AIP?_i^f&Li=FDSQ`2_NWxL+BB=nQr=$ zHojMlXNGauvvwPU>ZLq!`bX-5F4jBJ&So{kE5+ms9UEYD{66!|k~3vsP+mE}x!>%P za98bAU0!h0&ka4EoiDvBM#CP#dRNdXJcb*(%=<(g+M@<)DZ!@v1V>;54En?igcHR2 zhubQMq}VSOK)onqHfczM7YA@s=9*ow;k;8)&?J3@0JiGcP! zP#00KZ1t)GyZeRJ=f0^gc+58lc4Qh*S7RqPIC6GugG1gXe$LIQMRCo8cHf^qXgAa2 z`}t>u2Cq1CbSEpLr~E=c7~=Qkc9-vLE%(v9N*&HF`(d~(0`iukl5aQ9u4rUvc8%m) zr2GwZN4!s;{SB87lJB;veebPmqE}tSpT>+`t?<457Q9iV$th%i__Z1kOMAswFldD6 ztbOvO337S5o#ZZgN2G99_AVqPv!?Gmt3pzgD+Hp3QPQ`9qJ(g=kjvD+fUSS3upJn! zqoG7acIKEFRX~S}3|{EWT$kdz#zrDlJU(rPkxjws_iyLKU8+v|*oS_W*-guAb&Pj1 z35Z`3z<&Jb@2Mwz=KXucNYdY#SNO$tcVFr9KdKm|%^e-TXzs6M`PBper%ajkrIyUe zp$vVxVs9*>Vp4_1NC~Zg)WOCPmOxI1V34QlG4!aSFOH{QqSVq1^1)- z0P!Z?tT&E-ll(pwf0?=F=yOzik=@nh1Clxr9}Vij89z)ePDSCYAqw?lVI?v?+&*zH z)p$CScFI8rrwId~`}9YWPFu0cW1Sf@vRELs&cbntRU6QfPK-SO*mqu|u~}8AJ!Q$z znzu}50O=YbjwKCuSVBs6&CZR#0FTu)3{}qJJYX(>QPr4$RqWiwX3NT~;>cLn*_&1H zaKpIW)JVJ>b{uo2oq>oQt3y=zJjb%fU@wLqM{SyaC6x2snMx-}ivfU<1- znu1Lh;i$3Tf$Kh5Uk))G!D1UhE8pvx&nO~w^fG)BC&L!_hQk%^p`Kp@F{cz>80W&T ziOK=Sq3fdRu*V0=S53rcIfWFazI}Twj63CG(jOB;$*b`*#B9uEnBM`hDk*EwSRdwP8?5T?xGUKs=5N83XsR*)a4|ijz|c{4tIU+4j^A5C<#5 z*$c_d=5ml~%pGxw#?*q9N7aRwPux5EyqHVkdJO=5J>84!X6P>DS8PTTz>7C#FO?k#edkntG+fJk8ZMn?pmJSO@`x-QHq;7^h6GEXLXo1TCNhH z8ZDH{*NLAjo3WM`xeb=X{((uv3H(8&r8fJJg_uSs_%hOH%JDD?hu*2NvWGYD+j)&` zz#_1%O1wF^o5ryt?O0n;`lHbzp0wQ?rcbW(F1+h7_EZZ9{>rePvLAPVZ_R|n@;b$;UchU=0j<6k8G9QuQf@76oiE*4 zXOLQ&n3$NR#p4<5NJMVC*S);5x2)eRbaAM%VxWu9ohlT;pGEk7;002enCbQ>2r-us z3#bpXP9g|mE`65VrN`+3mC)M(eMj~~eOf)do<@l+fMiTR)XO}422*1SL{wyY(%oMpBgJagtiDf zz>O6(m;};>Hi=t8o{DVC@YigqS(Qh+ix3Rwa9aliH}a}IlOCW1@?%h_bRbq-W{KHF z%Vo?-j@{Xi@=~Lz5uZP27==UGE15|g^0gzD|3x)SCEXrx`*MP^FDLl%pOi~~Il;dc z^hrwp9sYeT7iZ)-ajKy@{a`kr0-5*_!XfBpXwEcFGJ;%kV$0Nx;apKrur zJN2J~CAv{Zjj%FolyurtW8RaFmpn&zKJWL>(0;;+q(%(Hx!GMW4AcfP0YJ*Vz!F4g z!ZhMyj$BdXL@MlF%KeInmPCt~9&A!;cRw)W!Hi@0DY(GD_f?jeV{=s=cJ6e}JktJw zQORnxxj3mBxfrH=x{`_^Z1ddDh}L#V7i}$njUFRVwOX?qOTKjfPMBO4y(WiU<)epb zvB9L=%jW#*SL|Nd_G?E*_h1^M-$PG6Pc_&QqF0O-FIOpa4)PAEPsyvB)GKasmBoEt z?_Q2~QCYGH+hW31x-B=@5_AN870vY#KB~3a*&{I=f);3Kv7q4Q7s)0)gVYx2#Iz9g(F2;=+Iy4 z6KI^8GJ6D@%tpS^8boU}zpi=+(5GfIR)35PzrbuXeL1Y1N%JK7PG|^2k3qIqHfX;G zQ}~JZ-UWx|60P5?d1e;AHx!_;#PG%d=^X(AR%i`l0jSpYOpXoKFW~7ip7|xvN;2^? zsYC9fanpO7rO=V7+KXqVc;Q5z%Bj})xHVrgoR04sA2 zl~DAwv=!(()DvH*=lyhIlU^hBkA0$e*7&fJpB0|oB7)rqGK#5##2T`@_I^|O2x4GO z;xh6ROcV<9>?e0)MI(y++$-ksV;G;Xe`lh76T#Htuia+(UrIXrf9?

L(tZ$0BqX1>24?V$S+&kLZ`AodQ4_)P#Q3*4xg8}lMV-FLwC*cN$< zt65Rf%7z41u^i=P*qO8>JqXPrinQFapR7qHAtp~&RZ85$>ob|Js;GS^y;S{XnGiBc zGa4IGvDl?x%gY`vNhv8wgZnP#UYI-w*^4YCZnxkF85@ldepk$&$#3EAhrJY0U)lR{F6sM3SONV^+$;Zx8BD&Eku3K zKNLZyBni3)pGzU0;n(X@1fX8wYGKYMpLmCu{N5-}epPDxClPFK#A@02WM3!myN%bkF z|GJ4GZ}3sL{3{qXemy+#Uk{4>Kf8v11;f8I&c76+B&AQ8udd<8gU7+BeWC`akUU~U zgXoxie>MS@rBoyY8O8Tc&8id!w+_ooxcr!1?#rc$-|SBBtH6S?)1e#P#S?jFZ8u-Bs&k`yLqW|{j+%c#A4AQ>+tj$Y z^CZajspu$F%73E68Lw5q7IVREED9r1Ijsg#@DzH>wKseye>hjsk^{n0g?3+gs@7`i zHx+-!sjLx^fS;fY!ERBU+Q zVJ!e0hJH%P)z!y%1^ZyG0>PN@5W~SV%f>}c?$H8r;Sy-ui>aruVTY=bHe}$e zi&Q4&XK!qT7-XjCrDaufT@>ieQ&4G(SShUob0Q>Gznep9fR783jGuUynAqc6$pYX; z7*O@@JW>O6lKIk0G00xsm|=*UVTQBB`u1f=6wGAj%nHK_;Aqmfa!eAykDmi-@u%6~ z;*c!pS1@V8r@IX9j&rW&d*}wpNs96O2Ute>%yt{yv>k!6zfT6pru{F1M3P z2WN1JDYqoTB#(`kE{H676QOoX`cnqHl1Yaru)>8Ky~VU{)r#{&s86Vz5X)v15ULHA zAZDb{99+s~qI6;-dQ5DBjHJP@GYTwn;Dv&9kE<0R!d z8tf1oq$kO`_sV(NHOSbMwr=To4r^X$`sBW4$gWUov|WY?xccQJN}1DOL|GEaD_!@& z15p?Pj+>7d`@LvNIu9*^hPN)pwcv|akvYYq)ks%`G>!+!pW{-iXPZsRp8 z35LR;DhseQKWYSD`%gO&k$Dj6_6q#vjWA}rZcWtQr=Xn*)kJ9kacA=esi*I<)1>w^ zO_+E>QvjP)qiSZg9M|GNeLtO2D7xT6vsj`88sd!94j^AqxFLi}@w9!Y*?nwWARE0P znuI_7A-saQ+%?MFA$gttMV-NAR^#tjl_e{R$N8t2NbOlX373>e7Ox=l=;y#;M7asp zRCz*CLnrm$esvSb5{T<$6CjY zmZ(i{Rs_<#pWW>(HPaaYj`%YqBra=Ey3R21O7vUbzOkJJO?V`4-D*u4$Me0Bx$K(lYo`JO}gnC zx`V}a7m-hLU9Xvb@K2ymioF)vj12<*^oAqRuG_4u%(ah?+go%$kOpfb`T96P+L$4> zQ#S+sA%VbH&mD1k5Ak7^^dZoC>`1L%i>ZXmooA!%GI)b+$D&ziKrb)a=-ds9xk#~& z7)3iem6I|r5+ZrTRe_W861x8JpD`DDIYZNm{$baw+$)X^Jtjnl0xlBgdnNY}x%5za zkQ8E6T<^$sKBPtL4(1zi_Rd(tVth*3Xs!ulflX+70?gb&jRTnI8l+*Aj9{|d%qLZ+ z>~V9Z;)`8-lds*Zgs~z1?Fg?Po7|FDl(Ce<*c^2=lFQ~ahwh6rqSjtM5+$GT>3WZW zj;u~w9xwAhOc<kF}~`CJ68 z?(S5vNJa;kriPlim33{N5`C{9?NWhzsna_~^|K2k4xz1`xcui*LXL-1#Y}Hi9`Oo!zQ>x-kgAX4LrPz63uZ+?uG*84@PKq-KgQlMNRwz=6Yes) zY}>YN+qP}nwr$(CZQFjUOI=-6J$2^XGvC~EZ+vrqWaOXB$k?%Suf5k=4>AveC1aJ! ziaW4IS%F$_Babi)kA8Y&u4F7E%99OPtm=vzw$$ zEz#9rvn`Iot_z-r3MtV>k)YvErZ<^Oa${`2>MYYODSr6?QZu+be-~MBjwPGdMvGd!b!elsdi4% z`37W*8+OGulab8YM?`KjJ8e+jM(tqLKSS@=jimq3)Ea2EB%88L8CaM+aG7;27b?5` z4zuUWBr)f)k2o&xg{iZ$IQkJ+SK>lpq4GEacu~eOW4yNFLU!Kgc{w4&D$4ecm0f}~ zTTzquRW@`f0}|IILl`!1P+;69g^upiPA6F{)U8)muWHzexRenBU$E^9X-uIY2%&1w z_=#5*(nmxJ9zF%styBwivi)?#KMG96-H@hD-H_&EZiRNsfk7mjBq{L%!E;Sqn!mVX*}kXhwH6eh;b42eD!*~upVG@ z#smUqz$ICm!Y8wY53gJeS|Iuard0=;k5i5Z_hSIs6tr)R4n*r*rE`>38Pw&lkv{_r!jNN=;#?WbMj|l>cU(9trCq; z%nN~r^y7!kH^GPOf3R}?dDhO=v^3BeP5hF|%4GNQYBSwz;x({21i4OQY->1G=KFyu z&6d`f2tT9Yl_Z8YACZaJ#v#-(gcyeqXMhYGXb=t>)M@fFa8tHp2x;ODX=Ap@a5I=U z0G80^$N0G4=U(>W%mrrThl0DjyQ-_I>+1Tdd_AuB3qpYAqY54upwa3}owa|x5iQ^1 zEf|iTZxKNGRpI>34EwkIQ2zHDEZ=(J@lRaOH>F|2Z%V_t56Km$PUYu^xA5#5Uj4I4RGqHD56xT%H{+P8Ag>e_3pN$4m8n>i%OyJFPNWaEnJ4McUZPa1QmOh?t8~n& z&RulPCors8wUaqMHECG=IhB(-tU2XvHP6#NrLVyKG%Ee*mQ5Ps%wW?mcnriTVRc4J`2YVM>$ixSF2Xi+Wn(RUZnV?mJ?GRdw%lhZ+t&3s7g!~g{%m&i<6 z5{ib-<==DYG93I(yhyv4jp*y3#*WNuDUf6`vTM%c&hiayf(%=x@4$kJ!W4MtYcE#1 zHM?3xw63;L%x3drtd?jot!8u3qeqctceX3m;tWetK+>~q7Be$h>n6riK(5@ujLgRS zvOym)k+VAtyV^mF)$29Y`nw&ijdg~jYpkx%*^ z8dz`C*g=I?;clyi5|!27e2AuSa$&%UyR(J3W!A=ZgHF9OuKA34I-1U~pyD!KuRkjA zbkN!?MfQOeN>DUPBxoy5IX}@vw`EEB->q!)8fRl_mqUVuRu|C@KD-;yl=yKc=ZT0% zB$fMwcC|HE*0f8+PVlWHi>M`zfsA(NQFET?LrM^pPcw`cK+Mo0%8*x8@65=CS_^$cG{GZQ#xv($7J z??R$P)nPLodI;P!IC3eEYEHh7TV@opr#*)6A-;EU2XuogHvC;;k1aI8asq7ovoP!* z?x%UoPrZjj<&&aWpsbr>J$Er-7!E(BmOyEv!-mbGQGeJm-U2J>74>o5x`1l;)+P&~ z>}f^=Rx(ZQ2bm+YE0u=ZYrAV@apyt=v1wb?R@`i_g64YyAwcOUl=C!i>=Lzb$`tjv zOO-P#A+)t-JbbotGMT}arNhJmmGl-lyUpMn=2UacVZxmiG!s!6H39@~&uVokS zG=5qWhfW-WOI9g4!R$n7!|ViL!|v3G?GN6HR0Pt_L5*>D#FEj5wM1DScz4Jv@Sxnl zB@MPPmdI{(2D?;*wd>3#tjAirmUnQoZrVv`xM3hARuJksF(Q)wd4P$88fGYOT1p6U z`AHSN!`St}}UMBT9o7i|G`r$ zrB=s$qV3d6$W9@?L!pl0lf%)xs%1ko^=QY$ty-57=55PvP(^6E7cc zGJ*>m2=;fOj?F~yBf@K@9qwX0hA803Xw+b0m}+#a(>RyR8}*Y<4b+kpp|OS+!whP( zH`v{%s>jsQI9rd$*vm)EkwOm#W_-rLTHcZRek)>AtF+~<(did)*oR1|&~1|e36d-d zgtm5cv1O0oqgWC%Et@P4Vhm}Ndl(Y#C^MD03g#PH-TFy+7!Osv1z^UWS9@%JhswEq~6kSr2DITo59+; ze=ZC}i2Q?CJ~Iyu?vn|=9iKV>4j8KbxhE4&!@SQ^dVa-gK@YfS9xT(0kpW*EDjYUkoj! zE49{7H&E}k%5(>sM4uGY)Q*&3>{aitqdNnRJkbOmD5Mp5rv-hxzOn80QsG=HJ_atI-EaP69cacR)Uvh{G5dTpYG7d zbtmRMq@Sexey)||UpnZ?;g_KMZq4IDCy5}@u!5&B^-=6yyY{}e4Hh3ee!ZWtL*s?G zxG(A!<9o!CL+q?u_utltPMk+hn?N2@?}xU0KlYg?Jco{Yf@|mSGC<(Zj^yHCvhmyx z?OxOYoxbptDK()tsJ42VzXdINAMWL$0Gcw?G(g8TMB)Khw_|v9`_ql#pRd2i*?CZl z7k1b!jQB=9-V@h%;Cnl7EKi;Y^&NhU0mWEcj8B|3L30Ku#-9389Q+(Yet0r$F=+3p z6AKOMAIi|OHyzlHZtOm73}|ntKtFaXF2Fy|M!gOh^L4^62kGUoWS1i{9gsds_GWBc zLw|TaLP64z3z9?=R2|T6Xh2W4_F*$cq>MtXMOy&=IPIJ`;!Tw?PqvI2b*U1)25^<2 zU_ZPoxg_V0tngA0J+mm?3;OYw{i2Zb4x}NedZug!>EoN3DC{1i)Z{Z4m*(y{ov2%- zk(w>+scOO}MN!exSc`TN)!B=NUX`zThWO~M*ohqq;J2hx9h9}|s#?@eR!=F{QTrq~ zTcY|>azkCe$|Q0XFUdpFT=lTcyW##i;-e{}ORB4D?t@SfqGo_cS z->?^rh$<&n9DL!CF+h?LMZRi)qju!meugvxX*&jfD!^1XB3?E?HnwHP8$;uX{Rvp# zh|)hM>XDv$ZGg=$1{+_bA~u-vXqlw6NH=nkpyWE0u}LQjF-3NhATL@9rRxMnpO%f7 z)EhZf{PF|mKIMFxnC?*78(}{Y)}iztV12}_OXffJ;ta!fcFIVjdchyHxH=t%ci`Xd zX2AUB?%?poD6Zv*&BA!6c5S#|xn~DK01#XvjT!w!;&`lDXSJT4_j$}!qSPrb37vc{ z9^NfC%QvPu@vlxaZ;mIbn-VHA6miwi8qJ~V;pTZkKqqOii<1Cs}0i?uUIss;hM4dKq^1O35y?Yp=l4i zf{M!@QHH~rJ&X~8uATV><23zZUbs-J^3}$IvV_ANLS08>k`Td7aU_S1sLsfi*C-m1 z-e#S%UGs4E!;CeBT@9}aaI)qR-6NU@kvS#0r`g&UWg?fC7|b^_HyCE!8}nyh^~o@< zpm7PDFs9yxp+byMS(JWm$NeL?DNrMCNE!I^ko-*csB+dsf4GAq{=6sfyf4wb>?v1v zmb`F*bN1KUx-`ra1+TJ37bXNP%`-Fd`vVQFTwWpX@;s(%nDQa#oWhgk#mYlY*!d>( zE&!|ySF!mIyfING+#%RDY3IBH_fW$}6~1%!G`suHub1kP@&DoAd5~7J55;5_noPI6eLf{t;@9Kf<{aO0`1WNKd?<)C-|?C?)3s z>wEq@8=I$Wc~Mt$o;g++5qR+(6wt9GI~pyrDJ%c?gPZe)owvy^J2S=+M^ z&WhIE`g;;J^xQLVeCtf7b%Dg#Z2gq9hp_%g)-%_`y*zb; zn9`f`mUPN-Ts&fFo(aNTsXPA|J!TJ{0hZp0^;MYHLOcD=r_~~^ymS8KLCSeU3;^QzJNqS z5{5rEAv#l(X?bvwxpU;2%pQftF`YFgrD1jt2^~Mt^~G>T*}A$yZc@(k9orlCGv&|1 zWWvVgiJsCAtamuAYT~nzs?TQFt<1LSEx!@e0~@yd6$b5!Zm(FpBl;(Cn>2vF?k zOm#TTjFwd2D-CyA!mqR^?#Uwm{NBemP>(pHmM}9;;8`c&+_o3#E5m)JzfwN?(f-a4 zyd%xZc^oQx3XT?vcCqCX&Qrk~nu;fxs@JUoyVoi5fqpi&bUhQ2y!Ok2pzsFR(M(|U zw3E+kH_zmTRQ9dUMZWRE%Zakiwc+lgv7Z%|YO9YxAy`y28`Aw;WU6HXBgU7fl@dnt z-fFBV)}H-gqP!1;V@Je$WcbYre|dRdp{xt!7sL3Eoa%IA`5CAA%;Wq8PktwPdULo! z8!sB}Qt8#jH9Sh}QiUtEPZ6H0b*7qEKGJ%ITZ|vH)5Q^2m<7o3#Z>AKc%z7_u`rXA zqrCy{-{8;9>dfllLu$^M5L z-hXs))h*qz%~ActwkIA(qOVBZl2v4lwbM>9l70Y`+T*elINFqt#>OaVWoja8RMsep z6Or3f=oBnA3vDbn*+HNZP?8LsH2MY)x%c13@(XfuGR}R?Nu<|07{$+Lc3$Uv^I!MQ z>6qWgd-=aG2Y^24g4{Bw9ueOR)(9h`scImD=86dD+MnSN4$6 z^U*o_mE-6Rk~Dp!ANp#5RE9n*LG(Vg`1)g6!(XtDzsov$Dvz|Gv1WU68J$CkshQhS zCrc|cdkW~UK}5NeaWj^F4MSgFM+@fJd{|LLM)}_O<{rj z+?*Lm?owq?IzC%U%9EBga~h-cJbIu=#C}XuWN>OLrc%M@Gu~kFEYUi4EC6l#PR2JS zQUkGKrrS#6H7}2l0F@S11DP`@pih0WRkRJl#F;u{c&ZC{^$Z+_*lB)r)-bPgRFE;* zl)@hK4`tEP=P=il02x7-C7p%l=B`vkYjw?YhdJU9!P!jcmY$OtC^12w?vy3<<=tlY zUwHJ_0lgWN9vf>1%WACBD{UT)1qHQSE2%z|JHvP{#INr13jM}oYv_5#xsnv9`)UAO zuwgyV4YZ;O)eSc3(mka6=aRohi!HH@I#xq7kng?Acdg7S4vDJb6cI5fw?2z%3yR+| zU5v@Hm}vy;${cBp&@D=HQ9j7NcFaOYL zj-wV=eYF{|XTkFNM2uz&T8uH~;)^Zo!=KP)EVyH6s9l1~4m}N%XzPpduPg|h-&lL` zAXspR0YMOKd2yO)eMFFJ4?sQ&!`dF&!|niH*!^*Ml##o0M(0*uK9&yzekFi$+mP9s z>W9d%Jb)PtVi&-Ha!o~Iyh@KRuKpQ@)I~L*d`{O8!kRObjO7=n+Gp36fe!66neh+7 zW*l^0tTKjLLzr`x4`_8&on?mjW-PzheTNox8Hg7Nt@*SbE-%kP2hWYmHu#Fn@Q^J(SsPUz*|EgOoZ6byg3ew88UGdZ>9B2Tq=jF72ZaR=4u%1A6Vm{O#?@dD!(#tmR;eP(Fu z{$0O%=Vmua7=Gjr8nY%>ul?w=FJ76O2js&17W_iq2*tb!i{pt#`qZB#im9Rl>?t?0c zicIC}et_4d+CpVPx)i4~$u6N-QX3H77ez z?ZdvXifFk|*F8~L(W$OWM~r`pSk5}#F?j_5u$Obu9lDWIknO^AGu+Blk7!9Sb;NjS zncZA?qtASdNtzQ>z7N871IsPAk^CC?iIL}+{K|F@BuG2>qQ;_RUYV#>hHO(HUPpk@ z(bn~4|F_jiZi}Sad;_7`#4}EmD<1EiIxa48QjUuR?rC}^HRocq`OQPM@aHVKP9E#q zy%6bmHygCpIddPjE}q_DPC`VH_2m;Eey&ZH)E6xGeStOK7H)#+9y!%-Hm|QF6w#A( zIC0Yw%9j$s-#odxG~C*^MZ?M<+&WJ+@?B_QPUyTg9DJGtQN#NIC&-XddRsf3n^AL6 zT@P|H;PvN;ZpL0iv$bRb7|J{0o!Hq+S>_NrH4@coZtBJu#g8#CbR7|#?6uxi8d+$g z87apN>EciJZ`%Zv2**_uiET9Vk{pny&My;+WfGDw4EVL#B!Wiw&M|A8f1A@ z(yFQS6jfbH{b8Z-S7D2?Ixl`j0{+ZnpT=;KzVMLW{B$`N?Gw^Fl0H6lT61%T2AU**!sX0u?|I(yoy&Xveg7XBL&+>n6jd1##6d>TxE*Vj=8lWiG$4=u{1UbAa5QD>5_ z;Te^42v7K6Mmu4IWT6Rnm>oxrl~b<~^e3vbj-GCdHLIB_>59}Ya+~OF68NiH=?}2o zP(X7EN=quQn&)fK>M&kqF|<_*H`}c zk=+x)GU>{Af#vx&s?`UKUsz})g^Pc&?Ka@t5$n$bqf6{r1>#mWx6Ep>9|A}VmWRnowVo`OyCr^fHsf# zQjQ3Ttp7y#iQY8l`zEUW)(@gGQdt(~rkxlkefskT(t%@i8=|p1Y9Dc5bc+z#n$s13 zGJk|V0+&Ekh(F};PJzQKKo+FG@KV8a<$gmNSD;7rd_nRdc%?9)p!|B-@P~kxQG}~B zi|{0}@}zKC(rlFUYp*dO1RuvPC^DQOkX4<+EwvBAC{IZQdYxoq1Za!MW7%p7gGr=j zzWnAq%)^O2$eItftC#TTSArUyL$U54-O7e|)4_7%Q^2tZ^0-d&3J1}qCzR4dWX!)4 zzIEKjgnYgMus^>6uw4Jm8ga6>GBtMjpNRJ6CP~W=37~||gMo_p@GA@#-3)+cVYnU> zE5=Y4kzl+EbEh%dhQokB{gqNDqx%5*qBusWV%!iprn$S!;oN_6E3?0+umADVs4ako z?P+t?m?};gev9JXQ#Q&KBpzkHPde_CGu-y z<{}RRAx=xlv#mVi+Ibrgx~ujW$h{?zPfhz)Kp7kmYS&_|97b&H&1;J-mzrBWAvY} zh8-I8hl_RK2+nnf&}!W0P+>5?#?7>npshe<1~&l_xqKd0_>dl_^RMRq@-Myz&|TKZBj1=Q()) zF{dBjv5)h=&Z)Aevx}+i|7=R9rG^Di!sa)sZCl&ctX4&LScQ-kMncgO(9o6W6)yd< z@Rk!vkja*X_N3H=BavGoR0@u0<}m-7|2v!0+2h~S2Q&a=lTH91OJsvms2MT~ zY=c@LO5i`mLpBd(vh|)I&^A3TQLtr>w=zoyzTd=^f@TPu&+*2MtqE$Avf>l>}V|3-8Fp2hzo3y<)hr_|NO(&oSD z!vEjTWBxbKTiShVl-U{n*B3#)3a8$`{~Pk}J@elZ=>Pqp|MQ}jrGv7KrNcjW%TN_< zZz8kG{#}XoeWf7qY?D)L)8?Q-b@Na&>i=)(@uNo zr;cH98T3$Iau8Hn*@vXi{A@YehxDE2zX~o+RY`)6-X{8~hMpc#C`|8y> zU8Mnv5A0dNCf{Ims*|l-^ z(MRp{qoGohB34|ggDI*p!Aw|MFyJ|v+<+E3brfrI)|+l3W~CQLPbnF@G0)P~Ly!1TJLp}xh8uW`Q+RB-v`MRYZ9Gam3cM%{ zb4Cb*f)0deR~wtNb*8w-LlIF>kc7DAv>T0D(a3@l`k4TFnrO+g9XH7;nYOHxjc4lq zMmaW6qpgAgy)MckYMhl?>sq;-1E)-1llUneeA!ya9KM$)DaNGu57Z5aE>=VST$#vb zFo=uRHr$0M{-ha>h(D_boS4zId;3B|Tpqo|?B?Z@I?G(?&Iei+-{9L_A9=h=Qfn-U z1wIUnQe9!z%_j$F_{rf&`ZFSott09gY~qrf@g3O=Y>vzAnXCyL!@(BqWa)Zqt!#_k zfZHuwS52|&&)aK;CHq9V-t9qt0au{$#6c*R#e5n3rje0hic7c7m{kW$p(_`wB=Gw7 z4k`1Hi;Mc@yA7dp@r~?@rfw)TkjAW++|pkfOG}0N|2guek}j8Zen(!+@7?qt_7ndX zB=BG6WJ31#F3#Vk3=aQr8T)3`{=p9nBHlKzE0I@v`{vJ}h8pd6vby&VgFhzH|q;=aonunAXL6G2y(X^CtAhWr*jI zGjpY@raZDQkg*aMq}Ni6cRF z{oWv}5`nhSAv>usX}m^GHt`f(t8@zHc?K|y5Zi=4G*UG1Sza{$Dpj%X8 zzEXaKT5N6F5j4J|w#qlZP!zS7BT)9b+!ZSJdToqJts1c!)fwih4d31vfb{}W)EgcA zH2pZ^8_k$9+WD2n`6q5XbOy8>3pcYH9 z07eUB+p}YD@AH!}p!iKv><2QF-Y^&xx^PAc1F13A{nUeCDg&{hnix#FiO!fe(^&%Qcux!h znu*S!s$&nnkeotYsDthh1dq(iQrE|#f_=xVgfiiL&-5eAcC-> z5L0l|DVEM$#ulf{bj+Y~7iD)j<~O8CYM8GW)dQGq)!mck)FqoL^X zwNdZb3->hFrbHFm?hLvut-*uK?zXn3q1z|UX{RZ;-WiLoOjnle!xs+W0-8D)kjU#R z+S|A^HkRg$Ij%N4v~k`jyHffKaC~=wg=9)V5h=|kLQ@;^W!o2^K+xG&2n`XCd>OY5Ydi= zgHH=lgy++erK8&+YeTl7VNyVm9-GfONlSlVb3)V9NW5tT!cJ8d7X)!b-$fb!s76{t z@d=Vg-5K_sqHA@Zx-L_}wVnc@L@GL9_K~Zl(h5@AR#FAiKad8~KeWCo@mgXIQ#~u{ zgYFwNz}2b6Vu@CP0XoqJ+dm8px(5W5-Jpis97F`+KM)TuP*X8H@zwiVKDKGVp59pI zifNHZr|B+PG|7|Y<*tqap0CvG7tbR1R>jn70t1X`XJixiMVcHf%Ez*=xm1(CrTSDt z0cle!+{8*Ja&EOZ4@$qhBuKQ$U95Q%rc7tg$VRhk?3=pE&n+T3upZg^ZJc9~c2es% zh7>+|mrmA-p&v}|OtxqmHIBgUxL~^0+cpfkSK2mhh+4b=^F1Xgd2)}U*Yp+H?ls#z zrLxWg_hm}AfK2XYWr!rzW4g;+^^&bW%LmbtRai9f3PjU${r@n`JThy-cphbcwn)rq9{A$Ht`lmYKxOacy z6v2R(?gHhD5@&kB-Eg?4!hAoD7~(h>(R!s1c1Hx#s9vGPePUR|of32bS`J5U5w{F) z>0<^ktO2UHg<0{oxkdOQ;}coZDQph8p6ruj*_?uqURCMTac;>T#v+l1Tc~%^k-Vd@ zkc5y35jVNc49vZpZx;gG$h{%yslDI%Lqga1&&;mN{Ush1c7p>7e-(zp}6E7f-XmJb4nhk zb8zS+{IVbL$QVF8pf8}~kQ|dHJAEATmmnrb_wLG}-yHe>W|A&Y|;muy-d^t^<&)g5SJfaTH@P1%euONny=mxo+C z4N&w#biWY41r8k~468tvuYVh&XN&d#%QtIf9;iVXfWY)#j=l`&B~lqDT@28+Y!0E+MkfC}}H*#(WKKdJJq=O$vNYCb(ZG@p{fJgu;h z21oHQ(14?LeT>n5)s;uD@5&ohU!@wX8w*lB6i@GEH0pM>YTG+RAIWZD;4#F1&F%Jp zXZUml2sH0!lYJT?&sA!qwez6cXzJEd(1ZC~kT5kZSp7(@=H2$Azb_*W&6aA|9iwCL zdX7Q=42;@dspHDwYE?miGX#L^3xD&%BI&fN9^;`v4OjQXPBaBmOF1;#C)8XA(WFlH zycro;DS2?(G&6wkr6rqC>rqDv3nfGw3hmN_9Al>TgvmGsL8_hXx09};l9Ow@)F5@y z#VH5WigLDwZE4nh^7&@g{1FV^UZ%_LJ-s<{HN*2R$OPg@R~Z`c-ET*2}XB@9xvAjrK&hS=f|R8Gr9 zr|0TGOsI7RD+4+2{ZiwdVD@2zmg~g@^D--YL;6UYGSM8i$NbQr4!c7T9rg!8;TM0E zT#@?&S=t>GQm)*ua|?TLT2ktj#`|R<_*FAkOu2Pz$wEc%-=Y9V*$&dg+wIei3b*O8 z2|m$!jJG!J!ZGbbIa!(Af~oSyZV+~M1qGvelMzPNE_%5?c2>;MeeG2^N?JDKjFYCy z7SbPWH-$cWF9~fX%9~v99L!G(wi!PFp>rB!9xj7=Cv|F+7CsGNwY0Q_J%FID%C^CBZQfJ9K(HK%k31j~e#&?hQ zNuD6gRkVckU)v+53-fc} z7ZCzYN-5RG4H7;>>Hg?LU9&5_aua?A0)0dpew1#MMlu)LHe(M;OHjHIUl7|%%)YPo z0cBk;AOY00%Fe6heoN*$(b<)Cd#^8Iu;-2v@>cE-OB$icUF9EEoaC&q8z9}jMTT2I z8`9;jT%z0;dy4!8U;GW{i`)3!c6&oWY`J3669C!tM<5nQFFrFRglU8f)5Op$GtR-3 zn!+SPCw|04sv?%YZ(a7#L?vsdr7ss@WKAw&A*}-1S|9~cL%uA+E~>N6QklFE>8W|% zyX-qAUGTY1hQ-+um`2|&ji0cY*(qN!zp{YpDO-r>jPk*yuVSay<)cUt`t@&FPF_&$ zcHwu1(SQ`I-l8~vYyUxm@D1UEdFJ$f5Sw^HPH7b!9 zzYT3gKMF((N(v0#4f_jPfVZ=ApN^jQJe-X$`A?X+vWjLn_%31KXE*}5_}d8 zw_B1+a#6T1?>M{ronLbHIlEsMf93muJ7AH5h%;i99<~JX^;EAgEB1uHralD*!aJ@F zV2ruuFe9i2Q1C?^^kmVy921eb=tLDD43@-AgL^rQ3IO9%+vi_&R2^dpr}x{bCVPej z7G0-0o64uyWNtr*loIvslyo0%)KSDDKjfThe0hcqs)(C-MH1>bNGBDRTW~scy_{w} zp^aq8Qb!h9Lwielq%C1b8=?Z=&U)ST&PHbS)8Xzjh2DF?d{iAv)Eh)wsUnf>UtXN( zL7=$%YrZ#|^c{MYmhn!zV#t*(jdmYdCpwqpZ{v&L8KIuKn`@IIZfp!uo}c;7J57N` zAxyZ-uA4=Gzl~Ovycz%MW9ZL7N+nRo&1cfNn9(1H5eM;V_4Z_qVann7F>5f>%{rf= zPBZFaV@_Sobl?Fy&KXyzFDV*FIdhS5`Uc~S^Gjo)aiTHgn#<0C=9o-a-}@}xDor;D zZyZ|fvf;+=3MZd>SR1F^F`RJEZo+|MdyJYQAEauKu%WDol~ayrGU3zzbHKsnHKZ*z zFiwUkL@DZ>!*x05ql&EBq@_Vqv83&?@~q5?lVmffQZ+V-=qL+!u4Xs2Z2zdCQ3U7B&QR9_Iggy} z(om{Y9eU;IPe`+p1ifLx-XWh?wI)xU9ik+m#g&pGdB5Bi<`PR*?92lE0+TkRuXI)z z5LP!N2+tTc%cB6B1F-!fj#}>S!vnpgVU~3!*U1ej^)vjUH4s-bd^%B=ItQqDCGbrEzNQi(dJ`J}-U=2{7-d zK8k^Rlq2N#0G?9&1?HSle2vlkj^KWSBYTwx`2?9TU_DX#J+f+qLiZCqY1TXHFxXZqYMuD@RU$TgcnCC{_(vwZ-*uX)~go#%PK z@}2Km_5aQ~(<3cXeJN6|F8X_1@L%@xTzs}$_*E|a^_URF_qcF;Pfhoe?FTFwvjm1o z8onf@OY@jC2tVcMaZS;|T!Ks(wOgPpRzRnFS-^RZ4E!9dsnj9sFt609a|jJbb1Dt@ z<=Gal2jDEupxUSwWu6zp<<&RnAA;d&4gKVG0iu6g(DsST(4)z6R)zDpfaQ}v{5ARt zyhwvMtF%b-YazR5XLz+oh=mn;y-Mf2a8>7?2v8qX;19y?b>Z5laGHvzH;Nu9S`B8} zI)qN$GbXIQ1VL3lnof^6TS~rvPVg4V?Dl2Bb*K2z4E{5vy<(@@K_cN@U>R!>aUIRnb zL*)=787*cs#zb31zBC49x$`=fkQbMAef)L2$dR{)6BAz!t5U_B#1zZG`^neKSS22oJ#5B=gl%U=WeqL9REF2g zZnfCb0?quf?Ztj$VXvDSWoK`0L=Zxem2q}!XWLoT-kYMOx)!7fcgT35uC~0pySEme z`{wGWTkGr7>+Kb^n;W?BZH6ZP(9tQX%-7zF>vc2}LuWDI(9kh1G#7B99r4x6;_-V+k&c{nPUrR zAXJGRiMe~aup{0qzmLNjS_BC4cB#sXjckx{%_c&^xy{M61xEb>KW_AG5VFXUOjAG4 z^>Qlm9A#1N{4snY=(AmWzatb!ngqiqPbBZ7>Uhb3)dTkSGcL#&SH>iMO-IJBPua`u zo)LWZ>=NZLr758j{%(|uQuZ)pXq_4c!!>s|aDM9#`~1bzK3J1^^D#<2bNCccH7~-X}Ggi!pIIF>uFx%aPARGQsnC8ZQc8lrQ5o~smqOg>Ti^GNme94*w z)JZy{_{#$jxGQ&`M z!OMvZMHR>8*^>eS%o*6hJwn!l8VOOjZQJvh)@tnHVW&*GYPuxqXw}%M!(f-SQf`=L z5;=5w2;%82VMH6Xi&-K3W)o&K^+vJCepWZ-rW%+Dc6X3(){z$@4zjYxQ|}8UIojeC zYZpQ1dU{fy=oTr<4VX?$q)LP}IUmpiez^O&N3E_qPpchGTi5ZM6-2ScWlQq%V&R2Euz zO|Q0Hx>lY1Q1cW5xHv5!0OGU~PVEqSuy#fD72d#O`N!C;o=m+YioGu-wH2k6!t<~K zSr`E=W9)!g==~x9VV~-8{4ZN9{~-A9zJpRe%NGg$+MDuI-dH|b@BD)~>pPCGUNNzY zMDg||0@XGQgw`YCt5C&A{_+J}mvV9Wg{6V%2n#YSRN{AP#PY?1FF1#|vO_%e+#`|2*~wGAJaeRX6=IzFNeWhz6gJc8+(03Ph4y6ELAm=AkN7TOgMUEw*N{= z_)EIDQx5q22oUR+_b*tazu9+pX|n1c*IB-}{DqIj z-?E|ks{o3AGRNb;+iKcHkZvYJvFsW&83RAPs1Oh@IWy%l#5x2oUP6ZCtv+b|q>jsf zZ_9XO;V!>n`UxH1LvH8)L4?8raIvasEhkpQoJ`%!5rBs!0Tu(s_D{`4opB;57)pkX z4$A^8CsD3U5*!|bHIEqsn~{q+Ddj$ME@Gq4JXtgVz&7l{Ok!@?EA{B3P~NAqb9)4? zkQo30A^EbHfQ@87G5&EQTd`frrwL)&Yw?%-W@uy^Gn23%j?Y!Iea2xw<-f;esq zf%w5WN@E1}zyXtYv}}`U^B>W`>XPmdLj%4{P298|SisrE;7HvXX;A}Ffi8B#3Lr;1 zHt6zVb`8{#+e$*k?w8|O{Uh|&AG}|DG1PFo1i?Y*cQm$ZwtGcVgMwtBUDa{~L1KT-{jET4w60>{KZ27vXrHJ;fW{6| z=|Y4!&UX020wU1>1iRgB@Q#m~1^Z^9CG1LqDhYBrnx%IEdIty z!46iOoKlKs)c}newDG)rWUikD%j`)p z_w9Ph&e40=(2eBy;T!}*1p1f1SAUDP9iWy^u^Ubdj21Kn{46;GR+hwLO=4D11@c~V zI8x&(D({K~Df2E)Nx_yQvYfh4;MbMJ@Z}=Dt3_>iim~QZ*hZIlEs0mEb z_54+&*?wMD`2#vsQRN3KvoT>hWofI_Vf(^C1ff-Ike@h@saEf7g}<9T`W;HAne-Nd z>RR+&SP35w)xKn8^U$7))PsM!jKwYZ*RzEcG-OlTrX3}9a{q%#Un5E5W{{hp>w~;` zGky+3(vJvQyGwBo`tCpmo0mo((?nM8vf9aXrrY1Ve}~TuVkB(zeds^jEfI}xGBCM2 zL1|#tycSaWCurP+0MiActG3LCas@_@tao@(R1ANlwB$4K53egNE_;!&(%@Qo$>h`^1S_!hN6 z)vZtG$8fN!|BXBJ=SI>e(LAU(y(i*PHvgQ2llulxS8>qsimv7yL}0q_E5WiAz7)(f zC(ahFvG8&HN9+6^jGyLHM~$)7auppeWh_^zKk&C_MQ~8;N??OlyH~azgz5fe^>~7F zl3HnPN3z-kN)I$4@`CLCMQx3sG~V8hPS^}XDXZrQA>}mQPw%7&!sd(Pp^P=tgp-s^ zjl}1-KRPNWXgV_K^HkP__SR`S-|OF0bR-N5>I%ODj&1JUeAQ3$9i;B~$S6}*^tK?= z**%aCiH7y?xdY?{LgVP}S0HOh%0%LI$wRx;$T|~Y8R)Vdwa}kGWv8?SJVm^>r6+%I z#lj1aR94{@MP;t-scEYQWc#xFA30^}?|BeX*W#9OL;Q9#WqaaM546j5j29((^_8Nu z4uq}ESLr~r*O7E7$D{!k9W>`!SLoyA53i9QwRB{!pHe8um|aDE`Cg0O*{jmor)^t)3`>V>SWN-2VJcFmj^1?~tT=JrP`fVh*t zXHarp=8HEcR#vFe+1a%XXuK+)oFs`GDD}#Z+TJ}Ri`FvKO@ek2ayn}yaOi%(8p%2$ zpEu)v0Jym@f}U|-;}CbR=9{#<^z28PzkkTNvyKvJDZe+^VS2bES3N@Jq!-*}{oQlz z@8bgC_KnDnT4}d#&Cpr!%Yb?E!brx0!eVOw~;lLwUoz#Np%d$o%9scc3&zPm`%G((Le|6o1 zM(VhOw)!f84zG^)tZ1?Egv)d8cdNi+T${=5kV+j;Wf%2{3g@FHp^Gf*qO0q!u$=m9 zCaY`4mRqJ;FTH5`a$affE5dJrk~k`HTP_7nGTY@B9o9vvnbytaID;^b=Tzp7Q#DmD zC(XEN)Ktn39z5|G!wsVNnHi) z%^q94!lL|hF`IijA^9NR0F$@h7k5R^ljOW(;Td9grRN0Mb)l_l7##{2nPQ@?;VjXv zaLZG}yuf$r$<79rVPpXg?6iiieX|r#&`p#Con2i%S8*8F}(E) zI5E6c3tG*<;m~6>!&H!GJ6zEuhH7mkAzovdhLy;)q z{H2*8I^Pb}xC4s^6Y}6bJvMu=8>g&I)7!N!5QG$xseeU#CC?ZM-TbjsHwHgDGrsD= z{%f;@Sod+Ch66Ko2WF~;Ty)v>&x^aovCbCbD7>qF*!?BXmOV3(s|nxsb*Lx_2lpB7 zokUnzrk;P=T-&kUHO}td+Zdj!3n&NR?K~cRU zAXU!DCp?51{J4w^`cV#ye}(`SQhGQkkMu}O3M*BWt4UsC^jCFUy;wTINYmhD$AT;4 z?Xd{HaJjP`raZ39qAm;%beDbrLpbRf(mkKbANan7XsL>_pE2oo^$TgdidjRP!5-`% zv0d!|iKN$c0(T|L0C~XD0aS8t{*&#LnhE;1Kb<9&=c2B+9JeLvJr*AyyRh%@jHej=AetOMSlz^=!kxX>>B{2B1uIrQyfd8KjJ+DBy!h)~*(!|&L4^Q_07SQ~E zcemVP`{9CwFvPFu7pyVGCLhH?LhEVb2{7U+Z_>o25#+3<|8%1T^5dh}*4(kfJGry} zm%r#hU+__Z;;*4fMrX=Bkc@7|v^*B;HAl0((IBPPii%X9+u3DDF6%bI&6?Eu$8&aWVqHIM7mK6?Uvq$1|(-T|)IV<>e?!(rY zqkmO1MRaLeTR=)io(0GVtQT@s6rN%C6;nS3@eu;P#ry4q;^O@1ZKCJyp_Jo)Ty^QW z+vweTx_DLm{P-XSBj~Sl<%_b^$=}odJ!S2wAcxenmzFGX1t&Qp8Vxz2VT`uQsQYtdn&_0xVivIcxZ_hnrRtwq4cZSj1c-SG9 z7vHBCA=fd0O1<4*=lu$6pn~_pVKyL@ztw1swbZi0B?spLo56ZKu5;7ZeUml1Ws1?u zqMf1p{5myAzeX$lAi{jIUqo1g4!zWLMm9cfWcnw`k6*BR^?$2(&yW?>w;G$EmTA@a z6?y#K$C~ZT8+v{87n5Dm&H6Pb_EQ@V0IWmG9cG=O;(;5aMWWrIPzz4Q`mhK;qQp~a z+BbQrEQ+w{SeiuG-~Po5f=^EvlouB@_|4xQXH@A~KgpFHrwu%dwuCR)=B&C(y6J4J zvoGk9;lLs9%iA-IJGU#RgnZZR+@{5lYl8(e1h6&>Vc_mvg0d@);X zji4T|n#lB!>pfL|8tQYkw?U2bD`W{na&;*|znjmalA&f;*U++_aBYerq;&C8Kw7mI z7tsG*?7*5j&dU)Lje;^{D_h`%(dK|pB*A*1(Jj)w^mZ9HB|vGLkF1GEFhu&rH=r=8 zMxO42e{Si6$m+Zj`_mXb&w5Q(i|Yxyg?juUrY}78uo@~3v84|8dfgbPd0iQJRdMj< zncCNGdMEcsxu#o#B5+XD{tsg*;j-eF8`mp~K8O1J!Z0+>0=7O=4M}E?)H)ENE;P*F z$Ox?ril_^p0g7xhDUf(q652l|562VFlC8^r8?lQv;TMvn+*8I}&+hIQYh2 z1}uQQaag&!-+DZ@|C+C$bN6W;S-Z@)d1|en+XGvjbOxCa-qAF*LA=6s(Jg+g;82f$ z(Vb)8I)AH@cdjGFAR5Rqd0wiNCu!xtqWbcTx&5kslzTb^7A78~Xzw1($UV6S^VWiP zFd{Rimd-0CZC_Bu(WxBFW7+k{cOW7DxBBkJdJ;VsJ4Z@lERQr%3eVv&$%)b%<~ zCl^Y4NgO}js@u{|o~KTgH}>!* z_iDNqX2(As7T0xivMH|3SC1ivm8Q}6Ffcd7owUKN5lHAtzMM4<0v+ykUT!QiowO;`@%JGv+K$bBx@*S7C8GJVqQ_K>12}M`f_Ys=S zKFh}HM9#6Izb$Y{wYzItTy+l5U2oL%boCJn?R3?jP@n$zSIwlmyGq30Cw4QBO|14` zW5c);AN*J3&eMFAk$SR~2k|&+&Bc$e>s%c{`?d~85S-UWjA>DS5+;UKZ}5oVa5O(N zqqc@>)nee)+4MUjH?FGv%hm2{IlIF-QX}ym-7ok4Z9{V+ZHVZQl$A*x!(q%<2~iVv znUa+BX35&lCb#9VE-~Y^W_f;Xhl%vgjwdjzMy$FsSIj&ok}L+X`4>J=9BkN&nu^E*gbhj3(+D>C4E z@Fwq_=N)^bKFSHTzZk?-gNU$@l}r}dwGyh_fNi=9b|n}J>&;G!lzilbWF4B}BBq4f zYIOl?b)PSh#XTPp4IS5ZR_2C!E)Z`zH0OW%4;&~z7UAyA-X|sh9@~>cQW^COA9hV4 zXcA6qUo9P{bW1_2`eo6%hgbN%(G-F1xTvq!sc?4wN6Q4`e9Hku zFwvlAcRY?6h^Fj$R8zCNEDq8`=uZB8D-xn)tA<^bFFy}4$vA}Xq0jAsv1&5!h!yRA zU()KLJya5MQ`q&LKdH#fwq&(bNFS{sKlEh_{N%{XCGO+po#(+WCLmKW6&5iOHny>g z3*VFN?mx!16V5{zyuMWDVP8U*|BGT$(%IO|)?EF|OI*sq&RovH!N%=>i_c?K*A>>k zyg1+~++zY4Q)J;VWN0axhoIKx;l&G$gvj(#go^pZskEVj8^}is3Jw26LzYYVos0HX zRPvmK$dVxM8(Tc?pHFe0Z3uq){{#OK3i-ra#@+;*=ui8)y6hsRv z4Fxx1c1+fr!VI{L3DFMwXKrfl#Q8hfP@ajgEau&QMCxd{g#!T^;ATXW)nUg&$-n25 zruy3V!!;{?OTobo|0GAxe`Acn3GV@W=&n;~&9 zQM>NWW~R@OYORkJAo+eq1!4vzmf9K%plR4(tB@TR&FSbDoRgJ8qVcH#;7lQub*nq&?Z>7WM=oeEVjkaG zT#f)=o!M2DO5hLR+op>t0CixJCIeXH*+z{-XS|%jx)y(j&}Wo|3!l7{o)HU3m7LYyhv*xF&tq z%IN7N;D4raue&&hm0xM=`qv`+TK@;_xAcGKuK(2|75~ar2Yw)geNLSmVxV@x89bQu zpViVKKnlkwjS&&c|-X6`~xdnh}Ps)Hs z4VbUL^{XNLf7_|Oi>tA%?SG5zax}esF*FH3d(JH^Gvr7Rp*n=t7frH!U;!y1gJB^i zY_M$KL_}mW&XKaDEi9K-wZR|q*L32&m+2n_8lq$xRznJ7p8}V>w+d@?uB!eS3#u<} zIaqi!b!w}a2;_BfUUhGMy#4dPx>)_>yZ`ai?Rk`}d0>~ce-PfY-b?Csd(28yX22L% zI7XI>OjIHYTk_@Xk;Gu^F52^Gn6E1&+?4MxDS2G_#PQ&yXPXP^<-p|2nLTb@AAQEY zI*UQ9Pmm{Kat}wuazpjSyXCdnrD&|C1c5DIb1TnzF}f4KIV6D)CJ!?&l&{T)e4U%3HTSYqsQ zo@zWB1o}ceQSV)<4G<)jM|@@YpL+XHuWsr5AYh^Q{K=wSV99D~4RRU52FufmMBMmd z_H}L#qe(}|I9ZyPRD6kT>Ivj&2Y?qVZq<4bG_co_DP`sE*_Xw8D;+7QR$Uq(rr+u> z8bHUWbV19i#)@@G4bCco@Xb<8u~wVDz9S`#k@ciJtlu@uP1U0X?yov8v9U3VOig2t zL9?n$P3=1U_Emi$#slR>N5wH-=J&T=EdUHA}_Z zZIl3nvMP*AZS9{cDqFanrA~S5BqxtNm9tlu;^`)3X&V4tMAkJ4gEIPl= zoV!Gyx0N{3DpD@)pv^iS*dl2FwANu;1;%EDl}JQ7MbxLMAp>)UwNwe{=V}O-5C*>F zu?Ny+F64jZn<+fKjF01}8h5H_3pey|;%bI;SFg$w8;IC<8l|3#Lz2;mNNik6sVTG3 z+Su^rIE#40C4a-587$U~%KedEEw1%r6wdvoMwpmlXH$xPnNQN#f%Z7|p)nC>WsuO= z4zyqapLS<8(UJ~Qi9d|dQijb_xhA2)v>la)<1md5s^R1N&PiuA$^k|A<+2C?OiHbj z>Bn$~t)>Y(Zb`8hW7q9xQ=s>Rv81V+UiuZJc<23HplI88isqRCId89fb`Kt|CxVIg znWcwprwXnotO>3s&Oypkte^9yJjlUVVxSe%_xlzmje|mYOVPH^vjA=?6xd0vaj0Oz zwJ4OJNiFdnHJX3rw&inskjryukl`*fRQ#SMod5J|KroJRsVXa5_$q7whSQ{gOi*s0 z1LeCy|JBWRsDPn7jCb4s(p|JZiZ8+*ExC@Vj)MF|*Vp{B(ziccSn`G1Br9bV(v!C2 z6#?eqpJBc9o@lJ#^p-`-=`4i&wFe>2)nlPK1p9yPFzJCzBQbpkcR>={YtamIw)3nt z(QEF;+)4`>8^_LU)_Q3 zC5_7lgi_6y>U%m)m@}Ku4C}=l^J=<<7c;99ec3p{aR+v=diuJR7uZi%aQv$oP?dn?@6Yu_+*^>T0ptf(oobdL;6)N-I!TO`zg^Xbv3#L0I~sn@WGk-^SmPh5>W+LB<+1PU}AKa?FCWF|qMNELOgdxR{ zbqE7@jVe+FklzdcD$!(A$&}}H*HQFTJ+AOrJYnhh}Yvta(B zQ_bW4Rr;R~&6PAKwgLWXS{Bnln(vUI+~g#kl{r+_zbngT`Y3`^Qf=!PxN4IYX#iW4 zucW7@LLJA9Zh3(rj~&SyN_pjO8H&)|(v%!BnMWySBJV=eSkB3YSTCyIeJ{i;(oc%_hk{$_l;v>nWSB)oVeg+blh=HB5JSlG_r7@P z3q;aFoZjD_qS@zygYqCn=;Zxjo!?NK!%J$ z52lOP`8G3feEj+HTp@Tnn9X~nG=;tS+z}u{mQX_J0kxtr)O30YD%oo)L@wy`jpQYM z@M>Me=95k1p*FW~rHiV1CIfVc{K8r|#Kt(ApkXKsDG$_>76UGNhHExFCw#Ky9*B-z zNq2ga*xax!HMf_|Vp-86r{;~YgQKqu7%szk8$hpvi_2I`OVbG1doP(`gn}=W<8%Gn z%81#&WjkH4GV;4u43EtSW>K_Ta3Zj!XF?;SO3V#q=<=>Tc^@?A`i;&`-cYj|;^ zEo#Jl5zSr~_V-4}y8pnufXLa80vZY4z2ko7fj>DR)#z=wWuS1$$W!L?(y}YC+yQ|G z@L&`2upy3f>~*IquAjkVNU>}c10(fq#HdbK$~Q3l6|=@-eBbo>B9(6xV`*)sae58*f zym~RRVx;xoCG3`JV`xo z!lFw)=t2Hy)e!IFs?0~7osWk(d%^wxq&>_XD4+U#y&-VF%4z?XH^i4w`TxpF{`XhZ z%G}iEzf!T(l>g;W9<~K+)$g!{UvhW{E0Lis(S^%I8OF&%kr!gJ&fMOpM=&=Aj@wuL zBX?*6i51Qb$uhkwkFYkaD_UDE+)rh1c;(&Y=B$3)J&iJfQSx!1NGgPtK!$c9OtJuu zX(pV$bfuJpRR|K(dp@^j}i&HeJOh@|7lWo8^$*o~Xqo z5Sb+!EtJ&e@6F+h&+_1ETbg7LfP5GZjvIUIN3ibCOldAv z)>YdO|NH$x7AC8dr=<2ekiY1%fN*r~e5h6Yaw<{XIErujKV~tiyrvV_DV0AzEknC- zR^xKM3i<1UkvqBj3C{wDvytOd+YtDSGu!gEMg+!&|8BQrT*|p)(dwQLEy+ zMtMzij3zo40)CA!BKZF~yWg?#lWhqD3@qR)gh~D{uZaJO;{OWV8XZ_)J@r3=)T|kt zUS1pXr6-`!Z}w2QR7nP%d?ecf90;K_7C3d!UZ`N(TZoWNN^Q~RjVhQG{Y<%E1PpV^4 z-m-K+$A~-+VDABs^Q@U*)YvhY4Znn2^w>732H?NRK(5QSS$V@D7yz2BVX4)f5A04~$WbxGOam22>t&uD)JB8-~yiQW6ik;FGblY_I>SvB_z2?PS z*Qm&qbKI{H1V@YGWzpx`!v)WeLT02};JJo*#f$a*FH?IIad-^(;9XC#YTWN6;Z6+S zm4O1KH=#V@FJw7Pha0!9Vb%ZIM$)a`VRMoiN&C|$YA3~ZC*8ayZRY^fyuP6$n%2IU z$#XceYZeqLTXw(m$_z|33I$B4k~NZO>pP6)H_}R{E$i%USGy{l{-jOE;%CloYPEU+ zRFxOn4;7lIOh!7abb23YKD+_-?O z0FP9otcAh+oSj;=f#$&*ExUHpd&e#bSF%#8*&ItcL2H$Sa)?pt0Xtf+t)z$_u^wZi z44oE}r4kIZGy3!Mc8q$B&6JqtnHZ>Znn!Zh@6rgIu|yU+zG8q`q9%B18|T|oN3zMq z`l&D;U!OL~%>vo&q0>Y==~zLiCZk4v%s_7!9DxQ~id1LLE93gf*gg&2$|hB#j8;?3 z5v4S;oM6rT{Y;I+#FdmNw z){d%tNM<<#GN%n9ox7B=3#;u7unZ~tLB_vRZ52a&2=IM)2VkXm=L+Iqq~uk#Dug|x z>S84e+A7EiOY5lj*!q?6HDkNh~0g;0Jy(al!ZHHDtur9T$y-~)94HelX1NHjXWIM7UAe}$?jiz z9?P4`I0JM=G5K{3_%2jPLC^_Mlw?-kYYgb7`qGa3@dn|^1fRMwiyM@Ch z;CB&o7&&?c5e>h`IM;Wnha0QKnEp=$hA8TJgR-07N~U5(>9vJzeoFsSRBkDq=x(YgEMpb=l4TDD`2 zwVJpWGTA_u7}?ecW7s6%rUs&NXD3+n;jB86`X?8(l3MBo6)PdakI6V6a}22{)8ilT zM~T*mU}__xSy|6XSrJ^%lDAR3Lft%+yxC|ZUvSO_nqMX!_ul3;R#*{~4DA=h$bP)%8Yv9X zyp><|e8=_ttI}ZAwOd#dlnSjck#6%273{E$kJuCGu=I@O)&6ID{nWF5@gLb16sj|&Sb~+du4e4O_%_o`Ix4NRrAsyr1_}MuP94s>de8cH-OUkVPk3+K z&jW)It9QiU-ti~AuJkL`XMca8Oh4$SyJ=`-5WU<{cIh+XVH#e4d&zive_UHC!pN>W z3TB;Mn5i)9Qn)#6@lo4QpI3jFYc0~+jS)4AFz8fVC;lD^+idw^S~Qhq>Tg(!3$yLD zzktzoFrU@6s4wwCMz}edpF5i5Q1IMmEJQHzp(LAt)pgN3&O!&d?3W@6U4)I^2V{;- z6A(?zd93hS*uQmnh4T)nHnE{wVhh(=MMD(h(P4+^p83Om6t<*cUW>l(qJzr%5vp@K zN27ka(L{JX=1~e2^)F^i=TYj&;<7jyUUR2Bek^A8+3Up*&Xwc{)1nRR5CT8vG>ExV zHnF3UqXJOAno_?bnhCX-&kwI~Ti8t4`n0%Up>!U`ZvK^w2+0Cs-b9%w%4`$+To|k= zKtgc&l}P`*8IS>8DOe?EB84^kx4BQp3<7P{Pq}&p%xF_81pg!l2|u=&I{AuUgmF5n zJQCTLv}%}xbFGYtKfbba{CBo)lWW%Z>i(_NvLhoQZ*5-@2l&x>e+I~0Nld3UI9tdL zRzu8}i;X!h8LHVvN?C+|M81e>Jr38%&*9LYQec9Ax>?NN+9(_>XSRv&6hlCYB`>Qm z1&ygi{Y()OU4@D_jd_-7vDILR{>o|7-k)Sjdxkjgvi{@S>6GqiF|o`*Otr;P)kLHN zZkpts;0zw_6;?f(@4S1FN=m!4^mv~W+lJA`&7RH%2$)49z0A+8@0BCHtj|yH--AEL z0tW6G%X-+J+5a{5*WKaM0QDznf;V?L5&uQw+yegDNDP`hA;0XPYc6e0;Xv6|i|^F2WB)Z$LR|HR4 zTQsRAby9(^Z@yATyOgcfQw7cKyr^3Tz7lc7+JEwwzA7)|2x+PtEb>nD(tpxJQm)Kn zW9K_*r!L%~N*vS8<5T=iv|o!zTe9k_2jC_j*7ik^M_ zaf%k{WX{-;0*`t`G!&`eW;gChVXnJ-Rn)To8vW-?>>a%QU1v`ZC=U)f8iA@%JG0mZ zDqH;~mgBnrCP~1II<=V9;EBL)J+xzCoiRBaeH&J6rL!{4zIY8tZka?_FBeQeNO3q6 zyG_alW54Ba&wQf{&F1v-r1R6ID)PTsqjIBc+5MHkcW5Fnvi~{-FjKe)t1bl}Y;z@< z=!%zvpRua>>t_x}^}z0<7MI!H2v6|XAyR9!t50q-A)xk0nflgF4*OQlCGK==4S|wc zRMsSscNhRzHMBU8TdcHN!q^I}x0iXJ%uehac|Zs_B$p@CnF)HeXPpB_Za}F{<@6-4 zl%kml@}kHQ(ypD8FsPJ2=14xXJE|b20RUIgs!2|R3>LUMGF6X*B_I|$`Qg=;zm7C z{mEDy9dTmPbued7mlO@phdmAmJ7p@GR1bjCkMw6*G7#4+`k>fk1czdJUB!e@Q(~6# zwo%@p@V5RL0ABU2LH7Asq^quDUho@H>eTZH9f*no9fY0T zD_-9px3e}A!>>kv5wk91%C9R1J_Nh!*&Kk$J3KNxC}c_@zlgpJZ+5L)Nw|^p=2ue}CJtm;uj*Iqr)K})kA$xtNUEvX;4!Px*^&9T_`IN{D z{6~QY=Nau6EzpvufB^hflc#XIsSq0Y9(nf$d~6ZwK}fal92)fr%T3=q{0mP-EyP_G z)UR5h@IX}3Qll2b0oCAcBF>b*@Etu*aTLPU<%C>KoOrk=x?pN!#f_Og-w+;xbFgjQ zXp`et%lDBBh~OcFnMKMUoox0YwBNy`N0q~bSPh@+enQ=4RUw1) zpovN`QoV>vZ#5LvC;cl|6jPr}O5tu!Ipoyib8iXqy}TeJ;4+_7r<1kV0v5?Kv>fYp zg>9L`;XwXa&W7-jf|9~uP2iyF5`5AJ`Q~p4eBU$MCC00`rcSF>`&0fbd^_eqR+}mK z4n*PMMa&FOcc)vTUR zlDUAn-mh`ahi_`f`=39JYTNVjsTa_Y3b1GOIi)6dY)D}xeshB0T8Eov5%UhWd1)u}kjEQ|LDo{tqKKrYIfVz~@dp!! zMOnah@vp)%_-jDTUG09l+;{CkDCH|Q{NqX*uHa1YxFShy*1+;J`gywKaz|2Q{lG8x zP?KBur`}r`!WLKXY_K;C8$EWG>jY3UIh{+BLv0=2)KH%P}6xE2kg)%(-uA6lC?u8}{K(#P*c zE9C8t*u%j2r_{;Rpe1A{9nNXU;b_N0vNgyK!EZVut~}+R2rcbsHilqsOviYh-pYX= zHw@53nlmwYI5W5KP>&`dBZe0Jn?nAdC^HY1wlR6$u^PbpB#AS&5L6zqrXN&7*N2Q` z+Rae1EwS)H=aVSIkr8Ek^1jy2iS2o7mqm~Mr&g5=jjt7VxwglQ^`h#Mx+x2v|9ZAwE$i_9918MjJxTMr?n!bZ6n$}y11u8I9COTU`Z$Fi z!AeAQLMw^gp_{+0QTEJrhL424pVDp%wpku~XRlD3iv{vQ!lAf!_jyqd_h}+Tr1XG| z`*FT*NbPqvHCUsYAkFnM`@l4u_QH&bszpUK#M~XLJt{%?00GXY?u_{gj3Hvs!=N(I z(=AuWPijyoU!r?aFTsa8pLB&cx}$*%;K$e*XqF{~*rA-qn)h^!(-;e}O#B$|S~c+U zN4vyOK0vmtx$5K!?g*+J@G1NmlEI=pyZXZ69tAv=@`t%ag_Hk{LP~OH9iE)I= zaJ69b4kuCkV0V zo(M0#>phpQ_)@j;h%m{-a*LGi(72TP)ws2w*@4|C-3+;=5DmC4s7Lp95%n%@Ko zfdr3-a7m*dys9iIci$A=4NPJ`HfJ;hujLgU)ZRuJI`n;Pw|yksu!#LQnJ#dJysgNb z@@qwR^wrk(jbq4H?d!lNyy72~Dnn87KxsgQ!)|*m(DRM+eC$wh7KnS-mho3|KE)7h zK3k;qZ;K1Lj6uEXLYUYi)1FN}F@-xJ z@@3Hb84sl|j{4$3J}aTY@cbX@pzB_qM~APljrjju6P0tY{C@ zpUCOz_NFmALMv1*blCcwUD3?U6tYs+N%cmJ98D%3)%)Xu^uvzF zS5O!sc#X6?EwsYkvPo6A%O8&y8sCCQH<%f2togVwW&{M;PR!a(ZT_A+jVAbf{@5kL zB@Z(hb$3U{T_}SKA_CoQVU-;j>2J=L#lZ~aQCFg-d<9rzs$_gO&d5N6eFSc z1ml8)P*FSi+k@!^M9nDWR5e@ATD8oxtDu=36Iv2!;dZzidIS(PCtEuXAtlBb1;H%Z zwnC^Ek*D)EX4#Q>R$$WA2sxC_t(!!6Tr?C#@{3}n{<^o;9id1RA&-Pig1e-2B1XpG zliNjgmd3c&%A}s>qf{_j#!Z`fu0xIwm4L0)OF=u(OEmp;bLCIaZX$&J_^Z%4Sq4GZ zPn6sV_#+6pJmDN_lx@1;Zw6Md_p0w9h6mHtzpuIEwNn>OnuRSC2=>fP^Hqgc)xu^4 z<3!s`cORHJh#?!nKI`Et7{3C27+EuH)Gw1f)aoP|B3y?fuVfvpYYmmukx0ya-)TQX zR{ggy5cNf4X|g)nl#jC9p>7|09_S7>1D2GTRBUTW zAkQ=JMRogZqG#v;^=11O6@rPPwvJkr{bW-Qg8`q8GoD#K`&Y+S#%&B>SGRL>;ZunM@49!}Uy zN|bBCJ%sO;@3wl0>0gbl3L@1^O60ONObz8ZI7nder>(udj-jt`;yj^nTQ$L9`OU9W zX4alF#$|GiR47%x@s&LV>2Sz2R6?;2R~5k6V>)nz!o_*1Y!$p>BC5&?hJg_MiE6UBy>RkVZj`9UWbRkN-Hk!S`=BS3t3uyX6)7SF#)71*}`~Ogz z1rap5H6~dhBJ83;q-Y<5V35C2&F^JI-it(=5D#v!fAi9p#UwV~2tZQI+W(Dv?1t9? zfh*xpxxO{-(VGB>!Q&0%^YW_F!@aZS#ucP|YaD#>wd1Fv&Z*SR&mc;asi}1G) z_H>`!akh-Zxq9#io(7%;a$)w+{QH)Y$?UK1Dt^4)up!Szcxnu}kn$0afcfJL#IL+S z5gF_Y30j;{lNrG6m~$Ay?)*V9fZuU@3=kd40=LhazjFrau>(Y>SJNtOz>8x_X-BlA zIpl{i>OarVGj1v(4?^1`R}aQB&WCRQzS~;7R{tDZG=HhgrW@B`W|#cdyj%YBky)P= zpxuOZkW>S6%q7U{VsB#G(^FMsH5QuGXhb(sY+!-R8Bmv6Sx3WzSW<1MPPN1!&PurYky(@`bP9tz z52}LH9Q?+FF5jR6-;|+GVdRA!qtd;}*-h&iIw3Tq3qF9sDIb1FFxGbo&fbG5n8$3F zyY&PWL{ys^dTO}oZ#@sIX^BKW*bon=;te9j5k+T%wJ zNJtoN1~YVj4~YRrlZl)b&kJqp+Z`DqT!la$x&&IxgOQw#yZd-nBP3!7FijBXD|IsU8Zl^ zc6?MKpJQ+7ka|tZQLfchD$PD|;K(9FiLE|eUZX#EZxhG!S-63C$jWX1Yd!6-Yxi-u zjULIr|0-Q%D9jz}IF~S%>0(jOqZ(Ln<$9PxiySr&2Oic7vb<8q=46)Ln%Z|<*z5&> z3f~Zw@m;vR(bESB<=Jqkxn(=#hQw42l(7)h`vMQQTttz9XW6^|^8EK7qhju4r_c*b zJIi`)MB$w@9epwdIfnEBR+?~);yd6C(LeMC& zn&&N*?-g&BBJcV;8&UoZi4Lmxcj16ojlxR~zMrf=O_^i1wGb9X-0@6_rpjPYemIin zmJb+;lHe;Yp=8G)Q(L1bzH*}I>}uAqhj4;g)PlvD9_e_ScR{Ipq|$8NvAvLD8MYr}xl=bU~)f%B3E>r3Bu9_t|ThF3C5~BdOve zEbk^r&r#PT&?^V1cb{72yEWH}TXEE}w>t!cY~rA+hNOTK8FAtIEoszp!qqptS&;r$ zaYV-NX96-h$6aR@1xz6_E0^N49mU)-v#bwtGJm)ibygzJ8!7|WIrcb`$XH~^!a#s& z{Db-0IOTFq#9!^j!n_F}#Z_nX{YzBK8XLPVmc&X`fT7!@$U-@2KM9soGbmOSAmqV z{nr$L^MBo_u^Joyf0E^=eo{Rt0{{e$IFA(#*kP@SQd6lWT2-#>` zP1)7_@IO!9lk>Zt?#CU?cuhiLF&)+XEM9B)cS(gvQT!X3`wL*{fArTS;Ak`J<84du zALKPz4}3nlG8Fo^MH0L|oK2-4xIY!~Oux~1sw!+It)&D3p;+N8AgqKI`ld6v71wy8I!eP0o~=RVcFQR2Gr(eP_JbSytoQ$Yt}l*4r@A8Me94y z8cTDWhqlq^qoAhbOzGBXv^Wa4vUz$(7B!mX`T=x_ueKRRDfg&Uc-e1+z4x$jyW_Pm zp?U;-R#xt^Z8Ev~`m`iL4*c#65Nn)q#=Y0l1AuD&+{|8-Gsij3LUZXpM0Bx0u7WWm zH|%yE@-#XEph2}-$-thl+S;__ciBxSSzHveP%~v}5I%u!z_l_KoW{KRx2=eB33umE zIYFtu^5=wGU`Jab8#}cnYry@9p5UE#U|VVvx_4l49JQ;jQdp(uw=$^A$EA$LM%vmE zvdEOaIcp5qX8wX{mYf0;#51~imYYPn4=k&#DsKTxo{_Mg*;S495?OBY?#gv=edYC* z^O@-sd-qa+U24xvcbL0@C7_6o!$`)sVr-jSJE4XQUQ$?L7}2(}Eixqv;L8AdJAVqc zq}RPgpnDb@E_;?6K58r3h4-!4rT4Ab#rLHLX?eMOfluJk=3i1@Gt1i#iA=O`M0@x! z(HtJP9BMHXEzuD93m|B&woj0g6T?f#^)>J>|I4C5?Gam>n9!8CT%~aT;=oco5d6U8 zMXl(=W;$ND_8+DD*?|5bJ!;8ebESXMUKBAf7YBwNVJibGaJ*(2G`F%wx)grqVPjudiaq^Kl&g$8A2 zWMxMr@_$c}d+;_B`#kUX-t|4VKH&_f^^EP0&=DPLW)H)UzBG%%Tra*5 z%$kyZe3I&S#gfie^z5)!twG={3Cuh)FdeA!Kj<-9** zvT*5%Tb`|QbE!iW-XcOuy39>D3oe6x{>&<#E$o8Ac|j)wq#kQzz|ATd=Z0K!p2$QE zPu?jL8Lb^y3_CQE{*}sTDe!2!dtlFjq&YLY@2#4>XS`}v#PLrpvc4*@q^O{mmnr5D zmyJq~t?8>FWU5vZdE(%4cuZuao0GNjp3~Dt*SLaxI#g_u>hu@k&9Ho*#CZP~lFJHj z(e!SYlLigyc?&5-YxlE{uuk$9b&l6d`uIlpg_z15dPo*iU&|Khx2*A5Fp;8iK_bdP z?T6|^7@lcx2j0T@x>X7|kuuBSB7<^zeY~R~4McconTxA2flHC0_jFxmSTv-~?zVT| zG_|yDqa9lkF*B6_{j=T>=M8r<0s;@z#h)3BQ4NLl@`Xr__o7;~M&dL3J8fP&zLfDfy z);ckcTev{@OUlZ`bCo(-3? z1u1xD`PKgSg?RqeVVsF<1SLF;XYA@Bsa&cY!I48ZJn1V<3d!?s=St?TLo zC0cNr`qD*M#s6f~X>SCNVkva^9A2ZP>CoJ9bvgXe_c}WdX-)pHM5m7O zrHt#g$F0AO+nGA;7dSJ?)|Mo~cf{z2L)Rz!`fpi73Zv)H=a5K)*$5sf_IZypi($P5 zsPwUc4~P-J1@^3C6-r9{V-u0Z&Sl7vNfmuMY4yy*cL>_)BmQF!8Om9Dej%cHxbIzA zhtV0d{=%cr?;bpBPjt@4w=#<>k5ee=TiWAXM2~tUGfm z$s&!Dm0R^V$}fOR*B^kGaipi~rx~A2cS0;t&khV1a4u38*XRUP~f za!rZMtay8bsLt6yFYl@>-y^31(*P!L^^s@mslZy(SMsv9bVoX`O#yBgEcjCmGpyc* zeH$Dw6vB5P*;jor+JOX@;6K#+xc)Z9B8M=x2a@Wx-{snPGpRmOC$zpsqW*JCh@M2Y z#K+M(>=#d^>Of9C`))h<=Bsy)6zaMJ&x-t%&+UcpLjV`jo4R2025 zXaG8EA!0lQa)|dx-@{O)qP6`$rhCkoQqZ`^SW8g-kOwrwsK8 z3ms*AIcyj}-1x&A&vSq{r=QMyp3CHdWH35!sad#!Sm>^|-|afB+Q;|Iq@LFgqIp#Z zD1%H+3I?6RGnk&IFo|u+E0dCxXz4yI^1i!QTu7uvIEH>i3rR{srcST`LIRwdV1P;W z+%AN1NIf@xxvVLiSX`8ILA8MzNqE&7>%jMzGt9wm78bo9<;h*W84i29^w!>V>{N+S zd`5Zmz^G;f=icvoOZfK5#1ctx*~UwD=ab4DGQXehQ!XYnak*dee%YN$_ZPL%KZuz$ zD;$PpT;HM^$KwtQm@7uvT`i6>Hae1CoRVM2)NL<2-k2PiX=eAx+-6j#JI?M}(tuBW zkF%jjLR)O`gI2fcPBxF^HeI|DWwQWHVR!;;{BXXHskxh8F@BMDn`oEi-NHt;CLymW z=KSv5)3dyzec0T5B*`g-MQ<;gz=nIWKUi9ko<|4I(-E0k$QncH>E4l z**1w&#={&zv4Tvhgz#c29`m|;lU-jmaXFMC11 z*dlXDMEOG>VoLMc>!rApwOu2prKSi*!w%`yzGmS+k(zm*CsLK*wv{S_0WX^8A-rKy zbk^Gf_92^7iB_uUF)EE+ET4d|X|>d&mdN?x@vxKAQk`O+r4Qdu>XGy(a(19g;=jU} zFX{O*_NG>!$@jh!U369Lnc+D~qch3uT+_Amyi}*k#LAAwh}k8IPK5a-WZ81ufD>l> z$4cF}GSz>ce`3FAic}6W4Z7m9KGO?(eWqi@L|5Hq0@L|&2flN1PVl}XgQ2q*_n2s3 zt5KtowNkTYB5b;SVuoXA@i5irXO)A&%7?V`1@HGCB&)Wgk+l|^XXChq;u(nyPB}b3 zY>m5jkxpZgi)zfbgv&ec4Zqdvm+D<?Im*mXweS9H+V>)zF#Zp3)bhl$PbISY{5=_z!8&*Jv~NYtI-g!>fDs zmvL5O^U%!^VaKA9gvKw|5?-jk>~%CVGvctKmP$kpnpfN{D8@X*Aazi$txfa%vd-|E z>kYmV66W!lNekJPom29LdZ%(I+ZLZYTXzTg*to~m?7vp%{V<~>H+2}PQ?PPAq`36R z<%wR8v6UkS>Wt#hzGk#44W<%9S=nBfB);6clKwnxY}T*w21Qc3_?IJ@4gYzC7s;WP zVQNI(M=S=JT#xsZy7G`cR(BP9*je0bfeN8JN5~zY(DDs0t{LpHOIbN);?T-69Pf3R zSNe*&p2%AwXHL>__g+xd4Hlc_vu<25H?(`nafS%)3UPP7_4;gk-9ckt8SJRTv5v0M z_Hww`qPudL?ajIR&X*;$y-`<)6dxx1U~5eGS13CB!lX;3w7n&lDDiArbAhSycd}+b zya_3p@A`$kQy;|NJZ~s44Hqo7Hwt}X86NK=(ey>lgWTtGL6k@Gy;PbO!M%1~Wcn2k zUFP|*5d>t-X*RU8g%>|(wwj*~#l4z^Aatf^DWd1Wj#Q*AY0D^V@sC`M zjJc6qXu0I7Y*2;;gGu!plAFzG=J;1%eIOdn zQA>J&e05UN*7I5@yRhK|lbBSfJ+5Uq;!&HV@xfPZrgD}kE*1DSq^=%{o%|LChhl#0 zlMb<^a6ixzpd{kNZr|3jTGeEzuo}-eLT-)Q$#b{!vKx8Tg}swCni>{#%vDY$Ww$84 zew3c9BBovqb}_&BRo#^!G(1Eg((BScRZ}C)Oz?y`T5wOrv);)b^4XR8 zhJo7+<^7)qB>I;46!GySzdneZ>n_E1oWZY;kf94#)s)kWjuJN1c+wbVoNQcmnv}{> zN0pF+Sl3E}UQ$}slSZeLJrwT>Sr}#V(dVaezCQl2|4LN`7L7v&siYR|r7M(*JYfR$ zst3=YaDw$FSc{g}KHO&QiKxuhEzF{f%RJLKe3p*7=oo`WNP)M(9X1zIQPP0XHhY3c znrP{$4#Ol$A0s|4S7Gx2L23dv*Gv2o;h((XVn+9+$qvm}s%zi6nI-_s6?mG! zj{DV;qesJb&owKeEK?=J>UcAlYckA7Sl+I&IN=yasrZOkejir*kE@SN`fk<8Fgx*$ zy&fE6?}G)d_N`){P~U@1jRVA|2*69)KSe_}!~?+`Yb{Y=O~_+@!j<&oVQQMnhoIRU zA0CyF1OFfkK44n*JD~!2!SCPM;PRSk%1XL=0&rz00wxPs&-_eapJy#$h!eqY%nS0{ z!aGg58JIJPF3_ci%n)QSVpa2H`vIe$RD43;#IRfDV&Ibit z+?>HW4{2wOfC6Fw)}4x}i1maDxcE1qi@BS*qcxD2gE@h3#4cgU*D-&3z7D|tVZWt= z-Cy2+*Cm@P4GN_TPUtaVyVesbVDazF@)j8VJ4>XZv!f%}&eO1SvIgr}4`A*3#vat< z_MoByL(qW6L7SFZ#|Gc1fFN)L2PxY+{B8tJp+pxRyz*87)vXR}*=&ahXjBlQKguuf zX6x<<6fQulE^C*KH8~W%ptpaC0l?b=_{~*U4?5Vt;dgM4t_{&UZ1C2j?b>b+5}{IF_CUyvz-@QZPMlJ)r_tS$9kH%RPv#2_nMb zRLj5;chJ72*U`Z@Dqt4$@_+k$%|8m(HqLG!qT4P^DdfvGf&){gKnGCX#H0!;W=AGP zbA&Z`-__a)VTS}kKFjWGk z%|>yE?t*EJ!qeQ%dPk$;xIQ+P0;()PCBDgjJm6Buj{f^awNoVx+9<|lg3%-$G(*f) zll6oOkN|yamn1uyl2*N-lnqRI1cvs_JxLTeahEK=THV$Sz*gQhKNb*p0fNoda#-&F zB-qJgW^g}!TtM|0bS2QZekW7_tKu%GcJ!4?lObt0z_$mZ4rbQ0o=^curCs3bJK6sq z9fu-aW-l#>z~ca(B;4yv;2RZ?tGYAU)^)Kz{L|4oPj zdOf_?de|#yS)p2v8-N||+XL=O*%3+y)oI(HbM)Ds?q8~HPzIP(vs*G`iddbWq}! z(2!VjP&{Z1w+%eUq^ '} + case $link in #( + /*) app_path=$link ;; #( + *) app_path=$APP_HOME$link ;; + esac +done + +APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit + +APP_NAME="Gradle" +APP_BASE_NAME=${0##*/} + +# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' + +# Use the maximum available, or set MAX_FD != -1 to use that value. +MAX_FD=maximum + +warn () { + echo "$*" +} >&2 + +die () { + echo + echo "$*" + echo + exit 1 +} >&2 + +# OS specific support (must be 'true' or 'false'). +cygwin=false +msys=false +darwin=false +nonstop=false +case "$( uname )" in #( + CYGWIN* ) cygwin=true ;; #( + Darwin* ) darwin=true ;; #( + MSYS* | MINGW* ) msys=true ;; #( + NONSTOP* ) nonstop=true ;; +esac + +CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar + + +# Determine the Java command to use to start the JVM. +if [ -n "$JAVA_HOME" ] ; then + if [ -x "$JAVA_HOME/jre/sh/java" ] ; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD=$JAVA_HOME/jre/sh/java + else + JAVACMD=$JAVA_HOME/bin/java + fi + if [ ! -x "$JAVACMD" ] ; then + die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +else + JAVACMD=java + which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." +fi + +# Increase the maximum file descriptors if we can. +if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then + case $MAX_FD in #( + max*) + MAX_FD=$( ulimit -H -n ) || + warn "Could not query maximum file descriptor limit" + esac + case $MAX_FD in #( + '' | soft) :;; #( + *) + ulimit -n "$MAX_FD" || + warn "Could not set maximum file descriptor limit to $MAX_FD" + esac +fi + +# Collect all arguments for the java command, stacking in reverse order: +# * args from the command line +# * the main class name +# * -classpath +# * -D...appname settings +# * --module-path (only if needed) +# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables. + +# For Cygwin or MSYS, switch paths to Windows format before running java +if "$cygwin" || "$msys" ; then + APP_HOME=$( cygpath --path --mixed "$APP_HOME" ) + CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" ) + + JAVACMD=$( cygpath --unix "$JAVACMD" ) + + # Now convert the arguments - kludge to limit ourselves to /bin/sh + for arg do + if + case $arg in #( + -*) false ;; # don't mess with options #( + /?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath + [ -e "$t" ] ;; #( + *) false ;; + esac + then + arg=$( cygpath --path --ignore --mixed "$arg" ) + fi + # Roll the args list around exactly as many times as the number of + # args, so each arg winds up back in the position where it started, but + # possibly modified. + # + # NB: a `for` loop captures its iteration list before it begins, so + # changing the positional parameters here affects neither the number of + # iterations, nor the values presented in `arg`. + shift # remove old arg + set -- "$@" "$arg" # push replacement arg + done +fi + +# Collect all arguments for the java command; +# * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of +# shell script including quotes and variable substitutions, so put them in +# double quotes to make sure that they get re-expanded; and +# * put everything else in single quotes, so that it's not re-expanded. + +set -- \ + "-Dorg.gradle.appname=$APP_BASE_NAME" \ + -classpath "$CLASSPATH" \ + org.gradle.wrapper.GradleWrapperMain \ + "$@" + +# Use "xargs" to parse quoted args. +# +# With -n1 it outputs one arg per line, with the quotes and backslashes removed. +# +# In Bash we could simply go: +# +# readarray ARGS < <( xargs -n1 <<<"$var" ) && +# set -- "${ARGS[@]}" "$@" +# +# but POSIX shell has neither arrays nor command substitution, so instead we +# post-process each arg (as a line of input to sed) to backslash-escape any +# character that might be a shell metacharacter, then use eval to reverse +# that process (while maintaining the separation between arguments), and wrap +# the whole thing up as a single "set" statement. +# +# This will of course break if any of these variables contains a newline or +# an unmatched quote. +# + +eval "set -- $( + printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" | + xargs -n1 | + sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' | + tr '\n' ' ' + )" '"$@"' + +exec "$JAVACMD" "$@" diff --git a/temporal-workflowcheck/samples/gradle/gradlew.bat b/temporal-workflowcheck/samples/gradle/gradlew.bat new file mode 100644 index 0000000000..107acd32c4 --- /dev/null +++ b/temporal-workflowcheck/samples/gradle/gradlew.bat @@ -0,0 +1,89 @@ +@rem +@rem Copyright 2015 the original author or authors. +@rem +@rem Licensed under the Apache License, Version 2.0 (the "License"); +@rem you may not use this file except in compliance with the License. +@rem You may obtain a copy of the License at +@rem +@rem https://www.apache.org/licenses/LICENSE-2.0 +@rem +@rem Unless required by applicable law or agreed to in writing, software +@rem distributed under the License is distributed on an "AS IS" BASIS, +@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +@rem See the License for the specific language governing permissions and +@rem limitations under the License. +@rem + +@if "%DEBUG%" == "" @echo off +@rem ########################################################################## +@rem +@rem Gradle startup script for Windows +@rem +@rem ########################################################################## + +@rem Set local scope for the variables with windows NT shell +if "%OS%"=="Windows_NT" setlocal + +set DIRNAME=%~dp0 +if "%DIRNAME%" == "" set DIRNAME=. +set APP_BASE_NAME=%~n0 +set APP_HOME=%DIRNAME% + +@rem Resolve any "." and ".." in APP_HOME to make it shorter. +for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi + +@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" + +@rem Find java.exe +if defined JAVA_HOME goto findJavaFromJavaHome + +set JAVA_EXE=java.exe +%JAVA_EXE% -version >NUL 2>&1 +if "%ERRORLEVEL%" == "0" goto execute + +echo. +echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:findJavaFromJavaHome +set JAVA_HOME=%JAVA_HOME:"=% +set JAVA_EXE=%JAVA_HOME%/bin/java.exe + +if exist "%JAVA_EXE%" goto execute + +echo. +echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:execute +@rem Setup the command line + +set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar + + +@rem Execute Gradle +"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* + +:end +@rem End local scope for the variables with windows NT shell +if "%ERRORLEVEL%"=="0" goto mainEnd + +:fail +rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of +rem the _cmd.exe /c_ return code! +if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 +exit /b 1 + +:mainEnd +if "%OS%"=="Windows_NT" endlocal + +:omega diff --git a/temporal-workflowcheck/samples/gradle/settings.gradle b/temporal-workflowcheck/samples/gradle/settings.gradle new file mode 100644 index 0000000000..7843878f99 --- /dev/null +++ b/temporal-workflowcheck/samples/gradle/settings.gradle @@ -0,0 +1,5 @@ +rootProject.name = 'temporal-workflowcheck-samples-gradle' + +// Add the workflowcheck project as a composite build. We are only doing this +// for the sample, normally this is not needed. +includeBuild '../../../' \ No newline at end of file diff --git a/temporal-workflowcheck/samples/gradle/src/main/java/io/temporal/workflowcheck/sample/gradle/MyWorkflow.java b/temporal-workflowcheck/samples/gradle/src/main/java/io/temporal/workflowcheck/sample/gradle/MyWorkflow.java new file mode 100644 index 0000000000..93e21ae623 --- /dev/null +++ b/temporal-workflowcheck/samples/gradle/src/main/java/io/temporal/workflowcheck/sample/gradle/MyWorkflow.java @@ -0,0 +1,10 @@ +package io.temporal.workflowcheck.sample.gradle; + +import io.temporal.workflow.WorkflowInterface; +import io.temporal.workflow.WorkflowMethod; + +@WorkflowInterface +public interface MyWorkflow { + @WorkflowMethod + void errorAtNight(); +} diff --git a/temporal-workflowcheck/samples/gradle/src/main/java/io/temporal/workflowcheck/sample/gradle/MyWorkflowImpl.java b/temporal-workflowcheck/samples/gradle/src/main/java/io/temporal/workflowcheck/sample/gradle/MyWorkflowImpl.java new file mode 100644 index 0000000000..351f1a2dec --- /dev/null +++ b/temporal-workflowcheck/samples/gradle/src/main/java/io/temporal/workflowcheck/sample/gradle/MyWorkflowImpl.java @@ -0,0 +1,14 @@ +package io.temporal.workflowcheck.sample.gradle; + +import java.time.LocalTime; +import io.temporal.failure.ApplicationFailure; + +public class MyWorkflowImpl implements MyWorkflow { + @Override + public void errorAtNight() { + // Let's throw an application exception only after 8 PM local time + if (LocalTime.now().getHour() >= 20) { + throw ApplicationFailure.newFailure("Can't call this workflow after 8PM", "time-error"); + } + } +} diff --git a/temporal-workflowcheck/samples/maven/README.md b/temporal-workflowcheck/samples/maven/README.md new file mode 100644 index 0000000000..ba669c81e3 --- /dev/null +++ b/temporal-workflowcheck/samples/maven/README.md @@ -0,0 +1,24 @@ +# Temporal Workflow Check for Java - Maven Sample + +This sample shows how to incorporate `workflowcheck` into a Maven build. Currently there are no published releases, so +this example expects the primary Gradle to publish the JAR to a local Maven repo that this project references. In the +future, users may just want to reference a published JAR when it is available. + +To run, first publish the `workflowcheck` JAR to a local repository. ⚠️ WARNING: While there remain no published +releases of workflowcheck, it is currently undocumented on how to publish to a local/disk Maven repo. + +Now with the local repository present, can run the following from this dir: + + mvn -U verify + +Note, this is a sample using the local repository so that's why we have `-U`. For normal use, `mvn verify` without the +`-U` can be used (and the `` section of the `pom.xml` can be removed). + +This will output something like: + +``` +Analyzing classpath for classes with workflow methods... +Found 1 class(es) with workflow methods +Workflow method io.temporal.workflowcheck.sample.maven.MyWorkflowImpl.errorAtNight() (declared on io.temporal.workflowcheck.sample.maven.MyWorkflow) has 1 invalid member access: + MyWorkflowImpl.java:11 invokes java.time.LocalTime.now() which is configured as invalid +``` \ No newline at end of file diff --git a/temporal-workflowcheck/samples/maven/pom.xml b/temporal-workflowcheck/samples/maven/pom.xml new file mode 100644 index 0000000000..ef9702baa2 --- /dev/null +++ b/temporal-workflowcheck/samples/maven/pom.xml @@ -0,0 +1,102 @@ + + + 4.0.0 + + io.temporal + temporal-workflowcheck-samples-maven + 1.0-SNAPSHOT + + + 17 + 17 + UTF-8 + + + + + io.temporal + temporal-sdk + 1.22.3 + + + + + + + temporal-workflowcheck-repo + file://${project.basedir}/../../temporal-workflowcheck/build/repo + + + + + + + + + org.apache.maven.plugins + maven-dependency-plugin + 3.6.1 + + + generate-classpath-file + generate-resources + + build-classpath + + + ${project.build.directory}/classpath.txt + + + + + + + + org.codehaus.mojo + exec-maven-plugin + 3.1.1 + + + workflowcheck + verify + + java + + + true + io.temporal.workflowcheck.Main + + check + + @${project.build.directory}/classpath.txt + ${project.build.outputDirectory} + + + + + + + io.temporal + temporal-workflowcheck + 1.0-SNAPSHOT + + + + + + + \ No newline at end of file diff --git a/temporal-workflowcheck/samples/maven/src/main/java/io/temporal/workflowcheck/sample/maven/MyWorkflow.java b/temporal-workflowcheck/samples/maven/src/main/java/io/temporal/workflowcheck/sample/maven/MyWorkflow.java new file mode 100644 index 0000000000..af5cca5094 --- /dev/null +++ b/temporal-workflowcheck/samples/maven/src/main/java/io/temporal/workflowcheck/sample/maven/MyWorkflow.java @@ -0,0 +1,10 @@ +package io.temporal.workflowcheck.sample.maven; + +import io.temporal.workflow.WorkflowInterface; +import io.temporal.workflow.WorkflowMethod; + +@WorkflowInterface +public interface MyWorkflow { + @WorkflowMethod + void errorAtNight(); +} diff --git a/temporal-workflowcheck/samples/maven/src/main/java/io/temporal/workflowcheck/sample/maven/MyWorkflowImpl.java b/temporal-workflowcheck/samples/maven/src/main/java/io/temporal/workflowcheck/sample/maven/MyWorkflowImpl.java new file mode 100644 index 0000000000..a3dbe0a503 --- /dev/null +++ b/temporal-workflowcheck/samples/maven/src/main/java/io/temporal/workflowcheck/sample/maven/MyWorkflowImpl.java @@ -0,0 +1,15 @@ +package io.temporal.workflowcheck.sample.maven; + +import io.temporal.failure.ApplicationFailure; + +import java.time.LocalTime; + +public class MyWorkflowImpl implements MyWorkflow { + @Override + public void errorAtNight() { + // Let's throw an application exception only after 8 PM local time + if (LocalTime.now().getHour() >= 20) { + throw ApplicationFailure.newFailure("Can't call this workflow after 8PM", "time-error"); + } + } +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassInfo.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassInfo.java new file mode 100644 index 0000000000..c674ea2cf2 --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassInfo.java @@ -0,0 +1,274 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.util.*; +import javax.annotation.Nullable; + +/** Information about a class. */ +public class ClassInfo { + int access; + String name; + @Nullable String fileName; + @Nullable String superClass; + @Nullable String[] superInterfaces; + + // Keyed by method name, each is an overload in no particular order. This may + // not include unimportant methods after processing. + Map> methods = new HashMap<>(); + + // This may be removed after processing. + @Nullable Set nonFinalStaticFields; + + /** JVM access flag for the class as defined in JVM spec. */ + public int getAccess() { + return access; + } + + /** Full binary class name as defined in JVM spec (i.e. using '/' instead of '.'). */ + public String getName() { + return name; + } + + /** File name the class was defined in if known. */ + @Nullable + public String getFileName() { + return fileName; + } + + /** Super class of this class. Only null for java/lang/Object. */ + @Nullable + public String getSuperClass() { + return superClass; + } + + /** Super interfaces of this class if any. */ + @Nullable + public String[] getSuperInterfaces() { + return superInterfaces; + } + + /** + * Methods of note on this class. This may not include all methods, but rather only the methods + * that are important (i.e. are a workflow decl/impl or are invalid methods). + */ + public Map> getMethods() { + return methods; + } + + /** Information about a method. */ + public static class MethodInfo { + final int access; + final String descriptor; + @Nullable final Boolean configuredInvalid; + @Nullable MethodWorkflowDeclInfo workflowDecl; + // Set after loading + @Nullable MethodWorkflowImplInfo workflowImpl; + // Removed after loading (if null then invalidMemberAccesses is now the + // canonical set). May be null when loading if configuredInvalid already + // set. + @Nullable List memberAccesses; + // Set after loading (but can still be null), never non-null+empty + @Nullable List invalidMemberAccesses; + + MethodInfo(int access, String descriptor, @Nullable Boolean configuredInvalid) { + this.access = access; + this.descriptor = descriptor; + this.configuredInvalid = configuredInvalid; + } + + /** JVM access flag for the class as defined in JVM spec. */ + public int getAccess() { + return access; + } + + /** JVM descriptor for the method. */ + public String getDescriptor() { + return descriptor; + } + + /** Gets whether configured invalid. This is null if not configured one way or another. */ + @Nullable + public Boolean getConfiguredInvalid() { + return configuredInvalid; + } + + /** Get workflow declaration info if this is a workflow declaration. */ + @Nullable + public MethodWorkflowDeclInfo getWorkflowDecl() { + return workflowDecl; + } + + /** Get workflow implementation info if this is a workflow implementation. */ + @Nullable + public MethodWorkflowImplInfo getWorkflowImpl() { + return workflowImpl; + } + + /** + * Get all invalid members accessed within this method. This may be null if {@link + * #getConfiguredInvalid()} is non-null which supersedes this. + */ + @Nullable + public List getInvalidMemberAccesses() { + return invalidMemberAccesses; + } + + /** Whether this method is invalid (i.e. configured invalid or accesses invalid members). */ + public boolean isInvalid() { + return configuredInvalid != null ? configuredInvalid : invalidMemberAccesses != null; + } + } + + /** Information about a workflow method declaration. */ + public static class MethodWorkflowDeclInfo { + final Kind kind; + + MethodWorkflowDeclInfo(Kind kind) { + this.kind = kind; + } + + /** Kind of workflow method. */ + public Kind getKind() { + return kind; + } + + /** Kinds of workflow methods. */ + public enum Kind { + WORKFLOW, + QUERY, + SIGNAL, + UPDATE, + UPDATE_VALIDATOR; + + static final Map annotationDescriptors; + + static { + annotationDescriptors = new HashMap<>(5); + annotationDescriptors.put("Lio/temporal/workflow/WorkflowMethod;", WORKFLOW); + annotationDescriptors.put("Lio/temporal/workflow/QueryMethod;", QUERY); + annotationDescriptors.put("Lio/temporal/workflow/SignalMethod;", SIGNAL); + annotationDescriptors.put("Lio/temporal/workflow/UpdateMethod;", UPDATE); + annotationDescriptors.put("Lio/temporal/workflow/UpdateValidatorMethod;", UPDATE_VALIDATOR); + } + } + } + + /** Information about a workflow method implementation. */ + public static class MethodWorkflowImplInfo { + final ClassInfo declClassInfo; + final MethodWorkflowDeclInfo workflowDecl; + + MethodWorkflowImplInfo(ClassInfo declClassInfo, MethodWorkflowDeclInfo workflowDecl) { + this.declClassInfo = declClassInfo; + this.workflowDecl = workflowDecl; + } + + /** Class information about the declaring class. */ + public ClassInfo getDeclClassInfo() { + return declClassInfo; + } + + /** Information about the declaration. */ + public MethodWorkflowDeclInfo getWorkflowDecl() { + return workflowDecl; + } + } + + /** Information about invalid member access. */ + public static class MethodInvalidMemberAccessInfo { + final String className; + final String memberName; + final String memberDescriptor; + @Nullable final Integer line; + final Operation operation; + + // Set in second phase + @Nullable ClassInfo resolvedInvalidClass; + // This is null if not a method or if the method is configured invalid + // directly + @Nullable MethodInfo resolvedInvalidMethod; + + MethodInvalidMemberAccessInfo( + String className, + String memberName, + String memberDescriptor, + @Nullable Integer line, + Operation operation) { + this.className = className; + this.memberName = memberName; + this.memberDescriptor = memberDescriptor; + this.line = line; + this.operation = operation; + } + + /** Qualified class name used when accessing. */ + public String getClassName() { + return className; + } + + /** Member name accessed. */ + public String getMemberName() { + return memberName; + } + + /** Descriptor of the member (different for fields and methods). */ + public String getMemberDescriptor() { + return memberDescriptor; + } + + /** Line access occurred on if known. */ + @Nullable + public Integer getLine() { + return line; + } + + /** Operation that makes this invalid. */ + public Operation getOperation() { + return operation; + } + + /** + * Class information about the true class the invalid check occurred on if it can be determined. + */ + @Nullable + public ClassInfo getResolvedInvalidClass() { + return resolvedInvalidClass; + } + + /** + * If this invalid access is a method call, this is the resolved method information if any which + * shows why it was invalid. + */ + @Nullable + public MethodInfo getResolvedInvalidMethod() { + return resolvedInvalidMethod; + } + + /** Invalid operations. */ + public enum Operation { + METHOD_CALL, + FIELD_STATIC_GET, + FIELD_STATIC_PUT, + FIELD_CONFIGURED_INVALID, + } + } +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassInfoVisitor.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassInfoVisitor.java new file mode 100644 index 0000000000..3d89068b76 --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassInfoVisitor.java @@ -0,0 +1,405 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.util.ArrayList; +import java.util.HashSet; +import java.util.List; +import java.util.logging.Level; +import java.util.logging.Logger; +import javax.annotation.Nullable; +import org.objectweb.asm.*; + +/** + * Visitor that visits the bytecode of a class. This is intentionally meant to be fast and have no + * recursion or other reliance on the visiting of other classes. Successive phases tie class + * information together. + */ +class ClassInfoVisitor extends ClassVisitor { + // Visible for testing + static final Logger logger = Logger.getLogger(ClassInfoVisitor.class.getName()); + + final ClassInfo classInfo = new ClassInfo(); + private final Config config; + private final MethodHandler methodHandler = new MethodHandler(); + @Nullable private SuppressionStack suppressionStack; + + ClassInfoVisitor(Config config) { + super(Opcodes.ASM9); + this.config = config; + } + + @Override + public void visit( + int version, + int access, + String name, + String signature, + String superName, + String[] interfaces) { + classInfo.access = access; + classInfo.name = name; + classInfo.superClass = superName; + classInfo.superInterfaces = interfaces; + } + + @Override + public AnnotationVisitor visitAnnotation(String descriptor, boolean visible) { + return maybeSuppressionAttributeHandler(descriptor); + } + + @Override + public void visitSource(String source, String debug) { + classInfo.fileName = source; + } + + @Override + public FieldVisitor visitField( + int access, String name, String descriptor, String signature, Object value) { + // Record all static non-final fields + if ((access & Opcodes.ACC_FINAL) == 0 && (access & Opcodes.ACC_STATIC) != 0) { + if (classInfo.nonFinalStaticFields == null) { + classInfo.nonFinalStaticFields = new HashSet<>(); + } + classInfo.nonFinalStaticFields.add(name); + } + + // TODO(cretz): Support suppression attributes on static non-final fields + return null; + } + + @Override + public MethodVisitor visitMethod( + int access, String name, String descriptor, String signature, String[] exceptions) { + // Add method to class + ClassInfo.MethodInfo methodInfo = + new ClassInfo.MethodInfo( + access, descriptor, config.invalidMembers.check(classInfo.name, name, descriptor)); + classInfo.methods.computeIfAbsent(name, k -> new ArrayList<>()).add(methodInfo); + + // Reset and reuse the handler + methodHandler.reset(name, methodInfo); + return methodHandler; + } + + private AnnotationVisitor maybeSuppressionAttributeHandler(String descriptor) { + if (descriptor.equals("Lio/temporal/workflowcheck/WorkflowCheck$SuppressWarnings;")) { + return new SuppressionAttributeHandler(); + } + return null; + } + + private class SuppressionAttributeHandler extends AnnotationVisitor { + private final List specificDescriptors = new ArrayList<>(); + + SuppressionAttributeHandler() { + super(Opcodes.ASM9); + } + + @Override + public AnnotationVisitor visitArray(String name) { + return this; + } + + @Override + public void visit(String name, Object value) { + // For now there is only one annotation param possible + if (value instanceof String) { + specificDescriptors.add((String) value); + } + } + + @Override + public void visitEnd() { + if (suppressionStack == null) { + suppressionStack = new SuppressionStack(); + } + suppressionStack.push( + specificDescriptors.isEmpty() ? null : specificDescriptors.toArray(new String[0])); + } + } + + private class MethodHandler extends MethodVisitor { + private String methodName; + private ClassInfo.MethodInfo methodInfo; + @Nullable private Integer methodLineNumber; + private int methodSuppressions; + private boolean methodSuppressionAnnotation; + @Nullable private String prevInsnLdcString; + + MethodHandler() { + super(Opcodes.ASM9); + } + + void reset(String methodName, ClassInfo.MethodInfo methodInfo) { + this.methodName = methodName; + this.methodInfo = methodInfo; + this.methodLineNumber = null; + this.methodSuppressions = 0; + this.methodSuppressionAnnotation = false; + } + + @Override + public AnnotationVisitor visitAnnotation(String descriptor, boolean visible) { + // Check if suppression annotation + AnnotationVisitor suppressionVisitor = maybeSuppressionAttributeHandler(descriptor); + if (suppressionVisitor != null) { + methodSuppressions++; + methodSuppressionAnnotation = true; + return suppressionVisitor; + } + + // If this descriptor is a known workflow decl kind, set as a decl + ClassInfo.MethodWorkflowDeclInfo.Kind declKind = + ClassInfo.MethodWorkflowDeclInfo.Kind.annotationDescriptors.get(descriptor); + if (declKind != null) { + if (logger.isLoggable(Level.FINE)) { + logger.log( + Level.FINE, + "Found workflow method decl on {0}.{1}", + new Object[] {classInfo.name, methodName}); + } + methodInfo.workflowDecl = new ClassInfo.MethodWorkflowDeclInfo(declKind); + } + return null; + } + + @Override + public void visitLineNumber(int line, Label start) { + methodLineNumber = line; + } + + @Override + public void visitEnd() { + // Pop any remaining suppressions + if (suppressionStack != null && methodSuppressions > 0) { + for (int i = 0; i < methodSuppressions; i++) { + suppressionStack.pop(); + } + // Also warn if there were un-restored suppressions + int expectedMethodSuppressions = methodSuppressionAnnotation ? 1 : 0; + if (methodSuppressions > expectedMethodSuppressions) { + logger.log( + Level.WARNING, + "{0} warning suppression(s) not restored in {1}.{2}", + new Object[] { + methodSuppressions - expectedMethodSuppressions, classInfo.name, methodName + }); + } + } + } + + @Override + public void visitMethodInsn( + int opcode, String owner, String name, String descriptor, boolean isInterface) { + // If this method is already configured invalid one way or another, don't + // be concerned with invalid calls + if (methodInfo.configuredInvalid != null) { + return; + } + + // Check if the call is being suppressed + if (maybeSuppressInsn(owner, name, descriptor)) { + return; + } + + // We tried many ways to do stream processing of invalid calls while they + // are loaded. While the recursion issue is trivially solved, properly + // resolving implemented interfaces (using proper specificity checks to + // disambiguate default impls) and similar challenges made it clear that + // it is worth the extra memory to capture _all_ calls up front and + // post-process whether they're invalid. This makes all method signatures + // available for resolution at invalid-check time. + if (methodInfo.memberAccesses == null) { + methodInfo.memberAccesses = new ArrayList<>(); + } + methodInfo.memberAccesses.add( + new ClassInfo.MethodInvalidMemberAccessInfo( + owner, + name, + descriptor, + methodLineNumber, + ClassInfo.MethodInvalidMemberAccessInfo.Operation.METHOD_CALL)); + } + + @Override + public void visitFieldInsn(int opcode, String owner, String name, String descriptor) { + // If this method is already configured invalid one way or another, don't + // be concerned with invalid fields + if (methodInfo.configuredInvalid != null) { + return; + } + + // Check if the field is being suppressed + if (maybeSuppressInsn(owner, name, descriptor)) { + return; + } + + // Check if the field is configured invalid one way or another + Boolean invalid = config.invalidMembers.check(owner, name, null); + if (invalid != null) { + if (invalid) { + if (methodInfo.memberAccesses == null) { + methodInfo.memberAccesses = new ArrayList<>(); + } + methodInfo.memberAccesses.add( + new ClassInfo.MethodInvalidMemberAccessInfo( + owner, + name, + descriptor, + methodLineNumber, + ClassInfo.MethodInvalidMemberAccessInfo.Operation.FIELD_CONFIGURED_INVALID)); + } + return; + } + + // Check if this is getting/putting a static field. We don't check + // whether the field is final or not until post-processing. + if (opcode == Opcodes.GETSTATIC || opcode == Opcodes.PUTSTATIC) { + if (methodInfo.memberAccesses == null) { + methodInfo.memberAccesses = new ArrayList<>(); + } + methodInfo.memberAccesses.add( + new ClassInfo.MethodInvalidMemberAccessInfo( + owner, + name, + descriptor, + methodLineNumber, + opcode == Opcodes.GETSTATIC + ? ClassInfo.MethodInvalidMemberAccessInfo.Operation.FIELD_STATIC_GET + : ClassInfo.MethodInvalidMemberAccessInfo.Operation.FIELD_STATIC_PUT)); + } + } + + // True if instruction should not be checked for invalidity + private boolean maybeSuppressInsn(String owner, String name, String descriptor) { + try { + // Check if suppression call + if ("io/temporal/workflowcheck/WorkflowCheck".equals(owner)) { + if ("suppressWarnings".equals(name)) { + String[] specificDescriptors = null; + // If there's a string, it must be an LDC or we ignore + if ("(Ljava/lang/String;)V".equals(descriptor)) { + // TODO(cretz): Should we throw instead of warn if this is not a constant string? + if (prevInsnLdcString == null) { + logger.log( + Level.WARNING, + "WorkflowCheck.suppressWarnings call not using string literal at {0}.{1} ({2})", + new Object[] {classInfo.name, methodName, fileLoc()}); + return true; + } + specificDescriptors = new String[] {prevInsnLdcString}; + } + if (suppressionStack == null) { + suppressionStack = new SuppressionStack(); + } + methodSuppressions++; + suppressionStack.push(specificDescriptors); + prevInsnLdcString = null; + return true; + } else if ("restoreWarnings".equals(name)) { + if (suppressionStack != null && methodSuppressions > 0) { + methodSuppressions--; + suppressionStack.pop(); + } else { + logger.log( + Level.WARNING, + "Restore with no previous suppression at {0}.{1} ({2})", + new Object[] {classInfo.name, methodName, fileLoc()}); + } + return true; + } + } + + // If suppressed, don't go any further + return suppressionStack != null + && suppressionStack.checkSuppressed(owner, name, descriptor); + } finally { + prevInsnLdcString = null; + } + } + + private String fileLoc() { + if (classInfo.fileName == null) { + if (methodLineNumber == null) { + return ""; + } + return ":" + methodLineNumber; + } + return classInfo.fileName + + ":" + + (methodLineNumber == null ? "" : methodLineNumber); + } + + @Override + public void visitLdcInsn(Object value) { + if (value instanceof String) { + prevInsnLdcString = (String) value; + } else { + prevInsnLdcString = null; + } + } + + @Override + public void visitInsn(int opcode) { + prevInsnLdcString = null; + } + + @Override + public void visitIntInsn(int opcode, int operand) { + prevInsnLdcString = null; + } + + @Override + public void visitVarInsn(int opcode, int varIndex) { + prevInsnLdcString = null; + } + + @Override + public void visitTypeInsn(int opcode, String type) { + prevInsnLdcString = null; + } + + @Override + public void visitInvokeDynamicInsn( + String name, + String descriptor, + Handle bootstrapMethodHandle, + Object... bootstrapMethodArguments) { + prevInsnLdcString = null; + } + + @Override + public void visitJumpInsn(int opcode, Label label) { + prevInsnLdcString = null; + } + + @Override + public void visitIincInsn(int varIndex, int increment) { + prevInsnLdcString = null; + } + + @Override + public void visitMultiANewArrayInsn(String descriptor, int numDimensions) { + prevInsnLdcString = null; + } + } +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassPath.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassPath.java new file mode 100644 index 0000000000..4da8907aec --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/ClassPath.java @@ -0,0 +1,118 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.io.File; +import java.io.IOException; +import java.net.URL; +import java.net.URLClassLoader; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.Enumeration; +import java.util.List; +import java.util.jar.JarEntry; +import java.util.jar.JarFile; + +/** Classpath helpers for a class loader to get all classes. */ +class ClassPath implements AutoCloseable { + static boolean isStandardLibraryClass(String name) { + return name.startsWith("java/") + || name.startsWith("javax/") + || name.startsWith("jdk/") + || name.startsWith("com/sun/"); + } + + final URLClassLoader classLoader; + // Non-standard-library classes only here + final List classes = new ArrayList<>(); + + ClassPath(String... classPaths) throws IOException { + List urls = new ArrayList<>(); + for (String classPath : classPaths) { + // If there is an `@` sign starting the classPath, instead read from a file + if (classPath.startsWith("@")) { + classPath = + new String( + Files.readAllBytes(Paths.get(classPath.substring(1))), StandardCharsets.UTF_8) + .trim(); + } + // Split and handle each entry + for (String entry : classPath.split(File.pathSeparator)) { + File file = new File(entry); + // Like javac and others, we just ignore non-existing entries + if (file.exists()) { + if (file.isDirectory()) { + urls.add(file.toURI().toURL()); + findClassesInDir("", file, classes); + } else if (entry.endsWith(".jar")) { + urls.add(file.getAbsoluteFile().toURI().toURL()); + findClassesInJar(file, classes); + } + } + } + } + classLoader = new URLClassLoader(urls.toArray(new URL[0])); + // Sort the classes to loaded in a deterministic order + classes.sort(String::compareTo); + } + + private static void findClassesInDir(String path, File dir, List classes) { + File[] files = dir.listFiles(); + if (files == null) { + return; + } + for (File file : files) { + if (file.isDirectory()) { + findClassesInDir(path + file.getName() + "/", file, classes); + } else if (file.getName().endsWith(".class")) { + addClass(path + file.getName(), classes); + } + } + } + + private static void findClassesInJar(File jar, List classes) throws IOException { + try (JarFile jarFile = new JarFile(jar)) { + Enumeration entries = jarFile.entries(); + while (entries.hasMoreElements()) { + JarEntry entry = entries.nextElement(); + if (entry.getName().endsWith(".class")) { + addClass(entry.getName(), classes); + } + } + } + } + + private static void addClass(String fullPath, List classes) { + // Trim off trailing .class + String className = fullPath.substring(0, fullPath.length() - 6); + // Only if not built in + if (!isStandardLibraryClass(className)) { + classes.add(className); + } + } + + @Override + public void close() throws IOException { + classLoader.close(); + } +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Config.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Config.java new file mode 100644 index 0000000000..3123a634db --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Config.java @@ -0,0 +1,51 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.io.IOException; +import java.io.InputStream; +import java.util.Properties; + +/** Configuration for workflow check. See README for configuration format. */ +public class Config { + /** Load the default set of config properties. */ + public static Properties defaultProperties() throws IOException { + Properties props = new Properties(); + try (InputStream is = Config.class.getResourceAsStream("workflowcheck.properties")) { + props.load(is); + } + return props; + } + + /** + * Create a new configuration from the given set of properties. Later properties with the same key + * overwrite previous ones, but more specific properties apply before less specific ones. + */ + public static Config fromProperties(Properties... props) { + return new Config(new DescriptorMatcher("invalid", props)); + } + + final DescriptorMatcher invalidMembers; + + private Config(DescriptorMatcher invalidMembers) { + this.invalidMembers = invalidMembers; + } +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/DescriptorMatcher.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/DescriptorMatcher.java new file mode 100644 index 0000000000..8ac8d357e1 --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/DescriptorMatcher.java @@ -0,0 +1,153 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.util.HashMap; +import java.util.Map; +import java.util.Properties; +import javax.annotation.Nullable; + +/** + * Matcher for a set of descriptors. Pattern is + * [[qualified/class/]Name.]memberName[(Lthe/Method/Desc;)V]. + */ +class DescriptorMatcher { + private final Map descriptors; + + DescriptorMatcher(Map descriptors) { + this.descriptors = descriptors; + } + + DescriptorMatcher(String category, Properties[] propSets) { + this(new HashMap<>()); + for (Properties props : propSets) { + addFromProperties(category, props); + } + } + + DescriptorMatcher(String[] positiveMatches) { + this(new HashMap<>(positiveMatches.length)); + for (String positiveMatch : positiveMatches) { + descriptors.put(positiveMatch, true); + } + } + + void addFromProperties(String category, Properties props) { + String prefix = "temporal.workflowcheck." + category + "."; + for (Map.Entry entry : props.entrySet()) { + // Key is temporal.workflowcheck..= + String key = (String) entry.getKey(); + if (!key.startsWith(prefix)) { + continue; + } + // Sanity check to confirm methods with descriptors need to _not_ have + // return values + int closeParenIndex = key.lastIndexOf(')'); + if (closeParenIndex > 0 && closeParenIndex != key.length() - 1) { + throw new IllegalArgumentException( + "Config key '" + key + "' should not have anything after ')'"); + } + String desc = key.substring(31); + String value = (String) entry.getValue(); + if ("true".equals(value)) { + descriptors.put(desc, true); + } else if ("false".equals(value)) { + descriptors.put(desc, false); + } else { + throw new IllegalArgumentException( + "Config key " + key + " supposed to be true or false, was " + value); + } + } + } + + @Nullable + Boolean check(String className, @Nullable String memberName, @Nullable String methodDescriptor) { + // Check full descriptor sans return, then full sans params, then just + // member, then just member sans params, then FQCN, and then each parent + // package. We remove return values from the method descriptor since the + // map only allows arguments. + if (methodDescriptor != null) { + methodDescriptor = methodDescriptor.substring(0, methodDescriptor.indexOf(')') + 1); + } + + // Member name + descriptor doesn't have to be present to check class + if (memberName != null) { + // Try qualified class with method + String classAndMember = className + "." + memberName; + if (methodDescriptor != null) { + Boolean invalid = descriptors.get(classAndMember + methodDescriptor); + if (invalid != null) { + return invalid; + } + } + Boolean invalid = descriptors.get(classAndMember); + if (invalid != null) { + return invalid; + } + // Try unqualified class with member + int slashIndex = className.lastIndexOf('/'); + if (slashIndex > 0) { + classAndMember = classAndMember.substring(slashIndex + 1); + if (methodDescriptor != null) { + invalid = descriptors.get(classAndMember + methodDescriptor); + if (invalid != null) { + return invalid; + } + } + invalid = descriptors.get(classAndMember); + if (invalid != null) { + return invalid; + } + } + // Just member + if (methodDescriptor != null) { + invalid = descriptors.get(memberName + methodDescriptor); + if (invalid != null) { + return invalid; + } + } + invalid = descriptors.get(memberName); + if (invalid != null) { + return invalid; + } + } + // Unqualified class name + int slashIndex = className.lastIndexOf('/'); + if (slashIndex > 0) { + Boolean invalid = descriptors.get(className.substring(slashIndex + 1)); + if (invalid != null) { + return invalid; + } + } + // All packages above class + while (true) { + Boolean invalid = descriptors.get(className); + if (invalid != null) { + return invalid; + } + int slash = className.lastIndexOf('/'); + if (slash == -1) { + return null; + } + className = className.substring(0, slash); + } + } +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Loader.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Loader.java new file mode 100644 index 0000000000..030d8f5ac5 --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Loader.java @@ -0,0 +1,396 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.io.IOException; +import java.io.InputStream; +import java.util.*; +import javax.annotation.Nullable; +import org.objectweb.asm.ClassReader; +import org.objectweb.asm.Opcodes; + +/** + * Loader that loads the classes, caches them, and does the work to determine invalidity across + * classes (and clean up the classes). + */ +class Loader { + private final Config config; + private final ClassPath classPath; + private final Map classes = new HashMap<>(); + + Loader(Config config, ClassPath classPath) { + this.config = config; + this.classPath = classPath; + } + + ClassInfo loadClass(String className) { + return classes.computeIfAbsent( + className, + v -> { + try (InputStream is = classPath.classLoader.getResourceAsStream(className + ".class")) { + if (is == null) { + // We are going to just make a dummy when we can't find a class + // TODO(cretz): Warn? + ClassInfo info = new ClassInfo(); + info.access = Opcodes.ACC_SYNTHETIC; + info.name = className; + return info; + } + ClassInfoVisitor visitor = new ClassInfoVisitor(config); + new ClassReader(is).accept(visitor, ClassReader.SKIP_FRAMES); + return visitor.classInfo; + } catch (IOException e) { + throw new RuntimeException(e); + } + }); + } + + @Nullable + ClassInfo.MethodWorkflowImplInfo findWorkflowImplInfo( + ClassInfo on, String implClassName, String implMethodName, String implMethodDescriptor) { + // Check my own methods + List methods = on.methods.get(implMethodName); + if (methods != null) { + for (ClassInfo.MethodInfo method : methods) { + if (method.workflowDecl != null + && isMethodOverride(on, method, implClassName, implMethodDescriptor)) { + return new ClassInfo.MethodWorkflowImplInfo(on, method.workflowDecl); + } + } + } + // Check super class then super interfaces (we don't care about the + // potential duplicate checks, better than maintaining an already-seen map) + if (on.superClass != null && !ClassPath.isStandardLibraryClass(on.superClass)) { + ClassInfo.MethodWorkflowImplInfo info = + findWorkflowImplInfo( + loadClass(on.superClass), implClassName, implMethodName, implMethodDescriptor); + if (info != null) { + return info; + } + } + if (on.superInterfaces != null) { + for (String iface : on.superInterfaces) { + if (!ClassPath.isStandardLibraryClass(iface)) { + ClassInfo.MethodWorkflowImplInfo info = + findWorkflowImplInfo( + loadClass(iface), implClassName, implMethodName, implMethodDescriptor); + if (info != null) { + return info; + } + } + } + } + return null; + } + + void processMethodValidity(ClassInfo.MethodInfo method, Set processing) { + // If it has no member accesses (possibly actually has no calls/fields or + // just has configured-invalid already set) or already processed, do + // nothing. This of course means that recursion does not apply for + // invalidity. + if (method.memberAccesses == null || processing.contains(method)) { + return; + } + // Go over every call and check whether invalid + processing.add(method); + for (ClassInfo.MethodInvalidMemberAccessInfo memberAccess : method.memberAccesses) { + boolean invalid = false; + switch (memberAccess.operation) { + case FIELD_CONFIGURED_INVALID: + // This is always considered invalid + invalid = true; + break; + case FIELD_STATIC_GET: + case FIELD_STATIC_PUT: + // This is considered invalid if the class has the field as a + // non-final static + memberAccess.resolvedInvalidClass = loadClass(memberAccess.className); + invalid = + memberAccess.resolvedInvalidClass.nonFinalStaticFields != null + && memberAccess.resolvedInvalidClass.nonFinalStaticFields.contains( + memberAccess.memberName); + break; + case METHOD_CALL: + // A call is considered invalid/valid if: + // * Configured invalid set in the hierarchy (most-specific wins) + // * Actual impl of the method has invalid calls + ClassInfo callClass = loadClass(memberAccess.className); + + ConfiguredInvalidResolution configResolution = new ConfiguredInvalidResolution(); + resolveConfiguredInvalid( + callClass, + memberAccess.memberName, + memberAccess.memberDescriptor, + 0, + configResolution); + if (configResolution.value != null) { + if (configResolution.value) { + memberAccess.resolvedInvalidClass = configResolution.classFoundOn; + invalid = true; + } + break; + } + + MethodResolution methodResolution = new MethodResolution(); + resolveMethod( + loadClass(memberAccess.className), + memberAccess.className, + memberAccess.memberName, + memberAccess.memberDescriptor, + methodResolution); + if (methodResolution.implClass != null) { + // Process invalidity on this method, then check if it's invalid + processMethodValidity(methodResolution.implMethod, processing); + if (methodResolution.implMethod.isInvalid()) { + memberAccess.resolvedInvalidClass = methodResolution.implClass; + memberAccess.resolvedInvalidMethod = methodResolution.implMethod; + invalid = true; + } + } + break; + } + if (invalid) { + if (method.invalidMemberAccesses == null) { + method.invalidMemberAccesses = new ArrayList<>(1); + } + method.invalidMemberAccesses.add(memberAccess); + } + } + // Unset the member accesses now that we've processed them + method.memberAccesses = null; + // Sort invalid accesses if there are any + if (method.invalidMemberAccesses != null) { + method.invalidMemberAccesses.sort(Comparator.comparingInt(m -> m.line == null ? -1 : m.line)); + } + processing.remove(method); + } + + private static class ConfiguredInvalidResolution { + private ClassInfo classFoundOn; + private int depthFoundOn; + private Boolean value; + } + + private void resolveConfiguredInvalid( + ClassInfo on, + String methodName, + String methodDescriptor, + int depth, + ConfiguredInvalidResolution resolution) { + // First check myself + Boolean configuredInvalid = config.invalidMembers.check(on.name, methodName, methodDescriptor); + if (configuredInvalid != null + && isMoreSpecific(resolution.classFoundOn, resolution.depthFoundOn, on, depth)) { + resolution.classFoundOn = on; + resolution.depthFoundOn = depth; + resolution.value = configuredInvalid; + } + + // Now check super class and super interfaces. We don't care enough to + // prevent re-checking diamonds. + if (on.superClass != null) { + resolveConfiguredInvalid( + loadClass(on.superClass), methodName, methodDescriptor, depth + 1, resolution); + } + if (on.superInterfaces != null) { + for (String iface : on.superInterfaces) { + resolveConfiguredInvalid( + loadClass(iface), methodName, methodDescriptor, depth + 1, resolution); + } + } + } + + private static class MethodResolution { + ClassInfo implClass; + ClassInfo.MethodInfo implMethod; + } + + private void resolveMethod( + ClassInfo on, + String callClassName, + String callMethodName, + String callMethodDescriptor, + MethodResolution resolution) { + // First, see if the method is even on this class + List methods = on.methods.get(callMethodName); + if (methods != null) { + for (ClassInfo.MethodInfo method : methods) { + // Only methods with bodies apply + if ((method.access & Opcodes.ACC_ABSTRACT) != 0 + || (method.access & Opcodes.ACC_NATIVE) != 0) { + continue; + } + // To qualify, method descriptor must match if same call class name, or + // method must be an override if different call class name + if ((callClassName.equals(on.name) && method.descriptor.equals(callMethodDescriptor)) + || isMethodOverride(on, method, callClassName, callMethodDescriptor)) { + // If we have a body and impl hasn't been sent, this is the impl. + // Otherwise, we have to check whether it's more specific. Depth does + // not matter because Java compiler won't allow ambiguity here (i.e. + // multiple unrelated interface defaults). + if (isMoreSpecific(resolution.implClass, 0, on, 0)) { + resolution.implClass = on; + resolution.implMethod = method; + // If this is not an interface, we're done trying to find others + if ((method.access & Opcodes.ACC_INTERFACE) == 0) { + return; + } + } + break; + } + } + } + + // Now check super class and super interfaces. We don't care enough to + // prevent re-checking diamonds. + if (on.superClass != null) { + resolveMethod( + loadClass(on.superClass), + callClassName, + callMethodName, + callMethodDescriptor, + resolution); + } + if (on.superInterfaces != null) { + for (String iface : on.superInterfaces) { + resolveMethod( + loadClass(iface), callClassName, callMethodName, callMethodDescriptor, resolution); + } + } + } + + private boolean isMoreSpecific( + @Nullable ClassInfo prevClass, int prevDepth, ClassInfo newClass, int newDepth) { + // If there is no prev, this is always more specific + if (prevClass == null) { + return true; + } + + // If the prev class is not an interface, it is always more specific, then + // apply that logic to new over any interface that may have been seen + if ((prevClass.access & Opcodes.ACC_INTERFACE) == 0) { + return false; + } else if ((newClass.access & Opcodes.ACC_INTERFACE) == 0) { + return true; + } + + // Now that we know they are both interfaces, if the new class is a + // sub-interface of the prev class, it is more specific. For default-method + // resolution purposes, Java would disallow two independent implementations + // of the same default method on independent interfaces. But this isn't for + // default purposes, so there can be multiple. In this rare case, we will + // choose which has the least depth, and in the rarer case they are the + // same depth, we just leave previous. + if (isAssignableFrom(prevClass.name, newClass)) { + return true; + } else if (!isAssignableFrom(newClass.name, prevClass)) { + return false; + } + return newDepth < prevDepth; + } + + // Expects name check to already be done + private boolean isMethodOverride( + ClassInfo superClass, + ClassInfo.MethodInfo superMethod, + // If null, package-private not verified + @Nullable String subClassName, + String subMethodDescriptor) { + // Final, static, or private are never inherited + int superAccess = superMethod.access; + if ((superAccess & Opcodes.ACC_FINAL) != 0 + || (superAccess & Opcodes.ACC_STATIC) != 0 + || (superAccess & Opcodes.ACC_PRIVATE) != 0) { + return false; + } + // Package-private only inherited if same package + if (subClassName != null + && (superAccess & Opcodes.ACC_PUBLIC) == 0 + && (superAccess & Opcodes.ACC_PROTECTED) == 0) { + int slashIndex = superClass.name.lastIndexOf('/'); + if (slashIndex == 0 + || !subClassName.startsWith(superClass.name.substring(0, slashIndex + 1))) { + return false; + } + } + // Check descriptor. This can have a covariant return, so this must check + // exact args first then return covariance. + String superDesc = superMethod.descriptor; + // Simple equality perf shortcut + if (superDesc.equals(subMethodDescriptor)) { + return true; + } + // Since it didn't match exact, check up to end paren if both have ")L" + int endParen = superDesc.lastIndexOf(')'); + if (endParen >= subMethodDescriptor.length() + || subMethodDescriptor.charAt(endParen) != ')' + || superDesc.charAt(endParen + 1) != 'L' + || subMethodDescriptor.charAt(endParen + 1) != 'L') { + return false; + } + // Check args + if (!subMethodDescriptor.regionMatches(0, superMethod.descriptor, 0, endParen + 1)) { + return false; + } + // Check super return is same or super of sub return (after 'L', before end ';') + return isAssignableFrom( + superMethod.descriptor.substring(endParen + 2, superMethod.descriptor.length() - 1), + subMethodDescriptor.substring(endParen + 2, subMethodDescriptor.length() - 1)); + } + + private boolean isAssignableFrom(String sameOrSuperOfSubject, String subject) { + if (sameOrSuperOfSubject.equals(subject)) { + return true; + } + return isAssignableFrom(sameOrSuperOfSubject, loadClass(subject)); + } + + private boolean isAssignableFrom(String sameOrSuperOfSubject, ClassInfo subject) { + if (sameOrSuperOfSubject.equals(subject.name)) { + return true; + } + if (sameOrSuperOfSubject.equals(subject.superClass)) { + return true; + } + if (subject.superInterfaces != null) { + for (String iface : subject.superInterfaces) { + if (sameOrSuperOfSubject.equals(iface)) { + return true; + } + } + } + // Since there were no direct matches, now check if subject super classes + // or interfaces match + if (subject.superClass != null) { + if (isAssignableFrom(sameOrSuperOfSubject, loadClass(subject.superClass))) { + return true; + } + } + if (subject.superInterfaces != null) { + for (String iface : subject.superInterfaces) { + if (isAssignableFrom(sameOrSuperOfSubject, loadClass(iface))) { + return true; + } + } + } + return false; + } +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Main.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Main.java new file mode 100644 index 0000000000..34dd0b8b02 --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Main.java @@ -0,0 +1,143 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.io.FileInputStream; +import java.io.IOException; +import java.util.*; +import java.util.stream.Collectors; + +/** Entrypoint for CLI. */ +public class Main { + public static void main(String[] args) throws IOException { + if (args.length == 0 || "--help".equals(args[0])) { + System.err.println( + "Analyze Temporal workflows for common mistakes.\n" + + "\n" + + "Usage:\n" + + " workflowcheck [command]\n" + + "\n" + + "Commands:\n" + + " check - Check all workflow code on the classpath for invalid calls\n" + + " prebuild-config - Pre-build a config for certain packages to keep from scanning each time (TODO)"); + return; + } + switch (args[0]) { + case "check": + System.exit(check(Arrays.copyOfRange(args, 1, args.length))); + case "prebuild-config": + System.exit(prebuildConfig(Arrays.copyOfRange(args, 1, args.length))); + default: + System.err.println("Unrecognized command '" + args[0] + "'"); + System.exit(1); + } + } + + private static int check(String[] args) throws IOException { + if (args.length == 1 && "--help".equals(args[0])) { + System.err.println( + "Analyze Temporal workflows for common mistakes.\n" + + "\n" + + "Usage:\n" + + " workflowcheck check [--config ] [--no-default-config] [--show-valid]"); + return 0; + } + // Args list that removes options as encountered + List argsList = new ArrayList<>(Arrays.asList(args)); + + // Load config + List configProps = new ArrayList<>(); + if (!argsList.remove("--no-default-config")) { + configProps.add(Config.defaultProperties()); + } + while (true) { + int configIndex = argsList.indexOf("--config"); + if (configIndex == -1) { + break; + } else if (configIndex == argsList.size() - 1) { + System.err.println("Missing --config value"); + return 1; + } + argsList.remove(configIndex); + Properties props = new Properties(); + try (FileInputStream is = new FileInputStream(argsList.remove(configIndex))) { + props.load(is); + } + configProps.add(props); + } + + // Whether we should also show valid + boolean showValid = argsList.remove("--show-valid"); + + // Ensure that we have at least one classpath arg + if (argsList.isEmpty()) { + System.err.println("At least one classpath argument required"); + return 1; + } + // While it can rarely be possible for the first file in a class path string + // to start with a dash, we're going to assume it's an invalid argument and + // users can qualify if needed. + Optional invalidArg = argsList.stream().filter(s -> s.startsWith("-")).findFirst(); + if (invalidArg.isPresent()) { + System.err.println("Unrecognized argument: " + invalidArg); + } + + System.err.println("Analyzing classpath for classes with workflow methods..."); + Config config = Config.fromProperties(configProps.toArray(new Properties[0])); + List infos = + new WorkflowCheck(config).findWorkflowClasses(argsList.toArray(new String[0])); + System.out.println("Found " + infos.size() + " class(es) with workflow methods"); + if (infos.isEmpty()) { + return 0; + } + + // Print workflow methods impls + boolean anyInvalidImpls = false; + for (ClassInfo info : infos) { + List>> methodEntries = + info.methods.entrySet().stream() + .sorted(Map.Entry.comparingByKey()) + .collect(Collectors.toList()); + for (Map.Entry> methods : methodEntries) { + for (ClassInfo.MethodInfo method : methods.getValue()) { + // Only impls + if (method.workflowImpl == null) { + continue; + } + if (showValid || method.isInvalid()) { + System.out.println(Printer.methodText(info, methods.getKey(), method)); + } + if (method.isInvalid()) { + anyInvalidImpls = true; + } + } + } + } + return anyInvalidImpls ? 1 : 0; + } + + private static int prebuildConfig(String[] args) { + System.err.println("TODO"); + return 1; + } + + private Main() {} +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Printer.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Printer.java new file mode 100644 index 0000000000..7abf27ca49 --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/Printer.java @@ -0,0 +1,159 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.util.Collections; +import java.util.IdentityHashMap; +import java.util.Set; +import javax.annotation.Nullable; +import org.objectweb.asm.Type; + +/** Helpers for printing results. */ +class Printer { + static String methodText( + ClassInfo classInfo, String methodName, ClassInfo.MethodInfo methodInfo) { + Printer printer = new Printer(); + printer.appendMethod( + classInfo, methodName, methodInfo, "", Collections.newSetFromMap(new IdentityHashMap<>())); + return printer.bld.toString(); + } + + private final StringBuilder bld = new StringBuilder(); + + private void appendMethod( + ClassInfo classInfo, + String methodName, + ClassInfo.MethodInfo methodInfo, + String indent, + Set seenMethods) { + seenMethods.add(methodInfo); + bld.append(indent); + if (methodInfo.workflowImpl != null) { + bld.append("Workflow method "); + appendFriendlyMember(classInfo.name, methodName, methodInfo.descriptor); + bld.append(" (declared on "); + appendFriendlyClassName(methodInfo.workflowImpl.declClassInfo.name); + bld.append(")"); + } else { + bld.append("Method "); + appendFriendlyMember(classInfo.name, methodName, methodInfo.descriptor); + } + if (!methodInfo.isInvalid()) { + bld.append(" is valid\n"); + } else if (methodInfo.configuredInvalid != null) { + bld.append(" is configured as invalid\n"); + } else if (seenMethods.size() > 30) { + bld.append(" is invalid (stack depth exceeded, stopping here)\n"); + } else if (methodInfo.invalidMemberAccesses != null) { + bld.append(" has ") + .append(methodInfo.invalidMemberAccesses.size()) + .append(" invalid member access"); + if (methodInfo.invalidMemberAccesses.size() > 1) { + bld.append("es"); + } + bld.append(":\n"); + for (ClassInfo.MethodInvalidMemberAccessInfo memberAccess : + methodInfo.invalidMemberAccesses) { + appendInvalidMemberAccess(classInfo, memberAccess, indent + " ", seenMethods); + } + } else { + // Should not happen + bld.append(" is invalid for unknown reasons\n"); + } + seenMethods.remove(methodInfo); + } + + private void appendInvalidMemberAccess( + ClassInfo callerClassInfo, + ClassInfo.MethodInvalidMemberAccessInfo accessInfo, + String indent, + Set seenMethods) { + bld.append(indent); + if (callerClassInfo.fileName == null) { + bld.append(""); + } else { + bld.append(callerClassInfo.fileName); + if (accessInfo.line != null) { + bld.append(':').append(accessInfo.line); + } + } + switch (accessInfo.operation) { + case FIELD_CONFIGURED_INVALID: + bld.append(" references "); + appendFriendlyMember(accessInfo.className, accessInfo.memberName, null); + bld.append(" which is configured as invalid\n"); + break; + case FIELD_STATIC_GET: + bld.append(" gets "); + appendFriendlyMember(accessInfo.className, accessInfo.memberName, null); + bld.append(" which is a non-final static field\n"); + break; + case FIELD_STATIC_PUT: + bld.append(" sets "); + appendFriendlyMember(accessInfo.className, accessInfo.memberName, null); + bld.append(" which is a non-final static field\n"); + break; + case METHOD_CALL: + bld.append(" invokes "); + appendFriendlyMember( + accessInfo.className, accessInfo.memberName, accessInfo.memberDescriptor); + if (accessInfo.resolvedInvalidClass == null) { + // Should never happen + bld.append(" (resolution failed)\n"); + } else if (accessInfo.resolvedInvalidMethod == null) { + bld.append(" which is configured as invalid\n"); + } else if (seenMethods.contains(accessInfo.resolvedInvalidMethod)) { + // Should not happen + bld.append(" (unexpected recursion)\n"); + } else { + bld.append(":\n"); + appendMethod( + accessInfo.resolvedInvalidClass, + accessInfo.memberName, + accessInfo.resolvedInvalidMethod, + indent + " ", + seenMethods); + } + break; + } + } + + private void appendFriendlyClassName(String className) { + bld.append(className.replace('/', '.')); + } + + private void appendFriendlyMember( + String className, String memberName, @Nullable String methodDescriptor) { + appendFriendlyClassName(className); + bld.append('.').append(memberName); + if (methodDescriptor != null) { + bld.append('('); + Type[] argTypes = Type.getArgumentTypes(methodDescriptor); + for (int i = 0; i < argTypes.length; i++) { + if (i > 0) { + bld.append(", "); + } + bld.append(argTypes[i].getClassName()); + } + bld.append(')'); + } + } +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/SuppressionStack.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/SuppressionStack.java new file mode 100644 index 0000000000..3fde9ec861 --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/SuppressionStack.java @@ -0,0 +1,59 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.util.Deque; +import java.util.LinkedList; +import javax.annotation.Nullable; + +/** Utility to push/pop configured suppressions. */ +class SuppressionStack { + // If a value is null, that means suppress all + private final Deque stack = new LinkedList<>(); + + // If null or empty string array given, all things suppressed + void push(@Nullable String[] specificDescriptors) { + if (specificDescriptors == null || specificDescriptors.length == 0) { + stack.push(null); + } else { + stack.push(new DescriptorMatcher(specificDescriptors)); + } + } + + void pop() { + stack.pop(); + } + + boolean checkSuppressed(String className, String methodName, String methodDescriptor) { + // Since suppressions are only additive, we can iterate in any order we want + for (DescriptorMatcher matcher : stack) { + // If matcher is null, that means suppress all + if (matcher == null) { + return true; + } + Boolean suppressed = matcher.check(className, methodName, methodDescriptor); + if (suppressed != null && suppressed) { + return true; + } + } + return false; + } +} diff --git a/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/WorkflowCheck.java b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/WorkflowCheck.java new file mode 100644 index 0000000000..882f8e6ee4 --- /dev/null +++ b/temporal-workflowcheck/src/main/java/io/temporal/workflowcheck/WorkflowCheck.java @@ -0,0 +1,158 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.io.IOException; +import java.lang.annotation.ElementType; +import java.lang.annotation.Target; +import java.util.*; +import org.objectweb.asm.Opcodes; + +/** Utilities to help validate workflow correctness. */ +public class WorkflowCheck { + /** + * Suppress all invalid-workflow warnings until the matching call to {@link #restoreWarnings()}. + * This must be accompanied by a closing {@link #restoreWarnings()}. A more specific form of this + * that suppresses only certain warnings is at {@link #suppressWarnings(String)}. Note, this does + * not respect logical order, but rather bytecode order. Users are encouraged to use the {@link + * SuppressWarnings} annotation instead. + */ + public static void suppressWarnings() {} + + /** + * Suppress invalid-workflow warnings that apply to this descriptor until the matching call to + * {@link #restoreWarnings()}. This must be accompanied by a closing {@link #restoreWarnings()}. A + * more generic form of this that suppresses only certain warnings is at {@link + * #suppressWarnings()}. Note, this does not respect logical order, but rather bytecode order. + * Users are encouraged to use the {@link SuppressWarnings} annotation instead. + */ + public static void suppressWarnings(String specificDesc) {} + + /** Restore warnings suppressed via suppressWarnings calls. */ + public static void restoreWarnings() {} + + /** + * Suppress warnings on the class or method this is put on. If invalidMembers is provided, + * this only suppresses those specific descriptors. Otherwise this suppresses all. + */ + @Target({ElementType.TYPE, ElementType.METHOD, ElementType.CONSTRUCTOR}) + public @interface SuppressWarnings { + // Note, intentionally not called "value" for the default because there may + // be other warnings to suppress in the future + + /** Descriptors for invalid members to suppress. If empty/unset, this suppresses all. */ + String[] invalidMembers() default {}; + } + + private final Config config; + + /** Create a new workflow check with the given config. */ + public WorkflowCheck(Config config) { + this.config = config; + } + + /** + * Scan the given classpaths finding all classes with workflow implementation methods, and check + * them for validity. This returns all classes that have at least one method whose {@link + * ClassInfo.MethodInfo#getWorkflowImpl()} is non-null. + */ + public List findWorkflowClasses(String... classPaths) throws IOException { + // Load all non-built-in classes' methods to find workflow impls + List workflowClasses = new ArrayList<>(); + try (ClassPath classPath = new ClassPath(classPaths)) { + Loader loader = new Loader(config, classPath); + for (String className : classPath.classes) { + ClassInfo info = loader.loadClass(className); + boolean hasWorkflowImpl = false; + for (Map.Entry> methodEntry : info.methods.entrySet()) { + for (ClassInfo.MethodInfo method : methodEntry.getValue()) { + // Workflow impl method must be non-static public with a body + if ((method.access & Opcodes.ACC_STATIC) == 0 + && (method.access & Opcodes.ACC_PUBLIC) != 0 + && (method.access & Opcodes.ACC_ABSTRACT) == 0 + && (method.access & Opcodes.ACC_NATIVE) == 0) { + method.workflowImpl = + loader.findWorkflowImplInfo( + info, info.name, methodEntry.getKey(), method.descriptor); + // We need to check for method validity only if it's an impl + if (method.workflowImpl != null) { + hasWorkflowImpl = true; + loader.processMethodValidity( + method, Collections.newSetFromMap(new IdentityHashMap<>())); + } + } + } + } + if (hasWorkflowImpl) { + workflowClasses.add(info); + } + } + } + + // Now that we have processed all invalidity on each class, trim off + // unimportant class pieces + Set trimmed = Collections.newSetFromMap(new IdentityHashMap<>()); + workflowClasses.forEach(info -> trimUnimportantClassInfo(info, trimmed)); + + // Sort classes by class name and return + workflowClasses.sort(Comparator.comparing(c -> c.name)); + return workflowClasses; + } + + private void trimUnimportantClassInfo(ClassInfo info, Set done) { + done.add(info); + // Remove non-final static fields, they are only needed during processing + info.nonFinalStaticFields = null; + // Remove unimportant methods (i.e. without workflow info and are valid), + // and remove entire list if none left + info.methods + .entrySet() + .removeIf( + methods -> { + methods + .getValue() + .removeIf( + method -> { + // If the method has an impl and decl class not already trimmed, trim it + if (method.workflowImpl != null + && !done.contains(method.workflowImpl.declClassInfo)) { + trimUnimportantClassInfo(method.workflowImpl.declClassInfo, done); + } + // Recursively trim classes on calls too for each not already done + if (method.invalidMemberAccesses != null) { + for (ClassInfo.MethodInvalidMemberAccessInfo access : + method.invalidMemberAccesses) { + if (access.resolvedInvalidClass != null + && !done.contains(access.resolvedInvalidClass)) { + trimUnimportantClassInfo(access.resolvedInvalidClass, done); + } + } + } + // Set to remove if nothing important on it + return method.workflowDecl == null + && method.workflowImpl == null + && (method.configuredInvalid == null || method.configuredInvalid) + && method.invalidMemberAccesses == null; + }); + return methods.getValue().isEmpty(); + }); + } +} diff --git a/temporal-workflowcheck/src/main/resources/io/temporal/workflowcheck/workflowcheck.properties b/temporal-workflowcheck/src/main/resources/io/temporal/workflowcheck/workflowcheck.properties new file mode 100644 index 0000000000..0486798275 --- /dev/null +++ b/temporal-workflowcheck/src/main/resources/io/temporal/workflowcheck/workflowcheck.properties @@ -0,0 +1,184 @@ +# +# Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. +# +# Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. +# +# Modifications copyright (C) 2017 Uber Technologies, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this material except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +#### Invalid Calls #### +# Rules for this file: +# * Every section is separated by a ### heading +# * Groups within those sections just have a simple # heading for comments +# * Should alphabetize where reasonable +# * Always fully qualify classes of methods +### Random ### + +temporal.workflowcheck.invalid.java/lang/Math.random=true +temporal.workflowcheck.invalid.java/security/SecureRandom=true +temporal.workflowcheck.invalid.java/util/Random.()=true +temporal.workflowcheck.invalid.java/util/UUID.randomUUID=true + +### Time ### + +# All Clock and InstantSource calls disallowed +temporal.workflowcheck.invalid.java/time/Clock=true +temporal.workflowcheck.invalid.java/time/InstantSource=true + +# Any accessing current time is disallowed +temporal.workflowcheck.invalid.java/lang/System.currentTimeMillis=true +temporal.workflowcheck.invalid.java/lang/System.nanoTime=true +temporal.workflowcheck.invalid.java/time/Clock.system=true +temporal.workflowcheck.invalid.java/time/Clock.systemDefaultZone=true +temporal.workflowcheck.invalid.java/time/Clock.systemUTC=true +temporal.workflowcheck.invalid.java/time/Clock.tickMillis=true +temporal.workflowcheck.invalid.java/time/Clock.tickMinutes=true +temporal.workflowcheck.invalid.java/time/Clock.tickSeconds=true +temporal.workflowcheck.invalid.java/time/Instant.now=true +temporal.workflowcheck.invalid.java/time/LocalDate.now=true +temporal.workflowcheck.invalid.java/time/LocalDateTime.now=true +temporal.workflowcheck.invalid.java/time/LocalTime.now=true +temporal.workflowcheck.invalid.java/time/OffsetDateTime.now=true +temporal.workflowcheck.invalid.java/time/OffsetTime.now=true +temporal.workflowcheck.invalid.java/time/ZonedDateTime.now=true +temporal.workflowcheck.invalid.java/util/Calendar.getInstance=true +temporal.workflowcheck.invalid.java/util/Date.()=true + +### Collections ### + +# Disallow iteration over high-level collection without it being a safer type. +# We expect many may disable this overly strict rule. We also expect +# LinkedHashSet/Map and SortedSet/Map to be those specific types when asking +# for iterators. + +temporal.workflowcheck.invalid.java/lang/Iterable.forEach=true +temporal.workflowcheck.invalid.java/lang/Iterable.iterator=true +temporal.workflowcheck.invalid.java/lang/Iterable.spliterator=true +temporal.workflowcheck.invalid.java/util/Collection.parallelStream=true +temporal.workflowcheck.invalid.java/util/Collection.stream=true +temporal.workflowcheck.invalid.java/util/Collection.toArray=true + +# Many collections are safe +temporal.workflowcheck.invalid.java/util/ArrayDeque=false +temporal.workflowcheck.invalid.java/util/LinkedHashMap=false +temporal.workflowcheck.invalid.java/util/LinkedHashSet=false +temporal.workflowcheck.invalid.java/util/List=false +temporal.workflowcheck.invalid.java/util/SortedMap=false +temporal.workflowcheck.invalid.java/util/SortedSet=false + +### System (disk, network, OS, etc) ### + +temporal.workflowcheck.invalid.java/io/File=true +temporal.workflowcheck.invalid.java/io/FileInputStream=true +temporal.workflowcheck.invalid.java/io/FileOutputStream=true +temporal.workflowcheck.invalid.java/io/FileReader=true +temporal.workflowcheck.invalid.java/io/FileWriter=true +temporal.workflowcheck.invalid.java/io/RandomAccessFile=true +temporal.workflowcheck.invalid.java/lang/ClassLoader.getResourceAsStream=true +temporal.workflowcheck.invalid.java/lang/System.clearProperty=true +temporal.workflowcheck.invalid.java/lang/System.console=true +temporal.workflowcheck.invalid.java/lang/System.err=true +temporal.workflowcheck.invalid.java/lang/System.exit=true +temporal.workflowcheck.invalid.java/lang/System.getProperties=true +temporal.workflowcheck.invalid.java/lang/System.getProperty=true +temporal.workflowcheck.invalid.java/lang/System.getenv=true +# We usually would disallow identityHashCode since it's non-deterministic +# across processes, but a lot of simple libraries use it internally +# temporal.workflowcheck.invalid.java/lang/System.identityHashCode=true +temporal.workflowcheck.invalid.java/lang/System.in=true +temporal.workflowcheck.invalid.java/lang/System.load=true +temporal.workflowcheck.invalid.java/lang/System.loadLibrary=true +temporal.workflowcheck.invalid.java/lang/System.mapLibraryName=true +temporal.workflowcheck.invalid.java/lang/System.out=true +temporal.workflowcheck.invalid.java/lang/System.setErr=true +temporal.workflowcheck.invalid.java/lang/System.setIn=true +temporal.workflowcheck.invalid.java/lang/System.setOut=true +temporal.workflowcheck.invalid.java/lang/System.setProperties=true +temporal.workflowcheck.invalid.java/lang/System.setProperty=true +temporal.workflowcheck.invalid.java/net/DatagramSocket=true +temporal.workflowcheck.invalid.java/net/ServerSocket=true +temporal.workflowcheck.invalid.java/net/Socket=true +temporal.workflowcheck.invalid.java/net/URL.openConnection=true +temporal.workflowcheck.invalid.java/net/URL.openStream=true +temporal.workflowcheck.invalid.java/nio/channels/AsynchronousChannel=true +temporal.workflowcheck.invalid.java/nio/channels/FileChannel=true +temporal.workflowcheck.invalid.java/nio/channels/NetworkChannel=true +temporal.workflowcheck.invalid.java/nio/file/FileSystem=true +temporal.workflowcheck.invalid.java/nio/file/Files=true +temporal.workflowcheck.invalid.java/nio/file/Path.toAbsolutePath=true +temporal.workflowcheck.invalid.java/nio/file/Path.toRealPath=true +temporal.workflowcheck.invalid.java/nio/file/WatchService=true + +### Threading/concurrency ### + +temporal.workflowcheck.invalid.java/lang/Object.notify=true +temporal.workflowcheck.invalid.java/lang/Object.notifyAll=true +temporal.workflowcheck.invalid.java/lang/Object.wait=true +temporal.workflowcheck.invalid.java/lang/Thread=true +# We intentionally don't include many concurrent collections here because that +# something is thread-safe doesn't mean it's non-deterministic. There are +# plenty of non-deterministic calls (e.g. BlockingQueue.poll) that can be used +# in deterministic ways, but we are not strictly enforcing this either. +temporal.workflowcheck.invalid.java/util/concurrent/CompletableFuture=true +temporal.workflowcheck.invalid.java/util/concurrent/CountDownLatch=true +temporal.workflowcheck.invalid.java/util/concurrent/CyclicBarrier=true +temporal.workflowcheck.invalid.java/util/concurrent/Executor=true +temporal.workflowcheck.invalid.java/util/concurrent/ExecutorService=true +temporal.workflowcheck.invalid.java/util/concurrent/Executors=true +temporal.workflowcheck.invalid.java/util/concurrent/Future=true +temporal.workflowcheck.invalid.java/util/concurrent/Phaser=true +temporal.workflowcheck.invalid.java/util/concurrent/Semaphore=true +# We are being lazy and just disallowing all locks. Users can override specific +# things as needed. +temporal.workflowcheck.invalid.java/util/concurrent/locks=true + +### Specific overrides ### + +# Temporal workflow package is ok +temporal.workflowcheck.invalid.io/temporal/workflow=false + +# We're whitelisting java.util.logging due to its heavy use +temporal.workflowcheck.invalid.java/util/logging=false + +# Consider everything on Class, Throwable, and String to be acceptable due to +# so many transitive false positives (even though many times the calls are in +# fact not safe) +temporal.workflowcheck.invalid.java/lang/Class=false +temporal.workflowcheck.invalid.java/lang/String=false +temporal.workflowcheck.invalid.java/lang/Throwable=false + +# In newer Java, HashMap init invokes StringBuilder to append a float which +# does jdk.internal.math.FloatingDecimal.getBinaryToASCIIBuffer() which uses +# thread local. We'll just make all uses of string builder safe. +temporal.workflowcheck.invalid.java/lang/StringBuilder=false + +# After much thought, we are going to allow reflection by default. So many +# deterministic Java libraries use it, and we want this tool to not be so +# strict that people are constantly overriding false positives. +temporal.workflowcheck.invalid.java/lang/reflect=false + +# Quite a few internal libraries catch interrupts just to re-interrupt, so we +# will mark thread interrupt as safe (other thread stuff is not) +temporal.workflowcheck.invalid.java/lang/Thread.currentThread=false +temporal.workflowcheck.invalid.java/lang/Thread.interrupt=false + +# While technically line separators are platform specific, in practice many +# people don't run workers across platforms and this is used by lots of string +# building code. +temporal.workflowcheck.invalid.java/lang/System.lineSeparator=false + +# Technically path making does some low-level filesystem calls, but we can +# consider it ok for most workflow use +temporal.workflowcheck.invalid.java/nio/file/Paths.get=false \ No newline at end of file diff --git a/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/ClassPathTest.java b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/ClassPathTest.java new file mode 100644 index 0000000000..2681309843 --- /dev/null +++ b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/ClassPathTest.java @@ -0,0 +1,61 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import static org.junit.Assert.*; + +import java.io.File; +import org.junit.Test; + +public class ClassPathTest { + @Test + public void testClassPath() throws Exception { + // We need to test a file-based classpath and a JAR based one (including + // built-in classes) and confirm all loaded properly. We have confirmed + // with Gradle tests that we have the proper pieces, but we assert again. + String testClassDirEntry = null; + String asmJarEntry = null; + for (String maybeEntry : System.getProperty("java.class.path").split(File.pathSeparator)) { + String url = new File(maybeEntry).toURI().toURL().toString(); + if (url.endsWith("classes/java/test/")) { + assertNull(testClassDirEntry); + testClassDirEntry = maybeEntry; + } else { + String fileName = url.substring(url.lastIndexOf('/') + 1); + if (fileName.startsWith("asm-") && fileName.endsWith(".jar")) { + assertNull(asmJarEntry); + asmJarEntry = maybeEntry; + } + } + } + assertNotNull(testClassDirEntry); + assertNotNull(asmJarEntry); + + // Now use these to load all classes and confirm it has the proper ones + // present + try (ClassPath classPath = + new ClassPath(testClassDirEntry + File.pathSeparator + asmJarEntry)) { + assertTrue( + classPath.classes.contains("io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl")); + assertTrue(classPath.classes.contains("org/objectweb/asm/ClassReader")); + } + } +} diff --git a/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/LoggingCaptureHandler.java b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/LoggingCaptureHandler.java new file mode 100644 index 0000000000..7afa4899ef --- /dev/null +++ b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/LoggingCaptureHandler.java @@ -0,0 +1,50 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import java.util.ArrayList; +import java.util.List; +import java.util.logging.Handler; +import java.util.logging.LogRecord; +import java.util.logging.SimpleFormatter; + +public class LoggingCaptureHandler extends Handler { + private final List records = new ArrayList<>(); + + public LoggingCaptureHandler() { + setFormatter(new SimpleFormatter()); + } + + @Override + public synchronized void publish(LogRecord record) { + records.add(record); + } + + @Override + public void flush() {} + + @Override + public void close() throws SecurityException {} + + public synchronized List collectRecords() { + return new ArrayList<>(records); + } +} diff --git a/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/WorkflowCheckTest.java b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/WorkflowCheckTest.java new file mode 100644 index 0000000000..fb8efbd9f3 --- /dev/null +++ b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/WorkflowCheckTest.java @@ -0,0 +1,373 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck; + +import static org.junit.Assert.*; + +import java.io.BufferedReader; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.nio.charset.StandardCharsets; +import java.util.*; +import java.util.logging.Level; +import java.util.logging.LogManager; +import java.util.logging.LogRecord; +import java.util.logging.Logger; +import java.util.stream.Collectors; +import javax.annotation.Nullable; +import org.junit.After; +import org.junit.Before; +import org.junit.Test; + +public class WorkflowCheckTest { + static { + try (InputStream is = + WorkflowCheckTest.class.getClassLoader().getResourceAsStream("logging.properties")) { + LogManager.getLogManager().readConfiguration(is); + } catch (IOException e) { + throw new ExceptionInInitializerError(e); + } + } + + private final LoggingCaptureHandler classInfoVisitorLogs = new LoggingCaptureHandler(); + + @Before + public void beforeEach() { + ClassInfoVisitor.logger.addHandler(classInfoVisitorLogs); + } + + @After + public void afterEach() { + Logger.getLogger(ClassInfoVisitor.class.getName()).removeHandler(classInfoVisitorLogs); + } + + @Test + public void testWorkflowCheck() throws IOException { + // Load properties + Properties configProps = new Properties(); + try (InputStream is = getClass().getResourceAsStream("testdata/workflowcheck.properties")) { + configProps.load(is); + } + // Collect infos + Config config = Config.fromProperties(Config.defaultProperties(), configProps); + List infos = + new WorkflowCheck(config).findWorkflowClasses(System.getProperty("java.class.path")); + for (ClassInfo info : infos) { + info.methods.entrySet().stream() + .sorted(Map.Entry.comparingByKey()) + .forEach( + entry -> { + for (ClassInfo.MethodInfo method : entry.getValue()) { + if (method.workflowImpl != null) { + System.out.println(Printer.methodText(info, entry.getKey(), method)); + } + } + }); + } + + // Collect actual/expected lists (we accept perf penalty of not being sets) + List actual = InvalidMemberAccessAssertion.fromClassInfos(infos); + SourceAssertions expected = SourceAssertions.fromTestSource(); + + // Check differences in both directions + List diff = new ArrayList<>(actual); + diff.removeAll(expected.invalidAccesses); + for (InvalidMemberAccessAssertion v : diff) { + fail("Unexpected invalid access: " + v); + } + diff = new ArrayList<>(expected.invalidAccesses); + diff.removeAll(actual); + for (InvalidMemberAccessAssertion v : diff) { + fail("Missing expected invalid call: " + v); + } + + // Check that all logs are present + List actualLogs = classInfoVisitorLogs.collectRecords(); + for (LogAssertion expectedLog : expected.logs) { + assertTrue( + "Cannot find " + expectedLog.level + " log with message: " + expectedLog.message, + actualLogs.stream() + .anyMatch( + actualLog -> + actualLog.getLevel().equals(expectedLog.level) + && classInfoVisitorLogs + .getFormatter() + .formatMessage(actualLog) + .equals(expectedLog.message))); + } + } + + private static class SourceAssertions { + private static final String[] SOURCE_FILES = + new String[] { + "io/temporal/workflowcheck/testdata/BadCalls.java", + "io/temporal/workflowcheck/testdata/Configured.java", + "io/temporal/workflowcheck/testdata/Suppression.java", + "io/temporal/workflowcheck/testdata/UnsafeIteration.java" + }; + + static SourceAssertions fromTestSource() { + List invalidAccesses = new ArrayList<>(); + List logAsserts = new ArrayList<>(); + for (String resourcePath : SOURCE_FILES) { + String[] fileParts = resourcePath.split("/"); + String fileName = fileParts[fileParts.length - 1]; + // Load lines + List lines; + try (InputStream is = + Thread.currentThread().getContextClassLoader().getResourceAsStream(resourcePath)) { + assertNotNull(is); + BufferedReader reader = + new BufferedReader(new InputStreamReader(is, StandardCharsets.UTF_8)); + lines = reader.lines().collect(Collectors.toList()); + } catch (IOException e) { + throw new RuntimeException(e); + } + + // Add asserts + invalidAccesses.addAll(InvalidMemberAccessAssertion.fromJavaLines(fileName, lines)); + logAsserts.addAll(LogAssertion.fromJavaLines(lines)); + } + return new SourceAssertions(invalidAccesses, logAsserts); + } + + final List invalidAccesses; + final List logs; + + private SourceAssertions( + List invalidAccesses, List logs) { + this.invalidAccesses = invalidAccesses; + this.logs = logs; + } + + @Override + public boolean equals(Object o) { + if (this == o) return true; + if (o == null || getClass() != o.getClass()) return false; + SourceAssertions that = (SourceAssertions) o; + return Objects.equals(invalidAccesses, that.invalidAccesses) + && Objects.equals(logs, that.logs); + } + + @Override + public int hashCode() { + return Objects.hash(invalidAccesses, logs); + } + } + + private static class InvalidMemberAccessAssertion { + static List fromClassInfos(List infos) { + List assertions = new ArrayList<>(); + for (ClassInfo info : infos) { + for (Map.Entry> methods : info.methods.entrySet()) { + for (ClassInfo.MethodInfo method : methods.getValue()) { + // Only invalid workflow impls with invalid accesses + if (method.workflowImpl != null && method.invalidMemberAccesses != null) { + for (ClassInfo.MethodInvalidMemberAccessInfo access : method.invalidMemberAccesses) { + // Find first cause + ClassInfo.MethodInvalidMemberAccessInfo causeAccess = null; + if (access.resolvedInvalidMethod != null + && access.resolvedInvalidMethod.invalidMemberAccesses != null) { + causeAccess = access.resolvedInvalidMethod.invalidMemberAccesses.get(0); + } + assertions.add( + new InvalidMemberAccessAssertion( + info.fileName, + Objects.requireNonNull(access.line), + info.name, + methods.getKey() + method.descriptor, + access.className, + access.operation + == ClassInfo.MethodInvalidMemberAccessInfo.Operation.METHOD_CALL + ? access.memberName + access.memberDescriptor + : access.memberName, + causeAccess == null ? null : causeAccess.className, + causeAccess == null + ? null + : causeAccess.operation + == ClassInfo.MethodInvalidMemberAccessInfo.Operation.METHOD_CALL + ? causeAccess.memberName + causeAccess.memberDescriptor + : causeAccess.memberName)); + } + } + } + } + } + return assertions; + } + + static List fromJavaLines(String fileName, List lines) { + List assertions = new ArrayList<>(); + for (int lineIdx = 0; lineIdx < lines.size(); lineIdx++) { + String line = lines.get(lineIdx).trim(); + // Confirm INVALID + if (!line.startsWith("// INVALID")) { + continue; + } + // Collect indented bullets + Map bullets = new HashMap<>(6); + while (lines.get(lineIdx + 1).trim().startsWith("// * ")) { + lineIdx++; + line = lines.get(lineIdx).substring(lines.get(lineIdx).indexOf("/") + 7); + int colonIndex = line.indexOf(":"); + assertTrue(colonIndex > 0); + bullets.put(line.substring(0, colonIndex).trim(), line.substring(colonIndex + 1).trim()); + } + assertions.add( + new InvalidMemberAccessAssertion( + fileName, + lineIdx + 2, + Objects.requireNonNull(bullets.get("class")), + Objects.requireNonNull(bullets.get("method")), + Objects.requireNonNull(bullets.get("accessedClass")), + Objects.requireNonNull(bullets.get("accessedMember")), + bullets.get("accessedCauseClass"), + bullets.get("accessedCauseMethod"))); + } + return assertions; + } + + final String fileName; + final int line; + final String className; + final String member; + final String accessedClass; + final String accessedMember; + // Cause info can be null + @Nullable final String accessedCauseClass; + @Nullable final String accessedCauseMethod; + + private InvalidMemberAccessAssertion( + String fileName, + int line, + String className, + String member, + String accessedClass, + String accessedMember, + @Nullable String accessedCauseClass, + @Nullable String accessedCauseMethod) { + this.fileName = fileName; + this.line = line; + this.className = className; + this.member = member; + this.accessedClass = accessedClass; + this.accessedMember = accessedMember; + this.accessedCauseClass = accessedCauseClass; + this.accessedCauseMethod = accessedCauseMethod; + } + + @Override + public boolean equals(Object o) { + if (this == o) return true; + if (o == null || getClass() != o.getClass()) return false; + InvalidMemberAccessAssertion that = (InvalidMemberAccessAssertion) o; + return line == that.line + && Objects.equals(fileName, that.fileName) + && Objects.equals(className, that.className) + && Objects.equals(member, that.member) + && Objects.equals(accessedClass, that.accessedClass) + && Objects.equals(accessedMember, that.accessedMember) + && Objects.equals(accessedCauseClass, that.accessedCauseClass) + && Objects.equals(accessedCauseMethod, that.accessedCauseMethod); + } + + @Override + public int hashCode() { + return Objects.hash( + fileName, + line, + className, + member, + accessedClass, + accessedMember, + accessedCauseClass, + accessedCauseMethod); + } + + @Override + public String toString() { + return "InvalidMemberAccessAssertion{" + + "fileName='" + + fileName + + '\'' + + ", line=" + + line + + ", className='" + + className + + '\'' + + ", member='" + + member + + '\'' + + ", accessedClass='" + + accessedClass + + '\'' + + ", accessedMember='" + + accessedMember + + '\'' + + ", accessedCauseClass='" + + accessedCauseClass + + '\'' + + ", accessedCauseMethod='" + + accessedCauseMethod + + '\'' + + '}'; + } + } + + private static class LogAssertion { + static List fromJavaLines(List lines) { + return lines.stream() + .map(String::trim) + .filter(line -> line.startsWith("// LOG: ")) + .map( + line -> { + int dashIndex = line.indexOf('-'); + assertTrue(dashIndex > 0); + return new LogAssertion( + Level.parse(line.substring(8, dashIndex).trim()), + line.substring(dashIndex + 1).trim()); + }) + .collect(Collectors.toList()); + } + + final Level level; + final String message; + + private LogAssertion(Level level, String message) { + this.level = level; + this.message = message; + } + + @Override + public boolean equals(Object o) { + if (this == o) return true; + if (o == null || getClass() != o.getClass()) return false; + LogAssertion that = (LogAssertion) o; + return Objects.equals(level, that.level) && Objects.equals(message, that.message); + } + + @Override + public int hashCode() { + return Objects.hash(level, message); + } + } +} diff --git a/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/BadCalls.java b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/BadCalls.java new file mode 100644 index 0000000000..86ed88757d --- /dev/null +++ b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/BadCalls.java @@ -0,0 +1,173 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck.testdata; + +import com.google.common.io.MoreFiles; +import io.temporal.workflow.*; +import java.nio.file.Paths; +import java.time.Instant; +import java.time.LocalDate; +import java.time.LocalDateTime; +import java.util.ArrayList; +import java.util.Collections; +import java.util.Date; +import java.util.Random; + +@WorkflowInterface +public interface BadCalls { + @WorkflowMethod + void doWorkflow() throws Exception; + + @SignalMethod + void doSignal(); + + @QueryMethod + long doQuery(); + + @UpdateMethod + void doUpdate(); + + @UpdateValidatorMethod(updateName = "doUpdate") + void doUpdateValidate(); + + class BadCallsImpl implements BadCalls { + private static final String FIELD_FINAL = "foo"; + private static String FIELD_NON_FINAL = "bar"; + + @Override + @SuppressWarnings("all") + public void doWorkflow() throws Exception { + // INVALID: Direct invalid call in workflow + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doWorkflow()V + // * accessedClass: java/time/Instant + // * accessedMember: now()Ljava/time/Instant; + Instant.now(); + + // INVALID: Indirect invalid call via local method + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doWorkflow()V + // * accessedClass: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * accessedMember: currentInstant()V + // * accessedCauseClass: java/util/Date + // * accessedCauseMethod: ()V + currentInstant(); + + // INVALID: Indirect invalid call via stdlib method + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doWorkflow()V + // * accessedClass: java/util/Collections + // * accessedMember: shuffle(Ljava/util/List;)V + // * accessedCauseClass: java/util/Random + // * accessedCauseMethod: ()V + Collections.shuffle(new ArrayList<>()); + + // But this is an acceptable call because we are passing in a seeded random + Collections.shuffle(new ArrayList<>(), new Random(123)); + + // INVALID: Configured invalid field + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doWorkflow()V + // * accessedClass: java/lang/System + // * accessedMember: out + System.out.println("foo"); + + // INVALID: Setting static non-final field + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doWorkflow()V + // * accessedClass: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * accessedMember: FIELD_NON_FINAL + FIELD_NON_FINAL = "blah"; + + // INVALID: Getting static non-final field + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doWorkflow()V + // * accessedClass: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * accessedMember: FIELD_NON_FINAL + new StringBuilder(FIELD_NON_FINAL); + + // It's ok to access a final static field though + new StringBuilder(FIELD_FINAL); + + // We want reflection to be considered safe + getClass().getField("FIELD_NON_FINAL").get(null); + + // INVALID: Indirect invalid call to third party library + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doWorkflow()V + // * accessedClass: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * accessedMember: touchFile()V + // * accessedCauseClass: com/google/common/io/MoreFiles + // * accessedCauseMethod: touch(Ljava/nio/file/Path;)V + touchFile(); + } + + @Override + public void doSignal() { + // INVALID: Direct invalid call in signal + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doSignal()V + // * accessedClass: java/lang/System + // * accessedMember: nanoTime()J + System.nanoTime(); + } + + @Override + public long doQuery() { + // INVALID: Direct invalid call in query + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doQuery()J + // * accessedClass: java/lang/System + // * accessedMember: currentTimeMillis()J + return System.currentTimeMillis(); + } + + @Override + @SuppressWarnings("all") + public void doUpdate() { + // INVALID: Direct invalid call in update + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doUpdate()V + // * accessedClass: java/time/LocalDate + // * accessedMember: now()Ljava/time/LocalDate; + LocalDate.now(); + } + + @Override + @SuppressWarnings("all") + public void doUpdateValidate() { + // INVALID: Direct invalid call in update validator + // * class: io/temporal/workflowcheck/testdata/BadCalls$BadCallsImpl + // * method: doUpdateValidate()V + // * accessedClass: java/time/LocalDateTime + // * accessedMember: now()Ljava/time/LocalDateTime; + LocalDateTime.now(); + } + + private void currentInstant() { + new Date(); + } + + private void touchFile() throws Exception { + MoreFiles.touch(Paths.get("tmp", "does-not-exist")); + } + } +} diff --git a/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/Configured.java b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/Configured.java new file mode 100644 index 0000000000..46da3045ba --- /dev/null +++ b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/Configured.java @@ -0,0 +1,129 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck.testdata; + +import io.temporal.workflow.WorkflowInterface; +import io.temporal.workflow.WorkflowMethod; + +@WorkflowInterface +public interface Configured { + @WorkflowMethod + void configured(); + + class ConfiguredImpl implements Configured { + @Override + public void configured() { + // INVALID: Configured invalid + // * class: io/temporal/workflowcheck/testdata/Configured$ConfiguredImpl + // * method: configured()V + // * accessedClass: io/temporal/workflowcheck/testdata/Configured$SomeCalls + // * accessedMember: configuredInvalidFull()V + new SomeCalls().configuredInvalidFull(); + + // INVALID: Configured invalid + // * class: io/temporal/workflowcheck/testdata/Configured$ConfiguredImpl + // * method: configured()V + // * accessedClass: io/temporal/workflowcheck/testdata/Configured$SomeCalls + // * accessedMember: configuredInvalidALlButDescriptor()V + new SomeCalls().configuredInvalidALlButDescriptor(); + + // INVALID: Configured invalid + // * class: io/temporal/workflowcheck/testdata/Configured$ConfiguredImpl + // * method: configured()V + // * accessedClass: io/temporal/workflowcheck/testdata/Configured$SomeCalls + // * accessedMember: configuredInvalidClassAndMethod()V + new SomeCalls().configuredInvalidClassAndMethod(); + + // INVALID: Configured invalid + // * class: io/temporal/workflowcheck/testdata/Configured$ConfiguredImpl + // * method: configured()V + // * accessedClass: io/temporal/workflowcheck/testdata/Configured$SomeCalls + // * accessedMember: configuredInvalidJustName()V + new SomeCalls().configuredInvalidJustName(); + + // INVALID: Calls configured invalid + // * class: io/temporal/workflowcheck/testdata/Configured$ConfiguredImpl + // * method: configured()V + // * accessedClass: io/temporal/workflowcheck/testdata/Configured$SomeCalls + // * accessedMember: callsConfiguredInvalid()V + // * accessedCauseClass: io/temporal/workflowcheck/testdata/Configured$SomeCalls + // * accessedCauseMethod: configuredInvalidJustName()V + new SomeCalls().callsConfiguredInvalid(); + + // This overload is ok + new SomeCalls().configuredInvalidOverload(""); + + // INVALID: Configured invalid + // * class: io/temporal/workflowcheck/testdata/Configured$ConfiguredImpl + // * method: configured()V + // * accessedClass: io/temporal/workflowcheck/testdata/Configured$SomeCalls + // * accessedMember: configuredInvalidOverload(I)V + new SomeCalls().configuredInvalidOverload(0); + + // spotless:off + // INVALID: Configured invalid + // * class: io/temporal/workflowcheck/testdata/Configured$ConfiguredImpl + // * method: configured()V + // * accessedClass: io/temporal/workflowcheck/testdata/Configured$SomeInterface$SomeInterfaceImpl + // * accessedMember: configuredInvalidIface()V + new SomeInterface.SomeInterfaceImpl().configuredInvalidIface(); + // spotless:on + + // INVALID: Configured invalid + // * class: io/temporal/workflowcheck/testdata/Configured$ConfiguredImpl + // * method: configured()V + // * accessedClass: io/temporal/workflowcheck/testdata/Configured$ConfiguredInvalidClass + // * accessedMember: someMethod()V + ConfiguredInvalidClass.someMethod(); + } + } + + class SomeCalls { + void configuredInvalidFull() {} + + void configuredInvalidALlButDescriptor() {} + + void configuredInvalidClassAndMethod() {} + + void configuredInvalidJustName() {} + + void callsConfiguredInvalid() { + configuredInvalidJustName(); + } + + void configuredInvalidOverload(String param) {} + + void configuredInvalidOverload(int param) {} + } + + interface SomeInterface { + void configuredInvalidIface(); + + class SomeInterfaceImpl implements SomeInterface { + @Override + public void configuredInvalidIface() {} + } + } + + class ConfiguredInvalidClass { + static void someMethod() {} + } +} diff --git a/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/Suppression.java b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/Suppression.java new file mode 100644 index 0000000000..82c4a10a98 --- /dev/null +++ b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/Suppression.java @@ -0,0 +1,171 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck.testdata; + +import io.temporal.workflow.WorkflowInterface; +import io.temporal.workflow.WorkflowMethod; +import io.temporal.workflowcheck.WorkflowCheck; +import java.util.Date; + +@WorkflowInterface +public interface Suppression { + @WorkflowMethod + void suppression(); + + class SuppressionImpl implements Suppression { + @Override + public void suppression() { + // INVALID: Indirect invalid call + // * class: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * method: suppression()V + // * accessedClass: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * accessedMember: badThing()V + // * accessedCauseClass: java/util/Date + // * accessedCauseMethod: ()V + badThing(); + + // Suppressed + badThingSuppressed(); + + // INVALID: Indirect invalid call after suppression + // * class: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * method: suppression()V + // * accessedClass: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * accessedMember: badThing()V + // * accessedCauseClass: java/util/Date + // * accessedCauseMethod: ()V + badThing(); + + // INVALID: Partially suppressed + // * class: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * method: suppression()V + // * accessedClass: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * accessedMember: badThingPartiallySuppressed()V + // * accessedCauseClass: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * accessedCauseMethod: badThing()V + badThingPartiallySuppressed(); + + // Suppress all warnings + WorkflowCheck.suppressWarnings(); + badThing(); + new Date(); + WorkflowCheck.restoreWarnings(); + + // Suppress only warnings for badThing + WorkflowCheck.suppressWarnings("badThing"); + badThing(); + // INVALID: Not suppressed + // * class: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * method: suppression()V + // * accessedClass: java/util/Date + // * accessedMember: ()V + new Date(); + WorkflowCheck.restoreWarnings(); + + // Suppress only warnings for date init + WorkflowCheck.suppressWarnings("Date."); + // INVALID: Not suppressed + // * class: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * method: suppression()V + // * accessedClass: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * accessedMember: badThing()V + // * accessedCauseClass: java/util/Date + // * accessedCauseMethod: ()V + badThing(); + new Date(); + WorkflowCheck.restoreWarnings(); + + // Suppress nested + WorkflowCheck.suppressWarnings("Date."); + WorkflowCheck.suppressWarnings("badThing"); + badThing(); + new Date(); + WorkflowCheck.restoreWarnings(); + WorkflowCheck.restoreWarnings(); + + // spotless:off + // LOG: WARNING - 1 warning suppression(s) not restored in io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl.suppression + WorkflowCheck.suppressWarnings("never-restored"); + // spotless:on + + // spotless:off + // LOG: WARNING - WorkflowCheck.suppressWarnings call not using string literal at io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl.suppression (Suppression.java:112) + String warningVar = "not-literal"; + WorkflowCheck.suppressWarnings(warningVar); + // spotless:on + } + + public static void badThing() { + new Date(); + } + + @WorkflowCheck.SuppressWarnings + private static void badThingSuppressed() { + new Date(); + } + + @WorkflowCheck.SuppressWarnings(invalidMembers = "Date.") + private static void badThingPartiallySuppressed() { + new Date(); + badThing(); + } + } + + @WorkflowCheck.SuppressWarnings + class SuppressionImpl2 implements Suppression { + @Override + public void suppression() { + SuppressionImpl.badThing(); + new Date(); + } + } + + // We just added another param here to confirm annotation array handling + @WorkflowCheck.SuppressWarnings(invalidMembers = {"badThing", "some-other-param"}) + class SuppressionImpl3 implements Suppression { + @Override + public void suppression() { + SuppressionImpl.badThing(); + // INVALID: Not suppressed + // * class: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl3 + // * method: suppression()V + // * accessedClass: java/util/Date + // * accessedMember: ()V + new Date(); + } + } + + @WorkflowCheck.SuppressWarnings(invalidMembers = "Date.") + class SuppressionImpl4 implements Suppression { + @Override + public void suppression() { + // INVALID: Not suppressed + // * class: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl4 + // * method: suppression()V + // * accessedClass: io/temporal/workflowcheck/testdata/Suppression$SuppressionImpl + // * accessedMember: badThing()V + // * accessedCauseClass: java/util/Date + // * accessedCauseMethod: ()V + SuppressionImpl.badThing(); + new Date(); + } + } +} diff --git a/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/UnsafeIteration.java b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/UnsafeIteration.java new file mode 100644 index 0000000000..8511f8979b --- /dev/null +++ b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/UnsafeIteration.java @@ -0,0 +1,87 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck.testdata; + +import io.temporal.workflow.WorkflowInterface; +import io.temporal.workflow.WorkflowMethod; +import java.util.*; +import java.util.stream.Stream; + +@WorkflowInterface +public interface UnsafeIteration { + @WorkflowMethod + void unsafeIteration(); + + class UnsafeIterationImpl implements UnsafeIteration { + @Override + @SuppressWarnings("all") + public void unsafeIteration() { + // INVALID: Set iteration + // * class: io/temporal/workflowcheck/testdata/UnsafeIteration$UnsafeIterationImpl + // * method: unsafeIteration()V + // * accessedClass: java/util/Set + // * accessedMember: iterator()Ljava/util/Iterator; + for (Map.Entry kv : Collections.singletonMap("a", "b").entrySet()) { + kv.getKey(); + } + + Set> sortedMapEntries = + new TreeMap<>(Collections.singletonMap("a", "b")).entrySet(); + // INVALID: Set iteration, sadly even if the map is deterministic + // * class: io/temporal/workflowcheck/testdata/UnsafeIteration$UnsafeIterationImpl + // * method: unsafeIteration()V + // * accessedClass: java/util/Set + // * accessedMember: iterator()Ljava/util/Iterator; + for (Map.Entry kv : sortedMapEntries) { + kv.getKey(); + } + + Set mySet = new HashSet<>(2); + mySet.add("a"); + mySet.add("b"); + + // SortedSet iteration is safe + for (String v : new TreeSet<>(mySet)) { + v.length(); + } + + // So is LinkedHashSet + for (String v : new LinkedHashSet<>(mySet)) { + v.length(); + } + + // ArrayDeque is safe + for (String v : new ArrayDeque<>(mySet)) { + v.length(); + } + + // Most streams are safe, except for sets + Stream.of("a", "b"); + Arrays.asList("a", "b").stream(); + // INVALID: Set streams + // * class: io/temporal/workflowcheck/testdata/UnsafeIteration$UnsafeIterationImpl + // * method: unsafeIteration()V + // * accessedClass: java/util/Set + // * accessedMember: stream()Ljava/util/stream/Stream; + mySet.stream().forEach(a -> {}); + } + } +} diff --git a/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/separatepackage/SeparateClass.java b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/separatepackage/SeparateClass.java new file mode 100644 index 0000000000..924c59508d --- /dev/null +++ b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/separatepackage/SeparateClass.java @@ -0,0 +1,23 @@ +/* + * Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. + * + * Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Modifications copyright (C) 2017 Uber Technologies, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this material except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.temporal.workflowcheck.testdata.separatepackage; + +public class SeparateClass {} diff --git a/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/workflowcheck.properties b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/workflowcheck.properties new file mode 100644 index 0000000000..e7defb7eba --- /dev/null +++ b/temporal-workflowcheck/src/test/java/io/temporal/workflowcheck/testdata/workflowcheck.properties @@ -0,0 +1,31 @@ +# +# Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. +# +# Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. +# +# Modifications copyright (C) 2017 Uber Technologies, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this material except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +temporal.workflowcheck.invalid.io/temporal/workflowcheck/testdata/Configured$SomeCalls.configuredInvalidFull()=true +temporal.workflowcheck.invalid.io/temporal/workflowcheck/testdata/Configured$SomeCalls.configuredInvalidALlButDescriptor=true +temporal.workflowcheck.invalid.Configured$SomeCalls.configuredInvalidClassAndMethod=true +temporal.workflowcheck.invalid.configuredInvalidJustName=true +temporal.workflowcheck.invalid.Configured$SomeCalls.configuredInvalidOverload(I)=true +temporal.workflowcheck.invalid.Configured$SomeInterface.configuredInvalidIface=true +temporal.workflowcheck.invalid.Configured$ConfiguredInvalidClass=true + +# We will make the collections static fields as allowed so we can properly test +# the calls themselves +temporal.workflowcheck.invalid.java/util/Collections.r=false \ No newline at end of file diff --git a/temporal-workflowcheck/src/test/resources/logging.properties b/temporal-workflowcheck/src/test/resources/logging.properties new file mode 100644 index 0000000000..56ad7ce1ac --- /dev/null +++ b/temporal-workflowcheck/src/test/resources/logging.properties @@ -0,0 +1,23 @@ +# +# Copyright (C) 2022 Temporal Technologies, Inc. All Rights Reserved. +# +# Copyright (C) 2012-2016 Amazon.com, Inc. or its affiliates. All Rights Reserved. +# +# Modifications copyright (C) 2017 Uber Technologies, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this material except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +.level=FINEST +handlers=java.util.logging.ConsoleHandler +java.util.logging.ConsoleHandler.level=FINE \ No newline at end of file