From 52be6a8aef56444a8c3f261b50f4c1c3ce2a4a7d Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Wed, 26 Sep 2001 12:49:10 +0000
Subject: [PATCH] completed the new key validation code

---
 TODO          |   5 +-
 g10/ChangeLog |   9 ++
 g10/getkey.c  |   1 +
 g10/keyedit.c |   2 +-
 g10/keyring.c |   6 +-
 g10/keyring.o | Bin 65256 -> 0 bytes
 g10/trustdb.c | 240 ++++++++++++++++++++++++++++++++++++--------------
 util/memory.c |   2 +-
 8 files changed, 192 insertions(+), 73 deletions(-)
 delete mode 100644 g10/keyring.o

diff --git a/TODO b/TODO
index 046267c7f..117cc8e11 100644
--- a/TODO
+++ b/TODO
@@ -1,6 +1,8 @@
 
   * Selection using +wordlist does not work.
 
+  * Make the offtbl in keyring.c global.
+
   * Always use the primary key to sign other keys.
 
   * add listing of notation data
@@ -61,7 +63,8 @@
   * Add option to put the list of recipients (from the encryption
     layer) into the signatures notation data.
 
-  * Allow to update key signatures.
+  * Allow to update key signatures.  It is also not possible to resign
+    an already revoked key signature.
 
   * For FreeBSD only: spit out a message that rndcontrol (8) should be
     used to enable the use of IRQs for entropy gathering.
diff --git a/g10/ChangeLog b/g10/ChangeLog
index 8e6185d79..9d11f1c6b 100644
--- a/g10/ChangeLog
+++ b/g10/ChangeLog
@@ -1,3 +1,12 @@
+2001-09-26  Werner Koch  <wk@gnupg.org>
+
+	* trustdb.c (new_key_hash_table): Increased the table size to 1024
+	and changed the masks accordingly.
+	(validate): Changed stats printing.
+	(mark_usable_uid_certs): New.
+	(cmp_kid_for_make_key_array): Does now check the signatures and
+	figures out a usable one.
+
 2001-09-25  Werner Koch  <wk@gnupg.org>
 
 	* keyring.c (new_offset_item,release_offset_items)
diff --git a/g10/getkey.c b/g10/getkey.c
index ad009d3d1..3a1b51839 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -442,6 +442,7 @@ seckey_available( u32 *keyid )
 {
     int rc;
     KEYDB_HANDLE hd = keydb_new (1);
+
     rc = keydb_search_kid (hd, keyid);
     if ( rc == -1 )
         rc = G10ERR_NO_SECKEY;
diff --git a/g10/keyedit.c b/g10/keyedit.c
index 2e66b4b6e..9c55b555d 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -2028,7 +2028,7 @@ menu_revsig( KBNODE keyblock )
 	}
 	else if( node->pkt->pkttype == PKT_SIGNATURE
 		&& ((sig = node->pkt->pkt.signature),
-		     !seckey_available( sig->keyid )  ) ) {
+                     !seckey_available(sig->keyid)  ) ) {
 	    if( (sig->sig_class&~3) == 0x10 ) {
 		tty_printf(_("   signed by %08lX at %s\n"),
 			    (ulong)sig->keyid[1], datestr_from_sig(sig) );
diff --git a/g10/keyring.c b/g10/keyring.c
index 5b5caca49..cdfb65861 100644
--- a/g10/keyring.c
+++ b/g10/keyring.c
@@ -479,7 +479,7 @@ keyring_update_keyblock (KEYRING_HANDLE hd, KBNODE kb)
     rc = do_copy (3, hd->found.kr->fname, kb, hd->secret,
                   hd->found.offset, hd->found.n_packets );
     if (!rc) {
-      if (hd->current.kr->offtbl)
+      if (hd->current.kr && hd->current.kr->offtbl)
         {
           /* we do not have the offset but as it is not use it does not
            * matter*/
@@ -521,7 +521,7 @@ keyring_insert_keyblock (KEYRING_HANDLE hd, KBNODE kb)
 
     /* do the insert */
     rc = do_copy (1, fname, kb, hd->secret, 0, 0 );
-    if (!rc && hd->current.kr->offtbl)
+    if (!rc && hd->current.kr && hd->current.kr->offtbl)
       {
         /* we do not have the offset but as it is not use it does not matter*/
         update_offset_hash_table_from_kb (hd->current.kr->offtbl, kb, 0);
@@ -881,7 +881,7 @@ keyring_search (KEYRING_HANDLE hd, KEYDB_SEARCH_DESC *desc, size_t ndesc)
     if (rc)
         return rc;
 
-    offtbl = hd->current.kr->offtbl;
+    offtbl = hd->secret? NULL:hd->current.kr->offtbl;
     offtbl_ready = hd->current.kr->offtbl_ready;
     if (!offtbl)
       ;
diff --git a/g10/keyring.o b/g10/keyring.o
deleted file mode 100644
index edce50322a2de8f7fee129f3f2e66ae0416499b1..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 65256
zcmd?S33%N_)jvLWE2Z?I1qzfsV1O1%o7^nT!jd%iwhe6-va}S$OO~4^Z8q-G1t<nW
z!5FGld3|}6SHmKUpn|e*1}GF15CNqKLRG|;fU*e%D*1oTIWzN}o20(4@_(M+?|FV-
zp7eh1neEJ(GiT16neXMx(WMK0KA$p=PX(0sO{weOkd%D>n5CwvsU|CbHV*u`|E<aW
zTRvDdW5@2%(a|R#9r%!GGwKJUlQ#~hW(>|mYAq-BZ<#)@ZR2qIt-*74Jo)HmTee+g
zDW!{VTBDdgeOdirdh*5(Q^(}Kj0#5czqjLh)Q>7EF8*|MFQqQp3Gy;7wJE;i>@Pj}
zD9Y6jHclR_nmSk>JeKkd&bVabbE!iH4=Fw?m?moRg30ONz_TNh2lwCjTzY5j@Y#ls
zsmsyeIa3GI(+4-q7_89ct0oW5xENI&IT$Ej5KQlf1gc{1fyC5-^QVuLZ036Yxa04i
zjgAgHG8h<G5JZ-N1(PL%TTk%f0l)b^FyrF0zZA2wI-J_xFd5Bnd^uIPDZOj3J~-&_
z-!&-}>fg0*`pEt*yOxb6g51}^==8zH8FjVGmhXtLJhBE4+xT+&=}qx%T&0m8_a{BM
z|CAt&Q|jRUExX$ZwLe1t9EyLWx+92)X0tZkMTnZ(R58<z7e=s~8+ZfK9{A`swfkPQ
zI{My^Kl=5i^1~$Cz@r$Iu?71#OjXnVV|d_^{y+K#>VrF`k%THHZ>?bc*;+B3TH9JN
zgFddIe+B{r%nJ{uCmZO|Ijmp#%<sS>8(*esAMXEyZ(z!3h<Z2htfNnyAN^Tz4JB<H
z{_+v+*#PZ3=pX8KJE^j$P3kzc_&Ul)3YMJ1M20yUX7RVlCZV1IHwImUeh)TIg*xxU
z{Etl9g!%^2WGYl#8%+QG$w$ptAm3!DTQK*zkuMA`n1LdP3@!-bV}D3(G`vdf_z`59
z`y7e}Hr37?c$Rg!|1BEB+)<X~rQZgdgJ!Ub`Y)KS(sRJwrsPbS0|ONpg6XL9AR3AG
zMW&NKr`e1Y9>ga$j!xV7UALwM{TIwo=|YrQH9DG{u6v4lQip*?n$R8}Th+*3TPtQz
zwOr>z8%NWVh{tr)@>fc=rslEq+&YOju5*p46P$5%_%78wHn7WR0NVkY8(X8hDSd17
z1NnGIKHj1aYB{y{V07wM`le|9vxKMILwdUNbw7`8|FBl+f#@y~({W%$GE-Xn0LpUb
z@0kL$^G7JQnZ^^-hI7pvtUJ7}b}+h2RG#ZdHD}iG9a9JTZF5R}=Xmv@eQmaC+lNhw
zhq8eBw`A@72IPtc2Tq^0^D@BA$h=DQk7wD|0P<nlkkTqB;MTHPgmOoB79uzFjhH=s
z)~0gbz=B!*pZU|%P=ToJ&LGvd@xy5w*Fi9Y2lRh3Iej!z+sWQ%YB(|S5~@Xg{Tn_|
zsi~V5eA>UuH|?@!l*A~Yfa?EbYPxviXexJbd9c64pPmid_F-Ajm&zJEJ^0l#f_=a6
zedP=?hJ$6nU+>8Fso}mq{$uhZpyiH^^jfY4wnCKs8+NO7Xkf$c5i%po2OD?S8ATin
zkQtl?Gnksvzbixraj*2DqtSN;8{a|yOKY>zU+Alu>>D{k+pk?y()*7_-x_Rui<7g{
zK_vVCnHbwU&>uDpShDo^4m?h5eTLa`3+xsEEGd{w`Ex(q_@P$!8K~4{b)*vVg5@dc
zFP)k$__suZ>Y&L3kb)jG2aqkY{Plm9m7apJ-nw9V76xPB9b^7^&S={|xM6DlMVQ_D
z$W*ui88;6uoCO=P1Y%yLwBaD@4Ym&f%{EutUS_mnq({o|3UV%q>SZG@JxIH22N%v9
zT!#5ETDW|0;S8Eks{%XL?+?aMc@~zZ69*Rt``1lYsVS?}Dz$vHck&MZ$IzvPZ2z||
zoC)64)`f@D$G|pY0F3?g`U8L91hjxI9F7|CaUi%JErbPK{Ruk<xi7O3J#!`+-RmAO
zszw%}SEFlW5^Y^LnVP_?CO%dvFkHXNx8s@pgw-6BI%qtr%XeYzvRsMZBL0ah-yu}I
zx&NYBDt-FDBHmS8gr&QV1bZw@g||LW$ouG;S)RmKDI;?Kj!E1PbmG8&CRyuu=(RF^
zX!~YrIbvFF{{g=8;BMBYhS*4I5mvAWCtS$4R>(kB@IdAck6o7sE3mRm+c-i)a6wR|
zj_$tz>&ChL7fe>uHr@^@kJ!#%0&TkEIQ)xjFz?!y-$CCo+<6%83u#Cyf?|gkQw6Dp
z_M4~|D{U|CHoX|nJy$cD4DQG`^<+Vr_D82sM)7<ZSxoj{cM~<hlzFR21zZwZB!jub
zBbb=GbfUM6z`-F=+(ZAc6f$%<I(_H6NMQSl{vC^%Jnb(3ecRD^-^p0nXN*QCk5)}h
zO&zR4f{$pax5%$OXY$4;Q-@8vD`4}crc_j>_6CIuzCZBVi5n*8K8cLQA16;6Oz-~c
zL4BWOr3x;6E|rT+4^b0EGjh_|TE68K$anByboW<h_$cF4WJHqz<VpRh_~Z1xFiBqx
z9(;0EYWk(asj0pVlV@+3I&I?;ECjsf?<KOzAFSH_RUdNAK(1p)qr0i)N%$VTbT|z|
zy}Pdn!&o-JVA{q>C=TD7Twqr&BxS69FS=gl8LWo`j}N>Ddrq~SE;6~7dNT0KzLO`5
zxZpqcou*QArros{(MVjA`-)ZSu#x?~;$HxH>J0lJ!?e4CGcnwMdEB41Kx$3@@bLws
zY(}w@09P`{+3vtEuOgSbf7F+b<i0$Zp8C~E=;RUD6&zjUOCMNqI+22TpzRIXl%n81
zsgaG(P20F17=$(NJ2?R5ro}gRc&8s9{iFW$zT{V=r!K2IW9Lnz2#fyFzso=E@*e}|
zzC7?u@$=LAp9AhIJ~=gQVFi7Cl)j#Na{68RLazG4O$&YfkNWBBjg)qg@6^=v&1IaK
zoW;JPQzbLGHUp2&e!qV-kj}xH;7WH>`9F%crB{I)tbJ3<YGp})Y?ec@&m{dE4bo~s
z%TjH<Nlg_awM6`*(Mf46SGqGh4*AFEC{2jn?b~S@=E7a^Y#GfbR+q8%{X+KfhQKF$
zysPEoD*3ogK4|JA?H>7ffIcu3(dos}q2&63Z4Yk`(d?MvI~@!6C;O~jJevI<yTQP~
zhg+i$K;&wqQ0qJD;P1!T?|1O`gN(hQMRu}v^5Ee2Ul@j^+IMU8Hp-~WSCpPJJ#jhd
zYt`g4b{zI8j8XI{HVM-<cELF#Hw;_B#ghlBt{g0zIuPBAd3!nx#%cW<ru))m5NChU
z<a7~CNB{8D+B0^Pz01oNB%jU8x~z)}Jae@3AXH2JVg9#9Und!CI_GuIK*K814tyZ`
z1en@dE;U4lDc{!U7Wp7$!?#=I<9g~5xZV_fb|88M`^tk=uWu?RXK(G%gVARP8($cR
z4i7YL*%}>Fk}Bxma6JSAA#7@Vy>93Cw7fINZ-_H~JSnwz|Hu1I+t`P%gH<~Qs;(Z5
z-rB$64wX6y%CafCy>?Ujtz|OT!O&oId;hKj*6ug(-s8dPYBaiC2y5Q$-*Asg9RR6q
zif)59ezhH_{tZ{EX}n45->@0;?FwqBad@z5%Ncc?x9Z9>b{y~yv@_BF@s#vFgV7xW
z(V@}kO(XICkIAk4c(3%?gN-`|8m}^(<vE;r{-|(v@W6ZGZ~jyMs;;s<%6%CcGp+x4
zNZe6Z($*={F8>J3LSyG(w$Rjho2Jh1GNw-dh9PwCHR=?&?!`(prxv<7nhH-H%@6OW
zh60NAUHT02>?Hf3{oxH)tMruq4OgM~5Ep+1Go?6^JAK-v*HP9%{L@dFu!p-!rM^5E
z-G+*bBjKs(<Y4p_fa$3XBkfL>FQS4?sobfXHoSE&?czrca}rO3W^YR6a3X2o?wi#6
zH>6G;Io`}KYU(6vDt-LO{-n=OokVpUs?%v=O}peJa=JyYMk*2i*>Iam2L{iXKJe<p
zZ-hpI{f}o+zT`3Br2oQPOwYHqN?<=Sc`%Y29DSC>k@^j?rOK(Q=<A-YY}wU*jS=r)
z;{$brRacxr88Guk6MDBr(-}U&v`gQ_r0U=Blu9=YMu!I*w_tJ&l+PSE<8XwN2FhnR
zecxxW@m3g*f!eH*DLe(U&@%{kNTrZ;6DMVl6mn8FC5@c088wfl4@J_}GM?*VIP{m1
zDVqnQPjQ2^C7@}hU2fQ&Cq%c9Vbc%RVcw5jx6+d_6lPOAeJgZ|v};@p$0uU3F&x<}
zLV9gm)kPB(2<ig7aYLwKxn^nlRy8-()%$o^kV**^%jN*~UgRn53vLEx4mM67D8b?Z
z!?zo`xaepOf7C8-UyVW0wPo2l0E8#@rOeVXW}gGy=-+^l!@~YkP9~$4J_QQV-Un#e
z0}rz%Z1ob;>OBXc<j$k15cURsZBLgu7%EYp@s(Rmm!Pp_R&Z!&_Sn8Ht8X8&%^XY3
z+=qW?eciIF-eFND>Dbcs%e~TIfqQx{GNC)GLhaj8vF6pNIHb3$UQ%ab+0dyN2$Nyg
za!JM9nIM&fFX`uc=~8s(sqDI$VGut_$1io5W>a)GqAWXqiVhBZNSmpmsnagK9^b%J
zt@M?(4SUWnpcS+wqQfpSIGWS`6*S38FtBas*HMaV@Tc1lN63AdBMeh3@ZnE|?nlR|
z(sptZj1YIN@*7A}z-CixlqY9QYl??{&^~OM;*lT8=JCMJkha-SSLrc_0w`>ft9zaq
zXI;v^%d_A><-(f1LSSojn|!<=A5X}~7WzQDcA+MZVN>Jwf#(Na8+d2;y_1pr{w-Uh
z+bKjk&^WyFcBmr0QbY>HFw-?hH1&!<n|A5XkN_Kv?jTs_#n@?!6~%nl++fdq05<!h
z>20Iw7j`^K<_vLoY|K9ZiG`#2Wy%Yh!mRV=ecHw*TG~I;p=1gg?OG=4u?qqmuUzma
zUa6%;cT@BQc$6LF9Z8U3+Qx%W6}R)O85TGnwS!epX+K}$1=BX(imsCbQj6fyq|_np
z<sqzzd(%H0!#x*>D;Rhby+4+=Uq${jA~G1g`q8vhJ{sMEo(>*{daxzNDZ;MW(ex`j
zD&eDAekjN`8hzrvqc)D5F&KT~qdz|UW^hyRo121tzTx8N6X{&jYqA~WO$=^$LeHHc
z@GwE=i3cB+ip)+S!ZPjB99q^s9ZmZYrFc1YI2eK`wDPzA!gOip-*~)t4{q4994ys}
zsMVwiTa)3Z6;5;m9fm+oKpBu&LdLveu-msAg}*-=ZS1@Z|7;bNg_1OSO7cAkrVKnf
zvfzJJ)5vL=eaSL?897c)Z~hmGCOw(z_5|3dC_~XrvVfFeGze><(H_KTZgSQ^YnR?Z
zN72&{=mTXl=QcKW(>At34``Bq4WC-E`b+)OHZH|?D$zJqmR=h_M#!8*JetS3*<64E
zbNqz~28x%ioxQMEMxC-DFsf9_6i-kFBWVmO0;9(m{|WJrHNnyJF2f|n?xt<LlcyDw
z9~z^LytZ5Er&(B%U$o=I3C5IoX|DzwT<<-s9>ZLzETdLr|3ek6whCTMH=qh^d)MGY
z{82<t=T6i-tZn=GrtJMQd7QF#9!KS1j5kF;z~4LM^49G*<Rd$OQ{)!Ou5{-|7^#5|
zX_tO<`$p&=8wv=@iE?7@P22be>fW^cvw_C9`akhayZoEn)UNh#nj(WycqtUibc-T}
znZn_PnXIE})`*?AP~i<(Dt$=%EnvR=yQY%%pP9b2Uu|fE(JZ~cHp?GEuBOJp#;iJ$
zar-a|j+~8dU{8V#`%Ko8>2);Xn|Ilcr_1{{yyaWFy#01ldj`AH(Nn~sZSBM_RsJ=@
zmCPX#4YE<~w08uV*KLqY8kv(rCmJyf#mMZ<8HFitY=XRK-qS5MJ!oiTsXkxv*c{^k
z2$P04S)=ETre{!BP~~X)ogIJwyA}!a@s92UlEn5=&{me~&3gXO8cPq9Mdjqq&B@hR
zsTV^}tXFCud~d}cJtyMN-~!;2iHIkHzdizZlKAT*fM*l_`Uv287=L{P@O+HFJ_2~?
zn5K`BQkOXR83)t(ipg^%W`MyIpEbC{!Tk=VUAW2fa|iEo@L{k+CeLXO?r`u1;7gP|
z0}dw2wVLkYZ##Kzaqy!KcJsfo2fCZ*?@pfCLE`y`wq?Tu9d8>xmpj<4XOPQgaoKAb
zAI<n)#>X&zhVd5|zs~qr#=99G$9R9twLV1}qttB1VaDW}^r<|?XEM%bd>&)c99SmC
zg^aIdT*UZ3#>I@EXI#qoea5FS-W#*FPo2v6D8{ETE?`{7cnRZj#?6cuFeaPYrz#k4
zW*lLBBjYIJ2N^G9{2Rt}daTr2j2ANw?M3xeGCq`XHRH1wpTRi6xQ_8R8P_wunQ;T-
zEsPr(Z)d!W@h-+^GM<h}+NaKDd;;SyF<!tp&iG8m?TizQI~iZW_&mlxV4Pq)%s9>X
zWyWh5?_!LJkLQ5BsonD#=P=&DcroKX#!Za-8DGfwQpQ&?zMS#xjK9kGm%v6p-*WII
zIQ4y;L;kr|<C7iwM#iF(TO9hcFj9R=bnLH;#WJ0SeS;b6^BK#S{wHG@i@99SS=?GT
zW0CC@PW^5BQavKiuP{z={#O}`tZ)$sc`j!96^t)q{1oFW7}GzdUoQSL=b^BVQUOGe
z`qX^J2Ll^f&2ezl!RtByDChq=<C(CQ@|d=+ck)w&%G61@OrE#*K;LUW;%AAj(aS%;
z^dp&0r-gk=#^u2Mz4}jZ@M#Wq+jVhr4|#3`y^mW`>aqho{2=2+obngOr!ziihR5?F
z#tlqApYaODcQQVQ@n0FA%lNnhscaMDFEM7Q_JRA>Cs5sSu!nyL*UZqf4k3K2&gID}
z!t?^B-^W<S_j$%*_ugV$%z5_0mab2gjH~Au(9PH_<2;q)@}!vlL#BU?v1A!>aLr*J
z&--Es`&2pW%(0BmWW0oN6XOJ9x)q?*e=_c5{2=4=82_1Zg7LmbQJqP~g^W{-V~jU2
zR#}wiBEhKF=;859mw9>$<2s}&RmZrIaR;!G0})Kw%lANc^IYTPx!b{Ro{>G!_deQd
zcb0=sb+B8Hi&r2|9})CpcwT%A(HArIdyJbIzsPtM<NYwT`c#T>HSi^jl!`N5z8sfL
zd5+a7o=g^lZt^#A9#o8H4P%+JS1`suc!n5DJ$Eubj_JQ(d_3bnFrLNuBgSI8rl6Qv
z_m5#Lx?RFp*6v!y3%G0>W0}7j7%ye|e=t6S@hyy3Fn*Zvml(gqxP|fG7`HPHg55sV
z#rSZ>Nyhn%MTScmpU?DWU?ZP3Oc#G+6XS)P=Q_rshYv6o9w_lz&Y{%vO#cdh`zvFy
z`BNY=Q@@-4RM7j>w>f`3<Nsvb!T2i18yG*t_)5k<XM79eVaAUzewgt~jJGg;kMU!S
z_rXy0smB>-Gv3Ph6vj_7UJh*dJkP<DX!>}CL%)&B!Vu!w!WffVKPLY^v#DJO1J4(L
zP5twkt~2Aq<WD$x2KSI>E7Nni@N0}CjE_5k+8V!3odUXPmol2R&f@&9aoH5(_Ze?u
z{1M}u7=Oz6QO0sH_*KSqbgk5<j0246yQzQXiNudQPdj+o9FLz)2UAW{*2P1})2D9o
z6YW=wZ(;1_dB>?|5~kuMl&Bw5XUQJujeDR|aZ~m@C(mUL9&+&g4tC4#3BQ2+eJV=H
z{Ft`h+*3Vsy?)JfFcmgs=Q#8za39yK)F<;i?B;jz?NF&pbpA&j{9E8Yg$nSz$+(j7
zZpQVD_YG5?RgAM3uV;KCV}|Nu#$T2%_}B0}J<n^G5)D1up%*x~+`(>s7gsxZnt;t5
z{2F7*DUWIERk$Xm@04Qb?}6T@FuC#UQ%D#S4$p~<8LB%O*T@(AYsx;$bTo*k2g`u*
zXLd5ajOp}`$$tb~AH&1(4$cAYQ*d7J#2CYQ(T^$nAA6ub?bP#I2fyiHs>;+exrEvh
zoxGayVs7aL#?t7WSRVS+c>BK%bi@B2IM0z>paNSF_*abYIF)dO@lM9Ij2}FW=w~zj
zei>oWB_bH!?nD)RM8I=Q1z`vnPbp(rXPX%_S>4GP72|o%p&t>UvJ06$pRw4?wT$bS
zzKii$j4y*Y`cyOHQWWb`s~P{2ae{HyBBEc;_-7DVpOUrgbxf5$bqCX5LNk5p*Npe8
zCj27fI>xUueuVKGj2A(r`qZ0@*D?MZ<Hs0(%(xrk>r<nQpJL2Vy^L=32~?}#GWMzB
zarSu-bTeMx;yhR|@jS*@3Rf=k>RIpLla>?x49>KGaRcKn#!~h!#$V(we{$$2ok?Zm
zOz&hY`FAny;V<)6c<tVSVd%qu^!$b~L;lC;#`RDg(-%rG^dCF)JAo(i503_mrfi;r
zD;@0Cxxt}d1>8r8`Z4WxVq4W`i1;-0ndf?K&2uniHF@@gTh8_Byo)gwJv_f>Jdg3z
zCNIz3j4{#iyyDQ0Z&4~+$-a-$BI;Z^N#ZAheIK^L8aJ!`flfpIGH1RIOEUkv9sg1u
zdb06HxRUE{Q!{|ufQK;FlY!}ps5Z5iK;RBF#p2a!UyC~(9y-(^mfo#MLwlJY(Vz1f
zuT%k@XIOvI$9DXQMhkC*HzI#FBD5z1(-To^oW8GB2M8JTb?QLi>$raLnJH<Q{?X5N
zd{Q2IsPBY-!u4OMXg2&Bct~B~^!-8yf0^UT$cDBqrqBsL5oqFm7GJCmx42)gLX`hf
zjyV3FdAor5-^qBx9_4_gnjhkmEaiL5=U3Dfzz4JvpO-UlM`=8jb5mPiQ9+9bo$<Ot
z9cJm99Nq?%XeE{XnhM)IU+0KU9_lYcTYk__)0hm?62=2ery|4jkAAk}bH2ve8aE<;
zw)&RZg70g9htxNj|4TF`{=cTNr_bL~d+T~4*moGcji{@5{3t1+zN4eIgukm~_7MKI
zDz#<5uNGK5q$8k|=Nbj`%})fgSu7&auT!#;5We27Y!USXl}7IGg3mJW9{|2lW15e5
zFurn+GNH2cWaICA{5^#H+3IFh27&$scu3vEGI?KP9@DtcJ(=9>$mEBP9^R@BqRR0^
z)KBcLI-+iK@a;PCO?iHbKFAY6OuoY6J9w3tf_BTm&t9M(qA~TCo?-r1spCNJLt8k~
z;suT9$Lh50W3a3|(s#mPl+9KTaqb4-A@v~ly+vbBpC5Ai`>=g;F`^!^b2$R7@^tty
z$5w1nSYr8!s3#ScLydo-5*GhbZM66)b*05mtE(-31{xtxME%O1U_{ij>UK;2wYtaR
z=eTF*p)Y0V7wJYH<DXAB--nTIcysY~hdvgI<V2p2Bi|tE&sM(!QtJD_L+T}#Cw-5A
zPUA>VME%~e39mXj^O`zFvLMfP$3FalcM?Bh{$FDL?`Qn-9`#&SHsOu%<H(<_{>-(%
z3OuA<cX<1=!`mAUZ#$gzWv7mm6aR18C}Tv8*xgt}z2%Jc+jjMfsK2U}Xn7~vEknCT
zhqFQJ#NP*?XRG%Vovj7ih_`o{xBWHt^zc1fHlp5lbn*koF8y82<X#e=A98d#3-y$t
zPI~5QjHdV@9*)J|$)IPePnj0uc0Y0C^C{~OB}UX|PP?Oytdws*E=_s-K97fx?<h;3
z<inPppNQJamv8aj4xZwpwPqFb`3aA2n(^*&V|^*pL$nm|GmL*tTibz6{e-DbdZ@pI
zzmBrm>Hsc#9q^Fa-$(w&k2UsWexT2@{|Ec_K^}S{>JXn<$0O=cr;msENS^dW)ZtFQ
zj_`SF!I3_=`20lFQ9jT9AL1jsL{CH=<AeLlPedK(i&=cUufyWmz8;HD@bz1KqR+D-
zbA110>2rPGv-mjQ4=fJ*Zm~Gecc;bqzMorM=zGlK`Mwt|F7~}`ah~r3i%;==V)3cI
zAS8V+kJk(z>HikS2l|Xn7}j~|V>|vRKRq;Fgr7nFY;`(Q-{di><nj8u#@={UIpbC1
z^VY0d-@#lX$@UE2krvlG<JI8k=Q3yPmitb%`B(U4cT4r0<&4qUzAxE4U-X%EHlkv_
zOD+9e-?bJu`R=v2*^%vez85S#=^L>)<$K5CFZ*^`+~@nu;yBBhzQSkrP1iDvsFl7f
zi`#uCSlr>8WAQ3qzQwD3<PS(aoxZ5W-M(szdwmTSukn4+;<dgOi`V&jEne?iZ}IuQ
z3oYK@yVT---?uHk)c4;OU*@~k;wyagK9=zIHQ#*}f8F<}#hZOETKp{sU+H_v(!cGa
z_Yb9>|Mb0K@m0RRS^OQ}2NqxL3u>boQA55%ExyJ#%i?Q&b1c5jmv8a)zG91i;9F$z
z&AufT|IoMG;#++5_L=bZBj13<KlWW|@om0uTYS53$l^PEcUXLn?>UR__5H@;`+Toj
ze82BKiyv_CL%vTe{pY@bUbG@=*f-VU$9!}LMEHE%mu2x2z7s5d(w7fB6$@aQTEcUG
zCgY{PNho*>aG$F3(XF8{)2rAfR4~2TM}FN>#x=eVfX`xF>%$uuqiu}O@Vy00JPgx6
zc#@!(sVgMtjPJwvGdi;!m~^9$^W2k>$H<EE7?}_z{^=oGM0gX*W~--JGj0VQQctlh
zx?5w<7Cr6QqGx^He(l%J+VQ+E3-!_yQNQsWFA(^*j{SMjSv$7*>TI6h`5G*K*>|?Z
zulYRR@(;dmSo$A*S6Tdq?;4AD`hINjn~wc|%lD|IzwLV(_!0E64E?3Cds^eYfVVMz
zhR2tR4AVdQ*^W;tOApDA@E?&sTfNIN^tF==-(eX})!38ayN(S1?#S>XpSSP+*mo#Z
zjwhma`;Ha}{14wr7JugR_GQZNVV_@4*r@DY{)o*#*<WMvK7QjHN7Ph*r=?HxUug0E
z{sD^*@P7;VVDzO7{UTW%qcO?qB*yQttmZR*f1KPFGJQA8hpHXMpXt|jV8cIQYKtC{
zE#WgzHd`I+Ct5G?kUGdenZDqOfbQW#{hmK_nBVi?j_`Xigroe&NKur{@{=!3PedK<
zFBAxTjK9j_Y)5X#`Wr2Mjw82|{A(>e$A6K<VgHcD`TpxIF7SK)NwMEsH%t7FAkPKp
zV;TBLa=wi5OuwG8<Mfd7(?hZ%yczkkRfV5uw*n8T1&(|w{4`$lL{!A@#hn)VX9*ef
zMUG4s`%5gn(qC@z>HftQFLmTo<>*zlzZH4z1`lQ6!SGLfuEyUZpl7QFe>Rxd20Wzd
z9X=ZzJ{uiA&-8mf>I%QnANVc)6D>bq@)uYf^DnTt*}v4{7Qbg(R{EPQeU<-Wi&y)v
zu(*@;pT0&^m;X9T@Am)D;vWC)7AO4=Se){EHYe@>jisOOf5qZ8{_Pg8^^?!}Cze}%
zhTLdp@K?}}Qv?3(z=y+e&Q=fl=RoP_0uQMNScVHUCYw{MvFA5F=-=D6^@yMH&=XOQ
z`DX|Oe%z7g6aLdI{Yih+;$QeZfBu&|)|3=cPy5j%KN0nezt7^Q{hKU)#(%TLzjoyI
zyd$d@{Eyo_zwtk5@o)XVviL<up1*VC`HKHzo9Fj_vnV3I;WxXhh<eSxFJwp$_U8Tr
zfzJiwW$Gc;y-tlOOPcY|c`UvR+^2^9w7yf>Vfsfu+wn>D&_jAo_$$btt#<k&5cGAx
zLu!Yk=YMs^;$8poT$1>C&(YftojLW9|6H5rLw}3KyZq}d{@B04;!pe=E#B?e^M9~D
z-^TrVlkLo~#(w1g1>+Hd{0!?)`q+-YvG)0S<j+>Yz&7;pFTg`85SWa7?`upt=36Cn
z(!+f<_Vg_n*c)_uB5HELi%ISs@b)-U0>?=f<k>rLg2ht;o{gFs@N{)b!1E=h1-$t_
zJ#elqyI%k-@)J=91iCFgC~&^TGXvkT_|U+$79SSy?7$I$t(Jadz|+s80?%7|R$!aO
z#{@i`%nnS}IulXH2BuhiT;M2+=LTk3JTGvP#kqk~EY1tajV+R4ejpC|;gE9~#)54A
zER899fyOkz6^ujd4liXqDKH6iyy=IslLCPJ4C_z&*p5G{pB~b4!Y#<3txn<m>w$;V
z$*cpHYD_xtUmAP1XrVLii|EQDKM}Rq8TYEdk(OTVjCD;QV(DiF&b9cgz)FkH3G`b0
zrGU3aHwXGGy(MtD#chGj7OxCkZSktW_bpx>xY^>)z-<;+2ky4GH}Igv=LMd!I2Cx&
z;&k9o7Ox5Hw0K?MZHvzjyle4A0X8`J9#LNoOx5zoxk*5xK19DHaD=7z2eK_*AIP!z
ztAY6zf5*Y!4J@|w{|+=-{JlWT;_nB#EFKD6VDU8py0cFYV*Y{67T@6Dn*!gp^qT`W
zTKvPnofh93c);Qx1s<{Z$AKp;zCG})#Xk+u-bdQ~S>RQR?+E<a;=2OxTYPumV~g(%
z7;iM9?hE*7GT@1*`vV79{6HYf;)eqBEdF_*z~YAki!FX6@I{Ls4V-83mO#?t#{%mt
zemroI#ajaxTl_?T-dzxWei7JY@h=14viRwMw_koHaJ8lXDnLKdC1sxt3|stM;8zwu
zAMp0hF9vp4`nJIP7XL0VUC;iA`eWdDi{A(|TD&uGuEisPK8xQDY_#~Dzzr6^7r4pd
z4+8WKgz))M;4zCo4*bR9(ZD+v`+~bI4g^)ulnn;=viQZo-WKl_Jk;XJ!J{pn68wV2
z`vgz5cv|pWi}wr0E#5zPp2ahQH&}dN@K%ct3f^z=!NG?uo*De3#fJp{VKF!h8U7Cs
zPO|u@;B<?#f=5_<Ofbvh<AU^#1w9dUe6YacS;2CPX9sJ5Z-BkU`w@Ys;H&(E@o9nA
zf$w8n7I*^q7mUjT&jP=s@i6e)!0_97UHFjc6@dpp55alIUHZU1zz1o32k@~P-v*q|
zI1;!OxJ=`lfU6is1N3{9=Q3Ux7y|BOyeM!r@LI-;16KiG!niVUCGcj(rw29zQ{RW_
zA3WEAUZyV8njv&!>$W4EY~7E!?6m=ktK7%<y1;heM;Tuq*yhw}Y!{U^IzX7@Nl!NZ
z2>%LYvsF%T^8re|0X(GU2Fd5y#duzj*1LT=i9Qd%)S=Xo8hbuZPH=C~>4~U3&M!DW
z=<RW8gWlSAMv(lRJk)b3K7WUH>4~WC`A)}Yji$e5>GeTxzuyo9TWW>QvyWyXqHgwG
zK$YN$s9Ss&<1?-E9BA__4{qcfl;_Ogw=9kYJ-_JOptn9Y1+TYxRs?Ud_^jaL7M~q_
z&f+fyU$(e8xC8jh;GqoiBtPUEjB|rDz}ITLm(D+|KYzybGdK^C41Fx#P6YjI*PoAk
zj<Qt6u&!q;-tN#1e(rO$^@q<<_TA4>mab5jseezl)46OzaO`;fZ)A1U=O{b2{$V2M
zXS)ITG<e?UXzSF^QMUSXls)HjlqC^R-)XMVLpF_Y7wXJb?ZI`J`<DU_sW!H0-`034
z^4!FDCEK*SHTG;;yJOS3g5Ex^CwMf<(i2hV1-&?1GT0zw(ANjQWbyeyEIIr{)CIvc
z7GLDpqW<95EPbP6e=ZN+Z|PqTK4I}Ug1@);%Agk?_;%25eZs4Phg<w#L2qyMo#5G)
zesyr2#orHZuy`nVIq+kUNg3ouw(CWWN&j~;UOAzS+KzN8OAn0&;a$j|t$q-s%LMyk
zV>+a+=dn0MV;T#3aDT>;`3=rGa&u5G1;}$tFpG0j{vQYDSbSUXG>d;4^!CVi1e-1W
zE@v$64uUOyBI@2?kHz-~(-uGAjMsy~3oZTU!HX>(4u0L@hn;og5of)4H0Z@ew>WFZ
z<H4tG*{u$KBKS8;f0D=d1jwokawGW{0QadIf)uw|!1Nn<jA|I)IBr~4F#WC|RoTY)
z?u<M}Ker>@@I%<>6^$d|H7J{{p5uD(74rX$GhV;tc_j1~o%ymYcnA^kMAS>p*u5M)
zUdW*TKIp|cUkfg?^gjg8vG`BHxW%sru?+ANQGX74@r}PYb82Vs3Y+J>;E=^11aGwX
z!{9>}e-wPy;$6W%TKq}yZHqs3#$|WVJLmmJ@DQ!@xPuY&VjBKXk);Ph6&43W-kx;t
z(7BdAHRPSQ?i>25rB4ri)8hR?Ll*BJy3XRMp&KkdDD)GH4-P$O@u8t7EIussSBsAf
z9pslz;?6_J+Ye@iN-X{8(8(5mAyj5@cE~#$Juc+!8IKQnd%)SDL7V@?(0469DRjTZ
zb3?-xheMB9oF971;*sE=Eq*%~vU{k%2B%m&Dde4j?iKoir5A?0ec$|0v89)Usx2-J
zdHcbWLrs=`N~qJ~Q$uSlJ}u<!4a-8`u=MiKcY(i!`O>GJ57M6HzZt&}Bwzhz#=i;D
zKILBEGRz|?`Z(j?@?3sdW18=8asC&BuOR=&jJE~J&z}mT)rUFt0`O75W$Jfa&upf@
z9Hc$be2upN(+CgKKl&Lq0H516Ud;8pYL3%0@|!%Al`!>@9<mRF8&Eb|RfVoP6frd5
zA+;nl8EHKllbydvW7<ayYD{bHe=%MfnhE?9jkAF1iJ(qze^DEvdg#Gjk&w48G=$JB
zKM~a!nq~3w&{B(6IQXoPw?>>DYPNaK34P7tSm-K?&kbE;adYS~i(5iZS=<`hX7Q@f
z`xdVb?PKR!XUL0db%jo~^q!Cxv+8wh!g-;KZJuOk(BhP16V`;Tvh=l~t1VvV%>DHt
zF9x+C^b4EkqR<~K{&HxC#eE?;0VX;3hjv-|#?U`3zAUuAosXMC^g9;xMASD!Ct3Wh
zP?g13h8irsDipW)yP;JUUmf!9RQz}7`<DK_&<z$}8+y><8$$FO7}D;Ip(icADfByw
ze-iqG#kYt4V)0KyyDk1%$SjHxb!X@(t=kcGSLj5G?+z7O{9x!*iyv}q$Z#lb>5qik
zEq*j~zQtQY-?8|y(DyBlhrF25%Fq@|Zx20Z@e`q!EdFK4izz)7`qa{&4o%XlG|sI;
z(}9OEr*OxEe&Rtr#ke}eejRY1st)afeR!SeHEdS@%JkaMJD`8Y_>2(U@gO-5(?59j
z?WMBIL*$1X23!VAb<#78KQr&P1Do}WF!4iAHvS0DLfI_+?nxPAnVBmXf06U9Wn9j9
z6XTVPuV>uO_<qJ6j9*|ZQSxinqYZuA`=^XgR+<I=?U$P<FtIwmKGD&=a&C*7*WS|=
zpSO1PytO@v)$>+%r+ZhPluR`>cgE+f%*~nS<XqX(5{|X>boF+0##`sAj_y=RYF5si
z+}Woj_@gu@C!Av+e9N70pHkJ*-jv|{VaXq!U7Ayx8=haPI(xcTW|`XZ{&%&dyOSL&
zyW_34T)tDz@{p4QF7hlBrmb;>3;u<|8Qd0n1#_KNJy@FKweBF@X|8J=H}kzpy^5$S
zjyyB!O1AeTQdSa0QoLw(=}CFv`GrNL^e?(DxyH3tEZK``I0_32@(PesL~BPZH%D`n
zgF17=MKWx*CNG~+g<PsET!5<DI(wS5n&@#yT0T-$Yfl<FCK}`odJ!eDSlo1PaC5_y
zft0W_zRq?z7Xz3qO2nHwOIQ=<<jlznmv(eDt<>N1!bI>2I&7ICEYy6Ny5088h|Hf|
z$_$!3;~3Sl&xP=X(=|OEt<p!xnRqLnt>(_1*V5D7*0FMKJ7LVS)_7YIU*@HgiFqB}
zEuHDs_`GDQwWDV&u`S+|N+;suGp|q1YniAP%xBb;Znh;lJDTTVBA-N`9eG8C0Nv?z
z^TKnB3+Cp#jiWZSp6ob39-{%APxBld$e*3bW^+d>IWM)o*W>A5Y#|m)$Fv3&={9n6
zXDcGJ#-i<_InW)n4cQS{OhwTgXpJyLL>dat3S9xUK(d~fZfa%ri$EbdUR;mG94ba1
z)Iy@7+9I77;|(g*p4xNh7+#_?dm!f)>ijacMJBtY)5Jjm<{SC*!a6@{;EGHEFF`sA
zAu~UP`KEyMmH8xwyaeg4bgQYgHDL-+cOg&o?*x2u!PfX1lS&;Vk#PTvgrK!V%_Hi{
z4ojuZX=+DzkFFt1Ju4z@h{d{kT17`NPSi1-xf`0b+GMAGX?jmvo1sdtxWP_`OnuTk
z_gX%}GJq`mq*Y5aDMQHgL}y2rsav|p3=-K&EG)g`zI&BBooq{5a-Q@u54}nj#bRs7
zzMvQAOp{siN^?s|C1%6q6z0Ri#A2<^Fyu)OnYk91E?vw+pH4vWFo`kM(PhM#Cw*eU
zq?2)2i`Jy>SDxr5_bWLzP4ttCCD%508tLbWeloqKv!}(-^F=*9y6t$rqoBl>QLB8>
zPwo#~2+dQz)60(DmY6qa`J$dY0l<$lZ22;r+%{5Lx>Keyr|*(rhb~{nl$E(HnORCk
zmBnI`ymB(SJmhW3wvJA(wE{<vO_D8FAlfXd(%s|HMVpxpwe{#E2WTX7k%}c-nmU_|
z<O)O*+}~6zotY-G(CwspQ?`(!+ewUDXS`cWslcj1#-hR2xHr{~rLZ-_D4SJ<GbCHu
z;lQ;+=NQF$n-Wc3B@MH3bIAZF^DRBm(Ua&%t#=nyXt=IF*4C6vkv36DngTpW;5w$#
zNh*;?a{{X_YU}Oj=8Q5^%wlXSYK<pb$TvhSBw2hwkSEY5gtji3nJ<=1CDJXa5^!%A
zX-Yw2Nnrz`Oy(707RFOeE$zfj++|;Pt+%JMqs8<~_%SIg3lRlov~-}OyFCs;u(Wh-
z#f7?WEj_)a1-M2+T$yf4w34!y@VW^zY$O4uR<j*Q##6ec++uc4(7s75p{`@-$uz)W
zm=g|bJ~)R{Z@7TDC{-Dfpye7BkcQv`T4hqnj<EiKO!EaFm>J33a4gn>1r#GmBxB2n
zxVEVyg>3@U!?U$KyymDv7QSwh*E_00t5IvZtIJ54CEyh`)`N13QNgS+jCQ3{@pXpN
zT$)vs4a$%VLpi%*@POipHSyNWk?q3fB#ljpt7VkCXKi;pk=X?zukPqJ6_~;7%8&vL
zC)@N4wlexl6PH-SV9~T;zMXo<^tq?IMJzlOkqJze)Ks5Xt8KH)CyY=MjzKK3HiIi(
zXP8QpJf7gWhA}g`itKBlt6q;y=a4`p#*V2~T2pXb2BW;l;PlO^Ey%q|Z0_uEXm$0*
z+IEcf5*jT+gTIv7byu|PU_egfQPA2;qH$W+^C`1oV^~bB#_kwR3ftAo<Y;b6Bs%o!
zMvZAzg9V4G<-}smO%ur;)I|KebcfevBYdRvl5$!tG{Q&1n7O3o?nz1Wk|6}GU*zME
zer0xdjCScc7#79Cv|m`cGzwFYN2VG7qVuq&l{GP@!+hFw>NTZjdiL<+$8SJli!jOb
z-i245f6?1tORm0*M?Uj~PRv$o;nEtSH3k_A8<#V?p?|T>jEZ;xG__&IHuDl8jTbOS
zxdkLD(mB_hXoZ6dn1)qH9tbUsAwgC6nvWu8wF9M@b3lnaH!+XgM3bo$%LJ_ySWFki
z+IoA$xyzN2!UwfaRv9Vea6&Cj<$6Iw`<U{mM0`%EMEfBq&uW}Ut7j5>5mQY8SA!C~
z)X=&p)j)Z<nhZIu#4xWh0yo}+k=wsB^8ZemELzifR~V1Q7FE<#FN@VIDan~*zEsx`
ztt8hWL>82Uov&5Vs**hWJz7=Uup(AjUEA1Dl5eRC8<#GP)igE`wZKv<moAMiDqpH|
z7kc#Sikhn0rO}3{PMYr}=^~M6eMMbmZ9`36Ns*UW-4Ly-MupM3IwTa&DOI|A7;W3V
z%KF&S^7;m+OO=bNYwDs>svdo#Ed~!xtPNfeEGliQU{Gl@Mots&blZ3hv^hJvJ5pYD
zaw?Gxc7n5Gof(ro4mZJ8&ej@Z07sd#)7sAY*{K&!Qi-PSq*sI&bhJP#x0C^EW7?1+
zP%^Ca4sR66A?9S`N&sw5SoFMfJh9$slN}o52fy4VEg%yX%oGOiSkVrx4N?wFPgpKP
zDzrinpR_BLVvs5q8z&ZcNKK;0WSV(d@#MvQHD&>OKo+Dc70yt=bDe!@$zgb57V^Et
zpW7mjq;U2ev-EUBz?kab6(SN|=g)@I#lEViP03WeSF=e@VFBz$vK^K-*51_Jia;IJ
zK>J~?fp)}LOtc~*#@8BejrBCIibExhsX|zwyQxbTWa+X2G~PBFSMpNe3wa%AOZ0Tb
zq!^k*zfCVvJsD){wUC}NYv_`3RO|>-0wiHw6<2JoU)|Nw9qW$AsT0J2=1F_kSR|U(
zO_W^35=63BI@M#nPrYC`Wxd1#&*M+U+tMa#nOCI!e0Lc0bG46eq)h{bAcIjV3Ni4G
zrzf3iPPd6L*c3pp?8~#>NGb$iGUz2J7HjKlS~=E<?C4(8)6$gc=;@Y4(2kQC4lLO5
zM0ZmscCr{@9zr`Lyhim(J2E|ZwX(yLv4+vu@RG!e&4r++m{((Z-O=6FBkD=P5n7$Q
zNf2P1B9lhvG>KHzn71$n+UT5?D^f8PytVlx#Bitx)<>*`IUL2&hD{q-Z3HP`BKl7;
zh()muS|r7H$m0Mb)?RRz&WB^rq9qOe(=I!r#?2i#vp^^F$oeKH&gL;G{Dg~&N=vDO
z1=?YN>~(|@^^n=4-5j%HLySlumT6olfkK8}5hp4sNjm(9LS)=g3R|&%ZMkkrP%s-B
z+MRAem@L-Wk)*XL90mihlVpz+xt@B1gH=mXz#!R6q;xeURzu6M-iM9*qYW443QL{n
zdYqG@=wVs%$X_x;%pMb~qqyW`-&zo#Y*~|{U1Pd4B~3stvF4hTp4IGBn6HS3q&g7m
zBfrAX;)z60f?W$k>F%M?hj)QCj91+tes(f9zbIo~i7`Mf-hm;&!*N8<teX^`pU_04
z=q-gwX>Ov4CP{h{B8hi;*rj-BW)|8+r!g}FZJN`Zv5`oFa5Jhj;Rl`M6fzbPDaoca
z@yt@%JW?qHJ<`1ysd-^55-#af3O&bYmTHZ_1cydoCK%(04Mayb6S3}T;}}CsFWzlz
zZ+<?+gbH-PQJbgyB5ARw6Dw6)8^>S7wJx9rkiR9Jz;Jh_yHGtvM&=acV~<i;8e7B1
zp|%v%D+h^KZHh|ejKZiR=DufDa<s=^P*_A6b$lhP{Vvk~IR*12isbP_K6+se#~t9e
zH?`)Xr@WdM&KD+$7&gTDIkI3-1YUP@ex6jB?uKRNoMEyN9$N(*u*QtR(ICl>tR2Qk
zZw4U>G90`c#1TY~C~R9d*+H-j`^TT`144QnibXEbLz@k&J!fNA%E^|D$5+Q}E_R_%
zDdwVexKI}&)XBJ)3o_-pJU_6dr)PCXTyvK0ZsBE$U13y4_E0#*DIw?6yp7GsCLIN^
z?bR8DyD|AB4uO2Ii8`NVaBN1lbjYYpoz9F7wdtICmj^qh<wM~HY|zLiutJkliRA@#
zK)+a9nRiK(m6RFQ#*X-vG{{KGSyzyGltftwnKA86(K#rKW<ut)1i_^8EIDr`#hxp>
zVYO=>w(vyM8&F;YX^jIpV^1l;XFAu!0?{>gbLpjyO~Fwp98p94{JVbyHQDJgHJa_M
z#0HQ`9!lCCnVMwSsE(%Y2@BaI3i4oufpZOYNawGmpstRGdtM4<iot(^<B0Gy#va+B
z5)|QC%XA#T({#pYB8-de`dZi}1e?-b@T!;$pNGkbc#4)IO(i>{A)H2<+Iqd@*b`Xk
z>Fw3ck>+u8MC5ZV-5e|xnj@;m#GdM<#dUdkWkamKp}e87o)&xwq2L4kq3}qWmmhrR
zHJrs_c<L}o##z-mkE;P4;#8p+w4N%3f+vg4OZS-IE>Dg`+<59Hn$qc%gxXU{XtP%m
z#?>uJs|s6HTsd%yl4(FuvUZrBrdi|2>1OeD!obNo82YBpIMjrLmVl5ZpIE>-kOLOX
z6Iu?Cgw+i+$jY<NxHmvFmKQ!DoOMabEKWaqKvo-`2_5jn5Nbj$HV(XInH5ndr+PYj
z){^&*Ol&3CH!>@v&6I{>m`ro@N=c)u8z$q53P_~*fJjfEPxzJ@(>sYv2<Fhqp6Nrt
zWEg2aDDOlcRI-7j_MpN$r3Pr3CmPI#J<kV`mI*#-w#W7$l3wr;aoRi02bmTNKG(K~
zxF8bSs1>LA_K+D=GIMAjX5E}>gGeKf^56<YW6szf8@f3}M`m`GIYOb#aXC??W8~M`
zgK;8D-w<w4-oZH0rF&#;)B5<8sM0^IX3Ct46IFK)0`iU>i7q{a@1V@lD^Yb15earG
zmL6hLq>}bD7Mb;VJ}v0p`8CmH@US&f-uX4rrI&dSpE=1Ps&o?P!I_#tN645E-q~}W
zggP;-7!`Z)4XUmdY;b17xP&yxUy<w*LPmbA93(yWoSb-(B<urK<~cc~iFmOK{1^8*
zaw#UQFPl(JG$ee;mNvIlh)M&(_daOnCA!V`4#>ztwe&?3%1PtF4keNG9u0K9dBFQR
zkoEqI$TS=@g(<hEpL8PuWJrxClU!q=>@*(8&T}ubev*!GNYl@0fkeY>a#c<n(o={t
z5nqYzojx_8R;0IRWSluj#yb%bnsCYdXGt9^;hwVv#Ud1IO7(PgwD2}N&s;-7V~9_2
zK9fK)KsvgN*txl_0RnpJS=T)FezCnGnTP4ZhFgiOUMK^7%IJ$$VERb*##^w$=kW@k
zEK043LGftSHH!-<-5!bLL;LoO>e$h6>ZAo2RTh(}^s0o-;xz~5Q77p)ZvYV;F_j{C
z(~5mkay6+Kuer>J0+seROe7UR8l*sCX~RVlY8?v#FRq!A;W|9gWK>SW&*_<6A)}AK
zuBMhm4|z;_(<Os~zKapUZ4XK@_b!NkF+{l1q0D^^Q--glV6MYPnJXDKNz4&0X6WiX
z{p71DDCJb>Bx=LtROuv&rJza?er-hnQb*Uw2cQvw*o?12)*Xu<_&4rc!bviYx!gLS
z;@D@&MxJVp(dtO5g0ixQXKHKQTvODWccvy0j+Lx>+YTQSN5xpBb-jAW4tI(2BjDh0
zO_P9*%GXKmj41&Bf;|OHa&q=)KWwvsBvjUDY=OZhI~x>IC3Zl{r40%>AWcNjq2%!g
zNKKvOJeaBfFFNfMcj-bH2HQX$dg?M6Ci;XTp1=TRNADXYb4L>4N~Zv+o)jFTvMIj$
ztnXX?i=2(0$MEjxCiR%>n|e1xN#U_+h$VH8yV}VGCQOkVniD29CA;RC1bp_$x|r`+
z$qas*lDIc9&K&a;hRTj*QyZv^8g#cfGi_~PwhH(lH(6YmOySne8nRJvNMJ=ctSd1L
zRvb(O)*Ix5cSZT&b?AuznglUG#O%-$0aSLDI4`D>o(UksSK@|X4D~z!5ndP*p`<!y
z1!BVCiQ-j;D+E!PD~d#cE##DoHE{oEUw|MKa)N53NSGN|H?)7v3AmB~L&`R14!P7)
z0AX`F^$_cAVoNcJ#~_?T&H_i4VAfGfS4M6f57N1rMG6HXASAgF>+tF>%;(JvHd!3&
z$<uY~ND=DRQieM_hayE_56c|}tuSAP4Yurm8a5kHpfh7r;s5br16MkL2&Vp@7&hD!
zH(`i$s-qKA)uEV8SMz!t>ZfKw$+eq^6)l}xC?s(au>hv?!a|`nQ9L~;1Q(-)knc#>
z*45NT>z1yFl`qBlb2JibSW!!NNl-PJVVXwR-xu);U=~8`M9E<#_o1*9>j#zzc3+B0
zF)Kay2vY;aIkW+V#Ca9+LqS=UWgTQkN-HbbPdQD1p(&)T9K0Ag7{FIp_!ERI<?T@x
zD+tXQG%b9<_}~~t)i=~Ft;G2{cZFOKuEiB5n^E#)90B8%7a<_xKf%3yCuc_wV!_B;
zS+k&VAzCTq9Y1}r<A6^{eO;2XnYe(;_|`y~Y5m4J>m9DKcwh^=Xc>n4fmM*44M?e*
zMxFdQA!5NMVyY)amz6b<>?Tor=*lKb+*-(1++u1;wb5}M$C-6VA94d5>@*h21oMvB
zU_uh8g$ZZ?QbzDye-~$m<KZX|UE%Su{!S?lp|L#R6%s`3X$ukW5e=}0mBp`F)L{zA
z$_(+^kBaTm4{wD<qpRz|@+1AwhS$=~EkJg@D6kK<5qRx{!@!5su&`v8#Q^Iw1~dfD
zwe_{f3)<`^)6E`9g7b8b744I;7K@8EdU~61Q^9bhqx0$Rm2~|R^+SUZV){H1HZfg}
z=aXbhGc-5e)st8cg@g)I(6yP}sRG`-VCG>rY7?*#!r`Pz7jppvva$u&ERczo4D<~A
zhV$9Cv-kb1ZZ<;=S-zqb-LlbOis%J3p|gnp>rPm`=0o$)4m1y%Lu{Hwzf@J#R?@uX
z3oi7*%79Nq8_Mez)t1-QM`HjKhb(}fNRwNxautMeK8cZmGst!a!vX?S1?lJz8shyC
zy(mFSAl$pG3HMOV4CWKDo?bJXH1qJkJQrVkD=38eF%{DJ2-nhXTi3#JBNB%b91}@2
zi80UwMu<VI8<F8`vTFf0xp=8@e^4zS$a7<m3`VJ=6@EQSpR*#^oG=>=>7oq?J44jT
z7DDT=3{q2P2M!o9wlcGHSLw8jQ@BM;NON0RcN<e3*OuX&K_Tt%)YLZU;UVW7Vu1-J
z{ihe$9BDGYBo(1)ZuT@Te0?0zWZYJ;vrjlLRgs#8r8N~xv`WzN6&j^Y9S=I~=GG-!
zd-xi=x#(iwcx+cIJA0a&Xt7<gpt>eP3m`Os6bm0>&tXTXiq)_McnQW_O<xjS5m^wc
zkCxX}ERNA_FeypPD@sBYP$Is*wHdqgrbJ6S+-4XKg;I5u)r(?_%c~=NbF)yQWcZNA
zI10u^d0EsKb5t*mS2<kbtV1mwy|}V2i<WU5kSyeRv|;R_1DHsZL{lgZ13u7BGQX&)
zbEP>;<&gldY~h``O<ADIZ9TZ}N~*_8JQ+(itXQ{VU9G%_w5A`Gz~bR>a%?yTD=^J+
zIs+-7)5wa-+Qrd2M+)REKyd7OoIsyY?{!J(iXJrF{?~@86+1`1QwDp5tmH6+ix4`&
zTXXJYXpJ|gF&U79eFze?nfI6{ow&N6*(1KtK-r<N%mW<`tV?#a##%d8#^Hrh25_OR
zF&04g@~ECNpo*nuLF#z|VjIQYQ8($O7m&gEu@()k$dFmDiew0dl$T4f3FE#hS?<W(
z<0g}=uv#2!*Ky*@+6z(BybE{HGLLqR|J6kY#+o3r4cC{zp!TtO#g`E-RZR)3EPH4K
z9L=KBWojfRXKg$7iH;%a>F!(~gE}-LKtLNPN3Ggh@vc@k+ZtI#r8T^EhPN!bdspg<
zPf|qYct>|H-XDx(3YZbo(x!yw^}X2h>L#?naa*gU6Z4KP9-0(+1*5wMJJ_aVdkoXD
ziBHOyHNBT?M+$K!Gz<-vk+vqUS@LW^!dXu@u1;BQ^hV`8upUpr)$$VLo&!1+cFynh
zH3zE|<V2ZGrx5jE(BjRzPPC~L^du#^ctx77FU5eay`n@@E0QqOyq0<@hfB($a@s-i
zRuJtNfdCC*323*dC4p&9!l1d&)*|D?Q*TCFn(*p_x#p&CEi`qnmyngzr(Giqb1VD&
z#xJC63g}{~YQ*{lm8+#wP}nS9|LKF59(-aVuS=#SQ>+)c$S6=`2={()Id#I>Ksx{w
z<&(a=a0chxmrU<XrbI`#$c{%w^pi<uYD3JTndU+sJHl+>&<`Oxd9_wLHdhBUh?3h5
z+ip}&-U7nmJ=^v@^oVQ-cZp4Tek)xOpdK0{0XxS%qhKNHi;SIg&Dc~i3+RY+ubp2s
z(QHWHVBKMQleqh?&4r$H@oxCeOh%iS|DJB;78~WF9^<dH1^#!+T`2TaDOGYOc)}6m
zFd%h^e4P9o(Qt6VqrpAXO7DnRI;ZL0B$3W(vNuPhgJY+$?%y6vgdRk(8}1!aJ(iB4
z)z)O3p6iX5q4QQkOpVwTxh`JFj%~blNkgo<raFpiYXoZ>7r=RlMXM`tXN?H;*tO$G
zzAlOzYy5phmC2CD1eC2Uudk<!xCzf$q7`+~h8VKp61=W-X=Mcy3f&y_+*rwcrqNya
zx@diUG=i({R0=%Qt*C9l_hSBDRbICwT2}(sk?UMqUWt3~XX1jpFv<>3LtP_Xc^6h2
z>#_J(MoMsh#Nk3WiWe=2ShF+|L(5gsY7`UZY8Tfu)Nnar%<>Vdia;vD97EyD6o=wa
zjf-j*p~mWlx|*dW@VD?*&gvAo^0I8o(F)66)s|N*iBbRoUwNJ5y~DbscwyEBq`Upd
z0beg(ftUleQLz*bA&m^(m#CvV{wAfivNl>p4rbUR8A-)Rf_%%cC6(wL!xkoiw8HNa
zpgkDFI0j@P#cQmFnD6x~sz^V~*Tv=ai%CDs_p>T%xg8kHHn;EOs&mzfQt)b-ykiX#
zn@?yYU6csR&PUb{x*Dfnl@S76A>rr?9NaMJ7|TzL6)GTO70z*%L7vHENwCKtXH;sz
zL@p{#HsKN{F+?`avoG_FdBG}#Sci7M#JcIpTdHUnlIy$Re8ga>G!yJyqB@Kfe8n|*
zrH*$JUQe`HbUC5^B*SD|QBZtGGHKW*8E09F)BHzHCX1~^X8cMDi-Wl7O*dz9qlc8v
z^dS<YQBa#&!7zBe#WALIjXOJrXBf7kQeCmjG@=wmrFc2G2QTtTy}~4%1qA8nMmaZx
zQO#_KyaZa)AXX7!Pj{UBDtIFFn+sr$uMf~CRv-A48C+w%K|y4N+r`e9G|EhB=Xo5H
z6EM$A%I;KiEjoob3?>C$KWwsdl^tU+1N{IqvJiOTD_#Jc;Faz;yWh0nk)pDmAXve_
zwxPSI)r9U2;N~{pjET|MKq>7OT?Y+F61+Y+jwx1Cm~)yHREWJdgqKRw-K)Ftf@-V<
z?`(G9N{~)MFb}u4WZ}w`COCvR=^Oy=3S9^jJ<uvXMiXdVg8Ge>eJ;666KO~;;$Kh&
z+0wY9l8aXpib~l97Ima64%i5xqu4y?RW99~nZcaG==yZrkjhM;%QP=&U<)%ek>iC{
z@35~-kjzErwDqB@64<oDG-(foZHHdwWop9j>TU0#_b(*E0~s2UmrvIH_IPJ6%?_Nm
zH?1^VMlD>M7GKwku&EV2gpBGs@S=JGzd4gIZ#-+MfS!o2>2Wp+;>eLP#dZSXpj#a*
zOFFos;S86Of2DuyMfXZ?FT`oW7|5_|mr1{9!x48nx-vS9d4w0;sXrn!z9>R1($px*
z8K*_u5$PSKh3%o}AvR|^)=cBX&LOOPrnzJjv!~gs=~}W<37nfE1Y*xK@)jz_LZ}%!
zh%+qK!I<XI2tg0eI6-T#40Jo|z_uQiaT8cOW?i^mZp<Sj1+&Xz0v*hpha`CrGe*%|
zQXfBh`q+@hN&CmLv6HLnMz2{JU}t1vK^ycwu9pUo6JdNj+f3Uvw#~GygAk12ibF|K
z&Y<fhh3@IV9{xW)>JyDFrsKHLrP&6eJEui6Wp**W$86_y3ftP=1e0a7VCJw?xH`<{
zc)Z`xv4-uCR3tt_2jbH-Q!`iN0^{Y755Yq&I)`_I$n)SLbbrQE5-Pz;LK|#UUD}dN
z<K8Tqg5fTv8@Uv8qXiFp<t}=2ovkbX0u0)xYc<It&q}g|kR?+N*4QVr6<|8xj)At&
z{JStz2UHr0XS!%EN_EF^uQ`QdLoGitTO=#2gzds1W-Gk8B8qRIXL1_Drd!&B3zt~m
zOA!@e8IyxVmQPD>ZsFMG5bjCHmY26xV$;U(z{@|)-mZA6y+^Dpm|&~sFd<8YFoE2<
zc}y>Eo<=>Kqo+A<gK6c5cPIroc8l#Lzad5J>UFGu*0CZ^p!;CrBCxozez)MqOn5bd
z8zG!aWxbs+R~*S=5%4e8piUh5lP^0~1Wp(JN%y^%Nu;0SRtary$(VVHp^dG(5{V)U
zqbqyi{~<D)=;;)3;g*H$T|_xdngoNamT~>#oVAQ2-OP<w0}la7Qg4-bN|*pAX#BkZ
zs*=uM8OINUbkLC<Ou3GWIJ*O?sQ|jf))>JI37qIfjJ6M)!T3RRBFk*M&N1hJK8Qg#
zZ*^ciwP(rc7=KB3nlP(2WhjJVa0WV76ov3CJZCWegS{_krZT5O7q~d4v=kq++z8P`
z$|ycbjbeDDl$oyHY~ysZOwpwnW{M^Pr$Dw+l5YXQnQ=6pGZ>jd^QEY##hh+L3T>8j
zS9v&x5h-2O;l_=xY@;NFkZK&8Z3GU;wlzfSu>r5EY^ba#Us`ff-W)H9?gPXct7$ik
zsKrU)u}LN&*GbT^7q1c^R39y;z=vA{(W7V9Rw5GPwh2;AT|@Z-9P{Km)k+|wz@gMd
z7a?y+VFqbgO$8U7?@&3sBMlWh<nlU>y?Bh$Za>C>0JlGN(PbRy!Nl^iR@T=yQs~BQ
zyt)RjdQ{d_m%#h+a&n~-PH<~wGDnC?@Fu92eMx<6;nH#()P`M|aPB1_x)Q0at3>=`
zMXV7KAspX&b=1}%IJKfA>@r6(&=tF)L80nsUA@#%<kW#)*HpwXYW371S8NM0l8Bzw
zm*i!3vvOH%S+uTl;fh#AdBx%=!dh;Bsclcm$V$rfV&0*;5taFv(X7X~j)PUZmELVy
z6m1~>D;mxu`^Z;;=|d)Ou^cnv)&R0&(OgHd?aV_*7(PCX#L^@8WAN3?A2EBybRZ*!
z#4IATU)B2yy(da^tf8Q+lOT%#Zi&!!2P_-3+0`pRDei(Nd(sK|StC041`ov?^1^9u
zWA&2in&s7qP~r=P`4D<4rQY(f5B(;IiIs6FTC?-;DqPZDs^ED|7frZMz3Q1aCBX+7
zTrdqU%^tPEfNIX@LW?*IdR@X1Ae>^|SG@)B#A0@;?mj{9#7c4aTU$e?*5HGe_+l&;
zaF}BHA`!?iN0cgt97BiUML=-1TwFpZ(cEA{9*&inD@<Hen?Q*r!Pe`Z(hJcULxb>{
z+or_MP@&Nf3Wu#rCQYjbuyiR69+*}P6f&BT)Xn0%cmxwPtE0;cE2|^;$&-aOT0fyo
z)M*NvL8$;Rgy^-zv)b_ET6{iSqQ+5#BN=e$gBRa|Bruxx+6YEdE2Y%w`q8{WL?bKX
z2|j?vXp5(ni%lZ=TC~Pd&EhJAQ4wvAFvD;#?;Ws%YdxeCUXyNM6wUFxIbr8uF6JV}
zH7-@?vwaHMnlS75gy@;&6%^(jpMq5hH_@<Cj8Cd6uUv|?V&Vjp!-6q!TC_TX$o=@V
z<u!GYdaNMhQ|cFE5sEE=X`Meo>e3qAMWDo@2@)69*5P7d@x&?N92mxllPK;#o{@!>
zb#eeOKB<}y3n(JLgbZapUzn&O7nLU@zn=u<!_bH&&A3tlP2=kp_#HKgEmKZU^*ego
z*oy<vOd^UI%B6BWACjv%7Yu`Ui%YaJ&6bH?GfKncI=^%x6S}RJ4)swr=7+Z%qf;>b
zJ5Z#htH&yTDaBbSrBvZ^5#rEv6OlHp_|Oj6L<fKK<(eTr(2-<8SWfI>J*%5cFp90I
zu|&j|eT}504cCNd_CPSyGya(g=PF4@Zqc}xUO9L|uXOR{@XvjP-d0BwZ9al7m}jxr
z(h97GbnldY@Cje48>_JP(h(PbZK$lG0~5(tvvetZFU%YMT7}~+9I>q6A9+H_Dx6T2
zFT!$8KktO^<x6qOBe1p{7hR$MOs_6SmGqNMlqV9QgDvPde{F~^jpB?6M{ZDUrc}Xi
zfR7-DP@1R82#%yG7sAP8Cke&}ua;tKvxfS`w|VfxI`}mTgb6#b1Y+xELXtc_*mEK{
zMnCq-Z+}RzQta}|L{Az&qlwkp4Pl}J`q={f`sMnrX6&qVqAb~z0G(MsCQ+}DU3ghy
zLQeF8N$C^vqZdy~AIp?E+w4gqn2q0qppA~<NiV0}@s+qBKQ>K{IH@;niKZ61Q^W5l
z=^qTD5Wqxq4r0ezDDE0>!LRr5<qYhR@(}4jc$<WX8zA`k(WVyOJ5v&FeioG?+&;b#
zhfTXDEF_T~?hZLFe20-L<1jjkpqm+Vj-pd<a5ZIoLmWz%)QLFc6C+BVh|7FFI+D~0
z3g_cZfud4f_ZY4y1Sx6bInIaEP3vREyB?U<sEMw>{X4Uq-dm-!LTEmQ5i6&4O!1XB
ztV|YT>Doc)JG=lCx7U}U&Y+a48vfai#W)pgp#MJsRsd81gGV2{UFDk9lDZgAWKJe8
z1!Q(o@X0<3oDSZSve7oz{p9DRm|1d7!bRdNaamz9!-bSt2`*F39IK&Y5Lp+5#y?MC
zjIYc`Sh>~h6jOqMgPW)4Awr3iV6O$~>8GzHi~C{%DLA3VUNxhC<i3DM_FlMuwm;f=
z!5YZ-2C*t+bbt+xm<V=@=}lBb%~oU8LOo{d&R5g1JaFty`s`iVmj1dowxy%I8Ata@
z+wgm==rEe%@y{PqIV8nD!-9IrnU{gb8bw<Gj`>J+^j@?jX{lkp@vTRm^5pi*84Rw&
z0zh1)_`g}utC1=Cc}BDkg-aI6A}#ilyWfi++r+I|W1^&g;9g$-DOD656edNL$uofN
zs?{a*^WTILh=Ad8teY!Y!VUy&?Miyb6<8g%Wu4k7SQz79nc>1vCPjM1t>Aj|m{!K*
zrdQ1=H#g>%1n%HEz-T9a@dLlXqkA)^2I`4h15HP&jgE`>0zY`L{Ge7!C*F|m$RgcK
zXGVKyVl0zR6ZA4WniDO^sGAZJHbKMzR`=8pU%ZK}Zngv9_K7a&q7~>YYRG8O?HT7v
z=v+;!JD~b}24rWIefb#|%Hph03n2*Voy^!?eg9wS$wp#CgOZpqiI@mHw(|PC7^C>w
zl7%!^kvp@j{ze6m1`7iIIGeF!T0Kx)I6)S4l(RUw$)3f~Fe@>=70<76u+q>s*&l0m
zC5>71(li66RRkko<n;DmOG0jH6OR)xum>5S0aGOzLg@wf)6}sZE4yaQ5gaZaPQVeW
z;sC=0)$pNMGuK4tpV;lOE>IKz5~b*f%BWN7(Yfg6L8fwOtB5!8V=Z{AQugY!**6gk
z{y_)(1x^ArgOD<GCF6_fy;kdg(gUcr(O_p_K{Xni!9S~22i`?T0OtRnO8@5(Y=u39
z4frR`IgF3zR^Nw*S|L`$>YSknPFc8oct02}CT|F3#_uVww-)gKX(U-vkBNexu5k8c
z^gpYSb13EIHnq~rrlfy(IYi7MrXgr_Hqpxq6|UgRLZWl2wUm~SGz)q`;Yt**TBwaK
zRB<md+T;aF@r*L{nffu#bZ)GuDnWJ<Q2d?*!sTd=gGt`>>Y1bK(=$}M<b84a!iDtA
zqHNY^=`QPT*_9>f<-pI-+1y5}^#F|@On&KsI|zS^CnF|cx2DqaPqR__VUBIE4DqkU
z$!4CrC<~f#6?v<yS0GEX13*9VDQ^yQQT_@x(MM^93A}ITbh@BS+keZ%9%eSZ8;_q0
zbn}wjXs*-mqx9Oyp7Nq?v;xt(gNA9bmv64msCq=ev@|zyG?U|7stMi-3&&lY^iA3n
z?mW}7Wb_u^H%?Y?jl(WV3H%7(YO_$m4<(ZqL$R?WG{_?(Co$ywWo`||yxp$Hn*MKM
z?*GDQkGU*kR$DAv3E9Fb%akF||Iz_RrkP)JN#E%34!;KSe{C{0;fM~Am@`JlcG-@O
z?X#tranTbsbCI?cSSi{HEM<(vmfym&)>)eg9&L8<X(g6r&#W^@V^aeSSlx_+2dFi#
zni*@MXUH=aHa@hbvuv^^P&KV4Q1j+=2Yz-!4z)eYpnVoL0o05X$ykOnnx!?FP7Ema
zW_vu2KteI60jyTWanqVcVjM&A`lF8);G1IWNXvF60dK`y4Q$0v7xwh7H<Qn`y<>(k
z(Ssi{GXl;WQ+B+J0kb}_x7(pv39+~~+8H72D7>zEov?~Bc5dnKdmdPMGnrqOlHX@o
zB$l#^Un|9w!&_7nC7>JhV-Vv~@e=BID*gv(2>Fc53^Kj`7sCy+X8a;#iEi4E>3>^@
zmzP1-lY?Hyq&)PKGYI(Rn{v#t?BLH!ci1x^+3az%WQFZv1HWV<CSSkDVNS+1QSU(U
zA_v=Ak)hduw&G=3yZ~gf%6mopZWz7wq{%u=M%OmHmCW4yYc_jUgk$xcKm52le#0$B
zZm@KQ?w;XXUDJ(=$@^B2`O+x`rEGTjUFo&BR|6HrdzB_Z-%8^IOiuT89R2P!CuN+o
z(9&q`rHxO}FBr+&a2^NxeImTa<%(CoRK%H`?L5Vy<rgpTb6c^D%h%kve$S|_ht3_>
z<hec7uNz4cUr68*`i&#1F5_;iB+4(Qa$DwYAvtQ2WCZyjR7#eq$`|X*Ti!*8$LUnW
zAUk?H_<#K&A%-HOVr{T^It_JnntQ56FmWggq1fvh++vZ0JwUgYE16E0wU8etbSvo{
z#iagCa;+1^5&<D)B^P{bs%Rqp8aZuNFx~LKKrvd1AHt%F&5SaA%gw>XEYQgZB33%u
zi~{H8NWj+23=)aaDg0~!i^QfmikO=#@4Pj2u5DV6pF`zKP@>Ygbi){pCE8kYi;MYp
zQlJO9VFWFO8qUwpF${<0+9bU?7lZ4(x(UH?M9pooy!{sMN|X14-!qn(Kw+Xh1k|WY
z?esqj!d<-<Tvs#2C^k%K*w=asf*2PR)V~ZMcjV~knuGBsnF6mUn{m0G2Q3$DbFJak
z`WJ3AS$;AA?+{F&lDP%)!@iU{UjK6oL}T~#E)xCVFnF2ZWu!vUR@!FA=zm6JdR{1+
zN~1{sU!{cpseRMALaV6e2+IDHeQu#BD+0xFMD8iFZz`QH>IyF9hvenbAXEysesIrR
zqykyX|BEY@PQV*BEzTEp#UXAi-qjp$<zMEvi?m3vNVJxIi(oB0bBf$|;{96w5d-$W
zbv99A$<~&L$6*}0yj=h;_=+xLx^>e3Hc77Dk?s|XA{%{>_XxxjK%!`Jdrvpsf^AQw
zdT|KRv(8SCV$o*$y$yLa*fsPyqSS32>#!eT>z9!#%8icTH(%xd3WyV=Hrxm^*B8P$
zqTo6UUs`ZqIt$ZJbU_1jI$qI?xk1`6bdr+E>d>!}wdws20-B=aO=<k!7HB;{#039)
zBs-*GG)x71pdvV2r_Fbg-j&I)h*;cYXxlL?85wvy!eLQ-8d_Yiw?Bpu&J&f#|7&n1
zVu;RSNvAnzG=-HFgNQ2WB8Qo@VLF3BDn<{N!sFdZI$C18A}<Bod~|Rk`Jf`&^AyVy
z&KK=R6`Uk*CGsMwRXLn*Cjg5^7Fcejm4EdH+7ix}i9i=%X%5BkgQ{H}EFQ~4fte98
zZEEq>2VQ~Xw~a(N^rPb768B_e4oawkexy|9mVVt`$Z*LgdN6Pt`570fH2ycXX<i-<
zUyrFh>(s0q{M={v@u@8Sr4Ja<EV3C{m^xYK9-BOVicV#sOGxwo=Px4<y||r0pr5VQ
zgo)U<yit4+e2V*@1wplDi56!ao18LXNg>j5g_pOp%mM@`&P7&7cb4w>KP#VzpG1wp
zyi;y&KC7(>#;3J}TQ;&A6Rxv-j|qWUx*OX<gw)1<gszTmZ$0T$eI7HH{qBF#$A2X$
zCpVmzUr;!|s92XOUr-T=E?l&@^7JK3tEy{i&%ou2#%0UTTyd6U_#e{yF21Dy(v6p0
z{*{5R4qmb8YhT~|jc<PI%K!NGe_r)p-}&y<|NXu14_$NZb=Uvkh8u6X`G>dM`lBEJ
z<hI*?`m;OkyzB0J?!E8+2OfOr=fe*_^5~Yw9^d-JlfU@oQ%^tht7m`x-19H|=C?0y
zd+B#Czw-N6U)%nNKmO_UKfm#p9XsC~dF$=J{_UN2-+TXqzkm4Au8%+YboW0#8>MkI
zfvz#aRYUu#3IA>bo&JWMzh{AK_fu-+9{z?ve++*+@E6)&{&Mh1e;28_*jDOUAki0A
zY0;3DcG&Z*o;D_B=ne^(!vUmSG;y+0Jrn2BV>Q9Y^76WBx=xoB&LTG@nMFQ2v>m@p
z)e3uxNE8&E7CE*oS@CuFWs2n7DeBl{R!1@`)gI5n4;0{Va3v-N?kc+p*gpzsf@UqL
zmQ4oQUWdw1BM!uq9XO87f@MzQ?*95LTpnCIMadptrrxY$TW60Ggsm|XP>h1a17pkq
z0yBGM4o*>Q1hVJ{?u`(Q)bS$_de)KwWVuc-(arpI?Mnu4CPPM;!sF2xg_BN2Sd#yt
zyN_9?oRUQsjd58{zcuZZ$VA6>rpd4*vywe%Hj%}v3C3a;C6NEZFC8XlPZ^`!89ZiI
zneolmzvqgNO_pSdeHYyo0TNaBJxl1Vq#Vdf|3`+5=9$V`?pj8#S~B`xr4$yKP|<bB
zMA`TTb%bhR8%|?*Y+4V0GNb*B4v+n^sG_1IYu2Lb#@Si&zctUo%QCq+^K<gDW<}!7
z_znLotkU|>3~T6IT%N(%D?U>R`NaP>RuFB`)m&tqD~NnpHMcpLRCD3i#;FJuqzr=S
zUlazZNAgmV!Q^mZhK}X;pL{<IX+Hc-(s|18dE1ft3qGc6cr-ru_Q-112e5UMl_K@0
z@<IIJt2$AC58#uYcbvNDJLRJ%7k`xB%}3wOWAYV(u$Lj?lj@t{e5bbQIT?Qj)A!&}
zN@XpSHuyXKnTo#!_;dTQV>j$A3Q|8v2BsfNfemkfDm$*!6YB}dW7=xOSHgZxSFZs$
z3}<QjIrwzjo%xwk&w@tn65X`h0c`39RO$`z$Kd~K>}+7Oy2?2I^liZ{5c%F<gQSBp
zK8C;;b0{$Czz#<l>&9S<b%5=LNRh79Oo+sfNz5G1Wm`Z8nxME4H;9HA(J-e#HgrKn
z(6EqfGZ=yk48fT|fZ^|d-~YXRdyvF8y#4Wio^#GUpZA_~?(J>)NABa2(Jg-y3D@yI
z!gb3V{tL&c!yXY_nnF#Z<Eo97hsyGvc#k?IT>i<Ao9mpF_L?|-DYuK&-AjV5Jc9f+
z(aRCI<WYxJq5i1$9c8Vut8E8a)1)z<?-c9Ba2?;<tkpz&`L4Ep2G*0wCTmc9swwpj
zl<Gj=Dt_*^H`i~V&(gRfq4IYSe(yT!i~!O{&~-Fo4~`-IF8Uo+3g0TyKhJ;1QOH5|
z_k^?Ph|gkI_#x=S=!fmU5k5VDIf4BjMSqzJ`Ih|+Fs_L>XaD`^t;HCVv+GkG6%B~F
zx)|l<FxA-ztPI~Pnk$k}zxaHjA5HXE(a-UHjj;VG&-WAm3yI#D=-(##b#ycJJ;CW6
zM6W})SszWppHB2ebS>RX{X_Y=mbed~Yp_e#q4ST*cT1w{6FoQ4pFua%_LE6d>2)Oj
zHHm&Q(d!evInmn^y))5!5`8GqN6}An{@G92l)v-n#hh5x-=qhS@AuKWt#3l_WbiMy
zu1Dt|)lXBR7oqDpdCa40DZMWw{>Kx&A<-`;`d5j5BhiNv{r5zlN%VPiE%}~Bd-sbo
zmo6p#9vayGsC@krJvh<B6Fni(GZH-qeSz`0k>jd<mL&c!CHfnQ-jL{RiQa>jNne%k
zP@<0|`eLGc({75Zui_6)^teRlQ$&{Z6;G4tvCH(CG1)pR19d$DmIkfxT<NK?D?WmC
zMMwT@R<hMlY;=&d?D3??=Y;vA5ndj5Jt0wkhNI#!jbbI;6()P{SFuPePiBi7u;mq4
z*A3a|epfUa**<65w?f-ZD_hDhi$iJeQ1#8zh}mB$ZC{?(KKo?;ix~O7ap*2p+sdWd
zduA)eE7siGnWxP&SRF0xtBQ1J!{Yy*pK@cn{MPnGnrZu0!P$ho2zl9qScOOXGvU(v
zEtf^kv_|A{iRBM3$~`_}p}iJZRJl-c1~k7fQpy%&`Adx1+{qjmH4j#$`BBZR^Ob*R
zEta&l@|>P-=0@vhmlB|Z?ZEO<vFMHV=efAjc1!YrQ&IN+Ya3<>uaR8FFMF?O;UUfz
zR`i8|MRP}ymiwS~g3Fog+O_4Ci^VS?75(BeTW8i+@}7fIsl6fOV(SI#?dlBWd#>eH
zqxGpsZB6^nv8u<E>zmu1k!>_M!m^buUu<*Nj@A|$E$hXVt8j<Ry1U-w5sxitTb{Q=
zUeDcEz2&V=eAz?p*~&D}VD?JCtRPz7WqY&bqI7l{JGn{gDl1#Fdr94_=`H5C?A~&2
zNp31<Z!Ye-ZLD5bc^f(Fg%$UY3+=tvY`sxpZZ?K<ZHe{B91;C>>lIw1O0^L`f>oT5
zw~5RJe`)TLe>m4_``?rvp~(EJ<N6|wjA($0f4A8tJIDE&^+t1xNc!8&9j4|OrO_Nm
znsoL{li$PUF_A)?vhK;XP2pCWYhh^|^I~bz|AF*JB6Mw6xIasek2q@oar^t=lfRB{
zi3#6r(!`%8P5hTc7K;09-!DBW;@{#etmn8^DSSUD`!JDwP7x<Z+;0C&`yUbOB3=-0
zjo4%VKKl>YKCLHy7M>4^EG)K(#QQze@eWEe!K`7PRbtQc(<14$iqu=DNIrfeP9(fY
ze%^$N|CTiQJ!O5){6O~M5ic@7Q~Y69L*h>oi9ZD@{&Z>L&$V7?Hp@=@rQ(=~*KI#w
z{>?lB)!y%kV<Nu8`bFt(FgKZ-p~Af+67Gyhd-P#FqwoV^mJjPy=FiL)!l>R>Lxn$}
z__tGTaYn=t=8>|GFh@h>|9R`f($gcJ>H|N)oRbM#=?=z^$hi5ZI5Xk~7Q>}k5sgsk
z%{L!1TjVF*ZT%tb^a@nCL(-p&c$D>)>}y1hvsWbF2gQbn|5(?s4wJr4yfb2kIGgb&
zev0;hO7~uA+UFsW{;<@1M*h1Zek?sF;uj+EcZtN`BR}!?NfZAqu`%LZ^PJgx5catd
z*Nem-E)st%RQw6j#BUG@_n=6)#UkN82NiCGG~ph%{<ieptRF<i-)7sl+WvFfU$y-;
z+y7+y+qNIG{e<n4m=BlcMcgS)rhcG~zfhXvKPlc5vEJNbZZ}_n3cp)g^&&QLzPJ|N
z7|||{r5}r9B7P@Q?+4A3Q1$+SNIE?R<ENY-7Afack#RgnoJjpZh3haMGruDLXwGxu
zeVor^C*AY*mxf>`-CiQ;){6D4MMTPd7gW0Qq$$TT>vn14trCg1PNW<^6lu4gh_u^w
zsQ5diiGSSwQ}&;=|DyeU*{9HPuYrnpy)^O0iqy|EbAdRY^OyBXbB*}1h$qBR5x*91
zj`*uczD|gYgK9Qyl)wH^#~C6`d4`J|Z<6fPQ-l3;?Oz~L-qj-gW4%bb{#2y=yF`w&
zM<o6IQ0f0gnsiT!jH62;;d%}&hwBR!ZjdzLri%FQu)op%Ci~Zl9B-rTTcq!g_@njP
z(hDL^i`3`U!^-IoFbA8%p!&xs>zkz)M$8n6*JS%z^C{Um&Sv|!+rC4Ze7`D^uRn;i
z&k^gBBIS8sq+UM6wO-+dh}dgI>|>znVZ1cy%@)bWeYQVf`y(Rhe^;bmJZ}yR;+IIz
z{09c<S&VD(9kX8J6Mfv=s&R(irEvjws$bp^ah2MS@w!E%Kh>*#@$VHGzb{jss+;JC
z<e`dj_^%Q0<LtGJgi|>$5w~g@=@PeUI^n2m#ot8PRnDy<x{)-*iQ~$gJRUL*>uxRU
zP3FtyVe^7{mOiie-{hECdK|0jUiP54Hb~cS4bZ%$uQ^o2eu1wT)edJ~W%f4vngh+j
r=1{ZNtTRWO<IIVs_MmjUDdse@-kfF5HXF@*%=xDF$COU9x!C+K*kOxj

diff --git a/g10/trustdb.c b/g10/trustdb.c
index fb06e858d..6f3de849d 100644
--- a/g10/trustdb.c
+++ b/g10/trustdb.c
@@ -107,7 +107,7 @@ release_key_items (struct key_item *k)
  * For fast keylook up we need a hash table.  Each byte of a KeyIDs
  * should be distributed equally over the 256 possible values (except
  * for v3 keyIDs but we consider them as not important here). So we
- * can just use one byte to index a table of 256 key items. 
+ * can just use 10 bits to index a table of 1024 key items. 
  * Possible optimization: Don not use key_items but other hash_table when the
  * duplicates lists gets too large. 
  */
@@ -116,7 +116,7 @@ new_key_hash_table (void)
 {
   struct key_item **tbl;
 
-  tbl = m_alloc_clear (256 * sizeof *tbl);
+  tbl = m_alloc_clear (1024 * sizeof *tbl);
   return tbl;
 }
 
@@ -127,7 +127,7 @@ release_key_hash_table (KeyHashTable tbl)
 
   if (!tbl)
     return;
-  for (i=0; i < 256; i++)
+  for (i=0; i < 1024; i++)
     release_key_items (tbl[i]);
   m_free (tbl);
 }
@@ -140,7 +140,7 @@ test_key_hash_table (KeyHashTable tbl, u32 *kid)
 {
   struct key_item *k;
 
-  for (k = tbl[(kid[1] & 0xff)]; k; k = k->next)
+  for (k = tbl[(kid[1] & 0x03ff)]; k; k = k->next)
     if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
       return 1;
   return 0;
@@ -154,15 +154,15 @@ add_key_hash_table (KeyHashTable tbl, u32 *kid)
 {
   struct key_item *k, *kk;
 
-  for (k = tbl[(kid[1] & 0xff)]; k; k = k->next)
+  for (k = tbl[(kid[1] & 0x03ff)]; k; k = k->next)
     if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
       return; /* already in table */
   
   kk = new_key_item ();
   kk->kid[0] = kid[0];
   kk->kid[1] = kid[1];
-  kk->next = tbl[(kid[1] & 0xff)];
-  tbl[(kid[1] & 0xff)] = kk;
+  kk->next = tbl[(kid[1] & 0x03ff)];
+  tbl[(kid[1] & 0x03ff)] = kk;
 }
 
 
@@ -1016,6 +1016,121 @@ store_validation_status (int depth, KBNODE keyblock)
     do_sync ();
 }  
 
+/*
+ * check whether the signature sig is in the klist k
+ */
+static struct key_item *
+is_in_klist (struct key_item *k, PKT_signature *sig)
+{
+  for (; k; k = k->next)
+    {
+      if (k->kid[0] == sig->keyid[0] && k->kid[1] == sig->keyid[1])
+        return k;
+    }
+  return NULL;
+}
+
+/*
+ * Mark the signature of the given UID which are used to certify it.
+ * To do this, we first revmove all signatures which are not valid and
+ * from the remain ones we look for the latest one.  If this is not a
+ * certification revocation signature we mark the signature by setting
+ * node flag bit 8.  Note that flag bits 9 and 10 are used for internal
+ * purposes.  
+ */
+static void
+mark_usable_uid_certs (KBNODE keyblock, KBNODE uidnode,
+                       u32 *main_kid, struct key_item *klist, u32 curtime)
+{
+  KBNODE node;
+  PKT_signature *sig = node->pkt->pkt.signature;
+  
+  /* first check all signatures */
+  for (node=uidnode->next; node; node = node->next)
+    {
+      node->flag &= ~(1<<8 | 1<<9 | 1<<10);
+      if (node->pkt->pkttype == PKT_USER_ID
+          || node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+        break; /* ready */
+      if (node->pkt->pkttype != PKT_SIGNATURE)
+        continue;
+      
+      sig = node->pkt->pkt.signature;
+      if (sig->keyid[0] == main_kid[0] && sig->keyid[1] == main_kid[1])
+        continue; /* ignore self-signatures */
+      if (!IS_UID_SIG(sig) && !IS_UID_REV(sig))
+        continue; /* we only look at these signature classes */
+      if (!is_in_klist (klist, sig))
+        continue;  /* no need to check it then */
+      if (check_key_signature (keyblock, node, NULL))
+        continue; /* ignore invalid signatures */
+      node->flag |= 1<<9;
+    }      
+  /* reset the remaining flags */
+  for (; node; node = node->next)
+      node->flag &= ~(1<<8 | 1<<9 | 1 << 10);
+
+  /* kbnode flag usage: bit 9 is here set for signatures to consider,
+   * bit 10 will be set by the loop to keep track of keyIDs already
+   * processed, bit 8 will be set for the usable signatures */
+
+  /* for each cert figure out the latest valid one */
+  for (node=uidnode->next; node; node = node->next)
+    {
+      KBNODE n, signode;
+      u32 kid[2];
+      u32 sigdate;
+      
+      if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+        break;
+      if ( !(node->flag & (1<<9)) )
+        continue; /* not a node to look at */
+      if ( (node->flag & (1<<10)) )
+        continue; /* signature with a keyID already processed */
+      node->flag |= (1<<10); /* mark this node as processed */
+      sig = node->pkt->pkt.signature;
+      signode = node;
+      sigdate = sig->timestamp;
+      kid[0] = sig->keyid[0]; kid[1] = sig->keyid[1];
+      for (n=uidnode->next; n; n = n->next)
+        {
+          if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+            break;
+          if ( !(n->flag & (1<<9)) )
+            continue;
+          if ( (n->flag & (1<<10)) )
+            continue; /* shortcut already processed signatures */
+          sig = n->pkt->pkt.signature;
+          if (kid[0] != sig->keyid[0] || kid[1] != sig->keyid[1])
+            continue;
+          n->flag |= (1<<10); /* mark this node as processed */
+          if (sig->timestamp >= sigdate)
+            {
+              signode = n;
+              sigdate = sig->timestamp;
+            }
+        }
+      sig = signode->pkt->pkt.signature;
+      if (IS_UID_SIG (sig))
+        { /* this seems to be a usable one which is not revoked. 
+           * Just need to check whether there is an expiration time,
+           * We do the expired certification after finding a suitable
+           * certification, the assumption is that a signator does not
+           * want that after the expiration of his certificate the
+           * system falls back to an older certification which has a
+           * different expiration time */
+          const byte *p;
+                    
+          p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_SIG_EXPIRE, NULL );
+          if ( p && (sig->timestamp + buffer_to_u32(p)) >= curtime )
+            ; /* signature expired */
+          else 
+            signode->flag |= (1<<8); /* yeah eventually we found a good cert */
+        }
+    }
+}
+
+
 /*
  * Return true if the key is signed by one of the keys in the given
  * key ID list.  User IDs with a valid signature are marked by node
@@ -1023,6 +1138,10 @@ store_validation_status (int depth, KBNODE keyblock)
  *  flag bit 0: There is at least one signature
  *           1: There is marginal confidence that this is a legitimate uid
  *           2: There is full confidence that this is a legitimate uid.
+ *           8: Used for internal purposes.
+ *           9: Ditto (in mark_usable_uid_certs())
+ *          10: Ditto (ditto)
+ * This function assumes that all kbnode flags are cleared on entry.
  */
 static int
 cmp_kid_for_make_key_array (KBNODE kb, void *opaque)
@@ -1033,7 +1152,8 @@ cmp_kid_for_make_key_array (KBNODE kb, void *opaque)
   PKT_public_key *pk = kb->pkt->pkt.public_key;
   u32 main_kid[2];
   int issigned=0, any_signed = 0, fully_count =0, marginal_count = 0;
-  
+  u32 curtime = make_timestamp();
+
   keyid_from_pk(pk, main_kid);
   for (node=kb; node; node = node->next)
     {
@@ -1052,42 +1172,23 @@ cmp_kid_for_make_key_array (KBNODE kb, void *opaque)
           uidnode = node;
           issigned = 0;
           fully_count = marginal_count = 0;
+          mark_usable_uid_certs (kb, uidnode, main_kid, klist, curtime);
         }
-      else if (node->pkt->pkttype == PKT_SIGNATURE)
+      else if (node->pkt->pkttype == PKT_SIGNATURE 
+               && (node->flag & (1<<8)) )
         {
           PKT_signature *sig = node->pkt->pkt.signature;
           
-          if ( sig->keyid[0] == main_kid[0] && sig->keyid[1] == main_kid[1])
-            ; /* ignore self-signatures */
-          else if ( IS_UID_SIG(sig) )
-            { /* certification */
-              for (kr=klist; kr; kr = kr->next)
-                {
-                  if (kr->kid[0] == sig->keyid[0]
-                      && kr->kid[1] == sig->keyid[1])
-                    {
-                      /* Hmmm: Should we first look whether this
-                       * signature has been revoked? Avoids problem in
-                       * fixing the counters later and we might also
-                       * want to check the signature here.  It might
-                       * also be worth to find the latest signature
-                       * first so that we count only one signature for
-                       * each key */
-                      if (kr->ownertrust == TRUST_ULTIMATE)
-                        fully_count = opt.completes_needed;
-                      else if (kr->ownertrust == TRUST_FULLY)
-                        fully_count++;
-                      else if (kr->ownertrust == TRUST_MARGINAL)
-                        marginal_count++;
-                      issigned = 1;
-                      /* fixme: track timestamp to see handle cert revocs */
-                      break;
-                    }
-                }
-            }
-          else if ( IS_UID_REV(sig) )
-            { /* certificate revocation */
-              /* fixme: reset issigned and counter if needed */
+          kr = is_in_klist (klist, sig);
+          if (kr)
+            {
+              if (kr->ownertrust == TRUST_ULTIMATE)
+                fully_count = opt.completes_needed;
+              else if (kr->ownertrust == TRUST_FULLY)
+                fully_count++;
+              else if (kr->ownertrust == TRUST_MARGINAL)
+                marginal_count++;
+              issigned = 1;
             }
         }
     }
@@ -1110,25 +1211,25 @@ cmp_kid_for_make_key_array (KBNODE kb, void *opaque)
 /*
  * Run the key validation procedure.
  *
- *-----------------------------------
- *  Assume all signatures are good.
- *  Find all ultimately trusted keys (UTK).
- *  mark them all as seen.
- *    Loop over all key to find keys signed by an UTK.
- *        mark key as seen
- *        if OWNERTRUST of that key is undefined
- *            ask user for ownertrust
- *        For each user ID of that key which is signed by the UTK
- *            Calculate validity by counting trusted signatures.
- *            Set validity of user ID
- *            if user ID validity is full
- *                 Loop over all keys to find keys signed by current key
- *                 skip those which are already seen.
- *
- *TODO:
- *
- * - Make sure that only valid signatures are checked.
- * - Skip revoked keys.
+ * This works this way:
+ * Step 1: Find all ultimately trusted keys (UTK).
+ *         mark them all as seen and put them into klist.
+ * Step 2: loop max_cert_times
+ * Step 3:   if OWNERTRUST of any key in klist is undefined
+ *             ask user to assign ownertrust
+ * Step 4:   Loop over all keys in the keyDB which are not marked seen 
+ * Step 5:     if key is revoked or expired
+ *                mark key as seen
+ *                continue loop at Step 4
+ * Step 6:     For each user ID of that key signed by a key in klist
+ *                Calculate validity by counting trusted signatures.
+ *                Set validity of user ID
+ * Step 7:     If any signed user ID was found
+ *                mark key as seen
+ *             End Loop
+ * Step 8:   Build a new klist from all fully trusted keys from step 6
+ *           End Loop
+ *         Ready  
  *
  */
 static int
@@ -1143,20 +1244,21 @@ validate_keys (int interactive)
   KBNODE node;
   int depth;
   int key_count;
-  int ot_unknown;
-  int ot_undefined;
-  int ot_marginal;
-  int ot_full;
-  int ot_ultimate;
+  int ot_unknown, ot_undefined, ot_never, ot_marginal, ot_full, ot_ultimate;
   KeyHashTable visited;
 
   visited = new_key_hash_table ();
+  /* Fixme: Instead of always building a UTK list, we could just build it
+   * here when needed */
   if (!utk_list)
     {
       log_info ("no ultimately trusted keys found\n");
       goto leave;
     }
 
+  for (k=utk_list; k; k = k->next)
+    add_key_hash_table (visited, k->kid);
+
   klist = utk_list;
   kdb = keydb_new (0);
 
@@ -1165,7 +1267,8 @@ validate_keys (int interactive)
       /* See whether we should assign ownertrust values to the
        * keys in utk_list.  
        */
-      ot_unknown = ot_undefined = ot_marginal = ot_full = ot_ultimate = 0;
+      ot_unknown = ot_undefined = ot_never = 0;
+      ot_marginal = ot_full = ot_ultimate = 0;
       for (k=klist; k; k = k->next)
         {
           if (interactive && k->ownertrust == TRUST_UNKNOWN)
@@ -1174,6 +1277,8 @@ validate_keys (int interactive)
             ot_unknown++;
           else if (k->ownertrust == TRUST_UNDEFINED)
             ot_undefined++;
+          else if (k->ownertrust == TRUST_NEVER)
+            ot_never++;
           else if (k->ownertrust == TRUST_MARGINAL)
             ot_marginal++;
           else if (k->ownertrust == TRUST_FULLY)
@@ -1199,9 +1304,10 @@ validate_keys (int interactive)
       if (opt.verbose > 1)
         dump_key_array (depth, keys);
 
-      log_info (_("depth=%d keys=%d (-=%d q=%d m=%d f=%d u=%d)\n"), 
+      log_info (_("checking at depth %d signed=%d"
+                  " ot(-/q/n/m/f/u)=%d/%d/%d/%d/%d/%d\n"), 
                 depth, key_count, ot_unknown, ot_undefined,
-                ot_marginal, ot_full, ot_ultimate ); 
+                ot_never, ot_marginal, ot_full, ot_ultimate ); 
 
       for (kar=keys; kar->keyblock; kar++)
           store_validation_status (depth, kar->keyblock);
diff --git a/util/memory.c b/util/memory.c
index 9822b1114..76368cd97 100644
--- a/util/memory.c
+++ b/util/memory.c
@@ -562,7 +562,7 @@ size_t
 m_size( const void *a )
 {
   #ifndef M_GUARD
-    log_debug("Ooops, m_size called\n");
+    log_debug("dummy m_size called\n");
     return 0;
   #else
     const byte *p = a;