From af2cfcb08ffee21febeacb7f32d1d88028b76284 Mon Sep 17 00:00:00 2001
From: Peter Collins <pecolli@microsoft.com>
Date: Tue, 21 Feb 2023 17:28:59 -0500
Subject: [PATCH 1/9] [ci] Use compliance stage template

---
 build-tools/automation/azure-pipelines.yaml | 58 +++------------------
 1 file changed, 7 insertions(+), 51 deletions(-)

diff --git a/build-tools/automation/azure-pipelines.yaml b/build-tools/automation/azure-pipelines.yaml
index acbac80bda7..da35a0af92a 100644
--- a/build-tools/automation/azure-pipelines.yaml
+++ b/build-tools/automation/azure-pipelines.yaml
@@ -1435,54 +1435,10 @@ stages:
       packageFilter: '*.nupkg;*.msi;*.pkg;*.vsix'
       GitHub.Token: $(GitHub.Token)
 
-- stage: tenets
-  dependsOn: []
-  displayName: Tenets
-  jobs:
-  # Check - "Xamarin.Android (Tenets Code Analysis)"
-  - job: run_static_analysis
-    displayName: Code Analysis
-    pool:
-      vmImage: $(HostedWinImage)
-    timeoutInMinutes: 60
-    cancelTimeoutInMinutes: 5
-    steps:
-    - checkout: self
-      submodules: recursive
-
-    - template: security\credscan\v2.yml@yaml-templates
-      parameters:
-        suppressionsFile: $(System.DefaultWorkingDirectory)\build-tools\automation\CredScanSuppressions.json
-
-    - template: security\policheck\v1.yml@yaml-templates
-      parameters:
-        exclusionFile: $(System.DefaultWorkingDirectory)\build-tools\automation\PoliCheckExclusions.xml
-        pE: 1|2|3|4
-        rulesDBPath: $(System.DefaultWorkingDirectory)\build-tools\automation\policheck-rules-db.mdb
-
-    - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3
-      displayName: Run AntiMalware (Defender) Scan
-      inputs:
-        FileDirPath: $(System.DefaultWorkingDirectory)
-        EnableServices: true
-      condition: succeededOrFailed()
-
-    - task: securedevelopmentteam.vss-secure-development-tools.build-task-report.SdtReport@1
-      displayName: Create Security Analysis Report
-      inputs:
-        CredScan: true
-        PoliCheck: true
-      condition: succeededOrFailed()
-
-    - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@2
-      displayName: Publish Security Analysis Logs
-      inputs:
-        ArtifactName: CodeAnalysisLogs
-      condition: succeededOrFailed()
-
-    - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@1
-      displayName: Fail Job if Security Issues are Detected
-      inputs:
-        CredScan: true
-        PoliCheck: true
-      condition: succeededOrFailed()
+# Check - "Xamarin.Android (Compliance)"
+- template: security/full/v0.yml@yaml-templates
+  parameters:
+    stageDependsOn: []
+    credScanSuppressionFile: $(System.DefaultWorkingDirectory)\build-tools\automation\CredScanSuppressions.json
+    policheckExclusionFile: $(System.DefaultWorkingDirectory)\build-tools\automation\PoliCheckExclusions.xml
+    policheckOptionsRulesDBPath: $(System.DefaultWorkingDirectory)\build-tools\automation\policheck-rules-db.mdb

From 05fb8ec6769a734bd55fd5d74de685460749eabb Mon Sep 17 00:00:00 2001
From: Peter Collins <pecolli@microsoft.com>
Date: Wed, 22 Feb 2023 18:41:06 -0500
Subject: [PATCH 2/9] Update policheck exclusions

---
 build-tools/automation/PoliCheckExclusions.xml |   7 +++++--
 build-tools/automation/azure-pipelines.yaml    |   3 +--
 build-tools/automation/policheck-rules-db.mdb  | Bin 393216 -> 0 bytes
 3 files changed, 6 insertions(+), 4 deletions(-)
 delete mode 100644 build-tools/automation/policheck-rules-db.mdb

diff --git a/build-tools/automation/PoliCheckExclusions.xml b/build-tools/automation/PoliCheckExclusions.xml
index 4ec72dc9b23..cadc65fa037 100644
--- a/build-tools/automation/PoliCheckExclusions.xml
+++ b/build-tools/automation/PoliCheckExclusions.xml
@@ -1,10 +1,13 @@
 <PoliCheckExclusions>
   <!-- Each of these exclusions is a folder name - if \[name]\ exists in the file path, it will be skipped -->
-  <Exclusion Type="FolderPathFull">NREFACTORY</Exclusion>
+  <Exclusion Type="FolderPathFull">LICENSE_DATA|NREFACTORY</Exclusion>
   <!-- Each of these exclusions is a folder name - if any folder or file starts with "\[name]", it will be skipped -->
   <!--<Exclusion Type="FolderPathStart">ABC|XYZ</Exclusion>-->
   <!-- Each of these file types will be completely skipped for the entire scan -->
   <!--<Exclusion Type="FileType">.ABC|.XYZ</Exclusion>-->
   <!-- The specified file names will be skipped during the scan regardless which folder they are in -->
-  <Exclusion Type="FileName">REMAINING-INT-CONSTS.TXT|TAIWANCALENDAR.XML|XAMARIN-ANDROID-SDK-9.XML|SQLITE3.C|MAP.CSV</Exclusion>
+  <Exclusion Type="FileName">REMAINING-INT-CONSTS.TXT|TAIWANCALENDAR.XML|XAMARIN-ANDROID-SDK-9.XML|SQLITE3.C|MAP.CSV|METHODMAP.EXT.CSV|EXTERNALWHITELIST.CSV|SYMBOLARCHIVEWHITELIST.CSV
+|API-10.PARAMS.TXT|API-15.PARAMS.TXT|API-16.PARAMS.TXT|API-17.PARAMS.TXT|API-18.PARAMS.TXT|API-19.PARAMS.TXT|API-20.PARAMS.TXT|API-21.PARAMS.TXT|API-22.PARAMS.TXT|API-23.PARAMS.TXT|API-24.PARAMS.TXT
+|API-25.PARAMS.TXT|API-26.PARAMS.TXT|API-27.PARAMS.TXT|API-28.PARAMS.TXT|API-29.PARAMS.TXT|API-30.PARAMS.TXT|API-31.PARAMS.TXT|API-32.PARAMS.TXT|API-33.PARAMS.TXT
+  </Exclusion>
 </PoliCheckExclusions>
diff --git a/build-tools/automation/azure-pipelines.yaml b/build-tools/automation/azure-pipelines.yaml
index da35a0af92a..66aa1155fa0 100644
--- a/build-tools/automation/azure-pipelines.yaml
+++ b/build-tools/automation/azure-pipelines.yaml
@@ -14,7 +14,7 @@ resources:
   - repository: yaml-templates
     type: github
     name: xamarin/yaml-templates
-    ref: refs/heads/main
+    ref: refs/heads/dev/pjc/xa-sec-onboard
     endpoint: xamarin
   - repository: sdk-insertions
     type: github
@@ -1441,4 +1441,3 @@ stages:
     stageDependsOn: []
     credScanSuppressionFile: $(System.DefaultWorkingDirectory)\build-tools\automation\CredScanSuppressions.json
     policheckExclusionFile: $(System.DefaultWorkingDirectory)\build-tools\automation\PoliCheckExclusions.xml
-    policheckOptionsRulesDBPath: $(System.DefaultWorkingDirectory)\build-tools\automation\policheck-rules-db.mdb
diff --git a/build-tools/automation/policheck-rules-db.mdb b/build-tools/automation/policheck-rules-db.mdb
deleted file mode 100644
index 02956d95da1c30db3126364b14f92131cffa60d2..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 393216
zcmeI531D1Rz5mahnQW6}lBT5%rL;p^$|5N<X$WacF?$!9q&px5nq}Ii&1NQDQnpY)
zfv1QdD2RgkkoOcf)c2nI@_ZtzsB9`Oui*2k@aHK$eZHri|Mz?DJu`PElVsASq08?i
z_ueySKc9Q<x%X_pqb#M?5484lwDxxdS49Sb^|cB{>We+zwk>(z-uRn;+}2<HR(0RC
z_un47>E7_a4SxBx&{u!)<cHdS{K~)H-}ryGezkdj*Q@7W`lI{)_uG%1`5!Y*yLHPN
z?^Tt*|J5%(7j2(f_e9m_7KQ#ac-h@^uRi-T&s=>^?wk+&?ZbDhoc(`4-@o<ByZ+~y
zTjt-i?Ync%sQ=;r`+nrLSk9x3AK5#-;I-eBwLQBbTd9hLA*4i<5D)@FKnMr{As_^V
zfDjM@LO=*i1OdykvMmcuKKVN#30PJ~5!?Gz9`%)?-9@%u&O$&42mv7=1cZPP5CTF#
z2nYcoAOwWK(MVuZBz6eOWBojzxtZxx>Qaok&vCM5`UFf)*H2OTY6`jt*i8Thrxp$>
z<HfBnU|4y|3$r|gTtYjov_-BCBiSOCK74xa0WGF#*M60&v_)2mMF}i?^pO(}%Jwl6
zVfbm`hbB4lgO>JTry~&uW6h_JLIjrVL)jL^2rS8Bmt#?cEV?av@k<94K=Rxcss{;T
z9GaaA$v$<^%A-YgJcH%%3DxB!*S-;n<oZl<3wRG)L8*QC#h~(4R+2>@;_%YK8;`?g
z#oG{2b*dN1>roNat_D=Gs#mSJwyHK9QJ7A1Od@dEkKeR)n{HHns>3n$t47rY{WkcV
z4t=lo(TU$Zsu||p@aa=4;ohfKtKEp5=LWSGVfMqmSpRN<zYetvAw^VyHdzDPUc{3d
z55=!q)E=Gce)w7gzf4;X!eQvs)jGsQeUI7-pQ~~7AQh!4=IhmV*!06?uG*jm5ko}X
zfKq_2K##IwF%^sT=yRt&<0t=%!IDLV>Uw>qANX=RO3_b&AC?I!+Yj#uZ?3+<d~#{!
z^XZ?oi>rj4HnRDZ4$HIQo2Pv6ou%XR;OxawsB&@6!%?gPI2Z9y1vnSt2q-_!`8ZIf
zaL&PDCnuf;(Fg${AOwVf5D)@FKnMr{A#fZJ@L2yCU^ZIN?qI9qGAB>EWx{r(qt>%&
zZa2?qRRX6|aZt^+FLrwz%_jUzZmwGC8lP<VjMyI6?N|n62jw)0V+YaYP=jV@6B=@j
zx^cH14Yq#Oi3S`StZXnAqhZ*lc0kAGEE|K_YCW#?x?!gqX@4J!d1A3SvDn{Yu_XO8
z<cKZ$zs>Rd{mnY|(HdgIW0FRbh9)N=AOwVf5D)@FKnMr{As_^VfDkzP2zadD6*5(Y
z7@2lAcG>u@ddD1n(0)C}+cAJiV;(1=r99nf|I?bvL;s0JyFJFtE(1O0pOt1ZfF703
zM!@bKgDi|nJ45@)7CCUJ2hkJb*k)eAK}%cs;*$Xq7Nhquq>jgXFjiiIK86AOv0tGL
z!_f9{HwUTv^dNH-gWH{YKsh%)+?_g*?T-&shcS7;49%9O>7C#}c0YP4*pJ~1BfCbQ
zoe}3)EY}`SJ{gEP8G-70eRkh8xK0{Io;$2BWO&Z9)C`1KibHxYG*CGS0U;m+gn$qb
z0zyCt2mv7=1ddMv9_xt$=Bx};_1#TLyB(j%Gur=IX#aCUKaZJcFP?%U6Qx_=>E;D!
z3rbyZH~%>uUt1(v`DV7d)BI-#f$byF%6FRoCa4q(_8g@3kv*(a!s$t{^TlZliJ$_Q
zQP7Tde;4`$x-p&Hj|t`d=po?jg8<HMyJGYa?9)^0jceP)JvU*#cC!vG|E;?9&*|&!
z&~+sF8`+gRtXc7}IQ@RW>7R&VdV42&EykXnJ`49!uLD8G_v_5l4?1t`ZilqzQ{hLK
zog_b4$dJ~xZ8#f#bbnLakLfhh1uoHlq0>M+-fP`Ulg3Uv;wi;$JghUPh#ZI#0zyCt
z2mv7=1cZPP5CTF#2pqcvEbCIUlo<>8DgQ5A^lIRtKwIF{z>9@<7B&~=6@I7Sx`HJI
z|DFHY{GIs=^8ej`pZ{WiiT|m*oAc`O4(5I-cOduN+~4Lr7!T*zr6DO70zyCt2mv8*
z)DZ|yM2d<hA`m0UWFo>k3c}#vfT$xtK=<2EOt`@b2*z`mfuxR!9ZHgh4#iV?KNC`H
zCnS*c>3cIw&xDkvn?G=vF;7S!hnWWPe*6=to`@_SW*|Omb^gfJG+y);MqlyK5Tq^_
zmmw|3%)=|9=H~>w`=}2>4=45-0RF%Md)q_@QtUXJkdF{VAZknk*S!Z$u4`G<y=qlc
z)7qUox31c_cBciiKyJcn^{SnYp=BGc@95lOyUMc-wsf@gUg5a$+eV#huUOT6X-C`6
zi!a@3yY(20tsR}+wo$%qw6m%6(yfkBfn&6LCqmFEDYQ+xSFJWtD4JN;HFdOguifSN
zn_`=--PN>qE8}g_eoInJ*K5<MsiwB$X>sE#dUrDE+VM%Y>6V?lciN0PR$sQZ$%%D(
zs^zXNcA{svEgUjg3A46UTh?w_wN*zj+im>zt*hGBZtU#n-P*LOd+o-K&PyH7Gt;}W
z(|AgH%kB<$T4xP&WZPcaVh3_+!rtx8moVPmyEdMl?1b^~Tb*NDcCR(%q|`Qe``S)|
z)!9CoMxN_zrdO=m-O<~v%>%YMdAF?ACSKcQXYZCRt2%dI+P1z!8yDHey*t--wya%$
zY1>)~DNzBbJ;r?M#eonI0zyCt2mv7=1cZPPNKe3L<#FkMTIKQO76+?`APap&O<I3q
zc=Qms&Q1zi`_Q2I6v(3ncRb*y25UJ2`P85vI8Z<hWIhH8slnX)K!6&|>j)H4gPxo~
z@pVJCcONzMo<$A4XH!G(In)$EGliOI(3DU!9h#}sltMF&nwij?M9nN{W>W)Ml7Z>e
z%!g(MHD^InN=+FwCsR`e%}i>RLURf=)zHkMW;rx=D;FBwiNKudP7Nm2bKUKVDu5rN
zgn$qb0zyCt2mv7=1cZPP5CSI{0iX4nf27vX$j$yydIZL8b%Ft(<m|HD4i#2LV;POd
zXuQ;*YapCuG}%UzV>G(^0Bz~8={^YS?gN_W?gMIc_W{aMcnW<{Q(`nzjb<7(=qw1I
zWHi%_W`@y}QiFbk@X1Cq(`ZgHnpxDKV<J4C8gxvAPiOm|$yjDI7aGl5sbPAS8qEdN
zFd5ZGQ)4u>)G+osqp3HV25Qi+5nf<4XBf?y)S#y$e3sFiZ8UG827MplbBw0UXckg~
z-jMLQMiVlcFg55O36~qqBBQCG20bRra*Za>X#CWm4<&q_(Nr4E`P86SC0u1Ri;ZRp
zHRxvvHyX`yqgg=>dS1dSjb@e6Ttp4}V#2G9rpaiUsaXoE7Duy88I46vH4^VJ8n4ml
z9wqePEYm$o)aV{1YV7F-2+(xygzY&MFqy+i0xZ2jJzD@8J)eQMThA+@M$b5)M$agq
zrr7BT3ZG^)bB$)65+wwLfDjM@LO=)z0U;m+j#mOcD;PjSNR$u|0zyCt2mv7=1cZPP
z5CTF#2nYcoa2yk0`yZp7qJ)4D5CTF#2nYcoAOwVf5D)@FKnMtd<CuW7|BvIFD_Ii)
zLO=)z0U;m+gn$qb0zyCt2mvAB5Rmr26a^t51cZPP5CTF#2nYcoAOwVf5D)^#KLN`s
z@<M8wR&&%Bi#m$(i@p%JGEf}&O5xiI|5osYf^7ve3!ci~pZ^R0wf<B6-_C2#^W}Xk
zw?6mfoK-phoqb>SZ?aZoz2Em=-pe3YOOy~00uF&G6w*i0bVZh06U}bEYvC)^?;NzR
ze%Lgr^=eQ>RkLbU-713Lt*TEg-Cv>9kQ0PzT31dffG{Xg7r{*gE>^2v)eg5^lqv{?
zjT)f*%0i$XwL$IGe^rppm-wqxL6xs!)oKd&NN^JM@S3Z$W}NYIwYjDyYPVX0XnGK7
zi)vFlaBWuuYNe`2q7Ofrw<`XvO8Q%oNM?0BnI9{^#mi)x>&VGmuKK}d7Z`28)t%^x
zNbvg<|28E3txF_$>0u>!A`*C`;$MBzUu`0Rkk#nictg@$Ga*`sqA-9WunlDURVQ>4
zk>tA-|28H4ZAc^;k|&)czvZvn{Vf|0RNwmdZ~fk<dVW<63wVkkDN!V*7o~LR{`tA8
zddHQtQR)Ky7gFxOg^7S6?a~SOlT-IsU%lZ#HJ;E<zx33BYFOY7GvIEW!}Z+T_B@(W
z+9m(aN%}iG5$Jq4vGn7f_v%iaT65(a);#Vtc#7IJzNoqcrmH95S-M*B&(5<sFG(Z}
z5<#7Wz4C^-_5Hs*Q2o=7d-Qdrgrz<^$%V@P<rFQ2I)zn~o%28VuhTg9J@%nxm1n(N
z4GYzP3aK5{)voxxV$r#%0AMepy;8OMuTr`HDiZ03h*T%|r#^g@4*oAcyZMSeRqo(f
zGY&XKp;6T#g3GfJ!Db!4^GGD>L+V_0A}dlm{n!0vua2PX@h{(a?wKP;uyp^8S*qH)
z$PRvt^g}SL6a0eEE*<<I2R?ZD$mwV5Z%6Rz;*5faNLnZO`@VM9Un-tHP<`H~bK}9+
z>8FE_?p^>Q`5^|q-VXXg#lP~TzfgiaB<l`&P^9yRzW&4g7xFnVS9;%w;P|A}<GdB@
z`KstZ1T_%x>RDt*V3(B<$>$7<;M6}?KD_vY2de3PJ<3cs{#p^qAl^JZh^7}2Jb(zS
z%p$<s(aFI-Ecu#df7z_^_wgA(_{#k-u0}M22!0nZ9s27HFJi^F@Z10(mopBf-l6v4
zZ%NW$l>^zDLTST8a8=}0XI0*yA)6~b+aC$*fVK<CTBwHqonr^Z2hlf1Q0)NOsh<=U
z1b5|V^iCzo!0<soO1hY$KH%ziN|gz~eRTzfQZ!0nO$ew1<hu}P1}U>f4Xjb8%C5eX
zD{K3gQ)M%YP@|-(Ucd8NlS&CciMBbZti~-){kt%6Gq|oADaGfXd1%a)(VF*xeP{V{
zwcle=wO!w$s9G{KMzxE(ok0X^!Ie*`{mx!8l>98(znr?zx$7AOT7xRK0k>+&P;%X2
z|8i;&28a8eL2$|Mn=#XfFpCjzkta^}Uw`n=m!5ppuc~1aCtHuN)}{Mrc~td&=c~Ye
z1e2d2=jo}o3q0#mJc#B-nJa@G?M9iGuKVh|fE@^<1Z;{~8;TYyR8p-_!~e<?MT^C1
z<dkkeKyA*mv}7nbyY{bmmEp1S0tiUGju0=kTN3=qTV|_IHd>$kOjmBR7kARbDnTC#
zn{ZnhZp7_Ngqw#FYq|-1s(=<AL}e*jcyye(n-tnQ$uBK7IRYtWH{i_yzp>b+SnQry
zOvPfku~=6u_8+lWQ0q74Abn^{socH~cMa*x&=1nB-TfvO`ybm~EcQSw_DkEp7k*0M
zCO7!nrt6daAfAu9;(?$4)PA~s@H3TuUi@U&E!s~a!}uA4qN$Hhs|}eM)tOCW$LEEI
z%b#|dn*Vf+rlG;c=iIz7*<u_-Xjw>MHV!)>3|y2D5CTF#2nYcoAOwVf5D)@FKnR>*
z1S~67XtJEEzEZTiX!rNSMXv@P3bX}I)jb2oR<1%o2nYcoAOwVf5D)@FKnMr{A#juv
zz`)<(s|g9@@RKnSAz)6^;VXME_wd7cvqP|~pA>O2B$cIp%Si>Ign$qb0zyCt2mv7=
z1cZPP5CTF#2nc~=mVnopa(=L>vuE3`-XfI)gB&0B|C2`lF?&-b;X*(N2mv7=1cZPP
z5CTF#2nYcoAOtcZAnpH*Fo`1}AOwVf5D)@FKnMr{As_^VfDjM@$20+t^*g=FzYs#^
z++yqEBI=Um|HX|@!g2u|ZZ$qRe?Q!)R6$(Qax+ABrb@VTr1fbbe~|6BF&2A&EcQ)X
zPG2nc<5+BO7E*v<)V*D~)uT$@(-QPXl8)y^C_Wq_9nXC?MK1(|fDjM@LO=)z0U;m+
zgn$qb0>>2r%X)WQ%3pSp{J-NWo01tJAOwVf5D)@FKnMr{As_^VfDo8$0>O!ha6$r^
zh=d&TVR)=|z5M?!<iy^N&(0D@%!~i-r&jQqht&W4<~hH!|6e@6Gcf*-V|-)&k3W|>
z=AWw?v0oi`{lxBq2+xZ{#^K|XMI!`+fDjM@LO=)z0U;m+gn$qb0zzP72w2wh@$rA3
z9{=a=e-jh7gdzllfDjM@LO=)z0U;m+gn$qb0z%-;C*YZgBuq#k)f17DLkz@YeNVUc
zLm2Q+UH|_NfBuQ3%=&+y^5QSP{{Li*|Ko705$6K<8L;g$5Bny1s8v^OJZKfr!pot5
zm9W@|{TY)510*I1j36SwQWlaHi`^58Z87ozo{PnT&}Si$mm<1fKEE;dP(=hF;|Rrv
zL#8IUZ@B1%fDjM@LO=)z0U;m+gn$qb0z%-}At3AjkDYrZDHQ@jKnMr{As_^VfDjM@
zLO=){TLdO#$b3QqIkvbRnbdl$?-nrRa_{i*f12-m>_f{c&w9DKIUfV{`536j_&v=}
z!H7PNk<^HD0klP8E&yVM^6}3|AF$^F*cQ3Qf<L`_l7MYdU@S1709wu-uq}#>MHVcw
zTo%)e1*RORY?nnTEc6V899ZON3wwq_=%o(ZA{Ubva$OeB`2BWr^Eh$A71S&flphv;
zmyeojJ20nVo!X^E9jsLKDKi{OR2?=z=ura@gs>N9x|j{KRuzTGdK^8_b;71o?bg>p
zHBDU%KmDph+qXj3uC}Y0I;3vZt^Eun*_ApWF_s><j>J<m+{T1m92d~AK@F-t_z9{8
zq_G`2*@d_xPRcu+)G-&+Q(Ty^xS<24YG6YL%+~NJD~oeBX2)U=$6|T0*wk3;eLfVa
z7Tks{<zINvo~_|*0uhV-V=UGki*3UUj94ru7Q0<*cH!)WpHtySsdp{8USHkwSm4^8
zwBhsVX(x%PC~%sv)Be(L5RrV}?7*~hISBzFAOwVf5D)@FKnMr{As_^fDFT-DY<#tU
zmP`KsF_j5PtPl_aLO=)z0U;m+gn$qb0zyCt2!Rm^42@`$kwq{gS4X`gkM&pG{{Jgd
zYQ{#VK(7Z&aovOw-hPZdH)mlqonz{bS_LOKis*-e0hB%3?bu=zJ~0T(!Fdk4Q#nKJ
z7zM@;z2;vV|6%HWl}{g>3E;Ls+-7C~ryV4G&}pt(t~Tniav#ne_}z>VbB=rm;<_f7
z^uflAUi*{>$)=K#T$_WOg@6zc0zyCt2mv7=1cZPP5CTHrL?Ga^f`OSQLPjNzLO=)z
z0U;m+gn$qb0zyCt2mv7=1WsTA9xJbi*?%1e2jI;RzZw5GXqvHV8;ja$tgYtYih~3H
z#><rCA%A;4zEU43im&+}K7e13;rRg^9Kf$v&H{0a%*SE_=8VPOSSIc$58|AMIB7Yy
zIRAjE!E*AISdz|#>U(9#-`q{P3IQP?1cZPP5CTF#2nYcoAOwWKiAKP(PSx#y=G&{+
z|A*thPc#;iUm+j_gn$qb0zyCt2mv7=1cZPP5CX#qV4M1*MCGV&9&$=7>mo>+x0R(X
zJLGWEc=Xsa1FDo7T3S8hfwO-#l`{u;#d>_D4_wat-#4bxGj<`s(toc0SE@uQzXbvM
zAyuUos`GG#t=9uvj{Vc67y5PtH(k58r3?7si@OtSP;&#S8lJRzhuVj~B}so(Du}%d
zV%3Rx1)N@xr)M_2<*(cQEgKJ1pK|MmPl`Q%pxO>4ao&L03T;}9e>5%}p;HU*uU6%1
z0pgEYQ3&GigxG;7(qhaKA&5>02mv7=1WrH#zUP%Hwx`e?&AI=bWm!Ke&b30tr+bES
z=X>~mqyQei!R>dny?ct@3+QOhh@?#j2mv7=1cZPPa1r=$(Y-~M@*dIl|1;m8^2?8W
zZsxzcqSe|9G1cH8+S_)!-L~bIMV@h349SAf)9fI=JZM~qgI^({jvWH)&@a-9^&Q+Y
zkeeI!V++CYsOjiIGP%tk!(-_67ruV)e?4b$7sqP7r6q+|)?x+7p(||s81Et)@k{ql
z8!KMw`?h7`cgJSOzXtj4RXeZ(r5y~$qozCYv%AdwthmDnJzrBbdi-wJ<I{8FOT*uM
z^{0j~TKrrY^fv^+d&lRP`5;Gzg|0en#_)N&D0Gy9Nch_*`axBYWM=H#SF&;c7X8sd
zphj;p8bv>-{Un&xUbtNushR9eb*W4|y#<b(#~)jla)Z=v#D8e20M8%aK`g6GM%qxE
z=U<tt%TXQT?m%xbH)lPRG@zp(UjH0Q{7uMzhqLMIp~la5vU&HqvX;=Ae4A^+M!&!L
zymKiapLx~?d{#|ez_7`d^#ku2<DoQSzWe#yvrfQRfZ_nbG#n@4V2}R{9Hlr;#=$y+
z8xhaK!EInUn1Mxtc;_f}8jiU*IBGB-$3h$naGZhTOdMz7U|Ld-b79Wm1DcCEbOIIO
z^BZ~8Hq0&b7y2(-(Hk8IHtZdU^mIh}gDZQs_Fi7-U$7!%tMIa`7F8`Oudl2KmDM#a
z4wZ$&b&X|J4Hb*ZLZO;a-QsXK6gscwnx&g+8<xg>g$n&ojHHwr$tE*%KKneVGV_t_
zivB!1aC!x$-_r>VpMqpJqy2(o<tuK&w#|d6Kk8AFP>tpz+0M7Awx;q^^B|3zy7NB`
zUAC`(S65_Xbn$c0tLQ*SZ&&2bEyZ{=YwBC-Yom`8D|Gf*)&+<t7te0;&Chmy5V&oo
z>kh(F53B2$9<TO=2m4B=-oH|<!B*2PY8Ac%>o6vksY3maO`;Qt$i$!C#hV`*P~4On
z0>lql<sQQOhmqav6q-ZJbt1XA7uYJByONLc{z*93y3=t!BW?V9@HQHsnsx~JKO0f7
z&Zlx0k>g#z7x^7xrd6Spk9PG}c_Tm~+gH=x9*IW1d<6e|08g6l;?ACM<+rYNw2R7f
zu5+}N6?>ue`kGqXKaU5|x3YfO+^ec87FR4<)EF+SSyWzLRuQfbl`Rg}*Or~XsH(QA
zw)XtR<>gh^pnh#`?T##)Yd_uixgyflSJ&G!5ZODxU_vn36zPw4_V(2EvUp5J`@g%d
zb)d7YE3&A3+1y2ok^FMh^hiiu)AD6=%Nxt<t3r*7szRaqn%Z#KeZWoqn%ZS^&uciZ
zt}$F*5o$cYZc*d;_4WbV<#o&ER@GNEmY0Xa=Qmh4es0Lpb*rU9XL~%i=c&GF*(<zi
zzejbv;`5=Vn>A#U$x`$2<xuUJW}zBd_9@Tw9M2AGT5fhpo~LB!H;?`CLZ2$|tny#r
z@lW@BnAKx$SL8y^$x*i4I`BEwg=XBDg&5yI{R-thd$U@86|z(ws(5ixs7&She09q2
z30PK1C{$5-&Af88Ff=bTuWrd^g`3{dyC=F?tsjhD+;VYcg=e!jQoeAYt8JcYS=|t<
z*)`Dn&2I4O?NM8l$2VPFzg<_!xfkLaDYpjI|0i08tXfrn|4`0dLsq`8-f9SE)rUi6
zRhGBDrY01stS>*ap{ByB4}0s^pv}3hzqLEq*r~cA(cqbTt18u5o9lYJyL)@Q-n{GA
z3`Dv&w|3m#ySY0$<S7sDU#prr+xvT?y<62lu%>;Wb9Y2t60C0>XbrZgwjGi7foKr<
z2?tkqw)MB3(?2+Lk+O>R{{Wv@Q}=tHeYV(>&+Qp_yn^`|M)AIQ)IoK&0xWeEzN`3G
zj-vu^gGN;b-IJ~F=ZiL$@NeF_G^YP^tkL|#kye|X_snv<ZEDoDDvUVm@ZM>{UkkQ`
zuuYmE5u#4NkJdXTcI#xb^R_x4--+}|(+0&~^=dW#=E0;B@8Mnep6^mY*tX(VC)zkc
zr=<}@tbO?F(x#MbVb2Un{`M}3=cNMf8}V1C7DE>Ti}UbnG5*Ssf)I{c=;(&5NGgP1
zbQw~MU>efL`RW>^Z86dr!j(rIX1kCD`yIC7%uO+vMid1U-ze;wbP8!7#eq8x`xacc
zYV!zOxPOIJrS`KPao6E*A#7J8ZS&HG!&YCrjwgyx>6a;E_-*lCkRbeb;y2Tl+AH+c
zv}I)x!mtT2_ii2U<>d7<J@fpXYi|Dia~9ho-*h^q?DAtu{P?fq>1Q(WyJNBApPYWC
zZ+^zk|M2+TCganOr=KZZ{45cvWg^wg{%xNtP$v1zRG?&*<GMJ5XC{ai<6g{1LoJGD
zp$;Xk8-Km%*BtxFT95Yy%XtK^5L3&T>yfT)&V18rn`Clh*F3D1*lV159kdQ)`{1V^
zzLM+O%*x^6_Oq-<eb<lrtnV=5Xa5KLJ@}oRHr1wo#avyE>?gku?<rfFlFKS1Z3)^L
z?(g$VJe>na_Uua)kC#1NQC;(A5<<ewG`zss@56o`_WPt&PQHWx_p=Yr`}cpd+-~>|
zPJWk7{yQj>`Uam*sHfcT=!;QmD4nWT?a}XLyQP0I-jx@lrm4U)z%Nhp;Yt4kc!#$k
z48DOIQ1{f}dt?CqyY;=dzc<`$&W=C-i5ie!U*V*8DDC*gQHC1MofGr5QHgt8j`(Vj
zCf1xxNjNDdBY$lqKmQ}woOa#^P=30R?^d1b&Co|3eK}%G<lkM7xXbQHdX_EPu}_g#
z_qYW6`B?6FWjSP@qr0DxeUJ1b>gXgO;|${)XJG$~)Bg8aZxovO|1eEb9$#*8Fv&!I
z9BTxw8`3EbDr)f3JWXp*0Oo29+Ub>AgI4?b$6DSby+S|;2mv7=1cZPP5CTF#2nYco
zkU0U5wVt!?)PraeCgk@grahUEnzJ#8o~>u{>9JkRZm{$W2jgJms}}!nTXTTdp2+;n
z*L*6U5n6iimKJ8#2>QWk;n4;Oi#eWR<)?*Lry^nDxnRF-;nPz95*8QS=2&FunTH9B
z+vXg!xZ^+vW*x4^s4mBIccI^LTGANha+r0(O|oe-TzA85u`|Bf2R+9f29@6x5_d8{
z-eR!}ux>IIn-h!OmZJB9-U7I}ZI0)HTQnW|!43;PdQ0!e2R~;xey)%E@s8>z3w}7)
zk@47m+_yPC+~D(}bHFYF)aW1V?4uzjP*B-7#ko%@b~erVY5AGa3BxJbmEoD{3cF1>
z<!glT5S=DD2>~G>1cZPP5CTF#2nYcoAOwU!h6F5Y1!ufymF>v?e>Lz>pe=4{Y~?Bh
zgn$qb0zyCt2mv7=1cZPP5CTFVGXi>0F*Bzlx*8hMW*ipP<8XVNJM~$?!2IJpkCHth
zAOwVf5D)@FKnMr{As_^VfDjM@CprOX|DWh3K=LmHgn$qb0zyCt2mv7=1cZPP5CSIx
z0croA2zOcXC<KIn5D)@FKnMr{As_^VfDjM@CprO-)vs6jzXOXiDB#Vk(J)uTrx{Y_
zAa{>4`m~%rZ1aeXMYM7|HTo2pe`Y&4pDn15t}MM%oX7F-J>{{*%R%g$wy=Fb79K?O
zZO|h2y0L*<ugZ=8%Eg9eT@c2%O~r-nrOMcg%hB^7soWSEGVpFo2-}0`!QpcG;(omF
z!%c4JX9(A1`H15YoHtF23hdNdv~aVti;$l|S58F0oyIFCAs_^VfDjM@LO=)z0U;m+
zgn$q@f&?t<`M9J%UtIp*5sXlR76L**2nYcoAOwVf5D)@FKnMr{AuwqKiYFqb+`|qe
zvE$ug1a)|U_^cU$vqp&h@IoFTP%)lV0@n@cIUQ3bHByO82nYcoAOwVf5D)@FKnMr{
zAs_^fIs!gx>WJ<C;8B-aNzix+T({-YwvD|VTxKDC0ON%x?uCF55CTF#2nYcoAOwVf
z5D)^#5dn|&O+Ej=3N1vl{@-4nuT;nE(>><E`hO4B{~If{5W~tmfPx2A%9{Ti+f<FX
z=D))h2H-&e_L_fN7=TZ8z|TrmucoU_dgXsqbz<dz4_5vUsy>*^Ofhd(yRf#tO}mZD
z0_ec1dh@@_XlUX=vO`E)40>A@0P`JJFplwu&!_X1e(k>PB<@EvLO=)z0U;m+gn$qb
z0zyCt2mv7=1deh7mUU{8Nut+T|8IWFRR{<HAs_^VfDjM@LO=)z0U;m+gn$r8416CB
zi=o5uZ2TTZAeQyrqB18OOFbX&3ot>;RR{<HAs_^VfDjM@LO=)z0U;m+gn$q@8VT4N
z^>Olg?BIq-cVAcQKqR;+(jV>Y?TH;cZ{gyF=V4PjRjRTv?LLR{|4jQoH8&#vFO|r#
z_uG;GckZ#5a!Iie5CTF#2nYcoAOwVf5D)@FKnP4E0n6HoW&O5Vqh2f8UDRH*rf6Bw
z*+riZJP>$yU|+x+_^-mB6+T}0&xO^6WrZ^fKUQ#i!8HXt3f{>7W&Tt7U(T<~59Obl
z@6Z3Uf5_kMf17`~|Czk6<$WUW{dvK>!o2^@y&<<R_wwBT$oWyuH*;3zROZafc{ux?
z>~~}rW&btnH(C8zS7xowdd~N4-$lME-|4<jdq3#C**nF1(DOUbfTz{d?0LcZj`cZf
ziFJlG%}5%UNC0WV@~NfTG+Qm*U!eSuPmtqNRWSM^jwQ)P8_<oi_>$e*_ul`WzrF9L
zcUAo8%Y8Gx^~u<63re17Kk1yyBe(4P*nd9s;=RB4!p|Bmd$DHTYj1SlF}UrA&mCC&
zu7aZNuiv_;y1)PR=O4ZN+V?*F#!u#T-*)n^A60kV`Y-2RySnp+^G<u=L!aGq^)Gto
z_MUQP>+5~)lqf{&N*sG|Vh4-di8Dr%oH!G$D{<UjA|-LgXp$3WqID%M3yGVSd|Pd!
zNx!X(R;hsdw)$X@k~rIF(i6vMQ_38B2U8M9qc`D!u=^>K9tc)xZ$e7!nlvdT^O2HR
zEa}lSMw49nO|-7kKYMuMjL{?~&P3}<+)O4exl%Jmlbkpctt)Y*!xLwWCOL5?T36zx
z4^Nyin&iZpXkCe8osn`|jnO10&P3}<9Opl#B+eL3a^g(1uEb%(sUglfb$x<B$Wp2i
za!?$Y{I3!_+NAFzlM+`J@C8@o=3C^W_$X~OnS5Q*n#4Iq2NkO7ciLZlFv3fDNY~!O
zja(j$t4Yp+iPn?{q}Mk*y~fCuUSl-L={3>1(u)^nDqmydO0O}R<n)?olha$|ewzb1
zTxp}pPh63e+zMbyQpztrjZ*m<BNty|G|5>o(YpAeGDuCYF><BX7)^3|O|-7`A`7Uf
zlRo%R>!oJF7`d`wj3zk?CfaxwEbD1&^`@HDus}`xb7WD}@k8M8uj~3rXNZCgQxz@h
zv~0xzNKf3W22}L;$$Z8+LA@F81FKX0AkhjE5fxN#hh)hJOa`IvgapbUq*6w}s8emz
zzji|xQF}6u=~!?`8b&44*ou<U4@sLR4vR#&AdzGmEGK=M$iN9h#9cN_898yULc@LU
zg+@9W?AI#5anMpKg2O1jiTU#i9QcUT>M`d^^F@wcE<!*E2mv7=1dap&%lf~7Y5(Ud
z^~{!{IYo26pZs?u;yrG|Y+6^YK7iZ}soAPVHLLa5${?uLx*C#AXf$-7@h}ti?f7GZ
zGMcibK|rlRQ>$0)aLoOx79n)1F8G{<P+Qe*xM)Qql+DySnD-)#2yAB#v%MJpI?$lq
zuHL4p+q)g$qXhl2_=hS{%5PzMK?t)P7OL}bg{{{E+v6)Yn~+!L+l!ptjqlY0W%+cU
zxi+_aSulSAdgl68e1#2R3yK!p2R8D1K#<)6_Er=n+MIW>A9rRDzj`oq&->C1vnE{o
z;Fp~RTcO{D`!j$$X?GS(*Ih1MFztq~#NA0YXS{a!rAh8r=(|aq9^7lj&<>Ms#L|Tl
z(S@sBqDqIwP8aOXC|2umX4gh1;$WGX1-G3jKYiN&ppK9EWeM!k<+uyiUUYQ44en{W
z8rL3lg0NHtP{Ny30}i`f&vt&V*KXL6(xcO4?B}bEFzJMu?VcS_-H4lM;get!&Q;6d
zj@y9z9(RO&tW<f*!q+lxO&-n`HIFEj?@^yn{wD()>0(CLp2bVcifeA!^~O{GbKiUZ
zM6<gtIAimMa}HEfPt|~~E>h}?-_J(dLj7Rxoi&$!<er9mU+mtop?PN|H!(>KaRYp^
z8>AWOw$+U<41VzX7iLsH`1OC-{LQ_ex;UM$M&zptK6TPPT%_eGRaRaRZpX=Mzx?~^
znu9BEc~`~Eo6dOU2kcL>_)wyNx+CL5$>Pek1NAJfRAiBDL$N$L(8MrjsUR2aiV%TW
zIFtn=uOCL;Sovi~`&<9p3+{UA_Li^Cc;oB-Pk-&|8xfR+yQx&JGO0CD-hPUHa?(a=
zhtG)enTSM0yjgg}?7LP7jhBuB&{!r7wON-v+Vu|?t^CXb?_B!Nul~W}lUK`e0eSL{
zf+uel>MYh8e19bBzID1ji=fs>XUhW1j^qNT4DtEzN2yBGXRI&nx-p8UkhN>#IixSU
zlacY2;Q8-??Jnq9r$*IIgj5Gz!bb_-u&n+1;bsG_+u-Unl(~^>j03vH_({CRSkd&I
zFFd~Rj;6crzP#;QuYcve^gF072$uffKsEJL!)uH>+d|!R&5qwMc<tGSkGHlge0=${
zU*)r(8lw9lw!MAtqvy@~pVGJ0e6i)y^EyBM>m})YC3nm_(WPAQe8#&E5>}`Xl53dM
z1Wi&6lgg$aNwoB&G2TUP>BQ1umlnHf`{kJvThAowlk}xEv$8zWSHS3H{BXVz5^ulc
zuY$w*TFC5~8||ASljm{bzB|%A+5D!S{BMzYDfJ1rEYok@ENWgseUhzSiq|LqzR!Q{
z!Jj@?^Tj7xqbqI<{u7_e(y2{LfAZXcYU-(yOTQU(`(W#=2KCG-jsNuO`~Kf=tAD?l
zwL)rW$v*jgWUG_zeBq|gyuYaV@AjYG_12re`?InAIv!IlBiAVWve4fwx%g&DO%^|F
zEPPt9F)=)e{EWzReYyBuUoQHifu9QeFyPli!Ib!yO9_nhm&;WB<uZExF;)bY4vn86
zCpj^B?O+-CbQ)1J0~-CEf=?8szei9d;d>;gznb}l%r94afY7wj_zgawPSPaJcPhhk
z0^n|QL&(_%cpX3h5xg90^h<5Ke%aZTAwPlHpc{k>Dm$QQ%s<@sJ1^ahc)iVp8NUzL
zz&DdqhmUY3VW%nwK#w{bFH0tpAL>yYTM;W8iF~ozBUXu*xz7p)IMqy)5D)@FKnMr{
zAs_^VfDjM@LO=)z0U>bw60ody=bQ2WJoTykPd$<Rcl_pDa+ZdGjC|Xp5;F45{^Jv6
z<eQ~_0s3o?#yLB|Ve@%7{>gE(ZMs8u5Z%4Q=L03Xu*2ZYl-a}Fnpr79J&$F${dye>
zJCHeUd#$cB?5=5a>ifo?L6qs78_vbaW`I!C=eqRl*~jhC^Kwe`>;M_f%WO1nqDSn;
z8h;yoCee|ZDRd=^hHHLM^5|U9;^<tdW#$LHJ=EK|w`6nEefJN3>5unRK0v=Oc7NXA
zvhhGQ^;Dbir1WFx#GZ*{n?2nB$^9RBP_6n*@CNVw_pDN^A5+6hjK&2oX}RSaABwHG
zY3rwded$LBf0530ax5G0boC)#TfH#j!jo$c+_~b8tFLd|w(MsmWBYH$08zJU(<yfX
zNx5V=vX`2vI}nV8$sP)mHqs~AjPC6~DydI5x@S${Xc!0II0~mH2_**KFvz9tJRF$w
z(h-N_^dupUHKxM+tWHr7=b0%fazikwGP9+Ir3%An1;rRfo2$Z@^%#mDbM>UD!$@!H
z&0DF{i(x!eV=N-+QpPgOd0cull(VCl@zgTM_tZbYrOb{x8s;UAKKr9CrB>oYr0*~a
zHVOi2C6D@Re9pjQ1D${R+{pzkxBc$D8>?FiUPEb6bG|e5z~T=csHUFE%px+g1=?oZ
zSRCGXLG|swd|~0W>a$VS5vk!AKZ&`D-@W0BKPW!0e)Ypo|DpD8%icXOnlBx#Dqr-w
zgTGq)+2vpCd&|lVe|@`^&PO8#qB-{}y+VP{WR_BD;+fIJghV?6K0Ajx2hue)(ab+g
z&0DvQvIOV!Q!nqwrw^0Bsh7OL!>3-d_QH{F!e#0WyU~?DbE7iJ-{DNSOuhY<brC)a
zZDpy;9NmOm@S&EXiou4}u~8}3_Rl|Utaz#K+m<p{mm_-yF=tbArttU`<HsFSg*cdo
zv>}*y&DG_IcbvK6Qb&HNLI8_8h;aBsKsXOe1Iiet1L0tqXFQxw%Lx|6IHurW*_w)j
z!iP9xWIB!+I5>6YWE_+=g~_)1g?lQlyg74l1aX{(V=j()IOgM6h+_ecGjMR0%2_y=
zo^%KEE9&qF)a#a4Ytp(6uEN-sVR;OqUT~)Xw`;gE<<4APE>_|Tk26u%>o3LjaX$n6
z&KfKJ|N7X^|7q)ek6PyHihe@0W5quqk&F_^;l$60T!*9Z&d~KA>j2gTX_a%|ADF$h
zR@Z|rN42Q=dhv~as0#D{$F6@<0%u)fjJ$fCNI%Z(UuZSP8DC3KdybcX8A4|rNmYk7
zP82b7y~uJsy=@nsgv{Rr_~OUhKfCT_I&`3^C-dBytIOVB=)Y`5Z*(Bouy-KR(-G+p
zuI$;`dwHRM!HSTr!pp8&RJEwQzOo`zR@b;VR2B}`HI`L1R4ghBg=#`|i^Jhi=)9V1
zmTszTSQ_^ga)ki>6C)|5MzYDwobN9lRGIlmc13@l9XP#$x1XmI8omXS-Hi4Nj+L*t
z3H8???pnQ5l1KBAZ09aJNqW9??TmHwc17;oQjAw~O?^v!ZS;|1<-tmO>jJpQ#k)Jn
zTa2q_l1=Pi)8Qu;EA_Cr&h&V-8^m!Xnwzz#{jbE-%XL`MunM(t9lpymRWtGY@teU!
znTbF4wY|&_45$wDNc7v<LppOwkcpeuOar;rDKv+c>qIQL7Z$&rn4L`HKOJsQNgMwj
z)B@vE(+(m3XCn%J^HI6ky_x#GNXrltq>9mDkZtubkw|5>uco~{5{-I&n`&$Rd;m{@
z@8Zs$aOJnIb+n7hbFOo=l@)uT_4=Ax+dq$o#78fcpPJ|B&i^!Y*}nc=U6GB^#m_;n
zq64EnTeI{NGh06~LH)$o&sM<w%&n|nHutKkip3R+7Bz;;Y8I83msN!8LuHG@^|fW^
zFRH4os;xbLad~;wHFFF7&8^*$WpnKm;OB}+S6^Lk&p>4F0D}p^$l27auD83db)d7Y
zE3&A3+1y2o5o|eXV>qa5S`L?sL&#ZeLrsnQfNlMn+GTUY<>63meQjmk`L*ZU2W*zt
z!J;<2xVEA$Tw7OH&ZA<{+(K*L=Y}j@=Xq7=Y>(&mJk>WXdxcl+_o$9nu#_}g%^I>(
zoTcXDi@w@3%|i9C>{FiUIi4NXwA}2HJWt8cZyx*Og+5i_S>?aL<Dc&NFwy3AMK1K5
z%(ojJb9Qe;)R~2t*nRpH%6s-^wfrh%sXSEi;-XNQ%Juo`Fwr}J&a_adqVk$~<!WJQ
zUT9w3lFbS?yrXwdbhBDN7#)aoFDmzJ_D0GV4s^B6Q!T3-f;GDadcWBXUcEhPi}LuU
ztLwMxsxtRNv|Vy*P%VF=Wyq>k_4f?ryl2SD_tjes;jH>_sI1EJ*4Na8LY4L9XExMS
zSoL9V{ThsvZR>CC4mM(WV<fs6H>10tx5t-#L(}Hgj@}iUyQ4#%^6>s<Oi6F=?~V3u
z#ZW>``#|UJ$R#RR-#XA5Y-v+FBJBgwVEIB74zBKO>u>F!J~*^OSw;JwMq_Epe($r-
z7JKs5+$US_W#cQBhu02|SFn=TDBc&33R-6?z*1MCKaYRqI4V#}H>xtnB$TA9b4(Mq
zwm<t^p(@oiXl+%XrB#mWVjOj931YBk{%=EV%oV@E_<G4G>^RZB8-E;0OtwikEq^`k
zF;}l~9qwl5{bH`?Bi^uM+MxKW9xHEGBNZIAiQ;RBtMfQA!?kgo^3V7<%|D2@R3H8l
zs}=0NZ2Mb@)IMBvFXTshC#C&AD}Glhkgi7j)q!OV*q33oc_Z|Tp$p@87<nnvZg|)1
zyHcZFh9DBB5iWR~ukXrY@CbngkFoDcI`%DC8nIP#i-0o6e0%ZyZN{5DVID>q*o*}g
z>ye5&{4Ip-YNT>r+C>)b75zcvrc$Rd2tO#~xW`;45`_Ow{ASsqXgRm~Dn|2$m)}Lm
zW1@t*b(xi4R1YbnxQ?txS2TN2a!^_5FEWlQc7t;{Ojr|{iirNXaHS2oX6_qw`QoZf
zmh{A85_e8!$M1RKiQ>~39+nf{_cBNxu-zr!^GcNXa>Q4IXOK@KQxe8CvwJ@BljzRx
zX5@f5-Hg0M9ep`sN#r?Q+2Nh0G=SY;hMElNwA)0<_c{t2JI$lrb&g&Y<3(BG!RkmH
z)1fcLbtVq`#cF@6@oc|44)^QBa^EUP|Ln8&7mj5O|4=^M_{9Hs2$&^X6J5rzHVj`K
z=u*cuxxCq_V?mHIHl90mWZcUAKQdg8l~9v=J>-`V5CTF#2nd0RA;4aHr~U7-F60Qc
z`Z8Jsm!hwkT?0Jg4Frr;TR56?&}&Nx5RTPiTyapDJ{Uj!+v3#NIfHLZC=5nhK3Zhs
z&+fIcEuOjpPHAB)`Y=CyN(ZGU%IJO`+eZ$B=xQHXdf+_~$Ckf$g7WILBrNWJ#If+`
z)Fdn(!G?ax(|7#nSg>c9M3IM;Xb|S=sj{3jTdXB5u!F^je+#0)9D#egLC>xmcLSeu
zymB!tU{C0~L3iF`+$|>-dn6XSI~F@9MehN~CBSgb-H+tlqH!d+;3vOYXzIhHAzpOq
zY$N^_B?N?k5D)@FKnMr{As_^VfDjM@LSSqHmUU`e{GV5SrD%6iIR1NV-{L|D2mv7=
z1cZPP5CTF#2nYcoAOwWK2|$43=!dVkGW@XBp$6i!vI12j#O{F*CQ-*Wf$N6!gpGPd
z4dzkQThw66M!h|$;@Hleq+SRJ0U;m+gn$qb0zyCt2mv7=1TrPyu|7^Ib!r`&gPe8F
z!G9hj%>QSjQ8yeRPe;qtah&6#m01grcFMnA9l%IZr{l*h>_9SD3jjHH>DL0BbN5(l
z0bq}4lGg&bXaCQ3iIz$gwauCRsjCC#Ce8g1#^?P9UEvfbxnU^7*A!&1P5{s^MA{SU
z1n39ij#JhXxYrqY;peT6pCMfByBuG}kyu+0x6>M)5_Y;UWX46-CB*rOMhFN2As_^V
zfDjM@LO=)z0U>Zy5wNW1_4<D%%ID1ge>HA$R3%jsBLswi5D)@FKnMr{As_^VfDjM@
zLSWnkhQ{q9jfd(qX5%*sj^E30ABP%<WnEQh2JQ3JEm;5GUi50<$ARw#S^^gY&I&wI
zc)y+>Fg!*v5duO$2nYcoAOwVf5D)@FKnMtd2_)dt`+&y|7O5rs3$Q<*r69R{79yb0
z;!AdK-+TXi{`S6~-c|9VFZa#()+b}PEhu@S{iJg)kKD5FWB>Wki}(KG3qNbP?8TaS
zuf5TI$KbXfK6ha8y9$c7zkchY>i+)MpMUi7Yv23y8$X%XecQ>uepKCc>%W|P?dr}O
z&O7ae4}Ese)xYSS+k48Ht*`f`M!PhTlI2LrA91)6N23i8<vz)YW3-eY?@C-X3{nzD
zqc<UOj5Z~4OJR_bI2uiU;;efL8F4y=_5a1e>LFzrO*%(nc2pDKYJW`MZ!qis8_fFu
z1`n;U6r#aP4Ynn2@KJ;184X#~U}-@^HZ>3e(U3z;9yGbsU@PQ?JZkcx@l#U(O+Gc~
zENUpA26IRn3aP<rk_MSjqC^P+As_^VfDjM@LO=)z0U;m+-edwkY5%{;ci_lI&lWh_
z|GK$Ojc%?}qnqp0=;k^#y17nGfW9E+A*I)VCc4*v8r^F^jqWv|M)w*}qk9c7sl@Iz
zpho0K9@)Drp$h>aAOwVf5D)@FKnMr{As__CCg8Dtspt2XqTxo-eB4KX2bzJlnhHIR
z<{S(N=V;k~aH&)cjB!x8w;nLw4pIJJ7RRAoviU|93^?Rdex}z;S@td;=iKcG2DEe*
z5@P=De#8+BIF|gsfJ<&4CH3X1m8xC!s-9tz|HdWN@9tRaoV0TKJiu6sJUo(f&fT}*
zs#IL6--v#^@Kfjb8KM_`?+9PtfQ00}xSiJUl(5rIQ*&!eHxwy;abBVk0zyCt2mv7=
z1cZPP5CTF#2plH_ME>7#aw8=hLO=)z0U;m+gn$qb0zyCt2mv9Gp1_1mN#;&+hpnm)
zI|Kx9sDb#b+Y3kXYnJ`T*Z=Dg<B3SEgfUqJocaHaX8nJoS^wW?*8ew}_5Y1#{ePob
z|KDiV|2LZT|BYt-f1_Fd-)PqVH=6bTjb{CSqgnsos23Dqo=79NmJ}rfgn$qb0zyCt
z2mv7=1cZPP5CU%k0crog3D74o%B1!``fu#^KQ+4jPmON>Q={Ae)adp<HM;#zjc)%_
zquc+~7=Z$I`=2I8pn%=}r->0LV7LEiBJKZ4y!R575D)@FKnMr{As_^VfDjM@LcmSH
zvRaF(90RZVY0<}vc1at}4M_AtKnMr{As_^VfDjM@LO=)z0U;m+4wXQT7Ft)QcB!Zu
zfM~gH?!%_d7~*U-Q%%=@CD@J41F3u4Y{7f9q_DmXs#UeAE){`yEsPIlbG5eswr0zA
zJYAEcg~4IeRbMHkuLQfY`SqW16tS$6;`{#<sUM;JKUlQ7Xim`|0{<4cI?xiB8~E?S
z?-hQqu&1y_%Lzm%qJ)4D5CTF#2nYcoAOwVf5D)?<CV?DoaIITdWw=5jd0fIaTXA-a
z%e1!8B;!ulY?9FvWt|&w+-V)N#YM+6aj=Crs$*=ytsPIpl`_#sb&QR>wc}D;*@PU`
zF}C~Gj;A}<Q5|EG@OVqsB!g*Bn?WwZcQ=EBF4^lr6^;kwPGY4hR}0nIY6053cJuf;
zN~X8-fs4KeW_5qsSb397yP5ZZo~hD0rUSQQdZtS2m>D&Wsi$YEw2n!~IHsN+sM0#7
zL*tlN77MDhj%jHe8;2t}wk%I!HSM5^Q`-L@2<!}87?=`xrSP8%Z!NsMFeE(yHYhm@
z0U;m+gn$qb0zyCt2mv8*LJ-K&+nrS-uWVSkw>~p1F?$S_!?t_uzJaBVWB0u3w2s*~
zz`58AnR=trI%ZppJq~otroT~X9n-;CIOv#7f1}bmri1x7GIGqmf!U5@>WxYpGW!PD
zm%)%t3!NU)I;I15PtdVxp+lSAF&&uh3DZI!(J>vcmxLjk7W#;e>A>{xm=^koj!m1N
zA&=?UwE5|ndZW_PU~`_1=-4#v=^?FS<A_%tMx}A=vDWEw`Ej`6etIR2TjTBPKiq%e
z)f)~}H*=#sS1MN^WE^^*Kif-Ut3BpjZ_byx2j7MR`)wZ{ori>vnebunJeRAQF}tA~
za~pCo&tXvYK_|P>nHwlqAs_^VfDjM@LO=)z0U;m+gn$qb0*6MxvO41ZQXch{qTTUd
zhZdgr5&}X%2nYcoAOwVf5D)@FKnMr{As_@sAYcaDN3hP!_|O8etg52bn`%}w4v%`U
zXqB}8Gs7*egn$qb0zyCt2mv7=1cZPP5CTHrXeSU+dm(i%qWV=2rkZ!D%{cd{4*c#_
zow%0acOP_R(D$l#2-(~0(lx=X2ggEHljLi2>|kW?K%~E?wQF;0Pe*@mXGd9UUuRiI
zZ+mpJJ~j3B^e(Kitu{w`HaGUSc1QN~_V0|Y?CFT?-MqK8yS2Zwr_A_{cI+$*FIu>_
zyX(jVUCy8_>(qFQ->b*}!|~ro`;C<J2>~G>1cZPP5CTF#2nYcoAOwVf5SSzaZUGR7
z9A)s3eY!jzVjz}viQkO>L-4~hSNpGiJoV2Ni)e*_5O|XbG_5OFwGaX_1d%5#=(g-c
zXJ!w&G+S|W>h8%BZQh|fIcp(BqXqVXxMYnc-N89s)x&-(^t;drI-oY`aP}a~I)u>$
z({A{>7^WSt-JW93c<t~@liaV+?rGBl*(8ji9VXp~rAw{B(Td;Px1@Af>~ygUcExHP
z&Togl6LCZk%PhF<gr7d`e^AHA{IbKg3({w5aPESBk9r&2({weiJ!+dycR;OFO{xJ$
zuTJr7=l6Q;h8@8@I!(rYzS;<rPMF#5NuwKaGc8g4*@SZ;sdghmsz>TJ>D-Z1;ts6S
zR3jtUZa`S<gf38x2#@rc?m)_2v+qz8Dd9ctgDX33`s#%lsSZG5%SxoT5Ah8kkF7}I
zPJ~nkUBX9+TCZLA!wq+j*#=h|^@K57SWcd@P@Z4_2|bpU+A`fz`5qOp{7(ipvbY!S
z&;PsT@Lw7~@%{3r%ddQ0i_N+C|6-?={@_40?Wr1&C*Iveyp2eQt<KrJ?@vE}@K?=W
zy7SIQp9tTvfC76`!z2~vsu{Vn)mvL0KDY1A*{dIV`jZ`>ub&2iO2d8G1S5`*=cd(o
z&-(4n&A0#fhO^G9vYt-ogLjnW$G!)S$CL{tCb{M8*w(<~@q&}5R9SgND5|Mh*aLT#
z7NS!C(249II4?!qP;@f&S<q9FceV}Q@^HhRm|s~1xrjOhJIlhMEEswHFzUurV@I1x
z^F|#lWk%&XB`QLpP&&&0oT3FprH#@KpAqFV5s8RcAPP*n3Ze1RQGls2X-K^{x9T)d
zt`bY1o3KgAIa4!Di7U${B}}R(eM)|E@6@U{qPN%l^V|z|zx3muyoL4S0%T`M*A2}m
z`zuvYt<|+lKWf8Zye^oDx}#l}Sw7jD^bIplcmVYk>yjOgxnI@lI;jiK`7B+R?uH8v
z9YqjgovwkR(08ETqYNXrZK4(p4zuHv%Cfi(aWQpgkLkh=gEEq44|8j3@gPz=n8tp+
zj%5HTrv0_JTeiS#eP>W6?P3WjP<{)=Aq0733)OkJ@*a9%y9w^0_j#ee8}gt~NPH~V
zRMfLzzu@SzUFNwieIE1{-01s+FyuXUe80!4Qr_RDj7If$$$ETSw4&rk@HBA%mNoNw
zT=`6tpc3tcj^74Rd>8N?Uz+sJ<d@BAn78WZF7Z`jzIu#Zsj|OJB6wmV2!(Hr2tw_^
zcMZQ%j?`P0Ik4X|{7UJ>Q_k<A8eF&OJa2QJek1E_THL++9pB8yMGLm)D<kz?{St)w
zdDOGYysJ-M`{mzP*Bo4V%eyLO-gL$*KcL?~cYXQBbI*LaTIoEWo%UT#cS`-%|Mr5r
zp1Qr|t25sCy8qK(yP9v%)DYdTHtk7y-}$S$?VEpHcm28Vf8BTYRlVtaCBLa{e~B|{
z6{n6!nCTZ}@*6ibDSRbQ<9iAIt&^M(_*$LLI)<7V#<tY4eHS8_gqL(GNTzf)6UF*-
z4${Jpfgzoi^l$FlPtk6@={^=x-rVLbsY^%lTas2mhsE&tE$i_B+yDRgyA^Qr6Svq&
z_iYfp5D)@FKnMr{As_^VfDjM@LO=)zfuooJhbclhs+}~xJ=EK|w`6nEefJN3>5unR
zK0xCayFc%5*?6FudZTh6>OQ$QSgA_K^5OnZ?*GVxYSm|gH+b*AXO-TYAYHf&gX2RA
zJx{g@Uea>QH$D_wansgM|N7F84*r6DBqRAuj@|SQDfD&O>V+8>o?Lt2&J}lDeSPD$
zWj`y)JgjE)Vt1=H^h)(3D9ie{{8>(zQ`A?!zx(^)@4x!=Lr=Foed^OMKK0^LcRtmO
zzr3fu^W=3;E_w35-J3@^zT_eVgn$qb0zyCt2mv7=1cbm*O(08QPSCIh4#${Nn<H~+
zh&Bg@2P-i(g*%9G)AcMhCrj^sm)uU_xatUjAjX9+rwN3sjWZ4eDaq>nt~D$r9Jb6j
z5TxX>ooNE$j(Xz><k9}Yi-)Cz4W#h|^1;HUslx){Mtb83<P)3DJ!@DX+&?elKrpSR
z@s#hKG%OG{D>Dvcty1^SOcMy_7-k#@?#^3hqzQyg`SAqu!3RH-JuEw%r!<~G{`k{R
z6b}moGnU2`$T!MAdHJwFIJa;-DfyR&{&#qG_^@Rh2%a5ZG`27$C6@IsMbi-sl}G)m
z=y6&7Z^MwY5D)@FKnMr{As_^VfDjM@LO=)zfuoWD*Ci@-874beEA0f9psP-I)+MYk
zBSEXUmCp(WX4+<Q76L**2nYcoAOwVf5D)@FKnMr{As_^fQv#N?uVA^8w-WVS(PxWp
zDrzn|t4I~S5O_FnLtu5_)WE^QpBCOxcv<1J!WRl2E;vp>NVbH45D)@FKnMr{As_^V
zfDkyU2zViP6H+4~9dHox`Y2<QGB9mv#vJ<$!k*)uUX|m8c-~~E32~e)Sp2*L9@`;U
zkPEb<df>Dif-d8pt4H*_9IK{#v4Xl!OD1#&We0NsBxc5gS(-sGwzqTCnF()I8F)*U
z8cJD)c0d=ZC5eE_5K!{`aAGP|(-Kb3f`O6dXNNEi>pJ2&nD0u8TU6>Lz`j~@n-A=9
z=d(v}KAclhhB*Lj3lF9UXd{5tPR?wsIf;i~8h4l~Wq8>A=cM*@0*UD`DNIVN9qzDB
zXD-PhXT~QBwzX4e*2L&y$7Kqpgi?+*C0-l3%~43Yq#S44TM_{-OfcSzpxVSuO)A)2
zeqfx|AVCdIcuC3N@&e;%IDA)lM*bfcZixIpP!lBtgn$qb0zyCt2mv7=1cZPP5CX>_
z0g?YVT#{k3{J%WwzlzNMf9M){<`}%ml4Kzu1cZPP5CTHLMS%OORbymfXoOuTGuxwb
zq&-GQ-@Ec~b|6jctvPXfkxtw$U*p-ibgaEeN8j1>$n0EtbnnJC-u=>wv5z75l--F@
zOndLRlDLVzvmE!Lodw(NxN^Lh`>Jt|IqsTDyS*5(<=$-EZ>}F^_HK-cP>nwh{c)Gs
zewWX=qx!VdGk+8}i4@jiAeu3A|5nBrfu3W{+*OwQ#&MU)s4ExgQo}o&8iu`#Tx1NN
z+{1SlV&g7++zodSgS&NlaQqJ(FU0^X6?YQza9k8SnORxX1hGqOwknP95}PVMkiJso
zt0xag(}hx*$W*swsnc~Pa@3P!Nyty9|4d}3C;LxsGck-*#c9!OZ6+&#(!09q{bF-5
zu$~Ht4u<VdN4zH!FEulv(R<sS;_P0Bn6hVU{r76A=T34;X}vE9y|cxv@3e$Idv3x_
z_Pm7NH$UOVce<nhJVLYdOpEC$lLrh%#Omc9o;x5Nkb1uk(N3=3M-~Oen!<EbQ^K5Z
zXW6Nkn$fKbk>0P5rRgNtAt+04)~9!tC8X5*OGvXA3L^8J>PqqgC*mLIBnNSxnUZAp
zjWfx101ZzzP!|+q&&jzejL9IO_%WA>KAa4t7Pv7pv_ofzVjz9`DNL7i@X!TB6X&M9
zM3?#?jTw_=_4yO+{~<;xN(cx6As_^VfDjM@LO=){F#_zPT7W67(nr;k;ZF23(aPuK
z^-eUVTG2PK1_ygU*gsIB`zHF(mLI_MU-l*JQ~|W)TQTd{%t9Vd|JCUIQze**&ouNS
z><zeXLwsZPcuAjDCph(>p<09MHr?a04eZ$aWZKu$pku$(fbOg6*Ng|$CN}s+?1_0r
zu_xvw<$p4;k?#I|pa0r}KYgy|i%+yhSKJu<Cz?IBD);g|RWDZ$K+hc$QYW+14Ptoh
zcUzxc`=f>%rvL1r^7p;*B)0%a4K3McqG#q8duIH=f5S!9Hy3Sxy!uxkUNW{{9p$hS
z+PhBE-fhLkY!3PX;=L)U$)W>xoap|NnNA2Wv`%5~0X6JK(6;PGpxTGS!jcGuXJ>e>
z(zUzki$R&54o`rAql2Sh3OYDKy03tJ9+tb$LwRP?6~gnezlL29@6a)G^#PwyyHC=-
z>zTx=yH#}m3j0u~@l0n7)UZQI_o|>*z_tq7R%ucp<Nv&$qJ)4D5CTF#2pm5IWc;6_
zryS$Wv~4xf?WeI?L!-B^q^&e|TS><M-SZe^{NL>Co;-eUTGn>mo;n=MR%+_Ne6oM{
zFmn3$16!;z{-0<SAI@;OjQ>yG_`eVG|Jes2N(cx6As_^VfDjM@LO=)z0U;m+gn$q@
zehC=)e~qVz{J-P(E=$gYfDjM@LO=)z0U;m+gn$qb0>?W6k^eWA{6EXu;#&XTC+q)@
z_eVnVCj^9m5D)@FKnMtdNhXk3?>~}U$-|KxIdSqLM_Xk-aVzM@S|4&`R)8erYtDkW
zG|CX*IvK7(@6_v%Gm{HCy8O?Hled{p%E0j@!!rGP{|#8p?OyNCb?SQIIo5P5bpY%A
zJ?ba%_5LfGzVn607v9ly*WH)5ee3nFyqA7&nexG;_5SI0xuZL!Zn|d2?-#uGY{SP}
zTNXaP{MoN^MMP?dW|zQblo4B9w_w(yKY!)3%isIaHxAVN-T%Ix&R6ovcE@ANg=;75
z)%b1;F6Q?lt9rG65oFt?CWsEkx!V6-h`_>1f3C!L=Z7oqea^ak>a(2maGig)&E3+X
z2Vz|3pBrE2kJa|}I)A^GZAdA6Olc}krgWU^|CyR!o@vWhOqUw2_}6Ru6LJU&OhOBx
z(d+*ynLvvMkoEuWk|lZ}AOwVf5D)^#GXYuuFYEuiA^D9`-J|%kTX)A-+ey~{%liMZ
z*YC^vf3~mf{Q^Y(KZNhGkw0wPf)i2xKiB_L`k^QxAOwVf5D)@FKnMr{As_^VfDjM@
zLg4r%AoBl@-+L=L69Pg&2nc}_lYor>%lN;H|8xI`S(xp+9oKFgjm}<M?s4-P%z@_)
zZ2j0N!rqIm7T0#{o|o{)nao`{`t=@r40SJd3Lnj9Cqf%g^G9*B9;s^8J5<zSS3kzg
zJ^Pr_2=vPl7fUeb=l8%QI!0<Zvm-SO=9cq6M$bnnb|BjYcXZi<d=IMCFyX##e@K~y
z?y)BsD=Ukdpv7J1N-eYNT&fg(*1Iouf8O7+@jx~8RLPR{ZL`#E%hQeMCw7@jl@FiJ
zb#g2+{x9SI+<XtS;_c1%Wc=S*;b2+4-qo9GR`WTWrM~F>;=dlspZye%c-D))P+bh^
z?LnKdZRkoBRBKV?u*w~Tz6sS7t5j}_+3sv+8cnGx0@&)bAMSQI=6+R+5IRvkb|C4^
zsQPxpMXRnVgQ&h(Sw|6O2SQD?y;xVQ1E^|)!|b?SDqjZMbk#Yi&K}c+9R^=6vxm9e
zgqR{~58|msPKVpC*Rc#Z_Sb5L+4_t!il>$jE;pxCehZsShE$bWsLsQcCD;SoO|Yd)
zFZ6d~BVDWl@p17874=*^@`9t!cA4k8^n5BTxRLvG<nGhO`X1Q#=||4}IGp=btT#=T
zMU-7{(w4)rh>{<xU8rH#p$6N7Ep!`oU2K0wx1bhY4Re0n&QvX^w^_UQ>pIYFSE^R%
znmB@bleHwni0B%<1fQ(-cDVe+9(yCO2k<<Myj*gjm&+v=c+H3EEB|u;?eBc)qK5ax
ze!cIlPu+Y8{qB40L(3}9db#?g+|Q|(a+R`|OLpNMW2R0==?rRXdH?I*xczH&pLpYv
z&$Qe&(8dqY)DX=g+Qet;^JUAP{c@zQ`u6GXZp!-mmw%Sd7xT;wpA(BL_eBC<TKDmS
zi#~PkM=$<i*M|OdzLFPNCSu$+V@v<a2j@0_<ED$69=pr4F1=qiIU;x`^V6R><uc&i
z`Z}m{t5iqUzgoSO&Gq-q4xBcyYVGyu!ns(#$2xR4+!DMU?^at~Tl=+H59Qv_@PQY5
z3QqE$y)&I}=Ac_Q&)8&QT9U)~%k8CCmS*o*c~|pLS@G7accu%&&H>9Gn=lcS%Uvir
z5hoR;|8L#E(A|Go{*CRAgue3|&kr*R!Q{yf;>S;JykcPP`x-v*a7TUD=}&G>7lQo^
zB)0OleHLE(obMf7J=GrzthsT`nJ2v?ozFyR<C9|F(GKTsaC2x|y|eFvjrZK}g{Hg8
zDt~zCN1l9f?2wZ4-~<!D;LE}J4u~5;Gi>Q?YT-VFrMLEW*YgqjY~*gVGRH3)z8Nd=
z8AN@$<*y?x#^pZTnAqz<QA)e$_G-j$p+-__nlfbErR_+@y<f*2#CfK^zv;`nNx|2S
zK<<Zh3TES6>OAkmpB58;!x4y|tI{pp|8()2yJ6z*A0>Xh_?cUs>&4G{qjhu7EzgL{
zpwq0uzC|Z!I?lz;>nri-nuO#{MnZ1Z30Z)1(DmL)UlW*w&A`J?{X{+=@6qX)h4b{3
zbi66|XFw-sV%O`BRYmO6adJ+4iBk>pA=!)95?`zaegrM7QQ<S1ktGGBt(@GsH7_rB
zoLIM@7cPu=!w(@&%bJsG+W%isAItmLWAZoI1ma)1Bemv67qxOY0&^0rn28geGjXC{
z#v^EFEKxeL)$-xCu<l?Nk;2;$3h!Qz3<YQu!%lcDr2VF5@7ir(D7~O#^@1*N4Oa!x
zj^of*FIsbKRYvfI#NJ%?wqA&@*zK@kubth)%YFj(-r7r@gRcHy_g6mqV%fgDRo^?i
zMB}dEm5zU?k$YR;1zWmgZ|fQQ6X4K$TiH9C@5Cr&Bh#MO6SHhAkltQAuN;6M>pd?b
z^LkK!tw;UH8g2kJX)Ef)D8`NIQ7c9v4x$StgBUlm$EBj^o$b-}DBVX;WA?(v?uBDt
zU<9FUfZ5U2+nZiw-pwgrDC})uKad46XlT)5vVuni;*%8$_vimzbNDZfpZI?H)8$vb
zPFeBlJ3}{Lv8U?gYBt3JIP6}z2&kENN+TMDwmN6?zCZo^!Cy6h>CQVJeIk6v0`|qF
zhPeU!lKXSt+Vb$ZeRs}Y{m|2&?D%~Bv_0v3nO;OYo?EAWK()Qvw(91<lBYk_>Dism
zM{*CalfabANZ%zXV)jzAz^3ZaDP}MA2Bd9N-vbJkzL&Z2E*_B3J&gZ3W#mSDihw<L
zzv75}Oh*1+>OD@Iuy^Q$O~W~m($8R$ch1yIlc$CJvExf?#v}jF?EiQ59NGUb<#~~x
zLO=)z0U;m+gn$qb0zyCt2mv8*%n*?M|Hj(?PuBk*Glf|aDg=ap5D)@FAR_{tR8Wmc
z3PV^Pcj)_k$)q$+S5FK8%A~ZTY1xm+|98tVkoEuf-9PxHKi*UMfUN&N4O7dU8ROY=
z^)xe)|L>Lc|MnUJ-vV7CI5p;BpPB!EgHq2Ne}6CKy!7aJ{=TUv0%i1pC60u^BoL6v
z!N>mO;CG{(n2F=R!DL=e{ytRk4>EC_(y)T@DXf`^RylenjvvXgQ7!F%l$9PVXRXII
ziUlN;sg`KXb7>tVq;b0R0H!*#HPwfuCIb*j#6{{m_3TV({~xUr!KM8#?SD>)PnA3<
c?SE<iqbhGkRo<=I^ePNatC#kFO8fu+1HJ$z;Q#;t


From f866106c97a98d56e40b8f086273cc8231e3285f Mon Sep 17 00:00:00 2001
From: Peter Collins <pecolli@microsoft.com>
Date: Wed, 22 Feb 2023 20:59:39 -0500
Subject: [PATCH 3/9] Update policheck exclusions

---
 build-tools/automation/azure-pipelines.yaml   |   6 +-
 .../{ => guardian}/CredScanSuppressions.json  |   0
 .../{ => guardian}/PoliCheckExclusions.xml    |   4 +-
 .../automation/guardian/source.gdnsuppress    | 236 ++++++++++++++++++
 .../automation/guardian/tsaoptions-v2.json    |  11 +
 .../BindingDatabase.cs                        |  22 +-
 6 files changed, 264 insertions(+), 15 deletions(-)
 rename build-tools/automation/{ => guardian}/CredScanSuppressions.json (100%)
 rename build-tools/automation/{ => guardian}/PoliCheckExclusions.xml (88%)
 create mode 100644 build-tools/automation/guardian/source.gdnsuppress
 create mode 100644 build-tools/automation/guardian/tsaoptions-v2.json

diff --git a/build-tools/automation/azure-pipelines.yaml b/build-tools/automation/azure-pipelines.yaml
index 66aa1155fa0..3eac7fff86c 100644
--- a/build-tools/automation/azure-pipelines.yaml
+++ b/build-tools/automation/azure-pipelines.yaml
@@ -1439,5 +1439,7 @@ stages:
 - template: security/full/v0.yml@yaml-templates
   parameters:
     stageDependsOn: []
-    credScanSuppressionFile: $(System.DefaultWorkingDirectory)\build-tools\automation\CredScanSuppressions.json
-    policheckExclusionFile: $(System.DefaultWorkingDirectory)\build-tools\automation\PoliCheckExclusions.xml
+    credScanSuppressionFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\CredScanSuppressions.json
+    policheckExclusionFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\PoliCheckExclusions.xml
+    sourceGdnSuppressionFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\source.gdnsuppress
+    tsaConfigFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\tsaoptions-v2.json
diff --git a/build-tools/automation/CredScanSuppressions.json b/build-tools/automation/guardian/CredScanSuppressions.json
similarity index 100%
rename from build-tools/automation/CredScanSuppressions.json
rename to build-tools/automation/guardian/CredScanSuppressions.json
diff --git a/build-tools/automation/PoliCheckExclusions.xml b/build-tools/automation/guardian/PoliCheckExclusions.xml
similarity index 88%
rename from build-tools/automation/PoliCheckExclusions.xml
rename to build-tools/automation/guardian/PoliCheckExclusions.xml
index cadc65fa037..cb29dc1f076 100644
--- a/build-tools/automation/PoliCheckExclusions.xml
+++ b/build-tools/automation/guardian/PoliCheckExclusions.xml
@@ -1,12 +1,12 @@
 <PoliCheckExclusions>
   <!-- Each of these exclusions is a folder name - if \[name]\ exists in the file path, it will be skipped -->
-  <Exclusion Type="FolderPathFull">LICENSE_DATA|NREFACTORY</Exclusion>
+  <Exclusion Type="FolderPathFull">LICENSE-DATA|NREFACTORY</Exclusion>
   <!-- Each of these exclusions is a folder name - if any folder or file starts with "\[name]", it will be skipped -->
   <!--<Exclusion Type="FolderPathStart">ABC|XYZ</Exclusion>-->
   <!-- Each of these file types will be completely skipped for the entire scan -->
   <!--<Exclusion Type="FileType">.ABC|.XYZ</Exclusion>-->
   <!-- The specified file names will be skipped during the scan regardless which folder they are in -->
-  <Exclusion Type="FileName">REMAINING-INT-CONSTS.TXT|TAIWANCALENDAR.XML|XAMARIN-ANDROID-SDK-9.XML|SQLITE3.C|MAP.CSV|METHODMAP.EXT.CSV|EXTERNALWHITELIST.CSV|SYMBOLARCHIVEWHITELIST.CSV
+  <Exclusion Type="FileName">REMAINING-INT-CONSTS.TXT|TAIWANCALENDAR.XML|XAMARIN-ANDROID-SDK-9.XML|SQLITE3.C|MAP.CSV|METHODMAP.EXT.CSV|EXTERNALWHITELIST.CSV|SYMBOLARCHIVEWHITELIST.CSV|POLICHECKEXCLUSIONS.xml
 |API-10.PARAMS.TXT|API-15.PARAMS.TXT|API-16.PARAMS.TXT|API-17.PARAMS.TXT|API-18.PARAMS.TXT|API-19.PARAMS.TXT|API-20.PARAMS.TXT|API-21.PARAMS.TXT|API-22.PARAMS.TXT|API-23.PARAMS.TXT|API-24.PARAMS.TXT
 |API-25.PARAMS.TXT|API-26.PARAMS.TXT|API-27.PARAMS.TXT|API-28.PARAMS.TXT|API-29.PARAMS.TXT|API-30.PARAMS.TXT|API-31.PARAMS.TXT|API-32.PARAMS.TXT|API-33.PARAMS.TXT
   </Exclusion>
diff --git a/build-tools/automation/guardian/source.gdnsuppress b/build-tools/automation/guardian/source.gdnsuppress
new file mode 100644
index 00000000000..98123d3e81c
--- /dev/null
+++ b/build-tools/automation/guardian/source.gdnsuppress
@@ -0,0 +1,236 @@
+{
+  "version": "latest",
+  "suppressionSets": {
+    "default": {
+      "name": "default",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "lastUpdatedDate": "2023-02-22 23:55:29Z"
+    }
+  },
+  "results": {
+    "5a0a8690d8a06dfdbf6002c67fa64a60a94f3fc77a594034cce20382e88002aa": {
+      "signature": "5a0a8690d8a06dfdbf6002c67fa64a60a94f3fc77a594034cce20382e88002aa",
+      "alternativeSignatures": [],
+      "target": "src/Xamarin.Android.Build.Tasks/Xamarin.Android.Build.Tasks.csproj",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "79459",
+      "justification": "Reference to an external source file.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "1b319055b8e507b220d0dab341e67e20f49632fd1844a08a4fcc6d4493930ac5": {
+      "signature": "1b319055b8e507b220d0dab341e67e20f49632fd1844a08a4fcc6d4493930ac5",
+      "alternativeSignatures": [],
+      "target": "src/Xamarin.Android.Build.Tasks/Xamarin.Android.Build.Tasks.csproj",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "79459",
+      "justification": "Reference to an external source file.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "6789cab1bdc97b0cc3ad057b7fdd21d63cdf8bc2679391923803fa240ef81292": {
+      "signature": "6789cab1bdc97b0cc3ad057b7fdd21d63cdf8bc2679391923803fa240ef81292",
+      "alternativeSignatures": [],
+      "target": "Documentation/guides/building-apps/build-properties.md",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "185843",
+      "justification": "Reference to an ISCII term.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "bbaf5f946cb72748567e41f0df5f1bae05550f4ba7381e21ec6b26d6c3ecec9f": {
+      "signature": "bbaf5f946cb72748567e41f0df5f1bae05550f4ba7381e21ec6b26d6c3ecec9f",
+      "alternativeSignatures": [],
+      "target": "Documentation/guides/building-apps/build-properties.md",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "185837",
+      "justification": "Reference to an ISCII term.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "db8916a0f0cdca4082c540921dd362e09a9ff413862ab826308411b76ee35789": {
+      "signature": "db8916a0f0cdca4082c540921dd362e09a9ff413862ab826308411b76ee35789",
+      "alternativeSignatures": [],
+      "target": "src/Mono.Android/Android.Util/Log.cs",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "80418",
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "58fab4dfef38677720e955e546a6af108332c65daafb0d043ad9d93442300a30": {
+      "signature": "58fab4dfef38677720e955e546a6af108332c65daafb0d043ad9d93442300a30",
+      "alternativeSignatures": [],
+      "target": "src/Mono.Android/Android.Util/Log.cs",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "80418",
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "b07e75fc8a506b94690dbd06877da06c1228e40e7deda3967f6b882b842f726d": {
+      "signature": "b07e75fc8a506b94690dbd06877da06c1228e40e7deda3967f6b882b842f726d",
+      "alternativeSignatures": [],
+      "target": "src/Mono.Android/Android.Util/Log.cs",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "80418",
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "87d8313310c2dd42021844b95bdcb9121bf10036fea5b212b945e0732a456e5a": {
+      "signature": "87d8313310c2dd42021844b95bdcb9121bf10036fea5b212b945e0732a456e5a",
+      "alternativeSignatures": [],
+      "target": "src/Mono.Android/Android.Util/Log.cs",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "80418",
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "8e5400e0233c8d887ad48bd8a48e8a7be5a579f9eefad521419b6df0828bbfac": {
+      "signature": "8e5400e0233c8d887ad48bd8a48e8a7be5a579f9eefad521419b6df0828bbfac",
+      "alternativeSignatures": [],
+      "target": "src/Mono.Android/Android.Util/Log.cs",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "80418",
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "06af52be6b6f87455b1db2eb6e631e783f1dacaf607c9b5f34cdee669992c8b5": {
+      "signature": "06af52be6b6f87455b1db2eb6e631e783f1dacaf607c9b5f34cdee669992c8b5",
+      "alternativeSignatures": [],
+      "target": "src/Mono.Android/Android.Util/Log.cs",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "80418",
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "a2b4d032c59a9d1211d218c3cd550cf8febb369941d70284d07d03ebee855bc0": {
+      "signature": "a2b4d032c59a9d1211d218c3cd550cf8febb369941d70284d07d03ebee855bc0",
+      "alternativeSignatures": [],
+      "target": "src/monodroid/jni/logger.cc",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "79668",
+      "justification": "Reference to find first set bit function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "1c87b45a6044d205dc3f3562f349c238f7cabe22b4609da762df9dc44151e9fb": {
+      "signature": "1c87b45a6044d205dc3f3562f349c238f7cabe22b4609da762df9dc44151e9fb",
+      "alternativeSignatures": [],
+      "target": "src/monodroid/jni/logger.cc",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "79668",
+      "justification": "Reference to find first set bit function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "a6639098c4785509a4215c9e2fc10f82c06fce461915dc11a00227ddec558845": {
+      "signature": "a6639098c4785509a4215c9e2fc10f82c06fce461915dc11a00227ddec558845",
+      "alternativeSignatures": [],
+      "target": "src/monodroid/jni/logger.cc",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "79668",
+      "justification": "Reference to find first set bit function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "d6b3df0b1d35cb4acec6a954acc145c9ec22041cd463b94ff080682c65a9bd62": {
+      "signature": "d6b3df0b1d35cb4acec6a954acc145c9ec22041cd463b94ff080682c65a9bd62",
+      "alternativeSignatures": [],
+      "target": "src/monodroid/jni/logger.cc",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "79668",
+      "justification": "Reference to find first set bit function.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "b34b42aa41018376a31460c142f2ae910704725d9e9a4470f92b587df682369b": {
+      "signature": "b34b42aa41018376a31460c142f2ae910704725d9e9a4470f92b587df682369b",
+      "alternativeSignatures": [],
+      "target": "src/Xamarin.Android.Build.Tasks/Tasks/Aapt2.cs",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "80411",
+      "justification": "Reference to output from an external tool.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    },
+    "75474fa652dbbf8f96826100a5fe37ba686a032ca07d61ef68a79c8e4412c150": {
+      "signature": "75474fa652dbbf8f96826100a5fe37ba686a032ca07d61ef68a79c8e4412c150",
+      "alternativeSignatures": [],
+      "target": "src/Xamarin.Android.Build.Tasks/Linker/MonoDroid.Tuner/Linker.cs",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "79459",
+      "justification": "Reference to an external source file.",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "expirationDate": null,
+      "type": null
+    }
+  }
+}
diff --git a/build-tools/automation/guardian/tsaoptions-v2.json b/build-tools/automation/guardian/tsaoptions-v2.json
new file mode 100644
index 00000000000..21ad8c31a7d
--- /dev/null
+++ b/build-tools/automation/guardian/tsaoptions-v2.json
@@ -0,0 +1,11 @@
+{
+  "codebaseName": "xamarin.android_main",
+  "notificationAliases": [
+      "dotnet-android-eng@microsoft.com"
+  ],
+  "instanceUrl": "https://devdiv.visualstudio.com/",
+  "projectName": "DevDiv",
+  "areaPath": "DevDiv\\VS Client - Runtime SDKs\\Android",
+  "iterationPath": "DevDiv",
+  "allTools": true
+}
diff --git a/src/Xamarin.Android.Tools.Aidl/BindingDatabase.cs b/src/Xamarin.Android.Tools.Aidl/BindingDatabase.cs
index 0be93e2c2e0..ac4fd818a73 100644
--- a/src/Xamarin.Android.Tools.Aidl/BindingDatabase.cs
+++ b/src/Xamarin.Android.Tools.Aidl/BindingDatabase.cs
@@ -9,22 +9,22 @@ public class BindingDatabase
 	{
 		Dictionary<string,string> nsmap;
 		Dictionary<string,string> regs;
-		List<AssemblyDefinition> asses = new List<AssemblyDefinition> ();
+		List<AssemblyDefinition> assems = new List<AssemblyDefinition> ();
 		
 		public BindingDatabase (IEnumerable<string> assemblies, Func<string,AssemblyDefinition> resolveAssembly)
 		{
-			foreach (var assfile in assemblies) {
-				var ass = resolveAssembly (assfile);
-				if (ass == null)
+			foreach (var assemfile in assemblies) {
+				var assem = resolveAssembly (assemfile);
+				if (assem == null)
 					throw new InvalidOperationException ("Failed to resolve specified assembly");
-				asses.Add (ass);
+				assems.Add (assem);
 			}
 			Initialize (assemblies, resolveAssembly);
 		}
 		
-		public BindingDatabase (IEnumerable<AssemblyDefinition> asses)
+		public BindingDatabase (IEnumerable<AssemblyDefinition> assems)
 		{
-			this.asses.AddRange (asses);
+			this.assems.AddRange (assems);
 			Initialize (null, null);
 		}
 		
@@ -43,17 +43,17 @@ void Initialize (IEnumerable<string> assemblies, Func<string,AssemblyDefinition>
 			var r = new Dictionary<string,string> ();
 			regs = r;
 
-			foreach (var ass in asses) {
-				if (!ass.CustomAttributes.Any (a => a.AttributeType.FullName != "Android.Runtime.NamespaceMappingAttribute"))
+			foreach (var assem in assems) {
+				if (!assem.CustomAttributes.Any (a => a.AttributeType.FullName != "Android.Runtime.NamespaceMappingAttribute"))
 					continue; // irrelevant assembly.
-				foreach (var att in ass.CustomAttributes) {
+				foreach (var att in assem.CustomAttributes) {
 					if (att.AttributeType.FullName != "Android.Runtime.NamespaceMappingAttribute")
 						continue;
 					string java = (string) att.Properties.First (p => p.Name == "Java").Argument.Value;
 					string cs = (string) att.Properties.First (p => p.Name == "Managed").Argument.Value;
 					d [java] = cs;
 				}
-				foreach (var md in ass.Modules)
+				foreach (var md in assem.Modules)
 					foreach (var td in md.Types.Where (t => t.IsPublic || t.IsNestedPublic))
 						foreach (var att in td.CustomAttributes.Where (a => a.AttributeType.FullName == "Android.Runtime.RegisterAttribute"))
 							r [((string) att.ConstructorArguments [0].Value).Replace ('/', '.').Replace ('$', '.')] = td.FullName;

From de328fea4d2aadb90880d9fbde1714393028360d Mon Sep 17 00:00:00 2001
From: Peter Collins <pecolli@microsoft.com>
Date: Thu, 23 Feb 2023 17:20:35 -0500
Subject: [PATCH 4/9] Enable localized policheck

---
 build-tools/automation/azure-pipelines.yaml      | 16 +++++++++++++++-
 .../PoliCheck.Exclusions.xml}                    |  2 +-
 2 files changed, 16 insertions(+), 2 deletions(-)
 rename build-tools/automation/{guardian/PoliCheckExclusions.xml => policheck/PoliCheck.Exclusions.xml} (93%)

diff --git a/build-tools/automation/azure-pipelines.yaml b/build-tools/automation/azure-pipelines.yaml
index 3eac7fff86c..9b51f9b0817 100644
--- a/build-tools/automation/azure-pipelines.yaml
+++ b/build-tools/automation/azure-pipelines.yaml
@@ -1440,6 +1440,20 @@ stages:
   parameters:
     stageDependsOn: []
     credScanSuppressionFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\CredScanSuppressions.json
-    policheckExclusionFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\PoliCheckExclusions.xml
     sourceGdnSuppressionFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\source.gdnsuppress
     tsaConfigFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\tsaoptions-v2.json
+    policheckLocScanEnabled: true
+    policheckExclusionFilesFolder: $(Build.SourcesDirectory)\build-tools\automation\policheck
+    policheckChsScanFolder: $(Build.SourcesDirectory)\Localize\loc\zh-Hans
+    policheckChtScanFolder: $(Build.SourcesDirectory)\Localize\loc\zh-Hant
+    policheckCsyScanFolder: $(Build.SourcesDirectory)\Localize\loc\cs
+    policheckDeuScanFolder: $(Build.SourcesDirectory)\Localize\loc\de
+    policheckEsnScanFolder: $(Build.SourcesDirectory)\Localize\loc\es
+    policheckFraScanFolder: $(Build.SourcesDirectory)\Localize\loc\fr
+    policheckItaScanFolder: $(Build.SourcesDirectory)\Localize\loc\it
+    policheckJpnScanFolder: $(Build.SourcesDirectory)\Localize\loc\ja
+    policheckKorScanFolder: $(Build.SourcesDirectory)\Localize\loc\ko
+    policheckPlkScanFolder: $(Build.SourcesDirectory)\Localize\loc\pl
+    policheckPtbScanFolder: $(Build.SourcesDirectory)\Localize\loc\pt-BR
+    policheckRusScanFolder: $(Build.SourcesDirectory)\Localize\loc\ru
+    policheckTrkScanFolder: $(Build.SourcesDirectory)\Localize\loc\tr
diff --git a/build-tools/automation/guardian/PoliCheckExclusions.xml b/build-tools/automation/policheck/PoliCheck.Exclusions.xml
similarity index 93%
rename from build-tools/automation/guardian/PoliCheckExclusions.xml
rename to build-tools/automation/policheck/PoliCheck.Exclusions.xml
index cb29dc1f076..05ef7a09341 100644
--- a/build-tools/automation/guardian/PoliCheckExclusions.xml
+++ b/build-tools/automation/policheck/PoliCheck.Exclusions.xml
@@ -1,6 +1,6 @@
 <PoliCheckExclusions>
   <!-- Each of these exclusions is a folder name - if \[name]\ exists in the file path, it will be skipped -->
-  <Exclusion Type="FolderPathFull">LICENSE-DATA|NREFACTORY</Exclusion>
+  <Exclusion Type="FolderPathFull">LICENSE-DATA|NREFACTORY|LOCALIZE</Exclusion>
   <!-- Each of these exclusions is a folder name - if any folder or file starts with "\[name]", it will be skipped -->
   <!--<Exclusion Type="FolderPathStart">ABC|XYZ</Exclusion>-->
   <!-- Each of these file types will be completely skipped for the entire scan -->

From b4ef24645cb292ffc89f5c79b53d5075fd16ef6e Mon Sep 17 00:00:00 2001
From: Peter Collins <pecolli@microsoft.com>
Date: Thu, 23 Feb 2023 18:10:00 -0500
Subject: [PATCH 5/9] Bump


From 911a3a3553373dbc986a71984baee03aa1b00be4 Mon Sep 17 00:00:00 2001
From: Peter Collins <pecolli@microsoft.com>
Date: Thu, 23 Feb 2023 18:50:07 -0500
Subject: [PATCH 6/9] Move to gdn folder

---
 build-tools/automation/azure-pipelines.yaml                    | 3 ++-
 .../{policheck => guardian}/PoliCheck.Exclusions.xml           | 0
 2 files changed, 2 insertions(+), 1 deletion(-)
 rename build-tools/automation/{policheck => guardian}/PoliCheck.Exclusions.xml (100%)

diff --git a/build-tools/automation/azure-pipelines.yaml b/build-tools/automation/azure-pipelines.yaml
index 9b51f9b0817..23cdaa2c9f2 100644
--- a/build-tools/automation/azure-pipelines.yaml
+++ b/build-tools/automation/azure-pipelines.yaml
@@ -1443,7 +1443,8 @@ stages:
     sourceGdnSuppressionFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\source.gdnsuppress
     tsaConfigFile: $(Build.SourcesDirectory)\build-tools\automation\guardian\tsaoptions-v2.json
     policheckLocScanEnabled: true
-    policheckExclusionFilesFolder: $(Build.SourcesDirectory)\build-tools\automation\policheck
+    policheckExclusionFilesFolder: $(Build.SourcesDirectory)\build-tools\automation\guardian
+    policheckGdnSuppressionFilesFolder: $(Build.SourcesDirectory)\build-tools\automation\guardian
     policheckChsScanFolder: $(Build.SourcesDirectory)\Localize\loc\zh-Hans
     policheckChtScanFolder: $(Build.SourcesDirectory)\Localize\loc\zh-Hant
     policheckCsyScanFolder: $(Build.SourcesDirectory)\Localize\loc\cs
diff --git a/build-tools/automation/policheck/PoliCheck.Exclusions.xml b/build-tools/automation/guardian/PoliCheck.Exclusions.xml
similarity index 100%
rename from build-tools/automation/policheck/PoliCheck.Exclusions.xml
rename to build-tools/automation/guardian/PoliCheck.Exclusions.xml

From af37a5ed9009ad207a1185fe0d95f7d21cf59731 Mon Sep 17 00:00:00 2001
From: Peter Collins <pecolli@microsoft.com>
Date: Thu, 23 Feb 2023 19:28:49 -0500
Subject: [PATCH 7/9] Update exclusions

---
 .../automation/guardian/CHT.gdnsuppress       | 26 +++++++++++++++++++
 .../guardian/PoliCheck.Exclusions.xml         |  2 +-
 2 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 build-tools/automation/guardian/CHT.gdnsuppress

diff --git a/build-tools/automation/guardian/CHT.gdnsuppress b/build-tools/automation/guardian/CHT.gdnsuppress
new file mode 100644
index 00000000000..4396a9a378a
--- /dev/null
+++ b/build-tools/automation/guardian/CHT.gdnsuppress
@@ -0,0 +1,26 @@
+{
+  "version": "latest",
+  "suppressionSets": {
+    "default": {
+      "name": "default",
+      "createdDate": "2023-02-24 00:05:39Z",
+      "lastUpdatedDate": "2023-02-24 00:05:39Z"
+    }
+  },
+  "results": {
+    "04910d714a13bf4523ffa77350f654f52114fa4fa3d760c9f63186d41716c019": {
+      "signature": "04910d714a13bf4523ffa77350f654f52114fa4fa3d760c9f63186d41716c019",
+      "alternativeSignatures": [],
+      "target": "Localize/loc/zh-Hant/src/Xamarin.Android.Build.Tasks/Properties/Resources.resx.lcl",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "policheck",
+      "ruleId": "64550",
+      "justification": "Reference to the Android package format APK.",
+      "createdDate": "2023-02-24 00:05:39Z",
+      "expirationDate": null,
+      "type": null
+    }
+  }
+}
diff --git a/build-tools/automation/guardian/PoliCheck.Exclusions.xml b/build-tools/automation/guardian/PoliCheck.Exclusions.xml
index 05ef7a09341..3df47bb4a1a 100644
--- a/build-tools/automation/guardian/PoliCheck.Exclusions.xml
+++ b/build-tools/automation/guardian/PoliCheck.Exclusions.xml
@@ -6,7 +6,7 @@
   <!-- Each of these file types will be completely skipped for the entire scan -->
   <!--<Exclusion Type="FileType">.ABC|.XYZ</Exclusion>-->
   <!-- The specified file names will be skipped during the scan regardless which folder they are in -->
-  <Exclusion Type="FileName">REMAINING-INT-CONSTS.TXT|TAIWANCALENDAR.XML|XAMARIN-ANDROID-SDK-9.XML|SQLITE3.C|MAP.CSV|METHODMAP.EXT.CSV|EXTERNALWHITELIST.CSV|SYMBOLARCHIVEWHITELIST.CSV|POLICHECKEXCLUSIONS.xml
+  <Exclusion Type="FileName">REMAINING-INT-CONSTS.TXT|TAIWANCALENDAR.XML|XAMARIN-ANDROID-SDK-9.XML|SQLITE3.C|MAP.CSV|METHODMAP.EXT.CSV|EXTERNALWHITELIST.CSV|SYMBOLARCHIVEWHITELIST.CSV|POLICHECK.EXCLUSIONS.xml
 |API-10.PARAMS.TXT|API-15.PARAMS.TXT|API-16.PARAMS.TXT|API-17.PARAMS.TXT|API-18.PARAMS.TXT|API-19.PARAMS.TXT|API-20.PARAMS.TXT|API-21.PARAMS.TXT|API-22.PARAMS.TXT|API-23.PARAMS.TXT|API-24.PARAMS.TXT
 |API-25.PARAMS.TXT|API-26.PARAMS.TXT|API-27.PARAMS.TXT|API-28.PARAMS.TXT|API-29.PARAMS.TXT|API-30.PARAMS.TXT|API-31.PARAMS.TXT|API-32.PARAMS.TXT|API-33.PARAMS.TXT
   </Exclusion>

From f4697420440a6ccbf02e7b5d05507be47248ea02 Mon Sep 17 00:00:00 2001
From: Peter Collins <pecolli@microsoft.com>
Date: Thu, 23 Feb 2023 19:32:21 -0500
Subject: [PATCH 8/9] Test report publish on this branch

---
 build-tools/automation/azure-pipelines.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/build-tools/automation/azure-pipelines.yaml b/build-tools/automation/azure-pipelines.yaml
index 23cdaa2c9f2..b3328bc705c 100644
--- a/build-tools/automation/azure-pipelines.yaml
+++ b/build-tools/automation/azure-pipelines.yaml
@@ -1458,3 +1458,4 @@ stages:
     policheckPtbScanFolder: $(Build.SourcesDirectory)\Localize\loc\pt-BR
     policheckRusScanFolder: $(Build.SourcesDirectory)\Localize\loc\ru
     policheckTrkScanFolder: $(Build.SourcesDirectory)\Localize\loc\tr
+    tsaReportBranch: refs/heads/dev/pjc/cs-template

From 69ed7e79ae6ebd41f830578e0da72f6846af4b1a Mon Sep 17 00:00:00 2001
From: Peter Collins <pecolli@microsoft.com>
Date: Fri, 24 Feb 2023 13:54:21 -0500
Subject: [PATCH 9/9] Revert testing changes

---
 build-tools/automation/azure-pipelines.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/build-tools/automation/azure-pipelines.yaml b/build-tools/automation/azure-pipelines.yaml
index b3328bc705c..d1386873c5c 100644
--- a/build-tools/automation/azure-pipelines.yaml
+++ b/build-tools/automation/azure-pipelines.yaml
@@ -14,7 +14,7 @@ resources:
   - repository: yaml-templates
     type: github
     name: xamarin/yaml-templates
-    ref: refs/heads/dev/pjc/xa-sec-onboard
+    ref: refs/heads/main
     endpoint: xamarin
   - repository: sdk-insertions
     type: github
@@ -1458,4 +1458,3 @@ stages:
     policheckPtbScanFolder: $(Build.SourcesDirectory)\Localize\loc\pt-BR
     policheckRusScanFolder: $(Build.SourcesDirectory)\Localize\loc\ru
     policheckTrkScanFolder: $(Build.SourcesDirectory)\Localize\loc\tr
-    tsaReportBranch: refs/heads/dev/pjc/cs-template