From df9f2f9e9ad0797c4f708c9c8c6da382af7910f3 Mon Sep 17 00:00:00 2001
From: Bu Sun Kim <8822365+busunkim96@users.noreply.github.com>
Date: Tue, 20 Jul 2021 11:17:37 -0600
Subject: [PATCH 1/4] chore: update user credential secret (#806)

---
 system_tests/secrets.tar.enc | Bin 10323 -> 10323 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/system_tests/secrets.tar.enc b/system_tests/secrets.tar.enc
index e416918d4df6a2fc2c634d6db858c4f5b5d46729..46b521c76e638564dd51363cbd18eab0bfcbdaba 100644
GIT binary patch
literal 10323
zcmV-ZD6H2CBmnkJRTJl!*YfxbuEW1zD>bLxoDK9$u~I6H0@VR?;meb{lM<>>08szS
z09?(blqj~@!l&T&bs4`)loH(JNDg@h&3rXoJ{YnwlTx?X^`GyaCkM!w<jGu%lmWMj
zDe)u*ooCsC^f22eA9Eih!&&_86ey)vdQSGYRx+2{=!xfxBX$kr4L*Q@DxvDrouDg!
zpVum{n}?YvK#00@<ErjkQ?qiBouET?nGx|MA&3U|;e-G;Wdfsfr7QXxpHtHN3GQ>A
zmjADB{b*KTVLaZ*ic?<3abQX0d|kD=rGhv30@N+z#w_%vGjTaLhksH|xtxw~GI0Y^
zXvZN`=gZEc1%E{PW>&`e6wJTwKU-WrI00hQI%+oh=PE@dQ%4RDun-)XpzaAqTNit^
z7+S=cndQ~mN|<BD>IlH9@j{L_{a<Ss{2RcGwZQ&7WD?&X&pVrp%4G0@BXV_KQ6*n7
zpUtus*`tx|!S1nU1CxdqYw>c`#*C3CpH;cVt!A7^rTj3=fk;s;f0cHbuQoP<`cA9z
z>;;lUkAqq!)>>i-aAF$uDyp?WCwO0Z-T0yJ^>^qLy}^uXST&Q|3%~i1C3_3O-6!=i
z+NO5aqqS?yuxu^~jk4WCAH>p9>vn}Z`(J#u<x<!7p~x8-QO9QXctAND%W6Ynk7D(k
z->-}tt-0zkH&@?mk+*F8%6tD5-Nwl9=G5=G32Tkq_(QW(JZO5eI5Q->gz6VpM(|jm
zXHUD1#H^J3%2P0|7NG1DFxIun1aIoN;}(}Yy)vI^1o8V8V1CMAYSisOAdIUOTd%|Q
z{(Df#5=0^{Se`ueCvRC3>dYUS0nI30Q_PO$ffm!>_ue-TJQyMH?!9y9Zz>ThUzi@M
z;YW(M=+w*4@u^rjP};6rOfL@S)u9WR4s!9E=x!E`3QUmZFHlw$Oc1h_<=esxvaeCv
zG(DJVKh<&Tk%mjo=Dul$aLn2Db*rTcbfXN?vrk#6@6wX@l&8gS1sHU%CusShMw4eM
zdy@sXwn!mkg@YM)V@JVf!0@*(L#D$*XA4kCJOs1{&e)iBWoRQ{Q^n!iFTOkK#7$zY
z=v{1?pAzmMdW;u0qvomr@kH&rV#3dIX+)WprUWji56IK(5c<B-@&A;cL75sYD(S)Q
zRqH7n?-M=IK<5~sdAj7t)V2-4C?bXzDGzev6d3NpD>sCjZj<1W7u$Szp<{c<49Y2C
zro>6w_T28W5J*{^`#BREh1m}yljsEyDXW{T)K{Wd)stq0pp%&U$ZMY9cEI1~Zg*7>
z0mX4#WKKK;#dL1DN`~71S<>)n_tMK8`4-h4XrIet;s$-08^(=0bCb-OK;5FM60@Jp
zA1dcPr+7p5Yd>4N_=aXJAtqej8w`1r!pO(AO1*+!T2<yCMxJinKku^i^1)LlSGk5R
zg}0j~o{mqVk}D+gOu8qKMLL3Krl|-DJmt<Kfd!>|8rFw8Kkbh9^wj81j!0y-6;FC)
zdmO)Nl{MS#1Nmz_b1r^+4?yTr0yk_>>;OOjXSG2?x{5OqhA$E0)6r<5-9IHi0zw|@
zZO7SDE%s#!;f>;;HUKp-vcLtq0t#=%^sNzlVOm@Ir_|yi$0T0K#EADAZ-%+1eSjVq
z>{FJR()V(vT|}URvhIdI6aOd`*b%Pzg|nj}2Q@}zsuDAKZCxPooyoNayjcY~DgEq9
z3{*JSNf*8ebV>P0xP~I0SGDI@6wPM>7j(;D084)nq@!3xKTkGD$6Vbe`p-?j<^X?E
zHBC2y8EUc3wW>#qvr@K~t}(*39m2qY3C!BNxy|`0|HTu|CBT6VCdlOCu0#eyqg9GS
zH{XVr6vnG2eUhb#YLv~cvY{cD$&ht)a}XCB7tMtP+zfF{uuJtc?T~m3t0WZ*JP{Ow
z$&^|30S%Oju{enHC*lemEKF^9|BJ{x8B^p1)${KgzEtFNdNb)jiw{<W8;z^Dl;i+l
zhd3jQ+R@y0&xZ(448Iac)~ulJPJpXS?ao>K<Z}0{H>l@-x=faTU-1ZBmOfHBLn;G8
z!{7mAPnYtTRb_)r0=bx=^M63x(8#rO7cDSMUMaAypJm~9EcI+w8EI`NfXdJ^RFjT<
z9o&F2%tYde<Ti3JW4Sgqy*u7(viCZb+ekc~v=Xg)2@99xVVi}I^TEH2$8;6DVNqRn
zE+xehjG)t2LQU^Q|0Ip=V922=Ee`UbqFcaiPfsOYSSy86e}MlAreK(?9^z#{NK9F>
zg)*^Yo+iOlh7t&i{IudSkwfxpkHbkw$_#fLc)KqaoHG9i*jEl>{qX-WBgP`(CEzZ>
zeH?I3;gXqO*maTxF%a;4PLSK3#$a(FMK7<B&xT(s*9($yAO3FYoSb?vIuDqk%5IAO
zdJe0u>|Xtj76f|BJON0Q!`B$Z<4G<wN}I_mMDvTB7jU~2luHZck+2s(5!E-WCu$4V
ztsQe8Hg6cGLxC6|Pon~;y~(8*76pG{MM4s=%frK!=rfj5Q9<Z_)N^k9WT-F|g5SUK
zz?35!p5!8`R-NPqAyrJiXgv5&5ZhucjOm7cHz*Sti3d#n{l*F75*-AAvp_jAWB}SJ
zDr3w9LEHy8WE`h)#mNq@XoP^Y*#oiiE4};mbTbH|uZ7VBK(3Bh&P7%y^9HS>;zX7!
zf~-h8ce|-3)}e{Yp*uC$VysSdmtB7+|8ABcex?`#hQ|P}HR<wRs-oc56wOC@_g)z3
zOKRA&&e=Rr??cLjFO~+CVyg6V%lEYKP8&OJzuz)(5f&>IY5G=*%#pO6Kv@~71Uiqd
zsJvF_sfVVeBLu5;B~o(WB(pnR0d%|eo-TbTBb_MH9___oxhUk*ltro1)U>yB5M}Zv
z$j-jDn}ZC`c1N(dgDLO-@}W*iQtr#gQgla}w~PXrBmzFEZJ*WHAMHFsdMiYFDVS=}
z*Rlvmeb<C2O?9gQ@e~-YJWVD@OKP1iRAt-M8LY`Z>wrjJ9{822sXpiR#F0(P!-fWq
zeX`={Tq`o4&hl@u;L}N$LFP|)4Gy^MqWnF&i$3w@R3;X_H|F5`dW14fO`I6sye2#<
z@p<r4%mFGYKA!$m9k_Zp4K4fBc<}RP6Jyhb78lU?9TEg5f*DcKgH|QYUVyLGx_?B7
zZMm@md1MJ95!za9VeElS)zqg#>Sga2nC6BtC@vw;8dHJr!aXaXl0tp)_vOnJ%V6ss
zj*Zm%_W2|m&|cQN%zbyM(=crJGrkV0WT#J?cNU2-NEz*IdQ(HN;OvT%`w2*@x9D#6
z!sS?1u%Lrn(2a1F5K;<m;pv7NaKi5C^cCW38@As}ELcNkqC-3L<1mgUuvdgAFvH>k
zko<Sut<-2_%(y^YcMMsVs3){$Y_QCp`9f~MuT|lD;lKg0mN&ExOyq19tFbjWt+gfG
zK|<3KRyq{P5wJ=ni-Vb#f>*p?Rts5=M<!m>)uWxWvO*$$nmqSgkG&`#r&boIP*W0$
zR@o*(pRPueeZj7gy#T<`{`7q7%cNhZ@SDmMRfk+fqmXAow2><z=33kJsZW_M)^*Y2
ziB1KVVDDNLH4-))j<a;8|K&=HV_{-)oYjB|=jHg@{e1<V^##Lx(gg_#%Decc6w=y)
z4Q1smU&7s)KV(TCaOzm-Id8TASeWZjE5#LU^2CMW8cA0-A3$3Wc@K<bIHib9jYp7|
zgZh^f!g1jjzt)4sb-0kWzs2b)4FTfMFUPcy?Kk!X^9g{4Z5$itMh*!+r0z(ZYpfKE
z^dh8A4!p#eFi3SciOkgPgrBr2G_9I6eZqH{^mz{URuTe<v(u9Z0@DsG$W(f80)rOy
z^G_(Fo*!aO*LyW8Nxe}6iNNk8Xv})EQl3Nm3*J=XUKYYc;Q6qR_BIu;AJCj!53sdm
zY(}x57kd>I{p2&$C4At*y+};U6QDBB5Jmo7d{Kbk-`zZy$W5!YQ12t_ea&SOCmB)0
zkEe{7f?;Qh12>z%5TN*4UJ5$!z7_B!SYSKGrxnLv;16s;@Vx}rE5(S1put!#pnoWa
zkj?afYJYK+JU$S12{9u|2mmREd@!jcY4t%UOp1HE>#|#0qsjpa`?ojC`3!^Ea7q2l
zh6C!li|-NS!x^OafCZzQ-6bcJ_H7~1w`a=!^)BDmfPOS#7Mr0Rzy{zf)%}_Ghd9KM
zdngaGj9N`U@BAg3M-OB7!rg-@u&osk6njH$s%f(+6e{)<q^b*1Q7zAC5P*-9)`4eJ
z#$%f9C)V8uNC~HhE+>C(<d31r<+7_7i2(0!9P(pTjCh1QJmdO}J$%~uKi_036G#oZ
zlT)i-X-;zoj1H95Ob~x#iHaQJzl6vu;YUtl(ThDaqYn^C(7IjtJWRa^C;Maqw`m=f
zM8ic?<zF!E9)l=;^Z0J@W$-{I5Mu!TcYA)-5n?<MPxEL1Sinym^4*tHt~rc6uBz(+
ze9Gh|sZ)>;2K1FfeX6I${k+IZAIEwMW2iuo5%fkH+lVG7i<HMdm&tE$5xNPwy8C?y
z{5&f%gW(S`-!5hv`fSC8gy{c!TR*^M&)$gCRD=eNgY0t?D|+Rke>2-4X>GTf<STiP
zLwhM&I##Vw;zGBN>DSz=r~L`Uah(tDe0|qg_}|RIhtOI8Cw+1NWpdhu#6ui3ItYf5
z2*?73W5$|TaA>Jcr>i#nQ}O5D6cZrbKz#*TvEtmgc=q)UF;_%y2OM~fRA1!bpwX#!
z^ZXEnh|9ln!Ye;>*ZN~dnIX+XiM$52IZuRBl!E@I8}WmLsHPS!o4@yJ7bIhdaQ|6u
zB!<JPi^I9C<A-qm$pJ&(o@|WF5QnSXCpeEct=HC|7;R63M9@}(%??0<D5e`&j*Br_
zEDIUoz#qem-!(T`y`5g|HJbpV*ObN2$Hom*TD8>waHl+H1;Eu&t4Z%Rhp2Du{XZj>
z9f=~NK!dyHVv?RR1XgwS27kH0MP39ic^f6}d0gu8d=B*j){1+}BTfrNdeiGw`=H+;
z=-~@$q!YOS>sZRsr}AY&R)70m&`^AIthy@R%42esb0*@DeZtXk39-x$A|R)Q@Qvm)
z{;>YnOV=y!)z0SR-LSOB*5*q{580<?meodOyX+Fb{dcGGo&cmy#%Vqs4GZE#_(ii8
z4|W=GgikCXpAzrKa&R|}ST{(YWlqSwmTqL}SMPy!%TZt-a$Y)`u0vdGvemZltFd(~
z%sK>;0A)o9d^zxda=wIJT3{$Gip~&Ufv#ys5gJuRUnaQ$oFdX3wDHy7vLcSZL}M#c
zmD&Y<9(TUK?nfKd#xHAGE@F*T4o&v3R5rA1=$7K<`^Lthl16~Mm>%{M3{Ij;fHh1g
zXLZ(9XkN)tt9@A6)#+K0$1vr=8J2e?-+;zZD;VV@v+z%&2TQ}d+*#-}da*>4t8CN<
z{+GZMEyT|<4MuEU`E|64I6M=CQfNeCXZ(~ks+p5RkO6PztW7+Hd+@`o;*Q&z{%m)B
zZF|Tj)+Lb|d$<P}BA)$8K1@8ytN4KYU=TafX?7KSW{cwopYJA$QGAyUeZs64a}RSe
ztkBXLtmY5>d(R?bza+YOi4-}E`nL)lQe^mIin0Pu`t7mtzR1ZA9NMQ?tzUgT$jly*
zs&!nfbQ_#ck;TE>=?GwhjtZ<h=X&w4$Duy2oe2CE@M-a^^Go;9rbYt(U<EK`tfHj`
zK_;4)M18SR-P9x;8oStMj5zWn;gyqVpO#H-Q22eu&)l#4|JUzQqzIefWC=f!_cc-O
zR6$NcX2mD?-iXzKFEjDE{4=qZKtvLB`i~tx1$3tyyEanW2c5_c$>C@u9#*0Zht_ah
zltg<zIf}$*<23A{)@p|f!<n{=y?We6;7>tQU?dVj59OWZf6M&N4>`k@g@}{-n^k$F
zv&=J>k<*}$yHG(a*ItLP{3Mk;zYs4EHE>I=FTfl0!)gmO2I1LC29I;Yj{dOpln>@_
zF~5f%`Mnm6G0dSj<qe!>1HGyBFXZ5J5|pv+!X(%M?s?A=qH;90kT%`%z~7!vppvpQ
zH`z$I>g_u|LcLN^nHDGyicoFYpVYlcl`u!n-njt3nwT5&21!hyx_0ZZHbo3Bzo@fn
zjJ+nD^K82D=Eq4B&YXN*WjANM$yd9K9#Z(!6Y)rB%Y;D&pul9%x*ePX66u$Pn>L<C
z_5;kEN=cS`>@1?=)FwGG(McRw(4iy3Nf@9;r5>xE@vbbm_v<I#QSdU1068`$sik&N
z_f|arbizwOac;7{S*GPb^sb;4{~`=b`QJCGG>fzRh!g|xG38yTpQa`&gM7M0^}vRU
z##nA(*DEN;0J*EOOu^e!u68UUkTsOUiKKBn8>&aZqoV61UH%Yj++whW)#htP(eL4E
z_jlqpyO1~Ln2CBYuLAvoiBkD*p>_NA#uN8;piHkR09v0Qc^&5mmVGs6-jFG!`ky_t
zbO;)Qpgj!1X6aLW>=N*sEI0pb(&?+-lRdzYiz!)Gt;#8NJU`XwM|kdvnl?86GrBox
z(mUM5V?CF<pN;sn6-#w5yl*CMh6rw^^DGA+_7g^_DHt^<cg4nnrY(8=L+aPOm_$Bb
zD4JT4m6%w*>v(Hr)4NBhsoGZ9%&;Mb(X2Jz|2vw>_y~LMrBA%N6@2FP&1VS0ojw8o
z2&&KX`R3s(=Us($yNVcTIe62Xqm<}1xiS;noH1haDccW5E<OF~g$sarF4&TT`A-d1
z7tzI*U5MY`A`%Zky`;0<GsJX~4Uu_ksMwt=Xjr7Gzh<VZwV!4Wm!kDm#uo5*m|N?s
z`J&1w0pYLYhbd7lS@<`9wo(>-p)O{Sc+ovcK-qy-e&*P@j}h8kk@U;q@(L;IjPLcd
zzMZA{iK*!TWcJ&IXz-g9)hNbR^tkv;#d7(;;21yOk+vE>n9ql<HX^Pizg4rNRc5dN
zSonltdqNu(4n*DE5zJJ==PtJ+%2?4rD7lsW6TO1dyyr`;G}PIy`Ca3;JE9GYMK#o+
zt_k;QGeR5*>S&1h^2Ui{M|y$ynFFO9&TMQll0(U6*I-J}(7oJ)eCeDBbL^5oYU{4}
zZAh(Cc!>Yyr4HN~eZ$rJ3xuq<<RyKtz#}YNA4C!k64>MVnS)5anU#w&j1(|Q%nG)Y
zDnc)@F(Rd<P7g7up|}onGB!c0!}stAGk}PLyUUC)h{dbO@zJ*DH;Q|gMM?%KkjpuZ
zl$WOZuz*|e=`WK<IGCzoSDAY|S$<0;vS{|h3nG{Q3PZC?01bD?$1O@?K>B22G$(*h
za}__=TDLi)mWA9WM#n%Iz=NG=DPgQx`l)cYk1{bZ`Mbx#-IwCM<0@o21rk#8_*V?_
zV3ji-=zCsZ$($`$?za@6+OSY$P<>3!Sdlj%s>PBdD=DDAV&>mI;aB`Z{s#)?Nm1!3
zJ*_XysjW`rX0%v%s}RweK@nee;*|PIJe<;OSK2Q#@{1c#pqx1qh9PLWyXnqN=lEs+
zO(Y;pDXgC<F#@P)6%bE8x~nSfKqlan{@w=V?n3v=_zdz}Yr<#zFPS>FHSoUgXmq9u
zmUrP2cab0AS^EVY(czKMdr_l0Vs;vX`fWMUJ@iz5iKjtY$0%>*<-fJo>)WTI9Wdfh
zXYtc2xaH$a8^gSmV4<tqy!zOEYn!PyYT~ht<mhnNkRxeKjPs(V@*t*F7Z4KYl+j1G
zMUYZuE^RWS7%cIP&n$&oD)R;0LRaNoEc|0+{Y4CVK+61AQQ2+ph_<g3`|_hEI-?Ar
zS^3v;f?r6cPmLrM{GqzJVJ@F+qhl=w&p<)j=7av5B#kW&7&4=%cHiN1o_I>L52o^#
z-?Q5+>oZjR--;nxos*4_{#dnG*?XNGp9xbK<XRY>%$O6~|7fK+1|j30bo`Q`4y>2r
z6Cl2`sjZJk)i61ZdHkr3s^l~xT|I+pnLvPcX0aAfAiq{*iu>|JBMy@>WQ3Rdz;8!1
z1dxB8V3)H{B`!QIaItqtM@mnl$&8QtJENOwchR$8RHky?sDX$}mCV-m0+;?{)>$~v
z)vFG8`TDnl{`nO`^wCl`yODdsXr+$MqylzwbvhHrBIC9ff|wyM|Bu3s6=Nk{#qGpb
z)04t$uI7fDRSUwPwxbJF%cQF9Gy>HC9kB&gSiSRqL}c4@v72tCyc1RRyzLr=6slvn
zYv}zD2VkQ7J3Cm58eer5NMEEu?$ldv$}GqgQ{+v`tIKQca{xMRfX<8yfHk5EKT(F&
z9ajuomSLG<6`)h>`>-&!Ju(TT>lIyobHv$<iX;?)5wOoBi+a%9**7QLP_nF;f6y4#
zg(|b(+_m0{cQO$6<Xf{@4zGOk*~)_g)a*Gfft41X+74l5|IgO+6=4P{m)uiRiO~l0
zhfJAJm#qfVT!4EpBWkcuDAiOci;HXz!fK>d&^FH6uao@nRzRw%#1bZLHqV;gNEnBO
z^sG1V@u0e~$N4q-B>_O*IPds-?WIJxSj2RbpA50X&%p*>L87Uf9RvfK$B}B3zKp?{
zY1Y2Fo#`Nx3Fn$Ld@@BBa{3OiW{$oEDbb;-w(1L}p9>d>T4am&?5deYDWuVK@ZCrG
zXS0wbgxos6Q#6`p9EbYUx`V&&Q;CPaNE_j|$vG345RhxZrE9@phj7%)h?cgD>ZcSx
z3nOeZ|HwV!2KzF^k(GAzpML7x{lR#1=?G{j4eX8k9Ys1D8c)dc3sQ-T1KUQ<qapX~
zs^$AP48ese8>E@+=Fiq)OC(pK`+^6K*n}AJFw0L^e>__l9P7*DFgzh6;^09k!H4j<
z_qQ%$kXRb+_=!ty(Xe2uky%lIY_*jpv(?gjMlYzuZ1IUi$wh!NHKkA!nB&J<U@fCc
zW~Sf$T@(i1BMJ)rEWxM`5XNGLp#p&(S~oo!^G1etN1mLSF4d>Ip0UBk;En3HH{xIs
z(gt|$lLNfB1HDxUF6=A@0vPF%+bX(Z&4+!_MMZR^AJ9XX%rmmW8bJ(O`xv~q84_TZ
z)Tmql_uLw}ZBflD^X*Vj-$eV>S%C+;#9Jc~66wivp1^8T(Vh`t(j*32A^RZLGG7->
zdb+8tvo!rjA2H(et}j=NbCMx)<BpW4ug;~KOw2>~SzpZv!k1jKP_&n!(zjjtcWs`A
z=LHord6RlLiuL0OD{D*0u0okShg4ZGo%f~rqcfGAlkrR4Knp3}s0$TgWn5}5phfM_
zx=7<0z9&drKw@;B8?hwi(+syaikRY5Is83Jhzy2`y>#!(_78qDq|ZRbj|goeC`Wt4
z6g4L1=LZD=K26yGJAx*sfc<Szu1E+oCoq|OF+tb<VU}RW6dFKh2W=^cy`e}x8-?pW
zP1NH2*YL0T>b{+CoEFjsGu#Zs(d2W;R)o=QirBC08KRs(WJrj3`RmO5f-kz*M3}d#
zJAV65&aTf56x2DVY>!b9j{&NiJ#SKHn=9DzNAz`LtpDY3XLiYP+AeS=OJS?Y;872M
zc?=`u5A6!^3d#HYZsn1Ef%ky*nus)_ZppGko4H`6Kpq?oR;h?<qs2PA-cQsKk>No}
zl%<s2@8b3ngx-K0EUnMJT8kgY;Jpo0HP!%9FqoK&S6bu{3~5K=8~*ASMNS94vHC0g
zQc(SGack9#JOfRzIwij$j86>{DFD&#06LTi^JXUK+6XBT|HG|8q!}W{7)t7f4>uiW
zXgGuJ5v{heCtHUiMPwQ$ydo$3D`BuE;Jw42h!^s?wR0<X2A%GBqloR%p18vOU<+r(
zgS{FT+Q+t55e&0&yS@A_Vc4R<1EWs*rKi@mgwwHII?l5>Lx=DMi{%IKtmgicmM%s6
zyI4j3t=IE34KYgdE$w1}U=Quxw_9QET!%a3oh06pj<|C^NQZHZGPDNvPS}OG#bE)3
zU1e~I2u4oJ3@f*g^>;Y)x%jDXn<<Kf>TDAk^Fypcdn_t>6Va&q22>Q4{&7Ad9HGu7
zUBbV4aY&sSK=M2y9gYJ9KN7&JT*~11tM>u}A&_JrCNO8Zj9~;qgXw+$&XBW}y#r57
zYmnyK9LM7CR3%}hmo?;4URcRp$`DgOi;k>6N0!)phDadm2^)rf&KBJ+JHF(^8INQX
zmTHtc(KRmE^U9VOaiPA|fiJj7a+60lMVM;`>}XgJ+Izg)ug>za4BmJbZFam2`gaZT
zuU&+EiXY3jo5Cq9r5yqYm{HbEe*PRsGyhE7qRKH%$$PWqt1`ZPo=5GBda!AOn*q$t
zL+!x9#RoIWR~fkQ(EqBB0%Abxks*~kY*Cl7!CQ%i+9M!0L}`O3XiUP8yy?y$eThUn
z8Vrl%Jf;;{4#({Atg@3){+uW4@p`8AG#cBa5pj0&EolaT+p=Z_XcW>2SoU-qVr>;n
zGA1MB?zs4Y+xSCcxGJRyRU1x%Fg?oPlvUc}x?hucQ4FJg#>8%DK2{?mV)<{isrtfK
z<`uzK1)Y`}r*dM$Sudw)o@X&q%U6%zB6iPr$pLX79WcEmGu|XF4RLgRi)@K2C5&S*
zM8uMDKsXok*Ns}EypFbOraYEq;zY55q%u24BtopRI4fnVM_}x(+5l5rM9DXyHrkuB
z%?2?K5cTCTiH|^h;bfbL(s`LX=t@np{qrd7ke{~bF?7$ytS$2Q5mD!r;b%0Zr3BvM
z6}Za6x%aQf%QJ(miYs@%-RYjjacQf7B6#koi?8wX!DXx>54alnAmc{JP4`Z9_~$l|
zt6g8erY(ct^djZ{=K>zsA>SC1)0YWKPUoA<(|d5FrmP{+X@@k12TCxpc&fpu**EY`
zlEs%@Tv0}mZF44R+31fkPtb(}_d=qY2t;hQ$L^7qv|m~$5&e{S82ead8Nrv;E$hHR
z;REgGrB=nu0uFoZcfV#w=1Ba5WPuNS)I+wV1M&|D$dUV~uV?esdtV*UvVaO6?ln@p
zsIw*Su_X$=ohHTd8d_uIU=5|v;2m28hWr3SS>E3VpWCiFV4}DJ&a+}GDSHNG{c2I@
zUDryE(gAoxe?l6=Z^U`K@r8YLoU!&2jId=DrdCe;k*xOZng)HNTnpiQ6iKs_WzK4M
z>!S3aS{~_IO?>Fq)#^b^5q%$U@({mN<;oy_{PxOdpZc|c<mR*=$%h6SNG#EKzf!!v
zt{hjd@-O?x+bVxyX#^MR?t;J%`v<yaG*>rLY8_Ob;fupo11+ApI2Cp>yxH#Wwz+|U
zvYwvtyINgC0R0pNR}xpAb6aEO!~g_ztZ;K%OOq$i;f~8wXBdKS`B;ir^IAw?WHll@
zOn;-oq@tN+g6PL;Q%9viIGdP@i6{gpz!7VgbZr&iQAOGsvW)qcJwOf8*p1n(EueRq
zXHwb<O{oA?rXYyHkqI2{lBtEgS|-9MtY6FE>}5eO9?@R&Jlp0pPrYWR_EaaKlPtUo
zPABEeg4RqQT@7M)F2ibMx_srkZHNELq5N+eq0rE9boU95^k~$iXnq^gSu93W(9<@%
z{^|Qyr@if3@*ubLS`8F#dl>Ji6lIe}<5hIMLG$%PA*(V4xS<pqlfH$k-`vL?4A0rP
zZ6sh{&VbPd^7vxXZk%#7U>@-4<69lJ9$M$kFcV(r-W#Cy#%7?hviHW#V2Wx`=rGe&
z@G#~#UQfJGP~8FTw>5kjZZn>Hcj}7$uBju%bld~Q*C30Y6T8AtKM*&zemFPm6%6|w
z!*RsY-Uz;=b)|_J3NJjS;v`w%XyB)*L1aiBS`ZS9%0dC@!lFTxP%I0vbIDY0>c|&M
z3RDS!pt2c$cB&<Ppz6+Ed-Q{cpwGhPBJM79c4~@`R$p?PpEwMffs>Ddx~q`Hh|>3K
z-<`T;R$FL5sgtWg8ermB_{VPqBE;RV8Z0K}h>V3D{DRhp^kcJ{eDmsf^}9@dOJm<{
zbHk4tUAi}%!d9MD&GJ)!hTr?M9jzr{9}AnZ4rs|+>Zs`Gq!1LNhdH=~g>|!CMIvS_
z`pU)XLbX7FCID>g%?QIL!i(gO>qAAuTEbH3Qs|af!*_}Xw!5@`Ha0<}6uQ*SE|p}O
zY~~k6<?kBHt8huJOkecK)_%iKH2~hW*qmYslZ(kB{Uks2+nni^G@0*apD9BQ%LYdR
zgB+REk2@I;OPM&bZ;5=5d#G9}H!?D^XY-G7YHi}OMYZl8*d;=yW*pJzseit_FC0sN
zc%6YRh*{@F%Rf>|Oiv4z1=|l^qe}W=iB9oEs+3l*vEM&q8PFymu99Xz5h>97cfprX
zn2u}(fw_C0`Z=&$q!^d5c+}4<fQrGGKJ*+Vd@yq{D#s=$`W=phV@g`5&`Pcpc1s~R
z)M|wMpPI?Nl7C`>hkq;CO7y2jw(SsuA295lZUr(C;_xAv(z|7KO_1CCqc5Z~lY<&v
zNG{;4I;swG(x1%3Ca<*KC)*&<vf<vrOb|NWt<BsAm@>WwCq^B9$%GVLo_vm6@LdaK
zWyw6OeB|2YDBo9{1qNOJpy7WUJPXoJK_xw+I{Nj!3zo15?@7pR6Mc!f7^G@ff3U~3
zjAAm(FXJux#&pQzIE9>hy~>aLHf|yy%x|kuT?Rl%YOPNR#~j99tkF9uF^$D6b_+(f
z%wx($38@2eX6ZxO*YDlQHt^5)iQB@LiCF-9TOnu-SDX_<@8(PG{CPDo?<2=@SBO&p
zfIBqJ6wvX$Oh=-F@9#=3j>#!9{M);0veHZEwH#z)1^>pykqc1@AM)9v+|)7~zXS(Z
ztQx_$Ifa6)!rV%0^1q0vjwz`mZBkeugz2Pgu7amqwLvH#omOGyMdtuF?AEh?5(SZR
ztf19vEk0Dq{;}|YYdWaS_ruIal<sH19;g!Ls}WP>FNdQDzxYMNu5Eph*nPNec}7t4
zniD!4MjI;AQQU;O56<v$vFFK~4nb1xdNLl!s4%uz8l_dN7c!)0RqMr4Z=TOcsiPPr
z{*aNsr#&n8Vv}aabmYld$b#G23H_W0SH#+t3y44=H{=0p_c*L@XOWy^c)Hyd3)P-_
zFn+D~S%!i&z(BqLCg~ZQ5U+g=d3cwa2Ko?gs>Hz=!TdX3sDN+q3%bc#RPcF^I76P&
z^Tq}prxfQVWfw=g&`I}!A?kNyuN9~uGX<wKjY5M|O2CZWl=9;lYld!j9K1A#6Ujy^
zs>gTmp*v4s_u|VQ`Zjju4<P*9UQdYRAL1Tfn0>6zrCv1DR5)dm`@%9MPkpu8hItpd
z{E)-r@QN7amqq`^Uv>EP^~~W5Qk;Gv_(#M|a(%g4q<D<Va18ou2X0yi_eB|;D<uMf
z>yGj&VJIi*FFi&B0L>pTr##VnBCUYH^`=r4up>QsUOVlQ#xE8t7r-T=vw^VMdbBVA
zSMV(8i4vs`vSABA+P_wR>M)Z%a?jPy-GL&T&m5BnhFb56xN}oGr0g-fMKBBCwqh+Q
z<Tx;Utn;X)14snu5KMFkpOE>Bf2;CsF?L4_2q#{3IGF$beO$0o|J0(B#AYt;ey=s)
zFqS*L0UXL8`LZj*LBJ*E)nUouhD_K|J>&x6tC%s&=GRU-QX+MLySY0joFdrq7<JLf
zROqubHN)kD0-+@PweR6Yz0A(R@ce~)`>`B+WGDD*J2BJM-T-3t&T3^s9&#cv{&{o~
lqGA=6@OO9$x0frCsrY;06Wm1OFh|e@tdfgVBS0uWv<palIgkJV

literal 10323
zcmV-ZD6H2CBmnkJRTCXOSZfn&3}lDY57;Kk3psrUae*(+uqs%BHrQ}HbP}pi08szS
z050f%$RB@m>qGkFCql?un@p0)B1A9oW_?Y@Y(fhCgqn8#ME<h!bYJ5dD^R~H81sd*
z0&{p+N8Sd<vUw>9d?jt;%Yz?xez&JAnL?pra}Ns46@5Z%6D!>!SlpaOp;5t2=tR~@
zFZDmsY39J_JVD1qzR<T!1OzC^m5u~!r+-u4m)msBbULgT<?Y17U={kOl~H>vp&4MS
zA~!gNSc+mKI}Gb^r$R`nc)FvEo*zBDj_~2l<xZgev?p$+|A32TPXcVJ7W7QWE#%#Q
z<dF`j4fYW&pGg4CIH-9w)p(n+ZOumNM9=5bYpF3Yq)M;Gqlhyh#ewVym|$9+V46EF
zRHZK4Wy~f?1FIRVt&CW*8_GxyJ_pb}fD;H&E$mVk;3V4;zM@vYOmOB8$`uhIaam)o
zn8tXrdAQeZKo5EJKIlrk(6a}_Hvr+twh)6IeqMp`)3+fb24iXZ>WqP_Rq9Q)hTm5m
zu88Gtwr8KVV<p?CMNh67xVyk!Agh(|M+R)JOc)wA#mBg2C!su-Qx6yM&Lx$5Nd~aM
ziX6#g@n`ty;t?YNAc0iMp!4oJ0{@watE~#s!W^htTUD|tv_pS`Z4RAkdq5yzoqunO
z2U~$#ZMf7r#;@tw`Zxe8j$we{CO<0i`(Kr0GW?-pA9;5<#kW|*%sEU)nDRFte&3QT
zy(DUFe|^=2M>7*WASvtd)=zQe!fyCJlEMpr7}<1G^fr-z_6*vRsL-ww?&oOh4V=pW
zMym_iZ%xOHIR}tJm2tTt-ODTpiGKK#-ax|JoS=)_PL3d#G<}xI<ws7e|6`JzZ!&7n
z!vlRtVnyz!NhWre5CjW}h*v&Qd{?dEt6jqqQvzQk$J?wbRr!cVO8)eR=5uE{0;1t<
zDpM3>H+gwCS~LkQe{?XV(6jQW2QnzW%^+p{&Gp=1m0uSIzoC?~(MQLM%ng|}^{H^g
z^6VMJfN-JjYqLdG5zI*(;dt`~1Dzsu5IVwvLnZA%6UbP<#)OQd_&GewrI-u`FW(Yp
z;1iiy-P5526S)=x1L>c=oE^m^b~pN)b_Vf%^{Tk8A6z}Ok!8q)xHWT{mZ96^bhSS<
z$ToXbc>*9ExxvadIrU;|)Rx4UrZvgThs%HYl2&?=o2Hn#-P0?sVT3X{*q9x<(=I>1
zI$Zc2u~ppxZzJB2mPSUrdWhgN)J2h*Dt@(z#kCdZBmxNF2yRLYQQD}%MeJKO%}QR1
zSQb9GEBwSV=0ZtONUF;=^!grHPNr$ll9BB#QK*L`dX95E_@kUsSG7?-)N8@~{6$sJ
z0yhvx9(HdbO>_OYus9*`x$|oo9B_;Z6b>GGMalPHrg8g7s_XUv3y%AVmoO`fTv16l
zt%Y=fxQ4gJd(X{1a(K{QJQ+Pj8(#Yp@giwnuhu*G$YHm*YY~k|v>aDJTiHdFJSn%7
zA-GX1v~`PZ*6L;yF+66-)w^7A+f!(vD?A2jy2@Cssgk_2h2pW!xv@0p=4HI0T48ir
zP+BU*9jnxB+$#-~Yho-ED6d|Ly_+Q=l^Ok?zU>aumNsNL$HW1p5SUqUbkJe;HCVfq
zV)(<#<uY4a{{~c#%a&|bhGqUnoXj|fBK5ZTv~9~VYl>P7Iu_rZ-WLP)s}q*Y8*|~@
zPvf9Mcq~xjggtW|DYr%Jp90dBRLgm_N(BZTUSOK`r%wi^qm$d$ikRnv6i{Yokl2o2
zcy<}Y8LKmiKH{m0VzbNiQ#OgXC(i*7B-a!}%F>#jXz1v*=|UUj>Ujuzd2C1#@RDb|
ziITkIpsLA&1ztz=q{tHL*a}&psBpO})eia3sNJYS(f$vEgsxYbs#8{<9SO`4O|ODx
z^0vG9E9^_bywBVX)jJ}eGfaLP2RYLi_^U<H>>$(2=_A|X;WfzfC$THtI*}|fGf_cE
z<}=+7NG;rH)7z@*bqk2a`_wl_>L>hVk5#0>Z>SI_<j=5$n-s(gA9TT4hj!Djvw5^+
zKC+Ymi}mH;9ok>s9Wh{d0W3BGP&hiI*6FYb5{E{`PFF5e(UO1d#>3zA4TEwZV)xTF
z<xLWt>pc{b2|b^YFy&UcYjcSoyUEa~LKE=*>8Drg{>>W2ewTBtq0-fh3x7_<c%;P#
zH=#zlU-8v65i-#bE*~6O)5iN;rLtBK&A|fhLRwVY|0pv<Jba}vQimIHF2jsaW?JNf
zJQ~==e;*wdv*ep4JBIp!ax)X!)Qgo94o50WIN%5m*sMpB=zo3_KThS>%E|xA<K&#Q
zSg%Ibu~$=7a@IfBU3`Fm*30#^Qyi<{u>&ooz#TxS0RmSJ$(`O=Y9j>m&VaISO9@nX
z0yl-qVqPpVCHDLH&imLB0rSv`u`02QVNX!@RT=Chq?D~cCXrz{g28|U4CbrqmKYjO
zrXRNiteG-S;fjj|#hRt63IVI%j@}(w?mWDLUC>UWww=lfm`ZA(nlGIaex*@mZOr4q
z9=HNa{}E0+@XHMmh4MbkdTtF<v@r55AujmnGgPz9N8dN8EVR*+YwiqT`O7mVa0&f2
z!7(2g`aMDAB+sPNmClS%p;R#No8dxmR-`qWEEf(k^j5$`PXu24%=@|Xf@hlA=lL{x
z;qCBG?aUR#K6MHL)<pA@#_V#89;6st1RxY2D|1Or8lzby?A}x+IZ#FP3~heO2vU3c
zq^=~P!#`g_Sqtkx7n5B)o}^#l?C*?=Jlab3qn8f6mYA-S4yDMLp2FW31B>L`;Ky*R
z`y9`%-#N8!N~t*#azlf<EGn3GA~iPmo9&uX&A*?M+<Eh9^EZKpX#;h$3VYm+C24!b
z#=gNyeq;=IC}a({wyH?*1)x9%@16PN6_UN)pPERGtz%AANkXIPkF2r_y-K)ib%9^J
z-~q^frakw&7pWEd0N!3?L(^VMg7A<?N^ysHM#_>-xI3kTKxT~7vDL`X>Yw{yDaZX^
z+{|lCV0_Y?L#uTB$NUeoW@aRYO5vh}cC;_EE1S$HI_+p9TxY+#+Gd8vJ1=`ti|;`?
zGdFyV^6{^_v@U(kNg8kCz}x6>bTpw$GE?gDq3h8nCB0VS_diuwb$Nv}gCO@(aPUX^
zoce|P@q(_DrZ84QB8U#7jLBHp?Y2k8nO5UtG5F5gdcRO{Vll7sT*6mjhrHNHD?XtS
z+8&8)Zauk-GsvTylM@zEkD+LU0_IPLOexHo(2&C>5Q<%+elXWpv6bjGAF&6sw*@g4
z$??bK>kE~?8Ej4&7jYNt3?rM_=Do{)+EcEWNI!#{z_DFZ@}3d7ipeP-Hz2mnvP?n$
z$PnwQUYVSlvwE($UKMiJ<h|PVqLR;)ctW=&ru*oL?e3pVUqLZ!{~6$j8u}#)-p#T4
zy~%FA_l$+yM)T^84&cLO7^C1w`uib}9pf)mzP>wM@3IG<Yof@_&0I>2o9-^J$KA60
z8R`-=G!ro%5vM7%OL#hEX&~F0iRZMlY-mQ6)JHW-M^VLL&ST)bcl<Ql2JA128F`<}
zUXd=#r|JPn-*}$lJ<Py~w$G`rtLnHW#Yho`6AY?^%i*Z|W6Si=b-i0dg>h25g9rH(
zj@}4l@8L6G^(ZCFQ9=Zpn0HORI_d)h!MEo`Iiis#al&>?dFLSVY{15^G@i6tcvyOu
zs+E^ezM#dMP`ZC7zWNR}%j{AI+(A+foVE;w?k&u`uI8{ZGZeMNN8;i6B^mS~6lPAN
zC^w?;OaiABZj5NM?yJ63K^r!d$TS9x3!ybcquyV(YRH<?NEoUjpJnW#Lc?{uQeVX0
zWKgz>{b<bf%m-X;yrUI}#OXPi4+z%1cUF(L8d>?fmFB`@Cu7P8EgP|-?^R}Ic=XJ0
zl~ebzh_B7*DKs2|mq3=QcTfzYwbbnpF3=-|(_6OwI!RX9oC%Q|Va0pKukBz~;2o}w
z+B@p-HFWV9uN|eZDGwyaNim>>Rc&nwY0^UZ4u;T+p_%0DW#ey5r0090R#F>~_7N+J
zu#?>pDz%~{jpT()7ck3nW#0G-4s2JFZPDH$34evyx8uf?mkUepHv|-Pl-j9OR}L7Z
zEIYI2oy%Aqybpgti%2`&8(V3FY?d+Y)Bb@WVBcGJ^&i=d43nJbZ|uIKT==5aQ@Guy
zwHiiT%xU`N|1|vN(h9v5&3_28sONQsAj4nKBU!T5`?P}MZ&k9&Xhc_^^XojMzOXhZ
zbpFk5KUchmXm_}d-?dETB0b=+mPo=<MX1vn1?K4q<3NQ;va>JYH{e)4+u5s9LT(iy
zU~gN~LA&f1A6A%a!OFF+LuDt%k<Cg{)%Ew3he!D?*aFLc2RE`ArSII=H%65UHpns1
z_?K82JkwICSPKCMeo4dX)-Vw=$X)%7K9h=|`E1X%^1Sk(0`tW>(lAb(*a^~ZeoW`b
zj7A=$+K3&rht|KT^=GwaaQ$-LO`3}AA1vutTybL?iV=gRcy!2QpgH>P0X|NnzNOu0
zdX3(lRj|NY&AW?$ykh%bCMAhpFn`nqE4EW(m=%&aU(BW!=`&&vm2mDfY8@URSDfwl
zTTclWV9!l+I@H1&F{}e)x}w<4=_wvd)zXdyWJE<u7kn)MgO&yoaxvSx9)_ZbQvBX{
z4^V0uV%iLWUWp-IZ3kGbB%*8<8$)D?@8E-(SBlo{KUSAR>=&ALWbp~{Zcyev;fq8^
z>Y}8aKAVnqJ{e$z;`L`Jb1I&KD%+2VNG4PXJ)1vYcy@5EfjiP4fjcG3+UU^o{7tMw
zMjq}`OC?ti7mO9!d=3q=OX4TU(GTg#uj!S<*XEmu^>g8g@Dp4&OeKPlY?nqQqfH`!
zk-?_{OAVIcAzhkEmf=A5?SMyd&)LiQX9qIoO;1B(%S;qLw3&pnB2wG)puEWZ&HIa9
zYkIo(S>{Ik`}?3MqjqIx8}@y%)yy-=ude{>!(*Kl*nX1GcB{q(Xc*(SgqvhlN~DBe
zr_r)~FZ%7U@WfHN8^nNEes><Z-fXL(V_ubLc<{MYs)Gu$(HeCIhDE-=dv%dA47_NK
z5~!I(O3}!RHblALMo0`dEo0S)=?|;TIrd<N)JogD6m15NbJh4yHS?H&Ab9=a)Bz_c
z5t$i68ENwj{b9i!PX)k-&<hwQI8jUxQvx5r1fedWX91}Eg_M$8ig29fBN@GbONJ@$
zy83RXcM-9i5M)J~1cq$UAT#tn7ymt3b+}Ou1O=Tr4S{UuD8BGV`a*A<O5kAVP*04K
zPG)JUn>?=#$EGhE<-<ljyv4}3*`zD%ZVPA@8)qnt*;mpTrQ6`LHUj6a^Chd`Jsd)p
zDRKo&Hmpv3W|EM_M)SdG?T~AQZTqjpgIcWeH{S?V1O4OUGz<Ne4+(!JjQdDc{BPEc
zpQ=l%qW`lKO_lMfnna<etwF*zXGe$i`$s?dd6Q(0Tt}YK=dX%D&Lz^T1liX$e`z`?
zy21^O<bKfTf1`jNI#)tjc(&831z8ri$O6SJbsrgW?6u*hcvZj}e4W(AC#2}JW2M@|
zKBK|gccVC1nxBIe0+8?e4k~^P_#<L>$RG9~k_f7~b*OMUqc92gD|kmFV|7l|`ft$F
z=F92N3=Tl?*@%t>CL&jN%d<WTgrW1!lSEjF7-A-+UCB|tHTefWBSy+uK@Q63TlWAa
zca1{`sc^iUKjMS)j!(P!K2X68rApo_+ZAW+u@g2|)g<zZ`StQDrh!=vukal{s~^OW
zJp{jue)4&Kxc8MTq(K>s&%c7phknUBTWaX{oiErj0rNqvvQ!*AQ3mMi$AA$NWs@_`
zCKdPZfISOpDiSPA&P_KOo6US|+zqoN4}^(`tN<04r{0<$%Wti{8Q~w+Lh&uhHwzNe
zow4LK3asEdjJAG>?pfPI9=7%_F5y#O=Hf?WoqLVMfEVlQy#=|P)Q#=={Rx<}=IIY%
z0^+<u?{#Tz?7;q8Uhq5XBo2=tLOE{SuOI6@XV)Ul(WbHKxE1f1$yK!c&p9}SFRytj
z<YqQbcxsTlO+6~|^XPVD*3IPmP-TKCR!zoP+_RfYQJ__oIv=3$5#bywe*v+TN`So4
zxvQ^P#B*2lz&qn+<hZkf-n*Z2DZ7Vv!`~8aLdMmGd;XAs+ea~KQ-qUQXhY;xg*xHN
zR(hJ11hi2QR8hTaJPWY+YlFs#bs^e{^DF!%{uq-KRxXw@-z>1VSk~1(VHQ~IUM1gO
zcL;7#Ywme^^tDWKfDLz*ST)a5HvtMCGRNY6N3$3tF}~b4K#T>_5(3`QkGz0ec2@cx
zQ3hF!HKF%ZUq5TqvBzwz%1}f|lTf%L^nij|Q6Q_TagF;}<9(c`*%9cg8bpC;Fa|VU
zLVp1P(VHefM$P5gxG}huk`J~UzU*~fkPRJagd?`Pr09Z!5}B~K<T7(}yULLj9utk%
zTtgtHi*`KY-$d#W@2?+;9@*iZQ;jkxyi~b8Ktm&VRT=xLHncbI1AbV16@UaIYv*Ym
zW&~6X|2Qoko~wY=5RlTA1zzi~E@D$178|(HJc=Yvi5HyM%2dHDC?8xd?&!W@UqoCi
zLY2c9PWbec0m%-w^PH_|`%7C}wCIuDZ^`!#I3@WX=syBVFSVTl^jT{S4)fN0fHi|*
zo^1HSZVr^2DRv=o*UmL^lMzbVv<C6o%WOc_vg;Z3XboGp_%QWvk&^gY3&r7)mLJf)
zoq3e9Re?9|G=UQGq=#%ZGFNeZFdd$O(Y|ig=X`Yd={ritEp#mvF!voo`bAtFY1>-o
zEfR9(TXE}b_heQRj)hxzwE<NBqD9OIO)q9*{L-6BFw+E8EOg%sJ?P&2?};+8r&SQE
zg!}Xb6mh?wwUNPKbL1}YR;UI=0uxur2Z6Q-EL}B>9r!1M09K%-U_E|mJBidQMI*<p
z3)~{MsK-XW9fXuuGVVr`%uRO4)1T6#D52ns-qad;AJUFXA3cTNj&mhj$5Kgd9ZYoi
zqts;*vzM`Ji(w#6P}<8RQa+!j$piLG2XGq|KV_6pvF!4Y;k=GTwG(#^xL#SPS1WXp
z%+7q1|M<Lg&*xpP6w_oxZ{#i#lk{r+9O`De*Xvt~Q>ri{f8pbZ@sJLkZP#k(D{yF_
zMeK%tvr)t&_fmn!J)`o1+>CpcD2toO{y}D9#8m26ORiWZ7@ZO`Kk?T6?OdiiCafHM
z&oEnczAM<wkhNXePQy9qr8tYixoR1pMZ<mfr5na*;`#^ttWMcp>;I0{@O_pXgwR0c
zc*dS3(=8>4MNq=Jy6?Bc+mwqG2t(?)(xn**!899Arg^5cUqv0;^V(#^EM`#=lesVG
ziXhe#xB8+FE<dKi8)tXL`{F}^d8tbI76O;L+<8Jq_SN;4`H&G333pR}K>ywdv$QJJ
zk>)ZlsAV+$#Imu_r73&;vL7OZiqk-m9Rb+rd@rLGIPl#RRW#TtVbksg+~V_GG*+s_
zIQFOA&4k>SD9cJ{WQO<SC@#Y5v)Dz$r$w@m4$ZO#8(MrsoFp)H^y=6gmX7Jd@)@us
zc3dnq(NDK@#)#xH`YLj^y)ipR`W1-hAUkMTLUIz=_4pJCO8Q1kNi%<h6!K}ch2zAQ
zlz5ldG4#;-cMcQISv)*<t+d|p+S8i<%%zpKbb)~jDT1;TnEE8*2)uM3@}Zfyd2&X#
zU*=OKAtqV5%uTS9+km4=jz+V_q;H=gCEus!dS=ax;=n%!SH!Wo^4VCXF%@M5!Q+l3
zYd0n`=<P;GeTsezEp{-ozUKhiE_<1VQZg2&CZ~T<!l(wCup2?2-KslCYW^TkNqOts
z^wcR~^gKEpthyr=m);L9eo`(Mh)5p|ue7H)+H%_mYt+rJB2YgNW?N_9bh4i?!IfG6
zcqNIUW&9l-xPRYk+^w?hI*XJU{FOqdw&IAgc37hJfl{>&?Bd6vXRtIx{G4=FVtBJ=
zUw)Kj>aOn0_$%{r(=ah>=;fcdd=Rxk6MIlVG&Qi;EI*?b*5iRn*Ci=&?^PdU7j!cZ
z1rb}BRtp8x<qR8g?$HCBK%QR7QDfxUbOLHA`SXAlKdl1Y5Wj6HMpt00<HekRW1pM0
z_Erb-RET{ny6H@!%#+G@%t0Iu<tp?m%dcc^A5mnAeio4?42kV0zG7+#Iyx{dwGZko
z+c4wn6A&3V14r+MP;2zeWFeGEkiLU&9u&7%TD+@HWe?hPM3+X1llO&fRU<qangt^y
z4U)|-KyHH<_Y)uSgV_2#KwK&~#=~9Jwv^H$I%E2Av}6wSV=kXuxVxcF<bb9}${!5-
zuprzuO{i_KF5EsrO}=PMu|-mfLTCzn&lWdSh@&Wk;D4b5E{tER_9FR0hAKmt<cnoQ
zIM#8#>Bv&$t=7tu3&)#9^Q{!U+#wk6;#bsfZE<@n3{VqYnH7TR58j}dJHBs`91>Z_
zux@vFptT%khMH>j%D&Dl)kal{k52Fm*-5JUc}f$rdjQVHaWU`;?-dr0y^(az<qk0+
z&Bq#d50Cmq`Oo{3us$s_Bki(&6CQo#j{4XFsNIXz{)KgQw{C9+vukic$7bT-Y$VHk
zL!%90X(i6wwg>eU{xCBp45R0(>E!q`E*@$#!q|pnEGex<xZ_YRPr~3ju+7qtc6*wp
z^%q_?iw`)6^mPc>%QERy>~axLgq4+{fbKbE_-IR1^s5gPvmhRTC5{@el!<W%hB2;m
z#))DdYTExe8qf-=treLpbFg-Vq`mBuntYg0We_sEzq@e<ig((j`OZcu2U3^!E*UeM
zHr43=&|p2U$k=lS)4j6JddMVcb&gj>hOA=gg^LKsU1-s@c22te8Yj~T<5Mc7hAn9l
z*<*Sq(Xv<|b<MPzfJ^;Q<wyqzC5G{b$5cRxsb>9{0DrXJ#EtybYIH67oSP!rM1vkj
zx_~B!i`rQHRuetZzCY_@b1HOr5K@e9n|pv3;QYYzS-8^Z>FoI0z1xyAc-n@kJOg)3
zt3Q_>JBilo8V*4C3z&PppFM~a-m}6q>@F7%tS=}L<9wC{>3~L+9%5rB9*c~59?ODA
zQ-`2;GJY_n@1;7)gi@i-0Q;_B7tK>PW{9@B@3(Cw8Am{CTBR3)-<s{B<b1ud)SU8H
zTm2TXb55bqOx)J<Ox--f7|Wcz*sqNm6*!3~@qkq$vaF~Rli{ewrrcNs*5m|)7C}#`
z;0$ei;kr(o9W$(#StguV9&QM!B|)4izKZFPMAtUFr$b`f<|Ia~RpcBddT?b9=P$!k
z1w#e%j5Op+HH+R?NbT_3imrMQgMEkwoU=r-{YX*;ABvEYxXK|V&wZ!nzjDk6f?!}?
zBW>^xh9(7k%S8cYaV`syxnGrE_Rih(;B1OvcHSOfZ!zJG#Rd8R&*{;5Eq}tKMVhwo
z=b=1zL7V{0tv(=zcdTy9>9KdIjZ#x=d#!zva=J4s`R9zIq@tp)Cn}+jKn7}V*;o%i
zv_Hz|7X9;rCe=Tna4z1N(I3Q5SKniZcGcmi4Z_ER-VmR7(Xp#RbI7C9G-~-dfBMRk
z<JrIVd-h4TRovKn648zug<E}`O745B%BfOE0oocBWUES%T6FhuBn}xV4=22)M;PoB
zpS4Prw3;gBHRiX5K~F_kHH}8(pT(TI9Ff_-D-5=>-L&NF4c|GX@HmX#q4|{D;pG*z
z+2qpg(=!zBRq&;pJ<uxN|3u*27QC70-9=Azua_M>OX$Tp9KwS|VhVm72xm%bH1q$&
z`6cxHy=SR6Bk$2^bW62`H@(94%gg0`s2(TNwT%a6wq-V1;Wr8(WZHv>7SV<jXCYpB
zk{>-->uKs=CgAeS5+Zbt3;s9tgLzi{q|{dOWJ{q~@FxCxb!ZjOHxA)ojaO{n>@xPK
zhRX8o7-%|%>9BQ6NEYeLW13+zc5r?oese4eqz4Lie*hT(Qm5uJX*YjyDa`S!Hn>x@
zxmXh6Eg+GUf0};B$H$Re8w(jE);hg(6ag6<Bc770bSV9T;0Dpdn)~cN`wD2g(ie6y
zu*i}Gn=@_FP;&(rx+eVmuGD&ozNR|TZdP7xPc%$&eLw24HxM@0>5QD+2q2oOs;-Vo
zqE8jjoscq@rQ5!HIn9wSNa8$~`Na5r3*Pc(I8gDWZZz!e#>H#7jM0*YqhJfg^7nly
z7NeR>^p2g)h&~E*faadfd_vtdPfdZ}8fJLVC<X;G_1W;A#5<5eli;*VQ8}t8&=l<8
zJX~UC|L7?#I+DmRu&g28Bc3pPwC^g!0LR~!@@2%2xNV`mlm&yi7W=4GC=(;n#XfCn
z<_^%MSzzX)jT9V&alhORXNzRTe3~H+;eFT)l3tgR#U9Sar6C)mFQ>dPaI6LdNSOVO
zLlH7=oKA1GT3^spL%gnr`<BC&+aiM<yIXtra^w8H4Y7Dk-wDhiEbEDQ4{@jRimpw@
zc(sL|n98uG*xV02v2jd(zfOZ~_bN~yDjh9AMgMDa62`hzerVPu>oqYW+?%@Z^3`^(
zU#CPdrMa9nCW=`l9S@c;4FzWWnwWfMJLutP`{J*_Drjxe09L}|UG30J>3|O?#URnb
zM=vUtn1&Hv!?bB7p7ffeGaaTeRQsXR&s|u7h3i|%ifWHkec%54<MD-P9nH&8jE)lE
zB(bkbj4+r{(>iAAN6;I@pn?l}TJY)G-khXMSh+NOEGdOb*Z+QL7g$_vfWNQ;$bDx&
zg&YY;M3#lsuUAHjQA+p+-OL(B!0wo&tQvd)>+eQfz7=lnxC*^$qih45{}~t}+}g~q
z<YN+**CiGl=n7K~kStUuf^3=3d}ag2SBL-$1+sDEtu8H>0>}ul1wpn#{NRW8RX>2-
zFVcNVPQSZu^pR>DWGy^kurLl-D-;-_7gjp1kx+Xk0kUBKZ}G?Z(ac5iGm=}A<^=;@
zv(}vB-DZK6E=6-wy+8dU`w(JO4)idf0Da(9)JlNj*b$`?^idqwVenVeMf;BoJPAg_
z9h~j56Fn~dHl9Rj*P2QT=@g@^#o+-Ch%5I5)BGxQO(^;0ydIAdyX>G83laIn{xWIn
zFI%teM6RGRv8N)0B?~jhO0PnvTm3$CtbRqOR?{W3b1}g<m}Nl4eSws_9IZ7JoRf^|
ztCWgAIt}D#sLQw8JV81!r&pZ4BPYt_^qlzX*mHH1zwIO#XD8uzdhC9XIc}StJG$tG
zU+r&H1-k={TNuxha0fgt*(tq7$qmi;c6p_KS+Y5^od{=XK?$(W#sE$cU9q4OSXpAz
zdJc_Py<$NWWN@2gnJR~Ad?i=!-1dg`wOIs!?hB2QLca4v+{&%w|4S=}Rvf|YAf(MB
ztK`6*N^1%=ig3cGYHXpSKKX`w)bN-4G>PBlI@@1@3{g@W#s@?cr3e$3iR1`fa%<g*
z?YsuSF?{G2Wypi~R8rU@Ty)1I?m;p*K<LaOsGcP5>0)lT{5;zs?ajOKJ)XVCAj(?0
z2|(pvx!c<{(kgsS)jnd7cL&v7D0q38t|6)XT`0gf3k_)qOzs8svaV%kE%*@e%O~C)
zW#6Ed{))O-N_%%WChz#-Q#%<tr;ez{PqeT^X*pRXTWi3dZLZ%Ux2hm|;{!c&WFrEJ
za5_gO(&jP#bm2AuTB(`CQ%=twOV7zw(>o~b4Q;b%`Q|0K66ssK_Tgo<C0-PgP;_mN
z8tbPVmwh)U`+xHb`YG9b=h*q8zhIeDM$x0A!zm~;7rPmscU362PzcbOe%i}5Jd_7V
zigc)>h+-liMq~@KqAMr1%UW5s_+w$uW}vzhOP4hNurYtl!TvNJ?|pFj?7?KIT>SV*
z^D~`H(Z^Z7NiPmbbWbB$TxOnnAu4(_oDrQl{cI4qM22fuz0e3YiyCCqHOzdaS<mY0
zLlZ+4&#UeIsA>aC1wt22vt(#tI?)zeILWYXXsgio)PuJhhy0K*4jM3$jBP(kw?+^-
zsr=aSm#Ci$$I=v=0|*4|k@;%}T4VdNv*hD?d7xIyOWLkuX8Z1YC*>?eD3{UQvj1S6
zd29%0X@7?)D|lf;og?COB7D_!De*DVByevUpc}u7PK{B(ICt`?oH{=@#eWS&h=*FH
zQ?Imp=>eU~^GBRsf3DA4!6HibZ=_cz1&Hvbu_E`AlG6{Z|EV2<_(3k7-^d~9iO>ip
zxKkbF<RFfhq3uMv=`A6c1HY<nP%&)!@HJrz4Xr-#+Waij>5vz!b-(W+F9=Tfx2eNc
zGMFBnto0iqL#;K|-4<V3!lYVRDF+@mL|9XbGDNAvid)(qV>@_k=Y0xb2Yl`EaSOar
z+kuDhX_<Ho19Au96p|GdxIbA4-OtQUkmg0_)}gEF50t9)!fC3C&8KX*aTlVN;o;d#
zyXqBg0f$3;m_gd8E^75#0i-6wqx=8FV#)c)#>8Oe0bvDIJr^u=FI@as0h0=68u}e0
zOx1b~Qz(=K##85s*32X!msL;97Fn!OudjA!;v=VsM?KY?*2a${!>(x7E+<c+cr|B&
zXug^S?Av>6W2$Y`dMu*O@+EQ$Qj;GZ#DkYL86SGyCU#elqBX7uF#FJI?Szl!kWqxy
z`l9s|+R3YRDezNZll$slwIu<|itZl)k90PjorCvu$&oOzf?EImZYxB&?8^=4z<hj-
z=cKUGrn-5fi0QTuUn9rRk6BoCGsg5x7i8$?l7ox5efEbA^3--@lt#Kcw)$1%TQ6B=
zwp)gB;68E*6!8Jl9?ki5gCp18gZ5VUx{~(=(Q`T`GBZ?bkL~hVjv5n5Z&RO?^*Dc`
z6tCzToEEOMjIj~XYDa=$lcK~`()!n~1tw@6q;cj{8|tbh{#6c^4vWE4VLKUbkAEh+
z;M(U8Dq{xz#+R)Gc}~;kFJX_yW$hwzZ%TcW&E%zq1|)GMhNx!+%SOete{2tL{VO$D
z_6@}>6iQk%;LHr9PTwolPC+#XD1GP=K(QJ$(>KCKZC?xqy|#tT@$sU~-+Z=da>vce
z)M>XdeHdf8@25tzS#^1j3IJ3Kdw9svv=*$&<BD_Twnw*Pd2ZYd3CloH+?++mfKM@+
zo_J`Sy7g^w3}VFUht6bS%S7mBM||Fr9>ZyVt1@l{6MF5V=i#9yW`P6Wp%$b6d8Kqn
z6#Tl-Yiz_#%h<6?kf9ZV<5xdUgEvwV$JLDQ@D|u0d8;Eed=gLAYdiCR#@&K-wROEX
zf=NCRGf|*hAs?K-R$IEik57n#`=~pJ#IW3b5(LvMw<DFLz{q%(j&RvWW$8;xqA)$H
z78Nr9UOB7A{y6fDPiF%sBn?7e<!@XlWHJ!`NVxTof6R0(TLCg|+i?PqnlI8jI`nrR
zMNK`%HtX0jAy8i7y^6}{Suop#@a9gCG5YyIb>!`Cvu)+fvFe(}U2$tEibj^v`OT}j
z4Z-3aK*tm`MVGp-eyd@?mjc!r42JX3DBStfKm@cDE{zIVg`QiR&N#7(U7|TCtWY|!
zLt~S;&{12yS3B6-TU3?95e1LvAZqzL<U^J{QS*KIDugg;uoC_}z_`OXFPcHEEJl7i
z%gy(Q1OTF2r7tfU@a$dIA!CT}(ts9+U{Ns6yFAcRn-7`TLr(E3EQ(o%`?#Ih42ZTB
l$7+)C#XcZY`}*asJtM-!&jfnTNUOy>TCxtx{<eOd{+EipB1r%M


From dfad66128c6ee7513e5565d39bc7b002055dd0d5 Mon Sep 17 00:00:00 2001
From: bojeil-google <bojeil-google@users.noreply.github.com>
Date: Tue, 20 Jul 2021 10:43:13 -0700
Subject: [PATCH 2/4] fix: fallback to source creds expiration in downscoped
 tokens (#805)

For downscoping CAB flow, the STS endpoint may not return the expiration
field for certain source credentials. The generated downscoped token
should always have the same expiration time as the source credentials.
When no `expires_in` field is returned in the response, we can just get
the expiration time from the source credentials.

Co-authored-by: arithmetic1728 <58957152+arithmetic1728@users.noreply.github.com>
---
 google/auth/downscoped.py | 12 ++++++++--
 tests/test_downscoped.py  | 46 +++++++++++++++++++++++++++++++++++++--
 2 files changed, 54 insertions(+), 4 deletions(-)

diff --git a/google/auth/downscoped.py b/google/auth/downscoped.py
index 800f2894c..96a4e6547 100644
--- a/google/auth/downscoped.py
+++ b/google/auth/downscoped.py
@@ -479,8 +479,16 @@ def refresh(self, request):
             additional_options=self._credential_access_boundary.to_json(),
         )
         self.token = response_data.get("access_token")
-        lifetime = datetime.timedelta(seconds=response_data.get("expires_in"))
-        self.expiry = now + lifetime
+        # For downscoping CAB flow, the STS endpoint may not return the expiration
+        # field for some flows. The generated downscoped token should always have
+        # the same expiration time as the source credentials. When no expires_in
+        # field is returned in the response, we can just get the expiration time
+        # from the source credentials.
+        if response_data.get("expires_in"):
+            lifetime = datetime.timedelta(seconds=response_data.get("expires_in"))
+            self.expiry = now + lifetime
+        else:
+            self.expiry = self._source_credentials.expiry
 
     @_helpers.copy_docstring(credentials.CredentialsWithQuotaProject)
     def with_quota_project(self, quota_project_id):
diff --git a/tests/test_downscoped.py b/tests/test_downscoped.py
index ac60e5b00..795ec2942 100644
--- a/tests/test_downscoped.py
+++ b/tests/test_downscoped.py
@@ -80,10 +80,11 @@
 
 
 class SourceCredentials(credentials.Credentials):
-    def __init__(self, raise_error=False):
+    def __init__(self, raise_error=False, expires_in=3600):
         super(SourceCredentials, self).__init__()
         self._counter = 0
         self._raise_error = raise_error
+        self._expires_in = expires_in
 
     def refresh(self, request):
         if self._raise_error:
@@ -93,7 +94,7 @@ def refresh(self, request):
         now = _helpers.utcnow()
         self._counter += 1
         self.token = "ACCESS_TOKEN_{}".format(self._counter)
-        self.expiry = now + datetime.timedelta(seconds=3600)
+        self.expiry = now + datetime.timedelta(seconds=self._expires_in)
 
 
 def make_availability_condition(expression, title=None, description=None):
@@ -539,6 +540,47 @@ def test_refresh(self, unused_utcnow):
             # Confirm source credentials called with the same request instance.
             wrapped_souce_cred_refresh.assert_called_with(request)
 
+    @mock.patch("google.auth._helpers.utcnow", return_value=datetime.datetime.min)
+    def test_refresh_without_response_expires_in(self, unused_utcnow):
+        response = SUCCESS_RESPONSE.copy()
+        # Simulate the response is missing the expires_in field.
+        # The downscoped token expiration should match the source credentials
+        # expiration.
+        del response["expires_in"]
+        expected_expires_in = 1800
+        # Simulate the source credentials generates a token with 1800 second
+        # expiration time. The generated downscoped token should have the same
+        # expiration time.
+        source_credentials = SourceCredentials(expires_in=expected_expires_in)
+        expected_expiry = datetime.datetime.min + datetime.timedelta(
+            seconds=expected_expires_in
+        )
+        headers = {"Content-Type": "application/x-www-form-urlencoded"}
+        request_data = {
+            "grant_type": GRANT_TYPE,
+            "subject_token": "ACCESS_TOKEN_1",
+            "subject_token_type": SUBJECT_TOKEN_TYPE,
+            "requested_token_type": REQUESTED_TOKEN_TYPE,
+            "options": urllib.parse.quote(json.dumps(CREDENTIAL_ACCESS_BOUNDARY_JSON)),
+        }
+        request = self.make_mock_request(status=http_client.OK, data=response)
+        credentials = self.make_credentials(source_credentials=source_credentials)
+
+        # Spy on calls to source credentials refresh to confirm the expected request
+        # instance is used.
+        with mock.patch.object(
+            source_credentials, "refresh", wraps=source_credentials.refresh
+        ) as wrapped_souce_cred_refresh:
+            credentials.refresh(request)
+
+            self.assert_request_kwargs(request.call_args[1], headers, request_data)
+            assert credentials.valid
+            assert credentials.expiry == expected_expiry
+            assert not credentials.expired
+            assert credentials.token == response["access_token"]
+            # Confirm source credentials called with the same request instance.
+            wrapped_souce_cred_refresh.assert_called_with(request)
+
     def test_refresh_token_exchange_error(self):
         request = self.make_mock_request(
             status=http_client.BAD_REQUEST, data=ERROR_RESPONSE

From d94e65c0e441183403608d762b92b30b77e21eeb Mon Sep 17 00:00:00 2001
From: arithmetic1728 <58957152+arithmetic1728@users.noreply.github.com>
Date: Tue, 20 Jul 2021 12:09:57 -0700
Subject: [PATCH 3/4] revert: revert "feat: service account is able to use a
 private token endpoint (#784)" (#808)

revert "feat: service account is able to use a private token endpoint (#784)" until b/194191737 is fixed.

This reverts commit 0e264092e35ac02ad68d5d91424ecba5397daa41.
---
 google/oauth2/service_account.py                 |  5 ++---
 tests/oauth2/test_service_account.py             |  4 ++--
 tests_async/oauth2/test_service_account_async.py | 10 ++--------
 3 files changed, 6 insertions(+), 13 deletions(-)

diff --git a/google/oauth2/service_account.py b/google/oauth2/service_account.py
index 8f18f26ea..dd3658994 100644
--- a/google/oauth2/service_account.py
+++ b/google/oauth2/service_account.py
@@ -80,7 +80,6 @@
 from google.oauth2 import _client
 
 _DEFAULT_TOKEN_LIFETIME_SECS = 3600  # 1 hour in seconds
-_GOOGLE_OAUTH2_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token"
 
 
 class Credentials(
@@ -383,7 +382,7 @@ def _make_authorization_grant_assertion(self):
             # The issuer must be the service account email.
             "iss": self._service_account_email,
             # The audience must be the auth token endpoint's URI
-            "aud": _GOOGLE_OAUTH2_TOKEN_ENDPOINT,
+            "aud": self._token_uri,
             "scope": _helpers.scopes_to_string(self._scopes or ()),
         }
 
@@ -644,7 +643,7 @@ def _make_authorization_grant_assertion(self):
             # The issuer must be the service account email.
             "iss": self.service_account_email,
             # The audience must be the auth token endpoint's URI
-            "aud": _GOOGLE_OAUTH2_TOKEN_ENDPOINT,
+            "aud": self._token_uri,
             # The target audience specifies which service the ID token is
             # intended for.
             "target_audience": self._target_audience,
diff --git a/tests/oauth2/test_service_account.py b/tests/oauth2/test_service_account.py
index 370438f48..5852d3714 100644
--- a/tests/oauth2/test_service_account.py
+++ b/tests/oauth2/test_service_account.py
@@ -167,7 +167,7 @@ def test__make_authorization_grant_assertion(self):
         token = credentials._make_authorization_grant_assertion()
         payload = jwt.decode(token, PUBLIC_CERT_BYTES)
         assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
-        assert payload["aud"] == service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
+        assert payload["aud"] == self.TOKEN_URI
 
     def test__make_authorization_grant_assertion_scoped(self):
         credentials = self.make_credentials()
@@ -440,7 +440,7 @@ def test__make_authorization_grant_assertion(self):
         token = credentials._make_authorization_grant_assertion()
         payload = jwt.decode(token, PUBLIC_CERT_BYTES)
         assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
-        assert payload["aud"] == service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
+        assert payload["aud"] == self.TOKEN_URI
         assert payload["target_audience"] == self.TARGET_AUDIENCE
 
     @mock.patch("google.oauth2._client.id_token_jwt_grant", autospec=True)
diff --git a/tests_async/oauth2/test_service_account_async.py b/tests_async/oauth2/test_service_account_async.py
index 3dce13d82..40794536c 100644
--- a/tests_async/oauth2/test_service_account_async.py
+++ b/tests_async/oauth2/test_service_account_async.py
@@ -152,10 +152,7 @@ def test__make_authorization_grant_assertion(self):
         token = credentials._make_authorization_grant_assertion()
         payload = jwt.decode(token, test_service_account.PUBLIC_CERT_BYTES)
         assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
-        assert (
-            payload["aud"]
-            == service_account.service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
-        )
+        assert payload["aud"] == self.TOKEN_URI
 
     def test__make_authorization_grant_assertion_scoped(self):
         credentials = self.make_credentials()
@@ -314,10 +311,7 @@ def test__make_authorization_grant_assertion(self):
         token = credentials._make_authorization_grant_assertion()
         payload = jwt.decode(token, test_service_account.PUBLIC_CERT_BYTES)
         assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
-        assert (
-            payload["aud"]
-            == service_account.service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
-        )
+        assert payload["aud"] == self.TOKEN_URI
         assert payload["target_audience"] == self.TARGET_AUDIENCE
 
     @mock.patch("google.oauth2._client_async.id_token_jwt_grant", autospec=True)

From 343c26467c0edfe3576fcd9da69a25fca653106c Mon Sep 17 00:00:00 2001
From: "release-please[bot]"
 <55107282+release-please[bot]@users.noreply.github.com>
Date: Tue, 20 Jul 2021 14:06:11 -0600
Subject: [PATCH 4/4] chore: release 1.33.1 (#809)

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
---
 CHANGELOG.md           | 12 ++++++++++++
 google/auth/version.py |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ccadc42b..6b7abb366 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,18 @@
 
 [1]: https://pypi.org/project/google-auth/#history
 
+### [1.33.1](https://www.github.com/googleapis/google-auth-library-python/compare/v1.33.0...v1.33.1) (2021-07-20)
+
+
+### Bug Fixes
+
+* fallback to source creds expiration in downscoped tokens ([#805](https://www.github.com/googleapis/google-auth-library-python/issues/805)) ([dfad661](https://www.github.com/googleapis/google-auth-library-python/commit/dfad66128c6ee7513e5565d39bc7b002055dd0d5))
+
+
+### Reverts
+
+* revert "feat: service account is able to use a private token endpoint ([#784](https://www.github.com/googleapis/google-auth-library-python/issues/784))" ([#808](https://www.github.com/googleapis/google-auth-library-python/issues/808)) ([d94e65c](https://www.github.com/googleapis/google-auth-library-python/commit/d94e65c0e441183403608d762b92b30b77e21eeb))
+
 ## [1.33.0](https://www.github.com/googleapis/google-auth-library-python/compare/v1.32.1...v1.33.0) (2021-07-14)
 
 
diff --git a/google/auth/version.py b/google/auth/version.py
index e74f1e70f..6327f8588 100644
--- a/google/auth/version.py
+++ b/google/auth/version.py
@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "1.33.0"
+__version__ = "1.33.1"