From ff8e78bbd5656aaee7f3d4123c3ef3417a196ff0 Mon Sep 17 00:00:00 2001 From: edgelessci Date: Tue, 17 Dec 2024 11:49:27 +0000 Subject: [PATCH 1/4] docs: release 1.2 --- .../_media/attestation-composite-device.svg | 1127 +++++++++++ .../_media/attestation-composite-device.txt | 24 + .../version-1.2/_media/attestation-pod.svg | 1737 +++++++++++++++++ .../version-1.2/_media/attestation-pod.txt | 43 + .../_media/attestation-rats-architecture.svg | 1417 ++++++++++++++ .../_media/attestation-rats-architecture.txt | 23 + .../version-1.2/_media/components.svg | 766 ++++++++ .../_media/contrast_pki.drawio.svg | 4 + .../version-1.2/_media/emoijvoto.png | Bin 0 -> 269322 bytes .../version-1.2/_media/personas.svg | 568 ++++++ .../version-1.2/_media/runtime.svg | 1376 +++++++++++++ .../versioned_docs/version-1.2/_media/tcb.svg | 547 ++++++ .../version-1.2/about/telemetry.md | 20 + .../version-1.2/architecture/attestation.md | 119 ++ .../version-1.2/architecture/certificates.md | 70 + .../version-1.2/architecture/observability.md | 54 + .../version-1.2/architecture/secrets.md | 106 + .../architecture/security-considerations.md | 66 + .../basics/confidential-containers.md | 32 + .../version-1.2/basics/features.md | 15 + .../version-1.2/basics/security-benefits.md | 158 ++ .../version-1.2/components/overview.md | 60 + .../version-1.2/components/policies.md | 88 + .../version-1.2/components/runtime.md | 91 + .../version-1.2/components/service-mesh.md | 146 ++ docs/versioned_docs/version-1.2/deployment.md | 427 ++++ .../version-1.2/examples/emojivoto.md | 297 +++ .../version-1.2/examples/mysql.md | 259 +++ .../version-1.2/features-limitations.md | 43 + .../version-1.2/getting-started/bare-metal.md | 34 + .../getting-started/cluster-setup.md | 146 ++ .../version-1.2/getting-started/install.md | 13 + docs/versioned_docs/version-1.2/intro.md | 41 + .../version-1.2/troubleshooting.md | 166 ++ .../version-1.2-sidebars.json | 152 ++ docs/versions.json | 1 + 36 files changed, 10236 insertions(+) create mode 100644 docs/versioned_docs/version-1.2/_media/attestation-composite-device.svg create mode 100644 docs/versioned_docs/version-1.2/_media/attestation-composite-device.txt create mode 100644 docs/versioned_docs/version-1.2/_media/attestation-pod.svg create mode 100644 docs/versioned_docs/version-1.2/_media/attestation-pod.txt create mode 100644 docs/versioned_docs/version-1.2/_media/attestation-rats-architecture.svg create mode 100644 docs/versioned_docs/version-1.2/_media/attestation-rats-architecture.txt create mode 100644 docs/versioned_docs/version-1.2/_media/components.svg create mode 100644 docs/versioned_docs/version-1.2/_media/contrast_pki.drawio.svg create mode 100644 docs/versioned_docs/version-1.2/_media/emoijvoto.png create mode 100644 docs/versioned_docs/version-1.2/_media/personas.svg create mode 100644 docs/versioned_docs/version-1.2/_media/runtime.svg create mode 100644 docs/versioned_docs/version-1.2/_media/tcb.svg create mode 100644 docs/versioned_docs/version-1.2/about/telemetry.md create mode 100644 docs/versioned_docs/version-1.2/architecture/attestation.md create mode 100644 docs/versioned_docs/version-1.2/architecture/certificates.md create mode 100644 docs/versioned_docs/version-1.2/architecture/observability.md create mode 100644 docs/versioned_docs/version-1.2/architecture/secrets.md create mode 100644 docs/versioned_docs/version-1.2/architecture/security-considerations.md create mode 100644 docs/versioned_docs/version-1.2/basics/confidential-containers.md create mode 100644 docs/versioned_docs/version-1.2/basics/features.md create mode 100644 docs/versioned_docs/version-1.2/basics/security-benefits.md create mode 100644 docs/versioned_docs/version-1.2/components/overview.md create mode 100644 docs/versioned_docs/version-1.2/components/policies.md create mode 100644 docs/versioned_docs/version-1.2/components/runtime.md create mode 100644 docs/versioned_docs/version-1.2/components/service-mesh.md create mode 100644 docs/versioned_docs/version-1.2/deployment.md create mode 100644 docs/versioned_docs/version-1.2/examples/emojivoto.md create mode 100644 docs/versioned_docs/version-1.2/examples/mysql.md create mode 100644 docs/versioned_docs/version-1.2/features-limitations.md create mode 100644 docs/versioned_docs/version-1.2/getting-started/bare-metal.md create mode 100644 docs/versioned_docs/version-1.2/getting-started/cluster-setup.md create mode 100644 docs/versioned_docs/version-1.2/getting-started/install.md create mode 100644 docs/versioned_docs/version-1.2/intro.md create mode 100644 docs/versioned_docs/version-1.2/troubleshooting.md create mode 100644 docs/versioned_sidebars/version-1.2-sidebars.json diff --git a/docs/versioned_docs/version-1.2/_media/attestation-composite-device.svg b/docs/versioned_docs/version-1.2/_media/attestation-composite-device.svg new file mode 100644 index 0000000000..f76b674710 --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/attestation-composite-device.svg @@ -0,0 +1,1127 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/versioned_docs/version-1.2/_media/attestation-composite-device.txt b/docs/versioned_docs/version-1.2/_media/attestation-composite-device.txt new file mode 100644 index 0000000000..7fae1031d2 --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/attestation-composite-device.txt @@ -0,0 +1,24 @@ + .-----------------------------. + | Verifier | + '-----------------------------' + ^ + | + | Evidence of + | Composite Device + | + .----------------------------------|-------------------------------. + | .--------------------------------|-----. .------------. | + | | Collect .---------+--. | | | | + | | Claims .--------->| Attesting |<--------+ Pod A +-. | + | | | |Environment | | '-+----------' | | + | | .--------+-------. | |<----------+ Pod B +-. | + | | | Runtime Target | | | | '-+----------' | | + | | | Environment | | |<------------+ ... | | + | | | | '------------' | Evidence '------------' | + | | '----------------' | of | + | | | Pods | + | | Coordinator | (via Pod network) | + | '--------------------------------------' | + | | + | Composite Device | + '------------------------------------------------------------------' diff --git a/docs/versioned_docs/version-1.2/_media/attestation-pod.svg b/docs/versioned_docs/version-1.2/_media/attestation-pod.svg new file mode 100644 index 0000000000..4149941117 --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/attestation-pod.svg @@ -0,0 +1,1737 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/versioned_docs/version-1.2/_media/attestation-pod.txt b/docs/versioned_docs/version-1.2/_media/attestation-pod.txt new file mode 100644 index 0000000000..10a7c6135e --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/attestation-pod.txt @@ -0,0 +1,43 @@ + .-------------. + | CPU | Endorsement for CPU + | Vendor +-----------------------. + '-------------' | + v + .-------------. Reference .-------------. + | CLI + | Values for | | + | Edgeless +----------------->| Coordinator | + | Systems | Runtime Env and | | + '-------------' Runtime Policy '-------------' + ^ + .------------------------------------. | + | | | + | | | + | .---------------------------. | | Evidence for + | | Guest Agent(C) | | | Runtime Environment + | | | | | and + | | Target | | | Runtime Policy + | | Environment | | | + | | | | | + | | | | | + | | | | | + | '-----------+-------+-------' | | + | Part of | | Evidence | | + | v | for | | + | .-----------------. | Runtime | | + | | Runtime Env(B) | | Policy | | + | | | | | | + | | Target | | | | + | | Environment | | | | + | | ^ | | | | + | '-----------|-----' | | | + | Measure | | | | + | | | | | + | | | | | + | .-----------+-------|-------. | | + | | CPU(A): AMD SEV, v | | | + | | Intel TDX | | | + | | Attesting | | | + | | Environment +---------' + | '---------------------------' | + | | + '------------------------------------' diff --git a/docs/versioned_docs/version-1.2/_media/attestation-rats-architecture.svg b/docs/versioned_docs/version-1.2/_media/attestation-rats-architecture.svg new file mode 100644 index 0000000000..7e291b4696 --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/attestation-rats-architecture.svg @@ -0,0 +1,1417 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/versioned_docs/version-1.2/_media/attestation-rats-architecture.txt b/docs/versioned_docs/version-1.2/_media/attestation-rats-architecture.txt new file mode 100644 index 0000000000..f0d1a68491 --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/attestation-rats-architecture.txt @@ -0,0 +1,23 @@ + .--------. .---------. .--------. .-------------. + | Endorser | | Reference | | Verifier | | Relying Party | + '-+------' | Value | | Owner | | Owner | + | | Provider | '---+----' '----+--------' + | '-----+---' | | + | | | | + | Endorsements | Reference | Appraisal | Appraisal + | | Values | Policy for | Policy for + | | | Evidence | Attestation + '-----------. | | | Results + | | | | + v v v | + .-------------------------. | + .------>| Verifier +-----. | + | '-------------------------' | | + | | | + | Evidence Attestation | | + | Results | | + | | | + | v v + .-----+----. .---------------. + | Attester | | Relying Party | + '----------' '---------------' diff --git a/docs/versioned_docs/version-1.2/_media/components.svg b/docs/versioned_docs/version-1.2/_media/components.svg new file mode 100644 index 0000000000..bd65c768ef --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/components.svg @@ -0,0 +1,766 @@ + + diff --git a/docs/versioned_docs/version-1.2/_media/contrast_pki.drawio.svg b/docs/versioned_docs/version-1.2/_media/contrast_pki.drawio.svg new file mode 100644 index 0000000000..386d2215c2 --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/contrast_pki.drawio.svg @@ -0,0 +1,4 @@ + + + +
Root CA








Root CA Certificate
Root CA
Private Key
Intermediate CA








Intermediate CA
Certificate
Intermediate CA
Private Key
Mesh CA
Certificate
Mesh








Mesh Certificate
Mesh Private Key
signs
signs
signs
signs
 diff --git a/docs/versioned_docs/version-1.2/_media/emoijvoto.png b/docs/versioned_docs/version-1.2/_media/emoijvoto.png new file mode 100644 index 0000000000000000000000000000000000000000..9779306e0484110339fcb14b98c8d4bf15cfabc8 GIT binary patch literal 269322 zcmce-cR1Yb`z@MEBuWHPgD4RM(L2#4QA70JTNoqiC_(hzI|I_CXllM)&zu&db-sjr;T-Q1O`seew=YG~&_geQ8p`oTkbeHDtwQJXiUMkDKxpwXL z{IzR0X7Aj<{UxK@q~+Q*#%nL-WwgDrw_!tD{zHij+G}SS)Y)0-86v{cfR#uxf{yRc z`EK31eS4&E=_g}DL<7KFXLm_@p}mlEt^rWc|N0KMw)}G=GV6zrWgpyp)lS7m78)gI zqYPcwDmEQ^J63#_Ej5Jo-i2%(UN(Eduou~GjZKYM?XeB5A#^aqmEBBux*fC4G+xae zAcrkT*F0bK@bNPsB;wnHG|u;-KY%`qro#xzKISt&J*CSKw;XVJ7wtP>A32J+Lo@b7 z+cxD4mF+!)eh>x{Y5rc?>C7B?%3m_wwB>y5*sPDFL7(n6WdR^Pc~H@R(f>#$Y9jgA z!Jm~|_oqcF_vot!s}rIJ~qfQC+C@>LY}C;-<+o9Z*Vt@$2ik3sutQ> zPRb3~J8{h$6;<@Y&}z-sf0PU_@A#!S1*`;IjBM$^#W{n}Ex+!1buagUEKI9!w8W*Q zP(%8#)4DGf+#01#b0+$dDHd;XWJ2MryB-W|JY%SPyB-Ql-bcL4-ifmgs5(er#Fj~A z3HSgj?_QjL-0;D4uffELf3~d@-BsQYg8;f6hX2a?#=Ve?eJj1@FJP_O0&!}#I(wxs zk<=Nr;}_Vn*(q_kgpM^v_jl|^$eYH^n?yE$t9!4F$&U&2mDWmSRzw;T=0g$^!Se3? zl9Wu)$g72J=}6}w1u6TZR^YeR1#Wj8=#c(gb&=+&C`0ZJNZw`5+P=bQv4`)p?1DV4 zVl&3#GIr8OqwqV}TF(Uf-Wyq3t$kS z>(td7DdDkY*%niDA&C;g;&wB0aNSWKKc|3l_&S9{#uJy~`7qs|ho$IH%ac%*(TymS z$F~Qfx0^eu)CfE*wEYK@MrMQ(%O$`UBrX)N9Ylb1TYn$7BAaklMOsP?Z)8c<=(-ii zH??{0+|O&y5K};K=J$fflHzAdlYY)2x+UYww4;k)d-0rDq{Ms#s?xN=xOF_VUkefX z`d3wjZmBXjW>ZW(s&dJc78V0|rHx^4egK1!j?GEmnDxe1Dcd~IX)*2aU`7)_##nA>`T3xKu!t>&HgbE9kb*)dQU4*#l$RM!e^n0@xZb zp*Q+YUOg9yTU7$hgZ4AOnMmq>?oWw2;!IKVnHc(pG0!NP4?E^7ADwrWkbY(kvP3lo zyoQeH!(!o?Xv5)U-FJjX9odL8njeZFmz7Kz=ah?1gdlO|qa=^pK+*mR2&3j+=zdQl zBp*gLzH(W+zg{g_KFhpwao5`lrSfsSU)DdIa5`;Jsawpas(q0?q?L=G!snj& z*t?MO{2IxL_1~cKzxh(p#YF)a^&@)^*V0$%CA%!$$B{9b(@_aV-~CW3L;YvN8PAv1 zJT5HKczoT*VP9dUPecxDV3cmd_j9;2sAIz+eN8%8r4};(n~z*JolI4>RTpK)=j=$G z8yn!7?bJfngZ{|#M^4{UXcpt0hwErLKC zx^O;i;S^sg^yE~^GOy~a!_2Eggz;b%uk|JRFM51*6!?;Mh?S^wUz&b(^19cJycVWSbNHD)B5ku=xmXx~uXn0d z<3ZigE`0_QYL1kQvK&&b@m_apezDQBi3wHQr9q$9>f!;xmKs;x7y&6(bIs8Sq`@j2 zM`pryp?T}p)|5}|mv8epUN!iU1%}(@UOex^{jccpLrmatrLAT1Qb$r}oIzDf6sDkC z?aCw3!BPr<0s2Y)MCgJw>*OVom51vNhzx$(f=9Pj+to}Jk^K9XPSII|4qaVO-@R{% zD=iuPrhB=x|JvKOF)n}J_m!moT9ZyhKSdv*a_M_M|8wthmL42Yw8`4?WN*DUu8(rz zycI)-tZLw#jYT8$()!&|J7JAu2u@EKI+fGw!chfYS)4zfpK{BCG>a;94>?_-vKiQf z7GYi@>6vrJ|B)83GSei7V6u^&Kw&0+*t+q%vln^PJ4EQcR7cpj4OQoBAw^My&-6v0 z$YABo;AYRmJ1!iY(;zo{(bn(CsDXdcpAKXjDbY-W&?jwf<|mT?H?yH{b1q=L^fO$` zn|Ua7awjiNH=A{eD(*07jQn`S?Fzw)c$fN{0wA0Zh6>`ShmuxwKzXpYYDO3b1^1MB zwlZ;w%I@3eLEXm|S&PJK^};5d?~YQlvXs6czPev8o~=3)#T2kR9>A=ZSx0p_8grkS zIHB$xz2#Zmr-XQJ*P1?wRcAT#IY+-)sn01aXv7@O_GZ-5@p7On?!#h|-*2eCoHeb} zga_;`GbjkRG35!InTpPs0@B3FXV)s6^+rq1vq^?LcqUYkca>6mb$5!>Yc2O4&1>Az z`Mw$xysmm{qV(($>u%HW|Bty&%POIrT~{(iVJ5ijeoA9 zjQ@tb=_u4iBjj@?x_`)f?OpdS?Om!7GV6eli}M?7DBDiH+w`^8Pvdfifba_OLR0emj6YFKg5F@jMUqXBe|f z%?(6Co4yY+gMx-d{^)MKN)lug1?Sv2)dsW-H?dfPS^ck1j{#UK<# zSj({FCJ_ik_~tId_1)$RT^4=<&emj4o2r2WaBGPyb4u=m*ZyueY`$DNPmetc!E$jr z?Z(PI1C~wW zq}wiR7(B~?je^0SpI4I zF!81t{epGX?n4&pT_9HP-l?SzHLgPE;-q6C3J$Np8A&D1&|Q$1sf(G*rw&e;fD+=e zv-Z&rRG*Kaqo02pIV7cNUtmA@eI(!PyZkit!+qIDa~tbvv5Ug-R!3+Z7D&$z0)~{l z!?=h|HK0+|Bvm1ds`vIRX7H%Ff+UB4f7fb)$K$kJ*LLpp4Awe`pJ4{Xi%&GNk(jX< z?p5CGSRb$=z9>ArUo?pB>_CunTg}BhTr7$br(?}F*IM1y9h`5&GlK31(nLLVhe3QZ zaCceyfTJ-VL^*@~=O}TeRd@=!N+CFLh=8o1;jl5ANyq)|3(V+Fj114#n}Dt`4 z2|uiw;F_VfKPkCr5$!mrDuA0$=nDPxgvGcpj*hQTuJ@aqY+l&Og67}S&x;r6oO8~9 zh#KX*s`gLC6rOSX+!(m-3qT{a*6sgRe`UTyu;($4epj7*uf($TzSsy_m)IsrswL9E<5}{ zX!U5C=Bdg#7433SU1kmME7}~CB}ZA^PD-oS`5Q#WZo#^6-kZ4jQ}Ej*U)9T@=duw9Gx;slVcV(EBPC0k)LJDBQ<4E8f2>aQ&9@A%hA79J=`@qsu z#Ohssm6m%WCduquW9P4oz#6OmUr?$l@F5{-W%`ldV8|jI_e5unnPm*&ACHDNZ^^$0 zEyVPw@c8IvNe$a7f`TQRkp@-u)QbCwF`BWET#o?8Shub3jHo$@_N=~0G{VSWkOy#T z!OwBz1u|vrMr1INRE2u#+~Ps~xE05VituZ@dm?3`V>8QvdL5F&<`K{$R+Yle*^aL* z;1>3Jc1KFhq->sYb|#4=e# z3w;=1 z{L7ZBE&&d>dnike3f`4@YFac(Ih*CA&`L{B-Uon0n8cfkjZD1XrPVesDY`gtLwL{B zU_);x9?4IcnoC>lG0z9l9cAtnSx7vc2W$9BlOr_JQyo`bq0k>cN?ilWRE@WE4nv;w4>c-w^F5s<=UxkguZ zj<9>Le5A$@0K)lrdojQLxj`MK;tvoiID4B~bl;FSpU;dUFr~ZxYOyjOGKWR6dFfAe zuCLf69oO;+DU!Oo(d0PA4JAUdT1l!vTmAwvtt9K#6|#*$;c_M%-NEb2tE&BK0&1$l|zdwRE)It`$k_kO|Xa(J+ z^qRmftT&_PTFGWXa@VbWS*fy>4hvu?n3t+yRc`q(vQObG}G{Yx49~oYkj|52+zkt&Bc$%26vl)1B{TqOA8bY{y^-@rW?>~ z>v6;Qr(SR`t2x6F1c4(kV9M+LWbWJD1hjvM#AS}E4aJ>PdoXpDr_Bv1s835^T8beN zD*9!52ANzc18r=0_UgqEO>A#OH&4jKu^CI5As9=Kn4q1ceY*c@n4v7VtYuGNzp2(_z#z}`dFMN%Gfvzy z=HwH4W~~>(6q+@ZJjKomEl-G8s9`XQUM@bjb|vK6xn+K165Rx+kfJ@0BJer}#xKdU zC1=|nEk1P|W!$nirjPlF_Rm=O(Tz6wAtU#`(aJ`I3BiFf*kL$TJ0W`CTw3SHTO%BD zPv5gZpHAjNi5uNCke~z*|Q7)5! z)m-!f7XX)fYP5j_=<4D<$a1*9F}bsDHm<_?*TZ&A&tE*w7!p153r{Wqm zJ#y0tgyf;e>6s$z)3br%U(22?jwuaBpMQKve#N%jod~N3fWn@$PjvXq-9cqL@_?H;&z<`t;ZOIIPI*~{Sw4E>sCHs}q8pr#sIP)kO%CG?< z8{MlLAW2j@!hs=0??6Gs*y){@^$>tl0A&kZ{~yQEfg9wW^j%2=LbtcZv#1ANzL-PN)-TTA z_CI(yZ_JSqb9q&Rj@EsVd)FxjW)~lLHpM0VGrKl1?Ms}c<9Z#(Qd5S=4)-b@ZQWD9 z{6?)2AEWO)UPe6MsCO5%LCbGv6{t(Q*Z^Q*dDcoa-#^u@|R(nC4f?ERz#2i$lgGs-X15Xl`Eg0zC? z_|lh}@5!DWyezm%sk^xCSz6cUH@F!p7}Ga&y61!e4rqe`RvEry{*mnBc=P*2A!fIo z5F+6S`4`;A&htTpUJ1$GmnT0?(objdGI96tekb-5=zd??#?fue6T=ZyD1OLqsYSVx zrgkKlgT;GGRc7CMp6!Y7*lzj!fmBixtvg9Vecl6M#Q*QcO^7gg5i--;$eEkp&0#jr zL2IIsVubcP<+`zfj1lMH7mkt_GddhgK-QJ|s zp*GwtxAno;+lXT+5it}9gSv%5XuO~{CBR!7Ik!WBcuYpe%hx#GLxBnYg+E`S&Zf{( z&qj~1)h0IXXEQNtVXRIr+r}6dc8FN{gsa}D|2?1cvY5c!^if08;3?c~GUD&4tZkia z>XNCm{0V-+ZJTlYkmWAoIlVqc=c{LX=B%j@{iAQTDWESf)5mcEwn_T8|4%KOh_j1{ zfJOYP1BP?9fMe`cN7eZ(CSb$XA8iXk`KczQKGUzY>P_TH2{?(n9JxBgUhTP@2S}fm zOP}Ij!KF_sTTd_nNhL5>6aUN;86mvB>X^rPcX9S$<201tC=3=B=Mr>-Dg%9cRwiOp&m8C_p5V@n>Tb z?kSz~o^x-H%4g)y`{akK%YYX5)$+#wh4ZH*hd4OLGfCy&37P;qdz+S3G36lWzO&h0 z$-eyYvk7Ds+3cyLVpM?u%Z?aV283ZZrf;7OpI_W-J!iW*XSlL8orwN@DE-s6QO$xOfn>)>44%RX>52{v9mK&GsR|IwKilI(Lyar0PsbEc=_eh1@oN{=%>j=Ttl z!<7@98jn~>6%w28*4DP2;SAV6DQxDSQyOuRDx^Q?*wy)?#xIN~+0XvF6t^JG{FG2| zPT?6cGlI}KXeSi{m8$M_n0Yv{-hUm9u{yYe0hL6M=yIQ zR8Oq-YA|2IYL`7#RU zm)it@BL0P18MflBJ){3Fr(^MtKmP-?pWnKC0p`^;nycavNJ?S`X2hSuNvHpWXQ#N~ zgO&$j3kZ>c&UnjS?MR)f`xj{e%M5)f8T&35i_({-ml3A4k`DitP#@Tncd-?KY`qA$ z+V!gfU?0ztK@VOY|R8dxq$_IG1Ltg|unE z__8F|x5$7v;pHM<%U&%nRv!>^SyR9*uf2P$`h9Gkd*xd9zw2~Bo0hMR zimwV&9BuwB5R|8NKWYAy{|b90GMca4`WYZOL3lulU1ZhknASyNo~70O=o1VMQtM~7 z+3-0N5qRap7IRVnM^^xG(<h^la_-Eyg1Ub!c-W_$)bAGna zXVMllb4JOL&H3y}IzMyO$UK`S>OB()-NynB`U4K64d#cx{#zoI#1)8$Ur9_LpOai< zV9@!`2(ZU4;l!fqyH)%zb;2B|+!lEyk@WlnH~-^a-rcG;H>uFyDphmtr%Ck6ja`tf zkI8u0;797*!~c~^J<$?>P`pj=i)rScMAU-rpKP?GpPW)~TX{7xGu`!es1-dAlg1og z%~V}-j)tE8a|`urKd!4^q+DIPTx=klGX`I+rBdrKhZ?TL>6=V!tXHovym z$_`Hl=b4KN0~t!Y-|av3Arj9k^u+Yg396~)448w~M#k3+`;iMoV(n{$_=eyFj^Y7e z30BlO6xBofju)Q=&fhakWm6i^K}0{-JvT18GiT89Se=nQ*5{TyjBNeuo>+EWcKGEi z!^LB+e@KM&bx~iyUbp`V!&P2DrHkcPbP5u$av;9_!e`w1vri|t`V@s=3_*@_%rP z+JqMLT3*uTasSTN!hZ#twn+l>h$vCJAjMcKU#&Td%ShHmzB$Gj;9%1DJU< zJYwwsxXiPxTnE#GnHM{(|Jo1uIoV*i+rJib!s^xJ&=oddeE*Zw``_83^w-T8?Oit= z;R<^krH9!zr8yP>Lzw%moTWScI@Nmxmv@RlY)*OlDL0x@&ApL-Y-R%C%gu^Jru@NR&zY9!S4Z0Iu)U_pzA~k+qPdeq zaraWyq0d$_HN9=s;t5G^OLfFASUvCTu59N2=0%RN#Q%+_dam%qi+oy~Yk2R(=Hz$7 z6F_D8SSeV4d*-G6i@zjF^0?aDjQDjA2Di1IFW~V&G;^Ogy)~s>caG}QjN`(*zng7f z;zkOgO6eC3PhZzUeO+ah3kv1t{ibgTHm$#!Jr` zmzU8!9Q67fKOQqy`=4DSUQMfk+BmP~*jHtJ*9LiGbd97=2y<74Mam4}B%3kPE8Xz| z2)Vd`xQy_=MOM1(7vStE8H=ThVn7=oB0dS;3+QtLikvg$J(3Y>KCNL8m(j^C!vpK^ zf(2-I8AGxqS>Ry+-CGXGT$NFtV1qzQ-C>c$#kqUSai))pQu~o_vJGRE=SrzLQVH|I zof-_P<3T;4!Xh4ku?dp{PHBvv!5>nRU<_DdxVoeR1rrIUdwf(IxaAtPLNe>yBPcK7 zypvPj_4Fp&*C&f^YuQA$1HFJvR~_Wi*X>-ZN;F+^Y|3S&(H5bI?wZG11$1l=`X(?- z=BXql(R70OJnh!?+QrKL9xk>O+pEwp=Ky5~ZLJ?blFC=N3bY=mD8oyUOqRa$;&LZB zs?=ZlB5He{VD19(mn-t*c&i8YA`7`lF&6H@J6!oQ^)g14djpHw0yiZnuTiS8h`pKZ zh<@FqX0i6Unt;6iN*!%Wi;G@17~S%BU$SjyaHwihD(-U%G>3&lmeVU+ z=vH@2KdTkapn$S0VsnmeNBi}X@;#ojge38VL!W%pw2-@q64SGcJfdHJ^%s=2^=QX- zKbQ6~Y0e~71Wd@!kjcf;32l&iGxr-(jk^dXxB!LCcRFv8iX<%R@sj+@2Pf`?u;|< z2GHA@#v!}Z8D0Q%AhfZZrag?@%Q=#_1CmDXrkZ~+T9OyIxnl`fA+8-#hX<&9wclkv z^{p^wC0}+WfRo267iY&a$ju}9yb~rKie_gX7~bf{+-&hC3>%U{x#loN_`VD)bQ|8D z*y74y%Qp8%=pGttHENbO!#| zs38myXUdPyGNhv&487V$!&c<~&`2s_?~oq~WI_MULqTD`BHpw4SxaJPT{^{h9mj*F z9#Q%!s$9|Lkwrq%^T6!5hvZ6D*ZON}W)glHTUH2%V(%N={1#kEoi5VjU=4mc|MTEG z$>y27L2DRf;lK)Xx@TUw%a>*k)9r?H1@{9^xol zYBPUZ3sqBq6?saSHLZE@R+t@p_>I|WzFhv|U~!#4h;J8(&6tV#NZn~96m zPMDtLGfzw>BmJCkvyzRYw~eXF`T5=BJK;WT!}g1t-fEGfe^kQ?@5T&OrJprah6i8u z24+jY30bmA@Gq_QwxqXjDd~&Su1&sX0qSLhVhmGAyV+#@yV*7^?4~_kKgDdayGSZF zPb`0a$A^kuYN}0u1b>26Lxfp4TrSQAh?B$dMeVp(a%2!DoPlKM9;0^WBM(bp!_%Iw zzSzapJ>2MgEyHlI2Z_ni;&N>WyZ^*7eo&Np_aYFKoe2zmfYC+02=}NLZV8j6|EkSpMdyV6*^z3EjTa%!q#Ug^A zTs^(WU&%A}d>`3hQ`AEHt-tPzGx$7rxHh%d^WJl$tXncBZpBUPiC#JL<{mSOkTfC9 z`Uyvs@~;CG!f2)WX&iqq&=S4eMt+h>He3BgC(tfzmxlDOAiX&a{e+<(mrjPsATr(o zND`KOo@;WgH70%7>6eoOIcy#V`j%+YRGvPaKD1KntJbsylt)T1goDQ@F7^xV^4d<> zGaH?GM8jVz|62W2>O+W`doMUFSD)9jTP1^-Gv$xWp%Ykp^|v@i6whx$2vdXOAynJ- z(1zl!Nh(8tf9Lg1E3oe!M^Gj2w4ln4)RtQXSh1d0$!+*U6yWQPV?z!KAk+zocL6NF z8-mtwqnRm-7Ln4l?^n%RCv3ZYYXWdfeVW!cyltu>Gg#4;DRDArQ5$+ZD*SY4!T(tn zrCdDi3a87frOQmeXohoI{+&%kj$`Up8Xih;Y(H1DCp3>y{>z=Ew@P+#5pSS2H=eEG zm|6rJKmcWwmJ^bQa~A)hp~C54KKGZp=gB!cG;LPhQF_pUjx^p$lF2#>LM9P}0T?-<5k zpU3z6p3>7tITUF3mm_wiU5A+4vgF)QHVX%W>$zJSIHd@ z-0GZ3VlEozA>KF^V}KMH@l@5c{_(I4zoP^#(DzwA!=rEFMp&_j(pl&b>1dk2IGao|R93QeleK2?6eeWVu#%H-Tnt=aeT|im zoV?&cx@k#r>q#MN;~f=|IifOr667btAN|NO**I;Zlw74f0I5N8IfNDq{&%5vb8@8h zMaZm0!#o!p1DbztR_Mh=Lb97c5%&{9w(nf+k}O0LUU(MXc%~VScnnrAgc&3_lqA2M zuROj}ZzP$d`CGtz;Q52Fx%aC2?0>A2+0U~BEU3FI@X50y#!&bq1ewO4DAhF)bg zXFvC$Vds|2!VcNXWix+j`6)`R(~xHV9e1*H2OiXAWIujhTM`|OlDp$c;ODoI403#X z^uGS=D8lCS&TU5C{Y$L|GisNf-bJehN*h8EQ98+|^h$pO3(PV6e^ar1mYgLt;!azd z1x9QZ2WarVrvy>wcOR(DD?|Dpf?Dzr$KVEo#VmNK9iA8WHL!^Q;lUtd zsz*-8pqx3G&guhc=hOS4Ij`REQw<4qNk{&aS(TqlQk&#|o0-oYy`*dBMMCP*%}YB` z0FxB_Rr(%ltQIa`40;zU)$%Ru&S`Ac;&mMVY_DYU?)=3P2_~m z;uP%|CRojvsiPqEd$-$w_P@g9>D9fJaA>9@9(uyb%RjZtYxZR0=AFT^B*!N)**^q> z=U;ODKWLNWJ{dVF21i|jPA{YO=ON5L+1XaQhdrSxCM)#{#KlGDso(c6KDf}s7wd*V zMr_JVra#R$=mfCGKCf2^gk3~l)1)4(y*m`O`(T{Y^GP($4EOyx0AphRDAj7_XKwXx zly8W{6Q)K})Y=t{cr08z<>em>LqvqKiPQ)G(63eRZPLT)dQOf=+mPmE>;05xxt$f& zxcz`hg~9!vuDu_NF~qia#O{dqyK9A3)6q6PV(%2}^090n`7CHAKA9O95nQ3O8hOCQ zMRNWLtp4Q~m=Ue_JxVOM~Q z%O|s5akA~G8my9{rg!?jN&4h+`v$U^DD{$y;tU)6(}Y+7jCuVvgE z1Pcu*FEhBV?i?gpA*jX`lLbc)7E}&FQv2Iz-+vsUCjMr`{MH$xe``pEi4YUL4Klw$ ztQ=}vJ;$uIIX_1k?Dc+rk3ORknemS=`-_=zGv`HdNcoy5yV@ViF0uQ|pHUx1CqOV; zWxJDFkjW-tt@}&h2@BTZZWV(y(ka`LC!xpOng-$WR*^36&grAPlBm!2^PPc0WyQ_M zRQo1zVc&Y2`6E$%iU{H$bUOkOU($TMB`mJNM8EP08t;kc4XV7QHp%Qp&@?g=)4Q0@ zNXsc6ngz#Yw%4tkMVZs)J=N+v7U^ZvD`dphtQs)*yRHs>)UReuVK<33jpcsrm4>Hq z`(BHf1W1WIy>)tDc3D!28?7R@zLiF_))xj?Xjf$oy51ehZ^YdxlSSzBtJ&!Jl2Tx1 z;4R-LWu=ysJS+6IVOCx!Gr0ZV@h|-oOw+ETj!N%>aP`OSV&x11!c@HAm_-_<8ckWE z3G|?9h0t3oHZeU_vuZgKN*UMFy=!dN{(S4oZq6cXeHar(lZ2-1a_tKM7NX-#pcb0- zL>a=!mZqiUT-V7LODG~Kq_%)Bi*brwgisD4|#c$ z)Qpm5Ce40+-skjwj_`i*U>5Z#*PKJEf&V_y?aA?Z2)T*bOC#vcnZ~+A28?d>I>cbdS2@I6AVe zi(>#AGrYt+k2SM`i#B;@Jx9l0kc{~=HMQb-djxkrLB8>pH>?Da-Qnf(j|ThPN2*7fg>n4U@8-W;eY@_hgw`R5?@&LBtAwDHl=R<+Bm$mXK&yqIj$zf0`S7aoXZU&(hTQTUaa z>JsYW*HWJyA9nrl;eULUMgHt-kUN-ofxQLla3r;_HJI8r{`#EnUJ2dtpw>DKlQXUL`olrF^gEeD0xfy)%)PZ(%W0i~ep*rmTguUNEd%vCVJ&T8R z!5tk~^~E6T=ErPdNsA`wybCLUqfcIRQ+uo3{@b^X!H>&m8VoucemXS-lLOK5gbeM* zq$MdJ+(I9r!|hmOnPufrPo8LL{}42Q9{@Fqbn7Q&-8L+va1FLPk+*`61%=GY2{pIX z1edp&LF@_{sp6)nVh;+9r)U-+s=5OkBkKDltTSnD)4(kA>7Q6?D)J3 zTKdL|$EBL8y#112IYcY43j(*uegYhzJyg;MgL|Z}Uq61UmaGukQ;H<+n%@^7zqy6X zWPj)Vd_skE4otM<5aL2yoKL*~z1H9}^1MepSZ~_>fjCKss$RzH^9H0Gl?TVm0W*mi zs;j53@H5EV)y2$*wCy7spGTU0UX+w?e$?$`6o*Ft(kTA9<0<<1LC$Wy=-J6MJ=2P~ zb143A{z-D|`s(->Xu}sIh1(C>a$^!E9r+*QvV`@SF75U;KTgT-#p>Xc1 zT?IiCCAR@a63qS5bH1`ZtU{pacZV_e2AP>e-1>)$_B@H$e#HGagBuJ(f?7FZb0z?E z{y9%P^Qr@wdeXFR@l>B?*>$;?gi)ki4V)nWB%YzK8{l_h#UUv0_2P$)`Tc$gPHcCvHC<|`O z+oO^ej+rCg6XIHf49-5tSBbsgMyZ5x)FM{{ z?!!{PdgV<&tPN0O`+)uhKBG%Z_?-q>&4X*HmO1HNEZy}@GTm)3SYQw5I4<(*Aavp+n*S?7S4I=21T4F|~byI1NfWs_+*4%o-Sclxb zWMj?I^!V*4_GbU&lseZ~m^{<}I)CT@NzzY0IUL08|I>Pl-pG!qO)$!h(s4|N88fL1@L#q(c^F$NcI1 zl-W$yPoC@15DJAlhIc3u2pY|Z3)f6*C*-V~2?n+iOB&tkM8a=oC!h9yVjh4lWN*N;XCsNNLCSQ=S;@Apll;GRcOu=Ij^5tIp$X(%>{d;6pR~2|j)HgRpf*r{`#lq_N2rWo zrxOBM`A9|+_mAlGrzwt4z60q~JVTey(&FzO@Z;Pd(1FHgv<95VJUtjM z!56HUU*R+BtCb`Btjefyw&gbUp5HLOQACCBK3%v?``<|?HGHa}_2C2HbJ7n0U)-qm;%2+T3|ZxzN`L zYW)C?Fz1%9>R-a={(UJHgw*1`2er{gWRS7I>rw`KTALFME(S&B-Jo#(563Af7$Qjduh#wlfKJy4!y46jSTVuTJ$MgX$^Leje zpKfx6^jnnxU20*!xKvPiqFyrX$b6(j;F#Wo!wr63%(Kx5s%w3%+v_j^UD*8Y52f*B#?cOODVb9rBtVbC~=W2fk^k> zLmA2q_0fM9#2^|uZngg1m*WmYG8=ju^L_P$AKcuXJqI%liSjrp8mK@1bQ}5fh#C#6p=YE; zG)B(?W&P1EUhC+vFN%Vl&oIMfE7iNfqxb)$I_Ev&aHVHlA=;vv52=}oQ^lzQx<@q# zD{!ggS0paHQ+VGb6kblzBAOj(^I`4A!lnY85k+WWKk;%~f?UYlntOjamBf6qltnOj z-^ud4;OQePwO^7OA0@R4**Dvt`iF#K?(cih)wxPe&uGczyn@UlKPta(oLF67b_9jT zqZ+8`fAfzTn0gfa7fYCfFtd01@j*h07F7cuaZX6VR%T<)|1`pRG=Q^FX63#d^p|j; zC~x~;FMm6+i1+TbV#qQ~(@%Q6gH2Y#fxuT{LdAXaJ*aIe>Y(*SYcc{X7}VxxPp=XGNzN}m#FW;auxOw1WjW<|~I*ysp z9!m1$K({DM_|)FYUz;`6=squrVN-s-mrjqk$wSlLCH)_FxAZ9@j92L5oCt^L5bJ=@ zPr=o7M#9#2{)ukh82x`0-B6=KA|$!9O$M=Mq!?UQ_3ouB^I~?$&YdX?2WdYv0jn(O z9HlhksMk5-?f_k*P!Fx1mR z`DEdPl^5QOBwyj>oF8wv5{3wsFlCTCMM);zDl2&-A3^Zmpus0MY3a`@$}?}3Ga*Gs zQ+?;*ew=IidnZD)%)4F7LqXM2ww9-8?@Uu?uuByEAc9V(Xz@bF8uu(X9yi=HQe~oz z>Ff%8`V8YpQO90(SwF-JPQXqpJB)Tb+dD)NeTJ?6bvId;WQa5GdE3TACSEOkl;lgR zriIO=({bOet*Nza5XHUfpnkEM$`3sCTho3`xBK{GFU=P>9C`#S&=(hFf9|*#6CeJB z5R@m%i`3g_$Bz#uS_=-AjVF05fLLC(7!vr{;y(qz>f@(tbB-cL#c z{kNI@$xEn}zuV?#ih1nI?mh-7hhm6@vj5|-5=_&EC`v>Hjt!X&8UZ4cGrpVIKcA!m zKYl>V`U~(5HQV8!rQnetJa!9D{0Klwo<>3fc(ckD94oLE>Xz?|vRc!8tjAK-va_g1(6<^go`g-JVI5^c?3HK!|0=FUI%^82)bX8wwKFy9L7~c#R z!{LXV{EBr(L?7padI_?d%OemW+#A3XMY#tcTzJ5mE-Hv0vqv;-4P|ib_~6044huUb zv37~~w4uda+Xi|S?SAMkiy8J{csMun%$JeDAz9H;DiSS`k;Lcpi+Z+Pw3bK9dk-Gei`tdZ!~KMfiHDrRecnlT*A@J%a&FpZN zZ)PHIoiC1v`uH0d`d2&eui%~bWhFMW+Au8RUv;T8HF~aPBF_rjK&tM|w#2oIY3y|oe4v0J9H+&x3_L_?O3VvV-0S(33ir83A-2hmb_^a33E_l*dX zg*C`I0B)kxYK8pD`_nmsOm}AgJY(V0VCJT8Mpz&KD7FdkzoL^)*f`aF=i6{oqF_{Y?dz#lzZCbuc<8oI_INl|2{~h zhQvg!Y32lORb{Qp=?xal#X7qe=!mKv8Ea`%*D35>=Pi?r0j_Hm)&9S2qX?MKe_ZYDn_AMGjeC?`xS+unOx2Jl%WZ(skgv2q{j-eX zP4(PG^Y_|!d?TIOBPlomAPPY8@+L`cpk8j9?rLTmKK1Ybe%$X(6lw1}vRt}DR^*CE zAo0TAI1z3rS5pbX8b(d-qlSW8(wi`mF6pQZoMvA zAW(#QH-!488nF^dWOo9Qi~n}Fng)s{zbvr)Z8YaVsJQZDTaw z$=8iAgA)}!`mDt-Gs|>(QgxZS}Wu2`%X~#@?=)j7OwBcm+h1N7AnHk#HL>^ ziC<`07{ECpc5`qHIw$JrEa(f?Ua-0UYDgj2!)g-K<@3SGYl{!qPjEWby7+m9A(3W` zylz&mJQ3bVq9*tJF;Q`9RP;VB9A>EbO8y2ZuWuEeZLn*0{zx6Sbz%a}_?e3DHb6eI zGtCIrIavj8WM0p`_o1AUD7cwFywI4f=1^nuV+yn*&QR*3d2!+|!mhfQ{kZ)1@uHfT zFJx$yl%kS*1t%0V2)T|K*B@QSb}s5f?i_ReX=F?z8zxx=aaB8yWm}eQynb_$IMha^ z=`XIt-9fl9KV#UQ`n_aAhI>vF2X@@_m~MR7c}+p>y@Ss;A$q6a^@B|l?PYfXoTY+G zsrz^e%9>5dPi|M}7>Ch*<)WsD#V8(Md?L%cvtPoxw{OHhRyw+K+m@&A>V~KVcr`N+ z_oyK^uaK8s7`LJnRJXa3`I4EBn+H;k~@b`TLr@TkT+)0$)?-Jmp?5(T-U+IOcZotX*A^ikFVo%z8 zJu&gAIK~U|=*%3_=f3q=LVk}RA=KH?xzbRd^MP`3N zj|jqj7zq!nZ|pZJIyQMk0wLsvBc+9+KX8(>l9-8(N7$>kI#rV@{%)#w@4fc3p8Z>Ejl$m>96m)WsgRm9w{{=g-F;F3RZ$sf4n z4_xxU3&Q?^Oa8zmf8dfoaLFII*+S^dzGVWy zW8d+NV2zQnYI^X`p8^z#^sDlt64BWE*a=1TJ8+AwF}U8%g7E1RpBH&tc51^0WTeo? zM8Nk-rA^XT?>`2(Q|jo7@~Z197lrVeHS!l~)L6_EeJ-Az3nnsim@X6JRn42tHE#AeF(8C_| zLD^qpsWH{9`2=7l1@!E_Bbs`NIv>#5wp5qr80+^i{y3vt-_7F1X;N6D5zd^S%kr$p z$oqY^%FJ<1*aSPpWD&cOeqnO%9or84ancR}`PvTn8(U7AQs^jqbc=oxMtaCsM(^97 zobJNN^`YZR#{3eNXyP?#*hke)Yg6KDka3pgO8TFW#g}Aec+GzL4|hm80R_Xn3z-!g zm#X-;9+;%QrHYi>=^c$0=)x_=E0+Fa#fS#eK=aMGKiKUtkOJP+U+DJE)T_rgXS2?0 z0St)XM(6b2>^_@+VE)vU&Uz?CS~g2h5xg>ogOa9hdGUe`a%JUQoDpw{*R4UVXAm8o z)sBDGrKpE20`u--0)5a_(b|0+m2R*V!|4R!5S3|-H6a*3XRAjo-eo^t{zLC=4Ojd8 z2tW8pIAg&4=rgTB_*~ok7z&|%G^hZ?lx#_p1k4xp`(?2y3O6nHHOshe0J_LYj}QLRY*KevwyuEZlllW(PFlwzp2^kO*@et%<_ zqo-Pn{8u_3#oc;q0eYc^{8I*$Qqy-1loIGoVs+$UQi%q~SXjT{wwN<6?2#Wv?RZ&H zH3D*JUp1AG`PwUd^Kxf(Tp`#qXFI;JLzi-X z-aGMp+sDUILI}GG=Y^&uY-Yqr_cJU87EEc)=YKWm&GqG(a!s1AZ$?Gsg6(i!M3ObqZVN^_-3)gB@@X({A`g@0%nsnU|^(UFT zkWcT?)K~OBzQ{ofi3sjqTHQMcqtwq@p}y7PrZPk(z!&|__T|VwfhOi6NHDAs>tM8e zr(z5#2hE14H_8nS2&C8NLRwCqLa-jFPzZMxkG3afHyD23aNyG;$}LDOio(n`8gs^M z-r`{lc+V`=i(Xa5ZnKl#!IhYhw?;s&7HuTY`=;o*S6K;_k#jE0dWc|@(~!w3k;090 zNJ6hdP?U$|1!=R{&tZPinc8A1XuFrnYWBqk`(g2-3>7;`iC)0iX<`w-h?VF-II1GR zI2H3SDaG@B52u*fqBHVcO7A`~VYUuYd_(}B0c89J)aqmqHjc5dY4KnLRrqVm6YaU&4;4s8SRh`QSq#R5< z22{E}nAD!j?@WsC0z2D|U|>{CbnW}`2~2g~{tm&v_YLXxQrCR>$v!2+UQkbd0<)gT10-DI2%?+t6R~dt--%ny&2&YSM1-bY_S>_3I%=okaDfA;ZnUtM zy!`dn^eyVgUNQaW+6n*uWJnKJ;FecnRVt4=4y6`!~U85~h@1kU;1Y$b=} zTZ~94zsX@$(o4&+4-XT3GSWt#xw^oa>rYB@+&8$`QL82kne;}SEJz60;Z;ZedtCrk z)sYzYYH7(I9mkE#s)Uc~s)H6f)V;rD_QGpvhZ#RBA^V5h$jMPpx+jNCl@78|(EMmt zkd0HBsZp>HAqpsH_9nq=sYSB}?4-Y{-?JJ#B@YHN&IFnbf$LXJ{C@mmN0f_nGo|ah z9~^&SVdQSk?qP`z??Te;XbiE#s-J_lJ;N}R7(7}<3DBji$fcIUedh#VO?dKs7ih*C z^L9fx4<|YBvncv$)$TCf{NB4tp)iwppZ{Qd_wjX@G6Nv+uX|awbTOIWlAF;Yt@!&~ zWOw==2KGxESWE@DkVpzX%0^{ajG(8{jD0Wq5e4k&ruJ?$YtgU1%Rz7OVXv{I$-aeQ z81|lRGb&$whYq@J^*(2&iTHz{jd)>l)lI6mbY2*Y4*2QsX%bB~11`b?W#vXhL}%Ut z5Yq#Ce^Ed-7M!BGUCzQX4V%zZ~wX;a-O8Y)+W&cPaeD)+4p4lZN zaVR{4Y+7MUXUppse)kZ{f-sn`_kl#m3AFRV4S_a8NzGs3Pl-8N$z~c;jnHyAe$sAS za>m78a^|HZ1>`ry{vB++!t4ELBq1N;3_n{~yU$Lul6BF6(2{;SCJW*f+Ohy8Vk6#_ zR~@O6S-6r_IiV6_QdXB{JzAoDG_KPelik{CW`Nx)t{gd0-AY2oTBtoFz;b@~>V>q~ zmmegM&q80R=Xd!L<=SD^9NvU=03xSQ)H8BM8vAvSvxl+oo8L(vSf;S8oWWzH9NG9= zI^EZy*hFv)UnA%A*NaL^yq0P$l7m14j27VgA_V??G|T&eYwJUUOtgLL-Fom7e*b(f zo)vSQXfido+2Y$E3LW{nZ}1aQ5kE-G#1MM*6cFGK6$-|XFcY>@PKnJ1tUomvQ-VEl zY>U;^hZH-!M!p}8DR#H0qz44j_Y;SS0q44Q6Zc{Bh6J0GM_2t->Ip7hBW@pg-f?DW zzxw+)We+!mk62RBW8wL+*89pl8*7E9ejXrt9WcU4Rm-;KiBjwPlu5HmSp$026|uQ) zQHtrm>!m%>o?IhAhCXF8rdqeJ-ryoqA`VM~OYrJ-7=xV6EDXE` zug2w=1`~fbQ$B3`VhJIR_se4a$%uV;i568h>z_Zu?hjKVlor_WUvgq=SQ>DJ$)(5* zzgL$_>f8UlHgwd1BLp@3mS~Ac_DpC{G|TxhdTht z?`yVfh`ttoF20fiq1rbrSOd+%k|QO-Y%RJf#i|ey!prhQ*g+eS4@`G&&D$vT$Pd^@ zPqi=kFn&CUWP@u@f8K1S^p{vR+G^)9 zLy5_tKCJYH=@rDe+Upp0GtDjNX$E(Rkk5n|S*|~@t7vP7?U0_2cHfVTms}ZOl?Q9x zAd@Z?xvS05h!mR~wSnT8CqD}7C3GtpzrBfvrM z17M=Q+uDgFVwW#uK|F2hnCu$l-(AwGjM1M-iH??-c5E*Ry{hiGOSJ7j)#H6SA}P?^ zMn!~kX-VjDIl;((eKg4dbq-f$ETc_-__qC9271NV@e+PJXR+Sl5** zbbTYmI|~wY>3Kl0>u-Drh8^O2H_MUinfaG%|7#gY~Pjw859BEV3@N+R_iJ zAKr$oPZZ;>J0$q$*-eM0734BC>@O0*&-*Ri+ajgW&HK25eEiLX z4UKVZ$lT>W*%Im;VTVUp zi-cTjiqw=bXb3YW`2r+LX#wgoyb_GaBO#P5|o-$|6d#}7OX z1x$?2_UscY4#K3DnI3|p*@LO?PdfR_^BhMMRV{gaI1Dzy4Cn3Eb&{)wzJr9t! z38aYWd}Oo?I?ma+N-@9*l#?I_=KpiWRlLsE8ZFMpx$5*^HMxH zPs=b1DGJ)MB1W6RGEuHa>Tr@(AOI;HIS!P~QrYDC?jH9Q^2Aw7SV{R?x28r0)qj;q zG?g6xqLYp&f*z}s_F1IRau1Rl0ZEOut2R#L{{0I@qnvQkqgE`*7CcqV55b&LOfHubAwFORNH-CIE7tNut8;?Rw#23mgH+MYCU&=+!h-}eP7 zqh_PS9$%L;SN=!~uAB$G=B;wosPmUpoxMQkjpQT~bqGSK?m*`ixiAXR{}{dKd|5$N z45l;{bXW?Fcg@vCepkg{KzmW+b|ZDH}X`!I!S7RXnKp|O^9XZ%$D#d$%e$$I73~1$xcw9 z8E^POR?ICkiLS87GIQFW3qir{k&oHknrzWzlpo7(Y9S6Rf`0s^2xTIn&%R|HPTVlR zWhXtG_?STy@n`g2-oRn02>QG;`dEBTm)u(P2sjE^KAEyNEN;1t2%$|(Pg**K@zX9e zzCFHBMxJn>mg)BS$iR+L97w()5>Hya1^e=S?>ze+`k?qnLKgdmQzo3krM7;2K|J%0 zh@1dL1Y(3RBcQshJC?L?pcU|^eG_>-tlvo#p%&l6wz&GIIBfg^Rg>TH(j(Y9bRAE) z-6Y6%S+K=9?c>P!7**$991(mJ_r5#3t*XF1^W!+(B}7v7uYzPq`$f05+?OXJeFKN7<4RC`v{p4M#uDjxe~X82XVR zFLAFisO!^#2r%zcj3qRWaLBjQi18CzYbZweMOV%Gr=f!YRJ7S0$9c_&i6)sx9m=9< zs?TFq!J(N3guHZm>4*`e-RN$5@hUE2Zc3QC)3h%3wF1iue!^uS~ z#?$o`O)p-Q6zU5FD%Fy)D($d)Fn?OrISQj8QPweCE)|+S5i)_c)ut9R(-gU%BaIuh zsmn+n9CA~GA5=3=UH?n$S6VLsX!bv0!p4kOi19BLdm>3!OaM_+d|$M0;o=9Fk`@qE z3P`3pN4MaANPc(arW`Xn$6?sK^@@^Xc^Q6g_sW)NiP${pm_Q=hJ}4#(JIeEO>Y}J` zNrMSCR0D0Ni#*;~4}Nn!vPH-@(-7(T0^kYD7L*sW4Rs8V^4?+8CZ|1P^wL zlOr>)eW#>bC`bDLsau5>u&jIReNcKi=CyZ`Q_iR>yg1J>Jc01MP)w`V+l03rT7Z{t zh(+MixROy;cRsLd$0d{$UO!K&k1^G{7_3pw1Uoln?&(NM zPg&#kAXgPn2RX1Bp~l#!O|dX?mk=8f{AlK$6%59#^-V$^d(Fip3FehT**IiM} zJ{{D#7s)Z28(cJ2X2WdaKprFiKnu6!vKxBHtTWgu4l7#i$wGBtDZNs5^!+o5(1^3b zG1eNp?$Or}#u1UJLl)oX2Q5^V#SxgN^@<$L-S48`gI478 ze(ZMJ!^y^^`nFtcFbHLZPp4()%rn;n^ji^4rFr1r?ECqC-FS&#P)sE0+^_RduaKvFLMHbKSg?xwVrsNH@>%ps>)nUw54665eS4HLdFkdl@R`Q3J? z%x8-vcQuqFUlLvacbAfB&XydooU~}N&{WyRSXBP&u$1aHF}>@yGwvV&OAeYI=Hp7} z|2AvEgajTB1C97akUfU7Xg0Q;>7L!Oax-Dfyhqer1t!EX$4dO)R}uN4Yq;?B*`Drw zcgxt)f?1~96Um)6v)09;Q1wU}kY+8v>Rn#| z`N}U9q906=VD~P>@4d1fWBj7LD{6tLid0iFu?w03=@b^+*w7(h zD~N9_jK*0ol6DftwGn=O;D!V1Y1MJ_(Ur1g?^HrtG0PWvY!&h@(l|LoAoqkYT29l&T|3X&KT+{s!Gzi*BG8&a{sdL!l7D zXkJ-C*-C-KVRN^bbFH9diA2+{`DkZoqs?)4G(9>h9+n7TIpIle2HpAR1rvW)b$wpF&4kNuJ;3rl*JG^LAvQ|N}$e)g;W%tTia{+gYbYs@=ZB zWmI2Rr0w{Rkzsr}hQex>ECGRU9Q8!v;v3)ePpH`;G7fm;ZD(cg$0P@gih$>%TfoKM)5m#%<&CsMzc_?TvCZvxsAbf`!GPu8U#iLvyv3JT@NO4NA3AK1^73c^q&UgCr90Q%DR$i_L1)WFp=Vpagy?!G(l;%; zo6xiDXk*an##;yewNLwNjmMIH%19$gedxl3n3bPVP6zY#Q5i0tBLrPDcy!n(Wr;Sh#SjVyvQO^jPs(}T|=2C(P-Ca#9)&c3N5FH zOf#f^4dch|*Z2?pLptC)R@HD%GvCILC;(an3-gT0a%XWI{B*K3vWCLC%f2OD^=!8l zekw<5l3!&CYvjytk*+AkzEFLKEUA=Z9veebA^^9Zmb1eBqa`HRqy`70-2l(Xx<%vV%pokP|yT4R=j%bIIrec1~~ zA9L)K06}TEuS?r(vb)s+RJTBrZ+?dR9<@Z_r(5u9L+jII%Sa=D4QeL_9(&lF!HtbE zEA*u9vvLt6_o100R-Nu513y6nW$%AScQNy_iViU$#j>|n-0+>6+PsdXeiL%TlsXq| z0ED2ktl$j4{Zgs@Dk^x<<#g+*EQ$Rh6RhhQ7pfvyxE2u>X6l}%!7#Zmj}B6F$bp-d zUC4*$&!-_%v`4{6aY@gQ2z1Db;xXf%3o|W;Nw498@E)m&iZv*8efj;67Sdqyr3rd9 zb5(fVU2WSwpH4{X3V9tErN$=yy6TY0dERBfQ(zvg$k+-`?Gt{sWO;0_^I72bx{Nig zOZ=_F|5Z0ms+(|-b)9(G(=7f+PqP@M#;9lw3-8uR_gfm_0b5M(IHxUhChZj^WyNX) zKX&dd(n)(M;?*X?d(aGwu!?=E&+LIz#BQgE%;ATqr|D!-f5F*K8JHDP*XCYP+Sfau zKKA067YDVnvOM+^5U_mXjVFa{@gKB+V~Qh4cN=Q2{gQ2s=XI#niaIBWIbhQ3hKcj{ z6V5>v9Za+=}MK`M3|F{E&(2l4tcBJg+`nPJ^6PW6vh);Kzu`a^tfxh2}W z*Q4>X1saCUk-tY()AQWu`nlQRuI_1f7Xai^KOpZkv6NS1B@IX2dA^iHed;RLN}E`>u4__g zx!GQQN>+IG@o^vm%CU{PTD3m3BtD;Ad(K=xC0`3VUaoZ-I7oPut3sBog2?W7vpSaH zsu&>M z*xr!?E+n?)_o3Z#5ZPlmo7x}Zi)fh;UXxM?sQV$*GU~-1Dj&e-VR!j$NV@cMMpt;m zG0$;sP*8%BD7J$GdBT~SC&OVnWEtFQbv;x+JE~G#TVM^mIh(jr)6sk^&xB5Lxpbc8 z3$9oRJ0g|SX%q6^3qQ4bDiywwdtT$u;K`v{vZ~9xd(iZ`HhtQxd%CH;@!MH-JVk6f zhx2(#&A9)*!>rpPP>waJQp}Y_;(3^ZI>x9$(F(hqQlo%(&DSDwmFSS!le;nNmGW>CY>V9k$499nVm62Fe1DGXMjEi@ajM`2o zAm12_>?Um|iP|PieHz4<*%|2gLJ1sWEfrYX8xu}DuMs&yifs4W_UtnD1PMAM@L1Ql z|JEGdZsiaELe?<@W*nmlD1qWG+b_5U2e~LF3&w)3qOz? z`v*QEZ-x#XbS+0kpGhNQVF{xpBuzPMDTE%wjWZu(KN z$gb`!zh6F)zY2(a&2LIYdcFK)ZMcXkj;{fA&?wd4JYoVXf?@u8L$r66G8)=ArK%qQ zI_{)P^xiHey)p@)0Y~UmG%Q)MBPHzBr2fwu=e|5X9N6X+;-No`nXbzH@d4>zASWmFZ|rFs#0V^m?~eF z$g))Lxku)0|A=+H@>F&|b?o}o32X*FJ@icEZkrW-292eG%t{Oke#2ngLNK9OMs1X9 zCZEp&JM|n#f~}ExbOV^Oo(ox{GFm`DJfWG@AaC(_YMCsnVzbPiwtOs`H!j zPne3PG;GM)lZVqVKPFkfp%})RU;z|SvF9<%ck{Px|B^%;xL1)A*eFR+As=EKInKG0 z5X^HtQuI812qu9Nn)3H-CWQ*GM29C|+IG`e>@1XGF>^=szkIQk zUif;Xc7pgV0@Rzc5o>8dY4b0l>MI3e5A+4&KdGvG`}STEqD4f-e&0lFSvqFM`PsaR zJYvDZb^5*k+t^x1X_2Y3*Byl`IMU%C&YaHqXjFGUmHux7PJ@UY6LjwT5!F3P>rB)p z;IiC7ROmqHH89O4IZvMfp)kWdz~dhhX(Zh;e@8QF{1k$8$(>sCnW0+O_4Yzi*zsY2 z=zv?so1ULb%+a0Q<2Sl%{K$R5^K#@vhwa0PC4{4Wx^_$u zWlX51)!nTwsly3&@`Zp9S<7+fjU`#;LmwI6gX7pJqHw3h%nHivW2zi)%Bh+CDwNAI zy+PY4o~`#Weoh~sR$$rzx6@8ccc19(lc(RNP8M29vT&Cmg zR)vT?D`cls(|o8K1GTqmTR386stePl#nmHs<5|TvmwZfHfJ@g!{Bu`AtT}2z*0#Oz zEYP`v<8DL4>q0moyeaV=jL8Ap6m$9RQFf-OaN} zM8+Zh%>umDav8K#^AOkVXqdcn8hf$y>k`q7Ky9y;lYN%-2#alPWIvmq9HPneh;ltz z1iO5WJ-e7}F~gy0bNc4GR`|Xrw(Y(U%pF;`%y4LG2uIeyes|sKd0MIlK zs(kv)AYnCteePZg18Yb;Xg{Ha)X5#K|8zEp5)!CC;WB>MsoUVwhtG1qK~?o*v_ zx{m2_(#BeX=pIO8A$%)3*LWcw&`Z@5`!P!QlShQQ2`mQtfFG-DT@B7Udz8$#4Ob&P~^*x|1YBy;|bo`;#rhIH69DDGw2?15zeE zcW>>%xfDnvLOHchz&ATAOPF2-E<+`1RLyIyIa?POD-SsCVJb>Io?Lg`TvD3;>&o{> zNgBUD$MG->hMG6^70i(@$K3pdTJIM=1=L>529H4VtrrSDPwQ#rC=QaY@TeR+M9g5& zQFK+edGYVBs{}e)s{(Sjo!*_1`8?g|YH14p?5bxCwDmMN!&~8h+@_@^YmQ63oTu>K z&eQY(OZr^LX0{>1mzQ)kDOcDx(Bf~!ymh{SO%1Hx~8Nt8vLuVoEPPZ_5Vlu z#P`)-R2G-X(ybk$B(n=&er5fF5jx|PCHMb~W%+Je01p*Rue1Oea7+zy^mVdEY2_Qs z`cdCSvQtnAu0KI>;(o@J7i@QVjqmpy#*X67>&S6z5L#4kB$=M*!E?SYZ&iw~%4+zF zm&bg}Z)0_No*1ZN5msTb4SnVnU7&| zBZthyYv*HDnLaKadnb$$<0W%BbGEX&ZQciW={}7boesC9y7ww0P^H{E(h%Ou=kgo% zvIE0aAbq@IfVEM5YfFdBH5WGD>wC^Q4}0g65*0daLyOEG6I5LD@zsxOdvQ3^*+tRk zviIng(Y_(#68^A;{b-_oY-y6XXamgJ0+whvFFss_X9aNU0nJ_n{SxcOXJTnBs#Y#{ z!el>EB)4SCm=B(*zmGI^NO`yOGqivrf)%2T){YcCPx=qii_41g=#yRv;jLmUfHed9 z@53FoJ5GD@7E3f;<70gJ03rIjF(w5F=<$K?{%O`YWVI)_ii68A`~Cvee^vN|<(svC zmBo%p%L#9T>ops$1`;h#!GrIIqFMoec{Va$AMp*Y95MR-RwtY=u3L~91@DL6@}>Eb zovD@cZB(;su9E{>YoVvBZ9E-qpFTir+s(s6gXrbYh}ovLTP&Z8)J#_rn3H5$F5OGx z)IOFjqno<$VRu3A%f-z+?%@{0Dyps&QrYh`voScpWrZIh6p!jcx?nF;WGkf(2q%GsifzfR3ohxE|sU^GC7ch!HsEGbhEhPQoC zvI)w?6zmuH)l?;oQ+L2zlhcKhR=-a46BKX!1BuOWxc$pV06j9SDK+t@!7(y!qqI-D zs2jk5yr6jCcteBH+pZ!`Dys0GJHG085c7abmenY5hr`1%zkJ;=2`a*&J5wlRjY<}0 zDbF0{;tnsr-SxfrS^8*YOM~M`?yA3-oOKg^5Tq0eG#d`h;M$flx7k;w%N=Q_TchEj z-37zI9NDg+*;orZ0`Gm=8lO7wOrEdaoCk#14L#lq-v>QEV3mVW>!8ZzE)Z?q0Qcrz zG-<)A*LDft=O})nh3bnf!iqaI7AiV2Z+bsT^yc(5TJ(T7W(Eaoc;o#H z3B_Z0t+-<&1ftoBWM>eWgoG?4+tKCUhUni0cq0qX*S_|86VDnbS+4PQNd0v}rxJ@p zMojHyk)WoeK{@GhRxMRMG`GYhY4(yuC8NA>a#* zZinNOaYqj0p#OfAH||zDvSE2G6QN8)W9OB|8<257bX_p;t;Wz@1mpW)$|7NFgT$t5 zLs_nYJ#pF3#LpW!TDkkuFM&oz0#o2=jc8S%|9oH!5lNQGAeT4_%qARt8O4XGvZ?6_ zs4~Yy3@?lFjJ4gX z$30qM!B#iZ3TxHkt0UIC^y0!ty}>@#u;hHN5YPX}E1IdYm0>RC6su0)71%T>`0DZV zdLMH*t}b_4u{``^p9l#X#>^Gns{+d$>Pr#rc^%9{Ce00z zxLM)D_3`oLo}ZJTG7v#|?g|u+Du&LhIn!W5K9CF%e{M-r$IB6Jg9YA)xBiXrCka0f zG=GG$M0kr%4Gm}8Ei)Y#n}Y^ktR2y>s@ArMI8NrVgCz z!;!wIC4D$+Rxx>WL3M+qPq{AIf`|S4_5JFR#MhKts8$~gxmgY0t}t|Ipldp)Ze$tB zVndM_rr@*%9V^2xD?r|+kQ_CN&YA$|Eci$+WF*9WzJ~XZ#t-s_S?xG)YRt^@l_e3=F1;z8q^F{orQuqfi4dIo(Mo`u>q5%lWeWT)9q`^)ZwNdBl^^}8tCT62@f6@@-gI02B(!Iu|KReVXzEF-g_ z17*j@5@ccPEX|0|Q+UH_I%eLl_eUomV!0)rcV{LTXnUA1O^?=n?nA)BUd|883P;|L zeLiQsmzD^6(1*fM1;~*%`2677i|L3Lj7(WFo5L>&o-32n^%Q@eMs<*x zjGQTI5oLlHc0b{m<}aD{Pn!5F*_xwO1ynt}77l+^--ti-l!FgXv}}R7_`g@Lzy`gy zMinEj9U@h7yzlM^_f~~y zhtrEr==vEfD%AF*2O@6CLl+lnCmhFk&2F;92K8XHERq1#vVC~<#rA72T7b1`tvi*3 zKYu_6kwJrzehvw9glcHc%-*+!vkfOfGDto&BWdU;eN66K3lgsIdK%YtQro^s)SX|M zk9eApv1?`$D#GbJZf$w&wk$qXUUl9RH4LD=ZoA@7Wbp*Z7xaL>TeT3hc$q%*UJfwW zCdc1ZZPW{P%rI%K_|7mbr46u%LOoto)_s!?hqf0d)_Ibl-Q~Lx-3}J6kXGan`k&8H zs-L`&(`2+2v|ALm=G{U<_N_c-zl6IO{-Qd#V@}LA{%!5q=@1|5aIQ%UDs4k61K^pE zDdqfkpOd=U@p<43TMgagqaq0_8#?yoG-}`qD0-oVW34Z>J5O^LhgOsHEr{qxM8Ka* zgI^?TOCq(zu0bgi7#Q;e0_%o36J)&Yc7HksXS}GK@-@^iG1nje9|aWF!td^vsK4=j%cG~hjO9aG=!~oj z$^tZgB-`utzS7EVZCN6axZ~htKFi<=;a&}bG(4_9b#fd7!#1^Hgb#L zI-paO2h{InbWgg`ZZ5_I{@TD=b$kv7O zp3Z#sfV}ZJySLjK^W41Ub>rUOQq#HJ$ZT%R@Pd>8P&4*Cu&yTf zoTlvno-Ji*y*O)gJsisrxb*dD1TD2fZJtCIZkw(F2eCIPA?r5bLzb?0xKe@t$K0Y- zi=lGOln(0vSG(eUb?r>=_mf4wAc{gUH1_KhU~dE}-yE`X9m9|qhCy$V->*0m6@2(n zDW2T8OktaTp1fA#?qdWQG=}3WN5_GWfuAiUBnXwpUQ{tJP9YrVwo>#3Y~3{dHaz)> zk>@WpphI-O7Wy}Fp!n)McVgqC{gi5*Qm^ISJX&>#IquwoR&4$*H5pkj<7haWKNPHJ z00M!}q&9U22Xn(#Ty78czamV&vM#QNVSn2%CC0D&gprf=^=te9Zz0V zxuPZgV(Yxug+5Q`{I>)YOESfIE2gyo|5aJW+j%z5Ti@@N!Q<5j9L^kZaNoK`nxN6l z+iHPUDumN>!f2K zQ1c>Gtvpibo}H8=`-VX5D+#0Rk-U!IB?$~%PNBMhCF+W4FI=+})aYyaw;JLuR+AJ! zm25<${!J?n7Q{-sWb{QI^7x*6uMp|G0I5nemgaK}=!P|}2@IZP4+>g3jI%?#)Y0}& zK1+xr+^(vBlpmSNrhNIzaX zju=^HmXr}4(>b4XThE%uDpRNRXT~$os4K>)4{{=Whf#MNr(3A0bXiad>t;sj0tAl_ zyl)`6qihOIth9}8M`v0c>c7*7sVih|v&_z))Utj^ z>M$=%l=tL+@xC#mkUyZ%@*X0ANEw_~x~~O@f^vf~g@J&B-(|9EHfj7JdHZoQ)bd|DFgr8cR$e0Y4wRP+JX+zmkvHVV0_| zMXCWVb$lLW_)Ez3ULRvfz9Rb$2N07uDO4C|A5Prh7_NdLq?&n}T$QpE5VGash zr(dHyvtms*==vp99-&y0J5v~`{lrixecK^y!cLa?VocBQ zv}HmZ)n**I6el+Ct)3K{u2#{fuIVNVJH*2qOxZ%=jS|fqjGw%2dXrWLE(}BtltvPj z>^q7bfbuHEjAXN-*)Wb8*4J22BA0Nke;%wb+oNc$pbITm4&g2MU6~|)A58}Vl6zV3 zx@N@oKpR4E_JpySZ~@dZ+hr1KuOsammdX+ih~|b3*o2x{H5iAT=$ntKy8=9hpntKU zRWsi*gxkDuO=_Damcav;b$#Vp0h&PUAQ+6fiq?Rk)cR)B`fq!00WDV0dtu<4qtF^u z7!V{}u^Bvn2Phu_jLiSN0%*=x)-AHVdwTxiuMN_D?;E*Ie3dAA{g13F>j_aP1=0ajgU4-z&=7AXmPd4*rtW@2s2 ze|E**#NnJTzQ{G|^NbRQSb=sMc8EDV6)BBbVVF6G2{iJ-ZL@DE z*~8F)ER)REJG{MpN?^maeE}aCSywt zy{THZf}QLe?Lr@!7}yN2D=60vO0CncixsW~9jbEcJ7cMF>(}}383URuOcav#^3Da9 zplhupu`C<>7*5(+dSMoQgR>m{MINPmIgvu?+oltj6> zzqCjfyR30^fBB@hRF@^glcC~qO9YU$7R}=|Yc9fJBduaC_ z5RqCd_d$jU5Go=FoRYb9ap3x%t5{H>@-5f<6C#D?&FK}olZ2W%ILWgGm(}gns|{W= zPhl>FIv!dN@;nhij0U%@xyAP^a>F81%hJ%F1CF&fY0rrx{RkH^XKHHs^wh?!vB?8b zL0<1yl1{yu3E*_64v)5JVQ&wrT?NugPz#!F57QhuOlnBmE_!c9h;lTq^=cA?tD!%J zZPyt>*>UF)wuG|dx|hinX_D5@^Cwj(>4CvLzWGx-#GyoDJA;#RxQ})43XW!9%VbP^ zA2gIck!v`3P|`FLM7Yw&2rYvCie$}T_PiMIX#p||Puyv8ixsAR3D)pr80;jPuwzzL7Sl4rS2*`?ZD}e76dJXW zcmZZ^U&MP!KC*w}2oP6}R(BlP+#K%L*#y_U!yD8dtO~r{52Cs=BsYxx4K|<}$1G); zClUv`@-E|Iiiz@lcgezlw);@t!>ABW7ow8-0;Rhu84(bAf*6X>=IX!HxW2?{UBCx8Mx4n{n^E^e&2g(KCSM=S)r zw@L?OY?JQ$B!-4y+OLj|c0X$^2QFi_hcOEvR+$dpz(`Cv^7KQ`!|C>tgxW~aFO^p^ zuw``qF^}JU|DAGij6v+`t{IKD@DulqKl}ieat!4I|0l)bOWE&d4Gy={?XStkHaV_~ zuzvL(=pODMgxCLH?7d}FTx*vtd~$+>Ucz|JPZ3-|lJY z6gi-Vu*2Evyh(lJ(WqvjICCj|^9=3*Q{x2*Ssd}tYdy9xG{fB*Y z4)=aKjIuhlRLkK|0Ky3gWX&Z5Mc2av#AR-8w}Qe|_J>6utSc`o&oTIU5=)IW>Hx;M zZ?8yL53+@8vZsH++ z{KQ0i%d8_jhh}91C-3f(*pNT~Pg_=D-p(Uurz4__j6($lXLww5XA0luCXc#Cf_@8c z;BD_nA+3O;nf@r2`U_DNitjn8E(Jc9w`W({q~wB6Bgan%qsmO>k<8w&BrhnUa^XVz z-`3Md|L@y7`tOGIfq~?Aq8gzKxrFj93Mx|Ka5)c2Z7L8{qyBA7D-}v|T|$w)TxeKI z$2vCItHV*M3s2}v!y~SO9=n9Fi=~pC{j0eVPqrpU&HG!c`)P%Xt=V(=Y@74HX#s4% zXRb*G?6^B#o1F)$(^jZ~cLgVY*=Tq!~*Id^1m#BORfCiM4x_{nj|cYHF4o$zrR%)%g;x zeXZ~uH{nwH=r94dYOpfk$cafF1=K7Y+tvvQb#2A2*f(irL`Fu9c6Du^`Xws_!ZQdj z@8Xz3J4zJ3@zza1#pHV z$DBN=GkWvv%7GUCHwPvz_Ur$lUHpYFzFW*C>IFo1eV*)REXgvgmLR16+af zBPN^hLrUmK3Xq1@R1!)_-XY(lbo@DkYeZdyWRmu28T$lL9_Q`D zofkxR4c<4mkkK1%T(keXmXR+;;l6xFC+1kOx0|Gt1Ay6+_vFFqJK$FOl+H?v> zkEmNm*3JCsq!nP~lGx#k(Jq|dMwVPKgs-QLcXfF+BWqhnoI?t1*5OHB@wW!nCS!~Y zjtkoGNk%*PsLdJhcaRRpcBU2}f+RUm?4aveIPCT)=e{K8z6hRXl1g1-uk5{j>RMT~ zS35YKF2ih_r@WU??1BqyHqRIyMg}&3#bxkyX=E^(9i$asy{rl z&rga%QVjpwR{R;^3+Jq=wu$*KCJywIe&2e5I|yHNhXyS_YAc-UHhPv5F0R7CNqPwv zyzpsR9j~6jfAS{jw6klC7;v^}W(z5dlx+Sc4a#{tKXnWjqBn_Ci_+&A9o=<`imz|bmWha zRfK~KM>vmUxBu=P^-sN{tZX?z;rPf~eO=Z~%Oq?4vC~I`XUCVuocc-r{%2j?a)EQ{ zMB=?GuhkoDZ)r+Tey5Zp=a?Rb$8oX_@0v5b&M}$%9ZCO7e@>4H?v!!Ui`(Nl*Dg^pe!ZX2cdQIhNFgEx=Q5vX18;OmOxp#loDN z3R=O-u_G*=zoe*if#A;7LE~PXmsu(weEm$`R3#EwwAHAHTSA+x|0)O*Cn6b|;SyxuT7gFTQ!+o1 zrltW&)L>3jP#uiH;|te&i_cioCHV)nVdBjU{M4sp9cRjFLHinLjRfjyw6<|n(lQbo zH}MFONc(&}q~ef4N%o}*oxJ9vziZx(2e_738sm{mbTvIU_X!5&Gd%thC?%?=?B6D% zDC0bWtT{7QACciPCfb8c{Tb=y`sbdsEEE3rPTh!?n0swCZRbLXvwz@@!i_t$>Vmr^ zF9MTC&unY7Gmax8oeOANcCZSjpNS>cqBC`u)Rldt4>s#}%!g|5X)(r{O@36*_5^`d zHGDEqEc7YInx^+j5_3(>z4p^X=<%ly1wnJi!_kF)cbMkXv;Cb-GgmXS_g^B@6O#(Z z>P;hN&3Nzxs>@I83AJ`#pqU^*`p%A3UuMi;o4_r+#_C(HHl(z+d~9leti~vA5(8OlpuP+DPTeX1#Uk4;QA?hDE7k3r$B7C?o0;fSXjLd6F1(L8P;|R zfBBr-Ukp{$`Re_nRj9KbAe^nHC|Ti|Djfwl+~Z}WS*n*DouPzFE!|hxoOlv(_kRNt zkf+F!v)3@Prp&drRB>?DTSpLN8H;PgN!{=O$%?VuLpO9NNxbi*o2nJa7M{5?%Cwep$f_ zJrJCd^bcEdYS_C~&Cimb*U~hpYMC2!7Mxa}rvl+csHRRCcY{q=+2CGx&F<-N*UZ{rx!O?-+kf06 zfO@BFsOrC9re553g4K~pQCJdowrsST?Ak$?GOK5~i5r8O+2yaTI=+8*`SOPv;xdLb zwR^N%FFP+`XvSMaLbN}e=r|4M+n>r4bOpHL^+vha3QoK-;rf|PYh@% zDG^d5f<7)fA{@m(T2?-NoGJ_WRrJjs5j03T4I4(D$xTIRSutS)$<5|@9T}RBJgYzk zcpD9s6L1KnwCbx*DgY?Y&E*ES(TJIFrl7ae!?x5&Am;20{9Z;Spl{i{Gs<7^RVqkb z@20#)4i|pUPl@H=Q&7PX8sO_5yX~+N9?k~$|EC8TG@)vxe3~MMvhFLC3Up-j2vda% zH(C*h?+Pui6a_52b2L>TuBGk~<^tn>1lbLIXM4F*4#UMCxQN%nbYz$L(!s@N&@cZ5&XpB8P=bBJ`tw}IMy7-%5B2Q;aM5aP*1u=`$;B1(>A&dKG(^HFwEORRe?AkI zAHxahTYPxXyhA#F{NU8gg$tE6?q24@efK{le22xU8560Yi^4_9LT1B=ufK&?nM_f{ zg~f5|ZQ5^XGkk9HiD7eRp7JA=Le4_tMI#tIu1>n7`QeSWaICcDENYAR`vwJ9qvOqJ zSamKPJ*z_5$g`2vpD%9;m|3eVv@2)O6Tx!Hmr}xMMEN9${$4m}@B5wtiUi4>fJgCl z5vPc<(#h}GBDLsme|IKlHh8tH_}&YLT{4_-IJHJ@fsux=?e?kb#>Ng}!paJew=D={ z{|+}T^-jhy?_ZEZBYyPJ6fgDIi-Fr25CY3v3R^vTM+fd;HP=sFDWp4Ikm(!&TVwx?Cd=^r!;A5LRgu%i7^0*~H`bm2-Wzia(pLW3w*? z;}w-@3?)<{C90w=7zDi!l^XLa%PnvNcde7@ zX+)3=Q<e z<_hwj!b+JIXz>b7sylWT7(=Ye1$Mn4h z99HG4kY!RvXn$M)qr)zMT6L93qmHyr2jDX82J4kwqDJ3x$w!5OCL#wbz*x~+;UJF4 zOja}7WGWu>(h5h(u*jk`Q=u}pneW1Y10v2hl;L%qPgjBLd}-X(N?t98p%Odgo2=Dp zT=~5c?aYiI36<9r?*f9D_?7jy#L>Dy%UotyG}+PGZ{%W3(vA&0A~5c&UD*&c>Biku zupo12MxNW~0HS7(SLJ+ZYwE6a<|!wdlA5OhVv?cn^ttk(Nre_=gyN5OKb%bGnL8Al z-YL?fme28$@Flze(dbpy31XOhvNl-E3!-0(?Em_Q^MvxeuYw7dTss@x#(WwZ)vMAn zE^NNZgr!`&VdJi=;#IYh>V%@tHykDQmRaGZMNLTP48PLCdu`{o4paBB`i^46V}~2w zp_3uCb%g{9WO|`%sEff5su_M_R`jUWTc=vz2iGZoQ+d^RXalNqoyT2O(y%NetcygM z1KJ}*!W`*&ibNEMoN>Z{v+%_~b*GQmreI>>cOdHuaOFX>PRo0+-#2Lq$Pak1RlUONK1mb7D1YA9aYaNWkeR*O>zo zBQ?7ruCW*T4-mYF#&sy60xEFy{lSlaQYST7+e z0kI%H95pL@XFuI!-LU{mnh^(d;HZQ`Tqs&FcjgAc{s+>}Q=K4=H-lWw>A=x-e>Ah* zn6jh!C_Y6&gsik!Q}z(8r5?6#E&mWX2dtMB4@ldUSwG3P5~}rMSi9Q&fS&3e8LtXG zl?Yr*1&M{5@@^T?b4-iuDI}Fzdh6eZ(<%1pQPW@{#xrL??Gzry90gDmEP5tlJ1GvN zw!2j}lE_MRTqHfTJ_rbtA}k8VSXk-kBXNy{g$Nq0BtNv`YN_gzZQ{lgXLhN~&yMYb zE?56G_x zqJwrWQ!WMqxpmeQkGPi0Y6s;kxX-6dve`&Q8x>Pp+5_1@&*n|vc zYH!!TL#6IQWk6N1))+{sUYA>Pj(p^@%=#-V%9a)_34Qz#QOhs_XjTH=;05a2LMdk7 zPHNlWr`0_ZS=Z#LZA3emtO0Zm@ z$B4O1hMrxyjNMp)n$g0iUquC@v=$s*F-$aePH}DSAJ5`6LcOUL^f( zb$nc3=p3JP6$&L{9jrjy89c$S+>~hNm9TVj0_y-0ZO?b)IjaEK9#VltFoVJV!X#i# zrxwQm*zMy24KNXC`$tR&jqdnzzrXpLkC7W69rd*5Qbf5SZ>SH3-+v@icr7TNqpog{ zRZUX{f-V=@lW@Mp&Wg-Ku+|6CAUT<#lq!guyIu0u92r!cMEvx2-B0*-f*}tMQWD11 zH`x7tnzlQtQ-3DiW~WrcE}@af&_ar8F=h!(K~r4C6SaXe-Z0F+X#oa?Qb{T2s&g(`L7#i#Xs+%T4W(53O~%}J8+nQx4Ny~Bd~pQ^^)$gh=08`zMaDJCuJ!3R z6WtlQJ16KFYA@lFCu?JPTTZUy*8{8kijZcuw~cgl&%hTE`1{-@0_n%#J0eneT4CGm z8@Qz^OOZ%|>JSKQb`Q(Ck&k@!LQlzJR{b#23NYjsJMxGxe3~C<{v5Kit2WC3SXGS` zSnnn8`T@dHUm;2t6W@wqtQqDzJp4)F2$9#D?dT z4Ph8xm#X(i9Z*1bE5Z0#P8tI7w3gN<<4bnLM4+mXj9fsgjNF$m({(Hs;-s+!t#+Aj z+9ENn80XTZUH2@vJ>P88f_H;7mM$7s2YtU*RUwUrJDEmbIH>OZ?qCcsXY)8n!oeVY z?_jcJtKtf7=J+|n$6ExO#en?l__@ZF?U1KGM2>U&Yt;ctU{D|tipV@n}~BdedceM2e^*ZOmrnc z0kIgVOXe$(ydfCl_3r-JWfHlZTh%^A$i$y-pK(=LkQG;Yl*zJEmydwe{BD$jUWuHzhRb!hTIi@8>z2v}lxF zTn9kA>X!zm8@4eD2@Xn=U2y>)0J!cu{$fb`Z2d^{RimRyED#Zt70p&h1MN=#$$_H9?S(PonB-6riMxEn%)tBY!%H zWa8~@ak^Jy2i#qXuieb~Jk5H*wy0od7g07|7h+F!3ls~?bEc05!Jm*uenNG-5bOt)mC?JFqy)^hfNg}hh}_LeZXlkL2dmt zUE{Dz8^P$lutGsQj~o`YwR8)^6~caH=~ITc_>zA?753~8JJqrp`u>1ISzJ_(`#3|< zxS?wX<;SWRr#!6T(XwJy%R2^Lr^peF&0^VpdQMKVCia%Jo-qs}G1H)Q>H?XVLFu4s z#S(1GasmI=fo6_@_6Iyv($uK1I+gtcd*=aM85AQCzpowGmqifXG+;8kOaqb}F4M=o z7IzX4VZJBrH<)Cem&Z{;4}%Wcih@mytvNeK<{m8Web<5~Og`5iD_ZYv6OYzf_p*iX znEL&gn_yyT*P zc+Q2`is`XsS2(5l)4_p&4NaEnpqiwvx=~r$QM#KH^GNW%gK4uBOK0^czbH-n=9l+pvd zK|8RcOgt^JFg3k@+##{D;Zm?79sUg|ncmf`S_{yr;-3A%g=>|{t+-!e2YW<#0Si&f z!>eH!V*r50t=BvzlMdKX%7UACTNwdj3X9KmiI5;w5eD zcgyfY)jE>iMTTu2oCrLslRwr}JoTxM`#e54yAm#?r8l{*t>Tk4-bh7x_A|}3ZEKFt zw+PWbzs}TVGe?9n_T6ukep8R30l~T(=z)FU6wQ{S?*v(gi!4OszovoCU*&4U%VyG+ zCRk*7E-AO%8s@dyYX%?6DShUs>}B59i}iAG+-Z$C_mbM;0$XK(uyk?@&wd4?tDf~ zz&1b%M@1af{fjj4Hf<$r7~n}Lm4z7Fs1NL8kiSq{eY#L{cq_SjT5u6Tq9By#?HIs< zjM>98Y0EJFQ;yGJ?0wRHGR|s{03s^0`6qogobT$y(P~*hhr!YsRdhU^is~@6+P*t= zGCEc$22b%q$6d%U7i!-|fOv&!6}e|;Ar7;=6z8%P4xWr(!xoF^uolNo!@Gsg`Yc`M zUT~1X-Omke>{&YtKWXw@>xT``t-_=*VfW*L(BzIgP$2V+479e*;|c7dfA=z&1?I7K z?N?H9SKo$T!~=!13w4^d6zUf|4B2(6@IDy|L4>`~RPNb2CnIWT&Isk$Pi420tNBzN z^k_H~LyHQCRW_Qy+RCv*_^|Os42>~U*#54oN{s|)7Qn{tUPq}js8tyk=^lT8v;Vmy zt6lnAdLcP4{l$QaOxgZ8u&VUALZV*bI+|fz$L< z9j%O4oeeF{l;>lmx%}BG&Z-dPPy|nPP;k3jy)krXeEuS8fYkCpLr_*J&bDr4_>S@dr?xO`zhhlcKTn z#Ii0-$0yu)ioNh3xoi$WsaqZJ{ltEK-6suL4zIKYfVs49pd5VZAXm+-@1{KUT6 zD;(nOL~{9`AE@7VTItrA$Eg~lg7kzU9Qm>u5A~zK_|){ z)CQpE1Rb5%FWQEYI>s#c3wW&%ma_DB498!5J%p&cQuTss<%JHc<7c5l+H ztiH#lV#n!C2meL<+9RgE_e~XTg3#05s-^qJ1xx$Wtoq}1#Y1GGj@#h$HT1-2A8ch9 zb}*)~c;jjdX2@7Ai;jtJ;Cm8B&EfJm2EG!|Qm{N*tbH>Mo^!!ppnN38G(MwbP+VT! z3!8N*SkwZiOH(q3vqC&ymcKQjPfTCW3N4Y)m)6$wYTo=UgZB=xHnhZXmXCea*;)L9 zYt5n^V)avTJggfRw&=FxwqmvzDnCD$4o3!}M*02iXT1x-?N2_B8;RccQDnEf*kLQ5 zz%l8!z;U;`CGYJ%5%0@l#*F)LFU1zKE-Du|D_eWs%+WHomZWrBiRm`h(_SYv%sA`9 za~D0RvbrZRrt3np5i0slp|m!y&P#fQOEFR%O%2H2)E)^hi?`*mSLhv+u1NwMEuB5e zrJpH%hJiaPl3?|}k8N;y23_&S$liRZW2;}&mxQYX(-!#?UZAnZJ{C@(xypz(FVDJ0 zZ5NSY$1Ael8_VLD9bK(36GO&aTmDd18zmLhb^-W)FA>IS`OW2z5iX2JRknos*w`ur zmvPRrR)dQN@byiO zzR&p}?lD=Iu_-t6;>Drq;p5YZ+v-`S@VTFj#~nlPKAh#t+gMIs!8K7`{HmNMIC1C? z=CSq=heNdbX+2hzuh|p&Kuqa2D;uN0Bp!P@g`QZW?Tt@$;TBdlX!fBm#!Gpq?Ytv$ z!ZYvBVr3BOWTjxvdPl(KgE}1R>*bZoTrkw!x_z;(4nRq}XrEe|q*(Q-pM~AXwxB{F zR;1>fc)JblZ%yxfD&HAq8FXmxxz1=ec$pl8U_Sm*_dZcudfR~ODpP%elj+C_!?}wPWr4(3MhP8`oQgh6 zspS{yRiKhuC}wv2#JlXHy@Wo?{;QLeliYX?K^HKAUYFY8wD2<+IjVv|<1ff>XViUQ zD*CrMu=9C+VfS{YYt?EFbuw4*HL3e?mAdCWX6t3OjfYw$J3NEcYq_l?lUl1Xr+O-V zSH7ggd}=N0c*`^Y!p1IQ!9?O@DIG0dd@B%Egp?-umK=~vp}(QD0> z4XVzeC7)Fb=I((SaJsJ<9FRx0sFZ5_Ob}!FA-lR!uK`Q283P{VT=wpyxM?|q-tB8K zwqEM{CDZ``?TEj|wI2@V|BRe;XdsKv#hTE~o)qkG(&u_z9kvfdUpwGr5r9X{vDXS? z`{VqzPd_8P`x{^CsHm!hAGLO8en*YD-ZqWnY#kt)@gev~)n=;W99F(#8p$&f3f<-P7w=Bi0!%X=N7^djUF_=3zWtM{l>+w)@ zeehp(UiZ(ikNLaM*?Xaf`CHh{Z9l9JcAux>1D);f;5#cQ6&AP%AB`Y){bj<_c3jbM z`O)WS3L@w=PByFk+^KUfTrMYr=z#xzhPT&~Yie&9!27l4`YsG#*=-XlsbAVIFbfuT z0qodxay_?N9C|HU^mj6gL;KUX$fv!NEI(Cs@=C^H&gyH3zjme0MlwcUsh2(AA8P~g z_TY*AIZ&Kmz`-iKWk7y9*n;&Jbu^xINy%oG4vg_i&3Rtuo!lX_c?+K|Vb; zjk3Y*ZWq?Pwf^lE1u)NpQ`kUs;|{ z!-gcSqR!l&`6QrR)aXlfe8W~n_t3)X&YIuhb2eF`fZm(7->v#Q;%DAGfak^;*V=T) z#ssZSGEO|ZYJ84CCy!M?{YI#tGkoyT2Td0yw6&Tfy1~6zQ|shw4H~Z`qqRrLEanD5 z?}tAvX-BAN_p^T!1yqycro2$3|CHDwY_d9G6BaT=o8(nZ{kj%H4OwD{Q2N~(7n0L8y?s#klb}W zM&zj?O6aog0+RW?ftX8RE6oGk9)S-}FHRNi8`?hG6Hlhllfh%KRsVCW3vdh-*Y;)0 zxcyu}F0)yN2I-ZyTNSh!zz4ip9bmE_?n|p6t-B@J?idTg*~L|YZJd`Gnl>_<4@6Rg zBG+5A@vkfrBcG017v~)3fb`49O)ZAfWk=J?o^`pVRgDaSwn`R1utbF}GVu1{I=seVgLh(h@v;ZA15=9z3#WCDr@N zWX^l?=2NC#4YpCXiDlmIa*(%Xa~3|~cuOC+`Z)Yn_v2H!)OOq_%fRnIz-3+1(RYD$ z2C!>9_(`-Di%6oDbfr4!sPRenBE8l=2r@?0!#E%6wfN_gavV*T(JEvTfQrtrjM;KL7NrABlD`moAfilGUb{^HFJ7w zn=VC(fG5KI&C^bE80&edlj%FHCEWV0V;n}j!n}#F?H?|UaEfmy^cO7rEFO&urQK zc<-~xwRYvdcK?9iw!T1&Uvv#8lbes;r9O@2yTzoQ1$96C&!=>OHL`n9tp39gj|eO= zO6WGiMiBO+K;P}QhUfaYX(I3$ti;cj3T#>7-x8RO3LD!hMVpeE-M(^Ty3*aP#UFX? zkh9-2ZS{+aL=Fx+GVZqtAannMK_lHAi_0$6b*KLDmTz1Hj?~B7_Ur4~@kdUF`tQbc z{DaKS6Eu4cQeqkh4!hFZkI~?{f(#)e4c|zlqnnuUsfmh`y=njJaMPa#75gVRPlW{=}qu&J<8BZO#cXTCq&Y}_$>I`g`xrr8+Z0U zKxt{v2{=daLq)V9#S`{zIDrPUqp#Hb)x43h?f2f@=6aG?zdkXfp@i*+i+oCDhl~tt zti4oO&aTWC=R=nKS0g(*S~)_NVhyu#beUd1H{-oG+cbegz-8<6Px8grEU19JempB) zJGECvop#-51tnkiqA_$N(nLEdKe(F1c!|0J{|U2_VV5O~lAqRN?O~4R(k~ znkbib$25PeszJsu-_fG!`el&an7$?Vdjbn4*Jx45IP$(qMAj62L$RR3s3;-LKBt0e zNC`GBYL@ohS=B3Uha_`s-dZc-9@$SgG_P`kP-k3n*1uxLaV9Iihs?dhhs@PlB2fQ+3s`T;7lEWy7`0!sf0JYR5gO0Ev8~Plx;Fj?A5C*!!U)JxtllQ zm2W9E*Ys5d(HIOUUpFCk;b?+>Vbss(c-XwMz}3ztLv9w-l4hbN4bbzAF#Of8bWlF(X?#?Z46YQv2vgJmF?KkiQB)N zX6BN+br!^XS?wR$jp4`;Yj7SRiqgMZs`nR%C%u(0=y#ynR;FgcQ~*v<225A2YYzG0 zQm4np5FERwd8z1THwxLC+27*jcJ=(^;jOZT)Kt7UklFi7kk!m&(q%=W*G_1X^*1d5 zDjT5=g2C$-iI1a=c$h8S#IM83xN^X38}9OvooAVUKDBgD|5JIq%Y4;;7JLg5I8|CWu13s+jBNcO_SI~5~7RO*S2eyo# zygw!rs}1GOQ1{?y8UNvuYrNPWy2-trw>TTQb{K)GscGp3>VQNJid2*fogOWY80YWII_d8w|BYTmRb~<41dB z?0CUvNmtn4n0KiDUaqoYooH<~gZ6g@avUTw#_=FUYx5_Wo;}TCo$qgFn5&pjsD@Ok z)I&lfMDxN5ywb2cI93$=Vi#F2-`ft{!5zN8@a7}K)d7{gIz!FfJ{$uoa<_u*&aKUN&@;R%q1}S$F*FL^hUm_#U;7koRQ2# z@fd$jLI9de`b!&z|7_INw1rZMaA*B0r3e*bZTRk-rCFJ6%nnZ*sg8TE4&!GntDa2u z)C??NTc~5{2(mrxAreiEc5XPTj_~CK)mE@1^odEI`VINT6600pf8d?2PdD;G*Die4 z?7>q`J-0S!&7e!Hrg6R~ZPGW(oHYgt$p|VTd<$fL z2^2rV`}8EmdxD@5X;4De{&i;q1x@IwW5MrXq6AuFM72yk?VMnAlPW8J|({ z2Eq3#^2}_5DMQSJZ5~^!2>7`MLwp*aLvY3|-= zb8$xVDxLjA9Z5d_iv}!o!+6_bN8WE|W2JzO`#Rkx5u0IhTPL+D0y0V=MmB@O9fvSy zW>`k3{LBIVnSZs=V7prTA{ysx47-aTD#2*gPI}7qgNr*vBud8F(sLZwX9h$PF@I8e zU^qq@<&zk^W0#Hzj{SXnVs92#qp(!Eq)LdVm;_nASEA5}-gjv(CFCzguk=daAR?&= zINJF@6xQ$whEuFFaSrtFshex`L9Wnf&_r1t#2`iXE0xGN7H6ge-TEKQj2rS zkb|))&k}LwI%v0fGDvPk2c3n>#L5k9O{nwfv<_5BzE-LCqV|6rMp<*`3Ldvz+4Axe z+hyd`xFX{0xs_=cLBX@(4K~qus7RkCbpJLhjN%XA_cuSdnL|gWEYd04)#CWFJ#^Ro zxkm=ze6D~$^^ru861M#IZSsew-YNq;9k+Nm(D*Y012k+g9Xcp2zL!R$D&vi7_D#3o zvR9u2f(M)|ZwXQa4$aVle)?8c&9LT4Kejv1E6>^`*JSV=%QKM9`|VmA^eI%UC)B;K zkF)F*?MtFNT4U2vYN~D*1XWg_SSZ9wRmcP!ASbS$ij)$(pe5pO5`Ao!Q83Ettm74x zn#^jKM24r5a5pylr%xp`Z}WxlL6ME8=bu-RYyNR`SD~2{sdTSLT`a;~UH;{3QhrFj0^Z3*l3h`zvm=8|pL{`Uf5v2gT~R z%orSbGcUD4UlnZQ_1`A4WwEk={?#Pz-#{+35*1tGOG8ekSY-UfeB=nXA$3g@V5nfZ zi~Uax%TiGec=T^S=-@VYk|b+tjjZz11d1aM>MZas<7CtwqtQ8xg_Ar9vGy^&2EI10 zmNQS0u7sj8vzaUr))&HNoN-ddh_b`+RX@~1kf^_Q39>uBvX2$p;j-p&%cYsUPegRs zruqLSWcj-?`tQo<|0ZR0Yd;?)vbjF~EK2zo`|Tj|anX>poB+54SSN8dJY@boFx|LP zb{`?po8)kF6Ysg?YVy)HO0Nvyz=|rBumtl4O9Ll98eP3A*7{1T0TeVytQ_W5#?roI z^k;Yah!@Pg^kw?toG=~%xb$A#;*dWq@W;B=XvLSdf{g5S~&*S}|$)A_ZSXYY%q42sYsK}+YYukt z)x5(MasUmE@}9eL5jOKYoSbfGXZT`qqI&YMmry#|bbs9bSWp4W0+u&>!h{=K*4iO@ zS3lHsVfFfr7c-{Y!M}X<8}sL%s;Km?$Hi`|@V_kG|IilUUa^OFcCW=p7v-;3p4V%s}-OmuA{$hwGfGl?buFJiTv8R4gm{@DRXnmL12%r7KL! zdm_^l@qQyx4ZW-rY#Xm&-))FIg~3*)rmY@;;{59K)f%g0^uY{@TAUp7p)nm{Fd7qq zHhGf0!m;7(Ut;dz4%0+>wzJbMzCuL?irDV=8nPTja<7fZYT2A5NxY+L$ZxAqz2W|6xuv8=jnwsV-0FD~*cYDc9B+;D5OWBCrHU*-VFPY4(T`oR~ zXORio-B)C)iChibN5SsAvOcS?*>2UP4pxXboP&*6n)X$BR_}nc3PQHfWh!k)Z{R^z zjp?y~9fYO*C>TTcN?gQY^H3rTUdWlMOdcZkk=Nxd8c`@dyzW>(6fdUAuDW#D<FK482d185xAWsYQ!1{s3hsBI2&K*{&V`#)s7K(qX7NxIh3`1Fd_)9{kga z5SmwIO@}%rE;*JQUGM}XYu=$qwy+P827hrL+*=_Irf7VJs4~{I=o&@Lp}{83nHPOO ztr8vdIVK|bhMy<@l|!V=M}?`R7{>VT%cn2PNUDQT1Ola5XKQli3+Pen>SIf8vjz}C z6b9vG5`GvQ@yPFgz2kUNG0b8|UCw1?KQ)Fc?VqQ<`2o71kk8XQh5EWbvf5%8RWU9n zEd98g{21dwOX_ET!0(jGe7&%9zn#O~$b!I{14L86MO@-?;Fq?~O+3%jKD|I-jT3Yg zF7Y@zIKJuS&gEq0gU0fZEE7E0L04N8=^=tHo1z_k0VMRYUl;X+fMN+L)M0%RZIS=28h4C=&4LmVs`vsLm6e+>_7;RKrr&@{DHAp^9O9e|XE4LCnU_#m)^3^ot*x_S2 zp#o9QH@RR&49meHZhe`J9}*c(NdW30LMQ)Vd{%!fjy#fciQ0gn{`G-SqN1(AOLCQ! zztCgSc_QrhV4n9vIaBYkt9inLGh}$dpA3iUD~v0B_%^gFc2CdhjQ#HJ0Mp>~WG#OH zZ{{#K-Q3_T$U!5h54Omco`p;^mo94k*@r}mwGyN@=z3KLC>)5t3d{=<_o4)HcQ&@nfv`0Vj8StwBZQz3`t)Gz#%h@&f= zq3OmIAAr)9^b6npL)nxUJB(_7+M9T}g&Ufz&8E>r>BYaA!({H-@X=uVU4hfl-v7=k zJ`E)13$*i#%og{Gz*v3dMiL2^$TK5~$G%dL)KQsCB!mysb-OXLS;og;{uY`^ZlghU z7E~7mgzAO=IfzU{OE@H4rf~Wb?U%{m&-aazgbXS-t9cp~U;csI3w5j(FPHvE8~!(p zyk%Q%vJaOF4Pdn148*9{9#uQRNc%+`FKpVmWijOx)A+7gR&S$3a1!Ddcx?|8y&>fd zSMnJWu{x1>}^J*~llYJNPy?+ai3;^pQ2WRwPZon1WAk^vUNbvoA~)TVXRS z9lHb>XUlCaneLA3aE;*E9V2MXGX3t>1(avOEOb}i;&V_xNAlg{X^N^~&0&k!=V`m? zLP7!}d^+ay@MP3+l`s3euY-lyWa+;{7DSorwE@Jtt2y zfl=W-iNB$IHZ4pGtMM&&TIA3^G1N6K%U|;_%k&bl;j7O$eyTiF8t8Da4>~ar`)4}^ zr(-Lf|HF7cW7GNRQ1_(i!m`=wAjgG7Jz@Bxz(u=0>1SLC$35~Vu#mY$(07bhXrd1! zQ^&=?b9OJ2yyGA&EUwWwc-3<{CJb5Fp2}T&Gr56b6ma!6Rhn5 z`4amG$&bF71W`+QAD6G)k@t|~TtJR*>jcJ2vmREOy$%TPh{>4BReKIhZA}3PA45_* z*UedP2#Tq`3Q)({?VpquP8L)@NPNseMf2VxpnOjvyxbYrn2F{U$8I`;yA-S@89DTE z*R0Bi7pA-FhAZdy5m&6{UF=YtRbrxatU@ioaDE=9ieB|A3pocV4pF^6bNEnF; zs4&!sP@hlaIUORj1kf)ioMpaml$NecUQno6K8F`E1kCs$4LTI-&pW+t6qn?QmHvjN ztkh_#W=2@0`XUHRz7S{>$#ND7HE@5|q7h;0WyCD}Hqo00>)G`dDAXSdct7+ch4Hz} zd8|Tc$1L@{w!h!;PZcPnktF_D5Olv7-;4c<(fSMA5XmAhWWT>1JlCN&96z^mx^HM@ z;J&xLqEUgYnARxra4|$|{Vg$L%TtDn-O)h}7Z?2F;=gpwBjzo>i5sJhlRU6TY0P9VW05Zv7*cyNNd zTX1&?9z0lZ4-N}=hp=#Whv4qIkTbLQw?C<>uId`yUFY=gkTH}8yNOU z!l68;W?uF$;9H(%vpdRrVWFd4x$*Ioj=Zx8Pi=clZDTvh)O16=w93kdffbvZ zx#}r~gDStZ*?Dox!|3tPUM|&I*nBrN?UVg&rjJ- zlqXp(wT{y+syz5TR9mvQD_)t_HFW`VoeN?wuUgKGOG7hCqC&lmyaun+#i*{JOy=G0 z*(uFrWAn;I8*BH^kIqG>C^R_kZ)!Mc) z7>5%*o$8SAJ8mDN1qM!R$KbCz;9Sq$|HAIAjpRi0f(TuV;lndF8=1d(Js1OW zsed-Fq<=3;Fwb5nmJZ+APuV{12Os~ui|oRqMs%+DsT>BQOFD9-1ZJTv`6|!5sg!{( z`N9ASDGjB`El2+g5Zls6jAQfZF+?jAwLLOQ0+)A3=#v(;&SFXWA@5Y4QH)?3<Qg}k!|b0b>!U4B~kUU8D6c;2tP z&n|Qbx(XV04&A~t@vvqKb&iMS21w2a*Kg{ib)P}@_e0AkjR#8=AMKL3E~-!XTJQlZ zBA-WhYS){@5CM){rmYEOU;?t>{cjulUaFPgE zQFiA44{aAfkEQFxs`%4yNtv#V1V`f&gg2v)y|nTWM&io3k_*Uvg39Y_bZs7_8am_* z&iSDUJc^@2g^9`2e&{~BDArRV@K192MD^TolKfp-rXc!DT1Muc0GEsT#|Uk>qI{f0 z+Jw=fUi1q&aSoH|3suY>yL08v#*p zvaZkL&E=8!*Vf0gZQZ!8+`pe?-`?m|=VLzphxLu#6G4~Z@~3+y`|Z==6Sug=8^6I{ z<#lbhJ&rqj81FmnkE?gUcP#J>&BmTp{1Ph;8|!+_SAO)Q9=EwC?K?5`OHS9WC+_-g zVwTU9_1c*r+G_XtJV@w+w7%Akfamw!ET5$dv-aD@N)8CBcD_8FMfI>zyZbihdTQSF zQL|glBoJBA`FpC*cr*?{KxOlBiFOd@1KeN}hM-}~D4mUDaFJUf}K0xZspgm_op6_{=8`f*k zYnK*!@(lx}vcr{o7*V?s$mY(tDu$emXu{hDcEeqDLve40nj<7ccgDOmNvE9jmDyCB zNpP|$NtEv~CzxQ$`1Cmz!JPnz6ozAS|C@CN7v$L@uh8ce1gGTQcZ@>7%8Uu<;ie4& z^NnKxhwTf?&#DIhK?%2NO{fUiYPN1&HTs9-R`!IOzHUfHl-t#-KZF`}(lwmZ{82&K zCWlAWo~auoFZZ1tW^CV?fzvkqL2c{#mbT4X-2(iMzcNO3E_yt>4H?w5 zT_+DNE_>M-1zYaqL+B>veO>qcF2ED4ncU6}4>|e6A|d6vq_Z`Zjn7rk@Gct!zz1=k zt|6pR?=`!qYF`jlcz1VRaG!-8t+DaeFlx-f-2cor5?AnLi`RaHTfzo}!SY+0#)~zR zqe^fm_~eXxm{v<{$s02WNCxpRwEJOcSR=J1PaZ(%ojFMk9D&~B)_+3VKGF^ z+AL>a)Yor-s=2^x}uHa_M><&fU&T&J^+bY{lPO%j`V$SfAie z;wBRCU*jDmq4Bf$j9+i}KsXcK`*+uzZ3Q@ntlTf3;+_vP;xb>gyG^1qR;D0sK_VdO1;v3zNN{Sbl& z)O4r}UPcFZOp?s86p^=&o^lP^f7p`0ds7^{hKu+JtF1h*MJ~-Ju_SZ$!&$~(k_90@ zu=bOUHK)ANK6Gxq>4OA=nJ`ER2n!(QUh7PD&so4QuA{Mk3AQ->Bkbv9DO1v5`hCG#!l2(EgAK8_NJouAq3TT0$b|k&KNQ>}7iEcx zB(H#%=Wc74BmDPFfsAvP{)5%CsKoBgNc&$h{iv;1#Dw_R&;l3o&rgvj+>akw#!U|n zTTi?;M$@>kIf%Rld2N)pudLFWZZ>a|y%`0Z>{Q?WAav`F>a%BsNtnL=%MAd$dw&4M~QO>Cx|GV4I zEiW{PCRCFv>ma}#zPSr% zU7^mTB=w`EU7wRI{ z$;k$0vqB$tgKgeuANs`_-Z!R!>S}K3I;Z|tdR|15I^6p!3vgWNh?e2A7W=TAH5?Fv zrlYxJy)h;$=(=%saLmUE;!?`s5)l=JUwIfj@p*ohCjZ#gga1t`?3?mgMi zkll4h--i%N`4v|VACbv$8;_IG-kQFd0Lqh=o1vMRnMU~~#~a9K@GvC0b-T~7{8roH zu*{arZB~$9T2yO&Fo8qQenU27THcoEvFB#xa(#CB?%nIx{7(1RMrzC6M_0XV&tra% zm$$z~nx}pxvtOKSz;nUazNi~tFgzmYux*6K_f5sq=%Pv_4RFX59OwI z`p7P&3?B{S{lBkt%bor=8{Mn`IH0inj3ij!=opU;0W+p?1?8U#-A5n)EOhto0i8d5 zg4vYpzHhdUBB!*~0wpv^847(LUvHLxr-+o6HCco2Hvqs&g^o|AgHVPdPz$o>a-f5b zkZsYobSD`2w$xE0jiS^>7~S*bFe|qLIvvnpy^IvPD!EGl8#&E<(0Zc5q-xDW#kNF6 zV-Uzr_!}Xa@JSB?p5sieq_|>a`&KG^O1|66>>5 zz+Xt`&ht7AGdkfvTQT}Z!t*E%TvVLr^&uQ+&&sl@g$o?fZCk-2?e>u5i+-$X5(fV3 zl~tdUM&j13&7Ft#`jHjaS;8A?;-%;PMW3DLn&?RjtpXeGY4&Q$Qi{{_bbnIM? z9&UWm-#4DoLNfJ5ibh4FSqHq> zbAp8Cdp)Vgb<=;-R>vde&>yq-G)=s8b)9=n7d;#R{1xF(p4W!^Up7U1on?nyjOw^A zd!Dp8uQQ(d^h9$0!q-Y9YCc1OKa`)`UQZQtTZLb}S_p8lMkVlu==j>5>qy+!(>Ncf zTJOrmuGt4<%X#F8VWV-`V>+O=XX@{HQCWC0z@U=X77pU@OZN+#$SB;!9qJ0y=2x9! z?q`K6&P+MorLDElqHx9r@@lfzywvJe;ps;RA^gbuvqsZe=QYI~$;WBmZX6+y5~cbl zmd1*>Y-0kJ8htBoAQI9TqH+PGPS<+qo-=gvfBx)_-pLXu3Y0;N)2AOcXQGa99|KR} z+TRNOvGlN|vx`>3Z)1%!upt5FkEyJrT^uT*Uu#tg5K={6MvRaZI+F4arvwwXeh_KG z2sk$w< zseBnC?K6+epl*`)z{!ZDl!jzbWi>j|0m2K8Qhtz2nJZSv2BK(@lX&6E+yMI&L9aS7Pn07T} zZ>zZ1AqTU(3#WQW=4qlKZ7AI@PM{nSI`Kr93!6ZDFldBK3juAjxnCBGHu%^fpgwnp zy|&BAj>DfiDcNMhLevh&bb3R$Z|QU@?v@*t8@rYw-8n|qRkPDI_ZnMQ_X_PGJz#gR z`r{H=idyn7VQK@M>7SqU5s6T`CAbkd@~7WA{TFnef_eD#J`uC`I|1(m|GCMoZob|e zOiu{OEOS&bZ`2JFuGlw)DG>^v*XsRYxBD)c79Z%c0|Ltnlab_@?soY61~CI!64~$6 zvaAR*KAq(GR=nLz@n<<03I=LP<=M*1iZmNo_(#)j|ap^*MD z32H~McBQwu$!4LpaTFFL(8|ZyG(7$b-q^ zgGR+xQwdG81b+nR2Wup@`ig||8j72!Y(H`eQ2zfE>HzBZvp>+nUua^z1;$jK&Zb~v z(@kMerEuImPhp}l|Lj+UqoyA>-)4w;J=eaef=vE4sE&~7-<>N=rls6^WeH5<(4;$* z3~Wph#2e(uZ73%+@O-L7Z~AwX9s_?Si-r&0oQMq9A0*@ML>+uk9PE8$OM>s%Vl*D70ZsuRRAoogb?PP(2#fWj^{EIpDaDO;OzdqUS_Nb zgP#&szYuV|nKD{Zyr#vVm{YThJh2$Xe35{L2pyeZ)=gQ@=9_15NvFc_6X+eyeGh!S zRWw)fQ#2=QqGwWIBy=^|hO$%A8pi{J%lPrDwi^w>WI)2-nvn$oA5tk5%OVd3vx423 zW6Vl<<1*`oOZEpvT5=pVSltkt7c`cWeDn)dx;DPC<-n(#mGMF|nljT$$?!e6q3-wM zvrzwyw8JE>umqyxg2WJ~jycVs_Yfs%i8hbX0kcvvJ2{}IJHcEJSOCpR7AIOJ4%k{+ z1cnS8-^-UMd!}o4O*GqSpF|dBu?G$RAnkPaqabN0VWoXu9I0#%rvJx@L%(5Lp`ShN zH})eHy({MwX++=$4=J9suNjDSpd)aF%*!T4gQ-BqzvyS06`If>x+K_;F*n;l1R^d6 zK~6HV<7FzK^K@%c^6PnrOmBv=@ZCTU?;yBpjn8;94Z(fCeLGu=D7J_qG09lgBr#&8 z)gH$mNs(!bpfs}A+01PyPlZ~HqF5z(sK{9C=)}!pz%OAY<;+=QLzDG)|G%%~Z~gx! z7`OAB?8;;0;__M1<0Uq%&nDM*8)>OiR?3Lv0cUiM4`qKV|HE#}+!d2iicca<@r8U{ zZiwD!sOKmMMhqHhA4EtncK{8~fiJevNznFT@PX^8reY?dQ0=d0gZ}SI=UYc>EOkq` zd7g5r#eeDXGoj@4F}HjL%B%o`aGM~<*gN@0U$>;6nfc{DBAxQgkLkG#e3hsG3PaMV z%J_~W%i*6{3}uWko-_B172-onwWj($k=+}Pg%MyqS&D);(O9M{@HW@}W4D`lo+QPl{cZ^XgYKsK z`ylGYw%E?6tw7t>ly0+z<1+yvl8d)^r5-3L>t176ys4+p`}G0GrS;A2ArBnu3R49Hn|-3yTRNTVoYe2>3=mBI4;rOt!|YLWUQ6Ahdv ztp6e;?v(!8TSmmyaIY5GFjrnSo>^q3z~QeG;HiS}w#ol@}J2JWD4d zQRrQcF-?rGp+-}=v{bCwGt_M10H1dIUVQ=}_GslQnVa)Dn7D9G7f5RT}NTNTc~j zS*P^SX!9w-IC}w)?d`vol@yY&H@JP`~p;OR6fPH{l`Inpfkgf#zh;*yvAh^3{XlhDMSSG59Q6z8b}&n zBDhJ)G7!370QL}Y_T;6*D*g45u?~I;mH@c4r}wx^$+$wFeo-*F;UNnI?|+?>Loi9Z z=cTo{ETR+qG`{;XfS4!v6+#FaClmQGr3i7}5Uyj-b#_8bu0ssB<{|NjZ=$O%Y@Gh5 zpfS3>A1o$|TP71fFv~P>IIewFM65h^I}2Z!bbdbo6(15^F*U`Gu<7c%6Mymp4wA25 zYg9~2|NYGJTUtZu9}=6*LO9IQjlI%-Pf>FayCS0LduRoJFwy|#7DXrs2>s;}#fqTb z#y7=QKp{X}D9;`&Rj^ci&czOIl2ka!r9#d}Trr|jbGc#k+G?9=lETh>ks~GrExW7IyjwpZWP?3!stUFV$h`Vun<#E^=0Fooy zj2cg_Sg-O(b;b;ig(z{gGYa0T*I-Tk=X>E~0y%t*!ZsZju^b0AdmN2F5+r(w0F9G6 z2pwIx8!P>vb*N8$^sn;!SmazQTE#=WHCk}|>Ed@sR9ph9hXjhNr@?ou6oC}2ULSjCCAvl>Zy4Kp+I@AW8U>W5?%?m7i<^^|r1T!NF_ zAA;1itaIqE|HhK;l`)>G*5Xb;h|@^MQ7lQ&5Pum!2>Gn53`Q$=+7NFAt+EK!wbwnt_tJ zH1UuSJYKEbi2lA%$50DHJifpX=s<@0OJU1HxF~(hn$lq?YYlcK*S=l7cUUj7lR;Aj z@#gZ=e<#dDeQBNXv6cgn(eSo=L^CRnWqei;%ZeG%&cX&FN7twiEzF#a?)|b=5u!yV zz7je8wh>yAdP=GOjL#C=_WfW&n3;%xi|fJ>vTv?hJCyLT`n?#v@zl3@eI#5B*w@B0 z@i3fwW3T6EOXdw92gk}f=H5(!$Qs-XAI6c`ex&;SX+WcV*3+Z=9e;*RfTiT5GnUn` z%eUt3eZs2){QWI#&%I&d2f;nRdHDgV*fz; zQNychT7qXyA}xpAqz|^I;>UKfeI@NZCFLnEvmAbx z>i9MG$|RN)jS@B^d%T3ULO~-=)yUIEnHx3bYp6o6;>-GScFcgLnl|)9jf3_MJZ8t) z6u&!m)acP{7QAq-Rv{8~m6?V?1r4XK$| z?6aE(UnJNhW74hIp$=Bu>hTt^UP6_4V*p%vxXGEba(q-##YWBHzsE}xh7LE=8GeLw zWr+SwX8F4l`=81z|8sUHaFpO&7;ZkqsLGPccrru~+OKcrwV;_+w!sZ6B+~rWSeOX2 zuUn;*eXWdjihepcmRP)HJt^)dwEGpUFKHB7ViPHsoqg7qFuz6M;xdNL!+J=^trAAJ zqk%IjL&v@of$V623`gF{o-!J9w#7ISE<~7G?j98}*l4O7@%VrUdHn{Go+ZyuIqF#a z4-Rm3RdftQEjGx)a!h&GPGGM-q9<*Qrk#|*NZ3F(V(0dgoPXqJdU`Szk7WPB+G1vM z3Soe+PE)+MfL)s%1<;Qglhl9YYb4*J|kkaR@paD{|@0RY^ULJKX~egX}y_wGhv+krxB@bI8euG_363ji0ZeP`=9lx zxBFxl?0%J^gTHJ9;>xM@jHMz!CRGV$_iO}jB9g6$aP}m+VEv<&^?yQK zkc9Lv6R?p29$aQ?ZGJGahL4h%B z``%^#ZRmhbkAd+Yv#pnoYD8%M8{rSHP_&$K+Q1<={*jHAV`MU-B=zr-NC&x=JFoEw zuT9PjUsWk&T;!9Dl;eVL`|yX@oNmyy9l6@ePZcKER;web))0as-Uzi>$Q%K!$NvYW znUOfU`rnX<|6He5$~!ev-I^1|9aVHh!Bd{##tmHu_0Drn1J3#T5Q;=wAv`{0j{r<0 zR{;oK1t{>(>!@r|5o-y&UW*>rDF&5~Za2RgVR=?T+mc-|r^#wThzXkAd`0lQrwAnD z)7TEFfD(TKhG_YI7{y2_r`LywW!*A^S?5L<$x_%CabF|ekasE*2gmA5z5JLL{avBa ze}62%=L1Qv)Y_UX*BknEw(osO)kni>3DcM2l$C4ujT~fLrM#HOf-%|2X2Y0g6g%y= zqx5+8oky%`STiXAAv#$B!wS#K+|M18S`ACi#%9`J6<^BK}+(^MI%1B45(uGYR zhYCPT5$0u*cJO{ra8z$`QLP2KnWr>(e*Ex@GBI}HrSQ08L+`Z~D~TO5++GQD zQ;r&A)YgR?VwKc1W!gWdn50LB1i{nQYvI_FQ*$fxC>YCbSMM+5%$>zS~j< zRG_T@>ibNhWZ3^TB5|p0Mh1C*;$FDItnB%v<Ee@kc1A>ugS5X^xsCh{o5;y43Njk(9a}PxFk*s135*0@O!M!&AuKjm zXj+%p)~ZtS$~@!us5D^F&(Bfg{sTa6jX5~MTg@?r&qIY&Td)BpX@Af@UKdO;ez`;L6!&nd7z;oN*xqs0;Gc z2&z+Wx#`m^)gD8_{>TYsM!x|Dr1j0!%&J*LRloVf|pyckxKuapSwPx zO<)PWRssxHkaCM+^>*oaO+VpM>xc9>I$t4rZJhGu3`3Xe+i`EX+E&KKE2C<(X6Nn4 zUU@HoKgZynQwD$RwK!hVX1&@r==*T&ctAbVbv?GX!3pG09wFC+EnAy29`aWmp1SUL z_3g(|V?Uyod~XPeSEwTcO$GxzqI=!lsvFJZxxR?)bgH260CzgEB zdS>AHez)#uvCew6&iWwu7;dQf`uJh7z1j1srC5S+vGxkT-p0FV#DB&mr}8PXr2Hhc z>Dbm4rOoYRKm${y3eVaNGF#rZHxDX*SkCCgKHjyKx!l7WD{h;=>rUn1=U^HyK<3co zC`;>)CA1aah(y*QD2^&5mgG_*p`Pf1A&Y^F#p%ZT+7N)jq#o^>qWo5=@t0_LF?!O^ zY_YJc$_G1`04yKUvzQTcCOE56t>h}jOBNcXC!q_o{EL@3IMpikBo)k39kGTmS0JY)OKxDj)@Ko4iQ~~f4yY&h9R;c&*jtCG6C1>P=DzsIbbq6 z)WWZGHiL1`B~kFU98-X0eqlNG5etmR#cD^_5$H*o}H4Jqq!eAOfxjrFFjR3ILtL8mo#;`S0;5A(ITD>$HZa4ZjOU}d0poPpdqsv0eABRxFTOw5pTbW%Z$Hrh z(M&5an;zn^k%>`R2tB609q2!=2}@q6cT_VUa5V{8uSH~*mW!Xx>rX3`kwjDnhSo3l zJOY7a^My@tkzlAb?Gv~+7koP3j!05Y!Vix=4#-pvq{hCyayFx?e*^uc11`KT=^Y_Y zsf3?>s6Y4vxFjr_-zxFQOV)TsRBMxpN=_9?S4RCQK1@HWa6p+(evt+6?~ z_-Q{pXrp;_yxh(#R*MKYOGGQ_q=7K#4Jz2wU|l>>9qdF00w&OpjyX^itUzk`5Vv*DqX^{qxe#4==+;TE&VAOK6VzZn5)l=Jd!p5F ziN<+@_Sp=-#d0rV^1F?XtTnEO`S78VCr9h{(yVjNlc$Y#lil_2uinvhxXQGd)g5#{ z2j3NxH9U9NtvVMVlJE#Lxl@(wWomo(H?s2Z@R<4*nhn>7>$og?j7Q|T9xXf-&|;13 z?D=5%% zl94C;D#m-|S4wu-?9lP;QRL=h+B%_L(yIMx(cT;>*Xu zcX}iph;H~K%L|5r3eH%n*>>F?&6pWyw)7b-;5-_8dZl zHD8Ih6)l^f5xXqg;nJuK+d+(|t5uIry@v@}TQ7nk0{ouhC)*oauocF=A+Ujw8DrfT zp&q{wBV&HzL|A7Faq&WJ3w{i!&X$` zxZ6~bSdj^0M47CCn!fh_K>k~FDt zgay}Gr$MVUj`Ya**%zj$6}KkqfY2j?GJ}Gq)1{SWT^w8o8MBT1rL5LK>}t>G9?u84 zypa0Get1{w7SrKv&I@8f5BJH)Rh->c#~pkKTz#2f?g^UO(rqAK=4ZNQPx zJ-+DA`sWsGD7a(I@r(I3rSeut0pro#-go@wr>6`4LC#~+qN`H*(qrr8r$8bnjR=73k)vu$bB`#}EYaPg+SUVFCTWP|uwiN)A{zFwE0#rJLs{EK(> z!%q?4>LyIMdY>k&+~QIdLC!v<+^;Q!+Fx}6(Tb`3eT>pOSiYBDthfk7wHFB z@(H~fcFRqJH~hED!#!WSKoE{AS)Dc;jUBt^GHK8D1;HEe^V4Alc4mvGv(Z8EpqjN$ zUP~t$zx!lys_Ss`wfsrLg;oi6Uzw8UiI4LrVIn79rq?Mt>C@mcK=+z;x(4ZRAIuM@ zh8v`3xAC6f@3y&YwaiGph51sg3RIQr%7-kSmQR&Le`4G2*#xbd+3MVnM?yd?8wKUZ zi#LbMgEux0x9sUD4QpWD34pDw?PJ#zY7-V1O?FyD@WA^7-p?H=Z% zt>JnPT@%L%srY&eb!Mw;tGe)708WkwoCl7nz6}nu1Qy%oIx%;P;6K4``W@2uQFcQ_LK8^h<8is zYg^eBuEi8`{(N5=gg`NvnaG4DK(`;I{RJi-J-16APs71xa_9-0Hr z;!~*odMy0jDBM48JimiW%27h0oXxEE4m(r}VKV=V8!UJQbCS{14_)Sa0g@qGGL0Lf zY=M!VePmcfEk2e>DyfmkhKuUcK>dd*W0RSyMv2wAy8sk5h9u5<&nsWu*3*tjc|Lm9 zd-0oKUfVtXf){1!NCJ+7P3{3&CyU2gr7l(w@M4`Ss1*`5N|)g}Q|g{r*0SN5$q(6! z#3z2w>wK+y)33qn+rXWg^`g1n>$!g!&SZ4zhk%g4(g$mH$6U~NMkvrPuH$t)-OG79qYI*d$bdTEpR$dZ?`uZ zbuUcQCeptv7arC;OI9fmXmxk2vpb)Qf}AXJpQJd4d82d>+#Bp4@5T)iRjbD)DHBTYXq-N@d8LHa|MlZ9e~1Nw}Cv z2v@lBrK)VZY|-hai5B>|tFvxOTuZfTPC6m?!7rsy*Y=PjS4_g?z3a+P*rC2Wg+NwX z9J=>4ZOG^J`SDYm1w9WG9?w$Bz zV(GRhM24r$w%YBtrH`VFP13iyT(uY*K;54#wp=VFlrUNb9?>4vK0R@UxIWHL z+!3c_dONSy9Vp|h>@X~hIr6%6w!nr@tv3sJ+0UMWe7M)Qr_l6TI_l7EcVZ7fysr9# zI^Nw--O;|jgC*g!I=pCL-KDdoYz^WzH{Ef8$e?8;{k6uYiCJAdo#kb-1n-YNGutWd zvt>FhCo#iXH!nLnzI)cW`kXhdBu~?tS5{)X3e=yBO>#O9Zl||(%i}DsOCT(4Z zQ9ZZ_W;nA07Mc25sbvrpEKXujhQBT4r;J3QO8qp6bY^Xs+NJ@fxZs>v_arT$VXU1Y zWhRh5c|jdD6T_#9in5r;lxBqZ>Lf^DqDWI*q-4lcGwsn_nsa1Z{3f|%_ixdK%(&%XoT+?~<>qsuvNtBy1!2&67T+Ecs4>Dcp2zmz>DiAyPw=WxnPjCU zhdauDF10W=V5;LZG4_4_V%xyeEUzjJqqtf+AC^!^m{v}c?)bDw!kfwTeJ4!+jfD=? z8(|N0W{7=VI_nvfrZ*{XA22Nb6{s`=Ws1xjNld5BDK4@+Fcjx7y8q?J|CQ zoBP2mb_c&!NO_BAkH-8s#R>r^`6_gp_UWQ{*q6WJp*xlHW>o8L6^j!}xE0fwaLjz@ zehN+Z!LLO`e41yswX(=nS1WBaqIK83`@7Mn>qNc)J21w(H9T3v!O1;wlFhO(+BiH z5KcE1DiT#J$;5}6%F@qL@urZb$*6a|xSdU}8ziXF^!Y7<{a*0emrq%0+Vs!Iz`Hw= zF1L%->2G!18^&}ytOlilhji(2ZDtyA2A|D)zEtE-^uJCyvc#P%q_)438>=+e)e8yG z8X70)Oo}*DQOH8J2oJKRfschzI&~b+z4R+msPk^DgMJm~=aBr;C>)V-QCu!}>Iqht z0yUc;Z$bi2n3Y=z2VV(N*tJz$3r~ z+#rHOP5OR}y!@7({;c{tlf2X4v0V=N?Do5mnl49&HSLeWz(zN=Z95Px)JxElvD#4E zxu{M^onTw{O-h1II=0hjz*9k{iYM~J;hx`&JJL&W>?VOm57mI+OFB%ao=^4Yn8Co^{CDEj(H+ z`N@bcoy=EjM-JN7raGUmelpy=n`#k5;?dn*d`h{1Cf~N~aKm40+-MXj(5=X#&DvC$ zP>t+SyY7nfPW73)*#^!9d06$DmYbR*t#;rQXC=#nla{jmNq0ubZ)3;MEO?V?a1u+f zSiZT5fYC?@-l%;6e;~zs7lZnZK5su9Lh!mk5bf2&d1hB}M}t3x@9S%toA0AFeK9t0 z&J#><;0|1z0C1h|@xn1*fV5g4WJc?2tM?qs08#Ck_!*1D8KyiQJaELFXmZD(l%0-9Z| z8t?Y=^yX|HH~1Rq8;-#ycF)9R^Ov`vPEL3TapUJ-*vEa89o}e0|j$6QuRf;nWO5e_-R6 zu+emcjL^Ji7no(kD%asJe;&~y#@laoQBk{iYjwouOo1$L^Yi+NP>Xn@jbN$qpBpetq>G!HkAXOf%^V*~AA7BX#K4t_m;V4$kD_ ziVbPh(#$`-eHq79^YJy?cj74hu`YQsfeBm`@RuWZS|!ymU2&5ELGz~}CtWCLBURXW zy7QJHY0CUrG9D4^o`-BYAmNugwD$e-79dq~es^5p7<^Lu$)giNkE zo%U^8L3`6C=T6!Uv5j{gou71?tDO0Ks(nWrt+(T-TUy*8oTZ@PZ6Ue!YtYllzzPluMY}%%K%q?i15o|h24e!>4wV->N+J`MG zxYlj1N(!A&cN)BI6HLBYqL&^`Wi=b0P7U_pd|nPH8HIyNa_wGrrNdvjHmO0?0q=T)=yGT!OH>2Sv+`XInhTx6ddDp z+8G_@hO^vuZnG8NhP}o+{HN`9UvdbvdLB7E)#s9to>sMvHu015!3&h-!S9*&YYI12 zE1<9U6}((wSqYJ7?ezu0|%p57UFx6FI;aUh8Ydak`1YXap1r|SPx3E z$65&D+x;~)?|%9sux=&#HcsH9?o9g3P(q=9sBpaq^CTsll7C62Pd1%ODL z%OG_QZaqtIXL6%@^%$+us#p}cXe>ExZ3yUCo%^;dv93&dFzY4qO7$gYyTAcFm@lqw-M8!X@^j0R2i8O^4_}*=^Hd}GeZGy2%p|)e#(N z(v6g_Z=!E?K@IHZWnxyvmd$)%1h-!K?}uEql~1y(^FH7K!q4X0RCA|e9hmZH9T2R* zme>Tkd1g*LJrjJYK@_541?#ikw|LO=iS{24rJhiOctLj0Bw;z{m1s|aonpqHP2{8W zokJIE*o40c+uKl38p3XoWE^c2_N3pt=$B5zg;F96eiDQt$wVv>#8Mm?Dd<@`^PpUF z_Xtc$7cnc(k>N&+QiQlevlX@_?a-=5dBLGMsNEET@O(Zf(nf|e?DY{HYJXnFJvYR1 z-;$#)Ohje=~1v?b{ZC!)|JmH##ZJ_ zBLjNpu(QVfvFz5}(bo4*zy?&NV^@lFPE@gs@43SHd|%MaVYM`tPBB8p`})s~6-6#k zsv9O5tDiXQjKuPtp%KxEGKzQ%)0p{0b45shAC5B|c+F_4Ztw^BD49y-!Ke9(D(|-k z0`DVe8i#S6w}}{BX$)o%Oa>cytYzwNuADmt8w>0QY3Mzb|*bnS#F;*ZjndAQ_TE$AtIxBo-o8K#oFb}ey8ajl2x&H_;-Rq zMGEQfbQ)F0l(n++*NDg`;*W`sQi~rv_@hvCLa3Tq?6|!=r7P$3w$hTMn~-T8b_f${OHgeFRqNs{>=S zGv_TmspO%)Jx_Hl*sAa7yf=qowL`%plh`IG?E_|I2Yv5PtwzSU$@Hz0p%3Id%9QKv z$52pdLq26BM#cng31ol%i2XE4$Y{e2!bL-+RGw9IY^$oT#`sFtl2uGesH>uNn1ksF zzTa8dzrqV`n2e_yzIHAk6pCW?cYbddtw_}Iooty68F?<$Gf#KYL3$*LuP+sI?}@$& zmKJ^nJDlJn!!QBD`PjG^}JA~jKG>|~!5}M%d?j9gGjk^a8F2QY|8z}130Ces%8gnA|IRc6b37k8vM5^I zCNz*cI5lQ}NLy1GJ&=phyAibq3UD?vRfp)CCBI4rH-(q2WnnqHwlb#jXwpp#!?_T4 zxaLZTTN`(#vT z<`^_r#Hpm>`)3V{v4v#!pzN+87X}dp*%$Ge2h`Ow-!tu3o4AO#p?P+0aA)1zx}SIF z-)@};y5kWF0e=6ALwOe4QAvi^8cd~Pxa_fCB0Sg=F~6IdOSxCS0}#fKRLS7@%}arx zc@yI=vBsPdnJEF42S_`n>~++D>~*@1TGe+Nn@F#CT-=g06Q+*{?e}DrbIKdZ_dbWA z_LdNo{hc9#zfuKRCR8FKCWZCmC%%{~mF@jtR#sjsO-k%C)mpjGl@^8tJbP5IuMk(r zA77t&E*KQS$LZo&Aei-@W=;M>&MP$BXi4H%Cg`@5-!Wx7jD(l1->A!PhT*ali5oo) zC14EfIqkwh*SY%CEhCuym8e44!F)h=Y_LH78fiEk0!1@28Y-gv@_|ze1U|Uq{4^dr z{nLfyvOR-UWBL45`Li&verB_JqjyPYCDSY@3~lHqjz>eni!4NYM1``l16f#kOb~q6 zY(1~t9(0tC7*3tNu9$R4Z69Qdu3Xv{I2m5;TM~n56^h}t-F5S!+BvanAoDL;6Y`|b zkUT6|H9HL}7>j2>c8|39j{g~w6sHQkQ&E^sYTrND&3G<*n!&mV)6=I<`%pU7HW88= zfAgDDTev6JJn^k(wkGP(a+Q*iP}$%0qCZyQV+^};uvHzdxhk2n{c~ucF-OQdQbW@$ zPBRVCTwohI(K%wCPnv6Ek($J}Br1kzb@?~JSp<{q+L^w^IO?ERD>;OA421d+^tYqNpRp00g@g&7N{W$6kuj720H7`Us1{E?F%FHL zuB~)s9!LG_UKU(XXz_U+F}F=2Q=ehAh6an-J6hK=F$w(rl5>rNTypylZ^qEDJx=?c(7vE+Wj?B&{TmIf;WBxkp3x-s!5ii$`e^QgM)@B(l{=9V~!RsU~3o{kq zkhErCM`Q`8xhlZiWGdJq9}>hfS4WxmEpdmp1kOslI9B6&e@qc%?^T1eBhb zONwtf5T;?=e(;E2zlf%7kJQ`r(;BlnbH;s?sy1 zqAleH8`CNy<~wG2!~rO*v+AY}SJ>}HMJRoZU#)?gB9?C71F=&;G74CJ@KX%YdMi+W zp^!p>)e{+x&UVC%+tvPaFJ;P~7vu|a_KA93K-J>v82S`}pI#Q|yro$I0)CzC!HNHbLES!J7pX z{?SSwrjCt(8dUd3Gg2{(i!$AJZe9TFN)KZy5i(8Vdl|GF?%8It*=Ko7>Fye}TeOBm zQ#;}o>KHkBx!+oDmiwUnby(32?SA5m=9pNO zEZ~-pwvM@jC8nrCq~hH=QJgZuLxGQ=>)###fwG|;L_XkoH%QF}BnFzi3GjC)Tjl{MPOt=L{_Jv&QD?4eIQX%F*RzdwWw;6U)AA){5XGVrpIDx zY~1%kg5M5C&wFeX@KQ~c7|@z-D@yQ|fak6%`&D-B)S_vr?;%kqy+wAEZj?u2wnQX`+Jl+9W+t`^57dQnMb;E_QN}0p$o09k$E@cX1JyToQDo}NHHwJc0l@T4T5`*6- z6Y#8{aNG#ZFcwM*p!bpDzcp?w!;NEisfvtFZA}>qj^k< z%6KHUW{|yn;u9)41}CWFX^Mf3nt}N6fauIGPUphCMxa5RT*GD>gJIB-szBn}^xXh~ zl+b6)$7e4`iMfro8@$XVICvAg*g>iv-XIQ0&D2-5crX?dYZHMF6hLz;qN^lj(8D;x z%by~!P8)K(TF1oP*VjJvLr*On_y^6kswmKmEx*Io+(^15pW?{Z6SOZ`$vj~~Dh4ct zznY!?H(iM_bK^p(q^#nuPapO$VLJNvHA(-3d;d7bN&@?jN5M?-14Cg|^n;zxi#;ri z5k^Wlo%8#Q_ro~s)++p|KvWo#B!kI$lGb(QLI=oBDL5r00p9VaFw@xTiZ4 z73RuTP1^)C?D3tK)oX=}`q{+Ni=HAa5r6n_+5^94XQNRPZ8q$f}}R!4Hq%_mQUSLf|m3yj+J7~Z~^a9i}VHWwxs6rtboCD z0mAXm!t#FxECmBor*5IQkN}rN%83|K>0m!Qoto*u{iF!kr(NX4UJdBsY0%!VK`$z$ z1vAKacT%zT2%!XKOCTJ9&{w9dTmkcuHgvG3pF^{@CJVOV*CZmU#szzS>$YO#CqJbW zQKe%wKsR~r*QIb4!A^M*W^;d&Z*8}blq2~R4by)=vt{t!p6M>K#7K6c2O8ktM^X_n z3cS=u3n3NWDUO-E?JKfPbLOqrE;o*x$Y0rm}PS4lpCuv@IpwA4T z7&uM?b@T(E+~{y&0xbd%L3Ma)DZv^)hzGPLyO9M0FK_5tjU*a(2F%_CVKxV|CoTM_ zjHX2W&anH^*xU$R+tk0ONMPzCrSZbAV>_ZzLGUf4k6*8}ekwynPG9UHxwgvYSrAhp zpmZxTvMi+^XeKB2D^yf%(yz30dLYONI#WC{8s119@x^E;3;wfn*4C%%>ba}MrjNr8 zVDAeay#MT|pK>I-tXyDU3bG~R!PGoJE@;CS1kevs;e%s>8FePPr%QGWMF`c9F{JLv zgRjrsQwv5F2Www-c5_mP!BD9)epQ8R&-ftkYgu_&ms6H0p4%I^D+S)7lOLwvc!Rb~oZ{ zWsEaA7ffc-71HACwir#u*9GuM96LU!o^Nn8-gMc80Q!Qs_SYyONfc3D zg%Q7r7-dmVcLg9y0sDjeG;XdVxX%VC@MKw^M@1$r=58@z{2gNH6vc0bqv z$|i8%T?nYuAfZX4VV1dv3HEtj5`qLjlUgavvK2Wa6aW|wE2PWVB-EkdDtg9CptBZO zVl~5|Gkhi)kszeTVsAA~3{lF$gdVBSE@oJ6Wi^NBo*ZanS^oalnmuo-AEZG5&u!lY z#zaJ$Ku2B22ay=wnbH=G5X1e)FbftR?jI_SBGQZDuuT&{03|KeGmjBor4Un@=_thH zx2X%z-oGyjud#+wO8^*xNH3mi94H^Yfi-#+&4XRZ5#?TlnEi^#iu<*QCiMR!Acb{0 z^{WXp%PTRCmjzTHflWJ=%N36>V)(OCp13Joy=XG>I)xr!oBMe0WHt zt7U=3`E!tvJ8_k<`A|=kLgX9E>_BGFj}afRsD?RwCA=q=PFG4{$@BS7g>z_l!lB4g zl~FHi>w&Fk9;o&YEc8V%xz6@syk)$hADzkqDBJ^!Ts+=)n>e|2>8+SRuOa)=P zFNWf0Xr=*-W*{9YVM9_a{LRxyLtANDS1;e!Rogm`A4+gkT}wfn?b4&`*(Klz?KJXC z8tvK=9^4Y5hH3QsFOya6*~4E;Pb=P3zkR74i7Q4nKoO)`$1vaMa)kvOIGq72)H}sQ z5>{DB8q%NiJRWEto7xgKzsYG&^>rHAISlkYJixBJb9GCYBq{vBc67rP#l!+?n((=q0)k;eVHs)Qq-5*4zYF^ZZX-N`V)E**dHfgs$<_9KXtEAb z!GCLe-BC_u=qY9x(SDwVRf50YUFah2^F&n)^sF#z+E=M-q(n=ZrYhP$aoz`rgS<;X)gQbz(E$j`@`M#>tYOg)$Q%mQ0 zf;dxDGYXPnfZ^;3{3O93!&ul7u^vIeD0}cA)lY(e-)Ph1GMNsfq{joDCJzA zFT?BDh~{7i``UKZ9isdGsYOo+g4C9YQENwgIo3t-jKdyOh#mQ8wZE&Q+=G7X6Obg{ zOGTM2PH&|3j1hH`FG{c9cO> zaC^x^cvaP21Sj24Vos=?PD9vsG+v1D&+4l&^@@l=oO|I@RbgZ!FaGvq1(5`QWI2Zl zh?6Pujk+N@*b81&WTZ(?y(rUUXcjOXhbd16-taNS$8B2UbJaR*myO0B4PbWJ;+rI< zFcizh38+9~@uG7=ICS0^_J&5&kf_gOj1j?X%)*%}51qM))rDHMu~iXDFmQc)?jSpU z&ErYI)_{-WQj2L0S0C z91YozI}S?rtl6}dB1Y)!qMpu_B&ef-^j@d_vIPj)3ac!ik6y{SCXXM4na7>gQ<9~) zdm-7<9r+yEcDU01)i3XIf_S&eKk!3>k%PtP^bXs>d*6LDPea7*ZHKk?3LG13WL}<^ z{+8zKScld(l<8>4?pR2uup|wGMJV&$Vrew)Nq%tCDU*6imk83vBa-kSMg@z>QL=~> zNnE2AH6m4GN@=SHx*0^6k8w{sqXdo3lKZMRCNHnin30OiAQBC_TK*!JthZ#(Bstg5 z468<_k{x3f@?WrM+e+)Y=Sc=sPV|M^B=KcB8?9Y!X$@aSw8*{|C*%JpwyoM1S0sQ} zHlM^yga#nQ0aeZ&i)xM2U=xL}gBznzOMXmz*5S|`6rr?$cbH?@jnnA9(PGJsMl)`^ zGI4U`f&TsTTp$Jgg-s4*`agSPx=t&f1p5qTJ`Zk*+HVw^R_JDiJEXP&JJ%#mSnu>uJ$FZZBSjo1lP_}p3oQz>>^Qa zs2cOUAZj=SA6Rp^w=ARBok<4rIQfE#oD9I50zk$LSZXX; z&7*y@S*vD%Z6bpi~4I`yNK;>ok&q0F>p9V<93w`YDeznaC2MuOI zuHW<#AYzEO4+CRFENEXdt-$?bqOA7%j$t;$&5!dO1J_K4#?QYev?SnTglCH?50O;o z%k0;ujZV@%1zhZi6xnt9bS$29g<<+p10e|q#afpjW3_&JXaU#dyGB)%YDETJ=#;f- zQ)_v-5FY3YBXu%*{NRI>yT0G&N%iJ#{)PDFoR5cOK$?*lCt_UgH%9<>AuzQTLk)u! z$M5fBv0>`|R0N^&TLl(6D9Ov_t%wLSr94r*x;agJbPlEBOuaJv9?oTpf`f3|TV z8iUD{_r0A{ydVj_S^q1)Ez`To=OiD=`n-YJRo+~EOi_N=AY(^Bk|E6ZNl~l4vrUJp z)tQ5U3Iao_t!j;9t$<{_Gd`FM6)Z7XJ&j(h`4^EO4t{{TT3?76f^pbq@_^h9hGyvC zfQF8csyU1-D1-Yax9JN`jLyO5t;%0*_jS19Q=LE7oSWBBZPU~0iK(k?8|SsqRfZfk zsyw_XprOywiI07Er^EHUaAHp`R(R%y%`76R$aXmTnkSH)!ra_$==3KtZGVw@Da7bo zN3F%qN>1WEnLXy)gwTX!SNH*^6y#my2cncJsWE77mme~A4I;*@K$*duGB{$BUA{*x zGd{p+?7Wnj&0wHNngG$%TUGkv66-3YxcYWuMz~eUpY%EwgP`RvVrq^A>I6#M?-ieg zc)*m3#H8l=Jeer{=D;_P^L60sE)eR_LaJq0HCbV9R`*kpJ~Ui8HTba!9_AhAEq*9C z#&K0W_D}S)*ogB5_d04WXLZ(oe^tf6^E7R(uUy4Li;PZ0%_iu&{LC4zLSDg-^;G3C zsw5xmDGCLWT0Ys6UM0_c;eTELLPXr}Zhcd3-AHRGL%uQm$>ot?E-(RpFI)<9(3jAO zn9IA?tU-I*g!wTWAHFkLmR`oHuH0NcJFk06NUS%@)0Yf05g?(qz8zmvR~DHk9X7Hb zg2N3A5--2%*#UVxe-cqg32N1*s&!0PNe+?fy5CaV)ekVWPUS}Pi@L??rHwON zPF@1!HM2WG&a-{6nI*I-&_raU^JJ(y7b-w~tw)4}i_r7T1{%{paFj|YQESzmQDwDAhPUkE%ZzLh$``^YU$wo*@Uomua zxfsWFGVQd;*X%;)MGc0YyY%|vT>P-2QQ9moUw7@&&>q4O1FIVl_6-b916z%7H6a3= z36nxzOxVoKWZk_3VTTrL0JViJ#r+R)7cXs>S%|m*yy*hgXs?l-Ox3rWQhS-ao04bj z4H~&0p#0*n(HsQwq~ZdyuQ%;U9qwMK*j%!4N`F%!b~MSxj>HTlrWVl0#&w`N$%f9M z=V%-ajv=6<{KOsIO*H+o zn=Ib{t5?fJPEpbTKE00GhYlJ{mN!o#Hbbe2YL0O~MY%`^aTs|o55y;AeO7^-VkL`m zr4n{@B&mz>qM2845-nVtKh32r{qckM&`(Uiq-8J0KmrfcEbdN0{`3 z`uH7CU|{_16F@U=xiEC0-~i)4EOt927y-MwK_Nw?LnT1SQvbhDQ3%@Z(vkoGt92xw zQJ0oI|&o;}!fo3l?>cf__pMeOZCvoO6T~4HSs09fpRkqmZ)9_P>77?ySZqzO-?C* z=V_uY;*4&4%{B`RRGgs2j4sw^=v!`H%rqYZ`NIU2wLnA?fIO?xMv;f=)ok6bW83s? zT%;}?C#L3}J&)Do8_no;i_#LEzE#;>y`Yfiv)X%~PRl}j42ve>-)b^{Nohy;vDz{r zq{ZdA?Q95N#`Ns3R`7Fw1&1F?cR!6JB|7Jt)1$c_;dXN@AD)e_ZI6yjM3=e{T#>^E zs7f-KjFM2xH`l3wSV=yTFq^M-7C&J*T)is>^y#11OgOQ`vR4lEWpxmBPAD6p>%du` zsE`e4Dh~@MxiSnCJ*_#jVGhr$Op_x5_gw504@~{Uq<^-4+{oJj;KS5MqG7MOG?VFL zLFtdNzGc(k@I{eL>wXup$n#qr>PBR zzMJYX`%^5F3cr;%P-}r_i)ug@>L$|VSn$qTghpZZ1U=aKBRP<9vlE0qK7`O*rz)DP zcZ&T)embq+YImMBN{oNb`>Wf7)Bbij>3hfHJ|^#|yFsD#qsZ}3#lZ9RuZt>tA%{jyYryv3s*LUtB`Ii=e`cAd-OaCV=G0%^dxBNDa`E6uGwzXp4 zUw1l9V!iCk@3iq?2LR@U36n#QR@~XGPfu(&ZaCF8TZq2lPp5K>kYtFRe|uqA>9oP+ z5#8J*<2rQ=AFE@n=ki+S!pPEbe&mLV%YK}f{*@6i`|9e%(C$!oGPAOLrY%TL1X{}b zDEPJy_kjAo`ytt!W*hr;Vkr9eeg5D=MXL`?MHdC6klZ6*Ty*Y;9#M!+o4*DI(6{X(t>*on_DlqI?G8OTruvCyxVC_z%H|^j z963u!Tf%At#|{bV!`0f3jm3+$fi^62&-h(PzED@j>%rjQ+)b>T)>5}l?YP!%cV$8) zt9llu#o)<+ART#Kw_>uZ_GtGQcwHkx`f|(b&RQg zGyqBo99)VnKBS9`pE%^zk?sZ3d|~)fm3_n?R!G;8W%>$~p| zA;C{eBgdy0gKo?lK-JSpC;lOVDF*Laoaa(EN}e@xwK4BKX??oemr|Twa{8&*z*VNU zt#@cAL1~ZV-R1&-s4%pehrCMweR@XB9SEvM9Cj>wl}L=4Lb(3^y_AF5&lxfp|F|Gl z-nfZHNZb_pF2&qcb`X-ZVhV{_mD!Q{mw8s+yTf>MwD~AkF@TFt7)kv!RQ0^{JLCiY zi|TzilvhF~iu>PDCOSMh9&XZJYJ~eu1?cI8pW^oNdD))}8`yVlL#;r0 zK$?=!x|5l9;vn>7UR`zW^RxzQI`3S7T;zLnmeuF>Zjtg9z3vi|9@T<}s2ew>TaOs- zPQ!5aRVcqc-}qbapG(~4blO$8gYO@^4h#*v1}a&ls%|2nsr~!Gk$kf8qWjr;w`gx5 z3i3f|Y63Vs2aM&YRK-AYn&V4)Bl^0UTp-=ttMi4xTTX2ZQ2+3*)wQ=gWY5EQQ^{^I z5E;g0bCv(^$MEnVgiHNj&;>vp7G$fgvje8ag8`X-?FQ6#@oLLGCp}Skxo(eCrfQ_Q zIP|=zYdh}>IASLdI8NxEiteVQj(+=wc!2t()3wO$$MF|J^DkKn0hJDxJ<I!VZ*p(?YUK?lkae4&!XXepUdr-rHzxg)U@fZt^3G>0<_5{AR#RY+NBn@2#k?QKTIT6@$_P~(aJLTuMg(|~#x$D&n&4Y<&m!G@{ZNz4 zPb!&{Cn;Kc(CGh_d*E_zyMD#;bKvSbWIM!%c@D+6UijuP`!VVFZ3;L@Xq8!h?|xUc zVkI<<@LJ=`(&?_;R23aDdhH`xZ7 zz52O{q$%;iCrisVu@cquQAK{2mTCc3->;aVc@Gv@j&54=53z&*TF@XKkx+yW0|gg$ zST?s1@n%Qo$#7-z5s7C)$b-1r^PR-I95`$;eCLWk#S(xGI1BGXi!9CWqpIiCBl71g zm`pB}W2cW)1E%RunMHk`RG<>^zt>Qh%?AsWt^PibqI{3((OLgKl?UR5Idci%Ffm}A*ip!^ z98T85o0jtWz{y8y$HD_+`P!o4+8%T^jlj8gFV%nh2ab&!W@>8~=OzQc?7_bq$}=~P z*qW=6gfw;BLt2ug3>sBYcXPYIxfb^koLWQx+!XY|8u7zP7&wCMq4KFzgqUZB4bIXB z>0e&cY=r>F_^rqc18bba(5kovLLRn zKGkePh)u=&Ro?j?c2<8CAG7}5$_P=xE8thZ9_uO7^KO#9UluVnV!FPXR}U}|SlaM7 zBxfG^Htb=+0n%|B&YNJcilq^{h_rpPyw0io8~kSS1PrDH&B{Zr&Vty56cx+EHK+Wi z7OBd0Da8{#F5ZTQ?hKr~s?yvbhR^rmhfNQxg~e{49P1d}U*jwZVZv_&nxWIlg|GV@ z%JT-&cH-l~2S2Z>)nw3}yyr{H>gjl5nyU@W03^lXB@X}VnEn}^(l>{LgbTW>&gpi@ z{im>#G#4t3pv^g+eof?8GJt4;bV?44Evnk;HMpwPgbZGoIAJCfnFg5E&|jj8O^Ozc z61;y^RnXu%4QxpRMeV>_R3!ev!wpb?MvxJGJ-WYAzQF~i)xR?mSEiqii6oAl9qDxb z?eJb~qW<}p(jv1?MltQ4mt z@kic79)(Zic82crI2-)bT6}Pq44beeGQ;fbM)ZdXUJ8RO0z#*h4vIOq^?d{-0G`0? zq;=RFJ&`n5OxraqNN9RZQA&h8ttKcSUhT_bO3XuBwu~Z3Fub?-u0qefhl4F-gyQeg z(yA7$Et6YfZcqKdB*T8eGlJ7Nt3Mbv3An|M&s zHY1QaM>@?Kt0^&zEop?Dr}6R5JP9H#=~!K%p#JSn{-j?r9p^}SjrT__L`70(QX?@q zbfH7xj-u^=gi`h%vpXMTJK`Kj6q|Z=u?pqpj$@vCZH0A6dfoo86mO~@W;UEG+QYui z1eLe99erZ;UWB|J?;G=4MuRwuDV&pme9vxn0WHbquI{UxkDQ>}-{A8{CoX{)&D6|R zP3qkO;Z611zWrJcD-r-g>}jlK{F2)7qSF5DN84t|4BE1a-o92)US|_m{ID~E6^66f z^FsHZ8kAaEf*+$2@Rx==e`&qKtT^8!u5ABy^2vtuqknKh?5U&3i26DkX%>F2yAUZ4 zNWF~SmCB-}ItIg0nldNx2Rp^b4lM95U&Uli9vYf~fdk;bit7O`$1K{9BW_wbx2HNy zHAZ)t2Nej z4{002E@N6ItzQw?#8(|D`~Qseip z>QdWDZ@2HQ&qvMr6~%#{)`k28>W=SAdz&cxlR2LvhG7r8W!V)03v0d!@G$paN3Pq- ztAz}OWvfknM#^69h##qD)l9G{AmVbvAdaQNtIc>AM%^^?)cGcVu+YfFz1dvVb*%Ft ziI#p~cic=-Esq9)rqCFiI5~6jjHX|DipPo@5k{b{gXnMBINz}U$i{Jbudv*U_LdP5 zCIEvVhC@uyMJoz!{V763!0++Dk6*TygNri4n2blV#{e)bJf5Aeo9)F;!- zYe^p%HflvJ%u4V)%T6B~Ob*y1X%#b1mv`%&A2Ag0DG7hKs3kYZGn00+xSgjr+4G*e z^*(ZB1GE9+j6E`v|G65d8(p?bt%)6;uXKNE&kNi-{@$RiNYwE+IX1;Gp z;?uf1`@3wAE}=}h{`kY!LecBp^3pH*GN8bc%_7mHlf~Ky$Y#2agLYGg5*!*biEw5p z?bGvad}8WP97GG^LGRoUNwLdcQjwjrtTRaU?3?lOwvkfUa^g*$R=jvh9g0-i5->of zl6_L38vX|8r*yw`mUT2tCMYmb5}_kdn@&^vJC2dZkM$?MU@5~~3#Gp#AJ{BzenmTP06?f@?Q}F(U+`=zrOmy$4Tx)tRg1kn7Co|~+;<2K$$Dn};cc|7d$j#+P$ z8*?^n;A8(5xFQ_o{%~PtFH?!Bbn5~V%KmiRTob%<3tV9GRz1zzPbHM8!}uh}W+xhl z8DFDl;I^C-!zWGdfnj{t*LsO@f8mZLqPiDI?yM*W&(%-YJ&y4Hsh02wBBurM$xbtk zyfPLbjN$tKPdXw7vu0@6bMBrBBaS}@uob^Gv6MDCwsghe;kj_@t2Y*TGje!-PZg^w z*v--^fjH3~m~k0mTZ!^Hw~Dtjh(A+8cAbeXlhc$^BT%c%azxJpdbJWTx-mC|typY_ zk&jFCP1vH1_KB;8A>}+0+N#HR^LM(6YOp1HgB$4BKgk;;5Z3h&Ohe(;vCm6*x^@%x zpVawz(z6Ik*zF&~k5Fj4Y2T_>hdTJNtneQ2&3jv{R*RC&abd!IH!W7Y*I6GO_r`1$ z!5mHcS((N-Gi0C2g>ca>d@-wpwfwM%!@nIbQ=Z&%5Mb!LZvF&@zjd8$ns>GT-tRb$ z8V05`&cT51{BG%p`4QlEU)t{7Oih#tNWjS743_g6-Sz3a-`h+uz`R_T?B6Tf)#9}r zA38bN_H#Urq99oUKEkL-wfz!4S*xW|@?2nfJBQcNIueBkhNpVYr|^d;#yx`C;RC#P z$9>h09y=rp(uNdBFi8UWm4{UqX>)OTT~~*nf$!yV1qp(IIj9CSN=wos`-vB0zy3u- zDmv+$($aX-1J?xf$ZvaDRdAZkP8b){@1UK`104n?Z^UlVM=E=}1o#8$5fSfW+sD0Q zgFeNj%7@bnxe+Ufh)COZZ5P&yXT_tug_ozmwQ)E|2CR*yQNoVLB<=igFb9P4x35R8 zK2z|ISLcj5hj`o{t!O`75y?Y*hGQ8uQzx7(m<~NXUEE1Jv{+JCbE;ed(w|8CZ8ve> zX0Y|FPGBe9{G*8`Zk-1IL)SyE85i(Wv`gMo z!35(Pc-(A(*i8o7wX0eSwLee~YRpw`1t(aU!BKEm9tM*|>9~kx0m9u1<{>RN2Z%eS3@K z(=|2cd%BmlO#d>{rysG}Nu=p>HSs6LMnKpTyNCNBnp|?|eTx0I{0o1L^gcyZk-#6* z-|I;ZJ{oNrN%b@a{y$24$m%Z+t(>wfn$t-P9x%d{;ezPu|twe6u{u93RfQ^D2Hi@g=o)yL? z!yc*{dI6TWy18w?1ptXyd4tGUHZtsf@6j#?3F5EAMKsEzRV#imDbNPKr5 zKJx;qZEn|$hIiYQN{@D=d38%IyYXi$FMe(|OQ%u1{n2Q*OIR+rnc9r`^PqlOdg%VZ zdZm$w{JqO#$miaL5i7$-?|i!#oDWC~z0$fbA5htrPCoCw+Nav(dCT0G zbKXXe<#Qur0u790dvCTo6Y}2m-g*7NQtA3ksje$LwC!$ojZcT}T#wiMzNqlvvc>sG zm%ZM5ci6f2XvuBW)_W~0Dy8aSfU&&&1lsBV57QCfzvox(YBbW9M|ga$8ToQB$5w>H z^?stB?=T}nBY4%XvB8o%)oNDqYXSbAt!AL<-*IQb(>O-EIQ-}Vv?N5A*WJz6Y z@dyS;u!7S+^gCIK5qCmgxowp&F>IYNla9#i?WSE;B|F<@>-a}YVLk< zrv`1_%Yt;iS~KM_px+WR;w>7HjK@~*klz9Xis7mGDn=-kv<_a?1UA;#*9&#*%+=3Q5L6^P+@;F#|r^I&YnM(B~=bOb%> z;lv#?%B=9#HuUiR<*ofu`iuI_VlN5&wH6r*4x!dRv4J1b;0uy zpqfTSE_b`HoLOS0zsX>p z$3>TZbxoipzi z5S=xXg;Y)BpirA*!#G(bapB3|6805WZecF{v?{+(8{B$1$6ZXlp79>C&tIoH-yIOM zA!BnjS)E-z;$V1@`5NnpsC}pNqVe6;MY`@X1mbp+!=>9D%j9?PrZKk_U)m7Y-hbqw zJ@oRu)oCu*+Vx3Y8bs!XoH)&G`lsBsVv}uXgNx$e9$VBQrU#OxOUW@>8yD(9DcsAU z`}4$$y2SIxLT568A88sglES9rDTprm{0C!an~4M*obSzuVPL?~+W6jBR5f821ddz4 z$$L*df_`F}kmB{IYdZ1;UaO(Kpz|tb$-DCYXQDvF>+N*bi*`<4<(iJ;*)#9VOYk(8 zF6I%aH^wC1TJ#WUZ2Gw$2plE)D8~cGV}FsuWqh}0m^b4lyB}YdVaGIgV#hu7glo9~ zdtsiOCAJ~!1uhz->r1L!bV*v-YSkw5Q4 z<#dLcZVR6<`A0l0*^1kIO(HzC^^)?iv;m3dRm6oW+Wd&$+kMkB-HXSGuc6CzzILS2 zJyDCkBM;u!x>DYlqRtfuRVzs~81qfbq;qwbeKntZ%C9>%1iZU*Q`eOa1UcU{+O5Ml zMClo}z;D(&!gS=5KTd`C)!fY|d%CSBBgBn}nvO$MGfGPlFyUZcqIG!GnI0GF>PW~g zPs6ce&aH+!zuxT0NyDnYd|2prw)}WOz)^~j=I&c11+!6Y7wfrSV{I)yhT`zg1l;W~ zXB#c>Gt%CfqylsZzDyyoW=Fa;fHB=t|G$jCef6e`h^4T6UE)=2M3L>N6*`QQT>uBe zmS+>?f&}-<42RdA)0`-b$Y_%laIhz0WO5Lr3ugCNRpfQl z1s9g^0|_e?);qakldg`8y|C-DsNjR$2F}fUwYP|S>aXxihrUqUgAJz9^;UK;p5K~P z;Z8%-1b%1{u3c51P-C4(9i)%BsVm*)s`gOaUaz^^rF(5hP?vY*ghMOM+p~cc!C%Xq z7e4!Dm|vES&A_^~^WWV3u-8moaoc(rvu~5~xesYJ6y@a1KCc29Q}}t?&A>W7w5Ps^ zxHp@>EA(qDa@=YMFFtgXC%(O#ig-+lXjt8Ii0Yb5`g{jdO!K|iztkei03L6FUEcI5xLj0Fx)wGVck13 z*ETQg`@8#?ciZF9b0e#sh(QEM6SpwqVYOYlvHuC9@0tb)`Bc}y@b>+$C zl~!D4L1O4;43WSKt4$2G!;i!fGO0T8I(Z$l^LTCuJ-KCeIGdCIxNx2lJJU>=t?iloR%TnLa~{Jagy2%*lRNcKJ&Su!;Ih$e^XQ)Cd@3 z>D}w^p31tJEZk``dREUa8=^Z10khlJjSD^*a<6Y3NvA!>t&hQ7iuS_p>952`^UaY6mM@=<0Bp|7q0V_ zlAWhFiWB8;!%&sbbrB-qHD5HgjE1xLJW=!s*HA&V8gTnAk`omZ5s*R!e z?I!_-^M?BntT-U~lf)?D=zl zO$~f`lc?!#<$a`$_)!`3s8)~Q2EzQqpN}jVosh>QqRYa znf=C8q~ENAvumulM!H1I_EpXHphj~|H0o#(fZ#qORe$Pb&)R_gWX{x<;d{#d;c_0+ zlk#8cjQ;N#J>#}Gw!_$Y&yn6$o5a+oUauIL*bZOaXmW*>)l-@RKG-3i_oX166*Kxe zK%rvhFVWkC*P9+e{{D(kCegM2#fs?n_n}sIYoW`a14vb#<*vGFci&g)k@go(m!g~H zpCa}_z7{2=+ofanbHuFcGIa;UhPOB;lVuziI=CXY`^R8+zBXS+!LK>yr4Yvwfz}Dh!jH?+_(?w~^_cpFXbo zW0GBP`tq?>@9dMIke}fGlF&s*(9!Y(DqKfjT2T6}t)8Fux~^@$Jd)3S?bw2!$8i83 z?CNo=5_s9C|7Y*^`f`v=nxApa(eQL5G>D?@{%g>I9C5vG9xPJSi}N#yFKJ&~&VC$r zwrC!7R?}1LQPJ2=n<3BXwFG23Fi0{+aXis=M+Du@Bm;oX#NBf)PgR=$MifN}0U>mA zTV>k{?^00Fb8D4rl`;5TY%sUQD5kg>nT0 zH#R7Bc}eAL5+F3z3BbX8QZ5vfBb@@Vzz59#*)2h4&0Atdzc@ov$D5H`n~^-dfokRf z0@w1J9|Kic35y&odJ?{8ZWgu0+n8Djg*=~)vzok54SnL78op(@;x)2TtCx?9ataZv zuOXDGS*0sg53`CK>Jgd+DAYQP#hPjln7Pg#z4zWpzs#RfkE0cu+n>p=zuO6c{$^t4 zw`RpfbK3CJV{U_LnI!mDFw?Y$z4oJjJ7L;n+qpsThZ33sELxo}FHd#e#l34LI5 zUjB4Adf1)!=DUu$8ecIRSwAh11Y-*!?CKp)*8KTPbX!*`t$_0@2&Q*O=T{QUfE?Z6 z8i7b4axQv2mvg0?b6wO!6WcpMJiY$DhcdBcPIt)ezKAx$*6+CT*%b-_4Z%y`u&3dn_~Yb&>Rx@JEQs#n6ni^F zX)S}Cg;H+E*68*wKb3D;pv5it4(ZjiP%;7m_8NBk{s4SNfhQr1x`>8E@HDUBp0LAM zY%P0_hZpVNSeRS5sz2Vi8y2L5vx(%7lsE59-4B*P%it~7GJ=jaBA%DYhRCpfc&Q%j zxxu#jeUs;*LWK5X8)yCvD?0H^yWN~=3lr-a-}C#cr0#6vD~4htQ^N((%djR-NXTt1F$X=JcpDAfuFcN8 zyK7eDE~CSeOxDan=7Gp|25uv;a7_q#9@n&nmDt{4{l*MQwp&`r&z66@^ie=?#{Xh( zli^A6kCzqC=Tlo1{Be5-l!915#u6p#z%yU zrZ&LpHAlanZrnxHAq8uy_-Lt~;-6;O9e~v?FLISVqqc|1t!3{Y%)9hFW$6_c@u-O2 zl>lq)C4R59Pd-DTUgj-eiuNB-bNw;G||VlUyZkAcK+EzFcPiW4*)^l8_v z4D!UzkUV*yuy6#aC!aWXJlS%J+;SrW{gYr^;d58lthdj6CMZ_Iu({;&A}VSQNW0`- z(V%n|I0bCItJ;G`krE!XKX3I!1;)LVPJD+bE-#InY#&rz$z;0x!Uo2b8 zc_s@)EQp=Vm?S<{Ou^mq5k5B)us6?sa9hBaJt*5^uhXF3>XvL|CG3&(Mtw#Z9KzM4 zy0R*P{xw9hspU=BUva%|LygYN9Y~mvQEUMHi$ zVRy77S0lDu`?D?D|Ha;0zeV}3eWPCm31vu88UX=m7&?^@5J~CIp@!~8K!=c&?vn0K z35On9x^qBaNNIt6yVi28XFdDf$NN0{*n7V}y!$_Zd+zJJ&+C)CKC*CLOXYqGUc$}t zURP3TZw@#rKCd688+|WPoVpU+bkaTj%7vcQ`w8l%V)0iGN87RC&B(In_yg^Fn_28L z^7e~?Yr{`>&n~Mi2D)rnD?Wa}VZYD$rejh{xy>-Uaqpr1i!?yKtSi&KUL4tR+WW;* z?!?h$W{k~FjfF9!ZGu>R*oNFfmX!Yeq{a)6W?ZoNbn*_ScV}W2Dxa z%50)Zn2(*x&~XjA-|=({C0HhdL^*Wp_mZne{C4t2e*FZZiZ8i-RvcrP&5n+R zyS`nnP?oQ(SS48I9VWV0hxhPf!+`Tjtjt{7c%^3oySoW`!&?(oW2u+K*PoO69#1rT zEcI$%rh5sKYWyytHA+6ElRH*xRK&vt;xM1KQ0}>g*rLnt+EI9-DO|;$N+AYe_ z>?@~GO}z{s45ezQNQrI%HHmee2l;35pDQQXt`;lZtmZPIp@{au98aLz4Q@7*YL1gc z(SsGX6%XRS+v{~x1B$Lu0lBZk9}U4M^P*=}!6JEibd{RyHQ%oivvmWim@EzY9nQNh zMmUs{?JyF)gSZ;PnZLI+X%Udq!x@288lZz#Y1SdvS$O)ES=Vyb+06ey)8OV~rk4K( zWVYI3#&4C;;Fov%@lGszcQrSP!aoQ^PKo=$Z4n*&)5g;UpFUS9k^0+V6^pn4?5}Sw z7Q||dr{rNpy`}YUN8i!*>+CtJk!j2|RPS>em3P`2PuX~Tw5tXTJ&Q~Dgn=5YJcu}b zHS0hQc0zn;JzxGgio$zSwnJF6SA_aJ)PjdA=^##)pU{mI@I7>2PD%~``ij(CkxiKF zE~4O4u=0jqHBw3Wd`EX~c7ol%ycaU^2)Se;{i!~RG}Q_+eA3HCz5PUH9}F7xtXkE7j$hsTxH6&9vy zt#2m%+|X;1wO@CYWN1_;)?V*c27;hNE6ZPoPajAtP+z3;yXBNx{FD=*a}x8bhBJzJ zO^QxkiE+VMsCR`OHoc*v_^2hY%!RDB#tm-2k#9+B`}kyO zG0zj+8N7&~JhuWi+2KMg?%|K2 zbmh+moY;lod0~lChQ(z$VqYEpI-t10p6gKevWk?iFKD4rY}FQZeGt|*dA01YXy0O^ zWXKP5GbSouNZy*f?e#wz_CL8iC~se@wVC~HU-320Z~dvEHgrg&0@lPmn_=Z|DuaTH zZE&mps#wYzQJ4RapK+|g_%27YdKcj`ovtFni8UCSULRhcSu`>jyZ$I>GA3EC*gptc z&^<`g@G_#8-W}->fKbViz5Y@2sMn_cZHa)NV>l51#VJnk4yoW52?Pc!;TLVTMC>f7&GOc-fhOg&kh37+5g?sqki<^g06T|K)amY5b z_${|)zkEt`s^oBCX7PA?=hRovEq)={;cGn0-B5l2|I>1lkzbZct<8%4iA{bDY354$ zcLtZZ7dO!yL2kyGzaQRG+pklZJNQd~z$W5zKGNoT_XSaHGh1y!?RA4p^gHf0yxI7@ zXv{O}CqSm_{PqV`?IhWCU)rw4g{Ip~+jkWVTj0K(=BP7{=TOx)|5<(a>*Ch@d+fNX zhJIrLMooEe1|nglcW~z0!t2YvOaGc5%KJD{(2)I$5;&?`7Wg!2&_(QQaQb z>}@l5FKt5+|5KQ6cmc0FL+WY8@rcq6M?#kIs1tF6i>PlJ8U5EFX`e~s7R|&Zj0h z8#VF`X3}~33>!8CC8^wJ&Rs(@t%FAXFj$pH`RZYRolV6e;~9S{N%_dHIVuEp$bdbi z#&YGV{(9VArxa&py@r*C)~tid&ashiW?TDg7i{)$Mg8}$3;dmI!bWRU^?t9_LrbHD zRi_Ai%GKQ2T#}&wXnAO=yLY5>bY@Hu;w_TJO6DECI2Ej86=t-=$|QBGFO6qbt;T^YPn$KqV3gwu z`n*a2Da5IXdufuZd*ayOrs%7R!1jFghU<*(#hI{prg=HsGtTPo&q3FXclVm4%pWpa zcuESZO&hsl)8%sa=&LA1B;mh(AM^Y4mvo1G?ve&HLeNFgW6hSeUn6#7DPItfZ+2O|Yq;Io)@ms5^2%My!@e3iL>0{rS9afw z&5sohljXpa)LC7S*z_jwRxTH;<2Z>;(F}g?FHEP`i6G}qrgQ;E)exhODiav+9sbE6 z`O%dwnD-@jl8WO8^sHd za*gZY`Q^HF{tmMlHSv@O$$I(bEnnsHT?%-G;S9I-mLVuSQ4-!P8v&<9{kp|3?Mr}*B#j*m)T!g0Z!I#;+_`BDsIExfy`z? zyRcDJZw|m^?XGUd$r@A;a49CyBubAPd!|izcMOyy&+IvCkxue@ZW z4FrpzUdQMTDe;lDpv-1s*{(&RXmOIFXUe)OE$PMd=C>qEB^vY(qYl#UJLEngG&9k% zeCN~niQ*6BrN9kFNzC&CqMc_1Y}eJETlx$ri@lBwFlqh*$(Kexi*y3?GoX*Y)CI{$x&WR%Y;10r%+`Ke_S~?B zefo*@MKlaLn)P|a`uTuYvP0r*pK$ElXk|&k~TZsi&E*Is5v+{eg{(g6Oac)Xl?`iY7@R%-+pR+tB+Jky@ zxksExy+Q>^td<>9Tx`VDSMbIWuFhiM6BhA(>IW4TD`!S!iY#boW6qsEfTzHft*^emqgjUkvTaLp3}A9{IR zMLDT0sph?6Nw6+aV=TjDb{2=DWc34UFCMX1dkfjtFtT}=q6uCQ<+?q2q?Vr=u<0T> z$d)@$YtOFHCEb4*IslslJ(^YJTi9M0u4^B7@~;Uqe8fLfIkx)Ba#|s}Qr53?C|FOX z%XIgE!d03yX*Bi22#TBBe8?=xYtXs{osIr;X}6e6o^hTp%dQw2l5F9L`A~iExiIkz zj)YZ{<>)ZZ^^z7|9H@bYu0g)f`%VFG@iuy*n4JreF~>gJdcDGl{`8BnwYE)UgR6x{ z>Ra-6#qvDGINSvZlo5A5-zO-vfPe(OM3!>iScPep&Q=}d2IpqRJ*w2dG&#sH07M?? zg&Ir`?lIR%KKbQ{P$lDIe$#IxGB0?m9ghLV+@bpUA+1P{*wuum{nd9tskC}u!s)MH z)5vxnH{a+g7D}}=@#&INBWNVpQ*bZ=Os%$ND!gd=Z=YP?KFADPZi+$To%w_Z=%o@( zrHDrkLkH@0TQs`wy=Itm71gE28-LcU2miFwIt&yyQy}q+P9bVBh&KUvmZv*HHWO23 zQv$;gJH6t>(QHm6R2mu7cYgau12sWAG$N>UbuzBrM4FRojKZ+fL9p`+2j+A*NYMTOvzH&>g3 zNG!qH5Kc$5(`173Lua3G&JL6=BB2641Fli$*q@U*tSVOliT0&e!yqLekYEXBy_{yc z#1ZYV%k0aV&Fl^2K$g<->fvhQ4&&sySiArwn7Vm=CAGGC+Rfg_TQZ%U*0(^ro z%!wUe43#(GPf2(cYgfXe6oJYVT zvm>Etr#+6D?{+)fYF*JV-KxJjl^4y7JKl;j>uykf>^YXx_Ks8 zVNm`ABqZYFH0u|-@HWlRl&FY3meU!#4D||=Reklvd+u%M-a2nZT%hu}@jbZ{TNBlL zX<0Nr<}<R~1s?%8nipm^_ zTRl2O%P0k}M5~*!8lqC+SO({i$Ge?UuENvu_v<mJ)mTSyJ1N7Y z()-njJ;m_TOQ2Wlx&$WX{j~%M_35S_*r9X0mewy}p8Shc+eHJ6)t9_|i@#E|QKjNF z%WwX?6uB67Mr32HL{25*)T{J zVWG0fCpfAQ@&d*gu^fmY9|!Ci`6ivcoQa@M;`Qe8d=I6*s-L;9Uniuz!0R%Ku)E3UN6K0EsEcOPHoOffT+iT z9sspt?Fgx+UB{Eeow&8Lf$@zqw!Zg>EIh5`h08VQvu47-e~7Cg7Rikfn|0CAov;65 zz;0Y?4<~n=C0)VyNx(kIGiuk@oEX8TFHW%+nT70!2 z)6gb2<|!Z%NlH5MvoRT-WIt!oU*kV=xhKlAbi6q6UTo-KQ?!QVS%$f?j&btO7gQ7% z{s>Yufv-35nQ2X>$6PBxERm9)w6iw1Z*Lch2%Z9A2ep+`;X3Z-;PAbZKUx5peh16L zY@%ZZ9=s>Rb{Uh^2OH`S@13qZ$3Uv~y@BGsR!dEYT?Hl!m?oGASvK(d0liCH9bM&4 zd!_mXB1b0Rfnnk)MZKlNeenz}#dF(?>BBE>5Cro`vcU3f#*d>*p zHPwA0Hau`JG2dTV43bp3k0_;9`CRbL)yn}0EjX~MLV1W{wTi?Tr|TJFs2`g!Q){{B ziypkkolJb&x^@g?7JSxU*IpF5=}>0ro{z@K!OX-1D%?5DxrF89^==_ghSovJ6b$es z9@CBuPHAP43Y*4DiT`0A9LKGlu`=y4RpPvl@N zj6ME-0Rt}Fm1%Y%O%S!@v!U*=nHQvDKqW`BF)(9bJ4q@di7lJQr_SBpUz(cJMRIf~)P zrZqj)|wjdc7ZiiSFW)8XzL^Hi91gH9IGif)3%Z-~p=+kg?q(>`m#z7)(3_|4SPgx{Xs8)fqzx$#gHc16U9c*|BH2fhTj1 zX)>%oT&_jFZ+_HWo84eThc38i)-R^>_6B>|5frS{w0|Tf4nCm=@d24lf`$hPO>iX0 zLK{YZCq$o_jX8rNBIUW}PO7q7wiCeb-!ujR0(^G7siz5KZsz9h2QFa!uG8mdyOAL; z%ua}V|F1EVC)7X=WeYK1^}v(hK2wU{xJjDjBUn~IW!1v}062-Pw_E8@tk)doCDzr! zUCXkQ|8njA>4_dyDTh5*DXJyrd+k^W(JHbNqIDZgOlOog-cOWr?uz75e5lugEfo11 zIRRJ>bWbime=`mB52Rb)x(J>c7z|$<5nKalf6X{m08RVR<-^!Hv&u2$F=RQ;bqGYySj2AZ@J{j@Sa6|o5U*Jt_^pWgF4mNhDt{#9pGo()!!tn3F3C6M|$;1*FPa!zj z6NsAr_J6`n0$nY}&2VE(M3V~bwo=}7oNZdFqe61pd6)f2ciqPlZ$Cb zFms$;75sfzBnDZN`M!U}=NYVa)rOQ_7@0=}>@Lhv%$G$;7 zdt%=j*A&WYq9`A?>trlnTY!IG!crht_!K18g>OTlA0*91(7zC9Tx_%c6MbH$b`OE< z#y89L*-&^hSixlKvo37Tyr>@tO*q+lnD}|;GQ&9zbns$OmS9lRR@Gacr*=v{>r%ja zku(yKS)dnv9tVnoQby__{xT)vm{D1Rf#vO1Y7tnfEtFB+@6)n!E74*RW=T$_(Q9*Q zuG083y3qXU@#J|k2ZR}XeP>A{*qp8Iv(Heoo^Ii)Bw4w5kepaa%nNr>yW4l^?-mTS zQx@7DkUEh5yvGtNZ0G}$(){-4M#xIkP}TZ`5Zs8>@%*0VuS7>W_Lgtt4-3k8*QZpD z8jI;1Zn&&6#(gL#-CRDAPYz(`aJasX=S~GtX3hbrZDeX;Cw;a6Cg=*cX;mwDK1FNMPlg#vh&;QP>s%6daE2w7FAkThtESn ztD)==>+eqBG+>%AY&d*tRR^p})$ew|6hb~QBFnH^`8Q~oBd=Jaw%37BJZiI7-1Zc< zy?!>HTQpd8r5XJ%BI*%b?-T!Vpr$$he{%HiuY?<~aPP7aTsjynTc2P28|~!-erhL5 zf~c}~=Lu4Xk%T>=Si^`-5^t>W4p#|^ur^M%`pGp#JS_gKtn?Zu3F@Gm#5+&5bf9L$ zjg_~VBQDIn=WQyg%(nmwUjWk_-0+LKTuZ(yY3^e6wr(*y*$;x_>qWzgAXS1(Q|YU= z?6$H+;ITsRV498_4^aQ1>TLA2&fH1A97vSp)2~23u}+SK$9ZFT*xc9qYDrQm9F($K z$L&r<_76%_$!ezXIepNP&DMp5I$0k@q4y|}Q@)e>MCjPB`wCn5j&o;k^v=(mtP54Q z&+G-W2~o&78(SaNV5}xfFvSZ}s>(V$H|t{r#8MKvO(KUAdcb_p_VBerzFWQQ;90C*%=>*WlfgsR;uX6YOf3M7gJ-R zx}*wqnF6+^Q;NjX%Q?`!$F4Xkr3c6A%%8P0tR87IuUCbBXM7x}Zc&zOyxCc2eh4_} zJS-{zbyQ`JC&@E}2tj)G8J9qH?%v7%Pig>k6_*qnnPgGw_F(6$Y3ZrfJb7Mp^T=FP*UIET*m9MX>u!>nbava>KA-gZt-SExxot z=KdJmQ>b|mCT){Q>8cL*#AfH!w|_9Qius=!GrIg12?##gw5`o>l2f(H{kh#>$}hmD zDhionh@BV**64u3kA`p38nbKop5b)VaOYqm+fIBQe7*$oe0i%Seq3RgP`Tq2d9SZr z8QT2V6o_I5;GLWDP2M8JDJCL-2uZuKKt#~#CL65Im)|Lc&&!o|L8K7}aaU=AUaBVK zDRI&^oYwOu0Lm}kJN9llD+scf{EVXq88uiO#<{MSB(U}kf$*eeHSq_fyi26vdty)% z9m#oRKyNL^S6wk-+TyA4HSD9ix+~_wCE=bG+tFwlm!KM1)VoYoM747u>@eBb0-;k> zJye60kt{`q43E=GdM^&_sr7>3reBM#Bok$q`OaqV5OkhgM<*aNscGPf;V13K{*CD6N%SFss3{lGtC%k~Dk%Lnw4)^+}kH~RCQX!0-x;xF3K z{SfQ=d4!pqyG{+a&DtFdHgh`~q=Gg8qnln-pBLRX_My+TYU!90%fYn=GBXK0O9rLp zO9<;kz?eNX_O>3o!z<*VpgG+j40Q%>CE&v?ApVv0+BrfXTa@pIe*S60up-b3moiB6 z?!Un0Y+Sx_DKGyKW&b)Pnf|-9)|^}9D*bco>8zp~66B(bcUA#&W*>6;nfnRUybcIg z^JDz;Qbdw923Sd*DE5_MH1T0NTZc!*1g^7S5GMlb-_(_kMeT0VoXDe7tR1hS7CMg70iANuW(!R4Y^HB`+l0-ltbSujQ@7kkhT+>brNM%g&M2tCSx} znF241ZLOn1VN)sC04-7`40pUdiF+#pYa*)}#9jM5Kap zFe?!pdia<7vISAY$}NG`KRQLSqM`H-hs+5%OjA`-@CBR9w&I+8JfTof)Ye?IF%TZQ z|1v&18E-SxtmcyA(z!rd&*3`mJ8&DdUQDK>hi7*NEB2+1if9P{!vxV5tI32u5fn?3 zq(sA5CiqyzR!0%03QUs^6pBd=%)iBNa{4gI;1P%W3NZ;xRx2x{A)5rgX@FcN2*(l` zk&Bv%VmlB)&rX=+Ce0gj6T~?Dvzd{>Zq=9Gvyuy?RN4KwCJw_s;}uzJ>G7n^Iup-6 z)bPahIhLK*B;y+y-&71=aeHIK9KKy(Vn|4o9H{ej{_k=Q<0C+V)9ulnvj|y`%xGoc4Xy^TZDz{?oTwy zvd8w4;1DVwF`&VtHK}{=1()MxqBc(yznN1Kj`#QQd$Dj5@uSx2Rb=MPOe8Q^ibWl2 zLmabbD{~)%fdNra>wGd)xx0M8{C%jyshI|upaPlWf68K# zYjz<8f$zY8xk7H|Vz)JC2zm79@RXZxU69+%Y&$%w-DQx~dfvW*lq{!Pt2%X$6w1Ys z-&Xjxb(RdOF$c?wn%C(ECJ?@vGRe#xuN-fScg?)#46=JvV?GbRPJd{FkzK3DV`%~N zwJ*gSfXzq8=rU}4y~_`_^Ov<&PfUU+*(Ta7`8tpUJ{sq&W991wFxb|iJP?yQ1DQH3 zSrrl45uyJVmUa(%c6^meG_ zEb66}MMQ1l(>zsxq0z(X=Cq+b6VN|;0b=;Ug6s*Vw^+}s@*!;K&@-7WUdVize#zQ< zS|U_)Mp+c56~2D?>T6d6i|G_`T<4I9D{yh&=9do4S}#{hK5Hl#O0gw(T{bL=dPu-k5$aBK8&{!smGPL85Y}l$X0y1fWrF6|6}Q_FNCs zDKvQS(9Dt~aSm-?43OqYT-%5lTgW8Wc%jU*7`TaObwj%nz+$GBIymv`7}y-}&i)kt`*IRH&~ z)TPmB5dh=}v|p2{b~kl3F3G^m+(*(Flm+VeRFgP-5W8?3M! z#nFP~$&)mie|?%u4@_%s;~}}g%^Xc<*y1LkEJ;{oLvsQmFMDhPo{p-1$ahxP5Z#A_ zknKp}d%zwy<91uz|APn0H|@qL zAUD}ofcZ_NDUlr2i|YrV`{WnD?Oke(7KJGFJJ?&m0TtfgUWS&G?DiP0H5E{+ABH>f zmGYMbbPT1S&Rz$~m>H&QSY5kwwnirNF%e}MJLg5VZb+7vm`LZB1tpl+_#o({<7|AO zPrV7DS9XTi&<+*0f8SqO6v*=k+$2Bb=AA76LlNo*Q~0$!ia$^7#c2)bJU5zKtXq0T z!z(tpZJ%n*%S@~SZ4$J!_VLM<-s(9CGRO{(voetVBB@WVu`-~7%o;F57C}d`7z-02 z{^bOWwY>~q5w*8dv)EJVZ(;?d!cL8Hn$w{S_vRCW^PQ}BP6CdKq>E~i+I798f-fX< zhRuq@M5sfCCwXs<%CNX<%;vD(&JT07evm?u@zhbnTT|`ueyVK}&Hf_Wu=5)#b(_kX zJ^1oxUsL(7>(7yUWIXt^Hgz4hLmwY%E9%Y`wlBJUeAiMU7+&_9@lz>BeB>I-kif#q zUJc)$;J?6^taNk%k#$QwcYXvbs*dn0*Y%4=ot$@t{1vm2(bHSIEgQ*@`;qY3OKQ$g)6ig z$#{|va5e>eXQz`#xrsbMa|(?7hAYn=YdjDk9tL%uA{93Ri1qEEMs4q{39YK~?wTjH#isiX%1mn#mdzLdnTmSR zuevHEDgcD%o!8E|wNjxQWb{=kmU9F#dve9&0lv2k_gBF?2zmoYPoRFIzx=4wF5S{NR!t# zaX6WUHd>37z+8bx45Rd}OKh_L9G=O&|3y;q-?(c-Q!P#2fK=`Pr?d6!*oD1_!cf5J zR7$^V)0z(Vtjkxz!4ilfuIfJNN)@)lX^t_#uUnT-4=;FH+T_Ozj!-v<GAx zNng)Yw|eHBwJ)yJmpq`Z!YF<6h$mgL%W9s{ad93|l&zRO-@f@lt~M1~Q+HHFLA#OD z?~rBYAtekQO7i;Wer9r!PHuH;G}21~;H}1Gq#N6<`8F+eP<0ArvmE{Dn$x3apd18m zYvJ%N(74fOj2ok4C{5gy_W0txMnySX+E&3lVtt{|kD``{DBCU%J;M;1kKx+fhQIfE zx4namOJ+JH;8)6rUW=meUIxWXWh{;KI&)Y&CZL3Bf5Wz({uQ?^79NH)e$RR$1t5>T zD}9mGBQ4+k0iYEFbSa`)Aws-fB@h3*n$>o@h4m?iQ&|jr!lu2?=N@id4BD{8$k$PNx8DGg@{@;5^S|fjyF)#vW~ZigTtqTpJl(eg`AQd6un| zFg7+!M`eD7@tc;{j{wFfv4LdjY_ZR3ZhJD+;baBOdIt|9sC@Th1AFLN$eE1sLHQy& zrOaF3Alw93i@;Wr)R*8A=5OK7#%m#uI5@U^D?@I0ErH9)3?O=y5c&p`Y!qJ3^tHW< zLLs$JnV&4FPf|K;y{#;$>ym8f*-*9;k@Hn#Lkwe+eY1e2vqAF)_(o_w%n7ZMxZgP$ z-^cj9ry~0{j@?g8lpBz#!!d8zqBgp_Mk*?)#jBRFuXt*_GPt|`^=Ur!4WDYSwwcfk zGJl1*EM2Z9b`B2y71kV%{l-8Zd8MKOXkO2r5YD#B!*6sVl8A_CfUAuwuM4V0NJZu} zu3?{UZ1-%`4Pbq{^J-$|#YZz{5TMZd21nm&H2O6o5I|)PKWo?`1K>Y1T&sWAyaMKv zSN|V7=>Bn5G`WBBgQZ1^1Exn-hAFVZ;!-!6**&>r@^ zqXpo>u?Ff;)shEAfQF6L|7@HS?ri3^0td@hQOT<{I1fEHx;`FNQ&jL3;}n~G5kDnT zawb5B36Y&hmRFD2LK|yp{?FpqLj9opGt(sZ@Be0;n;a(NxlaG{f(Tpx*QKv%`au{H zAIhH0v^Oc!Agox(PaEdTm95=*gRA~#!yIsJ;$)ap#kxnslQx!qg+XnC#TQvFo|_b6 zX4lE7Uhn7?h@#UugPfRPRjY^{=RZeI$8ohCQF6!cvv=|$E}cKVeRJwFA~*nZe{B8* z3t3WMB+5VrMDUIJP}J??^lpx*viAYxes3MFOgZFzRp`^b7xt2*4EzprkPk(Rk-a9b z6h~EN0{S6f`6ez|N84c`I;_1iURCWMgSOyC2mrOX+LuVyBeHaO=pSI zXHLq-wNUW`6{t*h6|4$&%YitJI9KoE`_nnvFmhOo|J(=@Lg%#%9$}N}p&NaE&vJ`s zBuLa>1%3PuG@9)edgx6OG~OohC|QX`;tDr+M_6y7k0mze3?vW1@ItEQgVo)>CO`{J z*szl1%{E?;<{xna&A<7b-_K!w{HD7pc-T*8YiKni@-|VJD{!8^s)#cuGtBpmyxBu*eUXFp(qD>S({W1X zIDbB`9K0f+_hi;9zyxG#M;TA%Bd3Ep5JaR?{ihIRdXD_#09T8-6WncO-=;1Wb|tYO z##!Es$+GWwICbw@LH*CX4lhTWxeraA)Z}(`Z5o=7i7Z9;8-w>0xH05$P0_ng24JcF zXQslxZMtV2W3)XV&Eb*n`T)Ca#`rkF3`^py)eT~_tYhXePlZ{dx5=-qr-kzTXow%M zBwguvt7W~?kciK#MDd^!@+Z{=HjQIV=}`Z8wm*lbB_(~`zS1}s9xz&-`ph`yS70h$ zQ)Ec*)Ux1CIG8h=A3Jm2f^RUTpYt?n(hXZj?z#3S-$*&Q+_lD(FUBBmBimq#E#84U zb0z7Aai_7Ybkei0Ra7s??Ifk`lB3UWQ>mJ7Xo}SJO%g=w^s7D3JB_i}W#JRmGZX*@ zd&rl__eCw)Qth8!wj#kwKu^`guBiuQNG;b4^sF1~Hy#j06XCm8Zoq>B@asdTbIHPZ z5ks}$t;_X<0v;Q+&!0Oz>YabpFoVo+Cq%cg1y!4vce*V70`i?h1Z=OLmwS5)@=h?h zTsNdChq^i2*7J!aNPf`cA;kq;-j)_+q^cEvb~SaJc4xXF>b*-6v?e~rQb5+4J{@P< z;8qrf7A9Z2>s2pC^+nvJ3HEf-GhH8GcmOPT7g0!?7<-?3bZ63arm(EP)G>{GGAhW; zgm$7VuHytcG?Aq^{WS2a<;_zqI^?zvceG*b;RS2_(M;D5qKBQuHB*C?$3Pn51%DBw zwPw20-AQXq1ScAj5i+cNO+o>9Z9LtteuJ)AG?`mF@dYL#306sig|&c95agS*ZW1W81b5y zL8QB9C>UCd9@P|}xczOsF)lK;Fn2pwWc>bGPsyZxKO{tg&(P5(34~`r|L5GGG3*=f zYO2NeJ!~R^9K`?$d%DJSB{q&BB0Vutt4;9GdLt|{EOG=$HJ|5zJeX3Fa#~T9vo?40oqTs@cE6vJ+sBj-SBi+Q8MN1TDL5+AMLE(mydpGdLm=4{yNE#U7o^mb#t>7?@3iVhC&enpZrmU zwyX?^Zv`PQHTkUOPSv7Fi9z?bmf~i#eIM+z+60g7sU!;K2$`ahBFL)qNJ;OtEKd=~^4ZN{`FU0f3X@#JWXIKz_u&{~=` zZBb)anh6nJ&`}&q!OTH5qpbGmfWxpL;D*%>nk<+{S-c{k@xL#?JW4mE5wVC`!eh0WsCanI4*#MC2e1 zYIuo(AviB+Pj8lQf#NsT`ob9z&ie9cesj06l5t9@%A5sw?2ePT#;g34L#eGUHwapzX!FDu(CYOiku}&{ZuVlIT2hrx=ve0R6vOCw!0o69; zsMdQ7@cf74tbH3`-gy)RoF`m1OUifTFDYr`zuj4Q4+4+b-7iK_opS!70(emEy~&7z~K@k(YV z(CC&+-kLe>AoKRvKQDz0XrY5A$CGhGBSYb*VV9o5|JubKF%7OA} zCzM+0gL|=|;S}_69xB*p<9GMIe3!8()EBS&X+)*mS4Sw|LHu^?@vc^mv0c5Ap}NX< z%=9i;ud{6*fWXq7XAX=G1|LgR&;CmM)uc+t-sn4E1>8*Q_6H+Bua2%rGHxhXQn981 z!vwP2U-J0=PUjn(!Gh@6DT=T{J~l@9?`a}|%Q&bT|NEijvBR_B76JkJvWPeyheMpM z;}Ef7fT9=2;5q3TbKC1paHk4XM(iYqk6X4-pn3e+%s`TN%=WJmK$JsT4L@%lcB5aD zQ61^8ix4PZXDNG>h+v9&enGK-QZ0TsF-kkMJm({p{;668xclVA%RX)Sro}H8HN+aL zlfyF56SQCEJXiX-`*Q`5sx5stnLqNv_wb~J3pKUj6mN8^i2*dG_tHJeVvaXUwZ^CH!s9l3vy-|F? z7o@DiPFBkeZ{wdrgTQV3`q+q$m;Ap=HoSaZSNwLcx}g3o-+`C_PUi!wB%LRz>i`D3 zgdB&(F%v~F!v~8XGVAR}JiM4wx=@Dc%`oVY+4oa9&WZ#L~1*fpd zK-hUJyDC`&DdN9y90!Y#dj}>Naf|fV$O{+@XvP$!v0&DGolY{uG3tU#P+*(craN_ifa$PRce^i_L88>AK=#K6K+2kX zl2VPDDpz-W6%*D>yN&evvK@;csR-bm-% zE5}hq`47$UgdTon$z&5ht|Tg-mfhWlc2NL(%rTUZDl-pEl`7yXL8Ik5l|rgP1t_8J z80x~^&x9@%aamG=?^O>H0SOn>L3F|cVh4(M0O(4_vvH#L^;j*u7YvFejdx3qZpc2U z)@$vnlg3r8xuFfZxh85`C&SHjT3q)HG()~6v+)3>IJGUYIR_7s4_D*7y>*onlf zX9QcGS#X*zwkJ%?4SI?Te2#l|e24L7D&;FwFqU1019jyRgJX_N6l9MX5a(zI}$ z%;Kx#LcxSkC8h2EeS@$YkqZUeDM$#A&0`;%*xdG&7XLjVfW5Uf?Yxur4A9TGlA4&V z@;>^3m3yF`^WQTG&x?FoNq+Oicv!aoBlhn!BFj{|Sj6(sC-KD;dm$NyI+4#$iC(sU z^F#0UW84O+^E`*~|Mh8}I_J{48>m*X2c_I&+p6(HXbe(P9kc9!8J>G`CGW~;KOn!J z)0H(l0fWx}CSCmC^G1GRa%DqW(}S>|D>Z~$w)_rI${7!b-6#54@Z*M4PI zLC`rHiCj;?8uoG8#yATBOO!GMd@{jn`GIHxQT=i{glNt*b_t^6zq^ONJN%`eg0|a> zQ)O|OH}*XWA*m|JdwSV%p_Z$rb5c6D9!?QQqhbM8f1QCRwY8ISd!g|mNgHhYAqM@3lX)+0P8DmU_#D31ro@d>4g1h0*DgmM$lE>Z9zmm`o>z({shC8HVO@Eo<+ElL$59ZMe z!ie|Lpi|lRTKJVGl-KyRny1P45qJf>ji$li-gZG2QvTu3El``m&eW6bxtRmO`#1N? zFF4kv_1r%4KUM^aN6T{89Mxr3u1v>8@-790_O_q!7snGx8SaEJTkw&KJ?pWf)|frj zDNhfpdu9ZViODrf>VYeR<(c2RTmd!#mcj(8L9~ZW8uu|POqfzkDBto74xRldVYa@? zik&(1CfPs;?$%uo8k7XtN_l~GZB_+LLFTjlp%r^5=wnT) zMctmTXS~EKQGw8a%g0XRDUt+}`I}|}K;(dY-|7d?lIq_NWdb7La)HA*`q(P@GX`!( zfELwQFVLed*7x3gNnkGWX6ATU65m=|G**SoHqrDiAPwkmAD?pLZNp7aUv+ja>23lL zl9Xg*2&ZdXMF0m{BTZkX?89i4FQ=#ioYgEm# z@TnWP)EYh-+X3E{iQ6c0NT;FzN}s%SY=jN)?sF)aX)#VGipRGm4FJk{s}bQW$Gd38VZDAOiNFTRkVC^FeNpB9%OPF|xtY(L_jqO5G=fN*0Q2g#z1Q|x@D~l&Q0=n`w|?XzW-v|TGmt96 z#2LU~;q!WP(eEHRDv%_>x;@KZ{2BSk4ln4?Mzfw{S+Y&D0XA|H%oxmcj&nGJ-sm;P z3GnN@(@=|j5gxwp18G}Px*6k@DsSX4)@O&0Mv8f&1(nYMhl2cOaUoIe<%5)AnzdR~ zY~wy^b3(ab6t(Om0c7^n&CXqD;SxBFnF;(hfdU+g{MUc(XI#IABY6BPw@h(1=F%zw zDXWWtYW?C|9W(9=@L2io?3G6}#@HsAf!da<8^G{z2FsRld*Rjb~7^U1CM&Lc_nqyQ_A#ttUZD@PkA!eF5_ILs%v zLOnO?Mx)q}y>ONp>z4aoH#Hi!b#cVds!89Z*5AL+U8jFXx!Su!Az{MjTQCaPY%#Ue zZhBek*{_*uINB{gYJLpi29$uE{6IFVTx%vom2mRZ=x;PD1=~$Si^6g;RyO!^WN{q@ zBj4L7DG*nD2I~yD1w2w1|0`}#(_6x;^c7Vp8206p2c^NC)$BrJEB_3V-{MINg&m>N zt_G1?kl8Tu$Y#uT*b})SyXx#!^27m?wcwfxs|a~(lP*%6HdH-|4a33ACUD6X)mOB4=ll^4~EnIz3n z#W5UeWpx|~O-s8I(ir$4;4ESmw_)rsBPTYz@06MMu`$sv8wT?Qyl{}N%1=>S?x>gN zw085gjh#w4Ns7RD0n;OBlpT)#snkX#(=2lg0ggz{34FR%R)~LrOKhD@oL<^J*-EwV zyur%K-%?H;Kw$NyTsg7(eS6r9F4`XA+5ldnQjXZo7lr&XdHzYcsB?N_2&`^Ehv zb%#R0W)$c5e~5_QNRc-GOK?fzv8%TQKR5&YZ+gl3L72qaT8q$1Af{t2>?BxbO;~eA z0n2~v;SK!WS?NTnsDGSI*BqRm!TRd22_}v|Z#wCxpTY%0E&oVaf|(spNSAC}Yxqqq z!e0CYV5Y$Qby-yClt8|OO*&5)s%WlKX~*!LSv+TvALx%ExLOs9)(#N^nOAMXp^ZFj z)8trs@+Abro^T%LYma$(o6Gqm7%Bi}5j?qZ|34Mc_^*Wclq3s1XXXy(sL+yQat7C& zcs|HW7?C-cRvJKlT&ssN3gMZVQ^;V_wov$}gMKX8v3HYW%E@(BG#i$x7@d^%i3KZ= z1F*g64mKS*i~egpS^34@@0dW`SJh=1*PsiAFdEK8AZCfy`sr`z5iK8XwEIL z(N}^PY?LRbxK+!DY*MGT@-#t>G2dFfUd-v`A%JZJGv3Q(&2qsTw?mMZ=Hn58qnNkN zY`g54eNGP8<;R&J{#yf$rhKi{471kP(}KRFScnua&nj8QI#<;@J29A@>QuJ4eB>_h zSV#ANCLYdLiz)-zCfZLPMHEzp5+`d!FAtX{tjtj|-{t?kD2TZnpynbDa}u;soNQ4K z=kZ7>VTRR_>6yWRn5u`yDT^hxM$bi{mU!%`@l>@a6nUQ-()pH7X~IE6O6=>Jt@`K2 z_RRj}e=>dtZ8~^Z7jz*3=mb;8^1i`nY|w<#V9fk~U?u;7mHY=*@*h~qe_$p5n_wkB z5+j2C?FIM`xa2?JlK+59{sS)gzY1LPe*jkUwtunXPU?GxcGB)YcI6X$wMD0Tm~5y2 zt;UC{^Of>sA^vw3Zmt7)9=G>%r}Wk<)W@az@rAItUo-dWQ`GI&b#iW)-ugC#p*&o z_1MOs3gshZPn_|n-*^*uDpcfC@RQ5H z`tW~M1VLe;3N~Jt$D%wn6bH}GUE9k7m~3u2x~JoLg}eDF0IdWydU z?dq@lA2gHtfO`j&92X#z2d z0CQHA&yVlQ^urC2RMNbp#iX8p3{mkLVVSsuR;7CI<*5g1A4P@F(Civ_wff0o>SnC5 zceEaZs0B}TNt8>+OJ#gj1FAUDh$cI3a&r>~4yas2eetbKT0xsJ7omSL0`uWU|0#t! z3GN0Coy@5G<{lIKr!xD_*&wiwcy0&lA3*hGHvhJwR6AqezSmQOzRw6;+u#gGluxSY zLVQfTO?)AJ)30#EjkCE9zTJ}QvoM?5vaXx@?)#SUhwUn$J!qz%#s6a`E3XhvKR*k2 z--oh+xj`-CnF@i3>WuOhaDp-Sj>IE;t=uep>ux9f+&s%bD$~p&xOpp#VeECiSZM#= zTgW5q4@&WO0!?MPjGu7N=#Cl2jCGFbcRtCo*A1d&TdmC&}bFPxRrpKqdb&uozZJ~56o+OPwaNSdv{X+ z9;T6WzPyC%zX)`;$2LebW5;otc}cuo=aR4sdhHy-`Q1Jm=e53XZ+X2+uQKR+?9ttp zRU6C+{pS5V5{~LJZzxFV;vwUE$bbjt+wAR}7@trQ$<93brdsge8b;iK`mK;XCMr(8 z1)e2pZs_P|kHY-_=Wq{MUAic=vomrDr2mtKBEAtxgpdX%WZ{5 zg1#|_q~NOav|Jh2P~($(vUW0UjhuN}Z9-z!!_V8#6`QHG6zyLh%oz1Jxs zwr|Bl_fFfE+e&Vi9r8sVjgM?A#}gXq`vLA%_gibY{l^|q+CM|D?Hdcdy8tys5FbG$ ziK5)d{&^;rpo!m6?&d)j>9f1N@MFeW{KwlQ1F0Voj%T(T=z3I~kd1UBgfaoj-1GyQOAmtDY(tQx=2;~jqC*FBz- z!^6wR$4feti)uU5-<>zdmE(61cfmmRS)s=Ycj5b!BZuD`!X2PjT++AEBNE>i(mUUI z3l-WXZjRWYC)uY7wDe6=uQYo-5IAPR<0E~2$vUc=A@O~Gx&-aVhUU^L7*e*XZ=c@rz?Ht_Kb_kgskob>@-dA;Z(j$FTMbds5cf z@ta`rx@%L{En)ok%ZVMxv_gr*$2oJ{xD}f;HOIHzFQy_g`EW<^d7bT4%c`$WZ0pD8 zk;4SKxEC5UhAN|)eneY{xYLihpile8BRMbcY9ON7%?Yua2%D~+Y1*+U$p{{SvKB}Yc_ngOY-uhkj`_ie4n!X zKN_36Zql|sUYE8$F179bkNB@zTi+wq^}OHPw)8jRr zkEdt;7Yp5w!B_9SPu*{uPeLbu^f#V2?1kP6c}PBXgxf%i-LfoOv){}7Jx_BQcMo17 zo;SR`fVm`H9#7)kKETLsZ(y&2AP;5L`drsN+GY2<_sIdF*9}c49uGkoZ>c3`m${K; zr!;tuxBQa9zXHzacL4{sI^X|J3n|2^Nv$?_r*Arovuvz)B;0Bl(_s*QP`I3k_RJy8UQ}=K*dND- z(*S9Ceg1GDx;(rJF|Rq9|5=%pS|bG#_kwB7AraOBnBI`?BH7lA?_8{@B(xQE(C!L? zRX#>{@wi7ft90%m=D&VXZaF}0xlL!gW?rmb<-ixW@eR5D zpl+$8_?I@nvtfo2S(~|8fj9jNnf=z>8eQk>9?RRZzZ>ud^vtKxxbsm3-kU4BLEGcq zDYMPTf;WEwoFknP8C(zJ5-kKYaJJ=cMDANN2r&aAVSTV8iNSD+`fEuY}ynqxu3 z!d^k9E`je>gei3M-n-cncaMUdNwW;XkA3l=qv_!T%`W(^H$EAENtUhOX-cbV>;#q# z0)1Zk&;#Jb+^p<%05ZRt>_6v?dF+gGeap`CKZ*E;Z!&af1@QqW>n?sEO`EQDKBmHqaC;RiR z9-kVNlqPCKOM87;1TnWob&FR0`J{oElU|c5m!}yU1DRpO_Ayx`7oy&i9?Qd788npp z$_>Bww12X-tUu+H`I?)OCLFQfw1n#>j#rS0*UIHb`cp^}Hm!aAaW@7CIz@|I-h58Q(iEXarG_;9v34_jdg`8Ez@l52n)%ti z+Uc5fvMyYaC)*2ZmQ7w?*IM~J_snAH_opoVJ1RLR*W8Q0)qHD!phBZxuD&)r zQZft`8-L8ybkh1HB<4HUMZI2S;ovoCYIkM&TQc&F{r-Ce%m$`!mzKr1#~g%rwM4-) z2!jCHCir;kz)kgW3(bju=zJP!%Xv5>4G|~+vvhMqOsX!3`9^ltqm)UUSPz=%k3t%= zdl)Wl%sa>+_eE#`At{0l20v)m)SuT89~j;`BYmF+wiW^$(g4d>-#dNKkwz%!o#{13 zVDC3T;p}f}CZ}LO>bJ;${vn=$6UG=hgK+v50mV0v={lb7nl&;yE4yYE6C*%!AW-HL z&hr9u1HqS<)$wVcC+j)fsjOnfoMKg#h!IFVK{-QY0F&Jdvl^%Ag4_8q51IhNdL@aJ zNqKSO!(-QpFX^(^oStO+se36#813-y(?j;>qVn%+BVea(Y5KaCS_wKaD~?=Za> zjVj%QO4#FKEV#;JIE*}{6{3itF^qyvDCN}kt{1BjwcI!cDH!Hui?lJn>wyWGA63G9 zESjV*_B!3B+*Y!(CDSN_#sM|}36pf_fQilUP;xRQ%Up$y;`^&!3E`+0 zDs`9)n7h~-!r?A>$DU-YOpF0Y3;$p0j%=^gG^3Mzy-8U>e=&1wWEhBE46Q8^S!5kw zG3UsLX$3iM!AE^Aa6geDtG`Op>8v!j$f$w z%Cn};j5hBJQU+4aNnfh!k^Qop)6-%Sf*@$<+xq|mOB{*N-xcBX%Tu!$-9zrC7y&s- zS-yOHZO@(sPHfJ}67}2bdzBgDoTg$?*LBFx@FFT>ZJBPasMCA;JaPUQMj>=CE^c(j z9}l?2BpwtzJkvNZ-fhWpg!ehxyF8aN8?_8LrXFstpHmR4G|LzeQ^z_~3OJ016!OL$ zVR&j5RAW7zwYKb1@d7FoE$n?Z1Rkj)FlbWj1rmXag?Bi?UsjU^mj@Z(M$ExGA4bb)FE`$W`Lcs7hvxYt7-`g^CX{o$bAEAg28B zF#_GrG;|9*Ng**t!Ede_J!N7zLIZbhow7`TV;_R_Zr?2z^f)LY<;Q=f7lA-)!^I81 z_3{lpzAZE<9;E*6R1Zph%aWUAM2{l8q{= zCtob`Ng4JXcZ(^&Vo77ng4W&Uj`s2X%j%Ub^66t4{P*XH*iV#ctnWp zP1R)Zoh>Xy3wtxW@48TPOkb^My#}MX4B{)z6m%51T+BTA9hPHdR#@VI?~gg0d}`iu zTKB{2esxY{3ljsaMmL#Uy$*y^=9I?t+aCwB%C|&!_xlDmdWSLXO7m6=tz=(wo3gG{-6r7#pp;B}_9$b= z)cz^>uU86;HEVM;#1=z6*=HbwBLxuYt1y;!BKB*JBa5pF8hT zkDl(%?ki1}lW*6TjB+mIYu8ZZuc$EZqg{9(wqE&L->zF2$X9;* zgn=>)#9}may7TcYIE0pUKWo2IlWtNhvWU&&%zdYk%RRXqsU}KiB3wQ9Iqfr98V_GG zb)p0M6za4&>}s@X9ODzkmCUNE2ZS9B(NBZ$HRpD(D^Vs{0WeTu<`>H@94qUJCsu?a zs&hT6g3uz+r~=MmvS;OlxhcM&$VyAua<`V3I{m}AJa)IM7|>#k>xQqiwtrr+1)hLF z#UCS4=S+TqJ+>w{iSC0}6ZNbbGq~T)9}q6B&Roph9;P&rTD!{bf~xy_ZOia=YHV#ndWT-A~>+n}6B=UVvt2iL?8&%gM)=Z;$)5QfD zN$pbMxGHZx>)OQ0HV!3*p~8|$djveNEgC%;VMAlYd~4Ad@ zF2d-L;D9YJW*o8p8g3Y=J}B*~jr&)xa`5vmJduyaxpZLkJE~aT>ay}tDV~;`NouV6 zN9NJAkybBnJ#or+j>Ela6aO|AVZrevg!M++m9>fjBlF2+yDZ?IeW~DB0s#J8ZZ|Q2 z7xHhlbyBN<;7#;fS$&GVpup2>-EF76^;#o!@c@2ix$EuPVU+fKBER-#PZ1gW_)vwv zvFS9nizImnV*V%u1Q%ckfPfJYSZ>G|H?c;w47{O%-+}rv0^r4@m8fO>tUkhyz>Che z));i)M+5s;jM{fs`|z*r>Bw4jDQjk-6FI1l60Pg;Zul-^;ZvkHkY7fP+oJQJpV8*TUH0o^$K(LEkN#^5m!*!50lfzspI|=dVvu z`HS3ECnLnU=B!l)6ZpAC7O)w6tZVe@`~tz8Rc;=u&R^Vzs#`Q6EC2{$sa83!ajm;@ zr{xvq9$mMVxx&GgIL43aN868rWvb$@u4`Cj*y4tbW&wYDKqJiuMzkInn3x5EB@pP; znCDa4Yur__vHI-caGc-*y>0hzn9=z4&Xx)*KO1W7hD_OD=BNYn`Yv$-m+aL6xY?>Y0rjW1Z8O?egt8QF{9pZ) z^;DYyG2l~{QV!;)bKU4=_re2da?!BT_2NNpHnI6a)$H<1{ zxRANndveihCm)i@cKSrkU9|Z?JRj6?V=9trn&Y|mcL$1Pa#G&hoYqVq^r=~fTEq;l z$_9Z||244SS8-vv(U(c3Z>h5NkKEKG!zxjhR;u>-MnCdW9IwUYWC9pniq&CXU9 zZna&*CKsuGXFe&dl0i0`TrV1vz1Tu0-wgB0zO6SP2u$PX(QZEft9mg|gk)aAywVG2 zV)NeEzIC(a|95d?uFZ^zT+>(~CHF-<0zX~tV&{a)oDVn-Uj)d&YTB1$#EJMqf5w&F%#rpb-vjZaAtOC5oncDN7i1ePuzx!sPUj!aDKaZ!$ z430GF95#H7UN82#h`s#O5W-Xb_h<8yQ(_Xoar01`=-zeh9*Mh4%P5}49EaH7E)JyY zmLGk+>nLVkE%KFhEBNT4Zlk=six$>89HREn&H6S@wR1)2IKd&}_iEXK?}i6zynTr@ z&W0Llj`cdsv@-cr9T>Lks)K7erFPUoqyAovh&$;5{V0Md&=#0T(FyBM0z#LlKiUbY zb(-N$9kJ_JJte0b17RF_x`+Bdd`eR>9OndHRRK`0FkBL09CwS&q`CFt9Q@qFLLd3n zv1i7SR9O04(Q_^F9h7cG2qI3Ciz4m~wD#a2uxB=WHxXa|jllO%W5%m#=)R1H;xq!|>EfLwc6 z=JZp+pYZSrBV!~0K7kw~AMzJR6x$d{O|~ah(+yObCj2BO_#Qsuh(H;a3zh@|ZN0G< z2@4CKNv6s-;Uo1X&Lg~I!ScvX!)S2yvgJAExxi19c{5n zkuLG9yYo@k0x0Y(hQrLiwh6fV z2^)C!sW7uqmXaEQ447_5^k`54gxU$U=t+t1F4%F>J5!D1Gi$GWT$7TnzAs#Haq4w4 z(DLs5Q(Uc2&4lOk^A7>qqu=^acoEbS-3O`|F#xZQ%InO-lj4{%sFmHsP8g1q@|bZ` zg056Gs6lp7P~7y@<$tzaB0i+CksF5x|9lMy5tEK2jtIn~LT+O12^VyPJq&}s;My}J zwKvN|&S3x6H{-e8u==ypOyc}oDJ)AwQV0|;v~eCyTRq8wPubM);2w#aBy&v=a&O#h zIQ2*5{*=#-F_{e&W7zY(sP!T10J<@CtvqfBlwx_-of{BgZAL!N+&DceT8ch zxAfy-^nj)g3eF(T%f-Fy%FkL`J^Z%FewyTqo{&Q&?|jmt3oMSF&3Fy z1^vEr{an(dK0Hn^JuIUfsaUHDqc~e$uu@qq_Ca$Lb1vUYy}eJF&PeblIEwRQb)NN} zVTDDsKaA=0sSkaT#@;;kS8~l)8m(?VZe~V8PymUy0c)17`(^Rwj;D{J7JH;fGqk%E zN_6pg92JPa_`b)n(tMoC<{s=3TOm3A(63(5ldh)#GE^Bt3x?!p?&>#`yblBnNXny| zK6Flz9MKi_&F7}Bo%eBP54A`I(tQqT5%W?GZ#EhuSJKbe;vAvu!d@M}&pfUKiElg# zrN{vRmObBVaHOZznB~(e!ngp2vTF)x&=O=4fANMQR4d1BYOK$$G!MlJSNhcs;g2KQ zjF8}LjIIzmr7`)(C?(L;Pncx{%v`~eJICYfHA^T)RTgH z^o8Zolj)%)@3T_|{H{1M=Q}Ct38Lr3tae9LF#N_|)g1 zwa;B6=mR=~hQot?m4hgHK_X0#ok=%0wR?8>kajqlxVbcAg~b75fI6N0Xl1oJiKp&% za9h~rqT!63H({?KUhiItUtARnv4ney-=)b=hvUk)eq;8pK@vbm?bRi0~t7&gDuGNqG5$xo|tiis{5c9>gP4 zIuT4f-gGYCROYF24rJFk^Pb1LQ;|FYfWiS<>HKt4@hq~`kfO*bKu`U!zA(SH<<$@| zN9#)^dK>%L!Mm`(&)g-UcbFRUOqI6S;Y!|5u6P8PY{^jh=us^>C<&9Ewo5a??zqT{07L+Q zMfoHx`NfRTGSpqCih_jcSdn}s zcD)z{DpeJ5vAsNP9=LP`74xw%EF>4Zmhb^eclJm9Ywx+D=^k9@mW-k>vx<#}@4<>ax6vh*kKsl>a2(6lYbtSPQ)S z3>DL7d*Og3uk-NW_@u`DiC2`VSPK~w6_EqHAbT(%Q6E|ug)_ePJ+!2u?rwx-R;e|} zNXJr#OK9|GVvxt+kwB%kStNoL%@iaj$8n>#*ndfycCI7g8+y?pwg*_XBfZ3#@aVZ9 z3UI(6@gYpR(5;>gqbvo6PxN6AUATQ)-r7vX$nX@p`(gmYHRv~*E%OI$Ys2rzwrqj2 zt-8>3W{2{i#)sDV_-mcl9*TA27BHvF+HJt4b2EBUCbYY)`+kr`E|-Aof-+`j>LPOM z!(n)+kuB`k=UQ*`-Pa3*+5kpKkr*~cwHTynmg(b|f^sNv%6>{~=Ggd*Vgx{W5MfwS z#j7%)htIXR@x+tzRmGUauKXpNlR~GRS@3U8!?^4ac4#0@$Ney+Zahkj*3z8!LAM0q z*MXP75`S(!ZbU$40lS2;(Y(M5yIVD296G>_+EaO{(HcvfWs=y>^}}MJPvlp+(#c;W z-^kWWjV?I`nue&L_5Dg4%R4Ej;^Z!k`d-9zuOkZ)f%;=%nep^B8qd4$ag!iud=n&bsPNlS>t#`Pt)-a=29w2c^G z#clbmmzbIE;b5%4%eygvM_I;+kqZD6#;7>B>E_1bmHb9Dn$Ci*YR2${(?g%ye zWO0c{KNSoRlv8HqD~Nf+P2JpU4;W&f;<>7d=@N?T7(eRR}zd`mBH!LS#_R2LCT`>ThkMYZ>OX11^AfSME# zN&<}_&g53cSNYo?LR>hRPt4{Xn@iw30O#bL(R$3N@H>@lSG{}i+vB{`r=BS`Q6$mu%$G~dT! zH8)}Cd{6$Tn6>QJDP!_i8cl`xaw}v!0if8)6_(62}ae*o0Zwt$O1#9ekU6(u7V98W2+0RPL17_Y}%q+ zH`lqZ{1_=HevZX1e&s6M1Zk~Dhie~ibD%$#!?|JRdKhCm1pXg^S5rDfSF**Am1`Z2 z1|HlT8N|LDK6@}~6IC&2>nrYa13M>76P})!1dpo)p>eX&w>)EC5iYl@g}J%4+#aRAbOEN3EvhyVqfpqfL+F z3^AnxCHl=$q!dC-s0vy7+3e;=6HcLsl3#@FgxXpBkG~?oudOA!d@cUSaM|nQW?34M4jiV|AfP|vn%z`%vvXIkjXm1a-uP5_TmpWnn zb2OQPCUGC>&kgUQ7M=)r^zewe{Q92f<}2P?YkVBmRT}xe+g))>sL4$>acF3vQs(k` zWdbjE>zmq2Hz7*&GjLm5p4SeR7n#dpjcfpP7}Y`euh2i3p_(ejo#g8y6}s(K#O|yK znl6;oKsYq+ylUmLbyXv)`A*QKcs@b1@i`!lhK*>v*~e!qS-aw0MOHHbxq1LSPTwO# zsU>Ksm4|>Jo@_@e4l~umM7lILcEB;6OQtb+8wdqK+FJuGkm1u!3Ao z(CBxWnNdJ@YP2$;3#dtHiJ^|e)B|v}xT1p>@HTotaEMMG{|2<4`L~U5S4V7D#J(W0 z*9BD-8+@SWocJj5PYS&sY;w*4T8vJO@_I2u-?arwz(J(UYM1`oP>wDLe7&>5%!;JkzNdyFrn>G6m>){E{j7^XS+&o_hi%LqoCC{( z<9DR*9)1T2O}^d~wfp_y(ZW6k)j9~J7qUaI>uF|cXeh{!;{>{*N1MN-6cDQsq1Z+$8!_k%%}k{3CfBnQpHtG?rtbmKv^{<-gcY3A(CkHZ@KL3sZ)D}x95tjw?1>(en7yTxq|P}c%EEQ(pAUR zUM2|~z{Z_owVtn{U3kT9?bsx!j3AeggBMOhqnY{fCf+5saz3ziTClr?D4*`@NSTKt-?U{ianV>M zar13R@e>0S>EJWLQf9bJYj#eaDmK@~W_~#Vfb2B64QZl2;T<(VQ=55++?AASOABRE zqc~%FQag2JapoZPmzWjq8L(FM)xPH_+io`DZ%|*#Jm-=?Wg~;Y<+7^~GT91%IZcg0 zVr6iSn_*v9fcRx`8EtZxm5_3TNUHRUcu;_ZAxs;coFj16p_x)?cmeN>E6iJ2huh%n zT8o3VPtvKTA@z3%vM}mRFh%kBvp~2AQC+9XgW*9}v{RPW6<1GxW6JlwOW`_0G6Pa~ z{#FD#eM0m(i^M&Gwr*K?_f^8#-pekI$2gANE)H_#%dF~aV^zK`)(@~sE0q$#>2A?L{X4(RDC%Ng2N32FBf=c=OZ9SFh~r* zhnVF~JQz`EV@&4My1d|U2vf%SPBv)-{_K$JKQS<50r_4f|Z=P*gyo9~a0(uLI41 zlnFf9Jw*=wb=G1jZZmhdZ0oIDL-hG$zhuRjcB}}~|8-^km~Rj2sd4LOu_-e!ay65l z`O|Ip>mZh!#ZYnUN||`g`{^S8)yb(Q1fUd^4-6*q_?fuVdS}xrWnStrlQRbp@#^?u z8;HX&ugj0s?NydOs!>LjmCe5Olsk2;1Ob4BozHTk?E>}qFoxYgkDFETZ2VNi1|Xpa z;sM-^I4?WV6MjJaz-PMSt8&1oBpSfTLGc0rG}cIDb;C;`07q}@CwuY2*ALN0({$x+ zu162f)K->MphICfX%v@%zD`iwOTV4%&dPN#c^V^x!XEaEPy$ZqD(q6(TIf)CF>- z;4?=j8e(aAu9l+zo>{0GK8zaEM{4dCIM=JKUH1P? zI4+|$H)TaA*wG_sVNyhe0R`ETZ-_6B6a5NvX<<_*#`0yAP~d1x-_ybjE%OtG=8s%* zJ&90JE_T|tt66F+04Iul7x~M~)-eIeBD&)h6By!V>US%#$oe^rc4`n~JHd2jU7%UF zyM1fMZ%dFkIGDh(?PX{_4P<*bsE(KllT=Sb=3!-?){Bm_pTfu@-&mPZMg6Cgw@7^S zGU}vt%*DI)N0U=%sVH<7`1Pac=Tx;|&c)bJY@L;hnN{`dh8lB_0=DT!4>}+_gUJ78zwVDEAYd#RI$C{%H(Ah;*V{@Bei9(E`SnYLrPq~~ ztwH!KcZe1yMj$WCk;kRc%PhI`A+lyleXHKhDtiw`?G%+^v>mK?XwO;}E3H+AsC!Al;c|tmvQpXEAEM z73de?uR0?_u=qUIUSZDD#ZGnB)UYNd?dz$T$%Pj`s>shCbybj68TnZ$XdJ3|TfN1J zbG_`7555-}`7qskWSzATUCKpd5Q1AGW%{{63PNc!}6IS&%Fw|*CX zZAJ^O3~zdSuPoY9B$w27*JHt7W_&oXn|hql>n~yN1#TA6Il)&&wy(=IvfIQ@W(w}G z*bd4%ex)#Su@DOwa(p`IY2%SfpAjOz$Q75v=jVB)z|(+E7U)Baoj7cD7zOmQdip4+ z9Afbk+o9$!r4W`b0=?GL6sTnNW}IyeMAs*4Zffr$YOG!gA}28MVMHJgHxYXQ4?npa zW;Jk?W4y0CHz|%!RIj}ChkFngs%J(bKH9rC<~FCCJlpn|Eai|&fE(S@4Wc|q3|IA$h~9AmTjt&HcW|{ zRFrvN$&7oLMn1iqmDFdKVj5bf(-&bbuN9V0(KP)!SzfCcGS;BS0+=`*1}16Bt3(oI zE8Y9jLmvSvl& zbvNW?#P|+u6{%1=5erN!H|ENaK|@6&gppD{WL0|BF z_D(^on1kBXti=Di(Z2)4BaERy1p!F5`vC`m4Pg69Ebh82pA8Yvx^e>7b<_IN8Uv2p zJm1qg()FjTyyXU8TmaeJ4^mhzl*39&sW5|sQjft9n)E=t&^6r1mQ-U_Jp=hz6Jvv~ zFG7qCOD2yF%InrOHZhA_vIhcZLmgJJ2$9TqqX`eS+Y~C=Qy5B@K_dg~Y()FE4ObMT zcRa8!bqFy#QOUU{TUNA5nWgs`i>N?2dn1que+~9mp z!hI1-Nn^iNR^ZZ5egBqz1pWN8FZ^R7|6OQ&U~OWp2)mQPA;iVfm_uBR&#$*l{q*Lz z8$`@0!PLKnxV*4WjC)AM`%r&kQ&Q;rT&T7+Iu< zUn-FuuOme`P*&3IN;t$6Zm#scou{pLumE(?x>0s6oOWf?F2+zZwXxO}%W+PC!4{!3 zpcm5!f#}(U8q3W#w4z4Vj<*8ERzOl*rm3E#Xn4VcJ~uC~S=QL@cJ}_Iu3lPC*#FIe zZE2iN1jlw(aqXvGJq_DHf-b#+qaon%&@8I8=r#ALVB{V}VFtAkzUy{l1Wi>zA41SF$^(;=q=#ZtO=nmv`b3LP! zb39SUBNL9Aws}|WrfV)JcnZ8ad%IQtm)@}6KwH*Y*s2D1p^yJlRqN21fHkj}+$uuP z;_7)vy&@k!%dDh?qkfJ7^BX`!C87wzb!)Sy6mqCX(*U+afv7CZ%!ZvlMR^!)Wd=#p_3LILf%G* zhzXkqh5uK&YWo(oTpn!|k=m#Rqu}cYm^}wrnjm5X<|OH#sCpD}iTc7=wWpY=+`r;^vcq z3IAe*EV1Ih>Bc!qTQ(;J*(2y1~1u9DVl9PK4J{pjBeo$;C|H?s(H_VZiifKE+ zos2!MkL5^@!w;%~{*WG(pZU?4$?h5x+N$m6&wRFX=GgX+T}Q_1n~Ys=mn0m_AEs9TCed? zZimk9@2t}m<87SmhV9(koJ`Gp|3Me#V|O@)=_rEw$SZCrBf1Rox*0WhI$(Eo{k+yR zVAtMgySC_|pJ!yx>3pg4vfZo1IMrkq_kzedt#|_yvt=+XdDg6R_dL4~Lr#_H&`A6(Vrr21;!}G6U_V(+GQ$`h(ZdQ4z%HT@i~XUyMMXrZM`Nv7j?e2% z00!O1McY;IE;O_30;0eLqCAho0 zLvV+{5L|*g!QI_qaJK;lIrCMWU3K@pcUPUN^Ka(Iylc&>?yg?lkI*GEGG=>908^%* z7QKkbP?;l16_n+;XP5$r#xg3V?79c-kzL*Twf|?NQQWBUe~az&)l*2@_6D&L1hton z=YG^z^5>t243Yblxp1X(v=OU z$4K-^7!P8h!SGA=6n;tv(cyk+`2?Po=vY&2Scuj*F00#5M6%W5q6)?SXWH|PfF)UH zvD;aK)m}Tc`#SEldAthasdmj)>5PZkC@DmU8=FG-U1pbJ2j3Yd@A%u_r38|IF$Pb3 zd;c1ux=xm2(!Z~It*7J@VtIiu*N+p|1cJXltI!|)D6L624`@01`8+J)S9Y_h`Q(;A zEp}_M*hJcF?PmS2c6I5`B!P|Qu5@9Sf!osk$fWX?r3vKumq>dG1QQ=Gj?NoUd9n<>lVO7=S>mnB#S5WP14>dlpe=?&hSU7n`X^r#gRso&X2}_=?(KQk`~H z)Wm&dEmuqDZO|8DGySYDYD*>!x*yh+bXEG@_7?aw5)4kb;!qBAIGTpjSh2qpsvVvF zX#N?SI(oMQ5%MrdcWkG2U<;1DzL;!fk*KZ;Ei7<*h1YP94ZN2p8FXhOXsXkEB zUtm^XHeRWDhsn>al*Vz0gm1k{9K5t7Wtrzco$XJf*d6lRTjZXv?Nw+V=f482rL*$t zK6yH_;{Q`3aaEE+S;y8pYpIa166N7M9Lb>AeYhB1+VX{@m3EO`jxI#3xjpJB=QHm!yAi4JwDLjsW(sK?<=k-C7r)ce_bxaH}zB0 z>Kq&?#;!|{%Kh5@A7a)X0Nur|oYO!HBPo(B9tUHGVu!wC(tzt*yNf z8VR5mO{2F(^g)N@K*x=m9C@!SWJI^IA!w>L}2Rtg8 zBK6qL*YNqnPs6Hvw|>7AcXjO*^czGBQsP4++dV$VlPbO5S+0C@fkBz(X))ELDg|si zqfJ}Yc}{JQO6#_(F;?nvSrN)wIJ0K6EFTQGRV-c_G}oDA-G;pkw6264Dyxh~u)3C0 z;u(FW_fgdii;lJmM3zY2lfKpPuXH`Ox|kmr9msai>98LAGH69L=kMKNxZo;cutqi( zQa)CCP6U%A+83Qft6_bLG(o&z9c z=Q#>xQi(i5lkd2HxO={rP-98wtxWKHgv%9s z)pmdH#lb>DD{J1!>avid5!_8_T=EU-bJPk_CT_=!UdRs5oh6#03wWn^XS-iY_`7 zNRAv3@ZsW4_qGKNfHW{m9sj@AAtxy^SI(lZTpg`7x?eI~nNRVc#1@3qn8Yznl+Ws! zv!66)InY*Lo3*KwJFK)^%ni6zm;N?AMshArSkQTP`@zC#<@aT9-lYgvW)+jPaag&{ z<9#kI#DNQ5vzPDitiPK*RifFnCGNU!x@+HB*<2yoc6Rls0Cxb3Rku|{QuZb~xVoGy zcMoj$)c4C+$9$>#Q?q$%RyyAL-(FLlOWJF=Qokx2#VM0WSG^aI+N)O=j3fIAbhZOhr(|pV13ht5o+UfM~H0E6r z7K2P}&)lv6n6iR?g4v=maYe-WKzebjx9}t4HAv|^kI-%a1S-SG3rct^;LEhZS~o*; z=%8%0Q+P4#;ujIrd3xPCB_mYDPHHhCPKw;fc9twH%tE7g6-X2UB6p(o2U!{z=gJlA z$x4TDn6EYRRT?x~oA@fm3?LxL-DMQRnN56mA}0jGeXS-fo~GJo58vMk{7%cK0jW&{;Atv@i;d**CCe zdGb{tig=W8^P>uQ51tO;j9)e=f39`jl4(_{0uyiVtd4#*2InucW7Q_K=dQyy*PusQ z{~dNJp>3VpOvG>p=OT~9B;CqofkZL6gb8TZ_i!T8he5`N|9YX(Y!?;!8HKDtQc&{O z$It@OX!>iTvIx+>iJOA(u*q`hgsE4m_7m8K)Y_&Wu#bdU3vJNP3}S;Rf;o^0#+Ijg z|2gN$3=5^Of6C(8-R}!E3JM7=zFH+EYJYRPHIX*JGlV+5XvGxo4}^Ai<3QB5O}ay- zfxHi$Q&FLXc&>k>yEFPS%B!RPd1Ch;jYoP{o7z`$`(xiN7^U`*n*Pa1j%TtHR2b5h zH1)=HI2)ld;P&h?0e#hIG6OO7q-3lPA7WZ>c)$1b7jPQHO;Si2l0x?QH41=qmG{KM z#d!0l_*n6Oz-c1xDPq7~P}YNs8sXCe*{hfeK%sL-m71_a_m zKs)G88yR^jmZ(wjyzb|5Yu=jGDD78YlhY)5&~xBVC&*CazeGs~!e2;n5Nm%=govhM zO8W90WlJ1?*zRdi7k~r7sd}R`HW;n>U*w9^;Q;7h(eInmcp4gim#8YhAm&fYv)9@c z4>he}3kl9|J*uWxH-r~vGM23Uf?OPDWH&rNt4lXKI{)LW$G{1c3FMfbbG9A}{`4SX9Zm7UBoZTE!e*_FR_S|{yLSnR%H0`eki8r-^0)8HIN-*{GqM9!sl~lia zo8Mm3>C2%bV{8_IzkJCT74P_I*Xinv>610W#)s6{&#Y@`Ni8m7EB1dh8ernhG(Fcc z0<#HBO)u4N1W4ip7I%Iyeeb*1#S4S=rNV~x@#SMuN|3gWDBkDI8x)n05C2bg1L-dk z9QTgJ8aZvXzS@3*j?36c+e^HlW(qkAi4OZad}P?#H3{d+%5r-cPYK8*(mLyKGh*D| zPvhy-QkzKt=ApE5m1`Z0IOtRqxU>+3ku|}AZLUp5#RKizf8sbedi@`)Bsj2r)c(*- ztZQl1XSr*v9qmAQ5Y$YcqX@Bj(9y>T%eCg&9OX=7@VsYcHn#;dM}ur^p!OhEU?x#&E^^{IPw>ifb{J%Es5V_=*4kl=X`{$d#^&awUTI6czhI zk9;tAXc#5U#R!L@-1rSgDB(QuJ@Z;X8>l`1_6KbhQRgxAs#Eg-){HkfTvOvdFMe(`B~Hg1m_LUi`_vESpvTdt)_rh{+1b4^GQz(pu3kQr5L z2rp+&nhV$FJnqAClSB>vhxVd6I{eQOOI-vg24PlW^M{fT9K$Wzb6hz-ys0tzOm)ic zO)NYNa%+V;Qj6#9WzdLmHJZq?V0o=yFc@Qx-N{@A7$M;O3u@ z3dke?0DsPj>%P7hkHJR-ck88nZxLj4ImQRaiwiD?CdcrGk%a=dz=;FpJlV;ya;E7a z3)!2x<<$fi1u|&_wZaxX)1H=>1M*fv&X+@pP=l1B_@}? zEK#!w(x!t=c8eiT|Jc#*`yO%Fc(HCK&XJ!Hf8{CZK!{5`fU^y8$7DU~M#KdsS%Vb> zdFQN0)Tw{`?{VN_LSO;#><(Cf-|EAJ+*!a0YgKL3taZu0eTs5BqX`&bumAbd<>Dr! z=`Lz!G|05%Ha+%d5?o-BQ9yp1O=Fjxg6}<}NRm<3!HE>Ljl*|${q*HJkvz7mnVHcY z>Jpd3*r+cdF5-brG`g*l?d}S`8(&56OwnK%b4Ky!gtSZwoQ^dk*%zS=na^$GK!A^8 zx8s8eW2eU4!dq{ibKS40RPo5M<^FHEl@4x|0aZNizbuA8u*lo6S5CVNW9p?Heuwu= z?GUuFa>BuW-vfdn12&@Gv0TF9Q@&JpJEh}m^Hx$c0D!#}_LqC@L64W%2lY7S!1i5a zzo{?AtwA+2oyS~-i3 za1tHUQZ|LQ73~Qbb7PUenr0&O;CWtlE+YmrD>G}OBcqf4q(j3-*0(=x*CMNJ9>(LS z>}tmp69FHhr(oyb0|^lKkd%Cralpn9IdM+7a1(ITr!>zir&cE4|D=wr{g00* zS5aq8%(HY*uLlBENA&C+^i>jP9OTJCNpQinF~HFj6$b%x%wG^?sMzsvHSx$!i;l&r z#eP5ChAw>nctN!87?h6Df|Z0rtz|;bIcvbBW@6E&AAG8^ZR0nekx$AK z`~MeCm7qMvqrWWFRF~k9rt$AE*h2L7_&vBt(~JH#C$nWYQfJZi~xz zrVM5A1Tw-(sRKSz1bz);jsd8uMb;s35L4}vGRH8ZCL=f9X7x7;;TXYa!{aY+q0-{^ zP}KwYlRm8PYCzeIh+4YCkaKhK3@sQPT}>bVp|+bHuAdg1b9~FVD*YO0;Cvx21BNC4 z*HPi?`nFe=$|@oETfY*y_b=0a-w2zBu&|x`PNbqZ^w#(?rgIw|r8Yz&1}F7~;cMcE zkNLnq8JKj)ZN}V^;;XD}g!s73a5$$lI2mi-wMN*jCx|;66n?0ys!M+$g6ls~fiumE zj0{BLhjH2^ZIM|I%w*U*A~`VXZnKUn$HGCzPZ{v4>k-tfZ8C4ghbG#uyV^fZE=*GR zg(gfWuxefMP{9ln4n3YC;2K^j>|A197)qRwR4TM~W#sWH=TzQ#{K;NCLE)Edc!x{5 zHSy0xjVsYCTJ5buOXZ=8V-zIh;N<4~K@sYkX#i>RI$Ns*8XnKHTLcM)|CIE^TM8Uz zycuzrTZsrj=o3f$0 zBXT=rvgI}*;sXa8y-Gi=!25t`P06QpcE7e}ya%Y-12qN?#^;^i`1?waPW_`JP(;;a zqf-30-okjoeym%D^=xl}kH%Gh2I!3|6YB6oBBkIC8rL^$2mgs;xYen;9tq`O#T&09 ze?jHnCyR_Nz8Y&?ihZP#!g9fjAR~a(;q!SS!!|C1l?R9Z#kZRyd2;jvc4PTr=<1PB z`XW??9J>&K3)M{*lU~xMqFlGRYyl5YMZ)xnwVDmLTe79I%{6FL$(Nd3w|r8u$*QKG z{Fa+F9c!LhYOFpQ_N`8x`2fhO&wsbd2JXJv-+`-1Q!ob{*$(x>ea@AWr|1Iv0+&-V(>G^2tGFLadm1*(iRkUGT^ElE-ThaObXgrzgw7Emvtu*6+Kz>6E`*ZC#0^XJ_yFgEDav8U ziVJXUYABSjGZH^P{n0L%`ry7e^M`hqInxA9BB_ar4t6pMcfY}=y4ePY`iR(8-B5c~%aM^GK^Eky1iTpnZnda67 z?1?g}Yh8(UCxm181OKRnecxebi@nWJ4kIKIWXH%tZVR#sDheKm;*iE=T<2_AYy_d8 zDE+NDgQIfCoZsQSi=T(~(uAS5pGgPY(Wh{+TV9H$2Nnju7YN`?+NN`>vy6$8_JcHJ zDDz3w#PEDLM3dCjR{Bu|bA8=`@BH%1OT;+d-+JulF?*1aS)ufmg609|AxJ6(y$TH{ zrtampc2Vj;sF%nmgPty~MsQpYbz?edz-KHuS8ZDp)cc|~gU6syjVH$+pQSn?j5-RS ziW=uw;H;z;AEqIj`~OaAx#72s9=l12qR~t6Ii}dOD_gOVsc@awa+VL}sU*Vgi`?Nb z`V)iyh2_++m4cv|d2s7-@Lu;oBf@w2ypa}~p*>-FjE^jlZnwjHVncC-jAuyPuomvq`sgJ(nsW^+Ku+N)59mdJ8t@& zuYa1{e=JM`mCdqb-Thg)xS+_xll7w&7hr;Zn`4@b;e?O(e07rhb}h=3``$QzW$pb$ zH69#0Quv-Se}Fc&0y=}8?ZmjP8J3m%w~$u?*!Ti~lQ_JjWIUZpT0%avin6vtPWj8# zP@*EV30$44YHDnF_}ljp9xzt)b8^(;Y5tc0hc&)}veOe4xyW~-les|6^c+B9`|mKM zv&slxBCT&^9mmmMXkhE^kZ3h~)~}mrwmMs{X4P^!_(j<7-s`}ny=gQHxrf)0Eo*Bx zAdOZH`$lsK31l0%a2cF18eX0l_8_Y^xhxs^9;?z1!9?iw_6={dEZKEwM7jSTTV`_%;)M0he9v(m7AtJ3B*rEk2&>1bnxh<@~Al&4#j@ zkyk9cd3#QMmwC#~4fSpFrygv%-OlGHtDdI9pH%icy>F&1ccnbUXYo1*Opeahm`C5oUF3`S9yaIk|FYnq5_Lal9h&@Q7;@s8(p!-4nqsTDG(=)bc~y;DEK-34 zDC*X|YrawtL`5tHna;&v_GZL#hjJa#?R^nVaRb@7gH9gT5`GzOs-;;MB#BmtL^{JS<;!_qa2nnt&}ho zJNOOVd{u5{LI`m#HfKQNt3Un~uwMJ0W86{LmeT3WGO82UiD?iGX8v=~fIO~gAb-e5 z$`~W!J??NPM0oLJ6S_Wi@zS@J9HjIS?q=p-Yxp@rI$z;jU#F9W*&LC?V6X~Gi zXF=(hkv9^7*@Z`&AAWnPf_4%)JER zBo4vMats|;U-j5P+MKUA|85Xpt^8}t@J@&Y`v^aEwo&O#HW`hO-fLid|CX-$H79qKX8Cm~#m%L5?%KIkTWmvpn2JU}h0erb|Xho1>3&%%Koa!#ng0mD* zzfF_+YhTgF)XQvC_%CL`-B$5XpYEEh>FG~Af8{#;Je;dsU&}t6M_K937z?9LPQ)A| zt-cuJfC;IVdlh&akZVm7B*9Z38TKp%xi0k8lm{&bbs*YNSbo(QAi7>fRTqjtlBrY4 zlapFez51wA#Z#=!ByL` zmaF0dYW$5D49-ju=!%96Q(r*1$1^-yuz_kQ0UivvlIsmjf^}wo4*|t2UyHIo^#I@G zW0wjEf_#0baOuU7deEdp17We)L$Wd5>{r(WJVaBsYEGqmcSlBWRi26I#J<2IKDc3! z9Sv`t4xj-zG~tHw8uw1s>~{(?Ge(*Rvy9W-I4+R&XDsG<=39>)H6XBzDJ?<5VWAC@ zR!biR7E2U;9b(sx_$bi{bU7;hy%k4`J9b&UwXo96rL){)jk4mI)dxj7!qn`@5+vsx zLGh7Ab8)7T_{A82mx-feCapZ+k!$}<$kU}4H9qyZ$=|(6v#rHX*7Y-aPiTsZ#?e?H zf2gEJuD^;Fu%w!FOtyl4Q1Ul@DFC2`FvI=so#hV2TmopRVqgR_ke6@c=<|Ld8qi_O zVY;!yiO*UQObrQLL_4%uZr*SHlKIkc8FcqYEd0;Q*EA_q2?}WTEbZhu}1riQR$GoSsU9Lc4wT%2fiwABMcYq?P50yZ&um-nk1)ZD1y1AD3l#*x&*e-FS>Zcek*Xu&t%T1S8U$?S`qZdW z){xTJv&*dgs*~z^!3Y)qjX4N>Sti?pkw#OML`wdY$5^G&LwJMtFy*^8{|%cw=HqQ< zxh4CCj&J)+5RwLl#-R?^HmK)0xg;F!)?|IEMts9x!4Rr2rEFp7G@K#!j@Qm{pk~1XnJ_<7Ii2PSnfkZ5IEw=d9B>9b-tPY zVDNroE*^;H&F}4VgZS_7`=8^rMI&UGQY4SdK=7w1@IBvN&iG8xYt6@vPJVw<+Dv(P z6iQBL4%}4WHM|Tu-Km0e-;K=eSkN<*7!;9OK%QVb2Lpk>-Ec(W2%LVhOVi!;c~rxnuO&}E@YDsYf@iZnQM&AxT=!%T&$&e z?i3&{sKjR2QeW5Q|5!Q#$F{0PN&$%6wDFzuJLum{Yw+A+Dr`WcQ|aNy`Qo4AeSQ84 zDuG(%F*k74T#yH7gB?YMLY_*p`|kAI8|jjN)IqaeIx2GiZ2V)x5Rjl+ajb!BEM_LR z+4WvtfumDUacD2Bc+Kdy48-t5?goDs0xpa*HhpON`V3^sFgBbdZEfY4yywrd76EmAft+?8yl)^{RbOu6v>Tc z$84MNO##$(QA=I6_jS^H#HpraJ?P$Q1s!cU3jDRfqCYK%%qfwNmJ`w(iC;;oWyoxz zwdp|#WRR;#L(;@x9Xtup;h^|gcCt^*2yPs==Kk1XqBL=OdSuji5lhV$ewZ--gSyZ4 zu&;%h)!R!Al%CuBz+-jO2G7BD$fMAW3-=A{r@%+b+um){uGZ>R#)FOuVvn9^Hi`Tb z9K;Rcu&|p!xE)J1i^c{DbYn{zAs1de?ptBhAuil>K^NH@Jwim>4}+9ClSxS+@WFs8 zOID40d@Q|-yg@AF3GZC4=OS zS%sT|PcwqBsBm`U#9CaQ+?@B{A9%Gl8PrE1UNg^6Rd7B@^z@m^EpHD+`qR!3{A;EmOGkD>0 zsktp>(cvc~^Y(kl-NJ`WBe=>F;*CGc7JfK8sLow6&}F-g;~|D%Q?ayD0m+}yM3o-)a5_l*8}pv*D+CNcvgO7I3< zGrE6>)HeYFD8;3*pl=dbDlkIRJBP191YnPv{+pXnG^fxM7t7+e>bD0%Ye=%GnCR0% zO|QH-U9fyXPs)(@ki$h@JNy39_8n4bGb*VBFBCT+jlho=So?D4ys97vS)?4Sgd?<6 z-pM6-*2 z790tB)+TZ-RpZ0UMN9rzg!Vy_(ZQL5>XKAxW_3orpMxe-{@alR4FHG@5dRfr#+b~} z|0j}m#f(!RfcNC`r27aVfxA0F?V*OB3nVI)cyPGqub?)Lf^oxi$4OgoV{%hdw_9ul zPqM%$tmBy(``U=Yp`a-3#l?}NnOohdX*)mTIa&c$o3Xu~=5^d43PH`6aq+_XrSfwO z-N}w^=spg*9Orj$mN3-oB$`+ACCtO3N0-+tb8V>@a!;49gpxb;lw%wbRY8Z z;UtO9fj(b*GDy2uaDV)`Yh}lO%`)Y9BYjBlb}9mKr*pQUHN0?*Mm@}H zfs7773~ov%uUkm$S`B9o7F%Ea=H&blwcQ=`VNMjduf}ylJI48CNvcKPP79fPq!&l*xOS8KO_xgraotcWsVV4&HN~&x$W+t&^>{r*n!QT{tRy+(}!W zN|`6ZZT~gelB8Ul34YmAhNqb2*6-$Jo>*1Y?dBEc@pqrH@wPg=n~s{O*m2kYDaFn4EH%E&BY0G&fusAqk5tN&2b@F}?d`T9p+|v5Hy{PD_iO8*2uDmYb|M{k&hIx0D0P?Yza%0F9_E( z0gap~g@mwySa&<|?#o!W;bERAUl0ZV9R1NXlk1a~#+B!c1OifypIla~Om|YrTXy1P zHx%h1BwUY8O>!~)HD&SrlFpu>R`@8!viEJxWIwc=)3!YO1<_O!&}Z-Z2J?zK()0Dv z_{x)Z)$m|1fE1C0ms5vNE=3Z_ge~)y z^w#%+jteyNY}h?*+%{&=^+I|#$3JzA`6h%o4NFdU+n4EdI{8#bP`s+n)3C%>aIf05Je7s%td*_4(i{vkJ{JhSlcpbySgGhd~r zHLT&u=m>=e@mRTv9jG+(`}p(#Wks=Dy}}MxdlXN!LrU9HPPC{fj#*qUAh#oinCHLG z1k7vUCQh4l1CLxp_*+c%X5Xy|Mh04^85m?6bgi#=t&L*(iqoKLIx5pX3;BRwR89>a zpIUGws3;_3W5C$}YK7 zkl{f?e|Yu}0Lp^3AbZ4ggt=k}FtWIj(s!?JlaKte#!ecLs61!i3f`q0OQEVH9Oly3GHGSSOUws8$70l!VMo2<@e=d zR3mjUz?*kc(87>keKj?9M%eZ_gc(|x)X>s2ds;eACxjj@zs`fAj#GE;Za`*-WFhJA zyG=yaueqHNv99Yd%xGo!Isi6hq>rJn=k`T!{`-BK9U{Q5Il_wY9CDkDugrGGdjH_J zQ`%4?n2yfr5RKGvXjg&g?s4-}`Et{daVFe4L42NqntCNr7_ zcLPlj7u%8w7Z8|)g`FeB^~(4D&`0k7fD-WUez_bG9^D{=X${^i_(Yl4kk2Ed;PyFov@70w8?HOW{T=1H1ITq z#$;7xHG5L>!ExG41ssHc`E^*+>G3^RiKYmvt{T&a#f2|ioeW=YZErXX9D|=;ehY?~ zPokmNYa}^^B@;0ShR6V^LKd@-Gr6cO>(ULCTUD#SiP{oYd-E5u!VzWP1*3yZ=u;>X z27M^eK<9T_@>m~^=~sjLMtca&Oapt{1ny%gjMsFyve2tsvR&6Xlbl*~94aIl(n^D$ zvl{E|3vs4?Px4rm1?R>km0ft#goSO59l1}Gk38unVoV}-hM<4<5C!vWx8d+QK)V*{ zEr_2mSccGC^<|a|5U6z~BX(U1>TEAk@jEza0G93{)2g|i#&?Rj9d>%0trKL5y5bBp zU#$C_PIfx*yAJ_BJ+*g>-oHAf$zq>r#T&X^Zqsdcn7&`YbM<_@L5}>`(0Kj0E)bcX z_UT0_Nxh@GzJyuyA??wpJ3kj<@-dy5g`75!f=U`*91EL5l4g5(V#8Ff?UL2k`aVqE z7ttg-(n|xoz*~U|P9EkvytE>vE=k-}UYMuTaqrf$K^*=$^aUOQDcyp2WTY(#V#B84 zZ{vBy8TgvKoL_o$zrJohuclrGT#n@WxZfk{Q{HJw_3u0nt}gHZ6itq3S}ce5Crwj| zA+#a>GBDDd^2!}tf-m6$>h=cs0WuIt>HW^%F>2fBt; zGP<@)uUm|9EYALqj&>bNayrguRl7;=frs7j10aU&Lw}p4VwJdj0npf`!eTORx1a01 zZhMgvP3i71FrHPo{p!_2B=i1Uz(KMnx7j`5Mox2B#11;d(V$^czpbG3?m;)aEtC-ZHkYs0$SV4<-;gr(wz8m`-~qn)N&y$i zd4vXI3WME`Z8o539BmT&FYdav0gKHpDXDZ_mXb_}ZjICUOV5w!f;0cH-lyt)^svFj zth&XSZAYH?z~`F2eI3RG(=Xp0@s@rtDPVPKYtB1bl(f#;2LCu0WLuhyY?SZmr=pI5 zHATXd3gRGy`CXEbrP>v2vl-$nuC|z35VBARkAORX4UQyAsu3M z=Gjh6BNF}2M0K|VzG@vrM^LC*>}AFlR-c~`hLSXI`jM0SU%ayWl2TDhhn9n}3kc-I zZn8ir&3EsQx0>A#RWnih2LZm2fEg9$u^%7ZUA@3l8?RZZ{@@+kEg|<7Fm;Wt@00$k zJ@YngwsLpYPu715zRX5en(LEaan8y>9;uf zKac14xlTL>fj)FxLK!ahL?YKe4@c(qVl3J8M@%ByDUx5jRp{oftqN1lHzFV&B|{jo z4y&o*9cXmk6}hJG6wpR7PUFa1>+&tZ!S~{|<(jZxGLjIN)U}`OWpAVVnZ%OZ$9Z-h zej+JkWUAXklMg47UT*afdN+GvK20FdO85I7Nq#^8uP=9WSR@s^mUg7*3s?I)$RQ`- zBGx6?;&`T{1n4gOx(EdO`M(cB5$Uf>8r_{f*CPWJ&4wUyeAxI;7ai{+?NnG9l%-{? zQ`Z5#EGA|(`dP9YJg)(-&Ol&E6|<-`)+^;a)EwsL(JMe@O_K1S@#WHuzaBj_H)1U_pz!E$hi_Ti zBM!>iCEn2(^PD15%zrl)5g~*+yq{ZhTza}-E#F87FWh%2JiVgDly?wLa8(L@7j+0k zSRlCd92n)v?+sa95UHpDk|)lOZkxyp79k1^p}wE{*vhW{wmTrm;3A^Mx`72tR+;FiZL557qW3vRwoQuPMS*{ZCvN|j=g`G zU*kydo>(Zls3$zj&+{WRFP7=^l%WDke<<+Zg{KGHJ~0FVoMpp1`hWZXm| zRU#S<6d<$cT-(|RSb47{BSGJ-UUtgvVW`dz|8vd*9kvP^D#T)nPHS@4yl z%jyYw=Ti=sMB?{vx#hal6Y;8KD`*j(GACJX-vc7BK`xuEi=)Ee=H@VaA8}}sE4tSfVM)&*(lYlR^_4VqR@DBY$_q(It4`Oi5P2tDk z6Z!_ZJlgNY5@UMnvnPnJn;L8GO(SZ%LS-?Bfub|jT1$rwC>dj;mSlgweX|LDhal#Yxwh% zm{J0+y}IEmLUwz`BGcx6pmvudm>}MK`WuwPpp9oqZ_1{6PD=H0KvYuYOv}Zl=lju( zgMiwHvhhZSRnI0;s?k=IK@8}S>O|W%e4)Y%S1p;;*UjNMX0PVmyXip-UVkP5>W1|_ ztOHEd0&+y`|IY8n+Roc^FB;#*uS^khi;Z7+6ffh!h(KauY|6geLVyrhum}h@X`^hf z=MZ&aC6RdFhdhIQ`E{20fZh{JMKl6;I*NRQhVP9(&!dpqV5#Jzb?bcHLnr{Z*&_RX z^fe~l^yBaQ$6S%#@w6)Wy=SX~`*%;S@UJQFweL5WLopBs@zm^Et6I(V2ZK6a-{(hQ z{n!?q>)X$EtXl4#lAv+2tQqNgtVQvjqm;GzqmM}+)ib=bvK{Oa|f+f$b$hh;M;h$eXL6Ult! zKiBLv(or3WvxQ?szKqHFV-GhYz?;>sCu}~hg7~`ZS8f(UpX|Ejk=0dwv5malOnr6y zuseKF{jjGm_0mT%pMBAKGyZI)BY`>K#Rx2mQX82noW&X7)Z6mR$rFA{cxp!wgdu*> zTKfDeS3sIOeTCWC|63nd*~5wO_^+kk)n3lUedHJ#R%&1S-qz`}PYNb0*^nPX({GI< zB@u}v^w5N$y>S_%sVP2iNfoD32ij>bYFoH1c*^M_9=38Vb`WkJuMH1-X8N((J)}(d z?h0y>u^hQoU7~a8D>QV$2v9fiSOFLvGAR{**c~=65H~ODg;=m}pq#8tq)|8E;f;Lz z7v#lpaj1DGE8Bem0OXLm)}?wWw{k%>XOug9rI|@{M8Q~SY|;D(g~F2XiH5~UuoC^+ z+=Oytr`OdLGZ#$Pc}ydl3fG$oGkIgz7h^N=wlhXjG~d}jWx|?tvHrVTAGkht;s5eX zx3$&{roO&Wb18Qg%8V3*e$wLS_qwQH@1QS&rvkCS?c3+NZgMz?t7>x%kaJ=en-Jb> zs-MOxPZ<)4c?f3rzouNCZ`~$&nv?Jm10q|iGyftd7kWikoZkfT*Bfyq27c%ofq;h~lt(`XmN! z=I@{=LZZSRGMSp(U!?BzHx%}iRU3+IuX)8H+tI*cySjlUT9V+^gq{NOHj$}{j%P^*NF;#`}Wt@48ofQ4brfXxx+Vv@F#gV zFBPtCq*xyvi_N*=-0qeHP(bSCL*Rs!P68VY5F=hx<7IgMG1 zYw{EJ#??FsX!Q5?Ji&g0H zWSEnj-rdcO3blYi`>Oh#`QOwE6+VGLrg(oimTkt3pYgGOt2VIEH!GX;g7mg*-W*yE zHSv#Vv#)mj9C944XPw+HY)=i}QqOj`T-`4|qGG$=c(~uZxWlLl3*i3d{2PuGcoHoo zvX_X?Hwc_ms?o#EO&x%|A6|@rWl((%b#hP5jy=5}9H2Ioz!gx0V1-aW1^xz-Sut{; zJde(do-k5UT-d;rh18oT5haN-^b9CsNwU7facjt%?fLldOYxWNYV%XexjDnH`4CC> zC+uNgrlxS+d3}5za(N6fdJSdiSN%0_gTY!?VG;1vb9%rBwvnVXam`41G`h$2*5hiG zPMi1Ry%G^DsH!mGE`0J$Z}P~T*jwg6$`U>#NqjiG_}b-gu0oSi+o0t=-G}X2Zf5(5 zeU_aJc-Y1Ja#LfL{-$A&HyuZTb6R}%XD$VkRP=pmsAgtLZm!Iy)#tFgqrs;&`}4{Z zWK!hm0a(iPG_02qy%liOvmu0^_KZzocA9eiXYP2xwy3?$aqE3q_{Th4vyBO%pSr27vA~+u3lXg`p|TnLZgB1ar5wce!h{6oF3+Y_pDUd-c{z8C z81b0VYA(*)_$bz&dipJNFMF1{S#~58H9vlC9N}QHYxsfI-9k*1SUw$eJG6Gm`sF9< zs}GsI>r20JoISqXAdeMkYUS9{p04p+LuYmi+t@8y4>s zG?|=0RfkL%q^FL*R?b|w@G*xa&I)PWqoI4p`)30)bHMt>d$YrHCWn{Yi>gbk4N&VM zbf*7NE+#^7XbU!FX3#^7njOapkqXO*m)M%fvN#Fc?MOv(zVg$KWyK3Jn(YttSW^)W zAXd_u$Ln11JdD|us!_q{kiGMO0mQSxO|mOd7c?_%f}M8-X8norG5(FD#{LrPpC#a-}O-<;J$U1q2&(R;2q$Z9UI6V2f;S$~1H? z?6_;{lH`+q_f_<5`@7B5Rga^mBmH|L=8T*%_=3Loi=coD6a>()^6XuIyMIISehGaN zzFj=4$O5zb1QLk*4)eud(JF6c07OOz{K|Be`|`Rf?wfVya;stiC)i==fm^Jplzeb!C%3Y!}?5_9`5be#0I2t*1rd z20t6HF*#fQzMgGsG6V|++ihebP*q>apCPQn9P62G8p4JCqtneDhgHm>rn65J_2#{8ke_YcDopLkGU*C_tr3AcRWV=6>%ITZ-W9wT!>=vn z5=M*-mT}-YxeN<~o0;9QdV**Eghkb+R?;=eD*}NQ1yNp+SIu0qm>FlW6S|rF%~ePY zv6xrL#`P8O-3a9nNWf|mUDVwk07gUvi{?Xn?v;q8?#G$qmF^Sh&?x=6i2R)oqWlgq z&lPgn2gft#>iFIPKM6f`=dJS#3*Y|(D*NuH0k>}MRy6Zd$+eUR48{DdrdIBc!^Sc! zikd6l;mEz;_*VaOAGfKKqeb_5v`0%p-0B{@ziv5i^4vc={C&HC{!hYnNFB?X6}N|l zkBoNEqL%syCiktxKaysDDL#!YZ(ygfMO2h}z=Q}*s=FUa#jzoqnjDIGdG$F@2&qF4 z*Iafoceku~6xjcME)B^hJO1s|t8wbMS`+BFc6cGHaI$JJ(OBdDU(-3XVW8FTJ(3Z^ z^^?=dU-{Z2=r0Dc&9)j!lUu>AwcM7wJPA^97R2Xyr@TUaK9 z=u{j>GPy`5Pi-l~b2b0~HWn6k1KPL#WA4tjys9ddCE20|Y6HP}foG%l5;20BoN0r9 zxASJjab5RNJ8Oqvtr$p>7DXH_Rb;d*+=^KSf4}z& z0_oyL-jE$ve!m+r2j5#<=x?K~GK8H?u2C_=FGclRJfG0t+XH^?_j?4~*Kq;3bpCbmYp%d= zNoXq1VXKi9b)v1O!49IH-wCoe;F2|B`cHfj(=v_U%A9Tk13P>#gJ;bhix7LRGuMXf z!pzA|C5>k3FD*n4wjn`oB0*454-}&m7rxo>chslU#EQ96X!9)c-vGby*RDAz;9kYG z0?JeHI+*cG4eYEdnJp!A>+1Bjjg&Cd*BbA_>v;Yy0PV2Y)M`n_Ezh0o0^;VV+ZF>y zsVS#tFb zG-CR6gkhM-;*~9~$ldi$KiQ3*M&YSyL2o2p)(^@BGjm?FJq}-(+F%xLQHn`V!l*+u zK|qRd0AVNCBPv;>MpSw~7%`D4J1*rOdPuo{pPC;AFPT?Q8E|O<%W=1xyW<8kLfvOq z*Z#FxiWFeWF1Pd4((D6#EPq9eR#IPy43X*#7-^J>A8RWi+a71vGkU|cj-HQS9(&D@ zt9*<{cGe)}?B9MpKY7k%`)rnfi`x$WSPLe4pAFv6e$9CRvu+Hfn(^`hg3#UgTV@eRm)o_UCKvWqXQ9(CjIq88=K0sNX=?{~$F<*q zBDmt5H#>^!uXqjieo&80(~`Rp|9)Xp zSk4$g)o`!E)gHEA$)&ZT4iTthtG!c+~rD0i=K zYd1~wi^k1WepSr;qBiTI`78@oOQZL*rd85!q|?1Nq>YOHsp4+V{-gIy`Ev#(42P#e zMknCQ>06Ggq8ZX$bQ^g4RY)dI;=#DJ{kY>-9f{1&&(a-)Y8F2gPR|zn>^jagwnOOZ z%59}CqlQo%cm}UA(vX-540*tS2MJoJu&5g{T_2Xq*psl3S1vJdf}&ao+{#d3yJ23< zZal#3wdeGU=wn?_IPe8?NOBA5F{{<~aDCi`f&Zlsp6GdTy)*(A7li9q`dealq0^)O z;@1N3p0;C7Lj2BMi6nk1HP9rfWUQ?#^&D@p~vCE^K>f|qR=5dYtV6W{HoN$j=H{U$g&0i8LehA z(m}ANfRp9f85(5gATP3dl9R)=q-j}u@fiDrSn{nd>v{a9|M2}Vw%g*mn&3NqDV}zv=~5dj zdtp_&`gM{mWNcN@)Slp?p=A^QBXjan}va1R8RNDDDH{AH!&7x!Rz2XUf1_$ zTeVEj%P3UC=^Oag80rbfwg1fm#lG@jx^Y?C>g)2d#IJ0#-H#V2uX|=LS4b8Jke?Lx zHz=JC3T`{EALZSBl_(bhdq0X{?lUzF|LeVFE){Oyg6A? z1{EAPQzcmMQz87m7z9=%87cDV_;bYDiL?-Q53HU%j)oyR{Q;Zey(m-YBcv1`;I35-b%d z$gpB_3wG_UISR`QkBuEhfogl(IoxYnfbUoTqhCB;Ax~WK^1oH{nVWy)O0Lg~WUVtD zfg+efJQj+W_3p#ZKh-d%ao(K`{ihUAHVDMeD_Z&KD73uhLi?6k4qMEbcd?snbvZko zWDhOsqJol@J<(zkZKWF=?hE5I2V@+XLQ}PR`)0pLPjj}@Rx!$W?<%wH$=_)rDGE}1 zdg4U=PWyQ5C&yW@Y`y-bMOTK}bRx!x9RT{N<4n3&*RsJ48XC1(NJYDlDJRRrgP$U# zspD;Zov0zDc#~7#lZF@b_*bjHzI$dM;-Ensg6+4@+8yx{KZH;V9I3`lFR{!-xN`>r_2zOq&`R|<6=Pbqf^>%x14n~8p-ah5IanM5g>vPKJAQJg zSd2A&PnKi8PVp$0&b_^uE))yL2_)Y5kP>Ag-nVs%p#08kLU`B$VghkqB~2XcKx+gh zO-?i5nCt)CH;pzy(5^p;yOxWHqK9+gkSJ(BGdxK>MJV22ucSP-6XxL}x~mx!v^qn4E8K7i<-L(1GSFni6&MfdNii*qoW1A*!=@a1_%-$7AJ+2=wqMN z_-G>|Kq${-X8Ww_XfpZ$bjn6_HnrYrZ5dm0(xa^+{^vtnGuf!8?}h1Xw{q^J^KS2v zuR4XOSZ&@F3rBP^I>o)K76+n;2l8q7np{AE;L*!+r;M}^0av*2?dL^lXQbdt4pYpi z;9T)^|9YqX&Z;uPNOWszw{-mVCxnsw{^F-3Hp3BClxdRFG57p?%c7V&VJM5E0No7> z!IZW=5}2elH%j9&s}3HhU0@vj9ZWWa5^uC^{`KoS%HbZ7+qF#Cquo)WUK*}BFv{JMvSbNk9UwhyQq4h-3I&nOn@KjKdNwi!Esm-k%DM8 zAuuq@eS7Cat75{U+j>|lStEk{JrWO`mZGBOObieNB#b-Yv~Q%oV0GZAAy%$yG_08g zDMPn#7mjs?R`Mn@;RRJ3>I61V*F8o%hm!6)j)s{+jjMeu5w^dRSX4NKJ2Zd3O6c!! z#fKV&9K#;3sv^WXn>Juh#VpFhAy$o_%yMil^IV$Ib~5O00+{F?wJt}oHRuIQR!U=H zLang|4N&$*V<8fpO)DkeSETW};?`T3Cf$yh))Y@mK&r8@Z&0QA|3Dpm3J!j zG{fQLYya+Jh!yH;p)ZBv3swgM_ zb{j)7(cKd^Xd4G&6}#w~vz~hM_Bm!J)W@%IK4 z7fOD=WdY^D5)Y__>Y)}qf-r+a1Lqoca6P0dMlH)#7S^w4EogVq?RS4A5hf29p;7S; zJ8JX)9#X(u|6ldUyL5lp${!?-*d1O7nY?s)Fd;Qn3f#R32&$H|9S(+my~ej&ilsHYf-!V;(p?3%t#(7n>!lI{ zjyeI-JR(0mlT{DDf8N0Gn&ezj`#O~6s`MH>4%$9j`Wdf<%{ zNVevifi*J!6Ie$8AELr@eFuQ$*FZ|4+gpd8Vrl>+^b>{$&L<^z=7f96IT((LrIt9U zT~n5a6`DahX4J!}K`}k&_6NOcWy$@|wOf+nwL_vCK!8D*=FN2cA62Hj%X#UB|8t!w zwNZL}{j=wEUW?{xiAhFPkI3pmV`>}8`k`lyjTpJ9DiUgkLK%4awh%C4W4g3& zFo)VQGIh65q`jB5v0$rKAl*HF;alf(EB?m8(gu>;0 z%@QlTX;O2|l`p_P2{yu@BB&G9^cl3~NKj*DpJq(d)}G7AG2DM=G!Iil=4Y`CBQ;JvvsK&TUmjS+I7b+QRKFzqWe;>q zf%w@Zoj9ep9R_Fkxnp9U(c?v11@#q9*#F$MdvXNIzgPQHl* z+^Cltb5kgYu+Gl>BoxSnan@&mBDhzaa0@3mEH;yBn+u@sXy%O&`s+un*Y5CQ02_V zr4vn-_g=}=mNLGdW*FMiTBEHM@N=rYAcU1RT7bA@ld#Hi#l6i%qDmZ$5)(%Y9b425 z8!oC3hM3-aG3W+E^_DORJfgk^f}j(svH-_=7>#0h{$X7sx$=Y{J1Agz2H1*r25In-3C64eqndd+&0789lqCh#pe4SQQ( z(F9<_gVUo7brBeFD6_W^ppaj^MhJ2W)0=4m{0u~xpM>maUhtuF8WKgJZn%~kR$6g! zM(F?Z9If+3{jV!a&cjiwboV&OqJEVc*-=s&K^`*XT8@BtCw z$5>tn^go+k&B45l;e__5S0vZ8s$mpW1Ex1QhMVa(?%-@?-DxAV>NQUYgo`zoTDtsi zensj~SfcZ&{HyN34#Q}qRv0EE#N>yRI?V{4X&n<&vpg#gHk}+9bye+X>s_dCl?V`o zX8D<{P&b1mhA|$NVzQ2plR|i?B2zf&eZ+%)2d;mLKm1!%w($+|J`Arz*@ybXWoPN?0vjN=$|(^r`7Pb(6C$}c)kp$aIp9(QQaL$ zC7F@&<<;bA6scj}7WtD7JDD*XFb$8LTdfI5;Y(N?vXxL9sCZbie!wwY?6a9RXSv!v zRiK!J%D3cR$*X2P_cq?lA8o~FF-rG$T=H!St?`x0u+%ZivKj9v`gKVV3hF4#62d}T zIWpAFsySH<`Pm!_Mva`cG>iW9J-YP&+XRQBJ+&n=b)s*OWld{J7~-oAs}L z_wX}|MEq?cT8?m&#<5{ZC#5suW}EUmR~ac~fp$`Y{aX{@+rPQ+YVP$%ahV%{yw8ml z1iwJV_-fkF340PmWl9qu00Vp_Bfm$wdYE^ehf6tBjRv?ghg}gup4t~dVXeUYc>F{V z0!BL!>RhK*&yi+$*b-NQMXk&vPY1!9wlXrcz9v36ztLMo;^9&8cSxnv?}HWoE=9kL zr!R<@olx>V0^9Tr0c&{EmN=MCGa{?$cOcp?VnD#fk!!)+w*5vNkQ}(wwv6D$UDs_= zZa6V%eVDBvkCiU~`_T>#V$bptAv!$D^^3;hPgnt%4hd7<;Hqir3(mvq?NikFiof=e z(OO)ha7XD1giH}&DnW=A`I{SS4J2vPJUWLG2oq>HF3ZMv(jOvKNlw@r^eS{}WU!Mp zADo8;b~4AW^@ukb06l<4r~^0M@Z9p;9!+Acj`qyz9}5wnhN5azD@tv(rV54my-S&S z#&ezBF-YoX(_A-3ZtqgM?4)w83{kv$1*xfr-b`2`-%VNr{y0Of1nR^X_$SmV!x=zXb)2MB(#3(DS7U(Z}4v2!9S|{m0~$ zanc*@w49CAEQGm_z-0^iP}L4`j|ihN7!9LD{W~>opG4C$Cfestx#9P}<;n$}>1m^t z3M*Tc?5E~@hf6PIKbzdl@qhxhK6f(}2IPR7aGN%gnv26$yv)kbT21xwB~$aXQv7>b^5LcbM=SNpgwF=oL8F8}Fdr2*npt z&6*#U8}a4o><|>TsuuYaD@q_HQILs9`8u-Fhc-IfzvC^-yL{uBEo+L|6?A}GF?#d+ zq!h3Qi#X%&3de4O7#KLPHHcAczeLN1Zg)~|pxeMjdGoS{{K;}`Y$e_h!x@m&LRVr3 zfy@at%MS?h94IuRfzzAniLOjKG9d`8tjE)k_7af4zOb*JbscUN{^x# z_PcPWRauVEldx&`t$VdQoQ5|rn5@Xl2xig5k=b}M{US@Ny})Yy;{y`$`)R(U1fsIZ zx#MQ_c*lqbc1J*VerxZzHv}QWayBSPT{X-8dJRV2B#D!O=3_M?kifo+4iUPq78X^L z2XM4QMH>m94y_5SNKrKoP+c=6i$;1z27KRXW_ni5qniA ztF0gW&F3hQhx4$js4d=tuC#Ujhb=opu}S#>(%fExB&Z2xSJ26shy9! z?tPW8%BJ)`PfFE4G>-GZ`ed5QfEU6pS9hOS@Dh0T1Oww` zc5?(M5cZZ{Y_?l2-M9;qjH}4=A(U}BhZIf<3m+Aefy;WRA-#g)gmlwV40OJXFF?= ziV||;;z36q7Vr)ILdek60HL0_*I+ZtLn5vY=sKPXS#Fc(u}ufEKh-Tud0Mh6!roKb zS}jW9W?znh{*=DyVJTHte!90W+4KUx4+3Oj1H=H;lS7^u)n2Z%*qjK4W3*7IMO|Ei9j zgC1<$2>gGgk9Mm;WCG$)*-I>7evwP0)Skrn}}o^c;#dnubrBuS83RY#SOK%h-_qLvLkr#P9PIiN}Q2OtRb zUG*GTXjSF?7;5mwN9q^%9U4Gi z&@nr@TCii%_?fAu*j;i~Z!L>`xksu!naKvOthRU6)986bFVCwzy^cp0#W=mZ!a`q* z4vQ6X7?FmB!&WoNCL&5!+s&K z+Zu@>r$F)}OpcNo#5a4cRjrUFTb84$Ch%7>;{TFny0ee<_Y-@D*snsgUKiv8y;&9Y zdKgZ}3ZfjqacwUz%mnu3d&-P7Ol7$u+j0k!P0`Eb#%boOxD zvEct^O2=qNoAr*f{BNBf)oGo~AyZz}QFtEgVQk-L;Pe3o3df^-M|4cH^V(@37nU&Pchh?WK>fO04=7eF4A(VCJ~PRGrCl zK#P8W^g|1VH<3`tDz{8ng+K6Qd2b^cNvzJXj%OtUlo5J4m5$vyJ-xbfq5On&k!ts! z$phFp(0UYqKxZAH9_w=Hgk_p-{>+{R_6LFH*qBO5N3$V zD<%F>vekDY9~r&ivbpO9q@~|xP@KTzU#Wdb9x1Wb_{9u_8ygI#EwyM~gQ3(sMd$E9 z+vt7~_kI6g4b%WbO=6f#G2LDD=mpqc@(nMrD{& z8oZJcN!;X&!*8z<4`j;gS3=LK_1An z#!pi@p~E4mWg>C1)iU*M5z^q)u~q#_l!igEBp`|GzI3wg*(5;_UE1kEgwchGYy-ZM z&CGRWJ$@*xB=DV{bFirke+6DZN#|TM5D?;QMx8o?k%xFNI$5-}_SN6Oa7oy!rV85@ z^RMnwL71t;_~{jQ;FghLW`ae1f(Sdf@rGbtYpFW>^gos({b&&i8A>|il=3Wh4<%x-}hY?vI+t#u|03=vbOK&Z;@UXIJqdDIEpip8 z*8kQ_d^R1H!7T=r83=plvX~Ars!v#vtWubZ9HhuzA(N@2@#G+a6hW?B3aE(i5ZK{K zU73u<61Qiqki#3QusLIPhlL%tn*HhX?P$~O-+Z7mwfW~$wdIvL?B*4`<^Mb>OJR7_ zBC3~SZB;QknK(|CX|W{uBb;evj_K?xUvz=mIS&Gr95dZ&p2b-Kz$Ux7RG89Yz(Xxv zQsR;YJ8P5Ov92LC&@&tIH#-<#H9=`yKtn-742yVXF78c0B!Xr=3C!vGK=O_-u>%2w zrSSFqVz=J$UDzV&pQmq1$fs(@M%?;fNe?!&p;yYL8ELap7qhM`B>v6pM|`U`v`7dB zQO&-uZ8RhcR?Flf!d z(LignJT1~A^q+vF(0wy5o0SDkS*;fB879rO+^J4r2+ismcKB&cXt90;Ym)6sRYq11 zxo5IRiUNgU-{y<6GW6e>z(NSN_S!8?VGB6V zB5tQ`8d5Vsk@+>=DSsN*P@3{oLZTjTNBi~* zw<-cqha;PWExTc*uU1py`VEZ*X{HHu7>GU2A9HdU?j?Mv7QkICJ~eY;kv{~MEXK51 zhuc{(;G(i61Qvz1g2w!V_cPBdyX~eblOPuT6S3KHMY2_om0B%T0DYRjwUThCd8sBR zDwZ?m{>%222S2bBMrM&>#X4VCc=C5QAkG}co|)VYLjL^1W}Ms%g8g<&Lh zxHZQX?z(1d_Za7uZsvS{2cDpfqk|wVd1r8(zMM_M2q5|YJ6HeFxq9Kuv7GXM zTF!`fPT$vNouBl8WvQjq(!@5IK|#s{;nZXM2CQS%mMe`ee^`u`Br8u7rT#O5>&WTV zS&bcqH|`M#`Ep|w*ip0I++XPJuU{2ZL1~<9A~G zXBgi9!zLdY-SMsz-vkN}krA(y_%{Klfz8};_5WhNQhxSIyVaDE%Ml9B*#x%uw4#g~ z)RJCyX!=dYBKx;viKqR%h_ozMrL$i5s^NUYF!2PesE77wyB)jsk>jpiOzn&q1^p2g=BH@tj_f{7D1J8X)o|+G| zjTNI2^;F~iT7N_=ZK4NEE>GATu9`xq2=Pz_(WZzhmgPTI2wWhXb;h(9xi6cNc;huMZ=ZR1G^=^{MSe^75 z$O%a9x@0PDR+BE^1dcM#Dyog9J1QKYtA3;1l`}ZZRx4{#+wq|QX=HU?_<0l;iF#Hu z6=Bwy275kMhjLak@|j=8W-53wlF9;455L6l_^1_So~^LsCw^N)`QL!FjR5FiJ@a zy8)UMYk71%YnRIkfqI#%!h)5(e4CwiR;c4_`8Gb7ajNFSkk;nZeUCoqh)4pf*~z*~ zgu|OQuttCU^z=nuPg)eZDxR>JWQ>8Se%5MUQS|SVQd)2PX0u=EtW{X#)xZ2TBIO18 zjyb8BY|ZGc(nhibu#A$_s$3kLq9Y0#$BZe*6XZxwk=)|oy)Ri&{O~S5T-KJd%;ivy z5(63vMaHd*lDH){A4@s$sl9d8K*wLGRhpfFz~>go9Ro|Shl@$jnL5DZi$@`?e|4@Gis z6P6Tg@aE%cIW1ZboTiiazMGz8UPeEE=E?v|%y9!#YMbL!Y5Hn&`I$P04=lF9icmrv zcCq;H6V5F(SA=JV=Ws3|dtkJWsBV9iQy{&~<55-}>V7Ptlm3RAEgaTo)3cnoU`s7f zh-&QVYd>+>A|T7L%wBZJvS*Pp@1{%dBd0M<{$<`p3{N7+(}ZY~qvhSL|F3chHH*YE z8bO6o;dt`XML9L)8EBp3n~bOH0vKC~WQ#)0CL4ZAMiOCnMBL5T=}tU5=$6E4*i!5-f@`5s3MH?Q0X9-QpYJUR>#=@My;@z%@WXb73^yh&wJTmULb8RPg=FhHbvo7=C;@1qLDt)M>>Bt^B zOx6v2)zPS?6TSoJDi5S5OAw(f*dnVpoptK)k}Z>heu|8ugNq{JLx3DMfQU;GuoQWM zt8hmi2Nl=S2td*cRGUNKFb+pEw(z{D9ACPNQ4ks4ZR6+#Vo%|vV1_j7OcE7o^l{JV z3_Gqv{6;Acy_VImrfZ3a|M!K_P~6c>Chj_WFDKop$7=WF1V0{ow7?^kvcyw-I1QU| zI&65sNEUF@;~;mfrN8t`kc^3RV{eq;5FlWdprS8pnCLtY2&(4;LFgx8T2t7i2$^wYK;j%wa+7jIAna-Cw5<6- zdZOOn_&Ki|%=jw&gvitX<^<4x`b{{>w4|cM+w{B6Bsw-{+30Gkp>p$Q76yy1Y-iuY zuX%sMD>IXQ-;UV0q|aZeI5V%G^d4FBIc^E{JM*I}z*!=mNy#q3t0p6!IRhc8Z^YbM zLs*tj`qYTCu)@@K-$&W8;0 zw_bV6q@tJD9&-7E+819H^^-EajCAX}HY-mV>zQl-|H?C?NpzalN(RXjdjKJknyK~V z-W{$?fZBvMYhQ#vaCpOZk@`M?4MA4f08R3MUwsBu0A-RORH?OcqtoFX5wNHd26w5^ zVC2RyHfBd8OQ%s~QDO+`PF@<4)mjO!o3ZvG2k5KY8(vFh{rEk3NRL2Uc6F9Z6ezDFJ(0rp% zS`w+08|1qQ3c{7{Jw#$`g7236574ltIRZBz1gm3cDL;s5aZS+V%vbNkC$qVR;SVzq z4IClCQwNaD3pIYPGL)fDerX?w$%~=oKBE}vN^yigX~kyp=Y3 zzD=rK=V;*lJmn3QOsn($1;;?00iLeM#s_ zXES_vWIV%y>8zK5N?{( zCfzmIFa0p|0|b^RklNYd;18pr|Duj9&4h9Lr=?tutZB@T+%aR!C>flOq7K@akSKvd zuEs1fvWcsy$b4-!{R?~?<)gSx?8jT$^;j{B9`F;DvEkb+;(zJh96d6Rzhjt{0FAX^ zY=T6OUn7jv?c?vf?{qeNPK6eJ8f^Z7vhv`l!}wds;kz+n1`beeq9dT;#}P-yn&@F> z2N@8o27TRDZ`7*wmj^G5GzI5#WzR8!M`W;#Ov#uG+!8{R&4-^r$h-^r*DBwpi_yhN z+yFGripJRlD{2sy;Q;ASrJCZR8;%;gSE;7Ot)5YA_LX^DDhA+EmYrDxa-jTgK2z#> z&cs~=3kxrb76pd0e7JbPP7lZz1I2^g**K#A(H}2-4-vx(tr$3y+?$?6LC3KLLsJ9~ zk2Q1_`=J1vw0h^tQNCX4_!N%0#K3ed8i~?paKDR-5b_dU6e~B3X59PGnf%#GoUxE& zQ&980#qk)Di3y;lG$n#l1?<1QvXmENRG;8*Tz&+EXx`6~6^2l=xU^lWA8s1+N9p!W zE9n><3VZyOYhn=b3fI(xUVo;u69=QuZ=Dv7?N zIj`iAkccS5ulLj|DX5n&O)hq4y9VcbX}DkmCwc%G!FqbWvK%Gn z&qi4oQFmT`Of)fJo(Pw`Iu<6VHEe@ATLpeHsa0Sz2_Sm*gOZ>{4oCzoZ&=P&6_@9A z1FEaOmJPC&I{_tA24=?O6&-{rKIPL&?Ya$?j_;U7fw#g}1_O)PGv0`;H9>z)t@^Wy zt?|2dSYmjj5VmUX;k&60)^SGyCpzv|t6^=)z=0($u+tv6M5}VX7#tV3$g_%Mimlb|$F4?J8W`o+~21fDm;{MD*q4~YoQ6Tg4lJeC0!t7VV+tZ6(o=zhmlXe$0v=3YU7MG9N@R zBg7T@^B!3K3XBp@>C{=he9UZlN@zI}m<6D6PTd|>R#tj*&N9h!fkBAb2{EGK@4iSBa3%3Axt51)E@r zH~S3}E}FoA%1O$L;YlVCzo@h}DErJUem?!vCC*I@4^86Bj?W@8$XjW@p&OIgW_nTS z&`qx-mGGAwDO);CeF-r^M#=;5#q980PUxfgR6bvdcr0L|^MG&J97zr8@7F2F@Hm%kM;Z!&gr*3`T4FD?QvfYK6i-h0LiSOGEYT1`jPEa; znYLw~;07i_Q%VjIjwND8JgB^uhG63*jjiq1q|!Rgu2Ad}(mTZ3iTzj4P6=G%+*0`UT;k0y3X#XsAyb4%&je?WcB6&Hl=g7h zUt?90CdhvHDnT;Hi}W1NQ`*E^8uUYk-pmF~7@|NZV!{P2 zo+X(Um|Hu-KcS+z+sak5gQxSAc8iqn28~*8Cr=||DZ8OPxj=)&jTe8#m(C*3xuyA! z2uuMTViMUwfF&SzQ7_2+0<-D8 zuoWoc9O6lmgt&?jmFdszk|1f?igrzJ>V#!0`$r3qvj=VZEH-zI*cmLAqoNPz zrRjctlSO&iMd{Xhd63Zhkz0lh!x!*Qj3wl{9h5d4hrcojkqvQoCy!&$b15gI7nLRW z1)Yo#;K3l*K0=|V2YVG*e0_k+mc!82N?yKF6&Dlt*d>FyX&lLiLlQZW8EKSYR9@G4k@D>+nJWe?VjrnLt)1_Nj|waF4{!kyjBTu$dG8^4 zl0vRRI1#+-cFaX~c2a;ZRTnjd8B~yQ_;6S8^PctHNR*^b+07def=-*=L zX_o6|MxX>_itYp6z!f%b=9vwbazUPf^f$lB!*aPkbCTP5{-~97FDSZB!es;E6{`EI z4!1oFHw(BS0Jv@vtyNISv5GFu7WT(P_H`hYALJZ=+$fo_M(j|bSh+j1qjmV}1aZu4 zZr~uGxC7q3CZeQin+NN6+`C=$4BW!Mx4M0W0+?ARXa?g z_!CjmGjT=di5405=PC8I&aLCu=EEjZF%zv6L+lh&?wA2?0$lCR;}8NTTH*2piaq!ZQy~gHcQ9;wa>7JDupU^h5z678JZNvc_Xke zT6&Zio2xwiXhCDGZ`jmJbZq1g$E$x|Jv>CQU-L)h_O}}v8^}EUWx}tV;+l-~X^v^n z0xqfFcXB{@kJu@$)ywFb2Gu8`e>Wt>4lR$@fsgVUh}Xy&v&pkLbl!)Y0P=4bLqC;< znApjn650e&U<(ub0{?34Nvi?on?rw2?FKN{g{3Ap!I69F$79q<{h+OciVpK(aw=mt z_lgP7V^NG@Zx^tO&*KabWT?qga)p9FLJ@cS#vmK87^H(1y`cJqFRyBymwJ|~EJrUXTD zI=v?+8w29WGT{Z^xMtI@dbINwE*lrkHXA9X;SM;;*v1tVDKf<#T{UOV7`D5~sHB>< znG@ML{i~|gs*Dym0WIj&_74_JkeEM#hci3oeBRM(*Ph3+-P^nQ_9kTyux_mp`;ecC%nIbX9V3DpPCw(#Pn3W`i0d zS#tVwKxQr*ccY}G=6fT^c;?j;{c7Ss{epkqxJtqm1 zhCd3UJS4R0yAJF7iZFb;6>=x78GT~Byb3vWfSoAy)y`jz0xo2g;!_JELL{*x9e3hT z*wR7o@`l$d4iL>|4I?>H`AvoBL_Oaa?v%v!7nY;ATlVtB_*AFINusc{+5cQL4DeM``YFoGI;SmwDva*^2sK_l$HKf{XOaT_yrmnBA zS2WS4bQ+AEkU$^|c)e_!_;ndSXJT5_5%^eC+wkgrY-BN1Ios03+RmSF$c_e0=!a;0 z5ZHfOL|uKktvmJwX}0(@U@@?^9SZLYr2wx9Yx|0r_WsMo?+6!TuG^6_?8kPTKLcWm z$p!{0QhztvjB!WFaX1XMAoZPl9$)e5fd#g2F-aZWCwH`Q?Zfymy!h;hF4SBp%QEXd zinlCM7qf4?QhWu7uwEv<^h1ng5wTn9$M+OpjGC52gqUe}*@(JEiA}9yoo(wY7TU`$x8x!y$*o zw}9=>ZBbu+(3kc(6{2wwgH->x-N(!54i4_MygvH;@(TVCZ0F~WitPtiMoJAsm!OE) zHvkjbOX3J)P5RZ;xW(c{aNMO6wUV_gsmA)HHUdS{rrT#+;L*?f9nU})B3MaW2?QNN z%%sm0)V3BCdIth2UVaCK3m30Le)BQjS1ub0#9-rLd|akvGa%E_)d;ldngGHeWp>$gYRtan$=2{wS9^S0b8`)Y2(F8tNh%fCCsJU&6$R^ zb6gi)Je7gR(##%nU0+vi^vT(ML(yikKInqRK=h>a?s$@&7b%f}X7g{;#y;_}WZL}k zIQ97|<|&7k4##ICX-Ai(@lB#mM|l?Yr*YYbwOSr0WR$AHkTOzp1XMrB+9MfDh@ekx zhPa8nq;y28Nbf4nNA%WrJO-y23wv;p+ZOsx3<5&4Vu;Gdd8G9}vWG#f6)627H3iBD zJN4I|)bY8)YEM#g!bTmkqC){XbI#t5jyLO5c_gG0yZo812rvDX6G!o;aw@AAo|Ndr z94F@`7ksXULot}opUcOm<1L$tQq)Sy;Yuz#oe%bM`>uWQw#yU;@;?wuw!meKxy-(2 z*8P^}y3RDH9r`#a*$zloL^!6~a5OD`{CUMj-7ijIP3J$BSuFXe4~4WBQFxPINT073yN2_wQuj6S+Afq+Od*y0eUqoE?f z9yBbL>%a4HCtYiY_lXW=#r z>ejh?=JhUc=SHKbcqJ+_Q+bV7y?naxc&i62s;z2V5EgbZQf_q@?<7FdN z@q<=DECuGNa(KWwp&ki9m-<4V1NwW`=~thwqjQYD)`YySx9tzy*B7;5+^AlEn}S08wUvzjRC+Bxkmb(2_N*t$l5~xToHQH?RNhCrKF{85R_v{03&Ww3 zccaG2-Z3pW8P4<9pfl3$)<^#OryMZG?KT4oXa?PGY-c4+<-{5yA9~g=#+!54v3z9c$;fEll zCPlU-U@35$(Ehv8@z?%%46i(Q3oo)|5GQ~8o? z2fIT7U?k1bnyWRAlzw0@$;&Zw;Y)`Gtp$br+PwZc2Ugw_9dIMFK?f+_P8J9g2uPJF z*M}qszROlmK4n%9}if5;CYhr~tIkEFatv=}#3rRnrMLhb zv#HbO)_pE@%N=t@i~+C#8ijf0M$dYd2j&+M z`5LHx$6T}4MNMlLnw1)Vkez^oryZMC`er~fjAf+^wn0844#q)eX?Y)wJ41vVTaVES zDlU%T@F+s^HII-t1a|dQVU;hF9?aF@CJkvOT#AjqX^YJb%o*+SyzbUQ8XlqB@}o&s2%59tr3w1zE;CVjRZ?+RO#$5VxGHR3cGUfm@Gk;-X*+HlI{wN>6FZcm9)~4 z^byuKF->C;|5YAp>|k(7vRes)7j6+xB+^J9VsCSjx+nG8p1kBQFZS2|sYJ^md{<*h zBkcQRZmBvPbikOyd_%@-tKEktgOvmvwxSLS-^K#~VWOL^sGlL? zGtjPR1Guz9Yb^7zpD>v<=WhV|B^!TqK*1v4UAywyQEz+)!k6K|1i7e5R#EKI)Fo?^ zR_{5+)_M430hHjxKW_~W1A(xmhG)6dF?+n=o3Nnn!SCAR4#Ua?bqy-=$p+o(wD${p zavSdKRCy_l+7f;lE0 ztwnM2aEQ(e|B^U|O~ZuBpfb(vWquFZ$)bIuc_1&x*7NI{kmNtyc@1f3bH!YII>(bC zJb+d2K1K`FziiPJBs(}-xPlLopfmtr3WoO$uHY)D{0Zu7)$tIDwjY4m54OtO5lKnn zB3)Dn`VW*&Uk@6vVJU7&({04AHdp9%V{(-Es+vVlI{WuzT2Lrdyt#I_rlUUsK$DrU z^Z74D^UaFC=emIZ2GNpaob>-jNB7)|_DO90K=md=en|Z}r!c4vY`jbe=Ax$TFlLs} z>>7_iN<(Ljc2PJ0SxYdR+;-K%gPlhFvd+@DTk zp-=0#d#!>WW*YsNMIi-{?9dSfL2n_+TfWC1H*fQ6z^**;E3QARSy&gG(9rBzoS%%g zgvLK@3+AK7IHx^2e@0o8B{w%WJG5qhW<uJE#~E8C7ZcC9IT7jf9cUvV8BHsTbD= zn!fET?8t)+M5E5UG~~MjB$2Lb9zLbbnzZ? zpgS3FU%EcIPee3&?vWjfM3ZlAC~T0O!?ZNY)7eb$3yhYC)yg$NP@>VV)I>QsYVDwe z7cOM2xUFCci?>*dsDIM>iRNVSH%j>x?Tkfq+#$wI)(QB~-o5Bz^j^mGg2MD?Z3_f3 zwD#Y@W7i}e+QJUzMXLYfv45ab=Ftx%L?rTH9Pkm)I5Nj<_Q2Hs?c$MSixfw;YWqJ_ z?te2733ml=6{th3*FMbbPGcNB&$W83@?SB3K~y59Y2!+Y!k?9Sso?hNv96Bp^CX3U zpH2!=0Gtz4MlicMz_`nQ&TIFRx!WEtyUqQZ_gMST<#KJnIRA~5AtWtB!LytMAz=JN z6iWg-B|-d)$|>jdrM&2VfN?ey2E-A7uxm*FOJP`-kc=|uP1QX@alK(!pnB zpLf^LprNKtOZ)08B=OF6)U|ZB(!w+n5%mZBrHqW|Nfi}pYHB5a7k$*Ks^}g0SY4Mc z$G=rys;;rxMGE|8h#M#u=bjsGj+dzO?1}(Pd$cZ`L^%4F`2zcUJvzD_W@t}dy^3L@ zX7u&>>z8vX(ikcxy4pz3iK=Hf={ri(xVTm5F8-u*(d}6<$m8;tL&iVn1iJt#KC#>a z;Qqh>jHd=~jKbH1p{l*x+IYw+IK z8Z$qS+KFBS!kBw{*$_fi4P`t3jJ1Dc?s=ZQAqf~iuX_4)FGAem#{E|wfhs$$pge6^v=I0v|BnWiKxV?q3{h!Z;C^_V>QOZa+DF7X#l zG6B+JI>y{gEW!);8o7Hk9o&BZ@U!Lr?p8?b{}f4rQ)3_Yl|6)7$aS`i)V7r#=re@? zU?!0Q!I9W*V!i}qdTpaP?NdG@2tFO1Qdm;KAE`mM8ZT*5yK6D- z&sAxZ|IXVXQZF38iIiAwAttpasn0lj5XcB)Km>h11vZ@(;)UhJ=?WwZ9~6a(0p-X8 zQ!v!0Qtm&;|GHMf^C|K@bA|FEg0{sRPr7#PLc4UX`&sg6XX_$kq)1K?E{o|hJO~3& zsM;UxZ0;hCN211{p;=q+lS?;sB@|_t0WG?%{mw&q6i3wn?fZ1FcDJK-5bWY%L z9c$}t1V``8ws~YZ`|4wMZR_)~7xMuW=(wEV=U`yDgMdmBWn?fZqUPKCmF| ztlQ+W2S)Rkx)&}OoIc9Oyq5Z_HEK+ARzqmQk)Ps?6z%C>>L%pt*=0ViG(Q4$y|=8o ziz=z4R@hWCE7EI&SvZG>+Modd7B*2^UWO+v?SZ-_^_%v3E+5!`u>wKbDKxqjbDXECF~xw#!pj$OkF7D{6h4 zK9W6rvqe`;9BwI_GCP_lTFQlY@(^8WEG|D&VIcNYkO^*T2pR+b_Q2zHWUwZ-O~&rX z*rsh(B*Pu0B_016mbWmr+jwkG4+fk-NPs_Hk|nsd@eGJ9`qcGu1{`}ZmozL`RN&>O zv`dI1l_lI=Pd63(BOtLo`qzalOz_j3%vXo}3Our6Kit$vzm#%^&tCwNCmO z04E1GA$W}LQmU_^nwz)}`vpi=G;08!U?NE@_WzLUa{bt;zFVBzg5|8MGM00e;BeTD zO9+^V`-H`6yIO^wcFtA;8LjWq<)8<*<+mQzc%ov2ic-*0@L3sw$OJzl4>|+zmKS4K zqWrzboC4Vv_Fh26C$N@|rZ{7h_oj^bA~e9`n3 zs17S0FfR%kSGw^MZtWXTLu-~as0!TpC1Lj^wldhF+8Pmk(Pzi0tMzccNBN!vbOH6%lBt z`+-v^Jq6~c!`|_+6O?<{<@9gokqWk}sQ+b+{|uFM|9DZ7gQ|Lse3*-+LlmS4&?KZw zp&_NZ`>kyTjQ}VX#8WG>9lm#wV3S)%8yv%sJf0NW@BgQ~4;p5;{ay@>T7N-+Y4X`b z>e#yzV|IFfQ{(HL3lOP+_m;z?LCaZ1E9n0 za9E6Z16Qk2ATAD1$F=gdIzQ3P6jXkBxkZc}KlpSTHtV{#Ht90mz&W^CSn)e%u@23} z0CDrQb$AHjAUqZ(Ta|dE@5zQZ87f@P+$2oA?AoVsxhGaH>sMvHV@tXBzq%Mz#37{t zY?GKYVzm*x4|(daQ5VMkK~_Og!s1w|EuL1Axv~h|PCSW-49&(dtk)ZXB4;rAHw7-u z?Iyb!jx?|9saT|eBy=$tXdFT~ z)Ej%4EG!rYlgtAtwzFOx`@6}%4I9Pz#q+SkeiOzB-WZSV-X0cZ{MJ6Lz}JCzTZe9B zwR5g1!NAH`@(x-d+*{wm3y+sQq&#Q5qZJ>6FlTP+7AZZ9^J-_M(-#F(H*rT}Z5K0B zu^4Q}Jp+8~xJTZ%rhoH|qW5SEcrQug$|osiTwR=TTX@rn8)iO*e&MF!S{+N7pa%s% z?U1o?f+IuH41~g0kU0Ug-yGU(5Kb|f5z-aDwD>IUuPDYrzelyxbG`3d^yMUMI*!~d zc_IuB?G6c#^`1Pa7YvH=3_tN1QdJnp=w;y}P~s(sQd&EkS}v!Uctv~~J_aM#W_s;% zgl&b~n*`VgLZa(B4!iuSmQGaL!$|xb_fS05Ez1^?U@Oz>RZS61<)HROQ8QujV5@8I z4$R*cI7ZTY8Ur4akGS~aT|wt3N}XREpEOdnSEXu~&OACDf+C`j2hj(~|R+>wK%N2s5SJh1>yzylT@ z2=F0ZYTYrHsZ?f$YhsU2-a#$SQA284{ClI>(q^M>$#;ZFZ4hC)O;vSy8mqa~#5U{I z?9EeQu_oB@?03vAtPvsUi8S0zTFERV@Y8bpGh#s{sR zW3+AbQzCDcApViMwp|rfy%3*s5PP@fW5NiK^{4U=jCoM^uS{0*y+iLdqZSpw0Iq>L z>vJH_qVzVb6(Qu|2|(823p}}Kgk%_EP`tY7KYok6SKX75e8QUeY?}P{zT>s6?+cU2 z*rJF2QUrM9p)nC-1^w7h`S3e60t}4;3p4)K%?mrq!YSJqR`~Dd$_atbP!wu=^pNN@ z+W^8SDBjJsGpc`Ff3%j*f4g|KmR3F!iKEbdNEE8aYk_jp_EW0R7?Cy#pH zJoEh@N{V?leV%@{u5&fM1sT#$=Ze_hcVMX*Dw40YFirmDwD*_+<%3>~vNjrf7i@a= z{7E(%KhZH(T2h}^sMnko=Ai-eoLX91!zrsR)n`kp5%A=|c=avM!OQu(Z^b2Ky$ITx zscW8b=eQ&rDl<1(Gn!wgKj_gR+=G2~-W1mXd$s+~sC?6l z9d)z19ds6Wtq1`C2z6Azh>zLB^UmfwXDe5v7eSiyQ+eo>;L>tC;sy(ZQTQzl;GC@A<20753HfnE!8ZBelDRkNB(Y*h9`>oYbbJiGq*uVSM=AcJ`SNru#=8p{*NH zHMy80bfCVzSm7n|*D11?>*F6GPQGnEuM7o!NQHiC-*oY@vM655c+n?D$6dc;V!9)i zR=^kLS4mTTyFU`c`pXw?C>WuJSwM;d?h@&RlI29$U8cuALm12$w~vJos|C_0z=h|q znY}0ZO+JvG@0n%<$SnkZml8$av>4E~8rk`GdVS;E{HcDUn?PvQd=i&H>kvfU<+1J# z4}k%X!5P6He3DTcAlADRu%1j3v)SzVnJeCL?&Wf?pSwFsMI9&Qh=JYmu!C5`E z>8^Lsip~oG_*3DtM6e~y#o-&?K@mx6`u&s&eX`;3=;-XBqoSf-Fx|%f{=qTes+$CK z63Vl#TC=#0#!V#bLUW|_9XBINQ%ehM8gdzkxV#adZa9Uxmg!b9#MrEX0i84~lc*?H zhb)W66}x8L`lmd`$-nLf4o8|_BY1UHJ=J-r{%}?>aKWt9rDriPnSWBq|AWwdD&qJd zdL$C!j@@TPvetW_OJbHjLPOMK=Ud+GVeR1mAYQ$siMrWR@M}Gt13^CCyS(TA-2TG# zZGwa1_1C6QYfTmRSD*&}Kp&5zj2dr}LQjvoW{abt@|VsCzpnL&!-{T;-Wvu5WHm` zqrA?iw*#gbTchobE}-WUE#kGnBj4H#L+}4zz+f$nR?o>wHZ_0DvHN?csc-8dP5np}s>LYCDeuM< z?zM!-!leu+hc3vTI`spP*u#BOgu`Wqj9&iM1~)O7Pzz+{Ea#b_*aAJGX=$?Y=7a@+Vr*mJVD1^Qrl?+<)^GJ07jA&_<){avB;#n`kA zf_#;*=k=l)JblDGV1>_5_H#Ip%l+uAvH}sFm#^@At++(W^6~tyG=AR9JjZiuPa|jx zWOr~I((Ks!SQ}_^nzvRd3yOObs8&}i9Z7vLFVimvH3q(jd`_{vpXqixoBL9ILswDy zMn*o!nwFlfp@D+f-^R|)4FaP1F+RR6!)2q_&!4c4jEs(ckwUn4C$uy-FIoBqDn-Vq zuCCEd`w~0A8^0%QY3gWf?{DqyoBhvJ@*Lly*yHCBQ2pbIc8;AlJxDQ>1Fd=sIsg$c zl{#{|*P4;;!3ro1D*a<_z|wmE@^Fw&vN@k|3DoaBHJs~`tVZfwJ3{4l$f_bDG@-9N zuhH8QUi&UHLz0WP*6T6&rhEeq9p@eLL7JmEtRpXZJf1S1Ro-`1KF2ohebT>|tk+7N zZ-yg%s#A@NOX(tOvsW5@#k-=g!xfc(D#R_Z80rf7d(`HJG<{i*Cj0ucVO?`%({Y~on5%oGuCf-oQL4UZjm$Z7XkyXKHLB5wafiu8@Myu zhsOqeDegk=7?qP%leKlo(nL_YmsXsMVmp)9^-*-V_uRmqME$;-Vm!@n#HZxQI|vY6{)vVBEKZ{Wyyc5G3rV}GT( z(;rt@wjn>n&)+7fQd!*2@tC7_@y@8^$|xD5bG2MpxA5ZBIHDmX`Z@Ym|-~>e*YFbU4qC`Y~*&1v+J@+@n~X$nrmpdw~n=fCh+o zSboXu{XszrMGg=rg@jSjsO-DhEV{3Iy!Rg@Eg}zZ zlMk2#<@A;;+P&|#uKBM|ora$Ne2dn9d_Dpvi5#D|Wddxzg&OZq|)3QLkK3m4g!@R*cDLhKS`|D)|-JbqA+#DgVc)1T90#$u4 z{_6X$tIAWM0$Nlq8I{v5&lZH-OWDaA{*!-VR}W1vjMCst{Cu2mU9+VCY+oxic0V3J zv5))(H$#jZ zQYOBh%I6zGCRu4Umj0pTnhX~k0?nJJ?!I3E=t(Aju|)hj?u&~BN*BgABICQBEJr;I z0vG0Kq~0brNL>OYU^_V1lkK%6dEwvW1rsi^@@U8l-V0`rf^UDBrj(hyr$+QODD2D8 zg1HcK2T2e5M`=Iu^1_Db^n2Hs<=nXo(wiu5%DCTsAAd*yugc+r*T%pO4msu6gWv?E zkl%ty>lu$d-`+pspzrTY#f3#TGM~L&jhX$&@3b(zH;*pomc=#Id5}dC3pB$1o5`;b zv%N2h$fp7c3E>^6e_1TBC5ehaNSTLip|F$KCk2%lLm?;lC~U!P z+ZIN8Lq;wq*kBwjh#$O%alwo>hzB2J;s%8m z0u1s2-rntNTg&vEHaLdN#6v)8e;w{X!a#`y-MdcuT246nZ|s9I>B*~VZdm-yr#F_I z`%u*WRXiuXNjvmb`^;=KCw!#T+rU8dHAM*k01;wF?`I3SW+gmCnY_Gu8ecdWpa11E zN_7H>NSo|U;e9=>)*C&yG|qmxsc1Co$782Ih;!sH#G!o6avpA|0>`f}FX1mQFW?VN zvkFeCF(0X8oQjhTrw^}OIJwTe(O22X2Jp1?ZMV&o4|)ibBkTJEpHD47Pt>2y42=(T z-8}xFosR_2<;GD@pb*cV7_^28{(-K}Lb~$L6@%J>gn6dyZvyu>$*L;Re>}?@J>2jB z*dv@$_QYFUpSiy4vvHlyUHq!`G)AuzKV6l9keUSn`||YN7$-GMf^Q33zAplSbB68e zbc4(AOf1%ga6wMVRse z0zy0N^drn16Njj#F5n-yu>4xbKH*|MXy?%7b{o1m{;K#zy@s*cmbBP`oL^vQrsCxS~7~~`-|6i>89PdICwqIZoz8?jH&h8B^JiEf7 zPAI@ezyTxC#;37@G~!lGNZrT*tD$3T!J$KBA~Nu!oD)*ROh@Ye8{ z%CG6-Q4lyj%)#IOv%&|a(3Pn{at`S7gpGWXydz%Fg|i14e(vM?$Bs!ylHNsc8{m=& z$><|V__W$7sQ&A)+I(tP7!7Et9K9sIAml72%YZp<1zmd`TYDq`ys`I!j<)Q>7PCQv z0Fi^PU$uEPXZQEX;cuFq)1l>5wSWRrR-gb*c_*tRS0qD~yM>XNqFUjK3uBRN8Cyo@ z52h+!p->~ki|Q7}rL0 zb=0~wt2F6-Rg0Lc$gp)@*T^+Y_NOfnww!;5#kbp`RgXSZT3WiMx`+eN$G0VG%n(UR zbNX3X&3Fp0<*4JmkGeO2@*uHC!K2JcebzZrT6SjEy)f~DV{4%b-}c+4qXN&CzqOlA ztVLY<%NJOH(x{=Y$J_}&pbvK*J2f~4J5$gh3NH7y-tnR}bxri*4)*vf#x8JN=FEo;LthK%AVFNi}1w9{`ZH zeOP|#oi)%SjL;4JM!bhXNi6g0ztj&h5)AI)I>>FS5cY{eL_cu|scbT9duI}g$74QK zM?ea)+7usWXBN?&x+YGoL$Ge{v8SU`2?yQtxnqV5y^&I0|5gG@J7$m)GFm^grW|D| z$?0b#&YjRJ*=5SqUzh9~C6kjJvxZ}kg15n*6>M^Jv0rb_H{^x|`FzOYi|a>Au=Iz3L-wSC5AOod|{>w&GL@L3_$5Z3w-!|0ozOIg7R;EJ=t ze{~{;{RBxcy{X$o(luDn;1am*4RIw*n&_i0`CE8LBS=dkPLWu`kFVlRtx}@fgm&3q z(|o_3Sc<*#pqv|>>mE&+kKXK)grNe0k|3)@U@N#0{c4?efkI0NL4*j zmDZ}34p&xMYV{k%&F;cNtGxiQEl2mn8+IO#Ud}<2rgsC!mq{P3Bd=-eiX%F;PAtLB35~{Nfo!sxG+2 zx>biEeQM_Q3(csrPi~8K)`n8$nsqIY*3uGK?0#L+OpAKf+xjS6+6YiacXcKl?Y7&f zTxei?f?BJnh)+luwb|0g8i>Y1aixoj#vSkQ7(OI9CN!!#uU>M*wWMzpXj$N-sVL6* zW0@&P_abW^Gx1A%If4+#q$D|Fx`Z+f2nw;QTHVg6{HrxiuPbM1b0^+y-fiut#!1lA zly(>bw%2o_;6n-!Fmya{<2?yMo@lv#2U9LOTAN;z=LS5$F>9{Mv+gTl@5>c%YndJ8 zu7hnNo~bZ6G~5sZs0Jc<%w^r!BbKh~!LzORIWl@}b-z1S2d%K<6?Y6&(iMR4Us4T0 zgGTY1-4prs0NROpyEsZ$Tr#JKFjPzdhB-yLu*;qk2br4SSiCc~!EW>kSUcE}={`b% z@nUxU=;t(c<(p7;|Dxk(*iCWrnQ|5w;VMB7ZzZfJLo7jkPZzoMPi1vvXkxLzM5KaF zM{xx+*?3!v5GBa}=Fg8*^HMD4%9V?$flC<=Nsaoxu+)Y<_5by9LBUr}*Vj+}XS-M_ zK;eWaxJP(QthYZ7ucHsHe@VgqW}rdAV4RW!%`tqhkOHK3`58`3zP}ypuB_4E88d7@NB{Z|L8nvO39tiorINNi?x;uIIJs;l}0}rxX5FWC_Ho0^L=l9(cYN=Ha_L5)u|H) zs^wK@=88*Sq*T-u--R%A(oUA+?K4ZQal0LAmrmRTTFl8Cayy^4{LT!-+(sS-H*$!c zI5u-!N0yI|kDt9DU{sF4P0@mvw02nm3#c6w1@<|8`e5D+6p%{ zoTWPQ<{KHcbYDt*dtd@&@i7>5>2A6Z&Bo9HzQF11qGf8?yIZ=obJ##C@A5#6F}c^_+nXr^+ffL zA-*ej#U(jo_*6_iLl1?NiU51&%Vi{*_{-k258aarDWyjHxHf+(R|NBHG8~_yl#8^2 zOn)!tPI5*wNDxnkJ~8MQIZ!%qik=cvI}>vTOb_Z8c5q;pW<6$Vi;j+|Z90)``Jxc7 z9##op?Q9yy3JN3a(kN97CbtM(E)@%^{PmJY$$~fqMhOPg5NfvpRaBJ624j5qc+NmD_jaXq)LfS8*?a+piA z%V*~wm(Q{8yuXu^3E;U(J+}(TK*SAdSmIG`4hfP1OcR|aNpdcBX z0?tFV$TyjBII7JnVp%5 zVbtDHTC#Q_3@Vl(@jouqwDos$yC-_;If@s!QZLa`f%JZOu6GQ$sJy#NXE>O+@Z5Yk zZ0)kQd)FPm8)J|(zyHcbs^l>V3n{7oT}9jF1N-Tt^;JP{?t?J1qVP)Jj)b65Q_T`lOuPosYRLpc`MnkFrWfk7_*;_?O zH=6iS$~>^96T|AjTumuqk<%B~Qi(&=Kvv^0CCz+;N@C^5)Bi%OB0(8CGT3xM=HuFC zjLf)eZe9&JzNz&Ch7t2gJesDMWD40^x{3`>`d$hQuG5U-8(0?0&Jy&K;AjaFdl~Y9 z(=Gl?(skmRJP;!7wK(n8zvQ%$u*0y+@R``6|3e)7a$^@J(j!#d0_mKa6p(UAAq~7DriS zd2IIu&zC9J*49pb#>8C+xDB4?eWWwzU~$j;9xq0yL2R*~RtS~+)mR$A4*W~rhu7mJ zW`Oc)ag^uZ`A7&aAtEV;m(}NihljV)8~E8wkYzH*vg)>a!4i0LhbHoDT)PAlbQgsK z%y;D0+VZ~g#pDQ$7k>DMBl47o-1ZUWHgO9@vv))vl zN_TYW1~+2iA~Q=9B4|PB`BiJQPC&ZrHO~4j{sbD16ma=jy})KSi4;IaZuXo0czKAA z?WzNIcOBEkyQT}?g7i>KnIL!+BjqKCk1P3SFx_Z^6NG;XADGwrr^PMJfuhDY(;))8 zn2~rK(vG~6h{P;j5YF4xSIGaqsxFe27aPbJ~F9!f&xJ}sd5t5zbJsVEhxlR z8~W`y`<4PT2W2b8eUt&`i8{3pqA!6-mQbAe?S$5DCUmohZf>nf4F6bBj;(hjdk;cu zJXZO&Og1W0tS>SaY**4s{vLu)!;P8Ju%%X>QsDjO@`muPlh1QVBZG2h#!EzJ7s|>r zjKs}?R@&e+isK0K<{fH{9VHLOM1-P3C8c&r^5XE z*x*TBJ2plOo)_Yhz^mELM!}B@vSWQ{D9f58EwMZMj(sqvZ-prAZ2nf>!MM@txwj>~ zkjGW{%--m{?fi5;Y(HAW`6>YS*uQheB_;Nx3K`b78k46~IKep`fQ_m@ z9Rr0Y4jxVjxS96+MdDrPyVLN%19mKL(BjkHS@fU=hT2~BK0OYHwS16b-(MwOd;B{} z3(e^emH&wh(GcW74rolAuL*WyT2hi$ssdkE3U{kjMm;W8ANtX@%F^WlK|vD>px-wmCBH=~t~zGB3o1}@ ztr1(_WGori7Duzq;1;nr@;T^h&$Ah>+Sdg{Qbwi7i!^J^obNhX^Ot^-00`Ir;A=_J zQ>ZDZv|kMCqX)CGD(<2teXjTpHm%v4{Z@epT0>Rzdm49jI5|FjZbl@)lh~z6;n4g&ub^@N)wW= z_-%she&+u_{QiftYJ$KoUq2C7MT~)j;-dUgZPL)a&ss8B{o()aBkG1CJ zub+Q;vP;-|Zh)uDZMv0gPwaH5%ekKa)~#pHZo;MB#>)f(?=z(&+b+^3E?U)xwjsf% z%~en1>nz1Z@yvtphY^n37sEgqb5s5Hi^Ws>R!Hyq2Y9WYW{qhg)+11*+8>4IA&)T8rXJdR`4 zw)~F!{ms=i{qS)AczaZMi;utLw4lgvjtjvsB-A4v(C?h}0lTM>&4e z-Q|Wrtx|af@S&wl&fd=FGgz`3KPIo8rBkutw3?Am+NjKojN#5?wqeEdSaa@s=3Vl} z**61&A`v%C*_y~{@yK8^&fPVvqgJnP8l|*U5YyYii;7l6f7NUGnUL4(c0NEa;rB+= znLwDMZ%g1BYrnPwD5$jaXn1^F^T_XA_c>UX@2>dR9le4FnhTgH+LF8QW>Am%>>F@s zu%w@wWmmbSMLni=itU3Ukln1?sMf%BC+LrUyvUZ8kQY!|~`7FRC#O+^H7pN|;1)1TvRnVk1^ z5{e`jTF#rio$bOu{rL?K;rM7c%rB^e31fHA9Sq&ZF2)40rh)7ss3#U?rjyMEPQ` z*&}`Qld4Qod;Z@ThO|Ng#5aj1F>nYl0eAZ{Yx@47oKu~-MHu50_zw{rueC*O8)d;K z=6#Zr$@)df4hR{}5=hh9sjZ&H2^S+FM3~4}daq*Skl|K(r zyU;TYxr=gP#p(Gu_@sSKb5DpxG@F`6uxVXmm_&dnv|nqu2&*N^j@Xf|GHvMUT0aYS z#5Rm2T5xD(G3wE0PA@Ahl`p~c$gd;Urk>l=o$+Ih!z`yQu8~H=5UTUQ#X7z?(e-Wb}U%}UKwT> zd3*tNW>xPwUPY)$cf(O=LM$FbR10mRagOsBX8Ymy%e^hY`SDtEd z9G_<=5;XF-2z{P#M6eY*pQxwDBV6Z|{MJEtesl{^}`9M$%y!gOu-aez0r9b&hWC*kO+!D{OvCM2PuZj}H zRiuRMuDt9q<~@}dMdr6-`Yd%@YQkJA!#LIuQs*dFqnMk5OXOgZZmu!EY3)2~f{w*gFm>&~6XOtw`Kn z5#OH$UPfqc#WPmRw_6o5W=sXF(|KNo@xSQf1dU(JY6Szu+sMb=Rf73_e zWaH_d@N*jfGPD956-TOdEP|QB<0qG5@0;QktKwZ{;N9?WxD@1Hbgq7q7CZ_VF0Ng& zN(G63XAi4y!tY6*T}Pu|3bAYUz&HgUsG_2y#wZpel2b)}xWV4ZXen9v6dB-C{wsq@ zy?Rl;B&@uM-X_sKB+5p9W4)R&&3t-#y1J@LK}qRyrO~pqvx0|z&yg>N-ci_>;>yB+ z^!~H)DNm*4$CCH5u!g(qmajl}zy`~xcglQre>NVn3vhpoQj&2l(Ru_%uR(IPVKF&v z@izI3!ryOcOk$HolF_g~zC(x7y2#>ELZF9|72+vC9x8hAMFLMoDpo-%?%*Lju1Xtf zt&UG_XqSiEdruXP3(@X2R|aqA;^)Sde)p$C^;F(j`<_gT#6Hy=JeSM~$Lgu^N6ef@ z7nx@?!X6%{HQtl`9>Ozs~ zCH-^p8;SqB?EOr4O6nfRgGj!S%+QBgv%#J@;Ez`9gH6Ml?Sd)Um0Kq<;8~axzsH_q zG#V-vw{i4wi|?4)0_$~Z!9;rnnjh zRMp$gP!gYV$5~IIojW3GggsUR6^W_~EiN?+o4Ig3xhmv!`H!2xpGZYXwhF49lX?~U zxS#y>-9yV}<$^g8vXDEO6#BiVe*?EyRVaVBuC&l#(SpqF3TAF?@^A2 zN8?jApN_d`czK7oReg@c36!;Oswe~_!^c}j5Jmx531B79luqnS>-_SOuw(F7jS=>7 z!qxz{f7f9ImvwFC>gn#S|LS?8!kpIJkxugkO zW?m-U-KH7h(h6##Pj|qU|Ik6~Ny*XW1u*_h zfmkwZu6-jxpFS#>BbXJ5-qX-#i`dBTkn$O^SEG1C{}`Ac>;&5GWKJN`y=-_tXdX;o zQl6Ujuhp#F@IK1z^t>X*Tj|MnvZ)5PYKE~K=zP_VlX8t=<5s0h`?hKT<``^69>#t1 z{H#dGiPw01oH{Dr4rEKT%dr;;>?K9Rl;G?L2zMJT;<}sHvPd;4Q+%Z2)*FfhhbNLf z7&3m`Apb*LX+V^8B+quvjW1M<#FHFBKOtS!k>{Yof;~E&MlBBhMtg=ZEQB?IXopC> zAR3youYy+v-%>Kg(*?7B|vcZ00Dx#OK=Sm++BjZySuxF z0Kwhe-L>(?8+X^~@BDMloKrP5HF7s^^;K8BeX(or)oVZNk<#i9cWxj58fY8k7sh{6 zUvlrB<(6^qVIe2V+n1C}X$eDh)Mue`K962Wi)X?X@B0+c|APsS9AjRPogu_<-aFmM zSUn-L|DUrlV^1MDL^PZRr|p(&)Ni2BOJ}*|IoVsb-X{o49=g4w+Igy`mLXSDA1?IJ zqHXU3%SZibM8Z2&=b69xis~e{e;qu)M!V~c;QbEB zH}$-0=5zA~Pg1^MA>aAjp~j%s>dZPRz$zecx!Ffm)}ZNR{{)qtO_pM^aC{pd9}j88 zR)LIJ-dly>eL*gbW}ot>(X-I0B#0uD-`jX^psfQdIJMuEXTftSibTs8sdB?5*Ej!p zaG`Nv^P>LxAUim4j=OD|$nz!nE?Os=HS{n%=bXO0itCvHba_^XF@%$q;oIPRa&q)~ zoxOg$*4u{y;%<5VUifon;?A0k6Xey|&?p)EAn@e#P%Yf=HJOuDzGBEhCfe_^s+kcw zNK?Q1+_nx43j@f?4P5xJd#!+XS>~)tr$j&8SWz=Gy7rO*egyb^Oc^jQPC0L>1M6n- zJjIz1*cK4g7aZeCy-M$+kMabfh3t)Z$S6+`uSr&g&7}ciBR{#lC}BoLZw&urnq~Q# zvq6KQxFnin+fOMiR$-AFfww~4z85{UwP<-WyU27N)!ojvIvq6yw6z|i=qSNWV?M8QtrduSGi5zvz7|E#T%4^t!t*ysXbx_A?BJV`!P&(C5An~Ecmg~2 zqqZu&FFUL9p_i5DmO_oiJt4yKwU~7BwW7TF9E0ssglty@qNDy$c0kAwXWPjKs*3=g zFOT!&R0SfpKvMoo$OetUt5=7U(*(@DM0rzNADI$nKx)_1)4S)hb#`u0Un`$rflLIQ zb%4&+o!|O2pLNd$tK4yN?oXjr?Fnq5icg@55Z+iw$yh@4SIad4MMrOAW|M*n{MR!i zkJ_7*-*2DKr>8Wj0OM9htF2>Tk14K_+T+H>3|7+)rV|>MgA*D;IF}^q7Nb6)UkAVTofz zTu#PQov%i|m%LUs`~t`kYWJ}@9)BEfa1*sZO_;K}m9IAH&?LJUvxVvMtRGzSoSb={ zy{^goyt#Hgkxb?C9zVZ9{x{@bAIwNR4z~0Yf#)xaww;%Q#|JwkuRZ4^JYLPJRgfDc zH2DJKODO2!9z2z85;ZY?@_M5r&;K%L2_u@K*W{heHCc6O&?Mq!>U@8)1zDW= zIzJMD+HdE{F?>C&o{~q_r(y*!uT~EGWEj^LI(bAAhnw3b*Dw89T{hk;Y%5;__4L}^ z`fj~o0Aq#{_gwGC5J}4ZNCfL_hWpWR>ic@ElkE>Ezu4xDUv6!aB=0AdJ5>9pSz!O` zr_qsAY!JIj`&Iw$oYH{hWG7?wAC3s)Oi4%gyT!~YPn|F3#dAWyKFu%fmRVUkRpH_K zHadYM?cFxI&{c@Tjzayteo#zB0aL<|%0XO|EGh@^#_h1CYRV z@4@)xD@v#BW;8oysj2W!(1A#kN{1$ehnTI*I7J92btGC@z!A!!mYsv6c4eK7N{jy&kp}(d5)rH09oO;gDtCCrhAZ&yb$~@fnnV`Ua zp?y;O7JZM@xLg*87XN`vQC!)qI4SL5(n}xcR?J%|%c^!G@m@$Y03jQ*1-aq(iO28M z;#9#B?hrYLvWBVCkP#BtPMjo7-=whOgT=9oI#k_5$E?G&!tUg_|Nif-taz6Z?Ndu6 zs|`9iTR1Q64+a$HNMpDn6n6G3LSB5j{ErBdZj?zR7Nv!XibSR7b)5>GF(YE}Fh|Bn zDqkvd>!pjuUfh*o`6Y;d^>Mqmn{FCopi?+b_wV3#t|z!3eJsdBl^4ZkyjCYTKvZ&= zz9FVCGDzmvSF5hm2R+nwJb0?}?y2P7$lNz)+gyBIfJ#Y@lPlVB;XS71lqN4*e2SdB z%B>z0>sr1A;*_T=sh&>nV|55Yeqy}jaRc3B*b3rPH$IBR6X(0Pz}od*@qVWFTIYKc zPV%}2FL*is7ATReJz0aO&l<^09kr4_gf9=NuVy`+&>0?qMov{=!2*2nWSV^5PXCl8mWm7=qP>~#=$Y}7LT~H-g4JX za#*s@`uS_fYjISxHRn9hrq1g5%=5hCdBZa`HN^`=LJ*r@JekYudD-iJ;|*wbzTPhb zy}#|q3;fbpoG}`De|x_|QBzaZ23EwzP?GVY&fI$~DNf>n?s-o+>gZM*@r1uriiU=;jS+qX6-V$)Xmm2K|@^aUCT$k#c+k zy{~^^s02WDuUX%LePJf43_x3=TaB;_r47xyl@&&XQ7KpgoV*hYGK@YQES;V&-Rsa6 zW*lEENLhO}DMk~A=i8^!@TG?IGma6nNY&Dfaz5=q>@Uqr4QYln?gy9V!<@&UWMsbP}jlNrdHMny3>6sJ=@uZVWUrTO)g=z!~+-J7H%Va^o@7hG*eC{A@XzUm{yCU7DI{CrMlc6c&z; z_x}SuoJ2^0Y)}x|y>k}D9}raLFww8wO*d9xIwBgLneU*%ex(`l@rAi;*B<4on_lsR zkO;JL1p2KB=m$fQw{#UzCHhpw59(lA4INm*la{FW2~1 zdzp7DP2Dx81Kyh(sSlf%`UBT|Wu7%&uVn+XAKd%|{=`n-zA}tOgGRDWEoHQB^A*yJ z%Tl}h+zedQ-P^e|?inYxP9~1u&mz07-rrW=kI$Y-d|n{7o9DYb7>R9T$bV`xI}52@_j);x@4D_=E!{KKWrGe20V*_q;32HBP4eb2 zg?dYgw7MUH@c9@+_ExK^K5EpcgX-Y3!+1+b*x2D&*)s;#A2(-cy1V;4$CZLQbYTDp=v9~$?^KNYf{dL&nuxoex7AJ!bFAohf* zV|x}2Jep%b0*SFn>B*y*Jurex;v|}>h=FMyQytUe8+d(>#Y5Gm{S%-t;PxPVcCJk; z)z&o-xf+)clqu*g!941cM4+{P4|>S~3)!=!=M5TiW#n3V7CKig-d=xhYV^7r+`bBi zaEWhkZ#64ij^;}|Iy%{j45_0FwH$Hu4%v1XYoEi)EH{quW1@M2`Q(LyHql~9ITq{E zA$IVGE^P!>6Gl_-3}AftJHRmn3aB)g6YGo26jYZX#th3t*YOm4x&r{1h5cDEU$jEJjdG^Z>}=rFyWTL zFXjMy3^LC0EH5tF5U^>xOt_HsLI3Yd%=T%n5Mf{jg&DfpVb)h}g-Yi%s(5flc#B`$ z=tyD1xgFcE6K-q4Cty2te9I>rlS;fNvOp)te&?Y>E=u>ExeqIs`h_#*fCoRF?*P&70Fu{Rj+L)wPehq&XM@4X zX5~j;To1(#$adp3kWc|%1le7tnC}ZCt%1-0^Cm4uf%_B4jn;DYZhpM8&&ahJQuzPH z1(1+G;kR>}>I}qab5Rp7m17u6Q=!JhGpbOHeikx-F6uy#5rXQdKbrzBLn6u&M9Rdz{#d z<5L4vg)O>poGvlW^7=8@FFRmRBsCq#qYAIx5jfCa{V~6 zuHn1brcf9N$IZ9tl5y}2`QWZCJN`V(n@9%)M6X2Vb^O`I1NA@)s+=!GucJt6e!Vc4 zwkU^ZKc_vHW#Toj#QWr~2nER&+D+RfwNK7e>=WwQd#1w}eWgN_=KH*37uSqCu1Q}f zo%xi&POPfKinJEyK~l{oN|59qUFG#<5`KT@T*uC1%*|P0(`%k(H{(kd*@adj)WMG4 zKX(79@qBY%ZL5YoeaECa5X`37MOJyaY6v~=znvcef3E^?{Lkm`HYffhx)F(ghq*v& zThh_2KECHtqT=j$h?ZRYb-YQY&Zk`;=ea#nQu}Q*| zNim65J|3@CO~vshS*CA)pe=vb*&-U<;7k8G zsCn&i+gCH2xJlrB<|yxQ$z6>>oy4d9C0S6b&1r;%&?}}8e&sBIJ&*S$rGJ?AlVezWZG8F z|kce0GHV5OgiZ|*yV^@x=3?^_LC$Aw%Y01VnsWDZ# z0cFRHU=HvsF>dXBnMIRAhbbzB;+jAG-OY$!VP~rOOA^}4V3i%p5J-q|wmFe{0f)Yn7h(saPdrtrY*}+uhAh94PoyBStn5wcu2TBa*y4oy53d!NMDWpD|x zz_Gh-C3{13!^a)0H|b@4o1wpW;1ZjI4qJm-VtRIKjpeG%juVEl6h@&uN^_)$VuOSV zu9n)vl7ZzdrqsYe)ERZtno)zipnLxs)zsdvNm>ai3M2%{Ht@IA;nd;{6ny*~(!n)~ zRE?>)o^;8fbEs0A5TEV8*)%|;tHI)C<07-~hUGL46Szi#x;g?NMfPswF1n%VB1yN1 zcRF4}8a2|=mQf%z=?C1s-!pE&+6G#?fnqM#zF}g~gAxBL^CMdBF86P-S_PYNT%BLO zfRD4a!MEj0#<#PT)OX`sEk@2F@l)xUD>QJ*YbN4` zL`?R}^SN*7smuEor_a6M%i$Qvt%h5-j&5*K^X*h@>Uzodb!%nH$76Sx*kCB@cvUTP z$foJ;oI!U*$(HMuio;OPy73{Wt$eYTk3;2k&zp^n0u>on@5m+s}lE~PaNTvDQ#J0a18 zfvjIUrf#~ObtaF)lp-p4#tt%a$B-QyhPjoGj?BY#*4xL$OWCEgXMVa@b0YjSYY)%z z7Yb(sjBAfuzvSu_({V|#lpa`#f@~DEcgkRtcGa^JEz_dyLRV$n1c1^xnVfpgR(;&X zDL?9&pmp*y1YL694Za7Sat}Z2vzjtrp!s24FM^#3g=pO@!oRvDS+HI$*S$p1lb)Up&!PTB9;P;WK z=-1m=wa%xB2D46(&!yF>^D?<-?8_91@408}2CGWRm(41#m#WvpW%#bE(K^PQt|gb% zSdh}gIPaKzN1MY?=Zj>zhG8gc2+|9|ga}ymoVJq7(-8-mC_typWn`z8sNa>>@*3zR zFF6)X=X!AVT)LA8uzMay9OIlMA7p^s!#(eMPnUxmpr5Hs|Mph158^H%FO5{#)lWo= zKd%ieYc-{|>0FvhXt&?(r*)J)S zcXB}HgeORvSdudwInr3-ZAx(le{;MpS`jl8F%HJXLlHGDK}UR{eu0TJUxy0iA4u^A zh5bm1&|DC}Vy#zn8zac=s{kGpRv2vH`G*GnaCbnbKvW$FIf$V;^`Ml;BucG5Z)Z)S z8e{2(>L0!dF4@ou`Mv4oXRN2ewvO3e)y@hNi1>-yyx>(|I0|V{0#o~r{!7>AgpVEE zlG37M=^2@X?kjL79O+M3FC?r@d6O>a2Hc0GaLwq?#{ zYx!Ly4tE(57%HqG@6}%%fGoYAZH33+L;X!)ZA35fRBL?q>x>rAj>oz>lBz``0J^~=@{@U;0VP+gHioy%BDJ^BcSoOgWp889%sROtk(fyxSj+ArV8k zY@;;e+BT8=*e?|6KIT~037*XHJ&d;XE^Nqn@drO5B3eQ|RXC2UbNPuF3p1J{_Vbl5 zE^Teq^**Oh+b3(KSMY$%wroqmhengtp^eA+z;n-cTF?`#sKL5+cH4d%!wqZ0GtU1H zkUZww{}v?wx90yDk}o*fCVWF$BtFwL@IWq_t2sH&Y$YjBrrC?Y*qAqKFChud*LRPO zU!kaTokhlc-lWQs@!i#V=V|n+#;rcM(@ze#P0X#FidyY@45d}GZOvxbw|;(Ds?7D= ztl=GW{aUG1o$X0^x5iono(lzcy*xQiftqJrbjAW^GG23(lBc{|1?t9xNT#80(7e8* zlSn zJSGgwe-4YW_DEQ@`Ajwv=3p1@JQ5p@d=b2O$-;X3eY)i}cIp5`f?iUi2T!+luBBBb zTXQ#!x+D{D+O%KvB1VfFnVRlz_5^y~pEbOGZFa)0%!QYofQ5~7T+(yD9}Xrs!+D<@ z6MS8b)N^~uFS;XXpm%XOyAynmEXwV0cv3p2d*6-)DrvLEFU9aTobxL^3tr(SRq3`k z9A51Kbv;j48Z4>gbJiMY-JiRHw>@o|(w#C+)+Z`+efBNiUsT4lZaeDh=PFe1dk2;g zam?@n4Zo<-?K>KWW`iG(qg~q8*<0#n?isosie!LO$$!sElV01GMzRN`r?v>1QQ70t z_3hC2q>L>#%w(erjF={FVddh=#+j#r>^)6P*i@L4cgj7DtStI@Ocx2+`bEPug@!nb zlTxk?jTrKtn)xt4j220!#%r07A!JgUkHK00(Up|_ZisK%LwvgM@-e(-#ugdh9~y8E z5n32BtR6-Ya`s$kN8hV*N_w9r6v zF_rZ)Ex>esg-%7>>rlAE&oJU6Vy=Wv&%6m?-_1>n-ml05LuI2LWT`s`OZ4w`&(_j)d`6Lvd zw}+jDc@AQ{?1xn<(0d^;_jzo9GnRPR_v&>)2_?yaLxiLo@q-zFKZwC_4!$d?>)34R z;Zx)#YdB(ZfSNkre{reW=xDdv8-Um-WLXExe|X=03;utG$ukRAJ~d)9 zr%{Ya`jgr-aYAAQNpa&MnDJpo@s#_}kSHL@0!CogWP_6stfBQQRR#`u2n;Z%r>q|0qrPp}NR(*1}IM0lJ5Y*UKbsB=Hs zsUl5HxTT^8u1tpu?R;~~vquW9WS5$xnEZ#~^IQ9vNuF$q9m5goOLC%&C1}e$?vTkz z3Zv2;p3D(rZB(1}Mhxz7KkPVW&R+J4m{EvyB-oYZ!%@t&C8~g3jdhzc9h)W*$U3mi z0SMK|;@ennTh}>vQl-aJzbfvU&Aq41pht5)41l*Z)_d#eTJYJ*HN2){8jQdWfeNH^ zLnmHNeeacz(QBVg*UUB;i!4{X(sDo9?XEk#`jCRs!a(a{S-21JW&ty&`5v4Zw&+8_ zeew&u83_|`opAf=38Ko*7aTmP_ouEUAR;}^4^{{Kre$|oe z5{;ikXUf&v%BeLndeWlo__|1Q#wBAM#Hs1NJ$*Lfa0w4I9da12t!P9ceqtjmnYrcl zu|jI=QNDWl9mbARWRYB=xyOrRtD~pEc!f#;ytZZF1g@UB6)H?Z#MRu`j&zOI&voi_ z*pUOfGx2Tu=ioeV0!=j!T?1h8Yh*5w_f%k^pl6Nyz6H>kmo>5BUO?UJs&o4wOehZD zNP!3D*#}`%BA6yB%Bl|~bh$;l#0Gz?50`eq^%O!WZ%ou`^)dC{GIccBu&yEy>tI$T z#G_rHJe~`sisjpE%!F86=BnA~CFm)umwvAhHc7I6#OW{g!6N*fMIzbbHz+ZCi{KB< zt+q|sS|%VD^!w#c+;#C~@yv*G+S)AYuN3J@;T9E2vNW{Ayd{E~@Pdd@nw%pr^+EQw zeO&W2J_WfH*ZmU|)0--n3kv>zwqgf;3cPL>Oeq(d(fp~a)Y+5*X>4S;JBhnl!XEx_ zMNj5>wIseBUboGnqmI^^XDF#M7~&sN(YL?%z4x*|nZi%7lYe2P*@Qt$AWS5rsB~bp z;G%B!$~6&gc{dgcFESuRM#l-%C^J$0rKDFo*jH*9;!mJ>4xJKW9>`LCnatS#*zNVw zfhcE-SA~p_6{{Jd%^IWx<73GJ@P3Jes8gZH63kk6PqEz3ZMjR-woY11%{@8AaE;_T z)z2y$8D1C|_*~(~EA?mtuXT$B0t(5;@n!W9J**eKh*WjU^`3VwRS8sM_s<`~XFG=~ zh+6rF9Lh_Sf}h__!8bUs4M0Gg|7T=UvN~Jj)QY>4^}&8` zxTz-{xYjE*c}2CQCnDQb7!Ngou)F8JZU+8izA2yG*yP(3m+LDVt#!T*Isw{hmb!9gwVFv>_CqxyW}wr1YyZWA*5TJ< z*x1CRW}B9s)le;AB$nfydW*t0aSg4ej%q?#FTk2g^NX0d>W|R}8eTIZfi2EVU1em2itztS8Paf2hob!=pR z`}B4ovtr?Ke^l7hd&IiJ)23)uS7HhtV5;H5aK0<^=+K~mM;{I0H_Igtxu^~PrC$}g z$rgSbZ}PQ#+;>m(h&kmylVldiq}L8!OY1bau$XaD6E2Mra-{~$kWj1r7T-z8Pk!#N zriC3~Gmy%-*kn0Op^_$S$TGC5@4r)IgNDmfMki49nTg#-$yYU46OP6s*Q(+{RNJR9 zlFGW3wh1Yq|2w=&i@Wpz4ntxW_fnV3kCZ{|JI*i01ndz$Z%`B;!j=I=);~c330X26 z#CzF7o1JXrL1~#F?Am0pmJhcYf~=3-vknt5)-(3WRSZU+&}gdz!_qi*e>YL1khZ)E z#<>6_o7jzXC4Lci~C)(iK)qx-G@`Su2Vvu?~lMC0iAa#Nbg`vDn0( z_my<=#+gNj|2Xz?;g7-wB}rdvvogn`{WdHAF+cP=fT~DLme>p@v`v|oU@2|^{QJ>} zPOW_V;B7Houc?C|e}Syc3zu!Ang5hZg|mAW=XiH>|yrnZ{W(@MjGB*-XGH6lBE|coPYiL_G;F7?%K9asylce z{ZnzR)7$g??KSfWs&*nS*%W-Vt(i~mW?W3yz`J1hwl49vNL(7A&+Ov%=dCw+nG*+? zQF%`8b_9v~;Uhu4cyVwnIeqFr%OWPA#{%fvc3gEDdA?oT>=mk-l`E5W4T)1BDb(U> zS-alHMk`11nvJEYKzaZn8zhDo7B&XloZY4In!55Pa;nV>P{`AczSJe}>d!P2U{S0r zaqIbFI(W7tiyXsKzWtnv5@o}Zn;S5kTKf32p%Ywu-eS{s=$w(WDg?T2&9>`8H%d8O za+w_6a}2IkDrdsxZNaUhL;)RRj)6O`+aSY5=_+FrE033Mos^D+#ApFWXWSR2A4B@+ zsZ2VlOhD!|?UeCPcUC&+Egz)0zsoPMmh8kcg((wf;?!Jaumh3yR&dGi$LLhK>5?u4 zm==$IHU~M#)FK=i<oyt2b5i;PAhC;q{!Qi-=4 zt!O_YH|5u_uCklKJm}Nj>eZQV;kR4~&c%)hTcLU?bj^x;OqeN}mGIo_ePZAm(~+QU zEj;xeqp&Gl(xq@M4JmV&2Ha?~{NNJv(biRErK|aZ@6L4l@#Qe&bv&#I@c6uyb{`cv z)7A9{5zl)K3SizcGm)|zdH(PKC~6jNmvg-<+;@G4V(5q?sHjW$9L%>{N~hMhO-u)Z zPWG&}%ffQGZ%1#mtzN`ae}}TnGOaj1sN6m>1P}hOb;iole4Gc-uH6F5nvBcT`fq(aT~$Yf6- z>6CUUcu=GH!MA%22=9BTLlP+RT*WT`?_2<1XlV%-(Ro>lgJ;B4`L4H#s`9ng-_H{_ zMCV*@m0dsaK&%(1VigO)V~jqp+m3qIYmHa%a(P}a+485Jo8EFh5W!cWS?*b$n6Vc> z^{Fb;$TnUvR;>w^q~MbXw%pgc{mxIO5-9=BUUN(XIqbIQ$O-;Ywq9R|NIs6jnw{VH zH@LPTWIk=oWm?)RA}Wy}<~KF7sitfm3d{1!6Q0Er5iXn`Joh$uWlS z&cdJ=R97p7TZ=TGFc@xs;SApqh*wxuBjS*}F72zK)zqzdz4=;pyi7Ud8{L^FW6_(k zR?}5mRXcQBjYkV@kz(HavqrS6=l$4r{q0H6I#%wO-oOyh_Q3~d8XD9m*TmbjmJI>r zfy9D}ubW*pMWCMYQyVHXRMD=w?T))DUfUP^v1f&9^&UexR1WAUE^|ZlTw25G7)&8TJnsU9QH*(_nfL|>U4e^yxoHXko77z>@M9!?>PfR{bmf`poi|yN>cHd zWJd2J!$1PQbHc-i&@p#0s-{Q0hmLYJ&1H7SWpUYM z0a)H8yaJMI%(gL{=H(e~4uKprokN&N*=xFQI9Mn~W>1xNZdloc9k0fLjvR5(95XNb z_`^ZF$s9K%=j|#9!+)dBvFV%~dQ7t!R3}J7BzH?Nm}x-~MZF;%9R%vBfev3g4{KOO z+m}-pJFi_kv_KOJw5ko}SVYzI)qYUl_0wRzr=F>Egg@p*_DGzxp7oZtRfiGRZW~|v zGbRx~^76j&PJi2G%sOkof}HpJ@~lX1V{SMO&@r%X4nQgihK!npaWsH%#oQ7;vn|hN zpuueHk7Sh<6%&(_aA&wv&K*AdEIc)I$8XQ)pnZaDR0Ep|=coPciiSbWqSf0P^VK0L z3l3MB3fHwnc&g)p`mE{7^Qo$)l-2baLm#!mAiuGSNw0jJ>WY$hhcE2(6JGhRSII5X z0z=1vX8WlGm8o^*7GF5of3})=I5`+gm|np_G9&lJnqL_8-!eBVq3+(6;)KijxSZ2o zNKf9~sm}v~yuF7@tIP2eECeFF$jHZ@qDYUNsS{Hcky`2MT zblMa1MDO|obWtN(Dr0uks6 zODNgZ6o8%D^7Rh8+;1L;8p_%!QHB<05aHYt1U5{^~{BJTm$Iog)M5{;*q%>G;U@jUenimOLkBAe$Z^d3k zg=aK2mx`yc?O8W`#Ql4Kjvzj$%vSAEb0gZe4X5*{s>^=^UESIaw+^bDDIf$&^d0)+ z>?)N0g*zooZXP01>89**8?kGQ&txevDeJa110o_~lg+vX+w9%#4gI6n+gaQB#{LE# z-~vsrt>NY>`f*RSX~y1q@NAWzqj&vlj0u0Uui>?@+Dhg9t0kfkE;69pxs?&54eLKkUTlJw(^CSaykj}SdrZ^-c(ki z{gFw@+N8$1`48tI&+Bp5HW~<>0d~Ar7QbH!$#@eUow<4adXfU90So`1Q6>04pI`C~ zJ09~iN=`i(*Rr~dYJH||md-4`J?-ADioQ^mzX2BI zM0N8|dKd5p#A$qVKi8 z=RJbE`;)RCtyo(yb%1{?h}Ab#z387-A9e$33@FZY|u^0lqYR!HFso%dsiKt4aPbp)1U+S__x~LG?g5~!f!=BX$!Gj`9nP` zQt2%43`@F$4T#M?3$`2GlY}m*=|DhLun(dib5Q`@lmmMTiP_^P)#V`?_=9>)I>q#f= z_hid!#S zT?9S;UNy#b)g*L^N$PO16KfUU8MdVsTx$#RikubyTPTmuZf9?fq?-; zc7Oe|DXTzQAQuu{15wsPfW=ill4>~{22Mu$a`E>p!f(Vm<akq~ zj^^#HZ30o)c%vwhH*cm&zA2eO1QYBcE&gxS4Y*YwVY&QqPW2djLL$P+vfDLB94%Q3Js{+vMup_iWXM* zgW5H;rWrV#!tafLzCmkB%?-|P{%UeQC5pp!SdIIlr@Tw5ix5msLi9 zA1sTR@W|y(%4?_Zr#P1-<&_-zouCoAi-54_tz&+Hef78Am1&^UBmtek#3sjP1b1en zfOjMF{&_!b5IAjVgO5CHcREx?P@n4I@F}E*^_S`*at8*S0r$P0ItcdO6KMU*6T|{Z z$g#GCOf>->4C$0!b!6!9==}fGsp&honZTg`$#r4%tBWbM$TE$P=+ret_W(&yggj4A zt&=|>s23&zL_?=q1~CfPW-!xOM2=3Ck_2AsOf}&;T3I3rm_&aRFa%zE_qQAI@?P#N zi{MFj&GNcX<|i+xVNZRph@&t2{xm~UYe$pLe*c4sw-&Q}Co?3(p84=}U5F*_GMceq z2U@6Q^CVlK`p!me`DQ8ovoDmIk;yk3-igMt&l>+5J?_~l7Hn$|1L5E#(q5=GYR$Th zD^K=j-zp$(Z13u^eTNG|u|3_2#2Zxzxx$wA*hnWTvc38KXhO0F4I;%F-gi1!9i{w3 z2GOe}5BpqCeq7T>mxQH#`swNw*KD*wXgjUWez}`q%M=bWLI{zwVSJB_;1#kLqPqUW zs&DsY^iiB}ckV-+10-RjIp{?>3Dv_fu9>OoaQp90c#X=93EL|M-{;4aqUv09uT6{u zwUudKx^W_k(*-v4uQo9&XUA&856EXF-y4gemVL189SN7_(01OZ3}cY+LYjV~;ZTxo zNpdrN9FiIM@9H$pJt=@!&*<4d0yS!TSUBsX=9zZFQH708^nwR^>_}T@u@Dx>CgTq- zO^=)Be44gysNs0+pFc2k3#=``wJ2r$g(lTzoTG9(Z&a@IrRERw`XEGj)L0KKMN{i_ zBFinR&7n^%G2KNokI(l@yw%I%3E8`6mI8A}FvBj6YZ#)w!;w8lzfuxs7-BKBBcfE5 z>DJ#4lHI0(2{-HhtvxaYFeF$w6$_WaWlIVdN&cSQB@ABPgwDgw#yn$!0~o~2=z~MU zT6dU39MkN6ul0|zTsDhb3W~bX5`@n3MH6{J@QcEe7?Scd^a~LjdclD#JVBG z>sl9)Bd)^ZS`LEIPR|>*oz}XYy;l?0zxzeJrEwa7oa1hRNm z0sm=eCU+a;q(i3jKhdC!Qfv?yDUmNSr^k~KI2w|PR{Y)}P?jEZuVGGA@YW_qfZ9_k z92^G->TgCiwwWbZgedRRxj2hg2ZBVdxH_=WBchNniN61ZFql7*^TQCk znw_9gXeV1z?td`Vpk$Y!lwKoD9xIIp)~faYCd;rP?-7Ji+(v+5$1x?-yOsPH*`6}9 z!wlA8I1iY=u$#4PCiU8z13|a)8vMt)AxSr{4CiY&Yh!(qL1K7KwRh&@OFmJ+RjBVAtqrz~fM5@gHs5Gsj2BZl_>rhltRxpL02?pYl3p&>+^Y$!~!6h2weM6-{ z-ZzD0O~63^WEKznP9f&t$x%%6A&k!kCcFIuSOufmT!w;+GRCa4%t@yTk0Qwp1;!zz zzi$a|5SW{mXmds@M}f-y_Vr=?J3T|K*Oj5jBzikeK!1a<51U`}r+5NYIe{#!K1bG# z!v5bJPKMKN2)gEkB6*fS5?I6QAhak#Y9P;eV%STAWIrs#aG#;VJ2YSDZ{PISAI>CsQIKc%&lGz>NqdO@iKb|; z0XkH}6YKT2NZfVp;Fcy7Lq-o}i|MtusSipq);{eaJy+l8V#XPYvWtpdjmsb2Lp$Ry z4w6ZXyU((jHBGW zAze@EZgx;H(S99>W{z=><+4IHTOGJ25-t{3P-{mRjo?nN` z&$H7l6c7BLJU`_7&|lJ-*{R6=Mwzz~|2DxZ#m>w{%ZVyD7|riz_$%8i=_XjHZ>3M% zR0O%@$?=^50QK4){dxV0+aaza|5mpD*-D2Z%^qp_;%1d`@^k~}n7kXCS8T5T6N^40!LaD|Cf`@6s}9ut?^)*No!RtEm> z{O;hZjjzOgdR_x~PrqKTWBIf@v}T)&HTjD#6gsdUWCAFKtLIQu#br zS=x)RwDTn`#6CJYMf|V60T@aKOgHj466F+>LC&qQPbNIR$Avh-i$P=oQTM9jex~|} z&e>xeC9Cj0-;5ifcyAIDZy;rZj+5`}D>f8QO5{pvgm1Uy9fKD7KZ?<>gi0fdTiSG) z;!z%QaIe2d>v&pyseeqmSrO-C;NyNj$9=SPvZ-(~25c*?xJRFI$MoB_S(1KWl-j~55B*Tg zza>{Rdt!=!VTTI;>n}Q_KttwH2!pOY@5&KYBUd=+})kvu7So$a0_n1gF8%TpZ)D`&#W_Z zXXdVZ*6qb#4bA%XD^>M8^;8vLTwF3ikP|L5G{RkGh1$KjE=5p#Q zkX;H2mlkVqm_3e4%=b#QG(GeFat`g;XV}nJrS34_nFn{iJ_%;WGMf1VI0YU;pM>-Fri6wDupx) zrT>+Mxpa=m1qKo))@4+&bqEJOgTzwsp9Q&U6Vgbz_^K;@o#P`Hf)yDTa*!7~(zU`c zY-8L-{hI<3>-ckvqAu;K>qu(b`*4iU#^rW_s|YQ03X$tS$pz=krA|&kU&o6+t zW0{cZIWpZ=^n{xE-w2KHoRFs73MtT0e{RkM;p+_lMUJSosBP}k89?p?aU@s|Yzh=E zC+Ha(R=tx#oID z)QPgwuKm=>mLqd}R{Y%=tY={Husf7!z$vkwLGoXxSozEGtMW+xpU5L}%_!+UORG`m0TM;h3X)Pg^K z+6sa^z?5+7Fsw_gC@ zp~4WS#E$lXa7VvlDtAIPfTuDwn>^-qNECEtxEN()3{#bjto4XDdl*Q>-$P(fvoL)~ zu0p5I?Q;MZePNRX|C^=ezzYD6E-$DjpVLsiNpQ(up?WZM zj>D8q0FTs(Epo{wWGvo)}`MBr@OO*`;&y4f8`|*qWi*6)wwa(k%^G zF<2y15VGYkON8F*er3IyQ_4%EKx|E)(4s?=FJ7}}f!>Ws{#X520_!9^`94Hx*WWlLvy8uuEHMdw2lovGzQ8*x*Zhmoe-}yY<FHe!>Ff0ZD?WK&%4iurQgq-1Y&B@Z*JyT}o3#K&LF68G$v=ZI_ts4OCE=CZDv zg7|F)E@x6FNDNlCCT73F1X%$lN8$6`0Qbd*r~Py0*B(V!7|B2Jn%k|&QV3hpiV3uR zto&*{ej0|kl3(tiLWqr*$Py_KQ9Jph{q5~U!m2*YcT>nX>8jGhy_Ly0X+s}ovn?l(fN{EGK^Fl?9jpw7e9z}xOc(TvODgZdcpw@$tMTgy78Ngs= zQ}jEPSLCyP-L#_qw=Pa7G`OtGT`D=8>S&Z{VwIH}KrWp??Wp*y?EgdWqe%I<g6Qz1REVu{T|Qt? zrb#X*bZQax?O%cPGFQQ)jF{)o_uP7-n4YC*MRKZG@!-be9>^sWg*pmk{n7!}p?Jrd z0>Wy+^@xD$A0txed~dF>s3DJ07C@;uggDsYZ$_m;GJriiMIn*&XMMNd$YAtp2X&4! zCO%5;YS5#^Vftkqkiql##+hl>T}G0@4JI4}<_)7Rf77uR$*8(VI(^;66G!}VIRybx z-Z1eiZWum(mqvtbqQhP?#XI86hHbEki0gejr+YrX4WD(fA&1TrL51Y%#36CVO;Nwq zzc;KQ+L41w=0&rNu87(|OYbD`Et1Z~-aAe=crTx?3{u5@4HVPSu8b7@Qkj1+Lg~nN z5MV%kS@o9|AS*UWNiKdu9P3LF&l!y;%#3OzZQ_nSol0!oXf!>)%}2DEf34i1P9(ty zfQ>KelFH7^@ex>&;DKD)-qVNRmckF-52w0nU@1eXTehb&P$~Aq@B}!lONUou1P}B{ znQ=36n4s1qP5Ue%_Mmyl;r5T?_0DlQUuh003PBF=jcKWqxM&ZHKN5A|(mUdg%90pf^2xIZ6&5S8fO{!LTZLs{Jltn<=M}3T~_!^@{2eEE~f`SLbhU zx+RW-%|Mk*5@*sZ@9Nn}gT zup^y*$gzju_sBN>REBlveDUtoPKBLEJ5umttcd(y2)+>H7d01Tk`;IJxgCTrZfLrv> zQ$kI}Vd_6k64bT_LZsUf)wU5PyxfG0wlMJi&1#2E^QvxR5)euV&%-$3T!@-%%PL4q z4Os@18C$+bfU8tW+_>4NbA1mk9hl)m9B!Y+)Jt@2h70X7_k9By5OEH$^EgSyQKZSX z-Q{DlC`qilcgSa1u9QuBq7)7$(NNOxtF9lvaj2|a)6*Ba#Ecq*U&c$VbnkPBImtyy zCc2M;in=)Q9%g{(W~e67azbSsI{B}JDjEJJw(V9SEe>Y28DfK8?Atm>d>StBG7&DE zaBW|wRg=6U%zo68^tjjL?`nhkg0jJk?tjP;8&7t=M|Xu5Bb69=K(K3wYlMYVlrtvt zN5JcPpnkh|&;p!YYoUukkUZQ6Va{u82k_|Z3JO92^rSJj!M{M_| znQ^A*_MD##IFpaZQjQk>v$nB=WA+Q+-`kr{460ln>3a{eeqi?Zu@*l8!%$Z|j}=~{eqsc&HEde+=O z)NjOrx^ewn`PolVCg^m%uw@3p<@>^GLGUKYp|Ep8`khcZz-V_~Kp*{o+BjBpZOcCH z-|MukvO{T@SRF@C`b&tXgisWJTZ87Zfe;MCVJeyblRE8i>y`tB;WcSITnf?udkX0{ zxHEBSf1<%+&PKbgmh*=3ITC>)G|V&vybCmLRQ?G0kaXfu0-qk8{y5MYgzAie`k8nu z-5D$HH=OJedt7>Y0)HZ3v0Or-TmpqSIs`%@*=>Mr{&cL2b6w{~k9N0?R)+8M*8Zdr z@AvKu-eXJ8UbuPjtMA6vI#%nB(65+&nf9lj9CBFT7Fvx3-}&IQwEi;Hw5!x-Uk&2L2Y*vYCZ zj&`9K?znfk6c7zKX@B8yRo0b+&UbL8`m+1K%Bjs$0GQ3W#sqF-hSS46BH4 zT2TqQFJNQtUokO#2RPW}aAHn|*R!daoD?4Nb2L0>T$z=FCUtz`fO3uFU3gDdj4NNH zYp_@k9EI)T;LwRWuJM)wk|E@wjtsYAidMyHrxN2WSjsVJ7#AD z+}$lIe@FO`*&Hu-V#zU8n-YU>MlrS;6~zHA8MC$v7O+$CO$yMwCJ=4%H1L+$DQ~1N zgA;!oENv%mIX!GM`Wo#Y{rUQhe^$bf^T=7QslH0DE0F3804JWXPeXRW6@QN>BRhDOEEeq< zWSy0HugN1iogak+c>cjB_2WZ88${@SAjKhN4*SrruflegV^L-_=4SG5CXX94IR|}x z>0094NS16I#VuFk#qs-1R-mu-ZwFk1m!C=Sxup{7Cp~!?&PjGmClIY7?x7U#Ff3fU z&cM`_Z3_PCtrXj0xnH0j>b7|oA*fStW*02lu9<8)ZIl* zfj^f+ss$+#r^shMkOJZzhAn6yFVj9FPFBe0qP3L~Xq9-fR6g^uz)5qcm2GNb-}v`= z)dFTkNpSn8%B@!Dv>o+0tAf>AhLc!Bf7A_H$QWjU&oZ&tD1e z(Q!6)?+57zJjy6=aurYFYpcWa6|d={aS9KO5VsRaRY6o8My< zo86=uEvSAB-jDu?6**0BVZe)ePN|3AK;`IzemqVbYt%TR4H zBSnT3eb&iayV<_gK#+NX0unqd6B!ZMFO2*Sl>aV1LWDu`0kKjIZ46SHzXFE1i=e8| zwt5(o9yE75pp#N_$ea@fTsv5SFmFBscDzvmGTV!MDQ51UaUa^%DOuc}G|Q;%CvA?W zcInt!2p&`su4p{Gn20tEG>Za|j7q5Ty#QuE9^M}nj}js3JI*lS#W>*D!j3J3`RdK< zaU$3wW<f10u}TOlRq+m6k4%!y03Z#+$8vg(A;Pu&=hv1_IotB+=y>ZviqIt6rYS z1OH)o{@gr5nHR?P;D(j>0?Z`l<-l-|*sbNscIV1L6#5<-BKB~KY>bN2>@_1wy|wKw z5U+oU+G}1ZJg%yBWrlfXvX*h}OFUQ6gEzz|!*Y*IGFN+B?UWcOrp_3u7{kb+{IW$lt_C(oRKh=OF;2r}K(Ox^ zi{yh{$zugVZpUt`n_i`7YQk(a#9ZHjGH6SKCf-HQOoq)LX5-BQv`PXj>m4TEWE4;}{56vnU7z_1ckk%6S?gNhODLmE7~UdqoM zulDQOnP2VQNRB;LtE;tpB%Le+p8k8hP8*OOXSLDa=Y>(G*WHmpG=0yUZ=#vrv<82y z<*K1!Z-J#|46+0{{`g~QfDi`?MN-ml3Rk0;T5ic@fzNXK#xjg<9_jD7V52S`$;PC93x}QljVgVa{ED#js@flW6EC_YFeN{CS}%qst?@N z+&k63+7^&sl5RzM=Qoq7bmT*MA(<1V(8Q z$Z%+lSmqO<1yEMSq`9e6LQC2`wE$1@a(;X29RH50_4}9yk@BF9vfl-(|z>rv8z%1`mBf)6)$y<%z(Jfcjl+29^gh!TjP(zug)>IQ$R^ zDlWIfC=Fl%3U3#trELYU5oRssM;&bsPE;>4WyEbh8c}QcI*eI`Gwo-^R92WRbXI!7 zO*~*u%oGnQx5}92mtTlkG|Dxu=*CB|aVF;QA0r}M`QoHn)9^G;;YaNcd`PEb^O^>$ zRCHe_eAzX3_8Em_Wr~+Ajesu?*r&3EO&h`26&9zyaafZ7cFQcE@ND0rIW=YpxKIgl zzC1Czvb!&h*2$%^LvpjqxLvBvg~a+#>d8^va^PDpjtwERW9*#{N@du2o^m#e5jU50 zjfyaQj3r$Ws1+=7om)l-TO-ZxrT$ws;&q*GlwM$j=0n{5e=j>ryjc z1jeye_}23cgT>ka^DM-HSA`DhT=Z;HD;ez9e?@B zPhzhx4q|(8KAdtlF`1~$&kX0l!&hH@uvC|G*W)x_T6%LQFnf^v0wgFLS=#R)O!5A5 z!DjW2Q_?@U*qV6+C&7-|Gsp z`Fl&tt*XV7Hst@dJ{pux`7UbhSbI%+`zs!NWf2c}18)AYQ4DGPTN0UbX@W%=arAlC zId$^o3HRyJi}~c_5(Y>sy$!0`+GR@V6~2P!h)NH&Cv08XELM?G7KSbOSbOvckn%Pk zq}-3}AJ7v`ie|ZOxL_et^i7ZvuJ{b&Pgw{~V@`(9#{l(7ywr!!nKr;-1L?5x&Z13% z`3KAJqQs+zT(|f52Xv!ykfS<76~ZtsdiJ2gOTLv3P8-%vVe{eqH%XIE-3+Tp=+X5E&@W18bAbWu1sY<)CLzW2zMMlZLq!0RAj! zwNhh2T}RcpQASyhZiu+T6TBZLR*qDaog}4!70MbN!lv`P&&+a2vZ3n(nH7S0F9cr= z5&m8`CJiU^YrV*ns2DLk%|6RFO9MjL&P3k#3i|e-53;dqT7pnCLD&Mg>b^w6CnHR? zHQEtmA3JNy_a_vJ&?0SH1*=w?^=or*>=QmkNz1^#18tH-K$-u5l9MD&De!+cUkM-dIosxLOs$n25w_h;`+m)+3EOc^U8~oRiuC} z;+v$B}8 zc`HF_9vYG|UEJ3eFGDQuXX&S{_eOE3JhX=zG6NLoMtpJ22x*K>00f;XOB<3NmVQAyP_;SmlHF!C!h zJ^e{AN1#X!ubfw2B<=eMo+m6QeyH40M_lo}Jk1b`tk$>6Tcr=@oCE1Ftr$g9U7xQ6 zQ`iW@D)$^hTSmTqCpgBD1|7y@%pxaWy)p`UG=46wU7-do7k4R|ov*v$k>OIA%QZHb z5!DHXy0T2llbb^5NGI~|IjBB43t^81Th?$>9?uLlTNNMPU{cl5=;Gm7d`I_E{AABc zpa(Ya496)+f~^D%O&nv-u9-*`&1&K)K%jN*4r^s)@KP`bn%+P*y)O3Y;M~MJ2BFXJ z(p_KrESzVv2}bBV9$T}^p?0U5qgLA*`K6L6v4PBpKtnF`8hq`#zt0PH(MCH@3hBfp zJJJ41^4A4q%T-_9WjFgY?Y&Rxup^$rvmzuJunD8`J_&qv(uE}E?p^OfsZ!R4FBz46>;0*3Yx6LlEZ_vH-c zW;kWIs+iRT3z@Fk9tQRiuQbgB=Qc;1l>*i3{K#}wLKw*f&+L4bp@kXlvq50Q1&fm2 z{-N7~0W`>fLYcv^%b^A^YC3FJ>wdJ;7JN4^BK9+aL1Wf0KI=?%FfUpmSefT$D+bi(u(I! zxok!{Jv%ID4HDu*M!*ocxy6Z3%HK{670~|KwwFQ;TUTu=vf*ozmQaa)KP98>E&6h- zqe#RkF%CMMWO1;KIsUg~35L7o&&0~aX>JP|aem}`s16aOYhs^seCm?z^&Cc*G2tvh zQXk(y(;*4O$1$$R<4;q2T!+8r(YMC>hd#V~(ME>1uM}wiG!}ruADalZIDsGl8+&Ab zXaYuCmPW{VqUxH>@UtSgAQIQ<@$ugx>9LdcKcqZe&8!yeQvtFr0dG-2l*`DEH4?;-eoLE_U2S6!z zQzpQlK>1@FkSS=t3$N1k3OkpQa^{4C74-TXeM_mfaxV6$*>Ec~998gdx2z!m*c3FB zQ2`EE;bNzTUsBuB`A>FrsK(PjW#UruKhW9r%k)?=Q(^jL02}T1%p%ewFTKnP0nHt^ z8G89~D;nz-q}bgcG)LmaoN2xzhp|KPc#(Qrr$|RXfm&Su{H3J^SS7gQDOKgXadE|T z%Gm@fE9ZA1!CG(^2D(B&k^jIfDU4ZQ^85y6ghfoSlERDyeYig?s5GdLDPqoxN*@@+ zeLA9<#|=ZzqGek^jjIY_0c1}?EijOi-%~R9d7pq-(H@k*PGca4l+C9FKmJKFHX(Z| zO5T~`P&Q`|!4a%DuN5ORD78yN?ezuYtjza#)~6GAe9ch%{thj1% zJA#}L3YAF2G)BE3b-dZy#&Ri*NXn!Nm(4a5mM9l02A4J|OJ9C_p4_9HHGo~f;fr2| zTVeWW`iB|O^w(C81AaC(D=pPY3496;0F!3UchXb2NMOHhlj+9$5g-M+8C^a)Ent$z`s#AP?NBmbft){2w-Ib98@cMI9^RAh*IB-a8Q7S$?yhWw}Jy#fh$yTk+NvkDn4+ng8% z(YSH(1i&0UpO&;R>DL^_+3PRE(qB0%GkBu4R&mTPF)@o5^W`6>1m5#=9rUApr z-y5eEspjPTCkpL<#G{kfzB@J6rDLp`rJ0!P%JB{__1E#jGh)Q$9F%HcSp`O2CWn2Z z;$kY~ziIY|m;X9_NWet^{b`JuEh5Y}n`OicH}+Qg)(qaVbZImz(IZfa3uInPAu+e6 z<`R4K+%TXff8(#h9}RR*wkZCzTeUq$0>xLuZLa1^gicO&8uh&lEQpK{noBv8a}*wvr-nP}YpJwTQmQ@; zhnLQd<2=261!H-gE+s8<@^;)@2Y5f&8hJ414be1uHOuJNa=+TSz2X#y7l}KYPR`|g z4@6n24g1%+X{XY+vVUYA92=A-LuS})c;l#zEixP>L@WV6X>}3ktdbZqsTVN^sX{1@ z#LEI_QJYZ`z1vVn)7`3M8g8&@HAm}og?Ujqrdh6Ukb*K4%G?D_GML>4vbf;Om}*am z-CU@fn3^(!I9wg5(uUx;UMiZsx%;=4rTs@mT5|KdcAmZuHG)NFq6kS~@17gUCGsX6 zSUVRP^HXHrc2tiO93=810&8SMGzYp6a)^7i?;MTxq6xyn1+ZiHpnHv?(a3DR$_-iWDlpARDqY9Tq z5)T7!&~;O~cb5n};7TgHdGnD&bG|D*Oz?v@O@I-cXC66(eK$G}Xofm~5ses_Z~V@*(k2czlAdsTyA*ZrtNQup9O4^C500a_53hL)|d zE)yZ=I}kMk$AZ&`WF_$b({nf|?k!~g@ec<2Pq5r!wRcZAl3w9XmV8W8{#EV;x>Ur% zLkckQlB1lXMuj|=MU^*hZ2=U3HXkvYYpKeoj;2a7ODn20)q0|-zQZ>KgseuYS+9S4 z$Wcf~k(hUD5!bg^vX1qPq1f>li3D?YzHith9m|sHI;WUB4(jXF_1@0>$ni*t?8Ume z>~V`Z{d{Tr#qn&PswhUY-FV7hcykf=`WhB86Fd*M^*Cp)KO!XRBrzc)H(0}WQuj6E zqA-IEe9Fz(XpTOLt{%SSE8k@J+)8=Af((fB`vtDnyx56Y2AK1oO0JIfGPB!t zq)kT?v77fmMx~i__f>^j}WlufSIHH zMfi{Ynknq;F|$Z?2-+z2lYEQ<;P-=)^kTiaJYBSiwJV5VleKc;$5dbOvKz#wC)y81 z!RRX#cEX_Ahy&Z)EF~fVfbE7)H!Qg^akt*nVNTHNku4)1Y`+gf z94d3u?D1948^pmH@tu^uQZLLl56S#X+pj%KAJPfXKDSL_2Om4Ku=1TZNQ-}Zp`JpsekD+AX&C{X$-f$r3sEPz4RFL!4UeB)jy zTfC~U?_c|V{J3Emacao^UdGqpgiYtFKM32e{l!e9D{)vNX=S9 z87<^GO37W)VRhEEdlPyHl*(-*@WDI6?a=^LZ-6Kxj*HWe5goZ&Ao5^rd&_Fm<_xHi z`-!gnQY^W-*k0<8DZ$eS`8#t#2lC7xYN*+jc;i?8FCwg!)C=mwZ6>WcA?efPZFTIO z-_!g-)v?5$jmjO#T5g0DGJaQ{cEv%0wrum7AL&OJ?ZABiXr+}W;B+fBh5*8ySV{RsHAH_*AZLO^~Z+mP%>)(xhF#6`<7DKn8CV{FM|gA zzsKAWFtt?Q$n{50%r_0@Zkp`3HR!dC%s?j&%XSWNUKX~p+BZ3jk`qFo3V``teCyo{ zpJC|GT80%31Cas$5(AB`fzZQ^Y5(f2X|= zpG{@c)E=Vvd|gZK1o^34LI7PCC%z~>6y1{UaiSL{cMU319`IqAyu;N zn_^c3o?klu_y}iF)cy2wr*tmrvZfGZczXHJSSRvuUy){<-sw@W=Je2W{uGE8c9do0 zgI%WwZj3jtXT0%RH0;!S5a7Ljw*@Wh+|@JGV}t|SKh(PJzgIDA9Pk(w+dQ8S?s1@R zik|TdM3;akubWaR(W{xa3wZhL)b%ih_S1Vilr%Se-7lbO(`*psJqv?(VYasEKI*|7 z8>!@nxH@*VJq}s}xui!oYpz-Ly{qagZUk;j(#Br|TvSq#_To=EIAdc+O$eOa&Ig7C z^x$I=@ei&zp?aLhyikamoD2aa#zr}SnN$K3+^r8b76g&+h6E%xB`HH{Sd%UaU|!bO zr}exprOGkJioFQC6M6bpOoGopux8R#hgiY2_~>+HVfp?nbHQ6*M$v9H_dCP4l&_UB z;Y#4dMYV0hs>LmHW9Vv`bWTHRhm1~hxOZVz&*6UsXcSy z&rLDAm@DghU0Xd6C_zq{;p zUysdV8g&AnYkC8>>SYND3Dt_i$t!VoCQHqr$svST?OKBS3pz!wr&Zn>MOVDNgkx%NqdKz}} zyA#b7%HMG6z1Vg~3wk;}Q0XSQ7l84qf~O@;OdDNkYXjcjoL=c=#$bBNWOwe0O7*iQNp$A`m(ww zX!}~y0zLej#~~}A<2m@d(f66VYHLeEirP9R(U&CBx82SSJzWEMOLZFL9X@mcwo zsYZqp{u^7euNY9BYho8KX_QF?{ySFg?}%a0+0$T|=xvtqQsdjEpdi|>R{gZ^-7h~{ z!80>vRhsmf`D;~6tlX|Xp&J%la=e2`U-8~ddb_?`_kN>|kdg7W`e^^_g7nNN=-a5} z4jQ8Ed&99%QQI}=LE-~WeZ@3GJCHvVAZ%1Z{3xUFg!RtT8lV#6JDhfR?JcNxzlJ-j zvFl_@yS(aX;aT(rou})Cc5;sb@Zluj_H#IrN@261so=AIK?}y=FVq;@9XmWt*Zwry%&9py_b(y z-(fg<(aj>sDMrFY3oSxn*0$$>7We{w48Ys4CGTIqo!>@#J6^iaN%07JZnchcA5IsR z7gb(2tBghbF6ULbKcG`&xFkzWHO*@((?qB4Ajo2~jyd>BoCx|~BL&^oIfLg8zV`PY zYjithZaC$Ayl98(eVA{o>&1yMP0mF4Mn>?l_%w0|We-8^LTFhvCHert_1N&v{}%1- z{ywU6BSBsa;)Ahn;KfCr=zZ*4S4R`PT@T}*{C4U|O>AbubX-1mSWoz-Ze^i&U-_}o!6A-PR6Pt4-(%MN@Rj2k0It$ z;Q%Hsg$7i+om$k@t^v=Ip2cq+9NwT(p|Qg3&IRPXZT_#vH&zOBQ}|VOhE;<3FHUVa z?DDk}m>Q{_+Z-$VO7bhsr?K{el46e^FKfCjT#4@GaBc1a!?*H!!WQGg^%rSb#-OGgBTna86`sTRVkx5;DO)r zUB4gPEepIu6SWxmd&AN$ABY7J_>$$~cM7p{R&qhy}dKLS0zee+5YzC#7 z&LpHV7>hFrmjKHq!u@g>bX)T0{wLI59BWNFeL#m{6}tU(_jdFh*SZeY6fevaJ*)`@ z;|HIw3`D#x=fG80^s@$7%iVgnxyAZ?^|n8S7I>eNmam)L{g`zAJh_AR+UMMQNSy)X zovTwf<0_FBZz*UB9d>$rPJ6w+y$j5*>wSBi`(fsBHgR)T(P0uEAh(yVdiF~!N1)m= z3{`N>`Ygn9BGwH}rB0r7y59n9pmRj{ORwyIv3Hh&lc6~lo|XZ&G-)>fgbduI4xP~% z4ys&@49Qv;V!s@;|D=q`%Tv;3s%Mz}_w2w)W2Q;a%4EiEW2}a`yPwRh>AH-n6 zJiF-h8O$FZjCWY>vpv<2E{Cca4Ls_LuJBgh)T)i0h(lVK4Amr>SxbYi)81A8g%$Kq z9#Vvm|CuV*`)8`S(y@klA+6S-cFK8P=Xt+$<0o=x%kM4)$NUxEAG};VY#jW2_1+fW z6BL@yKjM0o;YDoiuMF(3NVuDqbZf~Xhc1-rRQS&8m8|Fx5)tF&5M?eI6Z*(bUXFa# zc0X><6TU2R_V+wHvTXNpL^n%LL->YHhWJ{@1l=xTh9v=knBoc#DFpHT3Vm76;6cZzR+_QEL_MRKR)N>(9H@^M{dP20{AP zlK&iirJ?i3{DXwnzHsn|Us=6nD~TTqI5qvOF;le}Xj*AAV9<)Oj*!<2TNaW4}` z->qd(JcB)9z1OwL#A5i-jOg2Ck2}ATz(;PWHa8b`?YAOq=z&b|jJML z5eppiW&7VAlDt(R~Jy(@{ME~x1sOOIB>f@FYr#kN>Nc9Jq!<)ys|V2A=5%8^ptEy92$aL zN*bOV<|7m&hVV5ElqLj*tE2DXbnn|L7|`5pyhYia=CHk25xKiY>wU!K;NBTG#zT}8 zMGo!jT0rK75tBlO!iZLow(N(fRMpMSdf8fhb@TAQyf-{Q^pdWPWu7v6mS(_oH1V+$ik2GOq^vUT?QDFJkgl?x#-xxReeapKJf)v?hkJ~ul)XX?|9zseX!f| zPnMtl4nO;UkaiyNrc=?9N;5Bw=p+=>r;YM;{v#(%=S)j8rdeg5SMlzsTzF6ER&Cn; z`NslSP8C};Rhmr#bBHx-V_5MQ$)9cuazT1XA`DNl2(Q>j9$6jq(Ei5o~P=|NjX?yqgnk4BQm3U6NRUoKhH z?;gE)l7489f>RCpvCXFr&Y!(^ll7$@f&~5T14UCDBilai)o6SPd>KIc!es1URL`-v zz5@Tk(~gmZ_BnWC#bH6`cw9$^H7_IR$ug))gsZ-8oOm z`24QK#wfVMXv5wzB_ZgB+S8hcCdP4e-^9+gL!KhR(xBn+NT06(0J{4WxC z10S2`8J!>WJqOu>NG%ICoECJ_SabAxuJ<k2w536Gm)3>$CRU?!0;2#Fk|d zj*E9%PFQ4kAwMtdgB{#Jd)ndwOB{gojC7qILs55O=|j*-@VV$!qwGo#Y2_T?nQoo` z7bhMRdR^wLC=bsth?ep_f(A}6u?{(3gD;qFPNv$z9+QJGG z2?H{55oepQ974_5*xu1;-EI49tw-WFWzgMZTAqLPyj{x+89bCI^4_@8>P6I!F6HGd z5aOnJKDeMD>%6ToTf&%Da*)@^=j_idUm0^NFP)Imhzs$WO>H>kC_LFSuQJH~O)V#mT)c;2SYoDEC z>+IC^G67vi`sC&3{*Ar24~6}wp0R<@-BI6C?$)UHiGTc3h}YHF=&*6necjQx4ia@^ zd3bPdJzt~8MQnnwEUau!qj@&k*iHVy_zV=LWZb zkLSl2V51M2jA4JmCa6NTy^N5s1*4)hFDYRB=}H;_>CHMeUH)Re@tD&ubp7jfc1#Y54*ft`N7>O1Scc$w-RYhrS zAD_y*wZaa%T9Wumt9la$JD~vy^8_=cU`KXi{KMz65eqLH`>af^fCr1>ETvUGLAx2x zKN=51?tqfatmOslkoplT)6Lzfk_tz`_D<=vAI*)o+AlSLva9ttO<8G1FGKcU{7aTUtiDe3;IMSxcL(u$@B1Q$g8!a&NxSHELWNY% zP&bu6!X_o-Qk`=K%F`n8r62u*7QB|ABRgH|cB>ZM4WGvZIKtSEUDbecH?FM~4bGWu zCY1)BMj=J?XE0E=bEtNHd%rjo(kFVe?cSKi5T`I? zX|2*j0NZ(EhZ4HEoiSS{bfZ{YkpbpEA5hH@%ETZZtaQ;M96c}K#M{{XZrbzS=A6$X zo#Bp@p>}*irQh92aT*E@WM;)%-JJ7JiEhPpYn8fdqUW(b3lz3`4j@A3W@}0jhdw z^e^R`>;ZF_5K|>9aR7RGY{j~rpZObUX}O`GK3yq%OaE#>%~tXsi7m^HxIc2{P{GjP z!#i9Y9gFP8Z=$J1>3LTlxunEI3sFZ|O+yncbB?0dy(%(rz zK22}1AzM%71ia#kGT%up_U&7-bU*K!>&-~9KqFh0HleGvWazzv->ag-Rn8N5_&IBt zvq!KxHZZW9RL6BhD54A7Ht0u?2&04^Mrdyj-p!7l4)ukLx_WM&g}lIB@#ddEg~^fD zj4{C&ho*bx#{1#TJTUNRPAR#Znr;7ouf~Qnr=0NP>(xML6ff7C;<1TAeyXl_QnScL z#b=)s<3H~mkmU7~JE}A^%T^lel&Uz5|4WR$gyjm$IEubUKl+lP5swoNXb~FZb?<*~ znu!$-SeQvi5M+Re{Do#~nIb&*;U8OzB=@LkUD|R=X7DODAcmQfjYPln9$ZaR5+62k^ydi%(1tSCIklCly%F4;w2T%^fb0R`hVR4Oq!)D7p-;&5W&=e`hWmet(+{mjjDwBm2VO)qGIAtRp?>*J~_4x%J>d^5YK`5EAAgc|zGyTIF*^QIPsvwWvjcTqo!s_8zTQHy3| zmk)LWsA{#yn3Lw}?l$NcL62+B?_O&s%BLm`x?CP7@1@!9jBVUnRbTMB42mBnMs-rH z>Qeop?X7fJvIQTWIn`FUkYCsw;KV!U=73x<@P7>NukZ>sWJ!bU&c{ovFDU_)$`eDr zFd$oOV1@vkgszCpUEJy}*W#x-471Q)nTcQ7tqIRz>op@=cN%Ro+b__F1|r$Ixk9!h^9wTe5>4t5 zSkJ^H&vwVy%4}LURIX2y^R}oDGRed~eC```QF3rR8(608J#WogLE=H5R&&N#(B7KfYOpL`F(ltEfHi^PMncw;#CLbeQ%*~8lf z#J7*9P2~j^5tbb%KJ>g@CVeSTm>k4DlxZZFK&P?px5-7F$`^@vJh~!TC=Q( zn~Jla*qqeK3CXN%9cBs!DOOJV+bl{};0w&!%0ozp3mxa6&+N4tYdYUEmF`aoP_|Fh zIcoeO(v>rtV)@`ybV*8Q9Vj&UK;R2K*xT@gCe8nCSWa1~RdUyN98EqVof(|Ilpc$> zD$c$bZcv1ih63R$JdQ7Yg5B#@FVu}0?3$yJG0mRsZ8GKOlm-Ry$2e%eW#COt zL<5l07ba3U8J(XjLSu89`y2<~pZxw*UU|s}mXyQ7p#MnN_6mZ;)x}_FVAFBiqrV9z-jL2VvfklXCAA+pmVA+PO_o;G{I~jmBJITT%Lk*L?ff*9SVEb ze zoxZo{$J{FY+A3-9Ds8R(eeZgocU`=Q-6k&0-sR-9zj_TwNg=-LJO&!s8dOY~6U36k zN1CD&j&%y8~|s z3-Pf5$ki6O@o?vlU985fjE(gz9gXe(R;^hwGtH?l5Z>r<<1*>EZ*8skfiYaqYlhXC zGqXAb;v0V*t7e>Ku!`R(kn@^gM*O4GGv9J{wElerByHE$Bp@uMo~}5V=o*iBKYJw5 z^ci)-eJdqz!0x1~aX;KtJzxl_dEL-n|DHy|gwMh3MiHY3 zqVA5g%h1fsN?UEI+5sjQE(u94cWjR)Jfq6}2ebdLNIZIky(#j4I^H5squXTqmq3oJ zVlv_${H%(FK%Hk9Muh>Ihq(09yj=AqDLIBfx#55HbuH>DXX^z?7Epu~pis}dh@XV_ z!pq}(*-N)oIKC2{)04cHps<|q6h)9s=i#~n`sgGiY2653!a%U80KnZ|tt_2o#?vs3J&ChYw zEx@!YWvbVe?|~(S)6zLl^ada}+*w%a{XhoQiN=`sM$Qdl>hlPc2KlJ4xezwiUYP;B z;OVXQnpQcwbH%YFTlxva&kpQV z=U9Ta-v@+A#lo|zCr#*Sgb5QoR0KO!F-)}j9Up=h8eL76j*|6m;K+8&Q~)|ZSQSt{ zNZ=z=1pVM^b-9|e&8idUe>|NLd5MVok*d#a_s-EU29FY1JaL8Z^?2kTU6W?FX%MGK3$1x@4znDaiY{*)b~b<@cUXmf z3nhOf!{cdaJ_15EZt@|&RpVwOofH>lD#PUqG(5ryIxy+9qTjfR>*}b=p2ia?Oi4Qx zBo%at&vpOjzB_MDA(G?0;Z-aXYE%F_%RY6X`uoRX@=&aIs-#kfebXxF>0$V3*!Xw~ z9=b_pfVP|X4dv))QD}b$syQpb?2IbBD4S%Hw3Gzd!6)?H4zdJw56GPANWwBBLPC{uA0r=(^QhG(5u zRN3jKYi8h|2s^regjpBjCVTs3V`O4`H|nH3aE7^%ue4TQW+zk&$}Bgd4Qkvv%-rDy zvvVw8!Xe(rW_2|3@V9)-U92_R4e6Otj_=7V0*QfuO^^L;u$!k%j}Lo4pQaPbiZU|= zt}1nw&5QIrU@&36CFML*OAutyydm~nTs77Dw&+yMHTzwCJY7wzl5U_E|Juot$p*G| zTSJyEV_`pd@|fe_q%d^mOXu|}4D8m^Td|xysM0;V>m{%#t^rbXza)-;)zo!Sz@=@E z)7K)HgA%DPET^YZ1Ht}UF%fUa4J+sEpMTKH$Mn2C=`}#c-qsq{SlQH{UO+D=& zjq5*U)ydc-^S{^w|BR>_r{{g5l3>^1fOhnl@`2+~>3!P&1aSqd4*wI5BJk;$p@}8G zVaA9;1Uo;^91$6+0Ed}+{yUCBY;r>x)6QlzUpHto?KmRde`eWQ!Dqtg^6r+?YBxVv zX*G@#$|0nH;)>5ajge70lBdA$%f1}gi2!*BZ*b>j)*eq6{J}qH7J$(p(2^63rh}<_ zv7d3{+v!TJdQ~MC*UApo4q4N=#!D3y6`WfZ4>ENOVeDOemYz8WVf@be;^Af-)l5&% ztJO)`RTc~C{J}VPQWd&9$*E;@WdMk4LEUtGQj&;>M8MPhccE!jhJ$5DqWu_eyaOD(E1IRcH9OmbV&EGZUn$<1kIDZq@fspU{uf z+PeCBwPf6ZqQVBnL@OI;OKq<2T~jL*o~PJ6gn8Kwy&UYaw;^HHy=9tE-N&OZBl5); z#T+(85dRh5EC3_=TH?Ox!NLk$<0m0r$0O#&k3o-gN~XgQMpxf|_e-@ndEcyoi@VBh zjsNdVReKcD<<*dcTQc62nJ_}uqlT0DS0XdS`;fPpth%=zZp&-wedZcyjby&*p2XUo z*0OT}22RT~MO$)}MgNlmN{q-Jh4Q{rmAh!~x|_2U5~5vZ7j-~X`d8{XP85j)tTM`f zasHzncBycI=fC2BzR8trYig>%PySB^T1IY=KzRj4Pqn_V!TBSU4k!0wRXZ6kewOdf zPvK9cri`BOi_40g6`qik&=nU3_#$$qa(jqPE?7GSl;AdmLqw-~m zW^km48I;MUzB7s&qa6FXl*%Gs_HU#VMf^}s#e_Wroi$-W{(G&=0DIRdtEPEWpI;)W zyrwIz%dr;Y9!Rhj^O-~DmMfJpB8^_qN29NmO`Pr0vSo+I(~q(}JI2Pdh1M11@v|x}9%Tx=$ATnz&W5Qx`H>@{9?NdjpOB$IvdW|>egX866 znH$<#*;*k8R$^kWE5eR`dM*>0Q*$7M6zI4vpRH}%(eVfH-RYQ3Xz15H0-!a=kn8pT=C>8M&>b#*=AL85j%Jpi!jVSmE0*&H9|Cy+F#opKH%Hd62b@J(kksgw^Z&HiU2k|HzGV3c z*}K4C<`pEsZs?`9c;4*qbhB4A)Ubo0b@w>5E>hO&!P<}t4Qc0DX%`hZYH7| zF$Sa$Z;ME{JTvQqz;z(N05e1v-*dhDG?Avt;Wg?>-4V_NL?QP1i&o7ma&*Ay$YP%x zXab93m<*dPhCWu(t+(<>ozQS%dhp90bP329HJBOEmhmSHC!xi?Fg9=B?RX`iT8+pU zOP^8(7g=cnd*>#5rTi`n#ni$c+pA$Ar1 z605Q79&Sxd^Ysavr=$Qp4 zG>~x{rxy%4|JvoysMD|wb{+ey#a3Q#$&>#9%&R{yu~IkvluY)`!Gag^f@QWKgM-Ma z)~2RkLC~!tqLT{SDfAXh`ww}>yQtQ>YP{(@KM#fJUn-A+hT-;hsf7h^Fq!H1VB~R25T3t#~ zWGh`N+0of>u84*~gih!N!LAB+b)~9y#v0Nms2H~%qP=Cab%fAarpb4!&Tb$z(Ypg6 z(8op<@=NwbCnjtFee2wtZ;?OP?~WflpjZ5I<#7&{&Yk00&*mT^_HU;vpQ}9slQkjg zdBatXqNJEB$fuC^+B?l$CH0}#Cic;s;C+_9@L?b?N$D+B{X>dTG{Db0 z6$f|G^xX4yV}mhQjQ-)+%8DWcXOVL$g&Ya@z;uT!%kia<;4siA^de@b%S#@J}{H@OOD(Yeh2^G`Cx3Ic;YIT(upYXVmX@z@F)OKRS-o5V6zq>u& zkwf520)YZdLRw8?(Wy#KGRkrJC?h?_QkjGJ6*8RffxjPUNMTHP5LIi$RmP@)=_F_HL( zr>re+B9cN7DT-ojIKly%N%C{JfS2~usjub*O=OJ-xXc&#-+?$oBjw6UeV+m-6Spfz z{ZA%NO>nOtP#VjTBtc1c($_%k*2mDZ>+}*C>qr6OqAUI#cPTSsQ6^DeieQL1EMWfL zsnA%pJU0JdSe!gZY)DPvFGcfzPzK@uJ1p)u8f&`nb@y~1H({C6$u-{VJZ|xq>;oc# zO7Mnqo3{zAN-T87W_nX=48^*u_wu!PEkU{f=;E#^xZ0pt?HvGmugS;U$HuA#BZ-hO zw*P^Oi}HdxdaVM@_k-YXa}UDbw$*LhPv&>2rA1%Ol>hA% zbEQ>LXM%h_r!iY4VmcM3;q~p!zn7INA|_reSp)+_J0EBu@fgnou^tm0beXj()OE1>>?b~9i((h9Dv(N*9vfh{M5Ix_bdff%>k6%|Ah22{wTE;TD0|9|> z+dgit1smsHv2URBdv2|;Da#)k8ycajzRTa|HT3L2z$>XPooPQYxb2u7NJhhUi!E|2 zF%lxNV;_ic)kTYi4PN*`^R^^eT{0sG##C9t#ls~L-LI033QjYguaf^4WH1S{lnb{C76B9!5 zJN#LW7=wQX$o{{Ai}P|d&6cfsC4ptfe}CkqQ*K4QXgc)CaM7eLC0Na3!=%q=R~s)x z%%O;U7KfT|SOfx*notvVa_o##`1yGvXCuEXq@SB92h3!GY+M`~TEKMyA5#No{IWTk zAtgHwZo;u4)(=HG;ws65_4CQlR}xcty72Q=&Wf<}OsKDu`b)p-X2ZnG6~Fq1yQ7m$ z0HjgXx*}=A^6~YR6X5=|JNI_}T*YL^QI^T$W@6)=|E4ogco_QO@<_eP8$3`{$;1uN zH#OLKdn6NHFEU-4<<=_hh^!Ivb1>RcvaxsG2MxruozH}>zsA|l)v8!=&z$6wc2Mv* z2!!cDisv@xjka=pF4nQS=!;sZb&vVEjRcn^;a)I>?;YO8S9)W~u9+r?k{&!Doab(S zf{pHT&(EQ5UD$Lih+_X2NK$M5`%^f)%(v9fQ7bG8Wy;TgkFsf`Hf?oU)&|6ipNxqu1U%Z~F+Rtm?yDtm3aHi=vV7(Cxp3N3t<-XbEFq2y-{)no5fh&hk&!GF+Z7O2EM0LEGNxpB zZ11J)MSlT2P_(<+9*vG#((%tMT6g&RTDbChF6=`O_|$%`Wj6@3vPyHllc`W!YB8I| zT7T(Y9v(faxZMM8Y_4mafn5_@49;8F{}9W|?-P**Y1su)A$G^MRz1$YySz3lrJhi! z2Od@91zk*^tb56a={+mhPqe(6>0XlhH2ayVJ&*2rl-qfdwNtx;>+bIgbdod=N1sYB zTC&iD9Q3@bds`i)3ShZO(cd1j>Zu2;gr9;BAa(FCmalLoNw;CU4m6-Vq3ObDZ3Xz_5#F_m;{hGc`frg-Cwr}*i>@4&BF5Y>8xlS_XTK&o2B5GCI zuCPJM5z?wrJyHiR)m*N#V|+(SYC|^pgy6A-k~j!Bze`2=sDQkxxU0S}6PuTn%(%p} z-$kaehtvEaTYQ)tpkn!l{XZ#~Bl}-*fPsZFD?q*Ghixj~mL@mP(@Lz+U`(^|aogE6 zxieS*0G=XGV7qx}WRx2YG;^5`vW#evm8Xl6a7>ky!67bxt$3T_) zqZYErS`TXX-U^ob>FRWTvzS4R?j@Qo#Gf`k&haXl$1BK-3b^&G0ZJK_t(h0%otrlV zjxh?K0pY`veayL5w6vBFtmcMuUa^#wsnWE(bUpXFm!Gzm%t-&VAK6Z@zX{EvbMT7x zOI_?!Et+ZCn%e^q5bZax+uz3LUuy2BiPoj7)aCRriFVggL3}S)nhqQKxfSrPk4Un8G3Af3|IA<)=ggEHtOF51ktj8nt(c0>Q7IX z`*{@<2iiT7V(Bd^R-oR8Vn1^~Oln%WRYHJx_)#5Ptu$)lRJ2#oW~|>z$4;YO87w73 zmB(#J!`#o;841i4M*;*S)sYtWYSziL*?oSE#tn3$Uvrop(YlD{+HexItntJ zUHgJD?r_zA*Gk>^az+#~%b%{eP5%r>q|Rr5pXH-M7%k`Pp5*_JH1?D^D&A;-g`(QL zPA9RCgwj{ux2{^2Gft#0Z!M+lMOHPWMgLee7dfnc zdh%7U;|OFacV8zNxEFYM`TY3ReWG_W^RjC;R7&y*159*O=E*1w@4xdrU<^bA5T;es zw|@;WrY%5Ku_i6=$rN2yz=0D<0K6G70JPz>?)i+%pc$9 zzynqQj+0n}Bt1Y~lOr%}Td-_15acLH_N8 zt#5K~57nEYv1(*~IW;xtjK2|Xa%X-qibh4b)LEY0vU^fBZ(&A7lT%uA^eQu>LvDt) zZap~==n^;E@2!2G)KB7#a=`OA&^y`_LxAsP)hbW~(`9(E_-zQo#`{80t4EASFdXrI zbM+&@AF$|R7Xah0?G$25K!)}<=66E2h{aXkJHvc0d^Iw)2P%z%q04MM5PxMSD?3j^ zwst`i`=e9*vT4>+)y_&B6b8t|oWX(=`MH4C`BULu|GE(hd-d~JokNHPJFC*hz=_yY0Z(*1V zKkup-5)$VuuuLu2$6G{|+v)jHtNtyyQ#0A7U)gxKrs*K%t;di-*o=gwZfx z_i*vWx&`F$j9VflpMfW9DvfueSz7X!Ps%z$Qt z45h@?{uyCbW=gnDFhg78B#8Nw5D+En+12bQkT8VD{EF`SpK*K4v77&X$Rb;C@W#mD zU65-0bptsgF`6feRpFWUomHpnXX}Afq7i(Ac&r{D5FMqhEr^?2hk87Sf~(%%fS1Qz z-`&!3@fwf0{dK&I#8aLEXLCiPjz!9@nQY?TcMGxPi_IlMm*Mn|gXL=pnyUVQPZSWC-IiO^^e%E_u3&ChQVjK`r&r^z z+b|iy4<+H}!pq5ad)w-5C`ko?$%|heG2x%@FS1F-isdjC`wV#&pEm$p$Cz@A-oXohF0d6r{&(_ zN6D7vFYULTizh{hnAyPhWvb@ShBj?aYoT9K$3PR_t?TN6I|JR1do&L0ECQ(L_njF= znFkbx#}&D;ek`l(1R)fyFP?91WQ0|!1{20DRT!^dIntodL<|sc{rs)J)P^$))cmkQ z7M;$TaHzo9;|sNn+0WA-ozbE>0wXwJ|iO6Tc2HJt<{E zqbI_7EW(>jL!Fo%sBWan5q+yc+4pBz_o1|gv#lWhmqQHfQsjRbKn2aI_`j6AX_B&G z3#$)0rZ6nq(@WI^YA+A2p?vTmn?Kp={;juxe2)%=Ju{E0)Ch0uV|h9bQ4~pt{b%KW z5ZPEX`QCvawPMf7NC=8m1OOsc85tHLE${ttZd)~wFv|-?zk+~qPL};rPjC0aZRg?f z>QANXIt{05{Jb~4((G^NZo0a_4Oss+tiZQzZaMGM^}M$pyz>;T~N8Sz=y>w&_W~P65wY@z#;gkWAonEQnWB2CJ zOyCI`1|Y~E&TIL+t@aYqQeQ}2)w3}icAWURdPy(I{q zE|Er=6r8?guFpNV0%Jo<_%HQeo$p~R>{=ejeOq`Nhk80?u>P1lLWHZn@xrXlO?9~A zOksUE#oW0|ZC9zMWQ5B)PG&&|(NVF1&1M}ZU&>WF@3*eB_c}A@*Gu%h8SoDW>SN2S zK#v8(YSQI)?pS&I8#O@9`(+!4U45_f1Yxd^vzC8BpVj8+u1Dq~)#(9~|M*8;gyZcs z8JHV87i|nW6XD~FztZ<#UkEmY&LIa;+}v)pxmlAeZwS>@39=GebG7v)9xtKz^aP6Z z!?qhBNuk%>pI_PuEvKfUB0O~`f`&(}HxipHUus?8d{_j(*RTV^cqZ;e=GqsobWFjd-vK1V(J?b8Ixnw)0F};!`xoDveod1)+vNEtw^35{= z!ha*K)zNtpWcsI6`TLiMU#2qbEL;TyjHn2%-*}8^?SyRyd8Ffy$cHTcnpdwPgHxsJ zjWulM?7vYhJ9U;v)>{ucvy zKFXOb>1JH}jSP9?F}2U5R@kLL@hDnx6C)#fq;7h3^-68c{!z_6q|N6>MT~{{z-Ydh z=-XKErSHRNQxj+`0BB`j> zo|8e!bssB(tf;xMh$?m?0Oe!pq_b~s=OiT&wqIr+7CX&^oRwdyLhobNJAoiX_C^8+Gd8_Y_)glw|4~_)91JAhmvl2)m%uhz&y`>ok7SJF!=eG>S1?Ows;A zQzZ*s2VivU1upM93GjEBa_?gZdH#Oa2Vw^q!7^ zi51#RxC#BuE<=@>kAClpb?%`Qp!|6NpN}!e54+so7C&(?6vysH84?+w#xbj~)gQKA zHr#{LG^)9+-j;AeF)e|Y(w-hTmeXMGE(f=c-tw#W^Y=s1C#C$j!JVwM4`y9cAtuZ4^0f1L|o=3#999~0@*W}=$InsKF=;-=`#PUbS9<# zh`v5bK5qIW7VaQH!9$+edwB9+G(jTYjbxxg2eeV$luyL~a$$G{RisVEV-id<*yU_Iq z$o^ATCw_Xd+@N4M5$wjyG&W&Z2mEo+>tGJrw^d&SM$Z%44%ftxknlK~)5LQg(9cN= zH)+@`I$`wptzke?8laEgOAarL{cEBC@y9AyZ^31OyYz%;4%ntz*3$7X7!WEa z4-*_X1IKRUQ@`WMA5J_{6BW0$eGFWxf90PoH2Cuc#$Phe1=9TyFmxMh64@}|#OIdY zeh)J9lR?6ERA2}KSE8(_vI$NJ{B7XnI?Y$E)8@ogE5A;jw$duJ!5UOJLbpk?woVg+ z8}Dk`@BLQxE3Y1I#A;vb+;pBBbpg$fCBlazEvH@oJ8DlKKi(zM*)vS z;S_(?bI*0Hi43?!SfYs^y4(*~+UFsv>r*|Mo>OTOO=X0*p?t5Epi?!PC>CsJVC6I| zVl=NCeEIDGarE?w%x75SKRU~Bwi&2Y8G9_Kb2CZh_dX3NZF8y~nZH`7u~?`dy5V8m zrJ?wWG%B}brL`;Vw{Z`~bK2wko_4YQxQ{2)qDVIwIub8K7;|c6lQi^pQv_F~`;D7~ zW`8wyP5t@CC=mkt4j`J{fzdB@*v&R%M%(m+(|7{IVwcvSol>H*TU{th`V%n<6)p@$ z*q!qlM0QYBmDGvh)bZwdSrAzw883szpXFWb_*QL-*~BJ0 zc)_28U7n!(ny-WPl2#^q9_he^@S)NFvOcIiTBO$~oY+7MoI8lBFbcDrnyE;HQ6SQL zHQ9#5@U2%&$GM3u6zPENTIUWU!W|JG=)$V~RWUwabgoJ9(pP~f3(06wx_8GZ&ln#f zdHqCb7TfFSN1*hPj{qp3;aUS^PoSmR`I(goh^wV5;mnK95O-PfEUI~5zi3PF#46Ei zv~4yN*YEgVi8r~AkT)Lygw73^0vUTM>chm*m>J-+{zS6j)hA`}p*5ps-p`Tzh#q%G z@_tztXV->XM^S}|?5%ZR;k|wwGnc*+Q<=yP8S~lir4ST(p4v3x^#SoXzW`Hmp{x=g zc;)D>Dk9x5^1bEaa!$BvZDlQCAgJ(H; zPOb6N%z&e6ApkxRt#;Oi?=={NqF&G4kij`JW;&$bv7~oHh0?94@8Yt;GP<>76udQb zcD(5F9!i+F;R5uH8_hM73<#O%H>~jURfbJ#a{{NVdF`^aG<2A`3F~(nN6N-C!b#;%<>gT7AUFc_7;B!6H?syz&t$?6~g1O2%rDXOdTng>v z3qO0RY0B8NMB%g$n=3Wi+ z?%_m--%9=WlEaVo+{31<=cY>bZ$r&sfNzlutGp9*k^P=xxAzqTT$;L;=tb)BQX>4C zyJD^&n#TB7b11_(0y0cpk2I+?Rlzyv8codD1V8B7$AZSEpdw_?#`6`Qj~%+6kq3JsPGe!D_K|Sgx_IymShJ5y51- zX*~)!0?DXOj z!&som@&Q$@kWu0%K4uW0fP=igICz(eoM7&8(H|hz3lPMMCz78{1GSKwQ3nXr) z3rXaA87w-O5TZgG*KO>@(5!cwhUf?>^blYp%9B&I2nDCx!;E^iZ^;0BEnDIuPD%L&kf>ChphHX}I_99-prRf2^ zF0U;?N$+=zO15&qP!9K8h<7FS%J%A!qjFQZtU=fFmaSlRq;SdaE%Zywx*uHK8Pswu zPt5N!AU)BZKJt|UPuD{h%k*v$gz$2Uajo~N*sjej8F|+6aQYP2<~q9Gigq8x2e=sa zIEjULn}e(quFlLzD+M0EGR7l#@6|J~pc!Ja2{xQ}RynVMU_%m$wOoRL8?@$;wH zfc0;ACipCzwhh3GF*7GUh_6AObpqR&@be=$RIbk9k20=I3@_lK4X@^HfjeRajZMW_ z_)YvVyybX`Thk+l!2bv?)D)d`oe|AV>KN~>RNwZLh%r6wJS)T5K1r&{w%j&Uo#Mw( zq6td2Pxe;#&tQ~AMw^tz2u}(`<(-@0g`t4UF;wf>jn~>08a_BcK|s!2qRCuQ8jhpQ z9O|qc-|lwne0D~ME%a0Xd)lTN>qIMK?N`ZXNI+WFdwe@1aWH)x3e7Sq@Q@4|+Va!3 zehcU-q0tYop&K>OQ>8S%WFGqo0ghgI^AdOz)=S;(O)aFzKqvdGA(Ktzmdw2x;!)Kl zt2NflPJB;IbbUw}MyioSlxrFLbSth+L&u~);9|xSODYZ5@{4NbL%*cm`*-inus-z< z|J?hsMKYHmatID96QL5o=-(Th{43GjxA@VdNCZ1a5HY~%gs*W@WSSUDAgPP?N0Pn>9$GgvNn3gISdPP6?8{%P%#QN@G1#=Pje+Yhe)OU!J zxIuMB^$6uO@0Iw@iU`{&+Cv%YzjOQU)cW-5=ek3ky6+f{WA?|n?4v>+*XxRNA6g}j zV5J|l3{^{!BQZN){b+p_hT?XlBqRDzb7plkgVeLA7MKD^+WnKWvAVG0F`c~WTuyJQ z#hznH2{pB<+Ha1hiR>!$8drfQZl=(^c!ap^FTRTX;4E(+{U`fMj%gjv7N!#Ijg*PE zliH2P?H4WKwN*={V|!(>Zx=#qN#NF}`L9FH#Lew{Ow23S zkrgVbfXM^hM*I7trT`@-HlZ$3Ys4@E(+D^zvd5dc!?PhPhLQacE2VO6B{4GaooTKf$z$`Dn==YY@^C(zs47Wc%plCG{Nu zRCrnS=DaBnY1ymZx;wW9YOq4avhKZXuR*Fi^cy2&sn+0?p1F@)0Ms59SswQ1RBP7t zX~U}aB({vBuCb-dscM5x0*k zsi@G(`GU>GPGM>1tiLjB%ShRh+eTd&-*Z9|NnQoJf^ivE6DzX&T~?kmgbQb9^heat z_?@Ke;MCn`%fXtanLSMVserC@*xK#hBUL^D2e*Vi+2A#MLdVQ6xg0MFp@E$uyX5wl zoevBmdY{eRbVj(}PipZ9VKt(PY-W6M{{DnjRQ1ps<)4{bL&!lv$8Pv_d`bM9DRl_Z zDK00B$6t-PGb##2ITm#)q*gT8fxgX#FCPO&6deGR_OkG!-xn#jYTf|k54f?I6K!IK zXYwVa)UedVh?OMW!XlgDnDFD3Bh}h>-zh)A-X})b!$6NIIBuF#@4g`oya&1>qZ3Qf zecBo2IQ%_TNyk+s@2s|J)A@7=WaLD_CyRd-4&%}&<;NLLrL043yea=TYqc!$$GeG zkK0o5Sn)Y9ECc2}H1x&~FTd;^bbuFunbTu9^cjMXUAy(S6y{UE&Ah<)&{6Cw8X6ZJ zJb?B>n>!RQV)tGH?En=1;5Xb&6e9lk0$`OjGM-GwZ$J&Swq8sSt=((Adzu@oNaYq< z*=r8`!D;q{P;}<~@PO#|nxpruXInLi3gD=G88hFXK57c~9v{1!py$-GcUZp>WzV#p zA6sCy5Ujo(ZlPu7*cm#m_t5r)OsI0nt=|S8W zD>zM(wNFZu-dav|G2tXGND}k)mQxf>NhWJgL1QBXY<4?(8uUb^$Mv!>1d?WGXG*{I zE_qvpMy%>zww7H|Jh$_geTK-&IPKgao|VX=@)fl5D>(`|yMb?VT=6&nfW~w4>sPlq zsULE*=Vt`acjR3Re@UMclICM%mZIKzd7bRS4$?VNBBwda&vYmHI2NBCY~0IAY+DRoBF9VG zZ}0B$+I~89S9%{ieRcWb%s{j-uH&`mB^O`&H;vKLW__KmC0Kxf4D|FI?U}dLT$zk2 zIrerYgFrMMdtN|tA%r}aE^c^`Aje@|kO>Inlg6ZCecoHo&sp}WL(AG0K71|$%g zF!Ed_9iLB?j!{PZ-8Sb0pkia;@V>n&*pv^QKw{Y4JRmKNPFh{4$`3`p$-_vHLIBB4 zOi|pUbhJKJn4zS(I6783>}#-xZimLexj>GJr~RKwiikdsS{pBw(=m+%p;-ecm?dr1 z?N>Lj1#>1rKz1b(-pbfjQu7DuEf30@JF4%>3NGpeIC0k*2RX{V=11sRI2YXDc8dcm zh6gF^YYq5-z;+^JSj6#wgi%Fqh4SpO$R0K9Z!d%iqJszB}UaXaXfncVr)4#>@sQX|{_)6@X z&%?Q1F!Dj`>nsbW>5J*uuQphj1%o;BsD_xU+hhpdSO-UZ}!^#7F_% zl2aUD8uBi4%JK+{2PXulz{Ox1HleQ%0@+8msJFa7aJY%j#T>8>n>a=Ai1XgZ0MJ#z z)?{Jl+NpCDkF^sj^SJhTHZyZBW-Z%y$)lHw>}j0Z$(2>=^&__sB~n0CiqFlHiQ_G7 zBO$3ipBM%yRi0OC$M9bN_EnPf(PEfI>fgFkhKfaHuW}i}EPn+ZJq>|-Z3}Ov8SY6= z8#m3X*Sx-|l(Arx${AR|LIF|Q+zATNHA)&NRgLtQ2|?2L(9F@bW6a-b5pCd||LN#X z_`R?4=ZvkIN=wk8iEpF0Fht>XCp(cX(8PB76`Zw_p&`o-&7&p8-OUj^ed zj~PgcrnL=5j)7ZN+vKaKmp}-euEey%W+SDM$Kh&1&NC5&9Z?!Kp|LEWN+%LgC=zeS z%KCO#Y`#6zF2~yvZwFl(FDr1wht(F70Sw%NdoHp~*9ex@3>~%~CCHzS-m@6^5LC~P zqMwY5$Cd>EpOiNA;;w@3Hv?=+V~#_%5YNJeM*}~XT#)Xz<~6ggA9sRG;f+JDctnvE zE zrsp6P<;K{*0qMLXeg(%^vsrfC;}Yk$=do6LxnzpW3C}y9+Y? z+rAbz_UN|2)OIF;^)ggY2Xx}DKfLLJE4V5BZl&v0u-xeA!q_%3yf>|I8v0CDkhfzG zX4BLPDa`$3{6$*o%i*dBn;X)!1)z9AE4ivNiQWZ3jzB>A!|drPDfvWeWo}F4XW6>a zf@aIZ@_vq&B#PUm+EE34FUtV>MvM2>-tvCLf>Pz|25-lrH7|*thxI^;-lDb+JtC(S z>I~tsm$m!8>#$zfH_L4bKo5E45m$-P&LJv=@f+!Z`i34f66n;k?+-z>u%}*yKN~3! z6f%RFM9(^-7P0p8d}L+=vUt~!IijP*E){W>M}4fECue+_A8p!i*@O;YoiQ?V)ts`8 znDU!skl{-_SxRtnZ`G#T19X!Q--Nw34UD`!Sh`yD5R=&pxvTp)vpAQeC8o}pSDzqM z*Bq&=yZH=+u5LUo-nr?HSJ)C5!HpXg9q+)c?g&@zoRMghEvo{^p##1y2G35GWrs$+ zd%a&{*RER3m+J6-SlHxk&k}BBAnGXInpY3{=9~=dkOz;UEo$mF7SOJ+6jxz zEG^J%STpTusDo}Trc0vKeB4&PB&LS@Ek8xPKKZPFHu$nTeu@^Y70LP!WwPta3hC?b zRm1K4HS&0^*3)Z!*pXYDzm0vL%(QDjzgSDYs6lIG!`V;l_avO#% z$${XC2!0mU`%JxuJy1h?i#J5#N82{7v#&vq!z$eK05pJ`_I8HLpy*89BMeTCPF;%K>-t`vYY!km%k!j~glNT`Ieb7F??$Dym?q~rVZZU*GYniv#VgwAHz4gs5wzcGM z+J?oE9`awdqzOat0Qw7BawFAj2F_pNe?G@>#Evh5z6_bI1_*JOS88c4n_DMp!VRH8 zzuBUj&G?LWS%3v>r!hJ;I3p-GQ@?aYPy9R)y#nSXaoYU0Rq3Y-Il?MaCDL+2(tNf6)V8kB?019f?!DmnUUFWesaH|Ke;OSJ3QgkZH`O?#$O#3+xxx zUHx2(hL>q?%FWvv8&3HKJNDIENckD5kT6h>yA@Mp7^J9ag<#lJ*v|2yGd~)sxX}UY z`WXGP3Im{Ny1lEz`=f7JGG&(gsEpn+O)*KV!ZOLI4=wwKmuvXSvCz5kW6w7sDq> zp~VH_=VG(Ma=Q*Mp3Sm+&XGC>ro;SAhjZOiaHqxUkjnU*kU8VA?G&O1aJ(*C`SKf* zLt)wi2UtXJTo&dzQqnUrTCrJzwjriVa?c7{_P&B}A$1=_pCaBPcqa#?getaBitlS0 zknWhgm!~(+wo?nsOr*BN(~K>%MoreFCXb6M?PjadA%a0L#1 zBNj^pOY2YLKiq<^86_$&0u6mAeSP8VM20zU3j#3c$1}zaa@Wgxdv0-)JD1-68v65u zTK~q%Zm9TFIQ4lT@r$^gULSmIGkZiUKC9m+T1V1CK0HaV!`2K+p8K+cwr*hmf}iJ*5t7CQTU;L*6u1>eo*RJ{t*&>=EqKXhW+C@7 zsK#uxEV2s8GpnnmI*orhI_koS!i$g!v{3K}7jQchg`br*(;A3WhY%b7=GQzz1f7T$ zu+-Bl=GNw12L4BHUl|e3px5YxMNsZ78Qw@dy$SLs{4E^X$sFbV&%`KE0; zX7lxo@aF{0gsRT-rbe&u<~cbm`2 zRQwlLlkEo_768LcVNd2KTBbKa^BshOr?M%EkVH!y4rguSJV>Cztdz^JEL`?+=b>(V z&vwj@ zhvcEJsMg@Lcd-;Jw1VubcC@X;z+LY&^aH!wYE*|-f5edk{gbJ#+$x+zc2M+zXqFN^ zxyYM_d@8rp0tjJaUK69;osdKjXhz`_>&4$ai0M$#Fsgxm*fjCjLVxX{ z_+v=J{KlYwpgJgIL*s6T#H*N-3Bo&T zkFOYrSC~c0S=}^5>;cXd($-q)6h0VoX@RDPNy7K^gwwBPCQs9JwTx>{Y zr|;FfZY}#JsoDqP2|WlUwT!Y9UMeQI8)LZ&Tk;6}HhmMS7KTjVjhwWIjN=|q?DpYV z?u2NwD(IM_clo+5`#2U{_jxUH94%B?IJ2awR&RA9y?kEAKq!ib@nSH6uCq zDh?}=_-bki(ddC(s&JPm1h^ygSOiM3+VNH2x*|F|noF$*7897iYx)$~v3y3y4hl1fN5qK5R8YxS*cVPy6r!J*nD}#< zUjT8cKNagkkE*tV7#Su;BU+({+UYN#(?~DS)B?dtU`$+qE7*3yj>#O{e@`<@CxEp> zRl8pY<+L!9>cb-qKKFy^d%E2lsR{I<V!E*y5OTF)RNXUDT@W@(s-*je*GsEpo$9R>k=nu-$5YdKq|Y zMG3w9)pEN%)5k~ceXDCTlZ)7k%>h1Px;d8M_wqw;-?{=IbHjN!pvan7g9{ZH+|W}oApa(?dvV6f%HTXJNK;paf{ z)`zm*w~5$bwA&Le53?>TN{_$;?#UR?2H6u?L+f6RO{Pa#_JNRngn(uEw!5O|!YW$L zg-<@#*EvvmucIe#(}%IK6VkJ_Jf~pYiPX6E@(_3 zFK|OFO+0?cJ(QC*AX*Uh^^ilzgejB#+h>v$#k^GylWI z)1-vD-ViMT_f`%x+=yS$tw{AVNa6B($F;)QC3wUbh|M9A)zKXh^on~{P8xwByMQhO z7!Yx>^rK>wxyrzghKQpIiv%tYCFH}!Crh3!^!we!GsJ{6EU>m#iLV>riXzbB)pnFh zQM;+b#r2u+R7}wpKr3v|uMe@@r-6%xKy7xdd@N{yHW67=<9$pb=~qOu>of zN%u3C(r;sGuIH(uarB0;6-hTJBb#nGTeq;7+e|o5Mse7k3 z`9-Ty$}x`(d|-R5*IVCV1)oQ(T1^YZphBC_!7vVlua{_h-@l$NZftnIyw6hL*Dy6M zd&Y2Lxq&TwfU|W}NoBh~B=<1W!=m0)4A(47qQOfSqUZ1D-jvET>hL>! z--pHbFHgTF1a!3KJay4o)cl&UV$pFwfY^LKQJd&|ZrN=DYDMVY4<0LeU(dF`Jd)`jB#tZODA*=g%xkSnXzR)>o*cYR{Pw-lf6k$;!rFY!Rj*hr z+RpHO9gjSm#QWF=hJ+8xXE%NFmj2PXPtlZpxd`cK&E-T;!6z?KsW^>XroMeX)N!ff zr1(|zoB;z!E}J$>&{!{+V~}lBst2Gh3Xs6{dzx)e6!^?lkObx%_7V2M&F+2zM-!h^ zh7K}59$B3k&mZz3GP8J;^L zGl_x_nK+mhtjCdIm~qtE$|FXZ^y7Qcu5^iV+Rpah5V zyTZNcl%_&jsMJ>fsQm(K%x#BA(5!^#PMs9%U4&#FaPZ*QfXq?O-CM~|B;LEGm=#80 z@DcggUg@EAbTbSeX)&(10WY{EC8&EMv;j8B%1r^3UihvCnNm5Fum)msWC!4}jO8kr zqwI@p{e?*(#*)9>QvS`;*5BaAfP_Q8$Fb~0coGsXcH;m$rp+ONUR*m>?yNydTSpWy z;Jyrs-rTaxbI@x%DXvXj%=F)t^e0}+BYQ=1JX|cUc`Y4H?N0Wd&lbksx$5f{t@;hN z)wV`uEH$=zH*u>LT2I%Djj8mO57jJuzeeusKR0BPU48D<7B`>biPu7cZBo~hSr=KM zOJz2Q&{Dqxgy^T8!_NztkNs=UZN{onB8=Rom{d!V000H`U;K}Ex*Qb){t&*EIAv?3 zjFAl2*@FA3W))KW{49$ct~JfIDV(m1a2Wfqn0S>0S;`P_vxW>GoYg9YwzlTxY$uzq zD{7th`~1sGKkD!nU2q2rlV;fIyEfm1Uv9I_BoeXVCs;Q+rnFXvGFo$@Y~`XB5U9Y% zowrLbizl>;l2*WpLS$uTy?2vSQx2-U_n3j}8un01@2tNoV*$D(W@~(<8hl_Y$c_(P z@k=Xz<5ab4m#ECnmnl~CtbjiTcX*xd;Uyb}&i7Z(%sSmM_cih6s{sI0{2WQOG=uhm zmMc4D*BHLPUg-H(5p@H=0ig#cp^vGX&1t&YlfNsazXzMQxZLqGh`*-?o zBLz|@@}kQQweu!TCF1t`gW7>I$RuV$)q(LO5FbC{?LOb;|#cshKRuFi5%9w0Ql`VVBqQIcgT*=nLMf3F^ zwZuJTO2Q;jB{5%Ml>Z1Hue?QY8?;$6emp?LEJitpI%JG%1ZXga8G^Z3AOoB~BK-)j z=!iu-kA?oE9-eRRlXgN=RIvu$p9dI427)Swey49=c+kh~m5IjZ;B|b2a4gj4^8Bs7 zZll5m96pE{*VVKy{I+R4S&gw?y)QdmDN1f&a;MIe#dvXi&u^ZwYp^9$#;u*-y)U2pC}7?}D@=NA z*r*DVqv4=glI2WqzK%*2I&v;LZ#+#S=)87svj3{Mu2K0`NlaDq>ppVQ+wx#;_t>kZ zwQOC1Dk~&>(~sJh^!;kfYBxW&;{9%aha2OTR?`c8lDDnOVYBpRO-9&W78LW9XHVX# zag<#~=c$|D=dfH?T~pVx-fGo3Q1d9M$JJK`exeAUi^2$rNp%9BCG<{yrX!x`j{C(8i?%0^%@wh9ZisMhrX?Ql zHm}3&m7E<~t4*&Jj|o3j_ShSZ#% z9pt)XZV_Kf&R&)s$rC$U_UkMPG!9jVsN7lP7x8ZBqY%Y#uOHW9{QI4lW}?DyXf{zt z?PWY#@uL}JKJ(Je_{7>y@yDZ_OSm2|p@%G6=hZNhS_wgP1@xlW;XEJBSoY{|CJ`Lz zf{4H&R-zG43AeC+|I8o6e@E*^mb302=k3(~&=&IM-M%M2k~*{}-rgFA-LWdV;{g03 ziSg7HIyxq6D37w#F?-^@4n?>XDZy3I;}t%|dQ>hH<*EIG?1I`lOSdQEUSxFI0rSXat23}o&j>R*r`HGv3jabYT3icMJ-8x%3+LtJRI zKdr3nvm11X!8-0N1ww4T4r`fX0w5Wgf>OhEpm}94Th^=UCvhWNCs&k`iQ+u z%H{?^_%T06S}s$Ysg%^)FIF5r*$`KAVInJ{ zWle9UY7jnOY~f^Owny+{tONN?wgsZ)E;D)Do?3NZd@Co}2L_dvWwZ)oO`Ka>I_x~f zO}m0>vTlICM4ZZc8D61oKe5mD(m_@xVGtXny1rgPzrp`%%`-wQ&8d8WRScDSLw~ z2*cFnS$669FB{kg?qgKj69)I=-`A;|Y?_n@!T?wy@*>;t!eC!V)gy1li2*_o42F%A zsmA}3&Q1RV9ORDR5@(E#xi0fl?%?T}&G*}V5tU7VRy`E!e-*U$B90QIM~a<{PS8J^ zyZ&2Uozzs-A81Tb&MN$qiHYv%7z&ZIJOQ{Rc}Y?wwZiq=FTKd~lw1O35gu}%6kKzf zRKjFO_22Qr&^fAsVo2K3MX4AO@%HE;NF-rXDWC`4GpP?!wfrD-R0Qeulb6b zh&Cm1qJi#5AB&3)3OMPVHRN7~Xjp-P8J`g%<)hBs_s=;S72renBhA2@L7Yj~(A8woW$A z_=wU8P(XMe;CjhCRAJnt;%q_Dm!RsB zBFcUUy-NZ=#ijL$%k;LlM1oA;TR3yGfy8~*8-mY~m-Wf!M8oOP0COSVY)!7YEAR>> zk{|&-9N6?VecFWI~Z(oTcM`wv)g}&-%gv)3@{-$dk3-BB0_s68)C|x zJ4A=M7|TkLwgl)QGOVCc76&UEUFfcNP{WNr?cH%#bz+yowKYg~Jk8Jf-j8C>Q7uLOLtp^(Z5W*`{LmQViCRG;Vw!}$ z#iW;Z(+~vpt`oZZ&7;^lOevvH9vhJ-R@*} zrZgEofgvL0=iuYx`HX;l%qYN_C$ym$2Cv%hUb>SqByKkwPk;%idxb8XX ztChdULE*}Ap0t_9-nyQ)2Yrmsy39YK+R^$)_A1+-g(}+gpUks-xC`f;^&MB6*=$#B z9^&P_54Pof*pej`%6b{1y2HbVK_RNLI{(x*#ZMrP?)ey{P4!&OZHs?My52Q68yMxf z(W`9wFSMEc_AvD`4=@&_lXg_MQ18lvt#uZnq0ICL^#xlPr`MbQ3CyqKf1g|2@ID<+ z*_}Fa3#wIRJ4~$$eZ=zq%Fbl7QB}-t_I#8R?#Wb1Z~Ae`KdId&wVt-CSglzBTnQLB zcrmu;FjBQX0*q+4V=wK1eux;MB?f~9l>wE>*ES2mRN#Pu_@I@9EAMpT9-hCo?R*}Q z1_%gq;{)`{g(_*VLl4(FGK>V?keIuffG?Kh-Gdf8XaBcsT{-QahXE5s`ag>FF$X|n z`Rt$ew6zzhOW(GW9U0lg%n|?%^t-?1iLV}pe!>oI=sg6&FV<4~?fTJR3#7p3q%>ff zK2p(4xbX|z>b?;bK!RKXroD*pBX_L&p-eeHZK&qsRu#{CT% zxSkOHIyoK^3B=sJgwI89HghF*I$hZmPKp85+Wq5iw(rnHlnZHhP^d2ENujZ}yhy!G z;Zup3WhF6W6c-BI1>N}=E7!Xhr=Fn3Y6q^VhY~(|?ShA`Me)LYw@blkNrr0`-8(no zbMkx%OK<7$)7+I^t!SCoq?z<`xV+5nhn_$|7Tg3b7O&l6mf6ny*)?t1JotvCh;gSxN7(&J)y04?ZB zP}*PL%boO>b+q%}4V7cxX6UoM_Ux&jEo~r)3b&_^NnBMLzAe(xEmstogE&(aZUL!V zJF9AkeiVY2`ktvQ?Wr@9FjXKs(5(}A05ZiE8$}h2SS`iyB$)Q@EfMQl@5`=2*LnL8 z+xdDvpG-EG3lM;0gcF)l?gRS0NHgUQUmgjXUJnPwWXxzmlTjhe>BaD+5VAIXZVFQu z%JyqV2TfsxU>~+HiTW6#tk^uamcqN^*_sU-f5*)cj^mNt!%S&(_cxOJ_9 zE^`W)TwBvxN=ws!932nQs>y#}7@mn>@cBe9H*vn2i_V?;`8>iY)@p_;?MA`LT866=JYLN$X2fpwZT-y3))Pp>V&LU} zkBx+fJwQzhCNC>=a@(0H>jUa(!`j>Wjn%yJoPtgIAAOVM+HEOBlNgWdn-07v=gXV17_F-v{*krK2Q%=ze zLfj!N{^QgjMsC!PLe!q0i(B?;sS0*C295e{F_5l=lkCh10sj$f4oy1-Unsx~F5M14 zoIe^QHq)P@Z~O4ct{yt~-72Yue9~kW~XKTb$N>ObH(!@Jl>n46}Yn^^$d3G4Ifpmdxbss=Gzn- zS$V#J5uq;xEH9KWf&bjlh0`_o@WRW>!b-ZJ#0ZOH@Y~f92a(nnUIK_$uHSEDR$dqum!ur9jD)V3;8}k0x*RpWUhbAprSzZ0^U296k2^L} zaDhLHI9oq+c9+UWrR$}V5rOMQ>1?ep(ofh0Adk7B>U;sxzTh~U!3PEot4n@k_?T~m zSnm{Z>y6ajZIVoU?Tak1Ql*kqtgt6d-BSwC^lkdTt&8~Xs=Ys-v|A>;MF6k{Y2b{oy-efb%guD9wIqTjgwukyBxCs!d$_Am);7t5E0`iRzA+?5 zoq`XyCnQ3KdTJFmQ}hDR1bY$h|BHVZ(W&>E;bBAN>J`8~h@mehJ=hB*LGW`?_PL6sm_^I%3>@xTQ&U;PnL$1_ijr`>OQtz?$ZVfT z4O#vt>UO8+jl}4vF~Zk^m~N;ygIg{>YV=lg|-1 zoY(-E+tY9?cf)&T=iAN7N!d9^!!9x)F%AN_RPnAOaP)Q&qe@%7$)m8PeZS>KiK8)b zFQ#kmQfM31$_t0h7uH79Rk#kUkeT60|Hv2NN8|Or^fyovlKzj6@n|@y(k}v39B*2> zZDJiaaHlaz=vj%*zto2%tVLf+tJt4=Eb4!oG+!oc>Y5FZvSmf;>wXRu^lWI zDY{Z{%oRWY1X&|B$AvBSLTYzLBT9lpX$@zdd$*A*`EZCX>L|g zPQwKhRgY-4T3Of8Kf7MEdkj!n@nC{mIhP>;UH*=QWR7!isMIA9^(IgKXuv~piaqGA zOWb2#z9%=V_D|6%9|h8XgT+*G z(Inl%6`~Pu{l3wwNT`@gkRYaIk07$gRq_m9RCyF;Ym}o8-&BS-X_(a53{(5@b@1y zyQe8_152(`=me|0qI0Q3V498N2k~|l{(v9C1KWL|2_YWx-=*NY<^FW8@zpc4;`v2C zS3b|K>#;!^qL0+ea1-2v2V7csl}Nzt@vuG!Db{6v^km1dqGAk&TUGEgDoHb25X2Q za17Qp_)|UJiJX~_Re58rAVgmY8ay{iL<-5;3b+n9tj&44#jw-!fbOwNhrJv!bOFci zBH?;WdO-6MTMZrddLT$J%p8&4et;orc$t&hS-MRhZdFYO^x!uUI4^cX-zpj|#GeWv zo1o^L1t|o~Jl^%cQPEED^ih83-F3UVabQLb^_L4m?UljT`nq%w8AIVZG} z!-+6Kwnx7QB|NLN!^F3mOm>az4?o24r;!)IQJriR$)1cO9F2r>Cr%TQ7~n(B0NZH zFcumvsTRo=V(89OxX@SpP<<{5H_Y@unjV=8(PY%bzrV4v^n{&YRx^llCsmGDHIWRo zqVL-JZn=&BaHSkv{%vk=drcIBv{Whyn0uxN3FvAKLwzrTnbyf_^i55C`zE6bWOnRy zHnY|u5=M-WlRwTSaTu8tniBV7d%9k8>gCR54XXUx&$uW1KrDlbLc-NS$_bQ61bm8S z!hqyK$YAec%5ufQ$lLw(aB0nO>AQF=9*>X1k`_Zc>rb`SC_^I_#8H)dt)9vV`ALdZU^Lc00H1)8GUaNVJ z3%)?AW_MV2stMgl}?+vk~SfAlc{)M>k5~*dNC8%5nKwD z^0#fgW#qy0=)fw*@V)U59nit}G+Z6CfymLcptKOidfQHS%RNx0e@kfS2S#djFj#*h@!hFNxd|*MVwIdh>K>(x-m) zi)zOVTyP6ETUT`>{xc(nCE>T0#4s*&SBK|0sfLTYGAez*MmHLhB3n{tuS} z{h6y1s*fxEjqX1Z)i~N0DTMRf>I7M9kg9z#E_26CocHOfZz;dHXs2<@?q9Roezu=U z%G;zUK$P^#nSu1ZVMPx0K{~IWkHalG%g#y}&-|20!AyTvM_og2twkh6ZyDjfgz3X9i(TXOB2yuDp2G=*g=>Fq-cy^B4tCkApRxDz9Jj`-W`GqPCTBMatZ=Rp zv~HDryTaD__&lZFba%#+SG6ah5Z?;`AW7@gDDvk1m4Bw6Y$Gx2u7HB~SW>=v&*x6X zwVh_${A=d7tSogRkMCJd2K=PkKae#qTDM$)a+iop?187cmzNE(ndE0U*Mc2w!RxMJ zh<3}Djk2DT2}EpSNG}R}j0cAKW(JE`>1|_4IqsNI%c-XpGkd`#M=3=?)bYb_j2^E8 zS}}-&{Rah<%D>;$TV`>8<_u~S!^boDUitMoBJW!n27n7qP_6vf;}IJ255v80=SB9X zKAq6pNCt|1Jm1yqzXWdQ*Q`k1kpVq%ivn95e;by2_kWM({^R?2%p_)=rT493D!xkX zfdG{lW;wn*(>72o%ORG_X!=+vdY5`PZcnNsoH*x;ZMB!3PG?Uo@}VuTAa z^U#m8YvH~Y;D$n8e%q1r25;1K>W->UVyaSMRz(H-*y$kiy5v0BB? z;`+W7dfq=4h)VwDGOkn+vn1=$xPlWz9Nl@2V2o=*jV1o0IoFEw_{0K9r+r;!GsSF1 z&Zaxm-cs?9S}`yAj9~_!xZ*=H2XPcV z3cAyn(X2B4Jf{zsE!eryl7C>A<47=wra&gE7OBWgL*bhJZd~lYai9XVLnJ`226Fb$ ztZ^uxBDV+~p#xl^9?m~I3B9b}?7A9jx+-CyfJj=7^ALr>0{u*PrJ0yM^KWPje%mV2s&?{sWD1YsB1+RSj{sZ5 zUGqh;hGUzbE*Vw9xa8f;351Zick2p3rU<^kD5k|96))krPDhOjFeyxSwX^>pVc^rl z6~8WEl7h=S6espU%#8>S(yeaWrStr*P^!Gk4;9Oha_(8+W9WZql>fg=tVbKF)VrET6JcX4OasX+B4DMU(z&+I`gk5f3uI6K59nz52C z!tJHNyy19go*Vf$4V=BY5W)<9xz>^k7PKZX!QoP%dpUe68XT z)8Ix92!_Hcl7%HXLt~h?0Eun_HZc?33U?-UKB|4!0_ls6r`%ULcX*Ic4!LHRgFjDM zMoZ@xgg8IgI*1MrVePTG8u^NOFie}?3yA4xgxDO)M1L7A4^}vTRq_|t7Q^26b8r1b zreA*|8zym$2-gbPNdjAFH(>XZllVI`iY2VjoG1ua0D~$bBSI_S#Fd9E!oPn${n}|6 z*h*(zc_5*x-Ezd+U73K}w*xpHb8_>5{k?n@Ta9C(0?}`o_9y$KzbzvMQT$Z@*=P|G zt}$hQPC%wO|I(oca*Az{9CLTVA&lV>SP1p0=fnCg8T8Od0Li+u)y?&lKi5{Yv4idrDK?tvV z#b&R!TYOy#KhcgQKl8<$>sSoeVXNL?iVSru^h-mbJ=}3X@&uG7%Q;D!1+35dl@J)! zqL^_7Rv0i&1&C-8hOAbp@nA5fuLyT0@c@1aF#PsFu)39Q`fpFXzfg@pnmcAawUAL3 z+5w{u`guV_vFZPu(4Cb{P&}ZcBLd3A*%Z~C(cnWuX^%(7nJ#K&x2HID&z%7+75KHC zr*{GB-&d)X{F+T{t^>K*4>%db{?B7R?1M!>{<}FJl_i3+g6mjg`GYfE zbbCWiK{eBwLV`WZVBs~jdd-qWEF3RmB*kC_E*TqC|`~}5L}?v zOME6-Qxaygf+20F_GLb}fq>d!TE*R?kGua*9DNPKP*k5Zhirlm6&D^geKyyyOB_GEKP8-iJ|eNv>B0v2~(Snrz< zz;$>QG4O#qsCj0UWGn)geU&`<`{ZOoGl7P~d*JBfi;7mt{(o1chQ>wua0#As9ob3; zLkKfq#JSuQkWN%xFS>QnN_A)3Y&I92J!SRy$UnQuyT(Dc!R3Xa=D4XMuH*wW>P=9A z*QcCYc>euSh%T*B_?w+KY$^%dtKR}SpT4tub&{eTXsEUmhsf%62W4JTPIwQBL;)@s z{DvN2uy-4lBp__m;{V1-WU*a7CWZelOF;YHY){r1cjrGAsQ!&Fk5d@xrhREdhU3Hi zI2b~u-%Yg89@$0ZDV-`7qEy6VPDvUeusj>2$7*(tdR6DjBuh@5> zJEVb4N(2zvO}PpSZgp|SC2*dAN1&;^W8I;n9^@jsT{~nrNAI@LBW<(HWIg>>f@?QO zDCxR){1=b9qqsY9R@gKB#$(HgeeNg)H%%F9?|i0tAfa7h4!tvxZNOoACd#kGyiV($ zI#kZNbV1k*`EGdZ1BH@5;SR)he`QU99*p?8qpDZ@jB|vn!9CY-M-cZH3HFh|w(sXf zj6dCq{>>WrU(kgA`#xNT>wZXH^y9P)6O0X^y#`7^zgSb-;jOA>QUoZpDGs^i@Te~B zeT(9oLHv=TguhE7Q7l56frFGC(ff5KajWNG)^|6}vdQGr{RSiLdz2 z6h0MjH|oNO69UEBDz523+?=!bS1TrRBoCIAoGH0@keX*Mii_}-R2SC-J@n0v zdFRYdBSVZ+4E^E0rEupT?3T*b+E*AyEFffISRUB+dZzt9=-NfL#n4v4AEx9SvYr(s zO|y?LC!Sss4hak6JX0=OF@i(S64|?ow-}_D2f|+%w^)nYQNv4~>CDA74vq$AGw#+g zgaa;9Gg~<;l6lQX2?+z82#0e%Pqy}KccBHOv@4&EB-){?ZQVCK)#fc>FP^(!gihFA z3glF$21kIRpo?haC+RM*m}B?-CBlNwi9{8Z6QvWp=gvaz@7l2#cWXH_sKAnUYln;| zch8XEaAOW^(g9?6PAMq5g69{j{aR{PDna~Sr1Qoxf|Bc?;C~NWVahm=jk*kg;*MB1 z$8ad(QEdV>jCVcyw7t}D0e}l)ete48^{SLXMl9RhP2E+8T1kUTD)-_O)4gZ(I6RCf z3s2-7wr9kJH|YHOh`QtvDWS$Fgd;DMUm8wVbS6U%7a@*+`ua3k|HM0W$_U@aMqo6a z({NF~&`@D>u;7ybiY$TY|MHA_Q?`jCtH(|y5ist&|BRy1l+{PH + diff --git a/docs/versioned_docs/version-1.2/_media/runtime.svg b/docs/versioned_docs/version-1.2/_media/runtime.svg new file mode 100644 index 0000000000..b13d79e3ae --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/runtime.svg @@ -0,0 +1,1376 @@ + + diff --git a/docs/versioned_docs/version-1.2/_media/tcb.svg b/docs/versioned_docs/version-1.2/_media/tcb.svg new file mode 100644 index 0000000000..b20ac5284c --- /dev/null +++ b/docs/versioned_docs/version-1.2/_media/tcb.svg @@ -0,0 +1,547 @@ + + diff --git a/docs/versioned_docs/version-1.2/about/telemetry.md b/docs/versioned_docs/version-1.2/about/telemetry.md new file mode 100644 index 0000000000..074754c78e --- /dev/null +++ b/docs/versioned_docs/version-1.2/about/telemetry.md @@ -0,0 +1,20 @@ +# CLI telemetry + +The Contrast CLI sends telemetry data to Edgeless Systems when you use CLI commands. +This allows to understand how Contrast is used and to improve it. + +The CLI sends the following data: + +* The CLI version +* The CLI target OS and architecture (GOOS and GOARCH) +* The command that was run +* The kind of error that occurred (if any) + +The CLI *doesn't* collect sensitive information. +The implementation is open-source and can be reviewed. + +IP addresses may be processed or stored for security purposes. + +The data that the CLI collects adheres to the Edgeless Systems [privacy policy](https://www.edgeless.systems/privacy). + +You can disable telemetry by setting the environment variable `DO_NOT_TRACK=1` before running the CLI. diff --git a/docs/versioned_docs/version-1.2/architecture/attestation.md b/docs/versioned_docs/version-1.2/architecture/attestation.md new file mode 100644 index 0000000000..662b38f33d --- /dev/null +++ b/docs/versioned_docs/version-1.2/architecture/attestation.md @@ -0,0 +1,119 @@ +# Attestation in Contrast + +This document describes the attestation architecture of Contrast, adhering to the definitions of Remote ATtestation procedureS (RATS) in [RFC 9334](https://www.rfc-editor.org/rfc/rfc9334.html). +The following gives a detailed description of Contrast's attestation architecture. +At the end of this document, we included an [FAQ](#frequently-asked-questions-about-attestation-in-contrast) that answers the most common questions regarding attestation in hindsight of the [security benefits](../basics/security-benefits.md). + +## Attestation architecture + +Contrast integrates with the RATS architecture, leveraging their definition of roles and processes including *Attesters*, *Verifiers*, and *Relying Parties*. + +![Conceptual attestation architecture](../_media/attestation-rats-architecture.svg) + +Figure 1: Conceptual attestation architecture. Taken from [RFC 9334](https://www.rfc-editor.org/rfc/rfc9334.html#figure-1). + +- **Attester**: Assigned to entities that are responsible for creating *Evidence* which is then sent to a *Verifier*. +- **Verifier**: These entities utilize the *Evidence*, *Reference Values*, and *Endorsements*. They assess the trustworthiness of the *Attester* by applying an *Appraisal Policy* for *Evidence*. Following this assessment, *Verifiers* generate *Attestation Results* for use by *Relying Parties*. The *Appraisal Policy* for *Evidence* may be provided by the *Verifier Owner*, programmed into the *Verifier*, or acquired through other means. +- **Relying Party**: Assigned to entities that utilize *Attestation Results*, applying their own appraisal policies to make specific decisions, such as authorization decisions. This process is referred to as the "appraisal of Attestation Results." The *Appraisal Policy* for *Attestation Results* might be sourced from the *Relying Party Owner*, configured by the owner, embedded in the *Relying Party*, or obtained through other protocols or mechanisms. + +## Components of Contrast's attestation + +The key components involved in the attestation process of Contrast are detailed below: + +### Attester: Application Pods + +This includes all Pods of the Contrast deployment that run inside Confidential Containers and generate cryptographic evidence reflecting their current configuration and state. +Their evidence is rooted in the [hardware measurements](../basics/confidential-containers.md) from the CPU and their [confidential VM environment](../components/runtime.md). +The details of this evidence are given below in the section on [evidence generation and appraisal](#evidence-generation-and-appraisal). + +![Attestation flow of a confidential pod](../_media/attestation-pod.svg) + +Figure 2: Attestation flow of a confidential pod. Based on the layered attester graphic in [RFC 9334](https://www.rfc-editor.org/rfc/rfc9334.html#figure-3). + +Pods run in Contrast's [runtime environment](../components/runtime.md) (B), effectively within a confidential VM. +During launch, the CPU (A) measures the initial memory content of the confidential VM that contains Contrast's pod-VM image and generates the corresponding attestation evidence. +The image is in [IGVM format](https://github.com/microsoft/igvm), encapsulating all information required to launch a virtual machine, including the kernel, the initramfs, and kernel cmdline. +The kernel cmdline contains the root hash for [dm-verity](https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html) that ensures the integrity of the root filesystem. +The root filesystem contains all components of the container's runtime environment including the [guest agent](../basics/confidential-containers.md#kata-containers) (C). + +In the userland, the guest agent takes care of enforcing the [runtime policy](../components/overview.md#runtime-policies) of the pod. +While the policy is passed in during the initialization procedure via the host, the evidence for the runtime policy is part of the CPU measurements. +During the [deployment](../deployment.md#generate-policy-annotations-and-manifest) the policy is annotated to the Kubernetes Pod resources. +The hypervisor adds the hash of the policy to the attestation report via the HOSTDATA (on AMD SEV-SNP) or MRCONFIGID (Intel TDX) fields. +When provided with the policy from the Kata host, the guest agent verifies that the policy's hash matches the one in the `HOSTDATA`/`MRCONFIGID` field. + +In summary a Pod's evidence is the attestation report of the CPU that provides evidence for runtime environment and the runtime policy. + +### Verifier: Coordinator and CLI + +The [Coordinator](../components/overview.md#the-coordinator) acts as a verifier within the Contrast deployment, configured with a [Manifest](../components/overview.md#the-manifest) that defines the reference values and serves as an appraisal policy for all pods in the deployment. +It also pulls endorsements from hardware vendors to verify the hardware claims. +The Coordinator operates within the cluster as a confidential container and provides similar evidence as any other Pod when it acts as an attester. +In RATS terminology, the Coordinator's dual role is defined as a lead attester in a composite device which spans the entire deployment: Coordinator and the workload pods. +It collects evidence from other attesters and conveys it to a verifier, generating evidence about the layout of the whole composite device based on the Manifest as the appraisal policy. + +![Deployment attestation as a composite device](../_media/attestation-composite-device.svg) + +Figure 3: Contrast deployment as a composite device. Based on the composite device in [RFC 9334](https://www.rfc-editor.org/rfc/rfc9334.html#figure-4). + +The [CLI](../components/overview.md#the-cli-command-line-interface) serves as the verifier for the Coordinator and the entire Contrast deployment, containing the reference values for the Coordinator and the endorsements from hardware vendors. +These reference values are built into the CLI during our release process and can be reproduced offline via reproducible builds. + +### Relying Party: Data owner + +A relying party in the Contrast scenario could be, for example, the [data owner](../basics/security-benefits.md) that interacts with the application. +The relying party can use the CLI to obtain the attestation results and Contrast's [CA certificates](certificates.md) bound to these results. +The CA certificates can then be used by the relying party to authenticate the application, for example through TLS connections. + +## Evidence generation and appraisal + +### Evidence types and formats + +In Contrast, attestation evidence revolves around a hardware-generated attestation report, which contains several critical pieces of information: + +- **The hardware attestation report**: This report includes details such as the chip identifier, platform information, microcode versions, and comprehensive guest measurements. The entire report is signed by the CPU's private key, ensuring the authenticity and integrity of the data provided. +- **The launch measurements**: Included within the hardware attestation report, this is a digest generated by the CPU that represents a hash of all initial guest memory pages. This includes essential components like the kernel, initramfs, and the kernel command line. Notably, it incorporates the root filesystem's dm-verity root hash, verifying the integrity of the root filesystem. +- **The runtime policy hash**: Also part of the hardware attestation report, this field contains the hash of the Rego policy which dictates all expected API commands and their values from the host to the Kata guest agent. It encompasses crucial settings such as dm-verity hashes for the container image layers, environment variables, and mount points. + +### Appraisal policies for evidence + +The appraisal of this evidence in Contrast is governed by two main components: + +- **The Manifest**: A JSON file used by the Coordinator to align with reference values. It sets the expectations for runtime policy hashes for each pod and includes what should be reported in the hardware attestation report for each component of the deployment. +- **The CLI's appraisal policy**: This policy encompasses expected values of the Coordinator’s guest measurements and its runtime policy. It's embedded into the CLI during the build process and ensures that any discrepancy between the built-in values and those reported by the hardware attestation can be identified and addressed. The integrity of this policy is safeguardable through reproducible builds, allowing verification against the source code reference. + +## Frequently asked questions about attestation in Contrast + +### What's the purpose of remote attestation in Contrast? + +Remote attestation in Contrast ensures that software runs within a secure, isolated confidential computing environment. +This process certifies that the memory is encrypted and confirms the integrity and authenticity of the software running within the deployment. +By validating the runtime environment and the policies enforced on it, Contrast ensures that the system operates in a trustworthy state and hasn't been tampered with. + +### How does Contrast ensure the security of the attestation process? + +Contrast leverages hardware-rooted security features such as AMD SEV-SNP or Intel TDX to generate cryptographic evidence of a pod’s current state and configuration. +This evidence is checked against pre-defined appraisal policies to guarantee that only verified and authorized pods are part of a Contrast deployment. + +### What security benefits does attestation provide? + +Attestation confirms the integrity of the runtime environment and the identity of the workloads. +It plays a critical role in preventing unauthorized changes and detecting potential modifications at runtime. +The attestation provides integrity and authenticity guarantees, enabling relying parties—such as workload operators or data owners—to confirm the effective protection against potential threats, including malicious cloud insiders, co-tenants, or compromised workload operators. +More details on the specific security benefits can be found [here](../basics/security-benefits.md). + +### How can you verify the authenticity of attestation results? + +Attestation results in Contrast are tied to cryptographic proofs generated and signed by the hardware itself. +These proofs are then verified using public keys from trusted hardware vendors, ensuring that the results aren't only accurate but also resistant to tampering. +For further authenticity verification, all of Contrast's code is reproducibly built, and the attestation evidence can be verified locally from the source code. + +### How are attestation results used by relying parties? + +Relying parties use attestation results to make informed security decisions, such as allowing access to sensitive data or resources only if the attestation verifies the system's integrity. +Thereafter, the use of Contrast's [CA certificates in TLS connections](certificates.md) provides a practical approach to communicate securely with the application. + +## Summary + +In summary, Contrast's attestation strategy adheres to the RATS guidelines and consists of robust verification mechanisms that ensure each component of the deployment is secure and trustworthy. +This comprehensive approach allows Contrast to provide a high level of security assurance to its users. diff --git a/docs/versioned_docs/version-1.2/architecture/certificates.md b/docs/versioned_docs/version-1.2/architecture/certificates.md new file mode 100644 index 0000000000..d6c2b8ef73 --- /dev/null +++ b/docs/versioned_docs/version-1.2/architecture/certificates.md @@ -0,0 +1,70 @@ +# Certificate authority + +The Coordinator acts as a certificate authority (CA) for the workloads +defined in the manifest. +After a workload pod's attestation has been verified by the Coordinator, +it receives a mesh certificate and the mesh CA certificate. +The mesh certificate can be used for example in a TLS connection as the server or +client certificate to proof to the other party that the workload has been +verified by the Coordinator. The other party can verify the mesh certificate +with the mesh CA certificate. While the certificates can be used by the workload +developer in different ways, they're automatically used in Contrast's service +mesh to establish mTLS connections between workloads in the same deployment. + +## Public key infrastructure + +The Coordinator establishes a public key infrastructure (PKI) for all workloads +contained in the manifest. The Coordinator holds three certificates: the root CA +certificate, the intermediate CA certificate, and the mesh CA certificate. +The root CA certificate is a long-lasting certificate and its private key signs +the intermediate CA certificate. The intermediate CA certificate and the mesh CA +certificate share the same private key. This intermediate private key is used +to sign the mesh certificates. Moreover, the intermediate private key and +therefore the intermediate CA certificate and the mesh CA certificate are +rotated when setting a new manifest. + +![PKI certificate chain](../_media/contrast_pki.drawio.svg) + +## Certificate rotation + +Depending on the configuration of the first manifest, it allows the workload +owner to update the manifest and, therefore, the deployment. +Workload owners and data owners can be mutually untrusted parties. +To protect against the workload owner silently introducing malicious containers, +the Coordinator rotates the intermediate private key every time the manifest is +updated and, therefore, the +intermediate CA certificate and mesh CA certificate. If the user doesn't +trust the workload owner, they use the mesh CA certificate obtained when they +verified the Coordinator and the manifest. This ensures that the user only +connects to workloads defined in the manifest they verified since only those +workloads' certificates are signed with this intermediate private key. + +Similarly, the service mesh also uses the mesh CA certificate obtained when the +workload was started, so the workload only trusts endpoints that have been +verified by the Coordinator based on the same manifest. Consequently, a +manifest update requires a fresh rollout of the services in the service mesh. + +## Usage of the different certificates + +- The **root CA certificate** is returned when verifying the Coordinator. +The data owner can use it to verify the mesh certificates of the workloads. +This should only be used if the data owner trusts all future updates to the +manifest and workloads. This is, for instance, the case when the workload owner is +the same entity as the data owner. +- The **mesh CA certificate** is returned when verifying the Coordinator. +The data owner can use it to verify the mesh certificates of the workloads. +This certificate is bound to the manifest set when the Coordinator is verified. +If the manifest is updated, the mesh CA certificate changes. +New workloads will receive mesh certificates signed by the _new_ mesh CA certificate. +The Coordinator with the new manifest needs to be verified to retrieve the new mesh CA certificate. +The service mesh also uses the mesh CA certificate to verify the mesh certificates. +- The **intermediate CA certificate** links the root CA certificate to the +mesh certificate so that the mesh certificate can be verified with the root CA +certificate. It's part of the certificate chain handed out by +endpoints in the service mesh. +- The **mesh certificate** is part of the certificate chain handed out by +endpoints in the service mesh. During the startup of a pod, the Initializer +requests a certificate from the Coordinator. This mesh certificate will be returned if the Coordinator successfully +verifies the workload. The mesh certificate +contains X.509 extensions with information from the workloads attestation +document. diff --git a/docs/versioned_docs/version-1.2/architecture/observability.md b/docs/versioned_docs/version-1.2/architecture/observability.md new file mode 100644 index 0000000000..d6e0265dc6 --- /dev/null +++ b/docs/versioned_docs/version-1.2/architecture/observability.md @@ -0,0 +1,54 @@ +# Observability + +The Contrast Coordinator can expose metrics in the +[Prometheus](https://prometheus.io/) format. These can be monitored to quickly +identify problems in the gRPC layer or attestation errors. Prometheus metrics +are numerical values associated with a name and additional key/values pairs, +called labels. + +## Exposed metrics + +The metrics can be accessed at the Coordinator pod at the port specified in the +`CONTRAST_METRICS_PORT` environment variable under the `/metrics` endpoint. By +default, this environment variable isn't specified, hence no metrics will be +exposed. + +The Coordinator exports gRPC metrics under the prefix `contrast_grpc_server_`. +These metrics are labeled with the gRPC service name and method name. +Metrics of interest include `contrast_grpc_server_handled_total`, which counts +the number of requests by return code, and +`contrast_grpc_server_handling_seconds_bucket`, which produces a histogram of\ +request latency. + +The gRPC service `userapi.UserAPI` records metrics for the methods +`SetManifest` and `GetManifest`, which get called when [setting the +manifest](../deployment#set-the-manifest) and [verifying the +Coordinator](../deployment#verify-the-coordinator) respectively. + +The `meshapi.MeshAPI` service records metrics for the method `NewMeshCert`, which +gets called by the [Initializer](../components/overview.md#the-initializer) when starting a +new workload. Attestation failures from workloads to the Coordinator can be +tracked with the counter `contrast_meshapi_attestation_failures_total`. + +The current manifest generation is exposed as a +[gauge](https://prometheus.io/docs/concepts/metric_types/#gauge) with the metric +name `contrast_coordinator_manifest_generation`. If no manifest is set at the +Coordinator, this counter will be zero. + +## Service mesh metrics + +The [Service Mesh](../components/service-mesh.md) can be configured to expose +metrics via its [Envoy admin +interface](https://www.envoyproxy.io/docs/envoy/latest/operations/admin). Be +aware that the admin interface can expose private information and allows +destructive operations to be performed. To enable the admin interface for the +Service Mesh, set the annotation +`contrast.edgeless.systems/servicemesh-admin-interface-port` in the configuration +of your workload. If this annotation is set, the admin interface will be started +on this port. + +To access the admin interface, the ingress settings of the Service Mesh have to +be configured to allow access to the specified port (see [Configuring the +Proxy](../components/service-mesh#configuring-the-proxy)). All metrics will be +exposed under the `/stats` endpoint. Metrics in Prometheus format can be scraped +from the `/stats/prometheus` endpoint. diff --git a/docs/versioned_docs/version-1.2/architecture/secrets.md b/docs/versioned_docs/version-1.2/architecture/secrets.md new file mode 100644 index 0000000000..2edb026b95 --- /dev/null +++ b/docs/versioned_docs/version-1.2/architecture/secrets.md @@ -0,0 +1,106 @@ +# Secrets & recovery + +When the Coordinator is configured with the initial manifest, it generates a random secret seed. +From this seed, it uses an HKDF to derive the CA root key and a signing key for the manifest history. +This derivation is deterministic, so the seed can be used to bring any Coordinator to this Coordinator's state. + +The secret seed is returned to the user on the first call to `contrast set`, encrypted with the user's public seed share owner key. +If no seed share owner key is provided, a key is generated and stored in the working directory. + +## Persistence + +The Coordinator runs as a `StatefulSet` with a dynamically provisioned persistent volume. +This volume stores the manifest history and the associated runtime policies. +The manifest isn't considered sensitive information, because it needs to be passed to the untrusted infrastructure in order to start workloads. +However, the Coordinator must ensure its integrity and that the persisted data corresponds to the manifests set by authorized users. +Thus, the manifest is stored in plain text, but is signed with a private key derived from the Coordinator's secret seed. + +## Recovery + +When a Coordinator starts up, it doesn't have access to the signing secret and can thus not verify the integrity of the persisted manifests. +It needs to be provided with the secret seed, from which it can derive the signing key that verifies the signatures. +This procedure is called recovery and is initiated by the workload owner. +The CLI decrypts the secret seed using the private seed share owner key, verifies the Coordinator and sends the seed through the `Recover` method. +The Coordinator recovers its key material and verifies the manifest history signature. + +## Workload Secrets + +The Coordinator provides each workload a secret seed during attestation. +This secret can be used by the workload to derive additional secrets for example to encrypt persistent data. +Like the workload certificates, it's written to the `secrets/workload-secret-seed` path under the shared Kubernetes volume `contrast-secrets`. + +:::warning + +The workload owner can decrypt data encrypted with secrets derived from the workload secret. +The workload owner can derive the workload secret themselves, since it's derived from the secret seed known to the workload owner. +If the data owner and the workload owner is the same entity, then they can safely use the workload secrets. + +::: + +### Secure persistence + +Remember that persistent volumes from the cloud provider are untrusted. +Using the workload secret, applications can set up trusted storage on top of untrusted block devices. +The following, slightly abbreviated resource outlines how this could be realized: + +:::warning + +This configuration snippet is intended to be educational and needs to be refined and adapted to your production environment. +Using it as-is may result in data corruption or data loss. + +::: + +```yaml +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: volume-tester +spec: + template: + spec: + containers: + - name: main + image: my.registry/my-image@sha256:0123... + command: + - /bin/sh + - -ec + - | # <-- Custom script that mounts the encrypted disk and then calls the original application. + device=/dev/csi0 + if ! cryptsetup isLuks $device; then + cryptsetup luksFormat $device /contrast/secrets/workload-secret-seed + cryptsetup open $device state -d /contrast/secrets/workload-secret-seed + mkfs.ext4 /dev/mapper/state + cryptsetup close state + fi + cryptsetup open $device state -d /contrast/secrets/workload-secret-seed + /path/to/original/app + name: volume-tester + volumeDevices: + - name: state + devicePath: /dev/csi0 + securityContext: + privileged: true # <-- This is necessary for mounting devices. + runtimeClassName: contrast-cc + volumeClaimTemplates: + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: state + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + volumeMode: Block # <-- The requested volume needs to be a raw block device. +``` + +:::note + +This example assumes that you can modify the container image to include a shell and the `cryptsetup` utility. +Alternatively, you can set up a secure mount from a sidecar container inside an `emptyDir` mount shared with the main container. +The Contrast end-to-end tests include [an example] of this type of mount. + +[an example]: https://github.com/edgelesssys/contrast/blob/0662a2e/internal/kuberesource/sets.go#L504 + +::: diff --git a/docs/versioned_docs/version-1.2/architecture/security-considerations.md b/docs/versioned_docs/version-1.2/architecture/security-considerations.md new file mode 100644 index 0000000000..85f8da9f48 --- /dev/null +++ b/docs/versioned_docs/version-1.2/architecture/security-considerations.md @@ -0,0 +1,66 @@ +# Security Considerations + +Contrast ensures application integrity and provides secure means of communication and bootstrapping (see [security benefits](../basics/security-benefits.md)). +However, care must be taken when interacting with the outside of Contrast's confidential environment. +This page presents some tips for writing secure applications and outlines the trust boundaries app developers need to know. + +## General recommendations + +### Authentication + +The application receives credentials from the Contrast Coordinator during initialization. +This allows to authenticate towards peers and to verify credentials received from peers. +The application should use the certificate bundle to authenticate incoming requests and be wary of unauthenticated requests or requests with a different root of trust (for example the internet PKI). + +The recommendation to authenticate not only applies to network traffic, but also to volumes, GPUs and other devices. +Generally speaking, all information provided by the world outside the confidential VM should be treated with due scepticism, especially if it's not authenticated. +Common cases where Kubernetes apps interact with external services include DNS, Kubernetes API clients and cloud storage endpoints. + +### Encryption + +Any external persistence should be encrypted with an authenticated cipher. +This recommendation applies to block devices or filesystems mounted into the container, but also to cloud blob storage or external databases. + +## Contrast security guarantees + +If an application authenticates with a certificate signed by the Contrast Mesh CA of a given manifest, Contrast provides the following guarantees: + +1. The container images used by the app are the images specified in the resource definitions. +2. The command line arguments of containers are exactly the arguments specified in the resource definitions. +3. All environment variables are either specified in resource definitions, in the container image manifest or in a settings file for the Contrast CLI. +4. The containers run in a confidential VM that matches the reference values in the manifest. +5. The containers' root filesystems are mounted in encrypted memory. + +### Limitations inherent to policy checking + +Workload policies serve as workload identities. +From the perspective of the Contrast Coordinator, all workloads that authenticate with the same policy are equal. +Thus, it's not possible to disambiguate, for example, pods spawned from a deployment or to limit the amount of certificates issued per policy. + +Container image references from Kubernetes resource definitions are taken into account when generating the policy. +A mutable reference may lead to policy failures or unverified image content, depending on the Contrast runtime. +Reliability and security can only be ensured with a full image reference, including digest. +The [`docker pull` documentation] explains pinned image references in detail. + +Policies can only verify what can be inferred at generation time. +Some attributes of Kubernetes pods can't be predicted and thus can't be verified. +Particularly the [downward API] contains many fields that are dynamic or depend on the host environment, rendering it unsafe for process environment or arguments. +The same goes for `ConfigMap` and `Secret` resources, which can also be used to populate container fields. +If the application requires such external information, it should be injected as a mount point and carefully inspected before use. + +Another type of dynamic content are persistent volumes. +Any volumes mounted to the pod need to be scrutinized, and sensitive data must not be written to unprotected volumes. +Ideally, a volume is mounted as a raw block device and authenticated encryption is added within the confidential container. + +[`docker pull` documentation]: https://docs.docker.com/reference/cli/docker/image/pull/#pull-an-image-by-digest-immutable-identifier +[downward API]: https://kubernetes.io/docs/concepts/workloads/pods/downward-api/ + +### Logs + +By default, container logs are visible to the host. +Sensitive information shouldn't be logged. + +As of right now, hiding logs isn't natively supported. +If `ReadStreamRequest` is denied in the policy, the Kata Agent stops reading the logs. +This causes the pipes used for standard out and standard error to fill up and potentially deadlock the container. +If absolutely required, standard out and standard error should be manually redirected to `/dev/null` inside the container. diff --git a/docs/versioned_docs/version-1.2/basics/confidential-containers.md b/docs/versioned_docs/version-1.2/basics/confidential-containers.md new file mode 100644 index 0000000000..6f3f48f5bb --- /dev/null +++ b/docs/versioned_docs/version-1.2/basics/confidential-containers.md @@ -0,0 +1,32 @@ +# Confidential Containers + +Contrast uses some building blocks from [Confidential Containers](https://confidentialcontainers.org) (CoCo), a [CNCF Sandbox project](https://www.cncf.io/projects/confidential-containers/) that aims to standardize confidential computing at the pod level. +The project is under active development and many of the high-level features are still in flux. +Contrast uses the more stable core primitive provided by CoCo: its Kubernetes runtime. + +## Kubernetes RuntimeClass + +Kubernetes can be extended to use more than one container runtime with [`RuntimeClass`](https://kubernetes.io/docs/concepts/containers/runtime-class/) objects. +The [Container Runtime Interface](https://kubernetes.io/docs/concepts/architecture/cri/) (CRI) implementation, for example containerd, dispatches pod management API calls to the appropriate `RuntimeClass`. +`RuntimeClass` implementations are usually based on an [OCI runtime](https://github.com/opencontainers/runtime-spec), such as `runc`, `runsc` or `crun`. +In CoCo's case, the runtime is Kata Containers with added confidential computing capabilities. + +## Kata Containers + +[Kata Containers](https://katacontainers.io/) is an OCI runtime that runs pods in VMs. +The pod VM spawns an agent process that accepts management commands from the Kata runtime running on the host. +There are two options for creating pod VMs: local to the Kubernetes node, or remote VMs created with cloud provider APIs. +Using local VMs requires either bare-metal servers or VMs with support for nested virtualization. +Local VMs communicate with the host over a virtual socket. +For remote VMs, host-to-agent communication is tunnelled through the cloud provider's network. + +Kata Containers was originally designed to isolate the guest from the host, but it can also run pods in confidential VMs (CVMs) to shield pods from their underlying infrastructure. +In confidential mode, the guest agent is configured with an [Open Policy Agent](https://www.openpolicyagent.org/) (OPA) policy to authorize API calls from the host. +This policy also contains checksums for the expected container images. +It's derived from Kubernetes resource definitions and its checksum is included in the attestation report. + +## AKS CoCo preview + +[Azure Kubernetes Service](https://learn.microsoft.com/en-us/azure/aks/) (AKS) provides CoCo-enabled node pools as a [preview offering](https://learn.microsoft.com/en-us/azure/aks/confidential-containers-overview). +These node pools leverage Azure VM types capable of nested virtualization (CVM-in-VM) and the CoCo stack is pre-installed. +Contrast can be deployed directly into a CoCo-enabled AKS cluster. diff --git a/docs/versioned_docs/version-1.2/basics/features.md b/docs/versioned_docs/version-1.2/basics/features.md new file mode 100644 index 0000000000..5131d10740 --- /dev/null +++ b/docs/versioned_docs/version-1.2/basics/features.md @@ -0,0 +1,15 @@ +# Product features + +Contrast simplifies the deployment and management of Confidential Containers, offering optimal data security for your workloads while integrating seamlessly with your existing Kubernetes environment. + +From a security perspective, Contrast employs the [Confidential Containers](confidential-containers.md) concept and provides [security benefits](security-benefits.md) that go beyond individual containers, shielding your entire deployment from the underlying infrastructure. + +From an operational perspective, Contrast provides the following key features: + +* **Managed Kubernetes compatibility**: Initially compatible with Azure Kubernetes Service (AKS), Contrast is designed to support additional platforms such as AWS EKS and Google Cloud GKE as they begin to accommodate confidential containers. + +* **Lightweight installation**: Contrast can be integrated as a [day-2 operation](../deployment.md) within existing clusters, adding minimal [components](../components/overview.md) to your setup. This facilitates straightforward deployments using your existing YAML configurations, Helm charts, or Kustomization, enabling native Kubernetes orchestration of your applications. + +* **Remote attestation**: Contrast generates a concise attestation statement that verifies the identity, authenticity, and integrity of your deployment both internally and to external parties. This architecture ensures that updates or scaling of the application don't compromise the attestation’s validity. + +* **Service mesh**: Contrast securely manages a Public Key Infrastructure (PKI) for your deployments, issues workload-specific certificates, and establishes transparent mutual TLS (mTLS) connections across pods. This is done by harnessing the [envoy proxy](https://www.envoyproxy.io/) to ensure secure communications within your Kubernetes cluster. diff --git a/docs/versioned_docs/version-1.2/basics/security-benefits.md b/docs/versioned_docs/version-1.2/basics/security-benefits.md new file mode 100644 index 0000000000..85debb6006 --- /dev/null +++ b/docs/versioned_docs/version-1.2/basics/security-benefits.md @@ -0,0 +1,158 @@ +# Contrast security overview + +This document outlines the security measures of Contrast and its capability to counter various threats. +Contrast is designed to shield entire Kubernetes deployments from the infrastructure, enabling entities to manage sensitive information (such as regulated or personally identifiable information (PII)) in the public cloud, while maintaining data confidentiality and ownership. + +Contrast is applicable in situations where establishing trust with the workload operator or the underlying infrastructure is challenging. +This is particularly beneficial for regulated sectors looking to transition sensitive activities to the cloud, without sacrificing security or compliance. +It allows for cloud adoption by maintaining a hardware-based separation from the cloud service provider. + +## Confidential computing foundation + +Leveraging Confidential Computing technology, Contrast provides three defining security properties: + +* **Encryption of data in use**: Contrast ensures that all data processed in memory is encrypted, making it inaccessible to unauthorized users or systems, even if they have physical access to the hardware. +* **Workload isolation**: Each pod runs in its isolated runtime environment, preventing any cross-contamination between workloads, which is critical for multi-tenant infrastructures. +* **Remote attestation**: This feature allows data owners and workload operators to verify that the Contrast environment executing their workloads hasn't been tampered with and is running in a secure, pre-approved configuration. + +The runtime encryption is transparently provided by the confidential computing hardware during the workload's lifetime. +The workload isolation and remote attestation involves two phases: + +* An attestation process detects modifications to the workload image or its runtime environment during the initialization. This protects the workload's integrity pre-attestation. +* A protected runtime environment and a policy mechanism prevents the platform operator from accessing or compromising the instance at runtime. This protects a workload's integrity and confidentiality post-attestation. + +For more details on confidential computing see our [whitepaper](https://content.edgeless.systems/hubfs/Confidential%20Computing%20Whitepaper.pdf). +The [attestation architecture](../architecture/attestation.md) describes Contrast's attestation process and the resulting chain of trust in detail. + +## Components of a Contrast deployment + +Contrast uses the Kubernetes runtime of the [Confidential Containers](confidential-containers.md) project. +Confidential Containers significantly decrease the size of the trusted computing base (TCB) of a Kubernetes deployment, by isolating each pod within its own confidential micro-VM environment. +The TCB is the totality of elements in a computing environment that must be trusted not to be compromised. +A smaller TCB results in a smaller attack surface. The following diagram shows how Confidential Containers remove the *cloud & datacenter infrastructure* and the *physical hosts*, including the hypervisor, the host OS, the Kubernetes control plane, and other components, from the TCB (red). +In the confidential context, depicted in green, only the workload containers along with their confidential micro-VM environment are included within the TCB. +Their integrity is [verifiable through remote attestation](../architecture/attestation.md). + +Contrast uses [hardware-based mechanisms](confidential-containers.md), specifically leveraging CPU features, such as AMD SEV or Intel TDX, to provide the isolation of the workload. +This implies that both the CPU and its microcode are integral components of the TCB. +However, it should be noted that the CPU microcode aspects aren't depicted in the accompanying graphic. + +![TCB comparison](../_media/tcb.svg) + +Contrast adds the following components to a deployment that become part of the TCB. +The components that are part of the TCB are: + +* **The workload containers**: Container images that run the actual application. +* **[The runtime environment](../components/runtime.md)**: The confidential micro-VM that acts as the container runtime. +* **[The sidecar containers](../components/service-mesh.md)**: Containers that provide additional functionality such as [initialization](../components/overview.md#the-initializer) and [service mesh](../components/service-mesh.md). +* **[The runtime policies](../components/policies.md)**: Policies that enforce the runtime environments for the workload containers during their lifetime. +* **[The manifest](../components/overview.md#the-manifest)**: A manifest file defining the reference values of an entire confidential deployment. It contains the policy hashes for all pods of the deployment and the expected hardware reference values for the Confidential Container runtime. +* **[The Coordinator](../components/overview.md#the-coordinator)**: An attestation service that runs in a Confidential Container in the Kubernetes cluster. The Coordinator is configured with the manifest. User-facing, you can verify this service and the effective manifest using remote attestation, providing you with a concise attestation for the entire deployment. Cluster-facing, it verifies all pods and their policies based on remote attestation procedures and the manifest. + +## Personas in a Contrast deployment + +In a Contrast deployment, there are three parties: + +* **The container image provider**, who creates the container images that represent the application that has access to the protected data. + +* **The workload operator**, who runs the workload in a Kubernetes cluster. The operator typically has full administrative privileges to the deployment. The operator can manage cluster resources such as nodes, volumes, and networking rules, and the operator can interact with any Kubernetes or underlying cloud API. + +* **The data owner**, who owns the protected data. A data owner can verify the deployment using the Coordinator attestation service. The verification includes the identity, integrity, and confidentiality of the workloads, the runtime environment and the access permissions. + +Contrast supports a trust model where the container image provider, workload operator, and data owner are separate, mutually distrusting parties. + +The following diagram shows the system components and parties. + +![Components and parties](../_media/personas.svg) + +## Threat model and mitigations + +This section describes the threat vectors that Contrast helps to mitigate. + +The following attacks are out of scope for this document: + +* Attacks on the application code itself, such as insufficient access controls. +* Attacks on the Confidential Computing hardware directly, such as side-channel attacks. +* Attacks on the availability, such as denial-of-service (DOS) attacks. + +### Possible attacks + +Contrast is designed to defend against five possible attacks: + +* **A malicious cloud insider**: malicious employees or third-party contractors of cloud service providers (CSPs) potentially have full access to various layers of the cloud infrastructure. That goes from the physical datacenter up to the hypervisor and Kubernetes layer. For example, they can access the physical memory of the machines, modify the hypervisor, modify disk contents, intercept network communications, and attempt to compromise the confidential container at runtime. A malicious insider can expand the attack surface or restrict the runtime environment. For example, a malicious operator can add a storage device to introduce new attack vectors. As another example, a malicious operator can constrain resources such as limiting a guest's memory size, changing its disk space, or changing firewall rules. +* **A malicious cloud co-tenant**: malicious cloud user ("hackers") may break out of their tenancy and access other tenants' data. Advanced attackers may even be able to establish a permanent foothold within the infrastructure and access data over a longer period. The threats are analogous to the *cloud insider access* scenario, without the physical access. +* **A malicious workload operator**: malicious workload operators, for example Kubernetes administrators, have full access to the workload deployment and the underlying Kubernetes platform. The threats are analogously to the *cloud insider access* scenario, with access to everything that's above the hypervisor level. +* **A malicious attestation client**: this attacker connects to the attestation service and sends malformed request. +* **A malicious container image provider**: a malicious container image provider has full control over the application development itself. This attacker might release a malicious version of the workload containing harmful operations. + +### Attack surfaces + +The following table describes the attack surfaces that are available to attackers. + +| Attacker | Target | Attack surface | Risks | +|------------------------------------------------|----------------------------------|--------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------| +| Cloud insider | Confidential Container, Workload | Physical memory | Attacker can dump the physical memory of the workloads. | +| Cloud insider, cloud hacker, workload operator | Confidential Container, Workload | Disk reads | Anything read from the disk is within the attacker's control. | +| Cloud insider, cloud hacker, workload operator | Confidential Container, Workload | Disk writes | Anything written to disk is visible to an attacker. | +| Cloud insider, cloud hacker, workload operator | Confidential Container, Workload | Kubernetes Control Plane | Instance attributes read from the Kubernetes control plane, including mount points and environment variables, are within the attacker's control. | +| Cloud insider, cloud hacker, workload operator | Confidential Container, Workload | Container Runtime | The attacker can use container runtime APIs (for example "kubectl exec") to perform operations on the workload container. | +| Cloud insider, cloud hacker, workload operator | Confidential Container, Workload | Network | Intra-deployment (between containers) as well as external network connections to the image repository or attestation service can be intercepted. | +| Attestation client | Coordinator attestation service | Attestation requests | The attestation service has complex, crypto-heavy logic that's challenging to write defensively. | +| Container image provider | Workload | Workload | This attacker might release an upgrade to the workload containing harmful changes, such as a backdoor. | | + +### Threats and mitigations + +Contrast shields a workload from the aforementioned threats with three main components: + +1. The [runtime environment](../components/runtime.md) safeguards against the physical memory and disk attack surface. +2. The [runtime policies](../components/policies.md) safeguard against the Kubernetes control plane and container runtime attack surface. +3. The [service mesh](../components/service-mesh.md) safeguards against the network attack surface. + +The following tables describe concrete threats and how they're mitigated in Contrast grouped by these categories: + +* Attacks on the confidential container environment +* Attacks on the attestation service +* Attacks on workloads + +#### Attacks on the confidential container environment + +This table describes potential threats and mitigation strategies related to the confidential container environment. + +| Threat | Mitigation | Mitigation implementation | +|----------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------| +| An attacker intercepts the network connection of the launcher or image repository. | An attacker can change the image URL and control the workload binary. However these actions are reflected in the attestation report. The image repository isn't controlled using an access list, therefore the image is assumed to be viewable by everyone. You must ensure that the workload container image doesn't contain any secrets. | Within the [runtime policies](../components/policies.md) and [attestation](../architecture/attestation.md) | +| An attacker modifies the workload image on disk after it was downloaded and measured. | This threat is mitigated by a read-only partition that's integrity-protected. The workload image is protected by dm-verity. | Within the Contrast [runtime environment](../components/runtime.md) | +| An attacker modifies a container's runtime environment configuration in the Kubernetes control plane. | The attestation process and the runtime policies detects unsafe configurations that load non-authentic images or perform any other modification to the expected runtime environment. | Within the [runtime policies](../components/policies.md) and [attestation](../architecture/attestation.md) | + +#### Attacks on the Coordinator attestation service + +This table describes potential threats and mitigation strategies to the attestation service. + +| Threat | Mitigation | Mitigation implementation | +|-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------| +| An attacker intercepts the Coordinator deployment and modifies the image or hijacks the runtime environment. | This threat is mitigated by having an attestation procedure and attested, encrypted TLS connections to the Coordinator. The attestation evidence for the Coordinator image is distributed with our releases, protected by supply chain security, and fully reproducible. | Within the [attestation](../architecture/attestation.md) | +| An attacker intercepts the network connection between the workload and the Coordinator and reads secret keys from the wire. | This threat is mitigated by having an attested, encrypted TLS connection. This connection helps protect the secrets from passive eavesdropping. The attacker can't create valid workload certificates that would be accepted in Contrast's service mesh. An attacker can't impersonate a valid workload container because the container's identity is guaranteed by the attestation protocol. | Within the network between your workload and the Coordinator. | +| An attacker exploits parsing discrepancies, which leads to undetected changes in the attestation process. | This risk is mitigated by having a parsing engine written in memory-safe Go that's tested against the attestation specification of the hardware vendor. The runtime policies are available as an attestation artifact for further inspection and audits to verify their effectiveness. | Within the [Coordinator](../components/overview.md#the-coordinator) | +| An attacker uses all service resources, which brings the Coordinator down in a denial of service (DoS) attack. | In the future, this reliability risk is mitigated by having a distributed Coordinator service that can be easily replicated and scaled out as needed. | Within the [Coordinator](../components/overview.md#the-coordinator) | + +#### Attacks on workloads + +This table describes potential threats and mitigation strategies related to workloads. + +| Threat | Mitigation | Mitigation implementation | +|--------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------| +| An attacker intercepts the network connection between two workload containers. | This threat is mitigated by having transparently encrypted TLS connections between the containers in your deployment. | Within the [service mesh](../components/service-mesh.md) | +| An attacker reads or modifies data written to disk via persistent volumes. | Currently, persistent volumes aren't supported in Contrast. In the future, this threat is mitigated by encrypted and integrity-protected volume mounts. | Within the Contrast [runtime environment](../components/runtime.md)| +| An attacker publishes a new image version containing malicious code. | The attestation process and the runtime policies require a data owner to accept a specific version of the workload and any update to the workload needs to be explicitly acknowledged. | Within the [attestation](../architecture/attestation.md) | + +## Examples of Contrast's threat model in practice + +The following table describes three example use cases and how they map to the defined threat model in this document: + +| Use Case | Example Scenario | +|------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Migrate sensitive workloads to the cloud | TechSolve Inc., a software development firm, aimed to enhance its defense-in-depth strategy for its cloud-based development environment, especially for projects involving proprietary algorithms and client data. TechSolve acts as the image provider, workload operator, and data owner, combining all three personas in this scenario. In our [attestation terminology](../architecture/attestation.md), they're the workload operator and relying party in one entity. Their threat model includes a malicious cloud insider and cloud co-tenant. | +| Make your SaaS more trustworthy | SaaSProviderX, a company offering cloud-based project management tools, sought to enhance its platform's trustworthiness amidst growing concerns about data breaches and privacy. Here, the [relying party](../architecture/attestation.md) is the SaaS customer as the data owner. The goal is to achieve a form of operator exclusion and only allow selective operations on the deployment. Hence, their threat model includes a malicious workload operator. | +| Simplify regulatory compliance | HealthSecure Inc. has been managing a significant volume of sensitive patient data on-premises. With the increasing demand for advanced data analytics and the need for scalable infrastructure, the firm decides to migrate its data analytics operations to the cloud. However, the primary concern is maintaining the confidentiality and security of patient data during and after the migration, in compliance with healthcare regulations. In this compliance scenario, the regulator serves as an additional relying party. HealthSecure must implement a mechanism that ensures the isolation of patient data can be verifiably guaranteed to the regulator. | + +In each scenario, Contrast ensures exclusive data access and processing capabilities are confined to the designated workloads. It achieves this by effectively isolating the workload from the infrastructure and other components of the stack. Data owners are granted the capability to audit and approve the deployment environment before submitting their data, ensuring a secure handover. Meanwhile, workload operators are equipped to manage and operate the application seamlessly, without requiring direct access to either the workload or its associated data. diff --git a/docs/versioned_docs/version-1.2/components/overview.md b/docs/versioned_docs/version-1.2/components/overview.md new file mode 100644 index 0000000000..7acb319da3 --- /dev/null +++ b/docs/versioned_docs/version-1.2/components/overview.md @@ -0,0 +1,60 @@ +# Components + +Contrast is composed of several key components that work together to manage and scale confidential containers effectively within Kubernetes environments. +This page provides an overview of the core components essential for deploying and managing Contrast. + +![components overview](../_media/components.svg) + +## The CLI (Command Line Interface) + +The CLI serves as the primary management tool for Contrast deployments. It's designed to streamline the configuration and operation of Contrast in several ways: + +* Installation and setup: The CLI facilitates the installation of the necessary runtime classes required for Contrast to function within a Kubernetes cluster. +* Policy generation: It allows users to generate runtime policies, adapt the deployment files, and generate the Contrast manifest. +* Configuration management: Through the CLI, users can configure the Contrast Coordinator with the generated manifest. +* Verification and attestation: The CLI provides tools to verify the integrity and authenticity of the Coordinator and the entire deployment via remote attestation. + +## The Coordinator + +The Contrast Coordinator is the central remote attestation service of a Contrast deployment. +It runs inside a confidential container inside your cluster. +The Coordinator can be verified via remote attestation, and a Contrast deployment is self-contained. +The Coordinator is configured with a *manifest*, a configuration file containing the reference attestation values of your deployment. +It ensures that your deployment's topology adheres to your specified manifest by verifying the identity and integrity of all confidential pods inside the deployment. +The Coordinator is also a certificate authority and issues certificates for your workload pods during the attestation procedure. +Your workload pods can establish secure, encrypted communication channels between themselves based on these certificates using the Coordinator as the root CA. +As your app needs to scale, the Coordinator transparently verifies new instances and then provides them with their certificates to join the deployment. + +To verify your deployment, the Coordinator's remote attestation statement combined with the manifest offers a concise single remote attestation statement for your entire deployment. +A third party can use this to verify the integrity of your distributed app, making it easy to assure stakeholders of your app's identity and integrity. + +## The Manifest + +The manifest is the configuration file for the Coordinator, defining your confidential deployment. +It's automatically generated from your deployment by the Contrast CLI. +It currently consists of the following parts: + +* *Policies*: The identities of your Pods, represented by the hashes of their respective runtime policies. +* *Reference Values*: The remote attestation reference values for the Kata confidential micro-VM that's the runtime environment of your Pods. +* *WorkloadOwnerKeyDigest*: The workload owner's public key digest. Used for authenticating subsequent manifest updates. + +## Runtime policies + +Runtime Policies are a mechanism to enable the use of the untrusted Kubernetes API for orchestration while ensuring the confidentiality and integrity of your confidential containers. +They allow us to enforce the integrity of your containers' runtime environment as defined in your deployment files. +The runtime policy mechanism is based on the Open Policy Agent (OPA) and translates the Kubernetes deployment YAML into the Rego policy language of OPA. +The Kata Agent inside the confidential micro-VM then enforces the policy by only acting on permitted requests. +The Contrast CLI provides the tooling for automatically translating Kubernetes deployment YAML into the Rego policy language of OPA. + +## The Initializer + +Contrast provides an Initializer that handles the remote attestation on the workload side transparently and +fetches the workload certificate. The Initializer runs as an init container before your workload is started. +It provides the workload container and the [service mesh sidecar](service-mesh.md) with the workload certificates. + +## The Contrast runtime + +Contrast depends on a Kubernetes [runtime class](https://kubernetes.io/docs/concepts/containers/runtime-class/), which is installed +by the `node-installer` DaemonSet. +This runtime consists of a containerd runtime plugin, a virtual machine manager (cloud-hypervisor), and a podvm image (IGVM and rootFS). +The installer takes care of provisioning every node in the cluster so it provides this runtime class. diff --git a/docs/versioned_docs/version-1.2/components/policies.md b/docs/versioned_docs/version-1.2/components/policies.md new file mode 100644 index 0000000000..1932280e57 --- /dev/null +++ b/docs/versioned_docs/version-1.2/components/policies.md @@ -0,0 +1,88 @@ +# Policies + +Kata runtime policies are an integral part of the Confidential Containers preview on AKS. +They prescribe how a Kubernetes pod must be configured to launch successfully in a confidential VM. +In Contrast, policies act as a workload identifier: only pods with a policy registered in the manifest receive workload certificates and may participate in the confidential deployment. +Verification of the Contrast Coordinator and its manifest transitively guarantees that all workloads meet the owner's expectations. + +## Structure + +The Kata agent running in the confidential micro-VM exposes an RPC service [`AgentService`] to the Kata runtime. +This service handles potentially untrustworthy requests from outside the TCB, which need to be checked against a policy. + +Kata runtime policies are written in the policy language [Rego]. +They specify what `AgentService` methods can be called, and the permissible parameters for each call. + +Policies consist of two parts: a list of rules and a data section. +While the list of rules is static, the data section is populated with information from the `PodSpec` and other sources. + +[`AgentService`]: https://github.com/kata-containers/kata-containers/blob/e5e0983/src/libs/protocols/protos/agent.proto#L21-L76 +[Rego]: https://www.openpolicyagent.org/docs/latest/policy-language/ + +## Generation + +Runtime policies are programmatically generated from Kubernetes manifests by the Contrast CLI. +The `generate` subcommand inspects pod definitions and derives rules for validating the pod at the Kata agent. +There are two important integrity checks: container image checksums and OCI runtime parameters. + +For each of the container images used in a pod, the CLI downloads all image layers and produces a cryptographic [dm-verity] checksum. +These checksums are the basis for the policy's *storage data*. + +The CLI combines information from the `PodSpec`, `ConfigMaps`, and `Secrets` in the provided Kubernetes manifests to derive a permissible set of command-line arguments and environment variables. +These constitute the policy's *OCI data*. + +[dm-verity]: https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html + +## Evaluation + +The generated policy document is annotated to the pod definitions in Base64 encoding. +This annotation is propagated to the Kata runtime, which calculates the SHA256 checksum for the policy and uses that as SNP `HOSTDATA` or TDX `MRCONFIGID` for the confidential micro-VM. + +After the VM launched, the runtime calls the agent's `SetPolicy` method with the full policy document. +If the policy doesn't match the checksum in `HOSTDATA` or `MRCONFIGID`, the agent rejects the policy. +Otherwise, it applies the policy to all future `AgentService` requests. + +## Guarantees + +The policy evaluation provides the following guarantees for pods launched with the correct generated policy: + +* Command and its arguments are set as specified in the resources. +* There are no unexpected additional environment variables. +* The container image layers correspond to the layers observed at policy generation time. + Thus, only the expected workload image can be instantiated. +* Executing additional processes in a container is prohibited. +* Sending data to a container's standard input is prohibited. + +The current implementation of policy checking has some blind spots: + +* Containers can be started in any order, or be omitted entirely. +* Environment variables may be missing. +* Volumes other than the container root volume don't have integrity checks (particularly relevant for mounted `ConfigMaps` and `Secrets`). + +## Trust + +Contrast verifies its confidential containers following these steps: + +1. The Contrast CLI generates a policy and attaches it to the pod definition. +2. Kubernetes schedules the pod on a node with the confidential computing runtime. +3. Containerd invokes the Kata runtime to create the pod sandbox. +4. The Kata runtime starts a CVM with the policy's digest as `HOSTDATA`/`MRCONFIGID`. +5. The Kata runtime sets the policy using the `SetPolicy` method. +6. The Kata agent verifies that the incoming policy's digest matches `HOSTDATA`/`MRCONFIGID`. +7. The CLI sets a manifest in the Contrast Coordinator, including a list of permitted policies. +8. The Contrast Initializer sends an attestation report to the Contrast Coordinator, asking for a mesh certificate. +9. The Contrast Coordinator verifies that the started pod has a permitted policy hash in its `HOSTDATA`/`MRCONFIGID` field. + +After the last step, we know that the policy hasn't been tampered with and, thus, that the workload matches expectations and may receive mesh certificates. + +## Platform Differences + +Contrast uses different rules and data sections for different platforms. +This results in different policy hashes for different platforms. + +The `generate` command automatically derives the correct set of rules and data sections from the `reference-values` flag. + +The `verify`, `set`, and `recover` commands need to know the coordinator's expected policy hash to verify its identity. +By default these commands assume that the coordinator is using the policy for the `AKS-CLH-SNP` platform. +If the coordinator is running on a different platform, the correct policy hash can be looked up in the `coordinator-policy.hash` file bundled with the [Contrast release](https://github.com/edgelesssys/contrast/releases). +The coordinator policy hash can be overwritten using the `--coordinator-policy-hash` flag. diff --git a/docs/versioned_docs/version-1.2/components/runtime.md b/docs/versioned_docs/version-1.2/components/runtime.md new file mode 100644 index 0000000000..b40992b6ac --- /dev/null +++ b/docs/versioned_docs/version-1.2/components/runtime.md @@ -0,0 +1,91 @@ +# Contrast Runtime + +The Contrast runtime is responsible for starting pods as confidential virtual machines. +This works by specifying the runtime class to be used in a pod spec and by registering the runtime class with the apiserver. +The `RuntimeClass` resource defines a name for referencing the class and +a handler used by the container runtime (`containerd`) to identify the class. + +```yaml +apiVersion: node.k8s.io/v1 +kind: RuntimeClass +metadata: + # This name is used by pods in the runtimeClassName field + name: contrast-cc-abcdef +# This name is used by the +# container runtime interface implementation (containerd) +handler: contrast-cc-abcdef +``` + +Confidential pods that are part of a Contrast deployment need to specify the +same runtime class in the `runtimeClassName` field, so Kubernetes uses the +Contrast runtime instead of the default `containerd` / `runc` handler. + +```yaml +apiVersion: v1 +kind: Pod +spec: + runtimeClassName: contrast-cc-abcdef + # ... +``` + +## Node-level components + +The runtime consists of additional software components that need to be installed +and configured on every SEV-SNP-enabled/TDX-enabled worker node. +This installation is performed automatically by the [`node-installer` DaemonSet](#node-installer-daemonset). + +![Runtime components](../_media/runtime.svg) + +### Containerd shim + +The `handler` field in the Kubernetes `RuntimeClass` instructs containerd not to use the default `runc` implementation. +Instead, containerd invokes a custom plugin called `containerd-shim-contrast-cc-v2`. +This shim is described in more detail in the [upstream source repository](https://github.com/kata-containers/kata-containers/tree/3.4.0/src/runtime) and in the [containerd documentation](https://github.com/containerd/containerd/blob/main/core/runtime/v2/README.md). + +### Virtual machine manager (VMM) + +The `containerd` shim uses a virtual machine monitor to create a confidential virtual machine for every pod. +On AKS, Contrast uses [`cloud-hypervisor`](https://www.cloudhypervisor.org). +On bare metal, Contrast uses [`QEMU`](https://www.qemu.org/). +The appropriate files are installed on every node by the [`node-installer`](#node-installer-daemonset). + +### Snapshotters + +Contrast uses [`containerd` snapshotters](https://github.com/containerd/containerd/tree/v1.7.16/docs/snapshotters/README.md) to provide container images to the pod-VM. +Each snapshotter consists of a host component that pulls container images and a guest component used to mount/pull container images. + +On AKS, Contrast uses the [`tardev`](https://github.com/kata-containers/tardev-snapshotter) snapshotter to provide container images as block devices to the pod-VM. +The `tardev` snapshotter uses [`dm-verity`](https://docs.kernel.org/admin-guide/device-mapper/verity.html) to protect the integrity of container images. +Expected `dm-verity` container image hashes are part of Contrast runtime policies and are enforced by the kata-agent. +This enables workload attestation by specifying the allowed container image as part of the policy. Read [the chapter on policies](policies.md) for more information. + +On bare metal, Contrast uses the [`nydus`](https://github.com/containerd/nydus-snapshotter) snapshotter to store metadata about the images. This metadata is communicated to the guest, so that it can pull the images itself. + +### Pod-VM image + +Every pod-VM starts with the same guest image. It consists of an IGVM file and a root filesystem. +The IGVM file describes the initial memory contents of a pod-VM and consists of: + +- Linux kernel image +- `initrd` +- `kernel commandline` + +Additionally, a root filesystem image is used that contains a read-only partition with the user space of the pod-VM and a verity partition to guarantee the integrity of the root filesystem. +The root filesystem contains systemd as the init system, and the kata agent for managing the pod. + +This pod-VM image isn't specific to any pod workload. Instead, container images are mounted at runtime. + +## Node installer DaemonSet + +The `RuntimeClass` resource above registers the runtime with the Kubernetes api. +The node-level installation is carried out by the Contrast node-installer +`DaemonSet` that ships with every Contrast release. + +After deploying the installer, it performs the following steps on each node: + +- Install the Contrast containerd shim (`containerd-shim-contrast-cc-v2`) +- Install `cloud-hypervisor` or `QEMU` as the virtual machine manager (VMM) +- Install an IGVM file or separate firmware and kernel files for pod-VMs of this class +- Install a read only root filesystem disk image for the pod-VMs of this class +- Reconfigure `containerd` by adding a runtime plugin that corresponds to the `handler` field of the Kubernetes `RuntimeClass` +- Restart `containerd` to make it aware of the new plugin diff --git a/docs/versioned_docs/version-1.2/components/service-mesh.md b/docs/versioned_docs/version-1.2/components/service-mesh.md new file mode 100644 index 0000000000..b93820be60 --- /dev/null +++ b/docs/versioned_docs/version-1.2/components/service-mesh.md @@ -0,0 +1,146 @@ +# Service mesh + +The Contrast service mesh secures the communication of the workload by automatically +wrapping the network traffic inside mutual TLS (mTLS) connections. The +verification of the endpoints in the connection establishment is based on +certificates that are part of the +[PKI of the Coordinator](../architecture/certificates.md). + +The service mesh can be enabled on a per-workload basis by adding a service mesh +configuration to the workload's object annotations. During the `contrast generate` +step, the service mesh is added as a [sidecar +container](https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/) to +all workloads which have a specified configuration. The service mesh container first +sets up `iptables` rules based on its configuration and then starts +[Envoy](https://www.envoyproxy.io/) for TLS origination and termination. + +## Configuring the proxy + +The service mesh container can be configured using the following object annotations: + +* `contrast.edgeless.systems/servicemesh-ingress` to configure ingress. +* `contrast.edgeless.systems/servicemesh-egress` to configure egress. +* `contrast.edgeless.systems/servicemesh-admin-interface-port` to configure the Envoy + admin interface. If not specified, no admin interface will be started. + +If you aren't using the automatic service mesh injection and want to configure the +service mesh manually, set the environment variables `CONTRAST_INGRESS_PROXY_CONFIG`, +`CONTRAST_EGRESS_PROXY_CONFIG` and `CONTRAST_ADMIN_PORT` in the service mesh sidecar directly. + +### Ingress + +All TCP ingress traffic is routed over Envoy by default. Since we use +[TPROXY](https://docs.kernel.org/networking/tproxy.html), the destination address +remains the same throughout the packet handling. + +Any incoming connection is required to present a client certificate signed by the +[mesh CA certificate](../architecture/certificates.md#usage-of-the-different-certificates). +Envoy presents a certificate chain of the mesh +certificate of the workload and the intermediate CA certificate as the server certificate. + +If the deployment contains workloads which should be reachable from outside the +Service Mesh, while still handing out the certificate chain, disable client +authentication by setting the annotation `contrast.edgeless.systems/servicemesh-ingress` as +`##false`. Separate multiple entries with `##`. You can choose any +descriptive string identifying the service on the given port for the `` field, +as it's only informational. + +Disable redirection and TLS termination altogether by specifying +`##true`. This can be beneficial if the workload itself handles TLS +on that port or if the information exposed on this port is non-sensitive. + +The following example workload exposes a web service on port 8080 and metrics on +port 7890. The web server is exposed to a 3rd party end-user which wants to +verify the deployment, therefore it's still required that the server hands out +it certificate chain signed by the mesh CA certificate. The metrics should be +exposed via TCP without TLS. + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: web + annotations: + contrast.edgeless.systems/servicemesh-ingress: "web#8080#false##metrics#7890#true" +spec: + replicas: 1 + template: + spec: + runtimeClassName: contrast-cc + containers: + - name: web-svc + image: ghcr.io/edgelesssys/frontend:v1.2.3@... + ports: + - containerPort: 8080 + name: web + - containerPort: 7890 + name: metrics +``` + +When invoking `contrast generate`, the resulting deployment will be injected with the +Contrast service mesh as an init container. + +```yaml +# ... + initContainers: + - env: + - name: CONTRAST_INGRESS_PROXY_CONFIG + value: "web#8080#false##metrics#7890#true" + image: "ghcr.io/edgelesssys/contrast/service-mesh-proxy:latest" + name: contrast-service-mesh + restartPolicy: Always + securityContext: + capabilities: + add: + - NET_ADMIN + privileged: true + volumeMounts: + - name: contrast-secrets + mountPath: /contrast +``` + +Note, that changing the environment variables of the sidecar container directly will +only have an effect if the workload isn't configured to automatically generate a +service mesh component on `contrast generate`. Otherwise, the service mesh sidecar +container will be regenerated on every invocation of the command. + +### Egress + +To be able to route the egress traffic of the workload through Envoy, the remote +endpoints' IP address and port must be configurable. + +* Choose an IP address inside the `127.0.0.0/8` CIDR and a port not yet in use +by the pod. +* Configure the workload to connect to this IP address and port. +* Set `#:#:` +as the `contrast.edgeless.systems/servicemesh-egress` workload annotation. Separate multiple +entries with `##`. Choose any string identifying the service on the given port as +``. + +This redirects the traffic over Envoy. The endpoint must present a valid +certificate chain which must be verifiable with the +[mesh CA certificate](../architecture/certificates.md#usage-of-the-different-certificates). +Furthermore, Envoy uses a certificate chain with the mesh certificate of the workload +and the intermediate CA certificate as the client certificate. + +The following example workload has no ingress connections and two egress +connection to different microservices. The microservices are part +of the confidential deployment. One is reachable under `billing-svc:8080` and +the other under `cart-svc:8080`. + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: web + annotations: + contrast.edgeless.systems/servicemesh-egress: "billing#127.137.0.1:8081#billing-svc:8080##cart#127.137.0.2:8081#cart-svc:8080" +spec: + replicas: 1 + template: + spec: + runtimeClassName: contrast-cc + containers: + - name: currency-conversion + image: ghcr.io/edgelesssys/conversion:v1.2.3@... +``` diff --git a/docs/versioned_docs/version-1.2/deployment.md b/docs/versioned_docs/version-1.2/deployment.md new file mode 100644 index 0000000000..d8572c5ff0 --- /dev/null +++ b/docs/versioned_docs/version-1.2/deployment.md @@ -0,0 +1,427 @@ +# Workload deployment + +The following instructions will guide you through the process of making an existing Kubernetes deployment +confidential and deploying it together with Contrast. + + + +A running CoCo-enabled cluster is required for these steps, see the [setup guide](./getting-started/cluster-setup.md) on how to set up a cluster on AKS. + + +A running CoCo-enabled cluster is required for these steps, see the [setup guide](./getting-started/bare-metal.md) on how to set up a bare-metal cluster. + + +A running CoCo-enabled cluster is required for these steps, see the [setup guide](./getting-started/bare-metal.md) on how to set up a bare-metal cluster. + + + +## Deploy the Contrast runtime + +Contrast depends on a [custom Kubernetes `RuntimeClass` (`contrast-cc`)](./components/runtime.md), +which needs to be installed in the cluster prior to the Coordinator or any confidential workloads. +This consists of a `RuntimeClass` resource and a `DaemonSet` that performs installation on worker nodes. +This step is only required once for each version of the runtime. +It can be shared between Contrast deployments. + + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-aks-clh-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-tdx.yml +``` + + + +## Deploy the Contrast Coordinator + +Install the latest Contrast Coordinator release, comprising a single replica deployment and a +LoadBalancer service, into your cluster. + + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-aks-clh-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-tdx.yml +``` + + + +## Prepare your Kubernetes resources + +Your Kubernetes resources need some modifications to run as Confidential Containers. +This section guides you through the process and outlines the necessary changes. + +### Security review + +Contrast ensures integrity and confidentiality of the applications, but interactions with untrusted systems require the developers' attention. +Review the [security considerations](architecture/security-considerations.md) and the [certificates](architecture/certificates.md) section for writing secure Contrast application. + +### RuntimeClass + +Contrast will add annotations to your Kubernetes YAML files. If you want to keep the original files +unchanged, you can copy the files into a separate local directory. +You can also generate files from a Helm chart or from a Kustomization. + + + + +```sh +mkdir resources +kustomize build $MY_RESOURCE_DIR > resources/all.yml +``` + + + + +```sh +mkdir resources +helm template $RELEASE_NAME $CHART_NAME > resources/all.yml +``` + + + + +```sh +cp -R $MY_RESOURCE_DIR resources/ +``` + + + + +To specify that a workload (pod, deployment, etc.) should be deployed as confidential containers, +add `runtimeClassName: contrast-cc` to the pod spec (pod definition or template). +This is a placeholder name that will be replaced by a versioned `runtimeClassName` when generating policies. + +```yaml +spec: # v1.PodSpec + runtimeClassName: contrast-cc +``` + +### Handling TLS + +In the initialization process, the `contrast-secrets` shared volume is populated with X.509 certificates for your workload. +These certificates are used by the [Contrast Service Mesh](components/service-mesh.md), but can also be used by your application directly. +The following tab group explains the setup for both scenarios. + + + + +Contrast can be configured to handle TLS in a sidecar container. +This is useful for workloads that are hard to configure with custom certificates, like Java applications. + +Configuration of the sidecar depends heavily on the application. +The following example is for an application with these properties: + +- The container has a main application at TCP port 8001, which should be TLS-wrapped and doesn't require client authentication. +- The container has a metrics endpoint at TCP port 8080, which should be accessible in plain text. +- All other endpoints require client authentication. +- The app connects to a Kubernetes service `backend.default:4001`, which requires client authentication. + +Add the following annotations to your workload: + +```yaml +metadata: # apps/v1.Deployment, apps/v1.DaemonSet, ... + annotations: + contrast.edgeless.systems/servicemesh-ingress: "main#8001#false##metrics#8080#true" + contrast.edgeless.systems/servicemesh-egress: "backend#127.0.0.2:4001#backend.default:4001" +``` + +During the `generate` step, this configuration will be translated into a Service Mesh sidecar container which handles TLS connections automatically. +The only change required to the app itself is to let it connect to `127.0.0.2:4001` to reach the backend service. +You can find more detailed documentation in the [Service Mesh chapter](components/service-mesh.md). + + + + + +The mesh certificate contained in `certChain.pem` authenticates this workload, while the mesh CA certificate `mesh-ca.pem` authenticates its peers. +Your app should turn on client authentication to ensure peers are running as confidential containers, too. +See the [Certificate Authority](architecture/certificates.md) section for detailed information about these certificates. + +The following example shows how to configure a Golang app, with error handling omitted for clarity. + + + + +```go +caCerts := x509.NewCertPool() +caCert, _ := os.ReadFile("/contrast/tls-config/mesh-ca.pem") +caCerts.AppendCertsFromPEM(caCert) +cert, _ := tls.LoadX509KeyPair("/contrast/tls-config/certChain.pem", "/contrast/tls-config/key.pem") +cfg := &tls.Config{ + Certificates: []tls.Certificate{cert}, + RootCAs: caCerts, +} +``` + + + + +```go +caCerts := x509.NewCertPool() +caCert, _ := os.ReadFile("/contrast/tls-config/mesh-ca.pem") +caCerts.AppendCertsFromPEM(caCert) +cert, _ := tls.LoadX509KeyPair("/contrast/tls-config/certChain.pem", "/contrast/tls-config/key.pem") +cfg := &tls.Config{ + Certificates: []tls.Certificate{cert}, + ClientAuth: tls.RequireAndVerifyClientCert, + ClientCAs: caCerts, +} +``` + + + + + + + +## Generate policy annotations and manifest + +Run the `generate` command to add the necessary components to your deployment files. +This will add the Contrast Initializer to every workload with the specified `contrast-cc` runtime class +and the Contrast Service Mesh to all workloads that have a specified configuration. +After that, it will generate the execution policies and add them as annotations to your deployment files. +A `manifest.json` with the reference values of your deployment will be created. + + + +```sh +contrast generate --reference-values aks-clh-snp resources/ +``` + + +```sh +contrast generate --reference-values k3s-qemu-snp resources/ +``` +:::note[Missing TCB values] +On bare-metal SEV-SNP, `contrast generate` is unable to fill in the `MinimumTCB` values as they can vary between platforms. +They will have to be filled in manually. +If you don't know the correct values use `{"BootloaderVersion":255,"TEEVersion":255,"SNPVersion":255,"MicrocodeVersion":255}` and observe the real values in the error messages in the following steps. This should only be done in a secure environment. Note that the values will differ between CPU models. +::: + + +```sh +contrast generate --reference-values k3s-qemu-tdx resources/ +``` +:::note[Missing TCB values] +On bare-metal TDX, `contrast generate` is unable to fill in the `MinimumTeeTcbSvn` and `MrSeam` TCB values as they can vary between platforms. +They will have to be filled in manually. +If you don't know the correct values use `ffffffffffffffffffffffffffffffff` and `000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000` respectively and observe the real values in the error messages in the following steps. This should only be done in a secure environment. +::: + + + +:::warning +Please be aware that runtime policies currently have some blind spots. For example, they can't guarantee the starting order of containers. See the [current limitations](features-limitations.md#runtime-policies) for more details. +::: + +If you don't want the Contrast Initializer to automatically be added to your +workloads, there are two ways you can skip the Initializer injection step, +depending on how you want to customize your deployment. + + + + +You can disable the Initializer injection completely by specifying the +`--skip-initializer` flag in the `generate` command. + + + +```sh +contrast generate --reference-values aks-clh-snp --skip-initializer resources/ +``` + + +```sh +contrast generate --reference-values k3s-qemu-snp --skip-initializer resources/ +``` + + +```sh +contrast generate --reference-values k3s-qemu-tdx --skip-initializer resources/ +``` + + + + + + + +If you want to disable the Initializer injection for a specific workload with +the `contrast-cc` runtime class, you can do so by adding an annotation to the workload. + +```yaml +metadata: # apps/v1.Deployment, apps/v1.DaemonSet, ... + annotations: + contrast.edgeless.systems/skip-initializer: "true" +``` + + + + +When disabling the automatic Initializer injection, you can manually add the +Initializer as a sidecar container to your workload before generating the +policies. Configure the workload to use the certificates written to the +`contrast-secrets` `volumeMount`. + +```yaml +# v1.PodSpec +spec: + initContainers: + - env: + - name: COORDINATOR_HOST + value: coordinator + image: "ghcr.io/edgelesssys/contrast/initializer:latest" + name: contrast-initializer + volumeMounts: + - mountPath: /contrast + name: contrast-secrets + volumes: + - emptyDir: {} + name: contrast-secrets +``` + +## Apply the resources + +Apply the resources to the cluster. Your workloads will block in the initialization phase until a +manifest is set at the Coordinator. + +```sh +kubectl apply -f resources/ +``` + +## Connect to the Contrast Coordinator + +For the next steps, we will need to connect to the Coordinator. The released Coordinator resource +includes a LoadBalancer definition we can use. + +```sh +coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') +``` + +:::info[Port-forwarding of Confidential Containers] + +`kubectl port-forward` uses a Container Runtime Interface (CRI) method that isn't supported by the Kata shim. +If you can't use a public load balancer, you can deploy a [port-forwarder](https://github.com/edgelesssys/contrast/blob/ddc371b/deployments/emojivoto/portforwarder.yml). +The port-forwarder relays traffic from a CoCo pod and can be accessed via `kubectl port-forward`. + + + +Upstream tracking issue: https://github.com/kata-containers/kata-containers/issues/1693. + +::: + +## Set the manifest + +Attest the Coordinator and set the manifest: + +```sh +contrast set -c "${coordinator}:1313" resources/ +``` + +This will use the reference values from the manifest file to attest the Coordinator. +After this step, the Coordinator will start issuing TLS certificates to the workloads. The init container +will fetch a certificate for the workload and the workload is started. + +:::warning +On bare metal, the [coordinator policy hash](components/policies.md#platform-differences) must be overwritten using `--coordinator-policy-hash`. +::: + +## Verify the Coordinator + +An end user (data owner) can verify the Contrast deployment using the `verify` command. + +```sh +contrast verify -c "${coordinator}:1313" +``` + +The CLI will attest the Coordinator using the reference values from the given manifest file. It will then write the +service mesh root certificate and the history of manifests into the `verify/` directory. In addition, the policies +referenced in the active manifest are also written to the directory. The verification will fail if the active +manifest at the Coordinator doesn't match the manifest passed to the CLI. + +:::warning +On bare metal, the [coordinator policy hash](components/policies.md#platform-differences) must be overwritten using `--coordinator-policy-hash`. +::: + +## Communicate with workloads + +You can securely connect to the workloads using the Coordinator's `mesh-ca.pem` as a trusted CA certificate. +First, expose the service on a public IP address via a LoadBalancer service: + +```sh +kubectl patch svc ${MY_SERVICE} -p '{"spec": {"type": "LoadBalancer"}}' +kubectl wait --timeout=30s --for=jsonpath='{.status.loadBalancer.ingress}' service/${MY_SERVICE} +lbip=$(kubectl get svc ${MY_SERVICE} -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') +echo $lbip +``` + +:::info[Subject alternative names and LoadBalancer IP] + +By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed +via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the SAN field. +Validation fails since the certificate contains no IP entries as a subject alternative name (SAN). +For example, attempting to connect with curl and the mesh CA certificate will throw the following error: + +```sh +$ curl --cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" +curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34' +``` + +::: + +Using `openssl`, the certificate of the service can be validated with the `mesh-ca.pem`: + +```sh +openssl s_client -CAfile verify/mesh-ca.pem -verify_return_error -connect ${frontendIP}:443 < /dev/null +``` + +## Recover the Coordinator + +If the Contrast Coordinator restarts, it enters recovery mode and waits for an operator to provide key material. +For demonstration purposes, you can simulate this scenario by deleting the Coordinator pod. + +```sh +kubectl delete pod -l app.kubernetes.io/name=coordinator +``` + +Kubernetes schedules a new pod, but that pod doesn't have access to the key material the previous pod held in memory and can't issue certificates for workloads yet. +You can confirm this by running `verify` again, or you can restart a workload pod, which should stay in the initialization phase. +However, the secret seed in your working directory is sufficient to recover the coordinator. + +```sh +contrast recover -c "${coordinator}:1313" +``` + +Now that the Coordinator is recovered, all workloads should pass initialization and enter the running state. +You can now verify the Coordinator again, which should return the same manifest you set before. + +:::warning + +The recovery process invalidates the mesh CA certificate: +existing workloads won't be able to communicate with workloads newly spawned. +All workloads should be restarted after the recovery succeeded. + +::: + +:::warning +On bare metal, the [coordinator policy hash](components/policies.md#platform-differences) must be overwritten using `--coordinator-policy-hash`. +::: diff --git a/docs/versioned_docs/version-1.2/examples/emojivoto.md b/docs/versioned_docs/version-1.2/examples/emojivoto.md new file mode 100644 index 0000000000..23ef9d118d --- /dev/null +++ b/docs/versioned_docs/version-1.2/examples/emojivoto.md @@ -0,0 +1,297 @@ +# Confidential emoji voting + + + +![screenshot of the emojivoto UI](../_media/emoijvoto.png) + +**This tutorial guides you through deploying [emojivoto](https://github.com/BuoyantIO/emojivoto) as a +confidential Contrast deployment and validating the deployment from a voter's perspective.** + +Emojivoto is an example app allowing users to vote for different emojis and view votes +on a leader board. It has a microservice architecture consisting of a +web frontend (`web`), a gRPC backend for listing available emojis (`emoji`), and a backend for +the voting and leader board logic (`voting`). The `vote-bot` simulates user traffic by submitting +votes to the frontend. + +Emojivoto can be seen as a lighthearted example of an app dealing with sensitive data. +Contrast protects emojivoto in two ways. First, it shields emojivoto as a whole from the infrastructure, for example, Azure. +Second, it can be configured to also prevent data access even from the administrator of the app. In the case of emojivoto, this gives assurance to users that their votes remain secret. + + + +![emojivoto components topology](https://raw.githubusercontent.com/BuoyantIO/emojivoto/e490d5789086e75933a474b22f9723fbfa0b29ba/assets/emojivoto-topology.png) + +## Prerequisites + +- Installed Contrast CLI +- A running Kubernetes cluster with support for confidential containers, either on [AKS](../getting-started/cluster-setup.md) or on [bare metal](../getting-started/bare-metal.md). + +## Steps to deploy emojivoto with Contrast + +### Download the deployment files + +The emojivoto deployment files are part of the Contrast release. You can download them by running: + +```sh +curl -fLO https://github.com/edgelesssys/contrast/releases/latest/download/emojivoto-demo.yml --create-dirs --output-dir deployment +``` + +### Deploy the Contrast runtime + +Contrast depends on a [custom Kubernetes RuntimeClass](../components/runtime.md), +which needs to be installed to the cluster initially. +This consists of a `RuntimeClass` resource and a `DaemonSet` that performs installation on worker nodes. +This step is only required once for each version of the runtime. +It can be shared between Contrast deployments. + + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-aks-clh-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-tdx.yml +``` + + + +### Deploy the Contrast Coordinator + +Deploy the Contrast Coordinator, comprising a single replica deployment and a +LoadBalancer service, into your cluster: + + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-aks-clh-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-tdx.yml +``` + + + +### Generate policy annotations and manifest + +Run the `generate` command to generate the execution policies and add them as +annotations to your deployment files. A `manifest.json` file with the reference values +of your deployment will be created: + + + +```sh +contrast generate --reference-values aks-clh-snp deployment/ +``` + + +```sh +contrast generate --reference-values k3s-qemu-snp deployment/ +``` +:::note[Missing TCB values] +On bare-metal SEV-SNP, `contrast generate` is unable to fill in the `MinimumTCB` values as they can vary between platforms. +They will have to be filled in manually. +If you don't know the correct values use `{"BootloaderVersion":255,"TEEVersion":255,"SNPVersion":255,"MicrocodeVersion":255}` and observe the real values in the error messages in the following steps. This should only be done in a secure environment. Note that the values will differ between CPU models. +::: + + +```sh +contrast generate --reference-values k3s-qemu-tdx deployment/ +``` +:::note[Missing TCB values] +On bare-metal TDX, `contrast generate` is unable to fill in the `MinimumTeeTcbSvn` and `MrSeam` TCB values as they can vary between platforms. +They will have to be filled in manually. +If you don't know the correct values use `ffffffffffffffffffffffffffffffff` and `000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000` respectively and observe the real values in the error messages in the following steps. This should only be done in a secure environment. +::: + + + +:::note[Runtime class and Initializer] + +The deployment YAML shipped for this demo is already configured to be used with Contrast. +A [runtime class](../components/runtime) `contrast-cc` +was added to the pods to signal they should be run as Confidential Containers. During the generation process, +the Contrast [Initializer](../components/overview.md#the-initializer) will be added as an init container to these +workloads to facilitate the attestation and certificate pulling before the actual workload is started. + +Further, the deployment YAML is also configured with the Contrast [service mesh](../components/service-mesh.md). +The configured service mesh proxy provides transparent protection for the communication between +the different components of emojivoto. +::: + +### Set the manifest + +Configure the coordinator with a manifest. It might take up to a few minutes +for the load balancer to be created and the Coordinator being available. + +```sh +coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') +echo "The user API of your Contrast Coordinator is available at $coordinator:1313" +contrast set -c "${coordinator}:1313" deployment/ +``` + +The CLI will use the reference values from the manifest to attest the Coordinator deployment +during the TLS handshake. If the connection succeeds, it's ensured that the Coordinator +deployment hasn't been tampered with. + +:::warning +On bare metal, the [coordinator policy hash](components/policies.md#platform-differences) must be overwritten using `--coordinator-policy-hash`. +::: + +### Deploy emojivoto + +Now that the coordinator has a manifest set, which defines the emojivoto deployment as an allowed workload, +we can deploy the application: + +```sh +kubectl apply -f deployment/ +``` + +:::note[Inter-deployment communication] + +The Contrast Coordinator issues mesh certificates after successfully validating workloads. +These certificates can be used for secure inter-deployment communication. The Initializer +sends an attestation report to the Coordinator, retrieves certificates and a private key in return +and writes them to a `volumeMount`. The service mesh sidecar is configured to use the credentials +from the `volumeMount` when communicating with other parts of the deployment over mTLS. +The public facing frontend for voting uses the mesh certificate without client authentication. + +::: + +## Verifying the deployment as a user + +In different scenarios, users of an app may want to verify its security and identity before sharing data, for example, before casting a vote. +With Contrast, a user only needs a single remote-attestation step to verify the deployment - regardless of the size or scale of the deployment. +Contrast is designed such that, by verifying the Coordinator, the user transitively verifies those systems the Coordinator has already verified or will verify in the future. +Successful verification of the Coordinator means that the user can be sure that the given manifest will be enforced. + +### Verifying the Coordinator + +A user can verify the Contrast deployment using the verify +command: + +```sh +contrast verify -c "${coordinator}:1313" -m manifest.json +``` + +The CLI will verify the Coordinator via remote attestation using the reference values from a given manifest. This manifest needs +to be communicated out of band to everyone wanting to verify the deployment, as the `verify` command checks +if the currently active manifest at the Coordinator matches the manifest given to the CLI. If the command succeeds, +the Coordinator deployment was successfully verified to be running in the expected Confidential +Computing environment with the expected code version. The Coordinator will then return its +configuration over the established TLS channel. The CLI will store this information, namely the root +certificate of the mesh (`mesh-ca.pem`) and the history of manifests, into the `verify/` directory. +In addition, the policies referenced in the manifest history are also written into the same directory. + +:::warning +On bare metal, the [coordinator policy hash](components/policies.md#platform-differences) must be overwritten using `--coordinator-policy-hash`. +::: + +### Auditing the manifest history and artifacts + +In the next step, the Coordinator configuration that was written by the `verify` command needs to be audited. +A potential voter should inspect the manifest and the referenced policies. They could delegate +this task to an entity they trust. + +### Connecting securely to the application + +After ensuring the configuration of the Coordinator fits the expectation, the user can securely connect +to the application using the Coordinator's `mesh-ca.pem` as a trusted CA certificate. + +To access the web frontend, expose the service on a public IP address via a LoadBalancer service: + +```sh +frontendIP=$(kubectl get svc web-svc -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') +echo "Frontend is available at https://$frontendIP, you can visit it in your browser." +``` + +Using `openssl`, the certificate of the service can be validated with the `mesh-ca.pem`: + +```sh +openssl s_client -CAfile verify/mesh-ca.pem -verify_return_error -connect ${frontendIP}:443 < /dev/null +``` + +## Updating the certificate SAN and the manifest (optional) + +By default, mesh certificates are issued with a wildcard DNS entry. The web frontend is accessed +via load balancer IP in this demo. Tools like curl check the certificate for IP entries in the subject alternative name (SAN) field. +Validation fails since the certificate contains no IP entries as a SAN. +For example, a connection attempt using the curl and the mesh CA certificate with throw the following error: + +```sh +$ curl --cacert ./verify/mesh-ca.pem "https://${frontendIP}:443" +curl: (60) SSL: no alternative certificate subject name matches target host name '203.0.113.34' +``` + +### Configuring the service SAN in the manifest + +The `Policies` section of the manifest maps policy hashes to a list of SANs. To enable certificate verification +of the web frontend with tools like curl, edit the policy with your favorite editor and add the `frontendIP` to +the list that already contains the `"web"` DNS entry: + +```diff + "Policies": { + ... + "99dd77cbd7fe2c4e1f29511014c14054a21a376f7d58a48d50e9e036f4522f6b": { + "SANs": [ + "web", +- "*" ++ "*", ++ "203.0.113.34" + ], + "WorkloadSecretID": "web" + }, +``` + +### Updating the manifest + +Next, set the changed manifest at the coordinator with: + +```sh +contrast set -c "${coordinator}:1313" deployment/ +``` + +The Contrast Coordinator will rotate the mesh ca certificate on the manifest update. Workload certificates issued +after the manifest update are thus issued by another certificate authority and services receiving the new CA certificate chain +won't trust parts of the deployment that got their certificate issued before the update. This way, Contrast ensures +that parts of the deployment that received a security update won't be infected by parts of the deployment at an older +patch level that may have been compromised. The `mesh-ca.pem` is updated with the new CA certificate chain. + +:::warning +On bare metal, the [coordinator policy hash](components/policies.md#platform-differences) must be overwritten using `--coordinator-policy-hash`. +::: + +### Rolling out the update + +The Coordinator has the new manifest set, but the different containers of the app are still +using the older certificate authority. The Contrast Initializer terminates after the initial attestation +flow and won't pull new certificates on manifest updates. + +To roll out the update, use: + +```sh +kubectl rollout restart deployment/emoji +kubectl rollout restart deployment/vote-bot +kubectl rollout restart deployment/voting +kubectl rollout restart deployment/web +``` + +After the update has been rolled out, connecting to the frontend using curl will successfully validate +the service certificate and return the HTML document of the voting site: + +```sh +curl --cacert ./mesh-ca.pem "https://${frontendIP}:443" +``` diff --git a/docs/versioned_docs/version-1.2/examples/mysql.md b/docs/versioned_docs/version-1.2/examples/mysql.md new file mode 100644 index 0000000000..2077ad29d2 --- /dev/null +++ b/docs/versioned_docs/version-1.2/examples/mysql.md @@ -0,0 +1,259 @@ +# Encrypted volume mount + +**This tutorial guides you through deploying a simple application with an +encrypted MySQL database using the Contrast [workload +secret](../architecture/secrets.md#workload-secrets).** + +[MySQL](https://mysql.com) is an open-source database used to organize data into +tables and quickly retrieve information about its content. All of the data in a +MySQL database is stored in the `/var/lib/mysql` directory. In this example, we +use the workload secret to setup an encrypted LUKS mount for the +`/var/lib/mysql` directory to easily deploy an application with encrypted +persistent storage using Contrast. + +The resources provided in this demo are designed for educational purposes and +shouldn't be used in a production environment without proper evaluation. When +working with persistent storage, regular backups are recommended in order to +prevent data loss. For confidential applications, please also refer to the +[security considerations](../architecture/security-considerations.md). Also be +aware of the differences in security implications of the workload secrets for +the data owner and the workload owner. For more details, see the [Workload +Secrets](../architecture/secrets.md#workload-secrets) documentation. + +## Prerequisites + +- Installed Contrast CLI +- A running Kubernetes cluster with support for confidential containers, either on [AKS](../getting-started/cluster-setup.md) or on [bare metal](../getting-started/bare-metal.md) + +## Steps to deploy MySQL with Contrast + +### Download the deployment files + +The MySQL deployment files are part of the Contrast release. You can download them by running: + +```sh +curl -fLO https://github.com/edgelesssys/contrast/releases/latest/download/mysql-demo.yml --create-dirs --output-dir deployment +``` + +### Deploy the Contrast runtime + +Contrast depends on a [custom Kubernetes `RuntimeClass`](../components/runtime.md), +which needs to be installed to the cluster initially. +This consists of a `RuntimeClass` resource and a `DaemonSet` that performs installation on worker nodes. +This step is only required once for each version of the runtime. +It can be shared between Contrast deployments. + + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-aks-clh-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-tdx.yml +``` + + + +### Deploy the Contrast Coordinator + +Deploy the Contrast Coordinator, comprising a single replica deployment and a +`LoadBalancer` service, into your cluster: + + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-aks-clh-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-snp.yml +``` + + +```sh +kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-tdx.yml +``` + + + +### Generate policy annotations and manifest + +Run the `generate` command to generate the execution policies and add them as +annotations to your deployment files. A `manifest.json` file with the reference values +of your deployment will be created: + + + +```sh +contrast generate --reference-values aks-clh-snp deployment/ +``` + + +```sh +contrast generate --reference-values k3s-qemu-snp deployment/ +``` +:::note[Missing TCB values] +On bare-metal SEV-SNP, `contrast generate` is unable to fill in the `MinimumTCB` values as they can vary between platforms. +They will have to be filled in manually. +If you don't know the correct values use `{"BootloaderVersion":255,"TEEVersion":255,"SNPVersion":255,"MicrocodeVersion":255}` and observe the real values in the error messages in the following steps. This should only be done in a secure environment. Note that the values will differ between CPU models. +::: + + +```sh +contrast generate --reference-values k3s-qemu-tdx deployment/ +``` +:::note[Missing TCB values] +On bare-metal TDX, `contrast generate` is unable to fill in the `MinimumTeeTcbSvn` and `MrSeam` TCB values as they can vary between platforms. +They will have to be filled in manually. +If you don't know the correct values use `ffffffffffffffffffffffffffffffff` and `000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000` respectively and observe the real values in the error messages in the following steps. This should only be done in a secure environment. +::: + + + +:::note[Runtime class and Initializer] + +The deployment YAML shipped for this demo is already configured to be used with Contrast. +A [runtime class](../components/runtime) `contrast-cc` +was added to the pods to signal they should be run as Confidential Containers. During the generation process, +the Contrast [Initializer](../components/overview.md#the-initializer) will be added as an init container to these +workloads. It will attest the pod to the Coordinator and fetch the workload certificates and the workload secret. + +Further, the deployment YAML is also configured with the Contrast [service mesh](../components/service-mesh.md). +The configured service mesh proxy provides transparent protection for the communication between +the MySQL server and client. +::: + +### Set the manifest + +Configure the coordinator with a manifest. It might take up to a few minutes +for the load balancer to be created and the Coordinator being available. + +```sh +coordinator=$(kubectl get svc coordinator -o=jsonpath='{.status.loadBalancer.ingress[0].ip}') +echo "The user API of your Contrast Coordinator is available at $coordinator:1313" +contrast set -c "${coordinator}:1313" deployment/ +``` + +The CLI will use the reference values from the manifest to attest the Coordinator deployment +during the TLS handshake. If the connection succeeds, it's ensured that the Coordinator +deployment hasn't been tampered with. + +:::warning +On bare metal, the [coordinator policy hash](components/policies.md#platform-differences) must be overwritten using `--coordinator-policy-hash`. +::: + +### Deploy MySQL + +Now that the coordinator has a manifest set, which defines the MySQL deployment as an allowed workload, +we can deploy the application: + +```sh +kubectl apply -f deployment/ +``` + +:::note[Persistent workload secrets] + +During the initialization process of the workload pod, the Contrast Initializer +sends an attestation report to the Coordinator and receives a workload secret +derived from the Coordinator's secret seed and the workload secret ID specified in the +manifest, and writes it to a secure in-memory `volumeMount`. + +::: + +The MySQL deployment is declared as a StatefulSet with a mounted block device. +An init container running `cryptsetup` uses the workload secret at +`/contrast/secrets/workload-secret-seed` to generate a key and setup the block +device as a LUKS partition. Before starting the MySQL container, the init +container uses the generated key to open the LUKS device, which is then mounted +by the MySQL container. For the MySQL container, this process is completely +transparent and works like mounting any other volume. The `cryptsetup` container +will remain running to provide the necessary decryption context for the workload +container. + +## Verifying the deployment as a user + +In different scenarios, users of an app may want to verify its security and identity before sharing data, for example, before connecting to the database. +With Contrast, a user only needs a single remote-attestation step to verify the deployment - regardless of the size or scale of the deployment. +Contrast is designed such that, by verifying the Coordinator, the user transitively verifies those systems the Coordinator has already verified or will verify in the future. +Successful verification of the Coordinator means that the user can be sure that the given manifest will be enforced. + +### Verifying the Coordinator + +A user can verify the Contrast deployment using the verify +command: + +```sh +contrast verify -c "${coordinator}:1313" -m manifest.json +``` + +The CLI will verify the Coordinator via remote attestation using the reference values from a given manifest. This manifest needs +to be communicated out of band to everyone wanting to verify the deployment, as the `verify` command checks +if the currently active manifest at the Coordinator matches the manifest given to the CLI. If the command succeeds, +the Coordinator deployment was successfully verified to be running in the expected Confidential +Computing environment with the expected code version. The Coordinator will then return its +configuration over the established TLS channel. The CLI will store this information, namely the root +certificate of the mesh (`mesh-ca.pem`) and the history of manifests, into the `verify/` directory. +In addition, the policies referenced in the manifest history are also written into the same directory. + +:::warning +On bare metal, the [coordinator policy hash](components/policies.md#platform-differences) must be overwritten using `--coordinator-policy-hash`. +::: + +### Auditing the manifest history and artifacts + +In the next step, the Coordinator configuration that was written by the `verify` command needs to be audited. +A user of the application should inspect the manifest and the referenced policies. They could delegate +this task to an entity they trust. + +### Connecting to the application + +Other confidential containers can securely connect to the MySQL server via the +[Service Mesh](../components/service-mesh.md). The configured `mysql-client` +deployment connects to the MySQL server and inserts test data into a table. To +view the logs of the `mysql-client` deployment, use the following commands: + +```sh +kubectl logs -l app.kubernetes.io/name=mysql-client -c mysql-client +``` + +The Service Mesh ensures an mTLS connection between the MySQL client and server +using the mesh certificates. As a result, no other workload can connect to the +MySQL server unless explicitly allowed in the manifest. + +## Updating the deployment + +Because the workload secret is derived from the `WorkloadSecredID` specified in +the manifest and not to an individual pod, once the pod restarts, the +`cryptsetup` init container can deterministically generate the same key again +and open the already partitioned LUKS device. +For more information on using the workload secret, see [Workload +Secrets](../architecture/secrets.md#workload-secrets). + +For example, after making changes to the deployment files, the runtime policies +need to be regenerated with `contrast generate` and the new manifest needs to be +set using `contrast set`. + +```sh +contrast generate deployment/ +contrast set -c "${coordinator}:1313" deployment/ +``` + +The new deployment can then be applied by running: + +```sh +kubectl rollout restart statefulset/mysql-backend +kubectl rollout restart deployment/mysql-client +``` + +The new MySQL backend pod will then start up the `cryptsetup` init container which +receives the same workload secret as before and can therefore generate the +correct key to open the LUKS device. All previously stored data in the MySQL +database is available in the newly created pod in an encrypted volume mount. diff --git a/docs/versioned_docs/version-1.2/features-limitations.md b/docs/versioned_docs/version-1.2/features-limitations.md new file mode 100644 index 0000000000..69a1c028ef --- /dev/null +++ b/docs/versioned_docs/version-1.2/features-limitations.md @@ -0,0 +1,43 @@ +# Planned features and limitations + +This section lists planned features and current limitations of Contrast. + +## Availability + +- **Platform support**: At present, Contrast is exclusively available on Azure AKS, supported by the [Confidential Container preview for AKS](https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview). Expansion to other cloud platforms is planned, pending the availability of necessary infrastructure enhancements. +- **Bare-metal support**: Support for running [Contrast on bare-metal Kubernetes](getting-started/bare-metal.md) is available for AMD SEV-SNP and Intel TDX. + +## Kubernetes features + +- **Persistent volumes**: Contrast only supports volumes with [`volumeMode: Block`](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#volume-mode). These block devices are provided by the untrusted environment and should be treated accordingly. We plan to provide transparent encryption on top of block devices in a future release. +- **Port forwarding**: This feature [isn't yet supported by Kata Containers](https://github.com/kata-containers/kata-containers/issues/1693). You can [deploy a port-forwarder](https://docs.edgeless.systems/contrast/deployment#connect-to-the-contrast-coordinator) as a workaround. +- **Resource limits**: There is an existing bug on AKS where container memory limits are incorrectly applied. The current workaround involves using only memory requests instead of limits. + +## Runtime policies + +- **Coverage**: While the enforcement of workload policies generally functions well, [there are scenarios not yet fully covered](https://github.com/microsoft/kata-containers/releases/tag/3.2.0.azl0.genpolicy). It's crucial to review deployments specifically for these edge cases. +- **Order of events**: The current policy evaluation mechanism on API requests isn't stateful, so it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the [service mesh sidecar](components/service-mesh.md) container runs *before* the workload container. This order ensures that all traffic between pods is securely encapsulated within TLS connections. +- **Absence of events**: Policies can't ensure certain events have happened. A container, such as the [service mesh sidecar](components/service-mesh.md), can be omitted entirely. Environment variables may be missing. +- **Volume integrity checks**: Integrity checks don't cover any volume mounts, such as `ConfigMaps` and `Secrets`. + +:::warning +The policy limitations, in particular the missing guarantee that our service mesh sidecar has been started before the workload container, affect the service mesh implementation of Contrast. +Currently, this requires inspecting the iptables rules on startup or terminating TLS connections in the workload directly. +::: + +## Tooling integration + +- **CLI availability**: The CLI tool is currently only available for Linux. This limitation arises because certain upstream dependencies haven't yet been ported to other platforms. + +## Automatic recovery and high availability + +The Contrast Coordinator is a singleton and can't be scaled to more than one instance. +When this instance's pod is restarted, for example for node maintenance, it needs to be recovered manually. +In a future release, we plan to support distributed Coordinator instances that can recover automatically. + +## Overriding Kata configuration + +Kata Containers supports [overriding certain configuration values via Kubernetes annotations](https://github.com/kata-containers/kata-containers/blob/b4da4b5e3b9b21048af9333b071235a57a3e9493/docs/how-to/how-to-set-sandbox-config-kata.md). + +It needs to be noted that setting these values is unsupported, and doing so may lead to unexpected +behaviour, as Contrast isn't tested against all possible configuration combinations. diff --git a/docs/versioned_docs/version-1.2/getting-started/bare-metal.md b/docs/versioned_docs/version-1.2/getting-started/bare-metal.md new file mode 100644 index 0000000000..e5908fe336 --- /dev/null +++ b/docs/versioned_docs/version-1.2/getting-started/bare-metal.md @@ -0,0 +1,34 @@ +# Prepare a bare-metal instance + +## Hardware and firmware setup + + + +1. Update your BIOS to a version that supports AMD SEV-SNP. Updating to the latest available version is recommended as newer versions will likely contain security patches for AMD SEV-SNP. +2. Enter BIOS setup to enable SMEE, IOMMU, RMP coverage, and SEV-SNP. Set the SEV-ES ASID Space Limit to a non-zero number (higher is better). +3. Download the latest firmware version for your processor from [AMD](https://www.amd.com/de/developer/sev.html), unpack it, and place it in `/lib/firmware/amd`. + +Consult AMD's [Using SEV with AMD EPYC Processors user guide](https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/tuning-guides/58207-using-sev-with-amd-epyc-processors.pdf) for more information. + + +Follow Canonical's instructions on [setting up Intel TDX in the host's BIOS](https://github.com/canonical/tdx?tab=readme-ov-file#43-enable-intel-tdx-in-the-hosts-bios). + + + +## Kernel Setup + + + +Install a kernel with version 6.11 or greater. If you're following this guide before 6.11 has been released, use 6.11-rc3. Don't use 6.11-rc4 - 6.11-rc6 as they contain a regression. 6.11-rc7+ might work. + + +Follow Canonical's instructions on [setting up Intel TDX on Ubuntu 24.04](https://github.com/canonical/tdx?tab=readme-ov-file#41-install-ubuntu-2404-server-image). Note that Contrast currently only supports Intel TDX with Ubuntu 24.04. + + + +Increase the `user.max_inotify_instances` sysctl limit by adding `user.max_inotify_instances=8192` to `/etc/sysctl.d/99-sysctl.conf` and running `sysctl --system`. + +## K3s Setup + +1. Follow the [K3s setup instructions](https://docs.k3s.io/) to create a cluster. +2. Install a block storage provider such as [Longhorn](https://docs.k3s.io/storage#setting-up-longhorn) and mark it as the default storage class. diff --git a/docs/versioned_docs/version-1.2/getting-started/cluster-setup.md b/docs/versioned_docs/version-1.2/getting-started/cluster-setup.md new file mode 100644 index 0000000000..968c932395 --- /dev/null +++ b/docs/versioned_docs/version-1.2/getting-started/cluster-setup.md @@ -0,0 +1,146 @@ +# Create a cluster + +## Prerequisites + +* Install version 2.44.1 or newer of the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/). Note that your package manager will likely install an outdated version. +* Install a recent version of [kubectl](https://kubernetes.io/docs/tasks/tools/). + +## Prepare using the AKS preview + +First, log in to your Azure subscription: + +```bash +az login +``` + +CoCo on AKS is currently in preview. An extension for the `az` CLI is needed to create such a cluster. +Add the extension with the following commands: + +```bash +az extension add \ + --name aks-preview \ + --allow-preview true +az extension update \ + --name aks-preview \ + --allow-preview true +``` + +Then register the required feature flags in your subscription to allow access to the public preview: + +```bash +az feature register \ + --namespace "Microsoft.ContainerService" \ + --name "KataCcIsolationPreview" +``` + +The registration can take a few minutes. The status of the operation can be checked with the following +command, which should show the registration state as `Registered`: + +```sh +az feature show \ + --namespace "Microsoft.ContainerService" \ + --name "KataCcIsolationPreview" \ + --output table +``` + +Afterward, refresh the registration of the ContainerService provider: + +```sh +az provider register \ + --namespace "Microsoft.ContainerService" +``` + +## Create resource group + +The AKS with CoCo preview is currently available in the following locations: + +``` +CentralIndia +eastus +EastUS2EUAP +GermanyWestCentral +japaneast +northeurope +SwitzerlandNorth +UAENorth +westeurope +westus +``` + +Set the name of the resource group you want to use: + +```bash +azResourceGroup="ContrastDemo" +``` + +You can either use an existing one or create a new resource group with the following command: + +```bash +azLocation="westus" # Select a location from the list above + +az group create \ + --name "${azResourceGroup:?}" \ + --location "${azLocation:?}" +``` + +## Create AKS cluster + +First, create a CoCo enabled AKS cluster with: + +```sh +# Select the name for your AKS cluster +azClusterName="ContrastDemo" + +az aks create \ + --resource-group "${azResourceGroup:?}" \ + --name "${azClusterName:?}" \ + --kubernetes-version 1.30 \ + --os-sku AzureLinux \ + --node-vm-size Standard_DC4as_cc_v5 \ + --workload-runtime KataCcIsolation \ + --node-count 1 \ + --generate-ssh-keys +``` + +Finally, update your kubeconfig with the credentials to access the cluster: + +```bash +az aks get-credentials \ + --resource-group "${azResourceGroup:?}" \ + --name "${azClusterName:?}" +``` + +For validation, list the available nodes using `kubectl`: + +```bash +kubectl get nodes +``` + +It should show a single node: + +```bash +NAME STATUS ROLES AGE VERSION +aks-nodepool1-32049705-vmss000000 Ready 9m47s v1.29.0 +``` + +🥳 Congratulations. You're now ready to set up your first application with Contrast. Follow this [example](../examples/emojivoto.md) to learn how. + +## Cleanup + +After trying out Contrast, you might want to clean up the cloud resources created in this step. +In case you've created a new resource group, you can just delete that group with + +```sh +az group delete \ + --name "${azResourceGroup:?}" +``` + +Deleting the resource group will also delete the cluster and all other related resources. + +To only cleanup the AKS cluster and node pools, run + +```sh +az aks delete \ + --resource-group "${azResourceGroup:?}" \ + --name "${azClusterName:?}" +``` diff --git a/docs/versioned_docs/version-1.2/getting-started/install.md b/docs/versioned_docs/version-1.2/getting-started/install.md new file mode 100644 index 0000000000..43aeb46d32 --- /dev/null +++ b/docs/versioned_docs/version-1.2/getting-started/install.md @@ -0,0 +1,13 @@ +# Installation + +Download the Contrast CLI from the latest release: + +```bash +curl --proto '=https' --tlsv1.2 -fLo contrast https://github.com/edgelesssys/contrast/releases/latest/download/contrast +``` + +After that, install the Contrast CLI in your PATH, e.g.: + +```bash +sudo install contrast /usr/local/bin/contrast +``` diff --git a/docs/versioned_docs/version-1.2/intro.md b/docs/versioned_docs/version-1.2/intro.md new file mode 100644 index 0000000000..48e2d2be75 --- /dev/null +++ b/docs/versioned_docs/version-1.2/intro.md @@ -0,0 +1,41 @@ +--- +slug: / +id: intro +--- + +# Contrast + +Welcome to the documentation of Contrast! Contrast runs confidential container deployments on Kubernetes at scale. + +![Contrast concept](/img/concept.svg) + +Contrast is based on the [Kata Containers](https://github.com/kata-containers/kata-containers) and +[Confidential Containers](https://github.com/confidential-containers) projects. +Confidential Containers are Kubernetes pods that are executed inside a confidential micro-VM and provide strong hardware-based isolation from the surrounding environment. +This works with unmodified containers in a lift-and-shift approach. +Contrast currently targets the [CoCo preview on AKS](https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-containers-on-aks-preview). + +:::tip +See the 📄[whitepaper](https://content.edgeless.systems/hubfs/Confidential%20Computing%20Whitepaper.pdf) for more information on confidential computing. +::: + +## Goal + +Contrast is designed to keep all data always encrypted and to prevent access from the infrastructure layer. It removes the infrastructure provider from the trusted computing base (TCB). This includes access from datacenter employees, privileged cloud admins, own cluster administrators, and attackers coming through the infrastructure, for example, malicious co-tenants escalating their privileges. + +Contrast integrates fluently with the existing Kubernetes workflows. It's compatible with managed Kubernetes, can be installed as a day-2 operation and imposes only minimal changes to your deployment flow. + +## Use Cases + +Contrast provides unique security [features](basics/features.md) and [benefits](basics/security-benefits.md). The core use cases are: + +* Increasing the security of your containers +* Moving sensitive workloads from on-prem to the cloud with Confidential Computing +* Shielding the code and data even from the own cluster administrators +* Increasing the trustworthiness of your SaaS offerings +* Simplifying regulatory compliance +* Multi-party computation for data collaboration + +## Next steps + +You can learn more about the concept of [Confidential Containers](basics/confidential-containers.md), [features](basics/features.md), and [security benefits](basics/security-benefits.md) of Contrast in this section. To jump right into the action head to [*Getting started*](getting-started/install.md). diff --git a/docs/versioned_docs/version-1.2/troubleshooting.md b/docs/versioned_docs/version-1.2/troubleshooting.md new file mode 100644 index 0000000000..b61b06f726 --- /dev/null +++ b/docs/versioned_docs/version-1.2/troubleshooting.md @@ -0,0 +1,166 @@ +# Troubleshooting + +This section contains information on how to debug your Contrast deployment. + +## Logging + +Collecting logs can be a good first step to identify problems in your +deployment. Both the CLI and the Contrast Coordinator as well as the Initializer +can be configured to emit additional logs. + +### CLI + +The CLI logs can be configured with the `--log-level` command-line flag, which +can be set to either `debug`, `info`, `warn` or `error`. The default is `info`. +Setting this to `debug` can get more fine-grained information as to where the +problem lies. + +### Coordinator and Initializer + +The logs from the Coordinator and the Initializer can be configured via the +environment variables `CONTRAST_LOG_LEVEL`, `CONTRAST_LOG_FORMAT` and +`CONTRAST_LOG_SUBSYSTEMS`. + +- `CONTRAST_LOG_LEVEL` can be set to one of either `debug`, `info`, `warn`, or + `error`, similar to the CLI (defaults to `info`). +- `CONTRAST_LOG_FORMAT` can be set to `text` or `json`, determining the output + format (defaults to `text`). +- `CONTRAST_LOG_SUBSYSTEMS` is a comma-separated list of subsystems that should + be enabled for logging, which are disabled by default. Subsystems include: + `kds-getter`, `issuer` and `validator`. + To enable all subsystems, use `*` as the value for this environment variable. + Warnings and error messages from subsystems get printed regardless of whether + the subsystem is listed in the `CONTRAST_LOG_SUBSYSTEMS` environment variable. + +To configure debug logging with all subsystems for your Coordinator, add the +following variables to your container definition. + +```yaml +spec: # v1.PodSpec + containers: + image: "ghcr.io/edgelesssys/contrast/coordinator:latest" + name: coordinator + env: + - name: CONTRAST_LOG_LEVEL + value: debug + - name: CONTRAST_LOG_SUBSYSTEMS + value: "*" + # ... +``` + +:::info + +While the Contrast Coordinator has a policy that allows certain configurations, +the Initializer and service mesh don't. When changing environment variables of other +parts than the Coordinator, ensure to rerun `contrast generate` to update the policy. + +::: + +To access the logs generated by the Coordinator, you can use `kubectl` with the +following command: + +```sh +kubectl logs +``` + +## Pod fails to start + +If the Coordinator or a workload pod fails to even start, it can be helpful to +look at the events of the pod during the startup process using the `describe` +command. + +```sh +kubectl -n events --for pod/ +``` + +Example output: + +``` +LAST SEEN TYPE REASON OBJECT MESSAGE +32m Warning Failed Pod/coordinator-0 kubelet Error: failed to create containerd task: failed to create shim task: "CreateContainerRequest is blocked by policy: ... +``` + +A common error, as in this example, is that the container creation was blocked by the +policy. Potential reasons are a modification of the deployment YAML without updating +the policies afterward, or a version mismatch between Contrast components. + +### Regenerating the policies + +To ensure there isn't a mismatch between Kubernetes resource YAML and the annotated +policies, rerun + +```sh +contrast generate +``` + +on your deployment. If any of the policy annotations change, re-deploy with the updated policies. + +### Pin container images + +When generating the policies, Contrast will download the images specified in your deployment +YAML and include their cryptographic identity. If the image tag is moved to another +container image after the policy has been generated, the image downloaded at deploy time +will differ from the one at generation time, and the policy enforcement won't allow the +container to be started in the pod VM. + +To ensure the correct image is always used, pin the container image to a fixed `sha256`: + +```yaml +image: ubuntu:22.04@sha256:19478ce7fc2ffbce89df29fea5725a8d12e57de52eb9ea570890dc5852aac1ac +``` + +This way, the same image will still be pulled when the container tag (`22.04`) is moved +to another image. + +### Validate Contrast components match + +A version mismatch between Contrast components can cause policy validation or attestation +to fail. Each Contrast runtime is identifiable based on its (shortened) measurement value +used to name the runtime class version. + +First, analyze which runtime class is currently installed in your cluster by running + +```sh +kubectl get runtimeclasses +``` + +This should give you output similar to the following one. + +```sh +NAME HANDLER AGE +contrast-cc-aks-clh-snp-7173acb5 contrast-cc-aks-clh-snp-7173acb5 23h +kata-cc-isolation kata-cc 45d +``` + +The output shows that there are four Contrast runtime classes installed (as well as the runtime class provided +by the AKS CoCo preview, which isn't used by Contrast). + +Next, check if the pod that won't start has the correct runtime class configured, and the +Coordinator uses the exact same runtime: + +```sh +kubectl -n get -o=jsonpath='{.spec.runtimeClassName}' pod/ +kubectl -n get -o=jsonpath='{.spec.runtimeClassName}' pod/ +``` + +The output should list the runtime class the pod is using: + +```sh +contrast-cc-aks-clh-snp-7173acb5 +``` + +Version information about the currently used CLI can be obtained via the `version` flag: + +```sh +contrast --version +``` + +```sh +contrast version v0.X.0 + + runtime handler: contrast-cc-aks-clh-snp-7173acb5 + launch digest: beee79ca916b9e5dc59602788cbfb097721cde34943e1583a3918f21011a71c47f371f68e883f5e474a6d4053d931a35 + genpolicy version: 3.2.0.azl1.genpolicy0 + image versions: ghcr.io/edgelesssys/contrast/coordinator@sha256:... + ghcr.io/edgelesssys/contrast/initializer@sha256:... +``` diff --git a/docs/versioned_sidebars/version-1.2-sidebars.json b/docs/versioned_sidebars/version-1.2-sidebars.json new file mode 100644 index 0000000000..add18873de --- /dev/null +++ b/docs/versioned_sidebars/version-1.2-sidebars.json @@ -0,0 +1,152 @@ +{ + "docs": [ + { + "type": "doc", + "label": "What is Contrast?", + "id": "intro" + }, + { + "type": "category", + "label": "Basics", + "collapsed": false, + "items": [ + { + "type": "doc", + "label": "Confidential Containers", + "id": "basics/confidential-containers" + }, + { + "type": "doc", + "label": "Security benefits", + "id": "basics/security-benefits" + }, + { + "type": "doc", + "label": "Features", + "id": "basics/features" + } + ] + }, + { + "type": "category", + "label": "Getting started", + "collapsed": false, + "items": [ + { + "type": "doc", + "label": "Install", + "id": "getting-started/install" + }, + { + "type": "doc", + "label": "Cluster setup", + "id": "getting-started/cluster-setup" + }, + { + "type": "doc", + "label": "Bare metal setup", + "id": "getting-started/bare-metal" + } + ] + }, + { + "type": "category", + "label": "Examples", + "items": [ + { + "type": "doc", + "label": "Confidential emoji voting", + "id": "examples/emojivoto" + }, + { + "type": "doc", + "label": "Encrypted volume mount", + "id": "examples/mysql" + } + ] + }, + { + "type": "doc", + "label": "Workload deployment", + "id": "deployment" + }, + { + "type": "doc", + "label": "Troubleshooting", + "id": "troubleshooting" + }, + { + "type": "category", + "label": "Components", + "items": [ + { + "type": "doc", + "label": "Overview", + "id": "components/overview" + }, + { + "type": "doc", + "label": "Runtime", + "id": "components/runtime" + }, + { + "type": "doc", + "label": "Policies", + "id": "components/policies" + }, + { + "type": "doc", + "label": "Service mesh", + "id": "components/service-mesh" + } + ] + }, + { + "type": "category", + "label": "Architecture", + "items": [ + { + "type": "doc", + "label": "Attestation", + "id": "architecture/attestation" + }, + { + "type": "doc", + "label": "Secrets & recovery", + "id": "architecture/secrets" + }, + { + "type": "doc", + "label": "Certificate authority", + "id": "architecture/certificates" + }, + { + "type": "doc", + "label": "Security considerations", + "id": "architecture/security-considerations" + }, + { + "type": "doc", + "label": "Observability", + "id": "architecture/observability" + } + ] + }, + { + "type": "doc", + "label": "Planned features and limitations", + "id": "features-limitations" + }, + { + "type": "category", + "label": "About", + "items": [ + { + "type": "doc", + "label": "Telemetry", + "id": "about/telemetry" + } + ] + } + ] +} diff --git a/docs/versions.json b/docs/versions.json index 90e042ac40..47dac3a49f 100644 --- a/docs/versions.json +++ b/docs/versions.json @@ -1,4 +1,5 @@ [ + "1.2", "1.1", "1.0", "0.9", From 97774af6494922796a80eb4deb46f35b1849d9ce Mon Sep 17 00:00:00 2001 From: edgelessci Date: Tue, 17 Dec 2024 11:49:33 +0000 Subject: [PATCH 2/4] docs: update release download urls --- .../version-1.2/components/service-mesh.md | 2 +- docs/versioned_docs/version-1.2/deployment.md | 14 +++++++------- .../version-1.2/examples/emojivoto.md | 14 +++++++------- docs/versioned_docs/version-1.2/examples/mysql.md | 14 +++++++------- .../version-1.2/getting-started/install.md | 2 +- docs/versioned_docs/version-1.2/troubleshooting.md | 2 +- 6 files changed, 24 insertions(+), 24 deletions(-) diff --git a/docs/versioned_docs/version-1.2/components/service-mesh.md b/docs/versioned_docs/version-1.2/components/service-mesh.md index b93820be60..5a0216dca0 100644 --- a/docs/versioned_docs/version-1.2/components/service-mesh.md +++ b/docs/versioned_docs/version-1.2/components/service-mesh.md @@ -86,7 +86,7 @@ Contrast service mesh as an init container. - env: - name: CONTRAST_INGRESS_PROXY_CONFIG value: "web#8080#false##metrics#7890#true" - image: "ghcr.io/edgelesssys/contrast/service-mesh-proxy:latest" + image: "ghcr.io/edgelesssys/contrast/service-mesh-proxy:v1.2.0@sha256:756818aff3c61cc4852ef551a2fabfa90269d0b0a53d50c0e32fe448bac4d994" name: contrast-service-mesh restartPolicy: Always securityContext: diff --git a/docs/versioned_docs/version-1.2/deployment.md b/docs/versioned_docs/version-1.2/deployment.md index d8572c5ff0..b3c509f0af 100644 --- a/docs/versioned_docs/version-1.2/deployment.md +++ b/docs/versioned_docs/version-1.2/deployment.md @@ -26,17 +26,17 @@ It can be shared between Contrast deployments. ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-aks-clh-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-aks-clh-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-k3s-qemu-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-tdx.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-k3s-qemu-tdx.yml ``` @@ -49,17 +49,17 @@ LoadBalancer service, into your cluster. ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-aks-clh-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-aks-clh-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-k3s-qemu-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-tdx.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-k3s-qemu-tdx.yml ``` @@ -289,7 +289,7 @@ spec: - env: - name: COORDINATOR_HOST value: coordinator - image: "ghcr.io/edgelesssys/contrast/initializer:latest" + image: "ghcr.io/edgelesssys/contrast/initializer:v1.2.0@sha256:942c019b751762540c45d827c1667e5e9f228ccf72c8cc44f11fc428610d196e" name: contrast-initializer volumeMounts: - mountPath: /contrast diff --git a/docs/versioned_docs/version-1.2/examples/emojivoto.md b/docs/versioned_docs/version-1.2/examples/emojivoto.md index 23ef9d118d..38a42befeb 100644 --- a/docs/versioned_docs/version-1.2/examples/emojivoto.md +++ b/docs/versioned_docs/version-1.2/examples/emojivoto.md @@ -33,7 +33,7 @@ Second, it can be configured to also prevent data access even from the administr The emojivoto deployment files are part of the Contrast release. You can download them by running: ```sh -curl -fLO https://github.com/edgelesssys/contrast/releases/latest/download/emojivoto-demo.yml --create-dirs --output-dir deployment +curl -fLO https://github.com/edgelesssys/contrast/releases/download/v1.2.0/emojivoto-demo.yml --create-dirs --output-dir deployment ``` ### Deploy the Contrast runtime @@ -47,17 +47,17 @@ It can be shared between Contrast deployments. ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-aks-clh-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-aks-clh-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-k3s-qemu-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-tdx.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-k3s-qemu-tdx.yml ``` @@ -70,17 +70,17 @@ LoadBalancer service, into your cluster: ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-aks-clh-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-aks-clh-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-k3s-qemu-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-tdx.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-k3s-qemu-tdx.yml ``` diff --git a/docs/versioned_docs/version-1.2/examples/mysql.md b/docs/versioned_docs/version-1.2/examples/mysql.md index 2077ad29d2..cf50e029de 100644 --- a/docs/versioned_docs/version-1.2/examples/mysql.md +++ b/docs/versioned_docs/version-1.2/examples/mysql.md @@ -32,7 +32,7 @@ Secrets](../architecture/secrets.md#workload-secrets) documentation. The MySQL deployment files are part of the Contrast release. You can download them by running: ```sh -curl -fLO https://github.com/edgelesssys/contrast/releases/latest/download/mysql-demo.yml --create-dirs --output-dir deployment +curl -fLO https://github.com/edgelesssys/contrast/releases/download/v1.2.0/mysql-demo.yml --create-dirs --output-dir deployment ``` ### Deploy the Contrast runtime @@ -46,17 +46,17 @@ It can be shared between Contrast deployments. ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-aks-clh-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-aks-clh-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-k3s-qemu-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/runtime-k3s-qemu-tdx.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/runtime-k3s-qemu-tdx.yml ``` @@ -69,17 +69,17 @@ Deploy the Contrast Coordinator, comprising a single replica deployment and a ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-aks-clh-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-aks-clh-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-snp.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-k3s-qemu-snp.yml ``` ```sh -kubectl apply -f https://github.com/edgelesssys/contrast/releases/latest/download/coordinator-k3s-qemu-tdx.yml +kubectl apply -f https://github.com/edgelesssys/contrast/releases/download/v1.2.0/coordinator-k3s-qemu-tdx.yml ``` diff --git a/docs/versioned_docs/version-1.2/getting-started/install.md b/docs/versioned_docs/version-1.2/getting-started/install.md index 43aeb46d32..1b6e7243ce 100644 --- a/docs/versioned_docs/version-1.2/getting-started/install.md +++ b/docs/versioned_docs/version-1.2/getting-started/install.md @@ -3,7 +3,7 @@ Download the Contrast CLI from the latest release: ```bash -curl --proto '=https' --tlsv1.2 -fLo contrast https://github.com/edgelesssys/contrast/releases/latest/download/contrast +curl --proto '=https' --tlsv1.2 -fLo contrast https://github.com/edgelesssys/contrast/releases/download/v1.2.0/contrast ``` After that, install the Contrast CLI in your PATH, e.g.: diff --git a/docs/versioned_docs/version-1.2/troubleshooting.md b/docs/versioned_docs/version-1.2/troubleshooting.md index b61b06f726..bffaf24e8d 100644 --- a/docs/versioned_docs/version-1.2/troubleshooting.md +++ b/docs/versioned_docs/version-1.2/troubleshooting.md @@ -38,7 +38,7 @@ following variables to your container definition. ```yaml spec: # v1.PodSpec containers: - image: "ghcr.io/edgelesssys/contrast/coordinator:latest" + image: "ghcr.io/edgelesssys/contrast/coordinator:v1.2.0@sha256:458e408cd8f390b258b84a1236464febf63bda08f0be91a585c5a14500564cc8" name: coordinator env: - name: CONTRAST_LOG_LEVEL From 88dc38b00e33cfef5b3a0c445f8d201a68074ce2 Mon Sep 17 00:00:00 2001 From: edgelessci Date: Tue, 17 Dec 2024 11:49:37 +0000 Subject: [PATCH 3/4] packages/contrast-releases: add 1.2.0 --- packages/contrast-releases.json | 40 +++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/packages/contrast-releases.json b/packages/contrast-releases.json index 0afff3ea37..64cc316f98 100644 --- a/packages/contrast-releases.json +++ b/packages/contrast-releases.json @@ -71,6 +71,10 @@ { "version": "v1.1.1", "hash": "sha256-muOarmU9dJYDf/NI2YpgaJQ94FZqq0zPMRF5G56uKtg=" + }, + { + "version": "v1.2.0", + "hash": "sha256-EOcEvjQJVjr9HL+UITSi3nqTENqX/KyRrKH8zHaICdY=" } ], "coordinator-aks-clh-snp.yml": [ @@ -81,6 +85,10 @@ { "version": "v1.1.1", "hash": "sha256-qszhc9royX8inGGwop4VrSDMTHPNy+Ed0xcmRW8Xd7Y=" + }, + { + "version": "v1.2.0", + "hash": "sha256-r+z9mKB7h0poRo6wwqEzmkpBxS4cgg+pgh8EvpOPgi0=" } ], "coordinator-k3s-qemu-snp.yml": [ @@ -91,6 +99,10 @@ { "version": "v1.1.1", "hash": "sha256-XxbzhFw72ijVDSNjkEcfHlI5Hs6992TOLqd256uNS9k=" + }, + { + "version": "v1.2.0", + "hash": "sha256-N7V/ISNu9956b9NlMklDoUdXrFcN/Dr6kXZt9xylLJk=" } ], "coordinator-k3s-qemu-tdx.yml": [ @@ -101,6 +113,10 @@ { "version": "v1.1.1", "hash": "sha256-4JtzXbNikUuIT9F+wWJKZNUkZfcyE/3gB6+SN4kmBwQ=" + }, + { + "version": "v1.2.0", + "hash": "sha256-9I2WB6/gZiv6Y5s155+M0djgTuYOJvNN0uS/N8thXw8=" } ], "coordinator-rke2-qemu-tdx.yml": [ @@ -111,6 +127,10 @@ { "version": "v1.1.1", "hash": "sha256-LFxYqkKx4tqW4zmUucxzvri+xEDAupwFmcka7PH0vJc=" + }, + { + "version": "v1.2.0", + "hash": "sha256-HMYEvALslDZ0b53+vPh5bt3l+7+oN2PlCX6VqV4V/dY=" } ], "coordinator.yml": [ @@ -203,6 +223,10 @@ { "version": "v1.1.1", "hash": "sha256-c1vUO+pgsqiV5Oa7eFtI2QcDykd8GFH6IH3HG7LWL7w=" + }, + { + "version": "v1.2.0", + "hash": "sha256-c1vUO+pgsqiV5Oa7eFtI2QcDykd8GFH6IH3HG7LWL7w=" } ], "emojivoto-demo.zip": [ @@ -247,6 +271,10 @@ { "version": "v1.1.1", "hash": "sha256-UEQust0Hl5HPKktgbvS+ae6F397T79HLGc3YiXU5PIA=" + }, + { + "version": "v1.2.0", + "hash": "sha256-Y6r3fDWhCLo3EtgFD6OAyh+aj4QP3cIkS0uhThRcNW4=" } ], "runtime-k3s-qemu-snp.yml": [ @@ -257,6 +285,10 @@ { "version": "v1.1.1", "hash": "sha256-MOAP+zhX8vXRDcClDZRc3D5tafWhL6GK5ZRb+8+bgOA=" + }, + { + "version": "v1.2.0", + "hash": "sha256-aXC4o1dM1DlIvTerYBijr5VK6aBShQoJ07Hbr/9sz2c=" } ], "runtime-k3s-qemu-tdx.yml": [ @@ -267,6 +299,10 @@ { "version": "v1.1.1", "hash": "sha256-cKgDymIelsLN528e5weOst+OuufAGJL2KdEfj3BdeoU=" + }, + { + "version": "v1.2.0", + "hash": "sha256-wgzuQeheVULfB8lgnXNQQnIWmUzCz7bucIoC9uefJnA=" } ], "runtime-rke2-qemu-tdx.yml": [ @@ -277,6 +313,10 @@ { "version": "v1.1.1", "hash": "sha256-wfP23ptGT2Lmah5vHndkiioJVwaho202R8xSAyW8H4s=" + }, + { + "version": "v1.2.0", + "hash": "sha256-RYQbNqAp5cLjUGig9HHLi4SHlpn3qerygbF/E/92Xug=" } ], "runtime.yml": [ From 78209deb707b2b9cbe0a0ef76e30365dd0061050 Mon Sep 17 00:00:00 2001 From: edgelessci Date: Tue, 17 Dec 2024 11:49:37 +0000 Subject: [PATCH 4/4] flake: 1.2.0-pre -> 1.3.0-pre --- version.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/version.txt b/version.txt index cff0b814d8..78e1a3235c 100644 --- a/version.txt +++ b/version.txt @@ -1 +1 @@ -1.2.0-pre \ No newline at end of file +1.3.0-pre \ No newline at end of file