From c47ee35f8ab8c14ac4fe33a76fb0d9c59d45ec49 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Thu, 15 May 2025 10:46:48 -0400 Subject: [PATCH 01/32] Add logging to the JWT generation for ambient credentials --- internal/command/client.go | 67 +++++++++++++++++++++++++++++++++++--- 1 file changed, 63 insertions(+), 4 deletions(-) diff --git a/internal/command/client.go b/internal/command/client.go index f28ea60..55120fe 100644 --- a/internal/command/client.go +++ b/internal/command/client.go @@ -18,11 +18,14 @@ package command import ( "fmt" + "strings" "github.com/Azure/azure-sdk-for-go/sdk/azcore" "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy" "github.com/Azure/azure-sdk-for-go/sdk/azidentity" commandsdk "github.com/Keyfactor/keyfactor-go-client/v3/api" + "github.com/go-logr/logr" + "github.com/golang-jwt/jwt/v5" "golang.org/x/net/context" "golang.org/x/oauth2" "golang.org/x/oauth2/google" @@ -95,6 +98,11 @@ type azure struct { // GetAccessToken implements TokenCredential. func (a *azure) GetAccessToken(ctx context.Context) (string, error) { + log := log.FromContext(ctx) + + // To prevent clogging logs every time JWT is generated + initializing := a.cred == nil + // Lazily create the credential if needed if a.cred == nil { c, err := azidentity.NewDefaultAzureCredential(nil) @@ -104,6 +112,8 @@ func (a *azure) GetAccessToken(ctx context.Context) (string, error) { a.cred = c } + log.Info(fmt.Sprintf("generating Default Azure Credentials with scopes %s", strings.Join(a.scopes, " "))) + // Request a token with the provided scopes token, err := a.cred.GetToken(ctx, policy.TokenRequestOptions{ Scopes: a.scopes, @@ -112,8 +122,20 @@ func (a *azure) GetAccessToken(ctx context.Context) (string, error) { return "", fmt.Errorf("%w: failed to fetch token: %w", errTokenFetchFailure, err) } - log.FromContext(ctx).Info("fetched token using Azure DefaultAzureCredential") - return token.Token, nil + tokenString := token.Token + + if initializing { + // Only want to output this once, don't want to output this every time the JWT is generated + + log.Info("==== BEGIN DEBUG: DefaultAzureCredential JWT ======") + + printClaims(log, tokenString, []string{"aud", "azp", "iss", "sub", "oid"}) + + log.Info("==== END DEBUG: DefaultAzureCredential JWT ======") + } + + log.Info("fetched token using Azure DefaultAzureCredential") + return tokenString, nil } func newAzureDefaultCredentialSource(ctx context.Context, scopes []string) (*azure, error) { @@ -142,17 +164,28 @@ type gcp struct { // GetAccessToken implements TokenCredential. func (g *gcp) GetAccessToken(ctx context.Context) (string, error) { - // Lazily create the TokenSource if it's nil. log := log.FromContext(ctx) + + // To prevent clogging logs every time JWT is generated + initializing := g.tokenSource == nil + + // Lazily create the TokenSource if it's nil. if g.tokenSource == nil { + log.Info(fmt.Sprintf("generating default Google credentials with scopes %s", strings.Join(g.scopes, " "))) + credentials, err := google.FindDefaultCredentials(ctx, g.scopes...) if err != nil { return "", fmt.Errorf("%w: failed to find GCP ADC: %w", errTokenFetchFailure, err) } log.Info(fmt.Sprintf("generating a Google OIDC ID token...")) + // Default audience to "command" if not provided + aud := getValueOrDefault(g.audience, "command") + + log.Info(fmt.Sprintf("generating Google id token with audience %s", aud)) + // Use credentials to generate a JWT (requires a service account) - tokenSource, err := idtoken.NewTokenSource(ctx, getValueOrDefault(g.audience, "command"), idtoken.WithCredentialsJSON(credentials.JSON)) + tokenSource, err := idtoken.NewTokenSource(ctx, aud, idtoken.WithCredentialsJSON(credentials.JSON)) if err != nil { return "", fmt.Errorf("%w: failed to get GCP ID Token Source: %w", errTokenFetchFailure, err) } @@ -171,6 +204,14 @@ func (g *gcp) GetAccessToken(ctx context.Context) (string, error) { return "", fmt.Errorf("%w: failed to fetch token from GCP ADC token source: %w", errTokenFetchFailure, err) } + if initializing { + // Only want to output this once, don't want to output this every time the JWT is generated + + log.Info("==== BEGIN DEBUG: Default Google ID Token JWT ======") + printClaims(log, token.AccessToken, []string{"aud", "iss", "sub", "email"}) + log.Info("==== END DEBUG: Default Google ID Token JWT ======") + } + log.Info("fetched token using GCP ApplicationDefaultCredential") return token.AccessToken, nil @@ -188,3 +229,21 @@ func newGCPDefaultCredentialSource(ctx context.Context, audience string, scopes tokenCredentialSource = source return source, nil } + +func printClaims(log logr.Logger, token string, claimsToPrint []string) { + tokenRaw, _, err := new(jwt.Parser).ParseUnverified(token, jwt.MapClaims{}) + if err != nil { + log.Info(fmt.Sprintf("failed to parse JWT: %w", err)) + } + + claims, ok := tokenRaw.Claims.(jwt.MapClaims) + if !ok { + log.Info("Unable to get claims from token") + } + + for _, key := range claimsToPrint { + if value, ok := claims[key]; ok { + log.Info(fmt.Sprintf(" %s: %s", key, value)) + } + } +} From e5969d9869ef88a2419b3513bca0eae219107a51 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Thu, 15 May 2025 10:55:28 -0400 Subject: [PATCH 02/32] chore(tests): Fix error logging --- internal/command/client.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/command/client.go b/internal/command/client.go index 55120fe..043d4e0 100644 --- a/internal/command/client.go +++ b/internal/command/client.go @@ -233,7 +233,7 @@ func newGCPDefaultCredentialSource(ctx context.Context, audience string, scopes func printClaims(log logr.Logger, token string, claimsToPrint []string) { tokenRaw, _, err := new(jwt.Parser).ParseUnverified(token, jwt.MapClaims{}) if err != nil { - log.Info(fmt.Sprintf("failed to parse JWT: %w", err)) + log.Error(err, "failed to parse JWT") } claims, ok := tokenRaw.Claims.(jwt.MapClaims) From 1cae959a650533367ba065b1aad7176345f54099 Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Thu, 15 May 2025 15:00:26 +0000 Subject: [PATCH 03/32] Update generated docs --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 3dc8c97..a4d9b1f 100644 --- a/README.md +++ b/README.md @@ -95,8 +95,11 @@ Command Issuer enrolls certificates by submitting a POST request to the Command > Documentation for [Version Two Permission Model](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityRolePermissions.htm#VersionTwoPermissionModel) and [Version One Permission Model](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityRolePermissions.htm#VersionOnePermissionModel) ![Permission Metadata Read](./docsource/images/security_permission_metadata_read.png) + ![Permission Certificate CSR Enrollment](./docsource/images/security_permission_enrollment_csr.png) + ![Certificate Authority Allowed Requester](./docsource/images/ca_allowed_requester.png) + ![Certificate Template Allowed Requester](./docsource/images/cert_template_allowed_requester.png) ## Installing Command Issuer From e5b91ac00d42e395100d2368c34ff6c1e225f578 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Thu, 15 May 2025 11:45:46 -0400 Subject: [PATCH 04/32] chore(tests): Add tests. Add colon for clear scope management --- internal/command/client.go | 12 +++---- internal/command/client_test.go | 57 +++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+), 6 deletions(-) create mode 100644 internal/command/client_test.go diff --git a/internal/command/client.go b/internal/command/client.go index 043d4e0..3514117 100644 --- a/internal/command/client.go +++ b/internal/command/client.go @@ -171,7 +171,7 @@ func (g *gcp) GetAccessToken(ctx context.Context) (string, error) { // Lazily create the TokenSource if it's nil. if g.tokenSource == nil { - log.Info(fmt.Sprintf("generating default Google credentials with scopes %s", strings.Join(g.scopes, " "))) + log.Info(fmt.Sprintf("generating default Google credentials with scopes: %s", strings.Join(g.scopes, " "))) credentials, err := google.FindDefaultCredentials(ctx, g.scopes...) if err != nil { @@ -230,20 +230,20 @@ func newGCPDefaultCredentialSource(ctx context.Context, audience string, scopes return source, nil } -func printClaims(log logr.Logger, token string, claimsToPrint []string) { +func printClaims(log logr.Logger, token string, claimsToPrint []string) error { tokenRaw, _, err := new(jwt.Parser).ParseUnverified(token, jwt.MapClaims{}) if err != nil { log.Error(err, "failed to parse JWT") + return fmt.Errorf("failed to parse JWT: %w", err) } - claims, ok := tokenRaw.Claims.(jwt.MapClaims) - if !ok { - log.Info("Unable to get claims from token") - } + claims, _ := tokenRaw.Claims.(jwt.MapClaims) for _, key := range claimsToPrint { if value, ok := claims[key]; ok { log.Info(fmt.Sprintf(" %s: %s", key, value)) } } + + return nil } diff --git a/internal/command/client_test.go b/internal/command/client_test.go new file mode 100644 index 0000000..5b639cc --- /dev/null +++ b/internal/command/client_test.go @@ -0,0 +1,57 @@ +package command + +import ( + "testing" + + "github.com/go-logr/logr/testr" + "github.com/golang-jwt/jwt/v5" + "github.com/stretchr/testify/assert" +) + +func TestPrintClaims(t *testing.T) { + t.Run("valid jwt returns no error", func(t *testing.T) { + // Sample JWT with dummy claims (no signature needed for ParseUnverified) + claims := jwt.MapClaims{ + "aud": "api://1234", + "iss": "https://sts.windows.net/tenant-id/", + "sub": "user-id", + } + token := createUnsignedJWT(t, claims) + + // Use testr logger + testLogger := testr.New(t) + + // Call the function + err := printClaims(testLogger, token, []string{"aud", "iss", "sub"}) + assert.NoError(t, err) + }) + + t.Run("invalid jwt returns an error", func(t *testing.T) { + // Use testr logger + testLogger := testr.New(t) + + // Call the function + err := printClaims(testLogger, "abcdefghijklmnop", []string{"aud", "iss", "sub"}) + assert.Error(t, err) + }) + + t.Run("jwt with no claims returns error", func(t *testing.T) { + // Use testr logger + testLogger := testr.New(t) + + // Call the function + err := printClaims(testLogger, "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0..", []string{"aud", "iss", "sub"}) + assert.Error(t, err) + }) +} + +func createUnsignedJWT(t *testing.T, claims jwt.MapClaims) string { + t.Helper() + + token := jwt.NewWithClaims(jwt.SigningMethodNone, claims) + str, err := token.SignedString(jwt.UnsafeAllowNoneSignatureType) + if err != nil { + t.Fatalf("failed to create test token: %v", err) + } + return str +} From cb44cc64077b5db437349d626d9163b28f1c9214 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Wed, 28 May 2025 15:10:26 -0400 Subject: [PATCH 05/32] chore(docs): Update documentation for ambient credentials in Google + Azure --- README.md | 4 +- docs/README.md | 3 + docs/ambient-providers/azure.md | 198 ++++++++++++++++++ docs/ambient-providers/google.md | 59 ++++++ docs/assets/app-registration-app-id-uri.png | Bin 0 -> 206233 bytes .../app-registration-assignment-required.png | Bin 0 -> 291850 bytes docsource/content.md | 184 +++------------- 7 files changed, 288 insertions(+), 160 deletions(-) create mode 100644 docs/README.md create mode 100644 docs/ambient-providers/azure.md create mode 100644 docs/ambient-providers/google.md create mode 100644 docs/assets/app-registration-app-id-uri.png create mode 100644 docs/assets/app-registration-assignment-required.png diff --git a/README.md b/README.md index a4d9b1f..a82e1b2 100644 --- a/README.md +++ b/README.md @@ -389,7 +389,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou spec: hostname: "$HOSTNAME" apiPath: "/KeyfactorAPI" # Preceding & trailing slashes are handled automatically - commandSecretName: "command-secret" # references the secret created above + commandSecretName: "command-secret" # references the secret created above. Omit if using ambient credentials. caSecretName: "command-ca-secret" # references the secret created above # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required @@ -415,7 +415,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou spec: hostname: "$HOSTNAME" apiPath: "/KeyfactorAPI" # Preceding & trailing slashes are handled automatically - commandSecretName: "command-secret" # references the secret created above + commandSecretName: "command-secret" # references the secret created above. Omit if using ambient credentials. caSecretName: "command-ca-secret" # references the secret created above # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required diff --git a/docs/README.md b/docs/README.md new file mode 100644 index 0000000..6c5c44d --- /dev/null +++ b/docs/README.md @@ -0,0 +1,3 @@ +# Keyfactor Docs + +This is supplemental documentation for the [Keyfactor Command Cert Manager Issuer](../README.md). Please refer to the root-level README as the entrypoint for documentation regarding this integration. \ No newline at end of file diff --git a/docs/ambient-providers/azure.md b/docs/ambient-providers/azure.md new file mode 100644 index 0000000..5bdd189 --- /dev/null +++ b/docs/ambient-providers/azure.md @@ -0,0 +1,198 @@ +# Managed Identity Using Azure Entra ID Workload Identity (AKS) + +This documentation is for instructions on using ambient credentials within Azure Kubernetes Services (AKS). Full documentation on Command Cert Manager Issuer can be found [here](../../README.md). + +## Prerequisites + +- [kubectl](https://kubernetes.io/docs/reference/kubectl/) installed on your machine and [connected to your AKS cluster](https://learn.microsoft.com/en-us/azure/aks/learn/quick-kubernetes-deploy-cli#connect-to-the-cluster) +- [Helm](https://github.com/helm/helm?tab=readme-ov-file#install) 3.x installed +- [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest) installed and logged in + +## Background + +There are two types of [managed identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview#managed-identity-types) that your Azure AKS workload may use: +- System-assigned managed identity (MSI) + - Automatically created and managed by Azure at the cluster level. This identity **can not** be shared with other Azure resources. +- User-assigned managed identity (UAMI) + - Created and managed by you. Identity **can** be shared with other Azure resources and associated with Kubernetes ServiceAccounts via Azure AD Workload Identity. + +Since you are using ambient credentials generated by your Azure AKS workload and targeting these credentials for your Command instance, you will need to create an [Azure App Registration](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app). We will walk through App Registration configuration in this document. + +## System-Assigned Managed Identity (MSI) + +By default, your AKS cluster is configured to use system-assigned managed identity. Your workload should automatically use the identity assigned to the cluster. You will need to set up the scope of the issuer to reference an app registration. Lastly, you will need to make sure the object ID of the managed identity is associated to a security claim in Keyfactor Command. + +1. Install `cert-manager` to your AKS cluster. [Installation steps](https://cert-manager.io/docs/installation/helm/) +1. Install `command-cert-manager-issuer` to your AKS cluster. [Installation steps](../../README.md#installing-command-issuer) +1. Create an Azure App Registration. [Installation steps](#azure-app-registration) +1. Deploy Issuer or ClusterIssuer Resource. [Installation steps](../../README.md#creating-issuer-and-clusterissuer-resources) + - To use ambient credentials, do not supply a `commandSecretName` to your issuer's specification. + - **IMPORTANT**: Fill in the `scopes` in your issuer's specification with the Application ID URI of your App Registration, suffixed with `./default`. (i.e. `scopes: api://your-app-registration-endpoint/.default`) +1. Add the system-assigned managed identity object ID to a security claim in Keyfactor Command + ```bash + export AKS_CLUSTER_RESOURCE_GROUP="" # the resource group your AKS cluster is deployed to + export AKS_CLUSTER_NAME="" # the name of your AKS cluster + export CURRENT_TENANT=$(az account show --query tenantId --output tsv) + + echo "AKS Cluster Resource Group: $AKS_CLUSTER_RESOURCE_GROUP" + echo "AKS Cluster Name: $AKS_CLUSTER_NAME" + + # Get the principal ID of your AKS cluster + AKS_CLUSTER_OBJECT_ID=$(az aks show --resource-group $AKS_CLUSTER_RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query "identityProfile.kubeletidentity.objectId" -o tsv) + echo "AKS Cluster MSI Object ID: $AKS_CLUSTER_OBJECT_ID" + + echo "View then OIDC configuration for the Entra OIDC token issuer: https://login.microsoftonline.com/$CURRENT_TENANT/v2.0/.well-known/openid-configuration" + + echo "Authority: https://login.microsoftonline.com/$CURRENT_TENANT/v2.0" + ``` + + You can map the object ID to an OAuth Subject or OAuth Object ID security claim in Keyfactor Command. Make sure the [security claim is associated to a security role](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) with the required permissions. Please refer to the [Configuring Command](../../README.md#configuring-command) **Configure Command Security Roles and Claims** section for security role requirements. + + Make sure an identity provider is configured in Keyfactor Command with the authority set to the authority output above. + +## User-Assigned Managed Identity (UAMI) + +User-assigned managed identity configuration is more involved, but allows the identity to be shared across different AKS clusters. The AKS cluster will need to be configured to allow workload identity and the Command Issuer's ServiceAccount will need to reference the client ID of the user-assigned managed identity. You will need to make sure the principal ID of the user-assigned managed identity is associated to a security claim in Keyfactor Command. + +1. Install `cert-manager` to your AKS cluster. [Installation steps](https://cert-manager.io/docs/installation/helm/) +1. Enable OIDC and Workload Identity on your AKS cluster. [Learn more](https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster) + ```bash + export AKS_CLUSTER_RESOURCE_GROUP="" # the resource group your AKS cluster is deployed to + export AKS_CLUSTER_NAME="" # the name of your AKS cluster + + echo "AKS Cluster Resource Group: $AKS_CLUSTER_RESOURCE_GROUP" + echo "AKS Cluster Name: $AKS_CLUSTER_NAME" + + echo "Enabling OIDC and workload identity on AKS cluster..." + + az aks update \ + --name ${AKS_CLUSTER_NAME} \ + --resource-group ${AKS_CLUSTER_RESOURCE_GROUP} \ + --enable-oidc-issuer \ + --enable-workload-identity + ``` +1. Create a user-assigned managed identity + ```bash + export UAMI_IDENTITY_NAME="command-issuer-uami" # the name you want to give your UAMI + + echo "Creating user assigned managed identity $UAMI_IDENTITY_NAME..." + + az identity create --name "${UAMI_IDENTITY_NAME}" --resource-group "${AKS_CLUSTER_RESOURCE_GROUP}" + + export UAMI_CLIENT_ID=$(az identity show --name $UAMI_IDENTITY_NAME --resource-group $AKS_CLUSTER_RESOURCE_GROUP --query clientId --output tsv) + + echo "Client ID of user-assigned managed identity: $UAMI_CLIENT_ID" + ``` +1. Deploy Command Cert Manager Issuer with ServiceAccount labeled to use workload identity and UAMI client ID + + ```bash + export UAMI_CLIENT_ID=$(az identity show --name $UAMI_IDENTITY_NAME --resource-group $AKS_CLUSTER_RESOURCE_GROUP --query clientId --output tsv) # should be the same as the previous step + + export ISSUER_NAMESPACE="command-issuer-system" + + echo "Installing command-cert-manager issuer to namespace $ISSUER_NAMESPACE" + echo "Labeling ServiceAccount to use workload identity with user-assigned-managed-identity client ID $UAMI_CLIENT_ID..." + + helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \ + --namespace $ISSUER_NAMESPACE \ + --create-namespace \ + --set "fullnameOverride=command-cert-manager-issuer" \ + --set-string "podLabels.azure\.workload\.identity/use=true" \ + --set-string "serviceAccount.labels.azure\.workload\.identity/use=true" \ + --set-string "serviceAccount.annotations.azure\.workload\.identity/client-id=${UAMI_CLIENT_ID}" + ``` + + + If successful, the Command Issuer Pod will have new environment variables and the Azure WI ServiceAccount token as a projected volume: + + ```shell + kubectl -n command-issuer-system describe pod + ``` + + ```shell + Containers: + command-cert-manager-issuer: + ... + Environment: + AZURE_CLIENT_ID: + AZURE_TENANT_ID: + AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/azure/tokens/azure-identity-token + AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/ + Mounts: + /var/run/secrets/azure/tokens from azure-identity-token (ro) + /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-6rmzz (ro) + ... + Volumes: + ... + azure-identity-token: + Type: Projected (a volume that contains injected data from multiple sources) + TokenExpirationSeconds: 3600 + ``` +1. Associate a Federated Identity Credential (FIC) with the User Assigned Managed Identity. The FIC allows Command Issuer to act on behalf of the Managed Identity by telling Azure to expect: + - The `iss` claim of the ServiceAccount token to match the cluster's OIDC Issuer. Azure will also use the Issuer URL to download the JWT signing certificate. + - The `sub` claim of the ServiceAccount token to match the ServiceAccount's name and namespace. + + ```shell + export SERVICE_ACCOUNT_NAME=command-cert-manager-issuer # This is the default Kubernetes ServiceAccount used by the Command Issuer controller. + export SERVICE_ACCOUNT_NAMESPACE=command-issuer-system # This is the default namespace for Command Issuer used in this doc. + + export SERVICE_ACCOUNT_ISSUER=$(az aks show --resource-group $AKS_CLUSTER_RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query "oidcIssuerProfile.issuerUrl" -o tsv) + + echo "Service account issuer: $SERVICE_ACCOUNT_ISSUER" + echo "Creating federated credentials for user-assigned managed identity $UAMI_IDENTITY_NAME in resource group $AKS_CLUSTER_RESOURCE_GROUP..." + + az identity federated-credential create \ + --name "${UAMI_IDENTITY_NAME}-federated-credentials" \ + --identity-name "${UAMI_IDENTITY_NAME}" \ + --resource-group "${AKS_CLUSTER_RESOURCE_GROUP}" \ + --issuer "${SERVICE_ACCOUNT_ISSUER}" \ + --subject "system:serviceaccount:${SERVICE_ACCOUNT_NAMESPACE}:${SERVICE_ACCOUNT_NAME}" \ + --audiences "api://AzureADTokenExchange" + ``` + + > Read more about [Workload Identity federation](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation) in the Entra ID documentation. + > + > Read more about [the `az identity federated-credential` command](https://learn.microsoft.com/en-us/cli/azure/identity/federated-credential?view=azure-cli-latest). +1. Create an Azure App Registration. [Installation steps](#azure-app-registration) +1. Deploy Issuer or ClusterIssuer Resource. [Installation steps](../../README.md#creating-issuer-and-clusterissuer-resources) + - To use ambient credentials, do not supply a `commandSecretName` to your issuer's specification. + - **IMPORTANT**: Fill in the `scopes` in your issuer's specification with the Application ID URI of your App Registration, suffixed with `./default`. (i.e. `scopes: api://your-app-registration-endpoint/.default`) +1. Add the user-assigned managed identity principal ID to a security claim in Keyfactor Command + ```shell + export UAMI_PRINCIPAL_ID=$(az identity show --name $UAMI_IDENTITY_NAME --resource-group $AKS_CLUSTER_RESOURCE_GROUP --query principalId --output tsv) + export CURRENT_TENANT=$(az account show --query tenantId --output tsv) + echo "UAMI Principal ID: ${UAMI_PRINCIPAL_ID}" + + echo "View then OIDC configuration for the Entra OIDC token issuer: https://login.microsoftonline.com/$CURRENT_TENANT/v2.0/.well-known/openid-configuration" + + echo "Authority: https://login.microsoftonline.com/$CURRENT_TENANT/v2.0" + ``` + + You can map the principal ID to an OAuth Subject or OAuth Object ID security claim in Keyfactor Command. Make sure the [security claim is associated to a security role](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) with the required permissions. Please refer to the [Configuring Command](../../README.md#configuring-command) **Configure Command Security Roles and Claims** section for security role requirements. + + Make sure an identity provider is configured in Keyfactor Command with the authority set to the authority output above. + + +## Azure App Registration + +The identity server that generates the access token from DefaultAzureCredentials requires a valid scope. The access token is being used for authorization on a resource outside of Azure (Keyfactor Command), so an app registration for Entra AD to represent an external application. + +Here is official Azure documentation on how to [create an app registration](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app). + +After the App Registration is created, expose an API. You can do this by going to Manage > Expose an API and editing the Application ID URI. + +> IMPORTANT: The Application ID URI will be used in your `scopes` claim. Make sure to copy this value down. For example, if your Application ID URI is `api://abcd`, your scope value should be `api://abcd/.default`. + +![Application ID URI](../assets/app-registration-app-id-uri.png) + +### App Registration Assignment Requirement + +By default, Azure App Registrations do not require an assignment in order for an identity to access to the application. However, there may be some compliance need to require an assignment for an identity to access your app registration. This option can be toggled via the Enterprise Application properties of your App Registration. If enabled, and your identity does not have an assignment to this application, you may see the error: + +``` +AADSTS501051: Application ''() is not assigned to a role for the application 'api://'() +``` + +![App Registration Assignment Required](../assets/app-registration-assignment-required.png) + +For more information about the assignment requirement for app registrations and how this can affect your identities, please see [this blog post](https://mderriey.com/2019/04/19/aad-apps-user-assignment-required/). \ No newline at end of file diff --git a/docs/ambient-providers/google.md b/docs/ambient-providers/google.md new file mode 100644 index 0000000..708989e --- /dev/null +++ b/docs/ambient-providers/google.md @@ -0,0 +1,59 @@ +# Google Kubernetes Engine (GKE) Workload Identity + +This documentation is for instructions on using ambient credentials within Google Kubernetes Engine (GKE). Full documentation on Command Cert Manager Issuer can be found [here](../../README.md). + +## Prerequisites + +- [cert-manager](https://cert-manager.io/docs/installation/helm/) installed to your GKE cluster. +- [command-cert-manager-issuer](../../README.md#installing-command-issuer) installed to your GKE cluster. +- [Issuer or ClusterIssuer](../../README.md#creating-issuer-and-clusterissuer-resources) resources deployed to your GKE cluster. + - to use ambient credentials, do not supply a `commandSecretName` to your issuer's specification. `scopes` and `audience` fields are optional. +- [Gcloud CLI](https://cloud.google.com/sdk/docs/install) installed and logged in + +## Background + +Google Kuberentes Engine (GKE) supports the ability to authenticate your GKE workloads using workload identity. + +By default, GKE clusters are assigned the [default service account](https://cloud.google.com/compute/docs/access/service-accounts#token) for your Google project. This service account is used to generate an ID token for your workload. However, you may opt to use [Workload Identity Federation](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#metadata-server) to your GKE cluster. + +## How to use Workload Identity + +1. Get the OAuth Client and Identity Provider for your GKE Cluster + + Regardless if you are using the default service account or a custom service account, the following script will help you derive your GKE cluster's OAuth Client: + + ```shell + export CLUSTER_NAME="" # name of your GKE cluster + export GCLOUD_REGION="" # region your cluster is hosted in + export GCLOUD_PROJECT_ID=$(gcloud config get-value project) # populate with the current PROJECT_ID context + export GCLOUD_PROJECT_NUMBER=$(gcloud projects describe $GCLOUD_PROJECT_ID --format="value(projectNumber)") + + export GCLOUD_SERVICE_ACCOUNT=$(gcloud container clusters describe $CLUSTER_NAME \ + --zone $GCLOUD_REGION \ + --format="value(nodeConfig.serviceAccount)") + + echo "Cluster name: $CLUSTER_NAME" + echo "Region: $GCLOUD_REGION" + echo "Project ID: $GCLOUD_PROJECT_ID" + echo "Project Number: $GCLOUD_PROJECT_NUMBER" + + if [[ "$GCLOUD_SERVICE_ACCOUNT" == "default" ]]; then + echo "Overriding service account..." + # Override service account with default compute service account + GCLOUD_SERVICE_ACCOUNT="$GCLOUD_PROJECT_NUMBER-compute@developer.gserviceaccount.com" + fi + + echo "Service account: $GCLOUD_SERVICE_ACCOUNT" + + # Get OAuth2 Client ID of service account + export GCLOUD_SERVICE_ACCOUNT_CLIENT_ID=$(gcloud iam service-accounts describe $GCLOUD_SERVICE_ACCOUNT \ + --format="value(oauth2ClientId)") + + echo "Service account OAuth2 client ID: $GCLOUD_SERVICE_ACCOUNT_CLIENT_ID" + + echo "View the OIDC configuration for Google's OIDC token issuer: https://accounts.google.com/.well-known/openid-configuration" + + echo "Authority: https://accounts.google.com" + ``` + +2. Add Google as an [Identity Provider in Command](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/IdentityProviders.htm?Highlight=identity%20provider) using the identity provider information from the previous step, and [add the Service Account's OAuth Client ID as an `OAuth Subject` claim to the Security Role](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) created/identified earlier. \ No newline at end of file diff --git a/docs/assets/app-registration-app-id-uri.png b/docs/assets/app-registration-app-id-uri.png new file mode 100644 index 0000000000000000000000000000000000000000..7dfc8f372423bf5682b08367c2e306cdaa88723f GIT binary patch literal 206233 zcmeFYWmsKH5-5thySqbhcXxt2Y~0=5-Q5Wu+}+&?5J-RocXxLl896g2Gjq@TeZRZ+ zTHmVGtE;Q4x>~C$LgAwXJPZyD5D*Z&l%%K<5DenZoAW$GXb+#r`_c?6QI1@ zbt$s8QVJlCO<@Zib0Q~aX_}<(@JND?tb*XpyuJa!_^7DRdGOh9wr942cIN7zwzb}l z-)f4q7MH$L6C02 z?DJb*(gVljwU8VEgA)?%UIAkhkzxQ@8pqBX-N;*Wr_N77INTqlnzOZ>57`DQw!7OB zqfF?V1P-1mtb>b4en`-0uSkW-beb9kvxIEBnD+XU{se>cAOHoh!C|DZaHm2NRd3Hw zs$f_q9pZgsMPd$ML(p(cDA>R)RsO7^2ZwSEbKTJ70kw-gcO@|$kIJX|Y|&=vH<#4- zirEp?$Oe=|;$lH-RWj+wKn+mCy};~ysFdl^O}dZY{o_!qmfNA7NhvEh0(vPz-0$qr!Az|X-Su(0)<(mL^vIfHcUo!H5k?4 zvB5O%eg2sU#a<9e9|YU_fQZl-R8d>r2eDJ>HW-K?K2Vkj>?4h-zG!`c1YF!j9@aB- z0umZrEUd~kj1cm64?_KTA?m2YH3qf#wm&7(UI0`)Y>i2z;%1+@)H;)~=v(+yPz>VL zWQg4A+t~x~EzdxxY*Azayr}UkByU9DAdw*!Q?Pj)?uKtGA^~(9aBbTr-LjQF!P*P7 zJk&{WSnyHs$Nnnl0>M&ej%4PUrgRNJ_ zdLCo0^3EMqgV&;$7VKwx4i#TxOlIkMO33&VUxKoYybbi8^zsBehs@R{pslo zE&&xiplM_QFGJW`&>xz|WUd4}k#nFF^TBNTRX>=x2y}Gg&?~Hnw6aNZ@k&V_B{~Cm zXlslEWMX7mCNNF(^6l%N@!>fi5~-CGP1T5#;CrBiDb&BX5sW*#IJiIxzWOM3cdri8 zbmN8tj@)cd34!j}Z|?30AErV$fNQ5w`Cr3&oLuSd4-_ERmkqjQwTiaw9|C~ZP@M0J zutAjdp^w+SbpjyIfq{vzf`iQCfs}gP(|s^>_LLZ*WkDN+ps7G*`egeZjB*>ZD8(F$AdpffTuJgc!g}~Slh!22Q-vxi;(rHg5(>+wOO6rG zgWl(4Mg0_xQF!%rXdkB$W+h}kpK>N@-=z`NC*alqNO|O%(di4ckpUhZj?54MsPM?80$Mnk&r7mAPM^d!}kr^Go# z&8URPPm*Mb#A6BDGLaM)k|9MXvs$zCN~i}gWl`^Agzlv5r0NIJ52|vN>=IQvHYJM= zO|+KsbNoqcWAny#j;xx3Il=(pRcTu?JrcJB0p&)jW;8u%5b`YMtol$T87{dt8IQv1 zYTNwN&jc0pO1YoA#eHfXxo#j23Ck8$AZfz5Q)vq6i)~AC@>UDF^JmQ28-cWFs^Xi| z)#P}@I^>`7`o7xFuUkT~np&!uf49(?ahIa}R&`+g=TJrI0I4m zO`K1}IrJWG1CbiP-fz^#==+a8&MEiu3ydwbEq+wxBn8xnF|8zJ3cg~`V&LMR#k6v9 zS*}@3U!K2+n$k{Ye#v2R$*?x1cY<#S`DtZqO<+pTvSz(%`uekfo@B-_c8DO#D-}&9 z)g*LBdct%9K+960sP?VWveH&NsY-KRbH1W#TC1m}u1Tsn!%o@m>dSm@s+G32wvpFD ztm&Q|$4vG3X(r!Hj!CXj&+2PE=;8Wl{Eotg{TQ;#wLKbFwVO4eG}a-T3U8yOc^K+k z#EHtb%GPzS<}}x=N32uV)r5iCfKu28Tvyj09GGrtI%!q(ZlP9)h=lxR?px;z)dhbaN6%jNMtmLTWSmdPS;M3u& z!C4_6Wn=cyezhuIP^^htC0Gqved>CCN%v`pEP$ z`^^5}@|g8>^<42x2%!N11=0-8YqHeP@U!Cw1E?;@=YTMfHK$IlZ(NjtwRvCjX7if$ zPu2(5UHa}s=!BU?EQLKqRzyldbD&6r#ezS;9<68EKP+3?+O?Y9U!SK!S&DiOwugr$ zASBF=4lC}Lo-5Lduf){HqDah11ex1jNA7zuH8Y_a#SWqv85z1osA$L%X4zpqNBVN?jM#NzF-}B?Tp>QM$zvuzNo4M^TGY7bJ(OC|N2UHh=GC z>N8S{IlwvMZ#F)TacJJ6h~p7hHTOQfH$vSn?sKqwJ$?<~ z59`T%6GkG^px(!Lgh_+VHN7{bn|4n<$Z8{L;F%Dp;H{7tM6N>Z8b_E|O@HC1vu zHtrcEKzl$}Me|8dWxDZ5vB{l06l`^{9|i}4em&lQ}p z_+#{LMk>qR z2<@#3jyip%cMqWUbv)D`z6n>3J=Ny9QL6D^clYb0iz>V7j&`_qWHay2%*LBzyUMll z7Hk{ZrCXN{cdxzJR{RfhIdgM7F>dr_LRQ9XD;>k9?VUX4ZX#96C%b%}UgNicUG-hl zcb`u>>I4k^u7KwQ7K7#?X%U$aQs#+Wln*_R8V-4Im2egj!w79{uPu0;2Oman3wI@G zV-E*XGbG~}-ecxAJ&@$9s{3wyl??$oxrL5t&L2l1` z8lUgX=k*+XKIAcq0P{#|MH}(u^z|v9J+8T3CMOMt-b>fkn((LZbL3k}l6p{ePTO#o z>xJj{n_Jun4qMmgll@NW)`w%Y(<=3rC|kd7mLvKN+XKEyubsP?GxZmPw~?HWaZ^T! zfdq~G(SGiG$Zs=IBj9m8&XZokUP`auk1cLk7R)3%MA{hy2(LPiLbiwYauNlaUMsyV z?k?B$fc=_oV^2>!$$jSDJZEqRIF{DhyKGLQ4m#fG&sO&CJ`=(T9N&*Vy5A~amXzdD z`VjkQUd_E)ZMB5kxjkJyK9TcM%U{s?_l24o1D$*F05zfkVcGkMV;3&JQNt;oYNA6u zQ&ujM(tH8+*SdcrSOR^sAU8l~4*uEu6*H{R8?dThaQD8WNHx)rGL@49qIrj*fWU!KfI#0N z;P*ceFb)v--(VmhX<*zxU?pIxf8+rH0t&ML0{cfEt@r1zU;O+1j{T1(XksW3mf+-XT$L`1xf#-`j#qT>HRe}Cg6 zF?V*h=VoAVb91A2W1+WmG-F`m;^JapWM*Jy{_vjTgOi7?vw`~uTPM=L7xK??L`|HG z94+jfE$nQGewAxrXy@Y0M?&(8&>z3Q*VDw^;$M_(o&LerJA(|rzA!M+Gcx=)G-nIb z|AF@F%iq!d#@FA;@%}1|Th+Cc{|6da4{Trn}ef(EF|Bk3&;cjBBA!_lC z>GaMMKNCA6=ReSX|MXu`HUEXm#limXnE&?W-!Omiz^!EBWM}R2ONOep7S8<4ybS*> z`FAXhf1&X+v9dBS{R8da(|^a&{2w^~p8h+Iyradt7!7_^kN=-E{yps<`FRjIv#t*~G@Q3E|!<;>H6954T0!fJqskj3le}YV(8(bKMq|H+j^JGx6Arecr z1Xe^t7F9eD>xEz!rOPYGgMyM&RZO5)Qu*5B8(0wN9|I`5qYx{)n#@{hw<3@Y0V0iPBz1x(WaFD^O|*7$SbzbZ_pR)F(#*M(B8;|MLY;)(P>Kbf>u931>T%WJAh=kO}^uFHq>3zhapvz$q38o@{TK zdJj11FX{*VRj}XcujC@Ro=qwUI>zNT?$P^K_4_44oc})})Ult!XF}u@LE`jM3;*yG z8^yL12g5~MP48LOO7au}&C{GzG98&zG8HbH!5l${Idhs`i<VNC+h`)7AQP3vBIp)a=aLrS9&qX5=4xx6lFbZeJ2 zbN8zQltvAx%{WdVS+{toFJ{*0X{P*oybDFOqaI^z7m+Uxb3#m)S@;Ex5fg)`F)+i~ zEN+4zzEI1HcMJ~K_ZEs>vg}Nay3_($gPk7>9$9TR02jM^+Lc>b_r_d`G(~P* zm};iy90vjCGoDL#xkz#lbS;n1<^zG7eOl_GvwpUykRXT4+-@OGKKXbln%sUEGEA5o6KMJQYT@pG<$IeEFh+g4&zl;E149&i%aja#w ziFK~+jB7Y&*igjxp0_OxwVt_Y^0}`M(++N_XpQVx_e$2Olo%Hr3-YuZO1K}$qIk;o-mx}sE zZt$Q7S_EluYghH~_{POO(QDZ0wFuZ-u$&q!u6Ox^Z1Q^8DH+NL_Ox6|9IOVK%@}x` z7@>I=kbUn;V;B(&*mGP33+0wYBRu9%JTp7yX*$DfM3$4XdWqPrtNZXD<6}Uy1d$~~ zVsseA3BKab`kg^ICf&}TXE&|5QfM)1E|;2holMNO)A^`|TRB^XORrmoXZc07f{dA+ z^aC6|H%q=3yFuil)iQ-%5ifO2)Nsg;S6_5PL;+>#K{}~J1jaVY{XX+Y%xZNk0>JoRXI%j?wx%uw3DPG}+9+iwabXl}=^~pS3 zpoZU=1&d_x%X12(*e4h+l$9p9p10VRZOk3x*Yq!#Ih2;7eR&QNJtl^G0+fR>CJmHd z1UL6qaaZ$`(_5bNT#gSjvNzb)-gMEOO|8uB&AKQ?0Pj0xv z7+xXa&XBPrQB24V$k6?ZjY~R;Q0#iYRBb-(ylE(`t6ug8!yCGX%_@cj4<5%K&svdn zQEkRwfrb{EOR-J~r6i__Rq!}in7t)5qAPu%hs59bNb%M<(nLOPPUK(^;n^3$+(;%Y zD<*?b6mYaU-4(Xyuyy1laa8-wh9|;ZK;r2oQS08KN}!C7z*hdxef51(h`)f&PP;&4 z+QQF=sRJjK(n7|fUG;1Y#+qxB&6A0m$H%yjD$bT-XWbriHDJw}M6ww=!ZU`_z`iCz z^0nwA%}kxgNp_gMnL9+w-q6L^&~p;0Vi5q)B+)fpY`Jc3|mOi z&W=es`e1aN>W??kXq6i$A3e%xXko#aC*Km)uIXesL)YoZVYxZ32dAr^%`@G%i2lpY z)ReuZ-ISk$u)YRZ%Hq_raPKtdeqlc7fn2` zsJO0#4b>uZUkS5f!?VW>M!q+d&5K##9O4npyxcM4Aru*I$cP5$NEwXRM%(lIjUQn- z7IxY(>%~iX-#h^a@IqmZMm=nBdkpQQ{ftq@y~As8H{x+0CmQ_9Hbmca3S5y-^tSF1 zeAVdr6^>t|Xua z00LOL&1D2+0hUAyy>~Z#0!%a2dY0Su&^o3uPta|Sc3>;rrs(2FBD@tMsi$`8Cna{c zIE@{^ICL21CUi_!K&MVVEqqjaI3DuQXk{N$@C;xbQBU4O#|x@+YOY8X`IH-asaXXl zY?&pQJ4tCWl_$VX!6%|-^CV9+BL3c0BFD#a)DJzJn`FhSz3MZtO1n#`tM77+u^K;I z{tPz5OyA6*)@F>lp5l=Y?dG9Q9o@s+ZtYYj);7Tsx#=8WK9xI%PlJXtZ}nrJ@Up4s zdmmW91beF)GG@6b9E6iN;nttdOBa}lK>sTH{o1PQ9Y}caULuW|4a}DX&9J0Cm z8H=X@K#A;Fa7{=a*?Pe{cp{(mB0=kseA-H5IF;JY>%YP~bJ^w+;;$Jer$=2Ft4&B4 zjjKQyw-1)O)5rkPG~ORh_5zCYbRVQox})V)cN)7>1b=ugCpw$k^k~59AtgBg?Y8qx zx_gpmmiX!Gaklkz0r3DIe3qgg$XIfp)9ayGw^KSw(bakmDAzhB1olN#DMwb0H$ClFQvKl zxgqTs6;sCKdosb!2k?tgJ69;{tz=}qGo-Vz`$KZR5`B0ny;&h4_(V)`?=D?9E4@WiwBB+v{?{e$ zuoj&Zm=K@7sO18pQmz1|IxiEtKEHyRLI>f2pSN9)i_hxvLouyi8WMPUv> zN=Jnr9l-!f1ul(?_IwpiVfL!$>CDi{?7AbBsEmUo z*GSQB7l~5LTs*(lvf2<@R9~ND$BcEClKfUtzYESPuNsZ2E6L%+da->VA&8%r#S2P& z(@sU>M~p1bKal~i25kcLxKi*cPK}EMJLOMA>m|W)PD{T|T5iv%hh!tV_|}i{inc4! z%$l(zyXuP9G$j{!mJGku%IvDND|Fi1CG@^rJ@bhT^3BmBsyH$G*DFJ#g|2M7)R{_* zzXZD+`da7-^z{0`ZiT;Ei+qZiCCW?lp?MHS-cN&0o?uj~@X43cg_wA1wF&|$kXu0m z)#AL%dF^K7`=)e7zmTz+!TPv_FRUB&$h5A>ti!)lV^0=wH=%1si*r@yD^yo4`Cz1mvSjcBSyW1-p6i_5~`a*WRO&(bTQ2%D+w%i{8uo zy2WI0j#gF%V9%d+&7JT?!tsrS;ghH73i-g_hd~f>2F(ob-MD>0_ch3brmtc3HLA+b!YiB=DPRE*#ZAbGnj-)=8$7aw? z^BTtCPq2ZNo6DzQ;XhCL@%&If*n%xerxiZ3d;4hia)OvJi{FY6N6vIgLrg8=NUm0n zUsH<<30$Aj96`c~#}8D1j*CEv?`=w)n_WuOFvs?m2KcN)vVg%n15nuw=gH4}n^qQE z#u)-^tN!39;2Ng(^VgaAY4smI8%4Jr9xzL$kKc<#idAx^~u8 zfw!P|CGysL(Lg?1FKtv*&3J1Jms-B7%tr+XMU(XMgn_l^2l-ykz$@>jYvW!n#U(?s zeVHTFW2!BvSZEKq zJTwKD5*gB;u&C_quHc`2SUmLhhmo_rf`c7B&w8UoKk>{VEg~`|AEop%1{{fV#OCQP zUy<*G>yhh8ZtZv3RUs+hctP_DCOe4YBX-8;IS2IKM`}D#Xg=R<_#12hEWrHJ1bM;6 z*|EroW2z@iV(f>*b#_j`LeSCt^1*C)S&dbDdqI8ApB3=(;z0yzwj`bgcCB0BRMSVC zFr|i>X7$FhW})s55M2i{wf4*`xdk3w6Zo^3gda~|CqRdhb=!-L36#a0nv8_y2g3`suCC==KdxwLek~8 zF_duG&1-xd$!w~>^NcP9;oh|gaUgcJG4H(W{r0gao#BNgi z0!U=l7irqcHuO)r{O(i@+sv!(Iq!;BN1>0`=i$E>cWJIm(gVs!6!zab0E^-wi@0W% zc+AnHoq)c2=Ft)3+oPE_hyZUMl*d*d3J7U%$~vS{oP(dXfOX!zg|7&Kq7==AY+%CL z`F1a&0+jfG3s&8{lG+9&hOg|V#HAN=ek;tJzhaUCis3c)AyIU|DnFV9O*EQs?Gb=N zfksd<$k$-)p2_yok?Dplv0fuiC8kI|bwsXyZ@QRo1oZf0Ha9IGyK%-6<;zA@{@eLb z+~YzKB-FNz#d9DfbUzK9`w31(rBwYTigZ+jd}_mZ_S>atk7TE#o}!FF&HM&0FC*1~ zH%S2RR4$87P&sbZL6RF9+Wo-Ix6Mx}Y7O!n^mL~c*sG%t@5>Mugy-h4Bh1LGJMMAC zpGx_#rZjj9-}P=aAOsu1#pe9OA|X42?a!R!BSE9jgF%c}ro5YL)du!Xp|E=NkApb^ z2^Pu5oJgfS`1w6l&fLpn{mgFFDvpxc(;DW~M}qi?zkq`+^md#iR^vAj5Z}Gex>HKN zTiv0;leF7t;upf$?6RJ5#5!2QVtqiMSum$wSYpV&pZnO_RIUOJ%zBEbichO@Hg%Co zkqR@)F1ZSeB6jD#HhSjx?@bity2^z3IjBx@4tWIi7Ung!)&BUO=MSo{=x1jB8>Z6sWlhnpC>7_O;qg?KQW>Vtj0- zqJVFd8ioq)KOjfHRu~SYg(5A*tpV5q=z7s@`pl!_y^uOfzF$?F)~r>z;larUEhab4 zd%eI8i`oR;8MlOj+vJEDxUF9+gc1lL0JQ(@kS8l zX(DJ}+-!V5gjj0e!#geRmMElCJKM8gWk^^>-8hFW5lFBf^4k4uDh7H+)L17Ts_Ln4 zKilC_c`bhKNpSEq;8V~^b^(9so5q~Vky;K4+KzKQE3x|4GV#?%`uv4iCe)CIDA%S8 z-8)JDt$hz{mFcC}t{LJa?dKf035%0w+)kV7 zc>{fZzkNAiFHMy=(66k`@4_bRt12Vi0E;~0OGvFod)Ou-?TR>>dz{cYzxvW9-hNOj z9mJ(>N_21eTi@GB<0^v&P>m-uS-B@b13mF=gLf+<;5?e|GspVSrDl(>+3b^i&0h8h zQQU%Yhjez%@ncJ9`2h8A2PlgaNL?HDiw@m%68m?VwZ!{`$wmMW@Y~Mq8RMbtQvTqt zGclw;5J;gm_-l&ZqRGJHwB}1bSOSn4WApGHK6tWys8mOeTLCb>4+4=o%<`gPSyzyU zg3yIBxnR$9nZN6Zf(@z|Yj3!WV1z<2!@`(d#8?Wh)DjsQdq%B_@ zE=3CiEm8H9uMes+q$1s}aW|B*AsDF+1>#47ZjgfKf@YUwAf&{YqDhg0(M1T7cG;BR z2yz(~_ZHCr=xgL*1%VRq%@JXO7S}_wMG5tc+$l4{Jj9eSo)|t)3j#uMnm6dvvccL) z!^p{`&dAZD(s}XMD2xzRE1ZGtcN6yEF%{d*>_I4q`S&E~-yVdt->02?9nn>IDBg@! z@7h+mHYjl1{_+EYXf+eUw^!+@qo8ty;R78-wFWxzK}uaKjaZe=^!4Xy@9F~g-RgdN zG2&>7);QuL6W=g%>BhC4eM+?P_Igx4@7~`r)N1^9AM>nx@?`DBDdl;KNGWu9xFJB?~t! zYr3H^vjfr_ZRg3)^h!B2<3Y+zHyzhFiV#{@N`y94@StO7EZ_U;oKsAYun1LJDJzKH zwYtmCz*w!|u`2Z~En8c(E6zYvQQY`@Uk4iC2huj23bUH$e5sveX9*pIRE@Lhkf&Rj zkW?!@fAZQV00;v&R{w>pkeupp~z2DghL7_T%YS@$19Ap@O-Ml2uLi8xP@_h zv-+s-iDMLdkb;~0Mte163Q`y!FUkf>sDk<=$2zyS*A;+RlSr539FOLxN!dB9hS8OE z&9IZxiU~h+nx$D1NG=)AZbj1r_Il48NL%_%a9EmFm@|+tq#-4r9v`9!fE2X)8(<1> z3-j{S19{P=iYhI2Tfe0+Cp6>SJn2_;l9XV0%Gkjg1R>qR1U};OqV+=w8As~I1~1c8 zBBHdCQdiQyB@wTx2QKk5|Cw07m^^tUk@5cb|X!YlA}+d2tiu;ZLO=gJ%3!u>rE{sUv2I#{Srd) z>6zl^0M=b2%1U^>%C4c3QjK9`{?3ST4N7ALqNk$E9NHR%wEq4@;zt8AV|ANSH}J=E zdz-5#poN4>E%hY_>EG7luF&ah8fC|43tctLG)&i~9ODVw;XT$U=;~NU)!#N{vkncv ze-QsHauLSJNfXcrSdd`?1E&|S>hoDEa_*CKC2uD|V=7OfODc@*un=fhkQ z$sRLOB!Jayvi#hu_p^Q%Nu};bNrT+VmNcVPpO zpDt8lOSg}I+iWHi0#*6D~2p9yiDO zl&vH+d~}BrEFEA7J#F0yNrGH+m6U0AWqQILau=7j@4?e~$T?w^EH!QgUWj7&ZSCF6 zG4U0IwCHlx-WK(=9uu_-f0@#q-O!jlXK3lOuqO7rf_&~mOO!MJ;+bR3%!)_T;PKn2 zTYI9rz53H7Pt4sD7u%g^<-JQn{$p}WY6NaK@h1p1_oS(WX>Io=!HXU-UtB7YF3YWL ziv|gz%Wux^c5>^F;-jj;wro;H84BLba1G!>w%ozdV*B*&N&7*3-p7k`zL!@9hSpq~~*0VE$0h4PvQRItTlVfZVjNd}-ZMAZ+4prZ->^0#|?>Nw(w z6nT;vu*xzex1cok^R;NuK1vfro?}Yq1B+!d*cycX2xKn28;k)KlPtYTOjyX865<@G zF!beVnUVOs2~fSOXvoo;--@o0W3RsV5HCG>k-g#fh+$Vd*@sZp^(dV;(qdGP43uUV z;oU43u?VulHfT;3h8%NBQEV(z@ecEJyY23mDl*IL`EgdLl`|C}=>>XuJ-UW^{1;3UeyR-K+X88cKD8dJ<6lj>5EG&2lPV+01Wn%ESwOI-r1 zQ{Qy*%a`m-FOU%oSl_eJPF27eNHEy@B5$5#VUH2+|cQP@IfJdb@QKRuhmeM6n z*~yK?ZRP42N>@&<$4gszKLy0n)HXhLW%ok+_vN0^x>=4kgW#Wm0minD?jKUNKD&k- zZ?4odYi2Wz0tMlz@T2g(g|GI!&+=EL6%gB{+4PUM=?n0>Q!aoB%Ax?#2~XDdL!m=UaG~#n4@~_ z3Lr$XS!w(EJ)MU|DULNxNHMQM`Q>06#ht<_rQDBb(pFUb&&x}XuKBw+!N*ukC$hU0 zb~VDzd6h-7yo3?GKp>#dU@*3WieV)1feI3%swjwk`-c`|23>i_4ir%?w?ZL5A9Ze< zM)1L7R$WFj&}3E8dB4x(hCH$}77%rYOWj)BY1HvjPb(>}*iT%)20vL3vjrvWV%fk| zPl+CuGn}hLt01+*F&z;mdN}&V6B|EHC?2#D=8byoCczsnD({fmEIRRQ0~DtDsX7wU z7cIbGZkMmDe~d&nUee2hxrI=^uZ_PiqaI=vOd_6aFeLXr36uW_RUi6Ju%nwV{oldlIA5y`80-%QDY zSny5!=9w~!5b(7}0rl&GQl_EYP$0Vt=rHOaUFiCVYNa1tIe)K>9(1x!M6xKY-nCJf z(#6Y}D@+O!s(8F@tnu_=7>)0;C%OCl5}X-er=|D70Y~ENlw*d@vWz1IWwP2hq!}NT zWuCcgRW?KsR%EVI{Nf7cT=F6fT<9A6%j#0!B2N;tKZ}AKAv~{-Vq!i??JQGJC$Y4& zD5oJ|Buz?`VevIyUsHa6tG=j1r*S?WUllK5d@0U&r@kK}j$q!t6UC&ePiO%2Se#rS z5+#%oWI)|FTC^``xLrw`{a#|wX!bM7-+8lc;*G*1&d6uNsS&qiJ{=9`?y@@paiq%RnBSC-nek?PRZnSlk_%$1Qx zQvjpX-P{*a3Rn5DgI&tb6m_pM>IF#P4_dfS_8v3ses-w_%|uW?*}N=fpD+P~=MYLt z5}pZyyB`FoRO)Xd#poTdXV-5agtR^HIV%*N!p?-ywJKD)MD!XbdR0Cg z0l+1DN8wtCkz@&b5hzlk%T9_-`IVL&MSMCdxdSSy5N(E9`yp$hJj5!npHgk}4zI}d z4J)ETSWPy0Y|14Lq|0XCIi)}(<>>BqiKWGJbxE4KxcS?FPuW*oOZ;Le@&e(um$iC7 z<7)7RK!Uq1`7x;-2Rx`4^s>fyX%?txOA!-yBq%rt7h}l;_lQfwzSqprTD^SH9T}mn z2-rkk{p=-wzMKvUZ1RDXQm1buqb!)jMe*Sa)aP^$8We1y`e>&o3p)%ZoYb z5;7a{QEFwVw9mM)t<@F+_~P_H%KIEtdROMq!_(zq8jgjSfcWGi{RIKrRNvbu?n7?_ z-!`EP-q$eQ>OJy98fcfZGSA{N-yX_MT>@&iZ*{@i7&UiJrFSy#dmzdCkVAP+yc;Xb z2ioj<%cYsx(~-TR1u@->Gmt>LV92mam|#aG8&cx}DWs1IA;!!r6U83!%6u7({z7WuN*%3`4RWyALAPnTC9j{%l47za}D>{{al>KS! zT}^`R?e_qu?x;7p|H`ibYH#mT?$)!ImKpovYBsnQT@L^8w>e@{;@2F3L|-CyiHP$Y z-qoOp21Gaq(*7EVEVj3 zPTJ(CQ*0&0#$kicnA(Ml|6;We?4NgW(*M**eh z#va-z{FB-xZ&`4AxX0SNvls0(i0@Zn;x_TvM_f*;iq@+b6O!eGMayI&-^OlMk0cX) zp$gEtfm^+uMRlgt2$~h8LqJ~z{%fWS0F$CgR-TZgxu-4x!wsDxmX{eGD349)} zM^@%vN@)&mR5dx3gCP}R8pPgx>GX>@NMgBCXW(ZEqyn$ zW9?Lmn-A>I{W?gF#rAl2PJw%276J(1OH^KPZ|Cj&xNTN{L&=?Z(xcW#o`;zTZ$k`7 zP@7%|st4gp>O{|H&8Bdg#7o`7TgXf+fo^t)BshcI7@p!B9gp+IEd3r1!uKeVdII_A}D99&xt>aZR;UKItdMP z6X*xsjY%CEYGOv_0b2w609jKXGViU_{YHq@IL=(Og$)}}0@8hv+*jOgD%(Uect9Ba zD9shuhZnP^W6FmZ&#B{syY*BV;62}20NxytaNg#j{ zpD<=_eHdPvP@h7ED&Zp#hLF+@xO9eH(U?kOsQ zVC%Ix8D8d<-KqW?D%NHx(9_gW+UM#r(_#{=Dj5>)!iyQzvf6F{C~+MM-ha zD0@Y)_;9ncsrtx9U-5<{qj>k{@?LjAL6u7TW@e}vT5`$9KBr-4U9KapGy^bi)!4_| z#2h)84z-O=gzQhOj@@h5lOTTa^0`!$BApMg@@i6^JS55Rr?|^@4BV$2Se397om!lF z6c{kk`Ni58t})2)Oef1AF8C#L27o*jo+s#HIDgRJ%=VO?kEEtc9b;W3I3##PpQgtZ{t|OIwhO1I`W?f0YsJr zWcM>=U;_HW5dghh^(ErUk^LzX(P;{?=txd$P_eb+9CRCp=(*c*{lM)dK*3|#q34`P zn}y0fsUsS8azh)v+y&CtC93Qv!;44IA<&K1YnOzn5$%US-^?k*af5ez2?SLHVMkY9 z`n56FjPk2HVv6^Tc!smnBMUkmInAO24BEyD4hGr>lTPoF(kuN#)Z}Ug4h9UUx1we- zfqY|+%PHY<$!vy!qJuzJO6ku=DT&kuuHQYQk6-haQVK*bOT|>H<>%P8UAk^kp$`)B zbTIjxV*s|99QX`}VvY#c+MB#1sDfub3;cC@l>;viMXauQh!jGG%MOWI%Jx3*C;HMe zD@NLlRbhesw+cB###xuX3O3vl%cO6^=@R2m=%hMx%F0yw_9sFY$I1FS*)DUJd}FJO z8llV-8jkKwa*f3e7$sN?r-_A@FXLToN{5HT_)UD(-`-satUOptnc0TgshJfo<(U1% z83TY}+BC8kkgCzQL9ph#8~p>Q@u2sfMIWt)xw0>;Lj--XyZqb{;4HMIlhcL?$=etj z1fIH138OXcJmvLs3%OIEqv6zTj253mc~cYR7zR4WTXw>rSDi!_Q_*PNqE|6^P5FH* zE2%s^l%jq29)xuT?f|uWdgW_7i$a-?C4`8(H)dW%%b#o>bw3V1Vf$QN{W1rKC+FtA z-kU7$G(TTzZoXplzI@lC8Fyg--Mh)B|8#{Phr{c2{;G5ajfJxar)}e5K!lgPz*FV> zIXl&Xx#mj^Mw$DKl-=~a-c5d{4zM^VZ{hjM4!JwSyCEv4-JLH>fim^3<}e7RCUQrM z8Se9As`3#NxE{Hu2L1bf?_4rtr6F)9=8$)k|2%r8Wq<{LS{1z={YduZd&>szZ-ym9Xk%_#@;cq~7Psh2k$dv%=5V}|a^D}1 zOWe0jNRMD#EC?@d(%WeQ`d1TQseaaH6VBn+Xf-K)N#|b~=R%naMg4)*Pg1$`kSjQq z!0WipjrOJO^X5Q4DpW<7IVv#|5=Lohrc%+0qc;dSU%z0ebd{ zc&k=%BnsgdAjBh}Z~7*|@LIH8!bF^5ocuj7_Q5^EiTlcq-}#dT#ER-M-rXJp8Le@R zS9AH8d%%Uu!If2rk4HT{2oglm^CKh2wl66@M_UN^PQ?2`5#JIqh8hlf*4+!8W#WNY9qNG!^368r@;-ro=Oem2p zb;d>Pd@RIqD`xrTs3OcH?^Uj7y5eS}*rT&|w<51{>%PjIyD$swF1U>d`?u`m=~1gF zN)MBRqoBz!r!#OXO60Rk$u>wHguQmrp4*wJT%$rr6&bV1Z#}6Cj8mfn)LCY6C}5IuO)RHsH=g(KNWADYdEEh%i9j6lo#`s!JyeX+|cI9Gu7 z(c1r<8NMYX<2R?|kiI*NNl~xsv{NY5 zos$P3X)#9sig7q`uLpQ{yO(JyD)uNLXmeryQPyw3Eak7F_dJYh-it;N%u_w-G+awi zE>Jj)5<9v4DR%IzSuh(F#lS1iTAr;P-e4w{uY)P^dD0%&qd-x};oWJ!zf9D%rcg0aBW2w_tL-Y@}X-W-@iW zm~rY}7S=6V$KK#|RH5F7Qu^_Ztg;e|<(?SJ3dw)`!dgpJWMO z{=44&tFiqB-UDdvw+6NTGR_7&{9VDY_l+F0OygM^gxzb$P4GfHPv@I3%# zOpr3^cVC=8B=iTc9`{cEm9q}xuQ(EfAQ1$Wg5b{J{cY*;pC0GHe(&TjMk1R2sQLc_ zn33Lfi23W-cK*La_s>rJTgv@==u(8h$4aq3oAdr)G2kNwV#r@LXfNSA z`DX{i{|v79ji~@QQGbX;IA>-Ls=sW|*LU)pai~@a|AUb~_%bGX*Ae5qq%o1-;+Ouj zLC+=pAyEFGivA(G{|@}$siFa}&#FfMrlC-|y_Y)^Lv=$8BTNzx_?J&uF4w z!8s?f7v0@KB}xTt<$RqO6FKhzsXR{Uf@A ztTP(dkq5L~@(q@5-Q|1?*r)5Ak_7xuHf3$8{2tD6Y$j7GjlEGo9`Z+DtTT$>@_KU2 zMe94qq*f%UAvlWMFcFF-;D&trPL{!GgJm+63HMd0Mqk){5X#gx_&>`6>{7G;>J#qjoGSlY51FRQ(`g%Nmz*wZDGOivn)Nk=P_L{F2>X~THE+qw!m zcRpKZI9_NUR0Eb5CSnDjqbAAD@4x;HDU#RE`k|G#4pocF|0fOjm6SqXNbChbGd7o*eck*pow)ai-WleERK;puy4t7nbn)`9+m!c@e(|s z6wq8&juQMg%G0@py7s>(ma~{2-DAlw9SH@!wZB@di)3j+x;;N@qf<;NR=AoKNvI)#pLLp?iP+Ji_H~*aX^FR zwwpb|*Z8+&ERKhtmF}KSb{e(L|GS`+B0>5Lq-H;=t-qzpKOe6#hloxWYx^~T`=YuV zoV7U(iHe1i;z>oCYDoQ0{?I4+Y(0{#-D;2f!vGZ!oPLFUc{=%7>u~VRP+2ya9`gkB zZWYwYsuo(K=mVYFm&%i|)@;*#xNye8;xd&oA-NmaZ}hJR|A;oy^H0j{p-Ksn_LJ_)R!y+ss)t<2(ehDQ{6dOXk@ z@F0_DOAn0O4O(XkHxS)$sx%b-1({5*NiPviKqC?LGrD*L)}HQPclOgj*GG=mKsSE= zuXofo8jZ{KGB)+?F)~+D&}|IkoZF!b zOV9J_cX=jM9O~g>UVuiOYwh7;t>`Z#+kf8-s8d;h_v0sG>g0b3l6zWZ^rtept3)r> zU*WWH`8fBd-+R@tPJ&ij9U|0q-K15j)#e+^iM?NDREPX8;UeR+$z)8)mB_g${*`E@ zEPy4HwlE=we&u$*HJy;$Bi-V=cVHX?gunxFWRgFpxE3tg#_W9OfW5DxTZ1)X*b8&~ zt-J|fM@fFm<`lTzLsgv{E@C5@6tpNjb~O3)RR;Ur5h5j*9XmbozqQPq z{z?bs)%&n~AsjaAr|tq6^csqZ^hzSDZU=AKH=8a zra^dr^8gaXBtgvEjI~a{I-AeSRdMR`9jK~^X*6Bc@#s4AjC-pBV{!+yBB6cfgG}@{ zqQZ^uQ<+MsCGLp;?t5t}w?nc=qPT z6m2I}3Z*JbO*i7N7$9v2`P9lf_aCGm0zjmXI9R{2GPi4C)~`D8$>Sbtsn5qOeC>X* zZof}22jb%$)f8>|c&=Ds`1A?o^pGH}RJ%2NLiqb2eEn}e>C}W>0`5mXx&Oqj6bxiO zIN~cIf#r|G?bTMjh-rZgqB^>AwMr}ipdRC>CXRX_1rQc$7W3OhUwe%WtQ*DM9h=ek z-`fQ-g0+dp3WD>ZtG1#@CaOEE_bj@!kI-Fgiw?w#wg*#L3mY+lj5W({n|@gNl3=Re z_BioJoI17v=mH{c>v2wjG0qGDNb70c`PZr>7C3Kz&1i zDFP@fj^}3wUdXvw?;dqKqr7_Ugtq*;)%84dZhh)=j0nD}abOJXbg`at9E&R^camMK z*b#f3E;YFe2*m|yT(vm!I-4>rH<($ed?sA<5fT7APrkplq5So4urhePYFkWU3k1$8`Y*9<$gFYJ4x3qF)rU$18cHs9%#h)~_ZnL3Mjg z7Kp)2yGku*OV$@B7fH``w9V0K!;u=l4o@Zt*^=-G~Q~x;}x#+({XG5~(0~ zOtDA!y+Oijegb*X$mJNbaPM4&3=XS0=<>}BA-HT+SBYdAbla(mJnPaqCHBhu=*R8p&VWjdYxPkH9mVJz_e;sC0$Zr#Hw zKPBR}73Pf1wcW4K%=c<kZ3<4lDxo- ze6)lrbNF9v;Zdqk8(VC}lATE6XpXaF9o6=a2T9tcHfJxDmpWS|jrL)bhY%ub26z4q z_x3xBT-tiW+hI|7GL?|}n2{fQUq34&C!8I>@%{S=ZK>q}T4BuX$$RqeB z=5loh+K_^}TagfVSd5~y@kKrAjU=<_<`?=~sWrU7*Ada?>@lIXZ}L&18kvwcLhZX7 zsNJPH702V{wqNsL%_SsEI3R>8f8|*K^WMgpjE@F0T|W0T zHn?7)vDmD8uHd=y{nQtxetg)u`gs}aVm0r$1FLqLA~BRF8nSZSBLw>i&Ys25!+HBVdcklc(oJ&odv#cr<;GHI_tO z0#p@)TaC$_`raS2utAmMNeew{;>HKVL*lvP`ZzHIrAu~6Hv>f6 zhe3gp>YG$T2psAy3`+TPBXUI#3y?`~Ex1fO^v4>4|G zx(|j%=`P7${gP3_&Q_X3%F_223==)chfrUInCtHL)SnK;OVdOAZ+@rfURmz^#@4f? zDao^q7~smkfFy#|9i#5l<=gjpG%^tL@>7D6dDlmad8S=_D`-Ss|A~aR9!CqspJ)+v z-ZBpFkq#u=Y?Uv!)*8#RU)s z>BE}Z`Hbfdp{_s+VAouPXf?u}5c(bn_pe;kM9K)bpsO_s2Ly)#T?Epz796RV$E_<* zg;(hq^HYQM+7zhK|AHCO@!_)H&ip1-0W}=sd0w0|yT71#?-RrAJOt ziw48{=W_@jllWqD+!GT9?qBnR&h@(+tzY#2$OdDv23fLoG9hG_G-G zfoDz?qDlE7Dq3@ISbKia%^CXkX+2zK4yP3fO5Pl*z_wi~hLp+ecBV=#70Zi1QrqjP zs|*|WKr~C#G7xooGv2hj<2y`J2!V5Gi z(|&BrwdyI^K1k1Cw`ekDg5h_CTmK{ukKOdvalE-~2CC{5(q&{4?#hKBHaF7N>2PIH zIw`_8dMLjhy6c5E_~ivOz}Xkdw}g-6au;lTDMUxJ@;&wR%l5~&G}DxJZ?UNa!K?}T zpT%3iI}o@-7)1QvKF-YwcQ`$FJ+=9U{NjV;j&tngZk5h<(TTkoqnRu6+NTeHtUFo@ zype#5@g?2~HII`(6Zij5y9>0FV(3!Jq)nSp*9#S$BERA_rp5$uw?)i%2Q+iW*-{8< zk3St}fr6q@qusBt$R`+M1&?5^mC_0cgW(c3VXSr1Hnp(_>OfF-qb%@$Wph1UH~pT) zf%2Hah*^Tw@E5JbLE3I2kdQ5iVE_fzh(N$QB1r^Rc&`1(3U8LI?JMkJHZYonZMt-RfN)??bX z-AmKA2W{VLju1JSs16hW1h{KWYF{o!r*s!!QnjK6fBpu;P1a%PVi=VBee3v=NUzmC$w*&v)?8^3=T_oS)Wv57fvXnk?}edO^XF?G6($##US4{){1Rn3J3MEUE?AK^kNv}gwAf$(hJX!P9}LT)EI@&`D4g}N@17l z+4Je^#|u8ed=%~8&gh!-`NF)1{D}CzKW|hHi<|g!Uzztl9f|wje3tF?Sa^(b*Sj&U z;$z+$r^0o-i@Th?J<(xWzRf&e}j^mNEvCK34m9ja9HAfv`^C+A(>jY%D{} zRuk)~QST?R|7))O9EC|HaiokHx#^7=zafKcInuJ&linf5N7?+0{yJ3WT%C~mbq}f5 zg$*UmCFengBfkjex?Td=6qPm-Lf3z$zxwv-9u|NGvRv<%Oe`~YBoFz)Uuz`@c`><4 zU{PXl*-U;&i_Qlx#;Av;YFSq?C9(8d+T|Nio6Z#_QR{V85Ntixm=AFbmVC#Ns*~Bv z%|_U6kW(pt7h2#v20()inNMErexiSCg(&N$th6?2gg?#fp11Q! zPWGLAgof>g|J-Rup6_*;7s8(;DfRa`pWv(lL+h!@VxeLN+v+AK`dvdMG0ZY4*G64O zRk}maxdAh}A2)#b?(;frrIeEy1}^nZ*+J)axKN7i8ZxoK7t@C%ZoNq-T&Zm*Jt!W$ z0$iL~fgF~(dME7yujj6x%5OrWOPT@>%Pxo1nc=+iiay+|MDUDBpLuN7I~Jsj=DZLB zB1VO-Z2=KSd&<Yh7c-Eo4$SME@5Mm>$&m%z# zW)^r?cT@IHus2z~9a~gKm?=}OWbbhmPbr3Tfu{w~y&uRC<6T`wNVW)Y{0=;}M1ltJ zUv;rT+Fp%^cYP5}-lUwW&-Yf9E)`Zm+C5HlJ2WnO;n+-+!AM@}+HOX;2b9VFcmW?M z71H(HnsU8#bW`#MtULFNPrRy90tUg+FANXHt`Bu;!7`< z8^_y%?*Ko5%PkngJ(rL*e5eXV4zDMbtHQ7FN4g=Y@2}vEPtsF&_uqMAc24j5ZWi2F z8&xYbSXhj%#b$Da$uhnZO|MzaJ_KD9*zN*Qz}PCS4OBLRxfV6J-PuhHBO$;db3O19 z@@%!V;EXW0DPqBKe?qgW2#>RCPBqy7dAA-OoX9wmw$O0I@2(`bk3zsj5*56rW3|&( zhQgAY5|>Y=QAu4e!j!|2=^tL4|xlQjV~jhL)<1 z!%em$R}N<&cgx|>3Uy?tWwK~OFYoetofw=w{DQ=UtHcbyvYY2;*m<|0wJRla1FIBC z?|C!n4FT_+AO`?`m9Ep-{7pt)c~t~ymfwd8zBQW9Lw3l@)xBMG%MY4WA=>SC;&i_* zd`JN-4}_xd=B*?s0WFrty$n++Gt`zp(5Kqq*2-n{X&qKJPlQwbb%~BtvFeEs;*2h_ zm&?Ps#WM)MXXas_ftdCKQqEE&S=q(qw?0^1rpMP9LG5xNvRj=A_WYT;US{jXsV^=O znWG|u;;$28hTVb}dS5r?YIK{et#-PSrI?6{Nz7VP)Z=xr^9<$cOqJrl47DPIGa0Y= zyuG@M+^B7+zC8?F?<(qkD8VkZgIwwRfI*))yD9vs(j*p7I@*ea`LOG8=w!COM*O=l z^c#wi!*q71=Q~mo5w5O3*r?fB$FiKo_QN`QTTeL*5nkJE3ON1R^v`&}4jaonl@$z3-ozeB%~qq&m*OMjtv|R-CLoLv@a%6Mwl;5?3|{l^G$?`1wLKh`aD!@$)n?r*wil=n6H`F$lD>Umh&Ny_ME!@1dT`G+> z0k4MOIH@Qyb1fW|%gJ0Sdj(MJqT7EE8o;7Ul4J`S4M#%FT6T;j|2iVmPdSv}2q$W9 z+K1nCk6GHqgi%d{?Ebn#({g3hJHX+1*^TsN?Vy9A| zBo3Q<;Ry=apSgg4z%`*6E-81aLm#q2P-KdqG$H6twOYNt>ZpquiCju&rSW7)zX?eCHR?E`cSA2|Zn%dUAp zomg`H7ZEUtb`GPI=a~^k34p=pns>wq))>a5u@p!K@qbw@C>6STdA#{_Glh%O^A8+W z&sBqnQky-^PZvee3SpE9C;x#c>ymW_Y8_oN0cp@<&tWYsW7pfPhuKZ!$SQT;W7OlT z$Gv5dYE|9+*>c-h*Nc60IU*FX&uv)wOImTxwWmZI?Kp%hIhWDtB1)$C5TD39(IZHe zDbs(x9Mr1A+*Wr$BJ_^&>^qbn`3YKskA#YY)tAiM<~l(P?!*UwH`Q3 zKeVYW<5eXP^8QRA8^zeKbF25bt6JIL`gr^+#8U-U97o>I1id5n&%Lq&zoA=jntlJ> z@%$V%$n>6pzX1yHEF|R7&>>`ZZ!r2RM1=a%+vCUDolV9ZUSbtsm9Ws#BLs=uOa8;j z|199--(&QA*-igL4s2Zuw!)C%gVAg<=`hJ#K%|6VzuxsCd{8*!W;3-)hTfWETM0Vp zW^t%?ZMxdaxAco3v?|&dY<1}7aPBHonJ`Hzpb&+#XYWbfCfEu)OJ>j`Qaluv{$%Lu zphAC4`u13wP+Wmp@f#6N7*zrSAjDEXX0XS2syL=d@{Io>s8>DlyxY`~ZNM$L|-jdIJuKI#GLN;h>QrqZhvO~!lI8nX;>r$-#QQ~Sr z9vRMLRf8^ako!-%%cMvz{_&H4U3avK2C0d!vh7(;d@JXzBI8wCb*5L?{`LN320s!U z?BI6ftIaZ)L0BZ>(7?RLYVV|qjopA>t7!yv>`CevKs#EGMXvaO!3PLdcbBwO^`uDX z)o6U;QIdIC+h>39`Qa1c*NIKslf68nlJoYF!avIR&1Ne0PW^ zMXWeIXz(8ovhNtqu1%!a3Foc;CTqr^E|jOm6-a0jRe47Vn)9;jw3;WSBgqlFml){_{6*}FxveQW1OvDW@A}Cd;=jig+ooCz0xBk@5>>206WTk!MCUy!GPZc>E# zo+lzhL|NT7Qo8dM8PU_Eh8mdeoIC|l6{j3zt3Oj$GxjS(-(0dJ0t)JW$gO-MPfyUgR9SB zn;-+)q~vL;l%{$3{)~6~CrNKJL$>@%vrU3-M#kX&q!#^!JfDKoqdM)?D?D`d1HTV* zAvcuUt7vM)T%kW}^K5}eS*+swF>#~2cYcV%_;wYyW5s(VSQ@7@JJK_y zhVda{xv^{<5SLGf)VQStU%Wd69Selr*`q%|M1E0|aO1XN{VZOOyqy1UL}nmHs1K2x zS%aDh<*|JRZLYzxH-e!b8j*Hxk2v{LnAEP?C44L3+x2HX$-Zm!ZfSrPw+><4-Gf@I z@zpi>^2-ukQdsXUfVe_w5!$a+Wwl#60VmN^5K!RD#TIHR{H;h-<{Vwc!GW@VvLmYK zY-q7QTWD9!tIw<15$!BeLh?Yaq#aE_9{V{Eg5J z*(MSGru=9A>D`= zR8ot?9w`G>?-x?Zi@rl>;VC?2LY#|Oa!{#ae`ENipiD>K*548(QPtX_FfMN`mikV6q(z0}(QL0;@v{>W-YVr&$F=?6n4MB0en`Ga$3dS1$+qSD z07VhbHP?d5i3<^+PkdEF`a5?at{VDlqs{LZ;PM&H_OZjE6I6GU7XC*Oq;1GKK*s&b zHhtf~9?*-0!gm?_6;c(Gf!LD9x=N49)K$uBhus2n6tTeF@|e70Y1E6g$*_%K3x~-% z*BX^$4be`KtW5_=><=;mLHJ@M$hM!1fzkl!LB*Oj4d2#)^Iz>12`fw z=1W(%7_s_q?j4MaCjTj)q^2R!ev@d6ElUQ*VjZ z0OK&q?JecWLN#`E_ggUCt!RFX;Yh5@9_$gm7hTE|*hdtYS?X{M>H@lde*&L?y{_EI zqvbo)r6IyRj)?K6iL?Yh9Feor7lapnz?oAo=-8$3#AW>9SoeEbqR*ZMGZfD?!=a33 zah%AR5AX$vk`U~D)NRS;|lqLBOMzd z>Xu$;GL4!QNgR`AIzIy*|E~&p5$&>=JMt%SY^)A;D&wy}hVifY3aW&EnP95pn8nW| zZHSHHny~lJ4S&2YvhensUYs__U7up?9t!y{A9&nFk2pYFjhRfOQY3_-gt`8ztXH_w zc-u<}vQIqezgkpXeD;OFm7wb$<02Q%x|zq`2C&l4Q+#ON&d4ZvRN1GbU2jkL9}Oee z^ulsDX6>`YR@G}a?Y1H9S<@&i7Gx*r5Pzp=AM1b%5#@^zA~B{ko-|^9oeW14qK|CU zm~K@+Q7*j5&k8||CP?mwvhMQu`#~9~FYri2YvGUjI2m~pn1rT@5p*9b@D;(%?@(+7 zJC0@1sf$fJRKMoX0gB&1J3JzYZvYfO$+@}|ZH7DS8&?t+ zPD4KlP#5MZfPR`P5qV@wQH$~mn2c)*l`I&6d^#H-1Elg8r7zMO4u_Dz_CoDF;=i84 zS8HSj*ghpKw}rJ;e_ycyN+<~fvQybK);AHlttT*=$p{|~jebQc|1$!JvRthi>mOi6 z<8n@+%4xn_9VKxK&p9|xlUg#hU+CwxKyUC^51Ogi6!5y}n|MOVdA3kP z*avq9M$D4PM6RKm0&kc7F#|0z0{5$geF0OC=2bWXo+Z=(N?WN*Z~v$dlcMWhY9$!Q zi0ES@rpTn_I!5m#8fe~fjDd(IlI3$Hm%+`3}}{u=f8G{ znlE&aR#<6p+e3^g4;=9Wwvqo$rJd#RO9iYiM-HFU5W)HF!971v&+8;mq0wJ-$YG{* zs6F1R9gBn#Rk{fCY18&Uw|3^5&gG$)}N(JKOP*)mTj#8o`R`KoE7etD6>fI zuTeC$XiVxKmmxEa|IiE4*=-EUiOYi|i9JMKE;3pTqN>EUEd%*H3LU82*548jY)T)_ znl}osEc|4zjE=z=W*WlYuxm9K5f1vxE)`>FZhGQ3sn@$#L`Dcqxmwn(OQ3VLYTX^p z>91piWXJN*Xak#)XeW9;I+hkFGT!`rYLocZv3Xpl;MEueERB_yx0Q<~t9cQ2QH?|~ z!tP^bz9Oh!QWX3L3CmPto5F^8e$~e%M;ppuSm;T>A*0+adb~3wHb&d4ajT{e`Xay?)x-EbNTi7PghpU({Z_W zwsl$6sG)kLtc`M@$O|y*3U=yQCgX!+L(zD-UmeBu` zZUJ^OGkR#6A7n7cvZ~3{LqbG{cg`cZpMb-Hc z=ysX<*}L}Il2K(WM%qQ8;yX^h=eycvq%4Ie(cR6%WpM7T0_=fddPBvMZ({aWh_*RS1udxaVKVnpb%sAV$6o|KsRm>@~*;DHJ+!LWW$>i2zR>O9F!lIrhl8CIMX(^VD!OdpHZK{j zlx?ipRTpa?%JG@mtELB7@ih<&&Sr{wvlUv`8+#L9>(LXtoKtDTKpU!MA zKPb{h7XA?Mfym=UTC38cy7fnc#fF;W$-QeX!Nop{;W~B}j}vU-V;0)!m3y2JjW zT5l+djf74(22BOikDKoIs}P~X30tE^#EgT)aMmp+E{GlKb>ha~dAE(Ar&bXg;idDh zu^4n}6HN$w*e~vKOB|8c{x_MVVO}YWS)%7q*;G@CMx>lF{g_2^S^LL27l1=#wqO+| zDSY^-3BmR6BZz4-JSoR7VHqxfrw2Ob4+Lo7j07eAitlL#O&AFO#cr6T^eZuT4ZPag zE9D(zJ?iu$Ac=b;rD>nzg77qL){jpJjWW(7kZN#SFnSTfHyvL>!BM_UN!|mvjKb}p zhbi8u6V&W&fc5dUY7Qaq(9BWN&~APn)cTgpphZ;j)Q7+nUN&#u@|JzNPNq2gHQ?a@ zh3`)v064DHn^Yh0%!T)d#H5BBsx{ec2uwF2U{PSrtQO|#j%^W>$}q0Q56tku~XhJp*jN4L(R7%?ZMms}UDN?$9?;{Fe@ zQHMnRqsVGdd~ZOotJ>AiK&0ah?de9s`^QmNm&GJ=)oPddN}Ur*^`#yc=+-es+W<++ zM=_%A+5#5p3gzM^lXB5u#H1mHivw&9G1CEC2PwDnOM)LPwwomC`IlW@&!NFcc(A*v ze}2DzIKr)UuGHPNAZm5LM82Y99^#4$-y2VHu=37BjL`(9*E>DJPO6*f6j@>+xW7BH;0g-nuqao@$36nIm!*3xX}k!>3$7Iz ztKQqL1-0UGO>(98CyVx(M#s|csJN20n@HB}lTI&}$CFaf6rhhq2@nZ(Vorn-@!wd* zh{QM(sdvK4hX30Sw2&P_i9NRGF!mH9{n?kfu){CyI4coWkAi?PM@*d zXkjkHQAyi-`M2?;AiLl~wNt9Nx@%cd-?1!(kMbstfcqyWrBTB0HlL6A<11M3)_jb1 z_)wdPMx`YdROYBf^v@LA*FOs0=jwNg&ZE%nTO_fdFr;k5N==@Y-S4LEJP9Ori;Qje zIVcdb{Q}qTU;~eXCi9FFqX`El>AzPVcT~%Jsz^f=jVOH6#Mbje@bX1tw?`MP}heY)RJSozlW8l1C365?wJwgvI&+$OYhm;Z*c%>O_TMV zt-fwfsXFLvo*Q6XxF^Nl0Kx@(w=i}aXB(;N27RP{9G`;T%_9OFK+_?v&Q=X@A07^J z0;;ZEu}%f`eY&!^9VmCt6|(tgbUixtM%<5n_f;&_>*#cX*FCh2ybZ6mWnH8V&(qaYLlo)o<88eYQ=1)3Fv`L*DjY*(#_2H%ptk?#^Ek6;sK0IN+ zeF`8+RKJO}6HHG7bb?DuESY;AC!41DbuyEo4Ii7&|A-4Z^*p7&c7g?>`|in2bnPxT zNv{SH)~x94e4I{_f11*2)&(9e+@We^?TxF$k~^ZPKXuONkzlI;)VzeN1rOco5V3tJ zWb61Uo%WXVYG9-%S zZ2#@L8Ji3z#sC9{h{QNbE<5q$Rc?NBEG-eWKkpEZU3_Y5)g|ZdlbLjOZ|hW zZKIZrg+01XoQ(YCl3wZL4{Rjic+&_b>3wyz`YUL~&WRctib6KYF=|Mq{b**#%x@-Z zFajIhWG_@~H}{XE4*2Y*uBB3#te_4-CP0$dYxR3@i7h^$*7>@i`rO~(bfWf@UjlTR zzfIYrwu2!E!}?K03EbdfMfFdbtkm+Ise?NTbyhfrREsWg%f2Lf%$I>0?mvX0qm;W{>8>`X`41=V^Reg3CS)Sf0(>Askt!^po`&?E z`D2iMiy3hQe(fHwT5DJKJQi2r7WemXxj$OrRI2Vdc;e5XUi@=cRdww{tbq2~J@eZy zK)24p3IH|Nj3^$fa@JJU_2{Mr!ImT3B95u$iZ{-tgFt9ewmKXjyCEXc9&a>DPBaDy z^4~cU&t%6<--9&7dj?d0gRGndhPRn19K-Jx^p0^h& z4YRn77BGkoMLBvgL^0#z)g8a8BVLBNP2YUxr>$Q?&|j98+}+aB#wocL3q*^KKEaqt zA7r^$=btEaF3hfv&zGsm%g&!>i1;N!N@~wTN@PM_z>@fWfcT%wk}wJFM>Hfx(`rQQ zn9Fr}Td^IoHgAbXk?RULM^jDSr8XNbdhE?VFDKJXw1OE#K8;ZgYkC~Z<2rIH`;*V#8j6)l3OReG zzA7xWZ=~Q`n^F}>#-L^uP^!#+(6~e@Q{2;D-{EhQ-s%flGmmzk4)syT{kX7*s5$rh zrZOxTO6IIq&vnaF)=w+bBl6d8b z+#ZA-(4B3|EdJ)Eyb+FvNe5U;LoJJBfzcIiV^?fWwykElJN-W?Ehm&2jbrKJHs|`? zb$MkcSGlb1)SW&XuCb- zW2SiXb>rgKxj>|AwCYvl%l&dTmg;5Nn%8@ibUZeLw?}h(CpN~EWnZ*WG_y8Ntf5EK%}N+!Q~UV1;f_ulb(bYW?MB zYyWLkspS;d7x&5jw^@OJ>t@x_%U=D>^)RInW~Rv98!ThO-!|w8-t-TdQ{}q~36x%6 z)`%kbP_n!E#?8=O9R^@E8*KBwe(nEZK23%8zp?p00m`lPKLKiNO1|sr`HTGTGg47X zXpwC%j87LdUjxiYcx8x4GU$Vp?dHJy)}obk1C_SNun#r}eQ1NoXKhCJe0ERG;}dzK zUaC_IT$aNZSB>9^O*h%?7ieB+UsYzWUhanaWSKhA%pK}(zH(jnw#<-*fM#WGk8T9^ z_rL#`rdUFf$DGlHm<%_oNv2zxzyO|Vn=X@izsc7|zzp3IZw(h7EwGTI5Va2_=pe3_ybMcXj zCgPtEE-xTr?rM1C`-h;@M7@h@u+K(Eeg8LaHIw4{1+oJ;x5qz(=$_CsG z#er`dTRxY)$c=XkEB8a*i-bFzhs-H&J<-rx3Fx7qEuK3zd0I0j@ zQ6&1K?j1nmCe`cjhf*8J+eJk8;JP)o?y|ve5CS*n)#lvU4;i+f(KA^mrg|v0)teAR zMT@Z)86n?8|KKnudKdu1gouN4Z;EHSVi=5!gy{+2u8g&k%l~sIN|vu<;WvXQ%1!d@ z{s|v>FEHUO7#{0K;ZM!?HI#{weT4K2ihzwKH?0Z$fBO|INvtxIeevDE*Ie6Ejnxja zWsCkUkqRGucN0jeGpKEM|A%I?tZ`1_#7$|CXp+-2l+BzMS>y0ZkrlG}MT^_BNYgkW zUHXMP+iMVZwybgz=f+>9As=Rr8C&AfQWcvrM1b=^_#Oz3ux}$`hGS5+mP!$SpFKk&ZJz+`x9$P9sy>jg2g}O0qEW~!8YK3em2>Ji zdZVT|wnSVJM<*ojL+hHyzf~PG+r;o=b#W@0A5WG&{~G8nzZGyniaxrylw}I)mc}kc z;+gI%411^Ifpf4|1{(7(Z&{|s?xA8bdy^Z5whnAZ-cQfv2T7TUxCc3z&f?{f&;o!y z66$F6F&RU3sU56rzn7$5XquxzSAlMI68pWE-?9OmdA}Z(n0ha$GL?|1S z=Bi$l&PPHTOq%av>%{!DOTsIgZNSFz%L4>;P;B&y%jTH2kg-|_5_@vtj&WNgGO@Jk{J1ndL3KH=uD6_lxHSX~ZZ4M3SYWj|x5Ss5A*GL(aTnF0LL=h5 z_qy3LcdZ*LSRloe=mbY2GWS1-*#;|456!!U{-hmi-qLHCGSfclK?ot%KK26WAa5^)=z#S<+6|X5 zbG#>JrMi{rKH%7Kyu!adN6ik#OK#30Snvs@@5VqDBQP$PvJW0MUw`SVdFF&;;}l*b zoCv-Zc(;B3*1s2GZei|2+`y?>ovkodoFmtuP#aRVvZrJBXmr0}SDax}rx^qv0uTTc zd;fH2RApB@=spDgIf$Qa;zP zrR+C(V%~kPnI6f)!m}9|Y)UztoQkcB7bmkA`PXitPlVD)<9qjW_!~KLPmAk|Oa%Kb z!%6d74cRAPx%h+4u@hV0x$boH14TQxxOFEkwpV=ir&loAnh;8J&OIN#!IazbUmE)* zqsl%^S=Bch>pq}qp+B{Od8ZL2UtaTb*TR@ zSpSJw5(KziR&@2YREe_myMYHQyN?K!gNU`i8`Dq;w!ctZo!rr4#3M&VNb9iag;Ji$ z*Lj~1&p!IM6#J^5b5Zv1ztBx<`}`2Wor^Hc%t9x3^qOvt@$gsn@K{`@L5(I}&EBmN z+#t>4Z`#7W+yO+r`Tg#Pv0B|{D>hUnpctu;!WnLg_%@oY^pb?R^Tn>UzxA?!xXC1E z|1S@%N(IT@cv1ocsx@9aPrN(GutKj{_x@tTW|$VlbUz$ToUpymMIoDv(OFx?DLWSr zh@Ut$0dmjj+H*$M>Fs8osC|BGY4uH#O0_OOgKDw49zRIW`%%^TV#!Kgf!fnwg~PBh zh4mmKlSH`;IX#;9NSl%8W&E7q<5%~i*PP?wCFx99_#Ie$xHIN9(UymUK~^mb^}UL9 zd!X5JjkbMa1NxP>z{dgk{U#>yD}TI93JpVXmV5dmSnCT}dYswt$ml_}&jqK=I=xo2 zb;5fzL9GM73LEF_osF@5h-mmdjB?|TNncv^>K}2ZxK&X~CY(+dMyKi2N2dsR0W2_JfAl5)e#0b-$0T*SA)YRI--VFYY-W3~uAe~ieS;yk z+n0dfec(+nm*4mpRGo9YLHw$-+F+LO>SGM9TC>00-1xrw(n(|C55;qkFy#`zYLQ_} z_0*omWR#cIqxD{O)cvs&i^gzYZuUumzp>&>$Kj`Q~;8$9hH$n(JD z*#EP~{`-`IDzAH}IJH5L{O=dxfA{bI``aWiu!U~OXoLde6h5|MH;y_1h=%egF**Mq zdw&@h_4d61!-9Y!(hAapl(f>#5K4!HNE?83cOyzD(jhHKx5SV`2#S=nLw9!$4fn>Q z=N!*DKcDCAeSiM%W_0+*j$prjIwCG}e@?2bXpZ)~1U zPjSo*kEabc`=`B)rEzUcnzmK#o$9&cd8^&0@9#m~OA(?tP) z#uz_OM}JKR|6MQ>1lUSwep2F>SeDe~7fe!xrMVs!k06->nb+3?QyU_ur%-7d`cjsa zZbgj^69zZ^J&gV9N`HJZQ1aoz{g5s!8XV7mmq3sH(UdmgE1k`9pbyur)CN2-R&t+a ziHncuR@Q?jmtJctb*?t7%DQ9B{CRTw=M^E|P{(W1cHU{VtE(wuSlb+^JU5<6%+wJ^ z-2~I6a|dnHua6__RRs=YPPmpKpu9lv?J6$3j!|R^AHhlMTwP9Sbhb0%$=rZ{68UqK zLUB-Cw&`lofC_=W0C^zOzm`8F0m{Z16uBIPUm#z+%{}p<@9O(m>@Y*Wb`Jbd^GcEB zMXeSQt1CDESY}XTpHHu2z5w9l%4bycE7I@pVM`DPH2_%W2|@^9fk-k$X#cefzVP{E zVMvz_;sy^H&y#i=l2O`h;+GeYO{qQ@9jkOAH?_q_env>FgSm&G`Ta_g`wt0|FDCtXcs3`u|^ZoOa zPXc==udq`0?q}=mklK@uf*m29SId^l2WXY6sXeyQE)3NFb+;d5ymC3s3^!akNY3+Q z*ob}X#vWykyz3lyz&f2cV82IYll|Mg{0v3&SVJdK!t*-BmVZX4|M6Q05t?oDM;Y7T zUl!Xx42rkD_k}=x-{0A^08A8A+B=(f?81L@p$TFLbPDl^_I(0%TQ_kRA-zu(X2Egl3)KuE>O5crRG`TJK-@XVgrzjXujXqQ8qnwr~X zek}UG|M|~1{lDS)zv1~?Nd4EUg#6#?`TyYN+B($u%k+dZ7tN=Vwy?_b|I5`uA*s-o zSTh<+rI0r}5E)$cCCR^*#y>y#u&{zaSI$d_3+Ff1u}1<}N7pQsAHnfY1N4hgGB5#F zP4jR%#pXZ%`;Ry*loD0GCy6qr?+^0`4Z33R`Gx5n*$xw$e>kI13v{H88jW0OA|46M8EL@2Ins4{~qc8 zjicmK(_-?eKv&RkY^1XIaieS4baO-rmf?3lUi=DLprcY|%55@|78uEwW~0hrNQ30}Y1ZE5AcLjmrUno<`fy!-TaWbHT{aJ`?qw|}pq05uSN&h!dxjh+ z&(aRrNxHr1%hpz6vv7!=X^CK%PY{0g94yTy@A~fdQnR@xs)nDG+AOT&mS6E* zgAMwmKH7jE`7B^Ldo{*NF&$R){nyzplodT3C)A*=H?{jepXJA3L7jbQ=OLJN%-TP1 z?32gZmDN0DZ!z%^1-qxrlS%4dW@v}--6fgBK^4y5ZM^$Hnb4pc*U#w3K8Nn0rH=N} zz}+$=*W0r(|7E~FVs`n`CR{!E&C`ZH1u@;sKu9#9#6O?uugm#Zqh9@RUD40|hpqjB zM8(d%)`Fa`$NbjCmX7_4|?{yj|(cWo8IV#}gBz+)!f6e?pkH^6#)Se>fOm0syo4Q4US z2H1-c09oy}YdH*42mjcv!y9P7HbN(-$Lq1x!chFQ87Eu6u2#po0bOrc^B1)Vbq4@f$9Rf3ZNplBnp}-FzhWC*2!in^0qb9ogulH z)UrakFVZF}M$^d=$sOTPprX>A=fukI)tU?grk+2G%V=6dqM=-jY;!O#ogj2;p33VB z5d5Mx`&JOv5zpJkn3-@B=#@q-7nreTCb{P9xqSH5Q#FO3kAsf2fh2;or>HgXF?_TG zix(|M8@F15g9jwV)b0h{cwCFeE~BP(5i^d6Or;H ztGp38^+E~PU3ZmIhIAk3*J?F^sPO1YvFweZH_fEPjl<*uvOdkiGJvVd@Z^mMT}pzS7QnNxXrs)G3*`G1yHRHh?8%TS1~nUK!cDx2}SL>XG+auIVU zTgJmS;(NUfPZtF{IOxWmkzB6KOEO#+Z09MQzQkupJ+Tg@?cu={WIoA85%3=$t=Ab@epm!P%1?5*C;Y=E;tda9 z_>chX^Y{zI30b0tqiOErI(xjX#|FtOgQ`GNV7Y%R%|w-dKEW=nw}W@ECS5KjR*x1< zS_ne)_csGJ2lf5MMfX;Lk-MhhSg(wg2u#A_NT-lC!czA6s+o#`&uQWcC1lSDCRNhk z(+dIN-dMrLMbHQgoE0~mRhcPNh;H@Rbsjzf)A+lSQgLWHxM9i-_+Fn1{Bv*`(h&@6 zT8;YjG%@p@NBP9$CZknv?AN<#R=U&#y-E(lite??20ky% z3gJ8k%%x7@IQ|*%7{^bz++@X&*k24c6zBSvi3=?#ZCQ<)X;@KdYud`pgYwEr_>lZo0phYY%<=<*Qk_Wye>K*& zM}`4it;A&d-r$F){uD-i7W=11>vT%TXd5X=o7o-RdFx^0;P(i2wv+v7T$McIJJmz) zKw|t|u$%x@0?cAJt{-`rUPH2$T~+CrP3$!~-HKj!X5@E6`@@r$d3tbJ+xb>j^<4ER zfQcJUQSoi7a)2xLw5%ZtG--yN%*zq_pa>8FB&w@#wz!VNEOL!;u_*lH_wqI0XCyo> zNc>2LO~k5Ip$s$=Sp=O{B7q2%47y#%K!wdy{>`S1?R686rAo_DExSDIxvCBCJ^^@i z9~UCdl_Cq_FGJ^`MSP~2V87L(0!R`?)eAzrq~zUd>9SEpvje}H*cmmStJtA@O?^V? zgGEb$CODyL9F1!2Ny5WCPp6s!ZQEGOE9mK#Jw6AKY)$%8(KE#lk3fOeYW(WkucvQF z^x-GQ>#Ep6C9?V-hao(37oI!?>52g!Iz>I21Dg7ma*Y5(I2tnhZqE zT9UaBDx-KcT=I&yK0US3+O z>(r*Q^lKIbtcaT3iI;_SN!09hJ1S75D%{m&IoVxc5KDSxutdr}9z*%LYKalC?7E1@ zOr)wJ<``|VLX!E=sNntDB&GFCH@Vl*tb`W5m!ztkmW?hlHIP+1tm7wKw><$uDq9tc z9h@GA8i6n~c1jAEtS{ARngs=ifwlA**k3JBI||3S*k=b$AKK22w?h`j+W~Twx0|QK z8Kz%H>xOf3&`f1}v|8R`v<(T$Aijk2>ITGRFt5YZ(HnA#g@%wIl>pqZ&Jp9$e!uw6`# z8RBRV1#9N1FHM!wh7RMn`}Q06iR#!CVU?Z0d)OH)`n5t8OjaKC-YBpjJp*fFxQ@AE^MunwwA6Fdt8Vel2Jn3YtV7F9=r}s{Qoc0#+WPam4=c7> zb63hp4&7AG@;grJ`K-g0MKBA@sczGDxu$ z;7P7pinr_7e@*E_zM*k&L8q*D?@4B5@{A&t*Q-KsUWP@dNsx{>jeBghG8YEmaHgZY z0+>0XA+xDCvjWVcPs()$)e`~1{do=*-k)~o=AI*Wy2fsjy7MpRmDI5B4wXpy_g0-C zhdW}XW%YVNTy174FJ$RU8-_|Np!O2Byp&rAJF5Bs=PsIdEneUkKHg{q?0)n@&yy`m zHtAH9$ghclmv$r%4wnlphRaYbLXrs24<*vM_2Qf|E?JnZC%aXUmeiN80R+*KU*!UA z56s*tb?{vSBT0B~hsKoGg~r_*Ho`K;4Pj|>+%l{oWN}OOoRQ&rf@wU95+rPV-vgOC z&rWoqop-`alpZsW-3UFubW!*82)#>za~IT|VjRWY@uf+VvDiraA)a=<1QKA zNzk#DyvU>^d{WALJYZ2i%H}lg5VK0nVZWeErfh9NiTq4927pu^9XJ-VIF7@sP6L!2 zY&RyiB;aP&GpCm*Z`&b8r(8xnI)!^Oovem)CFg@RVfNX5ytr>G)G9VGx4Ifbq>qrR zaM%(Ia4m-PZj<&MJZ?bkmg&)T1pyy?;)|}+D66hzwZhg+%QVkx9N*~S@->S9{Vua6 z%F${~(GJ&EG@+Xvs_%VDoyI(e*G6*@sQ-ogM}OU2Dm_7eN4spD6k@C7vUFqSy8$6ZwW{Uk=ti4OS?Y(#Z0Jy=v>Nu;NTY;G z4;L>T80(*pQ{iU`Yuvb56=u|<1$NmB%IR_Tdf}`_B0LIY?bhkN846`>r0rcUqQ^4+EUUwN zBwh~&46&b#xSBmXADc3%_UR1b0J&t(!))!+^%H&P1|0a3Rjy^lR4X&wb{NK>!@g98 z(54wL9p<`h-<;@#fhJ`yad-QjLWPU!PTWRpt;bz|)84+(tC)_f4v4{7Wzn668}m60 zVar+0p6ZNy?2V3X zXdTYl_N2*d9dCCs#PvRX?_#PHp_o(9Xts!_dm3|wm5Y;mo$ciD=a=8&$pO52Gl`(D z7#y;$R?4;EO`DjB?WJWSA8b+y8qkTwD#USNw&D*@f9fxBS|5`fZu#Rp45_|cL75|? zYlgOSRc7k&rm!!KC&KIWq`7X1)ofj9RTF{sN$VOn7AC*V3#yd;jv3UJeKQ&vc%=C1sMGHqgb8W#gZDB*_ z$9@oCQEa@29kBxH*ev(n77tC+3exk+4{T)LUl}IwDFD;wDsJckVZ5uVxYdIN z>?M0Qsd+X!+T=gkRhaOf*JH07c_O&6Av|f0U z{%bvz;yOveuk-cY9rOsWZC@OUuZlj%V&6Swz=_zNd0!`@>u8sWHeY?G+IL&?JPX%z z^PQNl^mgdJ|2x?>8xFT|X&+#FII2haclTX8-XVzA1SDv8Ho|0d^$jGgB}IKr`*Vi< zx$U3Zc_>rwpDh6uq)S4Jh1*ZiE=eB?L(7~b((GGXY=-w%L$Ig^@Vd+lV!k}&5HAgb^2+|gyAYbIU9v25ig5b11fsW&7nCxxNGb4 zgKfA_qP4E?15)MgWpRqJ_GFmlsHujpzrk*d%vW1*;EQ0H^TP9!8H|`o{Uxp6>*r*SOgb|OxM7xg^dN;{iPoG8hv-`85wkF*OXTfIn7j3v~#BX+6 zqX_*1*4QM`Y4%RV5_x@EOc_`XgYk3$YIxywR|fBI~C z493otSYfkhV@P}QD`I9#4c$(XGgw-*!@>v9x*(2!1J-&TDq3A7W1CNMvm6)&y=rE$ zx62$?Nsqb|2R@qrn)!PIg){=-P6K{fKZ6kWg(=rJ6-jiK+V_r@V;mEeRsBEMf>gpy z#h6TCIpDJ+@{AT^)Dd=)3^s-Ob)NN}Ym1+~+YRy-dOZt-bK9NAV&d4xzVH3qD;4!p zAXAcwE|uVw29-{;u=E=1W$SWi60q855iE_4_0}EdUUcx+3o-7w@G3Er_LTa~gv;0G zh*ibK9SN%18yp5j9vhDrx>DxOkPpJu*h42Wt}&@e%f?dX2&f^#)8#%Y_T(ezMOn{U z)(V8lKGL1xDNnYh(bj=9Dy#xo)Wtt|jQj3Iu2iQ?+oFiTrmJmX!^nreCugT8W4BXJ zr;kmB-VH~{#<#oQ63BM5?lJoW2!vmaG_oEx4CfKPGt04Zr5_*3j)*D58fv8D<4Zk= znijpZstMw+=xZJ9nHIe+QkL-a2#2cqwQ7SIZL8NfG-OP(oyq#OCytg`3NydfukJ90 zQb&~fUkTnX+x2@%fzx>P!))})@cXhF_XFDl5U@2q$P~lk9hcr+!W7mR3B80x#8M<- z{W2HY-0IkJhQ43gt7tcf)Mao+1P-aj+ZQ`4Ft?{Ak?|Oepyg&;upd!-L(Q>_L(|L< z)snunq&Hf!8}RoStD#>4@Eh;WKi(2%9kn(-J!mUZNFd0YOkyBsC|5F zG~}zk*O8ZIrzA93k||s>MvF+g;QC%DJ=U%h!yW<2zu(6$4H&+b0{PoP{OUDo%Jfo8@)zSkfKtQ~qjpxqV((eO$DklR=m2SuCQ??RU9b z<*-cu^mEXMM(s+Qx7?35r$awPZ5PnPy;^GtE^V(gQ`xy`;+sCP54?9w*@H9$H- z2F0DNlZX_hx3?SOAL=H@xr6hiB!jAgMb%&7pY0{wtkF!EXceyVRvdaVu*$3h+U+^y2N!GCGsYW zSH=iKhOKJhNq0;}vZods;&h#q#KLmz%$(BC+U@~4pEcAzKoK5{8MRimY`IQb@*OEji_m)Ffr>pINy2uqe)Z-J-SV-?YRz4yFTIdvVMN# zV()Ntmd9rjpasfl#k=R-L2IXwWnp(ZRASKePE3#gOdMoJXENd~VVYV6&pH|4N$qjj zxO-PAI3(xdmj|q~P0LI_?>JbMXqhNYD=&^ZjolGev;;`<1A#uHtzQoVZwaIk)UaX| z>n4w!!%vQ&NP(Q)dOi*ge9Wht^~`En5Ksa5aB%bB4YvIPu@1$Y>^y6C3Ym_ru%Nx} zJQ?F7`qjRPws1PR6}h%*2J$jRiehGNndX_bfe-J4C_+Wv5 zsp#5w3&)IEF$pVGIGxSw`)mxmdy)Dz5j&=)VVVWC6NEF>ThD62S~E_C(>>^Z^@=Yzl3Zd6Q!xgSpKOt>D^4v(D!(ES_5P^YXo6Ct~u ztz7#&PcPBBM8}QSetoQQbq=n<8S$x_I^PeM%E*=OYRRx)e3J6BWRGACwlXY`vPovq zs~NztNatPLO}98`LzDW5?WEo>Z&`q%z8Y5M(o0|Y>8f_R1&ex)eLX)quHoUs^5z*F z!l3?%o{5ISp%@JIZ~3p68PnhvNRXPz;}Q#!mf1U~3lS-1*Bvu*C9C$1g1y)1)SF7? zEU>6vPCwi39Apw4b&ueUe2YVvadd_pw$ke)JhR!gngVvx+*;l(b78r(w^b&o#%0CD zY*4FKkMGoDw3zfN$zj~We1Sz@eK*M9n}sa5u8dYAFf#3RsjgP-PsxqY{|evpd3#N| z9DoPz@b!!cu>w)OPeoLvIOz`HSSbfu<`6_J0$B4ws!Jxe>%u*XS8d?DmU*eLYKh6J z4is79<8enni8f?mNO2YQR5_ScPQ7BTDL!TYX8HX7=z>1-N;CUHrE%f)v)-g35Zf(y zo@SDq?C!^$I8@od8!h%?4A0?a()r$FXhAP0q)j~r*d0&>B%|rE?bGN7AB%W2TBK(L z8?U@SBX(LF(fsVi*MOw&CffkU zfYaj5r_COCw{0qNq4T^-9B9^D_m|{0Hc>1c(NI%xCv?jSOWph0KC}j%-7pqwW z8T_$=7iuVcFX77Ug!-R$bh#%!y&Hi+Hp0K?8Z&Ge0rUbFQezZF;n6{y^P1(B!t6@E zG^WucS#}S-fz2eg?R(sM*KnAm!IW;*SBb_UeimNG3BLMx^Q=lK3ZEV3= zGfm=pJ&KKfan-K#O_dMc7GS=otlr_|mw^s&?DZ+a>^oTRF}TAc>;qosYnKl(VC;T= zu|~CY&-+_?&EY5enApppZOT+C@1@kl(wJ8;DgU&t?OPU>keLp${ZE2J&1oW_Sni3M zec+aK@->|3Sz3M4>#4b>Evk~4_AWd9{WeLvL0!8h?EEO}i~QWp){XXW7PM%3UBl4I zwf!{?cM17-exdR}OkRG){;eshq{XU&Mo)ni}WP$K0E zbnHnffW^5yI427fgvbt<5n~h3M%ml$>hoHbB6MBh?-38cNznRe=^~TBGwraOcO|L( zFr7MxEWJ83B7mNRbZyPSO4`zCl3)t5*NlT($bLVxFVDp_^_^0d$FWPb(>mfy!*3){M}%tGKOAXV_Z0pJYlPWrHGub3Sm8Iyl1K<`m(|A#jvq!7ntc5(;}1<=Ia)Ch}(ybF?}5a8%>--0~q z*MJY)9jb=DAV#3B$n-ln!U_bSlmy*nOYwgRWqu9QQ<=bzauU@1emNKYidPsE1Gp~7 z{YYb)U+Tg?AODZhkW>dhQsd9Q`kR{-`$BtA!gVTFTtLB_OE3Y~;ydQ-GWEm>cF0*g zW$IbaVsg&7Lh*DgZD=quyO1LpWIU7@oIpQt3gbp0xV?R+?({JCxmZi|3yAmsS18S3H^GOEQZ+hG_t+ zBinDb*%W;zPr2Y}++wXTii(VeL|M!adK7s+XgT9hsJAPWrJQkb30b!${*}i~= z3rpKJY1$I}=Lr0m5N{;_b;k9*``-`y{RINB0q*R>CXl=P&4nfi0o1wi(eD<ENyy*Wu(Ep9l|F$mTmuIlUVp8)2_4J8g$6wr* z+X77D4JHrARdqAWa$ogi4KY66dv@_R76THh;=^@G`X;()>76QJRzohR_-_qkDkJDK z-QAbQ_P-wr?+XzC_7;C?mZbTe0f_@YO3jXySQ2pGFJjRwmINK5!zI23^#0At{KEr4 zlp!5WdNnl&;E-t0N}3E*~)&z5qxNO__WrJ~nxtPMJz{TuSEY z>5*0SNgf9F43J8XQc0IJR3qe^;VUuf2p=qY)&jI~7GB=w@(-))>62%xMBO1QO=Pj(=%t6!##Vu!&w&yp<#N|8c*Jd8xOlyM+`MCT zNS9qn=pYUBvba4VT^G9=B0AQHq(4`v+;Kw=lJj0w2PuKO`v1dapHHW44m9o}ZDXe8 zRkPkQ^}8f@EL5BHXl0^ET&zCtJh}leA9~hl2vwyPP{zLMq6fr;Vn7N=I(ZB}I~{VS zWYqqaZQScD@f4?qI>P|gPxJq=(I*oJGVgq)Q< zwQ6-96zDL5M!PXUv_vM6b4fZXNBv^!Vr#P3DI@3v88P!UvF$3lV}VO2E9g%gMdh_G z)*8jmz>rMNE2ODjVin6_NU&N+GW67_f2rRw-fSBHD`!AEvQPk1lKJ%Ny2M)M{6-05 zCgC74tCpH+UmhcNkZy|j%bKkr9*d`e1axT`gOmv{^D&nAa`Ui=SJ%R-c9+ntVDlMA z$>89qQfWK;XMyV!c}co2!)IXio${@IX^R(xF2x1Y&5*!SFXV}nk=YZ z=aKLpCBDsg+$mbP5zK2bq+tt6n$CoI2u?eH7GAp?W7FP@e4*jOWL=!oJ4+{fhBNUr z=15#ow$gP088{A=BLD-*hBQ;*4$Ojy1`FI%^WGa*c8I2E zvZ`9q%Chch2sEbJ2TboW^`$q5k@B)*3o9?isI+0`Fu0g(^IqTn@#{_rp6wWY&kqgw zqXUzlar9zAdwH27GRq>uCNn{SG5ZKi=MiRyrEg`1ez;`xK&(7YL&SM9N<;rcLzwMs zn_PcRzj@K*&~ib^rwqjt6_A!AuXznZ?!IMoJBcHt?NlHGJ=1h&*H*d1;uN|RTgAH% zBTi>0sYj+g&~69BsnR*g9l>tu85UCq(7n|wp2lwW&KwE?i*V%I%}j@kXRqeWOuyx2 zdl9z%V~_vsYnmpc4M2Zys}#6fZnx6)o6SW}(Q&XTrwWU5E#AJ*C}Y?fx%`txFqgN6g)gE&_vLI_(9IXzKKV_kY%=j^z0dT)YGiXTzH`KkX z2e4r47t7fLme^wdZ71t*!=%ka4F$+)MeSyF4c*l;+s``{lmu)N{%?8$N4d*5eIh|KnxWZ1Lec1a zBQ_j`AsPw)bz2!fFk{$w|C9sWa~wo3YntqW&Uf8~7Qvls?1B4Tgrm**LJ z|E`{09t#3j^96&sxL2|D($k;ctXe-5K#Ou)G*}~z>?)-b34NmBF3L4QkYL|~MDjLa zd!-A@G5WD!h@DKIXY1;V982f}W;bkf+Rj zU4Sj$ZPmzAZqT-T>X)na$S<-d@GEzb^^i&Cpha?gN+Fj?;T43PI08|qUufl6k!$C^ z9XHVaj!H{EORd4l{S28~P^$%S(EUaoas0jUe4a+`xHzNM2eUGJJp%@Qcy^1i&kkSJ z-b_z4`WnWho-13D(J}K0<>J&F$-%+1Z0*7%fLa?VSUzR~nr5|&!fIp4cbcWfVO&;Y zI?=4UOX{NlAZiu+Ybxy*6Az>f<|t{O2@7d|gqMan)zq>)sxB~FvUpChN=k>5Fz`l9 z^y_W0u$?Qx3n@8qWCw9P<`3BgsHANp6x-KST=c!C!iiXQVD8)&ak}61@RPlevASzr zwZ7%L!~ls)Swv|v3($qsyu{2}Tn4om&+IuI6ix%DMY*>Fje8ChfQByUzH~A`_CzE~ zdN$;(-px2J0IkAP7;o;BNQKLA0k~3Ytv-P$aa)axO{2Ak=$Tu**Qe_mua-xja_;|c zau+lbt%n>UVFGkT2S|r?0)nLNj|tSEH>!0Q5Q+c(X!R=9^oBA zbtV=*TUNh0-E6pX^xi@<(HagKb&Pp}F52N_L(SM0yNfdw&?a)uW$KjQH}cvmN5UIYxZl{?LggV4v#5J1-Rv!<6uN zIjp}uiua`I_<&gTChUG^19o}(tS+Pp{hm&jwA*WA)1K07k7Qvtm`5@IR3b+$%9)RU z6WYE)HKBaM%xw`{WfZcoTpUNI;0>yK*H?sS1R|s5hRgtQob*QbyDu1o54-nF=@dhs zyquo9+LQfZ_@@?tjbZQM*iv!Z%&dkUticzQ9ijj}TTxMje@j{KoOWW^Hs$xcYOnSP zRJisSupQm`JZtiFOFrYIaPx~O_rNR!t!y1N^cegRRh~Q&%IJvc*0kA^seMXPt!De) zHLq#6mW7#>-KD#fH#;aa<{#KB#_01%M=`07n1-(l_#6*g!43V%f#-}h2cjQHCY#0} z?jWjratt~8#Rh?Z)6(;8utFw+b~)qEz!+qV@CM4vG83OEx>>|$zA2V^Z}Rs9M+%zl zY_aOCg_AZQ5ch&fOpgcu^7ty`q9W9n7S{{bgS^!ZX?al{H}oz5Co>&>uQfsCq36g} zwMV*CC%)6Gq1^Y+IxAW}mc=yd>Q=V`px?-x<#VzcfZ z%qO?->U&wVl_M3tt}zv87Z&LDvA@>$*o|sa-0_^KPY&D)j{ps^#Z1PjEgu$=aAvgi znW(N>Hb{8f&B+Ctr?9=((JlaZT!V@5-Ro`{_Vs5}#p3?PWjp~r@;ora+)gq+0`S^91LM6klRDqr8oazH78uUn))1I}Mi zyTs&j9LQjfi?zzS31Zw>{li@jk3)MBL(fg!CE#plI+MrqUDqq+uYEYdUNr;&qpi6B zd>(zPLybbcQRZo)g6e{@8W5{HrtT*xiBO-tJ&?7xb;y_K#o?Shh_?z3?azJCb}2(c z*0ksB)G0scY~rGur{!5&VZ}#Q`hx;HAHXP(a1}i%UA?|tf3hb7@Xhd)a^TEGW4X5m$5|4b_rCl+Gqt^3;R zj-y;IdjQ7X>d802*fY}7=Cd9`E0*+@R1%w~@7BmArQ;OhOKnCxY9h0`8Zp`E*HZM@ zYT!UTX{le1_oX~o{NZBka2Alk$EnoiEaVa+!VaxSLy1t9aZ?uR-6H}0XcXN>K>Yl= zwscJ)o@Y>Kv`}%hB8fg_Nt&q;z-3Y`zD?$HmEAcrRuWjGtxg!B0`-nCM%9cjsGNgU z7@Rxl!p2u-*dH-egs6oe@xY!ku_CYt5!D6su2XdrQc-ppC_VFEVcwuhJx;EnmZCMS zwx>H6>7OAmL>ihY(`BX&9?xv_-OW5BLLYgGC(OAdChUPnRL;+Z{kDZWW3I~1G72s!z>b+eEn4vR_DrKYc!|T`P`GR^RPWngl|m1E*(y$v{8^v6?#h3EZ*Y zCMpHO{>m^n!MvR;+KycZ4~eM}HW59x7&I9cSE}6*53bWWA2DXmL>yFm;Z_56Bt-Cl zuOx#>p;nFcz{z{~sJA@*BlHXx6|K;G1WI?Dd`u=Hzu4v^#S^V-ypSEAs*Nz}BRp1Kb zd?8^f8^~QF%P?t_aA^m_&oBUM3aI7aSPaz;^IL2E0(&7CjUnC|$!MlO+4={Q>(?~> zk9-95!Syd2)Uce`F{+q;mRP2cCoi{Uy2TgAeQDI+JZ1P@B8LanWKAqQj) zN%Ag4^&+h+#^iHa5@8ZIHLh&5KbP+>!Or*1T>KK6aY;HMoXk-UksIeC`#UifZ>TG# z!9MNkqQlL;*FSIfU+EfJ4M-bc-&^`J`v3AXgS7hdM&kWB>fbqw@iB$UBqp67e%fuH zM?OlTv9!tZaW@huY~js>O0A2Th%1$Egw96lW(h3`~uKoQ1isRX(7p$K!eohhuhF$GjUp@iT3B{&EIji?F_Q zGBLaDtwjmDAps>$=zf&C2;orJF50;vCL`~T&eyMF>&HF@Ot19ery;GtTe5m2yU?2p zx3Ch!POco%=L~LeXv2_xLML79vM$Pj93Bl9jQMh+kwE`)o1wkHW@G$m z@ssUw+Xu6Rbo!L4-ZPkZkj+~Uf5bvQc{iLaUP-2|=xC#pYogGa}xGl>pCzey*g!ntGh9KaEDZ9YXkevJ_$xPPy( z$Z+tlor@p=m)<;x1AJsk7r-l+N*P$ec{;|h2l^+4^U%-=kt=C4R zThTP~mTe~gng7d<_;Tlt^DIzP{Fq*Y{ll(GLN4V{2BjqLA*a=m#eA#dT@5S#TsD@s zqWXFsyVn^X)HtVJ2plHLUL}2K(zjqA%!0{+D3hpk*&4kSv-xdyFBFDe#FO z&ZK}TvVhj?cyD3z8oKmH_5Jbgr#yVA!@R2p3_~)V$?yL;z_?p<>B= z`F(3c9f|f0deXe-I^T-u7SztgdDrCCo?}KpCxh{H<%Z|@^Q6*++g%L(M>~tG`tGNd zK_r|HNV&{!SZ4_s6)#$jy1k`_Im%@!mZO=sePy=P^QVytX(b|jJ5*uwUYKIHi}J!@ z52S^{X~g8BRIEz@>1F=KvaNJaB(I5^r;N*fP9DFIed;}_JH8iWuHDJL^5fDy zY}O#Y1?+JjlyJb3GpN4M(!!9;f-8D#JtU^0>5GBJ#Yeyf+GNTJIIWRe+QHfpV|0ae zcUa!7N-4ZE09+6b*PSB{0Q#$5<>qWbS`vmX^zOxa7n8uZ+DkeycGwO8!`omZx3Cpt z>Q|KI8~xzaaJRjd1tY`w=@SrobBym~bW=AY-%?KlASfr@tNPP)=!NAek* zoHOKee}S&{DBLa?g;-bjH&z#uEKP?`FXwihS4Z@gJn^K{6t1u*#BVxP5Fi!t=a$aX#J zMJ&I=0j=43Hq2XC=a*(Fel9X7WEWMS@4*Ai@U&Bw0Z!8MGEIs!#SiC#$BhEF$zLpP zV~>HY4!PQe$)E11R-XA>5~q|(rafECOm3$gshml$`&yv1C3_q{ovt4sqF<3ln(O7p66bxd);hv}M3%Urkg(Dq}%YE{XQH>q4HZoBJ-Yq&Q9pjKUcy~jyWY^tA6g8_(2NE2qBU9-~z zA-N5COi6QgPahltF2zFA1~!JBbKIaow~pGPbko8iOgRA_*HQBY>uY!b>-r zy@>7X)a!;!u)3R!Oad{qWyxNF!!CCt(}C63%-t5-!mW4cUh#7tdvJ=LW_^Ql5`wI~ zUZr9FJI4o>E{8#daB4UDSbohNze3T4$=1ap6$uR7&AA)r`7ojV`V-3%4=Lrya6QQ5hxLl^^hq zyQ`);nmv;8|Cj^NQ1y2>pQHomGS7ZS9Tlmyia#p4c*sFK{wk&e0E9XXm^-|>M=E0e zHVDK6`8kq-;kL-ZXHxHn_FpQ zGwv!NdMJjAdU>8@c+bv6V+{me{~7vS@KM9Gubnlr62%Vh6FRXMjIEA|MJH~bEx4Lo zD=~H|uy*v^Z0aq4wd6cU<#JCk8*}#&CzVAwD}9mef##=~L1dIcGG??8@{}EAcCL_H zVjwOiW6MY{Qf9RC@<5WR22fP#Q;OdHqx=gYyW)-F$1o-B;P;}>c!2w)z#%qKBO1(SzqmKe1HWfBWvFN%FRKWr*W+dX4pP0C_h z{R|{&jbb=)n2QpoG38z-HQ`$d3Lrkitc<(itN$`FE!qX z?l8elqpnOq?FmAhIaiBmW)VGnH(6Ql_fM71vS91-xgv01jt zTW2mwMb#xGCDnECjrv;N?X{sYRYldN&Qz;p5iaeT7r{X)sgg1j(CK5^F#N0!PUFXe z`(|xKmGPp)Yqvf;z4XR%W9t>k+3|SM`d@?~Op4Tcoxm)w*GX-fB0uetitB!jan<8wWWn1)n6=%5RsB6t_)~_&5;TutS z-WSjy7f>!kFQ6)7SwmiAA~=X}Lam?gfqq0Jx$j3@*AIw|8z+yps;1nUQ^N-dRkvQ~ zl{W9;>sFm4__5bb?QpxfxpcW@vsUi0jTN`^Ot6MmX3AL}h${u#ZzilUSMdgsoJqV| zQ$j)De!mT#w|7FVNyG7h%5(j!+?XoR7v`pCN{f#-K+M0m0hyfmQa)OBzb!hyDN;MB zxK1%q@HP20(JwJmUT5$(I05&GUS1)_$yh6}ioUcwpo|ZB4guN_5e=7c(6Grwga%3l z$!TS%*EFwN?s@D{HXUF^Vy!c4mEPDT*!#rK&8O)Aik>qbHf(5=DO>mXo{qT6FS1H^#*#%I+M#X!P%Y}hb@6+&l zVb@t6cCmWgb7c5z@-a!sMI2#Uqz z`AS}_8Z{5*YFAkMjHuVTyTnci=dG?#gt(s1+K&mGN8`KvgzWPDUUPngubXzhsC~#W zWzE%Zj7n6a=~`Ve!-~3YIleS591QQqwGNe2K`Guw6*iJK&Z~zQrq168i1>fld&{t@ zw)GEGN)VAwNeL+h0VNlubc&=>N=Qg|FOlvpX^`&j2I=nZ?ryk)v-dvRea|`G@AvtC z<9S%H<{Wd5@y0J+s%f*%&!op(5&`jbi5FC|GNT*(t0)-(k%go%!I1})rlfy-m9s9x z9tg5)5eLJW2sMGLwm0V~%R{uXx}Xzhp;%r1@;;h@ag|C%K)U57tHSVAa1pRKup6q6 zUm$$_83xnZsc32g7KMOfHv@Js}{yJzXpulCA>i(SWcU+vg%xK_!&S*jTv9Y>KN1|YeL|HcJ*x1aas!6 zbi3g8FbI=OlwN2deZjg@I!EZNa3W1!vbTLuSQ1?}FhweM!lEuKjL0BEx%XxbLGjWD zdD~XMIEv+S-xb24c0$kAci-fE-%Ac9tvszZ^dr*OJ;$0?R})-6)vf`x`bejS-^Kmp zdr;B#mep6{Uv^Nx!ranuS~KtG7JM>-nv3rSnBwqKKa1P+afs%Lb9klb&Ao}RY(?Ly zVC6gH43ud0J^t(QA(gAn0m+DV{MA8lS}Sw-#_*T5?pI$FHZ6<7fQw0#e5VRQjEie0 z!oJ2#w(C*18IO=-(bSfW&IalhFIn`y_}=#teGYR^c@tNx6!l6AFDuXWpSV7*Cszm2 z4+HQ`g*hBALU&T%AFkLhEiId1B}|vDEG& zw6WG9qB5_73nX#Wq@?j8)!ylj`Xsh;$wHQZ>fF!C4nhu0rfL;xiT*TavyZd}^L98V z4H=oPKG!Q)$!&AX3|K$NE47SzTDa~DlhWAnf^?UEA2jHmGqAK+t>Nu`98W5N`e;Nz zfh`r5boe24#JNzm)qNwmp7^fp$Cgi!KEjJ4@r^zD^W5M&d$`wm4Z58jSo;r;Kt|iT zBWn9N7i3=J)A1bQxK)>hTBTcD6hfkrVV-B7&jHJ2DZ@6Cf<$KCU_OQv3mTt(NC3~( z6Iet!#)C)4&WnUcBB>c($G?LO)#?a+pVQ$$6NA^H#C}hUaaItxge>VkAwfVVSZ;JX zyeO_Pt6=SYA-#(IZeDLlZa#7Uq+@TMg2vJP$l`j!GD;ve&0~QGAIOWtlP$K0Pjg4X z{GQ!r*<{lM!}@w>xl)7oVxeupUtHlLAroCPw)+D&tNv+OvMuZbBEuY2OTG0m^+a5f zkJ$&y-;iqv(-w(PS5g?{PzNC8X5OE5>0Qe&LyKM#k8&^2{n_ymW4y*?0jg;y2Jz= zil$DdIBYkH^}eOrGFRcsw=y~a0=X2I_0C)QX3&+TCB%#z5(iN%PP>r zn(Y46;Kv^CNeBAX@3I=gA@97?OcpHI!+6dGmWa;3vwNVfTF+lGSC}iWz@u8tajEQY zjkCly*H(yR8gU^^rF2HT8RCHQ(C~epv;jsTh2FxBHXifl7qieRZFCQ=EY+&gZM~z? zqU|FXCFj52IGa^?qZzagnP56mgQ`si(I~~b$Ow|sc zn$}$(pgJ(?^bA7m!6jKw^j1ge?I~Bc&D7j}&LNE&KqE64aE#NwHCt_~nRm{myt}!X zwX5ofG>D_2J^u~ir{v)Axd!(4x;kjSBjk7n3}Do99Hv`2|MZPmEA6$aaQF9;CEaIS z-ABjnLp?M5=^lSCiRU@2C>Fe*Y5C%9$Ic_J37u22Ei!nKJwT86BO@Sthk!}~Nw3r6 zmUA$7+8i;og0jPK;W?eR%~G<_$DB=OSKA$Xm+p=+SdT}G(UaG{kK-0bwS8oNvXuyM z?`YLbd1C6+)pz-CpXm1&rVM)`IypP-sPsM5%z}GFXuO{DsdGP5Osrd0RMl$F&>;?0 zEbJL->ML2pq{iU1BLFZ()Q0ZXUV`Cy#lbv|Zx41P3E4OdZhB|=DH1@{w4R@1N=>bO zD+S+Bp3hjSJCfq6`O;5#jg7`{~)J+moA`wv329-(Tuw z6LN-hx)KHubGhG%3A1F3*;-zzZk(PRGS>DvPUNyr_MEUAy!m%*MXFYYZO5|1pw?M6 z8{)^b626SVGQYX?>p8~b{s3BN+;LdBn15_MbWMct>+`f)wxS<1c4_hR}_{o_L;1ssRK+2R8 zZuq{yp~5h1hINIlAR<(ajWruTje(H+0>Bwh(5V9u1YM-EYQgP*PeXhi9fPt5jQ<=DTTT{e3)k1}aABTYMuGk4DFImEpt&)3TX%lVHtZ?}@q z=d)znSrKG!_7hY8a*bTLUeYLWwQ!k)P|y_mph?b*@%e3T)@j~1Mjhiw=!5>@n z&{dekYC3-X$79h5ytiuhc93{qTslm5eCByLy`q#ff3a>q`QYc6I<2{Sn4_z6^NM)& zmAnrX!FJbYE>kOb7bj{-m50&Gsd&_MUq&)h)W4#Uy!3o39VY;(6vRRO>~LwQ2xe2) zX1}A5!evww5N`2NiVOCA2z>)sFY!y2zqA-L zk(Z2X9LU}qvbcI?%gMr{fFQ+@zyxi04M^}dJ?PSCozQ3vTZH2%A&H0x$cw;tKXfr{ z>28RlxvX~21ve+);4RcvL0li5la&bD07C3hMe9!c~K zQQd*SY%g2A=%7J zq*88moGGQz!^nb&f-gcs5uEazx4}-L8aZYw^1)+)ZtQlav6oa z8yud2R^FbDW_>;XQQhrzuNs!eF~AE$8CS+#dXH7hjI1UPSx^m~@JU*l;>}S>Zc4O$ zt}^!aTdjI=2K=K~p4Ty6LFhd(@UAL6!4!;z=9dO%CL0W3>Ui@ilhxK(=$osXbQxJ{ zsW{~Q6PwD)&)w03ZVy)l@9klnpPhN$GbFES?T%xi9^<*W)Gb2dIe4|VuX1KBd5x-= zrSN==DYJ3hDw8|>mpp?XmI$c;4~4^WL+fpmZhoo8F7X0sQ6mM{4dI8kJ9Hr|4{&Pe+S=WB98{?(U$$eoVzvgM?t-(zKTp0! zDd)KmTY5xEOjCk*MDCOTu2B;&=$EGgp0~`!QMfTCLEU)n#0fUVeRi6U&#vA@_%MlR zT}oa8ePBPz{<|9C-Z;DF9>IM{dyu!wus_6m9?l`->v&kHlRY6%`A*=NDbcgr!ScOVy^2#;UH=7lX0bj@zr$rc1bvctoumL>_=-?Zx1Au z42{c*x5w36(V<5fDEr25@h+dgZVRM z2BCbf=Yj8+-wbs2RM-LP}k({MV9cDb}80smt#= z=X^5lDUulW7vQg<3d5~KDISrj4b0MSBx>GF;r+Ei=gCc~98Nx7r%u>CRZw z8*}ry!VsEkbcp>?v4tign$4)K{|V9FTgIP$j@+PVv1#sNDd?h7Lo!EiifX)8ue0(a zfjEc|uzU_>?IF@JFjs`vI(vMs{UTs&o(j2rJ@YIIf?XN|iAhs2d$lSez+qO4LSoy% z0U=Mmf;gl@wokdAQ6!UJJnnMpopyW_!7qQPT3>dw2hw%RVlu5mnZz$ubBkJqf7Y4X4z(fF=`5Y@;aoGy zI*4J;a)$_m-H*O^l+T6b{UC4R1V{`bBkbAV?j3m)C; zwpHv&s(ruH!IWs&IqR^R;Ib|Esr0%ffOK|#4R7*9Kl*aDnmkHQkS07Pe-C@E_0N{jJoy~W3k^tO(Y9~vN8-O~3nae!f_nk? z9(2>7x7KJFOW+}Whv!J0rQJdM`x78a+fXC;a#(91teAosBqoFZzT3M1{x$5LP@t0O zN4S6dg{L0u%*>3%!cs=0m2x@hzZ3Jj{uG%nEK;B=2D-;zcY}TotEN_PELhHI`Kb1N z?s`5f43Yr9bDM}90Rn-E=&xUg1SUI)G`iu${&jcgL9jry|LC}^38eC#4)56i{a*k3 z&&W2A$Ph(`Y;nsm|8X6EXN7+@U&uv(z6g&I{eve@s+VM!^Ujo6QXa^GIIAsCz97(8npR;xj3>^ zq)>1~^~4^gXbK0k#YdW{m!ti9Au4>nB=gYCBms38Uox-SUQ|WYU%y57N#Ik-5Bd|? z9NNe2Laww(Ni8f*f`2VFcy{dQ=(nlM(8+^3)AQL%ntnyH4qvkUn#)j!cg+E{!R2Ou ze;N3{^||+MTMLY8F04*95&t@F{#aCJPh8I<3`)YDsnpyoslJLTX^GufIO^SZwl`NC z#1NZ6VE0L!I(cJ!YII?^rS#zi)G6|!q2Yf#k$)vK&XF|e85ANvcdG?zot=X^#$}@} zjMyEcds2L*PfnsqmfSnQz}goz3i@Zey9v!v=lEa>NZOLM~_)8=0#q*{au0molX69h0PAm zCXWL5*3f6Uq_xq1h@pz#6F}hf1s*)T;mRb8urx#h?cd4yT_qZh&-OJRvl`G`S6F0h zFZcOxPg<(3_Nb;?MzdnmD?C%h8wmrg#r8R*)5T4D*6eA)wtXUYyYmC87C%C^*F8G+ z!Jw)6?&>V^d-n*!)Z9`8#1RvrUH7J&qvN;@p5{q)qLTZa9^1(5B9o?53NTIc z0O>CZ&?E6&v<&VRt3rZs%Z)^wf zTzH;QbB2QCt&e*igTT!^d+$i6MLg8gcW^Q0H>-!2&vD0j}1C+!>>(gmykMP-FD4DokiUpA)T;E)hf_Z|DGkrckZ4O8HkV?IQ3(yL-ZNX@34mSpW&g>l+OLu@#9ZiI9pqr|a)`6rXWc06~Y+ z$Y?m$0+X};CJ!`P;F=Q(oYqy1RrXI$(?Y1F0(UFSEw(4*gFLzEmwT>x5BB#H0d7wi z{XO^4;uApoalBS%gVWLw!)RpQsdJH<94v`)+U(t%E;n_-q?VGXFk4C5;xK!=F_f_m ziqT@7Ug&{R&uzmpkZ=?O1xrO7r6^`c2z7vpB2=Z;A;8mzC zjd86*rk9!;h9RSR#cPlY{Q!U3dG++xJEN=TJTCcNig@Rtd0b?tB15O<&Qxu3ub~xV zrDpbjdFB6rL++j`3ak-YApV7w{xEoWJbl!HZx^=r$=NaEw5y(++nw%kXMaOD>FJ~p zohaKSJN&3pZ4 z?7dj7`CN)}nQ=~VKOq{A=>ayk&ED4!B?fxgPivpv%s0ZMf`RPqmaOZub)?szoR})T zPPU5We0c{B37kR<@m6u$zYlu=tWByr`ql91#l|uHha$UI1!Z)rJ?Hx3xm-4DFKq4Y zv!<1PIl=#Pkt7hvU-4kl~l|avnhAp?s$<0Ui0Vzg;0UXe9+TO zl{zO$L}9r?dsek7D?b#oXX>TC$aoCdY4ozK`v=`XG?FzMz|0=ZWewauSE;S>Xq4Xi zYu$N(qQ;oaX6~(#VE=Bb@rl41Jq$E~wTwgV9ByniW%9?DaWpY;O&fV9C^_3QXdG3d zxUHh9hJ+G`ufD@IC_GWTZoxt_{I=YrPXxWDNs>NhRRBSl4nzkR50s!m^^6_cC7((( zd7Y{&#|44!EcT_@;GOoz7ab4|2(NIuu0-`mAvnMq&QMk)ow?pt<^=N*rdHPLKX=7Y zjq;xVz*NN<{PfCjAhcG0QlU(dJ}$1{hbSq=SbH3|u2C^yC%>KMEYS|sx~aBJg~2>o z`q)9l^f)CDKkPt31x{KrH5GkP=H=mPZ;0pw2nLB#UR3`Kx4#7WySPjXQwA@>-p1s# zDwrmvYoPVOM(G2>Y1J%6BVSY&g@5j$u*vVGml8 zx8V*}PtLoyzEdV8CJez~GBP~ZGcX|Z=p0YI4~fYQS6c9MUh!_9%za@SUUe5_|FJLs zK*j#!aegg=jq72x7-D$YfFXQsY9io=TQJ%ayDG;xL+aDKksGSh8@Ij^QxB=`0E*6K zkw-gq=Bo@1-zc8MS~s~rddas0JO2(qaF2N$T;*rba@p<+vg0>-O-!q@pCSYOEN!X3 zXA0ftb2%Gz;-F-Bgx^FcGISEyPbB<}4Jg*wuk4zm<~%t`%j8=#D*K+oeAKz7E-9>G@-+z^GO|N0$aDYW&VV67%?E z732pF>A`gJbR`=H1JqdoP5sofR+~a^oF0qm4Wx!S-j><3S#I^k>5pdOWMWW(bR|tX zOCj+t9L*sia(hS6@W&9A>ua(t7|b`A$8TfQNg9*+*aJjG z2KC2JjKh2uMa@8L?k_f9}Fjoql9ib-I2YQ)>PO{hKfZs4-OB_ zZL&cZT8_q?RN z;XhS=B;m%Kpxph$Sup>Rq&pDu0%?D8tYB$(*LdtpZKdtuXCQqKoEisBs4Uv_cPWKS z6cwh2?&}Q^3~DcP$`srAQRPvI3u9yrJ&JvCI(^&&&ffb^&6PSp2UDdiZ6YHg@Z@t< zqE>ohsa*)BA`e}G1ZDh)y@<9D%#KM&8`>C1c^LNWeTTk&o)5$0$hd#d1O6k+aej;J z%E5=(ak$Y`=zXu#eK6P0`z>NtM#YeoZUh8&3E16-dYF?Xs8;2zr?!b|DkeT*R}@!kIl+S61qy-1J)NQSAT47p?;8K=nws^p z*`Glj>da|*X`|g~LO&~a%skPh;S6ju&Qz}?0&BOnsp)3`{o|{#O4+~Lgr_cp_ z$sea4pQ*wlmZw_%NvMkMN$OrSGyTVn{C&>t?I3|$diUP<-UGw=erh5j(^0wii8ZJ^ zx%$J>ULld@95h0_L+NUgD?NM1$0=a+avw;C*6VMsUpkDv&>t>LL3P-(kO7^#pw}h8wF-7zTsVj)%901uq}DlWcd2|_CYCy*rFR!`!mPDN zb5+R`EZ*Fw+wtC94CXM$tyto{Ia{>0J8EO5TLp;1(X{pSTIQ2HZ=9bF_L&$kd6DVHt`}Ywg=SBzznCxI$q)B&{f`lLqpt$$B zdSnEF$Sz$b`KQK27Kg<`^Mg$JB6lMBU}kNxY2zk$bMnDpXPM2)uJOB|eB{)SaL$czTVr~q|iHSN+Gxxr!Lps=#3xSvhxBhya5%|60}i8fuNUXvjsihRqDhsv|} zDrFEu}H_m zhKFjA_@7zcFNf7@%supT!Ws9Ww(;w`0{l3!i+Z7pgZ;%q2(wc;yzo}+El|r@2udL0 zuoFpAyeENOf&%cxS$XDUd79&a$79bA#c zn)u$V4&b>V9stb`KWim!fVpAcyPg5%!8@;h+L&9{-D#N$$IH^L@y63$7<|nKNJxQ~ zcNG8#U_s9Ki#PeXymm*PxoS0ZSoL6f#HG>UqfN_so4X8P_gnq;!MMxx=gb_PZ^McI z#>juo4)76@I=B$Z?u+=ct=XSun6h+jLc$c~=m24#vK4q5^|N8I#wUm6mc%F2-*o`qR%`+k1`Y?~|M+qh_I^;9^E~W_e zTK%^xeZ=t?Wq@NLlQ+N5$KNLluMira^I^U+9<5PqvE^dcxf!U5O=A0x@BBxgY*el1 zd}C7{k4pW|;`o=x`sa^9jKC~vi5E@<=65OJJy?uq;B)XUix$5*L_w?*sJ#bE8FY(c zg7E+GxqR?B3>5#tU;9!2QQ?w-Rv+k{-LTZ-{PqiS`|8MdB+oJs6oA+OK@c&=7Eno4Yz%Aa} z$TP&>9_8S@D5slS-hc@jkAou*VVy>I4iY|KuFVYfM}`KzU}k)<`rCSpkL)qBfX_WI z!;bXkh~Wtw9Pv(3`xg%fX*XS{U#_d!4_-E|VaVdj{kBs?Hs{J0Dn8((Bdt?eSN9O% zj5P6EM(-eF3KY$X5T6^`V_j_1%@yqEdo7Ca(|CRl;40Smv|+71hQ@GsKylgI?GL5N2OAf;VfkjP#$d#6zHP-uhj%^a05b;z}KY_ zXzcpVOb;{J!t%0cL34oVd$M8Mi;^wUi;X5tyBuIjHMpkklz6;3vVK@@z6|JcJ6jB5 zr!C0>alB9?J3l-|wb0|cwm2YWe=p_NHh}?EzvXhvL%bt9T}2}9pl*-O zw{lth-&G_#75X}dh|%^ArH~&{Y8j02`f%30gFWnIVaV*;U@cRvdP=^bL+LoJ+LwjR z0-Pbb39@Xs@{bLt%7dOt;7bEmOY-`ljzCx^a@i(6;7xVM^TvN?)e}=MF(llA+!gO2 z|NP-_ejo!Hv@YAiZWVmMwt4+>hkNa0TY0EhkL6HEYQ+7>H)iXnVK=+dNF9{-uB+G` z#S(#x!?0Ca+m8WHhQ1G5)~OS47P8>`-_imyY}g=NGFzupvh&NHgi+^)AmN)l8hNjv z16;K!E(z=0uH={Ni=A^KU(epz))S%z$0P^vh~arp`c}WWnXHNKiQ$pFYspvpc-FIk zlJMKkbj_DjUx1P)tJT;~P6rULz><)V3;~CL!&rv9t5w-z=<4R+Yiz*yP2&%P7M&Ib z6V-oe#xUxgkGWs99Wj{;#SHC1yZvfPol+I_%M&V*B`OyRV}Y-fPT~2E<~-z|Oc{Qk znI+}k!4qn#TmsTJ(G0s6%Ox%sJBwO0A_We}eN9<|f^it)m{zEPkebWy!HD;TICKJ_cw%8K`mhQiX>Dc#8MQOl(C_KmMpIxR`r1{k7dcY}9`je_EmfiGQPdpd(^+2km`1_&@ zPy0@B0IRXGhHWM~3N>&R%FgfZGV;Jxr8F1@J&SeZY5N`qgzgln&OX|9Ljb|koh;3< zI3LiqyINv$+~Zg1h+;`oa^eGUvqCHT;K&w94krd7xV;~M;N1rxvLCX!F%_P?Zy;e& z^t~d-_DgM_4!AezcP~q9e(rkpiUlPJF6;1>$cRs_cAN_U(?Fri)9ti~JT;5}B0A;L zX8^NTCw>jQtwKf(h)gZ^`uOc|BkP_5dT{FM0P$~feLj46NVCsq*(Y|Mu|(+;iO~j( z$=JLQ%o>c{bxp4XBt#*(z@>(oh|mqq&84*)9Ua+vKLl(=coCZ;kqPffgDUe)D<9l$ zue7F2&^HH?2$j=rM!SbN&&bMJ{RpKmPj-_D2A?;OPK#t)tc?YMo^pED9nDYfwVA4( z5(g-Pon&qfmc^sUoL0IB+;PK)fqQ(wUE|Bl6K}fI4UR#T)0#XksjajtlEdda+ZVd5 zR^MwsAbI-{{ZjvkiWp+@6<`_+YDZAM>x+}&OLl2wX+*2l9^xpxg}mp=M?8yS+nkoV zeF+WBd?tz#8ST-M6GwR&2-i9FfUA6!d{30w=LLT2-?|!tH7tz9KkOL^C+Es6mWNQGSuplyCe}xb- z_A?sw7*bv*l{y+mh3v>31wY7~@kyEfc<_l&{lf_0`{+YC>?XjxGg)lX085~iAzOuO zI9o8NkKG37!fRYXdod3YQP12s0`BjFp4MHon)5XHxEcV2?m@^Md!09TEv|6D=%oO3 zsLh@*`Z5Swd;}bCXTaoUd)r9O<*8XT9BjNomJ~$8Qy6i4W!xkshsU{H%;RMHc+~^WfoI%d zZ6~&>SQTCZa2djc%MW~QEU*LS=5^|OUwPo4H}XSnAZ9O&5|HAspDW1uZxqxJ@x&wh z@9DVI07VZioY_^y`eYhfcbw*VtmqS=SEjepExOTw6VZ{&ZW2!Jrd=!xkY|IcR#p(p zTHwhSNf~5(??u4*r|ZVc=GvO3Du92rDsX)`lgS(FscwBn@iSU0SIA5y} zo*6eajeTirz(6|?X>-PqK3I^USZFOgLKjD~qc`)V6vK=j&=%tpt?7Nc@MDIV9g|Dc znFfpK6FG_CM-+b(;#GyY_0;khPDe3@*lQQz03aGeACD0xG|6vKa&U042>i64BxpB^ zj3FmuOL!lRBuQN$>;Bb31t2Ku56%a}J&#HL<`WTtB!+Nbgk1*-Iyj3@G|zg~sIE#K zz-*#;ZWyDzgmlWbuo|E9jY6gM{GE*$BLl>{VeJV$+^xwe%S8UCWU%j~n<_MYDU{fG zedquMGc+qE`X~55VyI^(YLDc>lKU5^KJM+N@bq=dD@wp`U((kj|E7G6h*FH~Z$cWw zn*y|6TGjx92o^8mW$#N%?O(Vik}x>6yDfH7oG$9!yusRKCY zGV04?j=8fkbHaC=gow1>y6qkxtq+=Q6x5X&$_{IAW^vhZE3`LRo8 z%d08PnA00=iO*VPDrnW7LCFs6(v5dPZ+6n?u$cVxjfk5tJUd+sqV`rKQ?b)ECvjVW zVeg=%TL}bfcX|>gU{$$}>4YvI%L;I3$S)Y9o%Az~KalJ8>=D(E|f3y_ImFu5Vh!_}ugQIHa zAr&uJFn=p><*8S^G=NVeN~#DjWcUXGxc%ZBW?Cq=)MdWd`P*E~Wq|WyXlG~7=qgD_ zNVhvx^JNU#_PFGXl{W$qgJrQZG77r0MB@+tM5)H|aAJiVu64ky|WlCzvEz(ko2pUIIV!i$)k{Aoi63qfSH-NLh_%1VHbdjRZ5*lH`4Y_v~}t68*|* z+Ek{+Mhel!D&W|$%RCQ3^tg{gBm(BHQAt_#xLv17MQPYQ0FXeUx)XtJK;Yj+S7xI(&W7Dc> zY7E3Sc*T2)MTNZ#H9(*p)C*lzjh0RBs41G{Ca%9Z)G8mAJHoeTMSHBxU-UH33PdF1 zlX%ibUWpEa??4d)bv5$QEA=Pw-AR>FhdyN@4x$4JvSb~Nmf6z>bBe^#D zcnc#>Y|wuG0+qCMNqxWlaV-pH+{q>*hQZuGwcx{rsi$=8jg}D%>ML$djkau+PM6QG zs~i!vA63r)H#{XLMgxC~l$`EFyAWaKKcQmb>x<)v<13;vfYeOlD|W^8ml`TthLAd) zIRgYK#f74JG3G4BT?YgD#Z~8Y?Kc4v*Tnwo(t5)>IepcddhKd4WjRkBhwhSy0trXs zxzG`sOnpch_9k7B;@nqH#ZlDthrT=X1=Ruyb~0zmr=^TPY`v+%%I&7gO|7u1>m1I5 zeQgQNmV2l!ArzSIx0k)VX47Ygh?q`T=Zvra1q7pYAI#X>#VWEpUnL3pWN-Kqs*%?> zwJ0t%nWQ)fT_yDfV#22yL;*v?PF`3(<-lHAmvS(hy@@~mG7Dt}i7D%g@0KN_4 z6kygsgs0g4>SL{hpWE?TzEbPL&a-$fuF#0j_g}Uq%@K7r`9`Ipgxx zm%I&5r$fKmG+^V82Jv&*{McObvd{w795 zrVRY!jlMG)^VIav`^N=6jeldSJ!j3VuzRpm;@eI{;ObbKP($Y9tV zFJfcJnj~x|5@y`H&dw6Z@=oOx(q@`Kd+>!y&WF-a##Rm`v%S7g2e_hHKsGIWH*CPG zq|9hq?5b&YW>stS%FnSV_@&;vjs7C)iZ$ebnzV<%{k93>KcTpP|Rn*pPGSyu!$H%D_qlA&}?Dh(Y8)#YqX z3Z*T*y#ekhB$Uvxtr8>!lYIU#e|It$dc)!UQt=&iN29K4_6)oBcPZJZ=10EzUd=l! zpCux;L3Skg#^VOuJoRXW5;86w}(6kT^aBh=!J8^mpeu0YJ` zD*g7UZ-j5t|LS2nLuzGoA_1K@Jzw<<~~DQLAI!`R~I*2T0mh9rc=Y0JQGwz)X(Xlx5tpF z9;c=YK=PsOs@LjX)anw5H6I6=#LCV08jF6)U^oYm-Pj_#h9BD(lA^Si-rY+e@V zdD-#K8eg65AD14y;<8?*lh>WTcqCUX@L)VHK)wN^HkDPq1O%lBOlir_&pLuPUmyDV zIueXt`q<~ZFAC4qfMWnW@gIpz?wyu5O*TEi%2Ea}N|$+z^1e|JrANNlw_dQ911ZwU z4pR|+K@)}kSnFELsxHvzT^X4A<7t{6`2w2O*5Xg;zIghbkX>gu*^p+PB$1$`!Yrk@ z@Qfk3I{&yV{p8e>cZTxZjP~9R)E$z;=JzmulWW>Mu<=ZAvkh%*VVNOP4u)uW^;2ko zheIAjAqugf`m>J~pM3Haj7fXW#OwBc_c*Ma-X<@#S#4vJMk4MHA=OP7NbXu?5`S;RsNg&_O`8?j;{jhDXTMMd1Ss|53U85&++l|L|be^1`DPRZG}9b$!A zojo?5D(BC5m-^$V@s4JwU$#Eb&!PdnsXox5j}8bxjf}KfN)?NHyj6LY&24iQ$PDO9 zyq88BkEj1fg#!{#q^EP?_u7+HW!Lt1Xv6P$Aq6YJQaUG7W`Cn12`%r)!{(BNu`AT! zYJ*0H%ym4|@4wiD*8EVo6j(#M{%;v)o5ahO86|TVL=2 zav91>>!4muwbk2^LrwrRJ$U~$jhs#`n+Eu?dFYR3P#nC`3X?V4KLV4ocYXv>Ku2ON zHcw*JT7Pp$-_?+~&My!})Kn%IF$)hZJ|w+C3-VNTy?X^qYgllTTm_Y7wvG@aYczG9 zk-A1ag+>CQlso6`x_I+jK%eaC13&^hxN79FyA%=-5%?&e z^@(~{!mW)<9HYXQ0+!Mr8Bs`0n;n}Xq>!s}H-G2w=;%khuzwP8Gw!c-v|k5`?8?rm z3UgUtpqZ{(WrY!}q#Tb=|L>f--oGBOZoP!-4~pY~nN-POhvTpVkGi^grNcRvBDdw#K+RlNSVUmCs z`O>moSD?=a>mV*gDO-L>qvdYx^}L;FmO}0iKvh$6bY2>i&gyRiB(^CI_3xaPbX1}- zu3&PdC{R|Sj(+h{rs;Uf{h~ljQ5oG zox=da!PFNkV^#S{xW68b;F~5c~B@2 zGW1XSEA+(kN`r3pD??0Peus`2S{Ch&7%!lE76dvM7Q@!CpH6pJiRzz3ie z#zr##N{Kv!#qi+IR+6(WjfpJ$o7$Vo=dm1)6Z6A|WsTg;79mK1>{@oKRtMsmBpgX% zU`$U2ph7ptXMrNQa|2O>@+;j9a0kQb)TOH*EH$0am~1S5deZF{#^NGnhzf122XIB2)~!rj zGErldXSW$i){(A=0$ybDlH7Jj2?d%zG3)va2UqA-1H#s*>Sa@&tCR-O0fH7z zfJiD+hdQ-JnpB~}GpLj&oGN4=d8x7G0&Ru&86uV4Lxb^Zx0SBA=f;ifehN0z@;`kE z^bVG2=Z9;=uMdV?6!TOHINgQIuYl<%a4x0Fx(H+yi=a*3^?_qN-JPYr;j#jPo4Z!K zqfMF7>;M?qL#tM8Q;GWb{s%$9lNL6JjTMrLw7~P%Z6Jl*tBag0)GpcqbEu!nw0MVo zLl7?K2j{@D95blFMz;%KVQ|aog`Q*t(`k#9cvHb^gw`KucOG4ve0>uJ?R5tfEvpeG3ZPl(lFxokywH>3!D`6_V6pxAtUaAzueza&M7LDp^Mp73 zyRh`~j5pde z>WSmd8U>g5ceBqqlJYBUsm8!ybIqUOF)8ux#L3RR0158WGR_G!DTdeD{|>6G)p7Jv z-=Pu>c0E|`6~4VxCjmRJfJ^-rV0UY6^Gy~zR~!e&$5gyQOI+gNr!-(_z!C)js#|(R zli7?X1YnHeXh7X>$C(C@gFbLt=>ow`5-)E@5DVgRS5ydi3_@TaQfVc$=#dn%9@Or2fP{~9x^#k`=G8gjF%ONX}czf1W#6Ek^ET0l_g;@qlRx_?I z3Zx&X)EI7<^|2+RnBSMphk?_-efy=};DGA`ELz1}6@^PbLV(#OtMT5@n4uW3C=9wE zZ!TL2?FU;Nt*HyntwI$pZC&74lZE_$fN2hhlVuheDI0e|QN+|Qk+wIUHx1O${qdPa z^-?zzg@U;?06cy9<%B4$61CgWjK|$*)`>71s=Nz_h$aIX8Ou5v0Aww^E;n7wXlx}_ zCcYdDjQ7O)YCitt+cPk{`p2h*BCTf|<6-ot7>|fqCGI!+Uixhk!LLnK$mYjj+|jDL z&r+_yC^A|>Z|t8CUUQklH8^#w<(?MPT9`2^b zs4xFhzN&BlQU9vZNH)ju+W26mq|I$yMhHP#Kfs+*vvcLMN>Ky5;&}r;lo@Ty%}E`v z>qe3B!`4iyU)6a3^Jt*CI~o>bTe$zEekKL+ZH*OZ*S}UhFxG7KPH3IM8B4=<-#IVjY{k%%Uu;nKq)qT~Yz^`RbdYW{o|Ksg?VnsM|iLwu$sQbdYhbU{#bHBEn3svb6e&4K7 zZHFPp_Ub*Sr z`y8=E?)=J!aVS${t>&A}%fOmO3R^i7S7@DB7=vM6#^i>rmh9o@ZVMCF-Y*Wg4oToZ zi@YImv%r`?w@>YH1mGXXf?L^n<*=M?ChbTKCmnBQEK}l*IQk z3HZjC$k|Xf0_ltv)=epQfX3V=yV()GA6~MM?s+&~xQ=pnL2)4N;XyD=`>1 zvn6$qgc?qZ0SZrF#0!Tr6MFidZH+F)`eccl$s$F6{ZCk>x`QiO=xMJ9sPo^?&jr}E zcUOV-Z+cDu373>?nq)`=6>2a$-KUCPG{HD{l9VRit1h{D%E3&hzT-&R5CtKX$^cn!Gs{!4e>htCXOoprX-&rj) zjj|M`ma{I*ttx=Q&_so~2a5NeWv2ZsbdJn%GADY+UHzwYJddQYV)|aejl>}j$+Tu( zdJs)@ooVvVhSW`FE(YnD>Wiqy!nVc6v;3onEMSm_`}n+BD8j9jnUP;zv-#ZY6Q{Vr zRO!*tZbW}Vww@y!`>^?I@T{|hi1$x);-R@|PnOn^Y?W~)=khbHE!&gl!=DxSmM>~P z1pF#}Jl(&{HSbb6XWb`&rd@0!Q7-aFH0JBVom2UL82iewthRM+r9o*B5Rj6V?k-t$ zcS)zx-2x)gE#2MS-O}CN9n#G=*!!$~_S)xs>pDMQ@RIqCIp&zpb3b>WoNdt&CP#>2 zdXy~zYgG=;wU)&OrK-ivsNTqn9puOEI|K#-zLr>47~-)U85y1~4D}Ab&=CMCcd?^= z&4GPO^6AkSjRTdNo7;eED5FhbwoubBE;NPO`Id-fG2&>zz*l=jr9@7sC371qepC1{ zz&8*W2$Fw%3~70sORsS@%!{oShbEjc1bq>)qnPv}nfaWZjT!Mp`a|q5xprqlML7<1 zr-pDR_(269oHMObVHE}*C6FaJK_pGbkrNnS9E7}vwVUF8Sy#QafDfSk^v!;i9ZuII zzfE4}xexD9JNPISvL92|e+gEEKi$&ZqC!xLNXR$5k$N`{be5uQ?~1dIGUzB$p??179sg zM;7}&jJOP6>T9)$lBc*OaLTDSS!k|)ok{6`oKULTpP1SYQ3f?@MvCbi^UoEun(g7T z+t(+Ia_Ju(8dfPM$)xX-#$aG_uCE$^J20~(6qeFz%jfH3C}Rny$K<@vD~*)hI=<#8 zxqqzKX)Jg=x2|o$rBT4Yd>r}v%7-WXKIy*) z%>X1cIca;6Djc{qaRmHF(Ss5&hiF=tuT`>CN|sK$^5z^WH?ZpNgB@w{zFgn#J8;tL zx#E#KZsS4afB1xlu_0^Uy~&ouIV*KPKzGDpmDaaB@9mAN$>wl?T_q9p38xtHL%n?A ziNyNlq0ecRm7uv&GI!bgfvrPWWE%MX$>vhpU=mof>0+UK;>E&D5Ja!q3^VVb+XQmn z7ODoFKMdG(ScUao;{ftS{3NCG$F^tpI{X&ZqtT3zL5(BYtq`2In)x5 z4-7DGf_tV4)yAp#4PJkmDpn9-+r+xK*ITYWc=HmDr7sZD7jGvpcPzsdxqvW@^H_u+ zx+Y#cG>6T$`rGz#T>W>zMlfMQ`Uwc08ix@QkBM)69DogJ&77s>dUGss@Y%-6@XPQ@ z4?sg;G?w3$C+#xHDY`9f^YQ!Uk{Ndd_16kM{aI@;3hUGVUn}1j2yrie*+bwuT7QAN z!FCl4lX&Kpvv_-z;u$n)lZ4J*AYW^R3KAj`=U!WzCK|T@Px5RpIDK+3s)~AXI}pdz zt<^TQKUqLfIHda9w93rotS`FXC8?#Y=o7K+2$|>Oy-UiW_~ikI-K3!qfg0bh{C#Kf z3{cB`qbdnJ>MU&+pjL|aZ$t_a2a1xzBZnUMxkK(Ct}p1dxD98&;mey`4)d+Cv{34Z z6@j)b$`LEM=#2rO|ZZ!*^{Y;${Jjl=;}le15SoAvx`9?Or~> zay8G$rPm8xX)jPt1Xby}-bpc5ZPm3ej>N?7XG%(n8q;|F$vuw(x#s1zd=-_5*)C#- z_`|UGV=+9XRRPlaFwQprT1q#uvwP^f#UdLrYc8bI({1d(z>W+`t<>2|*hjDa?38z? z!$4mXcelEsLJqRS{y-)7-D;=Pny-EcFbag4!-JFaZK)~=D6rj3IYSixc(5KRWv}lT z$14QW6e^P3==9qgKqmG{*1kDNwu(U9czfA+T$j3E>&8K$+P+Pp(CvZt8B=ui3>%;Q zH%kk~R$fhQ&|41qji6Xs+tLa2abBDpw+O_NCcqJDF&zD&AmgsFy0AYO&AN?iC~>tEDz-%2a}erJ>(0?0!CO4A~3zf^a?fIl-{{XV~Zl}B&F;xYE4h0B%bm&BJ5(E+hP8>Yx=Qo1`iVR#-Vt|v1ldB zFh8{z@4a>2s{*ZDzSM1|jp3SU-xmo(IX<8|R2zIu#Px$zPNM-HS8v+(2zGr61=?Ci zE`8VkY%QNlY?SEd4!KVTb{gi-4jI~MFSa)_X9QG5J9o$4XdfMq7UG_BlADuKR1t7Q zyiPEfi=z~BWPl=im@u<_nRQzZ-%OqMvAS-y->w-cx})<`O7|#qcg$uComM$#XYH_= z-(WYOi`gS;Z(oDNA6l@I3d{Wb~bb-zQ~rdus{K6@5GzGXJaJxkc>v(f|*zJJFOho88K zxYGkTW#z`J@(#r@`IHNgVyJ)8Av3g~JU!;4THiZj$~bnnnLgeH<@5;s*?~Nh2U;6I zicN3BNtAWyKVdxJf-EZ~DI85KY-2W??%Rm&vD@f)%$qNp=DkpT`=$kZ6=m*pZ<0C( ziKV*YikL^aFzhL=t4=|2H7{7ve-jf!amBQUeYTN_RJadAdC&=}|9yDlBLM>q4*A3q za6MRR0hI=hQ#`9V=jLFH%(P#no}>;qzYfCUxe}-PwXSg1gg@#)mdpqYC!GmmP$~Y( ztH7ev!$IAY*3OasGXATddgs>MVRvx;`?u3-0pUmYYe~tZs%Q6w$CQ?*DFx==Ki(>t zO*_zXG?)=Y$E^N#%|3DjuH0smS)_N4yK|GeFCrmFKwW2*r_KEDdIWyZquqG&GaQCk z^Zf~Few6S6=?iG&_R76Jz*aLK@_piodUPOb2AyJ4lcB}$2-#qmI;!kfE>90vhb++- z_YfMv2rDbXfIBQTzwD{=Fz8b82ODH$#~H6at&b#*k2mRT7c&PW3=%WfLLR3y)#IoL zK`+5j9HZ;hhi6&^_fJTPBu+=P4C^VsSXbes0rvKh)V2#m!6Lt#QPwcGeAuUJGEaOv5WBv*;stpQxVek8AE*H!oFm`^ zJ028QVaJBI!R~yTxrAiun-jA}*{#T7Ph}FosAR19_ADBE-cAunx3x!hW*AvDGtR404l)1!B#ViS0P;8QT%VqF6E+%pnD|$UrWS z;Thw)STc#|Is3g4(5(vHua0u%=kn*yb^ld-0!IrfPb>6^Kj$GRUJwAav^(2E%o+N% zoU2T#y_9O2cI}%xEBNUAUpMewS8BEXs|r^{XZN_rRzguQ9*kws@)%z@xCIV)CUX;c z!0_f>Q$kBtF@ntWIN+{TiGi$}aGa2RPR=#U*tQ<7OE%+P;)rREyaLa;- z%Q|5ekg5~>QCRhOym0te;X379zG6{6U7BObC%c<+=NAEduo<2=zRz0U`Lh5n_aaUQ z8-PL)NJ08GH#eU;O4y$Pq9`$&tSq6-l!H`U=f6;ihm;{}$N1%p>2eC-EdI8oU%jYSyI%Gx-EdyYvYI+er$;byc z+_K!Lrf{1s07<1@Nnu?a2w38y0Lw8<^^Hu9q0~@*H(UpKd$})iu{RYy4@MaPOUPFM z5DkFX7NXd#_3Eu2xr?+KemWd2qz%vJI1;R3#Slfmp@~<>=nl@4j4O|#*M(q6nxu>e zF4~h1R*Z)8@-iFNv6S9_U_siVR06)XQ+!hST0N7|FHy%%j8DzY#-^JA(RN3PbeObX z#7>KDIb6=MrIOG6UO!IcstIi=izR>HSj0%aAGCXC+TnXl3*vTSbr}s&A1-FT1gzqnJ)I20ki9C)!SCEZ{4raeqn_VcN zNj5*0er3#Xsmee9G!MuV+8*BJuL^2XGe5c$nXmzqe@6{B0Fma(Z}wH1ZHgzs`dc?a z0;^r(BX=w5laCNC8JZlN4hIyNz&*KokUwEu z0F$7=muUzTVRxhF_y4-CPl)H~!02`jM+Mrz%-rkW>*L$nL1{zn{`K+^A093>+EbER z9etDd#k}|&84dTCQ((0R8DY)|2w@)P#Wr8J11C4qrvYZ{k0}iL*^2COt6LtWL*pNq zvaeQSAg7NqkX=7-wtjYNoE2r z+`RBUJ%vyzp`7;}QH5|>-df_9S73N`bGkh(-VD4MP#+0X&Uev^5YUv4b(V}(tqqEQ z7O0k`a|X%GgQw2~8s6=-`EqlT&QYN6zZUVIE9&(N%85$OfDEtwd13$YvyUV%WBYEe zBV{xPG-vUffnSZh|8HMxCkM6!PRC^K%8mIfy>2_|ngTA6;w5}M!|wlmZL{Hcs#opU zp+^MUjl58!#fv^;KA|%ZD~0za6S>N4vAddpe-YC}R2 zm;wNQi>!AyAhos-E3fIG%qHou^vRdqb}}n%(H3d3E1!H&t(7f=%QeTMQ3K|2N&G_!(fZZ!r8SY)G9SP7pd(NeyqApShmG6ZZ9Tzf8j`N_GO%pEA*0bQ zix{z3gdZT1N@P|mRxZzmC)55sJGD&qDz+q^)4V<~^eq$5fFBL!;Tv&b%hR>MF0DE9 zMaO-Y{xt<|WuYKEj=t()dKLS)ZNpEl4L-5c%%9v;vWjwS(${$J9`B^;1L$KmcX_Aa zgOiL?+?9(v6$I!ZvpY4#(3S_?)5l!qU<&YLdREx~xr6`Q&M5d$Yj6z{X`|MJyfFXT z&8<+4s9*Kh!kCORadNrz_-@8~DZ%vZo4|agSfq3RJIZ$+tU7BuDV~pM%z5LozzjC@>{=$FeY| zX_M&des<=VK}VLzz`mA&8dvx06i18A@kx1G81&l#Id*gX(e-eW9vT$`OQZTx@<^F8 z?#6A=PdoK&duY_q8jm7B)kGqZy{u%`C!Ut`s3KK4_Lcs>p9o+*`O$Qs;n|@6ZGEBq zzj8r~g#~Qu#kL9w>x^~!&narXT7}I3$!*9=4|V1LcBK5{hH&3P&2&y>cn06Rj{D1z z!(WM3YrBmEHlGFo81uF!RqVGr`TfVE^pXtaJwzcPJenx&_y716hy#6A#(Y*O=_3G+ zgz4MKt|6m;o@RgUg;pp%e6L?il=@njb%OtSX`Mz8VA_%P3TsG$j|~vjvN$S8ltUY* ztIfX@b4~~U=ilpzeL*eyZar`~XXszg^*{cex4=pcfoCR252cWobHBU5LRzx@h_LE9F*NS|MOD0#i7=|Avi}#{}}%F z(}qEK1=!kvd?vE?eWg=_-rPsm=db@)U?_%x|y%XF@%1|bkJmDMgBAPao| z)2oo&=>Ny1eN_O5a z#Q(VG|J&Dti{+0>nAuBwpsaIw&&(WkQggcYl-b@XHrOyQE6K!4kUj#N)@aiS&o15n z*M0Io7ZTj&8MGg#nD6&;QwUn5M7qS$NYN2^iX3<>%50$eP$~7``>vYIoFoax!vQP- zm>x)=`n{p_xTmPnc{85V*K-x#dULjI3WQD=NCOzV>i3 z?#cNc21Qs}SN*e{&zKRaz@m1O3#KmNJjQDia>=l;F=J5~pfkz=doq4B{IX0iTl#Pg zcp6y)$d5Z1hl^GIEt1ncT&k8-BD+AcQ`7B*evrjuD*jE1DE`kh!_+Gv&tXt7h?7MUoC z}h_xHH}4V(Xo#~}g2Hjn-3?;g>A9v~;NsBrP#P-LZ|>~h-HkCu5* zd5Mo=oKyp5d3@}u$Q4nf)v_T@vSD^_s6`x7Q2W9eM+@-UsywqMs6k)?eT>m_#?=_; zrA$E9aOF)-$`1IP4YaT0KkhPs^_n=XskZAOOFO}o`-KFAa@>gxW@w)pb|eMbu+pdk=Jy^F3$`k)|Bgm$FB-Nz4eZF^x?bJba5=;UaU7K4clLXXNy z3qaHVY}X1nkD_Yj26AmKxM*mCu2%=)NUN3$jRJ9uhUso}8yWYjMoo5t{X<~S?X-G9 z+Fg$jiAS-cg5a|s2tT+Tj~_(`M02cwa-vrti#gmZ@Q&4YPN z{~5c>ImIeBqfwuzv(0u|Vx5irSmx!ubx{aDAML~Ha~yV*kY)+U(UZ4mTgC#mtVo9_ zhfon(^c^fU=#@`Ge#rf~K$lR@jw8~99B}C(Tgq;`#cbG{C_KS|g-NTasyZVivyw2Q zgpI^Z>1`-LpPY2c?f2G!2f zzN({i4_6$F`o=kQAMTLUEI6o*ZdCQnv}oo7aDM{?zBi)Ky#Q|3!g#N$R4(y4gw=E` z%H?t|OJ*HF8gdp&js#ywc}N94l_ zu-}ilFD4Y2ug8hbw-PMXGfXxEFektkHw_qgJKJ;zI|1Y}F)ILtk6d!r&43^_j09(ozUS9ffSYl1?X&FU z%!1(8BI)Y5{AvMF5-^E_{l%{Z*D4Q$>}83@MF8NLP?^6lH0qVlnWc)81a;O(cQO{j zi(i2KPTGGwRh+e`H`xXD%`V8{4pRJ%(24-130v7)_4zr*+Vh~C6AC2b>H!iTV?W^N z_9?x(ez_@{6=1pVqFAIJ%xK*EL3t97jAEhr>Cx4UJnECJaDqen2maY{UvFgdcR~G4 za?-^*bJgYvuen?{;3f;zd_1myllQ*bm4b)o5CS5#Fagsm-P! zSB!(QHRH*ArHHN*tCl~c68=yY&vl8N=RX3r?;#5PZw9-}G9(pOix9pkeXLbBks$ew zj6S_bSwzuZC6Ua{VZKl*SIj;KaG1g52bL=Hd1;lNU7jMQQ>4E;kq)6c53VR8vvMrI z#d{8VaO2LM_k_uQN$|CtJZ|R03oLiJmbU^q+k#;4;Lm}~ChZ76VBsO1Es_k#zq{NQ z`_qxDdYC>)9Yf9TcY?UACMYf&zffbWbgRh}Uw`T6t}>gl@<-2hIcJ!wav$Dg*E1B$ z#Xgw?`D)lZlQ(j-?Gww!8GrZ&M8D)*`f%68YHr8wAdSaYeCDr2k){%CgX(#CFgpSO zjcPRebbS$Qxn00?hxwsQDW@M_Vh(l)lCrCD;W|2XO4c( zlp6e~I_vd6VhmO$fjPMQr}l}65ae%@pjxqu1I*l4m}I?nbu*{|6!@WM^d;dEg8iYG z{W1G)fV*ht56z})F-ZFQP+4nV33y|4t}Yl4#1?~uFWh}JK9Dwylb<>$?7n& zjzlKA6}jqNuPkz9Pk&V!B|RAC%sfYXZ(g@ECpWiPm%vr1aDJjVuxlE0{k41ta_T0a z-Th~~g*x4H_HwJYE?ydM2;l9R2Gk?F*X0blH4gtxrLM>I(pCRVU~EsZKO#u;k?~ap zO*=UZUY*}}aJQM#;7w+CaRoSSCa`=aF~sRVFD110-c45+qr0KSdQVauH{u#0z&7(r zqWUzQk}IRU#tDd97PDhET4u9Y_*hIa>Sf_j8j+qsuWJ~e=PiR!i1rna7i~*K(2#(O z_RA)m2QmSJxBT~nL;2q)C5*DMkUl!fw}QGBlJNIZ{4497d*~3GvCY`PrL=HR#NO%2 z-Td9_8@cJ?#d=+pKBKbqP8Hx%V*i{D8MCosSZv1u#3mArx2sW@%5(f1ENIzHr7S?G z1fzHv%r-!naygvLRWR@L-j*le3oAw~tS#uCBJxrYs|d|stH#UblJudS4?NEx%vcXv=>6O9RBUE=oi zKo;ZFK+sl82j1O>Yb0>lJyudtjmu>j{TFRb0o4csJgY4q{Ucq~H&X>&C%LC~h921WX?xSn(@6YFlz57#N%1&!y{fqabz6kF(WhoRv3N=O zRp1cXuwXu0j#Pz1!>|@EDoxGJDfxdBkoAjV^;ip}oK%nC#Nf%M6A=c6Rh7d75+QUC7lU4r zHE^ya9&T*LNSI|wi~hKBzze#AK%gzyKoOTC-88=qE*$2`Nzck-zUb)XDLOs*`8Ulz z_iLy%5fxI$f?1YmW$Eu5(Pn5lJfgpCJLHEi){PO>4?*{E zSf765#xt7bdpIBG#lIcqd&*?cb|W$#P6$9@s!+9g@7d150^>?#)qNxlm}SSb;(o?u z?8VBcdCAUy97fP{ypN{9zE|!U3?F~64rc(t;A1fzd6DGy99FHgl9at_JNn&j0zlA} z2Kr)ot+Wj>>pRY(R9LTy z<$un0#T9&^MG!d}#_@R&JwDR(=|VbKq_nhhqcCweT%g2oC%WF1gJ_~_g$Fk$_93cQ zB8zE#lz_t8My7zf(eQ72I%G(%Ul}HHvip>{NU{yR2|EQBu$iVs1>|%i%PN*XFyHH8 z`m6GIN58+7x&LH$K1?qxhA}~kE!-|}0jfm=r(?^=ZVZhC()}El^xIi&aGR2cu zom!-H47$(v4UL9+q{!{zw`fy!8l`+V!^kRG?c#72WaWEFEb(NJS+GMvk-U_rkidyx zYoO|txiQuyVKbdT+^v|r&}c1W=-ALj=+YaZOO_$Yq|yJ=H|{K7VH>~9j4W@+vKk*B zyEAE{H=>S4s#a~(+M&;jIq&c|O{eV4p@h5kiGPYNL=j;>f9?p%MH`G0ZkoHjBxxP4 znir{(ntjC~gBG2o!>&I;#Z4*o=VF=xm<)b&pTyMKrCJ zdO~x%S!kX@Hq<(O`D=yMRON^n%%fu#Z|xsL-nwU7G$ugN1VRK<;qK6fW+y%RZRkd75Ci0r zG5m>@Lu0AMIv?AGVoXL+kC8?)&_9Wa!Xe_IvBn~c%vPCAU%Ff;wO58P=1tbw8hgt? zWZ?-I8E*A_fb$s;M|x*tzf{~_#smEJZ@Q(AgN&yIz;9lj>71}Ym{Q?6cBK5+#o7p}b!fwg zeJ_vHA@zhirH^-N^-ySf=plqU&L2AkIP*=K@IK7+)0vVClp!YiCMidqh5Dd$SRl29 zr_;DZd~kjEj;J0E8z~3f{@|Yr)%Oi6N|^2Owtv0Ku0~xT+OUSlG}fk~`|18{m=TWb zc%`9R1^!KgZM#8S(lPqPdZ+*T90qO_!P3V`O4TdhnspBUD+d`a%D{2PzpU?HK6u5F zp%@}W(6#v37^J8|6Ke&0GcO}}Y!I!ck7RQf=MiyM;1x>~^w+zpIr%CZfp^*%LBvTY zNJI~e`k$?v~6nzqggxybmA1!;SSR$uI)<*aU47o|J z&ai&b)nM~~sdNH!Zq(Q^p>>N^Lo$o0->N}fp!%^aQb3BT-i6s7ywZy%)(_WP5OH>Ea)MYTs^ zF7_Sm8=)tjve;B{?562+!Idod%_0HkDBz27*E=)WXngH>j@Io>v{dT~Gj{TftgV@@5q~(v$?>X^&(Qka|CmPnISv5h9|frNj{>JzvO$vS zO(GQBg1cUtENInAEoC(EB$5K&=*JqIxSL{eu}81YBpf`K54dDt9~<#$g6MZ%^S!yg z19dyR&)&0N$=+oCD8FtwJmkG93%$(*MH5xKMi(Ql&jtOJD9rN z;$jJ`MW!M20!BmGem2Hs^i|Ma9nMM)!EaeE%%Vei4`}+8dIZ$j=Z`=x5eUA0%hx1M z*70Scu*BGufSlf%)#ILBy_tK!@%ywl-un}~;M7vn(Z)KTG2#fohL^798ZUvxkjRc8 zw_IvugfzOSF~i>~fErqGy*SuS7yU|n*mO0w6DF1er%_0ir&w41It9e+$W8@0n8H4TiM!+3a{g;{W~6GFg4|F#hT?Y)hv)XfV-I&% z3K@SO+S6*^5A1a6k;fhYHK8<6?M_o?K0aJ&J0qro9^v2FqO**ZujyGM zePrqx+II7IsE8yATs?9`@8`?WjY(I^fqBu~g>KZR!DVgxAo}?X>D#33ak-RNp1o04 z20?gRmys8+raE zb-DsoF`L_S)41ngn7I<4J|7yRgbqGfn9JvEFU%#E$Q7=&qs4}~m(GAYw7Cb(q@8-l zUIT!XSK35LS%PqonX+cBA0kb&;rl{B>eLIRV`39XM8A$^=&oo14xMB-ThvF?>D~6 z$a&A@Df21GV*`TCmHP?%Cg=U1tXjS{-{FMGlv&xMb;^94OCBF?$3)X8dcznp8jY2- zR$PCnY)X|Lzfywzzuw9{gb1;M%du~m4OJ=Ou&M&-_o3e`TlQ2#0=6V^cQwg)eSI`v!pCAZBMPmsP+J@W<3Fa-b#gwv0AjiIYliLap4;f;!qt(l2;KRGCJNRT- zDoQzVidg@*jCQdIWRYU2h2H~g(wt<|i&5DnlkZ6d7&1D!ee{huXc9)Okub3XyG@z!Qhe-c(TRTn~A*0_MjP>zHk!1S}gB|{0{&TNORoyB{#dp6cGJBySy#NwmKVr%Uzdd zzSq+8$dr83R{ihZaf?viIfQCuB8Bf}(YM0!nZnZ?8LG$Yo5bk0q_@X!4$-r#U5aKX z$L0#uzbjJ;-i-4dDyW6J5ML9`R-5C3tfGKys9v1wjG>_6<5eP^971O&vtgFM>!c(J zStr~wK)uS`i{PmKQa@Qn*%8eTXxUwidoKIXX^hqsW>4MV1l?p~c;gSpgYa?7PE zg=neE3(q5?rxJ}CX)2KydG`sHbLDIN|N3sNju0Y91lc#Qw)&OA=*Op5AFkk=JAv^s zv5GaY@1DMDXD59IKM23WS*2hKtq@dn=%p`NwmgdGC5s7P?6Wxy4Dp&tV-=hL&YEbN z-Xyo=qEUbH;%_goVfle=Pfn!XB+tM-(!2XSnK$@&1Qg#Hxe*?4k8l_GPM#2KSF&3_ z+5-=VtP3Qj#H%=vuUk0&0X6$rSFiy%;9B$`72P~1+G7oAr?&gP8mG>Z(8$oAw5*UR z)XYNQxmvI-%lFWX6Y=98!FbOT?T`qU&JVN!wvrtoudfP=a zOfl%*v#Y7UW1#HF^9H_10?fvjUt;DKKweb1To^ai!~AiJ-y#=wKLh4_S&OFSG@nL~ zz!*0PZib#L$}{9wFDXPvV1@Q3OO7kN4S+j(<>zf_v$0ImLY1)Ajg~!hZKqXV)jUGL z!48#m3Ml(bbfSycl|#-jUSM~9Bo)1f!*TRV;Z%kXf7T3*+dwjbRVhA+PGL)FSDJql zd1|UKfo>bEaJ~Dxjdwm_8+=vCC(*+9sNxZ%4Y@*t?WZ*@R!*9X zY%Ema9m~W7^=?+z++qWSZ7E4BhISjda=bTLrTxRYe~x_hAicoYwNEWKc`t%diOS`n zYC2D0d+2{;Jk|KZ+`lEZy3YHqVg2m<^3 z2F$wM9-VAexye1h!L@dhkwFXlA=k|W(4fG`jT%GCr_A(S>*i0dcM~)pC%c{Y`t721 z1=K%Y&Rc?MO|2-Z%XX3@+%cPzr^`&I7VeLLM;g{LFeNA`fb>juKtOZ+V%OdCg}nM? z)Zq-O(M$LxvS;luDvWZN`{RvCsHsj@s_D29?XX~F85sNZxdC^c z05oX-aogWcXvk^?3%R+Les6tEr~E9@tG&e6BkD|quBe#zl43RqJosoMs8uZXCL7o` z`%{)TqZo7)Doq&nrkc2Dw5qwqEf8WLPm#$`grHJ|RnX`>MlR~|O_o3_gc1lRO8RTR zWPE?E1n`PbqcFvbwVK3L(H#u#h{1=+W$;Ea<%2y=qFlTYIlPMO za-Nwz7%vz2lg7uUv8O2Pw;t=4IL0i~se!oA`Mk3mPQtIQCqBsa3gPX(Cc_rG)mIEr zI`pkILZ!EbIuqLrjX?rjn?1o#qZuN3hJkMs3r$eH)iB=}L$O*uiW$cOJqSSUwUA0@ z2R}~1>(7SNu%Zk+()>)SFO&wX**v9v)(J3ux}p6tHHwSNbhuthkl=LUTKq(Fr0Y4< z)*dP!^0mFu*>)2FS=)al0m~CGE*x);@Yx(bTRrPne#z`Y*|8tWDM$;TH2y}*d(JZd96^c9Sc&ZSyg?l6hxX!;2h0o!AabaG~j z=h9o>j|7M5ZOHQVk~r;-6CD&wbNuvoH8a0pdG!G?SxgoBdkS?+O;GEthFA-_fG7^3gL`-9xE-764`o>0kgf0>*kK&zg zHsglE?ef!Ojwft6NJYqKA>nkP(My~gKuav9ye$SeS zH|_N=nAfQiuJLm2^E1_Yj15cq{lGJ&qdJ-N(<#zBc0%PeeBwf+-UyCYn*-5-ATd=k z`=*)14|yC@ZpeR~+yIr$mt?$1qr<3#OgidE00s?J4C@mhZ0Ob5QSbn)A&OWS!Mzr= zOygj3O7UOWz;!LabD>?k+(0Y~IT9FF*5fG{BQ1L!Zn(Q%jR9hPR?!KdV8}LOopLw~ znEeb?VgtDE&u#nD39;P|D27`@047uxP@k#h1*|RIYGMpo2Z(Wf(6jyA{%%`|V8j7D zq9egjl!DxP1Cv(+7(vn`wXMBv)g`K3#Umo`I#BMKUbL1;W*6uQA;6=C(iXD&ZRaXQKbitaZW+|{ev8K60XN)S6nqKj_t0MZ^3MB+$@g+A-ISV(G zpA}@xF%+)?x=I$lUM2E%cW)Sx4?a?Pwb+c^61h>@Axg#UyKlUNiIzmx1VAD?#@d3w zO?rQbhjNHZ_F-hpS}PDP;nE+STv<%BI(NUMJ)3dti8Aq<@j#T^J8I+N#BXA}$MCY8Rx28u^wb5@Ie5ekuyz^A-g&C)cuy_XD;tCj4d;(B=MhAn7i-bSqZdpQW4ee zNEZ4NSj{mGIbKc{X{b~ietvtVImvr8PXgRrS)HRSmg{Nm*eZn=*iJN7hFRncHEIBH zCvCka1Rbw$3EiBuV23WS={o(;p5<)KgZKSy_j=_4v7T zNk*hAZ~Za6=k2S=svP&qNFWd#wH{>y#IIxo3<`=nP8nwuzkM%{m(%zU5O~w=yVum| z!z}KvS2;Cnt-O$aY*$C5bXBlhG&+F^okKi2v^$MT^k)B*7;e=i){ZeU-VELCEdF_l z6-AJ-GN1@+ed*EI|7y#>?6xx^a1%5TL&t}SHe8zNp&I!0I2?S5QBZGe>Ix2h-!TSN zxasBt+ApT%Tg^7t&~Zn6%V9q4`L9|8CWe8_(kaMowb{~hVOmM3*>l3cv7__#Ioc`j z?{1hw#N#(8jh@_hg-tA2mE%B~_sh=dxWhG;yo^zRz{mJrdUXM}V#C(|Y7ZiPa1F;C zbKiLd|8os}(#>79c{=j1KQ{ZK9eceUr5a(^>(d^x(a9WETbEppNg~`GD)&O?tNBSlrkj*PaW3Sf{MFVUjjqnU4^2+qrsq8 z-bQ${4H9;d^p#m{%QjljwoeYa^;ikaoN<|V=XmtLk<$sMP)%sQFwv=&@;8U+mEt3y zE1W<89Tl=h&T;8)PLq=y^(tNAuCF66IJdm@ik$> z6%%u4`VJ;5$dh>8IprCz?QTG4WpJJD`^vO0s-#mynJE5BYUY6a^Y^8u_C7C~FOf{V z*nl7*u2C~HZ07CU+46WRVXLsY=JV1Mg*_~Z$+$Rx*p0#~hYMZ8QYn`oKu(j>(uSI3 z1CCO$^q)LLk>7I1?oGO@2=CI|Gqg&+g$YgwEK*7(yg8^C)g$D~W9d7z{NQ}N+>&ys zrB8OS^Z;o_d$5z>?J!#-LvZ`MhhRXbsl}t?53DR$nD>0Qr8Ri;BmP17?3SHPD9dXZ z{a+$2n=jt57f73d_6{+7Kaikz-u(c{SQDK_<`Yvshq+0L>%$N^*YmW zZz6mMUN~AwXV36-gRZEJwuM1wJTGIvDI-yqSoaPIf1@dt@n&9G(W9YgHbiHu1X!Nj z&Mh@Ls(^P}KxoP9!iUlCh`1(T?teiEEc`U6>=!T8M1OdN!LRr9-)S2&JAhwH`+p-I z=w)FjZ#WR_<+S4WtU1KKvRiZspQk_&&}Oh|ec_Hj;Qe_rUkVZykuQ^mvu-=% zF8QRU#p<+F}4_C0|V2+7ZHMK5;-d62odXA&VT5CzRImZ8r+=T>WSG-DKT%IgN;8nVAu9c zLH5#A@SH>0Gb5L+%)1&X0?WGW+*lSzIH%U&pnKd7%CSI$d}Vy&#roroJ0g#g2a6;X zX#ZY=`q;1u)k@n2$9`nq9f6Z^V`+ZI;dL(SLcqG~?ImJoU3!v)?gjIoyp$c|0WmaD z*tWaA6&b&g1j}ZeH-wL_>$;a%zs?V9miw+KwfL`*`ra{{(62s>NjLKNaK2J7*;6Yx zB|&~9oVwB^UnbAzrhpm^MZ)D&1mE>G7W|R@<;Nrb+1>sI;^HQ=gcaoqWtw@R_VdE-FA>a98Gu6|97zve_4E)8$6M^9tYSC1 zI1_~^;b-5L0mmh0k)yja8Ol`pm(-k{%eL_6H!DXA_q!^PhZSoL1+V@7jY&_)iYEHr zNV@60(fcBh2Qg&Avi~DAR2*}8$_MFM76h4B#9G^{HfEN@^o2PH{-$?a;=UpBQzFGq zZ9Oo!(1js)4#W6lG?UPyb+@R_ks1{0gh={QDl{zM= zReS|a10P>VhpoVydpah>GQfF_QToO5yl(6HhBmP0($KDPTfh32`>FjE<68%}wso%G zX1glRP|j62iW6bQDZUoe*XG$1k}>Kj3TcI$S@RT#Gs)O+*Jn3dj@)g*E$ey zQg`Bb?mnB%S1091^c(_XLuNd3!4og_GI>J|1*D3%hZx+k)+)fH-Q5Ea)5M1CUb&xq z^>})4tc!;xXcPCi*))y`wRrv70MqA-tYjLG?iN`hTl&Ii2A|5TW_1gwMW{LG`M+c0 z$Bxzj7%q!6CbUF{Uee8kRt(GUrGSn^fS`yV`~DiBH# zvWQ`%tO(NZ0Wnczi3aM!{k3ws}w~|qc5bOSA56h!nCaMwaF}&C4PsA zzz)aWqIqiQ%!kL}_VF?j?kb1(mvMBG;EgXR=t+thl*?9^KDr7f;1EWU)4lPOo9Y;N zWw-_~3j>tfU`D}FmuedjN(qnhF_(=;w(_q0Q!QJr}8e4*Wfbf5`f>b}Dp;z2!7%=JJsNT^e)2fm>p zBZK=^bRc0gVCN`boFAA|)MAcdxOS5UK+(BXJZm0$YlsKK6dB&M660Y94(=KIHwcDs zM}cfh6y(baicbrLY6>{p8w64Jj$Q6q$yF3rz9+^MM*FZ5_s-M5FK)Io5o@_pbhrub z>$1Hni5$1}zPsxCIQV&~O1^7faRaVf=F5@vqOaR37A+?IoF#3a#ya&& zjf!L>%~Fb%ifhEhv|li)AgJ$e4ZC*#3MVn(>O6y^MzvgQBqh`Ey(qK&sC{=TLDwK@ z(82Iv4mowJ?kR*5=x7GF6*FX|u!|>X`EG(ys|wpHxOsf_|tg1(X

%qIz1; zQAT2G>rU4E)%&u1ZZ=r$I$s1OSnH4nc77reLa+se&T`#Ibu*fI`sa5hb z*Sk_vL(qMq(m>G|X)Q{^yJw$>9fg4DL&ce*nqR!meV7`gCmi_8jUAbRVm0C(Ojptb zz0x{5U%SUug9NHQ`hBFnm%xmhY==UZN_bkz4QkiwfZOSWP%-wC6?_M>eQ_kYQ~-wG zi?jM7^{O#a#J)rZ{d(T5T5El+wVn{1jCHfgLR5q!alxTPKx#OIn117o0_)HmP|wRw z7p2>$WQ{-cW1R|>fFmtGX$4#G|IzlAQB_9myRS-zbSbewy1Qf1-HkK|h;(;@lmZgc zp(03kcgrHBd(lg}W0Cve-T$}FK4Xvb<$Po~SkA>W=X~b8@9X+q8in7_bum9g#KbGY zNw*kHD%vhT{30=$*{KY3e`@r>F80_v8hcAD*Rq`Nhnp#>;(qF{wsRxRYW0m|3eSE@ zJW%KZ9N*dlXg{+?sg-{Lqs`04ND^c-&k4*cE3rhKM5|Xouw|}C`iPQofI6!%Y@f{e zK4^F4GnUv2N!mTG{x{ZNH__?S)uYz0?Q(gyW7&Bu&wu=NQtsmAS^U&+ljd`98R05W z>y)b|88OjGdjoXWn<*?hduUZL^Y#QdhgP<7WF?n2Bn^ts1XPa3JltK!?}NTk zE$jn$Ia5;<5d>#;hAx*8zdwib(Si2Bq-Kg;`u+*fDekzAJiJEhHA{-CsaMfS0B;qy zdKv~T{F*lf;^?@h_HWgl&d4GRKmq#a(SK)MjzZJbzyB53UxgRlh}%bS_0g^@Vz)+8 zLIJG?HSNV!dVJ_GEGEf|yl@OmHe^V8Jk^ozz?I;IMn6m7ftCMqjeMM-28^s*_o>h1Ux3z&WtL2HD!aK~|E>vR;;$fwu~c^RN= zeyN1CR|dapao&B0z_dM)2kOd@zt z(_Qe+TXWHw>_5bQ7O$QUvuTAI7~rIlXbdfo0%#T+wPJVRi>B829{U|ERK5Z;v5^?2 z`Ejc7beZ@L>9TtKSw|2*VmGMPA4`lV%Gb8|Sc^AYzq?SDdBb>5`4>dt*=tsqWgAHY zu+9_s21YhH`rc(z+4SEwV;i0-u6p$mr0E44ThLpW@RzRs(yvNX@=TtWPU8q;$NlZi zNs3dmdXR5ZvBGv4$c@%A_Z~xWGYF{w$5Zg^0c6xA9re9uRtsZo@Tfn`SWnC97(U*tLi(yheOOb+ z_0mW`@D3SU3y)5j;r?x!dB{FWO__JGoN(0w#)B^9`=Clja#FZi{Q=OCt7VTvM8gBJ zw{|up(gQmo>}lJTqle*wly;dX`oB_t%YJ^X)$xFE9z&f%=6O0T8nAs1paDk0E(mLK zsnQ%oEH>p+{a&yAH8c+*euQbe~*^XhIh^C>lqoOMqbD@!bLbIeHO4in^YHn)j4wD+hqLd7M;FqL!Hbm?1M-G zw0pK`I$o40zu6nizOysn8mT*IxivG`5(oI;De1|EVPQ#jF+wN{A72PMr4R?a(UliB z!y0GO_juXmhEO7&g|3|P7D~0Yhj{-C@km{N?F0SaJyIT2zgfvvU)|5-{JQiYF$?MZ z2gLTH<4<9E{%6ZlHs_U=U$Ncv3!qFQa?S2Q^m;#&94Dvv*Uj_v^|fOmh<&DNyV{f8 zVW^Xr^v&?5xgGk7X&K%2u(#<|TN^Wa#Fs!lpf?i3=9$egZ%ugaf-{8?$P>!?ego(| zdiZ!r=w}O=7nD|7j1UAZ1gAqMA6lEv-tjE(-`O#S_!!a-b^H8+&Kz{C`yrRqp0Hv( ziZw*muif$iF7P!Xiwl`WJ4d{pL(dFG!0ogG^Qa0ULB|uYjxcjZ z17%s0SH*{Hl^WDQcs@Kcd^kQ>?prX`+kQQPa6aHN%MeouDTZD?W5@{`On3ufdo;`XX` zlS^|&3~SRV(Q!*vj*KNFb_IcCJjEn&&}bDl`c>Wud0D4a_JZhe_wxaggV6OI+|3n) zkU|n1oM+ED$)(v6E~Se)(e>#C&7vEw!^`dEUQF3n6oikV^SUC_6(2dgY*K*YEy4?3 zr0lwt?W2HhiLyi>B&cMWVL2mgm&84C9wBWctSA-yh^gfW@Y5A$pCceCO3W2$*~}B~ z%4d=n?%cP0ZtKFYsP^YVUG5zaa#P`0@$ z)FVsm@r7WjnHVU`NNY-PoR8qQPo_@_m>#pbyS5k)^M;)u5Jsu4&V&>Zb7f^H*Q&RO zwxXqNh>aEvIQ$CAs8^H@5b0#8SPkoA@}>25)||=3VkrmWTCf63cn<4}{jZgLfxU&g zZSo!e@L186V&NEp*8pG7{k<42bD$MxqqRa39e3>1Eyo|?D1iVy>t{Sj zV_pnelt=9wLWBLv#J>ZrP98pF&xM?h7fK#4;gzs#iao$5k=?Dag`JfHCDZi7waav; zX{`YCM(r3`8hQkj#w*ljqr^&a66nNz+x?z(*_}EL_`NBUdVoUZ1Kh2nSvbeoyK=N| z=d7!o&00V2z8D;!>tFNYKSlc?ks+PYN%Ze{&EttdqBw3}>F#K}69N9OZ;U6I4b#iv z;cZAl&||E(#K$rhRFlovj`v{s?~oI#kF3Zw09li@rje9DZwslpZva=!dTo^)gwo9u z;+_+mE>_WgQ+yB^TWDGAD`gP=D&UX?5b+A3D^i!>p`!n6>=yj4qkSvh=n;X?J?w4% z5mUkh32SbRgcQV=W+m#eORz&$U4HD4II6!K9vVk3%rw+9Y}OJlwAZCdhHba#!@?|A zx|96krAMR3o^^gajBJftp$vX343vF@^y@0P*A7r{5yDMT?|c%KEXJ|xzYe9av!k$c z9HW3aufxWYZY=8GxBJ6I2-gJI^d0&pLpa9)z(fik-{~M;xwMYQdA&}IdDf3?$yvj| zpbbs|9^Z4DiP`uDE=fsAcRb$JZwU6DSp`>D|0tE5<)G>YnalV+NcJj9*qPcD^kF)A zg-U!&=e9;Ql{-5xMzed1xg?bGi(yuQly?uKk6+hj0nM7=M-U&%z!Zyz+P$C9i3z@8 z-_HNudST?Hu&_zH;@y2GQcZYRRhfR(o0k+k>O@EYXp+4f$TFx~Zvrw+;;z< z<49zPQE9TMAK&*!KK#WpMFQ)jT0Ek_eGxR>%60Od!Il;dxt~Lkxu{#r-ODa);a5JY zxr~Pp?w)(NSXVFU&-}~Y0sma?_?^A>NiUgX!xB%2oeE3`lQiO~qYXRViZ78eevGy! zJL`4e)j-DK{Sq8jgmztKa@Uf4d9JE>+MR-V-LOJ zUQ(;{RWH$H&21<3XPni_Fw2ge1g;B0MFK&$IzhKAw}nl`FP;9wG>e6& zA&S=L3^p+3q&>90Y9tlV;GXs`su0A782g&T^yGdjWXm4OO=BqscQNuLBRIQ8rx0BC zaCxOERAxk+YR4-P_v{`XP>=mXqD-y%qWTyt&vOJBw_ks?i5|9u0XHBo>+k=d>A)5DW0YrF;D zO&t&9nZPV*0Fyq9zQuVFI0m=OA6R!68dP|MV) zy)gG%POwT3m|!o_K&{8rk-X+G12S7ml5|ex$jsao0e(1$Bwb`Ef<7WtAK5Rg1Ag7q(eaCK@n#-)s ze2{`~G2;N|zm>C;$Y{ga+;Z5>X>?2zqNIG!KBry+q6J1|yTAA2>0H){AfjUg4*lzN zRPAGp(#?418s6Q8hJ(k$yD^8v%m&A%&tb2=Gj$VHId>}okdWjWl&bIfECzM}nZBBB7uBqe8>OuqP}%2Ndf*b+bW@2Mw|VN+##e-KVX)CHD%x-UNH*Nf@Lm+d z7yG?_U~;A#S8>A8QJ73UEfW-?V-4gI{Mmm05j}HP7vE(p>cJ2VIYngTt*lVt4nk90 z`^wobJ@;k&u3dI@8?9l9*O*+Q@XaLa+LaF1zCeracWb0*1rr?ClR=%&0R303?)rD| zxt;{xzU#g1kDJZ=xeyCPSkOg`UqtPsglOUP@m2cKxq$r9IUF{|shyMND<zoJ*6ph+IrEWi9jfF7~=t8R*AD{kNZtWu}BN zbQ74#h4017Rxv3KE%{l<#Ku@&JZfepvmypkjCC#SW>OZGi4651AZ32}! zI#QZx7nc()1QB11#_{eV)jwoFskH^1!cJEY`Nk~9urxh}d8I2S5ILYE^bX+suOtq6 z*WKOTHM!OAI7Jitse!D1hwI=uq1l83N#%rbiMNBU$DGe5u{2RZ!Auc!a9o7IfY@sHqAT#To7dN%2p38A#hQmSO~{s5|1wp*y( zqa@Z-$BTN=F;CN}eFmTm?e<(AKnrtmXWVmc9PQrHcZ8h`d%23_d)(Z)y=_l7sk)fy zK)N-4)4Z7AGwONEPQh3@*)IMprbWHM z-U$|Yj5mLMKm2r2E6DPy{1>DbksWmbIR`<%4l$(1^}>V^f$YKUCTFe48+cU~a^W_- zJHbmwJh&>%<--`*1M+xcRq^b8~q zKn7AC*tA2wg7dQ{5)d;o&m(Y+OEZ?32di#=K>>-c6nWi!{*>+S16JP&K8RcWr z@9U6ubMWf(zHlxXo9)Ps*QLk7X2*&Fzb&jYZ%9D=j$|QC*_0i&T2Qu^){||_cU250 z(=IJVe>EPsv|r8j12c;4sZu49bx6#B<5Cg8_aR?x9-(Ngz3q0BvvQqTAu*qAKnmL6 zF+`NgaVMWk6-F`jnszrz!bNSJCxD~kM~mM|dAo*(8e&OD<;?u~D-MNH-L1d!?z|%M^NX8 z9R~moAC`;j#&q_`94F9TnQfzo=~<_*!oLZ8O?>gu;>7@<0{R{UBz5TlLFGLcPHr|s z+apu$#)hf!2AI2P=qWGY7-Q8@5eyJm~r~?`ZL&i!jXjHa2 zR!4L{ScoV$?O;38E!9?7*d4&G^{F**qeVOX3T)QH~92 z?0DPop$LVv+2f!9e8>^JC{-D0c3i%3OKxOu_G1(X(<}r?8MwL)3?W=dSHEm6Ng-5j zI8%DLJOxFKfPGsLB~!p_n!=*GOqv+vgh}8PRG((P4B$o631jAgreygd`HL<%_a7jn zvRQ{1Bp)#K$q~~rpyeG}k!Sp?k|VFbdGY3lW_j;AgG0DbYZ6I$?ZuzcVHCzG^2oHq zBvmJG{r=H^@livp=@?Jw!?IrS1U$~K5V_xj+>h9fSu zJptclQkbnL9Oo;aLwFH*u702fDJ)eTf~;BIvH_ozT~66j5+E4ZogX*8e&2PbJ@|6X zutW(qTCYf-LYGk1F?J^&w{s4UwDkFakh6=YH5U2TUaGxXqvrO6C9+5<3OqWmvf@n- zbSK&aD|$tvZ92H1)74hY0|lYu1HW#+efzs-9wXn@V8QX~sDC+POc<3eto4oZMf&<@ zx!X(JvGlL38IwRE+1)ca{;H@z<@MxL5w6&mEHN$Zken4a;L;tk!$iv}eLtczqfXNB ze#J-zrPkxL{5{1l)$3jcf48+;%%glONH}BLu=~m-g3s8oZao;Ntfm8bE#rR(R{{-> zS{5~uA~+NvMqf7A0w~w6KNcI86e#&!YMcCP*_?;#ZKHS!0a!>YeitSHg{{;tg{QVdo16*-_gE8|hXIQ!^ zKU}7T?CX;I)T>~o%jP1Vx=a*wrs!sj@smeBWyV^ zw=L;jKXB}!4`_0ud^rrm_EiUN!Ih*xp3?YUi@eXft0}QTu{g1^(u%03bExs|EQiVR%iaVMei;QUBI9uLt@XCSW0*SQNFarX88YhHT> z@Y^IbZhMFr&&2wVvf3@Fdh3z5l7jUafwvcW0iQKgyAjcL!qZNi=)Jvn&)C2o z(_)zXgDo-m*iX9khEc@qH8KK_DqH$R%o@_Bp?e7{4rpV`dF~xJrvRvhw(4X%1RVGE z;gRl>g=3V%s#gt0EtXWnP`=%A5vR4|gNYhF_T95V`b2Z!n6=rKz_wh|4DAhn-r9j^ zco(pZqKW;_4u^Jbnzxv=4e4phOTf(WEl+v*TLqAtR!Hw|vfxySI|NINQvKqvNOT-@PCN^fg}-JAtz8l@?fJb8l%LcAgxR+7i;l=(Vusq%ed ziF~_*F`ci+a=m0cqGr3HuxUSAfTyWA*}}9k>p*$*Y9(&XiL{cL82uIrqnqr{M)p#w zA37b~H~Db0@A5$M*M1C^;+*)2ai|Ub0^ePySxSj;^Z}q+3Y^Xri`7eLwBscEH{4K~ z^!aslB|hfi25m)2ngpLAW9B4Nr&|G;fMgSn|1i@QYBJjyF-yKRU(MEf|C#^G_5RO4 zuu8I}_MTPY^Q%gWh)wu^QM5>jd`oCi1`Cf)`dfxhXcW`6-=))i(v&eBE$_b%dG zsdl9cD9GR3wjo=ZrG+<*G_`lXS;?y7Nx>5Jg3{mazl)kz?hREGs8>0kxq03LX&^x? zXBNlEq4htJH}jHfnXa<(|0O{}l?|ezGJN<}#)4NrQ#Ph$Bv+ecP}5GwJH%}wGHc@v z{-c(5pZ&qqBf=6&B^9|tojyi{XmQ&4>&p-KObxVL`2_L98^dy@f#!>b&o>jM3`xRF zWkP&8k*3jsL;*C2B7dB|2gyKh1Fs?Ey?tjV>EX3F7i@R~-iHx=;rCat^!O|n1n*gw zo4d0aWRVLe4LI9#EYDeF{CvH(>A?zQAG3}nOI_c0)O3;2oyTK)i%%- zG2$4Wj#yxWkS#4e}G60%N5O%H*&n1uJVbSR8n+yqb_Z=i<-R|@Smi1u;% z#o=Y>p|%l#caM90ee-k$X-RM5LJM1Xh$+0nJZmi-!}JhQJ34x(f38!%0QAB2g4A>? zC|rVyyjxh4gLhw>pQdtY*afi7ZCwx%4V?O`Z}%R@g-4_3(ENhob)Iz@liwfc>G%L= z#^0oJEan(G5&wm%h(~`u9M|P~4(_#ow9y1p5A)^YdmbnCLMFq`hLSAmkd^U&sw91! zh?;lU&Z`8c$fk2Z5hpEdrPGgjpPzAghSusgg>Lka;fV>gp_x#bcMxrNYR0B7S1#_e zf`&Pafij!EhMCawdJ2r~;?d}7JO*rL?bZ~#5s-057shtzIvVXu>t|s#{1Pp_O~!aj zfZS&9dor%4k2&&-`Wo{OnB0H6Mugs5Y}<|JwP&S3^A)s;oF&PuJ2p(7DVgp@i8QvS zvYX-^ya``@|C(FV9J%XGT}Fr&2%JkQNC3chPA;EnPg_N%wYF*&L;oPH*=(_!yVCtg zEBcUOT3HZZRF609pT$wh<#I~ufN&+YK#82URCbA$FP3%?!xzt&rN!_#)md3_5x!G_ zPp|rWQ=c&s>~(+>ot5w9`*cj>bWsyHVE1oBJ{AqPb5=7_!Ze~m)zkML3OZQeg=clv zpdf6uU!svnOXebdRPWZ$eg5!uue?2^Uc+n47h^y)>U54m6uZ3by3wR@p-Ue$($#jQ4 z@i}$sa)keArT_QHpZww`Xq`rHl>Y!^Q>Q0_T{=ZzaB?nX1(Nd%x>bbdX+z=g0@`l& z;RRm1cX4q?Uha0?vypEE(eR^q5%neT?AVa>!vEzI_^(0!8SFZY zTKN0lx}DA+YLq6esC#hWOq}U^v8w_kCu9HZ-59_oWmCR;w;l{x8;++4Da`SWdClvn z3{V5Vs2+jZxHq|dNzf1{Z2ICK5ru7oNZ5sD)Bi8uV5!9`9=La@GHT{i^2-0#P7|+0 zTLMDd9v*I;6w|qA`v8IST%VhdGNmk9FB&1<58l2;s486IAs8cJ*P}g{Qu3o z`p-f3k^o%dUJ_q1j{kl_|L4O8zB#}l`2TOvl!40RY5&KV#SufGf%hpu%%ChlK`Cgy z*p-n!rofN-iTISm4A@@^1YFkDhjhyr0HD5x$s~}JG7k83o8MqWV+0g^bP_A+4Zn3!c31ml#PfS&-mQ>F`K;}DXd15(*YZG*T!>6DJk29+M;m(0vg4%D8QyH{))>w->AuT zFkY0K;uZ*~#tob3_@kvJ`sD4bls$8z!*M`-l5=JVxV!)y5@Ccie`K?<2~eM`hSpRU zyR-2`NP|&pJ+@DQpkpi57dDDOZ>RvKhd{=dtK@&VD~o(!$`f-h0#FffDlt z@YB5wGY%vMj_|(c`wD<_&=YN-^nMHsQUPN003`y(tB19?PJpr@r3R4qTi#c!g=}B> zK8r+ietg24ilDA1kkZG$dI2~&zM?$Y`*#4DellQ$N-IJIO|!oUxeNk+p=2T}8m*V> z#S?W^EZ6^yT?(JE5MVzn(tZsaOqzvdoVIOpGpPa_Z>Obra6p0xGI6@vm;V`lXOHYN zrCXKx%D^`GH-hh_VO1W1z_r&&r1V8CX#S{n6jAyUhKsHmJtvHj@gyL zO-^H?@PR-6F$utoAGGxT15f_v)(>#jf!a#`PbFhQ8Vn+q<0c5u;{SevPd5SF8l(k> z-owh5r+|A|c8B4WW8lltzc0LDRkXp=vT_mGPC>NecMlY^TJ69U@=slfo+#~_03A*V z>Lw6pEOv8k30ToSlok`~^>c>+o%D$@u+v4>Zz=mcxG2GhhVtq+YUk}?TVvQA{A@44 z)brZpGy<;>;0CX{Py;CT?uu(b5{k;_PQ{+$9eoPaK`Ax@s1NdE4ZMK!NJ=y*?}uSJ z^j6Caf`4vR_GtcB%U(ivz+GNm%TUpdR;3oyKWW58zJ+yPMM zYPvs7Sq-&Q5z?Rv`J76t6Vd>3=6q@ktF9_bxt+_h#dCm;qh)fE$_Vg6z7w6?be@LRv3U`sLrP?KaXE5(2mvxoidGQ(s8=b>c58Z15Grz~P<;H}Do zv=5;0(9-b5$XsB60f`=nq|1V?+my#6UqxF~Eti}8;am>O)iP>dLu~6sd`_QYtDaKF z5w(Z_#~jh@8)@sdQyAewGp{|JJK$pa`!m%f&OLj?@;Vc`HQ~=Z}fhepo(W7}3F~YSv1PrxoR} z!lUKa=Q+1BAZPt!6^7)|zwzka>FOWPk8wly!uNn|7MTUW01I$~($I;RyA`j zF92c4&$XLHQ zT&Poe07j~Pp6S!)!MZa6TBm4nUJLc6ARF(yXSo?`{O%OdX!#BAHVMk;<-y`)c%F^Y z=d-$yE8?Ol=6CX`%V%R@E*d;sx^;bKRP)vR{vi2_@uK?z%3A}(5;cyogD1s~2#WLA zQ^WRBv=L_J%OnwsXsy}gbifZ(2b2H|d;zq<&t)Su~1mGm>m0hTlco;h)83_m|hCX0GyE7 zqpxK$#dO_=>Mh@ z9gkGGQX>w#?FAD0La!`VhM2>LO>wM$)6U88JLUcaa&{sWy{*f*qb$~L;wpRFl=$?9 zKUiq+;z705T^;PjRb6?63)`#DeY&y%AA^UD$62`A0NLAQ<+~S;4{ilm0&H3lmckwjJRbmp5$27>us)Ni zn8oq8pvOR0jw**m&w9vHcTA(?E9<)zpeSBo(HAoqaDjc~lr7}(eJGW!h_Wr9!ohG& zI6n--wDbi9;EjLE3oGRI+7940#X`I~oK8x%eBW!SZa9t5;dQVg1w_~PmX}>8ftU+k z^ZWws`1ZWo1M(O1@kT{R2v87E&QtG(o$H{5YNo}86*+fsVB^`b%UcI-qq5gw1VoSu zLAUK9M2~@cdu@TgnmM4!~qpo^q+WMZT-8Sdd z{Z3E~WWX#6FaZtc1)V4?VrONCO+gaGMs7>(8W{*m({WG)EO@-|) z6bkuh0Ol~TdIdaKAM(~_>+#sL9vpjhzrrr``WISEDswk-@mKTNam);7&Gv1KLH>SZ*ykm zKcBqo*8j^a?|N_YhIw67S<~iv6N9}KXEQWbdCkvIA0Zijru3OV6m>*1ER@7|cpeJ72ZT=LuHW)F{+*8A2*@Ofp=@LZMGPZ8N7_ls#!1Zo>F4h7F@ zLC99W1~_ho`9)0d8ys0mk8`X@y1RhcxvB!oLRB;^IeJUi#Y*$tHv&S|<~d?!^e$m2 zHo6IBX!yMP1O-GHv2XHF8J>Rk7$&(2Ag`TY$_ltuE)PD-{y<2}Ag_;T;Q^6kL^C(1 z+XSt!jk&gcCliEa)r4^~R;r5}=OJWY+(yQV)xMa5X;$Bz4za)3dWse;MLIrImH(Kj z7Jfvg3>|;_knLj~o9uokPRS0z?Z)kA)jy8G7fZan5epbbz!uYIGcG^@yjPI(!+i-b;}A=;Z_tc%yBs^4%#|Ijjmdb+PSs%RShAc%M|)zk6U`0o*^P<=aU6;@rP`r zD;q$vrR9es{l&v_1AA0_s+wf2U(7_wZ)oz22vjp2n$vy$9Db76`S^@TvXYI*dibxn zU}*56cnkg}SeN7&ICTF+UAS6y0yiLp_~eqsK!gb_QWb38U5TvX#lWip_p^O3o+~myg1GRYLU{9Yi4cEi4y0!zlN=qe&;K z;>IE63lGEaDqNo#CP^+_>m`D|W_^!*k$u5^^vUU)5=?10RL|6{RcKKp*MA+2{!`L5 z1J+#E02?o2pSfg}Xg5usZyk(lXKyJ6gka`}`DO$|-so`NR!orSzuK>S~nFqZW0M=UZkdwByL}eCJR!zITCzd z)hi|pKu2l`uf=)wrkqRk;$)s>}*2h%4pXp!&M`W zM|ek?I2ZZ}KFm#QAceZU(t0#H6KpZDImp;DA61h7v~!S@jXa-UAA<7l1N&k=?eK*DbM@z;=D#s3 z!&iDI(&n?;N$CtYN@!6){t2WuEgo$w-iJ^ex&9Mdt->3L!<;IE(>%;|49+o1*0rYb zO5r0+2q1r#R?OM7G$u-!GkzxVb>>1zA# zCzR_K$Orw;N0YX4wC=K40yK#C#TimOaCL6x@$53Oh}b<0ys5R7SOF|uii4BrA)%EL zVUB3s?}u>Z$PT;TCqV<>w4L-r!`y+Re$5!NZPT}V5tK!S>T=7_^PtCDXc&X8fsX5b z)j(tA_DDvGzJxmtvZ`(fK|VD$RZ&SDPpVv($6#U~EwkPO$=!B=DYTspwEbCuLCg2C z?YO-tEP+rc*=V-KYdkK(sg+9N@B>mJEx!@8uowNcW)3@$4Jpt4?)PdkMGgWGhQt18NGb?)!G!tC0d4)O-2vpu3}10PaFNL#w7(uB#84 zB38aTii;|Hn@t+Nxa`I#GQq?g$}y4SyUWNJFx&hVqq{6m?59yzsM9jN-!t!ok0O9k z)d$?zi*6Nme6n$*f~Is8<~cZrXo^6b8+d!rfL9WQLBVQVO~WvNKCRSkC$%8!S40h8 zFqV;c>&-B>b#%GtsMIxbSdH0Ty2>R#pu%=HTtR)WdBX+QZ!mby{*k`NFZ|9+aj`U1 zJk&^NC3A;Eys8Se z-@#wsHaIYv$BSORPtfzml#l)eCU`C*j*CiFxvy@R ze%{j&~gRX?7XUS_=+e}6MWVA(6H#(g47ZL^0_wmv8M>yuj*{m0q?O5JAuDczCN@yo+8Kq zo&=FT-Ntsfn`(IHpw}NMa9HUv+b?DZOnjng4V$d+4V|eYvDpik7EziY&sZZ1F9pd+hR>^Yxls@X|h;bfL=NYlJG+++CaH}OJ~2!(Tsj)yH9+ekQ2DDU#vGiE}x_7yaUI4Z=e6= z{ZK=57uh5t?FY1Dt-UVJ?5B(CYM3r_WtNlL<>H65yfh!m|7p#}cV*t76Ia)l@xLqIOnQ1)Z>HxKB1h3Vt! zEr}Lg3o5MV$cRIUt6U~!2h2<$tKgky8V?*-a|>&zw_=#fSzz0rjIkPjh9wlO-mu4z zFdG7eK14L9D;K4kHpKLWOv#z~v4%H?^K08JuYP<2O0Uxg)oTw)YT&i?-%iALqKi!% zHo2*XEYwNI24aouR*^Lc;IDu~ynkP#9z&~JP4t4Nr(F2&PNB`9WgFAe(J}!yj>z66h;|Y&k5~v+%7G=H}f)mpPRLX zK92G~t7ebq1qrVBC+_OTFUb5(fv(P-&2_DwYz8ze{&l*4KXx!QuS1xJSkJ$&Tlw}= ztx7I8r#2@gLg!5cV^?Fx!2B$jf|PnuCnReUY0g1-bXdP>*lYy^xY43d2i0Ob(?zJ3 zpp^a?NesSGk$?JSNgdv;)b~^3#LgeXDH9*$_rAk){SFnVqQlau5Wk=@^@Lgx&7GI1 zl^SwjicunhPBC-0$b#d9IS{AqUaXD2Q3jTi!*P2Ltn~UqR{jK#cVvu#AG_;P{r>Jb zL2^g%*r-#XeGJ^if$f@`A4wgZC3lctzLu8pV2evUcL3LXWgX*U;B)(iEo$z$=y_m~ zl;bppkiqX%jvpHrtzbH3yY@kXsY2T z$_bBxXiL&Al`GZhc+hC47hjDj714?@GJd0f|BStQZ1QbxOY5l6Ug_^ET(;kbj&AV+ zV5?Y?RDLq$Q3K(ufF|$3b!VbOe#P3#_3U7PCcN16E*#~!44+;vkj_J7trvd;h>0?Z zvpM_#|Auovt~Yu{mKwWgU-MZSt-LXg;AVzNUL9G7NFnpIPt?fNh*|QJU1L=2n`D|# zDI}`BO-ndhNmM@nPjR69#9so8pGq)VRPIH0aWtkjw7 zq2yKh2Z`4v$egr#wEE7fiefQ%X8-MR4F zX07D)LmixT#!8lb5NWn6&2P{H_BORtqqQ}+-d5zF_&}?Lsj}o){oaL4n>e34*rJ%b}$|mq|uwGS9;C zu$68F7R)0TByb?DK;P&v^CjNTroo8EymthTmsv18Ifer+jjV*$ZK9vT%$|#7s_%#l z?KOHt<2O>iL_;Y0Q_woX1Mg{ly;KcOS3_O(SC&ouj>tvgTdEwRs=Gg*?@LQaoVpBS zrIWXjM+N%uigr=?izhS8pK|XpvHtquQHO6!21^})^O~QgBnGB+_yK&qp#bI6GssqZ zLSy7m%CaoO`2_9;igb{SE{-nKc8tM<%ZSdK^$tmkI(qgHYCybgmtSxP}6yALhWUIEKmONfOX>rpG7dr$KOcM^(|V zR>C-;Zez;@Kc|&%BhByzZj3kAiN@?7x6S$lit9~y!}>I49hbFAqecZblqXx2sUOok z6uLae1u{6@bj_OFqD7r!vMI>6Aw(LbN|lm$ikcJ$<`QUY8S55%)lv)oJ3mvKPS=xZ zhW4MEeKfi5 zAgSNyI2dp_PtS#ZnB2>&1Tf4)IT^WJyCa9d%*IA;;%@cfw~*)ewwP#1r^mqF&YUgIe#CFG_-$9wD?bzX|O{>*D#Uke29 zQ0{(_qp+n@&9GladFej$@tieTqVW|u$0{8^2=k5Jx=QoahzPqf!!+{S)c5#h82nU- zCw>P83mru5O&l}D2J0|iR@wBO-QQkgR|58P*{aX_&D-wQm|l7bSO1`SnyTdnZWxa? zx>u$_I?aCcNs?W9Ii+_e1Fk*;0X181K2mH#g4Ew)OqafL7*x6j1tkaG;_>gkE?g?p ztc!`IAT}xc0B@&A37Xqp5Kp7RZem&HS*j@97c0uPW`@pSnNrxo%AuGTdoD9u#8Z$PQR&Vvag`>q z3%k(~2!U*{kxaV@czE2IU|cAoWb7eO8)F4jjR3~Z&F5tF_{SkW8=_<5nruy{BRjDY z7g&TeH;a71bTgR-Rkho&_P+Jp1ot09SRIRe7CIAIAVR=ne-Ad}h-20tTRiawv zGpn);#@_}Od=hKB?EWQ*Wa>tporSUz4~c03^_AhAd!x5V(I^r>mu{{_c`XZ~Yy49n zQApfuxM|FH#})6_5Ke-wscM|Dlx7*wTSgNFg!M7xATpeuNf)@e7%pOcJ=kE272iG9 zvvH}U&!Q|-j8*$x+1 zZ1lzI;neQ@wy>Nz=!UT#(wHLzII~6ol;SYZAA#KsTRwAt@NvMr_ueaOP+fc3bnehG zUaSMb_;`2x%WvNHYqU-2@#vu?y#^Hn+T#f!uf|zW(QL7RD- z`|4Dq{Llh$m{cCRxTq8Y2fxOZcn|kjcv>yqk`(#SBDKnwY25&PDY{;s3r&m=DUjas_~I(QW^9^`~{ zpa#hR_J~rq#`eCuZ1+R?>@R{IM=L!>-fJ@33U)kwaq8Q5!|@%Dvsa$VL7fL*OX^g1 z1T{%QhBL1$I5SJEfTCrm&_{7NZeHh00$Q|rYoW#f6^%G`J-Sp>j=bB$mNDb44j{Ol zPMshN=z^XKT<$W{(; zLYh-*8Th7jFjY{?NB_AS+l&91J>t0H9G^j!Q3z9}-sX<`xnz8zTi+s;vvAtDaF#t9 zjEy-PCytG2ds9ZtPuA%QT10CQ!Q1T~9KysiG#312 zO>){EW%W>#Blo-5{a@_8^;=X?yFaXilv0w?(vpIdLnG3ubc29MgUrw)CDL8e-QC?C zqkwd$$a#&qm@-PpTCnt{j|b`M@!+y2C?>@R4~9Gk+AtnuF&xZCL&u9x ze<})hUzDfGy-cz-h(4mxhX)ZP8s$4A(RdztU;cc3mMk?u&?A9E$~iK_KbD2hc%O{3 z92y4u9+?{X!w#JAE|Zl?EIWKWua|~nY=GCxQ2n<%$&2>j9)q#@E;F>DK0)`3)N#iM z18dV)_@n~K+g-eZsJ%4pYlpm>I#FciFPfisLlzwKX+4m6z8Fhk(8ECEJ@o!1&7KSO zpDy9His%?brk>J5%X3Xr?&q`HD4Pd*U|bH)?Vcx$&OS5;hkFfhi8L*T7(Ndm7uOEN zFK|G|(l*a#(20qqKk?>jIFf{153zA2M~LdSCbnOsc`P{Jyt8Z`O%0F^#62i2_7fRV zn@UBEw`nau*aU0Hx~WYoiuMEYUT5KilbeI)og465B(PF87NG53N|zDm*wV;~IPQOB zC>fYHLIkcgBesmC5j@yOYC^Z6yuRtx=^mU7<@*$4uLznJo6LsZz}t=72iT6g+L~Xo zxB|N=uen;`s&;dTL#%Tj{+2Ys9rD&q*6%7;bS^1y1iF*!BsX9QG(6l)8%9mCj?^TQ zC+s`x3@SE|MZzxTnkRp;G@}cGIKq!`(t}*sb`*qzS77NM~j_ZfmMfE`Idi0Cg1z8%F$qRLI7v6e zp*GVupU;Jg!=kiGv{!?dye<~~UWC?hHm(&!wy>2w_9_GFpnD`Jaaptvt3Jy|^Qj3* zrbg7oP*gr3OdkV$n{+cKJG>;AOpiS$lu#8zcwv|%`P%!&59jM_LE9d}2Gl#Asxn9* zyG#>f?c;k(d3$_Kv+4Vyi`lYK^3>-a6_}3KArFGjttRrC&Ql%Mf;K(DffQpt!_OPI z^3)&hb%PH$9ezpCLVsy!-y> z4Vc#}S!P%CF!ZWryUWHCtHDS#`t+t_L<;wj_t=X9AZ?3x!krh|PNQg{(SP51wd>_$GFcJpms_OF0U z`|)l!NN|+;NC@cuF8=V%vl18S%pVT-UnM;4>R3V50atSKS!n&NK`k`Myo)ONMq+Di zv@#aT%?B5F2hGj<;|lNAzC!m^!T7Jr-p_76el%Odn$FYh61nW*v5kG)RuJ)HB#C!q zrL%qr7R!cR%bCh0NANb==7{)(2fVgkA*RMYpD1w!LlE+NW-zxW49<6c?W=-$>}BBT z$V}fn=uoN0B0mJ>Y|L?14G7_E;x@0RoN6JBBacCkn);c1DB_OB(LHbgs6=E}xo}8Y zOv`FLWxgRO%~L*2xPqls1ViTnK(_ncs2dRR)o+D9%vY)3g9A zj3uI26jf6y5M;Z*_H^G>+h}Ryvvw*?S z-MMxEG41J!na|MkR54u31lJT766Tu-*0wI1bjQ9V3*hKF%&4+6Jd#Erz^YUpTmnw@MajH-LiKndrR;I~Ok1eP^;To9$w^*yGt<#j755@_!J=5O?tKl1 zkF9@`j~I_?3p5TgXz#&r)_iTDGCXE5ZIcO_(9F?s>Sls(yKfz2V9;6+Y|Mp}4{ubeAF z$TI!F)rG@43=Rcd>rVRxWHq_$HS(nhS)7qObo;9T|?S!sUqHz)cwjru72Ey)tl3L;Dsphz zK~A5GPGcItaBTwIavd`wkJ!( z{?9Fkx+C6{@mB3naK?PQk3ONPYTAsKP&T2TRoC)YXTj(TZyjdkU>xcHX6Y2^Oqm{a z*RW)iWqY188r`nH=_a^bWO%_$PAI;0Te_9a^bOU zsSI-BX`P6@(vqXnD_pmgvctI~LP|h&pts}6kMAvGL|G5XgZVKB(p}f&oa6IfUGzUj zgY#O7*y0Kr*Ag0>j9^sj191-TA|LBpRyhCGwY(OmNm7OE(9?lrgYtFua+#gSFYPW7 zaT4dDm7qgP3&H%Me4EQh$1$E<-a={@a(jw~z8de_lG1=9qpFi3Jb{VaD2gB}GVtc2 zkCHsp-N3_EKBjKo4sibDny@_qRziEn!!Y#biO0oyqlwq$Am`jbJ@Y zCJP&Adx^Eyg`k|9jfl;p12kcYVmy>OFOu3aL0>)rg}qVWUtp79 z)v8l<{*n2QqYWr@Rd7B(8WmV>Sj5I`$9G3g*^L|OCwSThgj}-qWAOPd*7_uJdLu@s z>%4}aG`}hE0Ln^3qoiH7odzfk*@m zeibJ#?oP@jL8N;x(pS|{NhwAg>+a^4N0x28CJv4|a)~(o_?K;XtHVXCgGEwPJQM49QcELLXEv;kplnfDQJn*<-@c>UXw+PWs@NCh-TcE z<2J{zwTXO@F0Z(Mj{5DgzrgCyrhR;S#kmh@55Y2~XXK@)UQVIxP+YoN0wA;fd8`=A zwV&8|;8f0h($bGE7PXGfNSa0!c!nssS+LMdeV7q|d;+jJ`cXUgqY<&;tdpZJm_8c_a(+o4$ zgIo9}>H|PZmxJ|S+_p_ky*Z>6hX=|0Cp=blm9>{JzwMIrTy@RyT@7H_-BDuZ6v5ak zNAHvg52rtvQskA>Hg+_H4D=M_ig2&EX-fFk5{qV58h$_-RSu(GY?iC>HHe7~jLWd8 z?BlxBm{PAPKLZNkffBZ3DYJPAmK@||>{CQpw4H$m9Da|;g<9gV7}{FwDR^coq>~RK z{~aUkX!`a*9`$aVpo`hx%CQe^XPkuhF=~YF`OT9%Cp!JKqXd8akCzyF+tC;(0{65q zMJvbJ$dG3A$D%zn;JlXXE`$d?YHNLTm~QQQlj7s|8wktFmnz)N;klnWI7XZ^y0q61(aw3 z<13TzRED3i>VL*seR`FFipSkg1t}3)JiO~b2|0iUmj%q`5=FpmtrH+(a{4^mO~HZAnQo0q~BnxXQo-KK6%u7-WGGKAi`hz0$FY4*>f z@_)QYOJ@{dM`zUuzi+tADp9YMXUREb#zrfM6QO-E#O17EUCFd@9ip_Gu5+{Y)oV|l zTpwr0?^#Fyz_0-=*Q!6_>^MsB_#uIjj8P)yF#BD%dMlogu|d;cWsKIjRqfx(&Hs#6 z|Jw_8sQAw@T2=?p)aCw*Au(tDZUie(U%pNk+4xkbV}84twL(A>22e#`aRJ>ogb*Vn zdG}u)I!bF5;myy;fBYxz{^wE>g~=^5xb--iuj)jX6{t@9Ekge5#m5EPCo5H=N;xx8 z+U)O-0pf)~NrwIFC_nXO{e~aJS|0tU7(;)azX81K{2%wwZpQCmu8rJZiCg}UD*Au^ ze_lL&s1f;|Y0la~r(t}~q5H{`z%l7Rwi~I<99_6#H{S|at`z^}nS4SqGl<;o{iMm) ztM|V@BcTW|Mv%8aYBdk(>+gucBaeiZRR6{Ph_2U%oBRQTK~)F z{v{v&x9g~)jy3~3x^`1Z!$Cyl^$r69+J0jSSbSKC-tSju)RbEPass^-OuTJa564N{ z3;UZJ{S!a?pDq>r^s2c%<8uoSN$v^B0W%01%M^lTJhmpsE|I6{g#4Pa5!OXCZ`ri$Zsy^C#33dIO+Ry)+(HAFRLHRRZD8F@c z{x_>61M~le|Nl8o|2O>q&t>|5tN*`lH~)FK{%`a7e{Rx5q&{cCdM)vPs@nfHaN?V^ zN4=y*i9n<6q!$`RiRVeI@J~y2?mfS<98v?G%qPnw*Q^j%N{HV5rIIo>jAM+o>U% zmhGG--YGfi>0akaZu>uFo`yY<8`7H|-{7q)v)0bBR(ZLF4S11PI;TDv1<%_ilzoC0 zRp60w@Vui=GZno#l6qGwukq)gPs&qDzANO`o}g%EI@w@wZuk>ccpi0PSO7J7p1soi ztZBa1Wvkm4BtAf0{X19t<@kR6viDY`6y6hTw!RrMBI>4}<*(4b-Tg<*;j>2H@nNS8 z>*+|*vR2X@Xp+A_-9d6GPVyTt2rLP(#!}tQ9NJ9L?6=_#R(k>;BeQ79J@-nt+OC-r z+wacGE$)WPfxc43fM5Km@uJiU5E3@;L7NYol3&P9wN5vW)&B+_0mpTP+GAhsJ-Xa$ z@01N`&pV`L=M3O2pPbV7m0`2g+UkT{Z<>#Nyf(jT8yn!f^CuX%7Z#7#>_mKj1U{_d zd?zOt)CfR>k8f5hx^V^0c7L%=F94JCosF|ycoWFf(u;f<(4*GwwV%2$*eGK7ypSEw{L2aX=P|5G zgtp|m{)E@{s8nJW2M;=I)3Exr6VA7@6{8~R_zMYx-kEvd9Lpf;+iz`^iqfW}ftZ4j z_Dkf!pKus^_^ENeTyWq6l3^%v*hsPV)30DHEDj+;pP@81cB4BT)d)bKTaLgcbUn9~ z`r5!hy^v)ggg%HTc4J%ypXd*;HzDnm!oYCR{|G~Tvgp1vKTWp~yGRj2 z#=g6eu^zeI)Y3PpTlV&-28OiQ=|h+sn=XMgtq= zz<{RuV;L9_i@tX%Nf6UtoP0aXQ^)i6jB(e}1` zQKt7aY$(>$D45=A;Vh+%nD5W^O{z!vc>#W}w)4ZnjqhGpJIoS6DOi~~nD1Yq$WS`^ zuiD$vjp-l<(nkMOa;M^7l)pTCzaQNm{P#g`U1xdnDOVd0X)9?bZM{^;vgMJtKYK!6 zShh>E9TfJbq=4jRJhzETZUG z!&=$)Hkr>l-btIY4I*~Ag6d~J;J#-?s`5}7`koBsl5Ek~@9)l|Wn%uZFSsKe{UJC+ zoH@lc%j##9v;)cD)2X8CsxkxKuA^UCMoExmuW9xwGYOYHT~lC7b382PVX7g}EYr7I za@(c?g}2xrNjCu?Ns^cCl@kBrD}JQqRQ<&XOq7?xzNL~);kmpa(3|X~()U*`5ee)% zrmE+jx4)(>wt<}$gWB~=p$40`7Hgnz)fwbx7G4S7I->=!hHB0C_dKnk$jyXD?Q5$} zxi_D+cF&7yiPjw!;cd55e@S`lA{&uXgvc^WeI~J8dGC36MQfo^d0XMT`taEgF(3C` zRcLe-YI{S(c*O2ct7ie!QwjCDz8e>m2%G@1#dlS?3ZteW4{t~$`t8muoJ+!iM$1N= zoOoUEfY<8n0tXL$mOXE43-#*DX6M`H0V#+~UP2(7W(oKG&9>MmU^8Ivn&7fK$p`Q( z%DWZU7#ewu+~BQ{(Jld!rt|%(Jx*XF#^p=S+p(?z+Hf!N!spw<`1ZqVAvI*ve8B5s zBs9`>TMjU=wrK7z1CiHz<@1o%5YVg1a)@+I%xh0$M?KT!MN%VAJMf~5)^*wick@A= z9*{`1GcO$|aJ7Dn=hXRx`})%O`pMyr)`Tap%C|(Wy%3y^sA|*HJt4)hpDl@Q5$X2H zj3EgPcWpza4KW%u{GS$P&iDo?ZGgjs&!fXW==$8PZA3S&6;PjXVo%MiHf@}U=A;0W z?!FdbXj?H3tN`jYALuxdu-8bSepeNdkYuiqAe6q^{A+e}Ynm1;iekS}!Z0MYI&!OL z-@19nzxerS!g+=t?u+U4oV&YUUhrkF?X7vGG7Oq9_p5NeHenn4^jYOAS{+o_PzV%smFP;x$vB^RA08&qU-6r{e89P zCRP7CGMX+p_5E4-ynP&;(opXHZH340%s`#ACOOqf;H2WJKRkvAx1L4Rk8s7eiysNN z7OBY1N5f`z6JR1{^Tp+y4$BlR>GtIMJ0bRZqP2~;iy0DL!`2tWuDGgo!gNK7eLuF- z)6I}SueMU0$1363pX6IF56M0L)FV8v7wfko{qSC1Yu~}!xrVk4ynvFbMc@I1TWP-@ zzm^&k(ZtQvc=Xj~ZRmpD8NYo@z0Q+4Zcqy7pGL|HImEF*<`0j;?vbB0Y zZ+;bPB@_|wU#(_ITLdf;3?!nI-t6RmDPQ+yPX)am>%In#TI;$JE7+?bfDFNm;mQj> zE)CcwTAmXksKVOfUcTS+=!ZaR5u|-j7q|n0M3G6U@7{(95t2eo0Pl?IVI0FWoS$4( zsrLcbs(Eg2)R&?aZW-;O+t{ocw_fL;PJD&0P6PTlNI&dy30H7MT;S{1emyzTEp%3d zL^7%KycC|us{`ZD8Af@k1;%`*93 z4vp5`?>5`MnfHZO zy?yk=w-;-q3TTHNp7|FQnmJmv)_6)j0?;<)x@GQ-nk!~|u?fRP&b8UZK_5#$^{1Cs z{abWneGWu7Wr#r9yV<4kx_T!9sdbKF~VFOvbRDPb=O%alP)@)ly5nD64T(pZ9*s7_YCJpT~c)#Cn@t`Cx^iD zzC$p!j4Ncj!bB)Fx2vli*zdNSL2|egnSoRm0E)!6`4XoS@M!to45v;w(f5A*?6Y++ zh!5?Hz_Kv+l-I~HbBb|U``sgE;~3$FE4cZMKi0W$5dWXx={UQ=1I$|6yy7eCbCi9~ zp0YH3{vzS)1;25J($}gO{N_xc$-2f^*i(%Da7v*e){rh_6&XO*Nc(DgW75@r^CkIF zp7F{>yJec&)cO5br%&d!P5=smAv5^n_EQyMyQ_;mQlto=jm7!n#;(cSEB$+WG{_Y zvEg?YPOGZfM^q?&qEd<=D<aj2<1g)va(`pim~rf=c0N&eJDp{ z;67`f2MC=vLjx}3m#XBufG{)ZYuK~zW&DPTzg7I~sP<#aSGn&m_Ge*91m?~MJZ{Es5|otKz7Vf@v>epYZC;|T>dm-zA5xNFx{&I2dexT| z!c}pLn7m0rd1_*r47P(1o4Bf5wk}-c(%VontF{{X3?G5G6Erbu?4H%`ugO%;iDny5 z{2h`2Ln39z?b)s}I;-NzJ=_pPHCTpi&xWo~|ME0DLUhZYC&6&8x8-y#gpg8S&I1Ty z(Ayi2-BQK01_A^&2&ZXK4ZY1JhAzduf;*+Ox6cne%sSQ!1AoM68Jcsp6dY0We|^$C z(Q?#3ol>scwF%#Qr*vYCnja69TD_fW-&DG0{~at!@#*V83x!Jj~++U(snDAA;jA8 z%)iSpta6YSQBb7Rz@tsZh0OKM@wts42KI=Jrz#CBp{388kNf9~51xq+Y@-hpk5wby z84W54Z}HK~goRUT5iCJ!J!v4?CQW53G`z#%{bXjfLU3W{gWA?^wV~ViJBEj3&j$s% zs_XBL!5J-zbLEWi&su$l6o7y?b)JwI-Z<-=aw0@w$XNx`zh>;COxZrWNfA=h;2tr% zx}d>7^3|^xb{PpS`EtRXAXLVHxHc@arcb9C@i=Cz=MT}#K0lb}D)m*_?fz9BBgQXJ zxwOism2e{L#-!D^PHLFQCZ@zGZ1+!XKIXVnHg+_T;M5XL#Ej3YPo3->rq8{zQ$t_b z%*axg#%R@CaDV;?2sf=YD3V%U?wn&;=LGK4Wm=}X#Ct(+Z)jV&P*AjKY-)bK-IO{-|_pZI#%1H0*~+u=clsH-T6a zYBJQDXedB_`dyFZbl*+mJxd?Y}DdWmD`HL8One-~=Go#F-N&O5MzNSkJc9er)uTDPWVBD&G1Okhm~WkV8XXG^W-nh`bK1_ zZvmgDB%HZg=S%uaMv-QHi;=|D6Dr}Ex>|YS>u|245Ptf%p_rjB3%1o{sLb(aU{&xi zDi#s<&jRcGjm*FES%W5SjMJVE5fGu*))kr?8XOhvWp8+t61%I^4}sbF0<>T8gLZlz zV8jNV!lY@~of7G8c5KkgV)j$$K3$BevSnm09F(e;UR@QEG!g$)CTWNeR&RRxxO3d( zJh{}CV_5Wl&H17&$KdYl0?6o>TFYH*d$MkVGI4wKQM{y5F(}abpanBqGY0>n z^z!lcUqfLV$&`YB8#&prOal)wwcP_GoX&&atK`ATC*lN~I8)g?LT8f`DCk(rbdvYn zCOWcSw3kx+v3O$2CwAk%f~ej+XUU?Wqnx#w7##`WYW;l~F|tVT{_2&nI8-2To1CoM zqpqMbAnI5)mfrhWBhda%$F7CmAp31tNx&`Vm^|WTv7iZMOVQ6F zbYfJWE#(n3Ge=lrT#Rp>Rp3z!bF&aS2x~hSg;2E9P7~bza;st~Pt3?ZAaZ}{jZoL6 z=Zs09p28&8W4P>imDDRcjNFj-=SG|@bO{aK zTMU?*z;>!;yz*s{NyO_ywW4|Zc*J^z7f<-oSRU-jWjVWec53zes5^q&V`foy8QR`O zK8O2zS&Y$}U+lcLIr3#mpSIRXoW1{PmQBHc_o!#?uf}b(OJvfMLr=S0mNBnN5&I!2Bp&f2#pdXiUG2#%rOx z>$`-APoRzfNczHoL4FA(M%RD1+^2N{8Lgs1~*&1y8!0r(awjGqHo}<%{eL^#?`hS zduaI9dY4B9$#Gd)i&3Z7AAbW1W|i+mHGUNL^Yy;LvD|DMT#c(&qKukR2`8RAW8Rtqz7CsRu8|vFm=Tqr!J$n#qoZr1M$9GDHfSM@n=X1Jsjj+dn2`Eq zcQFo0j(`0p7rP(eEq={HLVtwairL91=G~hNeYZoH90lJ+j2r3!_b6kvjYM&BS$ z)*0Y^@am~1!Gh;51SOrlGy*FIN>$&FCN_*5mt*vesM-q~3(Y%qJBe}mGaG)D5C}Nj4eObS!ecp2+8k*+t&(MQBKx#dUDynlUHjNT+l&nLz+AwpfabX;OxIo{Sdx)Ap(4|-GCZ+=4iB;z zRaIi~{Q<(&@m&XXH-a|_w-vBV8qtjWE7&cjB@=;a=?-AS<4OkLa zy8|8fz}{=mMwXQ-e9n?a1p{3?2)mR}n&~`Er#l#(U;odqba_7O1Ok0$ARmxPwg zUm`VRXAs?Q8`Jl{WEhynF*zQ^u^+NJWYQjn0o3zqp`DyxUcQ%;qh4UDn8K0)ZQk%Be<5Xk$z?W$Z$XhezMRzrIW81drzekghI z8FcWv`+Sr_Uua*GT=;`*Bd6K&bT~L``DdVxO?x?FR9I$ z)!61CZuvg|M^%vFPndAJ4d zZ|XMtQ00ct0D>O`H0RmYjd-Ul6cCaP=-Kt{s+*W>|3oR8#MMz`!&mc_0>XCH#dy=; zAGdf5@Uoi(Je5dAmJl9vv(+HNG2-Fz7?BY-2-R!wZ;osOA<- zOcviU2FHGY(e8~}XSV5aq>9*W&o7@w6a-m%hhm@iy;~)`aC^rxWwpqMkr&>c0 zikc4*@s7AZ@R>31bA6UJ(bVzyeswpdu^it`-|2XFF)@9Hie6ITAp9vfT`E)#5IQ%Y zHCl6cDIXH}qQDJ44lJw`5#Zb{X%sX}t1)uo$8QD;=Ko-J^%)UM zy55!)1&=&rq#2}N6xIYz97O8+Rulip-UG3Z%WYDPXIAN=xqC0xl)@&uyw!7B{vWq^PTDI}OzQCOLai?)!%fr1bb!d89i=dN)w;{@!ccIoK zC<^<=7JoPP-hoSCjSzzlnv(JIQ$h4b+5^QM7in zoS&8rsq^(6529+6+ad{jAB4QEi-9GB1X#LtogZE7*nwx=5@-`SeoW0VUsAQLelg3m zTWlV--9PIF@);A``C6RAZh`H35iwUZu-asm`EWu1m`V-irY9uGW;;;()UFM=rF`sL zp>+oonq8XLheFva_Dy1|?DRYm^CqSB2?-XBzSUM7M83Y9_8P){b2FnSd%am-Q}#N$ z;K#uS<>y^lfGr<}XmR#XxI0s@s@P+5s#_w-iqJ1Z_MnTZNJi>I?tq)NF%;qil!n38 z&_IASJ|%s9m8^cD63sNhH+U_6`NG-p=I6RRuDLoPAtTz2{7p(ALgL#4P1V>v+O+k& z$BZV44$O3?wj|huXs^cYyRn-{4P6bZoSYX{WWFbRUOGlYV)9<}=|(ph``5E~b>HGL zRAu zSG_Hji>1%OqhLP{ZQr|&TN2NfFY9X;(e_kq#lBM+ zEev*SX;Hl$KQ!hkF|yDl)dLHts0twa{4lKSuwPn8o5P_nxvhrAvap-imv6Q15YPBN zk&O-duT3#{-+aCR=cnRqH9UNrTt!C{qwhwEEKg9P+jCEOR$H%|pDfEVHu0laRVJxKFpGXxqmXIsGAfznLpUW>#+ml0ZK* zi7e2nPn+$>uCH)4>8L7;e~f~=j4eK%*BngvVP|}DP_59ubz5KE$Sk<-J#KGLm0NLX z)n2#BW8<8uCtoTL%~H(iQNFfv@T-vspKumwmYQ-DeSdBHQj-^2?`2BL#&Uw^k=wO# z+t%xkwahcmId(WxI%ap+8dw^No_y52PIY{Da4w9H8Kkl6^hxipU@XWms=et9ZU%@4< z*`3UsaG2%B_@gpyyEXu%(Zf7R22a-CO(65KhG@g1pI6j9|572teyKy&Lgx6puqLcJ z>CI(7uWJAc(F(648Z`X*>_b(tQKUp|iP4JZH#mQ=KlJ`ep>QQouuYY5(Vv?WR^W7F z8ESr^lxPh3u8dnUck6IiO}u2vF)WdV$tUFZMGV|mQ`JnYor7d}YEI&%=Bp#dc`>3# zOX6-q7mLGkZI9tm7l1E0#0|77e%cm=yA-_nUHe-1!bSqxrLIzPmJ@nJ4DD^i#}Tj8 z#m(=&!o!i+(wA&IqrDrNAOKNkvwYGo{|4p>B$70a1z-!+w*fm7Ro)#4@7t@Ub_dG) zi)nCplfrBxov_SDQNT?>C>^o7y|c{hMWemzxP;%+`FkXD)l9n}gtmu^`OpxYoV%`- z!wCI`z6KbKu;&Zn!egDI4xo3OK>)Vi4oIVee~|Q^EYmD!Hu3~*Xtr|y`rC_lX|@!Z;tZjV$?z9tOMG=K2YaiFkD~1_ zzyIAz8Yqzl?9^Qk_ooy&=+cX>V@q$-D-dFIt^qjX zjZ6+@BM0Xx<`# zx|Tto{#%^V9V-mzbwu^KyGObJXapZFXJQ4Jx0QNM&OtL>0ScV$=An@1fozJ4q2V^P zf1D}E1iB-=sSr!)yPfKc^2H$%n1Z+%`>f_uiFy0p^KLG2UF=!|Zh6$u8^`)R-`*i^ z4~JaJZ^UmZ1Qb6zs*vQa7_0uCJF6PNyKMqoHA|AJDaUNbKrrfxxp^4>x=5h4ax(v~ z+<#^frDYpyJJ@7SR zFW$^(qeb=T7T^YaOv+)HDi)Pe#O2pkj@5#$F|4P22; zuJ9E-`}SM#5!GdU4PU8*IH2C`het^~kDPZJzN~3f^v}i)(i09q(pq_;%Qe0JqwQ6b z&h`2_jtpkw#4EW83ib7KEZ>Uf8x?^pr}BFVMjn4V_V+V`KLbsn^G2*hIIi}!d7 zpYTBFDZeE@@w(M0G>0-tWR(l+SZxcN6ji#pcb2SZ_m19_a8K%nY)ZD52OnxVy1h4Q zch`?BtTQY`S&C5omYSva1~Z>6E47Wdl?8~AbDATbMwWhaC`{l?*O(GVT}!6=XyB}L ziYsV7)|9|kXQEtjG#XIZ%mx@ZoO*FDsieG`ZF)fYdnh0x^T@49Ek*|eN13!BJcE@tH2USqj_v9CM8d9CtD(|aAB44c+Y-K zR?vh?^{cP;WXD)R#e+a8@nrQy;LJ6w>%wupt|#PLvq*yj*3YOk$w#^rsjyH`<*La} z?Q7EWju$w+$Lj^VQDYTHC@#A+y6$*GZIM|&mg|Dk733((kSBsCs^~%J znb@+iQBYWR@Eymd<|MH~vgowIcGdQ}omuItwco6JRcLH-YjiC~^&8nD=3U`&sE0BY zUyTWF5;aneZi3m$E1peRKF9c$U#ijxxR|btrx`QjDe}90#d%Z`fVH=l8Y6jo^m4gX zPfJT<*H15Y4m1TO!Ja(+3p+5}(@m0YV&d@6)fjiODJONC#tq_mV|aD#o|VLNpu7!& zwThIO?_VsJb7P(vXCZ&kfw!^mW{zvU{mueKd(&v>htS#ebOf(`A1w!9h1}|6kv=7@ zv9|ok_4Ht|R15*%mjnaW_hn({+(PrnV!``hCA2s!uMRC_ANS(T<$LeYj{X6@#;(w`}eYg9&{A z8-#I__YZLgYnBWw_O8uTno)|G*&NK5r_T$qat?OTYN2DDb@4H10@#&nl-qcCkajd8 z&4K>(w!KZ@V)_0HZ{19lq8oAjFx|r2S@UStJ8al5hIREs9-Yo%Uy7y2$aN0UT=Ky2 zD9nTL-a+P)DgNAL)b-mIx8vaM&*twdIYHg;2@V#w^R=M`fw|*5xj#*nB-tJI5U(YN zIvf0c?teENNVAQwllC~Wef8rd; zhH*rHlWuJt7>0~+$)F)Yi(ULC>Dr$PevFZ1|aDEfb4=ho=xq2pI}QYSH!2eXdq|V)_03Bip9Iys|{az6Xsg7*(Z^%qy4o zZnf-2#!sS)hu@t9uWycPIqf8nz5eEewq9ALNj+Pjwr(7VzxSO1J6bYS$7JCobv=&) z!phddkDZWi7r2pN6g#E@S+d%8s49V818Tlu{WS~u6s`#R`!gQm6HBaqesptLb3-Bq zBn@gH9DQHPyJQoH=e`a4#ScbJ@lm@cM5358KSkF><-T=0>2yd=_S;)BdvJfm@DNvv z?hW365sTG1k(IUx_|si1INJv|qpk&4q+Nf8#~!g{aZExM7B6xrZ6*h)F~L6rNCnNi z3Zm#0Lr5&+s|6XvuH@}KI!Z37i5?AVt^*~;PU4_1&XWZ{eZ(}Wt9~@!U8(O;JW7}z z^Zs?v;ege0|4|H{hProq(9+=W(c{jIlS#DYHua6l43%USWoEhA4!wWG*gIv;vw&|a zW%&ogCc%664ec3am|PiH7mEoKQ?PmaW{%&W2*uQRrv^?E?ACowX8nngRM0eQG0Qq& z6}GzO?}S?Vpr3guS#03S#JwD|q!e?-UG4H&Adb`T&y;}qX|J7Q@LG&L`LtWZrb&u# zeW%!sl*X;6Lj;+0D7p=*_x2(rTSb*XfeB~I@g;<$9U5Q#*qNQcI?$>J)E6K zncH`rD~%g$js$rxIak<7%*Eu{(eiAZEiabbxt_dw@Id^5+#8AaWz7e>Stn^TaXSde zV0ZfvSt@H=Xi`oXVcJAJS^5ocTMngb5z8+$$Q98#7mO5IBgmY_g(Nw7!P!#)i_kQQ z@8N!4BnrT)eRgyU4nv?=OSv+Tt9&`o>n7eglO$n#p^*zsqIF+lC<`+-P{GzPiRII_ zHr)~iit^p1;h0eKB;M_0VZ?`AS_$s%7N6?(nzOy0Da6ewpn*eFwP)s^>_t}r2s`|G z=_O^;)^|gTUHW$h;E_cqwdY&i5je+oo{tM~wAbGX=smuLBfLOcuf*KWkUHK=AtYWa z_m2+=nj}gVIa%g6xqQe_JF9urJp5_|P-N-J~?>IaU<&8?d{TP4u7OuGf-J;Xy)XOeQH9QyLGGQO{ZFai%? z>f|^JaM+o^1Y1u-2@9vgL5B?WcJc=L9nlpn^4|CfE}i`ezoYkS#D}29s3- z`vOqG!>*@D$YW{g_75@sFdo^?gxNoQN|DB9{SwS%ITxhQLS1i>r2Ij$5T&~~cGF;X zT2dgWlhA~7PRYplOP18lQEyz3Lm~A3p-+}%EPYS=LEZfSN7z>Y#kFi}2Y2@bXK)P( zuEE_kxP{>E7Tn!E!3pl}E`bvW?(Qyw4*$-5_nfQm{Z+fDuBn;L-rcKLFa5q1TWDot zDbixC++LB|9YxkS>UZUeAH+wOs{ z^x&lvYWG|E84!ZJ$p+=-F>^$lLoSo4`1`0~p*srtjq;Akn@3N3{j~r{hXD6nT4KK} zzOo{w${KiF|2*)IbNbp) zpV)U8215}AbpQFSTX{t_n8xG-DBjGp`~Y~6gW4JQ@OTfBTEkm=r9l6} zVpul-yNoas!&}aVSkG0QTjNQ=``9w|E(0;u4#}$WjQI=|N5dPu>ZEvA^SJWW7sgFo z8r$U-iT_iOdXgqS1vlnv0Z+AU5At(!zpT`|gGva$@KfKzg)%Q*KpLZ=GCin`)Q2m# zNvBC9UCI>^EA|~IFU;+oBd<;&Kg*T{(XC=`Ql_JPtj*&{*d58~p9 zeklm%*!{{0t+=h(OSVmVU%Pu;a8Xjc!&{I{-oNjCJ##*hA9jI5_2!!!b6WxMTLrPqm`C6l-x)_}O$8}6+ET30erfX5}4BzDvF zD7*%vQm6OYeIcD?WAEt}kK1uIk&M+s2WW11zMNiBY-}sRIt&hXwP#~-2C)C(d!#)? z;(9*X|1IFoB5#oBj%ZGr?dn;ojM^UPa*-ipp5;+g_L@%$pf1}##X1go-lBS+v{D`w zNcdSS{y2xidd&xnk~h4-weAn4oK}=VG!>j%{HPay)%82?=Cjp%dC(S|rJ7exBIq5& zml@KEPQ=c=kK^FN+JD9CatOZ=)dgN%U+wC_5m))HvAc_>$ZiA^@BQe~%FEH%_MUu~ z14D?PTJKkRU&6I)y9;9QBualtYJ`xATkFXe$LS z+-bZd$qwzvJtQtrc5jHVrp|_8w9$p>5laRBSf_}mm}NB(f!>CNOuQT5E~Jc_gW`c z>zeY5!=QMQ3$=rfEIR&IYXqMKQjO?pZTt$v+`O3R@vg-t3LwCl6BBQ3KJ|alQ z8xFKZ@=^u8r<2~cH(QI&%q5GgIX6}9UDyF#4-n+G>A*s*!^U&@Bz+iv>Dz>j$n-8g zdSNjNc=6saLy2rMAZuAGKGr4I9?!GJ9zbj}RdVfpmxSx@f(L~jF-VEgn=C~GM=oQz zp$rk5SzGn}DNfKzf*e4UNV9g6%b&{F>pgNM<0Uxsl&YUV-p8XaP>vV>B7oqJ=Nu?o z!E%erf+*-QldK8PkM8@*U>_Lrq@L=qt-N$U`>&H(Rm8i_eWi1D8X@$*A-4jp+kqv! zHyCxqv}24!+FS{mkFhxQ&6d_5S0sc7EBST_Ft;2L+WK&fQQLP9%T$9tkMpr~HYWmD zjEcI%QDmElbMdN0a!7ad0nUd%SO`iwR*(+g5Z_e_EiFN=C;d7}On=P(P?&bLnRE*s zhlj#*?mK-$^k`4S;k^F`u0P5eCdv*#cfZG^3uN}Nri>AxYJ_>KW_6!@JZ)HL6Y!MPfu)GimQ8ayyVp zN&<-Q*qW(#+HeM}62Ship5GtsCa&b=ty3uO%IB3>H2d{At0VU+Sk8`Tzv&Nz%*vCV zk?IETXKqHMv{*>;O_rk?`_f*Sx>AUqJHPw^wmt-0g})Uj9XMMNv9OTw=wPINhGa$E zKwFi?kf^*>;3D<8{wW#b)}I{Njkn3Sp(o>UF1KJrmOR@8%6aDncv63`id`sS*^Inz zl$d#UNYtJeDX{d18%iI#v@Ruz-mlJ%WnPm`5I@DRAzJIm@8U`>J)Fn^QSKptJ29Mo zi@@6@!=(Yv2$sgF2IwEF-I9FcRI&0rlwl$N73g;0(#nq}(qjk`1ZT~Vq7=kL15i91A~+Zc{S%R$;Yh3$6pHe3);n} z_8fsc9=@Z3bhbk_P$;kkZAMs`K9BS1Mr#$L>W&WSUDoVMlZl9b*mB&|GPNczF-q_%Hh1lCR7 z_^JEjjtrx$nIMtmLA5MzY&2u!-u<`(^_nhF6BNT}K7LcTw~ypkM8+;@TnS4t*_Z4m z_-n@R7!=qKUu?}V77 zc(uV)g3n8>Cf(7K?H*1m!ckKo8F!M|ga;4%SbOL(as1+VT&jMwvsdx;kbn`eKW!)X z5f@#Gg|1tv+o3p zYrl$hGakFcYy{@$Hvm_l_cX0}zJ;lKU^>Z$tkKu=g`mLVlpY17$EmrPFhRx;`EEJS zTf_CME%zjM6P;`-lZ*0n2Onh^^s90r_g?6qbY(oHfoGQR1BllLw7JcUFFhsqvXTZ% zaLkZepV410&&>;~k9_gmFCdb8h|i>GFr6;iv>(>kXVKKjAs6q~rAjmWE> zBBkFsOq*l8GUmnw;{}Wt({aPB9^+KIpb?@i+_tlIuw1p7CjQb|K5X6jZP^KTxSz$H z%1{i+a?>DsPoZpTb1QiX8GuGM?}^9z6<{DcWm5`zVG6q!b?+8Q=cTOgW6!$%B-D~yA`8s4hc;ebw}VY4%C{lw z)vA!?W@|WP6%4

    t|UtD=>UKiVYx`^fm?1Dl_Nky(h}YJ^dpA9?|uZDHz3)=kg1 z^iD)isE@r|mxg;3G7QUKR9KhEe+oW<9!G0^PAX?d$tT=<3bB3CeTT`OH}-&J*7X_a zrXsX-mR#2CtPgPL{EQ6-si9Vj$g|7U0w0d zur%-RR~=Ozodk_FvwT})OQAG11S0Nq#@bI5%e^+0Z^YdRH74%fmZRWTIFZ_00EC6_wE1PYA4m zLt|Wmms<8Xqq~xR~sR!N4``h0!%)*Irl%d#M!wJDh zCa|rRq*~Ke0=H&Y0!yxy-H|k0>Q=j--&5*6UYiQf%V=)dC!JL&1X4n=f$FFhq@8x4 zODH?C&-=k8&Y>S|lmIpOt$iREqvP2XOh9^Nzn0Dn_$2^Cq{|WGt_B_3eV}Fy`WO4~ z$z`?(b|cOGw~V%07p>3Y?^i8X7H*C` zl8-_u$*%Sc%i+FyyX&sB-Vpm0ogJWKqZD0DTbdI;WnQ?H21Cmv0E+1lm&S#&au=6e z(dQXuNq$*iZbof0iKgIXzj$rg1ef8Mt;J+ylGB$X^)&xQ3r<>_r}RK`PYuh>86b>W zeQo+|JPwu1VP%Wee_^*zcT%B*1l7T&4}b6*)l1v8mwP(C*#LPcTverd{fm~=P<$0n zR3r{K>jPuVY?Z#C94@HSP>|u7%+*b)vft)1D-zz z9u(|0rit|YiGgnRb8u)^+i8jpd`n#nh$KLXrbVvccc;og0yV$I@9J;9)NpB%{(x5> zgc64skI`es%4=0hKJIrPeV>sjR-Kux+v<>1FRO(7*cOVIt?P`U7!lq4+7G~+wYms6 zwDLRNeA7Q3_wGJrPl9o_N+Izj6_ayv+KTqcURTH)F35Gtv~9dYx?hUk(f-w7)F+|9 zBTje)ryTQz3cs_XvV)VF=*07nk8!SN4j$yqI|9-Im`tTaU)W z;`5=$WU6tNwXJK1aT6Mg`hw5)Y>&{R?UWy&e1sp~obAIeHND}~?Lf)T5s1s?y<2;4 zv5(;v-L^#1E=}^?W3BWTlJEKz(E}P^Tacp<8Pl)(6f+70{B3|tA@lwHxAI913bcp{ z+8p<(Y;d35@FdQ+rEzV=Oc-=6=3}~OGY|RX&%V?ff_6#GL52LW8|LR9S6Tb{08qx# zw#l0=pmd}1ETpyYQDeU>ONUOQtv?iF_%T0sJ&#)s@y09_#^_q0Qxg_Ri{$bCUP87x zTzrJ8zp0PRJJ$)xOaS|)L)WC@!~;Qaq=kfEb}_|!P@{{*0Zcp|osenw2BP3a(K$1M zAs^14%7mmiT!dkc6Z#JEE8S|3(}qRwqzC+n)62@v?~v-z=#{&UJGu%g>D2hCZz6<< zbVzdHhNTwnTL*Ym$5y_h^(Nra+Aa?rH`dEwVON@ekvwROIX!gb-ODI=(j&JQ=U@(! z7R+}5AkyJmG>>G3W><(5PzkKDJ&8_`|8T985R~5aJ8;kc6>X)my1BQpR?Nti+nG6; z#eVo$I1$BzL$gdUF0WKzvVcB9c<6U^>M`EhL(TB0co&+)Xyh$AT`ZKr9>NCc6FNw2 zhG1*D3`03lxOz{6gG{ro?u`YXKVC++*1|XsMy1nR;Vx2dK{?SmES$~Ju5iU!b;0&I zxcUxzen8Y8;JUK8pe1{a5u8XlSuWxikxZ*ltd zh%`N}cq8=P)Cz^+WP-V)P;x5(1cIqK9$|UTMe~Q6mzX-1Oo$WT-bHflXNP{=6uGkp z>}%zHIK5wGTJRk~>l>Hc()r>z)3Hs@`RZQoX@q?an`1eC5T0i>65FY7eU!A^$In8L zJClbo9vXw8((MJdX0a93g&TM_*JJMI_uo6vX1kPe5O$@Jygde{i*Mt!73o>wy+6CD zo$g3AekzZ4q#a1~a2FYcNLbxcSxZMBR+1^;Bzt|mu>61s{Y2Y`)9WrWF|s}d8SZnr zu8b8TqPkU5U5(*$9Va|-4dV)g!@_aQ@yRslWvXhTsJ}E zPVR7j>h7XZ-h@sGZnG9=iGgBMHvf*5z}rxJCPYzqof1K<4iDx7r z5>EuVN(zHIdqir6Q`xXekZph#hTBTBJCnpMVG~CX8Y&uEvi%NPAZ!0_4-EfI6m5Fm zWBax1_VnQaJ6pgKmv0hx$BVnwks2v!Whc(bYK3o-p4zwXjz`k`1`qu>g@)0rEqAs? zU`_{KblvBRb?DCV%??soyHA2w$GMN^AD3I4QqhZ(4LlOuA>9|V1f6x{V(^DsIo+bf zomsg}kWCeIE>}>Cr27;xk5dUK+#~M>`DRZG$sq^vBJhy_-qn4;=PxEJ;s)o9{x^? ztLAF^Plak8lF2&MGdD@KT7xXIQ`x9@rKj@VRh~*dq5TEOzBubmA9R^n&W0fRnQ4O& zSACDKXmTC*MyXqVb(j;7XDxa?@{4@N<$pdp0mH@kg9pbfwI$@k76ufHx6;_NuCR8D zo^w4Xd%dy*u2V__&Af9WI}8lwvO5C$m#m zsr1eCJ?Pd8@zf@W7gZ&(|NK`&Xj6SGUak`+`BV0G0~l-VD3jABL4!H>=gOuL=eESn z0Oln+PDQik#R@gA(ZDJhBzN8C)i~P*;ffonSKI#V*5hODUXAh9>gGad)e;aRdcIdU zI7-8=BXykIcoZv=BT^qO%zNNt5QJe!Vl57RD;I8m8!F&U^5$UxO!Fi`r&16$cZOTj zQDyQPVFGGM@)w4;d0!yZT{b4c)m~@6Pw<&&1Qg&Y9bC^Ao3I z##OJKT96p323Y1T-nW4#2^V9WId)yqakx!@6AJzmWjQ|we+kSjhUNI<$?Mj=*v6^~ zU6YQvL|o!}zxE;uU-0#|!qz2IcnJc3YtAM9LaC^wnf+3ilt;!jQ;u>Z1)n-eeP~Y` z>A(E-9}V;gFk8NzVDpDr=Ipdl6ORaJ+Hum-YeuDd&af+qhVBbf5@ zrEY^Out3im1gET1=nM_=E85~I{FyYsYbkXS){lnTgm>s}(JtY2A0sS}v^U4oZY&FG zNt5sS3ob@YfAIhqEHqg&u-h?EhhfmP<#{%^_d;bbM4Wp=PU!_P=vR7Ue&Rzi&3(>;pStFt@cigxu-VzmpO|jtcsQw(&U(Cg^^TEc&EW@6|7{c2;uhEU zrsbZZm%ERfuOA!@25$w>G1{9S;Rfc0RX+;J-2FjOMVUf&B1lViqG9Csi&HH6r=`!v zPgxC;V*}^wTE?uD?}5*}^%`Pc<@wKfVVosa4|Qa;Z{MbeyAV&WVVL(rf_Qd<)41F! zR|#_cMw3|b+XAI7%S5Au!q`oQys>jbqZ+HQsbxMsUeu>1`V=|V^$#+LgN#H)3=qGYj))p=r^JzIDV+%eTJBk>(ra3+=_J=7gyP+ zIg;)oL(^ZCs3?d~DUioQ@pE`N74gW8*iNx%MZLUyiHdm@%v|T>`3JVj7W~Ah{9?KK z65-zx^_Ef;(H)0*W&}t;gY3Og5PN~@XgCl#;9q`$yQkt-vv3mhee zo$Z}}R#c#L%6nB!0*isP@d0EP5;}RVM|zuv94bKtg)IevJ@+E^2sS*A=>yS5!(wL& zJ72-yEx+BE-^kt{Gj%kM%^jlh-VWVi=6l~RDfER`^i23kMb27*FZTFAPppV8=YyC)r+x%kK@1SDIgfVkzfOe&_ zJ}Qa#s6q@_l*qPLA*`d|?{TOiGRsH;yXEhzP<;Mqm0^uz*3{6qNlUEGH#Hg#d*}NVY9e*@f z5%^#njUHm0o+vO-lwJfKK3m!`zDG`S!r3G0{Rq}4Z@BtuEnCuQGSUZyDMWr={0=YOuqJ1t$h90<3I^P*@B9l%5 zR7Z(90=h=t8_Yk;wd+hdT+u@SF-drp$4?#r+v(L&AD_1kJm0y_zAcsyKkk*3o#ADn04tDYbZrtRkIk2*y$id zJdOeoSFo(KfsFf-WYIBiH7d=QG?;Zp0K!P;i+9W!Iz|C((ij)8ICC_hMDwM2YpQk_ z$CUQzt}c9ZAkk6+hZCfNh~^S}bvR#ICwI4bHSbJT#%b4a(^zi@E+@qZf@`-wO^XWM z7=gTF$Z5M5zPup^mzd^B^>ce(OY*Xmj$HV&>gQ0jkxxavzWMeL(5UZO);#eDK1(f9 z+$XNwET`F-r~k2hm~4o zTJ8@ldXN?~-jw;wvO~3SkUvICxUBMK4&{!tRf&lvqnh4Qpc@ z;p#O_x)|;wYzNvZHOw&_cqOSGh1(uI-fmRYV{?3+*l*$^ka9qg*}Z+dEzpML>gn`ki`XohkX-vpTVXP znxTk|Zfao7o^VPGx;od5UR~)M#(V*@dshOCBRE7{kZHQJnIh8E!*_Z+;{Jv5sVUr2 zUtqDnydsTy8*=tp3UR5`<&CQI5X*(3{F?7`fp;*nE$aDmy-f1=hql9IkE<<#rY}o9 z3HKq-eC|s9UM}op?4fQ5*lbtG+%8Xkkkhua!hoTdBR)(NMII!i_DdNzffv)=k#QyR zRw~64p#8Nl)iZ4tLTYtrFAeQ*Z-YxrOphwbMV6L8k5KXlbEUg9{XNqr_pL%1hK|51 zi7yR>IlBtoC#w@v8CAK zaiS_pij1ER+2?+JMsiW$aoknf8l{r5-TeVk-^4s^V3H|sm8C}RYxx6Mnp1vg_cLL4 zW)SBM*k^Adf8ZSrpuOdw_a?HZH$DoGl}nGm1%XXA+Bkh3uDo;|yHtqDkeYG2?PSEl zrOG<}sArc$9}%0yp;wU%6`;E?&cE0?J29<#t&;-B03TGyyvlpq?_4QTZG~c3Zs8!K zCaT!1Xo_+CrV+mmg83z2CAoH*f<8~r*s-jyNe}O ziqND^D0{Cl4S^Po!}fPEg_t_zt?PI?f#+M1cP3|KigM(jH~JSAr9jIoU>?sr2)X}<^W<9}11t#e8*Zypq zrsvy)4?T~b1R}Yh;IQrYEGhA?kmCOL%bix(U#uowt2phL+i8KX5O!Xb*J?AUSmw*O zwRk<(vs0OX$mY@WMPVsMQ1M!)PaDt={%bV;XOp5qh)@gF8D`G=|NZvDGE~C;pv?&7 zYAK5*+s#-op!8u`?PhCCXg!|7Y1>ae@%-;U2A)}%of7yxksc~K^*y%xPVy;l&)sM; z<4(OymQA_+Mz2b%9MQpYXv;ue*XUNl97ECv%dSv}+Nu_oe`W{68)gQYd5){aJ=XKd_?z_vHY> zBpkZ6R`~yX4Y&z?%qyq3f@ax4DBy_s$Epcm!xlk2MbIH$>fiAu>0;G}v3<-=ssHV@ z{P~hz!6oor_g>Ziwru})CD8iIYT6ACJ`jwHQKRWyF;r{$!A0&32siz^tn8dm<7 zhkJzt;s>SzX);anuUS5i?*>wFARt;KINSOBy<+(xx1GbMOBbz+XlL7%#0Bri(^f&! zXr@BZ4IN3Lf(X8Dr>m++01SvOJUIQE6Z)usqULq!s*0Z%=WuFV@sG~GUg)nCu{D7n z|KRw>KsN_C`~Nms1-Q^{t|tlTtetcKo&yz^?XnboUrdujPM5c+{>!JT_S+kMS>lm= zek#(^ICXt*?%4O`8F~x^BZlEPnw64xN}D!pq$EbxdNju=2#jt zO~e@f$4OO390sK5{~{H}AHI-+YQ7B8{3Qq%vW9D`9kre}-|tS|!`;lfEehT{H8EP_ z2F3rJBuL!!n3CXuL8Q8xgD~=87{t`FenV!_ZK3d^u34@3un_T*4CM@Cx?d=b79H_!rWImB-0{zI8VO^yBSG zBH&F7&sOMEES70jBy@iz@6gK=Lt5zYYSL%@SYNX2GN-2@@CfWxP1BWDm(~*R`^y9X zQiO*PpT-CQLnZ{3s6eGqhS!-u#G}HXOFxE;kA_+{B`M;2yJ1hjZDn40F0YFWr`;+O zK>s!!{!=!Ijvnw&nzqM@+`ert7upluJwy47JC_EUDvkB(55&{KT&ZCCZlzcY+AF)3 zZJ)ONVie5~rZ06&QKL)KN8Xh>DOCTpsk&EnkZ^t}qV`D-gO zjm@KZ+iVHz@@3CiWTDx5Pk_4@85cxpPCLVFA9+b4)H}!piIxNJWMZO9^N3y7!WjcJi|Rk9G-yfqOV!=1Q?K04`^^ z1AU@Uwi;`^vOOy=5x;8+!w0)AhYd7 z)4_CcDuw83BJJU9bnRqrz>W^2j^_E1gP#0AWRr8G{bpU14wK5)U{R6JwX~EF~4oz)yU+BRu_hXH9Q@+Ov zvc#oo+=2W)2I$%QEAFt~O@~4G!t2ga#6*FG_Lc7gvgiia&Aza=UzUY?n_T!zo>1%ZPWk&gM-eLfn$-EVv9U#_?Wq(1^d)CK}E*?(UF z6>k68iX}vSpm6190E~k9WfDC$E|xKn?#{7gSo3=k(AY^e(2(iyyt!$;ce*<_x_A2V zx?_P~MDFclbx<1C>sCn`Zysf!^}^!h@M&u7aua3JYQyxYxn`sUpR!861R99Z$}tE{3)PUNp(PW9)fCM*4L4Iu*3-c%qJ$BwqUv*`E$5!A zNH@i4AzICtOp&fw_qU5)u9TVOIYU9gk&^c1GBaREA|jPIOL-It%Y7+fGuv^nxH4q% ziJ~JBQ+>5jd}ZP$JtV2Ov9-PeB}-R1yx_RLjpq|p>2hUxM$qvMLjDUsh8UH^{OchH1`R5G9aP!f(f0+^mQqaR>&=~0Ry>KXb zS$(lWEK_FZi2k8ri5(CLGA;*Lm$=D-7rwLoLri5~0PDN#Ag#uv{3fTvQ+pE;`JLG) zs6+px0!+m^;tzvR-U_KC?}9528{OM5)#+uC$v4s=F`%805Zn;j0^>MtL|7%frVP;| z{?LUfFVVA@eRnz(jh7VcoZMG-(u)M7)*>{`?REBv%wg3ceNMfF&t&Y9+e0*==H z#aOM72!Hil&jSj^o&%1g5oMEmQs^qGd2F4#3YcPDFntjJB%3{t`tUo&qFce1|1b|n(gAaB+uMbk^DpyN z{;OG;h9?r%)_D4`^ge*$I07(x-gIhIe3X@vGUcY@YXxc(m$)i!UUQtz-HRz<;=BIA z@B+XH-*~Qg-hcq8?*P#Gt!9m}ctxueJDFyi=gJPp`od(3EZ6q=L0L@I*c@f0ScMa1FxEcd1UGrOJ#qfc?d92a1()t4nNF%!r;`#6yOlY8*DxdBN+JG`i8 z5l=>#Q2yx{G*=*+{>V^&&3|9O^s!lK_eZul5(s6tO~jU>#w(suoOqJQDy2MTr|5ha zEfow;vu0GRn9JGb{c#mB_Imrg)W1T7KKU~-G!j3kvg};4G(gvcP2JH-V{RKrFXuD=(;Y+xOiKuUwVAg^gLstlJfG#?z=SU4w zURGwxcgR&a+KHLVWd6io_r1@vGCsL-{ec~D6dv~2&+CrLxPe6r4`ng&X2*0Li~!4{ zN-psOa+T!EQ5CPM@5A7iGgRIBXX_NH2r@k)mAcqGPOX>9U(pll00*L9UtrYJ z8mB%#f0Hv719X3S9_FPGMu%{v5+}OjFHBdNZ=NSKXY!&~=lNw$)LTo0^o<7_8xckz zfn;3h7t_I5OtTV%8l>>)6Hw4`GFSv=q7v_LuS(ByxjW44cf zHzaC`Aoc`5QCLigWw)cFt(XK)GsJa$Ii<2$tPiNxMXYP^nzQAgC+h%znS*((-YR8S zfJ2(D3Rz1+8jF=lv|KQ`hITk?Y#zme^54!4OeGdjmdliX)N7HcHIt&g9kHtuDl!Yw z*wA36h_&gpqVO9X^-u24Osn=igFCpsXA!7O_sdGqSCj~$eiyh>*pFk^XgS1VMbMk$ zu?UwO3A4(SgEXp)k%wAIR<0CNVsjIt^(2j08EgYRQAw3rSRnuP$|VdDDWv~8o2*NA z(YIaHOX!EeV^#aT^M~+ggy^avppxgGe5c=IDMVFa=8FL=v<+pyKg@(t z(t7F7Ru`+4GeBHiN|>$R+pYF0KUHHG4qhMJ%3Jwtrs7oGJbu?~ngtNn^gAFobE=?L z(DB}6Zqs7_C+hrBtDlPUOnvK67rl3SwctCvuD0*`?D@7%2Zw0)yQy0-C-Gk&Q*A2k z)f+}Xxt4FKeFiTIC)g^=mY7h*KjoNIZq1Zs{V3xOxFEl8Mf%3ESEafM+9p=Zp|%pu z*JpJPl>;m&L1uRw++i$rslEy67pIw@cs72=9{i-2fn^maLo-3^$degg5tA*B6Z#gf z`VQ6&vGsbr>PHH-1k|ZBZDYI$D6#+ZaDM$;ZcYG1mp@hP8|>k1zEl?t;P^;+!)1%u zA6lllA}YZFxD0bk4Nk=X14W`fI3;W4P^ki_1JUh#JmqV_i?@P)Mt{Tm3;E~FH&Mxv zWJX6+fF-pq!_EByZlT>HvBBqRR~}$wj^v-~%mzZ?h3dYLCmxTR8U3k^0fK?dVH5Sn z3jR`>bVhucD%o|osm(qccHaXmf6e~;u}W!kkeWfwj?jsjv6W>7XGMsMx) zllbZW`3E0@f|WE9Pn>VxkHgpGN$kdm8{27y{Tvmdk$iGn2rDx|ziQ0s6){bu5J?j` zR9n~#F~c=ZxR10thBUv`dYTtB4Tsmw6*gQ3uq8frsI#Ei=`&y|)0DA&rqM%!4T7wl zHa+wao=}t%BdkjriP)ndp<{w{Ln)Z%BXdtxj20;SA}LT8dR>ZlE_!szuS8ZjBe3|h z*2PUw@8xzO&sD2IlGy!%^C{JlQ_kC*2ap-k7VEMqw@ZvaCGjs8;T<$;P4YMkVyNif z4P7@%{{(7TZKI087$Pe79-xtj$#pUYkkYZfSboYEof?s|D(^`F6~H0yAYCB~+I`Kv zu18cFl;C}Tg#wFjlFYEe%<8&t$az!iez7^#puU4*HZ({v+%ekMio!V3N%USmkv)Wbsk`qMU+~>e;OFnA#usq% zQ}F0ehGM4c2iMp!#KH#I1Z)tG?kbvxY`NUmBP((`3@CTJw9U}&^st}mvlFT1xgb)c zHHS(i(SVf5`H9L@1ta-2-j*#y)rzH6)kI>90kO-`3<@n2)FSNu(n^>7kQ??#lRCK) ztHlR@-CC(|@^kn_&+|Nfj%zZgOw57p>)@jp(PzzMKghK5b3k!S@lY6+-XDY_qfk4~ zfdpa#h+qDeN&08qAyo-W>8DLQhvlgImvU_qfZ9eN;&4pDr#Pm~WB{?3*3;YlDyh*< zHczt0O2lK-&@EETrN9)4tLtZpskfTbF9N6^Oec;7(_;iT!~x{m+@p5dc?ktzX0HZZieOmR0g7eOszvqFj2 zfLD9IDGP}F3|JzwLdkvVW5Amrzj{o<@$0opkAW9d)p9gCu=`m$M0)cV4OS)-vxeX2^XBQR?l|dc(|gn=^dnrI@EVP8)~>WMv;ewp7^b zV8%poLsOLKba<=eo6<~+9hN%1pCen28bUiA0)NEAY714|p(HAI-9heWver&+5&2iI zP8eERm|QqGBP^;b4i;ve;vaFUZcO3*vg&F!Bn*sHO7RHpUHp5?O)(-K#~_6X$dO$a zO2T(OqIRXhSTb5nDSRf~k}`7C*@^5nXYPup(L`7edG8tkjeK;q!^`EFfAkHtWDIf4 z$dY0XKmA;lL2A2)o>7$d!IBP1Q1znEujD`~yID-;u)7Q`l8oUVRZZu+0$rJTx}| zh#hGh@z1qjA?wo*>Gwm@)V>7?X3vcKdYFifr0oSucp6A!`9Hai^#(iyD4I7lU-h=0 z@HvR@*^gv0i`AAn-K1DQ=V7ZfGO$vHu{6`3sj$+Dl4dg<1U_R&XFV7Z{f91j54A?- zBD)`7?f2(V=+BoU46xbcqooHggVyApC7djm3&J%W`rix##FEkgCVI!o?MHNs#L-6k zkE;y3;|HUG8#Y}+JK8g_P7Rxt+eeUkQ9Zdug3)w|t|yzL3PFDC2)Ykn!c90y7 z3DFP0wsNOicyC0*N*`s#JvIA_V(06DlN;Cw%_OV_OdZGrJ7WUc@0*mf^ ze;>r9!FqdHv%i(>H~B{@;|l?F-KUA9ts&hO9su8es}Mi(A0qK*#N~G+jQkVyHFG(nJi&2TWg<}hV@@igKO>FeYP$1v*&-?s;#!?%wK;ZivWq9N7 z-fH)W!g|AMhuKPN!>q+FtCH|T$9+-554`{KTi_01Xh7yE0*#~buT+H8d*}}z;tezp zXUk|+ixqITVZ%oP0`(^S3*`5*`UQ$^m;Jmj5s_S1geZC#HbQb!7=~wPIBlN!am)Vl zm;doTQ2t+ZMibVX`9c3!?>jMaetzAFEFLO=(F%{s^X^w%^1nw2|7V)WUqj>WVAwEINpV+RqAS!x}SeA zFQG5F27>UlK98=YO5Xxt5oo*A1i9>1lbCfHrGDm#Q=1G%(T6dG%KW>w{pW`c7bU;{ zaZEGe!ACj(GIm=oMW%36qfgFJmOdXZ)R_UU_f+Sz6TLopi_1~Ud%IaV5mE3k!1zFu8%2ae%Zc>U zz5jfJ-E7oU8i2ok>a=VqP{`(`K<^X$@4Nf&B0PZoRoJ-A8B-_=b(M0MdhZGJDldaf6n;yhlr<=ep2%8=myccJ

    J8H)Uhwg*m^Ub@)D{7SD*zi`cHkOkZfBXtX}MJkGOcL4 zbkXtFc3I0~{~N;25xweW+mYBAMqV#aGe-kf>(t@2Sti`M0}`CO)?jpj)f`Jqs8@rV9YEMuf%=9sYcq_B0{^d=^M5|>@&WArhfN0r;pH!3 z8@Mtk>TYB@jFFr^pBgNc4ya43^j!n1p`DPMg4x^UNW9waJ_`9kvc|KISmL~2p23%D zeIXYvVRX;qnOuqrFF@k#GD+)|zv<83;GgIn02+FLrpiLD)$DL(Hs4O?;S5Qr5@4Bn z9Gx_gfNSFZ-D~|9%_1B`3PN{-Y8P%tBE%FWk01=xy3Chnd%N>FHj7#zrpt2p8Sz}yZzKTq352t8?7JwF4DOI8VAQ)ev^Ahi3H8;YM zEDB4Ck0E&XRRUV^|!or5_-M6`5*Z5l@rFhNU{b7*9@9~Q;QZ^VF4+QjLD`$}N zJZEtD?H}niT5FGFaFmgrJ-8g1?p0v8XxvWqep{kU6-1|1!ya_Qu?6u2OHRIi4{I|I(Bk75CDD+*Gac zcmW9H`?}y#2oiJ1bUrx-VB?&o5Uu$hxeq_w93m(9xt*U-Xs-D?K_@;vv?h;dQY zy3g@4U93Ow^aILU{?t#uG1Fz5Z1wW%%QPx7yx%{V2wa@DI063ZRK6s}@94=Mi$F@H zURz7{-27V;)2BNJ&)yfD2FP)p%}Nl4vr4nQ5m0`lN)ObUpI*@>7Z*x`HS@0RkbkFZ z9DSXqGjFdBrkkotjhTUP0c{`x8g|gpWj!ENBR~Sd`2wgNG41~1w&TaB;jS^g6rK4# zz9%qLYwuH~zloW8v(XlfbT)6p{G^}1Xmj<>n4iiJ31%?TgFK)!+rbco%e$@EHWGMB zoXgto!59)+t7OfoZRy12L&Lra`cZ}dQ(+0S1BGn~+`3^ov3~Tf@%L;+{B!V zMJV{=bB}LF^y-Ra+du!Rj>ngZqcUx{Jas?+7Mgd`HUbxPWfjCR4Tioa%ZaAi|i;zdW7V0^qU?)Nt7xx1+fO+pD=xVTxv z;M3okr5N}PHXzH5OKIq$^6P^jnVpZ+#bNGc0~#^KWfd# ziYE7_cE(x_aC`G9y>6{N{Z`xWui1-)04U{{@vMW(O{myV+_L~U|a{N0IkDj)-g6-DCewlm6m@Bjo2nJ)%(VU977k$WjW2HL|y z!NKRm(o<|#^1E5s#R2i=BVVuEeU|4Lk9y0Q#hR*beIbWd8u}iY-B){0EmtzAP7cI? zbFEgPGGpb7JA|$+^?#nUzl(>VJ0F|9HgB4BVeBZ8_@$2{_Zan+gq zR+OtJ$n(2e>9uF{tzZ00;)y3kuDz2sPI%-1a@K%s7_O9 zOOX|OUGgB=QU!l85JnX%_>hL`aVBuY|8wY#-F3XrO7$Kl`_T!Xs? zOM*KDm*5aINQmI>1Pc<}6I_G4ySqbh*Wm8<-&FrnRbACxJ>IYHc)s0nGr~P*pMCaP zYpyxxdM!p+eSi0j&E>+v)jYPs7lmkKp05h$fIdgFG7-F#1%TO|kY0PV#hNPf#W*oc z>~YeFwrnErS4e-49zYWOZyBIq2_?w=wn}#RE7;|j2N{sUpi`ywXUu!jTD)yO3?+Nm zI>_j8DCpo8f$+LHq&_}CsV>w->m2+Alt)s&xIF3<9)fR7&UQ%34m@|w3hVU!DJDA{ z>!)iuRLhrc5_S^o=gZsBcf@OBbe*PhY8I%~)qRT9h01CGpFyp%uh1$g5RYqQm$w*d zBM5X_L-%2b8SN~guSwB_EIyIROSnwM7BdZ^pK!Re!GkWCQCGI-HdJf<^JnBqK}Qygw0H=wjTDVCY=LBPTc~3K287nIaCV)@Hvthl*sK>ayQx#OJ7|3lAN%HX+ouh z?3}Ge6wq8NRDjm=b%Ch1?>Rj65?{XZ=7?&THmQd_9CAty8XK}B%MSDEOw(mcsNsA! zvD?KGZ99x|i>-HzClR01^Pam&tax6>5e#dmlb_kv9v3sH80{43e8MKCs?r8x7i=@d z+IL`>PtAMq2&v)_>DCPoGKH9)Oz!d3Cge!mUOi?UM0W;JNK0}pjA6Yah~P|H>;EO< z|1tUYFnsxmtYT~}OLsFvT{lv@M+usk)^7W%z;#nd)DgDjO@n8*y%-#J} zZYc*0Jt?vppbD*QcHP+;V5B-%2;ZR^fO7v?Zi(?AaeeTC-jBT?tb{zoiYUOKoT<>t zJy?ZDv1{lD9Ea?BO0*6Jenv*dzO78qO&E8QVL(&mzq~Ne0G#$Uh}9|Bc{eVE1t(j7!8KC(l@x>)};CAt1SLwg+oaOvGH|N6Vy zNtNT6A2S5+Ag8xeKw*9~f4xsL{>H#Io)EozWf)Ii6p)8fci}vP(Z$h5a-2i<6w9~j z_1l0^j(dQbM;p^Lp@1dtbTQGFD)~i8VW8ajYx(s1Hy$%#f{VKjiU_W94FME*oi#(H z!L9y-b(COcP?43c3yVz_VtM(Qi*cv<+P#r&30Rco_R+Wf z@tYc}6-0U7NRx@L)CSNh6D%jQUJXZ?@GGCznoO}3@+Ank4{YF5wXjhA)F(JQ*5CyvcCpV7h2x&Ui0fUiAA7 z%3wWRP}qN^x75+8vJe8HFM990S-n#@t3l?w>pYd*XwpHLK7I(@VnwRlIiRLkoh(ip zKLdn}APj9byP?oX_8YIMBVXO=TLBFg_l7u9i<6%U z%?>=aJF6dKSjT(6y7(u@Ev!{=c6Uw*y?FkGsveWm%r^NaSCCstF1o@u)Uqh zIV4jHLRUANugkt{7_Y6|+g}nV4ud0h8M0F@_=mbJv}sp_^x}*w>Vhi*01q0HKgcYa zW?Grvow(dcC!u(|#WOb4i@TLLdhlMZD#`iUFi7WPL~xi+%QW0M1>|W~s-h5bl7jR- zyfzX}66|uLj=;^5j~jB1RdPghnJo+nm-~Sz`95t+*Jpd>!otif)^lFp>97a!EAm>Ui}*YoS$+08Jt49q|CQi^=8qXA5wG2UkE z3B>b99UqY=?(!?=+2geSaUo5`K}lF4jaZ285Hk6g+@Hf7!LuZ0epL~n6*WzZs4d4_O2 zdz8(_^QtGW+YMc7YygWB0oh{i1NHOBateJaQqm@RHd|SU;KrYw?TVlZkqJxe1A>ZR z9)|-oz(<7iN);g9iY?O1Wa!p5~rbHKp3#tXa!T7h=@zo)AKQ#`^?5 zhRfp(T<4!pbwj+0v{F)1YMej?3e8+Q^oa=G6y~k(k7BFbV>&$ag1#7ocma1E6e8~Q zh+2x2dOr66=G{Ww#sWT7G%@4}h8TURe~b$}9^m*1$wl5r)$Q}66eIM{mX$&m*XKsv z`=?Cg0S27;*Z+iXrl6Kb3!!E;QzZ09M`!pWH2!@B!8d}b0Ki&?;Sj}GCGpRd{rQ?s zN}{0Zto!V*>D%8bXG;n+!pikZ^N$fSM8s4LpNC6ElPCNVU?=_wF9WCjg5l3+9hLvbDv^3nQUa|5!qV~3 zUl;su4_#8^6Qtyb#fHNFc*vii!$Tjzgj0GCiu_Zy_S=>I--7XfoW$tu{2Y5(#g{h{|#(;J>we5$8_D>{(E`NtzmIWxdrYdZ6cP6Vvm~?9xje4U- zcb|cQyGqXHQ7FW`wD%@cv^hH$wO^22JiOQAkj)E`5! z#89%k5Mvq+R?PKo13+aMfGB;oHkrGTNTn$cbL_)LT$Dt>7=Ub z7XhRhK3}gJC5_8G{pIw^ILVzjqc6r2l*?-K&gOnMB~}>*r{ABjN8a5o96HG*27z3j zjwFQmsnU11m1=2o`NX4g9Ge}U2U-EZ^rIKtulsdO@|o4Ex@1o#focZX;aq#F*q~OW zv*Bn&nz{FwxsJ5Cc~3VDz?5Wh>}HYdrqewDOrvM!y^jad3;7uS`anW1DIh^@puGl2 zG_^rzU>Iolh)wx!bGTfW2K=CiYOrw756I-8P&2Q|Bf8^TT1cVzW3|q06(A z$VoJjeHik^ZLB?3q7WeeI_5)*l21e9`CVTFX(z>tkK;BUa;WFUyDFc({pnh5wGjC=&0@8BQNkYB8J=kY?{4> zNIVJi);YL zYt^_&Iy&zR5mTwQ`$fH4^Er&ipbz}%#lFT6IYCSWTmmAVYO*7FQyDxo_-!07sY>ZW zc#r(B=(W_H>u;{M3$2zfEH8IT<&8p)#PHcos#FFWJl%r24p)`r5$cSP#RH*koe{av z+-hj|Ngd*v9#Uj_2BzuA2~T;vK46I@!2)647WTUQV{d4)NF-X={0p-e z3!u5S&|Q=wLNo}~=~D&i^}Pj{b*74le(lMBU1@jnndLf76BZU$a;@iFV!_Qd!{HD^ z^~Xk{vkrJ3*)(^?Zuj+rklj061%{_+#IPuYhNr&R-h(|~pM6(>9bT$GUl?76S4Sp( zuKr;n+hDg7u?@M%N4wrhWuAadv`|Fv$?fnvx(s0pd=Y*;ht#Gx<4bvg?uGt440xtQ z*g;H-o7D)`*M@A@ah2~<>KwR#_FEcs2Fx)SFSWo#bB+`)#Es-RT93-S<{edh{oFjW z5@h?7^-lF4c31v>DE}sF^@nLB_|DN?KBt=-4S^AvpXwd?4)=@Br1!7WmXsg9Z9JmY zA-Ju=)g^FlzH>_@mr>rg#&-L4Et=wX_V*_}k#rH|-{D$R9oPF~5882S_`M&&!$osq z3`>8(8GN^oxzhi}wm=n!F}9G8;?-vhwXUQ$9IO2fw?X`D`WGzD#q!%-&yLpG{1vt` zB_qVXv71tpxN`PZ?2WMmr(7TE@<17ZQV<9NM$2Pu!?;3;!sm6|5#S%a3f=wZM?nCpdTeYWP! zyt?0bKhoLry-qrG->}V3!ea}F_jmh&Rfnn$z+3F^&$ zTX4)T^mU_98?R^L7&KET?6)%A=diNuHh>)V1_mg!RzY)t`2`YK;x$ z)i#?LALsHOz<|Pvck{v@|RD8Ngg=fyx8*L{oONNiY>n_yKoFtW7g9SCgE2 zv$z;Z0dVbbFlH4tx5Rcvwf^MB>!VtMi{qevy|(;X1gqV}0eZdDY8SdR-p917&uHGz z`)4tS4G`Z!oA)bI73J^9-LDUR6cA3K7Z3+m4d$!U5K&lT(F89R-+uB#)OK~;{TN=c zC9$TU*d0Qw@u!qtG*sedLf3tm7IAfuIoIuejv*S{)a!_oEN_1s?*&h6m3i3tor2mu zt66LuoXlS7DEhT35}#_7uI$O_ht3@6_R+_5%SWRvPN^BDN$TddQzIeSq z|C+@k>y<8oM54~KE=))-I2k>?zCma*QCvoDlu6yJ(B4*9{dSNsq`@mDCNjP=U<5JY ztqN&i6S8}r`$6;dm5;5totEP;7M)_-zpN(yE%$tcaPdI?2q`KciKU-Fm5cba_()Ra zLPJueDBmo*H_C!sinh9B$yU-j1Vgd}nE$J({;AXrYZs^qFZF7t$NqrCZ2oz5{opDK zBnAbLmhI|ielAbm&NS4eSXpsSHN$&QItTB_)vhR4SS$%g^|@qG1q!y&s#V0};NS5$ zt8N?}Y&-(Pze8PKye}E}T4K7bn$QZJ+R~Zi!uT-2l=o`VK-K=596Cg++FHYCI6wB_ zwMMB?P{B9Dp4jf`eacY7fyk-p{c3%AcoMuU;t~bB*FG}Goo2J}=ij-v{|?rOJ`_FA zE&2+!-$)U1rHi5gb=W@q9lo?mRz5&!C0hnf?EERWb<-sD7lGTt|J(9t6c94sfEiV9 zjxY4meBbJ#de+frJP**X?n1a8HP%X`l-ot0@97R51YLtJ)8+m^-+;k6t>wE2DHiU)F&IxYJYI>UD3|y`tx)@PdR|LFxhsYvslZsC@xFD3OTj9} z!R~YX^S_ZyNj)ye(5&k`F1X|ZcByU_l@SCW2g3vrlz|>Y!n35x*>AS4>Sc@piH;ga z0}}^n?2rq&g%aOzfFug9&t|{f-Xs}-C_(1%y0_GHrUx(rvUABzeEsqF@}K_Zee_Vt za$!#9@k0fjw=@ZP867TD>FA>JUL^Bl!_&tw>yB@OH>09OdUvv+bvt`+cC)VV)ly5% zV_vo$VwAIByZw2ig_HNLqa8s2)SfWYw$(wU2u}8b>cOODf=w|z2qj}%+b+yE1C3SF z{1{pd;le_dOAXTTHp6yltO=FzLR}J5*9d3ml(P7?fVoN+RC_0M<-<4@c4+cnS42L@#z}&oWMHNdbKB5< zdnP}tP4O93ZN*uPxIjs>Kqu&GY;Cz+Kq`VdXl(}nnW5LWGC}g`q9Q0OkQh7uY=%qU z9F+x3g7^MBKd~I1A3Wi)%d>G`!+!d_eyT93?<=3C*=$u9CU51js_)!tXMyKjxw{q-v}}^z;|#&Jl_44$Zg@I7~&{5#pSAwfLyq=YX4%;phEg{vuf?lbDw39rng;nOJobhz$^Go> z#Gp}G=a)Z)k6$m9J1FcN-r&1Ae8Ul5-NneD>@z4j?@FyHe7hpO?`gVwE)H_AFT&_VU%$7;6bRpm{!!OrgfCMnu zbq_GnV|10f3o5#7612DHg+xN0GaN!4;F-! zp-1qGrRMXq)lQ2cd}j`k-V2GwC&@>otPz`b9x0%JQvFe&trP79hx&R3z>OnoYcYAI zgHfP=q2YR_gsPIKQ$L+!CFjc2czCs4V$f-q+cyyf34^Gv()jHnV~y?#bVMW@-CUm* z;^!(NGaNiOy_7+^+^y7wNvdaYsB4PALiK5)U(nWIKKw4^MU!E($>!udIh4ZoeuT0b zGzZJ?KV97crwx*32R-?*{M?r4>N;;x7VLm z`z&m6jA5XziZgn#sVH+vie-6vR|21}?!{&=!!Rko4|#P`i?0g^!&7j=pM4+f;-{k2 z^W?3U3cos^Zo3S7-24{A)bJM{RbOziP9gWd)@NJ1-fxHqz-H)CdQ9+oO})9T;p^B} zV4WPSZAQO1p1|u^@=cVJY=y2%=lZBFkiL2&QpQ_+$q79U>( zz>lC6&8zZ3C%(4w);-CR6sA}K-NqQbMg@aW-ltw1;ls5DU2gY{YRS+ zkErQx&QXjVlDJ)ANA-t2Ze!)oq(AoiEA#BsJ%;90*4|wL*=U~C zNdz|-z5ck!V7BT|v0m(PE{fV8HTAFJdRgp|N7}nY=t#6wKB36guBUkhj*{8LLofBv zul#g;X;Vcp@}Fg&ej3Xu={Jj)t<$1}&p2(wW;hup3j~58MI?%frJpLibng?(PG)1! zW@7yofUIa%t-i+KJl4TMT6T+b$^+^;Uq2#n91A+@<1y&w$MsWc3_LInb0wo!O@J(E zXc@kPQ&IMVN}jqTDsJ%%vsP7deSq7g5fu!E05dr>MlIf^v9;=N2)?Y|VR*ZffA{SZ zemR#3^PwgTiO|&>7;IroSkzu1u6ey&`8C}a_hn3hHWe^2i5A4b`+4V@0W7GlguFnF zKi&c%3g<^5fw!ROvuOfomQAVo~IcnKhNPSrVC$Y18 zpeF{p-FfWo0oV~B6nA%~iEF;8-Z>?4Tt#mWb;l6ZxNqChmDX!>9-doXz+CZ%7r|<$ynTOzPs6L0asUzN`5w%h|Ndjt);uu zl5rKLFx4G^8=O&3!bXn@YaqAV$L~OWQ|97xCj*a!6mdiE=wSAO)ts@WA~Sdc!?RV5 zzU+r()CANekJVZa)!C5d-3dMhMrxfY?3PFqlwlHv1zR@s=>cg!s312|@=eD)98UH= zK}Z#G=5<)flo<7AT7MF3JA4jL?O>6%5NF;qoF={&*|QKX>o~L8A2-2DS8MES(pqbH z=Ly5D`=lkIxwq3HoAZY_z9@r(O$)3Y>h2tj#glG7TN>p}y8Po#8=iXZt8_KhXD!Hngr)66Rir&vWCk6lyG>db!G93_P zxV>XG@QQ=FgA#hYjL!G8t(IJ0l~dpnelYwgNCxttb}P!dsSaX0TeQqCR*bhzXCfA`TKnT zVKZ*c8bg2X&c;=-i^tpFVqICE-V#*`oX6izN*vT$Z=kq_?95fF$@4DhJk7u(^Co1> zbOsZ5NJ{OqX)rm&XYZ@Tf0@(Fq~jz)i`6;TZVbV$Wmt2Oqdul?-idI(JF*}^`wbK( z#errS4n8Nxbn0DTVhJM|HEa-Y)#sIvFbfaA9v#=z_J%9N(5y_6o(NA|mHMso^0k#bhZ7_F=H}ld?m09}{qF z`n!2&3kQemw+Hlk`hg_U<*4|9d6kvSY2xzD?YW94f)!<|FPV2|EB%hoTqv*e zO_e3LcVzu+9x4I*Y>#8f`%!9aNW)~D&wXy!M}R(u?Xcd2mfA-+G4@r!J#i7HwOU^3 zQZX=r(^B{fPz^S2Sd89ke3v7_2UH=2wgjK8>`}l2S5GOHab?tX-nC_j52&A=aq5R7 zF0!lVF!Tcy*=tWpXO_=su-gFmRe@swxasK3nPG()cAd!ukD2>Em$iDCh`#pqtf}ta{Ue>D4Kki57>XI%`}}He#{86X zF~!=v+}TzDuzvH7KgGZxr^+6}Gsgj3Uqf4j@cpaCMB6)1)hHr-K$uUw$(=wIpT2djqk-qqj)v z2pGnBtOiszg}v4^;&S_}<8x249=mrE%{ZeV1d(y#JExjy6A8nTHAge+ngygWChRFF zz2BKEmXaaJ<*+Q|1;QBa;=|?kFXeiZxoYxXLoHL~XydgH+xV;`{bep1Aw=SKrnJwE z0BzXjYa_1>#Xs4`0reJ^L|rn9jINL(_LX1(iL!j8xPz}~4_Sd2#0T*5Py-7A1JNrNU-RsCh&dnG?B0wsu6#!;&LJ{O1XLGE&^!?kX0)#JmFvQ;uTnPc0i}5b# z_Z6IM&!~Y$M3(UTd@P5ECbyeI@p|vc=gtFK93jbWuGiTXnoPx#YDb5t!taETJ$@Rt zp+CRXZ;9dVi>Z%0IIwV)qwP&#U^}a;4<4-%019|M-`Hd7c)~q@`HsLS@OU&^H`6dS z?k+cy#w%RgH;LQt>ZQD&EyF|SHTU#(tkybiX2h)dY$S~?Pl=NRk03;%&p$pVZ!4TG z*J>FNJava&vpe?nttWb*KVXD3O}~+GNN^}~r2KoB#gK4=zDbgmciRZnqd=5V6B0&r zOHSHB{luMmr{_;|TW=00k;7|>AxqfY-6{g5D!P{G7u2unNXycV>J_UOviTT&>BoG1 zzL~ocF_oNZuBxdtVY3@WFy{~1pKO#Kw&IP6tvE%Cwx#oPt*RGbqI zv^!7)5pm3eJ9y;fh^P?9-{FPsNW4(^;-2DLyw?)&ra}x>i z_@k<{H>1h2c7SV@&&E>_1R!Hnlgh;Lv%*3Tln>UVRo;$`$>um zfLNV~+;Nz+k|*v5=QSRwE4aGf6qUJeib-*&i$Y_)Di(YK5oHz`3afBvj7C038$?Q^ zNG|1vAtlK%0*Qe^ecHHC>ukL5%(K7SV5HO_PGY?=K6}}>%~t6BfN)s5KSR4fFh1PxB|wM6_k!Wm{-C3DlD;@nGmmk-U&jX@T|1OHfN_^+FYYu-GL=&kn|KBMN+L| zLCP{wYE;(ieo3eWQTc?M8MBV~-37Dut~re2u&7Tc0ZbZ&pX6Q;rS~IOEru?FX8XhG z7EI;|qTy^<^~PdFe-#{3TSlRSODpmNiMEaRbJNf*t@(V%e?-k+ z<>v3-q{cjYDnZ`GF&S?7DVPhx3vm>sm&~3S3za#@ruGC!2HfImI`e+jsW*$=@L7t%eI>?HU%KQsZ zGX_ck?GxuQT2Bt!i~6-+KzsgF3g=##lM^02PoUyf!LJXu^eqp zw2*Y*ySVjw`^!@jR6J5=;n~p3?ao?8>*zjiq@L*g2F-o#9eV+w@?x|3$+DU1`C~9i zKo>2K7&1nKBPu-SOF$HQVmvQ;9<6ZEIp|zesiG=Q?52fW

    _~*b)LQnA*0JdBc=s z=YoalD$TRhmEb}5aeiYfE7zUZci+3i*3Y_*$o^$$f>NweIL>3Lobk-b^?;5GD78ue-` zBM%Bsv(s_cy$z^B71dg@AKiPl>-6CqxIo5ueJ8>h-N8B_g3vnvwS6FqyS+b zM6MomEJ8lJF}m}pBCq&3?y1s^A;~JH+NiWD(z94YX)tc_XX zGL4{--#c-<7+SI@3{&{VMdVF6R{6<3y3@^pmzUlexZVHl1^Bfy#Nb~EVbH!+|Dwl) zMUtLBm_U%y+^ixQC<#lU-}=tmp~bKM`HjzAH|x*;T-9H3a&8{!Z81 zs~1T|cZe9&QdwW#_$-;H&g+tRL}DW$xCFC{M77ZJPSrE07sE(@fg?F7D|>|L&MJvP z=Y!Gq^iF!I#V0`|gg{_G(wU|}w{b54`>jBNA~M)i(i z(<^E7HA~;h(y7pMHeC%Q2=snoZXk_4@KJ$}B(vX}4f}%2+yl5QYo1SGf;?WF*s;;JYlTKO>n(J8N;H<1zKzN%%MK5GD^> z;nKJLw&$-dPJRw+gO1QL;ofxlM=47-QFfEbt(%~e2qdyrKvbCE{;J((b27zi zbl@pO@1w2)MJgEGO@z`9eO-Y>d$_$8xQ$(CKiu4++&9XxHjk7H4FItX|R@VD#kPK3W z>ok-u&t}YRWC&(C*5hY`4UQo3AD+QL^v7cAAcAgit$cew9yBX6Tf``$)0L?89iT}P z3JiR>`w#6)HR;a2y)Y$@pq8~c3M}E%? zEOzwS(5hFBS~Slqpn@M8bq6QeO98=~?c!mvLFZ5Z`;6Y`DOuZ{pf@7EQs5yOwyQDl z^;k57L^Gxwi-izVL?u2}xza1CvCUPbujm+*BT%>hs#WpJ3&5{wc?B4wa+^;UEghv= z$=e+?L1Yu@CwM>xGRsbvaZ|&MTt=lDbe`>UtJk{TWnH)9K7(oQ4~o5dX6%+y`e4ow z^yEe4vFayFT28YY%T@~W?TTG}Eq(A(DxuJ=AwzGtZl9U*;UuKov97RR-&KIA&|zR| zv9q!V+s@~b*Uc|jJnMwKV38OJwW#KX>5?i>bUA$C{ZskEg5P^CcLK~pF@Q!%2^?p?grA52tE-aYWK zF!IBz8t9(ZJ+JqFPe6Ws@lVc2&8XS+^eZ)cG(c^! zAu>=zivl{A(bdMY)$XG;*Vp*US?UV>Wz?sv(5p{%52GSoP85tqV+q+Ke*XA4Hq=~~ zARGmch-k}dSW8f{O&SzSTtDyB+s*F!%>hLS!OL7^C7?Gu3j-nFVDeHT?o0wsV=uVq ze$flH2ieGHxLR7x7m86d5CHU3CE?8OZpu-R^rY86Sq+FjA_bz_rgUAHw1|38!M2$) z0@*lb5vyl~*sw>PFR_zEH0>8co(qmyJA5AmhY*7MY*L)hVL2+f0hWV4hx&|Yv{@a& z1cg!DnPv`}RUs|5`LFZ8DPecAPdq}5-J5gnLR8r(?j*)kAMJ}}9rd@@e*yzT#UhzB zBiQ+H-oq8D*4Hp<)byR|_;}{%)H@B}Q8qApni`&@?`~jTM4#Y~NCWYAIeBM3(-E36v{?fNJ&fYpwM@pe z8k}=-i+gDM_j(X0Rk$PH<@cwlI-G7Un0vIxY#(&a6^6ywiUmQ!Y!uJ-y5_Cl`CgC| z;Xx*W;VfI%y$csD47EVM+HmjX*~C}+c6DC|CbzUl@u&R{Ch)qvVaz6PrKn>qiU04> zb8#L4M9)X9JQH@^3(n3xa|}{KsgV>Fo|JEL^ux<0lOH)5sQlXQznCY#;M!l`drXoG z;%a(?ikIO)8>`_^Sn*H>xkfd(zK^jgEtlSX^=(i&Y^Lh zzNW-wzRMh>aJ@oSthF;u+IVizfqc1LC}8W@3<;AV+#XP1Yriu|27I80jk?3BBRXWi zb?wd7u0>s)#$VOi?T3l_SLw_^v;aR`L2rabSNGvmAGzBHr^wPl{*4`R_Ga_+u5bgM zUq9`^DY6I*q(>Uv1&nRK6?#xfhKp{EKXw&5RtdTMx0N~2r7i;Hjt1zRSqFf8H3DSe zJlE8gXFD333x$PKQNSGMS~;{&IRJ}M)$<{{%O|yb!X^ZH=-ou(enWPD?tYIeFXrt2 z__&uDw-=C{6Cyfnr>owVZrjHw(Lo|im%V(1k^6gOYSV_SG+&5Lm1C*o)^3CA^(rW3h#ecq~CZUCD1vVX^WY@vxa|*mEdXr`{RU;c+cp>#UONCl}SL`n)UTAbm6?t%P%a*{e2P+Z3<)M<|g_sSC|xUg;`NrsVUM4TVAq9XBwnH}ir zasQsMEV|KzvKokW>n499;Qqm{mj=lqTRJaB6k%8H~t}hbnm#5A)RuWyEZCZ$a-?0+tf`WDw zMa0EX6x1X$&k*zy|Cxkc8 zbDFG(2+GK*WSRJn>}wVkI??Uwy|@tMxw^VcB+DD&jWKk+Idvbw%{LzOv-u_<<_fhMQjBbY(=BX!qEHg7 z>)5fqSwT`|-2l!x#a;v;)4_Md zaarSZf1i&5_84T{;Z)XJWN#Wjf;wqv|8fUDh_eRtvf*Th%n8sDC$AT0ryG;cee z-?k^M5kL~%P+NRRiU8PR={(NrOL#|faK7LUNINNr;gwG3(ZCO@drdm#q~k@7eP11U@#m%?_>UOat+HJB9(^-uU%h+*p4niD8TJ%kYU**_m37yFnFitS{VJEQUmnC+h5QeS@Iz6P>+o00x+ z95JkE;@hsg*1C$A5ohV_)R93BogA!}lXrL5`y*0(m;}ApN}r9VSPeS6f$f1=N&M5` z)5A_E!^;vQaQUB74VyZlPCdzZ1jygZ+%(?b-D^EH8gd(2BvUN^pfZQ8nu7{ve*Nf2 zrEkiCU6J_8HumjyyHKr%1`2NLjI&b5{4^S1MqEAA+R1l9uddN4#6IUzvYqy`haRTM z8fwgMJG$_@)&R8Xvg@QaN(wcF*THHF;2(;+DcbVK_rKXjTqX+p`%BKg?^e*K#ZH?5^7}|qF~7TeD`(!YdDRrcohBX>j*#T~ zRt=Z-?UU?e53?S0!nGV1XQUSSMoZ$RmTMPj>^*90TZxth$gNFSmZ=IMp#sou(w`D%5{# zN?nM#s2S9=9IAJ=uhBV!VG3Sn)+!sqpX#;M8An0~t}!JMaBF*E6you&JP;Xr4<}~> z=E__GB1RnE=rD;9J%T`Fs?EA_i-=JMD))92CTtauOMS)2p7YZzS z;^tUpf(SU^gE@=`v^479=IbQ96}T|)!N%eg%alvV>GL?>)E~9o-7k1v2JF ztqEn!_z3^<5~E(6kYlg%u7+DUo7zG(SBj^A{;izdQUhhpZQ%Jw`X;d`AWbS6PDwo8 z>GxD08nb)78h5bD;)RhW{fw>qoulvj%p_lhiI^s6FR&@2jsPD_Sotmeb<>A%G z>)ZAobV`|sT0T?~dJ||KFfBAm$l))f@Jo#M`M>fR2aEGQs8ucqp&|t@TrP&ib8fkf zUa)qGY?kRYyLj||_mfCo36YBSNbJm;Dveii+RVr)x$I0TdvSY4B)}kj$EsLk^Zq;G z%8i7!8X?q!QJn`&XLSC|3C}1+v`>WT?Wzr0c#|t=Vp_X`k&V`aeEZ7H*9%vnliV4R zYXinfvZ3em*GWpjZAD8IHvB!HZ@8?`kq}E|ad+d0O0^Dzi^*^YT@)b>b?(gCC2h8P zm^3mLT9zrot)GK{Jhk2Pd`ZW=K4WI6J(_|0?Pu{vuQ%Gi;Jgpg&K=L+{KCwur|>FR z1*_D!A4A42fzMg&QjU@I77lqxpza_W{+aq!DDG~^bB&VKqtE~tL2yJ?xx=6A{E!|o zmS7fvMLpwuPfPbUJ9*auAzN{cDx?G;)`&X7fk3;gEI>-8ityl6I4#aXJVFM4!|rmy zlF%VAUr<@{wm+x;D#?9MW5eU_Sw5vm)rK_3r62%P}%-avn53|ucMU_(`-8zZeA8hIAbD}@03kp9(!6mQG3lPe(`#D zzTS5;{Ld-A$91S6a9%lmMk7argGPj?SCXSG&Gs|Ykfk|vDwZ2Gme!aBi(Tw^rffv2jnnun*+ zR7r+nr5WF7+r}B_NAcwei3Ji;4GNHO`v=>5uo?Ak#d>5$sOh?@@V_dsmo-6LZBNNjEB9wYs#b!1}xuKoAGg)rEeftFrJ&CKu33ses_#A4dn<+-t3HQj^Y zcdG_#>pR&21PSNQ+dRCbpVQX$B^hA0|Y%7=-HgusMdE75v^{w*V6Shwx_sU zWlI!M($Uu%s)cu|+&PjWU7kK)(nApoWFGdK0Q}-omQkm z1qgKO$vM_Pdjwb{VbH2EDRV(U!~J+hp}IR0P1w-`H5emyQ0K314{++YFD@q;=}d*zvsCon>i+ z&n1>7*D_X?weK?l=YZ0c%D4N~Z}DA)eIrsxEh4@~Z1u6g>iCY@N}>p0*rL0av8nnKLTn^bDkqnRWc* zC+uap?=x`ro-qn~k=h|q?O`_Qw*!ANZm4{f+=>V>NV5tV6H4`Z)A_n74GF&^FqPI| zMFMyhC6q~yWhr5qK~+3Z`2ukr(I^dz>`auuAJ4tx5)4K~JAaZTYS) zo8y+7%cZTI-KB+0p?B;I-`yO`hhP(||D=(JyrdJCl|jMH)BaVM@wVj&}3*GXjBWVn70kg+Ld-$a(Cln4dZ~DOQ2b%44tt3> zR-@k=`i*EC0`#_k9cIFAnOr43%^l6E^dUoq9KG{#>`G!DyI=6H1K4swE~ni^T75~+ zDj=jTwYXSFt5l=;JNtl*-bdn;BvJ>fxTW}&6cI)P43)|c9Nx4%N! zZ(O2y&lNkp;f3P4VaM$Zl9RS&M3 zA?4Sxfy4vr*d~2Zf^bnJrHmM0Wstj~mec_XHgUUC6%vzHbCS4!>!+PRf7GR6gH1Ug z9KN@l?-w$x8@l(_e6OLJcmS)*E=ar|Smv>4?^Mjc{JMUIr-*Jsf!3&+m&jV#{fZ;~ zS2$*0`a3qqCZHI)F3u+OmH(}Unscb|!jELOWA`ASJ-KEy(Yv975hi`{ z77}l*cyP)E+$1S_=|6*R)2)sMKOXKT*BVu8Y>ZTY^$J%3j7@&Wct=s6J`#f(+xmUM8nqNq}&x2<~ z(D!_X%zN<#=$ev`{S2n3HD-uluo*$|!P#-GR!?YiyIdrWDwLVi<-iAZ`$K||oWTtZ z1;6{5u5jQKIa)81dX;Kj;j!!_?nR6jwE12PkQ0<_&a8&$YvXlFzxs7O>HdS8G;0DY z&Wnq$@fd3&6qm^XA&yaHLX5%}rvH7t&&Ft}ve#N%0^`o};V!x$L-NuPK|NT(9u~dr zW`t+aSrL;Jqt=-XymU^mikaxL8@3unao$ zvBQJ=!uT6hpV%ean1(HGU62~Kr4Vs%uh(tVSj~|KC8aW`Fy(#+ZX(foJ3TxkZk#VH zdW~+OJ)LFd{ICzXMk2w%W}b0ILCg{rfF}6;aHZGL8ezf;n{uimfQhhcVUz9@2;hun zAk31AQL67U#oTh$%^2YO8@ZlE726&aEH=2`UOBoR>B(ihCSK!s52OZ#0=!5Dw(y0f zEF<=yPF(MB86!{`rYrgYtymDF(Gi+2Hwb+8ioK5W@C^Vh9DdoIu9h$l^Y_D~%{aKs z0VozfrIL9&@$MLod@J2VQ+=GrUM>K{LV-|n4gHZaox!90x((0R5DrTo;T^Eplhxba zenJ&h7L}r0itIt{GrEG$?Hs`4y$d?X2`0h62s=l`HQE+gCu~C_wDgVahZmC6SZXA0 z0{E0{sNBuSN`osh_6r*+$Hg`;BHd@yM%|$aKhfA!bHY@KJ{6lHvnz4nmPjSB8fkeN z-T@fR^dtqOKyUO10`;?{YZ6Nm@1`)T>*Hbm@3_E-BS^sMBGq5;cAvo+!3y07Jv@?{p(9gF{Uht-KITqO4 zsOq%!GIya?1O*-eOtGxzm0Od;QWoKaxo{{>?9HW+&XW-!*@`r5su(O|d4mlMX4oIHwn?0ogY>ndFI*(i}Jrd`;vIS0A(WIUT3O-;lgqI3#s07 za@bbOq;Vwn6y(w2eB0;jFc`K%ncORXL-pQ^K@w$L-`1bJAto4nM}bWy9Ky3~JLEF# zrCwk4iGiTc6^D|*uK_F?Mz`{=Hf(Wx<`CjoIs;K+f$Y$Y=P{rtjtg-feodAM3W{_8 zlA2B0ZhyD|1b^8*;k@%ZEJ;Z1vp*jwyH;5A&T=)9sW02-!=oL*a#8y8o%A#Nmx@` zzy+fq>a4?;-tQb5C2p=;_Gi$SYcakxz0pm*X3v_HCcMfC)|G}+_~e*_k%gL_k4bGn zEt5mLmNWKEUW$BZ=0Onff`Tf1k*vq~1Ii&DC zT#Rfr{bfA5Q(VilZO~CFli_T%rjo_LB?$-X-Wv&u{41|pade7b3lF5)<~AL=X*9Qb z_6`rNrYQ(gwIp&XTvlgfJ-(GrdoxGpcQg=o4eD!RfKZ&8$WccU=C``?=rJLdcCM`` z1Su7RLWHY5*7(QOTVs#AdXZ{i?c%rw>z;An+Cr+`9CyTGd1)dCk_@4xN{AL%^ub78sr96tL(p_*Zx1p()oyCfoAXRYXw#NjRc@Z9t&v*oX8i zDJ@#5+3n<`J`12>$yf1X)+`fX4WkZH6_A>i@ohJWaVva}0&*uf3EQKWpXARz6=tm^Sc;3fWHY zeEY^=&Yv?C+N#4G6zd2<%ReD_0^yjxW4-luVE*2xhakgIa%Ph?)R~<1#OA| zDL_|BT~wE475J6Tqh`mO70ygBOId9`9(Re1>!yl$(IC=tcV#ZZ>4!*PR8-B#4ODc+ z*qGUl_NsY`1&U%;^9^)5`G_7xT$`XsD=Es-k2qvV0zZNOo)hv*O7yLpiOysfs!LHM^MJc- z)|z-B5hk&e1y#!--mw7NH8H?R2z*$o zsYn|szF-~9!8R-7YHyCXM#G8(B%sfFou9Z* zcVTCL>VCm6C@yO8z&Js6eTH=<@Vv!`4otzyMPL@ljMq}mX$RsM8LUseW+<+UYu$EQ z-LZBMTWPZ6{3a3l6mCr z`VWmfykN%&l6Bqzb+n8F*nuOK?ej^gGLAMm1csRdq3)Q%ZFT(aBzJ9{3R>l;)V=$R^w;5osys6u`BjGNp(Nf9 z8TW^(oRJl%MAJLW7mseQzdKa>Efh7J?$WtfKg4CzM_clw*UB#a|_$FoN5tdBkM=m;&og^=o&$p;6$P~;QJO7&U1Y2%=!Rn7VdA~b(6HpEk2 zJaXTd;~Op06XHdk38bJ#V_`w0O2SCp;f6L9&;5F#Rq-xoVSIlI|Mdsj3xP*)RQQJ5 zRi?y~y(ddG0j#^;_sBJ7es%`Czio-Xweq^1D1PSmtQtk=y*P~jF-_jx$gHWsJjYkCT*A(1rR!TSC> zoHO9x&GvjKr+yE0*2FnsH=nR*hfabnN@o~Ouiunyv3gda`9Xy-Kkf8NI}+2)*%~lg z4;d%_S*PctgkhgAQ?F4uZKQka^Q2^@JZi)Xx5rPCo#hz)+n}X3om|Jy(-}cBWHKpF zRkM}n&xl{}DGaxtUC6>iFNnqo;nTC`uHM|%S?X1nZKqhDYDUzqac&!6*!n`?92JV* zw&vjuxiMS4O#^CM2|#d5DTo$(Ls_O-d z_0y&@fD=dKB{OUxiR#?UBdf;*?1e-xVEUGskTkZgE=xHv-1#(bb` zFL#{}qi}?FMN*9%?|koD*vuwbnWmc0v-ayIBDAqpcWahO3v80Q$urto7XSrF0HEwX z*6OHcm0{wD7%a=feXU|QM}Ql1ru0pY3e%`On>WGhytXE}6~R=;r8H%_rPGr5cJ!<} znYUG9csSB^wb-RG&+x>q`?P;}autnXps|LuKVvLg%VGD$gK)SY6!mb87?BU=`)5~8 znG)S)!=A7tP+0@1b~!P<7(v4*yLs z%uB$-63L$#DKs=vVvxI(jQIIA`Ug@y?G0+{rn?3Mh;e0Wf_)hdWtqi+a@2!@!~4}G@lu*X&d6(_{TsSNr zE5BpA>vq4G9h^0*Cl$I&a5ibsh%k(by_B1bUwQ-oGe1Y64?YI76~Z&xv@)Kg}*=&UmftQ1bIQqQXgvRn#$!> zR&)V~UV)4B$jlH7oGzr!?NUlHOomt6l6qc+P1j&Z*M6D><#EB;-!LlJ)5!9CBpCI>r7(Hx?MTzj@u zeY{WeGj1NcYwM_#!P+WTcs*n`&kw~`kN&& z*|H&8U#_d>?MMgrISgs4{mm~20oFxiWy^DuhLX2er5s3@u+?vnFt0mEU5bO@AMHWo z@_%*EipY8cnoz^@*S#0=odsSRN2~pNyZRnhhwm)RA1iP+j>784z;F07mk0G(;gHUY z<_@*vA{sAPx*se)qG>d(GzMj~k*}s$B7%PQHot7%k8`?^%*^+e|0oFgT&zANERDbJ zf3Wufp4Sd3n^sPy_&3OY;|(+qB*}QSZO{u}|5e%KT|naEzN*-s@tZJ%#jGa`cs=0+ z1jf}q&mR|w97L@$1|S7I$#2c1evwalNZsX$8T1^Yn)Y!4wRRygD1y}AZLx>uiyt(? z9p!zn?aDQsY(KzFxRv)|XBoTX4Hw@~uL%8F1qKK(ahPKZLtBfV#g>Pd!Wf*4 zv98AQNJ+S0DWM!_K^>tplr-y3B_!NkDT?-oe}tf4OPnv>T`-m(PVW0z>O-mL%Ykj0 z7~jNbWIoogto?pthP}&&NNuI+2z{gW7$q&KEHVh%2BK4c2mUmr)oJoKNfA#R?4Y~` z3_yd58>=NgWJq_&%*R@11A{jq_FYIiIx)QNn`m^(uU#s`2kZ~no~#N9>UX(61-hNh z^uEC7Da`HF$!{DB29tRi!jf`K?T5X+$%u$}?G$s7aFLvpjIYk;^-mFD&qq&pCV4cw z$QCBiDl8dKhg&fk;YUdR2Yoc@8SqCfci%-I1zFZ3DGtQAS6>CCu!u5g)-9%TO8&YL zYp60kg*^k(ryHeMP$O(qkH{QZ`<`%HbISCQ+12_G^~f@TMs8mi5*?fC7tf2ffm*G8 zIC(c)+U|v!C45FxbF`YwN_6r$j|U#wvgfHG2#FQY@w?{bqAHGbN47Es;*M=t&E99| zQO^one&xu}#8OL#jq0Uwd5WJWFcs&{utWWSx6cCs3h{fvWg@h;s`H$>S8IP1lK-kG z|7)X*7or&DqJ^azm3Lp=Hou~+QU*U0ndsj|gd8)NB&200pa#LB(1GaeMy1xz{+I$W zsT2qn0BJEin*S?>)oztmY&)l{Y%ZRZ!@XF&+LK6nLnMJ&(EjJimS6l68#G)D7G>(C z@zy+#MgrezQ46sU?5s&FJ}N!LRcbuuPZ5($X!4(B-Y+6Cg5VqD$*GP3a-KsRAD~d_ zHD5z`;ex(f2kMs*tdP&|f%wn&2=zAomTjz}$8r~sDb=~+6~lMBKj)+W`da@bvupEC z5cuhRK1S|rTst0e#Z8aePh`~Y<3j0N-CEpt8lWs&mUus=y~-W3{F&2!-OdfDm~vy! zq}wptB|lytZ9RB|O@GxCTU~+3m1)*R;OQdPY8RoHRS*Q>Ek%zB+aoheBZ)FPva@NY z`(xRE!*dV)aAIFCbhqDM8n0b30W1F1oo8}MXaPPLu!-kX?q|EUj1{-8(-ZHV)`S8* z&dn!}r71F}lE(`j-|VL)XcuhLibT0~*xj$sy{Whch`C8AV0kHku)EKvIAypy!5{a< z(lGnmOz9>90$dO#WPZYUWZ%HNpgFWJPuHx5XEa6Ndk8zn-}PDL%6w))Ae`COs2 zP%o)35u);HV9CHamqi$qTso-S<{7J@O`^}1u|U~V77+U_7W=evZ!EvE>1exF(}V&+2?WHAAEH={CU;+3B|D(HDDTG z3mv8?ghR#E*OFh}*hpC-noK|5|?6s3Uf+x4Ic zQRlS(SS_CX%DqNmKMg@%oQsj!A}Nai`=%!>bMt zg0S9Veg9|!Yi=UuoK?BzKR7;puYF-~D795CBaTV~g7>+d{TM~dyshkt1bQu{N{ME}#jnE^qnVmw>G9j^a|sZo zl6otEHN`k-@QXiVpZ2@%6pQiT2cUeA$j~w#h#R5Ps6S%x^cKweebA{L8`@`mHX?J`2#OQ91(M{uLs*fjB5fr`7|J65=omF_F1BySc#e$ES<@KDi z94;?beEkyf_^sw&fD%K@*ZvrBlANG+`YBL7*%rG7Dm8QAj>6KWFOdmqYL&ky5U9kj zY7`OO$NDw^Cr#UF_ji^-?hBn7$pc>{DRM{R_akyZo4El4=-Ukz3pG*<$S;E<(c%zl z|=dnoN%i9te_3L+7lBk}p; zbMg|rB0rGAQnd5NYOJrEqobbO3Bj*`VqY>7a;_C$sE9#3lG)_CKP8@=t#>#0Y8atN zW0unU4sw<5D{p<0CwJxV2C8iFKs(XEHsZ=b($!)**8r+nhCef9PH4P+A$IF0rXsE% zkMVh2%J}#*(#rp(1OH19{_l-NenH^b(oQ&x2oZ!JV`7DNF+LF+{pd_(((sO$1gEa6 zFn3Xl<_RJ;6N{lBX57o=gzDUikBLCgl%ClW#Byj6N0BH%!f}B0oKOF&%e52;D0Fm$ z?GD0#H6dX$tHNf|R5fXb7y$|0H&tC>R;!y_eNB!fml`|Ra!GtPv)wU~j#QbBcUirM zd6`a`V?K!uZZxUh=!srEgGr;nK4UwI49n`;0Zu-B4>n>FlF2VcREX8m&_oZs3q}fF|l&K}$_g_E8s>%)my* za8w+f!ghrNncz-Z2>l~-QcZ7K6jBZuk4(ixR>x!ze5$xXBOa$}{e!<{A4MTz?;7e& z%4Rm^Q1SFwMaNz02`yC$2J~3C?1IcckmJxovbjqvX7g*SfskOWVZVI7PHT%Pb)cdL z?tza0M%{8@ynKxXXYMSe2g{o^C&EVxlX15HLjnmpJ0hhl)cDjFmE z>GHrCm=pR1o6TY(ytJYo&NlY|3d3=$=CTIBPVtueYd{d0}!6VFsfypF9P^=Sh2 z3l)_4(~cRl!u;>wDp1ofS?bxM$ChNt=ZI5L8T6$ozvG~=;pM}Kcc52><2w}01d)ci z8t6iBOr4~hcI#!KJfn4`Suhq6-|s9X9v*ezcNIfJ3jrlk?PNX z9wt9L5fWq?yO1WL@-TCL$_}7wl#O~GpTZkK@2P4lbGH1QJL3HKQZ!22_xnmuw_0SQ;=y?()&Y`{g=xBuZ_-0pt zun~RNWm{IZ8)L71kWR!139;*`FF;)|>3G$vCcieNk4&J;o)f(-*6bnz-b#Qa$<;E~ zqXa;t(UMAiV@00-VeSKi*oE?sxm}ZWHN=vZ zV2WmHieIw(1Qk+j)cuD&{@V4Q8>BI?e&kaTKmI@VoX5=cqny{~Lj501r2qAwR>0-~ z8~|s{AI$B4YkK}X9YM7Zd)6jIJpNxIrNC721vq2m5)pg<>qlK?1bZ&;<*c;*PlxIs zAC+9f2Px)H@6R9Fqdz|FCV6Zq3`ex^XUKUNWh6@cB%dql=B~t zE_ji29_!&U*Lj=%=L!0c+X9*3J0ZqB+xgEY^^f1_at8xh*R@0+*1s>4|LYL_^DTrp z@SS`y4LtwX%gjaQ;fnM|bp7{r_WwF!z7MyqtbWn|?kI*noLnd~nauy|`26)csVw+T zu;O8-|LaY*%y`+rzJ6=dX037mizcl#27Fh9R;R%aymg>aI?Ij} z6JTcN4s2_qRi>}#MLlMdfiF>Rpt3xML8XLNDe7crQUw5qmTboeCQH9R*k`7z@{hcM z6YvN~!((2X%13h9TEd_I1gS+iaw|RHx~UHBJpA)+?RvOD^s(8|{$i4&6TyN{k*gA# z4FwOW@1XU!>I+YN;F<@@91pHSN7u_EoIKJ)u@E?LiF|5{93sFmEOo5GZ2p*s0q?fSiveQ`M*yU(E}eYk3eSBz<>W~4&P&dxCZv1uO`FVzU;=x z4;Su%AV617a#I0g;9(i&)^u^ogU>32ZikItgiuoQ&umSg1@5eG z(n;h>1x=K~p|~hjbpN=;d>DLnB8Yxn22CyPy=4G%q@$rmXhV$w^}l}YpLd+VEEPJo zb70RO-bevm*mRd=F`~yX#ekKm0^E8ys_;eskPq`A05WH51Et6rA)ndHl)sN8q%9bk zaAF>f`h?8?`WrqnkcW#5ETun#=xPyEA|Bd@E`V~e`gIYBb~_O48Q$OBJ~&+;6ilmw zNeZAm%kUs#q68+2ruCAw4W*k{6#kn<*!W>!Bm~H8*~Se(l+{aobANLjNyy_O5JAjI z-|NLm{hZY>N+g7b98Qq{_T$-SpvUS1Ue1$5nRG6?Bqd4Qu;&x6flcD1gb7f#;vX2Y zpwpLQv()imt|d~@1J;;|S<=hyv#USIe7qe#{JgZU*~yUvpdtMaz>|3BTbl) z%4sM5;N1f=@EB4-h{6wpYf$6wZ*VkUTMdr2TZtri0IvQZ2V@{UTv6Nk@C#f zsdar?NP)gKUNVW*Rq=W)LB|l9&TF^%lkCUy$vZim@8qsWtHh^}xd-$%K;_O|H9=>a zv!CJ0PZqwbD|aM+l@5xl3Qo}J94JfILSKr^EpOg6#$Xei1xrb0ChXD0ijl)1sKPkd z9N4#}#|Dl&GO3glHHcKYu!kSq37$H80m+tND@ZXKpTzf;!T1O5s3gk1{n_!__tN?$ z;xf2$kxYy31twT;6%c~_(^S(yb4P(jrr<{52*6du50|sfQ)U(>fd$3zy2kQ~*z=)f zv7ij**bd$;cfo_zSHO&CRC<*HOF~!)GMwc#=kPe~WZPFlUmgEBT<-IOF?7~@GSx)# zzXr#9Q%LpBSTsQLY-jEX1wM`5$nX|qcmv@ymHZ@~{#xu48p->ZC@LtRIUuKI( zz!^6@$P`pJT~X#UKO>9`RvMeCHqUJuFHFFKnYIelJpr|<%F5Ll>(*%Sp>#mh*=lqo z5v{`2DG4diW%`Lcr@qyw`S4HFkBRrK($)FSjvPEU$A%n*h?rACzY=YX+v#?Gk~_P{ zdXmXk>()DUGTj75&==#oSo9Q>HMf3fm{)z68s+Amy(JTR^8ITtR_B=c@4RT`R5&L;ZT_4E|K1NATLu_X4x4?t3)fM}U#iK6$H~cvW(rTdhd}BFFYdHj^qT3S3)gQN-LCIP%7ulb=jecFYI3~AO`58?A(D_VP`c%e zy-ob!DX)e_Df3w~f|&P99Hx1-qxhaWo6((L!1Q)UF$uH@XfZhlqCtH|yuM;>6|EZI zd!eOy`b$^i9iVnqjkd2Ebl}>emYLmyD}rrm2sgGed;B8@Y;4mogRm%WH7f~2@57Uo zf&8W3^hWdfYV{;O$KGxiHk)mul+@x|#Dm$&Vbjpq2etP`J2?=wPFL(Vo)Uj%kd09E z%n!-l%ma?K)xIPl)Ls5eoHvW((o*T(Easo>QM?qDaUY7Xfln3^3Y32-KT)M>olVxP z>BZG{J6IG{k3I>ii1R(|JvE;+0*dd3sln&3UPHx)`F2LaAu7))XiR$8>7 zh$cdNK^<1{_*|uUx|&L9K(Rs_j%gvg=pD${$VEF`Pe~ih;;FG5TNncee(fP3(rF2Rwk*eYY_w4 zPaQ{|WC;56)w=@;N#xNF5Q6PlG?v}aB-i=LIsR>T_Uz;k5K-pLj;R}bym>t$LVWrA zISATddQ76x1eG%yU$>2TO;UUIpBwSzkBOpkBb-#Rb2p16W^%Z)~u z+q0d?$?R0_zby=GS}_hzUfC?<2fB1nqF2I}9X(@kH4q?_$Wy1I{ zTNi9FHv%vi?aulxemFCE$aMMoLJm62Nk!O7 ztgc_d7yefGiV%**`o7qTy|7gz@_C^F;qO}mNn=OuBav{_8bZM zqi8zmE-n8k1T4m*9)djwOVv(VxFl&2Cmv)xrk|hDHopq>M#Ky?w4&$c0PuN(_swy0 z1+6Vs9p|xAHe4Z|>Yf0)0S&pI{WDIxk0n6*)%B1zj>ozsZ+>m`Ci!$q8*ksk%A@1s z@aj%HLnm+g=+gn9HFET=V+6brp+58>v!*0o1{q+EJANN?` zlw)vP9`@|X71r6|^bnB;pM2}4bWVgDGC<0I#B0SpWa?^#B^Nohm| zt2AoeUS(m;A*2$glV&!`g^`vZ>IW>=PA1SY;Akm=fFPVYp4w6~>ATO28V>l6wt%Z~ zXLSY<)>K3jrEiHsFCMNh5CS9kZSJd6A0^Xr3MnmkYW2O}o+!*cmNWJa0c6m?>lYLV zpHO@Y8S9K$Z#eRbbC;fP`bweM;3ww$V!;9`)NIm2Ed9J2l zSr5$ae{nsZIwbwc1uG6uyWTWR269b?ZY|?j8hlS>;^~>y+}p)8nPFoCQ&FEA*aSnp zhv~mj_edY(?%SGW4i;?YJbTHT+=|mh2UNn2iT3>l^@APff{IA{D7EfYsw291A7sD0 zWr2Y4-0wRd1+WLc7K>zrbX?1mx+<=s{%cM0k9E&1JS>kJRx{R3pY`Ya6%x?E=usw9~AYn-+Kgi8H^&iJ>293iUvRxJ<3*E^vd88t)G+iD|3+s)RsR~$x>qOKu zIEG=;ND9S2GDo9mEfCm8?B1~`@Xd}Re z1ouk7_bQJ(XSz=`aK&p6>6Zd{!OY70I|kLQb>-e6Zu>VEno%22>#;qT0jcEUT0iJx zkDGqA9o4&S;i?xVs5<8#+;WlE_+%L5$lZ&j(~y)uE!FcF4agS0-hd$s4z%apEjwUZ z`FlxkRtDB@KQ}gfx4uJu^_Hp;h=g|UGC7iJPe0bsmmeE2G`ozDM+$+wU3TK@JExbN z5Ih7K-qWf!93KqHyw?^7$-BzFVsyS(c?!7^Rmz3YOZ#mz-R~Bg0~R2K;w;Z6CF_Mv zrwWuVP*ndxcDl=kRj;;UG+w@+b6&uZjJd*8U3d;4E8$`dR=)yN%}77Ey@Or2ebt({ zR+s9B2^+gE!>=^bIjzu*VAJqDkt{p*EMB0@n!;56n#6wlb-v@cL;`aPHSvt17qz0& z2h?0ES=j@MubvjUFCoD%)GGQO=+lK4WM%0f_)R7!M*pM0@%(3Ej7|9%YO!r~M!k-A zC6{F(dD_j%+N*lFIJztdvwW9Vb6u{J#RNq#zTaQcs*>syt7g?A3~8&^d$QWe(P2ZP zHMFf7JIr^O^XiL#BZ{MYG?R0u3%sE7(BhtnkN4EB=@=L~kH0&e{Mm{&GoIjl%Uug~ zF$oT7#-bk9>Dkk0pCG*3hLy)f@E6r7L^nz-CbcJ^fJ`g=w+i*U*@b6fJ!CLz2-qa^ zkWdWKXQ7x%&I?luYu;>rQftjK-CcJ;%X3m7d97+6Uus(<8y?igE0UI=<5bWQ-jT{# zX|&keeizc{2&LBXtR5W~_W2bQ{1WzM@QCnbLj;}g4EjY_?n6zb?N%Cw1@Y=^hdCVo z%}<7JB4N*%fNtKlJBHJqnucTmQ)mC1Y=0L`UlK#^FX|@PqL-k*PQ&fA8#OgxrnePC zrOx>?N5bTC_nunx5(%eEc~J9$QBiND(7F;rvbMpTdafk3L9mAWLTnZg8~kZ*<_5wr z9~mVHEx$J$icwSPHamTQWKRs55bKjYCE}87aM&k5-WZ{KBU5q z5W-&>KUK03B#V2Md+*-;<2Gi8^eyYH7PEb^+-Vm2PIzAgjeE`Rl{GxB>h0C}Is4ZS z%$4zPWnJ2mze_P`KUE@3w!5}o%Wmkl!0qF z*7I-mTmcKflMK#a(493)qL&S6D#a$T*D1}!A(izb4d=;zDLAKV9uxabEetG-ugo_R zftq;C6gHX-i&I(;7AsNJ3^e2`lQFHREbu5Xc0Y~(*Tq3PfxuG$DWM4BFkBCNKK&zZ zM%QkAaLtgS=QDG;L44b|VkShmzs)zJZ1~v)rIA*vr!r1! zPI(fOB}cbt1h9hRWIBVXOYHAMRq!4`I~bqqgBV@Y;NR%)IsKZjJ{Pj>&Omk&0RLf9 z?fYluU$&}Y60f1%v{UiI!GN+9akZ-NlGK1PM{XR#%u@bF)~X1RoSWD_5`c!-XYCOb z`&Z0wT8=DLtOIXS@4+0s!@;)|2g`lsAggmJJ(MV$TGC`B6=TXgo>%067e3${b7&Hn zl3zK{;r+<%-v6^uB1$^+&`=wuq9fF&@}rma5g^mwNcz?%lvGUVJC2C`qMWP@*SF15 zc+Sl+jqJtckpvA<(z_h-VXhwsG2W$qc$1*z$Pq%ITCiwD+^$~khK+^SqP@FoprhEX zFbU$kvqd5&_FCljyF7}MkNK#z(OJmYTt_K$!=2OYH@xD(8sz&=G9g&s36^|)<|1# z1K5{_ivpL+p-B~5QZOAy!T*rAj)-L{Yzz&pZi)=(w@K-a!?25?d*H2b4@pr=UJUj# z$$j}6i~3ql67D5??4F6z4I;%_#?y44!0(bbxF2b77!=2p&?h@5oi8SJO2=@q@`40r ztXRz_UfjB`X?=p(0rl_6DJ6RN#_o;?M4yP0y2F(++jxN0YFwX5vPm$67d$`L(60@Z zobDPEm`UaAPR_NyO{+4wO`lNCqf~uv*tRi#Ui^ z;&Gz(#0Q@m1K^;#t4F?5!|UddU^ZSre@>nDnmbi!IGs0cCrN#vTFgYHdmur4ue8q)CQ1OH~MFRSA=_7+&Dj^@b;fofo*v*Z55ASw`t z>C;&B=obEB536utVdpr#hwXEKp~pC zpf95g4Y(bil+^Z;xqk_FrtmE$hlz&I}KXUcVtLECIQ^U|S=yGw@+4-9^Tuq#H5imv-F zF(&Ext6{@+%N72WDdptr?}oLTPne2`=68P!?sBjr^o0iyT`utvZ^qdsM7`RA3>YFE&JJt+0+{|O&!gtLERPP_t#+$Yq@z>X zX5lsDY1GGvk{i_HwwhHv%;5+QKVD_|`)FE&ID5__YBhJKf=MO0e9rY-nF6^MC4SsJ zm;2P4ul{|+ZH?m4CPeXX^)6ayIlf)w(XW;MH0ungSg^jLx#EdBhT zR86PdR3~x{@+zeC1ztwWgUZ)h<;^$s{>ykL0w2UXL^^6t!rdMknRJ_oV4orc0VreH zi}pha`q~$31H4%@_=6wCYOS<#z!L3#Vcru)SuM?*&>Qm`DQO=r`Xl&X0hy;dH1r75 z4Z?(ViB=kq3WEw&tG_p}JFW;6`s6wK6n~~iqWu!&=VMWbfHZKCu~5&+Y;CnKWfhg8 z84ESFo_Cx-bv1Z9bez6%p&Nn!^s0_@?22UadY*P##5-z$vneOhWB207d){jXo~laP zAAw}5G19!R@A%OZ-dYzrsksZU{$n$qt?^?7Z|~`eA1JglK$oH;h4R|WCh=rB^bBC> z8s}eO$*-SJXnZw$sbDZ|+e-u`kRH>`)eVymr#(1{GJk$@$=(JQ zs5)0YS+bFI5CqaFsYkaK%J`IQ2j3Wwh)_C7r5Mx<>(5JFQeN1J$P@4wW@6NPV80r@nkp-yEdQUudMVCSRb{LoY>oMMzwpT zxLME|eVYhKXPV9|#{oI;ZX~l4Z{SEBB*R^^+!2IZnZ3^&89MZ%^J@yrn|reYFBZfK zHHXn|Q_+m72qIr_k~%~a2)%3NjvL)bZ-gF^5Sg4NkDLCwc%juW)~c9^hkVi~;~&cq zU_!f5kB3>I_FCHC&0})`|0)e{pZ)6q*Y9S+tW3p*FDKbo?B6Mva1ulA7=Jcjx6l=m zxbNDQod1CR1+^hkAmQakp(nZb60f&MWN;*`-x7w)i740^tqgGgSwfTMVHfRvZrOjj z=~Y^Pg@5mv11;6-WIE2cIL{uM%(wrN8@yhrc4GaqS@Vm#(lE8>32&};YXcu|q!8L( zH0#ftL+4Ko(9#*rNa8*3BQYA+#&0F(syD6iyqfq;M@$+=MGikGm|ACB9Vn5TVZTOt zt$&O&yyDE8?_SC&IBJm@ii82@$>$$G1YD66uVDJCE}3T(ptEr!uYT9rHhbQ8Zj(FG z3_FFNGosbZCF9(6sv1P6-Y(7vZwKPso?9EV&eq$i-t;TvD9Bnr#bHz3`SB|L*6R@Y zJ}?8H1AsI0$-QZ>#i=|-THFkjg;AKco;Wiuy`*E`iIiiDn01|;!<9+-Sqr7Ri{#$> zI**9PbD&$*>gJwT>lflS@FDYuO)H2;uc;i`h2Hnw9%tNb`Vm|UTT6d>oM-#iTXbP# z-fWyS(aqqsE2;FYT>hs3hLXC`jl78#vzKy)Ejf6oc&0fpNQS`oANoQkw`;k@u0%5YPiu%RX6I@0^dG=|#?!h1IbJ%PHbG!0^ zbmwlgZWM~9Gm?G71eJT|S}3pGzqI~;C42IJbrq7n1_E@?VKQV@T}R<^}BI0P3? zWnDje%BuAIdR1YBPn~#w-`+|PjhImZT>!>+6iKl-`GQ8u>j^XQQ;?{bYx|TxHpcsI zXVz^;C%<&er}VwzE%8%d2wRJ`-60j<&zLR8t0$)h5r@98Y##zYiSI3B_v$&_!QrW< zys<QQ^Pw^va3{ypy_p~od?d8syUv#vxyUKiGkOod!_$x--WL#xZJ!tApb zLYmO1mtLY-X~?**Up7Eqg5E<)D^ymb^;K!(-4!`A!-vM6j~9W+9Qn=>@*eqJ1b3%j z+I=29ma@JJ9Bp*AKKB#H@%B7I5k}bsmfLE7R4&>gdMA7m3i1UaW+kyx4<+ldyuxC) z>TNj+x4MYf>oYbu&$GSxA0$k3wvkT0HRz)APU^|O zwZP=w$bSEd@zOOI&jS1FF9|{w%|q^cZf=iAdetu``QB*M35?CeYy~^cEkihN-#$T^ z(}a9`D~Grme{LNev-8I~7{n?T$6R_hE-h}OoQ?e&zR=F=U$CD$pPMYHUsq3A9L+9J zq~q}Vt)g(-_)Q^q=&luqUs+_g)!LHerA_9}oLjOnay-2f)_LrPwxJl)l8HY079sLf|SXJA)vw9-0(QQCiUs*FH^OZh~Es^f3JW^R|M4#EX#* zvwdoC#%Hijx|(t!I9`W(u?l4Heo`%E3a*0C%yUv@ucUczmT0gEd^u!^gNUyM)AXos zFll|+k+q@t>hqH{uix6c;JfFBbTBb&LW3e45*O`WC+4I8-`pv=tWfY>rb>NxPOH3u zG_CmeuP~qPo_YTw;{G){oWqFdtxKb0&C#=9Ro|Tp`FZp;LEFi{o%*PQK{SgPmAzHS)QZuiml9XW}5(W zVoyibdde*PVevvTFC&4Vp_?ERE%5gf@O#XpxZK>as47% z$t_VC=!awaKqZs&RAMsfUST-<_LR5EVG9%Q<5dU0bGU1^H(D3LNbL#F6?@9Q&_Z@M zFZAND_QdUkH+#(9%}Z+bT-m^xq#JI2d1H3^*iBHBS*^%<;ka?XMkD{;GwX2Eff>nW zYate2ggRy6v4-2d##Pbl&mms(W5pW1&8ef*mZa7arJ=WAM0o`J&mR}{$ck6Qlo~sa zCi0Uu1i%*SB(St+vCXQ5v?KV`$ncw85%w<$L`o;!j4qcbtj23)tJJv@IzU^nm zv)mi*$RW!j-Do}K$55q=?0_OX5LQPs4Q93<14>%HL8Jt-p!{jGq_p5d*uEc=i!kJDzhCsM+qnfJL2^sTj+*mZcv8k)iL+_ zQg@E(^y9L2qrL7OCMn;wU#?Vk*j{w-Em%u*{jZ?o#|Db#kVJ7!mX;8qUU^UpU)hj4 z_Nn&4PF0AhS&xqOHLMMFmnF}CvHH|K-#o~hKQwv!6%L!8ugoI%*Ss&11^IrE3hESY zT_q~^dAq(U=C5CJy4QG2mIlOF-rk>T&4!>tET6%sD>A@)`P`4R9g7kZtN*aeQtEwZ zYSikHsv3^nL?zk7G9|WHTbq0WP}nNn#vvjFA}R*Ri|4ewEF@&wo+IPt=vaorva?8T z=6q$>)YUIujJ$7RbM02i1I;MlN}Kgv#?8iFm z0_9TlW)>nA=*cmA61Ja-5IJJ@MYCX!Y=>WTI0)zdX*vF*0l&+sBTk&K=$DE%yHAJY z<8H@>?h~{2`u5K8Ei1LCvA0>NW43j}#p;tB*6>$~@=Fa_DA;}2Q`!+z>q0-)M~O53 zw~n&etmxB)eIQ+eGZTx^G90@sHC$y?B%g9N6jRf+b{6y+GF@;oo_kM92P!317-C=C z9H!=#PPbxEl^;Ez+mg?l)SJ-h1EJ$eO1S8f@4*Km*t;ER?cB(%wh(KUI&(n$t+Oa|9?2bIH>mxIMDXCvl;ZJ{B}5e-q?S!{lOXDz{Qy9vV^C-*O18 zw}n^1kfT;)G&7y#5T~e5|>m9F7!t5G$a~F2=Qon&(9}h9d4y4eW+80GA4Xy zE!e*|03j-*#bMAQ4#+yet{cmqdzr@u3eIdBFZO|YxA|j{5&R7@7p0~k z$=n8qAW}9@GFGX2&Bu~>}$J%eD3c=Th-6yfEMRHKz&mT0}kdyA}X$dh5B+U zRmq5^E(Kp?g0_A0@bOp3gS(MAYsz1xniIt=r(1kpn}+(L7mgZT_fVpx@3pe9h{!$YFL2rbTY*DedNvqStD@ zc?QvI``NukdK zvlijCJ@X4joHtx-!hCVP(^aP2aP&>k5VCY5Xu=PVW(mR?w&Uklrn7#Lf;-dN!3ozz znPT_mGN@|}r*e&>Thc}c`l#veyMk5@6cgMc9F8Swh3YI-!Yzu*sjP>=K1J#>*mMQ{ zNQ^($g*`lh43J$nmlSHN8%VXKDaKA%eU8d-8+eEpsHUFOu$i)TSiZe%K-Dqd_Pg;a zKn^OjPxg3KsLJM?^*!ewudJ5dsDF-T>r>p%B12k%u7-^hc%|n3Lj@{WXM%p|{=*dK zzH+dY9}P4ANj3lFm`cQ-vvtam?fdwI^fB4e=sNk}!7cL?*fhxSTdOS$dVYaeqbwd& zjxnKLK{u1_Tgv-EE1A4+Ac|7J4eCr4NpE7)>MJFdbGZzBC@3AkbP?bUpbh8yz(cfCs-PJQ`0%KV!(#)v7XP*p z{`jxo%z3DmUG_{w56>wN{b5zoOX1>2%`F9dtN4?d`S%g&y>QMy28_0^eyE6xWAa&%woZ$-24t*#8?@WK6)qkvF z;Bo6*p%;y|R(QVh@K0C&CMkZ!grxsF(Eo*Nq>8orR8gG%{K_A~EP9B~WieLgE#IU0 z&kgB!oiaaZcC=&u#vjNR?o|(Pc(H9vIa>dH2hvA%<7AI@&F6in{^Rby93lUHocj4K zb&$Hu!X~xw=8qv1*T5gL?n}MH{j-Ak7t|I(Fc82XMRzG7@Moj_ac%tjh85C|2>Zo7 ze5|6+{&%4NkJm_%TdHiu+)*>VY>ZrYQJ!c!)6?wd+V@|&ycX#4*sVkF1^=66eFzg^ z>{kdc5IgZLQ!gly;-H2E9;9u1sLe-y? zR*dVHvZ=0rBHiV?&$^VxYN=jE>DvN_d& zGHzV0kf}djYMTu5OxhR&%*Qc3w`NdYKobguzT$UY?5nOtKqkxj%cAY` zc2L^c#B8T5yPpm@bMgpUr)m3AnPoJglZ~qGC-I?c*#-^T+f>5zPO_s7xt^1GrM(b4 zPa}j{aFNmQ*>O&&Lr}ba*RzmjK>o;?gZ6k&D-U9c6alPyQ-yNktl=?;`8NDc( zmkz;8%we2sJf%!d&I73}r;e-KJ`N`Fgkgd^NB0Fh5(Kpms>iGQi>uipZH*f1-*vW! zPrz`c;3k+JI#lK(U8>Uitf1ihZ2+<0+pxZNOQ(khF=$Dz<3q|!ndPzaEFVy72t5qk zoaH2r0;DJ(_a?0SmmUa3K6np^d-WTg=G0&fCm3_qv(b+OuKiq459$d>=~+CSX3a}$ zDRt-{F(NVF{Hc*A<(+vWTa|8N`>54}wcxayl~+qE^{aX-iF|lj+phlzE%P}w-RoPfpoPpAv;oGDl_TWpHVLrM>Wxw@xu*`ItnXeH4nO zG{ac*_aC(Nerkvy4{Kk0e`}<3_qRibZ~IU*9$|~~*%&#u_bro$dJOi^x3E1MrB5Pb z68b^0I%Wzj*y?qOOsqKv!r&a8o^c~rfmI_I^K2AgS(5j6%fjHmC-S#Db2c7|gS?i&~8}wx|lj4_OdH$+ie;$;iF7 z(6{We6b6TrCAAaX9Ie;YDUz(F*`V(A1(f1V7?2e1woP|pGOHW;QZ>i-gmX2e^2$TM zw>}GabYqW4(GUGz&1Jsu4KGjv1vhhYED3<(LmLfH{Bn?VnFB9<2RPV1$aaJ$)Fqad zDa}gqKz4{WS)s?Ht;cb?-Y^OE9O)T!!Q((9^`-~QITqF+yjiX5h8Uk{Fz0k%(`h}< zNzkhSp#n))X@S8Z-1q+9G}uMOPc!79YdB%o*V4W^5BfS7zj#f@%OE@1s7FsFHTThH zWio#@xxwJ^&61HGTx-;3?eQYcZELxL8l=5Oza7-HIoxAS3f-$Dhu#11l=8X~4XO;m zoP?~aOeo%8gdlKDx++zR)O*?K%K7p$XfO8*@9VfcL1tVgi2!5|kPwChQ1F<2DIz}& z!kHpq@Qfv<UkSn3D>xwV(LHo-+pE4P*HOxg5!uM!$&jr;x_LY{qVf$z zib+&#Tj##W=+av|8?f2PaH|W+fd!0>(TfFJIGQXez$>M>}iJ3mxZo6zN4BKUZG3mt`SqE6V^gExZkVMa= zvCJa07Xxm$P6+u>6&!3z3;3@4>`xNTGLetlPOnW(oq^|}ccmAzX$h@jHR?}}@ro7J z5jCiq$qAu-#LDP$_gbTSxjv1LOV#ysB?vRcZqgV?=CQ2?P~gBLl4KkbR)XII4~JCT zMiR}BOm~~=mls5icA+^Bn=5Qg| zeifXE;WeqeF8MU>@Nzp3Q}w53&X6xW5r3%KYE@%3%<45C=d0Cg%agbBr2)o^xl!o* zoLXi!laOPhS>iiRm2kXJd(7`bVlSI!gGcA0s9Kwyc*|?I0x=;(Z7ACFtBU*YiRn2 z0SLq1;__MC;UmX#C|h#> zb}?bJ37cr9>f;+U$}>&DWzsR^90c-Bo9!klv-MPC=^jSKB$9PBry*>)jn+{XwA+IIRe9cyHRRrc-@?A9Hv(5nJZLus_e za4GecMwe;zpz{<0g$i_o9*mn`8uwobKge_iqz`xR;~(B)A0Q>6!tC)TNV0q+zy9U- z^xu*nQ|Gqza$bzGnRf7MoQ;?)an6&6=dO7dGJ^N{O$RgCWak(N zud?r)Ev3`>YTh}+xK~K%_Q@-f88r^gxm5Ao+W0iga4!0Lh^I%ZspSn`u-6^WwOOOz zve0W^18zkgquGjLYA5zA6YWV(q%6yk+8y!1L)t!e7_P#yGo4u{M_sBSA%06Nl-Ct1 zTNv&}rX8e)FR8gGZYug%D{ODOoJ|gGN7T(lhoZXJq>kdgM;V&;j#iWc3HwAutUgDo zw}0TzZ=Oi7q5iOJ|Faxqn{K~6+mrEXVR@$N_lpMr6 zlC$8kgqVKA2}-J$FRvVd1b zm-S~ux$F^ed7#Qi-qHJ-t2j4n;aj!&wU4*< zqT{uztu(Vka7Z@ENaj9{<|S!Zm3wH`S-iR%5$;z3=|vuxd11qOz1I`P*f^g)_!Lf^ zwPRDQ8};%uWvzPtdmw4N`U!;!2bsPO{VdjVTC*RPJ{FGEI?`jPOi1>*w{C3>%T6oX z+DK+YePdzEI=b%UN3omqt&2%NfR>wa43ztdy*Y-jDv(XOR9kgDuv4t$fGHD~z zr5j^xhK=od!3hJ-fUWuy42k-(T12o(ORVpUb*<`m;2jBus0$vA8N>K@X9nsR37&-= zV|RrOGHKavG^?wYKfi`jQGRBEIoJ$r=e`&OH%-vRoLSm@BRdu^SfXBS5oIOgWx~u2 z7fJJN8DN2)pkaaWF_d~9hTi38$#C-`M2N#!O(Eg zbv%I9bJ^FI^0&VQ?u<`iu@cz>a_k0pqXW*Ps17wag39e zvgngpf6Vai^@|ec;MR(0UH7TsyaVNtJUg@XRp3~f zhYD093Wfqc<_VIr{S(0YAwvMgVm`Tgd3 z7b}U5ASgHPxk$8I8;$G^qU)2co*=={@-X|ThEs84j8;YjUJU1+o%}Gy0F&megkm9H zi>dCJY67Ss{v;C4aGiz{PV|25puEuVTH^_HP$-}IprR+ITbaKUuwY19HdxgSX#>Vb zqDFg|%U%ba)LBYgefFlW{$fJ%EwA-GNDuGwKVfkP?YWezf=Vr)uNcM@TD;q}E^B6= z$ga{cPjxk`>NyQuP`rk_#WpL~v0ndZyKp2!lY4Th;aNWA%XOuhT#}Y@c-|z{Y_4y5 z(|bg6ZF_sux7_Vf24vt-r^>Dr%rSa2XnxF%PBBU3HuA@#09~3deq7>JkCW+YgzC&3hAUNu#23?$geZ1?G}X zg1@^J)9nZrudH40*EmELmDxa*NyQ2ZW;!&Qxr?qC+kvW0iO?4K$-8qbct)f3u2`gm zit?c#4^$fe;JJ^BZ3Sz0h20c?@`KG!OR-XWNK>ja!oyO=wJvN9L&Ol_&NZ0d>(lID z)?m?`^@o{@-eRLkJjQVT(JLP%c;F|qgO=%K<(BLZqMMHM*wd>N?z$uV+rHLr@g^%j z6vBMYVu_rnT)gbozMO|fP;2Nr+o~>}NsupEK?HNDTFIsZR-S1$V82dIcL=`b86GiB zAleS7XXB26qhaHulU9qd{l;tU}DLd%W|D*Jqs0mGkPq zt&nzoSY-3#6>kEzl7k*xX7+{yGJ&J~ESq$nhNSj;FoU^%krOdh{bpt{=~9)WG@IG> z@KA_Pirdk(k@Z-WVn9^`wV}w#g}`>-DO!~#+-_b{agxB3{=M=8v4FTW1^gP{7OMbe z3m~5W1L3W+f$IC%d{i>rU2=w|SqWqbfBf5g<=f@Li z{!0+vfUBU!nvzn-O5%ltcLgZ%H!qXbs<)9P2(Za?6GWL5<$n`Ic+iUUhfoBcU082g zSrePpxa4Z=_1pj?qgIf0iAEPxueu`-d~DIDVe2q%#gxssdl{WH)e}DqA@mdMYha1qfmZ4v0>H1Oru7?9QNkr3XnckFDEQvzS<52c0i`zY4$Gu#lFV zH;mR6bb}!&!l=&r!W}zMxm60CIeN_vZi_VTW4Mdy_EuvG>{R;V#+I1nNM3F4uR9>( zhUQX2GDhpTO*e;5dCbynq|rB}zteb|}J28~oUJr|M& zg#HO~=>RFV4Or}gVcE)EuzoxkEgu?FgjJG$&e08MnYS8WuK8++3 zq4HWz5U3rXpHD8f-?uHBArx#FspdN%D44j3^4ab! zwCH&Sz>_4ZEg4pzkt;#J9?-|8rdpDSI`>i)1KlHIH|CO&LbYkFfD5}m{qg*+NCpiy zN6#3-*LU5|wfWY2lyk#dGO8`g`F7QV1ys(0Su^ALT_B=P_@K$h_)kZAwtz&@PJlH2p}LPmbfsmcTKk%CZ)lEdFDXZ^#I~2ad=P z+_gW6yTslRC5es>&p!>o{Elr?$b#>K>-7ds{Lj_?4?qM4dX{Z+%jzGYq5rz*qPQUb zqufTzTpRG;i~sn<2m+QY<1eXBeGB;Xif!ldqg3DGb)kOsv`(PlqNy+J~;>y-XI_T#gyL6;FHo9Jm`-WI8_ipc>EH;{!Q>DxPLL} z{0Cr z)G8!kEUxG_58a5Bb9-2Jfu{pk@%B~c6gRmdP5kUw)U5@ZU#N)}d$lq2-f4+}EIy`oFo5CZ+=xq?KknXY9VqotNK18It5>fy>xDOnmY$YM=WEdj|YGk&qWJ I6*KVvANMC_b^rhX literal 0 HcmV?d00001 diff --git a/docs/assets/app-registration-assignment-required.png b/docs/assets/app-registration-assignment-required.png new file mode 100644 index 0000000000000000000000000000000000000000..0841f793a4b97f011682f95af4b621712453219e GIT binary patch literal 291850 zcma%i1yEhfvNjsrVPnDFA-G!zZX0)Z*tlCDNN|F?ySq#9;BLX)-Tfz5-n;*+bE@vz zvue$r>2Iuh^>p|23Q>>~M}o(L2Ll5`l9c!i1OtQl2?hp@1N-5vfpoOTY zf~2S@v4VrGsfD!(7??yzyc&$U(jXv1D<(P`mDq_Un^X9+6c`Oj9oSTuJ{dW<2pkKl z^0A3xSA7_?^?u2BLzrHFQWrp9kau-fPFWaq>m?<$(~4S$YlrRW%bB3rtK;r+vk6#M z=DH+#a}gz&`=*G6wmGq*lN4?23=*mk44V*i1D}sy009ODTozK=8|VxqWNWULzODIo z{8m{&feJVW7cwN4!^S+nA{KxJ(;ZBdKmaEmavzoqMCT4d+Lti!M`eoMlA)-G+j62< zEj^d~z9qB_@f9zAAl4Kj%O3Y~gw%&}W@0~ZL5vdizm>zdPoVs(5(> zQ3oKfXp`(4E0S=68$y1^hDGq-QV~ead$2E2H`fV@>ruVfa|4QLyO%xHq^3h4T#e z0~Hf75<&SIUKnk=6S-z67vq=0HGt;J_E##@JwMoJgi4c8#mz2r$#oXv&u`zyzD1y1 zjRwlDzMVaQ-}3eZ$>fFpK>BPv1;ZE8)k|!M!xCT~g}>p`ghB`x1zy#>Nxy8RPq_91 zCl7lP5FBt6AlF?Em%}}kS@RK^C)?+H3E)6*4x-U7<H9jCI7G4>~^IVzaw6Cc9jjjRoUBGSs6s2j!I6ajVHG5zuJ z3vNMWJ+N^!K~F=3D#!(mV{#Wl-q2Y{%DDh`{qhACZbEIHD6CQ|V$C$t%#TH6kK%29 zymXbue$o-rjl2@AMN?IhSfox^5lXcYSHdADXM1NDp;vFkj*it{ z+7A5hx<{^{QzEc?j+?tXqKC0SPVlO641w3+PDdB|`vV1-^<{$&8O^+Hy9Yn8HFT%@ zJX{DReYoRwFKs`Vb8v8CoPclU(O|%zZb{w%?L8nfoD5{GFdQ|cbQf(EvNe>}Pvk26 zW0;$DYA(33uVL$-nvhR_&Q3$?e$_ok_WFVv5HNxI!SH($$=r9c&Cn`TL2{gs&zsSh zDbTYCJgN^12@vK0jf>bbFq6KFBsk6#&xv|7&oTZ z2q7{YjE``uP>cp_B(cmP3L?~0)?^<^(}Ko<*c${tBxcBdqw{anCW(wt%26`%tN2joMHrG9KaWcy~_xlQJGN{hR+NtvSl3N<=Qrd zzwPVkEahhfV%Z1hjBOp*G=wrlbVXLBK;(L)u0I5o>Zltq^`syuQa`2E1OcVFWt*kl zb1N!9*{Au0rHsJL{Ejc)m5J)U3xPd}LP~-c{#%N}ti)+lS7=M9E*^Q2<`BSU@Km zmFkkpGV(m~*_3WHWh8^uIoaBj(GjUOaM226O=!x=U3*+&@WnSd#s zU=p+=HEcSpOUGKOs5)I{Sq9RIE!UXSm@6$G*X(Spu9s{`wpFsd8kzf%TR%vWb=9*i*? za-zJgymkFkW1M@+J<_rLYS=)v2N=wN@8Yt+iS3%GomkH38f1lnLL^}3wsk&Vfn4D= z4?k~3W=ayl?>Gki;VaT0(t^f zL@TtTH0&`rJq!$4y9y3ol zUy#FT248(!U0aW#jeTSj#TuKhgHLO(B9QbTZJ*zMwpZ68z)1@n$XtaH&6Ik~~k5jOCtOl%yj?)%9$L*7Ay~dWB2OaVEl1Eb6&nB6&J7?m|<0PbccArMp zn!xmkH76SEdb{fpI^*G`nBtn_;uF0!di9((<~KSk9_oGV`!^dX2&FmbDHySs+N(!= z7bABxhr<#DHCZghR-|@^rs8eYWYwKJmdm}iEQc%?569SlSmDiSmg}_K4!4v!&(lHB z-74d$F_w9C>Q=oD1${-T$Cu?uuz9YNtUK7)h(*xfj_)z%ZLJJIfp4%2+IHWz4?P+JD;8#%t~>TCQ}m%kSYibnD+<(>{Ke zf6`hlXy|(dKIixQ+Z+rX3JY@l9Er2ip~q3}Aum19;?5eRf`!ROTb@ar~rSDY^L zfKbaJ&B1H+;-jP%FF5NQ#MCbLyL4qA|9is4#=8l(dRkzEk0K5TSZ25f4j?t z$IQ(weh4SXCH!Q+ji%}0SoO4AtuYMb+rfIoxB)ugANAb1i#StzF?buukc%2KLh&c8 z6A1Tp+e3Ss3>$!s>U0|Q6!8SU&Kz6Zu+E!_w~Dqf2@+kk9R+Up?PbIW*1wi{S=?Q& z>w){$-$tIEcu;uHzIjaI_i!$)wY1xuh8?uNF`ljL-Q^P@3LfA8dUU&0x-2Zrr1B>5 z*0`E|wc2X@ZtMDV_4q`=M@!u_ zG8yd%zHxLilLMs-iGfTjm9*l(z480AE$FNr)f1#A-Hr|1(+xurhQssgB z!TMT~!}x>fs$iy{_AJt~*DH2#u9xnre$L&yMUh~lE@>(&3r72%hXsQMM+bv^&w;=H zz`*gqp#PBv1Cs*B|DQY%ocdoh5MW@z7GO~SqS1VR{<)&x?|1aSo{%v?U@-6h(BJQX zEQo(o!~D#G{C6H2=e-V0SV>e;^8Kk~Q3siGCW4MHjDv*+5zKp<9W~8m^c{_yV+QS9C_UMN&i8? z^Pc}x%tT834-zLUeo}Q=1!7TK2NPlrMrKB4QUQ2kVq!iAV^bdB=P&<)zyISWHFt8d z<6&ZQb#-NQWo5K=Fk@oj=H_N%{>1d@6T>?NgQGjh$-s>P$7$kb@xMKR9RD?~_X#rnsbOMaWM=v+n3IL+-@yLV z{1f(%dHu6HzCVres5qK9h}zoNn1GxF{&&Us{?XI_SNXr={3lSs!p+25{jScaYWxS3mHGdJ{zuh+K>tjF2WaAGYwi4J5mi7IP6D6!nEtBx|Dx3Y z7bd{M#>T|*FW7&U|6h#8-(dc;{QqL)9W370(csVU1peK}f0q4=o{#Ad1N;X={FB@M zQTonq0`PoH|HHZh@YvuSL||Y-V3MDOmEFLP)1lk2`mhJ0{GD8{2v>4&aD1Va6%;VB z$T5YLrG|b&i9us32<3nNEC&3+Y>o+q51r4Oj}Hg;cC|FH%;|b|+U~i9^*pwBwa{Lx z^t7_5KbGdm_#hvmAn_IIzfHsu7)@*ucbO|x;ONBvZ3+X!TK@=3E(GykCTu8h+Mi6{ zhkwQX*Il4zL8KY|_tRMSCl-RfhqlLcNB=L!^iHPy)e$io4DP>7+Ne-ddZ=by|C|H9 z-?Z6V?6ld~AVs1!X)>!_c@&a-$@9Zy9z%`&9h`-etU&YKZ?D1C0mr@9*x15xjT6(s zq_N7EFlRnLn5H~=*J5J{-w+~<*Y_p)9tn0>k2xCH&b%8;Rch22mEBiW9Kswrw&GcEyEJJ5b3N?1 zP5db6tZJDsOmbFFv&Ab)efsEAt@0{xU+L6Zo1{#e(C13eeoC+Dt^Q?Xk%nE$B(VZ1 zw4k4{Mjo34yzz;yK8vdq&}qHsDTPcVNJepG7Q?sL?fIs^F;Q|dK%sX#oF|cim?3}E z`S#hR#I;NA#)~G6_Z#L|yfB05l{VjDc&o}%D{^|mr5LMp!ElTj_)3@W*slV9DhjoP zYaprKm-_u*PjEzUcWKtZumR!=XjW+e<71cyVim++v9n*DJaJnx{g&60{1Rp6Tb=xr zo<|71+s$P(2D>lOy&B$)p26(IL1fNl7VuFKNCoa~BYJaMAjO^kCYmo|vSkkgp>WyG zX%y_7mssObuEpT`%kx(@9wju19Wv{_)L0Rmm(moTC-sSsu4^w(;HSV(gGP-24*B3G zMyRa1_LJGpvZJWGnefCCsmPI6)s@?vT?uYMFE5Sd{#d3S=nkVj7A=O=hsQg}ISrJg z4q1U?1pyTdH}_3|bO?-zb~V+1}U zr!uwAczT(7Ge)y23a{UqTa8b~wmSHzJw+crPSx5=s#VhCyQD{}39iwWx_-o_UX!)( z((!TMyd{lMVff$}vo`=jufvxq88C@Ovl-?w^+SKS8E^cBViozTI@ZkFJ?s8VyR&Gy ztiwIsxaP4_LGZ>mN8jIdB4@r7hWa9^C=lAa&^k7d4rQ2Tr@BARYREWo?~H+@@5+=d z*8AyvgvDW%G5NYj_h@mKH_Ih-caWNCRZTGQF@oROf4^CiTIjHMBg<%kifmh{GQ$P-V5mKlT|%?|ylyjzgL(`?Mk z7;Z8i8n~l2KoWWj{j9t);bT?VY`R=gbPe$=ka^F<<1XiS!3-xfaj?f2#a*C;&5Pve z70MhT=HSYJHKKw~E+PPMqlTc{5~+Kp34JOW#~HuYa-1fJB9)qL1wCZi>UF!N>#n~} zt5JPIbkuy})V7gIr+sGcmJ5438fsK!?27I+-r(h0uWt}l{QO1N&A|O|3(3EOcQAvj zP_!Y;HM)~Wuk5NV_s*eI_haKQ(@~UEt`D7YzGj^fHucyUeiiV`*vf&M94~TO3^LjL zV3U~VvDicE-z+p91e(@YJ+=Vg`DZ%iBI;@5(0nN0+Xrl59u>+w?Ka-stP{$|urZr8 z-=UO=9`YSlq%i4X|71f&o02lfQyMCM4aL`m>!{~S!$`2wEak-mggm9qN=cmcV?~9qkxN zZ#ssx$EfR!HkGWIK!_)H6Oz?Nu{OQddwYpy)ZkvMU*r)LgJvg7Z+^VaRPNUInu}%2 zQKE;s8CogDu41}74c>E8ke`fq*Hn1`AJ$trb!TluLD(CrJk$uzR9zn8t$oj#TCdgW zhAhUVzXP``@Z9r+#t;*_U)phfhd0^b=ChCXkuGl#RJK3$P&^9UEUy%FB$K!nq4MlA zJ-VzfSPYXs$3nN38&z!%xPEINpA&u+{p-CNo9lgNR(gOA+Qe5~zn6xiaMQ~78jcqD zo;i$jDJr8u-N^*-(~^BwjL8(TG&nOEF`B|>Or=?c`}r+E)l{hY>mGa@mDQU7$xbMF z|IMu~nIjKcQ;E}|U8U!GQmsniqM6%ob91G+CHm$>_a^UE}8x!2-y!9n*^-QQA$ ztK8#jDk7()$wi;Xa?+xN76}SFG=3v$8L68v~soWvE=bxf&`ER|Z=sA<~?zh5c&9BpyOCOdTuRh9VPge={q)Ze`5RUv^E)@SiU~n2yF}C7re_jm->S{zPtATJ3wk7Ifm|MR++gZW6hH$Ek&`>FRb**s{#uCjFR+q_w$`hn5 z6Gll6kg)xqqB2wmqK2Y|Mu{mKC;Cr@;)%7%VKCHFUm7-w=#@?p?uy|A)vc6)jG+eH zhK&+%s`6X|z-~*rv{#bK7d-tKhrpD&C-)V!oy*IBIA8)Jdt4uJnY)ZeVWbVPg3A7- zj(*8uq^6+D)?4<5r5)*xXW&X7W#Jk)5=cqAOJaS_OPh{gMMnmgNQlOReuLw(eQy}1)HG!~hlfOU>GS8&ke=eY~ zouKsV1qywdK1JZ5bW_VnE~PUaomI(@WmzBg$T8R4b<>+t{9@Bn0K1}&aKsV*&|Y-e z9+h1LCEwYm?xXZv;HdNY<^ZnT5$lKdRM zJ{i2Ui9Jzkk-PdE$_e)TIK7q;Y0)vfc-gpFF|)-VS8s}5Eyy5BEb>Gd7YGpi=|~01 zsESCz-9gjsK9*bvIBnHQMCxOjdfk5%wIORB5S?u{zcDbmNkb*VTcy+YE2oIDh0@_z z;84C#_Bvegw?+3{wru)5?-1r;#x*D#?;y2C11D};G65}HF?==*DA8$~u2TmMV1#K( zSuDFo+hI<+31kyRPaU?>Hilh3_rr6W6aW{4~&19F2VK;A{_cQq|cbW9|!LW2h(`BOmhU$!V z7iYkEdpZ5`rKD#rU_8!@R(e{vv@C>HXHrf27GW9M=T@0QI+??8OimcL6*042DX3UI zJ3l^VS`yXjI$l!iS=)L1i7vY{sfci)q^^`bSjl@Mk76Lend_x`kG-<%m{29ZZ+$l5 zlltD1>PdJ?=Wu8xEFBTSxZQIOe*&rIUXM!y9_0Nuee|=v4mI_s$4rTeZ;PFk8I`1W zZOz@b5NdQkGl?1p@p$J;pfUbvm?@>zc?@9_uZ=@5lu)7PcX46z)6NuA*d_Mgxss#p zb!eq3#~ai`iRgr1l%zFYvceaUwF6Ti#CBteY^yePQVwE$<*Jk)v%I;BD=@1Igqmk8 zW-(0-?kn1ulV? z!7sxvZ5k+#;C_K*%Qqrfd|oR2bT=$?llNv-p+w7yee;3Rh79d9t!{S)Z)UOXMEcdU z69YqSFW&x$)sL^Rdn<+Gknn3%?+3qqU*;?pECErgz=hBdYr?QTAE2*Nz*XAx z-Zw|&JN#j~PKn3dCoD_+1Af9XU9TvgtPCwwuTG!e6c_0jgPbB&4c*)YSS2oEtR2F2 z+BRDIMbp_c3`LvTTOBLqt5+Mpe6a2`rP1nP$K#AF4KfnmU%2~*$ z*;4ZlV-Ff?Af&3I+xj-^c*raq|3;_uBJ^;r&;J<^1FyQMP$Qg$=?A<($p74H%mpQ7 zB@<)hfaV~ikUT89Zph&LgC6w*C zS;O(L%>#e>x}W&rG~%;&SWwyX;W|F!m?0buEd^r@fQ)zobF5OZG#;#`b zyOsSbIw|{#@}|kkA16Zxhc6AVoL}M2UKykZZ-(Mq0ZqWOyfVt_Xz+0u>i(>z2vvRe z3T$y9$%Vq^!@CDDwjz90P^XQ=cSp+x=$+N!2Jvj&aN0~KGDaHfKLQ-8>sX$IBVrOXOE;d-&!)&77cqz`Dvhs!YS~hG-cQMb5<&i(69i? z8^8UqF^6`$OY)9mD|pi`vWNF==rhFBCH#+|Y%vPhNy-fE--NUDgX;N~BgM(8Py?MC z08g!82Uqb_NPLyY{;p3Lv~pEGs_R?;nVZavb(O6b?pEV-vix#Gqj9a?NR{z*KRt@H zo?a@t$L5fR`Lk=@gf*g#wx)Eclg4IVJ-+1Y;A1j7A9^+LMf_Xg*`?>oEu9%MQtz^@_cSz_Rpl!H@-hoPC}r_-%tAolAm+<*~+mZqDPW} zngJ_JFH6gZu5eSgxC#6B5w2uVYb5VfXF*HK_Y}SSC zP+NN$r5JqKZVcmIf2Z)FejhBO#nfPmT*JIZ!8igzKri~o!-4V*7U2@}3oh|@^w~c^ zCnfkyqf_?W*g7s<2SEtza898;-S<6(rfSePmTEpkKz_GQW8oK5r~7z=lG$X@ucwi3lC;-k_4woljb_J2u<9zqyz@!sJ^`1(DU-c?RzVkM{9R_iA7LJ&q_Ha=>i#XOX}fK>U?3$0GS=mvF2pW zvf1+zCZ8OZZ;?3&&p}opX0#+V%*`t!5nrkQ-L9{ls?gt2gq38vdj} z?$t?H7R9rh&S%W6+m@5gY8 zpdeTjzltM3NO3cKS306p_}Y~MfEbqIv^dn~w$2pl4QSD^jFU?{@6xYfE~dz*Dr2f1pTVcHrWKDcZdPe_nKk@0XVKMA-G*#)L`iG= zt$tBh!Zrx4^!EZ`J{`vQn2psn5cCJP8qcG}D3&_eZ)E&_;-f1hvZwqhW-7#47 zeYs^^Mtj1_ zyNdSUJha6L_nqyREKXtyh&5GzCvthCv@3 z_Sz&oeI;>~Cev|FxT6(h!cCR(H!)KB%|@Cr4|J_WZkw^^qh8oXJC=%_4?XN{a;%MR zAUS3GA(GU)4EQSQ&mPR!rEX*XmCX~77xC3quoZhOgztKa^r;epfF^aIXoweF^`4@w z!{F5DK-nJe?^Yd+so$9wO^F8SPb;CK3CCa~jC2QnhuDEE^$dB`LYj`OKMC?B*^e?-XlBHd%`}zhvowinJ zyI5VIXJFZ_>D|?L(&u9V0(a zpB=HFt;An%raq15W?!81asqNAMv(_?UTb5;BDGrRTJm6yzrCPFq&tm2w$1( z>fu+WwB4Zol)EF1p84ohuBNc`pRC=UyBNZ+CfaT-0fj3IClgtCVGjiiQdwXI;(_v5_k2z$UmY8T|CFrXSNhQW`X@Zi&);MqUM)1zWJ37>G z`Cxti@C+bOpXhA%aH>|*ZP2iEZ%MEa+;vUp#Y=$$-E&o_5!_v-KBAwrO}TMjZ((6I zZV-YK^_u6qiJhukkB78Hbj`XT0_S+?-WewStbjOb21Y;Y&!7oA=S=;0)9ZcU|BCUu zYsg^JV`6>@+Wvd2l1$?jXfC)#a5sloX)!O#$cho{({y#z-p^AgaY&!wRiCCfr&qgg zSX%fnl%+Tu_upnWS%)qKlYlFgIXKS~b8AKLEDp}k%C(l%By}>+2DUZSKaE%fL{=bm zGsFsJi%j)F_7N`7NPE~n)?M2)(>7JI&OI)-B06wRb%(`Lnf@tPQMGUq zO44UHDVo0Z6N&V%SHAm?retYGmOC_Z_+338w(kq78bj75+m>QO^@{4H-ZuILn5vrw zMxnJ8bYCkC4c)+2B3Fa1BEEjwo6p_f1lMZZy1nzopRII}Dn8tOhFMc_>ksk>+7DC) zA@EgE=lA@&>4271FPb^)y8miN4ofnXXrEg4Q9;5Ax~X_%?!}>`pU>1o z(0-_N`kekJFFNA{iTd&ec@^SWL5BD63@IZl-~d@MJ7IIov(14vciQgc1O6J({jP^n zb+;iC{9lJdXdgp~Sb@j>h;Gn^o!dURVg&r4N&@n$6KoK&Qq^VSAejCrIpT?OS{&wsW!s_PMj@x}n@IuJ;`x%#vB zk{Ju;Dpe5qS7ADxIzXKggSyJ8%|a(?dT#h$toi*o;z|~0i<8pCKqKt3>RfCo;<5Z^ z_V>Q1?Dw#XnBghtPGn8{uSa;rm-r_ceCb6Kc89@QzwNNpmXv+SzTBUvZ8sPO_NW}o z4^1`QZ3pxrf}B66B4c-VZR_=jtc9E4m4zo7DWpUx8rgST1~5CEGG-pBsBd!;)k*1E zpeNGX|ExYY$f&{N=u>t{J@9yYQVE6z_*QRcA8|BR;}BK50S=(`P1i=e+wXfy9R}#F zPJ=f=yX<$oMM;ecGQxID^U915Rw{!Q%{xp#m}0Lp8)SE%lh^Hg=&?&*;+|iBvfiX( zmk#X>vA+$ho!m0?c8NqbTcS--r4NOz46&*1l^;nC+QMJ)0|wva+ByD0OI;cpeLOpr zbv76W_T;->$azH6Y8M5s6|=;$967dkgAe|oMUAi@q_#6F2HC(}3*~Xulx4_1)J@3A=_`uANWcRc|iObdR*t zl+Ye5f3)(o9G7?b#FHs2TI!v#=8mee)^ge^7of{hP;?nu=uyNQ&nF6Ih0B4%@*zZ zyYMV?*kew6VO-lFMnt2P3N3FMZpD+i!fgrp)1xdMpO*Ag7yigC)3xQx;MB;$ZL>2P zP(-6e=W(NUQulBCla9hN$V?0M5uiWWE$0-=!NaCEMYl~qyI|aj=Bkwv6^? zLWVf0sxp_qxRG66 zDK!);vlju8A~dDwRa0|+d^dW3;Wk_5kou&zfeG&~_+j%O6JS8U&K8yp>-D9i;ZPD5 zc`BRhnM8QX0Tm={ajHIKpeC&+Q+|)mv$%4BojV2nvCm*hjPcO(csg@RGHdJl0_}N^%lTUiF&YpoM4tv~mM|$!Ypv_~XVHPyR^2 z*H)#nZLFn8&l2|s)jKZ??6aHM4FE4Tyfi1vmVl={_MvK&+&so5zDs5m0B_%^u^jj8 zKJu^`GH#9fZeG=_vGA5By}yk=>Y+6p&DCj$>1jk1{Ha#i+JPZI{9R(IYBli@U7F(x z%0mtFXZW&tGp}Uc0af?Z^R{pA9JXRQ3f4dH(@>~xkpad@m+3&4i%}t41IqfXJ17ad zQwmwW_1j+qF6F+q%)O@LjK2!!gEi1~W*ci8ZNtsIHus))chx*Z<~N+7sAI3?E$jJK zV6L9GfOq9kwK>L!#5|>TA8=z2yLvV~r#)gI@2RhBnb*F%(jZ?CBqf(QKeU^y8-ii96qliba?V+K~(0q7cOiRyE z7Q91BBiN_0d## zoCU!}OLpS{xYh*Y^t55kaJNHi$^-?P6)!T&Pc;|t2=k)*2#^VX@p1jh`m1ajkv+Sd zW^}9TR_XBxa*g-V-S8GeYV`SwdBoetjBL|aiQCwtRMHto#uQgi@@J77s*ee~3lY17 z^ELv7Z5=ZeG3Rmvo_AfY=qpA?d>cMw`wqGdtZ|%3FCD?+$z`;4p=!+?UUI_J0N8H- zg{KgYwbbNuS?HaX$exJjCR+nPq(6~#U4|ugPzgJr%cx66lOU2}!o*RgQkUvTEAHiu z)(@ek1f)654pg@A9f4`5dg+Dl@l76T6}0jDK?EU0BTFU(qD66(^SoLaPw-1FUqoAW0z;y)x_CY@!pk;KmFU1dSMH?mn*po(Fw}XP_i@kX_N{jESDk zAphvr_0s9MYzlr?D!h+Ntod2@PsD@tRGo|5=@IioVf*FO{is0S55llaMi~X1uE$o{ z^o7ViP%dZD{a`6Wetu*=9D+hPH~*q;t@Y;T!=6LkiP*8K7E4~k^nBESDO@STrhFeQ zn$R;3qvl-FMW4}|vrmEO%dt7K)ZeoC#M6C258^3p^;7T~SyvyHy2~wCodv2cmHT$q z1aMP-@J+%EeU$kzCSd5~ifSUiIedgLslwfwE=Fd0-*mqY zn#0m3zDLDPg$732M|Sj-A0cdU3~rIlX}X8vtdh)~@-Y&XNLo;1W`E46zs}kjn;qJ} zj7nrV1J1x>T^vH%cl6k(WHM)0#HZO=@q;D_kCO9PlOLQl^R%cv|3u2Zf6#G{mI5&k zJub3bX{3y(#lUVI`^v+wsx|HLkYTmFwVZOot_TlcD7a~o3!CNmePM7*_RjC8TTipz z2u!r+1rTQdw|>L$p5K^LEiNR36(ZoD>G;o>4z$WxH3MPyZzn$-t#;vbwfptqF(@x< zm4kiKsg+kaOSR1kPGex5H;fg=KphOB&VJxUYPlJ1ho6%Kj9ahp>W9NO%pwd3vD#)K1Pj+9 zF+mUejR8v*)YnSCJL_?6hC0*M?Bl ze#wP%2;j`^gH^uAm-+>YnTO4$v8dY%9T?$GGzW5JcQ@FazmD(z+4qH5r56n5IDvqNOGePkRy=;+^ewFNA8kvQvBsQ17HbPjB zN^>FQUH$frcL>@+1|~ZGwj36wp2(6o`otqFY$jo1a3DEw#WIfd`uAF5BChtAWZ{( z$75B43+UEdw3(~aDI$IAsfUMaQxeK5tJUgX)22xT@;uf~JG`Q@y6;Mc@@yD-`j}MzB#U7nX9ZYMwTcPWtN= za@!c}Ec<%+H$pWX_}pfo&-p_XwoT@Vy~hJAy;~wG^a*{M%$G9*_)hgcTIxm(B`1|} zm&2(2D7}>ZhG7{PoLb}LZo+n#0buj((IrDY@NGgr@rcgeGJWLOSo8A&pt=8<~ujMLyBIyny%39mO_s-6DmIbJCuA(8oXyzWjrmM_c)| z-?@1!-m2`>zLx*`Y=y%lZ`RYQ%#~;iC1HK5Mftj!3}p|$tBiL>VAWmonicrw^1GYj zo(ro~TYBmJP{1QUt&bN)b>(DL{yu18pt{e09>5`eNC1Pe6o|$1DiWfDi)2eY9_9Sn z33=GfTD6q!7j}YrL~zkhgr9-x`_X>k!VJE9*{fu^CiSA{#-4f}#;1PeaoS=RFkUHq z_{NZESe1r7tpwd+TQ%`1Ze63GeD_9#v+Y}ZoXvZL-GO$ec@d>s+TS=>sQ-lP8u`nG zVb6P-`Z(&%gJTyYef8*2gcA=W9b#*vt@OI_!m`TIPMp>%N0qm|mL{6kT9HpzE9A8q z4WadJ^IqwmGv?9eZM#r-q?S9Ixdz{Jr+wZXxx3^P0t-G47TK1(s7fX z)mGKEPaj`i1+q7$SXWR(J5uxp%?^OdqLm7qDy?PD57`{U2A8N#sc9LMy>u%5L*~>{ zdZDkORnHV2U0UhvNx9RxQNusjz2;_8pQYBZBWs+t!Zgs@=*Y9KboiP@w9R?vmoJZQ z)zj|9Fl7`U7cC&Uw684Wo=!<^yykn1u_>JJ=m^qxzkiL9L!lPz5jbn?L#)O}^~kS0 zv^NHD=AFg190|sg|L*)E{Nw=q#X&hi2n8Bv;W#ZrEBZM1G5QR+#PvA^uwu*VJIROJ z8!lRLWrz^SK+m%@PiIIu;N=^l$qb!O1qFz0uJO>ChR)|Z#f8O$6)X|sjMgvv7C}{7 zH7qz8iK2{uQ2Xl`9UvrhkXM;65cGsw9sC{|q`L01#Q2!9l&Qo+@Q~h*ya_I^cvqlH zZ&-Yj!e6t`I3l}~x;KgsjZ6DZP%)v8@>iUZJ-q~a zqOJ8lHb-(zmB)**w~@Yw3asz&Mek`R$$4M9)>ja1wRLKKc3G=`faoANKRwP`g_Gx$ zd3KrD8EffXof{Cfu}T<4o5*1N=Hgil&27Y^g4(p?irz*g{%)6Dff?;~d2?lJiP2;O zHWr{)=@dF+*EIrd^B4I`KFr{c*t96=NU&ylZ(M#FZkZi-`Wst(0#^GnGiJsOSmovy zCU}h;E9ZgETz`#Kk+gyS_$!1J$mROsCQ;F$_os82yHBZFWsHSVfjUd)=rw}(nuBL$ zS#$%f+ND0e8gcBtq~TLDRiATH@!lut|Hs}}hDF(S?FxbjC@874NT-5y3Ift4UDDFs z%n*u*2uSA;(%lR_gmetuFm!jrFtBg;vA=IW`}>~f-S7UtIp)XBz&*zt*R`&-&U3AE ztvlbnI7x*PU^<1ewaW%M`hKRrDkX;dCHo8+s#LwxwU7XH=(q&2VCt`6sQ{W{i`EfbhDSOGpUcPp9ap>mT`40QvZ&emmEBv(?o! z;$R(^jr6Q`e9%kwgQu~$>)J!SPgEiIiA+^8bL$8W#XeU;xqEg@!bkB2$COnjN znUJjkax9SjV)cISz6MRAaXfqs`5FLiX$HY5VP)4|<(jkn_>-0&ot3b%ZyWR{ylTSQp; z?{&v?PlV9(HPNUV)Xfy>o=~ANW~+Phyn;rf3sbPz;~Y9}e_W`NS(MQ9mvQF#1tJk( zZh5(d)%W+H;Xj+j#C2((Y#zK}KT8GC|1B#2+cyJFF!JtgsQgiS|9h`mnujWA;J5nH zsThAxHUI8w0=;?n|GvKecMW@_7y+lGzjY4j-qU==sOM#3kx@#C9l_-8D4Pf^Ea;qE zi|<>hkd6BhSzO)|zry9U9R7=>%BIf(R=a5M+tTM^+{+w!tFD&$rc~hT+ba04LOJt` zc^OO>^V)ARB+8J#4`2UF6SrtW>)7Kb$B{$0UKjPBYx{q@&`-di<%T!D(m5>pdu`p{ zwGEEE0va7g4?9dJW&iHafBQiM*eYnL-GM&;{$g4s0G*Lmm&@fl|NcE8fK4cywTk?^ zHbE2cM!_HF@Qv@$l-s|5&pV*ok+EWt>fbgaaWV#ROi!|A&t1WP{~lUkkqLDi|Dpc= zH;YX3m@pk(__2|&`@go7zwQ}LB(TUKY_&4~aNhsBmH+(uXD7dMQZ*?3`}e#D7Wo~? z+}~Gk|L*v{Z~wEC?W7R~|9&s+dpcl|X>s=>|8GYBp9ek57}&|&rO>XD=zsejI-r|Y zI1=;XZ#Lks3;UPr|9@Qm|8e<$JT5e#WsbjC7>(D%BJFYsrBq>ap12p15At=Z<&NL< zYyN8+UERu=c$)!!k66^=_6Tn@L;3b!52=^DF+-I?k>3H4u|PR!bQ=`kD{ za`sJUBz3pfJ9MU zihYtl6zXblG@Xu=&4_xR=CNs)y(;3$;4(_$fQ&WmY09RF-c)PsOcX~aa$EMrv4216 z46871m%iFa^P>|LRg&xI(n~2cQZ?AlKT*t`33;b-VdTdik(FnYI9KP=_n1%rz zT<*tO7L~Hn#&Z^S0k)Ql-D%dYh&#dp)+l*qmLr)L0iUq@6S=i!st-1`2JppvIWcjG z4&_(y|9RsAvR(q-aHQOPfNoJPeP&Hdw^zjHD+feKc4JU^Dw=Z}5sXI}7jPe|C)c#g zYyIBZX*)Z06dvV_?0SEqNIW;Ugsi|-DD&~4(1GrE%aerJThPTk>)wngN48u?gE@9$ zGZ^LVwK8yfyaz=D^%rszv3z)+3ci-D+t~l=3^ej@uBOjs_r>*qE_kq$7^6PpHYam- zd?!BBcO5Sn=W^YAWfK_?FQL7A_?wV2%ecLv%{?B~ij|plK#ppBvm$^$#c5d8qJA6m ztgnYBRT!{`Tf7g_}DTL;qow z{k${@7}kBTsjlo6jkh;@m3{ON<%K_?Kz!usL%7+it?SmLKekKb-_m$>l5O8K+pY%A zB+$mgr{vY&o`lJR?@$r`-jeh!YL^qU_VMvX`)fK^VS)M&ruw+ETz|h_2#2Izvp5)JN=a(9>p8&{l*=8c(23h zlZlJ@G?3wb{SH-tn*+b|;>TWyi*v-$>-Al4Vh@ZfQPj)jfN$ z;!Y95J8#27s?dD2!ieE`FJAg$f%6V^fxvW06^`tFsE~4+D17UQEF&5^k4tB>o6E{? znVBxMovZC(S<#5x{cvDYdht}7+=uwbg=MT7)aVY)FqD5?uj*5|@a0gu^U&vC7eg76 z;cj$Vw1a0&7hk34<^;`|?^^B;m|g78r|wKaIbZGiZ?vhJDeRZ05Ueoc2n z=~i!dbHZ+u3Xna6^p6APea^doheQ{3C>rW{E(VCh$u4;7yKJ1+{{_1Eh8A#mzq&Jh zIJEjZx8-0Se;X^MvfsuaBz%k1c{!ZY4>v|z2^}+BOKVVREitYJn`Ytym$Q+mGWyeW zMYS(#{0(!-oF&i`3Ffn#5N644C_y+^7tckC&8$C#tkzS$xui_wa!cAda>Q$yKQWD{ zjy+oGdf@i7Sqzh%Amiq1wNF(bCZ1w)jS5b|QDE(61|5CTD|HjL+~1x!9ilvx!G$jD zW!HH0$O~!}`wOAIqC~_)lV)`eUv!s^f%ppqHM4x&jXh*HjBg=bLV9jz>-PcdPBdU6 zpw4AO?(3uHSvr+DYWZsP%I1mxpd$JcDrk5yKA};OhZg|@0%)W$!YPFqlwG$8Drzds zd*7d|E3#)}EK6V!GSw}deYBg~8K0D7fw5|pWGyQrnE6l#(yxiFl=d$6kU1^CgcHPD zmpcgRrNdaW-FAYr?dNADYLHzc=Evh&Mp!nQQF6~Ite1L6vgLu#XsveN({mCN)&GwkusWH;a@V+ATLdl{)C z;?DPG1U2#LFXctN1*uGzgJeD~%z25fdDL3Q)4N#g=!m%QK6@_W9dp)?2gO_e7myK{ z4#M7&xzaTPaEjLqhgTcX#m^S($3^FkUjW{ua zUH5ls%5Ayl5q`zTRtXgMN8An%7$4#%4skCs9HLSlfB-qXR|&F*fl=m{jviWwmonhR zLbz2fA{oRk<=FY-IVgDPh4Dnu^oXiXc0INUDW9!pe3pFt;Oo$2bl<~tXtqQLPPn-Q zy`gtcc8RYl32Hx+1QR2gF>RM6LhL**?M!gF*2C{yAi%95dT|E$x^IE-R55C7l$5N8 z)ZrdCK{GF=4l&~{3fWuxV^?FI6=^=Y*N=nD^VN*ig^EW;J!VKGuUWkUyMAOT6x*peWcL5!k4=7C00gu~D$nSGr z^oWvouKJ}x>~e#8Zg_ZCUo0!Ddagno3A-*%Q6R)@sVyi@NEi9KYBu+P{M-!TpluX^ zIwcg#X2Y}4{9d^a7iQ0vk5$8&*#KP)Km>ZD4mXUzkv64uoeDMQ#+2bJ_Qy+kkDXf9?A8hsDIDA@kS}6 zJSA$S2RFJZiqT=AainmvZ<}g{P7HMuY6OKDRei&86r;U)`+s1l|3Yl@Bg7R9(qSh9 z;rG_~l&)5{T#m0IkP@jV=2*DwRajsHK8n?dsiTJU`OO(#mu;6aBo^*Bv*WodAtwyJ zsij%)RO`)G&&Al&|KYqpClFw>l4X%HW~;v9)go0L9Yw%KHtzy0Jl3mZQOo+)5;&ze zN3;@3!X7tXILS})S!mw_@ti3AhL`&#uk9#SQi3cPX@69rRieKY55GB*Mu>*@I&j0! zCXE;el0-i;T(%cg!t?fK z#J5SG(@j-`!)}%Lr7^P#4a_JBg+(+BM1!blm-X)T0X?(Xnmy5r;WFDFp`p>eu`D`H zQH39{_o=1~p|_yb?x#9gbCQ0@J&)rqYQOGO5g(8pjdF%WPz1SKmsUWjW-KEG4y!?@%3DVtHX`gP9E@cG9BY&{kD^harax6HUC zU`_x(i@WbmE#;;MIaj@3YI8p0(UOJCRA*ZZ*svEaW^GgGzmK3omG90TG(O9ci)B%} z3!kM-HYzs>IuPb{SlIQXnl#W--=0&Ot?}8HK~%ib?ZsnTA36K zO^E$SGf0nFyDWXy*vNab#K5fWw`?u$DgK!k-mw(6#PY$N*aH4Qe@*`339ev;28< zVjK-V%*(COT#dP@{Kd|elZBWo|vY5XFL z4>Z{YrhpBcv}iMb$otuNzRjwZt7MnED;rm{a?o;!RbQUOW3xSf zEAUGOXfl6CJBMmxt=@UwsNeOL<)ol46s*lWArTA}$5f2%Xh=q<2z3>7-(8#<%#a+! zIYh^dmPSh@FcqNhihg;DOH*!={T+L9v@E@Py=-VN<=cL#9ug z_2}f(6=bbXtDBG8qI-ARrKs%jHUC2PI44Y>CEs#sT+4tsDw+e!P(4>^RE%Cd=SQ<8 z`k+;BOnyOAVukOOv-}o0sg@c@Z;svTgAe(H!(nWtSn2JhX@29`ggC;f>GSd7JrlVy z(S)nH^YSP6R;(s=r?+SPcA(nq00At}ET$!9{ZJ-sQ5#h2SV+G0OonjWq&T)v6Z_ga zocTwtvw2@$kfU3X6o{B5249mn;ve%@;sx{orz>cBvrqY%7NBiPXyvl=@^lofS&Yk= zu*8AjWYQC-r+7P2S$9T?|bi4&tW*3 z*luqdlZs@AH`VciP&2_D1i#=XvnfM$I&Che$kgCcyUY#4=|H1O&Xjp!MVq@zm|=rE zJN)~nF&`j)>Ju-9l5pawEDH}+g`_3BfSRR3Jw5tR9zUh-+xOx^4>2)ugKAu%CnwiF zOBbQ~mAs8R9FwN!_sh_`OsIt6yXf-slEHXF;jy2C@n$OZU?&^6`{wQCKZAb*M3EUF zii__nb&mO&Vj%m}Opc29PqeErG5JZFt85Uh$|2a#V7J%F$5Rypu>e)qGaFj;&`)Em zr-_MoSs$#t^*;5LO5L510@`)M%=!~lEuH4^sBZyVRJ80aDr(5MCo@Yq#`jfoVrONY z1b63<&-1WhWF?z4+i3;a-~QslqtKBQwXn;no~!85AL_9soPE6I1ee?1x4vjH#KIpWFP-3fA7X z`(aG9{DU4B2(0fZ|D;waCtF=OUs=ta2CSFh2yqgh?T>1?@6R!FHeWWHx@*gdoNLd1 zi$T;&DE#7eIQppo;nH~$FTjqy%p>#bh8KRc<6!Y#DZ31`H*RR*{2O^lcX-^l@76ST zl6?>NDyY}ahpyM5GMd_tOS)pCn`1u4=V0~caxeOGzu|6x6c~hR6==U+d=`Ul@7zI* zJ@M1NYi~<~r6Krv%b8~lk{c}baVgK&9hn`3T!GSuXy%?*n8(tmMc3Bd=lm(A`utJ+ zo=dEW9qQ}j3ab@{=^9W&_J{T}X5Ff9YBwL^$sHP7PiP|!nvsL~teQ#5zZQyHGcIB$D}HEq z7(ZJYwZrU!OPZ5CT;wh=`~AUKer7I5sZOOPd#4ZoM^*8%Hf{aG6HZw7(2E1?qMi1q z!hI<*h^4Ve3a_U)Sh$;Qky?gc8sN(%nXTDe=t>*4!DNKkEgin-Y1wTL`+sEf{#(*o z|M1V=O2$7sN;C2;m-*1^0IGLk60-I*8|sN%SX%fS?d z^=LCUS`9^l6ADIQ{mx1&`x0!UQTrX3WuG3zlbS5PHKe9vog66jsI>XKK5?~{dYkOm zkk7&6*amXmM~+uJ+QvAHx5xun+^jd$K8DkXV{vGq35h=9D)B0)X3*4r3H)q-1u_@v z;Ns+AABXQj9hanCwnXP>nfg)&FITcxZf2T{Y`-OgO=9!2#{%VY9tJn*qZY-Zm&JOx z`UzN-{2iWE4Js3qpLslLkJbx6I2nB^)6#Jk>}mZxxRJu=V7TM`Vi%pn7lTmy-7lCO zl@+_k!ZeNcL|%jxS6rsun~@_TyN3L_o8vWB^!i|@1F3p>Kl?|h$U7(Op&YwQWNgJy}(KM{t0aNoV0J(~XN{joTF z!)Cr7I$d~%4D+yEVNkq3Gn6=l$ChoJXh*6o1_iIGCW<+@4{d}sQ520qgr%oWvR55y z&GBa+&+^UP;YQXsa=S1gMGA+sLRSEM^TlRY_xDY)!HxxN0eED`$N`^8NIO@*qP-f<9*_^k zHc_Jm^D+2}Jv+--`NF*Id7Ze=WqDq7kF`AVC2GYXd2jxgiG;_&ZPgkVQS_Kh1XV0t z>`vlA!PMBftV>MtFB2#Ct&yIJ?SaxF`HUizatHKFe-cmEcZeOT3^i(4$EFz1;j}Co z#UEe8B7&kQ&`)c?j=ATE4IbCvq4PQ4t?+@{yNQr=ul5+#5!nIa0xzC^2BP zqXNzGkn5+pZ&Bn?$OyaVhB$xtaso>yUDwXm)iJjWL%(|PIcp5k|}`YTyB4a5+HOUhfR&CxX4XVmL)$ZsqFh$GyUD-OLIbgeGF9FbX zymf{uHLUS6pu-fJH#OXv>Qs8MPk31D?=j+k>mbK|_Be~QJw?Dp8ZZD(xU1hFr&wz7 zHzPZvQ{tiLFVS#ss}@C6U|Zy`a^@IBlVnwUm$;g!??a5L1r2;6U&cPNW?H1>LC1;1g$l z05`m`^~_zH&VCm{01jTnypKq7yx2cg+=x#U`^V}94e_5sW(X&q$-@<()$N@N?S!20 z9h_256)(FqS=?!2N5dm@p^Mt)C0ulNzLa18%wz-=L~2+;Gz`WX$7d?dQB31tr}iH5 zc(^CtxRkZiAjR9cr|ceZ!|Ol8%TJ8}h5!NEBKEXF1#)8pczJjxWeT zNQ~dz%{q0Xe3%DmxvA&)k^U=yXX09I@}N9mo!ij<$z!$bSuMV$c=f@{{#AAajz{3_ zS0Pc=Kj)|W&c1QDXmAFeSp+|_1z3}=xUCCY{k3$^o%pT`VaXd?BFi$ z2bD-Kr&#k=b7j-$5j$VHpO_e4y-EQ36(%mVZnZVD-%a@kM@pvul92h|zy2h_)=wf4 z0=+)J0(R|j0?jzZqVwriE+p2cEXVs~pg9hy20_dzC3215|6)>bYR0rH588hC0UV4)(dvcGcEfgEM>zewsYz?g27E?c|Jb;{fF@ zMnQoE$<{$3eR`7XNS;C=Qz+(RByBCeB;;g!+$KvVB3{xQcgORMsX)=!AN|AOjF|A^)#qS+qMq7+l&F5q>X)p(l(8|U}LqqubUKb~dN z%XEQwtZeA3+2F2y&*h(_(0#=@ z#yca=B>}66A}eunVph$E@8!d=%MK+TDQYh#28Mjp_Q#4YEUnWOeSVT}8i$fQ()^Po zF;xmtA*!;QTo@OmDi>d}*KPRjR&YP=N(sFKZTV(qerKmqCEV|o^OxJLS=we7y55gQ zn6kBhxN;rr=ssHXO}(r(RP4%(4@gauD?F!=lYOF+DAyfDU#MOY`!(qCaPN;q?zQ|} zbapAXCc6*5+j`q$!(x=sZx>{8>AsR8*?lo_bG;g(bG&efkk+E^wBkp!>zSPFW*evpXka@hUKbE z1)|PPU#HSq@$tk4w2`csBF`zgz&98&5zL#MMCGlG_)~D~3zcYwi`i&OzlbZkL)0)T zF}L_9aX2Ogfsp$r&NLA3^g(x?Y9?j7*`+xb_|1osa$}8ssgE7u7m-&AEhhPj$$avO zBiX2e1Ys{Zf1xYBh0T{`{CM{60soJ||zpwe0qi3_z zbgMSk=0`J3k@pJkG+4D{&-yqoG`wyuoe<3nR~u7e-tl@;AA6z@W<3t_t4B5ap_?YL z!7cw()Q*Y(U|3I=U_l&ENZ!-FCCm0aBlt`rN6FNeaj&}Xn3&ZU=+EAtWlVAdD-@*( zfI6KcbaE7)Lw097nd3766?^~z)G1orykW9NsLH{z&WY#5wC!q8h&(|y^#YfeZBxLZ z?1v>hwR~<7sCYYsPcN^mtbWE{z~34X^ANh${V|uc6R@h(};Qh81uKSS265SO}$tfQuMWOPXrz@uR8Y}I_tNz(ia?hyQx6X*lH$uF8PwGj|%JohO5Jns{5%&x+58mWDkd&@P zb0H3T2WpuwACz~k@kS&gwY9Z0L7~O!nyb1sc8C&>V!NKG+tH9Sy-c@=z_KsNr(-s&EY$ls^3JeSt3p9!uq(VtvSJGdB z+p@r)ST&*HQ}Ai_G^H+{sU{z2ODy*?KedRrLO7MW-;|j1yXM5#>Xu>FIC~l^!F4 zU%x=EQuc!!8L|pbgBy+=Kt)O#ybck5caN>D9M;E?GGm^O(Vv$6+ST|Hj>#vT7F(dg zI(YSAey_;I?02iW%Ly;nAAZ~(%RjzciMZPCCZ-#_cn7hK7M68?Ka| zT|^xE+IOc_#rkz>;-cCkv*z>lZeZE79RyXJlsk4ZEnkYwv#mB>7#?FQK3j8{Pkf%n z&U%?Hi$P9I8af5;s6y+>lhlX(4)576KP@c3-I_k3uRBk&>E9)t7mZo4u1=>fL-$bg z?_z;VVZ}2l{5_Xr{v$vnYQATfgvc#|2KF=@;9&YK`f}p&7{e@i49Xk zH|g^oP&B3i$~<^8B24>=Ya(+&lO-DR2JPh80PrzpW(wpbTKW9VhOB>2fT)g;@rR4s znY}xsL#pt)G7QAT6j+yZ(dT>HRZg>S{!+u=?`(W>Bzq@XX+XzHMIy}C@5=_}BY?|9 z5p1+mCB(LQ3nv`wZAb~9MMy_DpS8U*U1v*17mnv3E9;<*a->f{pWB-LT=w9j>*+T? zy{(blXk$slNmU*OPLHYelKdT-gMhoo;GEY}<`z?dI7*@QpU-xVR)>CLMt-RshKo!Z zJP8&gVAdYe+YH?kLMQIDH)fGI%X}Xxj(J{VH!Bi00Mu>17Kko-QUz~pobS!v953B+ z&u6XB2ut1M5QQ6d^vF@;jx-9ZLlQjg_?S=ZfO<#zHK5NZkw|&;_`QdGnagzJv=Lgk zGu+)zx?T*~XhiJDh-kc$R8#lDvOfBVTXz;GXbjuAVNu8wOFy)qt$`Gt@hP!tdW|sA zy8pvK_z|{0g4vdA$wymRM71(Jm`7s9N9PlI_Xk$fk!2hs6HDC>`HH^D;DlCGF_d+F zX;{I;CCMo$ft?ICSVy*or84Ft&wL~Sb%?!KU#SY?m)e3$@}il*SU(wJ)6VR@5+ggvZ*d2k&V-uZZ0tMM>mklNE!d#Sy&w2g2 zOMR;2o)~C`Xp+kiU-(o7R|~T?dfX<@+f*b@vO0K0_H}AwRWix(;RL$shy>~k3ruJP>L$gTxb?$1qRV{SazLsy6sKMu4 z5K-#BW;gVe0?!*H+OFYgP4rvNBkEJ_$MVkx`%TbD--~&4ScknJek$U!-P10+%}{tK ztDMmRt^Ovc>@f*aFU_dvc=NjUpCsk)z0u1*&*AyP+**A-a! z-m~AysT_wS(M^6%6l)nZ8&!2n?vF*U<)(q-ybBQdidT;%9Iwa*e_<$G!&8o`X*gWz z&~fj8TvC)0q`o_ZkdZc@cHLYv&+{xJ1`*8=PFmXQ;5sC0Tp-kJeP-RXV}+}A^(}Ib zPUY1X)-*p+f%V=4N8}SWKT30+O}ernQTrc>AHVzgJkrm--nA;!#H{}@;pMy`D|kSt z@^eD-=nKRwnEkv∨^CxwAqCHVU?;R#pOqyOFUOid}hDArNEC(Q6m#jaD2IG zS9f8PVTjySm}pl=hu8jfMtku6V-j|(@$(*fmUD{qdadY9Det@FTxrrxH02 zF3oo2L(ua-pf!)zsI=rCEaeDzb+yn2wSLBui-nfDfY`uRv{A!M1 z*sxI3&TOK;H2X&dLwNQg1+6O6wkUs{-F#6|xvub(nx$;)EWR{|2@o+r=6p{SQ?G+h zC`5hpY}I?~wnkwwz({o+sCKtKahsI)gssk6STpFRg06$-(5B_w6v(x$WyBThv%_9f zbuzDM)S3c?n!yRRWjHZVB?7W73JMR)H&#b9N%PgRzb~9sL0%dEYP?iao@~@I0>wJ} zi0W5Z!uOLH^YJk%i-Z9=ml<=?^dx32jmP)d&}X$+coa`^eMYpVYVLDl+7nP~jqIr? zj4X*R$hyx+$nviZTgmdoxuKM1t6rt1TvP5;jhM^*Q36u$Sl{2qWpoXU&c5u4W~85L zi}Zg0XKb0T1yAk>Cvr0`1Osze^tdT-wyT4+x)WYYvL&C4$I^#FPjEJLFIkkoLKG6Y zIva_FeCAuS;|;BKJSX$j^+c~X39l}rUtg=VkQlpJ3?|S^YIuHA%U-@8&K>ZNJq07^ z|I=q_^d|F_+He}@PXOYa$(3QMmfyk*3P&D?i*K)%f~n270Ljm66n$KwE$5kX%4K5X zD; z)3w6D5^~#TaoOmPLdQJz;V{szs|k|724p`4JLkFeU|1iu-%SPy9~+)Z9KXhQ&*J$s zuNh_8M54)-e7mfmWn3t1r4zi&ybf&&vni>YNnJ&Tbx<#Lm%?thlbYhXq;T^-0!72M zSS>@hV%(C$jFfNh$}usY$Jn?B#C`-g>Tb_lKWZWO{xi?P6oH%YrRU38_hfR6{7?hB zwkujKYgk3Qq~N=z6;-z0JRoegypD0I_@s~~+GNQ$UO)1(hJRUb9w=VNnCe_~G%NNV znK^{Q+8LivQ16SI?T>Y}Q( zj8rq!qV{JyO7G{N215wz1y+(vvjCNk?8FKIz1(|vDkn3XgHnUy93D%1quxqO*YHub zeT9YhJbpA+`ZTqCvJ3IQ6BhqPxc_qw!zAaPn9KT)7YKFT)t-|=x=kmI$rB>CrfzeFqGbW7A(C)Lf(7mb+Xa7 zIZWMfz7kArTA1f<$MpUFGs5UGv$AOM{PXE7Y_(=zf!uaYGB#~f`j;^s?mbcTtLH)~ zrVj1(2h)~m(W;r!I7RhsPghHUBJEjjpWS@D1_|eFtKi+oxa!&o6%z*N&G{@r-(HjZHirf$WZ zv!NDfQ4py`{Uk~%lvFSEdCKwKVfzI^f5EJwMMrP!Io%Flf{D{N=0EtlrD907Gc0XU z2kmw~5VOQ-ue_VapuWZOPKYH3xv8n(A0UBNmbZe#%+hF>Uicq7f6J5tpZ@w}>53 zRN6+(>qqs?ukEM8#di01`*(LMqgQVmPe4Xan5xTG$3Di@9)9tBSfZZxO8E9Rf zguNtr@W)C&U^?P!_`%Qid>RGLr%d&G<6A$Ma`&X(^h$yIilK>U8>uVF_^sZH178g>xoQ_hr*km*Wwsr!hVITyGRE4XlBhmhfNn|_An$3-fy0*J@M>Lu6_@U70km35#>xd-N2m!&Gt*oACQ+Vt|$i;#WXYnOF+R4)f z{uf$Dvk^iNkMqy?9icPLO*PR)T21TTFvzrhqxR}N!=-4`#JTT3sspM zeebp}o1e&;iJAYpTYufSfT!J|_nJQq|N7yuQyPTJU6O3qVS7Dj0R-8X@z=1sR5Ix| zbIMTEIWF}BB!OdRm=7<1_-rK9J-%eVpTur9w=ri*xNCu zN@1ywEoWGdQ*bs0kOJrWVvM8$J$BMr_W=B*zr zLjm@5-2Ry=q7Xlbe9+Y+q-Ee1c6B;B_VAvO--%-H$qD?l60Rw{vwFLV>9gz9MMsL& z6J>zOdg$oVvOyF`3p5BrPUv3k~lunsNU%r3P9*o!^dD;=y z8ozV0I;O6C5zIUr&Z`WnV1~4zAw85i@WSDu8*|;S*4|<^a9>Btg#A9|pS8+`&??)N zdnI=}6E6su<%Qx9=ow#yBvx7^-lE{)#Wfnic;y?t&K$_MG2_0+lcvc+Xia=cd=7C# z0m2uSGp{zM6PiQq8}`Cu7>f0va?GJDL+Gi1wnYl^oo#eO{KNK7Ku*S&efyQ20Q1lT z;e&{&o=WD*W5bbKagdhk9a_#S3wwU@&g}blN65%j{1fo76lp>+bb%$qXCNdm<~epO z|36s-8UbJt0Jtjt;h=aGCEr)EC6xSn!=`boMBpqm--@#mF6z^fDz9c2_IQJ2NjX#~FFS)+fd(q=7)JV4x;D3>tPPZTDrt>aqsclVQz zO>%D4y#4&!w`1vc!5g`EXx!F};UBFm%EL?NBC$q+#{qPWR1ON}@A_)xPWvwQcqM3+ zUl5!<(qIVShDfc+o}Y!DIG&vymxEAe*z0)d<4sYcj>} zHmH10S>Wm&VSKR9s3M=+i-b(FLd47PU5MtTdXoQVyzQrntXiOL5wfnTqK%49^|%w+ z$#yxVj~DZ5qw@MbduKXsH-LTRzGK>)URf+68PEq`5kEINIqFJt^;7;r-W{qvY#e3R z$F4s5{t<<%j&pUOKuMk2z?brv3G^~M=rqHUU@r;`KlCB&?cEj+U3A~AmF!*X^?qy8 zdyna#HX9Fvz;CH9<35jSiI!J{u!u)_z9F}?`W;ei)T?PG$FRv;z%cvLqOiCoDbgR= z55G&?=K1AP&r!KDRqA8_$e|$1Lj5j}y}X!>%E5~Yydkp6;hgfQlRQwN`dJ)RL0ib1z=?sBrP;W zyuO(Cf#Sj`OK1X6zzTdD$Y6J3+QvG{;XQRvF|cY%KBz@$R$3@*F4wx(#g&pTm9HbC z7#DQI$P!;h2m|E_><*(TDct*52G%2M1LvUCdIR%VjeejJ#iRq88fox}<1vM2e%*e3 zYpYj?Kad>^B{JjbqBBeL9SPZQB6w3F)Vo&j@SaoLZY!x)Y1Ue4<8gsN^8vP1!}OT< zYlPFr&nmZNB`O!!v~DlA0%A*yi9kX2!JD<7NgT z4zVE#>;WjD(x%Po_*}i4&4xMbV=MZk^m4yt8i;CqELQfR{Y;hB>J`Je2;$<>bfBzZ zKScPhJ2RrL3U33#*TQ65*{oMp_VIL6Mxp*@`#4K@zt;36@zq;Yi`u_lsxR3siG7Gx<*E0)UPBxlJre*N+T}&Lz<) znv#fWT#_4mO#>cqxjqM}5bDQheVB_&P0|n3e3P3kOTTvoZcatUx@(#uy zC~4STmT;C15xHKfA8j^(X4)UX_YPab*CYx+wDED$)OroUgn%M)_mB`EDquAJLo7st!3z$oBZMnoMo)I#H zu`3DUJ~NC{IUl&3i9CHxYQ*)5AMb$aUCF!P5`%he_;_`g8kPd|Dn8op3qEwXamF-a zzFjK2g45xA`L~0?Wk#^fsxM09V(O*Zy-A6m+{iS0dq8wE)lAHxSE``6+^YK2O9SK+ z)H(RBI|7G$7s+H#PVWzOfMrj&uY*9-9K7Eufm&<_>$Z(jU&3(Aze%P;{`c7AC~e|XKM2rV``azp*TK;nDq zpz17AL@B<#R_j@W%CEjpJuy_-D71bNduu3L14e}_YpalomUe`Y>N^_BZGXY#tpCkK zaor-%!SxsrH1T1d6T2-3U{T?alx69u5WQhpQu?qRjkUYnvIDy&K=6fSE z-Qm`Q>wCWA?vE7Ro-B1J!n#YTa~V)PN6O&_o5?VuL~^;ZWd%?_xCa#Z5GJIi5YzLj zP`b4(O7rh@F^%_}Es;>n2mc*!|3Pp8-`~^d7IU;hy2+=$_~}&!3mRJ7vC89?KyR*Z zXY74%(cq{LwMV>5;Gd;F8d&-l+nLR1;bIj@5E^SqmP{q7Gkk8eJ{6}&@fUBjo1 zSgm~m&kj>XL0>~VpSX!8bFH~I-8K7+NGD%f4vS5@CQjD(GAyGSr172d;MOoi>INeIa)D#<g}Db&22~e^K1qta(^GG3CiCEzqG%vmNE5!(9Y|czIQeT`*;hN2EuL9%vsB zn)HyW=UUuAQ?J$N9%q+)T4+q1wl2hzZu6;J9~hA1rT==|47*$ojl}&$&oiuvuot4WYPN|%%)-n4Fue(m2jFp?=`qy3_Jwj}~_3nGijbp@eP&$SqpVeEc%SRb5X4N|(3I()}=(!CiuXsYa$8jKI? zTY#&UKgHsrENlZ?5(M&%-s04y3SZGZ(t_#*ox#WHz!4Njj!Fyhb%xxt?sCta?(SbC z83t2mE(`p!0Vr*?#RkNq_tUeznQCr)5l>iO6XgalC{aeYiZ+sS6z&$pM{O(?jVH9* ztx&J5CzIwt0E?ES&$at4`!MT8x>phWD$|=964fSgKp4b0S;!xK37RyJ9OY;Z*#^8I zVW!0UH%-XY{@?S#)ZR1`pJ$EaFFZPkYL zY>>Lv?H;UOJccKzO3yzbwCF;1c~?pGe$7s3uQt;QxyPq)@TM*x zlsxlY&BX$!Z|-9ghmh+hBYn4*OUUEC2Z^MHo`bFnP<82Fk?&HW3%>IqYpP;J3`QS* zeSq2<415cwe%1c<@$2gsF#hPNyu*x1eNZ;JsneM}vQan}ASpv%KQ;3ei?3tw?|88+ zDI2fujO9}bRq0l%!#l}Q!UM-d;1Qyb|Z?#NRDlG=M ztW37YIO;AwN|VZ|=L4+3qQ&2(n2Bcs#9(D_X>v^wiFIlk5kBaJ_8uUP{Zow89&Hg4 zFG(%QlGBpAhzacl42;6aOC9!Ws4Bd-K#?I^Gri+N>*d4tPAaJDvr%5wh&ug;C(P_I z&ipzKYu?ye#d^8+ZBEU2+Y|D;&{Rdns6uAJ@1oE%9a_#+1%=dlWzpB2QYJ$_f?DcC zSnS`o#;gvi4BlT(&}K{;f~GeQB5f6LS6m;nmsu|~>PRb|iH=(a-5L&UNT)D|$uEjWYn zw~cZv_R9R}%j@!x<}glPtr`P*_C&;;p@}4zBDvGEGh)8cD0!j-IAcT&9hzN*)NG~cNy@wKlQbcMfBAw7X z34{_L34EKGIp@rrGxN>7Ki}(m|K$n~PxiB)wbx$jUiZ3p-J{*dI+nb-E5x>t3iY{t zOHqt`t<#CYXO~#_*3nAV0Ff5O5ya{`VJYjLJiFSuvdI$U^In}JRn}XPN<+T0?}2md zgOjr(`7{#WA3Gy0Retg2fIZ|+|MqTfVFzhv-E>boR75>aMAB|x>8kCI?{Js9%A%oU ze4E(px)|!R(mp9H%0Ep$Z8LxMqxS@$&pY3#?);pOb=%!IZH+}%MJ%*#>PdAt?Ddr| zldbWA?waf(O}AP6#}JG{e3B&ODB+&FvOc-`tlxO8g^wCH4r36rUiJPv{J zwF3`fg#yM0o+qpwR3hzy&53)qB>~1rZ9^3cy9jU68o#LUF4{fi>Gj~o_h;Ol>#x}r zI{Y;95-Eizc7(gY=Z3*O7EYm)bQ=v*#hKX>jlSj;lQ{rh67xm3$645?$9GB`7ZLSr70?rLN47pd&vYX$NH22wz^_o4%h11R2dNFsgRcvy-D3CUS_K~uEM^naj{Xs){@p+S z;UhEMv_1ubYkbR3&$GbV4QC~)Rw7@JJfBqea4HnW1U92kCFQ4ys zqfUFya>=;a!#dOW2a&4oxL@;{ls1c zh-#aqESM#WH55Bt`j>_LMR@bu(+l_<+%NyTuuoM2616fgv$+znz#E2+jI!+x~)Nr*_Iet!^C5V!*4r=g?G@@+hBK2>dzw&T~2Q0~c}Zac+e{O{QU`Q~GE9LNj|#zj`l!qGesv@1FcGu$$kEJ4K4rrqIMa|F!|0ItrjBTZ^ z0t2SL%kkeuvp@Zr?5hVszvi^5h?vt1ajOut+~U}$C{ciNVIz^yB!gf{Lp~NoIPlX(}7+gIAP3`i0cca_SS& ztwX0@Vit416NguLHbQ7B=O23Oh;9Q!=lx>e`kBVG$-tI%&UpngC=e#->KXE)73L5% zJL_|aFOHp^Md*0`#cuVV;bc2e;|2YNCOvK!x?g@98OB>C4?`3p+FwlsaB(efm#!J( zC{wz|^w1BLBXP0_3D7xSW-+09vGx+u>%*<^9{rq2o96JdHYwitI~Vo(O<~EOb#wKu zvqbsJ+jMfQ1L{b8hcpH`GW+P-ZID@}>;P$lj`JZLkKHjoF#S!Sup%{=1dT8(dm6Pc zSei9xS6JKQrtLU)gptc0wYw^)K&e zO{YU05T{?(smf4cR{SI4!gF_$$M2CeE90C>+nY~dV4^k$s#C8M@Pr2jaTrh$Snb6u!IE3_1)}V)9N2+pH)yDIm7(4yy#KGF=^pVyLZ!6U=FU}Y6&Sz zDpdJFLn;!X>-eob@HU>OYoscUhGGQYUw!tVif){FR#NfP9Rr`uzQDC-bAZn2Hi_8E zx)(pGXwzyJ752^l`X7AQpBPV!Sb%(UWW|G0qIuNx^3C}!XFh~rw>-9vwP3u7aI#-5 zJShuNBhbji<{`esF)`C>SMklIerXyGC*|v&{rr*fmVfOd ze;sr{&&4{^OOQnJe;M@pp;KbLq9ncnB6@2=}++I6;nyqp7Uh zyuqk&l~#PEZNOSB&9uh-R^h8h(fnHODSf_qsowa|^^yW0T_PqpkdMzzh0n$xmQz%^ zEb_98;ct!GU)fjT3oDiBB;qOrVd{)jIVpCex{cB?cIl;qxCo1uS{cl2q5_$b=yGL$ zt(hBMdn~w4FZ-E8sbp}6-tZ(F`$519#K_JKW0M~x-Pv#96uRkIk#zOe%yMU3?beW8 zfe`$G`u%sczz;emb|_6|7F*fvRkgCzUe$n(gOI#!k-17fHBXdD+t5`aHyPy?BAL*CDZp@n#v$vf)Uo!f&6tvM3AX^^e&UwH@$+-yXt{Cs8Gz$@81rO zm?Gw%gGzhnjoSClCwmrjG-aDYdq7qQrJ4c)OOIwdlb2oyTzAV#cE6(FxpBGNuHW4X z=&^kO?V4>YLDjhh)vZ6WwHx}X*1nx(am0bLiqr?SNGXgj(V=S&fC08c2nfV|)U7|L z`dZ~eW@0;lYtU7AwNo#iTB(MO+2UBj=_PQ?D-eGc>hI<})pMEfc$z{KtPRSa0ZH2 zumS35&psemKyjzyw1o9*_*A&`^I$r+rJs_3cP!zBt+KgGyj)}IKG-C`(RITbaHFr+ zg8rsq0jldjUoNm@(tVmz)Y*8sV$eD09{OMDo@!+8(ttOSkEk zc9@P)aXam7Tq8n;i`QUk)`x3J}}H}CtWsPT)GDBZx=upq}OKXnH)lxfA2_`wQo@?)IGj8R{Q zt&&)o3w+UUUzCJiuDE5rQ=BMfa+jY-6#)*1qE z*wPl-#u*{h5G$+^V8Vpb}s7_zdd+=mJ)v?l&;3;-kW@zQrr}%y}Q&f8}J^%RZc}Go#d=oY|UFCRK`^fI^awne@7eXr2rR{g?? zF;Y3XxWd;gG+MgDE;iS<1neH_v*2gkRjRqOJYIEth*Y$F!N{F5(nzwVs<-Km``2QW>NW`WfTB9?s&yYHd7*VCLq1ZstecbVS-D zyS-a4I_6b<_eU(OqVdb_=29YfYa{l+&^38{X5(#M-&CS|kM|w(C9ddTjZ+uyXo96cu1#|Nzrf_xc3}UttIUz|?1H*BR+^7^2Ioh2;3z-z4G-Wuo z@mlxoQc@$Kuq}V$%fH;gt<@y(?{YCVbj` zVHgw&9}HXk(ZVS>U5(6+)~JU$Pa=kH8vyT#yOFVRLXBhMc+(9kXo=O3Uu81hy^Uw2 z%~H|6)hnOWeW_^!1$XI< zIfw}pw>-!2v~j`BIJBKmw@m8?!?A(0_C*1?f)mpE42Ztx;nU);;^k+{SHDK;_A^^5 z1Qu@-`wK2$ZjE$tC-E(D^dJhZi`m@*hD4l_Nd=0#C{AN7<6@MbzLl2!4*xy^K z6YV&q**COG$~WfHse4=~Z9d4jKy;-rrR?305jnUvSonz`+MCo)e9V*4|BZ8-UKur>&1qDs^#m5VhmOwq@#V}E9l_`Tl4{96|KXyP7^BYfJqaa z8|$I8oXnYGHxbd)k|^I5&F(rc8+`H7cJ;(z&OsE;o7?_xL7lrH6jUAyPT?!MDlRcJ z_V$4@{BN6#&6PCgH|9Q6w3y`{L^lu1)9$5|wNQCv_J_AJ6hwg5Tq|%$z+>kafm zCa_EnkJtOY8g)^vdUc99B$nMoEVP{Y!wg)M5f-mv=+zb!P-r}|)vKj+%*FJeOIvir zqcR+sWM$-iP7DHX^w7VY(cXQ|PBV&>%aZL5Fom`VQD7oCML!&AItQm|@0IcJ(@ zcL}!%sUy$2Waau8oYGa?6j(o6(xM=O#umZ9%9+d(lt`;L*k6os6Z0F104P!QbP2if zO%48t*o8qAuKq+ELkFzx+}o<1D>JaR#p~5Am$aF<(S1*Jtp4n!NpD=ZI*tFrC1HIp zbClIs3`wg@;FviqigQSHIoCOi8eq_-{5!NJEsge^Kl_gm787I; zJ00r`fjtyG4lsDfN*Q-^`P$9p!CsN8U5^8&^%0JvCXzF#t*NyYk~?q&zS0AN-eh&L z+Ubaf3y}L?vEQdiV9PwpUga}0x>Z$2Uf22@bN#xE78!&pNj)m(JJE_ndjfv0;W6}m z%^5pIfqOpAY?6^vLjo>e6YL5WG$T3XehQl*Wj-y=cYg>h0YN(rartjyqlYF`wBuH! z7LxV@m**!zASnfGF_7hq&jg6_urBx1g+b|7D7;ZS^gDi0S8*A1 z>Ldb`V-zS8tBKw$hs3SuJ@NOV-CT+n)p@;%erO9JS^hX(3W%Li@V%Wm z(9&aO$Mam>AoiCMQ9RJ6AWlvOYtNj=fGE_oih7Da#iQP1k2xWPksI6E_!S%`n6;zk zW<|fmb-XxbqEJotRk4x+=k8igIyIADAigMj@Uve}5e99z^$Wq0yIy$l z)@!HqdEIkk3EX433fU)z3@yVYN20K*7Rzo*@$!uD{kF0%Hwf6dAP+@=r8{;mA!i?X ze0|w^`ENJbS9koG=B-F0)3r+q9v?(SAWu_;WEZ_Nt>_&@(Kexe^j<)kP?;ZpjPu$L zxAZq%St*`5RXekZ;f-c=xh;I!K+jrBI7+#;g)dQNVhi9Hn%FV;BW}<6^h+~UY#czb zSkr`%fl>)l&x@tSiOBN6fog2KuDUNx(8%rjHpvQ^nY0*zYIGs74GrO#=wOkD~u+jJ0%;ygTrC-*_FTA2Zq zoG|m{05(VzHLVWH{j`iL>(z8zYp8Ud0yKS{QI*K)yY%~h0~R5??9jgjh3{Xd1KaW= zM$t|d$xij5IHJS0`z`^;?IDvZFTA*DFqw)M2WxNWw(#-9&P!UGFU~ri5Fvq4w0b zLdFEq6lVXadtqmf96j~st&#}=3evCmBIycTL+OUSPZfp_Qx^e32iLhfDI>ScwwS*+ zgq?l34>C-5!qie&=@#p86o9n%9$d;p4A~0x)_TDZ@4xEP1AKdr^s~QPFKOc_@0Spb z=QT376o#k0jv;z|x4nNzMlbz?IdrGaF+BfSK+|>5G+HQDoHAHSf8c58NV#p_D`a(M zK)r$bh#l}*uP$>A3S>Hg5P7zGsQ_xjI#%sV-qn2g?z@n-kxHq2sd_I@!J=n1x2c%0 zQDzOcKA0i7zv!k(cuk&$#lTE(!IIF?+Iu^>Go1N0S*t7b1TL#r9BKC_>9xkPw7B(E zcZQoR`gHZ(e5_l~=j>Nr=@3&r(`V6*f@l-n^=t;fCZXq0v(QldD-n_C?}iCv{z$q0C7|X9rZwNob5-$f$7qSz1Vsir9kPev9OIjZb@v*}2fIRZ4U!}6e# z>_10iR-S@=SvoEdshNDuFl0$D#c775x3>yHzgl~m&c45|h~1~4X8OV~e*QA`-+8rP zcU%Ek@T_r3=N0~T*ZJiFWlAPx3NinXFHCoADoB{(n9>)T?hLKGOWdxugK2IlRhr>K~dyOcDshTTb^J`e&AN zl7fz_@6)g z`MWr*3`Rr2MRnt^@xb5TDc~&&Ff`d4p8xQ2s&im86pR7q|HMjuf8XEYOyw53bN>HF zW}j_HVfi1keCR?|>qRJ-hJ9a&jrjt~f95@+Pyd<;@nxK{ljk2k$=&M|jH`FoPF2zU zYIVv@V5E>H4^1oCyBUXKcpVB3|7oyH5zwjy{rRS8qkn&szkGdyN?=|7ziI#9RrY`Pw5M6m)T#c7 zvEP@a1se8^-ik9UFp2yjdkau4(3W+4UGu*NG93z5Sc-Dbv41VFPg>(ZF5(Ke&xZDb zxxfN_wIgV#YQMIW7w!6@LFL@|+)Yr_Y<(hQXPUKQEEPo{obQq&hA5Ygi$-w z-gH%RnVSqpMT4zYh|JRWnz7M3mpHwCI$I`QNG$4IVJh)Z>Qa5e#4Zn4}X7C zD|Fnz;zSp8?RnWPy`c*p_zSOlP-Yh0)>n7K5wTU8R5B z>{j3ua`C-$WB+yv%Dm^sgP)4|67$8x7DO)i#>G79b4dLhXY0KAN-hVDm*4`QPj z5JRqBQR_VX@4-+|-wpIfBZ5Gu3ftw{uC7k{r=U%Ls{6vm!7SZb4a zP%}IuY5T;phP7f0C^C0|#1Q)p1KQ9^e;V284tQCN3;kmIBR-(@0;oJ>uA_(vnH>rF zGA&$yzAhX9sJMMdfHzowLrApeL`UC&-{94VMV?QQ~je6+AnR?fxKK>@4z!Sw43Ic;wU1GtT_mF1||#00^tY8*nXd z4FfEwZI9NZ<42BeTORoROppUuPlc}~wFOuGHiO7Y#kL!yz3FJJ_UDHg9=rg(gc_xb zIk^d-UWjqf5#(W&-<|(33z!a)xp^h8WC21D-KmFa0MJ7GfoSyT`$h=$DoMf8M@l0} zM*LGlte#Oz9?J7ZZ;q~A@5ehVI-sf*bB$M|i-SwbHG3%&{38fW4;w|S@c+7mE6#rX zxZw95<(0p*MZ_AGi8QCPdMzB(CcSrN;$}hnxRg%ads{XV>PueLw=>oql4s*Pj2x}6 zxsP<`Swu2)6mZH9ygnm&#lpaEZ^z~<-FRs}g)hOhVMGR;VsV;w9L%KBvmPGlEx?+1 z!t1Y9lKPot?ENDkA!fYZpXyhI?s7m3cP>}WrRYBHHmd(P{U7TCOXJf$u)W7n_A2~) zif{9sE9?Vj7A1l!coQo&j7ViQ~$*V1zz|Q#ukSQ&BY~i zzb)K}=1VxvS@8-v=sI`d?0o|Zy6={o01XodHkeyO6Pf@}h6t9c`#W>o>%iXM19H>Z zzJ|NEzJ!gMk+zJ@Q%1btp_mEhr-}kp{`V{%N%Hf&_+CZ^h(o@>dL>zS;SosHr&`HM zcs5L@=Uc$aQJ6_8Y^W%r<(b2aVk?oi4g{bo)x`|)sqwOQ?{<8v`pGJ1t0p_7$DG7M z$9*CchrZuHGOd8MdqsN0DG-hug>}$KxjH}dC}5xTiEDoUqV}rX>Mph`h&(N^HwBQVrwc=(PfTZ%qXTm zeF-uLD*cTdp7R!f-g=4u~<^PFcc;3+F}lkpH+Qe`PDMwV1`H@DZp$fSBe_J5PfIBn9e=Ig1x6 zsj;YLZpe#KH~m+%DOeMVH_3NzJc=M|kA`7Dm)=#t#nGViy40=1_0^!|-_DoJN`Ia7 z(?HMIL9!RTYb9ZXu8cuPA}rsDAAM6K;{H=xx@qv38rd~~LUFqGGVOGjKlPWh`O@|S zR|$ZfQ31|v3py=XBJczM<~*!An~mMX!=lpm>$0ERlrg_Ad%M5jnldsD783#+m>Lcn zzd>ZZRUHXI?F}V))W1?qv`Om5aQHT!hzjF9S-;z@#wDIRaFTVWY?Z3YWVcT~&TV<% z#M*F_K$4&P$TNN@fLap))XIPA2ba{wPCS{INXKF(4H;;<2})UK+<%`&-+xTCqcxy6 zdA|GC0{uf*Du8(n>sTH);j*DsCSg*+T3_abe%^)wYRt(s z;~9Fd1mUh6j<#@rgBS3-)C84EPvMhma#-xN_Hd=M<(woRBLo79LB$NwOOb;rX?e6D z(rK9e1hMawoimY`UE^;zvMXE>&41I~Yk<_zi%dUPIHiF6(1=_0=M8Ej8lUfB6|F^T zgk3vw{LK7|^J1eXF5XJG78a z1rWDDZC$c7jBI>=tAVlf`Ae|^f4|>9Jw*WXi7$tcH@BbuiZ`}U*H0oC2_h#<#?U1> zvvgc+buj-mn=I@_q##`%?laSK&q(X8=JYqKyvQEZz1Z>nDe{Yk*|GNiRE%ae1;V zG?Ss+yvE&uXh|9prQQb=1LhxexbH+0oJa?ys_1>}G~gGYJ1&(o8fQX#5j#Vk#;u8_ za*DubI3sTx4MYnF~vov;Q=!CWo6B)XN z%JNRNFXcZMg~W6znFws)x2XJ{Y|NiiS_cY*7E&EIc#ionF3GvS&`>Yl#x!NBuCuv| zI!vPq8_KT6vG!TUlQqGt1!H66+cD+q5BbEvc_l_w=Hg`UX$-!^H3t_A&~&5nmk(^z#W^p2T6{pzgVS#Ujs!u>$3SJATv>s z%6ZK6wx_D{ojopk1ZY9kY2I($*Kz0y>PT}1{zK3;RLU3^`G)Nr0vJ;BUH;g4MUfMt-M+BAm^ z{j#sTd7&J$oxjLjpPNCOqB*V!6Fv4=vx%uIGS}jSM5fX8lhUC7#zSoNplrPStijyc z7Q87Wi_6<3psc7r3yMis0kM%TC<&BF&@+*GDd3bmcH@{kK|QCQ$l;LCbN)+e8=yej zM3+C|ULCPJY8k2USas8htTG(Q@|7&ZU`pDW8fkf<&H1cB(~dGQsJ5sUR41@i>JP^N zStU@1`3CY$IOtX%U*6+q?Z ze(R&e0aeLB8uO*b)tG4U!$xnMqmGpW4G&z_kNYUR`jO+VR5hB4kJm2|FR!5R&$3b` zVI53~C00xM2)c+=-^EK3PUE~^i!o99ML~NCgrPPdI(v>OND09;2K0Eo)H+B$D#5r7 zgPaI9>}0kUL=V5#Ws`I7!Zalf$NdbmIdm!n2qPLv>{ZQOAa-*cP`CnR1)T|?CH!`_ zoa2bZEwOmE(4*YGkoukJK;Q@XPA*93h#B^iwVpC^`0A@^(larbV4dVVFqrGswj>Q@~Wo^YuX z+oB=NPcX7n0FIBufq0zZ`wi32cSi{rjETL{p`LhD9BBLdE>B#R(O+3@h`bD_Dh~E6 zWYZZXcEZYtYy}tpA06Q`-H&z@oyc!rex?Rp`{t!Nq2mkGSl2muv5MF@e`L}0>5trZ zX1aGll{9e_h8cx_VT1LXEyvKjmG_>J%pK{%3z`E~GaOi)1~`1vRQi{F|6Pw84_oW{ zr9q_H$NJOKkg<_uJ#sUbS9@r-;G5<``8v1os-LCzCMz2|5B7O@96!NuzPaT>B{xL% zM4hCWf*(BZ?$vH6x)Gd?byi+y#`PyDNk%y_-t3S@zGm zGlB=eiiRF*YCeCjTd%JQIb zol&3fkPKc8+nz`75n+t8S+i!~q#;uYAA%ofmYe;=ZeEtsp88(gk_(0@2K5^k=)>4D z|C^cUg<1FGtykzu4@7`v#Gn{61}TzT0|o~?U#Sne>iV!>8SNJ_MeT$j(`DkFC~iLA z%iTU)CLR-qQMSul=``G~ZhgK8Q<%iDWmqa!JC*-cS68mS*g9!@E*#rGtmb|_t@E?J zPz|mA376@B!a4^YdvmwG*vwkfC!Yu&13;1I%6j8eWX*-O0}i7o`Fo@i>8Y9bLX%V9 z02#!WqD*z0um?c@>2-c?9VNM*Mm3|W_R$|h={?{G=OTF(4sze@9%??#gn1;A*R?sG z{VTsl(nSg^Wo<^92jiP6%A6mf4p?_LSTE6QgDX(dO0W`xgq zMi1)^xpc3V8ZX5NFb9KCJ2UEP+@mT#FvAc|l^C-t43fMza@~jE^Ck5d><+ zFig`7E5YYU%`v|tQg(V}r-X+Uy~&A?>PzoafdFDTph5sWZ|caWBH3>$b2nrFLz=ed zh->NC5c3qESX_p-7dIbq2pg_i*%~&Djn=%@jU-@etm_Jh@lcwhx1YXS@)92=B#Gu^ zbD5F!B9_|3YP^GQJ0y>C!=IE@%`WD$d}DVzmu}3p{tCs!R>fVm>{z{aq}j9Vn7QAE zcr$f}-H$vA_7;vOn%8!wgH$C)YjBX`C1EyC&;xaenxza@$V(Y7+3R4#4lw8%Zyfar zw}*4D_sD_s3MdWy7T`M2V-3v+hxTA*s|Z~eQ;{=rfHY}hdxCBa2olv0Q`8HZ#s8hz z9>6beD=O?$#RNb*{QS6V<_Q!EIVw9-P=ROAWH}X8N z3MM|1A{lS^KP{^+l_!TEJMCg~pFFLjN!JKrT_n2$erfeOUO4&L2ir&8)I1N`yahJq zjY2j?ZRba|zb}4#J#s%nog=;Yd?ihyVy#ye5?c#XeTrWt$#=dW91p`R zYNfi-ht^Kve;j)y^XA#f$mz8wUP-`eytM|AbJ#Od?Z>n;%Igb5n(UIh>QB;5HN~S! zPrA!j)uNy$&zNOiUb5(&3}CQ-MJzPW38pX%%g40PrBs(cVoY8DV;YqB zaQNS5A|Or)Ujqywz93tCM13qytgOpqy~-7^+MU?P%(`jo3&W*`2Fi65f-^L2bn3P*$oPB- zpyAt?B90(6qHb@lz%WPLBnIQA`xCjKK&4FbW_r% zQ%iKSy;n=Y$~Q%SLsrrTn>60DyNo}-IwM(tOR`@E!nIfQ&76bnN&xurzAf*4LGWYe z%&S-SAVp^()w16YbL;>2+mxmXQbvcL&Hp7TIv46+|H6GB=SH#Fc;Xsw!oRctcCXuK z=L?^^I8S|x56nY6*$y$G z>psZsq7apY*BUTZxZFWBeJjPBJ`mfa5}dT9qBHQJg&}oOr@q>3!T#&>!?JWA7j}j7 zq46&<)fG3L;?b3cwuC*pt|C&xh zaAnhRTXwecSZVp>1?Ux>UX%4yKX8bj%9}R%0w2TBch3D{8~AjxlsNf??`e+!p~k8p z=b6KCExE>2RqbA{YXV>TwW^SgXVJz>Lf?@KgpFcOaCK^{aanDxltJ!aT`sWb43riq zl54dQi|%)+MvM4xc_m6hGrM7K&x{Y={TS5f>Lf->#6BiOrgt)HGVfV*BQ5U)I9mZ> z=CmDc$~17bQ9J64W6h=%QMz~ddU9oQ{MKm?yLhXICqzU!oUlOY4qs$$dGYYJYB&l# zy~5AUPEIaHD<+S?pm_LyC0iuGNkB8IdH&jvtFD|;h_}5vAAThilha$6sn0YQp;&1$0^FxtN(g@X9mPs*q^_A31CwDZTTMG z0o8+CXKPPRXMzQ~H&l3HZ)*gqh4`X^Hd`sDP?6OtpMMNCC5a^wc4lNzK}D;2V(82j z=?3x(9m=3Kb}_T%^=L^l@&RXY|^vDoQGPE5kYozqpIiIZPdn4K`uCPF5Prtpx}kLbNflM1-s_*8Szux z*M?I)hh{7Exo}0~Cko+KOD8Wbzfdyv+rQ{TALg{rJBZ$_ec$Hg2zo)j-tT{TyJkX5 zv>2n>WO%5?U#Rn4@Q{9K*w-h!nw6cIrl&x$pz9t3bIh6Rk9UEN(o;nQ!|{f#8}qm< z$vCwtx>U5Qxu2HRq{1GqPBj$@P8LU(*)1M~g8wOi$R4~r$}<|juG3h5f@=iJ*M><% zVd9Yb%%wa0u32*WaN3xaQ@Jpzd(Jp;45X6-Wy>}Kybmq-~gXS4}d{q{)NlR+hwZ#HsH9=F8q zMnusCA3Oz(lCP=NcIf)a0_m%-6AO$ck=1vQY{*no_QX`9! zg`ew7t_`CDTvcGzP?W;(2<SiGjAQe>6Gru)*wh4W?o|vs+JVkGmUg9?*CGY`Z`(U2kBFk3 zf(QGBI_cLGIHZ5J8WqSoEu;l}T}k%cJ^giWH~l^u(6wPFEkXdZHQD0M3Dr`7o<0G&mpTAd{7oXOEab?sZ2S%&7A0_MYSq7nd3G! zS`VdoFAK&_Dm8P#kX7!hlA6?hs{u5x_YH|Aa;r)B<*#+`66`upmM~%-NKt{_x)^5w-5p$e-1f*z1e06}l;lNJ#8w2#%L`tv~X{Tsp6v#sBozD2-)qlKoeKG@WTSVRvr5_89osw#M0qzLI8L~AzKsP*b zd5*ba(`C+{Grs;~t^?dCl1stl32XRuztV6H@e5mWmmQN5L)fwa$2UK!?_}+bodzrV zwq#PW*$3-mFwLq@>(8oC>`)(cxntkZF>|wS?XZoq@7Mq$PHc+}@Cl+GQ9i1~!=xUP z*U^zMRWDpQ%*nRZM)i`}v>|uI(+v8@XJT1Qs=kvSCm1_c$vXUq8dpi@6uDKi_u_23 zbt0>e;wU&WVKz$bR)}rUAGw(^Gy$x2R58tcReZmM#t-jOS)3S|BXu@KXO?`SV;D7J zVybYRtKS?bl&78!&Ucyt`mZ@{!z(uoy`mtb?F@iJG>-{gA|2YXk%E0Iv~VSSE|fpz_V$EffA6MR1jp$hZ7u8vrU)o&9eJQl zhg#pjMd4yCsv;#D-{U(G%+3K7F?%zYlk%xPo_Ltqcf{Gaqe|TJ8_&x@=16``lQlRG z<(FYmAhiiI^>D3wTF-840vNkxa>5HE8$P!jc)N&jp*3^DgobQ;YT0>�d?bvlUe* zfH2_&0;=C@|6-yNVIeE!3czL)WfwlObbuD$CpwbtE}U&s+UG+WDthh;#REyqg;z1p zCzeY)uS}4>>?VP(zPRL#!Qzr(E^w?* zRmH?hHnAZ>j3S!Hnkf4N$Y!QhV;x%YNwb1Kh^hn(0=G5`ka32^;?n1!5o%^7e`GA) z!zs73(QZhN(HR~XmqlBEs|ypYmZ?k!*}~5x*U8Y?gKFTy?W;6p+v;KbS81-MMr(}q zsBuGI3;DKWzN_5M2xCUwkR)g+tz2Cv!!T9XfY^br3%hmTj5f;{A{7p`*L3!oRipcU z=~&pM?;s*r@)G4ZLV7~yi9SGmXVULs3$bg^zqxt+!!3!5URi)A{U!=kh#WD#NW)-PHZiTB?z4h(d>)fL#&`-LPww3YG*C1BE zK)#aq=WEc2@gvVrg4Rk@3+uX*u-SlUOqGSsR<>Pg+_%z_iD}w{O3SW|?WCb42!tA&q%==OO z{!j1KjMSX(UJe%%8-66#_Y0y)pl^4+kv$ac`8j3Qf3|QoDDNY**IdFjmuWsfKVQ^G0R6uNZY+l*rMjE&)Z5Ciot@Jk^G9oEvKD0OQ z9Z=moQ~TtGz3V$rqW$K>x3vU&zP=Z$JV?y`U_vhcX*7K6oWQH3^j#1P^&Me2ao+$+ zH*f{+ZexdM!%1&2_J`m@LKME0uH^D;8V}<})wq1x>H0lq>7V86U$d(;Y6$8DFIC6M?o3(gFFT$IO^yGZbabkZdy=tmksrYk>$8vZ+dqQSq3dsg2ZSXXxUcjK&J6GM z`o`V)xFt2;)Al-&Eu%!#v<6iDJ-d=ou3hJ#$sIfSHayo&golR&#K1vFjL{klb;o5t z#+_F1jPa@?EDtu+?)M?gm%BdLpr@_rn(-I<=kDM>M7UZamrK+&M2NC+98|s=^WE6f zxoZ(}EAL$t({+yj5tvT`eGVxS*UtPxQdD-P=JCGh%dQr>{^^eL<7~6wC(ISm4K6R5 z`NeBM62ixkVl)T(SyIp4%!-(a;)yOAt%BMh3jL7H_Vu<9ux7kc zW-u8c2TspR_Vr{sZu&TeaV?KjJ7?|`FxYcTa&4&)Dxb=s*xcUp4`?rwAF!t-NopH1EKE6vXT#uMGe##R?uoRVJa$+_6M zhNh>Yw-AkflN@$ub<4rWylNvlQffD^7IW)_%*>Bolb85xMc$8hk8+AX{wUk$=^CQ3 z?l@oyiIwaZudH;4f*1IDt9t{#Y2$0x(gPB`$8QW$XudLLNBm!D)j*Npv| zM_~JhGILpx4HcmA=lxknPu+)Ow-2+H6EG1)CGKbxn9-#pHLec-z%X!JjjP!FZ z1r>$_trOz!#n^Mt-v~L3-pgPRb7lBWf;*JUd@;_|Q%#>Fi~n1V?bo!)k2+_NJL=s` zp`7P`h+dzmJ&nb<2g#?Wz3w^GW=x}qSSSsCQ7;7ov6#@Axh58ATKjfsS8B-m0sjaL zs8ZK=sF#Up8!8oeq8;ck%$LA%#mN=s!OOaGWWH>g zdyCR;Ze&kN;(jaWO@vp}P&Gcs57i&=sUX@2A7}A3k@@4CaskG%Aq`wzljpLG19LVX`BJU&227 zvClWbQU6)fA4o>TrCgs;!kmtxbDUkDb(jlh9I}qrh&@;lJw}vkZx7Mdr`^QksTd>G zh!e6EyNh;}Rc|^7X(%N>(wdqyIswSyEW?m>D8;3d<*KO&X5DoM5RWy;U-3a-q7Uuy zoKKnVD5!&#NN%p>`zS3!_(UEEU{B9`Ej4rdI$=yj?0r(FKuv0qc&pp#iRb=O?9$xB zACjA}B$OZ2;zS>})gO~3LC}?vbtV0`sG1^xiuc@v_T!K2at#+e0*=eN8!$frOucEd z;@AtC^J1M0ziZ1{rO?mg=F zVCtDMoArXClytX2wKl?QW=eEJR`A4unzuHq)X`v4q#fdw>67b~>oV6q&v5>K?0sca zTwA(ra0o#H0TSE-1Py^uK;aN9I3c(PcXtmVxCM6!?(XjHUKGLIDIDHTpYC_NPv5@p zjQ9JF!C+8A)n0qqx8^s$IXQ~b)Zz^SZ{+A4(01#;DvX}mzET=B2=fQebf7g?RBP}R zR@RID#(kWPp9gk%HQT*#AIy(^ql+_GMVm zPy!l{1jK!S>vr4OXF=mYNu;16hsX}P19+=G*Dd$N`ZgjaawW+gl5=ON#Xaj{D`#BM z4799=1)11mO|cgcw%R-BuiJCoQIE7=cKiP>XIMeu{UjBGY4;y&bvbOrDE~g+moNP2 z2;e=L#Y14XKe@2IFf>ak16Ek1MbA?t1%4%O+^5J|&AX$9s0aYRO6H9J#xtX){qEdn-Ixt?MH*V2o(O7NU3PpsF&g%OE#Q{l$ zh@%I|clZncxTb&bw*|Ui0~9QqG!m+RCT9KSX!+2Kri+FW8lKgte=cv_bo?i(>fiUh z1l+t-7bVj_f8;+Ay#D3Sr*S}!{Nf`L{SS)g|I%21qp12DD}u*Y`u8vXm)Z08??|@> z5C?+8O5HF2-K+lsLjCOx5l8?9mr+L^?_Y-Ke<4+W`jr2@_&;~g|Gh!~^POJ-T(8iU zq`QfFdvWCHv#X*sDLzEv;Qiz`K%0-NcwrD2RE3QvKTt9pWi0$f`>DSWb&QAdr&uBI z^5flRi`@|KWwPB-{ow8L<-z4u(@1?~+EGFR+aBA0V|2FS_k_01qb*YrhaB#&{rIfE zZbLg>_W((~LW_9v*M7XQ;FF(R!UfCxCr4;;?>}4WMa2OZ7JUhMYw+J(^`Cs&{_&6x z)f#>Yg^~L|xmW&s6UDWF3zJ=T>iiM;7n||~?TS1C5}^K1U*Z#wT4f30rg=P1c0n^= zs$)IlBTftXbA$e?iR8nm)+o-28HOT%y=j5e5wAZ;Qc~&6{q_H$j=)E(L*QYeW5fJw zT?>o=pRc$ph|V3)+2H^Bzf_R}1EMN@i1WXi_;20$r+?b1CDrP z?O$EmMbz(~a+KGuEB!?f^pvb?nr|9w$$b9NDbMRGLuXRuA!oAOpBnc+JtU`ump^zS8wqYz z+^R>2eA$XH32mS0C<_R{264F6&04}gKlb{|ixnKsF%32Zv2N*SF(QFoj@q*R7D(g( z(WxxJ%`UDE()v&g$!ohJ`)k|U-?oge6xcCO?d`OP8rz4VrnR*pFAT98n-_RV%WSJ> zJu!@$q{)2%s_4feKvX%I(}vQg{H^g{y71N7v_%@= zT`E2!;^To#b|L=NeidLx%uIUXl=c`)KZekM9KQ(Lph*lkUE7)~*I)G~NF^YXP9t5l z0E#oz4Y8bdD7o#o=_(8c4HFE$B?09y%F>=|sx=miiLXclNB^-)|35acW3t!S(}>O| z!M5TW@jJ0Mqs3<4I&CuFxo1Wj`SE@C_JdWe|I z_Pcym?{`2|_&ZQollzhI<(t3v{?%*mH85ZtNjDJ7#86=rUcj{m8j#v~SnrS417I!6 z52h{onvFGd3RT8A?lOFzPO;}2ol4c56JLMCA20E6vjIf-)B?fI$LUu9C;W?gQL z>=*$H2^>Hh(ZA2j({sE?^^9C>Y};uwp}y;NoCeMp(*AIjJ5d}y2sJ;PaobXvt{C!*2NfYEFSt^rq@Q+R3ipPbc2(ZpZ`i&Ivg3prug+PcBJJ* zngD)2{GvX;(+%xg`8RDNN8qEP*T*(~Kuw#ELJ&WfXiyxs9`WG~oZ>MkX?l|ZwhWbdS_g&(%Uk`qQI=(B znlv-u-HWb^)-PU1C(d(QsYK+<3G8p^fDbXWYnR7<{s8Rx{aWF#-EJs7#O934O{e2h zM*xQp`h}Wi*%iWkprTA6BtmQkk6A-yC;>cr`VEN#i~l_0hSy=iUOTu?@5Jo2H|SMr zTe=TI_gAzvBn~8x7I*)?1U4fD9z}MG9-uBF(7|jrXr_4ad#~GtWYCtixbI{>ji{_G>m3}pv48QULw?o%TyYRWJmLeMUDKEC|0jGBznu2B zk5mWIegdD=a~49DjSg;Wju2Q}Y-Gk8E#b!18dxs_k`5(5f||3F#5*KjsB`yk7JS|GvW-5FN+(Q&ruN1Q%q#41smZ1>rblpWX; z6}WKjo~4AauH!lKOJ(1fOQU3)Z(H*6mX=W)&5it;<{a9d*FWE1djOJ2K|o1mFd!KF z-Mu1Qg2JbYCW7%o#jw<<{Nrtm^0#ju&Bbcfu=j9>_$#TrZcK%|ZZJ+6@88W{p{RoV}*MJtKY3~IJolBl1lGBZo5eNK-d#Ft{P+Jqti zvyUK!pOS?zi;4>IVEg*%SHQS7InfBAiWd;QMc$sOY?-2V#tQ^_J@+_o)VeC0Ft0SDQp9z$_?ikI?H54t%E^ zW3%+!`g~jdXDprB45NaQ+v{o7o14ATZqxjydlQ4qF}vp@in{nQyB`6$_LnchAACrT zh(Hz!{0@n&F$J1qeZTcfKV%5`S52lfq{7kb)R@m_I`00UQ&rGlnBN$P8MH--kq}=4 zR%{kYNw>!Rn3Qr}Tlh8Ne1&}TdRs@c3-e>IlWu}whLSqUu2ked7VB4OZ2%|GLfV@} zqpr;XF41$sY8`|V4UKR+G|4OBX%W_4@uH5%N7eBe%nIjaUYzAemwK8V5JJo)1c;@6 zs4|_GwBMd%r9&%n^0m$*dr7^&c=?LeZHAH6WCFaZHcwXZkrUK^ynJ91wskbhr*4RJ zIitQ7WvHAIL$`dFi%Kob3)3z%vZ~*}@8ya8aCir+yj^6C_|ypqYJLZNT$I+M#DV~W zysP10Kjc6>hS*>Xs3$>%T>oIHa&pz63L-wE3ONAG?fD_5|QT=UcO!0qL!6f-FZFNGdd_*Vx+ z=}^MGkJ7%g)`*#jPxxIFq%{M+G0}F(rbe+r6l4Yn+fAcYiz-WlBd-T?{m!Ki3fYSkF#n4w!E1o%T70!Rs!h)Au>0k}o5AT~ zdX*^O6x|oi_W=PpzFqZ_b8!7)wx7XP@6rT7l#wRNb zj}0ZW3b&=Y+ODR0JK;~ZCSHChSf9b$<%x&EEXqi{M4x@2vo)b=76I+DGTvsUO;JGX zBd|#+S8r=jeTIQv!Iye%GlzBz6iKT-Ijmd5+-m_gQ+Tfzz=?85@X5gm5Cr7xbq)cV zyc5_PKd@)O?VsM(hxS{spl#8-T5eRn(XU>t*AIA_xjPK9I|YA^KPMxA-_Z=ekK0u> zc74fZYOk@Jq)ZNoua#^wgUmV6cFCnY8w2CCLHz8a&WPzTI)j_TnNj-zToOP@&4)CA zPgEf(Svj=qD1PM1{YKl>G!y6IFoRe4<4?($^8+s!;o)Lr-sN!`QtAj+>Uawr4f9MK z4aRcg^S)ifUk08y(Q~#m;C1?~CRyEY>OpZHyTtW{USA74Pb9^v9KlZepR`z?yHzK1 zhJB*fa&oj;}AfAx(WFCmB|+ ziojh+iE<BxG}~YTGpiy`on#wE!Zt!@Cx#7ffnW(loP$+S*)cAgdDZM8U>n9+!!Q zZcnRdnpME0um+5FgK^23_1p+fu;5d@JkR-YC%h+x3aVVImZr_svF^of>~5{f=I!N? z^5qSGHp=cA#Y@!AFek;Dftdcc0ZZ<7N|QmCe@yIz?@y`*;t<6?ieM5$YVga%sfC(kI4iAUnj`lLX8NLDgn8J52Hd&l;isPC73Qx>uF zPGD3>=&28=dZz^72Ai z^U{>|%Es$lyU88yde&(3p8&N|g%Za=!5Vh~d56p%pDf>Nz(l&Fqh03U!WQL9Y%;en za2?Oq_kLy({^SkHX)BHO!c99wYG!y#FX{-vbW-hHC))1i3dvCnjDW$f{j57x_fn@maFK%_}I5ZBss zA|*uOCnG~lic>H zP^NPr&MKhjc;X&M0r!)zE3vdp<$3SCd$nPx>1Z6is^pJ26C24!z8U1;H|6m!M&XrQ zfaID|F!*ENmbYW(AWOLW#OMw$H!s7$v(xdJV)d>Q{oZLX3lsF#z*e5lkt!bE;^ShC zrQ-GWS1Em6mnqrqy%I&sYH+s4bODRfgW$Zk4jco1p->sP1lW>xms5{oG7ehTdczC- zQ^7S>abl1A^1V127QuI(VZttUu9mIWv$0>((}2pfXcd4(9t6iY_V`Ar;D>^PDa*$) zG1cyIT$Q3A{kR|k7K%Yx7bRp}toGH}(05Rw=zv%U?NVH?9OkxeH!&z}GEoy-?$)gC zf{U2qFuNlorjPeVO$0d6O&)gNG>gXCoQsXd-Ooh5W2x)k zoi0SWiFcNTRqTVB=TxheNsaVkY2BK(2Q%+h#F>eQe|Bp@$))9(T0IsWFxW9ggw0O3^p08G2 zu$C|iv-N)~zop|&mCQ+EfG^Rora5{u>;*gZ-C6>?zzFv^%O1V!GR2?UbYjF9czC!r z(GmxXEUXdLnoNquh!SHdmn=;eEIS5IKDhTqzdY+;b%*vle!~xWZXj(Tykiv=t$nbZ zsytDFIb%|$eP9yw^8lxWIZ({QX1(wEw3aqYI5UrI4aUc~SPO=E8eYYMLMPlGapH>s zuuGKco11tMcl5E%9=jDHM6Rnr!9De_M`9ZTpuC#sW*Hkvq6P6tQfS`&T4RkRL~R-> zNR(H_qxk9|LS?$ht(wGsNk%zj-cphmXJW@~J)l|fO2+VpWT!=l+T*PoUu^&pn({5U zyRv)X^X$&|s?m%EIR!UUpccY^w#0PG#n_A6L*G96X7}RoV2Luna;#LKk<3GdX)OK; z1}V0=`(OfFZjFL+)pX5(6)MNi4AM6=i)L4c4b}PkM;-Zx<&AZ5cvIrOOAk_kLm#^NmQZ9w6r-43a(Q89Qr z=JAhQz!xp}cevFMAEXudxbdDTBXH~oki%hiO~-2kJ%Psu z3K`mFHdPIVMWiuPHuJec3K(#(Qnny%>~15_!UlHYGNMB0wsA8(0cj$FQGB0I4`JW; z=TzNXRRYqaA9%f!O*KJFDXNZy@l?`y(=`_V)j4I$!yN=p88#KQlcO* zI<_|wA1|GmQbH}aVBi^dhejT)^!ki^@m{|QkolE07b~{LLwbkf51x-W2MsoBy@PC( z>UpO{_d9!l2LjDPl?Bl|*5ZTV!h7C@#q#Z{FhVW`onJqrpAp*Ma8gQTUwGAMfA66< z7}b~yY{yFRs=6OaU_*Q$H(qR^I(yeObQylR`*UdMG5sLV3fdC3LByEm_JCvqFt?Jl zrbM#C_!IAlUc{du+(%HHUS*uD2@k?2OS@b)V@s>_iFu@MTYSZ-`>=rW%vnYN7iFEH zzAoD=ZpC%`CxtM4*v2EB*=xxk&-Rcv#`l_&nzHh5Gnukp((Td@!uYs!%?R?|k%3|F z8*TcIYAn=H5;Bhb_)+ogd0FI57Z%T7?Diq1O-+Or;kE`@m zYT>SwwwwkfUUhyMpDfDogfKBVWxf4_eGsB7=5?)K%dmGe&S+of4;JtL0EgHy-_QJPqmilE*q?M zVP17T%E*F_&y3S-aDN|T&JgeGdf44AEHpC40inKm0E*;a+^>T~yu604Od&40uDLl0 zEub{3>!6r|`?m%IUs!hzYO8S_4(7`JE{KkvA5Hd`I)2%VsVeewxRX(4lP<5)?3jLi zlE>ot1J`VnA4I;+Dp!gXXVE!GjE{C>L6&$lx}$C_!mP6R`c_@-Eq-n*$y@cy3)lDc zMl)~7z{D1(p&D}ATUVk|H5c0_-w6q(Y?5Y=K&h$b?88*em!{x4f1m!bSf)gE9<4|Z z=H|BNo_7^a!M*I^HCTq5cABzO8vGi=PK2d3+!HIgqdvCmLY`UVm0Lp?*QD*l2h%8| z+j%|Z8Pioo8q^1`wT_n8@l8^yb=uuo#cS-O1j(cadFFd2f}fN>d0|sW^62OI?&f7Y zTAW!z6~@8(#wS<{6xKVUWK zec<87eA$+KeKM4eW?f|8^@V*s)$MRxYxnb7b{!_DFTFGoVV}i8EWZvaQ6X(d!KKdBZqn9YAb87cNM-E$KU9 zAs&|9Fak)8sW$=c%Evfn`RMKVvEDD-+|vUWnz4_?1E1$g@JLTI!DA5wGI=H<~8tT8)PJ%T& z9#V}0OleW zU3DDZ4q3D;q+n*TuU}C5x@EaogHe&<%0M<-;ZqY-HK#=Jwf20Cm~uc=u$1l?ZMj@EPoK-} zzW*TR(%snZjpX=6rxt1VN%o#97ndjGVm9B}cAZnW-bdTm&^tX;OUjhko19FP60lXP zLcYeflI9xsh+LBX&T+BY9sH?D&&H4 z1GjtNq*u8B$$>tva1W8>^+a>GYQFgF)8AeHjz5bZP>cqhxTb=Xps!ms&YzZe^*wag z=8N&R%Rbz}Nuv;Gy9a*n3Vqc&>%s1zU1jj1v9l~4;TrL%T(?t{vebR~{?_XS`i9~4G$bakPq-QN5rerO^Zs=^+A1R!+`Q@-|9W~qRv z#|bQ3B8Q;Y%~(<}!4W4VK=-l>*MpJPbAlw?l|$>g)Q{0l$L|B>&vi?UGq>6LNk6>} z0__5;;EQwUAMyG5+Hp&ItJ~vOq3$*1oG`bghsZT2~elV$j#v9^N zXq3o~igmEg{;x2bRff4sL>tkd;+wgf{w3Q0&X8Ow$XHIBF%msOF3mWw+GG2i$(x2O zL{l%0s>KYuvS=^Gl^a7wnelKudQ+T*<_+Lqs8KFuIU~sX-M<8zQEOsC)wE{HgSE;o z7>|VplZ1zwFK*2&$)JI zijAs6w?>l)s_LZI-t`WTZw3WiW_xiBi?cAv!XU)}3%NDj(ij;U|n z!VW5jZebpx2_UnXsdt^yS)v$Bm#Bk#rADKqvD#e6X7zxXTA_jEGPx&7>L*=G)!|g$ z!FO?m-i&rj#phb^kDS_u*k@dM9BG4fR_zuhpQ zI80fUO?j^OY9^fU|1HPqGbAlgAXl;bpj+BPcv@CznDSuR-`0)0NOXu9xy|U$Hnfn?@+U6pG5W#00Ls@ zerOh6;x2jpF%}UiBMlE``|e%$UDzPxSpjd>ed4bHiOv_<7>*U4sgx)lz8%w0qXT8k zDa3iV`?r%{VIzQ+BIA~A#EdKcSIyc($eWd-4>DKkuoYc`DqMUPE#fbXC@qSvmxl(| zopxrCermB?t8Ujn<9sKmrjJx%w#OgcDoZ@q5N3(2iZVOCYUgu|K1By9_}Af)P3Ujk zT`y#1)ms$2tFo(`%AFzaOaoyiOpo!KROUg<>O7H0 zDb&eCrI#fxe!1LK!dDZa=O39~QCJQg#b_`_Q7Q!?*9(%N zZJ<1;vsT7Adu${O@dI8>Qna0<=aGPXTx zrZ_P{&@>7meJ@FrU#JQthbSQUyc6RdZX#UoztY`2QW>PZ+2ocP=9;k*V!w##M|6P< z6<(1hK|hA*#%B)3G?TJHw%xcAEMsiAuJS{t-zVC4W{s$O?#-*5rZqRswU*lIrd}l5 z#wm{3iJl>hezOhaUpLC-=aRsAaSkXw5v=zz9??}AF2Wgfzc{-dIznHHw|G}soOADX zJ?(-t8u{6wOeSt|T1t`8f}pm6I`!g1t)-@77#Tn5Io&qGc9Sj(!X`MZ%EP#Y|LY!% zDWaFL!1>^SD}_@tcdl1lzIEpvI+&~cXLDXnyv7%OUaXc&?E2%;cf$4Wk**2v!^OMZ z`Pi()CLG5ch~8B+wBs(Q$wRKA{Y*oYE|<=R{0{gX?{B-gSvoa>6U5%OSU#O7?nT1B{QkUC zdhf-VX5BPz4pCL@aLXa-yx8QCy!J3Ryp+8<$*)DE{rmIcU;Inlr*mlk&;t04G;{^W zKw+Wx^_}-U@xhycTQ)dVe!oObKU5Um$9_0#gy(1=34GFgquM|!aF^%h&?4g1z8|iN z#%6h!BfrIe3u+@4+c{rBcwj{4x_)HZl6O z4mTxk-(>Y@oeEp!VaHDI{@RTNe-!E#c!%E1QH-NihFvu{MgIP>au8Wvwoz_<_ib7$&(J6dm>XWj) zdMIJ+weR)WbhG*KcU3a4qQj&CJ3s`&&v#RH)NNkErfSqkF+Y<;_kzQ*QLt)PWl8t~ zAzMDHXQss3VC57lSWnd!zM}B~b!4mQ(_v6Rk(AP2z5Nc(#VuyO7Ot)OuIlz+9Ezhy z>5pA?^2b~4gYQmPZ?Nvd{{YB4aoS|ensJ>L&P`5He|RImx)*RIV0FY3GH|8#g+NEe ztld#MI!;KiJ={?at2uC%gooC^$LfWp-Mom6FUdW_j+}RX#!XwQ+=jsb)f{zy|HpMb zj=g2iNv}5V^dnBkA63zf2~~Yzku5Q%YWx-K<2;LA-U}J#sslvH@9#y@Xr-y3mvd+n z&9_vsPgM|~#Qad(_&n=;2XgPSW{4;F zxnQ$T4nlHiX=U`oJ|4RW-$A|vB22fJS4=3Miz=*QKOEp+6u5*{Cp=g}8d0iy<$LYD zsM8OgfN?j35J;pFweF`p%72VE-^!Rlg<1z*81L9}KaSet?lfOF`yz*u^12qVy_0^t z5*13}K?F0V8w^S$hxORn<_?!7<$L-e@6xgtlefnELO#0o8vA`>GCYwgeH912l~J(Z z3!Cv?Y1Da)<@PrM*0cfI7ALx1ZW#{_H^ys>ozUtQ-v*^K@K=%)EIw;B|2t+Ee0z4^ zBaP8i-WX+Lu5z+Ke6xo8>^G^`r7pqv6s98?_lS*&#!59Wwi%YI24r($!w-RUT>@lLeTtGe+QKzqA|WJWb%NoX0Xmvh2)}$0C}7m2d?U zap?9sF($jY$5)ATTN1H#&w_=m5m6WtHAhT^eR+EN{)WutHJ!SwB-4)utXY6$@xzdS z?ZLSW)Y<7ld81Qq9crWwu}Tv@+7)etPehe!udC;Ks7%-=NVrJdVNP`8clca)Jj~8k1HQnLa=qB~=Lpkh3t2t%{)#BSV$~jRr&(hD2a%4DA)Z!hy`)7GA z9Nkvhv*&x4e5pk^(=8{rQjV9NgPGTwfi-Ctfb@*ISewCUD&(ZemMz6|()i~6(S{Jy z1unFL09gp3eLnX6DR0%iu9!1tpfVXqgU1rqpBT3^@exoP=p&SlaC){xdHAwUbxN{1 zv6U=^_$9k_Wx%x`*#UNAxRqS=lFUh5t94-Fv)*dwhw!f4+gvWL;Dw@i;`8y-!$!FG zm^ZbHcnD`!vhM1tSu5Jkzx-n-H5A@I{S+=>n4L;cCzX2g4GU{&rYz;wdH$yln%=Wj ziz^s-w3R|wt74VaszTgh%W`5Rwapuu&}F+$C?(wT7&3WG3bGR1RO<#mGm^Mq`ZbY1 zozdBxx;=vnb(I$YVj^88%K|ke%{XSwf|4{ZSVDuT+lAjh5KLEi;2nyis22^k0Z|uC zwi|gD5YxH53bVT1m7k8AQw{Sjd zU~*JN+4x(omd^b-Dvx+6UsFM;?>mC;+-p-1(U+v~4i=<$CX{#8PbyjAN~ZO7J9;F# znRp72L5 zb9wS|%Tw3qySB;(Y zos#C&E5y8FKXXWp5)q1KR)4D?T=qj-m&UIS|7n(FCXDGD*ay)Z{uIw-R<~uBE&uhw z%zXOBU%jJ3T5Mq|hxaqTml8_l7v)hwY~&}rl3%^E9<&^`$HpDTYHilsinpEipJ~2D z{Fs|n&M3QXDIuxkUtN5i&;n zk`wd7BnK~Q56tuEi_5;2x=SD%TRt`oh8gWYXv`}$~`;IqZr8C_A=P})L~Dl1A4 zOcp0#?RY2=Ssd+%_fyw~Fac}EHvR~Kwr57s+b#bO<1z}J6#NU2>w~p{lr7un4)0dLoj*E&o2A?khI9L(&mX@Hw^Rx`)U#t^=?O?gj+HVZ((1Sl8^(a)iSR&3la<0HgSo+FsYY|Ph>S^6Huerl#K z(=lsaqR2%8d)}jtpb#;QZcT5!3b?91_%;hO6cbJQl?a`)xVhxdeZRP!lIZ$w;XLaI zJ?GGQqV-;@ymDINbZf9QBp442Q3XLZ2IG|Pr*H*wNUF}HUh-?Df_b|ax=k0>mMz|u zMi8GnMcr+sS-tvLtt)uI(t5I!(iu-|iwi2*l;KI<+j|WraqM-g59iQMKo>svrR{#w z9UEC6r9q@8FlFIQU^xcsDp67lj)D>GD6t^6tt3psW7k@bwGh)U-nwQ4B{ixH|8xbJ zt->2=xJs1kb$=pjJAjBrdqGw^Ey>HN6macA zLQpr@%`pw8-vFv6i{I3`jGsd$`w^{L$rsxgTkvKpeypv;T71$lceEhf$W>`Y{w}~h z7>Ur6x@3dRK|YZ8L8S$ayU2Ktp-Q?8w@>2f3%c|LR!{cj9cy5zBFP}AY`r^`Q$8He zQSZgwd7pYcS`2~LifDa!CM7PK$id=tC5lOM6BLJQaOo#s>N<^LX@W&07=j68Wy9F> z{~k!p5V$^1oIKOeGbU(<#|y#g`C~D7~!R5s+=kK zbtp^$=euGa@03&QD(SNZW3KAT(Dhmp9Hd)4kJh^B_!$>fI#59&v9ms@Gt}%>+>^FX`bx<(Z+|l`jic?Tj{DKJv zQCML4d^ZoC*2%cXj5H;u$Z=K4mM!daRyvgQ5y1GwL&QTb_aFxUo4*nR=JC3rVfRUZnf=J zyjQj@tk-6jdmNGGPFt`=rb9+mgacmCt+{F?7jj?u%bijdeRq z`L<@GwcNH2$>HJ*0oy>ZyAt0^(j!Mm8LDvS)@>t&2rvs zb)KnA4TR~|dp(+jQg3F8x?$fWnSx}`kANH=l}D_~0<)!q1kYZuou=c!uj}(1ilx0k zW;V-sF{*J-^rltY#qQnpUY?fcjm5vSv3tgF#6QpEwq!E3APqYeR7+-X>cBj7p)UB1 z!dgT5G)qM$K8M$gW>mMd^W#Sg%ay7pO8)Hm>KycY0xqE_>}^})dTg#=jYB=r(PoMd zSxF2BH=FXLXYs7}rb->uRdA%WXQjfSx6b8~BDXz9mCp6yRg5|vx4T@4p9MTve zx*(XQLbrbDa`QB%Nl{5VeaeAt^%`LC==T|u?@UVj*Ey@dWF*Zc$8+It&+tn_NeU(wsZ%ONVv^ovKEXZP z7jqA>YApV?fQ02x9|X|_7Q z%A%lw7or;WkO~ zF}*q4l|d(r&SED&j8{7aa3*Zm%g(;MnAqy6UipBebjnK6XunfY$0J#EJupS6BRl3Z z^#S#5YnN_qYn=Ag_|_Y3t?lzL)cD)TvojROqsD{8ngIX)Bqthag&xjZ5^$Jg481{h zCCUKaT0>a*ZRlq0@_W=){`ho4J-vVl4+XrF-h4228954iFct|PHO+v2`OuLV z`>0ykihnHV8N8c`!WhDi|5JjByLgb6n0~_H{$>1%=S_a@57rhBIay9SQ5_KeCz3>y zAZ6FbyFFRAcSTS!#qgKq&sMGVf1{MSla%Dttg&~oGZ#vn*_?zqy;P7GHby?TGDTW3 z7L$}i=MDbe010?uyLSW!D8`=FQGO`0EZf!QLUp1X| zU?;Ff*aP_Pm>w>1nd;(|V4G9hfeSuziTgg*8%JJu4iyWQwQR*hO3l?O=z&pzZtkL>Ka=}^;9j^yUR_2q4 zAtGkqpMIIj8#h&A>k#+}n~IhVYH)(S9*C`%T#~DgG9J&Ye}9efo|;T11)qJ~EL{Ca zZ*nsp+X?4W!6?k_vnqvFGK<{y=c~jn^Q*Hc`4cpV-K_nU z$fhZ~#i4`6*b3>-0#r*rK$*T;e;u}HR?rQvJgB*^*~n8w7%ii_O|o3pNzO5$4-C?F z4B2Paihm@oAKVZvBcKS)XD(sMRWn9@?L}%AyDi>x;YV$V{RDZEu&@fY<@O>!U-V*%MY39ZL7Hbb{{2qh=$2_+ldLY%=tB*>` zUTCH9(SDb z!>!JDmAR_b%ejz)L!d536$_kx>*>6;&L^2K74esE{RuSamR-$~r+ezPVa+o|Xy#+A z9<;vAo3VL(@npYGvb_^qV{2=27SEV60hUmPD~4Qn>V7c8#qG0Mg7$K9wGO7P*+U$c z(3(=BkBRSa7!)m<@=bc&ADGmedL=tzx}7g7huE*1vEoE)kL@3^VNffcl-h$ski~*A zXw?cwoEu&q;I*ODJ%DwWI;9HFY%2L(D7!(3``C}>vg*)>4wp9Ot$;@R=h0vEpD}zq zf6}yrWt0V^wgsh<9wNDEhpQ@~`bb%%0%9ufty&?6T{oduhNB6EpW97@-5E~={a2p- zc(_L~W^fob%|mxE)kq9u<($qtX^xfe6b&tMyA9PEPGxc{<5uW8=^?TTBIR{cGaqxF zKsYxp(^szJn_PTGfJ>-W)(A;m9$bHw;_6HKD|=ezWeSbfA6fuWeoqM3F^G^`H>%NkwoP+gY6T{&hmIQ`P7d~qv1|7}Vk-`2om?^X?9r^cqmX%p%}8X@La zhJF& z)CLivk3JirAV{{}t-NXS1pIqD?ESG*1t);^YDB>?!_6bCJb~ zZP8A%3TY{lptci`%iUeRJL<%OM}H?(=?tN5aPNtN>gAWNc8dkD8I72;I+*GR!4s-9 zjUSKZXKTc=NyNe!AzQKN6GVM(S31Xi~E*Sc$n-2=QYDk6koLat_4@ zk5!n@D*&jEyzXyEd`A-G zTEA;}dgq~X4wk8KmiID{-@hDky&hfmzlblCPcBNgJmfdT*EUyk(z@AzXjzlA8JzS& zNp2HWnl~BBftrkI7Z*1E)YmhEa8+0vB}a$hJUA!hciXJ`>jUx9^hMSPmnyIPVjA#}aPPu2PE>;HN=Fi?N%=H~${z(;ve-C$Q`en#{rp{L*Zrb`H1*Q? z{&gNiQd$G*8B1PGH zz#`$b%nUo#-&8%W!m-B)Kb75nbb6O=I$FBD240aRgX&_Itz2OeTPWnp97K>jiT@6S zi`bBQC+-#m*f=TFM*^u2kU3?sCXFNY?l8R}&^pfjEQj=BlV56XyW4};jYluvBA^z! zUjGHs=uqh#fJQG}G)!`b3r#ha?n>db5&B*KMN*72`c;I8%#q%>BwSpn9LR-DEl^ps z4roHOG{$QtuSrZBfRL1s{luTjxkmyoG^V6gMgY%(8YkR+S~Ybr?~He~3sE}&c2I=2 zNE&`_4N37?vtEt{2RnH7l!OT)pgfgA7G9_}vm(jJdglHR0JBZv@bNFBV+iM4P>eUC z(Dw%1ptLHM{gz$4`!{z^>!^OXp*jZh-i-;Tmh1b_d;zF7t8G5_y9vqMw=eD zRBUl~F_S-yANTpdC7r~MfyO*@9?OOtetWT3I1m?x7%iA5hVwd*IjwxXR%N%)`E-F{ z@1v%euHd6INJ(kqrNR8&B>HB8KMC23osQ zEwD9s_z3`i?4D!VPDbDp<4yw{CP8%g$fF^DnT-Ktv+q-$xHkWXySEIA>)X11gS!X! z;1(dbyCgUScXxLW5Zpp=cPF?8cemi$xVu9mcjy0{bKdjRt-AGozEzb@r#Q675dzD!zqvkJ9k#_ z$=TXy*nE2>4~G5(8E`U9dDWr)5nbO_XpM}kx4Fn+qb=_$IAfBDH%?AIBb{VNz|CWO zQV;{Rt_tm|N+p9HdRtI0j`*ry9%P@s79#b?xN4{+zI%bAp%l-AX+LT3zhER=pK}27 zO4)TTU-Tk&sK}!Q^q@PSvX=6B?8iNNKs`wj@!)aZsb^1V4vyUBGn>fBtzb>XKHuhJ zDg7q$VW{1SMYTM!hYTO~J!*cwvE@tqKf+Pf@u)Z5}xg*3gGL!Yy7OQv71GY`DyGU)Mzp}WB!juK12uYt)byk{M_1j0C3wRAPLs<{Y z-4#}5mgTaTkg=nh(e9eds&^!F8N+x4*c>=7}~??iuaw0F!`PtK>q}o7Pwshs+E4+T!PuR3Lswb;KL^ zEczcVw`X7C0TF4WOpYJ^WSG;hNivs+azI0B^%H9MLM;`vL1K!9q}C3---?2Fk-@7? zX!^@|5Osukmh?zM;3D>ZwRkdKPo%#e^*HX5#9@yLdh*@ejF%L2R=LvlfSS%!->l|G zR6IHw|L(eQosEd6(wx;oo1)IPuZ4DqU)AOToI+-FJ22^Yd~wB2JT>?wH*c){mL@irK>b@e~k;)BSF1M#$EHEg)>-=bdd)hI z90UX?Uw&D&)X3_yXV9DIYByQZji?yX7SIu{9Z9Fvr$v+U6UgiEUStZc<8UQ$l@(41 z`Oh;>>-gQHH!pFJ#CP_SlxC&Qq1SPfXOKMvCu-l%GmC%JFOSH6XRK4@xFKy1Taj5H z(PD?V?CEvq_>L=$wt-StM*uMZ^A#!|bs!J@IXB9H6{n}W2?vS8m2Zwow$(EnlS;Kc z@O(LJvv-bk)j-{baar@^GNsd)4$F*N@4lu{ceN)*-8aBJbol*Rk^ns}af;Xq|QkQ1gVS*ZrI@@z?-ogz?6 zMOh~8N0KCIUznsmJ6(4{p@lW*`xcIH92q|UHSTY;=fvjjPD_zu;jKu+is%yAf_RgF z;-OlL+1*-9ai80=)YXghAm8P5dHkp|mpRHFN&KF0I$7dv=6$Cr>#|=Gelf`V?=w$& z3T-1R;wJ^FohNQ$kkl}UsX>-Lp0};o4qEHU1%fQN{xUnIUL1MG*43V1;j4&TNd z{32sd0vCK2b{sOhL;L>WjM>s(>K~bwpT78uwWnC9ZZH3mG-Fm@>^3G{owGYtKjm6> zp=i@MTC%v-r`)CTZWQ+J-+`Gse&W+-bq$Ek44<)QL#FYzO&YgA+T?>f4Z3TDII{EE zrk3~7KFGXZQl2U6z4Q|FLDM6+`gu#VJc-ZaRHDt?`Q+QWTPHr-&Fi~aIbE-N94-VIaNK&n}= zx~jrmVc~)x;hG|dApS7iqbbB9d8d8?v%F_gK_3laDu&r*WA~8k7#nuW2r5CEN=5Q$ z-TEKF${g&l^BK_e1{Sak%j8qm(@WL zDj5(SSvp~k)BU*K@^(iL4&sorj@!g}mEYVLt3HMKJa3~3h3OXxwRx+YwxF_MaxL4o zRZS;MV>zjx00!b+CFsu4d-q(eoSl9$5=%)xk&f;rB-1JD54rT3EgDYT3_-;&DkHBlAh?9mX@|7sMc!c>!$aFz-)j+=sDsJ z-p!#<6?~cP{~8x*-x!H?r5)H0%cD$F-di{~Nz96ZaMHnoJS+t_(RSsi7iEaRUF#0 z-@-+d1!>M}hhifZ^ABGJa2^*iX@@B-pJKe8a3jUXq|@B`F?U{Kzp8M9^RKYaMKZ0i z3DzH0j{Lwxyr)A#s`kH?n1s8O@=sCb9+%}LTk?FPYrpeHb86S_pIU(b>fH-q%8QhZ z@o}yVMR5p>pAkm{)@hznsCM$KPO{Kw;*uo1x&6SJZf|~mQt6V#+!q33nK5_T!#}CS zv-ks|%eXsG1_5L!Qf#y92dO#}vL7F@HaspU{Ik(XZTM)_&V&eha(%iBM^1*$-NQHw znKyRa;mHa98!JG`08t{_-;xV7M*a4^zp*l9jas7f{PDMgHmbG}h$QpqG29z!Z|+5M$SygpwmC~YoV&-NVbGN=uhPHPP0|L~(5h{FVmBxNlW z5OAcsk%2d+hCqXy@S+po?;EAJpE$|uRfPez^9hW|yBGS#*Qer#7m&)9Y|AznsSWXPj`+~I!_&&aeO7e%%kBjL&iZ+EyRbgx@msh8QO0SZ}{B_v~hv8KnG z?Rx!ZIlo>MH>1KiRP`!$Q*pk%rl^Pcls$1wgH&ls-4HoQ{MdK16KI5jvQ$Kax`oAV z1yNG5bax*vPMbjV$7xNV2>`dDsI(|zjr_XGPQ<8DEiC6pVR2FXL%0@Gx(UGnrNE_Q z^&e)(f1yC7-5?d?)DEAHX8{qjc?+-!eoLDAcWMqZzG4mlqLk; z>w1Pi5UEpWMtn5?H;#4}&kE^y)it?EYMB?)z|Xl)wD*k#A}RdsVst-0{+r0VqqO8o=Lj_lf!EE ztJL8pJPMI1yYYaO(Q~uoh{AMUzj$v5irDkaH-H>0{9EB04HA6O|E4&8pt_irnt^%E zfHqe_!@JP=x-Z2SEX4*0Uf!TJBr{XxfOgt9tFI~{D1?<0-#NxT&ST$Qrwi%1WIiHP z%bL8pkI_&TdF5sYL)M+b z?Nx z(kfE@v$j7JCsv41-u&|A?j(StzQt+(>NxT2GeDjEB!e&azNA7^9t|RaPFt<*ejS`w z(Wab7(e;c&%=I+V292pn4V=p<)0#cMi#N`?Dd%mQJWy^(lHo5Ol_1scjArX26Wruk z%vZES5f z$z1ej?d+fUL2mL9k`XKQ*!Rj(x(h8JUn;iDSp6>xO=$ff33x{c2t<4#SB$fl_McPu zsl%al5CFt0HVV`KdVc;tNSoiFKVb&UJV}32E=yJWN7?jW_xArA|M{QqRAX#FH>1G& z|K;5L-~BU@1<0Y3Dd*9p)c)~DOXBTkO7*@!!^WbKMK4$Xg}GbVp=AQdhQ}>e z$FMGmF2AhO4;wB62L(_FFlgv!(3o_I+V}l(d!`;>MX?1Vfy&oitg%9n*nXX8a((|PAL}KA@%a6m^JeW&U;4Y_PxgZK zQ~_i1WS8w7WAZ;H|3`E4S9U{(Pyi4*B~b{=x;FuMeS~3esQJjg>|JOYHJo(klU4NJ z0=dNNdVDx*wLlgGI4Jvi(F6+qZ~`DYrQa@=pu=Z?>m_k(1@Y>e<@1Fd2%|=XI=5I` zZpd>z=KM?kW4e~MgYA6COJOl=OMCa`^N47T`3&q%*!hw%iXu8db7d=np;GalF*!~V z#ZAntoB!uavUaNUol9#WTBI3}2S^FPGUz$|-ZCF*-kbyp8`zHQe`S7V8X&m z<1wB#7a;{`X(j5+ijS{TpxhA1Fm4q;^tgN$jHV!~HXX%Lo!}b1>TsNqbbMZPY@t1K zYUqLlIo1ofv}m{U{&fCEV14(O-R zG$}I~(RzL}YOX`ih(I2S0qEkx-prc+EDZ%10f4MeY-b{Kg@f~?5iE74GZ*BvOisN~ z&4yTOyP{@0#(-eL4GF0F8veAIPiB=+clq-=bRil8yu5ke3a-EHNRej%QMtv%!y2-- zu7~-##f4!;Z_^B#Z{8Gtlc_&TveWbfFgM5QsWBexlM#cBya)LU*+8qT`zq)#xtpqF zAox6N!WoGleQ2XswR>;h_E=QcOUW5saCVpe>=Bx}4vKMbZPORD++?9KCkGw%nw zqM~^^ov+rHmt(0T&r7c_61^eOqN~pf$bg^eqZj{G*zIBoxU&6D>)2hg`SaKGsq?zl z#3hdf6u%j4wENWDbp>(3@cUNRQL#&p(9Is{$>!cdCS@>r5L|iikpuHRY8WapulNxM z-73|GSjlSxJ5TcUM}f5ZX*2{A*uSeKvVGkD!GfZT8URV4%E4FCg}k1t&6nhNEO>P8 zDL|U!e*khraxp|aeI?VzeSne$T8&*rnk*mFVk#%#;dVh^;$zG9C6F;3e#DxScQZXm zf(z&x>n!HVT)!G}dwLZ}p*aFpnGxdX-5zth?cd3F<59+c{(VS4tt8m8I093;Wk=z|r}WY+I! z)3OM?uk(NNyX+rH6lFg79LY}QO@y>tBUmJi?IW4~P64>uJD6wd-{D#a5| z<{>R!b8FLr;%z;$llD@Su0HiXn1|;;!Xq}C>zRo}fP@o36+omrR@98@|L8fvGw1}? z@93V;Q~A3!@UNFAbAwOn;)7Y`PWTb6|Jau| zI6ljfuaJg-?bn(ZSVG%$JdI-u7_2Txe)gC9N^*O>v3VuhcGa5AKFx$+!U?I#wgPqO z`Jb!y-~aiO^v>?!%v#_&k&0pUYwDgb*1N zsNEl_enp!BvP#GbI?5k<&;SdVJPUwcMv$2LK1s37e&8t%{+MFW+$ahY&@b@jx>V!a zTKJgfelDzwK#f#5PmhRT0ai(yyL#|iyp9WB;KJtr*OJj)l#P(et^Jy zK*QQVz4)K<`hV&cVK2-F0E*N9lPWtxp!Gg%yOR`GBH}$ZFmwF5@Zp2`LwKx0m}Zz+;-HacPt{rfMo4mnRXlTB+Zux8c(c1ijN<2Xzv?A5CUfzX#x{7(j4R zyGFZLBDX8O1eq+nTdpP7Vz^q7EWT;X8WVRiUYR5kHhsa^1xU{`<|?b*d(I9eW9@!H z-#`4k1FYuLu*Yy2%g;v?k5LJj1$}xp%#A% z!jDZbdR_s@Zvw%^@ebGl>%|5J@jW_#q(PU8CBY`-wE01QSUaTpm?+v4TfoR$xWeR@ z0M~b)xC-Myznj3gP?-2-*5~mm*rR4Y8yyZ6_Rc9>1n(s2l72>!9L^1(D&i*6t2)7R z7}RT8MRNm0VQv})5+$`V(^&Bjo8}?CzfagvI(JX%C%ZBQ?16}0RiBsJ1*6+C)vFc7 zznCz#A*A(Fu2K+2Lg-e%Oi5dK?G`n+KboiAb&;GA2o3!8MGx4C%k13B%Z*EeR!7A1 zvaxp$kSqv=1+K3rw*c@caK9vB0SF*LMyOb;6+vEx?Jdn1CJG%7^t9@CMKbU{K)s!=6H&*2R zo{fN-&@za;^`6m0 z1`nXk0urCVc^&+f1D`XN^$*|xeyn^&GN|?XYA?~%mhO?MRWgHa#v0cfAHgzz*sJ52 zV*$RHGfjZ;Wra=-5UB@J9pwPO6Sh4VQ|@MOxpXJt-;>ouQK~)ePGn0uA*)}pi(r^* z7ff&f1x5>FFd@AQA*7ECgkk=af9aZ?dgNQ>V^pOQU$fqnOx%_pjD#DO-${(^zUJG+ zvJ!JS(P>sB!e?GSW)6tOSRd}*$Ab)_I1*eQlUA0ze5=Mho>!}MYI^?U!QuQx{^9{a zaVc~hv;5P=vBocv7pJl>vr>2aqQ2kmRGeEkktvprKSlW( z>L7T+*hT=!SY?fAD@{{}Ez@S2;5l`p>!k4`!btls09Z*5xs4_OSq9kD@bBhWH~$T% zbVL{fy!X>p`ufLX!q=Z!Ec`$(_vw;OJx1*ZfI=XQK#|*PqZ>|Qe*#T2-mBePfW&2< zj5qRhB@@+tdP|}2#YrlS?x125%_%yg-e*5^_~;d2oU8M3Xf@g8&tlPwJ%W%+d5QNU zjnO?8FE;alx>Suuv6W7zxf&pp)^9^|!b-KecrFs~&-yv|0?g&URUYR#gD;UuO#N62 z&~A%es8Fc_Ui=@D{9k$eLWTf3VsOeMYnOq|n>n}?H6gwe0L@6UTQ0K?(W~JA)CR1z z-)@dk*9a|aECi2=S;n)@zK^D?hCLp{ z-(4k0@SaA>MWA{$9&)Zhf01E%5|OjtL+)m)4aFFkt=W8a>n(Ee$gc@ax_cyIu|96^Tbqewq2vTovgj z&D>tjs<^8eKaFG<=?5nBwCoqFz0=2QT1*;&`$Ae{{#v z`4;R7VHC~wRTQn3L3Z|`AQ|)r~Th@a*Anps01JdHc6mXd5 zV{u&i-3$HSAm+LBn#AfUyuDr57LI?x}?(?nRAgH0KMLoPYe@LMxx>5e|L|79iX-Gl03c8 z+v+=8TV17l6jDwd9kcXj*3qF;_tnkvXfqhQ)|%qsb?Ux?`I0yaRqfS1)faK%=+A6n z*}vx$QaQ2->G$Nqr94IX+M1AY<3U9^?cl8qVFAlDDX)JmOY^0}TIcDW@R9V{o==v? z9D2ZE)e4ed=@A!$7?@v>p?HyJV0#{+EdM%4-%pG*kY!!^?OP>#KfS7uE-2?I)*dwc z060*}5FGF((zz7a?N%3AHR4M_PeVSH0PQYP&FR^6p;DLpa^oPA({?30^y#2wUmv|`l(T^DZeNe$xaM+uAXR?WcR!RwdE15@hn*|{ z8Sn+d$}q>v{Cht0qZ?tPq8CW_{3-wgoA9dM8nYZ8KwK|R%zrXAAMb9_XZ#L;|4(3# z?o1G#uoD7YU_>OWRP+<0E_sWSF)%;~PfYd1!FJm@0+sK46oH3Lh%7v#l#=?W+-;DU z_1v+a6|yDTvh21yf^GGOh`6?R*W_*`o*D)wbl+yRBsa0qYOXA@d?%&>;8~Xq4?(h<#00j@KbWRjmd$%0>TE)aEnTFe-6B#bfTg;7cN5VcMkioV+oM z7)gnKRpkTFX&B7ps56^X#$wrs)}`>;FVH49o^2UT>(gcN_Zt$$co3t}ka>BUXbrD# z2i2CmwCJi=>6tP?e=E~FA?u&OL*65Q`!)wKI!LGcYPE^v_jsH#FdAhSerZn{ap|Lu z8Ei)BR%3n5Zdj={d>H2IeAYVinDR za{G2(8;1JV-bh=xdkjL{!gU*6wW4UG%8N@O(M2C6E{a(cSPUge zC0z3J{lsO0yYn}tGZ$Xn?C;)cCj&EB2PumV%E3e*qa5xu3jTEX@&(kwi4blLq}yS( zOpFz-zx;)W;Uwj*zc?JRH>^z2$<~XY!_G#iSANw5azR8b3q&%b*_ditt#1H+i=OeL zAS}$z_8_3ZtI{!c`g}eiuDuO#yhk$g>*fMmt|$1IDaH8}Msdb}4U4^GObyitmuYd* zXo&I?!rCs^t3j0kOHTYg*FMI>**6UCSbR3Eu~Y%6L{dg}I?XcR4Ss|18iIp*5@Hxo zfS3JAAmX(yITPc6#PXAu`lo%Uz%!5@LCf(*%bfBoK!yup@dz;YD~9dsbH5~aC@0dj zF*tywKlYT8sRnEli}p0AyW&Tvcifk8-LQ!}NoX#BMgT_)_I+)PTYXCj3eW2K>#-Uu5W*2h$@76LB_;L7%>V;!`MPP{sXR>sz>+ho@+sWwen1@S##nym z6`0p}0v5KKZ_~ZSb`TOPi}MFg@~gi`xOqeZIBEW?B%FoJ8c*khYfv#fFSd&=8vB5% zvZb2EJ7kXmC`LM!o!~l_)=yUtMQW}hndjKj9i^Nmy@Y)9m!pmIj$Q=3-Lzi_87l_@ zv6;e0IxVc%HIGrtW25X5mvhi9OhmFVUhpjh(wI8?Tb%djKi5|3ffz=W-UEN?!YTZk zexRgaJ;#sA`$8)hVCX`u%Xm8tkeek|IBmZ^_AWv+3p-B(v`6eJ0Dbq~=}wz?GL_f0hi@*wQpZ*L?x5}O*2guJ4Ha0m~f?2!T;%M3#VcHi0`2TPEoP|#z`__HTV7d z^V}df6@XP_n>rj5>I8T1YPBFAmnj0^q%MjMstuUkKWMr&djh;|>{y~Mluum#WGEMW zZew^ei@)vXD@togA9|3I@a;m-2#dxx?*|CW3#74+k_7(DwYoEp>XofDoH$U>Xfd|_ z#WyVtBf#Bez~lN)3UGDRCKKb2X7lThej1D>8v7h~)EPLI_ek!}TFifaqeAB-N;w2< z&nv&0Ly_@`OmLARNn-hpf?I74|KvEJ5pn-e253%6?ZY32a(mHQ#N-~W0jLmaBLoFc zNzN*O6&i8cPG(&X@>5r#R%q<$jwVWJH~}&QESAV8t%aHadM|~<$4`oPP8^N96Q@P4 zhyS ze&z1tXpeiAIaj=i*(c9>IJ_>%~;P*N!%$W7q!nE0~geLG&*X!rtUl%9kN+R{X=p$YNSi`QBUp9{~YCxtI zNN3s{smQ}W@>aEYZ=tUcHMz-x4pktt9a|?=p)$-9y}der3cWmRFC8=J7Oza_c{+FQ zbN>MGowuF3w@>dcF8BaAem_^KYrh*_w9W_twFIzfXt7hv(T?(&VCJdSw?9jEG)1zh zTRYu+6K9hSSstik-taG(Oq?{;Uz3_A>zdDP%xIDJ_R^tVWOKeh=|%7Q zp3h6cHqy-gPNO~4+3q@DR5Ts;>zz4Wv#;#8ZBiAAG+qkyMhD65z4o)&?@Z+eO}MQN z+T|s1%9Hq15!Q4r@w$4QoWxN`jeTtIt22uUFMRRtV>bSgNJHYUvw-0-Q3UGtH9ezh zB>;QF51y?)`iC!bnT_EU`v!DcjLe`wVLa zZli-=AMERlmK*J1H?9HIAux7t8vYg76%g0@q02 z?5(5w+&U_MDX&d~$Cz$ob1pP!cS9uT`N;~bJwu{WeQcfvt&9~=Un-?Kne?CLxDGrt zr~P_?0@NiK(s-^Lb0ubl-FXjrFc0|*)w%3N(g5FB`-@LGV~>jHhS!)|ag>{@4}14- zm-yNT&RRW9nl$_w?rfkfnXc=Vsy@DWy1(Ux!N(fE5JntJw1O^mu4Vd|_0{trH*|Mb zubo(iO@(x;wpW?B)^oRz*e7SSdwmR{s`H(bKTceSxb}se zUL{O!p{_H}=J0bKrvw&NxgBR;?T*s;f^TO$RkrjQCtZ&le@)Oq56q1N)XZY+1{GSt zfaV}c#Qy%&0+6zti846>iR?{r!nEJxs@jPl?%8RpoA2`E3+qUiD9jlFd36~3OYXYC z3sh&L?F!vF8$vJn1BvHmF!X(qhnel?Bk*)3L&l91sc%8urhw8ftsXE&rKF)JvdHR& zFhp^#7-%-#kQLS**R4X=H){kF9;BTMy=j52G6TJm7)=On<&n@arhs?E zEET^Z-c)sWx@Fz-h%K$=TPXELhiu#H@RVpldd@TZW8?T^Ny@a z*??C9eUvBZlT6DTM;7JN-Dx`QEA3hLdb_?OV}?}p-Tf@Ot+s&#T=(_7!tJTX@}CM# zX9SmP+jF$U5RT%@Dd%(F`$yBzPy+ZiL?3`Q?FWWbzgXRBWv%v&rFHK-z$G6L@HNn^ z2z`}$=KUA)Jnb>M)$*H-=go7Ik z*Uk2z3!A+ro(h*sz5%(mb#*(>-Zf6kEy_&n!KUq;-olo+*zHckvEM77=w7DT)_#LM zZAD)mI718BpkL_tL&O>Oz4b$`YyClOcTdOR9mjup4j|kiBoe)Cj0?Yq0z?jr`?-ht z?+X$`Wpm{>Ki{OuIIyH2`jgWp18r&kJ)4&1fc}zjfl_4j1LkbB-LHD{djdzaAT#nq z7YEbTvOiu%=oQA#1PDT1k%YI6FIY!t68b`j1YR1lbWKXQ>6nWm#`Su*n!Q14!Fb*88|AA#L)&_NVQI; zfj>ve{ppL(+?zUoWCuDx0d zw(V_T_5En{wtUXOXBL? zg824hElj8VSkrLS!~XiZeK9M-C+EGfJ8Bx+Ga3Fjk4c!3mIuk+7rPz*OulrJsojCsw=`@?ckckKEOAFub2cjH&X4{Y;_ifI6AWbRkWx>|t)hWWb{ zlb#Ca=Ppkm&+Z0IVOLT`yVY=y=e@U`kdEw8kiV6WUH)#Cv)=qEP4$`=nFkf{0Q#Nqp->Zm^YU4^tWeI;OB&*2{I>WRXiDO4$z z*J91rQ5=r)i0m(tOAm1s62D>$vBJH>Rd*z5-zh7vbaE@~tBVNg{eTy=;t|49n(w^- z5tYW+70MI~)}bd(`k{tdhKyj?IZ2V;Wkjtlb#)~A*GzIx-in56`b&UJ-$n5E6(Pf} zIa)%f<1Z7pz$5XC?`$f_SW%K9i}KZ=AGTkJ+9a64F&L|&13>qoV~c`D zeeg6%)tQq_(J3dA8;N}~Q&K&UXi#o?5w6TguCw^+L+&Khe!qM(EI_et#G3`UOjrSIaQ6iAaLf;^aMA7NxJt33xJ+eAzFjTWW9}5-bl<=cK#T z^B)O55g)pLR}UVZ8{F{V=4xs_E@A=(?-;v~S}emOGSkubuFaS;U_H5ssNj_F;u0i8 z*glV#M7;8)KURZ%_$uP0`?Yx>oIBTa8p|#@BsH%CCx>~> z%W$Ro=(Sa4jls@?)onK;?V;y4LY+^Vpi-A`&xXof7XG}?mqTU8~eW5MZ87hA8|Q# z2O{|LB11r~;2-(!_J3M*TdC!%8ksoA83kH3WJ+ZO?ZXZX`_bRyLJ>$7cN-`2FKv&G+m;jc7%S1tSiQfd2Gl3#Bd^k`?i(aKBKoOOhf*v1pK&b4-< zDcvCYQ9+H6cacmdY={?%K^Erxj8+?0?O_BDgMARlXT1?5{&+s$j~O&%r5NyXj>~nt z{7Y8d3A)k7oJ>a#A)5MSaNrv1!xLaCX33^&S!|UY0+2oa^`JfqozE)5!0n;7|T}n}X)Ag@IMO4yn!WkjA8UI%fotLLI=x z(nm3->l#@Mu=N8mgfsxPeD>V19_x$hGaw@fMU0#tovG~;Eba-$N?>w`1ImdzJ$+u5 z6FBOu98x5yiwpt;j?YxZ1m7gu;ZTWKB%YJhbsU31zuS%0JMj}&tSCPF3Z;4V=q{fv zOzUq>$_OgQdv2hvdtg0+&!My27E`*e%wLggTdZ}wS4?f2F73c^xF>B1oo>1Thti!C zkfSTd!_$K~uU+A3cdUTsghGjRD$_ai3PR0JQR@|$@_IRiX9{JwFaqV1A4LWy^j;0z zD3^^!_7IAT!K?JVoODPAPhji8q>;3NGv;NL>~FJbqone>1oQ1`=}e}?b#)6%M9b8{FHyP6sYi(6U1dn8Et9RH+tR9+-t%| zk?UbHnk8qxwttyUJMWuniJMI6Ac&Cz`RwzXzy|4GYCRoFXmpV0#RmBw2~7j}Y(ZVw z=Sd8TkWsqAp|iZLdQn6i+7fKlFpB%Ki1x%~Dw($6h?o5S(~Lm6(T$N4APON47&nVj z%i>j;b5oGq^rAIPjmTCh~kcR9U8m!f5g<=bCne==zczyQNf{3AlmaXa( zY%UJ(a{E3C93{wj;vBN-`U=~c3Tn1^(sc$fk&dfw4)dAP#|4`Tl?Z@kJNT#*a7(N% zo7qS1w&dy2Dr{opHq=gKZbCvV7doe9P12UZWqMQwUA-}eIi_0Hf zs*V+u_Uqr>2@~+TEBs{{-B;+>>_Sg_meyl#Von9Q9xeopc62&O4O=X!cZ37dmc%sC ztcj{a@*YQ-I~|O^F9(gJyn~GN;96?sGQ60zeG9H;n)j7up-%a3nE-O&dfIu*`g$Hu znDMaTk+h*pt{ndNm~Jn=OtLfR9OI33zYb^hhf?$@1p#k*);yW@e1zB^oF(R+oe5;_ zCD)~K3GUS*e%-L)J2Uk4mem}GiTEYn!?sHWzHe11xg4=?TtTGZszRjBPDN(-95L}M zaJAkCubd2iT69mMi}gW}t=@|_Fg3o7PGazb3`j1_wTuLO#~s*%QM=bB6XZBDci@_w zgK`R&YNQfLMl^9_Cr%S1w2{lru<_I&0$4K%bhM#vd0? zWxn{ouV9QZq*lg`kg5LB6iY1s1QaMIAgzQ=sBAs^i6)dm%iMlbYX|3N0Vs_2F`97u)Oh!{>JPn$&!(dx+5c>ZYz=mdWm=T%kF|e&(9ZqVPeyEVn$|#`tunK}^n%66 zwFd3maQPd(SqR5h(I7K-K3_n+RgX3hofHhIaB-YT_yI-DXkk>YdVdu7YVx`Y(_n<>njZ*@i^DK1`qcSvgf?rB zVIWf^$6aLDF7z|YBe3jh)ogVr3VGnzxNjGs1dM9j{EFkR+dsbU^Aoz5kY0XjIl7NO ze&qmt%*~=`?L_3j;IkC>Ei|7ykyO#*Wv+zKlxmzBdE&Yw01H(oQ18~cBBTiWX2|8jm8OEkqg6kShXnI(ENLy z?SkGYsx!Jnen4sR}|bv+?h?-eA7`zB#<1)?o5Ri78P3;yT2u z`quITlgbCmn|pqd)mR4&fvY}l=p~wvZ^?GSFU7IlY@7hWG}i+0t>zgmvk&=dEcIor zH_*R;wOg)TZ&aB|hNpEPTJ9nD#O7=GbiUM5xnXftL@ZyJw`)%W3 z9JO>}*5$HTZTJLNB%>5im`e<|&ZNM;0(6s#BR8dhe8RSTxb@tFR@MF>g$NIU$j#Ys z2<>Z%l?gQ1fnesXTB>45{tR;h)>!gpp>?Gb2Y<1n@(0joY-YccQPFr;?+MXl#LVpw zLc6Kd4OWU2cNEzuR-=0bV}U1{?UufTn&g_Zpp)N0h50<{O;0(^-Wwtyaf}lX5E2fY zR#wtDZOe?AjRqa&m^%PxS_Y3ZwNi%#XV*$#jROI@Mb7?4v9B(@THE}sqVd4*PJaLu za*UiYU!plf=UurTYrtXoN8DFO1H;%TI=O2L2ay9_G?(m^rY{Cf=u5lUT8BTn`63DT z0t|DYfA>?018@tY|I)ZjuH&0X1B^L%CE2{LWpzR<7$@EwN%y`Rj^n)4j~m{sM8So0 zGe>b!8T%NMyo}vJ0>_KE^0FQ?p&~VcwrPBIr}W=rmegk=8onXem~D;VjwrJ#P7S8- zGdPgy%!v)elG1>6D!MLx1@_v9Xl{L8m&_+}H-KalAWnQ?Nr1smIlqov5Xk+d?A|FC z7HM1dycV2JKc20`YSymGjn_VirTToRo$qNj*?;~1CP82o2N5o!FMH8I$7yG_F7{Ihy}KjH z?oV5v<7rwt2!Ae<%B3BE)e!j`?$_lGitXDDi@MeftFq61@#S~st(uOm1CrzB%GFx3 zRsa-S#_(^|vagQgz0s5otmr_QVbnarFZC}c0e39C3((uw{OEtcxZ>BjO!Y+eTcd94ZbrFf9{>7`3VQ#)0= zL&sAW_to{}p@iK=5rj|a;^sj)X5&0omc`**#HJXIzpTLj+ALLiz@@KV`txhqjx!eu z4xR=(V>OU^|J|bo-gWkBz6;_EO-GvokL<5xY^)6Q33EUZ-SzmaZayG!Enb2D;~g|K z@{L~+tl;rnIYYHcL<1Qr-D;-T*gJT}bi-Tp%D?AKZS!LJ*wV#igngubO|YA7CMifa z`-s40igI<^V;5;Zb)dqt*(Nv&Pf(WGdZCn}du#Vd7UJ!{+c5_!fKKE_-*%-wX?GN> zB9!&wIW&!Ou57p0Pc7;on_j)L0_|yHCEv9fVMZvm!%JJ&%ctL%cb`OY(Zm>}y;prlL&anuZvtU6o zE&llcedKo;jC)H!{aSCaE^A{gO^ct4$8~zPbgemQPGH9acm;NSLN}JTz>pw(bY$v< z5+$+X%X6J}Qe0-e6AuB)#VIbjDa-FNc_KmI`JMM3Dk`Qr1z!8Gc)6(G30~jKI00#u z#W%_HK3|&5v)tyH`^4FOWx3B|3@Q+@Bb?ogud-58!nto0gx2Of;doOk#H-KeG}iCu z$zOi{J$ZHFW_#ahcAj>t85pjXt25KcfYiYy?!J7dSMxp!+o|H*f#Fy}30|(}IDOJ+ zRPGE^EY$wOdWUP;{xtcMEP=02aZ*}`s~f!Dbk3y5QR&B+#EvC9 zfDkNb_Vf2-Ee%u`lqBKqPksUsWF2_Fg|C%9##8j@T7x%ywB|xhMPw8CGsdxxa(jVX zp`l;#C@E~08##u>M|WN&#q^iT<|v+;Q<|Tnj;t?`@dB>=E^}JZ)~&o4D5G~KRaNwdET+mDRw?GGrKrxK!^!CDjfyRmR-5y6QhiAG6JgNM_w z^P~VX6RDqc6O7RMMW``>gm7Y+>h8CQ6?}_K82Reu9@1q5b#pfomgYwsP#38mW%`p{ zm8Z8x@t+(KD15F7^Y9k{c8~BL*I_%-I%qq!dDu`D$E+yJs(P*(kNd*4J9``wQ4cvo zg20<-e#yZcMTXR&tD(Oy0_u%uYJs3)19oOrsHi25MKTr8Qz&Szj?K)w?=5$UvKog( z#i-Vl^6@041lSw(=e@!j(#oE=0gw3dZrdMj_f=-J28-M^d2^*2>+ucb5rhASy|)aj zYTfsS6$t?a0Rd@|ZUJco6s1cVq?D5GZc$K>o^(q|H%uC&q!lFRgh?Yg=}Gh6tk`>< zbJpHxzt5-V!*g9+G8iy$FvcDK_{GBx=FO%xnYBav^i?U;Okvs{eo8xEjVOyCh2$UA zR;GB+@NVU5ZpE;~C zTwwd~eSHKyQ2ufF1jx@m&3`j^(D89$YK8W>2>4 z?JRd43@4I`4voK%W`wa z|CB1Gc{|wc{@oZsWd-)e^Fv)8ufuNJ(cBZ8AN$;M%_5DnaQB6jTE;F2Sa;RP6*>Pi}L14<{6*n%!eK^lWiknlu-Ieo<^x}a#CdF zH_p!^3ER#QyJ$DwUvH+cLb&AB*ms*qRoxh_S4{p;)SCJ162O$5C%eLu1xuz5FeChq z_}ftQi@Z4!UG*I9;oLoCW1D;j=Pu0mvz5hjuI(oEyOlKmpkDte>t(20v*C99%wx2b zCj54&&7P>9(*WN|RrGMJ)M-B>YR|;5)P8sa)t-4*SXplWw8!I8?BrKg#WTf__Pua7 zzKd<8Hjk+V#v#!W#chr|AD;;;`OCgl%R3QuoK4Pu_K}bl-whbpRX-&sbBI`=vXECj zrStCI_dI4G`_lDdmy~(-lh^FMglELo4%*P;>Q(t)9PUKU3T^PY! zQ@{=r4z^xD`kU*%+=f1BB7a1x+1IW^j{?ys-Ui&+qr;Qy0U{DT`qfsa)i{Ac>HWz_ zZ6#wS%;o_jKFlJ(Wr{E)D{6gR>=i*h=o*8d{@Hwa(dF6NXYw?ykF%k_NN(y;vvQ8} z>WC05QYLxOry;cmy3Fe_AeJIB?@2CiZ{2M~;adjxLip^Cy=-Tol|2HjSX+l%!0 zyV6UCk@?JE$n#?_v_7tHyGKV~jvRCfoGsLze`naeO(FJ_jVO|!yS2J4BDWUdp#_{J zG4;jtrzR>AGPUnn(NMOQ`CE+(ASl;v*)-}(#-u58zG9zH8g zM_)`H$xDcB3<+SshPr74wm>=WJZvw&f8=m6+}8xj@nUES_d7f{r-Aj{dGh(hrdFu? zJy z_W)BB!!PFK9{1hxxFgY@cuDG*t$w=N*@HiC^m$*S^BF`dJ1zE{hWRG`#9_~p4ks@z zO)g+jR2k4-f$$q&1rker&cub4z%)>a7+NBz3`I|UIOo${@K|5iFZpJ2 z%z5)e;z=K;`Xf8qN-q0EejD-@MT7Ct^|V@CFCVqKQ8GmuqP1y)f-q=0;srwP5Or%N z02+RT=l*TYFk`WrAqDLBaFp#hk!_ozp>~#(VuQ}BoH@qBg$VO?B!@RwJ@&mSwX~!H z_58IBye^{i?u|*OY}pt_CErt_&f2cVW8B5uWJ1RJq)#`?c>o!(`?1KD2mJIGg~29F z+0Q(=F`y5KI5LMW*$$d{4?O{%8W{UzUBVP(8!N3WcOw1Qb?98Snql;ToP{j$HOpR( zu8mq)4HCdq#F-)r3q_jdb#p>FN%Xnmn8h1&l)UlNjeEqyH(GA1;4RTY#nKROs1Xr| z$5_Bl;qq9*<75rK#ImB-I!uZ0qw?`c8~Nj~_>J2)bAFl2WW6DxsaUaQWj>T(jYrS> z86;MN@-3QLRO4Li{JC$W*G(IR!Bf(f)$TBw(rzAwbbs@kLxkuHjDYA9BduFIwtm>6 zVogWIq}}XY$4kIWiG1`1*VjB*jHvgt)!yjGzVtHX4}@ZhplplXkM4zYBXpu`-G$pC zfUd%qyg$4SW1M)LM1I2aDS5!KOvMj2_pGhGal`@98q>N@#*0qmWP|NG!)Q2L8!|b_ zfSoOcW&!bfSD9ZvXU+R34_IQ2@fvBNeQDTrb#3!^3%NL3cjtERn(i@c1!%G2ia}r9 zV!Q_rT-SgW1&OfLUYF?TnaRhjGg^uR)JUVzPG_1a%<&MN3cbuJP4$MLF7|aGH5o^6 z?_2O&1c`S&EgmVnWo0l{zC?BNy-Pla-EFD@{SOP$_?UeU2(%mgN#TXDDuI!6cweO* zZ`C&1vcq?u*AGBvJ01rvqgX_V-|blk7jO-qXQo-eNkV$o6b*^V*nD!n=JSg*f><#rcs> zq?+Kzk1~S?`>P`-lo3=S1!cTbk5Hj;u4kXi8P6A4Ic4Iq%(( zx(sc`^s%EyTWT-RU>ij}!SvDRHTia@%3ZFBCXk=CLn&nexK=DxdDa@2iTxA``ogKP z8NRGf4JH=OHF)^^d9dIpbSU!^zSh@cgXj9PO~}o|v!ez4sU`ski&`uXL;l;-+e7rC zWNo2$ilTNn?rus5yKhaDOZvrpF6|QV6g(#^dE9LL1DTPIO1l5cwONpHMiEL1`02?N65UWH7u zAN;NBNi%;QDs~&$3pqNc!joR64S?K_G{JCx%;$6he8HTi3^a7oB{p(oMH1(Un9VQx zn_KIbyWA|z#N+>9PXGe4JuQ($;~VJod+#r10)`Z`aRMn$0^*$9yp1X3Kd%sjM@0T2 z0BgLbQ^R?3LV-tkwD7S*{=_bPToQ8F+J=K&lPu6^EcGi3Nn`jOlUpyvvd8< zS!SsKo4DLw>K#s*%v;FP`C;@efnzBBpJDp_0NliD?B0#+d=I~k8g|YEwdxyZP>k6_ zGw`%MTOCD)6O8754vEr7PGPq`hJUXOS{w0avl@(y*a~5EGbGV3)DHRGg-s8wrK|f( zNj}{84-schYcxtGXjv)OP&m3wYpO*5-B}fT3VFLMc-L@t=DsTtgxk+doOm$^{hyDI zlsteb-TP^}YNgqLi{2Bc85|UPiuCGK4Jf`FHk3RKqMr78wls6Aq$P-z^p(n54kijl zI(4vgoRW@y$7`!K;D+PbkppqVu_9BPey}vnV{wWU9Nk#Bj}EIuE8`WQN}_<#-_58{ zT333p;IT&fLki`qdNC>Y^>8A+4$|~IC2$;&z|z|Gow;>j*#7-fn5MsROYuX2<9@=^ zuz9%kLi8U(f`G@!c^6ImazAEvNd8X5(O|>Y?i7`?$h_BBfs6EaQMfD`DMf&3Uz}`V z9R6wQ;T~7xeLx!Afpx`xyGd_uNTMU3ko^0zQ$-U%c*|!$Pe}j$>sZ2B!6&Ru_SXF1 zhNEvjE4n7#Z};-+3w6oKuommdiq+3^T?bOr0o}N@MblEb|LDBS%zD#qcMvJdU7Q`8 z{`mYH09?fKbN~e@ZrHR}CisvlTYYtS(3KI~dbH9t5`3vU)EQp2TaL=-CuT(PFYXu_ zGDfcsDQvs+4=sW(1iCF#QxQV&BkY+k4eiJ6wLYDiP`+BKf7lbq1IF9Ps6P084Ud zBav4XndbGTI=YvOr^w9rg+s05${+_mzfDr_P|(2dP@4~s*42@`rP;PX&uF81=hX)s zgJ0EB0&%hTY6++%@Vq{H zI1RBXsSCo{-kbewbl;^v0k!xk31TFl`zf*Nz2OBKMmAupmN;l%>9_D@zIu0;O)~|@ zo`QPh>S5YP-Dy==PU$6&1sW!iXXq8+XV0+eWFlIdHy$)?i`x9%T`OZhE4~)|njB|a zf^?}|RQYGb0)6mXpQ$Q~C&qU3qO;WHT{e7Im=Sp(IR4thvS?kD!G2?cyAE(QA6Qb| zMFe8v-O|l{`aWd1*vqZ%aLOuhc|qxK{-=LDsDB;={KBS3Zx3w_SJzi%tF!tUNxp^z zQ2c07k3Hd)KxhiDnL@m9H8T1=E{Py45xRY|2tc2wYAoo+wd$2-&4BgwnI>F*v=G6_ zARp^kpaU`=iahrGraMS)glqzU#R3^?sQ{J0_5oK*o6U*uZLHypRn;`70eCiFg3b zo9uf_%gorpY6%ZeiFuWxg+)O0$9Vru2<%@T-{D0gZNh+3^n4=YEx0#pYP$cc))erQ zl;V8PPkMJ2x>H>kW$xb%01BhBU=Pbygw+TGeBn#53UFkGIEeol0R2uY{#XA>+(qZ~ z#NAfuw{6(u_oyNM^VAS?hHCMrc#jyFUVV#U70H<@X zX}shwGUNiS%NQtBkVUfys<~nQEwU{ihom=@lxuALc_>LNpw$YUZoEsykGWA{Ho)q4 zahyjf>aKEynp;QI?b&IJ6Y4Zs#;SkOeqvjf6Qbw2nxn)AN`A4RSomDC)PSST$uNJg zv=PFlH8_ckn}9lGo#lkz-~^=Haof()hArV1PsO^{!wehXZ$Ih>B0E~p8-8I^|9oRT z;KXfXg4QqJ%6u^x*%Dv1I=re;#RViN%(Q;?CGpwCqh@@x;t^%9n(nfw(ihd+m!9p9 zC|^zH$*dBKEqGndoATGHKpp6r<|5FI(D3ks0R8UXQ7yw_k4!kBi;q^R4#)A{N_+@$ zsRl|ju`GN*;a|T0zmAT`shcX-sk?}+5Y2%Kslpm;tu0!;FPJ-Q0xIf&=*n)TsyZgl z{1cQ%b*ZLQk`GuD@~W(0Ql-A<1GQ*b$aj9eix_sz72X2@(>a9Cnt=0Wv$8MZ6jH-PJtY9BI^+r%T&c!6>vP4UPD1_S~-H%L3FLR%b2?t^R z#!A}W4%4w`{(vCyUPJ!U_uS;`yPXn`E3G3tJSx^JDU(W?l2cffZSi>UZ3@m7jtj-E zFsk(pfsaZN;+(0%k8L&U{uzV(-GcqcIuw8#bd7lSm7W~5ym_@N*<_|s*<`dJ)|VmU zti;QWii(L+B;y(9T`d{SVm$`XfK2p07}eTMP)$%ydDJtsJE1;Y4CB>xFwoQ?U%00t z!=<|)dsP+{OBB%xrxbfYC(QtTC9njK104P+5RVIoxHE?oGRx1&^Xjt#k*X0Jovfl# z3O?)mBj)`-HNUE$3xJjp+mZRug|>nBDudShQ?Tmo)4m$j|Dr_viwQ|@ujPjR2MsstXu-w#)BIMA${3!+F7ex->2eCu^i z>-*V+agBPVD;C8SNXptC58-nexcDuqoyD9GmxS|sh!bV$p?>vJv^*z)wPb_+;|z5H z9HWN?dUX{WN2hj8G%o4|&P^31htILTeP*9Frro|}gdTI}D?!$o)CF*8xH)LPV;AaD zv}@Yu8xP#V*LrT*x*X7aH%!OhV$%+#5p&iSJKMgI>T*=}%CSkfo5HTXrR+u@ ze?2czzyNxi3GpRw%0COQfWG1q*y6)6b^yYiatT$n%Db3kRpMX?5{igy^9X7*(D+sk&z<7X5Uf-Mctx?qylHUD{%ht*;F_FRDgAo~_gP?MG#u*-qz% zId8$A59cXEI|RoTBHV^IHvy4UK_za;9&6^;%xM)GCGotw%Nl%BO91|cV*Rj7PKTP= zXty;Gzjtq_Wfr>BRp+`otmC=~X8|hB5)GU*ykHX_7b zAqW6si58ux%6IysfD!C-#)Xso~_AhirxD85@D$R>S2ZJlf9f2r=Jm7V-7nDo1y&cYy zRtChO+!z|$!E~=JonskAnFL<18aZ*~+Gna>VDB}ByOra-vjtBU-S&U<#V?}7D#dY0 z83P&^3wF`~T*$Q-}?kuCfdfqR>oZqbwE*vw(7#H!W6~G)# zyFtz9katZ604<@ZqVECb)!%qq$bqXq6qjr zRx>6Ax7Y5Idg0w2PDbZ8?ULu39&zJf9f62YD+}aOFIl!(64-tH_323NK+0>C zEhu(T*VP#a^NXi|@SI&)s@v3CeDAmMFA+lEA5H4B42U@#36Q(EPk>3;;!QH{*HB&^ z4w3`RLclFFh{?qlyU%9@XS}IMfGZm=Z2W_Bj6f_Pk=K09iy+fkHL(B8qqOn3$5rR( zG~nlVy_%?hrW1cvMghlXV1L;PZujccOdx;06++CGf`$^XWoJ@Kk=fVE^u|av2iRRD z0}-Hh=j1gi3pO|XJ2xojHO6|12vwk82`SLl&6wq;L6Hmn{ccbgc8IyL>21|K={6*ag6WLUn<8Uf@N@a>M#PKeJg7(AMcowH>+1@P^ReyYPL6ri8uA=3%ftv0k zJI2zMizFv8{d8Yl%hCFF3&}6)!4LezH*D2VI+=Iyf8_7z&p}+R@Cr21f%O9zmU1*HL-Sh7BGnd2*cZ z9LYqza39q4u4THGb2(Tq^tM`B%9Sp6x*eJLU9-H9F2y8caNB5JX{Dw*_Z>pphS=xs zu1(X-jpY?W1`htt$eE^nnqh+qwazX65a$@C!9a__l;*?xh#o&<<5=_X)#`V|ULJhd z^W{pZgq=z#R^ys>M|&XI$YZffzd1H-T^pZ}G0W(1-2v#vr_?znW~T_d^lHd%nHasj z8eN05*WbC8E$t17#dxia*9zo>Jo=h6+XU)=9(B9DY{tXO+M~y-dFhr`?g|wYBCdK0 zQzW(wKv*$q9P?Hrjqj1c#nB#Dv)@;YZts7$U=U@XiQY0PgXq^-Cl2bY*1yw+1K2Qj zmh(1y+k9Y}ke3wc;615+)rB}JjE7}Z3XaR)GKmXna%#&3FHN@ej*qe;s4$LFCdJ}^ z#j@&ifn?dCcr2XP)?6lL%>4aUwYdJ2v#V?BOyRt#^n*P8qJ-(9pD*&XL>>qkd}&ls zy*IvP6e76r*fiB_xPHN`WKZKhJoOb^m-wiDXMf!7t(MspHOtAUi}%fPiMF1 zBzJ#EU*K%#v-Ur?RQIQYcQ_4+BOT*@*oA1MUgh>is#H%ur&zT;lVEQ7GbjFQ6!?$h zNI3eJYxsfN9r)tTccXwpPm|gMyXHpWR7o8Y5c>%X9?B5f?`$%N)F8h%gxq!264k*9 zApBDc0JgNdJg`volq^li$;|xm!*Y*3vnH03vX+D6bJR4Kia(v$5u&$(yksWq>1T_| z+<;N~zIq!D0aT2~yy<`qUK*$VYliyCc)~u)NvDpEc{||tev%e=dSuY#B@cpMb%j0l z6UbqqEL!H>Sr&&aQO2uOfUhVV<^{tDm``{|=?`1?8_6`M)J+Dp!B114V1K zdyB7+OG#mAv+h>IrElJ|wzuz{$#HrDFVE;y-bu6CXQeSIzuldJ1beL^n=h40zlOOo ze+-rXcEierOW>Dl(Y8eB76p*cf@g8*K_zfV*uNMjJjH%lxxAT~bSLIqFgNOU?`Gq; zM}jEnJfVXf!8*k-fYqSyG}=sB*EQ7E^8SYQ%a6TQ)I?jo{xj;70#QmltDSzn)4kgf zqx^tO{h`G=5JZG%uxa5m=7Qnyq~Sh__1!js`1yVofD37E+YTl16&3-Fm^gL=_6F2O zT!BV`-1`vXbGWmeI&vNG2A_l7mjwg&E~Hmrh8biE%FZ8(3nFGJTnf`Z1i9W50!4_{ z25H?TsvO59iUTuBqL7PJKP2PYzN|Ei>Juum`zyix*|x5 zqk#mQmDWZAa}e?^opksY*W;(@8`G6q&6hLgVPS`G=aGSEMn!ULYh$ojF9Er_c*9W- zQVvb^tEH4ub>&=E2eOdh^|PY^z+l%S>46B8V#jR+H5hO4YKK@Z8&x|*6TPu)Oga@u zjP8lI-mHUN#H9V?pnkwZ<0ugnobs%zAj_oUDZuI zM!&-P3zf663m?5hN@0fQ#G%p0oU!X6W^uPxM;KX8B3_q2<8FIZn13?D`n{!K@63Rz z_8qHMsVZIzPXm5hbSDMgy76pX_d#8zw%Nb{7oFCB+vxxJ@;)(P!1pFK-ecrKGig@!Re*dx%S{uiA7?@LWE=g1b0b^%nGZ#HS-uP zpXJy-+d>T*gXi@e(V1M#X{_7i%q|c@+L+MweYY787>hyqe6!#;wA}U9*87=J@+=bb4_ zHDg86AOo<8y88St&db-B-j6PpcT=w~)(#Yq2fR5AXe-Bq#R$G*6u65j>zRN?YXfz4hZ2;tQcne-MRHvM-g>f)dp{jUzgt$y| z7QH)pS}^Td_=!4oyU83WKe#{WcM*FTro*-FMy2eWV1;AA8TgVUHbqNszSeHot-*BS zjLLDhifbdH$?5xs4UbH0U4Hf@`p20O{=P9ErkufQp{loTzeEuo_>f|iBgf)z)q4`h z7rQ?dT}Oq(_?t#^p_(6n-o{Tf4J@Q&>sZ8n&Mr`e}8EZP4);+^~tf&6n_GO%n z80+*5B11rN-Lu;HUX!LGj$qC>?sEUHyld%S-0{;Y2RKVcRHnqe>}W0QCFflkdi!tx zeGn3fbCaH*P6i_^+?42*&5cm@GeD}x*RA^yupe}r{2N>E!K1t7_w1>@+?^{EtH^;= zlzqMbc(EN{ERt3-=-WpkrWE!vBXSWb7APCyes}mWzJH>^Jr(41L%bSZ2ui5ZTqH2V zG}csoRszam#l>BAI*-e>rl^uq3lMMoU)+5nh3!_E51BLMg?83|Gz`0!dGB4& zqk5EqnqmbPK|}pZ)YggMoAxV6psTl&c9$RU=};{-&_4z-?(4BMQI8VmHQh3!=2>B* zc{I$;Ft4_ zoSVV3KA2XoxB`Mnvd#vxiryvj+vLX1fN-jmxOuw%@q)(BNxU372%=03xqq|}&f^O7 zQ`eeK-Zt*fhw2`Op>~W@spEsf$d6;6p8*w7pN1OUZ%g| zN<&Cav6;8mjyX!iZR^42lv^ZgFAgj&WZa;zXpn6kNmfa6{aog$lFeo3eQ>{R3ZrUXq-0KdrxL=GUAEmyU*4y_+DGT zqJtCBmEnn{#txIpxo{<(_UIL#N%`tk$}nhqc=OJ^p}Hl`#x$0 z_HD0WsQ7WhwmAf0G+mUoZ}Y>YJqInzVERYbk4VUrwA7*Jz#$O%=o<1iLAFpH9b(i_NSt zx0IK*-LA{F%}LR=INc1#wbcgR1uJ!sD;OOM z-Ez-RZ}Ey2@Ey8*XrBgJF)e!^Op^g0AV=rbcb|!ucB|q)Y2GA~^cj1O#&W#mFTSPo z(66~Bq{zifF#xSi8#$^H7cl$uss|MCQ|a1_=r-OvxEta;JU%wruC8-6#=Jj)v+T|7 zyY77t<2v2#fUQ+h*6e##kNFP#oFTSSbQ1Y0JPf+t8MT(?8LYzH=F(lNLm+X4$A!Y{u71x%qxqvck&L6ezYpN zExCQG%F)v&V} zqwzaxv*`Y5G17@=5x8DqFzQjVG@AIb%F3P+H67mT;x*T=M3n2@B5jb~q|qQ?2(@nc zS&}dtO%XCR#U(i|jd>2L=J#32*Mi4ANAs@o@vDflQrqh-##q$dHdHtZwzqLCm-r7Q%P%)N!geQj zZ&c{%m`K{P#6H()B8}N!^73_zA~uEdl$ND;+d9tnV*>z{98r!Lkv-LR)ncw>@aIBAS2y&{8);)bF zbbXVjvEk{<=x!C$&Dex}GN1)UZW^V{waKe6+gI z8x-k@gPk+-b}6)|cf`%vLTw=2Z=aao@_m{iK@GGJ^*r;3csdrj`(Cw6|GKVRWUMlN ztLSx^-*UeW=;DyYXmAk}4t?0HfmsJ0?290q^N4dNFyC`d-3VYH0G+Rj(e<;a(kFpI z+HbJ=zoherArEEaXUt`ddlO9StC}}gxg5+>`BP6fvE-}VMunVxPAsGoua9pXdNl4k za^pYqt&{ut$V7`BhlK;o zb(#{=T{4D>Xeo~gCO+KZh%AQHtT9|*bY)7vxhL{0B8HocNafjORo4pkT=?$fIRqiN zaYMt=3WIOh$rl#!o-S)DKC*kOzV}5}5|yIupiOjzhw@uD26JQY&whIkl%`egHL%!X zvDVJHvhP^O=f(5Ot=cXkZ$x>WvUr;^N*{-L{#?=u*+0vbEB=5ykaz{oP#u&G(UOgv zHn;QVAN`WbQ1IiO2@}zaYsuEjhV|Ml0`|@!KaSJ31l&P@MQxS`TyoB6CdhdIo=43K zTJf3LAJx9sn<(VA4_Ix5{xnkjZ%K@*$aS{?le^{z({2dtivmpO^rviAh`847pa`;S zL*<@P&=PTxYmN2fg9f+FXuUcoSrG1k9uqq5z1kbEGb%3quMfY}$uBmjmK$a(On==8 z(Fh8jCqC9H(p%Dut-P&ivbW522Wo`KF6uXmy-P}(hozdT@PzQ?sF1|No8H}2Zl25D zhIKypjMEz4YG)qUcQq(KOj1GM`=O<0NVSHtsK8j`iE#^a3vSKn;OYOEVQ zZ4+$|wm{(hb9}qXQNSQuCaUapdRB4U+HLE+rtqUGTW-rAnsCyD?`0Y+m)w!~@uz|$ z9h>fRaEj4FEjJFU+K<0wJ^*51Hkgo!kAYF*Kx-4OUpn)6cc!7)?SQGb_yBZ(9yRRm z#vA(nkZ0C!y4zHXFzDNPGp{wFoA3Mbw$(uVyQN1n0SS;GY>QtpHct%o>eVeapLD&; zFGB^(jbG_Nuz#rp89SQ%stv4`VTuNN9f3U?ggT?>)%W=E`Z>mmm2wacJ5i6P@zNAr ze#6+Gpr~@L4O32+?iA9nEwczpQlpbV3z$jBkzV^I%mt#xIY3}cX*)Jv^3n?FI1B`# zvDc?J@7|Pgk2P!(o`V&d7HVG4A=IR?JuU;pmIqDOQBnX@LgZSX-S5$kAuigA&N>j9 zzix?sFbB(i6ZOt!y1`8?4mEUzMNp`5YJNmABxoP{vJ_%`$>^$MQ1X50?Y+5xUTfy? zuvT4))SYmJF=rvloS_hvVLg9&M zmFW7VI{Ys`pWD0HPTj&i+K?-^me+L=!*DW%xX87AGA4f_>XgEiot1RUh?m==%p2-S z?SYg>pu?&Q!doYPeH$q%7+SwETvIgRsZjdW)T^d{l}JA;`k0V$?ek-XB9{j0zaVM; z>W6Z_`pz~@qU_Vc%*K*DJtgvh2b6w~-!e;t4a3V0s18701=d^ycBUc>(fM5F3`k2exr|JTo`k5Z+Rf^GJ5@@@bgOve;m(Z_ z6*PAiG_*a()T@du(0~HZQe=)2hlG_L;k_4TzBk7>t?4f*dlR22a-Jc?E3RR!pimT* zNTs#3SBJyDZk8zGW(%Mq(UXc5E8BG@HTr=KOHMFMD>H#MZd#^rChg$*C0NWm+9X)O}fat+~_>mt5E~9-rdW{i|y@L896t`aK0$0Mu zM7cgP2n&su;2II*HWohG0HonWrsec46&KuR-IWnu`r!qY!r>Rev4Gv3(o>V{kj}7s zvdFnMXIz_x=Y_@x`{EqtT9;zNZ3K18zn(kUE^bhWm5+slZg<-kVny3*eQ zgs#HH`#m`Juz6U`EWh05#rY|d>RV%)8rZQ-WUf+W6^c8x5k0ri{c~3iE4*9v&!Uac z&Hhy0?)<}-IcHtz@e;>S>q(xR{lbh&2@hL(b0xdJabEKa-bvB;E{z&3%+g3&#{OWf zIwM$9_^JzgX}#soFSImDDcO3hs95pKBgxi$H>3g2o9_~ zcCMusIF;mR>P4Qx%snV9Ro@p=iaT!`eQ)1H31XE#y-Yov9!jtm(o~eV$7h+{_}H^* z@ZyJbCAwd=RP+05+uGeBWwenHC?V-iYhg!Cdp)_A8bWi zD*617r#7dfrWR&Fv@$gl5$$E=uk02U7WLfGtCU=Ohz zHXg>&1znzgv_kFht-vB zatX3JDqCb2&|;HEBvqOOOm#pLn8_!T@ye?sQP?GkUB6zPku7usY2a9i^ z1C*!GwVxx|itDxH|&UVukkH?>N@Xax2=7a z&#$nz7%fJiwJ?rS7=P*R@%&>9cb&B4`a|8`Gc*j`q=6Fo(?$X*EKPVDeX)z;_Viet z6Dbv|S$L8H=!+qLVSl=UHf+FJlo=J=5!lIuMT6QKeR+C*l6Md%>od)=tOf_H-D2Ta z&Bd%U-)t!ZP%BXqcUv+n75s9yX-jkNOGimx{v%?>lHRR_;9N;QWRWZXak2g+t!lE=*CgMB#(%X3gc(Da_}B7fEaa6MzZtFIElEfX|Ds zxf$QkS~3K@!zh z0S#Vlbc;VpHsFIt^Yhfa_)vEdJWoA6z3+4jjdQA0L|9`bIux;A$zz__4DFS;Zr{5nA0{}m`LZ`Q&eI3^4i(0V3Vd~cHhrD zkhR5l^l&dT?KP`XT@+%BhD3zAb}~GNiVe44823+^TH(cq0yt1|_Pcisn3^nZ%cq+_~`k z?9t0WHycP$Kn{?UZ8#1K660c7IviU#XC$K5?;@gC4m&9-T9jaFkJvcQh#=|v(|k+%5|!6WoQy2) zvbyVD=3qzr_}UnuyQvA78wHxPAkI^ji{(uHQUK7Wf<#P!b`kx?&(Zeb43_;TT1m{p z76C#kJe(6CD6+l@6?a;^xfyD&3aIFr(2z$#CEir{ipDDKZV}9gLXESFK)06AgI10zK zZ5+*$u9=*BY`FFvc;b%p;$&ie!Hoc%Z_QVUME47Cl1D)ibt3JIaf_f}(>h{yNFVH8;je|Ko0Sg-FWG3{dotK+ycgOzGE_ZDL~%ggPm{iTLO#7PYZr{V44VOMyWN-k~SNz zqBMOGXD3!r*pNHBq$*@Ui(9y*Wo{j1e3|Be=kg1xy1_X?%jd-rpC#90MX%)z5bj!M zS?dukaN)z+;tjrIuAdC^Z(HnJ?4Dv5RZ-yU(OO-IZKZ5EbXK6M26ji&FMru=S}w(~ zwSVy2QqLgNN3zTo)sWZdlGq8(7p1?5AS*$h2WozM=#u)0Qk{rI_>%z}KAsNCx*KCv z_r}U!u;719hX&2ju+8qhs@YBV^A6;CWoBNZE^!}-8NTk$RKQR)Bl;b%t;!NG1R<`C z@;un$mK`$f`b4(We7dE@9oD^WPo*;7R_(mh8(YmM_}ZXUr%Bfm;gWa%U3b1(UKN{- z`h+gaIj1_CJu|MuOoWTKdL>&vT;C2+qu71fg$ey&R|J0za~v5E5GhQ!Zv_9wb?%es z@5CIi?xCQo4eDjBA&r2dm}5WpH5@Px!^n359I{SRt-^$*dm2?%J41N(q$`|?Nnpk~ z<^u035_z)W$oxwL_}jyRt!x^IxpMW=#ZmCRl5Ux;un1PSGqBK(p=crJNA1VynnZU# z$@^8!C7RdE0{@qGOT5>KZk}fjWF?R(kc$m(two4QBUD1D0S1aH+-{G)%d~F6l zQoyTbqr%tct&8v8G6&^4fQ?^1HROV%K63cH|7&tYooLK4Rn@zOrn-w4X?LS!+(!@-?kt&s9^`noU4H4TYuDI% zIc>n1{IiKO*t^1{WkdL=^pTfw&ay*Y#Vw#6sl}Y4qdVSD!5uby%tf>vWZI-$zPXUP zxx0Vjp8It@#DrgVI_|2YcTjG)87-!WD{`9fPssFNfs6rrsnlJQ9jZcF@LfL;jFlX%mk@Y~Rca<7$D+uZ`Qy{=A;UvDlWYn3G;l zErnM1xd|Y~hjCuUVD-uKnAmF~3-n(ub7_Aeo}c(|NVX)fMXGJ2oX#z|yR@fMk^DCI zTpM4sq=(3w%+{l0gId71(d@&ag#Cro@$K4`-w0=VjriG$3#W^Cja({NMXgul#f1!G zD(fuUp&tLnky9bqnE`$OloBl-W*-*r{!>bKI!-G|tIt@ox`Lt?InT;? z_>M^qw0xV*9~y9NEe3WzqSvO7Tq;){T6DpijVkNQmR}g`u3{-0$dywYT;zq7Z-9!4 z$7bf|XucUmQSEz60#Fw#ZIzjIZB#@T9Fi=^u{_q>L>38Hvq%d}?#=d6GS&;lM)f~AX z=fX7Mq2Y#6dtcCOO-k1#m^7>JzeYqJrBhc8I${$S(9X0JA8 zIgLmm(MCx|q>D>S`J}=jyA412&b0KEOB3eGt%=tEp&9UBCQ^VlA;1&GJ<=ilyJX;h zrU&2*Kdl)1f>1#KC|zEOVn;X##i`L(dr*qqkna9M;=YxzdM@oUp&#ju1@Q-6e=TuCeq)^g zF`4%Imxs~c$7=s&c>VqW{tpKknrP?uz1F|^L;uB_DW?a(Xm*PV&j0+z?$UuvLNZqZ z{>kq8Yfb9!j$h0A<7{gWo9O@NH^w3bF8O~G=KoEYznL3Z|wY1ATiS$r%-eIe*Ib_hDa(kR2ajV9%%V6~`h2D>>#yq?X z^)li=<^8W4f_)T$41d_BB{43Xgt=Yb49^Ezjwn*cd7zXWmfM8nF&7fVPcAa`|Gx4q~XneSAg#zvQ6gSlKcgzXDmD&I2BmC=`L3y-H zzG3Qt3zHS>ro57n9jfsAobJpRf_mwaDE)F3P79slPXyC3VuftDMxj!d+<;WSQ%i{1DQ^k)oeGwJXx-6Xn7lW}9J^Gp69zIax?ub5cS0(`7 zC$AYRL#_&?pC!0^3d zriMBK4DGVDctI@uprl@5jJbAY8Cf*7vS(5fr{atC!rx6Z4$)$#*^7KRRJ=)mpn(F+nKC( zIoTa=P9+?Lk@1?TbGP>Og4D|j*Dj{ku%+2iPv_$wMD~CGqJIDGpg7u#m;Ui!(WzT0 z=&Sw;GhZ#HO0#OWuRYMXOo0f&!h0WMaJn&{*}WawJ&jt^0+Zgn+XLe7g36*2=>>*v z7@R-4BPjC56^Sm-_LPM{fPQ87K0iO-Z)RQxToQGftrM*g&H8xM!ps=BB#?@6NUYmR8^T)%-j5JRD62}B{@EEGAGAsG!lHh^jF{|Ke7ecT=i!u(9{{Fk40wZurZ3vwy_FDh-AK5i`ihMO+`!6q|2Ur{ z|KoKhT4hl66-CwMLVVR}rqZhxIDWrW(Hbq#ppwe{tX+Nr2#OfvG~>+1jCxr(C*+9> z&nnN5EtmTqSL9-QY788b$l)A0`H#^Iiy>_A;|1Mf{aU5&tV;ln&Vkk&0621_YKWg8 zC@Ns<6m1d7aChDshb!7&mg-f@A+M^CCaNpe=$i(aTjRtboy!BsppKbh=_Gqajn+U% z-@iHc5mw!HUhcfAs&jaXj8>c;H|>Rtp(=d5)x2i+KA7)S4vED|V&V5ZK3HEr{kqu6 zlfPj<1J%4TMb9LXD{$g0-3omA9%nKbTZF2|sa)d#Fh*=+f&R_97yi&SK@LF0Me$y- zqQL^;7#>#7*KOL;#}Kdg8Cl4>b}W-T=0mNXJyhj%|B9ynzkJ-sxSEC1$(j8IF5B;l z#C}z7@xN$pilea;$~F!d=St8?qr9wUpRUrV;Q&2^`) zcH-2#gB~rXu5O+eyp_Bn=7U0&W-ORTU}!Ymn~lUV?CviGMJ2UvrPLxzfLlxwyMVHt z+fDNH4K(JfRY7t-!p<&b5aUBAv=lCRktL3FehXqVaM01m=)%5)0uph)Vsgz1_m_2kGwND9L^vL=+K7^} z*a2i%#;891u~*#pOOpO{JK>k8GM&pG()y#XZub3{TLy-yKR?&yg%xO(K6&hU=zR0} zBa2-VauKtt-Ivv#VZ_VyylWz^-VwelH*UIm0xW30dFhOAU&g{DY?+yc=hrlws|U_q zb{WawTRD{cQk6o~d&_n|% ze8Pd-ZA*_FK%<2-hAXwW3e+0n250JtA^fQ{h zhZ$l%Nfi8v0WX&F4j|C|H%yULS4Yl>_XB^{A{RhLWEZ+FX^uOv#lF5JcI8l0p1{yI zq9PrAJY+IUin{On8-HV^-b@2?0ocM<8$aht z=UEHGk90ekZ`=(&egX>8Wfsf<2A8=L#rj=qEp=JdL>Fkf}>;BDppAU zGb^TVmcvkv*U=WkP7;gX#{Jvq*qT|z$bqBugUE|{ zFt@dk^xlu!_2w~s&Lg{n4ZjPEaOpLrXp{?nB!{~P!m_MF`#E3le!K0BAoZ5^AR{8r z?tVUz#V%AoUzIt*0~z{vKZ;V66IFL8rvsjX5#{SOBm`Rj#~lRg{s@91mmIWk{OAU% zD`>P^FGJmnR%aQQ-ZHiFq_s(6z7p-mvIgJ5IAo?!uH)@q7$6c9-wzc-KSId(8ngib z4oal=hOFsLqCfaZoiSkOl)6S+=!Onum&$3Ut=;6BK8sg#bC_dwGEZ~6YGYTi3(Hqj`NNs)e?NTx zb3S_*0)>}R9OrkEvq~2nE`q@NYJD!B-Z%2_c1a|-e}fd2y)RY}(x0-o=w2#cpsbY9 z(_|E}(2DYyWRj>^*ji+1!&&CP+E{P?fm18j{>CzCE|+sL2({H{lREeUuTtsI{iZJX zYyCH?8LP5M16qVc`?Y6GEB zbOx9@v2>Ckonpc^+fJ!SY%> zW1;~9X?4|kJ5Y1HG|club027%6VO%RGB~J+z7AaP$>axS&UeSEHd=FpVLv}G`AR{% zv02@nsHK<(0tQqa{Ugv1n2gtb4Vh7GpUG?ps+)NwqM;y@L6eJ}&F{YM>HTs&T=}BY z=pVzu!mhMO7$NW2GsviC2N&D*bD$;gDQt>LuHo4em@Y06g^O!~XMl5P`fkH$@#^iC zj1)XI9QR-xh`?5K?iOz$B8-j>3k&_f{@5jiw%Duwl2Ybe#s2TkWQe;~{)Afnlo;D@ zVG7|-!tDC%q3HPWfn*4K1Eo~wb3OuzXJ8St%cQA48Ctb*KY`m$%3hWKkEHN zUKKIy(3Y(_LN(I;Z;=`ndq584DyQ>bB$r&cNjPp?*+qQaTM}@3-t1Iu@5gk&^+KmnB|0q%6>REN6Z#h7Z!wHV+eu2RBuc@R4hm~g0+zul#XdSknIjD~^}!NRMlbqAqX#Ux zmE@XzJGjj}6w3{7r#pT|KfNpf?n@|)RP)!~f8#)R@d&_9HydBuuds%#zE5-ohom-R zim;)KPa`7z-!~jVkmF$`k3m4?VusM`QD-&A#WUHwm*&!`dW)zI{^Aa>{W({um<4M9 zuZ8ff>LZb{5&5khBHq(lNR)0>v!u*Yy2Z4^#g`MdL-cc?*{D&t9JP4XDtySam9dpf zeHNRadc1v1r@x;Pv5n5{bwO*#k4`3zt9$k?aWwY6nXA^$G`(<&j){#43mcRfCM=G> zeJ`ppnVoXc`3Bl(anG&-!yln;x~eZ79aekf6!Q4IH%PWq!LbQ)^b_1{1;_c%RI(ph&WvA8P7()Fg3z z*QY~1v)UsYh;he5z$4(WKf{RzcIqvkhy}do+dSHWTwTw#81`9|1M24|nnD}TU{8+vRaJ_#0 zsV84mk0o%gi63PZaFzS+PxR9%2nNM{bSgrhUEuO+^RJyHJ~QYJmaWL`*%=#FR0N9h zzxHN6yEykCLLy2A%1|tRrJQz;+z=q%L_EMF0oJX{cuVEGpvb~Xg$y~`@_?BZh28&mO$B8}2)BS2m&T!nwZX+X0XMX+ z+^2Dl2S(MR1K^M$c=MjnU0i737~;J5(=P`*2^kMK_6cSvZX@cp;(V+3=lN#v>K^G% z{4i8?iVG>dOVhjcjg!BfS|ALf@=g?GeB7g7fY|b>op$dxS!@qs7Yx5Yr|KVd{>+G7 z7BNXBi7L0<<*b;KFzN@e zY^!lnAs;THk}?W8$mEfUbp88l$`U}lsaE^@l}*UK*oM#Z?~3_xBR(a27ZkL4Kyag7 ziEA?1oxV<_@r3lOdwh+l-(bS4=&?kFEf-$>s~_t;B~*=uC#=T}2p}{HWz@>X$|~~Y zdkS7559N|Xu$32@DSYtM71MJl%VJH7jiywF=`-uqu9v_}yjQqhVTKMxRsQF>=oEtREvYz0}{=wc)W>F;14TFncOjh3b zNzCw_CT{v;!N7Z)YfN3C>jJ5azjS-$OAga3QNKHvV2Z_c z0&%%-J|hmWd~oW6B5ij47^Bmc9(7^lnX}@Plu)Q3GBQ^y<8b9O@c>By(fB54Sj$+T$(r(_|H}d>h&glW$xZK(dr``lpgr4;3xRt~rhDM`8^51vbbY%v zA))LRl4u_x5}L|{ydlcXvf9GDr5dQyavWtq3j$dmcBA=(M(3GUrr)r^YTjcphpPA5 z-d0cK*Nm*RZY@^6xI8JNLtsQ?I}G&*tvXfDHOMa2aroQrKD%&{XChH7m6_ zI3lPl*gi}NLMkRSNH{(Kgxx}b6FmcXpBIc6&;8k|xBMQm6S|~w1O?>Nm|4^pncF{L zF%4?!{HS)*sQ7`jyyJfMu9?|iFjA^Qm0X$!yWZiX4E#%&6<9k5F*jOWsP0bJG%BmP z>^3oH#I%|<)e5UH1CruQSOTaI6#d%fv%nIPy|KXYXMbJ?pW&NFzILuL|XDiZXxsR3%3 zL}FMM^HNrtt6MpOEf;Z6V;q9DtKrstgz&m$wP}>%lP=N=B{Tk_Tqf^B-pW~c45&Xr zS@5K1bMrhVscuN1loszi`IlFi`BtDYW_o{m#z)%rczwMWw6gZG?CPDzkt`9DUjx`M3_fnMe5TZThT zHe0bWDZT>c{XNhk+*`f?}QPA7ZdUQr6slNWop$$oJWS`C~h4?5kd_cbtfEUK4DY9 z7_)ac`)wq)koVKK-JQ|y3##4m#L<;McBz?O8P?bG55U zcdt)QCe6s$zcwxsLc z%@;6M;oR$_lOzER+4zkhC)PEPQ1d?j%xC-WQXKZq1J3RwHqKHF#uXP@|KzsNFQ~;+ zZe3dP|1wl4^sC0VtB0-@;zOfjY^SKeZb6FE-0iD}2n)wj=_6r`miNt1^TqnVg+nCy z*C+D>=nk57`tX%0@<3&fEr?4L(*-^MfCciZ>Q(jiBB?sAmJBIp(_U0A+WRO+oN$r~ zJ}rOR?<=hTi4LOzn+3y}!6c9kbAnD!vbE=~ou}GPA-}B-U5pHsYI1CufYdrTG@tGJ ztuwpf<1u2Ye)?~w`6gIh-$_CB_W<>+_{4T@mh`o^EUp$BHTD$j;dFs7FP?N1?Zevli)ipfsEZ3g3RMMtxft(>b$ ziMu@ieZm>G-(#_Y$#S|UNIeD6PJ@k2bx4{r0Z*wWW2^IF(}fdE(F#!9?pVJSD^)JE z1WMuTPJOV}ixoU(>}k7*FxczyNtTOGf_MK^{;LTT+P4F*1=SkGFXv`@sq|X5(!GGi za4)5O4s}$o&>EY7+c1z95emX>Nc0~mWFH#-i|W@DCWB2HUcDB_&8YZuydT6IVt8+@ z&O_!`{wyvr$Uvy!!W zUhk^c0GZj$b}vc$Mhe+h?z`v*(oj~LyW`Q`VIir!{>6)Nd^W^{LrXrz>{U18!M-4L zc`_|G2m&d$>@4sNdS%_(V)rh2L&m0aMfx?}Cm+t&BtPOZD$dZUMb}DSFbO z?X=+{=5ZFc+WR|!kS-&5^TUJ~?K-GB#Fv>05FMQeMDRe-K0AH}5wHP>OyNP#3n+MZ z=d!sk3N{;ULaGGZXR0lZUnKc~qdt|%<)Gfwm}kCzj*fG)+2lrdzF8k}>XinX+Rukv zGKo&Jn~)HRw{c%J#!t*Z#km|#(GZbP-#}F}M5eFMCUOA!98-RNZCHgIUU|TUR=_l4 zUnnayL^Xc-na^DRr??Q*aHX%M!(~@zgU6J<8Q>cBdrB7YPD6G2>eFdt;0vV9C#jV3 z*4WJev$PCF;W~TWkn#w)#3|C=d)7ZTUi9n*yz2~cQxvXts565yj4n1Cobq`q9u9K? zFh@};ZdkkQLu*4ghw%nPI{LzpvCz8HPj<4OBLxJA;Ul1xVi8EFWkAkbvgiF3KNZCG zI+Mqow|o2>o7&?b7h)iRf04Lyh?Or-77I+j&_<(KBK$3k|A1=@vTGKMzHX%0JQBO? zk7ADwoSGIlHcff}sp~D!4k{D0C#^qP?@&D<&{CFUq2tC&C|tbQ`{nlxIJLx&N?^#S1T$30wyHW`87$jk^0>RX^`dM@Kl@ z?mWP6>QR4OtpijVq5W;{$jx?+f04Izk1USBf62H4>IFu&#DR#X$wD&kU$GP1TZaFR zhtgL;C=_QKHsZzONQYj%c6S=4=qLb2$_+;r{n3|-r?H*HBB*N#-G8BMYXLG`InMpq z8gpp(FCt{C7jx*#NtnZcK>LH@F8R*|zH;X7O8`*&FL`~!lCK&?kL1j6_wm}qwrwBO z=uh)z=wzlode;6JtJCR?eQr2Gp1z`rHSPfQoeSA@Qp^{k8AiBDT4ZYYMgyuAA@QkT z?`B$8i-b=kom~p`KzM$1_jlMzeql6=L~(2PzB5>DnepokeastI<25Lzb9{{Ho~u>h z9yEc=xM02%xE{a~JcNlcpa$b?E|k5|7Xc!GbVy<}DO&=?yD8@~L|&jr)PWG}vvD+>2Wy)f+zXO{A@I2;U8qz+S)UJ(SW#t*AW? z+Ks=h4Rcmp%O>)(B#)?n;3k1s-v)g z%q&@Q$Z}P$xQH}<#~8X<`Fi}wCw;j4J}S%j9Df??&M?_D%2w2sXz1cI@?4)peoZ_d zz3|H|THEA6=7_6%h9ar^<@B+4_Bo5a>gD2oX@dE4J5xiEi* zG=2~(Y_^O)K2@dF72mP5cVDyXF6(62vOX*QVz)_NButA>c=eO?(QQ~c^48p8wf0Ql zf>{$BnrOhn>ju&iTtL>2dxt``V9L)r0?q>%d_K#yoaP)Dx~NkGbG(ld*@i&^K*i~H zT{3r<*mO#VXZ4L30yYREd>*B#0*&eiLM)I-xD@m4sUR(4r$!yGLwgrTIU3YL55&>K zK5V=XY(CyM^oZ-Rh~lBpg67wh1dW#YbsmI;Je$5@uR8pD&yH_+nH_pLx;Q2pQ=^8)DbdS`09UAD=HjpEw{)(#D-5*Rlg8TKPl)^MX|;+o zuQ;;b#8~k&f9bXPTCyaZTLIf)gpK$x4*-Q>7U0HI#!=BZww11)wNQh^-7&dQ5k5 z8Fe)&Vg^}lcVo>e0OXlmc7l7sgV1Bo>f^w{GSFA}el(mLCwNj;74%lF+Zt&cXdu|&U#dnb<|0W0l(ijjn6wKzE9o{LfOjeAQ4j5$XIg)@M9Ji2xim33 zwyT$DBSb#cGKOcBc1RyLI0*UIc;q%mdb+4%!%hs+Nb}AZBFJ<^_t-5M zNl9JVlzrS-3tuvQUOV~%(B|nLI$w5`x`c&jY{WOurl3k>bZcHhrX=2rvhWIbH04bhpYRAu7nfmFA;ASr{6j6oNk$JpBVuLZx zb=kF7O4!i90=h@w(^vu52nEa*gEBv6ntG^DF-t$J{Q45RWwtY}12i1fA#4h#p$~d! z;rYS}r*XntxaK;16a9J7PDvwYQ@vGsqWGzQ*)&<5KDt-hx#{9n( zTYdlk%GLD&0^jhJH>6e8u>bJp*yp>XR%;m@R0-x^V1Q`LW2R(Qdr&qXiq6#DKJp3) zlR9nMJm}Z#o@6RNsi?fed(rIcZAM$2J9KB5Jy*$|^_v(fe>JGj;*I$KhA{x13GdxT$#?aLIYQIlJ+xC+VO%O%Pb3mqvn=}IoD9Y5jq=0BT*jDB) z-9)?3|A~3M!0a0ifwLYWOMKWaNus-@HPYh+ZD*7+?i0D(dF3dFtPT4+P81{D`xnjv z3_4weIytPEh_^$iDE->D5#7p@qi6;3LduVs9)f$$V*?+m^bi|~J1wzd^jnl_JHK2^ zT((&@abbe_0XJ)!p5fhcF@DKF5wqyiGv5UTHDW6h1Ifuz}8o002 z>_9esh#87ZKZgZ&Dwmjt&tv1IJsQCvWa8vf<#>y|1mML1|CMrc0t) zwjcVbZ3o6990BrF_WUrvxVf2S@!lagPKH|Mp7ZW|0Akj zzVm)KJEC6-LM8||st&ah*4HZrhHCuSD1P~V4I>`%+D-xR!+eP|dk0{KGbh!c;4YV(X$B}6MP(a;56Ba+>vzaP7G1Y(KJb*>t zB*SO(#(DDCBGxhX=m~r~(Tm{!{Ka+W1#S>gRF~+?E4nc3oKWPd9xKiLvh$(Jc?bdy z!!=N*Dt7V~()9V~*=%w#$d5w*nI>`qy@G<-!`Hi&|9C|NslO)61O~z^ z$1m-0@f7ocufHj&it_L0fCB#Opz$LRJUrbb@qH&5q#tVg0A6F>>^+Q|D6%>*N zJS&C4V8PD=_&B#gAtLsIf<86E?yfL-T31gwDzKYZZ;t2ZY4XYD_sqCMMGlKP)3pRy19LjU zqb?h2ADOb<&k(vE0vmiwxIl@IdAKScHhF`Hk5D9p@<+H&hvpT zf0wDz&P~w;Tx%noeh8iA1QZ|2c7e4&IRnGdEIWJJVeP=2Z09&k`nx5KWN9zVxZ4{p zx63T2Yezc~vNzD5rt-?zt>#XwVST@O&A@xc8J=GbKn;iUrEPt_g?pWh8t`G*4u;1= zznpG!v(_;oHNmG${gc*;T=X1{ddi@pEp=nws24b>(cAUn+(avc7AE|x*Nn>V)KUV_ z)gqr_-tI9k>2%w@V_dVG_J+#*prv4}k=-Zfu5TO7q7JO>2cVNhD>~s28m`fXe3zRh zY;I2-y0OlrY>+v+f4{tfVvIh|quRux9J5UWWrC`qdUO9%-*Fpimt_2{V|}*nJf08Q zl8Qx*Hj8C`B)4Ql-q8Ic1&#*{QXq|L^@Wr6l7JmZ)YbDH`;M^brM|#K#mlDTt{=uv z7Lsv31r6FPr_wpZ1A+_fr6pckOg!M(A6>03S1zROuD`q^h)4sUMcnpff6P7!?d)(o z%zf0)`SwRZ^mtC;l_iN~wM~t#(Y>#k{GLBg9(jxD^I3@TBpU}q*cvEn^c7O|G4ePg z4L{@8I-{$HbJKUCZ&7K-NF$p&QE|%Y!B&WJ;(S5rx&eRP2UX$g!O$s90!|lY30V^B zNJ2y!;|^Ty6X$>Mi&xUpACLS>y{hq)>kietYi8EH&lodqB)<4Gi3o-8YyuMtbR^_< zU$kBi2g_-N#>k!}*t&b=d;?FzZh}^jtS-qcsuicI(Ppm>p45)`wY0<(Q@W9q2Q!{B zq6!b5T(p&VQ~2*C=`^ji*s?I1JTFv};wZeQ^tu$fSwn7bl2303M-v;sM`i?TZGk4v zQZRP#=5KQk#bz|ye3mOk-Kyz5x}>igN>Qz+X@OCD>uMJB&~UeLVac$s9tIK$b zsR^2v9_kt_$u1+Jws_h-#-1a#yZiV+C7-TLr9=S#_Vf_01|r&(O6+s_+b8{uKl|E) z?Fu6G7tY8C#^)Pp5y;(uYRGA%3QVXiaKA_S9r6h-edHp}(J}YUVy&_t{+IP|i}d6y zxIOMY|4Ks0mfaR1CLpG9f;oTl=QJf=`=Dl9_f;p26_;%M9y;>SSp?g?O6kk*d&fvR z``{kC7^w0Nq;!eNEp)ZB#u25#r^8l-T7mDe+MVDQo9E2foG5Rz-O-ZK7nLRH8I3)! zxmuU1>;7vXDbiBi5rs2(eH5dN{4OsUL(E4RSvc}yuGFnBkPPoY>l3yQdM;UQwDu|l z1n6de%qO$(@8;r!v@c#*PO#&?t4Lm3S&tc{);jNNsCH1urfB+CsEmZ0I-dHRwRfq{rfH=0dP_XEM6t%r4yIBFJZdB>crJc88lM<$+*Q-B5}3eF(&5qU zv{MB#9pga}-A&)P)h@qwh0V+41($DbzL%YvR<)n>KfSnm`2!>tx=P1dQ9_oGH5r{l zXd-{z+OO6V84D?-vi&+w&uvdz?{Bz+m_q9O*_6*H&oE5kCf_WE#6LN_N#yytdiue= z5pvl_V$@RZ5(=kj*fk45WKIYPxl(UWT(f3jyT1GPSf`j_r8>9nct z*j8`JGIinYt5Y^#TTby|E?<|vQ*T#{l~?-qia%G2iHjie84C8+H^ieQThpz1LFh>_d}Hm9t?%^uuQh^6 z7{?YHV#E{SC9HhA$7S7ael+EE5YJegT9uAIsoU|N^_+k%-6TJM0hedjPoy_>eb4Pi zLzb#bac$x&hj9Wv_nKa8dz*CWd1B$3{w0Y#hhMeSxC4#cVH-(@eCg#mgxZSn5vU6n{B^vXK$FGhORc~BZyGKowtR@X{1 zDhes5JFtruOB`=vg9zQgt4k5u1>Y4&A9zaOne(P?>Ys8i-tO)Xn;TZJ8dnxbA4YJr zXETRS2--hz<;dG^JTs3H{cIA~_m&TFE6WaSweSBe;H|mo<9^x1EX;GI!16P_SxIv) zFH366mN393pdh3J9rsi*ar{2~KSlbb21q1w<~YfGki_K@z) zWzDgea}<>%O6QGx-Pc-o(ZzGJtyjKW=~)5!T&+1TT_ zX&9@9)=x-FZ@UWsNYMYHm@=8or)9>{-QAbnyy<_+K&R*Xo*C*?yfso1P^~W@e@WeZ zhwvfYZ}`~HsHyR(3S<#YW>7DLz_%5~#&~Wco-`Q4Zr|nrSHH+{=sn<}E%^;otRn2p zCZJ==b>-Y>|E+N&^Ea( zQPSTKNb=uK4(#v$OCgz`_C(-z((%AG3=Fj8llVJSKD%Y^ciO+3PKu0yjMCDNlW+3o z-o=w&JwuRH%H~Lw0`!0!MZ0UCsk$YHftzSBnk$M?ua#uMd0v5TyqeFrOM0hxY~ZA% zlDlQb%)6`ofrLu7Niq-RM+7U2%Oc%o_mcep?fV>QWt_I9Y))}hiTj?1&J!DWoi3ZF zJE!TTDib>r&1@0U5X8aOoc{|zt(m6YDFKzuTbYMhp`}0igjgZNk(B{nPa4PVE2GVe zxs^(XC>2T)+j%VQ&I?ehbl8^&SQZ1{-gqytaYPp9-PalE&fOr!2VRd;FHZ&g&6av{ zIxH&d&JNtJKA+f(-JCn9h_J)nO2(q-R=+1|G1k9YykaIURhgu^Il8?_sV-<`3fZ>o7p$HRWcmXnHgXlh@2Ysg;c}Y=shm0J6>X9 zE0??r12$nxdw0!6lKrjnM)gL}LuV6YDlgVa`zh~1D_D0}L{w>}xb)XSv>T*UqtJL% zDB&HLc*BkVS5y<4hSlr8&#ulhKq@T5O9p5@^sQ0klM~E+rJC67*Tu7OBG^BWe+Fa> zhARWVd&&-lxfg6#MFu-{GI(DBu*|AOny#+tSDH(kYOn{K*)i-FfU+S@Hh1UO``(9LB8%c6Ui2w*%u5beVU2?q{lg zB%G4+ZX>)xx_S708r_KQx{o%JQd>`>pp)(F7cu-fbAf$*^hc&IP)OHk#G7>oC`rWj z95!8Lo(g-Zb%Yf4f%K7w*206&dZ#_}bQYIMX!eHu&H^tkKt)tpU z-$-StN>2@4isjw{`|jS06zuJkvN;ROK&f!)o^-mP-B?0e4J~KK!K+`g#G@-zIZ_1B zljxl;ScLw}g~%^mZ1_w&520hapiA=Wyd6D4--#UQQ zpQ`K%sN_$0wBCSeDXsl*Z+8_j*JhRRZq@ zGWmE*+1r(}g)*APl11fdQ*0!8_%x?s2D1q9wO|NOXFQo?$#sw)dD?B%fbNlcv0}}F)2@#n&d5C? zFhh^h*SY&@!iB5S>TI@vP_wy4`uh6A_v;Lhl6-WVYtqO^hWF{K$?iD6G7FBe=dvEX z&m9x|H91C@(4c4iPn9+&UF$Dx!@DW=W_oAeHuQ0`Pp=LPp{>Y6Rc0pb?X9IvX6sE- z0(~qtk8nf~7)=Lr6c`5JIWfajja(ah?;jpCG5QcqAds1?e!*S*M~oG(sk6TjUnr-6 ze7L>-*-C0Z0~YBRx?=WuC624i8^z*oNwM@o95Hq17q{e-VRidEf7~q}n^SUVlZq}E zmy{~VGU>Z?5?OQ;6Y8;jWf$bh_;@A7o3@&KdQ;H~?dP?_QdZ-H2Nx3-^Xmr^ zV%xm=EH0KOSkUz~-tg%o+LX%3hu?Ab1|veh7#Qx#G?S{>=I)*sY+PTpZ#ka5UPYQ_ zCdy{tqhKZQY;jF$Z497*X_j4M7>u%u9>e(t<3VS)OeP1x^H0}woNAZtmx7Jg$5HWi z<|vTKtpv&?Pt=eLX6(m+&~g2N%^`&5aVH+#EJw!G$^%b0`a ze5&NTA=J}thWUhd2w>8dA%wgN!`)zvz==cE(hgkdyc8sEGJ#vB#CUXT?|aW3Xt{M7TRi6iF<^3jUZH=s!TPxv}%d0#U87ux>5fY5(Fb+N%SRgHa7i(ubg{ z6-U;42F(#w1^VV;ZRvmWx+zomybL%k{R3V?$43YY70aJti20A66q^v(@pX#~o^Owl zD2;?6_vdV#!EM8Nf)m>|TW=G;4*XI)|Hu<^l}%VIx*G3;%w5S5%jQImV0y-X_P`Fq z3;k6Uu@4WUwIJfJ!BTCp=?khgM2cX`I`B%_RgvDQfkP9{1!V|T)B>*I%09z6Y*W@U zCuSpHM|@OZIY5!=47{R*71nVhex1$O6xC`N+ylSktA|sPR5-Eai zH}dOB3LxE485I97#x&@Rd^v9h&$BtQgY<>5*%2dD86EV;ExZ;>V!a1GfLhO_bKCLTzW#WfD&{&MZQ~hK6?JK|bHb zt3>_8Q-~Ey*j0ZU{@l^}yPu3#U>uj;uZYB^Q(KmgE)m@m@uAb40xu|2Xwf@uiyP$* znGN&yV z%sqUCQX%W2{`KMydF4tLuUu_3Sw zRpM0$^tXW=Hg77herf9M8U9M<-r6Q68Q+m)v!{NzZgpp=1>I*8$mn5EWi?i<@zN^e z^+hWxanc-$do!SRlg*g0V7lb#WM_?{m+1IbPkmh=x#n@`zA`?0V7ZTK_}Q1=fj0Z; zr+@AoYc)TyR_H6F-}XDf{qJHnllwEcDXt4?b(;%`yBz1uxqu=m-VcdbuGhV@D-DjdHdpJmSB)%2_r%tzdJCF$BvcwF~C5htPr=3;Or7rXRBCq;lGpA zC!#e+sb=OXgC%!GTgXbo)ZCBwR8K)gg}wO=HJn#91wj^@RPH->k|C9zealh+?MFTH z#@%~^nXKP_aP_EM-S1n{JA(T{$_u!mu?F-MyI33yJ+U zYL)nb6J~!jT~^@YpZvZelC~&&5C#@?kdxrQ`l%$?8uPT3J&8!@vcf%faNqAZ|4HHr zISDUDUG7UaO$;NsgSyy|a+-9%{jD^tb8|d{ht@yf#)zP74RkcSByaL2J1aJR&J|(9 zf}m1lz6QW9r#@@VJpj)DJ5BJK;EK;n!QR zfQ}+xil?Mc;Lm4P*=uXcqUwg=>nKy5V4C2rI2OTxw`OFEBsdfUsj!ff`O5OD$Kf(* zwai_T`xQS7@}k~(7N;9*LA-85&<%XTeURm`X6X55XXf)$q(_#Wl}%9|8m{#ky;et> zL>;l$(nI=KP^2PwZa-!o*z_eh*+zKAApeo~1-8L*=d0VGuHw)%EN1CLh77;xJKz^9 zRqlgc65itY;aJ|7orx0{jn9AjQe>rnkSutr|)`~vo{mH5W| zRQm*Tn*C394L%eqi#n-wl!mySaFoMpSG=i`zke3p7-Uj~)tBCkMtno`wTF8SbN{~M zDvQd4*$E**pF_y;lUy;HhRr&ss+sBQwR?me~ECt8F1oTr_Jn+)MJI$ z_kdub^d7PCJ3?@LH}k`0Wg@4c5b0zgbCeMT7GD$R+_)96mF}m!ok34);zd=*sI(>CTVc$r=;zjZ zZ}kq5VC0c-QO{P#tW_`?f9e|%Qf&5{xzClStWwckhD8WMLWWG#yxU@4Ie%q#SuLpARhCY3KkRY&Ey?m(OeEGF=+9$D2 zXA9^2j%p-%wb_`~G366EEBE2Bh~1r4FwQTT z!vu&SE�ZOyMN`yo0Zek7rjgg0e*7a-ltrwGxKQlEt&rju5N$Stcm3r&*`W#PTzeh0_JpF-%9*f(~?+Zb$?O7rWq0X!uIbf@tk z@@bc7Sen1x?w*5hvFs%ey>ECUxp)R^4bBg#IV-^m3=}<+7(90%n0FK|;33sC&TPa1 z6K<(_rZ!lvj9%{iGz8bDaw$)J=f4i6&_kYs%4kRrY4iQjXG$x1(pd!lIpFp{5=VPs zYs*T5-ln!Td7kYr* z{a#F0FbcQBmVw^|^SSzO6DSoA57t z=(g;!ej<9A2zy&>vp+47GD=(2BwanVs0zc}*jb5;`7b)B@_Fm!&peGY-2G<#KTloL zcLWuU0Hci?g#mN2bKo6l_#MmQX)~uQE+b~$h^4!CKHS<_>d0I+b)IDK6n~u4;1fg5 z32kKtXPA$#)O>J)_*8P&jT4y9m+}Bgq{)>f+OYY`@jV2;1Y7I%xgkeEbNteWm0Sfy zjcP>8zzS~HgI7C&NcpnsZ&He&2haUWI{Qy>vk&)U9)G&-=pg5wANJDBR1*Eu%S8e#WKqr@;{QYe;j5~ z`|Z^Qu_UP$Ohdj?r!6gQ_t+#5(O_XwiO(&>`UnN9>RyU=%V-d9;!geZFMTd0s%M)h zs@S)+fPTY z02N6idF{u)?|(EMC|jkw#M}xAi3N6zYDE9gsE!Vd`^qnCf+;Fv9S!I2&t}9};A_)2 zVnH87H!3!_BTj6jh`%K`*EGO$y2g=!Clm#}Si_OFDL05loR1rB!%O`aHT3M4lg|g6 z#zOMS)|d3n+xx~e_09kWe^LsRR4A9Nq5<*Qw0r2rEG!IkS~k!5Ucw|L=J8_B9J*zuxJyj$~L=UiHnf7XkXF z%Vj6>h}3wPy&G!=?a><0oEy~0K_e(Z{Psg!s0J6#x}rNu{q)tdw_*OQ)fTpK!Q1L_ zC;GL)vlIMGWF^wKifeTMnAiRfdv6&~Ww)&j(;%&Mg8|Yh-7VcAEhXLEAR>r@Akr<} z(z!rFX%OjHNO#u)7QEB_Z1>|n=X~!u@4xTI`3H-|y4OALF~=NnjqBP>u%o80*CdzA zc?7AhBJ?Tz!03T3w0vO_!YN^vd$}YwnQ(dbPTO_FO=e90`$VioMtu+5fc}H4q$EXL zf93G*8zr>I54W9&8(H_O<+v+dOrOhmL6P1yiRJOupr##me3*dKCkfJ9KiS>a?SJZ^ zCvvf4qFMz%jNd{)zVv?cUTCx5Yl_eoBZ3jsb}jFC?M#gwpWD|7Tmr@F`Zd{(nYE25*V0@f`tUA!ru4-T*#dY9Vy&i?9_pc)pa;>caVx!2gT-hj5_#Tto;p1wb9 z)qeX%r#U1)d}~}JC9N&}oHgC5xkl`Ik?d+b$KmBRSLcHN#Ea9z8LQ7{+!d4hg1!K3 z*Vn5BDJFYz;9PCj>Q>-3o3#10I{>#1UTVV*nGM~o7Ifs$O^Qbn(aJ%2Vl(qWX^oGg z%kKyxX-XSP{1cCu2|=B0h2aE=~3L`+!pe6^ByA zqJBJ^ocytl%5XE*_ch0eX3%u7eww>2ynIAHM2c5nczCFS<5jk;1C=-1s9TU|E77f} z`#ib7d69%wCV9~ixqqtvX{J+-$ceF{VFMlN5H0ZfN2@0rQ_oqB@~g}u&*?kZ98qTH z(~+K(t@cIDLkWz@n)oxj&vP$KtfDJs{nWdAH}6eyN~D^T>k#0gvA%dxqIoW-M$rn( zS|71~`#t%CbXAe9VF~kj;yWP&F;AtbJv0YV_vCV8ub4a9v$XQJl1l<@jJh?KzJ)xu z$M;ghmbn_?Jj>G`@?`_&U-Z-6qC3qmNousoH15=#{W>&(cM|qW z$WwT;p}u}d&g59;oIu#F`D|vmC8h4mAiou9BMHcbtWoZNL6G~NhiUCKL?=DDB*1+) z@J?hU9okiRtkrargAja(0to_di_)pkSJc$I59W5(R`O*T=zc!*Xbre4|B)qm>uTe+ zQtYoGG4V=_q=9ds$c#!M^8BaScB8^L6O#zXJ$4h%8xC&nxf+*v-;d6!ui>OVs+(&_%r9TbvbGuX#q2HgA#(e zh>&^NU0r}j-dQ+2GOW>4PhcnY_LZ6`qOH{3i?RJtYJ=)xp7IRwBHuat%huhq4?)+5 za$}0~VO9M08?kzO&KwRMo%Gcd9W1e8fZK#$WT-e>LT=jlq)chNSXZ~(pz67Ra;B*A zd>EZxjb4>rci>iU!G~Es=s-5rZ2i}xh)ytQOZ0&7Jcgn!^T{#gp4d$T5(zuf7^PL> zQk4H&DUQr1ZXTqHT)CP2cX>41+ngT0*qwR8M0Ok-tm4I{sPPr`(GoIaN=+jIJbK&2 z|G*qfG`o+4t6RT%vR|cd45(Q8Y!+G?OMSZBHgeZWDpERr1n}?IO0!UZ!eeK>%8VF& zVHI2@VE*d3#r#z@RP4))u(_)*jKsP%@(JLCusugAGltnn1JV_BRrk=z-G1b*4`R4pGaZx zA|$~~s-w*-?wQwNOetYIN#Ypkf5{&x%M@n@u;_Gv%*H)&buE+OSxuley7w zb*pPUPdU~^Mt1z@7F7AxoCQX6htaPP=6K+)!@Nnb{+tKlAulfej=#Fp8$vH+aEH?DfDf`gdV#3|7Wp-hKXfA6*L5Hc!kOQjLj5u~NB9!t~Qw@_bK3%U%AOx6mX8WbBrY z&>6)!K8n%on@z0q@K#qPmnPQ({TYVVau<7vdN=+E+7Vb{KuhQ$G_dk`~(Qu~H z^M$_ceHP0XV&cE~h=_9Q79Ee;{#1z#409=-J?nW(QCtQ!GuWf0{O0{d z4UYQ+lHw!a`vaUZm@mV7!}*~0F|+&+OqTIyC>OS;)K}kj66`K`&nqfW?Lz=0E5q1# zQzlgQm3-_+!5%*}bN%JlQV)PM!aHf=s_)-Yp1fH_^P49%Hzl{rzeyU+EmBz3y%4!- zBVrp#O&N{Q=I}fy?-bfBDiB7eAK>{CQ1OfQBZ0CfQM3{fz2z&^wTp3TIAW zHb6Hu-FnWFiZkj)y|jct@xAAYnvlk!fU7O?_Dk}yB%@U!Ok%YyAIx(2QZ2Nbz3X{P zZo98H`H#qx6gU6J$_isVE5)*&DmIO1v@?HKB&en+2wzuzABu4A80kupp;_$k0JNj! z(Jlp_lN`ZLx6(Tno#S-OCmIOwf7|a261~$m4_`UV)*YresaEGFeq>EC*q*3|`ldQJ zU=U8anH2^wwM|;Tx5umJ#p@Q)5{9o5O+GtW{LKYG0;hH2i6@Dh8w(QcWg5)Y;-n3k zwX!!QccQ;`PNQcN>)3vzigN=hCrtx$s+Aqs#n?47gdn22l` z;7Jkjeq$C*>WFuKeG9Ef8H>7;I-<5&-j5kWWH79LHGE#k(Z~(83{UU!2<2hLh?|D5 zQ|CZEoA!w;_7ccJ763W;DZHWuXW=;43S6_*R}$@vfY?c?|;w*=-eZO%N| z=a!ipQ`dAK$|*1r4Vs3N!;MX-YG&?+^WUC(XeWN2=l%X@&m?8wDAzduV@O#9yC$4& z2;IlSzraq+k>aG0;8nW)iVgMSU{7S_d?U9HRF+bT-YRSI(55n=)<+9k9!GW%)=`J~foSmKU+hqX(UiDN#+H+U>v=4eU9 zgcdY0;Ks+3eB~AD15kw0##V<2}gk(8%y&VYxxP+&y-nsW+&*O>2gsA16+Jg~^&A+p@ zrmo`74$U_PIFllu?o1tuoJyriZV@`tQa&Gf8HhPPdyy?#*La3I6<7zPs zul2ilkR$X)nb|Sy^7IZly|}j=9aRenuf5(r5xWN7O^;cv?YPa)FX1OwP7wWoyQ_*H zd6LJy?rRf&3X?+P$3QCXP8IR42x?>8Y|E z-)Cx8VAsMFoVC6Xzc-^6vk#DT1OsGKjC1GYYdEZ{I98{N5@Fvcp=!--q3g4z80a~^ zr+b~`Ln%!5vGjpwo*O@ksug%eXV{W1rSIGGyBR-*MWoPNvT7ZKHAZ{6bYrfL`=O$f z9#Eq{vHg)mubfi2Hy8xwEv@{oL@aO`~MXj&a*7Wn-`Zp<_chr+YZ7(cL!0#9R$N3bqG7ZFwfxqdK@XDj?MnfTg8 z#}bRtSU%><$Io>k=?~1g-rU*IsrxldQ7I$$;vu)wSb>6MKHQ4Kb5_UQddf-}6a^eE zHQ}aMSHo{6H+*YUY&rb=CI^@E;^xb++vfI%Vn3MnH}CUBXwA?JO{recIZY|Z20r`D zi=221W-V=Y7qC!-`n9hd)XyNpGK!pGo7?#r%>Y38p~-`T0ix%l0aq)RczZmm89uf& z@jj{IX~6b+_QzZ=#?*0swct!DJb9e+^27)wp_zAg7Nozb_%|S6+sRi9>w7$dXXQ{S z1vLoVt$b`m`&LjXxb0{ws|+)Ur}>@cW;S-si}V5$!8|jsX8+Y!m@)hte2n@Umpd{s zu?Sy8O;|*dm7Gj*U-9!G*_-G4O~;7P=h!CnD(&l>`6K@tzlq@X%m|=O|6Uo~rV)Nc zIz!Ccw%(%KmGO3xduJ4)cR!50nqdg8=pi=0rUzYW)ci#o(z5jG5@A>KlGYOv2!B4P zoSn~nh!SFO7x6s;gvdaq?;nH`zi2n-)-X1dFQp^R*<~s>vwO8{%IB|*gsR~7njSP? z7!=pcd{cO9m7jQ8rC8l8>`{+vIdk`)-dDugzOL-e1AHK~???rrn6ye?&@cO%0EPf^ zUjLWf9}qQ>Z9=M^SncpLk(F`ry5uCeCPmWCoosRwN@2O2%CdZE@9O*18-FJijB>Zs z8tHe9D-qfM2!NkbTE@>sZ)5dKdwI`rxWr9a!WTR7v_+mgz>TIe(&1=0?V%+VGH+aX zcAvrr*~I>_C%l2eiH)~1%G`;23KTAN;>+K#RquJJtoCP$i8<{A^%rEDYu!op{=jaM zLCp3{35@>c$Jdv)ZM_v244T`nY&e%OcER@OJL7M6==dVDmG$xrS;}A%unih#Q;Yc8 zviJ3#ZP9U-lD(imZVn7XW0~g7Fb#XAc|RAL45zsPd+bvcr7<_*dxj+F)Th9!bgvDZ zkIyGQOp!vJnc&YYIra#Q1&^MKKQzShYOw^phgc%DMV}`O@oKPPZaqC!tGlg(G_n4KAra zY+Tovx6EVaH5SDt2KpBvR51>62BkEMqK7JRD=JhnMgg_;y5cmzbkx=Toc0TAN)l_N5tJtneO<*o~Xwqq5dPsX;tg76g})V}zVSa9=2% zUOR5Fi7GRouJjD^BFd-Cw$@h1n=;2W*LlHCZCuFiEO8=<`zv44)U!N@!GhynEQevG zY4($STFM^o8I+eUxCCZd7cYbos`|x(0wjmWp6*2l&>}wF68NS>ZBF|^fIYS<8d3Do6z)<(${Q!G{-`c6-M|d+bC+g zf*uWN0plV!)06&SBu(!)pnLniTR>b3Qi05V#0(kjXyQ#g*;0 zb58^0W``HrJ>DQ~H2?TRZMiNipfvYOhg#x! zZF%-Uc*sPrN#;?4ihubqf(rlcUE9n$^6u3hnvAxdLY42E0oV|=%Mg{Z&1XE;3R~(z z_0MxUXa-C47597 zkwy7+jSuXHdKF|6ZS{fCAPx**D;6-cz+~j}{(q=F~W6iP^J=3dR~N zkew)>x6|E;f5khfI*5%{_W98;wi^fhYGPP1e`^nv#L6Eo~26T-1N*~# zDZ6uE44z+fP#MBJ+5EmcTxrLBz9zGc%P?x75|p27+f)@~vEFVR0Af8yK9oJvaVLLb zIr%?0I74R95eu`0`|46|pA!w7e|}g~L@rWpdq)VWrkjzJd>Q-BP4mefdyu?3mDQ%* z)M!gga#c#v1~HySI4ITYMjts%8}nh<=72h9QD5-oELoRe85sBpr=`Pr2J5fDWSC-n zS@!c`X%4?hoBxLoWKUdV)RZCC!_*1>yjGq+tsQ$hkZm(!j(Y^{otC9=qG!eL6u%02 zq=hBf-IDII%}%uv0F*q(iDNYYP`T3PqW=Ngb#_l6ptV$R@Sb4Ne~h)9j~6m^+*#00 zXJss|>}ys2z`oWzj9p6-68=L#Yb-}3j4s+BO;)V;84;J|P}gqy+noUdZjr*;2%IT* z|H=nK+?)QK?+3l>zlhksoG3C?OZYMTJBxnA` z84{b;qEGmZUs_DqWr_bhJ*=3DbK-EJ4uW@I-KwQzRPJ`o&dkap8C~T5`!-E-HJ^8F zIO7A}Bxcc@=j^zOK=N^xF~x-M1xheIHpk&tnbepA62>3roRHiJ(U4 z1zwmn+Es-nmlzU6p7Hygl`>(i`B9c*Se4@fl-d=}v04gGk&pelhmjME8M3*5(#8RY z&qoOM!1K1j=l@j!alLZIBkuG)-C|-@9tq6CGX-(W)je`gr1X+yTQ={{(aM*J>+k~5cj*JC*Ehf-XhHEMr<7$4h+bdV1Epy z60*8fn+|+AOZI(}UkRT@!s9AqIf#JNQ>{0HE$_-K-gJz&)12y+2PH0LcQ;>Ra^f5o z(qUvUNBc5CK(E1{Tan|g^9&(2&(pzR3GYD!Jf8BG1b}^X{`NxjGXc(aC)u{R2wHp_lr+-CkhPy(|G1JODaH@dhJ-V2Zjqq66`pFTpD)#I zit<3%(TT0HX8UnZ(zX`Q+8gNc#lu^UIhlzu@H^dQI>*RrAG;ok4&db>k7!lxQA7uiNJ zXwYdzmjuHp{#Mr>{*TKx=wo!f#SKr@_U)DXW6^#CWDF=nAUBt9vcBKj>KEJkE|WkU z-JfV22qR{1BxEnge=*+l1k~Gk9#`Y4nd4Oxnp6*-cfTPn%Bl6sP3Jns*IoVKj*3VS zfLlBXKDLfBXmT%E(klcY>oVhZIU`b75|II*ijQjXTMFH ziheJfDaPUxiGsx^Vf{GudpbUN+8fn@BFdl|r~V|u7k;T~)u^l=a)z}3@k@5*8T8FNH zu8y|+ZiD;gy|?578t}BEP@4!uWOOvkh*?G|7hpcW*XI@&X>$7POc#==BUYeMp#1(N z8sAWf{TCtFo4=Z}E+M~65=r~1=HIslsBd42$34tgH9R8h4IAQo8Yfi757Ozny;WK8 zuKRDqbA+C=sEVl7JobQ9ViB#D#M0tpA~9;_Yu#%ADQJ##l-Nw@SO7L zf?oN6H*{=GIkmKKBR(9HDBn6G;1v)XF61H7%K-f1FC)eI?dCbEaUTovxCLk7NXP>K z_XB6^B_XZDc=|)bup-4cX-=1WWak~9=*(`LF@$3upgsv=6B@LBy1yI*x6^*ec^>Y^ zO`mJMr>a=iXI=1#g^2ARL45n5^dhcKH;D%~_lK6>EAxjf%gbXd#%~W-TQmAZ5q=Q% zIf&4{cTYz{*9*nekL-Ir8J7kA?BO0qP!OM|84Y}VX)Bhn4_B{lo9IyL`JfF4H|Gvb3@zwuj zjlcgE@-i4aPXbA1MXEn*DF5kwf872*|0a)sfq^XiznA>i-ud?>`rn29znkv=n$Pbo z`0sY}&)@#neE$DvJ`bNFc(|7?0b2TvZ|@)URh;DJ6}_l>{_bZQrPEx41Za2V06rt8 zeKZ{M??ztptAtu}|JSGdUp;!qdq`f=ob#Vr9EyKRZ%vKV+F(*O2vxYU2E`SO?S#-NcbE%c$fNk<~AVS>MRlqDZ z#V<(mUfY%9(5(cMUL|dI8+xN*lak;&ACZ7do=LX{4)aY3_Z~Hc_3H;y`yWX3r3qA% zDee6~9^kLtP`+3Ni(NZECFk}mjhmW?-d0Oq1oab}`@0SKKr=@pSN5$9kQw4hCz}CG zr}+TcCS)Z9B${9@bcCiGO;$c<^z0Og~WmbIaD#a{?LK;};PW6izB*{}IsVZKhlXRV+gvxe^fdy?6PDc_+<6+iNv1VE(hk6a%~Bh< z`^0vpl+31fb3R$14T$6T5pR+00l}D7UmV-9GY{WF={u|SfIjWAP%%;OP_lQQNikuv zT)Y2ypcn{ypV%!JCJYfFSKs6Mzu(_&%|;IwEu7lwU=pI)P#|s&dtNTvz$iA1|I)Jmu+eBzAh-9%bUg&gWnzq2hF090YXAw3A+SqD^W7HAC}Pu-al*^EB{KG|MY`zlF` z(DQ9*CJ?@(Eqhj*0vsa!xpKxy*i%I#O}&@kn~zA83loaQ@{47*nAen4yVx|elRm}=CAxzq1)liC z|NY&7dwduwo`crjD0X-!bXMUY^~$KuUZ2UR37b6%)=tu=dpZncV`^Xx26gt?yr}^m z&dwueE|su}vQ+njMTsSWY9}b}`zuFO==UvBcEFS~>rJrQo2rY|0zhqJra}J0B!q;Y zjPUUM9E&XmlHM-_UO8wsZvZW?gxPJr7vjm>*7?@M8D!Ulk7G@Q-VKK%{dW)G*JGg- zKuL>VddP&aP-dqqz`&oGYjD1YR`5A*v3^SrsLmBSWiHf!ohInDM@ht_CBJuRxgZRi zDRePEIvdI^Ht=8FS?`T!=>A4u?;ShUd+a16l-kBRU2UCsY$q0UBP`2(D3B@ocu;?H zO#z6%neX^sUsMqbLmSM(cq6={qbhh&Q0F=7v1aN1Ya{vhS05IO=U4}qEELi5R{;Bc z!@pP-#fk=LbOH)wbnH$}(}Ud*IK9dFK2(*`aP5oK+pjvtZT?Tqd!qC4Qu)S0p~4^d z@d6gw0??V%KY!|`|K9ZJNi+13!$819nko&#@JH6v>0=q0o-`~tn0U3?PMx_6yZ`-% zm3`R%$e=fn@-^QQZ1ON+lntVcu#dp=uN1o;&;ff;@3N6|K&XXeer&~lz%+-Q_P1x z?i#2a$w|o2I`V5Brx4Ilec|SC3)sJFJhq7&-$cm8C{9$2*i#J-0StpJQ9=GyylXLyoN;OEBv=GqT@v1z>fL`BhsGNF@u;;Sxc>I@UrKWytLr+x zNVfUIUaSvM5qiS~QA_nC-jeg>1EDv3>u2ZNvtPfwpVySsilW7qQd0K*uqj*J1AQx!2}gWRGf+I0#ujZmX-Sy8~_4%b!>K zg-X+(f7CmPRqvXj|HlRWq!I!+3%`SNYej0Dj*hNt%q=`TT;1E-dkdvQTZ)zp)zHvz z#p{=cpjTB@?MvonfL&h3H8=Zlogo#3{$bkU-|sv$KuBZnm_UX`3CO*p{BaP5_hNpg z_9zG++?LjE)M-M5nh6lUE#(6gkK}xgES84{v51G*WL#>~uB#gdLATvADu&E@er;#F zLf^KR*(oO~Oc;VN2@i4&>K*&osajfEi-7P-jn(NEsnOx_@fgyEzyBLm(f6G>ette= z7H{1UC{h19`~G+~?MSK_!r6e#tS=%T85ubQ__h{0#K4i4L3>b$Y9hPIgztMHFGnWh z7XAb_qZEE0q<{O2Gp5*5L}vp@SI>8C?&xyp@$(vpOFCte{jtU7-IO^^ml^mBG z7dEvF&Kw`A?FX@%NPusclYodgM|g<8YX~@KRXXLOvjFYdw^M*`?bU^grJ)+&`Po{9fGNz*7*cvyNU{`E;F_Ei570 z;~g&Y-|lNIyaP+|unYkmLL(Na1P*+HNc{SZCerR$a zKD83Pp!$1pX(Lf6yJ9Cf8G==E;`8#Y9^Ajba{FR2dk!-y+9sw{KmO#1z*Y2yMilV+ zej>>krc~24;dkF(czXl8ac$w>MX={NPs^$YcQ3MAja`qHxz2}Zqd|4H)KKbZ^!gWHe@5R zQgb<>;K*)m@eE{1ML;xD>*>Ju2WDM1-?N=$%0B;z(qz{SH+oyvHF3EEp#+G&GwdIM z2amkzOg_Mhb~YS6b6m`Z#(aGB{N3bjGU0Qfbzmeso!i4ACmZc1!)m76rjkH6-K#`kL(3F6kTcdlNEND#tREv%gsK=c&i*9 zGq@~&9*lqe?*PU|gvfehD6@7kVeZIf#dgZ16A{#PPEy(2gfRM^9%hFwTc#X z=_=U_ymZcs?TF7Hfvr1OucYcD4MJ7^_{^lc;s|rtO13kUWMohAXhc7OhCzG@^DALR z<#Xyu%zrl-+H52V2?-vcH8UOEII!=6IB5fGo4q4K^iEYaWKH|?nCY!>ueWSkA2rHJ z@*+UG<%08WMyh^P?(b7SM2mhgsjr+Q(N40xw>MH)SQ!7B*DOr=KiCDWslK@7%cC@C zPiF=c_iYv%_b}asL-Gjy`4KXf|NaGaj=1=pgMI$nayNCzl`YM`xhGR*B#hwMzI1W1 zKc4tMfAplU1SvEoHughs+JHy-USeOsdB$!5b>P$?>$wTDu&NML3Z-LryX}#O6U-|; zXdUL2DTb`}=O>xk{rdbFDv6*!U;WFdJ!#uDZ5)7r_gRhOd=sayu=k>5KSjoo?9OWgHqVIgX(`q$*+3AM2PC-r zR_T@DtIRhc;{GUSJJSzJfJ8{#_4PG2?y3Mpz>oBiCB{MPieHpKhh`64DY|44>T@$M z7I@8nXbl8`aPH;m*C77!a6_bl9SEzFj$-_W^Lv&+ua+xV2d#8OkUngo0tsrZk~wka zlAeDvh!Nua789!qL)ho&<=H-z-40Nl&u5(hgRI;XfRvE96cCSB_ls5tcqj7Gv^tFh zEhjjMon-Iq**w0G;D2izIOy$FtiLYM!A#z5N{uK0Xo2e*cn@~a8AO)17^K&Xb zN9{gcUh2kL*-Clmy4q){I?p?+J9L!6;aEC1EU{02bHlZ45EP8*=@y%Yh2C)&V-m}3 zI<6hi!L9Dy566nHudkOF2RoU(batk1@M^foHe2blL0$m&Gwk3=*7R_4-2tZUJpl?^ zyTrI1_)ovod&rAo%E>wUeZ#|d2x>hvvE*VXvu!kk;+i$w5YmFqVcd(+7gz7a2#R&e zY@@Jd|FqTE9bmx>LINrn|1^SjAc?pEK;Oi4u4@A_I261!dJILLveMEc(VJry$K7v8 zV!RNpK|V)>ctWO?6>RbuwO#i$!bP?edXX}KJ>v#DO;u)~o$Ncc`|QqWqqO5lSKdn% z2aT{+P43H|Z|I~TcgbAJ%!RtF&YWiJ5`0g07_X}RWyEt(4}j-ay7ut`QpcFMxcQU| z0)-YuaX(sM5gz~!>0xtVz{GibhsjqAe~L^!)Gt^hjQ7LVn9L0w_{w8EFe=+YhWALi z=zAWHIDc-+dUV~YE8_(jRWrG4or_95`3UQN4mi zHV>c%ZC~FqNsAH2-m3`M{>Xab)d|^jV5WYo6iHoWL=c4LjF2WqfR7NPjCJ)#{1c~$ zfOxPH*W>ehNk>osre8MgkwXzcy#0KO+Rl2)oVVK?bSoNgHOP1LxkZ{-H3FCFvD7Q< zDzpKOl(1GqJUjvWlFm11(55_2naj4_#fXPJ(G0J){zmrr*a8)}XQCuy2z{bX= zRjS7sHeYhnYFFu4!rYl?oK0jxoH)O&@paY$VGg3fd-RPIUfVmde7+etg=Ns1X0b~G zUH(9cU_GGzKu)c_Py6X*rN-xlnuo$rF29$7qx@%vLhA@@>FeN~ z+TW`okAw)~vm*B*4SIvMb}WVOSO?AtW@ctb(qh*fkzns6o-lNiEwNVm99yMunhRR? z#)Yp9o8a#+$1expd!+b1(FBK3Dl0+_l#An+KSX-I1IYc+UnypK3G=Udton?I*It@^ z0hq+rDz_KtW7(Tu0CDKy5_DzX5TxEO;IH0By0Qg4VDd}lhLo}T+kZWCu%t~xUV4nr zLEPZF8Z~DjEb}cP*811+y}ZTS7`Qv+cDeuEoGDT4L7wWiblJkuC+O`R&JDYY^V|aI z*Mx3TF;BbQf+(_H6SaNyuLuw^dh0a}_XSYx7l2L%gq+Ks39PwUH1OhU~F3HEMNbU1XkC2J#m%MeU_lcGU&plUb)XMTW4W znW|d5$$Y~`w^8ZC#;+2g2KVh2y!R~1J`-Wtvh4%M%|bnRJewin_KF3^Wk|v~Ln>{y zMr(K}vXZ+S69pBu*RDUF!Pnc_Bl~J7qFAQco2qRGv+T0?<;C^=ts6(&Fa&<|F77yw7UW{$z{_(eZ&tmjpB3E7a)_n?O?U4BZx;$bk>sZ?M8e z-+t;$q#4`e&UWYBi0pNnT9R#>WaLCJZk5Gx^-z}Eo+u-F;BgJ~RwwHPvnW7F0*;&f z{-xuaqg6#$ltd&LmKq(WwdYWpfWu+kvv~%v%n1BJyddxfVAVegd-BpCDkiu~p!|2d z?FItls|1H7OcfjZtT|9n2io3{C$-v5u4FCJMB#F6~#7 z3o_qCT7T+tYGYaE3~#S~!bHC1E_CW=_OCF|s$Zpk2CWAJO=D+Nvzw8mbk-LKX0Cmh z)JsC5tJkn&9{(whCG>Yn3BQ=;1U{lffqNhv9t%x^iZ zKo)DB*klfrR*Z%q22vK6`~ou8-pPV04$F<7VTRxcdM`yr!usqb=(;d}epyO!a}35$ z-FK!q1wFP11)`j0u!vb6&M-f?${Vt|?(5i!XHe~9*Mxzbi%BW3n-kQIpOlkt3t9&) zH2Q&xZo}j4SE9bsfPD31zc6-9(t*+K~H_-|?_mkm9iIc!_4@y+<`?s&95GIwNj#f%KO`NzVPk zZ__3j85z&0+^~eDMP{o75{2sbUz|r)G%F+&b1ocTuX1O`?~l*>d9ChaL7De7{UPnT z@TfO=MSkV)bSnT8ZsLCKSb=IU3n$z!2|6o`EnwZf8KKQv7YLHA3lV;a2wdu%gVz{` z&6=?bzT0IegKvj2@qT5G`=DUMWVf%ZIoSpAyQLD8wjNH;Gi-G29S+HnSr%12%TpYM zxY_4GR4graOZsl!^&h%WQMX1y#L~&Uo&~O%vK=&h%g+$JZtm;u?Cf03VMi6?)~k<5 zxT{$4Jw;+ve{o)#m><2p`A4tBrV*v(`Rx>yX@lgyd+Kt@my%{IA^ZURM+9N?psfOXP74QWBy%~$ijBR z(GiqIDk4zI1dsaR&8r3lpd$APB-K5q&NGl8v4ETDf@cBLI`eYEFTUND!LIfpjMBo_ zJa!XGP0oi%Kzvla#CjNOt6DsOcj~w{YyXd+n^6iJ$k$XO_NOFJ7e!M&->Zwk>^0!pn|ln zsX}>*uNY0mR{$JH1E%sx?`fw^bJK3a!QoM z70NEX6Yu)*H~ck-PS&Ci?}sf@uf*s^s86$@UbGH80=0NFI9?#BNb&0qSqhWJQ`)q% zH$PiSUbEQqajy8h*~<8l{V{Rp33^+B<7?_Yqad>JHw|_jPPi8JN&Zn8FXhmC1^WFq zgP*UY^t^A13cjoeiue}Mr~tDV35Ay2wkkfjZ7P1kxU_mdUO2VR5fAIkyJC6y8KC~1 z0X+u{z5P%6+}8N$RWQV+Da>0h^MQ>G2$@K0%f{DUF%7fBgLEb^WKIyY{Wi|QY5sHg z4g3H>yHxM#Zr!ZzseYCy#m<@Jh|3?jHsOQCwCCk0B)@Y?@nZa`2AkY(UHamn%%BA^ z4iK>CbHXB=ZlD}l4WKOjK|*xBhG0tezO4VN>)A$zNb}~#=!26^JZS1*dop{d5#@(v z^M$hGa%?>?kS^}Hyt8X{qipka2oj0h;lc=PG51#ou9#AIRUkybv`NChx35DNcLMgsr^+2P|++Bg{+j@f(0_L{|vXsTR`@e*r_ zr760Nj5~jf=dSz8m&uC^4EObeAv*5OdWTu2*~Rv2KA>s@uz_4YO|{Rdm2d7P#|$&H z35(KkImCZH@SipbIL#AAMVEy-U4#tmwEDxi$_$!$dx`{(jZnoJW0YkkO8n@(E)6W) z-At?p(->nm=bKfd%^y548HuGcQA7`D8US`n>*ZIU-3Ce zf+8$k^^s+_-c4jhUgO%-&2o(BkMfW(NVkk^lP_Kj^^?B2>>1BCT%v17P{4!5~}1T-b1ecK<%31bFGzaf#!bZWY2Emvy`?G~63aBBsa z_|G_jnK)$Rx9GYoMij%`B}fw=w+`DHutUmcUfZP>iyCW21gD60dTT{iT61#e?Ml21 z8{I}r{NNS>h&2t`Tp{a@&5yz+dnP$PO>e)~MPqIIgbHai9)UZjG@lZm+Q(|5bueEw zjxM-mYq6YfLkLt*$%jr^(G;_Tk-ef-&BwOSd@Gj21m!J)K`x4gUIuEb3^y6Csma<6 zg-W`SUHKeQ`sO<$VmL4Yk9*uVzxVFA4xy~mO{_=qYDyv)1`rnxqq&Jr;r>~pSh?q{ zQcmzw_+JjZT`#!WQQLXc+oXDJP}$1TEw1y2#k-2%nyll(KmVew z0z=P+LkVtrDC&L9u79D%EXGJ;Txnek-r<*4R&Lz(gHJb1b9J zAEFz>0uE=Fphe*P@7iY`>cYju{2mGgp6}7E)!>T2MP`L``h(|>;SGem%UrfA^3Oi6 zc#)Z=iv@+u<=rFe5su7(7GXd|f=E8$O$bd;@thZo97fags z;BgRx3@2ZNgGL&bgXE$z#!KPota)o14V?GWyR@IH8ijqRpF*zL*9vJ{*bVY|t|dF} z`(3~KhQOCGb_IPCvl4hy;5>A~g%EggWbR-Pbk_ne;4%~xtSTHjLwE0Z`}mA4Rz$qM zb$s_;bFoyfD%2Z=LNUC6_U9KoJneGBX$x)K(0bePl(i^Ghf0Q^&1YQR-&Lo-3W9eC zDz7(ezs&TE{%yB82D%D za7b`V*?_VF8^vuWqF8xBDEuke^_rVWtFMe_$htLeMsE6kLEz8{5%b6XXhYGg0#Y3l zRESS{SQ;E%8cJZiF3_f&Fx>qbneuw=%RY0P3j8W^y>ybKTvNxwlR@Vv?EBX!_VvaC zKiBqPc5u;_R@Vfku1XV4ETxnXcXOcUDkNTP&&fj{`#tGtg?ipe4>u~Kb;^{ z`KS<>UYlHIWQ4d@<9)8d_~HYMdzXuRnGx$W>vxeG(gf@RA3qs&%5+bz-MPp*wAVFwKPiOi4T|UfrakC zjQc6>eGN*9M4wVfWPD)fMl1aAVb{`o&~}QuGEa5v`pV!-h&Y54bh2@ZOh8Og|1tU^m_}^RrpaL7Bb>9?nyUmj@M{7v`S4Ecg5tcJYTy=>u+@d$GdnM0} z-W9;gp6@U}t4XS3?Rtzbgea%YujZ#?!E);~%RAF(9x?Cj2T!Qw$YzWin+E`#D>Id$L5?v-*j%ZIY-cgalD; z0|+}^e=)>J+Os^uQO`XfHO-;_xX?`?=x0k{V%;^6U;m0BZ6_3Onr+%4`B{6&ckM13 z%RI#p>Dre-;hmNylC3AeoL9EDnYRr|$lCLxd}%h$H^UYH#_2)A-TaDpz5Z)s_0HVm z4fM^qg95q%n0=Dqb#%vo~?C)#2!w z|7RKW8s$Bns?q7qQz$J}ekO>y3*8(u73n$Gz1Ia7YRsj{iVbE?pd$1sHId3^{uRr} z-=s3|2=GjbxB~r8zOmTOUufe5WpsBQ!3S18J{975gwj549dcZ*hBNMu<)B$8{RA6Lu1? z!^|VotY=NvONgkOX0+5hR5h>oJN1ZgTL3TEI4_(zh_i5QX3btN;ciJqt_dz?)Q~(R zP{fz|DK4(-$A-qZVZO|Xwno9j=^Ky}mx(|^1BvlYkB{TsicA6%PAv?l*R>I*z5O)G zj`0_nbtlWUik%Ugmj3(t6Di z=5ly)@-WcZbZ;(mb!0&}Lde<-M06@v;w5x7Z)2*h($`<>K7u5f&l^6?6m3o8OGU1o zEN>I-F$`Fs{^cYN)L@1eB0HcxR#Iq}pgIL0P9rX1>{Qs6{7gy-m7iBncM z;7PHi5$6$p`)+f(q&|swjRE$582jqDrq}*`Qcxrm0SN&WMMYY=MN~vYrKFXv(cOrM zgn%MBO6f)#1`I^HbM%lJHEJ}B{cg_D=Xjp;Jm25rAHMdQbNk%&zTa_O*L!_daDytX z@*{`3)xNu}!cqCq^GeW2o{&~NF06(QWV-a1tgpDk1-DrKO6Sx`5;LKT#})*Bm2I+A z>&AP6<_Qeqe~e}Jl5EX{MU+knncNnFEGZ?x90DVIC+_x$JlZ7}F(K8swG=F);J9^o zMem-;$5S;7aS|q7@dp#UQ7O6%UiHi=cg2Mk;4z&aN9<^o=WqAoPr(XmkM2mS4&^d8 zK|eYqJRp4mv#RMRK~dW}ZN-liXF26*+C8yPOwpo=G%Fb5tXT?E-geouviA>AV!1lM zzO%U#r8+A1zxo5z8F**Yj>o7QBuJHY1W>MfHbBhX|f^R;EwY znZ8BBzVy&wC04}1M$_09mYm|W;3T9lzjkZ(v5j(LZ~bNietPJ+VlxY9lB9q{^%3=l zG^>0Y!NFAd2)R=>QU}Wg@C8&7swJD>_;Cj5IlMLY`Io4V05KK2I9Xv!eJ+=oqx{;u zl(@JXK=-~YZgk0aNpwH_5G?Z*sDL@H*33At6I4z34ct$z}w5S2Vr4 zf<1ZmE8Penc|qB}fU*%nz*8qzXJ$A8OyS(jR6j^4_1z!Vj~-`U?olTuditSWE)UW) zYpbZgU(M%AC75oCzbzfSF+inyCXOYG?V9iS>G$FGzI1J|p~6%iE9P6{lTC;gjDLW5 z2+yQtVV8Xvf}0wf93w%_k*K*^TBUJR*kAbLYNq0{8efAufF77f*IVq{&E0(2cxHOh zWp6trOiFOLo8w4`ac$-~Cc$|&rv{fINj6~OSEEOHK>1gw@e)Tcbq2{VbuOp3UE^37dG%GF=>Yn8O#16WdA}k#+5wIe`#i zy@(%^)OCU;-2q+{@-re6gRkb_YO5daN1_5&5pXGNv4s$g%OD&{hr4gy;x1q*(X9+w z)mnJ!b|%%L?(3;yz$n84%ZR56$4^+*;Djbj0R(<=Z$;9ALk4 zHXEC*?o~^=&T)BBLfgeD$;lPBb_*+y*>-op0Q%u1l&wjrXS{MO%$JZME-jnGZ|`zH zFS(HwV(XZ@!BPH|?louQRg|IBCp zxuaDnDTFn8U4CVh+=??=C`6faHd+x1zbU^K<}UBqMKYJR173|IJ&cq=l6_9yhsH;_h6DlnpuCmu0{nj2>x! z@@Ez#4Y|Pn%OFzuNVm~|+VPE!aU)Vu{&J*eg+QF81jW zuc@kb^~~>otvp(9*xg!*T?}!JB<|h@x%PH$H5&V(p$E%3h~Q33%$yh?&^p-e=%tO!k^)4prY~#Bp+)pbwYRDUhLS-wJYy$ z(#+c0qmCcLJD?BZ9XtK?z(pxDPcT#ToZuK-;L%J~u~5_gbO9`87pb`(c?dJ!Hb1!A zVc(es;Djo&XStJN(#!|Viz+8zPQ7bz?xDDO_dbxk7AY?;dsg04<1X|8QZvj-<)O}0 ztbNwM%b&kq^=&1*#Y#1H6{L@E7s#``taZg)e}9oTzRD4uE+)GY3_IR`P;D*A?_%S# zhR|z|G9!t0i@cl;DJ%@18PuL(sz#Pu7v#1gzWehJz_IgMl^ufO;yGTk1QhS=UusLN z^SZ1fzRRrqdFO_)9No~$k00+`dqwd&XO{=ZwOP0&zs)R&$e11PI`%t7aguWH0pVoC z(Ewp1cJ2$o@KF5IOTjDF7F*A|c>zEmn$CS?@CNHrn+W4*w^)K^X^y%w#t{nhSuO7F zU*QzGxj86vWdo|+Uws_pA0Wq4JRRq>7ijUyVfWday|v7k*@n#3N~qFeL~F)76kYlD zw_UZQ4Xb7BduyCNw5)M(P&H(p?=isL;lZSR2|!XqZy;C0K9AY^Sn3>(9QFLcQRfA! z!jC}rB^6zcBHpG?mZVfU#jjIZv6PN<*F0Cf31`cq3M!$Z(f{F19 z$qr$ZlI*I#mv|NSpgZx7=jfej$&$TUYLVMjY z$aA<0x3pur5+pca8$)B(?Vr>38K{fb#izhEa1LX%8;P2Kd4nX>)5GKJK|B83W!bma z=d+Boj$ZnS|IeF5xK2H<%B*73mUf%E^wC%_4{trUtD98HO`RKdfetLZCs<=W0ne)JK5YCU zTIfB4gs42MJ9dJpV*W?FSedl~6IB@Jn3m(a00{&M`~x=6aNYcoPrxp+#Ed%O9FDW< zTDtH$ZNG13AG(HVYp@`CAbXIdQNKdqa$$#m%(!HAw&u`O!^u;jit5PdXe_x7-{7 zNqeyHFCg?yT_4oFPz75D4=nNLww7nIGK?$*^Bwc(Y%Xp9xO)w7%HM*EGN+t_qd3jR z_fDJhi!9ZK43uvV*2&mWm{I6&e!aEVDTBP`eI&0KcaJhBPk@ba4-M;Nwl$w8hwiHDuS|0XMhBg}B~UGt z1ocD4f9-5|D`;^nTKve{1_bbF^wu-(=^!iWkjQIKyCJYhCM8{Hg+0Zo5WBk}kUiy` z()8YJ;6_7oTAF)DGm6GO%wA2Lak0}y4+?sGtd6^W$K*Dbu2-iJl92ah=hQAHz|U(m zNd-HJEOh%LwU%Dt3qpBbUBTX%H^cAKi^%yC&zo%%I*S%cFqcf z!nELg|HbvN$}a@SlPR_*f_Iv|f}MYuBq;$>d!U9j3EAV(LZ6S#a*bTcHV^Wyv0W3% z8}<%R!@5U5LAsp3x|c^X^=8AnQ5y*l{?X-}l`oFwDa zBWVaZS{uOk%q(n43|*rO7oXjoYmff!F%|ZXzj9)H{QTox;8=>N2zZOM#hx^r3@+6Z z-xcVFB;Jf*1fSIF5{R7&{r=VW-8)kHr(S^Sa>R$|=Xag77H1Rbj`jq~yNjtTqm$1O zu8C{K(=zz%8`1k~$8oSNOs;g?p449lmZ} z3#`{@YFUmZr;!`8TugiOmNu%wjMeX4lBYWs`|YSn;Hp28MF^0O2n%e_P2oZn6U8;u zApPm@kJeI-D*z_6_X9`RHnh+(gTTmxzi+(z%!t`qFFKWK3jVBxaL&(J zQxtzYra8pGg@~gd`I)G-RKmlz8H2GeoFihTg4Nagkz|2Lr)YW_8U0iv#SBm18ec%4 z`YHVs)1I1)wZI)WYTl1;G(+<)tpxad#iPV@_e-qH-Ul7yE9+OsKA#%^VA3j^<*a(A z+~H`v?n8;vViu$BPffL=p_A9M>VQp|B@7ZzdkPpM5nI}(On*i5cmx|Ku4=7*=FecH z@D+fuK=$U7EvOzg62xyqtOkg>Lah3$BAJ{L1I&?yuMA!n%_{Tqb6p~^ehe}ym39t6 zo4{cKk=xmWdYSe5VD78bOVrv(% zJ^$MTk$!(rxB13#!|b%N$ahty@rYKwdh=M*j*z!5!NyQh4x#u8{(l%NQj#!62dE-p{X_TSPS2WGz;;b zuIhr%9KpKeu&eC#W<6|w`R;f`=h>#>lT&PYet!=nNQFsP0Csb)S$lD`lyNXmy?fls zG60Xr@&zmK%x1aY_ED0OCId?9$KYTxz{hP(ZuY}sp3c3tx?|F=cs9_A)xeztP+!V- z?Vf`34Joi+=w+l4wwdxdx`cYNz9x=aP5HamNgRL5YkST{Yvtkr(a%Ux`iQtMt(ywx zXF~*@&Xn)er>B?wyz~}mGq}6udr@$tUPk4vFCNj#^E$1^ zufhc(nn2_D3aG3k#wR4mAFnRwUr);5@O&X4HrFzJmon*IUmnSis+t!b{RHCUuFmK7 znES-JH)`(s`sn)b!-XKDY(j(7l)0*zPi5eY?Z1r1$zvDZ#P7hjQZ6S<06%xKY;2G5 z?0wifC?5deo;>$DfT_CetzS0kijR$tkNyG!gC4ScUK2r8>Y__A)MzQweXKR zOMVK~Ax}}L@4m73O4wf__)BIq_x506d<#M7^sAJ!`JuCOt9SQnw6i`boyvaBL%n}x zA)%%3W`>9WN=WY<2|On#0P%O|bo&W(dUHYs`7=qfaRKc3#Fv@BDt*#l$e1MDR44+v z$lcxCo&ykhYj-zyZ@1s6%Xq%2G!-^K2q2Tyv3I|da%sB^V?dzFj+XBg{e63!mjS4b zd(!u)e@=nO3+o18;Gd{K?3cPUm_tn&c|uniE~^9E#uSiM z9FF#EM|#IA?fXGtAxs1gIV}6^{M#&xg0ty(@fV$R7=}kMwc|z7>;30Bl5RUcTxrjK zf&_&tUcF*832 zW06V+o8p{_yB^#tfeQe2t92p)f>RmDvbIc2=s>=4{66z5_v=Qi+~V$Cl5oRT%Crly z++)bawB?a-pDok5fWILYcI74%8d1Na_4#dcBIzB=v1C5ApZnmqiOrJsAv7gtxD&3C z8n5F9IA$VuL``Cs_!X7$iMh@Z2y)iRCIHfpb{8f=vgVcDJ4I)vgun7@R6af*PUel# z^(D>kruEMs@MWW#^3epSwmC`@f4xdOf0z9A@Ng=(^(lNnOQSbTzAi&|Vt`nQTvGi{ zh-32|v9106%3Wym@^Y}Hb+y=U&-*+CtohA(wduRRz4`Oy&gD9dA8C!+Q%8Qk&=-Fm z#gnCZ_!z(WyX9HPF9hD7mBQbq;NMgwAb&D~!w8*qcK&&J9bx+X08 z3&Q=^*Z)ddfnWOLrLW2@pUXYyttOIOZTVMW4f

    5$@O9Vy_0o!*2q6$-849J5DrY zJuGd|92yas6DYED{YgAkIpH(1f6m}vX|kVB?P36qG@SR~O~PKZ-h4myaFJt#B!Lqg$4%iHnP{h^Xkt;^H3#-x4R>??g$s@AiS%{H9Ko!>HhYV7dHrM$6d2 zARudrY?@)mBc;Kkasi&*VrD~2{%OU70YXG(zPhfwM7ng^;SH) z8h11k24vmORHDI19ribkPFP-QBxGO741rbOBl#P}@V`7uA*HX%B|J*+bMmr`MuD~& zy7%sXC{{kY9}pJeCSMv<(Z=HG=Mh?BmP?tvJQmb#mlMTViYLtCyx6x4kpH;jl!v|C zT#Z3=DIxTHEwB1^(PK)LnAvn^^Px|N15)ufJ&%uwtDLY5#JZGhLPA2D8{3!R1jIK0 zbu&AzJ}1i_*w%nh7O5v-3tr>q=DzhJla+=WM5Xl*n?kEOK+5=XOz(O;b_FJ3Jz4!7 zAEz%DyksuNeTsyne=r9z`)Iynm2axs-WiAOmU7r#)ydY$p(Q?b>iMS%^@EkQ{x6;n znit$ZNqI}QMR795nsYRrZhQ-@S$}Nt7jIOTvdcYT;1-7kUEsP~X%FpYkODOF1aZe8 ztBEt$)e)d#IV0=Z7#3C`I8)i8m_YqE0>ytjvHb*DqIj!pugBG|#v9I;PurdeOCDd$ zQy8h;AOG-0TQ}mqoZN>3g-_<98hY>fqt_vdT^?R@8<9A{s$FX5seCBsKsE#>s1%)w`5K&>WagId3=`4Hx?`WO^MF0*GKD5c)K zdD8=u?X$9Y+2q*eun6{NK!I%wT6p#!=HZ{m?Yr!hV~HR$N!q9Eu26~+K5=T1Wxf*r z@meLF%|k&3cctTAo@7h&78|P*ctTXh-t0`+%@nQsA}Yex z!fsnJGV4$jCD4B9zM-@_{#`b<8$erj&|~ajz=b@Ur&Av4vTCdBA0W{Uh|%N=NF|DM zUNcSP2Qr3{;P#SJlk(W(*$7{ZFYUZ`=Z*?dfu4yPB1b*!U}urDxTZ1>U(e%a01pbY zdI4Lo-6eK{kgg6>==~y>Y24|&Fglp?iNl2Jgu*@RWF;HrnSL$n4>-H^RAl%P?Q{ym+M<^=km8 zVqn3KvSjKAFh>=EPKFW)8a~?^G(QCax65F%4a}U`1`Hh#yG|W)<{b&ol`58It1ixj zN%dtH*Y~BhmrNbcb82OQ;*%YPlWL&fig~6z2?@!*4W5*?&p$nYf1V1q$0rkV_3G6? zrWC(PafeFDi&o@$XOr9C=8B9~8K@QLDjpeRf8x>!0uU*E^XTy=doxB7IKX2s0y{d& z3og>3*GTh}l$5Kb)(AB+AA6oy)ah=}fhYS*4T!&$zFXYi1q^D@@HH}t2t<)%bM z3FEI0tI>Yw<(NU9HvQJd&&bq7-vtV4$&?I&cf^E*Se~Xm>gX`(x`LpyZ^&Szq+`DE zR#1orZ;GiM^iI|*X8r|7|AH=7@i zO)Q|d==qKB3?Bi2t)FA*$JPlQ0B+e_M>hHM=MMJFHXU~4VR)NjC&f`N&p!eFLu1ZJ zVIhwOQuXXJDf=deIFJ@YkHFL|`~t#JEM4DOL}x7?K?U>5DE|j%$4B~z=(#6eJbzsy zuKh~GS0`Z-m)IhsOx=m94H%}tJjbo1QMwGGWnfA#WO1%0WM8`bMQ^NM=!0;qdP8CB)=XRIUr{IL4U`|la# zt?pA2EO4YEwmCr)@H@8CL?UlQyLFfg?b6g7K|-BRHa-CI;Agb@GkW>YmLr$?;WqyI z!w>jeC_GdN%E}^eLWA*KiZ5bCJ@($!muXi%Hql9v zaE}6^i^Wr+N8*l!j$?ulE#?oU`DaKPK$OF!-d|Pm6x?A0`E0J_bh4Svr7rI7j4F=y z_E!@zVv=c~XXKri(%vFMhwJCAF4p-HZrV`1zKX}pB0um8p!3V!{^u3w^I3Yuz>slB z$=0IR-Uog`V@iL)?pXfiDdAR;I#=fPmOia1iZ3rKqNCyDygJ``kH#cnu1dqNb?^vm%EsS5zB_?Uq z=kLIh3|`OC1LRp6l!1tB0^xA>(ca93=MC{WkfXMSA{OEGg0euA04Vzo4!QaUM0p?P zm6t#$nZ$4A|ldSx8I})edpH(6@q+{P0ulyIar#Bh<=hJ zc{Qit#W_}Hk9U$q9+h?~S$)e>@T?uTodubi!>tdneC^7+oSJ1HvF#kA9$W-S0M1JX zj>9#{0CS7x&;&cJVA`aoAHMkq1|-6P0>nlGezpoo0dr3OhZyo7>sxpi58vh-p7Xo& zf$L28G$UiDJMqd<9oE=GcHp?)0kjAPA>d=VZmhvA+7J8zzcPHIXX*eeo+?6;gX)52 zAa6$(8@Ar{JLPq4LC>TE27~ph>v_qDi&xy5@549{#!CCpuMgqAPlU}n0dC9)ZzW1%P;g{Cac?$uIs9aNvV84|8a%oTp zSln%d)1M85ym^#geSE^bZ^2LnFfSM zo^DJx4qo?D?_yvPccIz{pUoB)t*)hI=WqC$Q^l!Ok__}PvQ*K70y+-vUrPrIto0bg zjPDo$?wObxyiPF5>maKv>*!{~ z%4XNe=5F&*DC#C8=Kx{S(Aqlk>{OnJyO{e6qHV6oC(CTz?p+ zuu(mEWP?X}*h$H>zCLA3J`NT>Hz-H%|& z7P1Q%;zi`OT$EwCpE$MDiqSR+%f7x2>SwR6T`oe_R9EYZU!+1{zA&FSUCIQ^BjSpX zCc)ni>c5*)zyf)=Et?Dn99zttDgCn!8{Sv)#%|a{XU5KnD^@%!M9igK6rGsWVlx6+ zL=Urg+pdN$?5XQKD5kwoYkANdXn%jdako%-5cOlI)5y3v3;$W5-^M)O;QO(uWOxB- z35F7=i2Q$TNO%QE9ALudde7Nh=7=&Ns=H)*2w|^cD{|Xz#5G=O<9K^ti0h^ih0V z{&eaAV7lfun$Gt&-hHWMV}za_{2eWHJEKxtCpbSM8C zA|%4ygj`tyVulp8P9yZ1NjuY{%6`j?Fy&nq%Q ziVYTM{+HF!CuUlmq$vB;6|c|DME6rY=3(H;4pW{s`VseESK(yu*`9wFyULW&@bvWm z;1ixW!!NZ?62n7SY3u*?Ote@cXB~xZA#O zPTQ=z_kJTL^UJ(Xg&InJ(MLP#Ye#6_|S;mjCC>|EC{h{Yo4!QRI5v32I9Dk4^BO4I_}`=xX)4A5Zny=UE#` zfq+h&8ZlAJ@{fN?zx%w+{6t=6|2)!W%w#6>`ig zzwzXGt`(Xa;pLru@frP5W=-99jXy)l;;`b0GS2vobj5xDpY;govnNGkaEZl@>sGsL z2r=V%@2t>6h6{bWlEfaMzK8jx5bo2gr<7aNDyrtF1^0Sm--1?@JtqXhb?<=1j#&Qb z&lOixfaYYj2If**_+`J^>@rLA{_)WaxP4XFrq-W-QgNuMQ2E#RUhWc*m~=-Wo_==UHH6dtDY_!gO;Q8hJ8TcJ zR=)IuRfLY_#sk*zPv^@{_EVvh@7nc{h=gOisi}MDBfvpFQ7;S}HTGZ(K2JXk;Bd1` zOAJWR1uBU!VXiIe1LQGOFu@#=6_LDi-VTh2qBptT@5cIpV?<~5;i~&qL#q5Ikg2

    N#9#3#&k8I|+mv-nAcp(I0Z14s~TGYT#VwHjF*w32Ar zOIj3kkIv|8-xmCR@3EdE`ncpxa{Vsiv7ql+n~2-LO@yT~>qC#5*mQ!agWNShAQWWW zQ?t9Z472%gh0ipf;DOsJpH&209!;QTm&e+9?G99s7tVK8|gL&%y={c9z`(TJfEX7LC=zSpCr)8|`A|eBb z8cPji`jhW}lSujV%oNtmDMTBtA1YepYL*7=SyNp2(xp@Nv^%lp1_017G?TF0`NE|m z+JEeMXbNZwStbR#v(wXG&^YC@4*;Ns3qyB1_58I*Epus16|DfkHo|3#XHR5L`tWXxe z>q49$uIwE;(@Jnb9CFX>;B zB@{mPK#xO1lyc{f+d;aGsshk^H?%u|+S>q^Y4_^H?4CL47TDq+ZD0OPfI?LCT`uyj zO8R5^6TZmM+l_CF{TYkvKX3~`|F)>+i~fa=cYzpFMh3gB^cE0`xInZ0+?{ppBk9U2 zEp}>pb(Q&QjKz3u<#tcc(^2-KG}i&>n7)h6s=+YIoiL8sEBnrqS!ob; zGLM?IAlFV1qCRSm#>rj1A9`VzTa>*a4r2>j$q9l&p_(Ooap7LTaIA)uB23W#zMoXd z7W|N&%bkr>3t0yfKEVJO@y9jD+Dc5@k)%Yuz0kp^iV2KM9(sz$iXuzv~)*U0iw_H>$set$7y>=;362Y zYu&g`=kxSaHxIEPIX}II;Sy<3COqNDU!bME57?}qjt?wEM8sygsj-SPxz>^Uow1Wm zGBy+*nB(}l_GLYM#PP)E);l|X16PcfPbmvN5HJlPz14t*& zMU!$@6@Wb_&jpz?2T7!U{B4(0kI$Z4= z05W1nfDZIo;6KUuW~*jDkBOl>9LS0=_B;NX$P;x2B(Me#KJu$``^ms?>geI0|0j)sB7O0u<7C~ni*+Rkw00Jq%6sWa*ZlU zPl*{L;0aifEdSmv zr$L!>FXy=@kgljp)7%KvA3vTcC0;nhNj&UMl#0+3M`Ui$YA{$upai6j&EE|Hwpcs& zM5UDYR+fN2;W)_tV>hZLvR)$(FyF6fiE+s$+e2?Hbkfhroq~3q?@#&(*a_z&2B{sz zqhhm}`_p)W(ZpnQO&7}!fw~Q#Srd+=+z&gE>}@#!xej{ArC}M0KuOm=N)^zMi{5AM z^PuXwdq>RIS>($09cH~i>BSFMAIxr8S;c-Ap=+J1azsY>?m0omo(XN(Xxu$R@`{9< z;WpuR_9coQ3i{2`i^SJ_T$on?u(;{sw9eohLQ6j`=A;HhLM)Qpj=ghLTv@z?jD$R?yKM)*EBhKricE33^AMJOPoNs zemU$9M+mZb_d1;~0EHH8ZPPEcB1>H#c(`t{6FHjB{=t)jA0%#THC3}SGt?+AjCL}p z(x>1cW5$~?=~u>F1~Pk3>80EAz$~J>ijJ2AEV7&n5*+}J8@A+;k)_+igXR( z?Q^sy+D+!Qy`)P2V$QW(mG>C-4OIR?l{&|Xy>&TV5gOQ?!d*RCWW+&_heD4(m=Wnx z#R3`SwmPpu(%1H}7>qVh6RsFNA#RK!>1(et+FCHHTEd3 zQ=LQsMD5$a17`&CqNxhePqfJ0k6vgAmQs!F?_FdTcvm2i5`%-XyqgMO{zQk<8L5ty zQlz;`GLVJIcMAIBhBspu)O^>zO@HZ%dY(j=iq`K^vf-P=&n?!WYqtRs28Vsm@iVv> zF2VDr7uWy(Fk7!6e+5-&4gb7PM%%R4H#{x}MAd;D3OHuxVQHL9?TwqSN zq6A2@V;hf?cT>V7Zz;uoE%Gb&tx0&!n^IHnf!#*DvJf=uW0SvMBDI$%TVpw1@k}r_ z`qZM%h#B)VnQDobHKuSZ=`%!J zCBTS?N*WLU+H4K!P^16+!ohM8TYJGUj?QQ>~_ zR*G4Fji>we5@-43=-{awJ&zy6?n{?t1KJdYN_XQnW~r50U~9DoV^wb3=GpvQ< z$KYb}GGf(7-&;K656z5{G-m4iEc>=4Rh}9`brhu~np$P?oNi%gredlbnq*Z4p&S&b zvIVuQ0EPKL5n(x2@8{h|s=;?gmnSdIO}4#>byuWAa&frVB{+{xIUw@O zALR_?MG$97?e7^_obx!VLow)Im5;EvD7hjZD{T9Pi=n)|(~n3g_VUX!!$!F1^QULr zmxm{R1R0mYrV0A2G&0OYlDt6!A*Xh)F-Up)h+MazPBPL07M3Jn5mmxZ$z~pSU##Cw z(tBb{SI=!1lLU4BZJB9$rgpRQFmwCdYY!c%jvOexmM5;`F~ineHADa0{!!<9C{wo^ zG&(~Vj3q5=wu;)TEfXHnWz#EI!!b{aZXMv89zw0lWE{QARBal847q!~^+fuFz0=yz z1Y@vDaT~VYIcIzz;Zi8B~3|?nxYf9#U2X(gl)iB??9^^k~`F5m5#r@0}4;p9kbXrqYSG z>eb9C4IqhA4)?;#W?>_VZhFr^Qt_~{>TZ{@-DxPzsSN7VU_;J!T-wr6aZw`t}qKp6q=UV zrG5km05+%qrabcWTQ5wf5Fd~))-Ywhp#|CzJD~eCBzYU+D?+B&#Qb0Ma5W1gC&q0q z<)lE?wQ#FFx`tdeThF;IG>b=+&-ftSmLYsr<1Y?(pQ`tBbh=+}(aBcH3eOnI?*-8X zo2X!k6BfI%wde$gtufyyNZ78rBZwOMLP@*CAz*|%_MD7aaw8W#cCn#bsc*L3m1hwh z*k~Q(r~ui6Hmy09LvaZdhT_7j`z&5PKTLLFmu=_njV^|svtn5C&=jgcL{DPBm4e0rN#F_HoTl83Ydjq8e z8=YVUs3cb1v#PDEIU4hLh+excpe>Yg?NQWYr_k5LWNyokqPftWFnaPK*vkV@H<~c- zUF|7d2pA*hwq)I2PDolw8`01dgq(5cHK*g-h!#Ap^Y%VJsU$ijD|Ro)jNy-q$@qLv zqQ+J|A7_r2o{_ssFS6l>?y+t9gyU>Sta5(U(ye~?cK1!t%4uZq;N`dw(gU5%7W?)P zdRab=hYTQ@!aOWqqcyEySSPXjrSSH3$7Mvo2)}Kqu?75K$->FsDJfsJ_-GrU7f5rr z!_3ERwk5;x8wrbx7HBl}Q79=YHlxG#PI%rb%ag>9`s-R@Iyp{|wF_1qPS$eYLNG&L zOR(3#bg!|P>o!~B4A7b|`DRY%KPTLrVfEL9-z^2=z$e$q&#jd#vwrIuqf6{mz52a% zu`E*j^;G8Dm;e0tx|_5;Uttp@k(3f!$qU0tAKFUHSXu=*3!+*hq)Ol}CKSDZ|rO1A5Ii<467=;3#+VJt~a-P!i%RgdXmj|zDAE)zKRuA)lE2Wo2)mZG;3 zyTznqVksqKUgEe0I)VKDmU&uv!X*B;jyGa@ZUx*mhyG^FIUu$Eb9)xO^N}K*v_9G| zG9UABHzI;ZAYT$pwJN^w`#I4WPo#mWJc3 zYqz70gq;%s3uegJMaLb|cQ&PvB&hE#Um79HQ5leUi8?B~Grhc+krddc!GFvH8Pnm8 z!%uup>jKI&-;F{7EFzg_QnHlqg~`kO@l?{pk3QX4mFbAts5BMKJ5>xgb(V%p#-@w*7QNjndZ>IEt`2G$cRQoUVl()rQL^RT6jhNIfiZJd(*nz0-rOQ(4(o!_V} zsVH6O*kVJ%$cKSpop*6HGmUH9jr4G*@=vLv;^6+3r)$Wpjn zN)l@|Kf1dzVh~;GzEWm9d=bt0pgRmMf5Bc}Tje zxz=us2p|y~@2g)u0HaK-=Kq%T-A}c7IVaH#dH5*W5yl%qdU?JanWt#~P!GAF>J zmc$~D-ST0!xT=u&f~TKf-`3p9!SblXj5}}1@s|piO4#l3(DSdN3!@|BLaZd-Mhy&* zyI&Ffkz;c#H>t^PmIp{}_#lF&z0;Ms3q`-jJ5k7&8@^Hfnuvs#etH52KT3WO7b8+lQJolrcB zMB&#G$rG*e;X{PxQ8TguZ!HIli~=>O`~EYde(C!N*fIGnA7IO2#U z%^g^ivpED_r>HnC=AGK3%<*vY~NpYTJ4jYbeU1?-2e>mCPwS? zomEb9yJDCQ{t5l;j4%nodnG~_)wQ4QL{VHa+PMV zg>C(s0+$&Ziw6&{M)VT9U2QOK4OcB_CbZF|p}w=)-+aWm6B%#cC8B#tC?e5msdiE1 zPy1DAVHot&Hj%Q1ZxbKIPMuh-HOuti+n8~lM(*{aIO*#nYb58J=c~&Mbt}v6F?$Ql z|1^252?Rjd6?%!}xfByKFW-jW)Kr5REx=+*MC2xl8)ehCe|@X7i!Mh#!g+b3t3&s( z1>RVNO%yjPK-;EVDaXaeIvE_S&6=(vDBZXHkPnz$Rq`zcAB_i$ zYIVGbFR0nc&V5mPcT#EYVsbr7BC@?-GR~a8zLcDS%6Y~wW8gY^XPo8e`k~l0-mJLX1tyNLDlLWCpjGAksz0}Zwqiy=e_k-6BDIxA@^Ga%!f3w= zyLB~;{JL;9+%GuR4HfThH9S-0S!Rv2s**DCgV1@hPfpgFd#2#!o%8pu!r`V3WNT!aoa|7HGTxF;-Cl00fV2@aq^yIl&l$8;SFE zoENwv#_}j@uakQyK}81{#l$&fFjEF!|A=3~4!iR(yT0$!BN^(2Jk;{4_;XKBQpMu> z?a0wD_$raGUg?y^Dmh}P=Sfu+F~!l{K}_x1pRQlCG)_owWRH!@Xxf(QVjwE`$ep1gzZsRBwQ*_z-85XCNM+J}c`<{o~2KT^D`cQ#PYZ#Btlr&4^Y$FHa-*e_OzxMh(2zOO;HvMbs!s z<{Yr`nAG1wY2!Lx{zQgqdy>Lx{zs|DSmk0j03_Q4!1>_N!&3dZGl5}Y(QyLik4l#Y zQ`PcD&D=(@1KRi|f8KhmSb_t0CD^Tr60?X;H=bSTKbq|4>MadcLvt11+n9bnUc#AD zg{KIg3`A%7+Hf-LImuWf1l$<;1+$=1UyBQcP99R)`24%l{58IaOMsm9FY^pu=|5u~ zI%avuQ0yAL-+b`IqrbAQTw~^%Q|xVjQ`A&2on>; zO?Za3?hL6L-x|GE<>Z|h8Qi|&)Sv5-r_J~ur;^mr3!h+Wp4m+Lu%eZz|EzVyG#X}c z8e^59@t8Dt%<~RjtyS}@O7{*14fsrWIkH?~r)7b=yrsBY^%E{fvrdZz9Sh{qTkCwC zTLmLF(&b>jpt}EgfF~9S@+^@??a{3TWOPAJ^oP@A+%1;WRNkwVsI-b!>6CxD*nh3- zzrE5>1h4~KXq9xicLEdvsm0rG^L#K{_1vT-A_8&kv=?mYL0DsZ1NHHzZsttRN_)4P zvsReXN&*;|9=x{50`6?a@%0L0KUj3=&1}rZMl-r%)JnG)?mf0%epIw0 zJzTuDFZQHXlgY|*qY##6-mqLyGfxa>aoc-E&*xxTG*!-=Y1;dR&uuHmu7O-=bjAz2 zt|Ktlaex3$HlRY#XW^muKG#>6W_>=IH5(IxJk=AQiEj4fl0Maz?Own=VUOy`DQc zqNcR_py)}^oTaYRC64J}Ywjf>0EJBpKOBfEKY|eP`u}6^J;R#H+Hhe60TB>KMi7u< zgFyt8s&oq?(i9Y=tMro43B8Dlg(g+HqJVU12@tA|2)!qKiv`@nRPRDmaoGXF--A(-_4lZL#trwvz~-bkgDw&S^^(|Zt>8Gu zCGOUr`o#S~K60#AOH#*MVkZ;;gMZQDl1u~^k!^E$WVU<47kyH#iGHd6sbE<}%5aRb zzZ@X{sb^U=(tyU;Vnb%I+=|%s=UhfUTh3TG%JzfHa79~jfk{!ytr81!a8gALPGuaD z{%*8<|MpWc9jFsgWax@{@WVyE-+m#o{N$2;l8wEXKN)%6r@*5t)_Ch%M@s9d9iASM z3~4(!tQR;Or8WkBF)wry_Q_NUwCR6mG}fiM6Tf?o276p~3qPJ*n&D4ta38pBHIvHK67uDVU|1O_(l81tv2DgJyN+7y*QZ3KlHx3@sHYOeSzxZm;hfm>fv zWDCg9P1g{nM%m{((>vQ5z^QFiHBEkp_K?H*J;Ahz?Z1uVPjBhWUy0!0hS^6L-G;eX zT+feJI57t2G~Q?t45h2`{+gbsUuG>@Qp5CGvg%c6MQu$s`+;C8aOs({x*TgA*R_8C zvC+;J#qJAOt4{%AM{jd8v$QFnZzd^nPPVzP>+Ow55`D<%wvnLqui<0hBx(b+aNt|Z z!z@h@<<*#D(LOL5-6rN+LW6@OXQ4l2^W=u5Ji zRLJVn=cJ(7D8i>Y?hM+_)O}O`lAfUTB{hlt*;c3FYaa^-lY*F^W%2Kj?zS06d*NS) zdMCep3Mt2OMNU6U5SzVccK1SM%bDA!OO?UNrxGda(ECXjM#hPPQtrZmN?_Kr5jcKb z^nQ&l#@Sh10S*@f{s&&=?ro=%e3od*AT;e~4I=sRKd%KC6^jH_PWp|S`(NVQ%6cOB zi?esqVSY_6=4dL-t4mqIslCuxwQA^OpRkU^+5=+EF;J+;y6B4f1(Ri7!pzMMpX{;} z@{w)-?z+G3J@ojig7@s5D&9hkzYmnwLHrs5!NJirmAW!J#m^=BIUyDDL+fY zMeXX2y-hnx2U~?CG9?jpNtc6$PCKpf$41izPe9ra$3qG@zBpMzO0fii8|H9|;^~%e z(OPYnsO~b|+R+r{tcIg;!;u{RL;6-%jO! zj-OA3AxsS`J3%JPI}b|rb+_o&Th)Wx_H%BdRXSz&m^Exy?>w>Z#xmA>t*n_I7>sb$ zVZ&V8xW&15hZOxOWN}f4IlH-9*aH`zr%HZrK>bEP*2DI|sK{i%R<^{r9IdG5Xe$TB zP2Co=qwg`1c^O3Z!nEaP1{?=Tm_?~~4YUa-WSw!JZJEoC3LjmjL-StDLV4wOOw1#E z*5||C7uKIgeN30On?e|s-v4}sVPu$GEmmMu0xwT_O6Zn1tj5k|LczAuFojCesS*Ym z!j8HyCas40(2k`&!bmfQZ{|qCX&`63T80fvS`hrh#wWzOcWpT9p5FS2Psz$wk zc3NSJp03**7BT>psb1F)lu- zdqe|gde63^eWjm^KUnFO=pkWF^AZYvjgVx*G8*Z`wE^5O#}3PR_qW|h_X*DFaAOG9Lk0FN+%G22{E`Uyn? zu8WaM7o1;WGAcT(+XaA$8eoyMeR>*a4dz{zt)N~ew7i>A@BgaS8%^q6@9hrVu1L$Q z`P-9koId_aFu*MMV`OgoxO@8FKBJ>Qck-ah{UevTUu5Ly8rKV-AWKD1nXd=0@S1;KmxlLMbDAMQh%3BduJ1B>9sPDWo6^!JN=p42Kb(M ztMn$7G|)`A#5V^Fr!ft|vFC>ObDjBxT_*>TD2N&)5ChlJ(_PTD$slDrfl9${3<*o) zB6skMGl_&%&h$Kxl2iT!lu#g8_p#QW+)@Zj4nhIHr`5yP=Rax^l>S?s1(c8Ib8YAX zW>U;^#5~BIxQ7VN8ddIed3+jjuDb#M%DB5`t||c8*@5*7mFQ+zq2F?%O7FLhlV%-% zZ#?q4tO1Yx7|A@B*rzzaHpeU&&^=dd<*+t4paqh;hgJd9hxQ8xE;tikY~=wI>_v_7 zVBs3{8fM>=XBiEaho-$e43rFZzJ?24A=x|hzI~d0bySP2P)WX5VY&uF38~p*mHw;t z@xVsP&+4!<;SfQBckyaFg{a_esVL~Jd3 zR^gZ6*$XF$#l*Px;xQXVdt8cwan{dB?PSZh+EH;HEr&YYE8FV5FFK%Rp~EuMKDJ2%XS~h?&FJ49(ShVKf8-wcRJ>%#q9q?S~!=DRd&3237_cfxool zz`L6tJp+Rh$vI{%-Dv%ipg_gQ<|J=&F*jM?ygiHq=Ysr&!&6J}{3aLYTLG!DbJIg_ z?Cz?cZg6Y_G%h(QU|mVdLQcEM_TeHuf-X{7^?haX|5d*D@#z}e3N>4<^WMhZ39lk&9W95DGZl z)Y8>Qsb?f+Aq>Jc1Gkpp$lFDRI>2*$ieE2mQ@+wAGx4%M_um)qzixf;}@ogaJ8v&e+tK3ePOC2!sw96?|w!F9Qp=lCzR z*ZRu$jg<*Q4O3)wjtb&T9c;@c_tj>*kFjO`l-akpud=GfyD6Z@X??l8E6zGm(iGmo zYKU;en+ODNvw$pixt*R;G}Cn0b0#zv?j$n2g5*m2TD-(N7EGbC=mRRK`P=VSxjnzK!{J(gK67Y#(3V7(VyL?x{nzny^D@2`P{hvGm!SsijM*Au4&!b zvp}#BWIe?n?dOWupG=E;`+SX4;jH3rO7S04?k|5+%Q<+ST%%^Wi3w7K!d`KBcyMS3 zUB@a>b|Lm53bN_gtulDg2O=XC*O8`UjKEo3|t&0yr|I(U})^Jn$H{HHJ9{plE4 zMqMP`x*O+Pbdu2nscP9Yi1Y`qK-Zqzy!$XueHmw}uiMt`R6%9`EPnsnQ4|_?+;uo| zPmlpBw*Fk57aPUZDl``oh$`=jU9IfAASxdj_mBJk&&xl_y*uUfbQ^j9D7XLnUn~@I z9kvOvdz9KN`#*g(u#Cn%l>Kiv1w4RrzW`M&CKq0vtN)xP-vt5(uStNm)htfm|NW1m z-=81czY#*`!$y!v`5mkCAG#7_2HLuFqW^~r`}7J3b{(m8kohh?`%&M8szKW^;ljUX z=l<;CUtT@A2y$ZQeERIA{^KD1^%<(UgSLOEWB!K=I~Yd4x6x`or^ot#c*0|#ZCvVm zrhhvI{`f$Mi4oYSj_AB;`wzeU``l^+ZAIkovHuSj#J`r&^Wx<`H%q7w*{j}-oIYXG>tC%OOsAGktxZ1CiNcD7OU=Rr86pd(q?6kTX6 z?!LV)>dcb+-K=Rn8|pmt7UX_<-?>?d-psOooGv`f-06*rw-<~b{l_k>hW;7ApVr;1 zSOV-&*!J6hZ_vi5EmTV?LVVUfn8r3ghKTv+d_H(pO}asrgw!8D?cVcwM`Wm6y2j+l zX~VzY>T}`;1qCHlQK@3!kXKe0Vh+O9b8gDplCr{3&d4j@O&%eSeS^?09fN&Ac2Qdw z|9(~sjX2cJoUwZd#O*Lj&zSWnN$i=ocXU7V{QxhkQTuSs(K^U(g%7pz_sfbMBpI0A<*xx)#B4w+oID#Z`J;uySYsr$q~TCtcFywDkm>1Lg)dX`bJh9jM{++y zCXWBPCfwJ#JFHUS z7%CN0Kp|KXo;^$kNp;O+sqFFEB}dIrdd3IxSQ{!Ir3gWYUtjmBo-GsB2MF7k6)DGT zRg(WamE$C90COgW@k7Dw5@^_jgcYucqqyrwJCqvwPS30VVkFZSpx}57 z_)Ep!>T6t+)>DOG4vXtAzh!DPpI0(3@A@Sk4g_%s&iuYP&tYhn^@CG=D3e%UVJ zeRHAben%ATvpy7hJO>d{1LzOvqbdPc&@XrBoUt_n5<6=RU0S%(^V67;U||QyD?SfM zgl$kRVyYfN9RAGoK~_ljM^Qqn2|e!^+O6Tl;hojKbNh7ZaBFkjS6s-ei&gBt$Zpu! zcms__uGqipXx|hed0}ArKqksoXQR9*Aijfl4|y2&Wvnf^d1f**7(SG!-X(DwMA8bP zYk*gGxh!DAJxg^Mr1|TZ2f)73tC2RJT3={(ZnZyPlo~1Cvs>Ky z75`G+qLpwu;caK$9ak$~1OyiNsgJY{td$C5u9>Gf9W-k>h_Skw&%JQP`TJ#kca?AL zr~i0W=`cKymkuUbq#;+4iq)ar9hD*8#4Fj<9SeTp4{8QzX{9N-)l2$ZNo`p94Jnyg2>EDB!f6e+B+db?7Nay)J zQSgkEz7}O&be0~o>Ww|f3|oM@%s8HM-XS&i#tG1=z9H5WH7k1})KhP`z zW*F&(p8>Kq4yeLjTb&(xd++1(vB6TSMXXCh8?f6(Rdo-M2ghm}#A*Vk^~kO1|I?s=?^)P1wC~MghvQohM zd&nrLIavd<5d9)Y**t&RhCYDGd!V#{CW^9q=Y`2ZC-2Ecy`A+@4r9mJigci{l9)e` zuSwlpA#YGuq}l_>!=O%7sSNZoRmV~8L&Q9XYmP__m%ifk!Xx!&GFEA&jRq&Q`2V`+ z{1ze#kyxr;txa?76`{+Rw?NNzjYd1bCWrUbL~TM08Vo86jq`HzKMfBi=6-p)lo7Cp zU9L{bu_9oHs_lSKGLI?riG|Jxy8Z6>fIhwW>Erb6M)Bo^@k7bsQxAmh+XCmiu}u91MJ? z$BnGPD%bn^qc~x`r&xbl%4RIV=&I)Um#3lb2*__$IoK(z1_DSwwnQlxU4$BK1L}FW zu@uhpo-*(R!P~m{fxL7w+r(@4iDWxJlBaEc8(YvsaxMfz(3E@0NcI2vXs2E%g?iKs zok}+!vIq8s0*udGV#5W3?x^g{dKkaITki?LQ35_AO((sUk7Z3}1R8=_m1_8P&WQ-@cw@8G!2*FA$4(WvRFK?4XvxgJ>{pwy^M}nm|4TP=HC4itn}w}aOGuD zawQ5;9A)?I?tFPSO0y6W1)T@!*6>5?57ppIO$?{b>bMQvUgIZOqndjM6Ghq|E?EnN zwo5kPY;RmGSMO1nsBq}J#Pl?42<_UUkT7`wBaA+Auz-Fz^-{C|tW|GmVo0m|l@myZ zk4Mzn4O;wCzcr`GHweMNBLmL+J_Al0(qq{KZ*0-3-6c>ZJ{26gy*SQoIe52fPStPu zmyOxJE@vUraL;#!bt&7R{3`{}4MX-)6`4K(?;`l+RodJpJCa8kFZnE)sHTQ%~fJ<0m$!e8eBbWTiPzj4!b-plGz$cWw!30 z>M5>C?*v%Sy2po3XqvpgViobPpgycz3xFZCmRO4wmeB(fO z5l%{xsW$7B=2=pN&Bf@c&<4%0qZarP9@G;Gp(vF-iUbGnGHd$T6&o=57XjQBUNocP z-x;m{_S%aPyx#O;RjF0oQo%x=gjiy(ik70R`70#J?V>B9<42Xtk>!KkYKV$!enq@= zmPl`Q05(2j?4Ng~-b8=9!=%h>CsxMNK3yO2);BW(cdR@LlKcYGQTl5zcHcm){H^)f z^SHy#_?lBV;pEjG4U2iC>DrtWD451d+kIOKB$t=n^y>rRS? zbAW8UI{1eyhk@b(4Zi{o!R zGMv7?Teb8XezXaymT%v+HKKcST`YMVn=>Org_4Kn4JT-L|a2@6=2ROrwjC z(^<+$yiB8Yoa%fdRZeVsw_+;E%5}1B3az%aTY~{B=_#XPGs0Ji+V`)O>{qdHuYwNg z76?e~BFLY)E$1H)-&}1-u{M?LQ@k3j=;!m%*hleHhqgS&AqU&4#9gEtbh`W4z310* zbRBf~>;sb6@kovDJ7n>^qVI0>+VdC-*I1nW-clPsRm z-+^C$J>rJ;X{nXhhDq0%%TMKoUHK;RDfi<*j%(zpMNBMetCx$e1P1*UUMG5#_7kBh83;q??yyn@~uAS+f*G=nsAnBX}p~TSZ>2x@2nPT%9=b8NP@M_1b`m;@k@n@kT+pX z+l=m?_WlCc5BHl3>ST=9>T80ltZJ+z<<~B@v=40Qzf#)++$A6LKR0C1_JgSIY{%72 zZmJBFd6P|gv~|Q8S-C2#7)b&1zRL>rn=@KN2v}x?BYwCZQIV0@k1ME1Q*`ZbG~#df zNvKW&N`LUt1S7d7nUy@Qi3}#JLYPik z`h0D0z@yL@O2NI485K(_9X@?)xFw2p6ZyGB{hiGf%CC&Guu9h8jZ>Q4gXwp|CMDL3 zNS?E^bHeKZYj_4o0?23zvjma8M5QYX(N%T2;Hr99L;j!!!3fig4PM5<+zxj^SZ%Vr zwe*+|TCqfvOnF+=WE|Y)6x5=$J%7RiF=ddWtLZM@rL^Q+M#4}{Q!|Zu=`dMjPxav9 zDhYIDI<2t^EoxjA&n9^8gY6S!AgetMdFhORgi z$~~*wt5)6(01tgDTOlI@xz5HrQP;rg@8EFPYe}AM&wRy`n?Fi%3yJO9UFbhA>74cN z%lKS2z`YkkKv8|~H?{N1bVZ!XE*0-nv~awR$q#L;h=AprV^pY_JFOsQxg@YjWf2^t zb7+mcD5k+CC^6a+&1%AT2SgVE8zpTcOLjvJk2AdS`QzD17Kt0e&mprf$H?7{n!q%J zfq5}-fUYLPV3X`c)UkLzzx~zJDG0BFyc^cI{a0F&7;Yr4#ttw@O5R2vRQ?1j_l=x8+<2vvm#rDR*t(bwKfX zfm^8%IQ4aee!fGRxc@f;X8jt zaB+c~{J<=@*LMK(*(|?^lw9N9Ss{It+!Tsos$FS1f;xc7 zWZWD{{S8kcXN5JLNA*kLUz5D-xo2ou91+!-;-HM}DA>K=g7IBb3q|*ZM?Gjc!%-Y8 zmDIPm_PNd8=&IN4jKtyry=E`>1OE)(z$roZG02+=jc;Zvei3QFyJ+m`vV~WNz}`88 zmGNia3N=uLT6dos{0t;-{R+Zb;1Ot_JOaxh+g@oxUR1%%17b?{S}^xc<~Bs-q$S+h zVNlI>-WOlS8sxOPz9GzN+M+fP@l7x|?Zk5~>S-`*Dk6?<#1~{(E8HL3ms*r-m?B;u zObn7Npo}M3#4>Tq9E4;x*oQ3h_azi_DI1mNpsp}*s#2HZP*VL1rhNu74CY}(-ooyP z%c$i6wZ~Dp`4=C)7Cs+z?;|T@evsc%(0;17I*wZgX4Tv*7@Y*_gT3wZ9xESp-Y7Fc ztCp%(QUa$ypZDZNfx4r8*aYtpzp=03<761YZQz9NRx`*eFJzoHF% z+E}gY4G`xrL*JS-KdZx_m>`y1dRDtJf#B1w%_$i4-EN z^MNS+^x^Kta+SiL^6a|~$eR%*j1yLb-;3C!4v?=+5aURf^9n+*F=`&tys2m-a5D8wL&p4(&(y~qsGy(@3BU@4v{Sy*BoJ#gdlrK)(WxQ|-NY15YFw4A@ zx9u=J=Ko7K^S))}ji@&J5*I0~mnsCAXdgs;uFLJpt6Ll2FcWHj(c}iyPrgAyZ z!XMG`9#XZ17mU%azwB7* zg+>2dKpC#=E8vs}vCQ&e$ula+D9RmLAI7QyHU-)LqW@~Q#WktR4!<2mao$D(Mb7gM zf;uR+q^o>?NgMtd&YhnI#g)LZRGr4HNmXJ3Du-{GwH+2K=XJGpr=u)U#}-@t$g%x` z@OlxpG6S3ArFVM)Mm&mpe8b9gvt?GPXF;Djsnz9^n=(+?v`>8au(N9q$6TL&{rWd8 z$tlumU&MPr$Qr(zU)-my$j_}%Wj|2@NcUK;v~l zMOS4Qh?~!!FyqrVQFR_XOSu=3c7Ze4IcLQp+fx7_EUHLrm5C~Wo4b*aLY)9vKZt-DyQ$<56!bQCYR$2#%-2Au(c*OgW677?%%B;@21*?) zW~!ST=n*f%Nt6?T?>j8_zYKp+0mS$54GKd6??UQ#_EhR=>;2rM>L14OO+bRxLa?@w zqugP`iab1`)0T*ECfvs)$Om73ySkoa;hh{fLI&)(H~^5jUcWKn?dcKX~eFyX@2+IX%mH8J#5$;f*HHyLqm*O9aDz)m+;Da>8=ZtGNcG zB--S6Er0{clR#wK8G$iCg@3~$n46(1cFhpEi-GcTBr?7x-0>NEx23JhvR>X54>nwU z=Qw;zdKF(IWou@>b|W#rT>_B^GZU+c*2X&1zY|dKWhT@*e@ojlATDI--g4fO_X~xbWJ3`EXA1jqIn!Q(|Y{JjUu_K;+n^yyl$We34jj!EJl+n$^f--UhiU zb_t;oOA5tMuK!&Bm9PQc!ujY>lIqneU)1uF-K{MW0Je7s7*L$9t4sexsd^L6kG&nH zq+s|y$i@D#cbu@!Y@pWkk*{zKse!;=_mU6k9~&%?5|}Kj#m6&6jZhiOFY%fIT{D+Y zHIe)M_21n%W~AIE17aA>10D4ABF3+-JUx`9s^NL$xm|{@iAhS~G zl0f_xH<>h4V3G zxj!KocuvIux&MTG!pu3_m*K&9k7&fK?bXzUPnQp)Bw(srmQu<$Wgx?6#=1;U))->l zrjVKA^)Ob6`TS{0(>bf=XDU^kX0{#cIKIj46es$RVS6zw2xtGRzEk(6LE5CUKSPFz z2(zr35rNd%Iy!axjm_Vavc+NVb*27;z4~1#(t3X=^BiBi=|;OF&ykiEeDc9XG%sVMh`U~Lyv<>)fXhCPO|b)vk!WN_$Q>( zw#r;T&5_Bkzz{Q}?T#t(!`Dncj}j+PqZIXVs<^@8*AL2rK4z(NGK@8eJdM`tIKn~T zf*J$850#CFIG>Lz7W1YIuZLHvz5U5)+gmO}vFCLiZyLy(J(Z_S$6x;?ygw>5wYT&# zq$^G_KH<$=)tamln=62RkWWJcBxiifcmvVC}^+zpt=+e(bV9T!ymW zW92?j!+PJqvBFzn&xH`sh|X0H7Mxlu6B{;tl&Bde{EVjS$r0c{7vyv4Z2y3l0Y8VS zbaQ3xLNf^<%`w=gwBn%8Y-{JdJC1-+eJj|KjaO-~cniN=B{kAX`?f=U$8jZaWx&WC z?}fSAF{bN&qx_X}2uSjNF1A>2m+Y;l>Ui&f(Ts&pGpK?CNbI)au{$Lnv&}rnl}+KA zZq9%mob}IUd6w#@-Z|}T zAsS6Bx;P(~z+SAQax(+0;;1`J_DGnK`byna4TZ7(>YuuGJeTVAdI;B{-G(Uwe~>`5nDJc@2B5At|+1 zq^b4MlqNHvIj0y@UVQXkGv5v>;2=ek#zqE=(6(f|jA`O5iZb|a|x_ZmI0q33yE)eg~071HBdn-H@X0@6lLn9v`zN~|G;9OhS zDph!iu-8%T3cF*77F9)tV{L#(4P4_fskp9r_0^548(&Z2gPgd$!=w21t}n@a^Z`W9 z-U1`Ntu5zWsNpV^^BL2v6v&Dt?UXM(#U1QritEP7ZOfmjg__! zh(S)=Jt0+mf=bz8PKZg`i2M*y^l2&oA5fw{pdYO``opIUe-30!a;c|%IiPius zXrBVZcKG-x{SeMAWdmYyEQbV3q4T|zT<2bE*-nLc|AN8Zz<5o;|Rv@%A`oRvg^5FIl=_Ne&;pL)HHnu{6!$T6k`>kcnH~BEJ~6 z=lO_2%{HjHJu*ojM?0Wtw~fqC?Ph zHGdk_g|e3AtwBKqFP9#34=pkE@PGAlz5QMP56ql4jUmX|(M?zn9N+soEP%GbmY3cg z77>i>%$=ZSt19}hv9Nv2TC=V3rIQptH7F&%bv3^r)G4X1Xb;&TM=>z)k(k6h`2mqv zMr55|_xZ|?)}h?6Mu*frDo&q$o+6Yl`G@(YZt=&{LlfOFP!~+eg4=Vt{6elXT}qM}~N+ zj(n-;VR>2=TFeM;RyI>i!dmm`-hE_Cc4$uZPTiIHYOCoVfZiqgEumyG@3nnX^G4Wq z1LHQ;HX84Z8*wB0X!)QG`#6>os}GxDaweA2OWS+;My#v{#`#=o+S;Ei!%zj7ROw?@ zu3nd7&J;0$!7_LBMW;CeYHoxAeZzTl`L{!_B7X@23_o&KJ@@mUMZd{q`=_8ONYBhC z{6Aeg=tEuUU+cJuvOXzkT7Nt%{Q%=)GRqTz^R8;1=h*`ruP~(1EEFGbxb~=Xt1A@; zxnz41hRP@R3ZhNX%qGkCj*^?rkhT~#_ov@JXID)}9?w2k>b3Rc#R;1!z+VM2BqwvH z-D?3M{#eULH0MkgHKWdNXzrtI`?jD*F|Tk{U^9>1;Htfz*w<&?ipAu9X!8opF_eBI z`_iLlSsZ**U3@G3S#@IB zXpDt)2Vj&24~HLI$;g?ovv4F@@>*k(8m45kJ&Dv6>H8K8gPXmL2-`5Ho;=$yBYBRN zqO;1)_5gJv1_sJJS>{KaZevR|=_b+FjQYCB{dJZdCF#|k&O)hJz9noVHQlqu8(UHa z^%r7QdarjE*^X1X`(TQ9A4ew>rg1GzHdW7W9*ckJYGpbTUc+_(<`dD+pO=q51ST*jNYrozaML4{ z*1#x3knDI!jC3vpQ)v!}0GGWk}c+o7YcaFvmWean&L}Dj%aL>rq9Ysn-L8bq) zzm9MQQ;69H+LKvjiV%$aeC9&BvQy$R3ERT-6vyb;J@HZV>7Go5N>Y`Mcm5th@!y4F z)(Ep9Y8UEu@{L{FaB8@H!_zbtSZEK)#xfiiM5Nf2@304~Qb=kj=X(K-k2-yD`cwU4I@+gadysK!xyfZbo$G z-ts)cMpk}X-v+Sdl=xLQ?9ybHiKaFPR*wq@KvM^A?t<`BrD!)>5p0}Hy!PY8GYyX83^H@uK zS$4wue zZMD&Q5W33@$YDsa_a0oWFKb_&)3PAbK4^R1oha!hs64Gu!Qt^M)lu{Ew>y+rtyq~N z5LQaHM^N+4_sUCCe!}Y!!%`TNQ(_5#Q>;6UtMg}WZZHQ>fI2%rBJkCf^h@8ga2+T3 zGY_d{n(CrtOo*_&3*25n?`4VA9*tnC2S*w+!Fxd*4n4#Zyn{JuynDED-hBpr`#XPx z1Bl_-n}Vpiw5-k|>1tvd;v_%e-QglV2TO~hlKnsX@_Y?lsR=}(EuArwCS4GWP;A4P zbnI<+Ms(WE&7-0|t50E?v#LS!+fPBkdG}d()f%v;ARw4drl^(8ZL2i+Sz;BXPW9qx zV73%6eJn{(+A5-^RKM~8*vOB({-_bLyxNx0O|C4Sx69eU_$Qzu+C!E~JeE#$xXIE@ zKVuS>T`w{YDyiR0u^+)7-l@jb+~{*0C;;LO`JchW-2oeeiTM6Y_^eN0>7 zY6#zwyiXm*M|!k|1?Gi^-)QNFj#Oe8*zc2Mx59|&NY7HMekQw1yGk{y$CzMdcs*$m za~3ZFgih{sol%X;^+_~5ieFwA90N1uX+`z9D|N5b88!u9&PBLz^z?-+?YHAYQ53O9 z>H&vFo0aW|Yc4Km3$i$1WZ4GJWX{oN0Nx}nIR}6%ZeO=Bx*z!Oh?vd~d#dVkuysBB!oXmcbS zNjjY%=D%m5|LA(_ixa}@byvT2oRhhhnj+z0;DNjI?hUcQPZIvJbo6<8AUw@uu3D7I zdAS}U%OPQpsF_UJbPyMDFVXjhQfb|5VN97aNM)0Y@4#^{dmv(SpU^=QU`sDpcT8qt z`#dJX0gl>le0|uv9fUm{wQj~O6qay`^L|nq8Vz$ytYSK~ za=0jKPXKBVZ3MXPwR#w+xVu5{)^h}z6v z_X+K(>&>@Rc{p4h3g&>|QQ*3UbiLQLeMX*xk7jb(mn@Y1hr;u4e*ccut!B%8UYub> z_?~<~4x)Ws_nu#KhGn+(!jgekuOV6;J!IhNa^J4tjfUK37fV|-H z%z5H;>YUkytG2WlMg0dk_nFg|}9}_~GB)f4ZbD-84EH9sY8r<_5`}`iUGY5v+wSI?A_b-d&+4 zG;dDW+w{Y;@OR(MBj#%29cod1OF1t9uXQuYd|}OPs7BI4hLjpXdAH=Q_V+6e?GTDV zDUCrMvp<*DOR(z-GEp(g!ceWm*>1SDs;LL z@utl9jqm!9to3SF4&ov};5&tlBo}y9{0=n!SG7V208O{iJ6jHJJKPcIQt8F>xi(Bb zS0A`L|GjrWlB;Z&h-`yO87Q+|IlcAe3+7AZ-{JN9j_iq}7J=_ch$UBvmiFEme)P!-w5#h zb?mEk0LVskvZ?yzKk@bd?B~C_cbo;Zef#kT5!WBb_0bMrqxGtgEu9P&S0 z*trvc0A>q4%>Ji(;P*G`kFGp93EIXU!2a9I`SXMOR{;U619zJDN1@E`H}zlLJE#fT zp5%vrH|YO*Q-2>MpCSN|;brx0nI8e~{^;j#7a$Z1+Wx+-h=-q3|zI&mk!gS z_ESw(Eo9@aju+&g)6xyTUw>mZ_R?HNWRpv7R_qJ)+}{yMEBBmhgZ_0M#~AP8D)7lg z;iKb7evL6qoyNGD86Z@t+Ii<0oz0aIOEi5pF6^N4Btreau9rdvzv9at3&Qwcz~lrL z(e?zywpHQ2gIiI zbY{tD;(WAy(o`j@TG9o=hh*g8R5?hjXq<=^+<9m$N&kJ_w5iX%; zsjf>ZxTCGx2R!|th5~vowO-b!qgXO47F_bo%SS}($W{bDt#47EHAkD1t^*a7y9RvM0`<} zYey5zcaBz`wRi<2Q7Sn-`B*vje)3u|H1KN6IH8Zc0Y!HGByG69yhDy*bmDmVYT4~V z$!xOwZTxZleAm1FhZcSj-v+tkp%aH&ErmYQtrr@rwwk)si-LTX2%W&G-~)fqUVhMr zU&lbQ9*|S37AaWePpmot6ph-qbt8O{jj+2j@RDJVR;I=sT+lV9DB}}+FoD&%IhfX3 z>pMyKuF_lV)q(v!q~srQV!nH(t>;5$d0wW6|P`2f#mtzqfej13VxIy`s)bZUH+|K0cEeSRLrtl zG0%vb@Kj)jc64=KCl>SKlUEI@wzJjSjH_hFl#AvjG)o@xKMTazYDH$fzZbCi(S5q2 z7b4LeY4a$c+IbaW6M1$O5$yknzS@R5@d?`X5g+T7^L)9(0_4bqfi`cVPO98cjv){n z$TupH$ks|qJbJnUJ%4Qd>`<3LR51wCWO;KYE_6L>a|f3isL z@0i6R^nfs%U5VY6Ww0hVRXAgLfe6N|UsURrvI_we;&`@XozU?g9feSRlRm{hcAX zPB1VH0E+!M!L5S7CX>(rgm;HFz#(0Km5dhw(l~Gd3mfUBq;vXPl}_l^PIE=FO2X-6 zf5$nUIb2&ysin)@G?RxOE7zHqW3-LvYWtq!7eLWnIT8LbVFb>v;CU_ajPY^SiLRve z(FOfF6R!&m7Ih~vqpMzh74??*AnpGg1C`b9>bpgg4y$UF@js8NvRV-4#>GDr^0_NF zJxHvXE;Jh&e{g8SW^QiBj-oPB@UFKxTJ<59!rq77{vM3Ce%|YR?QjD0jaZ%NlaQK% zcS7nnZ{E0ZL(S8RoAILh%yV|ez46&eLUm!Dmo$AQFWh@vEx#r#e=KHKC1%oDHL>2wa>1V6--%QYpfFga3kKyeIJK0m(?nrseybml&Y}rb1>mpXR+^ zN7)@^3yJT0jLN&x~vnTjx71=WqW)2dLMe;JUwOqRM( zuK|SQI?8=H3io){5#GHxQOBW~r=R`SsD!XE%mBFq^rDviH$_|80}1hYndjH2ok*)} zpnuo-^`{e$+XV{@HG#WzVPh~4&tk7uXKC>EsGu(0c9txDr$sREq*Ze*`6$e2xrO=7 z)jEm8MMcPf3xPF&LD;hi#hn4y{b(!30I+eI%7FKZ?@V5rIEUt7qiu9? zYo9feE?P4+p7fr^7bF!{(02iGH;Ap&m*}G^#~bb#Pv5+0N`~%%kVgF_y<0;}ni=Q+%X3O<-Fl)_`aoBvK z@XVM5Z#UI*Sf=kSrlw>rQ22QO@Kc&dW@6`^niFsh>`bGK4eepj4z8@|w zv0SLswj@i`*`bBiYSB_Eb#1(}PS%BR>DggP;nnhKj+4t8ECkiYYcp%Ir{?0${TZeI z=v8kL*u>ib2tRq-eYV4QqieXzp;4#&sjq2p$4)eBh^j^9yM9T7#-p8yr?i=rZfRfb zz)dd|!HSLUe9^F7@;xIiql=L8t+c0euS&Q;mf-dA)>AG{?k%ZZESt_6!U1f30)Q2! zQZo$cwg!wWUQGAxI6WANR$i@YsUFrW50#DCnzq{k{FSG?{7i0Nxq8_w?sy+(`g0WHE=NsN^PDXoXQMyV6979T|{;9h;mx zFa@(>`+1}j2D%uZ@D-{@rM13^zFwZgkt_hF_`<#rr$+RFAg2(M^6V9!%H?US5sgae zvL5VyZL2C8-0!zO|8?T$zzhzR^&7hm3v4~b5Jd+}aZx#?1h5hVjRXU?OML}r__?@j zYq~Z!oj^yeCp&vfEQ8zPr@yE&1Hw*UE@GqU!#C;1}(v}2+Ya=~py9u*Swwq&Z25DBB8}$kzH+T2z2WEFio7tt>H!1SsCK&xTlS^-7 zE0rE6+M(^*$U(qQe+$Yf~S&9=M z)Ss5phgX+{YvE64pKM`wYjW{_sn1xnn!0#B)GV1S-1b8DO~t#LYJPHOW-GEQpA~9+kF zr?C(VQIs$Mky1hgq*M$f6r@X~yBR&P3qk2dQY0ohV5C8JY`_>pX~s5c8!!gXx$C~} z`|`TJ`t|wq_xxV>e;W$hK080>c^t>PkSjBEl3_zX*k=`SubmPL4e=7g(+8cDW-_CI zEG7`p!OVECGUxdgp%ma0e1UBk;vsg}qBh7sa<-5ZmUtoO9x4}8X5St7h{VjKxaz`F zpaO>cvhiqgNSbN#xy_k3C$gy@@5209>dF?8a|1RDUR|s*No>7%ekuF=K;v=t>{)~R zG+D1raU}K7nK9#VVBFfR2}vfKzqFmkMa_wrudp){#^A4^R6P6!NC0imlGz4x3Uj(X zM;S=^!Vl_afoH6?!Ag25GlLdajHTaHFk?GRztAG)aq-fCfzoj%xKxt$7p3bqu24~t z)OSl?lvBLg%cYCg`qg_jkT+tBTkGcZWA^uOTVuXSXH&G~tYgiLrQ6<%=h%GSv|l6F z%loI@G#DzGdLLAACv{dDpR3_HlgT9$UU~BIlIKyg!qE^@+t#wp#GxSt`!z#pGWPxYZHvh)w`OWk-8qt&MNbAdAn|&5#O}=mghuue7R!b zxZqmnjz`2HXs3Mb-LAvAW-^GO)XI5{`vbcpEb|2XG@W00ac-V2I$Jb#v+-35EO0EX zp%-DO<25fLnrF)V9aKkAPZQ3C#dhTP1v~Y$Pw>F8wsV`CtF0fA^E1`{%Z-ZaC6Ng4 z+0%fFC*!08cO3d;%@23OssVdtKHMY*UT-wbSMPDjzrl=jw9cZ(j>kvRIP2U3h*=+%D|+I)_^*! zgJ&9mM~gl$t|n@?5b`QejpgC|7yP;lP5K%vw?`<3#fla&Zm2d;lj_R1Y!c>k+iJpb zwRHlu2)BkKJE|bbRn*bt$+qcI>W7K&XJV&MV+2ueN?|s#(aRBa}w)iR*m5i%(vq{|c>N!^}Ki+v)tu)2k z4Jk{uxnRxomAih$Wxj@W2O0vgQB*E9p}1^n!Sp%d zK%8=LRW%K1Dn+3Z`zB~vWr@Wl@JJqT<)5bHeNDND34W#UtHmwGbnGxgYT5Xs_7O7t zOHy4Dslb$K#rmbJP|aPDN_|?B^PM-m=hb4{H1}zU&72oBeoPdetO;V{-U@zadaJUz z`Y`Fd$0s7?7IRXb;g-W|ZV{7yHx&-C*F2=EpvBa!^TD+no>h91=2fM+FjIJ^CSzgW zec=@kZOx17(gjCk9Z#kPlidzWP1ty4vyB5?Ufj$nyRH-;qnKLRy5`YnO1 z*wer?lh#-1lxF@iFxZ2rC+BQL#6->1y40*MnT*wH4_5n^z^3jGYs836u9(&+xYl@p zYwrQ$a>YjSbwcDt%}@pueQlEl;-ioQY17WYZWWcAji+Ftkk^$tmmoX^8uze<5X(8x z;Hw63e?%=IWvlm}P8f2bkWgK_9|$A6uxq7%_b&Qt7T{nmaFTf}_MVj_*u96ai*P9K z%h#p{Ml_gE0cJ6N8zI9f;yP?Cd*2LMhf-TN%j;M~;#om&>mr@c_DonS$=>q#sPD!q zCAl1U3d;LHqk;PQda@!><|&1Mp7zeum32+=$TQ3+eIqyFdURm zGKwkoEk&I|Rnf*73eb}(210%s+<|kez>T4Kuak>6F`YtNyvpw{CtPK@*4UceWh;7Z zV_8S#D~{hvt4W27fqXAxAHE5g(IN&HBr>)-(l4r(^(GA*g2LDOHSNEweM zY%e4|TAwRo$_j$<;~TYG)@fP^aSZQX%RBU5_MeL1OgC--g6;hr#~o|1eLBy1S6$GB z$x){~Y<75a+?I12ZO^ayz^E^tuvmC_^hU_q*LlObvZ|rE)Pu;a1&dQsz4KekkEbUS zhf0)???&xd+bsPjZDx^WiC)?QT*U^;%F+-hz5^Fr90?A^~93eyv$VBL@OjcA8Q8YK6;)x(`Ohk4rX5QulC32*BA5vbW=tpSru8KG`E zF5fK~r3hA@JeVvm-u`H#%kLuh{7{dCD1cxA#3_kcBSI<$?$xT<&OcpX@ zevLxYGwqYeWj+~2XLYEdnI?6vrGZw0?12QSxpFkBu7u&S8 zV4F72>80Wnsck#nqp{n=BPEIUZ0iJbL}m@?^Dd%YpG3GaIc~&aAbO2Eew7i($yjINw5luHF<@6G%nuHEv4?xyH`B&y>?GZ*bWA+%s8-$ z^2_0T5U?~x{FDLP;0rEMO#xlz3g2AIy3m#2IS~=P>{l4;a-N6{*G|e3h$qtX-r*!p zxKqaVFg2*S!~wqb$mUhsSVx>l24@a zFluQDK&BNQq}{FW)1gGp%NHv$x>L&LmuY~x6=L+l#HpO~==pAzXjwf|m4wIGTJu1M z;r#gh3|*1J;Z0}m9^Q8juE+_v`I?Ze;g9cxKDt_73di}R%x=BfzJR7-OgXx7oCm$h zjN-oCW_2g3VuBKz_@#+`sSY*NxfUhL=n2W1mA7k~vt?y7kaFnOX72}mrxLfV>z$MV zzPYHz*`0)X_CLZx$065(|mHN>sH0Foa!LAwanzG zi!~(Kxr9DMK12Q{=OT|0(nSD-AtN;_stp9nK1OqJUpttn9a+$4n=0>hWd}%IVlD8= z0@l1d&67do9x5sjmD}%j>Za-oqXtWk0HGZF`)51-NiwVAXG3JmT{TWXQ$k->7j_!y%%Kz=fABIx7!yU{RK1 z&xIA@`Bh|HhBdFe=82x+n338}k#n7Bmv~p=KC&7Pjay!6GE<;FJxF8hf?zw|%ny|$ z2GcU6y-G_%R&2J6uG)QgZ(NeSCg--fvDVqUbJ)<1b8+|mx~8UtlnHy%z73la`*LVP5w*uN$}vA*ryicNH_5^1rUqp0TWu1$E`PjvCDg&BH5lYnKG!=*bbN8HYb zPW1o;Nh{&P*ht)_-*lu-cEaIX-rHY*@XDCc8tVBbyY{$mEOpcsyp!$KB0EZV{1qAL z5le$gZHOy-9Y}XL0mPM6@dcmwg5YIA*HV>hI^OPaGo}nwEYg&vyYZVXLyiai1dK7) z40W}`aZACbW-IWN>R4D*7IPF{H=^TU?e?Par@&A`;XbSVd%-n)2XrGe0iz8 zR?tTQeT?4b@>lNObbsmT9)JKKbM^ih<>}w)%MR>7U;H|Jh<1g!Xvqr5TDO8P?8zr$Q%om&dj(XS#*L>QY437xle^DR)0xAm+;I zg2S}v)RqV&3q9P;^?C^m(3|lT@(XUsZ%5JKJO|qMEAy%qeBHrNb?M5QHsH*WJmwE3 z4%M82^Rc3a+6J&qz0KkBjtrV3B*EAz*6nCfgQj7M?$B7t#s;KqU{rMamtBCGz=TwN zACm&*zUoD$Dhd3N46KaanqwN;+#5pzrCbXbmSo);ZzNorO-~WLanLIjAUE3Fls2v7 z_f?1Y4A!~TRRVzb#Yw+Qgt67<<4szY5Qb`yITz9u9`-y8G7rRa+NQPDYe`iwjnN=~ zt>rfvSA%)AeG_?CQe^umoat|sKKk6#fQg34Qa)AwxB`Bls;Fvge`Lnyr_peBHxo)j z6;&KO7Rug!6}Fd`SKKb&$7Wgma-5GVY`_QBR1qnxQ^^8 z!}={ z%_?t)<-wc+erEhgWuIgNz)zB`fZv@A>HF93Oy8Hpjoe|vYT0f1PQVljGv@-I@I>Yg3IXwnE+9F8xS-2Ke9 z{DtQWVYmR1+m)zjm~!NTk#^GgZ}xPT^njHa2|B0NMY2Zbi+r|T3f*FE9#&Q;4Xj4h zrCZAE&jfw@#42S!R$_}qfh;Pj25{AEr_1PCyHscsEIn3MR`j-M62L(1i`2P+NJU~* z8|sW9COaO(11yHxQ)dQ8otb(2gI~W^BSX?WSANdI3tc%C(Xh@B9nZO#)g=5a<mua&L!p3L@l^8IlC<+bmO5VX^1rj_D*II%!cCT}F4-BALM{{Z=?7sCPCa z8oD`>!5q(U2XKUZ z4_@Nu=lj1}z(!`1K1CZF2vrq+EBM+uLFVp8)>HE1rIYVe+P)D!ryj5aEAjacsuxSH zYC(wBgOwJ){F?_>UD}gw205qv-~t|+b`a3m`eCt8|MjT_Ky)>JSUmIl0ge%?G4&40yQt~>N6D|+b@K=Bvlp|}nUBJ;obHwZFjaE@9pSc6T ztWGB@fP}VAC?iQI`p$z2j&Gl&J*;8joD2Fo44~IwNIsflUJ?uuFq2FV#cM>1wl%gH zFY|1a?=;4iv(VdfhR~>eVA1HleHD2SP(yMa!|RoPSX~jtfP|=rjO_Wd4H#3{M&}6l z5=X_qefuVK#1tMH1(X{%Zr_eFt9A#B`wu5U_RrZIAL3|-rrRheQ4cFP$6?<|7){UK z#wF-ml-eu4C6xTz3*eTB(Z@7wEo%He+ov-7G4$>LwDD+%NvXg%HK3ZMkUk%O1n3nD zdxB=wHkw)LAFfU=+5ffXkBLTzSf?hj|Cyl_>Ma_f0uAZW(FJs8QPcQdLOSj_%%rkc zCi;}|r{Gf-N?ud#y0t-Te)!yhJ33HTH$9wk#jk9hBMewR^|pq&^Z)zx>dW?=4_+_* z(%87p8!%EKs`mlw)m0Nh_4o%{@2{r<_?;1qDP-(k$g@AsWy50&v!xDFPDoVmyGvJd zZ`R{;{P{Wl@o3gi;Im*}CKf&2`R{rvw4U|ey?emL zc>JwWpzn50PR@BPrVgVf|KTF$N0sZl#F3@8IcRn)z^Jm*E zLP5~B#^uYG7nB8be#NtWRH170OhqO9hs@ERzguvWodnDJ;e`6qZ-ZCvtG)+j@|+|$ zhOXcLU6$uytqSX(02OZ;_-)s6$Q>NSg#;lDQ-e^dqD z!ObnUg^j;{{TGi^BLHEJ^DTFa)vvzQzkcx@JzJr_j`4!Z??2doFYW#R*DkGUwt)X@ zC-NcDaz3v{i^D!LAIRc<(+@8vR-+ez2g72w_ za+n)^pGi4J{`Z#f3viiE+AAyp^eOHN-c{{WGx#}){Zp=Th^m1*z&;(m`&V$$U;FIX zItYiTo5zr92KIqd1SQ%lP!S?TE)>!XC){}UdrJD)@Qz33=x=?SGdwG`!((u&h>uv{ zx;I4e_b<&5>Lj{n>F^lO$K9EO#+Xp+=V-l*oUbB18R_L3etzdfOiJwq!h<`gL8O7$ zVn~-o_k{{O5R8Y9y(v+$tl&|EMjI^dAv z4ztJ#?jH||e-J+ZczR7$Ad`8_R{-7lz5L;DRasjMv*`SXp%_W;#3qnsCmR8DqJc*t z>@JY-Y2}!a0B7g?jpfJO)}T|jefDf)Eej|$b)OB8eyEK2o?b@xVCjT+ z1!|7azG%0hx{I}@N)7(cId9{RY2}9_1{qx~8Qop_!Z85p^u(FMU40&4IWMfHy*hMO zYE)qWILW^Kx{(_>x_4n<@S?fq9@?KL>PxJHL|DDYJ!~Or) zsrJXCJ*SzDr84q0zbu!o#cR3;I>FIa_5zsB)pB&Z0* zM!M4zA_idyKy=|Fa?TM8&fjzkhC6i29Q7;Rzg2G#p^LD@LE3QB7BERShWi#ck5&(j zm_B~NHHkEJi_W}&P>Lx`uJxYPl}5gM$ev}icuzO?o}h^3yJ`@gg(e6&72tSPLd?J% zS_t%%-oyA839~fkk%|Tr;h?+&BD!BLxT)ht`_)iJDE?!>=-Ecx-wn!pqicX)W*!T- z)QA;1QRav__6B*IEOKkb7-dSdLR+G(P5aNaq$nYxL@l*X>wj<_&4oGnsla(Q!1|er zRD?))xq^08@Y0iAwc0tqQT~M91}!L`Kph)G&J-7li<&XnxAOtwY1zZ?o5k&zVCG!I z_ct46$vv6Zm)h?$c7|Mx_Q4@FfK7>3tYF=y?SqyoFT#lYEP$l4gGVYT){nU&lBN8M zhag+Cn4Itx0;UOLJy#{PHqpZ0mY8w1NztI(S$?*sBxhI9IRYPa)8_dE94W?`nWO@> z7!ARR1CpOcH33*2y@fYbpWt!dUF!Ui34n~WDB}|tDu~~!HC0|6yOiTkA5k}b(C-Bn zbB8xZytEMp-Yz6=%Z=D}+Gb$5FQ!Li_9eHZ#Qw%`?wTghqWP>>(55AgPIZ}%SCy=l zS%KDbf+TmvlEi}t6#Qc3bEpLpW=S-|n$PyZVZb&(X>^{EFkKj8>f_%!H*M}sTfGIV zyUVmO+BEo&xYd8|9|E%UL?X31%g@)PY(rvM9*&7{O=!=QJEC&MA0Iz4S-(k>0#Kto z@UY)?RHk{my|B0Iy(Td8bzu5JXHP;#{d1Boc<3rq=k>gX1IHU%Tn5}C6Cfks&b9;9 z_vFhi6*-pxOCEu+X6|Fad{&y#LU9%Ep?h30p(bC=Us2Tz(48yG)(hwvW`N>p*-XZx zv(%Sum)hQ13LZax{7uhg@bQoH4#TAzoH(T5uC$L6C7qymhlv?|6zEyT@8*^;ivT0; z+v(}$2|_*}z*O1($||5KP9ogu$`C>ocx2g2|0nCDBiFK8qd|5!Tfc0@C?NZ+xy(xS z$f6_lLa2DdX?Bi)5K#1I-Jb1DKRg4zj&s;VV5-_0BW^l@hc~TOe;EM)9w+BY@Hy9h zBM_l1He4Qvl8}C~d8z>wek^GBl@q@y6;apeh`DLLrmNyZs$(+VW2EmL$cQMZ#n{;N zd(`1xA*ignsNAY1qoFQy1r-OTY)hz;-b#jX4IT~on7!1=)qF;oYJb0kPKWI8(^1sR zRJq3*lqehAypk$q^WrLl*~9m~3ur}YBk9H*E$ZbfuMd4&HrX!QnIhY^J)~}>caQ)4 zVpB4~1zjGQ&8cKh2HYcH#P0igEpLO2gEeY|Z$Z{$b%%FsLr+#tr@)zpZ;@Repbtyi zo^Nm?0UAe+Y*tX5d=4;b5R$$SAyC1#fDMFJU(JRjEBH)&h0@wy$$Cxgn(d!`&O-c( zYM7a^2ZYII@|g`dN`ceuLbIV+1@|!l|Jf{Vtu)|lSXn&Zlf_5uBfM8B?B?gKRwyh84DC_`=UJ5i99T*v~`kL zRr$)iTdk~`2DK_-AkY#MsP&{&`$kGqI?f5u6&0=k23(f^%Y(KRVTtDgc2R+Qysc%) zhpVrSPM#GnFWip-9c#D%tf?i$SB4t6x`1lGm3+mFd4WJro|r|}ARH1lv0GJ~YX!vN znl|}trv$_eFnj74o+g~L^r?XrSz%?LelU$+0IWXW2iW05e0;8~sg^O%7_$A`(1qp~ zKq#nbTzd$wsH4*zMt?j`g6BMn|E&FC<)DhI3#Mpq%!;8UuVc0e3fMt^sZl8ijD7d{ zi9E>3h*5;N&fc>rL{HX-GW$jYFznZ-6F8zAF49*X>SArsJ9N@rSd+|5KoJlqv}J}X zzkMF5ypO}osYj&r59lAA1CL)CmJ#}<6Dh=bJ|0Wx`(Tjk=qoF2#N6O(T;-gbtGqsF zC8X*IN5Dx(WW0$&CRpI~99dAn=xx5!Oga(6AIR$+JSuJ1c~ZePzSky6`5`-}R9~Ya z2crR*fDye~klSD8P4E=lGq0><*O}xAFH7;eH@Qho{DOOX*6K>-+Ek(zm7s)BdM#;M zbsK0crk67)HnCtUkDsH1;=pmEJW;8fhsDrP+zFMxc;1$1PlkuoRo|Fwl~d4S-+o{5 z;O$?4xPKNUy-!rHX@?S03NPfs?v_N)77UFOdSN{$DX!JCT}rzx9`YtDAPfrPi|b7u z2D~rhgR?pK6ikOQr$#T13;S7%2>Y(R71UUre_N-@m}8D=K;FSudQB(YcONRAOd21J z2J>t`Il+p$&k1}Z5BD!efMGeji0mUkdfaK^dD_<)b8%HLfuGx_0RMc}ek>R#x za0j%3Yt^g}!t{YDB&||2UX;;?7zxhfDa-*ktYzvE*NTRfFy$k7k50OwJ`M$=*q1;o zjwoL=G3)GxOE-yDW-Gy|mGA^(m^xI|eQ9F5XrCf{2)-31X53pC;Jl0|Mt3EvOnbcg zNlwUL%>{U*Yf4`*FH({~ZC&Lra^2tEw5B!VzeDv$^zLwr8Fdo{?^(gDUs3TB3ht|(F=cro4Rh*-SE}k> z^L$LbVDmyV?u>=<#u#&7hlOGdz2;sLgw z$jg|5Oam9}VT|v&YH~?VKo|cTO9(Ay#DD306BzFvmIU!+Hx5o$Aim=Q$CR~yVy^YW z-T}r+2cGc{Xm%j3e?}q4C~^Mg7YJuW8i;c?FqWfAY}dc>c1-X}Pw`ex6AcQ|HC7 zLCazEBzbQQ3aIUy0fI3Bz`nJlO$?u+VPTT5{vTC#i5-NDi3Ti|N{C+OD6;i7XXXJ( zgAwaVA_ih(;%zz2d%@3!MrdxnW@&E!o1$9)v;8BR9|KIRdknt2Olq#8YcC8{H5TBJ zd`0p5((Qq#g=%MzA*xiKs=APe#Mw&HU}M-3@BQu~7S$Df5On#e{ZU8(cwKm(d_A4m zr_S8EJS};qFAe9gekm0AZwsA&z!r-y27m*C#|;6d;(jiuyoOFT%c6Ua&8q!+h&HIg z=ZLGxRm$D`dsca0G5_xy)V9pMU^@4_`dKDRok|@1l2AK_&+Q9e*p07Fh=eCLZ87n? ztf5vQ%(Txq(G*ov8%>LU2WdFpXhzU2BAU1Cztex|CPJ6!RWuE5$xJFcS^gSiCyhQsICLe(PZ~K(Y{DJt$+?_cFsnN8v4%Fo>rLjr;C%`(Pd-xcB#>QIXa2K98Yk! z=N_^t<8b{rByu8@{mW+0=WavG=oWtHe2~hD5YmW3`?5c|oo3Glg}WNoie|r2`Ny}4 z(oefH%A_j;wN_32wD)l#uEyi+-q|2C3xEd<4U$% z*`3BWfKtkOu3sdZZzdH~Yb^jjupa8oN;e)@@9_WvuhT#k#LU|`%gq~%9Ct^7!#jvp@^dMQ4z-g37aiO6?5t=2-;(knwl?jyWm0bbQ#fB|Aeene~xB zemp}T?gJp>>uMd{jxu!zl5(eufYGkEke&yIXL##j%f7^W?tlBt42*S5(oZ#`Kkhob z!ADVc$Br3zl1Ge*w*MRxN$h;&%~oL>>_mnm?DvdVo~uBlnxmH8X1A=WJ?6&=cd9VH zW$32~$|or!UNG$4Ib?z8e&OJg1*R(VJ;GvQ86`vuiu^;|R`>1_d%;?{F1B z62jbZ$s$A@NGl0vQ|glE2Hf@sR*^H1xAEljJiAbV(9Or(7qm$b%YZG*5ZOx!aQkm7 zsG=42?Z625jYFR@m${YMjm-_#BxRGuX(Ay?#A?J%_mk8*#g{_Smjt^W>ER={i8mk& zVmB^)|GYB^%tl(1h|{gSkbckCXf9}%3qNJG&@2Q(K3o2eb#|TmSyF)o?G2xWp(W?g5C4@Ih*BXm&v7oXM<{9mWS8% zrx=o}XdcP}Q3Wt(-H&(FgzqHnLtSeMbcq7azzcV!`aKLSk0pHoh z@BDA2GH3HFdzjhDZD8-#a<9Dk?jl`N>cMWs%)9da>r23WI|wESr8fH4UK|iPPT*%| zQFu-6lWopOPoGF9@%;xlg21!Ww$^e|GxhV3LPr!utg^i=gN1>^yR2R_j*?;Dlim_C z8dWRT_~VWrx*`Gqg~%2E@!5$&AB`1bN$5R7`4+omYcGdrUrTaM7kUGLa^T-bWPhv; zSGl&$iged7qenFevNiZx&@CWfl+Ci;AvltE!90kfPYkD!^sFpPzTAirb5JJW=#gZ$ zaOe19!qj~n&&=yrV$RBpsS`O?*_!bui^^(gNjxxP=Fw5B2kC#W$M#f=GPR`Itp#9bWvfQNj1GLa@uOBnvDNkg8#R8(S={-Ew z3UJ!>p4oQHVQh;ahfG?^$YS5HKVWo=C{;mX$-D~JXzLuAK=msm9Sq=pI)Wu-vt;en z22P_A689J+CNquKRr4o zc0LMX7|F(g5pu4OU>{o95RS5H^`ek^bu+`3&n|mm7??cA=CL)9GKR)X_O)$8wR_;*V4MV=)7Bq= zOK23xaj~EeQjHO|Vap@(o)Zxo(Wl#Le2CFxyyCOMSl(S(z)sC`YTkHllPX^fc9!Wk zKLBR}adQ~|Grxw;{&g>Bo(SC)oB#GTK~CRw05yz#cXUO2Mlk7u|HYLf(ID&VQ5Eag zqPVz2@*x`))?F#)pFV$n_&wfl+uycUfwQ3|w1kt$$K!^_Zk};tj3+G#+dkUluRe7{ zF2DLk&w1Iiq1eXu>-jsIe%vDjlD9`N^40G=G04l%J1J4=$qF4qBb(#SW&pr#5aIme z|NYtJ6o_X1q`S6m#`m-D@gF}6JwT@@9DlXzw^K?$;Tfi5&r}Zg;JtGXL|bsy*=h;VhtZ^!?NP z;~x`Y@Kj9{Ac+5cv;V!a|6K92BBJ6a&^4Mg)CA~9CR`vESbsqev2C@K;$4dzkMGqf2A_|yKZ=`HmuN9hA780K5 z&dk4mU$BoaMGK%u2^UXD?fS`H`!}x0$&(S)_Er~9u(h1+Ao#LZa3+rkev2)&ghC?P6pJ+rt!CjKTBy?f4e4PkRNyZ{mq^owNC<%>bz70nvu6p zP2mSQ4x(UK)lpu>bH?zsMjWgS2r^F6T_@;+eeiZ$c!aaG0a*NQ1>e`Si}Ei>b~1`5 z!Q*FD%a1>+4+j;DWL&}3&bS!QHQ7PlSd5a@q-n7|MmU?+lOSoNm#T6P$$}E;Az4wD zdFB!bz}3S%M%;Xk!n1d6xou4C;bbT~e-!BF>S(&u`akhjD}cAQ)Fy+nD$z?PRav|# zoIe(XgbM}cN1gYW?lkW_1L~5K3%2~;CxChXSq9!_n znnAEnDAAx!5@Hy1`SgGouv*%0xoT2u{j%*`AvXI-RBi6Fs9aB4b~REJQuaZ=Ly2E$ z9lrgz)1FnJn3n>|pf&0smQJObj_)-AIGxzi=IZt(pi#TFJSF}%IIwHip*vF8Jd=aD zyc@`;_Cv*4M-_cFi;ay}!2nf@?B#L%cPoJfP+vxh1BfVI?JFZ#-o^^Sy(Yj{m&ipk(-N_)t=?F++^R}Arn@q7!GGx*ASLQ~YqI^= z>HNKN_*W?u`iS+SGJ~sBT|vGZM-ZiuSLIrgFq&h@J*>fCisIM8m14N|y$lcUaw_G2L@ocLbjUOXxSvNVio_O2>$Fv z|MRmkN4gBXuz^^axcmC}3%P3d%9&cC65mmX8B{;v=a?v zaHh;y1@S7j&#>v+GkkLQ@Ze5pau}|%$R@}66rEj(kzYh?YMGXsO5TGlG29rT* zM3X^|E%u{FhC`l3P1Pe)y+<%}1Tr6Oo^NzEH8h}RlOLM@HkeAj4yJlpo>{HB@9wFG z=XTblwvDI9LI8oynpWjgjEA`(m!0Vp=No`0p7~bRq9?sJr+`u`XKuL>uCjS16SHo91^mhTlw@Bjjs<`r(6oVVM}i@Rv4f7)EptirEh`+du5 zzgx`V~PKhPqP)&;2 z9Kq}4XuzPjk*%4s^~N1*Np9p4vixD-+hn#veV|2pzFEOm@+1 zS6`b}u{_g2ms;K;^Pe9(+9v?Ma&!80ExQ18qPo+aih`zo=bpb9c0?Y+IvS<5NW~{>fSzcji^8rMQn*98w3IYGV z><-Ox@|(|BC%8og3MqT-*YI%5tmQ}@1PM16W9+9$XZF(jbb^vpFY~21aZogG%q&w=Lh1<0ZA5!`nkthAK-|a475vX%psg zK(IO2u)O#4(>CG0?0AuS(^7i}rZIr5##qLRy#aLc5=p!Ax~*C>?;YOa;-=+NrckK& z3pd6880l!E)Q~kG_%s#J9JrDbf`JuC_Di-`SSYlb4z$YKjMb|F=P1cmhyil7y3)&L zDC0)f6ffj_6aEET3tco-^cIrU_6Z3fsV zL6G!Ou{AK~x1M;mH`F5KcU&!&WL2YXr5;&70mVIqp~TXI8_GWGQAdH>*lwf4BXmG^ zsAS?DJHLB22eJEI1}GdFax^4Gt&AUHO}sgrI7S^8f&kL0i55o|F*2u+wuRsrIrcc! z>%U~n^;!26ugZqA#g_$9%{LsHfok66_3X;5{)gLVeV|bCe5KUmARsVSs+z4C^=uR8 zbJ_H@?M%8`TuNGX7d0XRry$_zHZ(C{_%wl^d1mtwr_fBJU5^6>d{EzRQZvFRe#y57 z64C!Q>a0rK9*Eoe=f`_bT=lo^&U;?##PRA^hCTn@wYKTgDaIQeTiA4U&n^t)Iwp_^ z2Ary?#=+DX7 z&*a7bjxTueA~1Pnfcbw#TBWCQPT|j>8MLpLNzh9va|l)(2xi{EM*~cYZ9C?cEo5Gv z2ey!lujvvM2T`D5)uR-G0S=~xJW97K;Z$CU=p(T^xi}-lEHxg9kt_B*no6CBg_cN8M_9X_m*Xxydfw~*!)0QmKE zank0qZ9P8uTboq3Y4@IV^$wFEAkO=u`Ec`QU-r}>I3C-{-=6X>#$6ea@3}e|&&Zrv z%Jm2ev|{Z(-gpn1J;N$VZuFU4a%K22YZSpeTORr)TD1%oQn@_gk)V@w-T{+g_rwQy z_9cxIG_o~Yw!&}fHhSy83RQM57=n{xgE##*qtDPZ?rl5Qg*B&`9m^poib3KlHx6%| zd2_7*83`L@o>1EW1NIRTM}cdH{QT}GieZJVVBXzs z(W0B;e24E;(~D0iAdU^^hHwkLC6E=Uryespw?)GC553U8Bz20&pS_M@RFY_@a1?`8TDi zngrk#E?nVqI|GA^W?x#gSbkKA)=FfnkzIAM3wD}BWfkk1~P1WcI~v}D=tnSQdbaoyb- z^DsE3;;g?@R@0GZY`>Z5_5N|j_zW+5u6Y^hrKQIBC&E}7WT~bv*{Wp6Xw#jKm%bZP z+IIHg+Lm0f@#i>R1afl(NrDQz&#X?1gZO#&UL61-bo2epkSoCFE(Wk~QYlIv-=Atz zJLIt6`^)z6@kxX$ZB{s#R=9_@Cv$T%KsSmi&V_egA90{9eC|B_+~&Pg6Uc7Dte|p- zb9A;~UWEuc6LC6DTO`%sMi`F=HkS^$zBzIAJ0?3INX9|8+L!0Y&g?&B+g~>taMA(= z9PUPWN&U2m@ffYn*iG4#GnMSO)fcntO-2r-WwGR`&79?scX{Kii&8JB?NS*_)Bf+ik8 zT!9j*aT0(@wLMtbXS2Z~+IDqsBZ1lG;Q zBe2A9?WS5gifa#G=*-Ao3FmVu4`IJC$t+8(xCDF_g-YzY-gYFOyAIG-t@2IKHMf_{ z;(g`^uV({#ZY!j9@;9~oHQvyOE(Z9}5&en=mQS*WMl)`S^f~K1-W=Q!v_3}4NLd-INt1kJCL0A^k_X!1!)2+uW4leX3HOU9`^WN-U&oj+cn+~R6U1E8Hd z>I3+p71#o|#X&~7sLJh(sMKADrJ8}a#$0Jdjs%29((sei7o~^P6pg4;z>KAmEnD_l zL8u?1)Cp@LWK035@i|0`hkN*4eldVda>;C7;q#x^i)dkqpj$~UO$VtM5-KucyhaLF ztK_J0t|WQ<44ijQKuJZS`a2L1?Q%zbnf27wH}C7EC%5l4}Nh)Wy3vv#1mIQ zK1Ofw^nSl!wpmwLN8j}8&b%=GqM#`g7ns)}QiY@dd4Ks`v-tMQU2MK5f30(q&H*f zI2-PdjiQcW)4XZgghABuh2Y&j^4>EMxATpFeZY&hLX^m;Y@0bW^P}G)Cu%vS;^2?l z@S|ry_!lba#&!JU1zUxKbm^aW5M|_Vc1x@KwylYD2fwqgM_e7(mAXst-M$R9_($UX&{yq3RqDa7_sNn->l|z>aoxgv@ORq?B7L`}z0?%R*CK zsgiB6l5$NvMtxPkt?6Xxv%G2#jt5RLaBWCoUy4&t8sxooh_LGCcenQ#)vW6P$_Ap8 z*sV5)auWc@K`ii0q=UlN$b6Vh>qN^`A>fb-1I~>0W5tQLzv(nG3mKg5=M<_KUKO|# z3g{ZwsJ{4p^OhfOi}(k&DEem&VqN8utnFmL<&#z3cdmJ0QLc|#WO#CzKC+5W!6CxpCWD~FdQDczML-i z!%~`6yT5B;Wg({GDofC|iB|P7H2Y4iAAkLSVk*bP_8k1w)tT{o1=%*1H*{rMK>UUO z3;KR5U75CqU!MQpUmg6b>K-}(lpfoX@sAGiCr{srfysXqR=EopX8h(4|M$)Q_sW7r z^8eT}PXs~F?iQGM3&i|o)lBpN_SArFi|hX3~s+kWn%w{PD|+Kj|I* z>LUJl)SRapU(Kib6Ly3EFRLvW1_9%fGT?P)R2M?)T|Br0pOB-KXbael@PRx-)2}bM z@Kw0NWo>LQB^ey8oq#`gB!zB-aPHohZGC`og((0-!f(n4e_YRF%{!6?KRDJ(-Wg68 zUsEnW&wGub`n(cH;XgPH459l@e{{ttBwhgdsU~HurAcqz+y$>fRvVNsuQCE2eVnGY zqt!M3O6LFe0`T8F3MN;_82EZND0N#d(zfl};6QKHL$`5>kB=u0JHfyV6yuu+{J=*f zf%Xd}q@6Sq3r2-%;9#+0{A;KYdO|d9jN&C%)?7VBYL=;C%Qoy0+G z1Nkt+{R`;*c)iIavXfUwfo^Jg4c>wm06{2JQbZ^<20C< zW!ip!`uWS&ZPwh~N%YC#;-yRw?I4!@=?MqUTynM8pv-Y|TKJj6$NPpdEJ?K+SErRl z$Mm|7{%y;+d5=Y=&U?>>D=-h@;JYvg#$3E!TRV6}nK$fD0YGu3f%x59vUT3T0T7mf z>=P|>dqbVuJX8H|h0B3=^C0#XHQpSHW$D_DUNZk6@rg*D>-x8}iWo2v8+ngWyB8J8K|H#@<0UVs)22@cr69fhf&ZW^OO4d0fxUFZbF}Qz)7}0FCBS%vR&L$0 zZ_6yorqJnjB3N=Hd{zLg{|9U{EptaEPq%WB50_s3#uozu#^&{Y7P%7)DNpNUcZ8tw zi-%6f0u!pe~xF>4twFYO5epxs$W@nGBC-VE=5Q%wxDV3u?ekMKfG@2QQh?&jlK;GWTC}9) zs6`;YERMFmdH8@$MV^JLdMMG*GI$`Jm;Hg&g!@#yoe9{HA85(fIuS_rx5hSs8zDLI zfF{a)Wyk+v@4ExpY}@uxtJLUFHKUW#(qYu*>9$*|Hf@z6sJ&-P7doigN^L^znHVj# zsSyM*YDOehf=Keayzle8Z`-He`@O&azyCxM?)$p0ah}I{9LH(NgaVaVcyyK+s`61f zc^X130(iz%?a5exblV}#eW7hoYx^L!A0BeFQ1HVS<==fOaxb2B%~SN$HGwcAX-_IL zo2TuW7#lgU%r>5Fz`$zWkYzX1{K*PmqZ$D(?_;Pptc0?JUV$+f+~|Y4s@i1y&V`qDzwZEU&o!vdB#Q zX+BNyg^z*wP{_wa`~uPr?==%I^`_i%)z8x{yAW^FnYe)RosN*n2LMf`>&M%xeaRu{ zD5Y)N_rnF4p6L5>g>-FgYKA$+Wx3r!2L24;`g(>Ndbb4vOxH5RHVbGF#W@?_JdHYE z!(L*5*&#{88QNWt-B(c?B3nQ3z*&HeSMnCyML&s#PjOCb-(qma5H&4K;E__@7gF82Y62-ehA((Tt$@Wuwa<3Y{;f zVbt9N!u?qJ?*Fu_f((?0JiX z!2RZ3c-|h}y8Ub#H1{qOPWEbKdL9!u23&nj_Y`bFoxXp4ZG|^M`i*`3kx5j~Q8*T>s zCf+P+ z^^!q%2O#Whf(RWjzcSi<1$oHuOE)xAqRj{DT(}Q;*=+6UK!J%2isSeq874^NlW}xj zD}ZiX&da+TG;5_>?yVy!lQ1iX`sD9h)H>F}(q}p$3PLEN@|hFWIDF985SV=(>DFar zr4!mbPru~dK(3km(oIOtA~#T365?@M%FpL(7lS3VH<}Bvkpoipwwtww%8u$<^UlKu zU|}h`HPx|lurWqhOCY%35-C3F89mjOwq4K5!CZaJ`+Lz}ionlQ4e2W1Tc<9AhqqJm z%oro&-Z4~s(*7&EHP?x132VlAUhA}SeMzRI5luZer)mi)Ye^@!U1}e6+VMTYGws^&DJ4}W=8HVXYH?Sy~Q#W!_m+)3b%F>Dc zgyC{)i~;HUbX19eNsSg%9+O|!+84L8i!>$Nb%?|Dj>g@dnYRa&qf6u!@vo;C9}@dN)fuEsjg zU_{_B!#61l(_*WBlNu}hdXwgkf2S)l_XEYQI%vhnCdvA8I6MYh%~h{NN_6$(yrf_y z&gzpX_O7sKI#PL@qk)*oN0ER>pEVp@-N{Rh@Q{JvNa^Cd)wh5do}HH zOY)VI7hOO2Z#IMn#KK}}ypEmxan|VgG4!txyFh<=&><==>==^B=x#SyJ2B!x-awM- zJ)D_XN^?tH(Cz)Vq~|a3Epfnc56#dC=@`|dd0%i&`i-jIy5?~!dYCu zj#oGy5Yu6rbIf6W$l~H}(Zob02-S&e3> z@F6f+1b0SD~>+f~n`?(dpz zez~Y#3I)fHLX0{J$y;b2%^`n;>6ZDZcB*;(iCnL87EimPEjfwxt^0#s?ErVFlQ z0`TJKhPedaW`ktyvsHE)8CSHjp<_rF6XdlX`|4Z&`flHgPTYrkS( z1mBTIJI*#fQCd^E+;+0f$6(frb7yeWy_#U%4&P99P<-)8e6z44toGeZmraa0P2LH5n*H8}WtD0{YG%wsZOX&TGgO06tjGWO#gko4|e zq@$Ma01hk1d7?OBIyp}bPkXP9srK&qY?lEIBKtYKkV8ODlAj?jyDOp1 zI~od!7EbZIa7SYkrp5lZNpUyb=*gonNrw`>oSWjC0twipSX7Vmyyz1Fdc$k0`9>GX zRdOElN4hR%3Z)h&a?zw*wDEv}EDKSSGC0Pj=<&zsXH|QZWNwTh)NnUp;B~x5Of-;WzPU@-#Y+HlH)?$I^1_(>Y z_3%~kxy7W}FoV8V_S@%=iA3Y`Ga|6v-}e0FEPtA-}2IPoM%S<4_imLG;}0v7^kSEthnzLW)$t(lKb`HT4p{( zb$fjQqZ}n*8e~fA%;kSLy?i9|43mGDzFZZgUF3)8Q|Q$=U7O3G=P8CJt}FVC74S9x zl`q_s8f)`CS#8l>Io~VlghFLwwEAR|ln4B`9k)`bJ1v1uERnrEINk?leIaMfYll4V za}Wfc5s%0D2b@@rb^Q_cQdv0!OiqZVQ*%3m%g<*Pjh+;5oMCow8YPrrM_ol!#*405 zm`u(xM!idQv|?>OVYwx^<4IiR(s!WRVW=so6Jz#k-1~{v z&i~o+SdI3jGu3np&*&OiN?Vu^?jazBua-c+@FT3g&C+-@ zF8sOU7I&iI?CyDbs1`SfJprLXZl8+Xn~bEXjMU8vwgqq8&&22-E{ACPQ1E%NB zYzI<3=I4l5Ne&1|~?y%Iy$L*QW#WKSP~<%=~H*oh=Ou0XG2La%S7EZ(csn z=%g5_^ubKm;aWSr#qT9mWw5jfk5@-w6P^s*LL7^XIMuo&Ulu2=JmB?7!t};&SXM$2 z4df3hPCDzyRkbqOKee11EvU+sVyb)|Hld{_SJ|-!+CrWjnF+;@e9&08^s0W$B~J6A0X zSG-@Z|CW&P`tY}NbE5I`WL@IzThdiwSEJqu(ID=x96(jM+El9ZaH@KE#frCtHEb2p zvHrB02I;opd6v0qoVJ7gCJoZoVR>&IwF>8nO;?U=LACp!IU-F8N7xl_ky^_aNE+s9 zU|pY&HS>srV9)wE^-i{|eREVD)IU}IJYY|ch`p?0?5NzSL*Lzdf2vwWp9wwyp}`Gi zhA|WlvK5EjGH9;2P!SqSH!5n3gr{zH;J?CC;p3sjYv;mlbBx?rhe^C)Va(NYrM`jf8~+JaJl zTofukdqK5QxTUL=^5LGPpP^e9PLV&+$o;wo zVTEiadETPdo`r6gj9mX-TZ@gW&l`=@NwIOTV$|wFubCP@I;N zWI8#ru(7k&%^^+lZoGK$Vw1an_pO#;W$IQp0pKHHC|BdJ+P?9pH2O?(vM+A0bt^;q zwoC+&)Va*Z@iW(sv8uU^oVIqukn)y|++D>s7OmaCBD3%CUKN`^lG@v4?lt*jlwINt zdGSV1vp>Z5JoH#)^{I(!Y4QW8MjX09lBqIG zHHxv?osVzKv)9rbH?K3_P`cWonWcw)qW^Qy(HjlcgqtJ@4eT@wndkOK3K*4apQ zxTJ7(`B|ot5c~cci8D3CiKv6mA|u$(CyQjq&A-2b%GHBSl|-atPv&wvB;aPF2RUd& z<5^*vsPe;X$r9kO>=qX2R~{v%V%Z+?bgf_=qjpk1Pj2?Z_3-!ew9n|K zdu3-_NgqyKx{e(&iks*yN9G&d>+Rw<9z3_&P~_cPoitiBA1~qeWpzgB@|EB%fQfF3 zHgGQVZlC$Fo~+`-Y|Fd?s@f#OVlkz;MAsd+n++78Fh&8;^T9!3t#tvn6yIf8zHBlFf*NnDv6-p;Ksb=rAtwzElhkrXo+(^&_a z5|gk_ff(X~IU_s&kwNv+RJp}-sTaPvhXl?gdG18tXL*Y81GskAc|N6E2~R#j0enF~ zQc23F89FrR92FP1;JYSR0fYV$9u_gExiNYjGi7K9)xcXKLQtxy;P~x_>6AMb$v?0t z`cxExwzFvZ2px}>GTaKf$T(DnG*4LP+NYdZRVd})o>qLib!U8g|J{WOb@EZEv0D3Q zYFesjr`QJqc{Fvik;*4+XWQb5hx8urX}mnCl%jP z(jIgU(NxNr*HXuQ11w1F*d|B`FizW(Lc8D85I_EvT+fxLt9<6H*>(h^%bbUtL&@eU z{qhs=dx#@gS6guaAiQtZ??&GO-jjwk3vYdF^3sD=xC~9L8ou7&j@-`{kmAyITH3Nc z=>2pEaQY<9ckPsBMON*i0|5LL;~zJrT>vmtmV=7p|^I9ASqS3NP;PL&d833;4!hYuT6AK=%@R?6GwJoO=NI zH%J{FKj9zpf7^SwWC17uht%HTLyP1yG)wc4v*t_vNVy`xDj{aVDBVz-oaNg(zDy2edbx+Oj4X#N3+^FaALe%Ltb-8{D! z8z1^BTV9e{4mwr!4)oi{n;rnR4Z}2q&@BRVeW5!o(nVWLxbZrt#U#bkJW6ogi# zX$i!>l7VXO7rv^~m@=KVw;~`dNZsj5d)ycMTRpZGUvjz)_C!hbrtRa96$|nod8p`+ z#m9mJ+gcPZ^&E6Wau-}qA0XFGv=ZPA+KP&v<3^pkA*i+L(g zF%jOT?0n{!E6{3Er7@wM;)NaeNIM;uCX<0X=5x9}x2tN~Jc}kTGK!;P@shOzCMN%T znPOQw%_^`o!&q#K=WAiAmyI1oVONer7q)l%HJa3T6d)WKUh0yS1_#_%2bu2_e}^ zUpZB!*q6#S{&O_A1InD*$0{74h7fwB^St-zCqSMxY6KW{gxLN}D4)!z(H6giHqQjh zIZ=7?^r&PTR zQVPhHWpG6nn9YTj2#ggC#|vvJhlm^@wF*Oo6@Ay$E9F?{TlRGN!#cJSXL|=@y*keV z#^1<;>W=RmW}vM&lB9g;+U3WA>%B*)(~q@am@|tP?D}tTzgHI9wRbod|2v+q5WXkc@Bv1&}jmp@5fKr*(yoFQAb(WZUtu$zetSzk3~ zr`)jQfhLkie&x{JUi&_xk-s6^>_+5rJ9Nvrz{MURM9g!opHx7G)E*xBq3SF&Mz7_d z|0TI*;k{eU(%naO^!2V@`+8*?^feo>w!Pb3ig`^MD;+VK`PVW)D@)B%g9dR4m*C-4 zkt6R-dSg2y1>{D6Y4^@(>*7(E`Fd}f&~$!W$&Px%bZ3GLDK&FZ4ZU#HCEl^xij$wT%lf6Wo*}Wv*C%Trw1QgodJR*ZL9~f%w8vlQf_e7AU4KiU9@X@IkJZk?-4?S6(oJzjUV>GH%bC`ay5s{y)(c1Hqyy+_BbYhq>*cF#H2)%=56J0nQCU(GJ7#J0ABOLoJgL|QD5O_qa(K-RFCxZ zxbYq{!(BC#JX1AGRa)Mh9y>RkMe4IRR~SAmub36dwpC?N)oRkTZcnKWaa69%T(I!7 z+7058RA4pB+tDfZ&I-66^HFCnx?$Nio%P)kcTTD&Cq2iwzL-ELdKf2e|AKBD9GcqY@-5i5sRE-C+px63 zszdb=kTyjM9Tz?_<+2=HE6u(0OJ-`B`PNxp0@*n{pc_}^DyNmiurB)YSVf~?q-hf5 zLFF0WUFQ|f9r2e;Hxqum*uU1#U%yk~WxXGfm)I<$6CDc^s-zp2HzicG^&Z+0SG(Tz zL?wXXK_I!Tdk483^?0fkDy9?B z(Rp48>_dUyJRHqQfQWIplfn7$kD%z!$=`1MuXNW1MLOy^>($izEVV!+<0!s1GudgF zXWr>USmc70{CX?D>=7zLfK2&H#0tm56MhYWOdRn(-Mh`>IBui10x*r-QpCAVY;sqI z-uJa(aGJ`K*OLu^EXNIg681~+_7|2>>MH=Xb02Vcy4eGTt(e1H;L_>DecF;c z$~2>H3DCtYIasBD8-;;;2(WtdK|3mg=j_~Huq)1re~tSu7yFNwDxVGr(U|88GI58} z(5=w1_!t7y(144W|MVU3#rp>>cNQH^IQ(r0f0~E?c=yJ2TF`oFCFfD+uYZ%@Dp*x7`pvxwnE`rV7Uu1A^?xx6cfoXOasD}K{U1gb23W^^8?BGVe*gYY z3*tQZ?7d5O{^P#=Pu|oG!(9#H_V-H1|Kd3u0iQk3pa1*e{Au7m<^ejjo4u;K@{v3W-0v0 zf3~Xn@vXmooAWsM?Eg*M|C_e|U(+^KquTt^Z>HDvYnB7KG18NL+Gjy|c{q5__1R;W z#QrMz|G7_1vfRIa2QvuGZ&}DP0WNbaL{o+#pJrM^mZG}!+#K2V@@-Na8T$?omy<5A z6NuN_i!}Q6JV-sUS7ejCs!lzDH+v%}M|}R{BtL0V&(K&1pB*XP8*-3F8~;dug4B6a z>S~z$+IgpcYZw|CbGG_Fr6}ITqo)5$1)3&TMNUAo`2O zxPIPKQZKP)Hs47BmWw~YJ;1;&H*5lw+U-N}RL*Es@{!q-{=Ar2d7Lz!*a z)ILPBE9qUD0|iId=Nak<*~L8*@rn~~UPurECzKNatL>$Rt`kfI@s|-8btKJypQDmxj zISq%Z=oa*uSM|jX7&h5IweVWV2pn0Gb)A;sp5F!zn@beZ@)~r|siz)RM=;Jattu{a zLVr-{*5&6zmDp$xp{ze(w*L5WOn)B4f9}bEZ>%%5XQBZR6k1a2E6iKl^!?)>*Bsg$ z#Lr#j+8lf)HBKqS)giCFJhEJv4&;U&z^TBbiIEN3H``ghgmQv*yypOvNa&>d;lW0b zG&ip8%t%BH?-fqexsxU8fqe(EEDE8c1Qbgy@m+G(`BbAM&iuP8`Sk^w;I+!aXgSKhBe?^yA+XO`?l_tZ)H_Dj@jK)-WKtxdQ!a8 zDWl%#A;sZwQw%sWoUi+-;QP}_{O9@M{2jopGztOpYqj)<(Cb;L#N+|$Cx4|)0S75D z6PycGt~6ufU8W{U!C`4mnR>MxI1Cu%-2T$#YBc%83?TnlZJ-fn6$7kdtCYxJonZfd zR0e;f1MED(!Z&?Ib1Uv;unA(<7vc#}_L~~{pyH((3#@#@G!1~qi)mMT<4Bo378pYo zgCe3y&TXE-a_o5z&~IbcBvRMz0r1@~_ZX9FH+{c=aT+iFa!TXoggs!O;Q5 zW*{Q9u zXNN3LRw@-#JnU;;L>4*$`d6`Lg0#`wQ=0kSYqP2Y?>)=poyJX_%4}DTIf1UMHugw( zU5bQaX0eIvsLesN;Qtm(M;{74AV6ct=%usDyEFJ`r2+RXrsnhg5V4D)pz$y zU&)A2H%Vx0R|-|(j^={@e9s3*_LZez66lAFy39dtfCtXTRh6$H5tI~=j!WlPjDwWb zt;rGrlWkQdONt#4H27+570G&+x}K%HvKHH7h#k(0RV0qColh{Vq1hVqq<&L!rCr?BGzsBh3M2^|MlJ>2U<7% zM9D{KV_wryJLjo>3)T=C$c67#36w9~9-UIikuk(J0ME$Nd4&YXz1;0|zLY$?_q z_6ao6b&z;!bFfe7e+!rZo%R49O-hM_ePc^);B^BX$<{7s*PT~$T*mBs_l&XlVKUN) ztBw|`@A`ZaXZMul8Nf;rR5C-#c|W8?AkRU(rUyJL*{6*{Sl0~zfD;s`l>^FcaDu*I zBhJ!)g#Vc+Ovn7P{)*1_sQ=IPA>m(^Bb5;4BaZi}c#y)zey*v=L6 z_ho6c@LM^VDGlbcBg7A{TK?eBj?&yxiJw1Kfx5$*Z?yJ6+Ox})gm2>Tv!o1~IDVo6 z1;ySy!%@mBl^g*w4@dgjV#RPM#O9k9{xqhHZ7-FVE2oQ-h}hRoB&Zw=v=nTj9S9SXn_l@2mem0&XKwj zh0V=_c{DvS)EwGA#+}a|f@a}W-t4(NSvv;0{=6^?94iaBvEBk9y#OsH$2blq7agrw zu~DvR!ud=-nZvHM2wv=@h2_uh9I`eLdkPBpGC$w)HT13CVl@&$Am2ZnJzy&&ICMuo@VBW4C)bhbH%c3789VdM z2?d}&o1=Gjzq?E1R19;-l8m=yyWopJtVPK;c85^`Z|q)<{&RCHCwt2`<-$u~G}xyV z*MUA^gE_%_u~oRh0|`v_j2X&eF66O0GW0vQobbYHnMgC zc=T)DsVL%xn-QR1&q2K}yxmv?IFtc>`}t96r*Q?o^LHyP5P%?j547^|YGBw?;2N7h zciv~cX7W+*6VR{waf1_70?5ZxUXapWh!Y0Jy`}>*x8UhB=~2y(^X5`K11b|8CLhLH zL+CeBe72p=H#iCC0vqM`XGl}q4sXUFs6P`-A)DYynCp}~($qSta^ZGbFfKS$e4UA% zZ~NUshFq@tZ;xl8*D6$6n>$((0&4&S9+|rO;(&npv5MEU0r*e$H`duTbMNFlhn`8d zGhp;u@WJ{^SB`TmZFdbg@CDpRiyK>MO2nb1FFp{*<5TI(ZHJ0Jkja3H4 zPR|A_1~Z7)gePI8Wg7Yw0$B;hPL%GJhF;htyT2O%{bfN5GoGbYT!9H>k*C;iYxTXx z();J9VI3*T=))4`iACjfV}LhLAQ_h_xS4li$QTQ1^J0I_Tl^)4xlostld<<}n6UE8 zL(>j}9dS3i{aZN#I3@S5DLMD3_^x%z)J}phYpGwiCY%(`#y1<=twiGQKn_tC*6P zKZebJp6xm=42O2Qa!Tz6Mwsfk=!Fj|sONrWtgpb1Cg4kMXU@iz&$Taz;}u)lq9K} z9!qy>Fffaui`@#CaLhPx{<>sX5wd0U3~MT6-LN)hr5xL|Y?oz_)a>x(uG*y1`L%enMoc-{br+w9Bi2g+jxq$2e zhy?j76N)A?>3)}=u?1nOV8f+iezh!*nVM2#F_K^Nbq8V3H;RjEo1VXZB2<|KG85VQ zQ1a``EdHN>eGcLCL8?uiueJ5Z)0{9GFA#e+x$d58N=1!c+&Vrtj*i`k>OpV?L*P^MISETi{HkFa-12Uq9bJS%rH|xC@SwI zqx5>+7Z-u=-D`_ya!%xBPlS7)*UM5v^R0>`=c#Askv&yFRD+52tU20ah#D}oI9MW) zWJrer%V4+yHm!=sl`AwyLFO!2La6iCWws+}pFApTFddI?lFv%pYMARxN|;tavxL~Q zKPqe0nU{T7%<=Dx@2{UkhUqw{E4?3SSb~@&^hF=4;+wSBG}TOYJl$+>e~CvbMw?}x zab{>(yRBqV*$cnZ+i&A5b_8Z<#e`5MEnTGU@h!&a4aU)Z7L7NN7vX(lIs^1+#WU@( zObI1*PQ!1c&iIuJT&+}%vyV0RF!H+AX_O0ucP-ASi;iE{@6R|dtJ3b{>U>LCt}$v# zN%0;uG63x=?`O4_lh*~aNKlsfU5XuwvdOlv?l4uDw7VTnI5Pkvx+Qsqt0-@vC`iwH z_{p@+$Gv7cQhsR`#Iu0Y$+aaVHjy{sS^NeFiIHZWN#t(~4SbScd2gLG8gm=7lRDE8-pYzT@7|O9d zK31YUzHJwF*uQr)4|E7CwJ)q1p{zt9m=a!mC+B1(7hk7rUXOkKE~WtX))5UK zGxyyX!0!mi-R}&|IfLI#-kqpKvBDwXck5VW#X1tNKC0MQ)nCZ3Bj85AU@^mhE9;?+jN0Ee&gkygs0dQx>Wj!j@+|9)5tXMl{7iY3)?OGu* zLDrkXm`JG7hxaPR0%{bobX~lH>&5C48<*W>vMta+5HFxtGF{`r7W?9^)m)bV;hQ>j zUBcRBApch1g^S!_S#S`{76577Wc4fy()3e&`}&i)l(oXa0@TnT)P!7KbXSR660%hv z9J++227IYVg>-4l&h#skWp-3whmha47uU3}=R4MH91g6#FvQiJNJkAT9o>CWQpQD4E_p2mt3M=3ATHK{XM4Du%Sr4@er%YuLHUW1Oy1g#pK-t*} zXnV;nFoOEjA{dMHa=#I;;Qa=R4y=zla~se)P(@au@*dTlo2%-1lY{O+&*v#cPIzT^ z(@k@wWpR}C@EJU{%UZmn^qaMs$(&YFK`4oMG~nZFKxiL|KCL^7;8S-1nzI0{b#O@D z=}xZG=!4Q*1InIK5#LKn8nzFS=qS(b!3hki<2aaw!6b{AC#7|0m`r2}_9DL2c;d>X zm(fEYg*65-PWnKjHJd!Vf7lRUI}r-5iMaQK4P=SK$XuU8MGcd{E~d8IvcpT`)>#lw zwgG64gOJY0NYYhWZBgbfF#5|2;3%Ox)?7TgZ|)tr;BDpw`s&5gdrYtLOk;7a#st32 zJ%8%kabieg@tF$(oMDh5)dIrdG0w z+$jj$qt~TOrQ;qdn7zK;qcdJuM~NTvK|z%&1p*-~MU1MQE0Dmumq!y@>j0_Igw-ge&A^e^OwK->>dvG^mXQul+^%@g&0o{V2pe>qY;k%9#%H-Cl&@l>G zB9P)*3F~s&mN`X%lQwXW!QK$M1s4tJm)pc{g}!A3wPJYLz7ms-uRth57he(#W%@Vu z9lyVw4>ZY!GAv8!c>^X%neoS~RK<^7T-$#02&wNnpsr0h8sDh49J{yZqnmmPTGJz<%=4e&RaHeL$D3kwdj%Cq%MlHfD>}VehG}AE6 zg*?%aiJUydu(a__XSwY;3htj!6SX~b2OWvn`CJeeJb~;ksdRgXBb(L(JQT#pfD`w zxo|hDdcXWSuC?;fJ+iH^oekz)0R`Q8B?1KVFES?wrAAtUD0}jEqo^CX(6zbF5>^TR z`_s*Vi5Nt|vyn*0K7>;&6@NjQ?rC|7%VLg_JUJ*K1hgB=k-pa)dtTT2r63uG2sASU zaI$H4he75(qLp}%Xlx2~YEIf`-B;^x>x85(~db$A` z)G1c#nPmh{sU3^%+{B1xZ|G`c1wCHff%|y}Gfu?}6l@__)6dcSSY>}Z^>giMcZN8x zvx>CKEA^Ss;@{l zN3$1Rm1~LlZPBNv!xB4D=TcaPAd#wCNZnT?$;Xc7%LSE+2_dDaXLlbCXAgd)kU~TR z=+pM4-qRuWX|3tHiS&?W6P&*D(iq}N0Bs$GAp)E)-EGkh*w&R{T31w>2d#cCks7UU zrhv$?A*ac6SD2P>Rm}C6<2l`QpwIe#2q&civ-ENQ?Nt*(jSvwRKr}(W>so2KF8GNe zJ|uXSB?RdaH>P^4t|q{{f-h#Kt>-F9OK#ylsjNmKV(P;1ScRO{0$eh`;z9>$y=(Cd zzJ3qKiCT0jd6TG2UC_3|lez=9UL^SwWUaW^k|?X~62r#>chZ${FC-|+DYpa-o|+ul z=&G3vOc(|3!X9XU#0rq8b-M+xi^J0YxCOeomSmRnddF5p(r=NSvhE`b&fxWmtKSNw z*w$QoeUv8oMi}&O_2=E{!uK<;yiDg3qfYPlEnMvToT)sHLPSpr)RvyTqx7Z$cVLCH z@+KHpn&5QfiMQHH?4dBgOBb2Q?a~A)?^Pm&Lc*csxS6|ic6(TB#;v5E+bpPF^l}4E zH{s!RQtJiIvel`Rp8=No0Z94@7J%=Zd0I-(oPunpC?Wzu*fZ}e`qCFib_aEe5ygd% zZ|`Ou`-*K7MT(2lQPi|k=lgA6Fr zrW_FRMMH)^7k(yxIQlKU!CJB1#1VcnzwC2Fn9GUh*Q)onVPuQj^i|tY zrFnimz04f|wB9>7>WruQk~hxXDSU|w5m}oRh(Go{-o8+CH zK|vuEASm59ds<~1I1>m%^_xCg_-{zvB+9(l=Okc}<6SZv@OE}hOYe}MwgIn+aXExpTu8#`jwTGxyIm6l!72!8E^5Gcn#V+{b*YY`Rsd(Ha* zFMaxe0Wi6+Ys8LJQtJZ{g|&PK6mR7uU#|D0QZCcZ0(*>;atawx){7VY>limU*qW01 zg4-@pXCwk20=gb^UYX-q^GGT5UZ<%FRhb%al3z|K-}wlum|_0kacfof7i=_6w(h>20-h6Pn{zOo_X~0IAVG}A35|<)7>g8-T(3U^3bS`#(!WkOa z(Z;tiGiYnJfwAJN?T__6uv*El`4df;uFbvD8q#6soIF&^MxL&%zLpJ1m?4Y8f~P|ApF$T@ZygL1!|=)ysRv)>&xhfmuesPTVo5X z$|5cqiNq>8_dJpA=)8yvKkJmDzzjRui7InSnU>0CE6b4ni6#B-3g#6{Onf|Mf z+NFKL3w>Fr3o?((+g>SCdc`X(Ex!#qR&71tQw~V1BP`~Li)}mRfj)la)#{@=;~QqL zWZ}TVy+tVrpMy?x$X>fDOYbiXe5s=JgWx+>_s>E4U`d_HiYNeV-v!B_rksYCGa0u_ z6JGLZ-0Ly6fn-V`lYp}GHcJ4c=<+b;Jllyod&4}?z;R&LddE5r!n>$oY)0gao|WAv z59vS6j^lM9%OJMgy-p)GznD$BsEUi|ny6x~hbcJhf?6Lnv)=R;NbB9sNm#$~i}389 zmDEdi^vmP{iKuwr)46=DRIlW#?oSe#{(R_>qQM`W>bSwGff&zRWMEXpCZlz$7g()({?%9JuWy8+GE?GfYz8(u5wO}_$m`gt=$KEMlBb4@z0 zma>i6i?O5N0WqHzs5P_Dg_c;<@oPh%fZtLmW(mL@^y3yg+f@|k8v0J6n^)8GoS|BJ;99G^b4{0x~)^Myl zq(A|twSCUxqGfi-a*%V>S>L~ZLc!2J*1EuhX&q<7d&+<9-C3)_O7vqcBuM}qV3g&?ah0B8KHsE zz@&+>l1f7Xwa}fS72%ZrPFxk1fWnre9HR_6%l%6D?96HJ8@)VoeiZTj6Vm+@b66fy zHU4caI1z^)p@s`@CuuaEMZlqeC~D^_b&C z+m0CuCH)rEprPC1287N)`N%7O4wM4ROP8iMc_Mi=peyca0e=89l4vSL#V&6(ClnXQ zgof_czX+eFqe!XP9q+Y}&cPBx3156ec)od^&t&=LlU-jPrU9v1&sUTAax5>E*Ta?X zxOw3xh5$=`&wRAFuH4Xfw0ewOsh~ilsXVI6l9+u9H}onTLO|v~d+i10i{AoAy4+4e zsJcWMAQfzBJSY&u7q|cg($eeekTMg;s$r)W%813C#bjSoX_99^*Q0_w`nA~W^0d(| zs#~_bql=*4e$sa)CU96+TWLX_^NM2h)j$wYnQ#*YE!1MPmi8AI&Q5HFRQLL~zH`k@ za7YOuU`Hy5-P*Ifca^t34utYp+| zXOg{j+dFsKo;&r^^Dv{{+Og{5-o{!0Da>C2M*HtLwCbYFv*TYBM zJqJbJc`L%RF>h(j`==8BiZxiSs?g%ZTLcpd%ccA(i{UTQM2;IZRkm=<2nH?#^8+KM z*z<|VG=fwiXz(O>B&W~{&EYvuyy1G%=ll_hf|o?^kx_-er$<5cR;=G;p85|7Yo#+5 zH|J}lv(DcBFQ~tqH%1!6$KR4VTk($44*59-Mmvuz(g7}fYz4fI>lu)O~;1qN*j<-xN-| zUozLxiS&;JO^eYjvzW*HKbS`Uj3emWr@J4-%_AlJgIMaH6ZP*GFQNhBizhkisQ>Y5 z{{6<)Qy{+jnk~Ek*Jp4&Smjz6;u+|{4PlUJI{Qn8@cjg508xI^>|9p$7i$PDerokZ z<&Vy0{}{k;DnKbHO%YX2P-tz0{PAs~y6VcGC*hwDCb)L*ynG6v1Ja`z)&?72=OjI< zk2&sY*Yy*V@*h{baH_~|K+Sh6BQSo&^^a;rIT-g(cm6dcsGS1ej<+ueATw^s!=FYS zqcQ(Hk;wkjr$GAV#;wEY*O--J{9yJEy2%B~xvE_x>)&H36c@zmC$?4tc%fOEc$11h zXcUI`SpOt+{bexze5qo*_Z*X#v7)&6;a~peZ(a(;feCg0g2S)W&wpRXzka$Q1|H|b zjmpY9KV9d)-v8m+X@c(qlKR`$qW>(o_{Ud;3II($YhZfn?tiha-T=#O?Nd!2|HT!Q z9stLXLDY*Ee;(Msx%q!x`VBDq6yo;%#ku&`?|;0dKfnJ?4XoDx8{Ge|!PPl69Qmfy ze{g%C+;(mIkGdIngo)8W@eIobzvRz81HYTm(f7f;TV8M)scItNP)|x zU*@3L?}&$^|LdAKRILJv*0_<1Zg!Dx*f#hcrZbmcI~lS&$}M@y7onN@1|AsnF=?l= z{q6w%W!?nSaf`gB#cTR{pgy~cv0J_CDss^mg&0c&W%&CNhnAtJrf3)Lds#xS%IWw3 zLlE@gGzI~EA3^Z>R3k?vVjlFH*)<)#13J4k={k`y{iF&Ksqn_tmk)`6YHfs3+BB=&j~}b?+^R=ayJMi(5vg*krfXt` z<@o~zhTV%*h9JiW&Utp{ku5BAIm~CwYrl^3Y(y4<2vTArB||S#?3p{@ep>FD#kRc@ zvkzrLTkf{Q*_R;WRNM`SJ?$-mp8NnK+?^S;mfyyrRRKKHqAQ#^zBbA;n~)6b`tQ~(QCc0}Br_gSwQ1cDQr8U}&@1;t0e zbYS21WD_7WDi7_@^#@7XQEnCRu&OFb2LSn~=X5#uA+8@^@Xl{|Ym|39T=*c+91}qt#ky=;!fYn$+e3h?R3A@nL zUcg~@2Gm7Vf7{!35J)V(VUb4Bw!vALjR9S@dU5Y!EOcq`F{6l0J`hxWjt%jYt=|LU zlRCie#}-V2$@_SAXyXw8mEo;=1J_3ufWmt}1g9fQ2KTjEuyAb6Db>qVPczw}i-~$D z6`a}EyzE;6cZ=6_z056`VO%>%R7*Zl<5X$C^Is>FzR4#~5!VTcc?5ZJs>8-<&%#w6 zS1U&?)J*Ifis#%J$`;ggU8%{} zt9x}&2k!bx{s%Zk2>l1uyr9=JkYi~6CP9$%lZI0g0d1GT0N6pQgA2rn`iZ+fC1;G( z-o456rqsxc_^{{T47N|UcAn9=r=!l*7uai*n0ldqdRzbaT_$Pd2wvGGl&rcNH4I!c zq+GMm8HYZ{<-B<3xTnF^FfGV02U*;3 zqN?!egeT&{n6C8+?CB~1FozEFWsRAwg$^SBSTGAsgD5t5Y*lVv7d- za-mXU3Wl#E@Rda%f?Ejgy23igPT2tB3F60Of{LXfqQYtVB(gwWWf~@HXdh;SGKYBq zR(45;;S>2;J!IVczEeD-AtuACM~R2NLyNfr4Km-oMTx}O%+4MwsB*o)gFsI={!hAv zL4fTzJh3>pdB$7Hl=`d>^V5r6u5TEaeb6;NTAxkikM~FyzSS-oU`NsCeB3^1BS^{1 zV?gNy=JT)Hf@1Y(AG84=+aq1a;J?Z4cP+DO7K< zpjWg%d&ZcHD2~H*xw4w&;@f zPvx^=+nD5N=awU=Fv|a*d1F8FrR3z_p1X7yM}=sub$N0}#i)1#0IwhLRYfr}9Ddc? z_Mt5sh+1cA!(Ry;J8_=u7&ISj8h4nEXgw>(qk+gQ@`=GbL2&Aww_A;9m(6yvP&fc5 z0BiO-U51?vAqmBX>vk|f0S(9fd?5SEKSFC*w);-W+W{2XQu%Kfr^7VQRx#c1cF(sG zK|6&+@feC37#CdyY#T;8ly+GIH%_&3ALvm6)a9++4t~>kL&31bW_BT%thuG1|43G6 zb~6*6AVzB7He@DcAqpT&{e`88khgE_#cNbt4DrV?XurRTH!9 zxsniG2YB=hA2+i$WxR)G2wqKoe_ITUfWNM8ENUA&zoA00bZial#N=_C!PB_n z#ew&o{=LUrb5L6#$EU*AonSdoRStuqJi3+tqR;amAwm99SZR}GxPkg<*cBH1c?PrA zAzwN?xA0|~%kkLdm7c6hF~B<3++h(@45K%qhL%2-)ACohEe77mtnv5D-*ieJO8_#k zk-b^XH7}rPAanzNoS1?!mj6AV?^{z}dB`VuwYyE@#JP0uoj7#bqtd6{K(@b_n@7&A zdqVzbw|lh)sNrsvbigW!l)qMm(r>=cLx3UVm~w;G=t{1&)scfqq`}Ai!BD9JCmwNw zdi(Y$RFwyLOmX$lOh?=zvgipc6}$`95WR-544DBJ@}qe z0Pm-N&)N!vvS;QG#^Mzd1YNyxC*=r6Loh?JJeK z@Pf}}P9G)X2L#TSrlf224er#46{`KY8v1)m9&nj0%sF!LuA$~*xVEEQwcrL+FetWl zKQ>A!$GY89tDzkqRp2C~U)63VRWYe=CFOvrF-6|dUm|ePmA|+e7_hPHMm5m13eqKA zpo)o3379%4iHVu4Ioh{2t_GxZp6iu;Sf1+;&q*nPbR zC5}MM$6*&ID#=cr{Wt~fVIG;IU)cd{87ypvi?->T)+sofe1W8OEWd^3*$YQt1jd^d z3#P{ogbkemynIXG#1}N^?2@d{bQ+HlmK?*Yv3Q}MbQo_Q^>_v2^>{rHQ~!{fVwCnI zZSblI_I94h>Z@g=>XRuZbl>hpeY~1{N&eFo$}0lZAhK%H(Yyi?8H%K+Z1zhsFHCO} zHJ^bBU!0O$eVr5AL`ShETEDdO@wm866qbVMdz@a~YDLrKvQTRIgkaZof)Hm19`(T3 z$1DrS7d&N#{=&290cnd}A*L%fj=H9~Bb5U@w7MoNbp3j3hZuiP ztVd5#+sb@ZzTIaauG2_xpK|Fi;eM{{e?u~a__k20UI+va z3rt;AR;p^n?w4pB1fnYpXP?^vx#pY{d=U=3)eDnV*24KT2LrbIk7O>>oOOLg%mrq^ z=7}%3dI32x`QX`si8f6;?K685Z63Lr2NYZJV(FzCTPPrzVDF~6Xk^2mQXSG^kIML* z{swp^I72PfJZ9g*+^RLR2FRYGE99_@_v!{EElJ6NJEaRS)gASEu}@8@swN*i17)V} zV$JfCF=U~22 z1n*b%@jf&drsbvC>c9B0Ds#ycnj|uW7M&iOrzu#Ud(3GXO&%v&4|7eA9uWDg+Ue*f zt382PNa~9m94u=y=#*D?{$$FO6~N6gC*Ig*nIp$!jmIry*7$aL$Dw_UBDyR(fpuT5NKPU$>15g|~I)qnRrmQP*Qs&r#^n@@kFP^|r03z3TPL5g%>qgz4mK z22QI)+f;jQ+u-ej7T3h#HCm`o4s_^A0R+f%4R&`QpjDko>wPu)j>BB6e z(Ul&q&8@4Php(;NYBgN$LYdC|8?yd;8F>4t%*+J>!)aJq&L;De-PiqgOtpJ02UahO zuFY-+D?Gg#xQ<*3D&w7nwb@tSIfGc2;>k3l7`BtF(WG>5KatdT!?O68U*JCGiU3JT zG?F(nZlJ@{@#C0UZz8OqCX^5XToJ&Rdk8y{g7Kw&U%w z*({xY>_~_?igIeCxa_-xsE(}OgCnQK8DO=c<0jNjjSek(INTTI14pXIDhA>@rv56zq$Ui`V- zZ(cg?l^0*~iuqMgCe*r(>S6E$uTU!Xj_#{HC(hE)JLAlA0ZIj|E@OInITp(zeeVE% zoe9gm?$zdP$X5cN`Ll##-ZhZt13|arKSy- zJKgk79>_;t<8Hg!%BJ)^^y!6prlu0PKAj1O35a#8*uYgv#5n%OD4?H5Kh zr075=Tjea7|3M0-*BR*KZY$m{?zg`G4>>Opkax!$}KOxLJ+MG;ECpEpI`%qXvw)#=t~Hu1m#@khCFWdToZI~+y=#4hDZI6_w3Gq)(h}i{T2WJ=eDUUuYam+eiZ9@* zPN#&ll<97WU8#j!Qt<5dI-7k#bcy~|t;6{4>C;uKN>(fO$<`mY1U}97z!^a;7z1j- z;iaP!kcZEn%wSyrU%_c&ifn$kSieFlktW0MXA1zpQ>3B(5Z^^YwB{$Rh>tVSTQH+n ze{0Q!trH0f3qU(;7>N+aEWt3kHRn5dt8-kJ%$zuQd)*darWWis;d@m% zCp}yBJQgCC$c@ka_@Ena0`AvQAZy-Um1|Ov8xc{R&}h92p^zY9=jXl?R&m`+!jtnNF#@&D;g`Zs;~|0;SUd#FvUq){ zAA<$oNdi_^^`}l4YM-R#n%kL8rq4xrp-iC){?ARmg$$K{18rxXVa$i4*hnpmfQ-hw z;%0HRMW1Ad#A3DKXOrhXIw|+#_zNs2+4a*(=!M1mQsAdKHY+^}A#QUXt52$fH+N9X zmaV~U2dIDo?6#5pP{lXl(!1kd>%>-2H+!Mm)EqG<^ z-%A4KH{bEQimmGcASK-*8kA+`nTV!ys8m)M9z;7E* zL8>C??6la0eA&*u1QY!vYo2a{s^XLlvjRASFy3OH;(}r00k84SUW>aR*TEn4y=5r8?Yg&rYda(BKa{5!Ia2pwZc}K#4Bx#RtaNp;=1CS zLrY@3<&@nyvPdvxtq8(0A>?b4_$++@tG;k2-*S9^mDTh$?4!Dk=~f%Q(WIMAF-0|S zSsogPLa2igVORargW?H-u>@gT{#4=v+s?Frqu6(Bgh?V@cVG%5oX@KWzE&tpqg&f& zuj(i+IA=6ISLYbqizxINPmw2kit()K2=|>RGao#71^I-Z{$b~ceIO5naaf5*?V|bk znTYPZhGgq*PD)aLFY?cS%;%Z129zD6J&*lZBT;6xY06joGk~trZ>Qt@6^EUyxOo>g zp5J~$-A=G_eAvS`KyMe?CaDrfcE3|PUkS228lH`4k&8dHeMMYSOyrGt(?O|!UAeX| zwqybW|doepj&AG9>Cnjc;23Xg? zp|u2AEw2SVRFlB36;HP2SeB@VI=a^Pa~rab1zkT$=Dv&5-@QdrS86kKiH76oDz=J$ zsu;%b6?#umfTNi9FrX_%Ua2yBvsg7=u$uzNCkge9r_}B*D8apw8?wYVUmOc>is%A& z@5P)(CJA>n;LChTY_>Q$5~b?paIJQ#l}`Hgp_srynO>rp>%GL}8t46Y>|M*gGe`0E zB8c)2ZwtjgKvzj5ww$xz3fv28y{gjXREk7my6SK_N%lywfDYJ*t$rKd8kpV4N2hyc z`%-Q>=Ta3}yyT?64D!vQ)_t~OjL2u-G!WFNTn-)wi8(Uwbh#}Qk+rtnB~>BY;tMGZ z{qMQC0YMx;p+VtiN!bCe@7q-uM4g9g7Q^O}l3f|9f_ZmrrOCxcTsQ>KCB!MT+y)k< zhwIqY9my`b_SK>bYcCq85Nj+T9;gm^OhYlHaKF#js{oc!EQ z^DSQWqKsxw`{ks?Tih1;>cOi6F*}G_7(*48er_UCf@$9iguDVDq_9_8I-~UGfuRC3 zI+%cjS~u2t@0@lM;2+!GSzD4e52@+XXJK|Icn0!*Gb+{j!&5HHQ+C(2vdgBL6B&;FB!bT=R%{xc0wS?sMIMV03<~zdn#HOlh1T$7n`52*IvnSV2%dlm3 zzGtSn2a}mqSrM)dZH?wBnnviy?xY395ms5QtIuePeOv7(|K5pM3=j^V;3KKq z76VcfF|9n6z)XA*63mLBbn+S=-}@9$5AYN(`*)upCtQTW^>c?NrOB@d8zQ1Sz-oefn%sf(>IJAqh9(zIe4@m2icUT zj#6CYvheFyXX$WwMO-U{mlY)TtVZKt6$&cd4+}TpXo7vm~{gjiR)Bv~Ber8#FqbgZ$ea4Fl)Ec%IXojzr3s&mq; zfLsgRRh=#=)-WCY?N~s2jXz>4Fxmr+?!%|LH)owzySr1_2NMudq+?76ZVU63`k28R z;>S)Im|pA!PThfvo!ibIRz3X)eP&$j_CVs%kyPUq%BEtzsAR_U5_CqdE( zulLgA@Af4)2Bdc`{;~CM2iGm;QGTXa?w>6&6^a$Di})sQ_B*!lg{SVq*kg_v+#w_r zbo%_>UU~^H6_qd7wf(aa{0!&XRedhcE+H?T5RA}bA?&*AdJ;tiTW^z3)UkG&xyxb& z>+A0FE_@6?Oc5Dx#~wgbTzuHlugo&D zrQ10Thdnf;K(V``qmK?tCExfCxTvf}(k`bG>upDkoB_~Wq*!ycUGlz_R)MLvuvfC! z5mNonH%u{&9j;}`{#%0nM-S(>BX#`DU3i8~nI4>YR`Q&eiV933oY;IrQr%!n#Y=Rg5LvgL~+ker`Jxh zl78T({h5ZR;@Za1WTq{6 z?nz6cOBS=^ro6EN>!P0vB}x_9 zX^?h3^+GM~%8_yvahC7@}ALj*9w_U)D`)8^l?t3f+~O2*f;Nb(f&QUvnpq1``_;Cj<#4RFfnu-S4R2 zSX)H2vEt@$+Y&@n??qm{C^G8pJa+G;&1k7Td}*{&+v=McBZqpFq2-liT~r>W$54`T zAPQFLR!omZr9**M?-c~_#3L9--TFu9-jo=~8I1vR+|T$9Psi5b!~|pOv|K-4y1El* zbU;5STetAeK(-NgmR8=o!9kr&!>p3N3|%=MkfcNc%92GZpsn)KOC1=3eyddh;TQN z06Q_Po-8A~I{Mgnr(>V_U~rO*0DVLOE?&rLph(u4I8bBcs{?APguVYy}clMN$x)T+F;opygESyAP^({*p*si&=z6^*@1Iu+P5z& zhLt0|Hp6AzhBegWjiD^K%9VYwXFs{l59Qv#tdVVT1CCdQsrjn%iHh=IaoDdJ2HlBD z6m@3T66(h$jzROYSHJQkH+pXj(b-WO5KdIQ`CB3Qdn}WIoEa>89B4C`FC`lzL}O5D zO+C`g07cO}>=H)ZF5j)x*Z^V`&>il@OGbAie9 zN!==o@C)K@_fZ~L+r0*&uRuA4`{m1*iiJFe>gjJK4w@bb5bZP1_s$LoirYJ>04qA_ z=E_ydh)eRXnt;1ie4?COu0CiuW&*E{oa4^-a>BhvhQ&ZNsAFFx{-z>|uik}%D>&=s z5Hfxb)|1kR^0l^SBt`t&Kz-YlWLY~HM*QVJVnl)7NsBEeOhMe`pwjU|5Fmc6G)L4w)@>qXPH?<5!t!GBWM*+yX3D6ai z;x#_(>%bZef_?3Wvvogpo?9XU1I7_{qm|etDbKA8plxCdW|Yqj6vQHjt2~C4Y@U%FR5hOc*A#7DI0H=m!h~nX*9A7ui*A3mefp!Or2a<0 zTf3pxHDHZ5;$fNAMoZMm@Gyw!x7Qwb(!>(o@m>pHJn-GfOrI*Bg{uNX93{HzTK7?2 zt3LCn>R{Vu!Oall(vV+Jre@qC&NMj&Oslr+l1aCWLeZ0MM{f|u(3oB)*}__(UD(4q z&qR7kzy6k}mqvQQQizy{2T2xY|9oj-iYElumYGO9xlWn-n@5W)OaBg`y`T;Na8+wC z%iH`M%dY(QBe)Gwa)0*F_fZ$?-gxk;Z8hEfeD8@5%_&33fEHl9VG7WWf-ck7i)#zu z+=!{zUO3TaB?VeVV2kOSJn2*dsq`}6)X{9;W)A3;pK7jA2NFD2&b4TVSu15q;Ycy{XUVeZ@gO^x_m7w zDEn;td2^mMHPg(WCFjqlfqQCULqv&f_U3n8%q3IBsqs4Jps`24$1>{21ci{p@shdI z0>^IoG9~)WTo&xRbpg=Uwei*A@d{AcGdl3BfgPm?R6cB&RwrHe!s`R4flmHrc@lBv zYSkpAzUy4q;~p@J=0gdFi9=5@AH103n?6bdHpCkfO1vbe;*Sq8XFU20RD)?TylhHQ z@8)~Wo1Q={psR;sbkN!wXhlCAx6!3?r)eidLwPb4y#y8zE6Oz#yy8Il|Ird}#L`QB z2(8B(d9kZFiDqly^?H10e~*=^#XH50I>wmn(efC3YXgi9>S@{r09W?idEUum~+&w;axn^WJDq zcSAnkPr;uC)(audp*^3N;`?(p{en~H%Kv3Hh?*Ci=0|a;4!*hdV*VBNf!9bOPn-e> zE;kInn%~kEl9L9o?Pe>Z`JQ$BH6Z46LSpB!z=sOxn*Q~9M^(wgqMSV0jrm?b3ioWx zckpJn?ygTReFREkdqlOaPi8v|r{0OVE*)`dup^;|{5FGXA{J6EgO#BBG@7?*i!D_x zRk+6qT;^?Czz*uEQj9;5G>``24w6!}*68?$aSad;i^ze%+K%|$ACgZm_yaD8It|jY zNIG57<(77wc&3l`+jTZ?+(sC$a_v`%*!#vYq4Y)Uh6?)4jgzAQYEhQp73-WN;lW>@ zWn|d7wu~C;afWo3G>$qnP(Y+$a|ucc!Qlw?k2bp4BrW4FU@F@wNJ}-V#)0`C^E&Dm zHuy7mp-Wh~#orIqCIC|ybF`Gtei0MI@H!$>U!?oVCD-&0h1@h> z{uu~WG4J^KPZEi8S;51+3%@FuKPUDwretCG%(|Gsf!}`{HhuzhJWQ||o33y%*K1Qp zo+P=gU~Y(x)8IFFZ7T(0lh^o;SZ?g#rle3MJYI zJE7E5G>XgqW|dl5cgsFM=_z`X_>UuX_(c3cKz^KlQmTji_q9v8lWZ0B$qo!Cct(zZ zf$|m4{O33qKRUSIW9V#ajOx8;uDIld%-)wIy`^@W0Q0E1^<~NN7`$hOEp|QG8*u`D zn`kD7>bpRj=OC%ti(ug8)El{=swLq(BL;JSak=DBMu9t4Qqd)wZqStpvfRoy=6`Z; z{&N|@Ukt7-ZhxoO6v1*V^KpqN>jXrrskXS@W0#fv z#k^W}kfFX|ygMNJefz?b$(fK9WGVdX*DI3Jr4Sio>){X6t>Kraf!51bGmkV#>by7B z8+(eH)0_@=9Wnc;`bnv3uV!G4I$C1E#@Oa}aHF(_Cz3~VICrrD&v~Y;q!l|^(7$|- z!F#C6qmWAo-_55z_J*9);TDa@O1b&;#?G?o6kXE$>Fx2SU}hK&a!+xJ-1EC<16jOA zRvZWh1FYF<`bDFcR=>gqf7wI-0YR`*j}m}dDZDkWjK5x~RO1ZYBg(a}K7ahLkExs9 zv4vD&R~$U-cO7sg5#yLIkUk7FQWS_l?{@lq6BiIyn|=oZw{xe|W&2ne_qYNxGe9D= zD+VGDtuP;K#iAm AF|9Duc#P{m3h!>sYqys;U>BI(v=NABXy>3j$rf(@BHrXC~H zy;hhlvMeiwNONTECE z?%Ji#8B8!xBYKh_%h4a9uLmyK9jAuhy8yyfO0PBKdq&+~`%MI9KZH3dv$P|M{b35-){T(Cynv%g3@puT=Y4CDejho{ zIl#W182Snlh!CVA%6^p~Z5W7F=}s06uvZAg!Te)iPF5W)P$T_~eC(98qxUt%IOf{WYK-UYqDu6C1Pl~N&#}+^4yQo^Ut4xM?hyJBT%LRhDXQs zlYF_sn2PU!!B0$!C%=xR_Lyg{t!o3=(-H$z$7#105xjGJ^K@m+2F!mxsQyfn zW2MJU-2}*M{#cY3b^$DY2M=(fYP~PP>#am5a7yGKmFRGv$hr?sdj+5_L-OfA`Y*wUURQ|>zwVu~}ctb~6=6mY9WeF(li^_aPb@Wm1%y*__$=AQz!q? z3xx+1|9bIyLC^y|xiUNYRrHB}Ml77W%je*X?JBJ}+0nPhqfA9L*Mcue;?$c_dtG^p}6 z<6o#E;LkzD3&bUcquXEt`XkcMZr?>(5dZaRWQNJ+j`y~Xef1KL$v=(`H9$Wujf)GJ z|A*sAz-#ud6f-5=T3=YUap^$Kt!1?Bd#w-5KR)h5NF8_!lw%ehPUDt1;1uhlg4*rl zr`sMn5-snF{m`R3mr&!1noOlndk;<6GT+0KB6*r|dcUSv9r^51kut z=+0e@U{_V_dJYbXZcl(`t;v^lKF7*8K6$X-hO2*BX(!;Te?AyQ&r%V z4>=bBW~~+H)zhZC05Ke7kbBcHmbh1@*#h5Tc@0S7o6fY+_oOLlXKLpq2|3i9VibM| zXy0r;o|y0>2qpA4KOC7Y(j{AMNlykPrN3>1FFa}{`|fZAg!YwF!8LZHVj{af%dUv#u#0(jcb00-f`RR*`Pw4}yCia_BLEz|sv(F1)=13( zhgia86UM*p^1t0L?w{1%1iHPct}4_9d1Houn({$Mjyp#J{WiAvziE8RRU7i=qIjGQ%A zn3aQz*yn!zo)iNz1*9_|M$6)~4`ayBUAqDdDk4F(G#q>a$gV6Hb^1L9{lOIB6Xa*Z z#9Sqv-(V4s|0&P;Ym6femKmJI!`K%=jIF5+TAwpe`Yc3p@>_HfmQdgTND>y$CZ6DZ zv$oh98(@l_Eh7nF;$R2IOo56;C0|u!E^(4q;-Ovm!b5oX)r?!OLY8Lbyms zg5t)E`qlbrg8L3Fvh5wVJ3a^r?*R?!QkBl6(x#N>@p7;z1c0$l}I8 zv-bYI=xb(##Vo!zzd*R851KBkf4F-(Jx&%4`jXdHDH*LWK!HzlxYVB4ydxs z`N-#XK&VaKAodEw3n0#Ezx*-f+bczoBq;|$J%%6!bwaH00q~^TH-^mN!@UDp+QvXN z=fc(*@Cd`ejQ!vtV9*t=4uAi|E^er_%^>u_d6vfx&j9I#s0(m|V`9LJm>%IM7$w?9 zRqFf}*vn)H4n9v3)I00`I1hgWNZ1MYt75SF@(Vv+pWE3o6(n_<6Sqj}U7OZQQTy<% z>P^aoH$WNsd^e&RGs*$B&<(j)bfoSL!m*EAVPjCBDQf$@M8Iax5K0j#Zdcn5v8&xf zAKwMn*xogl#5rKzdDKhcYwY+f3I_}-)<0cuh?d@HdNc$cY@PK-mq}2g^@%cb0|%iR&rdc+oI6{5 zFsRGHR4hB9?I8I#LjboO22O*re2XpwR`Xk1`En$f5*+-7iv+K&4EJh}y<~u>>-0mi z#Y#$jqjbAb!RkAJLUnsq6amIXP2tX}@T06s-{oRNMJw0;j*jze4)p|M@#{HpXg#U( zH@;AYBpJbWYE{6AXu36bV*?C3z3lMGkq@T!+a33-j2pv+bwVr#>7&u+jizAiQ(dz{ z=fXzwjNO(7?P5R~FkzQvSXokeVdZ&C)MVhgrE3moGPQuJ*hEzX(so`Hx{~O%0Az26 zr-4e{bHSJjFV=sT9Qe7YG7Mw}VR-IWPSi3fz*w*#I7K(JmyLpYs#15h@(4V&rHueW zlEhCJtKs5{WR&(o4bR2XZofR!VKRt*a_{T2X$C-q`8?Ynj8Ds@^C$+hH1uSa7!kEH z>NRNV{XhE5U^DjUvwC?N^PLGqqlizOJR6C7(~2xdTkMPgx@G`GCnuPye8<1hfw|XQ zR4|*)fPY2wgd_cQMRvn`&^t7yle-28-K09I!G@}zo>^0_v}k@BBq8cE1AD6HgCY$! zcez`%gAtS-4|@myD~IN{NBT^j)li`BvgGbEsdYY*{-n=pO|=^idK|H}Mr22U(}r!| ziJ%L|+*i2{M7i8zX!Nh1j;XG8Ms)c13)>H$b@0-&lkhw8?&=+NnN)T|1AbBys28TN zt2L#IViFZJyHuWh;(tl@{wetm;3NB>k0OPs zMpiM>#|HuejTlO3k`yUMoW zX=9U(Yx>(&7KeIobqBAwwVws|NVil$-0y{1;Iu~Mx?&cKYq2Z(d%LNjBeorU6AX`h z$MfrWkW&68ZfBp)?3*SG>pm0 zE5Gx~g95W+2>-zg`7evlDoON3ip2c`cpV;6@KCWF<@$&s572PG@e`R3QiCeXfeg13 z02W)o;GJ0nebB*2M*E_n(X@NfkvN=sdqKovjA!u{pj+71?J7l-=WL5X7c4@r8&#EM z>sAjB^p7{dQs@W7Tq=y70Pt!@bF`=-6VSEADC5CK!``ieSF?3sl zzJazBVtzO$VTcy~(idn^W0%bTwOsroyx+AC$cOkVSglp2lF0!79^s5);#dXm-SDls zaK4Nz-LVF=moe_h4n@d(hOSi}gMuPUdzEO`ccPiYY%U*~W>fC8;;15{A2^z$SLznp zoxR>!dw#x9dC`imLVFdp(N@@5?s_;o(h>j7S*g$rbINQ*YfJBL_S>EERD{~hezFXh zp{sto!!-b=a*5|%mAQfUdwen_<9}KH-!DI4>ui%rP?;3VTk<B`8fcx>RBI6#UyrxQP_r>;#Lg5>?28|K!jpcLoii>MoE^=w75TPl1Mz@7g-stM4Sq!QF=woea);*V&+Ib*v!7a;5m%MyDN|i z$Ox`Ce8(cpeoF*deTa5SvXaJbv3<-_%zyLus)AnC|Ck0+<#jLg$DOg75j-aISCCs1 zH#4{}P5PQ%QZEUod?of|#(t+B-~2b_WdJzb@t1ZpI1kPJtDed2r+CL4ub)-Q{9Gv3 zGelp6i9A!kznKm^efh(K)bHV4s>8thQ;cgLxmso0Ihd(o{uFI#(VF?cmX>vzU`WH) zV(qff++jTlQB5GZJUR(jgf!O&l1zVnNwcwoJdPNJxVvx@u2fv#7n2M5Th;O(U%)DN z@);Xm(#14>k93fmT`Cb za~W1!oYcviCm(Mr0oY$aUV8q@|0is|LEB*a}mud&ezqB;|yr8Ud zKvT1mx-?wnf2S9ud?YvF|9NoS)eevgrfde&-KKyQ4OmIcdw>-^1){$bFgACwC83jJ z6*viycMXtwaRA3PT%K7DRMI|x0SxsFwfAjJvhZKeoIe=|(VTMEnEwwXC!E~@#4pfj zdC6s5V*sj9TFdrSNm5e=e4nn{#w1kCkw7t`;*bX%KnC9H-_-MrB%2dN@+x5`{`5dn zlmTd0GEk-45vv!Y^a*z1Lb|9ArPY<$i$_i^Fbs~jkV3@-KH8Zby5fb=v`1J%Xn z2ex-Cb&5TUk;#Bcs|Yg25m(wv`XD6S**Sdg`XkQ@^92e`>2M+KzbiDcYLL#2pa6fz zDOfBINEiUH@(aYv{3M>(OPRAL=K?wRd$QL6EutA94aK2NCiy?&sbbCBu=nzQ-(W9<@nN%GpcpL~x^d%1&wDwNOdvc`tIMY^0vc@^Js#v9S5am(JsEVy*qX<uWm#w3@-tj`U zICZb4KjewiU(jmeX#aFB^3{#<-ifWm%Yn&eBr!J#>-){#!dp#ySpB+E13Hui+!2G3}aAj_4{_h!zx=WAKfb%#pVCXpb>X3x3G8|qXd;sFY%CV|O$EZC!^zf9VK!xB1p6{i zYibUBLbqxQii&DKtevo@p?Glt-zS+3oOb*`MgUu#Bw}wABo~^9lvDZ@CJu-S_HzpV zdSv{bx^m?|X{3a9*tZ{0o;_gZhh#}?d?S8}zL;fH_6p4HVeYNcpTM`rKST|zI&wex z{`&MG>dz<-^-FL&m)CQ<*#Go~{`S2ow`Bxw70)H2j~bFzCB5(LQyO2EZX04`t9~E% z)*mHM4fUkrB)v(nFPV#8)Jt6T`FXH~ zL+tMKE#ohx1>OBeBZD`busPM!{TF$$L^YKz%MhfXTbo69%s_VqE^NW;KyZx+rCvhyX|EhvRTNQ)6wqnYYR}{%>jMz%yU!j zf4UHA(n^1bhjo{J2*eY*GTdL|Wjxrt??!-D;WG%F?2uaB2TV_ymJ@GTq0RL7a3&`q9J+ux z0`V(H9z@40_NXfQ^2)7WEeFw7}2QWc4UVC19>wGGOJSW?%02zS;~D- z_>m%Byip8!xL61}2+edl;JlK|fV^Q)|MZX(PUF3{sRG}=t3Twi7Acr#)Fqr{^zGm! zah-VI^-C}wZph+M`M$#kSGG}PDn|G+aUJ>yeQcnFt?LIh#bN+$G?x*V9NGi9($a?S zaEQu#>`M&PG4;00Zvn`M(DC!HTf_;=JtEz5;h25;;~vL&lLP8hrH*v&yxx`hs1i3( zD?U2lw`UgbQneyhzVWKnZ2Dej;+J_hN1n)eA|tA+9!Jc0; zAgQ&0d8oTxAHiYUlK)t4x}Jn2?scjD6q-u%3b6XiydcR?^Y|@ntQ6uCeCA-su84WF z+1z;0znr)pR{o`WF&}_@oHRg|zFacjuG&+IqwBR5OhD{iYtSgi^lE#f4bA3E+clrz z$Wy~3e$Z>?n7AvCJ!TS=Wf#q&nLO>cna!v8muKPArD)&QCd2!^HT@x2`muxicY7n8 z`Tw*#)vp3Ax91KQev*|eIru=0jC0nRYCk^GCZ_O|QAsT0^Sg;IFv~(_a_jT2Qm6CW zilucKGfNV^4y_Y+!nu3NSjusi{gI?N5Vk*OaWvy?gpYi1wpUKJz9#rAyq82Idd!0ZnQ$N_K0xm2z#sw z5(((V_^|hRdw_te7{ddb232xL*WsyRXR7!mOD5rMO@TJ6`}gl>1RLgi0wMFyh?Rlr zN}S0VKj37oRHZX~tp$cSJyo_H1}L#$sENElC9I-;K~#3_!@>#iq-6m1^NvZ>X@IP0 z_YK6dHz}gPU1Rsov$b*^K!I5jXCoJJAC4E%7A{ZI`~q*l9JUHDwTKFcY$?ULuh{!p zRX2L(37C{0Y_!^zQeL>p3UJ)$)0O9=r9`F46X6t(%Sk!@B;*G=oo)C@r?@`-Y{Cwc zgTBAc_xL@Z>Q=Bru7i|*0~N{B3UYIP`nkZKX}!4hOJaFj3<3(Ky^wbPCm5Qoa*&s7 ze2q|LA7svCY>DFKxUAsINx>-OlrRX!L^w4{URMFlYvEKMU=Tt!L*RBj{n76{*}jp{ z$qD8Z#q1=?;9OowbCYfLuKSd-ti5DQgP$9A$_+$2*TyL85{tWq6m|;Hw(lH64KC>x zyf{^sQsljjWlp~?%xc7^DqNW>=gT7L(J?w(t(NwXd0wsbgy;kousgA#s|BSe@vN;iwLb%Ci{;MObDBFJN^Ir+ajg+z0+L02UB z9VbFJ+C_|8aU{qNYIO7R7>;Ed6{l{VO22M4`JLh&IPEjl%U?YdafSdR3HfG8!`lc1 z{Dc@)*^$lNOzqpyu{9!<^#Q`z*zib(V3p<1Y;K()_1dVaj%P^p{hQ1~2O>%N*oV zCgDxTInPcPJ0b~$S2Drbv6=SGdq+rkwny|^?SW5em5^g)rxb;|pQE2LXCwlndZRsy zF0wMO;w}S~(VT|#JMAqabl;_S`mq}&6rO9caZ*nzE{LQi06we$JM~cx(}cLFxdEUQ zNnqOqcF+kjjiasznexN8;#a)f(4DuEE4uUB_jJb&Y+eKj_uly<`~PeBQ4VqoN z#zxV+#yrOdo1yIsjzLfRo|MGzeJ!;ay#_enrMfpbRFecqyV==^-HiRRt$7O^WQ#(u!Lgh-l@pzUZ+rS@Px;gt^TN)`UcYKTPZrq3ak)cDy0)>9hEg!4aj6~b5UAkkclsXRTqfQ2 zX$aaaudSBGyk~|#tX3;1E@tsWzx%XER4w$RYUT;xRuq^^6VwxJp~bjCzh^tM;4yTI zBIIzSG{NjkY7*Dl5j(j7;g}CEFSm!YC*(EObAVaYM|dC|Ua?W{ztEHKWgsV=Ai}?%Zu4$b; z#DK1iZ-nFw27y5_@+=PI74{~VolAAE|9$UH#{70F$w?$UgLYgzP z{*SS%j%#|||FnS!ihziKihxKdskDKB)De`1!I2)F(xsw;fKt*(N=xT95S7lsXa>?b zY77|Leh(+E-ut`vcYpu!I&#K$&-aPX^RCaGC4WCm#X>T6!H(_JEP<^!O4-b8MPav3C~a!aQ6m^=E--U&(IOc?5FXl@6Ze!K+WIe z18)Vs|@$SSOU5L*FO_+Q0)5z0R%}=G7 zhLYs>q`K?u`+ji0=hqdo@@(|P_=vhMYr23o)?ukis+34i4B6g!#&O>tn=NOPc_DCL zk9Ax2?g2#dE$6$bKD+uyt{rG`r}X*`yz9*--}w}m%lLfyj71oI<>ENHByqZ@(wgTPz>Mz6inV!5 z*%dN=*2s6cb}wCe;W#!~!*BA8!ljRa{upRqXmCRZxc#|X!{~$ z`cejwrx-qtD$cU6r-7prR$0NmEGlTr>=J^$&RCHx_#s2nCn}-CEvXn4eb5JyI8L*SFH{jwAhv`o!g%nnEC9 zs9f3>osve~-ShI(+Hty{&eql&M|a=OqAaez?s#d9&ri(QXNun#$#`LPv8$Vhp_tr> zj)7zYT-22gDd|rW#b<%``*%4Z|L<6t7oPs|n>lE@qM&xHs(dt4_GCG{kr& zev}k9Em0J0W0SDG20CHHI;vgL9Ya>CTJ1kYrJWEttRTkZY1>U1m3U&G=&Bw`6C~`1 z07<(B_gSyiEqF+vp}We%^WCyl+Fw2KE2(ry-Vn_Z(;6>{_D0emIuiGJT<3P^k^xHn zc#>UWfTM{1;^M`@KltzY$l>~~!+{VQS)iZvo%Nrr_yNfNIlv0KaN5;;HSd&!j&?ev z?RJRmFXg74wNZcO`69Cf=7X(B*c^4qEh$}iYA=tCBz$CMZ<_+fqS7=)0*A)Rey4bW z;R5NjQlBfx*8ylz z*&2G4w=ULGQubhuMslx+&GVv+Ag9I{H_pWM9bK?wk%59`$!&qkj(OKe{n9SaVn;^K z_?z3iwfIc4%LW*C7duXI)+rzi%DA%vYLM3Ov$L$MmxjIEs4_wP=Ewx-1)Z$9VJNx$ zNjA~AIAKca>w(gIGV5is^+N$Ce+jDXKicsAEk9b~2Adu%tM>F?NbKJ6Mb1_@hj_aK z()2UUZ zh+};dW*P%?EHfUf8KgON-c%$JU(4FI9&w45Q9Y+7dP%m|oJt-$5G{f-7lht02sNb_ zGq0tIaBNuO!7FL=nieLYF7ysIuCJ89Y(s@edo!Bjf$lvfu&m}--C>>Z3)omqG9!}0 z3Kb&F|A4i2X+CKJ1(n0<3t;$=63P7qa}m9B$TF^`!3VEkqW93yvoU zu*qno<)Q4@H(D}E@*MY1qC12GvB8JXM;hSz=evX!iF6A_*_=we_0U zyg%!8n}e0X#VC{?yR3Hw+aW4^hum{wZWjyYQ2BPO6ur(>lz*2K$U6100N3k`CXA*W zq0{Oa?rVg4w_F#6rmf!gY_jGGs_+T_Vsc@dEDIKFb5D=2-gbLnStNH=P~Fm#Ir?qU z++LpR)@Dh)48K1ljAiGryKKxn(ovFiiskRowuCjAcm!KoAIrc*sj_8VUrHS2)jA+%evD9BV0uvDKh2a4qg zh(ti=U`7ktY38lR$i7yk?UN&>%Xv}?Y1x`4qd*U{UbvoAt z_XJr7{=6%TDIYO4@jk$_ceFw)?L#x+AiEP zpuTaiI(Z@W-QrhU8`*r{{G-KanjP2}? z_@jF;>;P+TPxl-%QqJ4Qm4dE5%#GTV|8$qS=Nd&Kwg0U0AtfUbn_)5WXIT{Ifz1qUUxi zY~+*V^?V55M%OoeRWyuCn$HRdK{(PN~U2Oz(hatB&DU!Y5I#Cp%4Bf zPiv$I{xsA|V~G9xmxM?l%a_?k)W`l{b~6Fwy1{{?Mm%W6*oMpxlc7 za7Fj^S#G=E3_{~hKNd@p{*6y(fYGhQpwb|Hf`@B-``K53_!?}mC$rC3gJ7R_7O%1*6jvGSwTjWnop(9Px#B(S6EmYSsi0|qF(A+&Q7J#vP z5UeL|p3Pn?Q&iT}@|Hb%er@*oaq|b{eyxjBO(8B*jpS+Xl*GooCW;v!sk+RsdX4SY z?721iKf^hGIV6afccKEZ$#1QCzDb4c625U(wX)4rw*{Wg&h|n6cn`3gBywVZSFHI8 zT)WK0=Syg}uLi?qeho{X=VH8tU7t+-dm3m`ZgVL*ySQ@|`fhP4V}CX6Wjq+ApLA6@p~E|)dsUmL5rP!K1tnv?Wl{Rw~i z2B<=CytY~N36zk2*;oBaj1&$V4|(e%+EN)o<2+VnBdDFLrs8azMhVkNCfieFF`lgy zpZb?=&Dth#PY z6S;>O;+saN1AJ{!VazHYp3EIiiw|t4O0O&-yHir9cd#`ertFyPq3`c~QRzzA{z}6K z%h>c_5FASg7AN9+Qe~l%One3dR>$2*-g(BJ!ILxJv;2CciWZnO?IE{0f~*-|0il8V zF8$VE(Nx>1$SUI1T-dS56sCnVsuVPSXJq(3M8g;ZO_pKgCnePw8_2`%=Lqalo$g8( z>d&>`p}H&D4BLfU0fkwd?Vt=j8(d^|4g@scaxc&+uw`KpGP>4{hzH2Lr`0;9eLhGm zHi_M;O)!9|?aU#h@nY6K1$Y&3AxTr2mTqxOA7=t!AqPu|H~W+@_U1Zb729 zD#n!ZK+8dQCb@bxG3!fce|(C7L4`6L`1aJ!%THSVMt@-^&^OBQd4=6zdr?|)-TEC9 z+U^^%lOs|l^%II#diI|8o(nxAId8SRj=riVQH?xQ#y8tBi(bqN=sV?|yEr}zlwR&S zlpyRW$Dl#KH#sfV4Dt*nw$g>~j8{sX@c^}3^jr<0W(F9}N(eS-OvD|=3 z4Ab?;6#B~>{$eC9_MvUGb4?Ox)1Fm#?C`wfz|!^+>oIRvHX!r{jf+wTWJ z2K)>_<3cDplkgu#KWd{Sv=7be{dakKMj)Mh#ojsK2Ip2gzlh&KczTJ1{pe__?>2VG z<;VRgvP_!lqb8Azk4fLxus{aAAmk%_HMbb&Jjeg+DprOY~Y%7P1H<@TmDEs$B^F~S^!;gwXLw3I{Wp<|(X9G6Gp&B4DGeUS_0RrBU zr0!u{o?iK^r_@36t6!g&Y|6(GSaq)DZS{jXZ}(mvfFcPj%1wNv&pZ?l2=aR&x>q#h zB2ozvAMtq2RJ33oeym_2x%sx$XK!F+3d*8(TRtNQq;eIQ?sx!SW&=93+xDejfJG;B zwIhc9lMp+bPYze#Tm7z90g|oW;~aTIO_L@4ks?neyw(;{+kN&;-Dc*8+0N7_sqo2d z>6bdm2;wV4`S&b494oMHyX-ix;bqYFOtWH4*VwNT@bg2czWpzVy+hYDwGAKz?J%aK z873%pVHiL~tCX=27MIf9L$P3Wuc9L9m%syaBj7J##ZC5${#g%P(Q0ga*7v>A5iQpz z;jzY?mUkO)5{w|%-9gr-uPnQ$ytz|9MGu_!vYOxoohKu+FXOLi|AY6yan1e@lsYN|lWfUaq?)^16w?;Tlxossua_HGOy?h>xXy)C(8 zlM6-+YNzO1PcHFc3+mmu&}BMO10Fbe6HC5Hd8zvoL*c>r? zm%MSe8M^-bC#p-x`gl7uTzzZ4gI5?P^A&zfRzGI7H;w#2I+Lij!J*IlFi}(V=dmvG zNkNZdik7)Eo=CvIhX0IrRhnAt%iL_9>-EjE zNKLsDE^f2--S4NFA(u&>DBwTD)z!T<}-)~Ef$os}V7Ad*WmCk*KHb~?}* ztuV}2qesW!q23ypr#lzT146GW$x^*%t^pmf?X$U6e*~bGX}Vq(8(i1y=Y7?9A!vT( zG^&#vQxb~{nB-gdaa!ax`n|N$VVa(s-cI}jM`wCS)!c_wd6(}p*4!B(QO|~q%eSA8 z@6Dg=+yBM|TZCb|pGEHM@>Kijmw!b!E40jarx>Ps&9i#O)07cZ0sc1&E`&!ldwu;5 zx?^VE?6zP$#J?7pV03_}@5g%N{0qd4Kg}(9#*A9wil6R@OEbrx+n?T`o{!8XbglfQ zUSm}f2$yvx-Y~3nv0!Al7M0Jx#K{A)Dr{a(=5tBuGW{tT3sPq2P0!aZt}o6kKffaj z{=FaOL*Ex};`iAB(5oJBGrG}9*$p8dBcS_V-9RP=6>z8R-^&t3gJSFUK;7=teYni# z*Ju}L+N1y4rcy>u?`&m{Nuv+)skD#6{w zdjn~xUWn-$GW?l%|CU#qR)%YFX#K4qXiBqTd2NcCgH=5VE50G?(0N``uULOph3?&Y zz-ds4Uvef-Ic)~$g0j&=>6#9;Gg|G3hfWVk{Hh&X5IZNG%y~kDrz|Nabad(r(&G)h z{ahEfdI8htrVVjvjn;z+-q{`fZPi!0`>t5C+U0NA89`eQVri8t`@PJ!;o2ENoA+9{ z_!BE(re3mD66`j9+}JD9BNefLB!Fsi8>|PlA4ZMQ;v_H+-vJ z%cp$^l|!@hNe(e!Fmr5c9(C!|!IkKjygItJrqb`^LC-1u8L0-OlZ*j}eIOERK+vG# z_);g}C0$mQ5PgYWNMMHPGc97KQ;=@L@E6x;!7pGd7n{uu-fQcwSan?>9aAC6YkkL_Tk7@wG~jFMfC{HS4U6(9Zj z-0HBMvwe3e*9N5{aly5_fPmjtxTYhqZMQS+9=_aON0fd;)W2kSX8|=BJjfNA(*K9ux*$>uL`ffBG=L4k8MEoFz zezF_3iKw1lEg;?@;yE8AJvvu+P@#)a1k`M2GY>==1ktX-?M5g9a(2j7bB%0Yx~rFD zG_7mO;lF?=MTTPGE|3AWcWc`z7{1aml5@w2E@tH>6#}^;N4MaTCGpM+*y z-z&mB#t3q|k<%5&^Jza=9xM@_>%SX#oopt28whpJGBQSI zbgYc4Vpj$$TXYKb9`UH3zSv8Tia2K+6Y@tLE>zPv>9M)}So$sBO#*4Gp7B{y{%+7r zB(zh;JiL|R-N(*HKbW$gf4XYJ^U$#wku^DgXSS&NR4mQ8CH46$7qX)6bBmnIc>Ge= zLhU_qMSo~?H(_1YQx1Pn)Uz;N-or6OTzB2AwUYOdU15{_z@H}Ww|jtH$A39O*ien33RBitrhzi&hF;Tdua~VD5Xodcm$MKdcEPQM`YfgRM02Ma8{t;SBK2 zAL}P&R(#tHk|*A{gOoDq*y+nuYHK~ibv2t*Bt{u&$=6FN6&o&*G&R>%!N47W)9!Ra z46d>Z&J2R-*OzTQY3dNRiQ0-GlLn~7LZu6y)#+~XS4#OH#^c2U0Z(e#$i3`zpkXScY_wYq(p3#j8&cNsf#1;pAOcP#VN=rn5=kgBUgN*c`Z#BtdLbK_wNik5sZ9HWWF zoE7|ZgcMc|GESF$6_Jf>Y?=QGrsevh;$g=%oM9w4H8~>Cf4*|@cHmSse>fWOu#e#2)`?sTVkM*!yy4*c=_Gw?+G{+Lc#xR+XZDwZ2CdujK%0&k=;c=iV6~`a>#4`uR-CGS!J%YSdoMUd zWj&}6l)en*>B|SKLp^oOxRIXVuFntuF@zul=W0|oUoS!2_0Gn9wa|3~pERFIuYMpe z+4{=ZYzG*e50@z&;UfsPN1>z}e)o$Ft92v_(U;f|W7mLPF;;se#TIGB%%^o9>>HOy zHGkmbeI4UT=m=69Xf?Cyq@~4S)0dIG_H;WGgOJ=lG)1b^#f<@ckI@*hTXLR1JI5pt z^1DGiv@gbW)Nuij>-X_bk@e1?VX|#*woc^oAat0h=5DFZa-k^AB_)RiUs=LikOyDgmskx$!anC>P%JS29RL4 z3zYi_>h7%DuNN9yBJ=z=nta)=d3Mw;yx(!sjkX9hL)&V|kyA;5J5YGACWuE^7Wvjo5b_`MXr9{joN*a6e;&N_M3!`?v%-g;MMTBs|BD42fM1C=)TGJ^U8Wb zEGFlff1B^ZV&i$zgp-)(QsG=Fm~IzTMCZxiOP-fK^#We z+@-i&A1EMGJZ%gfNJ;WVi!zxOoDfVGL||!H1lhaj(gY2w)D{mo3Sws@r%SzOM;!l} zvBz0jtC*)8nqQ;N`l1RGs%%HK>Oo9}M@`2IV>>b^(edu}yX5m97&F?@~>K)X^gB!~Cn9ce_>p||B%{ zh#LVk2}F4ypV!83mA1SbUI^v%R_0OnR!^+9z6>&y%V)IkNI2oPh~9fcCxob##(gqh z06t~}Jre|-Y#!cZ_maUbdf8}#T%Z$u6*`9My|7@LZ|lOG4J0_O3LPuSQO*6UVPqpoYw{bLZwsWMJpRb)@1<1%J2lFa7otBiH^_#>DV`pyr; z+W906F^?Q*!k7t4kdTRK3!w6!EaOso8?kq@gyp+&*w%&xa?8Ll2kKsesyoMQr z$n8y8D;#|3Zp#}dAdynOL74SJPaQy-6MkNN)^ma>QWco~Nh*coF zxCET!f@R%QU$7u9JLoGz@8boK6Hz{dILRWEd_FdV`Ion!b??#`<&~$yzcsO)<{b98It=14#e~UBfaKh=T9h6oQ!RU%UVcmvFS!3Ps>y zcT1r|LVf5DM^2u#r+YwSR*vu_2>#}ZIPUXGq5HTs%}WsQtK9aUTe1ENa%X;2_EHhd zb^h7szmti;5!K1kiXwY-(Jy)n!*|8Xl|XHuQU6@&*q4UYw)Ua9nn^rB zK)v}rS1d{r;xfANgkSef)m=?!?V_^rWP+&De5Z;=fPb+Hm*?STORmk6&4GJ(GwGRd z9S;~d&^8Q`AiizfHlxg<|7R-uA5&t4J4%pz0fv=DFQ;hqSAMH(*)w`F&wLwr9Djik1Ki-zx%em*IeBI zN8r7Al_kZosI5RB(6R0gHfMuc~t~{zy4ouSSh@-1}^%Ic!E}jlPwR z7%1?0v$N>`PRzbvuNXFeLBGmQzxBZI1H9X)Z%GQBP-NH!s`KdwxqC*Re!IMhLlpVN zOFB+o`DT%!9$pPn+3Z)S$K7RRh1dA@w=AHjL+e4Szr!~EQSJY-r2hPG3{Nhpf`!F= zs1sC;_U^cAU9b)&jkd2+?B?4YT&XNB#j}Br#cf?c)C$I(o8n(5=>QgKRb@pnx-#8^ zQSW4TfNp#NC&Gd3OHf6nkKRlxb$I1r5r>28 zg+p9!Af`V%Ea|K0-_nu4iJ$-Vd{IsmUTTm58%(%V#DwzKDbI_88aRO?FCqqx*8s~G z6jWJYe*}I-;-{6Pd|(hE@J&O0DJvQnVP@e?ncc}RxMuQ{5dMC1Gob${AqcV8ud1)d zrt^ojH0n_hyS-+Fp5n+p`hNIRs(*eUg>}X$Nwan7oYgab{X>@KCDko`PH2;3_R!Ak zXqi;1R-s;L&B9wNzoiu3N^ffg2#CECs@>_|ado)RloV8#-usicARbHA=VxmTc zk#+kEEy$pWR?}lEXgv{hhAXu+X%PN>ERopwAM$E{88(G0wB{uvx1`+xitWeAK*3vpZtC-CopA9epQOxObC9%%tO3FO;o@)X8C`Oh=^@6Q_H z0#Y}hWXkf`yDv_@mis>&H2yIV3cXaV_Usj05Bz>|FaPmHW}F1syX{|;|LMf|_pdtr z1OplU=$TCTfBV|t$sZks(pi}OSEDpY|Lp~1bZqU_Bgp^b5k3J?X=d4t|Gs@GT(Sng z8shQwlkk6?DuD`*!FztBfBt8M`1jcVuW!mA27dL9^zQ>K|8@2#T*^OkU^GPH)#vITOqSe$`qj{NVrb2={@vog?A8)ygjNEDR#Q)<#YVU$!E4~%J`Y*fbzj+yfN1yrE?d$(s z%C&bd^`LWR-^iNr{;#!o=_3`0#<>JSlX1(B>pkpkhChD<(7+H|3;2syUp9h({kZ}r ze)F|Dcas;RRrdU#)ZR1^{bd9d7>*Xv^tDGy|GJ1Mt{$}jYXipZqiVGZ1$>k7px2=a za9B}Pusmi8da7*-^0bbE{`6~IvZ+5A)s_KtOab#HTNF8_}AB= zY!t+lL%jryLw3|1vHZO3Qf^Ve6T{>1B9E2g_0;}qT+l^2Eq|p3hPB0%KBIZZYZY&@kQ~(5)pWa&k4JUAJxPlNUua!! z;tkezK)mupFf32IJE(pcxU+Y_`@eFLdij?T{&Qz-q&{rIfF^LNV8|%pN{{9FseS=y zl9&ptQkKqHKQ8*@_9sNc=uSt=A{283plNU&=ZJmv%Q`r56|AD5(=<N-C5A+NuuCwK9)PvIryCG`&Wn4ZI-*rS3(|y9q zL~0CUU%Bra2IJPobitfBca#3tAWl#vW+fMsjs4X9|MjPXrcTx{e;i$qwCM@)xmcbt zFYQ6%8)$6kOuU03*StTb%3$QXd0-6k^LCDp2N9LJTw^XnpErx|KoyQSAAb$C|)rr+E=p zSN;`OW+2n7;JWMguPgC*U}Ldyy*WrYtjYni__)H`yx%=eo=V+gC-_o+s=Up5w(`o{1jr1?Qb-lW55I__N~4yc40Y@{@Y z99T{SIYqt!r%x*du z%UlnRa26g2{^sY;J9lQkXHc9w(hIfKxym^=mKLDte`dxp7x}Qm zD>ptaB$OC8*5df;rtbQMBEMisfE(bck`1w67T#cO1zVy}$L z1a?RjbSG}G$)f}IH^|m%c~3jqa)RXp{EVj5Qq};onG{9dNo#)0$9o**+cv%Rs?`ov z->L)du&kmk)iTosGakp$-UMt;g5YNm4qe|aRS8u+a-{lT_3PkgxgWN+p6MC37q}6$ z;XKpQGCo;X2?f4tj?c(rlfJH<`yZShn|9XAbNZbL{CJg-Tt3soxgJX3NlRfbxW|`p8f9ZZASp!@YNxSg+S1Z^>r$vK_c73UyHn}!3qb(=XvjT<^8Rv zq|%srD>-??kBZ0xXu2bmBcg!F8L;!N(6|~!lT}hXZ-Do8j^rpaYxcH56EAvMetlJg zVw6KNHot5GI)g0bcUQ`s`hEx5zUfCfnVf12J{9cn22YF_btCX1YO>1OW*Jujr65&f zb06iQfgx>oDxt~?Z65_-E0u32nX>&u4vy3odPL0o#1rxF#sS#p(PdNlD- z$b9j)8a7Tj`4Vtg1nr#k1wL+%J{mf<98ad(RYqX9noES1#KuFs+s04fV(nq0z^(rY z%j!295d3AH^g>m5jn$pw0SD8EN;|75JV8kJ3SzwXV}^{RuwKw%rqbn=mlg6(vfopZ zVm2lEdy^@}$ch)JD5f}Qe>sb93q-{*jRB8W!p@oxY*F+dOVf!W4VW&E0QhlF46F=< zVn|BOZ=(Z9g7orRpN%a64*EVO=IRA=)KqmGb_Maa*3Om@=#k8=jx3cY+A$C9cb}&g z+gS7I^QL1)wxv^eGap36c+Pje6P6>5(=><55o;=B>)+am-PtU>CbU;n1fMzKk6%ge z2xlkd(|rJqo3KplX`yD|(76PoIDpk2?PmZi1E;d)yuCxOU&^%WMzaHi<`Tb{X|TP zBC>PYLn#sElh`dG$wb$ExHl77YZE_w)CKKQGX>FK6z%6}lD~onw3~U@esOPxpnc^c zbyZ)F9B=&YD&IX0PTQ93g&zBAw2=3v4`_d*RcutdQ+TB%ejgA%vr@?5B9$4WBBF;+ zpDVrFKxldLD46~c>uuW#Kg{ASSkRB0B!__}HQ{2chd~IM_-3)p!04nqN$lmH^Qk7O zHF$hb2_RM3jtKua({J&RcB?eOw^PqN+*}@f0OEYrq2h@vIign{n<959x8`zSAGs)Z zZClpm?cY{HHmr*CSU-P$E_BCQGhH( zIlul5M5SIW(B;jw4Xc(*kxCKfO?JB5P`=RW3&Io<)Q1c*AE+;Rjab;^-_yu}b}1*0 zh^?7R^c=x{ZH-9|Wrist?up4R?R+CfAzvqwX-FIF4pa~e0)JK6X4{Kov7nJ4?i#nV?Cw=D(%=l#adDF4rB9U{_rNB{ z>}Q@e0Cail`$GtkvNsnYyY+9`j^OCqCXwSNLDzY8-T|n*ed#TmPyHxJl)L?L>x78i z;%|LnFaUyf4ahkeLne*ujc4seM+2)?QA8W?bX(tMg9pWW;s@t=V^l{nnzz+|n{94?AvGQ_bYAX5fi<*m=of)wDR4o3hi+Ajge)|uY_}X$ zZjZhSy0S%qHreeU6&jPo@Ag~I7(d+LvSGmF^>1%js{O95khsC7M3-{Yv;@#O(x&1O zh3mZN)i|EPFqQ0n>MY9_GqV}@b;obf!ptc`Ta|W+nG9!sLq6~MoOHL8j|=0gTVOP1a#lNjP$@v3VPCW2&DOz z-7;_RDLvd49yh&|h8S%Sj>4WU+36B4iEpbOij~P>+G97)Zyjesw8JTFIx3Ls1Mfi_ zCR?p*0oFghSysMj8?@(dEu-_9jVooFZA=SomgIajnE zs?3hvy{QM3iFvj{YN7GsP}DH(2ngCNU;MVFt+s)g9j&~ll>*%$_(Z?X0BlEI)#JW! zCT}yN9ujY=-e6%##DHV(CEs#q80zs{0fK0tlOzS0HE!XeDrYtH!V8ER~O~f5%89$`weCvekg(A{)v~n=ZG^6@$7R z?c2V4j<2f(CsM1nAWscyxDzgB2pXn-%)HwUJg`C_eHj8rAHr5As&#<_$!uAxMMgJ1 zn40!wXMylePI)X3H{6n8ACygsEB>}H?QHM27tU>xr>rw^kY<)?%`K~11u`cyTAv6`GsGiggo>op?;eDZ#~JdfXE zVPimBm(@|h?8ccBnWaDB%WYc7_c1@#cp42gwidd$n(>e0iBI8geLRbA6*L@fA2K%V zix(aAAUI+&UTi%aETiTw*++j;dHcHvHp07qsWf)d_s)gm@~CyAscyPEqb$om6SktH zsmnkCV*Z+$YG`L_n(qrbQCxMsVf(bt^CPpTf%bei&O2xQi7lU%Drm)7ofyUzV@__L zceodIdG|%m5~s9-(fx-CbUB@Aq#$dOcgz4aXc}e~qMFy!cJcVt)Ibl~M@0tWNfO@Q zcUW&yPC2rx1ekoS$dH-|?yeM=FKKv4GvOXz9X(pMygTMt&Qc6}2M-#A zqP$CXT*bV1uJvvA7gk5)7~m{#P~QH!R;`L8=1opk!@_!# z#Ix1!`)Q6BZv6(xS>FAvZ@7|aAoZRdg%+0 zf-E%-_i#@FTZ!`fq+iW!f1+5@z}(|?Zl#9|UvH&}&|;C`_mxvTWT_)9Z?Ko03QyE* zS5Mw&-T_$m&D!~8sQGN`nJVhNBMjj4dVCJ|kdW|~u*p~R!AGWgV17DkqT*2nErDqq zpq)Zs)7D>Ko#_W^UsqAR_q9tnE8#sq5+!}>3l@(}9Xt+Q-KIOwQ<5HUUw@j$kEP*& zKCSj!jjkdJ0GL6gJd3O5mIX8T4`DcHVsCw$Vt~V|E;B}X3icRoT zpv={0wtqc%B~anYNniY0waL^+QXuh6lVeeNRfZ#)m|R04|GFk}0CX(r=Wzl#^TVKD zY#5DIbC`(?vLeI4&BXK3ZD07tkmTv}Q`89Tmn~4eIfTq!nAOniW1AJ*^UJq+R3tc9 zQnzf&)-dF5L#W`^ZBPtBFL+Az(E39OVjG1Ea)JQFiYMp!P++60&F@Wl2S6BEWhIy= zgaFl+rOcYzGaXFo<)cMV7U8`KkTIBa`>x}0fq<(PIAzx$VuUoYNAP`i&xJ!>UD@w- zoRn%EQtr1%!L%6;x}wi_8g{gR9XaW;5N5)V=2T4|2cz*+tyLOR*PAm%;G%cAb|JNX zt!f!n1jVO$Zd=U4j+}C}OF3-z^Jj~+Epglkl=(3ya;Pp^ujfK9YJY}rvsg6M{U*4G zUmT-I)W4@1L_zIB{gr#(=K(Sf3PQsI-Vpu!L^kFFMyD$Mrt#Y#G~Bzyp9^fk9yc-R+hd>h4nnMuEwbqqM~Ty>`VV>9Q$!gDMwGEFKLeKo)u4sPht59c0qYo z%e4h#uP1#oC-?cT?iH<&+|iepM1L>Z4-oc(4iPec-?OCLlseR_cMX!3r23ur(@*?d zp_utqNrEO1Lk;Ld(TKe{|ANJCWkXHRy{hPn;F4IS7T~EWS&}4yCS0q~-x2>}fOex) z>xFIpHFb;pyt}}Kbp{(+rRrq>NajA;+R`^wIfG(FX-O#OQG6-dk@6bb)L5=sI-uu4F zi4x4cL#=L>kCF};u|ZDfSLWPum;XB6Fx_KwTccaPGNybq-wt#i+trhRqQ=J{bhZNe zTd&nw3tBWIGY@~;Ba*J*yyz)48$QNGl_;%l|p_>kL z#)AzD)-5W?HGj|_r0hqBaCX*hhq^+Jg1bCjeh(GV(da~61?+WVM@PW9ir3be) zmt-=FZdVRw=UhZRZZr^kl0g#+-Z6QA0Yv(}{PC-w8fzCoZ*`fQohXON@mj4hU!^_J zJk@^@HV}u}JSQtzm$b?uE|^!Juzt;`7MUD?5KBW>Fw>!I83>8cVk|t~Q9|$?MxrQB z{01D5<-7H}pvSJJ`=BNfkDlyOh(;%00W{@y9I(99ostk7(f#1x=Z^mE%8eH~ zVRL&O6`jxn^0%uBkW+*K8|1z2%n-~4yZ(=y_Dn<|=6yC{wTP=*f11E$jNFlwl$P0< z3K8+zVv{&NS-xO#2K@x&^PQ#pP4mNE;^NKz?fRm{l6)~qN_1ybDF6p};5GH@n%C!Y#c;64zrvy6{A^?uiEa$b*0ht|tke%(+)Uega z{bUXjEs?F4E5&=R3R&rh(Pg#^lPaNU(zTo9f1A$~`#X=I)IVb#HrkNd!? z5o|vp?r_NO;MTfL0x{!AVJF8V0}1nBFXx5yJ5}694SwOvTQ=%L`Afy2@|(}Y*(4== zw|B8wLnJorx(D6jgzb721Q38&Ps&ZiJo%o2z)9{7HHqiWPq|Vmn1XU#>4a^iJytum zFw@P=yd&q}i8Q+rr1}XB{IlsR!paOcU6Z-Qrb>bgi##8^LCnpm3d61y8CGjxzf(<^ zJdgwD>*uM=NJS*KlB!vu;Au|Zjmu*!#bYfSGdt0>)>vR_s%e`nha(=yh+bKyyMQ>{ z3Y*BGiOqC$;is(^&st}hqwb=dIKi1tx=T{}*7CmrZL zBzp77=kt&`qs)y&3=a;D+78W8i_EQID|VaQ@NaSl$*iD$b*`8}&O;~|sMVB_p?U+N$9_2+HB?z%l7jpIdp^S2s&tK=PR z2pQ3I&cDmuV zZRHMLi!?N}wO+ry%C#J>^uU(PNELYc?0HxTDTR`yyUXqgwIlTjMyP^#g5S9no=vWT z6JNCfpHa4eLr^>#ddBaC4v_57&yD#ELUf*M9=4AAlAdmLwf3Q$eK%(x?}6T|toCJ+ z4$UY^2{H$w_`8$bw5=#~aIBn3WF?{|4qZFvJB5}!f>ZuNJc9Wc4mhC_t0A<(D>=c5 zr)9I<66+wDN|EoAx)ett9_tlF5p^CbJOn)bXFp$?4a0yN=&hb4#gM!N<0=P&eldLc zIyjzDPcJCLX5XvY$+{Uft3hHxcbzbw@(YI=&^jIUV+$ar;tV0q&>?n39g$I_)+?Ir zau4Azu{W{KN%|ZVrIFH&vm7F7RSFR^nx=rxw42snSJZP5YVeruaZQ{n`a@ud{8~Z4 z{?0|-i3bgQR)n!P5{G-eEg;1QxokUSKzXGY$fEjH->rOK+UAOsS*1o)a;N2#42pd| zsO?v%r1i(gt2{Temo09261F=sR*##LxOc~6P%!)4_Y3K8Le<#sIu?bscR=sI<)Rj4 z`HtlxMKpxPc%Tc~x1^IH`O$6FDZ>6y-pr1y>)@d7SSW|1;Ap>Ayt`oSnld`gdVv*o zZN8taUSIsT+3)*?(RE8QTv4qQAa}ZQ5UIvZ^cTj8?rbV?j@SUu_LTMaQQm-FLql1p zWmI?^Fxty3Ul$7rRUIjkq|MgRDKS~=%3v9;%+}k>oPHO6ZnF?rbgokhJ$-G-ZZonK z{>c@}(4d*dza~c4Xyu;wWW~Jx1Z@8fGCs6AaoZ76o@d?Xno{+JR+1k8y^EgZ%w1b& zirhp=p)cZh;JRX}EniPCt}dq@^dR+_54-ap&)KK|eam+!K=~Sl(-F{0Yl)(9Eudzz z^Oxocu!`Y_$j!fX720FR_(S7Fb!jGj%WEGI@AP4z`>W;IInuF)YPy{9tpE<6unY1N zf@CO|u5c9mNc4mDKF=hr5Ehm%lv-BK(9UVXJFB3ikLMQf=+sQ|tt}ohj*7GXg%h=n zDQv-2^1qPlmvAR$J6;>R+}TLaxfdC$p)DvrQM#L%Hy18y(DvD^`L2P8JN?Qe=NqbM)}fA? z3}HRQS?D>~M6Q~%8C2`#Rk)9ee(%P<$fvdKJ>-bC)ah_Twpc(IuX!fma3I#`xWcAk9jXkRoyRt)b zU%EX?ooBwksQ7~PUo=S*YtulIk$TNEmHRRj*PyVz=|Nq{yO#fH@5{rXUi<$eq$Jv- zV=1L56f)VhAbSWQlzj}Q2oW=+MOiDmELpRSb!=m)WY0Pn#-6NWjAa<>%=e!2Jm*yB ze9!ef|NQ>=UDwxNpX)L+pU>xB-uHdK->;>%QXh|S*TEinzCp!Ns#$JVxR>7~%Xf`1 z(Xvw|E+H#7IgR#My{%s$*9Qw2X3m78(Ix3;$+T$P$2E}M$5WzMu5FRDT78p9vLdyu zQ-er}7wIED6A_EzvK?P-r`%>w z@gdgUSFYl(57fOWVXbK!9F(_d?vAdBsx^!Y6UzqRaY89IAn!QT6ZPN&i{7kz*cXMLstJ|5~khxikNeIBJE0+Y2X>NY*=g7j0xHvf6l2Xqs~mT zR4inx^HxcLXqJV$abDPHsVLB0KH8~p743+xY*HZbRRvND8hFupmx#;6Qd;5~5R$s$ z&&z$RH~EUDljofJ$=}XsB@#Ihu%TkOee1C#8)8Mrksa-dly^LNM~7a>DRi?T2sha0 zU<7&G(okFUT_pK)A6Pbg09$gwA)O%%)ZF{NGR=oPfLjXgD?3zA4b%~RRxl8hemBIB z4tF+2E|^YX@Ws=;l!Qp5udTaKYl;xO$spfWuP6Do8Q^LN9`h(MyAHqcvS;IBuV=kz zBOjBCpYL$Mgo$p=`lR(^XWUS%v-AC~HW$K5==>@qI$iT=@Ix9zB7+>T z>hr$FYyfznfi=O9WyB|Rh`2oo$eKADgMYuE{q^@lHckeSdE zMwO4qk)Fi%nNbUa*ynHz(Ga_9oBad_E^BfAlmE4Pf;ax8e6F&8n@1d*9MCCnZ*1Kc zD^5G`cCrsm)*yK4$0-U31zj?I0)z5Z^LX%fM7|UasA}^V{~TdtcDOo#QqdmaQ#p2< zfwvR^S7G67e8zaxy}DyQA^{sEx_wJ>yHul=sF#}IR=QHOJdYv0O#k2x$+8bzP%t7# zf|_U=)D5LrYtOb#wsN_@n(A;yIqo-c)YZE0zLmqbid=edLJE=I6_VEdL6sl$q}K%t z6A{|dVU<3cx>0*noq2C~VmvFGYG{a$pxQS_lXqv!UlLp)(B(n_@vW%;=Aa9GBeq{v zd}jKx5sgi3?oDz`>^?p!yfn5f5xZdy6yjsIEoP0d-*inCYz-a=b=XDEL1N6rF&2wo zQGA4JJN)jl-pabwWGHD!IrynBkc{iH3F$gAhzcdy!vd!SEoihYX}8)t#T6NLcLGg1 zks0ZBW-m*EO6CyuOOz55waJkr!Ar?@-KG@^>nfisZPPbJLlV?J+(Repp&ggl!(sZ< zI&z(Rw^nxlJ6%Qf`~}c)hCaMdA};8O(#VTqm7^<}aR*tU;1uyXCCzPP=+1PHQgmc2 z+9ACRAA9L-hMjG!{!o(n?a;$H*ctrn?G_HjQ?&a#%qZ>m&ce$X_$qy&G*WR zfd$Snk8{R$>=58qyME=?t&SOktal%DO3DJ6=g|rcGVNr+r9kXjrE;H` zsqEk0TP(df_mGrak~7;^kfQl+Ep`w|+vzU9Ax{Q{#58C;m2{Q%#0z0wX8)ciqRaEM z$hgAt2J$m%1ffxocDpz(Wzef@!+WXe%z!d5w>Z*ODB~@kZHOvNAZhqT8()LUw0#z%Ro=Mn}bONWc)GA62$ zp&N>(C4&mZd~3j-3uAUFwondzYdUs#7=0|%fX}Sq;oF((I5j$=N&MPJAIeNHtiiG~ zF5isnLQ+kROqcTW5LxfF{Ar5eNHwknKoJHV3m+|7majybevgA!FV@enw`08_vOU=z zSrCzcodB-&Mn$kJ&a_3=f_gH$T4#P%xK}~pqHExs;-fz8`HuW>IX8pgu*lJPZ84E{ zO0G>t+^*gMX7qWfNg zTLr$Mo)AH_6Hatij{2JFI$6{%Pe?o@UTLR;?+QH=Q=E-*9IotV_iERQlS0?V8dxuV zhg2?78Hln2S};l|a_vmrZ@sPwn2+n!T_n}78JicOU9kP*R>5bjoVjQ5x!K@|D?B%n zIC#`{n`MP~+3Axauza{3IDlxe($=hf8dPc2l^;`P>n4JJvCs2--MX6s&Qh*7$eG7E zzF^Xdj{WA$Q`(Jnd+tt3i_zPPsr_cAFumM!0YY9Sc=!(mlUgaH2%n8cX(H`J6lM0b zR-9ysv0Y?bT>I8UUd_HHRX&lh7B6#QyM%sx+dvNVAeT!jEU#i^Rt+$ZwgZ`5$~3Uy z7_;5qwbzAxTFTg6rt?y2cKW=XOQNc5;b0?87OIGI37+b^jn{4n7;o7Ntj{fCC*Esh zt5sKeer-jZZ2wBtrIwyqPp2%boLV9*SmjLZkUu&teWjiKXK#`NSNO#XqwCOnycT3n zCjd;F*W1!{y_a4BK08s!Q@8_n&YYf*<_>qC3HJ%?`_yfsOM9>ox}bd398;~NljCLC zxMnXV{sy&DjMaV%8IE?`ITkM_7duSv!PfvV@|%+@l-ub2RZlpz`w5pQ|4p=s0Y+0L z^lj;w<8NmjOs-ZWLyfE=ED&l)8AGR@ULbT5_F{7p-}qbm0#wL`JHVjEejMF1%;PaU zgWfW&AluK5d|lI=mXdh$`Epu&IDuqdI;O`08!0i-gRQSAS|C575+7suk(_{*b4PL1 z>tGNj040=%H6d?Ks9^WNhVba&WKf)HZF*aUL&fceUl-mKO-I;%EjDx@?HOoO6 z$z840@;wBRX6O*N_q?;>8SQ9(9r=~;Qf)Is{nQYjbsOk#PUg`qEvI-Hz$p5DUPvY< zcM6T*_U`?9!bBz>S&bt$*K){PmyT@|^v;|!LWO7NRjcoEntTP&`}na(RC}DT3EdPT zma+G+d^=)K4%Gqz>t^twU}mqu&PFnS*@=F(=p zKZnBI!aa2sa5K>=(qSLI!AtgGY6A$fiVDU~r;N0{+}@?}L(KWu!kjpqhz0?E<})CP zSVtddT=xnmYOJ4NjWHx6tYhvxEHA=hUcr9Z|W z{7Z1mU|O=7dhY7FV9K-7kY%3QlhilWqDV0*es-Kt2laTJlr9#JR?Mwnaof%tlBr&| zjXxf=Q91E~Z;pAwK6kQsCEPr`_uEEyP{kVofm$ruL46A3zMm4VZQh;toJn(Egp9m9 zpW7}ck(<3I#$t2yp|Xfo+7$}r@O;+?Tk_>{qU}`C2x29+Cs{-w`Gqd~3;MS-=M@(SMqS^VHiAYmr z{nrHAZm}TGVFk%PjK_$%tfTDtT*TK_Ilx zH`kf+^33yo)wSvmxP`IWs*gpcNcDD{xko&%dGqxPzQ~LO?=IV>PS^5CDW|rQA-kt} z*NS50HX3VJ-#3_r#!+eCnzbN9-&vfF_`V1#U}^2~=}3|#UNh|`ushG+E}NIEWY*`p zL3(ThFtg&WlY23%M$Ja~C7F)G*WRLSN?A~seAau6%ujH0;vOs>+D`n)x0Sx)A?NTF zC?!DmcO18$YKuPyu+9goJ`D_U#zwlG!dF6uByW=U!#hXNu9KAlv7Ixr*u!rSq*>Cw zR>uRwX#t2S`StJmt12jwN!sph^WOP9G7H|mW@J3~+Q~K?<=rbkbz-haMcm#EIp=0I zw$eZaJzE6hw;WqQyG4f3pX?dY~O$V5Mx@{Ol+@XANNC zjins?hGu!a?KAYuNZnLeRAM^_wpas^AV|D^eW?DeW(SNiKQv}=ggEZFI#)_uTW*tY zkDI4;(z^9^yvDb8dL8@NwP{hos7zBTsdNv!F@}+`R$gN=CHS_zAu6OOzdY<|8nkQD@eQ5>Ti2IJH0t(wQi!yM5VR}9Z)qj zRowd4vQ=f|z({o9W6@DMx~8c+6Z`!TmR4A^=08Ry?TMdydQkhqCu~etPil_4vVWZy z!<`l=;O4h0P`q#O40#tMtUOt-c|jXs`Lw)0{6(#G zn*hD$g&pVWK=BSoZ>3Xwa-=F0z2@namT!vb)RlO+Ng9TBk(|B@B;c3FrtK2ng1Q1B z(X4xe*zcMX8kf}2%fr?xxeTF3uIy-V)tB>9hc zX|90rxH$*(Xa7DLp$v!|rka(cVafYR?5}2&`-iKGi*x=)kf@PF(k&1KqM56m;v?9Jj1DiGT%y|gKa+GGJ zm+NrT90(Yj!I9w^CA?86147P>2_PDr1b}V|A_)dEoAAnerf)oLQQq9s*-J5b0(;d3 zB4RVr0y%_&<(IEzdyHY;fI&}S)sfELu7M)c@S)|f-E$=o#_gaiz!}B6g@@(6woBj| zLyPu~E{V`8rHiB@W(e!O-8$G2*oEsm`Mj<@W%;m=N5*>RxIltuJ)7?ud{0wO`%{g3 z-c#}ZbDKsxJ3#E0MIEZgXD!t;?6jWFzxQop#T@MrF?j!)V!N8@l?uH&rco4WpuJ?S zTY*FpzHno{dW!df4}uW9hcf6|y8VtI4h$b^OeMA2D|qCM=;xsHy4LnddE-y%X5^Z7 zZ1GiF75*2@WQ-c$Vx&-2A zNnCG7LzMh5;yHEz{dD*;IK1)o7_doVSfY{_i$pPgQVqjDH;NQ<0Oq@@V~80fqwgfn`4K2 z=|_l~4u8#q+NJoA>SaJZ2I`YnHbH)TcgC*8QNCLY^NJ;Z<-H%=i5;b!h`#iQ$Ms;n z$ucte2vYDEd+forlJi@D!+!qI zS&}MlT|Dfk((~#SuRap!;8g*7#bx=Uzl7scbnY;p1`s#T$JdZS8OFiihnoo(9^cuO z@6e2WJil(#`1lGoZF@Pf^ihj>C#DparEaP^s;v4c_qn?x ze6jTdXx_@D=4@+VCmB<${CWV60bKis2r2?AQMi<;pB|uKd3dM>Ak=5H+Q7gqk<^6m zvD(g=^~~8;#P=V+cU&U9>~pp8D8=p(guYHL4~{o{9*D5krS4!aUc&l z{2^>O?yzN#!0;kfsZ2D*4}O%h^wa%=oTRQ?(?Mw0_>kx_T_e4KNj*BU-Kmw9jAw2F zfP7Zph9@#A4IJfLr?}R-yo}+DW8tHFz*6pYzBcf8X(^?4=3fppYWy1dNxM$35xcC@ z-R};1k7erBMq#_-U58@`X)e7=Wg4|vSA?B-Hqv)9I#^hYDMtaCO*Fghj3m1^;o449 ztA^mH4fZ$s@X3}aMQdFnNId-W)0fH6>uwn8s7IoLQS+LS`OCF?$w!f9P4*RrRTqYO z?mTjvX>!{%;SeDXBnsqdc@4qRa>uuzwpM7RmMF-&0()s_#k+GJ`?ybuMTeL4Xx`Ti zWZ8LXJL^c*ekBpwGFjq{n8o)hUM^|vibSEbcK{zQWIUiAr^x*-z(BGuYjf^ZHAHeP zx54LY^wFzbwYK$jo?5cm+rg?Z>6uy1_M-F^;&9aqO7%Vq6@M;{7^)SY&s;&kwhqbe zb4~E;6qSLvT@T;UR2Lq0}1q!P}F{6e)?@XnqzMT zK@^_oW-M=RLS9}Ufe6xFsH`kDX=M~o`r>|JGXpaQI3Gu}HVLl~Z8xN+Bp=aJ8!n~3 zY)@fc%LU^WXbv824Zg8*(|{_F`I|e`aa>}hUbt0M94H*j4N4BE-}fu5TW$$}!CsZ{ zrZed)g~szWC|6-weK#MHuOz6V|GFB7+;>7 zx<-W|F~daPGD6aW(MVG0n%N$Env8_&?cg4hkuIQ1q=jAWdi+kZsxtPAx^!I3=9EQL zIu=K+1_}BwJX+_7R%W)%T#ML1IGKAZQIU2{R`fO1zG_827y6QecdM4{V^&`xDrS&% zE2~G7VD}BcvRlxqj9&wfAWv2V`|sjt1{KQF7St`F^b5U*HZl@>8++BTLNE_z6AGz% zz$f32;Y?5E@q#!F%^-lZ6pT~WnsS*ZvOu{y3 z$PpO3rvV;MzZr8$)F|V%^zFMFpN3zLqEo#P48&zwIbylCMcMuLm4FiH-V4s7US`kM zqip`PjHQb}9RXa8%b!T^6mlGCw-1-iHY=1QE=aW5pBAeocNH|>rO2A>kTVanXIOX? zWux#DZ!tvK@9;UpMnJ@zLwNuWCm>7h?6!pM`KO&$p*u*ZFjIzaX@Exq9kW zxO;|*)R)^84>RfByoN<_O;lX|y-BzI;jEk5JU_T`E}=@+=F^(^(t54fXlmZ3+IYQ| zI5aqi#m~xA$utJ&uMqALks8P#2k8d#W9?t*jD;FXJMV2$NOY4c{Eiq~i{#Uf+-G)K z$#UQ9X~?mWwW+t0ooLZ|?613Ml^Pj4U#Wo=?F$z0;R|4d>erYJvPbn$NR9PutG88+$G=NseZPCgeUb zqFANX6L5J)Tct{Yq!XqkRbJ6BL~ip>iaV19;J7Y?o_Ksei1i&frIy1M?s^h(ORamF zBZkd^FWhxHU9rviamk$r%6xQg5`=i0w=qhrrgRfpb%H;%Twpk&a{aQF4BO8NJprmp z*!NK)roHJ`M?gT(jJ|MX7MCXmZ0p_tZ`?0MdnUm)iyd?Ri7q^3|IFOAoBd z-h%Rk&@NbA`VUA7XMhErH2p$G!m`^Xm-6~dtGr8&#Qa+!`v9@#^ylJzgeti>m(j; ziV+4f)THYTn664sSLyK}iPY;a4>%tJLQj8ki3r$HC$UT_7I!Pj~*~AAYRh#rB{2iIx73-(XD!eap{#Y4#^%#6Pyz3GiZ1 zp6>rII^oJ8(6?VwRN{Y%E&uckCjs+ZHSEHFR)_h&K}#>h{NJGE{C_rR8;^cb*Z=zj zYn1i_kb`DATM8J0oJ7*%T@T-D`O7pgJ`;8(wEKguz6sh{WTM5Wv4Uv56uZ3Tq%N5E zw&!1tSbr`-Ao`0Q?ii(<8*kXZ)|S=~HS_}*LZ2rmnKbz;+arva1zEM(76Jqs{~jd+ zP6HiMbPpwS<@k*kAyevr@@UoC{EPoQ*xT-4qcifw;q$VE4iiRFY<vuj zU%XWR>&hE;j8TeMp1J1}>C0u_?q6qQqcB6&m@#q_`k;on$iXzG+?;VVCbOyHkD&8M z3~eMbs(R_AOn5jecFghp3AdsL6@Jws1oHCS^={k#8j$O8ed za@SuU<$sAd|Ns1^QuUpJqdy7aC~5iugY?EAaMpOp)2o-!CZsnNu0MA_3Ngu-qH;jYI;; zyUuyDz)6u*gg=YW{EV2aM>FsYos%2FP{IK8F5@z-K&F$q#tOZm-J~4FB}+9BV?{AM z;8Fec9QEU-Pw2WaH&g>F{xw~~G?)Z+63!=z8e3A*y`Sw_S{*1#1FF^+Db9ovr={+< zI{2Af)5Mt53=1GToN@a_bc9CIZq!Oi$(A;}(%1?Ln{&A0=u2|nF>4gbv znEiW(06?zeK!t%y$ZxN$WToK4ax-{z;NYWi-`}#Y**f;EObmgZ6GCZk?($f!kL_gc p(2o=AUHZ2o_}|;jMSYaUfO{^vQT=N6;STVprmTG(b@lF({{ctGzHa~k literal 0 HcmV?d00001 diff --git a/docsource/content.md b/docsource/content.md index eb1aec6..b45b4a6 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -22,7 +22,7 @@ Before continuing, ensure that the following requirements are met: ## Configuring Command -Command Issuer enrolls certificates by submitting a POST request to the Command CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template suitable for your usecase. Additionally, you should ensure that the identity used by the Issuer/ClusterIssuer has the appropriate permissions in Command. +Command Issuer enrolls certificates by submitting a POST request to the Command CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template suitable for your use case. Additionally, you should ensure that the [identity provider](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/AuthenticateAPI.htm#AuthenticatingtotheKeyfactorAPI) used by the Issuer/ClusterIssuer has the appropriate permissions in Command. 1. **Create or identify a Certificate Authority** @@ -48,7 +48,7 @@ Command Issuer enrolls certificates by submitting a POST request to the Command In Command, Security Roles define groups of users or administrators with specific permissions. Users and subjects are identified by Claims. By adding a Claim to a Security Role, you can define what actions the user or subject can perform and what parts of the system it can interact with. - The security role will need to be added as an Allowed Requester Security Role on the Certificate Authority and Certificate Template configured in the previous two steps. + The security role will need to be added as an **Allowed Requester Security Role** on the Certificate Authority and Certificate Template configured in the previous two steps. - If you haven't created Roles and Access rules before, [this guide](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) provides a primer on these concepts in Command. @@ -95,22 +95,36 @@ Command Issuer is installed using a Helm chart. The chart is available in the [C --create-namespace ``` + Optionally, set the Docker image tag of command-cert-manager-issuer to deploy ([available tags](https://hub.docker.com/r/keyfactor/command-cert-manager-issuer/tags)) + + ```shell + helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \ + --namespace command-issuer-system \ + --set "image.tag=latest" \ + --create-namespace + ``` + > The Helm chart installs the Command Issuer CRDs by default. The CRDs can be installed manually with the `make install` target. # Authentication -Command Issuer supports authentication to Command using one of the following methods: +## Explicit Credentials -- Basic Authentication (username and password) -- OAuth 2.0 "client credentials" token flow (sometimes called two-legged OAuth 2.0) +Command Issuer supports explicit credentials authentication to Command using one of the following methods: + +- [Basic Authentication](#basic-auth) (username and password) +- [OAuth 2.0 "client credentials" token flow](#oauth) (sometimes called two-legged OAuth 2.0) These credentials must be configured using a Kubernetes Secret. By default, the secret is expected to exist in the same namespace as the issuer controller (`command-issuer-system` by default). > Command Issuer can read secrets in the Issuer namespace if `--set "secretConfig.useClusterRoleForSecretAccess=true"` flag is set when installing the Helm chart. +## Ambient Credentials + Command Issuer also supports ambient authentication, where a token is fetched from an Authorization Server using a cloud provider's auth infrastructure and passed to Command directly. The following methods are supported: -- Managed Identity Using Azure Entra ID Workload Identity (if running in [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service)) +- [Managed Identity Using Azure Entra ID Workload Identity](./docs/ambient-providers/azure.md) (if running in [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service)) +- [Managed Identity Using Google Kubernetes Engine](./docs/ambient-providers/google.md) (if running in [GKE](https://cloud.google.com/kubernetes-engine)) ## Basic Auth @@ -151,157 +165,11 @@ kubectl -n command-issuer-system create secret generic command-secret \ ## Managed Identity Using Azure Entra ID Workload Identity (AKS) -Azure Entra ID workload identity in Azure Kubernetes Service (AKS) allows Command Issuer to exchange a Kubernetes ServiceAccount Token for an Azure Entra ID access token, which is then used to authenticate to Command. - -At this time, Azure Kuberentes Services workload identity federation is best supported by [User Assigned Managed Identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp). Other identity solutions such as Azure AD Service Principals are not supported. - -Here is a guide on how to use Azure User Assigned Managed Identities to authenticate your AKS workload with your Keyfactor Command instance. - -1. Reconfigure the AKS cluster to enable workload identity federation. - - ```shell - export CLUSTER_NAME= - export RESOURCE_GROUP= - az aks update \ - --name ${CLUSTER_NAME} \ - --resource-group ${RESOURCE_GROUP} \ - --enable-oidc-issuer \ - --enable-workload-identity - ``` - - > The [Azure Workload Identity extension can be installed on non-AKS or self-managed clusters](https://azure.github.io/azure-workload-identity/docs/installation.html) if you're not using AKS. - > - > Refer to the [AKS documentation](https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster) for more information on the `--enable-workload-identity` feature. - -2. Create a User Assigned Managed Identity in Azure. - - ```shell - export IDENTITY_NAME=command-issuer - az identity create --name "${IDENTITY_NAME}" --resource-group "${RESOURCE_GROUP}" - ``` - > Read more about [the `az identity` command](https://learn.microsoft.com/en-us/cli/azure/identity?view=azure-cli-latest). - -3. Reconfigure or deploy Command Issuer with extra labels for the Azure Workload Identity webhook, which will result in the Command Issuer controller Pod having an extra volume containing a Kubernetes ServiceAccount token which it will exchange for a token from Azure. - - ```shell - export UAMI_CLIENT_ID=$(az identity show --name $IDENTITY_NAME --resource-group $RESOURCE_GROUP --query clientId --output tsv) - - echo "Identity Client ID: ${UAMI_CLIENT_ID}" - - helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \ - --namespace command-issuer-system \ - --create-namespace \ - --set "fullnameOverride=command-cert-manager-issuer" \ - --set-string "podLabels.azure\.workload\.identity/use=true" \ - --set-string "serviceAccount.labels.azure\.workload\.identity/use=true" \ - --set-string "serviceAccount.annotations.azure\.workload\.identity/client-id=${UAMI_CLIENT_ID}" - ``` - - If successful, the Command Issuer Pod will have new environment variables and the Azure WI ServiceAccount token as a projected volume: - - ```shell - kubectl -n command-issuer-system describe pod - ``` - - ```shell - Containers: - command-cert-manager-issuer: - ... - Environment: - AZURE_CLIENT_ID: - AZURE_TENANT_ID: - AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/azure/tokens/azure-identity-token - AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/ - Mounts: - /var/run/secrets/azure/tokens from azure-identity-token (ro) - /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-6rmzz (ro) - ... - Volumes: - ... - azure-identity-token: - Type: Projected (a volume that contains injected data from multiple sources) - TokenExpirationSeconds: 3600 - ``` - - > Refer to [Azure Workload Identity docs](https://azure.github.io/azure-workload-identity/docs/installation/mutating-admission-webhook.html) more information on the role of the Mutating Admission Webhook. - -4. Associate a Federated Identity Credential (FIC) with the User Assigned Managed Identity. The FIC allows Command Issuer to act on behalf of the Managed Identity by telling Azure to expect: - - The `iss` claim of the ServiceAccount token to match the cluster's OIDC Issuer. Azure will also use the Issuer URL to download the JWT signing certificate. - - The `sub` claim of the ServiceAccount token to match the ServiceAccount's name and namespace. - - ```shell - export SERVICE_ACCOUNT_NAME=command-cert-manager-issuer # This is the default Kubernetes ServiceAccount used by the Command Issuer controller. - export SERVICE_ACCOUNT_NAMESPACE=command-issuer-system # This is the default namespace for Command Issuer used in this doc. - - export SERVICE_ACCOUNT_ISSUER=$(az aks show --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME --query "oidcIssuerProfile.issuerUrl" -o tsv) - az identity federated-credential create \ - --name "${IDENTITY_NAME}-federated-credentials" \ - --identity-name "${IDENTITY_NAME}" \ - --resource-group "${RESOURCE_GROUP}" \ - --issuer "${SERVICE_ACCOUNT_ISSUER}" \ - --subject "system:serviceaccount:${SERVICE_ACCOUNT_NAMESPACE}:${SERVICE_ACCOUNT_NAME}" \ - --audiences "api://AzureADTokenExchange" - ``` - - > Read more about [Workload Identity federation](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation) in the Entra ID documentation. - > - > Read more about [the `az identity federated-credential` command](https://learn.microsoft.com/en-us/cli/azure/identity/federated-credential?view=azure-cli-latest). - -5. Get the Managed Identity's Principal ID and Entra Identity Provider Information - - ```shell - export UAMI_PRINCIPAL_ID=$(az identity show --name $IDENTITY_NAME --resource-group $RESOURCE_GROUP --query principalId --output tsv) - export CURRENT_TENANT=$(az account show --query tenantId --output tsv) - echo "UAMI Principal ID: ${UAMI_PRINCIPAL_ID}" - - echo "View then OIDC configuration for the Entra OIDC token issuer: https://login.microsoftonline.com/$CURRENT_TENANT/v2.0/.well-known/openid-configuration" - - echo "Authority: https://login.microsoftonline.com/$CURRENT_TENANT/v2.0" - ``` - - > **IMPORTANT NOTE**: The Microsoft Entra Identity Provider is associated with your Azure tenant ID. Multi-tenant Azure workloads will require a Command Identity Provider for each tenant. - -6. Add the Microsoft Entra ID as an [Identity Provider in Command](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/IdentityProviders.htm?Highlight=identity%20provider) using the identity provider information from the previous step, and [add the Managed Identity's Principal ID as an `OAuth Subject` claim to the Security Role](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) created/identified earlier. +This section has moved. Please refer to [this link](./docs/ambient-providers/azure.md) for documentation on configuring ambient credentials with AKS. ## Google Kubernetes Engine (GKE) Workload Identity -Google Kuberentes Engine (GKE) supports the ability to authenticate your GKE workloads using workload identity. - -By default, GKE clusters are assigned the [default service account](https://cloud.google.com/compute/docs/access/service-accounts#token) for your Google project. This service account is used to generate an ID token for your workload. However, you may opt to use [Workload Identity Federation](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#metadata-server) to your GKE cluster. - -1. Get the OAuth Client and Identity Provider for your GKE Cluster - - Regardless if you are using the default service account or a custom service account, the following script will help you derive your GKE cluster's OAuth Client: - - ```shell - export CLUSTER_NAME= - export GCLOUD_REGION= - export GCLOUD_PROJECT_ID=$(gcloud config get-value project) # populate with the current PROJECT_ID context - export GCLOUD_PROJECT_NUMBER=$(gcloud projects describe $GCLOUD_PROJECT_ID --format="value(projectNumber)") - - export GCLOUD_SERVICE_ACCOUNT=$(gcloud container clusters describe $CLUSTER_NAME \ - --zone $GCLOUD_REGION \ - --format="value(nodeConfig.serviceAccount)") - - if [[ "$GCLOUD_SERVICE_ACCOUNT" == "default" ]]; then - # Override service account with default compute service account - GCLOUD_SERVICE_ACCOUNT="$GCLOUD_PROJECT_NUMBER-compute@developer.gserviceaccount.com" - fi - - echo "Service account: $GCLOUD_SERVICE_ACCOUNT" - - # Get OAuth2 Client ID of service account - export GCLOUD_SERVICE_ACCOUNT_CLIENT_ID=$(gcloud iam service-accounts describe $GCLOUD_SERVICE_ACCOUNT \ - --format="value(oauth2ClientId)") - - echo "Service account OAuth2 client ID: $GCLOUD_SERVICE_ACCOUNT_CLIENT_ID" - - echo "View the OIDC configuration for Google's OIDC token issuer: https://accounts.google.com/.well-known/openid-configuration" - - echo "Authority: https://accounts.google.com" - ``` - -2. Add Google as an [Identity Provider in Command](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/IdentityProviders.htm?Highlight=identity%20provider) using the identity provider information from the previous step, and [add the Service Account's OAuth Client ID as an `OAuth Subject` claim to the Security Role](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) created/identified earlier. +This section has moved. Please refer to [this link](./docs/ambient-providers/google.md) for documentation on configuring ambient credentials with GKE. # CA Bundle @@ -331,12 +199,12 @@ For example, ClusterIssuer resources can be used to issue certificates for resou |--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------| | hostname | The hostname of the Command API Server. | | apiPath | (optional) The base path of the Command REST API. Defaults to `KeyfactorAPI`. | - | commandSecretName | The name of the Kubernetes secret containing basic auth credentials or OAuth 2.0 credentials | + | commandSecretName | (optional) The name of the Kubernetes secret containing basic auth credentials or OAuth 2.0 credentials. Omit if using ambient credentials. | | caSecretName | (optional) The name of the Kubernetes secret containing the CA certificate. Required if the Command API uses a self-signed certificate or it was signed by a CA that is not widely trusted. | | certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` | | certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. | | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. | - | scopes | (Optional) If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. | + | scopes | (Optional) Required if using ambient credentials with Azure AKS. If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. | | audience | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`. | > If a different combination of hostname/certificate authority/certificate template is required, a new Issuer or ClusterIssuer resource must be created. Each resource instantiation represents a single configuration. @@ -357,7 +225,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou spec: hostname: "$HOSTNAME" apiPath: "/KeyfactorAPI" # Preceding & trailing slashes are handled automatically - commandSecretName: "command-secret" # references the secret created above + commandSecretName: "command-secret" # references the secret created above. Omit if using ambient credentials. caSecretName: "command-ca-secret" # references the secret created above # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required @@ -383,7 +251,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou spec: hostname: "$HOSTNAME" apiPath: "/KeyfactorAPI" # Preceding & trailing slashes are handled automatically - commandSecretName: "command-secret" # references the secret created above + commandSecretName: "command-secret" # references the secret created above. Omit if using ambient credentials. caSecretName: "command-ca-secret" # references the secret created above # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required From 4a96e969f8d93475070591138af209779f034bed Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Wed, 28 May 2025 15:11:05 -0400 Subject: [PATCH 06/32] feat(logs): Add more logging to claims output --- internal/command/client.go | 9 +++++++-- internal/command/client_test.go | 33 ++++++++++++++++++++++++--------- 2 files changed, 31 insertions(+), 11 deletions(-) diff --git a/internal/command/client.go b/internal/command/client.go index 3514117..09a6f6a 100644 --- a/internal/command/client.go +++ b/internal/command/client.go @@ -129,7 +129,7 @@ func (a *azure) GetAccessToken(ctx context.Context) (string, error) { log.Info("==== BEGIN DEBUG: DefaultAzureCredential JWT ======") - printClaims(log, tokenString, []string{"aud", "azp", "iss", "sub", "oid"}) + printClaims(log, tokenString, []string{"aud", "appid", "azp", "iss", "sub", "oid"}) log.Info("==== END DEBUG: DefaultAzureCredential JWT ======") } @@ -239,11 +239,16 @@ func printClaims(log logr.Logger, token string, claimsToPrint []string) error { claims, _ := tokenRaw.Claims.(jwt.MapClaims) + // To assist with troubleshooting, only print access token claims relevant to Command configuration for _, key := range claimsToPrint { if value, ok := claims[key]; ok { - log.Info(fmt.Sprintf(" %s: %s", key, value)) + log.Info(fmt.Sprintf("\t%s: %s", key, value)) } } + if issuer, err := claims.GetIssuer(); err != nil { + log.Info(fmt.Sprintf("\nNOTE: If you are receiving a HTTP 401 on requests to Command, make sure an identity provider in Command is configured with '%s' as the authority.\nThe discovery endpoint for your issuer can be found at %s/.well-known/openid-configuration.", issuer, issuer)) + } + return nil } diff --git a/internal/command/client_test.go b/internal/command/client_test.go index 5b639cc..84fa006 100644 --- a/internal/command/client_test.go +++ b/internal/command/client_test.go @@ -9,6 +9,7 @@ import ( ) func TestPrintClaims(t *testing.T) { + testLogger := testr.New(t) t.Run("valid jwt returns no error", func(t *testing.T) { // Sample JWT with dummy claims (no signature needed for ParseUnverified) claims := jwt.MapClaims{ @@ -18,27 +19,41 @@ func TestPrintClaims(t *testing.T) { } token := createUnsignedJWT(t, claims) - // Use testr logger - testLogger := testr.New(t) + // Call the function + err := printClaims(testLogger, token, []string{"aud", "iss", "sub"}) + assert.NoError(t, err) + }) + + t.Run("jwt with no issuer does not error", func(t *testing.T) { + // Sample JWT with dummy claims (no signature needed for ParseUnverified) + claims := jwt.MapClaims{ + "aud": "api://1234", + "sub": "user-id", + } + token := createUnsignedJWT(t, claims) // Call the function err := printClaims(testLogger, token, []string{"aud", "iss", "sub"}) assert.NoError(t, err) }) - t.Run("invalid jwt returns an error", func(t *testing.T) { - // Use testr logger - testLogger := testr.New(t) + t.Run("jwt with empty claims does not error", func(t *testing.T) { + // Sample JWT with dummy claims (no signature needed for ParseUnverified) + claims := jwt.MapClaims{} + token := createUnsignedJWT(t, claims) + + // Call the function + err := printClaims(testLogger, token, []string{"aud", "iss", "sub"}) + assert.NoError(t, err) + }) + t.Run("invalid jwt returns an error", func(t *testing.T) { // Call the function err := printClaims(testLogger, "abcdefghijklmnop", []string{"aud", "iss", "sub"}) assert.Error(t, err) }) - t.Run("jwt with no claims returns error", func(t *testing.T) { - // Use testr logger - testLogger := testr.New(t) - + t.Run("jwt with empty payload returns error", func(t *testing.T) { // Call the function err := printClaims(testLogger, "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0..", []string{"aud", "iss", "sub"}) assert.Error(t, err) From 69c219c71eecb3eade0216fc86613aef6cf9f603 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Wed, 28 May 2025 15:27:49 -0400 Subject: [PATCH 07/32] chore(actions): Fix timeout issue --- .github/workflows/keyfactor-bootstrap-workflow.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/keyfactor-bootstrap-workflow.yml b/.github/workflows/keyfactor-bootstrap-workflow.yml index c24a986..dcfe30e 100644 --- a/.github/workflows/keyfactor-bootstrap-workflow.yml +++ b/.github/workflows/keyfactor-bootstrap-workflow.yml @@ -14,10 +14,10 @@ jobs: build: name: Build and Lint runs-on: ubuntu-latest - timeout-minutes: 5 + timeout-minutes: 8 steps: - - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 + - uses: actions/checkout@v4 + - uses: actions/setup-go@v4.2.0 with: go-version-file: 'go.mod' cache: true @@ -35,9 +35,9 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + uses: actions/checkout@v4 - name: Set up Go 1.x - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 + uses: actions/setup-go@4.2.0 with: go-version-file: 'go.mod' cache: true From 4f1bfe4e9106a5500e85fb06bcdf27144bcfd117 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Wed, 28 May 2025 15:30:42 -0400 Subject: [PATCH 08/32] chore(actions): Fix timeout issue --- .github/workflows/keyfactor-bootstrap-workflow.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/keyfactor-bootstrap-workflow.yml b/.github/workflows/keyfactor-bootstrap-workflow.yml index dcfe30e..dbaa654 100644 --- a/.github/workflows/keyfactor-bootstrap-workflow.yml +++ b/.github/workflows/keyfactor-bootstrap-workflow.yml @@ -17,7 +17,7 @@ jobs: timeout-minutes: 8 steps: - uses: actions/checkout@v4 - - uses: actions/setup-go@v4.2.0 + - uses: actions/setup-go@v4.2.1 with: go-version-file: 'go.mod' cache: true @@ -37,7 +37,7 @@ jobs: - name: Checkout uses: actions/checkout@v4 - name: Set up Go 1.x - uses: actions/setup-go@4.2.0 + uses: actions/setup-go@v4.2.1 with: go-version-file: 'go.mod' cache: true From 56376d2e7fbdf799ca23a1bafd48272b7649030e Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Wed, 28 May 2025 19:35:51 +0000 Subject: [PATCH 09/32] Update generated docs --- README.md | 180 ++++++++---------------------------------------------- 1 file changed, 24 insertions(+), 156 deletions(-) diff --git a/README.md b/README.md index a82e1b2..6eb2ff5 100644 --- a/README.md +++ b/README.md @@ -55,7 +55,7 @@ Before continuing, ensure that the following requirements are met: ## Configuring Command -Command Issuer enrolls certificates by submitting a POST request to the Command CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template suitable for your usecase. Additionally, you should ensure that the identity used by the Issuer/ClusterIssuer has the appropriate permissions in Command. +Command Issuer enrolls certificates by submitting a POST request to the Command CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template suitable for your use case. Additionally, you should ensure that the [identity provider](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/AuthenticateAPI.htm#AuthenticatingtotheKeyfactorAPI) used by the Issuer/ClusterIssuer has the appropriate permissions in Command. 1. **Create or identify a Certificate Authority** @@ -81,7 +81,7 @@ Command Issuer enrolls certificates by submitting a POST request to the Command In Command, Security Roles define groups of users or administrators with specific permissions. Users and subjects are identified by Claims. By adding a Claim to a Security Role, you can define what actions the user or subject can perform and what parts of the system it can interact with. - The security role will need to be added as an Allowed Requester Security Role on the Certificate Authority and Certificate Template configured in the previous two steps. + The security role will need to be added as an **Allowed Requester Security Role** on the Certificate Authority and Certificate Template configured in the previous two steps. - If you haven't created Roles and Access rules before, [this guide](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) provides a primer on these concepts in Command. @@ -127,22 +127,36 @@ Command Issuer is installed using a Helm chart. The chart is available in the [C --create-namespace ``` + Optionally, set the Docker image tag of command-cert-manager-issuer to deploy ([available tags](https://hub.docker.com/r/keyfactor/command-cert-manager-issuer/tags)) + + ```shell + helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \ + --namespace command-issuer-system \ + --set "image.tag=latest" \ + --create-namespace + ``` + > The Helm chart installs the Command Issuer CRDs by default. The CRDs can be installed manually with the `make install` target. # Authentication -Command Issuer supports authentication to Command using one of the following methods: +## Explicit Credentials -- Basic Authentication (username and password) -- OAuth 2.0 "client credentials" token flow (sometimes called two-legged OAuth 2.0) +Command Issuer supports explicit credentials authentication to Command using one of the following methods: + +- [Basic Authentication](#basic-auth) (username and password) +- [OAuth 2.0 "client credentials" token flow](#oauth) (sometimes called two-legged OAuth 2.0) These credentials must be configured using a Kubernetes Secret. By default, the secret is expected to exist in the same namespace as the issuer controller (`command-issuer-system` by default). > Command Issuer can read secrets in the Issuer namespace if `--set "secretConfig.useClusterRoleForSecretAccess=true"` flag is set when installing the Helm chart. +## Ambient Credentials + Command Issuer also supports ambient authentication, where a token is fetched from an Authorization Server using a cloud provider's auth infrastructure and passed to Command directly. The following methods are supported: -- Managed Identity Using Azure Entra ID Workload Identity (if running in [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service)) +- [Managed Identity Using Azure Entra ID Workload Identity](./docs/ambient-providers/azure.md) (if running in [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service)) +- [Managed Identity Using Google Kubernetes Engine](./docs/ambient-providers/google.md) (if running in [GKE](https://cloud.google.com/kubernetes-engine)) ## Basic Auth @@ -183,157 +197,11 @@ kubectl -n command-issuer-system create secret generic command-secret \ ## Managed Identity Using Azure Entra ID Workload Identity (AKS) -Azure Entra ID workload identity in Azure Kubernetes Service (AKS) allows Command Issuer to exchange a Kubernetes ServiceAccount Token for an Azure Entra ID access token, which is then used to authenticate to Command. - -At this time, Azure Kuberentes Services workload identity federation is best supported by [User Assigned Managed Identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp). Other identity solutions such as Azure AD Service Principals are not supported. - -Here is a guide on how to use Azure User Assigned Managed Identities to authenticate your AKS workload with your Keyfactor Command instance. - -1. Reconfigure the AKS cluster to enable workload identity federation. - - ```shell - export CLUSTER_NAME= - export RESOURCE_GROUP= - az aks update \ - --name ${CLUSTER_NAME} \ - --resource-group ${RESOURCE_GROUP} \ - --enable-oidc-issuer \ - --enable-workload-identity - ``` - - > The [Azure Workload Identity extension can be installed on non-AKS or self-managed clusters](https://azure.github.io/azure-workload-identity/docs/installation.html) if you're not using AKS. - > - > Refer to the [AKS documentation](https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster) for more information on the `--enable-workload-identity` feature. - -2. Create a User Assigned Managed Identity in Azure. - - ```shell - export IDENTITY_NAME=command-issuer - az identity create --name "${IDENTITY_NAME}" --resource-group "${RESOURCE_GROUP}" - ``` - > Read more about [the `az identity` command](https://learn.microsoft.com/en-us/cli/azure/identity?view=azure-cli-latest). - -3. Reconfigure or deploy Command Issuer with extra labels for the Azure Workload Identity webhook, which will result in the Command Issuer controller Pod having an extra volume containing a Kubernetes ServiceAccount token which it will exchange for a token from Azure. - - ```shell - export UAMI_CLIENT_ID=$(az identity show --name $IDENTITY_NAME --resource-group $RESOURCE_GROUP --query clientId --output tsv) - - echo "Identity Client ID: ${UAMI_CLIENT_ID}" - - helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \ - --namespace command-issuer-system \ - --create-namespace \ - --set "fullnameOverride=command-cert-manager-issuer" \ - --set-string "podLabels.azure\.workload\.identity/use=true" \ - --set-string "serviceAccount.labels.azure\.workload\.identity/use=true" \ - --set-string "serviceAccount.annotations.azure\.workload\.identity/client-id=${UAMI_CLIENT_ID}" - ``` - - If successful, the Command Issuer Pod will have new environment variables and the Azure WI ServiceAccount token as a projected volume: - - ```shell - kubectl -n command-issuer-system describe pod - ``` - - ```shell - Containers: - command-cert-manager-issuer: - ... - Environment: - AZURE_CLIENT_ID: - AZURE_TENANT_ID: - AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/azure/tokens/azure-identity-token - AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/ - Mounts: - /var/run/secrets/azure/tokens from azure-identity-token (ro) - /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-6rmzz (ro) - ... - Volumes: - ... - azure-identity-token: - Type: Projected (a volume that contains injected data from multiple sources) - TokenExpirationSeconds: 3600 - ``` - - > Refer to [Azure Workload Identity docs](https://azure.github.io/azure-workload-identity/docs/installation/mutating-admission-webhook.html) more information on the role of the Mutating Admission Webhook. - -4. Associate a Federated Identity Credential (FIC) with the User Assigned Managed Identity. The FIC allows Command Issuer to act on behalf of the Managed Identity by telling Azure to expect: - - The `iss` claim of the ServiceAccount token to match the cluster's OIDC Issuer. Azure will also use the Issuer URL to download the JWT signing certificate. - - The `sub` claim of the ServiceAccount token to match the ServiceAccount's name and namespace. - - ```shell - export SERVICE_ACCOUNT_NAME=command-cert-manager-issuer # This is the default Kubernetes ServiceAccount used by the Command Issuer controller. - export SERVICE_ACCOUNT_NAMESPACE=command-issuer-system # This is the default namespace for Command Issuer used in this doc. - - export SERVICE_ACCOUNT_ISSUER=$(az aks show --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME --query "oidcIssuerProfile.issuerUrl" -o tsv) - az identity federated-credential create \ - --name "${IDENTITY_NAME}-federated-credentials" \ - --identity-name "${IDENTITY_NAME}" \ - --resource-group "${RESOURCE_GROUP}" \ - --issuer "${SERVICE_ACCOUNT_ISSUER}" \ - --subject "system:serviceaccount:${SERVICE_ACCOUNT_NAMESPACE}:${SERVICE_ACCOUNT_NAME}" \ - --audiences "api://AzureADTokenExchange" - ``` - - > Read more about [Workload Identity federation](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation) in the Entra ID documentation. - > - > Read more about [the `az identity federated-credential` command](https://learn.microsoft.com/en-us/cli/azure/identity/federated-credential?view=azure-cli-latest). - -5. Get the Managed Identity's Principal ID and Entra Identity Provider Information - - ```shell - export UAMI_PRINCIPAL_ID=$(az identity show --name $IDENTITY_NAME --resource-group $RESOURCE_GROUP --query principalId --output tsv) - export CURRENT_TENANT=$(az account show --query tenantId --output tsv) - echo "UAMI Principal ID: ${UAMI_PRINCIPAL_ID}" - - echo "View then OIDC configuration for the Entra OIDC token issuer: https://login.microsoftonline.com/$CURRENT_TENANT/v2.0/.well-known/openid-configuration" - - echo "Authority: https://login.microsoftonline.com/$CURRENT_TENANT/v2.0" - ``` - - > **IMPORTANT NOTE**: The Microsoft Entra Identity Provider is associated with your Azure tenant ID. Multi-tenant Azure workloads will require a Command Identity Provider for each tenant. - -6. Add the Microsoft Entra ID as an [Identity Provider in Command](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/IdentityProviders.htm?Highlight=identity%20provider) using the identity provider information from the previous step, and [add the Managed Identity's Principal ID as an `OAuth Subject` claim to the Security Role](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) created/identified earlier. +This section has moved. Please refer to [this link](./docs/ambient-providers/azure.md) for documentation on configuring ambient credentials with AKS. ## Google Kubernetes Engine (GKE) Workload Identity -Google Kuberentes Engine (GKE) supports the ability to authenticate your GKE workloads using workload identity. - -By default, GKE clusters are assigned the [default service account](https://cloud.google.com/compute/docs/access/service-accounts#token) for your Google project. This service account is used to generate an ID token for your workload. However, you may opt to use [Workload Identity Federation](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#metadata-server) to your GKE cluster. - -1. Get the OAuth Client and Identity Provider for your GKE Cluster - - Regardless if you are using the default service account or a custom service account, the following script will help you derive your GKE cluster's OAuth Client: - - ```shell - export CLUSTER_NAME= - export GCLOUD_REGION= - export GCLOUD_PROJECT_ID=$(gcloud config get-value project) # populate with the current PROJECT_ID context - export GCLOUD_PROJECT_NUMBER=$(gcloud projects describe $GCLOUD_PROJECT_ID --format="value(projectNumber)") - - export GCLOUD_SERVICE_ACCOUNT=$(gcloud container clusters describe $CLUSTER_NAME \ - --zone $GCLOUD_REGION \ - --format="value(nodeConfig.serviceAccount)") - - if [[ "$GCLOUD_SERVICE_ACCOUNT" == "default" ]]; then - # Override service account with default compute service account - GCLOUD_SERVICE_ACCOUNT="$GCLOUD_PROJECT_NUMBER-compute@developer.gserviceaccount.com" - fi - - echo "Service account: $GCLOUD_SERVICE_ACCOUNT" - - # Get OAuth2 Client ID of service account - export GCLOUD_SERVICE_ACCOUNT_CLIENT_ID=$(gcloud iam service-accounts describe $GCLOUD_SERVICE_ACCOUNT \ - --format="value(oauth2ClientId)") - - echo "Service account OAuth2 client ID: $GCLOUD_SERVICE_ACCOUNT_CLIENT_ID" - - echo "View the OIDC configuration for Google's OIDC token issuer: https://accounts.google.com/.well-known/openid-configuration" - - echo "Authority: https://accounts.google.com" - ``` - -2. Add Google as an [Identity Provider in Command](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/IdentityProviders.htm?Highlight=identity%20provider) using the identity provider information from the previous step, and [add the Service Account's OAuth Client ID as an `OAuth Subject` claim to the Security Role](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) created/identified earlier. +This section has moved. Please refer to [this link](./docs/ambient-providers/google.md) for documentation on configuring ambient credentials with GKE. # CA Bundle @@ -363,12 +231,12 @@ For example, ClusterIssuer resources can be used to issue certificates for resou |--------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------| | hostname | The hostname of the Command API Server. | | apiPath | (optional) The base path of the Command REST API. Defaults to `KeyfactorAPI`. | - | commandSecretName | The name of the Kubernetes secret containing basic auth credentials or OAuth 2.0 credentials | + | commandSecretName | (optional) The name of the Kubernetes secret containing basic auth credentials or OAuth 2.0 credentials. Omit if using ambient credentials. | | caSecretName | (optional) The name of the Kubernetes secret containing the CA certificate. Required if the Command API uses a self-signed certificate or it was signed by a CA that is not widely trusted. | | certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` | | certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. | | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. | - | scopes | (Optional) If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. | + | scopes | (Optional) Required if using ambient credentials with Azure AKS. If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. | | audience | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`. | > If a different combination of hostname/certificate authority/certificate template is required, a new Issuer or ClusterIssuer resource must be created. Each resource instantiation represents a single configuration. From 2ff72db430a156fc9d84b0f6b07018ae746c5035 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Wed, 28 May 2025 15:51:53 -0400 Subject: [PATCH 10/32] chore(docs): Refine the examples --- docs/ambient-providers/azure.md | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/docs/ambient-providers/azure.md b/docs/ambient-providers/azure.md index 5bdd189..06b38c1 100644 --- a/docs/ambient-providers/azure.md +++ b/docs/ambient-providers/azure.md @@ -12,9 +12,9 @@ This documentation is for instructions on using ambient credentials within Azure There are two types of [managed identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview#managed-identity-types) that your Azure AKS workload may use: - System-assigned managed identity (MSI) - - Automatically created and managed by Azure at the cluster level. This identity **can not** be shared with other Azure resources. + - Automatically created and managed by Azure at the cluster level. This identity **can not** be shared with other Azure resources. This is used by default. - User-assigned managed identity (UAMI) - - Created and managed by you. Identity **can** be shared with other Azure resources and associated with Kubernetes ServiceAccounts via Azure AD Workload Identity. + - Created and managed by you. Identity **can** be shared with other Azure resources and associated with Kubernetes ServiceAccounts via Azure AD Workload Identity. Requires explicit workload identity configuration (show below). Since you are using ambient credentials generated by your Azure AKS workload and targeting these credentials for your Command instance, you will need to create an [Azure App Registration](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app). We will walk through App Registration configuration in this document. @@ -27,7 +27,12 @@ By default, your AKS cluster is configured to use system-assigned managed identi 1. Create an Azure App Registration. [Installation steps](#azure-app-registration) 1. Deploy Issuer or ClusterIssuer Resource. [Installation steps](../../README.md#creating-issuer-and-clusterissuer-resources) - To use ambient credentials, do not supply a `commandSecretName` to your issuer's specification. - - **IMPORTANT**: Fill in the `scopes` in your issuer's specification with the Application ID URI of your App Registration, suffixed with `./default`. (i.e. `scopes: api://your-app-registration-endpoint/.default`) + - **IMPORTANT**: Fill in the `scopes` in your issuer's specification with the Application ID URI of your App Registration, suffixed with `./default`. Example: + ```yaml + # Example issuer configuration + spec: + scopes: "api://your-app-registration-id/.default" + ``` 1. Add the system-assigned managed identity object ID to a security claim in Keyfactor Command ```bash export AKS_CLUSTER_RESOURCE_GROUP="" # the resource group your AKS cluster is deployed to @@ -46,6 +51,8 @@ By default, your AKS cluster is configured to use system-assigned managed identi echo "Authority: https://login.microsoftonline.com/$CURRENT_TENANT/v2.0" ``` + > **Note**: AKS workloads inherit the kubelet's managed identity, not the cluster's control plane identity. This is why we use `identityProfile.kubeletidentity.objectId` rather than `identity.principalId`. + You can map the object ID to an OAuth Subject or OAuth Object ID security claim in Keyfactor Command. Make sure the [security claim is associated to a security role](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) with the required permissions. Please refer to the [Configuring Command](../../README.md#configuring-command) **Configure Command Security Roles and Claims** section for security role requirements. Make sure an identity provider is configured in Keyfactor Command with the authority set to the authority output above. @@ -156,7 +163,12 @@ User-assigned managed identity configuration is more involved, but allows the id 1. Create an Azure App Registration. [Installation steps](#azure-app-registration) 1. Deploy Issuer or ClusterIssuer Resource. [Installation steps](../../README.md#creating-issuer-and-clusterissuer-resources) - To use ambient credentials, do not supply a `commandSecretName` to your issuer's specification. - - **IMPORTANT**: Fill in the `scopes` in your issuer's specification with the Application ID URI of your App Registration, suffixed with `./default`. (i.e. `scopes: api://your-app-registration-endpoint/.default`) + - **IMPORTANT**: Fill in the `scopes` in your issuer's specification with the Application ID URI of your App Registration, suffixed with `./default`. Example: + ```yaml + # Example issuer configuration + spec: + scopes: "api://your-app-registration-id/.default" + ``` 1. Add the user-assigned managed identity principal ID to a security claim in Keyfactor Command ```shell export UAMI_PRINCIPAL_ID=$(az identity show --name $UAMI_IDENTITY_NAME --resource-group $AKS_CLUSTER_RESOURCE_GROUP --query principalId --output tsv) From 4877e003e6ab36c5cf7f5fa62b24cab8c8cfd259 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Fri, 30 May 2025 14:01:07 -0400 Subject: [PATCH 11/32] chore(docs): add more documentation around using Azure AKS --- CHANGELOG.md | 59 ++++++++--------- docs/ambient-providers/azure.md | 111 ++++++++++++++++++++++++++++++-- docsource/content.md | 30 ++++++++- internal/command/command.go | 4 ++ 4 files changed, 168 insertions(+), 36 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 268ebff..e6fc97b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,23 +1,27 @@ -# v1.0.4 -## Features -* feat(signer): Signer recognizes `metadata.command-issuer.keyfactor.com/: ` annotations on the CertificateRequest resource and uses them to populate certificate metadata in Command. -* feat(release): Container build and release now uses GitHub Actions. +# v2.1.1 ## Fixes -* fix(helm): CRDs now correspond to correct values for the `command-issuer`. -* fix(helm): Signer Helm Chart now includes a `secureMetrics` value to enable/disable sidecar RBAC container for further protection of the `/metrics` endpoint. -* fix(signer): Signer now returns CA chain bytes instead of appending to the leaf certificate. -* fix(role): Removed permissions for `configmaps` resource types for the `leader-election-role` role. +- Update Helm chart deployment template to resolve Docker image metadata issue. -# v1.0.5 +## Chores +- Update documentation for more clear instructions on deploying workloads to Azure Kubernetes Service and Google Kubernetes Engine, as well as permissions needed on Command Security Roles. -## Features -* feat(controller): Implement Kubernetes `client-go` REST client for Secret/ConfigMap retrieval to bypass `controller-runtime` caching system. This enables the reconciler to retrieve Secret and ConfigMap resources at the namespace scope with only namespace-level permissions. +# v2.1.0 ## Fixes -* fix(helm): Add configuration flag to configure chart to either grant cluster-scoped or namespace-scoped access to Secret and ConfigMap API -* fix(controller): Add logic to read secret from reconciler namespace or Issuer namespace depending on Helm configuration. +- Updated library golang.org/x/crypto to version v0.33.0 to address authorization bypass vulnerability (https://github.com/advisories/GHSA-v778-237x-gjrc) +- Bug fix for Google ambient credentials + +# v2.0.2 + +## Fixes +- Bug fix in Helm chart release action + +# v2.0.1 + +## Fixes +- Change Helm release trigger from `v*` to `release-*` to support Keyfactor Bootstrap Workflow # v2.0.0 @@ -33,26 +37,23 @@ - Refactor unit tests to use fake Command API instead of requiring live Command server. - Write e2e integration test. -# v2.0.1 - -## Fixes -- Change Helm release trigger from `v*` to `release-*` to support Keyfactor Bootstrap Workflow +# v1.0.5 -# v2.0.2 +## Features +* feat(controller): Implement Kubernetes `client-go` REST client for Secret/ConfigMap retrieval to bypass `controller-runtime` caching system. This enables the reconciler to retrieve Secret and ConfigMap resources at the namespace scope with only namespace-level permissions. ## Fixes -- Bug fix in Helm chart release action - -# v2.1.0 +* fix(helm): Add configuration flag to configure chart to either grant cluster-scoped or namespace-scoped access to Secret and ConfigMap API +* fix(controller): Add logic to read secret from reconciler namespace or Issuer namespace depending on Helm configuration. -## Fixes -- Updated library golang.org/x/crypto to version v0.33.0 to address authorization bypass vulnerability (https://github.com/advisories/GHSA-v778-237x-gjrc) -- Bug fix for Google ambient credentials +# v1.0.4 -# v2.1.1 +## Features +* feat(signer): Signer recognizes `metadata.command-issuer.keyfactor.com/: ` annotations on the CertificateRequest resource and uses them to populate certificate metadata in Command. +* feat(release): Container build and release now uses GitHub Actions. ## Fixes -- Update Helm chart deployment template to resolve Docker image metadata issue. - -## Chores -- Update documentation for more clear instructions on deploying workloads to Azure Kubernetes Service and Google Kubernetes Engine, as well as permissions needed on Command Security Roles. +* fix(helm): CRDs now correspond to correct values for the `command-issuer`. +* fix(helm): Signer Helm Chart now includes a `secureMetrics` value to enable/disable sidecar RBAC container for further protection of the `/metrics` endpoint. +* fix(signer): Signer now returns CA chain bytes instead of appending to the leaf certificate. +* fix(role): Removed permissions for `configmaps` resource types for the `leader-election-role` role. diff --git a/docs/ambient-providers/azure.md b/docs/ambient-providers/azure.md index 06b38c1..99e358b 100644 --- a/docs/ambient-providers/azure.md +++ b/docs/ambient-providers/azure.md @@ -18,6 +18,11 @@ There are two types of [managed identities](https://learn.microsoft.com/en-us/en Since you are using ambient credentials generated by your Azure AKS workload and targeting these credentials for your Command instance, you will need to create an [Azure App Registration](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app). We will walk through App Registration configuration in this document. +## MSI vs UAMI: Which to use + +While system-assigned managed identity (MSI) is easy to use and enabled by default, user-assigned managed identity (UAMI) is the ***recommended identity type*** to use for your workload. UAMI identities can be shared with other AKS clusters and workloads, and offer more control over how the identity is used. If your app registration [requires a role assignment](#app-registration-assignment-requirement), you **must** use a UAMI. An MSI **cannot** be assigned to an app registration role. + + ## System-Assigned Managed Identity (MSI) By default, your AKS cluster is configured to use system-assigned managed identity. Your workload should automatically use the identity assigned to the cluster. You will need to set up the scope of the issuer to reference an app registration. Lastly, you will need to make sure the object ID of the managed identity is associated to a security claim in Keyfactor Command. @@ -187,7 +192,7 @@ User-assigned managed identity configuration is more involved, but allows the id ## Azure App Registration -The identity server that generates the access token from DefaultAzureCredentials requires a valid scope. The access token is being used for authorization on a resource outside of Azure (Keyfactor Command), so an app registration for Entra AD to represent an external application. +The identity server that generates the access token from DefaultAzureCredentials requires a valid scope. The scope supplied to DefaultAzureCredentials sets the audience claim of the access token. The access token is being used for authorization on a resource outside of Azure (Keyfactor Command), so an app registration for Entra AD to represent an external application. Here is official Azure documentation on how to [create an app registration](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app). @@ -199,12 +204,110 @@ After the App Registration is created, expose an API. You can do this by going t ### App Registration Assignment Requirement -By default, Azure App Registrations do not require an assignment in order for an identity to access to the application. However, there may be some compliance need to require an assignment for an identity to access your app registration. This option can be toggled via the Enterprise Application properties of your App Registration. If enabled, and your identity does not have an assignment to this application, you may see the error: +By default, Azure App Registrations do not require an assignment in order for an identity to access to the application. However, there may be some compliance need to require an assignment for an identity to access your app registration. This option can be toggled via the Enterprise Application properties of your App Registration. If enabled, you **must use** a user-assigned managed identity for your workload (a system-assigned managed identity cannot be assigned a role). If this identity does not have a role assignment to the app registration, you may see the error: -``` +```bash AADSTS501051: Application ''() is not assigned to a role for the application 'api://'() ``` ![App Registration Assignment Required](../assets/app-registration-assignment-required.png) -For more information about the assignment requirement for app registrations and how this can affect your identities, please see [this blog post](https://mderriey.com/2019/04/19/aad-apps-user-assignment-required/). \ No newline at end of file +> If the UAMI identity is tied to an app registration role, the name of the security role can be added as a security claim in Keyfactor Command. Then, the identity can assume any Keyfactor Command security role with that security claim assigned to it. + +You can assign the identity to an app registration role from the Enterprise Application. Please refer to the [Azure documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps#assign-users-and-groups-to-microsoft-entra-roles) for more information. + +For more information about the assignment requirement for app registrations and how this can affect your identities, please see [this blog post](https://mderriey.com/2019/04/19/aad-apps-user-assignment-required/). + +## Troubleshooting + +This troubleshooting section is intended for issues specific to the Azure AKS environment. If you do not see your issue in these troubleshooting steps, please see the troubleshooting steps in the [directory root](../../README.md#troubleshooting). + +### Determining Which Managed Identity Your AKS Workload is Using + +Azure has documentation around [determining the managed identity a cluster is using](https://learn.microsoft.com/en-us/azure/aks/use-managed-identity#determine-which-type-of-managed-identity-a-cluster-is-using), but this section will confirm if your AKS workload is using UAMI or MSI for its managed identity. + +#### Determine if workload identity is enabled on the AKS cluster + +```bash +az aks show โ€“-resource-group [group] โ€“-name [name] --query "[oidcIssuerProfile,securityProfile]" +``` + +If you see something like this, your AKS cluster **has workload identity enabled**: + +```json +[ + { + "enabled": true, + "issuerUrl": "https://" + }, + { + "azureKeyVaultKms": null, + "defender": null, + "imageCleaner": null, + "workloadIdentity": { + "enabled": true + } + } +] +``` + +#### Check if the ServiceAccount is annotated with a client ID and workload is enabled. + +Run this script to see if your ServiceAccount is annotated with the client ID of the UAMI and workload identity is enabled. + +```bash +kubectl describe serviceaccount --namespace +... +Labels: ... + azure.workload.identity/use=true +Annotations: azure.workload.identity/client-id: + ... +Image pull secrets: +Mountable secrets: +Tokens: +Events: +``` + +#### Check if your Kubernetes pod is labeled to use workload identity + +Run this script to see if your Kubernetes pod is running workload identity enabled. + +```bash +kubectl get pods --namespace --show-labels +NAME READY STATUS RESTARTS AGE LABELS +command-issuer-86c4fdfb67-h4vqb 1/1 Running 0 105s app.kubernetes.io/instance=cert-manager-issuer,app.kubernetes.io/name=command-cert-manager-issuer,azure.workload.identity/use=true,pod-template-hash=86c4fdfb67 +``` + +### Required Query Variable 'Resource' Is Missing + +If you see the following error, this indicates your issuer / cluster issuer is missing a `scopes` field in its spec. DefaultAzureCredentials requires a valid scope, which should reference the [app registration](#azure-app-registration). + +```bash +failed to authenticate a system assigned identity. The endpoint responded with {\"error\":\"invalid_request\",\"error_description\":\"Required query variable 'resource' is missing\"} +``` + +### AADSTS500011: Resource principal named was not found in the tenant + +If you see the following error, this indicates the `scopes` specification on your issuer / cluster issuer is present but pointing to an invalid resource (make sure it's pointing to the [app registration](#azure-app-registration) application ID URI). + +```bash +AADSTS500011: The resource principal named was not found in the tenant named . This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant +``` + +If the `scopes` field is set to a valid application ID URI, make sure you are targeting the `/.default` suffix. + +### AADSTS501051: Application is not assigned to a role + +If you see the following error, this indicates the identity you're using does not have a role assignment to an app registration that requires a role assignment. See [this section](#app-registration-assignment-requirement) for more details. + +```bash +AADSTS501051: Application ''() is not assigned to a role for the application 'api://'() +``` + +### AADSTS700213: No matching federated identity record found for presented assertion subject + +If you see the following error, the user-assigned managed identity (UAMI) is assigned to the command issuer's Kubernete ServiceAccount and is trying to use it. However, the UAMI is missing a federated credential that trusts the ServiceAccount. Please refer to the [user-assigned managed identity](#user-assigned-managed-identity-uami) section and check for the instructions on creating a federated identity credential. The federeated credential **must match** the Kubernetes service account's name and namespace. + +```bash +AADSTS700213: No matching federated identity record found for presented assertion subject 'system:serviceaccount::'. Check your federated identity credential Subject, Audience and Issuer against the presented assertion. https://learn.microsoft.com/entra/workload-id/workload-identity-federation +``` \ No newline at end of file diff --git a/docsource/content.md b/docsource/content.md index b45b4a6..ee254eb 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -96,7 +96,7 @@ Command Issuer is installed using a Helm chart. The chart is available in the [C ``` Optionally, set the Docker image tag of command-cert-manager-issuer to deploy ([available tags](https://hub.docker.com/r/keyfactor/command-cert-manager-issuer/tags)) - + ```shell helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \ --namespace command-issuer-system \ @@ -231,7 +231,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" - # scopes: "openid email https://example.com/.default" # Uncomment if desired + # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -257,7 +257,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" - # scopes: "openid email https://example.com/.default" # Uncomment if desired + # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -381,3 +381,27 @@ Keyfactor Command allows users to [attach custom metadata to certificates](https ```yaml metadata.command-issuer.keyfactor.com/: ``` + +# Troubleshooting + +## Failed to Authenticate, Received Status Code 401 from Keyfactor Command + +If you see this error, the identity provider that issued credentials to your command-cert-manager-issuer (using OAuth, Basic, or ambient credentials) is not a registered identity provider in your Keyfactor Command instance. Please see the [Configuring Command](#configuring-command) section for more information. + +```bash +failed to create new Command API client: failed to authenticate, received status code 401 from Keyfactor Command +``` + +## Failed to Authenticate, Received Status Code 403 from Keyfactor Command + +If you see this error, the identity provider that issued credentials to your command-cert-manager-issuer (using OAuth, Basic, or ambient credentials) is configured in Keyfactor Command, however the identity associated to those credentials is not associated with any security roles. Make sure the identity is mapped to a security claim. See the **Configure Command Security Roles and Claims** section of the [Configuring Command](#configuring-command) section for more information. + +```bash +failed to create new Command API client: failed to authenticate, received status code 403 from Keyfactor Command: {\"ErrorCode\":\"0xA0140002\",\"Message\":\"User doesn\\u0027t have the required permission\"} +``` + +If you see this sort of error, the identity is mapped to one or more security roles in Keyfactor Command, but is missing the necessary permissions. See the **Configure Command Security Roles and Claims** section of the [Configuring Command](#configuring-command) section for the required permissions. + +```bash +failed to fetch metadata fields from connected Command instance: User does not have the required permissions: /metadata/types/read/. +``` \ No newline at end of file diff --git a/internal/command/command.go b/internal/command/command.go index ffb672f..d257a63 100644 --- a/internal/command/command.go +++ b/internal/command/command.go @@ -167,6 +167,8 @@ func newServerConfig(ctx context.Context, config *Config) (*auth_providers.Serve nonAmbientCredentialsConfigured := false if config.BasicAuth != nil { + log.Info("Using basic auth credential source") + basicAuthConfig := auth_providers.NewBasicAuthAuthenticatorBuilder(). WithUsername(config.BasicAuth.Username). WithPassword(config.BasicAuth.Password) @@ -177,6 +179,8 @@ func newServerConfig(ctx context.Context, config *Config) (*auth_providers.Serve } if config.OAuth != nil { + log.Info("Using OAuth credential source") + oauthConfig := auth_providers.NewOAuthAuthenticatorBuilder(). WithTokenUrl(config.OAuth.TokenURL). WithClientId(config.OAuth.ClientID). From 468eafcafb6de7748ac7661558d1431b030e8b7e Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Fri, 30 May 2025 18:04:11 +0000 Subject: [PATCH 12/32] Update generated docs --- README.md | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 6eb2ff5..f76b65e 100644 --- a/README.md +++ b/README.md @@ -128,7 +128,7 @@ Command Issuer is installed using a Helm chart. The chart is available in the [C ``` Optionally, set the Docker image tag of command-cert-manager-issuer to deploy ([available tags](https://hub.docker.com/r/keyfactor/command-cert-manager-issuer/tags)) - + ```shell helm install command-cert-manager-issuer command-issuer/command-cert-manager-issuer \ --namespace command-issuer-system \ @@ -263,7 +263,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" - # scopes: "openid email https://example.com/.default" # Uncomment if desired + # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -289,7 +289,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" - # scopes: "openid email https://example.com/.default" # Uncomment if desired + # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -414,6 +414,30 @@ Keyfactor Command allows users to [attach custom metadata to certificates](https metadata.command-issuer.keyfactor.com/: ``` +# Troubleshooting + +## Failed to Authenticate, Received Status Code 401 from Keyfactor Command + +If you see this error, the identity provider that issued credentials to your command-cert-manager-issuer (using OAuth, Basic, or ambient credentials) is not a registered identity provider in your Keyfactor Command instance. Please see the [Configuring Command](#configuring-command) section for more information. + +```bash +failed to create new Command API client: failed to authenticate, received status code 401 from Keyfactor Command +``` + +## Failed to Authenticate, Received Status Code 403 from Keyfactor Command + +If you see this error, the identity provider that issued credentials to your command-cert-manager-issuer (using OAuth, Basic, or ambient credentials) is configured in Keyfactor Command, however the identity associated to those credentials is not associated with any security roles. Make sure the identity is mapped to a security claim. See the **Configure Command Security Roles and Claims** section of the [Configuring Command](#configuring-command) section for more information. + +```bash +failed to create new Command API client: failed to authenticate, received status code 403 from Keyfactor Command: {\"ErrorCode\":\"0xA0140002\",\"Message\":\"User doesn\\u0027t have the required permission\"} +``` + +If you see this sort of error, the identity is mapped to one or more security roles in Keyfactor Command, but is missing the necessary permissions. See the **Configure Command Security Roles and Claims** section of the [Configuring Command](#configuring-command) section for the required permissions. + +```bash +failed to fetch metadata fields from connected Command instance: User does not have the required permissions: /metadata/types/read/. +``` + ## License From a2b86863519b1f87c95fe1af26deb12f35f0aac1 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Fri, 30 May 2025 14:08:32 -0400 Subject: [PATCH 13/32] chore(docs): Add more documentation --- docs/ambient-providers/azure.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/docs/ambient-providers/azure.md b/docs/ambient-providers/azure.md index 99e358b..22a27af 100644 --- a/docs/ambient-providers/azure.md +++ b/docs/ambient-providers/azure.md @@ -22,6 +22,16 @@ Since you are using ambient credentials generated by your Azure AKS workload and While system-assigned managed identity (MSI) is easy to use and enabled by default, user-assigned managed identity (UAMI) is the ***recommended identity type*** to use for your workload. UAMI identities can be shared with other AKS clusters and workloads, and offer more control over how the identity is used. If your app registration [requires a role assignment](#app-registration-assignment-requirement), you **must** use a UAMI. An MSI **cannot** be assigned to an app registration role. +### Quick Decision Guide + +| Scenario | Recommended Identity Type | +|----------|-------------------------| +| Simple setup, single cluster | System-Assigned (MSI) | +| Multiple clusters need same identity | User-Assigned (UAMI) | +| App registration requires role assignment | User-Assigned (UAMI) - **Required** | +| Production environments | User-Assigned (UAMI) | +| Development/testing | Either (MSI for simplicity) | + ## System-Assigned Managed Identity (MSI) @@ -222,6 +232,12 @@ For more information about the assignment requirement for app registrations and This troubleshooting section is intended for issues specific to the Azure AKS environment. If you do not see your issue in these troubleshooting steps, please see the troubleshooting steps in the [directory root](../../README.md#troubleshooting). +### Common Pitfalls + +1. **Forgetting the `/.default` suffix** in scopes configuration +1. **Using wrong object ID** - If using MSI, MSI uses kubelet identity, not the cluster identity +1. **ServiceAccount mismatch** - If using UAMI, federated credentials must exactly match ServiceAccount name/namespace + ### Determining Which Managed Identity Your AKS Workload is Using Azure has documentation around [determining the managed identity a cluster is using](https://learn.microsoft.com/en-us/azure/aks/use-managed-identity#determine-which-type-of-managed-identity-a-cluster-is-using), but this section will confirm if your AKS workload is using UAMI or MSI for its managed identity. @@ -278,6 +294,10 @@ NAME READY STATUS RESTARTS AGE LABELS command-issuer-86c4fdfb67-h4vqb 1/1 Running 0 105s app.kubernetes.io/instance=cert-manager-issuer,app.kubernetes.io/name=command-cert-manager-issuer,azure.workload.identity/use=true,pod-template-hash=86c4fdfb67 ``` +#### Conclusion + +If all of the above steps indicate your cluster has workload identity enabled, the pod is labeled to use workload identity, and the ServiceAccount is annotated with the UAMI client ID, your workload is most likely using **user-assigned managed identity**. + ### Required Query Variable 'Resource' Is Missing If you see the following error, this indicates your issuer / cluster issuer is missing a `scopes` field in its spec. DefaultAzureCredentials requires a valid scope, which should reference the [app registration](#azure-app-registration). From 78bd4acd43079e958087941289524c50f811155c Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 2 Jun 2025 16:18:03 -0400 Subject: [PATCH 14/32] chore(sdk): Migrate SDK usage to latest version --- go.mod | 19 ++-- go.sum | 89 +++++------------- internal/command/client.go | 19 ++-- internal/command/command.go | 46 ++++++---- internal/command/command_test.go | 151 +++++++++++++++++-------------- 5 files changed, 150 insertions(+), 174 deletions(-) diff --git a/go.mod b/go.mod index 6cf8ced..b55ea86 100644 --- a/go.mod +++ b/go.mod @@ -3,8 +3,8 @@ module github.com/Keyfactor/command-cert-manager-issuer go 1.23.4 require ( - github.com/Keyfactor/keyfactor-auth-client-go v1.1.2-rc.0 - github.com/Keyfactor/keyfactor-go-client/v3 v3.0.0-rc.12 + github.com/Keyfactor/keyfactor-auth-client-go v1.2.0 + github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.5 github.com/cert-manager/cert-manager v1.16.2 github.com/go-logr/logr v1.4.2 github.com/stretchr/testify v1.10.0 @@ -35,8 +35,8 @@ require ( require ( cloud.google.com/go/compute/metadata v0.6.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0 + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1 github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 // indirect @@ -48,7 +48,6 @@ require ( github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/emicklei/go-restful/v3 v3.12.1 // indirect github.com/evanphx/json-patch/v5 v5.9.0 // indirect - github.com/fatih/color v1.16.0 // indirect github.com/fsnotify/fsnotify v1.7.0 // indirect github.com/fxamacker/cbor/v2 v2.7.0 // indirect github.com/go-asn1-ber/asn1-ber v1.5.6 // indirect @@ -58,15 +57,13 @@ require ( github.com/go-openapi/jsonreference v0.21.0 // indirect github.com/go-openapi/swag v0.23.0 // indirect github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang-jwt/jwt/v5 v5.2.1 // indirect + github.com/golang-jwt/jwt/v5 v5.2.1 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.4 // indirect github.com/google/gnostic-models v0.6.8 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/gofuzz v1.2.0 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/hashicorp/go-hclog v1.5.0 // indirect - github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect github.com/imdario/mergo v0.3.16 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/josharian/intern v1.0.0 // indirect @@ -74,8 +71,6 @@ require ( github.com/klauspost/compress v1.17.9 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/mailru/easyjson v0.7.7 // indirect - github.com/mattn/go-colorable v0.1.13 // indirect - github.com/mattn/go-isatty v0.0.20 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.2 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect @@ -86,16 +81,14 @@ require ( github.com/prometheus/client_model v0.6.1 // indirect github.com/prometheus/common v0.55.0 // indirect github.com/prometheus/procfs v0.15.1 // indirect - github.com/spbsoluble/go-pkcs12 v0.3.3 // indirect github.com/spf13/cobra v1.8.1 // indirect github.com/spf13/pflag v1.0.5 // indirect github.com/x448/float16 v0.8.4 // indirect - go.mozilla.org/pkcs7 v0.9.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.27.0 // indirect golang.org/x/crypto v0.33.0 // indirect golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect - golang.org/x/net v0.35.0 // indirect + golang.org/x/net v0.35.0 golang.org/x/sys v0.30.0 // indirect golang.org/x/term v0.29.0 // indirect golang.org/x/text v0.22.0 // indirect diff --git a/go.sum b/go.sum index 2101b7b..24363c7 100644 --- a/go.sum +++ b/go.sum @@ -2,16 +2,14 @@ cloud.google.com/go/auth v0.15.0 h1:Ly0u4aA5vG/fsSsxu98qCQBemXtAtJf+95z9HK+cxps= cloud.google.com/go/auth v0.15.0/go.mod h1:WJDGqZ1o9E9wKIL+IwStfyn/+s59zl4Bi+1KQNVXLZ8= cloud.google.com/go/auth/oauth2adapt v0.2.7 h1:/Lc7xODdqcEw8IrZ9SvwnlLX6j9FHQM74z6cBk9Rw6M= cloud.google.com/go/auth/oauth2adapt v0.2.7/go.mod h1:NTbTTzfvPl1Y3V1nPpOgl2w6d/FjO7NNUQaWSox6ZMc= -cloud.google.com/go/compute/metadata v0.5.1 h1:NM6oZeZNlYjiwYje+sYFjEpP0Q0zCan1bmQW/KmIrGs= -cloud.google.com/go/compute/metadata v0.5.1/go.mod h1:C66sj2AluDcIqakBq/M8lw8/ybHgOZqin2obFxa/E5k= cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I= cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 h1:JZg6HRh6W6U4OLl6lk7BZ7BLisIzM9dG1R50zUk9C/M= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0/go.mod h1:YL1xnZ6QejvQHWJrX/AvhFl4WW4rqHVoKspWNVwFk0M= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0 h1:B/dfvscEQtew9dVuoxqxrUKKv8Ih2f55PydknDamU+g= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0/go.mod h1:fiPSssYvltE08HJchL04dOy+RD4hgrjph0cwGGMntdI= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.0 h1:+m0M/LFxN43KvULkDNfdXOgrjtg6UYJPFBJyuEcRCAw= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.0/go.mod h1:PwOyop78lveYMRs6oCxjiVyBdyCgIYH6XHIVZO9/SFQ= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0 h1:g0EZJwz7xkXQiZAI5xi9f3WWFYBlX1CPTrR+NDToRkQ= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0/go.mod h1:XCW7KnZet0Opnr7HccfUw1PLc4CjHqpcaxW8DHklNkQ= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1 h1:1mvYtZfWQAnwNah/C+Z+Jb9rQH95LPE2vlmMuWAHJk8= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1/go.mod h1:75I/mXtme1JyWFtz8GocPHVFyH421IBoZErnO16dd0k= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.1 h1:Bk5uOhSAenHyR5P61D/NzeQCv+4fEVV8mOkJ82NqpWw= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.1/go.mod h1:QZ4pw3or1WPmRBxf0cHd1tknzrT54WPBOQoGutCPvSU= github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY= github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0 h1:WLUIpeyv04H0RCcQHaA4TNoyrQ39Ox7V+re+iaqzTe0= @@ -24,12 +22,10 @@ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 h1:kYRSnvJju5gYVyhkij+RTJ/VR6QIUaCfWeaFm2ycsjQ= github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI= -github.com/Keyfactor/keyfactor-auth-client-go v1.1.2-rc.0 h1:z4TfQErC+YLPujwHPNeAkK2bl6O5hd7m1mve+qGh2Ko= -github.com/Keyfactor/keyfactor-auth-client-go v1.1.2-rc.0/go.mod h1:yw92P9gSYVEyWkiUAJFsb7hjhXa8slN1+yTQgjSgovM= -github.com/Keyfactor/keyfactor-go-client/v3 v3.0.0-rc.12 h1:L/IXsbVR+cGW8ACQuA8a3nebux2sLQ4rpCGvFF4sIfg= -github.com/Keyfactor/keyfactor-go-client/v3 v3.0.0-rc.12/go.mod h1:BiX76zEZTgRaUPDiRjnUWKtpEPQlSuko6XKBpBZxmX8= -github.com/Keyfactor/keyfactor-go-client/v3 v3.0.0 h1:yMChWRnnxmcgLt6kEQ3FZfteps05v/qot5KXLXxa6so= -github.com/Keyfactor/keyfactor-go-client/v3 v3.0.0/go.mod h1:HWb+S60YAALFVSfB8QuQ8ugjsjr+FHLQET0/4K7EVWw= +github.com/Keyfactor/keyfactor-auth-client-go v1.2.0 h1:uNSlyOW5Bqpi0nsOGZtOYQzN0vP/h4S4J38jtQes+OI= +github.com/Keyfactor/keyfactor-auth-client-go v1.2.0/go.mod h1:7htRcBIWn+X4fI5jaYBALSYwP84H/djN7d8y3n0ZDQ0= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.5 h1:KiCdQssR8TgbAY5gnb8ShcjMbuzf5y+95BdLqVifReI= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.5/go.mod h1:tAg67Y6koUoVYSYeWelq25si5Dr21UDVTNAFi1pJoWY= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= @@ -53,9 +49,6 @@ github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lSh github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg= github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ= -github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= -github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= -github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA= @@ -93,8 +86,6 @@ github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= -github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= -github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= @@ -112,13 +103,9 @@ github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrk github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA= github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4= github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM= -github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c= -github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M= github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8= github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= -github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0= -github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow= github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4= github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= @@ -153,17 +140,6 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= -github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= -github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= -github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= -github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= -github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= -github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= -github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= -github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= -github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU= -github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -190,13 +166,11 @@ github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8= github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc= github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk= -github.com/redis/go-redis/v9 v9.6.1 h1:HHDteefn6ZkTtY5fGUE8tj8uy85AHk6zP7CpzIAM0y4= -github.com/redis/go-redis/v9 v9.6.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA= -github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8= -github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4= +github.com/redis/go-redis/v9 v9.7.0 h1:HhLSs+B6O021gwzl+locl0zEDnyNkxMtf/Z3NNBMa9E= +github.com/redis/go-redis/v9 v9.7.0/go.mod h1:f6zhXITC7JUJIlPEiBOTXxJgPLdZcA93GewI7inzyWw= +github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII= +github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= -github.com/spbsoluble/go-pkcs12 v0.3.3 h1:3nh7IKn16RDpmrSMtOu1JvbB0XHYq1j+IsICdU1c7J4= -github.com/spbsoluble/go-pkcs12 v0.3.3/go.mod h1:MAxKIUEIl/QVcua/I1L4Otyxl9UvLCCIktce2Tjz6Nw= github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM= github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= @@ -207,7 +181,6 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= @@ -217,16 +190,20 @@ github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcY github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= -go.mozilla.org/pkcs7 v0.9.0 h1:yM4/HS9dYv7ri2biPtxt8ikvB37a980dg69/pKmS+eI= -go.mozilla.org/pkcs7 v0.9.0/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk= go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 h1:rgMkmiGfix9vFJDcDi1PK8WEQP4FLQwLDfhp5ZLpFeE= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0/go.mod h1:ijPqXp5P6IRRByFVVg9DY8P5HkxkHE5ARIa+86aXPf4= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 h1:CV7UdSGJt/Ao6Gp4CXckLxVRRsRgDHoI8XjbL3PDl8s= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0/go.mod h1:FRmFuRJfag1IZ2dPkHnEoSFVgTVPUd2qf5Vi69hLb8I= go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY= go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI= go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ= go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE= +go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A= +go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU= +go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU= +go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ= go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k= go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -242,8 +219,6 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs= -golang.org/x/crypto v0.30.0 h1:RwoQn3GkWiMkzlX562cLB7OxWvjH1L8xutO2WoJcRoY= -golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus= golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= @@ -264,12 +239,8 @@ golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= -golang.org/x/net v0.32.0 h1:ZqPmj8Kzc+Y6e0+skZsuACbx+wzMgo5MQsJh9Qd6aYI= -golang.org/x/net v0.32.0/go.mod h1:CwU0IoeOlnQQWJ6ioyFrfRuomB8GKF6KbYXZVyeXNfs= golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8= golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk= -golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE= -golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= golang.org/x/oauth2 v0.26.0 h1:afQXWNNaeC4nvZ0Ed9XvCCzXM6UHJG7iCg0W4fPqSBE= golang.org/x/oauth2 v0.26.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -277,27 +248,20 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w= +golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA= -golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= @@ -306,8 +270,6 @@ golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58= -golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q= -golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM= golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU= golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -316,12 +278,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo= -golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM= golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= -golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U= -golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4= golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -340,13 +298,10 @@ gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY= google.golang.org/api v0.223.0 h1:JUTaWEriXmEy5AhvdMgksGGPEFsYfUKaPEYXd4c3Wvc= google.golang.org/api v0.223.0/go.mod h1:C+RS7Z+dDwds2b+zoAk5hN/eSfsiCn0UDrYof/M4d2M= -google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d h1:VBu5YqKPv6XiJ199exd8Br+Aetz+o08F+PLMnwJQHAY= google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 h1:DMTIbak9GhdaSxEjvVzAeNZvyc03I61duqNbnm3SU0M= google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I= google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ= google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw= -google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg= -google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw= google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM= google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/internal/command/client.go b/internal/command/client.go index 09a6f6a..639e779 100644 --- a/internal/command/client.go +++ b/internal/command/client.go @@ -18,12 +18,13 @@ package command import ( "fmt" + "net/http" "strings" "github.com/Azure/azure-sdk-for-go/sdk/azcore" "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy" "github.com/Azure/azure-sdk-for-go/sdk/azidentity" - commandsdk "github.com/Keyfactor/keyfactor-go-client/v3/api" + v1 "github.com/Keyfactor/keyfactor-go-client-sdk/v25/api/keyfactor/v1" "github.com/go-logr/logr" "github.com/golang-jwt/jwt/v5" "golang.org/x/net/context" @@ -46,8 +47,8 @@ func setAmbientTokenCredentialSource(source TokenCredentialSource) { } type Client interface { - EnrollCSR(ea *commandsdk.EnrollCSRFctArgs) (*commandsdk.EnrollResponse, error) - GetAllMetadataFields() ([]commandsdk.MetadataField, error) + EnrollCSR(v1.ApiCreateEnrollmentCSRRequest) (*v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse, *http.Response, error) + GetAllMetadataFields(v1.ApiGetMetadataFieldsRequest) ([]v1.CSSCMSDataModelModelsMetadataType, *http.Response, error) TestConnection() error } @@ -56,19 +57,19 @@ var ( ) type clientAdapter struct { - enrollCSR func(ea *commandsdk.EnrollCSRFctArgs) (*commandsdk.EnrollResponse, error) - getAllMetadataFields func() ([]commandsdk.MetadataField, error) + enrollCSR func(r v1.ApiCreateEnrollmentCSRRequest) (*v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse, *http.Response, error) + getAllMetadataFields func(r v1.ApiGetMetadataFieldsRequest) ([]v1.CSSCMSDataModelModelsMetadataType, *http.Response, error) testConnection func() error } // EnrollCSR implements CertificateClient. -func (c *clientAdapter) EnrollCSR(ea *commandsdk.EnrollCSRFctArgs) (*commandsdk.EnrollResponse, error) { - return c.enrollCSR(ea) +func (c *clientAdapter) EnrollCSR(r v1.ApiCreateEnrollmentCSRRequest) (*v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse, *http.Response, error) { + return c.enrollCSR(r) } // GetAllMetadataFields implements Client. -func (c *clientAdapter) GetAllMetadataFields() ([]commandsdk.MetadataField, error) { - return c.getAllMetadataFields() +func (c *clientAdapter) GetAllMetadataFields(r v1.ApiGetMetadataFieldsRequest) ([]v1.CSSCMSDataModelModelsMetadataType, *http.Response, error) { + return c.getAllMetadataFields(r) } // TestConnection implements CertificateClient. diff --git a/internal/command/command.go b/internal/command/command.go index d257a63..a354e7b 100644 --- a/internal/command/command.go +++ b/internal/command/command.go @@ -26,7 +26,8 @@ import ( "time" "github.com/Keyfactor/keyfactor-auth-client-go/auth_providers" - commandsdk "github.com/Keyfactor/keyfactor-go-client/v3/api" + commandsdk "github.com/Keyfactor/keyfactor-go-client-sdk/v25" + v1 "github.com/Keyfactor/keyfactor-go-client-sdk/v25/api/keyfactor/v1" cmpki "github.com/cert-manager/cert-manager/pkg/util/pki" "sigs.k8s.io/controller-runtime/pkg/log" ) @@ -68,7 +69,7 @@ type Signer interface { Sign(context.Context, []byte, *SignConfig) ([]byte, []byte, error) } -type newCommandClientFunc func(*auth_providers.Server, *context.Context) (*commandsdk.Client, error) +type newCommandClientFunc func(*auth_providers.Server) (*commandsdk.APIClient, error) type signer struct { client Client @@ -281,15 +282,15 @@ func newInternalSigner(ctx context.Context, config *Config, newClientFunc newCom return nil, err } - client, err := newClientFunc(serverConfig, &ctx) + client, err := newClientFunc(serverConfig) if err != nil { return nil, fmt.Errorf("failed to create new Command API client: %w", err) } adapter := &clientAdapter{ - enrollCSR: client.EnrollCSR, - getAllMetadataFields: client.GetAllMetadataFields, - testConnection: client.AuthClient.Authenticate, + enrollCSR: client.V1.EnrollmentApi.CreateEnrollmentCSRExecute, + getAllMetadataFields: client.V1.MetadataFieldApi.GetMetadataFieldsExecute, + testConnection: client.V1.AuthClient.Authenticate, } log.Info("Successfully generated Command client") @@ -299,11 +300,11 @@ func newInternalSigner(ctx context.Context, config *Config, newClientFunc newCom } func NewHealthChecker(ctx context.Context, config *Config) (HealthChecker, error) { - return newInternalSigner(ctx, config, commandsdk.NewKeyfactorClient) + return newInternalSigner(ctx, config, commandsdk.NewAPIClient) } func NewSignerBuilder(ctx context.Context, config *Config) (Signer, error) { - return newInternalSigner(ctx, config, commandsdk.NewKeyfactorClient) + return newInternalSigner(ctx, config, commandsdk.NewAPIClient) } // Check implements HealthChecker. @@ -317,7 +318,7 @@ func (s *signer) Check(ctx context.Context) error { // CommandSupportsMetadata implements HealthChecker. func (s *signer) CommandSupportsMetadata() (bool, error) { - existingFields, err := s.client.GetAllMetadataFields() + existingFields, _, err := s.client.GetAllMetadataFields(v1.ApiGetMetadataFieldsRequest{}) if err != nil { return false, fmt.Errorf("failed to fetch metadata fields from connected Command instance: %w", err) } @@ -335,13 +336,14 @@ func (s *signer) CommandSupportsMetadata() (bool, error) { // Create a lookup map (set) of existing field names existingFieldSet := make(map[string]struct{}, len(existingFields)) for _, field := range existingFields { - existingFieldSet[field.Name] = struct{}{} + name := field.Name.Get() + existingFieldSet[*name] = struct{}{} } // Check that every expected field is present for _, expectedField := range expectedFieldsSlice { if _, found := existingFieldSet[expectedField]; !found { - // As soon as one required field is missing, return false + // As soon as one recommended field is missing, return false return false, nil } } @@ -404,13 +406,15 @@ func (s *signer) Sign(ctx context.Context, csrBytes []byte, config *SignConfig) k8sLog.Info(fmt.Sprintf("URI SAN: %s", uri.String())) } - modelRequest := commandsdk.EnrollCSRFctArgs{ + req := v1.ApiCreateEnrollmentCSRRequest{} + req = req.XCertificateformat(enrollmentPEMFormat) + + modelRequest := v1.EnrollmentCSREnrollmentRequest{ CSR: string(csrBytes), - Template: config.CertificateTemplate, - CertFormat: enrollmentPEMFormat, - Timestamp: time.Now().Format(time.RFC3339), - IncludeChain: true, - SANs: &commandsdk.SANs{}, + Template: *v1.NewNullableString(ptr(config.CertificateTemplate)), + Timestamp: ptr(time.Now()), + IncludeChain: ptr(true), + SANs: map[string][]string{}, Metadata: map[string]interface{}{}, } @@ -435,9 +439,13 @@ func (s *signer) Sign(ctx context.Context, csrBytes []byte, config *SignConfig) caBuilder.WriteString("\\") } caBuilder.WriteString(config.CertificateAuthorityLogicalName) - modelRequest.CertificateAuthority = caBuilder.String() + modelRequest.CertificateAuthority = *v1.NewNullableString(ptr(caBuilder.String())) + + req = req.EnrollmentCSREnrollmentRequest(modelRequest) + + k8sLog.Info(fmt.Sprintf("Enrolling certificate with Command using template %q and CA %q", config.CertificateTemplate, caBuilder.String())) - commandCsrResponseObject, err := s.client.EnrollCSR(&modelRequest) + commandCsrResponseObject, _, err := s.client.EnrollCSR(req) if err != nil { detail := fmt.Sprintf("error enrolling certificate with Command. Verify that the certificate template %q exists and that the certificate authority %q (%s) is configured correctly", config.CertificateTemplate, config.CertificateAuthorityLogicalName, config.CertificateAuthorityHostname) diff --git a/internal/command/command_test.go b/internal/command/command_test.go index 27f8e64..ede7feb 100644 --- a/internal/command/command_test.go +++ b/internal/command/command_test.go @@ -36,7 +36,7 @@ import ( "time" "github.com/Keyfactor/keyfactor-auth-client-go/auth_providers" - commandsdk "github.com/Keyfactor/keyfactor-go-client/v3/api" + v1 "github.com/Keyfactor/keyfactor-go-client-sdk/v25/api/keyfactor/v1" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) @@ -242,9 +242,9 @@ func TestSignConfigValidate(t *testing.T) { } } -var ( - _ commandsdk.AuthConfig = &fakeCommandAuthenticator{} -) +// var ( +// _ commandsdk.AuthConfig = &fakeCommandAuthenticator{} +// ) type fakeCommandAuthenticator struct { client *http.Client @@ -266,19 +266,6 @@ func (f *fakeCommandAuthenticator) GetServerConfig() *auth_providers.Server { return f.config } -func newFakeCommandClientFunc(httpClient *http.Client) newCommandClientFunc { - return newCommandClientFunc(func(s *auth_providers.Server, ctx *context.Context) (*commandsdk.Client, error) { - client := &commandsdk.Client{ - AuthClient: &fakeCommandAuthenticator{ - client: httpClient, - config: s, - }, - } - - return client, nil - }) -} - func TestNewServerConfig(t *testing.T) { testCases := map[string]struct { @@ -365,25 +352,25 @@ var ( ) type fakeClient struct { - enrollCallback func(*commandsdk.EnrollCSRFctArgs) - enrollResponse *commandsdk.EnrollResponse + enrollCallback func(v1.ApiCreateEnrollmentCSRRequest) + enrollResponse *v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse - metadataFields []commandsdk.MetadataField + metadataFields []v1.CSSCMSDataModelModelsMetadataType err error } // EnrollCSR implements Client. -func (f *fakeClient) EnrollCSR(ea *commandsdk.EnrollCSRFctArgs) (*commandsdk.EnrollResponse, error) { +func (f *fakeClient) EnrollCSR(r v1.ApiCreateEnrollmentCSRRequest) (*v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse, *http.Response, error) { if f.enrollCallback != nil { - f.enrollCallback(ea) + f.enrollCallback(r) } - return f.enrollResponse, f.err + return f.enrollResponse, nil, f.err } // GetAllMetadataFields implements Client. -func (f *fakeClient) GetAllMetadataFields() ([]commandsdk.MetadataField, error) { - return f.metadataFields, f.err +func (f *fakeClient) GetAllMetadataFields(v1.ApiGetMetadataFieldsRequest) ([]v1.CSSCMSDataModelModelsMetadataType, *http.Response, error) { + return f.metadataFields, nil, f.err } // TestConnection implements Client. @@ -391,6 +378,13 @@ func (f *fakeClient) TestConnection() error { return f.err } +type EnrollmentCSRRequest struct { + Template string + CertificateAuthority string + SANs map[string][]string + Metadata map[string]interface{} +} + func TestSign(t *testing.T) { caCert, rootKey := issueTestCertificate(t, "Root-CA", nil, nil) caCertPem := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: caCert.Raw}) @@ -414,7 +408,7 @@ func TestSign(t *testing.T) { config *SignConfig // Expected - expectedEnrollArgs *commandsdk.EnrollCSRFctArgs + expectedEnrollArgs *EnrollmentCSRRequest expectedSignError error }{ "success-no-meta": { @@ -428,10 +422,10 @@ func TestSign(t *testing.T) { }, // Expected - expectedEnrollArgs: &commandsdk.EnrollCSRFctArgs{ + expectedEnrollArgs: &EnrollmentCSRRequest{ Template: certificateTemplateName, CertificateAuthority: fmt.Sprintf("%s\\%s", certificateAuthorityHostname, certificateAuthorityLogicalName), - SANs: &commandsdk.SANs{}, + SANs: map[string][]string{}, Metadata: map[string]interface{}{}, }, expectedSignError: nil, @@ -451,10 +445,10 @@ func TestSign(t *testing.T) { }, // Expected - expectedEnrollArgs: &commandsdk.EnrollCSRFctArgs{ + expectedEnrollArgs: &EnrollmentCSRRequest{ Template: "template-override", CertificateAuthority: fmt.Sprintf("%s\\%s", "hostname-override", "logicalname-override"), - SANs: &commandsdk.SANs{}, + SANs: map[string][]string{}, Metadata: map[string]interface{}{}, }, expectedSignError: nil, @@ -479,10 +473,10 @@ func TestSign(t *testing.T) { }, // Expected - expectedEnrollArgs: &commandsdk.EnrollCSRFctArgs{ + expectedEnrollArgs: &EnrollmentCSRRequest{ Template: certificateTemplateName, CertificateAuthority: fmt.Sprintf("%s\\%s", certificateAuthorityHostname, certificateAuthorityLogicalName), - SANs: &commandsdk.SANs{}, + SANs: map[string][]string{}, Metadata: map[string]interface{}{ CommandMetaControllerNamespace: "namespace", CommandMetaControllerKind: "Issuer", @@ -508,10 +502,10 @@ func TestSign(t *testing.T) { }, // Expected - expectedEnrollArgs: &commandsdk.EnrollCSRFctArgs{ + expectedEnrollArgs: &EnrollmentCSRRequest{ Template: certificateTemplateName, CertificateAuthority: fmt.Sprintf("%s\\%s", certificateAuthorityHostname, certificateAuthorityLogicalName), - SANs: &commandsdk.SANs{}, + SANs: map[string][]string{}, Metadata: map[string]interface{}{ "testMetadata": "test", }, @@ -530,10 +524,10 @@ func TestSign(t *testing.T) { }, // Expected - expectedEnrollArgs: &commandsdk.EnrollCSRFctArgs{ + expectedEnrollArgs: &EnrollmentCSRRequest{ Template: certificateTemplateName, CertificateAuthority: fmt.Sprintf("%s\\%s", certificateAuthorityHostname, certificateAuthorityLogicalName), - SANs: &commandsdk.SANs{}, + SANs: map[string][]string{}, Metadata: map[string]interface{}{}, }, expectedSignError: errCommandEnrollmentFailure, @@ -542,11 +536,8 @@ func TestSign(t *testing.T) { for name, tc := range testCases { t.Run(name, func(t *testing.T) { - cb := func(ea *commandsdk.EnrollCSRFctArgs) { - require.Equal(t, tc.expectedEnrollArgs.CertificateAuthority, ea.CertificateAuthority) - require.Equal(t, tc.expectedEnrollArgs.Template, ea.Template) - - require.Equal(t, tc.expectedEnrollArgs.Metadata, ea.Metadata) + cb := func(req v1.ApiCreateEnrollmentCSRRequest) { + require.NotNil(t, req) } client := fakeClient{ @@ -578,39 +569,67 @@ func TestSign(t *testing.T) { func TestCommandSupportsMetadata(t *testing.T) { testCases := map[string]struct { - presentMeta []commandsdk.MetadataField + presentMeta []v1.CSSCMSDataModelModelsMetadataType // Expected expected bool }{ - "success-no-meta": { - presentMeta: []commandsdk.MetadataField{}, + "failure-no-meta": { + presentMeta: []v1.CSSCMSDataModelModelsMetadataType{}, + + // Expected + expected: false, + }, + "failure-missing-meta": { + presentMeta: []v1.CSSCMSDataModelModelsMetadataType{ + { + Name: *v1.NewNullableString(ptr(CommandMetaControllerNamespace)), + }, + { + Name: *v1.NewNullableString(ptr(CommandMetaControllerKind)), + }, + { + Name: *v1.NewNullableString(ptr(CommandMetaControllerResourceGroupName)), + }, + // { + // Name: CommandMetaIssuerName, + // }, + { + Name: *v1.NewNullableString(ptr(CommandMetaIssuerNamespace)), + }, + { + Name: *v1.NewNullableString(ptr(CommandMetaControllerReconcileId)), + }, + { + Name: *v1.NewNullableString(ptr(CommandMetaCertificateSigningRequestNamespace)), + }, + }, // Expected expected: false, }, "success-all-meta": { - presentMeta: []commandsdk.MetadataField{ + presentMeta: []v1.CSSCMSDataModelModelsMetadataType{ { - Name: CommandMetaControllerNamespace, + Name: *v1.NewNullableString(ptr(CommandMetaControllerNamespace)), }, { - Name: CommandMetaControllerKind, + Name: *v1.NewNullableString(ptr(CommandMetaControllerKind)), }, { - Name: CommandMetaControllerResourceGroupName, + Name: *v1.NewNullableString(ptr(CommandMetaControllerResourceGroupName)), }, { - Name: CommandMetaIssuerName, + Name: *v1.NewNullableString(ptr(CommandMetaIssuerName)), }, { - Name: CommandMetaIssuerNamespace, + Name: *v1.NewNullableString(ptr(CommandMetaIssuerNamespace)), }, { - Name: CommandMetaControllerReconcileId, + Name: *v1.NewNullableString(ptr(CommandMetaControllerReconcileId)), }, { - Name: CommandMetaCertificateSigningRequestNamespace, + Name: *v1.NewNullableString(ptr(CommandMetaCertificateSigningRequestNamespace)), }, }, @@ -644,7 +663,7 @@ func assertErrorIs(t *testing.T, expectedError, actualError error) { assert.Truef(t, errors.Is(actualError, expectedError), "unexpected error type. expected: %v, got: %v", expectedError, actualError) } -func certificateRestResponseFromExpectedCerts(t *testing.T, leafCertAndChain []*x509.Certificate, rootCAs []*x509.Certificate) *commandsdk.EnrollResponse { +func certificateRestResponseFromExpectedCerts(t *testing.T, leafCertAndChain []*x509.Certificate, rootCAs []*x509.Certificate) *v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse { require.NotEqual(t, 0, len(leafCertAndChain)) leaf := string(pem.EncodeToMemory(&pem.Block{Bytes: leafCertAndChain[0].Raw, Type: "CERTIFICATE"})) @@ -656,20 +675,20 @@ func certificateRestResponseFromExpectedCerts(t *testing.T, leafCertAndChain []* certs = append(certs, string(pem.EncodeToMemory(&pem.Block{Bytes: cert.Raw, Type: "CERTIFICATE"}))) } - response := &commandsdk.EnrollResponse{ - Certificates: certs, - CertificateInformation: commandsdk.CertificateInformation{ - SerialNumber: "", - IssuerDN: "", - Thumbprint: "", - KeyfactorID: 0, - KeyfactorRequestID: 0, - PKCS12Blob: "", - Certificates: certs, - RequestDisposition: "", - DispositionMessage: "", - EnrollmentContext: nil, + response := &v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse{ + CertificateInformation: &v1.CSSCMSDataModelModelsPkcs10CertificateResponse{ + SerialNumber: *v1.NewNullableString(ptr("")), + IssuerDN: *v1.NewNullableString(ptr("")), + Thumbprint: *v1.NewNullableString(ptr("")), + KeyfactorID: ptr(int32(0)), + Certificates: certs, + WorkflowInstanceId: nil, + RequestDisposition: *v1.NewNullableString(ptr("")), + DispositionMessage: *v1.NewNullableString(ptr("")), + EnrollmentContext: nil, + WorkflowReferenceId: nil, }, + Metadata: map[string]string{}, } return response } From 4f1b454004eabadb351f64d6c3d510a8aaee68ff Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 3 Jun 2025 09:52:39 -0400 Subject: [PATCH 15/32] Add enrollmentPatternName and enrollmentPatternId --- api/v1alpha1/issuer_types.go | 20 +++++- ...d-issuer.keyfactor.com_clusterissuers.yaml | 21 ++++++- .../command-issuer.keyfactor.com_issuers.yaml | 21 ++++++- .../templates/crds/clusterissuers.yaml | 21 ++++++- .../templates/crds/issuers.yaml | 21 ++++++- docs/ambient-providers/google.md | 59 ------------------ docsource/content.md | 36 +++++++---- .../enrollment_pattern_allowed_requester.png | Bin 0 -> 179430 bytes internal/command/command.go | 8 ++- internal/command/command_test.go | 27 +++++--- 10 files changed, 147 insertions(+), 87 deletions(-) delete mode 100644 docs/ambient-providers/google.md create mode 100644 docsource/images/enrollment_pattern_allowed_requester.png diff --git a/api/v1alpha1/issuer_types.go b/api/v1alpha1/issuer_types.go index 98f604f..bc159b1 100644 --- a/api/v1alpha1/issuer_types.go +++ b/api/v1alpha1/issuer_types.go @@ -1,5 +1,5 @@ /* -Copyright ยฉ 2024 Keyfactor +Copyright ยฉ 2025 Keyfactor Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -46,7 +46,23 @@ type IssuerSpec struct { // +kubebuilder:default:=KeyfactorAPI APIPath string `json:"apiPath,omitempty"` - // CertificateTemplate is the name of the certificate template to use. + // EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + // If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + // If EnrollmentPatternId and EnrollmentPatternName are both specified, EnrollmentPatternId will take precedence. + // Enrollment will fail if the specified template is not compatible with the enrollment pattern. + // Refer to the Keyfactor Command documentation for more information. + EnrollmentPatternId int32 `json:"enrollmentPatternId,omitempty"` + + // EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + // If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + // If EnrollmentPatternId and EnrollmentPatternName are both specified, EnrollmentPatternId will take precedence. + // Enrollment will fail if the specified template is not compatible with the enrollment pattern. + // Refer to the Keyfactor Command documentation for more information. + EnrollmentPatternName string `json:"enrollmentPatternName,omitempty"` + + // Deprecated. CertificateTemplate is the name of the certificate template to use. If using Keyfactor Command 25.1 or later, use EnrollmentPatternName or EnrollmentPatternId instead. + // If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + // Enrollment will fail if the specified template is not compatible with the enrollment pattern. // Refer to the Keyfactor Command documentation for more information. CertificateTemplate string `json:"certificateTemplate,omitempty"` diff --git a/config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml b/config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml index 452fc46..8e967b3 100644 --- a/config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml +++ b/config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml @@ -68,9 +68,28 @@ spec: CertificateAuthorityLogicalName is the logical name of the certificate authority to use E.g. "Keyfactor Root CA" or "Intermediate CA" type: string + enrollmentPatternId: + description: |- + EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. + Refer to the Keyfactor Command documentation for more information. + type: integer + format: int32 + enrollmentPatternName: + description: |- + EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. + Refer to the Keyfactor Command documentation for more information. + type: string certificateTemplate: description: |- - CertificateTemplate is the name of the certificate template to use. + CertificateTemplate is the name of the certificate template to use. Deprecated in favor of EnrollmentPattern as of Keyfactor Command 25.1. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string commandSecretName: diff --git a/config/crd/bases/command-issuer.keyfactor.com_issuers.yaml b/config/crd/bases/command-issuer.keyfactor.com_issuers.yaml index f06ddbb..8c69484 100644 --- a/config/crd/bases/command-issuer.keyfactor.com_issuers.yaml +++ b/config/crd/bases/command-issuer.keyfactor.com_issuers.yaml @@ -68,9 +68,28 @@ spec: CertificateAuthorityLogicalName is the logical name of the certificate authority to use E.g. "Keyfactor Root CA" or "Intermediate CA" type: string + enrollmentPatternId: + description: |- + EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. + Refer to the Keyfactor Command documentation for more information. + type: integer + format: int32 + enrollmentPatternName: + description: |- + EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. + Refer to the Keyfactor Command documentation for more information. + type: string certificateTemplate: description: |- - CertificateTemplate is the name of the certificate template to use. + CertificateTemplate is the name of the certificate template to use. Deprecated in favor of EnrollmentPattern as of Keyfactor Command 25.1. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string commandSecretName: diff --git a/deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml b/deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml index 40bd6c8..8424d4f 100644 --- a/deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml +++ b/deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml @@ -62,9 +62,28 @@ spec: CertificateAuthorityLogicalName is the logical name of the certificate authority to use E.g. "Keyfactor Root CA" or "Intermediate CA" type: string + enrollmentPatternId: + description: |- + EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. + Refer to the Keyfactor Command documentation for more information. + type: integer + format: int32 + enrollmentPatternName: + description: |- + EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. + Refer to the Keyfactor Command documentation for more information. + type: string certificateTemplate: description: |- - CertificateTemplate is the name of the certificate template to use. + CertificateTemplate is the name of the certificate template to use. Deprecated in favor of EnrollmentPattern as of Keyfactor Command 25.1. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string commandSecretName: diff --git a/deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml b/deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml index 879c88f..e90bd87 100644 --- a/deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml +++ b/deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml @@ -62,9 +62,28 @@ spec: CertificateAuthorityLogicalName is the logical name of the certificate authority to use E.g. "Keyfactor Root CA" or "Intermediate CA" type: string + enrollmentPatternId: + description: |- + EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. + Refer to the Keyfactor Command documentation for more information. + type: integer + format: int32 + enrollmentPatternName: + description: |- + EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. + Refer to the Keyfactor Command documentation for more information. + type: string certificateTemplate: description: |- - CertificateTemplate is the name of the certificate template to use. + CertificateTemplate is the name of the certificate template to use. Deprecated in favor of EnrollmentPattern as of Keyfactor Command 25.1. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string commandSecretName: diff --git a/docs/ambient-providers/google.md b/docs/ambient-providers/google.md deleted file mode 100644 index 708989e..0000000 --- a/docs/ambient-providers/google.md +++ /dev/null @@ -1,59 +0,0 @@ -# Google Kubernetes Engine (GKE) Workload Identity - -This documentation is for instructions on using ambient credentials within Google Kubernetes Engine (GKE). Full documentation on Command Cert Manager Issuer can be found [here](../../README.md). - -## Prerequisites - -- [cert-manager](https://cert-manager.io/docs/installation/helm/) installed to your GKE cluster. -- [command-cert-manager-issuer](../../README.md#installing-command-issuer) installed to your GKE cluster. -- [Issuer or ClusterIssuer](../../README.md#creating-issuer-and-clusterissuer-resources) resources deployed to your GKE cluster. - - to use ambient credentials, do not supply a `commandSecretName` to your issuer's specification. `scopes` and `audience` fields are optional. -- [Gcloud CLI](https://cloud.google.com/sdk/docs/install) installed and logged in - -## Background - -Google Kuberentes Engine (GKE) supports the ability to authenticate your GKE workloads using workload identity. - -By default, GKE clusters are assigned the [default service account](https://cloud.google.com/compute/docs/access/service-accounts#token) for your Google project. This service account is used to generate an ID token for your workload. However, you may opt to use [Workload Identity Federation](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#metadata-server) to your GKE cluster. - -## How to use Workload Identity - -1. Get the OAuth Client and Identity Provider for your GKE Cluster - - Regardless if you are using the default service account or a custom service account, the following script will help you derive your GKE cluster's OAuth Client: - - ```shell - export CLUSTER_NAME="" # name of your GKE cluster - export GCLOUD_REGION="" # region your cluster is hosted in - export GCLOUD_PROJECT_ID=$(gcloud config get-value project) # populate with the current PROJECT_ID context - export GCLOUD_PROJECT_NUMBER=$(gcloud projects describe $GCLOUD_PROJECT_ID --format="value(projectNumber)") - - export GCLOUD_SERVICE_ACCOUNT=$(gcloud container clusters describe $CLUSTER_NAME \ - --zone $GCLOUD_REGION \ - --format="value(nodeConfig.serviceAccount)") - - echo "Cluster name: $CLUSTER_NAME" - echo "Region: $GCLOUD_REGION" - echo "Project ID: $GCLOUD_PROJECT_ID" - echo "Project Number: $GCLOUD_PROJECT_NUMBER" - - if [[ "$GCLOUD_SERVICE_ACCOUNT" == "default" ]]; then - echo "Overriding service account..." - # Override service account with default compute service account - GCLOUD_SERVICE_ACCOUNT="$GCLOUD_PROJECT_NUMBER-compute@developer.gserviceaccount.com" - fi - - echo "Service account: $GCLOUD_SERVICE_ACCOUNT" - - # Get OAuth2 Client ID of service account - export GCLOUD_SERVICE_ACCOUNT_CLIENT_ID=$(gcloud iam service-accounts describe $GCLOUD_SERVICE_ACCOUNT \ - --format="value(oauth2ClientId)") - - echo "Service account OAuth2 client ID: $GCLOUD_SERVICE_ACCOUNT_CLIENT_ID" - - echo "View the OIDC configuration for Google's OIDC token issuer: https://accounts.google.com/.well-known/openid-configuration" - - echo "Authority: https://accounts.google.com" - ``` - -2. Add Google as an [Identity Provider in Command](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/IdentityProviders.htm?Highlight=identity%20provider) using the identity provider information from the previous step, and [add the Service Account's OAuth Client ID as an `OAuth Subject` claim to the Security Role](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) created/identified earlier. \ No newline at end of file diff --git a/docsource/content.md b/docsource/content.md index ee254eb..cdda614 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -22,7 +22,7 @@ Before continuing, ensure that the following requirements are met: ## Configuring Command -Command Issuer enrolls certificates by submitting a POST request to the Command CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template suitable for your use case. Additionally, you should ensure that the [identity provider](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/AuthenticateAPI.htm#AuthenticatingtotheKeyfactorAPI) used by the Issuer/ClusterIssuer has the appropriate permissions in Command. +Command Issuer enrolls certificates by submitting a POST request to the Command CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template / Enrollment Pattern suitable for your use case. Additionally, you should ensure that the [identity provider](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/AuthenticateAPI.htm#AuthenticatingtotheKeyfactorAPI) used by the Issuer/ClusterIssuer has the appropriate permissions in Command. 1. **Create or identify a Certificate Authority** @@ -32,23 +32,27 @@ Command Issuer enrolls certificates by submitting a POST request to the Command The CA that you choose must be configured to allow CSR Enrollment. -2. **Identify a Certificate Template** +2. **Identify a Certificate Template / Enrollment Pattern** + + Keyfactor Command 25.1 introduces support for [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReleaseNotes/Release2511.htm#Highlights), which allow an easy way to share certificate configuration without requiring multiple certificate templates. Certificate Template configuration has been moved to the Enrollment Patterns screen. Certificate Templates will still be supported in Issuer / ClusterIssuer configuration, but it is recommended to start using Enrollment Patterns for Keyfactor Command versions 25.1 and above. + + - If you don't have any suitable Enrollment Patterns, refer to the [Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) or reach out to your Keyfactor support representative to learn more. Certificate Templates in Command define properties and constraints of the certificates being issued. This includes settings like key usage, extended key usage, validity period, allowed key algorithms, and signature algorithms. They also control the type of information that end entities must provide and how that information is validated before issuing certificates. - If you don't have any suitable Certificate Templates, refer to the [Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Configuring%20Template%20Options.htm?Highlight=Certificate%20Template) or reach out to your Keyfactor support representative to learn more. - The Certificate Template that you choose must be configured to allow CSR Enrollment. + The Certificate Template / Enrollment Pattern that you choose must be configured to allow CSR Enrollment. - You should make careful note of the allowed Key Types and Key Sizes on the Certificate Template. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the key `algorithm` and `size` are allowed by your Certificate Template in Command. + You should make careful note of the allowed Key Types and Key Sizes on the Certificate Template / Enrollment Pattern. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the key `algorithm` and `size` are allowed by your Certificate Template / Enrollment Pattern in Command. - The same goes for **Enrollment RegExes** and **Policies** defined on your Certificate Template. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the `subject`, `commonName`, `dnsNames`, etc. are allowed and/or configured correctly by your Certificate Template in Command. + The same goes for **Enrollment RegExes** and **Policies** defined on your Certificate Template / Enrollment Pattern. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the `subject`, `commonName`, `dnsNames`, etc. are allowed and/or configured correctly by your Certificate Template / Enrollment Pattern in Command. 3. **Configure Command Security Roles and Claims** In Command, Security Roles define groups of users or administrators with specific permissions. Users and subjects are identified by Claims. By adding a Claim to a Security Role, you can define what actions the user or subject can perform and what parts of the system it can interact with. - The security role will need to be added as an **Allowed Requester Security Role** on the Certificate Authority and Certificate Template configured in the previous two steps. + The security role will need to be added as an **Allowed Requester Security Role** on the Certificate Authority and Certificate Template / Enrollment Pattern configured in the previous two steps. - If you haven't created Roles and Access rules before, [this guide](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) provides a primer on these concepts in Command. @@ -69,6 +73,8 @@ Command Issuer enrolls certificates by submitting a POST request to the Command ![Certificate Template Allowed Requester](./docsource/images/cert_template_allowed_requester.png) +![Enrollment Pattern Allowed Requester](./docsource/images/enrollment_pattern_allowed_requester.png) + ## Installing Command Issuer @@ -124,7 +130,8 @@ These credentials must be configured using a Kubernetes Secret. By default, the Command Issuer also supports ambient authentication, where a token is fetched from an Authorization Server using a cloud provider's auth infrastructure and passed to Command directly. The following methods are supported: - [Managed Identity Using Azure Entra ID Workload Identity](./docs/ambient-providers/azure.md) (if running in [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service)) -- [Managed Identity Using Google Kubernetes Engine](./docs/ambient-providers/google.md) (if running in [GKE](https://cloud.google.com/kubernetes-engine)) + +If you are running your Kubernetes workload in a cloud provider not listed above, you can use workload identity federation with [Azure AD](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation). ## Basic Auth @@ -192,6 +199,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou export COMMAND_CA_HOSTNAME="" # Only required for non-HTTPS CA types export COMMAND_CA_LOGICAL_NAME="" export CERTIFICATE_TEMPLATE_SHORT_NAME="" + export ENROLLMENT_PATTERN_NAME="" ``` The `spec` field of both the Issuer and ClusterIssuer resources use the following fields: @@ -203,7 +211,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou | caSecretName | (optional) The name of the Kubernetes secret containing the CA certificate. Required if the Command API uses a self-signed certificate or it was signed by a CA that is not widely trusted. | | certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` | | certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. | - | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. | + | enrollmentPatternId | The ID of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | + | enrollmentPatternName | The Name of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | + | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. **Deprecated in favor of [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/KeyfactorAPI/Enrollment-Patterns.htm) as of Keyfactor Command 25.1**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | | scopes | (Optional) Required if using ambient credentials with Azure AKS. If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. | | audience | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`. | @@ -230,7 +240,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" - certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" + enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. + # certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Uncomment if required # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -256,7 +267,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" - certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" + enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. + # certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Uncomment if required # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -327,11 +339,12 @@ kubectl get secret command-certificate -o jsonpath='{.data.tls\.crt}' | base64 - ## Overriding the Issuer/ClusterIssuer `spec` using Kubernetes Annotations on CertificateRequest Resources -Command Issuer allows you to override the `certificateAuthorityHostname`, `certificateAuthorityLogicalName`, and `certificateTemplate` by setting Kubernetes Annotations on CertificateRequest resources. This may be useful if certain enrollment scenarios require a different Certificate Authority or Certificate Template, but you don't want to create a new Issuer/ClusterIssuer. +Command Issuer allows you to override the `certificateAuthorityHostname`, `certificateAuthorityLogicalName`, `certificateTemplate`, and `enrollmentPatternName` by setting Kubernetes Annotations on CertificateRequest resources. This may be useful if certain enrollment scenarios require a different Certificate Authority or Certificate Template, but you don't want to create a new Issuer/ClusterIssuer. - `command-issuer.keyfactor.com/certificateAuthorityHostname` overrides `certificateAuthorityHostname` - `command-issuer.keyfactor.com/certificateAuthorityLogicalName` overrides `certificateAuthorityLogicalName` - `command-issuer.keyfactor.com/certificateTemplate` overrides `certificateTemplate` +- `command-issuer.keyfactor.com/enrollmentPatternName` overrides `enrollmentPatternName` > cert-manager copies Annotations set on Certificate resources to the corresponding CertificateRequest. @@ -345,6 +358,7 @@ Command Issuer allows you to override the `certificateAuthorityHostname`, `certi > kind: Certificate > metadata: > annotations: +> command-issuer.keyfactor.com/enrollmentPatternName: "Kubernetes Enrollment Pattern" > command-issuer.keyfactor.com/certificateTemplate: "Ephemeral2day" > command-issuer.keyfactor.com/certificateAuthorityLogicalName: "InternalIssuingCA1" > metadata.command-issuer.keyfactor.com/ResponsibleTeam: "theResponsibleTeam@example.com" diff --git a/docsource/images/enrollment_pattern_allowed_requester.png b/docsource/images/enrollment_pattern_allowed_requester.png new file mode 100644 index 0000000000000000000000000000000000000000..33707f0cace50dcd54cc505f00d6c1a8b1da4469 GIT binary patch literal 179430 zcmagF1z1$?)(6UvgNO_uEu9L2v@{GjfPi$DbazQ3DczuSOLwOz3X(%Nh}6*CbvJ)K z=R426-*@gj&z`+!@BQ|A*ZQrseiN$jMiTo0=>sGrBy4FZ2_+;XbO> zk&qsWScr=&NQ;Y8DLC4hT3DMPAxVWMs$*y<|0K-Nj*E$bP&q%%<`t88jr5ed7HK5> zEiD}gipdU9*)~z^tP4l8MihTA#OU&;aV7j7>|K?WQyPxea>#(@Jg?sF)^4|ZvnOJ9 z>$Eo4WP+5H`AeFvsgME5{WsJ?$DGQ^`Sr8-F>Ht^2A3#Wy`azgKyrM1%q;A*JKH^5 zQ9E<>^cAhU?YoKsdI;e@NYs$(4bkKMBPwAqlHSi`DJ&3GuX~?#5FTGJHbTn4AHo*1 zEK6UWut_42}qzdc^_>1!ZwkpZ4|j5s9Xu zSCJpbin2_a<=AtIP)tMH3NH$fdIa2xZ zBF$jlc5Ownhn?Uzg@cC*SJw>07lQft7LuF5qN$NHLdm^GWdC-+kD`keSx*7A>jxy{ zgHtYzs+UJFQy><*4mHA9k(w7|i1L95jOD+qDx8{k;ZUq$t{a^2P3>U)ozg2E_tLBC zG>Q7xcP>dWB_rKjVKsPh)CHo}s&ucz{54Pv*ZtGZ!HGjXzggal`9-S`G7c?1`28~b zC6_``G=Yhf_-~cle0MaIqwhQ>p^b{qT034aQ_E^nmIe(eui&iv>k@`dhobO*^&gH! zal!=$_$NAbXJCF0J$ROm6ZiGY%T5%JBm++?9?;)xEj+JqpK!Phl&5jF9#B;25k5lQ6~Ko#xWN z*o`IbJ`4s#;v5YG$t~RNU4Tvnz6HzXg~eh^7>{5GhIV#Q84|Mxnn#l@`848CU`B%~ zn|`y*S-quLyup+Q?*xVfZUw&iT85d!H%eOD81&sNMTUS*LZu4#$NUrU9ReX$zI9^XMV#MtDP!ug?EeRLWRGdVg zD6XXlYuF9G9U3~|6H(De8p0LvG{mYznbO>*bEOan8%JT72;_cSHpR|Ip`#m3P+~=; zl}3~Kq>%Pfvh}?HbA|DHnMj$2J|YwSZ2RhKa_pBEaZi;LP1UI5u{*#}2K9b7ie6_I z2Nw*{TW`ho_Jyuz?PMSHw%lxYDUr^3PR`CKF9w5nL6t-J!nYwEPOdEH8wwb|<_y|p zwenW%FWw_9;yIt^ksvF-#oYeorSl$R9|WQz4h%4lK~nni?xQ!M&brbIOj(o~F-#^D zna*dGkE~I(zdWiW+r~Kg#q<($&@cQKN8_X2FXN+VdVYHQkGx=zz(6WL4u zzr!jaB6P%|62D^}(_#OV==$*RQ*i&Q-k8-Meq&Ch$ZhdQw2ZMwQUZ=x?tad+6|wS6 z!AgqcW2kjvA=xYmk+3XG#7i#x^bdr&NAT|m(%J{}K@-`G!{G>*T72*Krv^yM-N!GS z`Z0|Rp0JS0eCK%alm~_RdvDdVQbMc1vx{dFp(k%C9cTu>d}_qk=`?spGuX}en{)rw zIlmW%UP!|)^#hD|Y`2l3w8Z#NFc(l+4Y;V|UxX?^nHa5UpU|WQ4=E8Xk;h7n(azur zE!BL4_A|VpXQe4;+@;Q-s>i3qy^^Afqy8DYA``}NAQhB{H=;Gds)WDspeP*B5xN7i z1FFv@o~z20@<^8H*nFOGsAIO29~X}2{yAZ6=g6fgngP{=F1)s-)2DHZ6;ZBbs(-Bi z8ks(oBegnMNrq3ZNya_5yxcZ>H=m+}RVg#S9p+te$#;UWNm(?bg7GYbKj~R6Yk}?O zjI4#6_UvJEo?0ZWXJs+sCw^IixlAop%*QNrhTlmuj+Sj$U%vBT zZ%gy>^9fzZm7b^_UNJx9GBZ~*r13KPj~hnM9fb*rI|rXXT*7%uUhUgsV>C9^`Eu}G@d4qo+Ojada=Ze5 z=ufS9Wd@-Fj{;D^bOEzmbgFAAd;fL6gemhtN`D5Y%O`77RwwM5plK^xYYJ0V&PD45 z)7$B<6EwqyQQs-TJ(C{GB$))SzV0*a(_`i=QB)f(wJf#OjxW=k(3~hK8`A1%sH&5$ z|753Zcho=eCCN(LTHDBTGRkz_j(51ccQ-|7IKw2Zp^B}lKoFymt*_K zeC2M|l&^_5xm5&fEzLvl$3u5iR#cXczi1BejkrfSwH@^tsC`okc~0i)I>k%mmaLOp z#_ASqg@Z#WZ1!$>f3o~hx!2@_Nh?}&S}3gl$?%KciK)4%aGQWxIk(^|rn8IPfn9we zL7_Z~I*R!WwG4}l#0+v4a5nf=R`S=mm;}poOcpyF-V=p9j+$N7i{e zQcFE$w3HWG=Z9XrSFV@rHzU_P7cQ5nS4Y<+*OcfQ=wRe}G(nTunwsgBDK->c!VOez|m>iL*dC#4Vv7;`8F4gEPRifv*CeV{QFPvA>wJ zw6$wAJ3rn}0$WOWbv1toiG371((^+RQMj+j44aRvj>3~1mkcnsJq|;7ve&cY8%1^D z85tQe8)kN4N2e0H@nqnNQ2Ur&w*-C(q{no_+rcvl9gsfGtCAj<-ir^2OJ;P7qTunk zM1((uJXIXYVvpi`*dH60SGij&!JBW{4ILSupq7JvYKf;J?Fvl!rSK zH|kp8z4Yp+_?`F0+;Q)*o^VJ<${iF!rSTL&c=;e1E7SDclx65$(ne|%O^raGNQq#H zWEXB3ep~OOzJ-rB!i@Z8o^O0@9d|PX>so7DzZu#%L^aYca``&?v~(#d(QKq4gdE1Z z^eh6MwLwZR%CoW+Fm8Jqdbf=`dMF-W5U4)({+PhE@x{38=kK3o%1;Vd(hh51=AAbb zovYlAty!#%n#y~=NEh-xdT0#0j9B}W#JN7OokGBG)otCooi^PuHGA*%F!(5|h0(yY!uxCYL(O zFY0_9e*CVdr;y=cp=TvvYpd$_osL@7>I+X6(PFoJHUE08cO=nHT~5QLeXh)F*|OJi zdUKFF){1mOt4z1~w6D3;Ws(`0`Ba5eowd}fL$C6-H`oumj!cdx$>zFNx^`o24L;za z%A>lf{XsjdUT`|4_GH_xbg{UB#D;nH)TQN}=Xz8l`SbCN@o|AjH`XFCD`W2YmLI## ztpet5;$_M^YeF8Ly{GzidVl1W)T zb#1LFr+u!&?h@nG1Ija+ezdtBc#NH#l7;fxx<>3ETAwyvY^&{-sW*h%`nGd!u`bze z2n~3yo<;7d-x%C=XS|6XG{W(xs1=UzeYcK#HyqxL7Tw`I;0g6qx*glLIN_W$lWY-h zW)q=2YTXK2`M#bJCsKD?>Sb|u_)8z;TX!0@yW>IcJ$~mgO!kd;cCoq5W;cAJ<&Jf4 ze*G+;@}bD~dC%p$Q{}_YpEDV~sl7Fi#&4~b8$Q^%T^(Is(F;D6KVbIj3^p}J+V>DZ zs(p+^Z0`#r$(_4<`cQFKlK_0pSUN}htRKZs>->&l7Uj;CA8D$Ez_uex*qa53oeK%C z6^Y-l>n+(-$T5RHbM0+qO(qX`uc>kHNwG{O(4sHg-TjZOKL zBw&Aw1HXi5%$=R>`Ptaq+}v2*I9cr+&Dhxa`1sgfaIkT3JO|!*?&NOkZ1C>6trP8^ zO8!-kgo%@pqlLY*g`F+ceZ2;Tb}r6BG&J`O{rmH$pC<1t{--5dr@zAj2FP~*gpHl` z1>3*t28s&a-{n`ZcxPg*DPds)%o)&zFgrKj3&DR1{C^((Pm}*qRO3I3a&!D=(f@e# z|1PTPWa21pX9G0qEc`zU_P6kVKKxryknMi#|1lSTCifNyPrcQ+3Q;s#7zIcr*K zhIZSJJcNd#=sxv(nsR*FW4thpXjgiH3Km5|hWH_&QXzr^VC+y9@siosM=D%1uj|Gg$Kcn;;i^ap581y@wG5c(DUf9vl53<3ga#P~nP^!KGg z8b3dUpg`>Z-WnB^JgpAt585{h!kFr>H9G0|H2S z%Pzmugr=D)LCz;KhID5or=Rr6T%3J$70LQO)7Bj~rvw+a_0y)NJ9U%gQw52Vl-^@c z?7x5rW)oe52-FIvlIjn48WvL=evmNQxP80$Y&y3pz<+VOH6i1)--(eLLg7*9(btQWK$%dU<)-f41mr_k+T7yMV~L zWv8CAqW#ix&CA6XoA||-2!Y+kHKLC5pih>?Mg7|~L$-u^?+iGNdt&-8>S)E<&cq94 z7roEYNnYA#kr+j=LtCaN7?8Wk-O`$l1_iJLF257$TQj6uSAUIC?|QGLIkeqzce_^A zO<}cR!P0g-V%jk8YPG@M{Pbwb^@|+uyzv{Mld&*mkz=^{!1d9PepO`Rt$3E|UJ=l# zUPSxFp6^}ig|SVl!Sz8mZ@er==qHcOq5)(qmbZjj=G2_uA1fOVRv=K_x4H#)B65Zz zm&N`rt%BftC|aP?kWd5t4{xH>2-SuKkCK+6r+xB5CkfLole)}@N&(I#W%b3tl>1&U zQ?BiQ!>O2RUro|Z0iHG(rgm_69Gg3R#bo^Gd$XkvqZF~Aw!5{sIO#oo(|*@{LVDA2 zcXrnw&epEs;PEX4hZkRtOYu8T+4b#NN5xb@bVDCoN2?(j^G$#s>g2aa0xTC(Ny7!x zVlEpYls;2q)+QSBrl~glaWbsaY}h+hdl;0x^KOeaQ9`F0xo&XFlCrfu)3!*|(;2IZ zB(lQ!(U$$MSOZ+6vdgxch*h;o&SD%`)RSo?7#3?|7T;kHt+q#mZLeTGx&81fqEAOd zA|1cS?oJyz=ubSq!_+R(-mA5L7QQ)FuK7V~#dRY%e(`qJrh&U=kl$+b$QBmtzS-Tn z6JeT=EcmaDg}6h7Kxirynb86%eXoagJa_7TA|9T^6fyc!QAy}=v5_MCW8_hm(oh`- zgu}aNybit-twnGSGKDv8=DT&_N^%{5MNGyYfI114OoUfr#QQajB29SfPI$MjItfn) zco$_K#?!(gqh$3+TN(9+gkkb)C-7 znF50eUS58GfDAqDQ!o|^@Qb;*tmQ{ThL&IwCHpGw6{%r?X&930$*e2I9QKu>5*mE^ zM+c>zBBxUSRU8OIWE&#LioW9@-?}yF@1KmBbK7la3vzu!rem)`Vz35z;fpSc2cT@( zoF*)4P`2`J$66dhq=}m9IMZs_Tw3_{e7TsiNBb8wtb#?{sPLCVZa+IDRw!k38LVy2^h zPWkbAIQoEZcGD;5?h^FiYO9`R>r;$hR+F;nM}y#kB~9nySNM0^a($J3oKR6j2A0m4 z=QBCc7%Z9r>;ytC8XX(-fz`Zb^_^fXu|?v6QZh?&W*hy5OLlny+Omh%A%7KOmM3Pd zuBe7#D18J&@zx%7xZnPuz+QsxyQw2B%c6WG#*O|N`@WQp=i(K2!Ki_6nt%;8Lrvv8 zlsIs;loBG^6BN6q6~oTTBc%`nTJGl@DuvkFc!Y+hgclIRi_RK#U7LD~Fb(BAWQgm4IGKO;pn=+TuH##Fr37RH!p}Hidb} z=VO8aWuz?!>J*_p*-b{2{6vW3bI8QJyjY39F%BwUFQYuF<$NH-{s{dqKoIQ!q!Z#! zQVj;jY9{3l+cW2yZy+N>We(PQpMa=|>U};j?S)un#9IXWy^Ssz)(58E#a;sH`_Y+m z=qj7(TZBoE-4-Sl)pb{6j|Vy^`{c}Jf|iQPn0~@{ndl_LGRg0)bo=@5a8p2`J`4ln z5i@);#v`lSUu-=w%5a4(F?NIgC0phKfUWD10s4bkOerZYitr`E0A=6l#<$Y<0#msD zZs0M*`TFjv<4(ql_{wDX1A3&jxmnMVfqsHPLAs8|4j|qlx(75{B&dP6X9VYSw+#BVc*YG(pPKGOm8E<+Sal@k^Tthm=J5vTDMr z3NR=etQJX;+v8CXj~WPTnrI10jrHX`L>PmzN!InZ`0M!Z;8kRNrp$}Vwwl`1ROYPt zs%o0_pJ+RUCIHQ9TEFPy>84z;3VXLH`p0xk;aeT28AgwmzDrkIFiq#Z_=`mh!N;|J zS)o<7O{;`QUr=y9@-BMSY=1RuJ@~2t9<;Mn&(S(g9fE79{`0XTS+W4mbQ z19m<}D-~1d7ZdgPj_JO)7pme0Kv5?$Zd|Sj4I^yM!I#T)vxbKap_%S$Bu8Jd*rvvf z{VM?LDX2NQ@)oer9kG<~Nj=X2uiJ}tX}*;!ZG1Ff3$?cEI z{qa_8N}qFsxDKx{dH#*OwFY_y<|HpnZPsX!+eY_`)#Sb=z|=agHFVtAxVH@lxjq0J zW@ir^w%7&;3vUM|*|i=7H|2M2E=f{IGgw_+ZdJsaHxrq3UC;0Nm?deNlH`UOZlTTh zHJ9@si20L9zc*7P>$-k&-)lRIoA0%osx&aYIhmCAu}OjN#mc!Zi&&{ov8T4-eXTcbkfrQ*c3ViT25x9Cs_Z< zkjnD(3b1_SE2ZnNC|ip;o!i>45BunbIs-6L^=~%SO?R8t-!R}t37yeZ9qmnS9Qlli+bXG*vk?Nh+9`2`eqpZ+!XyG@vl5tee08>3JyKDc^7HWacsHg95%kZ zpu_jBUecM4uMe0T6&;^9Kt&r@;$$K=!Mq=C${H3nZ6C1q@m8150&f~*c<%CX0+8Sc znDc}!msL(cJEvxghmgv#l&v>S)TFK7?B8DPF}jpJC_GDK3+@rA*(E14O?Oe_yt_V{ z9sgA^Cs4#X?7h)W`&e^myms_W>e#S{JR+S0zw6amM8+#JHGS`s!06q{j=P&Z)0LiB zOo4fklmsOqes2B91@TuC`Oh-T%Qmq@5b1)ujmwv*+Vu<8AhDfH08qSasxO{Axh{@U zt~^;X%y+ws%eN}=q?cDnh3;TAUBf-4U24iEogdbrsMu|$XS>2?0tlr4r>c#( z(0cK=32i$ePC#8IkDg;SckH%b?dHjyZI)CpjFDWc>el9W+(fy@TR1- zOTmVpTzrRKH&-xQb*N&{Wvozfm1aX2ev_58<+h&g#;}v+w&>l^58dO{l^6QfENrP< zfL51&Jdh7BJyV&f+CBwZ?bWu8IBs_fct`GYzO-BL>yWvkRmqmK6@U^y&yu}^6Gdgs z(j0!|`J~ykU&O7m?+CEi-F*CdHEsT$=#VE?$q(=wZuJTZ+UJyF(|D8fv0Fm z@dBHVD3EO72=0G5?Dpb=z7?aCzS^#djs-nqFkULT2GD>>E{+TN^2X;(R!S&r+G&vQ zbL#>EDu9McGJDdw6TBQHFxb!0$Fla(D5|ItX8Xifvn}xUFu7xl3$E`pz`X_tCNrbz zw;NztcqJ*^jSmmh7nYv)d|(V{r##Mf8dH=cApsfsKO}C>Xztz$0w$Nk^+OSvvDaw# zUj3}CHlh67&22TRVCXZRo);{>=ermg^Xs>-1L59+LxM+*saC9g@7w@5pL%z_F2cP$ zozDN`k-+xbQiyp&h>!No_0|G-{C#${dFtjUae$YWM@t(4vj0P&;;s2CGfDKsS}K%{ z{A4}L<9?H(p~TFG&pAY;H1@?a&H{v|OuVA8>mHJGNFi>R#F$Q7RZQox@bInB=GV(b z%NvU;R$#APRJ1B{#llKuRFiz~t`^rSd~d8&s|JOyw!6M4*X6zXk9a4%H>`ek-@$+Yu6#S$wfkD6!5UJneCY35ZmO>CdzB;9wQOoBPQA0L>q7L zP%q?^EvsD5@MN%ol1c7Wh(F?^bC2$8{6u)V=zAwIb#zuTP;?qeFnx1#dnwB~kdVL$ zlQIwT`_;kd(vj)d`!w`r&FC9}@iLT?jF-PZ&^|-eY$Gz9skmRvX+RPO5|rO;7-5z- zTwWwfnF#O}Az5PB050TO7<2gtpAMPyO zFj8ty)P|yVZ)&sF&!&u`%g!gH!?$dSWah(d8If8<{w4W4RXY{@FVX;yOI7e*9*6n? z&(83eT(@FWE_aa&P)N7#)sOywBLok!5F=F&G0nH8MMR04!FYf+Is>nBv0v6g1v@3r zZj+@ZO!FkLh~V%r(Lo9wl{?S|;R;}2B<@C=3PI0>6CZ9433PAnFXGf=Q?~$|(;07> zk>4U47(Y7Ai+@x6l>gklaceWu^$Q3i@AR4KTn;L#cdcd497`$hjCt+~3gZ?=#h?uO zuvXjtV@c|Xo_*!*-n-&><0praHnuE_FLE*h0b6?H)7Wg%Uo!{Tph?-GC^EVXOJgWg zPi4W?BzJw_@9~)ey;P3N*;pwa+YFp5Q%o=iybmqFqu&&}_#1#yR#JjbV*IE&hB>Cj z9{`(0on}7}HBfCl|Cu~5CU~=sB{vz?w}Q#xe2K0jLP_#+eERFo!(ZJ+b>(`~9I`FB zr8BBS$Gjl1U}+LlqgO(G?xS+N++?Ps5v#HoreA>>%+0-7;nvPt|4V?2Db zHGgYP3f?juRakei@(=ihBKz+~mJWqIZ<)!%Q?ZPMnIESz&{5SEv(~MDXZsV*%F@O> zPVmb@PxG)JyJ8A!n@VS*>dMe&$`A&Zx1G+Y1mvIZR`;>~gkLILmd-ZoiuUw=i)2HQ zOJOGNsM;wgsVl`HYf4avNrjL|9+4t%JB-yRz=CTjV6QO2j=YdrvXLa+4$>V5Kv_1W z<|J_+>rf8W`FGI@$w#7+C>xhbVYM63J=g0$g&$>}edAtxSNFRXDjGwaJ4|I8!>;UK zLwWD~bWy3>NrYvx*4hR=bJM?HS}=H%yvS3J7IKJ=nc93N9*n+9f(J2-s@rS7V%Qai zB12^_YhTuFD&=nwg2Y^!VM<+5bTZ3z-4vctYjGdt1^w~LoRQyW z;6YaQ6w9GdG3=+@*Cw@ULrPov6LwFUEy!>oD`XR=I*HW7B2faE$)x-#;hmQlwp~H7 z+CD8Tl%|2HgyR}p(Tx$W5wMbOo&{0FB63%k=LOw!}R-*CasYD zVFo?VBO`_!BXjg}4#O!8jpyA1HP$Vxt%z?z88b8n-@ueFgmBPKz@reCEh24no<#04 z^^(9xi#N#w4NRa;ilN(?D@Eb{RsL7OURQ!MFSGSYh7;A=3IO*AE7zS`Mg4rJVx*wS z4K7@TO;S)NFI2|87!*bATZ8A|Oo^andVJiU-{kWF7eeZOyIL&4>T}HgoEJo-V=wj! zcl^pe0Go%&F5Z(Y($AcWOIs8?;E>Bva56VuSLc&9?=*Z-WbMIYEQ?1p?v^4Virxwr zV&J9aowFBj@=^D3U%(+{f9u)SyPAZG#%tb=f=R=JxOLnkBPkr);!!!Yq}KmE&>ZYBW#Hh{_9M zfT+`Vgz#a&u6mmhw7h{UBo^jzAqHb?+8@2r-+9hA&@mp(#pG8Xgbd7pEnR- z?KEG_J_3oIwR(7$=uNih?HLa&<9Y10n2cA?R9Q}1uo7K3PPWo=oCkkRRM*oSH(LC` z{QF|OYV%%A9fXKnQ(I&r_{Lk5_tN1lau=cTGjcqLCc70OlcS%9vk!=1q~FVM^L*fE zX*OiD-pxZNt%3f#*xrlMbNGyM{-qc6TxW10diA&2RI&QB;?_OdB5M|AQ+o>J+BT_? zybCYSpA_zVwlf}Z&uUUSUQkaJqrDI(f6Vi=iBrieOyQ3rI`6hn)7@O}El|tO) zH7DUSpBhwD?vJiOaPw_NEf+i0zze#7hIfJIy&s+~2U3oOt9Pq^<9HkffrK^RS(3Cl zw~a5qX-o2Q<7&1WuOws^=@BJLNzPF-(nfznazu}0{<8I=1i? z8!ihH8%h%1^)7!_rAS{Xm=r2qe|p@`kH`w}KXNW?ck@hcx!53q3qD{jZ#1MS>>+-p zmr^=CSf^;LTU@>2(N`Bn>HK`u!}-b~wQ8Z~3E09VL4vjE(-F2_eXB(<5s9++9=J{B zI#!*ztX4^>VMg#qzo{cen?l4~yT{Ep_C!`n6n-^C@cY`)Of&glG3xSYG`~t+P?uLI zzWCb>)pBjd3H<66a@-7=Pa!>3PkOXYwZ?MCCLsxE6}hWjlAb1HjcwScNn1sG5Qns? zc-WgGu^(2SLs>7|8pF)b|XtwoK$N5pSuW`&-fDUs}cOB&jKjJaq zKMB^MqSjf|PZ@@XE$p2>fgXX(7a6!8esf+MvaWETV z>o!J)*1MqqZQjV^)XM?3^RDhlocbRKmF?yz^>EZY<@xJ9*}G4Q?k8m>r%{=21dnek zUBWzV|9A||tEMD>@=)+d)EQPPE_}DU2olQ zvw8Kc+Y*yw{_Fj3@u9y*qCV>hbJ$-}7PqHjq_(RW&8A1p{y6hB@!I!f-_+X7b=xfZ ze449XT5?w1yGh2zMd_zQa*-_scr&`2XuDWQ^|BUULr?q6^Yqp&#Nr1mm6Uj;xUfi6 zM>c69k%pyWv;eoKI9jJu@qpf^M`1mL3q-v(-FtYw)#xswbHmYH$}29a;I1li;WRt7 zJR8cj(|m({F_H8k*Gy(ex-DxVpj{#V2$Q5JQ5~?>v0t6r&Cr>ta#n__(bC7eu|1AtMxOQd!k@Jvu1)HJ>5#EMNhH zH1apPt_aEGoc+~KgZezmuFvz3u9BE5{O`}JGcYm1&%|q>DJ}S`nWo1|kXtJB?s0<1SIM(kE&AmW$}kTfmpLww*dBEq_NYIqBj&S;j$4mc37V## z@{4VZX^p+*r=2x@Qvu;dl<|dMZ<+SxMxkxS?x8yj3k>)Q)6LDi5wP|0<&%4h?H%&e z1_--a35YLRTXtND?c8Y{l`*x$Op9xRL@fEr(&rJpa`*|6`*#00*)(*>s%HNwKrrOtC_V~*yjVg z(Y6Ks{VEn2 z+K-WXhnw#d*U3<3mLOzy0y**|ef{!?@t10aj9m3P&XSr|r0oYx>N80W^x(PpJWTL_ z&#mfiD`h$R`gS+4C>$zV3QPUMwqFIq)pIEtX9OHtTTSsL5|eTv za>~X+qm+Oyxm2C4(E}$6+2Cyh!o3ppU8H<&D`>NvSZr=B-)->&F73AEVe07{W+l+qo^|!r2bkbyLXW7eP%+2#!oi2O@S`WBCOI!PfuLo( zX3{7s>by*ygm0*kCH_`=ZhZh7a-#{nkSf%s{VfF^l4T^7{ZVZn>CI;N)#f?Gk(Q{L z(Fo>$>EhPr3Nu#;(iz_n=-Yd1I`r*^U`RoT@bZoMN-C^d79XOenB2VH!|~T-l3^YP z`eiAiZt8A?XvOz7IgD#VBbj}PEj~X0R|ONYE7+Nlc+LGHn=s~byh&p&CtbBX9^aZb zKf=CvyoUye!>5rsTTPzJ#32oR7AdlWn2D(*h}xEsba!m#fl;)OTKH-f4rZi8(b<7H zej#s72GOEuiC(GW{Bkhh!KF8Ne4V(e#7tx?V=VQg&^i@4gi^k>_@OMvzj>K-a&$VW zdUl?h0}XBl!0h(=V$$=ykP^AfRbDzOV`+W1@`$BPX`%GoeSce4ZfeB2*D9k@wK6)Rkp?SX5r9F-gfp`u2z?9byjuNx+t*q_Zu$-U@A z{rN-rF+3 z@sa%*a+UUsc=MV*+b=iv9e!g$2_oZH6^-%jEu)2@BXmxv^L|v2T~p8idC!WJ7n~Ca z%OmWj=nXUw^^djy;-7DyE=Q1YeX5$Hya2rUi4|*VHx-{5xWtFLxsvmZ9S`$b$--9Z zfVSPwG5agNg(cnUJ(*qzBkEIk9FjRBN&V91&0+$dV{v3CLNky>GjE|;2W-R` zlloiEF6SBFunupr?+q15-BxfV2MXiqNG_-BnD7A53V^$-YeQFr`-zaoM)fC$ai~Gm z_1HunAtm@-AOSdy}gV;_j!KpdHI`OR#w zA|Jx(LU+6L9Ybg+r)+y>JXPCp#{FExlh89#S#9`?$5?;gD!W5r6}8lt*@xXe*3WFD zL_ct6h0N6idY}gNB5dOwv|+Zqh>L_FcizAVoH7UmS`M0XoH8MiJHcHE1|njTXo13M z;zH$P;_|fK)qy}zq_YRI6|Ar~5@V1zJp`l*7jV>5h5PK7Q3HXfJ45ax!};bh<_Zs+ zj)Na$KV9N*e-(Yscs(J$0R*)JH}w(~oj3}kdhv{3I*AvaS)};=BFmlkngf!8N@tBb zdV|bV=O=N4;y*+$+=lRuGtTDC&vRdjw-w(Q_53Pm;wIGhI_Q#9?2-GJ`9qft00<;? z<45(HKcI4Y6{xt1b+CjPMSD6ZIDJJ>YH<= z)lWXicB}BPD2e<9D7--8~mSwpHtYs*!Kkpcz5w;{lkx z?%8B&cIKiI;t_2j3XKDdJnBGFqTV z{Au$OD7uusDEK6J0iZtMC$rk>oh034$N-UwS98AndojZ@w@~gBT86+i2C%pFvkCz2xN=bj!)wNzIFyA&@iU?w0z}d?UR@!=iEw;?jT!$3P zten!@7#_kMR)dX-@{?Xi9J23y`X?bA!(-r$m?NDgu;MV`~E0%Y{o@ zpX?~?nF>#Ct41K}5&yGx-Z@(l0z{$=8QpwOpa|W^PPbLa(BUCFDbf9{eJ$DR<80R$ zxy7e|BmdBGsiPQE|Bb@h9 zUV>GNiPwmh!dN@f#FC!oTFoat7=K*>{d==)KV=Z2>J2x(0bc`2mAIes^H|eG$o_0d zjq59HArE7GF3H{Ih6T^&oCu_iJnfo7y-=(hu)r3`etli6yw9l2jm6BNuTwj2u$wr3 zj;6lg+WR2<)ywxYFrLk&3Ptu4D6mUENhw`ip4lP3@o{Myw{d*m#hI69AF?aEuE}E? zsU+f6$-MH_D~x8es;vyb3BO=ileoi3wE zguJF#Kpa0^wsyNAz-Z*s;a**=2_5t$y9tfiKEec7Epk1RloAEcUs;$8DkT@JcDnux zK|>IjfPe)va%Ee!g>Uk%2&js_Tu*b7wYHljM#+hg=YTee z6?xk`wR9DVEz|+vVVkCKuI&pLS)v&J`2;@1T9fSN2JjB?h(z22QG_tswUOJjXSgxG z-X|$ffp9)7Hm^WE+F4G@QXCk@30M8W&Eh|?z%db5fk_}LgxADXU7?yiVZ2P5NPB<) zlFt2J=UOK&e~g-?!vVD!yGM`?F+hVcG2Q>w=~GXzmF+6sW25;hCm|7o(hI)bu;@eJ zDgHHU@sVAkALJ_Ic<~iLIG8!OHpNAH#yWAQR-I?p;1~1RhKzsxqYZVkA^V22NDzz@ zP+Bi@xx}ti7f^TD*YU`@DLY4dcq5~L(5see@{bJKgTMTv^w(L8sDbd9OO`ewX9sa~ zMbyAd+beiiC~0D4@3RtP4_1$XAjOghy-2Ql@4LEYzfBvidFN4+<|OI{rcK@AXbRrr z6h8>Z*oSa0171=(svhoCG6+P6bU^bK$kIllBGmQ0>uiJZu(*c881R#}P(q6j9ZD~r z&B5P*sEy(3(B?REg7+a{D?b4l z8QxFFLg61{c=hSpU=-2p)7KYNRE=Dk!GD6gT(JB30@!Gcy^~%u-4>*SF=CHFON?5UJ(i6vWQN{@ zvs~24yb+?6&Jma=$53piOJMJPk3nI++p^dG_L-bod9*nuy5k-D zMqa$ycPtY86%@U4ZD=PY!DG^&%b)uUKMt=%a-g?;mM|bPwD&pF#}c3$L>A}0iVy`iT~wnDo0AWGV~Bmb z_Q~uGEV$1kj*@5Loe}Msq;2ExFy{W1c==u1*GWec(V80t1Q}VksEtRZ{TcHIE2D0)VxJ%=`K6<3|G7(k_59Da@LZr^qs?SS1!8 zUHrKikUF0N#RNad;c$f_atT0e91056hy!Q+OrD2aenHd$)7s1=vuBlT*3W?qeVBj# z62Pes2I+J38c0J4IOFKHgkn~|Eo4ZmeT%R=Rul$kqfN1%F{T)(fnE|v55U>{R5E)5 zUipzS`NNnTJX?BLax|CgB6rh0@797_(K&ddr%ZH+$6XERqT0puXAdK^RLGQUq7wMH@w%Vff_l92Zs;9L_h~Qh8t2- zBh>M5t5M1Ip&jLAbOW5&y%Cosj_)1uFF^+4mX3&H20?ANVx}>FuWP9G8r!g79XjnRpwzXV1%8fCx)U zGJXx=K;oJ8EBujn?sYnCMi3&utc+V!i^mbg{0RB$P#!b_Ds-8c6Z_*7ApU5XR4QiR z5w671GX%oonbIY4F4j^jXu|dIAtS=*CUi&Gv;_=(+jHT*t z30wf+cLCmeyyLXXO~HJwZJJ=;4v?(!mnlb?%i?=PSKJj?YsDyX$dMET1$df=V3Jg; zwmm3vxyPxV$40*C7e7$8p{h*_KyT=em88(Dy8##^T+7iSKJG0MeU5!g!CJ^+Wb%F4 z3(;jM@;~k^q4=cp<;Ld<$00=W0YL7N4ixphqEFU|BeuTY$#!X~J6cy)6rB80;`z!3 zi?@e~{>*`W31BGkG6Ed#S7Qn{ihmdJ<;j@xK;5LCw!{3GnB?qOQY2=vviDi=YqQ93 zTZ&uH>RCxDAhxXax5dwHeYDF|{!ZoOzqgC!gnG9eT8`JVZ%#S#MW)yAwFmx5Pa+^B&{ zuUsmMiQL<=6fwfqA1uAb=Rl&R8p|bFpya6k4&WKmakXJEh}S%B@Sfc=pV0iISW-p3 zDfi_)xvmBvfU2)#FBEb->W(;mSXTpeQYFv?_{C#HkbBWFR=Nno($@+t699HiYFT4$krhGPKXL2lledyzhDF(>4wBwHmk{ilS0v z+0+4{85j)>u4ttrVGLejpWf!KkT-Dc*Z#qCgpPZG7$uP^UimHT|f&-5bvvizmf1eYT? zi+cvkZ~eE&m~^nm7^`0 z`-h?ps8o0zW)r*8JTX+!ZNjIhi#XxStxY84ZZ#B_LE4Mq~lFTBpA z_s%#|Ssng8F+)#P=s3el`sF)F#K+qz^2DFaLzm0!1PNPqsW=h~r-f z?bMD2hoxJ`GchE)+@9rZK6E)g5*VSP%F8jv_#0)hzbAi>DHNKd^@vNf>5YFl`S$d4 z8eZCpv=7nvuTOyg#~f!4Wy+Vv8o+~aB^)l^-MW1@P+{;+E0Nv&&S5=O>6lv#EdMjF zo-YRSuPMD9^*I6eoiP%2VV`V;wfOe!@>T;tg)O|QkZK@{uAF>831*y_1!HW3t;llCyLp#f%5{{`v9y!po*%I4fug;74+BG+&DC zw$UX3kmmQ#chqhubqvI%s*@((B8ZP1{P$j=Rwt3%NXNF&9pv@57yVrs7M5p(HXDbtx~Ewxy7q z&3ktHI&9~oDf)PHyJrW@yzO?=dPXP$k)fOt?ZO+S>jNaal-9>$3iJ4IuN9d{o2XDM z3b9`TtUAWsQs~zt-<_8Epjcv}lj}_lO;n`sXW~i6KsxaDz;I#~a2**i)IV{{e_UMp znh_r86^PNkaUzU@c zlZ7E)VRCHn(=8PJp|HjHo*$zXyLKec#k19coJOn44KAKVmo(HrLWM(ZLtMsx7J!;0 z(2rh$n?_uZ!w4bJVDAo{6w#?YgSGCW1`7T+xU3N>-9I5)@~6fB4|{JJ7UlN#4GV~p zfKWT z{gLBfX0B_kbDis4=P%Z7=g%6@GocvKsr3N$t86O1C&x~IO?J)k%c;Wco7oY+#4eVt z{KFB3fpT``(Zs`W<)iE+ss2Ybi27aGrv<&wg=Qq45EBymw6ED%ONuHl(U3@Ni9vGZ zsAKzCj_z=5`G1$qmPsm?a*UC_^J&ED4vPc9Dk;otMgO-yhE5LHfG4dR4o00S=Xm$e zG$a{|xUx{N-o@L*(kCh}r>2xY4Zu~<#1?P$5X`5B6$u!3$1uhn3ad_M@S8`<(7%m} zi*uhhXT!qcM?Oq7c)$>JE&bS|JyLkvwNu2j;Q)}PQ555dq*3L5&J1K27fnN>5@dS@ z9R9fdF_QWK^)abi$ZTwSRuDzj4+zzQhpHvLC{EnZUDnGq%-j6r_FWtrpgc*4Cg%4~ zxBWsaJr@*XV{HY&u@(=-Crnf%+Arg6V!f2%B=1?nq-lT1;GM#~(#tyEq^BZipNCdR zg`Gf@WDiUoeS`7sa)%1Nyh_CBqdC5`W6IDP0#-IV3Y@njZeXUy`heHP@f~>}%Ut*+ zREk88i|qEDwfy`QDbOLJWtqy%#cyz)AJ)0$PEA5Xou^xn%atZNlTKiQLTapWiFgQ!6+f7PaGP5xeJ)BD#NXy;~E|GRDEcScwc`jyZ#^)h^ ze1Pf<=jBRP5vRpbL-5{N*!`WC6)G!Pqbw{n!dV&oI>T;pdK4es=Q||i+n{?Q z?~8XMj!JNWXj=ph7XQ)1)Y-@AUY!f?3s?8*bI)D_l5s8=0sjfZgU*dD4S{V?-o52b z(4Kw%N3?_&qO0a^054Ke`TgbNcdL+vCwsxq9~y$nazUE5vXHA zGoSc=AU6iPkd@RKVEA=%L06iD(si%3YZQtDQk({PV2GDFn$^0StD$xBcBs6z?VA?d8m0&uy213@tK5cI2{xhG-L!WbECHr{6#?njwBD&dcnzif=zbX(S4a|6IA%ANjiTB6iBu!iaF`}W7E!;?4wp_0o+|#zIBX?vfjZY2 z8=10BQcJ9Y4ycU=+{2_orB4^hN8s*I*Pu|gKt&!~pf9hgB;*Jo6Q>Zz@BFd98{`QV zDua+Y-KaSh{J4WKBcN3B_JQJV9^jEU^kn&7tKPVw+s_2c6K9SOQfLXiYN*0 z-73#WokG#dMra)REK+aqZUF4ZG&@G!ju$hIP7|L>xZcR15Mf`F{zgjXAgBIU00r|d zPSMJE(`MCVH%cvu${@BxgIj@|I)l&S}_>9Y_OH^-N2)C`eZOx;fWWQp#kkz zv!ePz*l%9DWNnKBd8@fKn2^oE{S}uV#!(8LWAfi3=qVi~5?OAwbnJS(*^7n~hIGH# zmUH%GHLWG#W~!ax%~)Sq$||$+aZE9rFejxjup#Gqi=Z%~pQzjkDwK1Sud%daz^z*R z;7%}c9C9HH#4LgF>q}8QF0~X46@}RRCMzR;F&4$f*8I~=FjENP{gm8~cNd6YP5yvj z-GePE$3bNsIa*ia$3fUq!<;Z%zonxOOa`&f?wkzMwBU!-w?+2}(Pg|qFQZs6db!7X zEcQfw!LkKEQBa^KB%Fe+qHv}iW?NuW=)Ad@q_;Intoh2j*71EP(c~>Gg^Ls(*`kP} zPnS;y_Z}Xp9{6k-TqaQ$DJ(CKbOMg+^6N?Vs$iEv-dzy0MF%YUyNK=gpj*_CqrBQ? z>!8>71I0SzKI!k%fa+9|?1vc7=4Mot@y9SJGA`s(?NxCCmZkgQ_@|z974rihKMd@O zlOhuG^BktKCq>RrHvZPNIq;)Ir58AI4dTX+!f)#YXuES+pubSqN} zff|7q`THdTFGfm804l*@J9EybXMRW6o$(|~_+*c7UwnK4U7iY?gRniE!C<9UWU(1C zCsz1$1h;TEIctq7ou*-Ka10o(G3)LATkI$P#0u?;cog-AIXQP;z*3 z0E_2YKbBg|nh61#1yiKb4Xuzb1Ad(x0c!{?N9UO%-zmHog#DHMlI<{4M^>XPx(BK^ z&>9#Hx>>^B%DKqvBzld{MBO1wbPSc!;|<-ri#A=CxGm~f3z`_!YxZQNYH90;QN~=- z(ArCf%X%P0?GSpDRkns!Y3o4HVWKkgdS6!PZgWjj%Rs{?zQ~2a!O;h6_tRZvkK&h9 z2i!>g&aQua=dl;}M5j}FMs+-NxbeqYeU4K_agv`q_S&74Vf}trEpbcE$rpd+aXAR> z6E1SG<)gRx58$_PV7&*5rO-E1am)XB0o(74y1WSW^$8iEH%mdp?{2w{+f0uHvZ~&3Fo|D+5BR{!M@k|g;o^#-tdh3lq z%(a;LfQnyBHuq!y5!+oMC{O1G@>uQW%4NF|$&xT2+HG-3bDFSFxd@hMOo;LF)QE%C< zbPbJ0MBpXty2shh^KzggNxDrd{mykx10{ef2Z&4?12z3$d-LC7?f;ye3cqVWQ(1Co zlQZkKr@(>SLCHND!RO2geQy%*oNm=262Mz#4iVn|7Xt_F=fIr6(b|=N8EE5Z-kR-$ zGiwr9nqzK2LAwN6)-0T4t{bI2KwMx+4Dxq5Ko#NvupE0-`k#;UpEI|K8kq~Leongn z57$GKNx96!$)3Iv?Mvom!1-Gy`rijM{VouFI?O?`y8qt;^?yc{H}PFjQFHcJWq)Uz z|NP;9KI!lfOtxaZW%S>y!K)v(-v~rE>kawCe?E5Amw78b0xuJ&5yJ6zZ}5uQ1P`e# z4@R=ZtAp}iMw_}n5X3V7PJxQ)Kl0G4zDzU-3`7O#)A4`(LH-C301W!vop}G_h=RZ| zX9oj8j6v`EuRq9eM^tp>J6t;9U)J(9bXIyW5Jq2&3I6Q|S0urhro0IJL2hY(MtoAuKTrWMM)gp`QRQ} z8+Xm@%EYBD0S1&?w}S{><+>4m8Wxtyv%ul3>qco=lr7B`SB2X@*_Y-zIRl~9v81SZ zGB=+CoA;09JXh>DrdKVTzmtB9E)Ag+_2}$8bx=Ka+6 zD;e(-y)kamzqJ99_+dd+&egdGf0pbC?^nP!dhNglK5=FWwEeQF*`N-HM}f>!Z<_I! zdA*biYe&RGwTwxu@46T=#J2C&0j;0z#if*($((IprRg`XNEB0gX<*4B>WrNIl#L zxy8RiT@Jv7TSWEmiAXX~#DrLSwf}U?S4laTAZUIhcDCIO1%!f(F9a*`}>$IULd?@%|R~ z(TuBY%OPv^RGE#^Vv5s5zR|)Lly8u}=eZ-NqvVq;K>i}@7SE)0`J-M`6$oOb+U~6X8`{nLulD7c z@7uN0ECJwxx7h3F7)FL*#U_AbinT~SWv}~hmiDQzmHfPa)ix~33Ca+zC{s!OVy`zX zL>g+OEHQ4~>}~Q@o1kSa6J|no=y?D)$X;>-^)8)_&TwLfw@kz& z*8I}`;3G_uMfcq=e^bC?;s&aH&n^q&+GalNIeN3BdxtG%dlx z)(2&oKRbtVM^CZLqj$jbDbiId%T`^}(BF7^YYZ_3eemw5cSjD4)&WE&6X(0%uV^#6 zLX!s=AB;gF1Tsap8coyOosQl>y2#zr>mLz!Rz`a0q5W#74dX%qlMsHM?{~pQIcNXq z>KfY%n33IcqZ$T8qPI_KS2Dl1gpUGt9&`@~q{j7#n#j4SY1dFl6seF&o<=-4TE28| z)S=Cv^Vh8~uloifH0HDZKs^=?$~5V&=dQLQ(4XyyHhhK9SKq82yzBAs&t{4>%T58U zh~NY2<;avto4O)0VYhcrGo^PQS5Mh>2nSl-89#dp<~0HJH62S)O2XsTAcF+LAJ)ta z3iC3iPFDe5Mxt4&OY5|r{vYrV^zKp%fqwctP~d41HFflDZWEeAKFiLp?bol0_PzFfl=&j)hCd9#lZe5O9juPf1wB*51h-i z8cKn3+lH1z%0f(d>q(t;nU*~T7nC8Xv8$-=6`QN>`8Li>piU}nS^Khz}Ke2+&q z$G{HE#wxTt&kv$D50*4a0^7*Ul9_LRAptY`6Fj$qwDMPzwV;_GBe#8 z1S|`=z3+FG9wjYo$rXR*(hwa@H&ZMQzj5n+y!>v_vRYr-(vEUCMJC`oHa^s8sqT|r z(NbMNsr_YA6LpMJU6z<~pNlePnRkkB*bhhhMqpo61Fq13Y8%tQT0=CPg{DX3RrBZh zP%C4`Snt^rgC>;G8Q8+iv!XpKF9G{h!L149PqCOflt`^!9B|KR+EK$ExJkqenTrV_ zNOY`AjVD1Cd2ItA<&Wp3EX6?bfVb7|OCWOAZ=Q>y`SNaKH;-q zTkxDIClVMhw8!~uMUf>7YqwMoy;3bB#Pmpn1C;KC*S_B({V8REjhbde3&UbzT zAf^Y!YmgBP5iKeHxWPWEYu~dwb;B;uSdZ1BiG>>c$t~?!`3*q0k!$q%>b3ggB&YWe za0q(uUKPn)K_GXRzmQ&<$H6*?{1kXomO+Cx$)?sKvIPkG4R}N?D|}Me#2V5_0BQMS zb9=w7s~r3>$Kf)zx~THRK-TlPX<`e#R`nVynLS*@Gru&f@8rU_2?w`HLnyLMh++ z6a`D|-siE_Y!RdeDL6+)Cw4tM!7P;z>fC1=<{k>8ym#%&W1uvcTQYBMa-kqEYKb#2 zfzVseetH!&qs)&wt|L$ma|yujj^%Jte`w-(a`uAfZI2PHAlSN1!J<%7=cW>$=?Kw7 z`?^%rVY=zpWtaPja*~;fCgo3<(xhZeXLUrF{7wU|Vt2;Go$Ag<8oJF2*G*B6LjKu3wj;o-Y+#<->jU+k5SHK#M({dbvbh%if zp=F>yZ)O48O7qQ!S2jTUU;kN&Kf$H~Ok$Ei@zA8}V{kS{(vf@v<;XS;I<l?E$@J1y z_7vvx5zp@%@;p|EETrD)na+j6JRV^&S_A8)B~Z%A#U9vpu~t9EbpyR2C6~yzA==^b z8Psvc~WlvG)6^F_u z;Fv0h&f#F$jTlWcAo1Wu2j4y6HV2xkfxjK?+O2(M&#;PC1X)sp#j43)okd z|CmTgR-^lLJ_TjCx^YHF0zffljg!8IWyflFw*QvRqyOujO>@n}T0PI#^iftua9Tbc zE{66m-WV*wCwDNo&_%_JCaY%y^lU-^H8C(g_g&DF+B_E!j+OD(vo(Za#9X^#J}uyz zQ#R^;`rvj0^x?cIUgQ$cNV+r0@cgS_#ZF;)uPnXfXqgpW zCAyCYzxd8Qo2GLoPB5$VT`1Hz)b_lYfdUyv_yJWq``MC`?K&!fE&oV5%fQkf?906< zRs#|Gx8J{-d&F^BqaW$K4&m+wp1VO<}WR1hti@J8E%uY~Qdg+lC$hUXJ z#P-wxS;E`XDNWp%g>d{!Bc6YE-AwVwnJ4_!{#_bJFO*NUO+rGmNX z*-E~kFQKYeA&fEZpebS@uxw`H#z`)9@XG z03_&MX5fUL3TnmafOCl=2ZuEJcaY}|1Mn%-V|s1+^L!Xm-#yfd(PRfEoswSVrzp-7 z%9M#=D;QwnG^zp4 zH7`I$cjMXsktJ^Q|DO-J=;=(}W(TjZu#NB=~mW`JeI zKF$E3xfEx8z8OHTHW8_sLg`|M-+R((tM>qgN|x@mLANi z2h1M)cp}OQN(*tY4G?Q?P;y8~MU$e5VH+Exc=S;fBGGQ$Y_%&!OJMO8wZr2y{kTmn6N@DhH1JI2A;7!PJ3HaG-GtbinCZTzW_q%gx^$M{TeF%juQOxw%;>;2$NED5RC zpZ+U>xxdGw6nu932A6DGXkjVS!r+TNFVtQn{p8C%-8e}*40`8R2j7(T-q)+AChLCl zcRdFi2R$bM1L($e-48}Ou-;b)j%i!5+Rp_tq1gs1l%7dlkTuPnh)^$gUnFN5aK8~)Vy7Uf6nltMQTMX!W7{6L8L<(1&0 zWB#=O?m37(lYfqCaPsdiFmhcvYqVh2c)l(7|CJiwAVjHCL^tfCQ!!kxDzUCz7YDns zxY~~!-adbodpNb!_j72mzY9Nq;9__0$|gYts_{*r(w4C6&3rd>58dGcxxyE)pZROU@X%=HvS76H_dNFBrhsW-ouC zylQB#d83YTghW+h>C}I<5PY6syNsrUV_?4LtXxQ6uceeyq_xV}Y%^$B$* z9<+Z&aMjRyiGBd@{Q+l^TA9#WvzY;1T#Ur8+2IkY6-=uXDt={_-~qsbIj!3*{6C*S zKf<{_h#K2fzLLK+T>l3!LoEq<+LHcILdFk&A}u2w_nRSqB$&eC2!`hwS8hZUD756Z z@cV#2pYV3YL|;XX?f(5A7*`D~H6f@>2s6L&VBM4atI5!h`RnNe8C0viJu0jJsyR## z0bw$Ml?HAaLp8L&G@yGspvD$$|uz2EV#k3Nlp2a^y_maoKR{`qLT%r!I`hG&ug`slR@ zU>))r==I|N+w6o#f&Wr`^XOk6-GLLN4V%W=j3x%{BK}^82jJALM^!e%~*fsvHx!}Rz>KSJm=J>VKcRGbR`cG0jhnU}G(wjEB>JK( z(Rs$D2X$aznnVep0k$=PcmG*G3e89ubb4*v&~>2b+`QYxmR8|E1-0k`P(n3ww<}Fb zmz`+R25U=55U9kGz=a%56pHZKG>q-XugQy+PtK)m#L&{*c4dG_X?wU^Yt{v*xJwhv zGXuN92_(vGeMG)LC#7K@uLAq6+^ti<7mWufB!k9G(OGOSB%MESa4ioQR`#OWu`-sG zeZz{h!}PyVEJT2{ev%%nMgf_xZs3zg{}62j2j$_H-oOzC@SgAN7Mw@~}0X*+m)$(#5`*Ino-uTkUeaR$R3I`7W5qxWG<4&hA${K$*Ru^iA9o2MAcg z$ha-lYF+>X@Dwcoopr4j>Hc`-i_c8{g2J}Gln?ZHlRVl%KYF?l*oXc(EO)x1fNLVdNOp5zvo2$Y{Tf{T;51X{v-)U(3Wa`t z!64XR%;0&)p)l1h&=oJeUPG@RDqe26kn-oM3~&Phx2lWD)D(!v9w0W2WzvJw9u0E# zTgFN)T@K2z(QT#(wxO<1um&c~C4w@Ok@Q8OkrB?`n8YtSD@L`g5>Nrjy2x^p9#R28 z-PW>VCGyMfF1dSK7cnhO1q20a$*oC?Tt?77r*Ad&biKW9ag;2?17((*TQ-nI{_Uk4tI2*Q4kpSXVM&YC>q zCoWd)+gcULm283mt_*6ZE3XFeT2BRlWa-8CKnk*TqbZ%K0qQ~8;RmM@=svLc2X4Q= zIx77JOBcbh#;YnC&aQG)vO9bZKmFX^FNbR@l0eRBi#E0%@g#M6Z5x9l9W|SKF%C*ubwYAfo8gxESrj zVb@7~{uzJ+m=3?L*UO0Y5=~-ugOuT5@sK!9A;Co`Pz{O`DN%DQgEsmt7c?=ACt+wg zF&gzi7^K|SY5;t?rKMRnCqc)h2SD93vfm#h904FKet)#W|G8+%qXJLxPDbOmaYmT< z?SoEfn6nMCU`EXVa5A|;KzW~{VRL8D&!=J&%Jv2q_YL4MBmnXNGoN_sQ5*|3V}tPh zHO!D<&@=allN<_%ka>=aDd2HXe@K znZyU~4>O=oTQ-?)bC+;MSt7&SAN{WSsj0IWFD+^mrMq}L9JjbOJz z_{UsjvJw}`Az6FY$|(#Q`JJw=HL3_|wxipyDb#H9&!2)8=%j)IGUjvu z81@Tx$Wc-)n27VlJH4-PRb0$eAZp|<_9{UMIcf@H;k}?)&2O={E?gmY6ssHE>28*l zp`L;Qj*~#MmEGm20K+;<%moE&$nXFPOJRaVP6ByPU0j8zW@PJ^Ow7+&0+Q zw(Bl0P611GyRk8{?^~lM0Abz1=JVR11F9k=n9TzDbp8>z{pj{#PRs zR*m1|plh1su@Si*{PFb)c{GfH`~2B-tf2*#HD-0Bcjnr?%bhUK=xvH=3A)Pw$XkBH zX1TDm5#Fra0w~E!+69OK{^nbM_@$d7_!l z2{l&E(4i^j5h>l@P#q8jKTf5J3&V6u2 zK&~&ZsF~7bA)*#bwlT76C#Kjq9-fqwhXuB?do2|o=2rwpW_;;1sHN_gLEB!yvy8(^ z@MO2%PO3LPB$zVS0S!k*CQgC%!im`ux`={4Xj+%)$OiSKcS8W3VfFa{Z#GQJMO9fm@6+f5^_3UtA8@0U;_fk&Od~{Gh z_3=fFxrO**VG+{MJm9&ozS)c-NgzeZvZt!hMc8aaKfO)Z<{A|m+pbw7E`V*_J7HofYX z1Rn%D;Dam4-?JjZ>96@o`ahmD!u%lJsc$^-P*@Vuv{uta?w~XV4|C{SpMjGowJF}k z8LY~U(P&fC(_cr9ox`P78jgHCgCljKA8pq=)`#ZS=5rZO^wk>z zIJLytNW2qplhly*K%~2ia3@qCcR{Xl>vWLSt26s_s$r}g2TLn-vx@z|13{uDywfi< zUU>AT;dPaj$abL{x=$)x8@m3It$9ID8}VS(;OIx~xRTkJ<2Lb5ZznT#p4*narX9p8 zDETBQ&Yv{z9I;&=ul${pQ1zBbFYr=|AC|Z{gsnI13bTrfD(h%&^G>U3`OGM7ow7!c zHkz%qs7_Q=X;Qv6gs(jrafF$T7LZ8XpMn~xY@gCA>9hz*gIQbEXR9PLjw?Hih^!;y zt@~*gTPyc4phqXgdL7eswxZTO(y1@s%|`EuaHUTwW(-8WR_HTN9Sq$^GkR%(+29n0 zp1ybt$S9-V<8u|UO!AIC6hj-fXO$=Vd8VsNXK8I<*{Ticu+On6UlfLdx`ddh^V)KX z1P^o)U$MN~G)eAnUQ%DMsg1-9{O)yIwoqEsA|9G{x&s}OMVkUC^z_q>03T*Q;6zY% zrU4w#KgM#YkJ$Hd-&iGOMpVgl^pa0?zHmXJe*>I3ttT25r23H!((l?oZ`x^tTWU_u z;!5vk4^r*QPrVs1{7@OPiYI=J>=S6$FmF@$E?on)}gZAX1j8>&cX2FU7k%A{G)>QuHwARQN{;Rbpe`7mvqqy zE538#vjCWHlYYVe0f!x;s8@vwdY~^1xycAc^%e7HMhgj4xbHbot*5Fe3AtmzZ@oq2 z#)9hQ=;vOJtBi%oC$-l)N2Lu0DA#}ENAau;1zLlwY8h!#c9E z@BNn2^iXXzv}XS-uh9j_d?TClbr}HF>?PvIvlGZgC0^#qin`F8$dJ*mG4I3rsj`OM zP8Rn9ijkrAQ3d|u&f=36BHH2f0jFw`z}QNKS9hHKoWZ4{ZD%`KR@av^)7B?+luXfJq(#MJ zX;ow4pbL%q+GnFg;T?YPgKq3vN4fdl2qHAsUUhozhLAJ!d)K}R2idH{*St8o_2q*h z_FJx+ebF=cpth5ca@VkXpfQl7zf;jOBXBZepHX2!qclCW<*ZJLCI*FcWhZPibwM1H zQVm`4&ez-voq|c%<6(#AC)s3uUX4o7l>FHWp1KJ(p43MBv-A^HC_%MC2CSY-=B}mh#JiJ`z3ij>R63DQBiJ8v zoijpdUG*4OgommFPcH^`Dm*4Eav_1(TMb#YY#=;Mkd&n^?T0x>sjf5H>M1Y)*o~c; zmbvT?+K%;lr(j>bHS6Fq|nrY0;52I-n^L*kp`EQ*v?`=OYBh8|1XJMhBf5upiyv zMujB1{k5KA5$??q>&@LTv*r@RX68^W%l$`-C8y^GJ!Y@YB?HdbPj}3cpggK}%~94* zxbH=FP=a{U713^~E%rW3(Y~B=%I#b_aZ3WH+q)upPE8&~A}c_c*c%Nyh;@bnMoEtG zJyygiE?slFN{vm!fx4$gS+T29lrktfKQEqVQ-%f3zCjulk?1xpCBDd?`4qRy&I@?K zcR2&g&NMF<**s<3T1J`M03L6)plS;MyW$V@>cwfTk?p3T;9`c4r{5HQUyj$^eOB|) zZhM|c9NiB>n?!^CA^ciIPdLSO8Zl8qE-eJPh*k>ZE@|q%1lf z(?t(wW6bjs!&D*0ZqK=M*yFNpaB@Gbm@hZiwN`*rXb;|JmQ&Z~(P#!&?c;;kjqN-G z-DOb36{I17YQK0KasGxswX!dal>M9Yt;F}eL0(E??pn- z%2wZfhTFyQiV+ik3{ z*>wA1gWN>als*;to-X!Q;p`WIC+VDmI06!=boc%0P;TzlPQc^MqfuhwN9*yF89}q`!tmk)=VG`MFmH?%bATY>j$vdS5!FT*Wjt#R_Z;%ziui& z7-c_B;b&@c0&z^-a4N7}7LW_gO{HU4U|2eo|J>87^=Ls4 zN8O`Byf?rnd?S6(c9TGR_U(LY_H1c7?eu&eYbA_H_{a&f)e7bT_H`R0f}{Hd`N&6U)n zt%JJ9o|yqI^E!*Gjm*U6N94~RL=$|(EXz;Z9V=Iejyc>L#+=kt*l3 zFC*G5A*H%dyX{z6p7~Pc62(Y~F_~R?edwsvB7W?Nt4QV!gg$whz`FJ@-=*cJ_2lHE z(pBfl<#2rJm4{j1Z0Jm)9cUoGzJi8Wnxc(|#G*ik4<2(xX_B0X^|-TM$uMbPc3JDq zB7<==57ktI616ubBzHm(zZ{i$64j^?z9kV0O48(wh->1sLlx53-3_Hj-f1i1QXl(# zE%@brG{rdVLD@J%H zza|`M*Elb$25VPCl%hVlD<^1R(z3cQai+=e-ank2ZP(^C;hMY4%EXyTfna~#>PI@w zW)mGvqa5JW8O>zzY`g7L6{aEWmdkhaZ09I2nM8l#T0m<$g$2k&&0DfJZhVV1!2F3b#cUza zQjPsh+p36YE-HN0lusD*wQr76n%2QsrKa;+OKa5au1cXh7BO=HYRh#_T>Fr6YK-G% z1N+6?_tbZ$uve5`5{dK70a}PdeQcFj6}Xfk@8s6Zy4fULlKxFT zQhlQ&Zi37 zRo%R^OrmQm!Y@wKvekQgFx-1A>Aljwogb@f^mu63FPPA#QW$Uh5zY<%GRnO>;HwrcP|(JYiPK zvwGh&YHMywGo{5*sn|M8`@T9nMz`x>@58%+gm7O*I)ZvS803wXqn5wDX9A;&VfYy_#Tq(|z{>JRir z9^@(7KrrvHtu&m#g-z&2WO6l-ZhB5Utd3)8+*ssk{2Sa4dUTq$}CeKB=5kJk3 z4BzzUyJ&zEeh#zY`3URcP?*1ng+l|s{-I^6evz8bnIW)y7`AiGL!MZp&}2{$wA~Lu+bWXm2u!g>=zvOHxW~Qcz0U9YRhrJka5h zw^{1L=HD)ukxVnnDOh^93n^OYBKF1i7~a<#S^H6cK%S?xX^kPaES}Q5e!d7{&kvQ= zsUp3<6QpimY(1L2L1e0+3&itjRjT?z@AVt1>}&DOaI@E93zN?8q@n-g1rUngq+~&= zSI4bDK|jj|<)1!w39*vYLL6C9Rjx;m@>TcqYhQfRPa1P))ZC2 z%bIUtQ0QtMbL?VB!L{b&mLG?A){dT9hE#-UzVv9%DY8oKwG~F1jJ@#~*G{Qkn%{fo zbWx5x-7{~T;R!bISX2mjIhP30^H=eBFj|^dh5tC8Um&H~dUn*T{%hsTs%leFlm7fs zeiA~MUAhub1wSDW$BfP68n{i4ZR5*2j>_WPbmd*u-d4V49TW$QusQE661 zAu0x~7K_g0ZOf}k4OA**@CO97+r3c*q*WIaO?$5AKuELes(F*p!6!(m{a}Jj?O6te z!AM+Tkefc%IvahJYW^EtrY3WElg-?D2+S=qok18Gw^a0N&xap$GBnbJy_D5Uwv^Dd zZ?Gb$49ME?MhfMOz1+5qkP^cS7ql0zdfOAim=z~S2_KIMhO%gRsUJQNyf{DE38n?G2F{VdV!C(p{y z?;UVUTCj1+NWpP9+jqawv82idzMzQ8V0I6h6%^3)V*-{pBO@mqWjeISV28hqE5aQ- zT9YuGc1>LC_m?H)QSOD_XXELBZ@EpkE1?7JX2F?bg&wJ24^JDZ`e*x(?Gq2Jk`RYs zWea_*BFGM<&Ks+a7yUgY+3M(6{Oaez)d`UO*?BBf@TT7b?l}}y6Ilj6l;|u8DOaM15SoGelUb%eYXjoAGL2z|z;#={z6wJF&>s zHlDnGEUci8w}i-d5v#@FP-CmEilh9ICwr0n3VPQ<6LZR1NDX13^)h9MC)g(baV5X4 zLhejY@gXM>9-~s$eD-4`1xE_+d$90E-d+2;#d3Cd#M=)cF#X}EjkK35N=-UPI#L&F zHTHLhPD%^M@OB{1i?ok@;sv*@W`wcw_To`%%Q|sqwSP`G$0c9UqFm+G^vw*e(24Z2 z3#3r0f@+!v{|^4Zu+=jICHK_sGjincP9y`BXgk$lnc=y6ejo1XHJ{L(dOWfDw%oEH zXyNO0=KS*~IyWz=4M=!VY_FtMX7aMAuu#Q^*x4(vC8hwS+#7Zn}lc05*K23lA1zwpcrHY zoADXZXYQ4UE?UPTj^*y{o|FLe!}KiR2E6Q9J7_fA^%ZP z;occZiPis9`zEdf@+_?Bu*yy(^HfBKSSUF>uE%0rZ6?R6HdX?S?4=vNJtOsk()na) z|4J^70L3`X{=FKG0azk!S`|)9%-Ikb@@Xw8<5QJGu9VqZU~9ez6jo>|e5FnzXYyj- zp^ok6;a=X!7FawUsWtl~Zx6TTrsl6#V_$-C@Vfp8K&^}<)*_a3e?ebc;D(|Z%} zOE=5TrL5Vt;tL5HB!$X@B+HH52oY}BMwH0Xn#ma#bh7&VE)K{APKwHCbs@Q{IzM~a zeBHpFiPu2^j!SHs8d(RBs`n6Y`G!bCu8p&rrnS1=1@&V#s>?U|1URwd zNLN#qu0nnWbGIgf$$bYzj#Wi0VrHk%WPcHlyouTCm5YZ$`HT}=9o2wD|BURi=>uB+ z*)bM)$pKk$ngowmIDg-5B%$g1FE#^6Ac2+0oBRW+ZXTMjGTi)0iu?B_m4Rx^seRho- zGiKD#cb5qy6P4tm?Y^wA-A~Mm>uX_Qf?nzJHmSz*W7%t_x50Q-AGw~EvrY6`M2vZBTeyN}Q4k&~_mg>jUTl|-j*%o?o3_QB1*>HT@RMP7 zlMXhWk-G=vqd75Yb>O(%Zje%KQh20ABx*jAy_N&JYC7p z7W6dUgBZp|?y8Lz&D3fQ+231JBhwjmenmM zcg4t9<6lj)K0u(Ijp`FgE}?Tf^xx`t}UFL(z}Unyy%Q#5HlxJqC4kbvEUpEndQVjK!TK zmIlK*L=fAec$sRC6Al4ATea}5ONZ2fO4Xx5W|D)E=yCp2L8+03GW_*f+46#qpoAjN z1=R@Dunp0KsB#%TeT++8G4Jt+jjdvF$RnFWKE?CA;bnu#{U_%E*4Hu$p%{~S{9b2) zS^~1EWXcVD$fs2jG43a0IclFXgVe^~xbSW!BUvEGz<#g~VJZ$4bPE2cvl{>RFVMhn5?fVZ-ZZ+h(?YNE6kiD(3Oy z={tW#@rXeXyl{A0LobRTcRi0NJPCd|EO@5sfjpi*u4DE}7q`-JhPSrg+&YL($}YR+ z)09!Q%C(zM@m$V>+=WP*TpA*SoG(YL>ga#h5XjksG#I-S33~OG9-a(duL>&Drrl8O2c%=cg!6e%BhHw;`eF!`m;Wo}XJnko_FPq#BihVuYE`|Dh@!Hn& z``VUFZp>6iY+q2qE#DdR>kx_N;Y1^?UX1J))j`cX8}s;|Lx_l-cBdAp;!91S3qz?B zM_r?7r%8>w%uAXF5f_@Y}QZU$AzJIXH;S4KdRQJ8C*; z83oe44BA{HoV73K$%Sg(g&|Goz2@1pr=A5ck7>plO2THyo5nE*KQvpltAPLoZHPs4b=YUFzYnU{X@)%DV)P0?WHcXz0%I&eRM?IH}ION=N zX1RZG(GGFXdR&}jLvx&~+IxxM>f7$AskZn~`sakV*){^&7XU%P1Jy{4c24PA*Q0+z z#RU zjTqCs-E{GZg*eD?kZ=QT{b>&Vz8@%h#k`irJLI=BoDS~p)V?XVLb7-<@JMg9+@1rk-J_Lz>III~LJRzIhlZzsUp0zbc&mEG3B4OSC~YRWC?_pI2OLFMbhwK# z=Zm96cx5crD}p~zY$rO5z7W*Wj=!{isp^1c?R6OYA;qm>MeVKgYb-}M^;fVr>bs#= zk^3uf+DI4*FP5%-us;c-cUjT83=-kj@}sQ?vi341n)9PaN2muEBFj=;_54O;HYEo> zPIRI2jQDlq#yH>ZsgGGs#KdW1lEucOpJ%)lze!_~u<4`m4}Wv*ZYB5Bn%7jBZi1H?kbLsCCx^Lb$N;^=;|!p>OQ4)Ma*~JlVU3Gt~KUbN;mNi zRC6-TE9XiWo_I!wbnJ&}uOU3syGFP$oVU7l{Lm0P)yci|>Auay8>v>^upl&d*nQ6Z&%1SY}Cg<|~X1%&ARUGdg-)zfRh_n7YHnQPs?D}-UbB)Po z{2af6QslAz&v#!ftVgnURNpZ&#W@a02Eq`fb zTNol<8w)Yyi}w;#WZwOteMSGPNh#CnrjS09$=&PgiG#=z>9ZM&@gvt3s{G6vXU6i2^ai-fhJ8PbauH6`&XeCyyhA&q=$7EP z`7)yds)}oYZ^te!cs7HAb|8M~hC7cSc7-Oe%K*i+dK>d|Kv5&xVyRel%f+52O(@$+ zD_paBA^B5b{6dIyrDW?FMZfK!YI)Y1o10v;j}wjEeI^Bi&rZ1VxEiFI5cRQ~#|SOA z6{@ypQeK0HfaY6Oz2Yc4Phs%pNfR#Mdp2XCYp8%~45sPk;9wwH_oN>szu6weqz$$D zB7w-onPlms802B{%UZew!`Q}9%h_JX5;oci(W*u!i(b#$)ALc=Zc0_Q-Ag(WB{?%p z+g`6V8Wr{8MKesZzC>{572hVlO&nBex${$xwYQ&UYjHHheads@rJuq32vNVXjb+rH z@r^b@$K-z5tysH!#&zpfUz_!N@m0C6FqD42ao9nL%*nw|I^ZWXH_sb?#7Z;kj)dkm zs|m#EqFvS3C5s$6TSvncH^&k_VX^6nE+4li#}kw~h;Mpz^+0{?3Z-Y(CxPe*3~N;UDZVSOd|YZc~mF_io?DGM4AzU%9CUY%vD>-v7VSq&k2@=o7A$)ERYHaSJ6J)Q5>P}SSmJyYQ?#?0|MbZ_4*$ z)l=0L+1~A|b7uBoN}iVRG3Jf|vqjQf#bmpm>tPiW-?BEInurp!R9~r`E8jbUy%K)f zkKM%OYSY(5ZWU^^$m!8`H;zuO(FoJsCBDmcp^q}nFG|-ZbP;I=BT4QN@4A%W#|G~ zAlenjF>YptQBF?pg#3vpSvv@Roy(0;B)8}Amj4pjNl?o2GkWh+O{UW8n`HG~V1Q+H zchG2xqS>s+Al^}i=CpqzF^m0t`Py@iv!6H(mT3l-s!gPmb8QMXw@lcSo@F&NuiuSc z>1ryElPe))k#%V6B_?7k350C=vm3VwSIFM8&)HQsoaQmURWgwLr1*5F-u)MPjp_3< zs}YY-5ZiRVtKwDI9?T+Bfi*16ycIojFWI+RSIfbaRGj)f*94`T;cWC6eVAofs8&u_ zyP7PJ!fZ56XmZ+nOWj+K?EM&P2ToV7?X7aX|FQ+))-$|dGuN&5?7Gsk*4^w)m+NDj zg|qt3Ufy-kS?QE-=i85jhwD~vIz1f@Y&7Lfj+Ojueq)TsE(S9tcV)lnP4Cx8xc-Lb zm_IDux8YM+%je{7_4_~*2m$M#%)P5(8wwmUo?c8aE}7HoXaFdXGzIBPt@r`=L0Jm{M^i6A( zq=s47(C+H&WtmWeml@hPvwq{Ttkq*rX=Yw-+%q@MFB+MY)PChMx8{uQ{qkcQ=+}gw ziposB#}=i!J@|Rk?~Wc;Rv^>Nh)j7vk~ik*FY1Qp_}Mr1b=efOgGs&Xd*w52S3X!X zU2y2d^fP&h#YhBE(l&gbuya{&r`AAa8@Y72U0+{fxA3zt@QaI`_HT>m!SQ|h7}jZ) zx~cY_X38c3t8+!b<|wzb@5K(Wik^v@o1Y0R*?2tpNnzWrfXs|eSBtAj{)%FfxUS09 zpG+#Da$4k6PE1XN?TMPyClNWFie{*{uitb@Gw~g_GI_%ukuA&I~u`+8Yti7a;5D~M(amDEhJ^C#$O891OwF?ug=Ax`KA%2ltl9W&)wMOWIsqpNX}Deq zk;R7HR+#q%^pw#WzPo65UAJT={wy{bzd z!l*MVd-X}nQL_!-=Qq8ovvMmj#f&~!dcN@{RW4LFYvt>?;mP2S!L1qScTI%iSDyws6(KTe`9dY3 zcqSV~FxA5G>i%BQK0|jaDQS)MM<^W=I+qqPkAvq|IAlj(ptS5^%wqA|L@?V^Zt(`K z9zJQRl(ZGQJ~v-m<4OW_x;SSmc8HSJSKfLcVdIhLIicOxN2bPpuV<0Fdhrc-#$0QC zE=kX}x6NPcg)VZcfA;onwCQd&GjnBnfj7#qQbT{~J2f754|_K-GD!&FkBp}?7+;~O zrIoC%haP%lNiWy;65O=)JhK8BN`L7|CQCRB&eSsXN-;-gy-+7sX7QZKHdy<9k7>`T zd)*-T0pvjWveQn9QAWEFehsVxiuhxFd9Nc!Cmp*e^YWWjU2ft$nUL?b>epTG%K{Q_ zVP9Q#5|fDj5#h#fL&e4Utve%qFUg+r{UqPw{;*xf8gZYn30H{{#*beYR5)abCu*e_Ft zI__zPs~mgemsace{#_ zN+cz+Q=oHwddk{N3;y&0Q@@!y=l-yjna(|dW;kh4yjzcROhiph%C^x1{A{-dp`-c6mf(Qm`$&qLo%u8XOz{1dEj zhqmuo2cu36yTpE_meW7i%a>O?DECDICy6eo!*q)p@cP~U6Xa#yh3KA`zaU#JB6?X;=qsJ>mr zXVvFz1i1I>@5+11+nJPo_vvI|m%HBp(TOjU@rnLu?pn6VzH0_eax|yf3VC@I)I5Vd zYSZ3p`(CKeTX=%aFeX0FHaR5TF4o|V{o0xIyxfNI3KwmkpRtTI(~@L%s}%F}nXB=~ z*pyhtT)Ed}1$uoZ!K#Mv~1pjKm>D&j3 z*Do#>cxSHiU2hGJh!n)5+I{jDZUXJdl@+>q!SO@+>DIbi7goq&lS2_&i&VE{R%P?`I`dj2Q;NB`%0BGM z2#1?fhpXNSm3@eyLeGI8wfmIUbB-qP+7gl6R9g7*ITtf4C%zAX)8Ju74t^8Qf=&*gY@$o;|#T$13? z9RsX?q+deMS8c>lR>}a{;9T~EFh!)7YDjX6pfIcF%^sZp?cw#l3{jqozN0eoNbjVS zMNJU%y|9VCq^XSO3#2~%ij&9n;`Vps=P**ahA~0)?w4tgE@wDs6n!xbF;gCeZeBmm zNnEIWVhyX(EB9O2cyw;*0TDZ+;w@Q&kA2c@6{OQwxHG!8QbNTKDn9TbQ{JV7DN0VC zzruRS_GS@xrDOf4dvv%&lh+IbVqIK>^sKe<zTe(dzR@nU-l1vM^-jCD zU~&|tN}B1uj9*lJAqT}PRUKzaHO(W*^~w41 zWd-osn~UlTJ`Z-3yq6m|fP-S4)^Bg`>YTHVRL(WNBKafd%01LQ5&uN%5L8d<-9odk zMYEn_shu?(gz`5DW*GI9?xx^bGyz6w&YkuDLA-6p&FGR-ij z1wNFWaV%&+4LlsDId}i~IesFm(!);5`#q!Q3bCGA*X6Mkw38WJA*&MRS6fnVS*uCc z^xf(bd&4-4KA979OX=lpgJ%L=P4;n@6yopkO%#>96&Fh$q;$Lm z|IZl;ANMqf3y$0m((`;-Wic;tXSsP7bCKywMbm_}`zt3LVPknC5 z{4vkNO!WqxNoDS%X5%I$&35HpoAs?+?-UQg>Zl@;-jV%w|kv{mm_U zrKxBw(Fw1_2aX%Hih5&I8qhtx6@O)uQzl+-PrB+baqii3(e*Elyw~1BqHCDGeEFrN zP=%7Y9}irm0jl|tAod;9<&$CkG7&JR`aY|re@ZPiPstj z4dj#Rg1)hL@{eU?bT?rdvfl}MTMMztcE<%fZl1j(r-(P4i|?bzG)7f7MBx=2hu00_ zB=Clx?5e$dMmrZ?NNUCAdv9T{o9-$borvIk@KoAYaw^Y4!la+QIs`|6W{*DPA+l4P0-Z?|Vgn_H3?w$%w?4yeMPppOqA!jBpD!+XrOd&VM2PcNFI@yG& zxJPt1HAv6l+H5~%Eok#8Wd28Jrt2?a)^Jn$Y;&BwM^{CEc5t=omcfIl*R#avywL1! zZYQ&^^?kBrLHx@i}LrHtRVl(d{gQZIOn?QC}r2*Uu2hX{PO1QM`(N2_NM-ut!G`T zbzeG2q1QVkb<*w0t_(Ef31UfK@xL5~Cv`ga8M884PqpO^bd37vW|+QjigD&Hq- zI(D|n5~=~t+w)%R?klQ#S}{TT-puMtfo(j4FU_80Jld2E_HIpv40g>sbwk_RA(%s*c*-x*^@nC;FYUt_=%b0gXkLviHaKxB|!C%0t za5u|-bj5YZpf(*nT@^=l*t?>$`?0gyHIIYAj`nG5Xy3jO@Hx!t(5Py`2hy zUz4ou&X}TH6>a*96%z(=SbHY)O!j$w-{$A&i&w|)d8u`~jQA~9B}baA=ZuD%NlR8^ z@4moR6}uWp21c@VK>bqpyiMbGMLmTSQu89w?nZAhkKT&(q=9ID@)l9M*Qe6#7WXS- zH@$>psi+Mfzv_wQm2V>}*;PI)P5GT0kFZY~8tIC04L2PWmz|Dau_Bkj$`SKlWwd!V z7~GulDM_f8R=M2R@7Om$%JTWx)p>2%-Nyy>eQ`s|$!F3STaqLQRyMcH;<$ZRLeOa=zKirz8*i}5SFODCoFqK&p@P(A zzokrdp)*f7SCP_(W!R`_s=IQ#H5SWED(p;%(Qm%idf9tGUIaBZB>@M$mnnD6#m8Da#1AYrV6po<+9fy%SXPcp8A)PjlZ!X9 zQ-_WE>+mKy6Go7cda8^-Ve`8FLx<`!e{Nk$a zIfw8Onz(15-?$dI#h8H|+Er2cOTgt-R%JMmfMqi0P`_^MBqt*3hx!)+N>GpI_VOB-5nv?|_4?(GuGmtn*~E{6(`yDHhUxB@X&);jT(#0h|F3{M_w4mM7M0 zquW>LcGrIoI9d`m*WZt#yNtIciro&K$rVqa>)HZ^QJV;9U^nrie>z^Mb3rG?abN}^?x&QTX{aXl` z1fvUyTN zi~%8kO>~UO{1w=~|6iZZWajhNB0qQYe}9&os_Gq3kVNz;l|%WwwpAX&#BU#~?{xUM zhnVZ6uHqTOUgY)RkpuGB`TSdmG0#~4`GbGm`A^>_ZcME-ogY= zXY}vC`r}4@qDo{*o9S2f?s(0AALg&~_{XC9Kbt0QCcZ0v-J3IJ_UXU`NXuXu(7#QX zyyr1tDDk&<=G+gHAGQA+KWrVw-ONh1QIE<0Zjxz0N-9XX>NawlaZO~wz8x^M|C?I| z7{f11cs5jEbs4k4%}?|1|6>9C>t$g6IjCSs(Y#kR-wT_~mhRwu+JoRO`a-EcZQ?(+ zbFH>NSxv#W=^P0PS{L|QMZop7)IWFn9~Z#~-v#dD^DjtDea!@K&IQj=Yoqff`QPvO z?ioCoSgN$B@B=amN`56W3%-um0)KNurAlg99wplq3UT?rdDVZd;_)gNo3C8ryLP^& zLKB|4+vzkL$G<-GZ(|bh6^4Jj>eStT`^_I8Nt~jh<#QQ0W)<*vQ}mC){qMv4>uCSe zV*5R${~ekCj?ACe#D90w9|y}{7RG-^=D#EJ=bb|Ke`cF#tjUG~cb}xa8Rx1WCFgz% zuLJ?hK1Aq9%%LmCH#9#S8vmo`NK^T*p5g)by^lzFpD6sW571INi?<_@!rXaWvRlKv z+q4E|KCa^v6Li8k1uBLh>e6nBheo|2_$X=s!C(tO!_~cZvf#)Gth$#WCf?U}r1N(>Cq)kIF7j9zlR zciSnvo5#;C_gGl~U5As~Qo|7Fk<=9+RZ?5VVQ9bg{)u&j!m0p>yHaO$GBg=Me#T`) zVm#nq5y+qY669xMOH?#^WXjZC^gKDhAYy^vT;2_IJDy0)r!y&Ji%2ci06!lG{GXS| zSAz(Bbx24!Lsl(jHB~L51}ZsN*i1bvraB@~tP8Vm$KsXmliJfYb|cJV*V3~ef%C?7 zbU)&E{ja(E=eNNx-X+rUW%eag?m5Fp&4ft6q*Lx%)4$4Rflz`eBl4)YiODAzvLRr& z&w5>jUGW^c&t7wmNuC91NEh?l+DP8srMUXOpjly^1>ZkE@>w8(fp_iG#kSNwZl#ur z<7fCq^>id|evOsjg$jxKNGr}AW=Cm-o*|m7#+$G{*fIJZm=*Vz_E?6LJ_N%15{u>O zUS+34nep2;&zbl#Mf|a;Zu>M9HkVRn4Ih@zlbQF-)@^U22SE7f&OiMzs$4)ol8}rB&)w zsVydZ=#K#OFVlZQEI^rE$+k2RFDkhEiiF&N4J9p3gj}Ru8aE%hGgw4&~Wj9kXDwi^>d;jP*}DZRIiD-O&d-fM7EXl z=cBKJ6t~x!mC30R^i5nlJMumNt^1w~f&CSGU?THSdCCxXW=vBsG_9>NMqMSQO?Tp;-PD@c-4pPxJ=2Ue_^u zi;CHI`Ax!o*m4pYw?ienE}_0pJ)oa(2TIIja}%`CagXoqChh~Q3hTYi>6-Ku8{-!h z>EYef@KYrLiPBt4>9xB>tDXhRgYHTV)LFVIPAmo2JW$*iN;XabWqCMY9vVne zZl0NYN7-HutNb=1BM2m>CL0$46-vrv@pOKMMGTSVA213AOGV)iIx*{5AiQN2Gu zT>rqmddh@~`RtxQAdJ79cmXH(ax9Tkbkb^`(XxjQq1#I|wZP7kmM^KM zC#nIg8;)?43nn53#NA6{yZ$ER{cXRLR%jVWWHo@Z9z@RM;PdQ8H^S#K6gRVMdZ?jb z>D_l^54UY}o(#~tx%8gNx4`y8xy{hz#vEE~iB%~|(a+cG%@7<|dE#|`EB2E9iGo=} zqj$f`2!O5;*LHltx|G{=4~uP-m_^`JgTdb#EHGjLw~&bp(&uNtL1yvF#Es5ALdkBn z8WLmzQ|t8#%Y{o){F=<{qIihsI|pFWdVmGYU?j zW)4*?#?3MiHb$ju5lwR%yNhJX`?bx-*zv0ukh827h|mUwFP#RWnhuU7q}DX#Eg$fJ~H|WcUCzJ*G^D6_Q z-xcD!71GCg253)fK;dM+R7kDQ>C(8wpOm!r8-~iXm+b|H>J_(clh#_pd?luF>%Wl7 zBFS@zJW|0jGmCRU8CNtTU+kR*!7OE4y_i&M6IdT1Yd!3)c&M{(M-e!R|HHaBp972| zvqu$_8oa!`YC@$4qv+cZ@=Z(i-%jJ1+m`d!I(PekkfNw>b}p4<(R4dd8L#MehHHRd zA!7kbs+#vQ2?$RpF27&!vl)uAq7ANvEW1zN1!245{O(><3(R4Oe%HEgMR?deY5TMIQ}`=r1l zL3ny4&rPUp0j_%T?AGdVHRs+fAZO;40#%pjA>#1Q2-Kcere1cfK3zFRS@sEt%_-q` z1_?iEYWf!)!S8|j_`2@i)HNe9wk?Zrb`AkwbrH1YhstG#-$d+>eX17_VO<%XOmNh_5RTRG0)~njq&34C zEE(&jZ< zYOoOS7#EzTxYJSd?)yFt7xEx*pCz7foJtl^$Kr0Lz0_B4kCsN8>a#)If3)c)h#zSZ zI=>fjnl7u&NM;HhExG?p;I%_M(xNaJLfFBfC8IDogm{~?KC|AnP~uSghfh0)><`4J zwE(J|tanu+`<>d)>ry|*QhEVrckN^0yr?ZsI;C-qdm!f~qjxp+W28^PNbk)AM*4Tq z%OGy?t^9Ttckq37({hc=*A)&>i}FA?lUU02F^rd2A0#jn$*Af6V*md5HnEbLM&ox( zb_vy!4^hVuoai}%9J5S?g9 zI(1*75yTWjY8*W04GO!U$RXH2iqSn{?`~N zz;8E016d88Jq*3$3_^&;j6l*Vah^N6@qA*RsA>5a78pPLKmhZPy^I+C*>NLfAFAy9`+J6;Y?`*goJT8Mt)O9>zf zz{bMIA#QVJWEs=!Js3f1ik1|f250|eZ7b!D#(|t_OR$AVPL=!d$pP^i{s#xO-)hkD z>9)1({E-0d0Dfp9j`kT5Hlu6LK#7{DQP8HHZ~VY!7o4S&5sch! z2m($91Q755Ug6(S0fNRA0PXt&h`2ki=qUOk3i2c6zy)8sv9?&-Q)pF-Ad(=FviF!~ zY>$J7>|f8j|9PtxHRLUj*m(#PHy9Bp?v5-3uC>8jw+yZHS(VNJ0k=+)Pt&{JFj36V zZVO;)6|V68d6<_Dx{z)df=c2&`t`=P){DH{AkrK)2T!{+X~OpN%tUHLjrA*&E(gP@ z0(i6spwZdoyYOhoLs6-oxf$;SiTI(HnNzEJ&SRR5=OMF!q&ShcY z@Tiv?+&kJ7!;T=I&YgM&X}$pTI$}9Lmj+QYFM0p`6h0A3Q7z~^;M&bP+*822`fgVZ z;ApQ0mCis&&>llQ=?>s&x-`R*$uPHT$5j$10?8GCzDY0;bKc*@+C)`#dY-0U`Y=U3P;PpoNGX<@E z`}d2Aq^pxQ+nSrpWwjR+H!Mh5w~03Qj_P@*-hR19Vf8ypht~S;1lRyN($r^JRzF2l z5a7TNEJ#$M+0hjy3!vr~yFo!);|0>l+RVxXz3;H}{S*-aRS*f%BR9qQjv(9+Xp zR#P3-L%qOLC;b8~c4xcJi<1|30^^yL5_Krf3HkG-0-`9IX<_|G`1+EZike3EWjGUC z>fSeg)&OL5CMx+uqnk7IMz5O=ffD^5gf?K(hMYRg)uWl?R>r*F$fi;=PK!z9!J*gpOj2z#a!R`Aut_Bwj9YVXZeyHMCTVI)ugI7bQ()K zv@egut%dHq6Z@%yuahaO;Dl0;sPg0EPAH%TI4A7B=i+FZiZ|ohEC8w+_&5hQ2?q1^`GBJ{M@KCUIs$R8sdoX&i+x{ zUXJJFR9E9buzE<2u%;Or4f{H>27t(T5`vQ*giR}1TMZ)azY`LSBElw+0J^YFHN(JX zOOl%@)`_kMSbqOg(57A**s6v@SUKP+eq%&5D`L=DYq;si4u$|Mgsh0z4N6*1J=MTs zvOpYi1T%?(m=A}{og1sa-0@uch8EPWd%S*Z-%VJ*?lJd%S37!BM~=D+51eKi{rHJQ z)yNfy5XI~}GUuk>G^dvy?AQuyQ{{4cfwfXsT;16%RC+)Sg06N= zEEDutSK{39En&O0yd)2T)WT8B#AP#e1ut)N2xVXD!<@&t56VnK{>sj z^4v#-iO?XhOp+z8zq4%1`)$6)9>BqLr@sfy;a9q8EzsW|$EmP9YzlRpLm;T37MBOI z+yr6BWC;&J;B7XUZf6%AX$ls@+5S3PwNoNrFbZ0AXd#8-PA|0j3v+R2^Bh3|zJ#s7 zC&X6r_$;*|>8_4v3jl-nfBh^iDMBq74{3$sv-V?*^bb6Bcjwm% zzNZ8r^e_DO79tDA+HVE5szV}x#u<7|q}77`<53Oe)LR(Ct5#ny5UL{gq|s*-=VVH*cX~-U3~&`vB7jm!J#a488w3Lg0aQq*1!P z{P>Q@BrH287LFHSC_J4Zfdg0yaPBjA0c|5*ctbPO7$H-fm{9I${rj4 zAD*y9CO{cb^NsoXTD0$C4CGOJ<{;ts=B~q+|M=%n$j1sMLyl=gvmn0jSfKchW)6Pg zqG{ej#e55r{m6l$H2gWPzvs$@F)bp`hOl09fW%x%W3%&rdKYr!p~^?2 z9oi0>OD#{>YIlwn#ja3Qob-oO8B-Kilj=QY{0>*idwz~^6|rS0D+4<;Z;;{ z1nsW6>Ff%2%DJN(5PvZushX@05BDApTwXjHX?Q57{Kwfed85mHG3}} z+>6N6;kvSmw-M`$n3p!+xXDcadh%TdnIT(&zW-9+IBTfa5hA>yn~Lj3wYB~J1}3h0 z2z)&~mbiJ{J}a#T0=!ogvXJ6s3K_|nG-VJA!d-{l;Sd*LRka*I^BCjok}hLl87;#* z*~WGnn8{<1gyQ=282dJiqg&N9+Q~IMP9K z%SE&}VS8h22){Lj*LL^8GK-^-!U?o@fB(W)?sXrKGI`*$G9ayie@RvYg$mqkkjD&; z)IrN2M+76I+%rnOYCEk?AHG*5`xgh1)C)wEY@|i~Cro^{_=a{UONf3N4z8utcqq$d zB*t28d7yAZaeZ?QNys2>vfaikW=sx=CbM7b|NlRFlKSPDLyqM`!C5N^(-q=BVwKqq zSKO$XO~Kd{fO^Wwf)P_@aV$NHuB#byV=>=Yt2%!rki;)7>7HCx+?o#)gIw5;rhACH zgaM+b+=IAQ9x7(emzHP#c8644Gw-2c)_qVp8IFetv`y!`y`w%O3A?w?OU;SXHWon< zB=vJ-M+G!v4R!DvP}34gN$utzIe z%tD3KF$=rsFnGRxbV!yY>a?{w5-UuOZOd8k zHIN{Q#jX1pqg}gkxxtm4`ZYk}wGUj;>cp9$_LMM%=x@39Cua!INU2#n!I)svrLq2~ z6lrt4R~olm2eDM{sNuq5JS4MPitKr{I#CGH!s!QC(?ripyyQuzNTfBRd@8RpaIm9A z)-L7=w_F!0a`x|cpVm?4-Nw5vJf@zOCrzO%K;LHRxEm=1&8Mq*jAoCQCF{ky0;#78 zRzsGk6K79yuQ2(oo@<8U6n$CK6JMs^f~OoZk1(~i4M~LMV@8DQoQXIjXI>{^IfSWJ z7G4KGnjoCMH``~@6TZ5(u{?zc$*n}I=Jew@^!w|W@`=?G=`n3*P8qhPSadcqSrM2Z z%^Gj0_054KwE;1kVS7H-`^1K3d)N$(?$=phq`TbynEZLXVJ5-B(^5}PzEJ6{jqmcX zfa03k#2Mo-QNOiDdE@4@y{8eNM82>(*mSYIyzi!ElG`b4WUJ#sGXxQ79C?GUI697} zUqzoGhM@UbYVCaspH*{Q=pTXZ`Rs`V(RQfMGJNx^)MsI+I6gElCNjw$7rg}uUhNYp z+m?$@L#0<7;l!70+(e3%#t>E0R*gsiV$A3JMbVB-$u0>?i$CQ4-og8jQM_w+O&~4b z2Z0>#oR)5S7ONQAYWf4ButGT_Gvd9l^-LLoUsgwz^XGH;2H9`)VWxHNCxoT~3o<6@ zjY!CLv2~gCA~}_CIk8rlFKG#~>&36`@oExSqpp7cC=g@w28w0g`6mzn<}z{j#4VTP zuhm^5u>PEDZz&pq6?Kt^w$Q@SWJ6-Zo$)65Lpb%zY)pO2q1q&=yXd9sTz^pxewK}J z{P<|bJf;tfS%|Ok9+8{9zMFvTRC6?S^@^6^>dVNyIE~7nAS}&*PqSY_T6f4Ve!*hn zw5^BVH)2V`hq7Y}pBK6Q-aR=TV8N=?1Eg$^Dca#EtrpO4jX0xQK9$gAFf~ec=FY3s($82}5u>neNt6L`psCav zefbjZ>#W5-s+11+|>sbKBIh#qQZyF>j^U zmP{F)x9VexHa8@}8E2H^?#L`7W2{K6t_fun$@s{t=+lOz&U|0JrFMm98D3MP8FD_P zC7%A9lAAqG)k5tYIjU{i26fyL*1wIlU1Q?intR}FDS1hfoQi1BA}V!gU_aMOP4W{n z;*+=h3OS3SCl+@Ap6#iFHK2lYPTx6`;%m{*>?E0`mUAJ>OT|T@a!7S%rB5M+4r@() zDRs_WR3*r-%;FRlRlInWwD=3?JAAaipKo+*FYyQ36d2s8^(;I+#wXyGk^hm>_gXq4 zS~+26Dd{(cmj(QvvHukAv6@P3F3RY3;>yCiYw?$ca`j&>s1sJWd)RwXg>sdw21I_f zpIDjcvW97_`)!T+<=iC|kJv$}kN<=1N|4{w*18;UQloz~A4PrbgrL98W)3rf)SHpN zAXMsP9_Ni%5irjoKB|qQ8Fu@_W|UbP)A*uMrOmc)tqxD%0FxppwTKnY+%v5m=O`pb zvhINGVgE5I<;bYC6s4-%7Ix8lUv#wOn)xt7hbc*2$fgJGP_lM7w-GY; z<8s{?q!oO3f+_M~Ejg+UGHcwItw@JdpK(enSReeczd^Fy6Dr(z zEy-;r*%GvvpmsHH0Q{IycSH99SEpx72eL2H@j?}B?K+^$ z%n2{{Kr!qk4ZqDZAU}KVM3BaSRe*Ptgq?Q21y=SCpLCKt8@hV^v!^4iAlJ>QclOI6m=8Ufx1Xsw9zK$L5p$Rysg#gheAu~3HDjiZ z-y-Ip%UM3|)9t%2TUDJfW7b(Q(bHC#b;RNItD|o}U`s*8G1C)qoJhCURbK+*&oWTD z8a&ifCq`FwIgEaJo#kDN)Nb1xSmviY3Z>%yRGYc z>Kz`J$$1!x4;u*a$I#1+RFYlSA~9B9tvACU2V*HS%}6EhgKq2^<Q>a03l;3sCD> zrtMha)n1$7RvnP&M!BF^9l*bWd(O$aGGpFT6zM}+rXa1;sH7||EJC4ZV@PL#Pr5zt z9GdSS!~u04TbCIcSo_b{@7j5vH*wKs=T+FZ>|a&~0rI<~>8XTxbBNvv*BR0U>WD|Y z96Qcztkx@@gdHt^HMfk~F&3VMnUdB5N})=6B{nADNa<&oC2da+cz?U8Q+;MmlB0|+ z<$$~RIhiM7x_34hR3slfJ|y_+U=>=Qomrlo>4w#cvvoP5UfEQK5VMTY2$j_xKgB>a&E+fmbEnUbC~SRzAzd2~AQlLw%s~F2njL zd~r)(ocZzj+Rhk~HMNBfmBvChf{*%qr{q1(Ll7dIjM(O+`=}s$}8dihr;ck$KsuCT{Gy^n$arw&@ zX6_#El~XZ%>N1o`dNIk|$W~S;tF+;hm~y~bu=`osTq>N_iKo_9EV^WWa$z{NZX=gS@9HR*w^1_PY-=B-A;m2eK(3;mpzeP~qn za%9`Yb~LZICv3gA$xx>t&OCX#l#ZEC$)Ajzf{ON!FC_Nba$k$WU##$^skx}I5I)&7 zZ22hW?XT-qLq5Zy(rzEV+zTur-8H~7n(|ze^&kd(xdeZLC2b+(@eq> z%Q3!n+Sj?~pKxuPeArru1z662_;rFIs9jSo7n|StBx>@QhE&4=+6!b!pIe_kCBc1V z6u&6hs^1j&UoY|dZ35CMs*gQd07Gz{(UcASMY`@`T=;aU;Vj+?@`5rlcaGF=c9r2e zuYNHeKi-8#dztuTC0fd_PR8Ds@z+8nU;n9}N%~fPl~+Px<=frt+7a`)KnA`lNHuh# z57Bg7d&x2V)a~P9J`<)ngiPhkms^51bhYSeFy>RGNT!V<$S_u=YDe18Yufz+3I0L+yvadd3*5j>r>p}({E3VpjF9|SmxFKGBNN@ ziQd#+8f5%k6QYFlr{p~!%X06nLGM7;*Q|U8Gu}%g`&Pfsou8yk+3RuqGDA@0$`jYg zn;9Jh<^*;b=20R;5N*zf?{|CgfLuBR|I&yOONzE*9+Tu^FnvZIWa~Vz24uqtNlX@I zCx|-4MFlR{^y+l{+RL%51sAkH}Ea&7=8kzIBAvyM2*8ei@e2 z>WmrKq_r|Fo&+Pp<0?MAfxXP-5T`Fbd06hZ;XC=h;_%Zm$vLO}==ofJ%-#RrTM=2s zN@cs3uw*rGGWA~N#W)>2B7&FBd%#QigILzmxX7t^m{(=f=@%`VMErgSVzYV{s0mI* z^{$Z2-Q3~5c~7m%zghlJnDSKCKKSITd+&G4`ZF_zl#N$To}=20G^uEAM!^*OxT$;2 zLQ6t{&SoyI!>=~?>xBI_jCQYe!W90!m${Hl!i(m7M{kU1;};TJ_eXKjdD)?FACl zP4?y4Xncb(N`q4T)H@z@th6v}(;OP+2I=;x&FpS2Phs^4($<|yh1%43=JK;VYC+ei zAMH6i_wK1pw@YXG>!VlW6@0wvp|-pZ+tj)YAjp*UT^o{&CE9_<$%B7?B0adc=4}iQih?HC7W;( z{mRK{qv?eJqFt`%jWkEWqodSb$lYF5`J1hfPT}*z_LOtkyGAIWebFyw`QhPOSES{E z3mU_ti#k!cs z-1lP0Xt-YEeXLBdt;{Asp7Vb3r$Zqw{ngQW*Q-Vnev}z8;4%*JJ$r0!xD_WQ zS9aTMBR?goGvcwovaxHYUOOaz1}0t@P4o-rS3L&^B_f&If*T)$R0QkDgFC0MW&3>xJJ6$kZ2?Pij0rzu%wy1x4%a%oIsHoo(Z&TUf z0x<$yFe>+!Yu~>a=HIsoh!<_K`bS?_w3L%E0wCxRa6aC+Shk%$ao;epo{AarVlN>V z@&a)oI`Dqm_oJ?N|BuoC(<8!>)67183R*IGypD$gn2xlv*nN7&FK?!~!=(kT=6P53^L8n~h|Hs~YMMc$S-NIy0iGl$UL4txJL695@R1i_3pS2JRCvJ ziv_5wi`Wf{$Oi;2yJhMAEdcx5yXdMT_xOwGbQ=_~;z6WSbMi{?#Iq-~tckEHF?AA` zBL4ln`13z}CrM;Ped()&7)K%cX=`O}SeN&w$oS+>iHvcBE`e?OAKx@}#_tp>if7yC zj1GS--El#7nv>#!NK`2i-&N*-!97>oXWpW2pQ0+hN_2YbPy1^7A0I@#cQ)L+?6m*( zH2?c+6=t-8gJ&QF>HCb7UJ+V7<&jL)l*DDO=q9gyW-~E~lR%d%aX|Uv`xE=T7cj~p zBcrc4?3ldI=&UFZ69<@Vbh#w#bAdBA6scmKj}d+;sI+4Tsn}OO2j#c!cfonML4Lr= zv;X@O|Lf{%btujslXW&ev(E*_2Y`ypJubfA)DDD=uKM@O*^B#Ka2;-N{&dqm`y5ID zO59U{bjES}U7!m$Fg_pwW+(*j;PDdnK>^RHiW~b}P;nS;aJ~7#KC`9k5V8%9UhcoU z-vu#n16_r1#(mb22@kxXLu?iN`(5zgDe!-N3ZM)@RSC=iXXr{J=4FJmBW$ji^>!jyNy7HnQ7>{tp*#m{U87?SYBO<9I($KlZQu9O}57J>U>cJ#CC_QKE_-4-yfRkSj1C?g)! zNK}Q*kpq&3u?J+~7Es|htg&QDX8BFuGNrsC=qcfqoF+qlw1r4vlgI4-&LPtc1ryxa zwG=26S;M0X(5-KE>cCD&N4n1{?p9z$1!Gwp=AiOp+7aOavf1lkZFVCIe%J=m+hrQ5 z8A1|~g)6+&ZzNm|V5l0BTxN}bo(Kdrv{D7&M?D`NjNuNWBG2E3Ai^55vuh6`EVyx^ zKfpO*8j4CPp+86w(k^sK8HuS`$q<;h*LqJ?a{BekN{<@$V-o;-sT|ghT#v)o>NPJT z)N>DDgY<|F*+w}@)w@I%{6v&*gP_2~**=@<1iEDOP$_uazD5v1FQ}pC#NMw!B=AsE zPeEc)2NpZ%eXiY&cq9PuER}&6L`;M6#0{t-Z&AA+1+`WT@Wzg1)b7qZxW_7tCmff4 zcz+OR>+k!a>TBT2?SrIF(@@E}hOjaX{))WX4eH&Pp|zRZ0-b)Zy=8P~lce#~A%ZiC zicj4yP}Y~eB9dJ^c09yy;kc223fVD)WgueR{n}ACtCNZ=*>%ubBH_OKPl!ZR5Y|9z zfv{)zaUl*?$U;-rn$k9bT;64Ex~uYI43R{SlpqclK)~dsJbq%x1t@{zx38HWo&a+> z;f6vzM;;5~Dq!HR&MdpiJahyR>SQu~*jYPh-7}D`O&b8zJ26%ezTTXTsL(OAD`6t` zM@S7hl8*%u$|G&8G?ZQY_O=xHqMShw*Y7q!`0Vl{=j#GC=aLQ{5g9T$G&Qm8YH+B1 zhH_M_C29S--i#H5dmW^|5v+AN30LR?y9dGrc-Fq7=)-j?{5`1DG7-w_1;8Gsq4M78 z7ZM*yKY@^jLhIW#e%av})ue?Slu*BNO?PcV^@)8p>ez5eJ3`;t9G034@sZ=@)a>=- zUq_ILGKBH$AY} zLLW{|Bw=r^3s|$7puq3+X4SmOE4~2hp|cPscmseFgMUG28K75ey{9mE=GdYF|o(Mvy z0@92>kra6JoItN(an@IT#BIK$Kc7UP`~`lOQJ4W?Icp1_FmqLmhJ9W5B8P9c z9!J;VBEeS|CN70xH}(mQmQB-uplJ5w6GE$hyA4zH+*$5$u~qZUWIdg;FPO#7LwTp8 z()=eLj;5BO$dwJ?#aOy{7_n_0;t09lW)>V!e>b~R?*km3j+(!4dbyo&d%qCK!R|fj zY4O|fNNO1%j`U|IIUL4KvEG^y$02uFLdr~sl&a8HBbj9)s^Ny8mq8m-@ZB_yJC0t= z=@)(90p~djc<~v9*4n-=^%sJfRZI6d>?V^?1yt;FKs>MpW~D^`M@0DzXZ4@GQeQFu z?4}o-98RkK0P7b`ucEhlvv87lNaCi8Z)h@qu=3EbvjlqXs^VT72^9iINCJQ9Udb-T zLSp;$;4%50PBVIyU6mTJJ2 z!`3bY7Jnf*K61V~+WUK4{CWI#gxF&3QkcVd1?L@TKova8siqL!NcP#?atRx69RF8R`9V^w7BN(U^a4KZ6fb2GQh zbee!(iZ&~MeeInQg(~pIgfZih9tL6g#1c|Q;-iq$R?&Yh51@fQrUv4iYH z9M%re@dpsnat4&)M2CIwyD2YNn}{CDEXsTRmOadd1~Qy=_3F3QO$M{cj}gDD=Kkpg zfXI6|-0w$UB*p=SEe#>H5ib^LRT#+q>7$ghcg`@)->ZsEI zU$hP((L?AZd^&QvPD8lUS@qlo$2keBI@m}h&$9KZ-hPHf^pNj~nyBi*$mwEOv84?S& zsNfDO0iUoo_av22&*{e$krC`I2pbLTV>(|WK1M#K5I`+EUK6@+8tYFdEA9n4u`i}r zS7>2kN&T~_y0r$WOizOcL%s!Dy*qT=Gd%%ZGty%$uv=u2#k z1RBV$oLe@Ul(G#Rw8@M>6ClW`2ASWNj{TM0X%NiFp@*0;OiVnV35goht6F7iCBJk= zCH!88?Dm|^m)GKA*U9+I6zkwO?BNGAcEY&B%v`UGGX`@4{x>FK0E}h2R>M2y4 z!KOmoK6k1w(Ac(@l!}2U_@g41Dguw2nDNG*Nz@M^-qYLTC1JZ89-NTE)^tWKHMyEY zkI_q);Mzjn9t9LYk1EyDoaoN!sTcf&p`ec>N8zfEbhk}@m=N7D;mO(OXqo{?!X->} z_$bP%hcav6@2~q`Io8xCxJYJWw9Tdmv5atrOeqs#(w=>g+Bci5v`?C20BB3`i$XNv z{EuqI41tSwe!HaXb3rjYrWLoj9KlVWihimAL2EWfXC?Q!zzTtzt~YuUKI+)Jo{|sp z|3OMcK!LadHM%T>Z2_v#OzWP^)n7_)z-^Y`*xnvFR1D?9$K;5)+E`Nrdi|iye&8yZ zwJIfTap&aZqj095bvzR_?W;P~X9e+s=X$oGiM!-(kR zjrfzTN9}-4KHPJ!WM52D_z!xFycGnU5PKMPQ#5kKwrtxY&tjjyK;6##J77N9NXsTG4UvLFCXL(keI_RTl&s$=5KqA2-ve~q9$#Y8 zZp6!PVYV=lFkS#7#82*VgXpDEja7=vH)S}%rr(dM{%e8#&wo^?{k^uprM6HLwC@uL z<{}U9M`r@_HY2ZWL~?b0$W3PmGhGF2k#p6c4ROc#?DqR)9MREx*|W5{nvtH)iTJWu z&-7*&d9|uRHt+NUKTtDp(&YD|4_?aHsr?e~Ryh*izPubXnP@PNt{dWuj)TIW3X;&< z4wNC*l^1|RZvFG4pEV+s+udGwaL*?txMZeOk@5Nfyje#%C6Fd6?N)YjmuD%^D>+UkLfOxDnD{#J+ppt-iuunE@JdSl;jcKE9slj zhz6S%7aq+`!U1X3b~oZ&N6Lk0_1v2Yur7#6s&Cu|K1hAH1cM;bk2$O9SS!^$uzyq5 z+9L#3!A=qqNoSA>w&U#ZV{&_(7v48>6nXAF7BB3(;jgoO>F=503 z2!g}wU8La+AVFsJ+TeMI?aKs?0n{R+9uLVMH`A^0vvLXO5y%@-|B!WdU($K;#Het# zcPbguu~WmU+l6+?$>_4hwMQifnTiK7^E3uTVmy>MEX;0b889&sVsHr$*if^|u^7KX zrBm))SADJRpAvokaj+uw-65Hn17Xt!iW1@3rWF@?N5$HnCQ9kiG5Zwh6@IJ7>1R5G}#dvOaO0q4^=u z=~K3~X?^2T62P(xiLgTDXFxJ839HY;{auAV#*qA=!F+@#F+?mkYWhG`A04Y_7BaVo zmBUL22p>_IyuvZ*k;L)Rm2YSnVx~+)bc`+21B9$~QgruO0?*f=4`&WD6oA0u!nV3Y z5A6B4>alWUE8i3=0;!Wl7GNmO6}r=se>Fd^l6&ET2mj9I_1PS+2l7Bm(j^WMmwS8% z5iZ+iqIbs6T7$Nvb7)oW>mrq?G&uN8L*~-HDK@g2?>4a)bXotiNH`ws6t72eaqseY` zr=-Oj9JV2o_!81l22$FpUcDW|XS*7|l6jV7VnaP(5o-=)ZFrp{w9?ur{lZUahWfRI zZ#cNN{-I_FPT)&1-rJt;Le~uEx3~IhN8Y!Xd98bz2x+}cKTb7|7!_z3>weScil679 zs4)EYbq*y&Z_uX&$|Xl^@L&jQk^&4;e2qC!G4pET*3VI-Nrn3TGSZDq ze)weU!3ctO&zP)+aUAc`pl%eaKC?w%8`P-j&;$AB*Y2Nb{KHW7=@tR6H-vBLpF&XP1Sh(#|YJ3t^mlL(3Hn~8GZ z&6+9c#q@uZD}z?@IpN=fF>MGSl!-kmUltA;ayLo2nqIW^j#NQE+j=z^R7r&z9q!xX zi2tfVW|_0Nx(p(VU(7RQgn~dncY)`VUNKHOW65yr|13IbgeZ!a+p|Dy`b z8ZP1yuupY82O~Dvt(`DTq_FF~in>PTd*T8o(a|TXq7AN*YNy3=N3e}fh<+%uztJ7A zRqeh!voo#K*h`11fL83%cd1Z=j$K4H>4Op(^$c+Ulp3ga-<0Xozho>Rw9!{wP0J&t zYPfj0@3w_`8vDpe0m_r+x8Lgn_2<_QjzU|d!d_LS$mUYck#9)lC07y=DO}2ZHC^KY zh>3y&IA!Q>73gJVXn8sH)HD)(=C7RV*5GQG-{_93>DAzJ=~(Cewpg%rOqe^A`#x^( zVY(cNV@6)??IZuPPBA63EkIvBDZ zsvF=ff+MU9H_I>d&@>i6uUyHa#Nm#L$|upFV9H`939|qu*V{57K^;C8ZPuq474r~% z*@=>+ZN5cAzKC94BKl52l3RC?vDh*j$O%8h{~>J**ez{Ea=)tJ`8z@q#yA_kvvM;+J4>3cMky5dg`otUvCLL zNh#9URU!rV-M60KFoF?{uoc5=bhOU$pqyBim5_?7@<6eV*b2l=WiO(Kxu1PT z>;ca?M9Q(m6(gP=!_yC`RpUNA+bZ$|$yUy;&~4-K2UE_*p4kEqv`tlWgnZSBCb5TX{@Lj zt8Q%CAy;%Z*`dO$Pn@3&h*l`)i1K| zvBuh2=_q9#@+6dS-p(f*l=M~i@vnKHE_rLFHLX6WFDyeAh4~<&>TX}ob%XkSr_FRY z(dW6+f>Wqq;;lwawyp~=mPJqH*Yt>Aj9tte0B zht^k51DkWv`A@m+T&(q%Z7=}*ZYW5o{>FO;Jvg4 zg?<`xhIcP2W%tBu_HB_W!lEhhu^-f>w$0)Yd_H?F_RRHrc_lj94z`FX!!%<5IigFQ znT3?z9K`kzC(!6n`Jt+9kR@M3{Ju2{-`+rg`Q;ij3WY&{w3c0Sch$hI@*IiaX7XiP z39chw{FhyKJCTeF$>tG1p%t)JdFjpL-~doiHdTPL2W>;rR(3r1^N3>(^;sOvf^{y1 zW1#KnvcRrrFx{y}bG*4_*pv590secEo=uo2unjP%Fkj+!XYZeS7($ zq55a6!P9eQrr1;3TMAALtF1Xpxum1U&R=8unIz=8IU}TB{E}$26sqJhJR&TDy99Bz zD-yN1?1E8aROmznZk>ZC`j?w-EE3pdQ|XNtEIFjdb8DQs4%M^E=N=#3d=#n0fdu@0 zgfSFhmZWZSmPFmFP0wBbn;x4jk?wL`3+mg(AE4WEA0;6 z!VaBtZc=rDu7na@!EKUdadx4mz6L{F`$)8d_MNd4t5-X7%hC<)nvxb)HGPsKVwJ3Q ze$B7EDcGBQRJ1&^4OH-%*2&(^gqZnqYf}h#in#4VQK*SaMdP)rcki{7?O-h^6u4&X zbXvGW4K9QgfmpZw_sN-izsfu&!?t}u_cA_o%)e6`uLde6i<>P6l3HiS<~KZe*E`#( z1DcKL-A~Nm8yG zmMVTRu6a|vqQPS`@4C=znqixm)vdb?EL++`EuxKOZ3~K#A@m->qvc9aOnUR9!eLg}{#WiWm#bY7`M)pbq2*U~rK^>W9r*!?(uX_6>yl=$G+|}$quD%PM z67*7#U(}Ge5_2c={Hu%BKi<%tK(t1i_tg%tGnLci$TH3T5)-Z7G8wOF7G?xr_2%$G z^QOt&<#SMelCj7#f;?C|3F}Ouz_+SRL5UPCGs^^UF1N5EXNb^!+|SIqYE6*LF{cC3 zVS2ymac!dxnMhC!KRKYmPXn#)Lz<5fIOpt6BYdid%jKSiG87uE+?p1dtfWm7zW2P^ zw?ztx4d1UmG-9%?41HV*V*veV@dV=PWnLxeVoT(>HM(46ZJ7 z;Ea{WHuDBs7d#-{ZgCo1<}UTEBK}D((9!hj9RlGXYKW@X7~VV)%j`zy^-b6fHE3)a zKTa=q%Ap04*oXs;SA`KZzTIUlEhajx8z&CU&78u{ro8+G-5r%TG z-?GJ*oYw6a^eSdCxdRn^rFGSkG2|uE{Ey+wJ5F|_=Y+H5DeN~DnSK;kUbyGMr5owJ z#%9y$@WI=3*`eDI=)axu1_!*J2f$IBKz&BSrEo;1-dFemi*S)=O2IKd5UgeXZNAxY zcDeucfLK(D;?1moZ(gFNsU{X`3in(FskejZ*i2~bV@b=Lgi&&JG&WLZ^fj^{rKE;d z%SN%8UPXsd!SdLLDpk2_R~1G)rj_CS57ng7S7@7>WumCx#bwB_WdG&mOQO(|SU~qLacXU;MroZR$Rc6!__aEF~&mNgu_u;sDrp zt)KHp>X(eF;xDVX_9wU-QWa|xosKQ^L6;UE*ZO3_yz}Y1E%4?N7=tLZ6s6OK=O1|w3 zk4l>v4_Zmz(kmoauY%{WSbu>)=hL4GD}{x~e40F7T zN95TF5i%Hr<{gU@tNLFyXia{aAQ|EH*!nuDSw6431Ft2qZl6w z{{>ZkWu(VIgROrK9m2*cTTR!aJ>MYnlz6=ucsOoDUIyAmI|L;E9fJQ30r7u_;J-rvJMRC1yvTd?GUhY^hsN&C7hf?@b0xky6{^_ePCY zU1{>xpd+^PF_!tC1-XCT&+c4TItf+OSv6Ha7uQ=hxzgUBLrZpHIET;|S?DulWEY5U^ zf{zR%I8v)Ip1E-iX-!3Y?na8_C9E<}#P+^5`bm?tc@ioo%-u_b;E6xO{$J_Hf2AY; zRS!Yb{$KUbe-x0}9YcM9R)#$Y)qW_#CdsZ;8RQ*H{->8=l9MAVGk049s8 zCH8#%8VQ-6u-c5~0fJ{B6<;z5e5d$ouT~FY)H&dN0+EUgf^ynoyMo;76A;GZ5drG2 zWnWU-_}s}G|3j3sZPYhmMmUet`+zW@?n5`ftcT}o3z4c{Up@$TbcZGyfv}Vy3a)av zdqbWbtwf)}ll-fQ%S>-Ei1ag|jF)alEfP)m*q*FK4Uy9uFhDfnIt>-iYjr_%YT&Ww zncFjHkFTO;k5+{2ab36zoD~0guKw*GZEnB|+fD=^|Ar_k5S_LG!1>*0q3fWu(@WJ8Sj6J_PY#aILADSye*w-tL`a$ZY*P-u zEZ6f#TL7R{7G`(BZ91-Y=Wf2(%tPqQkWd50R++$o(b0}wr2*Y$|1lRi;6Q-R!=z>Y zJ0c_KR(MclVsR7&L=35J#PLxC>Fl;igP`xlFrwIPZ(w$+-Zchhz`Y8vDCmh7GI#6) zsLFPs|DRGB?Xo0R^b7}K)+PHp^@HH$@EP=?FKWPTIIg zEYd&FMqQSK5*X~e{h(hu8Epli5hCY5X&XHMzUF)QNt)GUnnHmVFe`fQ4g8ZV5WnMm zT$y~5$mw6vfn4MU;?Cz{GNwqz_$nWyHv zB4p}RKMvtYA|pD-4@{W}J=N`(OjAbysM7xp6N9_+%m$dNy+B%?&fIZzc76>N`?Ihf z%-tnkfew%V0suZKBvgnI0f6c?NUG*HAMFeP&1d<&LZP&# z(XotEs6V_>U{u{|cMTqcK7ab5w-uuicXFf(T*lw>b;M^F(OGR*zHP+W}9P7;oT1V8wQTI@MBDU}D-P z7@R<{df27$t?%&-1a|M~kXlTp6FbEIj75weDsfu87IgK8udm{uc$E>ayoAt$C!)-l zGu{^iw5wMxXb`r!ZN^e;34wk73mxJJ16R%X}d6#wMZ}p;f4th*aN1bW!deJ2Gg{g<1aNX>?>l<^kKoLm z_*dAD{sr`An`Jlfdp1>7XdCz*H#?~dKnX><*86QPk;1s3l@79*OeT;0txwkMB#@?{r=N3+kGhUg2MV#w?G|b}8RZ7=<_gKgMJfh~ z2;6wjD&`B^5h(!m%v<#~+Bb0?xG|(_n%6HzbaN2PA5qQt_29$GiJg!KGRIyX1e#_K z!hnmqYU;f?vH4>|i$Z1%I*%5Ev}%0!|Hn&EyWq%PZ-9?<`-woScRubS#+zaz56!(l zBD^0&Wmw@t@fqow=?s)Y*Dd+o8Qt0zVM;SBQUm?NgBk;7+xB8@?R7GQp9m$@!E7y= zRc3Oe3pb(^%Ne^%^rvkK!qO}8QT5DuYDaL-@cpR3i|F~rp0qAurKs+KQ1#X7R&wRh{wVLj|2$!6Ble{C2WAjAzxgz#odger< zh}akC&FcF7bTu3{?qAZcbytC) z;q^5>nX|Im8UJ~cd+3PSXcX&4SS3Nnl_O1ojwWqox`5PcdSFSRYhAI26(@Gh6t93X zr3Vs!Tz+%WZz#iw)6KBWB)H|8M$nX#6UmZ`#qaEfi_F68Ct4r> zwzl+rn8nRy)ppfR97hpwj~Jr^*Y2BWL=lFNkbmbJ~h!p9}O*aKRy}5xe~gC2B{l zD*pi|1sq`fLvcjt9Eh0)Y=PgR!b-vjhrm?DDX1YbdJa9o|7F=xdifjSXczDidlEYa z)WiSfkaB(q@fQN3#ft`?r&$ma@F6tbKB0X=LkNU_99o$o`ixL85nKjI1s+wbbnkX| ztJGe&0L&97jMM(G#szW!b?*EV3fiRETAK%$s?=v@$ZaW>^}#+663iYq5*b9lNe2@% z^`x|(vxD*VIRQhihg}oPP9*zWI(5|V)G-tfv@gUei^zKgPl(a^?$jA!YeemCBa{B^-0zo1nh)Yt8IF*8s zf1y}NT3OI!vtLb%tbz&g2Xfqe1wAkLS7+Bt`B@go2r zec$)1i_ZPs-N@iUgEk^lx|lofc51(e?xOi4E9ki?HnEUbg|iv%x~aXdP@{+w8XZU( zbnLg3tFORPj+3?;-VcKNf8h(#=1HkoSy>Uw4Hcv(%M#|p3N&MTjaXeE7C?QvY{`hm zzZmIm_o7L{p;F?(uX^X{3^`TAeiCHhq}^b1AlbtL%wCr1)JJ>Cp-L}Cmcrd$L#Aby ziS6w81fkRgncWpF1nz9`QOg7y`09r>{@n=u8~f3Z)H18W#C_q7hFb>s`(SJ6SW530 zfDzuY;5wua0yL!i>bXcGdOQ{gapjxc;Ttr&qja@uyIa*4>QjN5hpkQ?%YJ9kCzIfOe-_G4(d9O1jh%VqW-Gn^ zqi7n}>XQgoBr=HRCdUw*2HCp75-z27v2tNA!OCpHb`lkFR6qE4+B&CNp%Tub-XU?2W4W`0P?k-m1 zfL8u(Wue^Bg_%=@45TFpgX+U6*^;bK510(PJqNc>3KdK!?pZOjQ@9 zwx=3bbUo*gh0~aWPo-F=Nk}WGRD;b#TXM8%4srPYZZ$PQ+gGo;mD302J zuZ#>h5P%Jd*tJKCyA3%7gyOy8BGeG@wuvi0nu1>klCr&sYv*NaM0y;wi{V8ZZr{~6 zJA*W#H1%E`P+*Vs0MFZWM|umeNm0SCnht4O$}ZJ2PFG@NgnjVen_T%ws0?+RfDt|# za`u$Kf{Tu}51C)-58SRb5Kh{*%{Fr$Zf}Ey#|=bsGg1a7BAMWvSW(fac#g!z;WcN( z&K9+N2_zKhJ=8DUtyhOIBk_QBu{gzm8zsXg#!4T*1G-b&g!pRQPyh7Rq0VJyDvbwx zXxB#Otcgd^U~4;m>6SGCgBvT$KZ@0~pWrK>Fl=7_99$Cf@22{**l%3j8eX*jf~^^2 zUA$qs*`hnN>E0e!+LX8;HoTIQy#4cal-hn9BN1kF%n zpKUapw#Ch1f)8u-O6qR53~+t@rWZN`COysV;U5jD7u=Ml4-kX@$F53YK=(x7;;T7J zw>DI8MJso0MNi3`KcT#L`EuF?QmR$4Va_u7s->ZvEANNF#*&XM{I3>h5n|J$W$v{L zMlG^u%>i1#r$h-9ln&0MP;|~7tAVMs8MdG|XqlZ6dp$yKuQU0h#2_PSG$M!1YFcvK zL~pGYvO09tf`rR`eQ0E@bf$d^S2bX#Mg1Bga~8zSP(oFWDIrBjz$1?DICKrR8H?!5jw(dg(aD{Iqok!IJw*(Q3&P}L^rsY$k!4UCG|;jOP-uqg@h6*u8?Aht@0?K!oHruEHU9m8&;g@>RZtF#WGYE3JnG zg^ec~YHRzF_Rb`hyd0BR2Yl#q602zdhp9e428C zNP#bV8SE`5iKlUci0?Svi>7tA8mByG@JEOZlJwexu6tQvcmBAlKqz}Yxp?{!Myi17 z__Htm1&g4nk-UIm`V^HOv1cJ9xK*lZXSIXNk{eFQub8oPccb2+g@ecC`T*9Z32*P8l@J+#s zUXqW$W+SMt=+xV~Gi$(f$n7y?S3GpM?1|o0ir#!=7GaCa&Ba433Ge&f-vjCNA zYp|cTU4omV>`L@a(E*Y9idlR2%B4=o{8LEHzxMa2;cGKq&tSclla#Qx_3?YVJz}-) zp0u~XhgLsiBHwHv7a07h+aM;}{#7Py|3t+?boQ?&Q7o>#PN(V}EVt*~c=qIkE>em? z8%2(Xf{x>b<*^n`tuw%JR2bdN+qvXjfZm57_}mnL|8V zKTSQ1lA+k-td*}Cm6nlUWLU1v^_JC}b-8oXKu=S9|2_lCg^Hr~ji+rQ^TX?f3 z{%V+5ivObF#=G7$Gz^PB48-maweYb2y#=eAVWE4RBUJ@)5k8(-OvFj=pD`~-?38+L z?&5cA+cl{v#3(3R#`0u2Kir37-o@q-*O2{<&sEzCXk`|Motm6P7`MTb!U{7JTIj(N zk1@}p_9t0jKA^Q)=l{7P9*NJAV|DTpG^N|Mu` z=(OJ1n^s$l#mih;Se$v(<{hkmCbE{3ghT^WLrE~s52U?0@3NRK<2gr$@MIe}7)=6nrBE%z>4Bx4byYHM8kd z3zdrKPVQLNQ2B12rx(77&DU(7>Z1Iz;NrSmDS61hYH3XFy0-@{+m z0CKMdWNC13X~v4tK5OdO>b}m922f1+7i`DPq!VxmZJ&-k9V!_FCY9jOwd@(8<74K# z1Au%-=DoLt7F&R2iPmL1y&xTRtF4q6zF#NcWSrzsbM;`vL;fX-J(=|#2@pkfE*Cb6 z)tXBr1DjW@tajx2@f}luPc^BVn}`;mnxQKvUFYg`Tm112As$v?p;vqH4<3M(2KL@B zF__b3Iow%5*%UubqFoo{kQ$eAFqi6hbgN8531+jyT9_|z<*BJr957bD8R17B`3T8H zY;+sjh1SGy$2NzKe_1lTN6oae?qizBp@fRoaoFlqCVE-5{&o@-yv+IGNICN!s8-WA z=3QPNe;q-DihlSFUMjEqBYV6vm<(Z4E43tqIUj4o+CE&a%klfjJfixwd^i&6z>Ukl zG63OqsBGS_ULYZ0WKc294jL!y^lFWDyVX8&?a2uG^^iKT(O?y6UA+8Ww6MU$OgZWz zz7iCyt)3LCWtHGC&cL~Mz9A96df5Nj-B(!05cJm4mdEreQQeQ? z>{BS7xZG?^QSN-R7`=nKQi#|RpmB{C&w?>|CU5M$(8CUuO>_Pp60>i6dO+8hfMJr` z_*o}OPG*)S`+~RWr+w~W(ruwxb0`&N$5Ni_WQFJzJo}8JYiR*|Vs-91J@Im8d7)D2 z$QM_ERt%?`!nk@cz(-ene?r{}edmla-#U|gFc0X(YBtwnYngn^i16TC(?Z(uU>6#d zB>F@R4`<@`7}`SF^`dFSe(->o+M}2tNBa<*z7lOP?5u@t5pZT;o$DDe&GG@bz0sqs z{4sb@!}g!No#?*Kd=jciHl!a`D{=AG^0`?&R*p>to4PG0ECg(!q~bbSVgBqRDiOwx zUm7-F*p+VHHj&J(8XUr6_pt|O{==a-ta|WH)MkIP~rK>KG?jFyf+DIY!=tj51r| zj+3X{Qhn62;iA(}ChR)j<_fR^Jd09Aom(v5ITdXU$*#&u*G)SeM!gY8XDs4y9dVCS zJrHSr21WKLk^3S)%WtF(fIX@Fj3rL?TxZCqsb=DL-wf~?3oQ=Oai4-n>2?eZfIpvW zKA}jh2ORRCNz^Sb!Rk{etCA~UK^(q}AE;au&(2wn7>iiR(PZL1c$~xPZOA<3tH*^n$;49=XyUhET{V}<^I+I99aP<|DH@8o-pP;`Q7Fz$L`zZ~*I!fJVS!R~Gv#q0} zt)sNE620tEC|riwu5sHKlU|pOpkeba8j4A!k>RXC`cf6rVyhVV?}Qzyo-lcV9gkp> z^^x&dxpDuiBq_y8#E}aoSeG{Ih?Qkx+Xi zKOBep0xYlgmx7#Tx1MD&jesAHh-J)I$44sol_- z-neUeLJjqCh0@yx+pKQ+%U-(vNsOGsW4-3v5%F(Tg4)j&d2i(zv==1)mUy(rSH@VW z>T~nz6|vwY;;BV!^!v3gv#yzjbEH%?zV~zNdJBgOFeUtyUez9}cFoUU z+LwU-;uDxYzTfuV+dNj0NR!AjBN0d(V07?<&Fer#qc=yQYh~hy95$ruO7=!+`^s97ljZV4#3aP~qv zuGRgGvHVwP>kp4Rc8p^Fas)>$TG-E#8P%19J4k!0z+_leRzkqkOLAQ><|*#utlhnd zJl#EyOGh4PTbgEOey$EWH8_wrNlKMqLv!QVktuD;vO(xJa#w1;_oB`lw=`>}$C9n9 zjTLIcTD?y2#NenImpjZV-YR#_M9OZkc6cz`M!`xxpP0-JUI?Z_Yy{(j9}Y+hkIlB` z3Ra|hv+O6pZMpmg)hjZ@~I*nW>-|4#+Ia;?II-hgq^G84b;lw+ZUh#u( ze1|^_3|FF41bn-SEDNGtM2h`F<-tdOU2zM7>&D`IO&b|{75DVmomemH|B)LxV&a+f*qJR_|^GIsm`g+E&l{J>t?WriI0_Nn_tAJ(j9uWnN2=8Lx`Aut_8el&rm9`=ovchG}K=FUZ{iMF}UoAusq z6x5W^fl93*G)7eArUOnb{yrM%d}(hW|H`1mrhIWrs~cPVaOsuaOlDQF!NJUA7oGKu z!l>Fes&x;m>#8b~1zF(lUdS6rat3#?!S!!Y3@lx1uqRE%Va#64DIG7a@tI&^uj4E3Z+S z-~hG+qQFiQS{ItBsYSdUpyI#KVPg79sZ*>4S!2bLXUvQ#eN0J*5Rb?%_% zT;-zoxBTJ!1-$_Z`eGbp-hZ9f&3{+nGTXRT=p%ho9aGakur`D@I9d7zd#jg7A>LvN z(#9f}sV*V(Ju{-w`i)@fyyLD$Y+fscuJsH`6-=_%1&VD4E)GG1M5EKQ<0;@yQ81vT zCNpiZSUR+L!#bt7hOU?=rtSIZI-{4<<953%jbSWfDOGojL*MZ%fX^&ju1jGMhHG@W zW_xd;n>M?vB$a`+NRXIJ=Ir_p;cxR=(@~zI^H8LB)BP?Xt*4CE(tEuL0e-P+3Qn;- z0Q<8x*VhFt+y8;xcM|wA+}}#=q{_s1QidH{gCE*a*5)ZjLuKsa&CEmW8%$TcD+SfH z;~A*Dw~geAXxOdr=8Zq@9GuEdacr^9Tv4`p8IcsZV%eV9SNOAj)!sfH$7g-%48aDz zJjb8}?kngpLbcH2Ba)Kq0K3x64 zqRJf-Dmna))7uVtwCCzkO&9UFaf!eNZKQj>$@Dx<@_e*LR)6t(+G=kLNau<5syXt zoZ4PbFl|`F;89Y$EA~s%(ZP(h1*A( zn*8M-R*~-*jq^_=d@Z#zj7m}r^W0fdTC#fqO}n0_-EEC^{pmNKr(a}|PjT%7Uk)ez z3nhyw1v;7HsFeE(CJz=i0?&FKK>LA7*B~_B$$EV$o?wUZv>mGGA)?2@rk+dWk46K( z=vzbcVGY+_jizx!-AzoEs+R<2=l+vW*7Gzf>55^$iViWNx)i?q%SImu+bqM&z9 z^_U&(=eibCs>mq;vC~D_SC@z0IJu8EYw&6vw=O5)Df@AePxi&-Wz9=2KkyR*mS?L* z0UaTnnOA3OT+=}_F3^l?gV5!$~W%@3CFy1m@aFTQo+WzK&kkQ-1zP{**FDJ8D{@_)*V!}Y)%|L(wN0GEm)FCJwO0 z;P${-a&Dor>4R|quj^;8Cm1J*tY1{nNh2j!*t8%0W3m%361(VQ^tqX+k4LX$Ch6gl zi7DwPhuqJ_9#Y%$dKIt6Gb5?5ufAHjnw_{XE8KZQggNuvtK3J+Lzq$*>$klRl5%)U zI>AxH4%+Kpr}DNk4l|M1+hDvQFk6_u zf61ODzeYjboICrn!|RBH&Vx}~gNJz)Y`}+!8oE)!y)vXe`0kx`KnqlFEqgL|hk%=? zIwx6Hw6{wckXx_lT4ft`R*r3bP5w#0Df&nO@BQhFYO{t2pQv{!XEGr&>pS&z9h~c$ zYyx*AUtL*tw639eEEjQOn@YF3CXqFU-x zu6CZ*%rz)6fURpxFUzOy{)5KF9QU+dC6BR+J9Ucr%VI;c-=9f!J_ziVJ)2=)zEI)K zA6MH=zB=P_wMAIBA{{)ETD*6b&K@)3eKRKOZa(ib(GpXL`q-b(^Io&+ugbi&jQJRy z>*QJY`f~2JCzUlJ51}?rH0|a442Zq1g*!vQnTd>TP9x z)5i$gWkoB!*GbE=>B||l=iHUyduFVzvGkiH`rvFi_Ds2c^&?Xjm4RMqqc%6fM|}z^ z@F07%)NXLR2$XsT$@QhUE&E%CAWFkmFZN- z6UGiI=H3^fA)IaTLp`+$^XafS{(@m?eRreLtmd5aRM*#)wM#U9q5NqYmkttH^+swM zgWA7n;YG|~j$xT_kBPUq!RaAqU2C^y1%khogB=B4CSs>Uv(l>8AeBp#Dgl@7Ba*DQ zm1x=a z*IefmaTph5BS#EtJQL3Q0z&!dgThP#S#kU4z(a4nwrQFDX%f~N90`ugD=rw9>u&x| z@*hTu2+IVAs&eGPrWA6AOp@??AI?%GY`uOmFCAMg`gXza*n z-4gX{278IlRJ(iq`6Y^BrA0G+_imMLe_SOvn12SCo)`I>$@V16*4PV0TdQS-5NcjM z7!tMr7^J;FaOI5eJF|v^Nm6e4eQ))9;H?=AERgm;C9wPc<29mQlW{PjzQ4cw6f(i~ zQ4#we^*P$PM|pWvDfSy`BEJ?c7=g!KUMJEeU1kP>TWXj9HwpcZH#vgRE3;2Q+z@Gl z%~~QoRK=P1dsBYb&(LQRJ)V=>9A`BAaQ~$?WQr#)4c5FErsY4j|F5#5y29_v9y?HE zIW$;uFYo_j?=7REjMu(VQV~f-QIrmap*su^5Cjzv80qeg zK|w@OI;BHuhLrC28h1QrZ}eSft+Uqo^n7ty+%xw-ulR*lc3;U{$D zr?gzi)&I-f5K&4CdL!(Er2+p&tuMl++>@>@w3ZvEnW?4xivMpz0dLEB#z&rvW=CMV zw$ZcVVN_nIR5rsVLoX6kmclvX_206J<}itz7mLN=;|I6 zQvP2)Po6^+bhh`-mRS9`XXLROnXOygNJ<9^q$AjK8x!t-U$NfEHqu7Wu9$xFo#l@~ zDf0L3MZ6*)^jDI)DEHUBj6P05gG}=midB^T>;L)Rr~G+{|94#eKa7h;89{A=j6|>7 zf^A-?c%KO+!`|HsS~evDnO;Rl8ND)8OG_QI!9UzDqub#rwi|#TaGs~k6`NXH{wRVWeYANpHo?`1Ki6F$x#mJ=5yy`19E6;q%fzCiZsmys1D@5TDIEi(`MzhkqYE&nP26t~5niqCYPN^Nda*r;ICz_S*E` zn$m)IMcf1_az+z;bDC-qzJN%SMzs2U{Kmu&Zot4K%-B*-u-m_|ZZ?3PKyDfDoF;u88_(o0M=CTkwlN{TzL)3j|j9E_nWwrc% zRy(18p#CzFG~D)dUsfxM>amBFChL3K{fXE5W>L}P<$(pvf4MwV^GVM#{+{mDAe6KA zr<9S8)BSo8Uz1lW?wMl{wRv|CiT0_k4<3s%(ZYPCeIbH8prW!Wj7_dWMPk=$f8DDa z3><|P0FsmSg+!n6z~@BV_mMwDqm{eYRuNbALC|U^ov9;59F@#d;WQAEEcgqtd6ED4 zsBh5gb4gb-3^D_i-7|^>%v1$jP$|EQN{?w&(MU;R)=OWCfrQI)GQwBpxeSjyW>vWOVMOeywU>4n#D~Y)mq^9z)>com_G^ad03P_OeD1Y z8+c3Uy4Md$jz7M4pY6bf3D@!$Qko$zFF&^%82_A7B_}tR+_~8zb;gJp;SE2DwG9hK zfvpP?GvWeQ?zM_|~eCaYst- z1;*gx*E2*WyChkYQ#52LdN;bu)jb#mi_+tN{_X~$X^85NU0-~<4eS^5j917%Y~se- zh}(qzGC`hs>MBNeUbC<}&W5o?>pfjVDO&B9&pJUa`L>bZBq_Osv(Q2-^I-eYo1VYZbZv-+b1=#%ct>P^m|&3sQXc3qvPfLk-; zPE)i%wpya>8YuOB#7iJV;3h<_4!Wf1y~Zsm+^^hRo-&Q~Gn^^}ZirrgiM8T*=U9U? zxN=wxRkf3=c2+dD&78>5`w!^(1<278tINq-N(vMbr$mCf9?B<1oXML9$H|upg zGT3JEW*22P!KVeX^h#}bh01&>>brm^bq|lTtDOgqJ$*lrvQA7!c76gPrWx?!OX+!Z zdjZTo_VfqT*n?{pz=2`8#d>3LbZK)2gZBD zoX%*|%bM!h{=O7Esr|fNn72<4UM;kx$Rr~2)cE`_^cQ-}XRKT+PlPS9dr7qqm^fqO9y-Lza46P}_ zC^SbCxA!OB**E9omB~*w^R62tF?x*19q0Ul-aoP8l@g!2Fhjw+z4}<JK+GJ&-aF0!IjoQoJWY78o3q&!))t)6yc#*7_`=ojlYi?2Rr`RnUtV z5Z~LlkL$^e-=vz16LaeW9q+eQy4@X=^cVB+o@F+>KMACI35|w`$-(FV4R3wX@=bx^ z5UkqiAw=mn>qcwEKy+wrb%|Ie%f?4Dvex;JdxyxwRS`{Pr5} z_OTODMC6_guJ(q^U6`vd6S%pZgx^dz+H0zAW6wGCJqU!<0=*POz0r!4qPx^0(+E7! ztXZ3B9yBYOU({pXFED}s)un8qKtLmO(WTMXf|QtflrOb0`b?MSpH_2364C@nV^sU? z=f!s|8$-gYrrQTfv4_)gkP$K1TWNd#wgxJF-8nPW)$!jqqO1udMQ^M118uH#PJOdK za+1SJ!6_+%7yQObxQauf+gCUR+CZ(1g-+S3?+y5pUvIykp_@$k2AynZ5LlqUa(29PQjV113i1gl+WP zt~?nXL-#ZCiCJpPJ86QxvK;P!ewYt-nY$nFvG(X=0*Jgcv?v;Bm`XO>Mwo*e;Tl*D zmDl!F)L==pvPnt#BYYJaT%jpw;4=zV=gphu{?FTal21p4*`bZj*B+xSe}Po>u^~-y z@Tkaj_0+&g39qm2oMR|xcJKg0M31}8P9dq32+n{Wz$6L5b+cy*JjG-#R@0{;gFwWQ2Ci!`(*rvtg!n{?FK~Gd@UOCTMeo22X0}XG;%1<*xd|GUTgO9 z@}LywM#_kVhSkM1i2TCRqlDNicE3jr|In;nzD+rUtQk%X8T8OzOFT~jy?{Nr zR#ls$*p`BKWqz<9<-F}Ono4vSrgAZpf`z%t;D|2T0|J&hHGk2^8>;d zg^Fh7YzJ6nF(QR^v`SwIN$AdDpm933yL2iT)oofiBXl}>JoL+wI-oq zyw#GPyAWuq2jcE(Jhg2B#Y$_tpT@JTQkg9yzUCK-O^>ll^m3*0zQ`RaGDo>>rFSpQC>c>O zB3t$PTlP^Li=eF(P0bM`}&CtE8S%xV?dqMjJfh4Q1A6XdVGd`NA||Icq=0E(l4?3Hpm>xSn4hZ!2*oJo+lLtJ)~c2ZhzJeDOae?jkc^)H z*9|u0Yd)iS5v;&HDdpH0*M4`PYdEl7UJ)##;L6;*Ov>~@m-g>|d4i7(dCPwu-v*h@fis;^xu!SPRbvNEm%mRz_~xi2 z3U*#Gh}Yx#CNV=qZoFg{b%CxKm@G5Cd|P5*8!0-^>B_q!ADvfcL^+XBx=Qy&?P--$ z&lR1O>9#s>?iusEfcaABd%Qx$B7H5D06kysSqN7q3O84?zh@&I67y{LCM=YFGS|4y zzEWFT3X*Bz&S!^$KP~mJo#?vWW{(a-X6(Nou9&pcc-dSDu`VxiCMeSsH%=8d9$!mB z<9-Q!DUp6hP&key<`4ZYVM^Hjt?A3|{dr5N@A%GTFv^yD7YHfxCh1pd(Zz^o2OGUx zD$FDFw=?mUB~Pp4o1NCQI9q*~S+M%pT*pcpo1X2>%z)Up3dxDhiUO#`jQiS6HJ2C8 zdv4lqPQ0nCZI0G>S}9W4bsJ?V#j&5%adfE@XApaOoWG;FyTfQ-3 zcxT~Um#q@v4Y8*bYvvI?tODr;$4^JXhw@#ttEs|<|$XMRmdKpvDRvXNze@ns+ z91-GeB9L+(&=~G&%M|+F^*kemN-Nm8wZ9STyuLZMTf!)0VxxY?GyaV3AtO%(DtE%W&$KyNt53B2|anNM*xgRQi)FyJM!KbaM#(0ohU) zT=g4gXj?t9Na@u!78z5wGPEdExay5Qb_hi3y#|W8WNtx7rQfEV z%&zv-`t4N-lDE+Kh|#Ec2i9KY3%^Hyv7gHuE!7zBxs{GXcj|R2C??)(!bGML__pV# z)opXp1w`6?9Ck5_Dl}0pZ0M5k~=v8$53S$b*qje}7vbI9zq=(aDR8 z%(H#6<{{xR)ChnCVR+d!CBJn^&dL#-%RO-mV2ff-3SZS#`yrDXuTK`RkZMu*#keq9 z;(B7(Ddoa2W+=MF!DDnS3WA`ep9H?X_eDaYWe4yupy3>ic&Vw}Nk7t2TN%P|ycUj4 zIk=!Ogxp&C=8lw+B`-J9+Gx;-pC=ZS6xfv+CTcA^@;tIbLkw!Blo ztSBgst@!7MaEYl)-Y+vlMUf$16ju|_c~24Es&_7TAE>+gjL||S;zKK2@1jRpn%jQM z_@}68q@hePdBkJD(D3TS7Y(VdZEn=v`VQY%L?E(}^9X&Ch4*jAlNzfHXPZYjOHtqR}_E3)Oe)T*tQ zYd0GouQB&*J;8a}f%#%Q`!?-arTC>n+jJyl=s3EBK?1{zfCrF%$8@1MuG_nc49B(B!I zhD&I{wk#O49VU}uitc=1k?wi_^aF(AF1<(IhwOJN9H8-@BYyKKcc%&5m#jy=IC{jA ztWr~;F5EeVFWme`Wi(I+afOg1kdt9Kmgm#FLgBN5p%>yn{WIV&-f%2ksM7E;G}QZmsAt`5;bj*bZFGM^&juIvhw#DqZcIfwHFBE9=1YEN9;$@?8x09AcE3pwe z9L1yrEZn6IWib$y zF%aKAtYsH_-6y)gi;-tIQ6DTvWoyGM(iuFKUf*Iq`5lT;L*K?a{uu)YZ8)Ux1*H32 zy7!4(2#eg-n0haA46szvF0Eb0*Boc>2=Q&URJklGak;P17qqja2gD|fl9LQSO26eW zXA2RGQm=tCi!qhgFkx16=TD)Zb)B4QM-cw&l7ufI89x8wj_Ts%rxPj;RHLf_%sJvl zm)b-bswDKwyk%j5@dpuPz=!mmh`z{BOZw?NVrv9hct-KbbSd03UVbf zLZpf=@AfwbkD>E1D#P#NnUK9zE``jfPBj|_iZr~=%%)@N-Eizx&icr9!5OByVTDIz zH11~>7Nz;akv(XYt{~M#1s<3b`hBgihsh-hIl`mFipJH4=e{upaJ_iE+O`+iUT{hi zJtDciHdmPA^I_UAVc=NFff4o@qk#=Q+C6I2_bIi9wn0F~f|cRj@Rw$>R5gJ0Y?{n7 z?gtNUm)edMR>l=&8+5pB<44%Ip?GLZdv8m_8WK21FqJElakcjVcKg!1<-TU8+Vf8L zEdA{I^Ol8YX;%sTFR_PHRAzjz?Cmsmahz55ASLNMf9stYsM`l`&l8^-ohC0utjW!2 zx*PXFPzuIp`NH;-Nk;=WJhodd1*jRr(n74_QwzuB((zaJ1LgsgoBk%w(ABi zlYkjfwsp-UD73|zt<5CVmVT#GQstk z5W=j;@BPx^QwTO@+U0hK{hVdYIWiikt%+5_bvNh=nEpJ-^C}khR8EfcL2(n0ZeI=> zgTvly?^JiKzWbOcPwg8kU-BRGacyKj6!KXPmZ5*w7GA~ec0UbWoBX%}>}P4bXh%q3&rVzV&QXaG5)+_Q#9y znniOx0Xg$71Y=rYIPBy$4I6ut5b^B2}nuW2I8&*%HG_V zBky)=k!4Ra-J@>CO;EW?>DSs;CCdv*Pbp2Ir3^7?9+|7N?67r?l3Urm{yu za{FmQ(Bxhq2u~#0lWroPdMXcOFArRJxQZ%NR7Od$F3JgfKZ40ci)4~5IY z39ZZHUfUHcq%0oGHTI{{G@=+VgnIQuhPh!?7Cs%u1n)mY`jTSZSGn%^{;)ac zovVo6#9q{RnznGgvkI)75btHBdbzN22(xOi&FqJGI4L)WYxTLv)!j7W>higu3z^GZ zQ|#JLliRatJ86%!Zkn7x%8Qes&|7Nsq;oYeHxMkp6&b016Ou}$ll-K;ICFE^cBrbH zGRtfTO7yb;747VC76tV+1ElHvKzRiK(<*oxQ6Q!V zc6M8LzzHoT&^a@pCNdmA2Pdy&7*@OPoKiKO0aYi7xLO4qY%6}18sXhF_YV6^bi#h{ z)|A#af$$Xge>Pn|=hk4)IZt^Qd+g)~jTdrC`sdw}di0KR`#yjU;Dh~}#&TsLxkB%{%2RQga!WvroEBW# z{M9v+j`p!_ypb#P9P|QjNPM#%hI;LW!>>1&?|*(vbjBh;**M9%^YDe5p93@4MQziv z9OVX8b?%eN{%UTZKs-QB%Ic0ciX4xfqQItgbUP`n<9b>^j^I*htcXkGSp_zw+ViHt zoN7FQ0F$d{Fpnz_M`l%0jHwv3GO|2Fl;P8#^!0b zp?BEN+Ou53aD9F-wlF?dWncdZmw&Cdzbx8}d4I=@QOy2y@t7Q?d0ez?8PE$fWE6Cg zQp|&2s=fc2H{+B#B|TFXVW^}mQyDp?VEr|meO_eOR&&1vl zie&VlD~>)G>^ze(Fm>7oeYT4G5N`M$-}mzLXSpIiT_4k=8Xmb2W$IPintI(6<$S*#caspp@+mi+D=T&s{_E75jAE9kq;Am}`eCM`nq4<__Vys8=m_IR# z{Ytl>-3O|}%Wv_=1jTWD3J5K^Mjjx%i7F;zIVLQG!4bHBmU`UH!<=9z_;zT`snBJ+xt=X_;ZR)R@Q!u`kwTP(~Nj0Vc2 zPTQ*;XuPJ9SPAM(ojs8~Q*{a~SlpLr-EjjZd2REGb$?|O4`1`B?(aX$8jt&zWWeko*;|dS!Gp#+mSpG@YJ?t6kDn@AcZy zaNE^#QPHcSg`%S0XFXfCO-v`7d8Ry@N4Bp|IkgCPm5|gIl!1I-eGcX!CV0mgMc-54 zu35S0JL&knE%=*L_%%6+{n{&)>zI0W%%Df9tK%*zI~$GGeZJ89udz5dNXTLct0N;z>bF+XtvO;X`W;7xa#^ zM7%U6K6pC)z=-SjIR3qkUb z+iiI+^0FUs>}=AB=-wZuLW(n0vo8(~_&>lSs;eZAxsj^NJL`2_5Uo>M8H`RU4C{(6 z=r?Q~@{wA%DbDhE8V#{nuzVUiZ)A#{(RxjV(WA1Pb(WY}mMbTzIG zBpMEQZ2Sf&{COGjy|gFv<;Gb3IKPeC4Vs&C;$Dc5#rU)@xqjF?YW2yb37Y>^4(~$j z|B7tUAoO{6gvPzn%yWOr=nl&Zg*y{MOQ(hj2@?vfQwS=zq)rVQ@F_}Ltr>0Md-xoOH)WUqzwAW<{7@V^FaZDawf=V~{yoe8FNOk{Oi2TrhWkK$Duu+j575im zd3mjYfq_;XDaw%<#mm2bU6ha*hUoFZDz>Ze(9zR(fQOW2GguLc6)*ogQahVXm5YcZ z;L!3^OQ}o{eR=C$oa(~{O}g_%W^J{)r8dfMUotC8@%&{XecsW2nIVv5I|{Jo2f#)D zesd=<#{ux}u#ZD*Or&Itf|mcfl{I+r=LtW18*~V*0Rj}6DZo8#1Ju>~gB2)ybr#K5 z_G>(UJC%{_C%%*uNG2Y|3rgB4`+=UM?)c~6Y^WRCoR0Uso9$h7T0pgO z0GF~gGhe@cv#xlD#=hYsWATSyzNC~^kd)aFPM)mPh*pjjbt(bz_LBAiY9Zf0?9bn4 zo9bmE;bRDZKK%ezBx9-SV}3thVpO1z?a=kD%qt#-RnGa8TtyhE2RyoW%S~J2w19Zt z=o&P@@YfL$CIu%YXe5#9-cwu8#u$zwjqlA53xS7MU4C zHRp`v~*&;B8;t{(nisp&->Sf1J#?i7r0QeZNiKf2i6` z`?KD7++Rnqk?Um_p;VRtbrJG$jpwc}it1OR3+^j(&gwA`k2Er8(0!=v|I?FfHsCMg zq#@vwb(DslSKkZ_NjSS%D5!y^*Kn`@%BnG-r6L8Tr~6BDi=q0i9-&W$-%*I0J}u(g z-{)Mwxv*S&-v#8r^Fdv((i-oV7;buB=wKv?fX_HWgWpS_2APt&@6lEyLrg~Xz4r^T zm%)BU1^Cx9Xq`&E+HMvCQuex@o|qZ~!{0G)NrJa8QNSVbOPtxk!`cro?4=lCJU%6sTI*%!8tz0{#slck+&SnkC(KnSz^ za-4|bXb32`Ul}Bol#1%TM*i;;<6p<<7`cgocb@y^nN<)}Mp9onOuNOXS zD&SI2u`0%C{|peQO$1yXoy+0oVEiz@M2-OZ%8`xw`0Q=0wm*6D@%)3)&pED_C_>+E zvDPgzOxg`S=KdcV{E=b4A&pu^RKDFe(7&%R6GH^^s88-HnAcnBa`^mVu}8=uGKuij zjb4Dc>CSqB$&qbSj1XUmwWZe`SmS{Cva!@ol**AX`9hNkC_II!*A38?!G%Bzz#|KA zi;qHwf!qQJGJ6=khd99CbswVF^}9d$J!)S32^bVD3YFdcNVMJJwRd7U&ayMjxY)AC z@jMiS3SrOJ5Abz=KFTQA3n-tvR}_=^ExW(3fr@|z)z?4|udNvlM&ZXvc#K+z==?PR zMe3I0*ef00aj41Ay54$s?eZjV#T#E=qGietLT0UqNzWgcw&DA5(9D53eWN_8Za*hP zd~2FJUse$ghVj0wOUOh@jh)knA5oKI5YqBVbxsF1*vl74EmCqgwhMuZD~F8@PNa69 z;Kp(K^BPp#>B%wJwLZVP1;o#OFiF6!;R!d&XQZnVMv!Ox8s9%ioxvr?Q^KjzW6 ztSFFCl!II{nI3;R5iM{v#pK+(R-9Xi8}gT^}m0qMoVK(q}|kw9lothLz(%v~n_Yut?W z0!{CN3pr(Hr&1`kL1z0NUT#^x8n1JmG+$gL%B2Kg#LPi+5T0PSgtNm%C911|cpaj(qw;LO3_D5kVyX)Dj1>;)ISDohd)yW<_ zxPZUg@LHh`dXYTHjRmiLOS}p8Cj=i~3jj`eG67j=qPL-Z4XJtw&C#q$``V25BY-q& zD=XW`L31?1+(9a#0P2&Xqy8rpW)tSb2U^X-rd`39BYnU=?M<24A;F}pV4LAq66^l! zYfd-y^+n`oBL8Ut=@mxKix*!Mz2WXGw>NbI7cK>BFYV2Xn>V~wmyU)_@Aqtmkx-mk z+2>dtW~xzMIKfjkyPmlrIs#Ua{}s!so+2$ck9;QJ(FXeQ53p5Dp9{=8WVc8BKn1U> z(I8bL^>T(4p|7lrJM`ym&OMQ>PXp%%uVs@IUMCsv3L9pUUggq4otHxI{kYA+@| zHd*Xk)G>`Wu&ObUNV@@!5v&fC63gGOcEhb`LfwSjZ9j$h{`PVm-hH5QyUD~Gou0*S zt>(~Hi}L~(3pUHtX`z&3*UE46$G+T4^;Qb%Gfl_>s2d>LEtHL-ZZe+hGn890hC~oCBkdkAodOF4N6snnO z+4v1;N^i|{gZIpFRQn1N+pGO{+)E<*>_d21>HSbK!3k1_c;~Uh+aSI-nzIa2Xi;&2 z>nht&F|51X^Hg3C*?M!;O&F$SaP#R=#>vSkC)V2=udKY$TV60_^ISFo46X_~LE#rZ zrGc=0{sjxqZ9Fof*&2M+Qo@d2F@URgo5zg56@23Lgm^meyykfKU(azgJtt;Frtrl| zdWtoU)u|4LJEz0m3${lXS@31Ip#{ztU9xdLohr>nL)$r10f%2T!_m>W*}I?Q7KW3)^<& z+WD$OQdP&u_n36Odl{v3)x#7#il}`0907%FM`^#myWk}xmY>^vPuYzf=TI`mXj^5h z`z8To32e><)WmD-H>DKR^y#W|q~jse_y($%&U!{bbC)N@hDpX+zhl4k92gK>SlSoe zS$G8QYRyXf&Bcqw*u>#P*=zV-9Qz*QD+P}rP2PIy=iQf|p)%|^k=`_l&#VvZx0k#= zS%+yr;ZqUhb98=UI=RwAVy$?w`lp3#^aZu^l~9%gW%=g$Jtm4GME(=s-t>dw*O%CD>IE7D+0Cgij*{+VeU{1j+QFFBZE6X0P3(nJ?)pnU_ek| z7EatEKy;RwJMNsO3}f~c(v{a;&+y7@llhGOzUt#G5l?g|))MZFwx@R-ypQuCTklo4 z>PmDA@7!D;_VN;HiV%+n5&z2z29ySwbq4hXrQ6n4dhG7m#`L`yWz@cN5GQVU2FybqZY|uZ zN}!P^OyJvFPrGD3)1J)U&EDp@mCgM@gXVp>g~y=egPm7q6baMnTVZ5WXNn%w-OO>?72tNE3i=&r4`9KxNnR;oxgxuvo!HjsDjMs2tSeJneaH?1%Pf_50tg7 z3?C_ey1(#bJ{1gmfUbJI^hrHP(Tp``QuSDu{P-OFu+2+-$ZOwYdDy(t_ZVt~`{nJa z%J|nxiRWp5MQDW|r7?70lIh^2rwcei!KKl7o0Sz&c7nvqBtbAv!1A>@zi*$8&r7}u z>y|r&QW^UX)dwXEz0qNe;E$YEDL@*yb+p)`t8tf#?xcknbL1keaa&CT=m~v-&W)`e zApW*JEQ62J?aH=X8$Yrx-nCWX*SNtEN$~M0VfqW*#fFG{SEhpuHO)H+OCl2GhGU+! z&beaiMUZ+GRG15r#=d3UDgDKhloetjX~)+LS3om?4CnB<~n$Xgdt^_V=eq3g)YzSa#@J))Rsr5r)bnpiNXm! z2RwmC{kyEnE$pLuvNx(0|gDgLQ^RD?Ttj_=Y9GInQFuo?>aqCD=$OP+Y$CuY$c}0 zc9z5J}NQX!>pbh*UFEPv?pix$M2i2;-pYclJ+TCXi z2s1+u){svWaSkljJzo+`c-o7kH{JN=Q6IT$hm!{pt-#( z6ocK%C-UdRY}6{ZB)fHqSvJJpu>jGr!gPc+4R*?sY?g-0ST ztZ~YOm?T!6a0Fsz1G}j20=4Qa?1d8B{~i57FlbCj|J2ohgUtu7HtRlQ^z{LeLgPmb_iApP?-b-T@yR?BOxEBjj2Pg6d&-)n7?QD=qo z?`mvGPp|vp4)T0Np_55J2%fGoq_+N)Ir9s zcW=;kC4ZD)6cF`1f&pqPU!tb(f768{-9P>*o6Ub@i?}}VJ<2q0W|D<^p$ftrA)errmuLXje8iqa9yvT^=$s9-KZ#IyzX}F*t3$1ZWp&R-1<^W@X* zK(a^edW@)ci#%dFFt&)70`Rn;R-!1(%EIt)liZwy>3F6{L_;v+n_$fg+OZIMT8YjT zfv%pa945ZQfH~(h7fr4|Lv=OS8(TqKW}~evlh}MO_>w9|K3`wXj12#JdEmmi?h~I~ z+wTzKVU^QPd}|qbQa;}FnNW|^%3r8ub)R})V!r2~Y<(irU(~G*#|?4lM*3}sJv^bX z$P<~tt{*xr6H$D31>~;AZk@6XWDsVcr`LtL(^=!^LeEzH9bw!z_lNg)jh^f609j-< ztFZZT|E>rP9EWyO?#})`62{IxmOQ@I+w+x`xnrc{U%$Vv0RbX)PLKh!RNtV@eAQ=U zlshVtavBj)EdGNAk+fwi*tL6~l$_!yEk&A{#YN>XIs@7(+>5Gh4syCy!fgwB+x1%z zX<)BUaD9Ej4Fyc+#gU{QNeybCC4sFA{wQVqvEFQoCIg z5HVuyn}uy&K^Lj-Fosx@u}mkkaq;Iu=@1*knpHD#w5QV&bz~@wED5b5?P4J@v%x`mvp?t7C@9)D zR`&>cFz`NZi%|0X8B}{x85fZj!GYwo^w?SOvJA$@3R&F^i$M__+qT!WywQs|Je#QL zn5FfJVEWdGJCD0;CqYHiabNbtE(TRFy`Ww#u|FIjUGvHWqj+9ge)4+X(>AiN3i+%D z7WBE}U!n;lRTQw#9~rHjTY*~Hw8X;+9MDyRc*de5BQM@ac3qo2wfuERI+emH#8Lv4 z29c;Nxmo`G00P(3&Jd2x^PkQ~bD6j=G1qTpk%ksGd&?f(0gjd<)M;g85qM)s80{A!E}yocOLB5Sh@Zr*+~-6jgZm4f>y`3k z8^Fc0B4cqzi|X%x?u=USi-RKJrS^2jL7&qY!?LU5-O&WkyOFIf{K_x;R6D5B{pH>> zxqLe2sFi2qr;r7bc>MmvM8W9RFR$>7JmyRZis!WS>6`@D_BO@`-FE2(tRwbf61YNZ z6OlzVvc8;Obn@>7m@5-`HBT4w4t%}0gI@+6k;&qEqDa+h^?wE)BnCoEr}5>d`Sl!x z3SqM6uxC*?M*U7o`1CsS!nOtu#~blPf}(h3A^Cd1BKo>3(?NBh-`8Ph{%riYHM#-I zTrt1;E0!CfI;$BRk-J1iI-2?X8nVo((XQva#zX}aMQ^DGnqAfi7GInI5h;OSUUCLf zVi3oCVb$)wi}ytQStv_jw&KH=vHavHv26}rQXLMya^q_xkff+>SpIh z-64XH!_VS=_PiPt?|q(gBMY#8K~gkEou5TQb_5Bs^Y7_{81qQD61^}P$C$M>%Z3DlyoKErLDdd*60cR=X zG-{a(`sPy=el>6%!CN#AJR_*#VM2hsS7q2tEPs6%HkIRh-Gkmd;}in<*qPIGXHAQr z@|`wFSaAQ42aT38ORSqUz8pGWM$B5YG45cf9F;7nm@)w5y)ax#1<2ZYWvnhG(${vV zZraZX49?BmI3866X2D^K$#6A9?$&+OcPL9mD8$Y}pUpUl*EKOrmLen}bzb4;`|+K# zZEZFC8raO`q{^h@=Q#OWzYy2@Ig}Dj{Wm)kZ9!?G3589~q8x8NtQqq)JM{ir&D`ko zH`JFkN)k{UMSIdNL00_37(+Uy>6_-L=ExF6c24Gf{+@DRis-%v#kyoIx!7;I*R#asZ&1=babcw*nm40rd0E?xRM@2%kOe=L)Ya4uY%o09V2lFVS?FjB zWBn#47G7XBJ`PHHQu<(Pw=wd<;Jxf9jLrF+)be4sRcz#Q#Ye&1h()L!_lqu6jdydG z%~#+uJ}}z{9jO1|%kLWE|Bn`*&8VhIj*RxIzq_Gf+;BvjHqTf_*fD7SG)|+gKDrzQ zb?DAt%ga|E3Fr76NHqTW_?N^)I;Rj{lyL|%F@HOAPyL}a1fES&{`^!?8o~0gG{|H%-?N8 zR?u4sF1hL4S^D9@`7jv!*WXR9ep%V{=2jFguYSx(o!6VyZ${(U&()(c#qgBbsRO% zzaOlCj-YKdBj&l1Jrm3M$MydE2b0de>>%{5QB#&nB7M!kqiX`Z`87P?3O`*ivnc`L z0v;#+3WFr@DInJf1a19siWB@-j6oEXR|$Gx4p7(7y?VyoJ*TQC`cQOu8Z=E)AZ778 zWRpbrUNWZ$vHItOhLEH{58X~m{-a5G?!Onv|6q;29EIx0fEkCy^S^C9Z=@_KIn9;E zruzSV%70A$|BlPQ_sjo|%m1JIh+EnFl0_$HjIe!59V65*1)#5y_%aI93&5yZFmw;C zoCOtr>&?y0iJV%Xvp{dzVnSTSoC7b?VGX@^XjC)yTjo|P^bdl*fE7OR9oW^Ff>QP! zhyt?Q*5^TsY`bhbWvd=cnauHms-UcN2TZip#op~6C=vYQ-tl=ymqtri3zGYD!0s+d zNI2U=gI6Sq_1fDM?&tifu>&2{;>=u3-`p0co#=puLb&k7d2#T|4jzOakz<#pwoWLE z*x3A=5I&%AiEM+xjdhH5Nj@m*CUvTNf;zV&G@M>n#1G@K6?xF)Y@?u{*h#rkv$s}S zQ;cV@8MZ)pawYyL@!!6r{t5h-ghsDXCDeY-uDQ6ltbtsH4y4R%{oMUA4u{A=yt)K0 zl5$K8C{;Sl2s|_|TF_cIOIXOd&jjw^0%%&wm6TfdcY}jz{^QW^2;{Suzy2a+nDG{w zOim;F;-oQj%(78)eO-VOn2cVe_S*2nD=9>l2y18SK9JbkNUW4l&Q*uY;>s}Y#i^^a z;F(x0D&9}*4+Z-nJo9APaH=V0N>+6vJ&Tt6C|Gb$V!qm(L&|Ff?*92`27%k3?%wFl zrBLC?lRdoPZ&6;oSW9X1@7}-8kG@Q)`P2du^4i1uEL4ELsDxDE+XGo|RbFwbKdXuQ zFwuY6#9L>^<>Ao`IfnsOApm{6^;tX+A|9Vr2yvg$+BQq_B{~$W-^#QO03pEus><1d zAZUI*N-=*~%igt%ngz@7IasGC%0rf}v49$>*fI-#0;O3o_pLA6fL z9BLdzpa}J$OR<9$-n)4a2cpiS^!L`bu>xw|=zy#)%+^tJ3ie?P-k<%u+Hu{)8&7n1 zbQ`dJ(c$U99(M$fyHC5>PjGc^e~CU3>O{iK2&*3j^>{{8&-?7=S$szv^k=V#jy+?0 z7cUZ?TQ(MW{59;b0w}TMeR8akjGd-nrR7dbs;CKZ0Tb-mr3TiX{3G_%4 z5zZBX4zeheeS(@MSjF!!FXDk9F*%$=r^#K3_Q6s%zubQ62{q4}VQhB>&?37AYCjBn ztQ+Jntd2rktZ)uEo;H=ff#5V{#J;w~$XhXeRutSLcjVSHc0E3*%?6G5)t*Ady?JnK zqMgVe7?X|s$7Mjnhpw6P9C>c!h~v(x3Sj;86mJAw+J=_9>b1uJ$f?|3++&Z}M8bFlxPzq_G6f*&whGCTlc{*J*7 z)BuoK2h^wV7yy&lCns)QJ5%8N$k_OOtjlCnSQr6znnlDRO;nccBA_i7no~LU0H1Lu zhygJG0E_vfqkV3KHuif7r-k0$Wz)LYgmFJuylJh8})$QQ-IunKQMDeAPc?ji>FQ z5R^y;PJ_-KbF$3S>nSKsehSI=VX~HK{(g}_yz7nMTj3}*n9}G^OKZN;HvNCNd+Vqw z*KU27lu!YcP!L&)h@gOy(hDS1TDmb|Nq2XMAf+Gz(%l`B0wM^~(j@}Y-Tj-(z29@r zd-n32?~iYc?>D}`wquXQ^W4uJ^PcmXb6ywTp~{BiX1wQ+J7(!3gxe>Tvrw))4obQ< z(KQYUhrsEV2YKbjI~J4oy5G(*&o%X3$JgcbZiQscw9p*Nb?i*m={?!~3=Z8#UVKN2 zBf8U_yggsD9MU;}THj}I!7rsBH0cVjoJ1J%(aI2P{E9Ligi6JUt<~uLnoEy?uZ>5> zztCiak7p_%1s_sqS-{)J*&5=Pa{r;eYngNedxLd?;ZR8J^?*VTl%LYiZ1*@>WBZwM zVjS|bUa2-+nbxn=3C7y;kitlyVc>BS$w=g~gR`J7cTM z*T+l&`JQ*lO$Mjtan63JV6P}kZX2*9+X4jia? zx{!;RZsOaAd-J&!W66NGW?O%&feN0-m)+^IX@}>o_gaa%gn9&S&Y#+O@^C=6PieZ?&jZh! zyputI;f*L+_RBcyQ=|6Nv{cv95_!uFWbmvX7*;z4F#AGo_nh{=!QK_?nH%p3sjQ3U zb&7OKf$glN`QKhb1^e*Yjnm9iDSHkn&|o`~Ic(Ebp9pi0A-3#t}fu zE7<-nxfTlA%1=}D?pr5f_As$<2Cf7bVtY_Z_gW#D9Uf~bHhHyxcR?FLa&P{`#$3;h zwcnlcl!XCCgrin)=gM423e;!GpkYm4$R%--5l=cBBg*Jhy^?l9I3OhD<{p?sblsQ9 zrK6Rj{81B!8kOT&E*JK#TX%Pm^*8=q9Q81!!_(|X%OywjyAAHw{e0<;E z@`m1;I6Vou4l0A0*IV+%jUfp#Avx|)`cfi3g>Q7Yrt zM1RW8D!_1tsj-eKo^F%cE(pVTO+LE`OYSJsj?YQ=b}!65-HNTJ$F19!tRdBv?7qr{ z>iWExKw@G&4ElSCLF=(^iO6E01h0GVYMark698f z>g1K9SxO-}BHnvzrLVXAj7B2TIJ21MahTclO`yAd-$p@;kcQ%4_9}%eOEJ@R?2r<} zDk7FST0?h3D1p2lsg@{^(Ee5bPxs+D9Nr7)6mFm5FetPHp^{TqoRM)KcM@ac`a*?3 zL&iJGL(+eE?v;%$=M@p!k?}X*jx;LO{pT`*Etl1uQtk{MvtvJ0C z_#(iqgPJfo3=)+wN5HKAR$KC8U|*4RxeEY2Xne?e*;){vYTW*)KE|b)mi8EpjX|O? zt<*#iTe$V@5ZOc!-!%BX`k)xpJyII^F5UI`h+%7^n$5mJ%pj5vs&cW%Ao2WWOBz7LEx`ufRI9Mn6xvXK%eX|EEKzgSpCB$k)KY@wFw0AfQ|>fF>Ueeu>3wY}1ngQ)^+923h%%?-_bOmfp;C>!O)_KM8>y zai0k|7OFWw`dV7^Eiv^~7ZvzD)^fe*ZsGus;AQyBiNH?5^a;UoEr;1;6E877Ts&`n z4a>)XSuI(NGaeU@gXu3p`&s07P^a-^$J8`{6&AogT~iLX_d+!vA!De2{HWVSxVzip>o*<`FtX zw(kwA9Rftp3p!XOO=zFIo>|YW#rZ5KMoe`VSQeK&P6#u|u>(`cm=HT{2<2@TVD))m zrLx~#HkxI{qUsNy#`%Yf{z~URje^ zf0+O3L}BfbNv|tTJETF66u<0Esi#8JzMX5l$Ew9yJ^=(QMffKv%UWFq>Abm!4IYmi zqxly#u=o(s*dA@E#bo4>I|;J(H8J9L4p+RdxZwGYscy$1k6jDr=fQ#px`$>|U zI^^>HOvnWn5u-)8#QMs)NG6lg{WtiP@+e4h$jf)UQ{QUi-knbQlPRWPLbp0nj`cvR zxPG*?$|UO8?%q+lg|ll5OKDl^4AAP$fxKU2K7I#9mkOZ! zg#3p$0vvqVr+f^;7KmPQ31UjC4}Nn_=qjneIp}$)5O+WHXxejugs1hqz>IU*x)wb- zI0JmgCy9w~4qwR06Hg?5(VI2f%O`(tT++j5lT4OQwKtG|F{JVN?!rpc1PHH0NaWV!KHxM0eYKo*r_fyqe zwx6Y@p8CNu>s_7l#W)$sg8#qx7Lb+VH?`mQ4P?5k}saa+obMZI_AJDpJu zi~%QB`g)w__E%<32h4SxTNzKVK1FVjrBgL1E4Zn&{kiH`Cwht)*GWN;YfmJ%x=Gc9 zIpZZ?OYt@FG9@v$IBo&BNa*L)wSY=F1wT<4T?t(3o1g1>af*&RP$!8Oa^(~CwV^^S zV$-W_gDK+4kYGqIO+nmCBqP_`IXhBK95|Vl_X&o?TqtI?7nPYO8ir%`zRDr55l7*bY3S z+P+%zt3HSoAb;ES&6oT$#X*#+D%Z#PXY1!_y*$ZVt6aNfcs|Zr)J?1C#qW3RF4r8p zY=_18_8n#zJbfu~eP=~v{=9)Jg|Q+cuJgpWW2bFKIHkJ^fkWBMQ889wZwMh>;u)ey zm3xXT4H{{DP9(=V*42}5q=p-3NL*^Yj4z z;gFZV#FOjiJJQ@O+XZh+F0nJJ z-VD(7W4qaT9cK*tQk8C2dq!$bI`6ji2iQeTo=^P(yH_=^?l{ChGVY^3G3V9ii^DSW zp-HMwae5CJ>V`Lj=G5d$E`9x8EUyfyJs^y!y7(i(@81C1e?$J2&v8c+BUt=@PQth$_h8byOq(zK4@+kculrysYVse+tN-@(kn`L)33W|l zp&WnADj|Z`q5qk8%xn1HKIPwUtXV1q@?H&-{-3fX(91Xt!?ma;`uMm1jA^TMu_4`p zT@>5?hn?02!<}?GXMy|YNlwyr!@7K!^5M)M-{k%QhTF7zZSsF;>b_S4nc_VeUiv?; z6fb(X>oQHJ|9vk0>&Sv#U*=Rmg`ZS=x#v|p$DoRC{?~J`G`tbJc(@Z2+OM5N~K(Tyk zt`|=Y8PYNJ)*^lI;GE(`vxFoiF#~2Sd{E}OKOloyGQ=z zF{DI|p~WHxx6E>yb&78@L-~eh2!XhYynKuI8RBc#!&H&4FQR1uLft9DB)NnEa*{Q6cp`Vjhn1B}>Oq5$2* zdug2iB_OJ7J#6aY#kZO`#AhHXq*f}AL~~}BGRqlbIx}7HieQzt1z|Mbz7_)rQpO&J zCHp+1yr;^~roL8~dAB>IwONabUqc zl$NyUIpFPFQZ5|%X!y^qfY5*~ppo>(RaUjpf1gI?*rCaWU7vYEa{{M6tBwz4vjpeZq|nEUPwc%YaL)a+S;M3w^#f znZMXx+2lqpwrOMdqfU5P=asMn%W}SV9JNJ|o4%n{+O~F*I18X%BDRkXo6MSP>u=8P zD`o1mg2#x0|6L3%|L=B$Djz{}Dz|Ohhm{oFQB{sig+!m89OWTu9@OKW41Ah`%B0Nb zmaY(}>V2+R=pf@1|0!1@pfXN-jfIVkZOH}DntYZhp2kC=J^#qvT@|te6(@CQ3mJIF zvXtm@cei#sIjpWubg1l+=TLT>3d{D;eJg1Ng%DtIWiK1+QK8?7?#a;}0zvDia0Y|y z-`6l6Ub8-W`aq%6;f99p(;nPRNb2B~7By(IMLanaD)w-g<@sR5BvrxaXtMR+YkJTo zxQP}{%rGjm=sPFOASzwj<82zpagm}NA)mhL$G~5Wv3AYSFG{!V3%K~$){n6x>TO5o z_`nfdQoeqYJ3r#$=u1pqIZwC8>QBd5O1xSeKRvf`iQ9;je_@3_`&o<1cy7U*bNS%M zo3vl&ypAEo^I%i{lwzrlAT*(w^j6yYpWS!e`+8lokXwZ8jJ4QH654FZpv5bi&_^dY zbYO_pnIJ9&K%eVmg`KI;h0XkI?b2T7k;KNWUT7A7U%{$V*;Kv1q}g31L4{ATI9O6B z8(k4PQv_V$2@n*tQ-3$r^R&5e(b?czyRP%DH;Z=3cRuTdrz7Rtc>o>&VISR>VV+Tm zk&07qSe~J_pSHKU{8wxFujbN^^l%dSjlaKq@y{6D#JLw_`88y!fBl}tdPqWTAtm3aA-KR}Z zBVlDl%J+o=%gY}qc`oNNZb{w9)-26u)h>CpKuJQj=5YqQeyjh+xbI7}Y65`6l)OSJ zZh5HgYf)>5w%qzlZ1l<-`{+_=GLxP{i2MirC|X8LWf(h4Tn=r_5>Fi5562hz6fS~@ zW4Bw$F`+xw&g!$SCHx>K5x^Occ%J=f-;YwwTs7btCS8@__i9hoOGb4+AD1B-3r`+7 z7Zc2e$(&g{1f#+jmAw##wkiXL!NVauTCM@mq~0sbH>>10m(J+H^m?%WkW}EJ?H+;- zF~cZYPBCfdEA=Vmwv7Z~^2b ztgKsFG9Q(W+N2s6%JiM>8ychmOY&^?9ti>AU7u6d?lLz?WsVb5cc@sk^r!>kNRG_p zf8cs8mJE#!mIeu)MfBPqa>J`X(0HI;?QP6z-qc##-|b^ktS*H_Q#pw}z8rwO!XC)z ztry#H`-Shwuxb~4{t|RN$bI6GC(a3ce4*D}#X`GR&rgwgF=~69A=dWnqm67C|i!n=lWn4syL4vXfa=V>-8;exyUCH=_M+li$Rs+dYC!%{#8Uv|)$-0ErOicl_ zjMOB0cnz6WFxhE1zlM8xbg6t_h^O_H#5R1p&}}?NsyGr!eb;tKut2bvMmYH)+?AllQDQ=c3LdTyVeZj+5Ku6h`_5$IRR;tRXVgEdV}H8tO(8;745A~NaB)0|c|1^n z$lF=7RMn-;MHMO$l0CM_$K({o!4*ZujKvit7XcTkU%8~A_eTuPjdd$QZ}oNo!X zLf&bvEri7t{e2e@M#E{=OxGe)_B$hSJPAmNdXv&`55-D-t zy5G3;kx692%o#$Bz8{%Cwi62aboRw0aK)Hurd!j3BnQjutW8b_jf&WfxBNs1oTu_4 z)QA;HJZZIPrqHz6DS2#t(v_6DNQz92^R*MS=g0pz{Z9wg4T%rYg3>Lsl4v2gZz-&G zw?`bq=fCxYA|t7r!h!6t`;z0vWy8Uu2$cK83`w67u2+rV3RU-&iVD2w-f$g<b>eFKrjhFSz4Ddl^=i_?N# zt!p44CtO#XeyO;#kt_p z6t(=peHUaZZouKJ5(}c<9{*PepZfu6R&UFX_vy4+nV^L6ii7Sq4(KH zjbABIrnadMxR5&wg>s95L#F1I!!UhBXrq`M8Ja_T(}9urdP(M2;|mChn}zg~N>QTJ=F zv{)L4>%BOj;}2 z%;A9_20il6oD(StRO0}JO%JkivcnVIaatX1q71_wmmevmz# zA7pea9#Tn}r*0n|1`2L;;MQ8PWiJNuFW)fVsM;Pz0cI$^^4Z31D(n zc;J+d`UD12Af#i3TG7QXIq{$ez;cc;kaWq`o$I7T+d|%i+vAr^w?N25!Gu%BPU-Vr zo#_4@wWsQdMx28pkUoT-vW4>>Ahmlevrj(SUX!aM$X4K1IHodas6JR#WVt4Y>1-_# zK_spd6_)u0j0vkM!_SLOyU(biVwzdAl|Z5I(#{Y)h?34X<)oh=q;KQDVK?U#NNfJN z(`I;;v1}cB*99(m(H@hCLRC^pX_V>iGxEDhqMExhf4Q&YSdW^5;~DtM(2m2~YqEK* zwVXmgM#aS4b@kgXTrV}b@t52F+d_QEj>wZ5s>lZ0{{3RYl7SS%TW1q8_gMiiHXYR} z_3=p295h^ZmXeO2B6+>4|LuKe3E<0yLnYap3j-COFM)ECx8}DB{k%Ylp^_ReChD*_ zR{~>?h8RchUYQkwm$-N`LrO3q$I62`EnQ2fiaU%LLNT%?YPdkNP=4Q(u7ahR%~_Na zZiVuYJAE<)-;-Oo&E;}sU9IKm9A?ICe%?RUwIWVC9N$@Fl56GnnHk@y<1p84^nb2CjlMJ^a zAmlst(v$J+LML>V0PDBza4z@X&&r{?v+-a2MKg}7y#{|bQ`3d(4dNzk` z;-!3tej0ry%1yVwGSU_D z94&9^<@d$dOvscr2p$%;3p|73lQ)`WJDrU&1(CJG+swe%(0({^!EtwrD$8bZaH}cN zHAvtxT%Whh>+CAF28AmObsa}!dQ;_ew}mv1z!Sg0j12CEPD>PIuFU1uNr`*ud|lpD zgQ&U;V-m`nGe99$=x`yCR5*{XmK<4L%?2)_>X=^9r>5y^iQ$wdORHE(Rrp~v05^(S|mQ;!g>TyUN!>rO6knVh(3#-e_@JgNmDF}k*KC}j#Ia*G;|;h*XHHS+ zTDjcXi)$j`-MGa+o1{qJM;yC9E*X>et5s91`eaRK_Y4$`<+mQqG7hE8m)JDYZhO_V z`Jqjw-zl=mI}RI+CXW^*YOgfnCQ^RM@x`jO?kDIzkJ`KHtqe(v0^q~b1U3`;MM|L1 z*gLK3a{Ehw=nQ4nVh7WE7bYEbO1#rgJl(|lX1kuz%u^r8{tN>#xGz98wMZ$=3NiR| zJbzY3K4EN8f%_#G0(ZhBO$Z=H64YI)0VYUY=N8^yP^_5P(i}GMV2p9%X1{_M_UU(;%Y+i_oUa#X zAng-q=9XtMMXU++@~x+SrS{F>M;9X0?6xBfP0coaKU|d>MehW5Bw3G~2;utS_84C= z7>YvZXOO^icI!xVBsJ`-zWdZMfk(rxKOBmN+P@$16V!^;BjQ#X*o;2J#+uRq3z|XR zbqhP}Uv}6YfqjE`kQ`5jFgd4NcY0O4uY0>Y_1HkuV+EN=af0OHWXi9#eX*Lk(qsh! znJCU;YY~trDQgRmAdKa4lD>oNXE@KR!1IcW%;VWz559x;YfjZ_%U~1o+v+heKw-HL z16b+aHAz$G$~z-DjWvw6&D`V{{Lj-tg{h&c7PyK%nUi&8w{6;YQvSM9 z-m2qXKDE{`{lsY3Z%T#!{ZIXs;P{X>CuqRlmf6r5uN|$$X{`Qyl8h4H5MdYlC4hQJ z7T0#`Wf{7~(?%Y7i-quP(It-u(R$2T<(qR+5~PrC7!2U+u#tKD{f63p98?GHz0Y&v z-ctl}jWB+Fh=sCsYmUsfNeKweZT@WK{_ z_GxXkjtphPp(jCAM&KBkj2_O+UnM5n@Nxib&f}QNdVOkH$Vjf#M|6X?V9N5Zy9BH% zbPJT+jtwB;8|Belf8LsXOv2Ci#ScwI@gq@>Ix(QO92cq%s)~cCN8~l!;+j$4Kf%`< zjo0BXmCg?d+I5Tp>U7pii5AV`=3<$it8qib@LJje*|2Njr^`B*k-m)eHkdpKD>S^W z$=T8#4xz=(npS4rD)e$e7Qid_mZ%~L6KA?Q$C&qnudnYk+0YLP4r%)CVer->&cI%J zZP}~E0N0DUl za_Yc2)JC<)5hd#MPx=AEe`P5`Dx|^EPkL2;ec*0Y%t8BAeV~#;hiR~??$t*Oxq#qv z=sZEE^lau+!1}sX>D!df;QR&%ZzNb39DgWs+$uf8g<+KJfSCppP2DV)fWIr8d6)L! z)L-wrZI=1z+F%tiCwnP|l)zQ=pW!`x24FL7OW4;W_ED+dQ_{RMfBi7VV7n`zANQXr zfHYzlrE+}O-R<`mM6>|Wff3x@XWR~`% zDbPo!{?byvk_QBK&~)<#O}~f6F>*9m)C;cOaq;Ie8U7rdtHn6+;{#cTD;*k#{$BhW zhi06UX21m8FiSv`_E@WMD+|aJO94_+gIZJAcfIdoV`Gc0lOLy_B&VPl@W5Y3gX=)z zb$5RFqtqND5pDj9o(J8$Cy8IENAp<|o)P5^Tg|TX1n^;SZ_|6J=Je(~PulC!uYwph z7~xeWn9Zw7&jw_oJ-c1rzgYj(nt8MIv-4*%1E@W*9w~{M-w0Z@?uz1!6mjncVC;>M z53QwcoNRPCtJ~wyhfAdlw*SKK{tKoTDhVGW;K1v!&>VNy4hT_G?AxHyJ2cT&r1%NZ z?cN=FR2%2bk>fwp<`AHzqLeIn}`v9fY>@t7Q7LtquYNBZRLro~3KOY^MY%Es% z&*YK2G%*?C>BA^POyBlbekPb6y+6C;m453~V@!$tU-lHBvRN5te8O%&rgie4JNZ9y zd1s*!@#?4X8yM`*-+z^nf$YU6=7QJ`rs|4KdoPr0!-jVEjsE2rOtjgA zg7qJMhd7Cz=sbnyhYUDg1!?A|{xCi_q<}j!4I+z;xnQ<1WoY4}rBUy~KuJm7tr&%f zlD>517QPZw)5W2ZLRQ)eH4zt=h_<&2B6x%tsT}^^u}F3tWp?ECLHVb-HHSW}x<%J7 zBw8$Ymy4g|-*EF}sd?VuO$Z-pa!nS4f%o(CZQ?h1{N>30b- zX~X_>eRwF9aStYb4nAC&FKZ{1lGYvdhls=>AN- z9w$Wb zU+U3GW3cHa$G{1u-ir7X|M%qm^B_LWMTVUuyX5@qeyQGC2m#&GA?x{fA@6n{?OE+l z8|Fq)st6r=DKbw+Mv#!1RBc|bqEAGrt#J@e`8F*|fdC^3h&*s}b#RE?LoWnzJs^MbRJBJIzAAj|d zkU?rppGwOtpMsqHbEWVf!!@*hC{Tf8iYuc?frEFOWYC_9|HmiK$9`uKpPxSZQ$jzu z7*5y)gUF1t2qn^9?mO$>EVHbmxEYj)$Q}geVgF%GnqI*9J;f;p=0I$q#F(Fd;&q|) zNrsmv;m~;glRf#b4T#(VukdMHK*mEiM4Kn+Uce%!+4SRruO|pk{%SAHZ44-WCKWya z*>Yp(4pV{YHS8)%2PxC~!`%K?o}}F=hkBp~^x9|?QW5Ay<+fkD8bx8Go2OS@Y|z=o zcfwF-V|J(=`gw<|;R&a=A{Mp=^33n9I5W$omb z(D1l?5Wf0rUKaPnpgRGr5juP7bbRDGS{Ni5@Y)IFo^LERP{oppdS3`JK9UK#G&FF# z@uEID7-OqmsieqZ+t3x)Ar;)XH3T(%^s$FD-e>70T@2`j_d2)X$)@43C-;3ub zT7zpV23_j6gPhJe8v)n6@$TBQkmbZN5Dgps)f#<{1Fxf+m{C?}x9BYW86Ep61`suK z+L(Rd1SLPtMx`S@Vf}3<{$v@$(M1;>8exJ+1GEa($xALfB0N*UjDl04W17$pKhh|M zEed@uBlgqADoRR|TP)YF=N-PJ)1&oF_u@7lG&<*@K$Ix7+aKE-$!YSKO2_K{q@|Tx z92*~g_nAd@J6|s2uJ2!7?|!SM-hcMg^*F_LSqPo=;z{ltGOc=K=^a&5oq<}{erWeHzM*o{c8qG0s$ZPyxE4aqa|5wFf4V_( z004X%*N`FV23m;TTU(l@gYVmg{e79$?o59;ljA9*;Fbs3eJBfggRW|!JQ2OhzsT8P z({GNP6ab#40^nz9fPV4mlAfl_N2kWr8ekP+Jb zupsvE$jfs>oMnC0j)?o$mcQ+@ueT}2wnvqY zEoIEjrJguSGgVa%n+m>rEoCZPw|Zwp&}}8A(y60n@|oA%tfVksddpcUy5pT1%BV}> z_P~`88z`_gG}XQ_c=4j|56L7d9lOhbxIXGx@KeK?EsPz>Y^EU?@g#>fQHOj|v2bY@ zG6d2Mz%AII|K%TgghYghqWD4|DXh!amp@J~J;t4QW9>bqdM|ct`Q)reY;^3eqcNI; zmMOs#B!UaR>{8*&YF`Yt7StQwh^&4&zH6@@Pbh6AH+Jyr5z3oF<+`jbDdKb2-F!R+ z!DySobX41ifu8jDx6g1~Z6?Qddv%VK$u%X!@U`^*LWSjIp!fg@8i2u&;?LbIT`hjQKP@(t}GHO{|-6oN}mac{I; zt4?=utjDIm!7E0Ts9_969GK44>w*P^RYm7 zp^(oOsM=Co4;o#wTxvGDq-OK#tJM#42*@DcNIE-g*`A)Wx%q=;?9NqFR>6eafhkBD z{Bu~J;?9yG4er{WD#fZhCwIV5lYe~pcsBM8&+{t+$92aiPLvanUC}dJl53Og)|X~0 zq$)fqG3`wJn0~4=u}`K?*H$JR>l09=>nvoG;g`1~XQ~AhCTA}p@2q^vO;%Rb=3=El znPYnqSl*hiuJ-mi-birik(ea!v#S#r3 zg-Y>R;CfzCD0Re&-!G7S(o6eRsCsBgdvx?TSHM$G#rQ<+=T~D7@*~WXR0zl}xgM-; z94^yo3by#r7=;dP=k}Nq{QF+|dqQT!u(7?kH|ESvAwItmgSNoOd+V{sMZRX+SarY* z|6!?YqExvWR=yCW6yq$P(tmFk7)b8R3GIs6GqdqniD_^zCzGZ3V0+oU1IFl;7ZMFO zRGpvg{R}5b+tTyp{w&ebr|l@Sm+HEgx)E9FT1Rb|74kU6Lkz=$V7bRLBiuTCVrT-f zz4QVu;NG^3bDX<`+!<(h(J-pk`USkai`~7NH5CT~6GlD_#t8x)Qs>3*x~%%QbOGm> zO7X0*siWiG4}wNzk=HaPWkTBF;p)uYi#xrg)Y{EtV|6}#z!gdS?&Al(`}zA>wu>!7?^ z*uz2g^BS~)zMb7~qzl)vTlFp=LIw0?h3E*sP;!_Yf7yN4)hUgSj=*tgcc9X?eoSA% z>f;Q-e?Q~D=f%ej^sH(4P=VqcHXdtDrPGNa zA4OM2ta*0RWyvlVv`BWRM46}@m`Gw>HsQ2g8s6w$cX<^2;> zxWWmd87*ve?4}vpNm&au{cjfTuYsIWM{i0iZN?L18V!^jl+6L*y8DA%-Oy5_VV&vH zw+~%a$)Gx4WH9j}Gy9!NYt#)X%)6W1{Sg&%XLUe7Y4;>$(&~iGJ(}Da7tKBMLC@~) z-Ef^q6?IhdMugx|6~lI=W%IJXLutR!`n&JB4>1mm?7R+6J*%5p&*{D-VQ3p4eB3S5 zUAFk8B)K%VY-w*}zGCSCP4%n{s=~O$_^Tj3nMPd(<|m!f{5`UI-0kE{*r+Tu!xpH% zXra(iU>IUqJcs}d+*lo_`wmCmR2C~gs(5|#M5LA&-8#;ygaLB+ul4%Rf9UlSpQ^yB ztDBCI3O`ya*jRZIl-&Q#cH(re+^4iKqI*b)<)cLceaP_It zFK)QgcKcGOUThjtvL-?(k&|HD8c01XJRfbW%im%gk3L#`ojRrwJC9Y*pmL_xlhoC$ zvFImpHqj+9Ts*RO{ioUg>!tOdWBv4y@Kg(y=+0+puM36xNgqjDr3$CpSh!Vmh)Wrs z2b_K@S#z{GyP2!WA8#~l!r%=**xHoIg2!qkhy^2C$L#(WZ*{RiMVW|gZ0SQ`u#7=s~UWg z5OHdaWX^CMk8F>bfezFA@CY}=;aO}C?jnM)>d0oU%3Q@TU2dPq;JQ068eLqLLX5a6 z+sK7^TxuF{_L3=Rl6LXQPM{hMC^5d$C(R9BwOF>)N{O6d{mFyzM}!-aFfL&S&$KM8 zI>g*58GwcVIb%oyLPCTUlJN^Y{O6ve!zqm8I&~I?CDL`~(AWn{)D=GrB8Y!J3d_A5 z?56e;Lb{WPQ{!#jR+t|pihfi-Q!D3vtoRFD&oFQII39NqD&$OdeA_upyAS>LMf9~1 zTg(p`0E~mVOn++zhj4ksA@i~)Pd_!EVOwQUTUs%JW?|7w41q1dX(sJbz|`sP-I3Cp#HF0@6nH)&l`=r;norLdL8o< zJ6^-&alG)%dkw3#KrV9y(^q{Wql8^l7p-bq4l`YU`wt7R3JYK3;h9tkkD4WH#W+F8 zm*|DRCrSK&*|I;PL8_IRJ&NQr)`-0AC>zP8FB@5-Ct@lg6RrC!IjoB>Q6l+vqGWPF zpRRDg`P&KU4tpB+u;Ozcu3_E?NL@UiXIPI!NGLyW%+_r*O42R*E7YuKaalYabgtVe zdPu@t#7u-JdZ1E;abeEKpzjOo?ije(SGbE$c1r@G#G9z;1Jr%M!dPE>n!8>OZ zYcRWjWiEPqrGA#tzN8*~p8#z`R7t;4;k#iutayejW(JJ=B9G#{4Yt?)a2eU{QCHVN zi}luSg3`nA5~~Acp5b7Viix(OPKWtqBK|03_ z`%~xT#XMK3rCkdGvYhg{j1AB{CvV>h339rc{qa|%jPNuR&bo7$Vq8KTdw#!aE7}N2cv#&4VlWJ8A!T?54(kvgPa$h_*WRm=2SsIf&vNTMa5C~ zrteGpr^TXrL@*2!IS;;;hUo`Bh#eu^NiAO2Ig94ah_`RL{4(j)IYw@l3h2yEr8`=A ziGoI1IaMul@$Su=IX^&};_a6}TFs|uZG%u1D0FIgrn^uKg5aFAE<59>!~pIGKpw7b zG}@r;1VqGLsx^B(8zrSxEZ!oSiWSR!bJGgKm^KCO4TRgRycogW-r3(e?zRz3E6u9a z?1#JUuCgG=^f>5}6d$h^E+J?&%`1L;y;Do-5)4Hau?)92_Z{HD%O^51d?}WD3Fs3Q zxmR@K66Qbc1g@A5LM!g1NxDaC;odX&R9eB;q~CXhn(*VG)svLU;j8_(sy4GtWuTQ- zOVKz$6c8u*NPb%rhlU$EA>1QY-6``IcrBjZ_D|Ht_OcnvMV-gTbYa`66Um7R5hMc|f*f+k)34iTbm{CTLuTJU3A~?gz79GaZ$@|9 zY$^8{F53NYZ+PAW;&SSI&{m##cy9D?$u@P_X__BZ*vg$b$o{N3)Cy#MsA{0VdAMjU zBa^a`fYwTWub%EG_@`sUvv>D}k5+@ab6qwwIf1|U%Js8Re6Hgsb!XV0i~~)O)T(_w z&1f(%Etkz*%5VGxd=RlYAg*NvGF>TZgG|r)KQqqh8W;EYRp#S;Pfv}BOc)6P-l(b~ z5b8>OKd|~$&V?P#0^>a|%fA?^qW&ywBiqzD^Zn{d?(tqO3b=zZU)R&eOhI6tvqaT? z(UJM{D6wHyzC`Sj>eJ?9=_u~(yra!rSM6`TXo0#xAcFDdZZLZ55Gm~HG6?d94~?2G zwjTh+N1;JW#pq^EU2aSt#!Kg}SlsPY z7iZ0|!6{W!*Go4|CTo`@jucHN-8X+e9NmxGp`AvnwK;6DHrl(@G*j8n#|m`l9JEDU zSA7Qk`prMJv|6w|S$A6sV)sEFJoSUcgP^`E?O7VJ(;|n=x}#zr%jGT&v$dg_mwGk} zj@BxidJE)7Im?@(cobOWxX|HvbIMKC<2KLTfQx!eYtx7aLEFvPAwTz2tJlJQI-s<3 z842X6?a$4B(HGtyxHNx#-De1-$@Z;knyl8oGP0Faw>$mfXmIu?UKd7FKxG_^%a8I@ zGhlLXd{REeT^KR!!z#n7`*au&E!^2XNb?wbdF4vzAg7#u(y<4$`{`}r1VBqAsm$tu zZGS?P-t^M&or%{R8SA%Kh83~mFTOwOZxrhFMIc8F;}uBu!u!@Vw*x?duW}VS{;Nau zFDO~};!;ZyBgC{jkD#zS+Z?tar_0fLEYBS7#OlH`Ky*MP^7CA^Ju3CF+aYwP7*3Y1 zXRe=F@g?_Mw(mun*OZyYM9Uwvah&&?e})zBRBg9Kcz&{UpXSWxS0!P6kM)FOSeCzb z`0oEw$L=XkD`ne0Sz1snFdrAPU2HI!oZ;uv%t4xAxO($h1_4=uQD_T?BDFnJCc8hz zsL}_VAc(266!j6Ird5r|ec;8?y#M8gGcOjci2D)>gdQ6_?K1l&1ITn5mxc}aFGq0bt89O5Ayn>jAV!3? zm$k4~DD5_TR(@7gki!FL>p6p$CTtRyas^U^)Be!dk_C%P=r%Jh@#d*<@@opFcfKo{ zZVy2y>vy2Qii5kkQFoG!+&#L$mCkvi^QVQNTZbau_jxmEOeU%0H%ugK{TOQ;x;|J> zL_9(8=GKpi-#(GuQak&eR$gxPixY3$h;v-!x6%emO>*mPN~AAHJurDtO}W{eYO|FC z7G_g(!ROaPQTMUE&WkNGg&DJr{R$F*`1P@k$Uur+8^qdK8LUoq@s7-`(Dm74q=zWbGp)lOQ^fo z6`oOvF}gfoj>E0cMjxLo8(sFw!sy|_D>d(JG9I{`1cc?O!Ew0<-^5EdfWPQ7yTA`?Z(C2jk>4WXCnf+sA$~ zk@I~m`o8*O0NP|ocOxrLbd`f!I#4G03GO2LHgEV?=_=Zc9m-yT zd9P=D(tG9Hj~nkQ*vVQ`5SFhcdla?Y&G?RwS@BX?ZZl9qB@2v9?N^K)nuMg5ULc$* z;N29R8ro>2wbeSbGXFrZbv{7tqS2OWE%+ z1|O#`V@sVcjxXdhCQ3Z7#!8U>q;UBB`=wb$x(?R9uH5i!Q!%Y&9}8qPfT8NDRnok1 zg7Vm27J8K~L3eZ_u|y|bK|GZvAGKjyy&j!mgrXAKlu2pPpJ8$9aOO=*6MlH}f>N#} zWF}r*gqyZOqAP!Ql~H*2>rV$=975ksr+5hZz{ZbA8`3I;_n==#(|?}A^knZ z@axp=-vE_bDn8lT8}S}2i>#V4O+Mh2$#j~Ev#Vs$B@vot@Nl?U4u~a%y^jUf4- zsdt*?3(jPuG=+@K*oS6mq$ND(kWDR=$}#!(tppJYKP7%#Ug{CV>g+yz9OPZ#+6KgB z1%9k!o2^M`#zCq+JhF1KT@0>d96j32=?I7>N2Zwu4?8Q4E}keaH}&NuhcspmC0xSI(<$44Dep~CH0E0=^4^Qxev_6Hj=N`X>OH4*F*NGB zEh*OLV)%mWjQQ6bZN7@y4@XbNmybFVC52AQNRBcoPj9A^Iv2*Yg?F8x{|TF$9e?$KwhQSL zRvlXNK|F@>`J>Qw$}wOau>Gpwv;eQ`jsAn@!OiIO0KE74%)GgTj&a|g-x8JQ) z=(;vZ1|29bHvF(Y^)P%E=;(4z6t(a*8?I`TyooidBiih4SpEF!oPWV4gHsOpr5V+r zz*WhtX!6FXLxezidX6C9NU>-g!lNu%I%sTb_^7s)8uR$=OhI)QOZ5}8<4{G}bbXdU zbm@K?!G-3%1Qvyy{cBCn@H>z8s)?tnxCadqVJG*eCJ5L9Bhb4B>Z%bocClkInu=|? z?-v%C^p!%x#A8FZeXHMK0%6YY;k10FpLDMY7t}^$95ka9n<^~EE#r+BHNV&Fd#$3r z&2+LEx$ zkmcDRJzgQ*Y^l1$HtS-KN)PoUn+-5^deZD3sWWfxjsekeZ~L8LawSF-VGpoi`a}d$ z4~Y-3>iEoCS=n`}oA)Lf7lXOmOi`uuGLB{re8*i<-OP|Ts{S4GPRU2Rcbq+i83A@f z)}WvCsO#C=?kaoU2$nSq-iZ>LA=6LQN@fk#eW|)*)~bUBRhwO2w2hm|O%JEfAk|&~ zRU2k>_4aR|dpeW}wbs*@G!?GNx>(-*vWo_Ig>DNR)^J+3ec0&sXS?4%Z9Urpz1liX%cT#To7JdU?@Ie64SLBGL7Rw<0vQj$Bn!5`i(_zv;Du~7YU zbkZLo%727+#V!xMPm-}o9)2HU1?(2169s>JNOArhwinVrf>1G4MvCKk`~AW-_PhD{ zYsi%TTlUccg^#|?C^S581zF_tO>ZpdRW?t9Zb1`hz!jLhjE!(eCe2(7%pxs|kf^5Fmf z7vx!UE+Lsg6io3@+KBHTesGEw4H)P7xURbjyu0;cRQ5i`l_Hx#=Qw+w zG#wSZS_@v}JB<;^{uDY!A3y&(XSyt(dTA2tD?_h#0L?1XfQtE+TAq(Zi5%N z1288!<0#;XMcRc{r_UkP_}D&T0!+Xht-_7xzkPvS6`#yUS`~F21XNnzl5 zi1p~Jgat+u;)Wapglo@)E6tJ^acXX<^A5%dImHVrb-C}EAdebWygrpa=5fWLfAwql zgfdqvFkpMBe9Z{QxOeIm_4*;y`c*qXCC%(Xa3d#A)M5Qv z6gdaJ%B3H*hxjL{CL>N;c5B;?y`>a7*78HtU8;~a7?8%p_8Q-%%S*+$-pEXJx^BD; zL^LKdbMK!K*x8Y^kxhj7R=GsHYWfI@pICu5wn z^Cf8edTX}e>+I-8m`LZiwI#zdhJ{Wh)^sC?yE%FY~=5_%?YBV~_(v zx8B$*Y_AY|#Tkf`Z#vH@#y)`5w*w7%#pq99bbo+$1No*x6}z6Z45}u~)9N1SLM$W; z0^piw%4V~<(DC=)=yr8D8b2E?xPu9L#Bvvc+MkVA>8=sz>!7b{1G?p}ib z{~2DX!4f@Z;LpSkyg`q@#x${m{$Og1!;8J3<*QDG z_S$n>&NUnno>411KH5Lo!qIkz-g)h9EP$Y|F>cQ^KxV&lX;=wBh0%XQK=T*c{)K-Q zwQ>(70UP^mXTU)3q0wckMOYmkS|GFsUVIbg6QBBk*L~v`PYo}Ck2WZ%EPDW;ms7|w zI#k}9VsllW^go9NV7oJQ59h4VP(1*)1x@Qe{n;qD(bTej7l?1iUD`CRT>XLqd`JeM zdtD9l1`7Ym)pm&J6mMb|)syfi0ULHQOkBCadbI7R`pt72G24}l&HxmneNheN6ahQ5 z&nix(9cltkB6lSJ7R8gR_7DZS!VS(kn;EKM>X~S=NPcY~9GnGAmSro%SKrssYe4v* zURY`O=Z_ZMBMZJ?@1OWtD!3Mzn=`$$9R$4rf9JEKd%dM8z{lB#>PouL#9gI>f~*z@ zr1v!lJ!b`&F_tOgpwxB0lzcHKbs01R(3M9rP~0=r%~QP^kPy(iVfy_7cfN2v)ZFM8 z;n8A;%oLWnZb%8X#tPT;FJICR z_gEgkB?}jG;khkdv+goLz%#jhtOcjsM6Fo{Rpjhfsui{@NixX8BWK61+kIsS=hWG4 zR#n-a8)bxsS6BKa)s&ipDK_QN0PevwzCa6T(D>(8UOaQ2GtqpJ8jA{f{=IOP#s6XN zE#s={-mPJflvYXsWnHt!BHi5~Dj|pzm!-@U=lr;Rq@uJj2FD8EO5ez3O(KG&y3NF zZvdrf>G%#l35#m@709s;a!XN(9~K4RqLPq-uXb;B?f`(;EWtL5`;$LOUP@#pQQP%t?q$tOFPz}qplSAvN~Q)Hq1uFiC^7G*nt<>%7vG>u;r2f zsZmOm3fcv680A&b8PP~lOwVaVxkt_6KVDVZUF`>_S!RJW)=hT=1&*`pBB?(c(k|Ie z(s1XZ#1V4ym|8eHy0i^H_mRi!10ZIEPy?fP zJoW&mcI$pF0&iD6yMxCTF+9szZ~A~jzL#X^>`j_!v#5l(>8gA>bW`*8Um~$sz<;X* zn8#rMv;H#bz8TirojbgqOWo89n2>wq6s*3RiJk^F`LdXdM?p0#&dW7LYImb0-CZXD z$guum>eaRF&$^e8cD8vBsGID$bk;B`46EO`vxEXBxQZGrId2wxXXCow5_t9UtQtS4 zBkC?+Juu(@!ESCkn)cyU#vEUyO7pI?=5(`%LT9ac{3e}fK;V1}M>zg_H#{~A>zn`j zUJ#NNnS8v^j7ci)wiLBZ+ygctbv(I51RF6&Lw|Q<(eJ{NZ-|p`OimgSMCv zd46GvS4#f9diP>?l7(O&E2<-Arkh^%amu%Jh@{wVJR2t8G9ZUWb zYp6&0Cm$F#wVdH~lvFl^mA?L0BPKl+!H4Ovub3`pG%?#g7v4BOg(nY+IVsJ%tu1Hi zH(Oe+YQ>-%v3)#ZB$qp;;iV3X)RVvRNKIk_h-H(avm~+|O|Q=eiJ5gy%#_|VKg1S$ z&toT}DC&vZWMzxJ5l)GY+4x2vW%}A_s#(Y-;Sg?oFE%9J!bVTP%s71NO_|o*= z5k`A%CoH*y*UsB_M+(xo4Ww;B;0<5DMy)Yl3oSGM=J_e~&B%LP13v~HcIlZ6a|+8X zSqDZ@n^zHpV zwC4%XEJ@}c`LTf@$5X^VrzAaa>2TUl;|tQPrdecmK6vN55}xak{8q1hXyerKqZ`fE z)2TZYk1wg5E>p%#j5|ZlPBMf(2(`Wy_)ryQCU zz>y&&V;WR$Nslt6`U{iRfx$Qv>$&l>p68ihn}k#T&qzIssP%)*+S(@C5zGVWsZsgn zmNQy~q;8q0L;JH+o>U!BNT}ca+QOc!rLC7NdhjFIOS9@LYaylC)6alK8@>xZ$&~9p zG#}{xB>-vD~Qy7$!)w(_f3N3Dl$eQBt40@32-SN=KG0wRKTjEc^nHfyIR0_M}KkOD*eArSk7jsEOkYMaFt#aC2 zVAPQzjRkiaW(EZRw4OZg!*oSgZED%l5L#TpjV)-b0FM2Npq!W~6+ho0bo5a)(MYGBRk{k@%{~u88n^zGciefkx-_ z%)MiRr_EA6y}RO+QR@p&|LrL@T(C;J7k&&!X`Lb7*mBbl0jU7mi0WdaMa59(E%sPV zqc*|gfh_{<#t{K^+n4HzKTd5obxMY}tX_{Jpq9w1Fr<3h8_AKu_sc&n;$j8~w^>N7 zdj;eNWtJdur1ihr%?G@;KC`;E4L^eTos9GEKBXxN;IS@pwZuW5?NqXCjeRw?N3Og` zb21oDaZ|HLi;q!@`jQ6}8re%4!~AV?GwSsn#59QyFl~M3DpQp*&c4+c&ZS@gwbboR z9P-7FEoT5yAO>Wu_AChczd;qoB=KEgp3Xk87ET4SzHcouOr>KHjX~W z-$rVVmv0@8^){=h$ONWw+p`!=1yo@Zl#KN=T8bf{Ml#U(Rx2URYKMkab^h|z;k1f0 zLBF%mTAh(2dlbtDuoyJ$$!wbPqQ`ntfjqvS>0s?s^HD6g>8u1?OKYSO2x*4?ubUt72 z2i{{R0z9VJh41l^{Ah9fy^ov(j)fK|ZZ7M_rIk7ZWv00q=qRxEUUA51{+D^2#Sv09 zVGFUYfs=*DD-2{&Ns32ElON;a>G zu5w&zSiLHMXTo~-)x;xz>4;ymapTz=mrl@ZBZ7r9Es&APG$lFbQqO#lAJz^#oz~C< zB&zc@Pb$3$a+Cs zgtc*ySEn}~bLAb~l-w(ps0bt1pW|kGw{A#coPHsqm=uv}&}4ske$0rRY9+UdMWq=( zFf3A?YpJx~DwB7E3Zs`S1cdTBoMDrDtCw6jsk2gnu=2_`Zw~tHp~hz~_RjI+dk$8Y zth`TT<`FXcvHk=Q#%d`$^6L8`WzC#cE>qWHH!gVVvla*;DJA*g^}Jh(gJ1$FoiF|$ z<=h7qu`2*UpkWmb86!-qq5=LmM4ER0hRQW;I&#I;!u2Q$OAX;#=uyg_`Z6Z5|X zfbxGX0^B9<{VishFH&S^=#f9RvjUWr;cKf`38ENybl+Nhj}1*37U8X484t3|uKK$C z2lcY3IYLVC(|r!7Iu#EQ)j#Jm3E4!8-s^ZGOY{De_mN`~eTdAm1CNAr&Xy6KW-W^A z+yD>afDDnRC)6uGPVY=fK3O=Oq=$)m-=~W~Y1q82QjYt1(PBN#tnk;dvvL%7u|Zwu zeey^HXmLM=c4}YHk^qSx{5MxNN#h4?cp5bqTaeNf8U4EZ@--Pg3&&lEq^{|j|+?SHB^B`Jn>)a~^(-C3{xW{OHkfU@z*KSLnRyc9lKJ^^(SN{q@I|CL!GbeD@`{#8`lPg53;aVC@RS|xu z*-mdq?hpORCMX&)tb7#b2h!+jLeqg-C>ur&@AggC7&+XZ*p7T+e~wK#Ly zn+@csy`fLXaDE}_x`}BYF%1Ks;oB7Dmk{)cjZv+y$3~IOa|`h_F2zV7d~;)wC+kMpQ5+N`j3+JeT2FkVt=8+J(X}Z z6Lb=pce`;;F5fXuWTh2Y8(kp3KwsxiucOOWjR{qP@|l}@W%R)B3Hj=`r{%LbmCLut zJD_T`01-;D`5VWskZ~1LyNj(E2YVF6n8Hy|dz}Kdf_yxCRo3G1SuUyx!as z=kZu77qVL@u?%Vzw*I;gqU8U%Y3Z%=&q?Ry{moQfkr4^c2Ls-g3XLW%pDAZc#FrGA zvrCPm^Crq75E0@3Ml23nUOAAfkrE-bw@p(8v&bDuyZeq+|u}Dd~H|*Ji)1wec^xfDoW`GLHWq-WceO6#>XBYzA4E4mv7C zOL@BKJGEZ!M6@F;H++}2Gvy6D+V@ZDdsMCi=8=TROv+mOF_yVVSM999_jqaPSg8GF zw?QRWx?n$=7{n(}J#GF;xJ@vy1T;D+1DPmX^E3$FS01ZNqxZzF_&fkjd2;pUuy{S5 zr~NDfT8TmIWe4PMjTl7WOG*QnyAE=Mvk>*2odITTIk%w1<@GuQAW$CZD|WF3HLe19 zYnx%ksUYxhYaPy8`J%m&-jOeOcN~D%r_Vu@t^HZDyB5y&JJ5IgVZFS~Ge>McvUcx0 z2qdh!my@p`XBu@vwllJ(zv2OGiA;GEzb4m?nmg=>tOjI$U|VX8qrx5(jtt98N*e>`w#JMgPWe^x3>baF}v@4*a?_| z4hsU&&La4PgU3|3P73&K=ZG%xdOPITAAb23Kq=gpP^JLglL8ZLeivSY>gL&ckjdVe z?8r^hayaRCTx#LbcxMvr-A|8xF7>iT-#WXvBTel?L`uLat`4$1LKw+;JjyRq%H${> z-8@uwego4iA{2du=)8;I>o;!F+b`FSQQC8?HW*+91mCk%E$5@9RW_irE4v?ZI=PUE zQ$K}pTh+fV=g#t44}7m>!G8?Sf6_>@?Vo;wd>i#|7XqB2Pdf#{QWW+V7NN_`TzqZ7`QMuZ&AQN+lRM@=e1 zJ@67-`@msf>r@@WUme~QX!it(JHzzZkUYpsNQ*TLd5%K4A(>t25R>WE(aynkbIIMITZ$TP&x^D z2{?BSAmUI_VC`%NiS$;T*~ZOvZ=0FD>SfQ|)t4XTc$8eAV_s8R?Lxmez>;PuEvZu2 zbkT4`Vz^!yzn}H?mVn)0ne+OO8>tAiBr9Fd6SP@1Ejb%AvS-n`D^4f!oBCfDDBm$u zNF?SY-E2jSo$Z&@Zp-l>jY8vso;_LGBN-Xq8-tj7$%&e5`Nh?sjp=;~Gbi71a7TG} zUaDiQO?u=Jq*^n4jU?G&#*9{HWM&nD;Qq7-f@|_kt)elny&a~SSEn8hQUW$R&&9ZkR=47fI)e#J*Nt9cCf6C-{fhnejf1@GlV<9ndgM;C~489V64W?TXa{ky@pZCT1oP zgp=9&{;)Dl~Oi^S-~bJ9(1$<$aa6Uq-iKo6@2C zYX41VJ6K}1Np9Hb{iBAe_s*BMPMITI&>3&SyL{!7Z!#1qmTrjO$&*sw*Z1nIJw|Zw zV|eeWXQa&Lg9YnAw?xWq-ouQWgM#1d*^h7yX}m@HTD0P-#vI2&?%m-z&N2hm4%nwU zaWd+JhI9Bqt2M_sz6uI6VV+)%L~D4C*6tZBaQdkB(0bGU$f;t{_+6?Vw>(>3A)Pvc zqYQjnh(IQ8wVf8A;&-tx?$%bCpQbxB@nk(rk;4q zPx5@e7t9=*tp!Alezmpy3QKjTL`{0K1n&L5;7KSm$LU9EZgh;MspXtj?VXEN?t#-> zYe097D3K0=DQmFku+M|ihctkPZ9B(ir-P@;KvodJ};j4tJk zz$j&!e%S@~pRach=UNFJRabR_BlhNs@UE6i00L^$S=0+TI6?ShCz6&pAr-Td>EZ!& zVyT*Q0)bOHl^L|15RU&Cn1BK+jbV~RuYqw<;_r}!{i>nU9vt41d~$~0jqA` zL^+meeP1qdMi_FnY|x=+(htu(SC5DS$CpU1&xKXmr6%flW6)+YtFE%wAL0m%nwffQ(882?;@S%93}Z*hBdzoxN~i;Poh#WAK%5sGU!>R4Pa=q?;rv7P*ns=P9s?9H!X&~wCld34Re=po_m#lAS!CXoIbh+vru7ji7 zu^Gvd_F?V~&|^HT+)E6{zVw=(|FOA2n9qvNk}+8#rla=Ajl*7I$d zvlwvq>ZP}m?U8g+pkf&~9)FpHCSwlai3*t`8nOpz$}`FaWKM6HWbDip9%&XiymJ^3 zr_O`XEGbSsNqU8&=w?1BIzDiL()|$-k}kwo_p;Z+sHC<=6LW@hHZ>cr;P|nh)jm=@ zmf-q1*JTNu&+27MCFeoK>3z$cnH$p42pYIL>edg1 zW(N|?+P5lTfZ})2oaDTR@_@v470lNd*=88drzecYZ=nlObx?3P&wJ6@q_Sy$o_)1L z>WR|u{c_RR&Eq%!3oT@Jp^@CjYOB<S#`B9^I z#z}hY+SG4$sow$4&?U(zz2?O*HOn`0Wk%zha6l*~Dp?2`q{eqnyDz*(c4D)Q26`RC zAIXY)X>BKFEQvoM&0%4i87s1PM`QFYMok3@5|hlGnw{=kXq<`h4e`IMb$}eYv<`M;jN{Ue2~wN2 zJz3h!oZbbEih6f=Bxi=noFmJwSeU!YhupaY&SrJUKt+8W^@gk3#l@y@@1Tp z+%8UZDDWF4JsJ*8;5rMSVK6Sx5Ybd#Wv)o4B_PF249Qi!Hm16N1Ig#xHOWtsl(85k9zZ=(lZRUD)ShcJoLPW`K57C8rO}}(!7Wl}@+3)m2mQkyB z{3OyCGOoWzYs)t@?p1iN&2I9%N8r4G#``J;-*87cG$FZ}wj5>=N=F+l6BQCfEbv;y zg7LaLLnKr$#@)<7bKCB8}Ab)k>XH*(d@M&2-mRH$n{XyUB^%`EWG8Gan*aUDr} zrxxA!emAzvF>Jr`;$D+8{lK4onk8T=;EXIynvHiCqi@2_^6F`94ZlBC#KpOw3JDxV ziSeJ`zxB`xk8Q?`=F0G!+%`E5l2;Sr5d{IIzugrC1`=2_b0ULeRuuTk@4hyhidn;) z9hA)pXQz_hTj5&_IPW^Qd#sD3cV3XzEFkd`HbOe5F^)n2&)D9chGw$~{!|&?!$}VJM-GjKK1k?z zHNJSZdh(9Nt*B=A#y7g=fweE2n7z3rlk*G)v2o3!;2r$mj{~NnWIVLgu_T?w8_xT! zrS!IsK%re+#EZ1ys~s-UHl%`SLg~7(`P6@Q;!m@YESSWdZeMoY#`erGns^9Ef{u`r z+AsB99OeR|!kl%jN?mLmC*O5B%7<<2QOs}C+>*)cO!+KJ)}1_J_$YdkpxM`Wy@u zmN@^njzO^+DM?>-OhO|}?8=M&gWQR5J@|ITsY8Xo=A7i=C-VO<3gNs5W1pNih(bG9 z*M1eXOi_A?44dv3+1W_N;OOnBThYhR4kEoBV00N-!izYXT)=5fKuF4?jHslK+>se3 z7<+e%kwNBh{TM}8G3n_AsoNgogm4Ng8nd_AoDg)=%-353lPThY9of0#Xx+zO{(`p8JVO-Z>z{2@8R!w2 zexe$VRe_Y|L;>I&*GlFqgbnfDXFfB*c@e5z8dkr9ZOZ5lurW&E7JB?IuNLyMoniy- zgrNYESU_PUl(9DVa&*Bazs{EdKr$lGjJFXHzjoqwV4&MDvYmp6vc zjp2kd{^R0amY+@vu{ixpkm2mZ)CIMv@C=_QUal~kWwlN_n*_u7{X-wzG$EV zR`ob9i3WP)ezdX-&TpqdwU@)QiXAA81J`Ywmk2?NMY~X}AFdyd@I6j2KCx1J$&)On`q@fPYqif3|@Ct1UoV zFKqfhya4{$4*sbJ{;3E4DG2{52yvJ6|C|W^e{v$&JzN-i_*PT4r}6h$)JekEJVye3 z!G{BN@_NX*gi-O@{_K*9 zRQD8ji<$DFwe0EJ6}t@;@dK@_E_Sj0|C%?0`u9+j03z^Ve*5Yau1vIlOF?Qf!9PN} z?QUOw=`UFuko+Rg1BLMy=LH;rasTl}2V^wprV;m+aJIkZ0jZk7H=R$pbK~z{w5kIW z;$YYyhvF~MFlapAaWsKT zmPW4S{OzZ}-MPdFKG(mJSZMx!0|()fkloD??!OKRo$w8rH&-}G{ubFq^UtmMzr8iS zRpfti`6Bp?tRPUR5JCz2AdSfu5=u)ThW1h;cN>9rj^WP??QAPZ`zeKZK!c$Qmu%x| zH|A&Yc(fU@AqB!nDUbBQj*@O4wOp{-$Ie(aQylsbcMF?l-tb2U?XaVit z0>yj?9mRYSqKHBBQv^+R4@5#qh3p3V^h<1JEiRnXYd!P#NvcjZc^6NHGayAd)(S)` zN|@VOTN()vW7<<K zX>zC0tCq{tr{*nfj@T;6;9a#0j^H=3Q;6WnuMc8OWoQn)oDtRj{u)VV79rE$hK6^f z{^+D8-WZ613THc0*{d(m)7SwqciFO|k4xvkJ`Xkf^cF+L$JM>t)1vTNla4xOpUWLhuzkZ-RC(SmVpC1YB1;sotUt*}}g1G1MGj&h2!|IOE z-;29sE`O4RGy2*6uC&)64+}tD6|$$U#+9axyzI?Js8#&OxwQus?cWHxh1+S@UFLg+ z5`19#ISI0Aa%gKBtkk4)%K4h z6oK=D=OYcx2#*J9nBhw9#ycWQe*F^SlX^V{?2QfEDqZGF>a0(HiM{xhr29HziTmbq zd2Jdp@!wy2HdsrOgIXq}6A}eWOnGM`!sGH^8kBLSK#BS`5z)Y+Fc-H@y{rPc^;r-& zH(F$;A_v+-t*BlEL!~}XZve=B^Me^YTu`5I>P2Nk4AGR!0)&;UHJ$l?meV~ z@i~}dO*Mya{J6ndkM)Aq;L@j*%niKU%hZrxTmWI^8C8|}GT%o&+@Q{cY+t#?h{hQE znkdJ3@K0#6>dBf_SG5$r1=p(E#bnciZ17pS$!rN21P&lHW_hdo=91Bz+p(xP>4oVX z?EKL3WDtMNgY=s9N;NXB){dXhtl4=`?XfxZFh9%?aK!*Y39k z-i^Nx@vPgZ31E(x+&ee{_QJ1*;6`oC=hp7XJ~5^i9mT7J2G4ByaIPmkPslaz>I!;w z3F#hgO$0y7Y{7b}6;jhls9r?rX=Fdvd=e4V&;K)D7iV@HS{8X6W1zYyfgR+_(pOkl zriq2`ke^w%faOaV#O0*eG@A-_h`gI0u6CCrAtxYx$#l7Zn3CzsVy)ef7;F%?4g1+C zb*0zauO)lEkzTrP>G23C)CEw>I+Lc6 z`f4A3bjt2%OotaGi|EBEo*-C^L5{g0Qd{m`4T9<{&)p4&mgf0uFsMDnBSa_Hy`LT- z_R@18irjadaxr?xh-;qt8XkWRt*m-GiC}Qp!ljeLa;wc{-mCQC@JafwHQ^;1Q7Hms z1f&GS6c-ocvsz=tdv`XM?FB8qJ;=1L`Yi{`wLyWBNZ%z&6g9K(w^P!gc%N3MS{A|2 zlwY~DGBgvVBG&ijGLIaw+EJo7Em5Z0%tmC%S2lWtG3$pb5ZM;*QN9tGlE1&u zZp?fLu5i{88!j+!u>ot@2beY|$yt>lx`jm6KOp1`$ zPn+|nKJsTu!8Ee&$;t<9@)x1dYuRb2mo>qNx9@;k0<22?A-Mil-&)~)n zfNA&=aYHD*)BzX`EP$BM!P29s*6Lnb!V0K~bT&1srAvt4f}r@MLUPi&G?O8#(EX6g z;OM9XvoG+Hz0DL%h&p~s%=sc^3HRkt6;Efd<0(&UKPYq4nqx`6qJH}h(XF|jY->cy zgtTYm@b{;rt@WmXkIkB`06kZJ-({;`eup{lymn?wASmtJ0PlpkY`4Ho*Sw1y zXgszkniib9HAfWs?h(>>?}KtAq}r7pZe#Ujo4$)1R|4&Y5_Y2H?pt+w2mR=X%y|2ABiT~7lgV9#x6%j{BNXGMmK&}yx8-1l(j7V?Wkz#Z? zNF*M~EgL7(_+fWB`Lue-hqRO$?u&1D`V#kZY7gApVF?{7uG#3f&UssG@nmKS`SH?CLF%HavQgiW-cY145y={&no95q-0c{ zJF}^FA-&Y!N1)?k1DaRrV{Zu3LiYCraegsc<;&(=cS}!>ku}IaE>d=6&bm857(n^v zP7RC4O5IYmh2qRt4|fwa85erPT*2hVv4I`GT5W*X}l10_gA53b!?A9*QOc0zNb6Bd`wQ~oR{NNcPAJFLC z+ufdyUxXGQCmG7@KJcef6l9VgxO5b?Ws1H~$gn4syvV+bGjlU!8M%oZNYJE95TpORII1%A#O(% z5r6o+0qvdJ~Hd+QXWeUO> zkFkWB4%+kN@ZE37e7NghAECcpjW78X_TJ6PH7k?k+wv}6rD}oFWN+?|n#j<^eh^af zeF3FT#kHAYsN>*ioZ!$3?T2)MyCOr*q3+9v90`J+JIaCp$afV7`-*WZ+WV}M<TVJpEj$imDfzn;O)LiW?#3#m9T3{UB&k|)4|w^+ksCKF|J z_4|~QtYANEX;W?Cd0+cU^jb4FbXGo=A|Zdz zy#yyRk#L5b2F)=w#O`D2Ac!xNmo;98lu+)MOw!Y9wtq3FX0dmHz)%}WoMm&7+|NlJ zz3eZu%We%uxWxu6DZ^?%MnHEaRZ_m8Q;nZ&+QCCiFGyvOfxmarXY`)v<6U^@k9}z+ zF}d^HImu$)YP;JzgcT(n9wT8LxBL&SqU*-)v1~b6qYj4r`bn+GR^NH7eqE|QNRzvz zn|rl|j^=0e$Fh5M(nEz08lLt<7MWlAfa-Jtcu4cbA})-Cs{mO!lP(5+?^Pw}4p8Z2 z?5=!(^8Dz7-}B){a9Qi;y&bnzBmc!>>)uzkA55=}(;nuB-x|KZGSJJfTWIkzQzilb z;BNNAyF{C!DqoUq;tB?B{a_wG zFU7_C#(Q-nSH+|I+p~0y)MzX5$ATB34T8^odn%GvL}jO3J6k_T`}zqwRZ4PtQ!4B5 zt=R5V8Gm9uI5X`h9G8ANceNSLIEwin@eP7|3yBdZ3gokR#Ky zz}wB3C>RNyD09P?QVJ%nzC2^1sbLkX94iLlh<-J0e#Wxd^zEecmNQ4ah>mrs{~1#E zQRF-^_&bz{X4qp*N#uSGrB=L5eQ1z%`gfBqF9IWcFSpk>Fo>8z2gj+@&l6B+2@8tG))*(8BC z$yQ8h$%WO_qG2WW3pfMl(Xz*&T9DyXkKoZe?xe#Mt?BFlw?*OQ$Ex494Q#8eEa<0NmeM3mo#oBG8%6#eWO+(hfPkz$- zyPFS3=E1h7kxFvCJq(|s*0Z4ZB32bbZWkaW)+$`DWAHcZ_|ADX&}#yw&hb12Y1eycyEo7z@b9_+^%-CGDJ#$ z5>h}7MJVIRG^+CwQrhkQA}PgQdH4PSgmLKZZY=IwEMbuiL*>i7e_T>6WYi4u5KI2f zNnu~_Ud}_T15+xFx}7<|LY!%)rf6TPG}4U5Q>=FD2+7%yh%)Ugp7f;CIL1qPzOl8qU6FS2#D~=7#+S^~8){4+#9Zdi4VjRG z*V?%lN%szL&{X)I!CkTUPO9x%23mB=-jv ztV!JUuDD(U(mhU^C_KM7svg>*npw{29HYve;MX3f#9gyyk1lvvLy;GI84#<*7I_h$ z1cJF+p55fC8X+?fw(xNIbDe89YZ=5CDDJOtItlsYtczPott8+(P*P;3KVOE#)48}1 zot-n-uZ;VP-IDchUQn>$hly3qS!~{0r_2u;8pK`3h8lc{~$(0 zW+4eqiNY4&PCO({rhQ`z=MAOVSV)<;Uuw9Ut}UacbQy&d0i^+CyxgJ>z}K+B&wPIe z>*T^GL_P`Kv5vjzCt0m#Qyd+cQ-9ykcH~hy`$&~ZasyW_mDcoUN-evYu?@m$s1Rl1 z9)5F}l~O&`fKcQOqw4ikO+vkNzYbe)7}fOAxlH8|=h=FEMWvLQRccUZ_oE0_#xl@j z6y4GWK{2{735gi#&H;SFzsHv|A|E+vjnd54@1|Vk)`d;#sMx(eq4pdhne#_cS^CAz z$#+)Mql6yh`nq^~iUsFhOV~{RzPy`it6uyyl)W;F@%@bqTl#aVdFaKj?D0j&DWJOc zSF|+*c)L0+YwZ8HyzPEQnn+VK?8-aIL{It|y%HO}g^OZ2uS|Nfg=8M*DPPsw44S|R z75!W7L#i+PKqpK0m|)xbt*yRSdXGXy@0=k|{npHB)tj@p+I-Kk;K2oS!KccAMl$l_ z>EkiQk^@? zdbgbxJNJxV;++k#U&rj09)?68;M5HnhE~^=MX;i|jG1G)@#4g7tqeNWFbx!%D81Xmh@g8{wc0=L zK|v3veJSpEg{zeC1l<6jq*9SmP$s-A~>>)5;tS3 zExR+q>BAXr7BYg9)V<5rJuk?Klf=BlT3i&nf2-=VCi|#cC24x{EpBUZ=+729w-$74 zL!lGB>M^@6J!HFHts`SjbP<}#xd-lsDs>DME0(NrCeS_5G`-PELgpdQeORuj+$4kZ zbd;8G|yV2$84uz>E~ zuN#(yj#AwxX8?NE{$79UuLDWsr}>Ka32^*H2;6=kt1o#wR?Njv29PxFU0FR(tvcP- z7rHeb811&0m!V&a?zP2f7h84PynE$@vmQo>wn-oKIRFg|@=Sd*pV2T0-*5j|;kwAg z*WAAgz(W6ceNdrmjZNH57i!HzADsBnpBmeT@wpA2%&9#%x7)yJt0s3zOXe}3QH5@a z#hLrR>dG7@R)rt6SGZUYKqS?~i|xO1d_D*?Tp@{6nt;XeFDY}z{s2I#w9fiW+ON8# zTcN9$Y+s{c8?=H||3%>x!QWx}j(#qMGM|e*md5-<2K;kPhdY{SO*AHy`94PH`h}`XjpQ?TS8MqDb|1;Jl>46bI<# z+@16R1fK6tN>+%B*wIy!^szX7pO~c1KW&(8=gEIPiTvmA!)g({UqYiGn$#=y$Wa(_ z=>?_eyN0Z{hbl&F5B7+J?|o-!nf~aTm4+Fu6{tG%pMUw^o+#b<5Dk1nqb5HhavR`2 zQpOw7qse%Cf&0+peh(!ma6np_hRJ~g9z)Bu1JT9SwlHgQO6uO6S6D4UJI;Ja>;$+Z zui+*0vmgx4dhO2$(CWVL$Wb#~Jq(0+|3T2WsqwsEyx)@*Rct%Zlfgi!e*dqxk2L9Q zNGLv`_icHRB(uioa5Ohh!cStZOWEtnLO2oDKd-{2V@AVVkDj*O`*+n~2q2z5V%`(cRJ-|qGghNeoqt3~CrkUsq1p2L6sXE_^SJt9lA z)wuZu1l~hs0-amX-1_zJKfQ?(A$}d=XU_lqoAl^`j@7bL{`=dBwj+hp)63oK{C{2Q zXqqzc@E>P6I{gnUzT-8ZkL?E8-2(nHn^8V!ZQyifE-VkOOwc~`;4~4%! z@d7Tmd6|Rn{(>{Y{qh~8fl)JW1{nYCA(5g&wBY9HP5rw2*M~$p3C#_U2g_8}kK@8y z|NNV87NShx5@G)zSVs{;VEG$76C?lrO?S26=4qE-Ir;Yo`OlR3%f0z$%KYcD^4})d z|JjszO@Wfw9CX@%hV}t4-%)t{132z^0PV0#LzUNeQ~PIuUCTcyXi?Tp$t08quJl*B zQ}U;Pf-Zo3!-}?QH*5jZWvjBywduA}{@T5c>gB=mLgb`Xq9W@qXx>b>3rDOW^UZ~y zoj|pRGStBey#OXLD%JyEUg{THnIj$4~rAm zXTH*OZShZVgQ4DqONeBHDfe> z^d3QaOQ5UOoG_O?|HdnpSz>xPTi+u)BLR)DCr_RI*$_?XP)Ef0C0lH0#({a zL~RV=xGxAu0sx@@1pVSRWM}UCR20p=*z+-e6z7JW`w5qw;Nx14!@J7%<|=vf86VYB zyP>Q2aaY;N7&wMhphWXK|HDfGkL}=q1)gk)&Cg3M=X_QGK8@};ao##Qy$Gno(mC+M zDu9ZXu|G@ggPdjCE6yT8Kqqm)B26-g+zJe`rFGUufjBM(s3ujB<8b-#piLPp`!(iX zmkzsSerenTL}L+b++7G>Fg@x)C+33e7l%zIlFadbNNQHB%!2-KO5Bh1!OX zp`X{jhokBjRZfA)g8;aA5hwmI$FkvC1<_N%nkEX@kohXi z+Mq_i+p2VEis?6~9~Fr#MTQ^UDYXtGAZ>}{7unbF7QB_3Jg@nB8j4JYuOFhBxOH-h z0N$d<>=i)pjB!<8hGzO3#}E%Fb(b~^fMTl;^kT#uJ2cn^uCj93a-!j7HoSwg3+nfo zJw<>BwLxIy_by|89!F7WPoH>^a5cx>;%>EH0pC-BeR6OAsCO~8xGDv%SIAK&`Q(g> z>wt%8qEMq&wm(Q!(soON5Q&i#e3KCf)V_`2 zGYY*QWbTb1F!TIKZS8Iu0ta>Eohw0*GO6uJ+R`m>Gb-}j91^jkrIfd7cuHJ@z3y#R zr%P#;DP6GMn{xpAk{_`uf`aOor_y^V@F{6_Q~Wv#5E5Cz=z4jPAPpGhT#6h{vF^=r z1qLO0X$`$$vrb(G8wj6OaefJuo#vV6Fq zx8{t&$a!yXdX&0VKG0GPJFGR^U>UFgZ;r$qFL*8eD3&O7IhTT3iE zHH)x1ELCp6yp8EepLH*WkPy-3i#Ln(i;L7H`D35e?* zeD5N4<^1qj?_mIg#3K3^ApYgqA|S%QmSt0wV;2UU+KQpcyBn-6XkxGl%aLBeJCa-T zzZ=O-6n2>33EX*FsRC>xW?^`)Of1ske)=y(m_eU4exJr!3Z3;){T7MFbgEpLqAS&c z3AGTeW9&fi?6wjiB~?7|6}N&l-{AQXn_W(0CZ>9G%FzE4Lc|&*`|5Ois47G-8rS)P zhxSEb)1TP}B9)K;Ika)mHu*Jl2!q8y)=Gib{!Y1;+YxVo?emM2ymnW#2onBqn_gp% zv74ZVD0n!GVK-#iG~UM&%sw1~L_5r{RK+N>>32@A#I-F6NE=z4UXa_(h`OB_BzZ9| zwo^-8(EhQ~-oAFfg!4f{%Kqh`3pPxs+U;L4Ly2I9_vti5>^^XLznRgR;QrwxUQIai zgm3vCB_doeaxX|(4#}AYi@jiGL#k4xDvRvUA7IgOjFFCP^M^a7YRiQzk@w4?hr@I3 zqF#Gjx}zuu@BLrk?uBpNkrZH%yxa#(?XSzCcC!+q4k^zKB|LvpPefCcx!L7TG*JS% zqt(1!dkdu5kANo_%3`a{&ACxa-)(=hXMJDo!Kb$GzX!s8iHKVF@G$PJ)CzciThXeO z@w_4aaEXQQ7cM;!ng|hYeq%(d1l9s|ZO5I=zpBDEKYRNytTryf3tZEOGzJ5nwFvnn ztP6-eWBu4;`r-RPji`2=bz}R^Y|oQsSjR zZ9VC)g&l@Z@-?f+A<)-%WKP~7A*wO2ii_W&kzsVlnsH~eL{b8W+`Q}ajMy?#BfnI|)D$GHctz|pDd z`Wqd}U)Fi8saiieCvNvAtlXLauP|ZD=txBZ(lJyrF>)_z%ADo`yeJE-ALuAq-UmLB zQzS1JA44S3rObDe(&^Jt_Oi{L(1ouLDH*KV+e>LxBz`2bcZ~jm7WhG*T;h^_yzGei z+3j}J?>;6vox?7n6FKak_CM}|rfu9prYxMuTZlBw- zXRu3^a{wH;Ql-ZpYQ$gWM$2%F2<3Tz>Y+Yo8_b_xNSyY>=^h*G#BRJn^0o?qLHfXGQY># zdb54>eRRipFc0*0S`HU9v3%AQRyovmu|1(Ij#$Np%!&mlg?#q!^mp46$}QA5QY-Z{ z=&p@nij6FfkoHT*rhI&1@!~NrJQ38vu^TMMa$J{P_T@`I{A$HYQK0VAcy6tXIrxwD z%c<;Tdih1i74&xQkzG6|O!QRKTSkfCTlA0j5p%nVse6~3awBxx#j7q%4fQ6t_km** zfyStU62Wiz(oo%8RMp`@jg`A6e-N`XydLp)M)=D)I1(aGpxZU}Z<~I$)m&khXoL-k zKBg`KJ9P}*j`_U&QA@|j98MP04RjZCZ<-%ok!=MuoXcY3xTyQ@RK zER#|z(~3fJi-sKN(5k22d_fO@_oZTb|9VV!R=^jm-Ms@`XC%#=zD*=FnkQTU$G03} zNq%vQXK!93IxOkAqv(T3p4uHSVM74-mssAPot40T(4FXm{bKO95MH_-UOHJZlq8|~ zb>>8;)~{Da$IB*cGJOoYwMADDcc~YhAKekPHC{XR(d9&0`{)OiI}>Z=m9ex3GXY+b zLs`ExHXaisrV~#USFg@wmgVZh4&q&Cs~K>MGeaP+{@MKC)2mB zyLMN^G>G0fE4K2fXw!n`t}K!h;lL<^dk(&Ul1(SFop6wg-4kcYHu_v`6S zSF!>lGq6^}6)C=tOmxmU2;Vq?UZL`mKFn~h1!Kyx;M*%{LbWodcqB@zu--2^o~IAX zj8l+}FycnbL(r21q*8bxON;UpbX)thk&F+kE*b@tbcZ&$IZEblr)Crz`bWEUh}$3x z)4(V!_0E;g2%eAq{(sv0%BU#2cW**MLQqOTWJDCCEJ_iW@ezYYKsrPuhL)}w(f}1y zLi*5aOF?|tum?O$D+8*}3h^ygDa z(sd=6EJ9U{)df zpMc7HPbnF%*V|upDKo9B!rb6?yVfHTx1v>P%{j+&c5s1bPv>69TAQ3NSE`@+g$b;-30|MV z`*&TY_`393q3yiO)Y!J2dT%hoi*^Ux{*OES@BgxBgR**0g18zs)G4AVBYD84L!JXo zZM8q3R&b&;dZrbPXuVA$Zy!LvJaaqfHC#uZZK-`#P``#-bhwhkznWm=OOE z{BqiU*0{D`Rf&t2Az#WRSi?=1G}t~|z0gK&cFV5OZUL^+g`NA$RCA1Gj94-ox5mH6 z-7~5dBzkN89^znV!X2>XwOI64blZv zC)H}Mx&!bn(!LEbq}-nCoeXWtFHcp5J-wzx-UpkLv-O;$qFB61nSkHhVES?@dCmj^P-GF5>mte03t!JBiel7gPyu&ojJ|*Xix>F*KNC|R^nJLXeorpeu3@D2wn3{Jj;yl^k|vw@m_yzL}3Au+E#n(=!sTXX}tBT6MdGsA8ay>4nv+7iC z#xiC(9P3BT;j~aRvE>sx>ndq~C{gU1IO;8F89)o&)4KYpOca!hmkM=FCgM+Nm75)0 z)uG=WccZuvhP{%(QDM`Wolpve@{IQR^q|f4L@4Y}x8^DxKiB-BMP~b&4ZdeiY_YDL zkA<(h1z|)V}Ad-V7lz z6W%a@P6jvM?XM@O(VVW|R-jzf*Y`OWL< zl4vF+x#q13wwIa{>CC)g|Z_nom>SXi+z&NwZ zDp3Z5tlP68U;DgQ4A{I>xv1)cR)5uU_tH_>#Omx#Z3yiMi~V{3=;QnJ#v@kn9<9nS zcni>WmaO!7rlWKE1ViI|9_xmIKJkJjp|ilW=0lz``OtdwHry_3M|{(bNK3t_Q2~|( z%!=+1%gJ@cgt1mwXqAbQv1(BZS8DjdryF1^>}U+WOwS;qpWw%`zGLw{Rxa_CFeszx zRmS`7<-F3c(4#1@B(}9sLte?nsug260u!0hGQw&OYZF^DHwU}tPV_;=c=J3r{fIO) z^tzE_riABMNoD3QQ}$)GurGodJj+Iu9}nSoAJZ{{i_9BP9h#`11R35x=E`SMmOQd- zT4a>o$tEuspLol{-l17ZVkxb65+KHD=)H4axLJJSJsB5};*yaE#~SxN$U8nS=97tS z6_A31{1$5}LlzuIwO&R?Ja8piQjsh*BUqOfWMa}35hV>wM!U{ z)i-^`sOJ;b0eP~y`b#{b3m27AJP{dd8UFTuG&Q-6z`TCS^<%ElPq)H z)t-r@y#74#T6fy1^ksUzYvj~tR5atyT`0q6XoyJk*!#b~qRYB(?zqBAoK2PJr9t%{ zgU^OjuqX>Wg*_$1;kO0pCmucVqh5~&+3RPP`sEZ;Q3VW!$NOGOEGxRvRn2U>%t}?? zG8LimwN~8_$t#KfdPY?va@+3<|4bK<*^yZm4D4(!fXjMdKj}GlX6qS(2B~a5TGLSf z?8iR1qOkErA;-rl27n6eKX>U)8x6R@brcFv`yl7-)(vfDmP(+XA0(X73 zmn}Q{BVPUR=UZ1o+V@WI5I2{Yp?GmrRZd4zuH$%T;u<(M)rHCWH+?K&?58s-O%rJ6 z{c+nbAHWv3D8_W4JyFGqzO+1L zUoz=8(W#bm{S230i28(1bjS&7*A`oIpLZePdT1f~UvRj(tRG6` zY8uT9?9Z@wAM&K2bDoV9vtlhsg*ymH(9a9Awd$&7p3x!UO+V{J3?NNDMfN1pm%!J% z^{gPFl$Ik?(-5C`&T$0#tR*~F!!q}K2^`)jD%4`Rjo*SQa4XkCDY1Y zTZ!TU6~JPBe4IT-StfxBT=AH$>cmAfL^y^oO?94i(45LyZud#F1N(yZ*Q%2Ue&-DV ziZi!Nj+m7{!W)2;((}4b4)+17hb$zjG<@_=*ZD@aaNC-eFEq%H&;?n@CM|gz9aR7cD!FTHidGP8^7uBEKc`j>SdMg4IQ=#l~t}goP3*5 zhN~zBrf&%`mFpf(<$8meJLN`LN+~<}#pa}IUUesTjlnal-YWC8n_a@LnLAtGU0c{X z_E~wZ+Bo4TH?IT+T@_Tm z3i^mc9(spJMBqUAm8?L^vc0q{e1d*aQ>WH>1-@ zi|_xA`U#bYChNVg>!(Gpo^zeiZ)W<$fo?U1-T*&4MJ+a=O=Y17|FNL;XD@eTbauj` zEkVmLpm}k9=*+R^~Erd`}$C!gwQMujW*?hYSa&3Tn^q9hnlAnfQ}Sa zRNgH-T)+7wriTMWl&wjlEOhFj%A{gj`5g?K3flly49pqSwPx>qBmG8(cYFu$AYM*KxSDtJip3 z)LE<1)cUO{344xy86nsy6gzj}Ga2=uM;}ooJEI&z00hK^3CefIq5PT(`OEQ%zI!P4 zLDcW~^;i6Egs@Zca+eUAR$h>>W3-5W+9Z3zf}kNUFP)Hk<$+~Vl_MM!Vs6Cb4WWVv zp~Sy+tsJ*yB1SGBoIKzgR3acohfE&-BcJOJUfWmg1v!l-o8(;WL~~NeYrs6WZ#8L= zQD4*1CT47BbUxM;v$S6esEOj7b-07CkpZ+AM7gx{L7~^l1YEzyV(%FyUHMzxJ~f)Mch;e zs*do=bAOXapn&CPn>pb97l}k2B9Wl`HcqV8`}4C;6o^E^{>9i)qW6Q}6_E}rhy`xj zE8p8)xFCW^Bm&=G;wDCX{QF7SFnB`#j>MMwzr%S41Anzh&#`r43*wJ<2OW+`B-o>x z|00oqBvHmYgCgJml2DKhkqSrZ2BP-uK9Tx}M1t1!fecX!^^X|iHX@Or9CadEIR2i< z|DQ|7*q@5A*f}QRr^3)*z7a}Q7ru1@iz%MSi}LSq%&Q{Lns0olu&WIjjhcm-_^~BC zLiU$AM^Y6=%%*&IUpalq`?8_;mEteMTm&oUYkdd#?vqu5get5Qyrlih%YXz$yo$`C z+I^wBpM+I0Yj>LMFY9jv7S|bxTMU00JVW@S`}$2p{t^Q5m117R=al1!E~o6E7O?h@ z>R)EHjnwbdhl}W#m!})X6e$O+B&(G^ZA~-kj1cea(9KK5PIqhNe0z=6t_#;Z+GAC` zt6~XuWB2`N)y9E$1uweCT(vqD$F1(v;QSYJoF}nuRv}&a{bkP7$E_J}?hD#wVl?P{ zqxPW``CnSjO*tyqw2b{^8MeLc_S|zh^;Yd-y7_Awv*W};_TRPDr%Nb4a%u&d>j!$B zS9myoeau!&&#SWa93XX`E^*}4-SP{&@)yZk)BaCIBvr}Z1*g^_MBhNk-&DeC^tDxS zG39jEjRICZYwJj{WD_x~8+Rhpb@Tdgx|{Fo*MCVwo^j4g13)Y(?J3tsVfFfe?XAd; z=u&J_&s~j(U=khb@5E(!TA2n7!}T6JzTS5RN{kga%!jqQe0W4_-IXimF#26FU^3n2K*2+X-AC~%s);nfE8U$y z_F1C0LumLs)v>LvRGBIkt#5hN7wcLs@u%=_>^5F&!i=52=liWurH`wOI0eH@q4&a_ zqFh>$2m}86r!rBYS>_pCKbyFfcU!P1MkU{?l#JkpF~4%?TrbX`R3-wOF!sEORodPt z_-*}#t5d0FJW&p9Zws9+i=}F151!1=UtbdBv;Ahi+W`5}2q21KpUKhg`x4p zJZ>O+;KlO4Gd8py`)dE|^R4&wKJNAq65k*sKHy@x;Am&^_qv4{TMJ`D@P?6M$$KuSrJG|`kK`ES17e^DaTviDmcfl}0}eHD z_j%LE^UkU7^a{Rp<=a?+FFI!**ZKIK9i$rSPCV}hX7#sVXGuSaFoK%tQ954|haShc z^$F*9R3UA}s%w63ufbK^H6PK0gY=+%X%xgsxd7iZfXmy|dwnqrf(Md&Hgs-qfy_X5 ze!}C+m%w3Sgab-73LQ^IebziZudntSe|p2YBHWx!{ktnGx=$uHu5f4MDu}#hYEK%C zw$wb;Xe4Hj#to5*Z_qIyIw)FvQ%e>yaqt-HSexR}8>_!bfk}X@0vl2*mp6+UexCgBs zGaVx%HRzkVu~HBsyWLT*TQvMwDtqSZUZMy6CugKke=KdAs1#Fnyj_WQsl5N^qv;HM zZ+zoCzmVHftC96UJ*|m>Wp8nW^nylR$EZ`k#fUH1{yB`ffkknK#1mUr`aUE3N{TGZ zCNzC-hQ`j2BcG&tb$ zgbRAk%)ET{6|Fk$1F|V8M+*0_SS&Q5oN?;>7o#JAY9 z1~2Mx;liYUlTJ#xz|(i^$0jo9oL&p$bBWiBxh?EF`4+t`ioLQLcyr zXcoWY`PHQDt&R%-vqiYH@VjQ!pETv(fg*B#u8}B{0M|brL`5-^uZ*jo_8-0&~y} zhRcI`3Ct=Hd1|04)SftAejRg=f(dEASl#+!ZgMM)^5^YIJ%IJ`DzNEKQf_RWuF_&L zDgzOkf$WE$9x*}(<4K&tDr#Y+bNQzhUWUR*vE0#YX#i7C+qBjauQ^PC zp-N|3w11m7nBWmxO($4~de66#s0x$hfh9IK=353keZ&dE#^y&(I}3-mTpnX@L=wWx zDCyYG@UqUS`dlX8z;>zRkheI!;~3L2HilN{iJkklb-AHmVaL`o>7D}hO77R@&|@A+ zlj#8T$VT2Oq3yk^ofK%+6m#}56V$k!^ko;&n7cz||IDB_iCWZ2ND<_yYVeA3f%^ik z?tS|*ZRq!KN(-mwp5rLQO{63Rb(efv z0_V32dCzC@CXzYO^I{RVK6qwh8;`?rA{fTXZ!KRwY$dw-lcVB>?weH2=J&FLzqU>X zd1w~L08Lw{1YAM%2)DSkc2BzePf@UG7ATH;fYNfPZ-bqBJycQ(1ID{Ms?B*lppwe+ z2@F4RHFnFn_vSlT}f+_11G|PlzUS%Pj4{g0F3&NFn4maakJg09j<;&q6`Z z%&V$eB|+h~PipE^yAg#pGl?ps>p;QbfT1gI08(lsUClC-IdcsW7iqDJF`6)!5FIeW zC1iCjb~#3D6?=F;5aIbEC0FE=?W!OYuOH`ej8j@bhON9`yfba$u!X(0imR1sVXl%& z=FX_>P8O1-A&%xctnU9!%fR_LD6MP&UMi}v*bv{3 zhyw*JIQOlGx5^1B)kAO?ZO{cg7EyW%9SeD!VNy?HxH>|$`rPD74v&VtJG6sIB>NcA zNl26tFe;C}-;ldDY{gm)HHpF0OvIBxJxOv*&0W2M$1#JyK;Tx?BHv}`OGe+3wnlQX z_A!?YnE7m9?Zoj^%k-*AT2*GWrvrQCF$!etBOFhesh@H|AN^%=I?ehtbcgP`~;+}_7+Jbg0h8XaR~?{G ztV;B$0`VE^N-nO@a27VBD^kz|tH&haS{LMlC}@yl+SAeKjw+HWso4^y^fL($pFRVf z#RULF*%J!qNg24&SLqm6nG$tXNGfT65xpCsKO-j+Dp2jSt+CFOW*75iB&T2v zL|vz#-ds*;V?xheB!0B0oVtcH0)?0|l1RP1`fI=Q@H{D|Y| zJ-L7w_YrojMTyqahhZ!CguZgU6N*rFVSIx^WY#}TM+ymt=sg)yX#u901GHC(#`pbB zK9~lbZWfGwv+#}LqbzzN86+3ai*e$%*UTYzE?vx~tA)Z%6_XDqkl*yNe~9npcSrIe5AXQ13%}I5_e7>YtQ5jbC^5D!sd5 zbw#!!221Ieuck!NYOVShC${7XQc2g@;EmxB?&s{(sceY%zTIX?_;gJu7QG0xG3!ag zDKq9z+T`;;SPPmC*lJ30lnuMrQvIDXr!;8W5ad9e=_voEk)5JWa( zmdA@z*~Af_86Wg_WJBpWZ}Em6Z)y3xw7xRWJgTo^J-P|iB#npL&vJ!-@Gb8P{}x3x zGD!=U{mVEuTTz)2O$~@LFA;=u7F!5qlk}tZA^UJ!+RLm7wpEj=)LpPbO_*nfdGDJ;zE3?!$5&@USB)<3UWO&yUB0x-0bu&_!&wXS&3=m>um8~l%uMP1@bcH_k%r};2KL{r zHx`>^&GC!xW3#rFLY2*J@HGXWCvPw`+CGqW-ZCyvw2co^^ua)aOsY$%W z`HPY`UTcCZimy>cZ64fGN87TzJkDZGBmFLxKj(43_JAU+^)qt2pKHOl9$3;MZ|4xz zvLTb@JaQqFauD(p=m3SNud2yfk$)fO_Z7;N{Bw@mifQrmqLS(Cv=QS3%uY3&Lk!Z3 zs#0JeV$!PhZu7~b*|Q;oWh@3!s6#g|Zmw2E->_vA6d`@mOX!ueM3zMDJ6@V49%c5e(!{bviV7-JzMcV3;y?pu%?I z8$RLO5G*E=(1_Sz1iTK38`Of7dYX0I?WP`ZyIgJqzP8{0RVoC%yWumA)Brj3CFMql z>bV2jSTaed8^ggjvk{MenBhHG(4J<-mfZHwkjK*CQw5PMsAt6Ui)hY)Em?N?l?1U1 zE4Vgwk*pi%Ume3{T>$%DUlG63zWBam;K6pe+4d#8xX4PY7OfesXLIyxNZY%#&a*0c zLQ5&|$k}KCt%)P`LaM$-EFU#JUOPonzA*p#axIoI!3H9?pVOSUB^%KsuOi(rBTNQO38KBVk#>+x{P zU`es-{(})cQeo1FSd@EGEO~y{bZ%7v1h;THwv`@b9(VcV$yPZzhfzp3xEkf1X`XRj zeC}hS+K)ID;=>H|j}Gg7eG<&L6FB}trmJWj)r$MO0m|Q7Oa0t#`PDF zn}-eED9moZ<%PiGB_&cJGTDK7c3R7UCTA-nF5J$0?e!(Z;r$^uw88sg{IkN_L{$sF zk=4vAO57&3$nOha-x02|a2o|Gz+XclUeDmkLvi2W0fl?iXDc2=en$G?^RtFJS%TqayxYpi~myr?i(K z8o91`q-$-tt$R&}0WD_1#B*{J*C_@9}av69&{6>xuiP<`OB~rI;}79VzPcQsdQ12!gq;J+b_~R&YA27N5VD2`B6%RDWU2 zRqmD_RiLT%A9j-n8#6$0hsS3?DzZUr|E8EgsQsL;v(0SjB!nDboPoR7x6KIA4i~j2 zII1pGC@c^y0gVwI7MQoRK-15n~4&lTnNF&zkcrx- z4fu)MpW#~(T{^+cY@R+kA-E^lJ($RV{TWGg7TGy2^qiK2<4BhuSzVpY;(I~J))2!v z1bW#35V_P9mp@%##|42F*g(;NSfcj<wK&p$sSK)bwvi@d;g6F-ZQUxi0d{qH0GjL-j$#eXl_|3^T6NpUw2 zOZkw+tP9fEcM#`vqrlbxl0l*&%v&%c{aG+kqy<@r{M`Q;j~~WxTl8D1@x{2ykKS4~ zC+=a2bx;_i*kzjyeTKZ+jf(!@uJ3}xmOBUV|F{-IU^!C%OPsy=PfYMIaq0zjiytr0 z%9M;@;T8bBiM!79Y!-8Jj$z?`YX$~Bhw;bajVC09cKKi*boAaI`Xo1zTxa+BA3RnZ z5RqRo0U3LUD$LR=m8FFy8B$^(iyXJp+s52-Nwq5u;w!sBNoEbfcJ3~Ev__Ay$8+ua z`ywRl4Bd_??Ec0lK7Y6L$G)QmKKb9bpldn{{H$m>pXj`ltZMRvZ z&HUPdBJuy8#{YQlea|o=%rpQO2>Z7T2qR0eDaAhB0$Uq;PH~~!bY5Dd+G|cyX_!P; z!PCr;fN#jjejae&d)IF(;Db0=XbwN*l4?ufkT2l|8qrbCkLksW8uLFf`8tOLp4O@c zB|+%iflK#)^u9q-f+}_jTx-Qi0#4D9yz-G7%if_I&!%QVm2Gig9B8YX@}AuOAFYdg zH^>@f8P6=VU+Czjy!EinQ&vE7)LL`N=GY84{$D!<>P V)Oe;Uo&^3~lT*Hwe$m+P{{VCkb!Pwo literal 0 HcmV?d00001 diff --git a/internal/command/command.go b/internal/command/command.go index a354e7b..34d2000 100644 --- a/internal/command/command.go +++ b/internal/command/command.go @@ -248,7 +248,9 @@ func newServerConfig(ctx context.Context, config *Config) (*auth_providers.Serve } type SignConfig struct { - CertificateTemplate string + CertificateTemplate string // Deprecated, use EnrollmentPatternName or EnrollmentPatternId instead + EnrollmentPatternId int32 + EnrollmentPatternName string CertificateAuthorityLogicalName string CertificateAuthorityHostname string Meta *K8sMetadata @@ -256,8 +258,8 @@ type SignConfig struct { } func (s *SignConfig) validate() error { - if s.CertificateTemplate == "" { - return errors.New("certificateTemplate is required") + if s.CertificateTemplate == "" && s.EnrollmentPatternName == "" && s.EnrollmentPatternId == 0 { + return errors.New("either certificateTemplate, enrollmentPatternName, or enrollmentPatternId must be specified") } if s.CertificateAuthorityLogicalName == "" { return errors.New("certificateAuthorityLogicalName is required") diff --git a/internal/command/command_test.go b/internal/command/command_test.go index ede7feb..7ab6ad7 100644 --- a/internal/command/command_test.go +++ b/internal/command/command_test.go @@ -200,9 +200,9 @@ func TestSignConfigValidate(t *testing.T) { wantErr string }{ { - name: "missing certificateTemplate", - config: &SignConfig{CertificateTemplate: "", CertificateAuthorityLogicalName: "ca-logical", CertificateAuthorityHostname: "ca.example.com"}, - wantErr: "certificateTemplate is required", + name: "missing certificateTemplate and enrollmentPatternName and enrollmentPatternId", + config: &SignConfig{CertificateTemplate: "", EnrollmentPatternName: "", CertificateAuthorityLogicalName: "ca-logical", CertificateAuthorityHostname: "ca.example.com"}, + wantErr: "either certificateTemplate, enrollmentPatternName, or enrollmentPatternId must be specified", }, { name: "missing certificateAuthorityLogicalName", @@ -210,10 +210,25 @@ func TestSignConfigValidate(t *testing.T) { wantErr: "certificateAuthorityLogicalName is required", }, { - name: "all valid fields", + name: "all valid fields (both certificateTemplate and enrollmentPatternName specified)", + config: &SignConfig{CertificateTemplate: "myTemplate", EnrollmentPatternName: "My Enrollment Pattern", CertificateAuthorityLogicalName: "ca-logical", CertificateAuthorityHostname: "ca.example.com"}, + wantErr: "", + }, + { + name: "all valid fields (only certificateTemplate specified)", config: &SignConfig{CertificateTemplate: "myTemplate", CertificateAuthorityLogicalName: "ca-logical", CertificateAuthorityHostname: "ca.example.com"}, wantErr: "", }, + { + name: "all valid fields (only enrollmentPatternName specified)", + config: &SignConfig{EnrollmentPatternName: "My Enrollment Pattern", CertificateAuthorityLogicalName: "ca-logical", CertificateAuthorityHostname: "ca.example.com"}, + wantErr: "", + }, + { + name: "all valid fields (only enrollmentPatternId specified)", + config: &SignConfig{EnrollmentPatternId: 123, CertificateAuthorityLogicalName: "ca-logical", CertificateAuthorityHostname: "ca.example.com"}, + wantErr: "", + }, { name: "valid with optional fields", config: &SignConfig{ @@ -242,10 +257,6 @@ func TestSignConfigValidate(t *testing.T) { } } -// var ( -// _ commandsdk.AuthConfig = &fakeCommandAuthenticator{} -// ) - type fakeCommandAuthenticator struct { client *http.Client config *auth_providers.Server From 827fbdcce87208ce9ab8efd7c8e20662a905e876 Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Tue, 3 Jun 2025 13:56:10 +0000 Subject: [PATCH 16/32] Update generated docs --- README.md | 36 +++++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index f76b65e..2efb25e 100644 --- a/README.md +++ b/README.md @@ -55,7 +55,7 @@ Before continuing, ensure that the following requirements are met: ## Configuring Command -Command Issuer enrolls certificates by submitting a POST request to the Command CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template suitable for your use case. Additionally, you should ensure that the [identity provider](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/AuthenticateAPI.htm#AuthenticatingtotheKeyfactorAPI) used by the Issuer/ClusterIssuer has the appropriate permissions in Command. +Command Issuer enrolls certificates by submitting a POST request to the Command CSR Enrollment endpoint. Before using Command Issuer, you must create or identify a Certificate Authority _and_ Certificate Template / Enrollment Pattern suitable for your use case. Additionally, you should ensure that the [identity provider](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/AuthenticateAPI.htm#AuthenticatingtotheKeyfactorAPI) used by the Issuer/ClusterIssuer has the appropriate permissions in Command. 1. **Create or identify a Certificate Authority** @@ -65,23 +65,27 @@ Command Issuer enrolls certificates by submitting a POST request to the Command The CA that you choose must be configured to allow CSR Enrollment. -2. **Identify a Certificate Template** +2. **Identify a Certificate Template / Enrollment Pattern** + + Keyfactor Command 25.1 introduces support for [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReleaseNotes/Release2511.htm#Highlights), which allow an easy way to share certificate configuration without requiring multiple certificate templates. Certificate Template configuration has been moved to the Enrollment Patterns screen. Certificate Templates will still be supported in Issuer / ClusterIssuer configuration, but it is recommended to start using Enrollment Patterns for Keyfactor Command versions 25.1 and above. + + - If you don't have any suitable Enrollment Patterns, refer to the [Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) or reach out to your Keyfactor support representative to learn more. Certificate Templates in Command define properties and constraints of the certificates being issued. This includes settings like key usage, extended key usage, validity period, allowed key algorithms, and signature algorithms. They also control the type of information that end entities must provide and how that information is validated before issuing certificates. - If you don't have any suitable Certificate Templates, refer to the [Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Configuring%20Template%20Options.htm?Highlight=Certificate%20Template) or reach out to your Keyfactor support representative to learn more. - The Certificate Template that you choose must be configured to allow CSR Enrollment. + The Certificate Template / Enrollment Pattern that you choose must be configured to allow CSR Enrollment. - You should make careful note of the allowed Key Types and Key Sizes on the Certificate Template. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the key `algorithm` and `size` are allowed by your Certificate Template in Command. + You should make careful note of the allowed Key Types and Key Sizes on the Certificate Template / Enrollment Pattern. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the key `algorithm` and `size` are allowed by your Certificate Template / Enrollment Pattern in Command. - The same goes for **Enrollment RegExes** and **Policies** defined on your Certificate Template. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the `subject`, `commonName`, `dnsNames`, etc. are allowed and/or configured correctly by your Certificate Template in Command. + The same goes for **Enrollment RegExes** and **Policies** defined on your Certificate Template / Enrollment Pattern. When creating cert-manager [Certificates](https://cert-manager.io/docs/usage/certificate/), you must make sure that the `subject`, `commonName`, `dnsNames`, etc. are allowed and/or configured correctly by your Certificate Template / Enrollment Pattern in Command. 3. **Configure Command Security Roles and Claims** In Command, Security Roles define groups of users or administrators with specific permissions. Users and subjects are identified by Claims. By adding a Claim to a Security Role, you can define what actions the user or subject can perform and what parts of the system it can interact with. - The security role will need to be added as an **Allowed Requester Security Role** on the Certificate Authority and Certificate Template configured in the previous two steps. + The security role will need to be added as an **Allowed Requester Security Role** on the Certificate Authority and Certificate Template / Enrollment Pattern configured in the previous two steps. - If you haven't created Roles and Access rules before, [this guide](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityOverview.htm?Highlight=Security%20Roles) provides a primer on these concepts in Command. @@ -102,6 +106,8 @@ Command Issuer enrolls certificates by submitting a POST request to the Command ![Certificate Template Allowed Requester](./docsource/images/cert_template_allowed_requester.png) +![Enrollment Pattern Allowed Requester](./docsource/images/enrollment_pattern_allowed_requester.png) + ## Installing Command Issuer Command Issuer is installed using a Helm chart. The chart is available in the [Command cert-manager Helm repository](https://keyfactor.github.io/command-cert-manager-issuer/). @@ -156,7 +162,8 @@ These credentials must be configured using a Kubernetes Secret. By default, the Command Issuer also supports ambient authentication, where a token is fetched from an Authorization Server using a cloud provider's auth infrastructure and passed to Command directly. The following methods are supported: - [Managed Identity Using Azure Entra ID Workload Identity](./docs/ambient-providers/azure.md) (if running in [AKS](https://azure.microsoft.com/en-us/products/kubernetes-service)) -- [Managed Identity Using Google Kubernetes Engine](./docs/ambient-providers/google.md) (if running in [GKE](https://cloud.google.com/kubernetes-engine)) + +If you are running your Kubernetes workload in a cloud provider not listed above, you can use workload identity federation with [Azure AD](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation). ## Basic Auth @@ -224,6 +231,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou export COMMAND_CA_HOSTNAME="" # Only required for non-HTTPS CA types export COMMAND_CA_LOGICAL_NAME="" export CERTIFICATE_TEMPLATE_SHORT_NAME="" + export ENROLLMENT_PATTERN_NAME="" ``` The `spec` field of both the Issuer and ClusterIssuer resources use the following fields: @@ -235,7 +243,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou | caSecretName | (optional) The name of the Kubernetes secret containing the CA certificate. Required if the Command API uses a self-signed certificate or it was signed by a CA that is not widely trusted. | | certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` | | certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. | - | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. | + | enrollmentPatternId | The ID of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | + | enrollmentPatternName | The Name of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | + | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. **Deprecated in favor of [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/KeyfactorAPI/Enrollment-Patterns.htm) as of Keyfactor Command 25.1**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | | scopes | (Optional) Required if using ambient credentials with Azure AKS. If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. | | audience | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`. | @@ -262,7 +272,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" - certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" + enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. + # certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Uncomment if required # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -288,7 +299,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" - certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" + enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. + # certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Uncomment if required # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -359,11 +371,12 @@ kubectl get secret command-certificate -o jsonpath='{.data.tls\.crt}' | base64 - ## Overriding the Issuer/ClusterIssuer `spec` using Kubernetes Annotations on CertificateRequest Resources -Command Issuer allows you to override the `certificateAuthorityHostname`, `certificateAuthorityLogicalName`, and `certificateTemplate` by setting Kubernetes Annotations on CertificateRequest resources. This may be useful if certain enrollment scenarios require a different Certificate Authority or Certificate Template, but you don't want to create a new Issuer/ClusterIssuer. +Command Issuer allows you to override the `certificateAuthorityHostname`, `certificateAuthorityLogicalName`, `certificateTemplate`, and `enrollmentPatternName` by setting Kubernetes Annotations on CertificateRequest resources. This may be useful if certain enrollment scenarios require a different Certificate Authority or Certificate Template, but you don't want to create a new Issuer/ClusterIssuer. - `command-issuer.keyfactor.com/certificateAuthorityHostname` overrides `certificateAuthorityHostname` - `command-issuer.keyfactor.com/certificateAuthorityLogicalName` overrides `certificateAuthorityLogicalName` - `command-issuer.keyfactor.com/certificateTemplate` overrides `certificateTemplate` +- `command-issuer.keyfactor.com/enrollmentPatternName` overrides `enrollmentPatternName` > cert-manager copies Annotations set on Certificate resources to the corresponding CertificateRequest. @@ -377,6 +390,7 @@ Command Issuer allows you to override the `certificateAuthorityHostname`, `certi > kind: Certificate > metadata: > annotations: +> command-issuer.keyfactor.com/enrollmentPatternName: "Kubernetes Enrollment Pattern" > command-issuer.keyfactor.com/certificateTemplate: "Ephemeral2day" > command-issuer.keyfactor.com/certificateAuthorityLogicalName: "InternalIssuingCA1" > metadata.command-issuer.keyfactor.com/ResponsibleTeam: "theResponsibleTeam@example.com" From 8a23d0e4e92c97066a26f2d2416ceebc3c549013 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 3 Jun 2025 12:28:55 -0400 Subject: [PATCH 17/32] feat(enrollmentPatterns): Add support to use enrollment patterns in API requests --- docsource/content.md | 4 +- internal/command/client.go | 14 ++- internal/command/command.go | 111 ++++++++++++++++-- internal/command/command_test.go | 89 +++++++++++++- .../certificaterequest_controller.go | 2 + 5 files changed, 199 insertions(+), 21 deletions(-) diff --git a/docsource/content.md b/docsource/content.md index cdda614..3e69783 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -339,12 +339,13 @@ kubectl get secret command-certificate -o jsonpath='{.data.tls\.crt}' | base64 - ## Overriding the Issuer/ClusterIssuer `spec` using Kubernetes Annotations on CertificateRequest Resources -Command Issuer allows you to override the `certificateAuthorityHostname`, `certificateAuthorityLogicalName`, `certificateTemplate`, and `enrollmentPatternName` by setting Kubernetes Annotations on CertificateRequest resources. This may be useful if certain enrollment scenarios require a different Certificate Authority or Certificate Template, but you don't want to create a new Issuer/ClusterIssuer. +Command Issuer allows you to override the `certificateAuthorityHostname`, `certificateAuthorityLogicalName`, `certificateTemplate`, `enrollmentPatternName`, and `enrollmentPatternId` by setting Kubernetes Annotations on CertificateRequest resources. This may be useful if certain enrollment scenarios require a different Certificate Authority or Certificate Template, but you don't want to create a new Issuer/ClusterIssuer. - `command-issuer.keyfactor.com/certificateAuthorityHostname` overrides `certificateAuthorityHostname` - `command-issuer.keyfactor.com/certificateAuthorityLogicalName` overrides `certificateAuthorityLogicalName` - `command-issuer.keyfactor.com/certificateTemplate` overrides `certificateTemplate` - `command-issuer.keyfactor.com/enrollmentPatternName` overrides `enrollmentPatternName` +- `command-issuer.keyfactor.com/enrollmentPatternId` overrides `enrollmentPatternId` > cert-manager copies Annotations set on Certificate resources to the corresponding CertificateRequest. @@ -358,6 +359,7 @@ Command Issuer allows you to override the `certificateAuthorityHostname`, `certi > kind: Certificate > metadata: > annotations: +> command-issuer.keyfactor.com/enrollmentPatternId: "1234" > command-issuer.keyfactor.com/enrollmentPatternName: "Kubernetes Enrollment Pattern" > command-issuer.keyfactor.com/certificateTemplate: "Ephemeral2day" > command-issuer.keyfactor.com/certificateAuthorityLogicalName: "InternalIssuingCA1" diff --git a/internal/command/client.go b/internal/command/client.go index 639e779..e6d1ca0 100644 --- a/internal/command/client.go +++ b/internal/command/client.go @@ -1,5 +1,5 @@ /* -Copyright ยฉ 2024 Keyfactor +Copyright ยฉ 2025 Keyfactor Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -49,6 +49,7 @@ func setAmbientTokenCredentialSource(source TokenCredentialSource) { type Client interface { EnrollCSR(v1.ApiCreateEnrollmentCSRRequest) (*v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse, *http.Response, error) GetAllMetadataFields(v1.ApiGetMetadataFieldsRequest) ([]v1.CSSCMSDataModelModelsMetadataType, *http.Response, error) + GetEnrollmentPatterns(v1.ApiGetEnrollmentPatternsRequest) ([]v1.EnrollmentPatternsEnrollmentPatternResponse, *http.Response, error) TestConnection() error } @@ -57,9 +58,10 @@ var ( ) type clientAdapter struct { - enrollCSR func(r v1.ApiCreateEnrollmentCSRRequest) (*v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse, *http.Response, error) - getAllMetadataFields func(r v1.ApiGetMetadataFieldsRequest) ([]v1.CSSCMSDataModelModelsMetadataType, *http.Response, error) - testConnection func() error + enrollCSR func(r v1.ApiCreateEnrollmentCSRRequest) (*v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse, *http.Response, error) + getAllMetadataFields func(r v1.ApiGetMetadataFieldsRequest) ([]v1.CSSCMSDataModelModelsMetadataType, *http.Response, error) + getEnrollmentPatterns func(r v1.ApiGetEnrollmentPatternsRequest) ([]v1.EnrollmentPatternsEnrollmentPatternResponse, *http.Response, error) + testConnection func() error } // EnrollCSR implements CertificateClient. @@ -72,6 +74,10 @@ func (c *clientAdapter) GetAllMetadataFields(r v1.ApiGetMetadataFieldsRequest) ( return c.getAllMetadataFields(r) } +func (c *clientAdapter) GetEnrollmentPatterns(r v1.ApiGetEnrollmentPatternsRequest) ([]v1.EnrollmentPatternsEnrollmentPatternResponse, *http.Response, error) { + return c.getEnrollmentPatterns(r) +} + // TestConnection implements CertificateClient. func (c *clientAdapter) TestConnection() error { return c.testConnection() diff --git a/internal/command/command.go b/internal/command/command.go index 34d2000..3149d48 100644 --- a/internal/command/command.go +++ b/internal/command/command.go @@ -1,5 +1,5 @@ /* -Copyright ยฉ 2024 Keyfactor +Copyright ยฉ 2025 Keyfactor Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -22,6 +22,7 @@ import ( "encoding/pem" "errors" "fmt" + "strconv" "strings" "time" @@ -29,6 +30,7 @@ import ( commandsdk "github.com/Keyfactor/keyfactor-go-client-sdk/v25" v1 "github.com/Keyfactor/keyfactor-go-client-sdk/v25/api/keyfactor/v1" cmpki "github.com/cert-manager/cert-manager/pkg/util/pki" + "github.com/go-logr/logr" "sigs.k8s.io/controller-runtime/pkg/log" ) @@ -43,6 +45,7 @@ var ( errInvalidSignerConfig = errors.New("invalid signer config") errInvalidCSR = errors.New("csr is invalid") errCommandEnrollmentFailure = errors.New("command enrollment failure") + errEnrollmentPatternFailure = errors.New("enrollment pattern failure") errTokenFetchFailure = errors.New("couldn't fetch bearer token") errAmbientCredentialCreationFailure = errors.New("failed to obtain ambient credentials") ) @@ -290,9 +293,10 @@ func newInternalSigner(ctx context.Context, config *Config, newClientFunc newCom } adapter := &clientAdapter{ - enrollCSR: client.V1.EnrollmentApi.CreateEnrollmentCSRExecute, - getAllMetadataFields: client.V1.MetadataFieldApi.GetMetadataFieldsExecute, - testConnection: client.V1.AuthClient.Authenticate, + enrollCSR: client.V1.EnrollmentApi.CreateEnrollmentCSRExecute, + getAllMetadataFields: client.V1.MetadataFieldApi.GetMetadataFieldsExecute, + getEnrollmentPatterns: client.V1.EnrollmentPatternApi.GetEnrollmentPatternsExecute, + testConnection: client.V1.AuthClient.Authenticate, } log.Info("Successfully generated Command client") @@ -375,14 +379,29 @@ func (s *signer) Sign(ctx context.Context, csrBytes []byte, config *SignConfig) // Override defaults from annotations if value, exists := config.Annotations["command-issuer.keyfactor.com/certificateTemplate"]; exists { + k8sLog.Info(fmt.Sprintf("Using certificateTemplate %q from annotations", value)) config.CertificateTemplate = value } if value, exists := config.Annotations["command-issuer.keyfactor.com/certificateAuthorityLogicalName"]; exists { + k8sLog.Info(fmt.Sprintf("Using certificateAuthorityLogicalName %q from annotations", value)) config.CertificateAuthorityLogicalName = value } if value, exists := config.Annotations["command-issuer.keyfactor.com/certificateAuthorityHostname"]; exists { + k8sLog.Info(fmt.Sprintf("Using certificateAuthorityHostname %q from annotations", value)) config.CertificateAuthorityHostname = value } + if value, exists := config.Annotations["command-issuer.keyfactor.com/enrollmentPatternId"]; exists { + k8sLog.Info(fmt.Sprintf("Using enrollmentPatternId %q from annotations", value)) + conv, err := strconv.ParseInt(value, 10, 32) + if err != nil { + return nil, nil, fmt.Errorf("%w: failed to parse enrollmentPatternId from annotations: %s", errInvalidSignerConfig, err) + } + config.EnrollmentPatternId = int32(conv) + } + if value, exists := config.Annotations["command-issuer.keyfactor.com/enrollmentPatternName"]; exists { + k8sLog.Info(fmt.Sprintf("Using enrollmentPatternName %q from annotations", value)) + config.EnrollmentPatternName = value + } k8sLog.Info(fmt.Sprintf("Using certificate template %q and certificate authority %q (%s)", config.CertificateTemplate, config.CertificateAuthorityLogicalName, config.CertificateAuthorityHostname)) @@ -411,13 +430,37 @@ func (s *signer) Sign(ctx context.Context, csrBytes []byte, config *SignConfig) req := v1.ApiCreateEnrollmentCSRRequest{} req = req.XCertificateformat(enrollmentPEMFormat) + var template *string = nil + var enrollmentPatternId *int32 = nil + + // Populate certificate template if defined + if config.CertificateTemplate != "" { + k8sLog.Info(fmt.Sprintf("Using certificate template from config. Name: %s", config.CertificateTemplate)) + template = &config.CertificateTemplate + } + + // Populate enrollment pattern ID or name if defined + if config.EnrollmentPatternId != 0 { + k8sLog.Info(fmt.Sprintf("Using enrollment pattern ID from config. ID: %d", config.EnrollmentPatternId)) + enrollmentPatternId = &config.EnrollmentPatternId + } else if config.EnrollmentPatternName != "" { + pattern, err := getEnrollmentPatternByName(ctx, k8sLog, s, config.EnrollmentPatternName) + if err != nil { + return nil, nil, err + } + + enrollmentPatternId = pattern.Id + k8sLog.Info(fmt.Sprintf("Using enrollment pattern ID: %d", *enrollmentPatternId)) + } + modelRequest := v1.EnrollmentCSREnrollmentRequest{ - CSR: string(csrBytes), - Template: *v1.NewNullableString(ptr(config.CertificateTemplate)), - Timestamp: ptr(time.Now()), - IncludeChain: ptr(true), - SANs: map[string][]string{}, - Metadata: map[string]interface{}{}, + CSR: string(csrBytes), + EnrollmentPatternId: *v1.NewNullableInt32(enrollmentPatternId), + Template: *v1.NewNullableString(template), + Timestamp: ptr(time.Now()), + IncludeChain: ptr(true), + SANs: map[string][]string{}, + Metadata: map[string]interface{}{}, } if config.Meta != nil { @@ -449,7 +492,15 @@ func (s *signer) Sign(ctx context.Context, csrBytes []byte, config *SignConfig) commandCsrResponseObject, _, err := s.client.EnrollCSR(req) if err != nil { - detail := fmt.Sprintf("error enrolling certificate with Command. Verify that the certificate template %q exists and that the certificate authority %q (%s) is configured correctly", config.CertificateTemplate, config.CertificateAuthorityLogicalName, config.CertificateAuthorityHostname) + detail := fmt.Sprintf("error enrolling certificate with Command. Verify that the certificate authority %q (%s) is configured correctly", config.CertificateAuthorityLogicalName, config.CertificateAuthorityHostname) + + if template != nil { + detail += fmt.Sprintf(" and that the certificate template %q exists in Command", *template) + } + + if enrollmentPatternId != nil { + detail += fmt.Sprintf(". Make sure enrollment pattern ID %d is configured to use certificate authority %q (%s) and the security role is configured to use this enrollment pattern.", *enrollmentPatternId, config.CertificateAuthorityLogicalName, config.CertificateAuthorityHostname) + } if len(extractMetadataFromAnnotations(config.Annotations)) > 0 { detail += ". Also verify that the metadata fields provided exist in Command" @@ -509,3 +560,41 @@ func parseCSR(pemBytes []byte) (*x509.CertificateRequest, error) { func ptr[T any](v T) *T { return &v } + +// getEnrollmentPatternByName retrieves an enrollment pattern by its name from Command. +// It paginates through the results until it finds the pattern or exhausts all pages. +func getEnrollmentPatternByName(ctx context.Context, log logr.Logger, s *signer, enrollmentPatternName string) (*v1.EnrollmentPatternsEnrollmentPatternResponse, error) { + log.Info(fmt.Sprintf("Looking up enrollment pattern %q in Command...", enrollmentPatternName)) + + var model *v1.EnrollmentPatternsEnrollmentPatternResponse + + pageNumber := 1 + + for model == nil { + patterns, _, err := s.client.GetEnrollmentPatterns(v1.ApiGetEnrollmentPatternsRequest{}. + PageReturned(int32(pageNumber))) + + if err != nil { + detail := fmt.Sprintf("error fetching enrollment patterns from Command: %s", err) + return nil, fmt.Errorf("%w: %s: %w", errEnrollmentPatternFailure, detail, err) + } + + if len(patterns) == 0 { + detail := fmt.Sprintf("enrollment pattern not found: %s", enrollmentPatternName) + return nil, fmt.Errorf("%w: %s", errEnrollmentPatternFailure, detail) + } + + pageNumber++ + + for _, pattern := range patterns { + if pattern.Name.Get() != nil && *pattern.Name.Get() == enrollmentPatternName { + model = &pattern + break + } + } + } + + log.Info(fmt.Sprintf("Enrollment pattern %s found in Command", enrollmentPatternName)) + + return model, nil +} diff --git a/internal/command/command_test.go b/internal/command/command_test.go index 7ab6ad7..b0fc732 100644 --- a/internal/command/command_test.go +++ b/internal/command/command_test.go @@ -1,5 +1,5 @@ /* -Copyright ยฉ 2024 Keyfactor +Copyright ยฉ 2025 Keyfactor Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -366,7 +366,8 @@ type fakeClient struct { enrollCallback func(v1.ApiCreateEnrollmentCSRRequest) enrollResponse *v1.CSSCMSDataModelModelsEnrollmentCSREnrollmentResponse - metadataFields []v1.CSSCMSDataModelModelsMetadataType + metadataFields []v1.CSSCMSDataModelModelsMetadataType + enrollmentPatterns []v1.EnrollmentPatternsEnrollmentPatternResponse err error } @@ -384,12 +385,18 @@ func (f *fakeClient) GetAllMetadataFields(v1.ApiGetMetadataFieldsRequest) ([]v1. return f.metadataFields, nil, f.err } +// GetEnrollmentPatterns implements Client. +func (f *fakeClient) GetEnrollmentPatterns(v1.ApiGetEnrollmentPatternsRequest) ([]v1.EnrollmentPatternsEnrollmentPatternResponse, *http.Response, error) { + return f.enrollmentPatterns, nil, f.err +} + // TestConnection implements Client. func (f *fakeClient) TestConnection() error { return f.err } type EnrollmentCSRRequest struct { + EnrollmentPatternId int32 Template string CertificateAuthority string SANs map[string][]string @@ -408,12 +415,14 @@ func TestSign(t *testing.T) { expectedLeafAndChain := append([]*x509.Certificate{leafCert}, issuingCert) + enrollmentPatternName := "fake-enrollment-pattern" certificateTemplateName := "fake-cert-template" certificateAuthorityLogicalName := "fake-issuing-ca" certificateAuthorityHostname := "pki.example.com" testCases := map[string]struct { enrollCSRFunctionError error + enrollmentPatterns []v1.EnrollmentPatternsEnrollmentPatternResponse // Request config *SignConfig @@ -422,7 +431,7 @@ func TestSign(t *testing.T) { expectedEnrollArgs *EnrollmentCSRRequest expectedSignError error }{ - "success-no-meta": { + "success-no-meta-certificate-template": { // Request config: &SignConfig{ CertificateTemplate: certificateTemplateName, @@ -441,6 +450,50 @@ func TestSign(t *testing.T) { }, expectedSignError: nil, }, + "success-no-meta-enrollment-pattern-id": { + // Request + config: &SignConfig{ + EnrollmentPatternId: 12345, + CertificateAuthorityLogicalName: certificateAuthorityLogicalName, + CertificateAuthorityHostname: certificateAuthorityHostname, + Meta: nil, + Annotations: nil, + }, + + // Expected + expectedEnrollArgs: &EnrollmentCSRRequest{ + EnrollmentPatternId: 12345, + CertificateAuthority: fmt.Sprintf("%s\\%s", certificateAuthorityHostname, certificateAuthorityLogicalName), + SANs: map[string][]string{}, + Metadata: map[string]interface{}{}, + }, + expectedSignError: nil, + }, + "success-no-meta-enrollment-pattern-name": { + enrollmentPatterns: []v1.EnrollmentPatternsEnrollmentPatternResponse{ + v1.EnrollmentPatternsEnrollmentPatternResponse{ + Id: ptr(int32(12345)), + Name: *v1.NewNullableString(&enrollmentPatternName), + }, + }, + // Request + config: &SignConfig{ + EnrollmentPatternName: enrollmentPatternName, + CertificateAuthorityLogicalName: certificateAuthorityLogicalName, + CertificateAuthorityHostname: certificateAuthorityHostname, + Meta: nil, + Annotations: nil, + }, + + // Expected + expectedEnrollArgs: &EnrollmentCSRRequest{ + EnrollmentPatternId: 12345, + CertificateAuthority: fmt.Sprintf("%s\\%s", certificateAuthorityHostname, certificateAuthorityLogicalName), + SANs: map[string][]string{}, + Metadata: map[string]interface{}{}, + }, + expectedSignError: nil, + }, "success-annotation-config-override": { // Request config: &SignConfig{ @@ -452,6 +505,8 @@ func TestSign(t *testing.T) { "command-issuer.keyfactor.com/certificateTemplate": "template-override", "command-issuer.keyfactor.com/certificateAuthorityLogicalName": "logicalname-override", "command-issuer.keyfactor.com/certificateAuthorityHostname": "hostname-override", + "command-issuer.keyfactor.com/enrollmentPatternName": "enrollment-pattern-override", + "command-issuer.keyfactor.com/enrollmentPatternId": "12345", }, }, @@ -543,6 +598,28 @@ func TestSign(t *testing.T) { }, expectedSignError: errCommandEnrollmentFailure, }, + "enroll-csr-err-enrollment-pattern-not-found": { + enrollmentPatterns: []v1.EnrollmentPatternsEnrollmentPatternResponse{}, + + // Request + config: &SignConfig{ + EnrollmentPatternName: enrollmentPatternName, + CertificateAuthorityLogicalName: certificateAuthorityLogicalName, + CertificateAuthorityHostname: certificateAuthorityHostname, + Meta: nil, + Annotations: nil, + }, + + // Expected + expectedEnrollArgs: &EnrollmentCSRRequest{ + Template: certificateTemplateName, + CertificateAuthority: fmt.Sprintf("%s\\%s", certificateAuthorityHostname, certificateAuthorityLogicalName), + SANs: map[string][]string{}, + Metadata: map[string]interface{}{}, + }, + + expectedSignError: errEnrollmentPatternFailure, + }, } for name, tc := range testCases { @@ -554,8 +631,9 @@ func TestSign(t *testing.T) { client := fakeClient{ err: tc.enrollCSRFunctionError, - enrollResponse: certificateRestResponseFromExpectedCerts(t, expectedLeafAndChain, []*x509.Certificate{caCert}), - enrollCallback: cb, + enrollResponse: certificateRestResponseFromExpectedCerts(t, expectedLeafAndChain, []*x509.Certificate{caCert}), + enrollmentPatterns: tc.enrollmentPatterns, + enrollCallback: cb, } signer := signer{ client: &client, @@ -671,6 +749,7 @@ func assertErrorIs(t *testing.T, expectedError, actualError error) { if !assert.Error(t, actualError) { return } + assert.Truef(t, errors.Is(actualError, expectedError), "unexpected error type. expected: %v, got: %v", expectedError, actualError) } diff --git a/internal/controller/certificaterequest_controller.go b/internal/controller/certificaterequest_controller.go index 2f2ba57..6da4814 100644 --- a/internal/controller/certificaterequest_controller.go +++ b/internal/controller/certificaterequest_controller.go @@ -233,6 +233,8 @@ func (r *CertificateRequestReconciler) Reconcile(ctx context.Context, req ctrl.R signConfig := &command.SignConfig{ CertificateTemplate: issuer.GetSpec().CertificateTemplate, + EnrollmentPatternId: issuer.GetSpec().EnrollmentPatternId, + EnrollmentPatternName: issuer.GetSpec().EnrollmentPatternName, CertificateAuthorityLogicalName: issuer.GetSpec().CertificateAuthorityLogicalName, CertificateAuthorityHostname: issuer.GetSpec().CertificateAuthorityHostname, Annotations: certificateRequest.GetAnnotations(), From 6518ce53e26aed4859c47fe6f4b6c4f414f3541e Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 3 Jun 2025 13:25:35 -0400 Subject: [PATCH 18/32] chore(docs): Improve logging and documentation --- docsource/content.md | 35 ++++++++++++++++++----------------- internal/command/command.go | 22 ++++++++++++++++++---- 2 files changed, 36 insertions(+), 21 deletions(-) diff --git a/docsource/content.md b/docsource/content.md index 3e69783..4179942 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -12,6 +12,7 @@ Before continuing, ensure that the following requirements are met: - `/Status/Endpoints` - `/Enrollment/CSR` - `/MetadataFields` + - `/EnrollmentPatterns` (Keyfactor Command 25.1 and above) - Kubernetes >= v1.19 - [Kubernetes](https://kubernetes.io/docs/tasks/tools/), [Minikube](https://minikube.sigs.k8s.io/docs/start/), [Kind](https://kind.sigs.k8s.io/docs/user/quick-start/), etc. > You must have permission to create [Custom Resource Definitions](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) in your Kubernetes cluster. @@ -58,10 +59,11 @@ Command Issuer enrolls certificates by submitting a POST request to the Command If your security policy requires fine-grain access control, Command Issuer requires the following Access Rules: - | Global Permissions | Permission Model (Version Two) | Permission Model (Version One) | - |-----------------------------------------|---|---| - | Metadata > Types > Read | `/metadata/types/read/` | `CertificateMetadataTypes:Read` | - | Certificates > Enrollment > Csr | `/certificates/enrollment/csr/` | `CertificateEnrollment:EnrollCSR` | + | Global Permissions | Permission Model (Version Two) | Permission Model (Version One) | Notes + |-----------------------------------------|---|---|--| + | Metadata > Types > Read | `/metadata/types/read/` | `CertificateMetadataTypes:Read` | | + | Certificates > Enrollment > Csr | `/certificates/enrollment/csr/` | `CertificateEnrollment:EnrollCSR` | | + | Enrollment Patterns > Read (Optional) | `/enrollment_pattern/read/` | N/A | Required if using `EnrollmentPatternName` | > Documentation for [Version Two Permission Model](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityRolePermissions.htm#VersionTwoPermissionModel) and [Version One Permission Model](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityRolePermissions.htm#VersionOnePermissionModel) @@ -174,10 +176,6 @@ kubectl -n command-issuer-system create secret generic command-secret \ This section has moved. Please refer to [this link](./docs/ambient-providers/azure.md) for documentation on configuring ambient credentials with AKS. -## Google Kubernetes Engine (GKE) Workload Identity - -This section has moved. Please refer to [this link](./docs/ambient-providers/google.md) for documentation on configuring ambient credentials with GKE. - # CA Bundle If the Command API is configured to use a self-signed certificate or with a certificate whose issuer isn't widely trusted, the CA certificate must be provided as a Kubernetes secret. @@ -200,6 +198,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou export COMMAND_CA_LOGICAL_NAME="" export CERTIFICATE_TEMPLATE_SHORT_NAME="" export ENROLLMENT_PATTERN_NAME="" + export ENROLLMENT_PATTERN_ID="" ``` The `spec` field of both the Issuer and ClusterIssuer resources use the following fields: @@ -211,9 +210,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou | caSecretName | (optional) The name of the Kubernetes secret containing the CA certificate. Required if the Command API uses a self-signed certificate or it was signed by a CA that is not widely trusted. | | certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` | | certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. | - | enrollmentPatternId | The ID of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | - | enrollmentPatternName | The Name of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | - | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. **Deprecated in favor of [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/KeyfactorAPI/Enrollment-Patterns.htm) as of Keyfactor Command 25.1**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | + | enrollmentPatternId | The ID of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternId` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified certificate template is not compatible with the enrollment pattern. | + | enrollmentPatternName | The Name of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified certificate template is not compatible with the enrollment pattern. If using `enrollmentPatternName`, your security role must have `/enrollment_pattern/read/` permission. | + | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. **Deprecated in favor of [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/KeyfactorAPI/Enrollment-Patterns.htm) as of Keyfactor Command 25.1**. If `certificateTemplate` and either `enrollmentPatternName` or `enrollmentPatternId` are specified, the enrollment pattern parameter will take precedence. Enrollment will fail if the specified certificate template is not compatible with the enrollment pattern. | | scopes | (Optional) Required if using ambient credentials with Azure AKS. If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. | | audience | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`. | @@ -240,8 +239,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" - enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. - # certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Uncomment if required + enrollmentPatternId: "$ENROLLMENT_PATTERN_ID" # Only supported on Keyfactor Command 25.1 and above. + certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Required if using Keyfactor Command 24.4 and below. + # enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -267,8 +267,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" - enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. - # certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Uncomment if required + enrollmentPatternId: "$ENROLLMENT_PATTERN_ID" # Only supported on Keyfactor Command 25.1 and above. + certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Required if using Keyfactor Command 24.4 and below. + # enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -317,7 +318,7 @@ spec: request: ``` -> All fields in Command Issuer and ClusterIssuer `spec` can be overridden by applying Kubernetes Annotations to Certificates _and_ CertificateRequests. See [runtime customization for more](docs/annotations.md) +> All fields in Command Issuer and ClusterIssuer `spec` can be overridden by applying Kubernetes Annotations to Certificates _and_ CertificateRequests. See [runtime customization for more](#overriding-the-issuerclusterissuer-spec-using-kubernetes-annotations-on-certificaterequest-resources) ## Approving Certificate Requests @@ -345,7 +346,7 @@ Command Issuer allows you to override the `certificateAuthorityHostname`, `certi - `command-issuer.keyfactor.com/certificateAuthorityLogicalName` overrides `certificateAuthorityLogicalName` - `command-issuer.keyfactor.com/certificateTemplate` overrides `certificateTemplate` - `command-issuer.keyfactor.com/enrollmentPatternName` overrides `enrollmentPatternName` -- `command-issuer.keyfactor.com/enrollmentPatternId` overrides `enrollmentPatternId` +- `command-issuer.keyfactor.com/enrollmentPatternId` overrides `enrollmentPatternId`. Needs to be in string format. > cert-manager copies Annotations set on Certificate resources to the corresponding CertificateRequest. diff --git a/internal/command/command.go b/internal/command/command.go index 3149d48..1f8427e 100644 --- a/internal/command/command.go +++ b/internal/command/command.go @@ -22,6 +22,7 @@ import ( "encoding/pem" "errors" "fmt" + "io" "strconv" "strings" "time" @@ -403,7 +404,7 @@ func (s *signer) Sign(ctx context.Context, csrBytes []byte, config *SignConfig) config.EnrollmentPatternName = value } - k8sLog.Info(fmt.Sprintf("Using certificate template %q and certificate authority %q (%s)", config.CertificateTemplate, config.CertificateAuthorityLogicalName, config.CertificateAuthorityHostname)) + k8sLog.Info(fmt.Sprintf("Using certificate template %q and certificate authority %q (%s) and enrollment pattern ID %d and enrollment pattern name %s", config.CertificateTemplate, config.CertificateAuthorityLogicalName, config.CertificateAuthorityHostname, config.EnrollmentPatternId, config.EnrollmentPatternName)) csr, err := parseCSR(csrBytes) if err != nil { @@ -488,7 +489,13 @@ func (s *signer) Sign(ctx context.Context, csrBytes []byte, config *SignConfig) req = req.EnrollmentCSREnrollmentRequest(modelRequest) - k8sLog.Info(fmt.Sprintf("Enrolling certificate with Command using template %q and CA %q", config.CertificateTemplate, caBuilder.String())) + // Avoid nil pointer dereference in logs + loggedEnrollmentPatternId := int32(0) + if enrollmentPatternId != nil { + loggedEnrollmentPatternId = *enrollmentPatternId + } + + k8sLog.Info(fmt.Sprintf("Enrolling certificate with Command using template %q and CA %q and enrollment pattern ID %d", config.CertificateTemplate, caBuilder.String(), loggedEnrollmentPatternId)) commandCsrResponseObject, _, err := s.client.EnrollCSR(req) if err != nil { @@ -571,11 +578,18 @@ func getEnrollmentPatternByName(ctx context.Context, log logr.Logger, s *signer, pageNumber := 1 for model == nil { - patterns, _, err := s.client.GetEnrollmentPatterns(v1.ApiGetEnrollmentPatternsRequest{}. + patterns, httpResp, err := s.client.GetEnrollmentPatterns(v1.ApiGetEnrollmentPatternsRequest{}. PageReturned(int32(pageNumber))) if err != nil { - detail := fmt.Sprintf("error fetching enrollment patterns from Command: %s", err) + // Capture the error message which should indicate the failure reason + msg := "" + if httpResp != nil && httpResp.Body != nil { + defer httpResp.Body.Close() + bodyBytes, _ := io.ReadAll(httpResp.Body) + msg += string(bodyBytes) + } + detail := fmt.Sprintf("error fetching enrollment patterns from Command: %s. Details: %s", err, msg) return nil, fmt.Errorf("%w: %s: %w", errEnrollmentPatternFailure, detail, err) } From a8ae44b5b380f2b0883df2105284f97fa2298bee Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Tue, 3 Jun 2025 17:28:29 +0000 Subject: [PATCH 19/32] Update generated docs --- README.md | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index 2efb25e..39df70a 100644 --- a/README.md +++ b/README.md @@ -45,6 +45,7 @@ Before continuing, ensure that the following requirements are met: - `/Status/Endpoints` - `/Enrollment/CSR` - `/MetadataFields` + - `/EnrollmentPatterns` (Keyfactor Command 25.1 and above) - Kubernetes >= v1.19 - [Kubernetes](https://kubernetes.io/docs/tasks/tools/), [Minikube](https://minikube.sigs.k8s.io/docs/start/), [Kind](https://kind.sigs.k8s.io/docs/user/quick-start/), etc. > You must have permission to create [Custom Resource Definitions](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) in your Kubernetes cluster. @@ -91,10 +92,11 @@ Command Issuer enrolls certificates by submitting a POST request to the Command If your security policy requires fine-grain access control, Command Issuer requires the following Access Rules: - | Global Permissions | Permission Model (Version Two) | Permission Model (Version One) | - |-----------------------------------------|---|---| - | Metadata > Types > Read | `/metadata/types/read/` | `CertificateMetadataTypes:Read` | - | Certificates > Enrollment > Csr | `/certificates/enrollment/csr/` | `CertificateEnrollment:EnrollCSR` | + | Global Permissions | Permission Model (Version Two) | Permission Model (Version One) | Notes + |-----------------------------------------|---|---|--| + | Metadata > Types > Read | `/metadata/types/read/` | `CertificateMetadataTypes:Read` | | + | Certificates > Enrollment > Csr | `/certificates/enrollment/csr/` | `CertificateEnrollment:EnrollCSR` | | + | Enrollment Patterns > Read (Optional) | `/enrollment_pattern/read/` | N/A | Required if using `EnrollmentPatternName` | > Documentation for [Version Two Permission Model](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityRolePermissions.htm#VersionTwoPermissionModel) and [Version One Permission Model](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/SecurityRolePermissions.htm#VersionOnePermissionModel) @@ -206,10 +208,6 @@ kubectl -n command-issuer-system create secret generic command-secret \ This section has moved. Please refer to [this link](./docs/ambient-providers/azure.md) for documentation on configuring ambient credentials with AKS. -## Google Kubernetes Engine (GKE) Workload Identity - -This section has moved. Please refer to [this link](./docs/ambient-providers/google.md) for documentation on configuring ambient credentials with GKE. - # CA Bundle If the Command API is configured to use a self-signed certificate or with a certificate whose issuer isn't widely trusted, the CA certificate must be provided as a Kubernetes secret. @@ -232,6 +230,7 @@ For example, ClusterIssuer resources can be used to issue certificates for resou export COMMAND_CA_LOGICAL_NAME="" export CERTIFICATE_TEMPLATE_SHORT_NAME="" export ENROLLMENT_PATTERN_NAME="" + export ENROLLMENT_PATTERN_ID="" ``` The `spec` field of both the Issuer and ClusterIssuer resources use the following fields: @@ -243,9 +242,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou | caSecretName | (optional) The name of the Kubernetes secret containing the CA certificate. Required if the Command API uses a self-signed certificate or it was signed by a CA that is not widely trusted. | | certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` | | certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. | - | enrollmentPatternId | The ID of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | - | enrollmentPatternName | The Name of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | - | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. **Deprecated in favor of [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/KeyfactorAPI/Enrollment-Patterns.htm) as of Keyfactor Command 25.1**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. | + | enrollmentPatternId | The ID of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternId` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified certificate template is not compatible with the enrollment pattern. | + | enrollmentPatternName | The Name of the [Enrollment Pattern](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm) to use when this Issuer/ClusterIssuer enrolls CSRs. **Supported by Keyfactor Command 25.1 and above**. If `certificateTemplate` and `enrollmentPatternName` are both specified, the enrollment pattern parameter will take precedence. If `enrollmentPatternId` and `enrollmentPatternName` are both specified, `enrollmentPatternId` will take precedence. Enrollment will fail if the specified certificate template is not compatible with the enrollment pattern. If using `enrollmentPatternName`, your security role must have `/enrollment_pattern/read/` permission. | + | certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. **Deprecated in favor of [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/KeyfactorAPI/Enrollment-Patterns.htm) as of Keyfactor Command 25.1**. If `certificateTemplate` and either `enrollmentPatternName` or `enrollmentPatternId` are specified, the enrollment pattern parameter will take precedence. Enrollment will fail if the specified certificate template is not compatible with the enrollment pattern. | | scopes | (Optional) Required if using ambient credentials with Azure AKS. If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. | | audience | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`. | @@ -272,8 +271,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" - enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. - # certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Uncomment if required + enrollmentPatternId: "$ENROLLMENT_PATTERN_ID" # Only supported on Keyfactor Command 25.1 and above. + certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Required if using Keyfactor Command 24.4 and below. + # enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -299,8 +299,9 @@ For example, ClusterIssuer resources can be used to issue certificates for resou # certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME" - enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. - # certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Uncomment if required + enrollmentPatternId: "$ENROLLMENT_PATTERN_ID" # Only supported on Keyfactor Command 25.1 and above. + certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME" # Required if using Keyfactor Command 24.4 and below. + # enrollmentPatternName: "$ENROLLMENT_PATTERN_NAME" # Only supported on Keyfactor Command 25.1 and above. # scopes: "openid email https://example.com/.default" # Uncomment if required # audience: "https://your-command-url.com" # Uncomment if desired EOF @@ -349,7 +350,7 @@ spec: request: ``` -> All fields in Command Issuer and ClusterIssuer `spec` can be overridden by applying Kubernetes Annotations to Certificates _and_ CertificateRequests. See [runtime customization for more](docs/annotations.md) +> All fields in Command Issuer and ClusterIssuer `spec` can be overridden by applying Kubernetes Annotations to Certificates _and_ CertificateRequests. See [runtime customization for more](#overriding-the-issuerclusterissuer-spec-using-kubernetes-annotations-on-certificaterequest-resources) ## Approving Certificate Requests @@ -371,12 +372,13 @@ kubectl get secret command-certificate -o jsonpath='{.data.tls\.crt}' | base64 - ## Overriding the Issuer/ClusterIssuer `spec` using Kubernetes Annotations on CertificateRequest Resources -Command Issuer allows you to override the `certificateAuthorityHostname`, `certificateAuthorityLogicalName`, `certificateTemplate`, and `enrollmentPatternName` by setting Kubernetes Annotations on CertificateRequest resources. This may be useful if certain enrollment scenarios require a different Certificate Authority or Certificate Template, but you don't want to create a new Issuer/ClusterIssuer. +Command Issuer allows you to override the `certificateAuthorityHostname`, `certificateAuthorityLogicalName`, `certificateTemplate`, `enrollmentPatternName`, and `enrollmentPatternId` by setting Kubernetes Annotations on CertificateRequest resources. This may be useful if certain enrollment scenarios require a different Certificate Authority or Certificate Template, but you don't want to create a new Issuer/ClusterIssuer. - `command-issuer.keyfactor.com/certificateAuthorityHostname` overrides `certificateAuthorityHostname` - `command-issuer.keyfactor.com/certificateAuthorityLogicalName` overrides `certificateAuthorityLogicalName` - `command-issuer.keyfactor.com/certificateTemplate` overrides `certificateTemplate` - `command-issuer.keyfactor.com/enrollmentPatternName` overrides `enrollmentPatternName` +- `command-issuer.keyfactor.com/enrollmentPatternId` overrides `enrollmentPatternId`. Needs to be in string format. > cert-manager copies Annotations set on Certificate resources to the corresponding CertificateRequest. @@ -390,6 +392,7 @@ Command Issuer allows you to override the `certificateAuthorityHostname`, `certi > kind: Certificate > metadata: > annotations: +> command-issuer.keyfactor.com/enrollmentPatternId: "1234" > command-issuer.keyfactor.com/enrollmentPatternName: "Kubernetes Enrollment Pattern" > command-issuer.keyfactor.com/certificateTemplate: "Ephemeral2day" > command-issuer.keyfactor.com/certificateAuthorityLogicalName: "InternalIssuingCA1" From 238bc8b31ed3b3132e2e46c6616a6bc60b505329 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 3 Jun 2025 13:32:04 -0400 Subject: [PATCH 20/32] chore(tests): Add more tests around enrollment pattern id vs enrollment pattern name usage --- internal/command/command_test.go | 60 ++++++++++++++++++++++++++++++-- 1 file changed, 58 insertions(+), 2 deletions(-) diff --git a/internal/command/command_test.go b/internal/command/command_test.go index b0fc732..e73ac5f 100644 --- a/internal/command/command_test.go +++ b/internal/command/command_test.go @@ -476,6 +476,7 @@ func TestSign(t *testing.T) { Name: *v1.NewNullableString(&enrollmentPatternName), }, }, + // Request config: &SignConfig{ EnrollmentPatternName: enrollmentPatternName, @@ -494,9 +495,31 @@ func TestSign(t *testing.T) { }, expectedSignError: nil, }, - "success-annotation-config-override": { + "success-no-meta-enrollment-pattern-id-overwrites-pattern-name": { + enrollmentPatterns: []v1.EnrollmentPatternsEnrollmentPatternResponse{}, // This would fail if enrollment pattern name was used // Request config: &SignConfig{ + EnrollmentPatternId: 12345, + EnrollmentPatternName: enrollmentPatternName, + CertificateAuthorityLogicalName: certificateAuthorityLogicalName, + CertificateAuthorityHostname: certificateAuthorityHostname, + Meta: nil, + Annotations: nil, + }, + + // Expected + expectedEnrollArgs: &EnrollmentCSRRequest{ + EnrollmentPatternId: 12345, + CertificateAuthority: fmt.Sprintf("%s\\%s", certificateAuthorityHostname, certificateAuthorityLogicalName), + SANs: map[string][]string{}, + Metadata: map[string]interface{}{}, + }, + expectedSignError: nil, + }, + "success-annotation-config-override-pattern-id": { + // Request + config: &SignConfig{ + EnrollmentPatternId: 67890, CertificateTemplate: certificateTemplateName, CertificateAuthorityLogicalName: certificateAuthorityLogicalName, CertificateAuthorityHostname: certificateAuthorityHostname, @@ -505,13 +528,46 @@ func TestSign(t *testing.T) { "command-issuer.keyfactor.com/certificateTemplate": "template-override", "command-issuer.keyfactor.com/certificateAuthorityLogicalName": "logicalname-override", "command-issuer.keyfactor.com/certificateAuthorityHostname": "hostname-override", - "command-issuer.keyfactor.com/enrollmentPatternName": "enrollment-pattern-override", "command-issuer.keyfactor.com/enrollmentPatternId": "12345", }, }, // Expected expectedEnrollArgs: &EnrollmentCSRRequest{ + EnrollmentPatternId: 12345, + Template: "template-override", + CertificateAuthority: fmt.Sprintf("%s\\%s", "hostname-override", "logicalname-override"), + SANs: map[string][]string{}, + Metadata: map[string]interface{}{}, + }, + expectedSignError: nil, + }, + "success-annotation-config-override-pattern-name": { + enrollmentPatterns: []v1.EnrollmentPatternsEnrollmentPatternResponse{ + v1.EnrollmentPatternsEnrollmentPatternResponse{ + Id: ptr(int32(12345)), + Name: *v1.NewNullableString(ptr("enrollment-pattern-override")), + }, + }, + + // Request + config: &SignConfig{ + EnrollmentPatternName: enrollmentPatternName, + CertificateTemplate: certificateTemplateName, + CertificateAuthorityLogicalName: certificateAuthorityLogicalName, + CertificateAuthorityHostname: certificateAuthorityHostname, + Meta: nil, + Annotations: map[string]string{ + "command-issuer.keyfactor.com/certificateTemplate": "template-override", + "command-issuer.keyfactor.com/certificateAuthorityLogicalName": "logicalname-override", + "command-issuer.keyfactor.com/certificateAuthorityHostname": "hostname-override", + "command-issuer.keyfactor.com/enrollmentPatternName": "enrollment-pattern-override", + }, + }, + + // Expected + expectedEnrollArgs: &EnrollmentCSRRequest{ + EnrollmentPatternId: 12345, Template: "template-override", CertificateAuthority: fmt.Sprintf("%s\\%s", "hostname-override", "logicalname-override"), SANs: map[string][]string{}, From 520b176641ba639a4a6cce6bfba84084bf3dcca1 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 3 Jun 2025 13:42:13 -0400 Subject: [PATCH 21/32] chore(docs): Updated CHANGELOG --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e6fc97b..035a681 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +# v2.2.0 +## Features +- Added support for enrolling CSRs with [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm), a new feature introduced in Keyfactor Command 25.1. [Release notes](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReleaseNotes/Release2511.htm) + - Usage of `CertificateTemplate` is still supported, but if using Keyfactor Command 25.1 and above, it is recommended to start using Enrollment Patterns in your issuer specification. You may use `EnrollmentPatternId` or `EnrollmentPatternName` in your specification. + +## Chores +- Updated documentation for using ambient credentials with Azure Kuberentes Services. +- Removed documentation for using ambient credentials with Google Kubernetes Engine. As of writing, Google is not a supported identity provider in Keyfactor Command. +- Migrated from using [keyfactor-go-client](https://github.com/Keyfactor/keyfactor-go-client) to [keyfactor-go-client-sdk](https://github.com/keyfactor/keyfactor-go-client-sdk). # v2.1.1 From 0ebe029dca341fba777b73c783ce1532b4d632d9 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 3 Jun 2025 16:07:42 -0400 Subject: [PATCH 22/32] fix(actions): Use the tag number directly when releasing a Helm chart version --- .github/workflows/helm.yml | 26 +++++++++----------------- CHANGELOG.md | 3 +++ 2 files changed, 12 insertions(+), 17 deletions(-) diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index 61f699d..fa2925b 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -1,20 +1,12 @@ name: Build and Release Helm Chart on: - pull_request: - branches: - - 'release-*' - types: - # action should run when the pull request is closed - # (regardless of whether it was merged or just closed) - - closed - # Make sure the action runs every time new commits are - # pushed to the pull request's branch - - synchronize - + push: + tags: + - '[0-9]+.[0-9]+.[0-9]+' # 1.2.3 (exact match) - release candidates are excluded + jobs: helm: runs-on: ubuntu-latest - if: github.event.pull_request.merged == true steps: - name: Set IMAGE_NAME run: | @@ -23,20 +15,20 @@ jobs: # Checkout code # https://github.com/actions/checkout - name: Checkout code - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + uses: actions/checkout@v4.1.0 # Extract metadata (tags, labels) to use in Helm chart # https://github.com/docker/metadata-action - name: Extract Docker metadata id: meta - uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 + uses: docker/metadata-action@v5.0.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} # Set version from DOCKER_METADATA_OUTPUT_VERSION as environment variable - name: Set Version run: | - echo "VERSION=${DOCKER_METADATA_OUTPUT_VERSION:8}.0" >> $GITHUB_ENV # Eventually will build this into Keyfactor bootstrap + echo "VERSION=${{ github.ref_name }}" >> $GITHUB_ENV # Eventually will build this into Keyfactor bootstrap # Change version and appVersion in Chart.yaml to the tag in the closed PR - name: Update Helm App/Chart Version @@ -48,7 +40,7 @@ jobs: # Setup Helm # https://github.com/Azure/setup-helm - name: Install Helm - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5 + uses: azure/setup-helm@v3.5 with: token: ${{ secrets.GITHUB_TOKEN }} @@ -61,7 +53,7 @@ jobs: # Build and release Helm chart to GitHub Pages # https://github.com/helm/chart-releaser-action - name: Run chart-releaser - uses: helm/chart-releaser-action@be16258da8010256c6e82849661221415f031968 # v1.5.0 + uses: helm/chart-releaser-action@v1.5.0 env: CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" with: diff --git a/CHANGELOG.md b/CHANGELOG.md index 035a681..8bced70 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,9 @@ - Removed documentation for using ambient credentials with Google Kubernetes Engine. As of writing, Google is not a supported identity provider in Keyfactor Command. - Migrated from using [keyfactor-go-client](https://github.com/Keyfactor/keyfactor-go-client) to [keyfactor-go-client-sdk](https://github.com/keyfactor/keyfactor-go-client-sdk). +## Fixes +- Fix the Helm chart releaser job to not run into issues with overlapping Helm chart versions. + # v2.1.1 ## Fixes From abfef4c56c5810723263b4647b37b384b7724014 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Wed, 4 Jun 2025 13:33:23 -0400 Subject: [PATCH 23/32] feat(e2e): Add e2e tests for project --- .gitignore | 6 +- e2e/.env.example | 10 + e2e/run_tests.sh | 597 ++++++++++++++++++++++++++++++++ internal/command/client_test.go | 16 + 4 files changed, 628 insertions(+), 1 deletion(-) create mode 100644 e2e/.env.example create mode 100755 e2e/run_tests.sh diff --git a/.gitignore b/.gitignore index ef9e7e2..79cba22 100644 --- a/.gitignore +++ b/.gitignore @@ -19,4 +19,8 @@ bin # Helm *.tgz -.DS_Store \ No newline at end of file +.DS_Store + +**/.env +**/.env.* +!**/.env.example \ No newline at end of file diff --git a/e2e/.env.example b/e2e/.env.example new file mode 100644 index 0000000..874e5fa --- /dev/null +++ b/e2e/.env.example @@ -0,0 +1,10 @@ +export HOSTNAME="command.hostname.com" +export API_PATH="KeyfactorAPI" + +export CERTIFICATE_TEMPLATE="Server_tlsServerAuth-1y" +export CERTIFICATE_AUTHORITY_HOSTNAME="" +export CERTIFICATE_AUTHORITY_LOGICAL_NAME="Sub-CA" + +export OAUTH_TOKEN_URL="https://example.com/oauth2/token" +export OAUTH_CLIENT_ID="changeme" +export OAUTH_CLIENT_SECRET='changeme' \ No newline at end of file diff --git a/e2e/run_tests.sh b/e2e/run_tests.sh new file mode 100755 index 0000000..a78170a --- /dev/null +++ b/e2e/run_tests.sh @@ -0,0 +1,597 @@ +#!/bin/bash + +## ======================= LICENSE =================================== +# Copyright ยฉ 2025 Keyfactor +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +## ========================================================================== + +## ======================= Description =================================== + +# This script automates the deployment of the command-cert-manager-issuer +# and runs end-to-end tests to validate its functionality. +# This script is intended for use in a Minikube environment. +# This script can be run multiple times to test various scenarios. + +## ======================================================================= + +## ======================= Requirements =================================== +# - Minikube running +# - Helm installed +# - Docker installed +# - kubectl installed +# - cmctl installed +# - cert-manager Helm chart available +## =========================================================================== + +## ======================= How to run =================================== +# Enable the script to run: +# > chmod +x run_tests.sh +# Load the environment variables: +# > source .env +# Run the tests: +# > ./run_tests.sh +## =========================================================================== + + +IMAGE_REPO="keyfactor" +IMAGE_NAME="command-cert-manager-issuer" +# IMAGE_TAG="2.2.0-rc.9" # Uncomment if you want to use an existing image from the repository +IMAGE_TAG="local" # Uncomment if you want to build the image locally +FULL_IMAGE_NAME="${IMAGE_REPO}/${IMAGE_NAME}:${IMAGE_TAG}" + +HELM_CHART_NAME="command-cert-manager-issuer" +#HELM_CHART_VERSION="2.1.0" # Uncomment if you want to use a specific version from the Helm repository +HELM_CHART_VERSION="local" # Uncomment if you want to use the local Helm chart + +IS_LOCAL_DEPLOYMENT=$([ "$IMAGE_TAG" = "local" ] && echo "true" || echo "false") + +# TODO: Handle both in the e2e tests +ISSUER_TYPE="Issuer" +CLUSTER_ISSUER_TYPE="ClusterIssuer" + +#ISSUER_OR_CLUSTER_ISSUER="ClusterIssuer" +ISSUER_OR_CLUSTER_ISSUER="Issuer" +ISSUER_CR_NAME="issuer" +ISSUER_CRD_FQTN="issuers.command-issuer.keyfactor.com" +CLUSTER_ISSUER_CRD_FQTN="clusterissuers.command-issuer.keyfactor.com" + +ENROLLMENT_PATTERN_ID=1 +ENROLLMENT_PATTERN_NAME="Test Enrollment Pattern" + +CHART_PATH="./deploy/charts/command-cert-manager-issuer" + +CERT_MANAGER_VERSION="v1.17.0" + +MANAGER_NAMESPACE="command-issuer-system" +CERT_MANAGER_NAMESPACE="cert-manager" +ISSUER_NAMESPACE="issuer-playground" + +SIGNER_SECRET_NAME="auth-secret" +SIGNER_CA_SECRET_NAME="ca-secret" + +CERTIFICATEREQUEST_CRD_FQTN="certificaterequests.cert-manager.io" + + +CR_CR_NAME="req" + +set -e # Exit on any error + +validate_env_present() { + local env_var=$1 + local required=$2 + if [ -z "${!env_var}" ]; then + if [ "$required" = "false" ]; then + echo "โ„น๏ธ Optional environment variable $env_var is not set. Continuing..." + return 0 + fi + echo "โš ๏ธ Required environment variable $env_var. Please check your .env file or set it in your shell." + echo " Run: source .env or export $env_var=" + exit 1 + fi +} + +check_env() { + validate_env_present HOSTNAME true + validate_env_present API_PATH true + validate_env_present CERTIFICATE_TEMPLATE true + validate_env_present CERTIFICATE_AUTHORITY_LOGICAL_NAME true + validate_env_present OAUTH_TOKEN_URL true + validate_env_present OAUTH_CLIENT_ID true + validate_env_present OAUTH_CLIENT_SECRET true + + validate_env_present CERTIFICATE_AUTHORITY_HOSTNAME false +} + +ns_exists () { + local ns=$1 + if [ "$(kubectl get namespace -o json | jq --arg namespace "$ns" -e '.items[] | select(.metadata.name == $namespace) | .metadata.name')" ]; then + return 0 + fi + return 1 +} + +helm_exists () { + local namespace=$1 + local chart_name=$2 + if helm list -n "$namespace" | grep -q "$chart_name"; then + return 0 + fi + return 1 +} + +cr_exists () { + local fqtn=$1 + local ns=$2 + local name=$3 + if [ "$(kubectl -n "$ns" get "$fqtn" -o json | jq --arg name "$name" -e '.items[] | select(.metadata.name == $name) | .metadata.name')" ]; then + echo "$fqtn exists called $name in $ns" + return 0 + fi + return 1 +} + +secret_exists () { + local ns=$1 + local name=$2 + if [ "$(kubectl -n "$ns" get secret -o json | jq --arg name "$name" -e '.items[] | select(.metadata.name == $name) | .metadata.name')" ]; then + echo "secret exists called $name in $ns" + return 0 + fi + return 1 +} + +install_cert_manager() { + echo "๐Ÿ“ฆ Installing cert-manager..." + + # Add jetstack repository if not already added + if ! helm repo list | grep -q jetstack; then + echo "Adding jetstack Helm repository..." + helm repo add jetstack https://charts.jetstack.io + fi + + helm repo update + + echo "Installing cert-manager version ${CERT_MANAGER_VERSION}..." + + helm install cert-manager jetstack/cert-manager \ + --namespace ${CERT_MANAGER_NAMESPACE} \ + --create-namespace \ + --version ${CERT_MANAGER_VERSION} \ + --set crds.enabled=true \ + --wait + + echo "โœ… cert-manager installed successfully" +} + +install_cert_manager_issuer() { + echo "๐Ÿ“ฆ Installing instance of $IMAGE_NAME with tag $IMAGE_TAG..." + + + if [[ "$HELM_CHART_VERSION" == "local" ]]; then + CHART_PATH=$CHART_PATH + + # Checking if chart path exists + if [ ! -d "$CHART_PATH" ]; then + echo "โš ๏ธ Chart path not found at ${CHART_PATH}. Are you in the correct directory?" + exit 1 + fi + + VERSION_PARAM="" + else + CHART_PATH="command-issuer/command-cert-manager-issuer" + echo "Using Helm chart from repository for version ${HELM_CHART_VERSION}: $CHART_PATH..." + VERSION_PARAM="--version ${HELM_CHART_VERSION}" + fi + + # Only set the image repository parameter if we are deploying locally + if [[ "$IS_LOCAL_DEPLOYMENT" == "true" ]]; then + IMAGE_REPO_PARAM="--set image.repository=${IMAGE_NAME}" + else + IMAGE_REPO_PARAM="" + fi + + # Helm chart could be out of date for release candidates, so we will install from + # the chart defined in the repository. + helm install $IMAGE_NAME ${CHART_PATH} \ + --namespace ${MANAGER_NAMESPACE} \ + $VERSION_PARAM \ + $IMAGE_REPO_PARAM \ + --set "fullnameOverride=${IMAGE_NAME}" \ + --set image.tag=${IMAGE_TAG} \ + --set image.pullPolicy=Never \ + --wait + + echo "โœ… $IMAGE_NAME installed successfully" +} + +create_issuer() { + echo "๐Ÿ” Creating issuer resources..." + + secretJson='{}' + secretJson=$(echo "$secretJson" | jq --arg version "v1" '.apiVersion = $version') + secretJson=$(echo "$secretJson" | jq --arg kind "Secret" '.kind = $kind') + secretJson=$(echo "$secretJson" | jq --arg name "$SIGNER_SECRET_NAME" '.metadata.name = $name') + + # OAuth credentials + secretJson=$(echo "$secretJson" | jq --arg type "Opaque" '.type = $type') + secretJson=$(echo "$secretJson" | jq --arg val "$OAUTH_TOKEN_URL" '.stringData.tokenUrl = $val') + secretJson=$(echo "$secretJson" | jq --arg val "$OAUTH_CLIENT_ID" '.stringData.clientId = $val') + secretJson=$(echo "$secretJson" | jq --arg val "$OAUTH_CLIENT_SECRET" '.stringData.clientSecret = $val') + secretJson=$(echo "$secretJson" | jq --arg val "$OAUTH_AUDIENCE" '.stringData.audience = $val') + secretJson=$(echo "$secretJson" | jq --arg val "$OAUTH_SCOPES" '.stringData.scopes = $val') + + echo "Creating secret called $SIGNER_SECRET_NAME in namespace $MANAGER_NAMESPACE" + if ! echo "$secretJson" | yq -P | kubectl -n "$MANAGER_NAMESPACE" apply -f -; then + echo "Failed to create $SIGNER_SECRET_NAME" + return 1 + fi + + kubectl -n "$ISSUER_NAMESPACE" apply -f - < /dev/null 2>&1 + + kubectl -n "$ISSUER_NAMESPACE" apply -f - </dev/null || echo "$IMAGE_NAME") + +if kubectl get deployment ${DEPLOYMENT_NAME} -n ${MANAGER_NAMESPACE} >/dev/null 2>&1; then + # Patch the deployment + kubectl patch deployment ${DEPLOYMENT_NAME} -n ${MANAGER_NAMESPACE} -p "{ + \"spec\": { + \"template\": { + \"spec\": { + \"containers\": [{ + \"name\": \"${IMAGE_NAME}\", + \"image\": \"${FULL_IMAGE_NAME}\", + \"imagePullPolicy\": \"Never\" + }] + } + } + } + }" + + # Rollout deployment changes and apply the patch + kubectl rollout restart deployment/${DEPLOYMENT_NAME} -n ${MANAGER_NAMESPACE} + kubectl rollout status deployment/${DEPLOYMENT_NAME} -n ${MANAGER_NAMESPACE} --timeout=300s + + + echo "โœ… Deployment patched and rolled out successfully" +else + echo "โš ๏ธ Deployment ${DEPLOYMENT_NAME} not found. The Helm chart might use a different naming convention." + echo "Available deployments in ${MANAGER_NAMESPACE}:" + kubectl get deployments -n ${MANAGER_NAMESPACE} +fi + +echo "" +echo "๐ŸŽ‰ Deployment complete!" +echo "" + +# Delete stray CertificateRequest resources from previous runs +delete_certificate_request +echo "" + +# Deploy Issuer +echo "๐Ÿ” Deploying $ISSUER_NAMESPACE namespace if not exists..." +kubectl create namespace ${ISSUER_NAMESPACE} --dry-run=client -o yaml | kubectl apply -f - +echo "โœ… $ISSUER_NAMESPACE namespace is ready" +echo "" + + +echo "" +echo "โœ… Resource deployment completed. Ready to start running tests!" +# ================= END: Resource Deployment ===================== +# +# +# +# +# +# +# +# +# ================= BEGIN: Test Execution ======================== +echo "๐Ÿš€ Running E2E tests..." +echo "" + +echo "๐Ÿงช๐Ÿ’ฌ Test 1: A generated certificate request should be successfully issued by Issuer." +regenerate_issuer +regenerate_certificate_request Issuer +approve_certificate_request +check_certificate_request_status +echo "๐Ÿงชโœ… Test 1 completed successfully." +echo "" + +echo "๐Ÿงช๐Ÿ’ฌ Test 2: Add EnrollmentPatternId to Issuer resource" +regenerate_issuer +delete_issuer_specification_field certificateTemplate +add_issuer_specification_field enrollmentPatternId $ENROLLMENT_PATTERN_ID +regenerate_certificate_request Issuer +approve_certificate_request +check_certificate_request_status +echo "๐Ÿงชโœ… Test 2 completed successfully." +echo "" + +echo "๐Ÿงช๐Ÿ’ฌ Test 3: Add EnrollmentPatternName to Issuer resource" +regenerate_issuer +delete_issuer_specification_field certificateTemplate +add_issuer_specification_field enrollmentPatternName "$ENROLLMENT_PATTERN_NAME" +regenerate_certificate_request Issuer +approve_certificate_request +check_certificate_request_status +echo "๐Ÿงชโœ… Test 3 completed successfully." +echo "" + +echo "๐Ÿงช๐Ÿ’ฌ Test 4: Annotate CertificateRequest with certificateTemplate" +regenerate_issuer +delete_issuer_specification_field certificateTemplate +add_issuer_specification_field certificateTemplate "SomeDefaultTemplate" # This is a placeholder, will be overridden by annotation +regenerate_certificate_request Issuer +annotate_certificate_request "command-issuer.keyfactor.com/certificateTemplate" "$CERTIFICATE_TEMPLATE" +approve_certificate_request +check_certificate_request_status +echo "๐Ÿงชโœ… Test 4 completed successfully." +echo "" + +echo "๐Ÿงช๐Ÿ’ฌ Test 5: Annotate CertificateRequest with enrollmentPatternId" +regenerate_issuer +delete_issuer_specification_field certificateTemplate +add_issuer_specification_field enrollmentPatternId 12345678 # This is a placeholder, will be overridden by annotation +regenerate_certificate_request Issuer +annotate_certificate_request "command-issuer.keyfactor.com/enrollmentPatternId" "$ENROLLMENT_PATTERN_ID" +approve_certificate_request +check_certificate_request_status +echo "๐Ÿงชโœ… Test 5 completed successfully." +echo "" + +echo "๐Ÿงช๐Ÿ’ฌ Test 6: Annotate CertificateRequest with enrollmentPatternName" +regenerate_issuer +delete_issuer_specification_field certificateTemplate +add_issuer_specification_field enrollmentPatternName "SomeDefaultPattern" # This is a placeholder, will be overridden by annotation +regenerate_certificate_request Issuer +annotate_certificate_request "command-issuer.keyfactor.com/enrollmentPatternName" "$ENROLLMENT_PATTERN_NAME" +approve_certificate_request +check_certificate_request_status +echo "๐Ÿงชโœ… Test 6 completed successfully." +echo "" + +echo "๐ŸŽ‰๐ŸŽ‰๐ŸŽ‰ Tests have completed successfully!" + +# ================= END: Test Execution ======================== \ No newline at end of file diff --git a/internal/command/client_test.go b/internal/command/client_test.go index 84fa006..80b3b78 100644 --- a/internal/command/client_test.go +++ b/internal/command/client_test.go @@ -1,3 +1,19 @@ +/* +Copyright ยฉ 2025 Keyfactor + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package command import ( From f24a8f9cf1d9b02771deb459eb9bc74ae042c009 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 16 Jun 2025 10:40:18 -0400 Subject: [PATCH 24/32] chore(docs): Update CHANGELOG and add documentation for e2e tests --- CHANGELOG.md | 1 + e2e/README.md | 7 +++++++ e2e/run_tests.sh | 9 ++++++++- go.mod | 2 +- go.sum | 4 ++-- 5 files changed, 19 insertions(+), 4 deletions(-) create mode 100644 e2e/README.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 8bced70..d58c875 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Features - Added support for enrolling CSRs with [Enrollment Patterns](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Enrollment-Patterns.htm), a new feature introduced in Keyfactor Command 25.1. [Release notes](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReleaseNotes/Release2511.htm) - Usage of `CertificateTemplate` is still supported, but if using Keyfactor Command 25.1 and above, it is recommended to start using Enrollment Patterns in your issuer specification. You may use `EnrollmentPatternId` or `EnrollmentPatternName` in your specification. +- When using ambient credentials, some relevant token claims (subject, issuer, object ID, etc.) are logged for easier debugging and setup for security roles and identity providers. ## Chores - Updated documentation for using ambient credentials with Azure Kuberentes Services. diff --git a/e2e/README.md b/e2e/README.md new file mode 100644 index 0000000..f4fbe62 --- /dev/null +++ b/e2e/README.md @@ -0,0 +1,7 @@ +# End-to-End Test Suite + +This is a test suite intended to make it easy to run tests on the command-cert-manager-issuer project. This suite can test the local changes of the command issuer, and it is able to test existing Docker images. + +This is currently configured as a Bash script, so it is necessary to run this on a UNIX-compatible machine. + +Instructions on how to run the e2e test suite are within the [run_tests.sh](./run_tests.sh) file. \ No newline at end of file diff --git a/e2e/run_tests.sh b/e2e/run_tests.sh index a78170a..3d9bffa 100755 --- a/e2e/run_tests.sh +++ b/e2e/run_tests.sh @@ -56,6 +56,7 @@ HELM_CHART_NAME="command-cert-manager-issuer" HELM_CHART_VERSION="local" # Uncomment if you want to use the local Helm chart IS_LOCAL_DEPLOYMENT=$([ "$IMAGE_TAG" = "local" ] && echo "true" || echo "false") +IS_LOCAL_HELM=$([ "$HELM_CHART_VERSION" = "local" ] && echo "true" || echo "false") # TODO: Handle both in the e2e tests ISSUER_TYPE="Issuer" @@ -179,7 +180,7 @@ install_cert_manager_issuer() { echo "๐Ÿ“ฆ Installing instance of $IMAGE_NAME with tag $IMAGE_TAG..." - if [[ "$HELM_CHART_VERSION" == "local" ]]; then + if [[ "$IS_LOCAL_HELM" == "true" ]]; then CHART_PATH=$CHART_PATH # Checking if chart path exists @@ -431,6 +432,12 @@ check_env cd .. echo "โš™๏ธ Local image deployment: ${IS_LOCAL_DEPLOYMENT}" +echo "โš™๏ธ Local Helm chart: ${IS_LOCAL_HELM}" + +if ! minikube status &> /dev/null; then + echo "Error: Minikube is not running. Please start it with 'minikube start'" + exit 1 +fi kubectl config use-context minikube echo "Connected to Kubernetes context: $(kubectl config current-context)..." diff --git a/go.mod b/go.mod index b55ea86..1db9b09 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.23.4 require ( github.com/Keyfactor/keyfactor-auth-client-go v1.2.0 - github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.5 + github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0 github.com/cert-manager/cert-manager v1.16.2 github.com/go-logr/logr v1.4.2 github.com/stretchr/testify v1.10.0 diff --git a/go.sum b/go.sum index 24363c7..d0285ed 100644 --- a/go.sum +++ b/go.sum @@ -24,8 +24,8 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 h1:kYRSnvJju5g github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI= github.com/Keyfactor/keyfactor-auth-client-go v1.2.0 h1:uNSlyOW5Bqpi0nsOGZtOYQzN0vP/h4S4J38jtQes+OI= github.com/Keyfactor/keyfactor-auth-client-go v1.2.0/go.mod h1:7htRcBIWn+X4fI5jaYBALSYwP84H/djN7d8y3n0ZDQ0= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.5 h1:KiCdQssR8TgbAY5gnb8ShcjMbuzf5y+95BdLqVifReI= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.5/go.mod h1:tAg67Y6koUoVYSYeWelq25si5Dr21UDVTNAFi1pJoWY= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0 h1:lz+0F3d7nGQORK9VOcQFEvhf7OKhhho6o0idPxh2gvM= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0/go.mod h1:tAg67Y6koUoVYSYeWelq25si5Dr21UDVTNAFi1pJoWY= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= From ab17f13ab00a6dbdce7885e992f9ee62a6910212 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 16 Jun 2025 12:57:07 -0400 Subject: [PATCH 25/32] Update OAuth config for ambient credentials --- internal/command/command.go | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/internal/command/command.go b/internal/command/command.go index 1f8427e..d4b5832 100644 --- a/internal/command/command.go +++ b/internal/command/command.go @@ -232,19 +232,12 @@ func newServerConfig(ctx context.Context, config *Config) (*auth_providers.Serve return nil, err } - server = &auth_providers.Server{ - Host: config.Hostname, - APIPath: config.APIPath, - AccessToken: token, - AuthType: "oauth", - ClientID: "", - ClientSecret: "", - OAuthTokenUrl: "", - Scopes: nil, - Audience: "", - SkipTLSVerify: false, - CACertPath: "", - } + oauthConfig := auth_providers.NewOAuthAuthenticatorBuilder(). + WithAccessToken(token). + WithCaCertificatePath("") + oauthConfig.CommandAuthConfig = authConfig + + server = oauthConfig.GetServerConfig() } log.Info("Configuration was valid - Successfully generated server config", "authMethod", server.AuthType, "hostname", server.Host, "apiPath", server.APIPath) From 21225bd7df2a4acd67d058ecb735e413067e6e45 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 16 Jun 2025 15:58:46 -0400 Subject: [PATCH 26/32] chore(deps): Bump go-client-sdk to rc7 to ensure that ambient access tokens can be used for API client --- Dockerfile | 2 +- go.mod | 34 ++++++++++++----------- go.sum | 80 +++++++++++++++++++++++++++--------------------------- 3 files changed, 59 insertions(+), 57 deletions(-) diff --git a/Dockerfile b/Dockerfile index cce20f7..cb1b130 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Build the manager binary -FROM golang:1.23.4 AS builder +FROM golang:1.24 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/go.mod b/go.mod index 1db9b09..dfc7fb3 100644 --- a/go.mod +++ b/go.mod @@ -1,14 +1,16 @@ module github.com/Keyfactor/command-cert-manager-issuer -go 1.23.4 +go 1.24 + +toolchain go1.24.0 require ( - github.com/Keyfactor/keyfactor-auth-client-go v1.2.0 - github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0 + github.com/Keyfactor/keyfactor-auth-client-go v1.3.0 + github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.7 github.com/cert-manager/cert-manager v1.16.2 github.com/go-logr/logr v1.4.2 github.com/stretchr/testify v1.10.0 - golang.org/x/oauth2 v0.26.0 + golang.org/x/oauth2 v0.30.0 k8s.io/api v0.31.1 k8s.io/apimachinery v0.31.1 k8s.io/client-go v0.31.1 @@ -35,13 +37,13 @@ require ( require ( cloud.google.com/go/compute/metadata v0.6.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0 - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1 - github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1 + github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect + github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.1 // indirect + github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 // indirect github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/blang/semver/v4 v4.0.0 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect @@ -57,7 +59,7 @@ require ( github.com/go-openapi/jsonreference v0.21.0 // indirect github.com/go-openapi/swag v0.23.0 // indirect github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang-jwt/jwt/v5 v5.2.1 + github.com/golang-jwt/jwt/v5 v5.2.2 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.4 // indirect github.com/google/gnostic-models v0.6.8 // indirect @@ -86,12 +88,12 @@ require ( github.com/x448/float16 v0.8.4 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.27.0 // indirect - golang.org/x/crypto v0.33.0 // indirect + golang.org/x/crypto v0.39.0 // indirect golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect - golang.org/x/net v0.35.0 - golang.org/x/sys v0.30.0 // indirect - golang.org/x/term v0.29.0 // indirect - golang.org/x/text v0.22.0 // indirect + golang.org/x/net v0.41.0 + golang.org/x/sys v0.33.0 // indirect + golang.org/x/term v0.32.0 // indirect + golang.org/x/text v0.26.0 // indirect golang.org/x/time v0.10.0 // indirect gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect google.golang.org/api v0.223.0 diff --git a/go.sum b/go.sum index d0285ed..b7f83e2 100644 --- a/go.sum +++ b/go.sum @@ -4,28 +4,28 @@ cloud.google.com/go/auth/oauth2adapt v0.2.7 h1:/Lc7xODdqcEw8IrZ9SvwnlLX6j9FHQM74 cloud.google.com/go/auth/oauth2adapt v0.2.7/go.mod h1:NTbTTzfvPl1Y3V1nPpOgl2w6d/FjO7NNUQaWSox6ZMc= cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I= cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0 h1:g0EZJwz7xkXQiZAI5xi9f3WWFYBlX1CPTrR+NDToRkQ= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0/go.mod h1:XCW7KnZet0Opnr7HccfUw1PLc4CjHqpcaxW8DHklNkQ= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1 h1:1mvYtZfWQAnwNah/C+Z+Jb9rQH95LPE2vlmMuWAHJk8= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.1/go.mod h1:75I/mXtme1JyWFtz8GocPHVFyH421IBoZErnO16dd0k= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.1 h1:Bk5uOhSAenHyR5P61D/NzeQCv+4fEVV8mOkJ82NqpWw= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.1/go.mod h1:QZ4pw3or1WPmRBxf0cHd1tknzrT54WPBOQoGutCPvSU= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0 h1:WLUIpeyv04H0RCcQHaA4TNoyrQ39Ox7V+re+iaqzTe0= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0/go.mod h1:hd8hTTIY3VmUVPRHNH7GVCHO3SHgXkJKZHReby/bnUQ= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 h1:eXnN9kaS8TiDwXjoie3hMRLuwdUBUMW9KRgOqB3mCaw= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0/go.mod h1:XIpam8wumeZ5rVMuhdDQLMfIPDf1WO3IzrCRO3e3e3o= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 h1:Gt0j3wceWMwPmiazCa8MzMA0MfhmPIz0Qp0FJ6qcM0U= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0/go.mod h1:Ot/6aikWnKWi4l9QB7qVSwa8iMphQNqkWALMoNT3rzM= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1 h1:B+blDbyVIG3WaikNxPnhPiJ1MThR03b3vKGtER95TP4= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1/go.mod h1:JdM5psgjfBf5fo2uWOZhflPWyDBZ/O/CNAH9CtsuZE4= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 h1:FPKJS1T+clwv+OLGt13a8UjqeRuh0O4SJ3lUriThc+4= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1/go.mod h1:j2chePtV91HrC22tGoRX3sGY42uF13WzmmV80/OdVAA= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.1 h1:mrkDCdkMsD4l9wjFGhofFHFrV43Y3c53RSLKOCJ5+Ow= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.1/go.mod h1:hPv41DbqMmnxcGralanA/kVlfdH5jv3T4LxGku2E1BY= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 h1:bFWuoEKg+gImo7pvkiQEFAc8ocibADgXeiLAxWhWmkI= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1/go.mod h1:Vih/3yc6yac2JzU4hzpaDupBJP0Flaia9rXXrU8xyww= github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8= github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 h1:kYRSnvJju5gYVyhkij+RTJ/VR6QIUaCfWeaFm2ycsjQ= -github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI= -github.com/Keyfactor/keyfactor-auth-client-go v1.2.0 h1:uNSlyOW5Bqpi0nsOGZtOYQzN0vP/h4S4J38jtQes+OI= -github.com/Keyfactor/keyfactor-auth-client-go v1.2.0/go.mod h1:7htRcBIWn+X4fI5jaYBALSYwP84H/djN7d8y3n0ZDQ0= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0 h1:lz+0F3d7nGQORK9VOcQFEvhf7OKhhho6o0idPxh2gvM= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0/go.mod h1:tAg67Y6koUoVYSYeWelq25si5Dr21UDVTNAFi1pJoWY= +github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs= +github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI= +github.com/Keyfactor/keyfactor-auth-client-go v1.3.0 h1:otC213b6CYzqeN9b3CRlH1Qj1hTFIN5nqPA8gTlHdLg= +github.com/Keyfactor/keyfactor-auth-client-go v1.3.0/go.mod h1:97vCisBNkdCK0l2TuvOSdjlpvQa4+GHsMut1UTyv1jo= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.7 h1:/p+LTgYFDKdaVge/JXbigNYipaOvAw7hGl72HdaTlDE= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.7/go.mod h1:VnVW8x+pChhnOWBR1PNYPeCQQjlWIK1bwHI8i8j7UPI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= @@ -77,8 +77,8 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= -github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk= -github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk= +github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8= +github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk= github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE= github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= @@ -126,8 +126,8 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= -github.com/keybase/go-keychain v0.0.0-20231219164618-57a3676c3af6 h1:IsMZxCuZqKuao2vNdfD82fjjgPLfyHLpR41Z88viRWs= -github.com/keybase/go-keychain v0.0.0-20231219164618-57a3676c3af6/go.mod h1:3VeWNIJaW+O5xpRQbPp0Ybqu1vJd/pm7s2F473HRrkw= +github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= +github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA= @@ -166,8 +166,8 @@ github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8= github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc= github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk= -github.com/redis/go-redis/v9 v9.7.0 h1:HhLSs+B6O021gwzl+locl0zEDnyNkxMtf/Z3NNBMa9E= -github.com/redis/go-redis/v9 v9.7.0/go.mod h1:f6zhXITC7JUJIlPEiBOTXxJgPLdZcA93GewI7inzyWw= +github.com/redis/go-redis/v9 v9.8.0 h1:q3nRvjrlge/6UD7eTu/DSg2uYiU2mCL0G/uzBWqhicI= +github.com/redis/go-redis/v9 v9.8.0/go.mod h1:huWgSWd8mW6+m0VPhJjSSQ+d6Nh1VICQ6Q5lHuCH/Iw= github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII= github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= @@ -219,8 +219,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs= -golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus= -golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= +golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM= +golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= @@ -239,17 +239,17 @@ golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= -golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8= -golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk= -golang.org/x/oauth2 v0.26.0 h1:afQXWNNaeC4nvZ0Ed9XvCCzXM6UHJG7iCg0W4fPqSBE= -golang.org/x/oauth2 v0.26.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= +golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw= +golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA= +golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI= +golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w= -golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= +golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8= +golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -262,24 +262,24 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= -golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw= +golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58= -golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU= -golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s= +golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg= +golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM= -golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= +golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M= +golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA= golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4= golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -288,8 +288,8 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.24.0 h1:J1shsA93PJUEVaUSaay7UXAyE8aimq3GW0pjlolpa24= -golang.org/x/tools v0.24.0/go.mod h1:YhNqVBIfWHdzvTLs0d8LCuMhkKUgSUKldakyV7W/WDQ= +golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc= +golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 2651d2fa06c77c605ef9295ef63a111817fe8ff4 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 16 Jun 2025 16:21:32 -0400 Subject: [PATCH 27/32] feat(enrollment patterns): Query enrollment patterns by name instead of via pagination --- internal/command/command.go | 49 ++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 28 deletions(-) diff --git a/internal/command/command.go b/internal/command/command.go index d4b5832..c11c0dc 100644 --- a/internal/command/command.go +++ b/internal/command/command.go @@ -562,45 +562,38 @@ func ptr[T any](v T) *T { } // getEnrollmentPatternByName retrieves an enrollment pattern by its name from Command. -// It paginates through the results until it finds the pattern or exhausts all pages. func getEnrollmentPatternByName(ctx context.Context, log logr.Logger, s *signer, enrollmentPatternName string) (*v1.EnrollmentPatternsEnrollmentPatternResponse, error) { log.Info(fmt.Sprintf("Looking up enrollment pattern %q in Command...", enrollmentPatternName)) var model *v1.EnrollmentPatternsEnrollmentPatternResponse - pageNumber := 1 + queryString := fmt.Sprintf("Name -eq \"%s\"", enrollmentPatternName) + patterns, httpResp, err := s.client.GetEnrollmentPatterns(v1.ApiGetEnrollmentPatternsRequest{}.QueryString(queryString)) - for model == nil { - patterns, httpResp, err := s.client.GetEnrollmentPatterns(v1.ApiGetEnrollmentPatternsRequest{}. - PageReturned(int32(pageNumber))) - - if err != nil { - // Capture the error message which should indicate the failure reason - msg := "" - if httpResp != nil && httpResp.Body != nil { - defer httpResp.Body.Close() - bodyBytes, _ := io.ReadAll(httpResp.Body) - msg += string(bodyBytes) - } - detail := fmt.Sprintf("error fetching enrollment patterns from Command: %s. Details: %s", err, msg) - return nil, fmt.Errorf("%w: %s: %w", errEnrollmentPatternFailure, detail, err) - } - - if len(patterns) == 0 { - detail := fmt.Sprintf("enrollment pattern not found: %s", enrollmentPatternName) - return nil, fmt.Errorf("%w: %s", errEnrollmentPatternFailure, detail) + if err != nil { + // Capture the error message which should indicate the failure reason + msg := "" + if httpResp != nil && httpResp.Body != nil { + defer httpResp.Body.Close() + bodyBytes, _ := io.ReadAll(httpResp.Body) + msg += string(bodyBytes) } + detail := fmt.Sprintf("error fetching enrollment patterns from Command: %s. Details: %s", err, msg) + return nil, fmt.Errorf("%w: %s: %w", errEnrollmentPatternFailure, detail, err) + } - pageNumber++ + if len(patterns) == 0 { + detail := fmt.Sprintf("enrollment pattern not found: %s", enrollmentPatternName) + return nil, fmt.Errorf("%w: %s", errEnrollmentPatternFailure, detail) + } - for _, pattern := range patterns { - if pattern.Name.Get() != nil && *pattern.Name.Get() == enrollmentPatternName { - model = &pattern - break - } - } + if len(patterns) > 1 { + detail := fmt.Sprintf("multiple enrollment patterns found: %s", enrollmentPatternName) + return nil, fmt.Errorf("%w: %s", errEnrollmentPatternFailure, detail) } + model = &patterns[0] + log.Info(fmt.Sprintf("Enrollment pattern %s found in Command", enrollmentPatternName)) return model, nil From 815d709c3cf48544e7c9a652b116321604df79e1 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Wed, 18 Jun 2025 15:03:03 -0400 Subject: [PATCH 28/32] Bump keyfactor-go-client-sdk to v25.0.1 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index dfc7fb3..1c6ae7a 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.0 require ( github.com/Keyfactor/keyfactor-auth-client-go v1.3.0 - github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.7 + github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.1 github.com/cert-manager/cert-manager v1.16.2 github.com/go-logr/logr v1.4.2 github.com/stretchr/testify v1.10.0 diff --git a/go.sum b/go.sum index b7f83e2..c5da4af 100644 --- a/go.sum +++ b/go.sum @@ -24,8 +24,8 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJ github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI= github.com/Keyfactor/keyfactor-auth-client-go v1.3.0 h1:otC213b6CYzqeN9b3CRlH1Qj1hTFIN5nqPA8gTlHdLg= github.com/Keyfactor/keyfactor-auth-client-go v1.3.0/go.mod h1:97vCisBNkdCK0l2TuvOSdjlpvQa4+GHsMut1UTyv1jo= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.7 h1:/p+LTgYFDKdaVge/JXbigNYipaOvAw7hGl72HdaTlDE= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.0-rc.7/go.mod h1:VnVW8x+pChhnOWBR1PNYPeCQQjlWIK1bwHI8i8j7UPI= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.1 h1:FkERxNxOyoSHBJP/vS60DLH0g+f8mKeJd8IUAGhV8m8= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.1/go.mod h1:VnVW8x+pChhnOWBR1PNYPeCQQjlWIK1bwHI8i8j7UPI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= From 46a7a078b1e73e870bed2c9a572f060b5cb734ee Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 24 Jun 2025 10:26:55 -0400 Subject: [PATCH 29/32] chore(deps): Test port issue resolution --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 1c6ae7a..73d2a95 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.0 require ( github.com/Keyfactor/keyfactor-auth-client-go v1.3.0 - github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.1 + github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2-rc.0 github.com/cert-manager/cert-manager v1.16.2 github.com/go-logr/logr v1.4.2 github.com/stretchr/testify v1.10.0 diff --git a/go.sum b/go.sum index c5da4af..cc861f8 100644 --- a/go.sum +++ b/go.sum @@ -24,8 +24,8 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJ github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI= github.com/Keyfactor/keyfactor-auth-client-go v1.3.0 h1:otC213b6CYzqeN9b3CRlH1Qj1hTFIN5nqPA8gTlHdLg= github.com/Keyfactor/keyfactor-auth-client-go v1.3.0/go.mod h1:97vCisBNkdCK0l2TuvOSdjlpvQa4+GHsMut1UTyv1jo= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.1 h1:FkERxNxOyoSHBJP/vS60DLH0g+f8mKeJd8IUAGhV8m8= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.1/go.mod h1:VnVW8x+pChhnOWBR1PNYPeCQQjlWIK1bwHI8i8j7UPI= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2-rc.0 h1:Un+Lch8G/S8oGSIc868ZTeH6YfJcePVH28nQVjMqWQg= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2-rc.0/go.mod h1:VnVW8x+pChhnOWBR1PNYPeCQQjlWIK1bwHI8i8j7UPI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= From de8dd0dbee25eac099ac5b6b74137d9188f8c84f Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 24 Jun 2025 11:01:12 -0400 Subject: [PATCH 30/32] temp: use old version of starter workflow to get rc build out --- .github/workflows/keyfactor-bootstrap-workflow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/keyfactor-bootstrap-workflow.yml b/.github/workflows/keyfactor-bootstrap-workflow.yml index dbaa654..e4f9300 100644 --- a/.github/workflows/keyfactor-bootstrap-workflow.yml +++ b/.github/workflows/keyfactor-bootstrap-workflow.yml @@ -46,7 +46,7 @@ jobs: run: go test -v ./... call-starter-workflow: - uses: keyfactor/actions/.github/workflows/starter.yml@v3 + uses: keyfactor/actions/.github/workflows/starter.yml@3.2.0 needs: test secrets: token: ${{ secrets.V2BUILDTOKEN}} From 96324c30154cf5d10838a2cdfb5088f1bf2e1eb3 Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Tue, 24 Jun 2025 17:14:12 -0400 Subject: [PATCH 31/32] chore(deps): Use keyfactor-go-client-sdk v25.0.2 --- e2e/run_tests.sh | 1 + go.mod | 2 +- go.sum | 4 ++-- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/e2e/run_tests.sh b/e2e/run_tests.sh index 3d9bffa..794a237 100755 --- a/e2e/run_tests.sh +++ b/e2e/run_tests.sh @@ -519,6 +519,7 @@ echo "" # Deploy Issuer echo "๐Ÿ” Deploying $ISSUER_NAMESPACE namespace if not exists..." kubectl create namespace ${ISSUER_NAMESPACE} --dry-run=client -o yaml | kubectl apply -f - +regenerate_issuer echo "โœ… $ISSUER_NAMESPACE namespace is ready" echo "" diff --git a/go.mod b/go.mod index 73d2a95..5eec9a6 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.24.0 require ( github.com/Keyfactor/keyfactor-auth-client-go v1.3.0 - github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2-rc.0 + github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2 github.com/cert-manager/cert-manager v1.16.2 github.com/go-logr/logr v1.4.2 github.com/stretchr/testify v1.10.0 diff --git a/go.sum b/go.sum index cc861f8..d2d4df4 100644 --- a/go.sum +++ b/go.sum @@ -24,8 +24,8 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJ github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI= github.com/Keyfactor/keyfactor-auth-client-go v1.3.0 h1:otC213b6CYzqeN9b3CRlH1Qj1hTFIN5nqPA8gTlHdLg= github.com/Keyfactor/keyfactor-auth-client-go v1.3.0/go.mod h1:97vCisBNkdCK0l2TuvOSdjlpvQa4+GHsMut1UTyv1jo= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2-rc.0 h1:Un+Lch8G/S8oGSIc868ZTeH6YfJcePVH28nQVjMqWQg= -github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2-rc.0/go.mod h1:VnVW8x+pChhnOWBR1PNYPeCQQjlWIK1bwHI8i8j7UPI= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2 h1:7VsZOYgMHAO2a1eeyVgDKel9TJXXYRQpd1EvSvp8lKA= +github.com/Keyfactor/keyfactor-go-client-sdk/v25 v25.0.2/go.mod h1:VnVW8x+pChhnOWBR1PNYPeCQQjlWIK1bwHI8i8j7UPI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI= github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= From 65dca8dc689a671c6a241a72aae8f280d0744bdb Mon Sep 17 00:00:00 2001 From: "Matthew H. Irby" Date: Mon, 7 Jul 2025 17:02:50 -0400 Subject: [PATCH 32/32] chore: Fix typo & fix repo namespace issue on e2e tests --- api/v1alpha1/issuer_types.go | 6 +++--- ...command-issuer.keyfactor.com_clusterissuers.yaml | 10 +++++----- .../bases/command-issuer.keyfactor.com_issuers.yaml | 10 +++++----- .../templates/crds/clusterissuers.yaml | 10 +++++----- .../templates/crds/issuers.yaml | 10 +++++----- e2e/run_tests.sh | 13 ++++--------- 6 files changed, 27 insertions(+), 32 deletions(-) diff --git a/api/v1alpha1/issuer_types.go b/api/v1alpha1/issuer_types.go index bc159b1..2179c34 100644 --- a/api/v1alpha1/issuer_types.go +++ b/api/v1alpha1/issuer_types.go @@ -47,21 +47,21 @@ type IssuerSpec struct { APIPath string `json:"apiPath,omitempty"` // EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - // If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + // If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. // If EnrollmentPatternId and EnrollmentPatternName are both specified, EnrollmentPatternId will take precedence. // Enrollment will fail if the specified template is not compatible with the enrollment pattern. // Refer to the Keyfactor Command documentation for more information. EnrollmentPatternId int32 `json:"enrollmentPatternId,omitempty"` // EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - // If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + // If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. // If EnrollmentPatternId and EnrollmentPatternName are both specified, EnrollmentPatternId will take precedence. // Enrollment will fail if the specified template is not compatible with the enrollment pattern. // Refer to the Keyfactor Command documentation for more information. EnrollmentPatternName string `json:"enrollmentPatternName,omitempty"` // Deprecated. CertificateTemplate is the name of the certificate template to use. If using Keyfactor Command 25.1 or later, use EnrollmentPatternName or EnrollmentPatternId instead. - // If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + // If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. // Enrollment will fail if the specified template is not compatible with the enrollment pattern. // Refer to the Keyfactor Command documentation for more information. CertificateTemplate string `json:"certificateTemplate,omitempty"` diff --git a/config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml b/config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml index 8e967b3..00e7b83 100644 --- a/config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml +++ b/config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml @@ -71,8 +71,8 @@ spec: enrollmentPatternId: description: |- EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. - If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: integer @@ -80,15 +80,15 @@ spec: enrollmentPatternName: description: |- EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. - If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string certificateTemplate: description: |- CertificateTemplate is the name of the certificate template to use. Deprecated in favor of EnrollmentPattern as of Keyfactor Command 25.1. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string diff --git a/config/crd/bases/command-issuer.keyfactor.com_issuers.yaml b/config/crd/bases/command-issuer.keyfactor.com_issuers.yaml index 8c69484..b87e277 100644 --- a/config/crd/bases/command-issuer.keyfactor.com_issuers.yaml +++ b/config/crd/bases/command-issuer.keyfactor.com_issuers.yaml @@ -71,8 +71,8 @@ spec: enrollmentPatternId: description: |- EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. - If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: integer @@ -80,15 +80,15 @@ spec: enrollmentPatternName: description: |- EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. - If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string certificateTemplate: description: |- CertificateTemplate is the name of the certificate template to use. Deprecated in favor of EnrollmentPattern as of Keyfactor Command 25.1. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string diff --git a/deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml b/deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml index 8424d4f..011d8f2 100644 --- a/deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml +++ b/deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml @@ -65,8 +65,8 @@ spec: enrollmentPatternId: description: |- EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. - If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: integer @@ -74,15 +74,15 @@ spec: enrollmentPatternName: description: |- EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. - If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string certificateTemplate: description: |- CertificateTemplate is the name of the certificate template to use. Deprecated in favor of EnrollmentPattern as of Keyfactor Command 25.1. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string diff --git a/deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml b/deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml index e90bd87..8b7ac01 100644 --- a/deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml +++ b/deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml @@ -65,8 +65,8 @@ spec: enrollmentPatternId: description: |- EnrollmentPatternId is the ID of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. - If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: integer @@ -74,15 +74,15 @@ spec: enrollmentPatternName: description: |- EnrollmentPatternName is the name of the enrollment pattern to use. Supported in Keyfactor Command 25.1 and later. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. - If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. + If both enrollmentPatternId and enrollmentPatternName are specified, enrollmentPatternId will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string certificateTemplate: description: |- CertificateTemplate is the name of the certificate template to use. Deprecated in favor of EnrollmentPattern as of Keyfactor Command 25.1. - If both enrollment pattern and certificate template are specified, enrollment pattern will take precendence. + If both enrollment pattern and certificate template are specified, enrollment pattern will take precedence. Enrollment will fail if the specified template is not compatible with the enrollment pattern. Refer to the Keyfactor Command documentation for more information. type: string diff --git a/e2e/run_tests.sh b/e2e/run_tests.sh index 794a237..f037381 100755 --- a/e2e/run_tests.sh +++ b/e2e/run_tests.sh @@ -198,7 +198,7 @@ install_cert_manager_issuer() { # Only set the image repository parameter if we are deploying locally if [[ "$IS_LOCAL_DEPLOYMENT" == "true" ]]; then - IMAGE_REPO_PARAM="--set image.repository=${IMAGE_NAME}" + IMAGE_REPO_PARAM="--set image.repository=${IMAGE_REPO}/${IMAGE_NAME}" else IMAGE_REPO_PARAM="" fi @@ -382,14 +382,6 @@ add_issuer_specification_field() { echo "Adding issuer specification field: $field_name with value: $field_value" - resolved_value="" - - if [[ $field_value =~ ^[0-9]+$ ]]; then - resolved_value=$field_value - else - resolved_value="\"$field_value\"" - fi - kubectl -n "$ISSUER_NAMESPACE" patch $ISSUER_CRD_FQTN $ISSUER_CR_NAME --type='json' -p="[{\"op\": \"add\", \"path\": \"/spec/$field_name\", \"value\": $field_value}]" echo "โœ… Issuer specification field added successfully." @@ -464,6 +456,9 @@ if "$IS_LOCAL_DEPLOYMENT" = "true"; then echo "๐Ÿณ Building ${FULL_IMAGE_NAME} Docker image..." docker build -t ${FULL_IMAGE_NAME} . echo "โœ… Docker image built successfully" + + echo "๐Ÿ“ฆ Listing Docker images..." + docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.CreatedAt}}\t{{.Size}}" | head -11 fi # 5. Deploy the command-cert-manager-issuer Helm chart if not exists