From 7f5b84805c6202b946b06cc99afb6bfc54d9b680 Mon Sep 17 00:00:00 2001 From: kla Date: Thu, 6 May 2021 13:24:19 -0400 Subject: [PATCH 01/14] inital upload --- .gitignore | 6 + Dockerfile | 108 ++++++++++++++ Kinetica License Notice - April 2021.pdf | Bin 0 -> 75065 bytes LICENSE | 2 + README.md | 11 +- config/gpudb.conf | 174 +++++++++++++++++++++++ hardening_manifest.yaml | 121 ++++++++++++++++ scripts/remediation.sh | 20 +++ scripts/start.sh | 11 ++ 9 files changed, 451 insertions(+), 2 deletions(-) create mode 100755 .gitignore create mode 100755 Dockerfile create mode 100755 Kinetica License Notice - April 2021.pdf create mode 100755 LICENSE create mode 100644 config/gpudb.conf create mode 100755 hardening_manifest.yaml create mode 100644 scripts/remediation.sh create mode 100644 scripts/start.sh diff --git a/.gitignore b/.gitignore new file mode 100755 index 0000000..098c399 --- /dev/null +++ b/.gitignore @@ -0,0 +1,6 @@ +/bin/ +.classpath +.project +/src/ + + diff --git a/Dockerfile b/Dockerfile new file mode 100755 index 0000000..87a1e9f --- /dev/null +++ b/Dockerfile @@ -0,0 +1,108 @@ +################################################################################ +# +################################################################################ +ARG BASE_REGISTRY=registry1.dsop.io +ARG BASE_IMAGE=redhat/ubi/ubi7 +ARG BASE_TAG=7.9 + +FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} + +# Set user +USER 0 + +# Set the Baseline Image +RUN yum -y update && yum -y install hostname fontconfig java-11-openjdk-devel + +# Set up working directory for Kinetica +RUN mkdir -p /mnt/data/gpudb +RUN mkdir /mnt/data/gpudb/etc +RUN mkdir /mnt/data/gpudb/logs +RUN mkdir /mnt/data/gpudb/persist + +# Staging GPG key for rpm +COPY RPM-GPG-KEY-PK /etc/pki/rpm-gpg/ + +RUN gpg --import /etc/pki/rpm-gpg/* + +# Staging RPM for Kinetica Installation +ARG RPM1=gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm +ARG RPM2=fuse-2.9.2-11.el7.x86_64.rpm +ARG RPM3=numactl-libs-2.0.12-5.el7.x86_64.rpm +ARG RPM4=openssh-server-7.4p1-21.el7.x86_64.rpm +ARG RPM5=libmspack-0.5-0.8.alpha.el7.x86_64.rpm +ARG RPM6=msttcorefont-1-1-signed.x86_64.rpm +ARG RPM7=caravel_all_2.tar.gz + +# Moving RPM from Staging +COPY ["${RPM1}", "/tmp"] +COPY ["${RPM2}", "/tmp"] +COPY ["${RPM3}", "/tmp"] +COPY ["${RPM4}", "/tmp"] +COPY ["${RPM5}", "/tmp"] +COPY ["${RPM6}", "/tmp"] +COPY ["${RPM7}", "/tmp"] + +# Installing Required RPMS +RUN yum -y localinstall /tmp/${RPM5} +RUN yum -y localinstall /tmp/${RPM4} +RUN yum -y localinstall /tmp/${RPM3} +RUN yum -y localinstall /tmp/${RPM2} +RUN yum -y localinstall /tmp/${RPM1} +RUN yum -y localinstall /tmp/${RPM6} + +# Update font cache after msttcore fonts are installed +RUN fc-cache -v + +# Applying REVEAL Code +RUN tar -zxvf /tmp/${RPM7} -C /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/ +COPY caravel.db /opt/gpudb/connectors/reveal/var/ + +# change working directory +WORKDIR /opt + +# moving config and scripts +RUN mv /opt/gpudb/core/etc/gpudb.conf /opt/gpudb/core/etc/gpudb.orig +COPY config/gpudb.conf /opt/gpudb/core/etc/gpudb.conf +RUN chown gpudb:gpudb /opt/gpudb/core/etc/gpudb.conf + +# moving radar site +COPY scripts/radar_site_new.csv . + +# move start scripts +COPY scripts/start.sh . +RUN chmod 755 /opt/start.sh + +# cleanup /tmp folder +RUN rm -rf /tmp/* + +# fix permission issue for now +RUN chown -R gpudb:gpudb /opt/gpudb/ +RUN chown -R gpudb:gpudb /mnt/data/gpudb/ + +# Fixing CVE finding +RUN chmod g-s /usr/bin/{fusermount,ksu,ssh-agent} +RUN chmod u-s /usr/bin/{fusermount,ksu,ssh-agent} +RUN chmod g-s /usr/libexec/openssh/ssh-keysign +RUN chmod u-s /usr/libexec/openssh/ssh-keysign +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/anadarko_calculator/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/anadarko_histogram/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/anadarko_linecharts/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/attribute_selection/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_3d/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_bar/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_map/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_mapbox/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_timeframe/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/pivot_table/node_modules/* +RUN rpm --setugids gpudb-intel-license + +# Expose ports +EXPOSE 8080 8088 + +# Start the Service +CMD ["/opt/start.sh"] + +# Changing to Kinetica User +USER gpudb + +HEALTHCHECK --interval=5m --timeout=30s --start-period=1m --retries=3 CMD [ "curl -f http://localhost:8080" || exit 1 ] diff --git a/Kinetica License Notice - April 2021.pdf b/Kinetica License Notice - April 2021.pdf new file mode 100755 index 0000000000000000000000000000000000000000..a43667ace2d4a366d636f09b92d80c4109320a57 GIT binary patch literal 75065 zcmdSA1yEdBw>FHs6M{qIE{!|E-Q5BWH11BY039HBaCZ+b!JR;GLU0HP5Fj`NO|ZXV zX5N{(@4WZkuj;S*>Z73goPE|hd)YqEv)7^N)TL$Ffb9I3Xmm}`A51hLfD_jLJG0(pQOoUJ+3LDpb*02lPKCWkV}$(j-D#HORg1mMu}aPzeA&~^iZHJzP3 z09@RUA}Sy^dj%&eXXtGn4#AcHs2EsGj6((N0kVYN6Tl<*D5z@-_6EDDyMe91ZeS-1 z=p4M94;RG5FwwwHmXEeP%=$N@9*yCUa`trc0023ZY%Sf50FU#U0RF1?F!XPFP*0!} zK@EMJUK8x@?CA!b7HX)hvy;ce2N1yfcukfI@SBaY+yEfoZ$mr)puocs)DsyW4>>Il zkOvs5Bd5g=;D3~m(-HvuA)&8kZU?q_xTk_6G<;l~0O;>;%Ia>;7Fu8rBMxW+IJCh& z9>0l5{`MjD+lRt~I~)>DPR<@s2Z1~fx&Yv#aV7w0BrR=0lFmLx&|yvhACL>cFUSQQ zmx8(hb7WyxvM>u79%X=7ef&A;(zpD|q9jlp_G~OY!Yx zc6w6`{(1sUmpt&|aDR-OL-=~3^7M^~u}8I^My?>}L)$IIb^D@=1M)o_ds@G7%Zp&M zc9{lXz!2ZKEWa(Ekkka6u!}*x1D`;IU^Mrkuh&;@{+Gn>6Z~-6BSqgWg(|))U=a6f zv*QbN2JT^}+)O)QJX>=fMpFs&W>z%_ny@1G}+*N!J*-FG5Lhc}t)G(*DyRPUBWiRIIGbA7K zp^sN+x*y3Du&Tbc7Fu7^_=8xUuT9q21Ua@=VXm^m=(UB7`VX!j;AJaPR=u0g2rd=& zH=aRId=bkQil$zw$-4IzxU-~5Zv7Kpnl@5JvBmB^PQvh%9debWUDNFx9b^Lu9%%I?|OkMt?^luLAxJb8w1cQ!ERs4Bu?z9zoz zNhhv}ZjI*?k8OSJ8sb%&igPzs*cR=6xV%)ubw@$o8EVs8-O1Zd5^~R4o2ti8R4?(S zhT0H+snui`lXmI7{~P*9u36Za&mfzIO$_{9Vsvc;A~-(c9Aa13{YLGjiw?9>4l=n5 zNlbC`?*fX#SVylMv2#qogDoh_up+|D+Jvz)pKA~L3Mn9Xa&)T&9w<7x5y2(3F{dlo z%U#6uRlm3#(7Byb!aX;2nLyV%P8s@?(=Mc1lf26x9E>g(-&J*gBmeSrNRD`pa4v~? zb|#-RdK{#=jD)k~wZhEU2wSp{QLvh?WMUCOJtF)`42JO1jOOfxb}LaW;R|wh`R9jg zC;bjujjrd}j>Z((4u*@0;-08O-fwRX!?LauN{B|oZzstyytYqHZ~;p})%;N&qPY?c zb=#b^okw{@Ii7FHb>H`Co&|L;6!}FeT6de2#Cee9_~KCr=D*w$_|b@eu(U5h9`WfS zy8rv#;qnWoi9p1{^Sr5AJ<3$5A3VWWi*}e-i9a{n`Fln$s<6Ik`5+~g z$0JS&RbZh!DQ#C-66`fTGg6}PuJe!Ft9|XLYr4IzsY4nW*0Oj+|LrH+o?5LzwCkvH znH`?HZltE^D7Hd@E<>z1k$^g#l%y=~;)`-4t-W2fDKTUi)Tlw%gwq1t9pbuC*KY3o zjm*!}zZSORRQSCCqGMrs{JTQS3K z%<-($Xo3LaC!P{dv^s+iZq@QztI5A_NREbR;TSzrOpdSngx~vSsU{}HE#JXZ8%DJG zsKbTYX9oT`c=P)+H+#S2x#Q~m(2aM^bOqVe!B^(`2x1(y=XZ(hwKUG(h2aa|B7V*o zu(C3fO}tyBE1Y;v;I`8(Ny;+`Xp$p%lEt1g53CpJGex+2nt=ltH?M^?WHN~#qR?@c`0 zSK$IWT}_IS-`p9mOmCX?BABU|7Fl6m9mfx?S~gYdqfqMpsL&?^XGLyu*LD@!t*+@s zg%WZ@TAADo1`ryKy1LYXUiDAf6ZtjV7C=nk3gMP?^lt4pKhf0Q+4 zKV?kNw#$930>t7_+O@q8O%2-A4Hllg?~uAb?J0pLA$Rn{Xhf7yhcgQsE=nI6*uHu% z(w1BGv=4O4HX3t-+%4SP_DBx?K$bsv!UHn?flH5Y_kideTAt<}4@^cIN1+9kX#kPozLD@?cwQo8K-; zcv(MM1>oi8gR(Q9-%f!10>H;f^?sM+2R8LT zDoIKFUFm_i{Y~lbr2wr5&cEef_CMxd!4eu$TMu70`QKw|34%HZbM@6 z3_7gsET6Wyzz08KivJ- z0{zp9N2C6z`F{(+|D!ekNZbE#`j0d!+dA1p<7VMu1mNQ3Vux~iK29EXJ^(Kd7dsd9 z1SrVPD*#vXLAR;J%lvg6w=;&-?XV%D-Fp-!BvaLEvA&0m%0k zaNrZ<=J*#l@NfeE1P3lYAkX9K{2d&4{tGxLgFz2q34H+mjuSkbkK%ve1fKvDC!l+1 zE>0dk0Cbwa@6#W*)PGdhzn%;KDKk8OW(Eq4a(_O!|MzM6eOv#JX@P?3ADI1^y}xDU zA7SO6vhrUn`|nfozs74QpZE)2^ZbUz{~;y6<2Bdc^1#Xc2VV1V{ySd(-naM@pB~#4 ze@o2oEscNW=CQHyTfhKZ(DM16F!1t1+Yk=UZdxuN3-F)a1rAAD4|jF2o0PMoi?h=M zJ_v9qK)V%gF3u1A1ArCC!5z$@r2=xd2XH;2CC7j6FYrHN%O4!jC+naW2nz!P)0cOy z=7=Vq2R-~h_<7k5+p!1(`;WBp(USkaq9Er6@`WbR!vp+V-{yfb{jZ|(p98_gBgpqq zrGE)Urk}d@Jo(VkVZF!zvN;)#iY0>-Sqw?cJC(*H+2KM(hl~s&l)5=0UI}@8M@>5h zM=8VFrZNR#Dl96X2G8sh=D26kxXhfd0r_PJV2vm0bw46MC|znSp0-@(%u@i+)3Lq; zrTI->W?c*Cc5bhn7F>lWArly+$A*&K$4>zDtKhIZTqu**1JH{0&s-3ARa2RZxYO>? z-N=5JslRw1f-DpyU3}$_saY>V){8=m8uKh+>bDQ|ZYpBkp|&%v$@kI`*u#xa2Yy6^ z(|qSI$|t0pR<}h+fXD(AzTZtAnI^%<%>tDiXE;q>6#1!nR|?M=Me&&^X4 zQ`n3H^mPZnO;`$bt0hjWAO3|=$&FtF*g zZ>;Fx;J4s6IfT{2(t-H7uR@fxT^h>rgFGPc zTPJcM`K^F;E^!|Fu|zer&IM!_Lh1#$2tkKQX&vXUL*P_3EL_Z#h_&*SH?uQ8dP@WUD@#?O%y4Z4wg ze&E>nzQliJJKiAvp2-t`A$~CTS?nruc?(f|$4GoPOG+C2O88KUXk|@J)-TxMW|D4V zbcIvNn@@V7gbsH6Z5rlO9bx(_Xsa6f@&4HP9@osWA9#v9KYYQHZDmNw8;JV}|D1mp znRaENB4o!cqybxs?XaEa8}+GNq0K3L*-+i*(U+FLV7l$PtzRii{18JvAQv}VfFHp< z`5CRvG%Q83j8V1iBzmorJ{NiH1tXST4GYY-mDBG6RFs%Yu0uL_hO2CmAK1&Q`u5@1#I{ zv#4pcJP6%3fb!iCQUk@bceiYGOH~HsjCSl;?XX|>+0gUXQw9lPjkqMH$xP=kJfA2@ zEBkxa(h5T@TVE12eI6fGkd)*u&UMY@y%NhGy*H8trM~>oDLb0AF1p?Go=4{;G@a*dIAo zT#GmU25aN{-G@m9$qM+?Qbg=!3?;-peTq;XB&?e+1dxy>l&5W)Ux7Vs1ZDBc?X%wv zTdHCpmNxLI1r5TJ{hGai1&erksV~m2Jo41_NSL_-kVJHti)bBvFrPk`g-gKB60}0e zc_picMbUML0`p%gZx~lP(6A<4!a!bX#FC%a#?5K-;bA(rS8KX`@fSuzpNb zg!4U$U<39AQigS;vP*|As)S)Avb;K7;UaN&XFR>cm!p+qS6jhm^%%7C_>3A&Tq~uR zmTsB&8_?*NO)T}?KC}D+-0HgL*r;!HOd=98+RrI9gQW~_jXgp=>)Pmw$~td^;o{y; zgw5a|CdP5#83-a{GTB5n4z@$%x`bU##-*e;NN-kc-AtHjo~0~*LBJnQTKs+FgqmhM zkLuiLIzIkQ=bj460pU&B9w!-CYH22w$b-aWiF&89A9*K``PEAghMQ;2E>FchBy*eL z4$aL3ey#3N9l&&|e~|Gg%*@Hb5T)fYjmy*gP@KS#cdGJQ6CU(6c1RG(9kC!UG%0GS zw9RN*EN)ErEM9%S_KhMH;pe$$+n8?l*~KO(y;b{X^FTtjqWZc8oY?sf9ItSE!zu7G zW}j#=(b9@H&IN6*lPnGj1$ocdX!XWfTG5@#;u;mb1@O1Wsw)w-PcK~wR34k=HszF$9=edFOY zJ(>J{e7Ifs&Ah8w+nf*$`u%S9@k(Mn$(P-qZ@nt)d|IZ<2|_I6=lh|l|Dz& zq%+~IVclP<@bwIb)l`qVC@I|2wv|A@POws{j7#JVI$HIA`|dy>ac1O-e45@vheG~~ zo=dQp6hse}$dlA0dgBFHpUPH@Mt;(jiuemo4v&Y!JYSS+!G;3A5fu?;E3b2A z+lU}pd=e%tofz%=S_PNYDTjRNR3kHn#|`gBggVMbk1C8o$(2 zY~#m=mXb#by#D;|>+5q=CO`Km<_f#riCjU?f(}kUHAP9|Z@1pjpvf^6Et>oIwjFi+x?YT%nU$Q~_k&JiuFe)&% zFcvUwFwQXU&_62}5148g0E`~=*bT-Kdc+082?K=T`$GxZNRWn-Z$@b$E>12WCl64N zQve9$O+(9zu6A(a{rgNjm6qZ&P&g5y5vTJ(k%Q8z2*mHBdLq&G>k|>I5n|p!{00S zykC{EstOCrHK>7Qa4ppC^r6UcUTvTbqmajNtth**CrS3#bWiQ5toy z=Ps1cnR_x~RX%bmTB&YP&dR=~W;L(=mFq2&%JlV_Yie^ zQQAf3TO?0TYnph>BEHt^9~L8rPrHNtu2`CD9QxQZUuT{SNg_Kp+@|lS=*83@zBDSy zz##isQ{Ruxrxzw>Zj!jX+>H?UMX4K~n)Jg|kxuZE7glq5njf{un;Zl&ro%)#>|x>b z&aS+p)x03r8?h_#9FDB@b=Sswn+j=f zcKSr>5VS_S@(s;*e8UBgzj)@@R!)wyRP*?%AFh(LHZB%Ym!t%yyESlHx!c8m+MkP< zqqAMCQdIhs&|ST=oDiNqGG0+E?#QWYm<^;VN$JaKA9s5+9olj^Y7Rb?xj00+~3 z|5BfzCDZSOrzSNN&B%V4RfGGTRXw&#-~|SElvl<-uB^wV?H{H0pLbc@d;)*pWCbLQ zI)!rL$XxorO5LG`8>4v*VJ)VWXZ@vatEWRaK%rS=&MNiv=k*dr0#Er9+S*wEqm?>h zaSr}s2f6j`-5fp6gpy>*{wYcxYsUfA1EP4TH!@`)buD?r-E|ol?@?s5MOYfXM1O z?8Q+F6XSyBmzE?W+ad%Fso%>BYWCGaPH)so$`d~#R%l)Db9P}CX?-k?%0rwU(cn1{ zrFMMt)Ai2?xAb_Kc|j|lUIQI_kT+OLfi0seEk1q!@Qr3YMeCt>niuOtD%RLvmXn-zo!QV zj@yAcukQmrgtU*SC8P{w8y{(u@yNjycR$KPD((k_c{^&FlIp@-E!u?`9>#}3})lcZtcWO-rNrj+z^W3{;Cjfn6 z{0lt9p@NZI>tb`M>H4L~JVIUz*gu=idikV}2j(4?5^vL(v(x>0$~HO-dmApxRRQ>f zT5H$>GZ)^t8SbUbUw5}(p}idEdPz#(G~twUemesu zvL>nI=qA8ig0HJF?;zVys5&KN`y6OH!4(~Z!Rfu-@h)YH(#g*erM9s=Enxa)tN5TC zTN-Tkf@O<;Jh!vVca&h65Z=#4bg-ta#rJOCTgh}Bj?V)7*<90sBRZikM(xufi|wDw zgkw(ky>~Z~FTu?)(jC|*HP|4 z7$Zf2i#HQQYzZdUbQC|I8*Zu~DldV>>r6Dlkou}R)vJk9SA^y8^7*WP+yPn|^T-4~ z1+pN*2j}E%^JLkAD>M=MXD}$eiV{h~(h^=6l{umD9!$EVANDAWths_wza~Zh%IlD- zO?&CSSe?WM-b8nPx)7&)^m5a+QEzhCjRVm5gKZ#XL>>4UhN@tm1^O?9Ef2 z&?Q#Ld3TXYG5Pf5QmVGGfjCY5$Gl&3jtXEjv#KjNWik7ub00NK9M_GnS8A^pVC=!o z68*&IpXW@UPu=ddafJxfSL zTC*8|cC zM(-v4&Ud5!pbK*2Gj~UeoY6o>iuVLAi#-<;-$xf3CKuJVDAiMs2fw~}zt4SX!~UZ% z^q_C8caoqLiyGV>cxTXm`r!bld|z7S_UDZV_J#N2Cm&1~RPXJMnZK$(wb$yOFbXg(84!-x?32b4*^}cDB$TRrrA4U~CVFshj z5QJZE)<(N84$?h;d(W{>P^%osFSbVrj}ZN<%5Nj}K8Ctut?q6v z;5f?kjw5Q{HtqCijw(ztsVt<}9APGkuvZgAxr<3;3X63Dr$3Tao3xGJB_TWrHsXva z{ep_+l(;)(z9i&d;})V}j7F#w(2lQJ>?SO6e{}JYBk&~3^wGliza9SQmbwxykxsr0 z_;{Ve^eSjeRBObY;Wjq6RN*LN^-}qZaLM1~ADsJ5_3paQ>9)%6>%Rv6dfPw6{x_p| zlNQ~c*f;B`U-YGG2B(7(%(IF5<6B59qwhs$%sGQGqKT#@sr3Qy4(gcrJ+RwSG-I#4 z^pTbgyo_bDc-e)WY>YKlB3d-H@|c#MSTpliDF&V-jnUkOGqO4-j2MBQ%=Ac?`*V+l zA_iP0y(E3 zF6D58sS$*yV;-zw#0JcnJ@gH>l`)>R?;Ysc!>X+3>)7@+yy8X2u^P7Zg&OKVR=%8l z84|$Kbak+E{}Fv7LD9E{Zj8eHeT%d_U4#tU*4M#=Sm_&NZU=L zQ`Q>n@X|ISM($R)`}a@IEbF!(ch)gFR8QW6SG%_ctWQ^1!0tDfL^u3Lz*@bDG%?5B zq~RFM*k5h0oA3wYNQFzbI(92QCKGIeiwpPZ-qXloa4@qHrHId1jgQGU(K4jtZxr^O zwV72J5)kESe*hQs01Eqz7cJckGqSj%S}T|nhsMWkY$(iZ+%l%L1qI?h&Cr6mF(+(? zvfNciZA-H*y0Vn5NnmNXxRnX45>Mq@7iY%l=lRThq*_})e%pW3XHi@`MlI7wq#)me zR}xt^=a!hro6ek-9AzZTk}*=(#okmgX3S@loDOTk%!@Qj`WC+Pw3s@aw{U~k1p5e7`J!ROU5wHy3Vqrzoa?2MW&RbvsGn{ zHwce!ZhmY2g;d%}27h67q|ee;?~vBrii!+OZO?z#Ys=j%+&@;F1dB;8hU~saQbfIK zK2giXz|-WTB0v~LL6-g43M(8u3I zu@iR$BrpiWBh3^`Ntx!BW#{gbY;KV&a_fw-Q%?0tB#(5GpUrt)1fs1Fu7=e~!{kmd znO|N=;P~YI`nMiuE2cx{VOKJ>dXaHZ5N;MkkW%MwYmf_GXjM-wOe{R><9 z@_ifKJ(akRkOfG548U%lN;K?7rmxb9mxv>H5nkB$kR@vpcahbpqfcO}=4l7=LhG9} zJ7%ZjV_0j{6WTpRz1t~#CRIBrBhXd6;Jw67Dxn~<19 zvhN#3oM@P#{N0hbab``kv{M@l7VM(c6t;K4gMQcdHkH9Pcnfl&j)JO8J5yNpB@fAL9=~o-#NiFd0Dp@Qw`M|zW=FWJlfDTok zm}9~|jlQ=Kar`@JpI66RYjnE<(6c!|WJ`iNa z_{1N>B)8|fP_8}i6NR*+dTX2rqb{Q^qj=*uF|5eyIMX@guQ%g4Q901BD7U;G`7FO6 z-4g5~x+c^o+jms9i>d7|x@IWJutw4+#O%TgVgq5WG4~}ySd7C&1~wtH5FN-U3JWR= zN-ACoehO|1UJA}rd?A!56m(Q{lvJE0RLAPH{D>&jQ`A!wLR@y*F}g-PcEA|b82uP^ zBaRhb2C52#7_tMgg_J{>Aj1$@y)#Z}_%;7N+K^CnwK5uI+8I20oI(6S+(EoS96OY4 z+zM13$VZ5xBw~J+x-27IH1z^19mKp(z7M6(MG`lEia;lV5r9GS4f+!72TCi1Op=dE zDddB(hHmuY2OBy|JT8D24$57g3d#3~SOePyrIxx#SH5Xh<0aHOa3co29cWKfEP;87I0m{Ht9q5*ga za5OIwwy0WAJ0X;)r6>%j;y7Il{tUdMUCFWos_`eJee;kYye?`o27iUCkSVFFtYhLe ztv&`w94e)T-@S`W8g38+nY+waI15TVF&CL9fK`T$?MOzcj=e}mxto|{thJiz2(*Fa z>IlUFBM3jLv-)fe{`10-JIQ2nx(>xFZk-DT=1a6SaGw%{211C+q29V(zAKJ*_bfXo z)+KG}x|5~giE9L!h!Uo#RA*oYv#`8Re0iG*W~aM-P&`NH)4V`b^F+~&A8XB^sW#FRJ3no`{?^HXNvcj zwmp;FY1X`}j|~TqMp|=R*z!LS%)M+GB$$iP-$u)fY*`}U!>pSl@S-q}VR1lPXI5-a zaC_LSE49($A2p*T{9U z*YXC^>>jD}=T*y*6ENN|WtywI zcOHdI0KxfWS&(D^;yHLGb?W1_#(c!^iQenEE0%QLyU2>!*ir9FugVI;ofd~7#qbxK z$H}}bGUtl$>(j}?x?P=`bp>{<8`I>Y0;S_-xr8Fy7o$$i04gDd0 za&vvTfT7A*8FGFvGMUgHIkBST;X(sWlM;UNa=phRv*h!hD4;a_F$?>6XJHR^#>B0BVilpw-wEp-Bzni94t+5prgn#}o z0J%&HeO^y!uULg6}W<)y{j_QmfA8)bHAw=x&>ey%$sbzM;fR^Ci z)R5&v5Me$%yR_U`)AO%3pIw73Vm(tVE@BO0pYAEkH8c$a`-R4#U)|vu(%!QiN+M4r zkC{Un`k5A#(6qX?pm9{zFegNRSmqhs9P1t}b**n7V=)#>GUPkQEO#EuJOp9pTQb}! z!#UkJL4}jOapJG$qu?KzQE@$RmGoQja~;|kxLDYz>tlvTk2N4@0Lo$vMmvK2yv4ifReq!nf%0Kmo#RTVbQe)jY{HyO}R^ zGusy`Q>)q0eL+7b08g*%TJJgWO(?KwUe$|vPOul~t0+Zi(QUtPE@{xo9ewX$5?QlY z3%jmppXKU_$?kf6(K0YM){YhHh_i?bGToPZ!Kz<^*9iug+^>1CdGBgjy(^UaGjztRV3BTeToMy<)2+ zxb+cUfnDyf6$wNR{LEVXBdPtXm=BH@^--AL*XJ#i6g^i`-*2;zQI69YWAxlh>0wxSHO*WBLxvpiu8M z(JL6e&)e2T-NAyZeIiFb?wxV1cUZY*6BJ_#KN%-Yi)Z4BNn*_xFTWC@zr|;mGw23?gCmM5{eqwcZg;Rc|o%k9zB@CGJGgRbgag9BB*^59Q z(k?#ZoUA?gO*z=l5C+|nxddeRlr|t%(bq7tjYB3#Hgb#AHaLL}@~WP5g@eZ6NfZca zg?}UM&HDy~6zD&lwsE|NFj=JxBy`&1Y7T$zsy|7iaeKDPlkz_0YjRM|XxN%V%1~H6 zs1k=QooKSx2e$;Q!1@Z66Mw5$;pb3alztG=A+t%h*L;dN!dmU;)6UYF0KKD)_2;^i z&!yuKf|0Fv&8@-@e(bos>G*ugrgY{{M|tqm*lYS!aP-0-p4qis0Qo5N5^Q0Hm;=|_ zsqRne?SPx4j$#2Kn-Rw{^b&U3li7bIy15CPKEeQGe)+l+238=Td07e^GH1pJ#MY@K zv_GGv8#$L0O**?f$nN(M#M879?sGUg>zFIt6RqTEJSRIC9yFPQ1-tbIx&}VPN-!C`Ix-RDrS%y z3`atUIFWU9t7dAksuUFGm1Rd)kN5!tRtzj(tozn6kgBc0ROia1!E9;FT7OCGJ2f0M z5~`Zb!6JU%a_kC{a!oK#*Jb+v5AUSL8^!=0imm*JWWOm9_90Cl{8CJwx2U4^axU$g zd@?haAU$9DeDaDgnJC_lAd{ai1$}_*5Ar}+FP{By+Q}imnO=wJ*5%VW(b(_=UPJe! zr_}oD5Sc12hKgraRxcXph`$IO$hMR4uu9L^Xs#!WSrsah!fp*Pg5_5RaKcw$HR$N* zsNTFn{ADaEZ~f_KAU=4hC4XnGgY#9G zqxSc)_pSXbT4#~g3u1G8+_v&9#uziU>6QG9+H6|VSin);@BOm{Ww9utE7wn}-($km z`x__A%7??XeBNI60evb2?jF1F9)A(E(s%pmyfy=5x?1lP7B)(sIUx7O>#AIa_iXaj z5J`c4i|SzH1(~U`+6x6WA*|}s_{A4)4x%k$QfRILByE8vYzB)lEk)ohi1es>!1F*S zI3e1s8rQ-PKPp2OE4R@_8pRn$o0C-RO?fA7pGjI-!M)XYJEEg0s08oym*^C=dCP)z z;*1;0Yel#V#`Jkwci%CD&tgPb>*+MAF{@DZQF6&1}@mo?8OZ|`UeZg5y0l{_hx zX~{-1QaHj+FKjShnU}FjIhpK^z4WL5^kLjb%~WdD{k`O`#6EW%1dU2!yq(d~YivH+Vy+ofzBR)OWyHs_fRLgb!RL?s<)?Pd@S)OEXS}5d_VB@BIuIisU)gmK@Wk{+B6r?e- zc`d?oA!gVCMswsN|3Zr4cMs1y zJ&iNb@_G#Q*QXEx0UZ~!BlAOIkfT|=BKr{H+5|`s8R^u;CC`uenj72nWoB1KR#BuX zaDA@Ei&9f=y}t*q+|5~2uK2j!GIYCWA>>XmIN*5@lT`aF(gWNj0nR}ttT-p#VOC0+K0}2BFL0tT==weVXUgYJ=#`-NeQI~UcaXW-Z+(xTTTE=E)_=)p2#aE`E zqr=v1u;?2;704e{FX#C&zv5U!g>a0#?R-EgF*8ei#qf)-M5_eN+Xzy;Dn*h69=qY& zhGhz4^(RjUxwuX(*xuNAO8e_O*8sWc`IKj`zRnxHJNHtFQ?4D@ntqX7)rTLB8GDuU zn$M7JcvUCyTk(=oa_Y;KP#*iMZAa?F859vLX{_`#+MjegF!r#*Hpf$VgB!gWJ~4T{ zg?)Mb!5+-=+p!k!3PlBlgeY8q3-CdXI$g`AhK=y^9HJO~AGgp)bZuh44DUOdrumOJN#=%0WlWX= zR<6oSiZkT{!0(8<+K(>YBcIRDb9*Ju&F5Z`t>)f6KWpC4?lpH{Bg_a;%VJ%V_0Oq* zs4TpaUOPUFjy~>jT9fgMC-2jur!Vsed)*e;OyD*@besu0IWO2@;dQ>~c78r>t^l%j zt++gUN>QTD^%R$iMR#bsG=@1^w=Fe$ZBZ#1RFai6)8V5c-+1li1(r68G_27rtDO_< zH2U=}(t4Ih)$=GbMCPsD@KnV#Lvf2^=k+wk*8s8EjqetDOWS)cD^9aGL?S?ALy@%` zZ?W4r6f0qB%#+e-WO1QiPcgn+?4G#h?S4*<-ysi6ag+_cF}KK&2*nN??@|yvFBTGt zv66K~6+@Tp*_+{SH_S{Xux%)>)X)Ha?yD44SR{!-gTDqab@Le(#tQXtx#k;*4qbj9 z>q~Q3iP)#7h@3fjn^OIz#omD6q`c`Qwrh4WZt$B1?WAg6r=yFSL?&qxn z-{tNLV=xSxtOl`9e6p;!Bqq^!L?+#SF2#$Kw@8zxCTArPyv1Fa{~)>EfQR3(E+u_A z9q8;7^GSCij8KV%UimC-1oB zq#?OGtLlYB>Gs66#^BFFQf@Zwg8ZVqOShH|8byG_a?Cl}23}cSR?kp64mPHt+L(Qi3=YjP@I<)JZWazdo>6ezN zMFKC4Dk;_>r3b-zYAHgmkKXUJ6QISkwjU*@7a!Gy&)fNjv+cO_=tW(2Tt|)k408~> z)ut!)Ss@&)@i9LaIXaa}%pR$)@{CHEv2O9JXC5kP;$V0EHWX>UC0^?SX)ivyGjMKT zqKUGu%rIExls>3dCEGcU^<#|{rW^sW#Q4QcRH$i@<6v#vVBx=On^ruVW^k$!GM)Fl z%4uJAiX+?Mjvmna+<5_6lK-N*P8xeQ?cXRT#6|EUb<0#|_+>VuOkJW8?OjhnEBt&Af=MH~6;@#?g_zT`#P3X!)>EeUX%CYtMQ8ViLjlhFdFh%8&b-rKwtRL5BZi?BhfnCwL%cL!aW zp?9)-GpO%Dimd?VCOc2v%^A?n#hJ_Ul|fa*Ah_=BmP0FmgIWwozf2-dE1Mmkfg@P7 zkf4!}ox?kQB0dm+>S3&xzGYliDN3hUGg+FFEI7oakDICTQ4047bkA4Dqu++-|OibF(%JSj#Qg9gQ&>q(I)D8wQ-dmB&E4@w zS441<1wR^|n0jbl(bSI7=DfSY97EQ#3oA0m2#n%2%L9Ex7`z*{cgFvM5Wx^pxiNId zYCc2(+f{~mm6^YQ`%^xKcEPapU96qY_%usUiCDozVXh);l@jNd{eZ8Ohk_?Jtz>$a zu#5v+UQJC$`zM?(hORG<@0RPVk9KT@&$G3B#u>IErq@Ek58BI-OYLEvjxqWi1mu&9 zl{JwVG^{he2UOJ&!PmPpDK&8kbq;K}0VfRhUsrOywVtL4ev=k8NQfI_mJn8!1K$v4 zLti-deY3`8eguQkw7#C;9uMgaT3D}%55agXs~l@EZKk%)!thA4E(=aVH?9qw$?zCS zZo&=2K3DmfS7~N1cE}HV^RajZ*-utz_oBb#B+czHhPe2cPS`K}vbahM@>`w~dhfAu zB_tV~`RwjS2}NbK(_ggS8se4mR=mZ!G1Y#7svv*1`&R5`-YpwK+a!UVlukAP7L7N6 zVba|Q!}2p%>|3A;CFZ1x_sFY{wjQ8Wk40(mWu}_up8!AarVb(?>En(HL`@cVZt~Qc zxAPnx9Q1HpTCny-aIhG;SCH9T`t+vJgx+6zW8RE8cNe5-rGm&!E+qT<&R$S!mgkqn zemF&U7_Cil&xAxK#t~9D@EI&YG>MD^bU@lw(v`zojo z*t3WgS&7)iKOwdx^IIB@e(zkq^xzMU1V?jCW`-0=M2x$6B-6gV)9LG*Y)_S%yo`_% z;9v2_EM~o|=YbdRf8gbZ`=mOnIi9evddg%s#W&wo+xjK#N2(&?4k> zy^zWMGRNfJ4VhdtHYJ?^@iTs&|C&Lgp1G}PRSMJzd?Jz&`1&v?ODc} zU_n-5z~IdaIsU_jNSV@kOmL{>dno>66#gvh4#UxHy!HpeO0UxTMLA=&RB zF6`x*a9G=vd=5Ja5G0MAMzjcpy_S_ATHmCTR+uLhHHmTL8po?eq4?&9wmO9d;y8+0 zas1Z+IQaZ2yFyrgaf$4FLZvOn`cgItA(l(Ze?ZeBMu>Cs!bNfk`d(QGZJnFr{}A(5 zFD@6+DMltDNZ>6ZxyGa{KV3G<^hznhM;Yv0Fi$<)Rjq=SAe2l3Q_q|yxOl>oXCCN} zOXxA|U6pdKZ1wZQvoYuz@LXat9Rb1NxvGS(UZ(WEibTm5KtyOl@-rb#*bAI)Q&#Mh zM5%DtnF6VPZ&rag8z#b98n>_$mc8b}hdpeT;pJaq;4aHXO;m*aRyZ56F~1^yBe4aWz2EeP=8YzP z^`{CMA!0;$&vt53vFCN4=lvwD#t6)-qN<8L`TuE^i%tH18T3 z8FHgPs4j|u+_(-z&9fkCLe|F%`JS(Fe9zY*-vdIVY_|*A4Y_YgZd`?}Axl#WnU=#}y=_0|l}QT|VbPGU=2(PhBkFF>>5o#INZ0f8&=U#*Wb-em}p8dT)zka>*w7GrM?2UB(_UXofoQBR>d zJ%Cr%PJViCv$0_yWe9kj@^zG`{6huX+Iagd$&P?VC8S84pybT&eHm6+zPmQv@3C%Y z{$PLO=3IlEvWDBdzcO2}pP6GWb@_j)Jt^oP-Pitr2Y@B@Bg5Z8y0B9h*c6+RTHw}j zL>jw8RGED$LliU_EJL6u5FPYobRX8#fkZKHasm^III@BVaQ71Qhwaysp z^d@pUfJ98d7PbRhup_qf2mw;^v{pvQXVLVuX@cSmwn|1oY*eRR*8-|xyFz{qraN!k zBDp4#K#fR5I3{91g7{%m`05KaEw%AoO|T=$3!Z-;@NFN6SV6=M*@aUayKwpf#ZJm6 zP4jNuvDmFwqYQlQ$G&yzfo~pbV=M^|Tm-Ua1|yMD+DuzxtUqd@(Wj1n{^sW7?kCS+ z`>Xk4?rWoK(f!vXqaq1|YW)?e@rD&aHQcG6g0IYer znvg39xoU8w(w?hqe@4oj?a8)YR!)}xo+dTvc&yPv6Mwuj5}OKQz95kTWR7a z*bGjalc5j<*!+|kgBm+9_i2@uSulNt?CKo$fkI6a1g(4WWoquh!mbgpoi;VPiN%_!?H|xl4Vr3NmV_HGDMS6Jy0R1 z#SGUm!qbm+on&4iUMuhMd3osOnF}2Mp#e2_1mjJ1sbH3-W=N@}!5wb5U^-OvZyc8q zZL~>*Uz5^Lky3L!l+37U#XFNRw?aUO6%w>)HkYRvIYkH*t{{3D{fgVK0tidalz(Zp zqHd`Y{6_6}mdC-&X)yB_I6fl^*_m6WB#aTBd*IfC;{SA3%-AON0_CKjYNt_-nt7dT zZd{IrsWa0`+A&MYmsJvVYdVs)Nys1L-zO!OWU#SW!zj^n<J0C^jjy2-|7666U#b>oZFqa%xQCC4B>PVmf35+%}N;=TD0ip zXvy+^qyQ=XtQh>z_GXqT5r{roS<6~SCMG(>+he4FN%$0&XgZKY;Fx*-L zG&q)RXsEQE!Wfrqs9>4O9fFH`LO!o(VflyOt_}vment9I>vP98#MbJRf+rgH7Pizmpx4mtBqaoMPuqk4b%7sF?G}qGQ>AN{Ua9h8-G0+iEo1JE< zk=5DU7ME4!Uw3ZnYf5+0(UfgWK`e3CwYLd`JcI<0HstY&Rw+m0C2Tt=n1a}SSuvua z8XFu08LKkcv01b~D`5+!UU@OYal;w7bu~+ts@yQ_uF_>HC<&_K;z#_7I+EF|S(-Zd z;8lf&LWNe#K|>_9^V3_x1GzPB+7PhX{054##5|sug>m-uTk z2ELmIn8bmN=T5$k)z0M(|g8;_ruT;OAjOFS!{gT>m64=hm9j5fa{JR<46#- zWa)#s)codd$ZK$5@N=kMJZhLEuF^;9Ke8~f9{nl9ZC2PUqwKu zn|R|DZpjctNm<;9~}AVjT>Wh>&uHN=1JI#<|oXUWN!<8Dvf z%qZC=Hol{=`lHxPr}`pVvxgGkYK7dHSQD?vve4iLvJ??GDbhCet>+}4-GAR2xl?M= zH{LdNBE7jQpujg~J6iXCV%Oa36kk|T=v-%^!P473_pRz3;z0~G1TwZri&v&~nVO?U zn~~Rn)nlcNL5I<$lW84#PFrWccRWLqhHR+ww)Jt6Vw4JAL*%REVdO64)C_WL-ylAV zZJo)d2c-Zwjc4g(TXGP*j;Yzrv)GX=b*%W_$cA?cr}77&b|#Q(7)O=pl%T;$B$t#JPnm7`SOVL~diu^|)UR+i{Rn-KGX*88iA&6bIb&4RW zFqT~yRBu>&=v9L*wfD(A6OWEZo`)h-t6qq-sO@^CP(XzXD5j7yLU!=@ZuCMlZSm=-RCrBDtMz7F!FIPy2R*5#Mc$Jf^*#r**d%~)ydPxe z7s&$%3o4+;DshN5WiDZG&tDX~HA|@+y>!NFBBX(86b31v zz=yHJ+s1-dwvEBc{Pjw^X;%FI^wC_h6}TKLx(xW)+sJ82h+p)(=YD5u8SCtt=!?lf z{K7FpBx&A!r0dx9@s{@6|91bOFYS)Ki*Ff^<)Q`*eLoV)jCDFyI+alAFlcRBnN+V+ zw4V6xoyWd^wzuo(Q`_wO?{K$`MnM!ZTzen;EXWhB$l;1kv~t7*lSC}wp=MFbbYsrQ z&dzTFuwBf?^7f)UUv2hCzzlFXId?gEnd=gwZtQOscj4B@p82}D7I1hj9{VgIqCgfg zICUnkk@>Qi3ngD>%n7$UZlMpUR3x}{&|Nw;H~ojZo$+ENdowOg#&Gu zlU(KmfjYzSrFBabbr?(__;6CvRru-^Fq`05au>jCrF@T@sbDsO5mFw1NE>c-NgwCq z^An6EzCftH4QIER+M9xUDUON_alad6T6g!Fyl*Fu@%%jrLp+hTH3E#cCbS&JBhCo~ zA|bBywE9<6MQQVcTf&4;EM~-F5Up1SguJ#y&ygn(CGr&VrJ2VcKll{X(uGswRQ?MtX zVh2qHiI@~3<>nFz^&2aAdPl*>&l_@_Ca-Wh?BG?J;A!||h2r9JY=&?3Vq~vr`dE!FCkEoDekMG_nn{E;H$^? zHfzOJSRZFAvL`4hO=^^XRYhLq3*gFAZ#ACM(V53Zx73i98dcZk2ew4O-vS4>#C^a9`$lto z>?3{yY-b0uWhR$%j=JHoi4jH%@fWq$sdOrlOfn*ZCbBsqKbGno^S6oL0AVT&c1?2<#6YNmuhgkvk>f6_f_}Di zbU2tZ&@vH0yc+{T5#&cdvM@RIf$x{6s?n#wF4yuZoy@l~!FN~a{xpX)5L#mW-D~9uiA^0G6-_^3gWuUQaY z{-Q^KT|a?5GV{O#yB?o_aq!USXnSb`%w)Ts*p=eqVLQ{l3%m{mp+0OUjvRVC{|L14 z)4dZL4naN0PUQC&$BL!A&X_5BAd^sbQvgM-NjntU`0b!2Ik+4hp z1foLLAw%caAeXT3A{1f+zPN7K4sD|`78=f%pa-_*>>;4}nZ}q5mCd3jFOrRUwrJqo z@RciL@+(yx1LO><%70wCc!=MCW)@H)8rXJ0;1YY>*FBZJzo z&q@nPjFt;z8ndP$hQ80T#7{j*n?zzudfW-SRBBIrkXlV%e9{q7v{dUd#=L}p1R>Dj z<|QWR=OlItxo2i*D102sX(lulx*33nXD?DA@XBzf?Vj2ihWSF=-Ih6?uSjj0B)gA5 zPui8+n%@X7`g+6m3``r{`DC#w&|2Dn@q+Tqb!>hOTQPZqL!E)y1*k|9_0FrvqHc_#AF$pVR?!OP zEtM|GJIiR0i-Gu`Kn@y0x@T-QS1$!q&yc|d%{`Nh_V=owxp(ATwPbF{lU1$MZ2Xl< z*z$brjDr8EDnXnU(e6-CbKTU@)*Pr$9nO!LAu5?c&;;!I7;;NiJUSYS+H5p0lkL%H z>j4Opr;d%s;EmpF>#dxSW_IVs^IPCWu{Y*w;zi;d6EKzIt}hZ5k2 zwc?t91x>Y(O^KHX2BjS%2mL*H=c0oemwDU)RM`7hTem+}(QH7aw zxscT4B-6VwiNM^gl`{jgXf8{Qm$La}zPVW&hMFroG)b0EvzZ-mP0DH%noBHx3%_xEIP@BRL>3f|vJhBp&qMk-s^A+imgPP}1vi z1Nl6-xRCC>*Ch2qZX=#|6xGH1fm+TBD@8uH6R#54J9tb~N4_owMYXQl8xQBpsp!LL zPRK%8r_KF9*5z-l>>rRz@#o!;OR1+`(0)(x_7S$%3)L&6fqL~0tr`AegtqYCRj*!y zf+KoQ)azq)ugOAP^IlV@>s)EegImKADJV27W|s;CLV?`V8d$fo2_QIPDnEuljsF5^ zM+T5_6shcH7?j0?c$2G;EWA*_Z3VROyPq(qo|tmDeq7(m3_;v`(B1V4_w z%Dr)mY^LnG`Ulem^!m@9e{^fti(MGeh00cY{I>Z4EO`D{b(IfTf>z603+ojCAfVM% z_F`30MjEaPG^VR-16myb2xy9}t((FgcGl~a;+3E9r?v8ZT2*StgKL8W8b+0j{Hl0t zIM{sTTSssGn>|s5BW4Rm8-uPudglWpfsz9?DKzEp4fT1NJj$UQ+vHKT})hNR`WOl_yde~GjKTrfVBunx^)+h!1{ z6zPTZv&3gXMw&&4Hx=n(KT7hRiyr`R=HJ}YWCW1pHXV^D*a!`LD(N3 zJbb0f1Syiq`ZaOSay?EB3wnz&UCl?AQu3X5{N2qh`$iiSknR;QLMD`->~3D$X!3M+ zuJKk`dS9+L@23quo6WDMmhkk!Ltoe)qLpfiTxZi*S&dMsQ)&~#nf1U*We zTczx-Uw^Jv(in2nwfE6akpqYZaUk8*J+xZv`-mCQVB294g`T{SHOTw;!M|#}GQV4P z$*-0@Pe27R4fHj*N_JxLxK-_I*R`~*TiaS2IevnY!Eu5)#EQ*LeZ`gxuOajV{-bK& z_4XNxd+y48*Grx>|A14~tLpax&1;bMO4O7|G$>7@G=)kKlqLWu*$$6T=;de0AECgt zXN;Mqt9O?_NMYq6%a>z;>7HU9@1NFaAtG!Rfhkz2VifLP`5WEL7NaemEI{h9`T9Wc22 zY9dl{0;=q>u8R3X{Nato1kLqgLQPR0=N8`xD(5UnR>PagaBk*2m2&zwB|?c18lbDG3xM-xaI z+W6Y`%-TjH`u45QK2YeoYxeeAzjuG3^RC%5T?a=Z{=tJe@E-OL9E5#Jt z${`aY#))W1@n5=fTYyq#^W_L?0S{M>qmw|`(X%B^9& zukd##3~|_}v^^DH6Vjkpj(z`JUS^Bf%3EuvF1%4SihaH|zq)j8>R4vqNL&V2GhXZN zOAPPkJqEkP_3zzM@fcPHDOUzD$|xHZrEm#O!L?)>p4@|uW~pqjz{)iCK24F|_Q{$2 zI9#K?T=5m^x*uP(q`I7QaMBTAmk5!B5~&SVr6v#tF0#lqT0owUqqD)Q_Oz9TOKqOSw)@ux z2D2fRh`@0nBNDTj{+Kgim$U7I!-MTCYAqfa@XB<0O*mw6X@mx=QEK!VtwFol8Om<% z$lg>8FiMR~rm^WvPPI^@*GP>nwJl&bJ3`q_ypG5(kcW{+k-z#r(u75jNn|V5gLEQ? zu(#Kj z5*yatoK`z!27SZ6&+p##==SJx<*?bQkw|L=akVL_C#==5jrMSpG38%Ie{HL4zk6Ta zLlWw4HharRq`nhsz9a?~pu6@*>|x?O(u{nD_tIw+3Q3C}aX~hFN+$_d!*UqXO0K*` zQoSL8`qky*u;DB#cbwUm97exaTDJ` zwtq1T0o%=>*l7WIA{13E68b9q0VgZcP98@lkZl)6Iy(~+NzOY4%xnTlIKfM@abP09 zZJQv;4#0_R%%{P`F6K+2qB*aHYh{95g%^U%5afh_q%K$ZpqDBu#gOM;$mCQ?!WC%J z)f@Dx;=ZY57Y^0WohC+nD3S0co~U!h0dCK z5^fc7BiF7$`4TaM@V+ZR5L@C`X3drre z`t{|-5Z0_L2Hwg<#P2{T9s{$5eB@McU?a3Nt)xq01}~%`xE2}6cjoi?mW@(4_o;@w z68ey*v~`|-64Si0=7}Rr2A|+Ib4TIBt^8!6-k>QZCgH5CnlT} z%AJwr1%=){@1Yz=Urz&{2u0LVrXs645t4x&%cE$^hs_ST%+z17&WA9;yyBb)nmTl-7CXv0{ZaI0&$-S@*E=xU-JCi?>@AewE zLBa3M=b+#>mVg>^7g|ePcN_2FJp0>G*?|r{olkOg|n0;O^O*q)E)o0@`yhzTm+lP93NX)5T3cQ$URgnPRvH|COG+VUj!s{7(cZIc+m8HINxT{}!0g}H1c1`0yLK4WnN=-z2`Ic!L zP=ZVq?(@>5p|5hbC~P%Z(A~`M!3IS$$DvDa;M2=>LND41*_fX1iGC3lgbu%+DtvBa z>zySBCpJ(NaSb6m($!vQXFVsd_rcv*?M7MD%Ml3Ja2T6E6vEOvNE$Ov(C)A@B6;H ztIz6|)M`nst91anKuG97H!URD+yi*WEMOrcu)rf2+hD-vXh}$IByNF^F^dn3@q%US z@eKHoF<_h7vAZ-8nOR-cIy^hyeEZF}-*o>{=8LSV%op!Pym;{8u7KYVq+JG~P)uM&0-hyB+_W&d5+CE5LjO&-^R(Lzu4_;2za~ zbh%BLRLYPT!>83ax1pUkkVHp^p=%6J*7P;P&^N0%%aG%Q!H%&r-#ZM?DR{2&i0Cj7 zQh1g$#0)hSeo7{jlU9wAU$AVvZKbK=urftXR+@3%dDOuC|)#T$FMJ&?7W81 z=-K+4SVF6VJ}hsy)Hfm7i1q!%5h$AwSfj2WiZKii9L_Pk|47KeI&5S3NKL5m4(}{G zYo5i8{Vb1-8VnN!>Xr0|ispaiY)WZ}lG=B4DX2IN8 z&W6*w^;W9>n%-8;CJQc}{sHlV#++(PR-M}VNxMiJY(^}pvGYVJ7`AE&on0FL8ot_L z)M~}B9pIpXpTMu6JRl8wXFZ2#YsVPVjI0*qmg*UW;?=d|9Q&9csWV>{aRvpb0q z(5o&hghJTRO1{<@gu;~Jg$ukA+3Xd!z7dIE5lNrQ)F zlW3T>sW!O2&-+|CkoW3i0bkyZzsu`&LL?BAV9zx_khVIlUMp*|8gmKB?h)WRP(`xbtr_!PBM?Ka61 zKO2$5mKpMA8+Ao1v>F_?DzQKOxWBfd(^JZS|HCBljkmpd$K6HAJH%c}N&V5G3i zRSbE`9%tCb5q}&U8BTFx&{l>fOv}-PLBnbY0v_t`1^v0-dr6+OE1_y&76paMNU}?L96%W-R(VHUBOC3$1o&DludRcXLWty z&IP;XMqooEa7M|*yKI8SVVb*O!5qo2mwae^s{`udehmlfP#F{sG4?Xj1psO6NX=mM zZm}~&?Cau=!sEJ@GS>2zk~+2d|L#2_Sg`I7WNlsxonGBFePz|*uU*!g849CisoW8f zdC61pI%77Dk)keVdl3IeMf#O=F28Vd7t~48@5ijPq6)e`I}~vwDo#&Z!Wl?5@^Txj zHDQneeWMxZp*?lPX*4<`W7yYg5^(Z7L*DUJ~Qn1jcO zPrM#?$|Ep3RtkpPJk;A=2L`WRkc`b-U6tCqP2Pk9mL(Vd3ihhT0V*JS#AE`zIEIbZ zjEP7<`=#90z(e9giEXYCew*CYIIT?X884h{P7<658HnebnO14eA;Dh7DVoywO-4!3 zEawGYzmgHdZg*H>`gxe_vzHdO*$WOlZgB4>uC-}6F3?>;EyLf znaZMeH?3ujPPE3J4f_bcnsR_HFa(x^J$)Qli2Y9x114-QNP-#I=Rh8GV|!~Xoy^m8 zK1qb=J8|P;0mhe+7RKTGbrLj>b%=8oK}oi;e(X#+by9CU*q3NF&sUGQ+WH zPbV!C68Y=H?D&JQuDV^Ygv64LvKO{iZdXKPo8~mzIb0O+f1D^C+4f2(P=BF{i2^qIa|I@{ZqZgPcNv@G;cXjc17IUXyP;xSczm}h3S`md@*UGG8QT}MwCe-V~x0w`l2y=!P^j3IPNG+=rWki1#+v)gG+7pe70ck zT9~(9Sf6L7aVro1+H;vg!WNLYQ1@_EEtwC%{HH*AG-Pa+Odh!Sr=mMTl5cw>%O<%t ztHZ;8C9}=Up;Gw(TH(+YQA(u;8ZnoWlWZ`zrqZ>jAWh0a8|3(rb2yfH#X%LeAtxZO zX4r}ZP5=vb6pib`_MBnu4+uMgUsgPl3oV>QPa2SgZd_{dr{*o%Jueg=zGl(ApRZ=s{xd3CYN2fc_#9g z0`Yr7VZ~oUb?ubw-$o7x96*3|qNa1OFGhC+1gmGebp)t|AIpxPG*u@D%FZnZ%963z zDV$QB^7Ub$_+)V z(NY>`tmuyT6WxQ|apIcn%$%L$1)bYtw(*o;H$yysly=XjUtU0%mU}#7JbOhJ!IaNe2i8~{%i6a?~~&vf7;@> zmd|o7S{x9?gGJY{SG9UuAYxvBS&i58d@rh~$o}l$Ve%@6-|nR-8k$YFJD_K1YW14G zAm3sqEJ!2?4?B_P@oqSzqXfHLhECuQQWogzrAL{d;8v|Yr{va=5nE)MOADb zD)j_B)PK;{9tvO=HPZ6jd;C@WcF1uQOi^^WcO5wKmc zgQ$1f5&*&=N3HRUNMv#h1CK*?SW@#K+K(@lEPM3CgEYlSQI97ovBYMQTu-oKn6ltB zW3Y+!6k02ZVhtSjhG;Xu`bubYOntx4hizhX8UjTg@K=dHLvE*mCC7aJyqL{e(#RF% z{1#KEMN4;gTY8bdW~42Z?b&V%;f!r}jx;i$EC)HURMvT-H)rQ4dg08qki-GETtoL0 zoFf~F=A1fwF@_JJwIQRitW!tqrAbzby1h{wgRjJ~)i`5;tz6K;;2UuKVw{sy8HlzP z8F=;j`p=sZk))0Gd&qiex}YW-F!J+r+s z1OBfcf%p06GaurB+JN?&0$%9T;$y%EtoWTrIV$X&YZ!pS`sx2_I1!C<-<%RU*{i^Q zjP13&-@B|i`**nhWu^(OEPa?I?5Rmkh_flvSv7WwueJB?c`b9J;zFMpFbfn z4#rhZCW~%H=P5=b%3EHMXwjp?)-ie%5Z5#K8@w5^rZe+@DTS5yzrv9cIwQY8s=tFh zjQN2RSVs+D48QZRiIZHw@CK6otI9l9dZI#1Fz~R}l^~$41L=k(K+5< z_^cn{8e%zE3H7#?=pZhWpWOxmqi8FEm4~>tC_Fvw(gef;WTW_60R{iw97nuNn$F*_ z8Rxkw$1eX_@aBE~j7Lu!oaP&7LGsxgJ^`cZxZutC{TVlpKDZHmAUS*nlI*@8)>Cw`#s6KlJF6Bf;x%X1SmFv+KARy&_D|6>Qls8{C`us8y3upYv42d zxaMe_azbDaRxA|c zfRtkIY&u}HXcFWHGzH7HEtA(%|d3(gxIX`DXOQj_` zBc|=Xu1h*RozC%xDKe=%#xo4bHJrw2e=AcTNC;>Y=PSB?p|nj zWys3VbNE51O$$6O1qs|&V}0yWpKmEkR4yCCAE^l-9PaMlka2CXQwy~-mycoWVd1K^ zSD>92W^T-nVONfJZ~RZFQxv62rB$688ugT$qw$I|@$)LPqUv&~y}YQy7I6v1D-Nt( zd&k9b-;B*eC+tqRPV_VADZrbRU zDl?)2@5*=sMZaN#y)dubc11KbJT%~SN3Bf#eylUUWbO=~tFv0M%@`TZL}pypnH?UQ z8LX@?y5_|^i~-HxFmRzcHCD-Cxboq;>jpRj9h-J5pVbtNR_b%Lh0*ixXpbuLNYds2y^{QQKq)(}8kVAy(OdF`r zs;X5)8dcR|&8n$rh*am2A{`=)6QN>(6iuqmCr^z+A>>B)y{$Qjj7`$cJzlUiKzJ<+scO*Q0 zb?2h{`k=oc&?q*6L(jz-&e~VJcipysy=D5%J1-lEB?eZOdIs_vzkJoEdse5$mxO1o z>FK|rqr745ii9g0uwY*@2HT?X&X6&eOboRL{=AQL4Q#t)&>x#WH0UeewEwHi4!rlp z`RREZulY>>^yQs?ju((!dF}B1wP>1v-ET9r-C>&! zEuA>KZ(yb+*0Xq1U+?;*gPsL<_sqQh()RTH&Erl~y}jPx+~LJ3b1YNBw>i=Qixe%o zB9~XCOraf1LLcf(=FBPL>r_E)yRf6E?ZS>uZoAqh?FWQ93M6B8#oYd=k>H5?7?WG3 zNtV_LEU7hE1@Z$lH(zTIc>oMx9au&#C+7hg2tY!+#K3-98|Vcy!F+HLv@+|#Hn1Dq z0N$)^U9e&E;?3=QuI;)uwtZ)6r|+`0p|#q9zDO(&-tawSV?^R+wI4oxqWrVp*% zdF^J}b@2+DYxY&U=I!eL^z{SR7p~k|+3Hxf%CpKeyi{C@cl2m_*hGfU?7DvIs--=d zOwZC)Td&_mN7h{)h=A;C+1HHfd@yzT=U+cy=ohB{$S+Vq4+hGmVj-%Y&FWcF&yCON zv(jgu&;FbiC#S<_-M{fX;*DIXl)D=pJ}Ksl`4FP&Z3X!Ecrl+Z;=|}T?m!ptn(2aSuG?V5X+&?B;H3q`$;KR%0L3`DT03&|1i=e&&$vd1?%=%dJbxTKA_BO{1Dd(NlT&=!+E+`p`R^-X${MXS;Ja(162FpNoH zO6&G3`6NU+pT{Qhy+clq$@$)czm6}YehIzw%qYc=VNcfd7KQ;9{nseUNIqeE24>cX zpK0#TaI$5{G}tooD0imRZ5r@}X8vD3=8Q(}<7l-l?z3Sx3MOiQ(tmd#7Kzng=LJ2F zzXH8M#L*J`WrC+Zf*d`ga`;{R16fnY8)>XvPM?_g{7pIi+(eG1%jxGEpOXPOhc7hJ zgoAnyre6fg^Ijr`K-zg#?HKO z*dh%UQBar{%!5T!(ImA$-0h$uuy7ob9)o4%%%m+5l1Vkx({Pnh3sgBbFpRgZVx%m& ziqA{VS>NsJZOiEO28Q5tOrSK7>FCPOS~@GA8d}rt>?%cRQbS@iuk~g+0-lJ(=@^vqr{wgvWhoi)*YNwO_dy8l&Vyl3K21U2opv0@ z_Q6X=?6Dd{Ypgl|2(JzmDMBt%XoU(>wWuyB+?_4jvdY5i(6AVr5hO|7`>t&wj&$tO z)j!q|rbNIMw&}_FI;Rff?E1L`WA;0OX%XXyKh{5TI4~YNEIRZAq2ZWkUDE^pX|87( z9Ze8=hX{K;s!f0lMnSD6h4nlyMsyrUgdEXu)73y$Zvp3mDqZ z+4foiDp)?CAfBiyZeoW!G~C>XXcEOJ{vkz0%Ym4rC35w8nqVvuZ$6@-J|H}}{b+pu>In@p^K4EtHl09dR0nH$45*$Z`3VrM8yS;mLhVEub3MI{!%58+A{dMEfBE1yzh=mx_9_@mEL5jT8#D2tNL zN8CD3Xd2wMMyXo3gT;ex**-;V+x)=#4X+FUrp1dc> zNfK<`+zp%9m`OH;R(anv)$l{9A?vuqWU60*7{m@3%w|LV^!p|g+En9x%xW?bp0r=# z(3?&B?)Ii7k5Mz~M|DiKl%NyLIqY<1MabikAOJzb81~beDeFBBB!dL2ODR!(j^N%Z zAy&;lNvN!jU-yPhStUYkuneb76Dt-@YOCa3(&WfkV`efvX~vI-Ab6$0isZXPm8CuY ztJnJy{B?raEMT} z{Y9hIsHYv3^>?qj?7qz%9=UZ>+9tUrfF51PsKmhB9ujOCq!=Cuwx4XHZ=i9SCR}Dz zLv@NtDatlw<>}`BO==9+*xE#)ToqLU{~*?0jeZhsuf}54c1Tp)WB6|cqfx-(^&g`% z{!`v)d=&dQ&;vAU>+Cd{IUzo``? z-cU?p$?qU;P&Q9$I5Ft)Mn#6Ve*d(d#(%9v!*5z0jn(Qe8H`2){B$W|E`!eDkg{J{sV$&{2*KsS;3BkQaAjw|Ke~A#({BFbXGg4dZzVsLr>gw z@Q4Q#Rtcm28WvpP*Xal^{XZ~ZG~r%U1qe{SK+NiypsIlrz7RM_g%iSY@OZvc>*y+@ zD7`4&#c;06TFu}v2-ZK;FugDyf~iokB2Qu~hKqYft%}*r znwdATYjzySu%Y#x%2ClLV^qGIl%H?E!%AyG-7t!~0^8hF%seHk{#eQF)%=NIvp15e zB@BcuIa71k#6EXEs50uPb2hLP{>|=A&K_$<)8Qq5vwf6=Gq2!rAktz5eWUrK>2y){ z&9u!{GL>(^vu28!^uW@Xuzqg?pD(lT4~`fs*+w}QGG z87@13okUtxcfHP0cq{cK}X1gFrR(DOgB zhEdy%?i!EO;o(ztFtO71Tur&h~Pg6PWV$`=2y?Z!~nR z^su?L*I11-NA}D-+;EDk!pf6dWf#-@!vrEK)dI7 z`?|O;cE&U}jEJtQ39VlSs*sYh^!|W96O{KoW5kXm=&_sr^mbm`CApIRC4z^7=P_HB zeNTW{`-aH}+kf)8(rFv^ZH$1rHmb0^L#Pm<3?Mi0RqrX(Ax6D2#I=k2VW%lmD^@H~ zqUhHFqamML9DY-W*Z1mm`LL?EYR$7Y{jmx6V~%1Ax(9WTM~*^}G&{a$^p19jGje=O07h=YvkmyP6hlAFCn@aS zGN}o_>o*hrmIE+n1fM2lP>yBa0#xf;xOHn3_B*!52VX#r_MC48`TD}uI`XRsJhTv2 zQbqtJskJx&qQywcefB(vB>V-V69Y-o5l!2)ixxE*Zm(}mr52@e=5nh>$K!w>aW44n zkN>sB!BTyY1;Wx3D!_iP%X80g&f+xmNhYKDZq;sM>1uABRN)!lnvwtfabgrc%R^OR znRd&s2FWJFFF{I>YqFx2kVFe)0CCd*0;V}6SE-K=qR6GlU~m2DAdSI|p#d0Su6^74 z5FNI&YKh-L|F-)emn`R;J&5Lnx<-~D(Lp;-eU@-xp4W2u@SDQ|91&_U;1>RbR>@*U zg#8$2=@st$AyQ91x!Vgjefs<7l6!S5?ZgX|;7q3*C$8li!MVw+%{I%WH}KN4lsW8* z(d2H3DmU0Subi`*H=5H!jtQBYqo=YLi6`Zoila5ys*< z9fD%S%*<}oe7XQ~$&C(TZs6_4H8J9y)Z6Iw+K39{))1D}h_hZ6pwe}HCxt#(3UL4u z#jgbN%`#CB_T9682I~C3$+tdHX&u-%4}uQm#C~v)GE2h1$c|?iV-20)7Z+8B8EEGTD ziW*>IvuQT8_JqeE*3@maxS5Y4F#peIy7@zjQC&Eaj6R>-bY&Bq%Ec0jvI3YV&V*e)OwS+?%pu-g z$!ThevO(2fXl#_Vghl~M+ocnsKs2?O8h%P!C1as6*#FV#y1J`g_$L&I2f-~1!WIp6 z5}gXi;>)~FQ3)U3`F7MP?QHQiw;XI~XUo*tfGD@#_w#cuf_dP%kB+ki*F4DkOapo4 z&MUO@rIvLY>gRmi&-{nB&O5M`*q(aatxIU#iZoP zscpuohtR8_U-w*2+j_hgkDffaUp(K|_O{v>mW?>}+{Yg>t~jUYc6^r2ODCaaQs$9i zJ*ntO5oT@K$r?tPCNW+*sF%xp1o3ApAYqh}C497)_xTu@dKDZ`MU4&kXupm^J{?k|x~7VY%eIUVcC0a~k~htb|2#-5PY?1HjSt#>rfx&vom8l>KO(yZI3ALnNP zsM2B=TnuIeC=q?5P2tACCrV5>EKbu>KV3ZwkPy-0ue$`QE)%~4NTDMAaLx@nYmk=o zd)j%O;m=ctTtj0HJCiZf4Z}tKsG0Ss9lsR-zM*kl<8vG8AuLvD;9$dn_xIj+N2=;T z6`3Yhkm)MbXHMyYu?ZjJQJUppxk{=~5=}*N&FF*vG44}IUS4+}p115R<&zxLO$jSy z=+bz9Bg=Xs)Dw`pHq7 zoIaReblS*daMV-B7`M|r!-ZXyqT_?LdqkJ{YGhh@Y=ZX6BOkEUg$$46%~*lKA&o?z zjD~KW0&c0$1BudQZB}J9DLy4|45Q12@p;@OSs*1@h>XQ$q6BgY3(xKcR*JAWcr|ZS znSm)D(UIJ@I=u{a`uB;9%j~E#HY!l^9+#B`SmS`@$z4OcI{uznyZ8s6c_`zI1cLyh zlX~5b)P>Y8(a95P6_V5;E;fG3;gQ(|_%07com-ApzOFGwoj&kuWm9 zxAHhj!5fK`sdB3a7m=PaKQj->GAS@OnL|YQg8%(9`tGN$8S%6yrtH3_Dy%uA8@(8Y zWqDRTGm52Mp$Qaw32t=P?w@UCBhBA-(1fL?^L4;n82_Au;Vmz zHZU0H3x|Z`4lALTjwCnDHc7Hl9e?#vY2?c7pO0DlY+g23-BheIzGi4%vX^1fNovor zOJcUQr3W`&G`04%XTr70?7Z89GE9`ZdSG3Hr?~>AuE08WN3D!~!2uxvw+z&j zGOElkHCYU4#Dqj%=3u!V3pYFB#MJFO8wyXhQhmP@*K>fZ7aBNKSU6R2okb=I>@x2? z0Z4>fVmG#0j^&Zw74Ll+&$?bVNwsSpLTQ?h%70^sT(*pkShHcsm~>Ie>Z=eniqp>T z{2Vc`x^bW8I-=l7E!=tH?3bo!v&)p|mx7Nsc9_Z;(1D%4u zt6&Ahty48gBG%y#th@M?`(mQvaqJq@^ z^z=1^E6HD7l8MlU5`F+S0xj*ffjyR!O6U65 zyz63jRqA8fH=SJTtpoF1yj!?S*H5=F)s!=34>qv`tUTHL2hnsCU0GGC$LMW-p|$g+ z=xK{OmC1gE&^a;U^!kQu#|oiij{wX;vn zV(L%OV?0q9fm(vJtHMie(4fD>#15O1R#JaZXkMdal=DrMoq~WSB9ztG-mt|I+FT89xI$Mm;8s85!NMZF(t8lTL; z42d6o)Nf`$HJO`ZU{7I=Ir@Ydosq8`-OMk>F7X=lZ$BB2%y022#`q2#OhxLYj0()z zd3CJ4zeI3FSEo&{D@QECjvI%NFYVK*@a3{C<<@jbwv72e%#)Xlf=%+y`r7AA#!49Y z*pd4U70&|5{8DW3wfzh#KhdS~B?-wGU@}zw6pj(tv+vaHQP4!}>pnIqkTkW!%^M1g zW^g3BOX(V7Vg6Z#bv&5EUKjGao{$-z9>w)I(1dP92b7l$IyTi8BpFjPm@}2C4*v7h zg732b*O7xkDz?NJQiNL3p-Mta9HY;jD9TT6H)<6EgcPg=gJDz^*}L_ z;o03}-RntsEzTffa&^to!-$4ADi@)kpv-=%8P}Z=p@1`MDZy0z8u~es{Lz_GftixnFR(wU8}n zq9dPXOc^^1A@ldw8@}=v)uep>0u?+w*i#4)_igd!K*zqz68Q>-*Z)Oh!qDuSPjD<- zB@1HN1}bm3ZO!LYDuiKMzM`&DdPDHHw9nNhlaEBkDM@PN(3u6&*%n z%pbO}bQo-^0+mo;pR*t?!4gogf8&-B&zaX2){V9m7-~Qqg8>k^ucJ>Y`H3eE5ha;O zC5&oW?#QM|)@d1WAbP#+h=-$fth2uEBtViJQIqLK50#dH7k#e7F|SKrnem0=2N{M) zXCs@VoB26o0)L1fM$L#>=c}`;UtfOhd#0#SuPhaSkz^vQ@p9lXMjPVNXgaViij8-txkT0Bog;CPs0kI z)B#n4o0c;lMosVULMjaz;Pos6C0+d)xGCFjYmb{&zOczl-h*lnp4R_aexAS$eG!Gh zew0D^1avxZdI^V@1l)hH?ddrkT(-TBqG&pIzm^_}T%3X?L0nqwD-K3pc($u>E`N&= zJ~IgoH48acgfA93Qi#b`VXiR+q0P6O9~!y}_<7&bfZ38#d9gnV8~wNM0mRpR#KQdr zB7MaDvP3^Mb&-!xY@$Q(nW#hfVO8a9ek**Z;!8osf*TD+vbnG^*#axtZ>$yk&iK_| zSat}B+{7m4-~x$U!PZsW_D3=Dw204qZ)5L1>O{7rEJ=P>eHye!ye$(`;q-j)y>lrA zAx^1G*R2oiBd=lulA?sFv&0paX~u5IOM4xSy<3y@_&{k272=-z>9+88x^*r_v61KMlHio z##SP#Bo*rC;w#IK5`xLga&Rdw=u5;i5aR0RW%p&o`L$+vGM!)N_`G#C$nbo<-{bxo zy^&dfhw!}i?Cc$~Iu!+-;VF22P2^jEhg4g-E5k!#{7MhHmtKH}#`#jXejozzw&tM# z(lq1_<%9p#BZRFt=Y5}zq{mNKARS)4UKejpNxXQ*v_MYxL-9bB&dDk=$*B`*{4}!FpywjGDabUE`^gSo$ zz?auhz)(abz2O02&_O@g!^wQl+aUNJKw#$_p(m4ioj1woLka_JJ<$wT{JIxKC5e_| zIIH0fq#$F^MoRVV1 zDsB^AQZ>c43Z4>r5o&IOSI3j$54)`DLsSrXeXk(pNuP`2No0-Z@xkcJ>hG9(u0XzcPlkRN7v&IDl z8iDQ+ce+4Xzw$LZ^LH+MwRQvr`gq$Ru7`sHhrI1RuPcB`gRj?ujuCb?fml;pMau8* z`CMUjK5(ud!vTmujF8vev8<&bfG*y4H0v6$fH}~yaZn@Tbxv?V1<072KYFi0Oc^xP z0Tkc~Yz(?H1q46}Hb&K%0tYYx9cuvH``XzAZ+!{{901u9`f!9BALH`-HlY@WEpZf~ z(}nLx2w3od0Z?h2b$gI8Rc||jb$2N1b|}Cc_!zbK6a)YPd@OYr(079i$bwq1IB^wDSU*00WxOb zZO65~3<2o)1PlV%qwjP<{}`zaLi%&F;T^5je(*gz?;6(iZ(slsaA~gf5l~YkG-=A+`1WLZ_fJ)s?!C-dNyu| zlh&4VJkuRZ*I)ylsK!OiTOJOe4GM(tzLM&Epjlsr1~`F_`FUTNb-KV?zjosd?Ojbh zoZRa@ygtJ`pFWE{b3YF~gSr!W0le6F0<=dmK>+EaHub4zK2vzsUm$^cAO+yoW01gM zki9P-5WM3BFNk^|MK;9Si3J6?@n(E4A5h>C=w1iN9(kv##HI811Ngce=50k0ExLse z3_eJZeEp2C*61K(Lf&@p>&u{kD3CGJ4|i5cF)jkO#oG~@!qy_}F9ZgEcv7j3WlAcY zOL^OYuDc^xdqM+P!N*p-Yf!CmA%Ga5d(>nV47Idky%ES&6;{qp9zI&MNPI2j#jvl6 zGh+V!g8F6lU5X|N!7w4Y<;CA<9COEZe7(vI;W082y*hW;m9#RVuq(4b%VN)=Vb=Pz zRAdw#94ssx91;Y1Mg5O?%LK(m_45LfHrlnFo6n!Rd#o9K%QZRdcIT^Xg@xGKFRN@3 ze`pSi3C$||Jpga&q}OyQzaq^{jr67TK}RDYyCjtSHlPr6(gs^`c2!K63ds-i_ZL+- zIw~!9)J^%R&-{Z78IkZ88kR-hOS>_wWcO9s%=(uC!3i>?iDEUhX5K>4cx_D!2euM3 zE@DLq7k^X@fy(v^`*>0QVEvBF_g9BOX>}HR!xb62b%7Id6Ch91!C@VlmfAWdrEWGWe7s zDwqoeD%azJNY1q{2oG~;SSaR-9DR+CpBgv|tSJ6H0H3TKgW)2|h1~mUukGv&!^Vvt5Fbg6Ffb5O~=Fu!><(_yTlm<12W{rF9k_n8>4PYe_f zF{>WrXQ+4l%m{cku`427Yj5qRRKg-;m`{m0c?#m9d7iR6P@NGY$$atXiRj`&xu{c! zZ=!t@u;ZO9`u;hI@kKGR-zOz)+QK#rJZcgpC6qM5yq{Z7z*B_g9&1TpdqY5LtA_9^$Uw5XPat0`WTT^Oi2hw;n zF1e4)kJB0LJR2X&%?o%kZQ0T;DnY&P*4>POSv9NrUGyMuj(26?e-B ziG)FuNT^OKuec{aKnGNj>JvQ(EiF`jKtRZjzltZKudbt%jg(UWY9J~@51lbn;xK3a z;~yr5)Fl}DJeUmcUra+N>-CbIvZ?VQs^UH1vWpUegF>(njX1sm`Hi3Wll`19$jK9e zdVC}i2I5+~D_|*uVK-;^Q^KQ%Pz6aFCld>3fS|0mz~p$bBcIUyf?v4I#2XMv6BBv9 z)+zq+LxVH-~kjikS8HFxC{&6>3N}E)+X?_PD0!C z(TT24f|FQyvfcO$$Y=ruYc_Ny*x%W~jH!9eDxuM?s$3vB7CnHPYM%jLiJ&fk^)4<@*Vebq@YBF ztpD!PWBW{dM1cJ>Jvth$2gu77X!o;0<%c)sk?&|>fJ)~iC*C&akJAlvAfnbDEH)Pk z*eCIYnR_-o>=;_RJ650wrQD^`oXdB?G6|u%O@G9yS+<@^5Gq(%QE2+T&sDyNHB0Fb zEG>NHMrow}0}5FT)u|G}1N#2JVQ97_BwHX-S+74o)#V@z5ZM-p%z!0J1SB&~M2#p{ z*0d!jNU{;~0-<@7T%e_nmk@0V7lRA-5a2SEKx&wDu<563ijN=0UiWZHNwduB>=t%r z_2wrsG3I3oY=Vckr9&r$pW5h_2tr|mHG>8HZqs@WplX9Y0027$fVIMnY5J^J@Ugz1 zyC3A$o!SpoApUGh<4=6QBivbK)?wDE8&h-t@lt$WvboiV){fS$A|d|;=XQ{=DLkI? zeT_Mnf~LLB65>|s<>1b(tc!<-i;F5&UeFKYK3rgBSE;|M8nMcf73K~)E$enY$83#0wA;?V}+ViV! z*=ZC)8j8s&WN>(}L3md-c6vO&8* zr_;1yw(Yy8DErAI-NPf=lIa7N?b!80eFx+lqc9P6fQSuf8e`;*K>25>F>>oM^6gxH zpWpQC5?ZTT zhS@PTyGT+ZtXVaKVKSNyx(%~kW%<4ljiESLX9gAMRiY)K5%$IAH~kc&{4tr|U(sK| z(#rBJQd!u(yii4@3NgJYn&|z4D63FXtdy>-SoB*Ft(Za4M9L(h1QNlQLuJl}l_f=1 zv=h43Ntq5StW?(&y&XH)HTxS6!I`d;KgKujYj`W-RPX~LP%F3X3M)7ariw4HR-K)> zm3zDUMnX$O^}R$P9v4V}4xPwC5V?5?e%GO7$(Bf##lWlk+^>mV5Rc{CK^r#Q8Ulvv z7gz$x@|ImU)xrv4ZT`7QgNzA^u=c4z41tuMpp`NZ70^yZF*1!aFB8rw3yTZ)O^i!B zeMD`k5Yxnp(Lc@-n>5G1#jn^d8*WVbg4HcYM}M~8+(ibmMF^Dn+J+PpFP1Jt19fmo z&qIZGS71V8A@@)gODF1gxRZ_0jnK`)e7Ne`DYVg^AbXPW60N9cl{rnzz$~>J+nhNo z@~=g35ibee*L1~FgG_An*+UEECiMo3gFJnTviL4Y36n`{n*?e|A}Hwl*5a4sdwsci z$V)T*=sqJ8+!@SL*JIqhRRead3L|62WK=!Q=eX;_^lGwwNQO6c`0IG1)LB;9T;4E0Jp z^jX`loF7*#aL}YkbiM^Gb52fl!ZfC|As97U2;3z%>w5yO5R~inec6e^J`|In6Y}fl z1>d(~@R!jpI{PV2PJft1Hf;1ot+8kGZm7e<1yWL}=LgbsQy_o)LyJ}k}NHHGe= z`E&P2-w-$V9@dN<8Lv8M?AD-LTXhN8u5t}?5*|(b%Z`6=W@ zf|pR78($RS2PGUp@pO%YiN0v`35Sbr+oc)XZ}2Q8_(uvY_JokWvJ65Tzpu8SE6N1z z7Fx{rDpQMxkX(7UC<}E`(R;aS&$-$wN*16-mAX@d`D|lf+v*dw(be{`)0Ds$3P!6l z`IGjJHuXCL(Dq*i{Cy}!N#$SfcB9)i=Ay!0V^4q=4-$%7G__vD*`c!$=>4cpwry8O z+3IHC6@jhM*bZkYH5lx#bvC2PXZI*st6Qi>|*mE!6=$(&ViAt2qGzp&T?yhsv=PFVrUUr?^x-S$-Xq{($SK7mB z9&;OUpV{nl$0KeGjD#}_Z@=;kF_|vz4~ERqpoPnXy&UH{_L5?7*VVpcTZzf7Fyxv?VN$2V?peyd$zrl-X4 za;PaYH6CZ(hT}&LqYHX&fpI_h5^&OdQ}V<@yhzbqayPKho7>(#~ozb>y(k!{fWa8nps56bKjAAdFFLS3Btad!|3wp zTnhbn?b?mkKNB8i2*59+tR5w7&6^W6y2HPwwG$j*)Rjbv$KdJSr;{Kg85JHLx zDj=tE--hID+K;Sl2iAFA9p))FdI;GQ(B)7fjWk?HISRAH(J*)yz(21TktIri`5OKa zB1HZ@47qhbXMKh8g2kU#^wmUaK;y5i{*I0Y$4cjQfF# zqr`D_^ftGZ$)PJhs5|(>+W7~OSCRCvLCvX1$7f%!?~k*;(C*$)@7L0(&5ljA>}c)w ze`T~QgR{Sps38Ap@_4wqg*&@1J$@5NW*%kOzBSB?kEDFLq;?J1G#=Y{y3NC}?eO$C zi-jFBKa?(rc=7Vw;f?TfHt8C=3bRVLVQIY>Fq~=q^~8PDO8kCjEl^>hUAr?fyISz) z_4sW?xuVshOn&P`IUhHjV8~{=78mVlbX?HD{F&Y6tz@h9^|x2W<>LKtjTcAFpO&jM zJS~@#ls}9jN>6cUUVWD5E-h!5G*!PGpqeX)xnCG=2C3{SU>MH=Q{cQ7+?GT;do`-T50@CN3H1HU$krPM1}3+L-% zN2b

8JkGI_0>4f>3Tx!}ZSc7D?&5G9h1L_W`i%%;EU?Z@lZ5FHLY%RP4*TwwBR<=| zEyc`4*v40jo{ma93N(3moGq`@r^N-r-}igVX`r2{NUpTEO{)Y+l0A^GVX#`oc$C_^ zUER!cTH>lrW9+WYJ2ldMjzxoeF3y#ZDZLKM=22VwwRx2c({Xcp_juUQ|Ak88dTH@S z^r)gZOwDV$!%<@HcSExm;OYjB>!p1EWe)+)^jnV%8S^*=Ok16ui1p=ulF-r;ZRz#g zaXlqXX3A{OQ-Hy5_+K@F)YvQ}G!0A7fhT2@=o$&Ncn*bk_t7wZ`BY2yU9CmKU{pMK z%eHozmnp^Jy(uk!*!x>mTUWOk?x-q`7Md=<+{Cy)jSp;7CTXNr|E4n=^{yc)*10|C zujU$t62%Uzr=+&Li!qa)S;_t*b+AI@;nX+gIL3CdzFoXA?zv?7dc&$@emMz+ct1N{|tWiJf}N(^g&m=JYSIu zixuCl@KU9_y$c;_Iz=V9hn-D0`k|H5j}bqeG3G{EB3iN|rO21H7xB@X3T6(n2Iv*y#G8 zKwmnp=v~fJp#SZe1cL7-?pNP550mNVH4cHdmdAG22%Dz>yDF=WXddSMg|H_YP3~G< zg@*0Xf%ZG8eph6YrbTsLsLT2r+(^q)x z!&coYWfl+1(t$_>O^Rn)m<&hh%%-a}UKJ-dcWW>4oU=E1wf#`t)!^~KlC!ii8h9qrcR{a*s16G6cCkan&RjjWS|PGOm%C&mG1Q&V=Q- z(R4hv%Dli~7!*kiXg>Um*ag4gksi;UbxGqW#Zs;Iv}^S^uF%cI$4MVChqYlk79frx zMzRa!d1#vF3U4Ql6lYsS{KLuOufm=hc{z{R{Tjze-;FdR>d}2gci((-31NWpAP3&w zQDtX$+N9@_gFJY`7pY8=jLMxB>B06=#>KZ*tJyLUUuE?9%$RT|u66UtgjVZojnmP5 zf+xny5L@Q4!>Zd$?+L-SOj5hM1WBno(d`cl)2FjImNt)_M{Id%j6^MUTNzZ&G%vji zxRn;Qx97IkP&=XMIgbnCBaHTtl2sr@4fRTm;e=a?$Cn6G2S&Zk_xE8{$oJ5Oa0GG} z!eXVMFw{0kX}L_X*V@#N>~({tJdQ5bxMegY+&_j3ytv7zHN4GYRQwi^d?T5e-64G( z)GDyt{B((>+M-0-VW#}7esAREk34!i12=p1 z3I>Oxxx`?p23K|!U4_KP(}~GT6w#vep~{2j91SU<)pdK--Q0X}r&X~4+?HD_;*!VZ zeOk_$=Y3D8q6nn=?db6VV%-CI!SJh7n7CX1i`i5BudBK3LZ{TZd-uk-t>ne}#13@- zuRIowbj7wh4Ly$@CC_{HGnaw43+$(5T*}QFD|IKqh6RjL_fmqgm!uN)Wlolha@ABV zTMbs@H$$gizctJ0(xgpDX~5I>{4sT^XXCT=u2oRBhN4>pb+eAF z(V5+-Fg4Qar{~pCXSR_aCFSI6L&|7OZOrYDn|0S_CfB{B<0TrmJ^@`X z(wm2Qg4?8JM%3}_1PK)TNfXTDC|O*P2k8oM#)R zc+$D|nyi8>wC^w9mcpdp(2Hc?Ziq4^D`z#0zS-EftnlOvr=?i1TB`93WuN|8hD@*U z)ImX$QbbVS&6|cgOYP}U`q8v=ouoNp(YCh5qXE6R#+c_Z4%&x2;|vpFVKmK5rC_Au znv!0z05C}pzr0K^u|nRd!8LUri#T)6{pzMVxkR%+IBV^Owu^vKl6_M_!9x?ggJ4g& z_UyN@k-;n}bYBR89KW8op+q+P<((~2RkhnFbH zv!mS^wziDlPRY}0M@UA;>-Y-1Nz@lE#hxofsu z?$RT#w(t>AR(1$x*GJbJ$xnFh^M`+2{HONz6Y|C$iRC-?UJ7M{Cy*kglG%sH)*5$a z1HW9jT|Ku;E>#X#@QsB_Ae1{?cOH#3bT(fRCmtfmx#*rGiFPvw(^Z`h+R%UUV;ul6 z0SNOygVdNBCQ!WV`x)%>b96Bq>1Ht-=WY@v(-;(+mQS8dGv5}fUw_Cs z?;kxDV{?|uAk~3hGDFG2Gzj)4i2a(8<=*Vy+rGMO;jtRvP>rCHkR-Oku+^WrKNo#I zSoaXUct4^&%o2FD= z&uA5Ir&!Z5Ysn0p4s2wHHI2UAE_AH38?>!?>}-ywG{oIerqHD0rY$o3s$ZhUzlI#o zO_lhu%8+RRZ1$ruzfXIakJOa0yJb{A$WyNWohVb~e$B9x8)hMtaA~x$Xn-P~>ec~N z(zBgnpC+z!8xmK_Sg>OBG}xEY%rdA*z}ZNl8c#{VVAflV+ogqi$SPxO5!yyx;Yt?)4Z3xXK_)x&ED^@KfmZ8!@AN+ zy@<5`RYymmkVdiNBJ45B?R{^j6h;;yN5kzM+BGfPd7lIetenI^&A7HotFL!HqwViE zU30_RVYAINv~Gu43C;J`=CVJQbQbh$4lM4hJYFxv%r~fRf{c=+JI-lX7A|aumM_+O$xOrTPmu!;OsgvrGhU1@OWnyPteEB0_Dk3gE{{K?tq^=t z;4d*SnW8L#ZPTlD8e`YsCdw9!fX=x4&g(}Gn6ziorD8rC` zB#F$D;o*=G@=(p2-Q3@TlfS7>IDb;O=S86>tsy|T9D$oagT`$j$ONq}E%agFCki8| zG)}W2p|%sQKRP=zy;>`)Ik|MyVJ9??_RS3#pc}#0_fhhLoZb4uPbc$Bt8g~Um(eJw zQ%36tZ%LYJDkfHMq9stfTSdER{o>*>_n}S#;x*(NXRXXd_brxrAQM|#%&TT8Smfw@ ztgZksVi1q8a3i(g!fPZ_I&diDdn!V$k#uO}B;m2zFeGf4U|g84bC!@0Xf6^?YEP=9 zKxs!-YEDnDuT_NFo^!H4`?`HAR*`eIYU=PXg2UjT+Z1^*HVk?T2TscBv0C6^lsSp> zb|WB2Ctt+IuxwYG^hLB(yT)dyeeYmL*(m_`Wiqq6e0>*- z=HQE8z*tg)ikUc1%EN|z_gzAY7X}Nx2}l|#MKC~@(Oef90v5(M&T!4!p|@(hmLP9P z1srDk`%pwOz5XY)FG)Jg+fWGK(y&s$V)^o-3WwIhD;D0Sb#n;FmOYmB95zcPaiEtP zYm&&SA+^QZnor%XkTC9+k#)p-{>H!cQFmDhu&Zmin=S=Z&2~p9Ih+;SYUQ9E zB$e-YvDk}pYi^g%G+f4S%E3LX-tfDi;HYH;jN7mze|!BYV*RE(UdFyQ=KONKP{=sE zQc%5B{*+Hl+TihMTl@Zyi@-@MIWKI!D|U}ZgEbj~jZ^iOQs&TQ^5NV%KMuo}xOuCcX_u<)7s^zxHXfoW^{a;XG1mN`X*XJ-);ALJn*%KQ|e0{ z%f;?Y8~ypA_Ruxg#)SqX$N)#O8$7ImrM{iLt$~ikU(!m~6dsm|37-!CFQtx8r;g7| z$Et~s&!~>iz`%mfLdWvnpl5w&v(V!+GqAn47?{-YSs3X)D1bUX69Dib{y{Obz4Jc? zGyRpI|DfJSGO&E`SUyxU{iPV*Wf>Shc<-YCtW5YU%pZDLncwxYe%J$i*kfdPr`SG5 zv3$s~z3XIR{h;XS-kD5n%zw!bOU!?{^epP{;(y&`c(=gJ@Yh4;569S;-ennB=|8lx z;xo~Ic+3F!5c=yb1K@oqGu?+42DW#Sk^VyqBjY>C#QHImk?BL=uPh@I+j~Sze+5`R zg8PSLea8zx&-gDPz+Y2;fnj^^`H!K0bu)kX&GZohBil#RO!Ob*UtpLR|Hl0ff**df zGUBr`{gr3_i2fblfBXS3f24=`LqCA|-L-!Z1~7lP_79ik17k+!kK;p#^&^zODPv=J zH^)l%&eg>Kw-R9fuM+r3JKcYN-bMeDru)$T-g-Cpq3z%J|0nvreEwB9A0_iqEdMH# z_cr}sO>`e+@lg=}Dus_Cc!!MPUH^OP|Dy1o?T<9SbKW!j!DslN7T2%*-F@_{hUQTK+-)zaalNs6O=k$JxTb{6F3J zuQnqi<2zjMV6lEc_P>ArPyGK~^8b&+^!GIWukR20%yjQiy&wPB`k?6WS>OHn7ylp5 zha@9_?cbzW8Q#yme+!xQ-$G`1Fa3Y(`UvhX8l3M-#7)fY4Qy$J&2{Vz1P%18^bKew z4J?i9jq&N(-VOXmgZ>?VRwlal-GgEObtQ5J9(zE!D=03$vfW7!k9=p0(~lJ+(J@T^ z{wWX@-{({G=iCVnKNx0$0B=w*e?l-}xe2mct;xDF6%ugM&Qo1gxZ8GgM@?nrs*^(s zu!ju0H8#ZgnfGU~H&5efoL8KCTss+$t8sWk2>n=kj_&&^7CVKZSP(Df4UDHLotR$P zw$uKXC8;HwSmPrOI9YkA%*&{HsYdeV-8yl^a}~>e}T- z=Ih}wr+6l&o2`fXon{EasWpdH+<)o}4@p%hos#Juqfb|POf0L+ouBl^^%#$b-a@kW zAbA<}d*)I`kC|%ysdwxJY=P$T=$cRBP!As-U4DIB9hq+nAmg?ZTUnfSx4TUnv=VkX zi|wy(E|FfVPqooz_+vy>rvAry#iwGA@s|8iy|LP1;di|y>(YpGKc8H?gOHxtpYBzY z@N`=g+&dT)I~~kstJ_UxyzvJ3x756ph$3{g6{YUZNXt!1fW!hvi z@r8fKI>3my^<)~ot)*=^I1b3H1iew_o9VMYPkY?Ejr_d7yH;L#yGjl63OWc?IeG6+ ze!0r$94&t?dOEkG+qp9z;rS8e)uZ-0;}N1dqKjUW{IZp=F*?eVtUP@CM*4JVM_-qm zekFfLU`QYKE^r%_b}Bb}jpwzC?6~UnnDUqTKB|xEpMLb3w-)p#HpYLo{;eaq@3>>h z`M6Zad-XQ}LET;|;E?e};~NB_ekTuV}c)0|hefmi08bZ~v<{T!F+-Z#13JO-ahZxc}NjzCbdA$)@|>MsFazyttGMkC{P* zWz&D7ConPbGnR%%bmklnD=EkD+R~P|}Z^Q6kQZf0Wi0=IQ0GyT#BqIL4X6zFcc#SzGNZ60e*vAzJ!u;nOi$zS8qp6T}QxW zzOZgb^ZVn-*oEV*SMJs_4Tricb|uR__TjEV&0^AgmZHdtd)@#JA zs|P{tu>;s@2vPr~0wwvyVf02KDiy>+7|J@rJ*1Sa&mlm^6uVs4vNh7g;%b)1w&n#i zOYQa1qo{?s_L_?bcPo|AB2C#fs>brF9&I_kE0!GgZ>8SQvqA%E3#uyKmkxE9y@d4e z@+CbGud~+GUZ`l^J(ROQC$CM*#B0?6O`Id9M>%!f5D946+N-}K7hw;xjE8yZTrsex zUp$Rs=GycSDRr5%@iyXZsl=rXL>vU<=jD$qJ73K&m0CPDe!}Nh^lPuE5Gf5=A>4W3 zMO~T5Oq=SM4(5tdsQoD2FWgu)JvFSx%s{3l zn5I9$|7DmIg``?ssK(uYQgRXVBAT>3$$e1MlaFh$umSi(>Np3-Md^Bf zoj&3)2PeG#w&AHLxG9($lUY)iZD5d!8T+z=a zEcA1WkCBYBX9HNv1(wfulH;63}|6snzeBs*I$yfeKS08l0F4lXhgH(A7nxJMeColgcPIPN5ub@B(x#wIAX$Am_# z^1U7s`mqiS^j&;4+{Uo|5M|=6zT{}-(3~xDERi)hO1R@I>Be@cyQiBc={9_KG-Y`v zld&gc_g{k$eE4e z4M&k5T?US&QlwrxIyj9N-g51&YH#(Zrh<l;T|3U2$i8;Y-wbT?*G!mc?UgA) z4gKpc9f2=(MdL^a6om((*9gjrSIS4wjW@P2vCYZEwr$(CIk6_3*qm@@zy0>x{k8jJx2o&b>F&C9 z?vJiMr*3yYkD#D~SPV@Fqtb%OItteQKX|p(<`vH{zjXOqt4ORS^6r~8v-;GWe2 zay&8R3vT5zO7zvwc!#kp+bfpZha|hxGtclo1iM8B$siUkq6E(h$3i>!c;5+)FSj%b zm^0@F8u000f7gHq=oht%az)^~7HPD>Z!cR&HUFu7IH2bmteK&tLN0I!dMUp~#eV2$ z0iXU^MBXr@yAg!SkL`e>ulO;o(_J}?KT*ZtmV*zJAJj^y6cJNnX4C}~laqKiQOxtK zru!`w`7t3V8z-&MdUMwB@=IVX%qF2uK^jxGe9JJo@!hDl#w}Az5WxC{KV0h^wXsvr zTEyGQuk+DRSgFg1qaG~f6DB^ln$Q;Gi!$S6su(aImln+H+5C`);};LUC}EG6Pyj~G29x=9>M_p;ew)h zI0NdDM^1yt6jK;-9$F9LMCFO}aQi0~&poZ>MYPMUlh(WfD4TKQJE&RCsSSU7+Kn;jK$)o}xS8SEAPXWY|Ymkn#0Ak55P)HO3 zkU&dv4Z@MUKl-5lq|y{8i`Si!#KhW43$-(m52a{ z730uLGyo((h>0fo0LWsRiL^2ilFn~MI7DOS9#uTCs9|f=g?iVx5 z7$*;sgc!i*04f2I06lmt%x>MtArL|0em>y0oRe_mb@7WvWS{hH48TzC))M$hF`^0b z1&&~Yd>Kb9K^JNJszAYn{Wy>>{fHFkT_h5v4*Vo?N=g`qd z*whTUYWcEFZ?V53w0T78GVL2 zQ|j>#$QpUUwoqG~Lws4B8hwTW9&LssQ;|K!igp1|I3b=CPKB;Of~UmJxKD(DC&x~; zPXvRfpoZxb2cs^zg&~Y7ek5K*<3O>DfS#h#gCDA z6^blP3KxQlhb(DLW%dLg>m7Z!VjdFe+5be^Ovq^9(4=-#IIF% ze8jI4?+FWkqxL8~U}1VCfgDhKh-3uN9&{+&s7}-iHOK$5F35>9q4x+&7Z815J`xarAmJe<>CCg@T3{?>r1c^$ zxuWb0v!Y&zm6pY&L6^xuI-`Kc*j8}GUdR#mK((Xp6iEExITIjLvnAE$(tsdD^`JA*c35KwjtWgvtJFFgX_cymLt*(+_#0uQFPTA#)W8+%7z_%UkZ0& zwjy7EuI$Y{%Mop6+_weGkzZa#uOZb@XpSt8v7+SY`BBM4Z5_jXE;3c#P@?7xr-HB` zBOVojrPA{+8khbxR6KD6gGwrK*v-2$zM`jjMA)o9ZVpJm0iD}mq$PsGA&QnD;fiIGh zaLAA!DScOwe<$tCXQf8b0MDLCBdsRMPL>${%qJ8C8X}Lyn`bU8Knq*LD-owe8?%~^ z4==)F=iX0;qAl(I7q@6q0rSGNJS6+5kaW@9!|U`UlVxXK4?jP}!L6%_RSd1^|3$D0 zvWojKsRb}aKl+$l1Jx%8p^|8=9LmXG!zRIoywN9J65#vPAOYUIZwvSZG#A zQ7B%yn-A~qyb+Ebz8_JowkS$Da~Ms|iiR73s0LD^bURdw0FWsT|JZJYA_^L6^`0Zu z4L&A$cR;{8+xx<}!My7ge?{1J*<~{lde4K%Be{-~4nXw%_748S zY+P{s3^$XD68Iau59(>)S@1<*SAUnVH~`Wg-xI+T!;}1zV($DFlD{st=R7;4wci0Ljb_C;X)V zG(Y^eF5-dXp?2v-Q>UHhqt z+%Ecaeh-}$pR0P?8{0P9hb`oH^me3n%yy{u^~B>2xOaqI$)yhP?iuIAWABsm{5q)G zpk6#X{gBpLab3-R4<1KcN1!8|Ba0*2nSS^aBeT+7wnOd(&s_I>)3R^VvEF@6F59y0 z9IkbQB?i-NHjy<-PHT^VtF@Jw)xi@I=@hj6`tA<1{}2$r)xpz8jCsMxfLI5c*Zi$> zexiV*pk;IQr#oGic9OG&qo>v5lRD{k<)OM=)sj%%{-)+_q443r=Paf_g{(g zCa#Vu6NAe4Pay@RiJ{5|Poc_w6F-#oW$di{C${FhFI~i3WGzB09P%(LffdL(;dg9u z7C%KdEq|7#$s;Lj3UaV_n1QU&-!bGy!>DYDiSaa9so34$(&tYSE0rms=U6XrcMz8u zd6|Kb0><`&mGgwIeb=9ZHKtefZ)k0qR&vk9bbfZt`G|v z5Jq~N^YWyy+s(H>p1*HH#M}gJ19ocHY_}}VTY)0@ybf|V6g2xqd?H9xh&UkgsOMq2 zf0}^;+~^Sb=;|1+xn#=BegjPb>y%j(dUJA$CKQ8Lhe8mukY3S=4Bd0*NBK2I~{Tw+5((In8T5b83PuaE%3CT-H4VMDjiWCf(im7@V1}Z zh@Kf52T2V)MHosMIT}I|LL?s%2Rs`L5hfH|EC`hU4F>`dIx>jN2$dNX2MhoKB`g>Z z^8f=OER@d_kMIEQ9B4~|a0A%`PP_}nFU&-OF%GsR%o`8g9;ikF(fh3zOb|v8@(J=^QUVM3CI~GE@d@S&`%d%%_Ck20Yeak_ctdo@O<+|}RUlmuUEoyERG?gtTwqjCR3JhSLg0PSePB(0M?a4+ zj3cKbRz1`jV)g`{WUEVdK&| zG>(nPr`vq;kEY-9jv^cSP8&wc8%M3nuEf^O*wS^S3rz1=Agoc9)2(y5BfL=}G)b-3 zt)G8gLJ`X8*bSN zZJA4(S=88f-=TL0?1y!t?50GyJ{u)yvBeORSJ+}@&HSnFs7_rr zen+a#U>Kav9@beyZ&j0Hkk}FR;~xA*@TRp`_Kzt(#xKUqn@{bBuX0t-fnEoUc8uv5{Sa zJZo2z$Nd5Y2Cj@f8oJhdHuP3ZSF9utyV<|HtVQx@#i7}sEtqEZaY$L%kdHEsuAmW~ z>bxjjtC+gE5=l%b(8$!x^M-415^!N)8zC0Q#fF2@tPh0FE_vvL{-oSHDa2)T=*Ypj zbw7tam|y5*_v7CHE!4~L3uN@`PIEucW0SW_O9BS$O}I=M?3a_x?zSNO=(>K3rsQ~IXshG?_T<`~osS=F4B z6P34?M#L~7FkSt|AZNkX)u(bC=z`Ky;vnd2`g|-OSKa~ggHus7m(-Y~YLvOSyU7ST zgVEx*2Lf$r`i_Y#B|?C6FR1n;@b~-3rY6~GFm}9@pS=$ctY3a3p*5AJw%Bu<+7?@p zn_lY$9w?U#+z(fu!;3#Yx_5K@uCJN`I#yM5n5}-(y+H#ygC|aJpIh>+8@_r|O_u9h zB;1lCUI*G!8}m)JHhxIznFl@e1oc1#^?+XdarS{?WH)9Oc|S z`un2Z`h5X8%4h`bB88*hnxjj3%eE~71;C!AGI=42c5nZ_HquE9S4uk22(8r84mv>4 zgSq)6+a;(5Gm+a%;po^jRyM==NWczmu2|`wj{AQtv(dQ1&M!zpkOal!ua@bnI*+2uK zlHG?O4;@_wA1~3i8rm$9-S>{0AEh%KADD9;bM{0Tr>YKj<{G)TH>2N=840{^n!sby zqWVU93*G{I(LU&mqa?1~pFI9NI=S6m8R=cWK)4tfT$43P^Jrb~hjs&^GBbX~uiHAT za7`TnqB_nwNSV@{5|)5C`0SojRPy>aqrIzVzAvWxWgOhYAY!RCp;v$0zR{ zYnM)EdvutlgDo?L1V$*_k;8RXhlnn& z#z(fe;A3G!p(UyQ2X@jiv!PfCvJK&ohU;M+o(j5?!~M)-VGJ~<3?HSGIvVmJSRS%I z(-L`te=EP%WKeA`0Jr67nVFf1g-=>nHuAFSh3WxgV6FyY5W}#D&8UnV3_5!8#m90~Z9IBf~t5pii0k_!Lb+5^W51?Na zM7SV)rRLJ?crAZb5NZ&fBy#RJQ%Z# zD>r_v&KGQUFQxtCccoyAUz;{xSj`Ck7*@j@yJZ|!^2JzT3*eyiK9LvRFr`p2RiT zcDOm@Wl!krG;Oq@+(|$Vwy6vaE&e43*1k<&iDvvJDP)G3=x1|t9XDD{?BWOK z;gOMy#CvK)9ssAdJTIZ(5}SM~x2+~#i z3GL1MZ(ban>O?|(RvwipomKUjiVfn8@~xN|W5L9`fTfr1Vsq<`Qb^vP~q*quALQ z+Pk&t9_T-2F*BNi^`qygo|0IIH0j+|p39RHLD>YkbzG-v>XwVdxw(1Q47AUd>X>g3 zBV z`n1Ld$Z8j9&t9S;XUn;?Z56{9hR&51Hor4}_YbJ7GK>`h4y2hZIc>`!YyMDinAg?o z$Ov;7s&_T9jhuqVznoCuIF%3msaERv50BuT>(#4W?8$uHgy8w4X&d8G{p5wuXW_Tc z^oC)q@Fz zsDmnbjfSdfDz`R{g-R|h!j)?|Kk&AZedHHkukToLI=SKZZ(Yy#U2gX+M5*&WJQClH z4F0IeUbn2h74${n@Y?()|2_E(Z;5J@keJz`HEXIP3hq2N4oER?pd6PRHg&Se{y(Q|j%Zm|}Xm|ec^oxA96zP5SU;5XvQn^I{}*Bgb@4jO1B>n%0* z))z#Tsf~7`(@@e8u-+c6jDf^vBJ5`OTj@5qM=zU^&!|8oG{!N$ zO3RDy^FCPgVv{;Nj!WlpI2~Oc%`S!NanTxZftuq1$svq8KKt75#sxU4kl$WckSdx^ z2(9!PA-iA}fA#1urLO<(YPXv27gSM)?x5iEf|sou6F z5aF37vWT|52BTtmC8W@;RY$W%!^t7rt?rBGc;{!}+G=l~VPEg{8)Y1YCI9jIvDfTT zD4lH&!coxbD+wc4IO&gThwVKu(`vNmOK8^gF`GD-;NXrIaPGhM%)SB04RXd&JlNd{ z`OjCY`6TuXC%fkP3Gfwu$U8SV-Tm=xEcqN^6v4RPVjgDU+3g3+`=F8r2oHCE*<3)lo6 zR&KM;^V|ByL^B831+MY9^x3HVG6o-<{_eJ)qaT{I%Nwug@U*$ReLt{r!*6r4K0Vx8 zT!8)}9IMIR?k`VL*G((e5Vx_M5}Quan9e9nP&pY%ca|Mdw>c*5Qt6+)Wk`FiWWdqw&AHvqz6 z+9>o3sXp8Wtm-p(w*+_krVmL&<%@GTYXH%LIT-h!Tj^hq@_($L+0q9Pzf2w1|I_my z`v2zoujO6<7}3A?zrG+|b(_H?`Jz9CE^%kAenx!S&!IgUWd-pxaxU0Wt>m^u**D2M z(lc|dV0PMlXSEMGYBX4|v#CxR!RfRMM$;H^-Aq-nA8s20)ub-k`BWz@BXnNwT79>R z|AlrA>3GstHdLegx?o4pWG%612W@erA>Eddp0z37Im0^8(0{R=I&UYJ7yZJp~QBx+N;s z2INzr`?<-mGP`e7F1jn>)iiRY&viX1s%#>?2wlA?2!OU2NA z<#Q3uU?9$sUQdmnV44I#jaGu>kln>;||6f%l2dFXh-hA>5xG(293InmpPL}4fs5I_j?J%iy~{B1!9uL zb2=ACY?X)MyweQ8%Zkbpv+Rq^_ohNd##iF(is(S)r@`oWAHuv`bh*xJkYqHEV<{WH z*!IY8fB@H|%nrET?kT<$YcOE2`lEX#8 z8^w@&tVA4{^x)5b_5hGY$?CYNhx~XwXU1 zY>QCNJpP1vu_ndZ#Gv6zG9Ec$_NNuB{S8QRu$#es?xQ*wg^;00C*CmseBcj~C@NPb zpLhT>>OBjEf`}*E988%+DGU=E(<8CM&c~S)SNZ0r3MRRSp$NpsF9)$>N<-6#Kqsb7 zx&UfQP1M5n^@3f?s*SW@dNM;jl`~4gv@;u{cTVgeTS=LuPqvUec<|T3_P?K$Gtd0O zGt_rRF`JI=ARsq)V1HidIN%C?K62Phx%-E ze|?Ckd;F-K^FHK}3Fckb3Vy9z)2ek$!U@b&?o=*=602RpQz8PX`KZ&xg$q>zF@5%- zRV0oeIX)D>OSHJm`xo3L0hU>Ka&&2UQB{K)zs5|HC--SL*dCXV_{8mW7x%~zQ)Lo+19 zF(bMJvCkOCIF||a_?$OMe0=XGnK7(T%+o@Gjgw?IL1KqhGG!m4MpN}?6-RR8Rhd^W z7VP}09>guYJ5WdVW?X1@aiy|EoBXW?7`HM|8`W6wwwdLn5)z3mYyk)IPTRVpsbrK6^5NQOcoA%rDb~WIea|K`G*J_))UH#K+*)&hDzG7cj9!pdxjCg7Q75SS#w2mrkXzaP=#kqkGwBD3ehjzsH@= zGpgX2GhdvCHawhaaMau+rHPN_#Jt038~+S|fs0rfAwxzP(hT8)E&lU^3kx5BE%5m8WEnmT(d?xo+`$ zPgZTmew?S8&5}V_p;}0}YS+mS-R}S{2*gJQXpH>zZ}jjFuff(pQF2jc$v}Eq2)2rR zY&c2sfpDgN>B3{bgtFHnUI63`NI9m+D!ku^{~sV30d@#lIf{=TxIceB)GB;Ecz76? zvYco-nK&PE^ym*I@E90P@xTPYeAuN`G8EAN)(F!LiL}^;jPg4x4s|phXR>TKHy%Y4 zqySnzvDn-lxE*OB%u(2Tkuu*7jU|8qNW2aU3S}n`6mKYpky7oqBgnMJ)a8BUO*R!aGx%}S=2EGZmnU)Jy!Z%@Tc8fv>#Ru}saCu1pV(kyw2V=*(5 zYFZDY3y^A}d0W|#;A%m*s(~AvA(H9mM!>2@KQ#IZXwlE5I>G8F7!no$s^DQ|kR5@P zTx} z1PSzPQlu+*2bEbtZd^Dhq!s<*^HBQS-TBa^t2QH`3{dqfdS>%5`y-f4vY%L}V8Y21Jgu}Sv zQ0b8b5n5>l8sNc@)!r7J1Tm7NFhP*V+~S$MFk01tI z8a+{{;vn!yF~}N6GjJiEU5KY|@{~I5F2!g3DWVLioXxrEteD~S`N)pMwudJiBnZ;x z$_n90l&V&EI)Fn;)Gh$8YdFDW61`Wa9?E@^7%M7|7?KA9AcK=5OB(w;u-ZC>MHMG| zS8D8s{K!O-!Xtu%&bHfgLS{z4$J4W zHM7)X-q2_%mj4oIR23--S1IHiUN5r&heAJhwT{q3Jb=7li*Ho(W=T;xf;Ykyl5PlU z6-UphPtc?DqX4G0N}i@sUmzyek$j3PB`4%H+-%FCBRVdyIq#B}lC64FXE zJ|kis@ei%kg>i7nNYsM~BF%6~lTMJpHHgPZUP_#sZ#z{;kr%aUr;B$hm%Q7}%gq?e z+E_4w56O%OE5WYX!8vrCDryMp=MN<5hy4? z89elqW`jrl$06;j(#T9knaV_lt|}e@Cj-$hh#ntDP=39`Zu$8L+D ztkfa$$waN1T|Z2}S;5{M1P7o^4F2>imlPNEZG?4Q7nW0Lbow4(oEWHZBQZ!}6;GoA zL4q;^r$IqNW~AR8SO}q@z!x((`|eEzVT`Sut(;j20XOKV~EN~ zp$F%I>yBj$#kX;R>+S0TbArC9Z44Ya_r2l;85y?kM)fu)8}+kOX~e@_^2JgJvrn5X ze9p*^wl@l)A0`jy9RUh!FwBM_P>y+v(51i3T94XRxbEDe%b zFn9@n4=Zc86{4LGoDs$7X23H~vRz8SQ5RA#AP^sd`I`}cFDYYx`IsG~<2qOyUH=K> zXcFEYt%9QfxIIb#B{DO5zb9TawvEl!Mr)}Bl;=#IgI$oWuD0%RTA*exB}SW>KJ8B? z8-g~A0u54)akKputfQl&70&jS?c70u5IOK<2pVuB)1XZ-cxZI`twj@64n51@15S3h z$WWwWW7DY3HO*j6iMmLGCNy~{Bb$g#ohB{%k0qyrQH5pQ21mL~`2vR7`WEIzpjm^X z?o`IExlPz6uNq1n5psFz9GL}L5_mMEk!8ft*Jy)`i97eutZ;OxMOgVd&#t@Tvi-9C zk^hlDo2kX9u-m9^TpMF+Yun(Z9nS7DLnTgkVW)PJqm5jqQGvj0eH*>4^x_VDVzbBa zWe$^<-ks;my3>>Pi1x_9T9MSVf&g>NXz%FG0G>y^`43G`3nX9jP;#-{9yNs?0vtq` zDeD7-s@m52VZ!RTLF`Cdv8^G$xp-Q&4A-opqK%6BnbpW&>)#Bk)EXkfA!>doh)*r8 zpXej(w6M;H_L*B?G??_9)ftoHI#R&A-0DFH>ME0Yr6!Ez8ftI2W}>p~bwJvW&@ep_ zz=Xo%a?iGq+tD-d^0DGxVc`H<|R{C4=JwXT_{t zLm=kn1W4j{sD`x|Qdy+x1ajW(&TQ(oU52=76CdR4ggU#|7((bRmg7gJTaM(RXN}sw zfujXXGhO^RZl7wA-X)fSDQa$qil;+~n2T>MSNUDEb5Xhkd$C8hz!fE`jDs8RaS9A;+wDH`Z?ubv#G ztmQDdcOBObog|K7=WIjd0F(P=!#X$%#5yhF$DEp>PE2aT!f$Pyj8C40_^$>Zf4aQD zU25=|^cD_hkAV^k?V<+hqO+ngP8sW#uS6`6}09w!QmS#Py zslNHGc5L|llKTynT1-{#9yZlGXzCX_hwt_19OHdHZNH$IeYs*S2OamFc+c}smio>B ztRrWP_1VxFrmk6cOfY22C`)2?Pj$Waa~}!Rzs^_JW4w$ zOc5c+y2(s)lrrV+q2x~Rm?@Q!h~u>_6?fUQtpD3@O~|@F&qJ@(ghzVa`PPvW>(j0K zvAzJ}$NTVYUM6Uaiz4%p_J4n@pibfB&rZj!C#;>UpV@Xw(QALjtdzugU;OFC8+L3I zVL3bh$8%@)>TI_p-bGL~Pcu zLC#9BCExx@)&vv*f0b0Gs;tNR7aPxI3H6`!pCFG|;e$LEGLhVQ*1ogj zIUjzj9>!W{F=VBsokH6`>*+3SWQKEqHhKJ4RrBLy9y#&gXSJkWjpw=HS1h$<{%ef= zd0u;5kFRU$?M;RI7Pu?S*ZX~(xCx#la;%(3rB8Ra^1_k*;J=YIHGLWBee`Ob2zh?j zqIFDR94?BCEjXT6Q?z}(GuSZLN^lSOL}%|bzdqC&u6!A;-R$NYt9nGcJ$@qZn^(kT zU-}|o%UPtPY_;DzVwfIG9S8qj!dm_o_qX+T2&cib__IO6NGi9qX`900TJL6(K{Tyw z_Xkl)gI}pe6XbW>>EDU;@8hvcrO&K6X_Mg;UR0e6a0Cc_dxH||^vQ?^&R!IOMzmSW z9x@-l$%qB!-pAkjrX?wp+FI%wG8^*i`yUm?_8giiFEj(_|5a1*Tin(YjFTX`pqw^l zCj%Zw@ajx_r^?B%_|n6QuCDUF-Z`f3Z#_4kFV!&P*t)Kt-MX%hACuK5)3&-^gU^?E z)1XMPhuA01ZhX$6IEx+UYH<&J-^e?{a?k%XPrsQ@J}pA797J@sR*4bCZ28E3r`SeNQ;o?SL{ zzQT4nLvv@Qa?em7e`F79GxYVl8SSq+$jjB>8^YH_N0%I4`F#t^#Uv`Cq{$Y;IA z*@^18Of$*ypd=)!x+7M5Ady#pF?$oh?&=D)RfDC!gG#aI?RPb;o^DuacPe95SX@qE zJ3WX+y7oTy`?E7Zjcjk&)iP>M1pM)9MvDZSA&v?vhE9QbB3K_GZMK^v@$imUZg70} z0X2i0q}|5bQJ9&DhMt7J9Dzv~4{LA+_1=?o05=gD$Sg_OlWXPF_>!ejP;l8wqe(n# zJpI=b-j-FYf`d01N~ArI8(IYs0%!D^`2|Zj6gu9R1}ahkWCRbVNJj-!zG1?}Y23}L zpHF&Hc61!L%N-$Uklf7Bp6+LvN;NosyH?;oNvdx){H$|h+WBn0cYQ2Mvjd$cB2N}E zC|>h9Ur%QJ4gP~@gY`$#j?}TEIX~Y_YINg%^O_ap+v@&2aZJb6?fDalK1XQ%pnN9# z0D+%uf`d+n=!MjK{@3h)YU(r&st(3=L&LW5ao#KzUmcuRd%^Yq?xiM{LdD}_d+Huf z1dnm?Ye{5-s)DlN@y?om}}qit_iQKYKq^j1PQal5E&PPd?1%j%mQ5u!fuC}>rJd{>Y#Rg1 z!96uWfR~BN+)7_dx~t1ZV)YZH_MQzgVAP}g`z0Zr*W06Jt&@l@D2)1jr@b&&n|Br!71lwt_AD$yyf3T*C2e8o@r#o!(&8xbh+r8f%Jt{$ zA-AmMt}L%GYT@5|hLW$u;(jBE!ruy0cn-O@Mg;uM_`DJP#*xt`Qss|q#h)Dy1 zQch+>XP>aP9h)rrtMPyP724)TL3DbleUvxA~CU zW4vS3c)&ydwsOpOt?6{~>M=o+n&FK9uRSNSqbIc{jf4voLsL?P+eR|WZ z`NNcREXvdAo*)o+>f->aT zJ$Npq)n}<5>*?6kdbwH-3ZTed%xOLJ;Kztrt3T&?4V@PoGE;?ua)zs^D2nqsqjNvW^kB4usmy zv)(^TBxVc-XXAgbLPS-Qo$X$Gt*2+5+V945LcJZ=PTMSY>dTEg_zCCR-$c11vry-{8V^9j20;z3 zT@*U(*l79U$RF|F+{*b2vxN$d%krXPe%;{5F{c#$h_?lynvB!1E*6vg{77MASt9>Y z_!@C+Y-DrXIKdH|k)Y4G_37@n^EVISb!0Dv;A31w)+en+==#-nlykP?k6an;ueL`^ zf(U9o^kYMu<#XAuOMDpmoA!$cC9Sr9G?~c<&x5ybn(j08E!^A;ea;rU4Tz4OCXU>%t6TUyrG9;Uc zZxa?>dI$K^%AEV<@plUta(bffOtyv`M7S{g5%{=xiw0K*58^V6&2wxvJgbq&1dVjo zHk9RJUVM()sdat@mmquuGu&_eLUD7bdZ6{U@(Aqt&=OyMOna7e=;-uq5j4|%|4a~^ z;rp}UN0rIzY@{Y0MX0Wxwa<#ec>2*>-{0lfK$qcE<#Atd1%usoFG%Fnb$@voFic>c z$2&zAeYplK{iqM}01;Pra|bN!*`MV|^mK;2-(p(ei<;_{fvo;F54W{0AiY92oPRtyTZNx7Yla@kHC-39Pc0>|wW( zERDmu8rr<9gU`*22u7Yu2(PLd^`qcY_ci@bqb=iWHjhmz0v$&~&r=>oRi#FJKV|=$ z(6iaf#=MTtYr>mTob=Y|z0pMmc~P-w+y* z^3G6^E|s_x`tX&Eq#Yp94`ogsEfwlo5-Ewjbd*^C7H8N1U=yq+MAYKL$#)MFXnWeD zt7(F<{Lo(J8kuz(5aR!|4}4DCvEw!WO_csJ!#Tz5k$MxxWOK1;06X*9@K?Jl%-H8x z*PeInk$vaK=G!4f7{uu?OUckC9Va7}zaO8?NyJ8oOqSg`2Y!I=FRvk*teC!81wQ_* z?R|I2D~8;1)BFA`n;MKbbqRYyXLsVTj3&yqshwJ zZ^7U1e}8iJJ(g$l9|Ww9aE$4$$x*A>Bo*!NpVm%--aAtEB|%Um5^C#jaU-XUhLzU$c6*ATb# z)fS~RQ$w}co!z}AYlTsPhSl&X|3Qf%*;-c|=fy4ul!ab~51&>`!FThe{Qh5pnjB); zuM$Ve%)YMy zgSgM*F~u%yY6{Jo90MPR`NS9pM%&5u#@`%X4DKL_{^&5oBEJr3Tco6*CEcjGL` zv5$?f^MS7W_jjUYpv}8Qz2yVE!kUYh?_seYXTzIPO*rh*oL8-Pf)b)p7b32prAXY* ze5Yg1l;+NM?$5Z6EO+q~x<5JXuBB#`4el#J8(v)zcbbO$S>24^?eyk<3^Y2}L{S#t z_n_hQ8S8)K(_|UkT0wTQw6l@-IvAq`{GF|Y+%oi~f=Ys{*oO`X$y6rN-0}Ev!}PHT zbD>*rGho4Ckc>zk9D3_nK8?fybRlC+h~@&i^a#~Vf57<(Xg7a@SE`Sk94`blTBR;X z6HsZhr(S$F8td1E{-~Owf6;^$X6pb|GsIiDX4Cg1UYJw#lLT+x!79;X1)~TCJuih7 z_?#_yFvANgNd@qUTfE02hTYhniPGQS{=~dzq{MD_QOsSoY}K{mYFjs-xcJ+194n|| zB;*ojixakeAQAI~eYED$<-OA=K+wzQJ<~{icb~X@DXNi-ln|4}<1MRZGO7KxZkX+O zeSUk`w4*9M#?>>^yD=1b(03#G%t@zccRNjY>3!7tpltU1t|F+UCs~(WLCkjV zlJlhKzSHX)6Y??GS*@v^&2yCF?LJ9FlI*!Yt`2!T)5G}`cZRD}$ZP0};qPlX4yhi7 zw956mLfCgR>~!GU*XZRGyM0NdtHgVtKIGDM=NQmG7mO7^cVYcjbh$&k>d@Z%x9z@` z^5YxipeMQCc3<`T(DR6dJC~@SgUd!SeTw(8hMxix!c>YUbsy1)fc`$~MP=1~u0if? zN!W&4vyuAMqd|_@lyzwMBK4A|Y-h4Uxxn+`$U!P5f-loobK%9y2PyjJvWSME(uHw` z<=-fC^H|L&eUsbNu)eRg(3Yxy99Rq2pAy=;J&l%_!N>p3L^bhCc^^>gV5vj&{kv%0 zLHgI{WC)!%{M|Im+*s&}!2W#k!gq6hH@1_s^f1Ke zaeUksu}RF>e0b1W#=c$EzDaImMpO&)~}r|!233i~hBKdQZ*2?eC=#-kL8y7}1GfJ=YPK$35ODVIX+ z+O|IoR=`zc6NmE7(OZwJT^#c_9YH7e=KZnt#ops*MT=z%fnCLy$Njdj)w#;7*2dpy zXYU-`He;KFx_v^PU00W%5o;Y;o7ggGIj}(OKz>c?exg0u_I@Niv%YIl2TzQ*e^Tqa~ zTuWc3w`>hmwVK|o_g;wXB+*6U`tN!!_U=ffZkdGA;aG=?y1WXxlkPm^a3-Y_h<0X# z7VCcyiV-k#&1yO3%rnJyIf{Aez2Lowh)Zq}VfS(`T=#Fss_LtkRW|Ws`)mH2_JSLQ z=h``v8!i5nk82h*fBkRmU2SX=WgJI^fQ?;<2GD)s=t78r?%vwo3vEZYGF_w$+UlkQ zVt2i=%i3Odz0z)c03-Mkh`cNjKFl}d%Lo|=Q^W}qc`*?+EGo*&+z1E~hm&a-V^>~_{QLVq|F`F!{-0(0UE2rT;Pr|72d6*Ucj4@}pY^v_R(*8h(o}Ts zz|z6lmll?<>&3R6-*bAx+LB8Xn|>nvC#$~{E2!6m=8q4Hi6yJf9k}s=XMXR|4TJ0d z*wa|kUA=2?{f=<~VS9h`AbMrzk)+RXta94=$G`sYq1juEeS3fXoZda~{IPAm{-e_d z_IFfuEwd+YMy|H~yt$PtTGF}XBGQ$tzR>hUdAy*#y>(ajmShpy723C^c9ZN_apqd@ z0q;wG`(w$K*NzHvZKtMmCZ7G~-Q&Oocf{1x8q9t zjh8pHojLPP!_KGMk9WSg)3dJA&P-diyKdL5^G#D4_b*-b*3?&TPT$mhI+`W}%QATZ zyvXR4l;N@-kA*FBhT? zQ*T?l2@!%0Q-#%od157ejqqfH#QPc+`niT$jtQEIoc0u(io_yd21!N2(KwrOm;&Gp z&%(VTMomZ>BG)=hWFc;*Fx=!c*ri~I^}0)klwjmA)yQ&;MbTt3S(qdXMQJ&TGYo@b z1WFKQK$zq8Q8|z@N8<(A8QgrFlZ2Qoh*3nDF;FcgWQWOw49y$MnKv3QOgmP{i4hb& zK=DEnRVIRac9A3o6C5u&Jpw0*aWN!++JaPwQV=09+-6tsw=wWWMHuGT9*QSNqU%kN z8xAs-kizK@gB;3-`3N7CZjuz+_1Tb+}@2;7WW%sAu6 zXcos=D+NOq!|bREnb!1(K_OKCZ!~j|cUvrQz~i}dCL)n+GCUsEEpiE^jAd?TA|V7> ztOO^DsZzJuMN*{M;-XyUV%$ZWX`7p(sN$0Ow3|$aIZ{^%6eML)_;-XT$KTCtIl4N* zBlqAk+yfiPn2}Lsc`RLH=^9lAMg<;QU1RAQRR%@{9$Q_bOIPM=AKGhZ4u|`5=k5L; z&I=Ax61sQYQ$(6xIm<5W7UHpRpdPv#zaWQsM3xe~a%jjNIjp$)$WiI#L#R(^;1Mg1 zR#YK4VnKk|81;&x3ZSTuP&q+b22y836|F zK!j|gat}JGChLg(t~q^XOS~`^I&wnd3TJKyF;%Vi9y> zWZuF1LzD6&Cwg8yx%iQqsk0v}D=U>AZtU9L;b{9anO9e~cFmCjXY=O#=El|ThP~%! zc>BkHRkf(+(2sd76ApdHTr~DnUU=Z}#{Bnmi<6T0kkO!Ual_A{3rM_eRx9w1E1wKq zIIu@67Xl~6tjGo=+A0~LR6!-PYHHb$zXvP4mov zO!I8P??@njBkfWo0R;VO8A;@ +## REVEAL with Kinetica DB -Project template for all Iron Bank container repositories. \ No newline at end of file +## Description + +Reveal is a visual data exploration and insight discovery tool. It allows users who may or may not have extensive experience with big data or data analysis to quickly build charts and graphs in a meaningful way to explore their dataset. Reveal was designed to be interactive and easy to use. + +Reveal is a Python Flask web application with a mostly React frontend. By default, it uses SQLite as its application data storage engine. To begin visualizing data, Reveal must first be connected to your RDBMS datastore. While Reveal can and does work with other flavors of databases, it is most powerful when connected to Kinetica. Kinetica allows this through a custom ODBC driver/connector via Reveal's SQLAlchemy interface + + +https://docs.kinetica.com/7.1/analytics/reveal/ diff --git a/config/gpudb.conf b/config/gpudb.conf new file mode 100644 index 0000000..661175c --- /dev/null +++ b/config/gpudb.conf @@ -0,0 +1,174 @@ +# ============================================================================== +# Kinetica configuration file. +# ============================================================================== + +[gaia] + +# ============================================================================== +# Network + +# Head HTTP server IP address. +# Set to the publicly accessible IP address of the first process, **rank0**. + +head_ip_address = 127.0.0.1 + +# Head HTTP server port to use for 'head_ip_address'. + +head_port = 9191 + +# Set to "true" to use HTTPS; if "true" then 'https_key_file' and +# 'https_cert_file' must be provided +use_https = false + +# Files containing the SSL private Key and the SSL certificate for. +# If required, a self signed certificate (expires after 10 years) can be +# generated via the command: +# +## openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem +# +https_key_file = +https_cert_file = + +# Value to return via Access-Control-Allow-Origin HTTP header +# (for Cross-Origin Resource Sharing). +# Set to empty to not return the header and disallow CORS. +http_allow_origin = * + +# Start an HTTP server as a proxy to handle LDAP and/or Kerberos authentication. +# Each host will run an HTTP server and access to each rank is available through +# http://host:8082/gpudb-1, where port "8082" is defined by 'httpd_proxy_port'. +# +# NOTE: HTTP external endpoints are not affected by the 'use_https' parameter +# above. If you wish to enable HTTPS, you must edit the +# "/opt/gpudb/httpd/conf/httpd.conf" and setup HTTPS as per the Apache +# httpd documentation at https://httpd.apache.org/docs/2.2/ +enable_httpd_proxy = false + + +# TCP port that the httpd auth proxy server will listen on if +# 'enable_httpd_proxy' is "true". +httpd_proxy_port = 8082 + +# Set to "true" if the httpd auth proxy server is configured to use HTTPS. +httpd_proxy_use_https = false + +# Internal use IP address of the head HTTP server, **rank0**. +# Set to either a second internal network accessible by all ranks or to +# '${gaia.head_ip_address}'. +rank0_ip_address = ${gaia.rank0.host} + +# Trigger ZMQ publisher server port ("-1" to disable), uses the +# 'head_ip_address' interface. +trigger_port = 9001 + +# Set monitor ZMQ publisher server port (-1 to disable), uses the 'head_ip_address' interface. +set_monitor_port = 9002 + +# Set monitor ZMQ publisher internal proxy server port ("-1" to disable), uses +# the 'head_ip_address' interface. +# +# IMPORTANT: Disabling this port effectively prevents worker nodes from +# publishing set monitor notifications when multi-head ingest is enabled (see +# 'enable_worker_http_servers'). +set_monitor_proxy_port = 9003 + +# Enable Reveal runtime +enable_reveal = true + +# Internal communication ports +global_manager_port_one = 5552 + +# Host manager synchronization port +global_manager_pub_port = 5553 + +# HTTP port for web portal of the host manager +host_manager_http_port = 9300 + +# Enable worker HTTP servers; each process runs its own server for multi-head +# ingest. +enable_worker_http_servers = false + +# Optionally, specify the worker HTTP server ports. +# The default is to use ('head_port' + *rank #*) for each worker process where +# rank number is from "1" to number of ranks in 'rank<#>.host' below. + +#rank1.worker_http_server_port = 9192 +#rank2.worker_http_server_port = 9193 + + +# Optionally, specify a public URL for each worker HTTP server that clients +# should use to connect for multi-head operations. +# +# NOTE: If specified for any ranks, a public URL must be specified for all +# ranks. + +#rank0.public_url = +#rank1.public_url = +#rank2.public_url = + +# Specify the hosts to run each rank worker process in the cluster. +# For a single machine system, use "127.0.0.1", but if using two or more +# machines, a hostname or IP address must be specified for each rank that is +# accessible from the other ranks. See also 'head_ip_address' and +# 'rank0_ip_address'. + +rank0.host = 127.0.0.1 +rank1.host = 127.0.0.1 +rank2.host = 127.0.0.1 + +# Specify the TCP ports each rank will use to communicate with the others. +# If the port for any 'rank<#>' is not specified the port will be assigned to +# 'rank0.communicator_port' + *rank #*. + +rank0.communicator_port = 6555 +#rank1.communicator_port = 6556 +#rank2.communicator_port = 6557 + + +# Enables compression of inter-node network data transfers. +compress_network_data = false + + +# ============================================================================== +# Security + +# Require authentication. +require_authentication = false + +# Enable authorization checks. +enable_authorization = false + +# Minimum password length. +min_password_length = 0 + +# Enable external (LDAP, Kerberos, etc.) authentication. User IDs of +# externally-authenticated users must be passed in via the "REMOTE_USER" HTTP +# header from the authentication proxy. May be used in conjuntion with the +# 'enable_httpd_proxy' setting above for an integrated external authentication +# solution. +# +# IMPORTANT: DO NOT ENABLE unless external access to GPUdb ports +# has been blocked via firewall AND the authentication proxy is +# configured to block "REMOTE_USER" HTTP headers passed in from clients. +enable_external_authentication = false + +# Key that, if specified, must be passed in via the "KINETICA_HANDSHAKE_KEY" +# HTTP header from the authentication proxy if a "REMOTE_USER" HTTP header is +# also passed in. A missing or incorrect handshake key will result in rejection +# of the request. +external_authentication_handshake_key = + +# Automatically create accounts for externally-authenticated users. +# If 'enable_external_authentication' is "false", this setting has no effect. +# Note that accounts are not automatically deleted if users are removed +# from the external authentication provider and will be orphaned. +auto_create_external_users = false + +# Automatically add roles passed in via the "KINETICA_ROLES" HTTP header to +# externally-authenticated users. Specified roles that do not exist are +# ignored. If 'enable_external_authentication' is "false", this setting has no +# effect. +# +# IMPORTANT: DO NOT ENABLE unless the authentication proxy is +# configured to block "KINETICA_ROLES" HTTP headers passed in from clients. +auto_grant_external_roles = false diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml new file mode 100755 index 0000000..4f27ce0 --- /dev/null +++ b/hardening_manifest.yaml @@ -0,0 +1,121 @@ +--- +apiVersion: v1 + +# The repository name in registry1, excluding /ironbank/ +name: "kinetica/pathfinder/pathfinder" + +# List of tags to push for the repository in registry1 +# The most specific version should be the first tag and will be shown +# on ironbank.dso.mil +tags: +- "7.0.20.5.20210428141653" +- "latest" + +# Build args passed to Dockerfile ARGs +args: + BASE_IMAGE: "redhat/ubi/ubi7" + BASE_TAG: "7.9" + +# Docker image labels +labels: + # Name of the image + org.opencontainers.image.title: "pathfinder" + # Human-readable description of the software packaged in the image + org.opencontainers.image.description: "kinetica container" + # License(s) under which contained software is distributed + org.opencontainers.image.licenses: "Government Purpose Rights" + # URL to find more information on the image + org.opencontainers.image.url: "https://www.kinetica.com/" + # Name of the distributing entity, organization or individual + org.opencontainers.image.vendor: "Kinetica" + # Authoritative version of the software + org.opencontainers.image.version: "7.0.20.5.20210428141653" + # Keywords to help with search (ex. "cicd,gitops,golang") + mil.dso.ironbank.image.keywords: "Kinetica" + # This value can be "opensource" or "commercial" + mil.dso.ironbank.image.type: "commercial" + # Product the image belongs to for grouping multiple images + mil.dso.ironbank.product.name: "kinetica/pathfinder" + +resources: + - url: s3://eightynine-bucket/gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm + filename: gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm + validation: + type: sha256 + value: 4bc19f495baa221821cffe9dd7cf503759d8b2b06acb8bf6882959842836c9bb + auth: + id: pathfinder-credential + region: us-east-1 + + - url: s3://eightynine-bucket/msttcorefont-1-1-signed.x86_64.rpm + filename: msttcorefont-1-1-signed.x86_64.rpm + validation: + type: sha256 + value: af8d805b8b733cc3603c68fc43036521492c8687232d49c0561943bd35fb6126 + auth: + id: pathfinder-credential + region: us-east-1 + + - url: s3://eightynine-bucket/caravel.db + filename: caravel.db + validation: + type: sha256 + value: daac6ae9cbc8e1dcf274581be8b3463c8e96f20612d001ddd988f35cc35025f9 + auth: + id: pathfinder-credential + region: us-east-1 + + - url: s3://eightynine-bucket/fuse-2.9.2-11.el7.x86_64.rpm + filename: fuse-2.9.2-11.el7.x86_64.rpm + validation: + type: sha256 + value: 078494302e9d4c4ce914f5681c583b9ab571f3e13537c61e4a6db711528d7fcb + auth: + id: pathfinder-credential + region: us-east-1 + + - url: s3://eightynine-bucket/numactl-libs-2.0.12-5.el7.x86_64.rpm + filename: numactl-libs-2.0.12-5.el7.x86_64.rpm + validation: + type: sha256 + value: bd4df28dbd6928faf3bc3bb48de9c511cf623c78d95c0af7cc4cdb5b1818ea7a + auth: + id: pathfinder-credential + region: us-east-1 + + - url: s3://eightynine-bucket/openssh-server-7.4p1-21.el7.x86_64.rpm + filename: openssh-server-7.4p1-21.el7.x86_64.rpm + validation: + type: sha256 + value: d4b2de8f877b5c86b4c6751fbfba32d805bff4ecbb6183831888c833fb1af967 + auth: + id: pathfinder-credential + region: us-east-1 + + - url: s3://eightynine-bucket/libmspack-0.5-0.8.alpha.el7.x86_64.rpm + filename: libmspack-0.5-0.8.alpha.el7.x86_64.rpm + validation: + type: sha256 + value: 1fcc64016b2bf4ae5ab2657b3acd6eb3be1cfa9e19b2972df8aaf1a552db5b3a + auth: + id: pathfinder-credential + region: us-east-1 + + - url: s3://eightynine-bucket/caravel_all_2.tar.gz + filename: caravel_all_2.tar.gz + validation: + type: sha256 + value: 797e1f20eb9fa1f4b5f79e78905725f5403bbf112a34322e1b921a863a922138 + auth: + id: pathfinder-credential + region: us-east-1 + +# List of project maintainers +maintainers: +- email: "kla.ctr@kinetica.com" + # The name of the current container owner + # name: "Jane Dow" + name: "Kevin La" + # The gitlab username of the current container owner + # username: "jdow" + username: "kla" diff --git a/scripts/remediation.sh b/scripts/remediation.sh new file mode 100644 index 0000000..17ae43f --- /dev/null +++ b/scripts/remediation.sh @@ -0,0 +1,20 @@ +# Declare array to hold set of RPM packages we need to correct permissions for +declare -A SETPERMS_RPM_DICT + +# Create a list of files on the system having permissions different from what +# is expected by the RPM database +readarray -t FILES_WITH_INCORRECT_PERMS < <(rpm -Va --nofiledigest | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }') + +for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}" +do + RPM_PACKAGE=$(rpm -qf "$FILE_PATH") + # Use an associative array to store packages as it's keys, not having to care about duplicates. + SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 +done + +# For each of the RPM packages left in the list -- reset its permissions to the +# correct values +for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}" +do + rpm --setugids "${RPM_PACKAGE}" +done diff --git a/scripts/start.sh b/scripts/start.sh new file mode 100644 index 0000000..c481176 --- /dev/null +++ b/scripts/start.sh @@ -0,0 +1,11 @@ +#!/bin/bash + +# start gpudb +/etc/init.d/gpudb start + +# create and populate radar_sites_new table +/opt/gpudb/kitools/kio/kio -s '/opt/radar_sites_new.csv' --s-delimiter ',' --s-escape-character '\' -d 'kinetica://kinetica:9191::radar_sites_new' --d-spark-timeout-milliseconds 60000 --spark-driver-memory '2g' --spark-executor-memory '2g' --spark-offheap-memory '4g' --spark-network-timeout 800 --failure-mode graceful --batch-size 100000 + +# keep container running +tail -f /dev/null + -- GitLab From b665f33a1a32b6916dbf32cbe195ec438377c704 Mon Sep 17 00:00:00 2001 From: kla Date: Thu, 6 May 2021 14:32:25 -0400 Subject: [PATCH 02/14] add key to hardening manifest --- hardening_manifest.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml index 4f27ce0..203bfaf 100755 --- a/hardening_manifest.yaml +++ b/hardening_manifest.yaml @@ -110,6 +110,15 @@ resources: id: pathfinder-credential region: us-east-1 + - url: s3://eightynine-bucket/RPM-GPG-KEY-PK + filename: RPM-GPG-KEY-PK + validation: + type: sha256 + value: 895c34aedec8b1b8728ba5f5a05d02e5ae4e2d41eaefc6380507117bfcc79d96 + auth: + id: pathfinder-credential + region: us-east-1 + # List of project maintainers maintainers: - email: "kla.ctr@kinetica.com" -- GitLab From d4996e593b17580fc38bfc4816713452fc92ef90 Mon Sep 17 00:00:00 2001 From: kla Date: Thu, 6 May 2021 15:42:42 -0400 Subject: [PATCH 03/14] different approch to installing rpm --- Dockerfile | 43 +++++++++++++++++-------------------------- 1 file changed, 17 insertions(+), 26 deletions(-) diff --git a/Dockerfile b/Dockerfile index 87a1e9f..c31e428 100755 --- a/Dockerfile +++ b/Dockerfile @@ -21,38 +21,29 @@ RUN mkdir /mnt/data/gpudb/persist # Staging GPG key for rpm COPY RPM-GPG-KEY-PK /etc/pki/rpm-gpg/ - RUN gpg --import /etc/pki/rpm-gpg/* -# Staging RPM for Kinetica Installation -ARG RPM1=gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm -ARG RPM2=fuse-2.9.2-11.el7.x86_64.rpm -ARG RPM3=numactl-libs-2.0.12-5.el7.x86_64.rpm -ARG RPM4=openssh-server-7.4p1-21.el7.x86_64.rpm -ARG RPM5=libmspack-0.5-0.8.alpha.el7.x86_64.rpm -ARG RPM6=msttcorefont-1-1-signed.x86_64.rpm -ARG RPM7=caravel_all_2.tar.gz - -# Moving RPM from Staging -COPY ["${RPM1}", "/tmp"] -COPY ["${RPM2}", "/tmp"] -COPY ["${RPM3}", "/tmp"] -COPY ["${RPM4}", "/tmp"] -COPY ["${RPM5}", "/tmp"] -COPY ["${RPM6}", "/tmp"] -COPY ["${RPM7}", "/tmp"] +# Stage RPMS to install +COPY msttcorefont-1-1-signed.x86_64.rpm /tmp +COPY libmspack-0.5-0.8.alpha.el7.x86_64.rpm /tmp +COPY openssh-server-7.4p1-21.el7.x86_64.rpm /tmp +COPY numactl-libs-2.0.12-5.el7.x86_64.rpm /tmp +COPY fuse-2.9.2-11.el7.x86_64.rpm /tmp +COPY gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm /tmp # Installing Required RPMS -RUN yum -y localinstall /tmp/${RPM5} -RUN yum -y localinstall /tmp/${RPM4} -RUN yum -y localinstall /tmp/${RPM3} -RUN yum -y localinstall /tmp/${RPM2} -RUN yum -y localinstall /tmp/${RPM1} -RUN yum -y localinstall /tmp/${RPM6} - -# Update font cache after msttcore fonts are installed +RUN rpm -ivh /tmp/fuse-2.9.2-11.el7.x86_64.rpm +RUN rpm -ivh /tmp/numactl-libs-2.0.12-5.el7.x86_64.rpm +RUN rpm -ivh /tmp/openssh-server-7.4p1-21.el7.x86_64.rpm +RUN rpm -ivh /tmp/libmspack-0.5-0.8.alpha.el7.x86_64.rpm +RUN rpm -ivh /tmp/msttcorefont-1-1-signed.x86_64.rpm + +# Update font cache after msttcore fonts are installed RUN fc-cache -v +# Install Kinetica DB +RUN rpm -ivh /tmp/gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm + # Applying REVEAL Code RUN tar -zxvf /tmp/${RPM7} -C /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/ COPY caravel.db /opt/gpudb/connectors/reveal/var/ -- GitLab From 05af34a54bf9b4e2c8120d388e1c4b2e3c3c0dc2 Mon Sep 17 00:00:00 2001 From: kla Date: Fri, 7 May 2021 09:33:04 -0400 Subject: [PATCH 04/14] fixing docker --- Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index c31e428..5f610a9 100755 --- a/Dockerfile +++ b/Dockerfile @@ -32,11 +32,11 @@ COPY fuse-2.9.2-11.el7.x86_64.rpm /tmp COPY gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm /tmp # Installing Required RPMS -RUN rpm -ivh /tmp/fuse-2.9.2-11.el7.x86_64.rpm -RUN rpm -ivh /tmp/numactl-libs-2.0.12-5.el7.x86_64.rpm -RUN rpm -ivh /tmp/openssh-server-7.4p1-21.el7.x86_64.rpm -RUN rpm -ivh /tmp/libmspack-0.5-0.8.alpha.el7.x86_64.rpm -RUN rpm -ivh /tmp/msttcorefont-1-1-signed.x86_64.rpm +RUN yum localinstall /tmp/fuse-2.9.2-11.el7.x86_64.rpm +RUN yum localinstall /tmp/numactl-libs-2.0.12-5.el7.x86_64.rpm +RUN yum localinstall /tmp/openssh-server-7.4p1-21.el7.x86_64.rpm +RUN yum localinstall /tmp/libmspack-0.5-0.8.alpha.el7.x86_64.rpm +RUN yum localinstall /tmp/msttcorefont-1-1-signed.x86_64.rpm # Update font cache after msttcore fonts are installed RUN fc-cache -v -- GitLab From 9cad5055183e0c286ee2509f3efaf2c1321db5e6 Mon Sep 17 00:00:00 2001 From: kla Date: Fri, 7 May 2021 09:53:23 -0400 Subject: [PATCH 05/14] fixing dockerfile --- Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 5f610a9..807da25 100755 --- a/Dockerfile +++ b/Dockerfile @@ -32,11 +32,11 @@ COPY fuse-2.9.2-11.el7.x86_64.rpm /tmp COPY gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm /tmp # Installing Required RPMS -RUN yum localinstall /tmp/fuse-2.9.2-11.el7.x86_64.rpm -RUN yum localinstall /tmp/numactl-libs-2.0.12-5.el7.x86_64.rpm -RUN yum localinstall /tmp/openssh-server-7.4p1-21.el7.x86_64.rpm -RUN yum localinstall /tmp/libmspack-0.5-0.8.alpha.el7.x86_64.rpm -RUN yum localinstall /tmp/msttcorefont-1-1-signed.x86_64.rpm +RUN yum -y localinstall /tmp/fuse-2.9.2-11.el7.x86_64.rpm +RUN yum -y localinstall /tmp/numactl-libs-2.0.12-5.el7.x86_64.rpm +RUN yum -y localinstall /tmp/openssh-server-7.4p1-21.el7.x86_64.rpm +RUN yum -y localinstall /tmp/libmspack-0.5-0.8.alpha.el7.x86_64.rpm +RUN yum -y localinstall /tmp/msttcorefont-1-1-signed.x86_64.rpm # Update font cache after msttcore fonts are installed RUN fc-cache -v -- GitLab From ade5fc0b469ce279602cca4a5d5573c22fb8cbad Mon Sep 17 00:00:00 2001 From: root Date: Fri, 7 May 2021 10:50:49 -0400 Subject: [PATCH 06/14] fixing dockerfile again --- Dockerfile | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index 807da25..8338bf7 100755 --- a/Dockerfile +++ b/Dockerfile @@ -32,17 +32,17 @@ COPY fuse-2.9.2-11.el7.x86_64.rpm /tmp COPY gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm /tmp # Installing Required RPMS -RUN yum -y localinstall /tmp/fuse-2.9.2-11.el7.x86_64.rpm -RUN yum -y localinstall /tmp/numactl-libs-2.0.12-5.el7.x86_64.rpm -RUN yum -y localinstall /tmp/openssh-server-7.4p1-21.el7.x86_64.rpm -RUN yum -y localinstall /tmp/libmspack-0.5-0.8.alpha.el7.x86_64.rpm -RUN yum -y localinstall /tmp/msttcorefont-1-1-signed.x86_64.rpm +RUN yum -y install /tmp/fuse-2.9.2-11.el7.x86_64.rpm +RUN yum -y install /tmp/numactl-libs-2.0.12-5.el7.x86_64.rpm +RUN yum -y install /tmp/openssh-server-7.4p1-21.el7.x86_64.rpm +RUN yum -y install /tmp/libmspack-0.5-0.8.alpha.el7.x86_64.rpm +RUN yum -y install /tmp/msttcorefont-1-1-signed.x86_64.rpm # Update font cache after msttcore fonts are installed RUN fc-cache -v # Install Kinetica DB -RUN rpm -ivh /tmp/gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm +RUN yum -y install /tmp/gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm # Applying REVEAL Code RUN tar -zxvf /tmp/${RPM7} -C /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/ -- GitLab From d54e8c2add0bca839808f470dea7bc15f176d9c9 Mon Sep 17 00:00:00 2001 From: kla Date: Tue, 11 May 2021 13:44:55 -0400 Subject: [PATCH 07/14] adding gpgnocheck for now --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8338bf7..3a54fe1 100755 --- a/Dockerfile +++ b/Dockerfile @@ -36,13 +36,13 @@ RUN yum -y install /tmp/fuse-2.9.2-11.el7.x86_64.rpm RUN yum -y install /tmp/numactl-libs-2.0.12-5.el7.x86_64.rpm RUN yum -y install /tmp/openssh-server-7.4p1-21.el7.x86_64.rpm RUN yum -y install /tmp/libmspack-0.5-0.8.alpha.el7.x86_64.rpm -RUN yum -y install /tmp/msttcorefont-1-1-signed.x86_64.rpm +RUN yum -y install --nogpgcheck /tmp/msttcorefont-1-1-signed.x86_64.rpm # Update font cache after msttcore fonts are installed RUN fc-cache -v # Install Kinetica DB -RUN yum -y install /tmp/gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm +RUN yum -y install --nogpgcheck /tmp/gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm # Applying REVEAL Code RUN tar -zxvf /tmp/${RPM7} -C /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/ -- GitLab From 189e357f32a6861a76a124b379bc35aaa345e499 Mon Sep 17 00:00:00 2001 From: kla Date: Tue, 11 May 2021 14:19:06 -0400 Subject: [PATCH 08/14] fixing docker file --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 3a54fe1..00e1c82 100755 --- a/Dockerfile +++ b/Dockerfile @@ -45,7 +45,8 @@ RUN fc-cache -v RUN yum -y install --nogpgcheck /tmp/gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm # Applying REVEAL Code -RUN tar -zxvf /tmp/${RPM7} -C /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/ +COPY caravel_all_2.tar.gz /tmp +RUN tar -zxvf /tmp/caravel_all_2.tar.gz -C /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/ COPY caravel.db /opt/gpudb/connectors/reveal/var/ # change working directory -- GitLab From 9b2249b9d2bde609f2f3e05c0c1d665229cd0adf Mon Sep 17 00:00:00 2001 From: kla Date: Thu, 13 May 2021 13:09:51 -0400 Subject: [PATCH 09/14] removing django --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 00e1c82..00fdb57 100755 --- a/Dockerfile +++ b/Dockerfile @@ -86,6 +86,7 @@ RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slic RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_mapbox/node_modules/* RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_timeframe/node_modules/* RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/pivot_table/node_modules/* +RUN rm -rf /mnt/data/docker/overlay2/cff31b1c237f964b5d8a6bd5f5d2d68a11102aad3bc0fc19ff367c559613531a/diff/opt/gpudb/stats/lib/python3.7/site-packages/django RUN rpm --setugids gpudb-intel-license # Expose ports -- GitLab From 1ba9b5d399a3d1b08b390aaa73b6fb108deb4edc Mon Sep 17 00:00:00 2001 From: kla Date: Fri, 14 May 2021 10:42:46 -0400 Subject: [PATCH 10/14] removing django --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 00fdb57..410bbcf 100755 --- a/Dockerfile +++ b/Dockerfile @@ -86,7 +86,7 @@ RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slic RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_mapbox/node_modules/* RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_timeframe/node_modules/* RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/pivot_table/node_modules/* -RUN rm -rf /mnt/data/docker/overlay2/cff31b1c237f964b5d8a6bd5f5d2d68a11102aad3bc0fc19ff367c559613531a/diff/opt/gpudb/stats/lib/python3.7/site-packages/django +RUN rm -rf /opt/gpudb/stats/lib/python3.7/site-packages/Django-2.2.20-py3.7.egg-info RUN rpm --setugids gpudb-intel-license # Expose ports -- GitLab From aa2a7476cfa139b0f044278244b4e41218ae563d Mon Sep 17 00:00:00 2001 From: kla Date: Mon, 17 May 2021 10:43:55 -0400 Subject: [PATCH 11/14] fixing hardening manifest to reflect reveal --- hardening_manifest.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml index 203bfaf..688120b 100755 --- a/hardening_manifest.yaml +++ b/hardening_manifest.yaml @@ -2,7 +2,7 @@ apiVersion: v1 # The repository name in registry1, excluding /ironbank/ -name: "kinetica/pathfinder/pathfinder" +name: "kinetica/pathfinder/reveal" # List of tags to push for the repository in registry1 # The most specific version should be the first tag and will be shown @@ -19,9 +19,9 @@ args: # Docker image labels labels: # Name of the image - org.opencontainers.image.title: "pathfinder" + org.opencontainers.image.title: "reveal" # Human-readable description of the software packaged in the image - org.opencontainers.image.description: "kinetica container" + org.opencontainers.image.description: "kinetica container with reveal included" # License(s) under which contained software is distributed org.opencontainers.image.licenses: "Government Purpose Rights" # URL to find more information on the image @@ -31,11 +31,11 @@ labels: # Authoritative version of the software org.opencontainers.image.version: "7.0.20.5.20210428141653" # Keywords to help with search (ex. "cicd,gitops,golang") - mil.dso.ironbank.image.keywords: "Kinetica" + mil.dso.ironbank.image.keywords: "reveal" # This value can be "opensource" or "commercial" mil.dso.ironbank.image.type: "commercial" # Product the image belongs to for grouping multiple images - mil.dso.ironbank.product.name: "kinetica/pathfinder" + mil.dso.ironbank.product.name: "kinetica/reveal" resources: - url: s3://eightynine-bucket/gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm -- GitLab From 3d7599d8317e4eeeebe03f03b9b48d2c07107268 Mon Sep 17 00:00:00 2001 From: Sean Melissari Date: Wed, 23 Jun 2021 09:36:37 -0400 Subject: [PATCH 12/14] fix build --- Dockerfile | 3 --- 1 file changed, 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 410bbcf..f8387bf 100755 --- a/Dockerfile +++ b/Dockerfile @@ -57,9 +57,6 @@ RUN mv /opt/gpudb/core/etc/gpudb.conf /opt/gpudb/core/etc/gpudb.orig COPY config/gpudb.conf /opt/gpudb/core/etc/gpudb.conf RUN chown gpudb:gpudb /opt/gpudb/core/etc/gpudb.conf -# moving radar site -COPY scripts/radar_site_new.csv . - # move start scripts COPY scripts/start.sh . RUN chmod 755 /opt/start.sh -- GitLab From 7e2328093475fd1e2f0767b66520ea3d13cfde38 Mon Sep 17 00:00:00 2001 From: Kevin La Date: Wed, 23 Jun 2021 10:39:19 -0400 Subject: [PATCH 13/14] update start.sh --- scripts/start.sh | 4 ---- 1 file changed, 4 deletions(-) diff --git a/scripts/start.sh b/scripts/start.sh index c481176..3fd3dd7 100644 --- a/scripts/start.sh +++ b/scripts/start.sh @@ -3,9 +3,5 @@ # start gpudb /etc/init.d/gpudb start -# create and populate radar_sites_new table -/opt/gpudb/kitools/kio/kio -s '/opt/radar_sites_new.csv' --s-delimiter ',' --s-escape-character '\' -d 'kinetica://kinetica:9191::radar_sites_new' --d-spark-timeout-milliseconds 60000 --spark-driver-memory '2g' --spark-executor-memory '2g' --spark-offheap-memory '4g' --spark-network-timeout 800 --failure-mode graceful --batch-size 100000 - # keep container running tail -f /dev/null - -- GitLab From 45561d62633f30bb7fbf70a50a7245141108a730 Mon Sep 17 00:00:00 2001 From: Kevin La Date: Fri, 25 Jun 2021 15:19:40 -0400 Subject: [PATCH 14/14] fixing new CVEs --- Dockerfile | 36 ++++++++++++++++++++++-------------- hardening_manifest.yaml | 11 ++++++++++- 2 files changed, 32 insertions(+), 15 deletions(-) diff --git a/Dockerfile b/Dockerfile index f8387bf..98a77b8 100755 --- a/Dockerfile +++ b/Dockerfile @@ -7,13 +7,13 @@ ARG BASE_TAG=7.9 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} -# Set user +# Set user USER 0 -# Set the Baseline Image +# Set the Baseline Image RUN yum -y update && yum -y install hostname fontconfig java-11-openjdk-devel -# Set up working directory for Kinetica +# Set up working directory for Kinetica RUN mkdir -p /mnt/data/gpudb RUN mkdir /mnt/data/gpudb/etc RUN mkdir /mnt/data/gpudb/logs @@ -30,18 +30,19 @@ COPY openssh-server-7.4p1-21.el7.x86_64.rpm /tmp COPY numactl-libs-2.0.12-5.el7.x86_64.rpm /tmp COPY fuse-2.9.2-11.el7.x86_64.rpm /tmp COPY gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm /tmp +COPY gpudbsql-7.0.0.0.jar /tmp # Installing Required RPMS RUN yum -y install /tmp/fuse-2.9.2-11.el7.x86_64.rpm RUN yum -y install /tmp/numactl-libs-2.0.12-5.el7.x86_64.rpm RUN yum -y install /tmp/openssh-server-7.4p1-21.el7.x86_64.rpm RUN yum -y install /tmp/libmspack-0.5-0.8.alpha.el7.x86_64.rpm -RUN yum -y install --nogpgcheck /tmp/msttcorefont-1-1-signed.x86_64.rpm +RUN yum -y install --nogpgcheck /tmp/msttcorefont-1-1-signed.x86_64.rpm -# Update font cache after msttcore fonts are installed -RUN fc-cache -v +# Update font cache after msttcore fonts are installed +RUN fc-cache -v -# Install Kinetica DB +# Install Kinetica DB RUN yum -y install --nogpgcheck /tmp/gpudb-intel-license-7.0.20.5.20210428141653-0-signed.el7.x86_64.rpm # Applying REVEAL Code @@ -52,14 +53,17 @@ COPY caravel.db /opt/gpudb/connectors/reveal/var/ # change working directory WORKDIR /opt -# moving config and scripts +# moving config and scripts RUN mv /opt/gpudb/core/etc/gpudb.conf /opt/gpudb/core/etc/gpudb.orig COPY config/gpudb.conf /opt/gpudb/core/etc/gpudb.conf -RUN chown gpudb:gpudb /opt/gpudb/core/etc/gpudb.conf +RUN chown gpudb:gpudb /opt/gpudb/core/etc/gpudb.conf # move start scripts COPY scripts/start.sh . -RUN chmod 755 /opt/start.sh +RUN chmod 755 /opt/start.sh + +# Fixing gpudbsql jar CVE finding +RUN mv -f /tmp/gpudbsql-7.0.0.0.jar /opt/gpudb/sql/ #remove origina JAR with outdated commons-io dependency # cleanup /tmp folder RUN rm -rf /tmp/* @@ -68,11 +72,11 @@ RUN rm -rf /tmp/* RUN chown -R gpudb:gpudb /opt/gpudb/ RUN chown -R gpudb:gpudb /mnt/data/gpudb/ -# Fixing CVE finding -RUN chmod g-s /usr/bin/{fusermount,ksu,ssh-agent} +# Fixing CVE finding +RUN chmod g-s /usr/bin/{fusermount,ksu,ssh-agent} RUN chmod u-s /usr/bin/{fusermount,ksu,ssh-agent} RUN chmod g-s /usr/libexec/openssh/ssh-keysign -RUN chmod u-s /usr/libexec/openssh/ssh-keysign +RUN chmod u-s /usr/libexec/openssh/ssh-keysign RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/anadarko_calculator/node_modules/* RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/anadarko_histogram/node_modules/* RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/anadarko_linecharts/node_modules/* @@ -82,8 +86,12 @@ RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slic RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_map/node_modules/* RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_mapbox/node_modules/* RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/kinetica_timeframe/node_modules/* -RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/pivot_table/node_modules/* +RUN rm -rf /opt/gpudb/connectors/reveal/lib/python3.7/site-packages/caravel/slices/pivot_table/node_modules/* RUN rm -rf /opt/gpudb/stats/lib/python3.7/site-packages/Django-2.2.20-py3.7.egg-info +RUN rm -rf /opt/gpudb/httpd +RUN rm -rf /opt/gpudb/connectors/reveal/lib/node_modules/npm/node_modules/path-parse +RUN yum remove -y libX11 libX11-common +RUN rpm -e --nodeps cups-libs RUN rpm --setugids gpudb-intel-license # Expose ports diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml index 688120b..772a722 100755 --- a/hardening_manifest.yaml +++ b/hardening_manifest.yaml @@ -114,11 +114,20 @@ resources: filename: RPM-GPG-KEY-PK validation: type: sha256 - value: 895c34aedec8b1b8728ba5f5a05d02e5ae4e2d41eaefc6380507117bfcc79d96 + value: 895c34aedec8b1b8728ba5f5a05d02e5ae4e2d41eaefc6380507117bfcc79d96 auth: id: pathfinder-credential region: us-east-1 + - url: s3://eightynine-bucket/gpudbsql-7.0.0.0.jar + filename: gpudbsql-7.0.0.0.jar + validation: + type: sha256 + value: 05b7be15018205e632e41870146579203a495f00f5ad640af36df883c793e620 + auth: + id: pathfinder-credential + region: us-east-1 + # List of project maintainers maintainers: - email: "kla.ctr@kinetica.com" -- GitLab