From e0442d078a2b5060372412cd4c496c80d4a5459e Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Mon, 15 Mar 2021 15:39:43 -0400 Subject: [PATCH 01/11] updated redis --- chart/charts/redis-10.9.0.tgz | Bin 60374 -> 0 bytes chart/charts/redis-12.8.3-bb.0.tgz | Bin 0 -> 74866 bytes chart/external/.helmignore | 21 + chart/external/Chart.lock | 6 + chart/external/Chart.yaml | 28 + chart/external/Kptfile | 11 + chart/external/README.md | 709 +++++++++++++ chart/external/charts/common-1.4.1.tgz | Bin 0 -> 12484 bytes chart/external/ci/default-values.yaml | 1 + chart/external/ci/extra-flags-values.yaml | 11 + .../ci/production-sentinel-values.yaml | 682 +++++++++++++ chart/external/templates/NOTES.txt | 136 +++ chart/external/templates/_helpers.tpl | 426 ++++++++ chart/external/templates/bigbang/gateway.yaml | 31 + .../templates/bigbang/virtualservice.yaml | 36 + .../external/templates/configmap-scripts.yaml | 430 ++++++++ chart/external/templates/configmap.yaml | 53 + chart/external/templates/headless-svc.yaml | 28 + .../external/templates/health-configmap.yaml | 176 ++++ .../templates/metrics-prometheus.yaml | 39 + chart/external/templates/metrics-svc.yaml | 34 + chart/external/templates/networkpolicy.yaml | 74 ++ chart/external/templates/pdb.yaml | 22 + chart/external/templates/prometheusrule.yaml | 25 + chart/external/templates/psp.yaml | 43 + .../templates/redis-master-statefulset.yaml | 382 +++++++ .../external/templates/redis-master-svc.yaml | 43 + .../templates/redis-node-statefulset.yaml | 507 +++++++++ chart/external/templates/redis-role.yaml | 22 + .../external/templates/redis-rolebinding.yaml | 19 + .../templates/redis-serviceaccount.yaml | 15 + .../templates/redis-slave-statefulset.yaml | 386 +++++++ chart/external/templates/redis-slave-svc.yaml | 43 + .../templates/redis-with-sentinel-svc.yaml | 43 + chart/external/templates/secret.yaml | 23 + chart/external/values.schema.json | 168 +++ chart/external/values.yaml | 959 ++++++++++++++++++ chart/requirements.yaml | 7 + 38 files changed, 5639 insertions(+) delete mode 100644 chart/charts/redis-10.9.0.tgz create mode 100644 chart/charts/redis-12.8.3-bb.0.tgz create mode 100644 chart/external/.helmignore create mode 100644 chart/external/Chart.lock create mode 100644 chart/external/Chart.yaml create mode 100644 chart/external/Kptfile create mode 100644 chart/external/README.md create mode 100644 chart/external/charts/common-1.4.1.tgz create mode 100644 chart/external/ci/default-values.yaml create mode 100644 chart/external/ci/extra-flags-values.yaml create mode 100644 chart/external/ci/production-sentinel-values.yaml create mode 100644 chart/external/templates/NOTES.txt create mode 100644 chart/external/templates/_helpers.tpl create mode 100644 chart/external/templates/bigbang/gateway.yaml create mode 100644 chart/external/templates/bigbang/virtualservice.yaml create mode 100644 chart/external/templates/configmap-scripts.yaml create mode 100644 chart/external/templates/configmap.yaml create mode 100644 chart/external/templates/headless-svc.yaml create mode 100644 chart/external/templates/health-configmap.yaml create mode 100644 chart/external/templates/metrics-prometheus.yaml create mode 100644 chart/external/templates/metrics-svc.yaml create mode 100644 chart/external/templates/networkpolicy.yaml create mode 100644 chart/external/templates/pdb.yaml create mode 100644 chart/external/templates/prometheusrule.yaml create mode 100644 chart/external/templates/psp.yaml create mode 100644 chart/external/templates/redis-master-statefulset.yaml create mode 100644 chart/external/templates/redis-master-svc.yaml create mode 100644 chart/external/templates/redis-node-statefulset.yaml create mode 100644 chart/external/templates/redis-role.yaml create mode 100644 chart/external/templates/redis-rolebinding.yaml create mode 100644 chart/external/templates/redis-serviceaccount.yaml create mode 100644 chart/external/templates/redis-slave-statefulset.yaml create mode 100644 chart/external/templates/redis-slave-svc.yaml create mode 100644 chart/external/templates/redis-with-sentinel-svc.yaml create mode 100644 chart/external/templates/secret.yaml create mode 100644 chart/external/values.schema.json create mode 100644 chart/external/values.yaml create mode 100644 chart/requirements.yaml diff --git a/chart/charts/redis-10.9.0.tgz b/chart/charts/redis-10.9.0.tgz deleted file mode 100644 index 9bd7302ed264e66fd07a668e3fb42df646e79265..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 60374 zcmV)VK(D_aiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POwyciT3$Fo2$)^;hhXb586YQ?i{$XM9fPey*LizD*oo+v$9> z(ykaHAqiuOU;)sMCeHV_--Qc6Pph@k0G~XJ@DQ-`%~vXaBML?E7asyE`xTo`3%zJG*<&cJ}@QcJ87x#V6qc zvH#dvx~<~izLEz;5fw-f8u9%OfR6+oQ8wL&BP7rOaoj;M`4uxxXtWR4yB!qA>CczF zo!(zN0p>mK*2SNd>p_Po_g0POfYak8ScTc0K$O|1&)B>A!ZB* zASfUX2m&Nf2Y?Hf_#$B#IA+(F0Vk1fKw)LAR%JGdmS8&NQC!cL`58S#&m-BVJt+<_xt@35#wag^Xa5NAR={}i^^k1HO?d|RDeA;{Vycb8K z&J~{CP!{n0jt3gHCx@#r*YOly)RasRQA5W}6~z-o!hMSm%=rItI?(}$kR0L<`khlA z2aNdtC%{~Sn;<4g)Elz2LheIHztg?a^Q+o!K%Dun7f}BSGtUl4*4XcB9P|k7cdqSn z+TH2>t+&&8=q>T5di0`HD~#XO0nkkUUwr@l%jZS<|KjC~HT}PjXJZ3?3h4laaHO^= zkO>-Lh!H~*EHLApjSV;rG2(a|A}TP5F%lrggu@L9L!j4~F%ro4xKw!?NaTk}K%x-@ zIL1+cBcDhb?bB#TMu{Q&3D@;Ux+|LCZEV0{!WfPOpld`zGzilYHJ#npZ_ef)X`Anfwz&bu@94}{rdz>a8|;Bpz8s6PT^nhRDVrt$&(I^@L`BJ zmtfDG-yP7DbRRx{>BxZ^;tXf(jRmEX-WDwcoN6zB=%$%Jro5V!#u{mAlKLw9g+}x zA&IVZFFGLGG>nE9-~mCAx4Yx99o>)f82e;61(eOvDGiA~)t`^>5GA4Da)~`X2yf7o zKLs+(MkAS!ry&xUi>KRwLoRs@p^6_5PpCL$nBz!1EsT1<-@i%*m_=A%b%q7h=lz6Z z=8X~(;J#{r_cvmOy*LR&5{*3l&JHV1ySfiAVLpc@@coNH5giS?~EPJE| z%djF|YS3G9TWqL5-x*N*g~lYz*$rtp_H`cCVVFoJQ7$AQ`O=QBU&vwOND{GN9|TJz zmEa+|#)mYC#6Ik)+V8n(6y$0k5e^|8h}OVFPHCZ-)qu!(qjGO!-7XW8(9^ts*x=vWXm3Ew|K6 zS3TRXA+Tm;r$n}n%r+2O&l$@Mn!7O7P1~5C{F)Kgk>Fk1ttKM8ax%P1LYxk;ffz4J zju$7$cTbYjahJ&QY`#VlnR6^8OQV0tT@VpTq7TQ|zq%k3OcSvWFFF8!B$Oo+N!$Pe zdJ`QC1!iwa7!rrO7@eb{^X z?EAmzjeHOUM9-1gJQg*Y+6*bnlbeVJ<}7ZeHX4lG?E2RP#rwMIYeo2gvXl;Ufduih zc8-s@Y8)efED1qKd}P`^9@<)g{+w1)lzoIF%p|!+z)%#>36KDgkS#Eg#3>9ze7EyW zXc%L83Lx2SNwx(XA4$5a814k)aWXF$>azy;lt}no!1Vcd8KF}j_sVfd4B-c2? zTq|4{MgdX3Vnzp*h@N{*XYXxOUfPVOo9S;jmDQUqJ3L$GRKC_Ly?7R_dD48?O0-o4%-02Z-eZcrM z@^LIAzonT-FT&!6vMUme?7RMkgz3p1NrId|S?m~XKkV_M#+bdd{W)dyS~A=yngYs* zxuc$jn=$dnFhNs!lrqg4R z3cP{of{Q3u|E{+XK!^r7bbdO$KRz`Ai&_x`b2YwS(*D_n_LRdBm2wcsbGs+y6(fe| z*ZW|8_Co5Tu+uTUH(Zb_UCTyp##oHy!h#dG9Plws!a!o)a5R?Q7DNIK?_!L>RGiQN zhf3ie$KkXG{}|)Q@_eewwwewp?r<%h$Z`6VG3*-|*$)YhghrNg+?jy@Qnb#>Gje@e zwwfyg0ggyyv>7xq9gy^P+Z0m}C6HLi12mF+vO4=1ov2l+X^w`lS?nSNmjPk1>?Rdt(CWbl3p-wWB-x;ovYkeAz5~2_s?}%Y90)Q|TJBL9s%@aT%(lIK_e^ANP_-3L_-MBZV3;1Aq^| zE0T6*^&3)bQhkv8r@)^?$9Bs6uF|9oxf;7V&LvmFlIVcH=a{8$q;gedN>0L{b_pK&YxPz;dIi(?d?1QC~+`^nA*2kJAbIB)73qWv5$T_rNeF zo-wqQs~HYORo;j0t`w2FseY(Nr_w3wLo&45Dw_i;#-%}TbqZp7Ds=4bc>WkMw7%;xHs~`;&+Zi~>pOaCA)=jntC6MvTaH&fU5Fk%SpB zk-fx>6E2i_SkGOo-zW$)OePpMbw}T-dEe@!1vDosPo7LUF+mX;;lRR`P=3`=S=Xq6te4lPWBfrZ+f}!D%_?6mBRrVi-=nHCjPs4%e{gUlOr4NXx zkSCLTeW*)i2vOipatE7Qp31Oh1YS-0eJOS*s;>yK`_ryc3-2)drj}Hs)itupkLG7} z;a~8ySm75ut*CR*)W+dKxrTgW$0K*)(a+ja$6=F1Kv|%%Y4nov^8iWy-6!!FGcCJA zFg{gvGVo?*-36UDS9UaY+joUJNyFvpMQoJFo#j&a!<_7pYWQrGkVH7Ex2@GVpU@-@ z&E8RpAysxCx_y>JJwEQvrIs?}cr{8X-H;hkbf1@k;louG3@T_J)aD^YP+YvC5vDbQj-bt zIF|D*DTid_Wy>tE_HiD~ImFh6XH8K|1s-7wFmU+ToezZ4Wi`<-w0{-k<+` z^n?5B;LV$kyH3moa+Ztaz_bLa=)EJLwo~J!k}e1!Y&=xy-RBn2<;w zy38}8yrUwWB%vU2h`qEW?$~0}mnWK_I!7TNBZdQr8CBAACQ_0}@)a~teUvAIL@FVu5_bmhvgd3 zA2EuRnEr1%84v}RZ!5448QXTm!NC-e(QE?#gng~LmW`;xE2Pm#o>ya}5TU;1wX8iC zkIFwrX)wsJN|P#igeoT0q*gE}vr6uDB= zr&Imq#D195HefdD+A{EMSq6&JZ}yBvtD1goU^QAR^CKizX5p|g_d{axFx7fQ)SrDq+9s$xfDP}O5o#6qEK%t(Y?E) zKUN@oquN-~0PI;cFxy7e%Gv-$vC>XkZnTpsfx78#@o*&AG^QjHUFZ7%8J^Yr_I&r3 zo)lNA@6H2ioQr@yuYDXa?|>1A$j67W9s%|)8DJ)R5#!W0#mTIG{zT2S382%5G@A_(xctB|x_Q)*Yy2*c^G zT8VDtjnw6^XV{9tsp?6$n=LfiSEZ^fPla)j2J0hT(jK}#)k=7Q|8-ye-Kk?lhpyMH zs@Cmpn+;|}XAZ$sitUQ;zb2eeV;{8elF0M|HYM7uzynHOpqh%3Fx-ZSmYP#q6(H$| z)J3Fi@W+&KhEVSP!u305uZW&>6h2r@-zIGx_WgkkbkvR zu*Bya(Yv0W3vC~LE6+E*O65r}&*XnFBJjJ&*DIBif8%}l>rW)5T%}n{PiI@C6&=x? zs@g{z&VdUsDH$fsyVsv$hB+_j2;RqmlCXu8>PFLTODfGAol)fjXi8BAG&;f|7Ff!E zW)6%P-XxDCf--_ab+t>#z2c!*IbNx=etlk-zggDQy6 zP5<}vJx(V9F`>>3Q#>8-JX0XawQ?{VJY7vSl$N zR2lBzar*nBaMO0whWn3Ei=qz z<&?zov0VB`Mko8}D}W)vVIXC1=bd@0>0SC~>JQ=ePFXx1De5hXwU0x7r2AEs58pb~ zjp3keU1Kva2G>l9ey;7F8Sl2S0Vh=8eM`=Jig_R$5JKwErXd|oJ+9jG{H#4khws4zeLBCw zH(FIE4ksy4iyb1QffmIs@ z^q%}??E*@JTdlx-oR)!_u9??s+rZj3@W^ZfnoT*wnG5zRZ1v?9=CwPlN>BgQxD6E9 z+5j@o4TUqUxS8L{BLi5eLTJ<rX161A{)i#exxEdq3+xD*|&Y8?FMI_O!HsM*Fba+uiN$=AuIE=|gB8QK4N#1-&H9 z^nu0jJ$Scn6xe2me^P5QRWzzYzSzN9Z}0<_IfH{g#{QLeg{LY2)-QOvJ(<3fyY&~W zbZ$j2yN9O9I*UL5nL6q z)n1(422Qv0id2zSliZjN0w~$q-kAx^MH%!|{NV~Qw$+~6&^iN4%2cOQ#wE^;t9G|# z7Ow)k>FlpekTE8~Y<|^ER!7>Bk~_ojFL_ECOqfF35bI&10L98UHj&7l(uApvogH;= z(Up|in3{~t2%zr-+dISRmY4~Wn2YJvvrJp=k}!CHLM-W>8p091iPBG!>xh{N@%k}| zKO0D|x}QI15!Sl-h-h8t!Iv+d;W@fr;MFVGaX=0!+lRf0^TycLoHugSUSp>0E|@XH z`|EG0NZivZ$z*~gi*l9=Oa`AngY54U-Apfi|K&>;zI;(Jh;ndp!HegEC1u$hxIA*- zDs|J(WHfdg)Hwcot`7#~T0iws($tTGsla@(8Tbx%cXsmd`wh)a(5EF@%LD#9{A~wb z{co`YGnlK5kz9?S#Jt&ZFLH(0bqTTW9&{q;W;*DKk) zG}5W=Pp@uy{eq{juZi!(18~+?p{w?i`lgz(AY3qrRH6kRm>M6K z_dHeKy~#N{*z3-i3qWZU3LEC^_;lMsP(t_(;TS@Ut}zTk6kSz#N?8Ai8EzNGKj}Ck z!ij6{M*5YXwbtkqvk9@vpu;hWMmib;y@@bO9g@r?d86`F`c7r(P@17MScC~9A)7A) zueuz*pg=t#5ee`hlcWa;x01ChJL_nPYpJ;uhcGX=&S?SK-TP~`1<1KCE=QzpxtGFM z)VRTHY;-ag7`XLZ!SUeTkG0hulfedxC421AD4cq#Z2?CMw|=QG#&g6URfD~gkq-=4@tQeZ3z2lUQET9~w>|J>iZ9v67kBdz;gs3Wa zt8FAFtrSsic@PlJ61AXUkOU(Y4rXCLunZWt!#PS{{h+{C?wkpU4lDy{9m6K*)B6ay zZ{7I+CT6^0`FQ{2-Nozkp7>sO+{g3XcP6`oT_i<6W1nl$@}w z9Z`{1bYn-U60!h_0@!p*%{arUvM$j? zXm{>>m@rMQ{V|FNpY(LEf2;_5vJE%NxJaXsJRy_ONJ;@JN|Edvzac`$H|eJGL>G)G z*R>Ar-5wn9)Q5#!<84*hSB@>5x=>sk1YP^1o5=>f)lacp ztT+nnx-I`{m$O}jHoB%+p3Z`|C2V|Dw}|0Awbfc1>2Uzp1nKydpFfvt+l7_Jzmig> z39hd-@+$Pw$+?bzsDhTswLv1Sb4-&HbY@EaJ=wm|+V)c4Px*mg`#q;~xk#h3KSRot zf1Y-HP5DUP>HKKE^lumu*!i>#D!f}7#xq^(X{24#iuL6nuI_|HvoYod;gy}t;z4qW zsX+H$VGRxFHSXz2R?+F_nyYqG!Ha$E!tMjTFW=>6<0@bf87=89~ASQ z!Z2MLQ8*AUD2%YsJxqxpOCocLN9%~-?Df&{`Nz|P^YeeaJ3D&yWK;5;Qht+lO(aAw zbLxh=jzh)Jc`7~V!GlNPUz|oU6606h&%FQ%q>-LRYW&iLTNT*t<#X`70Q)q+Te&e` zP#f_!wS;8Hnwo^&9-Ji+ASXs>dJM^BkZ`Q+P&y*teu*55kh^pi04!2i5-p64!a^_s zi9L^D6=dB8)AV<3^a#UjUbNaLx- zp$dKIL=4PAAqRTFSQPkiI}G&YEcXTN>w)$p@YZPA?~6(7)?7souJClR4qPe!gT>oF zJXmD(rj|nfdlND?qegaK1qCF82_08CVd@r&=LsCke_pcP8BRmY!q?FK=*z*?Q95js*Pn`LlzHM?X_7 z>6J5AhT!k@;Ls5KjOo&({qW6knR-_+(;0r6_-SkFRM!){@$3l)FK*3cH_tbM!tADV zo3EEYndBl1xg_$Ex)ez!c%Gzq1wtlEqpZ9kGHG+_GFS!cy>i?X`01|)J*h;YSxLLL z9Lh2uq6|m)l^|e&@hN`)D;i!=WdD;)Y+0^Y^;y!ilUT zSh=T9$6k-oewaClL08VE)~gXJZ2D}IQzH@FrmZyxjAE=3QNx(={j$n4Q*$+HKfip* zNoXhUj$VH}J}ro5>ehWr1}HCe5rHTC!_MzLE|5rg4+Q~}GO>DRethX}mAY{H?(Cw_ ziA9>{G4^{Zd!%g7Mwa-}&GJvS-C0}4UhZtlCk9#a^m&r@x_J0M-c6V-%iOxjtAJ;( zos)MLulM0tsOTF4U12~l#5dM?q&m=ucHfYj#wx~o9qZTf52VztW1X@t(OYvLp5~MV z*M7?daWi|0pXRo}`RlV^j}I$$LF+bK@GD+c;PYq6?lR>YvPq%+{W@jff0bu)ckg=@wPm+3kGXnZ+3Zzw0xBnaicob+!(27HKqIaZYYw}7QDuNZ z0_#zjf)8!NTt7=ZMf?B9F%DzQcu&OPs@iC_|37>FV(&%K{{Q{%&f5NeAJ6B{{qNwK zO!n0+*&zwBGEq+?TKqBIhwu7|fb_rXy#5s1Y~XHMHsvDF>zHz$xin%ahNjeB_Dx+o z(ic7yxzA(`CzCqdf?!GH!^>ytPck`AhC}iRx?ToMQZ!E!s(kOX(?T33JeU0)HkD)B zVCoc7vdC6l=T(`k!I+Uq459m<-1|>S{M-+<21gP>tqCxhB!vOm#&Jm}RT-rx%#v(WjbVML^Q&4;HsY`2{X4J;yrIKRB z*x%}Pj)!?9r3bx6kj|SY((nX21`(I+XA*{{w>9X?PHL}g|1KuaPs`L6XtgG+04RSv zQJvp^)qdGI{Y>$oq2ySUtgpGZb9b<~pmNZ3yYp;>y1(`6JHsMj+60Q?n9-OKwYp+r zSFK7Ssik=BN>?$n1&u&jIXA}~Pp&aLq?1^##qQreAavHy;3OJ_N`kdV zXNdkiwf9%$iXmJ%A)?4cs>`O!Iju$^9iY%?jf+B{{-}{@U9D|VTRbE6{r}|qirP2T zE>5nRIL~Q5UBJzaQmJ@zd}a+h4q4OK7B zE}qWVjHQdJt+!=O&AB#cJ&c)KwXW)V)2=t|cF80sfzKM_ zFL*j@m~LM2`G@MHAitB*9v-xu(1SKpdU&wJP_xwOcQVo}>-wy*9{sFStyijRWp9hQ z*h_lM#$LCARKG2a^1Nt$uvg!Z@0$>|lF-(T(v&{Xg-_~q)A?dOee2huJ*h%@vtS=} zY|~qH&{XfMX<7=mYyRlA0#b{!pG^9d^s|FYpcdN?R_A(pWM-#_A?As9puwYDjKLhN9pgjK}CC znZWK&drX-K7>XyVT{No9Oy1ks<2Iayv&*x{81t#7a`kE%@3d(h8l$@1HTS*dz8?qo ztwrV|wM{@RPDoK=2(EG%Yc#Mp0bIHdx|r3vTE%KsfbM8LH>_m`k+Nj*-G0YV*b#11 zJqzFc`LlK-`&{9rPlhTyXwF*Y#JH(Z`c;*1DO}a}I$cCO|EMb~&Kz$ZM*V>1hgCQ9 z`60DL((Jh{5|;HmfBW<7l6g2BWB*D{yBK4pgXNm^0wB;R4UuRPMAf=y6&+U#T>56_ zwQQx*Zmp5rTz%PWw2j{a!z29ZM-m0l_1JH}1^@lzmXFciit2J;~ zUZcq1j=#jslOb&4Ka}5JL$$43y&|t(&V}?__qT4h)RuEYvL&1f5vFl8b_q2KFb;;y z3UPv4*28ba*$hBs{4IvXW?asT(ZxpZ;}NqETj3FV9wD9Z!3D_%Ys8h!dk;l@&00}AUAM0?7xDLa8dn5$KrP070p(8 z_`OnE^_)2?2inH#%wBfO-IE3XMM(tR-=eNl)N>+Gre$qqNT>9-=+}cc?_Zz8uLp0A zj}9)5-<|CL7Ae)Ot#qsKH+yd2S2I$5j_@pjzgJ8q&jp8H{>tInc<8s9nkv*4h5N!q zf&bm@?Y?Y#PhhLCl1t60)>O~-%h~bOIzFWVT$q&maIT7g3qW>CMZU?MV%!t7C&pO6(#fasC((r`N*b^8PDlY4Xs(#X z_?Sy-CFT7t^lY|`9QhG(XutGKgHSw8E2?aoI=3L`KhY%Is;*rYj34?^=NwP*{%@MX zpf^R672N=CzW=-P?B$E+h5NrR_I97I@BiM%lU>5vhwI(W6^VlVEWv4Kf&~hYK>HoY zRK3j+89KS7X?4*ZI{CanD2^*Z=fHx#lUiBOT-8lWjxi%blBrw|&W*Q_DP%6bmU}4+ z*kK#^G#aX`9tCDE-7glVN~Xg+DGh}L2l*5S+KiycQK^0pZXqI3Amyaz1!X!I1zOe( z*;GJSMZ6K0DN~MMW%0@Z*4TFwTVuu$O3<1{Qr#1ii2Kk)TB@;?)RxtADc4FG9o1MQ zpxdp|UaC3_tF+CHI4$$J7NxSV`s!t|i>H{ET*(xGnV8o3?q?vn2x|^J>#D8LTw8Pz zEEl^`8Kg0NTbhY(Urb^h2Yw*=q#YHYMJF7q4e)IO?dTb@m&i^;bcCMT`(YJr^!wHRWM;}RMB-S%Rb<0SWI@5R!MK@&xVk0b0RY_a7)gfAF z(zB)N+O9k=o$$%jYj% zuIc}MJgb-gJ-vh;2mN228XzXo=%W<%NQ6267*ZdFJw8swm5smj2PEpJ!S1VrME*#^ zv{`#!;Uh{uy}I;~fG3~x!6QHZc>Lz|mrFNrYB7a?3#38tDrAz803-SlC1U*1SXN#= z+5GSUx=%Kpn3$f?*>82>)&B$M%ZuK3Tk!ku@L&H0*dJ5yyoh=dnrEPGca2;17eILQ&TN5 zr=WfPi3pYB5@1N|4h_jQUT@I#23>E^yWOC2WtBg^d3SJheDaeGfyPzpcbnlwo}?TL zAd$%yywE;xB@8K2kYy-Y6M>dQ;G3iZ=dVvLj!#~{Ny)*-llO0bczw2}3YA!Txbqt^ zj?-Psd+6pW-M4)b_u=!8@7|vreLOyWwW~YTmzynpuhLoAFD!{jkbXLQe{y_ezx}08 z;#*ns))q1yB170rn|QUmm3{y?K7I9M_kSS$y7NEglf{m`#sj56&-MpUoz@g>q}kTcErJ{In;)`T9S0Zp}1dB0F`0^H@8TS9ZooCMq_Mh)}zF*sa?&bMhk!9EhCCG9@7QdKiWN)=oRaWrJ zmyT;tGEP?{8ufh2Fy-nFa?#DeKv~e&wCGS+-NPtvb1GP-=Bk?)qubfIawp0ocX)s- zSk?%`lPf&kh9}w)z9P(W0aw;3AOoZzz?Uzoy(iY8{*QzTT;WA;y)AGQ#FRwZo5C~R z3#QFZ1q)Hr9TEx5uCq{0_II0UFV<~vewZNPkKZ`c+InJJOqhbz%ijX==_IBRj>JB6 zP4~O*VmvQ*PpwGnn^L<}ztUR_>u1rY?)+b&``=9ezwf^<=6`$fVs~$S{@=$_Lq{Fa zZ{;3>85w^B4kD{LFI!XSSqE274>otrOboD`OL~&^;mO?9iN(omV4LOx2o!S?ReQ0)Ma0+ zL+0Oh_jau&$??3*imu+vGVf4cr2qN+Z>u>0X3+oV&v#4yf4eW9t?B=LJO!$dPw(fP z0-EgSa{T8`hTNj8PZFq>=vRBGaCP3~DjVKCi4esbi`s3y;4q=4>S7vaGQzP=g>HVm zwm-1?Ll@eBgD|8w5JVgp<}^%Hh*4d`p@7+oeR%QAQPjqa3hL8vAKo9G=0MU!3}_Om z`;!s&^|2x-P%*~Ly537P^5*86z3p53*4KcnaiTAr1&X@UeBTPwZ=Z@~V4v2@!9FdP zMcPG^_dY+ZBq~k8*MaQMS&;H-!iMDdUVjppMVWvPDnk6S(=?m^)j8bvp(|LDs`4Mp zs;Hc(Jo3z1IXQoubt^x0HF}6v*qfzzny)YEoG2|+rgv)4M&&zGumiP4%_$9Pd$ic9 zS`aTy9k~nC6kg7LHCq4$ha_cY3E)0MF*e~P9oD**I;Fh!{oSs7{7;epkAuMqBY)^; z=Kas-JH`C}J3DLs|6ZQL_KRt7L^w-StoR?2V1z}TE-0T`*$4=y<@yV<`*+63TNb>< z$R{K^NP{=2M%*_!=A>Qq9PMk<0rcs8gbH2Ay_?;M3J`Z>%4jc0&84DPKX>?)=zn^^ zvLwW-ISOXc|K~4@_Wzg9o~`fy-^=s4oYShvf)(FqOXN&0k(%RShVB0}2V}Lj|3U}n zvi&#L{aS7R1wOu6P307peZL`MJPS=I2#7p$P?*UXuF0SwzKK4L+cqSLl96IYj3#kG z#a@feC(g+uLF{Ki{%jw&;EB`CzrwwSVR^8pMF06JBme1VmjBn@&i5t$|M@!p-@QC# zCiEQp2_s@^Gzlj8Wr4cqHd?t-N#&nP2l;|uuPI>pzyekdQM$-eMy^SSNBA}OQK%zF z!4QQUcL0X`CrRt{NF@2%ho^57F3ytZfIro5Q8dCS$L>ivrJy_2Xg}2POM3>StCyLe zPwlIWDHq45hgl!x3u7J1zdSuY%3j2Fm_hcAVHCWJ!s!{MD#J0Ka)BrAcb!f5h|$=M z>}x6i!J9X-l*Gk*j@c@)lmeXxPlZYxzadfbDc3F4rGscHd!^!ssp$A9{K+}e9?uAL zHmDTePkkF5vN&ieenm&ZNSQ5yYb?=b#_^S3H@Rux$#lHYWe3x+V@!dKWfu{||`cQzXXFtq$|n z-BOae&X32lNV2(>(kks6Tc8!qQM7NuBy?|vU%QMBioTCC*U~|yv*YR)RO_BqS83BV zOWD#+=5soflPJ5|oR_uOEi#oQACE$TY*AZrXHNNLM*BKDYR&>~UR8Rx)>W^>Xw7uz zUKrwi;QKU*L@f<37t7JmnkCE#Rh_lTda??oPy5iVh#6l2pxd;P^SU|>1PzBIBEm^_ zZr`-iwl!~@LSqpPQty(itoydwX}O~IGTjg~#H_eKotI6WaO*D92R=p&pEBxWJ$DXM zr50Y*=e+K_6`Z!c@y9qwLd^2(F!#E$_3C=1RTTK)Yga#7x5p6&I42+Rm zy3n1uxf{ke6N*FDW-UWg6n_#7{TQNArTcA7mZPRhrnf5jPR4D_w%xs!~glc{f@Bd2G})ba&1`v-8TKl(RGn?(LAAEp=Ym8-y9#Rl$RghzB_td z0I9s43reR-oHXpOcEPi%yO-k(s{2;89<|oPD(x+w&@FYV3g6WosA~Ji+^q=v=(c~s z(=$9Qe{E0`>xw1G)_tz&1wERy8ach($QR@KAn{kw+d=5DQ>12+TCl@anozcnwmI#+w@gydQ0bP z`5c&yp~JW32~7P5Do>86MnBXHb>S(j8msK2K57>3VKvycx2B+Yg$ZghO4%n>ik-H) zhgpXh8=>x$(E+YLJaR?y9V8JE1cgU9MALJf7_bUW`9>-#6|oj$MwH`NJBYdBMOYi~ zF2bPG7D7m)5oRF9D6-nGG@d6P(2 z!zc)Ln|qzFRO~iSeA&{)m|;GqVK5sD#TrG3Lqx)a;W;1{YZM{kPnjJlTbC6&MZK5{ z3Pq?=D(aWUSXmQ-ab~}pFq@t-6=F}q1)aQcK{f4!20ecjqRCj2nInmrl>84MS81LIDS%E?!uM22sv0j}pk8rD- z3y?tdO)X-T;mM#)WmBxKcbe6l3kiRNkAXtKD&3%O%OEI8KyYL=*JcTT!kQryYIY}~w`S;vXNioS4a!1n^{2#qNLd^SkqllY_Uf;TC9& zBhEwMW3&smfNrkf>1QzBjeGFr>DFD2ytI*YZh@b$5F{D_iH4L-w4{p$QWEwP#w63j zl1L?=NE0*_?J^tilgeR`0T?nm0sM(@k*iqjfGLoretPv}GnZGRl9+2b3 z%NKC-elTu?dt7A2uj}!3RglP?HK4*+>X?|YYjn{VL!bB`)H_q*! z$7w*WqvEyQtd8i|&a_)g1{X!j{MO~_lcu5l19aD2Pba#g5hV!F! z4{ejHHb3WbrmkkSFJuk$D%2>@XcnxErCKlj+^uo2rkSOz4K*;AGB?z~T*BT^192&X zLk-NwVR3Nsa<}O7ytamn#arHh*9dDl6J84Xj*WPA?W|^Ft1gg=qesS1rq3PL)SZ#|F(40*>4r1rU0;>XYT%<_OHRC z$nhuI>9pG=WgJ!RmmL>Fbp&#Tq_C8nu&9(UD>g~v`nLm;`@qvBi%YlaTvi1u`PQn{ z8sH&HLIK@wWv7}K>kQG>firtr8!)4$?q|xy`IOJI62_D(#MP~XeyKpkxsh(j86&h8 zHR{IKuyNezvxTFqVoz1BsoaZPU{q+*4y0F}^2cJ^P>L1G1hbyr(g5$n&i5}~)J<>$ z`!bVtF;Up^TQp^5=jU{Zz>^YZungl15UUkdGlGg`R;x)^ZiovJ(Vo1UxvW|Y|e- zhK57p1K}Bzn=y{mM-qYQb>6J+LaV-wnIoZlFJ3mPzgEoVE6~^3Zn7~g(?UTm?%xlKVzzL z$oM0{yePhML0LNV2DX&^yE0{>6U5YNJx$Cz4Oc~7EX)fpWr(c41L(FtsY~?ehAD2i z>Qo1-&QS6>mtTIaUcUYmGh7rU)2=#S=jyKuwOyxk>mrE*B=EUlNZ`>_W4@fF-cDT> z8a-dnHdc)Zw;rQmNTShuRs9q(p>pUH>TlvdpnHaO8je!jfckEvdV*Xl`w%5zn8J6N zhkQAMuh{l#77k{QrI7P;9r*uIJk9a{ul-dd1Dcip=f#Us{{QFCUaaH)-^WuSuT=4$ zZkm8BLx4W~*VzG@=)Jivq6d&3mGy^Op+X^XTJZ#HZWI-xhr2=KTl4`{h7zyN;MQ3QQv+hI2jE`PsNLr2(9o|GRYlzj(Iua(({a$5YsLY=C^5^3N-r z`|2A?#F#SjZ*?m4uKvn zMzK_O4(++;kXQKop?Au+`P9?@0f_<3kumz=o=If2|H4{8Ecn`UTDasOOTHT^fs1L@_l z>=7`7{_nha_Od|#zkl{}&HvxaQ@WPs(uKN{pr`?~1g90rZ^&@=O%VUDi-Okd{}5f{ zRi*!(mH+qqXS>ge`G0qw?XLI#eLRKzU-U^SZ2Z+`2v)1?TiNzn3tl9ra)g!kVQ#I= zmHv)Z)tc0`Cd5zvmad&k1?^B0TdVe5G>z~BBtN!myIuun)(8r9R-G5x zh>*+YSa!g)XlfN5U#Es%r-uG2Vj(~7RMOcX6s@O22b3W`KfgP__)>n|7`eOtK5A1J zR-B=_Ks^5piK<;HJ8M$(;XYrY>e+SfDNnWTNSid(#ga3#Oh3{*)vju>3W~E^s{yq2 z&-ZqE?G?nmI^}(jU;DkXV)}?q5Q&QTtsKcbL8V)zd;O|Ivsa^N9SYukmWe9Rh~KY& zcr|o&)-10xq^~oiuQQ}K_vp`^A>H8!SC=5Y0_ckKqnBH7(xaC@E}9*^vYFD{&6ym% z4bVj=ZxyN0+d{4EW97?x&Wx@HaL2h1D%w~sK6?egMKa$Pzz|u{0$0j zb@GOM#ig=0RJF1K(y-FJ4OI}ACJrmj*iZ%WfzmZBPam2Swl6Sjy>(C=-4pkVF7CES zaMxWt1b26LcXtVa#bt4KcXvpFySo#DLx2#RAc4#Cd+WYcx9V2)KWFBgnc1zGIj6h7 z{TWgaML1)tNUS95N}8YDP;)fnsaPE^TDaJ_0OD{m6XR3aYy$7$b23R364r^)?z0ac z@lPB2&m7u%#{nk)v)P76ubzi@+v1`3wjdNYy%q?^P&B_xkduVKM5(hU-*V zyXIJ+_u>C*9cUhTKfg(zeVh4X6utc3`TrULP-o?_J7*bP0aXjjdESomW+~jKvhkpH z@pHrfOazl)MPS+o!+*uDXVtDJL*>SZ0-@*}?y6Alo5m&Ajd#by)(_88zVZuazfO+y zZ_i>aKC2`BuE{ms|7k9iLvDBXW3 z%N`cwx>+QTKHluNCx_Ok2h7S|2n|Ntt=O{Qe*QDP8@QZ!@Xh*oxwg}*`p>&bH(5d0 zd`6k7j%QGXg4oZzYflSU?QW0V{TI!ZhxJFA2pz&{y4>kG@s0{8Gg?XS%!@P^4&{9D zvr1XkidUjbm9_@yu4OX}O!(tGxhm;QrU)Jzgg|92XZ-e#=BC}I(FYXnoZ+?GPoWv9eP^F^hgG|=3ePus^oT8;WBK*_ zGgFb53A4F$2YjB1yV6-TG|bOK;`q5u)&4{!VE!rdcBhWhDs zBR2);`6Wnu>h1oYz}wUPw=>D{pOV?&Iqt^<-&x?&$mAS+gGMEJG3V$NW|%fwhYa@%ky|$k=-yT^~5DJq1J9z)|=mhl-b*#?zJBVf8Hkv-W_}t zh~AKx>YRe;rW_Iq3OsHcrSvNSiP`pyBJ)CdG~gSp*36muQZmEcZrw4ibuc z+`9|omrz{T0*gb=RFBJR5fOQShuONl$6+AkOBAkAm{iU54FPP8os9e-&|Pwqa2&$9 zwH_=XkTr+=MMy9*7_|K>F6yKv$m`)#cYm**$v+1Zs7&Bv!oTr`k}m+;;FlWO2r3lt zpUEmy^S0KLb#?&tB1gUtE;w< zx#zd@yZ-sj)owXg1}E-|x9;w|?(X8(poha2uh)kFKi(b1apF9z)81Z}`0%KQXL=-* zqJM0ZWU2^^o$1MHFgm`czgXafuSa#?m6^`dc(obLSwxu_1J@*J;Q0d8*B`FSyXDw8_g)J8 z`d%$h>Pi-Ut58v5+iU*;kc!HlDgLRGMaJ7za)_U}^Fzzq9o(sj*-@3Tqge2MqA~+N zt|$%4$$RyLUKrxc%C6Q^waf`2a1)<)O8_SDFL7i_ty^?3Ifcu*1{yu1IL(xQ-V7EX zi3DQbg#n`7A{VRn!ylbdt)C+0$z(e;Iq=l4=f^NkFhg$UaIM@;8M{w^=st#ep8bCK=eX#mL2;oS#rUcV(vDLG+Fu%NLIRL(FdI|J{r3+zup?T6hkB$aEHA1bm3Hp zvY}>H$p#dwq}`E>TCb5JN+zlZ-;*{Ne5PWOFpUpi&i}Xhd%92gwe5Aw zzNUJ^v!8Yg;JQ3Yz*gHdO2Y%Edjy&UiULl6+vV3jNCkEA^<$ri!dV1&v}1W2js$J5Ur6D*_~(8weilL25SM2K;jL@KdG8)y%D{J=?n;Xc+;qwJ@QO?>}c1<7FSm=cv}~(-9W>-=_*w z4bCy9(I{N-ND}A~`vR(E=uUJ1-a%ll49PUxK~?$jeEO>pF&sjR8iMmKWPFeCsV&t< zH4_LcnD@D%=3q!HLOeSY4)l^S@rxa%io=+zwrH4vS`1{5I zlW6bRQ6dEARmX@#Ap?D^ZjE!=YP?I^e30wcncoaMx?3rUzGya#s3)|!1IRL&Oox`= zvQJr6QAbf?HpdZ>#0u-dC8~DHRc&q3+sic(xS5-iZ^v6#>Icj{-G763t(MowpL9X(l zsI*%H38`t3HJ>HSK;fByks^b2y9Mg|!ykeQ=7sbN7J2PkbFc;qSK)tCf~R2#EZ8VX z#^nN*n10FCl>a%`b0=CFQmkzwstk@9m9fh#=cYUvq}nB9_wn)e)(MAj_ZYSr7Vaqv zvm?}!zzd-2*G->nRSz88WA>$f(G6o|BF?I@MC#%A_?nN|qA`nQD@4^#_RbnnleFYm zB*E?*EE9wVe=Ocr2Ezb*|9OaVM$q3W>`h9h`K0B5WURtI(@d=G3F29sFc5AoH))3h zA4j-Ef-cyI(q{Yd&hf$8Ab0}!-lwj=4?agVqcwMhjji%fqsmay_&{AW3$Z^7b~qzv(jPji4f# z9_IQvaLj>*-WvtU1ki=cN*TnLFO9w6BDwG+LWPHJ$?H&R2K&Sa70d3qJwZDo#(t{Y zwaD;HCZ8OLGI!Un?a+UGk)=PFVdv%+>bN9SVa&N0JbYKKx{M$4lI8dO)Zx4-T_^1u z4o*sZFAHsk=V9GrODs|wb0qD_gm-uG?~W~t63-&YLKj?0$B^a?{W3on5|CSQ*X*def_9VmyiBdz>z0@qepouJ! z0;|I*qFtHaSu5znYxK*I=`ahRVjaaZFZ%R{VA$&h%SUuA6{jM)G&-M9SW?Z3DA==6 zc1A-w`16k;N!@^EKUv~0KA7mwo}B$^!J&0dK-%}}CJWfHhpMll8KVlQHst7^y=hzj zsn6OI4>O}zBI{uE9L6tC0r1tpO}uf!iW1*UdN&L@xjXXXRWcHx%zLp~>rhNonZknz zMXfU4OyERDF|7v9DUrUKZFMa`gGB)22C}_z36Cj5du56Ofo)yNJR%#70Vkq$Y71bX zU9F8_yHARI=-nU*8!RIQJA-{H*7tQW=%BJ3H#Qm1ctploWHBvX3K^@+$ij}u0G91*d6ppUAshlw@WQ`~2?Z_BzHZ&hVj@?4 z@rdh^52nb-55IV<`4d?~L-Vb`jnKnZ0KAuA(Il$5cK%;Y!%msHN4DI_ybLc4H;KIT ze$lqm7ee7mtgOBQtuvertjgIuoj`&ym0OQjsX%;ldRgwLO3}LxsH`b=8^$Z}Sx38< zvI92;CP+Mmf2f-TowbZ@wrl{rZOR;=#6u@&b(@W#`!MlWHeVlmZm=?ik>Ue`ht$v=C;eW>4u*0TG55&~-sQjlURr3ZV~hEtC(P zF~6fs5JZ~+p}zJ<_5Goy=nw|lufja~VCZ#)dtAF5ekzPA(0j%Dw>5BR5=31ih(@2* z6ZVyjuTDF+4k;9^Mn`XXO+Vg3F24}~uPjinP*JB|T`vOtorN&z8r8)~Q5H z@7M03@$hm{{KlOCZ|hlF5;u1LhF>MK>Lo^iJYN5_=jGM33mhn8YAG%mJ z2e8axl>#%JxET#{>R2=qiQo-swJiPxw)cJogZlJ>5397t{?{AYp^_yJDv#c+THgde+X)g$m&-ImHqJ?LgjjaB-% z*Lz_zULsyhKxh8BlHG3ResA{2FHLCyhJ1LygeH1>!<(M&e4hF8sA6J~xB~nlvhzEM z@TQPo(&>6JqeSsU0crbsKcLb^PQVuDnFht}rjBNL#Vmr0Aa=J2fyLlO59jqu|Kd91 z)czk-l~sOEH(%d5bAs)G-TsbF^o$WxkT%%&QITwWV18C$i9=@!-3k(uU66k!BQgjh z=eEIc^|!|&rr}i&vrXEXb^tsF;zl>ckj;E@i#i&oG{x7 zdlxQn3~AOoDoYDEF9*KQ2VI}~;O^XsAx}|{`xnBV^R&K?-wmpKe87~pQF<+EVr^bY z=?<;6TP)=7YuVCNQXDW%;}siOrh8x0djeJn6TNnzdEg%yGa0)@VANnSJ#FyaN!Q$s zLx^a-#vRn%)0@_tJ0%g14M2YQjGk%C=7U9*0O?eV){cg)lL^p8XDtz6G3`4VufJ)p z>I<&BHr3Vr&2IZW2Cjo{(EVa${GZ7Hs9PU}&e4OQY-M)G?5fcmo!dyt?rUr^#lJvf zDZMLpR~g^>mtV80+ylRa!oL2&ijIAMFqiKRsC7R3KJ_#-09K83dKljJ4=)%T(8CT$ zWHN6wq>=87PdZ$a8fD8)p>TzRRBQg~LlpRHaN{4gN0S;!C~gG-wEGIGzF`vFLZiZM z*Vk;7I-ov@30JqjVWIVmR&N1A!)%5mSue{Em^vHMx($yTvYd;Eh`vMy2yZFme?byJzp%u3Z~eU1 zQ|%L-HoLT)4Ixk+fCJcLhPphmGMW}1f&Qk?!u?Or#C&{GdhN~2pFF>*$nsfFBV|OO zuKs>>Z!SS?fZz(c`_q$?5~!Sz@D~@}2i&;C7U+Rhq*NHej4tS!3eYu{C~i>8Gv}px ziq}dRG&(hBz!GABws;$oI4D87G6`%bo$e30j|${54{B;hpPGAfavo0`$k_9+Hz&}A zxJ9Ox?}C|gZZNEL3?}O#oB$H)ob3U(FDGByGf01TNAeqS=GzGYn5lExNBaW(zw=)y zGSE`Pl23W@wPC`iB`IxMyo)1q<Dhhn~=f4a6PC#f~@EiBEHmoRZ~|(|b@5kR50Jp8kG_54XA@I{?i&a@VwF9}YCv znJRk3Tcmv}T({*Nw7*yN)n$6`dfZZXj3tGX-jq+YB3iPJ?Yyfr?(C}#etWRzHDvo> z%S$@bNGgoat{npLR&J|utd#l1zg(?*v{9kma*_@9pV++{A6^$x`T3#1P*$=M+l9re z%4oZ0#k^39cWA}9jYR5UU-Mfw&)iH^dzsGfz?8vvH_$ZKzN7!^QhUtSzG-2ehLahQ zAa2EmmBpGJdMj6cM|*w+as7oA9cvD3JsiB($PHrc@dG55j;BluSoz=n%&lhW=IE*Ahgl zjtu%EGhkE;u@b848E7fYyL!3GN1W6c@O~fk$ZBgN*t^+cx~tWiZ1mrNL@0Um)#qQ( zMpXFU;s$)9?K7Tm4?&aGkBf~)wr4I}?Ow$2cSUu*(`zdPz)B3Ke@-Lq>=uQ>t#=*7 zn_tZ_mLl3;c`Xbwz^W7*Pn%FDqfp4i+{#aDM~6Y2Hq`%b_l+i^DRhVLhK3f)3m?LG zyo-<10gKoxzFKZ^I)b(Dn-RZhx$cMWljwK{X{oqbZ%C;Y;D`(1jbA)u@nL`0;EIG0 z;w){3sRqGtPmv;TSN+1?)OHi@nHHtcMp-Lb z5k&I(NBz%MTTxO_pk4szhdFd9ei_*Rm9 zaedRulCTp$u>kB#ddH#~AciXYbk)6QUqnpNe^_bN5yGR4Rz%&9PMkIsYSlF{mD_C& z?wjjr)eHw)6VEtEut;3AuI{Ey?<}s-VbK{HE0=%8@-U}LfVFTIdM}YX70>xm4V`_8 z&3+ZZohoM*`}#Ga%r;Fb#%sJ)8+hRGocfO(w`XFARw2uf74Ry{sE|!l(8u=jrpd$u zDw9h>7RBBr{f15cUl5~P%apQ^Z@ypE^gca|YS)URbb$o9QP!<+7I_>1yGvh`NQM`$UWmYVqVWHro~}mv z3;h>gpk-@4giNB|YnM0tnPe5I^&4p_z4|yT8hZ|8lCea|{+fF^mrx2H`$KiiqA0^ITFvLP&$KV`0n4R<8|s3ny|s6tGOq8r0UG+rkQv6sT@C| z6_bW-VN%$rBrZopsMb}Olk@p>PrXgyj~du7>u3H_=-fZn9DI!a^fWa#8_n&F82|R_ zre^VNn60)PU-F$DHd-&D&KS9xDTDg*e+$vxU2CH6Fl*ld?;S|sAHHI1$3e;iYA`aiV>K_y z|J2o=ayxn$)ZA&+DLQu|VI6AOjc;tN=B7BuU!7t; zv2ES_@j7qU@qs|>k^Viq%@zKSFK(3^sfN5MgZ;oXw1gT z)ugZg@=<+S0nAvTU9%z2dq@{>@M)3#B|>Q0;wYP2D^KmSA@Aq9IILdTs z{dV+eUUH5qR-dv!#UqhDcnQhU&d5TK@p)x+;PV85xW2Em@eeQZD~D_d_9Mge_9`s{$-tnGbZ6J#h82UgOGkIgE`R)7h!W{jLu~n8NTq2# zzL%*{pY@l~rVFUc{yP1%dLoVP@Bpu8bhR7G1d^A++OD~)Qnf{*n`a*-UhHG8UFe#R z6*X~!qlQ6&Ff^$a>Cw45{%J72#}MbB!q8mM$cTz6y`I6hPvnz?{wA!73cHbanIg}% z$Tf?0%{Tqq_}tO^+tMdlS`wN9IT*`3lM6JcXgIy>sV!+BQ({a}u$Ntz^s~Mdcn70< z^sfncPsEvitu;Z=rNnjD^Mn`9{WbaP^6Vp-3VpP6lPJw`xu$5~HW#B>;3RwE?da_Y zUTc9QthHewi-kIKMhZn8n%OcP8O24cxPW2#NqRwX~`?XuZN7ur=sN*u~A!w|`5 zJBvUxJ=`2}LnsOonOj+E?n2oAvP%R^sEjMHsb2CVqS1x8GQy~XRhZ3Ch(eE6vvXL^ z<^v>O5doGMvq^tnU;e`L%N+9DOrbZ;X$^uu3Ntcp+I6PK#adz!leKqjcQU6K?Zku= zJVQwodUQfDchU^6DxhbJPZ)Jq0EK31E;vk5_9^r|d+P5`uEIro_~K8eN4s^KDETE5 zLESJ?q5EeydYAo~iM@CQ*R|q12nttD;TNsU_UqeuppP#8>Nk*F?K_-Ka(Dzer0~2s zyk6WEO}4>2eEr9|l_}|`mcHUJ$v7kKbXiuh5@`)?^JpWBVO+ZQC~y-)Oh1VvV*j6y z$5T@??6worf4)3yGrSamxGH*&e@nU0qI`%`p1BO^2X~6r!SW@i8jl)t&=m37xzc<> zx46? zYne=~{`rQm&yjlIFdh3;@AsOz_)-EII{)nub(hD{hkT$42gpDyV6u?$J8{nQ2^(?f zU5f$TN%YVcoHhg}S^~|-8ur6i>b>RTfr^e{)}2Wr8zP-AV&aWq3)4lH4f{zWnOU@Ijwzn|!n*zx%B6Xx|o z&LH4jumNnZ1EY{{Ar%3#$4MQYt=*Vm$fjOQ7YB3_JQC)Wj4%+%uFD_NC|W+00RvFm z*p#Tzbr{O&e`Qr|;-?^S5`xWw{Dm{4XFrXI7TU8BaFY@C76=JMF`9RclQt1$6rv;? ztrJ)Di+cx8(R*ikXfwE$1>e{myJF_jrRx{k1b$;>>myeSRGiM;6dUeENw%qxm|;3v*8a(Bhd#kjO>R} z3%X&mk8gza8JfKEkzfGg&iRSLhv;Tinqs72gGHH})$oG3VT0@mCS|T?D0JrN4dHdr zfMTfiAxbg{lu(4*v>&)Di%F&Wy+~wG>Anv9YuvlEC&V@WNmR!?tNx>b1iGzN5MOpU ztW`)3RY;G@44K=95EgDD zbgJ9ok4?i>N|9Atgm_a)5RHyJqBbE*;=+M>Kl37cj|JmpBMxTI)6-m=!U*BvN50hR z^oQVu=Fg>L%PU$fNo2)p;=Zi$lir%Q&}iGzm!*k1@bds&Y%!W)nu(LchKLo$c&n&j zx_HHS7f-=hdoYj{oG1(le?Xr;33XQ5x-gF!={15#Q81e4RO4?|$#)(Bkdt1P=x(%|DrY7OE? zI2`XZ@*O(_GDEz4|7f$WkH%Y~KptyrPFK-a%|{P3gcrtK3dmk%FkHJz6ervjO`RjDHZJ5IkLp9eJ`CepJF|@y zbj->>%t~Aeplls$TVYbmWAo|kg*A^}3mqM40w%;o?cRrqZKMuFk?MZMsxMbk6cm5N zC!=_c0FpFr%F>82K})wdXKVrRm%C_jW_4tCUVqrm4&InoPY#Wv%r4bW2~^iHpD)cv z_JY`U=y*9Dc*w#7ro% zObCTUFbYYvT;MQ41Hyz@iZhG+qPTHoyNA*fti3sj+RTwrT089Aq>7R<5|WWfX9iBTI$(D}bVuha9G`Yj>QA&_ONC#dU6b>Bm2-OH}Tzr+8+z?Sul_fRoLc`!?JU`HT!G3T!Yjdx2!O31%z)AJF#= z7`h_S&q$HusNtp*luy4`Iv#OALLRL``pAg`fb(37!7T1Y?n9<*gi0`Y_@)9O zgv__n;$y!zKuxl=xL^w07)POUnrjpq!Z0^N6%J2RWBocJ7e20j=aA`JbHcE>rnoFb zM*!B^ka&}2<8r)>8q^QNkxNY$ZQinqwMTQTNqkB@(JUg(+e==-n|*>>O_bSsq>UsX zhpMlf^IxzDVxkU)qm|1}eV+x!Q0}fUm>X$cKDh1P- zcR#kH0V*Ux=fVv-OHAjB+s3Rz1FVJ_zh&-|GkT;0Wy5v3EqwOdpH=jZ^z|W`;{#tJ z>B=L;W`|cCz1i7U{B0`htk!&`o2LAAUEvBDKA}9%^FQMp;BwRRNS5$plzzfc+>&44 z^Q_t3+3w{QA&=AON+qgaN*2J4xj?VGRL4cdaHd6=LO`%hXJ<^5G+oI-a2HoP6%_nU z+`^i^TwN}RCJ$6?8g5+tK7JG%E}TjFcb16Cf-zS7H^;Q(g>D0qtZ~%dTBsM7x*~rO z7fpi{d_AS_FKie-6+FoI8hMy)fOLdMPCiN_gL)8HGv*BSS1c&q!A9UHuuqR87Zx=M zkDI-9+w$x;Deo63SCs}SN({+98S-o4?Fk9g4U=qt%3ua~yk~9`@Qf3DuImEZ(g4km zo!91NgO}6#$6>r=o6xT*kXdcy@!CCii;LOzY##mSx@shM5iWZ>&RLWDAGZYQh zWbEXt`>k{=26LESuq}|q7964PV_QE?ghnUMM2|dhO(&l8{)wU_0XiC{7G`D|TFK6t z{3S6O8YS^RFf@>3&M&ZqA|J&1Q0(3EP*(ez6^KBN{6aZuPNVB< zzWxL^mXoB~WizLNKW=Cpe-+I7>DJ2P2MsH358Sy};Xg`gn&=xVv$I0@R9*a;2^mJ* zm=>S`hGvgGM_Q776C9Z#0*O8prEKmCHg8DNhyGkm>!I zHCx%4RQ@!!)qUwhla#-YAq)tP>KA3ad(4KBHu|(Pic2x15}6XeyvR+(#948Q;9^8Y z!5jWC=t^)C`ayQq?DT{;l>gEyRYlJb_r&wfL)<)?$nq(^p19h4EDgAks36R{#B<)nMfnKNZkk*)%bB5x-HpaUTbK=I3&*a1=XFi;4+Mt@d$5Q z$?~d4y+Pt797dttcN(GjGiy8(_jkS1~{e8k=8kEpPz`kG<$@J!~OnE<|D`0K# z!l3b(j6u_A(3lohTmlgGE2eos#HV3AFxbbHP%x54g>reHo0IDonrCKGsk;yy@tYJK z^BWa5P*Iw)%cEM5rfB(?%U!}Bm_oCu{nz~>qhmoaMI6sCc7=W6k<5Uk{uL+kNb}!E|B<@*T0B{I2ccGFv@bX{j#f{7!aU76csGW&PI)&8> zF4<_bDaE`&B+4JpQ|cCc-Nd8O0v7SiS*ut#N3DmH#<^wt+99=nVInb1LfZ+!yCkq4 zLx#Jqpw(hlhh+*O_lL~$SK*m+HZqGM!nm6usz{reH9flm_+ytDkS4_NB`&BATor}0 zKlOz$`Li9@XJZIR?v#x6UpzdQy5mj_aX%P#u)8=wjohq8?Dtc zQVEQ?D6u$mFkO$1RIHJ;pe1aKl`BjR9=cf#B+rBla6C~x`qA;SMU%nVJ}fVw4YN{)sSrN)*!f%0>{!)ch$`~>S5Ixa*Yo+h zP)xd73O*^gSIXE~$$bF)VH!vJ``kB5+$MRO>PBsU&ASVz4tZq{d=M95kE=5q;ny$gaCQI+%$haWSpX7b0` zhN4{{f_VZpAFTv-(&kFSV5~t9QHTbrp}Uj0T63#-8>@f| z^%g@CNh(6JkzOHHE!iY_aR}*StCrnfu{(^bdTU)AFprh5T)crc3|JcjxyA7Bvrp+f zYN!EzH{LlgJq+lxkffx86--!mH(C0m>8wY0y|dlPl|&EEq|8s53bbfKEZva`^an+K zU=sN2ld?ntt=*dVYqk$v1L%F?{Sp$Fbv=Yy_&^KHU^sMxC94f$X7MY7dnu%I{V+&P zfDJ5Nvc(#xo5_mA(A93C%Ne1>lm6x6%d~oC=QiB9g-I9v)Y8e2Q*y*DV4;$)rY;9W&P$$SlI@$*jbvziJ+S8{K=uJy=b7nWe$HJI1xx%}7zY$Hj5}V? z0S__rY4sPf*1vVGl^DYqyEQrEMA=QB|GDZ+Z~WYU2HOU&J9X`bZYJ&0rHx<5w`UJW zxQg(j{PMN^c#Ca>NP;N_gGPpoT%Yiacy}*^7)6WnUWeMgpIUCkYH5ruUI87kpm{tG z&H(tu7(_#&Q<9;5vn!|MC^Gd1$NnidxzrH&NvKFt4#rd)1}-X_J4*#rP%Vo=HJA9+ zkQ*%k9ZHOxRsah}N5$ZlC(4Qol(HpfGKAsuk%p#_eV$HGC5~Ev#XuMk>LBU+jVVce zAgThLQ_c0Wp%ls37R}LmD|(}i0pGiWfhdsvFiwg>oAYK?yEHiPtEz1&LadD-k;SwI z>IPhC;yT7Hkqx@|3>yj8ak|}E4!z?cx5>%Q=nq|pSVJoi`+J}K+#UjeCM#hPAp>JB z)~F86`Y+2WQt)Tg1vhbwnk4#N0e-{Kmo82EH~=8VZ3NLLDp~h2(}g@d_8w++0P!`u z&y&EG3m7x;w*;apa&B?fvj%kMJu48Rp=djbv&wUXc~Vwmn{ahUGs8`5Oa}tDC;cyU zEu~{6xQHg=&Qc3q=*?vtTF@bu!nUa}J}qV6aN^+}G68d_#TwZ7MEt88)rN+RmLrfi zDRyQ5ygLxB5)O$L%T5$#@KV6MKYUf;_cg+M;K~3_4bM<`sU``!S-7S_{H=TI1Xv3F zixo`HU=zncGe>_5+_wHJ%;Bq3>15p1Y7xV`r~7HttPW z_;uF8()kBl<26MKk72Zx!Vr%qzLT0aKlV-2C`dDo4?AVeLbt}t4jybmA3RiU>p%%W zD}s|BZ?GbXiteZBPQsLg+?-Iq)iI|B!EF{guT9QqEul*)WfkgnCrJz{;>bCZwP({R z7L8c{5RH3WrrmX@$B{g*CFPCax}yWDNAGeQXeXbAdK|Wsz}>+LQ6~oB+?GURBKZowtHc9N^oxOepAbXLE1`|Pca2zeEOd=3PBloBQNy6k+^3TO zhd)JcOH)HZ7S^bEQfF;V+N4OO1oukKcT@8$vX6BzB~l|Y$W)AH`zD9g1pamX2uZ{# z@wmxm&dBjimXYRfBcM`S)FE2o9yi(tO*0Upxp|W8=IK-yTrkKppPq`Ww0iJ<_m6=Tbbg#*rh$T{v417w>a`Li!D67HH1yU-mMHS;Sq6d2eYN^cddP!T2OW$ zKl^cY#PJupqiyqrSww z>tegaffn%{FLqjS2}wG&%}UodSX82r$r%JZ0y}>C5!i?@pc*J*)381f!|B5l0+`-c~G+(S~o^(&9tI zwmA7w)Iaf3#>WY+aQQ_;xhJ(WG6B_Tavw@2-{IXT!Cn6D4=BAAz?91{)*Yw zkwBdU^`o$Cg$yYi;p|u!?JyZr%qU!tLC7X6v5h|J0}%CBTL<5S+c26=1{n#ib&*hz zw^Q)Z84n>`vg1M_CB-fAZGiae&lBg+1U;FLw4Yj{mP)Bu6~Dm@Vpx`{xo}Q3ks(7>=^xFZR8`j)aGtBeJp2`AD_#$u}mnBBE6mDMMwT=UpP&axfw%3hxDRnj1--+4q2q&G$MWFipDImf~LH%r9pPYurrL!T{W|4q&|LrJDm!Xb8gz7ZsF2m0u{WXtPIxa zFY5e11*~n#{>q)AB1FMo@5Iq5{O%gzXlS!AAjkzpqqYmY@%1omFhRS!E6^q?nI@cD zN7$FN8~;(dic&}u(r3E>yEoEL#vblV<3{}3 zJZj$qMbi<(ln>dFeK3p-8_)bC@-j5IJyMT47B2-Z3jc_fRyTAQx+n#{{QQr6S>M{C zhZ9q_D=cOS7KH~aG=*EyXDiy7M2sbBJyYuwYv{7TRP-;CXcgW&WspdEqX%&l9dmG4 z;B;gn-^vB-@A0$gO5btCT^JX+Wsm*i2kcEriBn{SPdVu1xu-C62YtESQ2M;Y3GY{h z7&K%3&bO}{a2P}T&2@xuLZYvGduBN+L>GJJ7B4=KrHL+r=OAII#VR&j_6q+^FE=hA zPBfmyoyWf|m^v0&ku}-Z;c#XpA2B!;w~gr3`)rI&*SRyAKa?iRdrajII06RK~}GTo{fQNq;e zisFFapB8*bh;Z(?ez@LQ&{7XdJjDuzEt9Es{p?i=iQt^8i zfiY0n^gIfVL)u^b)ztqZRQy(4!dEP>U?E0~=Om4acR+)M>(!+63yftf(W{(kDs_%( zHa93!vXanz=6#uQB=AO8V#K2NkyW0vPEH~PfI+n*UF=Kv>B3CVJmRfXK5_kT5JAXW z2YyKVXhLf6l;6O<&9!}pZ1XgkH*eV-$eW`|(sYWR`-?VK;2hV;D@JKhs;^;qn{j!T zSty93b~*X=vmS1Uhr^SiCxKl!6(T5~+s6!p&>BwI&gtZ6_Dps0Yo-X1OYqyc@)2CpaPkLLF124Hwj__0Ih zb6>6)Q*v2!Ek7*9$){0!G4s(^4W>#8n-KL2DD)YWt>WmK3#jLVUucePX)V`K{it)J zTUrq3Qb9k^f9Ow$jDT@1glG&HG5_YLCK3-vTvH%kZGfZ^Y#<&E)46%;w--=GNw<%v zkK-tQ|FS%%SV2C{vqPF#V~ww^M%7dsPGWj*}4jL+QPh(CtD4Z##_zC3w=gIC9w z+zDWXN321~eBw-8nRJWMMDEnV7YpcW94M6;JQ8e_Ym*k>#nEk%*|J~6Y~4=@V>qcGrlSWV~oF)*Tjeaauc%h zbid&`VBl4`s%q~FQK!A^8J@G&Do#lsfZj(xCQ%823E1z}8j4|+WNvzHQbI0x@O#F% zdGKwOwoIfK`D0-ITl&Wxw&c^$I|J~C zf;fh^Xyku8f0-g1CVpP#q4hlLthW3`n4%K1Ur~_69}<}+pb{R^TQ^GhT1B}iB=8J# zj0?ctJ+``>%OoVdDHY#Vq%QUg1xI&X-7|`qg1%VVSp0gXa546uVCmfFF^XSb))-%; zMm`0*PRRADJaviHq%8eUWMAuE8&P|;f8GBwNbZKtWGTx(%2Qv$JOi0pZL00-dtElZ z@YdWGla?Z^WlGKc4ebPY_Y&C3@`Ym=jW@mCQPA}FCcaD3R{W66f#RMebf7x*B>T4@ z=>K~exu@gl6k>7sKWGUmf>d@m5T_4M&13yKX~P2-Eb$-0p@7e^fxJu2``o^ z|2wEMx}5v5@GABVZ!>*5HN}(8+a$&2Q_UC6<1Yu8 zj>7j-iGTlhw}R|Vl9rg`5;Wv7m;IDrv#PtM-t)U4$nrs>S$-JTo39QjEz5cj?|VFa zwe{$8Q<%#IZP(LheVIMgkwzhV+HEf+Q34Y^5tS&wrV&h zOMwKr9_jsw*wDaV1RmG~%acRTU-OLVyed&inqNN(Z`o(&HkY2=nqD1SW?(;xRXFXftK%V`{>U^8;7t#l) zxM5Jl2e!a{QWMKR`<^4!e}lvL{{uhoV@%ND_J8+T=Bhq}n;~O!l0EeP;X^ylf0IIv zva!y%h2{9m>9~tO-)mDHcuR3AIlf}#8W!W zUyO1f(V;cO;;VqVr;&kF)zf?()CL3CL(x#E$u>R8M~wbEwyE^|0x(#N`R zkh30qKc53P#r3AqjC-GFe(%SPcwMe*n};6;Z)42!lwRNJ7kv_@cXYXEKq)B0p85w# z;5RMndx-SE@6wNEK1E%P2D@c5jX3l{u4Nkz44Xtby}gophfw+Wrk9)9mR z{}i6*B<1R-%PIawT?vHW#$!=e8M)6{uG@k9cb32^DnGbZmb;)6lSkA;`ww7_0Jg84I9$0AELO)64b-GDMwzN%hquEXhz5>BvifMWRBobWvVW# zm;Fmi6k9b-Ec7&vRxRaqH{6P?L73{N+}*bEa?Nm+^Nf$IkDo*h?2!Eno3`Qjw?uMm zK)=RKW>b2^{WM|RR#?#h>LKW8R52hIm>oH}fUzsoz7wZ{VE=FYjdIRavBS{Vz4GtJ z?-L|+_f0=Pp5hyy-ri6S)st1oEa$3EDla@p*n0|3*gWpntx5b~{PVHSAlCQ2SEn*> z8ud@R%D)K@@VY|y$grh@^K)Gsy;{_2xpvZZ#jF`eL0!cU97xTv;FE74VL@W7FMp24 za(efj@2w^%`8y>Rf3^*;dQVd+b~F4R;qBv?!K+OHrT6Xcxha?uer@VMPoiZ`C`{5l z4VD@*q@=IWJk#H-Ok#aBTx^zNamY;)J64p`^pqResa~D0mprq!{jr35l8Tq^CCOOi zi!(~=Brk*a$)A#Pm~)vGXV^#;`sE}a7{;)C9Dh|*^*;3_L+-CkahZ`tLsos;2n}yK+FGt@bv&dFy7Dhv~FN{zZ1ZhtluRdXZ?Uhp;v5Nf)!rOX(N zMAVtrYzmX?tUa}JS*NnZ!YHj{X{L0TUaOIe{L%%D4qw^!rD;Bzm{%!%{-sWeTU{*i zIfwCI$u?FgHD|tJJGR0?o1*z-ZrSNHy&*1#=k+SKI~yuA?BPF~Ubh!NVd)yy;T*kS zaT7oWMUj2LQO2oi#_v> ztKax58FiaT@u%&&KSu10)n0K-?{5|j8^BcMGqfE)#K#D#aWuRmL za}(kk3EhPSwD4u$#!rc(6Mv;Yp$;Z0AkK-J)Vw_U@-`1VU3U= z-)XT@c)v3jN}TL)EZT}HZEZD}E(Fvs4$7o=2pmoRrOvy4V{x#A%84gdwYEtrH?y8w zf5g&sk^=6UmVeW1x^4>N0$rHSelymd08TYl-=3CU7?N`|UDMhdQ)fSawy>KFSat5z zx%3S{>?Sq5P{wEma#Tu5u>kh3f zvBOByJh!#AwNbYcrktD{alhX#vrW#6kCO1jqRvTc%fR_e(Wt>2=~??JIfEdpB#9m| zNI}`~q$_A>dwbh-o|;b{RFrd_@cA5<7jlHbVNeXDq^$8F>=GBTej?_ku%@;)lXFiO z9oA zX!HSmw~NDqFo2@#WQ^Z<3Y5EUX@KNQP!)T{EzKh1^H9D`yvQmd?{;)` zQ4?_~O?s44!_qOkyn?Cb=!OQoYjD?bzwvkr+*Al@v1r-mB09`kkstpcdLStF`EAzD z&W`IffMzi^71)=f(ybm2I_xg;sy&_RQ^faaas^Zq8@b$7*4F0xo(cJvXUqL=o_+$5GGQM?y2TV-Qpyyg45Yq1NrO>~Uf7{a+pqO%xK<~<@f zc)`Rb9i(W*QIrZhR`(Wngn0{0J)FayK9hfxmf#%Z+fOVaoGD-eq^r2>AA`6HmIT-j&E4QV9G zZZ2m>9VofBhKtk6FnzfT@t_4zbrqkni*V}0d#jtI0~Mr7o3RYyg`-=#Dc;%KkoLz} zogC=f<5L|Qrz-ABVU$4{Pct(4A$GM}U#&;qwbGkv9g*_0Y$9Ed|CP&o-)j`ZV@KsFXCQuOy30l_PsKH9TWn5;A-UYGpR=#!`z9%FDf z9tNlreQlE%9rYjJ5Sk+4mR;+w9C7naIE(vx(PAE7&nL<2U$@vC=?IxyEP9?Kz?Nby z9i95d#H;g4d}vVkaGxiO*oA^OV+L%x((H#_v>B}A4h3Q}|3M}1 zF}4s#Ol0t7!JI88Q`fd$B5B^3wXz0wuQ)b^tPBckUnHE_V-4br!||7pcH$Im4&AMn zaw^){SD*J6s(s^fC`1=0Ty8x6j0Rpjty}VEtJL`_*x9=l9a&iT2a7?2D}{W@E%pB! zEPp5`5Y&#?B7sR=JmGto=_Boo=x?@rHz2*oct#-Yoq)*VK@1;P zk5=zG&i_?IUy2NhOB{@Ix5cJCmY|>CERUM_nARtk%=;%4a-QUoaR z*=i%LDmTT@eO{W0?@+q674`!-)O9%-SPev$pR$9Y+<2$5oz1AO7Fr2k?<|C%l+;aQ zpc~?@o7<#fM4V%~VOSdD1D>4e*CWU0=ks&c`v%9!H5 zuw+oc@^=ud-`X=nToOE~OBc}PrM-3NZCTTdB^o*@4+~Rzm*fNk2E+d+HI5g{aj`QX z!m;VOBckPvq_F3^wy0GWYX-&`6jLq?b3-r#I#pAXU%U>ccPM4c-QJ5Ap8i`HLrof_ z(Uyg}e~)6Q5rMCCy!v7n=sGV}n@b%;+d<)px!A1FpcSjI8D(*q09S)Jjx^68q7F2C zX8squ6Q>p4+ddhBHp<|3vnKV6-P0|^r9MK=$k@A-)frJGI+Lw9F~4!7ogJ@1_%Fp+&```I9ZI2L8L4Jkw>Byb{BM_SV_{XU z6Lg?`b8SWPbt~%MjVNeHz06oD<($N=GRqSA@pKEKST$@>qTRc}oMXw(XzJs+J)O-v zsjzmlg0@df9aWv#=;FvI+h>-`zM?a^!jSY73)*m+J?6t-ZNwRad`H_s*qh>`@46Mc7yy;*ficA_<8Tb*OdRT$M4HFj~~pT*_CkaOT|&r;tks^V6^si%(=K( z-Ab$H26|r^0~8H(Mka2T-Rs&Q4;FH{U9}st-v`0JiOUD=;g5vzpbh5%VhU!n?%+1q zS!oal&#*=JjmDie`G8X*v#dsBU#l>K*CZKzLzTd;T5oI+Fk(~s4TIkCQ;B*>t?AQ5 zC=vF1H|*wOA5dKBr2E&m>$1$%9JUR}hPI*lPrb@)hT=n7J*-y#{rl&DR?iJFVYi?$ zSao)yE%WoU@uThP67q_BBew9eTW05?RTw=LJ8V|xY@C;6xRpY<5|-Dy%NapsI(f|v z`mSE9#Zo6qkc|#nu_g*qQZMv*b|(M@x5ZW;`b=agMv$4BH(k1hH)ii@8H797@q+ii zK+^%{3#G0r)GN&wk4Z@bPj`atl`dZ+Nqoy#??SQGW(RQOgkq_WCp|jyVU+Zla*G=n z7~rOCVzNvd1l%=6giLQ>GAx3Gn9cn@KEu?VSRe0{)gX?bqRC4Q&i(ZoTb7pX=&jyu zi~1l#wj){Xq_ocN(0}u2?!@jY_$;;KdrbloB9C%mNDcZ|3Oa-+~LwoMwN4?3nlw z4X@M-aO>%;A1Pyn13E*QzokW<^dB$aG#|+&CL@!anS72TSo7uRSr%-)!|qIp<++4D zr%`0NW*h0?spGB34#A+9BLbaII|JNtLVSLIg?j|xO*`p+yZwB#?()IY8{?^~XLlxL zhK~HlCOr;64=FTU?-2}n6@X@S)*d9(y*qtPZ3_nE$wp?+ub_^^Ez(eCOLMpt-}`IY zijNQI=bszP)X`AWlugKT=C8|6!HW^aCNcbEJPTuvyg;dpqX+O^ z%iuL8)AuwnoX}j^4s@dd4N5Zu(~7~DZ~h%k20?nc_5|-t0rTiu^4(ibE}CAZp{c+% zeNezk>nhq*1>js0A&<^9It0L&ooiTQJpim4QxK?K>)$gBKG&*;w0 z~}Rc(U+sME=8H}wvv#P6WqDm zy@<4kO&(yH&mkjzeDiGPqdHbUL8L6@H$-l)?>iz;^uU)x3hD1X9!xH5{@xea4K$*|KjCB z;o*giw4(S*;HuVlg1uy7!t0^~OTQQOEU82c6Sg86dqm^Lh}zHx#IX zq%bp2!75`jUkJ>=z{m^v)j>BS_nygsfPk|3pJ1SJRQKziY*OVoM6rBi%4 zc>!o|dKjN2|5)n9Z$AG2&PCd6)xmBXEQr`Ui;IFy8VVjs0BqNo#en{x+e1*}OaELi z!-mlKtegsVr@_x7O?;tS94!s%4;Uxhyyga=T}cVLsf?ZInUyMejLV1FT5r?i#PCtV zPMb57h>so|oCjiKEkl?rnAbOSuzOEb5q(i*VTMHFBN`7F%~v+lS)9?6!7Z)*=RPg# zevYq4MxKSp*0Gn~?wK}`aC~-C{G-ep{onZ78HLKqGCEzNO<;d$3X&w6bhI?S7M?&QLIO zXSuPs^waJht+Ve|_n3fQa4(Ik{s#Zi8?s*Ulf*>D2@Rep(GM#F;3ZlA_azG< zqks*?dljX2+X7;|94pn+TxmU?N+7SbFVpQgtIUX&txO*9rPKPn zs_XF3j7UsOEKwv~XModJy?PB>3=UG)|C8Js@9t(0oT)hrf5xe~lwY%FoK&BW3qx#e zS?NosUGK_QoINKuL0IT#@-@15TG%_Z_>^BytPkEq9=M<{Yyj=lX`EB(f@~V6C)m95 z$|?l#jVy2$7?`A!H>d?<@W$>xk}?d(-1_16hkw6uF*_-06b#~waoG{}tL?zF{4e0U z@U=g_W4yTIr4#`Lqm0tT4G&-iuU<>CYiG`J?EHjn9{Q z@w1%W81s(YU{OlrDRe@?s`+{>>HuYh#rb;KB1sas=_tY+b0JZk(rAV~3$ylxicOQn z8uJeOJWB+c4XkP9>8NQmvOw5rY7SHJ1DNS+Z6}n$sphTPT2tJ4mj;kH{-gZ0*<@dS z5p(DRGUy9=TSTc=7LN*XYD7f1_U~vKZDJXbCqhu8a0-3yl%@Q4mrxdQl=NxAScFEJ zQ}e}@m7jYLS-_%QLtvDpxwz99E_9YqwtOaY@%9EWdtx zQ)hj8{*`2c5JjempeosbaZK`{&!hWYN&$;~5ppu?Ui)*Smy?r|-pC1WzN0Oh#T`m> z>7km&jmejTgwA1J*H~xaF1c9K^%db?eiUS6)D=3HcPSn194+@QYah|_y&o82v7mq3 zb+VoHH4FBe@EEa@*!~KgJ4J4X#~Q!G5KBe5UsP(^@4Sko9)3^-9wYAd3c|)_ev1v_ zW6%?@8%c!Mxxwg}5n0}ws&jy7pcF8p+YL{#uZ)y!i{~-qMt-}u;*RLXsu~*F`uM1H zY*iUG1>BtPCOqR}UEh$_DAqg9*hVtBQ!v-z{sCAtI;5nu-QAoFRwYiYE_GJ=rFSxa zdLz5 zA^-~^8?oXCLc+q2hT`Qt{{3<0O1-+9Z+1|IS}oC_JwCp@W(Iejsz+$&kee-wSM0C2 zhkWoDS;h5+63?$xd}9!I6ETy&4bzt59kgWhT>jyk6#S(+att?(U4773ni?uG@RKPBsP6bc5{@H)q#OAG2%GVv! zmI)4W9hS!80sBVssMgw?Yd|-i)wQ>`v#9kNb_@R_neCknYE^{urNaS0Co#% zUnPGQ-2pls;nJZ8VW3T;c8P_yf6hy%%D5Few11I(&5RV~0JcxGviin_n~Rw9Yq;pc zML&^uS9w-uAKcm+&1Kzbr_9B4bT#QP$x$dME0*{xMZ8E0@K|&Bt|6_w3Lx^30k?Nb z@-G0b=Ns>Oi28ctnD!6_I5fpP-ZbF8n9D~*wCP0xeQa6fUeYpkl=^iGs*CkT;u5zp zltA!{bbv)nT_)aZ6CD7Q+%l$9(0^qzhv(-8i=E}I@{@GSN0Htpzq1r|5?~jQ2FMqv zY0U=%D)DWel+mp$@iMXE*2^EyJP(W{1N3Gg8y32d2vpwIE8s?T3+E93qgC|T6ws3q zwVQ(-1aQCp)dlnl8LoVD7_>Q@;I300Gu{DQ*cjyR`Mp%T7JDST0tzZ5j@!Vp$OV6C z1uhg#5p*yk6B7XeIRu+`JcxX^Op>C=k0R$W`aO(W;~63u7_i<-5bx%B)6~EC&!)j>F+(bKt-kOV)%pynB>?nOs~`Uh_8x9+u^G2cGXt zH;(Ioq?_tx|J~`llnH1mzTVB0YM6@aBcAMrvT(&ecW}d;O@1Ff+aK~foOf1Ur9|v_ zEwlNRs$C()o6k^PYv_Y3|4Uf-E2s#TT4eCrbbDJqxsw0m9C(vTic~8XX+Ge zAHg&k(taLLc-S5kn{@$cpN@j=MU}U<{&<(*U>v3egiL!%`G52dyx7fJfzHwTI2C{Y z(-XUa@i}`P3_q7Z!HlzH8NxO_-)OEBw zgUyuYVT{5tJ_k!D3mKy3eAE^pIjxLA5Mfrd|FXUZZS1T#NW1A71F5LibWN!Zasoapde|8K^e8vIt^d=U zk&zK3Cl`FmHkAN=Kuj!O)l)9twQU4e9xVWcS-Ph9kNf@UF)}b9H2U@sq>rtl?60aZ zo^0#3cIv^(yN#H;j_qF_l|nbmp+r~C340y6Yfqm}Z}B`>G|H&rcQ7JCjIYedaB?*h z@MII(p6Og8chlO>y{5h`+CM}kVkWpHO_qN{G_>K2C=-LQd9q9z;}}CO&wP&3X4*xx-h_w~l#t zkn4WP>v;%q+74P1pRXTJK&(p1OfVL)ycF~+|7vGhy|xIC zY(Zfi6>HPC`D!g-&~KcrW$)JdH>3K@xx=dS-lFDB#?$?clVxK|$rqkFhFMRD*-Php z5#2?Oz@5uB{sEL6&+i1MOYyw>X9v*Z%+P+LqoMQi1ZKw;hpAkf z3FDhHj>%9&Hy#>lNn=OOPjM0(6-Tb7nQe-^y1{KXygij(NKUyS;|CbndBia*Yr4WqE-zcF2sI*p7D?~ucMO-m+n8Jc_WU;5m27hZn@1}F`{=Lo#i5?GAxW1g#GFOKB17o6p9*SZf2O= z;(8Jp!~3d*-#=edj9AwCpTs!MO3kUd>$rIl4T%DP7fWa( zM({|=zug|`tc-=n;!7t_rd3#gbCV+#w@X`n3JsFgy9$SYu1ZiM3kWrJEhYi03u94- zg;$qaE@Rv-6>=BxEM@Q;=;6oRbHcOT^~?zDb>q#!xZ)`qeME+{!Y*axf%atVr-)SQ zKHher_w5^&RYv zdkumoCnrd$YPGn?FZ(p6m++Yq4gR=jE&S{(oF14hDu9aP*uWVpOzqWo{k&$5HaJ zJB=c(wyTH2P_n4e8S1%-B#%c=YicsObnEbczSS0i&_f5@2c-TNgiQh_;QYU-sIRwr zqAapa^o_j-L;9X2z*1I_-9$5GW_;qS*VD+6BrX#|AnpFV>1gD-Yl7v@wEO4V8MGW5 zc4#q30o!}#ARfxoNDGYTbRl~h2b<=6`Lb8}F1*P>2fh9m=8oR+#IErV&E}%ax>wzP zg8kMVY%lCjV;1%s#yF-h%<0gr{X*d8`fEEo*~42to#PQ~ulG3l%~|&P)1c8Kxv{0< zOrW2ZTMMi=qk}(w$4I^~zuZ=58V-gz^>k-RSxwc=#JTeaLXUS^s>I#3fmg?C1KUir zA`xJw%nFvNU1<$EAd<(ACFIuga!VHSo!+fYGgrtiWReE?QZX=|L42~OIAA9xL--`> zF$Bx=(#DTExAL`R1E1)IaW}cghX%yAJP>_Smw%M=xXRnheYu9itwbb*5Jj$H1Ij?1 z{>?>=IR-$l)3)q~DeAs_tymp0chD)_buq3Gmy$Oq!zAuzcJbg=w1Y={Ortbd`G$6$ zw++reJ6VI(nO=KY;aufzq1kBY)eXE33pKYtDe}$;f5+MR zYnjSM(OHJRJR5e`)P2e7-8<~}@86qgxaI&PAp6#~T2eb~^(ItxwB)T*gEOeVlr+v7}{z(~2g&UIegwDJ4PG}{xrGUzeo8U2NrPG+x|;@I?;XXejoW9z2`<_c_>o ze+v+VSeb2w8!?#_5TZ>0a{b})LhxW^8i{92Wgp^^mbJY zO+iJLJu?$oUCzZS>Ph-~{gMu_>glDu(NJMH^PABQ8gjX7ZH^QkD&9A01emld2+jAW zY^BBB{ib9rRX?;EzS1>awHTw)lS4f0b+p=sdTHxe(wHpo?v^R$yzrgCU^H=9Z7N?pZmduDA{+>_EgKoWr zO2lz2sP~DRyP_*bIfQviqJx7&LtDiPq-{Nni23)HU9EJ1hv&~UZmmbboKsoy__;K; zPN(8?jMiQ4SZVn$q_0?RckJue4W(O_>fOi0;f%FRqCBmj!4N;+?y0 z*pZa?IO{cI2iyK!+0(McbD3s*sJ1Z*mZb=jp)ZN+)0O z<_I}xr`Pb)C5cVaRu%)mmJ&!`l4}kZD^}nFxJ)s?wU=JjRjC-V`VsAvq8FAeXy}v;?zSl z{w_iA)sF>jFDeQcOU1FPEeZ6WEI)h*Le=z`lKXd>gtQ?>hb1G>T24LfmHS2e-rosi z0?V$m4VtgXrZ*<5-CjWL<25%DMMMwgOnZQTh{lbe?9cyvjf{+J-nF#r#KVL96!YNe zEY#GZ;ydNe_xoIe0A{aEr3nqqB90>?sR{S{Zm1+7U%tqKLL>mXa==Grj^^gJW3%0w z{AW|%sj4MaRoUW1Q_^#t3$&4@v~ycn;>TZvJJP0bZCJ>5YD#sr`Dp^MOq*pg2LnId zN^dzT%Ox)LtH?eLL>U_9#X;|cp-fMJ?OX0I;sALvzI&sqXZ!BhR=Zl$)%6j>-YLxL zZ*EJfMs0hsth?QSXiF*H`nNHF--??2%8c3}@D&D(tzs!f+&p)HnbFd4`Eay6Bdf~l;mb^@ru(x&z!55rm= z7~$yQP?m3k0MZ6+43dpcfrnWS}4 z(KRgBe@gdtT4Lsg>hCs_>ev8MST-@9A^K*TG+rZ(ijU6NBRt)J` z6CU0R9teTpXquulP5w# ztSWg0k7l`OpPV@QXf}#Sa`Bm`GD~p-HdPZo@?WO*x2fA^{$)*3V?gRtF{#sLCQ?;y zdi>B#eG@&N7Nio(j>SS!bf?4Et6$AoR#BWWXB_d9s!iX7$44a;4>(d{{@|-@SLk+#xiHYuh(>@l}NmJK6y0_RUH)n{B)g*J`W0e9$< z_Of!2Sx*K3djsKm`LbUVleMG!vhq7o1|Wgmh^6d8hjVA?zXbIH&y-<3Wx|OW)+GKt zXzhC(YN_zHP*UsA)gxtihbUzEVJN3@2CLvu$ydj)EiUfpnBAFlA6M&Og$G;QBoho3 zG2@2YWfW5<{E@Tkl1kn0gOziAT0^??eyWnZK0TQ)Wq*4AWgQ(|LJ_HuSJTt(f*F5( zW{y)00lRqi({KlsX-_9tFWY2=+%n;<$`WpqPao5(*hR#@pN?n?s3#47$WYK=S2HYC zt^Pz;6VG_WRPYcTO`&!XJ0Xn3T7!S9l*7T>*+d6FmdmFmW4eE%I zqgo+TrQaFX%h2JMg0E-p<*X9tdF2<%fTnPEO<$6t1@jg0ZPASVo+zKg07bov^Qd6B za$6;?BQXe4dA^@(&FVOxVs749Onjp>#o&Se+(O9LJur&_5lCfUXXYUg;?`i1^8JVg zq3(wiX~Xg%4g1rM_6iknk6(*?zU1Fu7q#0Ced(E&l}o|?ZWkQ z+R?cylE~6|`j^}ZE?T2uH6*bm0+$@pWNLogdiCyh7AzB%|i3%bb~ z693jL>0Md`pa~%m=x%N>7#7Nv7QS4+!XWe!HlTCk8k99t-=M!(y??Q@fXj`h;U!&_ z>zbz&*Ke7FYqYqx+#Nj|&k!af{;>m>&r9jFR%&sBwKrkY6PxS*BG@Vm3t2sk{n5`f zf;dZ_Qy?=lu;sE~!}@PcE5&Nc!U*{MNT<7%o$q?^!g1e@LvMIHR3ni5Fnu5`-Vfj& z#IrUrS6NxP-W&KuXDY_RxW>Y@<2HE*QWK`wU|LO2S%A7asXoS@2`{vzi1V}Ph<$9f zpRf*foUWGZ3=-yC5iCgR#(f`4!)j>2s_s!27J55JkWSUqlXbKKhQBxyO-%YY#(Ega{Wj4glyuObFoQ^-)h_8V%6Of!Tt+XSfFnbpHJkeF( z$K6Z*{!}8?@A*|!R2Yg%xODQ4tUHH8+~6PKsAFAM^P*l?#A>c+rN&}S4M)QD&!6&p zmtH$W$!?a2bNUENyVUQ>J;E6aHq6;mdoC`WJ|mQ{nc?@KgE3rNTN^F0yu8pNX->x=;-+8%zi4VV6gti^f;ykud6e_nP4&W7%SXmIm0%s|TGTGfd`&Fs@H?UrD+5$nK5(ktv)grdb(%pYl;+~UmfK>2S63wC}Mhl70P?PjY__hu*lypZHrw87n85BQp* zUE_cI@Z@-$`sXVI3b`C7)b>W}AMLp_wgeu{SA8pK=0Xy47cMb;`=6Nl8`|ERNs%jeC$$uZV>mL zShfyoC7A3CryK1n=SI2z>61syR_Jp@f@Kf>{&-X&HBj=2huTdeCfuX`nFY8;@ONgH zH}W5guTP?Ww$uY;1fGgvYzkJ}+eEY{xIRJF_Y!w_Ne|(!P9b$wG(WTq!BRg)?V(hI z_|o?E{@Zmy)4IS~bxpm10Ki5-VddW5brAYg!&N8HlvF5DUtc5j{Q0Kde;3E2>i{qh z!v3=iYFf~;H@8g3uJG^QO)9RASuPzMJ0Bs zX~q{10##aS2bg!+Jb#(;DM!w`G|&nZvW{DZ>~81sar`|##Qk^Dl(RF>`le&hW8rl| zj(+Q570ut-P{&?N*u>)<3LPvxer)XCE-4sj2qP;}+U; zjybCaJ&ZuzJ#9l@o=*lCN(y|g@-I}7Z<{D2xS%eknc1BiZ!b&YS>Rh{fe!6FA3;?OdLFEdixjSh2S9qHhZT zeVXIbh6|jY-W3Blsf)`1&+Ii7`i7BHd7(wvT}YCNaj*)f2zfJuNO_9UpJvCQDs5hr zi*;h4V^X}gly8#DS+gq#89(#;ZqRvy(RG<<>OJD-#Z0-SVVVxn!Xra>;tZn$930jG zaIdP`w_NZwD4m~ctEi|D4QI_si5hT)Hku@RB?NUnWME5Le%0(U@){iEXW%|}9)(EQ z;ldzfsx_HJN6zL;4>DBXa#e36uBL@$PYzdh-fCcNI5?72mQ`d)V?J(Qtsms`aNr7% zi-s~c5DhRSDuss{JtluS4#p+7DW`)!HVt;WU;|(M)x#g`y_5R!;|J}&h2(oUW?Fhh zx9^$DEA!R>Z@kni52&gvba1pv~o;omkH;+dq4GU@2LEWWS5-OxdQLU94Rl!~$OHHT5JYAht_Ht)Q2oonDq zvKiQ7b~M|#Kz`@Y@ENM6J9xK;gU{=K0B*J9A!R!oNseDi7nK|x9p!w%iMXiz;0w1Z zX+Co6xjh|gOUBeRsRWPNyCdA#y4z@L4Y?RwI%F4`q&`@&SG6q-4b1!MMkT>2d%vV5 zTR>Wa53L%`sB(bH-Fw?tYbBNyha*OiB4(!cPp^DU0*R&7}8Co3D5EGyeF`+1b2j50qj@ z?4-Ld`|VD2$(PlfOU5GPS2palDugSd@wIxMtel*j4*N##dH`@znsJ142gki@C`-Y%qUE%G92!D8cf9Iz|0`Sp6!NTX{{<%qD3!ZXj0`ZlZvAb9d zPu7-bd-dVvgsextxI9mZ?I(b+{_KK2TFF;DSDaw`T_gR5EFQ&1sPJmGNqd?hYM@Lp z<5$oiXke=E@h9gVpK-q6jG@!+sZ#CMihYx9J2y8FfmzPQr>*VnbOSa?$jNE<-Ru6R z!O-O;Ud%yzgXsKJ$JXdwrrnSr%tKqU`N`k@Q=4`kdCn9)Jf7f;3@_d;oor~YjPg)S zIOcR%oi&Z;XG90a$K+UK?q_zqJmk{orI@Q;FM1>;LHvN8n~F3ok%X>HCth@Jp84d& zwd9^>h+1qYp@H{cW>nYdH*e%5Fpz)w27b0D+?Imn8t8xgNV3Hq2P;x5-QJD~^f@~{ z<_a0_h+`6gKlO5JtlGb&j~M8F#>Mwh_SLz?=cTFN(~31Vz^$H zrJ`5R1;{*-f5E&a>w4Y3PF4q1$1|$v?6(7UM@gZ1j6p;4zJb@9&1&zj7p{jwr5W;s z#P^mP1U9p$$8Po?1hQHBsatjvyiY*4fIRHc(22HeP&0vOO5ZYB;EmW~exJ2Z%RgDu zW5F(yxJ3Sni~(4$@3xw*_i4wC+~8A}E=qc9b2BXEb$i~&85?Hz)1wKn4)q(0al!q? zskz?XT7ry+7um-x5%Bx81qY=c{rB8yY11y`mg7Xz#CCsVn~QSI*VP?{K3aY-c)>6f z7)YaDvl2h%Cj#>3nfzqB=y5rcbkwuG#jEbg@L}EA!b--;9!y9UDj_VH0?TUn+CF^j zW0Gk#4FZnk^+AaJ!QQPHWTcoYbm=!U@#C=R$;m%QwVCaJn}mM9Z_)}hH5L^UlO4;@M9~HHkQZiSLoQl|$bfFIM!b<`iV8PSo0io6&Q^*%3#&ShlXbR7 z(pk{=aPOaSap5midAPV7th`P;^$VvH5`F-38=p_HBpHmq9Y~sTjAE`HXjN9IpqRS-`F9EejUbY%&E^hBe~Xd&=OZmS?G@rF%e^ zR)J{m{MhJ{KLEo&jp<@05QhVc3}XWk5db8-i3C}x&D&#Y$$$Nsii+xdXlSs#&Agrb z^@(VY#-ks_lGVQ7^Wc(?#a72{-0Vxgtx!USHTZqB7=td3VA2!6%~9~KXn9~TZGiL| z*=@l|N=nPrmPIbzPsrDRIxEEr1p$xMPZ)A}{H?cVa43x6U3K!@PZIy!LNOkN^*^4C z;L2Z<$6eWUz7@b9EPHO$U%_T4Zq5&@%oD9OlTU9%{Ltg+dZr@RYv0Lb7ugw?I@?^Q ztCzm9hd9;G|45|FF+tTJQs*ruDFjdG#B260mZn#*IvE-OhgEvy;bG1yC{0Bz>ZJbQ zz$A_D{a^<1!?RibF8-{K3?Lh5#nCs?2B1djo9VR8tx>{@h@oe*yd~m;dp-g}(JZg( zez^%Vw0r##NQ+3)of?)nlO=rm#|~FZ1rLJ8!+Tv6!7!`s+e{Tkd->)@7~!788ddpn z##HiOsM6ikA!&;|K}S#cQUTpq>V!$tXl=Rm!REjsF=(gT>(3NR;e)`tafiCxU4qrl zX?*{Jb*4~yn^mD9)tod9~VW zcK`YA@xIi_`C2!o-E8kEI68A*Mo37=;*_c@#ryZ_tW;=64iq>_w_Q8#Tefgxfq%N0 zG;hF>dO=*EVn9iO|M24d;jKLd^NTaWdlm)Ah53rMMZRy2)(a8>6`UE5uG&iTj@1iX z0~MUIof)@gefn@?Y<>^vw$mqk1)ZdMqU4@M0UJtB)(iRsDmZCrX@?3{^h!@lJ47YS zy-}QDwA4+SXVzZ2?Ovh()FqQG_Hc>+8cY2D|%|>w<`*WDfBl!RIp-a;`J>f0u@nVji=5Rtk}8u z`j!uY3f{}>1uI4!KV>Y7+hy$e%33zid~eG2h%?1r`D@OFh(be!i6&=PzC?TfTfAC~RxnxxK#S?9#Af zHKiLm>+3JDms~q^;ewv<#FE1|_7Ka`)922e`@`YeopXaC9oKnw&0CX|wN$WWB7CDb zvgT@`>FCj;r`s5AkA4>XYhK>nB$Jsk^p|`0f*;-3(>2+^dcoo8hl(RBFXsF8OH53p z^i6N?6weoFah37KD+hS)DlF{WcloKth*Ps$wYG`4Vj2JbSqU%?TuS!kCmUFEhYaa% z{m0WE8s9ugbxdf4EG>2O^Ye2zEIT1{JmxFNm)`oLhw#J_r@AWzosEnZuUOH|Um#eN zf@E$9*cM!OrJ!xQc5}=;42MTqI=;Qry0p;!xP!^*^>2M8e8WZFn~v_d;Fz2>e8%FG zs&2!h9{m&@?GPUyKYg&#vWyIKewTc$2hK6wCM$Z{iw~`Lns?**bhCEt+8H{?AYiBb z`m0%Kr28BPlhavx$1`f5SDz`}Lxj4F8DnZ{>P+^^N$EXu@#f9_$;UT(3=G)X%{Zys z>=(}l=ABOp9{Z}k==O<%qFakAc7#^emTk$c?0-6AV8GKqJ*{(q9d;moPmP0_)`QAa z3yEW5X1KaDL{G7=nKJ}$b$-kl3&b%oBOHeNEYR&S_vA_UqPGLv4=cNT8RBw(aB_08 znzgjg9_75@q_s+e4 zG%qi<_Oiv>h6amTCxjPR7~JOlhY!yxQ%5aM8Qt+tyhGBK2S<^-HEC(He;FBng zVR>~5r+xd#@~Jc6$`ea-H>4Rmn4GUZ-5~SGH(KguxYTXaG@YqKk<;C1UDEzed~wRa z`$r$}@4HKgtLKXc{`P#>>XFRT3FhablO{IdmLd(Mj-7yLrfqr7Vh!N5RE{R*qpUI76C zI@Z?KrM7L?>6xd;If{5?j5}pz_3!S}%+1Yft`w}TF_bQSkuwE9pCr!XN8WSkHEQOR z1@2Xr6%`e2_4EvkkMbfNSNLpgNXzpNN_Zu(oVxe&U7MAgx5 zI`*-S<3$trT zPm5KVnFh7BwJs$We>|V``YPYVJ~KQ%eniOGRj`k}@8*2JO~D@;U*!tJet6&p5h^h+Y*H6|Y66^OX*nHHR85_MZIU=tkdyf&$mI_L4{E+&K5|-kk%q6v;nPjDGX@=FN}Ld8K=1{E+iWQ5AM3_8GN1(M#L0+m2&? z-?Oel>^6NmWG}t3@bu}iQx3%Uc=qgBnpwNNyuAJc2F&%|-QWg6-U+VPByR(e*gAae{1V8a`}*Hvp&e((-Zq;$9IW|iQ!5&9_?u2xFpGBW+166 zsEnWT;PDICFaH*CVPyXS18}poXUfXTfJq%zzSVf*wrNYxo*n1!?;kj7R%O=xWa|U7 z%{(09-`YHX{`}&$pi$y$JKNokf6;;D8&kJMnNK&SPBrcw_sDjM(GX6XHf;iTi+fz# z6_NDf!G+|#d!mL%-up53&0~6j9ZY5~&AXQ4tRrwtOL%tA_5HispB8v;+VOEk)-a-P zZC%~ko2YlTBN&C&p|ULjwlU8|$4W{zC={I7{kUWA1luq4pgb;G<=Kg=hGM;~rtTGeK(CXV8tT!b z3p(UVw>n>b`)P|=`1_BMj+3_LeLA@2wttcICTG^HS(nSphrTN=4LkO{`pnv!=n^;6 z+}zyXiXuyMT?6;W4$*>!4mG&BZ$?Snll@8Cx7!3->UZnb?Wawb?!Iq$v3cv(1r_2G z%S^|}p51fJyzM4^#NUJu!K zY20eNHrRoNzLxs!ae^p#(0b;FGS_soN4F1}9D0>q%g^d~eYd2wR!BM!qV7H`M>>k?C?CDwfiSNsm=^qVCLZv`?9|l zWMR=RcK?Bjh}Q=i?yn8W+=raepD^@NpZM3eBiHGj*O@NNKXKxO;;}s1YwOf~3y25j z?>@+$4QP{+?chZ(a%R3hpL8>CQea@) zS+i!Xy)fo^YFXU}L1?F{XDk2){&z}mn~mj`LsIig^2Rg%$3nXtiZq3`pHGo{uUO?fD8;hzs@PO z_ehr#S;RWM>U6?U#1m*eeg1s()TvqG%rPlj^7Eap@0PfhKr+V_?vH`=9Y{NGfb@-h z^LS}(ZMaInS_`x`7Zl9jw5gxflwt_TZ*?C|jrKY{M0N!T`8jn@wr;-kFk0;4WM^l0 zaaTk@scnrOqXQK9uhs44&}n$oBiXg;OHWph>#J)t*j-JNn5NLOkz5+mrR4GlHdb`7+bTr=ZyD(1YnJ7w!S zz08aOTI)u}>9=atDsZ=Wwdd9gQ!S_N?KWr59ETZ?*VXi|(mJ0+6vsMFnWXT#ckkZ% z^18@7hgxM$+jb?sp*pjsbc2pQZ;~0Gb86v>K6(>g^!e4l)t#zS%MI2F=DT`OV8DO@E+rFI{QkS$*>%IZ&bSe&GqGTjIlp7O zLk(|*W7p~(UlG1suw`OS+?&U%M#TJn{a~M)MYm@rpFHVK)?e$sC19JrN{PKUcGszQ zPY$N)n8bJb@a|2?wOtW#VW7(xe9?&$ZomD!Lp$N!>*LOPBNMBtM5W7EHF;(D@^$Na z9XoO2NO`$I*M8oKr$m3=Fy5S#)9QK=R+8ARD=-wsWjh-0*|R5CxQrunTruWZUhIaJ z97BiSeaMYrgwSpH-H0HZe&J{Ut{Gz<~q6ju`Fi zTsZyk55I2Qc<9>9XodX#EA>mtTECmPvuOTIB`LGdY5hn2Bt%Y z8mwNu`fb&6pY2iglm2M9zxJ;^My1;vOwQ+>^4-6>u`#ySsF}UuUO#g3_3fh1o0N!N z+IaWjrfj$9Xotqv_3cNE8b#J!=>RnF>$@eL>06_@&Pg3>t`ziq|Ni~OA}lB|DX9`v z5sNK9zS=gckA+1$(BQOby^V~FT!3{O=~z{1pEuT}ieo9@a(fi|FIp%%=4;MP@9dee z(B17{OBC@0zW@#5m#SeOOs@1OKK|*U;-S`;FHO?-|0uu$3R+e~BQ{yZz!LGlb;s<> z_y2|r9Xe!a)BArzhYb3D|L?!?XKD(K5o5uy7;>SWTBn~tS3_N(Uh$?tj4UB3Mj{Xy z29q>48U?J1MIktjifH_Wrj;!rR4Nq9MHIj)1qOvkg(yN;DxU$TpPiQzbp23zC=@wz zD7Y#b>_`QX68go#^63=z@pB42uIZcZ98*&c-3tAbxke4X+SBPun2n|_e9b%SO#wnB zF@9>lISe8X3w!~Mrr)zy2c3nOi;T_QNDq?-TQTqA3o(hc3Neg6%Oo61P!FOjaVoz4 zIen@H`q}iBMnuA)Uxw{s+hP98qx<7g&6*N&8HH#f;(;OZV5x|QBZLeQl4umd6b(Ve z2v3YkBMA2Wb?RMzdn+3&2X){{8%`6O7fvWRBZvlbP54#K&6NnQci?|p~FO0kiU}qGC0dr0UAG$ z;(08{It?2Ql0e%u8Bhq*Y!_4kXa-7#QK0)ulsRSR6g<1KcNYAJ;IIW+MDw69RU+jm z4tO&`%)oFF1k1@VP=`kIg)pgRKPX8c;*b{Tu_<;6TZ01usWF~uUb&*pIF}z)o&;TJ zaMk8LeVMQF*p3+n%TV?|LfBQC%U|%^zs+@(eSACnRbutD%z|y31D7^u!v8uO{x=!1 za)RISi@zF#iDoi>2nkdg`Uf}#QWUUg=P*PV;g3oXOiuElAsh&blw-JD!iVfQ5QUuR z6hb1n7b+H`1R}(wB7zUu19h1LK_M_I27Fgp-`0W70P3AsjEMbWq(XuZ*-}8jILU|X z><0}UMjvD+C8DPWniB&vLt&I^up22RLYhJ=e*x%;#ez|SJu%qHG}IG@EBP>klBVp( z!-YmvMqptWU<6`R2s8b9gs`?B9!_i!?EBN7y6rNT9wXr#Zz{}qr0&-RjW*;Sg_M$>x>7kiu z$)TiT7eovLqNmAo2+bi79HlUW)DuaXQk$d_a-k3*2>&n~A;K`Rh^APYzU4TgmOg~i z!kIbzM@MG+H%3O|?2gk|I2s*_&hgb8IRhMJ+LSQ<^VsI!f>mWV#J)wWs+LCX$7n|~ z9Frk9iBfc|0j+3i3Vp5;86!hJ3%|&o^zj;OjIjynL@KSRgr#H!CPF|F24gB35-994gM?fwZu!A5V zx2-6oLOO>|=0nU+D={X7#T*VZ`oBa@^HwkSdDJvb7N&v}XX;5X5hA8=0%bCBj1?3R zhDceJkCH!@)NTN4hoG$!3i=wuaYV?N$U-rSNJ)CF)TA9V4+y4Moe~Ql90W$ICLl2d zmPjM#o0>wHlo#I|I3}Tplx8_}3;ml85fUK;iArhZ19Wa- zr80$Ku^5}-8ckD%#tJ!6nEK7SqkvXbN+Lm6L1TeN2^Nf=Ki~q&eA)uk$fMS=KgOuB zs==VrP#hr$Z$B@X6ozSlp)0e-W1^DX%$CA*LnxutszfXlbQl6Px9({mcs_@N2gAb8&dztVle0?p zeC^zT%*Vtk0piPoyVJ$2AP*7>!2lu9XB!k&qVU3M*w30U?>q>Wp%jp2#-+k(?ha8cD_f<1Fh+(oo3sU|iIuLjIc#ls!Y~+z zg;aU5EDV;)B?wO8K~pX>RP*Gije$LW&HUG2?JuSmn@5HrJiu@eoX5_Che>%MC{B<( zTrQ=+KiP@1i-bg@1hrKJWxYcE(NHOdBfug-qEJk(S`!P7sj@U}>Qap;rxAg~fF+@H z4iZO^C`3fFWnadJ2CC2wLCt2^7Cey{T4;OGJdkk;zyyUgOgq&OSOoYSB8@_EOiIyP z6pW*Q$O-k0bwkA}P69^BU|fq}5~ep!2?neLzV1&C)Qj453yvCEFvHrMRE`M=EQLc6 z5!)_kWg^`Q*j;Baj7l{8dxSdpuvODj$ym8a2r2~@>iCJyN>>Q$0a5lGjD%n~!j72| zzrhF;jLD^dTd*rjjR35sl3(B?rQu^J|7S%Tb;_#&!pVNE{9cL4_@PGO4lw z4991X(NP>>)DQZwsE#4!3y@+Y5KAE0nJ%ST5UM$E4XH+vClypW@kx3>VR>$@nBeb}$TdcOfbZLvY$|heToHsXD6WnVnT9Xw6V1hh}Yjb%Tz(Ns77ZC2>S1 z<^{vT2r(AQBhXj`vbC`rED7dP$6eVtjR;OTqa+fTM<8Io0p|c(JUB%fn@k-@#;x}G znX=xxCRM>CSzQAHVjYvRp*3f=49l2=7+4Du5yz;!c)_3+kYmzN+Q|l(gA_s}GBSpd zmn}uynnyV3A(+w)0}+UY@K_a)#}1dB9@9NLLR$0UL2ly&e(o-#)qgpS8^=+n6XpP^ zkqc12XzP>W_iD!J*SYYNRxuU@v~^^LHDeO`7D#^a@NwjS)z6bxR%U zFQOGk3&sVlblK8p1(!=f1MIm~HEYSl6jiqScn_D6woN;sEjYj_t!1#BKvb>51mzc1 z4j9k?or%CQ%0`dHB*7@vE@4SEtH#DG)oj7w7zk#(nh+9=2x+%9=!6npVoVwe0z}}Uq|Y04CTH+Lt65p0v(|x7b;MgDGmiDqBe90#t{e>3gr?xV5JNbfqegw zJDu8W9H^v2+gZe!x@P8{R&~*EmGea*cwf%H(m2p`yKg4JR zLpXRCArv#g??HAvJPZ*J)kqvdr!lu+z!{=W1RBz0Nvt$Ab;w$CFRfa*l0Y4rmVz2I z>n4RVKVW^5N(L`eSrk-Ci_2|mLuaOd*P6DF@AJqa39N zh^ss;JVZ+3F)|F5l3ca?V3^TancqC2`Y(E4gkqF-DYB=G=7LkW(?u|eOrOGq;-OF+ zkwHG5+`kt)YC+69T$DCE|3GZcRT z%DA;DrIItf|GO=N?I7tZ7-|#Z1tTQP3qfE~j;oO@sN%;AgAc`VK`ATE&S6{_#^pm? zSR%3?%%$RR>MNzvp*0OBOk@ojhk*4fMadXzSW2Qi_7^(>_V?#@>082NO{#n`NGAKg z5eJig4|VZyK|R_+T+Ln+@e*Ve|0`af$2?o^J(tqe8C6yxk~?$n~(N#ATT zs9bD3+Fhkmu$ws7T9VpKXhQ}wA)_W9F9{}>0-Y2lEx{g#$i>i%Fht5sL4<~cAh_Dq zB(q2xs^6!kj2CExdXl4B z9maIv^0+Nk<8m#T1IC!n1SE<9W;><#N1+6YF~LE$J-L(_1=Jrb8*A`Dl)r%LN-7tN zEg>n^tUJo90-?$o0oF)bLc%Z%QwE@z_EfzixD^ET50%+Lm=tmf@B_1er6L#y3$JQv zjHjz5$cFktJ~Bk=N5aAgizZQcjZ5fU9=#WIaMTOPH=0U;qz5uN07ps0M=GQ#l|W+= zKIAY4RdTLoyQY-RY>}_xBlMtJI!C5z0vCcL&7zV_nrpNSM+l;ck3b+3Q5H4{th&$` zOO{nKd*q8z_y3qu7!F}l7etJZ2(bT{Jz&i6FWDn<62nng45k5-;H>aq8FlH3lJ&tb zfeLxbECL~|P353RR2r&GCJ^d0sr{t4fhvgjG2`cJj##+~Fiui3gDI|@@3(9LVBdhP zQb{C^i77XM+JLN0Wo$oe5D-@%jdB$HmUIH3mdS7wqoQ`~QBd;8rWtBm=)_*DBrzZx z8T%5EMnO?9&M<1XmVJ?~(x{0ruI7zoqHAo=kSe04ipr_VQ5H*3^U`iOCgCfSASeVy z#3EpOtEDliG`~~+Q+XFceRNc~Q_YI8va+Qpz8DeDh1S3 zBgoXuBK)qAe%DC9QX^#|#mxNzYCklc3;zp&D0+DRW*mxUOKjAsrI^mRuZZFN{rH9- zd!gfRnz?G%>ilFl0*e682GSN-@BiHWppwBdjQ$@b`Ua1n`r`>z{i*rzd5{E-_KQGf z(5^ZlgxHFnNDQCaLna-V4gx6wlPD2F-6r5eE|@n)`Y~Yuz$dA$)Mln!f$xEV?}34T zJ1{_>$^Wx)0m_5hvIF;jGcxd*p)twdV*}q~1OH>O0a{J*MO62%|BYCE^B%r6?(lE< z>HnX(Hqcb96+x<-8`PT7j+<}4Baa2g(ey0D~{0o_X`cehLbVnNta3~+LwX(If zvekGH!j6_f-yc)>y2lh~iePpRVpsUTaJkjAiPo&9K2ap8^fOX2zUcrzdl}pbSKS4N zgkgvCu6YBS#r8Un>&@_sn0RJQO%lMurZjIdVq!^31izo(=cqa}G^ zQgFzcD2c2!su5R!)xB*YkQ6~g%-3_KsvJHfp<7gHE}$`SFf5EvegLcD9IVD6mx>XB zU_UKXwn}-;qhK*GjFggH{oAk^VKCW`P}<%xn4I}u5pu?G#K#Ystj4B1qy!0z#ngXs z`e{L8YX2{M2__7KagwkmaRjlZKaEgkwXmk9q*#QrYL7<8tR+U%%fH!W3u!!C)fhbG z!3gwU83=ny2)c7tdt$XZRTVx2xCBp?z{)b(L!%n3uUw2U-?}kMFGp!Z&_OMffDrI6 zis8Zp1S>z9wS)-FQqzx0DysoyjDG(QXth?p%$r;o4p}*aNw;9de$|;WrCkOrE29Rj z)LUd4^ZM**Qw6-5Xq#&1OJ&C}5kb}dQeUyE8C$?`#}OzTNGWC|m_nA2jGi_uf@M@} zOac}=29x8|!B&YnFE|1iZ8)_Vsu%$MJuv&dF!hlb^FE@+b6!@g&ZhB!FvNpkF#`A< zH3b)JhE$malnxorr<)0q%i@@pMsnlgRFA81H6KIcLRL^h0*_HSxCzk6k&umAlOY(+ zhwLP3DNJZhEd@|*6oOM>7X-%{)t}CTn=*H06}dzL0~N(r<4rOsE)D|YHKV(+Ql=*) zaG`_*>iHp!c0>pv#8FBc`PR08DXY<(=Hhx$-X?c6G)%oidW{`5#=tB&?Vbt(JT)jd zhD3|Ilfeb!R2Y;6ksAvlP z+#d!>a%6_2UpWb-{)I&r;Krss^JftY83KdgH8*>LP}6Yz#sHA5okPn3AhplM!HlSn z+?zdJ@tIpNrluU#4Hzh%r*1ep`M7%HI@FfaS9PYHAW@0k_ty*s0f+?<5Ez@f5^$%C84wdGSYVkmQe_$D+xu82nkbW_QYWe?TM{7J4vZg+3XPy9S`ZCAY-)EMDv<2GFbNzjkizPz&EEf4$A7RQgkgvTwhAXO>A#6F@MZi5 zTU)!qgPY<%*x1^A$A9>5{Kat~h-*e~JeLn~8MiVZ0UkpR7#?a(|I?HUls+!dBtcpF zIR`pTb@iIdhvFzX&Q*K2NSUZsJs88p2rT7VDl<@0Oyzvxl`BAqGsoIDkh)bPGE_1*wRp~OAq%M)DuP&3D zps^6l9gmjQL2c(W*MWV!-j9*$UtW(EHl0dmn3G207dHNL?Q0H=(Whv~D37`%qS-=| z-D#mb1mnUmlthH297njyx(RBlt9p_DbE8M4Bod0?+?Ge_$6QaMpJD#GDYmftU!njF zDqt`2uuHC1DuL7VUz+qmugo`*hw}Xu=9OvUACZZgzWTYvZZZ|R$qu_g0O(DcPMHNe{MYA zz{zM~@GXptX4Buu$Nr9#{tSOk_^&fZLSx3?dE5YJ>==&n6L4`Ee=~f{8^44!8k3cNTSux`xbz1DJPb zDSsGco{_8~?Pqu)($ zp?@|A^~G&rs>2Y0iV&U<#x*wwv_Z7g`ezBIWeZK?64kfJ#{ZN!`@;J9Fc($WFV5Lf z|CJDc zVQyr3R8em|NM&qo0PMYed)u~>IJ$r9Q_Rxd6T53lmg6L?c5`-J+iiWDIDTxm{q1eK zE<{2SjwymAKs!2)??<{H;(oIG;Ee=dMai<0wBmVAW0AmM01O5*gTYLUeZqQ&6BP6A z3{8W7d4y+ocX#*Y{=WQocXzk=Z-0Nc|1bUh-Mzj3{{G7s`~R}r-`jij;$L9*F_0-f z3F9dKm)!@qRqWgs@}MxJ9C1QJHs}C&h~qJhX9GAw91Rh}9TbtDam)w}2XM33K~a?c zeA(UY_V+qIj&SJX&?A@)Ixd80iU;7)>6C^YfEY)V5iX%lIFHz%*YgCyvF?!Y5KT$f zqtl-Ly92<{SR&(se&?pJZcNkt?uYJ&j*poalZeY#?;;!mqe<-H9YFpK3O($@HJ-UQ zC`d3cPGj7K6Apv{9dR5&j7K<*u@9UAVt~L$90B8T;_)QLz;JwnV_+oouzVa@=BJ}??{?91QX&V-6lF#|9re3A_9j_Wb$@fhRY z6futD^pjkr9pZ^@8VL5-Atu`BF^;@zrb_q7bgcezbPYIy0rjpQqm4QIfA{(G=OzCC^5vTUKgF|Z-fc1H{cgYGlQCv|0BnNxUc4N9 z-5=t8Zx;{!UG#PTn-_cgd(Ve^`+G0H#$WHf{N~l(^ZxK_Z}-(V-}EtlxjWo@KK$mz z?r7Bahr7Ga(OzeaLmVTH{Q)?8yL)|ichBA1zubK}c(Fg&-|g;x^UaGFU%%RW`F}fq z^_AW3QR`nae)d=bVDtKa)qnA7zqtNiyjaVBPx5TQw`BY+3dfz!gfgy{|B#G_C>(cv zeA6L}6Dp)J9HL<$7TyR23`^eN6Dg+wY=EC&Aw=;B7R)0G@CU+YfMS}2KJW=)LTVV1 zaS}^mb4Qkx5a5QyJVAjJwupy?bmkK#8-w8td^|!)z-2on8~_3|!~q+?-M##2%d_U) z7;$`yW(rk+h{k*X{TKWD&o%Owhi3x45PPyB_%wXRVS;Wjh(Un~Mm~;(WJlpEfnSXO zNJxx*Szi><=}?z)&sGIo&|_w#-Hr~4wz82xGa7$I;H$9#teu2 zS)r$cUhg^?;yA<{OOf8E9_u9x$L=^GKJLi|SZ^bWu^S~pK*F)B-kGjMDXIfdn5j12 zNhJ~m!3>z`TnH$R(G2LQM2=lO4(b<76UJePVT!^;!ti1&q!b{bTw#K(vIu#&TQPSP zUE+vcvtGJd-H7^bs&(~5A5^#8;&SMjes0K~T8n3+die-)zmR&Y82w17V6p=#gHh_! zCI4>o7=!nk;CC z3r$><_0+o@ggAh-FXC-P{VrUlTvu;PvVhXi zm6|W$n(a$!{sOil0ia>lgxcS337^PKh?yNTZ5+wX(o`TJ<0$m7?3XE1xfO40z`5Fz zAVQ1@-5yZFC!&rgcSE3IzA3^P4n`H^nCi=%M#N)1Q^QbJ!tj}HBOTdFesv)$a?w_f z!IqnBX0fipK=WFSN6K$)j;o;%s^4e4wi=`o0OoPqrTJ~z&f<($_tIv*d#;a%1ch#Y z*Nt}#UQN7s<=l9c{5b8Q&6Dj0O?yl5=HwR_wxCxZ#rhj56}!WP`I7o5WE1RP_X)t z`k2AVnciuC5g&!pC0I5Pu2`!qopGo@)_|?^!e-Ma(dCyE3u29eWeU_|3Q zf3$J>1rWq2^yw6c4~VO|Num^n-fedBO(+;rM?wN^u~l(6IT9O`R-6R zBjpQ;M>ux*1iM~9aL8RXS1yU{5iuYxRcDOcp@*nbl&Z{jBgREpNK#gB_f(SFsVQfV z32QA>cr^5I#D&DIGzmAv{FcVoBpjP}y$u1=6&Q(4I4@0@i8Xi_kwQ*v_R`>U7SkJ{ zc%g6xDBIyI3mV)`h&O>LnhEjA7`?PcdEDlbNMmPnb6-bJrVK7_q z_!!uE60rxW%0yVOA_f-rCuf7Q7@&m-DO1NuDD-MU6*LoUvPCK;ODTOtRVs?{@dxZ3 zP6hXL9Mg=EZ8;V5qIX6d-oOotODdy;o|8p1v-?g61s~8f3a}O?B%tH)=4TW${R+&9 zPpIU}4au$~oe#7@Fkg=H368JIrN4{mbdbIR7!e%!=Xhkl({IlZpA51;&0yrPgI|B^ z*b>596saN14TkPTq4MEdtGbe&Th~>^RsEC;5Uk|OA5)q%?BW@NBRWMS1RXO3unA29U#vE*xumEUOv_p%#-J-ssgDCm zM^O~ax?1*Dx}B`DBbOjVR7mY&jFhAt$JpZvn&PEufmkx1?g%KJZKzW4BwL4O(j@{5 zH9$e5p+-Uo9XnQ030VM(c+M0*is@8xD8oHn-)3C61T5Tp=NGn;o_5^RQ`X?J{$#ilX# zB3IXPb*%w74E=W$(|=%(cV$^!LKoCS_@o25&1r*Nn}|Nz?EW7$nOTMnw=fW?Ai4|kI=ipdQL@K~RhsSX$xo3Vh1`hs0c zJOtb4_ybp#PxVf}sdErV)xa&u^IDtkeY_&x-8jjMbA@4u>n7YVqX{RPHnNW zDh#pU5>jjtbEOZ>LM(_S#$86I=!4)P)_$o@r6dNLGShvwR814E-gBM)?(Xicqs-ez zEv*`s2P(Q|P~|K9fy*PT^z+61A&-;rfc?a9tOwng(`)R{0({wWoS%PFb8ATXq%>LE zoq{bhHCyy|U2lS7ec?-IxA1)2u z5s4Xh<3#p9N;~g3X1MSN!X%Y3C8%tXaY$p#glu?2Xu{HA+3swlrL~wMPl-)WuCbID zrJ&AZf^V>|wzF)6RU7I=B@fC#`4P|5(aKx3foKaVVla|6ITA9CkuNq09Nv(ahH|;w zpqL2qV1;S^jszJ46v*P35yq99rJTY@y^%m@kW4XbW%$08Bp{EH(sEw9M`ZTgDGJdT z`v$xK_Ok*eru#5JWSTo9VPJvl7Aad>&hUtY*x!M(pASG<=lxv7LraxkF9{r%)9T;qp5NPbH(bR`J;`0y* zJ=i1B1jouC2>#?u*2%!@nJp4{-tVKM7~i01DKhqJ6ps_J=*a$@+#5@`rFONf0#_)IL;l^<=%XzBBVwnr-mggUWwT6JF5ua%}q{{iDeA=#1 z*ie9lXhBD=(F0tAuIZv~-e73Fq`rIe)5Q-*-`c+p-n{7)2}iRZi+%*TD_fY{IxPjO z-RVk7{q#nVKfdj0(pS_?heGjUJ=H`?-x2k5%5X&egMyK+2K7g``4@C1+umPg?JwH; zLF3Z4yp{@42q=&S3yy(#6YM7ej&}fe$6at3r}4G3kSh`Lrz8{tPn?<5Q_WzS1e`jBv*?XAEb6^a&M+T~i%FibkZo5YTWeM1%>F10lcVPs_UYI7+`xX^11EsuM9G zmQ@{xiLF|)Hqj9abwIH+lqAzcFk{Vm;QV14qnK=051pG%il7wv=}dh&H6NBZ=hcgP zeaidiI^`{rfL=FhSS1N4pCD~`)jtAqt%)a|FfY)KThI60c!GmhxtA~0J5~CfSVwYI zkWpbsx_Jc&dilBRR`}J)g;RA%t;{yui!P{lt<{;#yIdctZqy97@}sRB@Qvz&?*?Gc ztAUv|swis%B-cujHZpxDwI4d^YLNo#ETSajj`e+rwB)aUyPo|^&5IWhWf?cCOmV{Z z&hI|r`1kh?e1vg~BY5|tvz#wLjaYC>eGCi-*yA)-e1y{g>+>;VqX)zo8A}Vsg3?V+ z2k9v=lE(=BqqiZo5Z(G}A&V*D%6-u4kUPX2xg(5t5?f>|s$6I^25{$yQr�K z030;+U+z27x56H&Ds98)tkmzxvqv-<39_8^P{@gEei(KzuT4n>wWE*lXESbT9#6Mh*!3Vi*3BOF^U#s$Ccl&}@w zkPZtyA8}+i&61%{V#!@+#vZD%;8Y<1oTkl_5PW=No6U_Av|L~`#BlbrI;PV4SbC)( zhYd@H%7a2$$@G{DwMZJ(%afxoLxH&sRWfkfx2L3z2mfim`ny#}Ygmr!R8@1F9lhkV zS%QH-3(=HF_2`B$LbWG=ftQ3D3)oT)yh<+wX^W9fg-H#?c)G6DtG0~ zan)QXF8@|+|3>3?L5MBC#DwE_p{HnU=eEmI1d0A=JQsKoEX~kI-QdKK!!;(kR zZcIyV2>RXe2eIq09FNhEtdnPTqN&~+mmn!EsGVPcn z{n*AP#bRJhvE=5L+BqYo<3h*FU9XoDmHnUaS-N;LtAF8x1*y>uZtdf?Dj&D}fz*X^ zi^v3VeKs^Odr{ZO!U%-Mh~(y%o?mtJ))-@Drk6fp>EV_%OJO3FeB&GiG~N-4db$(r zs4bj?6C4vEj8P^Sxfe)NBMD0sCS61X+Qwl=cA>paQSAI88pTHGFxM6v*6PMu-B_y| zE!7RnOGUe8#XLJ7vTbT#$ocI0OkPdoYL4Wyw$u)nJKL^0IexRqN%6yuQ7?=y;gSY1 z%dh+*iZSwqKp^Bn67m%oD>ErEqUt{`rx6Y4c;+(Mp6g}pStoxkOwosnYkaGW`$EDo z6@SFDL3(=*K`7I8IdS@=tr3 z_aoi1(x9%S_<61UN~Osrgol7DWVWZ_ymY*(DnACfK`n zuklPquKf|ucBZp;VzK^+RdCy^O4fX7EZT^-2l?CbLP9mGL<|Y@ViXBULx_P+MFFLU zI^Xp7`bsg&i_9ep6dA#cCeLCc+g4ny^=OPK>t*e@G!hzz+)A~C_ErT`F374`0O(u@ zM9XG4f)Hb0-#HI6Gg20uS<~DI1;G$`*J%)ojCmL#CkX@0n7NLxVQ#3CnHv-cWi4H= z_7&yZ3F6OKYCD+GMBnj;LmK0E7x1gasZK)1Q4q*~<3t6d_-$*sgdr6py1@fKJ4Un{ zHkzR#nN>Df@y_jMIQ*ClF+2$(W}&d0sA=T3G%|Qva{z*0xY>(Nrp?H`UTtqIjjbY2 zQshc!Y4Aa@pe&iZ?tXdwBIpeRIyBuoqMl?n+A}yJ-KoD3D{RuU6WP$u@@$nbz;cWC zRcae6+(tS8x;hER>DF!Wm-byH;TW?lM#X2@*Qwp7w8vnanG}!L{48^1lD4NSDL7qS zIoW%T;xXp3_@J@?@>Eu$7)Jr}a`7_8_`?96ZFRreerCUxNA?ea-YfMuD9qK150A8&S}kYmkR1)g1*Qr@;c0Z zE;@AAC?dHiFW>?Su-JZOH;(9SXpt!X5XCxU(p3`OX-Kb~ySpr0x04UA?LZgq?_Dhh zJNNMVHSAg-M>HP5-qd;%lvf5Ye1l_omWkuosJ|ukCtoF*PLYt7Evt|Ya}9TQAaLGP zO?A`v_xBFm-^&2DIas;uUyH*dtN=1U$Zw@#_6IVa*o~^O{(BA&J@m?wdnGpetKp1e zw%km71^wOKJp5imb5r!;0j=c${~f-`wOpoxN-}7mgL*=E2qnmKN)<((!Zh(F+KQfU zAV(e_^WWeht(tO*PpYr~CUr5PgQQ6_6i(eb`uY*ij&F!(MRu|XtbneGJhY{z9*cU| zzY7y^uLFbo3}UTY$%a&DXB6Q{juPeQ`2T#0tV9PwG16VGrwCB_i9g%_i@ zA&yfQS{*h?pMc2Y4|#klO~Yv*E*%9;G+zc@6&`5G6bdE~7MtK8$c$M|f7e;tvf4)S z&s&vXvEb7Ey{{{SODkTJC%kg-xYWCFpybdAy$ubi$%C#D4SXCc0Vy_sXQc07>@ro7VBq6Z}Y}qZ~(s(AKc{kf&BM-_y}IY!Sx+*z#Z-VuD~mV zq_(9oRbC^bL1BM2(!iX`;vH5B|M^ykr?KKJ?UE3ge@b0_X>ehky28x8j>(Vfoxw35l^-8+a&6L9! z9GNgeN8j4V={vF+`%oVRF-HE(a9%NgOl&ZY3h;QLVpNLtn#Ot*?~TuJgyRv7rzV!A z(xAmO$un?Yu+JX_L$ktMZYiTDFrnj;snRyl4JAI@qBs;~WIR0u^2BTarL7_LD3&&o z>fNEu-eB(xfAQQ~4Ov~phW-O({9?xJ{ECmULu_ooS+=xwoakbl!S>F@O2Cv(#c4=U z{Z58$EH>2;yts^3+t9ko>MkAX!6z(EBtgM2@yEDTtkgPR=?oY%-8o8MeJjCNuAV6g z4~!mYoTsPg!%rcy-+t=cpZ`+K|H`}xo}%tQ7!6n1Msxnxet&PjnE!QuclXsg|Lapc zcO3v{Q%$@x07sve3KDQNIna3AQ-5waLS=G<{wT_-Xm09VcF)ckz@6OP9V-xQ`qHXC zq%^=Nbav7Yga`6VLmc6(wAdLP%W3UieQ~0OCRH51iWXBmtH7u4EGvVk^w40$Sz{C8 z`#7{P25{t>bTm)d$=*kZOGiz6boJN!+(2lBylNb*nahuZ$*6dt<%#C;sF-y5Uh~7; z%Z7=sgP%uDOLFRj$d$gAc?gBssVEO9_9ld5k0&v9(z^H7=w>-0>#!#w$738j)mUC= zcVU$zt6di>X1|F7a#UcfE@sHBQum$WUwQgaBeM{Bq)``j4lwp0GO;A(y1_1BlE>!E zlC-Vx?(sr{UxOUf(=p7W<)-$ail*&>C>5?I>-Mh0P7dIGfsPpYXL0bMfnzpILgo}J zKrS>MF%Er6i4F^hUsziTP5J&U5kt_g`-(m|Qp&CQ{!>WAqISL~W%xBq5aujHu$Q7f zyS8SgYE?pRWkSW2Se~OzGgGlNpl)VlMiK21lzLe-6GqWjb+xEifa~yCfRm}sU=c>9 z*z|&YY?)oUhCkmwIdf#W9RYqMHmIzYHI_`mZP?_ekn824MQR0Q zjiSB2fmSg6%Op`e4ZLAY{ZZC;lLTF!1n9#w?ZGBZa5^EeHXM#fhypvam@`kH)(7h? zM!0Hw$w(q|P|_g5#~hJ>J@ z%ee(FvNt}~cGfU{@3hmKi7I5Up0|^wLz%Cq;t?S4I-MB3zm;2DY?oPy{HsuE$=TcR zu#Wiu{byk({j)yG{%bsjSnu@Rb&8<$;BGEpoMU_D zIB_OW7Y~w&Jmc>7FvFfgV zngzk)&^NSO{?m}Om{3EECQY-U(>y7gts<1j=`JWeA3Wq{#x|{@$oF z>Pnf+Q+Ilya_`E-k7AlgsO~6eWCx-ba~y=bqJ4ecqnpNG5+B%&*R_z#rMedQjA$(5 z@yTE)0e0mP`l)V!K(BaQ>*77iQqHY{X2A zmalpsM-C0?4eqMR#sR~N&sn=EVh@@lSMMtio~qJ>v}juza~|HbTcncWT6@gl|D>be zDRkB583iHelEN5sg<-ns#Yw0GlPbL&&X12yF0RfFE-rp~cYgGGbL%=8Vvh&1uFfp$ zWN)y+xH5W#mNkyKtU_fC@>XQ}IKPgV;Far8ebBJ}9wi9x$8#0)QEuI0=^?l>$NN zEcvb*V;N8L^|MoagX3r5x;VTk%}@R}xXPofsvY^k47^GI2d)b&z&HXD>gbZ9UxzfB zsj-x~W37~{S$=+B5sn!GFKRaeJu%xoPJ61OT>-rHunc;98rd~hfx$JNEr-ChyjQ<` z`-cb1^j_DJga4D3buzAG=9N=Goa^k7l@lhTL%J^KGjK_J!hA1aSn_F&wv=g8^%_@6 zqjFt!_o2<*BZZEZ=H6Qz0ifM9xUOIyfQz;q6$!`@1`9C_ej{ zYRRvxxzdb(uM3Bo@n=F<#@-L#oRm3ug`k~{QIo7~?n=tAf$n7fq=Or^mcE&bW8d5Sy)6mO?SNC^z+BiQQ*2#k#opf4++_ zBg-7!HnqHaKoMPrO*-SnjO7wKyvEnt#p z~2e1=}Ll8Q|a8BHIygNtSbcxsW6+7Hc5Tyq-!1YwBdPXaz*#u5shzA z?6;d?cH{Nha*jF!;GoVh__y**_V-@NtTg??Jm%_sVY62)34~sd`00Sk2!uKe>m?d9 zHL!ZK%NLc0Z-`^n3tjM2A7QVb2RudpkE;m|A{?_WkAhXT(d_^6eE-#}7e)V%SN;99 z|Ho52cXz$7;D$^G(sy!10xVq=reavU2_C>#J;^|NUv-W@MAAm7?^K(J5zB0aAp;fy2y4N^0G|UU=)*(kHGmi=Kh;tes(9+-#_D+ z5gOK@m^$^DVGvu{4E{(^Aft)`iXw?=xAO~D10c(DF$@A121D%097K#xv7I+c9cd99 z_$phEjDo9z2*}6~Te{c!_)DlYLTumec1}k5K}t7zH9+zm;c4uDl^=)+@iPemjcv{F zWjnQ7J{vb5(wb6N-Q9uz>~~+eyJF>_2n|U9TgLaX^PC(3az( zBB(y9!8BoBOi@!jWB0v(V*|l}?`Yqm45XpI%zX&%V=#8K*~U}VY%CKmbtzQMk7 z|FUnJv=|F>$e&|)g}a`GzE;1s04*?ZRkbR|FnLxO%ZUxwCNOs8>h5kVhP0(pFh5l~)(b56ArEFA7II_%K8Qfay zCbYJ-+OsI#iVCpcD#L1X153mlEp>~FGJ2DL6^Md#Xr_OO+CRvV4ksXfHk*K@WS z&+b2}6tmxv&3EPzmqJvyD@&{un$%1fi}ffk1riT&PJX|Mr@HzcNVBkp$o zorEKrX7li=$GUptbmmzTL$Wuaw=So>B=m7CL)Eyt6<4(4S|y8A(PnaL&w-1x)O`HA z(&?%{o6gT$1xkOe39OVNZ87qK(^yE5GS8wFKEC#-Q{Qn=)nu(NSbl7f`rJk}#_oSf z!yqHr!hcBL#D;3yxq3zY!7i!NU%q$VJ5H%BTWD(sr$Vi2?2RFzMy1LcAx$AxkmGvz zjbk%Be3wd3BTb}l*os~Y*Ir`$z***Kc>)b3`6Der;Tn!jX_ zs5QG>v&%x4QxQZG$ium1Gn~(pSuWN0Rr1OO5LnT$KRwYd*vI7<=0LJx6h~#mo%aQ9nauG76BW8KuSjF$Uuxr{WS<=RdisXpH69vL1=IBRGE_zUnZ?)M17ZQlw5_i(B%wDy}81P)CV&GK`5%J zrf%-Cb~`^YnccR0wE-G{|8Nj?dsZP<+$Sh?~sg#C>;03 zh~rx{>(0>h!S{fh@Bi-hU+(t{_kUmRz1myf|9y(*uI$G^7$-E1PLO}A$lQDrG?d-q z8h~}@P8FB8?qm|o=bdX3`UCi0(N$-PIr0%lgAQo>ta4q@bf@3SSP+BS5D^_v7kG8b zeH2CAJQqqWzr`RDSpW%HbAp3umrZ)|&TC}_eHA#ZQEp4@ASkRtx4zC4g=ma@cR0(} z(pf+1D@G{hE*hn74hv!GGg$U=IJ^+kLfH;Qy~)zFOyhev;=2_`keLtJ(k0imWt$tJ?+E-2YQ^|7PC% zsEmK5Y+o~G&C!b@M#^?84$iGMWwFdbA z*b^KRj>fogr`3Uws`qd;3>ETHF+6$6$08SzTt<&~L+ax$n+)KiY^wNEy&9Wr2Isqd$=m{Q4`n{{&}qYm8+&Tcq|)XY+^SgQGXc7Z+DLRHg$TVI1QKod4at z6EN=`*mmHz-~I#m1c%msc8lV$0zh`4r>%bS^zh_NT?QgdrcD3?+kzLXW6i#PH6jN4 za73%xnIHz!8JwJzplL|E@}~}US*+eB%>D!;KfsJFol8a`q=HViZ}$PsDT0Mx5aH?= z_~`UPp3(ZgK0A%foilSOOO%kbq*ob_XICo6U=_htWVSg!K6`U=C{F{f-o86Jeyvl! zca|nS_eM}(j+DVE6X6^zlvJe97?F-`@y%y}Q-O~Tl~uMIC*cA6iQ!nDs%_0LCL~?H zt)kM(MiPc&G2od3;7#al2=2K~ux9&umCnKBy}+_**dEQW7|8VMyOTG^#o;kmY_3r9 z;q~tx;;?yFQSJWss^QFXVc1}DV_8Jz?ZL(6@%geiRn@LWtx$34nmDm)nbny4r zP8KToZov@1))JEeqjS8vE~|!#7M+U>YzSFke|UU;sVG>-2ev={c>F)tiY{nC4F}Pfm~DT%DYL_wM!9 z=GJCqzqhw@wKQk>;oZgMYcnM|NWbp>c3)NF?A`h0)#*=fzdb&$so4MRzGEnV15Tz> z>=VRsFayMeG{6ga6T}W3W0l}jbD%DqjDYa;vYp(TRagL3Po4QHXfh-yCVYZpm>_9e zQccrXozTl{500FNB#bfgCPEHY8E?nrM(qAFDMJ@7Cl~^9gG0<1NSAp9T`WxCWQu9R z;T92@q2I(y$@V_cXfD;fyzh(rnQTgDY*NnpybIsXG~5Y>5Z~&qs|Iz7-3hwEDvzl= zHo*QDz)&p8S~HcW7{ygGmco|Wz)i|((uSd6vucsY6PW;7F5exk62)|ghQSP`7==tP zAR*L?B_)%y2%?vZUXeT?xjJZwVTQTYnpjivGK}OMCWjXdd|8%p5(Hg%7kXGVJdqwr z%y1FCNabpi2_JakT}zlDzQHjtjLpg{^{@-Shz4i`@_e3bAfj(>A+cve*_Wh&Keq59?y8tS2h zPjvnuR;YLI)8!9Whi^`fPcJX3D{GOG%fPhG3^QG-Vzf)~ORQnf0QwVGgy7+QM^=j#zq~KMwuBagRzXd! zX4i#5)PZy&=|t`nRm}1%DsCZ&paP{rt*W6_P@X=`eNEb`hcOWQ3A8(w2zuo z89t|=lbK{r*#@})99v~7Ov*w~3`eS79?I%~KkyiR7oc&@r=)Nvw5Fs+M&8@Z48`^9 z!A1_-E!0&ruv#H2 zCH~fX|Nd_c-{1dN@BRD#vI>uM)Tf*5i%^}zG5Pf@8>2$TBtUky$_!` zoB!>=-~YZSPF713%J>zr;Vb*sX5WF2K!u3N0$>x=hmU}6ui@F9ip##acmK?Svp%9& zA5pYAqWBCA*){4z!wM?mS*c58^=+jh4`-oPbz}2IH2dC0st!xxTWVkb#^i+@XRacg z%1&k|C9_!p&S{Z3$XgPoLV1<=Sb|E;iz92M z9y{Bs!rRbsyHhzOY&`lA;i?Y)R&(yR0fzxbVY;ParXmeW<3tjxTdHQ>WU^OPoyPJP zkPtSv;6eR>kKiR-FquBMK0JeG@DY-b`~lnl0Y1&`BobMf2TJ24gEr(49Kfdd$C+#V zOzqGOR?yWM>f~rGW8uu9S!?Rdm1?kg=Ao60pD|{bOJ8nHQMNJjX$PYgr&PFL0mjuZ zJTcivI6$)t?9nh&oqQUq{wQ*~NU2EHfFzP7oChn&6+a`k^U%}9HS1X)JgyHO7dv=_DobgW z>kOteB%H=A6zr6vSXAZ|Us~INQ%OR9Bs5N@nS}-U{*^vVuq<#!*6Ta)udk~cE>Tj+ z3~BZ9I;6LuIh31A+OXNL%iUhsbZcz*b?Wzqpjvu^VT?l@BSEJUGfRI``+~$%>2`b? z32BvKA6yL2djDJKRL_5=KWvIW7t+(U+^dbKd>T2hsHR_`e=__B>_XYNrj9KRWom`{ zds~}4J$T#7iYVG}bNb}T+3QSkH~Ovs*R9lgrA-)&QMeEH&$gWc$w`}sqPo-s0)P7( zxFI;3Cud6$Uix!B<(-^0vTfT!qpdS39@bJ)sOD)kRkrfwD)gW^M^vkF5y)-86{o!O zT?T3dg0{W`)sn&@P6U-Q#6k`Mt$Yr0%~Uxbtlq64*JOMDg8a`ao;c?OwW^qPh+5NF z`FL|N3%P4A(FS7Aotoy6h{T>uqX!6%3?X=h*c2+c(_)ARBUKgxT@T-&eQh~RU)W>yiHw&tE0d`749@WA_4 zk8<0pHC}6<<1g0d_{;SsuE75By?0mawhIq*c72fB?p3jTVMSCJU8Ue^xAjZow@ev^CMk+UJDI> zexc#deo+ZlecR|ya?9um#g&TNL7&OZo?28^da^3t-=5-Gef+mSXWTb!OO$MJ03Y3AHlTFfWc~s|fOlCEMFGJ+ zr~*l>BY39a{!8_{#WS-U6R@;NiH2y(Cvi(dT%8g&2Y2n}Gp7qBXiYt-#>6K~NQH-r zi!!LrM_OA}&846f*Dzw8^%ESYDnp>GWAAu%W7@1r$*-+G?0O7j7y|nTj_vvluq7lcjJ0(Ftn0DuHGZ3W$0@#6o_0|SeY|@;3 zxW?ahskRK1OAVyhiqKes00%Cch2E0=F)%J9hz5F{zkm%|^VV<~;=E=2C~=pI@}Hqq zSCHh2M8J9ZU!K1x=6`wdvcHc1`y@}L{8t~Izdf`2yu`pp39pr$Xd=qlb{2U{HcHsLlW(>0d@HoN6pz<QK-v zoeI`lpT8qP+U#P7X>E?uN*=aZmBTkD@?_z4$=^v20gGtJ@axSj!?U&6?J{@{n|*k% z-)F8><_&;5Q6YIIlyP`p?0&_mkE|5IX8t(GhA92a?BCi;tYXf2zzz=%v6*+PRs|v` z;gdsk?qVYY#;2_Yeid}k4sP{Te#Em%oNVE~klQgE6+I%QxDkpJ<&W+3L>KkK5~ z>y-R^BGb5teEZiPi9U*&A59^R z5E;Q%+QjR=9q8`l?Db~GR|KRm&qJyR z^R(zy#D6ofw|3y=Ckv+{1v%IDM_)b5YH-n7z(H#f23CNyB0g4e zm;ZgmVl4ZswC8(&8CLcQW!*KguZjH&A@)xu?^atvu2AS#EFX1C_R1&mYiD!IC$aQF zbT)U*9e4rzigCmf_F5h5I-6OgUX9Vk5mfr|W3Kk*f6c9);@41Lc6QVHP^}O@W`9en z_d?w*GqZ(y`>E}c>*r~nqWyo0c}zU!MlqdYKEcTf62Q*O|NiRvt7885{_e}Q{r@Q* z>(WYk9YxcC*^#%)Uv$*gx5}9&D_F<}ubpj3IPQ8h#*}qEI_(vYnKhIpeGQ9_WYrjk z`MmLklZl1u=Jo8w&Ny;={bzpQ4LO(Y&1*c{0Ts0#2CwIhnK{3;{ILZDxWAX}X*jvD zsm$MwLqDP<l@i;g-ufPIrI-a^(=D_B*mfK&bn|U9DDdOJbjkP3OFUl5+O~UG4Cqo>Em}Ax@wCB-jL_-|%0XVvYj?GXm z%IHb1Vw^zgoCz1Z8&J3Zuh9K#?*6~`yyXA2|LXaA|9^_7W~E!o_{u%RGWPu$IS8y~ zzihqA=XAYwP+U#WK8m|8?zXtQ6WGPwJ-A!&V8PwpgS)#2cXx;2o&*U5=kEJ`b*p}L zrKdw0_ulV9TC~R{U5tG*Ya`yH zXI`Dg%Tyu|mXexJ0Cwp1r>ixix6Xca`$NoGUnMq|F^^vv`{^hDnOyZ_#Gz1DAg?X%(>ql$^tMpwBv$4Em3mJQIKkRy` zU|7;q$yA^rb+M*t*0b8?cAXkkYmi9MLB&mTzaatGJ9A!D^Ye!cJJTOM$s zLHRaP&<;eT?WRkhJA1DpahCiu#+!h)$?<@TEZ_H!rg6xN|64nS_@UI1NmQ~}eFLl> zLYfgcyP3CRdD@hKDzYO~|BbEzKm5&;o_-s`MSO4k6cWH5rz8H`>)VpSKIi8zQ|_!jZ-lti6B|Ss1RwOskn@*UH@pE_%{2kt5Cx1 zsY3Kl5tw9sf<9yv>-~%a$pZ;fyF63JHI4_QH(?ym2^<=H@)iK0e3%OU_?h?k^FM1L^XG#nob@HM##x}}`-i?r1GC_JF@srpeji!Z;)xq4|K>Qcz}EN38RrvQf0e5QGL6Ql zveeRVr^*DFt~T-*v8TTBy9dZ94sCI5M z3qQH&$~_-b<=ep(k~?;fjbCSyE8`>S5myaO))(a}x-)#Nx_(lJLtv+Y5NyxfM*1iw zpM)>FQ4@>Em%7px`Ipgj8!2RyUpcDBr~UP`#Ua$pSqch>X^Q6ea4W>k7fg<-+_|h$ zT=_2<5W0nYS_x;Wh)h92*o`UgV&;~rkU+}tS`1xw1LLmBUN;S=k`qs*n99l}S_O5Ea&Mft3lp5BY&Jy~${CZIKhY< z!PUoLgY2V-w2|YCi`(D;ZNt;VpIvItjhkVWX8;51;|ga*hoS0=JznnG_g%xUOq{!1 zcc9%*(_wzngI7N;@ldsC8`r!s-1^j+TA=o>%hnsRZSii7Umve#CiVx8C%Tua+yBJJ zql%fk7BfZ`rY)%@)!O^Z2_vZR`gHaSuXJe9j;XsQHYR53iYO!3nxVD%z*TL&vz_|b zk*_=?czMRl9M_{~w^ZqFwqBhQ&kw3z#uD>zpgvU#)Y{Babm{pA{ zwQDS5mqQb6&|%rR<74|Xa|~=xEIJIDA}Ida`ijNMDIxmB%eegecEjA4wqTryFFCzT zJM2FRF}_T`^uJ;Y`5EN(|Ai`ZJw>uF>9wj*P%+gqhEKMu)*~LWYjFI$RCq>@fq%U9 z#5J}rpgvurkdqGEz5KBcqg01u> z&zeBAs>6o!hz0WWs_d;#O>{6jhCMmbd^?s*Tv&9mOXnmcnoIIF^SjlQtQGoN>}x!J zCQd(2m`-9?T8&U^Ys?1l#rf*i)2l0?Zuh4up`7t9Ay;?0s>fLAcboz9$wG4j!E~Y{#;?Wclj>%R^|B^5?TGIH3j$)eC%hN76RFFL9aFKm zBhwvF0VEur#__~s2c`Mi)qy85W;V)6Pjf&OzXj+RG|*&O<%s`kd(bK3@4=sF=VSwN z)FiUuxgmCr$?$SLj)6M+K6>R)pe0|Q&A!lx{-Ot44ZrK87;}$D|Sa%B^ zi!0bY59Qln9j*oGT;FMKa=t1YrWuhRmLWeX&y!GhuU~+%V1e88IwT*7kv(nWmYb>o zw9Z%AD*KgduVre#Ze)<0!PQJoO7>kx<-24Qy3Y@u(`l1l1Y@{>*MQmG@5bc$%v*&# z9b(CGO}#(HI6AdkJsT_(lui~F71vNb5?F*-sTsbhb+>vG#~K{}BAPs5Wkw;LCOG8P za7sR8#;oB7$9^jl>HV)XKXwB4ap014tA`PvLHIEhe#$IKh(2{hDtP+UAR=J%B-UF* zAPFFk96NuDsc?Eq>_v9e(w3#f%jcAuCReVc@L738o;9I@Hc-$TiT73qJyI}PH;hMv zb*f{}jQ!t>`AXGrKtH~-&wx1~-n1IJ`{31Dhp?@EKmxg3*+tYB$A=`?7vuj~UOxbh zxV^CZM}a}sBZA#FC&p-qu%)Y~nWgNQl8u?%&za@%4*qwiQeaBk0_dSGJ5Cc}AeP!B?Z;k)`~ggK+8`uQW; zelFdiMj;elkD(hLsauIB%{QsL8-evI>U_h_s7GF_V({F3A44JyQWUsiaB&EI)$4Op z6sj=MA%GdxHqo_3xnP8!&m3XT{#T@1R%?2MS9S2F1$ZJRNd+GXY+d_X5PW3MnueKE zba1w{8jN7u4#P=*c+;km))_1q*nRS?!Aob`=^oZJH`LtQz%8ha`HSyK!~{;gvi<6^ zNJ4@SshdB=OpZ%jLOZ;EbG%t;wlD@B9y3`SK~zcm9{GI#<*}us#Pj!Cv$L7~XE)Z% zv=(hg;delD0zU#a8c>fuhx|pcw!qS*ybbT1xgxBbR(N~%B;oY&g+}LK4uMZ>mG9mE; zO}|IH-K1nmd+k79+C?=XZN6}CK;*;7awYTVx0hAmiE*6+%qozzt&@eLK5G$PO_W!Q z;GBFp|AM5%vwZTO5A_R>LQVyy(TF9rX(8i4u%Ju9d^;4hESd~Z`yq*0d!9V&-aa_uO{WvrZ_W6_Y!k8t;*9?9@ZAGg`s zRWA5GW|tf|6ZLWL*WPCk`_a+Y-W~sOgR2szu7?*Na4*;YUcxDAC+PapW0Zz>QgUzS z2Bn9vsw4O4?e|vrv5Dy$yj#d-Y^`W zx!5Uym$Rwbsh~Z`Z;egfrtlwL)^rC!=R<9r`g0RA8leNvlF(r5H&Dw9>S1>^V1^ba`OI;Q6>k*7Z+cW*i)ul4mtzv~bCL?<*%nONu$ z?3oGb_|9@D2R`L{>GG@~o*}RUZfe^GVW59ba->K9TSY5VD)<9X)}q6(LZiJGz^&qy z!{m&IIVgOUVgz3UHmQ_APM&*~A%ow7RXu%vi0BJ+X{Y~%H(%X|)REP*^V}NoXHNed zQDhKNG=(F*<@F^EZ#C%bV(h`?a6WBIH=;0yBwTsv8l-kcy5-o?*1O~xNgGN#G@zwv z9Koswi8yb@5PgO|ilz;m1_Rw(xS}z)i={r|C~O%VJLESnhid;|B4 z;~PrYyB2Y^pH!q~-8HC#7v3Kp8toEVl*PX=*nq5;!}x~k29?=B4_e2|oD3}@R?R8=u&>ZQM} zDIv4OdsH#UiK@}6WA!?P#;9G}1r`v#^-)l^_u^T6xX1Wi97wis0#0IoA3vz~4888$ zTxW-*0RKz+`i+i0kVeOlzLwfE+I%AUjXLYpQ<_DJ&}LYmVPF+Q_#Ou zN~z{sDeq`)+GsC&D6PqI3ZsOMvzifMi}OU&xJ|0fS(y=;PE|v9vo)9I?TEJ_iyOSL@K~}*e-H>nn8K@Vg*MPhV%Nm04m*$kO(%zca-cAdDkl3qQSBtq7XBFxV zwXQlsf0?+DwW9@wYjAfO6-9w2`UbvS%_X#&uGm!Q0&hG#%eGQcn$s#*n)l*})WB3a z#@=mz(@-~P>)>QC73*{pU1^|HF+z`9>e{$~w_!q3_bYbkAWDbw+N~fF%-XsB>bZWe zB+aqV=P8I3%PC&Evj)_;vswn-qRy-)2j}P1muiis(=AkUS}G_|IdtZ-#-Q?gY1tyc9l_;l#c& zF1KBG)&(Tr``dK8{F?oR(cySo9BjI?hoYDe4cxlTPjXDzesKpqd~~ z*7!ZaI2835N4?QW#8;!>m@o!tzEFj)CP$%gLEb4X}@HhWoKEc7KKCj*_@yI=DD=3`&m z{=t$BFMzR$lLMX2F0AnWt`-zYo|Qz!XGMRSn5!}>nmt3Olc`@DYw7OD*1ptJ=+;v@f7V$9yl zGhXc9KY(*Mw;x~dBx>7(UgC9)H;c!vFQF@L6dprIkMh;6e;EbLbcK3C)qHMwD`>QM z#JoZ-oewh{Wh0a7K-P5Z+2 zoJIbolP&SWp%(J^#6R#>Ghs<>b$D^J`>bvn(VB1#xdtLC&2M!=^G*m$fD8}2 zDu~>}UqwinEl({}eLAhXeY)AmNf`>6O8Hu@^W`Vm%Jy;#?Ew>m(2se{KWrD~{xfRY z%P_8AyMNthJGH|22mG|;H)^j@AzNUirozqDUhC{y?d_6ps1%^g{oC zBs)J)E?T&Hwp0t@xj<6?>#>M_DgG5uzcfL?dcMl8jOVM;d2^MzMk`d;)ln_bLtCMu zwS8{QyID+am*wc?O*-)MNRM^UNKBips@r3*lAUE=bHqpA`n$fJ5^Ls=ZID`Cd(~=I zw(FeG--{4X{eygdU#y{gjQv8sh@bvViz(Ud->IgKdT?GHIL|-oVcBDR2_iBnnyXYQ zYybZ;lli}285BBV6!9NldPq{(Iybp=F8TkId?r#`^VbBDFOUq>>F|el@5`$t=lj;~ zyU_bsiU=Nk0A|dGS}b}C#*1l;!-}F(8s}oXeOfI(_wBI)=cikduEq&(iO3U^2HA>) z=UQ=CoctN+*tQuyT=!koqktF~TpxkehcB-ZMg>T0X;vC8NQsD=dc6l|x7bGm0`BepjOf4nMwgHGp&aa(%YF@j@0>+5m(a9Nyt1?7 z`Qmez{n@a`KDZ$^R3~%|c%+s7S$&py(2o6rH6*QC1c#W>L?WwR>8-mPMIpAk=T*a@ zd2p?vmQ)k@qNP-1xyf~a!|dNupv{ifotg5Nn7~tytsdRB)BAf0JqAP6pn$k?h7Y}@ zd+pWHo>xp?_GkE~FCQbjyZ;Tz8hb9_HHbrbuufARLerhm4O-s5oq!RVuRPmVi=;nxiM`D zZ~w}T7y=e$Za#j)A!=}8*v3*6#(6(c82ycTqIfX6s+$YQJK6~39uBh`4%AQu7W4#$ zBP06(;;BHpyu{|Kza09HLpe<3fGembIHYhK7-y>Ag;Jb*Xb6c8jt~?OnJ-0A-ewU( zy;xf1)}zfts3{uiGZ*@tzV3e}oDK|cDicShCIyRwwtu-Nu+^~%#JO0*VpwkLK0aN; z_yL-gzbbmEyz3PHJjeJT`gasC6Eo34|8DNzl+%y_O-!xgAWj1?S$(RSaw?wH*`ezC z?YDBgRB^ZRv9uAGucl}-xOa4x>CvU8_z@(!dk&x|&SN523h;|cZqonwByH&ak+hlF z{tk%{qg?iV+(HnH9?dE8y)`aQB5cp+y9D z0b22YNQ-g)Z)Q|cD%m(25f9r)Uoe*^guM2j#R+maC_whpU#_iC6|+i`IfQu)BoONB-*>9>Z z!KGaj!=AfgIBY0O*kgsdsSrM7c1i4EsGwyr!UP-$Mme2o(FH9wlpLRf$cusJefIy& zh5Td;Aws^S01uWkm;n+dSO#6h$DqlYoyy%LGYKfUMjCq^UO(RYn)tB}IZa6w{+b;f zGDg=2#VXhC!-y%XfM^DXEc&Diy68w4 zf)db@a-?eEM5SdLW3#2xhQ`kenS?poJ+26s`KBuKU?0$ z;nR{E7eIl@oHeXH2mPjNw2^P~1KeglN71WZxtH`X77it<&w8(4P#za{EhQ}xM-VGE9#eYK7-mNgk>ZKV*}pmKkb=h^RoGD zS*AEP`chP6<_z#HA0!od)< z`Vl40n@n|?pdZ0;5=KXzX1Yivwe$393*`C-xIPE$0ZGR)8_B%A`&UHQgVYlD5?`8j znlqI-^Y8GC&ylXFNYi6y@+ax-zErvE{^^Cq3RM)e9$L?s;ihAx_AkTI7w+& z?(Y$F(KHN?X1q2fkF2$h(ke2LO^lVAmdhd0+LI*+#!xC0UnuTx#pV@+@H!90F0D_u z54|0T#3L3cK6ajtK@3k^BYptNC%&pcw&nG~1g)(w;4L`WY`{J1Sd7szq;G@^XW+0L za}k;XGke!bplH4nRqAkPEL3Bo!}ur+-V`i7>8_~els6R(I47N&pB8r?HM@@h3T94){4a0#Aj5LuQZ9*Cn`GnytG3XMw z&qqfJmXsSejj8+^?b&AU>}BuVR>ie0-(6(ad~xAT`raCS#?CwO)+SYEuGA5Z)~zP6 z8=f5!>=9hEmpSbq2Q@uFG*@a=vDY8Pu%!rky+ zwr$%>H!0piYO;Ypirfwy@I+&74EiKGV58Xa*ZFbKnn%;YaZ>zE>aGcbRr)U%-u59v z%FzlLEdB#&X-vB|7`*{%R9Y0Pp;}@kB6dhNq=9$y+#+i2FSMYi3CAPr9yhF^A0+!!q9npsRF|D@qyiL`2QHo}N_ zgFq$7GEKu+4%0k|Hl$xH77&9az4x)xw)ge}L#xh;3N4Uh&=UJe4BsO`Xld@E50PJS(VsA4=o>T4U%jVxDnDcOU;UKd-K{Ud4`s>E?vjB|Im7CIH#hNlxabYY+>q9E8*Gf#vn2^TB( z^QUhnl^EZB6f}UiQUoSWESxjDI9 z3?Ido* zplKviz@rcuby~=zo~I@+G&k@|{5GpybS%36PA(mFsz^2xyc$S(Q3eVHEy`hJu7s0& zvS>I?r9VhNehSguCN@uX6LC{ePt{BvMzR2nw?=NJj<$?USD5&4dHX1ySfYQ!L;yK4 z`03n)h8f2FVp1Xt8_%Oi7QP6B@)>oGP*|Jex4Fgq1uPjB7p-G(jNC?hi<+7`p@4zS z-;LHy4_30kRXn=s)L=4((f7t1I01uz_@)Z9IC7~=>I0p&S1pQ)F^XV(-^-qiRFC5~z?jsBN22n5U{WF?!? z=4<2;{TD zR$8jE7Gc~s-JI{Gd7+#Tt5(UhOP(hIdIrlB^krLFpRa(ZZJgSRd`qx1*tBYSY`NkUdv|#d=?xcUe`V;4I zk$qY^;F?>i9)djo-aHxxQ&C*VaV4iC0pvWu&0&%eLEkq5*-++Z+=x|K3B0v=U4d?s zrxSOI0;m~Q=Q2s!zSb}%Jw0`|fAeL-CAIx=H^j}Z$QYB~=(ioDhkWNtLDUMLq8%tX zAL4PnpH4}Y_ntc=~p}>BJxyhWByy$e^;_HMR2uV`& zWE=g>$O9y09F92ROyP=)G2Ii#V*E#A(??0;#z^ij8n#cbsifJ!se0i4!;apZZ-OL?Mjx~R&t6eV4yU0@ z0XER3I1}ez%qA|^xZ-tySf_CZtV`JHYs7S+S-aoZc=ZL>UBA)@==J$~Fus0frO{<8qIXfUSvf{ zoQ@x5Y-y~EwbWMHPEvFTRp}+fX%;zW(y(qxV_%`#6W?mmC&iT^PVw`!OpQv$D-FXerX#+4)tP}OGXu*p;eMRy#-~P?fj|inn_RHPnC`=1Dm@?3yw!NP$`BD*1 zAQp;hhyk>Ek)I)XDE%fCJ~rBORM(b_r>iIt&s)g+=yNdfZ>p2A|iEW_Mw1TFRKxgmKSQ%_kBXrDZK>i#hEv zhyV|&`iUBb<^^D-7rTh=gGwJs3YHQ$kVapzN~YzLE@g>_3=J@#k(CDU6`R)il)0~e zBa)eC*Gq^X(;fc9mBw!c7i}e13hUuPYKX^)R7x(J<^u`CwvzAx7)P93BAlCh3|M$G zBQtj6+)1MfDIg0Lk=WbTubGMCyE9C8S%mz~xCnrCi&$%yB27`W%{{o#7wwiNlQ9zWW*U(HI$HTuxxBaLDpR0;btgi4*kf zSpoF?Bx90;ZF+ccfEZJ1UlReU1$dl%6dPP5Kr63cZnT)H!QHtqK73#(*2oC+-x|{e z#0&i7K_a2DoM^f|c{w_=N&_SisadnPT3o#LN!+p?9>`kCKFwl7N#8%%6-$+`1+J1= zGWjIAi=&1R#nfcGMB4-la>@}%%qcN6Xgx{^cn`06P($q{9ur*Ml$dXWVx~<;8<~wr z1nki_d^j7@edY#(R!qLJAK9COJl}D?^AN-_&=AR|Rz{YRPNpiAaw6hGlh#xqIJj1wM$nZM zgz;Br*z2H<=CaGm4os!)ao;3EhAl}1g?aM!aQdTt5z{wBkM7LmD6SHy zEnC7s1}7Dye;3LyQM`M(^4KayPZ-Qa2J%f7C0R12h^d165QTWq)Z+bwDAka5+Gb@6 zu`&wya!EdsrO27&q6r{Jd=O$~evfq!dlG|hLO1~+q)U;mpJ_z9H&3!-Oe06t4EAFz z32@K@muvod+0MZ&?8g1c8kh0SfJ2s4ideHN3xl&4a++sg$s6a}GLVLST1OmO(8CM$ zJOU7Be*YNG94hWl9H-;q&~PZgK`|#H*4^7OH8w?zH?})Hl5J8b!T~(|8O5Os3zAfx z(BqmUYjsrk0aTb&%`%W?|LN(!p@#$nHj+%Lu5Izq^7t*QP@KiubE#T59I6kR_HV-C zc_iY3YncXh6B7rAUj?XwBvF!5E((Teg(&NR_AJj(@5rGhx(g;;gw6oV>31hSZ5Fom7u!C*J4`P|CMv;Jni!fPa6kA(e zm&Fm~w+Sf-8}#tV0Y0P=weHfq6*72?@TR)&I6c&ti3ucT{BSLJEw>n|9E>eyoopxq zPMQ9M@d|;cG=Wl`PHORi9Q5+uh7}@j^ot-ECC0h|QYr}pbX24+6GSWyXUf&{gh$5d zta(cMNIjec%}vub3K>Z?!cE8)&ooj7@Jkk9NB}zllDQkgN*K!W1WK3@9^6!xlEL>w z7QTexUZk@v5ZC;_jc01gA&%L>4^_10_!u0iaH|gIcOhW+auZ`2%zK@sAf4j_q0tT| z-TGk=HJoFd$1_r4(icyBE9N;W)47I3!u(}XZ~0^3YYDm?XOg79)nST_4;8hUZM7LF zceY4ULt;o;tJ+?BXLNcv7PaYCKnqsxHrT(Eky>Jng$&N|UbEq!ROWj~851_{mEA(I z&FAB%yeLgsi=>QROdcT#aUU09ZP63K^Sf#3Pdq@bqtZEYfcd$f<&?C_$Dh?=)yaci zi%`kYp1&JlGZweSe?caVKlzif-G8IhrMY*GVj+wB#kvF@teOJl zVS~)B?z6n@o;0YEq-Y1k=93JOVtv@?u~Rs|-Nq)9k^^i}LXvz;+FVWKpeQ{LIK~dq zmb%EtO0y-ZQI6v)2>Akwf;t!iJGN<=MP1>=m&3gB@!VX%jO0lTi->+Swxg6mA?&V- z2ku^0F4T$RGvCa-K9ILB33Ddz?(>~N)WZLwhL!>bk)y715t{CZ3GdvJ%D4AJB|Vj4 z!9M5$i*TonWl5sm>T2}BCO2ZjQG1h~JvGS2>eP^@=j(!(>9k)@O!BOx_HUemxggl6 z4@u&tCHS8kx3TUnFnuOL zY+*t;op4>T9E)M3*=nfnjA%etRCgk|k|{z}9N^b^@eGvyLBl41q(kC3>pU$^9$}w& z#-OZ8XQ!U!FKf%yT8e6hiJq#b@}Oa7CvBSRW@6OLBU@Mn#Hju4nx?k2gr_V99$>gz z^W>nmSR02)Gn2r7pNL5eyl4BTm$dUR07IR6WO;3_kYR1tEY8Q5IE})8#)Vjg6RR{u z;l&WsX}NKm+$hk~**oH5Jfx48FSBS39o16z4T8UdpIXPN%$PTaD zHMjSbh1uD;(OVXEPUe+Vqhdxp0ZiEjav4L-WeQBdaQ1UouT^(B*eFwlF48>S&+1g1 ze*fE;&CTiX|L8^p10ed}ZVc9G8dNDY4#(!kLq&Uu2P{!GE(>;Nhc}h+baDaMAEn-ys*ZY z6YZ8FaV=&P^pw|X?LDGn%`USNE#}3#A0{divyx7h{;rjG=C)1JZ$!2$MHaG0swecP zLZ8fGZeYkc+n#a^d3hfec?C^-9Fb^6$M4tPrl%=$Qw8>Cp z9gGdFqU9`hgjGhr?u9g7P*Cc9y`@eH?I2||QkTiN%JU0ZgC8y=Eh_w3@j30!f73BB zFM@NUwg)Gd4x=#KU8l{RPizJ_5h{IQ~$|9d!f%z*v+m#N^CbK~n ztbz3pUXrW;`qtpW`4W17NGyLYgMAdut*FEu?AVb5txhSiQ-j1Xj;vwC|HLG z_tuO8g`Bn|AQucdxa%aM{^tT9A*>+Wna&>3eL0cVWM2;Hay)}KnBMpgH4Z><8AEYS zkCP=b1a53!!pqEJAV^vE8gO(}xbrV%6!@Nro5RtksJ3<(8=e>fEl5;OLWw99{sTdR zr1%y$8sb8scn8nuJ#C~Jp{i83+nk)k$N5(+>0`K@NcdsmJi1aAN_c5KR96YDuvKB+ zYh+S^Si$0l77|f%$bsKKalqkbjkL#2OH`|Fd$L6lgwJ(}`;uwoH~TfS0m0Nc!>AF~ zt6>(h7Aam--8HD@-`G&X>0M=eI4mG{UCb5p{djpNAin!%kOTj~C0M4ADoH8oq_CL{ ztZtueuzkdkG2YTa(C_r%@WlXnvD6|qmJ9cevURxi_}?3>4PNhUxdv5W;~QhNnU<- zwlWeNR&0gG5&XZ#X}G|7yG0dhr%St3UL zT~M)IGh+Cd0ZCA2lni=X;kM=Kpk!+b7>gv$dxHl{D1Fx)mr_DgG~|OBDa(+Mve?3j z7p_Ud84^5CbXB2L03^Vs*{&T#hnZ==&hWux>jdZj_AR4d*C~_8s=vcTm0ZY}&spU( zPbO@6ic^zl`wGa$ism@ZGSyGoc*HgZM3%1c|g zO6*7O#AoVS;8gtbtzcu?F?>o4{)dnqKpPk|pHM*XFln~%h&4)UG#%SCSrckTG3msZ%*sh~u^ZIZxA)55n%5M#KPa!5)^0U{3r zao`U_#Wa(!DLga;a4xyWcZ{q2Al<=Q31n9xxa!YPi37TR8>H0h+51*!s8FPngv<3) zD@0*|sEj-K_QhcE*qutX<#HFckogXvZB0yl{?K&>p0)P-{Yrt>3FFI@47LjMMGG}4 zE>oaQ=881#X9DbcTZWcp7GxLo#(J(~g|dr4iv(~vNZf&s{v1y{;ZALsW6Yxh8`-Gw zq)cbNRu`!>6VZM1WtHs5mT)PtS+(W|=WA;*s z%LO^^aFWF^YY$6HtgN^Mv_q_ufjDMGEC+_7X8bS_)TR?bmnV|QE{Eh9)#0N*V|G;K zHK8zSYHXcgOtFL5CyB)Q>xq=hWuq^$CtW<{J^J0ax-4rJQO}~HJD%Ca46fh~OOO0X zcT9yE=m$nh+{>NVGWlvXG|QE$5t!2i^3X!inelrjS4RXb+X7NkPCB^I^$COZbVT58 zIOo+eT3wWed_&t5l3b*v?y8%d^66ENZ(!q98Nk5CNYU)bl1x_^z%m9Lb{e%e%hHty z0)M&0!9{qsc@SeNRCW=e>;u>YSRTZN5=2(3p#^8v$?=bF#*rrJ;H=C!9NN4p2sNW1 zi85s%Bz6TAhC8DSG2(Mf+$=lc!D)HoPMYxY&vqtTI~(u=_euVd0atiD%Ut?+R9K#?zZT7Mkx2J1qr|bP!U~U9}n|Pk`Q}RsLg;j zwS#O2N+Jl3S>0h|1RZ`L@)XD@als=|K!XkIvR0(b?YEGuNQyP=On9)Qf?LA2<_7}> z*dM54h^hfb;QR{&ht5N{f|9UL2J#nthuw`hl~Zf~Fa@$nTX3@6<~pRKjIGDZ@JF8l z=gBfGDqN`40O+AvCiN90W~>aC+O9lbY+Azqw>3TXU6FWt5}P zZ>;AiG{~uFLI5ZQGXl5<9W9>FPNHp_eu|lRN{}nNyf~Qz?@CMj50Y{+=gtNRQ8J%$ z-9QAa?5`9rK_*ObbLge!wjrvves!X5xOKXk@%5gYbr7^u5{ebi z_ei2*IKctOaIUO!z#N791H<&`vRzO?Ik<2$Y@PCJc-2RXC9jQ!WY(TR^&N`-5_y8k ze8bF8mYU`P1a?FfanX=bra&IWk`@;_Ap2Tb8-z7eSn#*QFpjIP{Ywtr9 z{oc6<`k;wQ{$WlJs}aE??J}tlsspL(AT_^HP;8B(xl)kb=v-P9h8FXA{pQ z`kB*Prx!t!j!j0Ml#u*TRW^)OeuPv?;AkCw7$-n)T0ogDId*A|H#lC2i!ElIX#T$4 z;kW19J}Gi^|ETfZYibS>Y7*AC4ipyjg8GHwM8uH;@HRmj9fhl$S_usCR)2v|w!k-9 zB=TZ!JIyBT-5$lnEC19a8^_{3ZGj6;s;yVt8uG-hMYQ&%{2J6$?e4|`GX!kHN=+qK zmG-9$cQ*oHN3D!xGPvmTo=kowyJ!6#$9k_s34_jmJ~M+He1bu{t;_74u88x+q^>yY z`06^)2UK4Ltq{aX@KqKQm<4}K5!)dx(yThC%70VuhIfUgULv~(3y-ym%fb~2(=t{| zzuyRq6u8!t$u42^vJ;>Wyvr@V6hEikAFch%Tm*-0jy=|sczCZ$zvR?MHHqBM`NH`f zbxUBCB0a2}%G67rmr}8W5Ihz$biv6Kv?syo+0YK(*x_U%g+wnmU$bjFxxuCr$5MdL zH56RI3-H8N30oJsBi)GIUhb9j!gF=-l3K+>?sAxL;K*+6v%#X3H8R^(N~Ia578ny` zqC|ac@i5(nx=*_SX?=JW4J5@g6tK9s|rsHPAy0ofZZ&& z%QtA9I;LwjrR%V>GHvF);rNZ-46DgMLVT;r&5`3MZnapeJXsRbPL$8=Ly0Wk)c!XR ze*{-X^r3fwyqE@1gV3rC>nF5uSxCYb9!0h3IUtGu%ijKK#=ePY$I`s1`g0wE+EN^f zC$nP%#}_nzhfJJi`&3G z6fNL%7(_wF8V0X6I?y@+myV+?kPFIcvG;%M!oeDDW6`>ZN<{LpMLHrS1J;d{%pRbF`y`HfDb_P#_eEm-JUIOdkRLJV1` zr?l8NmWHG^WC*_m;RQP0L59 zW`^wb{b?BNNig5MH`Wd%^5D;rYP=Am5h?2$&C)Pk{N z`6Y{28JUwMSYgc)i!i!A;{kQDz5TEr9gKClp}L(`pzidc)|EO=6nwa<8^gxYd#KbN zF4Ugc`Bgs7+`1!=W6+?tMa9FzBXoGqIH9@6{@gwJ{RNN9EUf$rC(cAw45`n!isHw= z+k|REfJPgbQYcr%04F!X)~|*8 zuVwsjQ{#uXoS9Ep;V_jmqJ$#TLNuaons5p66cREQ6M6Q#X=V}S2&PV4n&MBm_5k1{ zB*7<$-dL|NF{5Yzfd~zDI{_8=>Zzb&>vfq`&%ovKdqAzlFD8HF3S|75^ik;njnw*O zf;%hwSgOT^P8Rn&r)^m+b`(!%IV&jv^Eti?p$}|f)D1<0WX0q?)|a!`F%DM}i>vsS zkdwtESVfkRylf~~t3y#F$%Tb_rrvGU_Vq9>8T|&_qCwV#1VE~6@B#d#>vT&?;qnJ& zdVC(A$6r08a^~#0n08?O!x}2(uOXC@$&jwr#VKuct{bBFCbyiro(Lr8k)1gq9#c(m zK4wd)iI$jlRlJ(Io@#u$y{I#fCWL_bhnokEO(_BGY%4kywk^aAgbgi>ol4yYYUZ(d z5K!WU`^SmU$T~PC?#ES0;Rvr1WD^Q9PKewtEFmH4oOuc4?SuX}B`r-V!fYxoE!0f03>AS<}fI*Lx)>*m|9UIiY-_QJw8gc5lW zf=2|QnBr?U=)jT-$);!StxYY2F~+jmBssML*p8h8HOR1soI8+gI`=TYj&wTmXa3qArASGO&z1wBwRFG&T^4MoNFWmy2cq9z=NN(};q24Pb02&5WaC_zy= zhfthKbfyB?QHJ)Y*Mzw=m+hu$aT&PXG{Kyr&C%krTU7*aw;#Ag;C5?BhBk}@I?Spf z0JmG|hMFb{P@gl^wEE=k3X-_CJrbnBF+!M}W)LSZ)V>ArjkW>k1k=Gib;zW(sp*KfV`I%v zdGu3@y+b$Z(QO`MlQJZ&%aydkepmlg;CAC3nv=3WE+^SBsfz6=RwD?Tgva(hy;$g8 zkT0EBiJ0zeB0QB0#s=Y(lzX<*Eqeu3HO=D1|ZfZ7(z%e#v6EjvFFgU$S_cE_5sJZFFyaMDUPJ?bb0XLa)2}x1lPAGAA z2u4J?yuw8t=0H%k4{gO+AliuKa!LzqlkN6EVna+fe-vQ&M5G7nB6Mbw!5; zMOKc*rBh_2gCtR4;K8Z^o1y(%Cv0q=)49>!86xY{lsFQ!ql$v>oU1{Ug%r;S;)7RC)CNn{h{j<>Aa+!sl5#thPYuO1qpnpn%Mq)Fz94!9 z=5<9Sm@@39)a~~KJe9yb7jy@Z2v-h7S)g_o#)sl8)qs;-qRcBXl{2vOZ%Bh&7xkD# z{UM12{WHeNaZbVo4-}bsKXod=???Sp?-Ht>r-sK0I(>UcBD12pk^C0~Jsg6#fj#t~ zK(9Ty@Ms<&ZUPA3Ob)0T>=u={ZZ4ZR=+NLmHVo0N)3K6ON*=Hf5|3!giZe|QxuHy+ zKpTrUMgTpEJk=l`PjMYhlj_oYIN~?n1))kk2swjGBVDHG0Zbv1Glf)azd&p~^PID} z{Mo?mBj6_f6!@G_+#9sniOCfTR#?u*Lsd)Ri7Sy64dAeSI~B|}4>_o(M4uAFDc(TA zZapQKhF~(Rv`aF*RG>?X)ssYMwY#C4x;Jdpz|kzsPuCKrc?1J2OfRLX^Z0|d z*u)B)9uVyIdwM;+%$w4LlaA0u!e$2Gr8vPN)To2W6E^xx#r|;Q9>sM?k*~n%(U8Jv zLQd8lhiwj@Y%%1GXk3_+xiywij%vEhF+6K^MJ`7R@_;sidUZ$+#VY3jfJ_3L6mqjW znTU*7pMAY%7-5U+6e0t>l425iVOub8xLm85t{Uda<^I0wR%Td>JSRhdYQoCK?J3OfWc6_J9VoDnuv{%3<~yYS*(IyG#!| z%dKlImcez(65x|#3YcW>2vK$@F*CLb`!x_?<7k~8C`rWI%PiEY8O)uT7NSKjaJvwM zve_8H$CjzR3`cnoCJLdSkYYqrcuKw8Hd2yl(lKbtZ|TQR{>(NBJ>x7=jF0AdWn8W; zw2yZNFC?(fG4}qnbGL{pXYi)ADNSInDv7*kNC{>JPA*kw*TYaUH-nJ5Y%VHgl}IWK zw<8sXZB;7NVxsQogK90Ae8JHpW%s{M0XYriLTHzw0#;1yO-@?tIuoqJXpCS-0ZC?h6xDz2khaN#iI4G>dwlTKTKOnNz! zRy1c6mu?V0V$3p9ZNrA(t zW(+4H1$vK2^dqeJ7-A|#ngGP%=^JExzSa%3AXW!j`i>w7i87~&=m0c^lfGrquSUwG z>RUS7SGKh_wscmQSDU3PaWS05;yeWwfid4HKkIfB#9=2M8#bUXusDH8vOrSRB#(xK z0NTQQg*Fp%SQn;fG@hTCXYgXkBA{$&3G4!fMG4k3_9<$RxCqfrA%V{fHsB=cW@REm z1}p3?N)Kf%rS3r{3y87-HC2PGSQE?Og)``AI57>Ivl2$KAbyGd#%lsPL?i*VriySo z?zVAEDh>oiBRa%P;{QO;T2&g>nLwE6s)P8-1*w7&(_VrDRLFaD?7^;Ro|sL8=OWh* zdycaZLtR9CLeS1)bE>L)yZs?(aDku)G#Vhv=>)xtGADFH&498YC0v|<**C<`6P%U+ zdOSo}DZ^rs6dVjfLO;{+v*=!WiQpl2}>~i@k_AX5Ewu#GE}AG6;JO zDC3(=*X9pmrVibkkV#?$#Bex4Xx=U-W$<7n9w$i&972@S9B26|acnQzO)OE;&9IcJ zWC}JLQzymS9%g_vOVa4nE0M4nWF0iXyU}*9=mO0c^r7NQYzKj+Q8vXso6R}Nf@D`) zdC>U*Za2^AJSRXB`D+s=9L6u|nuz7bzY5Ole1o72ot#R@SS zF-e^Y>E7)&5-Oa7kUjVZOo3PSA;C&d<`onY@An2=k^*Lxgq+CQ{U$0XYx^Ew_bg(CrU`GR7Ry z+yR)s#*G4ad6f+IwvN!w+O&PnJ_D(J;-;0@W>)S2s}?$(m(k{X^eDB666YF<`by9d z;8c+=%8e~H<)%YVID)^t~{iHQ-i#oiM0Pj_60Zmh#Er-zpQ#Ed>{4Tb``E74(D zs^jFIk|=lSXi8i~$c=c4+A{hu(~{GkpeYj8 zK}9)Pu*K`)Zg5f_u3HfW%lJoi!`LV&N}`dVLF_EWBoTS38z<3aMZ|7gD?r0CF=3~% z$kN-}+v|w^Lp++@snLYQY)d{&iT*G#4^xxSi_OFaJHv_%rwE_$oMxA2g}9lp1@VKr zksPRyhJP|Az$*gu09;Q#=`Q4K4e$<;eZ>(;Wzz&;Ne)pP$J&SL9g|{5x^MHBGKzku z>ZXzo3P9!fE;ND?96^gzl**fp+n zYpgJFrUmUp{6GwHGSyS`K!BxX0*5-s#@m>1rteABl~4>w{XLRVr=FykF@wu2HdGKv ze^#D>gwuHyiC>Z@NdzVKQ%O>KbaJDIiJNz1fg!=#Lz_w36hQ}N%xsxPbyRMt_lz`2 zDu}IqsN(i!1`i3x=pdM|Ods}>Fl01+nN0m=*o)Ns1?3fv*lyBQ82d*%1J0@28%Xa6 zvWhW?I;l;6PFV?c7R1NNjS#D85H9z)ivA-Xk_(3yy>xTkHiTNJF?>FsZ$?!W{=d)X zOa8ylKiya4ukr-~{;H}O)2oVn{;KKIeMP`ms0n0x;<~|UMZUbpN?zQ5$WsEEAa)c$ zCmplq*wlj)BIA@+1XI>F0xd3++;)Oayi#?iveQ|XU6k#9sQ;e!I2A}zNeOLEV=J^8SJ+(k1gJt;fHE&4DZ!a~hviC% zkg4Evhck#$=HJYi%f1+5veo2GJ1bs*bB>}nZB|_&S4oMB^iquj2^}q}K`g=kZsB6k z`oh)&X@{_w_3>huAitWebVJd&2&|PjT}Rz^*#7M@9oskblNeyC&ctFiY#@2W-idIu7KaN3JKLIeoq-@WpEMlfn!cKg++4R0<%n$AnGNi z%95mJ#kpFct`Z*!`YGZ>-B>Y)2XX;4W;Hha&vpwiByzIb?{jNDGLH^39jLiiG++t; zY|p|pmE_N#ilbZ2>S3Y|rV>@o)CvG4-SlvpYArP8tmLIs8DRANJbW7t83%be%3UfG;)v#frSE29?BI zs594aQ+I2RBgX-{wkQYF!QE2GSg9|}^r@UIpuTBXvm#qV5FHBE6{EYE>Xpy5!K48; z8OS`;&E#>K!riHOI*v3)59*!o&s*m-z1C&qG)TB$~Hh#oEwj%^&Bq%d?fnC=2#U0l)Pv1$--0U#(na!uHP zTC*rgqE4KJtHBJKawyD+5<C70P&0MEKW zP6ZVUNO4rX)3d-lq#JhWtz;LZDNS{uXeLV54bBjGYn;Y9V)nvyMp)Ks(zr2f>D%$o zW+RN`Swt-0fX2y!5(A0XyfjZM|nhxy@nRWEgLW ztucO6&X&m9V7K)oH3Ow2=4rNvPLefrZ!`8^=!AK5XqxF)_r;XIM!8THxkFk{@L8ocq zsMog{#z+&f(*&2K;wkG?r+KCvz_G)F__C4cbL=%yVEC}U-IBry?hu`V9ZPY&8t9n>kf_6MTn9wf?835C3_HVveb!gG=2o*BOO?wu>nOl&}Yes!9nDz+Nqs4aD>)ZPEx{(KN_Y={YrT1g3s0 zaS2Or%8CGMhMn8ifrQo1qD*xiicBYg=38O=6!(leQw^5gfsjP(SRy9?K|!RKvgD}( z0qTY*6Q%@BqTFLi%h<+WPjeqQAXS62fu#(WoN_|Wbz_FCrxUhT&Pp za{F47Nt>d9oWG$mGGOHvJ?J$g>^j4->2Q2F^tmDbbTB2Ilxb#O4M|-Q1*6C0kFehy zq*=0vER6Fsplu~tGSI)R{3BN8^;87_APFK}E-l3IL$0oUeod`Ki?UrC;sX@PA|~x| ziNwp3&u~}(36rFryNYB6k`VctA=J18Er#9=I8|JrDRI@tgB{zucFtt~Nc#=Pi@X!;NtxT$f>fr@|Rp(&LW?em15df<=2x!1n zx{RL5tW#LW>&FxxF*{mZuF;q3P&3~k(m*n!I(*gArWG~sYYA8?lbBk=?&d}dJ`ks9 z4Kl}>)SRMJ@oipzTO!hu%&ACAQj?J~Ez%IG7gws<#0gr~tSoJaV7V(vk~d`%zYk|9 z;doMzMU8TDJcjeG(?}iBc>`_pVAn83-JP{+nE)L7x|3KVtCj(Fc-C~ot;Jleq1l)Q?27fW z7$yiIC)HPVsyyIm!h3rVl&u^Y=w?OUlj}X0Sj9>+OY(%^%}XhW2g#Yz>`{^<5OACH04OO*awaIj z6sp{ zgH#xZ#M$z#K%nzcD8wZkpzVoxK(THpT32yS#=tbm7A<94EG`+MDnYk7l5VpEnlD=j z1D%6KL`TueR!M4?Fc6CVLuK{KVCCf)3)&P&vuRvB<>Q7FxHyqr$nQQNvK zC1{D!a1uy7PG2+Nb?#--&(@JnryC{L(csk%#HbqPrByA41HVZNZoiNGmGiD{ zI;%|I85<+r$tnRjcY`@;TWtv{G+H^7-ByZ#V%zT_jxs6q-)`RiFRS_;)6Vc-0djC) zUeXQ5F^K!}mS7%?j$YWF(Uus*s%u-2I|L2RO+!1ZV~d(}&}meI4aI3vzj7LnL!P;q zFr%s%tMu)VvUsIbu2~Vhq*`nkXAMhuIoS~1>|bma?BAJoD_4zsQnQTucJ=U3smq^f z%}1^^Cm^)H?ZBK@JC5zE2CIrm)=ZDjJFEB{m&4#|585L7!Xc`k%wt~#!QnEFD$Ox)Id7DQRu-&omT^#IK@7u9uJu{ z?41deaB?rInl;B2Wgx(AyDoz{W#F5o$PlzGBT6{RSDKDZ9?EKj+VD(@i><>Z;3SYn zx?(icArml<%oL@A-GdV|so*U8tGTu|)G$%(E>731xR}*XrJ|B?V6bY%R@*-c`Gpsu$7e<(g=~ zR+%TK6$#_jVAcZB#9k@8W>RbRNmjUoOe)=7DzOn@0AeY|4f?LWSJfcNN@XKaOL5i) zBw2F?j3g?|@`GfL+7;|#M88rrpvZM3S&J1-NyV*9GKv{{&QiR%X?1x_`$L>A@^14d z9U9&eoJ|4=y!NCp)TM*|lWYS?JJCVsU+tW+xe1(Rkn+)S=X!J50))a5YSq2GS#{i6 z5uUZm#$mPu%|07*7S%)X2Z&X}iFrjMVO|FlS0?|!e6O9lK2q`A#$l9{(7gMs)FdWv zqK-4|$^wV6o2eRfQQW6ND~XydVx2>REhz`cENnp0aE3+m##a#JOj9}nBdX}=!r}@B z*hMUP-DnMFqz&R*NQv`on5E=(XT>U&q-ao6tkCLl?uu%H6{~)tXDiIfeWkJJmBSO{4jBQq@Y1#Xs zc>B-vGoR^aKGV;9rl0vtKQq?)86r2+GC820rH%7~W|EW+J5Z57Q{6N34W(qc<_KHM zMXG_{Gu=~Z4_5S75ybdepkH=@e&h}`C+AWeeeai&B-YMG*RhCciu{=HBu_An9)O6Z zHJar-2KXrCyWCwcfzvcBhKY(;q7_Lfiy@YFZB4Ab*fqHB8?|4uV_%wz1BExMI{xSElpvw zBBMK&HUkexj`y{~3dAr@zel~dOKe3*L5%chl2g=~6yo?UGZ4c<9E=RcWeMuKRU?76 z#7eAgPD0$fNp9>u$vsidn5vsXVnT^ie|b==Xt1>dtg>M#R{9_PUn7}t^t9PH8MdKW zl?@F-Rx6DClm@0Hh9qc=7CQ!Jq5?TDg&Z=?JGbAO!{T@df-#v0yCpgqoRM_KYFJIG zaeZ31^@1rCh$_LFY|j3X&* zQUH=JHAw0tQE1SQ%*@T4z^PbW9YX-e6=2Ziw#Z#G*M+1Bjn(5t?1xB0AT$=UV$bEN zD!LKTpuSErttyP8a73yAH{c|Q5FcJkozf$lKLLb#wQ3?ltcj}|XisyBH*ByHffPFv zcN7B;=oSZ4_CU<`MzR%`r7mw!SoSWRKyJo5l7(U< zY9Exqdah$06!b)?vIZg9HKBw7^^xtwG~oC7oc((<3>V{i^BB$9@mw(5F>>lDNP7%2 zoP(hcLOv%!)LAH+qJUVOk5Yw}a{$Nj=yU!C@)?zVNAM*1wG{Kgi19NsbdfoEhB{x1 zVWPfUmJ>`wvU!>yYUp5^dfP(0j7hPD8~(^qp_`m^?*$hJ)#bQg!AEsBu?&1W6@-G&SA`>)UTk?Q3y@9XR1R# zrxZM^2DMiGIi*L2n(0J9Betl54r}MIt{&?#%@zSXUoQLAN_(+B%M=I*MqH@qMn^)owqVq* zSR1y$;wU+qu)^Unl5*KHsa{FEq89;)Mc&aEMx4V_O&%&k5{1-hWtnSWyz|h0_KeR% z^2Lg=h?kl2F>B>EOZlpDB;PSI=YI~&2+T~*|2(78_gVhuF?lX-YgzCm*NN!?aJs1zHR#KE;=gB>PbHH z2RySqen0sI2@mA8fP@@~-d5I^R@Ty~mj-+yo$Q*LaIDTRCc+W_bcKVBQDx>D(g`Ak z>C2)mq1k#*U7OF}7Mszd)kS;P#=1F86(Y+k+Y}gGqOXsxj4ZEOATDY< zyEHJrG|<4cbF*aF-XcXp4eR|4;rT1oS!XxQs&8$IE?ai?EGf_t(jrS6W=58l2Ie<) z_RgBQWa<1^WZC-CK*RFZC3;t*xVBb_bgf*^buJ0?tXxqVXqX?-rZ>#4T3@SaE$y{@ z{jxx1X#VonCDVHsudA!?kQ?++x3RV~FuzV%I+O2;ELqSaF6jy@kXt1QjpaQx{^@Jg@ZynckF^V>C{G|;fLrY)?+nw!HGGys@^+XDo>&dX0wV3mcmnBYJpQ+YCL@(!N5C zE?=Rvtn6v4^~XBoB{kC(-^>PI*Q`ZqqPwcDBQZUcn7v3(%x_%WE=6ZFPhVWy#m(UO z%F1;O%a<3jL;399_C#r5z8+BI(Ai?AymDrP zEU1x{i`B}&%5~jUq2*9pvYsDR16^W$Z;jlpEnc~FVQBH%hK}Y&VNq3mNAHr-Km(ky(!bods5H>f zv$V4|+|kj{UK(gX^H>BM{q5@Vb)|v%fhFC1?fMny$gN!%pT9U-wIFi#3~pW5Otf)z z(?gvN3pp;jIHtrZ+uLVzfi^Y1qG4uOQhS$I&S+dA8k*P@udSR>RSDzq+REBQ)w&Q| zFST~e_OEL_JH9x+Zef%h>6LYfW%2NOy}M~auR60%t@!8dUs#_{0kp@RCtcNottrAb91Nf zx^G19Sp43V*EYX%)(?L){e~MRo%)UIPY*OTEz!H+**CoOy(4CX?)d9zwM`S-zIyz( zfA;pFM?d%MmEVd#xaF1me!g?Uz@F}xF5B7j%<9@NK3moNU-LfNcI-F*`JKt1yn5l6 zCZBlGMHgLk;&0Q5yu^O+)L+wikcm zeZit9E<5SMH{OUo_QVsRgZtlk^2sN^A&NiVcl)C1#|9UEKfxzATj$8t#AHot?}Mp>ZL#a;^?~`e&6-$p1qg<{G5l1tE#?wIAzKG^-v4f|GpN&Dcfr9WG<_0(h^0Srqef~G=KiGcD6>~Q} z_~5KJ^_!;6m~s4^4f`MCub6YeM<4aRsjvRZL4IJvcMR^i;?N7H z96Wf&_442T_8Yek9Q&&!cW=FbANVCd z@TDDt^16@xe*TFGAAS5W_sS#vyKXOw?S1(-Z#@6wiQ%2!clU2>-@T>(?yVPa1N*lP zuI_ERsXFd@e)P@*uiV=D?DYNr`1+o^?t9h zfA$`J!C(LS*M(a`3wK;Gc}MNBbI!lN>%~P|{(JGBo%ifs^Um%q{IAvycxF!deYo=X z;rsSY@^HW3?7wK^#!Yi;m+#*4ue-Ny4GsLy>uV4F>iNxI_`(-{`^(t>-MUjPFE1~D zcIrZePE?`r(HkZaeo} zPyfa*?4Nqcp?l^v{(RS#*LIx$c<8)`9y;^=fBoyW)^*|up4H#F@x~jU?tgpI!RLL{|Z{4Z7_TN5l&lRUn`qjMJD=u!h z?8I$r?_ac~=7npnz4nKVS5Mg$nRVpB=O*u8u<6o2ZQ*v*z5Ty;zPDrYz``vx)1Q3i zneRUEzytdx9rO6$zDo{Wb^0y)BTxGM+Fuu*JX@(^Ir-@g6Uo$43%-#&oG zxM$v@mt8#bmA;8zJi&9#-0!><-1hAwH_z?=^}b2nj}Jb-ZE)eHXAe|9zj^m>Hq1Qm z!P`^&KmWp`l{?S+&fZ53wj7x7P;lTaZs7E%79N@uZd!5YvR|xyVWTpuy=mpjNq_u> zSkiyNGrPCkuzPZ2V9~(0&U@mq&3=CMyF2I4-1x#zm-C-|^xm$>?(+}*7|pX}-%(!| znuJK?mc`e3c15oIQeS`nwTHIV?rH7cbH(XD{?nS$+Dk7!@4t@v%hTSi*UbHnbmgW^ z-~Pc5z?+pPo`2}aR~)+P^lK0P^wv){?|wj;{KVy_oYDXJm$p6a-FoSN9d*pYEla$6 zcFx*8xv~A8t#4g3dE%6-k8W&i+!eXrY&E(yqw!8xKu7;b2MQw0+Ab!X1x2@X9wYiEQa#hQ68Gf8f=Fd$(RU z_m*XQc0P#K^TVw-l$|-{@Bef2B`@65i?^SOJ1+y391m1`d#+`Z-W{W}KtHN52abK8&D z^YU+29k_JswKv@~q4~L2_wK#o{rBJh$=1QAy<5NWTvcx(G5w<>{pzdVIJw$*^4#0s zdgABjJY@X)i2ypw_srXW`^?{6e({dU11HZrwD0PDlLmhJ{^PfbCtf~z-nk#Vc%A2* z_5XLtQ)}-p_IQ5&*51o5zq~;d%fEHwnqB+efB)M*5_|vk%*-XLSNHwjye-#XfAp(= zpB#Ms_1C|1y!-6nOZUPD*S-GvMT-}|_s6cgUYqytkB{x^>$~!X8>YQ~ux;{D$DI7z zj@CJ){S9~So_z4?#|C$AdAaP&DW`t(BkrbI>*kZST>9Fh7ruVy121p?%j1`PuITtn zjvO2uTybBx`Grf~eEY7g7yL+^rM_Bp@4ff_;m%bvf41s@V+IC4o?6xX==bMrxbo(k zFO&cLYi{t9k7s@JlUb*3*yDffvB!S!gC7+A`_SHjABrc=P+msJ{iBaQLf2;Lzdg;* z-M#jOX{#UZUGh=SU-zDJX7_}f&+Pdg+OjJSHHHTEv?|w}GV#ed+m|)=FR(L@4&x*y54{D-2M|UJa+Qui&p<;{nu_; za79B?(}b2SbHCL5+&^DfzUGGyKYa2(c5d16(tVN7{ppkE_U_uXtEeb^-=zD(&-~=T zhwr|0-%)et&Mm8`IDhNbt?kMizcSwZ%2{*f+_v+MuTj$S+(~dpT`>5AeMiUdUH5v! z5l0^R!v`Py`rNs5Kl;i;#e{ycq)_)J4dBL%h&;0<-ZGP^{6DR)H zPhZ%$dGqF_h%k`|8Gw(S-tww%Eh|w`vCQp${EcUCIqs`pJ%7`tul()Y zrfHwdthHT>qnEz?%){}w|Mw>+Ja>QBi|CwHob&6i7O8)E?C9P^;@yEzxAy5j_{oG z>&_28f9s`}PI&5-3)U}r?a#lrpRXlLmMrSq67T=&2`9Y1>$b&rpM7W1x4K^Z`O-rJ zAAkJute$sIt~mbb*uR_p_CV{>e;@4p=>15n`<*|2_o=I=F5a@_jQu?m4_>`(P!0_o z_~D+-n`bI7$M(Kl`g-rdcOH1}-G}xrLZ3udBRuzqHO<$YGI7KHJvFa9(tq1daMT-r zerV?Ycm8iGx{X`b-7{~~t@8(_FX?Vtz4e=?G~YPm+PU93`PJ`lc(f0~gg}wl%o%T6`lfQVd@)(4Z_uN(ew;hiS9y)m3q)Fw7e%!I-7WJR6 z*1TEy)^`t0Itt=0?BqMw^2U2^aa-ee%(| zk3RmmaZAmNf4=wLwx_P1dfU$Em-pX37mf7pU7JpO;)tS4Pnvnmx^?SzMcV%BXRCkp zl_g7-ILTqOspwm`-+ueOd(V$AJ^qp-V}Ja`RdXNp?B22-(bM*U3r?K4;lp?9(e<6w zd2H*vLsk3tzT)k_;GDbXeQ@`@O~S2%6Q)loiVrN@ct+qa$DR=ycq=$?`cu(EljNqN zZ>(6cxqaT&m%nz~kA5`m(3}_U=LQb!7+kpNxPz5{-CR_pD9T^|{`W;&YNpT9|30DG zcmwobPc+R@(r?Y}>Bh%k^20Cg+4=GASKNDce!Tj}^R7E_Vv&#Ae#GE4 zbEZz3zV@qATEAb>f5Ff1p7#%KVBqn=n|8c#K>wBhb4BmH_g?Qmw;grW%{ROIH=cIN zob_LQ=a2V4`s?`Hx3)f8y8j<5_T1IIXXibu@1J+w$rFpz{d-m#Z|*wslH=W*=04tb zyl3?n1_lOhI_|^r7W?yi|hyS>j|L=CgsOszMyF0S;)Hge>+5gPU zSAI}?;W3+MD&OB%z6i6vCth&qrK1kMzPYIArn3@X=|8x?J{m3i`8f|w>A$>vmOwoADVvh!TU}**fnc^&lh*pO@I5vyA}k4;N1QXmacxJZ{>lL z&pD&4?6=SVxZ~No*33J-w6t*x|Ajqwy}NtMp?kLenjaW=+`r^I$Iktz=)*tvO#V^J z%^SCGpZ}(Al+K$sx#LGo+YWvB$`$bG?=^1W7w*~n?(QwG-?Q~0exPTEf5|2A>F@op z|KR?w&skq}%&BLU^((9q zB}Yvj_{9JH-oG4e?0xx^GnW7S{1?_+s$b#nwk0Mn+qVt@R_wkNMDx$35yqz6y<-^)&#dH1^48!r92|Nq^2_Wj!* zyLjSN*I!@WfBboeuBzC-;QrS(M}M$$?!gJCopxIE`8)nUdtV+8)%QNG1tleweY=f4 z3}dH|eJ8t07&CVmW-~K((jqErN)#nZq7-eksi&==Zv_FqXE@d-;66 zzgPEQd#5jEq!#Yeb=lv?@uA z(xcbh+-zZIcPmSWvUtf7$eTTjZ{e3TOSra^Pa!2Ot>aNdbxD(irBC$9cvQu8yDaU^ z?d@n2b8|^;ZNUR8Lt-;CMQmi2j(mETTwQH(Z@vQ^mP1R@JW2F=&4HD?5)#Q_A73LY zV&)633RS77s93ysF`Ji{S7<~;Wo6}@`lks7VRpl!kjCM<0MNpJ zVQraZ{m&!bK@m~tr)ME~_R9rmnFgmhRWY;oYXorE);~D0R;}Bqn!Usz^~TtvYls}m zyDOi>_iN(0Z0jGK#X6m&kXO)<>1xYRPm7>L-1nf+ML`|^#Cb%WJd4Jkb0nLtM_Ml;=h)lZOUcO0E*n0? z1|Sf;2M-?nJo4t0bgkr8RJ7EN(SkUX5pSfK6fF~xA1%6c=Swx1B@M-BTgIBX*}RrM z5L~xJRSfKNg2fU@y6nGc%PhO@Ym!QnjFBot&OCj|RNBDn4U*=Y_6tFBoZ6H<7HA{4 zrFOd%Z8QVPf4ch9)&KpjmS6KJ0rd35T1tuLIGiG;_F!TOs>Whe-_ugM6pVQagUXiTN5`=C%I zQD1`5X!N18XPrl!q{V222raFO**f~+uCj%dRYii3+Tvx)V(bp+UVrvX42eVvs{1Xz zhf#xKZ;gP*-c?Cr)z#J4>JFO+_B@hr@94-WE?&$Z&wlN`01}B@{^7$1QqLoKQN8eG zLPA1KB`D5UuUrM10%)oJjq3a&|IRsXd)^A;_Ny^XH;I{a~0YU&oR=+TCPPwnmP-goyZWf(;3 z+sG`9T__UkTC{GtwziYT{v)C zHru;8WqDcW!3fBZ9XTT9aVgk#(=cbu$((&e!5Ab zAr_Up=<$iQTRpFYx7L|Un0k0*4d~eMiHO7>)QfmkQYCI28F_g?XOat{#INj`@VIC_ zs<)}c!qzrT-~3UIaol1dp&ii8?uU5~JIm${g)I0&(TD#15+S-&BlO$or@(htKKVR3 zi!BQuEF93eNbb19cX{YZfL~oMJHN80VpP&{nn#pWHTE`X^qE+diN^f-^SkQvd7g*1 zEd*cKv@4pLnr3L?g=f#1vnwM*E-GnxG30j*RgLu|jgInF&E3>im3%nl-Sh3+x4+EZ z?`khCEj^Ei$K2cdQ2o`or*chRl_dr(C0Aon(WPZyGcph;j;~+87876ScRTGlAM(zV z+Vg1s8QuR|@whxuK? zUntx|Zd$#y2#*Vp|5{Q~($!QVNhXtz*dvY{Tw`=4-4cx_PA0Z(n-kl%ZQHh;Ol;e> zZQBz&dG~wwNB_C2&+4u|r?B^~YEmI>Jsyfsw%Hdw^Jm&e%w_DHU^-6_vUdD{GxBC}cQ;tPUP-w+f zO(563rc>YB>&FV=}zrP>$ zW@3g8*;l*W>(^W8&0x^v1&=cCb%cRIe!JFS@_b6KSJeoIO+dc2wB)Sl%2GOURHsq! z((dBX9QJv;)&8&-e!O7YTt!>B&7(&`JH4}lR_GYC!}GnBYHeTi9B=<|xr$0ldnwj- z=v^T8cW((8IvmVpOi`kMtBxWTB0U$c=^g*wa`sEn4(MqTY`Og>GA$+(D0`=k&h#S_+g~b`S7viQL`~*Qo?zMZnTgsWdth z)O7H1Or46>b0@g8CLT^zbCg@Av$?!s1AINcXIVrg0X`h)VEyA6a+OE8n3#cVAIr32 zZF2a&yQ(2rR~G3IirQ6cNvn+)!=-(TE-Ty3>_1(}%&OlC8(A5o)j0xT+JxAr#y z@^F4*$F-^8u`?GBGpWi6sfON!k(Q(s@7Rj`+koDZMe zTWdWeSySw5niTapoc9i2cYHp&gRg+O{q0US4ieJ3n{IGuXh?fB+snj;N%c3=(&^q6 z4Qhs4K_?%+iw_Jpvw_ra-1o=v_RHj{oFd$Zv+N=mMnSCbO#IlBkf2(vwm;1gEdUG;2^icls{P0ld!mHr!?ZNC8{a9i6GLny77k3jP#J9m!BP-Uh znK%^1;w{Kdj~h<%A8lsqwG`YwHr-5fYinL2&?zcPauid?06D?jbN*q?WUEvde7%X~ zK`YKMTh8#xVM<(2_&1p<=BN|ZCzq?AwP+|o)=HE(AmT>ip_hYyE7%@m+Vyti^^@>T zAgFr|_gzlFv=$5567J6*@2km;KjwN~;%NAiTkz?<{~O!OTA7(?L%`>2iq^3n+4gi{ z&c$HNy_GgR;x?-XIOW+}k@nng@ib#;YwM67&b5gYqTJlvjd`O=*O5_TsV#{wdN_bl zR$RQ9Xt-;JXKK^pR$DXCOq#vaA)}WY|r9A`qsWG|UY-!-!-*`y1_oelV*0vR@+gPp| zvI*$vY3u3rvP}4fkM2>IA1j-RhHeo&M~t^1HZwyAHN?O593Wa78Cp{PP+mA}NYqwJ zB+q277zfoat6RT>+8x*GzPW1`&A9Q-jEY`(Im)^{MgVOYEz0C2rc$$>f@1Bn{ZgyO zl~7l6d|GHF?{2=$(goy*2;*4n#E3(ul{eR`b$I(^c2qv~3P(C`X-P_p38X#E2cSN* zwun;?)W6FB+hh^Y7q-i?k~7TZQmHcQ>6NdvwZ6V?Xla{lQ{U#ku-blD@Io{Az0kzTu@m?6L_$ZbevPgbBADgXqgg&1810nP9xlS(7Nx6-*XlOf} zuO+_~QzMiulZRBSkxI)>rfR_^

Sh)wG$ z^=@_(Edg`U%zJQ3&^pDfMUvN741@ZSf|iJn&RA@Nr4xhui9kU?$9m2#FRj9SIGD!$ z%XY@}H&NDHtvGRP*$1wBDP{WMS`0&$A>B;t1?3|Iskls|ZDbF;TfPH;PxC>C$!}ki zaT=zVyw5g=zK0`BwehDAf;CD&DR%5 z0Y+^+k@ERm%vZZc54Ms`GT0`pC1@sY$@icKA7l%fEO@i=pZM+)`cYF?{z@C9Na_mt zRkmd`dJ+>8!~3XH=%8;BuA#3#?jOJXR3FebucMfl=iQ0exORVkFODL43G}-o5gsOEc|4E2+5XPk24l}# z&B{61-@`6|rn71DCzdCv=2G@ChECyvEolbhML zr(Ek!w$~TcP};E3|w)$O{C0W zOYh$i;Koly=tawS2df}ew*n$pIBKB16^BRXLb%!jfU-s28?_ss&+DYhqd83nE+Pmf zF48hG>pF66b~{ZGHp})OwlFYJC|{ckq|Vc>PY09HMh;L=TYvt#R= z6&-Ywg9S>i^+7Td*OBukGanaHNkwV0G6WU7Xa|S81S&*px@Uc|xafoo+Df^IhFx}i zjAJFMJd2^ z1wzxwBd|8s?7c*L*mPZ?shj4cfqZ=bq-v}~AJwX!7TUDb@$YEasJK3qdHZ;6PB zi7Bl4;_U9)>vLAShr+%d&li*a$X}P>N|`7%G$3_!e4aQu;*~hB#8V_!x6X_1j);1M z1iM!81_`pEbg<~aDyoy@=h@%p%6NHk|1BnE;NhVmr{|Bd0c2bL0Rcn*p%r$!Y(x6S z1a$>Z#eBGK3rx-wObim^9hLL*Pz794NFq&B3;WoA37RV>&E3Xnp2WSr?z$MpRd;Gce^wMNRWhtgb4B7@Yq|& zM^|68w6x5AM-0sp6Egtm3lSv*R{l|ObaMKzQtb&s+n$JTC9A3V3@$a96oXMjpT8%B z;{N_%wU~)`IDc}`Hag(!Wq)YL0E8!kopLN+o+@ObtUV)KFWQ z8JRz>Nh2|8UtP{WpQA7B3=4d%UAB^H8T;K*V_GA639?e7B8d3=qM`+`07s#{G~$jb z@zz2(7S@sf07vHEsVSW4sUV*v+7-j*W|=v()V~!{Z3%3-=2bl_Dq6#HP_-5fGn&iG zXtn#2!@oH9J_lFz0q?M4e!dn8vCmR>V$g5!OsGj=6&ykZ0%IvziN%Q}S(*7}QFsL^ zbG7ZF?SnJ8!ezc@34Ty#u+&_}3ST2mOCH&+1LRPhg1a%ZK$si|4+Db$t)S5SubyE9 zQ$s1Hdd?ijl$LbK05`=vzo4T0{MHU*&k*bE^60iUl(o5TWr>aTDMgi)SYG*#k7|rT z>N39Bb%d=Vb)-cU%hXaBWCh;DGBRG3)#>kn4JCYqG4h;Sj$B!7OeJWB{;e$Iz(>+* zMn~DkS|Dr@0}RaSd~J+L|XGJ_U*IPBpb z>zRE+Wo9$AZ%j@%w}|F4g+1*C4-oE^<#8>pVU*Z=m{p+bO@O89M!%-u-z0;!P_mtI zU|7Z`2RC*-^aDJ9_GK2uMi}U#GV}FcZ`I(S)t@wFEj{jHPB6)G1cVfQYH&s;hSoII zmMHp?^Zy#jD>?OJrsUn{1mTd4V_!tF5T~n`WE99WT|;Lw*#Zpuu{6QR!9t@K1~x3p zF7$1hahjx?s+Snh7Aiyu_XDsHkLlv~e%jdhPZg#GS2jL@%uWRjV!sQPYmc^#o%N2l zH&YC+EUr^~xLZ87dt64ll2kvYxv#>29}eU2nDs2Ki&WbMWbWfgN%B9f1GP`f&jwqRtWm3^R7|LyF2v+pEFT8w0X|FVL3;ax{VW`5Ca2@uxN z!98Mka+=EEHIv=O)bp}@5qj=PU1(cStftj!5$NBM*PArBbaq#Jz+7KSIgkY!iuaBuZjO;^OzJ;eEd|3PSI6R0F|pYP}|xR z-qg|peGyVgo-T1e$lF4XGXMDf_>6gEW4l#m=O*B`IT#iT$bwhxGo2=Q?C$RF#wjVc zY3wKD#%E+_CXlXud_{~$V{vbWcN&qVNTw5qk)xti2u?i!Oh%w3#?310uY;E>jTYZXmaMUd4WDW5+(I zV|#l$0-e0KoV&JtQ6$&Iwa(p@0?eJ|f#(5g4|7j*D^_f0hAQWkf<5;e6aDt$nWDX( z!x2L}-5kid?(0~nv}%kFNz39i^VDN@_YF8TV)Domo-~g$WFKoDTX7`U%x0${8un@+ zH~6F%86(C^}TRx_<={?)re5XZqW3kDsb_;6}l9 zS52ue9jANuF@h&rx$8)|wTQAhDm}>a1||VX9%(@@mwX!Sdh)81^LQdD!p!RiJu+gr z+(h$Mi;dQLR#I9d=;qV~PK8|uI#R{g67}bj8(H%`e)D>3art;Ryh8VMcf5V_Yr*G( zKzFwVsswPIWcUhhuEqvh>6vzg;X=c>C0<)z~}qy{_9 zR9hTWOgM-4K`@+)hK0QqxR<&6>#uX5eX7yW1_b;uCr%DmGEB?qEOt9q$P*W+7AeXO z5(pNQd&>J!Hz>tc-L5ihEVLHl@wu9T`uw(&zKNEZD|6ra>fkM6u@k;dj3#AktCf@E8AS7;E$i4NrY7L zKz_WA74(#e_>(RWmvP45i5-uLd7)h(VK7C~LP&2Sb>g5?P0cuNI^7js9>&II0QVRN z_&woyl+G5{s%39-VA(netcFbFa7}KABt}J9-5m`3(}m46Z)_OPG;p)_ z2z_*bZL;U^R`R7KG4qYvC&&f-T>P`&-Wm*(sRYVb$;(x2BIZYTgKBBKraeMDI^l3U zf)v(Ww6F(;g*=|Z2(56ds8lPQ7wZ6fWsH7Kpun-+5BDuu7uRH>q!gxf$26R-$C= zlwx>i(_Cgyv84MIW-5F?@21upQ7VafvdV5J&S9OZuHd%TWn`AGKUCU^E2X5mwDbnHLY_i#E9H5dczlESl za~Fl{;OK0(sE)2d|IL?~XXjmU_Yc7M#cLv?q3JgI`gnJky?)vaHqVD)?Ots(TX}q- z-@Z<8@96Hau(D2z_@wOkaG&^Sscg23%4yne5o=Z-Y&0*ol^k4NLU$AG zHcDxzHmQzWOUlJ za$kUw>ayzBLnFJYHvl$ucA4U0J$X2lcN6)>R#CZxV+r!w26a96>neS2n^$_uh(nbpCjzkN%+~}W1UG%O#EdB(G03L-8{K6O5KiA zv*~-4zJ>kS(dgS%Q_6$v<@wp@Oo0;=#DXy!&Ie~pxZDndPS<6(yjOjHuQ3L*SVqz9 zh0&Y|N_|Lm=uYL3IV#7cM?ry7=i2^uCKTGM6i`w^CM{?nSh1uD1<%Rx`MHzJdoTM{ z%N&8qN9v!NDo}xPe zVZipnX7WyVX|3!;iOOF;KDawkMK{{C9q6?koNI5{gZ7_`fx&C&=s0!N*gNzHqyUVq zt99;8fQT(QZ;jsWL(~!^E&h#OdnZ=zkHyfw;kG$sd*m04gqH2rBk$vJF9hbaPZL1N=;pP ze*_UBefa*$d=FS06{*>vJ&O40xRo3#RU6D%2Z8lqk2zfp=g9MDp;fqiYknG{Ug*G? z&U%0bAmb6b)S{}H%D@eQ6=xm@mzS6eYad720ve+`Pjkp);xJL+47q&&b9ZmU>y?{#Z*hcjXmU+;b()e(@*L*rEn%X1cmo61e|!BO616g3 zR5;jdsOXh@xjMm16@(d8?*o9AtZw=Ar6>LNi1PDT5}{>Sm#ah)1>AIiUj=x1U9awb zllMYUS(oq&4eB7TTGo`m(v?6nNM&r$(*43p02;t#xEVutY@jUV+9Ck ztgTZcY_4hHZ?xPFS7^l>z0hCDNys0JFWaDVEKZ*9?+da5gmdP6{lo14uzDjvk?6)gVQ~-0~NF6)n{7tNZbfi%jh$V1$dlSfN1f+FMhQ@pQJadDMR4-d}qC z0o8FCQMSFm>JDig7#MJr&21`l)MIIC)_FbR(G^S+GV5uU+JpuN*A*1x)QL3<`?JH# z?|M(tyS7r5-h~JMGurZ$mAf))SZg_B2S_bS+HoUW%2KF;j}MAp?pXIOr#U0NgaaB+bGvwqw$+ zb@BxfX128g*Rrs%P|Zrcn}LC4dy}}?OU}*xb`&bb_atWHgitz^#=&o8$#*!}>3&D{ z?`8*AqWym5++NAf?(a#Tq=rt-+bT}6-By={dqw^A#tCP8SRAj!%SM}!HvLv7-73qA z{e-1R+ImyP!Ngj~$jwb)NJt2o3cQ8ejXIR0Qx(?7R*8&9&Rj7qsd-LI@0(%#Kq{@) ze`1Q>_c;glRvB9z^>p}??{Ayx6o`}Iy)OeT~zL%b~|Isj%q2d(!xrs zD?Zj;H3{lnU24FWQf&6dZrC$;?r{3{Mi<&4-QJ<~vQR!UKxyhhLXyUkv!#H-f2@UR z8groc2J>=z%Ia}9?%nU}L`MRSA#dG&+(+%CrKKTK3~Z<8nOi05D`cA|r#2oBs3(Ou5`zZF-QR zKit_|Ufc&A6iCw+U_uZJmB{1p@E|EFrCmu#O>%lBA8zdJubx|2aEirFb$dLR{wGJl zh>j+^^Z2tix;n<~b<}#hrBR=wrU+2jNSK>b00CKZa&m4S9=7g?VuM4Zc6qZSP#fo< zfnwIa*r@ymqbmY7Dz`C$ZDiD;wwk26dB*#mp}c^(yZi8Vr`zD*rd!5sT!$K<^}d~v zh-Il0AaDW57lsA9!;>E$+t$=$xvHB=w^l4BH@FtMrz#SMn09YGu9C|m)C9K=Os$SI zcAb~l9z>K49hqj=>}^=oI6ET>qKrbb%rHIzQV369PEt}WkMa1jF!4UOv7*=Lbhgkqsy~fuT&;|XTp}Rr zC5wf{>3p%h!~gLH6hN$WbelKZjrE*=C)22!wM9b<0a_!)(kAcVS+42AQfD8xt3L@} z3df_d)6_nAH3G}qhzPaS6$jDZ3-^Ib4`o2a26je^e8wiqSKeBg_I%gvF#vY&Gtem& zpy%jpXe_+60wpfmmIp6?(!BWT35PHF7xrt)Sw3NB^7BM}03@4@252 z;AFkiP`M{Oz0|pp-e!A-hq}5+r<2Xh7&4Vjt9p06fMKH5ZFpl|A6!e^NNeSHt|y&N z1DNLS4!D#gE~g-D$$(rA4&ijknWAUoS%U0(3h4^miv+YF3{>gP$mx^)75~q_Nq}hQ z5@s#elTSRJ%)?|I^@nqXZgXPcQ$%t*P#!$wK@yi=<+)wB9o;eHk&O`2gZ*7wdK;!4Yo>%Z z?wjp>sX`#!{$hq!ENwWL$GJZfYzznbZRXWL^+8UVxMC5wp!iwZY&cR$jx(Zwd&m&+w>e8uB>UR=Z3J54c4A#Eol5V{|pOamCx z*$$K~Gh?&XF@A!+#}H=44kg!vVUZ(_G%kY#nV^l7REkZP~Xj4{a8^@6Tz))IjPW z)F=MlY$Y{A2PLh8nf%#Ucb$G**S8ci%cnzxDpPv^hv%HJMNVJwq?C}cSug)8Xh3>#a9azJ_57d`o$x2ih@ z?pPVw(~^@}N+M54A}+6aT%}{*pUdL|H^)s39VXd)yldmtkWYQmm z(pmgS96e}S=Ta{$qZVeNVVtq>ctP~*)|D6pTqjPXkv!A$PX`w9Ps8ceqv6&j! z;V`Te}B&U75wPP{b0b(KvjdT_@KJL##N9EZH{B>n*Shg~B`s`j+kIzL=opWRgJ zI_7cn`AKm=*HTW3{?2!Dvdph1BFD*z%noes#5ObhOf61w-H=f$b z>!jl1pXrB!H4%fy=MX(izggGLep}7gtZi-a#D$3oR4G!*`^9~Y?6qw*kc({B<$4%iiX3EpBw_-jpAoljF0~f^6bmha|$c>+;XsPv~MeU^EtDQ4K?e%h}9XKE+p!t3>A4gg7 zda`)c)zyV8$6P%--^g&vB7DTWun6wy=_y@-H&q>hZMl##C;bu^tsT;y7SOcn%%i%O ze9O$mlpb}TwQYeDz}=T*QC)ADV(#ShfT-!X>Hf#`r+NR^!6i3!92XiYYKE!hf!A%8 z13;g&4eLP-c{&uwi9NF$)i~XW@nv&Zkx!gJgJe5W8@Tlh_-G07^%7tLkqja z@8x!D?-0-kv~{?aBZt}Sc4K|VBhsaQ|2OOX)iQ4(5>+&BhtG=*Vkx@RY{h(O2%NoA z(!As;dw2yMAe_s}>xo~EW`1~v_>Y;~Z8thrz@vNwq=kSK1mG_nsa37(C)wd)I_F%b z%5K+-oj(k(uca?UYo_--JkE7EMW`O=^8EYW-TbTT!XZI^gncpq^+>U&n}{zZW`@f= zp9;I(NjCp1eSt_HxLZyfy8QFo`&)N*LxYEWe5l!@dAx{aw6*I|VqF~r#=iM65!6>O zz>(f4+orXM$IZ0jC&+@&QZ{=69wfe)>6VR!MS!qb?@)qqRVg>(IqTCV~?T*3jqzjn$hxO6l}(7i-E+uJ%fT5sJ2dK%Uw1)#L>9|SxA}C>YZQ*#sE%FaxA9X49 zFiue9G59{;uG$knm+F7NJCZzhYi|7ZwI$t0P;qg;%IXy^r8IJOV-RrNnDY#fr%0Tf zoaB-rR*o|}^q^MtL7SSua&@4~Bi-FdYueO@brSplG4MaQycgaN&^Tvo&3v;$C*iaJ zu*y08)f8w>pfKUaWKAJ-adELy(Ft{1uDXp?=RZ8rYHw?jJ|b4Ki^=$rV$Up}imRb} z15A-`aAWA=GN+l5d5A^j@*Q+F(i%9^moq%|B}Y8|Fd1hP2DgeOM^Mn(k{%}zq{FpY zZ=*~6o2l>T6EYBT z|Mu@vTKb*zA6;*d>eu~PK6-!#4{P>LS)f*{Eou)ObTe=Jz9LO=V@WeJ_Xcd-ZPHpB zA%!^Tfl0EOtbqaHPiVdk3|JQ{bAPAZCox}l_gnpnKn5AMQJx(C;KiXTOZvzIah@K$ z)E_BZ7(1z@3%{=1He$+A{;1Mh7D(Q_!S=DvattV5bW<`Fb+m(af6)b?YD&e>dVRA~ja)T|NZ3!0C*L$s-cd)2q~a9U{{%Wvv6K3mM}iF@wHC z3tgb9Wt_GXZQ^9q^rs3+9YI%II77*YpV{i2IJ7M_c6-e_`r4E4Tt zQ0c7mdBNXi49r4Au@Z+=E5HD)8iY%3-c#!w%E&J?b~&9NU1w)!Q<@LloH2GF{7qU7 ze8+}`rG_&-?KDrXouN4No$KBjuk>NV!x>Q$C)u=wY|6!(kUMg482@Iab zcX~{+JfM0Q_|U`Z2sdNJoBNQbEtk2LH1HW)zNNj;t9LQVa4)Ub^@5nyq~>dhoS4w* zbZdQbEAkdzyl2r8cP3Un;<=oAR}9SV`lK6!cwaHbB#XMtP)-18aOYB_d^aaWZ}~>R zk7l#x@Rwqj(*%!yd{OTTsj3Cx^#Ik_{U>MlA1X)=Th#!wSzl0K^Y+$Y zAIAjLuv^8MO&3dp7ypRCbf2}`#qCkm!;NBQQC3m$zNhW4gN!=Vd2uFj|;i&4U?zNo92e_SkA3IRTdo^DpkjmL$)N${p97-kUDEX>y7Q=`#InUYRGTl1@+XezxgGb)1O!x~J7qT|161 z?#+tn*+$gVwB$c>|KYlE5A*L2^)zs~eN1*%j%On!M2Yo!S9m(o0cjlA8p`fCT&Au^ zG@Ef0^uTVjoXkgA*om!P8+MF)eYu&LMC`P=R2I}L=$BXNOxZjRmKu&aI+`{oBUKun z(1(D4XIcBy0|4Kn0#}EG$CvcpSr~pECBw7#v|G|pFz%R;Y#r$4TWyS*_MwcVi9o`Vh)0={tSD zJXZ(1z?s-EvsggzKqn@eJq#pDaj@6dOu;n(Dn~UvsHK-W-Awj|ouwsZlf3EYS9c=- zqY8*sbWN?T=tn2wh{98VTF1X?@vz{@;rV^g>E(J;&F81bLZ4t@V!|>8fO~y^4OqvF zYv$h3T1n^B5_+Nop04-L@R2_z)BC7eHW( z5Qlog;o_$KqpptXU%|Jzo|$EXfm_DIywK9u*B9`4a3?$pXw4pdSf~_riaA7c;iW@* zdw;qNQY=uD*4D;e0t-{Z!RA5j*4Fjq3!Yn4(pFbr1B!x-!I=l7jE zkzj`F%x@mph|w=zR#X0(A0@#u>B^r)`T4m|rJol&Z6$bGLBjIC^w)={sbH{}68uoK z;joT`0BxqHK@J^a)kFwM!iXQy-i1BbYEhv$EHHKz0;U8!D2)IP-d`w`>pogNCdTk! z(pL~?1yFloJsRkLz~zJl;`+Wo_vAXut^&%Ym>+_QMUDlt8@)fM`-c z4jAm|_=)hc?>K7oIBKG0A<@ym=ck4H-Ngq3$U+g%ei+3!EEq6!ZM70?Ku8s*yu9n0sX-Jf*&+DlvI zSJV5IDea^mV|X^I z9Eie^@|b5Clvm{kM~gai^i*3BDF4y;{gXmX^v44nF?#rNVMcgV-+|x=_-voBu@q-4G%0Q;ZXOKbPI=_-GvKc=<`+90TdYZCSdUn_D(o{b}O?-KaC%}mzTru33#9q z-1n#RAO;2mW><)DcZkB2Z~Ccy1k-DJ>9tpF!Afk1zO%|hd;kGdG(Q?V45Uv06vk!p zJdVM6eO_w;#R2mNQ4E;esCaVxR=>D4JvgQR7XM#v$-THROVZCo6Z3ZY+HM{K(r;do zpZsulqy!+OvO_0eaDROYR0#1erdy3UrZ6JbSd6)4Y<_862+%!bgl{Ks&VCs42*xzv zYgp-0%2O}qM2Tgvc^vLq(JMe`DeK|F|1h;?8r!VG^*?hg#YF$2WGj|6xk zutu1y-^%|2MMRUzGXlX%5cQMekF)KFqsN!@se7j1gZ3SYsi2^D_%RT z>=H=?FGA}57z{w`Fo13(<#^u@!uiCviiVk<2&v&!`|t%Q>;30f$S3Ve#sjb$7c6+^ zv1Wz_uJ$_9HP9&w(|Sw8^c+?4*98;Bjfo|md`}*Xm#QzSPPxM3L$43hH zkpX1hJc+`A1O|TCg%rvps6$};6nnLfk4vjF zAN|B=u!r)!Km$$VKez!o?M6AhTa3U(p@`$a>Vfn;0$C?DUx_qROV$ngpZgnr1I@h+ z**GzTMLc8W)CM)yYum$hG$JgvN&-?7^|A|fi@Tp>PXMR$FDi}Z7 z{kyG=!b=R!LHyV?+;-Fa=31oyO2HAc09*}(8t|VwM<;#MXm$W1pEO{ zF!v7+05KSg^p1ldpaQsgg)stX@zH3~*M%ZTEH@zWT0?^YL#RF~);6pr*&uu6a1bD< zzB(`}@eu(7)}i09jN$&Fzyul6B!lg$RrX{cd;|gzcSHJ!aKWzu&Tk@w<>EN=YN;T5 z^Wn(+?8DJrv-8J9fW` zf1b)rWg;Og_qC_`JyRqp0uIqfK@bV6IQmm3bRdWUG^j6#lerQMUr|&5lEtvQNFn^G zghJ#S^k;}8WKrCJM)#d0;P8xckp6XPHe@Mm@ zfh+JcFa}uqlzzPW7Jt_4x6{|o z6Y@vgFtN{%;x+mv{hA+K@PzV5ZN=T`NAJ(X6ZUf+>A%nc+j!WyB2fJ+SXpL%*!BFc zU!X@o9nJY)&Ll|Xb$7|Qi{A=g0$eOWg=V)IWXE0`?v4nDu9>j!hLp;V7{<(maFF=7 z$TQwU(9%STb;<{BeHjSkSn>%yN`L=y)9fQz?Kqyqz>e&I;esX+ovhqE5}x^#4!gPG zs(+6dmJk?CQ|JSwvxsP97D#QHly2IDrFh(z(Ki#HEA`D-2RB3Eye+deAu+qVWC6sQ3)Fmff*imZ}Y;jLtBcZeSi?tl{5b9iy z2rLTtNL`9neQs>=#E44Exm2F3+(?sNGTO~rz4DPvMN@h@_6Ofh%h&V=vy;+q9Qd{T zYc&(?r_##uv;OC2s?N5A2!42kqNIm~{Hm8|&Y1ZA!L<$5Ie$G}f6D*!M5%>?{&M%Tl zAqqm!QFDl2H01)2XkkGI8dR7Pe+8o8;lSI>X+l+fWWfjG-EsUO2w9;N81Zh1Fz*-y zNQ8_Hp_J#)v(YX9b~lP~%K7TM8=V4UcWMXKXFx(1-c5MxAv2rKp1_ZPAZv|qGUhe6g&MRmTN zsKU4)L3Dcx7_IG?h9f+201&MNI25Ik6o~N8fTfwOUX_7??2)}EGunAVmcftg zN9)UNiOrrtJO}jaVGb9U(>H>3^5@VubEN*y{40KdK$&dR&+_v38Xz@&k9o}-PE{%s z2f>mMU9_sC+|?kj!fpy_`^6+TKI){{(}GmrC9DY7pzq-Qka zxG9+#%#kd+%UiPcNu}*xvUUoP3b%YKw&Xa-n&1{KGEO5%$h&z1mSqeUVDr{x(r=i3 z(34Z%ajD>73Kt9lq0sV) z{47*tQ)CpIsc5vgk)!fZ&p%xzt3dW)pjMi%j_>-XYYN4r=htYWk|Ffj6ZEHD`~pR! zYT_jM<0QU02dvNHVdBhuev5BQz>N085&@n}7EwjxLuN9%dkgyKQ-G1%wgq=MA+n65vqCc;!+DiR3tWjSPvL6X2W zdys)+4`TR(goX;JPk$VRs{0wcD9~6`0m#Uw;C$??XyFu09t4o(MfC)mm+%`zFQpM? znfphR{Ec{Z7y%4SE=86Hi4GUW2`7;jJwExR_$9!^B1(b;J z5Q9@=!aOA7ReE`aeL$}$4rUrn$aEVo9mUOW2BR#HWmZ;brGX`xfF?TxFS9b(vCg62 z5x{~ZKxnY#)FpOAPeFFi3@5HQm}tzgam$MHF_4E)I59;;8hlpl9^X&C@I2G&L7q7o zVa%@oaMe>2*Twt9lyFJ@s`pBu^xuEMrb>#F*$39wlG9{gVbh#+_0gb?eo zO78cH2&I_clv=~GB&NQjGxIDnO%`KT#$V5&u@A;11I9wp41&R02s)J%+KUta(OX8- zN2N4<71J-5ko*SAP4Dn zLmbHu2_WR<=|Am)@E{qB0ub_mTo8#g9V(LX#*Wvd4>z&OHVvMF!eXaszV9^veZf#i z`j&tp4rha<(&Av4hld*rHvrgb7!V1W2MU!8X#6Vj2_KK<b0qBM_R?_W%Fn z|No`y_uv0weMiTME*^j}4oR8ubsVPrpdf&WH*rWHnS!NIK>`Y#ITyzQ@T)I_P3dYP z)L}fJ(MU`Bupoy|dN{+ITT`<+jQ4G(HDmoM=j0yse%$DXDN>pSo!*LB-U^|tN5%i|T|d$PR1%I6Ui<|M@Du&7 zqN$=a_4}VHYAS#9|G#nlmi{N8K{5qEGLnL{_kPC9T$n-w|ACJ^Ax&f&t_g!cyFIfh zpeGBadfeZ$0@J&gqQR%-?}H~27ZaL~O2RRpjK}HU`Fbd86FEj3D9&1o#N*^=Zv8*> z`ruF2KRp5V&(?pct4v-02rY#ApYQ+tE7xzVfBJhrSOWc9Y*-?JmOS@`qHJc&%gE_} zUjxwPiIHmb1*wd6|Knhr`OzE3U0NF@=FMN!3*YJZ|FQS2-EHH@g5UWouu^(sXH43% z^O*Hac2DADdVKm3uai#Bx#>PFh=e4>6u<^RIhs!HZ@&jG5`2lG9=0=Men?~zC={v+ zKvkhoaB}-FyXRkzvuf`heNE=?A+u?@(dUFR0sj0m2k`al^9OrZ=?H})R>ZOH06)vn zzH(l6b5zS%(7>nQ6Q@K@j?a64Do<@7OX%}fU%!6sfiGYLIePjS_!8ln9f2g=J7 z#}Pne4(5>QKux{L40R-EEB{Kg(9E+8nJxTmJE)x_B~Xr&QhiZ@5J`-cM}o^ADl?GO zdQG>T8p?%t208jirK<7-R*tZj+bE>bX@ZuYT5l?`2edOW0Q*g6*K@yOBb0{SS&=Wm zV@79o$iK4V2R&U@5@>m${y71%mT_x zN#m_lLr87<$AD1co6@U@T=TYFY4`pLEe1t7RD1SaC9%+6Ip)K3U$&orV`z>TM?c7y zr_X`;)08SonOn5X4}eiNh*a@)>J*_j z`4}aWcmWua-9#kPr?B9h;;2e(lXp5%$*)y@Oho3GQKG}9Rd8k&n;FrN7q0ovFBm_Z z(raJP!&Lcp1SFAfTJdEozEje3d>8kN$G^$5eExUBOb&k!A?J`p40c@%+WbGyo|NwY zK0ZEvcAx+0MxGAyzlqR6;LHj_enohmG8QtO0>6^td6gKZT*NYfP0k^k_$dprvO&B> zTVb`pjAC@TDW`)m^3IxM*0O^-BE!bOW>{yA5AGXmb-OnDt1dD%$O2RImh7P!$n(0C zNwNmumA3azb$=Vz$W@8!Sf8cP_ZnL!hhRWfj#U)knb5qI0O_(N2+`;lj@Si5WBhp~ zFjr_1=t?C>Hj>Yc@yo5EJbt;f}Ggg8-F)I$rilbqPkS z^rkTqu|_s~ZHVO#uIjh?u)@YG4Qr%umc{}nm2~J9ZcXH(8wyxDZq;^u?~C*^jxl5l zFiwe9lZ?w+C9}qpsj$8@%1Q@%md;(RBO$vlwRtwWg;}8$?Skhl$We4J*egZg<}mfp zDIcM+?(9;a!7`951KJkj&B)EW(vA0a@~UV0>ddfkR^Wo`18nAq?bs697o3T5a%+gN zu5)E?N_TsDMf1B8&E1*aDhQb>VA8MM`O)WgqJ`(>QC7#!;+NH8D?8}_GsrNEM%`UO zE&BhnC*}CRNeaTNms{8Vt$^Jb-QRY!QS(=)-!{|wZ5zAM`D;kp zN#nQm4LF#J>Do$v30A$z4_P?H0;#*+Rzb)qUWSy4X|w52f+J^QS)svfxTI7xm=4VO z)GM@F14qu!Hq5|*k($@7_1n#t<@GO765~*bNK<#JC8|(w$0RB z`4z!z*^IZH=)m_iP534#8yfHy>>W4X-RZQ;7%S*(J2c*RINS#5Za90jx6|bkF1z=} zm6oeJ<&EP=tl*5xXPq`ToGH12(ChL(N5ao?g>KRJW)Qjex~-~9Y|rbaG^^2848|4k zUdJ0?z<%3aH`9p@d|%h=)&ONwubTmT$GvVV`(~OHW^6Y8({Ku2W_xXQr z;6AS#_o&@FvqFc1(=uF%nRtWwHq&BJ%Kwp0v!+=9s{X?RO<=M zjN7cdYYVqSm70Tn%X1H1OB+tm#1bD+H2nN+bT z_Rf&V;Z!FvbJ>)OL(xl7(?ppeONiYycxb8gt;B)d1`;jr*%X?7N@JqUQL(?kqoImea&+R#7d zGV9xLkyUiQjx1=<8+YiZ*{=S-a*uX0d*nrb$u_myXAq?iSBK^jxdrYRODZa3F==aE zrD{piDB6`(sJ_J=%p|U|y53Y$RCm8&DX#6$_GUMi&>d&GGSn7OTb}RS){^z7yjtV+ z8y1(wKDCHUgGeN$VeZPqvT}FQA>G0MtBS6Z2(IP)?~~)lC*}Ch$0zsse{SUQ)^Pw| zN=evz_tW;{KedeA8P~5ur`hYPK5ypm)h+DC*IOZGCpWLIy`hJ<2xPf)w=vYS0OSfS zc#x>FO%a;1czt-IN`P8wuvhkyRe}A&Q3rTwUb=S+9^bTx>?Uz-mCiRi+p;doez+(Y zHKFL?ae|{tyjl{^<(6!Ag%-zTW5b<;xZKviB|oRa9PG@~wRD!)S_oIZ;A~;0T#E7< z0Sp@6=3!em9Ue9M>E5qQY2~FcOWY3auC3`F z%?orhn{^$RXLr{~`Zs<$*njRq*2xNN%m4cHME=o{QIQ*38*I0=LDt$TDqfRj zr!TyyrA=KIs+V7s*Z>k|-nYH1w{qW2&4ng{+C@oWO(q5uCeC6NEZ{6I@gh%9$isBib5X#V2 z+Gx@LkDeTt;{OLvj-TG||J=ya2NzJtnMz&eshKX99Rfxvjw3mXCosH%6T}0r58h2N z2Ruy@$^-{|isD#>M1UC-;S`g}0bnSG0?*B|nZJi5^7??Fi4LOO(=GxNtO)+segNK( zcmXI;H6=M7EF!~oeRR7u+ z)5)Ry$NtIZQX9+1|C7PfXQli^8alw2tSK2GdV%Nl`{3P=e|vT5dBfpQYSvza z5=0_ILX3>|F4xvm15d5*TbPA*ek0(FD#G4@jrS>dQ)(F>_OzL{zV4TLW z4wX~)I@(&Zg;tF~@1H1+DfmEH9Q8C3{XRG+BD)C8^VB4*6_JF|IgStq(9+yG_hi2k z#5lN~;&2K=NTdp+Ji#gsevV?A0D`U!Kg<3RgNsp*w^HMbBpR&ITnlb>BEQ-jCgA0a~ zFM(r$xaavUx`SYF{1?yH{XGc=!I7>aZCoVjAteHVF^yw-t*?(8#ri&1uC!Sz32+W^ ztiBn;&x~XvA}anNqzO`nVT8wHq?C4!!W`2+crhMhf(4d%evwGYRUAi%NCF@R+~*5; zg?PxYvJ%0{&lm9ebE0qCJ10ph+ADZp{N+#E_ia`C;(Y-_GvZ-JsesT31)Pq>5PSjp zqFw-jd;#PqL(_#ee{mhPzJQ?{eEW|#Z+gbfl3%m?^2KFO{`+6O{UKO}$rQ4vfQfu@ z)0iYQG9;Kbqv9Xd1)=R77)CEZzFM!x9s97@|nXGRK!-Y3p|*WLGTN2!<6DJ79VF z^2Hfoh|`pXs0*^4unbvLhvdpwo?X6LgOHu&()cf=!sMcAvE)Fo6vebsVV&9e60@ymH;B3e0Vz2P(qzJ5g!15E zy&?vZlec1 zd%E$#@Bnaxz{hi2?YF(YD#Iuh`&qOf7c5ojr~**afh3J%9pcG{wHpUMzDnP(Y6+$gdvmKg;0URlDkivcmbw|qnJ((kBf#mGc{1F*`oXr>+f`#&2+C?fAHY zuVbc)gF0J@%fs3PSS{y`U4biSL~At8(ix|o8Q5}4eVdNek&)hPk^OW{Go^XIF4X^R zuWtczbB?k`2j7PDRmgXR7DG@bpNXWqLW|W~-H3cy9xb4X*5^SN?CxgC9Nf&t{;F_^3`uneM^sBhXrMDg0{CMeLIWp_BOI_ zXVu%@_ID<^iPY1$khWF*r0Eo>@#S3PUw_-{J7pXEIZB$|B|16Pw)DC?tif$b^}54K zmMfDYiL>MxBtlHfqx{9QlQ8Pcf}9v3COnU)avjoXgDC3A@8XJ(9p}i7kpMoWX&eEK zfok~j4?xhq=<-kVJn9P17!GMC|6KvnHZ`4Mc{Ua!)|w$wkGH+Z2#;~ayThyHPrtA;-}L z!$bf~^mK};4mnq`a#lalN5wkJLW>e(duQINMtu9SxcgJ?M(I$HR#!zn7mOL5W&VyK zprcPH6ow&KaGiw`ifN~AToul#>c6@uVzu4)0WD-Fe#G1jsN!IZ85d3$B*rQ}6PmMD zk?AUBrmV3ImEx>a@)!_Gd|TS>MpePSLW@DMb4snQ>z0l+M_sRuL>*Xaa^CRRqf2+>F1+vNphoMK6cEZbe;_$?LJes(g^9GJ&BKU z$6;YMjya&j9Hd{+R1+ZO$X?=atR}murOC9T`KX0|b$9a&JM+)EooOp9tn$yfZRB=Y z=p+ul5iYjyuas{y+aKu0Kb7n5?>tTZ@4KJ=eklLnjE`0R=@f~#%Q~HV>;}i)3j7Np z=a57U7I@f|e`glTmS)f@|1vypnTHu3H^s-c_0QZSx#9Y!?=bz}3{C#F%SF)KJAKQG zpvK~67eQs#e}If&GHJKzSFqnVGO=5Y(iIHA&4O?oslGN;2^fuIOeXK(L}~zrSOAV_ zD$Ge-QvwJ$QImWYlsfDlr0Vti;BA6J3}b*51$j6{GsvBAXbCDm@ytxr)Tsx6SS09F z0>otE0TAWvI<=uzwz!kgNC($q4q_TYfg%q8^cl{Q7@dMh)e126Jm>IsOH-FwNhQd6 z_^%7u9P&OS6HGpPo`91!uo{kl6Bo=N7(5LIeuPFC5`S>yv!^GXm!xrgL1P@Y;;M)} zUI3`UUt|@toSVuy`tU`34Hx_&z~dYbNwbG4KcjefptEOkBvkS9@y}FTFvJlN4>dj} z04YZZG6okO09YWM0&6*@HiJ{V0Nf%?G!Q_?Ir^rZ!1E$BN*$_>bOzE21vJX`q>Y-D z)Fc+;D2Ax57Cg8-8;WiuV1sj~)fmlrxWsTAQCMA^iUgvbCJp;ND)NuMiN{X$xR zqFD4LnH!kg2M(8kOK`6bbk_|==5T%=I9rVQ05W-JTj^wzwd(S~*`N$uB1k%V9@o3v zXEEfwO$5K6Qm&JF

J!p2q16+3j+mARU17u@$kN-#Y+qGe4_*2ECp+BpzWd@#G*{ zNP>ns0|CcW&R+$Ldw$RJU>G9Kf1(j;L-&O$31&3P?>uS5yU@@jg3$+t1$v_x!12FY z8+(iYg*vqG*YC0CB~VP;;9i(aa-*D)Q2|nxgkqUEThY->?-$si>DmVlVM_$)14RLa zbYE>wIL&4CMI-*-$dKv$KVPeuWl4!6d;%O&bMR=6#kVM8h&5SIY1AyI>JB5MmOp)b{iZJ74YRDoi+`ooa>b>v#^*K%qRn|{%0!+BKUWj0ltX@^K@J#~$ zNKuw3CFjPUe>z+6M!)|8Mo%9j5@yNOzkc-!osN;>Fvy zAKqNP@^W2rZubgLJy*rlq*Rv}jEi5Ekjo9!%#sl{1qqe|155cYi%njk#nKk9oa~3I zHfZ-Ojh9@tD(UC--PD+htfdiE9Qrue^@HIV!p?60}t#_|6PJ8<$!F? zW9en%4t-826TkuU{K4K;Izpj{Rb`tOR)s9^1coR(^N>pe@G1DjDUs+s@BJCbIWKVJ z@M}*_aFC;?kAd$;D5MeE_v#2SSc?z?mk@*P5MrwRQHQ8kE<|s#w|ceyx0%G z$A2P*mZ!$EDe@8X{Nu21O8W{q-$;22HnPEYMPbsh>xs67t>*nm5mv4Jk5q=uJQW*d zCb%(9rf`G=4%L8C>h6@z=mZfYIe!fo1@Ed&*ybdElOlE|1vNrUFMc{RL7tL84HBG* zkru9V<90Aww9PP3Dyw6>oTz$r6hRAu&1GlC&4Gfaqc_Pz0mgFrf@A?O=PBZ=H>ve? zGm4Cy@(>ZoFwN2iX-1jwP`7qO5tq%|3CoT~NEVWhIU0E{^x??jSaZ9k$BaaqFT=Y? z46~jvG)Bx$Qy=MgjFq2J6^m$?N-IZkZTZ-lAOAi-`F(~bn#G6x?5Ce{TM Chart packaged by Bitnami + +[RedisTM](http://redis.io/) is an advanced key-value cache and store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets, sorted sets, bitmaps and hyperloglogs. + +Disclaimer: REDIS® is a registered trademark of Redis Labs Ltd.Any rights therein are reserved to Redis Labs Ltd. Any use by Bitnami is for referential purposes only and does not indicate any sponsorship, endorsement, or affiliation between Redis Labs Ltd. + +## TL;DR + +```bash +$ helm repo add bitnami https://charts.bitnami.com/bitnami +$ helm install my-release bitnami/redis +``` + +## Introduction + +This chart bootstraps a [RedisTM](https://github.com/bitnami/bitnami-docker-redis) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment and management of Helm Charts in clusters. This chart has been tested to work with NGINX Ingress, cert-manager, fluentd and Prometheus on top of the [BKPR](https://kubeprod.io/). + +### Choose between RedisTM Helm Chart and RedisTM Cluster Helm Chart + +You can choose any of the two RedisTM Helm charts for deploying a RedisTM cluster. +While [RedisTM Helm Chart](https://github.com/bitnami/charts/tree/master/bitnami/redis) will deploy a master-slave cluster using RedisTM Sentinel, the [RedisTM Cluster Helm Chart](https://github.com/bitnami/charts/tree/master/bitnami/redis-cluster) will deploy a RedisTM Cluster topology with sharding. +The main features of each chart are the following: + +| RedisTM | RedisTM Cluster | +|--------------------------------------------------------|------------------------------------------------------------------------| +| Supports multiple databases | Supports only one database. Better if you have a big dataset | +| Single write point (single master) | Multiple write points (multiple masters) | +| ![RedisTM Topology](img/redis-topology.png) | ![RedisTM Cluster Topology](img/redis-cluster-topology.png) | + +## Prerequisites + +- Kubernetes 1.12+ +- Helm 3.1.0 +- PV provisioner support in the underlying infrastructure + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```bash +$ helm install my-release bitnami/redis +``` + +The command deploys RedisTM on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```bash +$ helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Parameters + +The following table lists the configurable parameters of the RedisTM chart and their default values. + +| Parameter | Description | Default | +|:------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------|:--------------------------------------------------------| +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `global.storageClass` | Global storage class for dynamic provisioning | `nil` | +| `global.redis.password` | RedisTM password (overrides `password`) | `nil` | +| `image.registry` | RedisTM Image registry | `docker.io` | +| `image.repository` | RedisTM Image name | `bitnami/redis` | +| `image.tag` | RedisTM Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | +| `nameOverride` | String to partially override redis.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override redis.fullname template with a string | `nil` | +| `cluster.enabled` | Use master-slave topology | `true` | +| `cluster.slaveCount` | Number of slaves | `2` | +| `existingSecret` | Name of existing secret object (for password authentication) | `nil` | +| `existingSecretPasswordKey` | Name of key containing password to be retrieved from the existing secret | `nil` | +| `usePassword` | Use password | `true` | +| `usePasswordFile` | Mount passwords as files instead of environment variables | `false` | +| `password` | RedisTM password (ignored if existingSecret set) | Randomly generated | +| `configmap` | Additional common RedisTM node configuration (this value is evaluated as a template) | See values.yaml | +| `clusterDomain` | Kubernetes DNS Domain name to use | `cluster.local` | +| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | +| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | +| `networkPolicy.ingressNSMatchLabels` | Allow connections from other namespaces | `{}` | +| `networkPolicy.ingressNSPodMatchLabels` | For other namespaces match by pod labels and namespace labels | `{}` | +| `securityContext.*` | Other pod security context to be included as-is in the pod spec | `{}` | +| `securityContext.enabled` | Enable security context (both redis master and slave pods) | `true` | +| `securityContext.fsGroup` | Group ID for the container (both redis master and slave pods) | `1001` | +| `containerSecurityContext.*` | Other container security context to be included as-is in the container spec | `{}` | +| `containerSecurityContext.enabled` | Enable security context (both redis master and slave containers) | `true` | +| `containerSecurityContext.runAsUser` | User ID for the container (both redis master and slave containers) | `1001` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | +| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the fullname template | +| `serviceAccount.annotations` | Specifies annotations to add to ServiceAccount. | `nil` | +| `rbac.create` | Specifies whether RBAC resources should be created | `false` | +| `rbac.role.rules` | Rules to create | `[]` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | RedisTM exporter image registry | `docker.io` | +| `metrics.image.repository` | RedisTM exporter image name | `bitnami/redis-exporter` | +| `metrics.image.tag` | RedisTM exporter image tag | `{TAG_NAME}` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | +| `metrics.extraArgs` | Extra arguments for the binary; possible values [here](https://github.com/oliver006/redis_exporter#flags) | {} | +| `metrics.podLabels` | Additional labels for Metrics exporter pod | {} | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | {} | +| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | +| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | +| `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `nil` | +| `metrics.serviceMonitor.interval` | How frequently to scrape metrics (use by default, falling back to Prometheus' default) | `nil` | +| `metrics.serviceMonitor.selector` | Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install | `{ prometheus: kube-prometheus }` | +| `metrics.serviceMonitor.relabelings` | ServiceMonitor relabelings. Value is evaluated as a template | `[]` | +| `metrics.serviceMonitor.metricRelabelings` | ServiceMonitor metricRelabelings. Value is evaluated as a template | `[]` | +| `metrics.service.type` | Kubernetes Service type (redis metrics) | `ClusterIP` | +| `metrics.service.externalTrafficPolicy` | External traffic policy (when service type is LoadBalancer) | `Cluster` | +| `metrics.service.annotations` | Annotations for the services to monitor (redis master and redis slave service) | {} | +| `metrics.service.labels` | Additional labels for the metrics service | {} | +| `metrics.service.loadBalancerIP` | loadBalancerIP if redis metrics service type is `LoadBalancer` | `nil` | +| `metrics.priorityClassName` | Metrics exporter pod priorityClassName | `nil` | +| `metrics.prometheusRule.enabled` | Set this to true to create prometheusRules for Prometheus operator | `false` | +| `metrics.prometheusRule.additionalLabels` | Additional labels that can be used so prometheusRules will be discovered by Prometheus | `{}` | +| `metrics.prometheusRule.namespace` | namespace where prometheusRules resource should be created | Same namespace as redis | +| `metrics.prometheusRule.rules` | [rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) to be created, check values for an example. | `[]` | +| `persistence.existingClaim` | Provide an existing PersistentVolumeClaim | `nil` | +| `master.persistence.enabled` | Use a PVC to persist data (master node) | `true` | +| `master.hostAliases` | Add deployment host aliases | `[]` | +| `master.persistence.path` | Path to mount the volume at, to use other images | `/data` | +| `master.persistence.subPath` | Subdirectory of the volume to mount at | `""` | +| `master.persistence.storageClass` | Storage class of backing PVC | `generic` | +| `master.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | +| `master.persistence.size` | Size of data volume | `8Gi` | +| `master.persistence.matchLabels` | matchLabels persistent volume selector | `{}` | +| `master.persistence.matchExpressions` | matchExpressions persistent volume selector | `{}` | +| `master.persistence.volumes` | Additional volumes without creating PVC | `{}` | +| `master.statefulset.labels` | Additional labels for redis master StatefulSet | `{}` | +| `master.statefulset.annotations` | Additional annotations for redis master StatefulSet | `{}` | +| `master.statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | +| `master.statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | +| `master.statefulset.volumeClaimTemplates.labels` | Additional labels for redis master StatefulSet volumeClaimTemplates | `{}` | +| `master.statefulset.volumeClaimTemplates.annotations` | Additional annotations for redis master StatefulSet volumeClaimTemplates | `{}` | +| `master.podLabels` | Additional labels for RedisTM master pod | {} | +| `master.podAnnotations` | Additional annotations for RedisTM master pod | {} | +| `master.extraEnvVars` | Additional Environment Variables passed to the pod of the master's stateful set set | `[]` | +| `master.extraEnvVarCMs` | Additional Environment Variables ConfigMappassed to the pod of the master's stateful set set | `[]` | +| `master.extraEnvVarsSecret` | Additional Environment Variables Secret passed to the master's stateful set | `[]` | +| `podDisruptionBudget.enabled` | Pod Disruption Budget toggle | `false` | +| `podDisruptionBudget.minAvailable` | Minimum available pods | `1` | +| `podDisruptionBudget.maxUnavailable` | Maximum unavailable | `nil` | +| `redisPort` | RedisTM port (in both master and slaves) | `6379` | +| `tls.enabled` | Enable TLS support for replication traffic | `false` | +| `tls.authClients` | Require clients to authenticate or not | `true` | +| `tls.certificatesSecret` | Name of the secret that contains the certificates | `nil` | +| `tls.certFilename` | Certificate filename | `nil` | +| `tls.certKeyFilename` | Certificate key filename | `nil` | +| `tls.certCAFilename` | CA Certificate filename | `nil` | +| `tls.dhParamsFilename` | DH params (in order to support DH based ciphers) | `nil` | +| `master.command` | RedisTM master entrypoint string. The command `redis-server` is executed if this is not provided. Note this is prepended with `exec` | `/run.sh` | +| `master.preExecCmds` | Text to inset into the startup script immediately prior to `master.command`. Use this if you need to run other ad-hoc commands as part of startup | `nil` | +| `master.configmap` | Additional RedisTM configuration for the master nodes (this value is evaluated as a template) | `nil` | +| `master.disableCommands` | Array of RedisTM commands to disable (master) | `["FLUSHDB", "FLUSHALL"]` | +| `master.extraFlags` | RedisTM master additional command line flags | [] | +| `master.nodeSelector` | RedisTM master Node labels for pod assignment | {"beta.kubernetes.io/arch": "amd64"} | +| `master.tolerations` | Toleration labels for RedisTM master pod assignment | [] | +| `master.affinity` | Affinity settings for RedisTM master pod assignment | {} | +| `master.schedulerName` | Name of an alternate scheduler | `nil` | +| `master.service.type` | Kubernetes Service type (redis master) | `ClusterIP` | +| `master.service.externalTrafficPolicy` | External traffic policy (when service type is LoadBalancer) | `Cluster` | +| `master.service.port` | Kubernetes Service port (redis master) | `6379` | +| `master.service.nodePort` | Kubernetes Service nodePort (redis master) | `nil` | +| `master.service.annotations` | annotations for redis master service | {} | +| `master.service.labels` | Additional labels for redis master service | {} | +| `master.service.loadBalancerIP` | loadBalancerIP if redis master service type is `LoadBalancer` | `nil` | +| `master.service.loadBalancerSourceRanges` | loadBalancerSourceRanges if redis master service type is `LoadBalancer` | `nil` | +| `master.resources` | RedisTM master CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `100m` | +| `master.livenessProbe.enabled` | Turn on and off liveness probe (redis master pod) | `true` | +| `master.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis master pod) | `5` | +| `master.livenessProbe.periodSeconds` | How often to perform the probe (redis master pod) | `5` | +| `master.livenessProbe.timeoutSeconds` | When the probe times out (redis master pod) | `5` | +| `master.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis master pod) | `1` | +| `master.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `master.readinessProbe.enabled` | Turn on and off readiness probe (redis master pod) | `true` | +| `master.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (redis master pod) | `5` | +| `master.readinessProbe.periodSeconds` | How often to perform the probe (redis master pod) | `5` | +| `master.readinessProbe.timeoutSeconds` | When the probe times out (redis master pod) | `1` | +| `master.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis master pod) | `1` | +| `master.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `master.shareProcessNamespace` | RedisTM Master pod `shareProcessNamespace` option. Enables /pause reap zombie PIDs. | `false` | +| `master.priorityClassName` | RedisTM Master pod priorityClassName | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the registry (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/bitnami-shell` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `"10"` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources ` | Init container volume-permissions CPU/Memory resource requests/limits | {} | +| `volumePermissions.securityContext.*` | Security context of the init container | `{}` | +| `volumePermissions.securityContext.runAsUser` | UserID for the init container (when facing issues in OpenShift or uid unknown, try value "auto") | 0 | +| `slave.hostAliases` | Add deployment host aliases | `[]` | +| `slave.service.type` | Kubernetes Service type (redis slave) | `ClusterIP` | +| `slave.service.externalTrafficPolicy` | External traffic policy (when service type is LoadBalancer) | `Cluster` | +| `slave.service.nodePort` | Kubernetes Service nodePort (redis slave) | `nil` | +| `slave.service.annotations` | annotations for redis slave service | {} | +| `slave.service.labels` | Additional labels for redis slave service | {} | +| `slave.service.port` | Kubernetes Service port (redis slave) | `6379` | +| `slave.service.loadBalancerIP` | LoadBalancerIP if RedisTM slave service type is `LoadBalancer` | `nil` | +| `slave.service.loadBalancerSourceRanges` | loadBalancerSourceRanges if RedisTM slave service type is `LoadBalancer` | `nil` | +| `slave.command` | RedisTM slave entrypoint string. The command `redis-server` is executed if this is not provided. Note this is prepended with `exec` | `/run.sh` | +| `slave.preExecCmds` | Text to inset into the startup script immediately prior to `slave.command`. Use this if you need to run other ad-hoc commands as part of startup | `nil` | +| `slave.configmap` | Additional RedisTM configuration for the slave nodes (this value is evaluated as a template) | `nil` | +| `slave.disableCommands` | Array of RedisTM commands to disable (slave) | `[FLUSHDB, FLUSHALL]` | +| `slave.extraFlags` | RedisTM slave additional command line flags | `[]` | +| `slave.livenessProbe.enabled` | Turn on and off liveness probe (redis slave pod) | `true` | +| `slave.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis slave pod) | `5` | +| `slave.livenessProbe.periodSeconds` | How often to perform the probe (redis slave pod) | `5` | +| `slave.livenessProbe.timeoutSeconds` | When the probe times out (redis slave pod) | `5` | +| `slave.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis slave pod) | `1` | +| `slave.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `slave.readinessProbe.enabled` | Turn on and off slave.readiness probe (redis slave pod) | `true` | +| `slave.readinessProbe.initialDelaySeconds` | Delay before slave.readiness probe is initiated (redis slave pod) | `5` | +| `slave.readinessProbe.periodSeconds` | How often to perform the probe (redis slave pod) | `5` | +| `slave.readinessProbe.timeoutSeconds` | When the probe times out (redis slave pod) | `1` | +| `slave.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis slave pod) | `1` | +| `slave.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. (redis slave pod) | `5` | +| `slave.shareProcessNamespace` | RedisTM slave pod `shareProcessNamespace` option. Enables /pause reap zombie PIDs. | `false` | +| `slave.persistence.enabled` | Use a PVC to persist data (slave node) | `true` | +| `slave.persistence.path` | Path to mount the volume at, to use other images | `/data` | +| `slave.persistence.subPath` | Subdirectory of the volume to mount at | `""` | +| `slave.persistence.storageClass` | Storage class of backing PVC | `generic` | +| `slave.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | +| `slave.persistence.size` | Size of data volume | `8Gi` | +| `slave.persistence.matchLabels` | matchLabels persistent volume selector | `{}` | +| `slave.persistence.matchExpressions` | matchExpressions persistent volume selector | `{}` | +| `slave.statefulset.labels` | Additional labels for redis slave StatefulSet | `{}` | +| `slave.statefulset.annotations` | Additional annotations for redis slave StatefulSet | `{}` | +| `slave.statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | +| `slave.statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | +| `slave.statefulset.volumeClaimTemplates.labels` | Additional labels for redis slave StatefulSet volumeClaimTemplates | `{}` | +| `slave.statefulset.volumeClaimTemplates.annotations` | Additional annotations for redis slave StatefulSet volumeClaimTemplates | `{}` | +| `slave.extraEnvVars` | Additional Environment Variables passed to the pod of the slave's stateful set set | `[]` | +| `slave.extraEnvVarCMs` | Additional Environment Variables ConfigMappassed to the pod of the slave's stateful set set | `[]` | +| `masslaveter.extraEnvVarsSecret` | Additional Environment Variables Secret passed to the slave's stateful set | `[]` | +| `slave.podLabels` | Additional labels for RedisTM slave pod | `master.podLabels` | +| `slave.podAnnotations` | Additional annotations for RedisTM slave pod | `master.podAnnotations` | +| `slave.schedulerName` | Name of an alternate scheduler | `nil` | +| `slave.resources` | RedisTM slave CPU/Memory resource requests/limits | `{}` | +| `slave.affinity` | Enable node/pod affinity for slaves | {} | +| `slave.tolerations` | Toleration labels for RedisTM slave pod assignment | [] | +| `slave.spreadConstraints` | [Topology Spread Constraints](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/) for RedisTM slave pod | {} | +| `slave.priorityClassName` | RedisTM Slave pod priorityClassName | `nil` | +| `sentinel.enabled` | Enable sentinel containers | `false` | +| `sentinel.usePassword` | Use password for sentinel containers | `true` | +| `sentinel.masterSet` | Name of the sentinel master set | `mymaster` | +| `sentinel.initialCheckTimeout` | Timeout for querying the redis sentinel service for the active sentinel list | `5` | +| `sentinel.quorum` | Quorum for electing a new master | `2` | +| `sentinel.downAfterMilliseconds` | Timeout for detecting a RedisTM node is down | `60000` | +| `sentinel.failoverTimeout` | Timeout for performing a election failover | `18000` | +| `sentinel.parallelSyncs` | Number of parallel syncs in the cluster | `1` | +| `sentinel.port` | RedisTM Sentinel port | `26379` | +| `sentinel.cleanDelaySeconds` | Delay seconds before issuing the the cleaning in the next node | `5` | +| `sentinel.configmap` | Additional RedisTM configuration for the sentinel nodes (this value is evaluated as a template) | `nil` | +| `sentinel.staticID` | Enable static IDs for sentinel replicas (If disabled IDs will be randomly generated on startup) | `false` | +| `sentinel.service.type` | Kubernetes Service type (redis sentinel) | `ClusterIP` | +| `sentinel.service.externalTrafficPolicy` | External traffic policy (when service type is LoadBalancer) | `Cluster` | +| `sentinel.service.nodePort` | Kubernetes Service nodePort (redis sentinel) | `nil` | +| `sentinel.service.annotations` | annotations for redis sentinel service | {} | +| `sentinel.service.labels` | Additional labels for redis sentinel service | {} | +| `sentinel.service.redisPort` | Kubernetes Service port for RedisTM read only operations | `6379` | +| `sentinel.service.sentinelPort` | Kubernetes Service port for RedisTM sentinel | `26379` | +| `sentinel.service.redisNodePort` | Kubernetes Service node port for RedisTM read only operations | `` | +| `sentinel.service.sentinelNodePort` | Kubernetes Service node port for RedisTM sentinel | `` | +| `sentinel.service.loadBalancerIP` | LoadBalancerIP if RedisTM sentinel service type is `LoadBalancer` | `nil` | +| `sentinel.livenessProbe.enabled` | Turn on and off liveness probe (redis sentinel pod) | `true` | +| `sentinel.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis sentinel pod) | `5` | +| `sentinel.livenessProbe.periodSeconds` | How often to perform the probe (redis sentinel container) | `5` | +| `sentinel.livenessProbe.timeoutSeconds` | When the probe times out (redis sentinel container) | `5` | +| `sentinel.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis sentinel container) | `1` | +| `sentinel.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `sentinel.readinessProbe.enabled` | Turn on and off sentinel.readiness probe (redis sentinel pod) | `true` | +| `sentinel.readinessProbe.initialDelaySeconds` | Delay before sentinel.readiness probe is initiated (redis sentinel pod) | `5` | +| `sentinel.readinessProbe.periodSeconds` | How often to perform the probe (redis sentinel pod) | `5` | +| `sentinel.readinessProbe.timeoutSeconds` | When the probe times out (redis sentinel container) | `1` | +| `sentinel.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis sentinel container) | `1` | +| `sentinel.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. (redis sentinel container) | `5` | +| `sentinel.resources` | RedisTM sentinel CPU/Memory resource requests/limits | `{}` | +| `sentinel.image.registry` | RedisTM Sentinel Image registry | `docker.io` | +| `sentinel.image.repository` | RedisTM Sentinel Image name | `bitnami/redis-sentinel` | +| `sentinel.image.tag` | RedisTM Sentinel Image tag | `{TAG_NAME}` | +| `sentinel.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `sentinel.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | +| `sentinel.extraEnvVars` | Additional Environment Variables passed to the pod of the sentinel node stateful set set | `[]` | +| `sentinel.extraEnvVarCMs` | Additional Environment Variables ConfigMappassed to the pod of the sentinel node stateful set set | `[]` | +| `sentinel.extraEnvVarsSecret` | Additional Environment Variables Secret passed to the sentinel node statefulset | `[]` | +| `sentinel.preExecCmds` | Text to inset into the startup script immediately prior to `sentinel.command`. Use this if you need to run other ad-hoc commands as part of startup | `nil` | +| `sysctlImage.enabled` | Enable an init container to modify Kernel settings | `false` | +| `sysctlImage.command` | sysctlImage command to execute | [] | +| `sysctlImage.registry` | sysctlImage Init container registry | `docker.io` | +| `sysctlImage.repository` | sysctlImage Init container name | `bitnami/bitnami-shell` | +| `sysctlImage.tag` | sysctlImage Init container tag | `"10"` | +| `sysctlImage.pullPolicy` | sysctlImage Init container pull policy | `Always` | +| `sysctlImage.mountHostSys` | Mount the host `/sys` folder to `/host-sys` | `false` | +| `sysctlImage.resources` | sysctlImage Init container CPU/Memory resource requests/limits | {} | +| `podSecurityPolicy.create` | Specifies whether a PodSecurityPolicy should be created | `false` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```bash +$ helm install my-release \ + --set password=secretpassword \ + bitnami/redis +``` + +The above command sets the RedisTM server password to `secretpassword`. + +> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```bash +$ helm install my-release -f values.yaml bitnami/redis +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + +> **Note for minikube users**: Current versions of minikube (v0.24.1 at the time of writing) provision `hostPath` persistent volumes that are only writable by root. Using chart defaults cause pod failure for the RedisTM pod as it attempts to write to the `/bitnami` directory. Consider installing RedisTM with `--set persistence.enabled=false`. See minikube issue [1990](https://github.com/kubernetes/minikube/issues/1990) for more information. + +## Configuration and installation details + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Change RedisTM version + +To modify the RedisTM version used in this chart you can specify a [valid image tag](https://hub.docker.com/r/bitnami/redis/tags/) using the `image.tag` parameter. For example, `image.tag=X.Y.Z`. This approach is also applicable to other images like exporters. + +### Cluster topologies + +#### Default: Master-Slave + +When installing the chart with `cluster.enabled=true`, it will deploy a RedisTM master StatefulSet (only one master node allowed) and a RedisTM slave StatefulSet. The slaves will be read-replicas of the master. Two services will be exposed: + + - RedisTM Master service: Points to the master, where read-write operations can be performed + - RedisTM Slave service: Points to the slaves, where only read operations are allowed. + +In case the master crashes, the slaves will wait until the master node is respawned again by the Kubernetes Controller Manager. + +#### Master-Slave with Sentinel + +When installing the chart with `cluster.enabled=true` and `sentinel.enabled=true`, it will deploy a RedisTM master StatefulSet (only one master allowed) and a RedisTM slave StatefulSet. In this case, the pods will contain an extra container with RedisTM Sentinel. This container will form a cluster of RedisTM Sentinel nodes, which will promote a new master in case the actual one fails. In addition to this, only one service is exposed: + + - RedisTM service: Exposes port 6379 for RedisTM read-only operations and port 26379 for accessing RedisTM Sentinel. + +For read-only operations, access the service using port 6379. For write operations, it's necessary to access the RedisTM Sentinel cluster and query the current master using the command below (using redis-cli or similar: + +``` +SENTINEL get-master-addr-by-name +``` +This command will return the address of the current master, which can be accessed from inside the cluster. + +In case the current master crashes, the Sentinel containers will elect a new master node. + +### Using password file +To use a password file for RedisTM you need to create a secret containing the password. + +> *NOTE*: It is important that the file with the password must be called `redis-password` + +And then deploy the Helm Chart using the secret name as parameter: + +```console +usePassword=true +usePasswordFile=true +existingSecret=redis-password-file +sentinels.enabled=true +metrics.enabled=true +``` + +### Securing traffic using TLS + +TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the chart: + +- `tls.enabled`: Enable TLS support. Defaults to `false` +- `tls.certificatesSecret`: Name of the secret that contains the certificates. No defaults. +- `tls.certFilename`: Certificate filename. No defaults. +- `tls.certKeyFilename`: Certificate key filename. No defaults. +- `tls.certCAFilename`: CA Certificate filename. No defaults. + +For example: + +First, create the secret with the cetificates files: + +```console +kubectl create secret generic certificates-tls-secret --from-file=./cert.pem --from-file=./cert.key --from-file=./ca.pem +``` + +Then, use the following parameters: + +```console +tls.enabled="true" +tls.certificatesSecret="certificates-tls-secret" +tls.certFilename="cert.pem" +tls.certKeyFilename="cert.key" +tls.certCAFilename="ca.pem" +``` + +### Metrics + +The chart optionally can start a metrics exporter for [prometheus](https://prometheus.io). The metrics endpoint (port 9121) is exposed in the service. Metrics can be scraped from within the cluster using something similar as the described in the [example Prometheus scrape configuration](https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml). If metrics are to be scraped from outside the cluster, the Kubernetes API proxy can be utilized to access the endpoint. + +If you have enabled TLS by specifying `tls.enabled=true` you also need to specify TLS option to the metrics exporter. You can do that via `metrics.extraArgs`. You can find the metrics exporter CLI flags for TLS [here](https://github.com/oliver006/redis_exporter#command-line-flags). For example: + +You can either specify `metrics.extraArgs.skip-tls-verification=true` to skip TLS verification or providing the following values under `metrics.extraArgs` for TLS client authentication: + +```console +tls-client-key-file +tls-client-cert-file +tls-ca-cert-file +``` + +### Host Kernel Settings + +RedisTM may require some changes in the kernel of the host machine to work as expected, in particular increasing the `somaxconn` value and disabling transparent huge pages. +To do so, you can set up a privileged initContainer with the `sysctlImage` config values, for example: + +``` +sysctlImage: + enabled: true + mountHostSys: true + command: + - /bin/sh + - -c + - |- + sysctl -w net.core.somaxconn=10000 + echo never > /host-sys/kernel/mm/transparent_hugepage/enabled +``` + +Alternatively, for Kubernetes 1.12+ you can set `securityContext.sysctls` which will configure sysctls for master and slave pods. Example: + +```yaml +securityContext: + sysctls: + - name: net.core.somaxconn + value: "10000" +``` + +Note that this will not disable transparent huge tables. + +## Persistence + +By default, the chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at the `/data` path. The volume is created using dynamic volume provisioning. If a Persistent Volume Claim already exists, specify it during installation. + +### Existing PersistentVolumeClaim + +1. Create the PersistentVolume +2. Create the PersistentVolumeClaim +3. Install the chart + +```bash +$ helm install my-release --set persistence.existingClaim=PVC_NAME bitnami/redis +``` + +## Backup and restore + +### Backup + +To perform a backup you will need to connect to one of the nodes and execute: + +```bash +$ kubectl exec -it my-redis-master-0 bash + +$ redis-cli +127.0.0.1:6379> auth your_current_redis_password +OK +127.0.0.1:6379> save +OK +``` + +Then you will need to get the created dump file form the redis node: + +```bash +$ kubectl cp my-redis-master-0:/data/dump.rdb dump.rdb -c redis +``` + +### Restore + +To restore in a new cluster, you will need to change a parameter in the redis.conf file and then upload the `dump.rdb` to the volume. + +Follow the following steps: + +- First you will need to set in the `values.yaml` the parameter `appendonly` to `no`, if it is already `no` you can skip this step. + +```yaml +configmap: |- + # Enable AOF https://redis.io/topics/persistence#append-only-file + appendonly no + # Disable RDB persistence, AOF persistence already enabled. + save "" +``` + +- Start the new cluster to create the PVCs. + +For example, : + +```bash +helm install new-redis -f values.yaml . --set cluster.enabled=true --set cluster.slaveCount=3 +``` + +- Now that the PVC were created, stop it and copy the `dump.rdp` on the persisted data by using a helping pod. + +``` +$ helm delete new-redis + +$ kubectl run --generator=run-pod/v1 -i --rm --tty volpod --overrides=' +{ + "apiVersion": "v1", + "kind": "Pod", + "metadata": { + "name": "redisvolpod" + }, + "spec": { + "containers": [{ + "command": [ + "tail", + "-f", + "/dev/null" + ], + "image": "bitnami/minideb", + "name": "mycontainer", + "volumeMounts": [{ + "mountPath": "/mnt", + "name": "redisdata" + }] + }], + "restartPolicy": "Never", + "volumes": [{ + "name": "redisdata", + "persistentVolumeClaim": { + "claimName": "redis-data-new-redis-master-0" + } + }] + } +}' --image="bitnami/minideb" + +$ kubectl cp dump.rdb redisvolpod:/mnt/dump.rdb +$ kubectl delete pod volpod +``` + +- Start again the cluster: + +``` +helm install new-redis -f values.yaml . --set cluster.enabled=true --set cluster.slaveCount=3 +``` + +## NetworkPolicy + +To enable network policy for RedisTM, install +[a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), +and set `networkPolicy.enabled` to `true`. + +For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting +the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: + + kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" + +With NetworkPolicy enabled, only pods with the generated client label will be +able to connect to RedisTM. This label will be displayed in the output +after a successful install. + +With `networkPolicy.ingressNSMatchLabels` pods from other namespaces can connect to redis. Set `networkPolicy.ingressNSPodMatchLabels` to match pod labels in matched namespace. For example, for a namespace labeled `redis=external` and pods in that namespace labeled `redis-client=true` the fields should be set: + +``` +networkPolicy: + enabled: true + ingressNSMatchLabels: + redis: external + ingressNSPodMatchLabels: + redis-client: true +``` + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami’s Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading an existing Release to a new major version + +A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an +incompatible breaking change needing manual actions. + +### To 11.0.0 + +When using sentinel, a new statefulset called `-node` was introduced. This will break upgrading from a previous version where the statefulsets are called master and slave. Hence the PVC will not match the new naming and won't be reused. If you want to keep your data, you will need to perform a backup and then a restore the data in this new version. + +### To 10.0.0 + +For releases with `usePassword: true`, the value `sentinel.usePassword` controls whether the password authentication also applies to the sentinel port. This defaults to `true` for a secure configuration, however it is possible to disable to account for the following cases: + +- Using a version of redis-sentinel prior to `5.0.1` where the authentication feature was introduced. +- Where redis clients need to be updated to support sentinel authentication. + +If using a master/slave topology, or with `usePassword: false`, no action is required. + +### To 8.0.18 + +For releases with `metrics.enabled: true` the default tag for the exporter image is now `v1.x.x`. This introduces many changes including metrics names. You'll want to use [this dashboard](https://github.com/oliver006/redis_exporter/blob/master/contrib/grafana_prometheus_redis_dashboard.json) now. Please see the [redis_exporter github page](https://github.com/oliver006/redis_exporter#upgrading-from-0x-to-1x) for more details. + +### To 7.0.0 + +This version causes a change in the RedisTM Master StatefulSet definition, so the command helm upgrade would not work out of the box. As an alternative, one of the following could be done: + +- Recommended: Create a clone of the RedisTM Master PVC (for example, using projects like [this one](https://github.com/edseymour/pvc-transfer)). Then launch a fresh release reusing this cloned PVC. + + ``` + helm install my-release bitnami/redis --set persistence.existingClaim= + ``` + +- Alternative (not recommended, do at your own risk): `helm delete --purge` does not remove the PVC assigned to the RedisTM Master StatefulSet. As a consequence, the following commands can be done to upgrade the release + + ``` + helm delete --purge + helm install bitnami/redis + ``` + +Previous versions of the chart were not using persistence in the slaves, so this upgrade would add it to them. Another important change is that no values are inherited from master to slaves. For example, in 6.0.0 `slaves.readinessProbe.periodSeconds`, if empty, would be set to `master.readinessProbe.periodSeconds`. This approach lacked transparency and was difficult to maintain. From now on, all the slave parameters must be configured just as it is done with the masters. + +Some values have changed as well: + +- `master.port` and `slave.port` have been changed to `redisPort` (same value for both master and slaves) +- `master.securityContext` and `slave.securityContext` have been changed to `securityContext`(same values for both master and slaves) + +By default, the upgrade will not change the cluster topology. In case you want to use RedisTM Sentinel, you must explicitly set `sentinel.enabled` to `true`. + +### To 6.0.0 + +Previous versions of the chart were using an init-container to change the permissions of the volumes. This was done in case the `securityContext` directive in the template was not enough for that (for example, with cephFS). In this new version of the chart, this container is disabled by default (which should not affect most of the deployments). If your installation still requires that init container, execute `helm upgrade` with the `--set volumePermissions.enabled=true`. + +### To 5.0.0 + +The default image in this release may be switched out for any image containing the `redis-server` +and `redis-cli` binaries. If `redis-server` is not the default image ENTRYPOINT, `master.command` +must be specified. + +#### Breaking changes + +- `master.args` and `slave.args` are removed. Use `master.command` or `slave.command` instead in order to override the image entrypoint, or `master.extraFlags` to pass additional flags to `redis-server`. +- `disableCommands` is now interpreted as an array of strings instead of a string of comma separated values. +- `master.persistence.path` now defaults to `/data`. + +### 4.0.0 + +This version removes the `chart` label from the `spec.selector.matchLabels` +which is immutable since `StatefulSet apps/v1beta2`. It has been inadvertently +added, causing any subsequent upgrade to fail. See https://github.com/helm/charts/issues/7726. + +It also fixes https://github.com/helm/charts/issues/7726 where a deployment `extensions/v1beta1` can not be upgraded if `spec.selector` is not explicitly set. + +Finally, it fixes https://github.com/helm/charts/issues/7803 by removing mutable labels in `spec.VolumeClaimTemplate.metadata.labels` so that it is upgradable. + +In order to upgrade, delete the RedisTM StatefulSet before upgrading: + +```bash +kubectl delete statefulsets.apps --cascade=false my-release-redis-master +``` + +And edit the RedisTM slave (and metrics if enabled) deployment: + +```bash +kubectl patch deployments my-release-redis-slave --type=json -p='[{"op": "remove", "path": "/spec/selector/matchLabels/chart"}]' +kubectl patch deployments my-release-redis-metrics --type=json -p='[{"op": "remove", "path": "/spec/selector/matchLabels/chart"}]' +``` + +## Upgrading + +### To 12.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +### To 11.0.0 + +When deployed with sentinel enabled, only a group of nodes is deployed and the master/slave role is handled in the group. To avoid breaking the compatibility, the settings for this nodes are given through the `slave.xxxx` parameters in `values.yaml` + +### To 9.0.0 + +The metrics exporter has been changed from a separate deployment to a sidecar container, due to the latest changes in the RedisTM exporter code. Check the [official page](https://github.com/oliver006/redis_exporter/) for more information. The metrics container image was changed from oliver006/redis_exporter to bitnami/redis-exporter (Bitnami's maintained package of oliver006/redis_exporter). + +### To 7.0.0 + +In order to improve the performance in case of slave failure, we added persistence to the read-only slaves. That means that we moved from Deployment to StatefulSets. This should not affect upgrades from previous versions of the chart, as the deployments did not contain any persistence at all. + +This version also allows enabling RedisTM Sentinel containers inside of the RedisTM Pods (feature disabled by default). In case the master crashes, a new RedisTM node will be elected as master. In order to query the current master (no redis master service is exposed), you need to query first the Sentinel cluster. Find more information [in this section](#master-slave-with-sentinel). diff --git a/chart/external/charts/common-1.4.1.tgz b/chart/external/charts/common-1.4.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..110cf10636c084a920c9cbd8c77c9a3bb0368cad GIT binary patch literal 12484 zcmV;#Fgwp5iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ{d)qjYDB3^suc%9>Z|qD&OLiW!-pSrgoXm{B?oNE|bn>0; z?$d@yNJ5(e*Z?R;llc7Y=fjHxUwYWGtDOAdgs282T{r-l7vxl5CFtT;xXg%13021j)dfSEOU+nl#vgZ3&Q9D%=QA5WyPO^ z=t(pP5-eg)GO1s^gdfR}BR+?J;&cj{yI{mPj5*6QLdRhE4pKHIF$}T1z?j02NQ$Ne zVpU#50l@nS5#~=I0w|M^;4EcxG)yrJ=Rl;u=_m>&Y>E$HB4s8Hc6Y}_PV!+Cv+1q{ zxobe~N{;dF6bXrW`AMS^kXT{vK-iBOM#3&=%1|P9Q#NM8ed|pTKaVmx4$krXg7HKg z1U=iapa&D2W|#*(ka(J`q?&W`am;?Y6 zsgAy~mCawaNx^a+V+~~~A#9n0-QA0ei^%V6AmaGWSPdw8^a_!=Z*sQ^S1 z$T*9!5LiS3{)DDkia#h0a;`Sb20n33rL2rOYlQmoeh7gI%+c!Ce$(eCAC5U66o36?phfIzU3 z1j-Wp((uY05^R`;Q3yVN214UBPcVdry&{jNR5cMP2qA1IB$g1K<9P_--`~9pAv6n7 z2-_(U62ez6PeS$Ye}y|c(7U`0G&-L@_e_gRTToRpjz^etoV?CCq2tqdf|EQYbbK_X zta$zA6OMDOy#@e1FqJTkvHDv*QzYZbn@<_XLO6BVJUuwa^8@(&8KQGMhs(?23joV7 zN0M=+Pp(R%Do`!G7tmgdyo@D|{=4com1O<# z$XHU7e=(b8jAAN_u~6n8{v<53xq3Tiwx9d_UgP(l-h@StCvJeJKUldz4anVfsw z-l-Rbj1wwH5TY!L&hsJW6iX~3!gh;F2k^ZJecCme^Q5gY$VG-?ToEQ}l3V1X6P#is zaP-!dgfH-C&Ll2@NS3jbjpsio8C1ny>^z| z97F!qXONY-@%p@2g6GDY&UXOoK<{?;x**W^J|mNG?>c?scQXZbXUX_3`Pu8H{^;r*Pq-6WGNY_zwb*c%FJlB&-kuMiGF##G@c>^L~KidCG z6ug8BGzZBbp5XYrqx1zbAsK{9&XPRF3FK6gv?#D2?MHpMAaYXEdK4H-p~rABA@RgT zJP1G(P?BhC5v34*zPtpL(Gn~N11RMU1kwhsQKNK(}luUElHX4r}t*CzFS;n{&9{d> z#gPVC_zv~AAGFIbLvj*H7CEf?{SZQdV~%C<<1L!v5W*3`X`-u`qP>1UESK*FhJ%~J zaIgl3g95__Dt0EDLBa)i(Zs~>R^eA|8IdLlcB(r7O5ZqfaYL>_$Phk9V3pZbcMPV$7LifeYJH`3B@dbFhcdNMw1G@CmPYDrGCSeeXRJ zrUx$|{FNTRJU#vR?&S3;yg4~}cX9x8mYeyQaW*3fRxdcjIoDJu=dU-(vDR3)Y5M!Z zcW&CWTN#z6n;rN9BSg}h^=IEd>pji&pG?tsbFp9Ft+4(-9n}5*Po6z}dcXeP#C^q(h;$*^$Qx%E#@uqh3p@!q>7rAr!DTPW6P zj>kkuK38j|l7LasX5>Ekg)=6IWF5ub$FhP%<60^8#xs|Ezh(PIhTWSm5FAEsYq!~j z7acV^cOAUnWK;v@dlW_xelK>v7YBNmxl*i77v1e{--L$bz$~b^idV-n*J~D^V-81} zA&NeqYHbMgF7^VZ%knfeMMaJE3iYOw`v#A@zwPamyjk68T7^+7Sb3^~_g=A2Q^G94eM5V_JoZerB{ixsC&o1akZso{kIz^n^ORmuK&*)@!$RDgZuUWHlB6% z|Nnt0=15`~qWD}fKBh_}YwMl}h}kqlk_=O9T)rqx{Q!ZN$4AbyDSXqvDZ(uS+ExlX zRbW0NF}9Yl{c8WR-;NoV13CD9l}C?O|YCp-HI3W85%xUn|1-cJBKLEY%>^89}Nzl~=N``=s3g+w$#JTbA=qH~s7UUJ3F zjA+I?7c#CsEpLKQ}_m8*VabbI+JqG*hh-f&*6 zacXsfRxxQ}#?@+`3k;0f(7Q-vIF5u3NB6_awcA(B;%bRyw5`OaUzfb=lIji$wEJhR zrz!spQ*2QDFSY;rPoC7}|I@*}|Mym&HRS)BPnnWXO5LN@K+-`hI(1N|nDS*zuMrBZ z>uPD@ylJZByBX%3BpAMc0m#CXHY*`2Fg3@$)_P!TkwIk-YGeo`s$61PE4B=lw2!9W+-YHZNZj`6#9RAEv zN=5`HfU-$j(> zthR(R9PdQI(a7xv8X!dgmq&Y28n~M7Iz&q$Z?RoWb5*d)I9@2Q`&jTwJrKB2U?sZy zy8HubcLY}ER}asE90p2t=`3)qyj>f?Iu}-;nReG38HbFop|f8;`1=W#*&9bILJ;`0l{lhOfCQX=P( z#^5i6j@b1Q<88VAo0c_I8w27;ag~%bd8Bmz8BOPES-ik7K{M5j8RjUh(^RN6%Ri%b z)Bfx#k2Y5RhNG~qnN+>jg_6=jpbF?0^|jk-3C((IYKuJ^ZeQp7QZdmRrVYEtx^ zsjsFuoTGL%p{X-<7WEM=Dd4)_uKm{K&N-g1BzE+P@oPvObK?9Q>o|t+UbNhfXgSC8 z_K?uGp3SKWIfp_8ZcZ|f+>E=KzpKV1DFXOGgnsSViImFsNO;(zf zWyq}Ys(RbIm4N4-k*~E`2%(KwO+Hj}K-6QX2Q6{cd*Kd*DW+pN31QIJW60DP>J1$T zHNVet4Dzv&-a*?}qY$Q>OSb7XN8XqV%O#GP^6b>W!sOnlXVM5Gp-+sc<%5Y){9QHxuB9CTv;|&VVt)2|aklSc(y?g8DeYa)P<) zBT5nw^XZTo|NIJ|3wCHzbZX;a{2y90>-cGbNK)o7Hp-3jg@}A;{b$Q!)Skb3u2 zD}=#=g5?fgKo~lK@xb9zdtG+Fo}H)o;EFoHcI3SBgFZxdq>I9qM~`i#AB}Q`7Aw)HH_a<$rqIET^>nv^#pPoGEeTbdv`Qa`xDE8|WzO zh0K0|;j<^0#(qws&tCovFA~zx#wu`_qG5^?KZv1Z;uk*Wb_EeWa5<%py(v*Yqtiah zZppHvQXJ3G}dp@&fmWB7rfbyW1hi7TBlYWAwv9Ged2=urd0{|w=aS{{Vt@N`w+rH-ey zJWGkPL}ki}Nj@5-xOMWiC&_7aToLMRK5d}40AzcFQAIh;e3tDB71xK8^n#8c<9J3` zF1%IT&Pb=BYIRzyqMw?Q%e2z3rV?&gMR2|C-PYoCe}MdMJuUu!$v7J0+l&7m44&2Z z|L^_(xAm-l{>wk3b82`64pSsrkK;IIidBK~Bu<98AVOjq<91)1S76n{V6~=7Q^$VL zIBKVl2Ry2LY&p4A_vYC1HjQe2R?cdRFBVr?=pxk;v{}oAx8gsw8@N(rr{-32E303| z1U>&6{u=tnko?ttSzV)Ev}4xUn|l#|_nxNwmsx5picPHmOXPq5S-*b&*V8Ba_xFF@ z%CnaIrwQf)kaY^`b3a9xi{qeZfsS3W7T2)K1wp@VUkZ$~pssOutpd#^Y7)HRzn_(k zi&FB*EOlQBJG~=&s9$B<)=_rW|3cGrr@i(aIzHH(|HkKai}9aN`i=Sj(lR+0EW4&t8t8_o%f54ZI|@MzSVVl?&XSdp`&3h zw-0xF{_QyH_TIBMboK#pmzEoU${3gM`Ev>2^76%l?elzyW0`8=ICns=$k4uWUUqv_ z%UaOTWAKMyR0+oy;b-lsjZ_J9-sW0v5Z76;0!oTLe0I)fSF zCQ#FCG9wcSx^(<%v@nC`24p(#7283}N2CVIb5iOrIuIgDiS|ec^+RU{Qd+O=wpT;D z@D7o{e{WRPp1{Tt_IewYG&)_-%2VrICAPsh6C>E^I=f!_6+5AH?9R$^0UmKSbxWoh z!KEX&a4VzOFg1UzHM1IkOOKN3josMsMlcG?-FG_!?Iuj)u$|2r|7p_{HtE_OA&eZsoyK$z9h6oG%re7N2+v}a4N!gAf)cD3F6b37kZ`B3lKugi&*_UbVow)?96@*Br9%mw~Iy*zjU_D@@? z%4L4h`XFCz3o&Zl7TT%o=y~i=3mAzyHtM>(>vqz?-OxYppRfBg_5TaRDWT&HngC1v zzx{^)ckllG$J=?<(EmRg#sD;AxwHvCIZIRZzeM9jYJb5~w)}fEUXcFlgfY2D&bLDI zeWr*euw8g2LKk!xf|t;1$EFUdXYcxAc4+@jXaZr6|N3k4mj_?O1noV2b`YAZLLXnA zyghpRj{`UkpZKaZXiNh{057Zk~=JImqF<51TDiz=fJV* zCZ>rwg@tB}Bu#4DywjOZey#IkVmc$7Q4=<;gENcR%!I|Fa>;jjz4-2gUGyZ|&9!ew zBAWDUD?Qap&np>tzKi?CJoI&sykvi!D<^upk@9Dk|`7Xx>VIOxYTQWcahd{Fvhr`Lq(4b3Bhsr5Yp` z$>+!Tl~z$1zg%mxnrl$2722IpkNMZxr(Azc@}KHKfJQ)_sC%W>2}W%6rZW<;g*U@x zh?Nem=C}5+!p62#{)%BfM4tjk&_ zvnJz-biOpkYX^E3%C4m|p|~%#TN-@@sjw97isvjUQS>j^t3}|JFwNAdAE9yX>{_6~ zB9JQs+SI_?nOk;cy|H(~t9{T{9}EX)g;DT*fZZeFI<|oJ6=$LnZXFTUZLaL=(%qe2 zG2^`!&3#Gl6of(*u<6(C{Ot2Pv1H8av#f16t6x@&tz4}CPZ1|58D7&Bv_$`Z{EZ`afMT^l!}^S6+6EsfvRx8P7N zCs$VbYp~i?e#GMmkyzjLwhBUC@j9ejPP$Ep8XP5wRfP_-;e;{SVLEW{Q&?%W1&)%> zF3iA#k=xfx>n}H77S}()SxREfB3<2SmS{r#Iwnzl5IW7GO2KZ^$g)6Bjo^l@qY4Jq z-e@F!KDf%6!v;UKSxD8mH$P8)1&5tx{PL!aP)F$|kvD3F*2Ag&?wkD3zHkXWRu2~t zp<~W;b6-pO6_~KBbpvE-!)Y&&r=&US;w`wdRFN*As(&-@i>or%>^Z^MomHGkI_ z*;0%CCP%eIf60jYQnGEt{P%bKi0cyn52Ist!~UN^f4{l^yMKTF^LCyq`F|8wyneNP zva@*?kY%{L;{q!C+U*50NMF+rR5o-&uAnAq*K-Bg`WtZtRbh3wf)+b)svtTXI7{70 zwN7=rlkS=;=rxjPh(x`9Vqf2uE9n%w*#4#y$$VQ1>18e_Z%SVA;1qn(;egVw-*mIt zI<6ESizR02`hG9teehejlMXQ}$NmR6#7qT$4qd0!0?u+boV(iF>v9d3oA<`mma9AE zjT2a|;EXG!&N4TgEx7{IoANz@Wv|E;x4TV)&IBGA3V9w|8pzP zRs4U)hAU40{~tH*|MM8`&bRIp22 z+oHU03onPNGza%qlpeYzZFoTw3w%uNt+j?xMPD&^s-1M*ZiHs>ZWFqN`8RaPq=`kf zca}unNUgi;YE=tiVRS@h>(Q+v4t(fV+6YA)bg@aI_8P#LR9 zTiYr%OVUo(ZmdG>E#816@s-u9iIS?i`weq(YkxK;-F!l?De3A^mw?)^yz^Vjt}gOg zjn{9OT{`=;gk?HdBCAbvpC1;LyOR#-#r|K86LS4Ta7)hrKHYn=UyuLnKe^BUb1P49 z6$kK%VvFtfKW#q#(=gnfas6s^y1l;o^Yt9QriGjF^)`sPmYdhqzNUw_3S_Z!w=>kU z0^}UeMU?5XT@jk9czbxGPJmi#FsysYn!tV*cnx@YSvvd*9^br*>~-SW8lCTUwiR7e z{qRw+YC_e+;{`|6#%e)4mtV5m6oei%Y#O1gCE%`Y$=5S-4u7y%!V=Ji_ zcGt#qkM0G!dzeiff6VT#k@VmAS#1CLYuDASz-9SgpY8YS@jrV{p5NPlxA9!X{Im9u zDx)pEA#NIbMupbpwV*v@bky(bdu8h?UUA)neie2Zd&OS2Rf&52zEzPsS{rP(wL#I^ zDk@%=W@j$EXr)bC7n+w})P?~vPwu;3wp+RHC-y=U$=sr(v8H1SicoK{isopVR`Ohx zXTv%S>T-qYG^pF#^)7DST|L2;z5i!f`=*%fn?)u;616wcy)C|i9$&6@=B|*aaF0}s zq;>CdZ}4zb40QJu^rqVjE>T~s=@eY%E*n}n+n4vLvoB#iMcL9RS-D`!SB$)$_mk#! zCrwT3Y(THwd|njQ7a(~3^E`>FhnZGJN8R_BFP%Gem(EqM=qYDh*AYM6M$xf@7a%dG z%2WtL*!B*!hNT|7<1%u2ZXB<$FYvU<)W7n;_b4<07!ZitzvJ zMDUKLb6`~0R474)Ii!T*D2QI4{(h!&68I7eO>8a##Or&<~>Fzxb~H z*S(mGchx`cPcfsrC7>aS&+|;%J|cJ&iHj_F6b;dN@F!034)8r=FSUmrq4xT-)=l|L3 z@88e=TY0wNmAMzn&4wSzkSnd_P%UIZ@DhIcCr+o;*S~GMo2AsU5s8VuVQN>hjKpF$ zHAR2dOQG1^Qe}3uD|F0Ro+*)HxDHY_CNT`LyueD}SVT;{Cc&d$!1 zW*sCr!!*G(CfI84YHdBR@bo%A!(0$X51=1?iaxoZ40{>ZL2)IPZN$G6%l=l4=@y4b zOo9iX(1)VoIpmqrQ;Sj>FO-oFuHD%nI43kY0A<0G@lPlVrdT4SJu8$A!Yw9~z8*Ll zoxR{W50x_aW1=5~i9S1+dDa(N33p*b63Np(q9c3 zCP=_g@tDLy*%;bypD7T(I5ZVDoMMRu9G91>o#a%KDXyZJah61c?e4(#s~?U}b|QGK zu>|#3aVK^z*;E@e?|(dn7;{NRBt{a8$BOUA`X)W9kIgIARDY`e&RNa@WknQ`od?Gp zYhQvO5{n?{`RER!!QNkjp6Ty?G>H19in4LBqKD!L3?r7N?800hH%!fau0m_GjuX%f zkyL-PhM%3umPK^@L(DR)4a0>q$Tkvu;B9us?@cg2XQmZ&gFjWM=9Q@}C zyv8EtL|cil^794We9Fvidq*_OkFLu!MA^Z_b#+CVDa*q6`g5 zy5e+d48)aY*XmE(JX}82t~-U+ecBrE2Rim>94Yy3m-4e}SM9hfxhN4=BHok1R_lOm zvr5J(QIgS}Ng<=+vQrN}5TQK}0?VC9aY%G#7Bg^HKzCwUu8L8qdYsj;L|MjJ#)Q4l$`7Fw_F-Hk5 zgM-a}iIUAn5-v!Z0;VF@A<(T6-eWSu)Hn(+uzq7eYO}^zT@f6O;H=!CF)V)OmOZoc zL2PSs!r28N3K~Ie8R_>z*=c$j8jJyHV{g-_jfb%R9w&^9ydH zhtQpFd~o&{1jg{ok*oIG_LeTg8IwCjw4abX*XgJtXz4(fr>P0?6lbj+c+KK-%nc91 z2_6$6`5bIi=vy?!qSk?eQ{G^{o9_X@?vcC1>G`*wBJ>d(&fM&%$}O zq1p1ytYPI-VScM64^e!Msdg^>!-g*aa-46u3~V95RB^uXy{d(UnR)W^_^8muikToV zpOF~5SP{m;;@vURF(E_5Lpy^NlwVwH3C=jSsa+_OB(AypjENT!wmVGOcz3Tq__y8u z^WDK;cTq-qUTx7Mv^VGtp6zE0NZ2k_T^Cq1Zr2io)sZtpw`k<9B^Q>Bo!OI6 z|DKh|sRdRMlX?L?Mc8;QFr2w%M3s0q!<>@@pDi7|>IR4^f5@?s56+RIKF;CK9Holh zi83WM8cmyVwZ=5smLpAB-Ki|iOP9_{W7f$mcBNlD&9Av~euFFKn$Kd9|n7LScvfg5K;TQttv8K=-rY$Z}p^N~I>5>DsEPv11tn)jPZ z{ol5?96({uQMTydo8Z0%`OfkD4C>^wk#y&HzIvrp}HUCi0s-P zgw1z*;SPi;reiq?VbF(ANY3cEJbbR?zip=SyJX_WVCp{xQ&$_SrtHh9jk-1d6;_1h zwsD^xQE^uBS-PBcN}I+r9j#OZ2s_d`@|pS(EG1w2=G3?JxOG@Ej>dR%Thd==(cRoe z_SaeUHn;s0xiCrt_dKBlS*BQUfBvCk9jZ}B?SvG#P zlk~#wZ0OSvK09@V_UI9ESA|vcI9`2No7$Phvscc#1<8%h%DH0?rHf($8TXmCm4?^^ z?J0b;JB~=ZaV&sQdysz4azlVzV0VeXwVK?fmLby($)hFX*LFA0+1lgh-OjX;A#9GH zciYI<9YQa0@U4vElJTqM+bs46)*C;a>+WwN&;H~6Pk-B0|6gw$o8xCvB!1nYGr7lZ zaqg`!elZdP(S)PQ7_K{hhYreyBxrN|3Ov8^7#4Wk);KO(|LjeY*IfV19j5;;$K!v$ z$wkoKJN=axL4(EZE`r*u|A;sxbiCZAU%`IAmWjR8C|$t-yj~EF$JG~>DiLRCO6d4K z8Y>OJ5)06f<@0Q0m$GL8`&l7Mx}{CMX4>DJbFzo+9CeLn~0_iDz!3 zrVauCInVHc0!ZjM07%N=I&h&@uDF-c$OP9C0V#`-#7O{vKcQ)s;sZ!@t%$H7@D6V; zY3igXsTsKp|Mel;L*Bb|Oz5W|kZ8ONtbrrZ*atI+2G62FFTq2CXm8N(@n`!%kmYH5 z%u*6B#Z?n~GzVnB9~TvioSWJ?`tW6Xf#%{NkWq<;qS-^8tWiFEY_ewxEOqgt(OV{u zITo18hXx-TfK(!cI7jmUfJkgoU@gYfWpGO8ARN-v00A~C(YNhHL6G2K?ooAUGLSYX zU{H1^ZM0OAJbq{nbHax511!pGn@^H%3G2t#{F zJRw5iDIl3Eg2pBTfgnuDuL{OtFAM?{$5@D;Sb~?K`%;&LDND*bPdf3gG<1Sd@{tpX z-{}DmCMF+xll5{v(veSevaoqp)4a*i;W5_ z`@TpLVqn_E{v6NE4p>`As`^N17ZL`4vtP52*d|{`f$A3c$Zi1?%A+de(zXA9=LIPh zEp>+#V!4u3AML3rowW}Hrh@2%NqR17Mbb}uL1?i*_80`4VvuBtg#vJasGgK#Ra-Iz zotv%Tj0r*XfycRNR%;3qOt`31Ly2rRx?4~t0=Bf$?|Z#odyW%Jm8&N>0UPdZ79x~o zt5-Ec_%1_#=D0|dQjW&w&)yci)$hN+@Yxeg<085G@$! zg)N?Y*$-E3(Ct}TFS%}2(J$EYQ)6nf)@D?7@-LfBQ1RQ^3HJ8g`!}bN{AA=*%&1@~ zzD^S2e*bpU5cdaHNJPA1CgP=+OHGU0zrnvLG@Pd3<;oDglQCe)a@#K0%SU^9dm+yEg4?Syd2vVL|4m2E5^ zgF)1f`a$r^I|^^v3{Quc!(jh0?DhBhkL}t2J(uj{OMNeMVc8j{%>~Jnh+sTpMSOpmxM_ru%(()UBqpho>FU1Gr!*8bE3E>oqe6F!!1;O~x%? zG@b86@XJ3j$BR?rxs-T{1yDw8r%Wu;j<$hgL={gZFlCxbrR8gUKZ?3%eu@nf^cD2r zXGI006WP37XAPWY`%wk05&Cm?%a-nGZq!(`?pE=$mkZpB zk-%cd&Jz2Hj?Lh?K1c?$eZ?$43p~nGNC`a`h8JARs>MoHNSRB<2};E-$AYCZ+*8Qy z>3{co856QsB4WmQ*Mql8Pg;uWlg6e5?x{ZL_Ik6uo@Dmt{pO{NDfo O0RR6Us#Y@qLID6$ubF88 literal 0 HcmV?d00001 diff --git a/chart/external/ci/default-values.yaml b/chart/external/ci/default-values.yaml new file mode 100644 index 0000000..fc2ba60 --- /dev/null +++ b/chart/external/ci/default-values.yaml @@ -0,0 +1 @@ +# Leave this file empty to ensure that CI runs builds against the default configuration in values.yaml. diff --git a/chart/external/ci/extra-flags-values.yaml b/chart/external/ci/extra-flags-values.yaml new file mode 100644 index 0000000..71132f7 --- /dev/null +++ b/chart/external/ci/extra-flags-values.yaml @@ -0,0 +1,11 @@ +master: + extraFlags: + - --maxmemory-policy allkeys-lru + persistence: + enabled: false +slave: + extraFlags: + - --maxmemory-policy allkeys-lru + persistence: + enabled: false +usePassword: false diff --git a/chart/external/ci/production-sentinel-values.yaml b/chart/external/ci/production-sentinel-values.yaml new file mode 100644 index 0000000..009a371 --- /dev/null +++ b/chart/external/ci/production-sentinel-values.yaml @@ -0,0 +1,682 @@ +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## +global: + # imageRegistry: myRegistryName + # imagePullSecrets: + # - myRegistryKeySecretName + # storageClass: myStorageClass + redis: {} + +## Bitnami Redis(TM) image version +## ref: https://hub.docker.com/r/bitnami/redis/tags/ +## +image: + registry: docker.io + repository: bitnami/redis + ## Bitnami Redis(TM) image tag + ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links + ## + tag: 5.0.9-debian-10-r0 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + +## String to partially override redis.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override redis.fullname template +## +# fullnameOverride: + +## Cluster settings +cluster: + enabled: true + slaveCount: 3 + +## Use redis sentinel in the redis pod. This will disable the master and slave services and +## create one redis service with ports to the sentinel and the redis instances +sentinel: + enabled: true + ## Require password authentication on the sentinel itself + ## ref: https://redis.io/topics/sentinel + usePassword: true + ## Bitnami Redis(TM) Sentintel image version + ## ref: https://hub.docker.com/r/bitnami/redis-sentinel/tags/ + ## + image: + registry: docker.io + repository: bitnami/redis-sentinel + ## Bitnami Redis(TM) image tag + ## ref: https://github.com/bitnami/bitnami-docker-redis-sentinel#supported-tags-and-respective-dockerfile-links + ## + tag: 5.0.9-debian-10-r0 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + masterSet: mymaster + initialCheckTimeout: 5 + quorum: 2 + downAfterMilliseconds: 60000 + failoverTimeout: 18000 + parallelSyncs: 1 + port: 26379 + ## Additional Redis(TM) configuration for the sentinel nodes + ## ref: https://redis.io/topics/config + ## + configmap: + ## Enable or disable static sentinel IDs for each replicas + ## If disabled each sentinel will generate a random id at startup + ## If enabled, each replicas will have a constant ID on each start-up + ## + staticID: false + ## Configure extra options for Redis(TM) Sentinel liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + customLivenessProbe: {} + customReadinessProbe: {} + ## Redis(TM) Sentinel resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## Redis(TM) Sentinel Service properties + service: + ## Redis(TM) Sentinel Service type + type: ClusterIP + sentinelPort: 26379 + redisPort: 6379 + + ## Specify the nodePort value for the LoadBalancer and NodePort service types. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + # sentinelNodePort: + # redisNodePort: + + ## Provide any additional annotations which may be required. This can be used to + ## set the LoadBalancer service type to internal only. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + annotations: {} + labels: {} + loadBalancerIP: + +## Specifies the Kubernetes Cluster's Domain Name. +## +clusterDomain: cluster.local + +networkPolicy: + ## Specifies whether a NetworkPolicy should be created + ## + enabled: true + + ## The Policy model to apply. When set to false, only pods with the correct + ## client label will have network access to the port Redis(TM) is listening + ## on. When true, Redis(TM) will accept connections from any source + ## (with the correct destination port). + ## + # allowExternal: true + + ## Allow connections from other namespacess. Just set label for namespace and set label for pods (optional). + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + +serviceAccount: + ## Specifies whether a ServiceAccount should be created + ## + create: false + ## The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the fullname template + name: + +rbac: + ## Specifies whether RBAC resources should be created + ## + create: false + + role: + ## Rules to create. It follows the role specification + # rules: + # - apiGroups: + # - extensions + # resources: + # - podsecuritypolicies + # verbs: + # - use + # resourceNames: + # - gce.unprivileged + rules: [] + +## Redis(TM) pod Security Context +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + ## sysctl settings for master and slave pods + ## + ## Uncomment the setting below to increase the net.core.somaxconn value + ## + # sysctls: + # - name: net.core.somaxconn + # value: "10000" + +## Use password authentication +usePassword: true +## Redis(TM) password (both master and slave) +## Defaults to a random 10-character alphanumeric string if not set and usePassword is true +## ref: https://github.com/bitnami/bitnami-docker-redis#setting-the-server-password-on-first-run +## +password: +## Use existing secret (ignores previous password) +# existingSecret: +## Password key to be retrieved from Redis(TM) secret +## +# existingSecretPasswordKey: + +## Mount secrets as files instead of environment variables +usePasswordFile: false + +## Persist data to a persistent volume (Redis(TM) Master) +persistence: + ## A manually managed Persistent Volume and Claim + ## Requires persistence.enabled: true + ## If defined, PVC must be created manually before volume will be bound + existingClaim: + +# Redis(TM) port +redisPort: 6379 + +## +## Redis(TM) Master parameters +## +master: + ## Redis(TM) command arguments + ## + ## Can be used to specify command line arguments, for example: + ## + command: "/run.sh" + ## Additional Redis(TM) configuration for the master nodes + ## ref: https://redis.io/topics/config + ## + configmap: + ## Redis(TM) additional command line flags + ## + ## Can be used to specify command line flags, for example: + ## + ## extraFlags: + ## - "--maxmemory-policy volatile-ttl" + ## - "--repl-backlog-size 1024mb" + extraFlags: [] + ## Comma-separated list of Redis(TM) commands to disable + ## + ## Can be used to disable Redis(TM) commands for security reasons. + ## Commands will be completely disabled by renaming each to an empty string. + ## ref: https://redis.io/topics/security#disabling-of-specific-commands + ## + disableCommands: + - FLUSHDB + - FLUSHALL + + ## Redis(TM) Master additional pod labels and annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + podLabels: {} + podAnnotations: {} + + ## Redis(TM) Master resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + # schedulerName: + + ## Configure extra options for Redis(TM) Master liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + + ## Configure custom probes for images other images like + ## rhscl/redis-32-rhel7 rhscl/redis-5-rhel7 + ## Only used if readinessProbe.enabled: false / livenessProbe.enabled: false + ## + # customLivenessProbe: + # tcpSocket: + # port: 6379 + # initialDelaySeconds: 10 + # periodSeconds: 5 + # customReadinessProbe: + # initialDelaySeconds: 30 + # periodSeconds: 10 + # timeoutSeconds: 5 + # exec: + # command: + # - "container-entrypoint" + # - "bash" + # - "-c" + # - "redis-cli set liveness-probe \"`date`\" | grep OK" + customLivenessProbe: {} + customReadinessProbe: {} + + ## Redis(TM) Master Node selectors and tolerations for pod assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature + ## + # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} + # tolerations: [] + ## Redis(TM) Master pod/node affinity/anti-affinity + ## + affinity: {} + + ## Redis(TM) Master Service properties + service: + ## Redis(TM) Master Service type + type: ClusterIP + port: 6379 + + ## Specify the nodePort value for the LoadBalancer and NodePort service types. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + # nodePort: + + ## Provide any additional annotations which may be required. This can be used to + ## set the LoadBalancer service type to internal only. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + annotations: {} + labels: {} + loadBalancerIP: + # loadBalancerSourceRanges: ["10.0.0.0/8"] + + ## Enable persistence using Persistent Volume Claims + ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + persistence: + enabled: true + ## The path the volume will be mounted at, useful when using different + ## Redis(TM) images. + path: /data + ## The subdirectory of the volume to mount to, useful in dev environments + ## and one PV for multiple services. + subPath: "" + ## redis data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + accessModes: + - ReadWriteOnce + size: 8Gi + ## Persistent Volume selectors + ## https://kubernetes.io/docs/concepts/storage/persistent-volumes/#selector + matchLabels: {} + matchExpressions: {} + + ## Update strategy, can be set to RollingUpdate or onDelete by default. + ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets + statefulset: + updateStrategy: RollingUpdate + ## Partition update strategy + ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions + # rollingUpdatePartition: + + ## Redis(TM) Master pod priorityClassName + ## + priorityClassName: {} + +## +## Redis(TM) Slave properties +## Note: service.type is a mandatory parameter +## The rest of the parameters are either optional or, if undefined, will inherit those declared in Redis(TM) Master +## +slave: + ## Slave Service properties + service: + ## Redis(TM) Slave Service type + type: ClusterIP + ## Redis(TM) port + port: 6379 + ## Specify the nodePort value for the LoadBalancer and NodePort service types. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + # nodePort: + + ## Provide any additional annotations which may be required. This can be used to + ## set the LoadBalancer service type to internal only. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + annotations: {} + labels: {} + loadBalancerIP: + # loadBalancerSourceRanges: ["10.0.0.0/8"] + + ## Redis(TM) slave port + port: 6379 + ## Can be used to specify command line arguments, for example: + ## + command: "/run.sh" + ## Additional Redis(TM) configuration for the slave nodes + ## ref: https://redis.io/topics/config + ## + configmap: + ## Redis(TM) extra flags + extraFlags: [] + ## List of Redis(TM) commands to disable + disableCommands: + - FLUSHDB + - FLUSHALL + + ## Redis(TM) Slave pod/node affinity/anti-affinity + ## + affinity: {} + + ## Configure extra options for Redis(TM) Slave liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 10 + successThreshold: 1 + failureThreshold: 5 + + ## Configure custom probes for images other images like + ## rhscl/redis-32-rhel7 rhscl/redis-5-rhel7 + ## Only used if readinessProbe.enabled: false / livenessProbe.enabled: false + ## + # customLivenessProbe: + # tcpSocket: + # port: 6379 + # initialDelaySeconds: 10 + # periodSeconds: 5 + # customReadinessProbe: + # initialDelaySeconds: 30 + # periodSeconds: 10 + # timeoutSeconds: 5 + # exec: + # command: + # - "container-entrypoint" + # - "bash" + # - "-c" + # - "redis-cli set liveness-probe \"`date`\" | grep OK" + customLivenessProbe: {} + customReadinessProbe: {} + + ## Redis(TM) slave Resource + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + + ## Redis(TM) slave selectors and tolerations for pod assignment + # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} + # tolerations: [] + + ## Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + # schedulerName: + + ## Redis(TM) slave pod Annotation and Labels + podLabels: {} + podAnnotations: {} + + ## Redis(TM) slave pod priorityClassName + # priorityClassName: {} + + ## Enable persistence using Persistent Volume Claims + ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + persistence: + enabled: true + ## The path the volume will be mounted at, useful when using different + ## Redis(TM) images. + path: /data + ## The subdirectory of the volume to mount to, useful in dev environments + ## and one PV for multiple services. + subPath: "" + ## redis data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + accessModes: + - ReadWriteOnce + size: 8Gi + ## Persistent Volume selectors + ## https://kubernetes.io/docs/concepts/storage/persistent-volumes/#selector + matchLabels: {} + matchExpressions: {} + + ## Update strategy, can be set to RollingUpdate or onDelete by default. + ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets + statefulset: + updateStrategy: RollingUpdate + ## Partition update strategy + ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions + # rollingUpdatePartition: + +## Prometheus Exporter / Metrics +## +metrics: + enabled: true + + image: + registry: docker.io + repository: bitnami/redis-exporter + tag: 1.5.3-debian-10-r14 + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + + ## Metrics exporter resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + # resources: {} + + ## Extra arguments for Metrics exporter, for example: + ## extraArgs: + ## check-keys: myKey,myOtherKey + # extraArgs: {} + + ## Metrics exporter pod Annotation and Labels + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9121" + # podLabels: {} + + # Enable this if you're using https://github.com/coreos/prometheus-operator + serviceMonitor: + enabled: false + ## Specify a namespace if needed + # namespace: monitoring + # fallback to the prometheus default unless specified + # interval: 10s + ## Defaults to what's used if you follow CoreOS [Prometheus Install Instructions](https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#tldr) + ## [Prometheus Selector Label](https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-operator-1) + ## [Kube Prometheus Selector Label](https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#exporters) + selector: + prometheus: kube-prometheus + + ## Custom PrometheusRule to be defined + ## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart + ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions + prometheusRule: + enabled: false + additionalLabels: {} + namespace: "" + ## Redis(TM) prometheus rules + ## These are just examples rules, please adapt them to your needs. + ## Make sure to constraint the rules to the current postgresql service. + # rules: + # - alert: RedisDown + # expr: redis_up{service="{{ template "redis.fullname" . }}-metrics"} == 0 + # for: 2m + # labels: + # severity: error + # annotations: + # summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} down + # description: Redis(TM) instance {{ "{{ $labels.instance }}" }} is down + # - alert: RedisMemoryHigh + # expr: > + # redis_memory_used_bytes{service="{{ template "redis.fullname" . }}-metrics"} * 100 + # / + # redis_memory_max_bytes{service="{{ template "redis.fullname" . }}-metrics"} + # > 90 + # for: 2m + # labels: + # severity: error + # annotations: + # summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} is using too much memory + # description: | + # Redis(TM) instance {{ "{{ $labels.instance }}" }} is using {{ "{{ $value }}" }}% of its available memory. + # - alert: RedisKeyEviction + # expr: | + # increase(redis_evicted_keys_total{service="{{ template "redis.fullname" . }}-metrics"}[5m]) > 0 + # for: 1s + # labels: + # severity: error + # annotations: + # summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} has evicted keys + # description: | + # Redis(TM) instance {{ "{{ $labels.instance }}" }} has evicted {{ "{{ $value }}" }} keys in the last 5 minutes. + rules: [] + + ## Metrics exporter pod priorityClassName + # priorityClassName: {} + service: + type: ClusterIP + ## Use serviceLoadBalancerIP to request a specific static IP, + ## otherwise leave blank + # loadBalancerIP: + annotations: {} + labels: {} + +## +## Init containers parameters: +## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/bitnami-shell + tag: "10" + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + # resources: + # requests: + # memory: 128Mi + # cpu: 100m + +## Redis(TM) config file +## ref: https://redis.io/topics/config +## +configmap: |- + # Enable AOF https://redis.io/topics/persistence#append-only-file + appendonly yes + # Disable RDB persistence, AOF persistence already enabled. + save "" + +## Sysctl InitContainer +## used to perform sysctl operation to modify Kernel settings (needed sometimes to avoid warnings) +sysctlImage: + enabled: false + command: [] + registry: docker.io + repository: bitnami/bitnami-shell + tag: "10" + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + mountHostSys: false + resources: {} + # resources: + # requests: + # memory: 128Mi + # cpu: 100m + +## PodSecurityPolicy configuration +## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +## +podSecurityPolicy: + ## Specifies whether a PodSecurityPolicy should be created + ## + create: false diff --git a/chart/external/templates/NOTES.txt b/chart/external/templates/NOTES.txt new file mode 100644 index 0000000..5c27951 --- /dev/null +++ b/chart/external/templates/NOTES.txt @@ -0,0 +1,136 @@ +** Please be patient while the chart is being deployed ** + +{{- if contains .Values.master.service.type "LoadBalancer" }} +{{- if not .Values.usePassword }} +{{ if and (not .Values.networkPolicy.enabled) (.Values.networkPolicy.allowExternal) }} + +------------------------------------------------------------------------------- + WARNING + + By specifying "master.service.type=LoadBalancer" and "usePassword=false" you have + most likely exposed the Redis(TM) service externally without any authentication + mechanism. + + For security reasons, we strongly suggest that you switch to "ClusterIP" or + "NodePort". As alternative, you can also switch to "usePassword=true" + providing a valid password on "password" parameter. + +------------------------------------------------------------------------------- +{{- end }} +{{- end }} +{{- end }} + +{{- if and .Values.sentinel.enabled (not .Values.cluster.enabled)}} + +------------------------------------------------------------------------------- + WARNING + + Using redis sentinel without a cluster is not supported. A single pod with + standalone redis has been deployed. + + To deploy redis sentinel, please use the values "cluster.enabled=true" and + "sentinel.enabled=true". + +------------------------------------------------------------------------------- +{{- end }} + +{{- if .Values.cluster.enabled }} +{{- if .Values.sentinel.enabled }} +Redis(TM) can be accessed via port {{ .Values.sentinel.service.redisPort }} on the following DNS name from within your cluster: + +{{ template "redis.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} for read only operations + +For read/write operations, first access the Redis(TM) Sentinel cluster, which is available in port {{ .Values.sentinel.service.sentinelPort }} using the same domain name above. + +{{- else }} +Redis(TM) can be accessed via port {{ .Values.redisPort }} on the following DNS names from within your cluster: + +{{ template "redis.fullname" . }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} for read/write operations +{{ template "redis.fullname" . }}-slave.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} for read-only operations +{{- end }} + +{{- else }} +Redis(TM) can be accessed via port {{ .Values.redisPort }} on the following DNS name from within your cluster: + +{{ template "redis.fullname" . }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} + +{{- end }} + +{{ if .Values.usePassword }} +To get your password run: + + export REDIS_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "redis.secretName" . }} -o jsonpath="{.data.redis-password}" | base64 --decode) +{{- end }} + +To connect to your Redis(TM) server: + +1. Run a Redis(TM) pod that you can use as a client: + +{{- if .Values.tls.enabled }} + kubectl run --namespace {{ .Release.Namespace }} {{ template "redis.fullname" . }}-client --restart='Never' --env REDIS_PASSWORD=$REDIS_PASSWORD --image {{ template "redis.image" . }} --command -- sleep infinity + + Copy your TLS certificates to the pod: + + kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.cert {{ template "redis.fullname" . }}-client:/tmp/client.cert + kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.key {{ template "redis.fullname" . }}-client:/tmp/client.key + kubectl cp --namespace {{ .Release.Namespace }} /path/to/CA.cert {{ template "redis.fullname" . }}-client:/tmp/CA.cert + + Use the following command to attach to the pod: + + kubectl exec --tty -i {{ template "redis.fullname" . }}-client \ + {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "redis.fullname" . }}-client=true" \{{- end }} + --namespace {{ .Release.Namespace }} -- bash +{{- else }} + kubectl run --namespace {{ .Release.Namespace }} {{ template "redis.fullname" . }}-client --rm --tty -i --restart='Never' \ + {{ if .Values.usePassword }} --env REDIS_PASSWORD=$REDIS_PASSWORD \{{ end }} + {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "redis.fullname" . }}-client=true" \{{- end }} + --image {{ template "redis.image" . }} -- bash +{{- end }} + +2. Connect using the Redis(TM) CLI: + +{{- if .Values.cluster.enabled }} + {{- if .Values.sentinel.enabled }} + redis-cli -h {{ template "redis.fullname" . }} -p {{ .Values.sentinel.service.redisPort }}{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Read only operations + redis-cli -h {{ template "redis.fullname" . }} -p {{ .Values.sentinel.service.sentinelPort }}{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Sentinel access + {{- else }} + redis-cli -h {{ template "redis.fullname" . }}-master{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + redis-cli -h {{ template "redis.fullname" . }}-slave{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + {{- end }} +{{- else }} + redis-cli -h {{ template "redis.fullname" . }}-master{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} +{{- end }} + +{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} +Note: Since NetworkPolicy is enabled, only pods with label +{{ template "redis.fullname" . }}-client=true" +will be able to connect to redis. +{{- else -}} + +To connect to your database from outside the cluster execute the following commands: + +{{- if contains "NodePort" .Values.master.service.type }} + + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "redis.fullname" . }}-master) + redis-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- else if contains "LoadBalancer" .Values.master.service.type }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "redis.fullname" . }}' + + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "redis.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + redis-cli -h $SERVICE_IP -p {{ .Values.master.service.port }} {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- else if contains "ClusterIP" .Values.master.service.type }} + + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "redis.fullname" . }}-master {{ .Values.redisPort }}:{{ .Values.redisPort }} & + redis-cli -h 127.0.0.1 -p {{ .Values.redisPort }} {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- end }} +{{- end }} + +{{ include "redis.checkRollingTags" . }} + +{{- include "redis.validateValues" . }} diff --git a/chart/external/templates/_helpers.tpl b/chart/external/templates/_helpers.tpl new file mode 100644 index 0000000..65735a7 --- /dev/null +++ b/chart/external/templates/_helpers.tpl @@ -0,0 +1,426 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "redis.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Expand the chart plus release name (used by the chart label) +*/}} +{{- define "redis.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "redis.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "networkPolicy.apiVersion" -}} +{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiGroup for PodSecurityPolicy. +*/}} +{{- define "podSecurityPolicy.apiGroup" -}} +{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "policy" -}} +{{- else -}} +{{- print "extensions" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for PodSecurityPolicy. +*/}} +{{- define "podSecurityPolicy.apiVersion" -}} +{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "policy/v1beta1" -}} +{{- else -}} +{{- print "extensions/v1beta1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Redis(TM) image name +*/}} +{{- define "redis.image" -}} +{{- $registryName := .Values.image.registry -}} +{{- $repositoryName := .Values.image.repository -}} +{{- $tag := .Values.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Redis(TM) Sentinel image name +*/}} +{{- define "sentinel.image" -}} +{{- $registryName := .Values.sentinel.image.registry -}} +{{- $repositoryName := .Values.sentinel.image.repository -}} +{{- $tag := .Values.sentinel.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the metrics image) +*/}} +{{- define "redis.metrics.image" -}} +{{- $registryName := .Values.metrics.image.registry -}} +{{- $repositoryName := .Values.metrics.image.repository -}} +{{- $tag := .Values.metrics.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "redis.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert file. +*/}} +{{- define "redis.tlsCert" -}} +{{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/redis/certs/%s" -}} +{{- end -}} + +{{/* +Return the path to the cert key file. +*/}} +{{- define "redis.tlsCertKey" -}} +{{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/redis/certs/%s" -}} +{{- end -}} + +{{/* +Return the path to the CA cert file. +*/}} +{{- define "redis.tlsCACert" -}} +{{- required "Certificate CA filename is required when TLS in enabled" .Values.tls.certCAFilename | printf "/opt/bitnami/redis/certs/%s" -}} +{{- end -}} + +{{/* +Return the path to the DH params file. +*/}} +{{- define "redis.tlsDHParams" -}} +{{- if .Values.tls.dhParamsFilename -}} +{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.dhParamsFilename -}} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "redis.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "redis.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Get the password secret. +*/}} +{{- define "redis.secretName" -}} +{{- if .Values.existingSecret -}} +{{- printf "%s" .Values.existingSecret -}} +{{- else -}} +{{- printf "%s" (include "redis.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the password key to be retrieved from Redis(TM) secret. +*/}} +{{- define "redis.secretPasswordKey" -}} +{{- if and .Values.existingSecret .Values.existingSecretPasswordKey -}} +{{- printf "%s" .Values.existingSecretPasswordKey -}} +{{- else -}} +{{- printf "redis-password" -}} +{{- end -}} +{{- end -}} + +{{/* +Return Redis(TM) password +*/}} +{{- define "redis.password" -}} +{{- if not (empty .Values.global.redis.password) }} + {{- .Values.global.redis.password -}} +{{- else if not (empty .Values.password) -}} + {{- .Values.password -}} +{{- else -}} + {{- randAlphaNum 10 -}} +{{- end -}} +{{- end -}} + +{{/* +Return sysctl image +*/}} +{{- define "redis.sysctl.image" -}} +{{- $registryName := default "docker.io" .Values.sysctlImage.registry -}} +{{- $repositoryName := .Values.sysctlImage.repository -}} +{{- $tag := default "buster" .Values.sysctlImage.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "redis.imagePullSecrets" -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. +Also, we can not use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} +{{- if .Values.global.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.global.imagePullSecrets }} + {{- $credType := typeOf . -}} + {{ if eq $credType "map[string]interface {}" }} + - name: {{ get . "name" }} + {{ else }} + - name: {{ . }} + {{ end }} +{{- end }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} +imagePullSecrets: +{{- range .Values.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.metrics.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.sysctlImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} +imagePullSecrets: +{{- range .Values.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.metrics.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.sysctlImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "redis.checkRollingTags" -}} +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.sentinel.image.repository) (not (.Values.sentinel.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.sentinel.image.repository }}:{{ .Values.sentinel.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- end -}} + +{{/* +Return the proper Storage Class for master +*/}} +{{- define "redis.master.storageClass" -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. +*/}} +{{- if .Values.global -}} + {{- if .Values.global.storageClass -}} + {{- if (eq "-" .Values.global.storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" .Values.global.storageClass -}} + {{- end -}} + {{- else -}} + {{- if .Values.master.persistence.storageClass -}} + {{- if (eq "-" .Values.master.persistence.storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" .Values.master.persistence.storageClass -}} + {{- end -}} + {{- end -}} + {{- end -}} +{{- else -}} + {{- if .Values.master.persistence.storageClass -}} + {{- if (eq "-" .Values.master.persistence.storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" .Values.master.persistence.storageClass -}} + {{- end -}} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Storage Class for slave +*/}} +{{- define "redis.slave.storageClass" -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. +*/}} +{{- if .Values.global -}} + {{- if .Values.global.storageClass -}} + {{- if (eq "-" .Values.global.storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" .Values.global.storageClass -}} + {{- end -}} + {{- else -}} + {{- if .Values.slave.persistence.storageClass -}} + {{- if (eq "-" .Values.slave.persistence.storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" .Values.slave.persistence.storageClass -}} + {{- end -}} + {{- end -}} + {{- end -}} +{{- else -}} + {{- if .Values.slave.persistence.storageClass -}} + {{- if (eq "-" .Values.slave.persistence.storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" .Values.slave.persistence.storageClass -}} + {{- end -}} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "redis.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "redis.validateValues.spreadConstraints" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* Validate values of Redis(TM) - spreadConstrainsts K8s version */}} +{{- define "redis.validateValues.spreadConstraints" -}} +{{- if and (semverCompare "<1.16-0" .Capabilities.KubeVersion.GitVersion) .Values.slave.spreadConstraints -}} +redis: spreadConstraints + Pod Topology Spread Constraints are only available on K8s >= 1.16 + Find more information at https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ +{{- end -}} +{{- end -}} + +{{/* +Renders a value that contains template. +Usage: +{{ include "redis.tplValue" (dict "value" .Values.path.to.the.Value "context" $) }} +*/}} +{{- define "redis.tplValue" -}} + {{- if typeIs "string" .value }} + {{- tpl .value .context }} + {{- else }} + {{- tpl (.value | toYaml) .context }} + {{- end }} +{{- end -}} diff --git a/chart/external/templates/bigbang/gateway.yaml b/chart/external/templates/bigbang/gateway.yaml new file mode 100644 index 0000000..5692999 --- /dev/null +++ b/chart/external/templates/bigbang/gateway.yaml @@ -0,0 +1,31 @@ +{{- if and .Values.istio.enabled .Values.istio.redis.enabled -}} +apiVersion: networking.istio.io/v1alpha3 +kind: Gateway +metadata: + name: redis-gateway + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: {{ template "redis.name" . }} + helm.sh/chart: {{ template "redis.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/part-of: redis + app.kubernetes.io/component: networking + {{- if .Values.istio.redis.labels }} + {{- toYaml .Values.istio.redis.labels | indent 4 }} + {{- end }} + {{- if .Values.istio.redis.annotations }} + annotations: + {{ toYaml .Values.istio.redis.annotations | indent 4 }} + {{- end }} +spec: + selector: + istio: ingressgateway + servers: + - port: + number: {{ .Values.istio.redis.gateway.port }} + name: redis-port + protocol: TCP + hosts: + - "*" +{{- end }} \ No newline at end of file diff --git a/chart/external/templates/bigbang/virtualservice.yaml b/chart/external/templates/bigbang/virtualservice.yaml new file mode 100644 index 0000000..3dd5a9c --- /dev/null +++ b/chart/external/templates/bigbang/virtualservice.yaml @@ -0,0 +1,36 @@ +{{- if and .Values.istio.enabled .Values.istio.redis.enabled -}} +apiVersion: networking.istio.io/v1beta1 +kind: VirtualService +metadata: + name: redis + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: {{ template "redis.name" . }} + helm.sh/chart: {{ template "redis.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/part-of: redis + app.kubernetes.io/component: networking + {{- if .Values.istio.redis.labels }} +{{ toYaml .Values.istio.redis.labels | indent 4 }} + {{- end }} + {{- if .Values.istio.redis.annotations }} + annotations: +{{ toYaml .Values.istio.redis.annotations | indent 4 }} + {{- end }} +spec: + gateways: + - redis-gateway + hosts: + {{- range .Values.istio.redis.hosts }} + - {{ . | quote }} + {{- end }} + tcp: + - match: + - port: {{ .Values.istio.redis.gateway.port }} + route: + - destination: + port: + number: {{ .Values.master.service.port }} + host: {{ template "redis.fullname" . }}-master +{{- end }} diff --git a/chart/external/templates/configmap-scripts.yaml b/chart/external/templates/configmap-scripts.yaml new file mode 100644 index 0000000..6d74027 --- /dev/null +++ b/chart/external/templates/configmap-scripts.yaml @@ -0,0 +1,430 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "redis.fullname" . }}-scripts + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} +data: +{{- if and .Values.cluster.enabled .Values.sentinel.enabled }} + start-node.sh: | + #!/bin/bash + + . /opt/bitnami/scripts/libos.sh + . /opt/bitnami/scripts/liblog.sh + . /opt/bitnami/scripts/libvalidations.sh + + not_exists_dns_entry() { + myip=$(hostname -i) + + if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep "^${myip}" )" ]]; then + warn "$HEADLESS_SERVICE does not contain the IP of this pod: ${myip}" + return 1 + fi + info "$HEADLESS_SERVICE has my IP: ${myip}" + return 0 + } + + HEADLESS_SERVICE="{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + REDIS_SERVICE="{{ template "redis.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + + # Waits for DNS to add this ip to the service DNS entry + retry_while not_exists_dns_entry + + export REDIS_REPLICATION_MODE="slave" + if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep -v "^$(hostname -i) ")" ]]; then + export REDIS_REPLICATION_MODE="master" + fi + + {{- if and .Values.securityContext.runAsUser (eq (.Values.securityContext.runAsUser | int) 0) }} + useradd redis + chown -R redis {{ .Values.slave.persistence.path }} + {{- end }} + + if [[ -n $REDIS_PASSWORD_FILE ]]; then + password_aux=`cat ${REDIS_PASSWORD_FILE}` + export REDIS_PASSWORD=$password_aux + fi + + if [[ -n $REDIS_MASTER_PASSWORD_FILE ]]; then + password_aux=`cat ${REDIS_MASTER_PASSWORD_FILE}` + export REDIS_MASTER_PASSWORD=$password_aux + fi + + if [[ "$REDIS_REPLICATION_MODE" == "master" ]]; then + echo "I am master" + if [[ ! -f /opt/bitnami/redis/etc/master.conf ]];then + cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf + fi + else + if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then + cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf + fi + + if is_boolean_yes "$REDIS_TLS_ENABLED"; then + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + else + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + fi + REDIS_SENTINEL_INFO=($($sentinel_info_command)) + REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]} + REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]} + + + # Immediately attempt to connect to the reported master. If it doesn't exist the connection attempt will either hang + # or fail with "port unreachable" and give no data. The liveness check will then timeout waiting for the redis + # container to be ready and restart the it. By then the new master will likely have been elected + if is_boolean_yes "$REDIS_TLS_ENABLED"; then + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + else + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + fi + + if [[ ! ($($sentinel_info_command)) ]]; then + # master doesn't actually exist, this probably means the remaining pods haven't elected a new one yet + # and are reporting the old one still. Once this happens the container will get stuck and never see the new + # master. We stop here to allow the container to not pass the liveness check and be restarted. + exit 1 + fi + fi + + if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then + cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf + fi + {{- if .Values.tls.enabled }} + ARGS=("--port" "0") + ARGS+=("--tls-port" "${REDIS_TLS_PORT}") + ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") + ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") + ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") + ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") + ARGS+=("--tls-replication" "yes") + {{- if .Values.tls.dhParamsFilename }} + ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") + {{- end }} + {{- else }} + ARGS=("--port" "${REDIS_PORT}") + {{- end }} + + if [[ "$REDIS_REPLICATION_MODE" == "slave" ]]; then + ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") + fi + + {{- if .Values.usePassword }} + ARGS+=("--requirepass" "${REDIS_PASSWORD}") + ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}") + {{- else }} + ARGS+=("--protected-mode" "no") + {{- end }} + + if [[ "$REDIS_REPLICATION_MODE" == "master" ]]; then + ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") + else + ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf") + fi + + ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") + {{- if .Values.slave.extraFlags }} + {{- range .Values.slave.extraFlags }} + ARGS+=({{ . | quote }}) + {{- end }} + {{- end }} + + {{- if .Values.slave.preExecCmds }} + {{ .Values.slave.preExecCmds | nindent 4}} + {{- end }} + + {{- if .Values.slave.command }} + exec {{ .Values.slave.command }} "${ARGS[@]}" + {{- else }} + exec redis-server "${ARGS[@]}" + {{- end }} + + start-sentinel.sh: | + #!/bin/bash + + . /opt/bitnami/scripts/libos.sh + . /opt/bitnami/scripts/libvalidations.sh + . /opt/bitnami/scripts/libfile.sh + + sentinel_conf_set() { + local -r key="${1:?missing key}" + local value="${2:-}" + + # Sanitize inputs + value="${value//\\/\\\\}" + value="${value//&/\\&}" + value="${value//\?/\\?}" + [[ "$value" = "" ]] && value="\"$value\"" + + replace_in_file "/opt/bitnami/redis-sentinel/etc/sentinel.conf" "^#*\s*${key} .*" "${key} ${value}" false + } + sentinel_conf_add() { + echo $'\n'"$@" >> "/opt/bitnami/redis-sentinel/etc/sentinel.conf" + } + host_id() { + echo "$1" | openssl sha1 | awk '{print $2}' + } + not_exists_dns_entry() { + myip=$(hostname -i) + + if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep "^${myip}" )" ]]; then + warn "$HEADLESS_SERVICE does not contain the IP of this pod: ${myip}" + return 1 + fi + info "$HEADLESS_SERVICE has my IP: ${myip}" + return 0 + } + + HEADLESS_SERVICE="{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + REDIS_SERVICE="{{ template "redis.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + + if [[ -n $REDIS_PASSWORD_FILE ]]; then + password_aux=`cat ${REDIS_PASSWORD_FILE}` + export REDIS_PASSWORD=$password_aux + fi + + if [[ ! -f /opt/bitnami/redis-sentinel/etc/sentinel.conf ]]; then + cp /opt/bitnami/redis-sentinel/mounted-etc/sentinel.conf /opt/bitnami/redis-sentinel/etc/sentinel.conf + {{- if .Values.usePassword }} + printf "\nsentinel auth-pass %s %s" "{{ .Values.sentinel.masterSet }}" "$REDIS_PASSWORD" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf + {{- if .Values.sentinel.usePassword }} + printf "\nrequirepass %s" "$REDIS_PASSWORD" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf + {{- end }} + {{- end }} + {{- if .Values.sentinel.staticID }} + printf "\nsentinel myid %s" "$(host_id "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf + {{- end }} + fi + + export REDIS_REPLICATION_MODE="slave" + + # Waits for DNS to add this ip to the service DNS entry + retry_while not_exists_dns_entry + + if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep -v "^$(hostname -i)")" ]]; then + export REDIS_REPLICATION_MODE="master" + fi + + # Clean sentineles from the current sentinel nodes + for node in $( getent ahosts "$HEADLESS_SERVICE" | grep -v "^$(hostname -i)" | cut -f 1 -d ' ' | uniq ); do + info "Cleaning sentinels in sentinel node: $node" + if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then + redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $node -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel reset "*" + else + redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $node -p {{ .Values.sentinel.port }} sentinel reset "*" + fi + sleep {{ .Values.sentinel.cleanDelaySeconds }} + done + info "Sentinels clean up done" + + if [[ "$REDIS_REPLICATION_MODE" == "master" ]]; then + REDIS_MASTER_HOST="$(hostname -i)" + REDIS_MASTER_PORT_NUMBER="{{ .Values.redisPort }}" + else + if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + else + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + fi + REDIS_SENTINEL_INFO=($($sentinel_info_command)) + REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]} + REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]} + + # Immediately attempt to connect to the reported master. If it doesn't exist the connection attempt will either hang + # or fail with "port unreachable" and give no data. The liveness check will then timeout waiting for the sentinel + # container to be ready and restart the it. By then the new master will likely have been elected + if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + else + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + fi + + if [[ ! ($($sentinel_info_command)) ]]; then + # master doesn't actually exist, this probably means the remaining pods haven't elected a new one yet + # and are reporting the old one still. Once this happens the container will get stuck and never see the new + # master. We stop here to allow the container to not pass the liveness check and be restarted. + exit 1 + fi + fi + sentinel_conf_set "sentinel monitor" "{{ .Values.sentinel.masterSet }} "$REDIS_MASTER_HOST" "$REDIS_MASTER_PORT_NUMBER" {{ .Values.sentinel.quorum }}" + + add_replica() { + if [[ "$1" != "$REDIS_MASTER_HOST" ]]; then + sentinel_conf_add "sentinel known-replica {{ .Values.sentinel.masterSet }} $1 {{ .Values.redisPort }}" + fi + } + + {{- if .Values.sentinel.staticID }} + # remove generated known sentinels and replicas + tmp="$(sed -e '/^sentinel known-/d' -e '/^$/d' /opt/bitnami/redis-sentinel/etc/sentinel.conf)" + echo "$tmp" > /opt/bitnami/redis-sentinel/etc/sentinel.conf + + for node in $(seq 0 {{ .Values.cluster.slaveCount }}); do + NAME="{{ template "redis.fullname" . }}-node-$node" + IP="$(getent hosts "$NAME.$HEADLESS_SERVICE" | awk ' {print $1 }')" + if [[ "$NAME" != "$HOSTNAME" && -n "$IP" ]]; then + sentinel_conf_add "sentinel known-sentinel {{ .Values.sentinel.masterSet }} $IP {{ .Values.sentinel.port }} $(host_id "$NAME")" + add_replica "$IP" + fi + done + add_replica "$(hostname -i)" + {{- end }} + + {{- if .Values.tls.enabled }} + ARGS=("--port" "0") + ARGS+=("--tls-port" "${REDIS_SENTINEL_TLS_PORT_NUMBER}") + ARGS+=("--tls-cert-file" "${REDIS_SENTINEL_TLS_CERT_FILE}") + ARGS+=("--tls-key-file" "${REDIS_SENTINEL_TLS_KEY_FILE}") + ARGS+=("--tls-ca-cert-file" "${REDIS_SENTINEL_TLS_CA_FILE}") + ARGS+=("--tls-replication" "yes") + ARGS+=("--tls-auth-clients" "${REDIS_SENTINEL_TLS_AUTH_CLIENTS}") + {{- if .Values.tls.dhParamsFilename }} + ARGS+=("--tls-dh-params-file" "${REDIS_SENTINEL_TLS_DH_PARAMS_FILE}") + {{- end }} + {{- end }} + {{- if .Values.sentinel.preExecCmds }} + {{ .Values.sentinel.preExecCmds | nindent 4 }} + {{- end }} + exec redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel {{- if .Values.tls.enabled }} "${ARGS[@]}" {{- end }} + prestop-sentinel.sh: | + #!/bin/bash + + . /opt/bitnami/scripts/libvalidations.sh + + REDIS_SERVICE="{{ include "redis.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + + if [[ -n "$REDIS_PASSWORD_FILE" ]]; then + password_aux=$(cat "$REDIS_PASSWORD_FILE") + export REDIS_PASSWORD="$password_aux" + fi + + if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a ${REDIS_PASSWORD} {{- end }} -h ${REDIS_SERVICE} -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + else + sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a ${REDIS_PASSWORD} {{- end }} -h ${REDIS_SERVICE} -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + fi + REDIS_SENTINEL_INFO=($($sentinel_info_command)) + REDIS_MASTER_HOST="${REDIS_SENTINEL_INFO[0]}" + + if [[ "$REDIS_MASTER_HOST" == "$(hostname -i)" ]]; then + if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then + redis-cli {{- if .Values.usePassword }} -a "$REDIS_PASSWORD" {{- end }} -h "$REDIS_SERVICE" -p {{ .Values.sentinel.port }} --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel failover mymaster + else + redis-cli {{- if .Values.usePassword }} -a "$REDIS_PASSWORD" {{- end }} -h "$REDIS_SERVICE" -p {{ .Values.sentinel.port }} sentinel failover mymaster + fi + fi +{{- else }} + start-master.sh: | + #!/bin/bash + {{- if and .Values.securityContext.runAsUser (eq (.Values.securityContext.runAsUser | int) 0) }} + useradd redis + chown -R redis {{ .Values.master.persistence.path }} + {{- end }} + if [[ -n $REDIS_PASSWORD_FILE ]]; then + password_aux=`cat ${REDIS_PASSWORD_FILE}` + export REDIS_PASSWORD=$password_aux + fi + if [[ ! -f /opt/bitnami/redis/etc/master.conf ]];then + cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf + fi + if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then + cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf + fi + {{- if .Values.tls.enabled }} + ARGS=("--port" "0") + ARGS+=("--tls-port" "${REDIS_TLS_PORT}") + ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") + ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") + ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") + ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") + {{- if .Values.tls.dhParamsFilename }} + ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") + {{- end }} + {{- else }} + ARGS=("--port" "${REDIS_PORT}") + {{- end }} + {{- if .Values.usePassword }} + ARGS+=("--requirepass" "${REDIS_PASSWORD}") + ARGS+=("--masterauth" "${REDIS_PASSWORD}") + {{- else }} + ARGS+=("--protected-mode" "no") + {{- end }} + ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") + ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") + {{- if .Values.master.extraFlags }} + {{- range .Values.master.extraFlags }} + ARGS+=({{ . | quote }}) + {{- end }} + {{- end }} + {{- if .Values.master.preExecCmds }} + {{ .Values.master.preExecCmds | nindent 4}} + {{- end }} + {{- if .Values.master.command }} + exec {{ .Values.master.command }} "${ARGS[@]}" + {{- else }} + exec redis-server "${ARGS[@]}" + {{- end }} + {{- if .Values.cluster.enabled }} + start-slave.sh: | + #!/bin/bash + {{- if and .Values.securityContext.runAsUser (eq (.Values.securityContext.runAsUser | int) 0) }} + useradd redis + chown -R redis {{ .Values.slave.persistence.path }} + {{- end }} + if [[ -n $REDIS_PASSWORD_FILE ]]; then + password_aux=`cat ${REDIS_PASSWORD_FILE}` + export REDIS_PASSWORD=$password_aux + fi + if [[ -n $REDIS_MASTER_PASSWORD_FILE ]]; then + password_aux=`cat ${REDIS_MASTER_PASSWORD_FILE}` + export REDIS_MASTER_PASSWORD=$password_aux + fi + if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then + cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf + fi + if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then + cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf + fi + {{- if .Values.tls.enabled }} + ARGS=("--port" "0") + ARGS+=("--tls-port" "${REDIS_TLS_PORT}") + ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") + ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") + ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") + ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") + ARGS+=("--tls-replication" "yes") + {{- if .Values.tls.dhParamsFilename }} + ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") + {{- end }} + {{- else }} + ARGS=("--port" "${REDIS_PORT}") + {{- end }} + ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") + {{- if .Values.usePassword }} + ARGS+=("--requirepass" "${REDIS_PASSWORD}") + ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}") + {{- else }} + ARGS+=("--protected-mode" "no") + {{- end }} + ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") + ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf") + {{- if .Values.slave.extraFlags }} + {{- range .Values.slave.extraFlags }} + ARGS+=({{ . | quote }}) + {{- end }} + {{- end }} + {{- if .Values.slave.preExecCmds }} + {{ .Values.slave.preExecCmds | nindent 4}} + {{- end }} + {{- if .Values.slave.command }} + exec {{ .Values.slave.command }} "${ARGS[@]}" + {{- else }} + exec redis-server "${ARGS[@]}" + {{- end }} + {{- end }} + +{{- end -}} diff --git a/chart/external/templates/configmap.yaml b/chart/external/templates/configmap.yaml new file mode 100644 index 0000000..77bdc81 --- /dev/null +++ b/chart/external/templates/configmap.yaml @@ -0,0 +1,53 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "redis.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} +data: + redis.conf: |- +{{- if .Values.configmap }} + # User-supplied configuration: +{{- tpl .Values.configmap . | nindent 4 }} +{{- end }} + master.conf: |- + dir {{ .Values.master.persistence.path }} +{{- if .Values.master.configmap }} + # User-supplied master configuration: +{{- tpl .Values.master.configmap . | nindent 4 }} +{{- end }} +{{- if .Values.master.disableCommands }} +{{- range .Values.master.disableCommands }} + rename-command {{ . }} "" +{{- end }} +{{- end }} + replica.conf: |- + dir {{ .Values.slave.persistence.path }} + slave-read-only yes +{{- if .Values.slave.configmap }} + # User-supplied slave configuration: +{{- tpl .Values.slave.configmap . | nindent 4 }} +{{- end }} +{{- if .Values.slave.disableCommands }} +{{- range .Values.slave.disableCommands }} + rename-command {{ . }} "" +{{- end }} +{{- end }} +{{- if .Values.sentinel.enabled }} + sentinel.conf: |- + dir "/tmp" + bind 0.0.0.0 + port {{ .Values.sentinel.port }} + sentinel monitor {{ .Values.sentinel.masterSet }} {{ template "redis.fullname" . }}-node-0.{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} {{ .Values.redisPort }} {{ .Values.sentinel.quorum }} + sentinel down-after-milliseconds {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.downAfterMilliseconds }} + sentinel failover-timeout {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.failoverTimeout }} + sentinel parallel-syncs {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.parallelSyncs }} +{{- if .Values.sentinel.configmap }} + # User-supplied sentinel configuration: +{{- tpl .Values.sentinel.configmap . | nindent 4 }} +{{- end }} +{{- end }} diff --git a/chart/external/templates/headless-svc.yaml b/chart/external/templates/headless-svc.yaml new file mode 100644 index 0000000..d758c0d --- /dev/null +++ b/chart/external/templates/headless-svc.yaml @@ -0,0 +1,28 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "redis.fullname" . }}-headless + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: ClusterIP + clusterIP: None + {{- if .Values.sentinel.enabled }} + publishNotReadyAddresses: true + {{- end }} + ports: + - name: tcp-redis + port: {{ .Values.redisPort }} + targetPort: redis + {{- if .Values.sentinel.enabled }} + - name: tcp-sentinel + port: {{ .Values.sentinel.port }} + targetPort: redis-sentinel + {{- end }} + selector: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} diff --git a/chart/external/templates/health-configmap.yaml b/chart/external/templates/health-configmap.yaml new file mode 100644 index 0000000..1bb8e74 --- /dev/null +++ b/chart/external/templates/health-configmap.yaml @@ -0,0 +1,176 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "redis.fullname" . }}-health + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} +data: + ping_readiness_local.sh: |- + #!/bin/bash +{{- if .Values.usePasswordFile }} + password_aux=`cat ${REDIS_PASSWORD_FILE}` + export REDIS_PASSWORD=$password_aux +{{- end }} + export REDISCLI_AUTH="$REDIS_PASSWORD" + response=$( + timeout -s 3 $1 \ + redis-cli \ + -h localhost \ +{{- if .Values.tls.enabled }} + -p $REDIS_TLS_PORT \ + --tls \ + --cacert {{ template "redis.tlsCACert" . }} \ + {{- if .Values.tls.authClients }} + --cert {{ template "redis.tlsCert" . }} \ + --key {{ template "redis.tlsCertKey" . }} \ + {{- end }} +{{- else }} + -p $REDIS_PORT \ +{{- end }} + ping + ) + if [ "$response" != "PONG" ]; then + echo "$response" + exit 1 + fi + ping_liveness_local.sh: |- + #!/bin/bash +{{- if .Values.usePasswordFile }} + password_aux=`cat ${REDIS_PASSWORD_FILE}` + export REDIS_PASSWORD=$password_aux +{{- end }} + export REDISCLI_AUTH="$REDIS_PASSWORD" + response=$( + timeout -s 3 $1 \ + redis-cli \ + -h localhost \ +{{- if .Values.tls.enabled }} + -p $REDIS_TLS_PORT \ + --tls \ + --cacert {{ template "redis.tlsCACert" . }} \ + {{- if .Values.tls.authClients }} + --cert {{ template "redis.tlsCert" . }} \ + --key {{ template "redis.tlsCertKey" . }} \ + {{- end }} +{{- else }} + -p $REDIS_PORT \ +{{- end }} + ping + ) + if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then + echo "$response" + exit 1 + fi +{{- if .Values.sentinel.enabled }} + ping_sentinel.sh: |- + #!/bin/bash +{{- if .Values.usePasswordFile }} + password_aux=`cat ${REDIS_PASSWORD_FILE}` + export REDIS_PASSWORD=$password_aux +{{- end }} + export REDISCLI_AUTH="$REDIS_PASSWORD" + response=$( + timeout -s 3 $1 \ + redis-cli \ + -h localhost \ +{{- if .Values.tls.enabled }} + -p $REDIS_SENTINEL_TLS_PORT_NUMBER \ + --tls \ + --cacert {{ template "redis.tlsCACert" . }} \ + {{- if .Values.tls.authClients }} + --cert {{ template "redis.tlsCert" . }} \ + --key {{ template "redis.tlsCertKey" . }} \ + {{- end }} +{{- else }} + -p $REDIS_SENTINEL_PORT \ +{{- end }} + ping + ) + if [ "$response" != "PONG" ]; then + echo "$response" + exit 1 + fi + parse_sentinels.awk: |- + /ip/ {FOUND_IP=1} + /port/ {FOUND_PORT=1} + /runid/ {FOUND_RUNID=1} + !/ip|port|runid/ { + if (FOUND_IP==1) { + IP=$1; FOUND_IP=0; + } + else if (FOUND_PORT==1) { + PORT=$1; + FOUND_PORT=0; + } else if (FOUND_RUNID==1) { + printf "\nsentinel known-sentinel {{ .Values.sentinel.masterSet }} %s %s %s", IP, PORT, $0; FOUND_RUNID=0; + } + } +{{- end }} + ping_readiness_master.sh: |- + #!/bin/bash +{{- if .Values.usePasswordFile }} + password_aux=`cat ${REDIS_MASTER_PASSWORD_FILE}` + export REDIS_MASTER_PASSWORD=$password_aux +{{- end }} + export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" + response=$( + timeout -s 3 $1 \ + redis-cli \ + -h $REDIS_MASTER_HOST \ + -p $REDIS_MASTER_PORT_NUMBER \ +{{- if .Values.tls.enabled }} + --tls \ + --cacert {{ template "redis.tlsCACert" . }} \ + {{- if .Values.tls.authClients }} + --cert {{ template "redis.tlsCert" . }} \ + --key {{ template "redis.tlsCertKey" . }} \ + {{- end }} +{{- end }} + ping + ) + if [ "$response" != "PONG" ]; then + echo "$response" + exit 1 + fi + ping_liveness_master.sh: |- + #!/bin/bash +{{- if .Values.usePasswordFile }} + password_aux=`cat ${REDIS_MASTER_PASSWORD_FILE}` + export REDIS_MASTER_PASSWORD=$password_aux +{{- end }} + export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" + response=$( + timeout -s 3 $1 \ + redis-cli \ + -h $REDIS_MASTER_HOST \ + -p $REDIS_MASTER_PORT_NUMBER \ +{{- if .Values.tls.enabled }} + --tls \ + --cacert {{ template "redis.tlsCACert" . }} \ + {{- if .Values.tls.authClients }} + --cert {{ template "redis.tlsCert" . }} \ + --key {{ template "redis.tlsCertKey" . }} \ + {{- end }} +{{- end }} + ping + ) + if [ "$response" != "PONG" ] && [ "$response" != "LOADING Redis is loading the dataset in memory" ]; then + echo "$response" + exit 1 + fi + ping_readiness_local_and_master.sh: |- + script_dir="$(dirname "$0")" + exit_status=0 + "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? + "$script_dir/ping_readiness_master.sh" $1 || exit_status=$? + exit $exit_status + ping_liveness_local_and_master.sh: |- + script_dir="$(dirname "$0")" + exit_status=0 + "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? + "$script_dir/ping_liveness_master.sh" $1 || exit_status=$? + exit $exit_status diff --git a/chart/external/templates/metrics-prometheus.yaml b/chart/external/templates/metrics-prometheus.yaml new file mode 100644 index 0000000..ed53dc6 --- /dev/null +++ b/chart/external/templates/metrics-prometheus.yaml @@ -0,0 +1,39 @@ +{{- if and (.Values.metrics.enabled) (.Values.metrics.serviceMonitor.enabled) }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "redis.fullname" . }} + {{- if .Values.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.metrics.serviceMonitor.namespace }} + {{- else }} + namespace: {{ .Release.Namespace | quote }} + {{- end }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- range $key, $value := .Values.metrics.serviceMonitor.selector }} + {{ $key }}: {{ $value | quote }} + {{- end }} +spec: + endpoints: + - port: metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }} + {{- end }} + selector: + matchLabels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + app.kubernetes.io/component: "metrics" + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} +{{- end -}} diff --git a/chart/external/templates/metrics-svc.yaml b/chart/external/templates/metrics-svc.yaml new file mode 100644 index 0000000..767a464 --- /dev/null +++ b/chart/external/templates/metrics-svc.yaml @@ -0,0 +1,34 @@ +{{- if .Values.metrics.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "redis.fullname" . }}-metrics + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + app.kubernetes.io/component: "metrics" + {{- if .Values.metrics.service.labels -}} + {{- toYaml .Values.metrics.service.labels | nindent 4 }} + {{- end -}} + {{- if .Values.metrics.service.annotations }} + annotations: {{- toYaml .Values.metrics.service.annotations | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.metrics.service.type }} + {{ if eq .Values.metrics.service.type "LoadBalancer" }} + externalTrafficPolicy: {{ .Values.metrics.service.externalTrafficPolicy }} + {{- end }} + {{ if and (eq .Values.metrics.service.type "LoadBalancer") .Values.metrics.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }} + {{- end }} + ports: + - name: metrics + port: 9121 + targetPort: metrics + selector: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} +{{- end }} diff --git a/chart/external/templates/networkpolicy.yaml b/chart/external/templates/networkpolicy.yaml new file mode 100644 index 0000000..0249bc0 --- /dev/null +++ b/chart/external/templates/networkpolicy.yaml @@ -0,0 +1,74 @@ +{{- if .Values.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ template "networkPolicy.apiVersion" . }} +metadata: + name: {{ template "redis.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + podSelector: + matchLabels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + {{- if .Values.cluster.enabled }} + policyTypes: + - Ingress + - Egress + egress: + # Allow dns resolution + - ports: + - port: 53 + protocol: UDP + # Allow outbound connections to other cluster pods + - ports: + - port: {{ .Values.redisPort }} + {{- if .Values.sentinel.enabled }} + - port: {{ .Values.sentinel.port }} + {{- end }} + to: + - podSelector: + matchLabels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + {{- end }} + ingress: + # Allow inbound connections + - ports: + - port: {{ .Values.redisPort }} + {{- if .Values.sentinel.enabled }} + - port: {{ .Values.sentinel.port }} + {{- end }} + {{- if not .Values.networkPolicy.allowExternal }} + from: + - podSelector: + matchLabels: + {{ template "redis.fullname" . }}-client: "true" + - podSelector: + matchLabels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + {{- if .Values.networkPolicy.ingressNSMatchLabels }} + - namespaceSelector: + matchLabels: + {{- range $key, $value := .Values.networkPolicy.ingressNSMatchLabels }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} + {{- if .Values.networkPolicy.ingressNSPodMatchLabels }} + podSelector: + matchLabels: + {{- range $key, $value := .Values.networkPolicy.ingressNSPodMatchLabels }} + {{ $key | quote }}: {{ $value | quote }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.metrics.enabled }} + # Allow prometheus scrapes for metrics + - ports: + - port: 9121 + {{- end }} +{{- end }} diff --git a/chart/external/templates/pdb.yaml b/chart/external/templates/pdb.yaml new file mode 100644 index 0000000..b9dc54b --- /dev/null +++ b/chart/external/templates/pdb.yaml @@ -0,0 +1,22 @@ +{{- if .Values.podDisruptionBudget.enabled }} +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: {{ template "redis.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} +spec: + {{- if .Values.podDisruptionBudget.minAvailable }} + minAvailable: {{ .Values.podDisruptionBudget.minAvailable }} + {{- end }} + {{- if .Values.podDisruptionBudget.maxUnavailable }} + maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} + {{- end }} + selector: + matchLabels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} +{{- end }} diff --git a/chart/external/templates/prometheusrule.yaml b/chart/external/templates/prometheusrule.yaml new file mode 100644 index 0000000..48ae017 --- /dev/null +++ b/chart/external/templates/prometheusrule.yaml @@ -0,0 +1,25 @@ +{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ template "redis.fullname" . }} + {{- if .Values.metrics.prometheusRule.namespace }} + namespace: {{ .Values.metrics.prometheusRule.namespace }} + {{- else }} + namespace: {{ .Release.Namespace | quote }} + {{- end }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name | quote }} + heritage: {{ .Release.Service | quote }} +{{- with .Values.metrics.prometheusRule.additionalLabels }} +{{- toYaml . | nindent 4 }} +{{- end }} +spec: +{{- with .Values.metrics.prometheusRule.rules }} + groups: + - name: {{ template "redis.name" $ }} + rules: {{- tpl (toYaml .) $ | nindent 8 }} +{{- end }} +{{- end }} diff --git a/chart/external/templates/psp.yaml b/chart/external/templates/psp.yaml new file mode 100644 index 0000000..eca04c1 --- /dev/null +++ b/chart/external/templates/psp.yaml @@ -0,0 +1,43 @@ +{{- if .Values.podSecurityPolicy.create }} +apiVersion: {{ template "podSecurityPolicy.apiVersion" . }} +kind: PodSecurityPolicy +metadata: + name: {{ template "redis.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} +spec: + allowPrivilegeEscalation: false + fsGroup: + rule: 'MustRunAs' + ranges: + - min: {{ .Values.securityContext.fsGroup }} + max: {{ .Values.securityContext.fsGroup }} + hostIPC: false + hostNetwork: false + hostPID: false + privileged: false + readOnlyRootFilesystem: false + requiredDropCapabilities: + - ALL + runAsUser: + rule: 'MustRunAs' + ranges: + - min: {{ .Values.containerSecurityContext.runAsUser }} + max: {{ .Values.containerSecurityContext.runAsUser }} + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: {{ .Values.containerSecurityContext.runAsUser }} + max: {{ .Values.containerSecurityContext.runAsUser }} + volumes: + - 'configMap' + - 'secret' + - 'emptyDir' + - 'persistentVolumeClaim' +{{- end }} diff --git a/chart/external/templates/redis-master-statefulset.yaml b/chart/external/templates/redis-master-statefulset.yaml new file mode 100644 index 0000000..ae138c0 --- /dev/null +++ b/chart/external/templates/redis-master-statefulset.yaml @@ -0,0 +1,382 @@ +{{- if or (not .Values.cluster.enabled) (not .Values.sentinel.enabled) }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ template "redis.fullname" . }}-master + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.master.statefulset.labels }} + {{- toYaml .Values.master.statefulset.labels | nindent 4 }} + {{- end }} +{{- if .Values.master.statefulset.annotations }} + annotations: + {{- toYaml .Values.master.statefulset.annotations | nindent 4 }} +{{- end }} +spec: + selector: + matchLabels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + role: master + serviceName: {{ template "redis.fullname" . }}-headless + template: + metadata: + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + role: master + {{- if .Values.master.podLabels }} + {{- toYaml .Values.master.podLabels | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} + {{- toYaml .Values.metrics.podLabels | nindent 8 }} + {{- end }} + annotations: + checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} + checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- if .Values.master.podAnnotations }} + {{- toYaml .Values.master.podAnnotations | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} + {{- toYaml .Values.metrics.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- include "redis.imagePullSecrets" . | nindent 6 }} + {{- if .Values.master.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.master.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.securityContext.enabled }} + securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "redis.serviceAccountName" . }} + {{- if .Values.master.priorityClassName }} + priorityClassName: {{ .Values.master.priorityClassName | quote }} + {{- end }} + {{- with .Values.master.affinity }} + affinity: {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- if .Values.master.nodeSelector }} + nodeSelector: {{- toYaml .Values.master.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.master.tolerations }} + tolerations: {{- toYaml .Values.master.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.master.shareProcessNamespace }} + shareProcessNamespace: {{ .Values.master.shareProcessNamespace }} + {{- end }} + {{- if .Values.master.schedulerName }} + schedulerName: {{ .Values.master.schedulerName }} + {{- end }} + containers: + - name: {{ template "redis.name" . }} + image: {{ template "redis.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - /opt/bitnami/scripts/start-scripts/start-master.sh + env: + - name: REDIS_REPLICATION_MODE + value: master + {{- if .Values.usePassword }} + {{- if .Values.usePasswordFile }} + - name: REDIS_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "yes" + {{- end }} + - name: REDIS_TLS_ENABLED + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: REDIS_TLS_PORT + value: {{ .Values.redisPort | quote }} + - name: REDIS_TLS_AUTH_CLIENTS + value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} + - name: REDIS_TLS_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_TLS_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_TLS_CA_FILE + value: {{ template "redis.tlsCACert" . }} + {{- if .Values.tls.dhParamsFilename }} + - name: REDIS_TLS_DH_PARAMS_FILE + value: {{ template "redis.tlsDHParams" . }} + {{- end }} + {{- else }} + - name: REDIS_PORT + value: {{ .Values.redisPort | quote }} + {{- end }} + {{- if .Values.master.extraEnvVars }} + {{- include "redis.tplValue" (dict "value" .Values.master.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.master.extraEnvVarsCM .Values.master.extraEnvVarsSecret }} + envFrom: + {{- if .Values.master.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.master.extraEnvVarsCM }} + {{- end }} + {{- if .Values.master.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.master.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: redis + containerPort: {{ .Values.redisPort }} + {{- if .Values.master.livenessProbe.enabled }} + livenessProbe: + initialDelaySeconds: {{ .Values.master.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.master.livenessProbe.periodSeconds }} + # One second longer than command timeout should prevent generation of zombie processes. + timeoutSeconds: {{ add1 .Values.master.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.master.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.master.livenessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_liveness_local.sh {{ .Values.master.livenessProbe.timeoutSeconds }} + {{- else if .Values.master.customLivenessProbe }} + livenessProbe: {{- toYaml .Values.master.customLivenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.master.readinessProbe.enabled}} + readinessProbe: + initialDelaySeconds: {{ .Values.master.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.master.readinessProbe.periodSeconds }} + timeoutSeconds: {{ add1 .Values.master.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.master.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.master.readinessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_readiness_local.sh {{ .Values.master.readinessProbe.timeoutSeconds }} + {{- else if .Values.master.customReadinessProbe }} + readinessProbe: {{- toYaml .Values.master.customReadinessProbe | nindent 12 }} + {{- end }} + resources: {{- toYaml .Values.master.resources | nindent 12 }} + volumeMounts: + - name: start-scripts + mountPath: /opt/bitnami/scripts/start-scripts + - name: health + mountPath: /health + {{- if .Values.usePasswordFile }} + - name: redis-password + mountPath: /opt/bitnami/redis/secrets/ + {{- end }} + - name: redis-data + mountPath: {{ .Values.master.persistence.path }} + subPath: {{ .Values.master.persistence.subPath }} + - name: config + mountPath: /opt/bitnami/redis/mounted-etc + - name: redis-tmp-conf + mountPath: /opt/bitnami/redis/etc/ + - name: tmp + mountPath: /tmp + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ template "redis.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - | + if [[ -f '/secrets/redis-password' ]]; then + export REDIS_PASSWORD=$(cat /secrets/redis-password) + fi + redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "redis.fullname" . }} + {{- if and .Values.usePassword (not .Values.usePasswordFile) }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: REDIS_ADDR + value: rediss://localhost:{{ .Values.redisPort }} + - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_EXPORTER_TLS_CA_CERT_FILE + value: {{ template "redis.tlsCACert" . }} + {{- end }} + volumeMounts: + {{- if .Values.usePasswordFile }} + - name: redis-password + mountPath: /secrets/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + ports: + - name: metrics + containerPort: 9121 + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- end }} + {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.master.persistence.enabled .Values.securityContext.enabled .Values.containerSecurityContext.enabled }} + {{- if or $needsVolumePermissions .Values.sysctlImage.enabled }} + initContainers: + {{- if $needsVolumePermissions }} + - name: volume-permissions + image: "{{ template "redis.volumePermissions.image" . }}" + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.master.persistence.path }} + {{- else }} + chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} {{ .Values.master.persistence.path }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto "}} + securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} + {{- end }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: redis-data + mountPath: {{ .Values.master.persistence.path }} + subPath: {{ .Values.master.persistence.subPath }} + {{- end }} + {{- if .Values.sysctlImage.enabled }} + - name: init-sysctl + image: {{ template "redis.sysctl.image" . }} + imagePullPolicy: {{ default "" .Values.sysctlImage.pullPolicy | quote }} + resources: {{- toYaml .Values.sysctlImage.resources | nindent 10 }} + {{- if .Values.sysctlImage.mountHostSys }} + volumeMounts: + - name: host-sys + mountPath: /host-sys + {{- end }} + command: {{- toYaml .Values.sysctlImage.command | nindent 10 }} + securityContext: + privileged: true + runAsUser: 0 + {{- end }} + {{- end }} + volumes: + - name: start-scripts + configMap: + name: {{ include "redis.fullname" . }}-scripts + defaultMode: 0755 + - name: health + configMap: + name: {{ template "redis.fullname" . }}-health + defaultMode: 0755 + {{- if .Values.usePasswordFile }} + - name: redis-password + secret: + secretName: {{ template "redis.secretName" . }} + items: + - key: {{ template "redis.secretPasswordKey" . }} + path: redis-password + {{- end }} + - name: config + configMap: + name: {{ template "redis.fullname" . }} + {{- if not .Values.master.persistence.enabled }} + - name: "redis-data" + emptyDir: {} + {{- else }} + {{- if .Values.persistence.existingClaim }} + - name: "redis-data" + persistentVolumeClaim: + claimName: {{ include "redis.tplValue" (dict "value" .Values.persistence.existingClaim "context" $) }} + {{- end }} + {{- if .Values.master.persistence.volumes }} + {{- toYaml .Values.master.persistence.volumes | nindent 8 }} + {{- end }} + {{- end }} + {{- if .Values.sysctlImage.mountHostSys }} + - name: host-sys + hostPath: + path: /sys + {{- end }} + - name: redis-tmp-conf + emptyDir: {} + - name: tmp + emptyDir: {} + {{- if .Values.tls.enabled }} + - name: redis-certificates + secret: + secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }} + defaultMode: 256 + {{- end }} + {{- if and .Values.master.persistence.enabled (not .Values.persistence.existingClaim) (not .Values.master.persistence.volumes) }} + volumeClaimTemplates: + - metadata: + name: redis-data + labels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + component: master + {{- if .Values.master.statefulset.volumeClaimTemplates.labels }} + {{- toYaml .Values.master.statefulset.volumeClaimTemplates.labels | nindent 10 }} + {{- end }} + {{- if .Values.master.statefulset.volumeClaimTemplates.annotations }} + annotations: + {{- toYaml .Values.master.statefulset.volumeClaimTemplates.annotations | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.master.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.master.persistence.size | quote }} + {{ include "redis.master.storageClass" . }} + selector: + {{- if .Values.master.persistence.matchLabels }} + matchLabels: {{- toYaml .Values.master.persistence.matchLabels | nindent 12 }} + {{- end -}} + {{- if .Values.master.persistence.matchExpressions }} + matchExpressions: {{- toYaml .Values.master.persistence.matchExpressions | nindent 12 }} + {{- end -}} + {{- end }} + updateStrategy: + type: {{ .Values.master.statefulset.updateStrategy }} + {{- if .Values.master.statefulset.rollingUpdatePartition }} + {{- if (eq "Recreate" .Values.master.statefulset.updateStrategy) }} + rollingUpdate: null + {{- else }} + rollingUpdate: + partition: {{ .Values.master.statefulset.rollingUpdatePartition }} + {{- end }} + {{- end }} +{{- end }} diff --git a/chart/external/templates/redis-master-svc.yaml b/chart/external/templates/redis-master-svc.yaml new file mode 100644 index 0000000..8bd2f8c --- /dev/null +++ b/chart/external/templates/redis-master-svc.yaml @@ -0,0 +1,43 @@ +{{- if not .Values.sentinel.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "redis.fullname" . }}-master + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.master.service.labels -}} + {{- toYaml .Values.master.service.labels | nindent 4 }} + {{- end -}} +{{- if .Values.master.service.annotations }} + annotations: {{- toYaml .Values.master.service.annotations | nindent 4 }} +{{- end }} +spec: + type: {{ .Values.master.service.type }} + {{ if eq .Values.master.service.type "LoadBalancer" }} + externalTrafficPolicy: {{ .Values.master.service.externalTrafficPolicy }} + {{- end }} + {{- if and (eq .Values.master.service.type "LoadBalancer") .Values.master.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.master.service.loadBalancerIP }} + {{- end }} + {{- if and (eq .Values.master.service.type "LoadBalancer") .Values.master.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: + {{- with .Values.master.service.loadBalancerSourceRanges }} +{{- toYaml . | nindent 4 }} +{{- end }} + {{- end }} + ports: + - name: tcp-redis + port: {{ .Values.master.service.port }} + targetPort: redis + {{- if .Values.master.service.nodePort }} + nodePort: {{ .Values.master.service.nodePort }} + {{- end }} + selector: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + role: master +{{- end }} diff --git a/chart/external/templates/redis-node-statefulset.yaml b/chart/external/templates/redis-node-statefulset.yaml new file mode 100644 index 0000000..5a83a62 --- /dev/null +++ b/chart/external/templates/redis-node-statefulset.yaml @@ -0,0 +1,507 @@ +{{- if and .Values.cluster.enabled .Values.sentinel.enabled }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ template "redis.fullname" . }}-node + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.slave.statefulset.labels }} + {{- toYaml .Values.slave.statefulset.labels | nindent 4 }} + {{- end }} +{{- if .Values.slave.statefulset.annotations }} + annotations: + {{- toYaml .Values.slave.statefulset.annotations | nindent 4 }} +{{- end }} +spec: +{{- if .Values.slave.updateStrategy }} + strategy: {{- toYaml .Values.slave.updateStrategy | nindent 4 }} +{{- end }} + replicas: {{ .Values.cluster.slaveCount }} + serviceName: {{ template "redis.fullname" . }}-headless + selector: + matchLabels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + role: node + template: + metadata: + labels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + chart: {{ template "redis.chart" . }} + role: node + {{- if .Values.slave.podLabels }} + {{- toYaml .Values.slave.podLabels | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} + {{- toYaml .Values.metrics.podLabels | nindent 8 }} + {{- end }} + annotations: + checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} + checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- if .Values.slave.podAnnotations }} + {{- toYaml .Values.slave.podAnnotations | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} + {{- toYaml .Values.metrics.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- include "redis.imagePullSecrets" . | nindent 6 }} + {{- if .Values.slave.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.slave.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.securityContext.enabled }} + securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "redis.serviceAccountName" . }} + {{- if .Values.slave.priorityClassName }} + priorityClassName: "{{ .Values.slave.priorityClassName }}" + {{- end }} + {{- if .Values.slave.nodeSelector }} + nodeSelector: {{- toYaml .Values.slave.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.slave.tolerations }} + tolerations: {{- toYaml .Values.slave.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.slave.schedulerName }} + schedulerName: {{ .Values.slave.schedulerName }} + {{- end }} + {{- if .Values.master.spreadConstraints }} + topologySpreadConstraints: {{- toYaml .Values.master.spreadConstraints | nindent 8 }} + {{- end }} + {{- with .Values.slave.affinity }} + affinity: {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + containers: + - name: {{ template "redis.name" . }} + image: {{ template "redis.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - /opt/bitnami/scripts/start-scripts/start-node.sh + env: + - name: REDIS_MASTER_PORT_NUMBER + value: {{ .Values.redisPort | quote }} + {{- if .Values.usePassword }} + {{- if .Values.usePasswordFile }} + - name: REDIS_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + - name: REDIS_MASTER_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + - name: REDIS_MASTER_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "yes" + {{- end }} + - name: REDIS_TLS_ENABLED + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: REDIS_TLS_PORT + value: {{ .Values.redisPort | quote }} + - name: REDIS_TLS_AUTH_CLIENTS + value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} + - name: REDIS_TLS_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_TLS_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_TLS_CA_FILE + value: {{ template "redis.tlsCACert" . }} + {{- if .Values.tls.dhParamsFilename }} + - name: REDIS_TLS_DH_PARAMS_FILE + value: {{ template "redis.tlsDHParams" . }} + {{- end }} + {{- else }} + - name: REDIS_PORT + value: {{ .Values.redisPort | quote }} + {{- end }} + - name: REDIS_DATA_DIR + value: {{ .Values.slave.persistence.path }} + {{- if .Values.sentinel.extraEnvVars }} + {{- include "redis.tplValue" (dict "value" .Values.sentinel.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.sentinel.extraEnvVarsCM .Values.sentinel.extraEnvVarsSecret }} + envFrom: + {{- if .Values.sentinel.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.sentinel.extraEnvVarsCM }} + {{- end }} + {{- if .Values.sentinel.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.sentinel.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: redis + containerPort: {{ .Values.redisPort }} + {{- if .Values.slave.livenessProbe.enabled }} + livenessProbe: + initialDelaySeconds: {{ .Values.slave.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.slave.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.slave.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.slave.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.slave.livenessProbe.failureThreshold}} + exec: + command: + - sh + - -c + {{- if .Values.sentinel.enabled }} + - /health/ping_liveness_local.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} + {{- else }} + - /health/ping_liveness_local_and_master.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} + {{- end }} + {{- else if .Values.slave.customLivenessProbe }} + livenessProbe: {{- toYaml .Values.slave.customLivenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.slave.readinessProbe.enabled }} + readinessProbe: + initialDelaySeconds: {{ .Values.slave.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.slave.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.slave.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.slave.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.slave.readinessProbe.failureThreshold }} + exec: + command: + - sh + - -c + {{- if .Values.sentinel.enabled }} + - /health/ping_readiness_local.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} + {{- else }} + - /health/ping_readiness_local_and_master.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} + {{- end }} + {{- else if .Values.slave.customReadinessProbe }} + readinessProbe: {{- toYaml .Values.slave.customReadinessProbe | nindent 12 }} + {{- end }} + resources: {{- toYaml .Values.slave.resources | nindent 12 }} + volumeMounts: + - name: start-scripts + mountPath: /opt/bitnami/scripts/start-scripts + - name: health + mountPath: /health + {{- if .Values.usePasswordFile }} + - name: redis-password + mountPath: /opt/bitnami/redis/secrets/ + {{- end }} + - name: redis-data + mountPath: {{ .Values.slave.persistence.path }} + subPath: {{ .Values.slave.persistence.subPath }} + - name: config + mountPath: /opt/bitnami/redis/mounted-etc + - name: redis-tmp-conf + mountPath: /opt/bitnami/redis/etc + - name: tmp + mountPath: /tmp + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- if and .Values.cluster.enabled .Values.sentinel.enabled }} + - name: sentinel + image: {{ template "sentinel.image" . }} + imagePullPolicy: {{ .Values.sentinel.image.pullPolicy | quote }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - /opt/bitnami/scripts/start-scripts/start-sentinel.sh + env: + {{- if .Values.usePassword }} + {{- if .Values.usePasswordFile }} + - name: REDIS_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "yes" + {{- end }} + - name: REDIS_SENTINEL_TLS_ENABLED + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: REDIS_SENTINEL_TLS_PORT_NUMBER + value: {{ .Values.sentinel.port | quote }} + - name: REDIS_SENTINEL_TLS_AUTH_CLIENTS + value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} + - name: REDIS_SENTINEL_TLS_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_SENTINEL_TLS_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_SENTINEL_TLS_CA_FILE + value: {{ template "redis.tlsCACert" . }} + {{- if .Values.tls.dhParamsFilename }} + - name: REDIS_SENTINEL_TLS_DH_PARAMS_FILE + value: {{ template "redis.dhParams" . }} + {{- end }} + {{- else }} + - name: REDIS_SENTINEL_PORT + value: {{ .Values.sentinel.port | quote }} + {{- end }} + ports: + - name: redis-sentinel + containerPort: {{ .Values.sentinel.port }} + {{- if .Values.sentinel.livenessProbe.enabled }} + livenessProbe: + initialDelaySeconds: {{ .Values.sentinel.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.sentinel.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.sentinel.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.sentinel.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.sentinel.livenessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_sentinel.sh {{ .Values.sentinel.livenessProbe.timeoutSeconds }} + {{- else if .Values.sentinel.customLivenessProbe }} + livenessProbe: {{- toYaml .Values.sentinel.customLivenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.sentinel.readinessProbe.enabled}} + readinessProbe: + initialDelaySeconds: {{ .Values.sentinel.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.sentinel.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.sentinel.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.sentinel.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.sentinel.readinessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_sentinel.sh {{ .Values.sentinel.livenessProbe.timeoutSeconds }} + {{- else if .Values.sentinel.customReadinessProbe }} + readinessProbe: {{- toYaml .Values.sentinel.customReadinessProbe | nindent 12 }} + {{- end }} + lifecycle: + preStop: + exec: + command: + - /bin/bash + - -c + - /opt/bitnami/scripts/start-scripts/prestop-sentinel.sh + resources: {{- toYaml .Values.sentinel.resources | nindent 12 }} + volumeMounts: + - name: start-scripts + mountPath: /opt/bitnami/scripts/start-scripts + - name: health + mountPath: /health + {{- if .Values.usePasswordFile }} + - name: redis-password + mountPath: /opt/bitnami/redis/secrets/ + {{- end }} + - name: redis-data + mountPath: {{ .Values.slave.persistence.path }} + subPath: {{ .Values.slave.persistence.subPath }} + - name: config + mountPath: /opt/bitnami/redis-sentinel/mounted-etc + - name: sentinel-tmp-conf + mountPath: /opt/bitnami/redis-sentinel/etc + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ template "redis.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - | + if [[ -f '/secrets/redis-password' ]]; then + export REDIS_PASSWORD=$(cat /secrets/redis-password) + fi + redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "redis.fullname" . }} + {{- if and .Values.usePassword (not .Values.usePasswordFile) }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: REDIS_ADDR + value: rediss://localhost:{{ .Values.redisPort }} + - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_EXPORTER_TLS_CA_CERT_FILE + value: {{ template "redis.tlsCACert" . }} + {{- end }} + volumeMounts: + {{- if .Values.usePasswordFile }} + - name: redis-password + mountPath: /secrets/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + ports: + - name: metrics + containerPort: 9121 + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- end }} + {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.slave.persistence.enabled .Values.securityContext.enabled .Values.containerSecurityContext.enabled }} + {{- if or $needsVolumePermissions .Values.sysctlImage.enabled }} + initContainers: + {{- if $needsVolumePermissions }} + - name: volume-permissions + image: {{ template "redis.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.slave.persistence.path }} + {{- else }} + chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} {{ .Values.slave.persistence.path }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto "}} + securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} + {{- end }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + volumeMounts: + - name: redis-data + mountPath: {{ .Values.slave.persistence.path }} + subPath: {{ .Values.slave.persistence.subPath }} + {{- end }} + {{- if .Values.sysctlImage.enabled }} + - name: init-sysctl + image: {{ template "redis.sysctl.image" . }} + imagePullPolicy: {{ default "" .Values.sysctlImage.pullPolicy | quote }} + resources: {{- toYaml .Values.sysctlImage.resources | nindent 12 }} + {{- if .Values.sysctlImage.mountHostSys }} + volumeMounts: + - name: host-sys + mountPath: /host-sys + {{- end }} + command: {{- toYaml .Values.sysctlImage.command | nindent 12 }} + securityContext: + privileged: true + runAsUser: 0 + {{- end }} + {{- end }} + volumes: + - name: start-scripts + configMap: + name: {{ include "redis.fullname" . }}-scripts + defaultMode: 0755 + - name: health + configMap: + name: {{ template "redis.fullname" . }}-health + defaultMode: 0755 + {{- if .Values.usePasswordFile }} + - name: redis-password + secret: + secretName: {{ template "redis.secretName" . }} + items: + - key: {{ template "redis.secretPasswordKey" . }} + path: redis-password + {{- end }} + - name: config + configMap: + name: {{ template "redis.fullname" . }} + {{- if .Values.sysctlImage.mountHostSys }} + - name: host-sys + hostPath: + path: /sys + {{- end }} + - name: sentinel-tmp-conf + emptyDir: {} + - name: redis-tmp-conf + emptyDir: {} + - name: tmp + emptyDir: {} + {{- if .Values.tls.enabled }} + - name: redis-certificates + secret: + secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }} + defaultMode: 256 + {{- end }} + {{- if not .Values.slave.persistence.enabled }} + - name: redis-data + emptyDir: {} + {{- else }} + volumeClaimTemplates: + - metadata: + name: redis-data + labels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + component: slave + {{- if .Values.slave.statefulset.volumeClaimTemplates }} + {{- if .Values.slave.statefulset.volumeClaimTemplates.labels }} + {{- toYaml .Values.slave.statefulset.volumeClaimTemplates.labels | nindent 10 }} + {{- end }} + {{- if .Values.slave.statefulset.volumeClaimTemplates.annotations }} + annotations: + {{- toYaml .Values.slave.statefulset.volumeClaimTemplates.annotations | nindent 10 }} + {{- end }} + {{- end }} + spec: + accessModes: + {{- range .Values.slave.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.slave.persistence.size | quote }} + {{ include "redis.slave.storageClass" . }} + selector: + {{- if .Values.slave.persistence.matchLabels }} + matchLabels: {{- toYaml .Values.slave.persistence.matchLabels | nindent 12 }} + {{- end -}} + {{- if .Values.slave.persistence.matchExpressions }} + matchExpressions: {{- toYaml .Values.slave.persistence.matchExpressions | nindent 12 }} + {{- end -}} + {{- end }} + updateStrategy: + type: {{ .Values.slave.statefulset.updateStrategy }} + {{- if .Values.slave.statefulset.rollingUpdatePartition }} + {{- if (eq "Recreate" .Values.slave.statefulset.updateStrategy) }} + rollingUpdate: null + {{- else }} + rollingUpdate: + partition: {{ .Values.slave.statefulset.rollingUpdatePartition }} + {{- end }} + {{- end }} +{{- end }} diff --git a/chart/external/templates/redis-role.yaml b/chart/external/templates/redis-role.yaml new file mode 100644 index 0000000..080a7f9 --- /dev/null +++ b/chart/external/templates/redis-role.yaml @@ -0,0 +1,22 @@ +{{- if .Values.rbac.create -}} +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +kind: Role +metadata: + name: {{ template "redis.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +{{- if .Values.podSecurityPolicy.create }} + - apiGroups: ['{{ template "podSecurityPolicy.apiGroup" . }}'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: [{{ template "redis.fullname" . }}] +{{- end -}} +{{- if .Values.rbac.role.rules }} +{{- toYaml .Values.rbac.role.rules | nindent 2 }} +{{- end -}} +{{- end -}} diff --git a/chart/external/templates/redis-rolebinding.yaml b/chart/external/templates/redis-rolebinding.yaml new file mode 100644 index 0000000..835aa03 --- /dev/null +++ b/chart/external/templates/redis-rolebinding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.rbac.create -}} +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +kind: RoleBinding +metadata: + name: {{ template "redis.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "redis.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "redis.serviceAccountName" . }} +{{- end -}} diff --git a/chart/external/templates/redis-serviceaccount.yaml b/chart/external/templates/redis-serviceaccount.yaml new file mode 100644 index 0000000..081691d --- /dev/null +++ b/chart/external/templates/redis-serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "redis.serviceAccountName" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.serviceAccount.annotations }} + annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }} + {{- end }} +{{- end -}} diff --git a/chart/external/templates/redis-slave-statefulset.yaml b/chart/external/templates/redis-slave-statefulset.yaml new file mode 100644 index 0000000..ef653b0 --- /dev/null +++ b/chart/external/templates/redis-slave-statefulset.yaml @@ -0,0 +1,386 @@ +{{- if and .Values.cluster.enabled (not .Values.sentinel.enabled) }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ template "redis.fullname" . }}-slave + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.slave.statefulset.labels }} + {{- toYaml .Values.slave.statefulset.labels | nindent 4 }} + {{- end }} +{{- if .Values.slave.statefulset.annotations }} + annotations: + {{- toYaml .Values.slave.statefulset.annotations | nindent 4 }} +{{- end }} +spec: +{{- if .Values.slave.updateStrategy }} + strategy: {{- toYaml .Values.slave.updateStrategy | nindent 4 }} +{{- end }} + replicas: {{ .Values.cluster.slaveCount }} + serviceName: {{ template "redis.fullname" . }}-headless + selector: + matchLabels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + role: slave + template: + metadata: + labels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + chart: {{ template "redis.chart" . }} + role: slave + {{- if .Values.slave.podLabels }} + {{- toYaml .Values.slave.podLabels | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} + {{- toYaml .Values.metrics.podLabels | nindent 8 }} + {{- end }} + annotations: + checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} + checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- if .Values.slave.podAnnotations }} + {{- toYaml .Values.slave.podAnnotations | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} + {{- toYaml .Values.metrics.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- include "redis.imagePullSecrets" . | nindent 6 }} + {{- if .Values.slave.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.slave.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.securityContext.enabled }} + securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "redis.serviceAccountName" . }} + {{- if .Values.slave.priorityClassName }} + priorityClassName: {{ .Values.slave.priorityClassName | quote }} + {{- end }} + {{- if .Values.slave.nodeSelector }} + nodeSelector: {{- toYaml .Values.slave.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.slave.tolerations }} + tolerations: {{- toYaml .Values.slave.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.slave.shareProcessNamespace }} + shareProcessNamespace: {{ .Values.slave.shareProcessNamespace }} + {{- end }} + {{- if .Values.slave.schedulerName }} + schedulerName: {{ .Values.slave.schedulerName }} + {{- end }} + {{- if .Values.master.spreadConstraints }} + topologySpreadConstraints: {{- toYaml .Values.master.spreadConstraints | nindent 8 }} + {{- end }} + {{- with .Values.slave.affinity }} + affinity: {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + containers: + - name: {{ template "redis.name" . }} + image: {{ template "redis.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - /opt/bitnami/scripts/start-scripts/start-slave.sh + env: + - name: REDIS_REPLICATION_MODE + value: slave + - name: REDIS_MASTER_HOST + value: {{ template "redis.fullname" . }}-master-0.{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} + - name: REDIS_MASTER_PORT_NUMBER + value: {{ .Values.redisPort | quote }} + {{- if .Values.usePassword }} + {{- if .Values.usePasswordFile }} + - name: REDIS_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + - name: REDIS_MASTER_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + - name: REDIS_MASTER_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "yes" + {{- end }} + - name: REDIS_TLS_ENABLED + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: REDIS_TLS_PORT + value: {{ .Values.redisPort | quote }} + - name: REDIS_TLS_AUTH_CLIENTS + value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} + - name: REDIS_TLS_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_TLS_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_TLS_CA_FILE + value: {{ template "redis.tlsCACert" . }} + {{- if .Values.tls.dhParamsFilename }} + - name: REDIS_TLS_DH_PARAMS_FILE + value: {{ template "redis.tlsDHParams" . }} + {{- end }} + {{- else }} + - name: REDIS_PORT + value: {{ .Values.redisPort | quote }} + {{- end }} + {{- if .Values.slave.extraEnvVars }} + {{- include "redis.tplValue" (dict "value" .Values.slave.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.slave.extraEnvVarsCM .Values.slave.extraEnvVarsSecret }} + envFrom: + {{- if .Values.slave.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.slave.extraEnvVarsCM }} + {{- end }} + {{- if .Values.slave.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.slave.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: redis + containerPort: {{ .Values.redisPort }} + {{- if .Values.slave.livenessProbe.enabled }} + livenessProbe: + initialDelaySeconds: {{ .Values.slave.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.slave.livenessProbe.periodSeconds }} + timeoutSeconds: {{ add1 .Values.slave.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.slave.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.slave.livenessProbe.failureThreshold}} + exec: + command: + - sh + - -c + - /health/ping_liveness_local_and_master.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} + {{- else if .Values.slave.customLivenessProbe }} + livenessProbe: {{- toYaml .Values.slave.customLivenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.slave.readinessProbe.enabled }} + readinessProbe: + initialDelaySeconds: {{ .Values.slave.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.slave.readinessProbe.periodSeconds }} + timeoutSeconds: {{ add1 .Values.slave.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.slave.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.slave.readinessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_readiness_local_and_master.sh {{ .Values.slave.readinessProbe.timeoutSeconds }} + {{- else if .Values.slave.customReadinessProbe }} + readinessProbe: {{- toYaml .Values.slave.customReadinessProbe | nindent 12 }} + {{- end }} + resources: {{- toYaml .Values.slave.resources | nindent 12 }} + volumeMounts: + - name: start-scripts + mountPath: /opt/bitnami/scripts/start-scripts + - name: health + mountPath: /health + {{- if .Values.usePasswordFile }} + - name: redis-password + mountPath: /opt/bitnami/redis/secrets/ + {{- end }} + - name: redis-data + mountPath: /data + - name: config + mountPath: /opt/bitnami/redis/mounted-etc + - name: redis-tmp-conf + mountPath: /opt/bitnami/redis/etc + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ template "redis.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - | + if [[ -f '/secrets/redis-password' ]]; then + export REDIS_PASSWORD=$(cat /secrets/redis-password) + fi + redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "redis.fullname" . }} + {{- if and .Values.usePassword (not .Values.usePasswordFile) }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: REDIS_ADDR + value: rediss://localhost:{{ .Values.redisPort }} + - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_EXPORTER_TLS_CA_CERT_FILE + value: {{ template "redis.tlsCACert" . }} + {{- end }} + volumeMounts: + {{- if .Values.usePasswordFile }} + - name: redis-password + mountPath: /secrets/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + ports: + - name: metrics + containerPort: 9121 + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- end }} + {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.slave.persistence.enabled .Values.securityContext.enabled .Values.containerSecurityContext.enabled }} + {{- if or $needsVolumePermissions .Values.sysctlImage.enabled }} + initContainers: + {{- if $needsVolumePermissions }} + - name: volume-permissions + image: {{ template "redis.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.slave.persistence.path }} + {{- else }} + chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} {{ .Values.slave.persistence.path }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto "}} + securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} + {{- end }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + volumeMounts: + - name: redis-data + mountPath: {{ .Values.slave.persistence.path }} + subPath: {{ .Values.slave.persistence.subPath }} + {{- end }} + {{- if .Values.sysctlImage.enabled }} + - name: init-sysctl + image: {{ template "redis.sysctl.image" . }} + imagePullPolicy: {{ default "" .Values.sysctlImage.pullPolicy | quote }} + resources: {{- toYaml .Values.sysctlImage.resources | nindent 12 }} + {{- if .Values.sysctlImage.mountHostSys }} + volumeMounts: + - name: host-sys + mountPath: /host-sys + {{- end }} + command: {{- toYaml .Values.sysctlImage.command | nindent 12 }} + securityContext: + privileged: true + runAsUser: 0 + {{- end }} + {{- end }} + volumes: + - name: start-scripts + configMap: + name: {{ include "redis.fullname" . }}-scripts + defaultMode: 0755 + - name: health + configMap: + name: {{ template "redis.fullname" . }}-health + defaultMode: 0755 + {{- if .Values.usePasswordFile }} + - name: redis-password + secret: + secretName: {{ template "redis.secretName" . }} + items: + - key: {{ template "redis.secretPasswordKey" . }} + path: redis-password + {{- end }} + - name: config + configMap: + name: {{ template "redis.fullname" . }} + {{- if .Values.sysctlImage.mountHostSys }} + - name: host-sys + hostPath: + path: /sys + {{- end }} + - name: redis-tmp-conf + emptyDir: {} + {{- if .Values.tls.enabled }} + - name: redis-certificates + secret: + secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }} + defaultMode: 256 + {{- end }} + {{- if not .Values.slave.persistence.enabled }} + - name: redis-data + emptyDir: {} + {{- else }} + volumeClaimTemplates: + - metadata: + name: redis-data + labels: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + component: slave + {{- if .Values.slave.statefulset.volumeClaimTemplates }} + {{- if .Values.slave.statefulset.volumeClaimTemplates.labels }} + {{- toYaml .Values.slave.statefulset.volumeClaimTemplates.labels | nindent 10 }} + {{- end }} + {{- if .Values.slave.statefulset.volumeClaimTemplates.annotations }} + annotations: + {{- toYaml .Values.slave.statefulset.volumeClaimTemplates.annotations | nindent 10 }} + {{- end }} + {{- end }} + spec: + accessModes: + {{- range .Values.slave.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.slave.persistence.size | quote }} + {{ include "redis.slave.storageClass" . }} + selector: + {{- if .Values.slave.persistence.matchLabels }} + matchLabels: {{- toYaml .Values.slave.persistence.matchLabels | nindent 12 }} + {{- end -}} + {{- if .Values.slave.persistence.matchExpressions }} + matchExpressions: {{- toYaml .Values.slave.persistence.matchExpressions | nindent 12 }} + {{- end -}} + {{- end }} + updateStrategy: + type: {{ .Values.slave.statefulset.updateStrategy }} + {{- if .Values.slave.statefulset.rollingUpdatePartition }} + {{- if (eq "Recreate" .Values.slave.statefulset.updateStrategy) }} + rollingUpdate: null + {{- else }} + rollingUpdate: + partition: {{ .Values.slave.statefulset.rollingUpdatePartition }} + {{- end }} + {{- end }} +{{- end }} diff --git a/chart/external/templates/redis-slave-svc.yaml b/chart/external/templates/redis-slave-svc.yaml new file mode 100644 index 0000000..a67ebb0 --- /dev/null +++ b/chart/external/templates/redis-slave-svc.yaml @@ -0,0 +1,43 @@ +{{- if and .Values.cluster.enabled (not .Values.sentinel.enabled) }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "redis.fullname" . }}-slave + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.slave.service.labels -}} + {{- toYaml .Values.slave.service.labels | nindent 4 }} + {{- end -}} +{{- if .Values.slave.service.annotations }} + annotations: {{- toYaml .Values.slave.service.annotations | nindent 4 }} +{{- end }} +spec: + type: {{ .Values.slave.service.type }} + {{ if eq .Values.slave.service.type "LoadBalancer" }} + externalTrafficPolicy: {{ .Values.slave.service.externalTrafficPolicy }} + {{- end }} + {{- if and (eq .Values.slave.service.type "LoadBalancer") .Values.slave.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.slave.service.loadBalancerIP }} + {{- end }} + {{- if and (eq .Values.slave.service.type "LoadBalancer") .Values.slave.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: + {{- with .Values.slave.service.loadBalancerSourceRanges }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} + ports: + - name: tcp-redis + port: {{ .Values.slave.service.port }} + targetPort: redis + {{- if .Values.slave.service.nodePort }} + nodePort: {{ .Values.slave.service.nodePort }} + {{- end }} + selector: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} + role: slave +{{- end }} diff --git a/chart/external/templates/redis-with-sentinel-svc.yaml b/chart/external/templates/redis-with-sentinel-svc.yaml new file mode 100644 index 0000000..e1c9073 --- /dev/null +++ b/chart/external/templates/redis-with-sentinel-svc.yaml @@ -0,0 +1,43 @@ +{{- if .Values.sentinel.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "redis.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.sentinel.service.labels }} + {{- toYaml .Values.sentinel.service.labels | nindent 4 }} + {{- end }} +{{- if .Values.sentinel.service.annotations }} + annotations: {{- toYaml .Values.sentinel.service.annotations | nindent 4 }} +{{- end }} +spec: + type: {{ .Values.sentinel.service.type }} + {{ if eq .Values.sentinel.service.type "LoadBalancer" }} + externalTrafficPolicy: {{ .Values.sentinel.service.externalTrafficPolicy }} + {{- end }} + {{ if eq .Values.sentinel.service.type "LoadBalancer" -}} {{ if .Values.sentinel.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.sentinel.service.loadBalancerIP }} + {{ end -}} + {{- end -}} + ports: + - name: tcp-redis + port: {{ .Values.sentinel.service.redisPort }} + targetPort: redis + {{- if .Values.sentinel.service.redisNodePort }} + nodePort: {{ .Values.sentinel.service.redisNodePort }} + {{- end }} + - name: tcp-sentinel + port: {{ .Values.sentinel.service.sentinelPort }} + targetPort: redis-sentinel + {{- if .Values.sentinel.service.sentinelNodePort }} + nodePort: {{ .Values.sentinel.service.sentinelNodePort }} + {{- end }} + selector: + app: {{ template "redis.name" . }} + release: {{ .Release.Name }} +{{- end }} diff --git a/chart/external/templates/secret.yaml b/chart/external/templates/secret.yaml new file mode 100644 index 0000000..043edfe --- /dev/null +++ b/chart/external/templates/secret.yaml @@ -0,0 +1,23 @@ +{{- if and .Values.usePassword (not .Values.existingSecret) -}} +{{- $secretName := include "redis.fullname" . -}} +{{- $secret := (lookup "v1" "Secret" .Release.Namespace $secretName ) -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +type: Opaque +data: +{{ if $secret }} +{{ with $secret }} + redis-password: {{ get .data "redis-password" }} +{{ end }} +{{ else }} + redis-password: {{ include "redis.password" . | b64enc | quote }} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/chart/external/values.schema.json b/chart/external/values.schema.json new file mode 100644 index 0000000..3188d0c --- /dev/null +++ b/chart/external/values.schema.json @@ -0,0 +1,168 @@ +{ + "$schema": "http://json-schema.org/schema#", + "type": "object", + "properties": { + "usePassword": { + "type": "boolean", + "title": "Use password authentication", + "form": true + }, + "password": { + "type": "string", + "title": "Password", + "form": true, + "description": "Defaults to a random 10-character alphanumeric string if not set", + "hidden": { + "value": false, + "path": "usePassword" + } + }, + "cluster": { + "type": "object", + "title": "Cluster Settings", + "form": true, + "properties": { + "enabled": { + "type": "boolean", + "form": true, + "title": "Enable master-slave", + "description": "Enable master-slave architecture" + }, + "slaveCount": { + "type": "integer", + "title": "Slave Replicas", + "form": true, + "hidden": { + "value": false, + "path": "cluster/enabled" + } + } + } + }, + "master": { + "type": "object", + "title": "Master replicas settings", + "form": true, + "properties": { + "persistence": { + "type": "object", + "title": "Persistence for master replicas", + "form": true, + "properties": { + "enabled": { + "type": "boolean", + "form": true, + "title": "Enable persistence", + "description": "Enable persistence using Persistent Volume Claims" + }, + "size": { + "type": "string", + "title": "Persistent Volume Size", + "form": true, + "render": "slider", + "sliderMin": 1, + "sliderMax": 100, + "sliderUnit": "Gi", + "hidden": { + "value": false, + "path": "master/persistence/enabled" + } + }, + "matchLabels": { + "type": "object", + "title": "Persistent Match Labels Selector" + }, + "matchExpressions": { + "type": "object", + "title": "Persistent Match Expressions Selector" + } + } + } + } + }, + "slave": { + "type": "object", + "title": "Slave replicas settings", + "form": true, + "hidden": { + "value": false, + "path": "cluster/enabled" + }, + "properties": { + "persistence": { + "type": "object", + "title": "Persistence for slave replicas", + "form": true, + "properties": { + "enabled": { + "type": "boolean", + "form": true, + "title": "Enable persistence", + "description": "Enable persistence using Persistent Volume Claims" + }, + "size": { + "type": "string", + "title": "Persistent Volume Size", + "form": true, + "render": "slider", + "sliderMin": 1, + "sliderMax": 100, + "sliderUnit": "Gi", + "hidden": { + "value": false, + "path": "slave/persistence/enabled" + } + }, + "matchLabels": { + "type": "object", + "title": "Persistent Match Labels Selector" + }, + "matchExpressions": { + "type": "object", + "title": "Persistent Match Expressions Selector" + } + } + } + } + }, + "volumePermissions": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "form": true, + "title": "Enable Init Containers", + "description": "Use an init container to set required folder permissions on the data volume before mounting it in the final destination" + } + } + }, + "metrics": { + "type": "object", + "form": true, + "title": "Prometheus metrics details", + "properties": { + "enabled": { + "type": "boolean", + "title": "Create Prometheus metrics exporter", + "description": "Create a side-car container to expose Prometheus metrics", + "form": true + }, + "serviceMonitor": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "title": "Create Prometheus Operator ServiceMonitor", + "description": "Create a ServiceMonitor to track metrics using Prometheus Operator", + "form": true, + "hidden": { + "value": false, + "path": "metrics/enabled" + } + } + } + } + } + } + } +} diff --git a/chart/external/values.yaml b/chart/external/values.yaml new file mode 100644 index 0000000..2409edb --- /dev/null +++ b/chart/external/values.yaml @@ -0,0 +1,959 @@ +# BigBang + +hostname: bigbang.dev +istio: + enabled: false + redis: + # due to the complexity around this configuration, the redis virtual service is disabled by default + enabled: false + labels: {} + annotations: {} + gateway: + port: 15443 + # TCP connections don't have host headers, so * is required + hosts: + - "*" + +monitoring: + enabled: false + + + + +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## +global: + # imageRegistry: myRegistryName + imagePullSecrets: + - private-registry + # storageClass: myStorageClass + redis: {} + +## Bitnami Redis(TM) image version +## ref: https://hub.docker.com/r/bitnami/redis/tags/ +## +image: + registry: registry1.dso.mil + repository: ironbank/bitnami/redis + ## Bitnami Redis(TM) image tag + ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links + ## + tag: 6.0.10 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - private-registry + +## String to partially override redis.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override redis.fullname template +## +# fullnameOverride: + +## Cluster settings +## +cluster: + enabled: true + slaveCount: 2 + +## Use redis sentinel in the redis pod. This will disable the master and slave services and +## create one redis service with ports to the sentinel and the redis instances +## +sentinel: + enabled: false + ## Require password authentication on the sentinel itself + ## ref: https://redis.io/topics/sentinel + ## + usePassword: true + ## Bitnami Redis(TM) Sentintel image version + ## ref: https://hub.docker.com/r/bitnami/redis-sentinel/tags/ + ## + image: + registry: docker.io + repository: bitnami/redis-sentinel + ## Bitnami Redis(TM) image tag + ## ref: https://github.com/bitnami/bitnami-docker-redis-sentinel#supported-tags-and-respective-dockerfile-links + ## + tag: 6.0.12-debian-10-r0 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + masterSet: mymaster + initialCheckTimeout: 5 + quorum: 2 + downAfterMilliseconds: 20000 + failoverTimeout: 18000 + parallelSyncs: 1 + port: 26379 + + ## Delay seconds when cleaning nodes IPs + ## When starting it will clean the sentiles IP (RESET "*") in all the nodes + ## This is the delay time before sending the command to the next node + ## + cleanDelaySeconds: 5 + + ## Additional Redis(TM) configuration for the sentinel nodes + ## ref: https://redis.io/topics/config + ## + configmap: + ## Enable or disable static sentinel IDs for each replicas + ## If disabled each sentinel will generate a random id at startup + ## If enabled, each replicas will have a constant ID on each start-up + ## + staticID: false + ## Configure extra options for Redis(TM) Sentinel liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + customLivenessProbe: {} + customReadinessProbe: {} + ## Redis(TM) Sentinel resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + # resources: + # requests: + # memory: 256Mi + # cpu: 100m + ## Redis(TM) Sentinel Service properties + ## + service: + ## Redis(TM) Sentinel Service type + ## + type: ClusterIP + sentinelPort: 26379 + redisPort: 6379 + + ## External traffic policy (when service type is LoadBalancer) + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + + ## Specify the nodePort value for the LoadBalancer and NodePort service types. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + # sentinelNodePort: + # redisNodePort: + + ## Provide any additional annotations which may be required. This can be used to + ## set the LoadBalancer service type to internal only. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + annotations: {} + labels: {} + loadBalancerIP: + + ## Additional commands to run prior to starting Redis(TM) node with sentinel + ## + preExecCmds: "" + + ## An array to add extra env var to the sentinel node configurations + ## For example: + ## extraEnvVars: + ## - name: name + ## value: value + ## - name: other_name + ## valueFrom: + ## fieldRef: + ## fieldPath: fieldPath + ## + extraEnvVars: [] + + ## ConfigMap with extra env vars: + ## + extraEnvVarsCM: [] + + ## Secret with extra env vars: + ## + extraEnvVarsSecret: [] + +## Specifies the Kubernetes Cluster's Domain Name. +## +clusterDomain: cluster.local + +networkPolicy: + ## Specifies whether a NetworkPolicy should be created + ## + enabled: false + + ## The Policy model to apply. When set to false, only pods with the correct + ## client label will have network access to the port Redis(TM) is listening + ## on. When true, Redis(TM) will accept connections from any source + ## (with the correct destination port). + ## + # allowExternal: true + + ## Allow connections from other namespaces. Just set label for namespace and set label for pods (optional). + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + +serviceAccount: + ## Specifies whether a ServiceAccount should be created + ## + create: false + ## The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the fullname template + ## + name: + ## Add annotations to service account + # annotations: + # iam.gke.io/gcp-service-account: "sa@project.iam.gserviceaccount.com" + +rbac: + ## Specifies whether RBAC resources should be created + ## + create: false + + role: + ## Rules to create. It follows the role specification + # rules: + # - apiGroups: + # - extensions + # resources: + # - podsecuritypolicies + # verbs: + # - use + # resourceNames: + # - gce.unprivileged + rules: [] + +## Redis(TM) pod Security Context +## +securityContext: + enabled: true + fsGroup: 1001 + ## sysctl settings for master and slave pods + ## + ## Uncomment the setting below to increase the net.core.somaxconn value + ## + # sysctls: + # - name: net.core.somaxconn + # value: "10000" + +## Container Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +containerSecurityContext: + enabled: true + runAsUser: 1001 + +## Use password authentication +## +usePassword: true +## Redis(TM) password (both master and slave) +## Defaults to a random 10-character alphanumeric string if not set and usePassword is true +## ref: https://github.com/bitnami/bitnami-docker-redis#setting-the-server-password-on-first-run +## +password: "" +## Use existing secret (ignores previous password) +# existingSecret: +## Password key to be retrieved from Redis(TM) secret +## +# existingSecretPasswordKey: + +## Mount secrets as files instead of environment variables +## +usePasswordFile: false + +## Persist data to a persistent volume (Redis(TM) Master) +## +persistence: + ## A manually managed Persistent Volume and Claim + ## Requires persistence.enabled: true + ## If defined, PVC must be created manually before volume will be bound + ## + existingClaim: + +# Redis(TM) port +redisPort: 6379 + +## +## TLS configuration +## +tls: + # Enable TLS traffic + enabled: false + # + # Whether to require clients to authenticate or not. + authClients: true + # + # Name of the Secret that contains the certificates + certificatesSecret: + # + # Certificate filename + certFilename: + # + # Certificate Key filename + certKeyFilename: + # + # CA Certificate filename + certCAFilename: + # + # File containing DH params (in order to support DH based ciphers) + # dhParamsFilename: + +## +## Redis(TM) Master parameters +## +master: + ## Redis(TM) command arguments + ## + ## Can be used to specify command line arguments, for example: + ## Note `exec` is prepended to command + ## + command: "/run.sh" + ## Additional commands to run prior to starting Redis(TM) + ## + preExecCmds: "" + ## Additional Redis(TM) configuration for the master nodes + ## ref: https://redis.io/topics/config + ## + configmap: + ## Deployment pod host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## Redis(TM) additional command line flags + ## + ## Can be used to specify command line flags, for example: + ## extraFlags: + ## - "--maxmemory-policy volatile-ttl" + ## - "--repl-backlog-size 1024mb" + ## + extraFlags: [] + ## Comma-separated list of Redis(TM) commands to disable + ## + ## Can be used to disable Redis(TM) commands for security reasons. + ## Commands will be completely disabled by renaming each to an empty string. + ## ref: https://redis.io/topics/security#disabling-of-specific-commands + ## + disableCommands: + - FLUSHDB + - FLUSHALL + + ## Redis(TM) Master additional pod labels and annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + podAnnotations: {} + + ## Redis(TM) Master resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 256Mi + cpu: 100m + ## Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + # schedulerName: + + # Enable shared process namespace in a pod. + # If set to false (default), each container will run in separate namespace, redis will have PID=1. + # If set to true, the /pause will run as init process and will reap any zombie PIDs, + # for example, generated by a custom exec probe running longer than a probe timeoutSeconds. + # Enable this only if customLivenessProbe or customReadinessProbe is used and zombie PIDs are accumulating. + # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/ + shareProcessNamespace: false + ## Configure extra options for Redis(TM) Master liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + + ## Configure custom probes for images other images like + ## rhscl/redis-32-rhel7 rhscl/redis-5-rhel7 + ## Only used if readinessProbe.enabled: false / livenessProbe.enabled: false + ## + # customLivenessProbe: + # tcpSocket: + # port: 6379 + # initialDelaySeconds: 10 + # periodSeconds: 5 + # customReadinessProbe: + # initialDelaySeconds: 30 + # periodSeconds: 10 + # timeoutSeconds: 5 + # exec: + # command: + # - "container-entrypoint" + # - "bash" + # - "-c" + # - "redis-cli set liveness-probe \"`date`\" | grep OK" + customLivenessProbe: {} + customReadinessProbe: {} + + ## Redis(TM) Master Node selectors and tolerations for pod assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature + ## + # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} + # tolerations: [] + ## Redis(TM) Master pod/node affinity/anti-affinity + ## + affinity: {} + + ## Redis(TM) Master Service properties + ## + service: + ## Redis(TM) Master Service type + ## + type: ClusterIP + port: 6379 + + ## External traffic policy (when service type is LoadBalancer) + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + + ## Specify the nodePort value for the LoadBalancer and NodePort service types. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + # nodePort: + + ## Provide any additional annotations which may be required. This can be used to + ## set the LoadBalancer service type to internal only. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + annotations: {} + labels: {} + loadBalancerIP: + # loadBalancerSourceRanges: ["10.0.0.0/8"] + + ## Enable persistence using Persistent Volume Claims + ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + persistence: + enabled: true + ## The path the volume will be mounted at, useful when using different + ## Redis(TM) images. + ## + path: /data + ## The subdirectory of the volume to mount to, useful in dev environments + ## and one PV for multiple services. + ## + subPath: "" + ## redis data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + accessModes: + - ReadWriteOnce + size: 8Gi + ## Persistent Volume selectors + ## https://kubernetes.io/docs/concepts/storage/persistent-volumes/#selector + ## + matchLabels: {} + matchExpressions: {} + volumes: + # - name: volume_name + # emptyDir: {} + + ## Update strategy, can be set to RollingUpdate or onDelete by default. + ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets + ## + statefulset: + labels: {} + annotations: {} + updateStrategy: RollingUpdate + ## Partition update strategy + ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions + # rollingUpdatePartition: + volumeClaimTemplates: + labels: {} + annotations: {} + + ## Redis(TM) Master pod priorityClassName + ## + priorityClassName: {} + + ## An array to add extra env vars + ## For example: + ## extraEnvVars: + ## - name: name + ## value: value + ## - name: other_name + ## valueFrom: + ## fieldRef: + ## fieldPath: fieldPath + ## + extraEnvVars: [] + + ## ConfigMap with extra env vars: + ## + extraEnvVarsCM: [] + + ## Secret with extra env vars: + ## + extraEnvVarsSecret: [] + +## +## Redis(TM) Slave properties +## Note: service.type is a mandatory parameter +## The rest of the parameters are either optional or, if undefined, will inherit those declared in Redis(TM) Master +## +slave: + ## Slave Service properties + ## + service: + ## Redis(TM) Slave Service type + ## + type: ClusterIP + ## Redis(TM) port + ## + port: 6379 + + ## External traffic policy (when service type is LoadBalancer) + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + + ## Specify the nodePort value for the LoadBalancer and NodePort service types. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + # nodePort: + + ## Provide any additional annotations which may be required. This can be used to + ## set the LoadBalancer service type to internal only. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + annotations: {} + labels: {} + loadBalancerIP: + # loadBalancerSourceRanges: ["10.0.0.0/8"] + + ## Redis(TM) slave port + ## + port: 6379 + ## Deployment pod host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## Can be used to specify command line arguments, for example: + ## Note `exec` is prepended to command + ## + command: "/run.sh" + ## Additional commands to run prior to starting Redis(TM) + ## + preExecCmds: "" + ## Additional Redis(TM) configuration for the slave nodes + ## ref: https://redis.io/topics/config + ## + configmap: + ## Redis(TM) extra flags + ## + extraFlags: [] + ## List of Redis(TM) commands to disable + ## + disableCommands: + - FLUSHDB + - FLUSHALL + + ## Redis(TM) Slave pod/node affinity/anti-affinity + ## + affinity: {} + + ## Kubernetes Spread Constraints for pod assignment + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## + # - maxSkew: 1 + # topologyKey: node + # whenUnsatisfiable: DoNotSchedule + spreadConstraints: {} + + # Enable shared process namespace in a pod. + # If set to false (default), each container will run in separate namespace, redis will have PID=1. + # If set to true, the /pause will run as init process and will reap any zombie PIDs, + # for example, generated by a custom exec probe running longer than a probe timeoutSeconds. + # Enable this only if customLivenessProbe or customReadinessProbe is used and zombie PIDs are accumulating. + # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/ + shareProcessNamespace: false + ## Configure extra options for Redis(TM) Slave liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 10 + successThreshold: 1 + failureThreshold: 5 + + ## Configure custom probes for images other images like + ## rhscl/redis-32-rhel7 rhscl/redis-5-rhel7 + ## Only used if readinessProbe.enabled: false / livenessProbe.enabled: false + ## + # customLivenessProbe: + # tcpSocket: + # port: 6379 + # initialDelaySeconds: 10 + # periodSeconds: 5 + # customReadinessProbe: + # initialDelaySeconds: 30 + # periodSeconds: 10 + # timeoutSeconds: 5 + # exec: + # command: + # - "container-entrypoint" + # - "bash" + # - "-c" + # - "redis-cli set liveness-probe \"`date`\" | grep OK" + customLivenessProbe: {} + customReadinessProbe: {} + + ## Redis(TM) slave Resource + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 256Mi + cpu: 100m + + ## Redis(TM) slave selectors and tolerations for pod assignment + # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} + # tolerations: [] + + ## Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + # schedulerName: + + ## Redis(TM) slave pod Annotation and Labels + ## + podLabels: {} + podAnnotations: {} + + ## Redis(TM) slave pod priorityClassName + priorityClassName: {} + + ## Enable persistence using Persistent Volume Claims + ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + persistence: + enabled: true + ## The path the volume will be mounted at, useful when using different + ## Redis(TM) images. + ## + path: /data + ## The subdirectory of the volume to mount to, useful in dev environments + ## and one PV for multiple services. + ## + subPath: "" + ## redis data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + accessModes: + - ReadWriteOnce + size: 8Gi + ## Persistent Volume selectors + ## https://kubernetes.io/docs/concepts/storage/persistent-volumes/#selector + ## + matchLabels: {} + matchExpressions: {} + + ## Update strategy, can be set to RollingUpdate or onDelete by default. + ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets + ## + statefulset: + labels: {} + annotations: {} + updateStrategy: RollingUpdate + ## Partition update strategy + ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions + # rollingUpdatePartition: + volumeClaimTemplates: + labels: {} + annotations: {} + + ## An array to add extra env vars + ## For example: + ## extraEnvVars: + ## - name: name + ## value: value + ## - name: other_name + ## valueFrom: + ## fieldRef: + ## fieldPath: fieldPath + ## + extraEnvVars: [] + + ## ConfigMap with extra env vars: + ## + extraEnvVarsCM: [] + + ## Secret with extra env vars: + ## + extraEnvVarsSecret: [] + +## Prometheus Exporter / Metrics +## +metrics: + enabled: false + + image: + registry: registry1.dso.mil + repository: ironbank/bitnami/analytics/redis-exporter + tag: 1.6.1 + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - private-registry + + ## Metrics exporter resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + # resources: {} + + ## Extra arguments for Metrics exporter, for example: + ## extraArgs: + ## check-keys: myKey,myOtherKey + # extraArgs: {} + + ## Metrics exporter pod Annotation and Labels + ## + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9121" + # podLabels: {} + + # Enable this if you're using https://github.com/coreos/prometheus-operator + serviceMonitor: + enabled: false + ## Specify a namespace if needed + namespace: monitoring + # fallback to the prometheus default unless specified + # interval: 10s + ## Defaults to what's used if you follow CoreOS [Prometheus Install Instructions](https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#tldr) + ## [Prometheus Selector Label](https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-operator-1) + ## [Kube Prometheus Selector Label](https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#exporters) + ## + selector: + prometheus: kube-prometheus + + ## RelabelConfigs to apply to samples before scraping + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig + ## Value is evalued as a template + ## + relabelings: [] + + ## MetricRelabelConfigs to apply to samples before ingestion + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig + ## Value is evalued as a template + ## + metricRelabelings: [] + # - sourceLabels: + # - "__name__" + # targetLabel: "__name__" + # action: replace + # regex: '(.*)' + # replacement: 'example_prefix_$1' + + ## Custom PrometheusRule to be defined + ## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart + ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions + ## + prometheusRule: + enabled: false + additionalLabels: {} + namespace: "" + ## Redis(TM) prometheus rules + ## These are just examples rules, please adapt them to your needs. + ## Make sure to constraint the rules to the current redis service. + # rules: + # - alert: RedisDown + # expr: redis_up{service="{{ template "redis.fullname" . }}-metrics"} == 0 + # for: 2m + # labels: + # severity: error + # annotations: + # summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} down + # description: Redis(TM) instance {{ "{{ $labels.instance }}" }} is down + # - alert: RedisMemoryHigh + # expr: > + # redis_memory_used_bytes{service="{{ template "redis.fullname" . }}-metrics"} * 100 + # / + # redis_memory_max_bytes{service="{{ template "redis.fullname" . }}-metrics"} + # > 90 + # for: 2m + # labels: + # severity: error + # annotations: + # summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} is using too much memory + # description: | + # Redis(TM) instance {{ "{{ $labels.instance }}" }} is using {{ "{{ $value }}" }}% of its available memory. + # - alert: RedisKeyEviction + # expr: | + # increase(redis_evicted_keys_total{service="{{ template "redis.fullname" . }}-metrics"}[5m]) > 0 + # for: 1s + # labels: + # severity: error + # annotations: + # summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} has evicted keys + # description: | + # Redis(TM) instance {{ "{{ $labels.instance }}" }} has evicted {{ "{{ $value }}" }} keys in the last 5 minutes. + rules: [] + + ## Metrics exporter pod priorityClassName + priorityClassName: {} + service: + type: ClusterIP + + ## External traffic policy (when service type is LoadBalancer) + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + + ## Use serviceLoadBalancerIP to request a specific static IP, + ## otherwise leave blank + # loadBalancerIP: + annotations: {} + labels: {} + +## +## Init containers parameters: +## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/bitnami-shell + tag: "10" + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + # resources: + # requests: + # memory: 128Mi + # cpu: 100m + + ## Init container Security Context + ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser + ## and not the below volumePermissions.securityContext.runAsUser + ## When runAsUser is set to special value "auto", init container will try to chwon the + ## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` + ## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed). + ## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with + ## podSecurityContext.enabled=false,containerSecurityContext.enabled=false + ## + securityContext: + runAsUser: 0 + +## Redis(TM) config file +## ref: https://redis.io/topics/config +## +configmap: |- + # Enable AOF https://redis.io/topics/persistence#append-only-file + appendonly yes + # Disable RDB persistence, AOF persistence already enabled. + save "" + +## Sysctl InitContainer +## used to perform sysctl operation to modify Kernel settings (needed sometimes to avoid warnings) +## +sysctlImage: + enabled: false + command: [] + registry: docker.io + repository: bitnami/bitnami-shell + tag: "10" + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + mountHostSys: false + resources: {} + # resources: + # requests: + # memory: 128Mi + # cpu: 100m + +## PodSecurityPolicy configuration +## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +## +podSecurityPolicy: + ## Specifies whether a PodSecurityPolicy should be created + ## + create: false + +## Define a disruption budget +## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ +## +podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 diff --git a/chart/requirements.yaml b/chart/requirements.yaml new file mode 100644 index 0000000..e28df53 --- /dev/null +++ b/chart/requirements.yaml @@ -0,0 +1,7 @@ +dependencies: +- name: redis + version: 12.8.3-bb.0 + repository: file://external + condition: redis-ha.enabled + alias: redis-bb + -- GitLab From 4abcb584033034ed5aee83b7d7176693a89b69c1 Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Mon, 15 Mar 2021 17:21:10 -0400 Subject: [PATCH 02/11] updated redis --- tests/test-values.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/test-values.yml b/tests/test-values.yml index b6c85e9..33f2c2d 100644 --- a/tests/test-values.yml +++ b/tests/test-values.yml @@ -14,6 +14,11 @@ anchoreAnalyzer: anchoreEnterpriseGlobal: imagePullSecretName: private-registry-mil + +redis: + imagePullSecrets: [name: private-registry-mil] + + anchore-feeds-db: imagePullSecrets: private-registry-mil anchore-ui-redis: -- GitLab From 07157dad0d0d60be786cfe1c783f1588bcaa8c5c Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Mon, 15 Mar 2021 19:14:47 -0400 Subject: [PATCH 03/11] test values updated for redis --- chart/Chart.lock | 14 ++++---------- chart/charts/redis-12.8.3-bb.0.tgz | Bin 74866 -> 74876 bytes tests/test-values.yml | 2 +- 3 files changed, 5 insertions(+), 11 deletions(-) diff --git a/chart/Chart.lock b/chart/Chart.lock index 4fca5d3..7a3be40 100644 --- a/chart/Chart.lock +++ b/chart/Chart.lock @@ -1,12 +1,6 @@ dependencies: -- name: postgresql - repository: file://./deps/postgresql - version: 1.0.1 -- name: postgresql - repository: file://./deps/postgresql - version: 1.0.1 - name: redis - repository: https://charts.bitnami.com/bitnami - version: "10" -digest: sha256:c7ab83a0a5f6ecb74d55eb5351685835921684213e99b77b7b680b649b3804f6 -generated: "2021-03-03T08:04:23.320462-07:00" + repository: file://external + version: 12.8.3-bb.0 +digest: sha256:3e24ade3fda030262fb391fe38958d8ddc1394544aa9c14271f90c18bd6abc05 +generated: "2021-03-15T19:10:24.91091-04:00" diff --git a/chart/charts/redis-12.8.3-bb.0.tgz b/chart/charts/redis-12.8.3-bb.0.tgz index 7e332aba35c6f8e0e727eb1d1d1d0de291851407..00009f60a0a2bb40e127a315178668ef4d9ece04 100644 GIT binary patch delta 74510 zcmV)KK)S#3$OQbz1dvF7*%P~KN|s-eR=YX7uI;wIO&mYA+y3@8T^AxD3C9${5}+NO z#P=iJ4{<-)eegztucBnxNm}tdr?E(2FaQRFnZaNt#y(-aqX~+6cZR0HzdXXTv$M1F zVt-%$yR)-X{I|cqbMPU6t-RbssJCg(fK7UQq{qFnj`;L#97n6v~S8pR60;5Un z;cY^T=Cou+w z<69g9BcX={ECwD5!J{EZBoyUHIA+^0L2QEAHUxxmwhat(1}OA_(U@ajK*XGNI}<8K z#(xaLnD9w5v^%fIrN?88dsD(cg@a&GpzML@y+Z7#@W7ToxNXYr0A|gABV_6hW5eWun1aQp$+d`rP zdh);3lbMyreoVao_AwLSrYPnl?2h8JLVxZJi6rXxGICf2kM2$gD zjX{^tUMC}<-R{@jJ$E?l?sPu&BK(Ap&Hn@H-8@DcbNK(x-rio3|L?v$So8mQ|P@X+5uU-!Q`*xldV8}9D!zW5q{z5C*umw&r^ z{o&W%&dYDU>0|t2XSlmJ{N`Y1H0t}qot-_j+Zp2!$B1Kp0M72tZr|P6b$9o#c3un) z_6Per-JNf~IXL+Gh_OX|B~sm#}WXW*Z<4@!OQ*P`agKFzh3`O@od1i zWc)1($DPiEGOm{Ykc@{Y9Cv+u+mky3BOrUiXMkdwgg)>IVM1aUk#Q1BVRKuSln~&S z#5_TP6t$Cn0~>#bd->CrXU)4Y;`k2D6siCbjrjoj2mAYb8u_cEbAeunJy{Wa8b0SR zLAMyhpuhwpAICzjqwtl$FUEf)B$k35$Rc_iTyVZ}I-MyE1XZ8kL55HD{lh{y&&;P zI0l=)Z>MvhB;JIn`eTKPlKeI{;3$b>9CARnhy((6Q=$ghfqHX+$As~CCIw&l<~#|4 zOYFs%iw<=Z6fq)!+O(j*zt*#)D_k^<26TOpA2C_NREAv;s z>oeM&lAy4ol9+}=6y6kMe1HZtIU1`1IV4+3#2YM$BB_$N0&f?Ez8hl}3Btd{y6A`m z*bPW{qcBklnO638RNI#k_Q+@kD4VBq8W3-$J|BOpCCdbnJwFWY(2P9?GRk@&*3k0+ zam@JhZNLE&iWZl}Pe*5zpU0TtkUuZXutv4n5P)4cSv` z@oZEtA3^SyQi~O%9|`qKb|7UiN_83~K_EH-98V)Laj+@*kWmgbJC__w_I67wi4FPZ zTMcSZXiUJI-;jc1Ugu#Q1&L6R1?_O5hl_u*o_d#KygW_>PhkPN#YZ#=`2cn$fS;Jz zgao;f5C@R*{Su7Es!`Qt|~{vwcauU%*x*05r^+Q2W~*;S;$DF|%W) zjU%~PnhGRj9EBd1{W4`Lx8jWrxKLXXM2In=*8@uUMAY%*ZU{8YH$^zZ!Ki{9Q(b?V z(};MiXKEPAN*F%ZZKNYx$*(SDMK0RPG1zjG%`Db67-(Lr@ksft&2cppLiPKM*H(j6 z0>C_OyEMN|+gY6P>R#H+ch~jtkf6}*@3`@f!K;ZEubdmNk{_o%w0W}KplNRj-n=|_ zetiC%_PfNR4VTWOp&#)~eb-`<;yQnqmfIku% zCsV=g0DO8E9*#JU-;f|640|;6*#LHhw$cF@Arc5)oYwDutv(1jF9>jOISV~DfPTkF z(7P}8UVhUtJAQy>pn<~O1c%@S7=?n>ht$UmPS5pD`-}J}lrF)tfpEoIW$Ay6Lj|%1 zY+jsPo?Ho`dP__e3Ia7@0-}N@nKNPXwJ(w2WQt*kM^svGLn#GowPY&!tKzvKe$OQ! z!%rjzvLBabYz}nq4t<{}60{gZPM?7hjr07~!m*LPDljP$^4Ana16B1za(bX~y7w@l z-FR6$r^ie-j*&MJ3@;!a((Qkqjxt3`eoiaNAvd-ZKoFzQr&Az4Ag<;niBcGPx7p4& zpk4;SZp+^F#*QaaHLILAbxtB+qI6&5(505#|UVoG%(Sl;!c7C2*@oC zF;lkn7$cv^Ur|hlm4m(T(#_tRrrfj{S2feyuqw+pTc(Sq&bfF!$ZLPBdZ$bmYmw3< zBg8SGe&Hoo3$pN*C7y>FyPCw9O=#e&g{hWt5@YNAfmAwlA08F6{t}pZ3FCD7IyZ1i zZ&zO~@|denQrsyKM~u}`fz-}1(UYI@8dBVjfe-4+^bc6iLhWr3@q$V&j)2O zKnoL6rjCOjR21Wr_t-m{3hwDRrWqsKaw_IU?~FLSgqRKdrLlTeA`0*S3|W(Y$;K<|IdCZ@$5z0$;&a&wZ#Gp&$y;r|jE zq!>3f3}OdJKPwYZ?wcIWO{&$_3>OlPW6apu*+@Q%t_)`S`ii+wHVm~D0N)WO_hR>ssRz5*Oo4!g~?e(3J_tbis3`Tj2>3D z@M(XfB!fvgZEhbDj8*R;NFk(VHt)P7*bG6_?)V0aO=IjuuCC?kS_5zx`tK;F|G*ya z%CfqIF3|Pp)ai8MA@XX6`QqEdqf8QPJIF!`r$HvgT_i%sS@_kH`$g&`SE5)3U>D_-ozs*UnMluCgk}LL-nDCht?FhCi-Qsvy ztdQulw;WW#0gDC49_}V#6q8#L;ITe0QynlYHe&%1^#!|@cnG%7@q4Z;pX!}{Rb|;7 zF*yWM#O|wkV>9OQAT36ik_#8Vgr5(#l9}so!Vk$RTyHyC8XFQ=1L!$g;;+O zON_gWPSJb8L#+K$ok~dzG-amyY^jkBjaphYEDuz4&7jIx_&t|L zSn21>`9mHj;UW8p;aCs4F{jtqp9T1`-3Y!W!UB{2=jmKprKf<-Bx{$n3dO6rwTq4R`_UX9Y}5_fdez zGnJ*)^r@&VL(0WA zFJ2$1QrXBzaA!FwK~k;sPSD&#ZC@Uax!SqpW@7&|#B1OkW#1%~Y2`vx`A+|=F8m{& z6)XIRXBBl0o7y-!EY}ckOn=1UJpMtsJ22QJA<)=Yqp1&d#OEOrda!>-q6v)m2CR`+8Z1#~7kn-EH* z4-g6nVg~lIRtn_%E)IVMcV;f9a!bbCbEOB7E0h}fr>omak2=N6L-kI|O$Ew8rIA-N zJ_^uyQ7VyjswhNi$=?OqHD8$o9M_$q_sZhwYOCNa4G<>*b~z6myJU=`z#Ss*CZJ=N zk$+<7@9geRhfYopS1qKSJQBFM42u;a7_U$#1@9>>3rTDGw4;B%%jOWJqPpm@5sE;F zc{DU$9!I8(;qS`BjpJaJ^Hht)G8fb>&p!lf4FOLhKGSkYmGejWv|XXFp#Tfff{t9H z2e<}Z(?#99!O(a~efRpO%O8%vwSOJHe%&b&j%Gg={RnbbwlKMMS_)RX)0LF^>8&7t zeAm;Yuc(_2h2nq3da8+(z9Z`Al;Mc_hXo^D4eF0>^DpR3w!Oc~+F!KwgT|$8c`X&9 z5Ktfu790cfCfH8`9B%{ej=SJ6PU9PAAy*>gPe~{Qo;Wk9r<%bu2{?%Y?4~U-%a161 zd8YO-OZs3F6k{Kvm`Wp1W)dNx5bdZhaTL;&ZF7Q6?b3g_rH>R-wL>j1v15=B%%ac0 zZfn1o%nEgWdi<(iY(yC$#HP@TP{MEq6)}0nl_D%?MSa95l2)dF(&>;$xNKX3wHV>H zWzHDR0O=Dd5WA*2f)tHNc_EP%t+VHA>1ms2&Pds5>pdGjNcHMY_gO|CN2kMg2+yI;2)+8}3Dy)VtB@Oy*s#4^@9RYKB|+(N+%lM)kpW1F*enV5W^K z%Gv zF+zX;=xsm9}AYR_gcU*&`Z_1X<2{DCER7zYG@UchhVw<@!*l+s5%BTKhJ9vAzxA z+I?Yp_XRbC_S;KIJ{Kq)OOt}r-|5Q#^}bSe%*nZyO)X2QKEx|qS*2-nVSOtz{kqD2 zYAJ+yYj2epqmL{jq)&niCfF%WLLsOlzAff>lmyBvRdvB9qY;iR7vqB8cS_ibZ%BuQ zo{kNWHj_;g7Yu8g&5aYZTwpZBaQ>5U6FGlvz2vl6f`LB^(UeH_=$0@-wI_gqmxLM% z*i;U@N-qRyi;+!*Nf2y9NK4I0^A(V^M>531Hh2?C)1zh$FKZpgU4YGTvCSd4!L>H8l~w#8@on+z&($&q)nRq(aST{&}HH5ZD@zY*KN(fC~uV#_Zv;rM@T z=qcJ|*QIT zXsY+dB}j{a((H9iVr$#~De|Q?g9{CMJli%LSWol?mDdAwDH;O}k8yxGw(fv-=UQKR z!f8xUAmdLzLcy9WMVcvh+NJNWbcQvmW&TQ+}yFnGFtzyO!AimW79OQeJ z&Nzy>+_H4>bX*phZ?Ss_t}b8kmA2AG za@XtSL}mXce3mZW%<5nGU_okhgIoK!t;)wOe;{?K+#)hTT%QdM%wE(rvM_%Fp)n%4 z`K9Mq9lbTiSefaiPgr`mCCyTpNG0DmM*)qug`%GB1lwv0C*cIgLPAa-!}3zmu30h9&WCK9+81&@ zyFQaw6S&w2zii%dO0*IPo!#6V)1D^o?NlAw^>=?h+w;U4)b#81 ziQ@W1@iRP8R6@)JPVXN*sYg&XHjAEYuIeQ4i*Zn@QYU=Ke9GjwDZ^)Hc^|Y4a+QIr z$+opVTUnp2tj|`~XDjQ|k-ygI$ofp+4gkyRxH*Z zu?lXRRmqw!jYS*r_Aq~2UP!2Bm53o>UW_6kX$UdUsVJcIQ0IS}{%&6>W_gjhWPu_h zn9<~UY-HPttF<1DF=f519hXKzy>>(#!Zd^bV-IZJH^Gn(i- z{%}NN{Pq%lwK#v(X~;MV0{L&8sDKo|Z7!EAq+&!jc;IKph<3w9GgKtA$|ft`x%~`> zACn=5Cqcw46qXY;jog+-22X1aK=2DUd(p|X8M)W1?Tw|eRpd#ET+eimMS0~{( z-MTIQ(!Q%C9AlQnsQ4`VI<@M)^(H8<3}E;c$MP%_$FWg=OX^R)N-~`yAuU^0Asyx#K70Uy^E1^{H+_G9@4)@N z3}AnogO$tvwKzP&3Lx`?{6-pPe<0(D-KZMtzvuAKL$55k*J8839?m#s%gw}B(BIj~ z!|ydTH%0Fs&{`hw-{G5F%VjF4B!dPzs3(MnP=Y+CR8iz9OcQUSt?2m%a^&$b{|z3} zswt=Vr26`AQWq0CNSZW5;nc08uOIR3anPY{cE8$Tyx4% zu+-%LdNBQM3;qt}Iq$R2Zq6r2Y-6(DG7sP5&b8fI)pV;=fLenN5aVzFQxYcJ7?iCb zSM?fO`(uNG+hWld(d<2cN&mv1SZd9Go%2L90dFwlfYMlMCW7|q`L=-|jbnF&VF-UP zy2UUIPsLHu*j!&HSsyz(}xAG*~33J3}WllWD@st>A@X-W?V-;SE-i0_$U1)XK zBz*!Rk3Zz`sWc6zfw*)OG|_w+cvX0yB~vJvKv-;ogCH|zIsF}HZOdvK$vR>&7`RS)+7?nJ z?5enVB}(kFW)LzwX!;JMXv|X&N|UDw9F%bCY%33}g3A|=rIPAR?o`$j1=#MIihD(U zu^gxJkSt+1{@YlrpKZO(8-Kw8{7!sulivsO-|yigcnJsBcfbL6wEMdPuMmHd+Lp#t zd5w$`6%vKG@#W2rPCT??7+ z19K{i+X7?#%AgyHehy9SRDq0YB$AFFxyqV4Ye^zkEc3cAMHI}%5ZoyQgH$V0 z#_B4?=Bx1>RRIjO*C>2+ZG(U0;oI+Ot6K-+8z>SAuS>&V=E}AK)GO&uH&YH{aBRW| z9e-;dr*F$<>_dGN#2EQA!+FL0F|oloD!}8Vicu-nYZ~iOyf;3>5spVRo|;&eN`n^D zB+tNo!9IT!49yC2xv7kvz=V!Vrb^pHx0LvBhvHC_k@55t$WyZcl(v6{)T3D1NUC>- zHhY7;GyKJKZ#86f5gYmsl<~_Mv-2xH#tyNu0q5D$)^VbXaR%Ev7b^i%Iu)lOMfE!w zwz1e$L-670`Ct3}-Th+z*ZrOTi*^3jr+7Ye z0GwxP;++9F`m|J#fUC)Y#^av)bHfoTlOyy;QC3BBQ}42ScFq7k$lcws0>P#)t?ENc z1B^mvJN-a-Aip%k5zb1BozbzJ*6!68Cu(R?#o?=HF~zeAeENURvNDKD4-H0~H8vr> zk3$P%07tG#NAr~J?0tl|bkwv*SAV_F4TM(6tH!~ax%@bojEa|9o@gGAibPBZ$dcscoJhLt$S~cZk8jm4to-EJjSt8jpe0w z7gkBK+I6vF_M3kwAV&qp>SBi6Ds|r}{*|W>H8Km4M;die=Ky05A`?qet{dzECV6bm zElJx7?;bBS_%+BuJsrb5T5f6&s%Y9Ch*IHdvTpA>?BoF67wCwQe-;NH8aQUdBxFvp z0^~yD5#!L8l<2U4_=UBl(3J1r5HSS(y07THBc~QqL@a9Ods2p9vjkzzG6Z`m z>a%NWW~x>tMKfU(eN|VBiUqh1p9MIX+6)$9 zWQt8M$j6r1rEB=}{gX3Cmh17FH?Dc3{r$0dqolqyYixtcYFT5+B;1BgehRr>9$KVU zP}V5g>l=S)1=GJw62;TN8^+WhWqmhE(B(;hK1|adY|;d$6B28~;fRDNurrG}^8{*r zu-;;XtG1VnBr*pj4HA6J5eeAiOi`x&sYG5C?VDrk#%a;j5isIo*F$lBas&)k1-+JF zsx`EnTks-#<6~`S4deG#JH45xLI&%3J6SrE`FejU9s%-h(uvXgTe-!>cA1sPzY3+6 zoV^VX>xlo~e-?JqKkK9Hzs6&T_0Ha2om_VLd%nUp=GcE<_ILKm_TT-r{r4%JufBqF z<=8ru7k*{3&$|f;u=Wi=F$cn6h~?d08F&f%@YPqH&W8`K3@~ESK6QUqrwB?9?&bo< zIktaijsy4irglhqTG7tSCQFC{DD+{|E|p86Y7U#XV6*yrF8Sw{0NZg_`*h%!!;7=i zv+tEd(zod$rWi1%VlZCi$3k?_Hs-2xb4OklnV?&>2~H{FGJZuc)BC6|=f}?NrkuNs z(^N2%hxs(&Dr8wc8=r)Uy$K2ln|2lE-&KEPz}bd7dHIrt<6s6X8ILj3>AnPh?2d4i z>c&Z((Hzj;fQ|{`=5*nZrSSsDE#8)uJsCuRQ5%Xq4!L_sx5O9YiQpCm#LrF#XlPmd zGZ(Aw>Ze%{EDn7`yX8L(Ns9?J#Awnq8#>LCvPlkXi1_iT^Cu}T7>{$ELOP`rldXT) z_?_tdX4vn-A&8oR3U{ErL_pv04rquq%n1^#0*5K5(6n_$^_xQ5sat)b(`u@d$kc9< zI+I9Z02T5~3W51?Ro@?X*3JCZ%$~*6YG?oczGJz#s2kqOl@j}KOOQ&S{NY0xf?*(O zvOu`MH|mVKQYQ1%on5NjyE5^km?nP`syhlA*@5WA90%d9XkTCV=%(?P#0PfkbuHv_ zsjdY+BO1&2I4by5>aM~%o$vIQ-d#*MwmxlxOp%%9kZm|E!vjGoQHom?G~w| zxYizX_&@3BcM4s#c}779x}q?~Tw$1QdT|o!z@$nqhl`Wr)647g!^_KG-d-HPdbW9! z46(-pSyyM4b+aIAP=`2Fbe*N1N~-hVQuqg>p-}r?IUl+{;z$j8n)&wLfsZmH=8JuB zT_1bY$6L8RUs02GJ-tPh7i9+IMD)9Gk&}=jEezH3GklBV=is_Hye*T-A{_xoljkBV z4Go?xhro@zSHFDwM~9OjBO@IrU|8~Ljkc6&Q}r5GNuzRIb@!po-6MsLmge4BlVBqq zf4dJKtfBbqXR0N?vgS%N{@pGdX~v%kVHtZrdVN~v;1z;)Hbzadwz(@Q!v?yO`I8QA z)LQy(o^u3+8BXUnUoXEq2|^2)VDy5+6xk-YuHbqFW+qCbth{D4X>&4AYlTR@^06t% z*k8`@q*{g&D-CT~+-0$W($e7 z<<@2|AzUTAMmS@GvdKF$aW-1N@9%Tk+S%LVlk3y-f|@4d^{#@tc#of=er0qvdqy<{s>?`?VP>6IvKzzm-qfSy1{^8gzwCq^Xfz@>ISq}G{#ug zO;1{Xk-jF<0w#$@F3kZv&lwJGf4!CjaW{X8pXZjq<;lg*r$-g5pmm!q4FRSoJ~|{M1L->*oPa(f{Lmf`bUhtjnWdRc$o; zf9&nQe0fmx|9H8(xAy;dis!?J-dAu-rUU6aIU)g;E(%jIEZzhU;H#cwAib|TC+{O^ zqtth*O~eT4BGT>Xa;}a-e`h#`;?!>TO~%ty5#%Jh&vXqm#cywM91E%ZBk(v0J$SJv z|0L7PWHci0!ErNSf}^>LQRT5yPAgH6Fo<>3I*IV6yjMS*S%su7vQ>w?ER!`D#U$h- zaQ=Uh z!4P{g2N9!FZ0C(qM_L32zRK1kqu{C_0x~khrtY;q{t{}95Zkx9ozqc%kkXA_4Ul|C zcpCd(gG~w+ka!B&ZxTf7R|H3!(0BMST~TC$TyXMNt&fC?=A+B4VgkC=puYS6BEeX0~7v zNGs>&nBnOyj*sXx613?2{Z+ra@9u2FfA+gC-5s%VP=tmgAe>;<6=bZTbiXIOxQ65) zfrH<397-?l-fe$~IqEkJYKkZc$K9K+M@{tq~q!fvfK zB*XxuV=~EmfAF^`mKgv|I9ipxFU<-A%%c(B?hF$S8u&NTFuB|9?|@G+3!kT+XF&Ki zFba2A23eKaP^VEKqvV<(s41SYfBW9Qv4Q0HO|^@YD<{sinoo(i zxsg0k&4+4}y4}KqpfA6O(&L$?)s&t_wOvs83Ja~QQq{RjtWaaU*4At7b6RWJ!h%g> zNH+J2T=~5T6D#lbJtwH!g|TAm)z&Rh+}{P;-wqcW5M<|IXC>nD)I#Bc3L}Q8s;1QjAEQ!L+G=H+a^nk3Ztsyl(!e zK`qzSAMxx_dwX=)azYQ=OzF|#1G;*2_^3TSfBr$;j$?ECdi=w=ELdr_71;U{RUpN; zXwPiKx)r4QWvPwm#Zw4#{SkSdP7W&=ZCx*Q=|ffctj44l)HmW5YS!S*bZmo3_V_Mr8@R*I`D(unrK`& zO|#U*7?BwBnXDl3+IU+8ZhMtz4ChgH}0#UZsEq`6Q_%x*o;fBt#4 zw;ni}VDCmuJD=cKB?gU^mn?8JPP4zsW*OAFkQJS43);hG=2>ktW~cTLUtiDJe{4Lv z|EN;Ten&zd95;UV&j0skAK3)$9=sShTT%koF<}O9k#z`s%&|;(w`n;)myEc1pXv;O z`}?glm`g~dhK{(5rpU4YLNWH}bc#b??QtqEjk*U~99ksydtar&1{~g!n97Z~+xd4A zj%b?A!>1nW>XFl#XH5*r-h|${f1LJ`(8sY1RpaVbT+xbal`K+4o5`s?2QJQ1^YQOW zr>p*KIzMj}DE+x6uu_V&#mGxeV)78>(&P>J{||yQE5g`ObOgIHk61p{*U93bm@SH->~7l`3n5e>8}!blt*+LkpKeXs_Wg7`%djFkbydr7N}G6_3>N@VhLE zG4hXS$asuM$XV{FEeG1f3C&(QW%NYBe^3&F^DcC(qOKJ|Gc9W>Lpr7J!k-Uc|8#N* zKOeq6JwCiTeS0=|7fN%osq|5f-~73OpLI`7P*FOvj=5YY^qg@9e?NZB;8x!xXf-`m z!&g-B3l|#xv)}E%XnUVwt3b`A=45LUvq7;#T&3MUr#@WKhz4{#gG*TiYybi&8KEN! zsYydQ67cs|AdpqjfrWlLr7;Gfy~R^yPDXs0w3-q1U9M4b71lzRGbr`u3MWz@%mf6X zsHU2_xy#z^{KRB-f7|knXC4J|R2|s#iN{Tdd+X$oPr96T`2?$1;CL!;u>;SfMqcMV zkpeF8T|SHODN9qvKv!X2U_m?z%$Kfi5Q;l$MU_om=Ob|XKWG|kRo5;n#})T~hh#iN z;kY+O9N(c?cZQ}9z6acV|97YVV!vOw|NCNZr@y}c`xMWIf3hC~VVux3Izj%eB6IUi z&`@@ZYXH`rJ5^lXx|2yT_c}Ku^at?0qN~mnbL1nA1|87$S>?K*=}y0uu^!ZMLCUN>kyFKtf+=PW!6f z2Rl|^Lt7{eDOb_xR9WlAKvr#P+^*e#0gJFVkoo6TCM88F63_s2w3m$LRODINx+^1= z3^cP1lj#u013N5;jf~-zQn}1nv`yIJlYSk=lv9ree*?HWI#={ZbrNsUuJe^+Su-Db z{nzpTTN3jG1tz4+gSLS={C{`nnS;oO4**^G2!AA$bifO{Jsc+?>8>AY5y+ze*Q`J$((mJAVl_XyoX3IWh`_!Ck{jB0C?*ASQ zM`S!jk*o62u@z{5&HMlU!OK$quNUk6|A`)Z`@S{1^pPZjHz=yupj(6oR)o`L6VEZx z!e-uP=Wf4aPjE~)8so;DRtG|=-ow=}RLD!kfAHibAB$W>av43|4XKa2Y%+k4vf+(? z?F~uTlhM-Ui!S8u(C8uU1!PEBmrdrB3Fvr!A#KQ%u2ZJjkn(GJ^MGCZA-l#Qk7t`( zX;R4Pj6|=VZHhfZ-PR#n9sP-n;MZTl{UCC zfaVmz!Y_z$bqsubb}7$jeP5rQM&{0$f4P(;N=RDLtBl99Yn5ZLir^|T+gzNSzdk*Z zrvcY*-X5R4(kb6NOOu{^E2u9=%HWiVa1ItqDpF{SNXNGL=Ci=5z(+^QD%*{d@R0q) za4b*NHs==;k}ls;QE6o(3B$1%@Js>lCiE@@_d+LFvwgiv=V0<)VA(Wmk7ig5e`I?7 z-RbL-;_#R&HrFV5|LS)Sad`HjqT2oMRl}L(!mz>Q#s;XU$TA}1z z44r4y6ym_ES0)E!nYO$M1?Lpd6l^*&F#i?Y5mely#N6v?pcl`)pc1lOtk1+WMD(c0{f$riz`LJIzF)d z@yC<@Nx$hR!MVDJ`fHj3a*VlF@m%Elu{)f}2+ftKsdAT?r@K#%EIzjpe_UA~Q)$68 ze|B|xcJliA^z6I0uQs1;KCA5a)>f{T<}5$Fy}Wv5rX&aH*PY+)t7@FTy|}tQ`{~WM zCl@sp`@h|H4CQaY>2!*Hf;bLlfVhwbcp-0s*r8*r5`1b7)P>U#5T0JPlUuV23!v($ zGhYQwh6KfgPjCzqByCHoe`y-46MC8L!IATjgfT|mM99G^ zaflfM=`ydNi-ifCOfgM3+#w<}^qY7o+1@7_&83=`_kEE+lTGQ2P0CrHcj4QahC9I! z;yc}S)u2wXJ3+TtY$%Yo_uPqqs`OQrJ=(xJg+}f7&nuVrD`Zde>VB0z*t06l0QhUfc-2d27XU?Q8&!XdCkI(v^$hVoi>6_T6He) zj)mNZd6_QZ@Z$T+SDTJ2j~^Xyc6160@&4cC2Oco<(O%7BySc9{EEc{yB7%`S)x4v! z+6|sn)k>L4bz7*uxxbkK&eoxYG@UdD5mO$ zl{=-rn6{8Ue_&{9l)$Vx?W5*YhR-SJWG0zYwm~ic$5xpNld=#L!;z|&hq5~0_dG`5 z1!$b}DJk3uttqLIk@q$;Lvj83uqLG1+d0N3@3D6@^(|x?%6x>-oG&iYjLGGy>&S$y zrFODHf#KGBIZfe;Oal%v`V_Hy4&sr%b!4Y$NFB znqh7knE?Xop#a<%Zt(1t^Xx-^@L%$hZ#WijEQ78pD4icgx!r+l?2}4rxI`i0>Blm$XABSls7uW+JhMmufy z6CWymMr`Myr;BUWvp#rSA3QF0@Ca3w(k#~*Ole3sjaw+#DMzuW%qhOKwgab zXq-$l3k&l7YkintS>TMU*LUDwUsX3;qNI`;((2_+Nbf>(C^wh1;aR^fcY9&et+C

@J#%)5w8EHT??xli@#L2g=4Ze|2neBvUKg-`m>c+2Na3Rz%T;o6{#x&tGMVyU}+A zxNfD^D{aDHjKY1mf4=1uNKV>36xF3B5cu2QzzxB9c6z=P;iW(4Q{L%$BiptuG}=0o z;$bZ%g=(HwQ)Me(u0ju*b40Z&7lGUcTye@f-({diAZY75P%SAe;zUp>e?u(f5YWo! zAlFQl^TF!f3UW=h_b@L? z+51Cog6{w9s*R=Ce13zwf1*C>Epr)*N|mj#&Y)6h+003~uU?h5=;8u=GLw4wJS#s} zPTm0KEVK|RaZVS4qZdMDDYFoqY#~%bJJiKeA{ikPP_bJ~XZmisW>HJp*;hS6a}mw- zyu8DY^4>Am_A56c_#Cg9RRpH3xn~BS(dj%q@V?cf+_q|s*V^a!e~a}w{&KyEE3kij z@7)!((%GM*(tm#!0YIK&ZZ)c9PY^l_$y=6;y6@xig zTe6P8`sM7%tuKCmo*VLKdhNUI&Rl!-`H?O@uZ4y`ztHe!zo-POzHRg;xn=Z(;!4Hs zpwHxHPc14dz1UORf66Dm*ONcmDMayJ{;7@swvx!->X{S&b??QCV*J;G-TupU{I{og zRv-WE&l&ek+Y%*P9Kc7nm<=dhH<`bH5a3;wL{UJn52`>C>j<7{xc^f9Zt=`4#{?{G zQlcT6@=4s%5Lc&!&B0x}`ON7;30hN6sxk2i6H?)k;-U@4Qd{DXgg)$a<^SXhslPQ?;?)cle5U4mbF}nm+37yP1-d$qre-g# ze8+uy7rJP~e{t+iNe~dG-TB)LM5%xPb|_%Iu|XA^G$$Xf@wZ*7Ed%9B11Yv5G?pO1 zfy-v0w`6||j7tfkfnMh?V1w4YHC%=`Zy7&I+~uPDXK2+GB)K9Ha9;kGy@O)@mxC9( z>-fJ<@>I%y_2K#3GrP}A3~ZF}TFHqfqCB5PcmPL=e?y<1cK|%|_W;h6pI)ooE=q<0 zVUsh;FEH|FhrShe(vln+C;3w^w9oXZ;Qs-ixGOaSH1q%d?#|v$G5-7h z{#yTkf0E}B;=d~r`n>r6>dXKU3CGt$)gvKh>{^DPQHO$V=~S@Z`urUU(q+!t~?W}~7MNvrf&kO^0`c@qoP@+rKVAHEc6w~S{cDdzA4ScNrjSO6j9@cu;#J=cba#6G z>RJCkApN@YANrFS9XYTW0EtT;gnad^fBzrp3#()Xt_VnBo`+Ns=4sKZi2r6{Z*9Zr z`L@Ju8=mc$9;#Lgoh+P+6y#jnAAR*KtHDKU0SB!`7+3+)iuhQ?UH*3!i?Qsl(w^`A zWmwrKly%p{z9#lBgxEisyjyJvxkjO1v3%4m*=wJ~ubgL_K8d9dqVsIW+<_Ocf3F!w zJYlcYv99whtJJG8x;TPLKYq;Be)eB;tEc!i)R&!oW__quh##}RCDnVO?v|O^LcRUe zcFFbgG*8j~KgB#I9&@9ZPBEY0WCaOe=jDHYx%aY||GnQoSlj=f;;}BRq}Ne24VWEy ztNcYrZGEGhX|jTaeDK=YhJ@p;e@A0XS=Xb}Uh$Y&Ls`<-u;@rujbWJ28(%n?Sg3AZ z&tB||Be&Oo<_F%8bLoC|gJ;{IqSnLU)x0q?=eL$WwtxWl_p&_=CpR{g`P*^mN0fwI zCvaB>&AQD_g>YAc4hcDqZ&8q5cGADwOnOsn}lP_g)V(He^5|NWDt)| zr!?&HD7ZBT`Jsxi?YRHld!rs$q>gO=9qN}?Rj(>(GZ7x0FLgUV>6V?GJ2A$7$=ZA zXTrtq2Gs5UD|G*wyZ`U*f0g{d4t93e`~OosH7ngx##inkma*^8$U$H=`(^7@K99wA zRcGZIHl;cJA2bc-)o2K~<+c!*x+n}OS5d4~ee1=b4IVat5;7HAymF|k--o-RfT=Ao z$A2^zbzW2Ce~SVXdSXwJHSv3n;}8W`F&d4CcTNN1%^F*+tWhDwe<_@#{Ja=qTlF(( z6+1oG#GiZDhzd?{%RIwdd6uuj+H;Z_;q4_VEKnCv;l`Q9JU`ah%uuEm*4-by7hjzx2iwP%sJC@s?MD0KHdF1^Pt-W2gpar zP(bjau_nDfI?CPNGZO1x4X(fb@OkXdkOTFXfxEn_P|T^tT*|4%P zEEvyPS3&X(Ie@vWqsU%?t4=8P^sZ!)-wa37LK3iZCEPz_Cr6Y)kU=A^!e*ECp11Wz zOV4W3UcmnrGbwI2bta}2Y%3-kCcvAdyc^zrIhU{XjkxTv+Hu_70erv{S$XC0Qg3rxC7GC}NaQbEsNldQ1414JP@w3iK-f;ueu2xy1MP#qL#B`sK%u(_fzs z-vILHlboe5JQnWwF(xmYLo`;Vb{N{FmcQC1hbYOu?)Y`SWO4kYknR~4R#EWvjf2w4 zDG6A98;{|>tj#KYosxm;d1Zkh6MFnQV$gu!OTkvzs55dZo8N!O_)_Fr?~cE-?97CG z`|tH-vZwUf?*04A*K6Qxl*imc>4{E2QOZ~ZZA$K?MdGhfzqEa@6fD5@k_91LVm=mO zjbGTcpATdD^KJ}6Q$T6e(Ca!Y!)uM*&->Rn`qv*nMD&YZCC9ah*|@y99bKfaEaM3Y zss;XLv1KT~)c7QG{j)g-+#1;D-6E7(K#dOklwB2qNB@QUfz+GI%)_-+)9@ZmuSAy# z`g;LaPbvfdWbvt+k6~wTaD3s6VUv;&Lg%V`=stP5OIA+l-^)5>(0<0%8u! z{%rB3KnnAOFhBAfovMi^{JY2=I*sEWp?@_P5Jkt$k$7Fa{8}`rwe`Ae!c`C$=RR}| zLL)uG!9&me`}$naLxTMJZM$GQ2-fo|Ib8M^Mm|^>sH`hY`F#S$LA{ni`Km$4GdXLP zHh<_bA|<4f_Zvob`B-;FQlA*&#MRX&`l-gFr|#4Ifv?cFbvc?oL)eh5@Gbv0=0Br} zHER&9iG^NIyEqgPenym$+jorbuaP3Ox{(tdNScz`#b-FYy3W>AMiVQ8u8SLkMp_1t z+d7X<-jk(ii3KQDY|?3$x(Yn4eYF_ZmLEz(bmHW8J_Ev*w%OkCZNJAGJdRfDt4SW7Ila#lPg)SwZFE~DQY@R7A+mm zyv9=p)k=b4X9xxOrYH!MSc4%+wnrN!l?E>*$Me90w)}6#?4y28sFFdbEXswvO9Pqq8OWq4?4MFvl*-yH0ooP}Dtnvx%CTGVt`f{X&Aic9~<%@9rask5=*SX@ToV!#+`m z)V6<{>@3WcZ+m7aG}+O(cM41_(H7U`NB=v8}$4q>pV^9 zSnqXFm=rN%xj`lE9H{BN%OeK+=&lo|yYAiv zKtv>|)dFyCz8B-ye9T452tN&yKe0i}IG-&MdgD5nz*L)^BThP*9)(a`$aLgQOBzHDi z^#VP_gvs9f1YzBlYi|41O>%l8S|NB9jCw`a2_+e)h=+nh7(l`!@VO?nPf9w2>F>)+ zHQkr!DGB@(e_&fS_~NYqy0LhwFVtbUb8higI|PK}y8>9kV@&*L0nwHLY%AYMqYM!d zMMM9?jhRQM1Hui2RwDrx4DkWqe#CqCYT~(M`j%GIDa5ab174mqKr0|HB^^GH#}v-8 zNe+)bsK_9bx2s+qjgW`r4!(K;ZArG|{;a`I;>6k_;fDcJ zG_B>F9*xB@#>bqs2=&N%I`L#GmN-Hi-xt7Ga~W~t6uIHvc|J4o8rk?c(=U|Q3_kspXxDXRF+5}ha>vN=_)(dl9_<^w-;UI9MNAYY5WjDd z>&uyBwvAPuOOdNip#vaS=>}}=Rem>~ZW~|i=E@0>Bt9zmUm62O)qhLAdF1(zgNAfN zTwom{_-?2Ku%Zhe9#30P1uklILM9u%{UuU$z)aXbs1Kk)TAfBv>78ic`td^#`-GD3 z&+hr+AQRsPCG#Qv`1g!xw;er_I3R} zMmGCR#v-8H4*O20=Njj8BGje{T0k(d zM=x#r@@Y`g#dAcQI$sg30!hyPUcTbi6RR8B!*Fw|lAHo2G%-=WSXseYWm%Cazl7hH zFCP9zB?B0uRHz5%)@0fkyESD!J~uh)>`9sv2=^TDpp7=J2b;LRw6I|s8SNB@YgKg= z_Mr7(^!Eh+h{18ad6as2d>4SkwY&4M6O8!N{_kH#!t$=ctk!AS&lZ@5Cf^N+7d>#Z zh;Sr?iJ$Ia2!FSj`V=#V+XRU3}sQFmG7brnp0^HdV&VUNE^d613?M@Y~M5d%@{YA8S z@)#j5L82pw3#ls$Gp&(AhNt)=@j2=URNVj@ZnIN@39c{>gtDh^BZL<)T-)Jo*1bfKg0Tc4d-J@{Z`}8LPl~-H!o=LfdaTOx#xN4b{SD< zM^Y2p*#S@#F3cR-iUO6xrIi24rPfXk_*8LYp`}e3xM?^?d#Ou%WG(*vPYtggH_BCs z9}W9=7||D_Ks8e4UH$JX#>JNtn}zolH$!zTxdH;S`(@Ol`9I`uZH@Q$T|!ps%k*oG z5@lqE73KG3=}$R2Q24L>{S1tfgQ~ho{XIKgj3@mWKk01FIE^>Ue(w`J`+$LM-H;#V zSuII+xpuJ7VljytzIV8MuC&AIERLHg-I=$e4hsU(m9Ln8WfN?5tjeT(|NWh>#yc_{ z63a6Y*_jvpujc4_Qs)i^pDQ<=-{l#}p0-`>afnoBNym|#5XXCMoEaKVg0Rn;@I?v5 zvyXq&)sv@fQO#n`Jxyk)^yQWh3uYl7321fE)>c)X(Qk)6Xa$BX{nWlURkJQSU^rEv zU4g|#X!>-`NzLd^iz8PriRpv}meFUGO-SNT#oCIDIOH#whqXgq49Jq(x*D zmgDB~ix;MzT^h^sEKXmQ?=5t2enCidz=b8dJ*CwLC0cSacoChw-;?a?>|Ci?i+C;9_^SJtfAm#f1;0_``r99$2eILQ zNsnK-R<9)s_iEHx>jthrOQ5Y4@mI=o$h#J;)-@00x0+5Ta277s^}aj_Q@7G1_l&$)j^6>H)f0H`V|c#^rWu zI^lZNo`i++>k&P>6h3`u{POy?q5cg!j0<~<#WDM_Dn|?tnY$bgECT`wfd7sOaN;T- z;I{W<>3f%T^=WsE$VN1;zvuS1qTQJc)JzQZ$Cs2-M}gazPU-&3I;MXE*`S(&#Yz>% zrm?%7)jQO1CsaRY$z#Z`PNeplPl-}oqq8VYyMA4JKiqt-?)4^q1NIbed^pVmqPQl{ zYZ9)MT^ z`XKb}|D|0q$l6XGE~;QcKMI$OQH}V0=SirF8~meJ;IA)^=}gNK_8$*Fd`?B4DmwJ; z{`P;wHvYx(`sGH2ipG@6l%{CrM@gII!d|JN>Na2G`En#dedJ?taOg_L!ia8tc4)?r ztOQp5Regs)xqIlDmVes9H>5t@svFB%_anots%}>$a#XLtM)xC$>mB!{LndnBILRyP z(N+-m(sV*Ts(UrF1`nen`z8_Q*83Rf#0fN-`}PepBar)4c78G|oBO6}mGK!hWrD~Q z^-E>nXWC$kcg0b|T-t7RgCs|662Kq}8#cBbbewq8HPnm#0E-L@3^ux;(&`8tJFMvt zY?=Zg!rWJOSoR>I43A*2p#xA(ChA-&-b|5p#79)an?KTHn~MX}ig8TRop6M5VzSGH z=+SCIe_EF+w7i&D5@lS^geE%s?<7rhIm1Q(=w_J4;AuG#S3-~C@o;>7`E-5!e0FWE zP{uta?3)*d>?PJ!=ZHiCqeRpIL+*j+rFgB2#E-IB*aWml#zn!Y$H8N{@`3P+uHd8Y zQg6Dz;wM~S@qB&GXvKV@g`z~WcS~1JR1R;g1*gkYHQ+C%uzv5~>T!k)t;kur zQgUl~Fh6Mv2MAB^0Y7V^+p;ykvV0H1IyWCj#yDssez97vAm55@%HG|D(>M=<&CO`b zI2(V@_-hGENBSwZQzhyPMk_!t2lbq@R9hc@_0&*;S!PGnWb#e2?8}X-oD8a*{P<%W z3K|Y)Ga4$`)q_gb4K=SkZ`)cY))s*N0+ldl2bOS-tQH&h62NSlqlCEhpG?NvFReQ1 zXV0mH+!2%Dv6VGs8jiS0=COTEA&#ViNgI};y3BiHV!`SF*UXT6Lq~>Vmzm3EYo9Fn zv0pbkm|R4JZRP>5f=e1X$2O{!St4COyT9vNe_VGlEkbs3bQ#H-$meP!{4(>{Jo5;< zsW=QYu)de{@K0izbh3&}k{`!dP@R2@J4CuyPmD0dyfv=#UrscXPOZ+5Q9gLUu!c*q z%GTq$9Tem0mt7Qnk6cV22$j*U%Q(g{AU;Q7#x*D{h)69J7q5W&1qKq6$+9B-UO|(c zD&{IuE8lupIECa&zoX5AV(mmR5;(x%@0vVf(z6unwCN8WamInXI5DHjz-DE&7gj$= z?Y`tFe_!3$Q%Rx7z2w8k=N|CWaahmGjOfd)mUx6L4Nl6cj+5REg;;M(56uZ}BK7~a z-~?Jib;Vx*L|6}@0Hs5;`xe>Y#55`Atq6^z^1;&9kD$8L90ar#WI{X#*sTrXzu$h? zvmPp1x+Tv~UsO$PgUyQMmxOdPp-Xhxrh$->X@#*B(fqRX5+#9g5N56hir_rp z^*IF%s1!TyV|^C+S#(x&^y>d7CHFbX75+c&!^trE*SFy4jd_}aHXm$rnK9VW^z~7U zEAC$M!v`N9v-;JyARq@qjI$skN`}wZ(MbdwZ2gyme2W6W1fX3Nu`Pfc)MDP-Ew1i4 ztGOCeyz+kuwGf_moVYsU`;bn=9#s?@G$jJU{o8DReXOcfb3SnOgRytB{I+ZdrXb z^1)B9&2xcmN93oM-bvRUSA!zaN-YQ&B>btt)BBUB_o-b$-8mPL{M{`UP1nqF+y6vB z5@LPuVVx&enPm8>1mB}N9_xz%6(_}9}dg=fq%UAc!#i&NbkF#P6hK?OcLgVxxSvi$demtpRCtR6%BrYp_%pZU!DapNVVJt+o?{T@a;=)Z)o+SVjVQe z@whx(eq2|duojMTOcXSE5+?EJp(F|>k1P{u(i|t9P3J}WOlEjcO-{CQtZx|~*+iKe zglIPf^`=)Dz7Qx0PA9*Zi?}sBeKCuFeYrXO{*tDk2YIU}W@YF3d2^%IG>vXH*zTdu zSlyC&qdqx-JQ%&LhFI#YHytO^!+}t^>T+wjUbwmnvo3MtKzb1k&T8*Yg{mJIrz<6ZFhmX5BlThHOgG!?iHC3K8l$b+vCQb3w<`2jB< z;!_Jj0)Nf;l!mKM2``t%q0b9HoMx_13&VaGe!}^R^8EXLHcgzuEwMvAfz%B>7Ac)% zj+-t-ZGZMMjG>2NDlX!O^DpVx=K8LN1HI`^f-Q@}7J zX-q=ZELTnw(SD7;vfhbp?@I0$K7ID%A^ST7n^N8|U2E9ihetCS^Vi{@LcYHag&xhm-CfzYev>4>ggsm0{0d5t zH>8d|fn&;-cb+?sF?(*9wf~?PT8LXN$6wgRKh#4<_Em;3@gwgol1zzY`LB<#9G3y+ zrlkZs#1ocqqJQ&nmC@m5d!;73Wh<}4>4M~|uRr^LN`Gs8F{7;i{f*gA za0jg32WtjCJTB+GUc|t5q3i@LzaF{s`@fv6*j3#+b^d#wXPGe}%ZiA%_?;LR075$W zQ93s$v9*&^$JzC9EYG~gmA9z?_F*?YZoq5E9YoBSXmx?1fy5(4+lDi;KeVq9ZxikH ze`t7>-)MLfzO{hl2Y5Ck(JTq3+UaQHTU^ZbU$RChA0I}OuUKNUhpc$x+$iVVrAF&F zPbmqGkfW8|>$xaiVXvPru!ekfOfP3f@hH>Q((2iiBgiY z)Gp>*mQ~J5kZ!(Rz0iK@iZCjG!k!(`00p98E;IFu8$0gAOO%4b?e~LZB9~~v57?`T zse1qbES)S)mi#NM7lxGIY&WiFp!e;kzn9}rw7l9k&M;(nWxIwIFS-wD`uvPW5?Fr9 z&qD+tA5qQk>2nrP7CZ6GML?T1sF937LLpL+_{eOv>N{3q23Y_`z<-Qa02F&r@k=(Q zJEdi!f#QTt;NWj z;VCCFeL*gtCd`e5AO^7(Mu!2gA#Mo5=Lc?tkT}C$OsIXMjY%WGBa{?#c*t|AqjXG+ z{0E3~rdRUaqof=8e{6Z}-QqiE)Xsw-sM}cJ`cFUQs%$kkdQ^Pj1jwz2c<=M|6a9}c zP-X7{MrsF4aK|28LkpJ&cS{L6k8-Y$l|PLcQ}hvil_40$BMfLF=hu8nToEj*VxTbM zX{oO5xQ;)6;-!Ocpa)|V$oXr#{PB%t3UV z)xI3wO5TG~a_*QOYcJI5jPT6XY(+pg={#6ahn5NRAdBb5S2nxA3QiH4Ut-IyIa!Vd z!1plh`p%sO)H_yBYZ=U&cZ}UO-Oiib7<5^psUI^KlP?G4BIQHiGmTEvE0r85qgv?& z6gz6xBHlNtkA}pX%MoOw;zPKBRtDh~g)}G~z+K@!HxhzGx>DdlS%;BEF|d5x5r;pdY}4wT)%x?bl-ili?;Mv3YTC)q7q;UO~Xi41JjI#SgQdk zhe1T~cOxtx^jkO_GJRziKk1nQ(wv~2BG<4*=V9KT*T2@kKRp(={{6DqH+&`_WJ*M0 zuA>xRi)}Dy;hX!jwllu|Cjk@dY3$lC_Y*4v$VwXRn~N*tG>OApUlB|3XPSBQ=RW4> zJdRbVVTpeV^&?t;R0S4KpQw5t&SD{Efdav+;qJIpt39^4moJ?1viubXnMGhtA@~^B z{nD*_aOa-cAA6&Z{(d{&1@*pug2RWFetGQpI%%39$sstf7n0$wQTrB+sUEL_d1&t%KbHO8%U{9OoxKxkrJ+? z?&EW`zD?J{H#p^-8c|;J>31JR+um|3?6cveMUP|KvSL5tr{5K&y_P>#%KltQ)evh) zFZ?*}JX+g!_G!r*x^aJ*;})C!9awn$kw(xyFE7G$Q%cRjjWyH}`#q$%I%iWA157vN zid{q{0q{ya%(V&i%^6wpJwJC>(e{wT=c)_Q$7zj2*YBC^H+JX8m zcU;4((xBE$FvBS-HxVo3TBj{#1Lwyr#E|>5)ZuFBPb#pXYlHCek+o=O8<VKkOH@Hy zbSS?nfAa|vVwnAI7s9&9I^ATN@=PIIpRiW zFhuSyEn&R`Y>GJ?Qls-km^@F(!<6gEHvF6H!vcyuf`AMi&ul($7@mQw?-a$>4{X5_ zUgrN%Jyb`&7N7$?fRFMLMK?@i0ImhJgho=~SBKS?a5JeTCPPtCXX=Y28kM6|dn#&f z@;ct0jmeRD|HiM>Dgzr}#Ve9l3oK?N#sXuF_jgzr>TLPG3#8qlnT{z=c6$i5oieb1 z$uT17dq%Qm?1+w06eIC`XIdN|jz>+$N*Q&`;n^4T?50wMuJO85oX>|sNa8p71asnq z2yr3M!8ynp7BcQaI%p&|rg(DyZFtU!g9caDq-xodFX`eUu)UaYFZUcv<@~O>aAaGm zMm=&}HLz-*ko-?#0of72H&;~xJVk1y@K6vP^Jy6zawMd3&u$>w!A4_mgn37bWAqSF zlz&7ObcuMG&koXH!5&bLBws1FUBO?(uBS@yaP;wzPoUj#=FUfg_CIMirVzo4dLI@K zMMsNjlp|=sP;j3k?Bc1|NdNMP+W!v0M$JhToRO`VGTNvHv0&!2@IPD_UUp?-OP!+= z*edp86YjsR`6A?hl2kI#j+9F(^~Sqq(|W1JS=z^uj_dKBQ5wG<$5Rug>sLr!&{C5T zjQZ7tv&3@a6;{E8B;JsqxX0g!oup@-LmDxXay*d&^AV<_!&i&XOtfXo(~m8Dl)^&D zvFgvZQjbSnsu#|>wt4p`Wp3r;kJe&C4sB%tlbhd#0A!U+1^>vP^b4yKg#d2Mzoy-z zeH0P=Z?2UkBpCRfA#9NdhCJtRbGfzYJ>?}L(V!050x~mqM53Fr99KZg1RIcdActv0 z8387vpw2@N;je0Dy;d2zVddeBUr%EwBxO=~iO!_SSNPU6qm1lidt4;^_T1pl-CIJA zH31zD2&WBbU#V7ZTDln8ZST8TM7}4cu!fai_@#dtq;zsllx@h(#dA_EFE8yVmid!q zrEHP1e_33E5t_Xh>!vfk@F!UO*%QwN*Im{IcqkL?Q;A`K31K(6!X=^5N{2oW`mM zo@lj>5}?!wUnX4RG%IsK2Jyi^%wOSwQwN*#y~UL)ijm?k9~h1|L+DCa@bBz-&|tRq zI&ZJe$$m^H(xAjrnl(QM9uWU5(iS}i8&RwU-h{9?@0h>Xkn^VA@xcBleKKu7$BmeC zdM=5+;?E3HAH>h(@I*2NH75QE#2Yg7PfQc|pw_V-FZZWdDH0MHM3^IG`9#IyaaTmz zQ2z_nZjbw}2pS0i1QAA6yh1eRVLzr^<=;I}x)}-+5BF{;zo5qQRt?W0)s~*qr_M(& zP}L_&VO3(TYXF-l91joqdS?8GW$9ut>=+C0LK2?K;AH55+Onj&E^kXHuP4m$0GB;i z!H#%BJ;S|~=m-a2fXsb^77yRY=Oeg3g&CS1;8FP{j5Do`4Oj_!g!aMQ)Jh&ywvb`1x z(&lH1oez>mV?IT1NjqWDH+~y*pk2-27(r4F9GVu7Wc*C6PQ{18g`K|;h=gTSWHllO z(Ha%Y`=-3RZ=Qn$O0I!vR@~C%L@1 zr51|PiNC-rc%36H@t;9pS8P3ZM6J zmv*ytf&r_7?T54(Rns?b^|!W#$hK$@)~Jk~A-gUr;Zp32n!?eAuhG)bj@QkQl_)`t-Jr|n0X7njoZNaR={M#d z$!_JiG?}ByWBiZZI_xnM=NS2-#e(Ph%fU7gZF`DQ&sok>wQT-;qbM?&Ob zNgWCy+^$Z6sLnzIqj)OcIgmMG3ois|*Nu(B(&~^h1DLdDqT>%fu8xr54d_^nrl6L~ zj>Frf^U(P0b;e?`>?6FH`KwYZ5kuBoOtg2z&Pq7(5_5PMxqb#YW>^ssXf&?*zqm}lW3{dpK78A!|hu_RlK zm0X2lUTUOuRbB7Xt+d6!U4Lf-$K>yWF&7*}G^5Mk2Q!bU6J0R!z7!ZVIivh9xK+XY z&XZE+^AP3$ryA1D6b|r0U{_w(2n$x#;$eR#YM(`QpFpT8R2Lv)X{}>xXmlSQ!tk0L zU4vlPhb^;@Nve8kyM&Ut`#xAza)6ffuS_yOn`{Gv17?eh2qusp*@%1Ga#MJ^?<=~F0jBp9s=KqZ9Oz4-ftoW9`FDO4sj^AOm-V669`(NJsdn~)Kfnf#JPCOUV?X*nc76A95z+x4=;AQOO$UgM}3x|QBTjQ3N z@?eN|x>J{k2Kb6}hNV?sgHEyKi;%4J5;n{a59Rrj|p&x!tl2KCHB;{CMqw2Is<>W<>J zpW2}LTh0gsXq&bfFcK(x$n{jnZupzu24gLLvk^-x*6yqiQZCa~zw{5_@xe$WpXc}@ zWofF7An0}{*{-a)!EB5<&B!dcy=bsFWqzASWHp zk=i`@%8_TiEXn*-4F^pp>~~M{=LGbedo`~GWB$^3Ymi1IeWt5hE}j-VizmX6Js~>1 zofM0zF`-5pWand}5xN1W<_IW5-|E1V(?#tTDpq=hnJ@gJdB|^Ul8BY_jW0z-5fa6o zTbmuv@LB>p?Qs&>Jh4h4#d}P~q)7K5;#l!YG#zdYA%9)+d-opT9 zkO=Z~oa<|UDQ?6}mUPO^MVBXBPP-$(!q0LzxVZ8S^|YOVbV%ddpt{jI7p{nJ)$11V zO=Jo}iy1ak1oy^8j;@mJHIVFAZ)(v+ue(T@y7FN>0S|p61GN0YNoDbsS&RRm76PDy z(t)Xof%IHeF(9UFsG;qdaVXF9FTPcmBmwaoPp0HGP@G(3h4Oul)Nc92k=2mJfn$xUbgt?i4 zyfAb`G3EWf{A6{$h5ZU~0?0?9COdkPOA`bjt^k!mT@F5e{b{%~!#7|0Md$YpSO@zw znDTZRBpWFz_U5)P1pC-Y;xhDUbA4V-A*!HwJA3oO_fdfnRKh_u1!;pZoH1|vf^T`y z>;n{h14cUqwhv3~9Ji_LEQ2<#WM2a|J7G3t{@qc_lxN}V;Yiy#e9|HQYlRd zN@x*qPB_|2(qPQCTGV}M@D0K3emD|73q-Xx44>pzaCd5T(+T1~X54T(*{~S%K817* z6ae7}0n^);I3p}Vm=UO59TS_34sf25Rm4#T1JWHR^`Y}ns-l>81aBV%I=K>j7+)l^ zERB9hwxiQwbqIEPHV+TCdCP<(@QxJQ=rrD5Jqe_VKhXHZ>?^xMN5ePdifYehe@Inq zu4zB)VM6G(#r@1pmHRv1!eB zr0N%Gey0`jl}M}N@-b15w+=ePBtxRe^Y2`L8(K zXA~73deGW(sr-DGqUSq;@#HaDu0R@luh8JTJ)e62EzgDH?1Ug+X!*EOkqB^P@qQvR zq44F$C;8&^{y+s7Mog>UDPPo(?@{?L#1OFAy*;mbc?4vm`z}YuQv7!LZ-`XF(%>+k z7k~Q~Wh}HhP7FUew3zEvyQAtuwKqpP1L;vp-ja^{tTSIqdF1yvkD`Y)v>b#fcNVff z5yA);ycQ!vnZ&1j?vI(}2>8UBE=F%T1{VvkEQPc5$f}3kjoH9ykn9EOjtyg0xM>e4 z(tv1G_yA~>0Vy{4RfBwS1R)Tgp9Bn#YCEQ*>)M5Nui*svIh|^hg)aoEQ0pW9@N+yRR+KI!XR!~}6p;WqsT)kscU+p%6UT&Zb+l)a z?#9IHQ3Qhv#HNHkF>Bhh=SNvhJp*oHnRz{nNc&-yrRJ$5P-~KtR6{#iT`~6%&Q7^5 z-2Yv$Dvu-h=ZE1nzM3<}G-s2Z!g(+kZ&0ihM4Mt#JZVpFG7^$Y+ZhJvN{1&tN=>1) z41@TDaGqWb4Iy_O$RkY7OtV@^vbDHA`^v%;jW1qE}0H$8P~Sj$UqP6Jb*H-!=w&&zdbr`G(1Vi#qhfJrJHkB36mU`wSE z`dh4K;qa>dG!-)@Md^Qyn)xw!|L5rc?Ka7s3^n>+H?T-uJ$jC{H5<(z)VqgjA_=;c;hjklQ<7&gz^ncOpeoLRH5D=DwYgr-saQ2%(6Jm#G@$+iVhMv0b_9PoGj*iUVKOn=ba+q6a z;tb(S(q?gB*SObK_j1)2FKhMVLuG3c-9mCTuWYT{?8cjX9;S3GjYv&hMptF=enX>q zHv;`v7Cj2mFo<%LOMb&&(8kyttsr+skZR+>&>--?79&KDjDXT{3qA_24T^H0Bi|`iuSsSpxgqNc{8^hZC$TN`{ z8*uSKVd)moZtQZ1iGOYtORQ8RJ}-Er`6OUUt82j^#hN;U4r?nx9I*#Et zUID|s?lEYy1gQj7{2|Ru`vSQ6>!Q?h~1Y-PFgm4*Lu0}$_G6xjrylJvz zUlJ%nMnt#A?H6)WML`ajO{gGv*b0LpJ}S7_y}1}tA>21ZLy8bPwYMpET>N&gSl$o@ zgPlonPh#DyL4yGaK3$5!Uc?~ZIhY>EtI(Znuo7`CLE<+^05brZk_w)KOFMWP)ZT(N z5U6#kuLTmuHBvvrkL0m($nBK@Nu)-T1#%I+l6!HrvW4gw5sqZtRx>9M9NGg#iLa-# zpiXNFxEZz*oq;I%w~DZj?R{ zLNv|PDh}K4@K6$`isG&gaPVqDz8CHTnl;-CmK>6e0+?!EMsKX+v49KmD7Ls1 z!VPcMnH&RJo`g+VwASYwlEZar^42rT&R8T2@^-+oH<8vw24hX-`p-l0voyYUGbc4; z<(0Fe=eQor^@%5u6Q`)~v_8@` z*Qlj4ST>kOSH2F7F_Jr5Rki>G6F+7E1ncr01%T4@Dlve~Y=$=@Rmb0Gkkdx4|5Jgt zETyMHQ;Oc@|87DS^jTpy-qc()F52c$K#pnsPuZI$#>kW+2^g+DW*bN@4=`Wb96aon zOj|;B>T*cMdN8a`nH+a2m=dZwAUe0)hxSf{%uP7tKv>-Gc65p!jw9C-4;THq)TD8fC z4*hFcKdSerjkk@0*w+7nCTDXKi;qs&`#^WXjpGQnVJD;|UnJ(7j|2y8iV#ex1khMg zrB3Ag;=X_Vt)c9+q(i)NDea$O1Ev3=TRa^U2k=DgwDv2my@s zIQB{x=qGrLOlbOkQDRiL_GcPJXe0zIbffZ(dO?Kb>WDlAon|Oou0s%?{(r_7dfi=9 zPq+DSu$@*nOwaWb2}m)ataw$wf@U8gIU!b`DQB%>k zB2=LQoN#02?7hyMc+S&qe0Ruj*fyAFtA}UtQhmr7u5oSiB_;d!RZF~%+o%Oiu4tQ1 zG%P#rokt;=D>Dy{bF8=N&xZ`rRYcx~c-ZJRFe&~iM~2vjxad`WLPN*QaN(LYJ+g7e zMQ^F*(Go2>TEV=uJKo~af2fw(R-#MMNT2mR7bj12*+Vs#5JfKo&lA627HDEM>2x$; zq5=bPm`BqVT~3S3T{=x;ZE1te^L@AW+vuT=b1I?;r5ce=kEb=6#PKnyyTmqqXc`*C zF!u)PCW;W5l*WTTZ_m>34)>%<9hv=K!>*v=NjMbUWqzTM_apscsb zp|Dtm=#B{4Hm~j}@*MMpff!SX#%SIgjkMyK^awEHP_Z@h%VobQK^j=5dL+7a3 z={0}LwYZbymijo%WM*W^#w|p%&jto5%Z&pDwf5{Ducm?KOZ zU4lDQRRn^XG$13v0SCfNH1G`+u$h0tN1>J=I!4elOod67{f$2DF3krS{m6hf!JM>& z9*C^76D2lLCAkvLDin(`jjQj6mIBF9`T9*Ygv70BoW^;z@>NA^Czl;qDI+_Xor6d* z_Jx_#4u)8K=2@DKxM8Mv$aTgoZ$E!St1JbIvgfXbbadNW^;Gygxbi7wXD`Qaxcrzh zIW;&G5tI5-q@|-G9gp~6v_K?>4zEIg%%zeJKQJW>5e;>$ zb)fnvq$;-KVG-ufdZ*e1hegZ(OX3e=zczUhh2p3tpk(2n@kiKEBmUkCo6H{uT|AG} z@;j*#LbJ_0tOdDP`#zM)H3ytjAnq>rOwYTD9j3()y{5r1= zla6zh(Y*a%bdPOXE8kHU6xg=_$w}cfIsSFcAm`2ssc`0s6@A z)BavrF0L`L*uL?Z0fS9~h534gyiHoL<=GiT#p!A2E_GlkG4!hAc#2#bGnk_kJgNgy z((EybtD~&pDOxP_0W-9tPo3`feJQRPeq-m?Rif9KMFu=hs$DzqA1trnHmJ51-U~9` z^l`^0plN2+!K2&){~C+{(JjYmo#;EZ^BMXNV@Rk9dQU}@=^SSq+>scJ%ud^*F6j+% zX8uV1M6iMBogV2UMJiZJgIL}bhd)VSo^}K2@$2F=H1=8@r!u~Zo*9W!7@g%wk&?SE z%P;HNT>kQx>|Bmg*z6JUkzDM8b~lY)q|kX zkI+Z@(T$$(s#b0X$)pnmTm7*TC24oBmwdwoN)24aJ4$6kd14buqL!_+5&FX{FU;R# zl=5u%#p0@_78~>|rni_hkQ+#GSVtmjH~}x{3(=drk3^cuI%@)Bu2>J&u43!i@V(Yk z*Ue%4PO!HSTXOeMcOEDzM%JytQ_~ewH?q|mWyMFfq$DO_K#3iz^qJ0|mfwQBT(R=U z`qHk4x1cxNyUM+f3OIz9L&~sVJ<51KiCOD;OohKl7am+Gp4Tra+W6@VO!0D1X{3;R z!j>2nX4yC3EUGpZ9Wsk5a~Mji+OotK$1K>SitV7X+w#x7KJTJwQH=vL5Z!o z;AZetxluu~0?KLGg^UsQ2U{;g zuQ4}PSJv`Yt$Dj9N38X}8e^4KQrKMRZkStqXQj@??F&4cX-O*A{+_Il(<<-@wi661 z+D!HmdfvX2JHe!R=%nU)m?#^tuU$pOMf)sr_o*fL(7<=Y;&W z4&Fo78tDJ`L153Q7%zk;PyBt)ZL}hcrL)P_$$&N^N$F}kZ~yjD(M25nYdrfx!gSIb zyVR<1#yqo^BmPY-u59RVPBm~$~LGeJ#H+_6%)<1ZyEiI+kRGIY+Oac^FzPzE~@h{ z+`Y!017|MfttRL^){*gobb*p_Lpr@FW!@A7Ywzp$lG+8aPl^O6aH#zaraUSSAuD>N zmOTfPkp8Jn7HU)hkIV?s)5v@5a3;i;R4tm{SoS3W%=JmjU_2;bU5L(~-BS8l+%4lHno}de2?5GITCX?T7W* zJ$7v%uX)!2vR4uMTnAtRW(#Qs2^ye_yR)$JfOwrUAnYoM4y;7>%9}ru{K+Dc!NfdsIyG-@O~J@acL@>1uBx@2F}A` zLg&R9VPn5~znC5tI!`{Rt(@^s6F04_5>LoIK_dETti5uBit9= zJtrRGHd(CY85zY-ib!Q*)zCJ4_TZ2DXDje{&AQ(O1x3+rI@2;&{ zyB&{v@#2*|5&}t&`^6XKhw7_fImc(-{(_W1_Vqn5bKGOWW_vfWSZq~uJ`qs}GUbnm zIh1zpv&d5EX3HDu^GSmX(kQl=VeJ5=v2jcMdiqJIsUVE7ez^pcdN2Tfr}eAd@zI|& zD?SL(b)MDP*8G61;6CdpI&H68V8420cof?U3)>J%Btj*!*r__Vf(oiY^p8z2vA(zw!9Yf zK+U`)Wk5F+6@S~8WdZPt8h0EjH2@SEgh|08kZN?nI7R6kLUAh5nF?e_8QP;>6Xw!f zwwtEKWZ-tw1apcuSBuGRRS~@1KHwIC+pQrP+A!kiFsq6H+-{{CYMLlOeeQJEModWy zIaORv?0$vSps?FlSVrD=iL!v+v?&666@>uwg9Di$p@rx7-<8^Tc5D_+wLYca$*(3tT z*qBXBTXn$T^e)}Yysn_;rVH~5ke4_Oy6FVmWXeS(MS(l6#N0s`7Uj}17j>8e0ogvZ z6=#8HBbLi4EwD|t+vlkQ)6oBB621T{{ISBrpt&KO>j}nLsD%ryo2rWIpd2UhYbuAR zmw%bq&jXNTQEihdpd3;(oXgDIfwi0@ttIwLmLQgOMa+8UxuYH1J}_Oi3X!xEga+qv z0@(?^xf|CMigH+ky1u5c8vR382*WS`}+%Bt`$fKc7lMym6{`|*_DdQ zR>D%MrNHU@mDT1SOLm@>&F}|Sr4Mmx}gMu|y zg4+tVu-bMSw=|7Vb6MWe0JY4r)596VwxRkTrli7VFDMCi>xvEyimV)qOQpz21%FAR zz`%o512#kZw@%pDKBse|y)#7CsVOleXh#$U-#J%zLzz5*HWqJ;0D2U8 zxW;q`ZSAQ*qC$2fW$X14pwkKV3_h<`E3AFujaQLpDcAXTAellxUTw+~W(_ zj!(i`Ly$AjToX>H%MDgg=QG5&5samq8y$qEBPf#MsRh~`-Z=&_%6~8sj+&H+){_-m z!Va7%wwIWs%YdxV8%Z3;unJzVPRnex$k{1ROM)8!Juwc~Z-Wb);5Mx=#9ScrwLhEcO14k ze6q!$H>`0XPUhBHMt?b~=`zRgtkV^_6fMXD+6d~^AvqMQodW^WKs+SBZy&h1b+Y1ni-LTBAy0qO(#!v`~41e+cY_}Y?tC?Dt1H5Ew zKKx1$sxArHxg+W(rYY+nZ&3eSa(omy_4YtPhw-Qq)4Xao@5UPa5Y$SE4O<2h7nAu2 z;6O-&dc<_nMp&O%pYV-WWGJB7cras**c1SU)iFC%$0KT-&uXb(fx4c@dUm;i&G-UJ z(5Bej-phcX0DsOPv`6WYfhOu*rPVZ$iHfLhw;I#JFktz#YcQ>Lh3)!Lt$yWOSOy zIUq@(*2jnnFLD2AEIl<*qho+?IXz}Xxr)J*1WD)A!CCF~P4zV$_4ATIZT^y=q-XGJ zOW+qQKRM$0icmQM2|Y_T{Uh^KppL*g@xV;DB%B~1vVTPY7xjP|nYoNJ_cC@-Dc>b4 z%*xAQ1~vjU(O{N;%BdjAfk#b{21FUmL^y#~!_(7ewZnQ~7*&mU8J#TQ?J@PEUfO9p zNOX~xIKB%V64MUG#|d}D={Vd$#z*2Q-78KpBz)bBy&fIvO|fQu~pcwfdCsv>-0cLBHmtRp;pac?##3hEqa051tFBp z#t1&POzkB&%7ZXb2>k>VBa*~Z>ZP`k5=@hhL6d$2!zQE!HBFO?tRg*Xx z5&~!o^A*}m$YEWWqS1JMW}d-|A&Y>rp~bNa7#1a1&)BD^LE^$hH-!W~GuVKWsGF6E z2pO!fyC^-BwUoLCm@FX52GmpyvSLjvgBQ-Aqv6CfY|csu$%6PL`Wvqa=n#gVre}j_9Eh#aZ@S~bM{!s z0PHoOjBhqwn=gQwI&^P>CW#Rc!{G#>dAppH!Go1}oFv6@2vJsZoLydlV|&qVVu_M& zhNV;`Q?S{XIw{`vFaxAnl18UqiG!1PNjkbG57ih+y4;NozI|ww5vVSS|*=)`U z79_jc%7e}iaJzX<=Q#nA$X}Z{;V^zt-z-@GP!NsbCPlcd5`=V^@QwIFf}l%n+ni#C zDprWuh)MEPNcV2H5m(_{Bu4|cI(Pc&jfILzY(o1TD3qmt6UIrY9C{ZO0Wr#MSha(0~Cj7A|cngd=+HsaCfd(4(5dSKs z`=`;5Y*)!%C+Og9B-8$FlHGvt{diwkv_3t?M35njwLIMbA%9}WjgwRhdgen~`A$H$ zpB@{XhlmAL7(t}if$&O>)`9|cG(5u}>~e5&9Br~S4Qmxx>Pa$;SWEL$Ii1Eg4>xZo zFjS`e3K1fR)u9R!^F>Y~pE<%G(jVn+|Jv?~wNWulw%A)_{^^eC(2aHYrS#C!pP12y zt-(-0cLh2u%YSs7+*1&H1tj`jYyj-`yA6f@S>a7>L1T$|$Yz*^1E;~A17S^xsR+3dPf=S& zA7)x|+7mQI!aAr3CkwWCJ=_gW%ENUlqF@>SsBRb=1%E|JG~zUfou!y0A}@90B)Y7y z*o|uiXjmpD>@*fxdV70&9kG9iN3%OMnvj@d$%jeNA13BuY7%;}nb=@wSh3+0;S-+I z?DDJ-GZVHTeo!|O0~J#6Pv!)8MSvcF>&YkFg{-Xs-eIz@I3lTRngA@xA!_4T`*6Ku zQtU|gZGZk!LecMZ-Bi*+0jM0`g+@?9!}eL4WR|e=$6{2~m_nJFIytIB#rhQ_0^(yx zlkJp&9!R+eyT+AnjTI)&w4j}cABaLurh1AV2(YwF;85q-cpDSW^gYSC5{dz-zeghK z)DsjlW^kFsh6*C-&&o3pcRH^k@k{a~h@ixNDt}2zk4|p%2yyd{EHETkdw4TRnXh4_DmY%-|v67##!?mg&QO5{8YYFOjL=411BBzo4|t5!+3= z3Ss|fXTUjidjqK*K~^&cQ75(O&nYRQ&Vu+jxe;PD4Z@`!SHXYeLvrEpqL*&2+lEl{ zHGf8Vd3pKF%1ZqI^78V;|Cjr!$_spz<^GCUGb^jmcfQK1s#yh~JYN$?_r!FA(+bLS z9xHKi{~=EiXoA>L0G)KqnqyNBPKb{jaJh z_a)N*S-#4O&+h+tJVixdp`-*k3Dn_KiBw3mq--3Oj8!;gNK#1(ZBAh;v>KP$Tz~ci zs6ttQGA|-2!I^r8Op_q$ zMUxDb9)EEQFeq}e+gI+^%E>%B%ygjUUeSOh{Ifj^({z$Qe>#qCHLHh-I+#vWIn&Dk zlyuX>X}Z0*)%1i_j~HoBGJblCR1Lb-7|BOV-mzs_^$4ngeJCtv!w$2k6?O983pyOCe*W zzJD;&r*g7@`leycifj!*bSPL?jP7Q#S3c7QlLpviAoEZ+lf$K26^^1O*<6N;1W;t> zFvP5v;y5P8i?bFk0FvSrhC^ON^JAc49LP0!wDjoJWRNJHrH9+ZwZmcCH2BtSTTce4 zchtz&94C7$Ojnr>6OV|C^Nx-4iI2?%rhmc7qs7Xj$ID}nnay=4Vds(AoG8mVYNZ;* zA$qt#IJR+glETo{pvncn`k11{qSe6f0zgoD z_P*KV2gL135|ldPGOt$yA9|%|Mm0$$OD?mm0G@S$oC+!ykm9I%r)Pk9NH^@#TYt$e zNK=~XLeWf=tQ(vm^42(wb;Rt2>x{6h*Q9Y{$kMmtpUp-X$+L)9zyXbu1tkhZ0dNK@ zENAv%8u=VUkUp@RFmboXZsm=22nUnFP&aPc4j`QGN=eMq zY%h0DPBT_gSdQ-OrLz<|dz)AmoSa+$5{qP$@0||yV>L71C}zgTbVG?YIRJ;G81_rM zbLQkH%n2kNj-)b4_>_=RN!fDRyb@Jo7_re>PM9p4Lzv7a8;boK0HTDd27mslna!g4 zmRDodz*k-#9d`B|lxZSqV+|3XXOVk3Ep z-z8FAmh}mJVhc7vubUK3Sinh$ZzJ4c3;RyD%}CFf=`il?ko zo#vTx0LKmw;>$*&&#~7;p5ep#c1sE;xPx>Gc0kz{NUsy1UaHnVZL@D|qq2;na*#di zKRIaAbx^0^+8>CPdyptYB^2_y+BA?#3eQQdP$6Qb_YTdv15rG2LuI?UP=KA=B`sqc ze?858;DA&O&IXn=Tz_K93Ecx0BW@D`jykC;nj^i4knkIZX9>&gYfUC)iUxB2hReu+ zm0R?n*O0L5G{>gH@!|02hWyjPlyp+2nRzuNbVU@59+N-9eshp!$s)2a&eMRlm1N04 z|F-gvSee(86##%Fh;+HMAjc28y7mP%wH7VPbZv+aP$Y|(w13AW5-(3a!(jm=OpQA{jdQ}*8xh(Xbwe$f z*dV6E}WB$Mqj2w&3}A@NCU}?>hM)dnO4-iuSH;)Ok!#cyPF#=_&}VZHOL%il5>hu#kYC= zZHY*W(x)OVN=`<~v`E9KUR=p)6DMd{vyzk{f~BqmN#2x6eC0Sp3CELyENX<4V^N%U zokr@2&Kqc(2fKzz>h6qH%LL%q*PX-~S+xwX!?UIvZhtK%BVxyXsAhmN^QO>r@Fikc zRy3$veqF3dsjCP$3n$=C%w=@JIQ3)KprMJ-bTPBQOU5AjLuXg4mnASx2sx>~s#E0w zM-$%LgP?5X$UrwM@}5}l!Ne+7npu)31aDqaK|D}mO_oG$m%0*cvWN^>N{lG3AS9&7 z`igd$WPez->jd>wHR|jNJR}XnkSHTbwrzQ>72Zp=CFaO9MuyItd6)&2m@Hu1vn?_n zLDYdiG{cp|Qlm|=e?^1V9X2tSWjJ?y%Mu~5a-eqPQ0w48P2CY|B8f7z+9jleHq{Lz zxicvAYBAZPM+&o6c-U&G_#H z<(e6O$xJbnqB&YIBVPbf3Y;RznuIJ^HPDd6D?tNFafg$p25G_}tkXevTc$2u1pTJ6 z^?xKQ*U1!$%xvgxCFEwDg_}*6EioaIleu^_G%f2`RJXwXubQSNSK`5;x65{ZY`M+w zRkGxt%rr)(;H7jUMiBORsnkV$HkBaG^Wh~!c(MLaa4@v0BGe=ZUBk@!KS+gvNSrO- z3IsYIfkI5e0otCh2NddtqIDH!WeiM_Y=6;Gwnbx-A*vE|n}b|6O8FfXlYF&y|!N^twi$&V=jUX)tjnx?ag)PJ3^ zF;bnZB7k!@n3J~EmY_nTl|$KWr3fgr{T}2flS2RP=I#Hos^4KP1iNK;%fXt$fWR3r zu%;07fv^Tu(7L2>bSmg!(07X>ASsOm@ai=FR5HT{sXl}zHj0{V85t8G2M6XQ-C!Jp zxG!%J=E3Ob`Ry5Pi9xKowgtI^(0}0EG_=Dywx~%5oklg-SePR9E2r@|OzI*08vjlMT_${>5g&{+({OvemdJG)t>*R}T-By8M~eeDqp# z0z&)S4$OJAy1;81&U|lFC(U@sc;)TU^n;J-`Hwr!2sPk%o6Q|h6)MG)jhP^X^ z5>D<#RkP-}q6`GsZP#Tmrwn|v6d8iHlxEVWD-{1e^rYNL7r6 zI%ERok(s1)uzPS~CKa4ze}6U4)`l7;3f+aNniUqZ`l(b@(#`5Q_Ody){$etn1t_t_ z*p%WLv1BMYCP_GNXX0>Jqz0n7B7`E1GQdX^#nfZ7m>qL;sCfV=39Ejf$e?CL2U-Ou z3!H`kZ}qfrNqrgm8B7DMDwI16j_)c>FzPwnUJKo1FNm$B8PU6H7k^XrB09Z76AjoZ z^W?N5VZ0j5UMQN_D{0qEYRx{$2$zsarMgQ+HUbPlG|9L@-_`f38YEe%Y$R$K&f0(^ zYtDe-c$ry#knB;rf?bU0SBeG{xsD`jv7#xdxRp*uF=NkJiWfJnE{|z{kkdupZT_S~ z!&`*2Ng#pOo)m_t-6;ttBzYM z!n0P{ILwxy*=J+UqIx*~0I_N~F|TOE&Ff&|%ETX-@3m9cM=GA%IEP~sGgX5wiu*KZB~i0QtaC`PCFKB_g$*bg&ai0S_~3n_7)3A2>A?u=Naq9hG!l05Sn|MVIElp+6QGl@`x8r~D9c>HP6 zos%i%TXjxUT})A)N(0@Lp~g8kO>76VXpT}~%g{Fvk8;@R?kdVtsmOfgpIYtRFjJ$i zKhxiRroa0X>VNMDB5sG4YgIn%B&kQqRzH|8ecFGJ*(RBY3&66VVYm^YYIMdntJ9S1 z{cybfXZo4X^fRC7XFk)wbiz~`y*RM>+ReU$_;eirDLS)d=e1I>xK6vy8CrGF@awX@N6EMl4>KPEhh6HK88 zAfjoFW;u@mJ_7kJcNdJ~G!08&yet}TMH0#qh^1Xy6KnV+Sd75(*jXHM_RRZ%prP{` zry@#(Za`s*4~V!?ILGJr5&qlBM!9TdwsCF_5$ATDZWg;p;YrIY8dP+zHI7?RNd;$1 zQ`oG?=zor-%)kQ@<9)5L0x^Ws?@{mVB3lts5G6gD

!#1v$RU48*Vy2P1H3&wq>Zys-cDvgkxR9-Zo4BoWKIv?w7?}+m!Uy z9)IIV3Y!#wq)QEwI!P27^dmEKGbeB=R#!(6z;Oi_bh#~Z*UWVxX+mT5coF*{(hvxZ z#jMzKd8&$Tgf*zImrSb)<0u@FD!>gm2_nRY*HWkS$mUM~pPFhr+`^3; ztwbP&&cq#szytdGS+4)WelT|~D7SSPLVp6gKWcj;*^0~37!{zyZm40^CoTtT`;AM) z@@A7*G|C}X#U`QA92#KbMu6sgIvL7izVGiZ1pWOuPTtX%0CipyF>5lK{%{>EdzVfi zH)9>iA~77X4@zJ?&oK`QdZJWWi;(QvVBCQE=yqZT@RgT4`}d|9F3R=hFq*UDd4FJz zW8~yhkn$L$IS0cZgj`O7sIyQsMFG(mAE62@=Kzl5(dYaPmJ*^wvU!-yMOT%nDioXx&f*{RFq=|)A85>^@eAYvr*zD*sO=K zM=#S&WmA*GC`rn!W8nmFW^5$O$jIhwG-;W3hQ z+0vpSmUC)M}|hR z-(T!6$Fx<10{O;Y?k{(jSAV*F6`j8F;)=!oh|OzJ}0(RqE`s8)nzHHbs^%KYO<1?+9w)Weu~!%ZmLAnmT)D&sw@{K{UL4 zL$SYMMe9<%t5IB6tAB*MR&C%qm->5Ftt|F8EC_2=4Rb0t)M{Ewdo5qT++Pt~u%dNo zRqvAZb@d%`gC6WQ))o5~)CtRG@m=Ai3wy++T_Gi0>|fBl-e`~3hm@93nAbamipB9J zA=Dge^sn&OuB;c=w>B+Z7lMnzQe=7E@+G3NqNm1JwN4E!nSX^AbGBCOZ&=x|xV3Zr z;-xc-{SADiuAs%bI-EelWzA9$4H~4((*7NHt4RrzZNl~u5bCtiNW@UpuOIX;_4rhwX z7IY~KJ5<9LUVpTxVHG?($Q$dr%8jMbc(2j0Vo_sLV^|L@Z=0!yTiREukrgYImQ_7% zwZ3SFytJlDDWBC)-Zgu%8t<;G>xfqc<8v14@db@b+NH?M=Bg#NUEEBLuc%nxuwvPw z?qwUAdA)6MO?y1H&M(c0MwXn-Et1rh7?jWMZI2iG7k}t}MGl@VcFL<}HOPV*UbRH6 z@UL3mT^U>fwWS+4Be=3%&=vXYMOu6oKSl?SCw`)sQEn5^^vaX?{xlveLS>MsSwAkMOXRh+CC|_LcZ|GUpSsUu; zXlO6?H-DgcEQXD~c6G)2V*djF(r&(X!%B4I)-8%HSQ4pR7(RO@x4vr@+PJ!^U}wW3 zj*BdbD$$De_BoutO^vN=m=%)L-W3%y8&`^kCU(VYD`r+!z*wxdqBdT+J_t8RtsQfG z>s!x`Es3pP6d^}?Rb6~}EVM!IZd%x@&Z?DXw||CKwi-g4=BrX>ubi{8d|6X0-d5Sv zwWJ|FE7TENSndz?wk=!e>n`>;L@O4w6#E-y*A!RO7W*66t;AOp{Y>yqMg1#p*Q_Wg z00oV8HJ!aTz4PadZP$MA$0y#~QTMob=9JSw_rLSxlTUs_6o0($_QlnY4K4c0!HQ{@AAQupzg@TX%4@DU ze@aCNl$3no=IYqDAA0D_?c2APNB#h|JQMo;&1as_^}j#ccKIo1UU}73=iRdKioZPn zL4&H|#6%`~7$GJC1qm@yEIUxoJ-M zjn90&GVCzt$P={iR;|<1dcB>*4oZzwX(4`OnXJsIao~t2fS!Zk~79 zTNfX?>h%2!ubn;Z#5b;PoqxCO%F}AqopV0~r=NaAV`Jlk-S6D6Z`GHy58hh#v$b1K z-L`GpA1c38d*LyU-#+-w8U4q<@NL|<=Pz6CxNvY_Xv*tPT=t#ot~=q}4R01pFWp;z z;PeZ3KOC>vzJ2?vZ@zi-eJ@@5i(gc}dG#0eTp`>u|0iGCQFqGER)5|1`QL2#VEZjs z%-i(fgR|e%Z<;Z4=J9hk?thHGV(tYWeboD=zUC_j`GL*5ryl(27cal~?6Pwo{`#G( zA9!N-J^WQS+%Tj6@;hoTJmxgN|10R_uG^N}wsZZ_d-fi`{~vwmzaM@$d)m5x4jtV4 z`pX;lKK={wIrW3LmVdpe8-M%VwP*CcbN`Ef`0x5JmYw_X$^$3Y1_yd}44r(%p+BE; z@S!s=zj)nOzVekn+}=9%;rE_6>35G@|KzGon>Lk4|5$m%=RaTQ^DRAaa&2HBwqt0| z6^C9p<>0|HEmfpSf z0)F6^{J@uX49V+1_WAfHCVlkr$J{HA^zXX8B)a$I-@Nhsk0*zAe&5}{seSig|J_?J z;0E?@8(P!bbW?TA^~fWS^i^DTvwPLOM||^}-~8yE2VS|g_1UWZ|M>czyX4)2{Dazn zXU?=B&p&$)zkl$rfBoyC!Qi4DS4`bed+glv@9%nX@!)?i*|YPW-D}_3J;?uR-GFD- zwBLs+ejmDT-xLq``z^kUHf`EGuXe@m!GGPob!%|oe_mgA=vU8g`N9{z@Y`QT|L@kF zYH4X{=^M}9a^b!yzy9seO;;TH^Y)>ec3yixzu3p!vw!l{*IqmC_rGs?vtv#Bh7HvZ zKm2gpx#xQNH+^CM^h*xiGr#fYy9Qs|asK1M^B#KW%=iEGuiIMJizj&2eCx&=Z+yD{ z?I{PJJ8J)qq0@i0VBmsNCm(s_k^lVg!|UdK=O=IOy6uabHf_3fr|Q~&`}{puoId4O z^J}lTxPRfY6Su9qfAL_=3)ftG?GGETp0+DI`^baOP2In6^QC_pCkQ<3rDH8(Osa*#i~N zZ`u8ujk6AX@b>in&%f|!#m=+7v-gpMEe9q&6c~7m8#w)`MTe$@npWPq{1@w9*rd#E zZ(6l#${&9r7WH57%QRYD^EFn+O)#6&RTQe(hc0e6KJKI z4lTQV-o^}2cA*;7(g^|j-UJ8oC_`J)e3oVtJE=FYeFwtxKY z@{4!vYOn12-=+hTv~N9e*-5WIaoI_`!q0CyH06YYMU6A|t(XjVJodmV-@GI|*uNZo zGq3-^s|WXPy>8wu%lGVj5UuBjTW=^ibK2kk=jKaZx-YzB@Vy7R_w4>$^K(P*-~QaS z*IxVD$Nw0-@QN#r-Lz@biTk?3p?}bS|KJC|JvIE+@Akd<+&zJ9|L@I;b&n729z1>j zj-h=GFZq1j_9OPZ{F~JWF5P9=lNyKCS3?|=J8V(-76nYDDy zn!f*=KY0E1N5A^_se#vDfBiehyUz~1bT52x{p+7!ykyCHf9$&JwfX=4_}IR_zAJCI zVaEFh+om3M%*ns)Xq{W!-+yrD?x_c_er#y>;L9avPCNCRA8|L$UcZ2>< zxT7u*_`$xTWB0Cqz2S%>kNn|-4}N{#ym=pe@Z#EgBF`4~?SFfAAws)9Ik#!+zlYAe z;Ml3>egNk+KlkOylmF|dFKpVfWy?>t&NSZm!%t55!zJEFR(|lxq}!XW*Zyz*>W_-EA|Ly6eYt~#^5&oYa zJpAy86{0a(}{eTYP-E{&$4LgivU~bCqSQ z?mc4Rwcq@>_}8(wFW9tc(@&9)ExBch{b=`=Oq_(Y4>-c<6%{e<+^#%}?H2c%Aj9=lr_!gU{c3>7|pNdgX!*OJDo*@9pPn>C&Z(`vznEUp?W3 z*LU5vXyD_IKc3z5?#X4xKYtzlchlbPWv3e$zMEJaSX!Ad+w_K z+m6SE4jnvh%9K(>Kkit1i~7%3Yu>DQ>$``h9EEW5{uMXB&;P%Ib9-MqQu@DNHXoRD z@3y}`bED6Aqs>8wgo}LZKly0=M<0LOI9N0DpYOf5?WwD$-?lUI<^8wMLnFO=*MH{I zo;af5(vxN#vwr>hUE#L>`q`RaeP!v=rA~4fX)5^E?YG~4@80uc%Z|U~$mkz`an-y> zJ-Y`tAbQ$9aKVX_H-7kTJ-WVAI*)Cgf2eZ*-dDW+7o2nV{15J)zgf6-Xj0X*g4n>K zO=tN3a_kwwfwuw!r#}@rG(~PI_c9sn~ytK z@z*T{1&X5l_3wXQJXljTTmSo{YU2&ie?jd%^A80FPJil-LsPn&3chjmwC1+u%cu2! zepyF*`?vr8%#BM1U;FBw)&Vp(4Y4)#_4SOc`O~i|HeGVbZBDl4=ziL-aWap`Oy#Fe(|=}^)vS0ek?lB+INR0&7W3)?)AAnz&^Y+RFYej- z@$OgLdv<=j=Ew7|J8^PBIe)kPh@ordPM=b>?yJ*UzhBmW!O!oW{||0p;PIiGcD!&v z|CR4^1@FE0UhhA*9d*^sH@o{cop#FH4PSldkM}?N>)6}3wmw_D{~s&&+||8j=RIrg zpMTxSlMB@SdsZ25?mF_4GV_XU!J|1_o|Av!~_2SI^-GE`Q%P^wtH3=3H>b zhyS>j|L=CgsO;+5gO}SAI}?;W1lgDc|2$x)`&*Cth&qrK1kMzNMhx zrnBN-=|8x?J`ySU`8f|w>%Y8x)22-U|Mma;lfLt{-(O#`>mMZ-AF4X};C-hY?3%s5 z=Zib)s@{I_u7!aBIDfbQgJo+T>05Q+I`<_j~_xw6XW)Q_fiN^YdR=ckR5V zN@vWNad+@>*AYh?@#<642kRCr`1Za=&&7y`MncAsJL={Nf&gaBa7F+4i)~L{Rdm%& zH%Skk@V}RxG=J;v^{+Qv`gPy`yYuY(w?B6AVgwKZ`~0Bb~7yj5xad0^El(G8b^O&d>cKwuwAMUD-3 zYDbS<9>8kcxqG)VcAJD?lV6c?bR9KX-2HO`&%id(Rr1_UtlH2F` z`1tg{ihozmwawHN)TPQ985ybg)`&t8X;qRKrAM#1x!JXIf2OP}bI@u-UHc3Ik++uPA5=H`;x+JXmGhQwxOirC039r^Sw zxw_io-hPb*$6bpm9v7_-{M?U3V=ypTSO(jEh#CBq3(2agmiRtDy~Yl z+w>+&l^8T$M=XbyqaH~TotNPQBkpY@nSYFFR##uh|0>! zIe+&vwIHF~uSHzM!@~pJY-|*mHEY(q1q&))Uf;^g$G0uyc^K#W_wSo7P-IV^K22)7 zwXoYhjk+D05?>q9rCf3f3YFEnBpo1)!*v0mh5y3ZGRyj(N4$d~qR>yzLh|gF3(ztR zPIIbaX7ASs;IOTKaAK`mw^KEHi9za(v42O`5IK~0S3ZgF*Ti$#);~Clbvj8Qub?5* z)s~^2B&WG;BpukTMu)zR$U!x@4I7NT=NSiEr!7N0fvrERcsu;9V75lgg_8 zYjfr;S`>R5UGa7Jqus%C}r=saNxFVws&>P@_(|=+z zF!k`r8ql%h6A_6&sDBsns-#NXI5P6`fX*ZrLWy75GvRU3dQ@*yiG{6gn!fp?9OJmf zLP9&Bo81rd9(I<^9ST|Sg`yAr`z1njsYd9x(NBTzu6*)&au!<_K3F)QbCKL}hwt*x zlK{WETy}nCPsOODDie+Q^XGTf=kq)dZGT$`zOZRmG&MEN(8LSR zo-=1xMuuEe((+=+?;5Ha>q#0N<*S;zsjVvcaLBvo+qZ9jnZ4iDURqju9uJSXxA&p? zt8q`|n!GAY3|dOA#-gH2%f4o0AW$4%zkV$yzR>S>+H*eSohP;D(fl*MwR`nV<$G)O zo4hKE4Ze6s!+%%F*d5Si_ww>8-*>BKuj1O-1_lOShgyga^Sgwn8|bPt9)IE9;2m94HAX;2*K}Gzo_evn zVt;@CY7FM+fIM7YPfyI#(^F1aIbGj$?w8%Pl$2X{Z9l5Qr{vnRXJW&{!w>Vz&Mpvu zU%P+*en7?vvPL;`FvqbN6>+)(3 z`QN#7=YPQw%cb3FSzAWCdA>+mn!T+pM&$;*dHlI8+2Ba+A>sDduPa(w){k(<`9zOE z!Knij5DDs#rIJK-U{M?mFg-nJ^*{90p8KWV0P3SDyY<$MOk(+tZ3_gfvJHcZy|2%< z$=2U6!hLBXD2l&iIE^Q~mXMV_dXPe~C_;qZz!4!e(R$I%rsn>W9mP!W+MMQb|K`whWm{1(8SfTIay#j^I@q~`P z`heUw6-`;&7kxituOh$AHNl8mnM<}{GGkTRE$4p-9Vvpq<7EbgbP?#;xJq zh%LQ}SAIweY<2tbQBpQscflbeBf8@|UZpmV>%Ci+O#}U_ zy7cVVlHLKrXD>KjRs(6|{CB4*?#pzU0*w6g#j zjvp+pG`7+?zrTvL+4Di_kzGsHRD-}@P$9ESPdgC+;JBXEu4 zy6MlnyScpoqo{Yc*MT*5OFAHgJe+?rKRg_<@F=-|dpy0xGFBM9j2+l&(9)lcvXJ-*A@F@mbT3kzyFlEtSmlDH<>CWjW zU(CiAemnC;JMza=4>OPipua0tvBw{4Jb7Mxti&RTaaZFefgCWl5Hp~L_*S?v#<3OX zDH0;<|AVCNE;@KQ71v2VVnckOaD1>fFZopHeu=N)O=-@*=WaKtpQk!E*Of%r-v+;P zCARY(v_NcTg4>zDN4%%ZK=%3Pc8r_QdlK_##>xu9r+Zy0gOs3PRs2CVkHy7Nh-zE7KB8zjc*`!i9u{vZIsSSB$)@q=$)z>>^MtTB7{w z>s^JLIoUjfmljqVtn89gu7?7gxNFP$VQT+b77O#V=j7(*0<{(w8|{s}2b;HPZow=e zaYnAv^=k_?Lk>YbJ#9Tbfwn*1(GvQ#)yB&wVv*X#E-+IZ$?U9=!Y#;d1BS>}{`_9h z_)uTiZ%Q%JPNB`^svdHNn+ zQ(8hH?{7Z@`=Yl&nsKa6t^(RBC6|*(J+@T>F`j2ym3j9M;-zhkjg3PK8?@_Yt~W)E z){C8s6)8lyIcOgV2h^4IT@{1^&sZ7|#+jm|kF0jW0PR9kF6D>ML#y+)_{-fu7-HcU z!Q(S5Y9VWVM#e7pzlsz^jOuD?+_R~NMMcHat@X2)@bG?jtq;B;{71jOtN}KnHg#r< zrVK@ly+o~qUnk7edp3Hh7DXAOX8idSn7oo!qG=nehhRdeV9KROW^Fg%GAZFhq(ELa zF<^EXSYAeXb+JeWSM5&fZ=tKZTyo>xa0*=q)U&=5It(FHqF+szh5W(@(eRkSThICZ z?C=f=IVAxbt-N(Z$7hjU{yftf^&W#cN&L7_Blg_o7idY$^GH0R=5=hnO+fgbtgYW= zLQBGq0-w;}?ldWMmp05kvv9#M*R*Ve#GW7pz@$dqt{ySzm^fJB2#_8SeV!z_Z!NyX zWOYAmXHhb01{9b}r8jh6oXh*aEEMWr;zc+srkQS#*Hbi8w&(k^zzy+*j1@gQ1Wvs7 zNPK8%X`wPls8WAJL{(`Yj-MnXB=kG!{JP&ahSu2EmkdtUd2SBrTG&}cDe~+^W>tR( z93Cdo{ul%K%lH*oGXZ-P2cc-DbzWar(XFeal|HMrhrb~gOBL-7esl8-*IR}`LuMpL z>0iFxjXXPu7H-1v6fEccJlZ+HFG6HiL?k)ebQMt_=kHu(^L)JO*moM+v|E@gRD1?)woEs5EJ3tc4C-r z|H5kgS81pPy83#HN}b=HvC$n86hA2%O-CbF$b2y;?&qEoNJ%zJN%+cnLF- z1Tu+V`m&zypTBm}_>~mMuX10eHBVFZ(Ee<7*`0I;kCV3hQbk1M<7kma9P3k=QY^tn zh@Q%9N=Ilj$s3OU1wUtaGGPCy{9ms3d}?(gDr{Y2qxA_)H6Fe{ChRu~tgFdFWHaL_ zJf!xpyB>jJru}UoSAEa&IlVO%NI=LT+SoiSNLFg`_A0o#NMd>Aekg`ou3A&v-C}!D zxInaARFRRn?rdFS|CqUK{EfR8F`43QxILDsJua}4<^UGbZ}lj|2TON&>WL%7vYw3W z#MEru{CwFcUluQ5J9HjRJa(3mmDSLh=d#^pi@9F0`>=_FgG2YyS}cD8WL=&OrQ;9p zVPLd@qDFTI4lXiS4$$I-{iJ7xX>ql|$a6YQ zXw3>}OqZ9PRK!{;lhJj`NltRD;&EqL{tn#<`eeWGLzQ9XA!z-%(HLUJ;#14+tieO* z>Aa9khrtc;em39RLxBZ2^Dcbdl*Imc0SeXqJhM}47as5AjdgXbGTY-TmX18QsM(dc z!gXuEEour2_t9SmiMCYW#{7_jk=T?mxSHyBA7cHTeR1@sO^I4Z76#0=&i!6n)~xJW zxKn>!)Qr>^(7AzfB_ytGsjpwZs;u}EZ|}LA3)K2Wp}wBZm(l=Xzt$85(#A?GEU7#^ zpC=Cw1QkxJ$W&?doeSf7;^O`xz+dY4!Gt)_df0a071hazi|lR*Wj{Q4iOS2H`1t53 z83p33g90!xNXRGuRb+XhVqub;?5SN?h$-orMj36BSv<%i zDrTph{_{swRS{5C^?aO|!KkNJpsuZNb(ME_*K%fAr}S47u)c6fa%kxy z8}yS`7f4C@x~2cI?m7S2YoLDq`8m}A9Nnk90Gdq5adh{eXIW?Tz}e?#oW1Y+CnGL5 zcgthb%V#7R9SL_!djsJ2E+VcssiJ5Ix@cn86h=Lvo_*$W{&2BR+)Y!m!kdwoj=17;83!RgPe6Vlu3kK9U5_DBL1PpHMm1G zS)>`4b2$Mzw3E7pTZteZhfHY+FI&af+a9*Tv5sB}yS$luMoVa7Wrob#*RLm+P)s3{4&^F@*(N{oo$v4s>wZHPrriiWxXS- zouC>~r&9}BOtP$UO|CL)H+Fzc%tt@YMV`XWCJ_>0-{w0zhdU<+>Vs;lPR!yGx0t@p z_X_6SuWLR9^)Gtbj@S}3T_vOZ_L?9M5YB*2au9TjY8;ZP#id_ZY)(iJI^UNS0UZIX zM%d(6q2pA*F_zI)gPNMrR@)tw#x+fz8dhr0&F;(NEi5Ztx0k@Z=Do%!{5m)|;i`{=^_I`-Czy`qZV>O3}h z1P>44rW%)|XZ#Whk=>cTZ57C~IJK8>YL4O>th6~z6`Aw=wwe^NO%+K$9m@m&*>NLl z#f+F*ep%3%>}nm4z79bD%GDTj$R%Zu4O#v*I9g-3RP)5;^>Bq{t6A9BY;z0dQCFGT z>lMjFd`eOSzt#?0p=%3k4;`!&zDtnhLj%kDd*;vProUmNAJ~@0yv!ssZDK)zCCNc6 z4pP&<#$RhMdtWA*RD^>=e}NeTT(Oxk_4Q2^szG#8gVT9cM?qZd61!rsTndSNTeyzm zoULj+QkgcZ`26;3P~p(_Ht0EMc}j-uy&$9Iz_*K z?ytS&NOQsJ+TTLvQ}hlY_`>*|qQl;#d*cODIg%}Mzm2QUwWGIGeuG}uw2v@;Daw23N7{@D zEY+50B!JOauroF~Qq`)&YE?)*>#bi1T=Xl)8DH({;+OrVMXi?Xr~UUz&V_}OP4%8m zXTZK-VB^)!%4yg$x?Ro%|`%duk8_mZ@OW7}z~9 zGP|H)A!Zk_0D@<5($bcH8vXhk9Zl_H1mC+gM?SZ+Vm{U9ydbJd+M@TFqWga3^RqdLkXub<Q*{YV+VnB$UT9B94CP?nt*{Bq5Je)l{vsF%1S|*yALJ1VNOoD>HztK@t)RZpE(0@+CQAZAsj)dDpZ-jPT`;+L;Xj{F9 z8l{P522Mi?*9(0Hz7WwT`5VGrXfr4)( zo@v&3_lFMLDp3^zbwAdd88WbC|Fs|VXS~kW(Ykv3sZBF@BNL!Pz)|)2ND0WoqY=5_}R(>P8JoMy^EzZ^5r>(!?wpm)r*1B)DtD> z_*UqT%E3WTcT^JYYKTy+0AD#^HvY|EgKA}}r8Q9^F?)X`i307LVrf4#E8avA!VaUC z7vHx#TG*aL!JjKy9)8lpEit&B=V*&w(ag3tqobPe;&#-UL5Y{(hCMuSrBJ_H9=2RO z+GneI+@?kQ~2a+F1Sj>uwM5^r{M<(zOi$^W%c4}#fqTRp(*Az8tZz+;@=m{{U_@-nu8kU?LCfVQDWpnJw0KwPzF9O6r=)bk8QxL>GBdkE_c_VBq*_AZV}n%O&y zB%f>odv41A3=%R!OV}yu==e;&+~1t$?cVkxFMlPm^KZ0Yt~tB}jJx(3_I=j$_9-(U z<9z&r=NA?@aql&KL8#-Sqo(6Afsk#xYl2O4wEeQyepYmCEyG>3|1`6u?yMeuD}#`b z)BXuu!$;ZWF$n1Fa~maBy;Rh1nIQI=AAvkorgYCQfHTz2yp>KJ#(h_1S?YS-_Afk3mx>pWw&Vvd_o*NuXKnKtPFrsC8s zdKM6y`3Pc)h_Q~*^7?8{c~TR9oZ<>Ph2(mDFk z_*{NXuD5y)mojfA{r%SWXaoerm9E7w^xwyoTS(FNDZt7=ZRG9E&E)=(my?cNBFc6h z6(3)_JlbS?s|$^Qz-xRFY+agK0bf*+n$MdLXvH5>1!1-(OZ#U)q}_ch6=78)@x=6& z&dqax{_G;#`9j9@Pl-+JXJ-w~YMvRSD^Jvw;?JABwS9W)?X0S!t??E?#K((G{ihCB zg`!{kfc{IMhM4J}z{zll2rzG{55Lz1UU@k=;x7CJ6o0N|W_^;{1GhG(*Lrg|=fCGu zFE<@|{}e7xZ>Hz+U64@bOav)jINQQBj+qVG{`P2ww2qBild&ii7TjH#F4&<|#a71d zm;bgU7CH6L|E1Emc6d~XivOVmot2fv3LOSr4yf5v@gD5_z4h~Z7!kPdoubrw`T?e= z2T`szk}dGu#1pt!au%(tt6N_W`kvwAkb0szJ;yI5J)6iszYj~D^VRxLv!Df$@B?{3 zYgIRXRMFn`_4S1op6$NdP`As_YM~>rSIg3FUP@Hx~)Yfi{=YI@Zs-XxOJSaKVG(3 z9wLCy*dXcMy)$y*98Y{lN9!@Xt5o%O;xXa+^yaZmrdz0>cWY?q(A7~-Pw#vl5i51# z_0j$eR*3|+-L5r}=HtAF0sW^DvbPl?zUb=nVpu^ zS|`~<;qHaC;{BVbX8q3dTQZ>{`Wzcm)B22>pB_`3?wC=(`9s52`$J%_X}Y;DfpQmz z6%B)`?|xqBYL(#@4QGf9^C*wvrfSO}htwq{0?A0491HdG|M49l6AQBV-!AWA(oYjm zco)ektgDf(x|cM*vsXj#%I9#o#l+wy#Kj#Js2w4Np09o}psF3uZxpI^;e!aStE<{)6@T8GkSK)(*NKyhm!U;gLNS z@zvW$8y|7D5D*c^`M%A?j|I%mEP3sw-1?R@ZQ|%k$wN$e+3yWLR(3&2X!8%)SwQOFwkV zd?X~wbJgcrk&~BiU8(~7t<7xO+U1=-^DZt9QV5x!L8_KXp&Sh3y|=3J=UA5Oy`k*B zPCswT!!iBRLB;OwV30Gm^lU#ecK^}idRwwv{-?!0`}lxZ_YYgQ;kg4+g-S4b02z&rvoiNetE8a9L0zs=(jkW z0@$^0XA;Ak8{F-lrl$NEudl7mT7P8aHPg|HTbK`4j z>R%W9jj5{r{iOpg8k3yyhdcFIt-FB4yx@dj5(U$ABel_3bTeb}CMq zuB$+ow^*=$tB)Lk0QKw2W^^>l+)TrINP|V?zHk0fKyP*=p){!adQnuWEOaKvSVWed zHoOCBF#}@B!^L~_;l=e+mwt+Hdvw|yD>2jQ>dJ!XZNSylRV*Z~a%x}S;^c#|BXrKz z+RV&tL|DJKQursVJBzt{!^cS1)S3f$eNUm*(h}7Zj$*b$K)v!b#SgwVXdX~{O*A^b zo@CKdFs9m}J7H3I0#a*87+>E8JRd3g!&e}b)bu!j_wLyNpV%OoN;Rr>ePd(gMPo1o z6ot7tKzkMRA8?4yvHgx@wHtv-BKRLFQlZMABqJ}pJd%gVQ2B?`6CF~_?b(wXL4o`uASfrG+IZ13wWWK`#E%N~(4 zqk#9!qd$=|D%THZhB#VU*s%BHYIF1ZX6AfnO>=o}Al-=lxy&Pbr5wh%f9G+%dI>;n z1nn7uNY6{XP9mt766))^{31NKhsxO1QryM8U_#5y3qxLHm}RIh7nLb zxOKfg32wEBg1;*97h$ja^%DWO8&GPr+}7sM={^1DD2Um(V!;g`KfZ#JO)hutAG+{4 zXF}fG{boI))Pr;?i2!%)-M2OfO>YUou9k{uju-iHM78Nch}h8XIK|h*R6w=<*3ow0 zx#^hO%ggHqaY|QwpKpUK&MZ{5EGB+u&kn)O@`r!qZSjz-tkquk8yIl;9&rFSDEhV&OeLZA)0Mh+ znXi^=1LXp(M20w+|7LE;i=86QD_#xKI&s~Ki;4^w)+n;F zlHKCG%*W>&IClX_4)MGNh=Fo#swqN@rE%jOdQXWq+<{u`OSW%Z3yn&%QV*$>shXC? zgLQuSXJb1?j~r6jOXK6WX&s*Ah*wS9^lKCYTCBYbOjW;iFZ5>f8rhhJwcBxFUgI`u z=+@l5tjBLuAH|D<(+Y%Oc${OB$fu%oQR!2#idd+dp*8@fMy3^jB;?^mmI$d?zlOC!NJu_*~89XHxDa`DYN=JnmH8gq3F0oOM5WrB*e0fG>{PDhL8u zR$Ie=_5kj$x{_vcA6BRwh2elLq#s1u8v zj$xcnP_XLDLgU2P+FF0V=~AZERXPQ1w41y2@!_G^qlo`ooBiWeH5w~Ke`k=ft9tHs zTusMd*V|it))NgVL;I%EicurdExMYT)nPfF2COa{|2^`BKC{+knOp~UL<`1UwGZYS z`f5rrWGN^poU!}&W*&v5|NR4H2;9kaupn0PG{D!?wkyc(!t>hRGT0FnA;-ep%*^Ja zB-b$ce)vaZ%Sb~vL)CQZkH2FVJwg~Re)Cm)^dPpEqPM5^`v7E0g*@~P#270wvhd+J z@ZKmb+%3P9Kmd+~-HwQW;D&nLAvM>#d!i=l6Q~R4$D35jOVD|Ii1c^4PUo-@;#oO1#w`Yj;%3Df&Bad)Ydq^tO7`X@`7BE&D=!x8lI z4$+v&H4JZ*zZ(kY&oi#AR}e$Xzc&oj)aEkivr;H)T5ng__|Dc##Sxrn(xZl$*6(h* z#f=nm5*AI2Ph<3@il@D~f8IEr+w$hEQ+v}W_E&%AH@l%=MWjj_oy?_~ojU;XX~XBk zMX!z25+<1=){7b2sj&Cvb8kr_hyN);D=L}fL>L%nY<=$Fg8Hop2?z!XG1HBA zPO3IC)@>bBRX`|E-^xlxSa*QTtl(*LRZ?Ebg-ew_Ygo(la%;`dAPp^)& z&Q$`g;Zn=&Y8Q*mF)AxwV32YgVpo!*U$W6(c?wx?C)d)$Snbx*LN|HfeC(==rdYCe zBK`j-XJcl|_=U8#+kd}Z#;}h& zy|2Zu%;kq`T2>paYjr!djMB|-hlw!V91WbeQp9ngK?#+WPeWODHeqQ)gWDG~Bb)>e zyHH`h^57(;)pggk0YF_(ujAZR)heBo?8ZDEww)R!y_E22Ome}bP`XO0)6CudR*;w& zyk4$Y^j+wICPMvRPIm!}Ar_B;|3bwav2C~Zjc*#tP*HSI;t)s1_c`1!9?1ZF@xUu* z!zN@KB$6@?V0-7NnW8+^SihjOnn7(HKl%Xm1g1Od)+sC{8z7{aJl9hG$S_aWz_iXO zMcmTm*7E4D7&)(KQ}6lmGsCsJMN(PX(_%hc+{^0$RP%$~Ti<~7@^WuaOPJtbe^7tH zK$1iTEgM@j{;o8Nf@p7Vj#1tw@A4V9%LRj;n@aP=@$z!Ae4+7ibK=V1U#{Ho(z$v< z>e5e=Q{_!h--07O{^2nPzr7a9>=GG zBt$c>z~eP2C;^$y(Q2LgA?9sf#tZRfw!$9k^tsEJ=2nh!!glV6pNu50b(7xQva1Jsw=V;UM+O%F%966(4JPfb7)}5HoN(W^_EvY}mu7r=pTb&ei+t*UpE&XUJ@DaceSF zq_#?0Q!JvsxtBsXjw(^lF1at(y7(l?)u7fN<_W4C&cM6pbyvF2TJzwSbETtz&W_J8 zce-7CZ4ZyT!arZDSu8yRd4xSSCjG+|SyLt^CxuiAbkgn50;vo_kZ0yF03R>9BKp0} z)V4h{Y>>48xx{J^y8h1pb^}UD>nGdvJ1Hk+LGx15TgQRwfq)Ta!_pZ~|069;DJiRV z$Jea6`f|VzulZkn5?IVaMj49)LHe2FLwN({c!VX^Gj1Z?kAf*aLTN$;^?|z&j!U)RhX2Hd` z5W#7)L-UE7cH!Y5T)zItRMyheg$;*bkFwc*_%BlA$aGaBfG;d8?2RzIg$eEN(gf6X z&rQP9-NVta9;9WKLu`QXJ5ptW{;UbXbb@~%A0s?dJ5v{vYUSsR?_PWn(I;bG&phd! zKgu!rb%`0}ok2#XhN*7kF$96EcdA^oI%YaHNXmH;G023;;WU%x1F;q75N)tn7w{^` z3CC?s&76_~{K#q4|Kk;vaiiuKMN`I;q(~eFo}g?%a#C}>?qmgBfp{$^3+`cVDf41o zNenvP-UKhHXWh!+%jV`_I#hwTbX=>2{=_tiepAog=*MqMH-7%t$ZxF8S#3MiTv0ns zdH<=0{ryb>GKPfl*WcNak7UwOi)jm9p|tE=0B!a@%F$?F5o9{9Hzr_q-mF>!g(e6L3h3;Q(35I$0pSRUpH zFlQnio%R_X6W^AaD=OObX7}MI+g8*|l|11wxPggT<%+1v3B+r__Jlld(MR-JqPd8> znIR0gC)4h2Edz#@;w<-a|M*_w3))vdt$^fv-j`dOOWR5R&=tq$9mrx}aA&l&u$`qdzrW&lgi1@Rv)$M{YZwj9Jhy|ODf9tZv7M

3&IZT)yY@#DoYB7Ea~JR8nRMFG`T5cx=OlMoYM{U`gt1U@C@ z(knq-l(iC4bOlds8CDwZ$e*kyvkn7^Tc=+vE@6g{anl{Qx^x8&9JSI71oRb&iWv>I z%?*0?bcVp zq|pJDfBYFL-XA1vC>k@JKAo?4Z16}67eqer zVA7+h?zH)6-UYRvSIEoud-Luj@}7)(y5lz2Tscjv9RHcxvw~-A=qLuNza8-2xWxJl z#e5w*+qh)8uAz39lVm1-|5tuC+74zB)fvV2ZMa(Bie@QqH}ZwuV?INgrKJ0dVQb7O z_4WOBZYq`U{!(@HpRd8i4PI=mv#39#zl@J&E~?2@MQ8S6Az(Q)+z)}k;l!A=At}&S z_z-4!`>PO@e{S59j)!ppaN@Xm(JlD81(PF&^b;Sf%OiO#yH}WA8FHjYMh91Esnw~2 zvi$jPT_gV?JCWYnP)9B*io#o{eo`Yj$D~K&7%h=xe(*;;XK%o*KZtzP}&G#0Y9G=G!^5wPlo;O(BNH zw%*?l-k_8avoySVjyk>B>TG=f{#p_o49CDw$@L#P_K4WXMeY8rqvKCW39~LWDQS5z zRh{#8&-7*IWegDVx@1TknEQMitGY=C3U9mC&bT~03f=STHf(!R;G6(0&wWxAYMr^LGjw+Z$ zO0EunHSXNLJwKy~D=WL2nwnzLb|5b}JI_xvvfCc3c>uxvp>jFi4$|8$Kf;Uu>6JRR zvc9f66{H%Vh!g+r_sUg`8Wy+Y>Gj0*YJ6|ANjCZ%=AD9<`n?|oWx2*D{g;)J`0;Te zqEWJ!SFGb*TZ5Zxdpo}3NJp-$L>k`Jj4%+)7|TBQlH)qnIiDMs23;*1n>A9_GN zZ69n=co1puGq`^cbG!>Pn9IYU+KC7_BQz;mIT!)uZlr0GJEZ>r7-K5L9;*wp2sv@i zjcAQAZ(Xbs0xk};>Xc-^kIY~&bvW9IwE13Sk0dbm^!R)u;|7)^`S%b3Y*0MXf>SD8 zK8lT%nW_)xtFO1sOf#qlKq@l zdIR#`0$_G%UW}phxtl-qB^0r5q(46i(~BrsrBLPMAksJ;MYQZPj$`ZEzL25 zd#^Zv8e03Cgd0SGc-G)niP=7))aBzvumh*hS}ViDfem^DN5X*-gN1{GMvQ6wmn{JZBeF|dzcW2+*Z>E!(Xd!Mb#{5#AI|WI58sVoY+)mn%BGK59q|NG;yf^L@7o4FlNyD;ZjFqBFLy~xbefpPXV+7Hz&DNH|K>{ZsFDS!FzdiQ!Ad3L=HQJg9D?;2CaQ49Rp z()R7VfmaHnbbQxYZnt)12es(R8M6%-)|mBsA!Njk*?NCP0~V_e8Lg zL+|?cKJ=iTQl6AC^DEf7KGe0BpD;h)36}x1Pt|wPplHh1?;3r+28v*@k~iMVTa>cj z7ZA-qO$K00*uXYY^L+1y&;t_NWMeGPB(#XCf<%JU%)kq)mD9ErQXqM(isyX`xN@RE z1eiBlBeU99fCW%S?LDXvZw#SK8j-}nk0}xdICz|F2wCqgF$HCQ4FHZ6Is^*8vN&zA z&`6My-ZT3$URCIgCwWhiT)*2i7rbq@n~?PxP{rxR`K$?3FmkfJvu%tk zLSdDf_c(ep*Nl#xC_tBP`Vi-zoWf$Jdrg3(qFa>s`t8(|HSgHj13 zrQZ>lA(Qcyg-H{o!kiVOMMH){FVorJ4I(f=u7L zCIb;9S!g>;jse?8UQl2H#%dG^acuS@R1~l?AfE+8 zhlCzT#C|457S+Jofh76v5>o*Kla-t z);R3-#u7t|Ui!-=c~j`Iu|b9^h?ZUE%jY0U6s##2QV6uGjUFa{S#mUj!vNr~T!?m~ ztQz@*jDWt6r9=@{?{k_06<=7YP#Wr~v;S=o-^zj?@qp$UO!On1qR}aGl}uDTIq6PO zhswmxIS8YVl|v4!k&37;7>?9T=NB0+7-)?|mEb4S#6M!mEmrE9?5H|UOv^>#l1SyD z%K|OT;O4<3-r38bet_-Y^a9i``XQ7dQ1qB5ukriSI{ZnMxnuMQl#CyejKM9HY`KV4 znKqQ*LK3gG<^J-~h`I5y&op!daY%V*XW*=;0|XK@G(3LNm^6J0v$I>OxNsCOv&$4w z3P^tn#7 z^fY-UjLG~S%T*WzZZd~uX&cS#nEnl8MWbgX{QZ3c3KSyV2xEe+S^9$sYtR=WED$O z1Vo`R!X%nAHJgZ0C}$^>JIv;apBBa2cGI$L)tOe$Woy{7aS40?8;;MJ@75P3Z&a{5 zr4PpTdT+Hg#lXk#$0yrOG_#u`#^On6TAkmXeYEShG@JD44jw` zNg^X^ekc-AAwE%E5d@hI5lXamxdmk~1QS0e)=oh^p58qlHk`zsD;PoO0;S}TPg{(| z??JF6q@*Y+6)|HMy)t_Uws@{7&j-k15)RCbi9?j2ei;L_0O_OGG>5Z;*jFh=Le>sn zkyWxxTY$!=pe26Dn=BcekJSa^U*-eSVW~s_5R$M3K0YzuEL2IWAQ(aIHs`)Jp>!XD zH|;TOJd*=X29`)_P!&(ww7^IQ7Au@uXB)tJ{$fRGqDF;?$j%u2@_=>gFCH~&2?7t)6m5kBn&vS=8Hx?{q8SF~l$5mhhNl{QspJt&SU=?kq z0er`j#|SD>tb9D*)Mj>HD<8q+pgZVUIbqWjeO@;I@A!+9-Bv^mM`BoLq!@U`-Yy96 zlKphCZXQej-1OGcF=DfjZaB7-DwIDfFWwEc-cjkBM3$WmMP@%e;GgZ!K1*+YMt8hu zyeFuUdA)3@)N@$Es7}UYE-+0rh!rKXDq}h%7h6emDB!lGl1*#;G5%;?w6Pof!)W`y*rlMcwCwKPPF(l3F7d z?_QC^u~{)3+yvp{Hw>JkRVlv5vL4t=|hX42v<2_Sx~`` zi@XaZZseAm5{VSIq)ZsjWKp)?3z38lB^^D9f)d1uC=Tzp#iBKV$J;Z0WzC~>f4j@G zHOS>AtI{;U%qao@>1ggia&TOj%po+izY;JKgK#jTG8-CsYNXjiFY#+4xzl-!h4YM` zO_IAB(-v+^z8kWc!D1;Y=ZejnNGztlo!fUfsd$GE>W6^?Z268EO5=jclzgX`@KsI- zDOOJtP6Hl4Pdk5Ag(|rO@x6g+_se~0z>r?4nkD?q-&kybFE510;H1^@;1ANxZvqum zU`W~Rlne1xN1;I(1R+az$A~%H+52h;WHXC}z`6C@K(6Vg!binmQz}P$*jv$A*ePB< zv11Y?Mx#n(F(*WU6e=k4H#terla0fCeZmqN*wG@nT}Ma(g)1%1p>R@NS=!o ztlz-GA>n&8MDT)C@+ZmAvn1BSQNRjE849yyfln96%=)KNS;k+SvKE%79CQL7fh1^q zu*s*I&HI9X)W8r@;i6s>mIkmUI2d7Ga3^%|p=oCUy9({uq*LWT+?q^m4BqfP9*UeH zdTLOjZMDn?;i?d>`$XaW;5@WjG^VQHU@-C}DyPlcq}Y@k(GYm&n2OS0X;Ou0f-r)p zRCMpCBst#U&5L@FRwW@VD8UtfCve2ahYRNhVVFo#?uk;GveWa3B%Z-0=d+Q|+5};Q zKa$M>x3|4Pz6L~AZXP8QutJ|=>XS_`wg?z8c~9YNo9(7Y;b_?Le#>{G; zA8Lf!FlzhcrIoOKCJJF>Lq*nOmr=XQ@BGtGkkqu8Z01KgJLvRaIc)R$eMtC*gEkh5 z+T-e;(rDN*g?#~H6Pb|A5;0Lj{YGAF z&PC3ByucL!2}{u}s(2YBICAhh6B$Fc0L*d{|HcTm*8P#X3|IfEv}h+uJmno5O6<{p zx}Br9wU6#Qwo}9l=M#cC^&!`N4L>HnLI`J_k%AAsC>Fq_U0c^_h_iniblDMwn1h7{ z3Up)es6%xUG~If&C25D=N)`yxsMzkmiO-Z5 z%^2l8C2X;03DXy!y6^K3GSJ^?16I_bLxeA#MqDq#OdK_2{LqYheKXJMCEHPQ#3V69 z@pup*7bjCoxF-`R14hQ8{Ar6D3OfquUh)GM1;unO$;J_Id-^?G$nKp2UQFcN2Y2^I?<;)dElbll$tH^$@RGjv563w6^ z0e=!148{_JC@fZ-u_BosD$Sjy{EB}{hy0mW`d@Pi|7I6~Ia;NE%Q*dcf&72#`dR*; zN+ctF!GE;=8-dWAw*UVp|Nk#tzyJOh>pMD5bnyU;aY)LHuj4S~2L%C4yoo~s$rLPw z3KCG@%(*xgfM0zXY)V%Xp$_8#jYeA1hi(NqeA2@i-rSm+&0)N6Gp!lxS2-v5sQ2SW zKTMI*H0bnJ%<@(+kd_9X1R_5rt;DpftT6PVXAhVMjP*4nR%`#WwsiMmX3D-hnm;Q3 zfA9K<{-=^~jPT+wSb(4Ce-%v?t*PJtR8jkL{@1^9m(c|QYyrlXJ_Z3af8GDb-nVwQ zjUx+w=dZv@>5ZK+Y0J)I)-%~XiIeH^=|{XyIyvX2`?Meuk`Pk>8vx~KI=R379=u5K zC5n33&W!mXkx8IXs44(eg+f8q@$JhM=Y@ubo!mam?)lf_tlE1=Uz7QJ$ZT3}^f{qS zfIt7t0et=X{K4K;Izpj{e-&}8JHXE}w6C0(-5k|27BuiF_{1rZljHN=pUP7k$P)Uz z)z`0Id*BNgL5`k22EHGmkVa^~#)0xO#c>1>nS(iGI#5$@GD95++RDEYEj05iLuLy< z+YV~yNC}kVq*Py2AVd;l<&og>hsq2jwO-S0r-pLjok5QNQK_mte}R=F?BzBJX>^*P z<)_x0O6&pcOboz&)7kahuhRe@+ zvve-`m+!{uDheW4;y2a%vX+Lj2X#BMfHG6kcq`QqQk(uUAe8u~^eQ6Pylq$7y}v?> zK~WCXo_$wIEVNgS`7qs=?dRVZnj^;15Ax;db71~7rHWGKe-dA%*fpmtkmzp$g{ zh(jr0Bxu;EYx1s}K?m-J{(1l0?$e_GUqePPnQUePwEBOKD*oT6_xC^E%+o>t|Da_7 zz!6P_N%+ZV9LxU&oGerOGchvd-@(a}^k0{hie>YBEi~6>3P}X^GS5WM1|9Z*lhAA5 zqz)=)@A{&5e`x=KNd$U6`}No8FAu)(DLj7i^t7k53VnES`SbbD-=BiZy!RkN0)+xa zU{9*#PU5hyUr*&5S?254{R3c>4I)*1ojOJ6O+H4+Bwhf9WH%9s^eHSjr#Pxo+vJ^2 zRPt+;9}|%|W|Zi#X%(EA#b!n{&C z{o?U&@+_bKoiLNb-$TebBoTvM7lStc&$B0``@fHmPmb>MKi$aFVg5G}ItZLuLCCKN z&r`-irc>ZoQarB`!<36y2C&IFWD`GSK~^@1w`eP@7MM|tE;r?LFh<^4lgwInP)B6g z7}yN!f6Vd0eS@uT*G7NUMWzN>U~1lyJv0M(UY9aS)&RWH_TH)PZ{r%dDsdg_vlRMX zW6R_a49Lo{iUK?nnzs@lUA6=v8vVi%yI^RHKd%Jl3M~R%sRYSJ^0_g7xmA?MFPGXZ z<{DILg>om9WByh4DcfJ2{HJ&jpb}8W%U-E2f5C{A-ZVxc*2reB4YAz8RsB{UR@iu@ zVT}~d(pcc6k`CR%t%+Q8Ljg<2t=g{deUW~~F@|gb#wpQil5tt9WY%~x71ozVS?NH} z(z&a3BxLucHqS=4Fe|j8UGSU*Ig0KDd!-269Ht&RXXlzZI}Mqx;*AHfsLr^xI}yf4^;GH#&a}Njqu$w!Q%eQ!!mz=`X>mSNS0e zr&u6$*V`%xImOG6QZa2d9ZGQIOe`xjm<^YdiU!kxIiGrkR%_tM`PqgUI51N4y0w10 z`LewJB}!r(DiLYwPPIf8>g||BWhOM5MTLURrjZc=UvhBE)=>e2Vs8|Zt{kj$f99|v zPjwbjG49RHlV8ALzZ$>1Z6nlDx=Q4&nxW-zYPb73KeRi!^c+#|Eg?d~m}!>2n(`|M zVP0zoWU9kyImP}{4Ea?SxUJdpTU_f`!Fvs3-h!=xw~isdBA6|k@wO8k_`aqI-vnht z1KxtYx1)Xh&#`_M3e_Npon~XDeMd~uJ8tQG?F(b!s2hQeN^f$@X9Q_uK zy0c^*$K3aK{D^B8{|_Y-x_$r8;OL~X|2uegfBy4kp0)fxQV?Ff+`HW0z6;36*xhjf z<$Z1T0%@c-^aJG$?Z_2WC2coXkg2~FS5OgFgDYsc1E&b0!GY82PAYY(f7zXM*IYrb zpnxOD%k?Ak`leh-Z;_4duR4+Rw^m3mQZap<%ZdXhlZyrilzRQTS(rN~$-3@22_IA2l!e#f~xYBZUr@V0-i4~l2`K;6C zhBGBs5PDtS=ScWjuFx&|f8Got_g=SEb&2hH-IQiE+KR!r0^aL*0}R-2+v{dJ(Sh&l zdfghJZ0dD0VDGrsZDrp~lY+cU-^^Bxn8qHoxo4c=w1#_Tr>@Xt_Qp5jG+Wk%O(wtH zyFzc<*>VS;4*tJ{axr0u{}Fd|0k-)622Y+nEua5*^7uag&y76mfB63{v>?3w|37Zs z|L4fqopAx?I5oQf^D>)x0iCvX;{~iIa3@Eg17gEtAT^L`J%O2Vo0WHM;dZD}bFgoD z?xAaG!wH&L;$y0Btu~A*xW(Y9deSw!5vs+TP3Rio-_jwIDi+1w84@|1>Lg|^n{sg| zdMRp}C^KXUvAYHje=U{1l{m25K%(V6yGzcE_4NA)g*ZZ4YH4$W6apq2sKImDqE;2Q zl%v3=FfF9pxk3w{j(z)W*}~O$D~?JUWG?ox*hVU$3nm6@yGE5}>Bd!Kc@K&jen}T^ zNSaz(%4x?DPc13x3Y^wjCi{--*eG)S*8E%TOJp~XM>{-ceHIec{syYcl_h}p@_t7~uQ;VlALf9~9E4D~Dkxk3vbB&uvvgr+QB zAKs`Epq3i!mAzzDV83wG0bZJy?%jgNH!UK&NnBf{^Ucn-tc$WAE(%6XD0+CD;HVO> zmc(W?jeS z+1)jg{*9jw_Mf|ub+Q86^1nVkIV#8hJbiL}Z~xuIvyS;^>>*i3S$ZQ>HTJX$t;(y3 z_KcG8(UH1Wwyff1*FC6Ly(VKX+v_$ek$-e#e^lg#)&|>cZIHFLii+2y+35=}YH3r~ zh3e%OB{qP>nfGlk>#f{(Q*)t-pmtGGSd)nXg^9CR1q(Qf3wf^cvtbPeb-uzh8r1de zIu|z|uAX4a-2c$LFh^zAGfi+#>}esq0KL1AES))?Tg$ z@7s)A&YS9H=)AHG>fTl-hl5$l3PmPJf1IU^AtJK9++O7}Oh}?^<|y2!R%xlzwRleb zG8(z}47|%Nr%)HsqJ8=+`IXpUweR?^qzCp^yhkwDZ-@gb8iN|Vy40&Otz{QR*k%7mWVJ4%NT*#dLBg z|FM7aIXTP$jbM0{Cd&5V-lKqDC*GrA1h2eDftV%UqyP5$;5}rRrW~BVdd2)xRw$#S*@&9D-^jRtYf6w6YT7oh}^ z2$2vYqrJ--!se~u|R1xLZ>;Ij?NFqd(iW>;dFM%+uW%x~G4YH*CyHYVK2R1%J&i=a56+3mE&}sBHA!nlBw=)peJv^2NQJ=w1W zF%GV$IGlnI5~%_yPq2!EpQD&2fS_x`4|4^Xl7fCfSU0? z{*aCkOcI_$yE1PSJG96|D2eG}CY3{}tZMM;PdWxlGS4)8Oh6c?Tp-2+y-caEnhaCO z!AQ!OKwR1w%5R@Ye-Ixnni3mEkU$(<>lrbOTwDx#P$8U>gh?t{ITKU`ey2jG>$ z63D-@JF!ziXUd>?_v2d-A|~({hfpAXAmx6dZqg&_*t`@?`KRpff~E|>B#R<4tU`*qfe_reB<3_Q*&y_1})=C1L zLmaDb#_%&E*@%dWe+X%Ulwla*@fazkoue?vv=3g4$CzM&C7xd-QgRi?5h9WRhynNc z0$w2=GOVmbu=4W-y#Ac%+xE^$l8W{U-WPxQ)AoH^)xLONz|f3%m{BSqG(rKVV=)9@ zfWD{~Kpl*)*xhOxitO@sW7>yS}ZvbEJbqEN_3UR zs&uP)K5kEflfP^WOEuBIW{k2h z7@<5kSnrp}x%pgxYaGV_5uU0L=-LSH37#XOe;tL_NWIY@m06>$t^k~m!7$&U(IP&y z%bwo(z@{}ZW%L?A0u+MEGE(okwA0iu)EEP(jEx}IsLBnL_t@e&?$WC_M zfBcf$=t0k(ZhSC2030Fk@!VGXZLhD&FiORK7VXCcOI13m0Mv9KN#j_Dc=BOw2VT+e z3NbB%;1W$R7i23jkWlH&O;nA%KXKeC>Oc3k%ib%bVaTL*AynY77Eeqw~)kEq>I70DFt}!>be;T-) zk5xaVF-RiqLviM9$Aq>8fUZ#AtL0k0X-e%mYVvL}!#1hvs=zY7Z8Q-UIj32-jB^{! z3vIm9dlK^BVUC>}em3zev5Ly0=Aw54>M~eKo z0Dq(~mh_IKDXGw?+Kj6;rqDJLf2qr=P9<@gyL49KS);I+m45j!-*Dyp23O3E&+@5j z!=>>XTvbZoKoMWV|8StH(O*s zUDHfy-meSwf7|O@fZUv;tkJ=@A$=9{U7^Jgl*wlz>8{XX^;S0`UzSHqf2lpUNuy;w zbjX+c8}v@@u!ekD04QaEA;B=3BNY~e#{k9*!DssGaKU3 z`{I6-C9-XM(5t>X?(KtKjL1Yxdth(`dR#C{Ci&rWIscnx3cqt9J^;G@0nl}ov8v0y zn3j$8feD#}C-_m2(VL=(3 zpzUo*-_D}Dy^ZYKS@pKJ{hdi}BK0&bq-|9{X*vaJd^s2S*WdQ~PT2;3j*_N#iB3+n zExqmzYj9gqz3#A*<;tW;;w*Uvi4fEBD1Y(nB#b(TK!sl6U#2*Y03vhDD4FSV5)7+AEv2mMy%?y~hc3EYCbD%$ ztGX=s)ozrIX2@}Lf59*j024i(VyZ*VRji!VPxMi-&a%*=#Ms`Mx2h4}zAWzkl)F(n z6r|NvkayQmgB_XJ)PU z`4O+q5m4X`?33T&wf&}_&aq)zoom;8ZoB#4uF7c za^iSsR)TVcf2yDRpoM?M`7~YH2d7CMQ8Z-k32{43?#%=QPm@lWNt`#VpQ|NHKzzaPr~H{)ZK ze>z3t?Xphi9=pM@w*vn{$T=htg9RRT<=>fwvZWcc%D)WHTjpVg$4&9EZT&MhNp86Q z={rpSe>X#uzwL4nH1|&5@*=3QxYKR-<$U18}n-97n3J z4OIe0;~104J2;UVfFTxuBbo|x64#Uf0#4Kq0h%ybs9)lh2+f;G_+#h9ls_1v3Z+PlJIUp%I3} z9~}AY>51nhX&hhB7>BL6Dq@cp0BZ0TS;Z{prgDxxd=X#61%C+eILAZM?4iofC>|c@ zf9#nY303@j{4*673~@xnLyeCKK*|w%}&EOO-0JlgJ4Fu3}j=pIp z@Vp3(QirM|oq@DM0gbXfX`^N(HHpRe3dt{0h|y=kAi!iy*-Qs$>Z}3W<%P~oDnDK5f93`z_kqJ@;1b;H1Ko9lkvW{-2hJ8_K7dT# z*;YE)WUab9a5g9dmk5%Mp2zhr_gM@%Zxg}qrAylCX?JKXJk}>lqI29 zCeBuLG}HS9c4)fxfkW650s25uKq1{%n-fm6namc0h;p%2=_^`#>1KMfu}3zP%Fshp`km{U_KYaifi93%y^j^a>};c?Snk`f3KmHdhh#w zeU1}DmGu*x02A)57b2J>t5?-5e3QUGQj{f1$+_|8pUxJ%(eJ;2(bLC>gjsU+uV1}F zr=uj!dmIFTNo9w~{4~2i)h3;}c=7h_hc}n6yj+)@+r7e5&s8xsDb*zgBf3dX1D<}KmstwvbOXDS1txEcNeK$3xB5P?x6$gLYXaWVl ztr=iHzj^oiZ6H4Dc`BrY(->`%g!t&_X44QK4c16RykaKe*2^X~PD!kIb3T?c(wMSP zuAG!-TLk8AT6Nk}&RObICqjBEgE3-)7uaSpE~&{_8q|mjFk6_+f1)ZKV~JJId%c4a zHJ|r-O6DJyimsUNvE0A|JJf%dAWAtPoAX$D*|qN`wO*F;?^C^n*BV!XRrs+tfu#$poGL7}QfFk8S9s6R6e3L^t3o(#dBnLrd7Mhh^aVyY`0 ztL~jx+B<+Ge`j@iH`VUKa#pbH^qhy`tp46i==|qiA>(EVFjo8Nl-v*4F5Rno6^2Q&Nout zf{kqOT~U~H?0TYYVXJvRQiN4&|09)QGf%}vnF(%;f0HR3A%R0Rpp?2hr87D~1WC?c z!$rZnY7@3O$={@iok>BB5YvmF&P)f~1Tsvsv_YCtCOp)w9Z|$( z^LE0rf1?qSh2&$7M&1j3II=j_+^*>{Bhlu|@GcU=tS1bO5wp|OM>-y38Bj|A>@efn^9suk%?xW?Sr6Tej9>$OQ7p1dvF7-V?iPN|xg!t#)&EUE6Jan>c=KxBcyHx-LXQ5{@Z?B|tkm zj_*ghAL4$p`{0cPUq#8XleFS_PGgb4U;qpTGlRiQjD5m-hZ7X@?hH+Xe|dywcXxO9 z<^I0>cXxNU_-}uIxBoBw{oTF2{{H^U7yJLR+uz%J_2OS(_c4$NDLx6~DE^n-k<1w! zLL3bd!yOcnpK;6x4F_Va@=BJ}??{?91QX&V-6l zF#|9re|(Y*?T+g)>G2rj-V`y8!;U(S|-?TYTnaq75o6y)4b5s_WRu`G(Ghy(-Ee;l*_wvgz6 zp7?L|L}ul&9~1Atear;7DT+A>yQ4U*ko(Y4fA17lYBput4FhMW#HZdhj$P9sQDe|k zW6&kE*U5-yulsfPxjP(ocRQbY0e<4g=Klfpt{_tiJw^f7+9JKTFd{N}~(Xw>(IySvZPUT2I$93zhX0XTcRdwq9z&)wU<+;EmmEG=9>t8Z{_E-X7^ZI|)fAMO+xc*vLg62 ze8ypdZZL>JfeA)Fj)i1L;VXe(jQ>bTjD1;O6w%}0g7cNr=}c)TcqR$Q6$2-pjScud zphFbEk(610Owkxagkm(s9LG$QI14ahcn3ntG4KiEY8-D#5Ptx@!EsD{EQhgJc?U@7 z1&L3>G1&ZlC!GT&@g_{wA1hRp^tZ7Ahe;gckOR6wBoMfp5;e#U)SGiWCXB~3Df-Gc zXGsuTU@yj8bf}}Ch#}d?*BHQbX8t}!Q!%l{`euBinA{+a-B=fwz=ULv#`rKmj0sp5 z*6);11vQA?X@Bt)&c)lU%eULQKYHg9MPfY4wmTthD#=oAbp@fkCzO?*=$(Wzkj

tKONeL@BBRP?)JU-bp1A1;GrM>0AgXj?oP0s6>ukJr3#@OcTao zh+&GtM1R8YVl1Q-Afa4gf~~R$dAM6KcNJaYh+VT@x?0_c`fjRq^+X?3x7^}#=$U?Q z$evn@XQO)g2y(xWdaM}zNT^`411W=1>eDC*0?`TJcp8a`gDuI2jDo1yx#U=~x7%V# zY{);~X;6bgV*=*n_7x!RH-LW~LB9#Fz3qK+qbL!e>4DZ&{JMiu0k z>VM0eM#N)1Q^QbJ!tj}HBOTdFesv)$a?w_f!IqnBX0fipK=WFSN6K$)j;o;%s^4e4 zwi=`o0OoPqrTJ~z&f<($_tIv*d#;a%1ch#Y*Nt}#UQN7s<=l9c{5b8Q&6Dj0O?yl5 z=HflG8Nnoz^Aw2!HDDdEeQg`ut!6m4PZ}bD;VuH;f&d2>v(RG$ z=y!|+z4!9@t8Y4H#}Cj9G*Gym;1Ik3qfoH=kouUx$(i11e-R&r(j{0n5UyCOEPtJG zs6f_$t@GoH<4Yk_Z;Q!7L7*l~Kvd8qb0$o__9YUWOfd}ch)VlyD5YSnmP{poRXjJu zAGic$_=&_o_T$2g%?sVT1K%f#1T6-U(`R5r<2--0aBO6+3QUTG{53_T;lLIQ2ERdF~u5*v+bOn`AU9I^XK#7~ZLyVjvuLV!Q;7y*rx1}1t`+(~c% z0lC2;X3DxAW8@S0D~jo`aiAOkg`F{kvUO;fjT{TxO ziR=+EATCvBjNGAzs8f`x%yuKjMOjEvR&V!IlG>>$XO9VMEmU|k^l-$5#H}<5H^lsw z#@8eqn|Hkp0n-&2iA^{!O_+%_co>mFPHgtl;Byw!8=-iia0V#b;VcUp+)ju$fhn2^ z@yQsyv_|BiP`pi;G=C-;pi*!w4o;3nI0c~596saN14TkPTq4MEd ztGbe&Th~>^RsEC;5Uk|OA5)q%?BW@NBRWMS1Rr>%(`0kR=S<6vLlxu zL{v!aVvLle9LLz>3Yy}jYJpfXpY8}Ko^7a7@FZJ@X3`}B3pGGNqoGDZ2pv0CQ3+W9 zi+IiyKZ@y8awx^j6_l+as^DYBNvK3|fy8zxj9MWnO4ZU z@P7#nQjD7#2C)OApOpzH_e~Dx7S(ENh6@SDF=p)a;w|Fdm|t<|Oe;tq2Q^T8wM~lsYcxrbU28s5P7x3eE#jhVI~Q-9b_Se(;$=L&J&^Ia;l3-zoZcr1gV&f zD6GvLS{O3Bxu}?03tT`E`97veWLXfvm10iF^nY%k-{z!OBbkCL$rXD^O!!QSb_83M zZg4y-R!H>OTMnw=fW?Ai4|kI=ipdQL@K~RhsSX$xo3Vh1`hs0cJOtb4_ybp#PxVf} zsdErV)xa&u^IDtkeY_&x-8jjMbA@4u>n7YVqX{RPHnNWDh#pU5>jjtbEOZ> zLVqlXCB|Jwr|5&=A=ZAWPNgIUnljUUwp2|MuHJK<{_gJXuA|J`MlG!xmIo@jW>DoT z{DI3Otn~B6{2`B%@PPfqaI6R2nA2OGQ~0Rw1*y$JioH=Fifj7pnt6o)D)3OwL^Iex~3m44c!rm8F%AE_CHEH z?>J_-@CU*ql`$o#Y>{zDW6XqXctdEy(qY-|Y^0^Nm?BS!O;4_|lo+L;&SQdau&=hW zY=l)C>O>_E%0T%M&(zV%TeX2`3o2qTk~TRKGLDfiHVGWwkeG&Yx!jG<=lxv7LraxkF9{r%)9T;qp5NPbH(bR`J;`0y*J%89E(FDiJ zAPD~COxDT3>zOSQc;4@$qZr?yXel!GYZQ+YvFPlL>oBK_r>7*QNkN zO$a5@2M7fOF#~&9D+Tg>7k`I>J2RJ4xg}%nxzdBk6-tf#)75RIN1fv3fqEz9rUGT4 z(#WeB9|dTzj28fdYyPOA(T{6Z|;0}>@ z9ni7M$UiakclY+ELno()s}|Bu9tzxChQ$gIj8~|Wg7=h`g`_oo+J8~sWpjv9QC;-d z2t^>oJQ^A=k3&<&@OS0m#&Iyqd8)-?nG5Qc=O2Q#hJdFLpJ_Ry%K4*w+OAO8P=JMK zK}W9916+fy>7s7lU}(IgzI*f2#Scf{+P@Coyy+APN3$P`egwHITbSHBEd{IH=}Jod z^hS_BzU^t!SJX|1LVxjMJ=H`?-x2k5%5X&egMyK+2K7g``4@C1+umPg?JwH;LF3Z4 zyp{@42q=&S3yy(#6YM7ej&}fe$6at3r}4G3kSh`Lrz8{tPn?<5Q_WzS1e`2ydWT(%>@ zT8wbVGG`2Dfb>XcV2`HZ+ZFto`0&=a1C!R1b(2iTr_uP1bgIBqiFVs6#`kh!ua#fH~ zVMw}p1qpijx$IW>)yaiZbx5tuHr$IYsCTW^nasOfAAhQD)C{-sqpck9jp~E%24K&t zftfa{C~E^G*GiE#GJPktA3Eu3kpk;1q9o*w^?iu6^%A_xBEbgmH``c=w~ToG(C)Sa3>x3=9X@<1|)$gwp`)^D$$i2gDc|OAE$=(oIeW z=_xRh$A1X@qqiZo5Z(G}A&V*D%6-u4kUPX2xg(5t5?f>|s$6I^25{$yQr�K z030;+U+z27x56H&Ds98)tkmzxvqv-<39_8^P{@gEei(KzuT4n>wkUin3HoYn_8AqeTY}KvP#qD!unQb z`gN84)KUoZ*4`>HMju&5NS_23Ot4d$ghEh9d`HajC<&BTs_KGIMk5?sF2)7F@073= z-;fRqJs)voH_eivPh!bkXT~0?vEWo80Gy`HlMsA-W1G#56SQ1lG{kWBvpS~I`dE6U zAd`3#Fn=ArUJuZvXbdzw!U5*kx&zvsYklPjr!hf+jD^9)y0f?3-Vib3x#=f{ zd4F#s5iN?{)x2gnv#ne2234H4iWy6Q_(Jz{kndSK<0$5G%hJWuaam-(#qJ@vx_rfB z8c5TPg>!EsGVPcn{n*AP#bRJhvE=5L+BqYo<3h*FU9XoDmHnUaS-N;LtAF8x1*y>u zZtdf?Dj&D}fz*X^i^v3VeKs^Odr{ZO!hZ;a#)#zRm!4mB^wt<-Wu})tVd>$PG)rM3 zm3-qI1vK6fih8;e?5HiAgcBSSA&gNb7`YcnQzHpW6ee9n1lq=7M|PpTPEqXqA{xa; z=`hz88`kQ^THRQy8!goh%S%POX2m=^AF^#~UF`b=I;aoi1(x9%S_<61UN~Osrgol z7DWVWZ_ymY*(DnACfK`nuklPquKf|ucBZp;VzK^+RdCy^O4fX7EZT^-2l?CbLP9mG zL<|Y@ViXBULx_P+MFFLUI)C5v_xegP%Ztn<3ltf_j3&=wBimM7t@UV(DeGnJxHJ+P zhuliFg!WbiQ!dD=Speu<2t>>&SZX_%(L~?zheI0UcNg%h#ebP^>p(2@8Hd*n`?Poarm<%yI2_j~pu$-uACL9w7LnY`|PdHo{j4Fftf-8-V5WH#C}I3nGt zzY!~J(z6rU(9iO0m47h6a*Ov>Y8xxuMmhkxItj<=)@|{Z_FX067_%%!#b?>qsokfv z$6%b96pz>ZEOTU%wx=s8I9**i*?W%SG3K)Ppt1n+R92!GM*;G3@iNBv!vLObb-&tv zX1|u@M6U<%Oz#?3QH)3A!_{X0nGvg$r88SJ=ShI|y??Fmb$?PV`X)Cxa?{TZ&kiuU zlRuN-X*HpMsOa%Rq3fRO;LbFLu1ptGVclsp(HqM2W_DGHG|8?QcI;&+I#NA?ea-YfMuD9qK z150A8&S}kYmwyWCVuHTNEAl$bel9w6*C-;nC@m5Fnoh!d6tRe*r>lH z^(S8?nNE?AmMyE04s#86cOY=yR84i$_xJY>+~3OpwtqQTx$Iwy!y~K!GC#;~rD665 zGM?CtsF`k= zO!ix5;(Oe=wp**3Zj}sBYtR8=9A3bbgb6nWWh=;4y~fu5*r4FHSoB3Sd(U6ezwjrP zTJzuJJkdi9g%_i@A&yfQS{*h?pMc2Y4|#klO~Yv*E*%9;G+zc@ z6&`5G6bdE~7MtK8$c$M|f7e;tvf4)S&s&vXvEb7Ey{{{SODkTJC%kg-xYWCFpybdA zy?+f2smX(`5eY3cMHKF)ryp{x=OM6YCK0(07LCH3LjnDAb)xA z?z`IR)`9p2iiE=J(lD60vTXqMO1jg{l*1StnJ_{}-`dCNJF*%3P#*;`M*hrjUNL`6 zY%q=r@OYtOREqVQ#(EU*jn8m|;}MOgCYGhrpv5%FGjLz9&mRRtv%*|%DWfMaq2rRN z(l*fzB|hAuI22`MJUs>S#B2bit$!i)D3&&o>fNEu-eB(xfAQQ~4Ov~phW-O({9?xJ z{ECmULu_ooS+=xwoakbl!S>F@O2Cv(#c4=U{Z58$EH>2;yts^3+t9ko>MkAX!6z(E zBtgM2@yEDTtkgPR=?oY%-8o8MeJjCNuAV6g4~!mYoTsPg!%rcy-+t=cpMU>S%>T-~ z37(?vKNt;H*+z5z*M5I*znK4Ze|PuQI{)iaJa-)cXH!kQGXO`QmI@MZH963D+*5yU zI6`G|g#IYXs%UQNU3SmT8Ni*~-5o0sZ2HowKBP3jD0Ftx4}=HuOG6ytthCq}9m{F$ zUVU+*h9*@UzKRx8JgdN`?|&>SgQ)b-V8mHt6XN?gv@iy6s|>V(LZzL$9jh1sbn z4=DB~gkz5V1e<`gSHE;Jr74t+_94hx81SX&BB`Ti{t zL(s4Liat0}%B}hSQ-4UrqISL~W%xBq5aujHu$Q7fyS8SgYE?pRWkSW2Se~OzGgGlN zpl)VlMiK21lzLe-6GqWjb+xEifa~yCfRm}sU=c>9*z|&YY?)oUhCkmwIdf#W9RYqMHmIzYHI_`mZP?_ekn824MQR0QjiSB2fqzyo{mUd#JPo{IO#M;T zcasENo&@N_H0{AAO>jCPu{IozNQeSEvzRkapw zW!j%g0HS&96sP-@B9+wicC`2YQ9VJH2wKFa=UJcd~B z^xft0MVEizD{Nzq{r6RW_j%d=`(kbXeTwI+ui#8MwhrZmUzzOlc0vNIeFIR;fiM_i zdAC;vUcx?n^;M^Hcjw9gBPQ)r_h)sAp!DEwE?}Hvdw=FQaDQ)Vhm@xk?YwNVgeZVQ zAGYjLxfH7Auz4G{s=w!we{Kt~9e1@)2Yxv?KRr49UO6Ovn;v3{0dpz_<8^*4L1|plrk>kR|GS?kNR?c?A&h3xyv|B1v7b=PZO>}mgTeYNtoE1ppdX> zS7H8LMSljI9k`X3FKIXqX26p17&D#jOW?_OW7Y~w&Jmc>7FvFfgVngzk)&^NSO{?m}Om{3EE zCQY-U(>y7g*a5{c&gA%x}%? zSxl{V_V4dImWzwJ;jLULu@5%{sRYV*cV!5MfuzX-;r`yJGwMp2%u{!Ip>pra#E)W{ zNPnpAC}?B{q8D=#Ly z!;8;ZyD4H1nj=^5D-WKk(uA~VTN-m7-hZ@Pq>|!Vd(7egq@&*{bk*h=1tI8?!WeUf zVY=zXNvH#pD!m-ekB?3+uFeiFE`E7;e)M{C>pB@?j|Z}@&MfO@LDrxSaj57zOFflT z=fS1$4@N_w_PuuQx<2Aa4SJgS_TGVyG9%{8eQ;eLd(_9lxb7-8dpi9a$R-zq0QYRg^rfy-dmGkBOQPHyE|(rKKq$!$*-)r(u{wv3x}HV zXF^!U-VfiLlsR~Xpq-6TldNs-O3JW-?qvR?gB!J$zMJP9L1Bi|`OVkM?@ofy0wx%} z;4nqD39c)+UV)j3(kLsh8BN-p4Afd7lCOMh3NrSWGd!u5p~Ol z68(RZ^8Xjqy`s71FEX)Z9b?t|Nk?5GyC9*5;nXfGuR$r0JBsy0R3^~o6LnLvg_33O zKphi%QiT`FX%DJ$Hnnbzf*}+Yp_C}qk0zWEUt77g*-Hpl39k{(*r06k&P<$**6;iK zoVIrQ?&$dHoSgb!n(-!W1%0*clyV@vt2^r?A`fg z0f}XrXA$i$!CMW!?0o^%v=DA}wH&Xynoyz_Xm;;KqMz zNf5X5r}$ZJ30xeX|9o;-u?kwZ*+O1%vjTT_LgbC*_3AAW`uGEw)nZ@p?vijURtxNI zOIqnlf>BfH+?zF&C(x`b1qrDzn~^q2ed(lY9rU!}d1i7&_uUbVZ&B>Gn_+h2_1bcd zIs@RK&M^45@=W&kUdgO9{lYxv>V1D43@zggOlCB^om|uzIu07nO%^ zh-1|YUGP&MVXvPDJVpPHs|gMw9J4Nuf>pKA?Emq6|JAD(MgNai{r$E7$5T9acfGIR zhD-<2cXC7mEL{|)VpzNh9>7;U$v}Evb&fwo(nhK8RGWwq(nX}((dAqnh0cF)48^J4 z?3;|IsUpZpcAx1QXo}z6;5Zgi`A6V!5_<6Rx%`t%FOt!Sd;rJIfC-M~Dn^yZPC2ba zLBb%`QR^haTk>B0aAp;fy2y4N^0G|UU=)*(kHGmi=Kh;tes(9+-#_D+5gOK@m^$^D zVGvu{4E{(^Aft)`iXw?=xAT7sRs$f*b1@787Y0M@$s9zCPO+UgN*!qt9QZ0*kBow= zf(XdS5L>#}`uIzzH9~CP?siT_`9VrIdNn}u9pP#0f0ZAI3Gp)t0*!6W@MSx-TRs~% zAJZu}Woiqwq6wn_iXWR2`N8YmMSIlg|B9K`PV;5d|C+`XIr5OdUT8q^d~5{|pq zU(1{RH~r=zn>S1{xRQSyq*A1Uih(LcKIj?{^MXN!^HvJ!PFonHtzi*tul#fo9Ur2}nNXKN7_uzkTP%JY5nsBr#dtaIr z2AD@9ywe#b95nE6q+xQe+usGBVirD2J9TgLaX^PC(3az(BB(y9 z!8BoBOi@!jWA}f(e`5p5@tbNFCs$6KYc-z|adRViqM8rYCUv`o2SHzc5v9j7O{*zA zjcU7~@)Z_ZS*5CTmsp|3dabS3+UK;^vV{d(#*l387s+q63X(3>de!C1FSO{2HRrCm ze1-LrTQ9lKeaRKBv#R^4u6=#Ac`=rwKek<#H8mGnp!I(+<}TH`s_R9&UbLUbqLqm- zb=C$PD?4ee*^3A45ZiXc^hUaKnEB*N7|OcFvJx^*_vM=lL7?UyZSK%WH2e2_Q@M)cmI$x}-qK;a;Cp9c@70yYmGwSU+XcGHso|eLO^dC+uAhl!mJ?5Go z^ij3C(@{$V_LYx{VZk2=<0KsG9F1jbwllA2jTL{~X&%V=#8K*~U}VY%CKmbtzQMk7 z|FUnJv=|F>$e&|)g}a`GzE;1s04*?ZRkbR|FnLxO%ZUxwCNOs8>h5kVhP0(pFh5l~)(b56ArEFA7II_%K8Qfay zCbWOHwc4{N-HVy1a`kEj@U-cniWFK|e=UWtrSQ)~3RkN0kz6Jqi4)Qx(M(r5kTo8* zSb^l7PfE=84f_XCvjp@=^xQzp)0sIgM+p=eNb5p?UAk)*sSf<0 zwVPCy5rHiOP!Q-WU3thf&|5#bMQTeQ`)F2Wc+U60=*+ z^Phj7?X3q6C)m3d)6OS2R*6Al2gi-yzxV%r^CO#}y%#SB&bE}mbxfE6oM#;ZA9E}d-fdaV&m|*n z-lsZ4;QoF)4dxP3si7k-qbag1fKZG*I-TOsS9_ewOQY_A7Kavz{oYq;umOiRB&KpB z?sop2gd>_}^YE$1x_abv=2;U%vNwOBw=So>B=m7CL)Eyt6<4(4S|y8A(PnaL&w-1x z)O`HA(&?%{o6gT$1xkOe39OVNZ87qK(^yE5GS8wFKEC#-Q{Qn=)nu(NSbl7f`rJk} z#_oSf!yqHr!hcBL#D;3yxq3zY!7i!NU%q$VJ5H%BTWD(sr$Vi2?2RFzMx}qs8X-*~ zR*>U*_>E&W2T*zZmK(+9v0QXSm+QSf#ERSd)YXe^VIHUhAHoX z*P6d%kf=4gT(iqUms1f$63D~3Wiy=5lUXj+_f_)B1rS)#us=P~F4)KA808_IMkK(1 zf*?(>2_%#}OIzcnm@zcQJCc7Nd7|J5k)Za#sd&dSHQH-93@E??f;JgnVtEg*5&`isk%8*X!`|#(3 zH$NR;z|RM7PL2*PPu`sl-iOkhY$|<}<2Qe9;Ah=a6I7IrtYa=03O#>koWYM@Gq}+= z30h50)$kP+{KAEX|Lk}BFWcT{*e+0WsX5u2#B5OP5Laop&!`WVG@=0=&)`B90ULlo zN=E3<b`bjs*PuH3(!?bYP*MPHBumXm9aUnUfJ;Caq>feV1#LT!ppJwE-G{|8Nj?dsZP<+$Sh z?~sg#C>;03h~rx{>(0>h!S{fh@Bi-hU+(t{_kUmRz1myf|9yXo=dSF>Ko}=9jZTn% ztH|7Z6Eu|F;u?T;=S~%ux9(&T%;%kJ68Z!9UeQ%&iaGKTM}rP%`>b+Z&~&HY%2*JC z+7J;PP#1W0%6$|?-8>gcEx*Me5?KHVS#yGeX_rlU^3H2z1$`Abtx;}E>>wztLbtxo z6oqJveRnv^*V2DkKk6$+DCRC5=~1gG}AK{OLa$M1K?nSCO znJ3V2b-90=wA(*SQ!!0AHubGMbc0j_u(zn1ZK^s7Sz1T*t&-#`!))27Y@eEQt)Epq z#r@x-;fRcA*b^KRj>fogr`3Uws`qd;3>AO!QZYPv$;ToWkz7WPcSGvqE}IPC zqilHNUwcCm_GGkl`JxNCJ2ZModjT0z)@749Wdb^$Uq~A=rR$VwHl+MY-aKGee#owH z$m7}8cA6A&IwR5R%`LHKsM|VZyQ4pm5&Zfqxc>xab8C!cI$NanO=t6mKORw^g^D|`o2Cpjm&?YGjl0Rl#sNfR~e6IS1QL~6~R?xwmCmO zdvkIqPXn&rzB@X8ty8{tmL@&-Mo?dll))(z;T$ZKRHV=tk&bQg&1ZpAfsYQARkj-^ z;Q{-J;aHxkZOtzxBwfC(qSDGn5{6?j;F$v8P3Ub1?zv8|X8U@T&cWopz_MxB9?gHS z7|8VMyOTG^#o;kmY_3r9;q~tx;;?yFQSJWss^QFXVc1}DV_8Jz?ZL(6@%geiRn@LW ztx$3+_#BneK#Dz4#3waa74jp5a;8Sy;E}V>j@bt2s+?rKb z098+&`6_5KBq%0)f@7EiLJn3LZ^z_D?EW$-Ll-V5 z7y@#GL(CXRmw5$UEKJ~JifO{(77>}D-^5GF_CC>QF4ere?~DAIY)WTrQqKCk3*XK( z+zEyd-|DWb26c+v3A({5kEuL1!2TD&P%O$?GnJ_}NSK@CU++x?x_^sp`kk4_9Xg=Lc^ua^1-tD3rZ_iqo2EUDm8sD|XGAiqfi! zEGFxX{7y$!ix$7UFTb{g7K2tnO|E9wg+bJTbRy|Q?i5wb@+>NDA&8&?r9!Q$p;b_# zn5r9A?v(ms+CqQ&fT68X0<-3{kD5~%KBu6QnPg7c2DtznTV*Ot%0f^KN2*>P%IbhW z@ECm;pmENpq;My+rldwj-rLL!#r5mMnviO5=NKP|^}m190zr`?B?KksDF2k2Dk);h#GHR6XnZU)bHRe#Tv$e(GVP|a zji8?^hPh>A1_-E!0&ruv#H2CH~fX|Nd_c-{1dN@BRD#vI`Uu0nABcjK$~?5oW?F-Xw;O7cGW zw?^~cfe|t+e>O;c{D&kqGOJwzJr6Lb! zp;mQc^F=iK-bShpOW|8;U;oDBg&b$DBAm)jW+)}ISpm*zkvYg)5~f0VmH1eKO3jNZ zj2TCqcqd1VV?CV_Un9JwIjmq3?=CJ+58fU-+pEIc&~dv{IVEg7`Vrx(4*phi?zaJl z0Y-mex}{>KA`MF8L=vl8s%G9~vR74|#_|`C5H`2qLH&S_;3ZrznLfBaJcDQO5t5Mn z0o(rpKF#eU5?PrCO5-GhHslZ-z^3@enQQz^?a&QY(A6306+a`k^U%}9HS1X)JgyHO7dv=_DobgW>kOteB%H=A6zr6vSXAZ|Us~INQ%Qe9 ze)@UO3{8!k~&$qZ@r@;aoqp*fVBOWLs6ugl$D*mP@b z_;u>{hM-z{gJFzA93w%e5;IGGQu~6$Q|Wem8VPBYVIN!!&wBq`=v2>trax?oKNr%| zwcM+XsC*hZu&AbAp?@;`2kb)GxTb%OEe>UBh5LJ3n>;;u+scY4+HiCFrT45BJZuodU^8n}?#h)C2;5`y03+IGZPDOA%iBb3WyroHep-+d`wQ zGbtX{Qc|eqX*E^0^5rV@pgBiWt8x*@ZNL?$yz^ZKY6OC|z5~^g!Xi!tl`?54-mM_lWPAUD{Ld<$IOhbls+e_%TGLqhcyloexoa=c24c^hn&y#+#GXu} z2OgPLU8pG^dekR4S>>5W(S9u_zr_D?ryiSI9^y3>w;PW=oZPvGQ#|-sTDe()6%3?X=h*c2+c(_ z)ARBUKgxT@T-&eQh~RU)W>yiHw&tE0d`749@WA_4k8<0pHC}6<<1c^K=lIL@Ca%E# z@x6Cf?6wOJbas7^+wNUu-10WAvb9B*^OdbfrdiXgDAedITi?zcXW3GzReQ^p@G1s# zu(o6!f%VJTky~H<{yaD2&-B`N+nu@g>hmLAd|nF;e}19i&wfz}R(;#(PjbuX3B{F) z+d-en&7N9RR(i3gwv~TRe6J^ev{Q)Uz5G)f|7|6aztuA*{_FFXFN^VCU+ndF*YV$; z;#qzCw?AjxH*HIlY;gb|-C{PNblqhB0z!aySrSD7!9J)0NvtDyrs4ie^}EG0vm6t! zv`LAEXv!yXOG8|p5;g~S?dCJ53ngexJ*mdTCrn6%hl-0bsLp>!T3c4lrJxnpFk+qc z6C9^1L!hi+dkLL&4knA(@1TJLlXM1+m-*5FQop~V2M{VRPdRa@6FNDqh+`I1Q+P)Jer!l zwDKMI>22tu5yyYAJ0(Ftn0DuHGZ3W$0@#6o_0|SeY|@;3xW?ahskRK1OAVyhiqKes z00%Cch2E0=F)%J9hz5F{zkm%|^VV<~;=E=2C~=pI@}HqqSCHh2M8J9ZU!K1x=6`wd zvcHc1`y@}L{8t~Izdf`2yu`pp39pr$Xd=qdKw^+Nkhp9=mT@QJ%pGe9%{@9*tC-z~;} z-``*B|4)DNJVN|;MM9q!|6iRMAR^)TN~n4y#Ef0Z5H#vg&@G(`)?1&yBSG5iVuxvM zj?zjVwpo?KHz)FB;dRO1Ne=;wXvpyE%`L;Twb<=4cn+I=c(31Qu2tp@fICqkc_x%` zcwg*(#i@_16v1ZxILC%4{mks&+Doir&UwHN4-S8^nRlyJ1tKWnlS6gxVj}~_r>zEl z6?D)JZuM1u#Is7AY~j9;+c6szJtC#J5sDP$kL~p251dUih3X>2*}K#49jFRCofS-v zLepDF^4LyNy1B!&CiFF-e+h&RfBRd-$2ac|j!sU$SLuI&FbJq%;OYXQ;Oq=@AR$cg zl*WIvrPfP3nO`ia{4Im^VtU|Ws=JD`UR;%<^y#(}6f>L>KkK5~>y-R^BGb5teEZiPi9U*&A59^R5E;Q%+QjR=9q8`l z?Db~Y z#1r;f9qT%qS*2c$(Zvx|`tf6~_U3=ht)Al7P+xX-)A~@Y5I<&rORD!m-7Pb-g?js` z?UL)~X`Z6}e~NibJmy9*onk)0$qEv{&ddM)>iMf;{`daw%eDRgDIV+6N_rhd(}3BL zx65C2)YiAknI}OUznAT4IJvQ@%-@bfKcXb$ zI)S@7Xx43ZDulZlbV$f?e1n4YvXlPZX8MbD=iFl@i;g-ufPIrI-a^(=D_B*mfK&b zn|U9DDdOJbjkP3OFUl5+O~UG4Cqo>Em}Ax@wCB-jL_-|%0XVvYj?GXm%IHb1Vw^zg zoCz1Z8&J3Zuh9K#?*6~`yySoXwg2k*djEflr)H&F%J|AX#4`5%894~7X1{E`%IC4z zuIj8@!=^N+|AVH%yc!Jwx7-#2Qx}CH}>%~Ra}L(Fe!d>u)0 zUy%ebXaC>d-z(n#d)a@{U+@1<@f3CgJ^hN?*;0Vo_D}84ImsZm@bgfzVww$n@s|o$ z=S?0_ze3J`95tj(q!WL&?k{Iire~al<5>Cgi(kj)2bO=RLK|=(!(sa&gBUX!Bx3t? zy>(C>P0&7yyB^%_;OS)p!%Jckq2>aFKYz32e_94KPzI3)A=n8S`6sR3U zBH7-qE}M>rRn1Ib(GkuP0TMu(z#rh_|hjvA8lIU1eruC9OZ!Xh6FQ zeQ9sRzy!muF~h~Fi+Bs6FK0Y6YoXffiO>Qfs*ShV8ZyVy$B1f6ljkE_Xmu~kE9+c_ z@w*~JhZdcs9@KS78>$Ot@zXR~0!7ZkJhsaXBX)w-hVI5WSiW&ZjJ129N>{|8|^Si5=G5(&2^ z(0Gq(6o?*Xdv`ua3cwf0K zem#BM-F!b($nSBVUo1Y;2`ES&@1ji3`Dvc;d(0s9Oi~=!ZoS8amMpN7fp#Jy?J!@G zymj;`7H26qW4s31C&z({Z2!0S=5fgF|64nKSG!3YnM5UvGc>~LC8QaFbC`KOR-{b@ zs>zN}12?({0`NCadi(7N7x8`ZQ%OL3oMJZQDB4#HgjDHER>OS+y{dQ8jSbKu{<$21 z`C*7x*??c{Ag8Leo1Psd{Fc4gVkd(AmUa1=)H4%g#WS&C4l#yBYSB0BbE*l=1j*;+ z1>a&hZ+?UiT;*xLks)*Bawb&Ve+dT4SkZ&3K*wiN)|z~g;68YLQ``a2Q>bCYn%8o`=z@`!s4+~^i~<1YyyE*nRo_!8EPH-=^2$wT)PCe#ES*By+zHqp4bPfT_uufHAR=Fm3=u?CBSsI zQ^bfn^;g_IKt`$XK_y*cv!HPH%`-alTxrTpAX9lgkT8FZvkgae@R(Wn!9`c${g9^E zAyp~8-6{y`l9L3sv2&@*!z8Kand68`Ka%`76H z>dRUcpGPz7WRT5%=Bgi`_BYU$gidtq`|dFgdGp=dsFg6+CA`xDEP|`m|LqugD4~FF!b4tOuMW4JhWU&PrOxPtE!f0l`uYp!&IXJo{BzX zNUl6+h+;X}j*&SwkBIqlsYz?@Z|+T`r*%{>S?bYNL4;Et`->I5MBVj)6R;)jmAB!U~quVweV~C*Xx#@>5Eaxi;7t>1A}MhJF<|NO-zZ&R%X*#~6Tyo%B7%gNQ6%XC8(bU4AtT*1|c5Tl%< z$n=rp%!`{4K-c&*=|{K5Q`2U6)fvdh_PEkj*=eZeVvm=*?rqojGZW`7*RAC4hw1PD z*}nOdRt{*g%Lf6xtjleUHL#}^LW_nEP6Mp1>d{a9#L(|sn;Zr%0 zTUX36LD#$I$IuYbQWTp;5n*Cul}o0VKuZKJ10g%GpU8@4b6){BtD9Ep)>yy)F(4jtXmtL#RCGp)s_)t4NjIHD2js(i%wML4SK zKt`YB58H5Ivy_B5FvOVVS@RhV-UTAr(TUNsMK) zV@yIE7SD0>8pyr+s3_BFa1forM$c)3L;P?nSEOHp` zd`Gen5&=)=c;s<_(thdg#FH4a80Dm=IiO0|0(A}=X|t?yBz(3%=n@I^;!kpLv6FPx zCbHwXCU%X@_4D9eqcgqjv$}cJ&-%<2V)|c59hh@)%AMQm2r#p|UADs6xWS4f*5881 z;tKK1NBJ^Xk84Fb_x&_4r9d4H(}E}f%a|XP=TWGqF90wVEcBROhh!r$a;EJ(^3s&R zwgqZitO^i}9xmw6c$-e5TeU*+z_xr|kI&Id6U1}4GNX`A6CCnt zxuhI2W7hIZ#eFFk>HDufK5hc`Vc?Q}>C=%E_iSrc^ zNCqh)$IahhDxIDZ`;Z;Awr8vG^0}k|=?WDpN*`566j>81X@dlPk$7+P(4z!X^uu|y zSf@JoEZF}&Tdq_O1O51}egl@E1oIl`o`V-#J;L^m0SV*^RX0(896yo}e~kZUjr#yJ z;`YMsZzTqKuSj(2b(W5sg6V0AL`I)XexdoPCkspu}UIK(&5AE$svBz3`T+ByZT~+IisQe z@jb?IF2ku7Pzr-LVCaEI>QUiI_fPKWL14X#KHqRK=~dLJ96a~j$B;;eR0^&bT^vGR z_4!>Fhbc{T3SdUJPjqilE|}mKFh@GF{}t(x*O?ySRUf==1)qpXQ^7}p+t&UTh8#Jv zreo$7ADnHih9KB?z;MzZUbm~IcZCQB^_+ZZ^wHY}T<&1a^TI5BjXZ+enLqiTL{8u| zs5-7LizFuck$MDD%;dVoCw9Oawj@}TbKw9%sID&h-!wI8!*=`l+iUhBVROc<( zOqXYhQ}r+nfuxo8W^OX5_IQSq%nDg=mzIeIOE>0&Fwl^@8lK$t>8gGE%}M{Z)$(%@ znSrDj1gq0&$F8K&*2fmsfZj&7DA+AeP2m!=Vr~+}+b5K& z#9LLG6BVtgW5dsP$?bZ{AJJo|%vLQHOy8<9-r?-)nVz;p9)FMAzUqyEgX-9Xj|WMBUr(n~0%6w{FH?c+1s|C_Q-t z2k)(sK<12(k;O)l#Zx%4TRxxC0ld}Vvx~8Nx5N4LE&a%%T#^XYr9YAyXQW%st?hkF z-cht+v_k_r+9odfkX%T}KzfZBRA_i;1Fx>5e-z0G;bSBZE(jOdxBm7&e5AJq%c30` z%YfqtYQdVMi*1^4TH~>z=VmtA_5>;V&H>24yX3~kb&>D4UzrX^+w>=2T_gy@R5BHkBiG#@& zPNb6A-^LFbyu5#nZ!;sp7VnLwb(36|yD}p(ou+~A zVQ(qR+Zma~T}>r6U8sS6dn-R|hOCB3x}n(iBgi1!pb>c$mNgXNFU=`mm7^`Mqk|6q zAhA!4z7BI6&MMR^YJE+l;WBX%YiBDA*Wm6nDuALy6LSq;q2U%*Lsw!hbb&V>k!@e4 zEX!$=C(Ce`JU5zN}T;p(|zpES*}(8no=lqe`)da?rbo~+ivH>fkKDIo>94P`o`8FULZoYqQ! z5|vX|9&0QruTQ?V$3M6Yqm1bvi@F-s|CIa&aoJF*j4TNPT3Of%C=-=-T1C9sGRp$$ z4Np7_)(daC3=mEntK#!I1UsfuHa?P5eV+>D?$uUb4!M5aQkS#N&lJoyIXUaT^)pKT zY2D!a1;4hcjmVVAqiE2b7wS|B+1aY#*?+C`BsK+=OOim&{n}o!cd+nl#%RD7TRO&L%Q8crxVyaR$ zOADjY%J}*yCf__gv2ev`BVE+t#AHdBiWSIr-IXmx^Mv||^Cc7aV=B=t!kht?#~?=b zblocH$rbVx1uJq;Vz#_hcK(abO_cT+kYFFAm;5Lt>Tv`7E%;YJaPZ-~Pv4g57!Vj! z(Rg-9b<^$eQ!&tT>~s4+ShC>-DQx1DAXkeE8@#`(g~bvDOJ-FfR6sk@yc;MgzK7!? z*;7Bw8`D~cON(-#JBXUvxesuH`YtxLZ%}VP$<$i#x;in1_UE!C>S=Tm6fFeD{qYK6 zOv(Uk-l?vI@eeBStFYyFuU{9pDe|D?X&DSST+oN*v`M~E(Ol%7@b4e)G@qyo{N6r* zi_`|MQQCtcQILNtu@-L?na_@I@8CI{oA*z65_KKH&k6dbng{P_-XhUkjV89x$(v%jUz4N7=|^I+3-Vd-r+AUbRG5UQFl2G+W;1S^ukF z`f^u1{%$G?Ji4c$X)E3`olChyNZ4Ka@&{&|0XZdkp1XUxYBmTu2U303UbIkXPu zLSzBlXB$;vtznHSf(^yc(+oIFO~@;|Y^yG%)&EaP%tfk}A+Jp7=-&=DsR(TjD?^UC zHc%F=jnGnPB%;#(QZF>`g0KY2^m3?%$Q?Xz6)9t}Jhf2$;k5qd@p>aSbtrTy^>c;Z zrypc1+sm!A2TTk?-{vuYvt3vQ&S>Z^!?=I$`FWS)(gqU<{IKRX>8MpBTVSN7!p+lN z>*`+Z>i*j@yKzG^fZ4uMhWjT6&l?}Q)GGHAv5z}R>?(rI| zVrSXc9`Q4@{c7l-!kRT?AFPqzQN5a-<31K%#2C4jdsr~3C5XrYsoJYlYHR=hGL!Yc{}~iIViXA+U%F3L+B!G8bS?e= zlmaGFd&`$Zl24Fa(&_NKZ{PEaHRs#b?wiotSgHsfJ%Abet`Udcit%h7>$IY*k`8b# zCOD?o;d9>{D{+3f5$SH4@Rf)92sOnj;nhs7zFfsSjR;luUZRX+k^VQ~EfR_{N( zNSG8Nv8CH+xgjMXY8&(&pp6@XjbhE(KJvTi7Nv5l^mctlm)Fw?2tLil0!te}4=2`Id#j2GW;n9qbBIs)W?W669H+P7CJi9I!GnQ2YD@P)Kc=4ZS zB6oM9BGq%O*p+Z>y_wS*r^ra$`={Ntzhk=^a~im_v22N$B5>YMoN< zMm7(c3IAgVu0zzK5p>y_0^F?14`{hy?`ml($)5C|J=em!te^q zRroSr6F~jDGO679T+qjCAM7s>C}H5#$l!aUO_d(A%)|>I8*;Bl7a<_a&cs8QYmrC?Vp~BZ1rpc@ou)T7}nc>{=?%Rm;g|V z>StviwKu(@ALkhFME{O}nb?U=`ZvqK=G?|iXkuzLCvh5(+3I8UluOC1-VRmwuYi@~ zrOMlt_oa=X0u5!m!M&riEU#`2<@aFG-E$B{Nj?+75)crb(roztLDtywJ$W;$;|&s( zMY;U`egnbDuBD2!qj>>j*Y$~?{P@4%O5<38nN&#esMFKTg%pN;;ud(gq2iH$2R$^T zq>BiB1&IYw`6YN?-@d)Au{XZE|0a2PS>b;+{eJVuuJ!u|;-A3ljo|Jxabl|o?gF&3 zK;nAg8qWXC0xC)+A8#k(Wgq1)#pMlQUj1ivf*c_U$bSI-a&3jFSyYkCAnsDJ}lESC|CD>3#m}-7~83OXK?1JfB!}Rc_ohTzJFhR|8J%|B%t3XQqF#7etK`A ze+!ptQl9SnJ>-h;quQw8>ukgE!FT6q9VUV*G-+l3Epfs^tRx^*67$(L-nPE`>=)Ii zkh1QHVQ*kJ9ES~M345$aKMlg@%Px&Q3>CaAMwo~L!Qy66ExMt_g^}ZP5cx3hyv_c< z*?b>OAymGX6jFl~3>Kio36?=O@iAz!7MBVS=_~?Du92obr21t0U{zNmro6xMt zuxNwPIlqqxuoN$yL-5$gx$go(zdZxrUqAbfxZ#9_Q2KIF{y_W!APZQ}r8G3x2kzXR zEpOxS=_rf~pul9!8rPjm{-SHLQ)~|a-DEvQ)2m;3mi96h4JB#L`mj`>J4~pXannJV zi=A1fzt^jMb0lTve&Bl$Ksi%J!eZIC%7!JqkCGh{!g3OWalmWChdr|# zUN*li>s05K05c#)l4sPdV~I1hMpkL@7glWc8dsx}$(03BtK+Mzw~f(aSa>TX47|ym zIUEc@TL4kgyxCN@8Tt_%Ct*zVX_lKzatBYJu0UQO;Qj>cfl0@*n#g>8`&UHQgEf-& zlAfD)TC!9*3-+Y3z^=s6C&xYk&xaeneTW*$UnU5^Zh&+Dewd~N6d&}7p!zE2hCW{6 zB2IGpmFHU|T?`Gwg9Wc$=>uz>v#gpNWSL;2q2qQ)wDxE%31ci1hA$NVw{r6e!rGjV z;*kDb|2ujI7>P$LNPO%(1A`czxK{i?vVi!i64{>D4^wh&g#mBD#cl)cNzZDGjv-?s zLO2tL1vus+GzVw(t&>2}d@8QeT`^DyQ8a*qicILz_qT}Q|!=kap6n)))sTd&O7niE>mu) z(iwr)qam;xkrNX^T@7V7$qtj^zhMw}Ji{a_VDmKrb>j`@)dl$dL%7~Bc&_L5m&;gq zO955PIXd=J7MAC7DUvFiycqHqQp6O|WLMl0ZH`5fif!|m_ELibT9pnHUn1pts;;A9 zK&=IDs&nkSt^e)s(8b*!F0ceOYui3L#z8u)oYg{B=#l&O-8Cm%&E0BQm8HxU1Vevn z;tJ#7X!rar-bO!P{n}(RZfCjTk z*_Rau%uAh`I$acUyE=BfJG|$1^0r7s#kMGvlsBhz;NR-?t(^ zo*RSn7xz5jR!DcFBsI7@zT$^TX6=xQ@duz?P(};MA|5Q=6dEMMpKLF#=!r^Ja}0Wy zJjVs-BK08Bq<{|W+(W%tGVP=HfIsu5LAk*~EO1F+B<n{pK3Qt*gP>TV=q;#v}_C36rKsXDmR7V)FE$_5cVP{ zZJGHgvZTgHSPV=Z98fFKo`x_rDj3V{kToPueRo|XTo6aq5CtVVr zqH`cC{H8{M#1~dq#=Cvgsr6dVbv{lD-tIW2>4af*bECullMMQus^;zSm`D&?uMBpM7P)QKxx zC8N$KzQTD)jnDA=dNh3Y> zCOGmrGG7^eZ-#LIh4X{vkt_kPB4pHQA+rXa+WfG*pic?gtPU}8=z%+Vbku1gIY{st zlB$bxP$+28P9t-roZOSe!|`hU!G;M_h@N(F`Rbd9n}P=F7Md{9g=oCB3N!VzS!UT5 z#*|n3Z710w|M@aWYNZb`PL!PY3AnybYG^vEpR>5#2%pqSC8<$A#0)J0)MaO%yn&7q z@-G+yte`}5Q)fCLOgeiBWDBFS;DtS5Cw-2gD^rB96mi9nvX0JM@F`-=prI4Y;+C8@ zoGR8>1i+ceM}$=)Nma8h#o4!fR*xqQk>Ng{mL#g?ifA7klqjZSRwV&T4bHkGG7F%< zA*ZU%-h0nmH+$OzV>f_DheI~|ftD{%;@oljwJ-zye~D%+8ex{(S?fld{aCo+8>K=N zEoNfk)}zh!XT>NZstij*ZnlK>u8Okim_R6a@zEBors|^#-Gf(PKVtmMvu^nxf)^Yp z!jxAS2Xjunz98@3{Y#SMni!RqKzAo5-&}0p7w$WdVJYZ7B;m9M-RId0~^F47a#(y++-zjN4 z7|8=g!}sa6RkRy9)ek(sSrb01nfh@umnDj1@P<^FC7Geg`x}Q0O_Gt#L#-FhtGg08 z%PWZ>M+Up&a3w0eC@)l6|rE@AG(vR#5(3 zSxf_ey;ntimF1{xF0A5XH*7|;oO2dgQIe(;Mj2b1>f@|+Rko9rox;@m2yt3O&Y84q zThrNBsP@FSnhi;D<%m-QysgusQ}Bw!NwwP5^2K;@K^ijr4&daa7R?{#arSD45jn64 ztrQDPDAz~KKyX<;ayobM(Bp2Kn{1lv%DNjE#a_d`p9pU{@~cn1h16tLPz5I3w=?~O zw3u>9$;8M_F4z)G&tWMW6WtR%DRc9|ND|9$E)+=k1O$JT(F$UVF+Bx9Y7FMJX+w4% z2F`uV#OF(hAp(OkM{;zr<&uNCjsf!IOT{=rSSaeDfDyE2aey&-82u&{J#B$FXQsSq?jB?5HBys-aUDmk_P|xD{;@amp zr>=xQMbr>vy3XANo^02?6 zD|KEAkmht_Y+B2i(}Z)+RL>_7nxtnh=!&`QF^GTa*1$m?lE8icrzn24&&U(qe`igRxBcMH*KG@lE!yu zm~OKP`CV}lKB%n}mv-r9+%a2(Hk8%w=Vspg&N0k0CY5i4Yg3P*NqFD>M!F7WQ46HfM7BuP|{7 z#1;or4vfUxv8pzvd~qtIVMmR|ZFBFID6|upyUh~w-R#E#`&1HH5VBLDf?~#;nno~} z&hQWT#9_wl-vW%j)0miITuxxBame#Tfu`Bgh!YJQSwZytBxBNp?FM*oARyM9+TToo zY5^Xn0L2a$3Dm|bm=`0aZghJtj1M0ahBY$6{I}M80r3JqWspdyJU51JPf>x6tjY*U zlGLKbS0g?__auJV08i3Z#xdP$L&Y#K#2rhWuNAI}Svut;rJJLc5XIbVyHwW<3$l%m zq?k)mSnztZ3iu9Q`=FNE2M~`9scB9sutTxXrK63?K_mkA8XDi94e38|OG&PnePKUx zw3PII!}-cX5YIqEq?lF}RYsC$Gpr*%nFqy*9~v@Fq^^iXAhQf6dLX~bki=K47Mw^z zayB$BuSd+=OJEX#rBC>-Er_m{X(@&OOZg}Tv_KVG&P;bW4%qqq1`KEUp6tLfENEaj z4LM~?R`{nsyORQ>89D{Z5wJUgQqZlYCmuZ24-k_ug07+@jK4a=UJrFNms4JTU@miq z`zjqeY)v94%#**Dm(7jsk|a$8LyBZn$cxEaqjMV9ScVQd8~3(~^KnlQEu}3lZW`q+ELWT_K`k7XYXUilz#x!zt?O;EEu_VAj4_>bQ>tjC$x3C-k zJ9}KtKNAjFS|xJLp*$SUQOISUfhB*OZ_7v)_Hi9?Xu$w4%=-vLob~m6IBTe+KWUtf zheOM$5C_GQh**Db%iPo)F~QW~^hmy0sTc=z|9cdNE<9LTb;5valB~^H=^I#SQa#&9 zmi>o!;D!N!1O_*eOscPK@zC-FEUQtR#W`}RTR9zS4x0CG!s2-);Y!sp4eBQ)4GzBu zPz6h)B&S{!4$}%zHh>*jo}k{4!_4#-%(w_$LDtK`(BVyC3KU4Hb3>AO_#mcbX&HG$ zSiTd8bHQK^JIRB=QfpV5F!zuj9U?V|WvL!bA_asLW3tF8x3#%1iz6y-6H*X18sL$G z{756~JY{(+2>xK*d~+fXUb3NuqV%saiMV7=o5q0vqz{f1#lYB=Y3uP3CU zMnDHv;U*-ojFDPmjfD)(`A)m>pG?+UXgL!$?v=wriQUKJ$NXq*d8_2i zK1?1V32{F+VO`M^!SmZ`*$+HmuA{O!a**YDfc2ED+WYU-67|W0KC3WkV6^w|hLi=1 z$Kt% zlSO?sHR!?39>j#Bj%K}k8jv;DsWDIQ=LH}0>44tYlv!!rUpR$xKrn3dyEJip_^oSP z_YZN2YiaLaI71I=aRkaJFwxsE9~Uoc#~sGl=V^b)6a3GKn>bH5nD1u6Y~eyUU2xrT z9E;(kIU1;*jA&qYR8Jy>(kVi99PsCP@l2HdLE~nSv{TYJ>pU$^KH+!q%t3jxt}X-X zpSISkbrdxW6TLw7V@2?=tBWqppB7@&tRs6^CB*3c?b_z{^u)((1|D#PN6X}(u2?&V zSqqcEf4_)HjC^PNroNX9Xe#Em+jh{yQ-p` zoV=JVt9lp9DymU26CQvm$4DV_sHI$q2^_(G?(VbdsQ?>ouGCGM&-+o6iZkGU8*{ih zo&F!)h+sfO|J#khHeHJ8Ei z`crF_f)c%tntc>UKU$iku>Wc7Pq?yd1idU7DSWWBiwyHkwP7$KX?!tWcvI|&Zfmi) z4l@dR>PwC89?`LOw?(NA^J4usGc}1>X&382_o`b<`)1i!BKwtMEBPb!6Z%u350jZ%b2D}kwX%W10GQ{=0T&E$Wwo{s*DbpHU)~Tld-W) zw1UNfu-fG3osiZu3QB{&ugpo21Ei`&<}w9WbskvA9(;ErX;tITPRQ+e`kR4?c@dHq zy*)U&bQq1{p?HX+o6kQQ)=V|2K3O#!A5E|C$V}`)dimkl5!Ny(>asC@>5g26gq(O7 zp?q-;IfE3)I{L4LQdwcFG2J;Rw19HOnE`A1Z{%TF74j&^3PVtG2pRc8PKzWwK#%?! zC>THbDBagTX8w`X0a+tqJ`P2n&bHq?7;QRW_Ih|A=#?$nZ=gS;p)OCt;-m4xL3S$r z=BRPV_fgbgCMP%~jPb@uvN$&%NXSYZNghct(HMuXaFs_s^z*EY(GZ$KuQevkTiD4XB!>a#j%GO!19ue-f z1qBK@eMvwe1hS>oNo2#11yEvmVT3E4BckVW60O<30@CGpCT|G6>2GQrkl-?g@|*!D zOH?S_*uI31h1Ec?s{9|&(NWRPztmCiTNZ9E$9H9owZpiGq)=!4=|}s8QecW{W0>nClkzC(|lu320#hOHtU5L)6{&f%I5txyu?Z4q+|koO~G9-E$W*+ zke--xo$d(Hkb|Y+^a@Yzd+k#7R+`NDo1@N~qJEBcZL73dY1xBh?w^FrffhWJ$;mze z4)$^q95!r4$3P_i&vDw;0Of;84>6ta9hgb*R$3J7a>D`NuvFfo_mz0oN2jgO zok(w)(4BOBR~+Pnr6WM-?VOR3!}_}RW-VNfyp7wbR*OS-;&N7N&{$qp z-X+#yl!5`#Mv%cEBPpT{efUDTP6)VY#POjQ>l{PH7Eww_a&v7>3TuzY?!!?MEICud ze+~00tO>^PbLZM~g_+>=K{-jxmV(kYSy1zi^_8$JyovuGO$b|vg8Qm%mK6sB=86=v zMvVTupk}{j!tg#LDM6iCI_PVI+n%R~lA|qPDv~_!D>Yb3>A&W@lp2-_Xeov;QkEkj zWwS*PFZ>~iU`X^n(N~931CfB6XS;V0oo1#3x*`TsY!hAoThWYuUZ+eZtN98OU3wvB zIcJmGGMTvLEly3M>n|W5Cz|U#%hWJw=PhqF=75P9-DKM`V{oiPG=mX+rT=rElGBC7 zCqI4RDybj23!kZbfm0dy^rdiP+BsrM4E~#t14tJfJfB!d@a^*@P1b5u0nB1TZ8|T} z+;FE%+{yXJQVV!Kws2Xth{!ccTQoiUba^vsMl?lziusIfy!jGEV^HG_#%H06g=HEs z95y;l$%I6Uh8IGfLWBb$kM9`WJ5kYBA<=^C4L&;IkEenX{r1U#z)ADMmnccb2p`qZ z)Y3vk9tPr|Z^p{$X5mwKXb4hy%QKt6zZHXK2OPE zt1(}+Qj_8`1=(c*E3&vB39uXN8CsWFkli$!8n{xF$}fVf5~V66#hv)*&+)_)Z#9NF z#=I)AkxiOT%Jt^!^pVQ45Ir}aSINF@36~LD)VO|x$C7^{S5+-7-&&L~*y8#|IwKBM z1b5vz<|vc2T$t+#CtU)wcE7a5%8E-sJH$E}gkw?6a$qb9Sn$I{Qkzc%U!F)KyB(5e z)HE>b9<3L_Ld+>3m`r zGrEF1EISG$-7yzxq#qb5^{jAV%i^ok(ymacL10c7$VUrBXU6ZHTpba#ZU@p*Pdd5K z4GBXG^hDr*YtDI%%r-ZbA^)&;rDQi*ncJFXmjZhA<7?Oibp|PLQu`W+Pqhu-L_qc+3|DAJ+lV;kZETgSCE>@J>HeJDomQYJtlz>$}@XG0(1aYMmIFX z!#tBF#GVvtH=<4JB-??K2!>DF9TbvflI^egK*3Jr1^nh*#|$$|i`QBQ{_tcz&duAgEifl|_)T~VA&f_J4g z;TuT>nQK?0geaL`g?>4CN1x>#~ z^@IlR&3XtvDH+9v=W7&E37p`7a|FPZT>+Y-@VsZ3K3#SQF07C$+6-T({2WpJ-fGQj zrzM@eXH;{GVz@+}s5aj?GnB2NeE?KF<( zs_*!eOSi|XnpmtF2VTE(Ervd5rc%70Gr(#>@Jhc-E`sVr>OM#-Xc81#V*;9k=fTV3 z-1HvUmA+?HEfjq2#aR>1VRD!S$!U2w;bIvyLdo%HL#{%#W(d$I<}vut^su!d9TWaO zO+-$qxZLX`@}Pb;@jRj*xqbBpku(|DWaP<-DfiXo!&ntZNM!`hwh@Q%0`%sElo`@v zmzH>g<5jrWVzx<^Z`+*#dw^@lq{z|TgVtA{sX0hMN?7Ypkg%W+)K3f-B92^;uNl(l zC|uRlN>He;<}-v#1-{8Di5Gj@Wj1;5<|sBn^@lduI2P||D_lr&U4!!0kT-T6qOCvW z=iufVPY)KDA#gKRS{k{!Y#?QXrwIr5+oZgKc@J*dA zW->_h3iGwQ_LCcIdhslU_*_FFmAoKtY_;%pp9J3&0zeC{_*!x+d+?Z>I~_ zE}>kZAacFyZ>5Ma-WKH_`k66k2@7nS?IKG3L%h2($Gd#q<(ZHtv2kQ+YAHj+Rbw`W z%TponT0yw#h@_CT!qfrS%?gJCqqeDIx)yV~P6r$F7T#-)U+68c+WaHLH|pFRxz6G? zi*>4#rJ)@}1pu=jC9-03$KN3Q5nMUZ`@RM85*kn~LYppZfY8Ea5eZvFG}Wf}fHeM3 zN5`uf$7Z4(Ys==EkM#%|OYtb)%+8G*pYSkMkoLs9PB-KEZT*%umZZrs>xW-6_lPgYeB|LDW%18PPsaX4&pPH! zp5X}bDgeGZNPLUe4-f2;KG;IEip*cvhLd<_nfwGKas_RLBDl$94Dn*xRG$l|6p($9 z&2Ldq64S>zG1+0rb=dpgcHv-+ zx3Os5L?xp5*rJ>fsjr6bs1%vBaa!YD^Kp!}+yI(%D0OBQ67K4$FrVcdQaUX$B_Szt ztvUtq6iSmLD`3lA^0Y{0VBB7+xq#a-6}1X*N5?SYaJN3gsUd0qZSdAvv{D{H-AI*jTYQ z3oQ!yTu+Q^DWKt?pmb$vE?(Lk2hm(k!*Xn8xilR><}`o&f2FtQ^rTTOqT1CqK5qh6BaDR#+mMZU%baS`D7 z-uKwsU>_rus~YDVsCC{$?Sa7q^ijL|4IG>$c2L1c=-$H6cn=p|A`rjz+H zx=g6m$dTx3X3IJ!h8`%k<{={~bp)(0labu(#Gqdzr2(D@5BDqIbzZr@<6t9tMc6Ku zSPg>{uXg$a{Ze-6sid?I+#uTc1&|kvnTnRUpImiid7Hfs5i=b(P^G0zB-O8uFgknI zlNA4>>&WZQ|GxmcKt#U?BsVEOR0&Ln08gXn!289e7e1;Gmj>Ofcb}; z2aZiC0qtxnIu*7p#0-QDEsUK?-3Mysv3U?s;)VOiiO|S8I417LRY~CpuM&S`6ACg; zh}=G(7c1s;FJ_QJw8gc5lWf=2|QnBr?U=)jT-$);!StxYY2F~+jm zBssML*p8h8HOR1soI8+gI`=TYj&wTmXa3qArASGO&z1wBwRFG&T^ z4MoNFWmy2cq9z=NN(};q24Pb02&5WaC_zy=hfthKbfyB?QHJ)Y*Mxt$G?(qBX>l32 z-88|RqRr9bvRhRIZ?_+~Mc{U8NQO3y1Uk&BA^^8r>4usn3Q(Uj)wKar(qc{(ml3;P zaWyFJ_7_)>_g$hapf_!bz+T0m!J&y4SAz{M=D|~p2sQc;PmhdLjDPK?%@CP!HnCKW z#noVy^#lD8^HJy*SF(S*P_e;@5}l6Yy*r%ltyh5EUO6sF#g5<3aei8i?Sp6uj84Qv zSrlL>sY`REv4pvR7%};ssQ;WSrH|l@UZ60HjG9<0bm9)Zs zSN~MtcH$M!wFSm<7mFP&J4nC@&MJe3T_2H}*HfEH*V z!HR4priN5KDw7|W8*F+ldj*@LYZb>@VEiJ*BY0h$0YrpNV^F4UYBq_$F*arsGgcii zIK4~vGOsJBx#@qxyaMDUPJ?bb0XLa)2}x1lPAGAA2u4J?yuw8t=0H%k4{gO+AliuK za!LzqlkN6U0jX+p(})AUtL_iy4bdy)y4h&#V*%!Bm_G_K;cTwk<{!;MP(~tDb-To zbbibQz{OlEY>aQ}@uN0aM@uA#sS=m4lzU3tP~(P+xC(OiAbWavJ#_L(r-H7&rK8zi z_7tyzDBypv-p7P5QBKV-@WTb;6QDES~ssWp! z{aYt&Y@gG)(cT#%>(rDu611a=g72KGL6n6Q&ozI*g_O7fqKMB@fB-p(oJhnCC^CSW zrf53QpoCARp#bWR^_Op5uM=w>78@}DSK+H_IL8H82G8KsM$Wy&JlgEd-3aTu@c?e( zgI7+}220h5#$iPuc2uB}ayykz4aGF0u2nS45vzv2AbJJnbwwqZGVG?*?e_#cmB2k0 zbO(Qs2v-h7S)g_o#)sl8)qs;-qRcBXl{2vOZ%Bh&7xkD#{UM12{WHeNaZbVo4-}bs zKXod=???Sp?-Ht>r-sK0I(>UcBD12pk^C0~Jsg6#fj#t~K(9Ty@Ms<&ZUPA3Ob)0T z>=u={ZZ4ZR=+NLmHVo0N)3K6ON*=Hf5|4jq%8D~h54oXCo z3^doI6Y6q<<<$8M@ofZS>E=d#Tq}nj?hKIW(MG;IKd*+sDsH9Hu_A({&3_T#dS!LufXZikiuy~PSzcVZ4RGoG31SC zT$q!&HI`A1YP!rZJZp7DE=LRUfHs19bx01yD(3)zOahw}aTdDeZ7BfLvj0i zZEo1qt=ihWndGKp$eKu=i=!>%7qp-hw6A(jq_P8^~+J$b6L+WH?SFBKpEN;o7;N@ z5EQ@}g!U*sGSEc5tGt>9GEouL?N;Mj1O_dib`8dqZi@htDtJ~xfvkT{6FCPY3Dmkc zQQ;-;KaHiQCTesH@GYmuj3`$zm{K6=oH{tGy}qfwrlWpt3aHIrl9coeer-wog5@Vi zJYNwiMYRe$-1lV+YAD@)E~) zp+jQY!T1E>jyN5MJBU0c8VU|fFgQ{6fCjWGL?{r-VfGnn*RveEOb(NBJ>x7=jF0AdWn8W;w2yZNFC?(f zG4}qnbGL{pXYi)ADNSInDv7*kNC{>JPA*kw*TYaUH-nJ5Y%VHgl}IWKw<8sXZB;7N zVxsQogK90Ae8GRwBW3r$P60U$Qsm^!Fj8Tr)(G0!gP_eTg3vPp-8KvCP6r}utEYc6j>h6KDLYAl!>DEqCn5!U zk4W?*toRsWDn*(A#Np{1WPHBX4YeRv2U_}$AP9*vr-|qQG=`JDWznxj%B1RBI@?#a zwKleNR+v|tr7LkUoW6CmtI%pf9jEfk?7IQq?4nhJ*mx!hD4` z6LMG=rf7dOo}Za#@M6d!ploOf>;i^G3Dz_ADQb|o2+>U;fzJ#!;3Vp1Wgx z4`nT-?m;FCh_V4SRfDWp6U*R*Gw5hIF%6ru5=OEheu@6ZYXUk%BmuRiif}vbwsA}< z4g^IbI>b!k|3J@LRT|crK$z&NgZRn?se%#HUV?uERLFaD?7^;Ro|sL8=OWh*dycaZ zLtR9CLeS1)bE>L)yZs?(aDku)G#Vhv=>)xtGADFH&498YC0v|<**C<`6P%U+dOSo} zDZ^rs6dVjfLO;{+v*=!WiQpl2}>~i@k_AX5Ewu#GE}AG6;JODC3(= z*XDl@Vx|t=n~+Ij1jKMSL1^ACCuQ(pB_1b92^>O{(;R2{DsgNt+D$A`(#^1xs$>c_ z8&fC6+a6|sG)vOx)GLv&8Dt$az`N0Qujm5J81$jyOKb;$rcpMYF7C01Bcp)TDn1w^fFa4iml+Uq}#ixow-%%uvM&F&i;S zoeJsR?KToBoP*?O;8y2MUA3WDQHkviUAp25P^>bGCE6V?J0M=$9V0tk+<(s0TqeL4 zRp==&^|Ps>wN!8cf?Za%%AiH*hPWc6zp?@Zd;wntQ6_f>Oyv(^7O;6Igxy9Ix~Ys?PMHLUKA4CWh=S;dc2N$1>4Hoh3{l&eGM+6!g{ZBV zo=uc_MN<`xIZ#-E%v2+W2?a62kfl}vnu&|0`X#PoCYOM}qALKRp+hMQG#KGD(*u@) ztiH9$<8n=#wj75}(1~Nt&(gq|yn=rN2=k^*Lxgq+CQ{U$0XYx^Ew_bg(CrU`GR7Ry z+yR)s#*G4ad6f+IwvN!w+O&PnJ_D(J;-;0@W>)S2s}?$(m(k{X^eDB666YF<`by9d z;8c+=%8e~H<)%YVID7Zi1v*(6b-X%69^~1N7MFJVY$0 z!U!V84un^7v=$Voqv09;V3&V`lM`r@t!Y@Rz*0|&VZ>TmfXeAKzImv5JAt7x@3A35qYT_C(&g^#BN+GK*KUI zVW+Xk(%akH>xlhBJeq&qsnLYQY)d{&iT*G#4^xxSi_OFaJHv_%rwE_$oMxA2g}9lp z1@VKrksPRyhJP|Az$*gu09;Q#=`Q4K4e$<;eZ>(;Wzz&;Ne)pP$J&SL9g|{5x^MHB zGKzku>ZXzo3P9!fE;ND?93aHj7`)s;{TNc}yMQKz1ym@$LP zEH+dSNq<(JfrQg}6^UPxCrJb)_ESkxdUSH5hl!haWPu^U+C!U3+7v+tWz1}uMs-wf zsrQUDNh*k~eyD%q_GShT3CHLln6OMA_LDGVG<}&&{btyU)cghI6^__$(p4DyM>_+~ zsoNV!?+CJrF^D>;O@B^V33V34$H|Qlt7#A}_qdAwBOj6rhZntcbKN$CTBtF6KA&$! zRTcif&*w}2zt2D2SLCnq1p@x6su|O(ihTa6>C=5hz*m2$31oWWy1{8hzP!guUfh4k zQv#YGb`(G-9kb@x)PoZu90z<|I;h0DnGmbWAPA@hJ7+kRXz(Hb-QC+Zw#ljr9Qui>F9z9 z-7RTx7qEYGDx{6+1cViiE=(v#sqa)brq6K92p;qPTiFdwrlwGMAoKm7Ug`5E)Ble!I2A}zNeOLEV=J^8SJ+(k1gJt;fHE&4 zDZ!a~hviC%kg4Evhck#$=HJYi%f1+5veo2GJ1c))fOC$bH*Hp3Ay-L>i}X^B0|^~1 zszEHl{%+x7(E7sG18Ik_nDy~um>|EJt#m`txCpG3I9*5GcG&*yG9BAD^phB1s?Nk> zQ(0$oIb9m_)h;Ok8Vpy1Tyk5Yg^Db7fMzbxtge9HvI+^+DSl5GW@T^@@_}PcHiboU z-2w))Op_q$C6gAF9)ETVFeGxa+wXI0J~EFEGaab8S2SP=|7_2~G?nDfpNgYf&FW#I z4yF=S&eRG3CEfIJnrbg@H8p9~!$#VZjGx{TRfBFdPV&)`cWhZ!J%VarABv3BYNgmQ zGoIS);mHTnL!m+bW%@%AmwPE;22&@826@u#=8*AK=FN4hihp1^&v?;F$l~0pCU$cM zG|O^%*=kFGn#(mp$G(G@_px(ESkU?NHb@ z1HN_J){_P59WnAX$H^TF(^Y1|#KYp^f@9-C;$w4x8Gmr{NU`$B@$%?nW^>&s*m-z1 zC&qG)TB$~Hh#oEwj%^&Bq%d?fnC=2#U0l)Pv1$--0U#(na!uHPTC*rgqE4KJtHBJK zawyD+5<C70P&0MEKWP6ZVUNO4rX)3d-l zq#JhWt$$<}q$y2xp=c&b)(y@Od25`;I%4+1bw*g$YtpzeZ0Xza&t@Zx4;DE-- zf)WFw062pcmNWY>jeL$FNFUfun7G?xxAMk1goDXos2ex!2N5Ma@y0qPUgPd-&1_2~ zA2P|?rd#3PHcSg8Ac@@&7kww$Z5$=w(*Zl@vwv;9XG6KoVccXGZ;7ojepAkt$l74H z^&~X|r6lHQwwJpnrx`0LEJt_t(pd_fy-h9)PEIZW$wjis_fCiU(VCfm1T*8~x}n6H z9DqYo4Ev?sIdk$8<^)m>M@pF_d`d{Eq+B^|UWuu3jM!)`Crp;jAxvhI4aNQq08v6! zgMYyE8O@^kmRIA|!0+?LhMau|WtvFZSVP3;nI*_(h&xk5BcYOQM1NE>ezCEQYzqCl z&4Jpe*hpUDcga+jWqm@Q*n$nv>n4R0=5rF_+X#2q!oJgOGt#prI=mwDP&E)QM)*s& zmEeKB^Om4KagZ)T(oSl_*2w0;NDf}3^?#Dhr;XIM!8THxkFk{@L8ocqsMog{#z+&f z(*&2K;wkG?r+KCvz_G)F__C4cbL=%yVEC}U-IBry?hu`V9ZPY&8t9n>kf_6MTn9wf?835C3_HVveb!gG=`(EO7}-Z_0`Q zYlfZM)`5i8&!S9q9g0jRf#zFb`xN(#I#Ugn-GPuq>{ucv06{^dm$Kxk0s-oVC=;dx zO`_amNz2&AUr%!%I3QJnvw@`ymw%jcLid10h}%SfqfY9I=14ChB>jfrS;lhvT9Zke zqJf;hp)xXH(U z)SRMJ@oipzTO!hu%&ACAQj?J~Ez%IG7gws<#0gr~tSoJaV7V(vk~d`%zYk|9;doMz zMU8TDJcjeG(?}iBc>`_pVAn83-JP{+nE)L7x|3KVtCj(Fc-C~ot$)R3MC{lP)eKN( z-V~Y+zD$hBiUxJduZuM)ca;EV;RM`?xr{EDpnmKcG&B*KE@l>Z$rwa`=;LS@ZhzH87$&#q;a#xZ~7Lg%K zi4nsUgoHF%U(qg;41cS3ouHnsMx9-OhooT`7G)&Kwk@l*!h5N<#2lH%$k2H+53`UG zmj!HlwnfGxh&u3xX1G#VYP2c#uV~P^!zSjk4Cjt-St0~h4%ChuY8@P?sXJm#BvFP| zyQFl`rn-S7cLv2?EiQZXXmQR84_hsj{M8-SU^b52u^{YGl7Ax*aGUf1C@D#DCMdxa ztvHQ8K{rlECPBAhNX7OqHKml&_0#&h4vC~rlksGS>h{ZU!6<3HD zL$h*|eb;qcu9=~i%oIaunxhpn@&yp3z$ucfNyvg#0}V;M5;UNca5!mdkR}|$IvsSk zW$MyJ&~G|hPk*X%olK#`%!ck(!fwV{xY=~s5|bi1nTtn5)6$NGb@T22s%dI+B_AAm zyKLvjmfH+pB}@LvPGe*WUP?D&1YwVtN?pWfQwiZbA6_zq7wZoN2SckWLQRs;HN>p{ zgH#xZ#M$z#K%nzcD8wZkpzVoxK(THpT32yS#=tbm7Jn^eTP!XaqAEeRIg)O(1ez~f z2m_sidXWPEGv(sprCdxt0z{!m_Y)rhT0t|VoF?7usLo5&o>m!fYf&i8biABS-cj4S zEG1}((Qpz-JWgLT;C1e0($ChBPNy3s*U{kB4#cP$=A~6Fh6BGz3vR!U{FnydCF%98 z89J*>-+vh!Bi+d=0XTPqIcZyM2`V&NIh5U2ihyF<= z9IP%53Y-ChtBXM&h-gp+t&59Crh*;3uTJAnB{O`G>O*K^qnPQIku?Ew zaA0224aPBu`|_4x9*mA&*q+gr7{sb;TaY^h4S&u}Lp!Wvi<)%MX;gy^#c5K%avG0A zp1GJXqpBFI^zD$cc%@XXSrNRXT5K3+4NG`A*%00AUu+ia-%wt~#!QnEFD$Ox)Id7DQRu-&omT^#IK@7u z9uJu{?41deaB?rInl;B2Wgx(AyDoz{W#F5o$PlzGBT6{RSDKDZ9?EKj+VD(@i><>Z z;3SYnx?(icArml<%oL@A-GdV|so*U8tADw+Hq@H5%thkufPo<)gZdT8+m(8*D z7nkWQK$$JZrX1IZB}2(^Ny2$MlZV41H4x1eArxs;06wZHrXHKc?3klN%>zJLL=6B% z1~tn&&?-1t;4}nytEUBv>nqUDU|#W}QZ%5*btGAf6-`OStxPhC8GFuBytrv~c})95 zoG$Wi^Cuk|-V&Tm0tvkKq%hQ_gMa>$Yy(L<(Lv{5?VPc>37lq-^3ieUdUM$Vgu)SO z)xEq~b=+DJp0&!xVYUR#J{xlu)kEEubsL+Qt{lzVU(26 zy!))wBqnd7jx+7b0*A4isTy=q+^0b+iJC29okM~xDF?_bY(UX)hDGznSAP)XOj9}n zBdX}=!r}@B*hMUP-DnMFqz&R*NQv`on5E=(XT>U&q-ao6ey~vbwErNpO)3!=fMr3$a3ez1 z$c$}Pr)k;yp?Lex^fRC7XFk)xY=6K{_-`j0<+7F8#<@8}oZEG(S?nT>CoQjNP|>~C zIBrEH6`UX8Y(+>xjPz)dQ`DIh;`lBz5W_+o zj10zQ3F^94BZ0QWN~~^9LfpGaZtOnEJyFh>s+&S$LWxs|jDI63Y*GM{E;UH%BvEM4kIc-?oWQAAT^&OJ#}#1E<+jLOGuMTr360g` zMeK)2Lm)I3vtrNXsVce=(V)IgGOa3%qi{s305{+yh!7uMOP$gqn?C`BdbMgILad3a z8)#2+iZ^Vq5`h#u6L%B?59se_x&Dj$!JIk3XX`SI1b_BG%=SjI6_=$kDnN(bP{XQE zTn^Uu8<&jb%_i|!j6bxdm)?_68 z;W}9ME}cMb#yXOPVkBxGl)!qfV;&UrM5(d{A=x#dgaP%D?ZhFn`-Ia_T8adkiw1gP{*XJ|{ucSty#KfLNT5QiYat0LSs@bN&YM8I^rU@Fe-Q z6!XD|@iQ}YkvVyWI$w)nqP|P*{UlwKaxfaMFl2f7SHZ zIptt3NZoV4{;AvZD2K=xUN=DN9^JjRkCtw`@qZMU^dfP(0j7hPD8~(^qp_`m^?*$hJ)#bQg!AEsBu?&1W6@-G z&SA`>)UTk?Q3y@9XR1R#rxZM^2DMiGIi*L2n(0J9Betl54r}MIt{&?#%a1UtQGXLWQ*i%FDg2a}Yg9DibTC~UF5Wkh@hI%1r~7-3;aZHpdG zlhHTjF4A8kyFn>;%XB!vX8i0kFeYCv`_)Q&u|CTb2na@8sOUyVLbtYH)UH??w!q>j zIhwG-;W3hO*)pkKNxY&L0f|N4(HKUY!&6NjDnk;5)M;gzYhb+d(0=xe&qMOXim`~7 znSb&zYvnde`Kodx-!U@he-6wD%uLSzJfqV0S^noSc`j~iS@0#-iRk`+sc~Uldr{H< zn^;uzxk+F6d{I%6`wzFjQdD%rB}V-UBi4%uc~NO)E%~c7;EO7{QCeA78VGQz>JdaP zqH!_ZBSWJ!5GW1!Fl`l~K)wn10zS8|%75*z?DYFeD{HD|l~&eN20SwYfwRf?Tm;Ir z!|5JhX~0+3%<-aZD0;M?aJs1zHR#KE;=gB>PbHH2RySq zen0sI2@mA8fP@@~-d5I^R@Ty~mj-+yo$Q*LaIDTRCc+W_bcKVBQDx>D(g`Ak(tM8B-^ia34wlpxmPFOmV?}{v0&?7GC3M-M)!2ITQMtiJ2th9t9 zyxt*HE=n{B;pTW_V0oZ+MZLJLwQ0%PFkBdsqRZ-*Ef$UCJvIL6Yt``LnSW?8XKST_ zh7}EqT07S*S~8aewVVKLpA)7g?|ehR>HGGys@^+XDo>&dX0wV3mcmnBYJpQ+YCL@(!N5C zE?=Rvtn6v4^~XBoB{kC(-^>PI*Q`ZqqPwcDBQZUcn7v3(%x_%WE=6ZFPhVWy#m(UO z%F1;O%a<3jL;399_C#r5zJDH2hg7^f%$`{tmsiecTp=2o*cGp>oKaN?{cFgv#Ydt%@IKFOSlpN`mb%|y1@Or(wX+f_#vsRwf8h>8VY6xwbf4VYj#q1Tn zrA_ffTUArn;)cY`a7TQBFA(l+Te`sCT^eYJRnBiI4K&QEDXpw64K%P@iLWU7nc$tu z`d8krSzc5GiW=)`I(u(==g%A3uKnPTPrSFI?s4(VNvEHBcVGSd3mB2YOh(7kj6QP6q-+A)MC%++zKi+ryqUy&67k=en<&?{hKI-7# zu3K~EHP@U!sWJ@8%D!-Ob^O~8J#^;w?c06PKY-28gnxhYnJ0Ap@6Wbfe#)6wUUk)Z zw=B5gFVFwD6$jeg3> z6T83n{qJ86pZ*@V`);oH)$@+}^2sMpxcaH{KmON0N=i$Q+&XyRryYBrdg`fd-*d0> z4Sx*wZEl(};iMT8?mYYc`Ks!h`^i6R1wokg!Kqrs{so(MZ+ZJKo9|vyUw`DLtFQj) zBWJyM%YtK@Zm#~?n!fjr9Q@>8t#AHot?}Mp>ZL#a;^?~`e&6-$p1qg<{G5l1tE#?w z&JFukeo6b_ zt))L(v-Q+%+qV6o>Pxj39`pF^TfRB1|M(ZajT`s;W%C^uZW$Py^!gK*edoICPB?e{ zo2AlA_tqac{leW3Cn~pZ-~Q^GZytT$OPBuQ7gcXw{e?YO2=~nU$(MH2o$|Al_kVr< zH|syxe#;eeH$M2_tT*+Wrp=gf{G1K@ALFl>bHPU+^}eaE{>njqVAJl&2Y>p-%P&5= z;@pS7e&?zOp4fd4f7J~)OzXe=j@k>4IV}+Q3VONgw#B#YTzB-Iy~pqWM<4p{hab+G zvi6^Y2lu}I@`k;S|3Z9D{ot*oZ-45>-+p)P8NKh^|KcD1yZ(z6=RUmRz{$0tfu0?M zCtq>s&!-%G=*-J6Ui+1=eB}?fw@!Zey(dok-6PjOxpL#ijlS3)tB&~m=ZpRRB?nHf z4GzS24DPw&& z-@T>(?yVPa1N*lPuI_ERsXFd@e)P@*uiV=D?DYNr`1+o^ z?t9hfA$`J!GB->`qzb9LJN0XF?mPrv2)J9zw52YP4aNR-|W9=54;t-adHK&T9|o7yG$;R)4(u+H2?i{`XC9 zcC2n+zrOn6haYY`_gqi^#xLxjddZ=C<~9C&*Ou3Iod0;}yoVk-^ZkGQ>$cW);t8JB z-@5U}8=vlfd(y$@j@rLt@bq8JAGqMuiANrJ*>sk-*x zK5x$zr%(FTyxJ=+ZhyG!#BFQuU$mv>g=?<8_J@sEPuUfjb>zY4ChuRc>C!)K;da!$ z{l9m_Lr1N$Z&^Z4MtOAcLi`Yrn-Px}4ZUl*P{TdO-T;V1R$ z*H>@fzWvsn>KFFkK7hu!XWpZiT|D!ZzKLHv!E?>r@4OY<_J8doH_z?=^}b2nj}Jb- zZE)eHXAe|9zj^m>Hq1Qm!P`^&KmWp`l{?S+&fZ53wj7x7P;lTaZs7E%79N@uZd!5Y zvR|xyVWTpuy=mpjNq_u>SkiyNGrPCkuzPZ2V9~(0&U@mq&3=CMyF2I4-1x#zm-C-| z^xm$>?(+}*7=O*PWZzL=7n+1f>hx<5{`A&QHt&8wnf%1%r<~FM z`Iojm?cI9me;swq!Yxa@dv?y+J-M;{o~>_PGkM~atACGfY;4>Wx$>0Lr%Wk6>#WrW zE?v(JJb_la@zB!S_iZjKFR%I6-=Dc{CpdHMu3L}(-S2*P>&`nS?vI>>X7cu=zojK+2|8w&tFWnbeyyd+Iy7%n< zT=R2-@8AC1wbx$z+Q5i?^SOJ1+y391 zm1`d#+`Z-W{W}KtHN52abK8&D^YU+29k_JswKv@~q4~L2_wK#o{rBJh$=1QAy<5NW zTvcx(G5w<>{pzdVIJw$*^4#0sdgABjJY@X)i2ypw_srXW`^?{6e({dU11HZrwD0PD zlYa(&`u^j$iYHz^dEU7nym+1Gob~^A$y00ZFZOtT{?^{hF2B4%6wAML+8Gnh8w26f3R)xQOBJ8+m6;brGNbmckZ5i@ao3~cW-&Q?93^re)A*lrdjLe zleJv>+M^e~e&+)(Z~x2Vmwc}1_)Cr)92{J6U%2^&OWu6@uB{jRNSvjVabh20xx!)%@u9=WMw0=9@2*|NLui@RN^cee;u9r*7Eef9$cxe(-}I6o38u z(B6R`iYLxcUPj3MqmMp9*JkOzJ*l_$#QyZ)aZ|27`od#Q`SzAAlYjU0(^p-4?UD25&HH5U zz`uXG-hcDl{u3`ecJk+oR{v)G*MDwVa79B?(}b2SbHCL5+&^DfzUGGyKYa2(c5d16 z(tVN7{ppkE_U_uXtEeb^-=zD(&-~=Thwr|0-%)et&Mm8`IDhNbt?kMizcSwZ%2{*f z+_v+MuTj$S+(~dpT`>5AeMiUdUH5v!5l0^R!v`Py`rNs5Klsjc0E;?yFxtf77O~{O#PPX`jrjwOxy&m%jYW!|}KO_a`SjcYoK5 z=$uuY^Xsn`segIw=zrcs;@yEzxAy5j_{oG>&_28f9s`}PI&5-3)U}r?a#lrpRXlL zmMrSq67T=&2`9Y1>$b&rpM7W1x4K^Z`O-rJAAkJute$sIu75cG>Da%U{`NrY(tjW9 z{OJ8itoxlme)p-Xr!L;I5(N!FL{b@7;&? zE<&F~RwF$3hc(UDoHB94{yjCXJko#LPH@y4e|~7@{&)UwD!PqZ*4;C2)2;IdrZ4Gk zTD|p~r!?O<hJ}}|lZGV5}M!)e!n}ZGs7x~wH^3l4FKK{6IOU;abzW3g?r>>rQ+s^2h z_uoDjjeqp+U7JpO;)tS4Pnvnmx^?SzMcV%BXRCkpl_g7-ILTqOspwm`-+ueOd(V$A zJ^qp-V}Ja`RdXNp?B22-(bM*U3r?K4;lp?9(e<6wd2H*vLsk3tzT)k_;GDbXeQ@`@ zO~S2%6Q)loiVrN@ct+qa$DR=ycq=$?`cu(ElYiu=<0Q>9~WHf8AVEq$tW?|Ni$yTWY4y(*Hi8+IR!>Ur>9`yhEXZ)1SKI(4_9B zqHkP1rMYd{vMK$aU)s^${_Vd%bK~MIuYGk->j0XYhS-|=`g+FJ{OMPf8!x%!HYZzi zbbnEq+x^`eZ#>Df`a#gYaq*cw@19)M{OAX7zj#~gx@r4wKNcNm?Yn~$=1nO=cmCXS z&t159@zrx5FTL$YKl<-;9_ro|xriIM7h(OsPCN9g$2Q;b{C$yD>E(x49++_5rkifM z^xWU9Z`|_3FYej-@$OgLdv<=j`p5IGJAZLvk&oMc#Nah^rcRo^_N!A`zhBXR!O!oW z_YZDh;PJtmcD!&v|CRr9Men`$UhhA*9d*^sH@o{co_5Nd^-gKZwmw_B z{~s&%+||8j=RK?MpLgBK6N}XSdsZ56?mF_4_|^r7W?yi|hyS>j|L=CgsOszMyF0S;)Hge>+5gPUSAI}?;W3+MD&OB%z6i6v zCth&qrK1kMzPYIArn3@X=|8x?J{m3i`8f|w>A$>vmOwo zADVvh!TU}**fnc^&lh*pO@I5vyMGo0gW%l$50F+ge;TP`N`|j>7uivxvA%37|hkwZ>@agaUu>auxug_Uub$`sMXO;C| ze#hj2PmVk8xZ|QP{`{2hdDnRQFJBxSc;N1N|KJB6xO?l?9sVUpO&<8f|NY*-9Bu4< z`IIx3|NQ(H)?PdJsq$&lrrjNS+;zkeN4)yf)Gc-M=YM-&qvvA8Ln9&M$Q^Za1VI4P zrnzE&{Kd8>uPV9frkkV(Pk;E|%TAhk_qx{`F8#Xy|J`}^{o5bAc;Z#pUtivT{CS72 zs@T8a{?|4~f3S1z!3n3Gc3SlLJN`d=Umg$D_dc!#B_)-8yNx{zW2caPC%Z}*Gj|wf zGc$J5A}VW26eUWc6m7JrsAwZeNSlx)N`<26_qww%mbTA(`Fy^=SAX}9GWR~`InQ~{ zbDr%y_a5F@ZlNtVZkT{C&N{ohZ;y$Y3z@pWwp)Vwk=mNLCV(}fE8eQK{yea1mFR{` z!KRHTHz2SNr6R|MJGG<7E)QTe?%cgw8M{zKCGeHWst?tYU3G^!VK7)qYAP&BScC10 zq-Ae1ThjbXE6MHie1Cj=`d`H>=h|j!3hGkjjEsy_d}~CZh_ot6jMAgm+}vzoXLl=0 zhq8Fd63Cl9i*MnVG)uU)lTRTfEv@5GM0H7%gr!gP$#_)7b-OI>&F$@I6LWJ(ZEe8= zD??&4GevAq{_m-5D z#ZY%TIzl=+Iu%zX+iiN2rAiDMuOpU2OVT_^^m@&KmAn!X$zdN~BP(L&3$6-Psi>$} zym&F2mzP&)M1MqOW#ydvnOcxg?$;tN;^ET8H@;r?5 z{rmS#7bvo)PoE~W-CEdfpGMsdO^L6K=u$2@1%=A$U6Kxv#^JgE(87OVZJA~L&m-PJ z5mD%;XCZm^%LQne2B$eyF|+q;1aR2aKRB^gt=p-Zy??|Y^~TtvYls}myDOi>_iN(0 zZ0jGK#X6m&kXO)<>1xYRPm7>L-1nf+ML`|^#Cb%WJd4Jkb0nLtM_Ml;=h)lZOUcO0E*n0?1|Sf;2M-?n zJo4t0bbqbnR#ddqj?scRlo4;FnG`J(ksmF(bmvPom?aIxXj{gbx!JsyJ`h~DL{$vz zbArVZNV@F5Y0E6T?rV}tlZ=rnM9w^Y$yD0F>kX3ToAwJqa-7?;ll?~&m(zJz3^p1LPAX? zD9%@}UO~nn<35I4SbbhjPLAK>6GD+uQ3!PP;(Hm0IhK}|)ipKzV`9sFY1CX;lr(>( zwY`1SY4ENJu1RH8|Ft>u7A=asjjs4Q{C{y*YU&oR=+TCPPwnmP-goyZWf(;3+sG`9 zT__UkTC{GtwziYT{v)CHhw8Hcj9BQI2ukVj-a&(9Q0Lc@I0w<_?7{_(IW#{{0dmx>O_d+vumjcUM07JUNRk z3m+^T(78zNxWjjO=t+QIT`oJnvZrEH(sG(dlvFkLHfi*kSe1#!{Q2{{>VNZjo`<$A z1Yg*+E1H^`W@zGtXV00lD9B?c`eS7TAprDb0;G7u<^uV23w6JO|eJMB3i^3Idm z^JxAV-`c(Urt-bD`b}Py#eW80yrbc(Wb6*;vU_=XmG8S%vsZELYy$&>uR|@whxuK? zUntx|Zd$#y2#*Vp|5{Q~($!QVNhXtz*dva#RVBCO#EDltITw&O)z=kSia8^MIRp9E zDwunMCZ?vA**OZmwP8&!yh;o@1J8|l_}k2#JJ-AAJpQ3?*`7UnmVXU&)fta)Z}5(; zsTw07qiZ^?AWyy6U9rEve>DbkbU+?1ucs&G>FFt_temcII`_+NT1v{TyS5)y;Zt($ z*)y@>;o*n*WoH)%z^~oEf4`%AFk!TN4iwRQ(>=6E$c_P<9wn=py1R23Wx-C$Wlq7Im&)eiu?VqYwLoxiaNstm$7mkKZKt!wf8_I{HAS^Cr!csnU?+`(2J$-s z-5`-j+*YO{HZT;$*}+i2UtF5c{$A0+#5dbv`zx!@Bmdz~cWf0k#ub+b^oCSc*Q@Jz z9GMbm?1*G~-BCJ5|mb1k1%zVPzlu>uU^YuLED(@*> zFuh8T!`<6a)Z3PEJda-q)?b)kK_3STtB~-?>hfSLWvN^fQVf%5&7P*&i~j3*1%vgd z1g3t+vGCOS?;ilt8?S=h=k#M-LuRIKUx4=yKv~%pH$C#FrluxC7H8$qGXx~0F4pnc zDg4pFL5n{8Wgq^Nx33Eu5xh-vbMvCRJGmI}db8{Q(yJ9{S0Sh-+Ngmn1jF(<&`zHZN%|i{TGNFL(hff3WJ6O^c0AY-CPrceYilnR z@$^H^UgcPmOek`Vsnu>1!2oCGz~Wv~OlQ~!r5fYU$XD_|oLLY%%BAsGeu4gDs< zE`k0~v^~JJ>uSyJAr~A)(eNDTJ{v`7DiF0L*_k=mQI{XN%kn%U(DbFU6x4tDH@uy` zI62vj@=dTlQrBj1!_$Q=3x_4^O4ewf&%6edpQo|mPeCFv$C>Q zXN=2S2ZzXH)}`K=kU(KsbOFqduzA|L%qGAqapp?BU*`Mlfb#l#J?e+O7<1t3`%n3e z#+!>enSNNY+*rKOG`pX&fn78(ftJkM-n_N@+luE$Ias^pMMQm|@qZ2s^Vl%))#Vw- z7&Y{LVO{I*SYGDN)=IZxE>dT&t9w4(LpRe(J2Qm+P7Y zH?H48o#WTj5vk$^>y_1yVys4!-lr$N)A-aBtq7SAHqi(Q5)D`L~CQ8 zJ9klSjE$^lKWR=KR;8-Sq!K677EJy@+aK{CWjX$)?`QG z9yNZ>`=tK%D?(=_sh z5IZru21{}^rc$zg^coVGSq+W;`O`?bwYdam*REfp~I-CD1kfOJO=~QFiiu45x>}t`x^h|8C|9L zY;T|qwQl+5=0*}j`T(?F{y2xM$>jLbNHmcAi=cy>*v`$##(?dY*OQ2=^@2{Lz{yFH z+ZAKCQ4PxNSTw)qzBlLJ8QUQI8S5!|C;J=3S?H9)V3hmI=Ij#F%#G7OtzK>$4qOMe z9H)nhgyBpnjZvp2bcn9Jxn^}E%O*Nwf*Syh%QAgU?)$@K`|1~O(abW>txT)Y4~<4f zyh;jDZ72ShZ2vj)$^8|wXaY|8$qjp&<&H#q1L2R|D3+P0nUH+N%#NW@US-9)6)WV^ zfj%ysyUH;RpFd3QMMi4@i*8r(G?^U9D=pw14Plg3<^wRQ`Oz#f2KYyrQc^V|Bm979 z$3(m$-?wCxF033^0Z`xF{rg6OfbvX%O}gvY>JgfL;*@stzrz;4L9zy9HDu&=PF5Kd ziS~t&*_=O7VbY)@SCHz>2>K$U5hwQ!J00Fso+sN*Mi*B?A(vNH*qj5^A`v^o1KYpC zKOWA&)G(PNhOB=Fz2j{1^;Op-%{5T_HnukU16mIG^3qXJifWCIPtomRIK>D5RVlz) z?V`~B3de`?A-L9xnmqq;L;DvlaQvXTi*Vg{IMP&UcQ9UdKxiYw>DOaW_nMUvn0Rx? z8#%o2WIJl8gN_j4kUv!6c&p3yUJ{*L0udEQ%+cB=R)#EB z_Z>dkzt}jm)1?($)lJkZFxaZ-}69%3(Pf4&0vHyJWy*S5XbwzFFDN z)Nda%$cm!jQ|QBe*)$kLboqc?_H(IA%lr8fXh#g{_K}e zU@uMYQ)nzWD(XU@;zP(tax^sRSLOMZ-e*j#8k>r83h1I5d}cxV5%>a7AyKU3nKTz9 z;KJO^&X53n#i2%@5%-^3m1mTvpKyXC(Rew{)Anw(q{P%g=aI^qd&17z*l7F0t}Kq) z5nl>aCz!c^uvw~-ne(w({Y?$8h)M{_6Aw$^7^IwE+F13s!7rCq6t}8Cs#ir}h?b&XG(jcW6R~Kqp#TRh9<)&Kc37mm0FKC=r^;G>~;h1i#QJ zUQD)%{%EW;tCTo{SgcePLH&AK+6WqfJI`JgbyJOOeKrgaZ{M$%JMHiIIKjktpwB$R zqESP`&uOgWzojzGahzEe<(-SF+5^*YRhG4rS_=zURXfrHUwF3P`j!kpFR^HGvK#`l z!wys*8ul1IkZ4g`2L;nYAXrJ4;ql-}m!&;h=AA?SJl}B9@geA2T(+~0Za0tdr%DW;;QBx zlfvA_JQ7|=NJobujw)YR>m(|=kzFBCrIl#?fHhx$N;)bgB0N=v)nUDy)&eY9g%z-G zj(;jQTf3x*ez;pE7q7;Vw`!f<5@!!?LAAiFO%;Z?x6N^EUt5;eK<68k*}*5SwLopp zu*wfccy4u2MQ9Z9<0aHO!1dDKN^P}AOXP2YVRH!O<_I_SgOI=9#f(OC?Bl z{P9o^7-P3Tn>mG!6emO$SKq+Qk39Ba+XVDl++lNODc{&6`AL+n@_8y&l(v)twZ< zk|G~w(Z}4alLfSh5OBsK*5vU8wo#%g`L|8W zWWt!a`?!0+-T!5~UTo(k?6%ey8V$n6OZI6_qx^Q)*ViL7G#m8xqw*t@a+9NI7e2n? zCPUGLmjj!1XyfD)@dM})5vs&T9w6-_zzXMbiQ~)edV2cC z)bs6zG)A}#nl@ZQd>SxT<~})LxOpozRhJBYY*o$ z6Yl=Hua8$4{}3}dUJepG8hz)Dd_R_d#AKYE((|q(%oIGbH7Ed&tf;xgG7$|1&d{-JWTu`_$Pj z5@=Xj$!*d!vf^koNUP}U>x*;Oyi8_N81ZE^?Q7CxN~k&7Ba}_O-jS{vjLa4ks`^8- zusF4dH(-m(H350XRw)l(<8#Nt<~E#7Zzt0r+l`FEK|sL8pQUvN(y^tb1%*+;Ti#vA zKL0oG=!Nd}xgx@~)vo6*W+z)`Lla(fTdEq*xuQMaGb_`^+_93qzQaCq3*$7ziQdz2 zh^$(aE_vhJ1l#ysM#m*I9ctp>JdrHFGi*0UHfO8)iRRN1{_AmB%l+r_Jp!myIKLl%VWp{{WTXRGv16hm);{qm_w81=qr(zY3Or%} zzSQ0B6wM}-rqzOkgYC>Ql4ni7YcuuE>gt5e-0`$+$=!qI%<%+PlZ$@5IR-8&jN5xR z2+2j$(%u@{%fkKX%L&*H?NCT9%C})B9&T4k0M}|Foy(2`_Rs~cQHG|K9EKg^hUR9- z4Nj>^ue}%_537-EWV*7qCa3wZd$e)#+`_k}B50lL$Dv>wPQ8ka^d^1=NBxu|M3#HZJRqP_|# zAe3;5x$i+02~#vdvxb@pgE45_FS^KX6avQ8ZOh zrJk|Ijc4m5yc9f|$vd_x9v=~5eZ4#2#~3=I@qDEit8wZ@ex zP$rm?z$Q3iA1CksdHTK@TsVhe$FzRo|Gey;ixv@D@bFnMF!7J8~nJc5^?dYf)5Su22No?XJoO1PZ zj|RM^qJxV-m+|f~VY;*PS}LT}t+Y%%Z{|lU)J&}xf*U8lZ-#YxNos_&Cj0=9$iow& zayjQzu4{|j;T5MtL1ZX;KxsF^676+=IIjwdcE=Kdu5=>l4Nfk>7vk`Q zfrbwDZDvTHdn%OQiuq35eYM`PR?{IIee<$;uVQJPKx<%HQ-^RlqG_W{!_p?h{KBcV zz^rP;_$Aa#>}JMIy(_#(8W%WR;DBrAc(;g*WLg!ws|^dyg}Y~G@ExREbuyZ2 z^=g9`((*BD+`IwhLRPOWWE%+8I<=B2UUSI|bze5wZ-iga!*wQm$g=)DJ5ggC>%ViB z(wl0=kvFnZFhsroHV0}!WXq%SVu=#fVhSUg!h_C(stvdBBBS+v+mX8Li7dY%K~pg^ z`=z43jAcR7=vZZI-+Q)T>JRY~pQnG|TB}Z;1=1Bb4ow`Q*w8~h$lG%_fjJvZF<)6KRL zOr+n!gNXESJvs@sG!^jLfYM_Rl(RG3+2z-L9bwI(&HHKeVM&CDFy^do!|LC0?~N$N z=xEKq9?GQ8XEM4XH=PN6YFB6HOPjBuK%`sfLE!i zpI)>C_?(#7W!qW0LGz^~spT)dp!Tm0g+KH61})(wC(-1h3y3b~@#Knxe?Tb~l=1bv zI(kfB@*w40!cH~m0==p@lK#q;flZ>BN3HMf4j3C7w-hJxK<;?Deo-Geb3C@0qSJ{M zCZ@NsNe=&Y!GL_J?Y6hbAX(=HU_VijQ{9@JHN$6G9zNXMbeZ7*xsCX1UL2e_BzUC)#o|tv)4E1KJD}CiKK{{cQ(kZ!9zm>dLkk`y3yvL z-!}z>TyMy`mKV$av=bqJ`uQzhUJ`<4)mnm{KqXIg{2Xi2{G(XjWR7R37YRvIyN=GI zuu>9Lc4Gd122x7EbAO|!&FEQ=Jw4h6VF(%q@ZjZTKyYv{r7E(e+ocAaqfv|#Z(<5`bfPumyv$5;h zD7H75LHj>HM%T-<16R{eTV0Jm$cG;vzbcX(;%8?OACFh^lCBu-ev#;5@&&fonOL<} z$aodym06z)a%`zf(QWC`fj*W}gExNdw&6po(}y><=qAO+CWDuy%Dy2+eJ2{4ES|hA zHQcwmDunuB2PVK9%FFFOz0=*KYp1&n8x1^)s%hhH2eXZVfu2+;poNKldWp0csxZ|KF@TU($LGkZD&#`m%^MZUQC(1Fc zXb6_W1qUoot=v>pLsdDkS84&%Y6bU4F-RMXt1SsK(rSR3lD4*jj*iZ>!CvX@6Bcf( zPy}O+^J?m!KLoW?i&v#nM?LFf%NgZDtW|ZK+QQ{m#Yqh=aGm0Fl-l~|bGNXj$hJK{ zLFM(2n;Td1)QV!qL|ZJjW$Kp?kg<2^)my*Q16@C$G@zu6NxQqMd36g2)=hRj>r*{H zKL?o({sLeAi zXSeXU%a!$-2L<-+^{=zjo50;%S%zF(7&6g91pJH(jl30yUZHN+73>l!XN~7?=$Y56{}(Uel%o zJ~T{nyEhjKok=DZByQE?FV+88cM$nq!DoVE`#WM!M_pROBK2k4NI}@b-F;xA&8@F* z%`NpRrd1u(;@`qT%0Ax)vdMr95Cb9|VTpHl&C43mycP9D>x-6StGu%v z^o|<$Bbw)nL*i#B==zC2LSuB_IbV>!dxJ_N4o1ec%Z<7kp1)%$v<*5EA$cIvl2TE< zchD5?L|&1zkK6h8xOc^aq38)ZAEHX(g$-1cs*2Lx$dB2Zfce{EFfv0sz<5s3#8lvfe?kw8^|up5VU` zRGqJxzS8(;Y$xjD$O6{>hbwJHDxG0}ik$11er-(h(^b^#wsD%9z$SBQS8T21GLJU7 z4Xn->Kx<1HYcGDy@?_Mlh0@yEgqD#edTKgHa;=|gCGe>AUdd<0|!ycw9n4dh0jBBH_Z{pG$0SeH;x6*_{st+w@IPyDFIhdL`*LOHIG+P6 zQ`MCv=5xK`R@UaFciEZ3`&401;9Q;BI3!2oGCBe|>xuL3TO~ z4Go=F-nXytu5MCk>h5J=w6qcTq#?2(%9bechj@^LSbayw9U~`Wbb@_}e8TE`ETQM= z1(LnfIExJ0MqC_;``+OMNNk;I#aK5tF>e|cBJREmW}~muRL#B9tR5~^EtAa73RY>X z54&ps5?v((bvyX%Oz!3oq%196rOl&g!t>Dtm;2<%(TsO@6+k;FZEyIcY5qZ4bK%b^ z#$d_OQAcDH6zebd^mVn3uJ-nSTnbZP4~G47*Vk7(JUph~QN9UXu6B6QK}8DxW879> zS2=RaE4yT75(3I8KSml>wTM8SyJzxD3a$k}q3sIDqH&Mi-lFIKqPZw@`|yoB_SkV9 z^SPeBx~xQOc6fMLTfCb4u45{$y?v28Jc|6hN4?71Gh0sskLfRg*T$=srombu1l7u) zKR9V!mgXrY?<^F#47D~_@MlgG6z!}a7bDdACcAaCbhq)qaMe}W-+$ftr%EF2eyp;9 zXrTPFyqzJmOj?^4QXZ&HV*?in2xdp#xitu zT*>`UhBoA$+dXvH?LOWnl#&DJ0x|D}x-yj2jU1GM~Z zar$^y#j2wp8FMVFzwD|hp4?_mn0v2z;zb`dj%-LN+n)gz6&a8Nh6i!jtw4RjGVfaa z!SxHv$w&DJYF4kzTs+CXCdZ-MfynzGc7WW`gT84x`P3?6b_yQB8IMQ+!k~I3BqZeD zasL4}H!mI6p(~y?#yo)r4KpXFnW5dcS%G8V^F?j4bn*U6C_w{8N<@Hq&!sv03o5zR`2~L4n?&i1~Df8aAn#uY9T5I{P zq-bX79P|0ME|vC&lj_VDTA)?clw01-7y3J9!l$Pk8TvE6qRkal0+gt74~1(IbQL-@ zxn2e{+uH`0J6{^f-|_dC;#NH-A6cwYs&pLeU6MTJ;(mvECDyF0t)(`)NSiRg3#eI z#X>*s(MfDXPHbkT&t|*FfL%F#aHsD(-sm9N z8lDIJ>*x;?Nf9)%6UQ#)+P>b^)jwjimuTyNv3rz=nE8R!4{a|mC))dSAFevSZ`n## z+OOJlPKv%dnZO{O*Wt(U`@7@E?j!@2YJ_I7l6wu-5lI_4vGv3<7LIcQH$ zPuWtU@rrPKtJ$P!*~gejo#2)f|N13oezonyD>h!%KM^`{LV5B}sonlczB%X@`%&k zGG_aAzqt8TRENPre2V#`f(n%aPd9O28r)Qu89`MpyTc5jDW+WUZfLj67;J@y=a=V> zjM`cch1d}DJBwIxt4JHy{rKu?W}F?115yC)JqVOjFI8+)8YN>Uo4&=#K~K>%c!HiJ zwt)4Dlbv0dq(OgAie*VTEBx_tg`1DB4PUH@(4DYKr&DTFiSMRvG!*3b37UQjV@mOz9rNw45v zI~7$zM*4mDF4E174c+rfoENK58^Ah4?6SuAR;fVCD}Ac^7alI$=PKp(ub)FHtW^>7 z&o3`8Eyc#Ync6~=R*p>U?Ci3Dm43X}b*_DD?b36NObSy376wMX8O_YCC=^0BwroT6adIaoC;3E}#e=j~eYhpS0J6RwDoYo> zV=i`u>0b(SpW0iUE1qB7l z`G<7PSsK5r+x`(rRCwEvcaw5Zo{q&17I>!nl%DtB7~+b5K%2l96gy20&cMv6lx$+F zQ&b|EJsuNj%sUbZ0ii#gO_|+F=N%y-s|q`vAkg-fr@W2NzFm%gJS;MZlWkw;#K*V( zdka9Pvef~RBpw6zx<6Xg%M%M+pZo~$iJ3rM&e9%E-3rhD&SYg@DE={a1**N@4Ci3` zYw~ksY!(M-H`!u#BEdHZwCpI+7t|Ftu<@-T##|*VHm$p2m$5~#lbJsS+OwL;XoiF$ zimupU1+x2EhTBST-~_PEC{;DEc3b=;W_1gcF6R49gGKC!UU%%r`Xlk{DYE?B$kIvG zIc&BBQIG;AfYk7@eR7JU^W+*`QnPjy?OnLjpC$=E47>Nxm%g-~y*8$6`k(f;DJg+% zXyC?wtdtJ*4PfI)_a}mGksR45upFRiOFb_BLMw8X=olSffwJe zRtg1b2O*hv^B!N}RzZKHx65pMZ9hIf9@o0%9nwY@xq@8fgL3 z`}!4nV>!?NCFb%HkCMiR{W}}u!+eRdZa~n)H>bM09l59_5{U80MD6rKK<1I)2)Oxe=i|kQhAXjuBQ&dbsN{p0kRdw%JjLP1UW? z5mY;x!-WArE~9VdsLG)0XB4V3c1~I|m#N?jQFQPUjL<~KOO07UUm6F~m(AFT(9qB} zAS*+8x?d=6_P}cMt!81*1WVp?6~2+a1NK9+&a5SS=%P+gvrWXIZ@?5JlPn^8q%Tk` zO{$^)pg~xA)KIs0JzXdh1$`5Jz4W9@k5h+z`yZa_8-{Ye1ujahI!#R=f8E|chv%t+`PX&&EG9nW8{*rnza&-35oM%$E#9vi&IizL zPTZiblK+G~V-NE9hjUFeY>kOZhMdGMbN3qaoQvCPxtb#Ut~(JhI<<1<631nym-^EV z`pg0nc}O1Jh()P0#x&s96Wb_l!qFko=LX}Dt`n(X$Aku^YwN-3jd=kR=OCc2uC4Hz z^^eevZ$N0Lzq6Lt?RBiJY$O9MF5*X*cd4f%Bber{t&!ZO!&&l5c!N22ZYSaf`{7K4 zrQMIE3!~N%uXi_d)9}q^m$KX%MT3%Z-SJ;{eMLq?j*eyxiD+d;hfKi`(CIclH6U_$ zKiAbE?(XqV*A#*fzp~NsOA2sB5dy^*6`Y|9-;kyAcevM}`pfeJ8sx@(hSeXhrE!W} zBjU0ojPpcLmG4Z%<~ndqoWNThEhcY_$$k1(3&9Qq`E%b{A0CV8dvS+{Je^3_Qb=JyD>ZblM90{P8Q;cL`azO zkFFx3XYt#wi^(ZY1f&Hb+*54>0|Q~7TX&Lu|E7$g+u1S+r>H$F7Xe1J=a>7lK&4!D zSsfkxd8klj0(^eV4jnyT!Jz3mWgQKTWvJh_koRkA?6>8B>}m^!t^son+7aQ}3>QIx zVM+U<5IM`OALMM_}o7l&$HbCum1g_Q}rjo=L%A;z@)rB9YJ4%K^#FY|)V+ccZBmvny zJq;VD?}l{(Vxvz>&)1TUU>Rcn4&cH1zK5Bx zi>Jthv(PhAbffgg3A3imK9#WRNP|&^2@5?+g!3pd@}rIM6F^xZ@5X6lFphgW}1fQiHvs1V|elx0S$Z&A}b;!vPzTNQAf?hg32}e&|4CO#&*L#}O z=bRkymhNKYFX{*aj>r*yCT=C(%(eaQ<00wu` zUA9$Vb~%8=fZ4x)UsW2Q@LKornM6nW-2)mxjT|_eofI1~a3J0XKi(l}{QD-XYY^Mg z8)UV4F8K=<9!a6V0){9>+C%jX7~$NM#EvcO*6`q};KTYg=6Lr&ZVJKR2y;D7*1zMr zH?;Qy!e2y;mfJt*d9i{cKag_n;77jjCC^j(==&A=f>h}T=nD7#!I%5;+9+&k7WeiF zrIfBJ?5m0Q*-9@L*MH*pl&4IDvBQUExv@xw{MfG^WR5#&_nL!{d(b}>QNKRX1mm%(;-E6_^*9k3Yff&CWy zTdbQBWFhB|7YiUZ1n~2yRmd^>p?0XZs~mqf40Mgq4o-jK%k~0j-Z=^{*tq>cAIMIB zjHbX|d&sa5_Y}Iodh16%3H>u$j5E8|S-|r{P)EQu0+{%P(+?}(Qw!3!*=& z363xY1ZZJm{v$j_CGVhyl=&MUeoTxJ1``0QLT^hTj8qAu4*tDbrHe)nB`BnaM4Y%E zCE~_-kzWCf99%eerrzRfIHbW>MMY*X940Y;CzjveiEDvsjK$743^2G@5q;))tlul( z^#0$W<1GBb{2>g7e|yKk5YvKEzTz-3yyQ?M#nWs)ES?*fWR;O&uMu1~Ek`q6ymDvAxHmLM3ykW5OCsDS@OOXwQ_q(2ti_DnCpH6RHUFMf9Gd$k`hUR z8TDj{?HT}zUNDS#&Zb=BI^yyNYPcA=G7WvbT)ZjPWH;%4z)~6YiA}72%_f^w-|u2- z8XRJ-Z~-uIq_2rlY}Gg2vY8|e)Da*hQcRSWGz{WhM&2Vn76ZP5G`dC{ zM&UhH1?;<&a|-}||P=Ohj3^~gs;Kri1YCsB zSDC*TR8Odvg6 zyu2eh_9+^0b0gIF7&Iy*HlCn10Q8h`_x_O}!`2A4#G+x^II`-eMVdBapG zr91b9qXc&k?nIvyDgu08Lxw?PdU)>8m{!}lNP)M+Sc^$I(#=Mr?2b}ZOLijq^P8Kt zuh}PV8x1f5{#5e5l!oyp-t)bF9uk9-la&x}2Z})p2cV!4C&@-!)?k2% z_b0@vl%pW$7kS5V6IlEE?cm9nnI-h%y~wNYAf_7Mu@V(22|F@lL9>z?4k`~a4c2jp zvAXQy?k&wfIU~uij|MpLqXy5FBVhQD!hzxZE>IvToAfh@&TQbApK`YbOl2T2k*94% z(x76=;=#Y8Zhj#j6Qw4B9I}A!EQdE~geq17OR&j;#wQiV+Ffw9BkawYg=<|uf*4B2OTQ}>i^RFpdc=V~9 z@Qk|*&N}6H;z72JYjt*WVOTJ7SnM(~SOyLmc(6Qq3LC9&zaDP-rdIJz;{`!7F z{|OI7TDKaeUzS$n*hwgkh!97%BtbFQ4r@9hllg-&NI}EV7|TEaVxPTM=C=Cfh6esK z7gtmJ_MU85CvoY9pK`BFk5`4iwhd#s;h*+0d3l{aP;3(4`ajry8+^_@ee)MCmW%jY zSol~5;nkO@r|f}boS@x-2%jG!+<&U{yWbj2SP3v&Dq~+mY=Ni{@=p- z`e=Ne{oh5JrT;1dU%738G>BvD}ZoeEwZJmT+SlJ&%Q*l_V_{ zlS2}|BXWewCcwEB>2(DR2gcNMR#_?yBAp-gWosPNEkPVePJjjt!3>Q9b{p`16!<-w z4H-SC4+sYL7m*~m@Dl)&BAtOjIC6wMS+@MAQj8MjIO^_!9vt>XGtUt(!UCBO+RxjB z04v56Dn~_#9y->zdbEEME}%fXmmHM><*2rw*$whUauA_e!#ySw*51;)D9J*kpRM?v zWs0PGB%n_Te%zazkxm)GzX<#dZA;U~g9gI*2e6%TkQ6-W;5uC+%bB@XFV_mfXmUxt zQp?BhAJNtCF`=|TC9wSx{$7Ng{g(Hv-!FTwe~Nbsod36>g}i^0|C|jD$ms=QR}JA& zbVJ!{o5zDn(epYj3o9B&n86}*0Fnj?b$w>A5ET5++aGY7G{uQvb5dN1L)J0pQg^^_ zW6x-e+z?wxkwpws z-;WCa9*jqu_cbnS+IUf7+Hb%Akhd)&U83SCYWYpgj3@FL50X1cdLffdx(vF>ZMJs4~1soyL~p zYtijWf~j-bL3T2A#%ZeTq*e?c4I8rsnpHK^%2ub})4yYgKv>>@v*D?|Zcj~^_5 zfu;MSI2riS0Q!$DC1|y#KLZt2*?2nb!`pw(%t=R@1gh2Z&hA}StC_7leMH~oPopDc zQ*5?M2Qwkrd>%u*m=P9yO`?Qw{V})(1RmnMB3+3?ZkImU_1wXr*!ArKr(VAdIiyLf z^k6^_F}Zd;+Ik-H?@p3y)8Gc|9;VK0Cs*HWiP^9|*~6g|DZ|U@ zeJD+bwyq$*zX`K;l)7dNX}}BTppiIy&S?D!@CX?Y{tUpS%LAj(`U%|A^0K~n?oq*R8RDaiZ=gMC~GUT2mjw$12c=H7-GcqON&1?x5#!JzGUz|Rjbkx&FP_Q^dN zKF*&#f>MA0A-{;uAd5mF!^rs*l5`8dNbZ{u31Q^aVb!6=EX#WTPh&pZ^{SS(K)#3H=l?nnBlRDdgiC*MX%N4viCf z)r{i(dp9P2x}|TmH!5tUv+sNlh7(!Bod4%ewnc#DtwjF_7wCpEB{dr-K;Zul?Z;;3 zN$`gx&l)GH{KU$m^b$7L$N{67NwNW^Z+uvcpM0cTKRd4*>08Rn7fMyf1FN@2UWX^0!w8QTScaW9AZU&;siLn zz~~*H;>ezHT;EqwVOHWVCoZA{BPejh`v)gN7Xkl>aU%c-)Ehq?)Npn}+W70i=%xP! zxgSR0qz^Z-$~Fz2g2G~_X}<3@0DZwwNBWk4Ar5DQrPAVHn1_cO3pW7RY8Vg+nFk7$ z3~2l+@(CZ0=H)RsF#$1Y$x-}*Fc=&-`4ar=*pbmX#HTUi9n%^MJ9whQw;^f7X`n zUd&9{cSrL_#sBYJKhghG5{?mG`~?f}6aBBEsiHOY`=2UmDu49+=VDSLq0ae|-vkaLn{A@d@og*bsj+0V-QGpOijFm@%%O5H; zkkoojx1Acwg?9!y`bVXzfAR!Yj8D5TM8f|j3JZz{0|v@N&ZL*mWo zll<_YiK4V2R&U@5@>m${y71 z%mT_xN#m_lLr87<$AD1co6@U@T=TYFY4`pLEe1t7RD1SaC9%+6Ip)K3U$&orV`z>T zM?c7yr_X`;)08Sof0)qj4<%7jUvn?a#!>lz#^& zOVWQ`QYx0s^R>`ipD82}*vmWHj>Yc@yo5EJbt;f}Ggg8-F) zI$rile{~5)tn{Wa60t@$du@p24zB9A`mn;rD-CO;aF)gbCzW*Q7H&=Cq8kcWI&Rf= zeea9(GmbH23ouTJR+Eg&S|zi_lc})2G|EZ`dX~;zts^13FSU6#x`kPx743rOEXYxG zFW4(Z;N~#(&?z6GvF_|rpusYbD+AgViE?slh_J46Wp7G%dwNClyA#dbncgZ0nJQq?uig34=XRon=jBmW$IjxH)nY3< z=>IdwFpNgsT|q7S|Fb9M_`l=9v-|sBZ{}G?|Nlt}!mF2C*Z!@5-5K5AcC=CRSEt`L zf7AMH8@ti@Ye?Ejn%AxM+s&8d^)FEp<4}o6Q+KK*s!(soBq}qZ z(JU$yY&MOI2>6nNTegl07!-S>kaXo>f1NXj6?v+&kcx3{Zl3%C4*S*k`4z!z*^IZH=)m_iP534#8yfHy>>W4X-RZQ;7%S*(J2c*Re>mI< zUD#xtxhqnafz?oN%Z?d2emihB*P_2kuIA{saMYb8>p14VzvD+-yZC=7nb7U~e+EY< zmHpqrv-|U(H}kCJ|B-_5>gC?${`Or!M#k=r3n=evvlmDsy`di{Z)iuZpekv*xq?jn zt+;}Uuo_%J%N;mH5DgBTR(DdVe^brwq`T${dIbd>L0+yOnb$YvN_vZIY=6~>q`$R7 zdXb9h>s(eGIGJ2DIH1()*Ue(q#g*b>(PE}{_j_sYgWJNLbcmUG>_5OErYpE(Xp>em zIPGpYd$qUIry>2V}W||b_UHWFW zYQ!}5pv^tw45u~RGdp#KF0(hj5vSR*E^IRS?cNo7+s>9d_;m39C6tQ^L;R1pqYJRb z|2KH@>}mP@$CJnR`G0QYe_6->ccBI0?f?IA>;6AS#_o&@FvqFc1(=uF%nRtWwHq&B zJ%Kwp0v!+=9s{X?RO<=MjN7cdYYVqSm70Tn%X1H1OB+tm#1bD+H2nN+bT_Rf&V;Z!FvbJ>)OL(xl7(?ppeONiYye|TuA^sU5!-3AgZ z@7Y~)Zmg%@M<~P*%2G?48>A30*+31R%NDh&u%#RYHic;+-Od$S_;l>sZ_5_0##?bz z(jarOkHt1p30*KTSlczKG)p(G8q0f7)bLBXctg_E+EPwCj(BQGQCHx!)-u_5T*pR{ z>$m3LYF{F|c|6+Te>p3eCRF2{799k%+(`SrNWIBta}@2BdFtR&@2}b~c4vuM*w{u_ zz*}~UIbG~1G3zimsCguI2pi zljFxH<@nFXC-?b(ZshUSaR6URN!WY$)Ar*(wT#^v*RMjS+3Tx5Z|3mTE$qhETOnpA zH?OX}p@+8!e`L9Hw=vYS0OSfSc#x>FO%a;1czt-IN`P8wuvhkyRe}A&Q3rTwUb=S+ z9^bTx>?Uz-mCiRi+p;doez+(YHKFL?ae|{tyjl{^<(6!Ag%-zTW5b<;xZKviB|oRa z9PG@~wRD!)S_oIZ;A~;0T#E7<0Sp@6=3!em9p7(AVQgrv8JgckHP}SJeDzqxECfYMf#z#l$UfHsWmtFUuUiF%cy=<@B zs6_tJf00p<8(JG|x3xjm+A1nulV+zcyr`v3T^FjCUzFGY5@+7Gy{xx#-%ZVhCW6{U zNnuSU1{5aFVihdlEH31^%Fl*17}WU+(`ZoFx9eQoe7JgoEpz`*Tl>10>6<|&f&$hz z(Y!6bf*zl*cKWW6AajotjHIr2xmRR3$Qa#xe+9kn_L57~muotil-bLMmX7xJJ~j5G zS58sZIwT7hOu34Y^Yebt-0Yw!X`L15rJK*QqUr(!r+h%9$isBib5X#V2f7)o#|Bs#=m*W2iPmZ77@BiG$(+3w&$eBuA z=Bb%3mmLB|DUKsKizhI=f)m68uMgf$F$X+N63PSze2U^&g+zcE6yX$;$pK&}h62yc zvYEe!B=Y)zpotEm-P0}t6RZgS*M0!rkaz(oQ8gt>AVCbon4rK5UcLSOtz6{1e?B-< zQVQOmy#*0w+zTdH9IAgc`d%>l7duq{+85Kwq5Q}G$>-!S2Q-4=RhlTx1`@VVZJq{^~XNf`rjeC=_0RBLok1IYvKu!JLOQLWkdw%c5@l zU%r0v>ZjMiEZR~V%g6td!P94@fBZj#$B&Qi$N!ByeehD>3uQ;ck9fqS)^a9A!t-8$ zkN-sRtoZu3J$tj1Tqy!RRX0o>3Yy@MAI7@q??$Nlvdq46g-#ev6FH@5K?5!6;N6dZdv)n~!{JbB)?S1XL?T2&jEwd!*Va=5Pp$KFf5bSZ*T zbPA*ek0(FD#G4@jrS>dQ)(F>_OzL{zV4TLW4wX~)I@(&Zg;tF~@1H1+DfmEH9Q8C3 z{XRG+BD)C8^VB4*6_JF|e>sj22hh^oI`?G162v&Tp5kx{LP(?vq&&eY4t|bengD{X z4L{5kWJ($;{NJ~W1eierCx``}_p-pwLIY~X|M){XLNG~q4(-akQS8tn6QLxgi-z8S;MjASDsD*hp)2~vh(gvVo~ zly;879Me8{F&<-r1(tYzkx0o^97l*q0w4z5=L>j+c*wA_62Z#P7x4OXqHo(fCrK*W zD|lc0Kbqv9Xd1)f8_jbmhxe-tA_7#UKEhYDc+fbjn)D7^eP#~Sk8?0ObQ-nmz_HB0p`l{ zz>(Mwq=W=Ry_f-e1#}~p`KlP?s>iT|B}@`V6NZ%+H!D?IRfDb^?|>y2P@r)db5ulg zRV>~5yTcL_br_;Z$TG*5U}@`jBV<=B*$9Re6gyyffBEvo8DNOhl!d4ZvYoIDSyYGQ z%2=LVzFLEjo#oQ_FQmfcqH3|^K(G|aQ7h3^8mrQ+=J~ii2~Pg9EiBbU|C%w%I!*CA zpWV0hbk^2ZgW6%8+4&N)t!Fogx&r|zISbNc!eE5*;9$L9BIo9F0j_Zz14MYLLZE9S zyeD{$e~5MzUL*BJgH&dXwz>jvJ_f^lhenI|&@Ov==L4J8#FWu%00~eCD$7W{=h9A7 z!%$-kpfWasT%#&CP~Ky=ADkWb?A2f&6csQt8qa5N(ynmbl=ZUq(>6wK%II19aV1w> z4bSy|!;F;9x*}Hyp@bom+J#Vo!;-sCn|J}HhohKI4v&up|L5@N+2P=?hcLmuQ=9vk_yd3N z^w60L7DT|$nYS#IgI5o!AK?haH@U{#f8c81az0l5l*S;5v=7CZw;dDO767_JeXo{l z`KBqg=cviM$qd`1s;dIa__onRSmc~$-7?N?G%vLAPVY&`e}_48a)Fh^Bu+q27B-%8 z1cr7QktN>D5o0()!&dGUH$Y_hGlum1U>zy);{yDV!dTKflBT3WqiQp*)|f)ue@LV* zt2&j$Y3|ZliD!+%VpjU)!+gV)^BY_-J3h;&t__#QZ*XPp__%_vW2TCOI$Md$!`cK` zE$5A0fh%W3Yc$T%8K<5Z*m6pJn~v3yk=|^P{d7$;rFp+D)cuqCY}pRON(R`S(vPJK&{U55o_aDukCC4D=K?)EmaZ)erp-u8DUxrx-% zxRAD0{iNv>sPW}opNu|{5eXR-X%IY)wcAyJFLNNN%gwJN|q~=B8ju)86-kX z%cK0ovy(9D%z~U4AtpSJf2VRC(rJSz>d5cnijW=W$c~W!KBZ|K0gZw_nroXm$PA1z zLw}@*h`>&k2HKUqngbPjg@2ji zI0A^wF{5Or&q*+>0=1N~uJ>Y~Rv)_Pa+%219j)rJ;8(j*I+`KJf6)cQL;y_mbc(4C zIajfARzJ~4#X8GEixOjdXWptteEYJv`%~^l=}?eXS4BP-j2WF}{*ED_qfaOlh9OvR zorMyLX{T;n70#*Zzq%-5wcYpuEo3Kt#M}+2;$Vy!7fu%>#wtD&nzL4s=_+NWtg#K1 z;;dBi7!XQ)TiWeLe^tT0LW@DMb4snQ>zQo6_2wI>-cAj zH0OW-=K?UZwm`tAP%5xGs6$ZVLo=up>&=NAniU=w$cdcpgoC?a>rp|HjX)< z#2lnw&{Pv3f91$t;%}@byQ!tgw4?c`g@1K-^9(!l&$*pxD=e(?&$(^nc3J2o4!#jC zw(zf%Z!_B;=*B;l>+bJ7P5$q@pZ#30Chy=xY5;~<0FG!X%t>5R z0th%!lYADGI_w^#>h=5JZGu7!V}KO}c{oKg$enO#2`WGF%uLkOsRw{qBIsOH-FwNhQd6_^%7u z9P&OS6HGpPo`91!uo{kl6Bo=N7(5LIeuPFC5`S>yv!^GXm!xrgL1P@Y;;M)}UI3`U zUt|@toSVuy`tU`34Hx_&z~dYbNwbG4Kcjeff1tBxawJso^YPDATrk8D5f3#!CIBf% z2r>p29spP%odRn)rZ$69ya3!HO*9Zd$2t0@oxt-VG)f(+j&ugn3I#OE_N0xPmDD5_ z<0~Y;NFhd_1%m*SF=aCypsBM4aF-W4H>nii7ev{_kc7wp8=+ILpGlu9Sp7m;fTCFR ze7|?L&Bh+tP%^i(vxR|vg%&@-B*8>Y8wFVAeU>Cdf5SA3 z{S{j19k9BPRQVB;CL}cedcS5Vv30(V4Ankxk?jMJDUY&{P1pVdT4bb@v{W6Ih^2C- z`e05?sjPi~Bf_ytn54#{QY7897no%GV+VlK83F>&5SIY1AyI>JB5MmOp)b{iZJ74YRDoif84)@R_eX)`}H|a3{}=oZ~{!Yw_b=~lB`};v+zv< z|431mC?)5{pMN@A@J7G?0!B|CBNArG)xUoA3Z0IUIPY-~1SXXoBJtWwmXOO0)Xb6*HU$Zm0|QI>FN;lHf1$$idUtmmna5>8{ZNfP3t zqnk}bd^A`i5%G$dh+8k4*f=Gz;?4P3&PZd*Lb-BMo^27ByJ^*FPdR6)Q=JIusSL)5 z30`2E$+)B@V`)$$F2HPIe=>`zbc`idJ@54nO4NMb>nWLkSSq?=zQ=L{5A0C?U4kg( zfNaiV>1E>%eNHG7zyb68!QNFmLZOINWt$gPg)Hy{hA2DpkV^ybDfq-Gk?1||{TawP zFL31WYfnyakfW!Mf$v8sq!HTp>IgAdix2~s5QFUyVz2{34C)DCf0JeXVh<{tSUw5{ z!BKGJc^}^p@H3sG*$6Q(I5_~vN5@A8=IsBmO?wEgAqUDJkv7p76U?V5%8!gqu$ZPJ zmBLC2vdJ{o=K_k9`*iG!De_GQ!TkdurkH~n{6v|XUqD?afw=6pQD-t|RXBxYg1Al+ zrL%R(?|CjPGvbuFe;}xwA}C8}7T=#IZW<#fQYJw~kxuHQyLzJaDFsE2N}~X)sF18F z(*uA7NAXyiSdc|V%g9Lf`pu7l=RJD#L50j2#IF%U0Go_u$YdEV6XE|odgOUNxUiwj z<~7&ku-UzIf7O|zqIxm}du9SrWEd^Lh>EGMbga5}VrlOHf0CTl>D^TKi!hI?Fm=W) zKuNsV55UKNB8HZy#~1_Wele4&4+RI_S&u z!7q{uS|>7jyM`5<<|jb`tug%Luy0EH3OV0Mc?&kO!FNSr(y{A_wuPDb4KtbN}2wckub2 Q00030|2fY~T>u&e024qw8UO$Q diff --git a/tests/test-values.yml b/tests/test-values.yml index 33f2c2d..592419b 100644 --- a/tests/test-values.yml +++ b/tests/test-values.yml @@ -16,7 +16,7 @@ anchoreEnterpriseGlobal: redis: - imagePullSecrets: [name: private-registry-mil] + imagePullSecrets: [name: private-registry-mil anchore-feeds-db: -- GitLab From 1084816c04fb1e9e4ea0267a5d7584a3b3b18b53 Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Mon, 15 Mar 2021 19:17:33 -0400 Subject: [PATCH 04/11] updated redis --- chart/values.yaml | 6 ++++++ tests/test-values.yml | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/chart/values.yaml b/chart/values.yaml index 870d351..909e4e3 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -12,6 +12,12 @@ monitoring: enabled: false namespace: monitoring +# This key configures Redis-HA subchart and when enabled (redis-ha.enabled=true) +# the custom redis deployment is omitted +redis-ha: + enabled: false + # Check the redis-ha chart for more properties + # Enterprise license: Specify your multiline license # enterpriseLicenseYaml: | # License YAML diff --git a/tests/test-values.yml b/tests/test-values.yml index 592419b..0c91da6 100644 --- a/tests/test-values.yml +++ b/tests/test-values.yml @@ -16,7 +16,7 @@ anchoreEnterpriseGlobal: redis: - imagePullSecrets: [name: private-registry-mil + imagePullSecrets: private-registry-mil anchore-feeds-db: -- GitLab From b4c5bbd13032f32fc988ef1fe5c14ba76080b855 Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Tue, 16 Mar 2021 13:49:40 -0400 Subject: [PATCH 05/11] enable redis external chart --- chart/external/values.yaml | 2 +- chart/values.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/chart/external/values.yaml b/chart/external/values.yaml index 2409edb..2bbdac4 100644 --- a/chart/external/values.yaml +++ b/chart/external/values.yaml @@ -275,7 +275,7 @@ usePassword: true ## Defaults to a random 10-character alphanumeric string if not set and usePassword is true ## ref: https://github.com/bitnami/bitnami-docker-redis#setting-the-server-password-on-first-run ## -password: "" +password: "password" ## Use existing secret (ignores previous password) # existingSecret: ## Password key to be retrieved from Redis(TM) secret diff --git a/chart/values.yaml b/chart/values.yaml index 909e4e3..6fe35fc 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -15,7 +15,7 @@ monitoring: # This key configures Redis-HA subchart and when enabled (redis-ha.enabled=true) # the custom redis deployment is omitted redis-ha: - enabled: false + enabled: true # Check the redis-ha chart for more properties # Enterprise license: Specify your multiline license @@ -1058,11 +1058,11 @@ anchore-ui-redis: enabled: false # To use an external redis endpoint, uncomment to set 'enabled: false' - # enabled: false + enabled: false # If 'enabled: false', specify an external redis endpoint - # eg redis://:@hostname:6379 - externalEndpoint: Null +externalEndpoint: redis://password@anchore-anchore-ui-redis-master:6379 # Pod configuration for the helm post-install-hook enterprise engine upgrade Job anchoreEnterpriseEngineUpgradeJob: -- GitLab From e068de4f2e5cda346df3ce9f70b849243441edab Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Tue, 16 Mar 2021 14:20:10 -0400 Subject: [PATCH 06/11] test external redis --- chart/values.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/chart/values.yaml b/chart/values.yaml index 6fe35fc..2554de4 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -1041,17 +1041,17 @@ anchoreEnterpriseUi: anchore-ui-redis: # Use Ironbank image + pull secret image: - registry: registry1.dso.mil/ironbank - repository: opensource/redis/redis6 - tag: 6.0.4 + registry: + repository: + tag: pullSecrets: - private-registry # Use Ironbank start-up script master: - command: "docker-entrypoint.sh" + command: slave: - command: "docker-entrypoint.sh" - password: anchore-redis,123 + command: + password: cluster: enabled: false persistence: -- GitLab From 18f39570f21bad9f3607c50e70d8a8de8f6bd3e3 Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Tue, 16 Mar 2021 14:27:17 -0400 Subject: [PATCH 07/11] image pull secrets --- chart/external/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chart/external/values.yaml b/chart/external/values.yaml index 2bbdac4..9c3cd7f 100644 --- a/chart/external/values.yaml +++ b/chart/external/values.yaml @@ -27,7 +27,7 @@ monitoring: global: # imageRegistry: myRegistryName imagePullSecrets: - - private-registry + - private-registry-mil # storageClass: myStorageClass redis: {} -- GitLab From b7280484d0d57a01c62e878f0be45d25b8d2face Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Tue, 16 Mar 2021 14:44:34 -0400 Subject: [PATCH 08/11] test external redis --- tests/test-values.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test-values.yml b/tests/test-values.yml index 0c91da6..82f10cf 100644 --- a/tests/test-values.yml +++ b/tests/test-values.yml @@ -16,7 +16,7 @@ anchoreEnterpriseGlobal: redis: - imagePullSecrets: private-registry-mil + imagePullSecrets: private-registry anchore-feeds-db: -- GitLab From f472ef0ddbb573c8f24c04cd1961912a6d509859 Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Tue, 16 Mar 2021 14:58:20 -0400 Subject: [PATCH 09/11] test redis external --- tests/test-values.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/tests/test-values.yml b/tests/test-values.yml index 82f10cf..b6c85e9 100644 --- a/tests/test-values.yml +++ b/tests/test-values.yml @@ -14,11 +14,6 @@ anchoreAnalyzer: anchoreEnterpriseGlobal: imagePullSecretName: private-registry-mil - -redis: - imagePullSecrets: private-registry - - anchore-feeds-db: imagePullSecrets: private-registry-mil anchore-ui-redis: -- GitLab From 20a7ac4578f82036c4ff0ebea1e2c97419e92fbf Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Tue, 16 Mar 2021 17:02:48 -0400 Subject: [PATCH 10/11] redis external --- chart/charts/redis-12.8.3-bb.0.tgz | Bin 74876 -> 54159 bytes chart/values.yaml | 25 +++++++++++++------------ 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/chart/charts/redis-12.8.3-bb.0.tgz b/chart/charts/redis-12.8.3-bb.0.tgz index 00009f60a0a2bb40e127a315178668ef4d9ece04..9f943298b95687f4481e6f23ba6740ad10bf2c19 100644 GIT binary patch delta 52926 zcmV)FK)=8I$OMn41CU66-V?iPN|x;;t#)&EUE6Jan>c=KxBcyHx-LXQ5{@Z?B|tkm ziSI|cAL4$p`{0cPUq#8XleFS_PGgb4U;qpTGlRiQjD5m-M-vqD?hH+Xe|dywcXxO9 z#leC6cXxNU_;3GU_xZo{4|ews_WIBFcl-ac+uz%J@$z3__c4$NDLx6~DE^n-k<2L! z*FjN~{(RBh?e_ONlK}x$0UeW90Z0rxFhOjB*$xDRakc}Ks{us^y}jM{d;15I_W@{s zz3$iDeRnwQ?sh))BK(Ap&Hn@H-8@DcbNK)6{{DW6|35!i^Z%!KR?WLD27S=&cYHF& zj1PcK(BAVGgRlETeBkZkp}&j1?tk-q?_h6#xOcGk;%of%-ivQu?(O%7UwgYRzxk$* z@r&Kz-v02L=ewg(-yiPo?xVfV7>782MjZPCaQ1fh`tI(YyLWK4`(p6?U~sV8-Tmg9 z=g+@>x%cA#cK*t%y8WZpzhwICu>`>8_5ZT}qQ6^Q|IhdL*6aT%o(=exjK4+UxYL z$j7me>nMCB@Qd*u35lg(2eOEN9tRhkubfV2N<+ajNjR<;IPq+3!1ns5{|*p%n zD2X>=s{UA^q9nhK4LC~T7>69tEh2%y-IS<7cA(x|;4xu5o=L%1zBx~Sg5VN+G3KH} z9R)=U$wt1$0H!nZ_Zgasi7nPQ;~T}~7IEyxy0|+ffdnX|do;#J0b)$RyR?3%#40F4 z^iYeZa3S7qUA@`XebT#^C=%mQw&e+FQ%RO`yDJFgJ)yAlL=PpDfo#t7%>32w`iyoJ zw)U<{Vj2!ncvFz`0UFSMqR4ilkcN3cOtu`fiL_B#8eO>!KqPU^gJ) zjlx7JWm@6eRc&8J*dwDEplq(rX+XT0`h2XGEfa+H>@c`PGxiL~DC>b(N6!MpG2_p6 z00&GcTU-`D9i35r9%F_>{;bf`L9cg{3~?M{j-^QNQ;+o$hGTbsoDd)PWCN_X5yjYz zk{}@A*j4XLSE3Zv0VvE=8*il|iGpAT%ycdU6vt==bW|eAt{w;V3#JLqu2?Egx;CLE|iGwZ4i;RM(S-Rv}vbWn}No>eJ-)c~U zLSq8v{Du@9^EwafC`g2wENF)dU0js))Vmz><#8hT3JcIJKB7s;2e2mr{KU*gB*=|~ zIDoV-;%!9zE?lLYS8q+SfYQ*FqA%c@ElleE0=6Onpkda3gxcfo2%pG}h?!k8Z5+uB z(^McK<0$m7?3XE1xgBq8z=hhDAVQ1@-5yZFC!&rgcSN9JzA3^P4n`H^nCi=%M#N)1 zQ^QbJ!tl9nBOTdFesw7;a?w_f!IqnBX0fipK=WFSN6K$)j;o;%s^4e4wi=`o0_Jhs zrTJ~z&f<)JSNGCpzI(2ZhXjRgf7gw74PH&Wc;(!9mHasEq0N)+22FcQ@aE;Y^W*d9 zwBIEjZMbwM5&ei~>bn+=6xX@LT!=a9hgb?B5p4Ttg1wt7GQ~9E19;v6_#>flG8Nno zz^8ZN;fUk-4G99mut!6m4PZ}bEFFLmB7xw=Y5o3x*Xo0i^@0Egm$T4g1L${*6utLi z|K&Fwv*QP71{x^bO>hWafKez|eMo)G;PhPYw7-atLh%wT8wgjdRhG^;R3K}>*2T%? z$(0bSx5Z?kAW#z~AS!5*ITI#d`w|IGrWl5JM5P5cl#;MkO{S8+DxMqS_gn%p{6u0P z`*CT1#^$;1-J$OjMS>QC$mujNqH&(TS~xbcR|O_TLjIbfXrQW|NKOwlPWK)rG#oE$ z=k%D##xe3Hg5d?kL%QA5QKn4E&uJw&RNP5$00FthA!f?H z9%JMa`74U)uyU{$Ub@+P)0CSw-PMHAVinC=haMyuH|d ziX`ERmXO9VMEmU|k^l-$5#H}<5H^lso#y2E?9GiE& z4FS^?7>P|dFHM+PH$+u4U6saN14TkPTq4Lpx8>_mKo?F*d z#Z~>33lOa2%O6vkH0Zi2<| z0)jKU9Iy#Z0$;2)t+}MA7tG6AB*vgCPN|OrNk>r>%(`0kR=S<6vLlxuL{v!aVvLle z9LLz>3Yy}jYJpfXpY8~MD4uPoQt%{Ohi1|#0t+=jL8GBYLI@o@R#6FA0E>9e96yTb zRB|ZA%oUWaBC6nH#!09|ae>5kH#3BxAfR_<6Vu|3UTNY>xj9MWnO4ZU@P7#nQjD7# z2C)OApOpzH_e~Dx7S(ENh6@SDF=p)S@(tqNU28s5P7wK!+i1W;ZY_DwjE?4h0`FD;w}=Q<8rEtN#CRq6$Gi6jVP?m9aCS_@o25&1r*Nn}|Nz?EW7$nu zTMnw=fW?Ai4|kI=ipebr@K~RjsSX$xo3Vh1`hs0cJOtZ+=lDHWmQVFgzpAqAj+h(* zDPs54ys;Vcc#xWg<+?1{Y(>vgMzH}ug<@Y9>`ra5vMLO*;1W`75p$&v&O$7RCB|Jw zr|7-lA=ZAWPNgIUnljUUwp2|MuHJK<{_gJXuA|J`MlG!xmIo@jW>DoT{GQ7rtn~Bc z{2`B%@R0p~#Bi(!-I&vB?9T#x*>aqpe^Ya7Ncp5RS=*h0Ei*M+^mkovf@0*!@-h zVUpUI5?Hp#IHWOVLPoqLG-2uRYkkXj#6OfF~PUkSKC@P(y9%0 zvXTd7p!|qu>WJly+DNn|6)_k|+Z+iQ$H*6(1rBdXOhdVBZc$7GnXtlie@B9h5ej5+ z%n0Ms(NIlgq~1s%G)SfxwlaL*NK%kTN@+PS-77M??i7V+jC})M0Q*@16VrYaATrGz zmN2k?z;%lht}SSIL_+NE!1>QdsU_JMkkgj6y-}ksg_$9SAx*+eR?`D5(GY{1V|_92 zl=N>gKO1oM`Z6!yi}xvC(FQ_MNUP_S=R>mWFM0zLI*UFnQqrATPT6{u2FH+cvE7T; zN2*jdG7{WbPFj#uD?Jr77g5`ohhwgGFuAFJ*gp;N8hA(9H%Vn$$q-e((?6>V|A=SB z3P0jmMV-T@HjWOcbuJd5DBQ?2%}KV`Ufwe{wGC zWZ?D8770A>1JY3pa8R@u89O$L$B9^U_6By8)5+7*5>q80AY{AlIv9BMeXl;*I149{TN39ok`9ngcIox zgaU$?fxWD?0{Om+L&2Sy%cvYM*ivQw$dX{@$yi;lk!u6GEiyc)r^k< zG+vZSWSuGsk=pWifp*hZrUA!wr|7+ZvV6MQI(SP1#7Tf%&I89T8RIB$hse7L=-6fC zpBVbPdk52@lheml3uz~h1a2TsJW}NZQa*K8C~PReLd2kdBiHBy zu0hvyQ8#ZeG#*pmz5eO)hvRSUUx%+>cZ!6g*^fm(g4~r&Om3Z)qSfw{C8d6PE65+; z^)%@#>ZU`XfU%xxBBk$$`Z=XIqW)pQSXYDkquc%qx|419ud@0VZT_HfXSO_{Letr3m>`5(S6PND$2X-mxVCrV$Q zsXfe+KG+1s*oP>l(ioJPMo1_`JL*dug*0W`o?uJ6cW&#W#Z>)J3ry@7Bm}eQGq5|_ zKPIzAou3}R>K7YP#t5+~^dginoIyoQo^_=N3tCYhF^Z(M>7R5uBoZ!v+mT=`Mz~{{ zHHI@l`lJfPuBnb9MI%yP2xvGKBEkg8fso(wr)FJy9Hoz^G{})r)ybF;%c_pW#8xd? zo9KvzI-pn@Op<9Ln6c(OaPctBQB1b0ht5qWMNo?TbgsUfnGZ{x_v%HxKJEQ;o%R+< zK(8A$tdazjZ;&>?>K_4rxzWTEPnZ{I2d@1+H=f|&W$xv3^-h(3E7p-*6=YNxl5So> zf?j?uyA}R*a^X}RRx9%j_o7Sc-Dq_t^EB6os~a`Lt^8>#2YjRY0K5U%el;-DMipgk zfaF>!(nhB5q;^CnT`f{zokf&{+_An7k(T`RZ`ZSbsd@1NqAcWpW|b*U_|Ey=M;!nD z&Vi3Gj&THUe{`1f38)bZ&Zv)p;Q)J_#)^+{8en}+W^DC<7$ak8!B|kb$>|_H1xE51 zp?~x?q!yxEUoB)YC0w}?S{-tSm?L+D5l>=^Y(aHi$bbuWo=mUNZO5Q z$sIwzJ9#g59hT!U8j^Jatxh)8d*d3UML=oxIwrBT?f(?{(wf1A20fnb7!Ir_`hv=9 z0=g89friI8z#LomLA!IUuRP&2CMb|GF}PTF_LkclB1Swn{lqZuZ6u;avAder3}?1= z>)oJ#iqlpxV+jyn>V6LLJxgaC#awP#x_CM+i_Ev!Jp@;muXs!YX}Ym+?rlV-9dooF z+t{R746G@Z-26&AX{2;q=yU)J{}Vn-7jI_uFMO~dHM+yCece{&>y|%|x>W8F znINvuh6ZLY>Ka)XfzTL{-2Bq>tB&3pW30@7^wKvhJ=~IJDNLl2Z=9rn#ydh$Pj`YH zwS|*#f@30tG0FrZ_X25ZBw>ldq^pQP+c@sXF0|Jvik)9Xqu3}N=GtPzTHRQy8*6o= zrMh8xsc09im}lohwoUB|IiFph$*YN6&5?Z8mfGQRXWLaL$FCPTDSp^7>ZS21T+$$a zX8D(2MlnXd5D0`kNJ72>V`U~KMpXUBMKo3eVAj==gjaebWl7{`ffUH)lL z6Zdzk4(^Rv$MPpS_Zkwz|~~iTA!_~&sNrFE9vUv&rtviQ_s?TG#e9Mj z1}E=j{IwW*@CNgkc4BaM6mW2&0(Bfq5*G$ zy&Lxi&twGKAMtEwI(sV?>yKF446Q0z^QEz9Bi4NN5~#E7cO(8x>f&AggA< zpmU)REt}y8LX3TV_dLwZNLip}O>-j@1ViNAq`@pQ=3#`KBn&WP=32gnxuH&GZc!kV zwRFAOSC#K3h(BYg?O;X|eb*n3XpG-p!mk#mIt>{|K_LH)6BU@^x2@%W5{Fcb=mrn` z>=@B**l31|WLDW^#XGm3;qYTJ#PB4Dn1#Y}qNb7C(kS6+%>f90;bt#7nKmQ$dbPc= zG{%ZNNs%j^r9lYAg0f`tx_jpJi=a0Q=+JcUn0k`gXwTq?bf^ACtguPXPGmzr%d=I& z0Lv}jS7~mnup8+B=;|bY9H(2i#b4TYm4su=vRD6obYg|V$ z9+CIgoBd}-tWuWFY|&gK0oM2awZ7L$wdmX2;K)rsH#|GQ=uZBBOoFG?gaV=>$qR+9 zd!d6o(-^ukbxehIr`1GnDASwSRVC6SyJFa}m!arfE#uEl;R|Y(#q2XZ-tyDP7>*1{ zV%Z%SmS-LR5F(Qv5?yEqBGrH7qevdwPsOOuXcEhPCX>6~pc@PhI|cJg7i z9q7XSy{pAw=N?|Yf?W&bh{glhn_6#z^2z{)Z*eToGI1Om^|z${3-`+EoO?`0s{9IRX>u*KmKRsfkFKzej)J8o|JUc!-?riJP@eNX`|Rd?g2Xl^`z>?wJ?>oFtyN98 zN(-np=m0Se&tXc!gd2mh73`{BV{3nGP;gr;`XZXW=P&7B_!CR5`LA=HXeQtdW*kr& zQ_V!uK0V(t5TtSJjxY=XMzmfeL_2wo_^ix{=Qy4c zV+}rhuo z#w@45>#S{AZ6o^UtxB+1km>&3*Ofu06|cz?UO9+d>RmWca_EHKg@)ARLDz@|K8}@u z6dE~ywlYFoHw_2ZNl)8Cs)St?Kd(fIUDgajh6zpIffS8->OpC8R)K>OPMsa)fmLw% z;;~dxy~&-*exd-|T~l$ds4te|R34Hg499;Pi}kakw|V0)IDp@Y4{q}NK>qtZd;~Ay z;Q9_Y;EwiwSKt*wQrps)DzA}IqJo3U)2<1B8F77%C$<>odCJ6X&hi8n#AmQ2269&b z6Qe03nPOiD6ovnxiS#nQLur6cWpP_ztX~;)L($KniJ>ZxQH?~>@grAR^N&|5f^02G z*7;dN<$ z7|dMRHh_91-RWk^VGNE<7@^~D?c?+v*^GUtkAfH@e`YwZm_H^q7)J$qyi~C&#d=L+ zK8p9oXE?&~h{jVB(^6^BVw&U`xG&h}kAk6D;V!q7(G!@^amiF^o9LDjAMQ{biZU{u zo&tGlHh|LBka`qL8%g!<&}MJ2cZR=zcn+?H>@H$M|A8`oIb(LN#mCqoHa6fqTiQBa zbTQ6gd*@;$U`nUrG_e+)P4E?Gm5e*f}47m z-K}#5@ImhAjureheQ8x6QW{_sIy>nH!UOrGA%<{PTI`07<*0VAzGPu_E1FcX_bOUU z@vH)$zOyU~qS8YH5oe7}i0|Wn(83tNk!#Y?d}JqkA0aNCGwspUU+;4Rp_TBeaj<4C zKMp3F;-!`$n#ZGJ(&c;219LAMCcX}S9yKk!sZ$|W`dj896lSNQJfPT{5RN^b#Mnve z-dm%a<%g`po`f8aaqLuMd8u85Rf4Q`U96b>CJM+=fw8ohA-781cZz?1<>^C>%tGXm zMq1SQzu1Gw#FCEd2D^Ys9-DJZy0${Q#|sU94RTOV$1snUo7#ganzjd`RJfX~+q(-p zIe_;CI%4FX#leRLj@d8?nIo(KxzKpTIP@hYIxHZ5VQnci<@+~83_-u{D|+up$+qVE zPazSD+WDT8;nyrdn6nIj!Cs2`yxN+Xs#OWOl?fG7VtI=;%}mA8fV!EH*+jG#Q0iIH zOc+J~)YYP50j|Sm0ZyhigGCsbV$%!qv1NAY8vcC$twFw_%f?Lavtw6{+QuHH!B7)>*;aFB3%ZG}wkQ??+jG-%SE^Y5ms+XxeK{ zn%#6VVr?uOkq`xTRxxLuK&=ncTa0kk_L7lA=9HvCf{!^O0ehS&%CtX~#H*rxb5z|p zExI}aMttmgD9%rgfWfMu*Ah&%hL&>$USw~4tnI8}{N8FuHxo(7U_EaqONTOFPsJcW z-c33&dVedoxY#a#vl97Nq12MIx8Y$O@&EfzW*hx0Jj(uSyo6Zq?CsUbWtYF_D{Nzq z{r6>mcfV}^-Cx^(pW^xID>zrqtV4OpS0?(rn~(r&e*hG7APk0B-shFUmaq?BebwoF z_~6Q*A|};S_h)sAp!DEwE=ZhXd*e88e{X7sl&2N#oNTgxgeZVQAGYjLx%8>#fO#9X zs=wzFe{Kt~9e1@)2YxxcI6FQ2UO6Fsn;u+>0dpz_<5hkvLcLt zlrk=3Rs=J>kNR?c?0jy@q02Z*1v7boPZO@fl;tz=NtoE1ppdX>S7H8LMb?`gxRVzy zX*dpMz>@KQ7&D#XOW?=u2v_NCoYVo$0qp_kn80mL7Y~w&Jmc>7FtLmy7g#K4A# zAD=pZlH!8#GS}&&Q#vu3ijA*{&S{4IE*yfW8K@9{2ih|P^sVlIhFHU#Ai*kdm~skD zTUS)SDYTus(kD8lraFmC?Ix)Mi6jP4Va}uwm>*a5{c&gA%x}%?Sxl{V_V4dImRpOu z)veqou@AQdspQEYK9nIC29hQSg!_A=&Zui-GB@4XrOLZ2lRb)QBB8pMpphMjUd(X{ z?uzz*^%ak98gof}V7Fe^LN1r)THrIHv5bkM0#2naDy-A_PJij$#e`$)(+VX_NG^Dq7XZxQ#7VgHs1yi7XUKQm7|R%%ub!RZTO2-Y3tW$EJqvHg0^WW2U=77*KT|FFl{HtI@$YrvNHhLS2+P=i`_b#u zG6$~^w6ig4lC{nKNEs^7oy?zfaHH1Jck`ShD9ms=zxjIk-ANEyzyzZg9Hz)N!F2`K zD=;%r8fE1*qe+{S!C5Or@|BNGLB{@ah9}iBlvrtK%i=DJ4V0D+zmNe~qJL8U|AM+# zG}rt^Cbq0&ta?A`sEcElB=j(UoY`gN)h7jVN3ouW%B0zRqHagFP_pbDsAJ+ys*plC z?Lk$}rq-=dFodEaloF--(S$SNYb&=ldkNtx;Wfe;8+Ww|#t~0g7x{iH^kex>|G0OyODLSby|^lWAhAsIEW%z_ zK$Y#8Y#H}X8dkIQ%2Fui7UiZMEV27+rdSs@|Ic?3W@MS8oBR>LeA+pCdv!8^Q!elN zadd+L!3f`(d*;>2Q`D_zv1p93tec*+{vv%%qypFG&1!KxNcH9eVW&jhPx)z1ih|i^{_{#IfpyF8HaB zu-DH6o}&N9^#lhIj#-yS!K&J5_W#&Fc=_^q!T;mnZN7**6(OQ$>xF z>^{>q&=kMD#c?cur1Foz<0SOp#lHNLOfQqsh`a~K&43Ax<|;;&$4)t|L_xwJ){*KY z!dvn#{cvU#lDf!t9rChF)?gHqkdMImH|GAEV19Nd)Zahjm=PM*pqM)KnPCuH*$n40E!=*68XWa_GD+_nT~^kk`qxfTyt+1MzBawIcTcgMHWKc--`M!Fi&E29EzeS zrcq2Jbw$K~P_0lRw8pQl?N`if!6J}W&do8y(_0)L(P<=T(fRwUe)quL-GTq?cVD`@ zV&$L+4M{*a!K^FDSVQT4Pk3<+$w2}KzvnoVUfjLg{t$E2ZyMATQ4)^3H($%!{kQ$* zA)7Z$GN6(iq*8Q(ih(LcJLnn^^McL@ ziyjhSq;r7rTqC1&`wY-OXC@G?pc)ffDb(5HvgxvRtZ_hxDA1PUq9Uk1s=+j&T})9^ zJY)C0e`5p5@tbNFCs$6KYc-z|adRViqM8qX)h2bjg$F@jei5a|Gfk^0J&kI+pz;+K zT3My4bC+15#(J%-*V^Z_*0O~KTgH%V?ia~#wF;6h)q2(C$}hC&iZ$o1xqOB7l3Opi z&wa@iuCuE9sjhu}wRtg?BR;lWmNhjOTA=kX<}TH`s_R9&UbLUbqLs-nb*2U!D?4d_ zt=WqQ>NHqVQsrfPOdyhsuO?snj z`l6&5kvfBEQ~z%8tW_U>#It$b{858iuB$)d*`xOM=&%5F*Yqm45XpI%zX&%V=#8K*~U}VY%CKmbtzQw+B|FUm?o3t1U zbI6}#c!j&3g}zq5wg4?Ka8n5DGwc4}D z+>4p0a`kEj@U-cniWFK|e=UVRuch$MLkd@_^RZkeAc+&wA<;}%I*>IUwphXAoli>4 z_6_?7QL_Z}Nc7x5%ho`OlErs}j^?mq+@`uAqfL{>DjzI4SVz*SP-bS5bxhXl4(#n2ELLVGAe)rD*_sx%Ng7%)j7&zNf0@pEN25^ye z2z<=3OmeqnIX{<-xOt!I41xRm?KGH6NTr63xQwRAvH(Ic_ULqqLtpK2Di@8q2U;9j zB=&n8U!}eV9Nv=xGmtUGtAxV&{IlVI+5Zb;}4;Cn?^ohjzXM;r}0pzX8DbwSgeek)@^3~EC} zbUB&2m!XJTzzR;Ww zRJ{*&tiXo0P#99KqS2|c){B9x+SIsRy8#0hVQ(OF&Z|sHic%z?0qAHi8O^E4v$Azp zMl2a9}u^OHPJ!2jh{TFw4{R%E65Tiq_O z=Ki0W`#1C6M`ipgW&4^jYmQzNF;cc$ad2+6DT`$eA|E~gbm1fXkx-5+dd|H_H7D}~ z8m=yPlYe&mhiNLN3CE_sm4|MSY5?{YRkKZ1Mld}Wv|`;_fdbFTHXil?~$ zdo&!8@f1a_%16gmpaC}T{|C=smhykSSnvN&^w`_?t=XlIBoVwpQN;$`B0R7noHm++= zbbsI@jAI;u^S_%P1k8H}wjKEGxBmb>!J)OE-Jv+F0FWK%X{(<+Jv=>Emw^bAX%oP} zw&2C;ShKHRjflZM9MP(FCWygw2B+sGXd2S4{Ha4-7OS@jvp>Pe4=`g(=aNwfsi2eX z+kHTDieTXvM7TNzK0dpYXSBYr&rTzA=YPyx$`U0cE$LOpy>o;$YPhRPi@13Pd&%G7Ymm_6x%0xH^3ndjPG)AOjTYU3b;8ftFBW0EC#z}a{ zequP5r)pdCiwQ}WZ>y-ZvXO-0SPXck0C*F67lM1C6Rg?3UZry|c`vYR8n#C>EPn^+|Df%oUq!l)QiSyN5VzeyFH+|9jPNX1OqIFuAcTBJ<|(^6KPbS)8hBSEE)a zITu4`vzkI2c=gKUfGpFNH=*F10-AzNM+WA-p5H*8SK@%-)@a5!3W$f6#eXwby+solrWuBWUF*Ef*E7u0iMo1yd3|zr`0eYH zW2dm|m~H!7Yzo&p`1>m-3l;of!4SaK5|aU=bG*7PtA>ddor?@?2w7l%baHW}C|Jh_ zwm<%O@;~V}9VIwd_fUULQ$UU}*D9Wid_Q)FGZ~?|5;axs67zKT$&tn9Hh+RE>tiY{ znC8!}PR~wWU!R_R_x9D+=GJCqzqhw@wKQk>;qB$sD>EfINWbp>c3)NF{O!fn_1RBv zzCF39so4MRzGEnV15T$?>=VRsFayMeG{6ga6T}W3W0l}jbD%Dqj)3s=vYp(TRagL3 zPo4QHXfh-yCVYZpm>_9eQh!a;Se?+zY!8l{ha`+K@+LwKRvB-{=(P%E!yu9y={F!V@XKYf=`n(I@&NSQ! zh7jNBuB!%hiropi#VU`fJT}1o7r;;~%33p(rx?XmGM2)Y+Q3c9YJbv(p` zj!-&+fZi2Ab1GFsA%C*TF9pUTnv(oMas}*XIWh2i!i&0LUe0S4cBI{*Eb6oobkeGG zfp;wAKFrH>35OToU%uLMTzUNHfU~PpScv!kEMT2(`}(#^~JP>^nU?ETcZSK&1oMsr!ss_K_@fGoU#pa0XVkGRG5^7pcsx+y*!lF0l()l z`Yu4@oKH#NPH0U@jf}jvnHh@f*M~JB)!xoAK6#J5qp5Ep(@^Fkgywv4k!DOTS6xRY zY%R5u6%qt0div{s|E2|kB1K9FO3qRKDK%A6#FU9SOMlS#SZ3ye1-ZGfj5=l7O=TNF zKi3R%%g786P!9#*#&CmYubj;f{lS09OTOV)ys-?rs-Sd!6y^2?uCY%lso@fZgp+?_ zAYqhnmVQZV$Ul0$ckg=d-o1NgK`xf~TkqYwzcqY+_g}qt@BYgwAo+oID}4oySoiR^ zznOaP^nbT^j)kvSm&n7{B)k@bRkiZcNtH`5ong5O!TH~fuimk*Hb00#g6>z6_sPFC zn)eQjkYO436%&DcKQ|H5LbdtqUHHt|{BH;T{`W<3vRax@#;=JDU)jGl`wn~rDnvvU z0Gpsbd<1lN1J6FFxa^yI_s=Xi>m!Qw5k;#bihs}0kX@rbG_0T^o|U>pR^L`C@^BVv zRW~+YM6>U0r0TE~zNPl{Z%kguapo$*sqAEiQZkzr;G7njgS;hSDwJ1=k0q$oyr{yM zam0ytdfYhH(;4wK!dsfd3MTRP^6KpH&55(UD!dIHw>youN*S)-o2(9GbPJ&RnSmn`a(c z$@m##hPm|R))ZwMGoN-aYH>=13l?Bp4S&NElYNW>G`qwe4Kvlrr=jYPBB#rgiewE) zB3Z(Du!3AZHgO76Kku}}smbN(6m{r_5%}kI>hclxDfkU`j*6Y1~4=PC1H2Wlr&>wH-K>B!Bcr zLgQqbSy+(oU+cpJ%K~R)y}kqg`l`C&5+#+)kXA2mLV6dPL%F%64V(SC-0g);x5kEF zr+#k;s-?FW#yG?=5_Bptv-BsmFGxI0IiAw6Bo zz1oP%r;!7TYWfxWC&PchE|iUH>Oa`xNTyb}zqhr?v%@#7tcaowH>XdYp1;ZzccbqL zaNSC+SK5TZ7=`=pfg6Ied6O17l7F$egDrZasv zU9+eq?d+=_p?|rEW_n)U;YWGzm}~o$8xeet*UTyc)7IQGgU{%69v*n#>QQc6wZ?1h zbNt2n9Dljq#1+^-zW45m-FD%D&aMw~+x<`(x4ez3Y;Doyd}ZsAY1Z^A3N<>**0(dq zS+-Pa)!wotyo$jbtSwnbVEuA-qx(`jgx;dO~rf;&#wya-cX^@vJ`n+n+P;o3{V0B-Rl; z({TT#`hVTxnOTkrSlXmSLp0@+xTPVkP6?ZXyLR)L(}fbWrk+$|;u9vM!Xw2+8C2&Z ztu3qOQqYQP7_rX!364{hAyC$_cf7hWZC0h^S68O7keM`Qm=!x{wud<*EsM`ZJ+DrX2R+5X{5HqA%6*d*zL;y$rn<8Yp}$t87lZp&G+VL z>Cv*=eS!;gbskO4URwE%`}8h!(TL;Nosu9ROuO^98HiE=0qjt~dSinsHfc^iT;p%M zR9gnhl?GC5MQAKRfCHD!LT}0b7#NolL<7CfU%&>fd26@~ao#e1l(@@9`Ona*D@bxh zB7fk#{4e{@i}_!kzt~;J|9z6DQvRzC&)=TeeO_WVo-URB-6x#S98I=$hBjjl_JdB zTZJyeQ9Q={T$VI-TVb1Tws29R)NTz}EJ4Jg;$e7csFIQl_J>8lRG^{f1RHEfwO6*P+f#Le|z@5166^ivx4bS zXnG4t9@|MuH+PuUguW*9FM-hEZ-1-!`1t8$b+-FAXvhEw8aU37Pol7EjxJ^1k5+n>&k zf3Hu^U-cDIJwbr!dx3cRB~C)(r=Ko}z8GLWup7$-C8-kZTnB70XB6lD+mx{L0zf@<}Xx5S`6ka|d3)zGfWp zguPP7y3S@+saIokaRilq{Ftk~`CoIZr}#D0mz~|TK2$5jkJ;an>b+2R%gk({f8Ks- zyX5+Lnx|<0pJE;pkGWAyr9TIXJ-=ZMB?4*CUnf_wkIrrMCfy7wOHVMa;3tjqZprDw@ARe7g zY1rjaaBB|oLm$TuY=KWa4vx+%ut1xRr>>Scu(@ry8NGN=r_}3q zzYbpXlTAQ?0o#+#KpFv=lj%Sr3c8<<@{Ik4H00mr0jSKm=~i6t2}eI8dJ-iQoZIW?pJ>9Pf`Al{NV~Cf2e2f z{m=f3g8aY#^5x!I{(p+6uwnqe zz7f=0jMJ2ahqs6XVzg8v_M4mt)2@0c`p-NB(EFc4R6rs3ZaxwfARg(^q`kVeHX1$N zQ{w;W#u_I9Ud>i8kN+RM+%MXH_WNu9k0*IPl!KNQMX%!fj6^O3iPUTlb9_I}b3j(> z`%yrDa3SB1=DJ_H??*w7Z#Gj|g$3?1_u`!4LcUMLZi0eL&#;e-8X}yijkaw=f;nj| zW*pNbDja9jj^?Jdrw9=GL@Nql%iy>Tn--d1!xIH!`9x2N|Fcy_{!`D~^Zyq`{(rE$ zzdrwelBX=CjZ?=LJT?khaM4nB0;8 zkMRlfP@rN*!3e3GCL{K};B~4ef_)9(*_(v%izGZ`&(vEKj&UlByFvpg*iQ42#x+RW zE;B{%+gF)T#!t_WG91MVeM*#nd477Fy@*UV{p?+gk^eRfW*3z5??`~zjBz}*zsvA{ zy#8@aqazfdAqfa4**V4G>(`=`37!6sQA$&KUe*R?Zy2z)wHba*!sLApQHkVXI1_lv zm|}Q}Lym&)txfK8?$a#|63a*JnP(!2JTq??_F~M_pLiPa*)fUJ7io+|{ZE9S$_VSj4qcm2D)k5tj}oQUxmM5bqrj4(FN9NO_l3iZH*?! zyZOyF`T*AYBR0dCr};gxKXy#TCYn-~_MJOhJjkIbIWV5@DS3-0D4gOga7?>@h<&u> zac-g0RmW~Rb~N>i2Zi-Bo)s>r%{51V%b1+n;ZrKz4xtittKrAq4NImvBAy&rbAe$? zC!y|M>6z(%ix@sfd;(5&1U+Y48b8zcWEge=ejnxxWYs{*vv_Z{(aJCe5eRFhXLDOe!+k9ekGQq?X+qP}ziEU48+nm_8 zZ9AEG^S&vG`c?I)_mv*2sF8OzL~jv+;n4wtG1F0W^-MVu zcmPf_w|^vsf99sugqG=t#GXVl zLb~HGR%gvAVu&^Ch!uI;;82k5Wp6W7rE>R?-HD^wk z3={tISon4UAAlZ*Y&@qLI<1;&HA@Z-lmi0WBlUfFTZ;r@RjgFK@^Sc24TmgY-}B$6 z!hxY0=m&mO&2kCsZ zN(gzmgO4?KPbpr*eG9f)lX)^>i4`-meIB>TPW?x-FnN>R&&jft8EawQB99%JyFt-B zH6t9&0QNKB922L0l3YtGjNveU>5yuRZo|JyWU6&23`<9{oS+u|g4Tlu z?L7Hg>VFy*EYaLDNS4uxN*h5HsMD1th%y9S7O&;b-QGrAoebCD_hKg}G9F;_;Avx7 z3NKN!74tO;^kGQ76=u+%`P&b`8izbNp{D}%yP7gSuO3r3&kJIlmg2h(xI)M z_am62nMR^NRXh2!(33m z1oKdJ=lue$g%W#0sfSt&FQXkwIhb?F|50Tj!G?%i2&B0<*_fkn_KiHhO{yQ$Va}R{ zQ)#xR52VSM?@SW|gAJp}22jZa(e@!pu&gjh_n!Zl&=icrB@3WB2@?C!W(jmH9F3>L zI6K|i;;lNTmW>FcG0T?J*vQM!Ma(>6F9*%@v9gAaaz?(6QIp2Ikh?KQN>W7(vELoZ@duSQm+d;t4zN~ z6?>Fvl48rKnMyFo7;9H2bd`+LF-JL2yXZ*6uF`W2ePK@sb%FOE+BjF~JD4v8mA^gT zQ-vUm#2p4^MumlP*-Gue*(ubi_j7F(g&*JjTig^VZ_9&iQZUJ#9kA+Qusxex)Xwmp zd`lR8HZs^6h4KBs+(6~6sI&PMxP9lJH>s2;V>~WQV5x6|EieKz=Rx}b+o2lg!26Z$ zBig)|PoS5Bi({U3=-ke$IOo{w6H)(x=Hl9J z0t3e%F)213rUkzGlg6;z2hq!=BMWBRS;NEd-XQKX?Cr z4c{gKnJJNXplckh@0-QDxoG!8hDQ;t_iT#$9z+9`P?n*M?`LBf(aml_!Y)R;MT!3rJow!@Rx+ z-oj9TLJyaTl>d3;kgG;C`)uTlipp#!rru9wYlfkK`J;}YO-T442}ujHQv2+|$1W!5 z@B(WZ95~m;G9*y61}>@YpkUzHmmTsrB%s;E13`Gfl%T6Eu(5z8Vgd}pVp53F`@G;|*;wHrFY zSS%oD0ngfPFhuooAz^>gYg$iP?)PGFnx|}h1OF0ZS|8?&r{+?{DW}%-k*b0xL#MkG z(wWK39%MTtc~)~f)-r2EpeL|02niDT=;fKVVhG?i%m&W>;9slwzWU;|*~l1G>0{J#_yjcTPcI?tfWI6; zyBmF@9uoD^h$w$_A@#N?y^Nch6-9dq+m|9Dj~Qm;xH}}EK75R?F~iH~_A|nR01$iu zDsl?a#$j}VU$y=r+cVa}Jt;Y+Rf&;fW;s?NkVprR1lx_rzc_k!k_9eyvZQUN3W@CU zTP##B@=f0It0qEN%L3nPJ~lsXSw8oBuOeOEV@up=lg7&J-z((6o~WWv6~^P&j~~k` znW?JOoC+e3AIfX^`D4T`O_#`W)I>)q<~O$TAO}qw;(a)+H283bNzShJ)kaXIjU2xjl3{Kb)nJ|K<>NbB{o%7g)stc*J z5@?Ga9v*4*Y0%Yh2Z{&-Nd@EMj=70v{bI~g2g#y`deAzb z$P*gi%BJ`f)%#os+L_K34bQop1MulFg0Cib4;M#+qcoj;p5`;`qbnn>p_;1Wgt4ek+83#xymN!iyo7^Q2>T0t39WXzu zk}IWQEamfk2Vr>CrrTTr6BQ6_M5QH&bI{w-@*X~FZVk*H!(gyZF*q63j>_^uJauN? zojr6=M4tJLr5c43y^^{ywIK0BIHn*ipwf;SN>44(O#dD>ZR_GL{5>WyT6b-IGNyen z^lv6>h$sEOwPUrx$te5^3w@ytAx8qCu~YbPlR&JAUH?2Be1R%kpv^Cg zm%Ui}PfIbFoQmj=yMv3fhl_(pGi&SVyw;Ikz4ny+C#ZkgMma-hIl{ZBGIwpRM2nm` z*Ry6Oh0}S>g-u)RZI((t5n6N^K6I9PW9g@=FlaO8OB4HZ=EKYs#H;NZn-l%gxQooG zoTkcwUSU5A@b>x<@D`c*V?_{BfHx04@m0!ih-oTmkQw@XGpyzU{EoJX?XKSwsj3NS zrGHC=N|Pdw0pd*ePP=ERXcg*OfD|1G`Nd>sZY_I0j-DePrdX>bD_(JduD^BKpOi6U z45J|nojFjQ2!}_FY zm2q!IczoqwKgN5!8Jgnnft<mt}To6ZfoC^Wy|MZn}1K z^<5VnHPZncO`Q8uCR3@J5n9JS8pl2_b9aB~>)(lgc8Mh(HnH>%7aTxZlpKEyItF-C z4+}AccvP!&S&CJWNGMN}I9z2C+3Yg4Gws@Okgtwz&{3$=3`A+=t@##zYd4J!9&9r=* zle0%d|LPvrS*_WT0Nh@=&AR*$fOdG04+;U0WTv%iKz4DIn$KXftJBJj9aXF?e6 zGe&s=2(gMbg*B2VFvM#abHl_lnDBdQrXAf=tkUb@F3q}K?pVR!U+MGz*42yTBlSvS zcMRUjV@cpJE+qBy`RN@`t=MHDKYB<2!o`ospuyn6i7h2ffcX2_lR=w(+c};zKJjvV zU&IMBRJ-nw>pi@m-EVguEMN1HT^!%)i(}ZAua=11rS%>ku}Y@PS)+fCAPfH}yoHSJ z$ zR?za%y-S7i)oJ(yckXD1ke@vNj)!N$@^!rR9o*yo@%3B1BuWxrReX>;XZ!4~kvjo8 zo|DN|IWMr({oC~Z1UUKwDsyL)~fQ`-gaB9T4p#`8g`Bl2f{#> zEV@)zyHqoNR64nQ6zzri{@oQ`ZfjrqFC9_oC+tm?J6RMvVe}rWWk(?>a6Is}y1fZhi27=7>5loj1;`DKZujp2F^s^g`h8c(v^bQM zOrje1HBBl8qr6`fCt`VHZLJ-3QSyJ{(4(Cd_|nbv4465A6xcK%LS`*vylm%#1QW$H zec*SeVp9ju6|E{0fE|FUq||VM1M9Iym&nv@mSr+kP9C(;?XGmd=Twq&5Z0w=&UIi$ z6OwP6yG=ojXl+-T!L#(hWSn)0AkO7kWXShKt1o$oFm(p+TSeR0Tx0fFj?Q{!q2^lK zh0gZh6}mj;XKdRPtBpMVG*e_`jCWq3(9^}yE={N2DUSmUM~iXii0PrHfXQD-5x3t6 zhl}f)!|oFIi1!MTExr)vXSKNV31%#jCaBTs;@|hhKWbJ72RkTX#>L%5-M^JQCaV;O zon)0y`CF{&ZDVYC@nBd*m-1^MELkqVNKt!UR@ns&JfGmUL67T$Wuz zlrNR~1hEpOK4@lk)ip9N4f^bYJOo;g$~=vwkv%pteIw-*vMett|701j#830EiMbg7*Dlz`0E~WslRC znFNd@jC@xAeZ2uq>_~=;`nXa~27x2PN*LQ9gk`sZ%jP3H9M2u!T{dLRwukzLNl6O{ zu!P`99hfY`aR?|&;4}|uG;-zF;h_*X27rYnaOESg3JH1!NpU7ir^Ph-J`?e)Ulxoo_g`1>UY&9nO ztDP%@tmZ#nqc0|!3t{0c1R>x$&-!5?7%g8|N%DGATzc_FU=5iu(5G4UBgn4Jy$kHQ z-aa2LzIrUUVpxoL?(Y05ylTMD%)LSUW9AtM+2PpL{RfJEajYny z&sjbY1yxrl(B^LfXX;@eYDQvY}#F>5Set`Vm5>cwrFV0sZ$Afr? z3ECGdxvwkF54LP>2wkH2_yepG+L3H!jKqHN?Z0U?(AHAEaMLnkys>m=M>GrF4yPX}!F2Gqhu^ zVp5yzD!OR8xOmU?ZiP9kXOZw`6Dd8MZjXrTT43La$bpF{sth`lqz3_buD{0_&rpf7 zpWr6MuK$31-Td6@cGGSGd+zwSvK!^}v;`CT%+ykZZskZyoM7^SZwdoZH&A1;?&f-f&mZ_ETYC zDd#pu4BfS8uQ+0@Zda%OY+n94pO#d7 z-US?xmnYzNg16ECK~5F^%9)Ak1R(`UB%!VYGXAOQD9QNs!x#s0cW!jKiC(ymcB8qq zn-ze7kR*ySkx$|;waby$0Xl_<>-*0~{3%+UjzVUmkPBXz<7cfBNtf}j@HQqSxVYMW z&{W|?0U-|ZZ0pea9&KG)U0+hEgq9359xes;7RK|c6wH`tVvue_3ABIGae1c>xa7^j zKr>-+2-;n7DY(4hO8XYd&&pXig68;Lb@p{BYXc=&fZ-75Ub^32 z_90m?!dJhI3PYS!`Sf!1S82>%&>+I0e}HrQkWK?B;K5rhAOsP1wRcRuHTnBRlE4Di zADx7Ku_{Yj*lD{vylh99W$K^OY?>NL<5R=zX6F$-5+{Gt$2&5!YnMi>FFFYWLx#`w zg91cmu^TzeAU~tLrJbE*XkSkBCZtCH8h0YjOEfr-<+I-iFgRIl9EFq=z`)YYFXaD~r16A(XDv=8dAhfz zC@rpIt`AxX?q1~YnV>){E9;C21n`0dZez-TNhH`M=8j~-eWcE@2K#z|HhB(4R!w@H zZ6xK@%&bZT1k|oy>b#)F=XwfQ(dwR)iBcHdYjE#h!%6UKU6z#$CqHAVIOt-k_ZCEO*gz_;b z*)bZxLOxLCN~qK6G%$V81$9OD`>Ocx=fXn(FH#KraS~q_!4i-_tNQzGLT1~MTA=fS zo))cLIaBRP+R1!86R?QQkYoKwV)e$Ez5+pU{XV^+l)vO@JHj6glioq5mOReEU`1j;;h`bU;*?oC-&c5o zo_&XAys-}9$59dOtU4Oz$uJ$nXZq;e`Sy9hE*H}I)=+nQ3L^e(khe_;t}Ie{4CzcH z-ku~i_fDc3yCiYZid zv4OPG)l?vUP>sczABxRFp>?fJ1LJdKmFgll^I}uS>-ia=0CU(s&D?T z*saQ|oN~lxGY=ut;c*aUqBYdtHO)^PNK~1ludMHw$O2>LrOs5u#qrM!ayQ2$9M)QWw8cys=|wuSKqNFqrgPHl;OQsxuRkH+;i0plvplccy6%tfe=jEB!ZM~F^hIe`mC zn@9lX^l?h@lautM#Bu8Z0x6LBU8}beUIRNO@jl*P8FeFOpS`5GCe55uwMp{R`zZ06 zL9wT1nBv~`fL=ip)99#UGI0O`<1k6N3A63k@b>ElMK}E|ta*3yVm5=sA%*zPxf|k5 zsX+eSi%ySGN1R{O07HHb{TFN&D-gvI_nNMV^Qk>BH>R&LgtqnR!W+EI+aTq*JXqZe zD-A775@|hjz^o5SmLx3e?1i%{k{zHb8l@@TsCc>+mxyLWV}i5@N&RSgwt@o~Wgz|s zc1c`5>YCd?LDY~Y?t^K&p1=d(ec&j+HFTS9CRGq8-5N1UVU311QY1l12HvwYB9C}7 z4vsH35c-nIf*}p{#KGN~hJPFv>rRwE)b-Xcxi>?>PWp9@3pFcWwd&J=hV~^1<627X z>RrIbMrRTHmI7!2n*nY~B!Y;9rSqB#v#>l3Ab@++PB4rx8(fw>=)QfmI1x+smfl7h z0Ou{9x!(XQ>;zV)x}qoqki7DG2Fq2L@gRJn>wY!K5NuotsP@M*uj<{b7lz`v zJ5xxWfOE*(^(`ViqP3eMrtGpIPcAxOASv%?5x)@Cz zlgcn%HuYsIYu-6Rn}aJx`VXz7thr~Y&&sS5CISr)==bXT1kkMZic}>ft)G1{)Zd7U zv^Ku0x9rA)ga;=Ewi|U_eQzy0vhu`sd0J7YNOTVnp3NLI9>Xt+bP^kidOr$+O4#@uf zaL?#<$%`4(`3^Gw?~*^zW-GrT7!{GLSVx#|>Q=Z{=Atz5!PWoALAl#!_!pQh7X zbvm|$I=q+xvmVyq$d8VS{a(M`Vfcu^a1?L*c_FP*_EabDG8bQc|4e3TY@Zc9=H z5~B0j@O7x+6x&&qjY>R+{2?hNL1S#9-x+H>2!OQ?4Thm`9`IpT5>VMNrh*DR^Eq1V ze8})r)%0*Z>Gbe4IDg!Im(0?HO@|)nfD>?7SqwvX;Pa#_I|mj(R<9-m{V|TDB=@h6 z%zjp{@p&A|c;a)TUyx*%0)+6#TFaw#`TEgkqyPZdJ3fXp)Av3H05DIHl_Twyd|T-e(#49xm~?7q z=|dm6@0>Ri#!m|h8ctxx=||Jl&SO5pr}I?@inipggFwYpyuYY+Th-VFKU)8$Vh8xb z2rV%t;SKRlV#AJ3UNOhla#U0a>``&rAxDt`7+2pT{f1IV96am6R5#-06Pb`1nn7TJ zaD#LrR_YsZ*!+gO2%yiDa^9s$##iy!{0XSZ*3H-h^Xp@s3R#Ps&Z_0A663a(FR+6^ z!CGpWBXu>H#3Mr;932EmTpVaCNTlAHH}d;>40NafbS=L}NJD4UTb;WQVHK=*i6W9E z6UC7F7kT0QRO5KM6!lkZVKUj3@z@ETte4Aos;vrbc0qtiDTyLkinv9BDN8Ra6(DUg zjd&(0*vVNTNoK6at(O53J7O`DEJO&Xl^{Cy==VC6qt%C?7v1Z3#uMC={U| z$#)qvhI>Jdezv``CbuQ0*>fe?g%)CsE`d84?@A^mP*uyJ?-#t(9t%HHdn4GS?TShaZ3Rmc#BXvTVVEzV1TITf<&PYh90m<=HCS*fRA|??AEKL;oRQ#kLis8< zD{6SqszD+flCf%$=%rm9TA3>%UTOhBoieFb99E=x8C$sQ%~Dirre0d+B-=jBndytF zS1~F=;Oj4P7X(CFAtD(wJ)(8~qSP0x?Dpd&{kq?06fkua%obiGs0RfBKQ?vxjCtbJ zX?~6iwe3H=9}}5MSd48rdc8FN7@rD=g9)U=Vj-PE|D{RvEm~}uNr<>Za5DZPLf_0D zs1H;`aGChf(I#CFf1wc)iogIx)cZb}g(+=#94`_dj6WU~|2`77|GKIk9q5#Zu|g+Lt6nY=-P!&XzZtr07Wu%IfkB8Pqg_Dh8%ssv*Z`^*P?(*nDYfq>43OHyE+)G-|$e%EU^c`?1UgD#ek zp@Ht}Q{0M)>?=O&#Z&Cks6ZVG8vOlSOXvXO{o;1qu7tbHF#}=rWy)jR$a(!v10}$< zW_m+@TrXH8QZnGjLB2MOv4OLAeRG1XM!OXq^#77 z(py9H?P)-${iK^9V}H5&6V|=uSqRUWz}_Ma3JPa{h6DP({R!4WJGR&BKkEZW5OFWfugHrKI-v9d(gtj%JiO`EzVx827$!_T6j=KVC7dI+3-+&r_ z+8;Y25;jWHfrx;VHjS!XvnKd7Yjg05zya1D6-&)`S^ERcq;(UM<-t|nEzC0wYux`S zcR8f`mzDWPWAd_~;h&7fWeYkn@ya7p6(_f(_BM3Ky5tTcjvp0wn+nJwS$d=`{^;v> zvmfwVgcWTXK5cHpM;K1uk856lSL&0KXRg;VO?8%ZCI6`+ing-ZreSlYRKU(bhuNZ` zy-BGieDO=y`CiMpDS=VXOeU2Ukdo^B!fn;QAYf=Aky_JGEQN_SF4gXx#i3(q|9`RY zNa|_}$CowcMIBV>Fj*~3=(c?jBddh-gONpnk#LZ1ATd?Kh90DeH4O<8-wnb4@y<$? zE{{{!9WgfHu1gf6T<0hJ=2nVP*%A_H`43o%(s7n+f`V`To{hL%5mlqptSc(VTn`yN zQlZoTO_yA)-eM_wxz_Sz4N3JKn!7lxi9&=Wc|YNyd` z%Ba5#VI+!Lpw!tHq5TMvJz4T#-ymE9t}Q?nlg7ik$_BR{jXIj=BGRkokSBL~rCD2o z&<A9~fGg;4AJ>)wV~21xNth)zZ^=f3%&-(u7PClU^BbZ zQ55$i>7`L{B#Bl#CjwA5zeaZa}T1*{RRGuFm90G|`?2@JB?=Fue*oCh+s0bTW{n;x|Y{5>!j@Nc2K| z@VL?Go6k~4`TWKClxs|EC}i_)Fl0~#sD=0fBH=5;7^6c~yzA{esz6vjO}1AF@<|3r z0h`EmEE*Z`>kCmH4P~eGnXt?*6w%*Gi%A&9U)Gi6x!(USxM74@4FP%a(`LJwe)rG< zeq!8zZTO(8Y#i1r0J`egE`pEkN;wTO4U9>ovy``e%YR(*5W+dbvDZv=RycI6qh%}O z-1At@g)}x+P8-UKi-G@rnxY06>??3l@h-v5H>qv#R!r7^ zH<+hK4>mLw$87GHG2QGw0Vdn2A=>_Pc;*T&vB%3MXK#kisG( zu~3@Z?gztY^Y@lrXk2SJ`FQUXsV}#=XjX@!(L1{J4oKKztW|$Pn|D}c1Ws4}wLTEF z?mw`1(t}m!&lCK;;@SupIympx8iK1q9yK?*RRpB~vm6fb(7tb$2a?s=S3el)t2&I5 zXYRf|!_jeEy&^ZzWa&G3RsZt14$5sn0kCw5^e#5*FeBO|&0m&%+$zyD|0cHHCD&Pc zl@xRV$ql=(^Rr)dev;Xq1)IN9rKFnI4rv=B@~(R%L-AEaTXHCq)a8l#_8Cj*-5GH0Xnrp1uLf%S7A%=!govy)+juR}Bf+;GKTU7Db@)S`of$tkSliXpzD>Yl8W|UdvoB*YCDBumGwO zw4DaOcQ-stDkOq`6rnrq7LjU0Uh1?&Q^7{lQuK2DanM7X&ruJ+`(#JVU!Nk7Y6k8| z7z*aQEM4Loa_cOz9Mk|Te zgmpuWz$M>iceh5>CHjGIo=BX{nGR|wNX{go{=i*N*n-n~$qH(JNOc?x4Pr;#tN+pD zCArOUZ8#n`sz>f4POr)y;Kj$~e)~#aMoq4jZM>1Nj^^iu^ zN0csVekAkSkSL3C9T6vxa4i0AMe#r2P^y-kGz?Qh_&cV^=s^Nw8k?xTE5(@+vImR{ zo5+w1`H4<12%CNEgdS>1=WDz>L2-TgS2WM9L#c>#3VxXojd=cf##~pXg<|CMg=tS< zs)wrJr{_k$CItZfNM8&fj-1z=Q>wK_4d1r_OD6Q8fdUyyA9K`<-?B zY2gJL&{Px@u&IJ~IB~44T#zn-}q5l`SIC%ZGL=3$`Ks!GY zERm*TN)BaCVw_r{ka9XhLHg|D&$-{J+RQ2a$YZJr$RFKb zAJoXF*$}7f_!4uwmqh|zO6^5jonyHR?>6*h*`L}#Q_g( zLkjtueI*kzcNSZ&3Ym;MJM5tgg9U}EkRq;DU>`;p?*v->J3{}0dNokRVbn_kRRhpt z%W?ci#x`skS5Z{7$~?spmOM6Om*AY8g{&})wC!A=6hW^XfKK7dOvKjXs~qRby-g0n z+$T(|5LGF15JW^GB2H#b6hTje>|Hz+zvMA#j&it7h=wYiuTS94&RW#xzvgi#;=vA3 z)4-_;@8Dc(O*$%$aR!iV$+80j z)GTK_lu4ud6cag}-A8N3>~^GiRB8Mt;+!KI@{f8=1aVG8BI0)UQ^+bZUO2>~wTHWv zcFNA{`o8<}*g#i{_B-)bWj-`N)Q_@z|AVXofm2s*Gt`CkmSTy{pop>y07LIpIuy-l zK0D0ivrG}91e3-2I9&KeqJR*x^#>SEeUr)T` zRJcvSp(c(;F%1Idg*-k4Mi8b3fSoKipyhy1{Q_*g5SWkP8psUT0TYq&w)4?xh!mnP z5XtVzFnr_MWgDfz6gmZmH!DpwWrxTWPZ8;Pbq;187!#OtLi~9-jd%#2nnfFUz_hF6 zzjgOt^-%r}XbAx?i5s*gQARN}GCMOTRAJT>GRlO~<-NQVhWTg@2dT{uClO8EUngj9 zL@;PTmeov3Cs^`|8qxIvH-&2GdcGYE`HS+k%=dsWOMQ7J^|f2vNT9i z8K|CQH%8sR9>AxgLpoN2vcRsN3(x3g>}~>dFR|hjTOif@O;fA8390USh+(q+w}j56 zC}?JR|3cZNX4s^jCW7+12UW}oltoZ?`@LC#vRq*Z{?iw&k7$H+f`tOpjFt(-JqsjM z0;to64)V_wj{6?3$t1=Jbt8V*w4Jtn((Ar~W3WO^AL^5$c9~bm#=D`4IKEsYBO*|2 z;kp7?%KtbG-+V8eJRyu6C35EGhX@x(ek^O$H;_#pMu5ouM(6m@6nR>ddVPnwRQU)5 zd(ULYh|m1YSKIsM$`Ky3|mRNY<3SFP-e<3m1Tt_4n>sGq8JZB@dUbmx;w4 zZ-$f|BeI{|D*Y^Z|6ygcIGt*p{grvWe$U8Ql96+~?7pVZ8#as%zwSo>Po@Fq$(nx> z5O44I=^N(_FI7U{aPab;g%7*|=dCMtIWRih_u=vaUK2kf(-Vmj|0X;wJ}x;8zd^%0 zf0Hnjp{apWBnRE^@4nefKEOy;?UM>n_%#I`oO!S@p%JYh{cSiC8eO*da>BS%KxS(G zwiw702@~^iq$| zcDBV)7#PLvLOWMx9}OZf%j2!3($xx=IBk^C{H!7C>;Aelp)hHYv*Nx~1_@Uy(7h7C z?x_fj&S(oJaPUh|8m0lckZ!oE_V!OJ*i`V;42ucg12Lv7TVg_cF{NT+vh(M5kT*xO z_wqBD!_vUJ2r-l)1A($)(?O6VALomzW|tA;Bq8(OgJ`^)ps^SWfK0|foFj`bgm#CS zr?YVuDt1X3gt1y~>Oa9=1|%=6=@Ng*Rru7x5(9I7rdr1k_&>^`A)Qk+>Ef*2l4F;- zGPcQ2QDn(hh5dj|)QDr|%Fz5Ml-s3v%DWP)6`d;mfk@W#Wd+RE9s{5FH8dgBONr`# zFSBEEXAK?SiR9=KyTkT6yRX2m>|qE{i;_^r*hdRb1Ka1Gq)bT6VBVEvoIe)1>DR^` zR7@DmB}J$Xh?DWNg*dfPP#q9-0^gI5M{3duO{1I4jfKd0e9RSoaKJ~|X@aSfX+0|H zn*dc0BbdX7Q~=6JFY3jVd^+qq&)fwIqa3G;(7W(uGcSW2d3>FmoQV63be8e9tI?Bg zqZ-{@?q)xjHe^HA@&kGRot~CsVF(mPq1rW~k*~I2|M=kr2;od*lH!bsm9VMkLYhUa z)3};2c$YLuQC>W*K&N-0)Yxgz zwSBiwx-D?aouq2FSC^ir*%~QFks*nK#b%NN63uGtoNh<|p$Mb2=b264lau%In~|5i zaazES6b1_81}6QZW?yjyqqyl(4v1JhXY$|+lr6bVn9tOs2QK{7{m1rnJ3?VL_G;3z zIrdAnskL-esC#-E_!Cm>mV114i|8fWGd026FIb_F*PzwV8~N3dkmq+^f;v_|jo`!_ z8htDo4O0n0BX@*|AtU{2!<{Yu%K5Bz{d+W*UPMg?O z{5mnO&%?#_cJC(WYbbwG(iikrl4i(7=SSJx?-@GEZG79d_H0;T?**=7vxb$hdp5eF zVr|3A^3K-wY*2kSIoBh~&#>?DKty9bM&wb_vd6c)9$-qs+-UAv-i|yrVdQ~QIu8FD zDgrcbMJgZsphx;Cs%uh8#lDbgLpUQLTbhUrfF9i7~tkB&{e3)N6|>Pt5rs+;dxi^tUR!|$ z=@&FLunmndE^`U=WHAM36SoH*38JzSA6qIpT%Zn_B4aZa+^Hi3PB~mi|AQUk1Sg+td62}P%eVOko>K)6#(x}dEZ3OQ7dh^2g1#)w67lMID2yW;cycLX`+iiW zk6IP40MvfELLUf!2EL;HqkfSBmRv9{$XKA1pJHtB?6)--(<5{QZ~HR&u0g)# zY6twKG8M%5XRUlTSLw|81D+ZfU=05LWVsX~pTwU%?@ZfqHksdOdjy#aHUYow{n?fH z#b&pa43S7l!|gx%WCz$bN6e*EhkibbD{2~aNp&+Ynk>nFKaJkZBlmI!BH(3Y$HKZ*->wLxn1=M#D3mmBZxC^(z`Y3Bxwwq~ zL7yCeX-lyYBFTrhi@b)|tUK;odc5)?-~yk^WWed~GMfaEkUphexUoPVp3BTx8xCKA zRH&>Sk^R(e7+!$2bpHn%I2ZKO5)4V!16c`!%PIROIVWs>V1JBb8hQT+5qE4uoE!Pb z;TdBsrPrccPTUve*E7ZonEb!MK5~^d(ui~1NtaSlv1+Zd2)$bKm|H8B5yo8j!TN?gjW2L#4EV7I^7$VZsBZOyR&&byN^~L z6xx#*Tu)h6^Int)7^ba!JNe)}^&xajGn}6%z@+TkPtxZ$F+EJ%R^=DGxMpE)5hXwE zvNfAmKVf;1XJLe2^ffC<%j{J*(^5qjP!yq#iKSLDQW^-LW!A3+on>q6X6PGw)t;1j ztcG2E3o=uj$#z6CtG*XTdBL3K5EA2+8dbj2$ov--5*D8T#NRAPCBf{2o6=R^J$4@v=R0zBEJe5j z5=6eTyJ$WXvQ!fqb%KA$;ld?Z4k;p%1G|FfQ1rKC&$$`i);Q z7Ap@zn$jBSvZ4ntLL@apD%dY1TdzImESEnE+(!s*^rrwkQM7kx*@^K84G(kY-aY&}B1s@F4+bibNr|YA6KBbU4RfFN zgw6O>egR??ygZ>mD{MkMz$8$AW~jm|@4t$rS0-wS25`z1nxS$Pz*K=`aq8qB?_R!o zd2)a8^1BMC%`YV-y@ua;iC@V5-n59EPeP3Q%2)LO` zP9p6xuHDP@K~;QL#I==|0s}i`NswyGzv5Kn%>kp9q=6tJPbE!I)$qjPtahLWX0te* zAF9bBZx6Sh^3q<|LD@w1_XHbm=OvoJ(&FH@*BNwqt( zDnu(^K)VrRk!dX9V`XaJhbRwZq9pkl@pM|@DaC;`Qpq$~7_{bMQF^?@yb%mACQ&Z(2)f!al}f;00+o*Jj{ysX|*1qprE9c+Isr zsESp>R2WVn6^6B{m?g776#7tFOD$heg;KWvbp_-qkV}$XMGAEF8R$TQl0`h5Ocjqr z)6(^X@+XU@KU^H--s&}hJg~w;b-jO>MM=EZm0?C^Q^`J>(3Q9@XF%5^)`%enb}^lT2lx5`YvueTSOQPp()p1a)Ap?--I%5YZ%%2ylNkE`6(` zU(?E@UcPz%?!V68p1pa0XpXi{SJKfmOUHToIs)VSqWmmu5=6m?$D#)61&9;!O7<~T zO?fma1gI9~mE255K^Mjo70<8DGq4z31dGyS4lZCIO6Z=!r|5@}PEa=`1wIpOKtttb zWeA~$6}XEkq&!u(`%udQL6m>8Bu5;t&jip`SJUtUQ-JR9xxc&S%e#pSln#3DWvF_$V*O)=iZ_Ozl|6A^VuJ z2u`+ITYm^lojf-qbH(_Q;V6R8oUY={;DQp5hT$ASh*p~8w?~g4wpZ>ZNR(4%sN+UfhGpMDZa!)1eHeFh<%pLxnx1I)mE;= zAL2M36(02&M*dpjM8Wu_e6u2-Fh59}CWYMAz9c$Y_?CPj66gbKn`>qmgF?)@OsZ4C z?j0wc$LzV3qlptgfAHZ`m&a(klZUQ*NV>7MSjye$X$0w6XAFOLy8HR}2dhj#FKXLU z(CTNSqRmxs$4Fg1yp6~ke#M|7WdG42IX*f*Iz(mi)v;0jNM-@l)L}R$QUDiIRL$a@#Bb7S<_-kl% z49k0@VQ+OLch=JO75hA{_6bcNfz9l|B_Dn)I4{f1cg25HSwzvfMv=Zfi2^hZ)S?`) z*c=##p78>E2;6Gc;@+YWD8^)jaDRLv(&Jw;9kzdDDmSl#ZAQ zjE@KLK?NFKqkomw{j2Cly{ov_B^|tVW!m3X z>;}m9!@hs$XnlpoD99jV9X&|N811-oOtm1|51HpXAy>x=ZG^`p3(EC{sHg+-N`=-w zXF?9I>4!cXG@8pz&Zm*D0;HabVI*JLv69nOd~?&hi@=Dr@@tHjAgDvR6!QZb;%9~M zhsCITb^OQGqd#WB1h=@iXa4DAf;phWKTt@ke$szNAH9Z@ldDG(S$-Cf+%pWKOM$r1 zXp~E{lqUfVMK583hgS?tamVoAM^4N|>f{qqEQZxzo0ZgjJ_`AyhhH$%_kscN>exxS z`sbrwy#-At=E2P{hJ&KPosvnyvse;0^c1x+`e@Tq(Vmd-5Oh#e8u?bd9&`gqdFT}n z{M>)|r*y+$6b!;3ovR>ronjJ2UggG#x~xfX1+@Yakcp9<29f3C$B!Qiv44_Bvz;0Z zB>tYuhn46LLwU5CL>+7`HrNa+7)~WU@n~Ypvwmh0wn% zorRUH0lkLoD}_iZOA`Q+oV;xcYj5fuuHt_}x^MH#z9PR5gi+ElpTyL=lq2wQW1j~V zvxLnb2eUZQ3T0*Lq)LSf`V}bx0vf7hJBQ?&DK5g+xT>wm!^E`~^u6QI&{==X7u9>Qraq?U&(Y_vbk`=B;w@ z<1yzy&u(a#nr+d6#phoh`SSh$tbcrbfBtvz?Cp_%hI~Xr@&ZyNDj_kKvLPxNR5*uH zQmKSC*Vqd4#)p>6p3hg?@xu$KV@5*Atv$ZW3v{f5q1{)N>8wv$vW|M(|1$6rk=k@AF2*l9?G zklkKbe|L;y`=`$s1FY1UAU5s4e|?~qrhT>d_DI6U1F}kPOS#ZMrw)He%mPhy1$e6~ zBn&EkPYY(1(g}W0n3JWjDAz48Wt#jz>=~6Mre=j)txUw|BcVQ(oTvkeIT)xzOBb>*DNe627N(C&z&vq832be$q0YtZ&>S2K(4^Wl!;E=FT7!Rih zc5$l*rByGDw8xB}y}f@pVNRT3K3aUImzCEe7!Z3X9O-SIV#j1Wwd~<##B>!j@Gs*J zg)aBu+yqmXLxbF!-E54nGAGxGxt}}F^yEr#aZa2BS2Sg&ELTsjc8|oX93zSL7iiuG z=Yk{+U>%0$U8;uLd2<@#4BghmcCV zLKE>q%}*+aDG-0x>S&9}t6`87omI$fXl)avi ztyAM|(qps01vGhGs=Pj3zJ1DU)?J~_%h{Zn&N-T=8if!&C=d=dj`vs?dO)6Z2>CPP zNj4jh;|?J{zm87EDN9}lVHgN>79NnND&^3a2B9RsrhR|^Tl_(Cdtu1Ji+SXU0qM(E zJV^(bOcoEbRRAwPKt%8BVq|935|R{BY{t7ste1RK8%sCFa-7iZo=qp4{qgWFC-1d z!DKg%>PLTGN-*)W7h1fA?oUm&CCrD6dD}!D{%uiO7LqWyVo>xQv)dF(z}EqLW!%o+ z>!BPojDy4U_N>P6=0Gn|w*j~HlA1x?BnF%9a`%YMprpth-Sx|2DRlj|ToxQLmymLi zZ2Z3HP=8x9>#s30FB2)By($1sN-_GEcg30GPr!c(RFI=mCJC?vOC_z!X?uJYXF%9g zEho5^%@Bs!)I;gN2|*>)fE+)0`Z_Rgy*L|?{?XB_arPIAX~MLzX#n`F6J%?`y{KV2 zk8vC2KL(m#JUhotQD2`INShKH@g=+~-?}>Mll;UAHjuAhaq53hL&>)xclbtsC#)HX z)|Y>d$0Lu$spQ3wzjX2h5BgniPxc8xx{^p2ZyUWvJr8~5z#8+HdOqh^+Xif;mXC3s zAwj6LaLVi3gfXf_>?*+}Ry@_63YBN702~`0=*x!D=ioK5W%%g6osd)C8L27QfU*{- zjuTN{s`;PR?9a}XEK{f)WM}N5hDEN9{45T6VXxOPn@fQZk ztALfVc9biCY1&&PXV~5QDI==gjQcDE4~#et=Pm)S7R3g_eN>w?!sAK8JS9C>^G3k! zrxTax^rpH9aFW{Gwjd#>pMyy0I(VceA?JH&eF{Cx&f-*OcfczV9801(K@x<$?3aJ1 zN_-~LAVQ`@PU67LrDd@3zf`#o3XnR1Y+#k)$|)y=Oa6b7+mwJ)PU<`00YHB+L1d?sjHuVRx_957oaT2?+qFqPfQR{I@-7Q8 zULHS#umB8`RGzy$G=U^2Uu%Mzg)C?29YW*ap9#-mi^(Sr$-VRQw}tyt-;KlpEKzYz zV7&>L)#!>PqjG~xuxhW8@RUECc+AbBJd-NkdawZU;dh{H`O%BHPjtmWq5^-e>N0wk zS*Njp^}`J>nVlqyPQ=fGCFYI18Za|z!B?#|t*AM#d*tT`V`@{|%}o`2K&R-0X~&sr zPEn=!HpkyeM7p;)73p3z8L8GHHK<-XRkcYGw7S`TZHVAOrzFW6nWTRN8A_;!1zF-L zjj|c!U00DhLGc7y^U%kzqV9igty)HagReWr8s)VNz~MO&sgq=pyzKN30}UvXH$|m` z-w!4cPngL4x^$C+&K@ZiPJm9#GA`L%`LQP~O#)_I%yRJJ7^puicBOmyiOumM$Lgy> zDG#Vhcy9+mS>?#cl`isLuJ>T5N}gsG^Mt_WRSM#f{d}?*wSCYj*<^p^HIyqcW>7)M zugUrH)B~S8^uUgBz_|<4BvIn zq-of-zf4#hIwR^`hJ50P;NOh&kB%SDM%|*Pg1l~&&SN&CP99e%8ADUK$=-Eg<(g?; zvQ`Y$G?y#Z*B6mD1*AyIClUF14Kyk7hAd^_yx^pnFqLo!bUJ_XY)8ta3(0Stt*5G7 z$0_WYZ0HUjJDRg_^mO$SOOc$~#p8!pKVSU#;(PnAlUJ`gWyDdZ%fcTkw;3FzT>fdN zF*1S|zmkj~yY4Be3w<{E2=aXNaEKo05B&l|8*~4pBy=^*`Y)uykXM|QZ-o)zO_`sC z5TNZ&T+$UOPcDDED;Wc8k}c-SwpkXYK^!v2j3g{epn3TQ8R!+%iwgMn%EhlsxmZR4 zR4A(b1QbveG%Mva)n-qH7b<(&qhlwTvhZ2qyQHhOa#x0}u1yta`de{xn7|DJ0_J9Xdqi?roxg{xD zb*%+CBbI+sM}>CeXe*mssA&wyr*2K^SDJVb@=Ry`)5l#<>D!RXd8I1X%>5o#iycGO zuz8P0Y2fI;^ept>i*{>OjeDutLVbJub*R*%d#(BUT5|-U{q_PluXhmJHy|Inm^ITq z>V4b&y;Csw+Cf{WFKnoOvNBs(Q?11~k2U&8n_GWeX-8wKw9X|V8Ir&=pU@Nv){V1J z#Y|&~7aiAaG>}Da6ouHb^8taxDfXBm8<`sR#RN)_+)Jru&A35Ce0F8)GPF|$oGczO za{db{;S^tK9GhIlYK+cdCf#n1Y(6A`OzVo#D2Gg>{~H52T&sxhl;W=guI>Q;XtG&fmx9xk?A4v zrkoo+wvO2`qqD>%WPcJL6CRP1UoYe;XynsG0zU8QpFh1kls}XIM&8COx=5*ac~COy z72ICC4(CuoK)Re z+OsZTLS_}?hI;q%W1KL|N@ZP9KSS0ADOuB$P3DKD{2=bpI}R>J>MNcQ9=*V1EqOGh z61Nt~C?@t?r+9Hxb$Ph^M^pr!V}24W?d?G}2`TW}Nnw;rhx!w@0n<)gsQC|yGd6#l zK$8^9M`y+LuCfJ^giF#YdY-8|p05aI9qVzlEg`XIV`edE;twRN28nrtbZ(A=p_Szy zwC{CM*M}9)Ee>OEPvza$r6%Ee3j}1^jeH8!&8P-DiuNTePoic;tWzo2VmUxxE^_pN$J3W z3jbMk&)hVWQsCTjdnMM+y4OL( zG$KD-Jmm@2=mAhPJxOxsG2(wsnRn@2vN@z__=(LAXY;pGLive-v}-lVhp)h53Cm-% zIEZ`Zd`M^rFQKu#iR20B)_j2CM)&Xi<394=MK-EqmDz^e90BBZePD`R)OgZ*JYih) z@^KsKBh>;Tx zeGO(&$b`siB&e34#JZxPLZi6nff#ab@faF94f%b!<}DuujzlKlqM2gk5{rEfeL|0 zbj*sK%QNO8og_^B85*mK<|qo0D#Rf)WRmc~T3+z$$oxbk=}iVGLi~}%pHxrJyPrPg zi9ou=#2sDYlFy%YuK(_5^87hDvbr2gf&F-9y$P-2vMNS}2zJF1P<=uzI-OUBmmZAo&KN>mfd9$$ge?1 z@?$WW+Jhpjzbni`fgY7Ae@G(x$7r51vEEKRB>khKV*kAb!_DZ&4Mr<={2lpwVdN?n z)S|%xJZMIQO)w!4Iuwm_GRwTFQfL(iD4@qp@i(%`sQQ09q?7pT-+&L6jGxKSg>!P7 z@arcwe|Z&nR&<($V5RBmaH)NjL|V3E{vVQ6`y=Hk4cFTI4^L*lACT`zbNT^;t0?hGHtPm^^v}X5n_d-+ zl2~RPgcE;4O>Csj$#HgmsCxjD#C0GT2_YZuD5TM4jYU)2IhUA6m0!VGp%9v|Gu6qT zD+SL66b1*{|7HeBv z(VjoF&Ft3+}aU42Ma7j z$*F`D1&@)+VOykn#dyV@1d@)tQ!$K?!!s@qwIGQ?by_WR4cv7e+WY5j9+m$Y)j5)2 z@u-(q>)Os3OY*<>kDfd$=YKzXd|&@zCr^J#Xz^&uCP4hoqH#h|6PhKgQ>;nXp>b^f z?7NTMey1RcoRC++D51&RE^{~L2^NadMcsKsLOuyRGGgg9W0Af9v0e_`QRqVn%~ioO zte&Gw;bFc|w=?BZURY0IiBstWo}9Vv!Y=;h^XmvrV=KqwD>%<)@DRZ@UE0()vG-o>c08939=$ z|6M$Ld!$4M_x8vcP+L>_bu=fZXT5*Z7bN9ela68Is@C#-i!cHIqPOCY^!E69NQR5(F zQ2u%*!QxHXfIRGd{@m%v&pPi|nk5mTMDTG6Ualu92!Q0~Ow#%ENmcz|q>FzT&T?n{v14jSd2n>B7`9j#|~$R(Q( z$fr-ly<~Ip`Ew`N!E5ucWT=0w*SO4q^@b3+ssyyZF8*BXNsc3jD8H4>Smf*1*DRP! z(*fys^bbyT1E)0cn>Mi3{>ct*cmHq%*+kz%?YGZ%z<$q?nF)mX3+&;7UE5&8%wEaU z-6dT-9k;S`xM{eiU`*Jb1Vbj(m}=$lYdb38S{*_$fI_c`C#&>|Eee0VDtIq|J&?SZ z`x^c|@aal})%PRjeu@5hd=~SFMXA{f4^vlm$v3TGZ*{Ae@{Q@344xZjs&1FK`48(8 z$Q%~(i0NYhHn5A5e^1$O_me~R%Mel)N$W$HC&1x=+>j`Ud^zF%QStC7G>dpj_A$>{ zzU+hYrzB2-C>@h7jpKh(M22ZJAb%5G8+Mi9ENW}H-V}(5JmhNf+J(q{W8C9z$e$Tc zS>8#?V;=I!{3l6+iu0OsA=z`bB5~gysuoE7_E0sa@2jBd>UV)tkCNL%$Zu@~X^oAW z<6;RDt9ZB~7Pi5`1z5K=gxk$kg(Gd@rn2bn_AV;xge<$KHspW*m&kt}jVToF-$Vjj zBL6*=!d^-Kdwl%(UjEy~vxfYaP8msQGGVD*RX`WhYC3xbOp@e9*$?tNAQ%((7gRl} zDv$PIDgS8qVSl*bE64f_&ZqUazH;1Cd!9e#tzF%V9-y&j`;e+pwlhL2R#ol}jpKyJ zNdUEijNt|hFlc{1nXxE!+ijKAAn&TMX@bqJSaQl|F-;ih{-f{qA3I0g>W$ir0`7t7 z5N<`%&6CmhuKFXE(tfuH)zbGgj^&r#tpUo4d};|PyTvX+rIvmdKvI<-S^`La-2fbo z_Uf|*KUqDPuUdSf@8r8d*!qG0zVX0$dKdTdTVU5(;X;31vm#>LLv0 zs$@jH73j^gjX{S4X6ckC!N0+EU?mVPYQ8;Cp1yn07Jy#juK>TzQIEz!j`k~ouAyan zs9|{xxiSep@Q(xs4aK~XK#)i7qyKa}C*+z!4GRd4Z20<`qDw{)rBFPc`6P?dAT%F5 zav!-zSe$>U$o0r>6oho-z4CYv;I^1&Wa@tU{JBeraYS)D$|Xcj3o6l?u_4AQVH5Td ziV)caGNjZwZk_}A{F#iHM>D~&=OCJxoKKewy;$_OK}7!X$bBTwDa08DQu^&eEaF&- z)e<6Oo<)8aLj>H;!-wxxF_0O*Vm@YYfOsgH(vW{o9tbiEqF|Oqb-VHKVN3P{3%Uwx zt_57SAk+P{fA!(W`TOq&4?p}LpMQV&`SUkjvR?oXxgjZ6<&c%)LiPjbvk2SnTAsOo zR(qDn|A4`p*naB%w@XB%RU}eat0s95MXP?R0(?;5!c*;42yiKJWuCki>gLyX zWrqFRnqhy18TQQ#D^pR27dMHS?nQMb_OgGBUbSXNsvtNhS^y-!@lN{%Jpwev}m+CSpN>j zrOs@P!kBdbCVGDp1F$j|J}biomfftIfSzL}!T0a20!!YhecGsb`XLCI>d z0O_pY!4m2j_NEd0`iITG9UtVlS+q2@LDa&mELOpKFHsAo_ZgBpHRF-;GP4oGitjYI zQ8U7G6^mPZ>(-)E@vlx{XqCU$sZJ{1(L{nV*|%LStZoiqKgwVklxA8O7)H@mc5N@c zf~Q4UJN_4ETbAAb%9^qf1F(Pe{(n}H{~tejbbtTv;#tN1|4&sBos6h=DG?tsMx%5e z2q;KO(_j=bRQb{{v>gOa&d;=FQ`n+^m4qvtQ==F;RVDaPlCb(!{iS|8=SiCXrv56+ zr{|V5YV~OZQ5S9(DSgt&E((p+8C2hPYbaQuTldbQ)Fto=D#h>fghYSYY{ZfSoy$Y# zydr0*N%Wg0G!h}i+(SlxmDrce=`2+F$W-lY6nCkvrp*&M%^*tIgjGb{7ZPx`ocn&t z%+FfEZSv-*bZG&Png!s><`}-nGQbR;FR_r+S%P!lI*WJV3E5|V7CNu986H%>YBuoU z0M^bUwYO0r{~hZ>Tfcw9&X)NgD@RS#)S*flZ!?1OsGSMY#jWgC#?XF!wG$|KvRIu3 zQQFWGVBzAvsux?8RXayx6lAK@rX+c|CA0K?9y0<;Dv6}ZB*FX^r(K&b&Q&j%wP`6H zR-0MavtMJs`*vmfUB!S0850&;>JT`80Yk}>`(HW1-m3iH@ArR?tMY&U{{G*^vx59@ z-Q_0vIO0d+DOKpBKgSbM^>;Qju6!)PsoBkwxOJv1oVj9(2)m#O{I1$m$J1%gkQUmW z(e>ZYXhbK>cSiGK3tcX&mQ140xV+6X!3d9(>zylN=D9ips_kA5YF}~X6~9;p+k$`k zrr=!_R9_%LyMKRHdX~_C#E{L%|5Ewy=<(w+{Xcqkum9c2vjY8p`7wq9I4U2QmSzBV zngs@%#yAyMXlM)6L~GOJmv66Fk_0{@HzZB6$Rkf5!9Ro9MK&G>A4%7#GFLdsQ^;zi zQpUhE<(#!g4OPj&NArB@c!w=pfVxnsN>Ar+qFY=D{#$fQ#%!q^Km-gsR;PsI{V0S& z9{GI*suyoA-@hSKR&*{|9A1MaQ_?iFCv8^;R{qd8hMb0D=n^8s9q@lraDtw@f*@r z^jDHKBwt<9oz2ZZ7b$p4T{+}s;YH8*9_a+Cu2p}J4XYMdDqu7eside@nk+I2u2`hm zicIL@L)_eamNT+l;EPAhB`0CXuT_D}R5jwL(9^zA`%s_(mB$A72he0hy~}Hw__+c; z2!m85VE@k`8uQH(NtIpS*? z$J$ZIa*dF4c}{}JXCD`}`o>JU*+*jOanoHaKW)Z|mnS4)X%et22E{&uvB}G>GE28Q zmAT6-YE>=sZo%Q%LHb%cg`}%IR{dX!IUveD)cqR2>f`PK>4q$tq|+|xAHg1SxrcvP zCAtgvs)i~2d!YeY9sUZ&5~qN&4{#?R0rNVP`m1+!NxEAWAKIDd&v8sFiDr(}9ivm)57d7EX$JpkK?6U}VT{a;)`f^{r1WRYeAJ24+DX0n zs2O7LjX}A=bJFcPw92O{Bm|4^Mn3WcdT~K`o4ceT(#5YV}+yVs?mQ>NS4dA zBTIu&xD%HC#O6OFd?qp3&ORr)#4Vw_b!c-It!Y?jvv6SeLJs|t#Z&-ks$Ijv(G|&% z+-1o5Wfqg}l_Xc1H~D5k&K|Y5rn6vd`m=8;yhPM5F4R}f)7lmH|M~KdE6ko8wH}7G z12lYVxy;^>(bLB)^6Z>MpR9lU8I~uchK*w2RM8FFi6KYg=QidxIT3!Nb4s0CN1_~~ zQ@_jl%2K;x!gBz8T|JGiHKQ8DupL3mQ-Q#VwW5rwt8%J)^Gi*L3WomFPsHMewiRmB zJeS%tgfpPeii ztAJ<1y2aIrG?jxSJ1u|O@Td6YGOqN_Si&u{2zs^7t}dth0P-*ES*HKT!u+@D|K0CD zt=RwX_5VA1R*(O(V{|SMJqXlntfi_7e?0j?9*JWWcdOUM+11}#27{G`%0(UZ1I!VW zK33;$;m4ZDt+F;p#oJVx*;zS@BR*f;XrYP}C}_2nc5h{Wf*OCg@X0|*t)y>O`x|t6 z{;m64*A7FnZ~J9!k-ey&S>tN%N&J`hETR8t94hf*gBxH8{Xcqo^sJo!^QeDc|7$1D zO7uVSSt1BkNWpzY1{=oc8*O6^p#%-@VfpgKxILh<8HbIsza10ctwAIl`AfC z%9qBW{>8}Y4cUJ~?I!!Gjg+(gi_XG>`qp1i_~4TBj|#Bc_5XZ)R6hUxXZ=U_`G0ou ztZ@D@?k9*a7hAw1P@Yd1RMti@PwDiVDFEV=QZ-Iks?PmlVOuA?QE#D*qhGe93k?HX zxqT9C^RJ&XjQ5_ujIMs6iB8LnWz7keNyiR8e}4YW{$+nQVqO{oaI`wWF&Wxh=Ve!+ zT1tW@4k!N-Jd(umdG`}&YF+sS##?><{JBeR$cPH|^f7T9pLyJ82Q>7Cr}w-x>jSjhSImAf5{)dDJlQW zXKFXiNENHS)sIt6ThxuwjX7ag0lP-Wj3^BfWfXtqWAfl{;(^j3k{}|w{s5Zd8`B!) ziJ&q@o|AoTX~`#3#1QL;=ek*)s>~=$ujKya);MeeJ(2}_Q?$!!7|IpYS!M}O)R#(I z2}cNw{vnBY>Rm3v;)AA;-XF_yq%|ZtSi=KrJC5I8W!BE$vT~~*Wd>Q=b{d2d^68`_1CQ%Sg zHWLAs>VJOinu`Nh-axv_?hr9l>blZWD(nM&`5p%o=z5||9Z!H zx`@u#_Gar$Y2=fAqnYSxr^7C>5_%n|)Iopc>|Hl#q5UCX6 z4!W3C=+~2XZ_eKQb3oqZt0z87nU^x3>`Rv1N*wn2^FY3l-+caja7Yxh5lI#wQ>Ub8 z|9X2V4bmAxDWTl;W zi?TvH$Bd$Px%v*BG4jQ#WY%(l=#hV+ePGS3jp9Q%YPLA8_Wr8#Om&T8YCe(=|TpF{OYY^B9P$!gq{vrF6UN0v9DFy;m9O{2WSu3@Q zGh$^mjh=`#xY=Dcv0TAb{jJ`uu(70J4HnL_Fb(2LI&|G{jpw563RnuaT2{XIB>NbI z0Zry)oJGhcDU~%OvkoTHRO`}sQVQrzRaiRhg67Q4r)U@0D|z7N zed5t6htOzscFECTQJ1Yd+SY%@tCO2AWwpK6#H)VO+i!;Mr^PPVI>6=~(FpE5Trf}EME4be)!Q7_wnn5tEfJ(pi#h*TV5li;Ge9G#!v-nFp-^vyE{~1jJ z>W@}e1ufzKpFJu2{~hLjG1-q?^_^Y-s%>>R5z!^5c}UnkZ*IrZB3Tn;$7cn z-fIZ+y4#xm))C}ecC%$MUN2&WeP2_AZ|Y@30bY0eg^TYtIbDC{j1_pcTNK`J@wgS1 zu*o^IZ=_WYRztfjD`w>RU14W)F8VLItNHYo?5Is8>vqh3|AmLRuA=|p(S&bb|I4=JQdtbfYl`83iY2W^;5($4> z+S5svPG9D@V)bM2qCo)#uU|H!*($0OdlpN?)YbJ~sC}?U_#zczijMtnpb*0b_8Hn_ zRMXFLHJmQ(Z7sPpm)qCIm9DEVN*gCw+CmwZQ=MgMIQ4&J3#7;I9l=t^Ar!~|wx2g(VByaphlxB;TunF;Ehq`(jjp`J9?nfcZC@X#uUV zZbu7P58#y)fmRnAhJn=dRI3Rz!mat*k<1ttv<{qOyUic`mxts>qfJ=IRutg>*ZYZ0_)}qkmg; zaWz)OfuupIu#cXt4+&j@NX=T`Q6(zfcxx7F$GHCEN!K- z@7RBejpDA~nSN{e6}g(mV|jnpO@@GKtZA_Vf|dtaZWpN+`E-t={qmk#bE(%?9TbO(#@cI`3gCAV6ZYS~-oF1Q;@B6X`i1E$!_A;R#|+rvdt_}uEU;!ViSrQ9?LnZv{wuKx$G~SRiVW***NgZ zPF(iretsxCs8g<3pqTIDL-lO?~Zr)~WWAE9QDT@lVM^@*9x!Myx9AAqx%P1ED?T(fH^H>dJqXSv*tj z0bX^Rggs;HRxFWobfj41hSB=l9j$LhYs2C-aduenq82uFOQ;sVC~X6YExNB)Suf?j zpQ?f;Dc6@0%sQH=u7b$AtlT-Bg@rsWarnG*DX0vz;K0d$guvUMFYt$nJA!*fG?iCz%%|8x9#CqHpbA$~B1S=it?Nm&v}QK8!<`&LkEH|K*7bVe@gP1S!GdQ~xl+STgh zaZp!T;gbnVPqQRpQEF_t-AXY`8u^BD6zZu}Mp~&Xp4GlQja++1-sh5&ho2y74}Ob& zi?p-a-^6cGm+ZH!Bj_G9_yHA#LF^uidR54pDbPWEpFD6J$rk-h{7pRnMt-iSfSd)5 zeD`m{MvZ*;t#=xL6-a-48KDYw{J%S8;VhU$JYicIV+sF%^yIkY|KERd{N&#Lvy*3! zoYPcNDk$cOn=Y@Nh>Wrz^d%LKsdq^yOt_sr@_rf!BCaf2r{FoHw~i6 zAxT(B)8I;7oB4Yh`JFuyu?afS?xTu8IV+O?&w)$cM&X?B2wH#2DUp~ZBn%?vcH9>i ze_Y5*uCqr@0ZYj*rx(Nz647xdLE3}=;`BT2=-){X{;OY1Cq4Ne{inE!dU;19>Ro0r z$UdU;&=uEl=b<~Imz{@hI*U6G|If}I`GqC{&jdMp@ltf$IN|?dUfOX3pV1zEm+*ge z+$-U6pY{GiDvN)*^Z)MU$&1%7-I>3oF&3ZyC;g|-O8I~Kk01B%&;L%IJ@P%)h0>?t zRWM2<*K#URqSHAcAAV%vtoZu(eO*~f-W0BwLWQYb%HzNjy%0bBLm}0k{N?~up_7DX zu_P&oXe8v5z#}7;UNcE>)I_kI+v)7>k@v6u`-^v-&TxM?l$>?PXEBR>7I^_v+`GJ6 z2dY1~=dV~I0v-*>k^9m8sGTxYF|L6riKPayi(;vN%fVp85f#(UH$+aKn1SacizT0G zzJhttIQT`6d)4n;29ZA?Qi2aAuW8(wv6M>gSxy-zTq80;d0=;(g(14iL0w1PYBopK zh;)BsVaR{UuRIC;E>2=^kDNuRDFoK(0Fg#UBu@BM;4?v}hPhVm$#umn5#)LrcvIrh zNU}hn2?js-tN)k1r+;qSR`PfL6+2Sr66cw;WxvV2%e~%BzOLtKn|PA6nYm1-g2Mbf4{*3AVEpihb=qFO!-41OCYe=5A1&~u)DxgRv_@o)5BjuM%=JO|AU|; zV8#TSpvscuS%;jR0cgel@O?c(R#m#~?ZSUUN*SasdgpK=Vuna^GS zTtHsd+Mv>zQ&aS-L&KD57+D@OsI8Ad`}URX;zIz_LZbv4)NtNjs`jQ9hR?7IVx?q} zae04q01uyifBxnmgBJuP*uR=Pv1=n|hmh#G7 zA2%x9eXg3U*}w_xlJSy$^NydFWX~cL|B!#n3du1n_;`$Dv}?>;Nc-?~Jm!KMZsGi7 zfwEeh7bq+OP(l2Bf)}WB#mP&At)EZu@?+(0+dC6gZ8pDe2gy}h}*oc=~iqjGyZX{jXKda<$v#8xxgm!&a4GTneRi$L5IPKy#troOuwkySVfKnS~a9o!fyI^h$W&Hl#LCFOrLv#_jNbxmL zhWB?v zujg(6jRgUT&$7CjC{|z_9PG|Z?Am;0;EI{A;hr8#J#{j^bkHI<{v zV8sNgx-4CYryj1HzzdmQpmID2Z*ao3QFHK7p|98s^}+-imcMomgTw28J2_})*v+*c zwtmQ&Gji5S#GVw={fWokp0#qeCu#X=bXfaznBQB;BbHyFpv{HveE0&e!1ASP?0E&3EULVnRkt^}GbzUOt4;3ak|R(k?<8 zo-b_oITtVE@@Q1b$THQ;H-kR$P`gPPZKs?YlLA?BeuosOH_&%INV6R z?g5Bx|6HM4AHqh8{c#Sz*Q~VoF03m_U@ZHL+YLrwdyaH%X;M{Lw_7?}(d=4g@tS_U znBP)!euWxy$7lW0bxYNM_!Vl_9iN!-UCdNhs2feZDAqo}YCUa&242b$U14!9`DmguV-$4`C5~K9cSN=i85Z zEA%yW#K`RVoH$xH!w7xteuF#79j-uM696g|C^U-WB~n-r9|J3Y6|!OuIcbI>i|xNo z%y8=K&2%vYJ%1ox{Mbro%9Z%SE87hX%7a+(9=dqF=>;}?fUPB>3nXP z_z>Lthv42NXVtZRI`dJtZhu8KVY#cgk0`2#ojuD?v(8%6cuCPpO@MGfZ9t!UKZA|v zTYWh7H9bKO8>!fT1ow9&{dtt`{tmJ~kJj7Y@pr?ym9^8fvA)&nMKfx!VlU^s{q>iJ z{iy9V`#Ho-?m1mQ-zDwNDjcbdjUCr{P=wTmIP zavI;`+)m;LuH%3z4P&mfiKbv7rua|%AmGe^^16kAo-%8|x}Xla zD2rl$J(_&!UFf%;A_~LpQ1wMVo9MTYNw59M24zFU>~vjd4^b#w71piecyqEYTW225 zw3WIw#f^ro?D(W~-3XA|J|kaggf3{$!b96}-1viI4N~|-`njwf0&0!n5`XVCg+nce zraM}XHqdX?-8{pc=@;G3v=zlD06&H2D?^rKpL|I~H$ zU+;eW=aK#Yc63~(pDU60c}eGLkKLo}Z9%`BY0X5TScitY((ifbWlt;UGW{AjKQj#* zIPQy%oAjT*N%EHZ&)s4AZwe>>d6!Di-#h)8m7s&-ew84(_3xPyTue6m^jrAvw{o$6 zH#((TIDoec!il*0%3~!{vMjlnykiq<0eEBq8_C-EOkCdr44cp*-vp%&cMnoc`h9p? zVa{0zoG_^KDbARV!l7+fZN{_mQBzM605h-fiS3Y!Ndi!`X_8cRS)R+1=Nn-qWRK^-T=(bAi%rc<+8llGw7g<-{Q&s5 zg~Q_P0o7+T4-Q@ROpS(`pN(HhbFNUMFb^C&J^-l&h$+S92>>_fN?@&rG*obZD(9dB z(86^Ba@>ON$H|hUz)>Axb>u3LE@8ld95QWaRiZ_#^lgylJE{i7^! z6Sz;QCCp^e-g$B@+?|2mAS>Q0Ztyh`K=XfX9PBOs7w#~^KfdEhQZX}s-PG^7uOv5W z30ZV{YKl;-W9Ps+j_CakIUHX55FvH}0ev705YT-(oQQ^Pc(xlv)Uqv=uh=llxYApQ zJqn>@@nmOn-}?p5e`Hm~1uYw$zWn!1kr3CXSN0b;cPC)0LQ?IITwDi)gWsLktVOn~ z*U^C5hZxvCKw~`GMxk7P`}a6+P-$^V6SjcWcBOjnv!6WTO2iv4o49pJVxrC2 z*se%psdB41rEZQ0{N1#a?P=F6%IZXPOBpLs8Qme9ued~uv300X8<@>~Wl<`}xIn6J zd%eR2Y<}D85zjwZXu4&+$Hf7@38Mb1?P8$@U4-$?>7j z{XYq158;Y`X&{Hh`b1+cxSnFsri@LvnbspJVPzTFR~qYU!%VGHIZn+KQ(r;w;1JA| zYnZX$q>Aec&~*~1?XMq@dDwk{S^g|{*ql)ZfYLzX0u9=)fK zIS=?1Dg^E;mZ7gQyoiMVe)K3wQaBHx%>HZb&=IP8x%pDgQP(^f!b87+5E@2v7)djA zFP+fzP6O_vjx1$ec{iGVx6hO1K3&BvkfNL)WbomCQQ`X1c%dYoWdT-kKPeZBbU;3E z&V=QEsRCw_u+)0KZturpcNmx0a6w;53O`vaIGf1V?HVq@ba|R}z#6mPkNUoKO2DO_ z%Qrw{2YlCMCKtP2IbS$f-j4{er28LHh0V4Un^Zoyv8<+SgofuNP-N~-mm0umB`-msBlt~0;w;H~ITVPK)Hi}8x0>M0e$ zF+!+i=jG;*`g75n;(>v&UA~x@1J}Anz5S5RUiVVu`Bdj9nBuZ28{`P(!$ae@3yIne z9~P`2jZDlf9a}KkS-9lLuB^pVb24MW*6ZNzBE#zwg=17U6t-RbssJCg(fRRL|2S^-E5+b}_Fg4s3%gmJbFldb_p2i@JB_q%)hlllQ@f8Fla z-92|W?Cx|v^&fJm>8*}*o&feZ$k^k?$JXrJpr+8M)yDbL2-|csNGRBM# zfKAZu!HdDy{UP4>cJR>OL0|X3IoRFb-5c)i@4omNf4%$So0q$L{o&W%&dYDU>0|t2 zXSlmJ{N`Y1H0t}qot-_j+Zp2!f5(Vpe*n(z&Tik`*>!jKuXbJx4)zE8JKddczBxGf z`sMD6|J(U1uj=-XTK|&iv&Rwuo7ex#{=v)r;`%>$vA(cveA^+66Dp)J9HL<$7TyR23`^eN6Dg+wY=EC&Aw=;B7R)0GfAD+4XMkdw zgg)>IVM1aUk#Q1BVRKuSln~&S#5_TP6t#$lg>>cs!)bcg~tmhuXaDH>yl zP>iOSwI6l8pW1~fSuf2#sHBwI?v8!U+;sgk$?Zx@BW8)Fs;!oS73=!gW^4M=#SFi{Gb zR`zyO+m{jc$Y=&Ao2PRc5O1bFAFCzH1d%;I4DQg3JqI$%dLY)&^8j(o`15VR0TYTA zm&H#)j+n9EX@=DbD-UW4(mo*c~Utf5$!90PAf;F?ORQ2uL_~ z)jQLbC`EMu3NzKlTd72%AeaF&oeKfQF`5A#mB_KH$3gvqX~H-RF-%dINElv>g_Hs$ zlq*cIRTd!+cPr+uqDvgH8`eu#s~b_@O*O8b=!5E(TU-u3)6WgrQ)}^TR4*Sv?w3-F z6{8;s^-Fdje`PRAbs8l>AUXjYPa`pLuqpYFQ4TdbmmEv>c1tXY4f*F=4QfzmOu(Gq zkb+}g=V2WMiBORR?Qo%oi?W`2mt(v156S)a7vty=>Be_|c3M6D4 zg&vmuGG!{a;*AZsP+Jm2h%uqp14{Tr)bZqQ2sF$$ML5I3sDd0*U76E}c&uk?7|Kc* zKG$ueBU{O@E@ee7+R8E5a+A$0)-@PtUaRp)`K`@yH55Yi`;6CCgH!^*JZ`%*zfId& zobl>jf7;A<*Y)v`pwR8_xbcp`tBDt{oExu_AE!OEd9vN0X>SSMygYY)eEyvFyTqdn zm(HZ2AMs3m*J6?4I+vIWF-QFnOCcnJZ68grcXLIim?nGx2OWSv5*jB{!R-KidKVs! zIF8?tARr8TH1yd3c7?Xm0T>|?2wt4l?|-d6e+W4*2yk#Y3q3Y~e#c1AyD#=$e$z2K zet>46fx_Jchu{Smg@V>5M}KvIcBkoLrt<388vR zOcn|PHDLmxf+m?WVe+*vk>F&CVTeamT5m%s1#7irD*3D8xgmbfB_P93BnGk{mu74Z ze{}B-eV-^2v=~HApMepL^ZeDqv5~zhFewu9*AztqRrN%2dZ2N-_b{Q|cv(BA$4oYk zkv9rQ?~UOBcI4$ zQA~%GgT3(5&EA`)+_V{2HPhR$D$6%pri-S|xp+OuYpi;wOc!gB(j+6qF`<6pC07fw z@RlW>hZ(z?#F$NJ;H!nHmT?ke>-~XLI&>c%6|?>ln0X1~box3sa7u4iUoP^Pf2&VY z+$j-9jMY(r)Xp)}Coln-5?-W@xf_>9r%@vLwmyE4Vn^CUDp8xJ%x{1xo=SOR_u$1F zlD_q#WB~o0ooOxhms&cEVjAI?lT2mNa^t{kPEED>EW$bAVHV+mk&{o))dcBE=N1=N z(vnY@dTBVj;z92@js@@IF&d4Ce+QA=t6@{Jd1kdN81ZY0{BKbpiwk8ter33k1J;E=m&u3Qq?BVs^Ysm>U=Ll04> zC{>y5MvRNHkff~M?x`fTGgHnU6V_U&@M!4ahzp5ZX%cRT`5ldKNH{j{e|j4NrYkTK zn{Zy5FcWL=Fd~JV*zBdj=RBsjLh(Z33{bYiSr#<7n-FgTQ#2FelQDW}jmSfxc$+Y3 zOfo>F;8+}-9F1@aLMxCIMZ;jW;_)%C^CV&qRF#RaU_}fp>`%`JWidbt6H=y*lThf@ zf+}bx*kp@TOqNpmimFr;f8&$)*gKjE?&&zD86(?rD&|G+j5xf7TNIa6MhQJ9i)d!| zoe&D%qiGaiElfy2C*keSC}#QJ{e)6IL(a7Bdi{S+XXLdPY z6Pg6RSZ!K!Nl`DDmbFNXL06no9|w|-q9~Ykwd}2QJ6UC0EklMukwvBwoO z#Y@!!v1C5o5l}qae^901NwyBnq(cN2YJh@9Lyd$GI<~E%60!gm@ti4s6w|5XP>Pu= zD4Ru8!N-h~P>JFKiLGvC2tz?Y@60Bq#T~uU#Fuh&lEyQwkagkz5*nl!H#H1m2S`6F z6HxA(9L`Ou)z%Cb5{_fc*xBV9#J$ODo9CpT&Z%Gg+R@DIf6()!@v5F|E^`Iz=|=s` zN#a*p5f&P?7})|SbzIO*m4c9}0TG?omM)=%$yr4T5Mil`;X}fV9#*#SX{02BNjYt9 z9}BRLDTN|28&H&>_x7wOOcHE6$U+LIK_0J}*-pFf2A>0TJ~DyOwwew$JfYaX7W!W7uIRsL~?yGrY zGv@IiH4V#kS+d!Ro~Mjr1AYp{zAo6E+G1r@7-GRCq}U?nN*|hqSP)B$yNpiJd%;7j z{ZgGuNenb)ru%HEnkHPm=Q{nJot+&=nYWEvS~V;WRCLXt%2)V3mq%FX=gav+9w*@; z`-$OLe-FAbr`On@1^BY%I6wcU=H`&{NolgSIt5#1YPRU_xZVWC$dl!RXoA9Iieutw z|2!aher4fdm{w^(TOX(?B9Ur`@)dMVKU^BRBN8+2#)<5Ily=^6%y8lNgh?u6N>JG( zKiAo-nf$}4s zsiT!QY6H<0RK#E;ZE_@J93x+B5;(jiF%9K%xkWJ%)#&*v#;KBS}CWC8g!ObdSjFxl630qkc5OicGtfXFm=NW#DZ*DX@E zf3}?A5ec!s4d*`}r50pkI8IyEc1Df56k>)LhBOH?8BGtgL_-X2j^)L?Q_{P|{A|G0 z>&v`cFW#s8L>mT0A+45Io(svczvzui=qmb@NJ({S8D;BK8X7~&#WpWqAE{E=$VhN! zIVnL>t@KXN+(T_&9*()%x#VVI|1`vFf8ZTu-z1f3hjlY!SWTO{zj z-$zF=zCqDaWbD@{9w%ba*&EkUP8Uy4NlcZ1ggC3Wt?b1))$ojR48P;|*!x|uf5a$O zZX*(!hLV}6<<9{)y*LTGY~nmbJFZiO7qz?V-C{LX_hTFdbS62Q5K5#E5DExl2KKU6 z3gr7P4h45+E~j!!#@utI2azk38u_QI+e(i*#mhtWPRdOM%0Q)&S2I2e(0EZQk#(vl zL~6<31==-VnFJiyouc>3;^}Iuf8Z?*5GMh4IS(AWWQ?Q09U|{0pktSje`4tG?Cwv8 zPEHS3Eu@`161cexixnamuTUoi?CKZiIl!0>gSZGBV7&Zk8blX=uEb~zslNQwDp6=rEPgF6`~MOAPp8A1M?=> zPXZio1MZHy;4n_(8)qR`e}TY|M1f8n-e&KS-B=@Tjt zyQVsV6pcuEA)w({hzJuT2SR?!pO$s)ag=_Y(hx^RRVQLXEUP*W6I-=pZK5L<>VRTt zC`qP?V8)vBz{SHfMlsp09y&Lj6hSHS)4BR`Ws(%FJMiWmwe_>vr9k=#&-FSk7m${b*>YXb6R;(krD#)lXB;CA%1ik!Rb}Rhq zsq*i7d?nRf>yV2@Q=3TB2RX1veTlvve4){j(!FL0&y=q{ljVj980Lisdq>W79 zN$rPDx>}^bI*TX?xnq4FA}#sr->zr>QuE>kL|MkoDpQ>Bf1UHYk2wDQodX|X9ODSy z{^%^{3s55#oKYVG!vXdM~h(`+r}`cSCb#_=Iq`!;;Bz765pePMa`1vP~B z+e=A47bqM{lY-OV>B|50zIM#Xxt2{WOQ}A@D_dEmX>(zHD>MDN%6@7ogn4Ukl^COs zEF+{(f(s_tDNRBls3X2D=6I9@$}3fM!6%~;jx87Ce}dn4O4y2TNQZ@K4SGD=HXK+_^aYjI19T}G0}YRH zfH}7AfOh9vUwOi5Oi&=>U~sYS>@Bx9M2vWD`iWuQ+ek!$bf ze-a?R)cqXfdzQ{Pin-jfbn$dt7MX9cdkC&BU-6g*(sX0t+}nsuJLX6~wy{aE7+6y* zx%riL&PeIF(D8ED>*Yjc|0jHwF5b-QU-)1_YIK8J`?#&j$1Q&#b*bDUGC^FQ4Gqj* z)HSj&0--S?x%s8%R~@}I##ou@rB7ITf4C*hQkY03-#AABjkkrOp6&$OY6~af1jj@O zW0VO-?gi4+NWv0@Nf!};wsF{zU1+aU6g$6&MzK*k%(caawYsrZH`eM#OLfEYQqiti zG0)D2Y@6B_az490lUEbDnj`tFEw#ht&bF&gj$bcwQv9%E)Jx+_xTHbM@+-fLe`1V$ zArJ_8kc4~%#>z}ejHvpL%V|UdI-a>qw&!|Td)CRH3sdy|@&?~2?ib z1dzJ*Pa#8`u#xlx8^AF=qx@1I9*TWeHf8lJ9f9?6;`%u8F^&_}y8P3gChqN29oqGG zKHKxe8r1ab^@-y8MDa5`QB*?Ae+5qOA3do@P&GD-o@}n_B=C!IP^wZVe8_ytgIv(i0H*6GOlOyg?fp!87ZoBnQJ zDQ0<*xnzMNBbd?Td2D3ce~PQM9*r?&y{sLVMndC|Td9`N-l$;81z9x<0G$hgXxR)$ z5Mu1>JLh3$M#_RSYnmIOAQ&R=CJkbdF%Ki;Bw>IVGuQDo%nfxibBh9@tflMKzM_0L zLHs#OZ3i=&=sW&!L}UE+5`MKf)oI8$3Ih3WoTz{lzilp;ETm#Ye>ZsGXUB+k!$vby zB(usUE8e;N42K_+A%-VG#4Hq+6E%(8mPQ6oYYss03pabw$+Q`{*Q@P~rLk4yNs3(Q zEDb&=7L+BE*WE9#Uj)5jK!>J#$JCR|MtcTFq&xLDVuek5b|M@4S)Q#D23T(KzDjLl zh1*C6KvyT>INiD}fBw?Gt0Wv_mc^*}Ec-gO`;_(=j5Cws@tU7yj!e?_bS(v^>uV=_ z&rv+aToxZx7C@fLN)+QLKwd6h#u&dJ!1K-SS6k2R*Rq`G^#GphUE?~6@rb;?e%60( z#42U!%ofc>5@3DrU+a6FRExgN4UXLObHlR@jBe-8BzRg)e<&a-dc08Rx)(aQGmW7u z)5TO+cUn#KhBCdGT~#7YvMYuidl`z()iVC<6uzKlS1lAyWNEK8oa_{Zx$lj3%+%XEM3#4Z6X=k{GLVT65f`g1VTXFY=1K4zr(& z4&611NG{3?f4G1GEVf_SjbnNjS|p0!N3qV9be%*WG^AI~hYwk}ZYLjJ+kr0J-@952 zcJATTE7-9>j%Yl9-Kq5^D6b4)_!h_VEEC7EQGZM7PrgbrogyJETUH?*<{CbH0DGfl%2BY?MFEc%UUyD40N4Y=VOzGiEvc9cOLJ zY8%NvZ&iZDf=l;zzpe}}t$0nI@XEpCQt!fnl0zr-E;OVj54uJ)@NujJq|nH*m674P ze`y%FPI}rFQYGxFxOpW??6PJMGCXMd4y0(zQx8g$rwSaDaO!L;53GXA7muZq>P_xc z))NKT?wX2wMSZaxr}B_2VL1NVSgfCIz0Dhc!2$eEd~lQB2lC(V;Ujnn2iJGN0e7_f zy8^EelG>KWRC$ez5)~9wo_0;hi0gAaf3d|d&r>FDbCxHtAU=alF_1d~m>5kN!4&&C zkSP2QO{ACc9ZCapDvR3!WBtmY8;X7oP3%;GjA|s3jvu+ont!}fkz;E~B3CT)x-Uf( z%*7DgDFlO5D^kYlD#hlj@f=kF47JxNd~|JtruQnKEn}? zM>L+ASe8nI7SklpzyyALCZBQtN!BGhobg=Qw@! ztps1WdZr{iGAt({!20cEAu9Jin{+`G+bpH&G}#ZfBoJ4V*c0t zo&Jk;{@15?K6C(_XKLb|0XX`!RFHtH$$`e>p89jc5h{}-^hZ%vMRQZ{vU_&U06xgw z-LV3}rZ27PLrMdTLT5YuKzJa(G{h0kN{gM*v7FZK)fXpfXi~-Dt7tLBvkH9r&ayIy zN)HW2oHaHfzK=r-V*p34e@RF4l-Ty!J4`JIGBuzms*}^ z9*>Gim+v({%)M-w_&WG`)U+h0PKaFTdzpt&n4OC9fMRb#IQDoFV<)Y9Z;fu2BeD*A z5^_Aou~UuZrFIuqNwV5?v10a{C?H1##_D2*+$we7DgKqG4>d9if00KTby4R4V-F$| zOH!^I>;fivY|br7+Y0Xg+{0Nxkqh>?F5 z2OkyLgNwR(3h0xuz>i5wWZLM@81wH1pT_N=)EJQ+?ww{g+wfB=X+9y zU$X>Z&N2jhDeALpe`{u{Rwd+CCR9v`Sjh}6ww|*sh34FVHAB;SBr`T zxDKBMIGNfE7GY$HO)tpDmf59i`1AdfGe?%|@tQZTd87UPv3aAUzBOxXgUV`IW631k zhE0A7xn3Sxq*hSYDB9~AXa&>1OcKS@z#GQYA7ye9RFE*yBu5rv0fzUKQ<|W9!Cg(bW+!;$zoC zaei_H3|0lbmSCziw47V;B75UwZD$SR_f|W-nW#br>v=m_I+Xc(DjosyZqkX-`&+ri z#devM$iE7uf0mrR4G-&x|KEQWcG5rVqwK%NV~F+6-d>$tcKLh0!ZzmEe_!@@_R99( z{k8q~DW0#sf^+5AI+PcFWwOt^2??53UR_V$wc! ze^#dmN)PVl0>(MEXO08+_ojA8d0NrV%O*>R0x0xhf733NOQC8Go3~)I`g<<<=avB5 zaaa3v;FrUTv(vNhl|$0E=^>^VFsEWLUggI^bkH{Ds&jKkUKW|4TeS&JDdRGJMKII* zs4wTo&h4h0yNuIRFq4P*G~p^_Sw0(|go(Wg3JIHb73SYnWWd>mJ9+t%hT~ucEE$h6 z)9Jnhe}3$aaFy!DNuALg(B6QK3F78-;gF^A0>~}imX$pjM1WBniaidwdq}s$7vqWG z76ru5P6udcS^P5>tM2NjSr9A^eM7tDKMhHX2{puM(li@7&6Bc84s3|{@u~ACDJ~d~ zbDcsur4y5_*!Z33{ASqi!Xb#7feLq^y+lCYfA9`yh&9X!608D;DW}l1bw%}?LfffZ zeWKH9s*}jnZjw5aNMZmL@=OYW`Ega>A9vQx{MO8##nftN|Ng#Xxwxns-pZ8{`*2H; zN}&AVLm7f$AZfBdxW6~*jJi@L^VFSPs@%IW@uQd~5~@228rgy9#T*CWu4rFh_voha zf0x7ucI$O5|eHLwbw5YO-;_@ZxjUZi?80=E&9i%7dq>G$Ae8 zmd2ciH|-Xwq`1}|bND~$=ywWTwRuKCe+aswFveVAm~MJ;66(ODN-u|tljGCN>+{3Q z%U|AJ9KU+Dd6NvW#{*ecXO?xdAZt*EI8=0UYw zJ}9wi9x$8#0)QEuI0=^?l>$NNEcvb*V;N8L)$=oai{t0ux;VTo%}@R}xXPofsvY^k z47^GI2d)b&z&HXD>gbZ9Uq>{Wsj-x~W37~{S$=+B5sn!GFKRaeJu%xoPJ61OT>-rH zunc;98rd~hfx!))Er-C3yjQ<`fBQ#=%k*B?l7s(~mUS|&WagDqK%DFBk(CoBqeHqb z=QD6gd%}DtU|8~Ljkc6&Q}r5GNuzRIb@!po-6MsLmge4B908!+G`Ox{ER)>+@YqXw znhkh)f$Nd2XW{Kwz`GA0tfBbqXR0N?vgS%N{@pGdX~v%kVHtZrdVN~vf8Z5@b~Z*$ zvbMP^DZ>W3llhYlZq!=(Zk}@lg&9ugH(xKmI|)Jym|*mR!xY&jxUS%O1!g8nqpZAU zG--1(P-}%qzVfjt$k<=b@T6LX5-SaDS=?o@fzs097cu}#^iRtFUr_go=9<6A#Fll8 zRqrPqb&2efgdT=7yR5thf2BZfE7lWHnLwLQ)J@42N|wC?bxiC@6<#Q(J*djr)Veha zhEP<5QleBpns7#ZZROTxFCkndyhb=ny*e4dDVO*DIJ&`rV1)0? zo%8BMD(VKbSTx31)=f`Zf04c>(gG%lMlQ_(JkJ>pZoQTSaW{X8pXZjq<;lg*r$-g5 zpmm!q`K7J2owb&QDyCfWo)dD+Pl2*EsVANDP_ht>{2{h|U zK|(6bW~5D0Upnbp2R&_go|#4FRe^~WG7yQ&m*z4y3PtpJ5 zdV+%p$E?evU{!52`+w~1zkGR6^#6FdySMiLc#7x4hu&9kOQr+qJ2@f&mM#iYF)ZE$ z58$hwWFWn-Iw$WVX`|G4s!hZQ=_1nY=yI-(LT5OJ;?!>TO~%ty5#%Jh&vXqm#cywM z91E%ZBk(v0e?54yC;ueV%Vabn@4<01V1lE$ic#gUQ%);UkT8gK)H;dqro2}_oLPmW zF0xgJyeyM77{w&yBXItWx&J1ZpWO-d_s=+HgoZUJrcQlk7{pdKgFg}!$f%-#qDW%e z?fin(0Lb!O41>Uh!4P{g2N9!FZ0C(qM_L32zRK1kf1}{4AObQn#HQ}GKK>GFjS$Ff;>REsl@qG!nGv{QXtGyYKF7!+-X>FWnuna!`bZBp{q% z))i!|p>)3|ytszsAc2G5a~w)9?%r*Gh&k#v4Qh%g3CG==ujNhu+kW$q%^M~eTuBa6 zDN;ejK$RjNbPb4kL)G73c8t`lHIGX+jt?6Rf17BQ9*>s9^Ux7#M=^~Q)@Fp1e|a(A zi3-tQ!y@%@Ny@QIERi$KxeS+*<+|ppUEYLXsjFeWXLUFlmkWxQAA!?LbxGYdoBj_t zn8I$i-#5-+%10;5FC@eOq+>G4d+@g?mKgv|I9ipxFU<-A%%c(B?hF$S8u&NTFuB|9 zfA4@#F$P&LkbXhyrIG{rmXv=X?5mX=5V45&5rl={NvHRY?v4Q0H zO|^@YD<{sinoo(ixsg0k&4+4}y4}Kqf1oeFh|=Skrqz_5Mzvi~`3eiItWwpvORP|1 zz1G%i?Q>dd*}{TNV@Njli{!Uj1xc4`z3Ou17g}`1nse7&zQTIRt(V;AzT^tmS=Iei z*S@~myco;TAKNa=nwkqO(0Ukimug+r^`c!b+RtOr%0!qtYXgpzowU~M#RGPPe{H*A zdL!LA%6xJq3}szoSqT}Z`|9Zs6s*gY7*}QK4s6j2))gSTfQG0uI*m6P-+f3=v;RCvQboi(}J^n%6j$?ECdi=w= zELdr_71;U{RUpN;XwPiKx)r4Qe`TqS=*3eAbNvx{o=y%c7;RlIb?HM@_^i%GoiEl^ zQAaJ_lNy#c3+JTP8TD2jG>LsRPfOuC`VXfSklHc(9&=3(`lwpn>8K?F`^rbfu;BNE zaT1Poj>fVz+nHCi#tQB<59EB}D0NgYGUWpk3w;3JVqdv`*|$wvjD zw*qW6B)epcLjN#`Cg?1gLVu_IXz765QZ}k399d?r3~sG;6I$C^?OBxW#Y|MWdbI+0 z+VoIG3azZamcrLk_~#*oI4jlpSS}Ng#0lw;Xr?P2$Qln@tU&V4CnaY4hW&%6Sps?_ zdTyX)Yam6*;=4gdbJ#I%Q{9l!Gn3CM9}W3fN7AWKW@(ajOa|)78>(&P>J{||yQE5g zlVB``E5Rm^Q1UEojhkY|&=_w^e&mUQBSeDQ1E=C0%hYJE;V>Ayf`Bky{Y9lKlMpR| z534}UrRHR760*SD6x}0|T z1glrzcq(tP1J9&JUgtfL0xs}fK8x@vOH;-`S7BaYK|Bh~m#%IQiaTmWl}%meBXIgZ zXc}x)*Dfo^759IKWIROSxHm=|-=SG|hNcg`2i$!Bcc=eizhAij`(kgWzrO$b6wiN$ zvL6FsoX|8nLH?~GbMsBmPlSwf5IyWTr2k^b3tIia2NgtJ62#rTPO@ESJCKHS?k3>R&8qBuHAqEi?BD4`R7$8B}FL` z&;WF_myG6AQJ1mHejNz72xy)F!P1xd-ejUY>Q;&ZJ1GqXm zSM*195^vG2^Oa*+Gaq^V*YW>b67vKFCZx-Qwt+ePe|P8QZh`;5e7UpE|NJD+6Yzg| zl~%L=pA}hY{#LgOthxWE=KjsR_fZ-DO4+_<%$lPYMU0f~RvesLZOUSqgUE*u0A2V9 zeXQq9RcfrhKg-K2lr{$ZMmX~MCoZ{?vIq#A&|Mb&Im)ltaOI-+ltBwrb3 z%RXiM)SPSmtl}x|{~irTWIRQYtMbvY6=;CX`~UvI%ToTY7wi51i5`3VzBRk_ktBjQ zD5}_?TZ9Kzgwtjd&oR-$X5MD!Zogwsa7;KFQi(Eu< z89m+&sgJvCGJub=;f;Uo4N2IO(bDCMF68de=ppR|WJp<;P3Dvd=y-l1ZOD|aQ>NLF z@@skXfL;3`yT&1pXPaATQpo9yM6aH0iakT!)*)LR{fUg=*I&W?CpgbG$5^JbMQY!4 zp8argc>Mb0^72}T%5;C=BaCAlf%Cu5J_wli4s1E_+i(8?e1b!3Kf6P5SOFkA(9>2w zd3tzyt}X)+CetQ>fo;Ky)v;z@zZwyPeK?|3?Mx7Z=?qTKOVBi=9r;s-x-3?26J~#c zksn~jmd+)k5K=)W+qe6G<`lugFNkn;419ccDbHwqU!R>u=FWeaxs)YJNLtdXjK{NU zm1D4q;3_iPT%4T0K0T7B0oQNd9-q9@Dc?Iwlb(Aks4qv#;FO7Q4i-u(QfQ1w$F}(9 zv%smqM@Pyk+l`a(kp0APEKk)o=NA)_F5gm7X=Nh`!?76fOabsF^ezPVLMK?WeZ5NO zVDesI*)(jAW>|j=WP1JG>Fbl?@R%z$*C=`a>UR%uc=n;9+WqfU!NsY&tS9{}tR3RNSP*-0Nwf zUI=RfYL07qQB^IO-x~XFvG)81^1KoU47Wxz#!)~#v@Cy~x#}&N$S}&xqtv%_y+pBy`dUB_(O*J4w+*1_LjIa#RS4-19>ww9O-7@gzQby+n`wCG%9 zU_;0P`=gVKD@DONKCu1q$CLj_zv(E!xw?n?YnlRbjJa0vT;%()JDkY~&6TLBa+jE= zyHAcRKDU1nTv;DeX~8sqc6EAo^7{Jp?7O$GHlJ-itL*pIR<4%jEI+)xyn1D(BnRo& zo!{=OYMj5lxVk?3>CLw%7c~|8zuk8Xw(-CrhU=)%)A`?K%<-4s_qL>cRFqpv+8woSSw>Sod zv00g=9(Lgu(EyD=-pCP3M-b4v0%%U9YAAn1Hu*X9x(IKUd>{= zxvwlN7QQ_ck*_asB$RCZyWiImRdNv3E4}Eo2(X ze1y=PFD}xI$>pl+$b_w>cCtc(Kt)e~{qNtjKv1Me2|>v@%0H#1N{W~=F=u}X8XwEd zT(BTF7nV_{OuMOUBk1RvVQv|j0Rrlw0NfaE@a&cI>_dO>U-FV~I2La#gRUwlogYQH z-GOWDlS*p1L?PkipBP9OC7h*S(i-xQUhmzz-n)12-dT`~CH~fX_wH{E-{1XL@7=rq zvI`Uu0nABcjK#f z?5k%V#2`WUE6Mxh-x|$(2S&)SjQfg-K)#=w2x*~u_WWJ=+3Zoyd}QLK+BS{;8;e1?YX8ug)J z1r_nE)Fra|wo;LYvrwzLvH2pJeQzUGho$f>wXc6;@GsPQ26O#<8Bxh_4ae)ErhYiMN+mXNPZ2oUK*iZRoh&shkov z9{q@LRR@2oIrrOuqX2)SFx^ryQ;`OxaUzM;EmbpbGTE!DPGk8CNC?k1;X(a?kKiR- zFquBMK0Jr#@DY-b`~h440Y1&`BobMf2TJ24gEr(49KbX2k2BZ!ncATnte~qi)XC9W z#=@CHv)0s^E7f50%tI>~KV!@=m%iMZqHJU4(+);0PN{Ig0*rsFVR&M)k8yxzm)N6W zraJjFRQ*xpbeU3-tN}?ROE?c!kjuv=PJ!y@ot8K?xjdbs4*f6!|GZAUKK%mt60QI1 zBgKj%MOE{!aH42NJ8kz9A1Z!EZ0Dh;i)+@iK6qRoJT7+d2vwHSEY}%KX-GJYTPWBm zN3p2PDZaF}1E+tIg#JiqoJ=zd3-bMIeVAZb;Eb%-ci>-NRX1Fsq>>rZ>g7#H??Q7Z zHKVu@o6NaRfc_VF+A`6 zZ=q8?|GEC~O#Hc!p04FyZA9hM$bm&Q{R;h);Xhyp%Em!8b!>4YQ!Cux+uG#W;hR=g zMA3$u(o~Uyo;_PMcMm9Zi4Rr?5d5W*nED2yP`hoEpr)* zN|mj#&Y)6h+003~uU?h5=;8u=GLw4wJS#s}PTm0KEVK|RaZVS4qZdMDDYFoqY#~%b zJJiKeA{ikPP_bJ~XZmisW>HJp*;hS6e{&Jd^t`;okMiCz*Y+znBKRDynN1*9{&KyEE3kij@7)!(( z%GM*(tm#!0YIK&ZZ)c9PY^l_$y=6;y6@xigTe6P8`sM7%tuKCmo*VLKdhNUIf6iQc z_4$!5KCgv_KfloMXTPWftG;dYC%I+xgyKrY?V!)(W=}0DE4|oL+sY@t*ONcmDMayJ z{;7@swvx!->X{S&b??QCV*J;G-TupU{I{ogRv-WE&l&ek+Y%*P9Kc7nm<=dhH<`bH z5a3;wL{UJn52`>C>j<7{xc^f9e{S*2EXM>aZBn8kn(|59(hygtgw4TSyZOxNLJ3+^ zPpUET2@_J`k>a8Zs`HW7mQ`~pXvH;*SZDnN$EnH?DC^ieUfq~Bt5Wi-E7MrWOd2!H ziXAlD!<>@4Qd{DXe}q2lbmjl# z3#q>~SmMr6>dXKU3CGt$ z)gvKh>{^DPQHO$V=~S@Z`urUU(qMNvrf&kO^0`c@qoP@+rKVAHEc6w~S{cDdzA4ScN zrjSO6j9@cu;#J=cba#6G>RJCkApN@YANrFS9XYTW0EtT;gnad^{~zfKt7HbQ2uNX` zhg1>fY0;~Q|7K!uZNusLw#024p6!?(s#Xh~ES!oI2i}l#>3(*DXWO8EqSnLU)x0q?=eL$WwtxWl z_p&_=CpR{g`P*^mN0fwICvaB>&AQD_g>YAc4hcDqZ&8q5cGADwOnOs zn}lP_g)V(HP*6-{5RXo$H0<&yxHSj)p^sw+Ho+$z2S?`>SfEYEQ&-Czc(!G^8NGN= zr_}3d{~TKOLXvK+=Q{X%hNYx&Q{80+mSu zbRT3G@#f~5-Qrt2!PkJS@prGt_QYu(x5D(Br-BU3)0!O2(}FBg6iHYytt2c>!Iv@E zx}A{n8U`n$xSwcAFRM3->GYw~G+z%=VLt}o@HoNFXGRs36O|u4O)F=Amv1t(@>5r1 z%V;%v^9+xR;gZgYv_fV(MT0dmk4)i&w(ZcIQ@<9Y<)~`OacM&2F@~n_a{jCNh6u1& zQg%EA%!^TkRh~Ipjj82Msb2FG_bWg5rzrnN{&0nnKh!h#{%8M1LH^(0>F=%O|EG8g z%Pyk+F=25MiCzBN#2;gSUS|tbqGIp1Kg1jvyWn}b{+BK88$rFrI88}-c#B9NMoTqf zzsZR(?W&ie|I9-Gz5gjh1r&1c<|9!7;*kzb+N)b@qtW9%CH|jotZ@?H)ocax`2YUP zy`ueRZ*T4Y@g&cOa?sME=v925k;sK0k(%vcj_=2L4#;YKKMDwcF68^sT=z@&{V2%s z&1NdAu)tmBUYs*r$oGlZO;C{O8TOG;LxdBx(Y9?!Fek0WjANQah2xCc(R^m@DFTE( z(TW1tG&pX-GYieH;fVsVe4?ks|Jf=d|EXv0`TvU||KHy^SfBqt$x{|9FLf|#Z9(v2 zj1&{7HTRb*l}!GBsdkVr_+{$`^I2${^8%w`NL%E2Om0bl$M}SKC{VGZV1!golM(w~ z@H*8K!M+CY{7u66MG_ve=jtsA$2gV6U7>*#Y^V81;~J!GmzkpX?W;^E0oUPPvwe)cZL$bTCKvkOZ3cO<}U#yFnZ-(`4zUjI0z(GiN!kOYL2?4088 z^=nbegie3RD5WVqFKYv{Hw;+Y+6=!YVe&qQs6_HGoC!Q-OffvgAxFXY)+YBk_vw}f ziRGjA+%u6xo|`uedokwePdttI?3l#qi!{a}|5?I13J{q-|I_WepUYF+|J7YDoqdaO z#PKKz80HUu5el03|NWi47X|;n-JRWjf4%=d#iRFs8pEc2OjbA?-pYS19@v!}|4|e% z%gex-kj;4O`ps;?% zv%&?nx#s9^8Iw~xd`hL;AylGnHT>ASVaZfS#FGPSE--BBB-Gt2Ju}^J5yR(*Pr#{; zpyzB!;|H6d-Gdh_3(uQtDXr4Ju_anjbo~WT9NqH<3Zsj=yDhM|JAq}f#ogVV-~j?G z?(Xhx!7Y&B4#AxScM>duU*6xp>Z`AA)vfBPk#nYJs?MD0KK*n*gP{M&qN~_ z4sm5_CCjz;*H$`3O}ELSrQ?~`MCy=QN$?p$0lp~;0wvZ^NRsW*MoFc?OUdy(@Sr{a zt1IonB9}JP-{4QKry~^x;ObRjwfAF3irof{v)9}3K!mmLtCHH(K+DW zvH}F_Z4G4ux`jnxf&N~;-Vc8+9%kO4=+JN3TlVOd_J>~D*5|oq3yA|-38tJ^ssgS$ z6V2(A*6ctg;v_9d9cfqtbx3W;*QxHpT>18AhC-7ajeDmsrUq76rVqzs_dsi8t*!nd zt>EDcv4ZCdH|3Y0=RaBJX+p<(uZzN@h#AX`Drxt49jTRiLmAHr(uCi%33x9JZG=n7 zSI2zd<7;`uU?1Ie;&j*DdjN=tB(+)q&dv8?{F;xMi}|rwGlIifxhUU(X2yj60?WF) zurA@JA@V0SXc;H$*%DFi-YYJS*5@hA(b@Z4Anx0PTZ;?0go*h^!S|6bR!L%t2%RV? zv?zmkv3l{Kcm*UdqS8fvJ?+0SH$0zL`APBblu+c*=8Xh5EIjdhIy3jX;F>LwLGqeU zWM>On`pbGD*(qS9G0Fl5vW7 zC?tddBs>bAYf}59q%)NMzPwb^eTkluz)$f9wq>I)-U^@>i>LZR9e2(x-fD+{kbGAF zOL&}#A1xr-GJtL6J86_5BBE&Mf8{sk(dmG21EJMOfCWQ*z}Fw~-d{BFTrz!2E9w;D z*TVrXPZ}`L3J5|;hY#d2g|lpy!=n!>GRWlZsaHoM;3sinZIST9fN7exa!!w?;uzy&PFO8MJ+huoJei6mj?l*U1qjw$M%)BN zZn$@z&uqL#Hh#{`3+44haRgd9zJKobN^ED@ki%&rKPBm@#DfH)xa!$j5gK>xAKIV! zTkp@<$vSH4EX0LWE(0b6^O-;HP5Csup8asniY zj|%=5`KB7UCEq;q{Kr8NHSsu4|_Gwec_h zhHNv$sm7rynk~7y6aw~j{XRyv_)Wzkpxlo5&ZOrZ{F_8Px1$@C(4zivEL?~W8$E!3 zgY^?#z7u1lQw2WGf zDTF2`%NHvvIIAoxGUb=>`}4)a-xxUn!;}j3kldO~8)LWTtjFhON1Z)Ma{}SM10J-o zruASG_m@^SOe3S6;&831uEIVTS|7$hU+|9@9M_vi@XO=703@#6orj%Z#Gm$m|1uJm z_Y7sV&B%VTz%(@ZZa}=~fty8yBOy%ubdT_Ni>Y5>)1L05-i#b0{^jQTRofurymja9 z8O6xYR?_vG7RUClI1A5N%TLEWc!KU)i*y4zCOR$SsCCxb22Gle^?QL5FzOQE&W>;f zRG{_C(M0?1bkRy=N{ZHBM4Km%QQ{ILI)b>6y0S3S8Za_E#UF`JQAeQaM%YNZos!@R z<6tOz`Zhv%0aNZ|-}tsk81bLsJ7)nd(+XDYU9TRusN%`d>WMR~-`8+HrqpjK&Magk z$8__81|KMZ8&i9phi;bAw3N?K1aQR$mht*jeH&d!RZ$~`{NLRjM z{+Ug%&9N$z^8NRBz8deybVw}EL}X`Q^go-U>w(W53_ewEI={;^l09v|+T#$Z&XS5F zIU$bs+Bh>bo&sT?HN)^l3B|LIf7I2Jr)^Pv!<>7X%24UgEguogLOv4E>Y=Tzsyw6L z4tvlF3|soCeQ&B}U39>3szAFE7oq9XGY6j4oe@W_UJ}y@4J@P2Dw~wVpN_Q^8Fk2C zFc0gHc`+bMZtoST3}fG&{45iJJg9hWcl^tHv4^|mPr`QQW)Td_snF+wvyDM%ocUK7 zDaoY`OYO>P#8rDqhqS0XiNYH!%H^1M^mTQv6#BIqvkZ{;4iCn|J{_%Mb8~K;?_?c_b9^nQVy?e{K5 z`zh?uWw7r--mHwZ^0yHKUU?4 zkzsR}!@*@hAOY~-F#%3ojWbS`JRyY9_fj5c zN2FQsvAik#T-eKOrDAx+{RBx!AB4XBKco(Wto`KSqDtsT;gT_`5x?&|2~}~UfAk9c z^~EurX<5Sl-4BOi-{Lsv2uMs@46LoO1_&-9yi`{L>!30dBZeHl+?NWOtcBwwudGK~LEKBz3Hhk*)xsJ)f{yH)M3`IeW1tf!&}8o0Kf;Va z?o-*_U{*HwRn;ov6KcvNktu3tC9MAwZLr0=;;0cWZMV81k|Q<=V336k8`};#PQ2+F z>cv2SMTP|i8(mOobp(zb)=UUCO@R<$?kjut5TZ1XV6dSBP)<7P92{?^NIU8ys^QHa z>9Nhlfoa7!F6mAmaR3d>WP^$8zNZVW+O(qwdm|bb-YNTww8hea=|Le4>S-M2mN8Pfk=0Z>I+62KrjdO9L8Cytq;F?YAC@h zy(4Ne^(I;N<;GP`231ae{4ov%jfdYd8Y|eWZ)uJa;!=My8E-q=bkfhBQwzBxrXb@hYsfSlaZ}9W`XegChogbro@PJ_rmtvKz$8|d-#x)?jDEc0`m_85+lh&@wIL0v`K1X53H7G5J zNG%l?uYmdm1`?CWvLgLnL6e;><|&Bl-3PtWEA3i?!L7tAo`d(&5Uv9O;BV=iC zQdV`G^lm6%VqaSOXijJossFbGC(shAEA9jkVLgNbln&AETV;b2)4kE0SLl(#?b}(Pf`nb_!EZ(xVMU z zitMr152n7q`5kDOK* z+Yrq!OD|Cp7>8iyYM=(t^)c1_a$^&>adw;fmH+BI z_cu-P<}zcjqv`9T7+2iAtj`= zn)5-bAB??=w=pXjInS50{}YTgoVelYtTG+gtjS?q+U;tUe3V|*`)`dudfzp6*ElE* z>!^GAm(YAST^W1IEvv6aKKSXic`mT+i2U^OWy-bB)u2eUQcDH`f(bV?dU`i_dY{@A z)SYt?$=}^#(e%tNxBpKBB;nHtKj;=H)nVRA#k5JJ-`ZywHl^8TNN^TN)z#)KYzb6+ zt5sB4MmT9n>r7oT;3!%7E@5^&^C08bn*8f81$<+gT|4T>d;RWeiFyLnKnt`g)|Exk z^Ce9u#{o)JjCj~huTJ~yQu@c05-ql{$I*cQT|&4*r?z`7UD%OiyrGI>6vbfj{}R~$j-R!6 zp%nYDEq^vN1X1RfZ{KIXzX3*_+iw;=>CM8czEBgtmXT7}Q~entUa!r`Wwk1&T4goj zusxW{vJ5)#^Ri024aJ=qFi%mZ`E3*eV3No~Bz4Ji0iE<#j=vHkgYMkwFMs^&>jmQ( zv&>ZP;nLz%w*-v5`DQSvAjyDZo$Fpbr0O`=*Yg*7a%1h2^_r=o!7m6jvp&A_Spb7n z%YCSW>f{OEzV!BnRzE7%fgF#^!{x_y^$Ba?7{_EmvnOE^j~+^*VDjiPktWS?(%DR2 zq|a1_2i4S68^`*V@sUlGxj~3_bI_OcD#I57CBd2G7jqG}#wS>(S^VqE&EfYK!08JSxhS_ZKvc5M@Rnm{%YZ42X(El9$ zg2y+&w8CyZhab~a;69YlF?t~nzCuU=Y1ZWjynKjHtqkOIMnh%tL8*4Tv18aj=R@_X zP%1HGg{2x|*@8s;{_k=pNk|{GUo(s?<&0H>c_;KgDHiWM((zDRVVl59m*q!bEvReK zEs3Jl1Zx#XVJebH3|@^$V88pAAJ?Ju{I|*!1Y3~5e*KArqQ#5t5KmK*;CD}h{V?)` z^BLtiEmL2Jt`nI-I)BUZ)ZC^|zU0SxFm6(XAX=VAy!^qtKSX>Fs|{&C^%Gz(v#u7; zf6ac@-@@KaSWT%5;r)8}*YROfUW#8zu5@8ogHBU{tTIg|evDLw4{Pk)J}ozYc{S&A#4U*|&X_B)@!%=ivMbN{~0Cjy-{6%9nSZ zJC8AYZv1BdK{2!tw_J|Du!nyb)<;M7S(-5MBkwJebctm7ua7w{gUroK33iAlEa61| z=HV)%!_D?eO?JyxUPmT&uk+G=F2T|T$yZ;04*Zn*+V)~bS^xVhv!CD&M7$xaiVXvPqu!en=NyqT}V5IlHv3nH73<5z{fOfP3f@hH>Q((2iiBgg?co*{xIh3;! zq?_+hFSMV&B8&>4uxCd!K#@@}m!AH`jU9L5B}zfz_WMCHkxR4y_5=26V(K0MfJh~a zlO_KO`+}6;VmF~@p!fBszn9}rw7l9kGA3krWxK`|FS-wD`uvPW5?Fr9&%*>DA5qQk z>2nrP7CZ6GML@eXsELd~LLpL+_{eOv>N{3q23Y_`z<*Ri02F&r@k=(QJEdi!f#QTt;Hzp>&q&Q8}|%3N#AA5M5ciRw=5m`e%Iz{_JmFuqr->jk!dF~eL*gt zX3UL*AO^8kMu$O&A#Mo5rw49?kT}CHm{9vB8=(&* zkCJZW|M8G@^osACQ9BQTpl;)V>p%UJtFqPH=uz>76J%hw9^zk~ub=3Dgn=r*9AKn& z3GUcKYG~o|;BF~F=TXk}vGS)eY2?$uawC*)(SRKpZZRC9@ zCFhRmvGy>bHfMxqwiYV_!YSvWf;zNJ53+b}d}Xr>tl$)(`6agOnv>;d0DK?AuJ7Dw zK)qx2jF!Q?dDr-D^XgY>e5TQfdZm&BWmFrzfMQq8TEzQi z^|6q6b2)-+RD2n3pp`+mMIjAJ7jRd&-;IPIkq%Z0JZPF&5|b4(5)kg?5jN5xbFMVe zXgBcwEsp(aD0`=udl0kYqWkWXU9_dYQn&;Y5|sc;Xc|VU8iZyn#99qVIRYYzzZ+%w zpbu;1aLDwPU2M=Z1*ADaIYq7)okw_oUjJJE{`6Sf_P2Ahf8^)7Z5U?k83Tkd+kLR~J{A(PNNys0u8eK2d#nIE$4r3ls=m4R^<-TJ3|`=3c&V%FFUs9Ap+jG=<<}?w4-egS+?4 z{@5FR^!MBGE~xkQE4LD_=*$kuvH55`bIA>e<~hR~PUuRR56f);>o$!;VnWy5>g2RW zF(|PRpI%%49$sstf7n0$wQSg_?c~tzd!0=R<^G(v4W!g4rb9vUNC{U`_whMe-=>4L z@(oQpr$&_5H2m(TXy03I`($`&(dXE{tT=$!@Vlb)i{+1%vOibg8e$Epg&)V=M{C>8 zKCOAfH|{TU++yE;2NoWGq!F~w%Zo7G1gkl?v4%Qgzn3Yl&e>GOfY435Vi!?K0KAiB zsLBwp9sK6%#}QgxPtWS88Fff)J~s!#C>z*NKt zP<$lT6^HBjpAL;`G^pdH{Cfvl?aJZd4Q@scFZgs8gTaPK%?5-@J5b-{u4{Nz8q|6T zW;jLVW@3e0>$Ih8;QWMz81g`tI$SONNd-1^Z3tdIvK9?(1M{kyDg}8jy6YN7EF}ke zA5i#|k5<*~UH)COWw7=XrPxbag#fuaEO>n%8m~`XNJ&Sx5Y9kmi7IG|4&_(nZ#hAP zFYUdGR`j`Y14DGY=GA$_WyzuDiSCw#61Z+|g*nng0JJa+JH!$GWbUqO2nLHS(b}3p ztDB3Gif159H);@o#@4JBX$LEvhfJ`#mlgc0!a*XJ=7^oIl%krHBW{8Q%gEiOC9Ib~ zOfg47YIL3mljkXUm~uVYMt+lhSU|By5Rj(h`IZkHfoCA=KSi@hCgmvAK3GM~O0*e`mu^?Cz16>w|I$OT)0%><>W@3ty-5x@1rwuG%a*Rm&o{_8> zJEG$h#YjBgnHDET;!)GFQpOx}c=iQ7d#O~RYrHNM=kuX5B=MVkf;n+Qgt#)$p*fi~ zEM(k;bkJyQO!3q{?CtrS6Ne10tVz|fr(V*K7n?}nL8f|I`9P3Zb~777xg|Y9*&L{)hI{M zK*4>Eu#2Z+BmK)GYX3U~8#O0Ya8|Zr+GwL1#Dba6!vAn#c-fPQ4L(OFuvHwuCft8r z^F_#SkW@0zj+9F(^~Sqq(|W1JS=z^uitF>9Rhqb-z*7^Z8&F7H&{C5YjQZ7#v&3@a z6;{E8B;E*1P~78h!cNk&&LNE$O*x)S@e!t@!&i&XOtfXo(~m8D1Y;rOSPf)bsmG%( z)eC1`+q`=On_Kz#qqW+QL)%y&`p)9n4`GRYs6jQ0JkS z;je08y;d2%VddeBUr%EwBxO=~iO!_SSNPgItBmYqdt4;^cHiJny<0+#H33}@2&au` zpQ%=ET6-8eZ0~znM7}4cu!fai_@#FaQ93y%$~NZa;yJ07mzQ=GOaIBTQnpChzbvjn zf;sw9D`ZipqIp_Vr=4`jR)-a$4huzCDVW*ofs;Ty3jNpuU5h+f-#rg_2xvo~Fec)? zSyX`!8j_hvAX0Rb7Z8a+Z50kXzpVNck%&QeeyI&QbS<^Fd?b4%r>QD}Ct9tm1PC7G z%YMigs>Hz6#}JLWGoznl-k)?~luwyK|3rTn`gOjEQYRi)9y1Y%HyuL8U16=l81v}zN^$hnm zq9Yu90W$XuT0DFopO27%6lN$aJHVr|GmJB>oev}4myw6{Xci%L1;&W`mfGb zFfN2weY2yUeCllej<6pajWtGqjn|S{&Rpa%n6%U}g?IA(d2nl#Wk)R(q|MJ1J0B#4 z#(aw2ns&mXZ~XSqfp#@R;{-`LaA;aQlJT>(Iu##=7Iyy1$Vga5MOMQQIhdw^{mkd< zHm?UUK0q)e9jn?K#}4HjF)p1NcaQ`kST4MwP_QaY)N(da91h4@Jjvz7EwxaTO8f=+ zVMLoZD>12&Bp{ex#Pi3J1v7|A1A;35`yapTw9 z4Mh3j#%|FQq27aI7cgcDsB@b_=&}MIMdr0K3L2K>9%zz*+ zmX9~U3}$d>uPY6JS|J(w5J10^Vg}ubA10HLTz_KLp9JSmb%nFGD}36=UE0mo2?neR zb{x`XRL$JH<&@eMBHN*zYqMy9>ftmwdRLb2DdXi5e7PLI6NVX)s#hC%P$`*l?E*62sh}%#n$9&c1 z)o6}IFnym?Jx={7jsBT%UAMe;Z|LB8hn{J^{q_}1bj!OhA4xzueaOjO@4F^zvQ}^g zyad8MXXUfBUVIw-#bIeJlGdid+x(}B$gW8f;Iz%7w(4+D>;!>%#mKAXMtgWOjRf4~ z`Ihe-Gb!qZi@Pi5NQgWvsY7K5x2scR zRKLNXfl)k_?;OY+v4t0cwCl#l(&~^h1DLdDqvH=gu8xx74eD5prJ$C}PQcrx^U(P0 zb;n|{>?6FH`KwYZ5kuBoOtg2z&Pq7(5_5PMxqb#YW>^ssXf&?*zk32{)%CMi`FK1y zVv=3t;%^Wa&U#>gM%NzQC;vK^DI21K8?so2GVkWEXh`5C0C)C2amR` zs_Qk}N?8ov4RkkhO#MC>cfmnKGrIhJF#DJ~*#jf*Pk}*`Gs^!$+7!(1JSn9=!GCRsOWr*~%Yha1u|cg-rz@T4K7&D?){n$4;(>^}`s{wD~E7>MXv=pmV99 zr(9ogPcDDAfY5si)!o@y4)&+eK+Tzl{kuPkRN16s%mZTljdEiSZFA8w7QIt>3P)lz z*9$O(O;9c%mdxnyaPF8SbIB=yj(M$O1T}Qd9aLjx>Jvc z2IPu#^k$KL(vqJTneq`^9_85TT^Z~FY|c-Y>OeQ}n=`GOzv%>V#+WNoX8M8iZ^gmC z19H5v*dV*CDkhy#YFR!oECz%~DVj&hFNR$x_coZVmMi)58)BF&Q>5IyObL}gozJ)l z{t>)rX4tdxE&j6KDx|zd3PmE}qi+`;P&{f5N$h0@YA#Kl0zyi6#lP)89M~gDC-0Ql zM$`3%V?sgHts}&e%4J5;n{a59Rrj|p&x!tl2KCHB;sdnvw2IuYR&_^l+lF>%{+2TW z0otZ*1__is zB`7?^JW1GA_a6KbT% z?0jr8LN@@_908^2+Z=dudZ^t(#Y(R*^MzkD5BZHv5@A?5U-?p06lJ2=b8EBX8D2|H z`KCFWma;$eFoVzVpwj$20L=`>hI!fR8MCIq4! zx&d{4@=|6Bap&CuQodM$&3$-#?hhUgCdji@V5Is0cXKN>7R?#fPGN3lATK(inDTyq zezH2>!hVG~fy_stW;=S4OA`bjt^k!mT@F5e{b{%q!&hJWMd$YpSO@zwnDTZRBpWFz z_U5)P1pC-Y;?neKbNyb;A*!HwJA3oO_fdfnRKh_u1!+SuoH1|fg0Fed>;n{h14cUq z7~6-X4vyPYc9tOpzaBpgL^9kZVX54T(*{~S%euZ=m6ae8U0n^); zI3p}Vm=UO59TS_34sf29Rm4$;0MZ>`l={$lC{?^xMN5ePlifYehe@Inqu4zBwVM6G( z#r@1pmEcuxZVA!1b_2n%`+f zd?iwoiHl0Ax`&$j|RIAPlh83-)QKY*$F|u(DDhTA`uvHbn$*NGokS1M}vHE z`aqxpMogREDPPpE?@{?L#1M$ty*;mbd4$YH?_G|xrTFdg-w<%Z($EN>7k@{mG8S4L zCx)LKTFmvT-BI&^!&kN%$EQS`8emV+?m&O+8FLm1(L*J7k8 zllYX+{V}r~0k8(vbTN9%akyB3WhtDcM^^paxDA{J$zGuD_y}f&oA#h04TwgC4}eA) zkYa;hHN+Q35F+FAlYrq-ZO3$MUAwUEHJkuHr(2D(@P$AXYJJ3?oU_{BRTM{gi2XL3 zJjqE{ocdFkgrfu!eomysiqfUzEcT26HC9z}40 z*p$#GW=(tc{3xsGXTVJ?Gp}b6=>W{K)I600YE5#IYG@~`E9M@;*)7+D`@a)b<#7c6 z{4l&GR&&Og=4{eaI1lFH4T_b5Xj4pzr|juXMniIGyTbrI>F~rysVTIUVKP1;oTpdA z!!YEY19^n0*%?+VNw!wkXJ1)`BkdVUWT2c!D|tlGvTr|7oD$(cBQQ^-bmr z9ZzbW4xr=aIs!gV=lg$0%m3CUTLHF-9XHy^q!Tk|S8W*tQ0rscj8Gq-7a!dTJy#op zm{6U}MhZFRzA9vNPx)X<{;y=RkM%Lk_V;N8Rkzjj#a2DG-9}15-tyW)qDE0|?^fd5 zsRaddf;T;NYFNulZ%zYKpf`mQ7SGFdX}8w=g<=n7p@2y$9gl}X)=+Du68c-LX5sLv z{xlUcCPnFgjhgu}c>lNe|LZozoeVYlUpI(IT|Epv$J&~W=9Qe-FG>a=K}e=@Imq4CD!Kqqk?&Isijn3x==HLs{R&(Y2}2C#+AFhy$_ zU3^EMuwgvOg#U9XkzcK0%KPjC({_Y!pt=R3vIfHxk4wLgHy%taY`1AD1vE-&0!QEM z>tMu;5c)V?NrTmUvNu<$!!aez$2tT3`f562+-q~aoKvxCzMyMK_P(Taoe{l#Pu4~@ z*fbwG-3D9sZy4bP=}fwZ|IJ=QzRAs+bIX_^$Z|UE^eFpX=H8p3%vY})hX&xv*YD4x z=zd_WrDxd{KIvBpX}A<Zro?f7Xm2ezT7?z=t3#*3pP{r3;ZFss}xG;x;jC26xb zuxG++t9QAo)5}`@_)yuJM7NM!%`00gH@oR3pNA3r06-%sCBt9>Ar1>OZN~>$Z0CodMzPm72?q5VfcnJVQ)cp@~li}NKHBw~) zeLI)R`RKqy;j-wtp2e#kVeIDyCSMpmo^EtuTqjzEmxiV!Y?%hgCoSo(nCoHtFDtTTZkWK?u} z!hRt)RTSia*^CN;hpjLu;-f-}-CK%fDunxIX-E-br}sAHj*H)}70VmOV6ZbO?n|uu zX3%Irf=`#Cuop4J2Rnz*19=sClMPlPt|dtPh6oIRrlf-BkkT%mMzyz~jSSQ})z<AipD`BYkV)<4>W7B7c4m>8v`)ayo}vg$72B(kt0Q;H;T?J?Uya(RIH+LquEw`AH9vQw8s zD%OJ$b;{(pQ^Ax_)j`p@<$knxB4lpDAqT?Zez#-O^l+?IC(NHm#6R(|!^8In& zKmXQHc3M)Sc90*P%x!yH3ewAY-f?O+BT!^P7)XYOoRazEYTFcn+$n?r#(Erkr3>^E zJVquoeZMF%s$2UrjUqG>0v5V4`6j&}LUMIPo`P;O6xf#Qu#C^ZKjRC%-k#~F+kCj4 zHaASq^%Du1VnSK*ssRPfenfIYtbS9@TE(X6Lv$nrDb=JdRg^#9!2CZ~ijhR9LIpVC z#?9HkICJ7T&$#j3A;V$YV4kfWp2dUvkuzN5+UHA3_V25fcpbM<3z}WgHl1i#cHFy< zLNZroA7GAithedUhYZnGMBavY*yuK3{%J>s*v7c%RenN4$INiynl(ML3C2ZlaLZVU z79Fi%UfLaR@z_69%WNyrrD&v2`ksqZC%WvRnoEeHmx1Sr-!BU^v6^+d8Zl9UfjG=# zX^SqW#pN#Drm?oP!RGnCTl?+wP{%nHQG`;BNSM>(X-y_^d`#*tu}wdkh6b^FBXu)H zh;&NRLBF?WX?T}=(v*(${;v^N(8v@VitaMMP)KrgKglj;ao#Fsl@?IeTjfw#tU`20 zglwBv_Z0a~M#lJ=q=>^O^jfn;GVv!a)f&NZsb;N~5YBY=JWDN~t#+7>BBom8KqL`{ zDa_@3FCTwXQc=OvI0wLiIZ)3=9R82=qp~nLR3)`{7MW`m!a|CYTS^N3BW(_>3gJW#p=!|5 zL9*@U{>wDt!jQ6eQt1{6UsfA}kyV^R3rib7j9f zl@{CyZ&?^{7@AGq*2YRb7sE}T?(N(e%f=(t10RZjrdz%i8%Ks7iuX-HGk?h;6f92< z*lUz6u>Ducm?KOZU4lDYRRn^Xz#5T};DCc+CK~t#3fRm);iFJX5FI1v8K%P|%l<~6 z_Lk;@jDBRmn_x~^LJvgN*@+UHsghg?zbO=pF-@rNhn51#QTYZ;HH5^iX`Ci_wenR( zYp0eSSScgBnVo}3G4_R-(+-ANeCAo2kGM_okn4pQ2`E|kXZ-P~ z34iZ}P5KXmE}lnf`5m}~5N39nZo+s-%Rn@3FN((}hvpHwiD|>D##ktMa-os^t!5cP zO6@I08KYV1C%?|C!<6G(Wi;?EBJWO&jxK}pmS3<@I5H-YT(-t-h?k-J{{ zqnHSUgM=IissMfD_i2BxEEm_9SZv>TvVg%R!NPoBguG2!vE|trM8)Z8=q`0sV(3*T z@D#Z=W--SocvJ_$QZV+I#MLp@@Dwc;`hZ#5v8QhL`~DQy48QU7>nhRf%pwCGC)J)E z_z#v>a2r%x3-1LPZ~D386VNoX>fljsfqxA~f#{YKv`+M0+xZLwhcP5n1z%1@lj$61 z9o&%^jLc3uqAuwTac2L3e!xU{Z3|g}gihq#3IC&&|3w>^V%|`;F!Krq*}ie}|juAZ8+1QU6S)hVo)e zN|N#<_}Z2fmbmVj9kZ^Hl|xhdQP642S@f-Ok?oU=)cUQ^aNT!W6A2Zxu9nm}c+2f>3^@s8kZC{Ju6 zNz}5HHo`!d<%Risj8dNM{#abq)MA6a#q?H_Msfo%hjk>fh7<6Dz7W0H`$(jPth**K z=8E-T?JBmO4c}`$b={ob3HBCrOYR-+%>zZn$htLp!ZckmbtBunQC56pOG;t_29?;c zN}uWcY56V4%M~kstS{|)cnf;Ny{p{&sDMLwIjjr|)}xH)llW#mkE!q%>B566#q;_l zMH@ezfhk@NDuoo1PuLox!Yun%nTx88MTg9y${dE$rnW56>6kU8VmqYlwmdy(>$GRF zMPZ9l4RehZI4H3-7u*b`v z_V;9coHl_5*iLZKX0n&i^Y*3O2`0@$H#OJ8B&=-EzIGKA7wwbCT|-S++LSUfw3hEA zzu}T}hC^nxdM@K3c$$OK_DmNM;D5uCoAx`;#p?8%3AgLB^X29iq$MA6E+Le*sY)1s z;Ga4usGm4OpA+)iI(QFRYjEJ-2Z24KV!RNZJn{E^x6z6$-OaX62DBMTN>|%?`?rsZ zE--QQ&++UF2{TD=tVOHB8S~6uj`%mVxX$JK*Vks@SM*+r>AIqyVx*k%m+#y{1wCiI zFzrNR(^(0f3jRojrQ+Y=4;~Q_QnMww)0m28K09@COqhzZX841x#>0v5X``d+t=1K% zq2*IHG5BB=BZk3`eeQs+Y&yj~Kq#(@F${MTTV^fhTsmC4n#rDGSDd+{V_%LHzF1dZ z&{jJO?Yde(M7c5`(=AfG(ojPk6>>o=g3GOdYdPc8)Dli=zGzdH z-OL(w=O;Wbzj$w{R1#Wt_m`WS8;=LN1BR0`A8D*<#L9tHr9Z$!X?#x9mwW zJV=TI9l3^(N>{iqx_eGstoY+Le`~Y{sTMP*>@~CTM>se9)SZ2q_pth`oNNvLU~o9# zb3rhAz;A8!=HESAwRSrm_u|DXdn5#s9`}nc$`937!E%nzyaNR(f$Zyh5azhYg3XRz zVzJn&mV6?j5M;_95pyUV+-H%cQZ1G@)aO$M7o<^aF(cXmO5+oj`1SNtP*Xv|`sET( z>cJr7oz|}o$47tCELeOHqU$`Z69j=)M=%}nsp8yANon`y-p+6G-66Hv@99_r&m)VC zkl#2?HR)e7)fJhfdknLH?epEP(ckm7JZ}64lk??$j>7e|1xD_xIVzY8EhlxZ9dG<= zuTTG!&Wh*aA|27VQVR=KptiL(oM^9g;PT-LwsHHg`q5P9jKPkiz%e90X_z4l=R4V5 zG+K-i484lMDxiL0I*-py;o;RE5lU9Es?YR^N9eU~yrNgxPB(2mv4m&FX!~ne(~)H} z_k0h6>yakkz;N9_AB%Y>3@L_2q%vWCjHC#S8RPfM;gf_s6J3?<@Z8jKU}^2%$kN!} zpY7X)^t@#CyD)})B)FBQ;QAejbC9UZCnNK({x-gZn;00IxQYi-sML7jkl0V##fVCr zz`VllPQiBEQPL?Vf`cVqb1@(6CE6iskDuVu)2*Q=QO(nF0@#pO9kIn@H<5EK$3Ikc zgwD!xaV?V9AbN1H!VWln{5;`5bg>d9sZ% zQ-Y%fP1k*a&gn9p1$1o4>2vl-`iLaJ`zO$qL@teu>^avQPk+@mrkU`-|=eF zy|fnz!lbQ7*M~Jlh;_r3S8(p+r{zn`jAMR6A^^;aUZRPAf2!AZn!@{hJj@0Xi3W*{ z-8;~A;FL0Qi{cU4Xao<0bIxSQ?H?iFOVZgRK3-PnQ-shzG$-)USF^p>7Sx>Cg4f3M z920sz?y8q;IEp~E@W_?Q?^k~$9v0dF6cZ>T!~P!75v){J(tl4(5Rg2aSL67DyGwwSm)yjuH;Ddd^1K+bnef5hb>XEe-+HW^wWCZwfz}zHdh_p{WywdWFJ6|6mOZU8 zSK7R!G~rs>NQT8BNNg<`+2oqPtCfSyU7Kp!FKnC>8<#1aLayToG4{RP0l0XA36Pwg z8rV7zVQej1McK%^f9H;Kd#bmw_^1-&7Ckvj7^~+LY0G+27APAc);PQ+MM`|Qz)Rwt zjR?Ok(MDt!V$YB{#lq2~(y@75gRnUFYK#8`j_s*=aHzPOF8>^D)Sx;7qam+0_Pm&q z`Pzv!syZuY?HgjUwT4R?YcZuJfBw|;7A&MaAK1Y7M=6sw(_41h|ERl+YEy#Sq#Zq_ zjUXIw?2fRG_WuCDKtI2}xf|CMigH+ky1u5c8vR382*WS`}+%Bt`$fK zc7lMym6{`|*_DdQR>D%MrNHU@mR?~ zDT1SOLm@>& zF}|Sr4Mmx}gMu|yg4+tVu-bMSw=|7Vb6MWe0JY4r)596VwxRkTrli7VFDMCi>xvEy zimV)qOQpz21xcd7z=Kr-HbeWjPT1H!r*or!y)#7CsVOleXh#$U-#J%Z4Shj> z^a{-Dib^mg*iEV1=ka?gfO{V3_9GFl6o|4w?JkTD#aXHWC%Z(MSE4FsVCUbU2DvWk zF^T#^5()Zel#^qegbN-hGV^}wRDjQi`lsF{R6S1(k7acF_K-woMRgsDly%ETsCpgp}~P{7@}LJVz zLzz5*HWqJ;0D2U8xW;q`ZS1pAnu0&QefW!9fR505-fW$X14pwkKV3_h<`E3AFujaQLpDcA zXTAellxUTw+~W(_j!(i`Ly$AjToX>H%MDgg=QG5&5samq8y$qEBPf#MsRh~`-Z=&_ z$}ka*nv{svlNDRS4xA~rmzbn~%YdxV8%Z3;unJzVPRnex$k{1ROM)8!Juwc~Z-Wb) z;5Mx=#9ScrwLhEcO14ke6q!$H>`0XPUhBHMmehKGRN?&(-pZCEyx4f2^WKs+SBZy&h1b+Y1ni-LTBAy0qO(#!v`~4DtPJ zw;Z;snOc_vyku)W{7MjisxArHxg+W(rYY+nZ&3eSa(omy_4YtPhw-Qq)4Xao@5UPa z5Y$SE4O<2h7nAu2;6O-&dc<_nMp&O%pYV-WWGJB7cras**c1SU)iFC%$0KT-&uXb( zfx4c@dUm;i&G-UJ(5Bej-phcX0L~z^N9mD)ChA?K)ijWail}aXw;I#JFktz#YcQ&G zTLh3)!Lt$yWOSOyIUq@(*2jnnFLD2AEIl<*qho+?IXz}Xxr)J*1WD)A!CCF~P4zV$ z_4ATIZT^y=q-XGJOW+qQKRM$0icmQM2|Y_T{Uh^KppL*g@xV;DB%B~1vPA$F^?(|g zxr{USGImiZ-z6)5%*xAQ1~vjU(O{N;%BdjAfk#b{21FUmL^y#~!_(7ewZnQ~7*&mU z8J#TQ?J@PEUfO9pNOX~xIKB%V64MUG#|d}D={Vd$#z*2QLy4NPRoJh8fdCsv>-0cLBHmtRp;pac z?##3hEqa051tFBp#t1&POzkB&%7ZXb2>k>VBa*~Z>ZP`k5=@hhL6d$rp~bNa7#1a1&)BD^LE^$h zH-!W~GuVKWsGF6E2pO!fyC^-BwUoLCm@FX52GmpyvSLjvgBQ-Aqv6CfY|csu$%6PL z`Wvqa=n#7?YP^CW#Rc!{G#>dAppH!Go1}oFv6@2vJsZ zoLydlV|&qVVu_M&hNV;`Q?S{XIw{`vFaxAnl18UqiG!1PNjkbG57ih+y4;Noz zI|ww5vMKi2Y|aT5B)i(mgU%0dyLnE3=Q#nA$X}Z{;V^zt-z-@GP!NsbCPlcd5`=V^ z@QwIFf}l%n+ni#CDprWuh)MEPNcV2H5m(_{Bu4|cI(Pc&jfILzY!)X3Z-=tUZW-w01i8mKcFl zk_?nFyfg4Ru|;|YaegwX8ODu>(o1TD3qmt6UIrY9C{ZO0Wr#MSha(0~Cj7A|cngd= z+HsaCfd(4(5dSKs`=`;5Y*)!%C+Og9B-8$FlHGvt{diwkv_3t?M35njwLIMbA!5gk zlT-_O=0jTfPC&Px9vhv1hlmAL7(t}if$&O>)`9|cG(5u}>~e5&9Br~S4Qmxx>Pa$; zSWEL$Ii1Eg4>xZoFjS`e3K1fR)u9R!^F>Y~pE<%G(jVn+|Jv?~wNWulw%A)_{^^eC z(2aHYrS#C!pP12yt-(-0cLh2u%XFOFQxfGaot%YXjdDiJP&AQ$lXR~Jbw%oi*c9i- z|E+MVif*{AiBJ~9)?X$oN%475Qo>&H1tj`jYyj-`yA6f@S>a7>L1T$|$Yz*^1E;~A z17S^xsR+3dPf=S&A7)x|+7mQI!aAr3CkwWCJ=_gW%ENUlqF@>SsBRb=1w~0T;xvez zrI;ilFLmQ2x~#B&*o|uiXjmpD>@*fxdV70&9kG9iN3%OMnvj@d$%jeNA13BuY7%;} znb=@wSh3+0;S-+I?DDJ-GZVHTeo!|O0~J#6Pv!)8MSvcF>&YkFg{-Xs-eIz@I3lTR zngA@xA!_4T`*6KuQtU|gZT?b1(eHHKRMJ5Ks2tygMo>b3!}eL4WR|e=$6{2~m_nJF zIytIB#rhQ_0^(yxlkJp&9!R+eyT+AnjTI)&w4j}cABaLurh1AV2(YwF;85q-cpDSW z^gYSC5{dz-zeghK)DsjlW^kFsh6*C-&&o3pcRH^k@k{a~h@ixNDoIL@PHyxFar2HW zFeF%ecr!_VnXh4_DmY%-|v67##!?mg&QO5{8YYFOjL= z411BBzo4|t5!+3=3Ss|fXTUjidjqK*K~^&cQ75(O&nYRQ&Vu+jxe;PD4Z@`!SHXYe zLvrEpqL*&2+lEl{HAZ=PdHKxBO8o!w^76$0m;0)J$_spz<^GCUGb^jmcfQK1s#yh~ zJYN$?_r!FA(+bLS9xHKi{~=EiXoA>L0G)KqnqyNBPKb{jaJh_a)N*S-#4O&+h+tJVixdp`-*k3Dn_KiBw3mq--3Oj8!;gNK#1( zZBAh;v>KP$T=oR0LRo+^FCr-B>Y)2XX;4 zW;Hha&v6SdC~~sfSMJuz$visDbfD&5(SRlVvpoybbdo=RI*x8NtA~j?m`+qV)5`#q zbkoCWy1ls7^n_K97->&3etL^k4Z78T7|BOV-mzs_^$4ngeJC$IbwtIIEO^ggkq9}lcAZ8H6<7|G1ZjaLl7^z6kUxX{AVkF?W#Iq zFx2PB1Cf5%YiD09qbt*Oy37E+tv!w$2k6?O983pyOCe*W zzA)3LareV#BYz;wlC|FmF?q;%AKGO!12H0dE^H4XF!=+jkj-n^oT!xDTP-N#Y z#H^R%I3~u6vlcD@lHwJHLtaFG^JAc49LP0!wDjoJWRNJHrH9+ZwZmcCH2BtSTTce4 zchtz&94C7$Ojnr>6OV|C^Nx-4iI2?%roqXh#mb|{%VUq3&2=YX=aJc*D9br&r5eQ{ zdbmJ1wsCZl!qC;A$_2psn4-m^)xhrpKu~(*nvemtW>Jzvoj40ugPAmc z_P*KV2gL135|ldPGOt$yA9|%|Mm0$$OD?mm0G@S$oC+!ykm9I%r)Pk9NH^@#Tgfg+ zQ<~~R(M*)A8=N8X);NuI#O#IZjIgZNq;X@&(zoNE%|;l>vxr#00gaOdB??3Va0V+Z zXZB$l`5Z%#KCqiGaks~RZsm=22nUnFP&aPc4VbVG?YIRJ;G81_rM zbLQkH%n2kNj-)b4_>_=RN!fDRyb@Jo7_re>PM9p4Lzv7a8;boK0HTDd2L7s<&7%31 zS7X({S6&_+cJ>{VX(DN34H2JbmLQuU?sN@}xJtGW{ZY;M#l|+WDfH_$2Wq2YBYBD6 zB~o3M^$C4q3pPN1ubUK3Sinh$ZzJ4c3;RyD%}CFf=s+* z=9zK;#|{tT%SNKlvDZYN;luiNOA05rgLDdZK-m^ZuM?nuUaHnVZL@D|qq2;na*#di zKRIaAbx^0^+8>CPdyptYB^2_y+BA?#3eQQdP$6Qb_YTdv15rG2LuI?UP=KA=B`sqc ze?858;DA&O&IXn=Tw=-z-2)aQZW95HI;ks~BfW@_@Ee9_3CrzkO(tcE26Fy}%gBJ0 zTlApUkg)4C$EL&a;qd2%{L{gdbW*07c{L<-MHGyG9+N-9eshp!$s)2a&eMRlm1N04 z|F-gvSee(86##%Fh;+HMAjc28y7mP%wH7VPbZv+aP$Y|(w8tb8FHb(hVF4sel6vkc zk{L)swPjZX=UbHdge5!xDcLoJxt zAg05A}WB$Mqj2w&3uDM1Idi)@KsBhR@A(&MPQjsVrmV$n;R|oK%AmA$Q);qbBa>Mw|V_- ziAammry?y%PDaYKNW-XJT*+z^Cumu-l9VBTf~BqmN#2x6eC0Sp3CELyENX<4V^N%U zokr@2&Kqc(2fKzz>h6qH%LL%q*PX-~S+xwX!?UIvZY?GwV#j`{W`HvDrqFcoC1O}s zG^ksCU93r|s|Yv?C*V%ZWpu$f^<&qdp^4CRF|)u+#vuAbXIHG3B`{71IjO#?Q{@4F zM-$%LgP?5X$UrwM@}5}l!Ne+7npu)31aDqaK|D}mO_oG$m%0*cvWN^>N{lG3AS9&7 z`igd$WLUN91oc!k>g)ZF#K~-b=M5=EyWghR&OLm<5%XEMVKSEixWK z)PX-V!_Ax^X%( z3AznKDzty8K~-`GIlfC$!fsvM0D-UEUl|P+Iz1H-xuH6bXq0nXafOI6G%GiM*>_#H z<(e6O$xJbnqB&YIBVPbf3Y;RznuIJ^HPDd6D?tNFafg$p25G_}tkXevTc$2u1pTJ6 z^&~6T$rOsrZ0K$!}b|6O8FfXlYF&y|!N^twi$&V=jUX)tjnx?ag)Sa<0 zQk|?KfO9vPleX2CphBaSL)mSm2q?7u9^@#KLjUdN?f-(f8TyJdLG!J5K=z!@;G zrV#Xjum)Aox}ASsOm@ai=FR5HT{sXl}zHj0{V85t8G2M6XQ-C!Jp zxG!%J=E3Ob`Ry5Pi9xKowgtI^(BRxOw8J{Ks7VK%Mm5-2m?HHnr|~%CnTrZDD+{qo z-wr8@S4!rZ6~RlY#fEU!u(+3#4bjd1#b&|&oo=_X)wm}#ORH~xR}T-By8M~eeDqp# z0z&)S4$OJA3lxEVWD-{1e^rYNL7r6 zI%ERok(s1)uzPS~CKa4ze>Kn6h8iXc-G!-|6&AAksZ>FzPwnUJKo1FNm$B8PU6H7gO~jI=w;@4cIF4 z0>tN!_#2=V{@3m9cM=GA%IEP~sGgX5wiu*KZB~i0QtaC`PCFKB_g$*bg&ai0S_%ec=X-Y?6L=+ueSX{vX zyND&O8?C{Nv_X6eDRG_&vy`~*j98_jBn@hkJo6d<^cnw@A^&7EiBN+Y-V>*I{Atmh zlPTtZTXjxUT})A)N(0@Lp~g8kO>76VXpT}~%g{Fvk8;@R?kdVtsmOfgpIYtRFjJ$i zKhxiRroa0X>hB05Zikj@RX*$_sYl6HKbS9l+JBJQCYgu}z_OrWxDlahbjCKT)0FJ} zaJ>Cz`kBx4GoR^aKGV;9rk@#a{S1+tX_*{wbiz~`y*RM>+ReU$_;eirDLS)d=e1I>xK6vy8Cr6_^5v(a@dVwxg9COnA~OrZxL zqG^q0IgbH80{Jd?7mVXH4NG9WEE;b`63P;YrCnPSYxpEsjKK2PSsZfq%=>|$q4OGl zry@#(Za`s*4~V!?ILGJr5&qlBM!9TdwsCF_5$ATDZWg;p;YrIY8dP+zHI7?RNd;$1 zQ`oG?=#Hh#zylKFeXXzpF@)3aQSa>{TM<$aB|Vzt6m=#AIljvb#IO(tBZDzng1T!y%@7*}G{Umnyd8f@(Vt8G|{mHtQn*GMKDJ!Ljd zhHYq8WkZ9I)e2)jrGROXAqg6z#g2iQs6ft3K8H;4&h4}2up}0QU|c4`Zi!9?XC$4m z8dj5PT%Xo$yH3&wq>Zys-cDvgkxR9-Zo4BoWKIv?w7?}+m!Uy z9^*&~n-qYgOAV4bNfa9NBQtX|CvYlOS4R=RaRnH3xh-)W0D!>gm2_nRY*HWkS$mUM~pPFhr+`^3; ztwbP&&cq#szytdGS+4)WelT|~D7SSPLIS%#YI`Huip$a%6`;dzsA1J7E(dG-jZ4Jx zW|LSn${|+8CZW+B8ero_faZKU8Ome6@9!@J{rxyj-qDu;bzT!OYciUD{%{>EdzVfi zH)9>iA~77X4@zJ?&oK`QdZJWWi;(QvVBCQE=yqZT@RgT4`}d|9F3R=hFq*UDd0>uX zmJ*^wvU!-yYUp5^dfP(0jfY$lw$_d@z?_OhG&zrQQ{@otcS5j zFVjtBQed8uYpCqGe5gYs0Y3ZOZNP#cj^Gk>C~UF5 zB}9A$I%1r~C}CkqZHpdGlhHS&F4A8kyFp2J%XB!vX8g>5GcYDzF8kF=d9gmr6bJ}L zT%_nmM_jkIV9c&q8@9mWC^?$2!r?KJblK9WUP-*77XgVy-q9FFoWoO194bu`h2&{v zm}_97^U!|wOw2>_#fs6emznZ0Yvnde`Kod_*D=!PfA-Jx&q~byJhQ_0S^np7c`j~i zS@n|C?M;@VO~p_)Pb4n%J&>WeFC>C}t;|apqZ{XUw*)nWzk;1`-4ZeoZf>rA5vm0jDw>CwVFF$*> z5Ftt|F8 zEC_2=4Rb0t)M{Ewdo5qT++Pt~u%dNoRqv92^>y_fa)Tc1Hr5sU7t{&MX7OF&r3-t+ zrClKqi`;p`2DCM;LEmKss^we~FQ>}^}w>+4(`t=({Tu)Zp0v^V&C>(=w@ zD-Cr4^hr^!yK|Mlqh@7;K1*2G(hg^e%NBGg3p-T97hbfeVHG?($Q$dr%8jMbc(2j0 zVo_sLV^|L@Z=0!yTiREukrgYImQ_7}ZMD8=hrG0=N-3Y!P~J6ru^R8Ltm}wZ1>+uDROWLK#%;u^kwO!myj<2X#->_oYqV8oInt8o#aZP(Xw$3ljiAI*3%`KADmKc=J z?ro13`xoebMGl@VcFL<}HOPV*UbRH6@UL3mT^U>fwWS+4Be=3%&=vXYMOu7+7Ub8p z$x3A;x{hBNi^~mje63tf-6~kVd}%Eop0jSr!tx4#mssChBe!cyRxMi;T(YjAqq$L7 zTv^}IyR_Kf0B5f9tteky>~H8<)>#|s=xAs!_BWt;EQXD~c6G)2V*djF(r&(X!%B4I z)-8%HSQ4pR7(RO@x4vr@+PJ!Zs$gfsB94nJi7L^G_VziPzfFy;Y?u|2)ZP^pGaFZm zh9-8!YAa?|R=`-SwxTv(xjqOtNUa@neCu1!jxC9;UlbundR1L~c`UR+?`~SytIn#G zXSaq{wi-g4=BrX>ubi{8d|6X0-d5SvwWJ|FE7TENSndz?wk=!e>n`?xH$*EIv=sXr zX4e!~)E4_2*sa7@6#Y!_PDTAIZ`Z6SC;$bGbv2#6H@)-cjcwO{@W&_K+fnzpc;=MT zPrbXZe!+#0Jt{oM-OkOtuerIi{JL*M?pX5PmDe`EbJh=kRCU7*Q%?QH^{4xrnwIKa z@a!92`rZ*UgLnM(wA!YB$!%Xf{@Xu$`_QAGd-lq2#U31d<-VWqoHVef`=!fv_B^wu z_KVL}HviZBkG38A&3}Gp>L;&W_@${QUUbn#7oGTR{@WK_bdj{(S5sG4H}kbEps=v; zMz!h7#~pW7^XzFCU3Aft(@vgTS63%YzWnII!oqux-f_fn#~t^7()pjFW=E_nJO0+& zZ|4v0f9ImhE_-~>OZWM@_pF@s_40ygS06nzH1x*qdy4+}%jhNFbFbe1=Rcov-g)P# zJv|Gb{+|2UUq)9Odv+f;G&EFxebd*=0|if9cG87!yb*cqi6?>w_rLSxlTUs_6o0($ z_QlnY4K4c0!HQ{rmmhu9!M|O%_R4FnIe$t;2$Yn3;pXbtw;y`w%LRp;HZ@QS}Y|KpA)pMJWQ<4!9({)^wb(Yt;7_62|a+uvS$ z{>L4&H|#6%`~7$GJC1qm@yEIUxoJ-Mjn90&GVTO1^5&b}pPaeifADPdQ%;`T{k`vh|8n^B_qg46bG@&gchr|pK6%pBPo4kqzy48F zTzur#p#wkd*!$E|Pi_02dv*E1P~VoOX_HQxIqA-`?_Z#*YqMx){D0+JhtiP>aVTsd+*4hPyW^V=D*e%@BO7-`r|K- zzU$%lUBB+xd->1Ld8n|m@~bz_jBcKH*;^MMy6W`(3$L9$?Zh{(Zk@O7%F}AqopV0~ zr=NaAV`Jlk-S6D6Z`GHy58hh#v$b1K-L`GpA1c3pRD0nukKaD{%^Cg2zwm9`xaTih z?znJpU}(zgPh9q$>#jTD+zoFQOE2A9f8g{BcRw7j*uH)Ht8cz}^nEW~`ioywzIpW* z_FN&{Gyf-F+EI7P&sN>{`QL2#VEZjs%-i(fgR|e%Z<;Z4=J9hk?thHGV(tYWeboD= zzUC``2l;``yQd!f=@&1*`0TQCAO8BCs~>n`_dWboH{39z|MEL(FFfWnzyB-f<*wV7 z+_rQ5(R=nDzyBY7=)WI+ID6Ws>% zO`A5ANB>xP#OFU>=<_W-aB^*6Ahu&@&lQJWIOX8MGcG^6V8<0x7w&!eH^&`!+_w2u zcYc5I;>BM+_0-FM``d5aK5*=>mfpSf0)F6^{J@uX49V+1_WAfHCVlkr$J{HA^zXWV zy(GH#<=?#V{EsJxc7EU8zo~uqVE^4)FW?6DZyQ?E+jLWP%=O44kMvbscC&lcy+?fW zo8SECod;gIwe{Jm{r~v-p1b7TgZzWqfM?FMAkRO055MrQfBoyC!Qi4DS4`bed+glv z@9%nX@!)?i*|YPW-D}_3J;?uR-GFC**0kS;Dt;fjZ{HLT_xmlri#BcAJg;`e?!kZE zy>)AF;D26Ucj#BoZ~4L(zVO>$M*r{DooZ=mY3Uo!-g4o-DZl>h&`nny`t$aon|5A% zK)=|>-Lvx5*IqmC_rGs?vtv#Bh7HvZKm2gpx#xQNH+^CM^h*xiGr#fYy9Qr>+j0Km z!Sfz^=*;*3^{?An*NZ23)_m*68*hBN|LrLUpF3**j-k_kwP4_aQzsvJKB_b*JjufBXDBSDZfOSMzJHxVYi66Su9qfAL_=3)ftG?GGETp0+DI z`^baOP2In6^QC_pl??~+4Toqo&y z@RL5D_SZ!x&(Z1*O!`Uvh7Hx*w{O37r}~Bcw-2B(?wSASWf#wSrEl^VPw-qb?>lb= zwtf4^E%W++y>CkQ<3rDH8(Osa*#i~NZ`u8ujk6AX@b>in&%f|!#m=*TzO(m{gDnRp zJro#tiyJuosYQpTgql{~x%?OFUf86}Zf{z(YRVsfAr|#t@XYSP8+K1^^e-Ox)_G4n zw#CPbyY-rR-;u7|y!qQd_yKsc;>7b0{rHMQSDk+C z!Jppx$(G#@C{v%f{FF2LKmXFUr@dP*{jZ~rSv0uRyJzR@-BTOe@7em+HB%=~yZY$H z#>QRYD^EFn+O)#6&RTQe(hc0e6KJKI4lTQV-1~Oha2&U&we`Ar-`P`A zRrR&wjyrBw`1zv`R-C$j;pWb__O|@)@{4!vYOn12-=+hTv~N9e*-5WIaoI_`!q0Cy zH06YYMU6A|t(XjdcRcpME8n~%JlMY+eKW8Bz^e!MZoO{aEz9@pd=RbYhg)wbIdj_I z|L5jQUb-*5WbnNQy7%njj-h=GFZq1j_9OOxy!@Nh2QJ-u?M*jLYJTq3 zy?d{C|NZxWvUTWb@78ZTSJ@knSABG(Pkr?pCs!L!o_qUSPyGCxhm3ze;YVlrp85N4 zpY^-TFWxbA;N9=lwT)S)E`|p4IM`G{4o|(0D&6>Xdn?HE{^+&(@_o;!`Uw{2O$GguCymT*o zaQ*9_U%X_=dw=Y@>$Um+{`lCwzP>AOxM9Zo2iv9|b z;L9avPCNCRA8|L$UcZ2><kl2V~;)dgCG2$;NOS#4*XC&ai;PzLhc`Z^bxu?%l_?Ye(vsdFU(l;aPQKOdj7ii zlry`3C*6Ez&-c)lU2&)}IIyQxx#pC~r=EK1lRI}_H}7>N`lknvn|Afl7anuUw+9EO z{_g3gue$cyBj?Yb|HegNk+KlkOylmF|dFKpVfWy?>t&NSYC z_`^?5_`@aMM^=9D%B0(yuGju={_2m5fBW#mXTe7vUUBowgLl2W_ot5yo!GE<=Zd`_ zE(;EP>6YL9>&}*!d_UafKX%fj^Iur^_`WxvJML>=J96sOsVAS=J?Zw=!JlvNUH?p| zuAyOhf6KrA{>-EA|Ly6eYt~#^5&oZlA3Xf<$vZAT<wcq@>_}8(2w=dYV zY12=pzR%x(_C4!fnDNm^AHBN$yI(AEyB~k!*;|hL>Q~R-y!k7CJGW`ZC$nm8*W&19 zFF*5e?Ct;k$qCQh-}NFoXJzO7`l|)%UmiQUHy(fOch{b=`=Oq_(Y4>-c<6%{e<+^# z%}?H2ctn^MlXddg-N; zo_ghi4NG79^Y88FYw6OZi~9y+{a-!dgx7c7w&d=!?=1LM*NZ=2c4*+^k3XK>^X|!I z$3GqYchlbulF8&=YjX$eQ57u^htOP!gGIE+kDL_lQ-_)Q}fCr{kQD|N4@dqhi2`6=l`ao z+c>!Xp81<^T`*9!w7Y4|)^DEDeB;b(=Y8koSHHjU-J1IP@9vv&e{kT5$A=beb{%@5 z?j_&n3SN8dwPmm9O;22ZdBY8xmfq6PIJk8Bo}Il2&HZ@mnWb~5E&tid^Ddq|eeqyT zw=na@<4!v1jQ)n3@1FlUH*k96ZA0(gx^K(fE6dcL9)xk9eCC;VemUs5Bkbs*0900f z_3an$LSKN>PWv3e$zMEJaSX!Ad+w_K+m6SE4jnvh%9K(>Kkit6dW-tcS8Lv^cp%Hu{YM{v+&EY> z^Plg%x9zE`r{A_S^5y-v&qE`hUE#L>`q`RaeP!v=rA~4f zX)5^E?YG~4@80u&W6O@ec9sn~ytK@z*T{1&X5l_3wXwUp!b-HCzAtq-x_0(0@Vg zJ@XF*2Tp(Ljzd$rn+m>h^|a=;<;$n_e|}j+U_24DN?p4I_0Hx02h_4W0P zt@+chDmGnm$!$)y=IDYFxBI&{-guH{&4ZwS(~>iL-aWap`Oy#Fe(|=}^)vS0ek?lB z+INR0&7W3(fbRUc=bpQ0$&#z*Jzjjo+bmh@ordPM=b> z?yJ*UzhBmW!O!oW{||0p;PIiGcD!&v|CR4^1@FCo_g?Qmw;grW%{ROIH=TCM+znrS z=a2V4`s>)+x3)f8y#F67_uSRJXXia@?w^0%$&(Az{d-m!Z|*wslH=W*=RMwbyl2f9 z1_lOhI^wtH3=3H>bhyS>j|L=CgsO;+5gO}SAI}? z;W1l(W+~s_SGpLpz9(LA=%u3$zP_cP;HIZ;y;@ven|064e*gJo+T>05Q+#zBNfyaGIzjN%oj|x8gbI;TtwcNaE z`}PHI>PGSW`BOW7)U@r;hp$`#pZ;FsAirqO-gkEozJAZvhxmb>9loWPz^A|W!~TQ& zzdmUvSa?X<}Acl>|$zC0eP?|obgN=hpGb{l&b z#!eyoPIi?rX6`V|W@hZ9MO4<5C`yz>DcWdLQPD<{kTxMplnO=B?{#NkEN!3n^7(v! zukIgZ?tRX4p7WgNJllEhJ-o5pLR)U!Fackjb#`~(9uqScGIfD%w*>VgwKZ{nO#o{| zSG-ke{dr*3D$xy>f=wGwZa`okN=1$hcWOtET^_({+_`(VGIpVeO5iJ#RUfJ)yXp>e z!eFqJ)KplMum;-~Nz2}3wxs!&R+8K2`S|$szlvARwawHN)TPQ985ybg)`&t8X;qRK zrAM#1x!J}zX_jzpC!az}T3W}Wi0YCi2}_^olkupE>vmb% zo7>ybCg$dn+S-B#R))l8W{TLzEFJmuF1fne;@*CZ1;<^BDjpZD5B%JZL}M^8Sy|2t z7cNxS)|y*d&SyJxL7opFT}$yS1>}K8?B^ni5|d(WP8+3JR6gyCfYTjl*>T zpoRa!+A_=fpGUldBBIbw&qDI-mkZD`4Nh~aVrK8x2;i`-e{f>0TDMa*dx=5njj>19 z5IK~0S3ZgF*Ti$#);~Clbvj8Qub?5*)s~^2B&WG;BpukTMu)zCj>thZxD6YOz2_MR zTc<5UJ%O!1+CMN5Q(CH}ZfkrgxbH!si-J1-iSvj$c@~X7=SVhPkF;Jy&at<*my(g0 zT{e7(4L~4x4<0=DdF0J0=~~IHsA#DjqXls&Bi=|eDOx5XKU#F@&X;O1OB#yNwv07% zvw1CjAh>Rcsup<_T`j-nQv&GeiM5mx&2czIOzpwM5>%DXwN0~B_Sy7* z`ea^}BvyAGzy2()dCA+iZ$DrC_Qjy=(xt=T-MxM-=aqDSgL@(4oM9uwEvUlQb}P}C zN>%qkp-Q5@1f$XDLub!Ak2pz-(FhS*S{1W(^ut|c3oEON1R=G>%a+C19nii0?3ox6 zi4;`#TYL|r2F2bQ0gt__lEkX3tFP4^HV^E1B;VfAkyBi}m_MHV+I;~e61n`thYzHl zNAjY2;md@7goK((P@Jz`y@HHE#(fO8u=>25oE*Q$CxjxSq7dln#rHB0b1W?_t7~fb z$HbQV(x|zxC~5vmYkT{u)8JhdT$9SG{%dpQEm{qus%C|M^XTwHtgQ_Sv}rn)n>+jV?b|M1 z2jA2k=7c-|n9P#w!DD9#z&Fd`k#yyLJ8U-37{529})1HN&D(jd9N}3n7t6NY6Io%+{^j zKVUg`$ozDZL_;hpchTb$Yqxq{32&`4moWA4$QsbG;}a2yKd2Y+s-#NXI5P6`fX*Zr zLWy75GvRU3dQ@*yiG{6gn!fp?9OJmfLP9%#pqt$f^B#7V%^eC^@P(oe{re?Cbg4$@ zx6x05@2-6Ed2$w87Cu-wpmUMjafk2n(31eax?FaCWlzPZq~$b^D5+}fZPMs7u__ad z`Sa&@)#vj(4{cirzOZRmG&MEN(8LSRo-=1xMuuEe((+=+?;5Ha>q#0N<*S;zsjVu1 z`Eba)=i9e$f0@1C)m~a!dL9ptxwrSB`m1qI<(j-IOAJ~{uEwIGOUu4yWFSx+U%!4W zCce<`cG`138-*>BKuj1O- z1_lOShgyga^Sgwbnchk zw3L)vcWpna!l&fgvu9$%!^02r%g!zkfM2_R|9(gLV8Uqk94Mmq$T2WZ-mzuN?9X4m zSZ5nHKu)-+sp+KbXik;MVY5W+mn!T+pM&$;* zdHlI8+2Ba+A>sDduPa(w){k(1$N5B$K*6a46c7pOkfoADbzo5(4KO`DX!Sqz)t>vM z-T>;ODZBO7jZ9+sj%^DBtg;P*ioLJTw#nAtFv5LlBINS7>3x1hWOQV3xBk|i)_uMQ zuZO&dlARQ*smYvhRake<|E89x{LvF9xar{@rq|vUikR{YuB}G-+{-|Jz(4ush}`UH zIF8u(HMCm|S26YoqLX)I4!5ez=`&~Q@~j2A)v7tl%ggVKy*dRt0)P*q83`dfQncBFgV+B}EzNbNC!Azx7_ z-f!{>x|2MA_wAS?N2I!c)v6aQS-O;0TpS){cBR;$%{yAk^5$5fQ@G8ZJ$nv?eSH1U zH$_YX`*1D@f|E0!R>?auG6Ze*t6Pq6pFaG)tqL{R(=ZLBxLD;#e!g|KVep>)`*&{N zKCfG?CuUR#nzj{#A+lhV2^K5AUn4*!ibH30+pWYv$Z1sbzd4qF0L9OIBgc1~M!jkw zUcGsyR$n2?Y%AZgWq^T!*9iB9p89;A@^51iOlTePFPB!*8~D6^dLctE;{1Tn;NHD^ zIV2>q@4N^N4GVJ_ZSIw|%UbH`M0b5Y>iQOTX2O;tI`rw2bJr=EJ4rj{ zFO~8B^!C|9-$(I(H+?o=y=w6I+Vp^d>gw&EwWMiH)1m(*;g?T$s&f zVP_Ycoh@;H=gyt}-ZQm6FRyK`uBo||Ya0I`*K|RaL9}O2J-!%Km6Sv2tf8@xuB*Ef zPopX-D~)e!^?O_n<%N9p%a<<~x_;Ut@3h9#b7M<<_ds{OcI0OjwwFB($D!!c$H#}% z_eA3)U1M|}T^Ehr*hypCHX7Tu?KGOCvDMhNZ8eR}#x|P9{+@Sz&yV@>tTk)hxp(HC zefHkxp4;P@E#~o}s1+=K$8NsXF9`4EmyKLshi#>hXo2~Eu-m1k+iEZjqtMDj1iM-0-O(vZKJPAvX%;*E0Pi>?`=C-z5sSEy!-J63=4 zxcFF&K@#Pv!AS%KU@So?(}n)B&tW>-&ODiczlwN&Hzt|EN< zL)+%ONBLrec;1z~pWV&J28vc^#2J6- zC<%rM3JPXLCAzH|dRj`25DnXgqnNiw`ZhGU2(@sqx(h8Y{%N$dO-jBV_IKo}D<6QV z`)5%i#NCmdlao_tezDQf#B;EDo9Y_G92{%tBGs_ASUYSV*xTFQ+Z$l>^BpyQKudK3 zsF;jF>JYuaNOmB#wL%IrC%yF_CSCpgYf=3}ZE?Rj*-$H)CWo_T492XgVfE_E_P9~c zzngaHoNJ%#_}InAgY2sl4Dj}m(kvlLMlIWESdKvlYt9&hYe z;v`PTZzK^jTAS;2CW3SMWbE+0A}j4QgS&zyJ6TD-3^lTV=Xde(7RH4Ifc|~ zQ_Uakai&?7d;cI-*51_AG`zS$vu^5gQ`}^=)U{NZOqi36`VoIXRn^d4Nx=V%sSaV3 zAwu%VVk<HyDao^i|;a43kRGN{@k|+wHFcc`<{Usw&qUkaAdD zTr$(vFn0+L?|aww;3Ld;l>c=NuokhdH)SxPFJ|Z?Y$NzKX{y${(MP!?!Vo#@$1Bh1 znYbE7(^NAI6HEzHAvHQ@vjLYu0Us<03bP6Rb1N$=$gj@kN#H6yi36>)^_R=8JR6Q7 z>wsG34+8sPgetVFNz>qb^k8+seG+#)``5GmJ0#?^IBb;C)(tJMc~-^qY+K}eG{zLs z<6^DobGL7R1rhfn(Wt8DvDG#{!F!UHUbis~F&i>`e50G=l;BgVjm^XO5_}M;S^1WC5LsL@|g(+Nx>N_Hea>q#A6afK&?@8CU z{r+*(rvCmUaMG@GGf0=Bu3`$|XHQbghQq_dM4F%Dpl}(t3Tw)5hioqx#kkJn<07(k zb+p=Vx%Tik_+q)T!`>H|U!cFdjk%Axvk}0vYBkq*{OuQ_PN4FYRuB;M*{P zS>a957nveH-*^;{(n8CoCBnt%aHsYYgEYGr7Nft4!>!OY*ISfoe0B^?Zjc}VrC>M{ z^`%n!s~OP%*ED}}l4)}C_b{I<$|6r82I2rlu}dG8^ZoPJE^6P>Lb*R&m#Hl?l)W^0 zZO*$>Zs4&}wqL6OLPBo`^Hic3@2cbyaaIDf6ebf|0_!QBFubpL*&|c_`%e}Ba=aE& zYMM}B>zkUaPGD+q@%%7gzmsELO%;7HHJZjn>Il8-X93vM&^Y@MVFcT)PYF1Y*E<$hDg+v+*PO#Ur+1?&9EJyBzkE^2SZ%;tJ zW`KKcdhNpfovf+8o<(|lV%5Td8wVw;3P-4Z?H6EPTU4}<_Buqkr3^Rj`y~j8RSBK5 zxncJq#?Q$ITW`jMux)g4&~)qE_qBD+(zcZ=CI6y!v{s+i6_hI>ac)a~`}R$F)sJX< z&&`a#&NmX}^>m?(Iy8Sxfj@P;)ZBv7-Q#)c@IXNRw3<|fM$f4zwl_BR9|HWPwl7Su zJq_S)(}`PLFD)j#yCs% zd{@O5C(7o=Nl6}BMMW4A9;p;j))^&3+#;g3T4{MdtE-EvtDlb((iwDB3)QsrEU$9! z?pn_bk`!=g8tc~9NYqS{3)t-FspB)cfUcd3KTSrx-#o~c zTc^p;BlD!b8H4qQNsvKng;pLM9X+g6`@u4HrjR-*=o>u4D@~-vV;3_O9*U!TzCGH_ zXJZ^MoS*Z25i(MW+k9HuDYO}w(@PJd-~#>R)cBK=zisJ#ta~hc_UWsge|}B_oxst3 z@(ZBB_$8M1{_`yJj1D;a{EW5pdH-a<;o@q2Y<~HSAf+YdYVBwQeBXt|bf=UR3_uqR ztlFZ;CzP|#9FCvPb_u(wik7&ua#G4=BE7I3t*T zD83H0lzvEf{a~GAg=%&y(ABHteOd3!?7*)<)b7%R7L_QkT9d8H+y!C=Sw+3|Vx8s4 zZLJd^5%#Tru(7*wu%kSvv}s2#Epv(LY5%BX+WofXUD)uVtL1jkf5NQ`s?o43;TXzkYe0R{XliVa%3>Q)I2ycG zT<%?v^v?55s<0x4!T^<(!eyRzvX*R`2T$-{Et;Oz{Bq&S2z(3-0yGkmOM@eWxK`#0 zoULL-F6k{lmBT&MK?TH>rKNp+CV|m5`E|*CefZ0ZgSu+#i;G&iOEDrU!>{EeLku+Yio@oC#xDfEdbc&Tw)=kq7`BU_=}isG z@@w|@=BA%PgfG~Z`hxTn6HP*4p#||l8#Yq&zoz`Pm%Xo3jLJemA^BiNoG}^E4Gqne zDuJ|;Lo>P6M}eGd;=7`-obn00TR0A49Br!Hk{Q;2@Blu$HK;IXJ8QITR9rS$M7y$r z%HWnI*IBl?R@EVG=_>rt5LjE0pIst9KKIw&vZXj-b?j~-vvXiWd0(P6`;xqp=loN= zoV21E%3AbZu2zpcUYEb#D(YTxU)K}EOvVfQO!}3yBvT0gt{@=2P~(VrKU=;voMVnNs1s-_cXW{I?| znMJY936Uqku5uG|`)+zp4>^rtIT`v`kHC>|eho53!dFk$5-b;wlW*q@<&m$Q41bWeNoT{zgSoQc*as zK>t1oLm53hIudFZxe?rT8Azl%18Ca3hMS}qe^o`EM`}GyKP_+B@?2T!9@a|@Tpmnx zyDJsR4fqcy4jpugAQt=Xk`u7$aDu?MBKHi-g4;tUPPK?KzM3z~%`7R{ir?B#x-%Z9 z>nI(2eMD@M*`;WO$w{GX*#TaDUWd(I|1Evb2Sg*z@wjSL_X=;HAPC9d03_rhAM9~& z+De-zCn1ivK~_!m1m|a%87kfORe$P*eWd+a?NN>&0`qo{Tx!I}nTSEFxtih39Hm^U z0MEW%pS%c(5bcWVdaHwllcFIVvORm1TY2xPp>+9!THRl@?Tp27V9^p}#-w`Wlep)4 z6dP38i~ctQdH+zVK>^JGVAGfH^;F2!e=R*J3|*Y8o?tz)2i|?G=Bs-CgQ*qQhWm#l z)e|M;=9~2_`$AM4WP5)jF}M~jN(O4ME(&&ciHjjast5_jh5Sfn4tG{F%*#2Qwz`){ z(pM-~nMzKQaA%cA%SMT}DWx}kZVDZ(wO8XP#Jdni!uCKy#yY^)RP;RDitZXunDKgH zI;+}Hqm%Uy;cM#n+NSrmriHG@sPRe=WaRsMF<%Juw>b-wC*xo}_?GnsWS1C!5V6R} z_j6@E8A-z*;q5v_%3me&O} zYg>YNLe~ChB01`Jg|Y!?7Tn2VgdGM?Pu}l$G_bvg0zlrXrn|4yNNY5X$2sbfXB3mo z&DfX*yqGPOMqt7vxIr&>Y#G$A)`u-;_m0_ZC9&6+-_&@OTNSm2vEPVK(IqCX7&rd> zeR8RFD79pwv!KOPJ37Es?NFL&@a*8dyOMNG@ecWtlGRN)!gIBhrKSa%><2?PciKO# zBKdz)wt({luNfTOQpdN&6Ff{z%$MC(d&T`MA%9_nAh15SN5_!|2;T8?-xalz8imTh zl;LTnc515zg_2(vOamwD)*3_V6&-|xnP_8D+XnAcxpWrkM%&$_yZ_}tnzVZ|0$;QMB ztK}L9bG=ZO^%B(U@8NNt>|Gp{wy<>?N<3Ky^xjnb9wK0Z7PnQ<*7lxyxxYEh-M#Jm zvht1C*00HKrS|aBsC%D&-+N7WpCTPH*4sB|VR4ZI=U&4H#5z7YXgD0>3)*zJ#9OyS z0d^~z`peltuKI&->sZS;bIj{7HYjUVNg#~`A!-*t>k*>_V(r%X0S+o)4o1YowN$_8dZs@;7XB|&u)(d5jQ_RX`u-rN%F`C|G^p7&Y(+CH7tc4qa_)t3p*LKI(2EfeK>F@dU%S~tQKlzK(o0<6nXC&l#V*&CPj`mRXVE;yj}ggp-a2n8X4F7pJ|GuptM0*zEZ)1mzP`}Jwb^$a?r|QT>*?J_3R_Qu z!EEnrKkzo#JP8P5nDRVXZTQ{^i`|iP*B;le@0Df*oTgPd76Xlx~!TbnKjS^lxJEIp)aYT2tH0~q2iq(H7ALFl2 zZywvFdjt#nwuXlfT^w|Eb-q&Qa!2sAqAlWdA0zMX&4pmQ=8qF5B9~q#?aF z&wZN14I}awUr6YmfneBc>K?Ak3TOLOb^YoezMg2RRbl3hXNdF*$d6(ssw=^VRHdc- zNk|&(iw$x~5`c#>Xp05y_}?$@VbV_Hk$IL#E3Imfu6mZ$f3Vd+@W^Fzx<*Ii#K*=S z7OEa0g`EHSs!v%rQP3n<=gbQcRA1kqL)F^S#?$V!8LQVuGIeFJlb4V^nOw6^=U$qz zJ~0vP2*QA3ui!+3@Jk08#7B(i3n}x5?O&6%tlL5TFPXYO6CRRfN5ahB-zjidgQZMK z@HgvJNc@Hx3ex{x?5!R2Ja~=PUBiEIU&2%C7;AdO-aFh(flnVE62V8 z6j{Y<_I7o*gnDaSARYB4R-CpnUFO8q);7E@`WaEy`1#h%9=3xD`5Z=ng#S68e!ew8 z`kv!P)}K0+G)sQ0gkQ8ZZmR{!4OW|zVgV6v_ZUD0aJ_Prru6av%&EQ`UxFk>?n^C1-$ zh3mfMXCa;Gk+|ZJ%IigOnUdg{EJHDATI$FSsA~;KB@Ywp)q@w)OIgkn=5p_{K2~I+ z)zOgw>Dw+YE~3G)Rnz-=<|iKvogwo!R;H$|qe6OpRYG~NZp>zGjUS`k(`)tsctdZI z=JGP-6ShK@y?=w!4Eayqc4%%;dQCVsv7Tt&S~#xKsWWL@bON$#h#Ots`ad5j_`z2q zl-BmzgZJ&(0-snQn@SCeRzp)$)kRYf1QfZM8O>GTf4m_Y`}RAM2S9 zqnn#&Zr7`)yiSIvygU*`769UXSyy`M9F9};Cr8?9swPmPqS;y^EOBFyGQ?c|{*{(i zFleM^WIR4miL(n1H!3SDIV9v|dpw%TS_1h;Oj+16e;vb{5F3$SUnFk#x>*f-8p@>f zYf%*x6o7%%A08ao$H#B`5IA7sYXAGUDNvo@p^IeRz160X^0XW!2gt~^T_p&%(=x@m z8PJ*(Seyk%i-Ln-C6?Fq))y3~ZHr#vGeiIPjHBNXv&z>GX9n1snpm*+WUBKE`=(~R zXU+4ut{~rt-MRE5Ta_&OgkRTjgIXz-A+$$yR!yRn|ANZ;B#uht*qDIXP|KYD;RRI` zQyiXSuE_<+&Xc_jWNGPEruaTNTQ0sotas_XzWgm3G&D3!8~L_nuhXbr1e*O6N6bC0 znccfn;QQB1XW9wI(^Cjb_#Z*{#2u7(lEcHpYQ;y<(a~xC1h42%WM>$z?&heDR-e*~ ze2m{<5txyQYw6up>ckzW{vVpqIY)f%{QYJFqU3{A3Nb%d-QD+g2n{cBf$rAI zDE1e*2}ISIB8Zrfo>+y~gcOyATL+uL=jLNBPfyPq#AzK(%E-&{>A2duFEI(8;#kGY zfP?ep4R8j0&zk8`K2sGFgAf*CPQxU`tB_B~5$Zn#gP_|7CqEx?4O20GK~I!fi4%rtj?s<+vL z|F*h$9`xYZiKNbB*Z#f%W zBugvR*ZoF%9NtH4S17vn6AVScj?>lpck4vAN=#BGNy$995Z~RXO0we=3$3?f?Jj$I zIp7wD)&o%t3v-&@<4yg~G5Vq5DAxRX2+6_bi5sg2^MNf-)`P&y`iWW<1nFP}e;c6z zHpai%8?q9|@bk)7{nRcT*OKC5efl->%*-U$SWmNwg+`8D33jpEMTo%)Ey`&E^yLYo z9Xb#3cAUXFtV`DKoQqA0bCM4!RVf-4M!-^wc5_3I9LMmf<20Ro>a7P_fN5oFvz$|eGA)(&EigDHWE5lbA@ldaR{aB_Kvq=O@Sff8ueuZGl$a?>O8(I1aF$Xe$vzpQ z@Fz;gL`I8)0%-*tb!S>)s@+~Dz$Ms)Nk&UQ!7Ct8{dKWva(r!VV8CQK!}2PP95%|; z&Fc8@Q1nsQ@2%bL@u~)u1!ABp(8xtCXFImGbEy06ts(P?8kC`ZS8hYE748xFlakqK zF_HRb#pv&m5A>Op4)fGHup?49;i7f0(AZyFiY`M=PVR&?us8cCB=zqf07?H2vLz7(~2V_}s^K|)>2vth##eaBvDmq1?r`FKDkpFJTp99acE^Sv3!z;fw^i@^o z)9EskDQeqpS6O+_*2}~Y9I4YHhZ)!JZhFKF6|&=(jEzpC^(0GXytwji9L{Zca@VQ6 zs1*ikJ_}l0kuk$lqzq5yQ%%q91on1BF%xC0VR zeoE6{ba!$r+>KOkEzEV22G7T@x~WSf>P8c<{JP{4$+f0)HIA{>brcRC@-#3Wzfp?` zPqd)AeUp|?>&z74`IF^HP}A&M5^)tI85|tk5l+0Cbmx>{BxQTdyFF5F(Ca!pu%vOM zAVo(6T&euFbaFCcvWQzuZNL5Z%Xu8@xXbHW?8;1Tq_*`>lU1Egm!@Hw+3g4+hO2|V z(^j$=4m2pEvh;2&&&nbwYixA=YHElb?`|6+q+1b`sQ72yWo=MRSGV)rMa43Wg!INN z4z_~|IjxM~XeHnw&*IJ$0_B^pS3srjB8iU52=&!=>pyP&s;D*{;_6H80(zr&U5p%ENpC z2ov-4d;rz_VD&XLV!piG+tCoj+uI#9T+kCIl0wVG6i>V>jv*u3*_okNw97ev#_n>$ zpyi}ce|5OLoT^xCdfc46^7E6eaJY1;nUs8X@xZUU*c@?#M<52bIn9z1E-l~7Qfj*W z_fJt^s#!>CW-xmJHE~8-3FqYWl(oVKU}>XrESJ#|W8V~JbHzF`gqb&7xX}($>zz3n zHD(%j@+@A5$}(d)`^x3VY$pBI}w zL&MP15YF*tUP2a&TOCcqx0pAkW5JGR`&It3^qRQ-KCc&laFy9}b9IVTFmN`i=?XHI z-LUnHSrAkNVG_{JIaZ_HFwC^g!*C(C!dld8 zl{SAF-O|QhLD0b!etcNsbqHWqOm_J}K%8%bw+@n#!M$PJTR=eQrk#Ou{StHYWyx3d z&F&1h4}rc2Y;c?n4|Ly5j8+>Fm2*SG4 zun9VCnF|fAS)7Xl>h%V8JXc|GuYtWP8XoQS3G{DK-d-!FxHr^Hh!XfU5XdD*R=xhNA~h#|@81 zm<)Oubd{A8$T<7*^LIYCAgY>t4t=XDp_&pNZ9mvhA<|E|u@P&e9LJS}(kyQ1IUYM3oN0=R|TH>Ui;6j+ic zr=|o|@U_$I&H^a)gTKtqqkDVO7Sru*rnK*wVu3abP(-W&k?Ze#Z#STnv|*}UuZv&s5Ns}9No{*1x*Z?WmYT~!U)+{|4T)gUi|OUe;`nK24i6QL z7!%$+YWW^CX{xUB5i;4PwJcDsu|0Afk7R=mER8aAk=uI)m)+6RJy`d|9P zDRA+_p*nWf)3pAsH)P%W3G#45D9f8gXP+Vj$IVWSCoY=Bhl4P=hM&`!%hMOu>;kgH=SBDsBL=(UY^pcJR;+!L{!+dFs{jWamlYLLa`MmYCcWRDk?A+84w2O5+=&WA zq2TdK`ot%-*Xxd!(3ObSvNGWAW){-Gi&Yg7=zM%*+{E5>OZ~5#n?q?(g)?^ z-)0@hUVcW$=0@?p9yKoRQy)WkOG;q6o5jPN33qncrMpjlUv8EhcXeV!OBX^ZCS=2iuU~ zjpOlbBr^pWR9r#mEzU(uM0E9^?*rpgLN=`m)R#2c9 zIPY`HvdpRL=GKP`Z~V~6p;We2k9}W{o-zitHmLmL_i)Mn5J4Ne+JexfTa$P11k zr0&N>EwF=tn6i0Vh~?r?5s>&y_} zaIWLqJS=#%cEe!txXH}vLgizlduo`#mjic3UFw=H>yMUQP)mFH+$`TWuP#EbsmP~0 zE;EhQ)6}Yoyp-NmTq6Sq(M#V!uZ>I0&k&5)@w1If=IdH2H(3cLqW6ClXJZ{;=8;{I zyx&J^^em}?<=owf7dH2WbSdW2p05UN(Wg|`_uDxsls@~*HBrC61(h^#4+e1D!TcbW| zYHC1=KiB&Hek>!yQ7GWkHM_NCn2<#-ipsh^FaX}D7$3bn^5-07X0y%7=>Gk+G$;s; zp1z9nKX&X9v5Aw)?R#hE@6u8x9V!x%iW16tr|sUE%dX4l;MZjXqJW&|+ZdHiS`fPJ zUXRmyh>Zz}#<$0e#XaM6ch?`RYi5Gc1Ayihe&KZn4s~Dia;Ko6An^OC{m=y1Emxu$ zxjOtQ(2;|S_wCXL=PPw6vXO?YE-ntr7=(&0_J7syT)#g*qlzghxtN%kV9<1aS#)w* zm~3LRIaYNK8VHfi_Oh4ScK#Vw@=v$Sp^fEr-LWu5A6bm(*MMh^O5})`1$UnZ4&d4J z-fo>__&LHe4KMj?KN8AfjaTX~3kA{R<6`=I`-c*AL16)B$%m4-q}sXC`*xp;0&g=^ zXz`EU=J-54bQW`pcZy~bw$V@u6NA%Gk4}+#I-Dd4{Lje1sv$J}C$Tq*RUnJa$ z64VMXe2U!&lV&$azdB^z2w+2E5#}6{X>yUQEKHRBD8CX#*wW^oIym%Y!2qfV5#i@= zk-VBr0_YP0L{PTKdx_fFOcNQTRXQ}gg?V=+h`6ly3jk{;;b(2n{0!be;GBjgGCX`x z6LM;Fz%PV2AwYj1+3LBEu@kTu^)~c=LzZp?)!fF5qhU&=Xg{x{><)BuFc! zV39n8{g~VFb!j?44M3Cyh#AN*4rT^5E<*ifBn&r*}$6 zQYiz?!=E3V3olmq3{j0Z=;Feq=*9gN#h>Z~Z|3iI))gdFb$|v|$V=Y+XPrJ8+Bkin zF@s^6Clwz|G$iS3U3mEFkAILJL0ID|D*F1UxM}3lU&t`PC`3q2fpV~*2$(OYduTB7 zgjNX7k`iFr5C}LSFyOcbg*yzUP@F~mq)03x$gz?t;M!ogFp$QU4-YJ0-`WI0e}dEBM88e{Uryq9ARK3Yj!UvPKaRL;1v4@FwDpiY)iH z<&F|{#3?K6M>)w0aB~Qj4>d~=1a&mv#!kpSGb~`G1P=!`~))Ow`{=Vo80*>hjvg8!w zB%GqCk2|Q313>)&cz&FKMwIS(vQmaJ*e@`-ibt`J7XxU%^s$5sr?>R6nC!bj*Er&W z71hN7<{;_l8!-kpWMB{&;n~kW)Mf|GWqqZTI}C85gwWYBDNNLT!6{p&=$bHnK)-M1 zI62y!{0IHQw0jw-&_zgE;tumYoNP}<0zx`JZU!3jBd9cDMbVBs>b_^C-EnA!Z+$zlz$== zBK_#Ir~_~*W6|NHmQZ9^36M7wwzw1Zhh;w?DA-a(hQU}UBBAp9DAv8n4MZ{_%nmo3 zue6&PC+60Zf5JD9;{9TeM-5+(C5|VChk`+?*a4u>kM!D>6Oc3I(})uxI*xao=pOr& z)Tt|8{=442UPqi=uS1k%NdCLVkao}nf3~oBJ8$HXL@%4zb&}n!8{I)EzH-872S(KA zd|wC{u%fr#Uy-mT5S}w~UZOufmG*=&lS1wW_C9o>o|2!GFbXQ!I6u_1R-Q0E-w9R# z0QFPlT_iAy;`N7mzmL8GSd7Gt*UA=!%#TGxvrpqe7-Lqjjg(xUyJ0l{gm#%|i!*Ue z!stZTVzKZp)GdpF+;;NRR;L#oENA`i&V-Lg_oG6l)5mNF0?w$BQl& z1K7D8tqEA}E-?h8^9KQkN^N}k{7itu1{0MSDJeG68$AgLqFw`zN6bJ5nrpK#zzAyR z-#(m;CR!k9@e)L$=Y9sG36Wq$1}Yq#VS0n6S#zhisG+hMzph~~dA*Nk4kgO3? z@X4JXLir?CaL3FR0ssE>h-Ekz{2^G10rz)70CBQzj@TEfYI?rw3d@RK&yyw z^oRuSc7tmpc{TU)+ zZbDn_PfiPlP7>T}T+WEu1gQ-Xia<68h6V{en1J<6^hHD+a|g080T9JZh{KcnTOxzT zaRruOI6N3Kj2@_A>&$7L1G8I>3Jr!HXacXE5EC?L8$ph1iVFS(QiLr-I?Sy`dsiOH zPb3g&FLHncAMOV7^k1}?Y9dcz9RoC|@Na<2lZR;G035M(- z$x-M!EtUB{Bz>kmR={EymWqlhi-;q-Z=iIbtb1V+sUizH4k}UR)0_0#$NJ4=-uYu~ z-mgy%_z!yDK6~N#PYn%?vWri$=0$bR&tIRPzwhmCgr`DyUK1lldjs5SzG<0?QW&wJ ze>sgHLAYZUJd_brrD^uz`HhVyaxbn54o9iL`x5BR!-JEC2o0Pfp3SrO4@eVYE8N1$ z7a*&vgBkSL@HWDeAeaSzLH3A&+~xSW-yy!nZl^n*5K{ayP$9vSOoxR9+Nc6)*rdOH z4k1Uvnt&k%L%Ue(V(^tGMIqP^`Y9Em-YBU=Jbghx+s9NS4{h*1O@@jqDw8h@@zCD? zzJzCK&WCtFeGPz#e1wrVIY#^;6%k8Hyi?GoG`4jLMDJ%|mj!F0B&-jDBQe#^C&d8+ zt&xZ#{8XygM+}+yYJIaUW#@@Wg$P_Ci5zr!fVnB$0+{$aTRGHEu>G4psu#UrieM-@ zjFZ>6{TXe(#HyTeIs^)a4+(~#)+*K<#Oe%d3UER3SHPyiPc8~ECr;*>nifA6DfjFQ zoCReNU!0nn+gA#Mx_@zQZc7CRjvQugg*;Lo>35;%2@IYHbfS%Zx^^E!G-2^~26La4 z`TY(zpS+lw7#Ra4ViAf!QB#*sd!g5vd*2nM3t{Z|yLY)3Bl|w%Pfk=iwadQBqrB_S z5Be3SRRBosCqU>DWfMt84s2lOnR;U}4}Ty=N`O3B4trQglrA3pt>!8JDs>NeItvz) z+hdja^V(*AOfY8MhV3M}M0w04VJd`!#IIY4=N65gB~p4oHF6u=N+{b}MDj&3=*Lxk zh+Osei41NwTwe@#B>AXxy{?7u{Kp*Z?M)BkXMi9&<3|imFbp;jtU{L5ncPsbo(%wrdoc-N9I|W%na}>! zlvfE#!PC1{0gO0V@^;bEY8CDD@gZ0nf^w6dE z`2Z}53`N9i^3|XfX4zO@JC%n5@nW%M40SOOiOK+zV8+;DEK07F6<=XLmm_vs9B0!* z!@5;(QZt{WZo|sS{{d_`JZHRHU6j62!tRtk7}@E*)zy}KjC_0&tXyAwW(7kf#1#Js zL_x;_gBOwxRA*!C98m?sL{kz|Z4lx~0CN9H?m1UOLxkBeWMn8H*qsO)gtD8*%}sb` z%Yu&$Xk(5>gy1RR_2JGeqmC^`TE!Tt?JsaL%+VlD--uu;HZdvRMN)tn)1-=pR`Wq7 z@p>*VD+}+}q%gv(^N4go+n|fYNyEU2dJ`uwpcI545foiNg$=m6_qxykY?CWdl$CG4SSI$f%CFBqyNizKsqcF z_XmRGx469hM!d#j8gVA2mJu6U_FE9Q2H27DS}ym>yy&L=40tCkQ8_aJtr$< zlB~zW>h}Y0iK54nu<=L~z(gfM$1U-4Mu3+Xpp9{LU;gK+yOxF?lZkZ0zNJ{H^jUTB zZlL*&Lf0(3;$$E^_vsG*Y~>5<9u!4x=wwLI-^HB^}3FVM!a z3pwKS_N-wqz@^b6xwLuG2&6|8gUiJHMSiON zp2(t+5E#WzS85q&2f@r?;q)~=-5J*e0 z8TJnk`d&x`%I)*lNFb8sieAQlM+R5KCQMZ|J{oe-$rYThS&*@?pzRO&gn_X_L|Eec`a#z^mo6`Y+fKfqc1R-f{O zW&bLQmO!N|b`}U2`kE^hY7s8D6{B*x6Tmf=2A&c~YQG3kPFOX98QHT)8+T%XqW+|J ziRZ>YpaGLyoJ2laj3UsvA2pmjO!`t7C59UP6#Mb@Sa}6S34pkTRu%X4!Y-^cI8)xC^`r7zJY4@D}1QI zkX|WU#C^@)n61CQ5FCS()Wm^5NVUB2S5kr@Wpz+2#!()H1g7H$FW(&_W^-ljt0IsB zvr9$5xz+q&j>)F{N99m+3VTQBTk%=wDQ*FgLm~xwlX64}2SlMH3JCcdpTz6R#A3X^ z<45K(aZ^R*)wSM`8Is|V1go=QBf*gVDO{@98zn*i3X^YrL;I4Zc_=Z)AXqit*u!73 zqZ3(cR8}np_PbnLvPW5Ob290p;%@#Faq5=*E zBUh??+Okc8MZq2gfqRajAoYzpMTj~OJ&;ma=Z;c>{T<${xEJY<1f)3yxWcb^_PDq( zp`1W;V+o2q5egGFI&R^FGuWg8RONUn6>Pt;d?@K~vDNrx#v6%7Wf*^%}R8XZ_R>%x9N5}v`3wYh@UgqnvGDpqt+zrScDC$8l;sy$K}%l8*T zXqf)82>yw}9Ot>-6~>w=6#i0C5d*y@9xRR}j(yyKReo^`kuAzNX(Tv+47}c0+JMy` zqk`D4DV()!f3!Z`#jiRw%25JWX~&uZYwVv+*Vt{{quY+nG|}Suq(F8<@O6LV&&h8P zLYZeI;KMHpg>b3YR`u#)Y~P2RcSIoOVPOk(qH(E0wBt2g`?MrzhTlpT@lz>T@4x0` zSY_BW;x@5;_#nsnvrypyEZ9+&s7T9VvlYd&hS^W?TWpy^bS0;5`+P(6baz^SB~{2U z!AqAR=Zg>{do3v+G{av1?6X?wcBCv3aWr8ZE(9pXN!JnVNe4)SkuocN+Teu1j%i~C zCcqy2kS;z|PK@F9?56T>kJM289H;@DMPhV8adx2yAG# zgZFC=1xk+!D3_ay>}w?|J$Z95#}7opN65&OU_n9uNn=gQ_p^IMW4zi2S>+4`i&k;!=RbnK$by7H7`efJ zTH*xp>XrZ#Jnz8wpf}+BMdu?=mV(@W0BHUo2%61q{rsf<{A4!h`~1K;=jT&&zX6MJ zksgn!+h;k1g$9@JjueL&!(<3WKv&+G?BKx;H1fx@m({{3K;8$B{iZt~4$bQ~KZLin zk(oJV((S}vgLkgQOZ`~>xc^O9K5?Gotn|6Q zr+!f9i?TtBuqFLyehm0Mp`R`W`56>1NUC6tUke{B(k0kLn@^2c>a(%k1hLSSUN}&8 zcpXfQjssw1#>)<}=EaPhZa@3b*kSN~BcPeqjsCTNVCDEOeD|`Wv@9$L{xGu)R949w ze8Mq?{03p?HxPEN23~xHwISa1?6t{)QUxAE3+*i@Cq_>JBgomq$VA&a=!zJR&wb;p z=Q)Dko1Y_FZJuqhku6KHlTf*Jcv*Bvdsp z0gp<<#-H| zM#;~@acXU-&o@MT_BrLs^*XZjNZ&he}1I zKu`+##UU4hjeBPPVcBw)>;?FxJW_wa0`TX4qiz+h#KcSU0P%17T!sM~C#)WCn>#)E zI?EE^fv!JGZ%e*xqi8{;HDJSaK;vtovu zSxc2&dk2nROATxFTFbT0Xq@5bpW3L;qIH`V*HmWHwibvv_wGE>rcE7cHE zoBlB%l=!CfDk9gsZCBd8ze0;aQ4ZCfeOE~=v{#P#Fx{8!=ieBbBgWAW^5yAsVE#0v zic;nlEi-w&EySR9TWG(qqvwc2DPSaM*r;oN@~)df2kwUcdH>w*)1v=hLq;%}Y-R$q z`hSlq{@JUze1MW%GP3 zG}mVeNd)#X&qU7#9rl2e&}-kM4k~Bw`l5Ge|A9#adOrL0*XS<~zVInLe)9CRr?U!w zeRy&C^ZC!;pMuN0_aH(7g#txjPpafj;;^q@Pvsj~=Iht}17MU5B2|2yIz{MBK1RtT zUI2z%|YJ^x7Bn zFjc-C0ZHVWR(#ot@09c$-^Kmn@o(~fET8|KFq6aIL&!NK5rbV9gEs%qvnQqdzmJbk zj_&h6-N@5n{x=ai2%K3#$gc>`Q^rE3Q{Y!pJg*YNl#5sfu*o@O6F+4^RyK&YXe+E1 zm{E)_H|2CNM&4PI%vyF(M`YL-*bM8;@xgtAt!~#wf7L~%23cTg-jY2u19@J5moiD# z0KC%n-l^_y;~KdtaUJWk6#8Cc%j6IY$jY&b0z4C%w-O*-wge#>{lXEuU}%g#uLR}_ zEdpJs1j$D7xiNmZRg}jsm)b1m8dPe9awn8y{#EuV+h3jhr+5&c5>Us>Ua2m@h?U+n zMk3b8X0Hvg+`(1-Rv%W_c%@-~jTFw(Sm30R4&B17iClC;0ZYfN+OF??k$%Q8hHL@G zDbZ?@aapTm)_5`%)|W26Q2XnuF1xjWNa1tC)fO!~DuKlHq#XZuJa~40|Le^>>*)VKNkMq^a_ic^6|g&_``eB-YX0i<+h$t7ZDTh&e+@}H zY5can0S8ktU0dld!Kzn(`5_CZSRi%R+bRe-#mkUVF>N*-N^s;%EGsma4VRRP2GfB# zpL&H>Yv9QF*@hW7FjDinwSK$#vb_E!N@5%;5ozj9wL}%_?U+PmCN!Ewg@Vndkr4r3 za&XJmQ2~QuZxoWQ9ISKZup&=&7E&?p&CQcvz+t}{zr1ZD)Ka>CO60AYq2+LDxBEIj zv^%-<98vErAwt8LX_mg4@+$~oUTX(rs>5kH#r{(a`BfIUt=aNhTDym@S*}wi6xrzNQJ^1Z6`5-h#d3=DRzcb{S&@oo$E4`woX&p$nUgGj~PmGO!xz zZP_s+$8QJD=34ZBH_6o;{T7b8vt%8|-1m3d` zrwF3Kfz#?vDs`&aopje+L9d{IBgo73BlG&ETuE<{jqR_0I+66ZR!A>WF@2rOiUTK; ziv|ajdi}at%(}QzTr675)b4&S?R{`txRVYsGmrfTIK*@XcMNUPY6hp>4QH?RcDh`` zW%u5=(sFgDym1_f6`XPTtkdR(GbL9LdR^Yv#iy4A^hm>t;I9f$!^j-5Q{5>UA?<@3_}(W#3Gbg1k%L%vOz<#vZh}XPn`* zhI?kGuFz%n#y8?LTh@h5CcoXgLT}sIatEId{=bBBF=2@R5qER}w)p=BPo6z3pZ|FB z_&)#7jXdl4|1Pv3y#4<_Zr%Uq$k?560p>V0y8!clGMjk;owj!41*|7Pd4=o;bQ z(jk*77RBBf5;>geBxWv~a&ahnDQcQ1Gh_*|y9N&}mA;iYu-ibQ)@V0wx=%!E@Q7Ru#6Cqrj#xEu`DILJOacefw?M!qs>yj!GJ2F7~n5Mk=8T zCI)M}MwMpi##Li^4~iOoNf&QOnp#`RX~z*yEh*{>oYq<<`;P0_D02PQ{9ElyWH*mT zJ3MD4(}Zfg)1rfbmK$l`7pXV-Y>uM6GEW_UTd;&wx4<1^ zNkwHWCT*>&R4qvwMZ2;J)wj5VnZ#9A*PBX;>h3oz#kKv}-t6WQy5me&hS~yZ%k!Oo z+gh^zlviuKe#7F@*ryheX%LB|G|XLjSXS;%I;1=Je^t?S62Y~c|9x`&_@o^F`S|gD z{+}CpymcJFmr@e;-u<-w_)jfkcgFRr&}sJis?VD_e02-E@%2`S*~!hTYj5b`Edp8Y z+-(f?EC9Je3mzn@Y*U1$EM6bps1l%mmKyApy<}Bjzi`w6UYeKg-GawAEh4)~TwA5{ z&Ca&0i?Sas3Pw#RdU%}Rs1mQ1#B;eNn_Z#BG1=H~=O8Y(^>4|~sW1mS^K>npCAJpA zl`lA3m?@W{yhZ?nhPQdx){RGOX~b9O?s^WXdKep8Ylh}`(G8{7CY?Io8fUtH_bXFc zd1=fNw?n&YYr04C0^Q7JUB~6w-8GW_jh_zopSzHCvI5)kzdk)VD#!mkeR6zn|J}s1 zj`?ToAz4OQdLvXd_OuGE%BzX?jFR!uk-As5tm0+YJ*Zc`CSxz#>ozKpe{^J2g5+DHh{#L_iZoht=xB0bD@c#c2QDTlZgR^iL+P* z3pk4ld9L!aVGRa#zQQyb)b;H;7dIcSo?y$||I^mKE@t{>kcpsx^-VNyi?5)^=c}E* zDs{^@84fZ=H(x=oyS?NR_2rsQCS~@rp{1j}y-$sO>6KG|l(i1Y!Ua>V zV&we1A2c^RXi8dV1$yb`^Q@@40Kw^><4Ke~Oq4P@ZobF7b?lT~I_qB1laIKjBYvul ztYfFofk2E%Q=!)bd(NTOUakl4+l*Y!o9brhys{1I-c~1vgIUT7MJ7m`rHmmWvc241 z_xnFL^7O$46mq72QkQvZrpslAfKiI$ zNY3I346on>@xbeYcT>y(Pm_c)!2zG5I94GMUc35bF*yb?;(l2J|JkK zgJ}1(i@*dcg8#K2fHx#w07_I%i4sT<12HBj@Pb!we}5|%Ij;}Sl$3(^XKz7-8TWz- z7KiFzjlLI*{>2V|)xY+|baE*Fv48S8Im`i#V0e`#%J$*jqkvy0-lJdyue?Wrm?hq$ z|MvReJ!F`s9Gt&;&AlLD^b-n&7vKoNLtT#1PhK$RA&t=CH{`OY8~>NDU%dM1buf#z z)W-7h|77s=Sts=h3xx?bRU z{XTg2yl$jYPi>&WXq_0`ojI zNoz$UVRVio!~wK4x6VD;uLLm;uBSMhf)Em^0x3^_u!@79qnIXuplibqa|M}_h6?}p z?IHnYkiZFIf#c5}rf5GH(<+w8%s#iRoe{l|!klYVhh$ItEHI z&oq2YKp3Z7AjSi|OsTJ$3{%L#NXnQ%T-q4QZ=XmIA1#^^8%B^o99-m=s$Hf;;2A2S zm@pcD1(+W0gT0qOTwLx4;FZD>$iK2Xu~R{3%Ak4o<696SCh!=CP#}IF<$j`W(j)5F zycA9Or|j>7rVPL&iy|`P;DRCLOW;@_?s>k8?jRT(|Hbole@}uzaHOk98y87>NQppT zOyihd>+9o2vA)lhD{aoW>j#(OeZvxBl+1#6%s2 zC=#;F@g-Q=`rQcG6-zdPVFkqwSYEz-aRwOTG-V;`f@~)&Ll)H`xiXe#m#@};AY^B` zH2w>zFuAB&EIAM?MRL?ibd|=cbgOwjZcl=fzibOjHPOFjjIvHs{LW|hZ9Sc}wbh_@ zSZ8*=#BA%?4WjNqKuXSnG?_3Mp*%QP@0ZBA`CNc&9LE3=o~jV&+6eCno+F|ih1W>E z(IAysqphw0oR7gU-=WbWKD5h!p5FPurZq8T^cp|{6oSe!Qt!F6)6_837z3z`jUd;k z$_cRae7v{ogPnrL(Tc zRRw9$8K-d!R7vG;sdB)`PIle=lH2G(&z^34FgySpA@K3sR{L$QugWlgO2vK_?Z*X6 zRXVBw)N~+8<5-7y@?mWUUeWLhF)f4O5=}4{YynJE=+AJ5c&P)K$T#+3aM1kict7u9 z@vQwYw?odglCyL~Y-vHdx#6+3XX!ZG(rEc+*0B632*1&iM=-oXL^&6}H{lBaTFEz3 z223GuRKwgrH$P~WS6@o zj?l1`d&Lb9S^kV6JwI4Siu||$f21&$^p2z{snDp}jH@-K&^8jO%c@Q#ahkhyR^nNs zu$Yy8`7qyb<@^SJSImyj@~LaXrSThFSvx+i;Om&F;-Jn};_|RI0anX-V^`qH8POVz zvvkI(X9l*MQs1Uyb!4PBTVy|7(@bgJuM72m+v{6^+?=DV(ZRPNeHHRup~VoC$!8+z zuFzujRyQJFmPbsfJ-11tWj%Drm-`#^PVTUVd|3b}Wq=`n!7!R56&8fY0LBc#XaPdC zGDLx^{}p0}eUopdNFmTO8{*OX;(nARvTb|NtG+w#?So#7$V5zgU~mL_Trf%|`QdXp z|C?qCzjGlz0J{DG&~=rus>{BZnW$UsU!hr8Zk_Zgj`Cr_XK8cRNo^X`(lBRcwPENHgz3vWca9dKn?y!>O%A`o*EO`cr5YzG~fAQ=jj5@O* zCq{?~&*Q0FhjiK?iaPSUxFTf7IkICUfKO=}M?j;0ppWL-W)3m~W6aPWDIy|X*vetS z02w|Q$`w>vCPr$15xCvqu-l!btqJ-H+dn%LxvhbAWv}KygSRFcAO~J)L5zL(WyKoYhbCQL)al z(4xeD*xs49suAD5Ebji4yHPq6q}5fC&jn*fXPLia2$+!Vt@rs6ug(!r;12A6li%UB{idJJv0+=CYu9{kyZt-#xD!ju z$xAo(XN9xGyA-;DUba#WfPidr;&^CQvjcOAR@(U4$-ts*e@;LMx$?U$^00~nCn{S< zK}_qUX5PCQ1b*A=+f%iwpZlPNf5qeM!#e)iBF#A7iFnfkL0J2QCt`KVix+-R7O9djt1X9GyP&y=k+LON(q;-lPgSeT7t4k$4P=@&HB1V}lu zm-rj2$!=jlBcmPB>yH0JWl`ZaM zG}6Jfn1h&xP@u>I0DXqDBu1xyAX2pgOg+yzyxr2&WmZxNavuKcLNjX zqz$ZwBjCgZGYAGxgMlBR5r)Jc9Qo|&iRUG09AD5Fhpo6OVviR9YVa3X#VqHha*jTH z5nsave+ck6$3xQWp~}xF9vOb2M{tO4BRh0aYXMfe3#HZde2GQdXY)az%`=L%N8kQSgQ7JW(P1}67`!)4$S z-0K6~b%T*PoZkn|7GpktfK1-mRyx^at-3sLHYfv^2$GJT$Mr7vSqwRE6T$DNl0=RpJ;^I(0!pwf*FnSJ5L(%E;MwBVDy1uf!-(vaQv@-*2doAf1wU7{Plb6 zc?lHLHnXu9@+L)a1l`an@YA>CJ-6Hc?4%oc-) zadqq?d)t}pkJZIPcTU^QPV~NmU*8g3DGdkVt<7edIzj7BvpRI zqzMU)zuvD|N^G5fuOmaX4_svX0A$LeEM(KQ|9}=5DJ3mchb3aEoT)yTQ&TEyAK-{^ ztP&=vv8WVDH|+%`+5Xr8;BQ@%HV9H=smWLx z)QAf(TbRtEDjj2qRnL39gAz5L_j*d^AC`))nD4QF+`t1n)PI*CN;x2#^H_S>xI>>4 z$^>x0Jb$ovm5xv-VpZAZg;gO7Jb@v~&OGGO0DKBQaY`h5&wGCca?T4JIsDp_6CC8| z>0{vg5ejL9_Pshn4AvsVz$L_BJA@eQfDnUvLfB+kzu1GyCYFzaL2witdEUo21pG|r zXf{HB3=B>V!12-X(SbSpe{9npf@{cuGDxING{yw;DT?wVV-qZ<=}4upl7eh9jrF;J zBIQ0E`(lcGlR8_rCXnjgSk)zTmz$z*vYs&NhV8Ky5mL?Wt zkbP*}x$rQl=s>ql!wo<*R)^lDb1T#fA?0@_g`%q=MFoOx~_x z1*iE*P(W)8|2XWM(!N5@H&Wh$jco8;QJ8e>dZKM%t9d_CgjH+*Bb8w@PsK)=32uy& zDI6hzLp7k3x;v#aIza?U&R@et!MkdI6Sg_Y-=v70NkNSe(~FF7=JP=K+Vz93lu%z29V>P>2W-Hak5 zr#wUiGEB3yL7Gt}Jk+fnQN(5QcEYlw5t4=EV~$4N3w=1UIM&>*=`kbG=F9MZE)v76 zCk%}dv(wZ^Iv!)?XH>-^8m7|9QCwR-cIL;w&rg1z;fZGPVL$unryThqr3B8BA_j>c&WVoa{MmId3gY_X6PQlx@13}b%C5U24R`4YKf_3w$FP%iu& z5zXgA2i__@sVS~b8tW3smwiwo?fLU#Ur_V&@hostname:6379 -externalEndpoint: redis://password@anchore-anchore-ui-redis-master:6379 + externalEndpoint: redis://:password@redis-master.default.svc.cluster.local :6379 + # Pod configuration for the helm post-install-hook enterprise engine upgrade Job anchoreEnterpriseEngineUpgradeJob: -- GitLab From ade3578ad37f5e036bd20119919d01a8cfff9e5c Mon Sep 17 00:00:00 2001 From: Kavitha Thulasiraman Date: Wed, 17 Mar 2021 09:53:46 -0400 Subject: [PATCH 11/11] disable redis-ha external --- chart/values.yaml | 53 ++++++++++++++++++++++++++--------------------- 1 file changed, 29 insertions(+), 24 deletions(-) diff --git a/chart/values.yaml b/chart/values.yaml index 1a85ea0..7fb0dbc 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -12,11 +12,8 @@ monitoring: enabled: false namespace: monitoring -# This key configures Redis-HA subchart and when enabled (redis-ha.enabled=true) -# the custom redis deployment is omitted redis-ha: - enabled: true - # Check the redis-ha chart for more properties + enabled: false # Enterprise license: Specify your multiline license # enterpriseLicenseYaml: | @@ -147,7 +144,7 @@ ingress: # Global configuration shared by all anchore-engine services. anchoreGlobal: # Image used for all anchore engine deployments (excluding enterprise components). - image: registry1.dso.mil/ironbank/anchore/engine/engine:0.9.0 + image: registry1.dso.mil/ironbank/anchore/engine/engine:0.9.2 imagePullPolicy: IfNotPresent # Set image pull secret name if using an anchore-engine image from a private registry @@ -473,6 +470,8 @@ anchoreCatalog: repo_watcher: 60 # Interval for when the catalog garbage collects images marked for deletion image_gc: 60 + # Interval for the runtime inventory image execution poll + k8s_watcher: 300 # Event log configuration for webhooks events: @@ -600,6 +599,13 @@ anchoreCatalog: tolerations: [] affinity: {} + runtime_inventory: + # This setting tells Anchore how long an image can be missing from an inventory report before it is removed from + # The working set. Note: The image will still have a historical record in the reports service, subject to data history + # constraints as part of that service. + # Note: if a runtime inventory image's digest is also in anchore for regular image analysis, it won't be removed. + image_ttl_days: 1 + # Pod configuration for the anchore engine policy service. anchorePolicyEngine: replicaCount: 1 @@ -682,7 +688,7 @@ anchoreEnterpriseGlobal: # Create this secret with the following command - kubectl create secret generic anchore-enterprise-license --from-file=license.yaml= licenseSecretName: anchore-enterprise-license - image: registry1.dso.mil/ironbank/anchore/enterprise/enterprise:3.0.0 + image: registry1.dso.mil/ironbank/anchore/enterprise/enterprise:3.0.1 imagePullPolicy: IfNotPresent # Name of the kubernetes secret containing your dockerhub creds with access to the anchore enterprise images. # Create this secret with the following command - kubectl create secret docker-registry anchore-dockerhub-creds --docker-server=docker.io --docker-username= --docker-password= --docker-email= @@ -931,7 +937,7 @@ anchoreEnterpriseNotifications: anchoreEnterpriseUi: # If enabled is set to false, set anchore-ui-redis.enabled to false to ensure that helm doesn't stand up a unneccessary redis instance. enabled: true - image: registry1.dso.mil/ironbank/anchore/enterpriseui/enterpriseui:3.0.0 + image: registry1.dso.mil/ironbank/anchore/enterpriseui/enterpriseui:3.0.1 imagePullPolicy: IfNotPresent imagePullSecretName: private-registry @@ -1041,29 +1047,28 @@ anchoreEnterpriseUi: anchore-ui-redis: # Use Ironbank image + pull secret image: - registry: - repository: - tag: - pullSecrets: [ ] - + registry: registry1.dso.mil/ironbank + repository: opensource/redis/redis6 + tag: 6.0.4 + pullSecrets: + - private-registry # Use Ironbank start-up script - #master: - # command: - #slave: - # command: - #password: - #cluster: - # enabled: - #persistence: - # enabled: + master: + command: "docker-entrypoint.sh" + slave: + command: "docker-entrypoint.sh" + password: anchore-redis,123 + cluster: + enabled: false + persistence: + enabled: false # To use an external redis endpoint, uncomment to set 'enabled: false' - enabled: false + # enabled: false # If 'enabled: false', specify an external redis endpoint - # eg redis://:@hostname:6379 - externalEndpoint: redis://:password@redis-master.default.svc.cluster.local :6379 - + externalEndpoint: Null # Pod configuration for the helm post-install-hook enterprise engine upgrade Job anchoreEnterpriseEngineUpgradeJob: -- GitLab