From da4ab996f8c32b1e9db1c8150ff3e06ed718dcd9 Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Wed, 9 Jun 2021 14:09:53 -0400 Subject: [PATCH 01/14] bump chart to 1.12.16 --- CHANGELOG.md | 7 +++++++ chart/Chart.yaml | 2 +- chart/Kptfile | 4 ++-- chart/templates/engine_configmap.yaml | 8 +++++++- chart/values.yaml | 13 +++++++++++-- 5 files changed, 28 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 757147f..562ea92 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). --- +## [1.12.16-bb.0] +### Changed +- Bumped upstream chart version to 1.12.16 + +### Fixed +- Fixed insecure SAML configuration issue + ## [1.12.15-bb.0] ### Changed - Updated docs for BB documentation standards diff --git a/chart/Chart.yaml b/chart/Chart.yaml index 6d4387d..082eb86 100644 --- a/chart/Chart.yaml +++ b/chart/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: anchore-engine -version: 1.12.15-bb.0 +version: 1.12.16-bb.0 appVersion: 0.9.4 description: Anchore container analysis and policy evaluation engine service keywords: diff --git a/chart/Kptfile b/chart/Kptfile index e44bd5e..81dc50d 100644 --- a/chart/Kptfile +++ b/chart/Kptfile @@ -5,7 +5,7 @@ metadata: upstream: type: git git: - commit: f50573427adb8d582eaea20c968bb0391cb79c48 + commit: e2f7ea00c4fa078b93608c95b31ce71a4038aa96 repo: https://github.com/anchore/anchore-charts directory: /stable/anchore-engine - ref: anchore-engine-1.12.15 + ref: anchore-engine-1.12.16 diff --git a/chart/templates/engine_configmap.yaml b/chart/templates/engine_configmap.yaml index f2a3c85..8046f5d 100644 --- a/chart/templates/engine_configmap.yaml +++ b/chart/templates/engine_configmap.yaml @@ -231,7 +231,13 @@ data: ssl_key: "/home/anchore/certs/{{- .Values.anchoreGlobal.internalServicesSsl.certSecretKeyName }}" {{- end }} runtime_inventory: - image_ttl_days: {{ .Values.anchoreCatalog.runtime_inventory.image_ttl_days }} + image_ttl_days: {{ .Values.anchoreCatalog.runtimeInventory.imageTTLDays }} + kubernetes: + report_anchore_cluster: + enabled: {{ .Values.anchoreCatalog.runtimeInventory.reportAnchoreCluster.enabled }} + anchore_cluster_name: {{ .Values.anchoreCatalog.runtimeInventory.reportAnchoreCluster.clusterName }} + namespaces: + {{- toYaml .Values.anchoreCatalog.runtimeInventory.reportAnchoreCluster.namespaces | nindent 16 }} simplequeue: enabled: true require_auth: true diff --git a/chart/values.yaml b/chart/values.yaml index 7e610d6..93d0bdd 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -621,12 +621,21 @@ anchoreCatalog: tolerations: [] affinity: {} - runtime_inventory: + runtimeInventory: # This setting tells Anchore how long an image can be missing from an inventory report before it is removed from # The working set. Note: The image will still have a historical record in the reports service, subject to data history # constraints as part of that service. # Note: if a runtime inventory image's digest is also in anchore for regular image analysis, it won't be removed. - image_ttl_days: 1 + imageTTLDays: 1 + + # Since Anchore is running in Kubernetes, we can collect runtime inventory data out of the box + reportAnchoreCluster: + # If set to true, Anchore will use its own service-account to try and collect runtime inventory data for all namespaces + # Note: requires a value for clusterName to populate inventory image context + enabled: true + clusterName: anchore-k8s + namespaces: + - all # Pod configuration for the anchore engine policy service. anchorePolicyEngine: -- GitLab From 5cf2f3d906c34e2ccb16497ce278899649c4cdf5 Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Wed, 9 Jun 2021 14:19:08 -0400 Subject: [PATCH 02/14] update dependencies --- chart/Chart.lock | 6 +++--- chart/Chart.yaml | 2 +- chart/charts/bb-test-lib-0.4.0.tgz | Bin 2369 -> 0 bytes chart/charts/bb-test-lib-0.5.2.tgz | Bin 0 -> 2475 bytes chart/charts/postgresql-1.0.1.tgz | Bin 8687 -> 8688 bytes chart/charts/redis-12.8.3-bb.0.tgz | Bin 54151 -> 74871 bytes 6 files changed, 4 insertions(+), 4 deletions(-) delete mode 100644 chart/charts/bb-test-lib-0.4.0.tgz create mode 100644 chart/charts/bb-test-lib-0.5.2.tgz diff --git a/chart/Chart.lock b/chart/Chart.lock index f6be325..76e6cc8 100644 --- a/chart/Chart.lock +++ b/chart/Chart.lock @@ -10,6 +10,6 @@ dependencies: version: 12.8.3-bb.0 - name: bb-test-lib repository: oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates - version: 0.4.0 -digest: sha256:cdf6e2694ba10c26845caffc96343262185f697595fdcb658c1c6e9796ddb029 -generated: "2021-05-11T11:23:19.071211-04:00" + version: 0.5.2 +digest: sha256:4069be0edc492091259959ae0c08cc70ff20e198b42d3dc201bead96675f80a7 +generated: "2021-06-09T14:17:39.519096-04:00" diff --git a/chart/Chart.yaml b/chart/Chart.yaml index 082eb86..778ce81 100644 --- a/chart/Chart.yaml +++ b/chart/Chart.yaml @@ -38,5 +38,5 @@ dependencies: condition: anchore-ui-redis.enabled,anchoreEnterpriseGlobal.enabled alias: anchore-ui-redis - name: bb-test-lib - version: "0.4.0" + version: "0.5.2" repository: "oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates" diff --git a/chart/charts/bb-test-lib-0.4.0.tgz b/chart/charts/bb-test-lib-0.4.0.tgz deleted file mode 100644 index 47269ecab02fec984f282a766ce13a2f7df2b98e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2369 zcmV-H3BL9piwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PH($Z`(N1{j6Uxj~XnTJS$30?Bw9Z?xENA_7->T2JND_#iA%E zX)Lj(NF7NzNt51hKTt2W{BAdHvbSe`uw`;M;Z1 zAP9oGp!&`RQ5jG&p|}bk9yN&YwWA-)$^!g*H?@3GThtJaPXe zjppnfD$S%A!1&amc|Q5sCEarpI5Fx-vD}n>&){#!Gl;CFz)&jqdl8}%Xiz(XW;lSB zLOJFp#{qB_DynXraf3J@JrX#NP5GhO*0z6xSx`I)2k^Xvdqs06 zLqlU~=)eJ}T!MRh3#2++UegTW^Ji}sz3Tu_A*7+!%V;|jz)g{7M5lf#<;WdCxiwux z5o)~%;9Vh0QsWN5_4;l(u33x`RfK87Bw^BL;v+_80Pc`-jTVU05P7|x#a7Zk02DOj z7}o^ooJKeROT-)GNHvyZl--se4Y9Yk&>??i95wlo%Me_PO#3yd{)u}`p6QBDa0h~k z7=?jTi^56)MQk6P?Ij||s1%D)yA2K|B3{IE6AQyQ$xtQeLWkzLU5IQY?c=$GG>>FCS|dyA2GX%CI4g8jKp%m__(3iew?o z>ypc>nXGBOK<&KO{fMM6lnGQd$zCnP^&%`m0a!*89Du@vX`^mPtR=}9_pL7(N|kw1 zpdYft3#mx_oaM-wKyT`8mUK0T=BNlUGJMb{0SVgcT^5{QO3tF20sJ(4EzPAujiTAp zl~f}pk{3)3z;Ep}l37MYJg9$q;QApGen@rdPW!xQ`s1#Cvg|kD;pAtOgRfQ8Y?XY} zQdDdC6PRoiGX-8=_cv5AVK7mpO8X1=PRK{S4Sc83BvlCTyimz2jS8Yv$qd2sQlv4r zf6^ALUmFP>wC zjufKMsWckie+MQ-F_{5ir~>a(G=zx}Ou>nviX@*_<7?rGs9A^N4s3XI-h&_3K#}mg z*FwpLP%ASeXkZd)fhSfvzh&6rn;-lb$G#{yU!Wf*YsARW;FmAcLONv5BK}Ary$^oy zyrGhrH)I^QWnyb1%avoyVw79yMFqKBC91I%+AuqDi6YDZ>{AD7;=ZEz7YN^<wrB6jM)++}!MheYK3o=28VmxSJS5zbjN271yXbgkz*RRuJ zcq?=;IftVW9JPl5#um?Xd<;i$2mdOh!CCTV1UcQ&E+pCA)a!JN{FP=L$Z@$|bNlWF z8y4N6L!rG&m?kQDjbpU>P-$AJWUCb{YSJf-2zJPvEK@vu^JaCag?%Og0wM$OU3yJVBHx7qu>S-eAvswIU(dg}gdeg4PF zMc=z3xFP>@+Us4+=YP8W(?kB}A=)OtrRnON|J#{-#F7-yhUCOUr+>V@yPMCJe6iwT zJs+WkNu^?+%59O+pEP08pYY|4_U&k4^?m*n|MHT_M?(Tt_Sd&>%Onz8Cj?Z z%brQNugkG9s<7%WZv*bP;3jD77iYTsu5KXi`<*!+G7&S8d@1AqQcd5P|MjwuB?igy z4Gt})Mi6T#b^uzMwxxdQBK(MvDTTe%e)nj#JITBZCAJAVtS_30=hlZPrS$dQvhx4V7rYA977(Porta$% zgBc3`&~F&j?A!JYgN=_XUG{=fJlJ)1QHRz8PF3kXch2QTFn{gb`1sg1zOJqH|NANb zZ}R_V=fU~H{qL-Q@c$3dHkkTMcF%ht?|;9S4CVBaqpY+syjkv?0Suan^G zIp50D|ISM6C-ZgnD9vOH|9=f9(_)cSP|*WSz{z(I%U00=qf~eZ^-Xko|fEAFma-tb5)RAud)sygzV!*ghnWx8`B{`SH&G74ct5{J#DPwCVpp z7ybGF|MbuLXNUOjA)3`f|HN6Y_;AHIhw9N>N%-~ItAD^mOMr?PWMT5cfJxCh!-5;) z{E{*ahK@=Ipi0pjkV7!3LaZEpnS-=bjLggM2Cq%iQ)4eZRW%J^;zytpqc%*Gk=pUP zDb^UFQzfvEofE${xMe=8ZRm}cvKt$G54DGybWb;82bIjqf@_ZNvO3ui+#K5XxsjY4MJHWq{6-G*e3h$pUwaO z=d2$b@_!G~p28(H29?lYBvitOs}u!<1>>;|jB^@|Xo8wJPocDJUF5k`MuSd~b4a)h zA)_WrnMl3`g`65TM#!m2Tm4kT&QlPWl*S94T;Y&iV+>c!r0{>o1b!C$2Bauw+ATqj z3OEx;9P;Arhqp#5be_UDc zVQyr3R8em|NM&qo0PGv>a@#gCzxfn13|c>2yGH zMIizK9stUA?A){8fFBYiQIr&`cCMrSA(6mhfnDq_7FaL{JcHVJoCW^#F;#}#(1btP zD|EZv?s>nT|989H<^OK);`B+c-yK|Bbo;&2^C#Wj*;)7O33T^6jAqERq3TKZ-hC}I z_kRL3W$#dFCdCk@rw&ci*=vvV&PmsaP=|`8CNFyi|3IEVXf*{!Qo%p70F^+4+7UFt zA=DJgF*hj=fwMqSb>mDc!d)^Tr_N(@egF$~`!|@RoEp^rZ{baW3nFj%txi;F@3VE+#Rx3?ZdIAQ|9t?2?O6~LQoKtMIR@bROw;4*s7go$Vf&vU#V zXzC*8=W^ZqyL;lVgq;Nxk$rTwpAk7lrC5a8t!OY2@+?|vm>I@Nf+|KAIy6mfM`WwnK3*Ez zV=L?*Dt;v);wB|35oD#D5P0o4ie_0Vd_SlPR42rHqzWft|d* z?Zw^FyY6#k*xSOOQw$52?*SVDc}IDMngl`a@{3_N*Hwbu28U2(*ocM|MU868LVOm6 zG85)?F6H$?*0k)Pblz<*p%jKPfvRNLE9bC%3UgEdme3f7pfG0Is2dV#NfO3=>q|yb zC7u-M2Q2miDq=rnDRL&zn|qsvqH58cWC4bT4+o@6y7m4pGtMt1XW`8dUX5N$bE#0H zsK#_9)r5)o1ye)tYhw*%l28#1%U2IvKVZTSs2;oXGB2FJ+?7vO{02Ony@o0HT7}h6 z$$KqD(U(8NNhT3f;H71G#T63)7heEgr&1Ys`R`Xh{r3FF7caj(`s*>=-8GfZ=(p*18^)rBZ-cq4=jAky;1}?s zB~j>5AqqW~M#Hb)fElBhwE!?wf%gi&j6bjxyuW-2UO0l8LCl*HLlucXtfyV08B)_m z;tp)6bl!*WTChlP-mj5lBPbOcVl*&|y1)}_9bpr7_~JW1!l^GZ&R1jsvpyo^Xz{H>3M-87PYcSyHz~k+fz`TSSjBcJ!fR&W=yvA$s+y_fS%N><1y&Dd*wuPiU;XL= zNi6;)HRECK!&lnbzH!jc_L+0U9e?R7VFxrXl(rnIrMK9@yVyAY@=Dk#eHU7!0ExG@_0$C=Lmi=C$X>&_Ann24B&KUMI5E1K^t|FYZ1 zng+@74UR0OY9d-Vb^vOcwxxdQEO?Kh$tSzfe)nj#JI#3>M{E;uSYNad%(cfSx%KXb zKhwSC;O?>A^zR01*8k$l&wj3dY`p(5==Yb`|G~u}|MwuU&N>SPXuAHf^X{%7wFL&r z_o(~2VzR)&ANqz#DZXuQm~4Dp>#|pr;=%T^t2)$3ybW6Y z|9-B2Z1Vqo>+F~JfBo}=|9=SBVCoA;d)@G!8VrmnH1b5<=3F|yJY-Ug8Z!$e(k2Pof+(G z0!wMaZ4!M;qHcTr#1x-bi&op7H*E`6^IP5@cvDc1jE=XKVg32BL%$r>#Q(V*_Vp#; zrtkkQ2Fu_74bINHhxq>?z$&DF;xyX;Trtj}cr;fMet!1DzhI^%Kt%*HGihePjM2LN zj2q(oG-etMo#Yrmm7+HwM_|SZu~^dbGicky$TSac@!C`+CH35C70nQ4E(JOfYQsbx zsUNpBv33caB7t%2ocN{fHMy_4%~uY~4s7@>l+J2aJRgXyR5Hn3cc*eC9qYWWfk5v# zCvgmSwnv(A1D%M429D=FqK1P)t5tjZr|5F&^1%P)frIjZqWlDde`Tvow{;XwYNi z9AYj5NT>x`cqu@6nMc&d5 z2~t$RnLy%@7jJ)iYotQwDLj`+A_csA{uUypv_oQM{QS2VzC(f!%FlnRf^qEIpXyal zg+C`0&~TEaFk&3Fb3*i0>YR{(PMi~B68kI_i=C7II#1ypRZM0YUcGp!9g-?(xAYES p5mLWESMt3>raF`n`k%)Ne}DrV-~i3=zW@LL|Np&dgz*4G004F?(IWr= literal 0 HcmV?d00001 diff --git a/chart/charts/postgresql-1.0.1.tgz b/chart/charts/postgresql-1.0.1.tgz index 1877132187aa7f054422eca0a279d6ed9bde09bc..8410d56a982714e6ce7fcaa33edecb0acc12b744 100644 GIT binary patch delta 8587 zcmV;6A#~pFL-0e8uYYhbcs6+UVsP-yVE6g+7YE@Tgab_he-b$5WI|#hmVbcKNWSC(r4eEg_d}Xw zF+pjF18+_fJcPLr86Woh*VorUIco#TW_^!@61f#65*!iKC&{djCNvlQjA73EIL6r= zr6S1EnRkVk*OWzk==o6Ac7Aw%(OJ(2`7K2fF{d!6ISa7@VUd{;G0!JKNR$3mKEW)- z0`q<-*BWmx7Jt$33Nt?@6NcEbUo^k41G5_pf?e-v#@|{03l!&={{akO_4?o4J$SKO zU;hWs_rI?HFY#<_6!RBIf@auL|1W3t(69k-V*}1J9Fpl0kS;pP<9I}45-#P(&7=4l zE%_#pss4O{W#z47gwZP<60y8TPUX3aKQwnja}bH;Eg`dlDE!am9}UxNwe zB7cdUF27N4kJyY4i}6G$pjcp*N;2|rj-x!r%yhfQ1!Y&g;6Ce2Ab!RBC`w35WIz2d z&Q*Uynoh|qXV_2jSdc8ne$fu^>*ZCvcrSNlh1_Xog_N8rc?C!+Cml^AZU#1j6l3{| zg1{^xst+@ULOjjmczG|h3-)kL*;PzY#DDu4)&J{nSg3@iKAlQ#V7Qd?;k9gUgc+gH zxyEh?&j*!B#qv~;1cRmoWQd^z3(PnmE~hRD#SY|Lu7MCGIDUmV)*~RH-1PVyF&zDn zPp6pi-Vl2GgTcEWdUubVAqF2`<5Qm{uhiS>vM^H>rj$W8yPQu@AS+iETSOtHLVt4s zTrCCJ?57EmfQNAFdm8`{(-6ggV*Q_BITz~voN`gTR)y4?T7hI)impp8S2pZ^|18)& zco__WLI2qvB+Uu{NIWzvo?tURQQ7hY zPbtH8lei{vEQ?KOo<_vQNNJ-nkg@_0(-)BCcOaZo%FC@wK`UFvECAS=WzXbPIQsQ`r#K=3O)Z?)e?8fe zAK_1Mn&I?Zpzvy2eN@DE(SI09GI#(e3^C{LXoQDwhEen@BLbhMp&WQl{(*<^@->lv z=aUf<^C9#~p5R9l2||ei`eT2ASU)C{zH^$8gWAt#@*g$c&a~!3xViJZ1Pew&URf?$ zPyjGO=ryA`<|&Q~$d~w2Mw!6O7P>&QAuI;LUT|PvIier9Vy3eWRe!7U=f@m#VSWK5 zIH7DgglGE)?}&L9X890y2ZKcY*4&Du7*G@uv%Q2l7c>FWAzQ9%b6?S^4GA=z`6<5k z4K#m2kdF+X^`|7p8op`tT}edw5+u`%3bDk#1o)U^*|FaF$=j1x7Z3#z67u*8N9Q2_ z-GNs}=O^&%Pbcpsh<^|X6w_HSN4x-cnK7~;F`nVAqWTVOzB+yX{^Zrg<~Cf^Dm$oL z%1KpL+lG_3=O-|LllR9G1NjwxJUe~YQ5_<U?B6V3@lSX_bu21dQ}zIREdr@_$GktBtnU)o5z4kURg5TUNoA z;4&fQw-kqpf5VhfDW@z!cV2_psv|4stS}<3LSwri5{hGbePTw{h#Yb%%CXV?(vwus z7;Dj;Yr&C5fH)^Jb>e*J*g|IcxZLqXY7!j&ge!F`lQzS9|h zf(7!Y7=MYJVNaGkH*KrE(J86sJDN`AacrqK&J8$SV8%#P3Jft>;8YI!pMYT$5%qV* z=mc|5|05@~Ev46{gh)_)jAOJM!ofhjltMktMR5$-S8u0?#5uzkbB6hx#?cTC)KWJs zwZYqO1@~ON&8kP8eM#@5Qan&2t;L}%rc0$;kbjdw4N>5gZ;xssMMk6gD}B5uz^FyV za2BHw0~ZVlJX=2Uj3*B?jK=B+TH@5-D8Uvj*l{zWgOL~7bSG-rW~f}gN}>U|`FZ%0 zVCW=Ws44M8`aefvv%4qnzdyY=IS<4q@ic9$vH$EHJRj8bzx#u)_Mb2FILtoOhfKYD zV1KRnQ=5m}gys1|PRA*goLin(j^As^QEvv4_mdQsG-qJ6Hbd{`2JEDA4-mmLk7HT2 z2LasO1vfVkoZ%QFjsq!0@l3AHySsod!oUCv)H&YsZf<-aQwV<1#)_(95AN=~H&cm( z*$}A!6iYU>EY7SIeV$S^88xIjmV#XRp?`?23c_e8XE?=-gdj2PY8iY#Es*c(68OF( zmy+WTgMLGwDM_Z(IrG!8_CO;60kr_9KOd3 z%;fI`d|!wq_yl}y2`H!8ZxSWnmniq#5i9@h!Ea_}t8Us!RuM_9hGrYKFV?0;zZK4ko34F1oOd{z`G!1f9hT|0#&wx-AYz7y|$ zz^yV~O|P4qKZKU=slY=xCuxXl=K#X3;NKA6747fI3oDfOtRhX#aZy<@Vota#sarOA z??o07DWb@6WxRfX5%KGa|Ub1iiFcZ^QSvd6U0jeAW_kd-liR4W`oqwKR)cBH; z;qJ*Q9e%TU6A*zD{$cQYzy%UH4^R{_xlyTi=EvRUwrzWKdRA|nFTy{JA#UCTJi}oi zH%x_*Jy=SVEEN@JuaL4h@!pS?yU$((17-bpd+DwZxmPz~scl@&2+(SUlTSFz1#aiE zO7vvZelO2`MoXrZRWLd|zJGjw^zNiaWHs;aH@-3SP?jBbQM;t{4%77y>#*SNu2ul-h8Yh; z_7tulYvljugJ;j{^8bs2XJ6(2FY(;m^uL1zNrp-VCB;(7cMcOtmVa=Lhwxqh?#`2? zypvCvQpwD*mivwRQMob&o+;-W15L|H_R9ilK?K_2P_5%)14aohlpD7oSe}M(@Lc^# zlJk5zC7+<@m%!w5@%4`1|IRB-`KAqJ#D$MJipiAV2vC+O|>Qi~1FnjUVWU0tujz!A7A;aNzAWtNQe`z2E_g9qD z?}#X@X1P3jDWk4L-e9|my5+89iQ*iP?8kzrwoGS%dr@6(WcJ6mst3cv`wy&xXF&`N zrOMq4Tq|!Mj9|t{DyGo;5AOem6dWtibh{6kYF&TpDR_oO&VTgz1!Wnd86#?n6@HdV zyJZATZT4NWc&ajK0jDzD948CRUeP3zbF=rC!`)!dAMC(??FKLWK@WmgC_~EEl3*Ul zX>FhcuZggTNq9Zumq}CJU+hk>K)XH9m0fBr{l5n{VERMSS#b4IDcBaaiB6)Lb?qz| z$%%|Zq+Bd&(SMi~s7ooSdo^WM!CvPyac8mq+xFwOP$BmIvj@G)-XmDmYn)oLV}B2f6;GcTQI>VrtkeR{54%en zrd<>_qSdf*ZnFjEm=U2&>u!m2ef*MzZ2xMKlkpS?Dt;CksD5QVG}I!|2-ClzBwhpI z7Cz=w81yQtwHgA2!<+uKXs2NOYk^Q&eFtYzj z6>QgRs|j0!bKT@Tho`_TkTk-nfIU}WySww`F>}~#!`hxT*uoNhKbQd47sB}QAQ8^r zI`n=R#n%$CL{E7QC_kMutc`FU6m3|iqH@Z}Cx5Qs^-#>#;MSmP)ybfQvwq-SHi!(M z2Twz&@qg>|;WT00K)mK=Qg@sOIU8)fM(@78Tjk*I^mp|=00)tK0&L(_-deIV&3`DX)sOMYb%~=b zoqr`!T3m2l9eA%=u`E^LixW6%Nx6wS+-M_#MArVTFG(1)bw;B%Be;Wxrrvt@ zX(6G$?G;~FN)z%?7U(8daBiuWco#dv$o00?k98Iu$#v`!9)BuD77Iohj;k+y;Pcvx z3g442Bq*1I_`bTD^=*T|u5W4E)_-W2jm0@|%U4If?vc6zNVRAcOw%KF1)zH2s_iDK?E+Ed+D~(76(7sBwL5TY>uYWAXr8t$tP0nyT#Is1 zbuQW!C93@_u3B|eGvD1x59jfg%as?28d&#hVuvK}X&Nt!i-Bd^HO_M%@qed4WaiH& z`dU*58d?Z?5F#BKJmZ*EqG6G6FKj`(d~0D?Id|Cg?E=jnBL-JstQLn`g*_=GT%Mo) zeD>-@`KC0t>yq&g`~3&`>HXir-DoIxhX2EPoX`j#nv0TMN zCuf%@|8sHj{`m60e?B?;+kfTg=;Eg?xuZq*x@t~#?1uG`Z)}C%@4kHT=nl3sjI#A= zA1b_h#X@|@QtaHk=R#z!v8Zk#nQpHQAAJq0{-t}^$n;;yp3s%)+`JCjMicyEQ%R;cccXt;fV5x08IugTds$$!N1nCM$X9kau6 zH16V*_nhf#=5uJxNG@p}rFZ~PUVU}JM@jIj7=k8rM#lX_ zPb>e=7U5Hdfn3M`5B3}W|GQuPKfcVlk4iIkm{&c7w-o8ZzKT-MtEn+- zfBs>9*{%HF#4mlSJzyRG9}Md8zxQ7py!guhzr@ob)HQDhv^ojv&;J%IT>GP)X6R#% z9e3dhyQzoG)jqp*jmr=!?5tkt7A6OKI1THrybgSd41cw~ET7!*fUjYC+aU zGN^;E)PJ|4w+hXIKeqR{j4)#2vur85R->?uv9Y~fn8k{Cj%^s)k5IoMQ}+=z<(;sT zx{4czvgI(}_77PlE2sT~*1yC5&rXhx-<i1;#KtKg7S4&lp~!V@4GSZd;s}TU1Y9th z&Vb=8H!;+wl*#o%^p&RNjt)0YQh{eo{YFX`t|FEyFESM~^5X5EkI(+>dE@bTg81C~ z7JueAPE@K26vx1YWVa4!WI>ZgLogcUO0VvD7jt6cJWMDRTriYL^0g9reGZ^)HzX!a zC7?1yg$7g)U%72#IYAja?ZZzvPRe$THfkF(6keg3P36QiB}NQ0{4pn-2+TdtcY|W= z27CXhZ^!(A1%ji|n<5OB=fmh1H;_5-JbzPLgmDwk(+IP8DRCm{lp!uyt_ODOG>w;V zJ;$l_w2+15ux%R>t3j~6QFrrIuq!({WfXuSByA-E$2eK~=EZo}ImS9D5R_%RM*TuX zNzyUV^!QXlbD7AA4%zI87)n@$UnP=kpkfApsJ#1qYoqde8@M*$sEEEMrA3(;LVqm~ z6VV~6&w)fG$bnSV;P)SO$%r|+}_i%U6f-JF_+dJ8rJ%~k@0@%O<&@a*BJRIn-iN5?MgH#!<+9>-wvjI03&V}G5?Yb=Fg zr=x_!SZDJZn`~ZVH^0KTiH-4r8Mk9&^vr9qNlE-D${1{1x7KkDwtQ!!S*7?|2U-=> z#D5Liu=&h+Q&;-Av?&yUHUhRqsfmcG(URzE4Lz&a)O_2j^G0U`)4Ph34QxtcT+0Cl z3&bRCQ~>+O&*J)3ESEOwcz>f~Cta6fW%p1$-AI)ew#E)^RFbbFo8)UPz|Wq=m20Tu zDr}p3qCFGWAAwEPNHDIzZp-l|2kuBkTP~*36Jk@n>RH9+%w*0o*FZ<*4&4Fp^Rco1 zk_{lY5(|~%h)yA!{Z_arb^}z{z*c8wtnC$;YHXV3{IP|tvbU+!PJe=0SzDivIT&ouA`#O4^|tg&y=<*ch71P#ffcEpI_Dkgz<{JW@~V4VpBO+Jqnw}AlMCd zA48lbHkET#1Dmx6tJ{`i(&Mmc&SnRjjyc@K=BZ|Jg&;@7S8+#m$cDY*SjYpzI-EWq8z%tOxQ@+5@$G&Tx`hwFe^~Nn zc5LcFL4U?A*qAaPipU`)ZJq?1_COwX-keoa33d(DlhLLtAjr5Cn~tHnh4J$z#-=$` zO>8=b>IrC5i8ol)ZM7v$EKhA}SyusmHur0dTsgiMHje4~sj#t8ky>|#bP4KvN1nwc z&EcBnaRf2B!bRFenwE)EqkE%xtF4481(|CEOn*>j!MO>`xJ_d&8Sw{8qr!lH4@ZCi zexyu$QIK>>Sz@xRYC|={Q*Fjj*8a!9H)orOhDyI}t;9B&KStra?5E>eF!p_U#J|GJ zLnX<5*eU+}eGJH`%Oz@K*VsPR{lTA5lErxE0XF&HJOJIMYvwsjmVVAL+o@Yy4z)ho zDu1DO>J|rCu`n*EJY}n_{(8KvO9uaeqtr8_gA7ImZ>Zi4P8#-?y9}+FN8)>ZA0a z)z-s(J#X}a;DRzkJ!g=WUQPQEIi3R?khY$!SE*SAopC78k!S+r@}S%Xlwwc24%L;f z?T$Z<2GTc35S@5j@yY*5fWac&D1MATBax=q5WQX_mFfJz#HT6(0{72 z=X1qsQ!3=V(hf$|j2$~R-NgzULExDbd@5bF#>puSIOT+74lfpxwr$E|zCE2i8vmWQKXUg>OVZH(1SFtfyYMRSgTcdOVPv$XS;QL6SFw4fw% zK5TNBlPJO|Sa^~(s*H#v6_`!2a+Ol-dQ6nbcN_qi9J7dF$g>%fg5XRqBY(YC6@Uqz z%H7!}sTmJ~y6hk;t42}qu>he>DL!C|6us91x(j=sD ztUnt{7O5q#%G8o(^>T%h`hSZgBt{GnH{6|vj7+qMq{JAr$H1t5fgfs4axGlF?7I8s zB&L&of+RZqiloywZMmg=hr2G5c-wI2g6v9X!%K&Ry8ct=s4dl_a^LuvV>#mjILEm3 zpxfjycDAvx8c}5w)dVmb4VRmrp^V0XSLL-MbLA(oU96@cWE2|-wwacAz$FuC>1A;O$6l8HeQ{#>V5ZP(% zWKs3>^Q!te$uP?h_ zNz$tY+@U>`OIYdN0)Nkwa*^YfxY!N$;ZO3PgB`^_l3cl2atbPA7)@*X#z~>n@>F6u z%?polx`Z-YWob4GKyQtT52?)s%Y#9PUCLjgIKI?5I?b{wK$(ovHb15T>=Y<3rl(j0 z6D&|rC32N~hd00VO#G4GdPDhxQ|)c~TW|PV&*{!@y}P@f=YRbwxonjLMM_=4&~!?| zB1xW;eeds*j76SuLw7YlGloOCeQSJn+6JzoXg$2|bm{7wNbmMM7UmHoN~v zRb^~7NpCsN1MLZ}3)xOYgl92YmMo6uBFmL;h}`3p2f#Fs?T#9Jy{h^3`TBf)p7Qzs R0RRC1|9_zrF$4gf001_ay?Ouu delta 8586 zcmV;5A$8vHL+?Y7uYa(2u>WkZzyJK3!S3_D!TvWecw#(SpPUQCz8QRWTlLQUi##YJ zzhK4*O^2}9^-z`-KfezSg58&1gn7tFCe*vr$=`7(e1>BrU!WKwB+vwL3<*ln3@11h zz?WR$1h!7kj(>P}z75wz%mJlC4Znak}tVHX@pqB{g5VE zOi&u)z?;(q4`D7u#)tj>_4Rd7&f0*oS>Gd}L~cci1V;q*NiyrB3C%@6W0>wGze*gnmz5aK14_@rn z*S{?Ob^U*VXJez7zd#Z+!=CzoIje_;4R{+HaGv3iOqYOk(NP}9BN~%%DL-x=#n))b zH-Sv`=L<9g!eKK;0&}ss132awI2Ir%Y`&Skr((n~$A78Vl=T^&>LonvJ1Zq1R4xeK z&pBrPEGH4}E9ktxkumINc^s2;=IeLf#)h|1M{Zcbz4&;JLxu&fG|k)F4rv^sD_qlc?ijp;ThqAEwAuWVfl(-Bru?ot;&AOFUNR_ z@>rAuhX6^opoS?sRx5`WC7$ZBGaA;O$69Dyz4Z2&ecYRV5` zQ@6a?PV)*SCB$Nd=)ov{ADarb8I}?eO#rc3F3G}o00*-Gd|$%%!#NJGc%C#TUiTKD zCgCKelYWA@z^vF4)P%&T2$E>SzPr@zUm`YZw$ZXR>KUFhhEvh!0tpiKQI`1{OfVNo z?04$Ny z`Ww=8N@h93ev-$6WHI)Oc6eVeuj0jfxhpH=PBSZ{wU|5TWW=8_p zP#d9r?Puye{Dk8KP?}Pqrz=fi^nc5%0A8UKCKyr@17*;=!Z_=B9>B&197(}DM{&F~ z5_n|smDv5F*|rp~U&V+dy3QH?m=np*9IS&n%98s|A;MFV;%Gx;BwM7nGqHmWXrSM2PFp>Z@Av@PA+KtG^UA zjKtCNdu^3^y&brolW-0Z;gSLzqGgH_5<Tb(%F%6}8 z9PdC%8;yaK6@Zw&fGocQ;ha)lZe0pm*)nDUz}75#Ca1#Dujf0(5eaB&;k^Fq$&UO8 ze}dBtr{@BNSKI2NBEE~pP=Aua13+PjIe$kZJcKihqF)&i_%sdWz;p5sJcO68iTpdC zjF6ZQp;z(*KblAoN)*r^`wPVSF`4w8(}WzMm481!=9mlf3n0M> zWy>Kv+dp_m%)2nlhp;;sB3RwTuMqKKI7CCs^?378Jqa$TGIicW1vpy|v{@wIQD z`3r)4WcaKHGI5uP!#X;i6XALFH0T zsAQ~V5W)2vGsP+t)^e91DQs;DoMiHVG1%OJ;>WK1 zVTrrB-E-)W)afN3Uy-2tPChwTv#|H}=!cWHy~gK?W~8T9IDeh$b!_nN)tZt0yqqir z=G~3GKKl9f$-2hQCBbTqNrEWYJuTK+nW>oc#dKHuK}-@-JN~Rad4)8|a)JF~87bMT zvZ$&{s=1)b<>Yb97DVrtVwvF~ywc*{n~?_~7sL?u_ntqK{Na-lFXJ~OK7S->DW5~XGJ4GbU8NQe^%;z+YhH#*kx@oBm z-hL~%=jv@%J?iXBdLNbIff{Ko4rMW2D&2yd41a2f0hy z7=;+PU`XKE@{wmed7xo5R!7hhr~XC>wrIhQn-Lw1ywIjQQOh<%Y$4am*U!=D60 zC+R{>i6_$kITD-QJ$e8A>BY%;AU=twX=9E3XYb(opr-%b-~DR;`7)2g>_dIX)Vl}P zihn<~dB{yzowws?-yO(v#(>#ui4eM@Q%9zn-2QAAY-KahJ6W;`hSo ze!~Plg}-x}W=PBrdpA;)M?s?lcRjcTDUBZNf$v8+q!Ioz;BZd2)!5-Ql6{k%Gk*ew zWOS;Jg&fQB`dkZXlE@ukD=&`9I9(J>)5s$ey1?7jVU(brkOsbyynHDE3&h0Xd%VC* z{!YO6g;;`5z}J?5a+>`nQSyC>a?c&H^6wt}W@fhPrk!LJk<@BvwqZ+7?DjGh!D?HQ zS~aajs>9xcx_KzYGJ}~JHwDa&hJWuv#y`g3|18O8MUet*uRzhYQ%GWKdd%-T@$LuQ zD&y7ky1Ds7X!)KBJcM(ShPZYPAlwT64e?#k{+_(BLV3?B($pLml@%lAgu9ZuWs~<_ zWD$`fdc4$YhvtGyc~Y*dzrN%p3kLu*F^!dlL(d+d$}w;cSZ10?-t^Py`F}-?FDV)B zo~+X0H=8#B5jf!=2EPYfAd&L`MG=!5m3n7>+-+{#wnwLD^|tvU{KFXH=1sse90qd3 zR2bQVr9{b6QE~PPDT@>D{b;%S>_sq8)_=E`?)s2>brY7_#^sCvtyVbsgu`6mb}p+# zPe$$c^4w>%WLjATqtoNd_kTz4PHIF}^ZtJ08$%Ce*vH|Kc(y%vFLvIertOS_a^x8VMF7r-7h8owaWjOa~x-w@jzrx z;R>=w{(nAr_Pj3tzj(3xRsR1H&&^H$J6Mops8mo=ER}rcFp*>l=YMzz-}UeAJXy*+ z`IIS@%p7aE->4szD^uW^a=tOpw5(*mET9%dpdAj?IxaR~l;A?SaSMXwX$S|;)t@9e z&!PqAdwyUUH?n;&@&H>4OEQo5$bQZW5)#XNJe|)QYFg(2fz&dyq#L!Tx z+`YiH^7g?9W{jj_3cdf}{(nfpu>wuE`;e*D^|zjaXISJ+pMPIamNA+!qNZ5kXQ{MX zM$pt|-!+S;Dw7s)D#OijvcT*WO)@z*dw)6H4fg!O4*b_{@WLPTAb5o`qZH0Axp?gR_8+w)x6rPk8_dvF7$KO~(6S1*-pi7DQ0D-%z0h* zZ6(gS+dx`ucpqr&a#bCXEDTPvZ={&j0_#-d;`q zJ9z$8|NCX0n*aY5Nu!}L9lt}FXU|ab=%>Bi?{_x#z<*fr^qCQ5S$EA!Eztb1yR>22 zMR6lq4IAe+TVReE5z4ggmN?hPFImX;uO>MePl2G~XQ6@WSJp#AEfS3|{ToW+H4tv$ zV@`!ZucBJ3Ay7EH>93AA+|X4-m&LjuuNwc>^=w z;&Io%oqvB7QSNB;#uVVePlzj(jT8-gaCZmh?^3yScLz-Y(w&Q%!IT!+e+v#H`>#~N zcFne$ur)Z>P0n+83fuxoBb*A@a|O1$J5L@nhs`#u?OB5@EYbIa31EF8j2{mY;ry*b z?}t%*EfGufl-Gdr(>cT1240>1uN&WT(+aQ?3I_S*YTc($Zw5)?=D=y?cr>uJ21rqi&tY zv{|_(P?oCR9)O;+!PaZ^?%TUn4*pJmSKkA05V`+<|YEub-=VibyCLhCwaOx_~7C z{IK$K^X5iDg@r@rdO@P8qu+Lkc^DEulTdzFK5?P5W++G~zcEat}h zENG(l`j5b?(fQ*aRyVQ2fP5eDZ{EMTIR4@C=uoCCLfb>!#y zUy05I(w{}>63Qw{XPxp;15DN~5LK@IG?!NKv0Pib1Gl!m*7lC(Y1_i8aNWwaC>K@d zqFqs<+Rx&uRYx`R-L3R+9&fo^d6B4rb-yNdNb;Vh@v^uWShii`JogcQ3V%dq{(PdZ zHFcn&g`fu^(xJgKj#(ud776#l7PQN^7KW8`hh5(;(Cjf{a0SL{aky33lS0Df`RUJR zuTGS2N^`p|8UL`~e~_Qv|1I2&hH_{4Kb*%2jqstlDA_gcD-@?y+()l3PyT0gdUkPg zc6stY7bowJFaP`Jle52Fj(?6We(I7tT6C|g=48iiSReVuR`~ty%NLLCU^~MoTd($^ z!mC#-#D^@!&dqx+MD`ks>K2me_S*2#*Rbkex;L$-g1>@aTk?1E?FK#ccr;GG4(G13 zuI9by%A_jpD(kDt=328endFQ2Ryb{i>fVTk+XonNtLOZhoQ;!AEPs!QzD3kAI~+&j zE>3yRnZ9N|ht`bblIBs02LR>OR~LMg1iy+QxYMt@+&V>0=f1jnSGCs)N<_*7$)gS} z-8ASv#kdscDz&cvEgSi&ZT!m&d%KRr>1^Zsx^C9v^OOY}k$W2ZNnIn>3g(~S-nsT^ zwf|MUlRn!7xW@j!yMK33zyI~(+1`t<_P;Oj)C~b`mn2HNUFFV$SG65>m|Hr%*VIaH zTL12OMWy$zWdE~9o=hH2zoc1>q_ScWY~U!4={1m41!i$CbbFeYRfJ`~dIi5=m-oCc zQ{p&vRC<1s2Ks5Cgk_o!xHmI|p1wKL!tZVOGe#3E<~ZlTLw|-cyt4P|9Pq!9aX-=1 z%Kx)P_>^HF*YW>@{f7Vl?pObhFY~k<2HFlkm0NP1=a_BfKdQHiQQH~GtGS!~J2-#T zJOgB%-WBymYHI!J3+RH7Bs-6nX!*o~SHQpv}1S!)gzw4-5maJ;E z*2H2mVXM0Jp?~Bb6@V+K;6}i5if-YL%0YWwm2K;z(u^JERS)4UMY^!BqSW(hYRuZ7 zf0$o(EB`m~OP^{FSjYbdgL?e${TD9|zViPs@w5na&D#O3PQv>0zXc1|{%EHe`j}(K zUAV$->S1%W&u(4gGK2~{t5>>($-y2@!@4W4!(v)M-hbSvc)v$+Hb?Js74^3pP=m$% zvuEJf=b!ns^Zzd^|G#M7|J{B5{44+e5>E$fSFG>fg16ttX50|qOC3T$XkV)lD!PYi z0j)~teZTwiMXybk*87X=a@vRiQ79+wgKwLaGpm|41!6NSMm6hOMP<_AIivx#AZsHT z)WKKkTYu48g=WDY+k0F_7%}l#wv=6~QP{@V*xoM8Vnsa1HVo}YsNayO`v{xzPS{CZ z#f?MRa+qqXcW)Q_hpdv7)BZv0-{JpfCr8KcPJ$$QY96zi|37+)fD1ZFEWuqZhqrqC@%GQhXMgs*@pwEzeC~Y< zbAKEsDpduFW8gxvTZc5Vph=@47>#nJSNFV&Ik9mbCX@;;7|JC1S_!>A2hg?~5|gG9 zP#K~^1FDCw+_tftpp2dN;U^p?WxGZjwG9~xuh7h6mDGd@7;2Oyop|Y<5HpC9J})5=k~tF@rx;-u=F{QTe?MTpMsyL|>EAqRb4T7JrC| z>R4pZh#<jh90X}RdD7< zPzjxl>>_rfWT`pe5WE->`P!kr34f2{#%L>A7IREkG43Yumgn8V$kvC(a|_312=M0T zmgm+c*0@*cdS&kx{Pst~?)cbQ<$*P-)g?A#$6$C1sj28D*?jz``{pW_Ha}x*p&XGV;A-t9gQ-NV=#F})&PXD&VS`KmO`=9 zQNm%Yvw4k8Hm|XpUt!$D#`wUD+p#fv=C#$nD6zO&J+QhcogtqN-5 zzXomCeCE8VEB##B6pBC_0o$U~M8wo+N%Xabo>gpWzHQZcqcei(UB$@;HYG8x$=8uh^0gM=XV2owHPmqx zw#_}!o{8&^z@};>7*}Ao<#>|=cch{%7gOm8v8i75tYUL!GH01*uqxX+f-^NL4U2Rt;}7! zAx;yU%DJk6&Dw+2ZObv~ao99xvx7~?9ByLsRI|8pE6DJhqpqxYT>w8{E^ZoK#wBfx zGxD2}ifXPCUw=WT{^SK}|!1siLItDNpC`P+1$S;rzsxPu8i$-HU3 z>R@1-v~SfE532xvHZNY`NiVm}W14OXwXg}p)% z&(DLse!XegZ$%i6f+@eXx$0DD8*&076+*(L&G=yOd1r=|@jS+@*qAZ}bsTK=AB#*o zHuaz&<9`-xOc@YGJ$Pt(CJJkZbf+1|^Afr0n0hvOy_hbfE|zS8*B#&M7Kh z0uc`60=E*ReKig|@5pHX$pXjA9YFB6qjzt$!A5xla5a9!7`?UOxm>H|yft0}nbycg za6Pv+AIIFUGrv4`;QXmId@oVb=~3gjC4c;l<_fQz*2nhH+n&EL7AbRGssG>ru~Q<&jAidThG?3)U1NeI27neG=Xt>P;LWCv8P>!>dM!4 z$Dc;>?lNkLZvvw9w>5@@Lrg=*?Zl`E2`|!S>J=U>Q?r_2cv4njvbrsVug($@JtFmm9ARjV3qo@SSS?k}0E)w~+n8+IY+>|RqT#g+Ih<;ReKIvP!c&G zHaW~m6yX#sJjohWMnsYd%%)hmN-1_dCd%YH4ggG!S;R2p*^Eg+aHf}$UVp0!zywd_ z?rf9Pj0eG9Fc|MB4S2f&L2in@-dOt}8MT_j0ccii36c$Rqc67lwL(WM+4+Z3dF(iH zx=!iadZib&(c#b7Oq})-TiYC z(@8%;5}kfU(&?MF+|s_oU6)C`ZMbtmcBQl7r9(np|EY7-mg-TtZ+y(LoN)o1V_bUB zZE_ep+t^r*s4|Lb0+@}4%gxVFM&rP%@>(k;R%q!rBzEb{Pw}-4lYitd2=aA&A2L(n zjkXmwO7M)ZKqNK}v(?Zb-UT&|pf=T&)sV~D<<7a|S$6ROL75o}vN)fqaYq7(?6h{W zsCxQ&RsEb~m}Qq+_CkU974NH@&vNZC-%Q1Rgu@sy>>C7(U1~$GV1G$-e}ZQu-QMve z>D2=6&>qSqtaNXI=YL7L$Z<<0VrC;898j$$84uG}m+1(h+3rZs)zq)=*kDzTjA zg~vEuLYb|yG@AvWw?@T>)aHWa!63vgX2=q5Q$A_BQ>kH~g*VbmzC;-CfV~et(r*wn~B`rLJITIwfI| zB+tpd_jgIgB2T%YyPBUF!=c>1H9k9S16NVB9%>z~WQ>M{o=WA5bli|4p|2#H-T$Mi zGPatex18sJ_5|03Y$qbZvluN)7DscD<;pii?s3WkV4BBvM-9GS)%^N=eZD?V`TYL? Q00960j4tXP00W)?0N0lS761SM diff --git a/chart/charts/redis-12.8.3-bb.0.tgz b/chart/charts/redis-12.8.3-bb.0.tgz index 2993243961019ae4eeca7f5267ea5ad69eb19dc1..5ec081aafff6eaef5556c92d759fdc69575d7fdf 100644 GIT binary patch delta 74748 zcmV)1K+V60rvvxM1dyt){d>1n?A#af zpfIEyaY92j>;QO(;|Y!DLpVYljS#~f6p^2C%m@vKaI@DzQI!6C(d~B!dmSG~IP`Jo z5zK}i7eX|{L-6QqM#Bz3j3dejmr$piM{L;Zd4k|rcSLxIW~A$X(OFOb-2vceB9U=H zzjISqH>T-9_kH($$H&ZzNyO!=w-FA3(IocpE+GE~g&y|d8qeJu6eJiJr!nrr2?xS} zjyVn?#$z1E*auDlF+kuWj)3tv@puwrU^u?PF)$K(SU_Unp%6S8azsK=j)W7o3sc0V znC(J97-ze{FlT^&LLV57Irio6Zf8oxsF(qm5I#*tcE|OY^mvSMZ-yAhar#NF(hl)N zHw^@P><|-e^cY9pHB+T~WHwQMx$?EUx7UBa_iVo#g_F)Tp5M~gm$Ri{yP|t?oI0)? z1v&RKL}XWSEQ{h9BEit~AII#!EhIXiC;nSKky&}{$He=8Zyz%OZiZq`!tOXuE95?O z)H{WhnoZeu!@wCT@u_!>W7l*@)EM^E7<38kbu!}F>wevR=8i_)e&cg%wk0`+J37-RsX%hOtr-TWqVN51TEQQToSyDoP z8xr#b1ya}|9v0G>Pnc{BMsx7-7$pIh?UZl;2+#-zYzQCjf<6AUWr~*VZ z=0g~NJm24crjfrqJQL`J*pn5(r{Pl$Q*?tt3<^v!@^LIAI|^S3{9^n^LSpR8`l5&) z2N#^LoK9y(L%}miIH?#o@oa6u_W>QD0FI>00%V3J7$Ov-8Rj@QjUR7 z5m)1QOM(FC4US{tV>yh)%DX^9FGze6PQd1W@4M+7D2X>=s{TZwqNKmAEjUc#7>69t z4I+WS-IS<7cBtN*;|XCro=eeJzBx;R-~xLw=AuI#1w{V z8^z=XaqPyrxCAC7do;m^0b)$Ry0Ctyges^(^iGSXa4z0%U%uJV{n0y@C=%mww%rMT zX;Vp-a;qx{s3fN02!+=LIUk?_O^zn2Kn}^4 zQt=i`qDU$wuE5(xq3_0+MS}2eur4|#0d@ltUMozLLZ+3yzH0j-!X6pV0cG=aMg!u_ z)#oF%WSJncrw73;nzN@s##s-<8hRRkAdVS-x(hg9Le=83_{sQ`^0OE-9P+1yo(_Ax z>tuxE5OXX=dY^i%moOZ=lZ5!VCmUeBttiHBlmr0@C$4&Dx)PdWC9x&{e5*kX3ylewiyKmK%d+cAHtr01n?6xn~)$k65;^TzKFLG^}BGHa$UVG$pT74S8Be1 zYql?``3u;J1b~KF6Ka3EC44G3A!c^Wv~eUiOH+Y_jHA%QvR|f53BzZ)jdWxy`PGGgtjI-MIR;y9 zvYExY1_RA&H6AIywK=YaLa2V9@!D#TN&r~IZCB>EX*bn+;6xX@HT!=a9 zhgb?B5p4T#ioNSgGQ%`~;X`=d0r(@KaWWI!4#20k;lY^W_zejH!mvj}pABJ8Xe%9n zF(QHB#cBP)*Xo0i^MU{e7xU0#Ll|_71ikm-*~@P_X2%cE95hh4o#GI@0HaW_`jGmV z!O5B4X@3zPh0-NhHW02@t1O*ys6f_$?epV{<4Yk_?}*7lL7*moOh8o7By%QAzV;;& zoXjwc@R&;bZ78K+t(MFre^op;#P7KTWcZ21K=$LpjLmc1y93`RiUchNk<({jOyfL% zwQy`?uL?|xg#0x_(NI-AmYg1FobEkLXg6Ng&dCvzjbr3Z1;Y!7hjhCq<4lo~pVLZm z$c-%p5X30-=?sW}4~VO|Num^n-fedCO(+;rM?wN^u~l(6IT9OLoY_I}mUcxw?z0M7s(%aRS^E~G2lN5JK#1Uh4Tp+b`%=8&dKxTv& zX=CBW<-q?Ho;tfgPdQmcjLBBt%#r{G|hfz!; z9CMPXELv`V9GcCksWzWSI43;JBRn*6^2wQ+AYJLq;^InL@(EKf4QE$8=sm}=;C(zs z<1z6dl6y65OE%A}mIWhzO_BdC3WVGm?<}{UB1t$diX?{-jKI~>d{6DzF4m~H0Y$z$ z(#=TuLgEolTt3CF7Z4nBSIw16B6~y(h)dNOBX{V3A?g&RDzn{)aZwhMl-1ikm85oR z%GqPWS_>5(4LuxjA#p2B!VNLMrSUZhC+1ymOTcsmMq(4rOA}^d4IW0MkQ1A|H29pw z^hPLND4YYzb~wv|2DekrB z%-1}BJ_dH4MC^g8G7%Q6h=GOu$=R?h254bI%G7ZZ3cXrT1|q|Qc7P@m5O3~ z{2qIUGr>I_$24PPTTaEi=$#RVH*kaElFBHd=VTGh?7kC1!Fx1|0<47z3FtVy`5DDb zzXEgO6Ds*~OR_6T=R<7}%$K8lisP$t>F;8HIvb|10LBCd{y84o@ATU<#HYjTPcs-f z?BLhmI<|!H21RNJbAzFKQK)?Q#;UHQ=hk&qaaBL%0t74h^2d}W4ZC>C;E2u;2|>u` zUCaKUUJpV4>;}|BL8qfBR&yQOm?j#zonkS(fZ)_F2W(1{z!$4cYc4731=F$?i81JZ ziZkltK+;hZ1@o?!y_Ie!tL(}p2oV)hyBH%SDaSGPxPqp5sahbG%%?j7if0?D6g1SmE%6*f=xlOg&n&CpiNsJjg zy?BGTH+^mMob=Nf^^0FSnzn9;+^7Cw!XWH2eG&Fw>ivFbepDTLI_=AD;+1e+mf z)}35qv1v@a$knx6U26yqL;oGc^dH#cU0GI_&;`04ojILOJVIXWFrR;WaF|JgZ3kIM z;WWskxbsBlxSZ-@(l2RD1wkriBMNJChZcs+ZZ0aO)&dt$M81z{5?K}maHW_NGQAt< zw>jz6NT%RQa>ZT}6F!%s9l=(Ar5hZNiWL%l_LhSxIAF2h#KYYrjAC*_0zA>@WvT;) z#bzuZqP}3)5)Z-lIeyQTgsb;l zXVCBW`;Ibi8@04*SnjFlnn9JX@Ov(gu+q;Li-$Z;!UOgb!?7N8V@|KJKMU|>%W;1G zP0j5Q<J5O+Q>3x?>VE?#79K?0=MY-Z6hVX4vq1!X&jZC9rIhNl0VNgp7DYXu{Ir+39Sh zrM0*sPm4{DuCbIHrNGW(f^V>|wzX`eRU7JLB@fC#`4P|65z8C3k!VXQVlbArITA9C zkuNq29Nv(ahH}~5pqL0UVTI}bjszJa6v*P35yq9frJTx0y^%nFXpqb>Y-jksk)$Ax zl+toux>sa&-5Cne1p5ZO0QR#2CZ_!`KxCFXEMZ`Q>lP_oThQ>BgxKGOv!4%BOR_N_ zr!8xHqefi{Gb0QmnuM9GrUzQ0AqF?c`eNQG>EB|0w&3#hMP9xa?^C{_4TPeQR?jQX zhh*7b^adt$7JXWOq@+8woU-*Q4UQq@V!Icw4^^pbWF)xLoU|aRR(dIDE~2(E564{X zU~*Hje;VR7@D8(YlFGD_A*y_*e^wX%5zmVie#G;NItNW{93GTwh&QG`VsRe*pxho9 zY?BaZ?5ok#hdbi)2nl`IBheJc$}kB2^i0;t!0VYU5_sN!|D&TA;IL>hGInefPZF`{ z><#QNr<13rC8kP1LY&pxRd(Z?ig-#nhTrjf?ENlSV-zd*5eZF0$xPMq=MbD;oP=FA zb?&1j*QvzI+TZoAu^#LD5sm^nmz+%qC(;)P1q3kzdsS-%@_iSFf;%&pQ@J%`?zz&F z$Q8iOa}8F%0^9`?Hag)5lc{X(tZ_ZZ5-Og$Twg z)Jnm7O3Omhnm+ZY@3J{esi-b`Y=k2a;vNl+x5uG>DP#D%@^s@knCCp!VzJBxb<1-Q z!CFJWvxv{NJW}NZQa*K8C~PUfLd2kB*XRSTLDzIqH*YXB-csMa{^{a}qi^kB2d`gu ziiD%tk3~O%+?7pCZk?8*)$WufrG9!N$RFSKH0dkqrX!(%v7TxorSFLPIi)zF{z1W5 zSA+V0gWLWKx|419ud@0VZT_HfXTy+F8n_ z2>CM-3V|oiOzWwJFiQeXq5!*TOU&{oN?)F;JPsAj zG-cbKU|YL(?&zb%RQ*s3OzapW1heQfu)ErSKPIzAot+%L8WbB*#t5+~^dginoIyoQ zo^_=N3tCYhF^Z(M>7R5qA`&j!m0&GKxNDg;Msq;=qzc5Ysg5E=BT`-nXgCof!W7AY zkl*sBW?g$6rGKY1$dPf?$(Rt!s*c6PRxMeZ=!k_npjaAAl35~{vF1E*em~7oOt!0k zht5qWMNo?Tbf&(Xnhz_S_v%HxIqm&(o%R+?>K_5Q*2EJ}nHOjW zu4j90JjKDw+{@?cohtoStRuN9$ha^h-MoSXz5HBuEBx!^!l^o}R^}V-MHke&*6K{= zWv&lbw`zu4`O{Vo_*V4+cmuF!)xb=D8&#CG1(Iu}NE?~HliCrTbhSux2U zLR#|Izg^G%rRK#8h_aBIRi-%MJLh*Fas2x`2R_0i#u2>z(OJzWphhe>r9K9R1MG1c zD?Y+$fb}_G#W$r;D}P)eB&tgrp^!?H1l8VJJQF(9;qsA!|1Hk@5wVrG#(4GocB=3 ziEDltEX?nw*;>g3qENSu14Oj(ark0=9Kwwo!|HAfY6$JO7m|F=Q8MDN%6@7ogn4Ukl^COsE+eE*gbOCv8BIbVs3X2B z=6IY0$~#qc!6)M}jxAT?g8z3)*otpR$AzAcII^2&$;cM9`B0J@HZJ;;({Z8?|P@;bCtV#=D2Du6qkP^wtu7XyCB4tUt+@X+t5?A%g8_R z5WfDNq`a&&YpL*JinQV^3aP4m|5M~kYX%n@^klwkIIy1Rb1JV1=u$KW8Xn;Qb8Ovz1??`hzVd|An4mz$ z#NcAx*;{UJgc$MM^b^Cpx0Q$%#qMfeGo0Dht#`vJPFux{B|vd z;_0|7Gv8wO5L{ip;xP@R>Bhpjw-uRo%+Y>qW0PVrw5C{c^GofdkO#3kWP-Rp8ycFusB2_l1VUp(a`Q{iuR3~b zjIlD)OW&~ca7&t{Fp)~WagqWW?+Qgd-3fNp7EZz`j)@S)C=-m_3#6%$ge3}-t|9_$ zW1Z|qFuCqVxFB3**3K=Ca)%P zJxB6cTWW{Poo!d09KT-Xr1*Zvs29eka7BZd$b8D=xGBSDXLTR6404r$tI4*tIa}GB zt!&O#HfJlF(~-Z{>B#0x<8kiqpT%^B`4lG%j^E3F_-irr;0@+6@zfm~^=DO>)|v=& zRWUsmMD;`=3g(=6Ix@eDH7ZIALX#m3x-Ys)%c+b{skD#3S`@T$tV)TMo;@(5_y}=- zlzf>9{FVSGNisFxO3|W-VC^lMgE+fH1Kt#S*X}i*%LukV;`#1u{#Gp3AF&E@n^no0 zFO5Zi8}arae`{VysAiRjAz@yOA|YuAG0>?fp!87Zo59{dDQ0<*xnzMNW0=$AX>4TM ziYvArjWK1ttR0s|LgSEIsg}^*sG!OPSv3m;oePC%*$l@JV(ja?=V4|>%7Qd&nj51a z7$NUE4Q7!s4hDSlf zEEJX#HI3YsMhH)94ngn>H+#{^v>CbAtL=@YF;?VBid^X|4MHdulqHkb-7~LW1ievz zKu4x~N7R$dMtcTFq&xGsVuek5b|M@4S)Q#D23T(KzDjXph22O8KvyT>B;C3#{?fjy zB%END#j5x$`#Q7xl=c{mGn3-+nxAEkOw#srB?YIeD<^x;Q9Qw179Um?K%UA@6yqpB zUM_CN1iv4`)9vn8J5TM`vYhDk5T5FPUE?Z>@tC~7dNO!w#42U!%ofdg5@3DrU+a6F zRExgJ4UXLObHlR>jPB;oBzRg)C?G0|yin-6=Q_wUjiD>k##C5$T21tpGQF8yRU%EY zD~26=8H&!;GXCrozMy7V%s$iOEkBKn;mD9AmfeA2dDig{Au{P9(S>#)QvFANK8oa_ z{Y;GdoF=i{XEM3#4Z6m_k{GLVT65f`g1eaDFY=1K4!56+65Tb5NG{q7xPSsIwqMze zBYGQJB#PfhvCf=yl|&yjq*u;|4_Vl5Cm&|pfiB$LxmpZ%?%>rc=vyGiG#&B4lL z0b3p(VFi%+L4G3*vpktQDKv6yWrVnH8V;_Lp0t|PQ^TuC)a0tH>AKc{kq5SuI_y}IY!Sx+*z#Z@XuD~mVq_(9oRbC_GLD3jYQJ%BUf4Tk5?*!Y%NLTie+B+rO1MRxmbezLQqJxB4w{$v54R`|MHv}SPk}r!8$fAmNIiaXtOuiJHuZ* z2UkOO7qOxLKpDT7Gds`XL+lV+TX2>wZ5=PV7-z7(bFmUIrBiVlT2#N2VH=B0H3Ts( zqt!OVuClsIhkEb{ixWvuFiQLhZWS}N&R04E#!PpAj?!1(O7NAdXGX#UqX!!2=^1+e zQ;6)hpECbvF8?d@rg(gsS8Sy-}1^QQXwK?0%gygb#98cdP)g=}W8nh|&O~(AiBt5FW@c z4RM5jv(jQmbS!7JJM|?Cty|HgioaLUVv1)K`1GA+T@aP-8;m$>Y)X6|hZe>Fj$D(D z<|Vt?`v`IAplOe;{(6@i2(5@$je|9F`Ef8A6)&_L(L5d%lP=$DKA3yiF!6Qp^QdVF zPMr+7(&sV{p)flY^D(BjtY#m#SFPs>aJ7#D^DM4WR@b2G}@xh0mkk{CYFR;H`oPC^4OeN61ElIJzi?? zYmkF_I)+8G+|(Xa(X>4frNY%@-QH!`$pO48&=Dj5EDk<2aLk5D$edvX$fd?3#-T5N zDbZm8@e6B9p()?LAz}yybzjkYM@qLf-+u~;Sk%tX=W;x2Gq@r%qXHgfl}{^X2K}?sIC_k3veAiOK>u^87#xd6q{a>kFByx z*YM}NM`w;K*W(Ru-0(*G`$O|aNqrlC*4PG>^|Hp2DYy-r{1kG%Jgi8qpR7@|*Ei1! zCV!bEil+fLjEO(W`fie-%M$>7h^9T)r0Gp3B-RGQF$qy%XBKl73Do*Py~PMuZ7&%~ zWR6K1B>0#k60nDvqD=c!iM%S>H^*V8q9+hvNL?2pFsidM&|JYiK!tci?6A z#)sO@8piLfc6Kw-gbdb;cCvIR^Yv650_0t%6QlRHa*NCDGHa246-q5RdmA3s5&ysY zr1sH2`=ji?##4y(PTyW0Uv&9hs-;$UHv_m{BuWu?YQfGI`GTE`RU2&_sS9J+w|~K z446|f7_ahUAv$OqbJcmdBQJ?e(T&;!XOwXnw<4J9ebkrpW9M{JPF==-St^*zLwuTW z6{;+sjZebF-V}v|&AJNn?|x}?04Y+ zM9n~jIndrApl@~uG{hR_6bV*=!<18K+Pb9rO`+}7oj%cNHPuOEYBx!pNF*_U3Uwxh z!2GzX?+-icW`1jC&tht|vwwHjv0Pi!&2HsFiG8>sNF`AI@SzNU!7z|CNg&+a8FfZo zC6oE-PA^pMU77GvOcM#!-2{#7Q1oJfV{lirudjJ@)3{6G1H19M7IL{%*8-n0jb&UM z6?7_fQ(>LXclt~3HYOZfpLRi}$V~G{=XlzMp-|nD34K6p_i7R@9yRmA3|y9tn2FKy zRS)FIp%J~oT{YQ%IAD1BIcqmX>|S%^>V4(jQ&pOf7Hvyo&i$Kqi&RovYY#d6pLFy) zg|6B>qaXxbQkY<_FibbSI09!{DaX@sC}=T4_zN|qy|0Be0%4Az(<)0^Tj^6u8%$HERF!sZW>%yFqUaF^5~fED^D<^M0Jdqs22Uu0s-I>x&9la9JPc0oc9!>L_XUVl;` zcNOc2s7##Ar|O1e3nk0mfjTDUqzWsP(;igiY--&a1w$w*LMc(IA5AzTzP55}vzHLA z5?&*mv0>TdotZcrt>1TdIc@Fq?a}eo$yq^vO_TBQTM9vW4UBL+W54!)>oSgb!n(-! zW1%0*clyVjvr|Ih?Ctqw0f|+bXA$PshG>!7C%&oh%N zy6=u@e2Zeg-3+rEuh*7y)ENMWb%w!zzm;clu=i4CqZt(DF<0*ko4smDAoPO7PX|;+ z9@ODiFVTdlfz_K`zNkEWLmaDK=z^d62z&F~<0<-oTupHh;h1%K6s)U_X8(_8`!8QU zFZzGH?7!Uje>}$X;Y05$xFNHl^qm}&081BznHUytiihx3Pco3+SDoYck+e~N>buk? zQiOC7>2`EES4W>S97AzxH~S{zXsXC@lHF&z2AbiwH#m-kRQ?fooP-{{cqacOvx{Ur zChx&W`u?{D5g$*W*EeORyKz}5){a2qJW}EV%qKeg4F=X@>~pqz=gpGdouSB zqcd#hi&95g1P8v#(j%kas^9@KBE+`twLbn5YK;)vceuO2SEh_xfvj!~bT`JYSYL_>mSL$k*?^zv=Cgp)2Ox!Dqmr#l~t;`aETRaY}VRlt$j{wEn8TyZ4Algev$lE zt03u8tyf*H{8EdqSaac;%U9Sexy_RM+?QP8I;*;$>e|u` z5Cm%O(dG_~MDyR7njh1?_h`h^#5c;OFG`9LsWX^1_3s+bTlMirJYUq!A2q1ey80uY zKWJ|c4_Z!t=s}w)Jv_KaR}T*!w5LZusM~RDVPB7aIFkh{&9(wtf2s5xsZ{VXi+S&(ld^1*5I&r7nG-3ZK^5sPo0TD%z;Uds4&lcHx}VI-}mHgC?=B z=4mNhNB`lp0#Z9>-(#-nK_6ACI~}z|U|;#D7#940o-j_riO$Vfwq`qviq=@co#ugD zOdO?-3Pz@UU}B*U;2Z2K_b>alNsF;Chx|E)SGen0=xgQW4DQ;cQhGdtFQRp88(G;B~GZ^&S zkCqO9#4Tl`TEdZK7Run(S~nrJt<|1I=U&c4m8(}PfTvB5RHV?#`Wq>HBZYq+Qn*r` zkK{4|Nt}=liDtUefvoYc#R?$rd{SbzZ`j|9nkAqIqUQ!$wgys^EWR6dG>4twHq{Lo zJ@I1fU(O@R&iFjSZ^zKJMI$l>{D)P{nW5-^R~3oxH<^cZES(Bvb|zWJWWN6JK{}Xr z!BGN52GY6^V3+RNMXCco=&gyyh0`=E?thIzvZ{p5b*sMD*-4`1XQHxVx%Y+s=3&%# zXn9z5U0)tj%RyQQwZ!Z;^Ze(ZXM5{`!zuQz#kBJ&j#Wa?Sb50;N0T(`n{1XrtqWOy z(YdyuJ#1&5)kb4>Y7g=C^_=a-v-^)Kwd{8!^uclCckldvfAWz{(cbeHLuW@y;5sJE z5YDp>fsZ+siSD*7=jW0UH}6xOA#iuMlLm7MsnpOBm(dhi7C8Wom{=5{$Q6>X)oV7?;NLp)Rrx@ zwS!ZkRyFpiar*yaWl*qn&4f@k33Ouj7U&>;8eV0nHudi z90tQz5D>eA_OQ(#UDEJRbLU7)N zj#bpPB50;%O=U=@^j-M#!Rw!nFW~2c*C$5@mnUyehwnmZPBxW3%JEx&JU8&O?x_hX zO2^hQmkWiSGtS`0uNmCvn*^<%nK}tM}hg$)eS;%N3E!` zt?PUQPX7nZf}QHxW#zcy{_luPMkt*0CWzx(H1E#Q?B4f)oA3XB_6INa2Zj5;FZNzM z-`xLwjORnykAW~wXd0a$|5lN?`6g&6yTvsG>&~4jE^pn*B$&@S*Ch0Z@V%m|&J1(p zBaVh0(Dqs7x}fP!zm>5dhP5FgI-oA_>QwtEin@6&lv;j^K_s#O60+tL2eU4l_T-({ z$_n}_a9X3>me@gmP*{a-eVrK!(FFVMXr8a7vwqZ9j8M#7I@Y6BQ^=#Uh=w@i_RMrj zvY%~x3ZED=E-GBj$us4)> z=T#;pMJW={5OlPcjOJA2S=qWPBbE#`vkjBk2**P^EQpPNjNz72xy)F!P1xd-ejUY> zQ;!BixI8>l^hb5_Zqcsum19{mA9(%O@&6kV^8^JZq|3dwfd%}3um5td!2e&qc)7{{ z{3y>O@PB!gR{AiK^gyA*}i7Xnxhv*jFjzG9GqKi%3_&= z$cGOAUHAxpeXQq9RcfrhKg-K5?AVVa6*!m+7u<)Is<8i2h;)ofGMQOMFd zqHmQXUm0f0K4tsVoNM!}<0KuV zkSSfKOtT^7SMufoyYfSJg+m_Cw|CN{kh3|7UOm|sdxpBLLv}j)6B)y=zk>TuaGq>W zuuNxvi`2g9Jo(}H;OO=7#l@8lmFd7on8Y{&=YOAk5HRl?*m2;u-~I#m6o=M+c8lV$ z0zh`4r>%bS^zh_NT?QgdrcD3?+kzLXW6gnnH6{l8a7?S(nIZr8plL{b`BR6w zELLw5W`By2A7I8-&LyJ|Qb8x%w|kG~6v4uOFNkn;419EYAu=FXY9lqE_? zTGFeG$MY+dW3Y;7ZZ{$-%(L%Wg`j0u^8}70q~~uHU#&7 zTqjtweZ5NOVDesI*)(jAW>^eldiCAO>*M0^m@76{D0%uI502x|grj%#{RRV|s{8vAa4vG(Ey^1KoU47Wxz#!)~#v?`vt>MfecFwHO| z>`LctzM5l}PSoY=i>u?)gKu9SA323x$86hIVpF)%!QWpwS*YL-ONIcpmY56}o#WMY zSv5?w=v-uAL&yUA!{hTyMZr2gu>JAJ$p?mC9@x8P(p!#+VA2XjDNNCUi(H$m*s zF;)paH3#a#$ruPvFWbqjS%n3EQ1#TAuYx8+f?~p_IEE>bwk6dxjnxUg%=X~Oc}T(- zBX26?V3qN9LT<$FFOxEK;c|*0AU8O~jDd8SSJ1`61Wsm{CLC@Nks10;yp(M36OHCl z&CC0~$e+umbjBv-tk1jf?Oem1VhHiA?z(DFr`VmM8?5q}%3}lUe*p}C#iFbYQ+bS0 zTqk2GY^e?0q^u@w845P57I{38383Zj-PI~lOh;%G%wdL6$n*jdLcLg0GC7MNdb#Ko z$pezBgN7L9m|LxhH6<^@NZw&`c+tR@Wf>5;??7txDUt~QzQfhXRz zgc;%+90SAHtjtmmyYP#DXn;l_Z{!H2BM9hi0W_ylH54M7{8C^nqAAHABv-(GmJ%A!siK_{)c5O~Kz?!%%?mvC_Y{l%+o$CbyA4mf?C!a}_Nclm(_ z%zU(0v)FF#DhrE+?~aLJ!&04i$*Q}{1t-8o!vfjw=bZoU~@yomNYfES`Xcg4tYIa>1L>)*cl1}7K zQN=9JqT&{U2r5v2D%7ePS_LJFsk&k1&ZsY@Eu{At+8QM=Yfk&9IhEma3Obod=9F!a zOTe*JroyBw1;ucr>gA!V4){Hf(RTrw9Gf8{*+Fc|)qyyP2B#2d?? zs|rfzM^SEX=od6N&NYMRC@;>>uM)S^rF)}RUu3{pP@8>2$TBx2peHT7;p8U51fB*Zk zI9V-CDdShfhOg{jPX-Qr1S&*C766-~0el2>dks&2Kd89uPxkJfT5vW;6q_T8R!0<{ zp&`3QeP~!gMLa8YiLAb@ROI0-)v9i6v502h+ep=6DSS)q>))8XkmD>=gj3nc45ef? zYrr`zvH*EY!c-`)6CX=Zsd-U_G2@66@8qa)tY>rLYlOEohZRiX?ZxHk!JA`eXI*$3 zI&OD=DyM{v2R|ZQ*TLU<&i%IFFu*8Gw^Ynjq(Nz%NMdzM)y$hr_NuDWSpEVM!jo;d zS3lq*cnKFwW&o}aPvI$igd`+?z|MbwPjfqoL{{d3(m2VW4LJmd@I?IMEHr+mcIXBx z==uzGalaOTjgHFf4nHP}4!&`QS77&FX&r7yRpDBGC%xPwuPQz~4r0OM*Ho|x<- z9H99H_Gp-?PCgA)e-t@gq*NqpKoZFk&b<}n^0A3ip!!9pB~DE)Pp7Cu-;cmQuT!s2 zzW}~O>;L9RvEoQk)%+`*D4Nku+x^6cik}hNx$o)XhV^U?9ybS%%N;yIm8CSxbp|tk z8WK+977BLCQ7kHRiZ8A0z^NpmKN1=zv&_PReE&)xCRi3YBkK(u_}5p}4VNgXWQMeQ zc^%T*&>YGwByD&ysLS16*mP@b_;u>{mY`aCgJFV093w%e5;IGGQu~6$Q|Wem771yU zVIN!!PkaAc=v2>tsy{pte=en`Yq?i{8&UZza$s3aze4|H_z&nq*|?^TEe>UBg}Xaj zn>;;u)5?k{+HiCFrSP0C!J!oC3*7n}?#h)C2;5`y03+ zI8RQ_RwBIg=VHn`IcsFwwuMGpXHq<@rKC{J(`u@0<;zv*K?{zk*5x9Q+kh*7PI(u* z4Ack&ZG8u-C52_22r6ZWr5plU`5fe$sd7G8zgt1B$@cyQ`JYuhalr{{RWa)jwWhK1 z@#b4aA;1HO(Uti9MM{_dGJKx=>R-^r%m8vd%M)qWxM2Wv~#5m>*R9l7~Zm-m5>g@!!@G z`CB~;;=ew7@uC?2_4!`^*(UzmV?67R|MusM`=)J)k}VG5qg%`dl&+i1UqA@(E=!^) zAlL_0Ac=JZ&otbBseZS3W|m_DmNqHT5KZ|cZfS_CQ^FSDuHAfp7IdKmt*Ix~nD~SV zsqj#7Q3lodNNdZgxfHbG8b++MeuCpvWeAjY>>aOeOq*3H`PG$aEMz8)IcCKUn(bl1 zNXuf22D%7qiE&m{TMct<(N#vd?nF7SX4~hwxtVZ!d={xKaYRBN`d#@y`9kV%4VHK{ zLj|9y#oin(JzDyI-AA}USLe~x?4_0OxKD3G7mYcN-5Ci2!n8Yon}H}55Wo%utT#5O zVw2|N!!`c4E45{yTxuZ2R)oe91UPWnJoHxVkAZO^K{U|o;stEbTC|4C5Em`u2Z_5} zl>ZE^x`HIvBmyqV|MKj4G5^c+7lTdw-$!{W<-hvy{Oy^4-RC6+HcEJ{XE1~L<5Hofq zL(r&0LAP`&SZ{s)js$75%N?e*IZ7*e*k)A@U!Ta6g;yniCp`o#q9Mbto@^VQt;KGa z!83R=fOq{Y~nGqJaJ;pA*r;P8*Y-zWKg()x(OSYm zYZ(SsfV3t)R&kgAUBzN7`>V9)dw&^L_6cR(4Y6;C{R<)XPbTkHTSBf-=vOQsbxZbt z$|vzF=gGEDV(EkEJn5S|@B;P~izlQp< zvrnuK)e7-L_P3;ZFV)>LGh3>+pV}_Dc^>B}+W%*m$HZf96w?{zQ=F_J0qmmu?=PRd zEarb7^amUJ|6@GXrIqwLilzaxBkz=dzv!r~ZY!P-*{KljYS1Ae$MFpc(#uZzcbn;dFVTaALX8rLTqxiir&3(b~r0 z-BQNa?je@3?{vLYR2VnZE$yYcY+59p>cP2clY4#?iNUJCkZY=F2DbM zxewpB)_JJzlGQWQQ*~uzxO_^e+n(0Q&)hycu7;{fZuVd$WEAV#*tc zPfm5VX49aS+W>oDRt~NsG(S8EcL{LZiSE;E7x{c0@r>*CHdI03M44OR3Gl~r2=9Y( zh9~n)UIchV8(t)EH-n%F(SD#44reToWB%x?GrQ#3h^7z%tVs(c*$9+Mh|5HoleHHGV1?^hX)kbq&g$i(z1( zWf1kw(pF~uX=!^{UN@SyV1J88_$hseIv3k6blNKl&cX6i<{+Zek3#-pe`e`wwUwy- z#gK6c6s6t6J)LM&Ow-1a3vU1^1HTxdTFAYPNMkBjz2}Jiw~qgB6}7kcmjxm!pu%SN zb#5R!=;i(5a4Mbn>76}quqnC%kkrkQG*5r$xuVTj+ki@~Snnc?VUrnU@z$<;w~GEJ zt@@c=nG@^N7CBbLf_m)wXE#d4uCvk;(P#{@KLC;%Waw7ch^%IScLBLX^8MNBsO_zb zO5}Svu|p1wx3Iwg6O6xXmt)3t!JBk166D$YjB{a=qwvR`K{#ufPiSKyTRJ zTcyEAAFNLe6wKOm(_~&`?NOUgmHVJBGi+8LW2Cj zq_JdKw*NiL=r}+OcjGSq^aa%KILnu}@yp8F_?@n7fg)-?0wyH+B4=;s&OvQ5M7eK{ zu9RMw)gHQ;7e)8SCQ2WT*|kV`h2%AP4ziGyBD>HKh0MUiD$N7`!)X{? zUKTIP2fhDPMJW35C1UtAnroEuU2hN&K*7iqeqFlk%AeBMdS5YO&HWbbI()^4NO1Ik ziInvKG_K*lyx%_ur_b^J_qX+ZFK2iBF=iP$w43{~wijqLaYZJD+5GatO=whOjpDJ? zqL;tW+lK}WoDsC&7a`XyWihOEZ4xQPeTmL?x`nK{lW`1dmc99E30!1EDFIxiOqYUR zI{gwPG~8^3era6esi^Xe80=+u5&pBC+TQ|~SI2F8T-cuBqa&T$2r(L}W;?{aX|waU z4wY+ml7gwvw1?t*9MYyeB!&1Jj-ZCxl)>9Q%bZKEc*k2pDJ2)?s%T>k%)sR**# z^>Jq|)!O8312f7)IQ$9$82TXmnF&d8^d`Xi0u`1-=d=~88Cp7a!CAYG^hr-!eILRL zk4%U`$o#|86NKZ&OhiV7TBI;A?2exOz8lYrN_V;0ZdBag9rP8Ia#{4;9_evZjS4si z&&2|Y&G`NJ?|7g5u{4w z^5!z=+6vK7?7Bz)I_15L$-lJL=EYMN^}L^$-27bq2SanY7o8{vj*q3z>D&q%%WM1J zPJbEQs15sFLl*d)Ks?E0<(NTV7owb*=O@lTxqy8k?jvKJHe;juWqW(_asDl)hEe>j zMUZF>6HA|FI{r&DuqP1yvKqS>zrvy@mA)>(C=+U7PHe0NU!Q4*dXLws5qXuCiGTfO z#&W=kW&OvfUblfEvS-#k<6o+JAuL2V??~8+Vs!-T@t94$3K}|#%FjIG9-prshJOi@ ziIv1rYIEYE9F3wCHrc(a7N%f-R*u#(@TVmO$Ak_K@43p`0=O0pD^#j0_h0zeG;S)| zfZ-c=Ar`=CzC>$evCc|#&HJb73W@{KaM{)`N;{TMVZm$lzuw$DUyd%W0U~&dil)t0 zI}Xu7?ZsRB_NG49h`kPbaG6mxij3y|^Eyj_8n?C0=Q&n~1qMOoHB-|au;*mI)<36k zY5QMpSsIOnz($z2d~|>ILG%>3zHF1>1wAbsPz?rP?UqYT9Q*0=om~ls8=k#pkzlt99!C zH0t85@e>{|ettLm8m0`MEmcrPm+FpN!pH}y`k5gC&@`BtB+w3aI?qCr5_N5$`!!o{ zmZw=I=-|0g>TIeQP}iIh=W=(H$e1LfO6LLtE5j#tgPaOf+GkwHYHBjX>4#WQs+|51 zpT=b!+zk3o0hdaO1VyCmg5nnirs^((gx^S^2}DRty`$=2DmM04MSvI+C2=u; z?fhsHm?w7(N&JJJ)i|reP&9+3(&E7%%bva1Zz6;=LL?PoAsGZ3RS;uZr2`ND;ha*J zPRC^kq&x}|fzT2N^sSsp=f*t2+uP=9I%UyF3}iFQnKk}VkfjX{zBh)olUu3s?I_!Y zc0cFVVK=cXz0xzP$&Nx8|+SIe|ctXxA4}t_~D1tcL*(!T~3od-WJZc z+`ma5kbqfoqj`euRZ70^eIwCFf==w)SZ-hw{vpR?Ry52|Ij-s<+llo=6g0Ou4%h4w-1JY7NFUu;++Rv+gvm_-eXfM<{+8y;(c6WV*%hc}|rF_^hY4 zW7PYSt`YN9aRkB!{a~0V@Hz z;&O(w*34V_oud8t zui({yl0Vrb&=(%RLrr2xM)JQH`re=*%`cBhZ5o9zF#LSj|sx~Sli@yE4+?L}}xBcVJ7Mku)y}HZC&OP)n4`!S4Ta^tW~tdXJAF)^6?Ea2Ykg{ zBwJzT^A(TeS{uNGl}YC9=W*}y2;fpA1zSQ{K31b?&lHC4+ZscSzI zQs1wm2~jt>W&NnBzsOqtgGRQjX;jjs15|xZ*vw`4bsl+<><1D?9QJKgom9pr8sDhO zEQd(-EthZjta;$3`6Lshx4<;U7ppC(Sl?DaTn z<4dphHvVw?*KEeT7`I*OWr_Io_zh?O<7bgtdG5sN%#t{=bv6JPK;9S&Nf4{oaHI?M&?g-Y%>y0<1h zjFGQ4D|7p(lYN-$ULz1pWH;^%!|)i3odIt4CZO86;CtXpp;5{__zxpTrYo!4r2%p2 zEd^}JwVdRIqzzBX(H*Wj*>SG)baq+VRO<&HWYbv2i<>SiU?V~bcq-R_!!GHlJNX=a z(04p{Z-RHz*XwuXi2Z)4mWQNa#?G#5(BaY}{tE{2?P++Zs8U3X*E=)fb1QBd!lQOr zBcR^>-I~n_>RY-?6^ARE1zqJ>p=zz1Z-grj2KphZJYi7!JenPrTQhV$5zcSykfx>c z!-2tt)}|6x!sc1&Zt$df^ADDLgT@OQoNXE$qdd0F(XZ7t4TzFDqHXBJ;dNW1G$`AH zY#v!*=~3Y0b?4&NyWBPjCW;yYw7Q~ed*Fs?w+08L&hYLN0TZcTZKM7Vi7mR(anX{( zgaX-d_uP0}G1{AG^F(P2Q$*u`m=k)Tn#Z5$n09H*>t*F>d_9G*shTDfo)&Pen>%LjOAA*KGG6{hzk0Eg_?Ae6as~{+|K$gvEWj z-F-fOesXz=3<%4$GdtIzyRBc;J#+wgp#@#ym8~POW5NV>jF-g=uC|r!s1J%WAqHD80C?AneXTSTZC*fW&1b>VgdL)W` zHTWI*8fIOs&c&$Pb${v1Q@?O4_DXouBELG3HF zUtOb$MdV!J-vF8?LqT-=?74@NW{$;URf7fn&sm1wD@8_XQ)hZ{Tk9=nJQ!gRZMhtd zTd!u^ctjD}T6H`;2@UN;n1Y&f{_Is#myaf$1Qn zhTnFCTm@u&-{p)1&-FCUn=n@U4aTbUt8*LRPE1^kw%3YQ5u7GUaTD0@kBn7yiPU0P z`C_A}47mwWm(=RTc%~H|B_qnRnXz|yPIQ6$Oka>>=0i>-oUi`9<_IYPpq&iE1 z=`8x7cc|JxC7Qv`XgXZ&ex=T|xe1JRxwR&_wQFi3dfrogo>To#isqXo4o~i-4)n+= zCbn&9I4^^K%(WbCT#?4H^alD!X4Qv|dd3w4(Ir{v@d-UvBQMNOxTU^*B{GV;O*l>5 zUIXw`d)J89K>M=Nl*F-{-o$a0l}LIiDnov@m1$$z=D1I`dsj`y_95hT*OuUr0<07> z;jcbaPt7AAy@XS%z`CxA@3SJvB@4apU ziPowQ<235fkNy*q`VikL3@Hyw7a3AzJ2t;@L^6T*D6k`I7L)trKP8?$&atEZ72x;) zAjIF|fq~|MX7J1L@mJOd-m84FeR`&6?~v{~{jQ{6>sPs#uVV17x2hr1Ao84yPCeKj z?h4!aV=i5KmGOLLD32T%^L>^WUl1u?>9&Mk>NJjQ14}`KY&I+LV7-dFcbY?16VhdQ zpXW6P^vg3>QEy|DWD(kcB7WDvl`Nhd0n2gpEnb-J@_l%m;PI#itsyG;ymrHCF+lU%C}#@Q+LMu=}0r`JCJgW`Skuhs(|N5 zzmZH0>*a#Q;~mEGBekEr#mB*KvsZnewGmhlVwGjne_og48U8**{RGTnkse361yjWX z{QMiX|5ll2|5k59R=Lsl2e08n?(rkm{Q5n8&KQN~D5o%MJEvfqd8hSQDmDHz- zr0@NMfj>)vn?g$IqptK6g=@kz!+)Y^W>r6spRkF{{`2qY%RA??=jE`^vt7wW<9g;XI2HYm!aJLZQuJUebpE{D zt~XdMk2^t0#6VK6&Nejqu;-0~vuA}7%vZmmaA!A9r~etVazAJ!*YkLh0lG(rvKIYN zNWT>C0;FFW&uBAWWnaeiMd`G;N?oHBqVw#amfBNWp`!Ks9IsEah}uu4gMY!&0oez7 z%!7cjh$c%FdUlA0iSA%!)LqMjKh|qS3&@0wuWp+aOhoRF{I)d|@|NkwE{r`3eRT|guegqQA zFR9YomIiosWqJR+j+Q@{ zBWp>`7Z#9$_UMndEZCUJcC#O79{z}23qC#=H4-CSu@U$kZGXHqJ#gpt@eXI#`J-qv zs-b0wW%tjJD&uct?v9isx(?+#;ts7g(;NY3ikl{hh8ppzbs>{U4d(Yq>TGM-zV9UM zs&7A7M*-l;t-deu{nI}Eb$yWc1IFUEiFh67kS@jw5vVJRXeRq-k##!$pDgkk%3a)D zZbY9{E1i^^sD{mG-)hrChPe=FBwh6*2aWfka3qD8uFe+?$L7JchFTI$#Iu%Cp=F@S zZGg@EVJX0NTkFPL{Bv{wzUPl_-PYr~J2G9mErdWIww&%=FY#`5b+qUO{p%b&?9=D> zr=2J1x34iagmb{l|DwDF9=7Fb6;zry?Ff49uVLwzF-pHf%hx9(4XZC=0_$jDJ%h3cw(tTmW!birm*;hEJS}J@xAB6cS?W$qtc`LRuaGWzD0xNBkXsBg^lT5!6NS4tA*qvij?9Wd#(&0+6kxtd-c*I4&eq$(wc8IJ@&ot zUFROoT!?E5vYM2nNR@qEXV=t5y|S zGBw1^AxA3Of~XpDfP$7TfG(11k`0<+7yt!!sIVuCEQ4-KWq1l)&^}HSi`lc2Y<1{V zxU9XyBzlp#(gJIsi$D#SN8bs;r91?3Ynj{qUdd#Rb7%kby|dKwi9i;T%jThsKZu(^ zDQ`3%RM%9Sd=VDldBmA49$h33MfkRp|OuKQJFs`KmB_1_R9Msj-z364J&78;KEm` zi4mX_;DeTOC&8mVQhY0ENiCTB!Is}cK+C8GCNaL8U*N{p?|(9_h~0=!2({WFsw zbTA7;m8pcQc)kjawwDL#AF{6g>1RfSibW@%ckL_&O1=nfK(D zmuex_=Lvkn-DsqbvTEC%J;YJyKp7=KEMvWg>mSdyKf|5YytP*h4)~em!g1jtqRqX0 zR9R!oW_a|p{&Z6JSYy}-1615#vc%Yn{7>F$irE9SRLT`6p`S=Zy`_0E_+7VRUu=}E z98nP#k&+-Wl4+1_E*{!2!3E2-Jr;2c<3qb?-TExIC^wggpD8%z}O4V!lxOC!i>`^-v_t#^%n@P z|9gn5*4}CUUGU>iyURVNBzq49m<&58E(>R10(OG7Fn(XGi54r)A_Ym>cRxk2W+RPD zp}XXCm60`gf*X{c^Jv#*PWbTn;Q0CNo9^bnA5J^wcUi>sQOFHd)Y4kvHM?v=N?%qC zrL`Xru~R*yF3br4|5VJB#)6PvZQqM-$I#fAO5vy<G@J@D`E7vFsRa1OV|0mlN1$u(N{f2Uf2|hZ{}rpmQxiY=b7Sa! z;mp&up=AC9@By|NxyR2UzmEU;{rTL9yh8Fb0<6aQJr^$ooU%jc{e> zGhZ_fi z%&5@(6rreC+UEI8u0<1+6AZ4!r0?ZqFxi8(Q44kAq?6KU4YEO!+7GnE%^IQI1j-N^ z)sOV;(l;d;wzEztt2Wzmq6LV{D51kb?nx;C#Kk0pvMAdWHj)Ab$;yvljv4`V?g}s^ zI$y~W<`%aPIB15K)^?pDP+*)8srdQ;F|s6J=i>PkUcvKZ*&vId@9OKvGtcjBShUra zl45B`J~H{9!Pj2tBG}8KjiPc^?TwzD!VmPzvIT($Pm!~@Z9-oOQ`t;s2rD(g4iv!W z0FGhrY(-jp-Xc{V$xqc*(y>3LZ#?)Y%%)mWD`k+ew%N?))-73ns)`|CqDo+!q2q|@ zYM5s*&;-{7sN^Ly@S`2~Cz}bFvHa7xK9HkLS{$)bV0S$OW8-Cb_8Z&j3M2AE=96^D zEaMOozxeVgNrHU15Rp0&`Q^wU>DT~J6Rv3T=rmn47Ow~-ygfe}*?b|pFW64>WXDoG zQVtO#kYl-lhPx~6@pu2`0zvr^&6i~)s9Crnxd5DL6?kGj%mNJ^w8@x?3T!C`3{Qv! z6YtUW#voTRs$gx=laK^@J8VP6$==dSJnGQE=1}QAqiUmHn~1hXW`m0K>w$pz1sSnQ zK=a)(UG(JqiB^j%2G}q^49spwRknOaDRRxY=Y{P*QTd z%AB(3LRevd_Ot**OBsU|tDP-cC(c&UY)pN7AktH!B5$-FE)JI7f?~3HSwJCE34t1A zmWE#HBaOLFDgnOqD zl@ICrE87gO)+EqU&n>YVS|zjy$N%-nu!u#|Kd7!GY&(+NG{C|47=Lw%VPLuzBIQaI zW1gcrU6kN3Lz}a}+HOPeoF@)_EOB8vMZQEjQKM!-TrY(CB5=0&HBZPI3pBry9~;`v zC_iJg98Zmi6b4Qg9R#FePfp>H6)~6Hq?EN-%Iz}Yu-ZVZg!E;h*!L}La94=DDWGw0 zX>5o#y~EPxMKDSJVP->ormuj&(b}rsM8epcYIdGa&Qh8djBojH;KEU-bqRs9i(<|Mg{U1e$ znDjNRyf^HLgz?FEN@CfV9xAD(_mJ!vTW|DEOO zNd{2U-(o(dS6cO`H|s9~MDxc1OO#gx_bb-dGO{WB%&u^%xJLMiG14i&O|@|B*__7X zC?kbcZ=R}pW&z(3YO~1b15n;=Fe)?^gaijjQ;I;{DbrdpyC>NG0E0)>#N~_8o6wSpIcjbFiUbPCvuE8H9HO7GF;x}61u)AiVZFToVDin zhyf(kwcZxEsk6pu-T+c8O)LjB%VA}dA-8*IcEuG+Tp;DwDx?kih@(cLYK5&LPVs9H zhw>t>HSNMuL%Zaf)bp%bxElE z-#!OA5&{3{RD@Sg#DYpYNRY6YI!9H-z6il=^FYRg)~Bw}6FHv45FMoIqD(^JOfrhm zIj>ot&O?yQG4fHaAd)rbe@Gq=&>*gsOgqYsa$e$DbM;3GxFj z*3y1xkXH&JVjXynVf>X1l$<=?hm0QtL)n04DS_vSBhdkMxIM#BE6qwJU((IIf3!`IB7C|avhrs4QYoa^m8B2? z#RHisc7`a>@PV@YWa9rI2{RS0{+`pLh!)xx1;qwpm7muRtpm?X(R%dX4jOAPgCjpM=2mqlJbAO{xCCd7I4}Z)~IuH^Y(}$cLIBl}p%B6i85ZNQ_fn=S1GI z6zNQY!Xf#A6(ok?X?!{$R{};9%(xDf6akE(CB)465T{wZ#hGz270te(IGMc`VCTv@ z*yku$t~D@oicvO;*O1i=lIfoDRd>i}b_Wffx9J$?*lzz7*z)Yjf#H@&p>lB1`RT@x zpb?-2A%gVeT=ps<6O#;iv2R`lv-Csn=760vG@~+^o5eai)4a_=KAujDLy)L^eirED zNYmqXmEmZ_6nRotoW3rpR?J<{?$rzrfWDkMb5SL+Q@q|tRilyD4uNu2+z|13URITr z#NDn)l~kUS{}xVPCTvG&kH)v?FIi1DoLmo+7KP1VBN=|v<8T~9w_DY?FN?ESbP&MF zkby3EWjGR+!Vak-ir|Z>A9stV6bgiVLT|N!lNLRR37_t+nXV5T91KC{9rfMz$6#V% zp;Jc5k1itf5WrHQGpk7%vUJxo>SZK4T|y7y8+~PR%?57=p6Zy#?hYoL&>;~GF7K9S|7lEi0!004-m(d)miOQmIn!Hr z5{dd@)IpYb_$ww9&;|EyxQ+p8X|tQ{nSfn-ZfGpdELSyH!rWWSTH4^LJ+Sz1LPRx` zO~10lJ_>={x%D!7+TP~?Wk7V0oWT8qQkzP-mdq8_(MAG=l@-LCVcB?@W4*JDE-=bv z66}qoIQoY^hRHr$GM-xFOCy7`@?IimuI!psAtXCeITbUAWZ1&e!@Olct-yc_pSPOA zl`=M+CUjiao8Zvl4;w{dPqvnI4gs$V4jk4xVx#zPy-_>8LvV|D5ipQuZJwEF4L2=y&W)GGdpeRJo@1{kT zonIzaW-BrITA1hO`6Eh|^-Q1SYr;%CGG>MpiL0os4vc9lbO{ApimW6N@0HN63nn{q zOzgwWPs%A6LSYRrEkHyQLG&2JSntrnK&bBA_=l@XA{SvPE$i}4!HNZ%=~*0kEt~@L zd+!wR;R!rR4>uP5>Nu>FOK+4}KvAWcgb1IdfuD&BELRgn(AJsF5mx^iPH{*8Ej?PY zuxvDwYYhbqnp9yaSy?}m#%?6j=87fk>`Awv(dtf!@XRNs1EG>p`uyAEs$4n8K8pE5 zPNoQ0Ldz)ZG3f~-xKU${tt0459{~+KVo+mtZ+-@SRK_M~=M(YDY_eQYSko*iMDcny z%viL%#AA|!ZF;ycSkY#bUrqTa7ErPCk!*1gusmD&O{GLDs$Xvlr69>EBweqNgdKEm zgP%i7T*Bi107_EWE~TKGPn9MJU=s6YAGO#x?W5RbJzTJjltZfJhLXO2kQ;_7PYX;X zqh!)iQYTvt0g{>NR*AML#y`&oaS`W)kihjwCD0wL=3Wh@w^(&hbyGsVEt0u54Ru5o zJRzuC-|+rqNcWjj0=!}>L3VI%4)%J(HsZpMrK2JQuqFg;+m~Du^aV1gW!C?heP?a^tL4EW7Y(;`LRi#2R6!<%*5Mq<{hM!2wH?ZV- zZ}g}X$VEOs#@B(kwsCTIziKG*jq)#2+iQx=Aop3e%;TB&N5 zSzm-h3~9&KtqkxmJ0Aj_Lg&E=FBtG4vEu5<8I_545M#&3 zuBwh&vKP2aV8cPQ->7s)9O3GlGyX2T`Iim_P$q9w!;587$h-~Ke-@rEG>dRMSb~fM zpR{?3AceNWwC-*_o@OXQ?OXQC@x6=%^j}z7-b_5uCvdZ+vo$d7^-I5($?{ge?Dgj) zj5DBIu*E{VgTXWM@#%Q95%{POC<0l8v_?QSl z5I0*z{zZnRFmU5ZC5B%J2_@1I49z(LCs4?iRu~8?LVAzuwf9(xrW^g>IE-N&Zprm$K-CjE#f6O~#V63kND4sn=8sH(B*W2K_b{c4@Q63g* z61W;+RW*1y_T?(dm=Rp{j0`ebPy!%J;ifK}(k@ARkZKt#CE70~N{=>>#@5 z0k>gI14bECkAmUYt3b$XtzC-3G1ql@9nD~0%|vyCutU)S#wN6@NtWCqQr>=8|4VzsO^1QZ~9K|n&o zo9Dho=n42O8#K(8KDO)kQbKCao+#;W zy`OCBOHnkns67(Gmn#)n78Dj+rM*_u8JihNh;Mo5S_PMM01LdzYe)wD))PS3JgYSQ z6V3JtucSpux4u%Ov(PzpGZOjX^(LnGl5z2ii}|_=Y6~CnpWaMMi*kWD4oc@fVOgB| zSxrf+y#HA(R-N4IwhWOR?Y`ZRFlTaKdi9GM#=jSx%*1%Qg7kNFbAvwgNTtATeN5@?;pFoCU>Io zSqIbUD@v7)p^y7HaACJZE+vSw7D`lKue+sk6UJxlObO}(uYzR6DH3zt7ykZ~+LvO# zxnhwYjI7zB73&Lz!+MY8B0{Ehi|PC&CVndE^&5NWQ6&an5eX`C3(9Emyk^{fjCG#+ zmn=S1B=B+PI>y5ls?Ri#C3G;-5XwlJ;1rx-y$of91pQxoX{=KYxbKKbg0=+;u%>1# zdWe)fvIlr4Ns-DiCIt#+poXojnx^|^j`P)ctrSb+m6xRthmN-z^HDGMLo=}@urzqs z#aUbL$K)6ZEfQ+v?nmo})Oco;^%^9!NZ{jgbW}T!lkKJ@wfuiA!^>-PKE5R0YOXIb z>b(1479_VX2S?VaeqT!9hcZkkiUYAjuNPj?y9M3co1brgl0Ione>?)(aTnD`r-dFt z=@>0oe$tK(J*%Yt(YYB0lYFA8%8AN$rK2;RG$QkheW{y1DR;(GH}6#sKrVFnFSQZc zTo#KRIlH4=`cQM30s|Ms#^2ElHsa?ILP&aLU zT#kuJZIOF!rjL)p&nw=qPl@|DXFf+N!sFMM0Hn6E22syu?nzxVcXhl(xp%(RvfyGZR}0NcRg9_ z$AvUew|`XIZYK>Q3JlV}kbM{b=aGEc?o+Mu`RQ)~3xe_io_1cIvPYH%QGUa9H$6=X zs#=)3GPN_HC@`RJu;8+<`%Z5{Ob{$-7=D>k_rS3Ecb=SwE!AJS;^1)z^j{5(nY=)F zts^wa3rwZ6M4)MzC<&{Q5?dO%`#2_%vaG6TRwvy-S69TlB+VbnYgp-UPuB`+Nq#UV zgK1_CWH>Ab+YSF1Hazrw7w8NY+TcU54KC8t6_ARyQO^6&ZbW<|V#TO#z$E7*A2JRj z*#CPQY+8VkfRSR{!Q&`aE0qFLBim%=hNXqE&1jHyFDL(v93dbEeeivGcNIElMI?VN zopl7oy{P0?%&9#YQk`6Uy9R*{A&id0^!2d0jbsfv=uHncAY{@m2P9s}NpUl@_Qy7M z3;?T2a3!}w3)qiiHT(sIcpgj<4J6lpNkoh!v4<}^t|7o377yD0OD@3Pv?E3f@Leo)qpnO~%ijF}e1Bmk;k(guX z`)^EBRt`ui8`%t7jx3czZ$)_J7HgVp3H51LshAJ1*z7E9nlBNNfGT*{mP)#iB2h^{ z$(*r2;V|G`!`M+uPJ8?syILo^@ynEwV9C+{M*A2FYv}LCzLF=@ z0JqpE*j9_b-<(c1VLoQM?OGZ4+MEw^e83}HQk>R|^u%^2BrgYrFGtJ`B@YOCvN*zk zNY%Mb-ZnR$C#dkFGFlWfUx%oGk`l!wpecrkoGw(^5U2chtFhUNKM6FeCX7>8y5tdt zG9RY~(csReD}y|KCj8Y(=s9mYl^dL(ryjt;(14Lt#FvP*eMFT=kr8xfq6?snM8(px z+5QdRW^LVTC}B3yEYqGMln?mr3pyr@$E_#_N~+%#H`+AM=pBwZ36dwGRtuAWM)PKP zY*KZsxCB8>7OmmI!|Tl(M>W?~G1lRdUN!eF2?V@&LUWV0Ua~tOhRC?vCnROx{pZb( zc!sRhsVVd4H$ z`3i@=`*<*!g`w9QJ8fQhUiD9iXP;6xV|h4@`dqX>{M~ zDf8!ExiV~>!B7VhCaE_(8N2ed%|msySCLhQ6GMznT9!goYGyp`yR__0~fH zc|>Z$C7NR=B!e!RPbYpoxW7i&(G=PU2TD-Cyb593&Fr^Q){->k$b#H13iPNZG(L+sl{if>JYh9Hj5UiA zI$9Urf|0|IIj+}a29Xq(5^IlK3EN_L53ub3dU`EP^-HtOznX;K5w?>16d=uwqOP8r z*z}anTcC&sWG)ycp>@zuH1e1JZ@VEiwdVF96!$!0(G4vtjIB#iNwJDTe-&C10y5J% zj8da+4#ck=$~H0gkChia6g@8+*XBHyp~qR`YSaqSzH?wADBF6~typBMjdjYXjz+QC zLqg*qBBahil2MKtl+~!^p$J(p6oVlbk<7+z3)pE16(Flg(w(n6r>gFGxk1CgVpYjj z;^On-z)4K@!1Gb&Q3$oLA1lTlamPA|RNz={PoRs0 z1Bw(IRF+ZEH^u~-rn%PTWIQ`M6+?$Gjzeb9HOxqkEsgmR<&8Xi_1rV+B7(H)Ho*8H z1DYw4<3&ECAyd&js|L<}znrWQlbZx8OE0te8HE^yZD3FD-K(nTBV5G*h0eh`7++KY zEC>a2UYG_IEiTCp!Y$i=vY9w?up5g!ASO(~&D|2$LtIYk($OF;OzKmv832coWkdEa zaL0gXAGK#}5w39Y(eUe01IOMQqr^RxHl|xr$t}2$gzU1#sPurG3U}I80FzT1(Jkl) ziWNsA)*P9~9mDkTvVCAdxkTY;=sNkAu&VbKD^yz@$;^3!>Ki2erBCrH;|()IK<0ME zuoEY;V0h5tz8m*M`_EpdtbjE>;V1$2B-4+yE^rZ3 zVRRd!HsT*COSI~A!k~62Pa-t@M~@y2%g5m;lU1RabEc&VjtX^cWO#zqrVn_)%R_ug zN$y4Sw)~Vaj^;RFOJ=Z~2&xDgKobHVp($>+($Asj8Pn{Nl#e_hNf2I;d()3UZ#`!O zNE>4id?ZEWH>(KXc>WGtFBTVa$*e2bc&gl|tIG z-9arvPX$yL*=5j#MMpVlVr)%!sdiu2S&Hs<9MKP$RJ~H2<2(o0BAH;QOYu_@$s#Cn z(lm^!?JIWj$p*y!?B!eQiU|iB6-=?76#qCyv3k9 z>g^#E0@?Au$YLf<2VJ8}1BM^;qzapg?Ax^tq_E%=I;=-A$PjMWXp|y|OV@Kb4<%KH+GK2}K8Mo|aY=%iIm<1}0WRHECZX&pI2j`J zsm$=NG$U#`ug0wp%I>KLt1()3arJaSCr#AN1D30AMQSPJK9N4WYH=9RJ0!;?TLd*R zw&!S7mr>#p*iR+tx|Z0s%TC@@yh= zmJ29y4=|T*tcmVdz+0jwRtgnOjI^#eKGXnCbL2;kE?Ar(n5wXdpp=5-0qD(g`+S4g zsY9A(Gn#fHYqMtVE4JUL&Cr^>BShD#oNU=nV%Ceba+4*&-wF3|rDVZL7tF#1TI?fg z@jahg#t@`}xC>_O0~)b=K6UPzXAl&92#Z=S^wzEZ?B>Z{0E~EOx<(J}ak#fDOv@MH zkZ&}v=0hNUYkb)gNmBQbFc+R*ZFviX_IH+8+`j$toj8#*=GI-v_%>B0w9%s;lRU}T z{lq{6o>nIVDZzv9B&QZN_6VogLi0jCp4>euJfm|ZATZA_>d5ld`iJhbJFlXysKGy; z@(iZ(b%8nN1E2*PmWn^GqyaU}qEXh`RG6^9V<5$a?bRss5zkiAY>Q^j;Ezy|y0UW3 zhCZI`;Xa4oz4brnH#g$=K{Tpp4~rX%TghW?Wvd75!K{*Qh7h7tZ@(A(4sT3;YI(-o zwc!NrS%#>bg6$km(xJ>a%37om{qonjgp!c%1M?dsBp^O@tR0<|bn313N17!oX7Z$P z0lniO5+cU1#A>4>wKM3~6z&9;nA2D6qOac&;o93NcB_z~!nI>v zu^^%pXxm)Y`+DoFHd5XJZ-3ws9i>k>d_qFm$^F-B;Ayz%pjPxG3i8BV$D80%X`Xh7aydazf)x?D*Ki2A-7%sqWb) zqe$0p-IP<}S+sDjBcMnmD?>}8L$-aQSQ!jj{J>6l*UTU&kJ3SPX>sUbtr`lPuabz; zY```~tU!5w&8d#Zvz9qJT>$bcJ}XJ~k%EEPt0Gc_r8@a@}(8M18!` z8VORb!7cnO%`{{nd&fM9(GCHIXA}K-DYoMxi>qNkbwE%DI*L8##7R!!!op0fq$#F` zz&h|6r+d)Xx(L4IjQVQ+Fe~4bNj)@{aWuOQ8m&g2zD`nB_c^8J!}YS*l^g`v}@{y=)-^<}&yGA3NvEXtI^bE%!DBmS9{{&NNWbj4`0l{^hc#5nUqfz6CPTW~7N@k)xgLn#o7{5hdLoeEBf~j= zAs$mraXw~Csfm`Dc2&HZx}F-0-Coq0M-xK8{KL%y$EK8k4z?9t3fmT92Ev9G#!jW~ z12yy5JP7FJh5N^e(8xMCCho^oN#O{u5@Zt!GERt`E-WFT+db)`*A1xZSQf=1Q|fex z*DLAUW^)ZX&Bq|fsVbBOMV1nHq)ptoZ?1!F|?Ka@tWp-+uHe@F=zy z7PTQakp~fYbRiT|dhG_CSaKoR^vu1rsf94bSXP%Lr&a(P+Bryr40{RQfn?Kvxrh06 zq|=cn|Az0aIz;W~RI;hIVicgXx_wz4=!KejNGgDCC@Quu%L3pPHQ_)iH3$?Mgh|08 zkZN?H1SRPlB5^9wnF?e_8QG&=6Xw!fwv(pCW#D$x1apcuM~lmDRS~>Be&7~?+pQrP z+AtCbnN>vqZnx3{HBA(tK4+SLYXiPXi#b(XM(lpYHK4f1UtB@ncZ;%s-n1(MdliEQ zhbCTJ12(vr2Tw7&sL_XbdSs+x{ObU1hOQZB6HDb-Tmx2FKhPgBABBE#CA$k18=NT7 z={VlI!|C371=!=2+hzS}H7`a4lhX|11cutTBEHc!0G(huxTg-8 zv^F)}0Mx(Y>(f6GXqRT|Enf^0ao~9 zg@-|NLpawHO0ZB17g{$}71u*KLE_g`4&7d6Vm}W+l0}V8s(^A>(Qqy^a|hONlC*}{ zFIj?E))g`9nRrJ#wtZl_Y84}CCj<@7;{>u3d~-IeE*9m826cUPaSi&1t`LrWb#cw= zV%u_77Y_^+yIjkEkr3<6mVGYW5SmxCvEd3JP_zi z#W%C(c13V>ZYZQ^D5e)Qzo96TcTlj#N^)Dl7FOF%5o!+0I~t^xS%y8FF=QL6 z|6xihZ1#eZV7IR5(4fT1vAA@KjC7DB3Jg404PZ00f9r&e?Q=Re+B+j;U78X{f_79< z@R@Tpin5U6xdyn95;s5;@mUHGASV%wMBIQP1E^_=rUMO17&8q8PJG=q3N#dS1Is!Q+Xh~IcOgevtQ@@E6LkAR!_Q(!!yv^Qw86O$tptgxJqhpLvs6IUWD8o*)u zb}E={9&%7mi9RKUQ@nwK-FiwW4WVRMX_sVrsX&Jot0#%jYIj37b#K_HfumWNpROfL z^9Tl5m|jYyA)BM5Gv9$NN_2+D=kW(^=##X6)-dD@G}j~yb-BTE>U@UyHbSv2Dvw#-6{oRt<^ zlH33&#yDKR4K8AW+qA+EhfS=&=>@?azo*aB$Gj;`IO&L7By45?UWyYcLXA53dcsD3 zpJ~`1j+~>o4k_^!I6WFtI8DgOy5q3TVaygo-iXG9Ihk8y8Re*^%N)bAR#)V5v>*>? zC!|-01SwWI2LNOe*rbq~-N__m#QN;(a~q1=-)D2frf${N=FKE09YfY6@?0EkA;+jQ z<%EWIq_n%;2@sct!)H!c9Ij1REFp7$grFC50*E4FK>^*XR4*A)`aGakw-+E3dtilK zb!j`7jG+(|8RGNVVL5EqFtsiRc*)j$=#?N+T^6=;N7PMBQ`SP>p#Hf8eH1zU_CP_0 ziI@`CylM~c#v1)F)XIqsTLuyrm-#5*Kv;u%)O6BDRG(O%@QGJsD4^MRFk_B?*c1SU z)G<3$$HQuz&und2j=G-9dUm;i&G-V!(5Bej-YbBh0L~zHkJ2jxP1L)~YiJ-76;a)8 zHLgWq(DG^5U`*+;Ep!X0rs4tEfLd3D>^RH0oDL$A4Na?NFPP${cKQen6qsW5D-QlS{9C zT}ldA^%>j&0wt7{cqB@BB+f{>o{0Pj)o5d9x#g{%CXffOu!3HHFXo~U-m}UuA#+nf z88M+#aUIQq3x^?ZfS972_p}wrq?a>kMRP`R=?3v5#w;TxPR=cokiiPOi&CVlqqlp1kjVm~Y(P!bAS>3yGI-$( zIvP$)!{)4nkt~Q`qQCK)fDX}>fLc>UxSe*}I3^Vbf}#-}VkYr_ptx3*hIJ+oCc5e% zK5{{-V8nMXp#du7Jv#PaS2Rz|ronTOV~0J*S%{%7B0eE#XR$d|)xACb5Hz?z&;yzb z5ao12-bI;z6MCR#K-rKIE>6Jg8{+2)O-leh9wMxiVX;UG4hA8ipK176bS}L_am9i= zXU+^%dvK^Eme#{!AG#c~Zb}7W&K?UHgnb5-@yVuZ^9M0ght5sNykZ2za5zC|o-XIj z;K52fPLdKhgea#u&hk~_*j}`oSfZqxVJTI~6l^wsrY=giJE7)&5-Oa7sSWPWS34jD}JqpvSHEif!g0Ld4yOprph(b4&amy)_ z;LryX(E{BdI=Z_k2f%berVfUv?MxZZ7NA0Z)K*N-Cd#~`sfxxND6Bwcsu9B%1u?>q zrB(u(iHoKBC9Y#8mw>;bD*&RQLn#b27~wS21D1iTp{?2Da!sGU9EVQOiDS;s(!iO# zf&&QircXx~?GQ|)s5=94AP8D+3pJp}9|UELIik4(Fn^631@Q7J8SHHxp`Ep9`<#7$ z22%UPO)Ig@tlR@uEp#|9qs{l|QECw-&NYY~pE<%GGNW>TPhd?? z<(ilnAzSP%G5>VOb?C-A{Bnx4^e1NYVQVlH&{K(!WvPyndrG3*trJ`r(kN%d4Mh_< zN%v|{SEL?@O>qJI-%7Wt=!V;x2xT#B{bjR~G@pkgCE_JtK%(!(2Ed+x+feAAmEQCg zG?ti$Y=&t#a2nh>5Yd#liijJ3@f5XX^kJqYr#(SaB&>sqafacF3$>aGhqwj2X!MkP$3QfWKMv8R|Mz*xSo8{ zS;*NM;2k3SiX)QBrU}539J*~BYagn2d=)#=eVf0OQSv)YH=KfEW#FvYiUh3n>?2*SONHvBJce7PJfT12M?SR8P?h z0hX2t9O@k#Z)3ulz9&_GS3)Tu_4i07oqCdD#tbgA*ibDq;Bz{SrBoUO@ zPbEp|)yat-CT`x51%?D`4{auCR|FlDF|%bF)ls>n-ZRo9sUWucp^Dp^89XE$qk~|= zGJV)FVaRCuGMW0#uotQM3(6}TvE8JrF!qmj2Aos3H;~>DWEEq75Oq?U{_L_6>MV%S z$&CoBX%H^=xQhNGACe1)7rk_I-8O<+s4;v#pRc;A3jg2d^Ckb^=bzy#@>lt)eF0x! zrmwol=dYSkRapdlg_=O7C$1ZuR^-cjtmMW0hdd>q8Dd8Pgz1c;dLjTymXo_{O5p~=(~iVkEx|1&Cm{^a|Arav(Av-3ZH7EehDSRg4OP6G8fRU#D< zEh!sEC1Vv%1(H-!LYvdr3a!Q!HkUmCs!$f7%!^1$aHig2xl$rzDj4r@22slVn;CQ2 z7eh?8hP>%u#S3uGQS_$Wsw?CwDRGfrYH%Q-qeTsfCD`AsTnt)Y*m@xC5EZjNUJMiD zSF@FFC>j@kfprq6>!{mK+rM3=WBY~y5(7-tnOJNp>uM>dOJly;B_%+E;Tn)jZcDUK zk);mM%mtd&74TbDA)zM4?-hag^b zIXW68_|G=lRZY@hsL$aCBK@$}&c0YiSElQ9nE`yM@h?{7T@9!t=0cshhMT%udmK3q z(6vQ5m=5liLdHscVWv;zWC8U}!WUIwr@9vlcD@QsNbcB3?xEW1wLi#5Hxa%;eQ%kSLv{$ZgWv zp{Q*Jdh52WCkxU$V&ZF#lRFirtIR}+ho!{@r^bb($L0bv(BzR)<&o3n(WlJjx>Kls z^YCm=jO84)QjOveJzO9h+c>&NVdxq#!v(;)xT3{lH6Y*uKu~(++OPq&7EzK!oj42E zfNGj@D9nixBEM#P|19zY;`Ss7N}UOr*K2?uy;3xzh9r|EhuKyD&pJR(1r-ZOaa6t2 zv!Fbr8+PceWEZ3D%$oW+P1GSwt-0 zfX2y!5(A#mxm>S1~jn;C)*RnZ;$!xNr*uMcF zN~jtTm{Hv#ns0eEUIY9-Uu?*K*>_T=iKLA+M2ycYK{g}YnHm}im24yWqlWQ|P3>e; z=-2HI(niHb@)EyGzI9pFC-jLe*Z{q5RybikCn3I#aEGnzJKZ)TJ?l${S7aWl2I9pC zf9bXoJg|4(64WOS(nUntdE2lxvU#v82d~k3$>!5eYTIBNsm;gO%8;Oc)3k8Z>)Q-t zq>0#Rf=g2Ily$1pJW~$f*x^BZ*+}#`_L?X#d|2OZN#O){h)%%{DBA+*aRSs!)%vGx z_D$_nmT^=LvS2f$nk-5@o1_LSEOH22x4kImwk8#qSuzssfgjwIjI# z7^A&Taz?uAib6o!#S{U5O4tKKRi%UnV6PU+2IBiDZPEx{(KN_Y={YrT1it-P;u4nL zlobKi3_G{20|~32MVab46q!x}&9}n#Def6{rW!1}1Gy5hV~LyqganaZ%95uF1gIOL zOqdchiE@u6En^#h1I>NlfK)Bc29`2ha>@za0~R4}69JAosVka)BfW@_^c#j}8O!Z! zO(t!M27-S>Wn{q0EsE&1BFWCoHD`I-^bxCAYR-VHcaT%aj&)yCulH?X|(t+$T*liiKLjj@Er zIbrLK2yKmepcYDQ5Z7U9uZZv@e;DDRCoWr=RLQM}7XVhBjVYUT^i)Lvtl}V`0axiV zdM2|@VI8j@-|&dp(c*HgzEp>r`37ALBr~eRS1oN?QS-cimVl))iK#X0Zf>;T196Jh zAak5a%_&M1-{$eRB_b`!oQkw0H5n<>A`PK>aiywFoS1imb;Q9c~d6w`*4O5 zjwc0K)F>y%V>s_RjnomHC(t$zb_`S0-C3)a3Ba+hJBc;2Y8haMXH7TUT3kk#9s8k% z0m{sqLes&2mx&Qs(V%Ymb+IPpt`guZoPawqm(dLq)Q??*h9*MO#moXP8H4B#on5hB z7Q+O&$Vv58ohlDFn(*Ep1Z68n26|YL_vCsHCRMT0%#u7Ic=J*U;(;=2vLtG|+?8aL zMc0s}#E9VvLPDCXuV|M^hE=;xP)}E*&aS{i(l88vi!zdA+n3c@;k{H_VvbB>Wazw^ zhgnF8%L2AN+alu;L>=@)Gh8VwHQE&WS2SqdVH0y%hI7ZaED-`L2Wlq{bq)^H)E%)V zk|;x~T~az|Q{6z4JA-1c7MDGGv^Zylhpm=M{^|~EFdIkiSP=Fo$q@*+O?m*7lq5M5 zl;9hGtvHQ8K@UzxCPBAhNX7OqHKml&_0#&h4vC~rlT{l$c5sPtd zE3ObRhGyj^`>yM@Tr)#2nJI?SG)F6D*B3xH1x}G9XOEEw>pyN|yYSoyN!%yp$fq2*O@3mAZ(}rV_$=KD=ZIFV-Il4u)1$gxVyb zYlvC@2dOa76=%!00)fs)p%9mFfVL;%0mZtZXx+s*83WTKTeOsIvAAT2ss!EUNV?5` z5@^0`B@A>9>O~6t&ym!fYf&i8biABF z-cj4SEG1}((Qpz-JWgLT;C1e0($5x3r_+s+<7n_|Ct_3$^U$gm!-3zV1-IWveoO=K zlJxr444qY`?~IL+4zo%C&fQ>6+E!bCf(ngR4rRBMBB0pzdx)b<3jMd6xBttkeuuRX z?3Cdx2dj&N0%ySB>SE9jA{tad+v4Jpsi21-->r&(q%;!1tJC;X$qXN)`VgAfC}z54 zWPJfSI502i2GbbCeR)eT4@O5XY|m&*3}V%_Eyx{$2Ir=s9TwW6CY^K|HDE)3ahlYx zoW|pjXD%jGR~2KGz8z8)uawF)D}t9)iw)zfVF@oM8={;2i_L=lJJW9Es&P+hmQmlX z9v&)n`7^Eg$hGDKg!Z?cnDgquv3)gQRWZq$>G64I6`$>L7<}zPTSQ+tMD>%L*}^o{ zT1@A$A$_FHTbyb~RgP+%lZ0e{oCF>UfHQExx^P^gG1H{P3ybSEHIPnk6pGlW^BRB? zr`X5T;~}$#y)%IlPVPljv*x&>3dG6D0*Oi?=6JvcFw3eL2@nrmxA4HL!g;&jc5i&_1DR4OXzX7wC< z*&JJcahc8nl-Xiz%5jZYGL#&bB%HT1c{nUm1JPU&B9TS~;G>FS>akhOjyXEiJOGqM z)BsRqP`kVnt%8#UPD6mVdRnl!p#uF3rh+yV%AE$scb6v_^&D=m#cr|}#MaV+?zIdbuVVuubL(wjyDFyavo#Aez)GW!KExnthTLEg_Rica}|#W}QZ%5*^(0w~6-`OStxPhC8GFuBytrv~ zd3^VWI9=r3=1)2_yd^lB1QK}dNnxl<2mL4629kE7lg_`!Ib(Bw6FAKv<)h=y_2#k# zh=e23s(X2}>bSKcJZqJW!)ytfeKzJSYKGzu5UYk0^NL2oJPszUO#XrSUORPtq~f`a z!zd}CdG}eVNqoJDI?l8!3mm3yrfSedX`cqIBx<&Zbq)!(q#Pi#umMHG85YeGUqOg7 zP3Z`XsG_3-iz^s^U>C9Eb)z+ykv52LAtlbUVV08DofWH8lA=LPk!L>RpFZQCvgDs^ zCJ|~-!+YWsk3TKCb27z3tImn4iz&*}X`q|4)Hvs-iS1+-%@GQ0S^5UzQ4U+(U8OIb zip=l()N1dBm>PZknf~rG{oSWfe@6&$2ee$P3SlQnKT58D`oTi!)Bc0ZHmR4m04xg{ zh8q#8MrLfYI!(*o55?Pmrl0vtKl7P><}>}wXZo43*3S^RnU=``4J>V(7qpP1bl8E4 z{F&;WnQtg1%QZ*XS}sxp{GJ(}N_()PzlspX&jS6j3-lvrpd~q%;^=$7lq9iswtF3m zn5M{&FP`Lo38v8l5Ye<&vz*5OABB9kyBj8Onuf(NQ4veDAqizM#L}*?{t!J@b4ZXz0Agspuv`C!jdZ2SnT`p6w6#3IFY6qg=K!+c-Ceh;zG6GmBlM@ucMy z4Jx|V8po}uq=K`hDQr<>bjH$V-~q|;zE)U)7{=*;_o(-FiLD4Jh>;%6>lAe+g*d+3 z48*Vq2fGI2vIKSAs*yljVkK4&Cn4_Lyl(71$-Pm|n5LUTVnT^ie|b=+Xt1pltg=xl zR{9_PUn7}t^t9PH8MUEVl?@F-Rx6DClm@0Hh9qe0E_MveL)tM?GvMnQJRt+^wAROx&^0Zm{ z=Oh-$cD^j;+NPwp_83P}*rWg?U22fjNutnypdXo;n>m3~vAQ~j0FEobpu=rlcP(5u zk|s1(j~B5YA`OAiSj>t&m#3=eMnr@9I?1%EFpk0zsRG=9lOQ5|crEoxuWbGV5b4!w zhzPMJu5O?`%_-in!Ab;D>`dHI3_M_9faUrx9sqOZ0H3YPFcR1UG20u-R$P|Gr~n;* z_CO7*K5;o%+izSll{cHjV=)e~DmDp?=Fk8eHUKo|)5uUB^Zmd;F&G%Yaq^D71gP_x zh*^`7^oQ$U*}HTCxdrP;7K)LmeNY1HxsG{I&=aM~8boB*gc1hSN468wf#2tI_V3Lw zT#W0>V>D;SbHQxK$f;P677a4s!O)0*kPjw^ItxWp6cCH^QL4~#4&XqKe&=r>pHbO& zgiexQOEDje7(X*Z7nzf1DEwLs6Ae8gZ;MW|Az0FMS-4agO(KojL17JI)z%n_!AT?9 z{8ckzXP1MyAa&3E`loKsqa3=%@VWt7_vr4meYAAjjiS(6k$pUKoI$#a}yZH_h!e_&R68%9z% z8d?>O7)%MO9Ku{(QsS~q)u7*P7cFbs8i#CdQ+AhdDq^5<@_jcR8vybOhwLYag%{Mb zK&blpc2#)=9>$RcU(z5aBpCLhoz>AHEhbT}og`2f9kx2QZ|FU97GPC>(`i62;mDDY zj@8@(LczrdDQvO6Wkh@hI%1r~7-3;aZHrz`lhHTjF4A8UJ3%RD%XB!vX8i0kFeV=^ z`_W2!us+Ka2na=7sOUy#LbtYH)Q(s?w!q>jIhwG-;W3hO*fObJNxY&L0f|N4(HKUY z!&6NjDnk;5)M;gzYhb*8^U!|wjL$>z#fq_rmznZ0Yvnde`Kodx-!U@he-2a!W+vx< zt`5xnEdTSEJQuaMF8Gq`1a$tt)U>d^qp0ZrO)4t-+~hBOzNo0k{fFCLDJnYRVxwV& z5$i)2c~NO)9r>#?;EO7{QCeAF8VGQz>JdaPqH!_ZBSWJ!5GW0Q`0(8-LVTm;Ir!xagO9MWU zPIgUgI9Bf$6XA$|e}=-rrl>M=4e113h2)!dbb;+beMXKAH@#ubf=+Pc;)T2fsaXyl{ym8F6C9hy)Y zXk1#`9@b(lEoy0?F&y?SsH&4&BH;zI)*G6zOyyc@McLohyR@sXeMO(YYf-Fj{aK-g z8F8bd(eGcoj$c=0sPmy;ig7(%D+8UiD;o8g!h+U+4p=QNo!_l2=u{1VWZ}ZbmGG<( zZ>;V18B1b`KBIB@!lve?h#p?nUad!3J65RClC zi_hYJ7D{Ss9Li_)btFmy^Ywrtht3kai&35%*4I{TKC1{z`YO8;`-qS8QrWADzM^qv zSW^3zS5`Nz5DiW2j@MOIS5?Azysok?QME1v*Gp}kv;FJZ&WbONuUi-;D7~^iu`C{c zUa$8wFX&Te*2%Nl!YkSgpMQk%GZe|h4>D_dqwz3{>dpPYKqr26`LVbWzs7Z(@bbM*EjCQh9A(s`ev zW=E{3IPR9)ZsQN^d*{MSFMWLXOZWPFcCVQ5bzjlctByW&=+GOx?k@S`FJl*f&%J8f zpZ|RFx#ym%_VzA#`g`tYe;HeUW$fNH@z9||zU!L5?h6(@ap{Q{yzxf#u_vAg9oYBI zlTSYR4N?5@-rE+{Ja%Z|R}NH8z3k|t4*c!fHCJ4H^?8#k!=S9}3pdrozy08YXKdTH z%@_Rx*!)cR_cxt!eE0wU?2*e(KI4ijuRQnW1(*Nj`5$*a`SjCu9CvDe#c^N!)(zfm z+qTXB>)-zN+Vel|oV9*$Ss)O&i{F0CV~;=1{m+fFeK$Pw^{VKX=hxLe`?HmmAMM{C zdh&`>H~aa|Z`!o!ikoh7e{#nB|G~4-Pd;f<&-cFn{mbCf-{W@O#r3^7)r) zJ$2s4|N2KsY3Y$$5AFYdY3H7&o_gw$@3~j`1`qXbZk{^f#OeumoOR!PRrSsNJ-}UR>J(vCb><5dhs=j(db!^kzOW(Ta;FYI;?OSlotf?owaaG&g zN3J-vPTeu*LvY$@M>I7xJ<#*c^?O%-N&Dcfr9WG<^^`{*dE^gOU#h#{n8$D1^3CZ3 z$Gz}v+_?8In{U5h%iy8OuRn3=cdotm_;c33St`ABPs9GxF4*-@qH^1|ZLhxh=F#`Q zbjdG%QT66kU)X(rxp4QqpL}V1{mDODdGF_cv;Ko^H(x$?;{y-OdQ-n~dUf@2b2jXI zjK6%&`5%4M_olx3D+l<&O}nNX_~{ofyXdTna~}Ho9joqtV%OdLmDgWCec-a&>n=Fv z)Ii`X=;h8^7vH*L-O;=E9JlWu{pi0RemHCD+J7E8u;=xEmpANr{1@VL>IZKveN#97 z_Pc9N?|bLI7yt0z4PUG{=b;t*PpS(I_HI9P(&Y#LeDZ+@&$#TOwO{$lSN?EY+mwgi zd*a03J$&7hD>rW3=!^Za>WI&OzS!?yvj3#I;9z|Fq1~4seBtB+2Ts52=%VeHPg$_% z<=;%4IPsBxc{A?#{-Q;TzI@6lm;Ls)-?(k?*k3KVYwP*^;4k^XFKs_0ulv~V=bxDH z(Z?TiuRJ`k^R}|so|k{~#`8a(6yEWD_rS)EU0Vk3+Il`WxbKletNWU7tcklGe)!@3 z%1du@ue|4oZ+`QeAH8$`E4Q>gJ7eEJzP|fTdDj+y{sC>!Gka=?=bycsU+~wz{&nG& z(8BGPPuX5~?40xN>wa<3mj7P7d&k|o*1WT83;(ONgPxgFe;=;=efZwJlRez;H~TN# zxN+0my5+mJ{Ohi*TSJ5Y^ZMF@zj}W27ryX?-~KZ8f4A&V%gf8l-+1=s3-(U_^=}W| zc=^G9KW{s9lgXCyH~vW+H2?j{`bvqcCPMNzrN<7haPG_=N!+##xLxfcJaZx z=QaI&=a$#DpZ9p^+y@^#(;h);_;r<-@4(38=f9`d-8$jj@q~V&}qM#KY0Er zla4&{$bWwL;k9$W^OHAs-ulIj8#msvLv`(cyKUa?%TJs9t9f;oU(|T%36HG3Z_$?8 z7p}hMnjbb@HFalX){zIEo3d}grc3^`h1*{L_W$1T-u5Yj3%AtHc=DNNzI*@u_wSv2 z%;SglUVQM%({A1udD8FK{<`p_*;@Vn2|sCAzrJSMwr#iUP`|M6wm~$;-SZy3^rD%6 zuk=s);_;rV=YHp{;3MBYa`W7QU+QwtAH4mYp3W7#j(zOYf5)zQ3i<>Wv9LM$0L|CwD| zuHQAKDX?hpTjxIU*k(V!`rRG#XKs9d;it>_Pd<8YXJprT2Y-y_S+e)2uM5pWBy#iO zYdt$7SA3~|VBngAkJRmM8`ypMX+Qqcn$o&UE;{$Wj{3{f-mO>9{f>0SrcK}e!4JTj zl_#8c@W+=Qyz;bb4*c|%Pd4wmUzzg6Whb9L@cEY>dD^@6lK(pDn1x%Gcz5rAn6+z4 zQ^(y~-@1Crq^VaO-PF{yGjherr%jz&eCC;}_g}J}8+-z-bmPILx9#0rR$gBFufIQY z>ke?n+MTx?{kz}&?v@?5Pudqb6V2rLS8lrclu3TSe{+?%Y42oV!Ry;E-~QGMKfN{i z6OQ8+wzXY5_dC1GX3Y57#EBDscSfE+`atC=`xb2KdTUSX?=HJ&=gy9*?*DDxKSBG} z6PKR&`V*I)xHIzn#)FfOKTy&%eed!~aQkETzw*tCBU=WRp>O66?0@yZo~_r;y?NR0 z9S@-O{BY~_WoJzN`~Tc@@k{qc7H@g){+`{tKG*Wxq4#fl?wV_^dF|tWe{8wn^2?9i zxN+kNd%Gjy@PGf{2fsZf^49P6zWLnU!AJhzo0V%HKeTJhY5TSx+S~Y&-_LD3V)x6x zS+)O?t=HUm{DpaW~FdH=nHKlGh%+;PpH1e|g(q9>4f=MaNxy z<^OISpY}oC8?6Jpw@Pi)|{rlja!5@kzR4Xqd;{MS`AE9Hj^xvMA z=k8kj!t~V-^)30R_pf_SKBH&CO=t9e4{h1y2b)5JyW5njPo8wjDW^QSW5=~~Usqy( zdSK$ztB$_ln3KP~Wy_S`J^l2R*IaYtym|9J*)#a>pRV_R-!ymNgbR+H^7*3Gzghpa zn-^T(*xWp!b<5l@wLJIF7nZO2;X@Cd^p71|w!d_5H@|Y`oH@7dxczJNYI*KNxV=6Y{K4L%p{;^Ze`2fysdG5=T zCjHk>U)Z>L^X8vytv25H!%vR?!^Pf*SA6iwgxi|0)BbPXs*g*5`_MyY!iOJPe$&fa z?tFRAPaivULgStt%lCY^G&K07n}7GOJ6d1z|8Qr2;MfTh&U<0)<9pwHZsOOzcI1>P zQ%*XgXToi5TYkRYf88_T`o_j(1Fir1`!kQe|F@@?tX_RdW#oT;@X$jiZNKc~M^`Do z`R>cV*?>;X{lD4VJarP{53auU+DAiozxt1azUj=Na%PW{^VX4{r~-t>PzbJzQi zcP&|ea_%pFQ5C&@*$01n_{JM={K@gpZT9m%{qKl~3E}Yk=c+1J-gCr)%T7A?+G~&3 zbp3NhYrgq$>96B&pTBYA#-B`ipTF;{yVt%j{iBaQdUe}(zgXsWKmNwEH&6WPSI^tD z=_`Lbr+NA(GwW=};^?I>Kl4!h?f?DB@z33V*Zm^Gvx>8S{naA%FOMDFmq@(!yK7G0 z^kBgC9nPY_jdeRvSi7k{w?u=uO5H=>pO2%_!99!6Cy~{N&i!Fc%he}O+OThT?JExt z+`0oC^~RqcoVo9v|C@$RRgQqp!dg$F-_HMpwMTOdb+lwgf zlg~W!&M&ukZjU&6C<0YgUw!+5)Kfo4Xz~{iR33w9^6oop{=dzV+RMlaE3)dEfGz-sk^c(K&su9Vz|aFI)CcxaX0-KXZfMc%$8M z4+$6g*M0KQx{p5oxM@pm^*`T#d+(8_u9|l1j_8;7-8L7E^zNOTPJQBtqDxMkdCavl%k|LbR~fAy6mOO`mV!)SBSw{E-bwtM!R7hihZ#Ye{e_=_v&KI+-EWj(r2I|k1` zVbX>V-)%t0cXHRUZSxLR?c4K;ci{Z9@0$0)UGp{xw;Y-i>26!CyVL`S$1UjkHNGKeTfHgljk5c;hAK{APXAmLGn9arcgocfI1?z2oE6 zKc08(36qL^+_obQT|H;ohJHrE3)I1H#@K1_sq;!eo%M8F`H*9-``ul2(!K?oPY48qYk{jxv1#IGZSAKIIyoF z8ZGsuUst*FA7vLEoN>~BfqPFr&^>Ek?-#e%&v^UA zI~N3l;GBUEmacxdf93v@&OW`Y?6=SVxbxXN*UUSuw6tjp|ApOmzPoG7!MnHqnjai| z+`r^I$Iktz=)*tvPWe&mO&hmuoByV6l+K$srSnJ4j~x8)mCNDN-)q{!FWkN7-CbK= zzkBP0{9x~YcK?!#;nUyy;lP1?U!SwS>X=i`EE~A&_9=s(Oq@7zV)VtIpZq=V8qdIG zi-Uvr-!<4 z6KCGF?)An?zV82jcbs+Kw#P1-bmeu|l@AVgwKZ`~0Bb~7yj5xad0^El(G8b^O&d>cKwuwAMUD-3YDbS<9>8kc zxqG)VcAJD?lV6c?bR9KXMum;-~Nz2}3wxs!&R+8K2`S|$szlvAR zwawHN)TPQ985ybg)`&t8X;qRKrAM#1x!JXIf2OP}bI@u-UHc3Ik++uPA5=H`;x+JXmGhQwxOirC039r^Swxw_io-hPdL z1;<^BDjpZD5B%JZL}M^8Sy|2t7cNxS)|y*d&SyJxO(jEh#CBq3(2agmiRtDy~Yl+w>+&l^8T$ zM=XbyqaJI7hDypQc+Q{c=2L3FE6jqh=|I{$~pHlwIHF~ zuSHzM!@~pJY-|*mHEY(q1q&))Uf;^g$G0uyc^K#W_wSo7P-IV^K22)7wXoYhjk+D0 z5?>q9rCf3f3YFEnBpo1)!*v0mh5y3ZGRyj(N4$d~qR>yzLh|gF3(ztRPIIb%VrK8x z2;i`-e{f>0TDMa*dx=5njj>195IK~0S3ZgF*Ti$#);~Clbvj8Qub?5*)s~^2B&WG; zBpukTMu)zR$U!x@4I7NT=NSiEr!7N0fvrERcsu%DXwN0~B_Sy7*`ea^}BvyAGzy2()dCA+iZ$DrC_Qjy=(xt=T-MxM- z=aqDWdm-bTVI#vWsKVBEE76!rRrf)mN}|35qtWO?XU{s1I7y4q2oYLZ6|;5p!(C+y zE31kGA+^QJmc`f|(7pbD?3ox6i4;`#TYL|r2F2bQ0gt__lEkX3tFP4^HV^E1B;VfA zkyBi}m_MHV+I;~e61n`thYzHlNAjY2;md@CgqliFoUdNJf{a1NeGIp-`n;T+9KXjW zgd(G&5a{Z~_c9Q3EG;doYijt%#FqQgsJXBxY5q!Ud;6->;9V7eT$9SG{%dpQEm{qus%C}r z=q#0N<*S;zsjVvcaLBvo+qZ9jnZ4iDURqju9uJSXxA&p?t8q`|n!GAY z3|dOA#-gH2%f4o0AW$4%zkV$yzR>S>+H*eSohP+_=h6H#zO{SxP33!Q^_#pZiw(Yb zN5fai*d5Si_ww>8-*>BKuj1O-1_lOShgyga^SgwVz&MpvuU%P+*en*y@TI}JUH#|!tBL1Lo8 zpC%L~iMtyq6C$$+2w2?<-7Vz47Hxu^7SMLwFUHE5JjdB1LRHoy2S;_)Of`=zZn5Ac%$!<27IPQJ0p^EFe}PNvYphmJSRVkQ%m1wFsNHkc8H3X zHnF49Z;-01zCW*z3HJ&;A4aU7TXV-PKXEqdB5Sffz~v`Jbu|dlW7I zp5W6Ny*bp%Q*E8d74Ss~_4j+9{w5&@`Rc?3_amA8m&OPm8yl4ULxpaf(=WldZlDT* zb9s&hxv*91Kq{cyz1jF*?)$5!!GRxoM3Q3^aZeUBlzFjbV8rTbdd zAK_tZwc8$^RItG*Kk^~Z?C)JRq@YIc#TtgBqjvOL_2z*=K}&FtVYx4Uxi^lcU*xR5 zUNfg@%o03x`umWIG4H+wPH%5^`2su?6!lk~aLCAru6XvBDNSQK@8+dbeJk2@Y**r* z{(`43*d7-Bsbsu&C&{i$v>ANTe22^_*B^HeD`H!c*WdiP47+UpJ?)1*t?Q*rdKaQW z1bO}LW?^8E`qvG_aMYgP~yZAGfuG?oOD0c-b{sX{&a{s;g zk#|LI%g5Id2K^jYTzt;Pg_l)dU$4V&uNQv{4Fl88Fuk;ZH90os+Jm_s{_WrM+o=UV z=CYHsbJg`fsfdq#-(Se~@Ku1R(>u7uLtA}zB>UR&C92}rMV3qu;@$a0g zsjT0luxFRYz9m+3ngH@p-tpYfQ26|#_}=Z&)F$(2LDUkKze6W)Gcv-v*+o6q*FhUe zB-+^<*sX34{GZ#p9FA*g`2FAXvTYq5g($%%>1k+i%-up2g@0d&4e6&jrlEW_8Jqv( z$P;DH8(lR-PwfBYUA_`vi#t+#azFoAjzJRPs=`SG9l%%uOe%blig$ zh}DFDE91|w=cEb9KL6T^b`f|_WEx3dUPkzItxchq;1>{RDgcHwE@I*(Q(Kc?4Do&R zP^!)*Cz)M5fQd{x%2 z9R^TEf|)bweReY&=_^>C5@Y04LlEZD@s z>L$22zfx~u10*G14f;E9)s*(Z)ZCaC34UwK&dJHCF*{#xYvA7BxJ`8lVh)ZqaF(oF zov$9W3+(Q0?d}e+{`rm;->0cERyH1k)FyI{k!(+DV~G@IMtbW%NV@#@&%D})>ik|~ zvVmqYO%7+(2#je(-SQ>!)~I3E&2_6(&XrGgeC+(=K9GHRi~-&{RGcM9$*5^F3Cq!M zk5a9}msDH5e_G_I=wrL}t;-8LmN<#i;X6shl;*}-jj=$#{HEHANx^W(4KsB~F}bXt z?I7%n&N@l@ktUfEXsZ-oOdxezSMo)>pK4U(-am+zv^F#}49>69teH4p7dBWfbS#u7 z6Xs;20Uz=ER26ldZ(DBy!7K*wx?|IE_T z63VNSSrWK%S7Ki?ZSBRP3-`K1$Qq!U`Gdf25TWAB<+w@kZ}ea_w{hIH>_5+T?~ss_ zVz5z)o7c2FW?5y=(=Czj(HIj%kMq?c&z-&j=0x8fiH21?jx4wE3Eq=5bvun{h}lr! zf%tk?hY5kZ)FHO%`E&Z&#w7zJws;Acl*rqaLq;tlI}2<+l6}I@<3!iZg}3O;u7|Bm z3I=umd{c?E`mXacS-+S00^JMTa7X!6<8`t+@+OM5JU?c*L7w2z!e_gH@%L`A4-E|s zRHkrcDsMzorM98C2?7EF-{X$&d%dG*KtpeD5;$qcnJJ`mK}R8l(6a}rMcu){K_bo1 zQP6oAw+w5-XNzJd5XHF0?c*%Gd3m_pYq9$9FZg`1yv@#cc8>mPQ$KLfg!nM+tM}dT zvz>6k2Hdy&rQBbK+xvKhh)nW`#HSn1LaJlD9Sf}PkC*Lx4x<}3^AiQU=!Q)80KvkD z2JX3=_=H7r-AHSyf4k~wt+t88>&1q56Y5hKujYL>-@?!LIy-$1J=w74L$5m_$dajS zQ2A6s9=qJ^jvbX+U)r7Cz_&pH)BNiKWa$E4-*{B_;(UvS1;Y90aL3kT{WRMb7Q=rE zgU!%YSDTcoytWJtu8<)7ByTVUL?M?;eKjTO;R+rrY4f#`kkHHCER`t6t0K8bjFsR^3aCm8 zfzcp+J*+pW0)#jJU@X!i8TzdTQ5e&u>7f?BFvmEYN9eUUpyG+$7X zlDg_>S!Mf}zG(P^vl~8td;LPY+z$!)4sG6$sT83oDQbp4eg?%w}Mck zs~tNhDJ(l^@j`#mF~KxDTcPJV9HnsZ?YpdVit(WpmlvmMBGPk7b@6z}VIZ_*`ZuJ> zN>9jRE|yAZJ7gy%I#+&kWnTIL-2r-Kzw$zrV&o!d{JmBiWWoe^RI)m%aS^&Z&c)MU zaDqLbO?P)uU^#NneOweo{(1m%Rej%PCRfkh-pLwjYgweW#+J?Pzu}-}Rp1ELuKqEr zE-2Xh@;X4csRTFbiyVZ+s))|nShw>K`Fsac%(;-@kuXTJ|H_+I2PMtMQFQeLa~gp$`4MD$kcXT5M)c>E`}Caj?%X zcT!2JOrz^q5ZfIadxHRfq2&t`Y)9i}-HuyWDD=VLm64DuTRPt3dbuBJ)@9vsU^^@drXzFWLS4mWjlk?bY>8ay0Iy$z`R~ihv zy&D3hD8jDK|XR|Sm=FZNzkp&GE<2Ifaw)3s~W^~iTD7Zi$SyjH| zm*BVW0e4juxIsyjop=l9rZ!EMJsw?kxN8Z>qj}$&i7TX z{JIw%O?xac>dxX3UR!n02@pn)MGWi*-l7@?r)Y5M78IEh;D^lhW`;wDuY_CWRer%P zhhr$Et+Ls-qN%buEQzg0<*4&qa=v#)(mnfaT!9ra5T*?3Gtb>h)|5^2-~s-pNyEd6 zPc~c$ftP`SpGI6_p?|0!*V0U$vstvjIlbwpQn)6tf>)e1mXTiUyXa`8K9kKb-z(>Fj+Gk5EWH**)%<)>QlgBicC;qZ8<&z#Wu#``auHlsi z4aug){_uN0^zR(C0lOR$wwU0h-vcAnHjC9yoE{ICnAYkAy-ilPU~aV)DLoz$j6^5I z)$prru;tp;u(r@a3Sm3=nO@YeEPtl|ZfyAJNBDwms?AAFFwrFB=bHn>`z_c=jW-Ry zS6_C&PB1D728H|vGvtiPh_0(^ELRSsl^B@Htvn3mWE0yFf#sA-;Mv5n7v*SC`6iKJ zwSvcMy9yNsZEN)<8x5CD2GO=8uROSE!DX6lrdee`OR54tGz8X0_-BXkkI%i;w`@sH zSZ&)|$m|^0P@b1)jh-aHGkL~8#nVwUs;;C-_vLc=(EWAs>#c&$#kZ?kVwmxGA)j%- zqNZe>0|=f_UWcgAH_4tj{uK5kvmEa+)!DW$%@y9zYwEV)hA)M=4}C}*(E%lzvJChz zYV$UR28YTT6__n@DW^Sk^8pLKW!PgYot?bW-WpUYNxqu@E@hkmW)4>6ds?l2U*Fd) zFIBo?JWFiCO1$+)GhMmyb>9^jba!|6gst%jR?CNM9(PN>i?R*Wl~)~^JsH`iX1f&# zXkRgZ#_+1S9sLPQGs~%rV6`u5q%FE2JrHEz0M5iOp`H`HK(GusgNA^v{^6N@01KnGKVa- zA_J2~Q1%f>>w{2k+-kT)7_rr0xl(UFb{I=pbk6A9jN||~ICuyhO?lEQQ!q)}QOe2K zFbyqgUqg&qoGrpTzO9dDeCQCN^r*WUnM)u05{o#*L4B!`fOQLwVPH5Eh<|C!>+0%~ z%Ymgg$)S2_EwkRdTsxj|RbJwn7@daOULt;td3o8Xc5zs1ko>j>?QyZyquR^vws@ST zc)0SS9Q_PDn-UASR97?{J28u=ZBEULZj1>(33QYio7r{JbGpkK??kmH8Qd7fBVMjZ zbRUeRl}JrUs#9+4|BQfgdq%|8E!i3Fl8+$x=1@6V<7odd(XH)jR8+>}U9voC1d0hL z`}_N2ffR*&o~aQRPMb-VMQ-@oBYljOf>(3VR>1(JY+9xUH1?lA;|JIa21q;`adBn( ztCCVtOymk6+%f?IfB&K)DXA!&mZ1M0hoKH193Bd`3SSHCIQJ#eozk>;4mLO?VbFL5V zI6$Sa627W0%k?xV*plDsPr6fX$Ezr9J3T~flIewL`SEeVY?(eDJ|6pxZvRa^j|W6U z&e6C^6}K`kpCAZ{zmSmgys$^zX-h30oP;=D`dL+#W1OF1rf76qm%XXyc9C|c)rUEL z2+UhuvZ)atr^5QpW~v5LGoV;1Klh$(4u4&FmJJyT1@rGD}K-QDB7>Q8+|hcdH+zXP65q;O<%g(RVG{ewfHzcbbh>Y zjP=kCc=xfKt?2p>rIuY8>>U(UjunxcZPc>t2~u&8?f#3z;F>ot>Z`&!&)WfZhzlV@ zDhLTi1^q~-4z`yw%t|>OH#-+d(w8WgnTn2+aHo}qONNQJD5W-huJawNw3g#2#5xd$ z!gfKCj5Xedg6F|zbeDL-jMsCMX_dMv?W`Mwuc@P}8(v!)<~r`fMoU4Ek?-$?ydluv zXUvVCjDmIHo7U=3oMZe!yduEJ`*Ue68A;tA;q59#(qB39O|D!_&6VOTemEumj%J>e z!3`Y2HTPJf#1xzZ0LJivweqjO#1^o}8=gi!GSw%xN)I5BG6Z+7zeiJlc5fE+t%2yh4yu zvN|b;xGxv7R5d}f{b1ngM!V81{QFzcxJ>o}5knE@d`p zl=WjxIvdnVnEy5ID<9D>nV5JX)m(ict{2LZZh~69T|Ca?-SflZCbo71@h7W*?(4F@ z0|ZRaVm9(xT7cKY%l-99?#^uw^3r!=8@~qIrRswV!_GbWJ+D=rJ&JV5STEn8x%qhx zoO^X25bOA8uWo;YFJRr~9Bx>eGju_$Geju{lqd;~>` zh_H$tcLrdstN{XlocCpAW*c#Rb$NU2tTo!Htcw=UTNx>erK2^1l3BWuxEx+}&bK;t zr&3RVQFpK9JqiH4icO>_+vMf`nuy!$>xsQX4+kxq1eC2>N*UlmwLxMB`JNTG!A1x-$!` zXY=V(zr;4Mo*mWHtG-PmUAm(#7kysmuI>SJmRp&Xhnr)~{D_a|8@f;J&T@sn_jF$Z z)I^N`226yBg@buYeE7c3bIZ!e5Ow0sqxf+yG3gT5?7Or&yw;hzIQ~1Ee7SDVy^%XV zxt^NMb3#IyHR30K;b;w2J7Usn{nxD?+%h_5Ny;o&kbie+Ja20+eS}MEnA`5q~ zuCC5CaIN=T2D_XFXS%w#kiyo|U@(E!_SStb{f*;*AchH#8#ms!nr{~?rfrQYL1o@_fq$<}76OzN+^z=xk}!RAq#?pWzYSuh_$L%q0X z*Y@zaV;s>PEsfjIjzZ9Vbijq8B)>R)b?9IhCVe|SSeSNeisuc*7YF3OzjmeuqsfB1TQ zQK<+st3O4gpF?>RHC9;)KAW={V(1DGO-|w?|pF(lXeo1!o5IRZdrwN z*|n(lgRKgJTQ-~1B{~`>J~s9sU*!-fbZU@phgc|dI*OY zYo~RzHLwG9Qf?i~quUqKRn=T6RO{(_E_Tz|0$=ciMqN#v=h?uCwm9 zWf@u7mc>dxOB1WsHd%+y-1GDOWCEt=dE%xCfoycc-M7lJ=NRUz-NCHh4qs1-gHhd* z0r{@3AkblK?%sB2==!tU`L=kc>~FJe*3mwZ-~+{m?H-DAm(x|d-rV{CZ3ULT#aww5 zy(tcUM+YJ{fQ_B0##6Y_W=c6cQD<}Rn#FbCE}GW-^SArz$6>Sxf^M_j34m4eb}BZs zvCh@zZfwk({`%U|r14i;MwWfOz%pK=yQ8xy)Jy#w>99Ky)UJlO6T}; zzOmr=vYYrG26<&51;vrO?lBjxdEVSu8zBXM*!@q~Fd8g=vv+rXqeFhecufhqtl5ms zyDnlFf|;2)i^1L?V%Qq{KAp*-n8JYa>v>^`qQI#PLm_Ee>d^Mt?tfA8 zFwt&67hY61W$~8~mm5fTt-wU9tt}0TZ#z3Xiv-73Oz!EL9e*&ihs;`AnwYo@3+nb% z2>ya~Wj1xK{}}F^T(twQ>n_k(T%>%$md~>DuTz{N|H;z|{SD+^6ON3nC7Lzok1Dro zj~f*ngVY*ghF7=#&xi7U@Z|`_)!laBJ-dJn@QDS|sZ^nA)-^O#oHqnPK#`l8(p(1q zM;v}(-+D)~*a=4^=6@KqR#*RNlD4;*Hbex9vv&k*#?IjmXs775c04+9!_K}faD`401I2@ zpCfocdsKsu#YlPWJS4-BmKV1M5(K7PxGz#bD<>*i*IzcRsH2g$5+ zvqe4SX)#JxTDIjfL7FVKBA6r8M3-+E&Wp-}Q#FXb0Xq?S;0SQNJ&!isNDrC^d{5p>6REwz$pxvXhsuC^z z=akpRag-xRM)*w!nr8G4&Z(l9;_w`Djn6@Pp6snGO`Y---zO)F`S*vl4&B$6e+B&p z1_o(E-#6{F>(vTCv!CLCxyv=Rb9VxGf6a8F9b-H>fv|x85p+-7MtKKF3=R&e79K`N zN2mD{yrMsmonpASnV~sYeoD>rGJc0eU`8RXrgu}W9hui_^|)BAA2wb9At+s9oGKwX zKV_n?f*$v4$9!RQDv$CA||9OR{k|1MY-cy=PG)~a1ofMs+)&DJKCtzDXL7 z$BsC=Xzn~jf0-ubBmw&3nBg{^yI3nue+||Jt2gI-gTjo&LrO)8y1C&%t#97x=(fQl zyF}LF*w}4qyE_@;W#bmzDtW&KOV2!GHotfMQR>mRCHXNAO*!61KRaXzov1{c= z(V`$AHD3Vcn`3k$*<_?PDqS*WAv0AI)H-7W<1#=T{BSS9nY(UeZ0vk-_D_;#d4tm0 zV5bVAw3J~n8kbEv+|f&k2}mzjr$*^cE_ZiW6LkQVGw%;UJMkxyqo86%Yloq_T?l>~??I znK+}!Oi@&{LYu=`Opzq>WQ59>C>0YKEe1MC%iyTn(-Ko{cQd&JIxxv->Bo5Z`76K9 zH;j+2uJ-jAFJ@R=rjf%&xwu*$9UO=}3i-XY+CE-Zp|L>pbp#qZtLALQR<{pyzP$l; znNQRp7tLF#1-)9ROL!$Ev)z0wb!Ex$-=Pomsiija#2T;8zKUN3+h$7#B9&bv5K%)fHs^vec!){Ju(C1og9#2#nr=kB@wEa*pu(z_Rx8z z^ZE9htTsY5lE(b!n~Q>ey5f=kkGOZrMV-P%WDoXt&p=0DWB*Vq#68 zXX;uA^(-oqK4YRaI^#gmZ3fX#7@ijiJBua6okfRJznDwqA%1fo41XzW7ml7-MfXJc zw=Q?~Jnh_a2{E|zXI)Q4Wj38IGnt~g<#w5s=X9+^6v2TyEpm`??e4lu)IdHve!7G;N$lfV5AvtA6KrYuUXqE zD}h*`-sR==&@O+e$KRjtXSzIRaUHZe(|KG z`v$uMAMS2<{<`&jlN1FK%;Zgbah@7KykAv8ahv(*VMcn}Q-^b@U7cEzT4yo1`U?${ z%N5?ad#jQLLj5&nwYOQ`w>F z=9LD^8to1ZgEZ6IAwmondp*a^WKkSwkV9qRRbQHwMNk6N*SmZ*F~E*@vk4K@DGN$e zSXpyk?N`;&X+LvTwn!r(y*7=5ZKFa-Da8H-a3RPXAw|OoM|Y2q?@LxVOVCDAZ}`NX}I;3 z51*B{s&;?f!MKO31imd))Zym z5Mpz|Iy8WpHJH2B3R3N!IvzG+8g=w2afZ4CQ!H-!TdtlzF)<-#HDbR9pYgsFMjTOd zRml&WYN@H2WtK%=bvgdMZ*OvE->)Lc#t=HR;|7=~xvos^T4F20GL@u{i$c?wEuCFr zCRpQi-5O@-b)>&FvnYL@Z*&a|LQg_C#hZExn$K^xH4NTjUYm>rJDl!S_{-31;QIT# zp0D64vFGM$7bs)ktXIl(`WGHr1)oQp287Ia&t&0a(|wXl~Fv~h(W9Ta&UV3v({_(4FNZGkuUlaax_ zVceTTK zjJ19xQMSLo-zcOYC7R+6W0!)fUA0Yrl}vzlD?pqVi@#+46f_c%)X~nh>1nXg`G8pJ zK|Mups?83|z4P;P2eb{3ZTC)>XDV9Ri{U9ckPODlX><(iasT`cCy^LO#eL9fAwNd* z8MOP|aZ&;3I2U+x(~aPbW3c-)yEA zTIDOljDYu>UENCkkBmA2ST`Cr0mn@z`JDF6D&VaMCqx?8{PltEz zijl7A>1mcSf9cD?=>C&YgQFoP{cZ*wC8Y#1&Ys`Dw?A~aNjZHu0bwo-9)Qy2gQUmXkLnYYS~fU5YR)dm^BxcrZ`=Ef<@1#mokgtr=8kAl+|O5g_~nO<0R1j%%9{TkR*@;REvBJ^-@~7(l-ixjg&z$ zOhS;TrEk4VWegdqGxKE0%cMI@JHsA54IY9Sqd4v!0~&cD$kJ+>eom8$elH&pY`PAUJHat3Pqk z%s=dh$pUphCo>l(&#l<`yA@6L!hVw=N2Dnm@Pvkjz7d2qGot-l9EZBfNjcBM2N*Hf9f0XnFNn=pyC}VdTK`vm4md7LDyHP* zpV1G-ab1Kx{VVmwY z?!DMlUf!xRvj;!Xx~y8F;0}+@1&q%q0_BkvSW_Wa6Mg7Csb)`0 zDKNMgYrdQF*XII{-?r*$86@BHyx81W+)BLpB0n}~M>-R$m3Uhzb|wqziha{TLU62` zY@W_gZK)!GFuZ#rRdigCqPP4a~`*kmuO4&tu z<>jZruHX*t5llp3s7m|UBaG!;Ugl2BC(@Gd9sXQw>;0$L47nkeq*(|bk?l`ybgH0v z{w6A?A7Zn+`SbbMmmAxF;Ee-#JRQnRK>;OK5PFGm5fc$z{-^uE_!O5(tMI-Z(uhyi z=0CBfU#`C+d$OF!JP06anR+q1fEh%_NweSV)aKi_*GSXj)0HPIV$j<%)z7=A(5yk> z?1uOAw%2GsDjP~1_%6QHQ#!!|J1H zXNsmmE;q~f&9j5h6PSp6y5llcUp`5#82gpdy^L$9Z!dD;+wZx4f%zGN@j80Ce!+ZI zP30;h&P4QnQ+7Ji24)u75y|5{RHbV{y_mZb@xtadmoCX%-1SwzCHjQw>V7LHh0uw6W8=Y3p)$Pk13i1ycHk=&MC%Z)Gf+0!DTf+{ssYE?mA{+xH`@PEus zgr_Fdp_5b1_ktoKkOI?$sqLTo{=^$ZyRvNGQ^M(0?3;nL{K7YAC(?`9<9$q%Hn}zd2qM=_p45iF*u`@Hx z!ZNcqIo9*1RN5NwvECf^QB_q<@#k9G+lysnI1B}RI;J-_4HB}*MbKE+`uf1@72=~8 zhgQx|r#4y~4e#Gyi-UsT=;E@=_U(?70qYE@P@d>RlaH#p3 zl{y9m1%cmB?1d)4Zn_Xn$=2XcaK`D*-?vKbpDop(%0wElIy>7dVGt@f+x=6!bMbzD zMgv3@6`hTZjWKB2k>?#9=f)e@tdCUOg8D*avOVo2x14^472W8R*tf8}t~unV=%I)b z{ps__QH~rEHUHM*j^okr-fER(@Hxai2`}+yFA~apl}GX)3kA{R<9zyi>xUwA9$VFi zqL>8ab;-xoR%|`T?Y+sUlgSGyzA%HC(%kllqQS)6z^Tw zfvc95OvHuY(jsO{B81TjsP{3s@x@)1H7e%T!H{3koAM!eG{ZtGwjRvKD385od92OIf;!hJdo)2~3 zqF?MkzzZrW3DMCZEWa|~ya!?t`ab}zKd7g!0bQ+6J>Zoy`J*J~N$mL*saNr?2SL<6 z^Fvd0=BWTAXp&VyPtS*^qy(4E?4}G3647Fd2;-=#E2^)97p6pazGF9#HX}nQR1!wW zj&`>BO;5ogXJ06eQ7ZJZ3w&l;zq89@OROM9<`JvHt8A;y0_Dg7^&gy#Y5-dDQcpR8 z=>62or)G5o+yRy_3wDhxAI8_D1=E( zO2L96V31FCzre^5S|T_}h=XZCAmD_+fP?C@Z8MlaaTfHFBC!ag#7ZcGYk}dyKpI&* zJg|U$ZxH}}8D69Wo}QRT4j{dFew8yIQi_V&%}>PmlJ|%E{@zkRSYFBu4KitjWR)T! zhVqFw?@ibZ4Mp}}(;X$+kYiTZk5ZDC>jSXgP}2lKP=|f4?1b!7gZ!3?@Ni%QZb1=n zU_@YH;Ghv>SpH*;2SN#LQrGT`PwUsg!K~EGR!fz}A&X8hj>9PmdcFnqZ~$mO0FRGj(1_AKj+aVM`+NDvm+>g}@M1JxdRW4R z(wll%jQ3ojs~m8_3Tom2Gf>dzJ23_}WMB{&;pxv6YSaD3lAdD9Z3Z|ILg?(66ejAP z;FL`hbPbpupw}1393}rUBlkf+H|bUa%5f2t62HTI4=3A|7Kf1f9XADy3HBpT4VUD8 ztkY6tj4*1R+eBE?@r}hD7b#GY|7i+qABy=mUg$Kb{C?cVL z`BAKSk?RX*LYN+GG+t^oGLFrxCI5tP9LD>@9*-8j7E2sY3=akKrED7t{ZO}MF##o0 zE{!-5qU~tgk?yfaQH{Fn<-hCQ>s7?*)fz-mhQ!SkhLpVq__Mk7+gUxg1bWHXj-$*@ z&G0sA;U(aR(FzQy&G^0$FknS*zP}=2jUhZ|Ks_ZtDPrW6 zvvGc?YQ83ag7)es$w$FU5Ez#919Vy7eQPEdZrSctb(eG!R2k0SkG>G(UK6lZdV%}n zXz~{l=Va`$`S40^EpPy==nuqq-Cqnn8C0+iXaU zdZ-1gG+AOK1sk?>=!b>F`ZSl(F#(NNf^g{Ps#+aKx-h5pEDebuE(HO`H3bD8lu-qm zQ%HLff?d1BdpBI~!O)l4N-{7=u`-e%>;hU?az9}@bnvY41=@d7=0{Kzg@cVFm;3h{jwaR$Y~%~F zf5Cm4w&WE{#Hl2O>40?+WY1tfG3V#27GQmDbyI;Po;cIf*VDt~BZclEdJaUpZ&^Q| z=@o#fxuDrAi<~3o2U__A!3=mq)?x}HR~LgFu|bI@7=xw2{eBZx>-GFCmT;Gk#1JGy zl^?7`f)7WgRM+YZ#@ULm2MyP!@?PvEfQAnfjv0g|#4sAKeJc!}00kELeJ)>u0ze6r z5SQo!GwMWxo*bk>2paBJ(R%%^0; z;-tYeBwyK6w`G&btk%Ivx}rkiqbb2E=C^I8d6D~-NfE#(zy{DuN$?;;7tkbG{*XZ6 z!vvbKB_bW^)b(e;Jq3c{{lN$p0XWchVP_9;LJP^9#SOI)0*BCRpGf-U8tP02ncIm) zD9{t-ifX5MrBk)JA)^xz4QlcW8$<#IeWps0>GSgojRMyx9>5a8QjWzb#j=ekm`M0J zuAdVd-&^)FgqE)Kg(5$#(cd&50#*WuK0z6i3M-!yR%N7WpMO3-|K8hP140ua+^>m| zBHaOQRo^vDL?{f|(2-9fND%Ir1rDS|RcIQcxc_3~3EzvUfWuMB^SlJQadYFOAwr)Z zp3buO_DK<9%iqGv<)Nslf$4Wy^VGwWAeaUtqqxUF?r{9vYZF^#x78U<2q}E&D--8V zro+Ml*{MJpHmR?l11OQOfH4?SFtoFk4hC;&QWSz+zn@|O+O?u`#1k^Ympx1c^3Xc3 zlVqs4f)crs5O=LT?*%*yGhW1f>MJnek1+BEhlmwYVbP?-J9#ZiBOAv+^j;Qr8L$RQ z!rCA>5)-Z8q&Q%*|B8ea;3rZ=KVrztmTMbrDBF*X%Y@+)No1i*fdDfTxH&MfceYZf zpJ02}Jyb8c!4$zzbQs64aeGr*yonV#qjU%q3?JeQLCqDcIf#`RRutd@Vz1U^ezH-B zIdRg@)S$+1NV%t{;4G;9_+r%5-+U!8sC(yUW;T^^;K*TSmdGRJkpAY29K+xVLnm76 zrEB#tL=zTzGnn}-0keB;u0FqFs$!(|6^Vr@0!2)mKkWoxr|x~16wigQqFhI`bRUv_~C4 z;#NpP7>6R00g(CZT~2rwq2@ikTbAEo)Psb3Cz??1=;{pB5M%yQjaK_2*%@@Kl`elu z*-WuwI2o*d{-uX5zW)tNB25wTnta)BiCHqz(@NzoPdr~}5kp-FM4~akB$zTb8Htc9 zX2qA;&E$xl6vkP1(XejT8CT6_sadmf@_hj7_RksbfaQ7d8zt;^$%CP-&Rb1&+0D?$ zC&ALy`Da!zR6g{n z2)4&U`l0M*aWi9H*)rfGeOj2q5g~Yrcs;mNi)bVBk(M!rs(W*s3^O!{lh?wS3Jpw3 zcaaoefDuiqXlNxbWD<|Z;-Zq!UR4Ssyc)M~2edW1aGVqjoQM~30t0GZ2ohld9${@E z1gRDwN|a@p8AT8TBQFQ$c77eM&OHwnoY<~27=Fk+h4`RXYqZ&)0kA}*#7Igd5kn`P zQdXoWPxn%XPBId0IC zGzpxC#R>f;;{oZQM9d!uj^6|y8=q?usGyPK52tdObzL1-xDUpiavL(7$p$9{OCZs! zj3a5BXP^a(5lpGI_GdYJv7j(gp+rPvV+eZrD#t`nFaD&!JLnl1LE~gyZdSh^cncI=7KHVOBA93-=(t6mP6+VgeY7zyZi_cAI;&~u zF_}o$?3)VZik}td@A?|=sC11&OOEaFR| z;yel|F_BB6pf4mdQCe1ph%eQdCJU@Gb253>_SUN*8S=p-7r`QIc+oIHQh_okWWT}W zIahyab*iGl1S3Nm$;{=@^Ctc^Lqjk>CXUTZgr6C&EEQ2XHkT7L#weV#U!H>LWuci% z&Xt+PT;30w{}tu7zlvZUk`k#epXT5?U{Ulw+3l zV1{-qQbz4qBA5x|UPT`3H+7igVkC0Wq7;Eny=dX&VM@o$^GbNJ5qBX(4O}vlLJ^|o z6!AkD%!;Q2f~8MPYr`m^4Q4xVwh09Jv&L>)TzfwO$SvX{EXzMs^_} z8O0Sq295)hF^GotPYgzE01jqEYF#Z?g(Pe6C2mzHXDXMWV2j%FJcaXI(lY zNF-V5OulIYiP_kvW9tq(1^3`V^&p_1HP1d>VT@mqg6HG{zS039+2U#3q2KM-NyqQX z5Cx||p0^C3YpcwM8Vu=`vPsO>^o`l->kGjVI7w9;_=9BA8(%pk7*bXn#e5v)VMt&) ze(>Vm5n?u1)}9Ii>GVPYaArB%pJTis_fbC3n8Mx``c`-vdV-rrWS>ZZ-k=mw!~u~n zfeHftM#u3w(y!J=S~g1|k)keB>Uogzpbh#p9(qTG)-W zA`WRr0WSY1o;@xuOfV-9-AJ5bSD3<>jqV#DlyC~0l*dXoV-<)V_DDK=d)pJ}qep1r z;#NEkEAT0zI??!Ijes7V`xM2x(Pn%oN+Ti|^R_Z&GY?*5$fWZ5p+cYuqq0X-({e=!Jn{{rl7YR>)z{*Tsb4=A;5)CW5pw}M| zDd)ts_)fJ;DsA!pLI@4hTN1%HmY?G^)4jx4HG#@kEF!G0+rW**vB0s18?ekLW-h!* z87GAVM+RPNB&E;lk5NYK*AULyvNv3t?(A2Y8s#94tGI1Nfi-fY-7#`o^XR&5JxMfw zHqM`27kt%Q|8x91gka_=3HacPd_EkIdSzLwCd%eL;Iu6aF$)WuuN{p`6`~cd?$VUzkgn*& zb&q#|p6*T)u%HSVBzWmC;CvBeWUnUWg=X0OUjT9-jo-k~`BSFfiAo+HiyV#^0+Ina zNPn*z;z)i-03k0=|7jP52gz6zfRG2|f=Hz4P?3x`cDyEixQSJ^Y48*j7CTMzeXjxN z3x+zpMD5bnyU;aY)LHuj4S~2L%C4yoo~s$rLPw3KCG@%(*xgfPY_o z8Ei^d6QK^{0gXml(uV~(eA2@i-rSm+&0)N6Gp!lxS2-v5sQ2SWKTMI*H0bnJ%<@(+ zkd_9X1R_5rt;DpftT6PVXAhVMjP*4nR%`#WwsiMmX3D-hnm;Q3fA9K<{-=^~jPT+w zSb(4Ce-%v?t*PJtR8dv?qyPVn>wmZOKLHJrDFBj@6r{cPGhXJx6dL#seC!EnBGYh9 z7zEnwnN0ybSuoY({+<<>-o+FRJ}rMAJdwDV(0o)9j`?IfPXEr=Ls^^1G1@?J)>iS1$A=LkT|L0%1eq;U9-}}K5=-*<)5`PJ_A6R!VQ|j7eK|CzPFh=e4xDS!=tax|UX-+m8XB={0V zJ#1&j{E)~bP$*OtfT}{FV1M`g>v2}?y`!(m{5@ngEjRjZf! zP{fKj)*awy8QNFQ%WjTp84DWt6#UL9k(1+#-k-`-8^{v+yw#U4UwYs(7(tGneG7a) zLLrUNevJd=Ws2hnATkGY$aJ8l-eiV4610_nC0c0aS%%COezqOd&VP{-D91^uzNkQm zB*w}k!Q~H?8AxiqrrS;p<-$9M9Q~tGRe1s{N7&146w>H4LCa6AHNK({fOC(M?2XyjaX1+C^4)hc0?j5& z&#A1IA@OGPyZrE|iK4V2R&U z@5@>m${y71%mT_xN#m_lLr87<$AD1co6@U@T=TYFY4`pbEq?|@IaGW0T_v&5UODE& zbYHfge`9El7)RgBm!~g)`O}mtN|{@<%;fd95QExnq5Z;+o+A#WfRUhKqpr!jZU!B= zANuFRbGJ{6{(l1*!DO)qj4<%7jUvn z?a#!>lz#^&OMlXTT~R8Q&GWU;T%Rc<5!lN-6FnPr*aJ>NuYHp`sGPm)v)-Zo2PP5d z`RtcpqQ5-)%%|}9>9funo_&Rlp(3^aWl1aP(49RXH66sS|a87YlrGK``JDsTH*D60IB6G|r(P7gn zI5UgQjA+OU*L>#}j2}+vjW6h7s(d>FlE^o$__7t>Dd{=Bi-*PI-{e_7|2ttOhrfl8 zb4VfvyDkQ8{-5VhOZR^tA0Iz|$p3UJPlx&6MCc%JZUrH~B0NtS3z<%VUrF)2N(@sj zVi~|D=YNn*{FDV**&yDct*}~PMlrhFl+(c&d1p;BYuP~^kzr$CGpsYm2loxOx?LOn zRTr5WWPz!9OZLzVZJG5)j?m}|5Mbfpp`8_DO!_y*9*h2Uqo5eOO`Rm4-D^I7?%JlS(>t3%4e6 z(G3MG9k*(`zV|HsgkucZ0*q6l)g`dKWGbvLjk3~#o~3hF>qyA%OKqNw?qF7E zMSr{CISX_-%ay4yIzdw$fjMRj=|x7EZB1>aMp{5ORu_A*Ev4 zY&w+S$eCDHXfPYDC>0H+19Lw03a!?_k@K?+GjL#}=5=fRcJpO<{VSBjI8-9i)PJ37 zi7M2)F^S4dXf%ro1)EJHBLcqU;FhhU0tUt2C?s7uSm(@PMV{&`q+;Bgn zdD}*)rF50ZTQx(=;nZ&Tb$)1fa_Kpu-djS1hB4DDeKqA*5W>9H4#-r8({hUarx^09 zEO1-1<+r%juY&g)#=Hev18*Heet$(UTQ=iuCpz$bO%uKe%7zBK1$)oUcXvANGR6uz z+YXKQ9S*lb7d9DZ?uyi9U^Ud+vSUV$-wvG3wdk*st2z2D9Cc^OI*z&T@A(neF8&`% zCUpD$pTW^dW&d~Z{NeoP?L2Gwf21J1dbxMCzkL^wk+J*Z0?PZ^>;=+DZ-3|q${X5| zE2v7^Zmu9xe=Dw_BCG~i&~gV(5k!Lnr`4TQ>Qu8k>AtywUO@pzkeBO6=Jjp4lHMX4 z+h27e>2Ix&&QdXboy&>?CzFc?2b6mKx>?M+xKdm!TFlh$elP8Pa9g;S4ly&2{RcS2 zbOm<|ZPIE6r`-)_ul9DjTz|r4_ujbDa&@n~aU6*ioN@WA)8>XVC07u7UEb$N_*t&d zE&ARJA`f1-RdtE&dEJy|HQI{7xB}kmcmoXBuiNWpI?;je>w4W9pls@OGhpwz*KK9r zOp}7VOW({^jhMzBw7F-T;k1T(W~Z*uW%kBb;xt>jkVzGbV($!z98Pr-GnY-dI264UHBFQmvV_=OgNK$% z-%1?VZ6ML|p4}(s#(MgFghCvlEVZ<`K?(tr4bx`hReBXfBak;Eu7RqB0hfw$@dumL!d$U0H?dTin4+;wr1_O(jKj_bZm- z+Wu^Bc5?~cai%LnZ2`6A`Oa-ES%1o_HD14BacS&Ri^w#HL{b{&t~@L&cP|~%9sIwl z=sJnuTF(DIJ^uEj9RK<4$wU61TY0>79Kcsn687HxxPSflPc38j#`UYvY4-Z6&zm`X zbql-k^;U@4$<3>4Z|LDI0$J|dZ4C7+0J%mB9we%4Q-r20ULW455}=kE?3KM_RbW4J z)B#?am+swx$2Tn^yGdMIrSr|swycY?A1(?;O(=SJoZzSuua?Afxh0!jp~W%T*l_0{ zF1Pis$$!tOFb6yHbS<4Fwid#bFF0G6DVL(WMgW6`w|Usstw(HW#8>C;dJd_27#mt^ zhUWLt4W-v6ojTqcXS(+*Q(Adx%o4XlyK8H@NAm*R%w}E3<=Oo;lKzdK4)&kBkae;G z+w#9YJ2@)H|2#W+_F(_r#vTW;$_!8 zs8_uvV=vq5HY$;SbYxWIhSmn#ZEcXXwu*|^q}k~UFKTI1*M;ik7bP};#F_VPFYB$` zcT;nriJ*2-QdpCT0fmXPSOp6>iwk+K^0Q$L26eu|G#b?P?K&4XAFiHY%iRCd*1j%g z`hRASiJ*Y>O*C(dub{{0tDU|pB*@$&1tY2JUG5bb4l+hJUqP?Cz2p-0<(f_=W%jb6 zrK7#QPmO))l~a_p4#~m=Q?6p<{CpTRw>xM`T4x1%>E`pSsJZ~b>7V0Cls!z8GCFR) z$GmmylwCUOUeS|}xTYh1s*S8;r!Rm&jDJW|q1OX@&Y{*`t_Sbij9ku}>SpM?vJL9q zRwsvpS;`7UCPq@GOcA7bigPAk9}XNMc?pm_=`ufxPO@i zBo>fF!8hC$jhy?=J4?U{CGN*jg*yE|n4)-wCxkMzl{Q-R|D&hJrTG8B)8l6k`#-nx z^uZ+*a;8$3d1|K1Wru)KisMMm;t33|;RNx(>w|Yw%mGi6gfhVapQ1QcArW8(ML5M| zasU{Lp}=#qZ07GFiM&1_XrhB?_kXmDzyvFT|Fs{0HzZyFN>ojW5=amOF(xSRf>&>U zdn*??uMf_Zl!Eu?Z$X3^_ksx)hw5LAz88%C#SYcK_QiB^DF3m4@;N!o0gYgIohHim z;og&g-z46XU<9wdCxMtH-jo0K`rtien5GKC zG(v}8k;|fP{9nC3d-db%U>0qujpgJ2>EPM(QvRR8x8EK=jQ?AC`rxI$7s`%?AMl7t zt>s*bgy)@skN-sRtoZuZJ$tj1Tqy!RRX0o>3Yy@MAI7@qZ$_y4vdq46g-#ev6FH@5 zK?5|F4xvm15d5< zbHq5NdQ)(F>_OzL{zV4TLW4wX~)I)B<)vxQcTK<}R@ zjw$#+Sse8=68%27AR@a6%=6SFtrd}k(K(I~2hh^oI`?G162v&Tnc{E?LP(?vq&&eY z4t|bengD`s3_r{jWJ($;{NJ~W1eierCx``}_p-pwLIY~X|M-16LNG~q4(-~!QS8tn z6QLxgi-z8S;MjASDsD*hp) z2~vh(gvVo~ly;879Me8H8;>!;0!utUOQhr~jw3`Q0T2W3^BKHCJY-l|iD2dDGkE~o`?jim_CAB58SyZqR6uBi0#3(b2tEUSQ7?c%z5w!*q3J@K zzqpQCpTW=#zWv9WH$CHK$*zrQGbK!942st;}wTfg%N9wuGOEq zao9f8HXTA;pSlKIMu!fK13AB&rF>ZIs^Pnw7X@T;ig)HM<-~36q4;gkj~y%}SM4)u1cKJ7CEL z6lk2r9DfzjTop^V{_e2EL>-1G60*$kC0N?}-3ZwgOE!XG1;q|nUcEd!2MlqVvJiDa zwiA{ii|UYE8O!slS8EWmvs@bgg;bbaR4tYq2$mu_Y9+c#V^zAwcYh!tC1*jJOc;z%9vrOqOXS>qA;1le zV}J-xRS0x#g!cr`5z&sq8>HT7kjkvlR#yNn#$cH5&}b1K+GS7gd|=a>m@;|;AOQ+N zWf`gWT-s@B7;20GRK`Y-YgFY1%6shggR{e)y&CL;q5@_{AH+Q!Ij z8Gk)%Kd$7etKqr+ZMmIr1G~^IbdWbyKa8TZS}Lp=Ggwgazdc#W8rL2!j8m@Hy@Yve3bewHzw0t#dSpF1* z-)PAr7+xcyoD1KX@C5*^qme4A^`Ev^PG=VR4RX$+D``%s*D+cBYS z0iY|?_iDM8Z<SS>nwcF@_^FY=7lmaRWq_KW9kK57v<)KQ6!@DU2n(BWX%1G^#e^ zYKCG0|PuDb4n)mBM{eNHg`W7HJ z=O}A*@NGz6g?!g&F$87unMk^8v{=2>jmVef5mRc}f|Eom+Jbo~IdlCOSq>T7!JIxHxI6STc8>AP8Ux3`gfH>=+E zw!bsUO{AX2g|w~eCrzh7jW6di|N84*-znSR&r#C!F44)Uwx!qIV}A{9ORCpBR)8Gj`+eNKX56{w|@b-fn@wffLSm&-)9?r2q)1;5&j($Ne#jxHG{ z0$`%2Q%rTpxr&vu`iVX&)>#%>lo;DP^Hw$D+n2@NpK>=!hk~@aD)PBt%;+rhcMJg? z{f95JIl}ZhwnBtm43l%GOa3lYFaeN^k74=`5uIcq@&W_ihG(U-$ap*@O2_NuUA9>?|BTGh@Bo_;>+mLxYC=6_?y97^Ze0MhO=Wh;%44%(CW zD0dtdX5*LxO3Xp}1x+;pQjY8;{>Eyun_8MoJDQJL_*Zu~&#*K9oZFeU!on*5oZCk3 zmW58@;9KEh3;#;_HnaVKZv0cZ?*7ixx2Cech!}E@LnBj3-d~93)%uSLTu7COt)BnxT zMS@NxKujhc08!4aQyXe!i#r*ObZ{-^Af_P{DDnV6pWrNs(J6>jtpHQca}IB}Gs3tKkSZals6N!LwlCM`(m0@drmfdv@Y^NgBtOG{#{o zu78Ty;{|{k{AE@#%ekqXqmR$x8@S+)0UqagNSZxX`5DFI1D!pSBcY04jDMoyk|BhEGqJaQ9&e1pR1fCb6QR+~2q%)9KD4XjoXzZM8tM!L98)=e6)^7kJutU?e4;;dl z2+#+L0t)HA+MIBj&1AM1M3jrIN`GI`(n~kfn~goPp=54nXA1-U8ZCZ=NrH)*HVUxJ z`z%R_hG`c2YqZciV09s>@*^fqNND`^e$7&1>wFyS^EG-gkzO3NsUFNNV;h+Fv<4E4gjY!1O%QTE&<#?qJIYEMAjBm zLT7p_IH8MNKn^l^^6k*28)R0rQvNnKs;r;j1ekDdy%519 zS-q-e;hO~hk)kY7O3sZx|8%zCjeh?bjGldqNSGy8|MJBvbUI4nyvIQhm{fL%%uloX zQ*F|j%d@v{KfJkm<>k8M+<)#Bo_el|sY$6WF&G!WEFqU0sF@`rYzh)A2L_h%UlyCZ zMvJ8_UOU+jS8dSlSsE|7YE{zD>$|Bj6CL;>Zv*j3&r=~K zoW^LAB*aHYx0{CeXs|{i;uSLyw_Y}}aY|yvn~SlWk;asTa^<8v+kYZ3chjoVo^sAo zr#cbRQyGjA6THASlW|E+#?qihT!7iaWENHF7)z{r(d!+QsQIGTQ!@X!RCL9BkL3m) z*`fZM1X0QX*__AH%f=o0lu#ys1Lnn}z3X&@LJ_OVHZQCSS>Oo_QFi7bmj>Wd@H?kO zqW7ZrXCUXiz>&i*J%2gDL5`k%3w%F9A&tR zdr;ZL@=-7dj)Ei4`}l@{pXeOTMu>sI$pJV%IzBouXaA3F+Cy*yIZy_Pw28);U_M1r zeq?Nd#WWqM6joA@O{TFv7f__!r(<7Ck#8~x?jHa##T?Aw?|+oJ`32N<5{S!g8+9gg zR)teYCWz}KQ94_f{GR8+G9ylz3xdiig0h5W@%?$?rZIvdWfD{r>7-7&t0!8YQc&cm zGzzea3dx!>Jpfp66py8e1zBXYjErQj-~14G-jgRERLGn`{01=uu*q14OqSs?5&qwk zC!XhnOB>2;UVn2<4x8Oe_g9@cDyk<#uxBO^MTXG=jHsCEO2?{uCzkdOAjw&s-c5DC z2=llKQ)k=)l*Ehu0DSx>VrY44Jev|viU3To>6DH|+E+Gk2#J)b2+XLWQf~Qb-;bp3 z&`q(SgT6c;{4A-Ubt03uYgoZ)ei9VW8pA&h`=+$7kbm=yl(%3b8+=z3CLOz;Xj|B7 z-cJ-^)!P3=W!TJ9u~BA%8{=dOM@ZmM4Jf7VPU(zJ5J8gjH*it#uG)lcPVzS?V&_s& zBgFLLr!y1eDGAgd!I>Co;kqzx2ct#X3yV1s#ix5v>@1Ac4pihD0n)0lROq+ zET=C>7JmS9o+7?_lUiRlqsYi94-tV3(=2U}W|RpJb!$fyaoN0`uJmXDqJ@o)2!-)4BC zS$x>fe)=g#eh4|@`(~7wPh_H*XZs*1n4d^t`Cgf$aT)94X*@^1MDAGqd*UaQ3qMCh^ZC$$w@OcHimQ{xx&-oNA5?q({MZ-N{5<)Z(#$?Q X56{DM51;=D00960u^{~K02&4Wiy0L? delta 53865 zcmV)UK(N2}$OMO{1CX$PfB(hvz5es(&;F%9*xP&g@?W6;5XcmtgmD!AOaI<&6+8EZ zJSYq)N1V`*4LblH;&?*i`4El}M8bBP!y#lnn+|^ z(C^$7){SX;(0$*1-|;c?ViIxr>TQHWU^Iz6ybH*`L7|6zxW;q$1_cQQ#%YYZaKeEw zpkt0hi18T5G4_E|KnxK0h$CP;PCTB(7#NOka14xu9u|-ocqjyqh8&Sllq2DU?ZOnX zDQ3G65XRXqFw7Z$pwI_KV~&0KyW5#kF)C&NCWKFuk==1UCOsZw+?yfBah!gVtF%Kr z(M*b^M&YD$jpw&C_T_9T*skcF9H)*e zM?ud03=!E?9Lu73hDb0p{l_u;ZwrYI=!ySUPh?ge`!Vr<{@ce)fSaM1ldwCE(+ar{ z9raFOrDjvM-7s*5N_^^F^nQ2H@yP@;J_I&Jd(U4CzaEV6zSqYizmL8i zeDi#7fA86UXm5Y-#n<@jy%*oS+%?z#sMd&(L0H zf!|N7Kk6Qnd@w0~# z0GrqU%fXBOesTRje?Hi(|HpW?;9D~J7KM{eXG$4=SId7yCLPp}Z8_!JA~5e4`?;d4MSO+p{|lrSMRjL9U4rLegxOG*fE zLt>twKnh#L!$Laq36qV%XbwIeqa@(6oe~ZJ0UF_e4dKI`{AtUx=G_Ewe2eA^Re*@b zd$<$fXvVYLxf^9!yLy3E2F9eK(y0CGjRq)t@L-l=Qc?1&2u-Jlw6AyNWJd*@2Y7DD`Qa1cB%T za6F5|#KE@YLq|Amz+1nklB(~(AZ#Af4p)mn-aYG7@d7X!K7$ibX7PP~KCN9c) z>RpcU@;DJZg$3vaAJQb`L)epl0DfX-6B6V`LL5Na7x6ZteitrNuB*2tSwLy%O3fE= z&GscVe*s&O0MIaNLhWz2giqxr#LSMFHjdBjT~1sbMH9Vfak9k&bL7zq*ir6}f0D$6(7% zHnUjQV4!)e#v|poHpkUa2-WX1URw=P2>^?@?aKT%ZD)DLt9xlP-#ypIBZ5MA(0Aj$ z!K;ZEubmsOlOLx&w0W}KplNRf-n=?@et7f^8p8v3Gq*W|$^_dPbJQ#Bvzac?D81`uBvmxvWZKVS+ zMkEltIITbUT73|5UJ&5mVjg;I2!oE1p!Z%pd-+Yr?Dzqig9Zw>QyhX9U=#{gA5tGP zI62ch?Jwe^P`U)m2Er97JRSx#jOE-IOnsU=-T-8i( z%c?Bj?3gZ^I%nebFt4%doibglMM{&55XXf2g_m3{$iiEHmUtd!>~b1oHl=~D7N%Op zNsO)c&!y6#`|zNc4OYO+OBkoK*SUdHdb|2^p2u8$lHyK@IAW}h3#4|AnLdLF$c*qJ zZ7kflJUWXK$+z_pgcLi{CQ^yoG-ZAR%J~>kpq${0STwF;@K4I#m;p~bBz2`Uy2WvS7roDe}KXfsk9{o#pmZBnihwk>oIf5x82K@2MTz#TpeipvZSe zx)~{7NIb%c%ct1&0)j*Cs=0DWWRHjeaj80EWW2A{K- z-U!7Dg>yjJ4rf`=;C4#9Da_DZh)>4or8OcCh2m|(q%p|=m4ah&aB?)lDG04VQWOn? z`I^Un$H2~$h&@nMCc=UhF|e>dIUAP604+>NnL18Fp;rs4pqXHkEmARAO6e=AQc;YL z-(&A^Cb*~Lm}ZP@%c+aae5ehA`Ery`aeP%S{as9dXT$Urz?k5`KgVPHoql_U_;i^4X$B*Q z9sK%R$CeP@phyj2ZZLE&3Y8DvSk;yE+`6tRuIi^;fM6wG{+QCFVHZys9MKsfAqe@r zYuO*v>mlf$-GF*1=yWv2YOZ4&(?lb;Q!IuT5S-fOfK6!<_+qtb%_T*>U|QB9F$P_K zaYlU{NIHt5VBXcTx6@oYntf+yKJ zG?Ok7Sf~LC8VxlPLg?7Fib}`=Sj2Ot_;E~Ul0zwGuApoeQ3W3}PC_M$3nX^BnIQ}X z0lhVwm=<^RN)uno%}E;1v_jT}|4V3pkYe1_Fo+!>{j5wtxo>hfx2aZJGh9eGi7{iR z7jF>vrmtXGpEyuN64!k=JRh44l_xx?H~&& zoCcW`cb*6xms4F#`X!C2AV|e*L}6|2(87?}%|*r3THpeT$oDZ#BFlmRt`u`ZrgsDV zHYdFr$rM~kuGmXr!sk-7BiO2cbc5qju|lHH-f~a{2P_txc(|K{QA}<~fG7IAOm)Dp z*o*~4)EDep;vv{R$M3nae5!Z)Rh4CT%;XSA5qqHKjm??IgVZ!E*Ja6OD|((XiY@pl z6#KehcWR53Rbhk$mylwMm@9o~7GgmxG43)tL+=F-vGz-KDkU+{l$q{-v!!a9aP^++ z4Ep_k-%;jmqn1_;%RLocGpOz4AUwNXzK$tMI=(~ zP~L*B>4!^0cT8f&-8hkd{g2YlJLXTv3>$t=n4~tQ1eR?w32BU(kP&YPO;|cSJDshx zv=&$7X|d_iHI|a26xex8@D29Www8^wYD1l@!y6LQP%fJr6ca%vtT5f*ksxD)0$Ch0!nks`lv5e0HxdYc4U!p#?F`>Hk`&~T zQd-VS_lnG}J3}FwVBdfjz7F@o*$jkTQeacs~flw6E>Urh) zkSzO)-oS*;qECx|lys+-Q?_2E!7-#{zp(>S)j0AU@lNKb^N-qV?MbtLt;h3u( zOl~UnPeZ&0-eLAlQkhmVM3wLK&+5WI;(4*ck9b~D=b)*L!-H}S@y7H=EY71Jl-mP? zZ4v^FeKnf;a7TO|A)ya@B%0z_83w_hp2<2Hcs;X40?+$@e{>WB92PA`#*U5RNg@`V zy@4I(bn^7H#8e4Lh_iaT%5I!f5l<<{@H>8wz260EjAG?JBB5z0nWt}ld#LC z&V97xI+b`?`@7yX)?QS*`nYN#?c|}r&1G1u5W#qb zS}Ax>X<0~G)2ANwT{ed)71c$Ljc^1)+@qoK_Bb?uWek5;o^Bim^PI<8ES9;TZg~zO zSZfG)7V){3N2;7a%BSuMg)IeGh!}M28hyYu=$bC-<_(6%Tk5;lKVAHA^sW8t;PvZH zk#IEovFJyTyRwPNtBQS^c_(@rxZujKPVXM zYEXZFaNB=Dce3sNRaXC^%^x%_ZOdz^5QTsOX}I7Rm^a0K65x0jaCg!LhjAKTJ4?9~ zA%8|fA@IbRX+6~tW=X(F6ks=PiCO+c>C02Khgs4Go1z%|5XDp)gEG?y3594!eTk!x zrfl02Y-`uf9euQzsvl~Bi5-K4U>1D_c31m<$7I&1vy-D&gJL7f7$G)=UW5{cGpLBk zv#u0jK`ZJbMv=5O{gci{M8aje60F4tcP+EVXbwo9RDswv)lsBqM9K>R4JSfGm?Ak4 z@>~AYtZR>>^zW1gIWn#~853ez)v=h^swHa^9kEac6ib6iGD`$A)|>~<@25G6$#(UB z(7EZP2uhKk&eWGv^I?VaUcIO{r@eo!)7~Np=yjupRg!@64blc!{UadPnt0+V^8)R_ z^=!|Lr#N_-d-+_wQ>EXEbtG2>85f46n^%yam!HdSg@2t~I8}$$%6!AU=z@CJTAj(f z%=O{wR?ToLf7;3c->NmWz(<(GID)r7I;;5v)QAPA)W^VZfIUuQ z#YZ>|us$a8w7qXZVuG|Q%4!I+L%#l0B zh$pc{wxY^~Mq>yc98s#9Zyd$m)ER<DWsK5kGW8bq*1**Ir>t66qs94B?Gs8 zi%RNv@Spapzgu;*hUK_URW--i)k{vBB^dbg5Y32Gk8TJfRC@#%cuAL7aTj2F672yE;oz4G(F+v%C>G%kdZu$vS~nC!6ZMaShTU zpfr0Ok=WYye~Nr*&EP_Vp3HX*2i6mPPUSTLU5ds)!y_DEj;*_YpxuSmSDtVh6BNjp z7+kD7d&}*O5F?(OeqxySwi3~z*j>$QhBMo`^=??jX{(sA1c)zmKZp6Ar8ACVF1IXQ zJRO&1=3DF@f~(6{Jf?v(-B>vHwj$GxIogkHY*H+S))Y%_eyN=_QaUblyxjGAIZ@gF z37@BnH?#T|K3I@{8r|VGzHaOCb;}<}T`2d6Oc2*+LqoF{b&V{HKxm9eZhq&M%`;Y?TgkZLwjaZfw+zjk?iN-LSk=w2M}M%(L?$+otw~oX>8~BGLsS`s{Z40 z8qt7G<}Q=%xn92~hjxShXM3JlgPMN5IZ@o4D1L?~ zib{w%$LT$!NA(D*#%9@*&2^mwelZS8RqBKfnNOJ#9od{|JkI_7vzX2>pW=kU@p~D6e=UX{yumysp1NbB{;UeqS`%Te zDyHXxsGcZ9!JHFMN9K32Mn!2sXflLB_eED}IhFA#mG<#hi-J~;RVlI3vj=7rA0h6K zk}orX-xA;?Nv7soDOwZ}ti45Z5NDTYz?)+4+P%he8Nv2PJl~zo--^ZhBUV9fvnpBh zrLky#Bi8rjgsy2;phXAqalqW-mIKHY4|XwY{-4#)>>ikt?00K?ucyvSjkQd*=0vpf?JC z=*V>MhP#}^Rvv6N!p&Sq~LUQB$whks7f^u3_A9$_ zL~lcjMDhD5)|r#8lIVkm^ve10Aq(5>!!LkaSnQbm)eFiX6twxZ`7$dSj#{5QCNPphV!;*;v@ zze!z8=pbqG424s-j=p}x^Wz)hSrMKr0xO_vA`oq>smG!o_OFE2aK$M{!Ag_=>+{)f zJMecX&-s9Tc5^;OVjGkFmKpgTcCPK#s-{~d1=JdJfEb78Fe72YjX~K8c2%#jwLdl} zxGffa5zXH7m-H|EiKW(m{MR{8G!yU!GY%+?sb(T+pPcO)2+}xqOBjX#qZPS&^4xkk7Feug+`98j1bpN!@+gZ)3%T*VOPb^D^X&X zHG`00LeqC3MPr_NP?~&I;Gl$4XIFV(6dGYAHhpFxV{4pxZ}Ow6?lb^)V4IH%4=ktsNkUT zv};PnT%Y5KErxlXGI5);Jb?xA8ElJz>UdFd54bZ79ZcB{y zD}!z*`Z+Q&R0T4skw`jzR;7iqTi& zIjRB~YOhiF=-LL!gSX$+R<{nsw@@S$UYCZ!+?8zus8`aRZmt~0;K+m#I{MZ=PT!Ty z*oXQkh%xf#hVzQ~V`77GRG`NT6{}LL*EHs%cyD}$BOH%uJToyZl?E-QNuGiGf_?rd z7@8ICa$6aHJ%I@wm&}y5iEb$I;TFZAC?n(PDUc^-11N0`sYkK2kyP&vZT1FxXZVZf z;A+V3A~y6NDB~A%X6IRah#g{U3(m5ot>Z-(;|#WUE>;4jbSh3mi|ThWY-6#hh9Jge zwAzN)RaSTDP!B#~aUux{Mu|VctzxFu`ATQNnCZ@cQTpmz3BGdm%t&}(^g!c0Jwxw* z3X%QxQ|AB7<$q<~6wgriAB=|UY@<2<>tL|AU(Ely-ydx9zdp+Ip#$JNQ4{YB!O^Fr zf&^Sm4m6(h)Sp|9P?a2^H;S?6}gAr$qO^NU0(83tNk!#Y? zyks|fA0aLsH0{yVU+;1Qp%w9}aj<4CKMp3N;)RwYn#ZGJ(&c;22XikQCcX}S9yKk& zsgogB`dsEA6lSNQJfPT{5{^Bd#Mnve-dUr6o8^eC!=8j3PjKv1V|k(7gjJHPc3rHP z{U!>?QGv0xm?5`H-F1q8<>^C>%u?i$MqAW5z}UUW#FCKf2D^Ys9-A{u!nVS@$4d=< z4RTOV$FPW&o7#ganzjd`RJfX~+q(=qIe>QsI%4FX#leRLj@d8?nKP^axzu>XIP@id zB|0o1eqn7XH0Ap@L=3^8?kjrlNa?ob`%fVei`w~~l;PJbL0GU1!Cs2`%-Wins#OWO zl?fG7VtI@<%}mA8fV!EH8AY@wQ0iULOc+HU)%Buc0j|Sm2~MUqgJl?*V$)0Vu~l~I z8vcCu=**Gjdc5I{8{TMte`ww)sc*x78rz_;jQH5~P@JC}0fSXRuO*mj4K3$?4!q3X z_)yzf!}z_`&Tb}}kimMX3zMhIhfV}H;V)Xu2ZgII?W-aosLa8NZZ^Oen;{SJ_ z)IR!Wf0X^#cnY!J>D$ZWi!Oi9*Vx7a`|ry^|5?fY+kd&S|31d^)mLz)99l>6qOVN$ zc{?Qm);<9!=0F&Xu)NbN11@2IAHMpk)A{hhm4QV}x~J~X>J&lg!QEV-ILG$Lap3OG z)D9_6E82P4WC>9Kg+6TCrE)1$%^~v+Y*&BJCI8$JU_0)5pAP(TaDIAn`n_^Q`Zhhh z6a(f|492VcScneV#$0t??#N3bQ*@&?!5L*-#;pkEdLQ-W{Mb3&lv9^~ah3|^@(`aU zT!kvjXXBGFu{T8_VY9Bn{JVifgax|!da*|V5h?d;#(bu8Bwb+cQ!P+}i$2vP}@KYS>ELof^^O%e!qcSfC2 zSIK04y3-4ldsilW6w^dPbvHpHI~2WG;27K$?dxkE-8Al!_`q(wu7zAK)wRH9Ok)`r zM+Kcq-Beho^PT?EyNwCQ)~8*NDKgVM(m9@XVJK9$WI`Vh+r65Ei$~48FawumBW7Z> zeANRva%e>*|cM zZWde(>JW#DuCvrbNp&7v3jbg<6l&iq=R?;=9H~K1GvD5SIq*?t!hEq0uIpou`gkYT z=SynRuBW%B@}i8Kh(Q<5lMqlLNpvcH2yze`hrG~!Xuf)Sif?fI6kHdFH>LT>{{~lil2x@MKbV0xY5%}=fdv>xKtdf=QuOPP zMsqcmGH0xRm1;H1&+jY3F+<=*?M9#{X1m8}Pj$2_fVUo&VUN!uyXHDDxW@C<5V)52 z=~r+6@L-kR>soT~f6}r}#+A&xaterZoi(y@!emrP*X4W;E@@Ag?*t4>KCRJ~GHt3} z<0@%XuB+}mw7GMn(9zP|JBuR#w3`Ok6^vz?+aDf(dP&c+0WU9bJ+k#Iyd4X8_u+#z z6rcS}wd7aUTxrI?*M&pP_%k6aWABHrPs$v;LeS2}s7cl~cO+%FKzF)$(!q^dOW)0N zj-W8Z>HOyF<##7RXaN(9UT~Nq+XUAYT(7{)L}`?j*Ni4@P6lYL5Xsj*HU$~`%Nd?j z%TQu}rJ*g0yDT?QS~~nf24IE$N%{W^>R!=Y^B0-evW~It{iLHVk6n<^!*FVsmDisX z$X&&HA}SMS^QpQa*+R*(cc6}mIjO=5<+KM?Ih$IyM!^t@icm_F>PHjKh_9{O+UzBS ztAy7GXKYwDd1ofhM(g+8T~1p&eS36#b#hjJP}5|5{FXvcUIQZ>&)Bd1-@1$=p0Fy@QY%q_|%da%Uq^CZQ( zxcPs+i!dY09NpxP02b5E>D$ZWA)Ih|-;bkf3<$>f*4#C(PN1T0K8r1!e_V3KI$(j3CmoZ;ZcYe^8di>LT$ZV6l*pZ|PvSg{IPx7k8oakBy+J_wOFme;Dc zN$BJEU{;HLvAavciC8Vr-;uP^l?0=v(z!EhC{LhSR|*nRVKyUelKRp~*E;BF!}HAK zitf8(8sDPWZ#Tp2#_P4^9CZf3VVz-r@Near9PGW6*=PoZdCb-O!e*~p5(vE@@zVj7 zkq347)k`#CYGCzdmoF+0-w?;D7rNl5KEmES_jro_A6HWxL^x($9tG=aquKxC+5XFy z&x`&aF9$C+{vVI=eE87&3U0`3D19f#B*4-|VJ3#fo8lpS)sqaQ_f_ZkeI#vvl=?2U zi4-ASM7kYa&ehT9498HM+ReVnIGQSQoMiWzu7PIw?G27&A(ejw9w(s(FP_Oi$?PH- zkI8#*+zgoDXs%*ZdF+(aN)#jvVjZncBD^i{(~ss>A*qY()FCg+WDQ0!3HcbDe`D^y z3Fc>aLjCL4w<>smj0mxAuJkxQ1P*8FrN``Ch z?a~Mq2`UFowY$thsQX({-#O+_&vv= z^y2Q_3`UrvLDQh7h>~!B(!Ks#-tfN}G!NOLVUj_Wp+H-Ij*E(*`ltregm*DTP4SG~_x_CyCC6{7U7TDwajw;TO2o~L#A-R?Pk$_9*b5cz|`3qaIEa4wPr6KutRLy4bvOx&SB=0D`6<>8p}$^_}rJT zF9d;_d$hSjBhmbKrsl`A?>!pvH1UnH>5GzLMCuHtP5ryZ^HzQQ5ziNO^G6M8wXXh% z=MUQ3!-JN86ME2QN)He2(bdC)2kq(659)RtTiDm5AI@aKO0%uN)}N{ZDZWK}W+T?E zAk{BRZA34gLYV81$n$hkSixxPdZ|kvsKTdpHtKw_u8KBl@t)MMyj?gawa%z_>Yz#N zt9e=q*U^7Ct$@^y+4q=hdeBGJ>P|;35!hEgDuxArzbA~7aH4ZFmaW;&qM|icaHn}7 z7ZXRRqk@qsADCF^1Na8}%Kgi}ZPH>a%pre{;T7(B7W!KK+5)u1z*W_%9K-xQoF(j+ z)(sn7xo$wp!1XomZ9I$kyeL29EA7~#N@K}(Ycp1QRV8@3gBteBNZvMvi?R2-$>z~hZL?< z=OejHKoTdUL!z0kbRcUyY_S5!JD-%8?Hl&@qGk!`f#|t`maTylC5!Kd9nE1UxJ`9K zMo+vL`1lXm!c9H794|;2&ap5%0iu+$44=h@zR;Bbn)YccJ7ier@!G*(`+z|kbl`X-xYQ0qc} zR&=f{Xb;<&XSLCoo!UcueLZKp@$CMiN-g^x34L(f_}x4I-=BPBQ?&Q|#n9Q261a{D zGlcW3L*QeMWum)n%lWxv#LfFuX9(Qg?WDn6LMkN z9(C$F4yu~0^##k14N{-msK(g+FKHNL4BPk*>6_S4Z6{Z+s6W^xRocsU&O66{DYaz_ zZSCMxs8x-qf=B|nKeud#^LaAMmHNI;UbzGU zYZ~^)C)y?ZxEiB8q_cMtrysr9aSq?U)@Wl@Zge@H{dV?;vEaz|}B&?Zi3_R=Y%Ckp<9k`SDC zp<@+wtq7WFSyLI(DSa3IeDM0G;|uut;PuJT!R5)@)8V^Nnv+eXk8=Ef7S9d*tb1yL ziqf%l%;iF%=ZrJ>@oNS*`X)iE>8TpNqJm$z(D0vw?%+k+`wTk;YA!V=Ta%a#iyh)B z-S!#v;gUu)pp!XV$Rc0^5J<@g9a%_C8p@G?zrO;3tcngS^wSxQF$nD~o+)!O;;W?7 zjHvH&jgqUd7P_24skcynIFb5bCLjn!HPzJ3UDj^rCnmGnmTx@sD3GJ-z_w33ZbIB! zCx?96<+RJESiJ(rQ~8P=cp^3OI`4@TaDnggd4x|`nlc8u3iARB;!$9}bajJJ+)*p4 zZ0kB7fz$s%vtXyXc3C;Dxc@sMlMxChy$Ry@7R|eJG`sgb;O6^(zx~0B{XyaW?~A>c z`#pSI#nFRA$=bD865WZJ*)tO9;Z##IQC*L;$YTg)1JKZ zT3JC~1x{;}+Y&o}2nwsvt*jhiV=#rOUHWDY6^LD7SRxg+@6_E zNfxwcRt=}kHWW)~D*O>h=nKthU)B3y#|ms{3xy%&DjJelSM;2Fk!nun2{c???k4T_57Sgk6OK)ND-Yc;)d1`*s%D$2jzX5! z5q+y9`N}X`_9@$^=3JX+9Zzxp_h>jKlNpL!m5+|CK?7{w|M#E2Eam@tvDyD0>9M!( z8?#FvN+NiJqKXZ=MR;IEIBhoZ91|^U=52QF_B-}}6vu?432xkJbs(hbJzNb#g}hV@ zPhRq|$VDWV(c|5a`nb!cL-;5g-ulWjI{q`Tgr#Q6svs)C0 z6#%jWJ#F=qr-vtJ>M{^vGHn7F*cQB49cvEst1&UyhhtjR&J;12&Ee#%1WiNg%bz;b zWwCmjF#A)C`~WkyaxNK#kP154zTJB?rwA5*enEt*W8kCH3wcKC`}*uOGI!3*r7TfG z(vn_fJf2^v9D`K^SCQG~{P^tk$)P+AxO(&U==haR`QBNX^xPXkeK}GFr%Z$kuuxKw zLSsxiw#7G}1x^J%I#gEKZk&V%>?ej}d8)R(xR{W1`HqT8D;r4|j>Ujy3V=7Iw;{NH z=Q_cf?dw%K2b1>#%cfy_G{a&b)2r`JULO~S$6T?wLdpAAzk7(olMfZu?tZTt&MX&( z4JJ31MP%L_TwETXuZmMu?P}BtB^P4oJgKG-2VT80IUvil+V7N7!F^&S_p;htBRd3NmhG~W& zVOKhD^VJ-)bfPX_UtArZ9(?=y_{b^jI%eCx5}U%64*vei$wCExSTY2#wZvq==p3)E z%c^0bMdu;|8$uS?A0D4yDhk%|f$fh!9{*4JO-BjN)jiN((-e>s%(aT=BHxdH-O*e| zXs$#}mAk+^-F0Y#W75gv@NNoX{=7@Wwr-L&O;K$ z7k_3zt(20lC2;W(=guyn-$kCU7#tG~sZIh|JJ$;-zGJpJ+6f zYF^&=MgCkir871uXMNsqi3-C&i+R2~~({|jJ$C>CXHn95^} z;yM{iVM}e`CS^5g%TTacwaDX%OaLvH@2*yfVmd;jU=A~kLZ%mx5bDK}lF3;F(aS}z zNFI<}9W=x+$J}a7tSNaJM)D4m!;1#KEXz0vf-bxbJ**m@N{=LFxQJe)a<$2X4?OX% zCCm`t;20RjW@VOo*o9wzL<2Mec_T+C9YH{E3!pibs-Y0sf;&FfZpd3p>*8P!@IC2s&xig}^%&avv6Dx`c!C?=N0$JFYx_binEB6c*zBzsnCi zVCJK}n#Fc=S6Nsre0NL)BX_EKM`g8ZJg=&iGL`DKP`04V8 ztHakP$ETMU)s?kK$z@<#XO5XJRWaJ7_$Ah`X8`@Ft3t0-_2cM=tFwdigEtqs?&J;> z%HBW4X-%~*Yu2h2yJk&AY1Ks*ll4Y^r(>%{i(lTAUt2pfuKl{5`vO*lz&Q1l@u{$ zV$KpYK9rfcU_ov!ETc}Dc2n6#(9ada+%hr)1k^(TxG`Mg`77tihr#f_7>dfn9i_V zh2Z?})>rS?S5H2OL4xjAlK08KHJW!0jFDj(cNG(Xd_Ol4(n9s*>AUc$^W?uB`1{|N z#mQ=EN*TW*Hhg9OdNOd}BTykCvH;i=4d5f7+iQ4#`a#8If3kP?)Pl1)qSzc!v^t{r z3=P>e>O;c{D&kqGOJwzJr6Lb!saADki$yg1-bShpOW|8;U;oDBg&b$0BAm)jW+)}I zSp&{#kp;+G5~f0Vo%mRSO3jNZj2TCqcqd1VV?CP_Un9J&Ijmq3Z!a!S58fO*JL|&R z&~dweQ#mDUJopjex(@!KA`MF8L=vl8s%G9~vR74|#_|`C5T0zq zz4`$k!ArPcG6QgZcnVM9BP1dD19tuce45)yB(gFOl*UO0ZO9=wgeT%3XQA;kwL>>p zLDy%flcTkYg)@g{t*J9ts=?-&hgLFv#+YG$E`7N*McKy8#~qAXoKoR}1sGSu@Wf;v z;Q-Aqut&p8b@FMb`lHC{BBdf(1CmIVaPF-jmyb=H0@W`%Epcjcc{)WM`hEodd7XNF z`UUVMTK_jkiWNtSs^(weMA3|P+U_SlRQ!zC&V5f8H>_uK@VGg6T<+izsw|~ht}~c_ z(U5Q&w@|QCj$%=nQ+#P{2Tmmk{gKc(nPnCh?1nw*=MF8w?X1;ur}!m6%!jliC*~o=Uglvq(s* z4Ex|>c-s5lLZ^EEQ~lwI_;V>eUCX_H+K9?$kps(W`W5;o!+$^@%EmQyY;h=4E8N}L z+T`iMn^smt(T1DTCr{2^Ws1AecLlg^rPeEL!eETT1Gsy-;}l3v+B_81r6v&g+uy(q z!Fh6Wwi4l`KNnNp$yp=Ywko(3D_^cc4_a_UwJsNd+y-2Kamu^c zWuQhNXzM#rEh#MHL{KS1Eaec;%I6^0OqKJ&`rQh0O}6(h$p5V3i3?6ptBP5Ns5On1 zk2jaIkh}I0Z6NmCsc9aGNbJcpy62H;)rFe!p+|j!lXaeX6z$h?@=N?Lck1zE+e5sj z;!fkShm$+^aEb>XD=Rl^ki3h3t|CR*`$KMm?*8nmjiuOpeuKNFKI$!V6^lxht+CFa zQfb-DNx83HmA2^O0(>-+digvnKUYrP0Ol;U5Grv_7lNY~LS-ql5S(lwR6{$^#Zn>} zBN9-tTg>MAZn|bsE85xDJwgi+&Gfvy!;kXbG1vAhHzN2PubEW@rmeYuX9l0q={(%? zzSV==wrY*n#^?Bp^*R1>y@@NZe|YcRHM{M?J)K?e<+l5wGH!VrSJ~R4tNF^-Bh#$u zRTOG;maT7RfwOF>)VjT8OL!H7Iaph=j==im?8vPzet(`D@@IPOyY0?gd-eH&EF>O|*bXtsw1 zBQ1+98t5XdCB|7*Z8glbMOPW+x)bHRnr)x!=4Qg_@mZv{#1RR7=y&D+AE)7JGBF^l0gScOT&bU7bf$vzJ!B<37C&T{Px6c4s6A2-EKTZ3d!LKma=su-@39 zicOl657+qHuGE%+a;bq7TM-&d5a7UN^UzzdKL*By1kpgRix;p#Ytb4mLtM0sA0+N_ zQT{Wu>I#xvlL)vd|I4%I#r!YNU+it-|31o7DgV`n=Wow{>^?6suu;NmB`2DQ@_ZiQ zAsi|WeR9?T@XX&sI8}ant#-R883lw*Pbojg$e$nhevBEzYzRC~a51R7OpM^_{b&7R{P+F+jsE{A&jZANS0wa#@&EOi0U{Dku7s*bLd@8e z3_+s~1>MrAV7>MEI})VLE_ayL<|wV?VVhMse0?HM7G9P7o%9f}h=vTmda`YJwidfx z2G8Kh0N&~MnQN7K1K>_oNS-NW9NrbXUvcUqD@E{sB!8S^LzI4I_HXSaRx#&1V21~X z*vz|Cs{#>}@adsCcd?NH&$=RzXga3ek^lSe=^d~bqa$qw65|=y(`Rd8wKhhUg z$qZZ(kit96;#^RtudhoQf3WT-zUg{Vc1&MQaHM ztz{Tk0n(cISjAobcNL4V?61}+24}ty;OJ0%xtONermhq=6Rf_X#byK9utqbQA}r;PjRw_1h9+pzrTF; zvY7vUFz9dW|BvxlmsZm2D4GV$j=WQU{-UF{zERFJS;0a+cp$}YZ^*fHKe@*9T~JZ$Vfbp%n3?li z%O6`nfV(@{o`#bfo67v{IP@b*Lar0ItAl3UW~V~9t3ii^9LF~(NH06--)*LUzgTy{ zy|!u~F_yDU!inWVm%bV*C?+z9M`tq{c6k)sn1lS#$FT$3;1iF7qw@+Z(Wc|6t7Q&6 z*|FS=Ufiow>h*cKYo!kl)4_84OLa5vV=zP9o4&S|Wa~xQVzEhB-Roq8;}CPqx`g&T zI*VwCLp}sYchIpJ%0(GH$yJPh6G)vi;c|Ba>h}LNx_>R)|M#Ai{J-{JKHu#BkMY#3 zbW0guyN6iDzCR-ef%WW{tylRX7TZ;wm223P=JbEiELc>dA>eeqWl&^Iuq}!^12pdL z&fxAkxC}P9yE`;KIE^#7yX)ZY?(Xi+;9S0Q-j8=9-s{NN(UrS)MceMmT(xpl@|vi@ zX&y^~u0*ZMLnU?}r^hmw?68{6&1i0wAMs@bL{U>W!RL(byr+EJCnJK=akzlQV*eFS z3{VV1ckrvQZxa_ejLY7pu}(4squ3$-_RcBnVt%SX{e1riI`Hxr`Jws(_A_9WEa~Rx z)vU(cD1J4@TWjWl??fOq{qC^TGvXB(_RJVvO)hh39S??e{`vaqJ@5)-hMCH?ef+99 zM`#Pk@*B9Yp%u1$Eq*-8Faha2dD3XH0w-WPpX5T$?xCF|{P zFRaZ^f_9qW&)4^l$mq9E97V$wiFqM11_iR(F<|-=`uLemfUMg2e`{*w#@PJyOP_TE zzT{tYoMK#f6gyP-ev4Acb1ojVqF)ax_t_F~Isb%0O8iAHH;gFgg!!jQa%H?-t&Q2e z{ucLt&P8)5K(uF78lZh{0iP=@K0P0862?S>fmimEpTq~WkxAIRIE_st9;}iP@bhV} zV@a}9pK5%=*l%^NK?4j86P^JxECr0W3{+ec-RM5!{1_$6$}Ey}#UrV{%pRGi;RgC* z9xqgeZ~X8m%c>7pA?O*SyH(S|2u*W71z)83rm^wq*GKiD#G8crJ|w9d(QLqhepV&{ z(3F{MPF~0x+jzh0t7?;{@Qn{(z-dk}b$-RhUk${VJ4XGV^+p*t1;^``MjBJm;w|&U z*~BdD#())kmi&#+qt+My&A89hh z3H;CwoV$DKED0Y!@!fj~Jma`e216j>R|#0w$I0Wy)B)|~=V?{SWaj|)u15wG(%mZ@ z^u+6@-{(qX;OCYeu)3@33;5fcc@>H_Toa_CC-`=?--U&8E*tYn6OnpwR6TNR#9^G1 zUNrF%_4w}kgs3sp-H83mAahZzWpiQC!l_+n-6kK!pi;=_dxk{X7Wu33kQ&e?kJi+3 zt7YyWh#)OqZ0|WMzS$$Nmv$2{)G)Rzr9*Ut#rwmPLnI(^s+GP&t-Gi&iDS}Z8fQBXSafzAo-ci zJ8TBTsdQ`F%Gu6ZOl@Td%~v3m+B5XE^~iC~uq@W>tO(_trjSVEU`4Ae{ydVoT-^B4 z2jzG6p8wPlhDps7CWRl3W{wdmPf19^49g)G#}-rU%C6QE@k?8N%^6vpx{Sp4Ddzg0 zLS&-p!9oxq_XWh79j@jUX?+A7%~0$&W_0N?40&3^2~nw$;gSsA>H`1X)7pntmFwSj zmk^w`pQ!bS?yKgj)`DJ2>lHN?{d9bP=j1*5PH(e!J389xFsFlR z&Ng9TIVD&HBTIiTU}z7)#lMva{+#KB;I^&3DOy&9AUG;z{nuLeaOzd4p$aK7xnmZ< z(Yc*W^=xSB_*~f9z75RAT;kbpwoCM@a5JQ9?O)X5p(8+FyDsDPnD}8`(>$Fi8`V7C z4*G}UOqw0X;(g^c5U4J5?wZxNUY&@*2*%w`%UNNjE#bo>B8?MuHEtnmo`wv|ZDBH&-T&eMxmT8(=;s;as06BtmiYNat)gJ+|&BgsZzynfCCnf! z5hhrR3%C>tV@Mw51DuX>?NmXtP4>tu9J7pCNrd^>Ri;^_5&c>)qhQs8FshYABlFAF zN@i=VP=d!`#l8nGnT4O1v+b-17j8zqDvFbL{}X`}48P~{xC*n-0KjYbM<*>;rm--_ zflQpLQ{58rOh#Y1Buam#SpyAdFsqq9K7>!>w7EC(V z;DGnGM9Q2tbp!j(5d;ac6C6-Ay-iX6dD3wBL+n~YLU1^k)#K)N}p34t#Fc%^L? zeY24WSQy9jloK0^*^kB?E14|gA$C;TQfp(ce?DcvZ7i*bTrez#S}BAP@f+xj^qhGy z1-hqBk$Gx1V_1xL=u!R|(N)n66EA93M&b2-|Cds=CI)jO2*g`<3Rw6sy01 zT#$yJri8B!gD2k(vwmB&sXGxpveeG}$43b3Ff(drNxz4%Zw_zmQ1ywC7-yBAV@144 zpg$L8Q2{(SiX^jGG`of#8h0r2il=y=8i>&oqzOX|wKM@C-#J>vytSeJ?HJwaI*UIcD7kCdm5hJp};!N zu?Ps*$N`Uu#Pt2AQOGlD(m_F0qAhdoEVRLW@V9IA7~4$@#6&`$(LmE$=}h#|TQU)| zkIFtFTjxoBq6}&HLMTa#=ih~Q&dBZGoV3@*i}3KdMn?c<^kOq{K0t7 zumtyUoTa+%$fzM_s zZ|MnWyR3>%%OqHxt&Bml)K}w1kT_Nu;NXxUTac!uf49HtfTd{NH#}VW8o=hqYCfhE z2nrwQUYHT7R?7+WNA}jA7jwo?Tk6_ft*6940~m^6joN{Wc7+!?F*~_0<%9^Z3g}Ek z{wzgM=gwqWCoQRCwW{+H1N!m@e~cYX$^A`?ii`wVq*t^d11?N&LY)3SicZx>stxGs zK~fS-$r@eyVyO5_t9Z+!&`EbLs(5zM(#3SzGFpJ#=uw^7i0oh0{?Mn2Jx#ZxU|mJ5 zRd)VI{vflrW}0z3u$_8i@!VaooJiB&zfq1gp1jKU{9bi)(rfxQ`)k{rNZmR+$J$zDQua2@)%~1DDJHB zh2a$EoWv!m&MZrt8;BT7RFK1MLWN(b5fix!=BfRjP&dyI-Lm3{VG~ibn#*V-TQCcJ zAVw#n)ZrNL6|}ybYE88#T_GcVYWz?{ZnEDbI$XCv~lY2 zK%?kRJ8Vhe;*IgoxV7Vjl=zeAXw?y0gC?%)Yk4>@?w2cM2l773MP4wLmwwzxly{u< z)+$XQ3N1;JBAF32Z+$L%bv5XP`-LFKf_K~-)T!a;BT$15sOlaXYn`FXO z0;ogrDFAHx{K|$O3TZmyK8bcpSunBCgBp_%m+V}uRHR&d*JUC*f+940 z9eP9z1i$FzUgBBLZ2IX77`|Xcqb|%bJJA_i(U}AIeB1WsQG|41mj~n58pq>NTbtf# zMkKLfOOH|-mzWDqZJjMkzJ5S&#LhMyT{Vz%3NR_#vpuSQ70@%=vxHaPD9|5m6!j*C zhX5ZD%)j&;2IIokMT2F@4wJmyNF0};F70|5&6*Ti2P?W@TGK-^IW6lynuUzdrlbBbqbjDrKuf7OTc1nd|0*^FITAq_Mt4 z4!n+Wxw<%bI=H&jdHi0Ckco`6;&GkAsanEUsKLAJfI!gxDT}XDYlNWTr_WJl@XNSx z#X5psGh$^4Uw0b9%INeVV()Bcmu28Vh z2med#E~TEzZ~Cd#9@$SJNtG1=^y}Zf49RP}??PNd87qRH!t<~;vpLvdd3_u%EsV-3HyE>B?ZC3k{#K&0NTbji9YGto@0M4-%%G2RSOv#dw&}+{q`~2 zh|$Q^eT4VQp8Q0BfMO9p)p(cF^z0KWNKfwjtr4^Gp=iW4{Zw^bd*xh5`BirDN3$r% zU$WkeC`FPll=iuMapKercxgUb653M7nvb{cJC3`6dSyOc68h{(VN?@b>>XoMxN6^B z(Z{e1b(WPZ0{If)oIc-JpT*J0glLG|?pjgSxC(FW{{g+U;LB(gJ)Nwp4UTJUe+eB@ zh&J#PI9I~mtDZ2!Lim7S(l_3qMwO5AT_GRO)hVEoC4V5g#le^fSkZ0k>1-$)hIkQL zv@KiISMi7JiFq1t*@Ud3ElkA_dcDB|csZ_R2bm;ICT>c?P` zBh@j+_NifD$|eEE%5608yD+6B`BZ5iI%}=w+_q@JU|E+&XEgIPk43EfA|mM;>-gTT zrZgXa^S-7eWtx=&{YMY$xHZyCC+@Z)vqF|Qh6S!hdM&B3X!SZ4qcdk5D=d*&A$pbo3vBjM+gTTdO4D~w3QLgf! zu;tI%G5sU%Ns*N+7qf&+)GMwsg-t@-l4T>DJ`>3f9v-wzFiKJ9b*M2|gF3wgIQ*|teiT4Y{~o1O(W9$W2~RBFpiUSjqab378>SO@F5gEhjrk;)1FI&# z`vM^LKY=*>`26(!K);WQPaE{lXV$FVyjZE>v$96|=V-#Ml}!{ER4J7INx{QQ)77VS zf+Api6@rp(gWp!jgok8EI4^rkq-G73R|OK)M}7oAok2u|H9XgmzP+&jHg74SEuZ## z(V=Gk-d(Loeu_^oM{$Ze?ox|S5Ni?_ydx?Pt7g&wT#a;mfbqo%sZ-h2|(G*M(=lyGr%f%joZv)&|v(GPz`mWD7F)Bn+wJcl~N<{ zCX|cdpW=hs9Z=v^dg8;k*&q6?>+{w#?(;unvuo!IsY|SaS{duKqoy$fV}C2aG`9~k z`6%AK!Cb0zGH#=x)qk#&uzipi(Z_poop?c+o_GNWb5wu6e~cM@Om+AH?Q68Y25Eq! zsM|;+P+PqqVnR&hF?ddJ4wc8F0pc%HAd1g`$S%xhU(iSbrA zsT~^Y+dUOwA|->oa@3U3sUb&(Y~Tc3?y2)afZO-f-*8c@&B`ReinX{diMY_XQjR!>SRgPvBWwr4D@*A}hp@a-H)e+a)dBi$lqhgheW zvO)ts-sUPgY5&=XR&UbZTUFmbj|~?# zv}3)G^c7<&;&YNJb}>Z0Qth97S&D_?Mlk=E`Lf8EqTjmw|J!`j^Z#5zYa^P~+Xwv3 zZ%f?Lkom0%UaIx~%U()*<2VOD|K2PDpj<@Wvd!PknImqt9<%Isf&8PYj<@bzPs9Vu z!s#`{O~V=!^J=){7k@QYtXRqQJ2CFar}FXBbuof1z+uLMUrM$R*ja8?2)ZrSY{W#4 zI3zxrfi%Lozm07_2d@sGBeqp6IWd2Oc?u^T&`xFZsKu zA4v5*ijI06iPo8zwqI0hb*Dz)H(dxHr3j;Eroi^_s{NP?^N6#4jggZ0dBbm~d>NIQ z?-AI->(CIuURCuK#sJmqH`yC>suIsM^@?mqfQMLY%zRK|cm)v?cZK|4v5aP&W$3;4 zSODTd*MG}KDa`-$?Do5cJR;u8Nj3$7UH<(9osF|#i8sQGR250y6*ZTv91OHk!IevU zNO;JL>Y1)!9<-BHJmziEX|{}h&y9mfPJCXS|Gdua1?*KZePXOtTyxma!>R}J+R~x` z8!L2KqL$y;NwnP;+BK)w$hIXmIGHsrJbm9`u@JaKxApgEM}Zn99gU5(G@pH&cOoKR z1%RE+U0(s#p4Q+U@&B^CCw<*j&Sn$Nf8d2yr}>B=aEPB=_|KkEKpdHE`{xVusgvby zj4G%~J1LiGGc}6%G&z;1_QYfcno*ppMdm3;!5i3<-%ADZm3_)Gv63@U3;!{x_^EXL z4#H7n`Ca9ot325YV@XqrYLywR)=fJt22+SgYo4#X|NTlii;)`}<2sum{KN10P{?~% zpBrPW|NK=j>hQX<^5HHn?i&w)F)kV5P`C84A$UT-Z_&LghS4~O zUN@j<+xFF3e88*H59&qCIr&JR{HpHMQYo772i0$3NoH2j$xuT-!nIN5iCv$4U? ztxtMyNY*UW!CG-LcULoLu};+WLsizf(B+w*^f3Ns#TYgi4_Zv;UgI z3|@S$b*sL(P~Aq9`NzAri0(gK39$N>a*kia8x&abBgu-QM5;nJP!X9iiCmN}I6&o5 z+}MK#5k_1DoBt6cjt+TVdMI^|Ha3OX0wX47h%j54kiM#X*U#%t!ZU?HxYbg zdDygQaU79)`hQ}~sv?!Q*k|tB$xs1h^UrYDk{sET;MB_g2UxuECn|VDq?OXq06RLj9UX>wM-t=I zIjEvQD72_yaV*2sqako6X>NFy^}%4{FdBFso9_<_Gm{F)-|UelHPm6&EPtxmYWxz2 z?d#G&doQGF*=icG$%9`48FC>|^C_v$D2Zc&$v;a7J2CS`*0yT_2jGS(<{U}a^bMv7 z&)>a=)akFa+@~+xb-7=0^HMiab7SE}q~s&E_XGD6riUC!R?y*xSY@HfI~+#|7j5Ly zDD`Gt&XQ7k_VME76yDf%YNNd0yqmZ_1sN{hFE|})y(Xf64nS)z0P@Sk79DW1irTE0 z$je`Y!)05^+*px-U88WLno7O)YdXp=#;`caDnaqD6shO*Us}dyV;oAgD1LzQo5T*) z2^U`A@9NH0ikYAK$U7W{1mZ)k)ql*|y2g~z1vR^@vVzrjC)#49r%Deme6-fg446K{=A!ncU}?(StC740TF*2Au0bmEq?aa|40=^`F zND>Rq&7Ky3$E=={ET@`e{YSUMT00Ow?N(ZFD?I5dRxaJLAIvFBUmXCqXzC-#n}NE? zS*`fj+PWI2VlSvIR?R3`laRD$eqhxSq%AoGT z>$K?&u%l3^oo|FP2$)SKUWZHO9 zc=x<2d;l3Y@3t5D$?BR$nCy^D+EY%G!5_*Y%KdH~WEgN~gMy3*pv|m+7=Q*zpHvNt zPE-IxiMKM}?qZjytMz=e;b|G9_rra)cl)&z;*DMMJ6^wD`P5*wr&ktBPo4|3W+KVV z>BqdWUjI1aptDg!M0O8HE9pR@vtPc2@0o&Km~2k6Qfd?D99 zW3-PT;*m)&S+YM><1e|te8POZ`M?`1r=jpGF-{yj07I%iYj^t*i8N&Z z$&U|2Go%>Iv{y|OZLa-5*2;p+Ij!Z+Lf1$m!|kT&zqO64Q~LU->OXP*(0==d(FSD5 z0;_wdriqkf=r|mqjL^4zF2}!x5TvNSSj1;G?K2nSRSt$i7V~=-4YA?;=K&PUx;qvr zo5Kd6SmhgKz#L!m6G>QLtddSO?rbOri~DEcR5R-xtn^!Xb&^s8OhTX`hq~uzA)n651i&@Ag;$rb{g~`Oj1;EGkfnJZ-4`X-g!Q zgGZqKIi~NdY%RdGpDhVB@hh%;^dK#n15^{=&QOrbqp)mgsB#al=n2nuX$#Svwjjw{ zZX({1Y~D*$@5Q_62Lw8$QHyQ9uPi^gfKdR5*tkYS7iY`7#5PA`uMSb!1xFK1GLr#- z!q!|{QpdQ!@Azl|Qv|V86qCR9T^EL34;x16Nfj^C@%@(+ky)TJBl{~w>tvCxd#qC32T4=~^Z{p-Ya{u9|dHJt=-Ei(rD z)>$+`h7(fXmJt{g7)EvXsbIt;PGZWg)|&87HMwRLL`VellYxiVYn6VHeiQ$F6S-<4-iSL+b2V8uZt!rjiS80TkB{YcL*aB+AckOxv};q=hAS zv1SyLKZ6x;;aZ~pC8^+l6$>j#8ES}O>Uz6%2B>wij5#leRtO;efETCyeId5{-4K!* zwO`@ECw)@_4^U1f$w;AH>S8}E6JDDLWcz&zk?8f^)dnekKN-a*;1OlPgl~EU5Ucg0 zpcA3lc7zZ>^n$nGQQKy|2BIlIwclrz`!g8CN{bpc`i!#*Ya)=cdvLb$O$dz|9M;%C zI>e)+|HE08*-ZUq*+9#hUneNoOnB3bREN%8w-NHmBnsYf|Jctt5H8XFeCtF zqgL-^mwR)iMTG91;4-v*Emy@j7LaKu}1HdG2)ZNIn)^J8ckWo_g+>t%aTTS&77g@!;>klaa1_&-VA__Vt# zw0W|@Lo1H-t4=O1VlqZiRH-8thY~d(6RGFBW^X0!D~|2_aQo#gg;#|G8ERZ+aq7;@ z`~w2G&kWpCDrEcaC&lOe73Tl|>~h7$AcI0*8v{~iM9GLlo(-HG_E*Nq4U!x5^k!H|G(d{YhnBFh9Ee*$3!L6=7%DI9*SjM@QDT*mH z5Gg9C5#smu(tCiXRs=j`PdH=u3j`}~`4f}pL@piTM}Z3J85^zGicbmYj9lF?rX0gN zFp?CF`g{QPFmv+F?F0QvjVX;Jo=pvv7EP{zU8X+O;14=r+-w}hVzig1m1dO6bh~Xk zIS_HcN&!tQmvMybz)RTId{h8gA*?IP5@O-t9<zlV)9N7(2eOp{Gr@8#x6-uy0rbZZ!DYH&*#JUA81=h zQLpoy33Gw|C7f7vmD8!|kHWOk;SU-7UJ@fH2*c)v!y>JYPv41TEDDNIJ%%U`x|kKD z@TGP0rev-|z@7w)$gfF8L9Tsc_kNXAtWk?ci(UCP$l1d0pC@~El|^%*;-g~8zy{SL zvH|w3<|W%LPX4AKbQPPZzy?#=1bnBwPU^ryOH_G56loi=X2y2fyLu4i*!t5#sy0ME zS}tkuXF*h|!eaVV(NuCpKzVRLV;E%HdwQOoM*2ViCg}_v(m7%@B)uq^UExsq0Q~&s z2BU&aUI)F1=w{JaV_G9@OBJjT-L}4iksWj;h@&uJMejaDmm6^LM(y@3mQgHE z-eNm%xtk2b4Hxh4!PibP*ATlYo3j=wZZZs_y&soMhINF}6^R+9x$BNzAI>QC1?;AF zEge2<>89o)(!o8Lk*TOh@WhOK9R(Rb1U@!#Y`C4G(TWIdDDUA1kf{oE(f@`) zN-7cIA3CKaeS|%}XBs_#9FRR67VX(PYT!>XS{Ib~+!j27j4Qa(Evkzco=OS+@5~@) z=q*kkT~I-*V7GgazlT@QJrZ5#w>aK7&eW`=(mF_=QZ=($mlHME{A8nBc*^P(go+zn z*`7}IV09XphXrtw)#}v<4z_B{Ic#+xJd3Up6dt-U#-slwtT2?%9J57KhQYOD}&TC9;BmVvt>qs3g)WwY9%!@+*jH^n_2&) z=8}}dmg2FDM7{yl3&SWqi5U!2I2ISszIH8c=Z)t*Gpcuzvjra+LKDt?Q=N za>2bhI|dD}L3d2Gvdek8Ga4R*5>(Fp5Q7M0*7&h|Z))Z!DqV3XSi25{@Y<*?^-=u{ zC!<(xQS<@+`9PPDZg9r4IO3>rZeLcqq!G=_oD- zUx4^^>Zu|{NL^LbyO%A z`(}qu>s})K^%3;xYQvLZQD`8#Xo*u_GEJNE0hX=oG%CL~(%5+UB_U&{HqiwG7+bGc zyslq`{=wN0upnaeCtclI=Xui6Xbq%!XtvO+(W!%TtYu61Uq3fvdVSnf{MFGj5@7B4 z#OYW=5;=v2bA4G0pX|mue9Q9aMr~TU`txN8Y~N%xXstWk_WAe&`YL8&y+UxS&Dc4j zB`tj+#mBwk(9E^XeP~s)F=_7WiUl(G^UL)L&WBRvw6vs%HHIp?gmO|hV&>Lo##U{a z6z2LOIZVKqT&vF?j$c+JwG9Phz!a^yLWJ-G%3q!1X-pj4|M~te7cxjwbM|1Y;v|o| zJPF}XLtWBUXXwBp=}hnMJc*D%KCq!h(%N>=NQ%}-!Pht;KRU-{snn$zm`&=~GM8mY z6E3o2zPyY1=*{0^Dus<2^Dyz%EB(Rk^DPG4&hvofn3c;a3lX+`CU<3+Ecr>YKPz+^ z^V}|Uyqf~i%afk93MUn-Mp_@tH_9YTr7M&U%@25m+Q5fe)gvR^hh$4pyT*0Hw3|C* zPxB=3HrnKVHDv0zG>YeXwp;Z3E(S5=@H&_96KmEOXVTi<+YIPQRUSnp+O@Y z4lX1?oY|@ z(T*(r^v27JTg>2z8EiEk z2I5VrgVacJ*DFvl!bthaTD#;In|8g1Yd$BiNYLhjLrD>t596BK{f5qLIE}&!{`eAKNn- z%35qK#3!>N$?{9BWD)9soQr5mfm(y5gqE$mT{MS{o9*m$c_sCarm;zb?PIUaM9B(;Wg`*f;nE`#0q{fe5Z z>i?XSW9WB>inaZks>2TtD-eFu%>%>Em1ni&h+*i;&ay=B5& zhu;jGT9273JsRTT<*^76`nff zB&p@*b>ONED2H&?S#47n9qStZ>x3Ns^~8F2lz!v<0}HsaxKS%>;mK3g4v*B^H8{H6^cxa&Rb2lP&-PFbrgR6 z{nUsDaR3jUq|fXA>wUe~mH_;?dD&lxTu_i9q`*qHs2Sv6^P~(tm_o+Qiq^lo=Qngx zr|-^#2jHaDE^GLqeP_m*f+zYhgbE#CNO)@@EUJiyh5%3Der+>B>>L7C5}lWA6Zx!R zoWmLI@|9Z5f|W2z2-)INHG_o@sO=Jn1u6?%R7(&ZRYh86`W;JW@34SU+u5? z_y2YP+y?{gHE}0Gp(yrW;v(;jWbC>2lSXV|OtV7;NYkS{kN4hL&qw~nXc}u<3+c4; zY13O{?e=F%MA;qx!U%%Em(AVjap(x1anUMNPwa+ZK#Hh9;bC_FUm$Ok@A!T(zjSFZ zJO+yv_n~MTm?UIOD<@6W@cJ*jFB1p+;&#u@xZ}%#Q9%~W> zp7PW4_LLGA7T}|r1~81lEl};xYn9}ws#QacmAp+nk!9ZZ!V`Yb?`DkdsYzUznZYd& z*x<ZpYK^Lq|LV^%l%%8ai)4SNOsh^ zu{j1AgV=qy8#p$)wCcy|nDxCOyKJTQ+*vSVwCV(5Syos$z)B3#0b__KgS8t`w>)}i zm0cYV+>d-78E(bGbLyV3X0JZ^Z{B7rZ{p|#vl|R zM>!V-RZ0<};Zi`m^;bx9LR|ht)2lpj{DNeeFUN#4wgYQQKl1v~yhU_Cx{*MVX+}<~ zrZux6uu=58kjc9aS<+^TM2!;f&IG2o`@-e%F|kzw)@m5N;4qfiCwZ0x<91Hq_JfhC zm#j+{RKLO?w*94e3!V15j$RdrGR_E$t-p|eZcMn<5uER%%X`6-KRq&Po7prg()rg zaV|!pg8lCXBSkAH(`sJfC{vl6Jp)}pD5n?o$fPQxC67t;*CNKT?Do+?nzKtBPKCHk zID<^J@Lw+{V{h2Uce_87NT!TH6}hu?^Uvbf?8{HQvWsHJ42Kc!Vc_q;GkTFVpDlolF(-^3y55KX>FN;D%Ma(#0( zOevy|4VGIV2gjMo<|UTiK-3I()6u`sGSeM-^rP=T(-Vcm~;^=?`64H0mGy z_q;}ex#*t#m_o)pg4wq~nk18W%6-h}<6z3FUS9ka)cl4KTlslNg3|qrWlrs?kT~d!pehu9!iiNNQ3x!7=04Vy1RYjN*`z;!5Q3P;jGy;2OIu6` zL=K}pkWTJ72epy6CfR-=zu;4uY6!uL4NW5+*F! zQdsIODxun)XQ)*!Q>2dc^@MwoFJ#V+XH51xDoWBJhlLw0^c2L3Q%NjR1e5h$WS z#la{E+DIN}iwh+C3gW&m@I_~AoMec1+Mrp|(dft-{=8L-ul(*|g4>eh3-5_3jvp%( z_`AZGvL2kxy6cG)4!09(lQE3S0?kJwBN5VIL0ku;#Lawgmf~8LSp+ZfHOPyE#}Kn1 zVh;H4HgC@J>lhfu5b9itD(h-AOWYkH!q;%1m*{Nx$&wVj8x}W%)~~5K?Jc}V4jEUo zvz8|mSEDv-Q_n?;@5Df1_e$Bah**bep5ww`FBlT*DJo?tp{=kB+6zK7-BU7RJ0)9$ zQt{t~U(D?k{SF3gH2!HrAYip2)Yf0h@bEwH9m~h}>kFUH( znrmD}+2pdOwpzf2y3wt*r35tuH-Fdvv;F)FG`OL8VL6rN5)hJC3{IKW+)@Ns%X+GV z@ZfQXKSHppDT+%P0D6F^TgOfMeTpNqNh@HK5pRSxrfjFeYj!>;*2|;z!RIpI7U$)- z^sA_ykbY#-2aD+MzKx9mB{bYUh>;=P-11pZkU8E}SPp-0+ zky7Y_$OywaBIHQQ%#T~b($f~v3Udyq&&vEMwJ!p5EsCp9AfuCHhb1cb$5#=K3X#DhshJ)EXE~w!Iw8m}cL)MfX9Q zG+|ywWgkxb53%^gLCMSnf!s?JMx|#r!7VT>Q!oFeYNuj{@&_{=M)1!uI6?L({|dO$ z9~k`KNx`Xh7F1OwO=xiW_JLlE+Vk$OL!ZiEr%E)|dBGH~pjK`z)&@$WzW&m}?b=0z zfZ-|U-x0bj5Z99@4CjfVAOqF+VIXg}DT7jTJDG?t;xs7Vc@^{w#0o%hA6TF_&&@%@9C7YWmbfw{yH25c%$TG15XSYPo9IE z1!W3=v*AcqlKWb>UhHA~fqg%`if#f1SW?|iSa(WhwG*R6G4QR?d!MM~y=P8JANWeR zPM8CH5|eobZp)XN4o{|M)7e6G7~OX4B$uE4VdK9@p$ezvA?Zi<~xTN3;SO9+l=+alzRzWLZ}nQr0fuza-IYpdFGi} z0vSjaPoM-6ifrO=?)zumxVh%3uIAWH(kP>j;Zo#H@hXbzThU`WuL}?&NS7r&Yeh$n z5ej23WiCF$OPZm99uyk(i+nS#?qq$zkI zFiY!LCoRb$;y5b798aDlS>(jr?_KqY6A;Hqqzs*=bBW9`_le{1E0!dI&&0C_osV#n zc4-{^f_A^|fOLPa`rSi(e;Gu+d~?oy{c6TiDkt6@kdGbh!PAu&wfqpKha+|2*H5aM zyk?3`a+PCuK;Gv+s2_oklD~Ay?n2#^2BDfx;k`4id)xEbRWHiIuv_@;_u{8run)>5 z=zC%oM1jvnr7q1%XLGZF@+U|(z;CZ+Z3spA<2g;Iva5gIEK2KUUH~e*|zN z_^I>h0dXAIp=Xu-=@hRWbE{aWIFJxF7mxM5I#}{t;Fm?Jgr+-7gjbTmZV1la9(m1D zDOllF!fk)3)T0sppxt2Wwd{v_j-B^Zw*dMQW)oN!O-UfB>5N6nP0f-B3S$GCxUlL# zO2wt1(;FR|;MS(NtnKNROAUZhgD2F*RjO?NFI170l^deCp3z)~T6BNpx|OQ+FhH0BB9GBZ2y2MxnN(0-{C#OkiltY`2}b!>fLT(!DV+8MEwx3=Wp-7fa-OhMX(=F`pLPN0 zXxD!Vi}9_ZpR&OgT1r7I4(U8s?(r;*v$TV*g47POSIFzC$(OJ~t^W1JE4%C|tO6Bq zp!YHGMdhS5U*v(vMHSyn&*$7Pbe?i78VdA6e8>EJtdiRbSXix{hL*+%^-Sj- z9V*ML#vYnBwo&>Yt)v387Ylvcx*}Mrh*f`KadnD}I!K}d0|pxqJwyB3B5bVB)!bC? znvlIqcqRqyDd%wJIzI%FU-4Wcbi}iiOeLSiiO*<=7%8~{9ubx#JP{;eAz)_8iE_vK z|Nfu{H#6|$%dpN3Taa;m2_yVUk#QRWtwAsxaN%b8Vz(F6p15_LQ98VGoia>vG zR8W%gTP2^S+?Y}S#gp6->qNaky@K|-QWDHQxG7!r-DCF=alRv0$5MnlAVK6SyNl*S zAxkx(Q74EzK8tAz&cCCC(M#nqDf^QWiTra$ql|`7@PJ3!`{^Ag{l4s9d6y{lyfQo< zs_EMyiQ0?+`yFv~^<9Tgm?he6%C z8mp{Qa>uS{?J07(ptxirgE+&4DC4NSLJ*r`8K3j!ff=28Anhl z#VZT68NN6M8fCNyr%Xzy_0)gGmcW6tW_!^jeMlm%P9!>xfePNwvE>`N$Zu+~rQ`;n zFs9)8ozjT`x3R*Y!zL(juF3GK?|yJUXm3gbCn3qj+%f}rVTM#h8Fk=#0;A6Z@Q1^5 zlnJJYuTRBv#A)KMWZfy)<^Z#UQE!saF^%XSxlvAOy382vzXXpCDGbeb#wF$%$oFgOGzzIl-2!evVSCw9J#6P&?MA!uggDZAut1hi`sTm5NM-0yA z+uUJ$pw+sRc%jw2c_n|6RPT>%?nt?bCH!B^OO<~vq7RSiw}<(H&1XDIdhwO#fJT4J zk^{71MX8pO=~Gl*oQa_ydVwd+6-JSRcPyB)HU}Muemk{Rk2E#3d1R+ z!mw5qvt)l3h(aGqYpLZ6s!+=Izpj8>1#(HUt4M*aJ_8*{P_l?;ld0m7Xj;0SQ2u1` z^oNUs+*`dSkOx+HsIC{YD2eyFGR(+qD%nR9x)RsrEa-U5yp+tiF!yvG$RrN5w2~B~ zxI~J6#K1Bt;#ABqa%fU(3~lycXn958eTL9I&%u9QbRf#N`ibUfavoE$lL|Qc)|^2i zQX;Mc)Q{-mW0I*1R05EKr|(en`N0rc?K4Pi(pZj%)tc=Lb-} zl1~`gEH;f}(Yxx8SW1tFE;&odlnNy8K}7v4mZU67!+D4Lz`jX-9%!wN|rgkjkkbOv51Seaqtv`PR zrcR!lk-1`g$#4`wXiiu0W^h4?N5gOqAw(<9@tdPZ5Zfzv6C_Ht8M#swr(oHb-YL56 zY6GMxNh6e3BC;8{4i(^iW}PdwKof)B6klQ?f=Z)o#6HXBT(Th9YAaXb4{;oi3Xl2> zBY!P%qG0?|zFCn^m>;A~lR|E5UlM;EEqqJ95DD~wwaqm%j6or0T_)A3VE2xb&SUmW z%F)D$pFMd0vCCt$-N{4OJtW;&TP)@7^fZF>tTTo?-Tn0YgHewiMB(nf&>M)!WDS(S9t5<7S=)Qj^u_6-= zA3N!kIZDPoP)tHWAB>`fyg`J#yA%hYbwNf4gK9e?<5>YJsJ7C2wjlC&67xhmP~?Hk zN+Sjr1sY*+sgH=t#HCaHqU)I965uPf0urQxg=3Pi2~CU#tOnVOH!s~z=i$R&A#_4b z95}yR17~=J0ucW9hY#gN+rWQB2BH{{!^kjqTNse5{*dfz=1AoZ0R9>p9mDb-Y1msG z$(^;deZ@YHt9?S#M_@BMaLM~03(m`O^Ib7j7EyGrQKWBAq5zEpwI~NHHV4L`XS~23 z0=HT|uOV7{93S5S^dQZ3eVa-t=KSr6Yf40^=h>$&}Cd zghfnl#5F|&rxyNn6nqXwA$MG7N>G7@*XUoRb^j{*QSU15bx8+rU77Z`6}tiQ{je`O zT3?|t3Npx8M-NgmMmz2tQ!R-0L+1HT$knkz8{sj@f^vN!D(Zl|QlYianUKS4`k@a8 zjplNb^J(O(0I8>97|DN^cC6%d72n)6?;gQXYE613x$ZDcvv_ z1%oh1=PHO@rMSGjSbE^888L9KuUWMX8eL1g*x;lqbQ?4RV(Y^O#8iEnfHuoC@Y zD34Z?sDrJ=2Ah9j1;eSNCmu~~dDhQN!WPL7inJW4P{Ti&33%LRE`fUTrL(ZIHK5m! zeWegdWoZIHl9RVhVeL)5!&O{J_icXJSLFABFiJY+lbCv!as)nZ?DL>vmazHbU=}A@ zp{z`uRH;xwzam9IKtq*m=a5`8#YNZ}SG6^Hn7G!0zLS6az>LvI=_#%m0cjcG@Vv0` z789=ZJyl(aqJYZZqf9zQNik!B%W^i<53s*H&%nIsyeh@7&@G9eXg>`@el74sFNvEk zWP!n8?PfE{IrjzG*JjHa)zLw&-b-teRG_WCskpt#;1NQMj)aNM^kHK{V>JDKr2J;| zi)#LYgTsG9Y&Ui_2LI?{z`1gJBlV6T?=^!cur~eg`+Le+5YWkygw+^?58Te*{*n*o z!tsKh+FZvXsM{Lj=;-L^>Ep-n|D&U$^8b(ePmcc9e|+@#>67E5Cr=*z?Wq6w$&=&1 zk)v%*V9}F_lqP>W+IXz;;{GDf9(l>YQ9xoku;zbY>VbsFkkSe%<>?tovIukA`2xLC zMN!#VEXy85wjb(W^>lpsk2(LK$;C+4ZPS2d=l@avaq0X&dGz?n{rTU;gI5~(WExez z4jpxz8T~MWl(x#}S27)!Y%ZKI$vVX5RIrV40s@6&2QJE6>bvU3bWdZ}c+C0Fvl|+w zW?O%BVDb5X^602vzW=}OKYDt9{&(^0?U8?md_+U?98x7JAu*S-Au1VEIEPYFsf0Gy z*b4K;hnCBp&tew&Eb;;=B@|Qd=v*lioC@F_WDr%%zsZ=Zzi6230N=dT#S0+ksC;vt z*A?pQ?RBu10R$2jS`5f+uK)d-&RG71)dPRFlT-c|c z6wt`&A34bp&f~(Q12uc40+!%sI}6hT%%A@NqFYV%ut1OpsLFY8NLVP0htmVQxYdKw zs+UIEW5&zSGOf>k$lyJrs`gCQq?rGM-xY@G@e$3L5yA@rOc}`*3c8 zsmq~3Zq05s##fn>>%`p8oo9M-CAfb$Cr*MZnle+CtEX4HN8(kEkwp6oH1C6RL6Qcr z4nuP=f@YkBAtXaHjy3y0nzU-l_7H?cAIPJz2mgGdx*C)QlYK592>a2mi+$;gu3FdG zF#&wl_?JBLZa^NPxlm}=aHG4mOViye?H_f=UOZ6sq2d7L*6O(T6@yc7aV*stcYNk}Oi123|hS*>it1dqJHMo%I?U zpN(^UJN#@K0g=}cv4oO@Mn0dBz$Y}-h2=~i#>iI~0{Z|rVRW|#xAL>+k_O{ovKvSB zBQGVG_}OzUUPJe%CfgF`L&m&qA`kzzC@l*~7+f(Z`i|Lc3MJs{fW0zq=kN7Ujv2A`em^cx_(__U-~=kjQ7MxISc0XJR^_xkK8rITY^s(MT+3z% z!))rI^xuS_5^6w>pFDjPn73Y>4M_j!Xx2FU3&k{H+SoJzeAa&nvNhpe)G(dLxQ+53 z1I;g865f?>U7htweqse1$k#79^}nZ~q>HzWUZb9ezH(rV`Aa>YbF6IxHd4#SIM0wER9ZOY z^=-l!RU&qk;1Yi;p6X78$}?2}jtvj=Wy9!m@S4~%e01MV$f@s))D&z$SqoIhi6}4C z{7-B4XXi?mDO3)!v;HHZJrLwMhuR&x9EWq4fLDuR1K~cZO&WjU@g!lMlAf!1BjEPaiA!{P zQ(Xi&No{UhkPy_*L8NpYJW`X8^F6dag`Q<+ajLUB;FSoDCDEK93Bq3X%Tpyj6KN13 zQz9pE;O5dY*!W+l+y@0noj^9Q%5deB6T&6`hvYUT;FOa(PYUTp{L*g#&wZWSH=j&x ziU!2Lri_0Kpxjc3eu81w3()4G@L@CF;GYGi&K@BI92;r`TjBXIyrRGbr7ZvtjD zx?;(w+#nOI+N&fy8s5EP%ZK9VlCV^kVK4U2%}8fUCNUo@Lf)EMWa` z!%Jo-$)XeSvtWsNBd-R`j9Tzjt4%9v&g&leIl`FQ)OK@I1s~8UI$_#zrkYb!DZb6| zw-SGm?k!G5x>rp`s5%H&N^>EQQ+NyHN- za=$L!JN)u>0W+fbG*p0`l?XM1F90< z+d)uPIWlski@cZXJs7Hzr(=-aTtParkU41@cI__{ z7KhG=dY2)eI3oBrBmJY}$Fotl=&64ouN$TFn9Zn@#}!J(&{S@+cU@SyW}26*6+<=6 z<%;$7MdVEZDU$L@M1EcaO-j5WOIbKCIB6zKB^&~sjy&6ua_K_yTW9O3D%WuednOyY z!^e*1EF3*uy~I)^r*`r9;pNX4KR*B7{_EuB%T5__)akPD$I5L6M=6(o+G&4`jNrwu zBqPYKdrIm;pG`i3JRdzAq6hjzzrfJO+&?J^T@ADT3#l;V6=&sJVMKUS=4T-UXuA`a zbVbUO%kE0Xz?x)>xw37Rg=r9n%rPSg%Mxf_zD5Rm1@)o={=IVX%Tg|uQ2-T+YCi!5 zR0YjSIZd_MQ{jcmp7!Y2Nv3}+{JQY+3BFUd^(dUH5~Jf1NZg{Y8R-@Gvh;I~(sjB~ zJdUXsUr0tZHHS9N84h?;3-10A{#XO>y?TA?g3cb*cc#av!>m05xf{%+t=bYwXv}jc zJ9&zLuJ!wfDkeq!?RfTIdG$NcLg-TlTTXuK4t<)k;cs1XLnaA}$(w(ly6dT+8_4%- z?n@~R19*jsKMhUzpwfq^#6~mYmeKkGDsW&u>;`Cz#JP3KFGym!1E~xZvNaegzm22jH539wFA#2#YN24@w z^j~@w`tL=%wW`Lw)NFsDzCHdjRO->a)_i@fIfBrBdjXu+TZru&koR58n&}?(zUltn zDHwe1pe@uFHdH@ZnJuiT)?%E;8hxbAEv~eqF;!aUl8_8Z;F(Wo3I*%NS*T*BvBZmx z>oyw5qBn{{Y}xsMK;jg8Op%RD4f|pOB}ne2RI_H>AR<1yvUPtM+9?B07LOP?{{@wB zimx<|O|D`!M&~e-ZZ}6ZACf?(b;W3uLnhH4nH8mj?ZF95D*1=~>N~5AGE8)xZe6o( zSJzKfqLMJxbL_G?R)1NfWiw%Zm(Sj z_X2G#ujG9<=x9~1yr+Lnf|R|9Jj7Nhj1R~+{|pTEs_dG%t@S6ZXbDcL?kw$D7ce2S zig81|d+{Mo7-priuBe|OYlD=mY04(^LsNbb_vkGL7bAc56;B9{o@26>JepF8TZ?2A z6ML>xyf~`5Jly>wDgw_jKM9uh_8^;t6nO2VFv_Jv{fXOvX(uk!{0GGun@yleishrT z;(Axv0!hLpX%#)sR2|P(1hbCyINFww*t0RS7&P$*l2wDmyg@oQ$HCCb@(4=8)m7z?pCbQUPXgik!SAtr+faXCI4iZ zM3g}d_M|8te=fRnoZ_}s=cww^it;)Q^vjkS=gogKu@~B+xu(F@(l-!B`C@fOc9Qy0R@Dz~OP}@^GTT%yai8QCG=Lil zRqGks@=j~n`zGH0UO#iMpSjo1-0NrV^)tKH&!F6_%H)t2I&EB!yuze(;6R1{th#4z z8cKhubIl=JOD6-;cb~YA>|n+IVmXtpksmIe z@&s%204SQCB)Rh#@utkXbS~K((lq?U=7+QS8!4gu#6a4$n&iV*V6lYdu~{6%J##)J zG=!JXSl&eP1axaYKyjn{ZU4BB{CAO!>R5kewjno10J&Wsm|_<-p0plM7#F>K9EZnP z!8z9yzT%NQW3?H0NIBj&4=V`9kbX~jZ|_+}NXZO)G}o!@EF4kq(gb4UghOA0SrjrM z@)`-MB`C43XehaNbKTfJ$=6ewJ`hGoobyci%ac={us0Xvy+x&T>3{kE1T*1?+H8NE zn%bzW%4x!wt`(+#s)6ZV8v2R8iwgs5Q33H~n?u&TbNcxle#%CS>|`SPln5MLU+J3F z$eRqHKCP3#&`JeVCFGNRn_-&q5!3u&$1t|2V-5si@?TUJk}yFVheYrKX|U@XN)7>2 z)ks#$)ipGELR?5QT_a|-I#YWn+iHJOme)`N0#R63<7vzF&m|VfI$t?+Z7J#VJ%&gM zOA3(EWx}vdl7fc%$YgG&K8-33NZ3;=hxjUdMTxeMAze$>_?zNAQBz3V(0RV zxkx7o6Mu%rs-iiHLZk|D2o0Gee6W`1{5mo}5lMQJ0g4cRWbsGU)3ff!k9mJ0kZv(? zN0+$d(m5& zmV~BqXpoN|iJbFSIFxJNfBMuVpFTmHe4#I&2`>qNHCd-WsDov9Sp@Pc(2@KYOs4jr z2OR$^tdVhMm8B$e}{AufBie~!IJSa8M<&zZWDg}#O5!q z0?&$0vk%Jf-1UoB#gF?Dqrm9jWelUwnUddp@P|8iREc zx$fKDYkRc1?S?66=_RBhB~QpKh_Y1cc&tFZW;S^hC0@y9-C&RYSr}#0%Yso7%dCTN zLa2$2)HylM&JT4DV3N2F1S28j!ySb*x~#EiYCGo=^QiJGI4cxF6LzLL`E#Y<*?^qp z_2>9?#1i8~pdz-Ef)0PQbD*mSJ%$NiRDq3h_-f~!8m3}RNn1zXi75-iT+r_JkGd7f z8dLn-%hZ+RIYqH{MH@!{_?vngMkyRkt_mUsD?ybF=IXt@PHw6uH;ye@p1k>?vALz} z-lMT(pdtCb17j0{uOMW9juu|>Tn9ou|K3)WAHpz&EcjuPAF!~YoBAvjK^VVJ1rN4ZB9id??BOnCeLhG-op!gab=r_#f6xbgmhl8?=LesUgj+<}3$< z`exAUU0;7+7wVjKP{0at_c~X_J-%yXy??g;)Y1QKmjGH?|L0MK{y*wJzNi1Yc=q;4 zi4yMZku#vTru6G*PEOByr_V{sxys29C){H~FyVHT)!-M*K7^e>2B7qwUVQ#f-TBv7 zmgxPVyu1S@+%#U78Z0^gPrg3t7tjCkQUB5X`QLxZ^YLTvA-M`>1MrC&2O)#<*E0zg zZ^{PbVeiwYPDg&$dCSr)i3lZvk5lk+JyAgbBsXW0&c~0c>IWlT#3wWe;7l z?+0E=x|eL;CEXw1yy=oI-aTEi4@q{q-=Dng%K!ea?!f_ZK7H!IbUuD`l+}0H2(n2G zrDuN==0DGpAevmD18WdX&LF>+di~-9^D=Z_f&_QaDEHi~aWm^^J-b6L*?d4gekATC zo0CtUI=K#Bn|~!kZN0{24y-qX$WEh|Q zm7T*)!!-qC!u})}GO5N?D~Dg(Q3==T5Q+g5dPO{0rB`fG=vBdc0qlX~#oX8M?}1NO z8mzt_G51UK&*QV0M=VOsUU-ACx~O zaS}x7m~?3zmm)GuqXGH5=-RNW3};bW%k`!}OynU~lh-ap?rY;7cSHWnc*^olQXcb= zPv$>K8dRLulncq8vlWT^_E5Dz>bHM~syTgM1yxtS3!HkC+#W)HVsw#hv_F*ai zX!l`%xZo?t`V7ve^|!uq+*5m=Kjp1m-HRTev1j{`s!_HxLMv8P?hcLPgvUt$wStV{ z1`IH0K$)>9b=z%~)gbSxuxWzLu2^!)XE99}>Heed_8&V(-Rh0ni~{a~=@4#3(#@06 z_pbUQmePK=2-VW}G>+w$-K~EC%8Gny2`Rh9Ey1H&17_)zC&9nLbzmhBE^59#P@cYh-WGsf;;#U|%~6lWL5}t-fv$g{WqYV$c@4QT z2|n zsmS%nZWM%c0(|E|1AIlpzz2Tdg&g4Mhzy=pbY%HQLK)axIdI5a z=+fv8;kTbaWf*_cbn2$u)w4P}>XI&2Q!@W}4Pj#4alk?!ny8vlM@QZK`mW5de_J!` zuQ0>DnPFur>hR(wG1I-M&ct4p(W}<%NEHMJMGJuBH{NQ$AyYyO!kz?btH3<*%uT}XPkr&p=k_a-V2H>rPs28N(l1_gUeyuNHIj))|ade%y!g%Kt z0+Y3}yz$0e2GU$tTLzVo$nq~9L}1mZLc!KV)5x!BUs2_siJx&E1^v@kFh>Q`!86kR zEjmBBxcK$W+vgYL#oM=U-VPuW0-VQKWjBSWZWEqu&aZXInJWJeL;v0A&T&j-$|ww7 zUBC@w4ZMF{efIsc+Oy>TS82p<_x^vA({KPXu(79gD!JXk_K z!`?JvU;nWAx8s8xH;b00Hi%l7mBlJp?98Sn-_(H)=+Brebl6 zZ{2@dbSnPUDGaUh_d3-{#XFivFedx9tA*9g0qjQ^EQ8Wa3j@O_y2`HYrC0E@C~L?6 z;%v*Z`(Ig8Hevvl-v3`$rD-q< z8LE6~7}^d3C+BBcvng!Rze>Ut&Z$w1oT`5kd?-m+{i^;_zn$|W&3{vWmF3fOOB%KM zG=iuLw~LfMX=E3L#_9~JZ@V=VtkA7{XHn`Bcm_jy91Y&K%afzIWjb6%0N)Fk>% z6B>ySV(uZMze?;&=5!XSd}OM2Hj2AcSJUQ+oMsTEY{Dv{?sEw^Th4tqW#(tC;5L7G zb5y#tfJe;&aAk80Ut}3z2G5pQNa`%Xxo@4tyYPhUvp)-+*VzmYs$Vr5_;3Jg=aJgm zsF44Tb)l`_VQ0&Hkd>n*YU)s>jJFvEc#)D`RNCzS;>CJXx&Hf+%h139xW+ zU)77P%Br2CF$ywOYEzOt+>%*(H;;cA0VS10Qe~20ev8wt%@^mY7tGqU6c4M-EbQ5@ zvEO~Ovi+`Nz=Mnli!F5soWFpfWXb)noM3NN{_pqu#})bi@ss=ee;3aR^1pSLo8;q& zAC0F}p^yF?Pej$<+0eN1u>_}PH&5c$nX+)^iYX%Of+q00YEvCgr#(YjXnTJ~*MC2w z5uGsK8O@6=bh)frGKoIp@;1)|BRo>Bcdm$;=jsfowtG3KeZ`em{9+kw3;yYwf_GI= zeTD?>{#of+LjMs%HY5K_<-eoHkIVGG-@n)Y?&Mj4{=fJTLjfF>4@^rlfIH0sgH2TT_{zhr}KBwEiMHAtp$-AlCU_W9wXiV=#uUq-Srnm4dBLE z7|zL`84V#HI-zk4i*-A{GVC3`PvsbL=EAr)2|i=CR1P2lh8?R@Lh^rp6ha}7{JsL! z^Vb*hTabif<{h}5v$3`YVkgFd%YuE73%CGxaM6;JSF>FV^E`oTjVrMJ(cnti5xDX} zE4bUd{8y2(2(-pmYn}!i*h}&1G;=MyU3r3KEG+bf)2-RgVp;7Fa4^G!&_%s8*URG6}9&q}hs0=;A}% z+B!5(tChgc=L3;3#r zDg1k(0a+dX3dRzrfU*y8Cm-ZR^RA~XL9bc^<3K=tPE2v%cos@M*Bl1SU}gh~IN($L z5A5u_VsC$CvZOtCqlvDiRUu1Ie0U()F!5(-Al!AyuTtKR1MiZIgG8ix$qVHapv!e( zXE;^d6XK8{N-cUR=ZwFol};3H`Xr%|&u0d3*bQzcame?ahm1zWu6|WX(o;^T?-Mbf zjd*BEQ!VM*phF#_Q`!&Ie*kF)|7k%3KhI)}%#DB6g@|mV^k>U_)QQvDNxk`~8Dj92 zLAk**((P)3@s*xW>2<#Ra&{i`gZ@-^tai@&zJEkqwbSNfg`?-H(N9R0%d{g)gHX5= zmj1-%KO}r6G1<;OC%VKfp}Tcxa~7>>SZK3wVE94~{gcI10BNdS!@|)O$&lP-$oXX! zlkR_&Bv+a@`D#JV9<{fovtVrcvu`TAMAR=X)K|{a+78Kxm)bLg zGqBJ>(frc(U!;jy%YMkOSwi+DT|WuqDJA`b1N`%KHe*TPk^TYM&*HfH)s2eS`J<4y z$;NH?UU)%Jp?pmZ*o1v}izb1SFnk%LAP0AU`|Vc?8l?L_y5vS)4$G z#np*4m4hTZE!yy>_~kOL^v+nqEwc!Ewa%_Cr~3f%&+A#H|Hs1ox9b1h??0{B|L^tx zJ9<`+|FUCrE)YEk)NHJ!stSKR`9XgkiDMOatJlTZ)!$kMgO!HLMIH46%n_76R_AWv z$C}8kvNlJ>+fD8>(3~BaLM^c1=#KSe?C4cpa1^X{U`VNe|GY$aQ-pw zCx|c?Tfiewo=+H5)GXe_DFEV=QZ-Iks?PmlVOuA?QE#D*qhGe93k?HXxqT9C z^RJ&XjQ5Veh^~I2iB8LnWz7keNyiR8eR}rQ{$(~|UK#>$v^u~s8QNRtWmlnEN`fX1 zC;t*WlEm>@_akU(UHJvZTYdWUsY`Cihzj=fF>xH9dE93QH42pPvmk%;35%}C6;04l z6OGIiJwcc5UkMhtd3r-;bH|v2mhVWZD@#cUzknk|90s6~5b__88Ax)yYS~r`P~n|Y z!G5ST1x;WjguOgQA&pK`Z+X;u(-->$m5DAnXo_9W^@@$XG+1ZT`~n^)e5S8V+`*+g zx6qVf45s+kN++w*ajt(+lB-dM9cu^OZf<>7Cr}w-x>jSjhSE2qf5{)dDk=ZXXKFXi zNENHS)sIt6ThxuwjX7ag0lP-Wj3^BfWfbLO^5E~{fzlz8AR@Z{0Gi?((;DT8pfX0D zk$r7x$tP395bK9$x>=p7%qUB*IBWtvk_CEGw99H3$`yaqS!M}O)R#(I2}cNw z{vnBY3KWA9sKAtib>Oinu`Nh-axv_?hr9l>blZWD(nM&`5p%j!qV&|9Z=Lx`@u# z_Gar$Y2=fAqnYSxr^7C>5_%n|)IsI!T{mc<{UL~a(sh#Ge)Iq1s~a(;$4{OPx|mhy z*ORxe&tCs?K;Gu7Cq7G=molI1OP1V99QNtcK)#XReENTMa7Yxh5lI#wQ>Ub8({E&r`f||l3B|IqDO}Ifi<%>iVxwa+2Xj``>W0~)isW(`A9lwhKjr`Pb64f z@*L&80j{_4j%*8DOZqIizSqbyc@L_~N?1jqKjnX#*Qz7@w$y_^`dP5#JYnPDL#u8s z+1$lOrJl4WpY7w9OGUZ=a%s$Bu0dccK%G$b`G@RNdcBzZrx*xOai|kzt<);ch?Uhe zdLq`~W_Q`das^lQw|ck2#*&6LSUAhVG>9wd&~?8xo{P3CU@6>cS^3_R>_ZR+G?|le z79oF|q*T_B%sQA%Q>{zmNhzRbA?;dv5=_0+W@>Z?RAK3~3z{=GpQ2r0ujGN7_lZZR z973bj*(FDVMP0V;Xj>bvPHw)G)%IQ!ulh}IzZtrp7Q0~U0GoG2FKhwq3(7=E+!{Qr z>r~mB!d*wN;C`JpX>{+`mS!&xZHc3vJ~5A^L4Iu3wLFJ3N04 zNLS+cb$itv&C==GOn<4bdX}Fi-ZV%V)Ou?(A?x#UPgy!`79C3cNJ=alG>8pvIZuBZ zM2E!ssaqJerXNY4wVQ#}N2XpcZNFT6S=|0Di^ISJ6lq#c^^0n+cOw#&H=$81Dty>1 z8YvWT}O*tiZF~qVRr;$E~o0P0pEp zBdv0<8rp4HF(c3K3Ok!~(SONZ&8NR)M{O!uw`2DE&pgC+75xv7CVcz)pZf}Ycqj;JWN_tooNsgf?3_U*4Kk?^;rJ)LCf z^hJ&KP@AU%HX2$nh~SLhaXZ)zg!ud5!oIJob!+HlQ>~lo_A}SIwbp;lG%?7xshioV z5YxDVW$GF0IIW?cxm8u@B6;I4qBL8ygiVOw?W;oXTG{d$J}c<|VlL82!o;89iYmY* z`oI2@ub-CVKb}0k&;PTNXC3|DIU>Tv|9rW1{hx(npN$GIpHs66F#l#VEub~l?Pvk( z0lbnT(CT8tFp!#_YBhg>Mz}TK+p_TTUM1(C--=vAw`2^rX*C79vf=sHjD6UR{$l9ru(9GVZ936^UikczH8?pe{t2z%Y#J*NLaJ!B~ zi&yqJDL2;R?|tS4J~OGMRRt+VR5nmG&qbG771=VuT%E$SkZynHlFc1HcJyzHF0RI^ zIFK|*7534y^&z245UE+~JE}yb8*h!pD=2dKC0@KCX=?3P);Jb=BBnqIoTaT)_8nWX zQQY-A({C-mB3ILREbq^{$q-PDH7!;^(DES5?IQIepUzRVU*1z|F7^7VgW_@)h=q+~ ztlIIG)ne8XSHypq^^{`^I@(Y_W^dMCLq%5M`BvP52EOqY^)%b%|68xCeWf zy_|voKU_VU3-FfMXDqI;jK!p_b&aZDMvbUlxrORSyah^PGpp;7k|MkN7sle+^=yy2 z*??Y=(v^E%($$vfojqE-KFO;UUjM@A(zvE2DARxvap`}U+xW2PyU$V~y@LK1K3yjf z+>-d;C&!N;mHj^-Kf2HVvy-Q@jsp0t#Dx8KueR_1i8%JzsD5EO&01ghc{7DCj&M7= z-U={RQuAW#4K=*QP8KV78(lpMom{fHaAWwk$wO0qUhm!r2~bM|cFS6_YG*$SwnBed z{&n{bG`@dXak88EwN)11tZXw&lhR1S_D(%$*e=hsWW>skMOg0X@vJ;m* z`d>-U2{R|Rrs-NpCAQ|mm0vhppp*-zyoLh<_P4p)*3Lb)aN_NEcRhtveIFZ2YYOI{ zqZ$hDCQKc#g)>}zYe<8ZMqP2YD0gj*_h`PLo40=%+t_>d`3gy2@Uw#aXJ2G1NrB7q zzdn6*RQCUQ`uNGc{I`o|9q~`eL-HGt^hT^I>>&#c-vgmN<w zpQf~ah-R~R3qC%-?XXseYt$nJA!*fG?iCz%%|pf zR_Ux;q9;FbO(A|ThFRF)8A(|ZNl~HOCHq!TYd7bE4|GN@>rK@ddQ~xl+STghaZp!T z;gbnVPqQRpQEF_t-AXY`8u^BD6zZu}Mp~&Xp4GlQja++1-sO^$ho2y74}Ob&i?n~U z+TX=*QJ3tutRv_iH247(g+c5dih5PZnkmpheV;sV9LW~_UHn}<`$~SUsDPXWjePg- z!bXjJ_pNstfE7r59-#_#{J%S8;VhU$JYicIV+sF%^yIkY|KERd{Pf=bvy*3!oYPcN zDk$cOn=Y@Nh>Wrz^d%LKsdq^yOt^oYJ@RfE2qLmL=1D4un6fYgmk2VWsW%Ox$stKt zNYmg-U7PuP8u^_)60r$7(e9&)KshUt|LwpfZ=!Hccmyrwlt|1H5(W`-JMQy~KQ81Y z*V!YdfTiS@(+lDUiRieKAnn0_arzy1^zWnx|J5(1lb-yK{!?5m#Ulm64MOZk8Lj~^f3pZ}dad*pkp3#CuP%V3m9 zuH{ssM5l8?-v7wLS@HGn`?`O!l)NciF@*|Ky_Cm+Cwd`%`iDZQJ^9T6s6r+avE@{`co^JDuThC^_qn&tew&Eb;=TxOaKC4pe_| z&tI`b1Uwp$Blm;*K|5urVq61L5=#wY7sXQlmV?2FBPynyuZWyJF#~_kNft{!)qDl> zqH*wx9`~x>xeOwIK%@j8OkUBrGh->0+_RiAPPj&7g7U!bI158`m4mvDy47rstP$z{ z$ik45UwIPxU7W<;9yyCrQwXfn0V0izNSyGiz-NL`4RfvBlk19EBFObL@TSD0kz|2D z6AXUvSN}hIPygJut>l02{3~{(&Lz$>Y0G|-dzX8?n|xi*(>C!WX)|+~P6d%G2{i?< z0BA?A>HmI%1wew5tPfjul9>S$5bW>rheVb@V6h+AU0`>CrK~{Um8XZlf{eIfiT(#c zNx+N=HbIpo$+HeQI|I;)|Ka<3gsiG`+uMczhRESqrogI{^O-dct+DEVx~D(o7>F~U zyZ*U=ysWiBr8B3d=vRk^Dbp~rJZ4Z^AA|PoE8E3~0H%dT2{fqTyuDQIO)U(cVHdw6Gi0Z;9Mbp?Imb#P$x+mgFDCuCx1&)H{a82kR7{MtdENpAC@B!#|dKQGCiMJWCumlcv@Sn%-}$!OP@w~+SX>3GZqH{8Pc z$pU4yI4@9G1fYWW`2;Ue=Zce;2wOj&;N{24-L`ios@iORA^DVlu75WDzOUClC7)pE zC7v~y%7iR1({gNv@Cn>Sy}-bJ0rn@4)46kh`6_IEf?*td`#-N=_xv_Xd(G~%r*C@p z-~a0!3}GE4Q>KazB=(E@hNO~(N68XSDp>?Tj_hY)_$t5}NOC!=q(EUBc-jr3VV6&? zgT$d^2`6_42?^7Gb5^ktFSit@B|_Xty0(8-$>C;EyR8WA`m7otCUhR*IJ4`!SLMU* zR6X78x@efPOMJ8jd#eK;IxU%(+^&ovCxwrj%TA;Ifos}%&}a@a%OTm&DKiLHKwk@G zs}-}>^cXHc$*M}pN^#o7ZCWj8)ofRa?*OGX%;2~#HFm*&+!o6C{kwyb3rdFQB65-9 zYoHA8?}o@-p;RN5FM+rNly9CreGUq>tW}P?0J{^Exhhrxxiyr}-@Ld1B6sFXzkgv3 zrWn)!r3RyFv{GxqC5x48tIJkyPqWj%?F&j;=wB)&)lN(Nov-fudUm$fw(E5VJ#*(O zW?#?U02&K_0urBPbv03}z&1G8otN0P`OLr-FH1n7YYKs08R0$Qmnhsu;T6(1u1j)j zoY$4X*%*fH35{d%VNiSSO)Pd!{Yffq8rK;?K4-r$65qvqhFLSL~N>V*k3EPw4B28Y-Gc5=|pu$yZ?Z2gck zXXLDZm54nlr27+(y*+E?Y){hi)#$MH=`g>yl1D7RKtY=e-}&$bV1e^Jmw|5tC@kl@ zy;rMPq?41U=Vy&A)<}Xzb;)xKu_99Tn(xjf#e|HQ>Ujyay?h9x6<8_srCo$HJYU%E zb1q)S<Y4o;#PPs@2>EQ8Ev=+>TVIP~_vfK)<6R98A z2+RA_G54qqV#=2^PwNbd!tJ3%>vrTqhX&wYSUs!tR=yvK&Kw?+@m*L~lE7H@8MhmZ!1f&J+R~(|vTnC@wxZd!%;GiudNIGH z=KKmZ=8n($rR$ce@hjAkXBfZ(Y`53!qWO={ry#LF?e&|qt`#j1OHuyfcZwY-DI3L0y`g|na1 z>WGoq^Eq*}ZiW&1+WiK1k~>_1z9s-vDo|(?$4jKJAU+0GDrChRa?%V%7TbTFnBmmd zo9SW*dj3GX__=!?6_6ap9`u&KJLw%juS791(;f_tp{I?KV$vp`+x6cM)A`(gGVvj} z_Yc9nOU|lm`*h}`Zr%QhY{GI^aUW4s4?BC7p=O=6rty-Zm6`zIfZBjQ_kIQ&(YN|= z>T7y}9yU_33GVMm`tvB={T*a~9<8^(G~R0bdld(jnJfXG-)KDr?M^!a3HwU+%U{x<6w*x{$8Un zxt+uhT*m=b8pd2{6HUQ?LQL_Q%;#DaeyURWw%#`+!u*}%TQ`Jg*F zGOJfj&#ziPw<%sbM?k?Ba8CXO>-PJ8c8(3(>soum=W~z$1wHY?vLW*_j{Vspm-sH3 zu49*NRRbUsx5+pjdTn;-vuLf4-(&`Mefu*3In%W7HgCf!4x^}lY!?MFX^+aL@+zp! zNR?*r);cpk#}x#AdDstGwKUHI*g(H-I{R=H{X&!LYe2x60p)cI13hKdfOSC~bWs+? zdNldcyU=exMHGhHq3Vl#Hqmb(lV1Ci4a$ay+3C8_9->gVDy&<_@#bV*w$419X)ASW ziW?1E+3`u~x)C6Mw|z#w(gI|S4k!zKRSYYK;24o!Eo z9&MoCs=IlHJJT<^ooO#5T&7=i+sNl7VN^KyUZ}W%ehc+BoAZI)=ts5g{;BKgzux`$ z&m;T)?dZ5nKUX60^ODZh9=k``+k$>M)0&Awu?`J)rQh>^(951y&}I5HaDHYQHgMb* z9XIJef0N`b^`E=L^xqUt{_`%CpuczeGb=#{#r-Nla_iqSCAgSu_UX6q-*4q&Z*)qx zZ~$)?gcEV~mB&h^WLa`CdB-N!0`SNJHj=gRnYg|M7&f6rz6nYl?jEF?^!xC(!kn`b zIAKudQ=Bn>9fd>NuG)-e<)fyaBmib!;S<{-7n1~_Xvy^?gj$8>QAHycT+20-GG_*h z1OPv>Sykc_DCn(>%Or`Cw>J#+rfErx+=lX{l1H9s4_lIC2YMqwT}czgg-3lLL^%@Y7_(3QYi4{502RL(&MpoQxM zc~|fUBZ9^Ib_<sgW~_dvEI^kn`WDUC5V;Q#l_5rW(g!zn50OvK??ZIN z*b0!ZJG&82p;)VH577Z-79+vpF-f#L<$hi=tv9jYcT=fdQLh$213$~Mo?$pH2kPk% z&c=bodTH+v;$dDPb*=Dzm}od3wGiVIpcI(_-?n<62uPp|ARaPCgPR)wV6AGx>=2nWAAuUU(1SFfW1 zwGT0{eSpSzw2eZ!_V01tpwi-!CTsz#?Mn6DXH8MnKF}yMr-Df&i)2W~WiPmB&c_Zx z%Nc^_Zy`3UrRki)Aj)bo(_Ir&@p_G;yfBX?0!F&7u6O11J9Yx+0SO4?R zq%-NFD%%-nS>{XGp}2g~+@BhX&YVAe`}Y0oH!qUbmb?sSg-?>$#B`{nOAN+;-Cx$A zD-P6biVPu+VhNdXI|(d=o_dSKGxx4an>3SSF3!;m1lU15r2Me)I669${`udO6gE zrH}<(u^gM6hn5>4mGGOE!h-j0?~lx`d0E7VfA;JG$230vJEUoWxh(L1AX$Zo!Hp0x zh!HW^4UUoY+Wp-3U6gJD0}((hb&1RJ$g?ea~|+3 zR0!NxEJI&qco7Nz{peAWq;MWWnf=$=p(9lHa`UB}qpo=}gol2A0URvjb z>754LM;%$py7F!`{cfKp%YC|vTOdU_Kgi(2|DwY6rSU>ZJj(*C;(k&t7U_U|;G7A| zQw7WGCw|fHh{nAN76flz>Y;mv4Z^ z4*0IiOfGi4a=vhXu)H4;VoCQuq6(XBDK@EmaAR3b*$55KNubEwoywVFcD>m=! zu7-kbQSmp+V$Ut37O0%^bCn6&k_03qykR59TxWjU!CTRx!oWgX7vmL0)l({hV}wx4 z&dbdq_2;5D#RCIlyL>S*2d;IEdix=rz3!#R^Qq2JFvVqmQ#QyE%7=%>Zx<4^9X>2r zK^mEuTROI2w6k!@kzHAfr{-kFg00uV-9?7iCkn@?!ZP(ij>nw#8L3$z^V)hjM78y@ zb9wUX<>{|8K5-;I>Ng+LT4S0sjrzb#iT_DV9Pz>&jD*Wm%Pc=>9M>h3TwG|!3t?nC zVy7yksf|=hoR#`Wp_b((rWUvp`u8-gq&8^_h@^&?Hp*l^ztM% h(tkYtn##=n_5Ahx^?ZTP{|5j7|No+PEqnmN1pqVyiEsb_ -- GitLab From 435be844d2e4181cd9120b37f5a3e518ca777cd2 Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Wed, 9 Jun 2021 16:28:43 -0400 Subject: [PATCH 03/14] update saml secret key --- chart/templates/_helpers.tpl | 13 +------------ chart/templates/bigbang/anchore-cert.yaml | 22 ---------------------- chart/values.yaml | 2 +- docs/BBCHANGES.md | 15 ++------------- 4 files changed, 4 insertions(+), 48 deletions(-) delete mode 100644 chart/templates/bigbang/anchore-cert.yaml diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl index 53458ee..579c167 100755 --- a/chart/templates/_helpers.tpl +++ b/chart/templates/_helpers.tpl @@ -166,15 +166,4 @@ Create chart name and version as used by the chart label. */}} {{- define "anchore.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Generate certificates for Anchore -*/}} -{{- define "anchore.gen-certs" -}} -{{- $altNames := list ( printf "%s.%s" (include "anchore.name" .) .Release.Namespace ) ( printf "%s.%s.svc" (include "anchore.name" .) .Release.Namespace ) -}} -{{- $ca := genCA "anchore-ca" 365 -}} -{{- $cert := genSignedCert ( include "anchore.name" . ) nil $altNames 365 $ca -}} -tls.crt: {{ $cert.Cert | b64enc }} -tls.key: {{ $cert.Key | b64enc }} -{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/chart/templates/bigbang/anchore-cert.yaml b/chart/templates/bigbang/anchore-cert.yaml deleted file mode 100644 index f6a604f..0000000 --- a/chart/templates/bigbang/anchore-cert.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if .Values.anchoreGlobal.oauthEnabled }} -{{- $component := "certs" -}} -apiVersion: v1 -kind: Secret -type: kubernetes.io/tls -metadata: - name: anchore-certs - labels: - app: {{ template "anchore.name" . }} - chart: {{ .Chart.Name }}-{{ .Chart.Version }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - component: {{ $component }} - {{- with .Values.anchoreGlobal.labels }} - {{ toYaml . | nindent 4 }} - {{- end }} - annotations: - "helm.sh/hook": "pre-install,pre-upgrade" - "helm.sh/hook-delete-policy": "before-hook-creation" -data: -{{ ( include "anchore.gen-certs" . ) | indent 2 }} -{{- end }} \ No newline at end of file diff --git a/chart/values.yaml b/chart/values.yaml index 93d0bdd..98a8b64 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -251,7 +251,7 @@ anchoreGlobal: saml: # Locations for keys used for signing and encryption. Only one of 'secret' or 'privateKeyName'/'publicKeyName' needs to be set. If all are set then the keys take precedence over the secret value # Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs. - secret: anchore-certs + secret: {{ randAlphaNum 12 }} # If set to true, use the secret specified in anchoreGlobal.existingSecret to set the ANCHORE_SAML_SECRET env variable useExistingSecret: false privateKeyName: Null diff --git a/docs/BBCHANGES.md b/docs/BBCHANGES.md index 61d229d..9bc4072 100644 --- a/docs/BBCHANGES.md +++ b/docs/BBCHANGES.md @@ -146,12 +146,12 @@ anchoreEnterpriseRbac: ## Other Modifications -To support the BigBang wrapper to simplify SSO setup the following global saml option needs to bet set: +To simplify SSO setup the following global saml key is generated using a cryptographically secure function: ```yaml anchoreGlobal: saml: - secret: anchore-certs + secret: {{ randAlphaNum 12 }} ``` The following block needs to be added to the end of the _helpers.tpl file: @@ -170,17 +170,6 @@ Create chart name and version as used by the chart label. {{- define "anchore.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- end -}} - -{{/* -Generate certificates for Anchore -*/}} -{{- define "anchore.gen-certs" -}} -{{- $altNames := list ( printf "%s.%s" (include "anchore.name" .) .Release.Namespace ) ( printf "%s.%s.svc" (include "anchore.name" .) .Release.Namespace ) -}} -{{- $ca := genCA "anchore-ca" 365 -}} -{{- $cert := genSignedCert ( include "anchore.name" . ) nil $altNames 365 $ca -}} -tls.crt: {{ $cert.Cert | b64enc }} -tls.key: {{ $cert.Key | b64enc }} -{{- end -}} ``` In `chart/templates/engine_configmap.yaml`, modify the metrics lines as such: -- GitLab From fa6dc160bc1ef6aff247b4e5d93e95e0c1b4867f Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Wed, 9 Jun 2021 16:33:07 -0400 Subject: [PATCH 04/14] update saml secret key --- chart/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chart/values.yaml b/chart/values.yaml index 98a8b64..41cc895 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -251,7 +251,7 @@ anchoreGlobal: saml: # Locations for keys used for signing and encryption. Only one of 'secret' or 'privateKeyName'/'publicKeyName' needs to be set. If all are set then the keys take precedence over the secret value # Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs. - secret: {{ randAlphaNum 12 }} + secret: "{{ randAlphaNum 12 }}" # If set to true, use the secret specified in anchoreGlobal.existingSecret to set the ANCHORE_SAML_SECRET env variable useExistingSecret: false privateKeyName: Null -- GitLab From b7119045749afd13ce47343e486fa81cd510042f Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Wed, 9 Jun 2021 16:45:38 -0400 Subject: [PATCH 05/14] update saml secret key --- chart/values.yaml | 2 +- docs/BBCHANGES.md | 8 -------- 2 files changed, 1 insertion(+), 9 deletions(-) diff --git a/chart/values.yaml b/chart/values.yaml index 41cc895..12fe62f 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -251,7 +251,7 @@ anchoreGlobal: saml: # Locations for keys used for signing and encryption. Only one of 'secret' or 'privateKeyName'/'publicKeyName' needs to be set. If all are set then the keys take precedence over the secret value # Secret is for a shared secret and if set, all components in anchore should have the exact same value in their configs. - secret: "{{ randAlphaNum 12 }}" + secret: Null # If set to true, use the secret specified in anchoreGlobal.existingSecret to set the ANCHORE_SAML_SECRET env variable useExistingSecret: false privateKeyName: Null diff --git a/docs/BBCHANGES.md b/docs/BBCHANGES.md index 9bc4072..32ec614 100644 --- a/docs/BBCHANGES.md +++ b/docs/BBCHANGES.md @@ -146,14 +146,6 @@ anchoreEnterpriseRbac: ## Other Modifications -To simplify SSO setup the following global saml key is generated using a cryptographically secure function: - -```yaml -anchoreGlobal: - saml: - secret: {{ randAlphaNum 12 }} -``` - The following block needs to be added to the end of the _helpers.tpl file: ```yaml -- GitLab From 44c101a3afbc0a0b40b3426ef0fc63bab0d9cd24 Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Wed, 9 Jun 2021 17:18:52 -0400 Subject: [PATCH 06/14] update ci test values --- tests/test-values.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/test-values.yml b/tests/test-values.yml index ef17dcd..c6eabfa 100644 --- a/tests/test-values.yml +++ b/tests/test-values.yml @@ -23,7 +23,9 @@ bbtests: postgresql: enabled: true -# anchoreGlobal: +anchoreGlobal: + saml: + secret: ci-testing-only anchoreAnalyzer: replicaCount: 1 -- GitLab From 630529900930baeebc74d76eed2af15e8382d14b Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Sat, 12 Jun 2021 18:05:57 -0400 Subject: [PATCH 07/14] update networkpolicies --- CHANGELOG.md | 1 + chart/templates/bigbang/anchore-vs.yaml | 6 +- .../allow-external-db-egress.yaml | 0 .../networkpolicies/allow-feeds-egress.yaml | 25 +++++ .../bigbang/networkpolicies/allow-istio.yaml | 93 +++++++++---------- ...ing.yaml => allow-monitoring-ingress.yaml} | 12 ++- .../bigbang/networkpolicies/default-deny.yaml | 2 + 7 files changed, 84 insertions(+), 55 deletions(-) create mode 100644 chart/templates/bigbang/networkpolicies/allow-external-db-egress.yaml create mode 100644 chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml rename chart/templates/bigbang/networkpolicies/{allow-monitoring.yaml => allow-monitoring-ingress.yaml} (72%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 937cd7a..1d4614b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ### Changed - Bumped upstream chart version to 1.12.16 - Fixed insecure SAML configuration issue +- Updated network policy rules ## [1.12.15-bb.1] ### Changed diff --git a/chart/templates/bigbang/anchore-vs.yaml b/chart/templates/bigbang/anchore-vs.yaml index bd03271..f1fcb17 100644 --- a/chart/templates/bigbang/anchore-vs.yaml +++ b/chart/templates/bigbang/anchore-vs.yaml @@ -29,7 +29,7 @@ spec: route: - destination: port: - number: 80 + number: {{ .Values.anchoreEnterpriseUi.service.port }} host: {{ .Release.Name }}-anchore-engine-enterprise-ui {{- end }} --- @@ -63,7 +63,7 @@ spec: route: - destination: port: - number: 8228 + number: {{ .Values.anchoreApi.service.port }} host: {{ .Release.Name }}-anchore-engine-api fault: abort: @@ -76,6 +76,6 @@ spec: route: - destination: port: - number: 8228 + number: {{ .Values.anchoreApi.service.port }} host: {{ .Release.Name }}-anchore-engine-api {{- end }} diff --git a/chart/templates/bigbang/networkpolicies/allow-external-db-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-external-db-egress.yaml new file mode 100644 index 0000000..e69de29 diff --git a/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml new file mode 100644 index 0000000..67d040c --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml @@ -0,0 +1,25 @@ +{{- if .Values.networkPolicies.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-feeds-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + matchLabels: + component: enterprise-feeds + {{- else }} + matchLabels: + component: policy + {{- end }} + policyTypes: + - Egress + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + # ONLY Block requests to AWS metadata IP + except: + - 169.254.169.254/32 +{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-istio.yaml b/chart/templates/bigbang/networkpolicies/allow-istio.yaml index fe17541..dd1362b 100644 --- a/chart/templates/bigbang/networkpolicies/allow-istio.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-istio.yaml @@ -1,11 +1,23 @@ +# if network policies and istio are enabled: +# - allow ingress to Anchore API (for engine users) +# - allow egress to istiod +# for api pod +# +# if Anchore Enterprise and Anchore Enterprise UI are enabled: +# - allow ingress to Anchore Enterprise UI (for enterprise users) +# - allow egress to istiod +# for ui pod {{- if and .Values.networkPolicies.enabled .Values.istio.enabled }} +{{- if .Values.istio.api.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: allow-istio + name: allow-istio-api namespace: {{ .Release.Namespace }} spec: - podSelector: {} + podSelector: + matchLabels: + component: api policyTypes: - Ingress - Egress @@ -20,53 +32,40 @@ spec: ports: - port: {{ .Values.anchoreApi.service.port }} # anchore engine api (default: 8228) protocol: TCP - - port: {{ .Values.anchoreCatalog.service.port }} # anchore catalog api (default: 8082) - protocol: TCP - - port: {{ .Values.anchorePolicyEngine.service.port }} # anchore policy engine api (default: 8087) - protocol: TCP - - port: {{ .Values.anchoreSimpleQueue.service.port }} # anchore simplequeue api (default: 8083) - protocol: TCP - {{- if not (hasKey .Values.postgresql "enabled") }} - - port: 5432 # in-cluster postgresql anchore db - protocol: TCP - {{- end }} - {{- if hasKey .Values.postgresql "enabled" }} - {{- if (not .Values.postgresql.enabled) }} - - port: "{{$v := .Values.postgresql.externalEndpoint | split ":"}}{{$v._1}}" # in-cluster postgresql anchore db (default: 5432) - protocol: TCP - {{- end }} - {{- end }} - {{- if .Values.anchoreEnterpriseGlobal.enabled }} - - port: {{ .Values.anchoreEnterpriseFeeds.service.port }} # anchore enterprise feeds api (default: 8448) - protocol: TCP - - port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }} # anchore enterprise rbac manager api (default: 8229) - protocol: TCP - - port: {{ .Values.anchoreEnterpriseReports.service.port }} # anchore enterprise reports api (default: 8558) - protocol: TCP - - port: {{ .Values.anchoreEnterpriseNotifications.service.port }} # anchore enterprise notifications api (default: 8668) - protocol: TCP + egress: + - to: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: istio-controlplane + podSelector: + matchLabels: + istio: pilot +{{- end }} +{{- if and .Values.istio.ui.enabled .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-istio-ui + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + component: enterprise-ui + policyTypes: + - Ingress + - Egress + ingress: + - from: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: istio-controlplane + podSelector: + matchLabels: + {{- toYaml .Values.networkPolicies.ingressLabels | nindent 10}} + ports: - port: 3000 # anchore enterprise UI (default: 3000; note: Big Bang has configured Istio to use port 80) protocol: TCP - {{- if not (hasKey (index .Values "anchore-ui-redis") "enabled") }} - - port: 6379 # in-cluster redis anchore enterprise UI dependency - protocol: TCP - {{- end }} - {{- if hasKey (index .Values "anchore-ui-redis") "enabled" }} - {{- if (not (index .Values "anchore-ui-redis" "enabled")) }} - - port: "{{$v := (index .Values "anchore-ui-redis" "externalEndpoint") | split ":"}}{{$v._3}}" # in-cluster redis anchore enterprise UI dependency (default: 6379) - protocol: TCP - {{- end }} - {{- end }} - {{- if not (and (hasKey (index .Values "anchore-feeds-db") "enabled")) }} - - port: 5432 # in-cluster postgresql anchore enterprise feeds db - {{- end }} - {{- if and (hasKey (index .Values "anchore-feeds-db") "enabled") }} - {{- if (not (index .Values "anchore-feeds-db" "enabled")) }} - - port: "{{$v := (index .Values "anchore-feeds-db" "externalEndpoint") | split ":"}}{{$v._1}}" # in-cluster postgresql anchore enterprise feeds db (default: 5432) - protocol: TCP - {{- end }} - {{- end }} - {{- end }} egress: - to: - namespaceSelector: diff --git a/chart/templates/bigbang/networkpolicies/allow-monitoring.yaml b/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml similarity index 72% rename from chart/templates/bigbang/networkpolicies/allow-monitoring.yaml rename to chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml index 8eed2e8..5595337 100644 --- a/chart/templates/bigbang/networkpolicies/allow-monitoring.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml @@ -1,11 +1,15 @@ -{{- if .Values.networkPolicies.enabled }} +# if network policies, monitoring, and Anchore Enterprise are enabled: +# - allow prometheus to scrape metrics from every anchore pod in the namespace +{{- if and .Values.networkPolicies.enabled .Values.monitoring.enabled .Values.anchoreEnterpriseGlobal.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: allow-monitoring + name: allow-monitoring-ingress namespace: {{ .Release.Namespace }} spec: - podSelector: {} + podSelector: + matchLabels: + app: {{ template "anchore-engine.fullname" . }} policyTypes: - Ingress ingress: @@ -25,10 +29,8 @@ spec: protocol: TCP - port: {{ .Values.anchoreSimpleQueue.service.port }} # anchore simplequeue api (default: 8083) protocol: TCP - {{- if .Values.anchoreEnterpriseGlobal.enabled }} - port: {{ .Values.anchoreEnterpriseFeeds.service.port }} # anchore enterprise feeds api (default: 8448) protocol: TCP - port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }} # anchore enterprise rbac manager api (default: 8229) protocol: TCP - {{- end }} {{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/default-deny.yaml b/chart/templates/bigbang/networkpolicies/default-deny.yaml index a6a043e..b3240e1 100644 --- a/chart/templates/bigbang/networkpolicies/default-deny.yaml +++ b/chart/templates/bigbang/networkpolicies/default-deny.yaml @@ -1,3 +1,5 @@ +# if network policies are enabled: +# - default deny all ingress and egress for all pods in anchore namespace {{- if .Values.networkPolicies.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy -- GitLab From 77327f8c7885f471bdf6273c64208a2652370dca Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Sat, 12 Jun 2021 18:18:47 -0400 Subject: [PATCH 08/14] update networkpolicies --- .../bigbang/networkpolicies/allow-external-db-egress.yaml | 0 .../bigbang/networkpolicies/allow-feeds-egress.yaml | 7 +++++++ chart/templates/bigbang/networkpolicies/allow-istio.yaml | 1 + 3 files changed, 8 insertions(+) delete mode 100644 chart/templates/bigbang/networkpolicies/allow-external-db-egress.yaml diff --git a/chart/templates/bigbang/networkpolicies/allow-external-db-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-external-db-egress.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml index 67d040c..79e640b 100644 --- a/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml @@ -1,3 +1,10 @@ +# if network policies are enabled: +# +# if Anchore Enterprise is enabled: +# - allow egress from enterprise-feeds pod (for enterprise users) to pull enterprise feed data from various sources +# +# else: +# - allow egress from policy engine pod (for engine users) to ancho.re to pull opensource feed data {{- if .Values.networkPolicies.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy diff --git a/chart/templates/bigbang/networkpolicies/allow-istio.yaml b/chart/templates/bigbang/networkpolicies/allow-istio.yaml index dd1362b..1e58c48 100644 --- a/chart/templates/bigbang/networkpolicies/allow-istio.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-istio.yaml @@ -74,4 +74,5 @@ spec: podSelector: matchLabels: istio: pilot +{{- end }} {{- end }} \ No newline at end of file -- GitLab From e8f9ad5f7d71248b88b6d5db9f9b83b4f39ee7fe Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Sun, 13 Jun 2021 03:32:07 -0400 Subject: [PATCH 09/14] separate network policies --- .../networkpolicies/allow-external-db.yaml | 20 ++++++++++ .../networkpolicies/allow-external-redis.yaml | 20 ++++++++++ .../networkpolicies/allow-feeds-egress.yaml | 12 +----- .../bigbang/networkpolicies/allow-istio.yaml | 9 ----- .../networkpolicies/allow-kube-dns.yaml | 3 -- .../allow-monitoring-ingress.yaml | 2 - ...pt-aws.yaml => allow-registry-egress.yaml} | 10 +++-- .../bigbang/networkpolicies/allow-sso.yaml | 39 +++++++++++++++++++ .../bigbang/networkpolicies/default-deny.yaml | 2 - 9 files changed, 87 insertions(+), 30 deletions(-) create mode 100644 chart/templates/bigbang/networkpolicies/allow-external-db.yaml create mode 100644 chart/templates/bigbang/networkpolicies/allow-external-redis.yaml rename chart/templates/bigbang/networkpolicies/{allow-egress-except-aws.yaml => allow-registry-egress.yaml} (56%) create mode 100644 chart/templates/bigbang/networkpolicies/allow-sso.yaml diff --git a/chart/templates/bigbang/networkpolicies/allow-external-db.yaml b/chart/templates/bigbang/networkpolicies/allow-external-db.yaml new file mode 100644 index 0000000..eecbe36 --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-external-db.yaml @@ -0,0 +1,20 @@ +{{- if and .Values.networkPolicies.enabled (not .Values.postgresql.enabled) }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-external-db-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + app: {{ template "anchore-engine.fullname" . }} + policyTypes: + - Egress + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + # block requests to AWS metadata IP + except: + - 169.254.169.254/32 +{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml b/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml new file mode 100644 index 0000000..a4f8c33 --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml @@ -0,0 +1,20 @@ +{{- if and .Values.networkPolicies.enabled (not index .Values "anchore-ui-redis" "enabled") .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-external-redis-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + component: enterprise-ui + policyTypes: + - Egress + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + # block requests to AWS metadata IP + except: + - 169.254.169.254/32 +{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml index 79e640b..b56dac6 100644 --- a/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml @@ -1,10 +1,3 @@ -# if network policies are enabled: -# -# if Anchore Enterprise is enabled: -# - allow egress from enterprise-feeds pod (for enterprise users) to pull enterprise feed data from various sources -# -# else: -# - allow egress from policy engine pod (for engine users) to ancho.re to pull opensource feed data {{- if .Values.networkPolicies.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy @@ -13,11 +6,10 @@ metadata: namespace: {{ .Release.Namespace }} spec: podSelector: - {{- if .Values.anchoreEnterpriseGlobal.enabled }} matchLabels: + {{- if .Values.anchoreEnterpriseGlobal.enabled }} component: enterprise-feeds {{- else }} - matchLabels: component: policy {{- end }} policyTypes: @@ -26,7 +18,7 @@ spec: - to: - ipBlock: cidr: 0.0.0.0/0 - # ONLY Block requests to AWS metadata IP + # block requests to AWS metadata IP except: - 169.254.169.254/32 {{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-istio.yaml b/chart/templates/bigbang/networkpolicies/allow-istio.yaml index 1e58c48..c827619 100644 --- a/chart/templates/bigbang/networkpolicies/allow-istio.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-istio.yaml @@ -1,12 +1,3 @@ -# if network policies and istio are enabled: -# - allow ingress to Anchore API (for engine users) -# - allow egress to istiod -# for api pod -# -# if Anchore Enterprise and Anchore Enterprise UI are enabled: -# - allow ingress to Anchore Enterprise UI (for enterprise users) -# - allow egress to istiod -# for ui pod {{- if and .Values.networkPolicies.enabled .Values.istio.enabled }} {{- if .Values.istio.api.enabled }} apiVersion: networking.k8s.io/v1 diff --git a/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml b/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml index dc1db2a..4a4829b 100644 --- a/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml @@ -1,6 +1,3 @@ -# Allow DNS. Due to inconsistencies in how distros label dns pods, -# we just allow all port 53. We could provide better if we enforce/ -# standardize the kube-system labels or the coredns/kubedns labels {{- if .Values.networkPolicies.enabled }} kind: NetworkPolicy apiVersion: networking.k8s.io/v1 diff --git a/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml b/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml index 5595337..5a6ea42 100644 --- a/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml @@ -1,5 +1,3 @@ -# if network policies, monitoring, and Anchore Enterprise are enabled: -# - allow prometheus to scrape metrics from every anchore pod in the namespace {{- if and .Values.networkPolicies.enabled .Values.monitoring.enabled .Values.anchoreEnterpriseGlobal.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy diff --git a/chart/templates/bigbang/networkpolicies/allow-egress-except-aws.yaml b/chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml similarity index 56% rename from chart/templates/bigbang/networkpolicies/allow-egress-except-aws.yaml rename to chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml index 9d4b2b8..1f84cce 100644 --- a/chart/templates/bigbang/networkpolicies/allow-egress-except-aws.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml @@ -1,18 +1,20 @@ -{{- if .Values.networkPolicies.enabled }} +{{- if and .Values.networkPolicies.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: allow-egress-except-aws + name: allow-registry-egress namespace: {{ .Release.Namespace }} spec: - podSelector: {} + podSelector: + matchLabels: + component: api policyTypes: - Egress egress: - to: - ipBlock: cidr: 0.0.0.0/0 - # ONLY Block requests to AWS metadata IP + # block requests to AWS metadata IP except: - 169.254.169.254/32 {{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-sso.yaml b/chart/templates/bigbang/networkpolicies/allow-sso.yaml new file mode 100644 index 0000000..854fea5 --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-sso.yaml @@ -0,0 +1,39 @@ +{{- if and .Values.networkPolicies.enabled .Values.sso.enabled .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-sso-rbac-manager-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + component: api + policyTypes: + - Egress + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + # block requests to AWS metadata IP + except: + - 169.254.169.254/32 +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-sso-job-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + job-name: configure-sso + policyTypes: + - Egress + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + # block requests to AWS metadata IP + except: + - 169.254.169.254/32 +{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/default-deny.yaml b/chart/templates/bigbang/networkpolicies/default-deny.yaml index b3240e1..a6a043e 100644 --- a/chart/templates/bigbang/networkpolicies/default-deny.yaml +++ b/chart/templates/bigbang/networkpolicies/default-deny.yaml @@ -1,5 +1,3 @@ -# if network policies are enabled: -# - default deny all ingress and egress for all pods in anchore namespace {{- if .Values.networkPolicies.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy -- GitLab From 0af3c57ff8d0830955a26b795a400ed96ac41c22 Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Sun, 13 Jun 2021 03:34:40 -0400 Subject: [PATCH 10/14] fix conditional --- .../templates/bigbang/networkpolicies/allow-external-redis.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml b/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml index a4f8c33..ac54da2 100644 --- a/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.networkPolicies.enabled (not index .Values "anchore-ui-redis" "enabled") .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} +{{- if and .Values.networkPolicies.enabled (not (index .Values "anchore-ui-redis" "enabled")) .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: -- GitLab From 1f812119b6193a95db80f15121ccccf3f8f5ac60 Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Sun, 13 Jun 2021 04:34:12 -0400 Subject: [PATCH 11/14] fix conditionals --- .../templates/bigbang/networkpolicies/allow-external-db.yaml | 5 ++++- .../bigbang/networkpolicies/allow-external-redis.yaml | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/chart/templates/bigbang/networkpolicies/allow-external-db.yaml b/chart/templates/bigbang/networkpolicies/allow-external-db.yaml index eecbe36..73d5d74 100644 --- a/chart/templates/bigbang/networkpolicies/allow-external-db.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-external-db.yaml @@ -1,4 +1,6 @@ -{{- if and .Values.networkPolicies.enabled (not .Values.postgresql.enabled) }} +{{- if and .Values.networkPolicies.enabled (hasKey .Values.postgresql "enabled") }} +{{- if not .Values.postgresql.enabled }} +(not .Values.postgresql.enabled) }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -17,4 +19,5 @@ spec: # block requests to AWS metadata IP except: - 169.254.169.254/32 +{{- end }} {{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml b/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml index ac54da2..6cd2f5f 100644 --- a/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml @@ -1,4 +1,5 @@ -{{- if and .Values.networkPolicies.enabled (not (index .Values "anchore-ui-redis" "enabled")) .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} +{{- if and .Values.networkPolicies.enabled (hasKey (index .Values "anchore-ui-redis") "enabled") .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} +{{- if not (index .Values "anchore-ui-redis" "enabled") }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -17,4 +18,5 @@ spec: # block requests to AWS metadata IP except: - 169.254.169.254/32 +{{- end }} {{- end }} \ No newline at end of file -- GitLab From e4584a0bae7f3760eb1dae61330451ab26df0e6c Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Sun, 13 Jun 2021 15:47:35 -0400 Subject: [PATCH 12/14] fix typo --- .../bigbang/networkpolicies/allow-registry-egress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml index 1f84cce..3210620 100644 --- a/chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.networkPolicies.enabled }} +{{- if .Values.networkPolicies.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: -- GitLab From a7ccce0d6dd68905b0d468b4547404623a7c2679 Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Sun, 13 Jun 2021 16:49:24 -0400 Subject: [PATCH 13/14] revert to original NPs --- CHANGELOG.md | 1 - ...ress.yaml => allow-egress-except-aws.yaml} | 8 +- .../networkpolicies/allow-external-db.yaml | 23 ----- .../networkpolicies/allow-external-redis.yaml | 22 ----- .../networkpolicies/allow-feeds-egress.yaml | 24 ------ .../bigbang/networkpolicies/allow-istio.yaml | 85 ++++++++++--------- .../networkpolicies/allow-kube-dns.yaml | 3 + ...ing-ingress.yaml => allow-monitoring.yaml} | 10 +-- .../bigbang/networkpolicies/allow-sso.yaml | 39 --------- 9 files changed, 58 insertions(+), 157 deletions(-) rename chart/templates/bigbang/networkpolicies/{allow-registry-egress.yaml => allow-egress-except-aws.yaml} (66%) delete mode 100644 chart/templates/bigbang/networkpolicies/allow-external-db.yaml delete mode 100644 chart/templates/bigbang/networkpolicies/allow-external-redis.yaml delete mode 100644 chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml rename chart/templates/bigbang/networkpolicies/{allow-monitoring-ingress.yaml => allow-monitoring.yaml} (81%) delete mode 100644 chart/templates/bigbang/networkpolicies/allow-sso.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d4614b..937cd7a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ### Changed - Bumped upstream chart version to 1.12.16 - Fixed insecure SAML configuration issue -- Updated network policy rules ## [1.12.15-bb.1] ### Changed diff --git a/chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-egress-except-aws.yaml similarity index 66% rename from chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml rename to chart/templates/bigbang/networkpolicies/allow-egress-except-aws.yaml index 3210620..9d4b2b8 100644 --- a/chart/templates/bigbang/networkpolicies/allow-registry-egress.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-egress-except-aws.yaml @@ -2,19 +2,17 @@ apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: allow-registry-egress + name: allow-egress-except-aws namespace: {{ .Release.Namespace }} spec: - podSelector: - matchLabels: - component: api + podSelector: {} policyTypes: - Egress egress: - to: - ipBlock: cidr: 0.0.0.0/0 - # block requests to AWS metadata IP + # ONLY Block requests to AWS metadata IP except: - 169.254.169.254/32 {{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-external-db.yaml b/chart/templates/bigbang/networkpolicies/allow-external-db.yaml deleted file mode 100644 index 73d5d74..0000000 --- a/chart/templates/bigbang/networkpolicies/allow-external-db.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if and .Values.networkPolicies.enabled (hasKey .Values.postgresql "enabled") }} -{{- if not .Values.postgresql.enabled }} -(not .Values.postgresql.enabled) }} -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-external-db-egress - namespace: {{ .Release.Namespace }} -spec: - podSelector: - matchLabels: - app: {{ template "anchore-engine.fullname" . }} - policyTypes: - - Egress - egress: - - to: - - ipBlock: - cidr: 0.0.0.0/0 - # block requests to AWS metadata IP - except: - - 169.254.169.254/32 -{{- end }} -{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml b/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml deleted file mode 100644 index 6cd2f5f..0000000 --- a/chart/templates/bigbang/networkpolicies/allow-external-redis.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if and .Values.networkPolicies.enabled (hasKey (index .Values "anchore-ui-redis") "enabled") .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} -{{- if not (index .Values "anchore-ui-redis" "enabled") }} -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-external-redis-egress - namespace: {{ .Release.Namespace }} -spec: - podSelector: - matchLabels: - component: enterprise-ui - policyTypes: - - Egress - egress: - - to: - - ipBlock: - cidr: 0.0.0.0/0 - # block requests to AWS metadata IP - except: - - 169.254.169.254/32 -{{- end }} -{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml deleted file mode 100644 index b56dac6..0000000 --- a/chart/templates/bigbang/networkpolicies/allow-feeds-egress.yaml +++ /dev/null @@ -1,24 +0,0 @@ -{{- if .Values.networkPolicies.enabled }} -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-feeds-egress - namespace: {{ .Release.Namespace }} -spec: - podSelector: - matchLabels: - {{- if .Values.anchoreEnterpriseGlobal.enabled }} - component: enterprise-feeds - {{- else }} - component: policy - {{- end }} - policyTypes: - - Egress - egress: - - to: - - ipBlock: - cidr: 0.0.0.0/0 - # block requests to AWS metadata IP - except: - - 169.254.169.254/32 -{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-istio.yaml b/chart/templates/bigbang/networkpolicies/allow-istio.yaml index c827619..fe17541 100644 --- a/chart/templates/bigbang/networkpolicies/allow-istio.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-istio.yaml @@ -1,14 +1,11 @@ {{- if and .Values.networkPolicies.enabled .Values.istio.enabled }} -{{- if .Values.istio.api.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: allow-istio-api + name: allow-istio namespace: {{ .Release.Namespace }} spec: - podSelector: - matchLabels: - component: api + podSelector: {} policyTypes: - Ingress - Egress @@ -23,40 +20,53 @@ spec: ports: - port: {{ .Values.anchoreApi.service.port }} # anchore engine api (default: 8228) protocol: TCP - egress: - - to: - - namespaceSelector: - matchLabels: - app.kubernetes.io/name: istio-controlplane - podSelector: - matchLabels: - istio: pilot -{{- end }} -{{- if and .Values.istio.ui.enabled .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-istio-ui - namespace: {{ .Release.Namespace }} -spec: - podSelector: - matchLabels: - component: enterprise-ui - policyTypes: - - Ingress - - Egress - ingress: - - from: - - namespaceSelector: - matchLabels: - app.kubernetes.io/name: istio-controlplane - podSelector: - matchLabels: - {{- toYaml .Values.networkPolicies.ingressLabels | nindent 10}} - ports: + - port: {{ .Values.anchoreCatalog.service.port }} # anchore catalog api (default: 8082) + protocol: TCP + - port: {{ .Values.anchorePolicyEngine.service.port }} # anchore policy engine api (default: 8087) + protocol: TCP + - port: {{ .Values.anchoreSimpleQueue.service.port }} # anchore simplequeue api (default: 8083) + protocol: TCP + {{- if not (hasKey .Values.postgresql "enabled") }} + - port: 5432 # in-cluster postgresql anchore db + protocol: TCP + {{- end }} + {{- if hasKey .Values.postgresql "enabled" }} + {{- if (not .Values.postgresql.enabled) }} + - port: "{{$v := .Values.postgresql.externalEndpoint | split ":"}}{{$v._1}}" # in-cluster postgresql anchore db (default: 5432) + protocol: TCP + {{- end }} + {{- end }} + {{- if .Values.anchoreEnterpriseGlobal.enabled }} + - port: {{ .Values.anchoreEnterpriseFeeds.service.port }} # anchore enterprise feeds api (default: 8448) + protocol: TCP + - port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }} # anchore enterprise rbac manager api (default: 8229) + protocol: TCP + - port: {{ .Values.anchoreEnterpriseReports.service.port }} # anchore enterprise reports api (default: 8558) + protocol: TCP + - port: {{ .Values.anchoreEnterpriseNotifications.service.port }} # anchore enterprise notifications api (default: 8668) + protocol: TCP - port: 3000 # anchore enterprise UI (default: 3000; note: Big Bang has configured Istio to use port 80) protocol: TCP + {{- if not (hasKey (index .Values "anchore-ui-redis") "enabled") }} + - port: 6379 # in-cluster redis anchore enterprise UI dependency + protocol: TCP + {{- end }} + {{- if hasKey (index .Values "anchore-ui-redis") "enabled" }} + {{- if (not (index .Values "anchore-ui-redis" "enabled")) }} + - port: "{{$v := (index .Values "anchore-ui-redis" "externalEndpoint") | split ":"}}{{$v._3}}" # in-cluster redis anchore enterprise UI dependency (default: 6379) + protocol: TCP + {{- end }} + {{- end }} + {{- if not (and (hasKey (index .Values "anchore-feeds-db") "enabled")) }} + - port: 5432 # in-cluster postgresql anchore enterprise feeds db + {{- end }} + {{- if and (hasKey (index .Values "anchore-feeds-db") "enabled") }} + {{- if (not (index .Values "anchore-feeds-db" "enabled")) }} + - port: "{{$v := (index .Values "anchore-feeds-db" "externalEndpoint") | split ":"}}{{$v._1}}" # in-cluster postgresql anchore enterprise feeds db (default: 5432) + protocol: TCP + {{- end }} + {{- end }} + {{- end }} egress: - to: - namespaceSelector: @@ -65,5 +75,4 @@ spec: podSelector: matchLabels: istio: pilot -{{- end }} {{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml b/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml index 4a4829b..dc1db2a 100644 --- a/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml @@ -1,3 +1,6 @@ +# Allow DNS. Due to inconsistencies in how distros label dns pods, +# we just allow all port 53. We could provide better if we enforce/ +# standardize the kube-system labels or the coredns/kubedns labels {{- if .Values.networkPolicies.enabled }} kind: NetworkPolicy apiVersion: networking.k8s.io/v1 diff --git a/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml b/chart/templates/bigbang/networkpolicies/allow-monitoring.yaml similarity index 81% rename from chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml rename to chart/templates/bigbang/networkpolicies/allow-monitoring.yaml index 5a6ea42..8eed2e8 100644 --- a/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-monitoring.yaml @@ -1,13 +1,11 @@ -{{- if and .Values.networkPolicies.enabled .Values.monitoring.enabled .Values.anchoreEnterpriseGlobal.enabled }} +{{- if .Values.networkPolicies.enabled }} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: allow-monitoring-ingress + name: allow-monitoring namespace: {{ .Release.Namespace }} spec: - podSelector: - matchLabels: - app: {{ template "anchore-engine.fullname" . }} + podSelector: {} policyTypes: - Ingress ingress: @@ -27,8 +25,10 @@ spec: protocol: TCP - port: {{ .Values.anchoreSimpleQueue.service.port }} # anchore simplequeue api (default: 8083) protocol: TCP + {{- if .Values.anchoreEnterpriseGlobal.enabled }} - port: {{ .Values.anchoreEnterpriseFeeds.service.port }} # anchore enterprise feeds api (default: 8448) protocol: TCP - port: {{ .Values.anchoreEnterpriseRbac.service.apiPort }} # anchore enterprise rbac manager api (default: 8229) protocol: TCP + {{- end }} {{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-sso.yaml b/chart/templates/bigbang/networkpolicies/allow-sso.yaml deleted file mode 100644 index 854fea5..0000000 --- a/chart/templates/bigbang/networkpolicies/allow-sso.yaml +++ /dev/null @@ -1,39 +0,0 @@ -{{- if and .Values.networkPolicies.enabled .Values.sso.enabled .Values.anchoreEnterpriseGlobal.enabled .Values.anchoreEnterpriseUi.enabled }} -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-sso-rbac-manager-egress - namespace: {{ .Release.Namespace }} -spec: - podSelector: - matchLabels: - component: api - policyTypes: - - Egress - egress: - - to: - - ipBlock: - cidr: 0.0.0.0/0 - # block requests to AWS metadata IP - except: - - 169.254.169.254/32 ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-sso-job-egress - namespace: {{ .Release.Namespace }} -spec: - podSelector: - matchLabels: - job-name: configure-sso - policyTypes: - - Egress - egress: - - to: - - ipBlock: - cidr: 0.0.0.0/0 - # block requests to AWS metadata IP - except: - - 169.254.169.254/32 -{{- end }} \ No newline at end of file -- GitLab From 4ecb0b62721f677a6f804e604c265bc4b16bb42c Mon Sep 17 00:00:00 2001 From: bhearn7 Date: Mon, 14 Jun 2021 01:13:41 -0400 Subject: [PATCH 14/14] update dns NP --- chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml b/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml index dc1db2a..17d27b1 100644 --- a/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml +++ b/chart/templates/bigbang/networkpolicies/allow-kube-dns.yaml @@ -16,4 +16,7 @@ spec: - namespaceSelector: {} # all namespaces ports: - port: 53 # dns port + protocol: UDP + - port: 443 + protocol: TCP {{- end }} \ No newline at end of file -- GitLab