From eb96237c8894e1563b9bbd02c159b11f96cf5b75 Mon Sep 17 00:00:00 2001 From: dekiel Date: Wed, 12 Jun 2024 23:12:49 +0200 Subject: [PATCH 01/11] draft 0.1 --- cmd/oidc-token-verifier/README.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 cmd/oidc-token-verifier/README.md diff --git a/cmd/oidc-token-verifier/README.md b/cmd/oidc-token-verifier/README.md new file mode 100644 index 000000000000..0f97df03a7ad --- /dev/null +++ b/cmd/oidc-token-verifier/README.md @@ -0,0 +1,28 @@ +# OIDC Token Verifier + +The OIDC Token Verifier is a command-line tool designed to verify and extract claims from an OIDC token. It is primarily used in the +oci-image-builder pipeline to authenticate and ensure the integrity of the tokens used in the pipeline. The tool uses a provided verifier to +verify the token's signature and expiration time, and then extracts the claims from the token. + +## How to use + +To use the OIDC Token Verifier as a command-line tool, you need to pass the raw OIDC token and the issuer information as arguments. The tool +will then verify the token and extract the claims. + +Here is an example of how to use the OIDC Token Verifier from the command line: + +```bash +oidc-token-verifier --token "your-oidc-token" --issuer "https://your-issuer-url.com" +``` + +Please replace `"your-oidc-token"` and `"https://your-issuer-url.com"` with your actual OIDC token and issuer URL. + +The tool will output the claims in a human-readable format, or it can be configured to output in a machine-readable format such as JSON. + +## How it works + +The OIDC Token Verifier works by first using the provided verifier to verify the token's signature and expiration time. If the verification +is successful, it then extracts the claims from the token. + +The tool is designed to be used in the oci-image-builder pipeline, where it helps to ensure the integrity and authenticity of the tokens +used in the pipeline. By verifying the tokens, it helps to prevent unauthorized access and potential security risks. \ No newline at end of file From 0ae37112e3b9ee74c5a567bca72fbdb5cba3d03d Mon Sep 17 00:00:00 2001 From: dekiel Date: Wed, 12 Jun 2024 23:31:53 +0200 Subject: [PATCH 02/11] bulletpoints to include --- cmd/image-builder/README.md | 2 +- cmd/oidc-token-verifier/README.md | 20 +++++++++++++------- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/cmd/image-builder/README.md b/cmd/image-builder/README.md index a9a327d5ab6d..d5c221c2cc7e 100644 --- a/cmd/image-builder/README.md +++ b/cmd/image-builder/README.md @@ -287,4 +287,4 @@ To use this feature, make sure that: ### Environment Variables File -The `--env-file` specifies the path to the file with environment variables to be loaded in the build. +The `--env-file` specifies the path to the file with environment variables to be loaded in the build. \ No newline at end of file diff --git a/cmd/oidc-token-verifier/README.md b/cmd/oidc-token-verifier/README.md index 0f97df03a7ad..36f9117f4d16 100644 --- a/cmd/oidc-token-verifier/README.md +++ b/cmd/oidc-token-verifier/README.md @@ -1,26 +1,32 @@ # OIDC Token Verifier -The OIDC Token Verifier is a command-line tool designed to verify and extract claims from an OIDC token. It is primarily used in the -oci-image-builder pipeline to authenticate and ensure the integrity of the tokens used in the pipeline. The tool uses a provided verifier to -verify the token's signature and expiration time, and then extracts the claims from the token. +The OIDC Token Verifier is a command-line tool designed to validate the OIDC token and its claims values. It is primarily used in the +oci-image-builder pipeline to authenticate and ensure the integrity of the token passed to the pipeline. + +At present, the tool supports only github.com OIDC identity provider and the RS256 algorithm for verifying the token signature. ## How to use +- authorisation env var +- expected value of the job workflow ref + To use the OIDC Token Verifier as a command-line tool, you need to pass the raw OIDC token and the issuer information as arguments. The tool will then verify the token and extract the claims. Here is an example of how to use the OIDC Token Verifier from the command line: ```bash -oidc-token-verifier --token "your-oidc-token" --issuer "https://your-issuer-url.com" +oidc-token-verifier --token "your-oidc-token" ``` -Please replace `"your-oidc-token"` and `"https://your-issuer-url.com"` with your actual OIDC token and issuer URL. - -The tool will output the claims in a human-readable format, or it can be configured to output in a machine-readable format such as JSON. +Please replace `"your-oidc-token"` with your actual OIDC token. ## How it works +- the oidc discovery +- the token and claims verification +- hardcoded trusted issuer and workflow, link to issue + The OIDC Token Verifier works by first using the provided verifier to verify the token's signature and expiration time. If the verification is successful, it then extracts the claims from the token. From 939f1b2ecd1099403a96d070c1b38a06796064df Mon Sep 17 00:00:00 2001 From: dekiel Date: Thu, 13 Jun 2024 20:23:17 +0200 Subject: [PATCH 03/11] Documentation first version --- cmd/oidc-token-verifier/README.md | 58 ++++++++++++++++++++++++------- pkg/oidc/oidc.go | 1 + 2 files changed, 46 insertions(+), 13 deletions(-) diff --git a/cmd/oidc-token-verifier/README.md b/cmd/oidc-token-verifier/README.md index 36f9117f4d16..47d77f819968 100644 --- a/cmd/oidc-token-verifier/README.md +++ b/cmd/oidc-token-verifier/README.md @@ -1,25 +1,37 @@ # OIDC Token Verifier The OIDC Token Verifier is a command-line tool designed to validate the OIDC token and its claims values. It is primarily used in the -oci-image-builder pipeline to authenticate and ensure the integrity of the token passed to the pipeline. +oci-image-builder Azure DevOps pipeline to authenticate and ensure the integrity of the token passed to the pipeline. At present, the tool supports only github.com OIDC identity provider and the RS256 algorithm for verifying the token signature. ## How to use -- authorisation env var -- expected value of the job workflow ref - -To use the OIDC Token Verifier as a command-line tool, you need to pass the raw OIDC token and the issuer information as arguments. The tool -will then verify the token and extract the claims. - -Here is an example of how to use the OIDC Token Verifier from the command line: +Run the OIDC Token Verifier passing a raw OIDC token in the `token` flag or in the `AUTHORIZATION` environment variable. +Token passed in the `token` flag will take precedence over the token passed in the `AUTHORIZATION` environment variable. ```bash oidc-token-verifier --token "your-oidc-token" ``` -Please replace `"your-oidc-token"` with your actual OIDC token. +See al available [flags](https://github.com/kyma-project/test-infra/blob/main/cmd/oidc-token-verifier/main.go#L45-L55). + +If a token is issued by the trusted issuer, the tool will validate the token against it. +If the token is valid and the claims are as expected, the tool will exit with a status code of 0. +Otherwise, it will exit with a status code of 1. + +Apart from standard oidc token validation, the tool will validate the following claims values: + +- `iss` - the issuer of the token +- `aud` - the audience of the token +- `job_workflow_ref` - the reference of GitHub reusable workflow used in the calling GitHub workflow + +> [!IMPORTANT] +> Trusted issuer and allowed workflow reference are hardcoded in the tool. +> The issuer is set to `https://token.actions.githubusercontent.com`. +> The workflow reference is set to `kyma-project/test-infra/.github/workflows/image-builder.yml@refs/heads/main` +> This is a temporary solution and will be replaced with a more flexible configuration in the future. +> See [issue](https://github.com/kyma-project/test-infra/issues/11000) for more details. ## How it works @@ -27,8 +39,28 @@ Please replace `"your-oidc-token"` with your actual OIDC token. - the token and claims verification - hardcoded trusted issuer and workflow, link to issue -The OIDC Token Verifier works by first using the provided verifier to verify the token's signature and expiration time. If the verification -is successful, it then extracts the claims from the token. +The OIDC Token Verifier is designed to validate provided OIDC token and its claims values and provide a status code based on the validation +result. +The tool is not expected to be used as a long-running service, but rather as a command-line tool that is run on demand as part of a bigger +pipeline. +It reads the token issuer and verifies it against the trusted issuer. If the issuer is trusted, the tool proceeds to validate the token. +During the token validation, the tool uses the OIDC discovery to get the public key used to sign the token. +Once the token passes standard OIDC validation, the tool verifies the token claims values. +Then the tool verifies the following claims values: + +- `job_workflow_ref` - the reference of GitHub reusable workflow used in the calling GitHub workflow, + it must match the value in `Issuer.ExpectedJobWorkflowRef` field of trusted issuer. + +If the token is valid and all claims values are as expected, the tool will exit with a status code of 0, indicating that the token is valid. +Otherwise, it will exit with a status code of 1, indicating that the token is invalid. + +### Activity Diagram + +## Use Case + +### oci-image-builder pipeline -The tool is designed to be used in the oci-image-builder pipeline, where it helps to ensure the integrity and authenticity of the tokens -used in the pipeline. By verifying the tokens, it helps to prevent unauthorized access and potential security risks. \ No newline at end of file +The tool was developed to be used in the oci-image-builder pipeline, where it authenticates and authorizes calls that trigger the pipeline. +By verifying the tokens and validating its claims against allowed values, it prevents unauthorized or malicious image builds. +This is done by ensuring that the token is issued by the trusted issuer and that the token is used in the context of the trusted GitHub +workflow reference. \ No newline at end of file diff --git a/pkg/oidc/oidc.go b/pkg/oidc/oidc.go index 0530207b2886..0caadfb74e0c 100644 --- a/pkg/oidc/oidc.go +++ b/pkg/oidc/oidc.go @@ -196,6 +196,7 @@ func (tokenVerifier *TokenVerifier) Verify(ctx context.Context, rawToken string) return token, nil } +// Claims gets the claims from the token and unmarshal them into the provided claims struct. func (token *Token) Claims(claims interface{}) error { return token.Token.Claims(claims) } From 4e431e1c9f082116a2627c672aacb88a2e793a5a Mon Sep 17 00:00:00 2001 From: dekiel Date: Thu, 13 Jun 2024 21:16:37 +0200 Subject: [PATCH 04/11] More code comments. --- cmd/oidc-token-verifier/main.go | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/cmd/oidc-token-verifier/main.go b/cmd/oidc-token-verifier/main.go index df4887719b14..5d7756bba5b4 100644 --- a/cmd/oidc-token-verifier/main.go +++ b/cmd/oidc-token-verifier/main.go @@ -42,7 +42,7 @@ func NewRootCmd() *cobra.Command { Long: `oidc is a CLI tool to verify OIDC tokens and extract claims from them. It can use cached public keys to verify tokens. It uses OIDC discovery to get the public keys and verify the token whenever the public keys are not cached or expired.`, } - rootCmd.PersistentFlags().StringVarP(&opts.token, "token", "t", "", "OIDC token") + rootCmd.PersistentFlags().StringVarP(&opts.token, "token", "t", "", "OIDC token to verify") rootCmd.PersistentFlags().StringVarP(&opts.newPublicKeysVarName, "new-keys-var", "n", "OIDC_NEW_PUBLIC_KEYS", "Name of the environment variable to set when new public keys are fetched") // This flag should be enabled once we add support for it in the code. // rootCmd.PersistentFlags().StringSliceVarP(&opts.trustedWorkflows, "trusted-workflows", "w", []string{}, "List of trusted workflows") @@ -50,7 +50,7 @@ func NewRootCmd() *cobra.Command { // if err != nil { // panic(err) // } - rootCmd.PersistentFlags().StringVarP(&opts.clientID, "client-id", "c", "image-builder", "OIDC token client ID") + rootCmd.PersistentFlags().StringVarP(&opts.clientID, "client-id", "c", "image-builder", "OIDC token client ID, this is used to verify the audience claim in the token. The value should be the same as the audience claim value in the token.") rootCmd.PersistentFlags().StringVarP(&opts.publicKeyPath, "public-key-path", "p", "", "Path to the cached public keys directory") rootCmd.PersistentFlags().BoolVarP(&opts.debug, "debug", "d", false, "Enable debug mode") return rootCmd @@ -77,10 +77,10 @@ func init() { rootCmd.AddCommand(verifyCmd) } +// isTokenProvided checks if the token flag is set. +// If not, check if AUTHORIZATION environment variable is set. +// If neither is set, return an error. func isTokenProvided(logger Logger, opts *options) error { - // Check if a token flag is set. - // If not, check if AUTHORIZATION environment variable is set. - // If neither is set, return an error. if opts.token == "" { logger.Infow("Token flag not provided, checking for AUTHORIZATION environment variable") opts.token = os.Getenv("AUTHORIZATION") @@ -128,12 +128,16 @@ func (opts *options) extractClaims() error { logger.Infow("Using the following new public keys environment variable", "new-keys-var", opts.newPublicKeysVarName) logger.Infow("Using the following claims output path", "claims-output-path", opts.outputPath) + // Create a new verifier config that will be used to verify the token. + // The clientID is used to verify the audience claim in the token. verifyConfig, err := tioidc.NewVerifierConfig(logger, opts.clientID) if err != nil { return err } logger.Infow("Verifier config created", "config", verifyConfig) + // Create a new token processor + // It reads issuer from the token and verifies if the issuer is trusted. // TODO(dekiel): add support for providing trusted issuers instead of using the value from the package. tokenProcessor, err := tioidc.NewTokenProcessor(logger, tioidc.TrustedOIDCIssuers, opts.token, verifyConfig) if err != nil { @@ -142,16 +146,25 @@ func (opts *options) extractClaims() error { logger.Infow("Token processor created for trusted issuer", "issuer", tokenProcessor.Issuer()) ctx := context.Background() + // Create a new provider using OIDC discovery to get the public keys. + // It uses the issuer from the token to get the OIDC discovery endpoint. provider, err := tioidc.NewProviderFromDiscovery(ctx, logger, tokenProcessor.Issuer()) if err != nil { return err } logger.Infow("Provider created using OIDC discovery", "issuer", tokenProcessor.Issuer()) + // Create a new verifier using the provider and the verifier config. + // The verifier is used to verify the token signature, expiration time and execute standard OIDC validation. verifier := provider.NewVerifier(logger, verifyConfig) logger.Infow("New verifier created") + // claims will store the extracted claims values from the token. claims := tioidc.NewClaims(logger) + // Verifies the token and check if the claims have expected values. + // Verifies custom claims values too. + // Extract the claims values from the token into the claims struct. + // It provides a final result if the token is valid and the claims have expected values. err = tokenProcessor.VerifyAndExtractClaims(ctx, &verifier, &claims) if err != nil { return err From a6b955fc8e481ae2bf11a90365e290a256d51048 Mon Sep 17 00:00:00 2001 From: dekiel Date: Thu, 13 Jun 2024 21:19:50 +0200 Subject: [PATCH 05/11] Better describe tokenProcessor role --- cmd/oidc-token-verifier/main.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/cmd/oidc-token-verifier/main.go b/cmd/oidc-token-verifier/main.go index 5d7756bba5b4..a2359bfdbb20 100644 --- a/cmd/oidc-token-verifier/main.go +++ b/cmd/oidc-token-verifier/main.go @@ -100,7 +100,7 @@ func isTokenProvided(logger Logger, opts *options) error { // It returns an error if the token validation failed. // It verifies the token signature and expiration time, verifies if the token is issued by a trusted issuer, // and the claims have expected values. -// It uses OIDC discovery to get the public keys. +// It uses OIDC discovery to get the identity provider public keys. func (opts *options) extractClaims() error { var ( zapLogger *zap.Logger @@ -138,6 +138,7 @@ func (opts *options) extractClaims() error { // Create a new token processor // It reads issuer from the token and verifies if the issuer is trusted. + // The tokenProcessor is a main object that is used to verify the token and extract the claims values. // TODO(dekiel): add support for providing trusted issuers instead of using the value from the package. tokenProcessor, err := tioidc.NewTokenProcessor(logger, tioidc.TrustedOIDCIssuers, opts.token, verifyConfig) if err != nil { From 16a1bfe962acb9e7dade9a159e8ae165ecc08650 Mon Sep 17 00:00:00 2001 From: dekiel Date: Fri, 14 Jun 2024 18:18:26 +0200 Subject: [PATCH 06/11] With activity diagram. --- cmd/oidc-token-verifier/README.md | 2 ++ .../oidc-token-verifier-activity-diagram.png | Bin 0 -> 119274 bytes 2 files changed, 2 insertions(+) create mode 100644 cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.png diff --git a/cmd/oidc-token-verifier/README.md b/cmd/oidc-token-verifier/README.md index 47d77f819968..d8ff1e22c774 100644 --- a/cmd/oidc-token-verifier/README.md +++ b/cmd/oidc-token-verifier/README.md @@ -56,6 +56,8 @@ Otherwise, it will exit with a status code of 1, indicating that the token is in ### Activity Diagram +![oidc-token-verifier-activity-diagram](oidc-token-verifier-activity-diagram.png) + ## Use Case ### oci-image-builder pipeline diff --git a/cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.png b/cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.png new file mode 100644 index 0000000000000000000000000000000000000000..f2e067ef79cbc5f5fc6ced2264d1c9c59763be3c GIT binary patch literal 119274 zcmeEv2|Seh{y$Pt+DN5EDpEAEj#6aHnk9@iBnE>Sj9rB4RFo2->`S&0B1=eGElIZQ zTV=@-l`KW_|2)jdiF@z4=YQ|Hr}I0#&XIZMS-#6>eShAcCvR0{*%iw+E~BENS|Kkd ztwu#flS4(d_#NF6IC9V~x*YzZwo{Xpq)L6UxtEFxD`S6H+aB+1inGE}aR^Aw{Kmo0 zYi@04&mkbq!Owr#3Ttdnv?jo>a2#)Kf-}WoO=iC1=j9hf@uE?Df*O2i4gm>10py1u zk09?p-I?=^%&-LVjg+iiaaLAF9Q-muJiKtLT}npAID);kojHeqBz%@9*ki5WZ#WD; zRn*~!HvG@WYse>LD7+hfm9Vj~!fIhpDB|pqy9fyL2%zEcE=4&Fr6U~tQt-PK&JqiM z$zqKyt&vMih(=C4IBPhaUyw(LM*t2z?aFPrk9OC6c3!sI0_<4olo9|PV5#U9> zf@A7Nrba~EoW~)nfVDR=n^^&QWerUMS0m+piZ-T4v>b>yg?(l-Gk3%i?QpPc(~C%X zIC8PQiw$<>s0r2)XAC1jj@lU;S&lkyt6FP$i`gB z+GKhwOq|J&-zNYMMTTkOGIN9vjTW3aVn(Dqi2PjSfI7~VG8yuPW)3(LtR4B{nJewB zt*z{FHorb-Y)v45!2Rk(BO=k->DQ;3T3eB)M}Dde%=}juAqUjwEh=(U3uj^vGKUB^ zzW^dZ$i$E@6cYbpQUfv&%u8RlNV7+qqzsh%WN#{6cnSs*;knf?B3#f+)}; zWXT+jtQ^Q|K6Aj%-i0E=SQA)%@<(f;y}7lSHNnX0@b{yVL~93v$+RH>VV3-U&Jk;C z8(3RDIB0>jw|60nl97YGH5@Xx$6JxVh4~R(wBZ9Uj}Uw_{ZR+`NckX*NbmPgh~y%l zDEs|=fyirSXYD`)b(|KA1?NpZ&)$e=h9!&1g6DxPLDmOZgPFTcU--|(;JYx$V!=GY z)Zh+8td)^H&T;Nt_<4=UnqW42-mfjgd=Z;_1hMg|)?jzx_GIlA5EkUwzh7|w?4Oz8 zlQo@Rm@Ge(=gv%@d=F%v|5{FG1|R?iS_Ui(W!(RKLC9xMtH!@NbDjn*xGm)E`=?@S zWd#Na)?3oa9A}SJw=tR)2q!R#aBPn78QIy)SSeGSGa|&2;6bgVtgWnP47LF8^dC4r z@5Fy7e&8_dvE(iJy#hnoQK9{?qrcupA@VjleYbuTqi#OO?op0Wc6+Xr{g$o%FKpXy z*|+b8Mf$rb`Hz~Lf4Fb|(ro;6=0NCIk|XpVGXNAbAVDM=A?A%DV>XCAvYUD6Ph(8L z^8Mfht!?Zf;Iregx37! zNMrDBNGvFc7zrFiH4@}6@Hi6_#OF#9v359DqZ8Bq7x8lBH3erTB*`Hp4M*k+@WNJ- zqHaH$BYs|TY({+4DJef7bD!Ajtl;tdXDnU-o+xxwAGkwF5^!y^lYQ z+>xWwf9l2l`_>TajI-AU!9>C|CTkHzuxDJ-?+DSpYb*I;N{oo!_v=Rr z3X(rl9{KY|h2*uHqfkE@a>R}!SpiJ>y8-|H+n?8zQ*6b5-;{$T=c6RdWU2hymV?Al zQu+m5E!jNHk-QmSG$$?~np@*fI6%fXH~FvwJkD|!#(?baf0bqY+9n7rkYZ2{%}p^V z$0(-b4^1&7loj_o3Ch{X+X$IS7&%CxOiWc#^JBSr8-e(S|1zL4^UNQd5Q0qo4y1yN zYW-`^H@$_wBZT|SAsS*e|22*^jST!JbA9px%+W0=BG$+r0f#lQL8S4W3{V#C>ezLostF#NR z(7pvt#ZRrp3);a0K&gSNLP()Pzkj#3X zKL4YH`PU|W;T@iy`R~|JG60BV)`GtV04Yh%Z#LY&<>~YD1&UMuljqh8ira69$Nm7r zv!HJOT4u8&cgw-YCqOnGf7=SANW8FxrsUTDqzL+_PTmCPm5BB)5HnJ8wYec9Y4?+X3Mk@?@DA0;K{o3CG#x(WnZkiQv2WgKB8@tPU|dFd|__st0M z|CjYf&kOv>=*Hj195Ln#hd=YKm z4#vh&oel(49M%c3+q_OVpy&bwXpX@9P^7g&*fzj4=QSr{ zO{Yt@lxnTHy*)xW1{Spp{AUK&Ih^1zwgwip4A8u>R;UvI^*X>Odm}swA&(>6amvN; zn;CLv4GAT`08fXq z0RR0mu8{D49w_zC{vkh^ViANFun7E=V{=7@pKK2QCnB?;U!0##%-f|u4BJ~k&F4aS z3yz<>6LS;91rr(7#0B7Zg)+?mbs+ z7mOdFeG1Z#-{IT;JZacJoBtf&J#Rz*Y(am^5at)e$+!xdLbM@U5;TRwO9_$x^PF8i z-X8*k*)C4XGiUbVckqP&z*epWWn_M({)dR}&)KRID!!R`7DFw?)2R3cc>_wKdd-Uth(d)E5@Ml=4M-S+P_&)R{>u&1~tf;9qh z0lWprWT5{Mkd_&Dw1D#hk48Ra1`&fx$P`In$>aHtx~K)Cbqc=tAN5fb2Qe2%p&a{Td=wuqC6*;SseKfLkfNl2J1KDR z2nFhgj{OC#1DQlKC*=OoNg>eWpS-bT!I@F)-XG$o1cd%4jU{9+h2jH?GhG>^=)j-c zQ7wq8{D$oB-*HrkmH!=%YGxgOFq*#)SD{4D|1z84o7TeL61x9snT-poAY}pOSeMxb z2MweFS(RvQjJ30a7ZS|YM}9OvMg*jIGDD~NYqdk{f+B@Ho%xKaNEcZWz-S(f+-rriyn6bToLG7InbkAz9io7)PCMz4FwIjST z2~l6uX(gu6S7w_Z9Ht9~P|U!Y7{gg6I6Gr&P-YkS9gj6OHzMHd@I3P*%u#$wUqY<{7P&2cql}HKe^Va zA@e75v}6j?Tt~YwIyrsfUr=S|bGW3;;YF{YmN?TnYC9VsPj?6ZqvpP!O*_%^a@u_h z`qZB!r=_53bE2ks2J|P>PqM|CtDg%)H-AyC&jKwMhn?+-M({RYvQOm!G6N0|o^pnT zCq?-L1ZfB4EF@x_18V$iD*9upDzG5v^wR{r^CP5rJM@!jD7m~oS3?)}pwp`S7xbVM ze!+Lv?5{kiF}y+p;llII>Z!RAynUFT7we3??sl4MKW(u8dcm$B!rVdZ&!0U(UD&0} zC&bLtRZ7bN)Y`!$;~a7Jken~joAPIWlQG{cm1@pbQF>J7;s}&ue;y!zegHdfmwqyf zN-j;zwWtdV==9Y8f);gtZAJ}igdhbJ5MeeOF@=A20*=qTtq80r&IDdZHhbpJ57eXQ zp?>=)X!jgN<>&j~#Xr-m#eeWmGEf+e-~aiGxxzaAE#)8FnE8Ty0a#1mKq3Fa1M6~2 zKPoCVDtT!M4QGRQ1xxR)Jv>_Ip~|;C@%m8)OUa|W{UNHy?kqRGbaB6t_|r>KJn=%t zD|dB=**(fMRb|*9{#1x-Kiu=Up#`2L_W;PffTu54SbzJM@VP30Oy_ z_7eE8&#vt*T0%`HPDQiYlZuv&%8QCFQ=G7#a`h?xURn zDou$;W35{5+V0E^cj>-?k8tTu?+Vg;fo^j)ZniDnl4AGv1@4?=^USWmt=O1pO7L9T zlNQ5GmT6gbFZLJT|2A%ESrzlkUH(EV9OP_u+{N!Nnz}rZV?2CKvH>^DH?smg~4cn{~ zl$@p_hA!^9G*L-Bt;m!6&OUwjmHDy~LCJ~{8=qX%A#@HwrHiUoT`zN=H zcw6fHO7w{*7oLyD?w|~pO?3rzXZA*gi1(k0Hd$-er|L5m9FSC(stYbNaQk?;t_{7| zr%;NleSW)P$m%V<_VIf5`VO_28_!aLb`JN|mMM#lytH3(IC*w2*_ObWO9b0jR&8N4 z@R%HV{#X}&4*as-pyZyR$k|y<^j!nWe0>wXIXi3Xsn6R!UEOo{)oHZjyN2fzaZ}-5@r@~-;F1{+} zu>N?t%QL#I6yvcLL}mA*auSX!N9St%R>}k1V9&-QqPgBA*M~I!vQD=IM7N)7yUBXW z32c6_O6W~5l1A0i@;Pqhw7Cu%jzpsmyTDpnvg!HFPF^j(si4BG%aec(fqB2S%zKg!yeN4a4sAstq$ou_)ta^i_ zvBOJehZwaE)Dx9?usz4P`0{9#?A9BD?xA()`eSxCNKYQ0TcMb|yy=(OZApi9O0W9j z^a^xQ$w~S8K^G$F;fk$dEt)#mK#hqg+u2d9K2Js5bUviGm|^q2%GQUkinn?kIruF1 zZA9}6k^VggI{l;=twWc5pEo1Sn|+sSUD3zlt=3w{Y!Anr=1v#wON_ncG4(CNH^^qz zL_e4Uv$RBHlg2~Qp^_c=ARW_mZzj$n)~+zS7r4U7(NKNY-Z%{_WA#pP%4jmSd$yP! z&RaQYzJgE@A=`t%}%Wj_4=dF1u7a~ z+EyJ!zINLWe0na>eDKqA<1(K7TMoU|PaWG_%=%k$?Yv5OH7Mhh+~(PG&cF0}hdG!> zr5pSl-Bp{vJGrkgi}AoK&toMB0xxaesL!;=KhNC6>j52Gju%H}-D|d-EJkAw%6QzswvC5{ zGn|kj2zVY@PkEw=3{`G9LssOLZ8@j9e@Ue5%mrDhT;F2U_1ItgSYCn7>{m5Zf7tV0 zEyq5m?hM*LYaiuk6I;$*E8k!&K`<8YSWTJSJr3}0p&?c@QiMCNkL;bDoD@v%+?|{P zww$*3a}Q=GCjpbAM%|S1Yxc`1)utR4CoC6R>eqZ)h3ed@8J9qJ2?SqT(sIj6q8>Nj z=y|g4JTL=OP|;Y*hVDc!DzT>~`wwwb#CWStG_E1`n;BeKMlndvaM-!!^!{bJD|QAl z(2@^RN2nHU7AM?TL>cT^Y0qbPxyDO;>kzBD(u?viJ$P77Qt3`!#5fJpP#%VcyISo# z*}Rpge2?9NthVDMFjOVt44J#gvD^w%PrG+eZKQw*9?rWTn0EZ)#iU#urHm z5f+o&fHaw-uzE z92=}Dv39*$$v+zd%0)m7cu@Vl-nGggLihov?5bGV=FcBH@Q`@46{~nsG*CQ>4=gJ6 zTN#Z4)K*uGaugfmIR=Wpv4LWVGwSs7K1RgEg&_n#RMqW6qHEI!XkdQHMdvpUvaYDfn#c_$lCpL}T zOz_`!x7RLVDP_^B!A8cH)tA+kac67T6dYlied6jfVCEL-My$deF)bNRYA8eSuwUs|ijfv~YVDww<`z;1C?Zm}?@Tab8inw&bPJ~`LsKgX!E!nGgaQ~6r+b98v-)aa2xB2M^btKD; zZ`9IsiJlE@zrv!9Up-HX`Jm6{ekF~ol^6o}`i*egoKI@Nl zVXIeu@Oc2IT3-kuVSs5kY%J6A*?N3P^Z^*GW427f- zUocX4hn{I?13hQh@jEX>lC$v5b*`iDaH~Xz{SIg{Yhm=jnBdjpkJvJ|@#yC@L`j^n z^5zJ#iOKmoRE9jjOiSM(5S3Xe>G=8e`R2<92KSZA)$3ZKPEL;0r|9Jn93jPR@}yp5 z_3D9F_J>EynHH>tdq*y2>TQ_a<%?Q0NoYgo*NgjKCI#r*R~;rCF^hE1cAuIY z8yt&t8}hd7c&V3z0p9``zvEM8t%d*)YquS7j#U!h}q`uUDo1*1)6rHN0pAD#U0aA`9nD{oDly8^Yc-`}5j zaeuszyV)W+#j2+=I{Ve><>=e204y*)*?a%#m+FH^?@-@OoScUv(j2Ep}cUvipq@TYQg z^YaMjH{QLc_R5IRU&w~XSVbc_!ir!%CXfyV$`Q)MO^R))abptPdwC zxwPKxyixzWmUD2c$JeT+Ok4*kWjyVPZFZyS9X{itee{8Q`ZDqin8qja-`}_NFErPY z% zDg<-%WFJ4Uj)kntVJLCK{V&~{Kyu5%UMhzOmU@pKmEF?yWTN8GRHi|J zYp%ioB*;C|*@lIuQn!rkHo`avH$?y{;X_Q`0K@(0L)3G1Q@_zEBogRH+}IVp+w?0K zjt`+=A8k(!8GLzu@++%~?{TRBaRq*kvv;2JUkp%nf87hYjbou!oTj0l&rPk`lGl&V zt8nHpHslZHm7$a>M_cSF8n>O_T+NnKMIRf)Ztm?xN-#Y2B@RJ?Qd7=vJ=IWZf$PfF zAb@qS*6IzsZE;|7xMl#pF!$5L{E~KWNMQoBDeU=+LsMUs&vJBD)y2xL%Aqy-_;h`a z@#X#T5`&!^5JfAqX8e71CzStMmt1TZX))e(J-%Ur<6BQUe>sbL1UF4llQy#nC zVpf0JnDe$Kdi8601C;{-mNx|SJZSF1mZ???t53Eo2}F@omVC zJIY)i?$}g{QF3rG4Adx%?$it(@t7D8t{GaK;?xRSq~GOuW(C>?^U}7XDE9!zW~UZg zLTd^w#!y7>xYy!$5d07^uhen_&yp;Xvjwf&Pfg%CLrJGBa!<35KVeeIymIJU1Loog z$8AVmbGz2)ej-i6a+~F>)1FYc9joWnTc+o)hweULYV(QB2yz zQjXRTJ-ol3d#U1Su8*~-!k7UVgU!^YflZSJ+mo_izBnRK{<4!z=JICTrxypTV}nN= zxKX7J$(kw0Mzjom+E%#>9OU_c$HG^KQ4yQtula4G@)CiFsGlw}b(Nun9 zy63%%Xjan&KpbFdz=E+wyyOe_f~Og6lW+GqoLxyx=M161$S#(%G+wk|Wa-6knK6wp zK6f3_Q>hzXK}~m79)dA}v`eJB;P0r2ky+-Zt%g*)PtdLQ^ehG;zY-v2zIrC|EiabJ zV0>|F{Nq(VK8W#*U`UUjbH{S=z=)z+5>OGioUN){8T|WY#0yfm4eg z7V*NO)4)@f`eg#_(IaCt(I*mNoL;b)ixtpPC|Ypft8w2v&R88ezNY!K z679L=)O3PyX+ytoAPu#;y|_xmqdn_I0fFacrc8g|bfqe$}M+#k8lAFT9vJ@abF9hvW-1T_(L73qy_3ue{AX1#5LGZ4iO5O8k zTIv)oO~Ptb(y8XIK*e54=z(XSuAqX8m^@!Y)Te=91M?9G$sOWd=*&y}5i!V!#1_p0 z7OJ_}mEvr?un5QLQylh{;8UJ7K!!qxpr)1l&zyafk+Co!7g28zqh%BC0$gQ2TEr#@ zPnIg%)v;RynSj9G698fS6$bS4>_81>I(?RnQw-**1VD)h@M5`9wLb$(u9E*wJXj-_ zZBb+QzfDf)0R+0S(=pZ;ozYfsvKev%EX2K~WvUmLAix5lUFW6%nj1;Qu$5*pM^qf0 ze{-VbCXD5X9ecsz!;f!o^E(NGH>lolkD4u~yrZ}Zbo~^4&tzJ)Of9-_KL-)Xx%57` zAUC4nb)#E*T^u)pek5L-{ebCo^isg-02}+bN6}HZb_4BnD*d>GJ9ZZuU+U$2n?`cC~izcOxP=0AqP4eaWrN4TQWT*>QPo)4&SB|Na zji{pP-CcTJHejX7RE1!kq|y*T?2 zB9$zcgK62bNeve2zi3)6OM2;ggX{Fr1@T_YO4|C^C!K6-JJCz!6$GR^(MoxlE4-3u zWAv14Zv?VXdo|HXV~&M0DA+VoszcQ8&$KKFJ9e&nF|}A&f!rdA&g zB}))kGN|WNl48xWEy9oPTI!ZgYU)}u$Dz(rwCk{WsQYLmzUuJ$lyBmzM!$Y}8#w^A zkxY&t?ML0$jaRPP{>+0euFO?C!f(pWl#iwpz5E&Lm{*Hy*k;KxQLoJ49S28Vs%Jy8 z(A*gI-4)QA*ZtQR$Yc+!)ThKNDK>ZYWbt7bqa3Q1Va259Yqjp8ERskmD<_rFoGf zIZP@CZ9~vO2ClgN+T`FZE}d5i^d;0wHy_4D&S4nSs7 zPWX1GLd>qC6_*fBB5*SvBjsRra1UPwbg1T#1B#6~?z9TcxyWT+dq~;-PgfoKT3H8K z$djVm5Q8-vUlBD`L}gurf{xq9T=)KzoR)S4;ezumC*KzgE+-4h>gIrG`VEP&1G=ie$HXP!`0)9q%0a_W3d4-ba}USQPyORgRFx zHSJCaJAq&W`1Ggi2J8JDOHnp!Wb0J2{$$yi zmO(%kF5~Tl`80W+#s#5tBg99t*I7JmS)YqCZQCT{J8hi4zNC{T>h&s`K*h|?ew$ZK_MZiKBc<4(OBb5Sv{nWZ$P zQ?N0Y(>I(?YdxO-Zn<3#dTfXPE zr@l*9AP?t>m}dz?-(DPe-*5{M5UJe253F|2`37laGWI^SZq81zR8ic@Ua4~M<5?u9 zLOXvresZK%O9?Y%7U5E4dIP(T^V`(t;zLI|d|B-#o~}1+03Efi*LMm}$*fl3(ZEDu z^fluQ+=S3u@<;0Q@=0HykoN9PaEpalV%|5vnC==2wXY3Umds4zN{RIN(zV`6Erw~` zQ%1axOO2AS1Lorv$A*Vn60!w3L7wc?vnKo%c|cI~tn%u2_SdVQ%wLvj)QP@(tq#rB znT$8T%@fza= zq;pjnwDOgoDh|Cjc?0WUk5TlF;o+zdsy~+9LM&^9s=NNvqqU0kMoAZN$C?aJMEj(i zm3No9BB>-vU~V@!IUuw`GK<^xnDgsj@K7qunwos?p`588?0u`#uvSICNUIC2%NpIa z+@FvB_E~x6w+cjVJ_CGKtyLp7I15R<=|j=-VO)1CoZ@eo5;1xM$rg5*hiiL_IyIT~ zQ_@p1_eiPTea4l17t7?Y_cSqJMfinXX1*ALkS5>$cefu~K{eXGn&fsdnixa6Yoe0j z(i43?&m%;IwDDp+z+G>-o`jf*D3=|GQBvdncuf_G-f49t47U>}jrW}=>SgTq#GBYf zP^A6kK$Ul=<}Ja!95GE#hCV!A<%H2LH%`C%`OU=?knn5(2J)|83pKBi4<&sP(W&|t za>hqCu!U9BwV^j5lF(6n#fg)u%5s-Tw*3G~Yjd(YCs+5W56$-VmLjHOwYcTmFT9pvN zq-d@Ur70vA(i?>(90b_F`zf~{EvvbtPfR+c@lgG#vj6r*jWGF=fpX#YcR?$z5g0d@ z;(VNQ#A<=+i!zu&n20CiH}=Fl2l;l$kClj{wQ}1gR0Z*QYd3&_jnubWU$BsV;#5` z<>e=>D8rH0l(|F)@16F>?@4kV$>&y498-9;l1B}_AJ>$~QB}+o;2IfV=1TObwNDOY zDKQ)HsgG##>-)C!nV5s^wC7ybq)}eSy!5F-ULcR6>bs2>>-a1uz!8RRuso>Sq;@}D zaNEb6WVTJxgfmAhN6y3mqQX6TRy>O~#J?Hp(9bcg>>}g**KR5ixgXYGE%i@m#wi8v zr4Qf<)*3Hhmj|iyYw61<Dp@PEs^;`W1{~(X;48~qcmWx{8>Yn zE@sXH{`%g|y+kUED6?H=ozNR5Go901k^ULr>Z&oT6ooOUEPE-%B`-wBj&YihHdrtT zV`#EyC2OU$fMtYx>lXC_}#{01lbb9g*EgYG&}hRO-+zG$a}A#jjLnKGx>WgW78 zBOQDIv%^9DkiTB|ZMjZN)=T0U1!A&K3aO_nG)O@1h(mRB+~Ov7KSn2%N>v8cNP-(r zM#=U;Gv5UJn&5VghwJv1#*qpb4JL0fE&X_btKbcKM{aGHpL8-YnVXTZvs!7O=WLuk zcVIJu?_gfUa_p&M3;<~PvA*c8cE4te_FsGowi5N;ef{)H#_6|_uM?z>%k<-8t;-dU zV>kjCsYxF!vPUx7$G=1!_1(&*FF@2si}zO_Bqm#4Ac zIuKSimxIf{!Mx_9Zu0JrmFw?jw>s)+F<-7zC5}P^R@jFqNiUJ^fLKPicn}AaT5xsiqWcVtwxbfSmw%PW^30Hz2oj*h(CamzGs@* zjm|rBrmmr{`cx)Pl*Co5%gW{jvy|iI$PwASdrI;~P;eqCnTZ3xu`noA?!{7u4X^52 zWSFbfaxq;P%iyeG>ELnZfV$BjYs-|Zp!^e29E(E^C8y?*k{kL>WVER4GorsFaV+X0 zChujCaq3xp0CPhq4fCbm%{yq@u64G1f?ulT)_$$?*32~38cN-NE9-U0rxLu#`=il0 zJ}u`WUhgcD?V8SG6C{tz5V^gNa%d2@ukn{lA|_;A8BgP>>90N+ipICN%Ij~e>l#uh ztnbn*P2t(SH@DM2Rg$yn>P=FgUS7AO3^93>LqOLxDl4=q-Y1b=aVSnK^U9O12IDIZ z!D$>9^E!`xOBvfoOzty#q7*2V75(gXof|1+S82dLjDNG7xDa8>dbn>t;Fr&M2IXjD z)8(mZtTlcH3siPBpw>rS7#F_(Gk$0;Z?43bj%RJN0{GR6yT9uP@7nq?5E zhZl+V+ozyi)}?8R@ol*ju1UvT{WC~*myo^q$-0N z6X5WO-6-&b#W#6BW_ZiKxZ14%zNc|aG+ol$Ngr{k=1MurV)ijHU!qS=26;%RV8$ST zF7}l$98y0dBEw0edq27hUA4aMnQ>&5C3oO@0pD(as0@{5a;z65hHh5WJuNPMTxRP7 z-KnHy=Jq=JLs5Ddm=8Q$-d_#|bxMEwA1S#bMDHW33( zei7KVQIblyV6O>jxX!4HPxDig!kOjxZh*!@)7&^%QN+-FY8%grKkgb)7`v;q{0iv; zDJsc7*(a7OH%~yE@pPc(^UUR5x&Y5*F>-f*Lp*UCuf*A-YyentR#zl&=Us+?LaJGe*pdEobDla+(p-t3~_XedW&^ zU-K#pb7<71k0rNUJzMPpbFLCKm(scjs;v)tm8e^pC3ECza{3$$HCk&lbG|BA)(B5I zgz~gnJIjO)R*cshdMJ%i`DDJ~vdF)e?Gy5)smQmbu88|?!PVwhYR^0mvOQR8<0@ad zh*nwbiwS3F-lnsJ;GjBGsi04F0f4wmo~27#MLmzBsGz z=wl?_J-IBHb=Pf(aYI=b-&%T@VT;I1O>Lva`A`~bardab&+7aE!lb*j4YYSlB?Gh9v5B6h}e9z#K?DK#8&<|@d=ZEIrB$og*VV%145E>`dvzN;;2 zpgqO@tUonB^`zT7$7cN7n`*1pI72MD@k0;&2@6?|0ID=d34BLmIlYsJ`4E`rbJ~pn z30MBsW%cK-45_Taw~Du0ZXHR(GQ0X*k9dGkUv+@c(dt%p&nOuHTCAxCz(gtM)E-O# zEX^4lUF%ClY!-ACHE{S;F6_jgJP=};YD+`n%#kNxz8nPVacldq=Q2?)&9XI6s*_s@ zK0D|(@SF2wU(2Z6tF9^6$g1to=ePuwxqFt1L&*-Au5PL0jgT+uk7%ySuiW8Owsk@` zZ_jJUZ!I&oV!SZ!kcVouik{=R(=@#6M60!SM-AG%k_{;l>KpnPLIp7uJ(423G&!bB z^McldAra!Gn{sBCY}#QVZ_jV(|P z^-1ocYsxf{2>xn~Km^3($(%;hO`I9JX)iN6ykM_NtHf zU2TpxEUD^O*bk_i@iaWXf^5KK*z(+(pxmpq#soY~U4{kj0g~t4XNxBdAStLUtIN#* zJ(QH+b%hOCJep41DmhNdM}JGkE=STmo91l1{x4c(Yc;xRt346Gqtw(GVx2&FA|}PX zFDc>J6k`PtfT32`0PN3!*XOrpBMv%iTeQWkt*9Fp27_z>SRHCOt$#i_;U z%E6%vdi>E1BXRpjF1CR6K3;&w-}AXAOw{Xq7s^83{T&ag&$7e@N?Vkt4DN|iDx(?3 z@}#H)wq#q>l3rVjx(?soM7aA9qmgBbW|W~P+DGbP3{H;pb}0_IK4+oT8jZ$V^xmN0Nx?Wm}(SO`=nS*on9KFH+e{r z@j9~-6i`C9ul?M9wfO~%_u*LHgFNm9@!EJ|AP!`az}V~ zp9Rj$*~3xxE;P(7w~1xu)!U-#FFnzmsx8Whu-|vSiHo?&!jxq_E!!(*FSUo5<8B?z z$-}EJ$jNKi3CLpcRjeIXoz7tydk9jjP49KBbMAWyW3xSu+}Q?@RhojUU^B*Fq_l)?Iyhyd3$$mq8*Zn8s_Kr z56yYE##)z_Jri_2EcvBOt!^su=HUZh9k1$LA>IRwGPhVF6*A&cumO1!V)5xC?;2|W z3f$s!sJI9%TBbj3ZaLRUrVyKf`r@R>CfX}oaXq*t=-Vy6+Y)S7XrC?CGQPm2u8}x& z{pg9yQf&U(TlB`KTvw>3_)1+f-VWwV!A@fA^(Nlqo-2R?j*;i^A5S>BrLPb{7?b7t zx;yi}WY|34Grxt72{63mvOSmkE;Sw@`z-~U_zdE?kO#N7y3=~ru?n$!&Rd| zTM!Yes_472g2rVhTWM`P$1oN<$m0eQ<@$Y&mn&tvBq~Qfwj_eR*gSt z)0KYH*Zz-yF;j!^dTMsCVdAcRXaiHM{A!(!$(o!!uc2ARQ7vIpNFgwLl+OZxeBe|< zLR%s!sl)zI36heZ`ub582pIh>??>*+iavY`_?XoNrSwF@*3FX$z*4MXVW?79rS2m3 z?XxjwwQE?H+o$rkTnW0{Zv%x%CsNG)NUf>-doaN7zs0}J0j;i8PCdVBtJsR^99EQ3 z9nU2r8l7kl{2qtLcHJWrHGt!NV^WOR>5;&DY zI!U)&hi}$JD}0W@()+iXmk%u2WOdxt^b0_7ubYnkq6zTIIdG(3m)O>-Ey5U$SOd1} zcqRJf{X8v`T-qRjG=%P|P3Q)5O9ZOk2Y|XR-B>n9LsF4B_3oQx>&q^z+0h~ftdZP+ zW~dyrpc_q?w7QTci-eOtmm;Lu(}S#5Z4^w5Y2hNE5w@NV;{~psytOZ&xZ4>CajM!% zgt+2#!+=>8pAdN}ub1zNzh0@CJ?>kemVqrJDU!Q1g(G2ylG z&u(+2_)Ezrp4$8IWyfwqfM#$qI$Sw@chn~Qn^%c_ejq;zD0Cm!!zODWsM*D^;sKJ+ zKY1#@Q?ra+5RKANWzPA!#(QJzxaKhgnF8vZbzOf^z)Zkp40qz!*Gg?3zXv@6jKvA36t*ZNvCxIrLOMWN$;*tvfF7dsONa zH=6ZT0;7uw%sTRhl$=T|+q1R8^K!ihw3WMEuc{9G_s?!JC|V5gwO_ zmnp(f^#g(}TCr((vDYwU5WD#_F=~tn*rl++cM#f~<5;UxJ}JIalelY5ZE!mKBY$Og z?{^QEZnb}tU#-BME0n|dz#QctM3+c&3rkBn1waM+nTdg%$mEtjMU(M_IJ)r@!9mpK z-e(B|aY~j}SvxhEP3T7e+|@~+tk&~N+MeulJBYc(V`_3x@0KnxTB+X_6Rp`b3I#NK zOP8$3vv==-zrKc01y{s`GrEQ#Y*AGvs1)uz_Kt!2Ju>KcIbuToj^|KINIgwb3hv-Y zHZHo9jszi1Io9o~y+(sS0N{JCMmlaJ*Z%}+P38LPkS6x5KH0Iewfbwg@T3@U%Fj@G ziCL589w^buJfmsRbAd(*Bq3Vq)eBEysQ|AOi=|<4QgNDQajF7M7pox7wg;?c(U+IO zckDxXTNit+m?nSrsXzqlvGM{HjXZET0&d=ToIQ-q7|KfDzj?_t)AIr_6?}a!FWN?C zIGe0rOAOs&>3W)q_AAgD#&4{TIW2w+ZhegCwfTI@5`VdK(0=d)hEya|?6vv>palI` z-HheSa?39Zi9&(*6g+40`SPO@YzW_kCs+Kk6k(A(`(xngo&dQtj_nYqa|SZY2tTTE z@h>f=#UT+uEIb4=n{EeL9Sqg);A3pX+j6|v{f$8LX4-~q*=X;qa{Aif;>B&o6bf+Ea9k;ktCp-h+ZLPsZ3i*4xHx0;5`QFfHrmeZIX55$fKDnJN| zblJv5_XL<7MI7r(Y)kNL-XqJbP>W^;Jvoj<V_dI_>3%%z+UOaUI^LeZYRzD zmANa}uQC9G=%S?KUfOxW0g(`?~(%VvG?umlL4Iog$REFR+Zk^ zU~9tFb_S_fZX|@gv8M8*;jq|-(gB%G_|CSa?a;Ll%8ykrO|M)70oWe!VmcAI=1SIm zae8lGgyV;Ms?gA#(N<}9RpK;shK4AziBw(T$~>B-c}TXpxkYRrD>O!|f)GforN7Ct zH`Eo!b}zbK2xSj+R+A%9U!@QALElo5chmtocEHn=HkccPBoD{G*yL)EAsYr$VWi~> z@3Hfbq}6Hi6n6&?InrgA(^l60(nTswkE>?`+{B&L7#5rVGQNz-a0bjeTJDur11IKq{$0`T!7-({Gpg*mQH152-A#NX2A%7~I zNn&iZ9MV6ty5t`EvDD_Fko|Aq4*uJ3e=ORRAAgR4#a|;Ja}iu|706?o(?WJ|Q`|G3<0e($ z&TX%#A!IniZn8zvHri+0**>y{yDomy8^1o}TC6YyD?x4!)TFan*%3aNTLxRNWeQ+Obnpz*rtO@3I?2FEOzJ(a2g6W#HbJjA;lnKr? zJMbVHtK|a3Qy%H|f5R0i!^;FH!y&xC8?$ljZVUDH;}GUJ)7Tys8nk`52u zbU#%XpDhFQnRw~av7>Iv=V+B_H>{`3YVZ3oWku;4i~5sMv~-Y#T^85f9-^6_yXeRR z%55y@_u{FQ@+WnRp4~@cW3DyREmx7ZpoOO#+VRnm(d$tr91%Jr9g8(i!wJO0Y}_B8 zlOm5jK95-kZtuF^Wfh=JLN^6o@1CKud1PSYdWM!tz4v(I~)-ji-hAG_W| z%sfTwwqCBioc2@sTby5c`DUjS9{TWLkt5*moNXR0OSE)x9QnQRp)DsXA#1j< zOwH{UJX8VgVYZ>&cNu^S$s$f5thYUzp6iZ&``MxcHA!_HES_CnXTw>#JGnIhyHEr&GLAq$f%y^bmB1wJt3K_$X4FF6$W{-nTGd?J*HL@k$iH z{_q(%3oFI8>XEj>qcLX~f$PcPD%o)7Q=^S$bs1PiJ?OAvQt5`5p0xBk%Wz)%2Q6oV z>{C$bpAbBhU|Suz?<Y%G{|VB=K?r105q-ixL|`O)|2n}nt{1EP^)F=uvG!+ z&p;Y*vVoM7?*=b4F&%|=uSR(F$20}8*|2caLFe1${AGIxTeDK0#gif}Z>7sTrh~Vv zC?h;B{N?@KHd{>@dlUwOpA7&@&~)5S1MAXo+bDHXMeNIy>?R9tqyTl~lR4zxIe>&T z4of6G`vje9Z%LJL%>oq%J7%!5kCjrZ8sUWz1192bF_E=f^~OOgpBB-Xu#7F;>UMnT zW*bk)`t`B_xXJ(01aGQnK5-G%!t4(`;o5>a`$uT#uxSRikr{$SYq6V#J7`)0d#v}S zKu9y`E~$xBpVp?R@p=Fu>~9n-3DQ16&*=(4&%Kl3$U8>jnL0oeTO3<#i*Yu$vg&jZ z)+F!|Ti*fTmhw4*{o&h-Zmqox>IRm)CG}; zwWtC@eBU?%6Dya`1G@4q8~0Yok4PQph1P(X$iLnSRvA>bJ zMm|bRb@(A4@KHFg`In;cO$|QWsXaGs0C3F&vf+z$+Q+HKqB&pJF7=~T4&IHKW<`a+ z)Q8TP!N=0uZv?yHSAc^SISsG57*YqEwNg3N49;SF#Xq~Uh0Lid4wQXyR5@&|U{=Mz? zjH%e8U7;HSc><~flP_;MkQdMkZ#ik!FXfudO}h7KY#g%v{<6ZVHmO{bin!2mCEgUH zAh`(JA{L$tKwvB@y1b>IbiltE-Vl?^)elB+;78077)%+-$INTapAoaSS0jG=@>cjl zvRID>OZ6f54aj?L29j456Y2Np2Sr)f#Ep(n-(1B@-vu~PhnV&-b*y68`0={T@{MY;^}=v4)*hSm&UlpSE;z5-fsHsbS`xZMt^J^{LWhFn_z~ z`%q6I==hD+PIz$@AP^)@{*1E0h+)AC`0Jt^0#nYSkz+Toeo1BOpUZy46C zhqW~v{>ENaC!hL6Ps@0?Nh3~E>jry9)tKPRgtomJt-ffK1c^Pz=Ob`S({|;=6$=L@ z$J`qo$*Wm6DZIDcSAq~4^3dVy$u(R#Q0}=Yzpufc^EN^SB>9MK&J2gX#Zl1QeXtJl zzrtF@UfL(|>Ut!*B>5zZ?ZPZp8<7s>dQ8ghStQ3uYF9i6^wI8ftIEu;#SxRmxUC+SU4SxQmjedcNB_H)u~1Dn-7Y-hR3va??o_V9;V- zL!qHsY`kX&=N;gR79Q9i>?a!vz>CWp60uS%Lhg&mUAFw0Wx)Z;X2S70t^uq3hPjEB~J=v}ToZiA^k z9Lx~AYGcZcn)AmXZP3q>8PZR3M|r3QYGSacfJ&^qeznFW-Ny+&*LVs^BC#VbwIwNB zz-;ADQ%u?D)EmF5tLKcUR_V%v4SQ($R-A=SVwc(`dlYjuh8|UZ^`(W*BcN=*k^V54 z|K4%JTtBt0xL;IqD&|>=K``Sn=FP)~;ZOQT;+ZrjkMZO%8e(+c-|blG#4ML4pnTx1)Bb9V2b;CtYkiGu&2vt;K>R zP}#9e7!yAtrajYv8Biohms)OaF!8m~x25}dQb>Cn2-@R3D74_63P0w_nK7G#KYp=C-5?4_6 z>^^PB%}w_H$JA;;-wJODKQ#L-RB7ukBp#$SyU&cR7IvMcq7(Ut@^--K!GlGDI+mS9 z+uSWvNf^^?WDAO5$n+{xF49J|8PO-;W#_M(dLU$es{xaz#+kV~z(|mL*}oN{zf^I+ zc7D>7Fc8m`X?2fTx_eAOW&W$TgpkTWN_T~V_EWKjWZfw<+QOlxk>0I_kC(YY4?1@! z@}r}^!gq9azxGq(hU%G6+06;(jez)%!8!j#poe(6Hp>bMpPfh;JUG89bR0aY8X`^8 zHwU*2L^=<}w|T^kzW-&WJ~Wi4+UBl*#j{OjkIaAUFfXsHqWocp2n1mY~!G0Wg5 z)H3e1C&g0x{S|_oX4E)GDw;xlf#IIXd%}7tk$!$(=?d+o%N)8c12K)Ca_TruMpjft zfo5Fo_Hgj$qirBtv)y!i%^q7R-kN9mR0d&sSD#bni}HW#ngAsM8(Nd_r^z4Dqo9EP z{9AfNdb0s-+A7o>%k%IGLq%fHJz{8dfwS{Pd^5DDWofrulPNE zN6VJN&tCnzD}k3Qoa>&RRNAMbpeg-i;5lZ(U7a-eXv+U0xh)0RD(xGW&zp?4+|`x= zod-g=Df4kf?}FG;_}HtpugKl53S`i-o$O%eA==?|G$N&Cn(o>;~QTabLsosRTd`e$)pd& zqyfCGW{NG|!ZgloX zJBzQs>6*1p)8IjJ7#$XUJB`yo>}BzVCcW>UAdyi1PSLL`K0k2vyF?d0h&OvHF=gE6 z`N!`@gc9Eav@=SsJz!ixPSZmUP`6A-vHI!x-(=_6UUi-VnBh(PkFzVqp{I*(1WxM( zLQ)b8!2+UKjS)wwT=XYv6Dj93C3B8+99evF=x!^Nv{Y%dFbaLxCK_$KSQV((-`07O zbz56k8PdV?5opMSNvX<~WRMQ}UC~=WM4kImX|ycS30N^Y3NNrQqEA!aQLl#SAH7W- z0m!?F+&1euBUQ*lZ}f4>!MLEwv?-m97DL3%jrKa(1iKO9tkWE1s!%OCq|aWO-Fmk4Q_b-kFA)`%ZjIQh5>pe`vGEiS z+Ji_|+e*=oC|argDCm7%8j3`?Oeeb^ z62*^ODhryX9Wq)dA>(Jq?q_=Lu%w(V1zDtf{jmIgvS>P^!C7VV zI5JxSuG0TOc24L8(K5Wdp~O2G7)QJ^p>1w$duz=%crbWtb^f3*UyS z<5(~Es%dAFFuZV&s%9#d^&fTwq1_K=dfVAbd8`zXk(PxHPoBELdG zo(2Y9?yO4p^h0jOBuIo^>g7gmS%XsRTIF;45N)!M5z6%$l*r?AsSK~XTZkiAjg$w`p-Zm zp7+xuO?a0aWgQpcEYCZ!*Zx|ygz@Yg3Cp}^d~j(pSNOUPqCrJ0g4m_W16L?WQqp~V znaV*KiL+6OX8-(Mw9;EdP1Qusf3}`jg|*y^=i#AHcXcQcwb*0muV_${x4KrYVglVnT$LDCk$?xK8+*fIit4*u2IzSqA!9vc;Z1b<@4O*I~TTt zHHX%PnkBu`a+^<}^$)wrMsEINL6a3vwlh{PTn5((?&q8y@!5U1FCO8g513BBX+u55 z=c|Qn^we2F#xp`A`#r9R`a955YdEH9EzWXKJro(~y!kzu?mfd{ciK@WHC!s+&dA3e zBnwL#?H$$UsPwyE*kUe5miLr_yxPVh+jjSQl9f58lBwrio*dj#xhS~T=5!bN&Ve?n zkmh#x*}E&T9BSsbVpCFeGQ9Z=YNPHR!jAQ+?AiJ7_Y@(j?ILX5^+(y?E5HYH=pRjg z6aQ#uA!27C3xgzK_JT=fZ|b=U%fnK)_Pk&F9lKoE5R z>IoN}Rj=gFQtXaBy8#7Zs#8p|i^3;NISHPtpvrURotXh!DGiQ!&VLjkK0?CmiilDx zT?PdE!V|n5!QrwT;yUShY|-3TgrwK>d$SX4ox2NvQae8}u*Gmp;h!T{#(x4{guBPt zPT7SbnUs{<@UuHJphCSS4|z<9LuYb$)C^>*K{R!fySN!5Sr1=G z{CknA;buw_#Nx?qc-FvgDnlQ^-P6iDKxum=q0+gp^#C=i8?a(7yz&5qr4ccrLgIPT zfk9GxLMDId^VSmx6=fKy+_aec*1mto?Di}~-N@ARw!l&@kC-?1jms&X&v@0%J&K6c4sdkJ00gp66I|S08^2mO^Wa)D zr4J(JJ2Z`mo&RhOH6bRYJ{9 z$5o&2Fq=iGrL4f?vX%$n)q4L5;;{247!mqv57vM9)NMyFD2u}JDX|K!3`8?434RL2LioA+fra^@YuV7aun z9*k}X&m(TzeSqn=*i0o>ff!69365{s_pCp^-fSaUWzjEyKD;y0W0HQ2@Eu1GEHgPa zv?6R}NK3#YVvgQHGPl&P`Nz`Y12`y%-g@^J(rE8@N zL?6v-{DKG77L6xiVUj;{ zFMlibc=d%Pmr!`3`1~{&X%XyB7B0BRz6K@m;)E$NQn(D?0C;JsnD+b*LLZsTqm^6@ zkSvqq-J>jSU=8MTIkqJw#@2MwDWP6x>1xBO8B>$sr}*_J5Bxh2k88dfgx#1h`rvFp znm#Z6I3g^rgVNYoJe7zVO%vRf1ylsalqgpLy}61A?3kbE@7XbDn^yWW%e{_p-;%6f zvw_~_PNH5b;vLF<7^2JW;oi=Z;+6LssYAdhOI-LMGPW{RxS!Gd#kSt| zY*_=zoZ&<3gbc{{Gl_yWlnxbNe!}3EA>1p|)YaDnWCT^PP)7*BTzk2Hhqylm{JysK zx}O3p!LpA40`6?D<~AQ?xL|b&kw_=Z0XRx*FP5q-+TsGYqiKEY>$7qi?piNQdrT!Q zjYO~$f`ox%{g2Vtf%)pqMrarUe3&~A0!+U5d7xfRxQb>R0@dSMyR(%*YEU0^Wo zM49j;kvDD56=9uKFMALHfYZlH9taPR#32N@R8qB<@zjO+8@g|7S*_*=ORRb7ensLo z8}#?ode473YWUh*_cZr%JSMz2*EAi3e7e{Zj==U$!s<8y{uqYKsVSr0W3|E z--U6Q%BNy!>H{VsrwjsNU^dT8ipA(j6uOiTQoGgxd(kQhqs!pKtsIy5j|)Kb(Bvx~ zp|2MF5OenD{RE75pveYS2U~eqm5(t(JL65%@yp=($B#=dA3E_FvGBX8thn=6ldBs{}9lB^;r!xOQp~oWibL zunnrDvnvr81H(MxI8>#+a+{SEifKEy-x6JH0xOBfhg?9vOJjMu$mLmKbKFfS#=DyZ zrr3ef#_K=ZxME~J4@&F}+R$}%?tEi=BCGMH59rN50QS1r`T?k^e5)>+4EE2X8V#Q0 zQCp@N77+_wL|-yoEr}aU`NiE?NEB>ER2inj-V*U^(UR4E@7TX1=>kOzgk!HV=6uXI zn~i53{ImS=*BJ@y68w9iBLK zJ-m3Z!^ORH@VU#MnWI!A7ktfQDcp;G^1`cIj2{MR%-_ipDVxFYj$ zk1R&1M=~yYVaH}J(QVSEH@2B}HeBU-OFPs%R{+w2@3X$O4i`iglUhrsDB`hW>MHJY zo!8>AS*(hNLi4RZHL(et+VVRadMrJ>$^!8f`$GP3v4;%dj*OXJf)Vxf#l2sAy`olrxffL&>aUIYW%QannC;2m1jEQtZto^B&NjtUU!@i0sL|JLJuq z%J`jF?XEb(W11)8mkXJIjA28X-AysCppmf4T9JVw=+y(DgE}eh9UPU);t<&h^OTp7 zQ=40BM@f9tB8(|}Oh+faJcvW))VECKOQdA6rgcSzaIy2`Ak>(5|B)zZw?lb7OcoY5 z+B+x0*7o{7F-n4k%y7W0q`ZrdrL|%=s{c+&uY=Vc`iR3kTTi&d6{(wT;^udR!IxDW zhYXP-9e*NG5EUr1rN9#Y){!ia@2=JMH(BEr;7%xK50f9_tDd^mdDrW??VhMcIXE0v zf2HtptIck3#YPsEh#{|5Oo+Dmp{YDz8D8?c=*aW8wnxK(ECORlL2rib+%LWPX)xGt z#Hh#SKvZ>xGNFI&Yw`2H;jJ<&1-&Kq5qXjgE*j|bsk3a%;NAk>n8zKU{v4%E2P~S$-E0Hq|YYkX9Eb}rJ?g*lLT(P z9qb^X8`nMZ!^7yyVUFF!4*)9Nog-B8EKiOS-)LKWO9We_-Kl`3*uh?~kI&16Y|04q z9TzCsSuv3@IJ0vNdUBnzuI~VgI2{@azG=v5{KC6ex8Ri_cMV{fm&VQC{=z5(jvefU zkg7OKJ~x?r&N27z+<<%P-34D}g{OP}|2Ywp z?(ASMU#@KC(&Yn+k{Q=4_%G+wrrQBua?3Nye*&T;tEN@6Ge~Cz|3?N;isc{X@hZQQZ|X0>P2d;l0+RY9UJROSGAe~-Ju@xhkat9N!$kW}G+SJ@BF+$BlJ zww~xH4~!z{!{=_w0w0aZf5*uIK+ROq;j!F-LO#)c{c#hJkd2dxs!1TzJX~%{eMo(-T*$Y{`0(BDK8y z^!laQR)FLLkEIgDUqMVZbKThU)P3Ta?>c!0Pl_ORUDh!axdl}~GzlUM7{v;;`yEjn zB4qVuy_~vrJ9ig*AVjsp-K$Puuew{`eY1+=CqU80B4JO_>7%MEK8bW5prL_3DLD{5 zeBeyvaUEWA&X)tUtdyevHbPCZumlX7V)iPj1c~W?uTN6DLTL%n2P$?Sv0KK!0D}qrh7CDNpZwzxX~leKg+%^Hj6$BS<`|Afg-rUeiLa1i~ZP&t!EG z0=TPobgPiSoN9j$#F7i9>4;q|r0sUmOQXk%kOVXCkV zC%A68!p!tJFD%sY*g@ivW=s_%@gH@5teJv2a|tf7huu!=aRP3*Z%8Qg}A} z8yJ_3HNLt_U0qT&(y{Fe8H#Tc!Z#ACDu*PYPO>xp{TD2}XNlXBY=54C3-K^`rtSpo z+h99Ug{0rwV+gcC6vcV`0twUHm)D1ciZAB*t*B%7pDO$~IPaYpiKazhd|>iLD?cPv zeROr_*^huXJ0`Wbqf!|&}9!D5PrDXx&OjV=%GE>gG3|{b2 zGiz^C-}=HAh-xkfXfpay@1T_nB)mflwtqHLwzjnSGVPH@H(Qx#?Jak(G%htF0%8-9 zfJJy7ttVWEA>6x+7)cfFK{7`lFoqs!38!-hWl;6reFuh5dUjpP!v!EwHDYfDe_f6^ zWtZj%d1S#57oX2kL@b1v?oL=c=OrzG<8u`}cqlu-9J(AwEL3VQse%M?G}8yV!J=Cwu|yf9Q0FR_rM`nN!j(@*4a1?%am zOfb9FKT$azr^z~77))zlS&5j2Bk7L(Qq7}Gz(al_u4nLhwn;=CRqzvX;)~zG2r#b^ zuAg+9l< zgx9}e(#zeWB|;7P&Fd$_l0SPDbnFou=oH6Hq7&gxsQJ0M=jsEPWZwSUia|Tk&xHkl(t~5MAUD7xoJdjyhEtk@`BLA#23zeY3HAtyf!l8?Wsj1)}eyQh+bOk ztafX~is~prd?L5b;U^@$(4hf1=oDi8p6RBE!<=|0SX4Z*Ip9&qIN!ogO%{I5eUM#b?35G?Kh^P(a zyk;&!!;4hcrZe5W--+O(ur%x25mGo>xUvMx8rHp{kWe_Rvz~O-bgeUmhhOn^t{xvv zM~L9m>hMmX;rz~qoqq@FnMd+Me{PJ9|NbJFQTQMk8?T^!UsSgUCq#%BE{NbG2#%X< z^i8>!XgAE{L}m!9?0Ky7gj>J4u1{ZHmVlV-TYImD^F6p`YOEcXtDD{;5N}?| z_i~mD>a)F+m2uDJTHr9Lk zpy?%^(%Obp!HP`_SEJP_S@%Nm!n7jY-?VDm#U=5?e8Z5oK-x06G`nU3`9&*iTQ*}429O_-;$eBzv(#|%xx z9be$>lvQ45>@B~Ue{s*b`==W2dmh-w+r@cBWq%jylpW*in{i+3sIM+I`QHDK`C;)v z!GqrevH>?gEFG$L`7nB3X-pE}JWUL}C_P>R*5ENCl|$_!Z{pRuh@4;1&X@4S_*xY? zb!!}R5Joj`%FM6Y;a7~BUieK4{7s5PH2Y~BbF;e%Ym_P)b&Na$&vQ%7KJj1;&4Ya6 z4Ol{a0)Ey1=q~?-!C8i{b3CCCn%&diuBHVZe3|Wn)g1%}y_Fa%W3e_6VxD@KC(1e@ zxN_i@6@f?MTty;g4t=-1K)o=$ck^I}Q+oY4V1GR$q=zy_duXtnk16Eh#|ll0hDlYW zH{x3NNOKke5d5_A2z4*@@@iz85P_gTQrFo>t>f`9Sy6Yo;XJyd_;4WGYjtk94(P} z-Oqa^T0<@}MG!Z=?yAONTJ_M(W{I_%tDyZJBK_nfkysLrHXnl<;@LqMh%fzCL<8>kaH` z#e)G@=evnCY-dG(NL0!1wGy9;rkvt^`V*~84nK2T?1YjS1F~^VyKrt!b$ouXy2ZoC z*QbTvcnaH1QN@iT9(Jr!TytBn5m~Gx`}=8ijvGy1=e|EWi@x9|(Uf@WTCbw_k2`lZ zH+9FN;-pW+<`@heK;^A)tqs?1s&85CA^og2Xu4k40y|aI)fJUG)vP|IxoOTYue-S) zU!}{(M1N+OCd7}*I2VfUJ`EX4E$n1&K`ok{i=4aqc&gJ8W8_kew3Kn_&DzE(>e;>U z`=keZE5*n-*~vH!@Ha_ju4?4yYU1~Je26Gib8CQSQ$cmsf^?0z~_ zM%Rn=deX6{n-c>zZlo9Uqu0YOQ0y-l18|ea*5mH7eZCn$LQnZ?NtsSMWfM-Y(>I0FymRinjU!$hJ`(T7kwps z&QAt4)+c9ycKj>pH=n7oe3cjdvg&rk{q(rs|8u~ZwG&dd z%L~Xb9c8DQfoy!`t9JuX$ro7i-TFF8FD*=XLkYl~JhsG4fG^W4-gTs+0KoY1C;FK# z@^R58WqYMmFWwcbs&v2%A;>*qNg;Ll(|Cnn8^>K4PCqou2ZNin!)+mLHWkm*n3^@3 zN`bCFdY|1^UJ(~b#K|`Tt~My0(-G){MB1HOs0O4OROvd@EfsyS`ZOta?EUcYXLu_s zeor&{eBnH#N#oBNJFi;O|!S}V!X0(XwG%>DlLIgtvn;r>-i2cJeI~Fk{bB|b?HEy_-i;qruY7(#-NOVHIpg5YrZ;CdByY-A*a&6Pi#6WSjX&e88YU;OQxq$(7BTofn+#;S7E zar#QzUUZDubgt8gH)p$OT{OpI3Z9A9?`T&PhYwM;3|l+POUJq#ZRf1PED^$06U5*O* z*s4jzNq*V;lY#?&)=X1<)L%;R1=%->(c)L6Bc0cv# zMj2)l;r!MmBuR{a`_dc|$+~#3|*(XxUV(SCHG68ptCK4(;x+Tc3+S6fwBj zYEoX-!kyN|Yd+skKqH)~8xp+O6yuA{>z;WLjhv2cyoTna*PrMTZW0X&{PQDE(4DP}Y5n z<~3w@-6Y0`e6$_oYablhn1yhM#JGwa;#cT5<0`P6R8H{*1-}jZP*a+vaCD^ zPAkUq*LtP28nTaYW+XNSZ4I`G6j0h6miL~sFJN$^i@L_;L680O>9y}8<@km3D2D^`uB+c<0i(e9S;Do2*R zA3^=bp-QzDMuK`b$|olsS_DaIb5H2%7cv=-Ae}+gGf>h>-Kw}qFRpdG-1I3a&SFKJ z?x-T?+!UiB7!ZrNemtOjCaKLsk-(#>pSGv@oP3*P^%C6k3f_p6e76&ylW5%YD=~@7yo&2C-~O_xog*+rJ^oU7gz~?$fK!Uwr(Yo*-_X?c$GF zuITksy#>2-fRjcjq^nJ&zb5ZIxpb**8#t1uO@-m)GcfZITA`2bo%qbzLiSlbFjm(7 z4$%@PP1vu$|h^9Tywtn%Zm5IG0%p?iz zFJ?-FrmztX!6+hU2e`z3tS4~Ejh0}f1C*lzO-QMMX4rrq&zLrvUbl(7;rg6wcpYoC zCzfnaT_CRWmDjgVDh0QX%C+57fAFJSgo!qa<$#r&7nJsMK80<*RkO`&6ZxS`3L;D; zm#@Tw8GCQb@uiiLSYp`{uuu5r4>BF@qMR20b4|p%k*ZzfM~CHQJ&(h#nKRO^vGtck z4)sOvLSU+$D?V(gxxX!h=U_U8}(}|unM>Y5Qx^Nbec2y1Sr+Ygl zpR)&T7+$r!hl#o-Ej2x^pKs{Y)xYrLS*dGKtLi3xdqlE`%d!$t2FBOL#AO>ntz@O=B`{vfVihJ-{Z`5a=rcLTb7%Mo&WOH4NmLOyN%`n=$J`<9c}#WoVncy zMJq!2F==pmjO=vjjEFbtwVKuS^^T@SP4>aoUpnR_s2g&kxfJ^0;kihr@3 zCc!y=#4pSB@)pY?vuqy_m>%ZwvlqT*?7qB!e)Z_GQ=0p!|g-C0L{V`_`9+M+yxwhx74JK)G%ZO}x6KPh-mW&No_e z5MOCAHPRYkoV1%WaiiH2aLjt=wT!OOrJXhvB6HxQVHlM$_U}-nk>uYESXap<1gg7S zR#Ga-tLKIY2ZkxgHZ7dV6*2{PkNc3NCXHIXmI9geCbOiir7E^6uOTjS{S{ zzs{Ln=AsO(;b)fR&J^AGJrcF^l5zOA1YdEoeJ7z8eE%&Rf5n|=vpb0JjU-x%9xe#~ zZJ%(6c0`>Izq1?cvy&BY(Bx=pVU5cJ<7b`lkrJtKg=T;6mnNi!GIRzNKU(7`>#!PD z!*6`YV2oksS<-}b?S5dY^}W*vStoM3))Sr9|1N~FC*WE_Nm7!Xe5v>D)bJ-9FL3#L z+FlesT^Y~HL5L1WHa4?`?{lC4x1hgKx^M{1Syf#6hbbA)Pyc(F|L;a~-_x%U4*0Oh zdF9VKEah}<-}v;(aBcUUh5rgdx`$C&ckzcVSe3AiVxc2C7WyhmI#ULItn_urIlXG+W znV^PpqECvo&#BaCMz*&l5h^Y;fA55yESxTu$a~NH2)!=5w11~x#0aDA`8WT~QDtRZ zkvGlZ5aLWpPSwkE(Q=%BXLkVyJ3;TQiNm8uJ;iB71W2#5-w|Q7X#FCa#PN01*@ja6A)S;65?^k@M zjU|5hhQ5Nb_`PDsEQTB4CA&mtQ0h7SyzPjxZ1OboIw&F{ zh{~5D+YtQ{Yo+d0`mGWmk8RwuWOzFP*XOB~8CFQqr1%bTjSD-fcH-J@eJboe-Q`g}o0q3Py5iXF@?!E@YJ6 za>zKdfR~2BYRUeaXU@L?;-G6QCTavb>$<7g*j%ULU(HHWO&K1VAJ;m=sj3iXcpwb*ASi)f;zektbr+E4PurDO+8AweKyy=euYeo%@>FW zt-V=JJRqJaz%yveV{hRJd|B&FwF5 z)6>_n&t4v2oI*MP>D97cXIBgoxX78qrxaS~IozTDZ9Dy&_k37Sc;$ZhbRvykJ)uV2y>*f14N@jeK6*3p zD4Qa2*%|;c3|H2M;`B*-HV@YiWqGSfKN{C3sH8n6T5fHRKt?uZeEzIMAYQ5z{H&{< z#p&9|dvJsz_11KNsK#zli8{Sm1%$Z-^ypZK2gL^=n9u*d1&*I05fOVNu%ZX@1E7uY zv#-z&Y4Yc0HE~Afm$tkG^y3+W5{k=YBh;Wo1gTE9#%T4j;&ew2*uDJ)6Pk^e2uxVJ zx70jLd%#t+2x-7P2E0?pADW}+M+hn%uz1q*)yTz;BDM)TJjwKt2(SB+=DL8? zWHYs8;_U6i+eDi+EudkP-X{K>Mr4X$ZUX=5oV#s^VJfe`R&e7xZ3lktYP{3K8$I2K z3jyGUn-z*gKIb3wmDOOgYDXJ#NIqnP~U5*z7kP=}ye_c0fNq+#O}6O1*`Fz~kR3^JrVJLiAHh z{Z98PpNsXwc9E$qLp;?wdiagtOQw9gJC{(%x%QHG)gmjozGtQx!zWYDmfdax(Ziz8 zXjgc`gH z=bL`@Q0Vwb&v}b@FNU#&dT&>dasil!`d~|2&|G)g7~|0@X?RsSm990}wrM0leSI0h2a^A#ze?TR`iSBHFXajZ>dc5KH zraMFo_1Quk8rb7<4_{L$N4k!E#-BzR4;oq%O3>EM`wG+zV8aba&=l2=okZBwATsI5 z84DvNCo;00B$0)wMvy!6u0+;q-Oavg^DSI_y2JgU_bI6G>rR6&OoX=R>nFKd*vs3& zW`C2Z#JHOzDY80)ZjtJya5oMKgn!V^ZKT2BuX%>anUgaz5I72hq{x#{Osd5f#z|{) z*hTyr;Hkz-kg44heyw}FdOnUR2aBdfNp9ZGkH65d&sdHt zzvC1O81XXh%f6u!pF}m`^;(>kB9nlY;!}UF=$pTLg3aR?m9e7p+|nW;zifI@ZEqahU$7ZE+Tcgx z$Is1CIG^sK3Yxg@)MTC&w(f~iBfnpT(9L@mH*r{=YW3~$!rQx9gdiF!Mtr#RfX=jf z6IK$Zr4A_uvqF+Firw3CCqoNs`-3m6jj6gh?qW_M1!_X|b0GG@R(|nUva&AbBlw%W zgRt^BsD|Zp7Eo{#%J7j*)_SD)e3tmgVRnODBZKS1QBtwrjdm~`E%u28D>hIpZDml=a<;APYwr?i6Dpfw6Xxn| z_y44D$WtRUYgMIRay$TAum;}ORg(n%95yRFDrv1iH1}q#kunA^Hs7~K^+Bv9%U_22 zM$}!Z<2hRqM6;P-dr6_4Md`g0g#QQF(G}MPv*`D8`ZcnP5`Df@ovM!Y8)NFhWHoiJ zUDr!~7t=L##+z&C_pwl>@9a3Mu6tKjLNG&UJYjL+M-;R8Ir*?!1Os~gV#s*Lv-KQD z1ha_8TIbMP%yAmo+{5Aeg|YKGp~)Mh!JtGT*|&I{N%H*s!DjuIMCmiJF3n6#l3|CO zg`YWO^i-uf4pO+@dq=3ru`!a&*)EJ!vU|s@YJR!r?!w#&wV;jp)o9ysroV}OF4Xf9 zIE(z%vm>BVS9BdGc?Nkgv}7T@>)FK#*|{|2fPDt6L6cOo| zL*>yTtA&XvaPRf?13PzySN={e!Bx%PBSxBF(ol=BXTIoDKLP~3F(6xE<2O5mo(@Y9 z7J6S}?U9hiT_v)=Ocv2`Im)!#OC94kr3X%I0X&<}Gk>)-sh=&yhX?VvZ z(x`uSwf~OKg=xvyn>UhAQ0PDTi;?NWizzd)Ao;0}cDO7#vm^EcxM8&_FF^EKRn9#6 znX|gVe-#HE8H$)8FPWNwUW7%Ai#&3jrI>|caNE))TzYlqLsdCcqI|$nJ8D4k;)^|_ zD$zeoJ9J^-Y(Bc^?V?)O$x`D-!B=Rc1WR53ZS7tg_r~#{z5#Gvsh2LrnCae|8$NLA z+9zeY59wDM34=c6P?J4fz;mk($w7KQ!uq`gG*-LOmiQ%Q4(reGZy$I?&uee@y^Q91 z@s37G_t)X?<+=amwNP`ubB5Wpmr1M|yt#cK$7xCj&0E9SkXtqJLb@%VGIS_K9n5db_?(9Ib zbHjaM)H6EDS7L{tC0`9l#%e*hT=Q5jy%s*|1>D?QoJ06egv%yLoruUSOZ|R)xi{m6 zxNPk`h4b>GS%etVSAOBy?Evs|8~gV86;+4GMr|(t0;oHuj@#eCd>5dMA3ZEacElPP zOfp`;Q5{$l(_(+Qa5Eu|YIz?a?s5=EEuM1|fRfO&hSg87hZU?oz_6Z>pD!*a0*#FH zz<*8v(z>;@d&_>nB^J@S&rIOS{0trH%lIb{%ARbUU^@zMcuRIR%YS%|Dp#y5;P4qq zV)qw}>^%>#@}`4`aSU=EJxf3FuIZ11LvmNmK0PeE@;1#m;qKY}THoJYp^)$CCg(cT+Qbj#whYV5G}lj_ZutxZAm2XGCvQcW2-` zIVIW{wQ@S1-N{sBH^^fSIoIia=9bXQXm`DW96=8D=Oyvs{o=^eW4}x;0h#cvd7c!d z)mxiU+h?3=l4I`mFFz5B75q9z8k2Qi zM7o(c72NiIxBtOlZ~@x8es}refyM8~`^6zQN zOZ(;ZGhRU5w@dI?;0= zL`tk}eXl6A{JS(MlNUnJUUkAz(&4hIjl9po%z+~(NC%FdG^Zm>A-1@6uuct63;qYO zavHF~J{lCdvRy{w1kHcb#V@JqVF0-GPT)K51Bs0H=__6Qx@`UU|EAz3O!YpcyQZhe zawCu`|4pbpWYBN)_C*Sk z##M&OBUfDdQGche))BZCm&bz4EYZlJx2+kjiGQz@h7S&9oH4!dh?3MO`>=5QO}WIjEY>EV5!KtX{ry*?5us*K4aK z^-R{eqMxZl>&S>_Z&KLXU_H4i@xmw}0BuElqVr|Qes_m4S#O`Cf1{_lyW@r;xGZz@ z;2hKSV^l^B6nB+NNrDl~-NbypzfdTpy&3kAU6Jj`CJGhOOukZ{^A~GH0N+H+pIQN4 z9lP|$Q-zIY5y~dl0GKJM$kfpb9oc=k^HY?0r;=54-R7;C<&?=?P~UFp9-_Wg^xwuv z3oGs%lNY|zAV`NQ1lf{Zm$_@4Q%|k#u)E4M**$UdkE%vSBm*L?xv&Z$PC7BYbSK^! zOYSa-E$0D7gg@vgj}GQ2Xk7r)7tHoa2ghznBjnj>(II&?&b_bV%)pQVc(Ifi(Wz!~ ztm-08+uswzgg5Poc@SV)F^KB|)!-@sumt$q@t|)n50-*m z0v3=pFR((b-Gbk`X8r&;*TOp8txP*}+Y(Tg9l+HG`t)e5DOsviWFZJsvA1-t#FtsH zlJx-NPi4a=Or1~jJ2E_vlw1YO`x+7#$xq<9BHRl}libxjTz!a72y0-C^c_aJ5MiJ> zd!$^G`3-f`FBz^*LGhz@l=CvXySEEcV(~MBHOk8u&}IS*i$&sK3KG$wdU$$u(ANN3 zFAM$wFit>fMz`YD!V;neN1)F|ve&1kGd%AhUC1dHjyq<27H#^48>(ec2o z1C-VS!F6}QZvc@O5$8X;iG1Qmz_z45BL1o(&=ZxhhXrglF!pikR!ujytq|2e0{6yi zjf*0U!KF{)BQzqvPJ>^@6{h_ZD@Z%CNu*|=_gMQ$+nTIu_ZpI46fGl|HzE|5hi2r( ze>OJN6aB%|MI!kd8&I|}pu=#fMUy;X`uQTk>NogiT_Oy{T&>rv-KrSKH}-FcJa3_0 znv7BM0U$dp{qj9oBDCGJcos~@r(Z$!5W!-HZ9HBxNNM(LTs$dFymtHTXMoe~4F4GG z%f6m_Am?2uKbQZA2;zWGQXj8hUV~{_haIaGz%l=LS5>%6!_h)AsjeUB{;2#(Ksjxn zT_OF1zmxVrTgK%>1XKf+nJ#w#hI#M&%Qy7qVylp5F81Fcw5<-NJFbx(!~&|Cd>F#j zg=4vVmcJH%Bb|TeNLxtd25AfLdKCQDBh-^o=g=`16jp)kO^y`s#R*eC6_%H#kj_6l z)dO%rsTl?2^IQcA6Ph6vcY2N^dani2Kpg>W=fF;2skGszWhCu8aMYCy`nDYiPnd;i zAJR6Rauw!?U2g=v=Z(g92aled!Kc{*fM&)Plq%((rv8v>HPY`BnLW5_oJpO|vHKjx zR60vNj#wS*6(aJ5d1=3nYnR-DHdh4NVm5N#?Vyy1nS$lBU<#?86{N8-l3Wgch38Z| z7#M4G%ZY0kQJ)~aBQJNy`H+4=QKigpDu<$~t-6=i?)PUi@7))+037F{{nGIFIoXh} z%ETcGbj#4BTf&_DXeVtJ_K9jxCdhw$)9L;l@~c$w_{oSa1N;(5oLm@#cskaAoh;vS zVxwKe(3!hX^GwpgF`Vv-l+1%y`+WX!0aPRIbClEP#{J$gVYc0jKqItFEa1J~x%4!C zAS_CE#f68{a?Mf5;UaIwZAI0iRs)gp7Z{?X0drabrw>{HjcUmFMqj@eaeeB({NSr+ z@7d*c5ech&TXb9;Mijj~HQ-NhD7CC`x@7m(LxCTE|7lr=U?q*l2FFy_ex@S|GWd&3 z@n0Ft%wKYjqOTIf{ehIZaEsk?Twi{Xgg+4A*91N(ZhG~wCRAy}Ub^?$&KcUwmq*gV zJX9hU?gk3%46yj0I!_nhv3Ln9sYykqW3mXabah4O%x#@Ex?A}A1*Fa43f_dAlh8(j zJjiT*ON%aEjidQG%!oITn)Bt<0#1qvLI;L-a}wK1g3a%ZlF)&m0MQ*PwkWq4xuVea zC^-AA5`Swm1U|R&Y}RR$uJy9TUdv5B`2}I6p170pgZR#KDlT8p(8);n&}yW~AyP8o z^DXY`>jWMhf0#-4-Hf!1FA{s`4=BD%!p!9z(RuhAWpPKOKmbgEqt(a5Rr@q56wzsT zp9&feR%vX8H9LEc7J#ir0Ji>*=@HAo9YwUj83d`s0#q-m%heWyxs`&k4|fun<`ktT z56|bQ{(C5^n^-?UZ98bXX@7o-&Xl!O%!>E?q#~W%kC+8DJ1Gl;SyJ}*8 zf$*%am%nX0Ou(=G_g%yakJP{(fM$FbClDm0@Q|L@b}kDBDFe-q7#~I;qhFNVVejz%fM6J z~7^RX^iZ=D^gnFmF zgdQn%bfZn+>c#A9bthBR22q;a37560FDhsqkH3@Mb6|hFor1#k1b3I zza+};<2f1;!yEOAQF!qJ7SK;<-Z)E{T%DMJ`*!%Kms`~fsNJS!3 z6cvtno+*S35y=oTONNX`4hf+Mndf;(L{Z3m98)D3qX-!eDM#ipDhlttQQvp?^S9Q! z*88sCTF>*;bI#d&fA-#={n__@-Pd*91cBe{EDrDAlDzO@JLVt0Z${x2?vXY@(w`Zv z&$FAY%fbXuyrPWeec`WYKqX*4s0XD6ji#vK8C-1$s|)E79?FY!k{&5g2bd41+qZGv z1V3Y2+Iuwwg*c8U9lmER`Q$?~NXTSPS1U&O@~obX(^}xMr^5M0KDNm6SqZH-;FtO& zDc#Kd5?}hMPyV#771~QpxW*u7t@O#%ejcV=HszMq14oD{o=@>jF}`_O>{c17q-(AJ zVkhHKu!3}lNke-wT;U-6P3+7xV;S;AZXg7z9JG1pFaAA(OiNNiQe+*5oC+A z^C>5{w~2s;;W#%J(f0SpSMMdp*9`3@P~1Vgw7iW2X6?G&rAAzjOot0!?2FtXvh|$b zrQgMjJ+aDumYm2zb<8AhRnJ4Pw`TWZjv#eume8%Tq_LS6Ws<|RAKr%s&;T^)ei*&RvcvwNx`cv$+ zN|vOf+HAzL&&b<0MgV9sCh{ZQCNH+cwmVE;_Li?H#lG#{m@3@ex#SMD-EpFQCA&XA9Zn`e`)qEaV~8l{*tPaX+m3s zUgh3q_eh&Gci@-ia~(X-h2VIifiuN>$Fok_L3BFjFd1i;{(G4JeKr4!b2CDq<@NnT zwb0F@KSKJp4r0t#3{`>?k8{5Kn~vhJ%vQ1Xx?e5?Q^oW54-PWK%`$N44)1ahlZ{uH z9LJws`im?*dIsRma|h{9N2fOjaQ zBFe!sn7PO9z*xntyZFM+BP0R==v(a`5gXPRrusY`73Yos^T@v|Z68wA>ePF3mjw_m z73YugPZ@V9VIbTD45JF))MuVal7oC#xubmBA=atGS|X5`5~Y=(u#iqm<9sP`4}paj z!zp+X_G#L09HIk2R9-)FX9EO3IS)_d2TsaC!#iH8h+WpCl=Ja(-tNH{?WX>%9~7|k zIFm|b#zXtYss@Y)NBkIPfN|pA)u4|`?ak$|Hz=&8zhhdmU%zGVZKyy(!$q}n`Dxs6)6q_JzT|4%;UhYl|7L>TJ%xOkOm#G0$?^6+YpVm5rIX2y z84jv{2lD6-iQ>q#9>!#=Qag!$oaSTo3{S_SzW?BsIV4+Kzg?t&@BmuYMI0EdwXZ?X zFp3kRO#)EWLMQ4QxFU=!B+aIoSMp8NK+m!zG%mIXGD4Uwwh0(1$GW0Fw318`I=&?7r_sSY30J%&*HAY~q6>>dH; z!AOba8$5Kmxk4WhH(Yk@aziX8^agI|;=>f<-6#S6+p0Q-@Q4xu0LAGQ07BLRbSTDv zeVquz#q56t=5}QF6%caojA=8t8fpnuui^@Qp?bKZuo!1@|5%1$`O? zCqQLPq@0Juu}}^(A*m`>bM~bQA#y~o zW|z4G%ySL}UgB7NR8<1yDd}pUw@P`-j-JR5Ar&OfvbaW09Z$LI6CgH(kcNdC8hG8jsffaeUB91K&U?$F+d<#+D; zOO)@^yoW`dgzig8R*0>q39q8n-ImFRT49ZV!`Pp#{$z32_qvNt4F1W@B1wAyF#5-A?D}~ zD|9K<^XAU}`J%_C_iqIzQ0>*^kU7#e2fE+155K*Bw}rtCkANuPcRAIBapAzS7MIET z^4gXL3MW*oijf%1?8K-r$JsUSJ!k~Z_BhlIQm{N#JvPZATN%(kD)YtWv&Gv!zMp@d zV)^MYotNz4)Yq|K`{%@sSbXzEvFw^KGk!7&3rwZ`tV`SeUIeWy;93H|nd-ax3;vi|rv z3X{Tw`q-9VL3m!{NRho<(I#b3)`rdrVt|{HHi@V3IJei72(1RVv5U8%a_#7pDGRJ* z{xH|CpFM; zi;OEV;FD|JJvpU7t;Pp0h(G2(ICybe0%VAX2?E@NFoa0iv)#=;ng%Po z10$cCwi3ODjd$A1zKWmn>`5~kUZhJ|f1quPQ;uH#(%4(5xl%pH`$5qj4dly9t9jpU zQ4>4}zm~^G0L4ruo!U=%=9P2xm*8SBZmpaVTJvZt+J|i*5}l$nLVg6nd#e#>to0 zFu%v{A04{eCA-{VJV_J^XWfrpH1k=0TMU*iI|viB%L<+^h*CC(hdJtjR8G+QG;#au zi#~)!gm7#E^RTD^u*b86NDEn*4|T)9bvPAkj_LL6-T*kwLBIP@l*~lJl^vdH)VUvq zQuaOUGPdA=gN{|9cSQuMYe8ycE#l5YyhvP@FRq84ja8%UPoudz!MoMwR^)M!oc_r=zt*3T z-XSvtCME{vcjP#KWwX?HFr=t;9dGWF&1n1uIJMKbFJJ+KKDu3CYkYe=Qfi3uVgmGP zqWAHJKKNXwFAo%y7-NxGN z4NQBfvNbgx0oRt%sw4{l1C?GKQx4bCfS;VYv;>%#Op9cSx%r_Z$H&s7T+oeS70cuk z2y*uRk5B@_ZHP5+U7tucxkEYv-IT6xo=+HL_RGB0@A~nn7MOBEuQ7+yUqha7EN!*n ztGb{LkhZX46>CS5oF#GgaHI*-ihJc*}du$&F$L*79Ma>(5XhRDiPJ_crI~)92>s&*fb90#IJ_p#1MSv3QeQ29fBbd_1ZF=iCX!it<(g z>IGo-x4e!xY0VyA(*l;>Eh{mkIT1G*;*+T6nc|Gq@VI@~=3p0D%SO;|E%LdRhJxWV z?MZGYj`q_(lnYXmftd1H?&;}o7clAbS?h%n4@svHZ|>Xr-0ir|_IHP5yDCDj4{b0l z^*(pB;iO75smf*#3oFq@bn3OfKySU zz)uY932szsey@?{cn2nu9<*bIQM|L^43_c-H{1Zjt;zHlYD4-tC8a5R=~HU;RgrvB54{-wTSHLbEbeV9aDSbpG)&}v9tjl zLP@FR2Nw_N>iuxyl%*l&<`V+l?;raD>S#P#DuObsF#n1$fzpwrp{se^ z1X&EZhF-j#0QD<`g;fvT2`L9rs4zoR!i*Qk&TqtBd~m{a!B=q8wXj z>@SFVeF(R(&ehlU%nx5=jcHwYl8!bO28{1}r9L+%oDl!x6~obZ)=vl>$^@47A~Vd5 zHi-+O)Eb1r}N>b>=+}?v9Pa`Aff)jTy`O0Y=yfI@U zZZoA=#Hl!|g=_ii-=fSiPg32{Bu0YQVeM;44&I6qazE`7^~Lgv?)~cDiOR8f&hwQ= zZb`bAz8$I5-k|9#as{mTrDp|CdN?tG=2XUD+pKFGnazuK8{#_&%R6hEjRq+#=PaQ9y1O81|Og zJj3b+7!`PQ1nPJG%~-#Y#=P&EB?r^}D@=E+-uCa0K=*a*e^l2Q_`oinH*Pq$HK}wI z6K;ze=3`UeV{!qJi}Rjm+4;jRp{xNN3&FYE;uSGruV&Xn23DTLAwFd!(rsX^5r;l8 zE0}yU>3ODT&Xp_whDuFLD(E7@5}-jTxEL5EXKldGfBN)z;se3}P3c6@k&EF1zVUc^ z86}=Gg7(XoYPRTD3>g0Aq_iYzI@glVSCu?jN)twvfLg~SGu9MU$#x;4Bt&SD@@b4! z$3cmUPf*HSDi{+R4RIbK&1a*$Z(e-)d&2tEV*-cgx>_9@ea^cNSJ+!IJ$(mN%PPym zCJ)N3au|%GCT>|kMITFXquq!dJCSSlr0Oeucl9hE?Li5)9dsJ7L@HV$-NQS%p407D zib0xI1KqI|!R(TD+_q<+?#-RIlu{iiUhJ(KqHTsiiaY#g8${%ZX zTH1;&1e$ujuVQ;)9g8=J^J{dLGPuNa$FK3tm9>8t>=?VS=h8JPyALeC8PD9jcHoX~ zt$mxb@Rit0s*Jq(6z7Ceb@KnCxBWm0A@z2_bPp&N1EwDmBvT61irMnQ912>vKDqVr z|2qW~5p(65FFB7lACAKHE&GS3*Mlkt#%ZQ2;sUT; zxU}zP7=y7qJ^j>F_v7c5cDu+qa$7-f_t0;{KHeDgBpY|xaEX2bDFn&vHZ7&fuz@F* zNxiCjVhWxB|95<=U_1K;O(4qNMo`Y)OEgS3ojL687)&1Q~M~<5|Z`djr#s z+yzx7iYsWE0gB|6=0e(u)p%xd1zJ@&6qd|C!d`XH0=a6!`b)v7!CKd>Ui$&i4Qh z)!IDM{C^J`JNR>@pByghlLcMnZJ;mI00W!e={wQ}7a?OHN?)hV8c2Nc;D$N@NmT5> z41Zn@BnLwX)VBaUCjoUvuv{@lgzTTd98EVZbz%U3gAN2RzO{hIO?evtW^)@V?A74C zc+5A7^50U)oeB7^yY1`DWk^D6fX7sO*>w|Cna0PW_O6Z@??NBSJa8P1S5a|z4K{s6}Y$xea|O% zI%dA1lrfa|`}O6}r-Cb72#uu{F~y{EgChB$Yj;H;l=gciTt@NM8*}CFtHgsq>-zl33pi*xBAIPF zqZn>?MGqaNbqEF^qLt1PT^9 zkv0$7B6(>>@hH26TBB-6XTe-`-VK$EAZsdmzRQ@7N#!e{L#P&nLzTzN5--HjxS_Uw;S2dVAs-K3LjLs5$}~J+{9H5A@Dp=XdUnIIMxLH={w8GEWoyVbA1p> z8PPE4=;IA?D#5EyS71yBH<2y6VsD>Cx_JK3DeE}%WIT<&O(70b3+&P~!;g~FC!yzR zMMXGbOD#xuJo-IOpy}vqPW3v#Lx=afAia&4#B3u_Sj#`H`3$=!q<;y@R|n$5@idm~ zL+jweT#aA~BoTGmV4QY(npkd<{)@^~wPu&V8ce>=IgfKsIRVv!{w;wo3$J^q;DEB2 z{r&H1{$rBc;9>Wb-ppO6Lz6?X_7yRCHSSwl2gVZG?eK-S_8jyo%hh11R6TVop-;(} zIBOA13@Fdvh4aKCq*g)E$PZwaq&UCx zQeg3fn>Y3}e~S_`oPOwq=e@8gUY>ohG}gdMnpR(Yc#zGd_vPUT(<`W`Tq>40d^^J9 z83Baf>g;p8?xcSqQl~&Q&?zTBXrPi?x!v|=;x+#^ukiLO`mZ6@AHTs1!%FwT)XIsn z_9E|rQt-(50`)rf~H=8i9bdlqvqR;931q2Dx*t~Xr0`Z-3gDaFTP zv^U0NEZ`T7S=Y~VfoT~-_!U^e2hN7n3n47p&1208K7Y=9gSV~N=@R|_IJG-%Kl#-CXmZ(pjcl6^*8p9_x|J2ly3}==d;YA zRmw}4^ikZuBKtq5Sb1_p=oz$k-$E3W5K5K$TAKAU%QggK%|cT zD0O3|bZ?75hzFV4FXb~!z^yet^6xrPKsDW&`)p?NaVVW%x6}Xod%bf=DP7BT;~+Oq z^K(W)%isHd7(V9~%l6|IIPdtkysrGH8}=G`A^-4KFuQQZE9?I)-dR6@i7(@pnHH;# zz9OdoZ{m?a_{oG%$X5ax%in~b%0Cz^fg}?$x-=qSE0Kz4hI{esGkAQeW}cq$-JgJe z;?mV?^*2Keg5M>iYRfwSXQA@=zXypC9{gc#jI@vlT-Bxz&#v$NKHnR;%2{7mDYP-^ z4QH=J|DBz5@VT}v>dht+>zDye@h|}7zUr$fN5*?T?EMG~nvjOqEBR-L2#I#{P;tW} z@9V`s7pF&Rv9mpS8l5lsMvZR$yC^J(DEZM-E}2Y(jE|^-I`0ivInQ!xJ)C=TIn$V} zelR;b_Fr*cJONHJo8WFvEpCki=AP zvrkT+_11lz2mi*%i|B5t=N!bDcTJs)_vA5f`|{xGCaGU);ZkQ|tk>_A)aiX@`u76I z!LfOtO4Q$9ak;GBD_QTB|M0J_4Uy%|W-op&ZMOs$>;i(R%@b!-Rcq0xqe%k~gf#V@ z$w#q!(jc`MxFJVP13e%(7UZoW>+*j_@BfID`xJZrwDyhN`=gGC8}@Z@Rd!Ehqe3}~ z1y4O>Bre>uxG|j?C^DOXAcdlY@&cuTfP9s##7GGCHD7a+Obc_YLX} zrgkRGvAW{Cs~pd^f)rT1la&f&Sl@+g>@JPkA)p|V^nQK|YQB{Nf1q5n0P&7TXS&pF zuzgU_=9`3^X-5-=xEz_-rrKPeW*Ub``TYpeMLx*{eO3yZeZ19mF-`mfR0gEbTmGV% zuK6cY`UT$k3z0tS4SbCsT9o3#{oO^EGz>YWg>)n0WAtO>w#84VarRyM(5=cm-zC58 zBL#U&v#347;bfBWD1?ZAME%)OB1CF20?lRd74{$J@JJgABoZw~Y=st)h#hIu+4KkT z2!b+|qbAcyq>JP5x|7Rn2aw@!SVi@pb)V8k0{rCOm(8c&6`^xCgPG7NdC!mrBuMv- z1?b*scT)_CB1N0c~@zFH3p$&Gk^rXm+2@dzJvu3UBnVn`_3ROE4QUHVQQuG_)>oZRNg&Xjc~Cej)x= z<%mU=DHIGf-FZR=p<&0k-8NWJVG#fOI}oMe;XX}+_E-A(gVt{$)NFVNNC~HXS9Op^ zD+#?V%_kA-8yw^|%yKO!~ zRbPCD)VGUK=>*iBb#QOS?}2vxq*i^HhsEUy=1171@n0 zo>l7ZJo6z-b4xey6|VuN!zWNekyG{`b1Mhg&^I$7DBfaQ#i@UR)aS#pOZB%diItat zHxD16WUwgw3>{70NI-(p&mh`q-1bkS#PkOI*1q{|u3e4y-NETLbc(1e500qgV%O(Lf5zfou0EE)~X{ zB|Mno6WxFbnclSG+w=>-klSFIo_p~yP2-IQs#_{G!1KHET*^3vfRq{Ovwi1ETV}u* zryr?Ms^n3(15DC%3P?{X0#A@CH=@s5fQL(ph+`|12v>3nh|Qiwt4eHbIgQdU5r#yWWHqM1(^nxuVyvw zr9vdB;W3~Fd#ju*HwPe2ziO_OG$p|oGMg#~#C4$Cm4w#+=}XYaNxZhnXcah#Q(M9O z2FB0efku#Ip&2C9+#A*u8TXgfKtZq;X%|WXrdG|D5>oIE7Cy#}h>JFZ7NSckDgZi3 zQ*+dgF3F3Q^fp&@e)b0jU7az5d<&R=_UBJ~A1}{mK5=SS0Ito7I43A#^+Jmg2Xpp9 zLEMBtA4!Vc1ONaFkUiVROSB_mH(hl?ghz-j>VB?x1oZqu^QeLgloDEm?G~7Q)hSga z8$0kwL9b|Ioh#M}e>8h2s9NnKW!hu}F)%=*%^az4 z95o>!S7JVZzCZP(4udI`thFO7KhOItl+(Dm&bE-Aw&KF5`y$wnNWdHLA+tLYqPqxs zLwX`khe%~K&{qz4)q}i;b4Jas;n4e#2%1cUd!}jl*q$MTCoXbIr6sllm6mib2G!Hb zf52Y(7nIha*e+;FrS~3Nyw-St0u%m$Z9k*x@}JVra=l79{aRoh$+A*db(fn4^b@Qi%cSd$*g81}#; zr5yr0*a$Pyo|@K1*=Eotxzc0>2L(`9AM|;-P`{0U<7|R*#K+HVfm*Usje}YR<+ql{ z5p(b!;e)DmVk_#FGC3wp@0%Re+vQvamP|TS)~Y=y4mr=4d?h9dRS|ESUkl=9DLByE zR^-PXlP~Dvqp%RdkHX?txFU%zs$h8FjaNU5v_82W%5ivQ1CieNqPHjc%+X&4o@g>z zeaO8?E0a)VdFdg>{p77Sft9u(in2?rGnd_y$mt0E@(EMlvuBNkOz8-6+|5TP5U)6j zrsRBl+}0~&WrvH{G0Ppbr0$s&->w5{dT66Vg(o~2j9W_ho0Kpnz1v07YCCbkBk(T- z!GMRuLikkZ5bGg=dmPhr2XwZud(o^2O>U5+7sI+KaBD?tJtLrm`oJCFz3?-(7cBzf zHiRQw{MIgDPolhS_fgfFT3k8BR2$~R1jBDR9h@mO$JclBF6j8lJCFF&yk9$`QB7(b zSo}2G+1EN`9F1zfE8ZABK7b3#iq@lDRt~5qSyvkeNuL#shW7#4sr}u$xv2>hIS*y4 zRY&<~)Dk{+2z!aj2adDd5|PV!ZA!|Tp}e|&yJ0P0>?2psB0>7fOuR``f>o^dP!PvB zmzLz`NoCKAX3O?cxppj-@7%KeN)2Yd#tPLxRos41usgFrB%z{!nayb9rB*`O;Gc1* zx4w}MDP$Gm%aV{TjgxOi7v;5?esX4P0n37fiw}Z)(}(5O|)Y_ItThCB_ePe zSKT^Qf}lAgf?T4i=Nn^=uQ++NhRgHFHZ>L9WK|+#`>8P7VV7eYjmsP|n8Bw4WtNBf~ zuj-$_AM2sAybPK@^45E09IM}f(biLx`3`NhIlosHNI7l!$n?5o>pBwhsAS@5uIUP=GwS4DijB*%F`FvrP3?IB4|e@&Y$^K z@Iksu>V?i}$mO;*uD;w&H`uYU68FZa^e5=$h!t{6iv!$O==bFwwOLW-O|J3m71+m*o9EW7M-c1^B^wkGi)HC=sYc1Ep{8kJR-%HpA>ff6cFTb`6JpTS92G1n0FXA>Dmr&2@3o zIw2+%ql&Y6DOGOK*+Nb}L~MkCWW}s_j3VKocnH2hGS?z*IQZTFX3uo>Jd+w7Mx*zN z3X-|+-;FA=A(so57V}^0kk`A~R%EeXDQ~Q<4Ml}?2uS&! zvu8~G&SzG8L9i(C+e+36vbFpV&tLJLy9Rw|?4gg2=5R#8%biT<6r^5r?<(gDo3HvF zZ9k^iGw{9qUfP550SMqawAJ<141F1?b~^nU zZA!t@{T=vui$t~^W{KNu`xrb@zNedsCu!zqa9|@djWT!ru%SJ2n=?4%%y7)K$(SPD zrs6Cj_0<_>9k?#zY&wk1^C|({PVT9HCNGJ`Q6!cF5|CVWkQ)J{3J~yOte3jf`V;@Q zLm}i3@0Z`A^__BVLa&zr^fjl4ulOoFrDni1)Y)XYjCJ4Q$BA=ZpY^+XOEym14X5_r|%5`p^s$RkfPVL1b=3b&hqpu-5dtdYP zp?CYJe8)jDr$ia+R;ppcHw>eHUi}Ujw7Va9bb!P^vt}T}9|NJ*P&IeZ5Ww9y8?2be zrSb4c`GK~`qL4wA2nw#L$2Ts&oYKl((`LTW+{Ss#NdW_esKMXyNC(w%(nFHB#@t4& zPVNwouiV;&44W>3QALMAWh-S_NU!)4mRz;umz(ciQeT=;m3#noi|eqoT42GPcDTsF zyee9+RBXWhX{N1=QRyZh@f!x+9UBCsDJ8+VDTKOe*1-L#_~#qe!Df8}-;yFJVz{fC zRf>INTG?dWx+$3yKFE9MDxs;}2x-nn;E!)PycyoWYS~ay@09)B{=rB+R3lpI##PLz z4LoMPD&F%eyU$R2owa%{2C>YV6&oHbJ8^JstWD54BD7N^g-fztAs2Ve4h&RfmR{}G zBz$>$U>}XD{5ndsE9#oh!tJ^1R{LMtAGESk760WXm+o@&wC`hPCx&;@mhp$G=^U_B z@>Lw)8c8fUwv)VUm@G*WPT>vjte&dseecmRCwtZITyM+Z3%-8pwIe{5+|Xhom1ekF zp>lVe|Nm%6q*fk-N6cV3Z-HBK!Nn1zJtO7rm{K|k|l7RalKhX)+GF3us zt7$PFg;nsKJ-8;2`aaJS!ptX z8a$xEK$GfH2WEw$BFegh*+*gYpjKp6J-ESN^R+wYjd@)B>&Zi2tZPDgnAr_MqB)E)SE6GVBLe z;?CiPYS;0IyK;VN?7m+E0ve@Ry*2$rzaOUcn?ht0Sg4Z?4Y8D&?p-9IRnsFPE)N$$ zvTjZ7{7tG0wPPIqw>JSmPX6N1DZ*r0xeMVB#$QC0(B<3+q3<~kY|Z2~#o+vUkn?-| zW&~OCra@gu4-j?jF@z34C?M$P@1(pQSei>+2s8F4^#{B2*F#^49<-o3v!Rx7J1@}ygS0RtllMhj zngzaI)H`b&(uBIXG#$c{wEr&`V6?tgg_lS9(Zx>+VS`)8fB5~`@-bxX$vvr^pXCu_ zr_0k1eOlu$_mHntB7{+TLh|o@$2Z4w0!RgQ^mBhgm{RH-ircq@Nq0F%_h#_LbEJJD z>Z|F=63TNHx`Kx35oe2OCQrpwZ{&LK0hzC8TNCi2cFe9Q-DZKW!SqeBYFyn$<{cf+ zvqGri#?|CFsU?(Y3dRQJ88u$QvT+H` zU*?5SK!s7I8A^vq=0XDG!1WOg0c;gF8?`1$;>kX!>>J7PQ(N?qa%cR8W>ABkZWEtX zD?@3-%rWj?s0H3#OpwQPoV-a66-njF@0A_PLBC!LZ&Zze zXK(J{a*L}W7!Wmdps?N+?n>LAK6vfE@FrNmPff)zM3#EQ;gUG{`7a)Fv6{IQsY>Y3 zI#efk<(EulyzJ}z3DGFHr8421qn%u58P9hnyM>1!S$octk54qq@n(UU8G4_)?jM!2 zTd!9Z^ZIaP5N{o?$v;WY!!dDhiuY(>?6}5^!s@AN<#Xhji!RA*cI(X=OsmnZF>aR@ zL{Ke;2qFJ$HDNApyuHXLr>~;(&23ZhLVzPAbSyRwzSMbqAyp4mB+GIOa_;vi?4J+9 zQYGw1Q}v?px`p_MzLcsr6^wCx(0cc>e|{nH%%08J{VhA zczy0Q>zQzYg@p!B`Wvxh3zXy}$t<65FQ7YL_FQ^@>8IXLy<3^TWxunh7T4Tb^jfsO z4DRR0w9Xn@1|36vR-rdyZy$_RJ$*tfFVs|rOBxK*n^*2b{wSr+l^k6VUYKxV<_tn! z_l!T@^Xkfx)@N~E1VO(U?vIh_Nio-&l7hK0ZOoyXQE#$j>-}qg*e9q(NYCUipGi2s zq<7#4mx&Kpls7ScbpH(t*|UYLhCidDK5Y=Ohj3Hi9v|69Huu}Z6Eo2zB_244^c4E z^&476R=t}CwCkiz-H_|^<>x+hhH<#OC&}rHA$-nIUk}kLWs$RXe_r&U>kQZIGd5fv zNl>Ab@A83RZqMyy!Iho#Bxl5@nj@ufe(P7c{w~ zICPYZHQ2({JrXt6!0$2aH`{sZO4ZkYd#Qqp&TI>{1vVk+}aC$1bc`2@Yq@k=UgYPZX)%w(>gty0gTGIlhH zN|DhZQ&S*T;m|h5X_6PeEDW#lIdxl%l)I|)(VWQc1>_^nOB!Akny<6DS$?==Q|*xq zNlzZ>LlTb%xxdvFh-qRJ%1IN9(f%3qrd#tuOSS^%qT_E9hdGb35q|CL;n6wbyyRgL z^$iAG-0V>eBeI)iE$@l%a(2=-locPG6hO{Cg(P8E56^obIXVuTa%&KXI0m@X<~LS9hEkk=}n(`?fH8* zsP3GtW7;>O4<`lRXL7Z^+3fyY-+i(_d;J6e@paa;w>q%UX@Krt`;Zo-(sys#9n)W`fgURrn zhOEWXD8O;|Xz*~MX|>U{ksm0_IIn$^bj-J7VeQ? zRAC%uYA0hbvy3~(f?q!}htsPk;9o#YIvku`38or5gX@4jo5(f2O@D+jsY^Kv%|3TN zHixl#g(`=(EQ9DQ7`m)Ki&V&i?pp%&nxU>|Z|(l-9*Hyy+;~~=Mq+fTVR4Tz-YxooYA+@r6-Vdy|`ptU?m5LFKqf{-D0C%ZWc( zcejl4&z>>-J3{XyxK-tU&UuF^*!<`(Eb36&z1=MS#$?>sN*cG{!8B?&Tsns&=_)h- z-rhLaCeBh|A(uBRLmQuZ2J>%k0q_mk8sWrqFfUvP{gtqilEAiP<9OO%&UfRNa@e;o zKh$>a;|B#8_yJRE`q+v0%1%tJpNlzQg7r&J3bIqG?To+yF5T8qdej|Ijcuyf#bd9p zdlWJnB&O3xDcs?5Q!73((iqf3gba!M9MObiAa~_-$5;rzORKJ(#`bp|>3x6rKlI2S zwZ&*)k7Se}ORyp>cRl{e+kT6$LFOHla#qA!PS!_y7j{=b9ujo{EI{ebd`e5lUT7M* zoX)*Q(i6~;c*O6r)85>ZrR6RH!)ANFDlhY#sG_H2xwGB%HQgV(mwxS@)d_#y_M+>M zG%dN29noU(+7kY}X8oa$b!R$yacZmMY7l!Q!(oVujZz$*6*NL`n$*dZzH^eJ zzt(_O7YNN?u?uoNGPWZYocCuGxq$kjI_8)gdts)rf6zq~!152zufCX*S;%c!Xy)_P zof;lbJ1uvVd*>i#?Ap>eO~3P8*M9@?<^jS(lZAq)b1T9}gl?o<)|@QB1~T^q9v@;E zJ^Z%By8MKj55%Ew0GXi!7Gh`#a5RIU&kQ#|2v)uT7Do=>T8tc0|9Kl!UHv0kk3Eno z+?(T85!9oe_!Z(rvrYI7{bfB;pg$?2#~%Vg zVD=Z+tr=SvCPrzQWMm!jM^nM;|4BJw*XEW2MX<+ssP}d21jobxTSx?IFQ>mit!DAy z&^8umm7|Qm@4z3T(=VQ9LI)n1FW@Ll26RKmGY~qz0fjaruotURvY|`s`!{grANz{8 z%FJqBQeQZpz2L`K$(A|@rgUfcOI{IMu6C=s)Zm{)zrUzVvu)e%%=R@afy>j)=&?cZ z=I(3rHdzAb`GuaJhSoY?GTgezth;-XLqW{taDx6OK2_AwAkIcg=&Msk+va-PTxR9gyBgBroCjYtfSeg5UK=U;2w~J+R%Og zuH1M$Bh@>oSqiQ$jNGXH&1O>v;`?Ceb8@ehyrX$7m4^UEvN4BBA$`R5|5V+6@ z;o|cq48f$?0@REGji899gPudoFYm&A4u)j&ETVjy@0tXf-O+Ht8oL3QU{>_$>+i)s zUUKD!^=0zr=Ie2og=E{mTI8?ah3*5cXTX%N(e82N4+g(<=PILNStt@UErA3yh*c># z5bD7Eh0yNg3lvny!9M(l#SatcnXv!Ft!9yKW!fMpugg2ZZCEDBJ$E@nJBH`w*D$_D z2uV+eNZie`O|x&LyK;%TL#!3wFSZTQE+1SH9)I~*L*?kRFk60n0gJlBP+`6{_6z9E zrV;ZX1MQ*ThPoU3L*-cgmtZ`0o&V@rLQJdJ$jZsP<=Bx;mrt9!L0T+{IuG{Z#YQ-1 z=5lW}%gU;Eq8))y>5@kT{+4h}D50?AM`w~7#DB6e-83iDCdnvgip2~x!1@UaqOVDr zM4Mj54g@inp9x!rB$!EKKWKdimOw*#^eQ=0UI+#vF(1M}aE)jkgaQPu1%;{ewpiC0 zwv*ty1(Ci%$n{8Bwpu9l`Xrnet!foLfrtAi9+kd`mCAy?iKxTd5JMlEjEsnet*B`? zbAKy+L%0Rp)nEpAmF}E%q{!734U$wpsvGJgps8HlCqtm}pD;}PO)b_Gi+dGF6MlE= zd)D&eysM&YY%7%f&dGvrfQVlPo~1mZ9-1ZVpl4I%xp>9i2`eF`;x};fnQdXoY0a=I z6Fk#qspib66b^_ zD6KVOdkAIXIdAhYxo*&OnF608Hk}(E47C(7TaWl8(}o6^^w%%AMV|SDKIIY zFKojy+3e~A3zfev(P&w-EA%QM%l*M{_9YbEzn-L;b@+ZhAlBrYS*pHu#Pn7x3ES;f z{&`pw!cpshbt_-g{H3pW0eym5SM5IYphcii{by*E#PpUimBUt?B#mjiRgNt@F+&o6 z^Nl3V#?<;w8{NkkOGcwr@5yL9C8IdEuq1&ld*VVVQ1m4b1YIOOt5w3afM4U9W=yvh zdg%_VhF^~bpqf7S1bT1R-r5bI><;?t0_N(Hj-QS+jeW~rn}kkaUn2K`_BLU0LHRL} zn^18c=a_E~erE~~jgEG#^o&u#1jn1JJXq_CgAHY%bT$IYwa4*=;RIGBz0+}MTSYjN zI%?17-%mzt!onWC>CTCDy6PzaGq(#qKz5auVQKTqemaR2QVG_*y1AO zmM$xh&4%lA`@^S2H@kVXb#pJ2H=^Z^#8)LdD;nVFA_BKI7w;Ygc7$u4cvP#d+^a~# zM9c--sE)Z1p;S}lM5X|4hDY>C>9|%wFqbU;0z-*Zd}s3m>@#`&nme`B_$wdxCS$zP zGzNvBkrn?rHL0fPhU)1sjj03y7Ms2wleW*{v|aVnkB-kj!|V2+f5PC=M&WL{F{$fw z1JmJ$h{a{;8`YcBMZ?-R0Wj+n2785Oej(X>H=94C=sOubm{6aUDY3Fy(kY~m8`6Bt zvrK#OPv|(j#Tm4;f5~u32wQa}sOLsUU*lSS`YkyEbCn?Z9&T;<){B9yozrGPvP~0~ zIQz$bv_uyfb;HJbV))VKLtqXu{u08=^^$hp=Yasn3U8$|#m8_83cLV=(B*HejB#&9 z)=eL(TH|6PhVbx`6hLRmTKYSCH4{$(VvOL7u1ncZLiyG#3#cCrV%lB<0 zCv+a7wQ-+8FGAxOO>M%sJVtWA@N7}sm5sCIt?aG}f9#v0%MM&VK9ecGdGq5btBHa` zO^LJ|-!!+U$FF$DHf8CC{UAtYCSDe6cl?t$T)0JE#k{iywx%gePtZT=4UW^#3%qw| z_V$l&ybg*`@9gxvn10EoM(2qz;0UVzUno5rVvK)eZ|Bkx8BN&oI>@!{>mRDAy}RLg zs`Kgd@vke=-?KCBW9v9pK6Y=l3OIQt3;>6UTI}m72}4X<7SmGP&~R~7^w}~Y(X=L( zL8jE4sgShh?G(Cs+gItx4yT7)2l z1Oz+rb%X5>;PO#`IrmjMJg|TG+UMy_oT#JDd=2@PBs415Y|`ghDQrWU;j@GxH^+5+ z0w(;)AHY@=hQRy*fTd>|1XHo8h~0!v0B{wTQwAp}EUUgzE!`;ipN64;E6Pm0qsLkT zqMIP(mDJ!G;Q^fo9}M2eI)}7ISzfDa<&V6&j~NWS{joS!EHG?*hUHdE!As(8!~)2u zPE^5Px!bIrK=+U$M{PM8`~!lrU#an38x^w8-?@NX_6>8L_768Z9IcmfI0$~I<& z#H5O(`ShK+SDM$rykz0#sqem`<;ctC&lbe33`qbg{u;6((8sD6+xHF>!vim3GW-y) z>!vZ-2u&DIVV~0FfL%uOXDTuHFM`9lSU z>Rn3^H$DI|8k;H5M81IO@L>?E*}NMnhM3P1BHer=v=k7@?v3ewu7&L$fEf-;yQl;f z|HuQ048ebbCy9T6QHh1;A_7`{GT)6#?;r<$R3@H%hy2OodIWnd=~3qkf;t{&ghaog z$bF4W0WFC~-w#K2_&u`Hsu;Ib%W|`;k>N-rPw>=NQ;5jJv0%Jk{0>0q_aT0qk>ATL| zQ<)}F=fYmJC(f-e99muLpWlz!KM15jYR_klP?nMlHDzy?q#M@(C%&7TpPAOn-3E-rH7X%I|LDR zKX~=E^Qvz7b`G_+Q#idy3*XM#Mg=H#N%FvH{Js6(+-oZ^2q5-**dHvAZ{SLb{$2so7@9jstFY1Wf z423ww6*#vOoeSC7mD(eJIQYTF%GnK4f~!uy6z$JFSX1rMAjt|eSNZu=sL17qbZg)8 zN;S9Jf!5bMm=v;_Cn}sir-&0+59l1v;rCL@XxQ7MFtS~{vt^Q&)xoqDmBEzMq363_ zDG(dcwmw$n#u};Ou5C`Z>d+s_ezS*OCM50dZXWYzvFUp?x5jCjr$RfIkcRt+zpQs4 z#w2CpV~YPbR~<>)CqH<1zlu@l-#uEtj-cUPFVlnrN>ev??x_MXP}EeTwb2^2C%0vm zWd+;g9yCqwfl7y!SfWp7VDd#$~7f4|TBJjd}K$M3)Qc>cJLZrir^`mD7+>vLV_d0ywGXD1iU zWJ3YIj@na)eW4}Q*Y+&8u)g^J_cQ{W#kge~11)-fx-p&n_v&k<;R)w{*nt=)iEmFT z5GDgLRCHhV!^>sDZC_6 z;*rglyXYYp*_S4Xa%Zh7ol2Y zriYuQkrewET-|tVN_i(l9A^L~UrbEBu5v~D^W>v85a*92D?#7l7|^+^Fz~9^nx4y3 z*tJvW?-srR*LH>J!~#R%M?Yw>aI?46A-&J9AV-~*vhOa^a2W#dF5>jFG7f-KT*0;R z++7d<&de8>f`NTe8~@zyorKd79Mw{nB3{nJ2*aDZv(R(f&d|Fm8Oa!H3hwNSIN6Dl8&QC>Jixdczvi_k2Wg;yjztrHothDXlHC~cK zkQv|W{}`=sylK%FNW>~gFReUIB|N=*|IYeF}0579S!EP=dV_7`g3fs9d+zn69q z$}o42cT}mR92KC32Lc`2))2L)@BeB6cH|!>ho-J5&k(!rcuCLKk0tfV3A&OhZ1&UO zD-;BNk}lI4n~|6~db@d_MQ7G_>iK&-xKFc!Ldl277kC%(ZKeC_pyJ_rqZ2P`IEzBV zRs-Rr%yD^K@JYa#9Pl$b{KAQHIvXFbKS41~eIm(GN^iY!Ue@><1)Owcg-`LYONKCr zKN?Uebt2%XE?~sz<-iDtiAgr(J8gh~u|bFGG}(%D1nvMfqU-_^e_GJcMyP@k1faTR za&Tex4PkPvfXQ(VgA|Jiul4rgmR2wj;DaVeLtfXDCf@>P#Nd`FuMY{CN^7Fx^O5^) zT98l#Jcsl+)T5IFOy=64+IlyL>r3XU{{~^-Tb}re&D1>p z?4#c!nhA6Av~Zagoe3O|{m6Prp^ZT?8YyCAoQIZ>B_7rMM{kc$@c3uUFjM!+2C%pd zrR>O@;65OW!Cs6+$nj7RL<_El)>p@2;J>31r|87<`)^&~Ze-5s_+OyaksBy3UV`xN z3c|)}+`dE;L!RBU3tU)8Q*_YT+}Vsm@HFpR>BxqXdKDydpMoo;ElyN0V%SrS3S+K9 zY^Lc5JuRkCzy@J+#0Y2#TA_4;WgmaWgFHY>+5qO>4USr?OV3!%qY?0w59=}oea;yW zEc*UUOQg2rCm5|nb6X4}J>~@fP1#HMmR~Y_3s9Ov2Ox!SC@2cr0D|L%@b)3XLujgN zF*wK&=KY~+?W$y1zCsC!9G-EyMn?h~Q>AWJO@PLA$-f?hj>hHD*J1jy{6HfPfQqj= z;4t|Febf|zsy@>qHDmt62@hP@dPx2{(V*cpLGFv}G zrC9V}*5|(a8f@+T@mvEBAy3&_4efiOK;){OM~$-36~;f!&*%ULy*rPA z+|M)n&CRS~&PqA>ZQHgqib|cRXzBi52rYl)Cwnh5NQlcDTyVFe7S}_%!OTyf(-ZWq zeW^cn{m+Ic&xzKA44PraW+;Mr-Ib#zfX_eapYD%bLmQl70n-9V1cOI^ZiFg&0DVch z$#V}C9Sa=qGQNuumK0Zo$6PDYoQNix2#r3B6E9S~a9#gSE3g3UsH2p`y`cp$5x+X2>{&DNbl{F3peAU$>L;fjqqiDD>r(s=~ z5LkX{2KDx`x^*Avx+{!Nyk#Fb|2Mi5HOKV`%EP4*9-y4< z{5g6i1m8fqNT^PW=QOImkLepoN|a)`ypd`rnqYKK43C*?F!=>k*j12dDjP9n)!ZY< z48(V(N|p$wckzvCcf>gkg2txK_ObTDsr-5FiIEU6-$?vv?ZG2O!hMt{@zaX1#9#(e z4dj{`893lj*ClwE9bwkDRkOCo5=yKJ zwbxV#=UK~iu^HSy23BWvFLN)Yx^tul zpqf(8xp9$Qjt9h=^u=~Fi!K;gD>oi1#Ap##BH)NzPLH@%ay(;PB(L+<8HLiJPeN+1 zW^ujp(|SqLGLjkJVd%vYX#~AX5(Q8e@G7~3&>$gb(9Nix?w}Bj@gy7zBos0zy6^7I zGm)Y0;P|d#*IP>z!WhPAq&ZYS8rqSu)w4M+*2*mHIgeF{wtg;`?FYBUu*BTs(DA@k zL?zQg`RO3*F1>2P&`#m0IAXnudG+M8_;PtmV_!AGMfsco?_alOjN@ojZdjOU4`*%L z(oHuIn5W4ssCA;F>s*vyYXS?K8Q1MCr4M9xO(UwwC_In{t0U}?LL+Wj&>qQ`B=MQx z>bOQBb3yo^=(xpzSLIMZu}xrD!4D&vlyi!4=KJ&S}B6jH@F5ljN_JgyE{ z-8Je;lg8cNFct46RNBSMc?d)TbUz;}QrAoS8G#@^8B#qgsSdJ(ZP$Dyl)4@7zSF&A@9ce)aIxy) zhr2Eh=SverSu`t?0xU9mlwZvmdK3iGbn~9c`(XREpU`FbiFNul6A`hc)OO%_Vg|Z>$=VG$7}~{64Acp6d*bB;~e0 zsvnKW@q_~CP&{HYnl@}e;+7pzq8rtb5p^+nVY?5 zKHepYt$O-uj%Qg?S9f7JSk=mYXUki9YQn)*uk{Y65Y^qg*z)Js=dSp`9o37pns(+2 zuMI@aT@6&QLc)qY@?Ap;M-(1>ygG#HzU7Sz9J`PFBgv>O$9!Dj_A7;C!h2u0zdmz*v~WhSJdydOIJdLilfKcJepT7{UV%eyE5W2nmI1*HI_vVcrlP5^rd@Td)%P=;+F4hGLwaKGVED03o=xyzf)#rB&k5JVz#_!t^$u9q0lL*;jWkqU-X_S4eeHR6iMze)cF5X(D%qc_4KgMBdE4xN6o0%p=IYw& zcvs2Dpy3Ae04rIm4|JIBQyv-?lQ*xQQk*lGKdiM-QS)5_U%n#0 z;OHzCbYw2=VNZ1(xG2dFGp-K(Q+*v1*!c8r+P(`C+%xv??h%KLdKW2xkR4<@9%-LC z0#Y3cJ+ujjZ4~ZLs2-C&E9zkMNX~r+#xIPEChM!87N~9()z7#3+I(%2(F#pvZ3S#$!~C%_N(%f4g24RP^VoVMS__Rlt|rv~QT z^H=2{|Dgd&Hkq7+QZE>f!a>8&-`MW(py6r4xs!Z-$9-nz>7c?BbN-m^%E~3^`X=0~ zI+Iuz@`|(=Hbrgue30GuE5OkUp6?3D=Uu-o%!J!|y~$_If{UG&VB3Vb0j2oMdzw*% zMSd!+;ogyk$3oX+U%Vy-SZju}TR4L+C|53{SxY>Ac=_S4KcI+u$VDMcs!&F(FIF6| z+-oyA)Nafg+9#cqMZdIRRbAD50H@-y>`LP-@npO_RA|dSwrmJ!XQX@q-CON$bOjRx#_00HS=sm6~da-eWXR~C&3QctKKALQm!e!ST^@2bOJPBo#pYEA? z80x_7PA^w>dNMc0-!l100JGKaBm?m(oT%AnmWQDOeM$d0Khq)l(F0^N6?h z(jCsph5DOQ8a8N~Z4xWNNoyl+DP);PrlP_Fl;)ie-!q*BP7Eg?kD6+jNv22EZJ7?b z$%*?I@91LFh@kdYi2nd~wp@z!T{5EE8P(kLF{e3q2Dy%( zv1%d3PK>z|94ER9{&n-1gM*V@PZGMk?IL}@7zCpq>UX(+WRWRQ(h zaRg*aGd(*~4;$?Wb&_gLNEOVO@9=R9J1!I01YTgeaR9fc_szPq8erU!#anSc@_K)e zA7vSxJj(`_Gst=EStTSak8N9@EJO{e)Gu?^wLs`(-z!wc{SyVW%h{PaNCJm5Dk0Su zuM6WdeFUEDS9sa=9h4=!W*{*c*_m`;v~t*H$Ll>^`5%uBO9`kw{VYdOXt7e?N_Vgo z;VfH|b;qxG3;Gy#oB>Hkg3|q=3bCwD8Pe}zx_D8Omh3BfSg@{Zt4}=Tnd4A+;6Bti zAw;`9*GZub-W1V0VtFa=s1pkVI)v%S~U95PKGX+eYPdqhqB#rJU5GIxy#T_e`&6?jzy z_KdkYr%JM@5*!94dLFdFD_jd_ z?+lW>n1;SFaVm&-+(^^t))XxOTjHP66i?sc&VBS36sZX2h3U zBtNmDK1Gyh&)Crrkk~;AFVxYlkO}N@kNDv0H6Qqow;i)fb*^FGB0wlSx2}B_k60F= z#vUv7eGBf?gzpM#z_-%YjF~qRVR)GKDxNOr$7N2wX`uH2&c?cX5FB`yUK&Q(2k?XcxE{`7`ABRNu z)sML5{5m?7i6vX(S^pAd{Myz8F=V^EBvwCZJz-~fB%I32U zspCFKyu=PXmzuc!4Y>doKS6S`WqSEp%Y!S1bE*@eFR3|)A*WJvUaRtSB!1MBY=xpS zK4Z~zebZ%-&#<)Ig;9x)o2qRePrYWQlAY!!YgHk$iWj*td7a@Kc{@aTAcRV6)ImV1 zq0ipCUENFw4|Z{u54KG{d6`@1C*asbR_{jj(t_-KaCE#{YgM`C+Tb+rGBur%BG>xf zw?cv@WRZADmzp&?pGb%qA&bO&@Jj^&ujwS}ojgf6%0q1x2^{B7jCuHnUyxV7w83nU zB^1h%-SS;ki2MlsE)`|jBclqE$Ch7PKc&Rc{5IBp5G+bbh?wazov|53w<6P|8uc8z zlhx>{^FJ=vJh^VT8oiIcdNU~Q1LC>Vz-EUmzeQ#0?;5+PWmT3_Y*D(HL7lwvFlWoO z4Tk+bntVsd5r9ZPFFa;7zN8XC`On+%Nh<0lvo>aZI?30_@8!*Rq2!(R54=TuL4e@F z2pu8z42n?G1(EKmJz*Xdu^P`8KDV1Z@>J~^V4;)Td|m{zyk!h@W~yQ>Y}#CDBQtH_ zL#VrEzFZsE)NhyHd^!FQysV#Zq+~>@KQc9iW>ag8fsgLHbTa~D1pn?XEBHGQJ^04s z4GHpgqIG9K+G?@-Im;N$4|Cg(?qi0SD`vZ*A-m;TJPJ1t9!U0V$ zLYfED24Vvz3S5t_acnNdFhJt<9**={Ql$F+si39Jm-!&WS(CW1bCM5K>%p7Z-~Uv# z{!+il5{tTXejl|omJtQ_C&aeHPUshePv4qOPc8inJu^BZMFYpn%&+&ifJ^|>mAV9) z#W~k}CLPMV1)|PFz`DwNeISwPh8{M9!7sgn^d{~LZd(lN=2kH%!op=vyeG>0P)m2L z<=Tyx8;);Q+!O`FhOXcqZ|zI;Mf651w5A^Kzz)~@yPSFQ|GI2v!y*u)Kj={Q^6+yK zru>qMZU`8niYvHr<$P`RaG&A&sRk_y-)vAsf_q1XePG&Lf-sp|Cv!o%AZn8^8in~b zi!J*+#;+ObUo&IXJ+tmOK6kaCv-0J6od4=*xGs4*x{xHD$$U2ch}ErjWrvSzVo@6` z27H7L#jC&rknb8Gbg@>I;QUM*WMFz#CCffAnrb z?CzIiFM``A`)Y4(nBCpvVmq4jdu;P7yQ&+0OYfJW-aL^W9;UDu5pScmZ-`D7>>)jt zIb38J*f(8oa;gBavr#y)quz~rzJ!s1E~A_R@AiF1Wbp(3uf5d?THr+Q7VxYB9H-eLi`x^72%X9*%$qdLOFy=IW&)pfAhiPcnQ?J zSKHZ7G`G1Su#v2}Mut#gZXe1skk0YThgVX_2+0L!=W*xZIu0YSyO$wbnUOPtrfmQz4z9g~V2902bt+o*I_QDLP_*g-I`c|(zUpi!yu~)WznS38 z74(Q(CFs%dWQ)cM74J`!Dw8D0Wa|%qM-m_;Rz^I+pOyI`D|23bo`7c|GlB3iF(4oo zZU!(r=UGMZ@BgMnird`!Kn_ARZ|_(4N`ceLvp^*9XSY;Uw4G-`-G@2Qko#r>PTU5R z$FNT|Y%z;K{5 zt^_?-6GwU+mvlq1IL--#y(fZ3CqNc48VFb74Dq)N5?Q-|_J#qBdCws(Zeco|Nn<94zMM0B0C@&$>u0T(0kVq?570yf zmhe6QuK`g^?hSiH#>*IDt9X=&_T-z+Q0(4EHzazjwBl%`@x!`rU{lbfM zFaCmzYFuKk?>C^K^dIQRGPCH$JU(%5{?Qo(EtA;AB^Q=9l{UVLXGtAne(C z7EG_=Z+4L`l*puwL!PBKk5bs1y8)H^ZQ+{&OSJ@>O5d)Ozr$cI5Lg2y#0j*4{Tpkl za`m&~WOeUxj#Ounq`>XTS87onXz?7F{A`|tb-`nqK1*TnjG}g@bDV~G`8u9D`33E9Z18fk9jwTC2sG#43qvqe<{@6XeH%@JUAtpD z|9Sr+We(h{;c+P2a`}FLJW^3lqH6bsIR8(?<&;tYE9AlBRL{UbsLu-gt zyX($0-}9Mv9{jj>x#MDv2CNcc47)_{!o%3&D0tEQxIb*~a|OD^2z!|Cd-P@CKG^;} zi%=f-t;v2WDg}}vB~pNS7u)E|ZiOw+@*7dPf(1jGx(H5QB#>SlgIvUt^HUw7ud!Y- zYSf$DWzg}=_AyXup|1DgdF7An#ca>hOW*eotnQv7@Hz-D3?zwhu@3ou(>%&sNC5mzLbQM)#a z>luq>O)3`|SciMQ(|9;``z8Gj*7fpc=8Aht_%3lvgGL&eM#1D|VLZXq5_JR06f}}7 z&327%>CIo+f#GS4*re4t@Gfbo5&5u(#@24oT&muRk)9Y(!hdNKJ=YO)d!VbKUK~$Y z?h+G@&R6Z{VAbh70BzY^d(RJ~V&)VFO%xf=Zqx#qE&7P{)*g6VoswoYP;tHb47?G| z+OCNnOK^kCPNi40Ic&$42V!o7pd6&}}9nTgIGFCBTkl=Lbdw@lyIw5e# zF}-%UMYOarnak^ysq3$+#CNyfB!+x#vBhs@ixBXQ3l3wC zc5Kzh5_YZHO38i|Ho|=Q{!IoCjhvG7aaq2yUvmt+(w7mx#Y@n!JSR6`Agt#irkE%p zmg7K^ohY1RR$b|3QPE2j>x4IT@z|Z@dwC^RC~AY(&;(x@X!yC!H0+D{Bk8&>!StM*IMabm;^QrLk!puJiV=lvWCcS7y>!)_+CtIfV4N=I+3T>ElW zyOdk0#z0AhB|wdra99Wk{chWLM(b2|W1zoO*pZx)EvmvV*w4egezSZE-1FlUtWB|L zuGkMk8HO`+V%{NlB1DA~ZfCTc%_W@@a)&HWtJF*>?1whsIfHy7*BKN>jc0M(J$o0d znz}{%SmrQ_X(k;;A$xEbXSHpX*66h+Xz*;@gCy7- z`z7C@@Qikaq{^%SH>Ue`3TZ$i$K-=Unzrn{vg_aCeFaVtE6fhBG`KJ_lUCGM;_mye z^D*BD*%M~?<6iTI`N1L6^nlrcgMr;v^rsvr^?#)9pT$|y)|(nhrb?9TxFKY0FcTwI za@E8)JTT!svNjKBCgw-03ciD)L#J{1u*Xs=H$_+H=KsNDdhzVU5^b*(rMv6%5#~x$ zUOUgRjh6A{_^s!MJ8`jf zK`~oaoF(x~Gtn1&WpsX4MgEc+eq-tJBwtmHWB;k6#C;R#(qWckRNKvj1{R9p#5tHE zHzRUUf2~j{o)~!Z7@DNKUr?(;xwXzgHuN?9UNyf`nSqgz(6zjPb%-)MQ*=66w}00e zIu$FH-gaxLBzTBl#VJXlTVgqZT|HF^b3*nt>&SDih#;>#maPhpzwR%reImN#{o)=e zj>&+-ojZ~4soU>Yg?osj9H~e6&RW~~Eg+qd@_8G9XYe zrCxLq={JJyVjW)^gw*`~_DHiFE!+4qUZX#(HWS2jw+k*FJW{6^M8QQ)F+~j!WOh!K ztqt2hos*VJ88}CiUM{1!@Lo^6LM6zPqFmEM0+6qz)k4z7o!OqCB%W1MPo@a-Kt~*{ zNtm?HeY^7_jkkDerbu>OML|J0WmGepZVRD%h#mVBQu@_tq!+vjY$*!73M0sa@}5ry zT5(?TfmKu&J6Ta7rAtme;#gF3}g3PRv+kKdF#350m(d4nX6~) zKk{TSOmJ7%AnjZE$d;|OCq?_#P~dU5Cl{$6e<=yQafV#4ZUh{l>6J&8{_7H92|1?~ zrARN1c!?EYJTnev#D$9%?>BxDheWQYIAI|*Zjk*FdUVI)42lwHdWS-oGxNykk+v-C z(1K`D0tR3()hsICSBKK%XM2Wus8PhSePxGUP-r*>3p>RF3|fHiVxt+gVPDw`{z}%O zf1xl~beVvqRrO$!a#dP@<7O_sfsh3L;(;WPaXNJsph{@~Ndy#OL>>~05>oK5waDTo zW_R=e{J8E~_>)r#-?%evOC}}jpM{h?Z@fSA?8$DwFt^XW4u=QRRQOUCqef}#bfUiCp>$>u-4X4#Q#jpyROOvdQ`cSPc9nVu*9yb_}#gM+p8w}S5ls;?FpyPbK3PVE7~uM z<9Ji&pI_!#Sw>0bvuofra)gmSJtu}{V zg6OD2O?`Xf_2Nx*_=^bqhV{pM)7ti(e8h|gd;1VR>>`bVvszwHX$E$B1<-~l<|h)mU+)HIj>fZ+&)ex zA|7~6{LHWx-uqbrf`y`n;U4_GufADZAVQ5NjbvG&GyX8)O->!S6G%bnV3c&_LHbGx zi7r7MHPGYdUcUzRs!Lg+%+{4|zN%411f_&=|5-i?P^lmQ09eI&(!J3;4Az-WwLDZJ zDtFqB`#Z=sn<3){?H+`FDTL*=+;_k_Y1~MpE7|(`9ye!OodyNm%hdKFDX+Vm@(Q+; z1DvPbNwbj?u&L=~CNmv&w`cXJHrAnaRSbBwikg73&js*=(f9E8FXZ^=1O2jZxuwST5MghN#?T>SluM z4k(A$9fA6I>Yq+wq-!~eH>xw>Z}(|JZtMaUfPMyl7K7s**Zv!aI!F9(ad6ie-!Dzz z+Z_$+0+GQBt3ZRGyp1KI6s$5Wl)5eTHUV*1@kHfk{FD&;RC-5aZ4XBHrQqP|6<- zrOo%e4${RDAA?PFK;f$~K!Lc$3eF73jbbv~)$0|&87081N9GV9gTr?{ABrqe_MZZh z?wVeZUrjg%vc4Tzj)4S!19L!pj66ds7@l>?1L zdm;%$wPeSGU8`rpA+2o%g(*kj-$GO*STzy|0#Q^R*@2)F8D4e<$jQz{ygF`k1yQU# z0OYtpUvh^3O$U6@UttX(9QAndRR?H;Gt-O!h$Vm?pOvF#=?;btQDgFE$1d+loRyyANt)h<%4iWr|m9B@WCFv1$iWCyC# z&CB}8d!h|GwC(!-)IDkGboCwIAh3nJ0%zutnEc(S9$o%w1n<=8o!fQ8JL{38u`L$Ncmc?9Rc3!V zlXWlb>tZF;LrTPCvI}H`W;;Ov!8*G01}c1p z9gk@z!H=3B-7XTz^9=8h6IuJ^m2Dl*>tj_qin&(D2Fkv^_pSVQAcpF3}@DphFH?LtKG64LOf0q$FN~hHNoNv~I+{ng`w#ZJ_#R zPa(YP-7O%{dPH+m7;sDVOyM@5WZIu zh2g35e>y|N$n_?iyCkj=tv&M7jc3Su32-uGX%yWO?~DvpyPjKXV1@9Qj5I@U(b30R7CP1X{1IOy+PVaVEFo_m zgL7Kb5pFCC*EEglwpa^G+{F=OED~@5bHpqEAAzW$&gw-3owOVzh-5rt*f*os(B&a~ z*uZCi<;Fc8@o8L_j5wD8M|Fp3M3+pfQOmVJW6fQ*)$hrsC8|^1aa-OT{_*Gcx0WM^ zbSKkZbU$?daqGGWx0!wcgLryeztFu6f03^vU!pkDP2DRo9dKnom*93ivg~u3w|Q;M zr>(tw?3{~6hoN#_@L|oX44f=A{arGhhfaDWrkU)OzoZi2d62{ManzTZZEEvVBGDaj z)Z$w)Co)vUm%UF%&h^q!iyPI>dLC}?nic9g8yhSx1qZ=@qr_aVQdfV42%>k3)i@l{S zYJS{60sm+HMdZ!fa%>9E5g?v9hNuB&vp3K>LFXY`#sz|I#=J3?Py=+Q)1}g@ZLBqO z`;DPb(=ggO2cDl2>2k*QbpfS5ST(PrS}GUQ=-fmfz~^p-DfAeKaS}24nFazMKVHrZ zP`e%@(iT>la z&e&%HUYO3V!~y=+XlVflN3pqdG6+C`r(|;{9&>YppTxZ$(!%*Q>Z-%s> zDAlXk`Y~04HU$j>(x#zIuTB9zFkGooZ z9)$uJqy^c=b$Axo&cxCP>UZ&sN>qDdKBbO&2ln*24TVfX5rBnU>OZogRtpBDjPhbl z-Hc|wJ)$RN9}OPNy0)$%q?d$2Qlv;Mn~v-qNzuVLj(|2+1*2`L3bZs=r1>n3=%_}I zceJ{_5X(M!N#azj{MTo`Z5!(cICW^^r3KwNV&!kq)OGvS1qgM;5!2oE-b;v{)EsIO z8qdTG?ZqSIY-73ku##lXTQ64F)!5&{vc0TKa+=?WL2gMhBx+)Q$G2TCMSLb-svGdv z6fedyit=YVrACQe$jpXPhz)<&Lw2;{Rv1e)Nw)}Qaos%C081S|x#{k{u>6m5*h(RR z`SYRyr5EruzwEL!>n>+VU?rf=eeF;6c8V_}*iStowlXnm%OZS9uWJ!Jl-9D|5la>E zwA7pm-acNj%;wwz#vQ9(jm$|08rS2`nbwQu9T8(EgJVj``7LB9zl5!)c)K*tadoE%v~;{DoN# z$(t{X8bzBPfqt&m9orb?n`xoXi8ZWOF`JbOdoB}XDjOy22ve3uyVsq1=&6ErH@kW_ zQ7B+2r&=b*>BGq!)>dgJ_M>9Ds#|cl$Xb6biaH zIc1||9`Q#A?RI4Q>>XLaTeY$Z#s>0}635ngY#$#HhL$!%Q7e~d6)ttT4sb~2ywN?+ zEN>*XD?$M`;rFT|=L`Ko+kl|m<)J!Hz`cgwSonk2v*_{w_Xql~5@;-@Yz_>m)qWmI(P9bYewEwlX0!iM84sx8 zt{V;W?)EFZIb}=9#~XQ7?^lSuA|q-5aUg#N3U(Dlo89Qgp^cIKW*y(g7NX3^&0sYvBZ<-Q%h{ zfJ5^uj)h32U^(~!?dkMJ5+fGX=H~fU8*1|WnNzB5ewz4tdPV38lBzzw%ND2S8`i^h zI_z-zXRvwjN3}Uwvd11vR!Gg9&8uX7D-)i7bm>|%W0g<%!)p|ns^|gCQpbvn)92>6 zMEto4IM3vNszb$3G{F0czL4QqoC>RxP51->U2@g7xr$SW$0-Z!$s1s^JsI^~S$5L3 zWBegXcKlH_(`$ZU)MloD{7mkgsp~-1gJP$xrJVk0QgtEKClnDWnNKdPwx9aS@Ie80 zTEt#v+B+L=fGW4cW>n~=!AlV9@SRvN&e8DlJE|CnySovq*c$+$(oAc!YqM6%@;Aq|hs>hc?9E!uw)MzRx$oO^Fi`nNGo z!6(L_9u;beFL?|u6c4cVT8)r)I&G=LV?2*=xI~i;B2Wfae!q3cgHIvl4?5y6mu9*^ z4H_M=r*_DX@1|}B^CYw^oA!i)Rfn~Vnoff!*M-?B^0C=#DBVP=_ZShMt=xE#tBl-i z=!_?uz(F7_OLng#h+j`ss)3l!VuK+HraZ{a?-RU6w8mZh{u}h2Q&(1I{$o9Ns4oO+z>4G3F`8|4(X7gG0Qbv2;!)|Kr7WTx1j_d;DnjE4^cl`#t!*vyjA9RY60 zU>xp~^O|Zq-MTNR6X~-b4p{Y>xNYZ`X`;{kg!P`Dc_s!{SS@Ev!Th)z5sh-7Zm5g+ z4WlBLmLq=u!D)vXS`kq?u(;?PDI|Y-(FLUQ5ecVP-irU-K2t~%K51vZ?)oVa{dRYf zwj@cp;1Q`*f#x-Y<7Z5s*gM!zu&>=w2tJW%m~^y`zV(44JYCz~_tDtPjI<@Pwn(HO z94LGI9%?>izY+l0=`p*yh@E z{kQLaT-_r|)DS{rv=2|$eI}&)#O$byT=-tTD5E>1yB(kfIX`c>tTP{rhM5U2pm{sO zZ@pcySYcCq<6+%>J!QZ|o$y>NQjGPRk-iu1B3X;puK>4bh)&$B*yuPeu9h`To1HHE z&Z3Zn3Wa@f1O=o9opCyW3shmUTSo3)7IN##s!*c=`wZ5dvwPy_mewdv!2PNKcg>89 z1r^Yw=bB$X=qRpDkzB!GvOyR*{q|k(2QbSOo@t<*&(!PSAvK({D+=-Z2YmZiLxZORnz>(#diXU6}WHkVoaa(`VH$YQg~I7qkJ&kVXjWuIeYO}=&o(q#5QM> z;ewk|RRu`HN{A^yxZwZL!}le)G6c($KLL1zqyGn=3CRO7g@3gG@Lfg!AD$DoxVQgt z^c{!g#0uA5E~m?G?909VYg35Zjo1hCa(YE8QoY=bz@km|fe7;##Llw4g!pjV=I;5Q zq3sqc0X*Qq)dk@1cwR_f#6_xmu6KO` z>$IGSrymU|&@KcE0NmF5o=Q-X2aNlcVB>~{7j)P3?fJmwV@z1nIXtOZ~q_UpJ5xX0Z}=+ zK~UX7*(DcgazPXAw->u}n3L)mE|4bIovz^JX89T14|`Fx6-V4}F>-4RbPcVVED5 zzHQ8E08@M5^E&6Is~CLQiY{Vah35tHh3w{17#HH4$PSb$f&dQQg+=wZtFAg z_=p(k(B=xVybnNAa<%CEmfJSR7AC6BM;H7x{b)v~N5|tM9+OUo7C-&gQt;aOuOrSN zVptC^Mpd&6mj93!`pZw$f~2_qt7~o#r@Ksv-M1{`Q%sbqO1Q5#>*B83)9p9X<$iU# zVl^oI?=-H!7Va~bwht6ZV(Zuc_9p#MfaT^)u^~00zkm2S?>?3n9=v5`Vdu{O{WEnq z4MU!H$$Sv#_nq=xTmGOuO)jrPtGXYQ<>NG6?i#x0aUSNpc;Dqbl?%ooK7fK zWJM)_vb?KEbqP4TArJ)I4{INB!;rIYm3~S)kBuXSHM44fPLm} z@UGsd#u1TJ(I`;wX-Zdj2_bLM+hdCeB_|hFtWc@@*f0gioOJl>QBM?DWU;Pal9+kQqy&iUy!whq=@mOM9C z^M2;@==<<5-ZYha2uxg;qK$Jz};o&G@&KfvGTMmnKa z>+Vm0r>k!3=>0Yar?~%+#gTRs>73`NUNiYDgqTbSC+*!pp0dbYVG6hqT4Z;fY0~is zLg{U~fpMa^*j03$ZhsQLLi)f2t!iyHCV^?-LF!)RUc+Hr0FsENd6EK<`-sFWPe!jF zbUp(Y{0D-uE=HNzKaL;*GtINxKN&=I{k^a==LSsp@6gd>_1H~P=k2T zhpc?op_kc>cEEkG)r$fDIC=lk>%Q;7HjoD@v63a?F}iPn<&Zc_JBPAx4*;7bt|K3s z5s;};bM`}}o4Pah;B4yQR#5>*j~+LbXda5F^>gNSFurMl0ge6E0!#1CWyLqZh^V4G z#s&1%i8=PO0WbB~lcr-&W^DD~K|PB;R-M5Hm)hkQZek8ROSYl@U4rasxO0~=PphLnHZnsQ=rW->&{Oe^)sh7SeJR-Gc8&{WyoTCHFgN)eEY_QZ5=Jk zj!l7%I$2Ao)pr%4d0syOkDWGkhQ4o{z@Zk8Yrbc>xHD2JN$cpEESA*PkE35%4FeCg-x^+(9d`#LQNRZadh#1!$oHZr0{Mg3AZBWFTftnrxPthxzMmleWhiErP%LFOoS za{afZ+~1s;TLUkI1eW2#Sc^`hM<0;&tg%1?b9v;S-^lecp4v$AkY!{75n7^32_=7A z&W!4=rs3P#F+$K4u15Am(!oW~aVD~txWgbzD7EU!9lrxHnJ*gM^oL3cZn#B!i@)UNp0MJ{XT^77#p zHLZk7L4aY)q<)3Wi*&t9gGu7jOIjV>^0)Vi9qy5rx}K8P%V_7>^r?0&S)-L!xOUuK zsr1>Eft`iBT~Hp{&j8=1D53I}BaFGbIkA{3cG2>0Bu)*X3_V9Jrb|l(rxme5ef9Z` z%_LByUjY8>@)PBIxD_f5~_dW4MEB^lC;seWG@$ZTf*gC z#@QLJ{`HGAD7pd>ybKTV%h1EUybr@)WTe}$=%Ai@kadKFFk1?~i=-k@BmsbFn_l;I5^gMD%1b4*D zTeOUGzTf`-e*aZC?RcIyYV8(b^`mw!A(QOTGZjEo!WlkOy;MMoy$cs_G zzTFbL%E^9&Ql$g=NCfPN9}RWA;Gf$QJrMVIDVF}cF)tzF&T~rOMNj-=c7n2B`(4rg zp+8kIXo2`*!3v~RV?kXxLwk%A&gbtI^P$+h zg009w`1j{OzpHwFHr)8TQ0pRqmuaCw9^mge5&Riayb6kfD@e3(9%^qI<0hqRdRb7l z5E9E=LB%#3i>D*$QR4-&gBz5qdvm>m0?RfC>v_pFN^OiP(Ws<}2#BrH*ED=m3pfkN z!2@^uvzB{)s0jkHC4N8Abk^o<07W(h2~wa@(NLfU(BRP!=J%$;tzgrhk8u5DL%e+czzqn~ub>*U(gQ2? z56Dfb_$Vu<9fX_}zd;cFr|OXg)r0DDGpfI{bL?|y8*imWi(T@;+F9GD;f%dbtVtrwh;aaX~{e?99?pwGUhI$q?{UlfIOZOVRQ`@hvukHYFAw#Kyz&|bKTuHo_Rb>J>Rew9Q19)a*7=~*pyLPcset;i(#737t|qX_ zRHH7QeWdpr{s>x8EK; zvyK9eVgfP<4fc}N+|S9p8XqCg@n0DFQ5$k4e8PbbGTn?I%Xd!i_Me_4ZnfIFQeH0o z?q;~8z&rQ5_sdUexOeZy%l_(Lf|+8$4leIwc&$sBSJ$XSMtq=|ukq1_W2XkHz6YO& z6+#6gET?`!n#AD&M_h9$dy{^)lpyXq49811t5J6K9?d!b%jEvv?x^VTMtz!_Pwt+Hnn~HLk|Gi3o=helbI~fZG_vnAZ z-!&~WWp#*5h;Z%m0d!Eq?0wwOpGPlBxA-p%2qfim3Di!l^wZWg}B_5BwZJl^R@=;D5(>^=(A#K?hzHoxbkysBve2y8p12^@Q>&K@KonO zfmNn+A^LeF)e{MG(6fkRfbQ`PK~Vg@7?OyCMsnswHcEeCp(vU2x8(6 z!LoGWT)ex7v~jXB!kKlUA#U>lTZJ1PSx4$}FMy5q()6GI6vq?Ke*xdjpC3fY(9KIs zU!2Yw{_%aS4!2#9#e$M2wNz>*6F1PU115X+OVY*TXwP~{(0Frxe}diHs1GS7h0E$# zVZko2(P!w0(OC-O{1WizS^cnf)Y?VbsXip1%TLgQ24%V8syjva67!EGZY{r7vS5>A zgaZpTiO^@OBgXD4kp*;*+ms*Roy{4NPT{zp#fk2}G@K>a)Puwb@M{<`!E=6(kwtd< zN^J9Dp{G{u*R*If+7P2rx&?s9BFPuNeC$S>qZ3;RqBM1cqJ5qXL*Vl^JlG>(mL#Qg ze}B!V&buN#Po`-lsZ%>wCc0ko6TxYzV@H_6VCM|NMR5b7!i*3Sg>tbaJXp%9&7$ky z79a~&O^RItZ%MMfLAd#b%v1;9Q3@lr5PFd)>rU7Td;PgtTS$|^Xa0y*yrx2v}A;m zQBKh^-;`~$a~@I#qfZw7QS!13=neolkq)V$J)%f53cbIEwE}WQpbL8DC}PFI*fz%L zuREyuo>j3pVgmcBSH035AwunDM@iwfLL)d zKE0ryQ*_a%)5wMJh!Evsqir8`cpVFPZUEFPgo1$BK~(Guu9rNBy`Qa`i{k}L2VIwt z$OxyUl8E@?SpAw*#NY?8PGc};;cGP+sa&WiOz>s@&lh*tw$fe~@mES;_E7Mg;wD2D zN`fAo*_LO1ZT~}T9o*VHK74S2DRTNX_Bnkh_gN?V*sF3hb~aH>w8~~@Z9+q3>;l!? zwVtz&9$wRMNtuV4m=ndj5cXC|P8F`(64C$QYGJe;!B<*Ca3I~s1w8^_3P z5&iD9cwAM6-r5qwy;dxgrvc|)k<0qFnVcQH#hfEFmrsCfoGick28PeqW!>P&y=4S0 zUiE{%O5RM4e_(03^%qxo_&)E4Q`!|BoNeTpO~k5F=sJbk#N?P5%wRRjiqbwW329xI zEr$V9NfXx^7=z*Oihqb?vkhD?;20es9YolZCOx9V>xJje@AhUGUOr!V;dmV5&{RVy z$0BmtU>?5sCp*k2NmlzE1vq-9?HJK{>9#SBvE>p^B}cG_0-TcMXnfa2cti(0G0WBO z7QX;_H%c**@(28B3KM&vNUN}p~ znr7*)7RM0l+#btO_k|z~|EHRj);4+O@ege-T+>Ja(`a?P7>W;&_B)rhonxAZa&U?j zkD9ecmfcnSu>yLy$!GVjlcf0=r5RUAZF2whJY(ex z6QV~Vmi?B0=B%xJO6Ny$0t^q|I}lE+ZelA@hzkgE=;B0IN^-JyVnE59h?LfAu*~kd z5+%%$3(q|SED80b8L*ryTn!mj-WJP<$=)(7sAZ~Uj$SlCN%k%1aKj7_-yTUh=5gzb zBmRX4aCM^baov69WiYIBlD07v0+I&G@A^yW6E)S{Y+jCfO|y2j2d=! zSasY#>?y5_uW_jh9mq4i><3;$S_Ta(I$lt`G<<2Yx6<8I#i_7Q)KV%su9c$MO#3aYeo|G0 zGxO0sAkS@3FXdckfXsqalFQUNl3T2?&!$TXs-T;TE&_`cgn*lW^3Dow~ z?nO&xk^N&Q&@6ctzpCQW_yEv^;-Jy2-&^i7MG{vUPC4i{q+ppg9E+=JzP>}#@5}s1 z=*QOrh^>bp5NO9A$BZ3BOY9z9W%PDZ0zY^ieEIb^DC@k;r{0dmf&O9o&T*nx$zw(8GO|~CY@_@lyvA72~Tir`Y zO6yDWVKp=V3tj{Dc`MRdc{1h#NZOZXrQPaSF?)et8KxMiL^-Z|qFRI?vFFxV7aOl26y3ss1OP z&nw;}{x(}JV96(m8^f!hV|+5!np$_ZYjS{;==pthX;ujHyctZW6zs1)keaUHeU*{g zI)rv}Y+5H@G~5_~3w6>OoyszbqMuAr{Zw0ZS!5Tf%DWZw7QQQ|WVU#&s|>9h0k%P` zI+*{AoUDQ(0k5pH(X~%a{RbFh0E~&a!FaBD_#imW?Pvd;ToKpTJ3V{55aFx-e}KFJJ17g z%Cq5p^O=wc{P%C$lQ@_Ey;Y7W@j3i+O`M4%(_x=;iH{W~>>C&NW4;=0W#z1iZA_|g zsUzXuKOc-*bp+g7i1?#}!&8tYfB>r_fm*tSPQ>Dwf$C;VdxrP3@TC?)H``6x(lzg9 zpZNLXJ8-9S)F!JOqrt`RQrf=#pfkMtTww!;PLP-o5YfAfq(_M2zTjn3PjO|3$}%+B zi5fH(G-#-z(%KW>KBtap+upa-9ya~{ulJKZMV{t2WykKm`3!v%#!Y)gKuf#X#i3FV z$VKM*)O+ypEmD$12(Zq6PdWMvY&f7?CI$?80OCZMWJK#IQoTIy2Q3lfRDqD^*)jPndp&Fy() z3(7EHIGQnA88miM#ih1pim8KV>WxjQ!+uZcG0-rpR&s(aNCAsWB(Q2uJyUXXVg^|6 zU3I#;XM)f!BPP4&*C#b9jnPjpJo)4qMaD74G0bw8BboYyVnpd_^#<_(ZeazN3j_T4jEVPc1Yrd?+L(yH zgc~hHlgnxUo4Tk`wMRmy18kg5>;%OI8LTBazRfm-(lXMy4T=}rCry1TbpJeuegRVE zG;kJ{3xSg~@o3Y>)>#_IE_?4;FSX&$pdtz^@-phnJ5v|<;W&ecO_k9Pd2O9zG*e3s zUyacx3Q6nKJTSX9zTkU5flI2meW1K5k!{<^g%DnE3dkALY|AApB&HHbcBlP0z%9Ia z1uh7{@P_l-uX3fx!BW6vOT!OI|GtYygr}iwldS1_(aJV(17KtVLIm@h&~n4OK}%Ne zsl+Mu%dnFu3f6Ex+q7n1BVa6VfnE==WXGmmwp)8*b)tqcnuq z9dt-9i#JtsVg%4_9`q35!|Gzc)s#~OhC01;M(3ZqWO?JzA_fT@K!I-mg7Ysp|9Z|p fKJfpTR>ME%-14st|6Lgi0Y873SsyDmITQOIaOdGk literal 0 HcmV?d00001 From 18ab43070b1a3779c04cadd35c83d323de66cef2 Mon Sep 17 00:00:00 2001 From: Przemek Pokrywka <12400578+dekiel@users.noreply.github.com> Date: Thu, 20 Jun 2024 00:17:53 +0200 Subject: [PATCH 07/11] Apply suggestions from code review Co-authored-by: Patryk Dobrowolski --- cmd/oidc-token-verifier/README.md | 26 +++++++++++++------------- cmd/oidc-token-verifier/main.go | 8 ++++---- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/cmd/oidc-token-verifier/README.md b/cmd/oidc-token-verifier/README.md index d8ff1e22c774..32c16d38f404 100644 --- a/cmd/oidc-token-verifier/README.md +++ b/cmd/oidc-token-verifier/README.md @@ -1,11 +1,11 @@ # OIDC Token Verifier -The OIDC Token Verifier is a command-line tool designed to validate the OIDC token and its claims values. It is primarily used in the +The OIDC Token Verifier is a command-line tool designed to validate the OIDC token and its claim values. It is primarily used in the oci-image-builder Azure DevOps pipeline to authenticate and ensure the integrity of the token passed to the pipeline. -At present, the tool supports only github.com OIDC identity provider and the RS256 algorithm for verifying the token signature. +At present, the tool supports only the GitHub.com OIDC identity provider and the RS256 algorithm for verifying the token signature. -## How to use +## How to Use Run the OIDC Token Verifier passing a raw OIDC token in the `token` flag or in the `AUTHORIZATION` environment variable. Token passed in the `token` flag will take precedence over the token passed in the `AUTHORIZATION` environment variable. @@ -14,17 +14,17 @@ Token passed in the `token` flag will take precedence over the token passed in t oidc-token-verifier --token "your-oidc-token" ``` -See al available [flags](https://github.com/kyma-project/test-infra/blob/main/cmd/oidc-token-verifier/main.go#L45-L55). +See all available [flags](https://github.com/kyma-project/test-infra/blob/main/cmd/oidc-token-verifier/main.go#L45-L55). If a token is issued by the trusted issuer, the tool will validate the token against it. If the token is valid and the claims are as expected, the tool will exit with a status code of 0. Otherwise, it will exit with a status code of 1. -Apart from standard oidc token validation, the tool will validate the following claims values: +Apart from standard OIDC token validation, the tool will validate the following claim values: - `iss` - the issuer of the token - `aud` - the audience of the token -- `job_workflow_ref` - the reference of GitHub reusable workflow used in the calling GitHub workflow +- `job_workflow_ref` - the reference of the GitHub reusable workflow used in the calling GitHub workflow > [!IMPORTANT] > Trusted issuer and allowed workflow reference are hardcoded in the tool. @@ -35,23 +35,23 @@ Apart from standard oidc token validation, the tool will validate the following ## How it works -- the oidc discovery +- the OIDC discovery - the token and claims verification - hardcoded trusted issuer and workflow, link to issue -The OIDC Token Verifier is designed to validate provided OIDC token and its claims values and provide a status code based on the validation +The OIDC Token Verifier is designed to validate provided OIDC token and its claim values and provide a status code based on the validation result. -The tool is not expected to be used as a long-running service, but rather as a command-line tool that is run on demand as part of a bigger +The tool is not expected to be used as a long-running service but rather as a command-line tool that is run on demand as part of a larger pipeline. It reads the token issuer and verifies it against the trusted issuer. If the issuer is trusted, the tool proceeds to validate the token. During the token validation, the tool uses the OIDC discovery to get the public key used to sign the token. -Once the token passes standard OIDC validation, the tool verifies the token claims values. -Then the tool verifies the following claims values: +Once the token passes standard OIDC validation, the tool verifies the token claim values. +The tool verifies the following claim values: - `job_workflow_ref` - the reference of GitHub reusable workflow used in the calling GitHub workflow, it must match the value in `Issuer.ExpectedJobWorkflowRef` field of trusted issuer. -If the token is valid and all claims values are as expected, the tool will exit with a status code of 0, indicating that the token is valid. +If the token is valid and all claim values are as expected, the tool will exit with a status code of 0, indicating that the token is valid. Otherwise, it will exit with a status code of 1, indicating that the token is invalid. ### Activity Diagram @@ -60,7 +60,7 @@ Otherwise, it will exit with a status code of 1, indicating that the token is in ## Use Case -### oci-image-builder pipeline +### oci-image-builder Pipeline The tool was developed to be used in the oci-image-builder pipeline, where it authenticates and authorizes calls that trigger the pipeline. By verifying the tokens and validating its claims against allowed values, it prevents unauthorized or malicious image builds. diff --git a/cmd/oidc-token-verifier/main.go b/cmd/oidc-token-verifier/main.go index a2359bfdbb20..e66fe329cb34 100644 --- a/cmd/oidc-token-verifier/main.go +++ b/cmd/oidc-token-verifier/main.go @@ -138,7 +138,7 @@ func (opts *options) extractClaims() error { // Create a new token processor // It reads issuer from the token and verifies if the issuer is trusted. - // The tokenProcessor is a main object that is used to verify the token and extract the claims values. + // The tokenProcessor is a main object that is used to verify the token and extract the claim values. // TODO(dekiel): add support for providing trusted issuers instead of using the value from the package. tokenProcessor, err := tioidc.NewTokenProcessor(logger, tioidc.TrustedOIDCIssuers, opts.token, verifyConfig) if err != nil { @@ -160,11 +160,11 @@ func (opts *options) extractClaims() error { verifier := provider.NewVerifier(logger, verifyConfig) logger.Infow("New verifier created") - // claims will store the extracted claims values from the token. + // claims will store the extracted claim values from the token. claims := tioidc.NewClaims(logger) // Verifies the token and check if the claims have expected values. - // Verifies custom claims values too. - // Extract the claims values from the token into the claims struct. + // Verifies custom claim values too. + // Extract the claim values from the token into the claims struct. // It provides a final result if the token is valid and the claims have expected values. err = tokenProcessor.VerifyAndExtractClaims(ctx, &verifier, &claims) if err != nil { From 14d54035024b2f98f4397a8f424da4ef6f7cd727 Mon Sep 17 00:00:00 2001 From: dekiel Date: Thu, 20 Jun 2024 00:20:07 +0200 Subject: [PATCH 08/11] using important baner --- cmd/oidc-token-verifier/README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/cmd/oidc-token-verifier/README.md b/cmd/oidc-token-verifier/README.md index 32c16d38f404..2fdac35286f1 100644 --- a/cmd/oidc-token-verifier/README.md +++ b/cmd/oidc-token-verifier/README.md @@ -16,9 +16,10 @@ oidc-token-verifier --token "your-oidc-token" See all available [flags](https://github.com/kyma-project/test-infra/blob/main/cmd/oidc-token-verifier/main.go#L45-L55). -If a token is issued by the trusted issuer, the tool will validate the token against it. -If the token is valid and the claims are as expected, the tool will exit with a status code of 0. -Otherwise, it will exit with a status code of 1. +> [!IMPORTANT] +> If a token is issued by the trusted issuer, the tool will validate the token against it. +> If the token is valid and the claims are as expected, the tool will exit with a status code of 0. +> Otherwise, it will exit with a status code of 1. Apart from standard OIDC token validation, the tool will validate the following claim values: From 23f2d5f2dfae2825395590637b3f98a92b9c1ccd Mon Sep 17 00:00:00 2001 From: dekiel Date: Mon, 24 Jun 2024 11:35:40 +0200 Subject: [PATCH 09/11] Use .svg diagram. --- .../github-workflow-integration.md | 2 +- cmd/oidc-token-verifier/README.md | 2 +- .../oidc-token-verifier-activity-diagram.png | Bin 119274 -> 0 bytes .../oidc-token-verifier-activity-diagram.svg | 581 ++++++++++++++++++ 4 files changed, 583 insertions(+), 2 deletions(-) delete mode 100644 cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.png create mode 100644 cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.svg diff --git a/cmd/image-builder/github-workflow-integration.md b/cmd/image-builder/github-workflow-integration.md index 52fab7d0a70c..a24fa14f505c 100644 --- a/cmd/image-builder/github-workflow-integration.md +++ b/cmd/image-builder/github-workflow-integration.md @@ -180,4 +180,4 @@ reliable infrastructure for the building of OCI images when the pipeline is trig The Image Builder solution, with its seamless integration with GitHub workflows and Azure DevOps pipeline, offers developers a robust and secure method to incorporate the building of OCI images into their workflows. By leveraging a signed JWT format in which an OIDC token from GitHub's OIDC identity provider is passed, it ensures the secure and authorized passing of information about the workflow and the image to -build. The entire build process adheres to SLC-29 compliance, providing a reliable infrastructure for the building of OCI images. +build. The entire build process adheres to SLC-29 compliance, providing a reliable infrastructure for the building of OCI images. \ No newline at end of file diff --git a/cmd/oidc-token-verifier/README.md b/cmd/oidc-token-verifier/README.md index 2fdac35286f1..7b53bf65c810 100644 --- a/cmd/oidc-token-verifier/README.md +++ b/cmd/oidc-token-verifier/README.md @@ -57,7 +57,7 @@ Otherwise, it will exit with a status code of 1, indicating that the token is in ### Activity Diagram -![oidc-token-verifier-activity-diagram](oidc-token-verifier-activity-diagram.png) +![oidc-token-verifier-activity-diagram](oidc-token-verifier-activity-diagram.svg) ## Use Case diff --git a/cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.png b/cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.png deleted file mode 100644 index f2e067ef79cbc5f5fc6ced2264d1c9c59763be3c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 119274 zcmeEv2|Seh{y$Pt+DN5EDpEAEj#6aHnk9@iBnE>Sj9rB4RFo2->`S&0B1=eGElIZQ zTV=@-l`KW_|2)jdiF@z4=YQ|Hr}I0#&XIZMS-#6>eShAcCvR0{*%iw+E~BENS|Kkd ztwu#flS4(d_#NF6IC9V~x*YzZwo{Xpq)L6UxtEFxD`S6H+aB+1inGE}aR^Aw{Kmo0 zYi@04&mkbq!Owr#3Ttdnv?jo>a2#)Kf-}WoO=iC1=j9hf@uE?Df*O2i4gm>10py1u zk09?p-I?=^%&-LVjg+iiaaLAF9Q-muJiKtLT}npAID);kojHeqBz%@9*ki5WZ#WD; zRn*~!HvG@WYse>LD7+hfm9Vj~!fIhpDB|pqy9fyL2%zEcE=4&Fr6U~tQt-PK&JqiM z$zqKyt&vMih(=C4IBPhaUyw(LM*t2z?aFPrk9OC6c3!sI0_<4olo9|PV5#U9> zf@A7Nrba~EoW~)nfVDR=n^^&QWerUMS0m+piZ-T4v>b>yg?(l-Gk3%i?QpPc(~C%X zIC8PQiw$<>s0r2)XAC1jj@lU;S&lkyt6FP$i`gB z+GKhwOq|J&-zNYMMTTkOGIN9vjTW3aVn(Dqi2PjSfI7~VG8yuPW)3(LtR4B{nJewB zt*z{FHorb-Y)v45!2Rk(BO=k->DQ;3T3eB)M}Dde%=}juAqUjwEh=(U3uj^vGKUB^ zzW^dZ$i$E@6cYbpQUfv&%u8RlNV7+qqzsh%WN#{6cnSs*;knf?B3#f+)}; zWXT+jtQ^Q|K6Aj%-i0E=SQA)%@<(f;y}7lSHNnX0@b{yVL~93v$+RH>VV3-U&Jk;C z8(3RDIB0>jw|60nl97YGH5@Xx$6JxVh4~R(wBZ9Uj}Uw_{ZR+`NckX*NbmPgh~y%l zDEs|=fyirSXYD`)b(|KA1?NpZ&)$e=h9!&1g6DxPLDmOZgPFTcU--|(;JYx$V!=GY z)Zh+8td)^H&T;Nt_<4=UnqW42-mfjgd=Z;_1hMg|)?jzx_GIlA5EkUwzh7|w?4Oz8 zlQo@Rm@Ge(=gv%@d=F%v|5{FG1|R?iS_Ui(W!(RKLC9xMtH!@NbDjn*xGm)E`=?@S zWd#Na)?3oa9A}SJw=tR)2q!R#aBPn78QIy)SSeGSGa|&2;6bgVtgWnP47LF8^dC4r z@5Fy7e&8_dvE(iJy#hnoQK9{?qrcupA@VjleYbuTqi#OO?op0Wc6+Xr{g$o%FKpXy z*|+b8Mf$rb`Hz~Lf4Fb|(ro;6=0NCIk|XpVGXNAbAVDM=A?A%DV>XCAvYUD6Ph(8L z^8Mfht!?Zf;Iregx37! zNMrDBNGvFc7zrFiH4@}6@Hi6_#OF#9v359DqZ8Bq7x8lBH3erTB*`Hp4M*k+@WNJ- zqHaH$BYs|TY({+4DJef7bD!Ajtl;tdXDnU-o+xxwAGkwF5^!y^lYQ z+>xWwf9l2l`_>TajI-AU!9>C|CTkHzuxDJ-?+DSpYb*I;N{oo!_v=Rr z3X(rl9{KY|h2*uHqfkE@a>R}!SpiJ>y8-|H+n?8zQ*6b5-;{$T=c6RdWU2hymV?Al zQu+m5E!jNHk-QmSG$$?~np@*fI6%fXH~FvwJkD|!#(?baf0bqY+9n7rkYZ2{%}p^V z$0(-b4^1&7loj_o3Ch{X+X$IS7&%CxOiWc#^JBSr8-e(S|1zL4^UNQd5Q0qo4y1yN zYW-`^H@$_wBZT|SAsS*e|22*^jST!JbA9px%+W0=BG$+r0f#lQL8S4W3{V#C>ezLostF#NR z(7pvt#ZRrp3);a0K&gSNLP()Pzkj#3X zKL4YH`PU|W;T@iy`R~|JG60BV)`GtV04Yh%Z#LY&<>~YD1&UMuljqh8ira69$Nm7r zv!HJOT4u8&cgw-YCqOnGf7=SANW8FxrsUTDqzL+_PTmCPm5BB)5HnJ8wYec9Y4?+X3Mk@?@DA0;K{o3CG#x(WnZkiQv2WgKB8@tPU|dFd|__st0M z|CjYf&kOv>=*Hj195Ln#hd=YKm z4#vh&oel(49M%c3+q_OVpy&bwXpX@9P^7g&*fzj4=QSr{ zO{Yt@lxnTHy*)xW1{Spp{AUK&Ih^1zwgwip4A8u>R;UvI^*X>Odm}swA&(>6amvN; zn;CLv4GAT`08fXq z0RR0mu8{D49w_zC{vkh^ViANFun7E=V{=7@pKK2QCnB?;U!0##%-f|u4BJ~k&F4aS z3yz<>6LS;91rr(7#0B7Zg)+?mbs+ z7mOdFeG1Z#-{IT;JZacJoBtf&J#Rz*Y(am^5at)e$+!xdLbM@U5;TRwO9_$x^PF8i z-X8*k*)C4XGiUbVckqP&z*epWWn_M({)dR}&)KRID!!R`7DFw?)2R3cc>_wKdd-Uth(d)E5@Ml=4M-S+P_&)R{>u&1~tf;9qh z0lWprWT5{Mkd_&Dw1D#hk48Ra1`&fx$P`In$>aHtx~K)Cbqc=tAN5fb2Qe2%p&a{Td=wuqC6*;SseKfLkfNl2J1KDR z2nFhgj{OC#1DQlKC*=OoNg>eWpS-bT!I@F)-XG$o1cd%4jU{9+h2jH?GhG>^=)j-c zQ7wq8{D$oB-*HrkmH!=%YGxgOFq*#)SD{4D|1z84o7TeL61x9snT-poAY}pOSeMxb z2MweFS(RvQjJ30a7ZS|YM}9OvMg*jIGDD~NYqdk{f+B@Ho%xKaNEcZWz-S(f+-rriyn6bToLG7InbkAz9io7)PCMz4FwIjST z2~l6uX(gu6S7w_Z9Ht9~P|U!Y7{gg6I6Gr&P-YkS9gj6OHzMHd@I3P*%u#$wUqY<{7P&2cql}HKe^Va zA@e75v}6j?Tt~YwIyrsfUr=S|bGW3;;YF{YmN?TnYC9VsPj?6ZqvpP!O*_%^a@u_h z`qZB!r=_53bE2ks2J|P>PqM|CtDg%)H-AyC&jKwMhn?+-M({RYvQOm!G6N0|o^pnT zCq?-L1ZfB4EF@x_18V$iD*9upDzG5v^wR{r^CP5rJM@!jD7m~oS3?)}pwp`S7xbVM ze!+Lv?5{kiF}y+p;llII>Z!RAynUFT7we3??sl4MKW(u8dcm$B!rVdZ&!0U(UD&0} zC&bLtRZ7bN)Y`!$;~a7Jken~joAPIWlQG{cm1@pbQF>J7;s}&ue;y!zegHdfmwqyf zN-j;zwWtdV==9Y8f);gtZAJ}igdhbJ5MeeOF@=A20*=qTtq80r&IDdZHhbpJ57eXQ zp?>=)X!jgN<>&j~#Xr-m#eeWmGEf+e-~aiGxxzaAE#)8FnE8Ty0a#1mKq3Fa1M6~2 zKPoCVDtT!M4QGRQ1xxR)Jv>_Ip~|;C@%m8)OUa|W{UNHy?kqRGbaB6t_|r>KJn=%t zD|dB=**(fMRb|*9{#1x-Kiu=Up#`2L_W;PffTu54SbzJM@VP30Oy_ z_7eE8&#vt*T0%`HPDQiYlZuv&%8QCFQ=G7#a`h?xURn zDou$;W35{5+V0E^cj>-?k8tTu?+Vg;fo^j)ZniDnl4AGv1@4?=^USWmt=O1pO7L9T zlNQ5GmT6gbFZLJT|2A%ESrzlkUH(EV9OP_u+{N!Nnz}rZV?2CKvH>^DH?smg~4cn{~ zl$@p_hA!^9G*L-Bt;m!6&OUwjmHDy~LCJ~{8=qX%A#@HwrHiUoT`zN=H zcw6fHO7w{*7oLyD?w|~pO?3rzXZA*gi1(k0Hd$-er|L5m9FSC(stYbNaQk?;t_{7| zr%;NleSW)P$m%V<_VIf5`VO_28_!aLb`JN|mMM#lytH3(IC*w2*_ObWO9b0jR&8N4 z@R%HV{#X}&4*as-pyZyR$k|y<^j!nWe0>wXIXi3Xsn6R!UEOo{)oHZjyN2fzaZ}-5@r@~-;F1{+} zu>N?t%QL#I6yvcLL}mA*auSX!N9St%R>}k1V9&-QqPgBA*M~I!vQD=IM7N)7yUBXW z32c6_O6W~5l1A0i@;Pqhw7Cu%jzpsmyTDpnvg!HFPF^j(si4BG%aec(fqB2S%zKg!yeN4a4sAstq$ou_)ta^i_ zvBOJehZwaE)Dx9?usz4P`0{9#?A9BD?xA()`eSxCNKYQ0TcMb|yy=(OZApi9O0W9j z^a^xQ$w~S8K^G$F;fk$dEt)#mK#hqg+u2d9K2Js5bUviGm|^q2%GQUkinn?kIruF1 zZA9}6k^VggI{l;=twWc5pEo1Sn|+sSUD3zlt=3w{Y!Anr=1v#wON_ncG4(CNH^^qz zL_e4Uv$RBHlg2~Qp^_c=ARW_mZzj$n)~+zS7r4U7(NKNY-Z%{_WA#pP%4jmSd$yP! z&RaQYzJgE@A=`t%}%Wj_4=dF1u7a~ z+EyJ!zINLWe0na>eDKqA<1(K7TMoU|PaWG_%=%k$?Yv5OH7Mhh+~(PG&cF0}hdG!> zr5pSl-Bp{vJGrkgi}AoK&toMB0xxaesL!;=KhNC6>j52Gju%H}-D|d-EJkAw%6QzswvC5{ zGn|kj2zVY@PkEw=3{`G9LssOLZ8@j9e@Ue5%mrDhT;F2U_1ItgSYCn7>{m5Zf7tV0 zEyq5m?hM*LYaiuk6I;$*E8k!&K`<8YSWTJSJr3}0p&?c@QiMCNkL;bDoD@v%+?|{P zww$*3a}Q=GCjpbAM%|S1Yxc`1)utR4CoC6R>eqZ)h3ed@8J9qJ2?SqT(sIj6q8>Nj z=y|g4JTL=OP|;Y*hVDc!DzT>~`wwwb#CWStG_E1`n;BeKMlndvaM-!!^!{bJD|QAl z(2@^RN2nHU7AM?TL>cT^Y0qbPxyDO;>kzBD(u?viJ$P77Qt3`!#5fJpP#%VcyISo# z*}Rpge2?9NthVDMFjOVt44J#gvD^w%PrG+eZKQw*9?rWTn0EZ)#iU#urHm z5f+o&fHaw-uzE z92=}Dv39*$$v+zd%0)m7cu@Vl-nGggLihov?5bGV=FcBH@Q`@46{~nsG*CQ>4=gJ6 zTN#Z4)K*uGaugfmIR=Wpv4LWVGwSs7K1RgEg&_n#RMqW6qHEI!XkdQHMdvpUvaYDfn#c_$lCpL}T zOz_`!x7RLVDP_^B!A8cH)tA+kac67T6dYlied6jfVCEL-My$deF)bNRYA8eSuwUs|ijfv~YVDww<`z;1C?Zm}?@Tab8inw&bPJ~`LsKgX!E!nGgaQ~6r+b98v-)aa2xB2M^btKD; zZ`9IsiJlE@zrv!9Up-HX`Jm6{ekF~ol^6o}`i*egoKI@Nl zVXIeu@Oc2IT3-kuVSs5kY%J6A*?N3P^Z^*GW427f- zUocX4hn{I?13hQh@jEX>lC$v5b*`iDaH~Xz{SIg{Yhm=jnBdjpkJvJ|@#yC@L`j^n z^5zJ#iOKmoRE9jjOiSM(5S3Xe>G=8e`R2<92KSZA)$3ZKPEL;0r|9Jn93jPR@}yp5 z_3D9F_J>EynHH>tdq*y2>TQ_a<%?Q0NoYgo*NgjKCI#r*R~;rCF^hE1cAuIY z8yt&t8}hd7c&V3z0p9``zvEM8t%d*)YquS7j#U!h}q`uUDo1*1)6rHN0pAD#U0aA`9nD{oDly8^Yc-`}5j zaeuszyV)W+#j2+=I{Ve><>=e204y*)*?a%#m+FH^?@-@OoScUv(j2Ep}cUvipq@TYQg z^YaMjH{QLc_R5IRU&w~XSVbc_!ir!%CXfyV$`Q)MO^R))abptPdwC zxwPKxyixzWmUD2c$JeT+Ok4*kWjyVPZFZyS9X{itee{8Q`ZDqin8qja-`}_NFErPY z% zDg<-%WFJ4Uj)kntVJLCK{V&~{Kyu5%UMhzOmU@pKmEF?yWTN8GRHi|J zYp%ioB*;C|*@lIuQn!rkHo`avH$?y{;X_Q`0K@(0L)3G1Q@_zEBogRH+}IVp+w?0K zjt`+=A8k(!8GLzu@++%~?{TRBaRq*kvv;2JUkp%nf87hYjbou!oTj0l&rPk`lGl&V zt8nHpHslZHm7$a>M_cSF8n>O_T+NnKMIRf)Ztm?xN-#Y2B@RJ?Qd7=vJ=IWZf$PfF zAb@qS*6IzsZE;|7xMl#pF!$5L{E~KWNMQoBDeU=+LsMUs&vJBD)y2xL%Aqy-_;h`a z@#X#T5`&!^5JfAqX8e71CzStMmt1TZX))e(J-%Ur<6BQUe>sbL1UF4llQy#nC zVpf0JnDe$Kdi8601C;{-mNx|SJZSF1mZ???t53Eo2}F@omVC zJIY)i?$}g{QF3rG4Adx%?$it(@t7D8t{GaK;?xRSq~GOuW(C>?^U}7XDE9!zW~UZg zLTd^w#!y7>xYy!$5d07^uhen_&yp;Xvjwf&Pfg%CLrJGBa!<35KVeeIymIJU1Loog z$8AVmbGz2)ej-i6a+~F>)1FYc9joWnTc+o)hweULYV(QB2yz zQjXRTJ-ol3d#U1Su8*~-!k7UVgU!^YflZSJ+mo_izBnRK{<4!z=JICTrxypTV}nN= zxKX7J$(kw0Mzjom+E%#>9OU_c$HG^KQ4yQtula4G@)CiFsGlw}b(Nun9 zy63%%Xjan&KpbFdz=E+wyyOe_f~Og6lW+GqoLxyx=M161$S#(%G+wk|Wa-6knK6wp zK6f3_Q>hzXK}~m79)dA}v`eJB;P0r2ky+-Zt%g*)PtdLQ^ehG;zY-v2zIrC|EiabJ zV0>|F{Nq(VK8W#*U`UUjbH{S=z=)z+5>OGioUN){8T|WY#0yfm4eg z7V*NO)4)@f`eg#_(IaCt(I*mNoL;b)ixtpPC|Ypft8w2v&R88ezNY!K z679L=)O3PyX+ytoAPu#;y|_xmqdn_I0fFacrc8g|bfqe$}M+#k8lAFT9vJ@abF9hvW-1T_(L73qy_3ue{AX1#5LGZ4iO5O8k zTIv)oO~Ptb(y8XIK*e54=z(XSuAqX8m^@!Y)Te=91M?9G$sOWd=*&y}5i!V!#1_p0 z7OJ_}mEvr?un5QLQylh{;8UJ7K!!qxpr)1l&zyafk+Co!7g28zqh%BC0$gQ2TEr#@ zPnIg%)v;RynSj9G698fS6$bS4>_81>I(?RnQw-**1VD)h@M5`9wLb$(u9E*wJXj-_ zZBb+QzfDf)0R+0S(=pZ;ozYfsvKev%EX2K~WvUmLAix5lUFW6%nj1;Qu$5*pM^qf0 ze{-VbCXD5X9ecsz!;f!o^E(NGH>lolkD4u~yrZ}Zbo~^4&tzJ)Of9-_KL-)Xx%57` zAUC4nb)#E*T^u)pek5L-{ebCo^isg-02}+bN6}HZb_4BnD*d>GJ9ZZuU+U$2n?`cC~izcOxP=0AqP4eaWrN4TQWT*>QPo)4&SB|Na zji{pP-CcTJHejX7RE1!kq|y*T?2 zB9$zcgK62bNeve2zi3)6OM2;ggX{Fr1@T_YO4|C^C!K6-JJCz!6$GR^(MoxlE4-3u zWAv14Zv?VXdo|HXV~&M0DA+VoszcQ8&$KKFJ9e&nF|}A&f!rdA&g zB}))kGN|WNl48xWEy9oPTI!ZgYU)}u$Dz(rwCk{WsQYLmzUuJ$lyBmzM!$Y}8#w^A zkxY&t?ML0$jaRPP{>+0euFO?C!f(pWl#iwpz5E&Lm{*Hy*k;KxQLoJ49S28Vs%Jy8 z(A*gI-4)QA*ZtQR$Yc+!)ThKNDK>ZYWbt7bqa3Q1Va259Yqjp8ERskmD<_rFoGf zIZP@CZ9~vO2ClgN+T`FZE}d5i^d;0wHy_4D&S4nSs7 zPWX1GLd>qC6_*fBB5*SvBjsRra1UPwbg1T#1B#6~?z9TcxyWT+dq~;-PgfoKT3H8K z$djVm5Q8-vUlBD`L}gurf{xq9T=)KzoR)S4;ezumC*KzgE+-4h>gIrG`VEP&1G=ie$HXP!`0)9q%0a_W3d4-ba}USQPyORgRFx zHSJCaJAq&W`1Ggi2J8JDOHnp!Wb0J2{$$yi zmO(%kF5~Tl`80W+#s#5tBg99t*I7JmS)YqCZQCT{J8hi4zNC{T>h&s`K*h|?ew$ZK_MZiKBc<4(OBb5Sv{nWZ$P zQ?N0Y(>I(?YdxO-Zn<3#dTfXPE zr@l*9AP?t>m}dz?-(DPe-*5{M5UJe253F|2`37laGWI^SZq81zR8ic@Ua4~M<5?u9 zLOXvresZK%O9?Y%7U5E4dIP(T^V`(t;zLI|d|B-#o~}1+03Efi*LMm}$*fl3(ZEDu z^fluQ+=S3u@<;0Q@=0HykoN9PaEpalV%|5vnC==2wXY3Umds4zN{RIN(zV`6Erw~` zQ%1axOO2AS1Lorv$A*Vn60!w3L7wc?vnKo%c|cI~tn%u2_SdVQ%wLvj)QP@(tq#rB znT$8T%@fza= zq;pjnwDOgoDh|Cjc?0WUk5TlF;o+zdsy~+9LM&^9s=NNvqqU0kMoAZN$C?aJMEj(i zm3No9BB>-vU~V@!IUuw`GK<^xnDgsj@K7qunwos?p`588?0u`#uvSICNUIC2%NpIa z+@FvB_E~x6w+cjVJ_CGKtyLp7I15R<=|j=-VO)1CoZ@eo5;1xM$rg5*hiiL_IyIT~ zQ_@p1_eiPTea4l17t7?Y_cSqJMfinXX1*ALkS5>$cefu~K{eXGn&fsdnixa6Yoe0j z(i43?&m%;IwDDp+z+G>-o`jf*D3=|GQBvdncuf_G-f49t47U>}jrW}=>SgTq#GBYf zP^A6kK$Ul=<}Ja!95GE#hCV!A<%H2LH%`C%`OU=?knn5(2J)|83pKBi4<&sP(W&|t za>hqCu!U9BwV^j5lF(6n#fg)u%5s-Tw*3G~Yjd(YCs+5W56$-VmLjHOwYcTmFT9pvN zq-d@Ur70vA(i?>(90b_F`zf~{EvvbtPfR+c@lgG#vj6r*jWGF=fpX#YcR?$z5g0d@ z;(VNQ#A<=+i!zu&n20CiH}=Fl2l;l$kClj{wQ}1gR0Z*QYd3&_jnubWU$BsV;#5` z<>e=>D8rH0l(|F)@16F>?@4kV$>&y498-9;l1B}_AJ>$~QB}+o;2IfV=1TObwNDOY zDKQ)HsgG##>-)C!nV5s^wC7ybq)}eSy!5F-ULcR6>bs2>>-a1uz!8RRuso>Sq;@}D zaNEb6WVTJxgfmAhN6y3mqQX6TRy>O~#J?Hp(9bcg>>}g**KR5ixgXYGE%i@m#wi8v zr4Qf<)*3Hhmj|iyYw61<Dp@PEs^;`W1{~(X;48~qcmWx{8>Yn zE@sXH{`%g|y+kUED6?H=ozNR5Go901k^ULr>Z&oT6ooOUEPE-%B`-wBj&YihHdrtT zV`#EyC2OU$fMtYx>lXC_}#{01lbb9g*EgYG&}hRO-+zG$a}A#jjLnKGx>WgW78 zBOQDIv%^9DkiTB|ZMjZN)=T0U1!A&K3aO_nG)O@1h(mRB+~Ov7KSn2%N>v8cNP-(r zM#=U;Gv5UJn&5VghwJv1#*qpb4JL0fE&X_btKbcKM{aGHpL8-YnVXTZvs!7O=WLuk zcVIJu?_gfUa_p&M3;<~PvA*c8cE4te_FsGowi5N;ef{)H#_6|_uM?z>%k<-8t;-dU zV>kjCsYxF!vPUx7$G=1!_1(&*FF@2si}zO_Bqm#4Ac zIuKSimxIf{!Mx_9Zu0JrmFw?jw>s)+F<-7zC5}P^R@jFqNiUJ^fLKPicn}AaT5xsiqWcVtwxbfSmw%PW^30Hz2oj*h(CamzGs@* zjm|rBrmmr{`cx)Pl*Co5%gW{jvy|iI$PwASdrI;~P;eqCnTZ3xu`noA?!{7u4X^52 zWSFbfaxq;P%iyeG>ELnZfV$BjYs-|Zp!^e29E(E^C8y?*k{kL>WVER4GorsFaV+X0 zChujCaq3xp0CPhq4fCbm%{yq@u64G1f?ulT)_$$?*32~38cN-NE9-U0rxLu#`=il0 zJ}u`WUhgcD?V8SG6C{tz5V^gNa%d2@ukn{lA|_;A8BgP>>90N+ipICN%Ij~e>l#uh ztnbn*P2t(SH@DM2Rg$yn>P=FgUS7AO3^93>LqOLxDl4=q-Y1b=aVSnK^U9O12IDIZ z!D$>9^E!`xOBvfoOzty#q7*2V75(gXof|1+S82dLjDNG7xDa8>dbn>t;Fr&M2IXjD z)8(mZtTlcH3siPBpw>rS7#F_(Gk$0;Z?43bj%RJN0{GR6yT9uP@7nq?5E zhZl+V+ozyi)}?8R@ol*ju1UvT{WC~*myo^q$-0N z6X5WO-6-&b#W#6BW_ZiKxZ14%zNc|aG+ol$Ngr{k=1MurV)ijHU!qS=26;%RV8$ST zF7}l$98y0dBEw0edq27hUA4aMnQ>&5C3oO@0pD(as0@{5a;z65hHh5WJuNPMTxRP7 z-KnHy=Jq=JLs5Ddm=8Q$-d_#|bxMEwA1S#bMDHW33( zei7KVQIblyV6O>jxX!4HPxDig!kOjxZh*!@)7&^%QN+-FY8%grKkgb)7`v;q{0iv; zDJsc7*(a7OH%~yE@pPc(^UUR5x&Y5*F>-f*Lp*UCuf*A-YyentR#zl&=Us+?LaJGe*pdEobDla+(p-t3~_XedW&^ zU-K#pb7<71k0rNUJzMPpbFLCKm(scjs;v)tm8e^pC3ECza{3$$HCk&lbG|BA)(B5I zgz~gnJIjO)R*cshdMJ%i`DDJ~vdF)e?Gy5)smQmbu88|?!PVwhYR^0mvOQR8<0@ad zh*nwbiwS3F-lnsJ;GjBGsi04F0f4wmo~27#MLmzBsGz z=wl?_J-IBHb=Pf(aYI=b-&%T@VT;I1O>Lva`A`~bardab&+7aE!lb*j4YYSlB?Gh9v5B6h}e9z#K?DK#8&<|@d=ZEIrB$og*VV%145E>`dvzN;;2 zpgqO@tUonB^`zT7$7cN7n`*1pI72MD@k0;&2@6?|0ID=d34BLmIlYsJ`4E`rbJ~pn z30MBsW%cK-45_Taw~Du0ZXHR(GQ0X*k9dGkUv+@c(dt%p&nOuHTCAxCz(gtM)E-O# zEX^4lUF%ClY!-ACHE{S;F6_jgJP=};YD+`n%#kNxz8nPVacldq=Q2?)&9XI6s*_s@ zK0D|(@SF2wU(2Z6tF9^6$g1to=ePuwxqFt1L&*-Au5PL0jgT+uk7%ySuiW8Owsk@` zZ_jJUZ!I&oV!SZ!kcVouik{=R(=@#6M60!SM-AG%k_{;l>KpnPLIp7uJ(423G&!bB z^McldAra!Gn{sBCY}#QVZ_jV(|P z^-1ocYsxf{2>xn~Km^3($(%;hO`I9JX)iN6ykM_NtHf zU2TpxEUD^O*bk_i@iaWXf^5KK*z(+(pxmpq#soY~U4{kj0g~t4XNxBdAStLUtIN#* zJ(QH+b%hOCJep41DmhNdM}JGkE=STmo91l1{x4c(Yc;xRt346Gqtw(GVx2&FA|}PX zFDc>J6k`PtfT32`0PN3!*XOrpBMv%iTeQWkt*9Fp27_z>SRHCOt$#i_;U z%E6%vdi>E1BXRpjF1CR6K3;&w-}AXAOw{Xq7s^83{T&ag&$7e@N?Vkt4DN|iDx(?3 z@}#H)wq#q>l3rVjx(?soM7aA9qmgBbW|W~P+DGbP3{H;pb}0_IK4+oT8jZ$V^xmN0Nx?Wm}(SO`=nS*on9KFH+e{r z@j9~-6i`C9ul?M9wfO~%_u*LHgFNm9@!EJ|AP!`az}V~ zp9Rj$*~3xxE;P(7w~1xu)!U-#FFnzmsx8Whu-|vSiHo?&!jxq_E!!(*FSUo5<8B?z z$-}EJ$jNKi3CLpcRjeIXoz7tydk9jjP49KBbMAWyW3xSu+}Q?@RhojUU^B*Fq_l)?Iyhyd3$$mq8*Zn8s_Kr z56yYE##)z_Jri_2EcvBOt!^su=HUZh9k1$LA>IRwGPhVF6*A&cumO1!V)5xC?;2|W z3f$s!sJI9%TBbj3ZaLRUrVyKf`r@R>CfX}oaXq*t=-Vy6+Y)S7XrC?CGQPm2u8}x& z{pg9yQf&U(TlB`KTvw>3_)1+f-VWwV!A@fA^(Nlqo-2R?j*;i^A5S>BrLPb{7?b7t zx;yi}WY|34Grxt72{63mvOSmkE;Sw@`z-~U_zdE?kO#N7y3=~ru?n$!&Rd| zTM!Yes_472g2rVhTWM`P$1oN<$m0eQ<@$Y&mn&tvBq~Qfwj_eR*gSt z)0KYH*Zz-yF;j!^dTMsCVdAcRXaiHM{A!(!$(o!!uc2ARQ7vIpNFgwLl+OZxeBe|< zLR%s!sl)zI36heZ`ub582pIh>??>*+iavY`_?XoNrSwF@*3FX$z*4MXVW?79rS2m3 z?XxjwwQE?H+o$rkTnW0{Zv%x%CsNG)NUf>-doaN7zs0}J0j;i8PCdVBtJsR^99EQ3 z9nU2r8l7kl{2qtLcHJWrHGt!NV^WOR>5;&DY zI!U)&hi}$JD}0W@()+iXmk%u2WOdxt^b0_7ubYnkq6zTIIdG(3m)O>-Ey5U$SOd1} zcqRJf{X8v`T-qRjG=%P|P3Q)5O9ZOk2Y|XR-B>n9LsF4B_3oQx>&q^z+0h~ftdZP+ zW~dyrpc_q?w7QTci-eOtmm;Lu(}S#5Z4^w5Y2hNE5w@NV;{~psytOZ&xZ4>CajM!% zgt+2#!+=>8pAdN}ub1zNzh0@CJ?>kemVqrJDU!Q1g(G2ylG z&u(+2_)Ezrp4$8IWyfwqfM#$qI$Sw@chn~Qn^%c_ejq;zD0Cm!!zODWsM*D^;sKJ+ zKY1#@Q?ra+5RKANWzPA!#(QJzxaKhgnF8vZbzOf^z)Zkp40qz!*Gg?3zXv@6jKvA36t*ZNvCxIrLOMWN$;*tvfF7dsONa zH=6ZT0;7uw%sTRhl$=T|+q1R8^K!ihw3WMEuc{9G_s?!JC|V5gwO_ zmnp(f^#g(}TCr((vDYwU5WD#_F=~tn*rl++cM#f~<5;UxJ}JIalelY5ZE!mKBY$Og z?{^QEZnb}tU#-BME0n|dz#QctM3+c&3rkBn1waM+nTdg%$mEtjMU(M_IJ)r@!9mpK z-e(B|aY~j}SvxhEP3T7e+|@~+tk&~N+MeulJBYc(V`_3x@0KnxTB+X_6Rp`b3I#NK zOP8$3vv==-zrKc01y{s`GrEQ#Y*AGvs1)uz_Kt!2Ju>KcIbuToj^|KINIgwb3hv-Y zHZHo9jszi1Io9o~y+(sS0N{JCMmlaJ*Z%}+P38LPkS6x5KH0Iewfbwg@T3@U%Fj@G ziCL589w^buJfmsRbAd(*Bq3Vq)eBEysQ|AOi=|<4QgNDQajF7M7pox7wg;?c(U+IO zckDxXTNit+m?nSrsXzqlvGM{HjXZET0&d=ToIQ-q7|KfDzj?_t)AIr_6?}a!FWN?C zIGe0rOAOs&>3W)q_AAgD#&4{TIW2w+ZhegCwfTI@5`VdK(0=d)hEya|?6vv>palI` z-HheSa?39Zi9&(*6g+40`SPO@YzW_kCs+Kk6k(A(`(xngo&dQtj_nYqa|SZY2tTTE z@h>f=#UT+uEIb4=n{EeL9Sqg);A3pX+j6|v{f$8LX4-~q*=X;qa{Aif;>B&o6bf+Ea9k;ktCp-h+ZLPsZ3i*4xHx0;5`QFfHrmeZIX55$fKDnJN| zblJv5_XL<7MI7r(Y)kNL-XqJbP>W^;Jvoj<V_dI_>3%%z+UOaUI^LeZYRzD zmANa}uQC9G=%S?KUfOxW0g(`?~(%VvG?umlL4Iog$REFR+Zk^ zU~9tFb_S_fZX|@gv8M8*;jq|-(gB%G_|CSa?a;Ll%8ykrO|M)70oWe!VmcAI=1SIm zae8lGgyV;Ms?gA#(N<}9RpK;shK4AziBw(T$~>B-c}TXpxkYRrD>O!|f)GforN7Ct zH`Eo!b}zbK2xSj+R+A%9U!@QALElo5chmtocEHn=HkccPBoD{G*yL)EAsYr$VWi~> z@3Hfbq}6Hi6n6&?InrgA(^l60(nTswkE>?`+{B&L7#5rVGQNz-a0bjeTJDur11IKq{$0`T!7-({Gpg*mQH152-A#NX2A%7~I zNn&iZ9MV6ty5t`EvDD_Fko|Aq4*uJ3e=ORRAAgR4#a|;Ja}iu|706?o(?WJ|Q`|G3<0e($ z&TX%#A!IniZn8zvHri+0**>y{yDomy8^1o}TC6YyD?x4!)TFan*%3aNTLxRNWeQ+Obnpz*rtO@3I?2FEOzJ(a2g6W#HbJjA;lnKr? zJMbVHtK|a3Qy%H|f5R0i!^;FH!y&xC8?$ljZVUDH;}GUJ)7Tys8nk`52u zbU#%XpDhFQnRw~av7>Iv=V+B_H>{`3YVZ3oWku;4i~5sMv~-Y#T^85f9-^6_yXeRR z%55y@_u{FQ@+WnRp4~@cW3DyREmx7ZpoOO#+VRnm(d$tr91%Jr9g8(i!wJO0Y}_B8 zlOm5jK95-kZtuF^Wfh=JLN^6o@1CKud1PSYdWM!tz4v(I~)-ji-hAG_W| z%sfTwwqCBioc2@sTby5c`DUjS9{TWLkt5*moNXR0OSE)x9QnQRp)DsXA#1j< zOwH{UJX8VgVYZ>&cNu^S$s$f5thYUzp6iZ&``MxcHA!_HES_CnXTw>#JGnIhyHEr&GLAq$f%y^bmB1wJt3K_$X4FF6$W{-nTGd?J*HL@k$iH z{_q(%3oFI8>XEj>qcLX~f$PcPD%o)7Q=^S$bs1PiJ?OAvQt5`5p0xBk%Wz)%2Q6oV z>{C$bpAbBhU|Suz?<Y%G{|VB=K?r105q-ixL|`O)|2n}nt{1EP^)F=uvG!+ z&p;Y*vVoM7?*=b4F&%|=uSR(F$20}8*|2caLFe1${AGIxTeDK0#gif}Z>7sTrh~Vv zC?h;B{N?@KHd{>@dlUwOpA7&@&~)5S1MAXo+bDHXMeNIy>?R9tqyTl~lR4zxIe>&T z4of6G`vje9Z%LJL%>oq%J7%!5kCjrZ8sUWz1192bF_E=f^~OOgpBB-Xu#7F;>UMnT zW*bk)`t`B_xXJ(01aGQnK5-G%!t4(`;o5>a`$uT#uxSRikr{$SYq6V#J7`)0d#v}S zKu9y`E~$xBpVp?R@p=Fu>~9n-3DQ16&*=(4&%Kl3$U8>jnL0oeTO3<#i*Yu$vg&jZ z)+F!|Ti*fTmhw4*{o&h-Zmqox>IRm)CG}; zwWtC@eBU?%6Dya`1G@4q8~0Yok4PQph1P(X$iLnSRvA>bJ zMm|bRb@(A4@KHFg`In;cO$|QWsXaGs0C3F&vf+z$+Q+HKqB&pJF7=~T4&IHKW<`a+ z)Q8TP!N=0uZv?yHSAc^SISsG57*YqEwNg3N49;SF#Xq~Uh0Lid4wQXyR5@&|U{=Mz? zjH%e8U7;HSc><~flP_;MkQdMkZ#ik!FXfudO}h7KY#g%v{<6ZVHmO{bin!2mCEgUH zAh`(JA{L$tKwvB@y1b>IbiltE-Vl?^)elB+;78077)%+-$INTapAoaSS0jG=@>cjl zvRID>OZ6f54aj?L29j456Y2Np2Sr)f#Ep(n-(1B@-vu~PhnV&-b*y68`0={T@{MY;^}=v4)*hSm&UlpSE;z5-fsHsbS`xZMt^J^{LWhFn_z~ z`%q6I==hD+PIz$@AP^)@{*1E0h+)AC`0Jt^0#nYSkz+Toeo1BOpUZy46C zhqW~v{>ENaC!hL6Ps@0?Nh3~E>jry9)tKPRgtomJt-ffK1c^Pz=Ob`S({|;=6$=L@ z$J`qo$*Wm6DZIDcSAq~4^3dVy$u(R#Q0}=Yzpufc^EN^SB>9MK&J2gX#Zl1QeXtJl zzrtF@UfL(|>Ut!*B>5zZ?ZPZp8<7s>dQ8ghStQ3uYF9i6^wI8ftIEu;#SxRmxUC+SU4SxQmjedcNB_H)u~1Dn-7Y-hR3va??o_V9;V- zL!qHsY`kX&=N;gR79Q9i>?a!vz>CWp60uS%Lhg&mUAFw0Wx)Z;X2S70t^uq3hPjEB~J=v}ToZiA^k z9Lx~AYGcZcn)AmXZP3q>8PZR3M|r3QYGSacfJ&^qeznFW-Ny+&*LVs^BC#VbwIwNB zz-;ADQ%u?D)EmF5tLKcUR_V%v4SQ($R-A=SVwc(`dlYjuh8|UZ^`(W*BcN=*k^V54 z|K4%JTtBt0xL;IqD&|>=K``Sn=FP)~;ZOQT;+ZrjkMZO%8e(+c-|blG#4ML4pnTx1)Bb9V2b;CtYkiGu&2vt;K>R zP}#9e7!yAtrajYv8Biohms)OaF!8m~x25}dQb>Cn2-@R3D74_63P0w_nK7G#KYp=C-5?4_6 z>^^PB%}w_H$JA;;-wJODKQ#L-RB7ukBp#$SyU&cR7IvMcq7(Ut@^--K!GlGDI+mS9 z+uSWvNf^^?WDAO5$n+{xF49J|8PO-;W#_M(dLU$es{xaz#+kV~z(|mL*}oN{zf^I+ zc7D>7Fc8m`X?2fTx_eAOW&W$TgpkTWN_T~V_EWKjWZfw<+QOlxk>0I_kC(YY4?1@! z@}r}^!gq9azxGq(hU%G6+06;(jez)%!8!j#poe(6Hp>bMpPfh;JUG89bR0aY8X`^8 zHwU*2L^=<}w|T^kzW-&WJ~Wi4+UBl*#j{OjkIaAUFfXsHqWocp2n1mY~!G0Wg5 z)H3e1C&g0x{S|_oX4E)GDw;xlf#IIXd%}7tk$!$(=?d+o%N)8c12K)Ca_TruMpjft zfo5Fo_Hgj$qirBtv)y!i%^q7R-kN9mR0d&sSD#bni}HW#ngAsM8(Nd_r^z4Dqo9EP z{9AfNdb0s-+A7o>%k%IGLq%fHJz{8dfwS{Pd^5DDWofrulPNE zN6VJN&tCnzD}k3Qoa>&RRNAMbpeg-i;5lZ(U7a-eXv+U0xh)0RD(xGW&zp?4+|`x= zod-g=Df4kf?}FG;_}HtpugKl53S`i-o$O%eA==?|G$N&Cn(o>;~QTabLsosRTd`e$)pd& zqyfCGW{NG|!ZgloX zJBzQs>6*1p)8IjJ7#$XUJB`yo>}BzVCcW>UAdyi1PSLL`K0k2vyF?d0h&OvHF=gE6 z`N!`@gc9Eav@=SsJz!ixPSZmUP`6A-vHI!x-(=_6UUi-VnBh(PkFzVqp{I*(1WxM( zLQ)b8!2+UKjS)wwT=XYv6Dj93C3B8+99evF=x!^Nv{Y%dFbaLxCK_$KSQV((-`07O zbz56k8PdV?5opMSNvX<~WRMQ}UC~=WM4kImX|ycS30N^Y3NNrQqEA!aQLl#SAH7W- z0m!?F+&1euBUQ*lZ}f4>!MLEwv?-m97DL3%jrKa(1iKO9tkWE1s!%OCq|aWO-Fmk4Q_b-kFA)`%ZjIQh5>pe`vGEiS z+Ji_|+e*=oC|argDCm7%8j3`?Oeeb^ z62*^ODhryX9Wq)dA>(Jq?q_=Lu%w(V1zDtf{jmIgvS>P^!C7VV zI5JxSuG0TOc24L8(K5Wdp~O2G7)QJ^p>1w$duz=%crbWtb^f3*UyS z<5(~Es%dAFFuZV&s%9#d^&fTwq1_K=dfVAbd8`zXk(PxHPoBELdG zo(2Y9?yO4p^h0jOBuIo^>g7gmS%XsRTIF;45N)!M5z6%$l*r?AsSK~XTZkiAjg$w`p-Zm zp7+xuO?a0aWgQpcEYCZ!*Zx|ygz@Yg3Cp}^d~j(pSNOUPqCrJ0g4m_W16L?WQqp~V znaV*KiL+6OX8-(Mw9;EdP1Qusf3}`jg|*y^=i#AHcXcQcwb*0muV_${x4KrYVglVnT$LDCk$?xK8+*fIit4*u2IzSqA!9vc;Z1b<@4O*I~TTt zHHX%PnkBu`a+^<}^$)wrMsEINL6a3vwlh{PTn5((?&q8y@!5U1FCO8g513BBX+u55 z=c|Qn^we2F#xp`A`#r9R`a955YdEH9EzWXKJro(~y!kzu?mfd{ciK@WHC!s+&dA3e zBnwL#?H$$UsPwyE*kUe5miLr_yxPVh+jjSQl9f58lBwrio*dj#xhS~T=5!bN&Ve?n zkmh#x*}E&T9BSsbVpCFeGQ9Z=YNPHR!jAQ+?AiJ7_Y@(j?ILX5^+(y?E5HYH=pRjg z6aQ#uA!27C3xgzK_JT=fZ|b=U%fnK)_Pk&F9lKoE5R z>IoN}Rj=gFQtXaBy8#7Zs#8p|i^3;NISHPtpvrURotXh!DGiQ!&VLjkK0?CmiilDx zT?PdE!V|n5!QrwT;yUShY|-3TgrwK>d$SX4ox2NvQae8}u*Gmp;h!T{#(x4{guBPt zPT7SbnUs{<@UuHJphCSS4|z<9LuYb$)C^>*K{R!fySN!5Sr1=G z{CknA;buw_#Nx?qc-FvgDnlQ^-P6iDKxum=q0+gp^#C=i8?a(7yz&5qr4ccrLgIPT zfk9GxLMDId^VSmx6=fKy+_aec*1mto?Di}~-N@ARw!l&@kC-?1jms&X&v@0%J&K6c4sdkJ00gp66I|S08^2mO^Wa)D zr4J(JJ2Z`mo&RhOH6bRYJ{9 z$5o&2Fq=iGrL4f?vX%$n)q4L5;;{247!mqv57vM9)NMyFD2u}JDX|K!3`8?434RL2LioA+fra^@YuV7aun z9*k}X&m(TzeSqn=*i0o>ff!69365{s_pCp^-fSaUWzjEyKD;y0W0HQ2@Eu1GEHgPa zv?6R}NK3#YVvgQHGPl&P`Nz`Y12`y%-g@^J(rE8@N zL?6v-{DKG77L6xiVUj;{ zFMlibc=d%Pmr!`3`1~{&X%XyB7B0BRz6K@m;)E$NQn(D?0C;JsnD+b*LLZsTqm^6@ zkSvqq-J>jSU=8MTIkqJw#@2MwDWP6x>1xBO8B>$sr}*_J5Bxh2k88dfgx#1h`rvFp znm#Z6I3g^rgVNYoJe7zVO%vRf1ylsalqgpLy}61A?3kbE@7XbDn^yWW%e{_p-;%6f zvw_~_PNH5b;vLF<7^2JW;oi=Z;+6LssYAdhOI-LMGPW{RxS!Gd#kSt| zY*_=zoZ&<3gbc{{Gl_yWlnxbNe!}3EA>1p|)YaDnWCT^PP)7*BTzk2Hhqylm{JysK zx}O3p!LpA40`6?D<~AQ?xL|b&kw_=Z0XRx*FP5q-+TsGYqiKEY>$7qi?piNQdrT!Q zjYO~$f`ox%{g2Vtf%)pqMrarUe3&~A0!+U5d7xfRxQb>R0@dSMyR(%*YEU0^Wo zM49j;kvDD56=9uKFMALHfYZlH9taPR#32N@R8qB<@zjO+8@g|7S*_*=ORRb7ensLo z8}#?ode473YWUh*_cZr%JSMz2*EAi3e7e{Zj==U$!s<8y{uqYKsVSr0W3|E z--U6Q%BNy!>H{VsrwjsNU^dT8ipA(j6uOiTQoGgxd(kQhqs!pKtsIy5j|)Kb(Bvx~ zp|2MF5OenD{RE75pveYS2U~eqm5(t(JL65%@yp=($B#=dA3E_FvGBX8thn=6ldBs{}9lB^;r!xOQp~oWibL zunnrDvnvr81H(MxI8>#+a+{SEifKEy-x6JH0xOBfhg?9vOJjMu$mLmKbKFfS#=DyZ zrr3ef#_K=ZxME~J4@&F}+R$}%?tEi=BCGMH59rN50QS1r`T?k^e5)>+4EE2X8V#Q0 zQCp@N77+_wL|-yoEr}aU`NiE?NEB>ER2inj-V*U^(UR4E@7TX1=>kOzgk!HV=6uXI zn~i53{ImS=*BJ@y68w9iBLK zJ-m3Z!^ORH@VU#MnWI!A7ktfQDcp;G^1`cIj2{MR%-_ipDVxFYj$ zk1R&1M=~yYVaH}J(QVSEH@2B}HeBU-OFPs%R{+w2@3X$O4i`iglUhrsDB`hW>MHJY zo!8>AS*(hNLi4RZHL(et+VVRadMrJ>$^!8f`$GP3v4;%dj*OXJf)Vxf#l2sAy`olrxffL&>aUIYW%QannC;2m1jEQtZto^B&NjtUU!@i0sL|JLJuq z%J`jF?XEb(W11)8mkXJIjA28X-AysCppmf4T9JVw=+y(DgE}eh9UPU);t<&h^OTp7 zQ=40BM@f9tB8(|}Oh+faJcvW))VECKOQdA6rgcSzaIy2`Ak>(5|B)zZw?lb7OcoY5 z+B+x0*7o{7F-n4k%y7W0q`ZrdrL|%=s{c+&uY=Vc`iR3kTTi&d6{(wT;^udR!IxDW zhYXP-9e*NG5EUr1rN9#Y){!ia@2=JMH(BEr;7%xK50f9_tDd^mdDrW??VhMcIXE0v zf2HtptIck3#YPsEh#{|5Oo+Dmp{YDz8D8?c=*aW8wnxK(ECORlL2rib+%LWPX)xGt z#Hh#SKvZ>xGNFI&Yw`2H;jJ<&1-&Kq5qXjgE*j|bsk3a%;NAk>n8zKU{v4%E2P~S$-E0Hq|YYkX9Eb}rJ?g*lLT(P z9qb^X8`nMZ!^7yyVUFF!4*)9Nog-B8EKiOS-)LKWO9We_-Kl`3*uh?~kI&16Y|04q z9TzCsSuv3@IJ0vNdUBnzuI~VgI2{@azG=v5{KC6ex8Ri_cMV{fm&VQC{=z5(jvefU zkg7OKJ~x?r&N27z+<<%P-34D}g{OP}|2Ywp z?(ASMU#@KC(&Yn+k{Q=4_%G+wrrQBua?3Nye*&T;tEN@6Ge~Cz|3?N;isc{X@hZQQZ|X0>P2d;l0+RY9UJROSGAe~-Ju@xhkat9N!$kW}G+SJ@BF+$BlJ zww~xH4~!z{!{=_w0w0aZf5*uIK+ROq;j!F-LO#)c{c#hJkd2dxs!1TzJX~%{eMo(-T*$Y{`0(BDK8y z^!laQR)FLLkEIgDUqMVZbKThU)P3Ta?>c!0Pl_ORUDh!axdl}~GzlUM7{v;;`yEjn zB4qVuy_~vrJ9ig*AVjsp-K$Puuew{`eY1+=CqU80B4JO_>7%MEK8bW5prL_3DLD{5 zeBeyvaUEWA&X)tUtdyevHbPCZumlX7V)iPj1c~W?uTN6DLTL%n2P$?Sv0KK!0D}qrh7CDNpZwzxX~leKg+%^Hj6$BS<`|Afg-rUeiLa1i~ZP&t!EG z0=TPobgPiSoN9j$#F7i9>4;q|r0sUmOQXk%kOVXCkV zC%A68!p!tJFD%sY*g@ivW=s_%@gH@5teJv2a|tf7huu!=aRP3*Z%8Qg}A} z8yJ_3HNLt_U0qT&(y{Fe8H#Tc!Z#ACDu*PYPO>xp{TD2}XNlXBY=54C3-K^`rtSpo z+h99Ug{0rwV+gcC6vcV`0twUHm)D1ciZAB*t*B%7pDO$~IPaYpiKazhd|>iLD?cPv zeROr_*^huXJ0`Wbqf!|&}9!D5PrDXx&OjV=%GE>gG3|{b2 zGiz^C-}=HAh-xkfXfpay@1T_nB)mflwtqHLwzjnSGVPH@H(Qx#?Jak(G%htF0%8-9 zfJJy7ttVWEA>6x+7)cfFK{7`lFoqs!38!-hWl;6reFuh5dUjpP!v!EwHDYfDe_f6^ zWtZj%d1S#57oX2kL@b1v?oL=c=OrzG<8u`}cqlu-9J(AwEL3VQse%M?G}8yV!J=Cwu|yf9Q0FR_rM`nN!j(@*4a1?%am zOfb9FKT$azr^z~77))zlS&5j2Bk7L(Qq7}Gz(al_u4nLhwn;=CRqzvX;)~zG2r#b^ zuAg+9l< zgx9}e(#zeWB|;7P&Fd$_l0SPDbnFou=oH6Hq7&gxsQJ0M=jsEPWZwSUia|Tk&xHkl(t~5MAUD7xoJdjyhEtk@`BLA#23zeY3HAtyf!l8?Wsj1)}eyQh+bOk ztafX~is~prd?L5b;U^@$(4hf1=oDi8p6RBE!<=|0SX4Z*Ip9&qIN!ogO%{I5eUM#b?35G?Kh^P(a zyk;&!!;4hcrZe5W--+O(ur%x25mGo>xUvMx8rHp{kWe_Rvz~O-bgeUmhhOn^t{xvv zM~L9m>hMmX;rz~qoqq@FnMd+Me{PJ9|NbJFQTQMk8?T^!UsSgUCq#%BE{NbG2#%X< z^i8>!XgAE{L}m!9?0Ky7gj>J4u1{ZHmVlV-TYImD^F6p`YOEcXtDD{;5N}?| z_i~mD>a)F+m2uDJTHr9Lk zpy?%^(%Obp!HP`_SEJP_S@%Nm!n7jY-?VDm#U=5?e8Z5oK-x06G`nU3`9&*iTQ*}429O_-;$eBzv(#|%xx z9be$>lvQ45>@B~Ue{s*b`==W2dmh-w+r@cBWq%jylpW*in{i+3sIM+I`QHDK`C;)v z!GqrevH>?gEFG$L`7nB3X-pE}JWUL}C_P>R*5ENCl|$_!Z{pRuh@4;1&X@4S_*xY? zb!!}R5Joj`%FM6Y;a7~BUieK4{7s5PH2Y~BbF;e%Ym_P)b&Na$&vQ%7KJj1;&4Ya6 z4Ol{a0)Ey1=q~?-!C8i{b3CCCn%&diuBHVZe3|Wn)g1%}y_Fa%W3e_6VxD@KC(1e@ zxN_i@6@f?MTty;g4t=-1K)o=$ck^I}Q+oY4V1GR$q=zy_duXtnk16Eh#|ll0hDlYW zH{x3NNOKke5d5_A2z4*@@@iz85P_gTQrFo>t>f`9Sy6Yo;XJyd_;4WGYjtk94(P} z-Oqa^T0<@}MG!Z=?yAONTJ_M(W{I_%tDyZJBK_nfkysLrHXnl<;@LqMh%fzCL<8>kaH` z#e)G@=evnCY-dG(NL0!1wGy9;rkvt^`V*~84nK2T?1YjS1F~^VyKrt!b$ouXy2ZoC z*QbTvcnaH1QN@iT9(Jr!TytBn5m~Gx`}=8ijvGy1=e|EWi@x9|(Uf@WTCbw_k2`lZ zH+9FN;-pW+<`@heK;^A)tqs?1s&85CA^og2Xu4k40y|aI)fJUG)vP|IxoOTYue-S) zU!}{(M1N+OCd7}*I2VfUJ`EX4E$n1&K`ok{i=4aqc&gJ8W8_kew3Kn_&DzE(>e;>U z`=keZE5*n-*~vH!@Ha_ju4?4yYU1~Je26Gib8CQSQ$cmsf^?0z~_ zM%Rn=deX6{n-c>zZlo9Uqu0YOQ0y-l18|ea*5mH7eZCn$LQnZ?NtsSMWfM-Y(>I0FymRinjU!$hJ`(T7kwps z&QAt4)+c9ycKj>pH=n7oe3cjdvg&rk{q(rs|8u~ZwG&dd z%L~Xb9c8DQfoy!`t9JuX$ro7i-TFF8FD*=XLkYl~JhsG4fG^W4-gTs+0KoY1C;FK# z@^R58WqYMmFWwcbs&v2%A;>*qNg;Ll(|Cnn8^>K4PCqou2ZNin!)+mLHWkm*n3^@3 zN`bCFdY|1^UJ(~b#K|`Tt~My0(-G){MB1HOs0O4OROvd@EfsyS`ZOta?EUcYXLu_s zeor&{eBnH#N#oBNJFi;O|!S}V!X0(XwG%>DlLIgtvn;r>-i2cJeI~Fk{bB|b?HEy_-i;qruY7(#-NOVHIpg5YrZ;CdByY-A*a&6Pi#6WSjX&e88YU;OQxq$(7BTofn+#;S7E zar#QzUUZDubgt8gH)p$OT{OpI3Z9A9?`T&PhYwM;3|l+POUJq#ZRf1PED^$06U5*O* z*s4jzNq*V;lY#?&)=X1<)L%;R1=%->(c)L6Bc0cv# zMj2)l;r!MmBuR{a`_dc|$+~#3|*(XxUV(SCHG68ptCK4(;x+Tc3+S6fwBj zYEoX-!kyN|Yd+skKqH)~8xp+O6yuA{>z;WLjhv2cyoTna*PrMTZW0X&{PQDE(4DP}Y5n z<~3w@-6Y0`e6$_oYablhn1yhM#JGwa;#cT5<0`P6R8H{*1-}jZP*a+vaCD^ zPAkUq*LtP28nTaYW+XNSZ4I`G6j0h6miL~sFJN$^i@L_;L680O>9y}8<@km3D2D^`uB+c<0i(e9S;Do2*R zA3^=bp-QzDMuK`b$|olsS_DaIb5H2%7cv=-Ae}+gGf>h>-Kw}qFRpdG-1I3a&SFKJ z?x-T?+!UiB7!ZrNemtOjCaKLsk-(#>pSGv@oP3*P^%C6k3f_p6e76&ylW5%YD=~@7yo&2C-~O_xog*+rJ^oU7gz~?$fK!Uwr(Yo*-_X?c$GF zuITksy#>2-fRjcjq^nJ&zb5ZIxpb**8#t1uO@-m)GcfZITA`2bo%qbzLiSlbFjm(7 z4$%@PP1vu$|h^9Tywtn%Zm5IG0%p?iz zFJ?-FrmztX!6+hU2e`z3tS4~Ejh0}f1C*lzO-QMMX4rrq&zLrvUbl(7;rg6wcpYoC zCzfnaT_CRWmDjgVDh0QX%C+57fAFJSgo!qa<$#r&7nJsMK80<*RkO`&6ZxS`3L;D; zm#@Tw8GCQb@uiiLSYp`{uuu5r4>BF@qMR20b4|p%k*ZzfM~CHQJ&(h#nKRO^vGtck z4)sOvLSU+$D?V(gxxX!h=U_U8}(}|unM>Y5Qx^Nbec2y1Sr+Ygl zpR)&T7+$r!hl#o-Ej2x^pKs{Y)xYrLS*dGKtLi3xdqlE`%d!$t2FBOL#AO>ntz@O=B`{vfVihJ-{Z`5a=rcLTb7%Mo&WOH4NmLOyN%`n=$J`<9c}#WoVncy zMJq!2F==pmjO=vjjEFbtwVKuS^^T@SP4>aoUpnR_s2g&kxfJ^0;kihr@3 zCc!y=#4pSB@)pY?vuqy_m>%ZwvlqT*?7qB!e)Z_GQ=0p!|g-C0L{V`_`9+M+yxwhx74JK)G%ZO}x6KPh-mW&No_e z5MOCAHPRYkoV1%WaiiH2aLjt=wT!OOrJXhvB6HxQVHlM$_U}-nk>uYESXap<1gg7S zR#Ga-tLKIY2ZkxgHZ7dV6*2{PkNc3NCXHIXmI9geCbOiir7E^6uOTjS{S{ zzs{Ln=AsO(;b)fR&J^AGJrcF^l5zOA1YdEoeJ7z8eE%&Rf5n|=vpb0JjU-x%9xe#~ zZJ%(6c0`>Izq1?cvy&BY(Bx=pVU5cJ<7b`lkrJtKg=T;6mnNi!GIRzNKU(7`>#!PD z!*6`YV2oksS<-}b?S5dY^}W*vStoM3))Sr9|1N~FC*WE_Nm7!Xe5v>D)bJ-9FL3#L z+FlesT^Y~HL5L1WHa4?`?{lC4x1hgKx^M{1Syf#6hbbA)Pyc(F|L;a~-_x%U4*0Oh zdF9VKEah}<-}v;(aBcUUh5rgdx`$C&ckzcVSe3AiVxc2C7WyhmI#ULItn_urIlXG+W znV^PpqECvo&#BaCMz*&l5h^Y;fA55yESxTu$a~NH2)!=5w11~x#0aDA`8WT~QDtRZ zkvGlZ5aLWpPSwkE(Q=%BXLkVyJ3;TQiNm8uJ;iB71W2#5-w|Q7X#FCa#PN01*@ja6A)S;65?^k@M zjU|5hhQ5Nb_`PDsEQTB4CA&mtQ0h7SyzPjxZ1OboIw&F{ zh{~5D+YtQ{Yo+d0`mGWmk8RwuWOzFP*XOB~8CFQqr1%bTjSD-fcH-J@eJboe-Q`g}o0q3Py5iXF@?!E@YJ6 za>zKdfR~2BYRUeaXU@L?;-G6QCTavb>$<7g*j%ULU(HHWO&K1VAJ;m=sj3iXcpwb*ASi)f;zektbr+E4PurDO+8AweKyy=euYeo%@>FW zt-V=JJRqJaz%yveV{hRJd|B&FwF5 z)6>_n&t4v2oI*MP>D97cXIBgoxX78qrxaS~IozTDZ9Dy&_k37Sc;$ZhbRvykJ)uV2y>*f14N@jeK6*3p zD4Qa2*%|;c3|H2M;`B*-HV@YiWqGSfKN{C3sH8n6T5fHRKt?uZeEzIMAYQ5z{H&{< z#p&9|dvJsz_11KNsK#zli8{Sm1%$Z-^ypZK2gL^=n9u*d1&*I05fOVNu%ZX@1E7uY zv#-z&Y4Yc0HE~Afm$tkG^y3+W5{k=YBh;Wo1gTE9#%T4j;&ew2*uDJ)6Pk^e2uxVJ zx70jLd%#t+2x-7P2E0?pADW}+M+hn%uz1q*)yTz;BDM)TJjwKt2(SB+=DL8? zWHYs8;_U6i+eDi+EudkP-X{K>Mr4X$ZUX=5oV#s^VJfe`R&e7xZ3lktYP{3K8$I2K z3jyGUn-z*gKIb3wmDOOgYDXJ#NIqnP~U5*z7kP=}ye_c0fNq+#O}6O1*`Fz~kR3^JrVJLiAHh z{Z98PpNsXwc9E$qLp;?wdiagtOQw9gJC{(%x%QHG)gmjozGtQx!zWYDmfdax(Ziz8 zXjgc`gH z=bL`@Q0Vwb&v}b@FNU#&dT&>dasil!`d~|2&|G)g7~|0@X?RsSm990}wrM0leSI0h2a^A#ze?TR`iSBHFXajZ>dc5KH zraMFo_1Quk8rb7<4_{L$N4k!E#-BzR4;oq%O3>EM`wG+zV8aba&=l2=okZBwATsI5 z84DvNCo;00B$0)wMvy!6u0+;q-Oavg^DSI_y2JgU_bI6G>rR6&OoX=R>nFKd*vs3& zW`C2Z#JHOzDY80)ZjtJya5oMKgn!V^ZKT2BuX%>anUgaz5I72hq{x#{Osd5f#z|{) z*hTyr;Hkz-kg44heyw}FdOnUR2aBdfNp9ZGkH65d&sdHt zzvC1O81XXh%f6u!pF}m`^;(>kB9nlY;!}UF=$pTLg3aR?m9e7p+|nW;zifI@ZEqahU$7ZE+Tcgx z$Is1CIG^sK3Yxg@)MTC&w(f~iBfnpT(9L@mH*r{=YW3~$!rQx9gdiF!Mtr#RfX=jf z6IK$Zr4A_uvqF+Firw3CCqoNs`-3m6jj6gh?qW_M1!_X|b0GG@R(|nUva&AbBlw%W zgRt^BsD|Zp7Eo{#%J7j*)_SD)e3tmgVRnODBZKS1QBtwrjdm~`E%u28D>hIpZDml=a<;APYwr?i6Dpfw6Xxn| z_y44D$WtRUYgMIRay$TAum;}ORg(n%95yRFDrv1iH1}q#kunA^Hs7~K^+Bv9%U_22 zM$}!Z<2hRqM6;P-dr6_4Md`g0g#QQF(G}MPv*`D8`ZcnP5`Df@ovM!Y8)NFhWHoiJ zUDr!~7t=L##+z&C_pwl>@9a3Mu6tKjLNG&UJYjL+M-;R8Ir*?!1Os~gV#s*Lv-KQD z1ha_8TIbMP%yAmo+{5Aeg|YKGp~)Mh!JtGT*|&I{N%H*s!DjuIMCmiJF3n6#l3|CO zg`YWO^i-uf4pO+@dq=3ru`!a&*)EJ!vU|s@YJR!r?!w#&wV;jp)o9ysroV}OF4Xf9 zIE(z%vm>BVS9BdGc?Nkgv}7T@>)FK#*|{|2fPDt6L6cOo| zL*>yTtA&XvaPRf?13PzySN={e!Bx%PBSxBF(ol=BXTIoDKLP~3F(6xE<2O5mo(@Y9 z7J6S}?U9hiT_v)=Ocv2`Im)!#OC94kr3X%I0X&<}Gk>)-sh=&yhX?VvZ z(x`uSwf~OKg=xvyn>UhAQ0PDTi;?NWizzd)Ao;0}cDO7#vm^EcxM8&_FF^EKRn9#6 znX|gVe-#HE8H$)8FPWNwUW7%Ai#&3jrI>|caNE))TzYlqLsdCcqI|$nJ8D4k;)^|_ zD$zeoJ9J^-Y(Bc^?V?)O$x`D-!B=Rc1WR53ZS7tg_r~#{z5#Gvsh2LrnCae|8$NLA z+9zeY59wDM34=c6P?J4fz;mk($w7KQ!uq`gG*-LOmiQ%Q4(reGZy$I?&uee@y^Q91 z@s37G_t)X?<+=amwNP`ubB5Wpmr1M|yt#cK$7xCj&0E9SkXtqJLb@%VGIS_K9n5db_?(9Ib zbHjaM)H6EDS7L{tC0`9l#%e*hT=Q5jy%s*|1>D?QoJ06egv%yLoruUSOZ|R)xi{m6 zxNPk`h4b>GS%etVSAOBy?Evs|8~gV86;+4GMr|(t0;oHuj@#eCd>5dMA3ZEacElPP zOfp`;Q5{$l(_(+Qa5Eu|YIz?a?s5=EEuM1|fRfO&hSg87hZU?oz_6Z>pD!*a0*#FH zz<*8v(z>;@d&_>nB^J@S&rIOS{0trH%lIb{%ARbUU^@zMcuRIR%YS%|Dp#y5;P4qq zV)qw}>^%>#@}`4`aSU=EJxf3FuIZ11LvmNmK0PeE@;1#m;qKY}THoJYp^)$CCg(cT+Qbj#whYV5G}lj_ZutxZAm2XGCvQcW2-` zIVIW{wQ@S1-N{sBH^^fSIoIia=9bXQXm`DW96=8D=Oyvs{o=^eW4}x;0h#cvd7c!d z)mxiU+h?3=l4I`mFFz5B75q9z8k2Qi zM7o(c72NiIxBtOlZ~@x8es}refyM8~`^6zQN zOZ(;ZGhRU5w@dI?;0= zL`tk}eXl6A{JS(MlNUnJUUkAz(&4hIjl9po%z+~(NC%FdG^Zm>A-1@6uuct63;qYO zavHF~J{lCdvRy{w1kHcb#V@JqVF0-GPT)K51Bs0H=__6Qx@`UU|EAz3O!YpcyQZhe zawCu`|4pbpWYBN)_C*Sk z##M&OBUfDdQGche))BZCm&bz4EYZlJx2+kjiGQz@h7S&9oH4!dh?3MO`>=5QO}WIjEY>EV5!KtX{ry*?5us*K4aK z^-R{eqMxZl>&S>_Z&KLXU_H4i@xmw}0BuElqVr|Qes_m4S#O`Cf1{_lyW@r;xGZz@ z;2hKSV^l^B6nB+NNrDl~-NbypzfdTpy&3kAU6Jj`CJGhOOukZ{^A~GH0N+H+pIQN4 z9lP|$Q-zIY5y~dl0GKJM$kfpb9oc=k^HY?0r;=54-R7;C<&?=?P~UFp9-_Wg^xwuv z3oGs%lNY|zAV`NQ1lf{Zm$_@4Q%|k#u)E4M**$UdkE%vSBm*L?xv&Z$PC7BYbSK^! zOYSa-E$0D7gg@vgj}GQ2Xk7r)7tHoa2ghznBjnj>(II&?&b_bV%)pQVc(Ifi(Wz!~ ztm-08+uswzgg5Poc@SV)F^KB|)!-@sumt$q@t|)n50-*m z0v3=pFR((b-Gbk`X8r&;*TOp8txP*}+Y(Tg9l+HG`t)e5DOsviWFZJsvA1-t#FtsH zlJx-NPi4a=Or1~jJ2E_vlw1YO`x+7#$xq<9BHRl}libxjTz!a72y0-C^c_aJ5MiJ> zd!$^G`3-f`FBz^*LGhz@l=CvXySEEcV(~MBHOk8u&}IS*i$&sK3KG$wdU$$u(ANN3 zFAM$wFit>fMz`YD!V;neN1)F|ve&1kGd%AhUC1dHjyq<27H#^48>(ec2o z1C-VS!F6}QZvc@O5$8X;iG1Qmz_z45BL1o(&=ZxhhXrglF!pikR!ujytq|2e0{6yi zjf*0U!KF{)BQzqvPJ>^@6{h_ZD@Z%CNu*|=_gMQ$+nTIu_ZpI46fGl|HzE|5hi2r( ze>OJN6aB%|MI!kd8&I|}pu=#fMUy;X`uQTk>NogiT_Oy{T&>rv-KrSKH}-FcJa3_0 znv7BM0U$dp{qj9oBDCGJcos~@r(Z$!5W!-HZ9HBxNNM(LTs$dFymtHTXMoe~4F4GG z%f6m_Am?2uKbQZA2;zWGQXj8hUV~{_haIaGz%l=LS5>%6!_h)AsjeUB{;2#(Ksjxn zT_OF1zmxVrTgK%>1XKf+nJ#w#hI#M&%Qy7qVylp5F81Fcw5<-NJFbx(!~&|Cd>F#j zg=4vVmcJH%Bb|TeNLxtd25AfLdKCQDBh-^o=g=`16jp)kO^y`s#R*eC6_%H#kj_6l z)dO%rsTl?2^IQcA6Ph6vcY2N^dani2Kpg>W=fF;2skGszWhCu8aMYCy`nDYiPnd;i zAJR6Rauw!?U2g=v=Z(g92aled!Kc{*fM&)Plq%((rv8v>HPY`BnLW5_oJpO|vHKjx zR60vNj#wS*6(aJ5d1=3nYnR-DHdh4NVm5N#?Vyy1nS$lBU<#?86{N8-l3Wgch38Z| z7#M4G%ZY0kQJ)~aBQJNy`H+4=QKigpDu<$~t-6=i?)PUi@7))+037F{{nGIFIoXh} z%ETcGbj#4BTf&_DXeVtJ_K9jxCdhw$)9L;l@~c$w_{oSa1N;(5oLm@#cskaAoh;vS zVxwKe(3!hX^GwpgF`Vv-l+1%y`+WX!0aPRIbClEP#{J$gVYc0jKqItFEa1J~x%4!C zAS_CE#f68{a?Mf5;UaIwZAI0iRs)gp7Z{?X0drabrw>{HjcUmFMqj@eaeeB({NSr+ z@7d*c5ech&TXb9;Mijj~HQ-NhD7CC`x@7m(LxCTE|7lr=U?q*l2FFy_ex@S|GWd&3 z@n0Ft%wKYjqOTIf{ehIZaEsk?Twi{Xgg+4A*91N(ZhG~wCRAy}Ub^?$&KcUwmq*gV zJX9hU?gk3%46yj0I!_nhv3Ln9sYykqW3mXabah4O%x#@Ex?A}A1*Fa43f_dAlh8(j zJjiT*ON%aEjidQG%!oITn)Bt<0#1qvLI;L-a}wK1g3a%ZlF)&m0MQ*PwkWq4xuVea zC^-AA5`Swm1U|R&Y}RR$uJy9TUdv5B`2}I6p170pgZR#KDlT8p(8);n&}yW~AyP8o z^DXY`>jWMhf0#-4-Hf!1FA{s`4=BD%!p!9z(RuhAWpPKOKmbgEqt(a5Rr@q56wzsT zp9&feR%vX8H9LEc7J#ir0Ji>*=@HAo9YwUj83d`s0#q-m%heWyxs`&k4|fun<`ktT z56|bQ{(C5^n^-?UZ98bXX@7o-&Xl!O%!>E?q#~W%kC+8DJ1Gl;SyJ}*8 zf$*%am%nX0Ou(=G_g%yakJP{(fM$FbClDm0@Q|L@b}kDBDFe-q7#~I;qhFNVVejz%fM6J z~7^RX^iZ=D^gnFmF zgdQn%bfZn+>c#A9bthBR22q;a37560FDhsqkH3@Mb6|hFor1#k1b3I zza+};<2f1;!yEOAQF!qJ7SK;<-Z)E{T%DMJ`*!%Kms`~fsNJS!3 z6cvtno+*S35y=oTONNX`4hf+Mndf;(L{Z3m98)D3qX-!eDM#ipDhlttQQvp?^S9Q! z*88sCTF>*;bI#d&fA-#={n__@-Pd*91cBe{EDrDAlDzO@JLVt0Z${x2?vXY@(w`Zv z&$FAY%fbXuyrPWeec`WYKqX*4s0XD6ji#vK8C-1$s|)E79?FY!k{&5g2bd41+qZGv z1V3Y2+Iuwwg*c8U9lmER`Q$?~NXTSPS1U&O@~obX(^}xMr^5M0KDNm6SqZH-;FtO& zDc#Kd5?}hMPyV#771~QpxW*u7t@O#%ejcV=HszMq14oD{o=@>jF}`_O>{c17q-(AJ zVkhHKu!3}lNke-wT;U-6P3+7xV;S;AZXg7z9JG1pFaAA(OiNNiQe+*5oC+A z^C>5{w~2s;;W#%J(f0SpSMMdp*9`3@P~1Vgw7iW2X6?G&rAAzjOot0!?2FtXvh|$b zrQgMjJ+aDumYm2zb<8AhRnJ4Pw`TWZjv#eume8%Tq_LS6Ws<|RAKr%s&;T^)ei*&RvcvwNx`cv$+ zN|vOf+HAzL&&b<0MgV9sCh{ZQCNH+cwmVE;_Li?H#lG#{m@3@ex#SMD-EpFQCA&XA9Zn`e`)qEaV~8l{*tPaX+m3s zUgh3q_eh&Gci@-ia~(X-h2VIifiuN>$Fok_L3BFjFd1i;{(G4JeKr4!b2CDq<@NnT zwb0F@KSKJp4r0t#3{`>?k8{5Kn~vhJ%vQ1Xx?e5?Q^oW54-PWK%`$N44)1ahlZ{uH z9LJws`im?*dIsRma|h{9N2fOjaQ zBFe!sn7PO9z*xntyZFM+BP0R==v(a`5gXPRrusY`73Yos^T@v|Z68wA>ePF3mjw_m z73YugPZ@V9VIbTD45JF))MuVal7oC#xubmBA=atGS|X5`5~Y=(u#iqm<9sP`4}paj z!zp+X_G#L09HIk2R9-)FX9EO3IS)_d2TsaC!#iH8h+WpCl=Ja(-tNH{?WX>%9~7|k zIFm|b#zXtYss@Y)NBkIPfN|pA)u4|`?ak$|Hz=&8zhhdmU%zGVZKyy(!$q}n`Dxs6)6q_JzT|4%;UhYl|7L>TJ%xOkOm#G0$?^6+YpVm5rIX2y z84jv{2lD6-iQ>q#9>!#=Qag!$oaSTo3{S_SzW?BsIV4+Kzg?t&@BmuYMI0EdwXZ?X zFp3kRO#)EWLMQ4QxFU=!B+aIoSMp8NK+m!zG%mIXGD4Uwwh0(1$GW0Fw318`I=&?7r_sSY30J%&*HAY~q6>>dH; z!AOba8$5Kmxk4WhH(Yk@aziX8^agI|;=>f<-6#S6+p0Q-@Q4xu0LAGQ07BLRbSTDv zeVquz#q56t=5}QF6%caojA=8t8fpnuui^@Qp?bKZuo!1@|5%1$`O? zCqQLPq@0Juu}}^(A*m`>bM~bQA#y~o zW|z4G%ySL}UgB7NR8<1yDd}pUw@P`-j-JR5Ar&OfvbaW09Z$LI6CgH(kcNdC8hG8jsffaeUB91K&U?$F+d<#+D; zOO)@^yoW`dgzig8R*0>q39q8n-ImFRT49ZV!`Pp#{$z32_qvNt4F1W@B1wAyF#5-A?D}~ zD|9K<^XAU}`J%_C_iqIzQ0>*^kU7#e2fE+155K*Bw}rtCkANuPcRAIBapAzS7MIET z^4gXL3MW*oijf%1?8K-r$JsUSJ!k~Z_BhlIQm{N#JvPZATN%(kD)YtWv&Gv!zMp@d zV)^MYotNz4)Yq|K`{%@sSbXzEvFw^KGk!7&3rwZ`tV`SeUIeWy;93H|nd-ax3;vi|rv z3X{Tw`q-9VL3m!{NRho<(I#b3)`rdrVt|{HHi@V3IJei72(1RVv5U8%a_#7pDGRJ* z{xH|CpFM; zi;OEV;FD|JJvpU7t;Pp0h(G2(ICybe0%VAX2?E@NFoa0iv)#=;ng%Po z10$cCwi3ODjd$A1zKWmn>`5~kUZhJ|f1quPQ;uH#(%4(5xl%pH`$5qj4dly9t9jpU zQ4>4}zm~^G0L4ruo!U=%=9P2xm*8SBZmpaVTJvZt+J|i*5}l$nLVg6nd#e#>to0 zFu%v{A04{eCA-{VJV_J^XWfrpH1k=0TMU*iI|viB%L<+^h*CC(hdJtjR8G+QG;#au zi#~)!gm7#E^RTD^u*b86NDEn*4|T)9bvPAkj_LL6-T*kwLBIP@l*~lJl^vdH)VUvq zQuaOUGPdA=gN{|9cSQuMYe8ycE#l5YyhvP@FRq84ja8%UPoudz!MoMwR^)M!oc_r=zt*3T z-XSvtCME{vcjP#KWwX?HFr=t;9dGWF&1n1uIJMKbFJJ+KKDu3CYkYe=Qfi3uVgmGP zqWAHJKKNXwFAo%y7-NxGN z4NQBfvNbgx0oRt%sw4{l1C?GKQx4bCfS;VYv;>%#Op9cSx%r_Z$H&s7T+oeS70cuk z2y*uRk5B@_ZHP5+U7tucxkEYv-IT6xo=+HL_RGB0@A~nn7MOBEuQ7+yUqha7EN!*n ztGb{LkhZX46>CS5oF#GgaHI*-ihJc*}du$&F$L*79Ma>(5XhRDiPJ_crI~)92>s&*fb90#IJ_p#1MSv3QeQ29fBbd_1ZF=iCX!it<(g z>IGo-x4e!xY0VyA(*l;>Eh{mkIT1G*;*+T6nc|Gq@VI@~=3p0D%SO;|E%LdRhJxWV z?MZGYj`q_(lnYXmftd1H?&;}o7clAbS?h%n4@svHZ|>Xr-0ir|_IHP5yDCDj4{b0l z^*(pB;iO75smf*#3oFq@bn3OfKySU zz)uY932szsey@?{cn2nu9<*bIQM|L^43_c-H{1Zjt;zHlYD4-tC8a5R=~HU;RgrvB54{-wTSHLbEbeV9aDSbpG)&}v9tjl zLP@FR2Nw_N>iuxyl%*l&<`V+l?;raD>S#P#DuObsF#n1$fzpwrp{se^ z1X&EZhF-j#0QD<`g;fvT2`L9rs4zoR!i*Qk&TqtBd~m{a!B=q8wXj z>@SFVeF(R(&ehlU%nx5=jcHwYl8!bO28{1}r9L+%oDl!x6~obZ)=vl>$^@47A~Vd5 zHi-+O)Eb1r}N>b>=+}?v9Pa`Aff)jTy`O0Y=yfI@U zZZoA=#Hl!|g=_ii-=fSiPg32{Bu0YQVeM;44&I6qazE`7^~Lgv?)~cDiOR8f&hwQ= zZb`bAz8$I5-k|9#as{mTrDp|CdN?tG=2XUD+pKFGnazuK8{#_&%R6hEjRq+#=PaQ9y1O81|Og zJj3b+7!`PQ1nPJG%~-#Y#=P&EB?r^}D@=E+-uCa0K=*a*e^l2Q_`oinH*Pq$HK}wI z6K;ze=3`UeV{!qJi}Rjm+4;jRp{xNN3&FYE;uSGruV&Xn23DTLAwFd!(rsX^5r;l8 zE0}yU>3ODT&Xp_whDuFLD(E7@5}-jTxEL5EXKldGfBN)z;se3}P3c6@k&EF1zVUc^ z86}=Gg7(XoYPRTD3>g0Aq_iYzI@glVSCu?jN)twvfLg~SGu9MU$#x;4Bt&SD@@b4! z$3cmUPf*HSDi{+R4RIbK&1a*$Z(e-)d&2tEV*-cgx>_9@ea^cNSJ+!IJ$(mN%PPym zCJ)N3au|%GCT>|kMITFXquq!dJCSSlr0Oeucl9hE?Li5)9dsJ7L@HV$-NQS%p407D zib0xI1KqI|!R(TD+_q<+?#-RIlu{iiUhJ(KqHTsiiaY#g8${%ZX zTH1;&1e$ujuVQ;)9g8=J^J{dLGPuNa$FK3tm9>8t>=?VS=h8JPyALeC8PD9jcHoX~ zt$mxb@Rit0s*Jq(6z7Ceb@KnCxBWm0A@z2_bPp&N1EwDmBvT61irMnQ912>vKDqVr z|2qW~5p(65FFB7lACAKHE&GS3*Mlkt#%ZQ2;sUT; zxU}zP7=y7qJ^j>F_v7c5cDu+qa$7-f_t0;{KHeDgBpY|xaEX2bDFn&vHZ7&fuz@F* zNxiCjVhWxB|95<=U_1K;O(4qNMo`Y)OEgS3ojL687)&1Q~M~<5|Z`djr#s z+yzx7iYsWE0gB|6=0e(u)p%xd1zJ@&6qd|C!d`XH0=a6!`b)v7!CKd>Ui$&i4Qh z)!IDM{C^J`JNR>@pByghlLcMnZJ;mI00W!e={wQ}7a?OHN?)hV8c2Nc;D$N@NmT5> z41Zn@BnLwX)VBaUCjoUvuv{@lgzTTd98EVZbz%U3gAN2RzO{hIO?evtW^)@V?A74C zc+5A7^50U)oeB7^yY1`DWk^D6fX7sO*>w|Cna0PW_O6Z@??NBSJa8P1S5a|z4K{s6}Y$xea|O% zI%dA1lrfa|`}O6}r-Cb72#uu{F~y{EgChB$Yj;H;l=gciTt@NM8*}CFtHgsq>-zl33pi*xBAIPF zqZn>?MGqaNbqEF^qLt1PT^9 zkv0$7B6(>>@hH26TBB-6XTe-`-VK$EAZsdmzRQ@7N#!e{L#P&nLzTzN5--HjxS_Uw;S2dVAs-K3LjLs5$}~J+{9H5A@Dp=XdUnIIMxLH={w8GEWoyVbA1p> z8PPE4=;IA?D#5EyS71yBH<2y6VsD>Cx_JK3DeE}%WIT<&O(70b3+&P~!;g~FC!yzR zMMXGbOD#xuJo-IOpy}vqPW3v#Lx=afAia&4#B3u_Sj#`H`3$=!q<;y@R|n$5@idm~ zL+jweT#aA~BoTGmV4QY(npkd<{)@^~wPu&V8ce>=IgfKsIRVv!{w;wo3$J^q;DEB2 z{r&H1{$rBc;9>Wb-ppO6Lz6?X_7yRCHSSwl2gVZG?eK-S_8jyo%hh11R6TVop-;(} zIBOA13@Fdvh4aKCq*g)E$PZwaq&UCx zQeg3fn>Y3}e~S_`oPOwq=e@8gUY>ohG}gdMnpR(Yc#zGd_vPUT(<`W`Tq>40d^^J9 z83Baf>g;p8?xcSqQl~&Q&?zTBXrPi?x!v|=;x+#^ukiLO`mZ6@AHTs1!%FwT)XIsn z_9E|rQt-(50`)rf~H=8i9bdlqvqR;931q2Dx*t~Xr0`Z-3gDaFTP zv^U0NEZ`T7S=Y~VfoT~-_!U^e2hN7n3n47p&1208K7Y=9gSV~N=@R|_IJG-%Kl#-CXmZ(pjcl6^*8p9_x|J2ly3}==d;YA zRmw}4^ikZuBKtq5Sb1_p=oz$k-$E3W5K5K$TAKAU%QggK%|cT zD0O3|bZ?75hzFV4FXb~!z^yet^6xrPKsDW&`)p?NaVVW%x6}Xod%bf=DP7BT;~+Oq z^K(W)%isHd7(V9~%l6|IIPdtkysrGH8}=G`A^-4KFuQQZE9?I)-dR6@i7(@pnHH;# zz9OdoZ{m?a_{oG%$X5ax%in~b%0Cz^fg}?$x-=qSE0Kz4hI{esGkAQeW}cq$-JgJe z;?mV?^*2Keg5M>iYRfwSXQA@=zXypC9{gc#jI@vlT-Bxz&#v$NKHnR;%2{7mDYP-^ z4QH=J|DBz5@VT}v>dht+>zDye@h|}7zUr$fN5*?T?EMG~nvjOqEBR-L2#I#{P;tW} z@9V`s7pF&Rv9mpS8l5lsMvZR$yC^J(DEZM-E}2Y(jE|^-I`0ivInQ!xJ)C=TIn$V} zelR;b_Fr*cJONHJo8WFvEpCki=AP zvrkT+_11lz2mi*%i|B5t=N!bDcTJs)_vA5f`|{xGCaGU);ZkQ|tk>_A)aiX@`u76I z!LfOtO4Q$9ak;GBD_QTB|M0J_4Uy%|W-op&ZMOs$>;i(R%@b!-Rcq0xqe%k~gf#V@ z$w#q!(jc`MxFJVP13e%(7UZoW>+*j_@BfID`xJZrwDyhN`=gGC8}@Z@Rd!Ehqe3}~ z1y4O>Bre>uxG|j?C^DOXAcdlY@&cuTfP9s##7GGCHD7a+Obc_YLX} zrgkRGvAW{Cs~pd^f)rT1la&f&Sl@+g>@JPkA)p|V^nQK|YQB{Nf1q5n0P&7TXS&pF zuzgU_=9`3^X-5-=xEz_-rrKPeW*Ub``TYpeMLx*{eO3yZeZ19mF-`mfR0gEbTmGV% zuK6cY`UT$k3z0tS4SbCsT9o3#{oO^EGz>YWg>)n0WAtO>w#84VarRyM(5=cm-zC58 zBL#U&v#347;bfBWD1?ZAME%)OB1CF20?lRd74{$J@JJgABoZw~Y=st)h#hIu+4KkT z2!b+|qbAcyq>JP5x|7Rn2aw@!SVi@pb)V8k0{rCOm(8c&6`^xCgPG7NdC!mrBuMv- z1?b*scT)_CB1N0c~@zFH3p$&Gk^rXm+2@dzJvu3UBnVn`_3ROE4QUHVQQuG_)>oZRNg&Xjc~Cej)x= z<%mU=DHIGf-FZR=p<&0k-8NWJVG#fOI}oMe;XX}+_E-A(gVt{$)NFVNNC~HXS9Op^ zD+#?V%_kA-8yw^|%yKO!~ zRbPCD)VGUK=>*iBb#QOS?}2vxq*i^HhsEUy=1171@n0 zo>l7ZJo6z-b4xey6|VuN!zWNekyG{`b1Mhg&^I$7DBfaQ#i@UR)aS#pOZB%diItat zHxD16WUwgw3>{70NI-(p&mh`q-1bkS#PkOI*1q{|u3e4y-NETLbc(1e500qgV%O(Lf5zfou0EE)~X{ zB|Mno6WxFbnclSG+w=>-klSFIo_p~yP2-IQs#_{G!1KHET*^3vfRq{Ovwi1ETV}u* zryr?Ms^n3(15DC%3P?{X0#A@CH=@s5fQL(ph+`|12v>3nh|Qiwt4eHbIgQdU5r#yWWHqM1(^nxuVyvw zr9vdB;W3~Fd#ju*HwPe2ziO_OG$p|oGMg#~#C4$Cm4w#+=}XYaNxZhnXcah#Q(M9O z2FB0efku#Ip&2C9+#A*u8TXgfKtZq;X%|WXrdG|D5>oIE7Cy#}h>JFZ7NSckDgZi3 zQ*+dgF3F3Q^fp&@e)b0jU7az5d<&R=_UBJ~A1}{mK5=SS0Ito7I43A#^+Jmg2Xpp9 zLEMBtA4!Vc1ONaFkUiVROSB_mH(hl?ghz-j>VB?x1oZqu^QeLgloDEm?G~7Q)hSga z8$0kwL9b|Ioh#M}e>8h2s9NnKW!hu}F)%=*%^az4 z95o>!S7JVZzCZP(4udI`thFO7KhOItl+(Dm&bE-Aw&KF5`y$wnNWdHLA+tLYqPqxs zLwX`khe%~K&{qz4)q}i;b4Jas;n4e#2%1cUd!}jl*q$MTCoXbIr6sllm6mib2G!Hb zf52Y(7nIha*e+;FrS~3Nyw-St0u%m$Z9k*x@}JVra=l79{aRoh$+A*db(fn4^b@Qi%cSd$*g81}#; zr5yr0*a$Pyo|@K1*=Eotxzc0>2L(`9AM|;-P`{0U<7|R*#K+HVfm*Usje}YR<+ql{ z5p(b!;e)DmVk_#FGC3wp@0%Re+vQvamP|TS)~Y=y4mr=4d?h9dRS|ESUkl=9DLByE zR^-PXlP~Dvqp%RdkHX?txFU%zs$h8FjaNU5v_82W%5ivQ1CieNqPHjc%+X&4o@g>z zeaO8?E0a)VdFdg>{p77Sft9u(in2?rGnd_y$mt0E@(EMlvuBNkOz8-6+|5TP5U)6j zrsRBl+}0~&WrvH{G0Ppbr0$s&->w5{dT66Vg(o~2j9W_ho0Kpnz1v07YCCbkBk(T- z!GMRuLikkZ5bGg=dmPhr2XwZud(o^2O>U5+7sI+KaBD?tJtLrm`oJCFz3?-(7cBzf zHiRQw{MIgDPolhS_fgfFT3k8BR2$~R1jBDR9h@mO$JclBF6j8lJCFF&yk9$`QB7(b zSo}2G+1EN`9F1zfE8ZABK7b3#iq@lDRt~5qSyvkeNuL#shW7#4sr}u$xv2>hIS*y4 zRY&<~)Dk{+2z!aj2adDd5|PV!ZA!|Tp}e|&yJ0P0>?2psB0>7fOuR``f>o^dP!PvB zmzLz`NoCKAX3O?cxppj-@7%KeN)2Yd#tPLxRos41usgFrB%z{!nayb9rB*`O;Gc1* zx4w}MDP$Gm%aV{TjgxOi7v;5?esX4P0n37fiw}Z)(}(5O|)Y_ItThCB_ePe zSKT^Qf}lAgf?T4i=Nn^=uQ++NhRgHFHZ>L9WK|+#`>8P7VV7eYjmsP|n8Bw4WtNBf~ zuj-$_AM2sAybPK@^45E09IM}f(biLx`3`NhIlosHNI7l!$n?5o>pBwhsAS@5uIUP=GwS4DijB*%F`FvrP3?IB4|e@&Y$^K z@Iksu>V?i}$mO;*uD;w&H`uYU68FZa^e5=$h!t{6iv!$O==bFwwOLW-O|J3m71+m*o9EW7M-c1^B^wkGi)HC=sYc1Ep{8kJR-%HpA>ff6cFTb`6JpTS92G1n0FXA>Dmr&2@3o zIw2+%ql&Y6DOGOK*+Nb}L~MkCWW}s_j3VKocnH2hGS?z*IQZTFX3uo>Jd+w7Mx*zN z3X-|+-;FA=A(so57V}^0kk`A~R%EeXDQ~Q<4Ml}?2uS&! zvu8~G&SzG8L9i(C+e+36vbFpV&tLJLy9Rw|?4gg2=5R#8%biT<6r^5r?<(gDo3HvF zZ9k^iGw{9qUfP550SMqawAJ<141F1?b~^nU zZA!t@{T=vui$t~^W{KNu`xrb@zNedsCu!zqa9|@djWT!ru%SJ2n=?4%%y7)K$(SPD zrs6Cj_0<_>9k?#zY&wk1^C|({PVT9HCNGJ`Q6!cF5|CVWkQ)J{3J~yOte3jf`V;@Q zLm}i3@0Z`A^__BVLa&zr^fjl4ulOoFrDni1)Y)XYjCJ4Q$BA=ZpY^+XOEym14X5_r|%5`p^s$RkfPVL1b=3b&hqpu-5dtdYP zp?CYJe8)jDr$ia+R;ppcHw>eHUi}Ujw7Va9bb!P^vt}T}9|NJ*P&IeZ5Ww9y8?2be zrSb4c`GK~`qL4wA2nw#L$2Ts&oYKl((`LTW+{Ss#NdW_esKMXyNC(w%(nFHB#@t4& zPVNwouiV;&44W>3QALMAWh-S_NU!)4mRz;umz(ciQeT=;m3#noi|eqoT42GPcDTsF zyee9+RBXWhX{N1=QRyZh@f!x+9UBCsDJ8+VDTKOe*1-L#_~#qe!Df8}-;yFJVz{fC zRf>INTG?dWx+$3yKFE9MDxs;}2x-nn;E!)PycyoWYS~ay@09)B{=rB+R3lpI##PLz z4LoMPD&F%eyU$R2owa%{2C>YV6&oHbJ8^JstWD54BD7N^g-fztAs2Ve4h&RfmR{}G zBz$>$U>}XD{5ndsE9#oh!tJ^1R{LMtAGESk760WXm+o@&wC`hPCx&;@mhp$G=^U_B z@>Lw)8c8fUwv)VUm@G*WPT>vjte&dseecmRCwtZITyM+Z3%-8pwIe{5+|Xhom1ekF zp>lVe|Nm%6q*fk-N6cV3Z-HBK!Nn1zJtO7rm{K|k|l7RalKhX)+GF3us zt7$PFg;nsKJ-8;2`aaJS!ptX z8a$xEK$GfH2WEw$BFegh*+*gYpjKp6J-ESN^R+wYjd@)B>&Zi2tZPDgnAr_MqB)E)SE6GVBLe z;?CiPYS;0IyK;VN?7m+E0ve@Ry*2$rzaOUcn?ht0Sg4Z?4Y8D&?p-9IRnsFPE)N$$ zvTjZ7{7tG0wPPIqw>JSmPX6N1DZ*r0xeMVB#$QC0(B<3+q3<~kY|Z2~#o+vUkn?-| zW&~OCra@gu4-j?jF@z34C?M$P@1(pQSei>+2s8F4^#{B2*F#^49<-o3v!Rx7J1@}ygS0RtllMhj zngzaI)H`b&(uBIXG#$c{wEr&`V6?tgg_lS9(Zx>+VS`)8fB5~`@-bxX$vvr^pXCu_ zr_0k1eOlu$_mHntB7{+TLh|o@$2Z4w0!RgQ^mBhgm{RH-ircq@Nq0F%_h#_LbEJJD z>Z|F=63TNHx`Kx35oe2OCQrpwZ{&LK0hzC8TNCi2cFe9Q-DZKW!SqeBYFyn$<{cf+ zvqGri#?|CFsU?(Y3dRQJ88u$QvT+H` zU*?5SK!s7I8A^vq=0XDG!1WOg0c;gF8?`1$;>kX!>>J7PQ(N?qa%cR8W>ABkZWEtX zD?@3-%rWj?s0H3#OpwQPoV-a66-njF@0A_PLBC!LZ&Zze zXK(J{a*L}W7!Wmdps?N+?n>LAK6vfE@FrNmPff)zM3#EQ;gUG{`7a)Fv6{IQsY>Y3 zI#efk<(EulyzJ}z3DGFHr8421qn%u58P9hnyM>1!S$octk54qq@n(UU8G4_)?jM!2 zTd!9Z^ZIaP5N{o?$v;WY!!dDhiuY(>?6}5^!s@AN<#Xhji!RA*cI(X=OsmnZF>aR@ zL{Ke;2qFJ$HDNApyuHXLr>~;(&23ZhLVzPAbSyRwzSMbqAyp4mB+GIOa_;vi?4J+9 zQYGw1Q}v?px`p_MzLcsr6^wCx(0cc>e|{nH%%08J{VhA zczy0Q>zQzYg@p!B`Wvxh3zXy}$t<65FQ7YL_FQ^@>8IXLy<3^TWxunh7T4Tb^jfsO z4DRR0w9Xn@1|36vR-rdyZy$_RJ$*tfFVs|rOBxK*n^*2b{wSr+l^k6VUYKxV<_tn! z_l!T@^Xkfx)@N~E1VO(U?vIh_Nio-&l7hK0ZOoyXQE#$j>-}qg*e9q(NYCUipGi2s zq<7#4mx&Kpls7ScbpH(t*|UYLhCidDK5Y=Ohj3Hi9v|69Huu}Z6Eo2zB_244^c4E z^&476R=t}CwCkiz-H_|^<>x+hhH<#OC&}rHA$-nIUk}kLWs$RXe_r&U>kQZIGd5fv zNl>Ab@A83RZqMyy!Iho#Bxl5@nj@ufe(P7c{w~ zICPYZHQ2({JrXt6!0$2aH`{sZO4ZkYd#Qqp&TI>{1vVk+}aC$1bc`2@Yq@k=UgYPZX)%w(>gty0gTGIlhH zN|DhZQ&S*T;m|h5X_6PeEDW#lIdxl%l)I|)(VWQc1>_^nOB!Akny<6DS$?==Q|*xq zNlzZ>LlTb%xxdvFh-qRJ%1IN9(f%3qrd#tuOSS^%qT_E9hdGb35q|CL;n6wbyyRgL z^$iAG-0V>eBeI)iE$@l%a(2=-locPG6hO{Cg(P8E56^obIXVuTa%&KXI0m@X<~LS9hEkk=}n(`?fH8* zsP3GtW7;>O4<`lRXL7Z^+3fyY-+i(_d;J6e@paa;w>q%UX@Krt`;Zo-(sys#9n)W`fgURrn zhOEWXD8O;|Xz*~MX|>U{ksm0_IIn$^bj-J7VeQ? zRAC%uYA0hbvy3~(f?q!}htsPk;9o#YIvku`38or5gX@4jo5(f2O@D+jsY^Kv%|3TN zHixl#g(`=(EQ9DQ7`m)Ki&V&i?pp%&nxU>|Z|(l-9*Hyy+;~~=Mq+fTVR4Tz-YxooYA+@r6-Vdy|`ptU?m5LFKqf{-D0C%ZWc( zcejl4&z>>-J3{XyxK-tU&UuF^*!<`(Eb36&z1=MS#$?>sN*cG{!8B?&Tsns&=_)h- z-rhLaCeBh|A(uBRLmQuZ2J>%k0q_mk8sWrqFfUvP{gtqilEAiP<9OO%&UfRNa@e;o zKh$>a;|B#8_yJRE`q+v0%1%tJpNlzQg7r&J3bIqG?To+yF5T8qdej|Ijcuyf#bd9p zdlWJnB&O3xDcs?5Q!73((iqf3gba!M9MObiAa~_-$5;rzORKJ(#`bp|>3x6rKlI2S zwZ&*)k7Se}ORyp>cRl{e+kT6$LFOHla#qA!PS!_y7j{=b9ujo{EI{ebd`e5lUT7M* zoX)*Q(i6~;c*O6r)85>ZrR6RH!)ANFDlhY#sG_H2xwGB%HQgV(mwxS@)d_#y_M+>M zG%dN29noU(+7kY}X8oa$b!R$yacZmMY7l!Q!(oVujZz$*6*NL`n$*dZzH^eJ zzt(_O7YNN?u?uoNGPWZYocCuGxq$kjI_8)gdts)rf6zq~!152zufCX*S;%c!Xy)_P zof;lbJ1uvVd*>i#?Ap>eO~3P8*M9@?<^jS(lZAq)b1T9}gl?o<)|@QB1~T^q9v@;E zJ^Z%By8MKj55%Ew0GXi!7Gh`#a5RIU&kQ#|2v)uT7Do=>T8tc0|9Kl!UHv0kk3Eno z+?(T85!9oe_!Z(rvrYI7{bfB;pg$?2#~%Vg zVD=Z+tr=SvCPrzQWMm!jM^nM;|4BJw*XEW2MX<+ssP}d21jobxTSx?IFQ>mit!DAy z&^8umm7|Qm@4z3T(=VQ9LI)n1FW@Ll26RKmGY~qz0fjaruotURvY|`s`!{grANz{8 z%FJqBQeQZpz2L`K$(A|@rgUfcOI{IMu6C=s)Zm{)zrUzVvu)e%%=R@afy>j)=&?cZ z=I(3rHdzAb`GuaJhSoY?GTgezth;-XLqW{taDx6OK2_AwAkIcg=&Msk+va-PTxR9gyBgBroCjYtfSeg5UK=U;2w~J+R%Og zuH1M$Bh@>oSqiQ$jNGXH&1O>v;`?Ceb8@ehyrX$7m4^UEvN4BBA$`R5|5V+6@ z;o|cq48f$?0@REGji899gPudoFYm&A4u)j&ETVjy@0tXf-O+Ht8oL3QU{>_$>+i)s zUUKD!^=0zr=Ie2og=E{mTI8?ah3*5cXTX%N(e82N4+g(<=PILNStt@UErA3yh*c># z5bD7Eh0yNg3lvny!9M(l#SatcnXv!Ft!9yKW!fMpugg2ZZCEDBJ$E@nJBH`w*D$_D z2uV+eNZie`O|x&LyK;%TL#!3wFSZTQE+1SH9)I~*L*?kRFk60n0gJlBP+`6{_6z9E zrV;ZX1MQ*ThPoU3L*-cgmtZ`0o&V@rLQJdJ$jZsP<=Bx;mrt9!L0T+{IuG{Z#YQ-1 z=5lW}%gU;Eq8))y>5@kT{+4h}D50?AM`w~7#DB6e-83iDCdnvgip2~x!1@UaqOVDr zM4Mj54g@inp9x!rB$!EKKWKdimOw*#^eQ=0UI+#vF(1M}aE)jkgaQPu1%;{ewpiC0 zwv*ty1(Ci%$n{8Bwpu9l`Xrnet!foLfrtAi9+kd`mCAy?iKxTd5JMlEjEsnet*B`? zbAKy+L%0Rp)nEpAmF}E%q{!734U$wpsvGJgps8HlCqtm}pD;}PO)b_Gi+dGF6MlE= zd)D&eysM&YY%7%f&dGvrfQVlPo~1mZ9-1ZVpl4I%xp>9i2`eF`;x};fnQdXoY0a=I z6Fk#qspib66b^_ zD6KVOdkAIXIdAhYxo*&OnF608Hk}(E47C(7TaWl8(}o6^^w%%AMV|SDKIIY zFKojy+3e~A3zfev(P&w-EA%QM%l*M{_9YbEzn-L;b@+ZhAlBrYS*pHu#Pn7x3ES;f z{&`pw!cpshbt_-g{H3pW0eym5SM5IYphcii{by*E#PpUimBUt?B#mjiRgNt@F+&o6 z^Nl3V#?<;w8{NkkOGcwr@5yL9C8IdEuq1&ld*VVVQ1m4b1YIOOt5w3afM4U9W=yvh zdg%_VhF^~bpqf7S1bT1R-r5bI><;?t0_N(Hj-QS+jeW~rn}kkaUn2K`_BLU0LHRL} zn^18c=a_E~erE~~jgEG#^o&u#1jn1JJXq_CgAHY%bT$IYwa4*=;RIGBz0+}MTSYjN zI%?17-%mzt!onWC>CTCDy6PzaGq(#qKz5auVQKTqemaR2QVG_*y1AO zmM$xh&4%lA`@^S2H@kVXb#pJ2H=^Z^#8)LdD;nVFA_BKI7w;Ygc7$u4cvP#d+^a~# zM9c--sE)Z1p;S}lM5X|4hDY>C>9|%wFqbU;0z-*Zd}s3m>@#`&nme`B_$wdxCS$zP zGzNvBkrn?rHL0fPhU)1sjj03y7Ms2wleW*{v|aVnkB-kj!|V2+f5PC=M&WL{F{$fw z1JmJ$h{a{;8`YcBMZ?-R0Wj+n2785Oej(X>H=94C=sOubm{6aUDY3Fy(kY~m8`6Bt zvrK#OPv|(j#Tm4;f5~u32wQa}sOLsUU*lSS`YkyEbCn?Z9&T;<){B9yozrGPvP~0~ zIQz$bv_uyfb;HJbV))VKLtqXu{u08=^^$hp=Yasn3U8$|#m8_83cLV=(B*HejB#&9 z)=eL(TH|6PhVbx`6hLRmTKYSCH4{$(VvOL7u1ncZLiyG#3#cCrV%lB<0 zCv+a7wQ-+8FGAxOO>M%sJVtWA@N7}sm5sCIt?aG}f9#v0%MM&VK9ecGdGq5btBHa` zO^LJ|-!!+U$FF$DHf8CC{UAtYCSDe6cl?t$T)0JE#k{iywx%gePtZT=4UW^#3%qw| z_V$l&ybg*`@9gxvn10EoM(2qz;0UVzUno5rVvK)eZ|Bkx8BN&oI>@!{>mRDAy}RLg zs`Kgd@vke=-?KCBW9v9pK6Y=l3OIQt3;>6UTI}m72}4X<7SmGP&~R~7^w}~Y(X=L( zL8jE4sgShh?G(Cs+gItx4yT7)2l z1Oz+rb%X5>;PO#`IrmjMJg|TG+UMy_oT#JDd=2@PBs415Y|`ghDQrWU;j@GxH^+5+ z0w(;)AHY@=hQRy*fTd>|1XHo8h~0!v0B{wTQwAp}EUUgzE!`;ipN64;E6Pm0qsLkT zqMIP(mDJ!G;Q^fo9}M2eI)}7ISzfDa<&V6&j~NWS{joS!EHG?*hUHdE!As(8!~)2u zPE^5Px!bIrK=+U$M{PM8`~!lrU#an38x^w8-?@NX_6>8L_768Z9IcmfI0$~I<& z#H5O(`ShK+SDM$rykz0#sqem`<;ctC&lbe33`qbg{u;6((8sD6+xHF>!vim3GW-y) z>!vZ-2u&DIVV~0FfL%uOXDTuHFM`9lSU z>Rn3^H$DI|8k;H5M81IO@L>?E*}NMnhM3P1BHer=v=k7@?v3ewu7&L$fEf-;yQl;f z|HuQ048ebbCy9T6QHh1;A_7`{GT)6#?;r<$R3@H%hy2OodIWnd=~3qkf;t{&ghaog z$bF4W0WFC~-w#K2_&u`Hsu;Ib%W|`;k>N-rPw>=NQ;5jJv0%Jk{0>0q_aT0qk>ATL| zQ<)}F=fYmJC(f-e99muLpWlz!KM15jYR_klP?nMlHDzy?q#M@(C%&7TpPAOn-3E-rH7X%I|LDR zKX~=E^Qvz7b`G_+Q#idy3*XM#Mg=H#N%FvH{Js6(+-oZ^2q5-**dHvAZ{SLb{$2so7@9jstFY1Wf z423ww6*#vOoeSC7mD(eJIQYTF%GnK4f~!uy6z$JFSX1rMAjt|eSNZu=sL17qbZg)8 zN;S9Jf!5bMm=v;_Cn}sir-&0+59l1v;rCL@XxQ7MFtS~{vt^Q&)xoqDmBEzMq363_ zDG(dcwmw$n#u};Ou5C`Z>d+s_ezS*OCM50dZXWYzvFUp?x5jCjr$RfIkcRt+zpQs4 z#w2CpV~YPbR~<>)CqH<1zlu@l-#uEtj-cUPFVlnrN>ev??x_MXP}EeTwb2^2C%0vm zWd+;g9yCqwfl7y!SfWp7VDd#$~7f4|TBJjd}K$M3)Qc>cJLZrir^`mD7+>vLV_d0ywGXD1iU zWJ3YIj@na)eW4}Q*Y+&8u)g^J_cQ{W#kge~11)-fx-p&n_v&k<;R)w{*nt=)iEmFT z5GDgLRCHhV!^>sDZC_6 z;*rglyXYYp*_S4Xa%Zh7ol2Y zriYuQkrewET-|tVN_i(l9A^L~UrbEBu5v~D^W>v85a*92D?#7l7|^+^Fz~9^nx4y3 z*tJvW?-srR*LH>J!~#R%M?Yw>aI?46A-&J9AV-~*vhOa^a2W#dF5>jFG7f-KT*0;R z++7d<&de8>f`NTe8~@zyorKd79Mw{nB3{nJ2*aDZv(R(f&d|Fm8Oa!H3hwNSIN6Dl8&QC>Jixdczvi_k2Wg;yjztrHothDXlHC~cK zkQv|W{}`=sylK%FNW>~gFReUIB|N=*|IYeF}0579S!EP=dV_7`g3fs9d+zn69q z$}o42cT}mR92KC32Lc`2))2L)@BeB6cH|!>ho-J5&k(!rcuCLKk0tfV3A&OhZ1&UO zD-;BNk}lI4n~|6~db@d_MQ7G_>iK&-xKFc!Ldl277kC%(ZKeC_pyJ_rqZ2P`IEzBV zRs-Rr%yD^K@JYa#9Pl$b{KAQHIvXFbKS41~eIm(GN^iY!Ue@><1)Owcg-`LYONKCr zKN?Uebt2%XE?~sz<-iDtiAgr(J8gh~u|bFGG}(%D1nvMfqU-_^e_GJcMyP@k1faTR za&Tex4PkPvfXQ(VgA|Jiul4rgmR2wj;DaVeLtfXDCf@>P#Nd`FuMY{CN^7Fx^O5^) zT98l#Jcsl+)T5IFOy=64+IlyL>r3XU{{~^-Tb}re&D1>p z?4#c!nhA6Av~Zagoe3O|{m6Prp^ZT?8YyCAoQIZ>B_7rMM{kc$@c3uUFjM!+2C%pd zrR>O@;65OW!Cs6+$nj7RL<_El)>p@2;J>31r|87<`)^&~Ze-5s_+OyaksBy3UV`xN z3c|)}+`dE;L!RBU3tU)8Q*_YT+}Vsm@HFpR>BxqXdKDydpMoo;ElyN0V%SrS3S+K9 zY^Lc5JuRkCzy@J+#0Y2#TA_4;WgmaWgFHY>+5qO>4USr?OV3!%qY?0w59=}oea;yW zEc*UUOQg2rCm5|nb6X4}J>~@fP1#HMmR~Y_3s9Ov2Ox!SC@2cr0D|L%@b)3XLujgN zF*wK&=KY~+?W$y1zCsC!9G-EyMn?h~Q>AWJO@PLA$-f?hj>hHD*J1jy{6HfPfQqj= z;4t|Febf|zsy@>qHDmt62@hP@dPx2{(V*cpLGFv}G zrC9V}*5|(a8f@+T@mvEBAy3&_4efiOK;){OM~$-36~;f!&*%ULy*rPA z+|M)n&CRS~&PqA>ZQHgqib|cRXzBi52rYl)Cwnh5NQlcDTyVFe7S}_%!OTyf(-ZWq zeW^cn{m+Ic&xzKA44PraW+;Mr-Ib#zfX_eapYD%bLmQl70n-9V1cOI^ZiFg&0DVch z$#V}C9Sa=qGQNuumK0Zo$6PDYoQNix2#r3B6E9S~a9#gSE3g3UsH2p`y`cp$5x+X2>{&DNbl{F3peAU$>L;fjqqiDD>r(s=~ z5LkX{2KDx`x^*Avx+{!Nyk#Fb|2Mi5HOKV`%EP4*9-y4< z{5g6i1m8fqNT^PW=QOImkLepoN|a)`ypd`rnqYKK43C*?F!=>k*j12dDjP9n)!ZY< z48(V(N|p$wckzvCcf>gkg2txK_ObTDsr-5FiIEU6-$?vv?ZG2O!hMt{@zaX1#9#(e z4dj{`893lj*ClwE9bwkDRkOCo5=yKJ zwbxV#=UK~iu^HSy23BWvFLN)Yx^tul zpqf(8xp9$Qjt9h=^u=~Fi!K;gD>oi1#Ap##BH)NzPLH@%ay(;PB(L+<8HLiJPeN+1 zW^ujp(|SqLGLjkJVd%vYX#~AX5(Q8e@G7~3&>$gb(9Nix?w}Bj@gy7zBos0zy6^7I zGm)Y0;P|d#*IP>z!WhPAq&ZYS8rqSu)w4M+*2*mHIgeF{wtg;`?FYBUu*BTs(DA@k zL?zQg`RO3*F1>2P&`#m0IAXnudG+M8_;PtmV_!AGMfsco?_alOjN@ojZdjOU4`*%L z(oHuIn5W4ssCA;F>s*vyYXS?K8Q1MCr4M9xO(UwwC_In{t0U}?LL+Wj&>qQ`B=MQx z>bOQBb3yo^=(xpzSLIMZu}xrD!4D&vlyi!4=KJ&S}B6jH@F5ljN_JgyE{ z-8Je;lg8cNFct46RNBSMc?d)TbUz;}QrAoS8G#@^8B#qgsSdJ(ZP$Dyl)4@7zSF&A@9ce)aIxy) zhr2Eh=SverSu`t?0xU9mlwZvmdK3iGbn~9c`(XREpU`FbiFNul6A`hc)OO%_Vg|Z>$=VG$7}~{64Acp6d*bB;~e0 zsvnKW@q_~CP&{HYnl@}e;+7pzq8rtb5p^+nVY?5 zKHepYt$O-uj%Qg?S9f7JSk=mYXUki9YQn)*uk{Y65Y^qg*z)Js=dSp`9o37pns(+2 zuMI@aT@6&QLc)qY@?Ap;M-(1>ygG#HzU7Sz9J`PFBgv>O$9!Dj_A7;C!h2u0zdmz*v~WhSJdydOIJdLilfKcJepT7{UV%eyE5W2nmI1*HI_vVcrlP5^rd@Td)%P=;+F4hGLwaKGVED03o=xyzf)#rB&k5JVz#_!t^$u9q0lL*;jWkqU-X_S4eeHR6iMze)cF5X(D%qc_4KgMBdE4xN6o0%p=IYw& zcvs2Dpy3Ae04rIm4|JIBQyv-?lQ*xQQk*lGKdiM-QS)5_U%n#0 z;OHzCbYw2=VNZ1(xG2dFGp-K(Q+*v1*!c8r+P(`C+%xv??h%KLdKW2xkR4<@9%-LC z0#Y3cJ+ujjZ4~ZLs2-C&E9zkMNX~r+#xIPEChM!87N~9()z7#3+I(%2(F#pvZ3S#$!~C%_N(%f4g24RP^VoVMS__Rlt|rv~QT z^H=2{|Dgd&Hkq7+QZE>f!a>8&-`MW(py6r4xs!Z-$9-nz>7c?BbN-m^%E~3^`X=0~ zI+Iuz@`|(=Hbrgue30GuE5OkUp6?3D=Uu-o%!J!|y~$_If{UG&VB3Vb0j2oMdzw*% zMSd!+;ogyk$3oX+U%Vy-SZju}TR4L+C|53{SxY>Ac=_S4KcI+u$VDMcs!&F(FIF6| z+-oyA)Nafg+9#cqMZdIRRbAD50H@-y>`LP-@npO_RA|dSwrmJ!XQX@q-CON$bOjRx#_00HS=sm6~da-eWXR~C&3QctKKALQm!e!ST^@2bOJPBo#pYEA? z80x_7PA^w>dNMc0-!l100JGKaBm?m(oT%AnmWQDOeM$d0Khq)l(F0^N6?h z(jCsph5DOQ8a8N~Z4xWNNoyl+DP);PrlP_Fl;)ie-!q*BP7Eg?kD6+jNv22EZJ7?b z$%*?I@91LFh@kdYi2nd~wp@z!T{5EE8P(kLF{e3q2Dy%( zv1%d3PK>z|94ER9{&n-1gM*V@PZGMk?IL}@7zCpq>UX(+WRWRQ(h zaRg*aGd(*~4;$?Wb&_gLNEOVO@9=R9J1!I01YTgeaR9fc_szPq8erU!#anSc@_K)e zA7vSxJj(`_Gst=EStTSak8N9@EJO{e)Gu?^wLs`(-z!wc{SyVW%h{PaNCJm5Dk0Su zuM6WdeFUEDS9sa=9h4=!W*{*c*_m`;v~t*H$Ll>^`5%uBO9`kw{VYdOXt7e?N_Vgo z;VfH|b;qxG3;Gy#oB>Hkg3|q=3bCwD8Pe}zx_D8Omh3BfSg@{Zt4}=Tnd4A+;6Bti zAw;`9*GZub-W1V0VtFa=s1pkVI)v%S~U95PKGX+eYPdqhqB#rJU5GIxy#T_e`&6?jzy z_KdkYr%JM@5*!94dLFdFD_jd_ z?+lW>n1;SFaVm&-+(^^t))XxOTjHP66i?sc&VBS36sZX2h3U zBtNmDK1Gyh&)Crrkk~;AFVxYlkO}N@kNDv0H6Qqow;i)fb*^FGB0wlSx2}B_k60F= z#vUv7eGBf?gzpM#z_-%YjF~qRVR)GKDxNOr$7N2wX`uH2&c?cX5FB`yUK&Q(2k?XcxE{`7`ABRNu z)sML5{5m?7i6vX(S^pAd{Myz8F=V^EBvwCZJz-~fB%I32U zspCFKyu=PXmzuc!4Y>doKS6S`WqSEp%Y!S1bE*@eFR3|)A*WJvUaRtSB!1MBY=xpS zK4Z~zebZ%-&#<)Ig;9x)o2qRePrYWQlAY!!YgHk$iWj*td7a@Kc{@aTAcRV6)ImV1 zq0ipCUENFw4|Z{u54KG{d6`@1C*asbR_{jj(t_-KaCE#{YgM`C+Tb+rGBur%BG>xf zw?cv@WRZADmzp&?pGb%qA&bO&@Jj^&ujwS}ojgf6%0q1x2^{B7jCuHnUyxV7w83nU zB^1h%-SS;ki2MlsE)`|jBclqE$Ch7PKc&Rc{5IBp5G+bbh?wazov|53w<6P|8uc8z zlhx>{^FJ=vJh^VT8oiIcdNU~Q1LC>Vz-EUmzeQ#0?;5+PWmT3_Y*D(HL7lwvFlWoO z4Tk+bntVsd5r9ZPFFa;7zN8XC`On+%Nh<0lvo>aZI?30_@8!*Rq2!(R54=TuL4e@F z2pu8z42n?G1(EKmJz*Xdu^P`8KDV1Z@>J~^V4;)Td|m{zyk!h@W~yQ>Y}#CDBQtH_ zL#VrEzFZsE)NhyHd^!FQysV#Zq+~>@KQc9iW>ag8fsgLHbTa~D1pn?XEBHGQJ^04s z4GHpgqIG9K+G?@-Im;N$4|Cg(?qi0SD`vZ*A-m;TJPJ1t9!U0V$ zLYfED24Vvz3S5t_acnNdFhJt<9**={Ql$F+si39Jm-!&WS(CW1bCM5K>%p7Z-~Uv# z{!+il5{tTXejl|omJtQ_C&aeHPUshePv4qOPc8inJu^BZMFYpn%&+&ifJ^|>mAV9) z#W~k}CLPMV1)|PFz`DwNeISwPh8{M9!7sgn^d{~LZd(lN=2kH%!op=vyeG>0P)m2L z<=Tyx8;);Q+!O`FhOXcqZ|zI;Mf651w5A^Kzz)~@yPSFQ|GI2v!y*u)Kj={Q^6+yK zru>qMZU`8niYvHr<$P`RaG&A&sRk_y-)vAsf_q1XePG&Lf-sp|Cv!o%AZn8^8in~b zi!J*+#;+ObUo&IXJ+tmOK6kaCv-0J6od4=*xGs4*x{xHD$$U2ch}ErjWrvSzVo@6` z27H7L#jC&rknb8Gbg@>I;QUM*WMFz#CCffAnrb z?CzIiFM``A`)Y4(nBCpvVmq4jdu;P7yQ&+0OYfJW-aL^W9;UDu5pScmZ-`D7>>)jt zIb38J*f(8oa;gBavr#y)quz~rzJ!s1E~A_R@AiF1Wbp(3uf5d?THr+Q7VxYB9H-eLi`x^72%X9*%$qdLOFy=IW&)pfAhiPcnQ?J zSKHZ7G`G1Su#v2}Mut#gZXe1skk0YThgVX_2+0L!=W*xZIu0YSyO$wbnUOPtrfmQz4z9g~V2902bt+o*I_QDLP_*g-I`c|(zUpi!yu~)WznS38 z74(Q(CFs%dWQ)cM74J`!Dw8D0Wa|%qM-m_;Rz^I+pOyI`D|23bo`7c|GlB3iF(4oo zZU!(r=UGMZ@BgMnird`!Kn_ARZ|_(4N`ceLvp^*9XSY;Uw4G-`-G@2Qko#r>PTU5R z$FNT|Y%z;K{5 zt^_?-6GwU+mvlq1IL--#y(fZ3CqNc48VFb74Dq)N5?Q-|_J#qBdCws(Zeco|Nn<94zMM0B0C@&$>u0T(0kVq?570yf zmhe6QuK`g^?hSiH#>*IDt9X=&_T-z+Q0(4EHzazjwBl%`@x!`rU{lbfM zFaCmzYFuKk?>C^K^dIQRGPCH$JU(%5{?Qo(EtA;AB^Q=9l{UVLXGtAne(C z7EG_=Z+4L`l*puwL!PBKk5bs1y8)H^ZQ+{&OSJ@>O5d)Ozr$cI5Lg2y#0j*4{Tpkl za`m&~WOeUxj#Ounq`>XTS87onXz?7F{A`|tb-`nqK1*TnjG}g@bDV~G`8u9D`33E9Z18fk9jwTC2sG#43qvqe<{@6XeH%@JUAtpD z|9Sr+We(h{;c+P2a`}FLJW^3lqH6bsIR8(?<&;tYE9AlBRL{UbsLu-gt zyX($0-}9Mv9{jj>x#MDv2CNcc47)_{!o%3&D0tEQxIb*~a|OD^2z!|Cd-P@CKG^;} zi%=f-t;v2WDg}}vB~pNS7u)E|ZiOw+@*7dPf(1jGx(H5QB#>SlgIvUt^HUw7ud!Y- zYSf$DWzg}=_AyXup|1DgdF7An#ca>hOW*eotnQv7@Hz-D3?zwhu@3ou(>%&sNC5mzLbQM)#a z>luq>O)3`|SciMQ(|9;``z8Gj*7fpc=8Aht_%3lvgGL&eM#1D|VLZXq5_JR06f}}7 z&327%>CIo+f#GS4*re4t@Gfbo5&5u(#@24oT&muRk)9Y(!hdNKJ=YO)d!VbKUK~$Y z?h+G@&R6Z{VAbh70BzY^d(RJ~V&)VFO%xf=Zqx#qE&7P{)*g6VoswoYP;tHb47?G| z+OCNnOK^kCPNi40Ic&$42V!o7pd6&}}9nTgIGFCBTkl=Lbdw@lyIw5e# zF}-%UMYOarnak^ysq3$+#CNyfB!+x#vBhs@ixBXQ3l3wC zc5Kzh5_YZHO38i|Ho|=Q{!IoCjhvG7aaq2yUvmt+(w7mx#Y@n!JSR6`Agt#irkE%p zmg7K^ohY1RR$b|3QPE2j>x4IT@z|Z@dwC^RC~AY(&;(x@X!yC!H0+D{Bk8&>!StM*IMabm;^QrLk!puJiV=lvWCcS7y>!)_+CtIfV4N=I+3T>ElW zyOdk0#z0AhB|wdra99Wk{chWLM(b2|W1zoO*pZx)EvmvV*w4egezSZE-1FlUtWB|L zuGkMk8HO`+V%{NlB1DA~ZfCTc%_W@@a)&HWtJF*>?1whsIfHy7*BKN>jc0M(J$o0d znz}{%SmrQ_X(k;;A$xEbXSHpX*66h+Xz*;@gCy7- z`z7C@@Qikaq{^%SH>Ue`3TZ$i$K-=Unzrn{vg_aCeFaVtE6fhBG`KJ_lUCGM;_mye z^D*BD*%M~?<6iTI`N1L6^nlrcgMr;v^rsvr^?#)9pT$|y)|(nhrb?9TxFKY0FcTwI za@E8)JTT!svNjKBCgw-03ciD)L#J{1u*Xs=H$_+H=KsNDdhzVU5^b*(rMv6%5#~x$ zUOUgRjh6A{_^s!MJ8`jf zK`~oaoF(x~Gtn1&WpsX4MgEc+eq-tJBwtmHWB;k6#C;R#(qWckRNKvj1{R9p#5tHE zHzRUUf2~j{o)~!Z7@DNKUr?(;xwXzgHuN?9UNyf`nSqgz(6zjPb%-)MQ*=66w}00e zIu$FH-gaxLBzTBl#VJXlTVgqZT|HF^b3*nt>&SDih#;>#maPhpzwR%reImN#{o)=e zj>&+-ojZ~4soU>Yg?osj9H~e6&RW~~Eg+qd@_8G9XYe zrCxLq={JJyVjW)^gw*`~_DHiFE!+4qUZX#(HWS2jw+k*FJW{6^M8QQ)F+~j!WOh!K ztqt2hos*VJ88}CiUM{1!@Lo^6LM6zPqFmEM0+6qz)k4z7o!OqCB%W1MPo@a-Kt~*{ zNtm?HeY^7_jkkDerbu>OML|J0WmGepZVRD%h#mVBQu@_tq!+vjY$*!73M0sa@}5ry zT5(?TfmKu&J6Ta7rAtme;#gF3}g3PRv+kKdF#350m(d4nX6~) zKk{TSOmJ7%AnjZE$d;|OCq?_#P~dU5Cl{$6e<=yQafV#4ZUh{l>6J&8{_7H92|1?~ zrARN1c!?EYJTnev#D$9%?>BxDheWQYIAI|*Zjk*FdUVI)42lwHdWS-oGxNykk+v-C z(1K`D0tR3()hsICSBKK%XM2Wus8PhSePxGUP-r*>3p>RF3|fHiVxt+gVPDw`{z}%O zf1xl~beVvqRrO$!a#dP@<7O_sfsh3L;(;WPaXNJsph{@~Ndy#OL>>~05>oK5waDTo zW_R=e{J8E~_>)r#-?%evOC}}jpM{h?Z@fSA?8$DwFt^XW4u=QRRQOUCqef}#bfUiCp>$>u-4X4#Q#jpyROOvdQ`cSPc9nVu*9yb_}#gM+p8w}S5ls;?FpyPbK3PVE7~uM z<9Ji&pI_!#Sw>0bvuofra)gmSJtu}{V zg6OD2O?`Xf_2Nx*_=^bqhV{pM)7ti(e8h|gd;1VR>>`bVvszwHX$E$B1<-~l<|h)mU+)HIj>fZ+&)ex zA|7~6{LHWx-uqbrf`y`n;U4_GufADZAVQ5NjbvG&GyX8)O->!S6G%bnV3c&_LHbGx zi7r7MHPGYdUcUzRs!Lg+%+{4|zN%411f_&=|5-i?P^lmQ09eI&(!J3;4Az-WwLDZJ zDtFqB`#Z=sn<3){?H+`FDTL*=+;_k_Y1~MpE7|(`9ye!OodyNm%hdKFDX+Vm@(Q+; z1DvPbNwbj?u&L=~CNmv&w`cXJHrAnaRSbBwikg73&js*=(f9E8FXZ^=1O2jZxuwST5MghN#?T>SluM z4k(A$9fA6I>Yq+wq-!~eH>xw>Z}(|JZtMaUfPMyl7K7s**Zv!aI!F9(ad6ie-!Dzz z+Z_$+0+GQBt3ZRGyp1KI6s$5Wl)5eTHUV*1@kHfk{FD&;RC-5aZ4XBHrQqP|6<- zrOo%e4${RDAA?PFK;f$~K!Lc$3eF73jbbv~)$0|&87081N9GV9gTr?{ABrqe_MZZh z?wVeZUrjg%vc4Tzj)4S!19L!pj66ds7@l>?1L zdm;%$wPeSGU8`rpA+2o%g(*kj-$GO*STzy|0#Q^R*@2)F8D4e<$jQz{ygF`k1yQU# z0OYtpUvh^3O$U6@UttX(9QAndRR?H;Gt-O!h$Vm?pOvF#=?;btQDgFE$1d+loRyyANt)h<%4iWr|m9B@WCFv1$iWCyC# z&CB}8d!h|GwC(!-)IDkGboCwIAh3nJ0%zutnEc(S9$o%w1n<=8o!fQ8JL{38u`L$Ncmc?9Rc3!V zlXWlb>tZF;LrTPCvI}H`W;;Ov!8*G01}c1p z9gk@z!H=3B-7XTz^9=8h6IuJ^m2Dl*>tj_qin&(D2Fkv^_pSVQAcpF3}@DphFH?LtKG64LOf0q$FN~hHNoNv~I+{ng`w#ZJ_#R zPa(YP-7O%{dPH+m7;sDVOyM@5WZIu zh2g35e>y|N$n_?iyCkj=tv&M7jc3Su32-uGX%yWO?~DvpyPjKXV1@9Qj5I@U(b30R7CP1X{1IOy+PVaVEFo_m zgL7Kb5pFCC*EEglwpa^G+{F=OED~@5bHpqEAAzW$&gw-3owOVzh-5rt*f*os(B&a~ z*uZCi<;Fc8@o8L_j5wD8M|Fp3M3+pfQOmVJW6fQ*)$hrsC8|^1aa-OT{_*Gcx0WM^ zbSKkZbU$?daqGGWx0!wcgLryeztFu6f03^vU!pkDP2DRo9dKnom*93ivg~u3w|Q;M zr>(tw?3{~6hoN#_@L|oX44f=A{arGhhfaDWrkU)OzoZi2d62{ManzTZZEEvVBGDaj z)Z$w)Co)vUm%UF%&h^q!iyPI>dLC}?nic9g8yhSx1qZ=@qr_aVQdfV42%>k3)i@l{S zYJS{60sm+HMdZ!fa%>9E5g?v9hNuB&vp3K>LFXY`#sz|I#=J3?Py=+Q)1}g@ZLBqO z`;DPb(=ggO2cDl2>2k*QbpfS5ST(PrS}GUQ=-fmfz~^p-DfAeKaS}24nFazMKVHrZ zP`e%@(iT>la z&e&%HUYO3V!~y=+XlVflN3pqdG6+C`r(|;{9&>YppTxZ$(!%*Q>Z-%s> zDAlXk`Y~04HU$j>(x#zIuTB9zFkGooZ z9)$uJqy^c=b$Axo&cxCP>UZ&sN>qDdKBbO&2ln*24TVfX5rBnU>OZogRtpBDjPhbl z-Hc|wJ)$RN9}OPNy0)$%q?d$2Qlv;Mn~v-qNzuVLj(|2+1*2`L3bZs=r1>n3=%_}I zceJ{_5X(M!N#azj{MTo`Z5!(cICW^^r3KwNV&!kq)OGvS1qgM;5!2oE-b;v{)EsIO z8qdTG?ZqSIY-73ku##lXTQ64F)!5&{vc0TKa+=?WL2gMhBx+)Q$G2TCMSLb-svGdv z6fedyit=YVrACQe$jpXPhz)<&Lw2;{Rv1e)Nw)}Qaos%C081S|x#{k{u>6m5*h(RR z`SYRyr5EruzwEL!>n>+VU?rf=eeF;6c8V_}*iStowlXnm%OZS9uWJ!Jl-9D|5la>E zwA7pm-acNj%;wwz#vQ9(jm$|08rS2`nbwQu9T8(EgJVj``7LB9zl5!)c)K*tadoE%v~;{DoN# z$(t{X8bzBPfqt&m9orb?n`xoXi8ZWOF`JbOdoB}XDjOy22ve3uyVsq1=&6ErH@kW_ zQ7B+2r&=b*>BGq!)>dgJ_M>9Ds#|cl$Xb6biaH zIc1||9`Q#A?RI4Q>>XLaTeY$Z#s>0}635ngY#$#HhL$!%Q7e~d6)ttT4sb~2ywN?+ zEN>*XD?$M`;rFT|=L`Ko+kl|m<)J!Hz`cgwSonk2v*_{w_Xql~5@;-@Yz_>m)qWmI(P9bYewEwlX0!iM84sx8 zt{V;W?)EFZIb}=9#~XQ7?^lSuA|q-5aUg#N3U(Dlo89Qgp^cIKW*y(g7NX3^&0sYvBZ<-Q%h{ zfJ5^uj)h32U^(~!?dkMJ5+fGX=H~fU8*1|WnNzB5ewz4tdPV38lBzzw%ND2S8`i^h zI_z-zXRvwjN3}Uwvd11vR!Gg9&8uX7D-)i7bm>|%W0g<%!)p|ns^|gCQpbvn)92>6 zMEto4IM3vNszb$3G{F0czL4QqoC>RxP51->U2@g7xr$SW$0-Z!$s1s^JsI^~S$5L3 zWBegXcKlH_(`$ZU)MloD{7mkgsp~-1gJP$xrJVk0QgtEKClnDWnNKdPwx9aS@Ie80 zTEt#v+B+L=fGW4cW>n~=!AlV9@SRvN&e8DlJE|CnySovq*c$+$(oAc!YqM6%@;Aq|hs>hc?9E!uw)MzRx$oO^Fi`nNGo z!6(L_9u;beFL?|u6c4cVT8)r)I&G=LV?2*=xI~i;B2Wfae!q3cgHIvl4?5y6mu9*^ z4H_M=r*_DX@1|}B^CYw^oA!i)Rfn~Vnoff!*M-?B^0C=#DBVP=_ZShMt=xE#tBl-i z=!_?uz(F7_OLng#h+j`ss)3l!VuK+HraZ{a?-RU6w8mZh{u}h2Q&(1I{$o9Ns4oO+z>4G3F`8|4(X7gG0Qbv2;!)|Kr7WTx1j_d;DnjE4^cl`#t!*vyjA9RY60 zU>xp~^O|Zq-MTNR6X~-b4p{Y>xNYZ`X`;{kg!P`Dc_s!{SS@Ev!Th)z5sh-7Zm5g+ z4WlBLmLq=u!D)vXS`kq?u(;?PDI|Y-(FLUQ5ecVP-irU-K2t~%K51vZ?)oVa{dRYf zwj@cp;1Q`*f#x-Y<7Z5s*gM!zu&>=w2tJW%m~^y`zV(44JYCz~_tDtPjI<@Pwn(HO z94LGI9%?>izY+l0=`p*yh@E z{kQLaT-_r|)DS{rv=2|$eI}&)#O$byT=-tTD5E>1yB(kfIX`c>tTP{rhM5U2pm{sO zZ@pcySYcCq<6+%>J!QZ|o$y>NQjGPRk-iu1B3X;puK>4bh)&$B*yuPeu9h`To1HHE z&Z3Zn3Wa@f1O=o9opCyW3shmUTSo3)7IN##s!*c=`wZ5dvwPy_mewdv!2PNKcg>89 z1r^Yw=bB$X=qRpDkzB!GvOyR*{q|k(2QbSOo@t<*&(!PSAvK({D+=-Z2YmZiLxZORnz>(#diXU6}WHkVoaa(`VH$YQg~I7qkJ&kVXjWuIeYO}=&o(q#5QM> z;ewk|RRu`HN{A^yxZwZL!}le)G6c($KLL1zqyGn=3CRO7g@3gG@Lfg!AD$DoxVQgt z^c{!g#0uA5E~m?G?909VYg35Zjo1hCa(YE8QoY=bz@km|fe7;##Llw4g!pjV=I;5Q zq3sqc0X*Qq)dk@1cwR_f#6_xmu6KO` z>$IGSrymU|&@KcE0NmF5o=Q-X2aNlcVB>~{7j)P3?fJmwV@z1nIXtOZ~q_UpJ5xX0Z}=+ zK~UX7*(DcgazPXAw->u}n3L)mE|4bIovz^JX89T14|`Fx6-V4}F>-4RbPcVVED5 zzHQ8E08@M5^E&6Is~CLQiY{Vah35tHh3w{17#HH4$PSb$f&dQQg+=wZtFAg z_=p(k(B=xVybnNAa<%CEmfJSR7AC6BM;H7x{b)v~N5|tM9+OUo7C-&gQt;aOuOrSN zVptC^Mpd&6mj93!`pZw$f~2_qt7~o#r@Ksv-M1{`Q%sbqO1Q5#>*B83)9p9X<$iU# zVl^oI?=-H!7Va~bwht6ZV(Zuc_9p#MfaT^)u^~00zkm2S?>?3n9=v5`Vdu{O{WEnq z4MU!H$$Sv#_nq=xTmGOuO)jrPtGXYQ<>NG6?i#x0aUSNpc;Dqbl?%ooK7fK zWJM)_vb?KEbqP4TArJ)I4{INB!;rIYm3~S)kBuXSHM44fPLm} z@UGsd#u1TJ(I`;wX-Zdj2_bLM+hdCeB_|hFtWc@@*f0gioOJl>QBM?DWU;Pal9+kQqy&iUy!whq=@mOM9C z^M2;@==<<5-ZYha2uxg;qK$Jz};o&G@&KfvGTMmnKa z>+Vm0r>k!3=>0Yar?~%+#gTRs>73`NUNiYDgqTbSC+*!pp0dbYVG6hqT4Z;fY0~is zLg{U~fpMa^*j03$ZhsQLLi)f2t!iyHCV^?-LF!)RUc+Hr0FsENd6EK<`-sFWPe!jF zbUp(Y{0D-uE=HNzKaL;*GtINxKN&=I{k^a==LSsp@6gd>_1H~P=k2T zhpc?op_kc>cEEkG)r$fDIC=lk>%Q;7HjoD@v63a?F}iPn<&Zc_JBPAx4*;7bt|K3s z5s;};bM`}}o4Pah;B4yQR#5>*j~+LbXda5F^>gNSFurMl0ge6E0!#1CWyLqZh^V4G z#s&1%i8=PO0WbB~lcr-&W^DD~K|PB;R-M5Hm)hkQZek8ROSYl@U4rasxO0~=PphLnHZnsQ=rW->&{Oe^)sh7SeJR-Gc8&{WyoTCHFgN)eEY_QZ5=Jk zj!l7%I$2Ao)pr%4d0syOkDWGkhQ4o{z@Zk8Yrbc>xHD2JN$cpEESA*PkE35%4FeCg-x^+(9d`#LQNRZadh#1!$oHZr0{Mg3AZBWFTftnrxPthxzMmleWhiErP%LFOoS za{afZ+~1s;TLUkI1eW2#Sc^`hM<0;&tg%1?b9v;S-^lecp4v$AkY!{75n7^32_=7A z&W!4=rs3P#F+$K4u15Am(!oW~aVD~txWgbzD7EU!9lrxHnJ*gM^oL3cZn#B!i@)UNp0MJ{XT^77#p zHLZk7L4aY)q<)3Wi*&t9gGu7jOIjV>^0)Vi9qy5rx}K8P%V_7>^r?0&S)-L!xOUuK zsr1>Eft`iBT~Hp{&j8=1D53I}BaFGbIkA{3cG2>0Bu)*X3_V9Jrb|l(rxme5ef9Z` z%_LByUjY8>@)PBIxD_f5~_dW4MEB^lC;seWG@$ZTf*gC z#@QLJ{`HGAD7pd>ybKTV%h1EUybr@)WTe}$=%Ai@kadKFFk1?~i=-k@BmsbFn_l;I5^gMD%1b4*D zTeOUGzTf`-e*aZC?RcIyYV8(b^`mw!A(QOTGZjEo!WlkOy;MMoy$cs_G zzTFbL%E^9&Ql$g=NCfPN9}RWA;Gf$QJrMVIDVF}cF)tzF&T~rOMNj-=c7n2B`(4rg zp+8kIXo2`*!3v~RV?kXxLwk%A&gbtI^P$+h zg009w`1j{OzpHwFHr)8TQ0pRqmuaCw9^mge5&Riayb6kfD@e3(9%^qI<0hqRdRb7l z5E9E=LB%#3i>D*$QR4-&gBz5qdvm>m0?RfC>v_pFN^OiP(Ws<}2#BrH*ED=m3pfkN z!2@^uvzB{)s0jkHC4N8Abk^o<07W(h2~wa@(NLfU(BRP!=J%$;tzgrhk8u5DL%e+czzqn~ub>*U(gQ2? z56Dfb_$Vu<9fX_}zd;cFr|OXg)r0DDGpfI{bL?|y8*imWi(T@;+F9GD;f%dbtVtrwh;aaX~{e?99?pwGUhI$q?{UlfIOZOVRQ`@hvukHYFAw#Kyz&|bKTuHo_Rb>J>Rew9Q19)a*7=~*pyLPcset;i(#737t|qX_ zRHH7QeWdpr{s>x8EK; zvyK9eVgfP<4fc}N+|S9p8XqCg@n0DFQ5$k4e8PbbGTn?I%Xd!i_Me_4ZnfIFQeH0o z?q;~8z&rQ5_sdUexOeZy%l_(Lf|+8$4leIwc&$sBSJ$XSMtq=|ukq1_W2XkHz6YO& z6+#6gET?`!n#AD&M_h9$dy{^)lpyXq49811t5J6K9?d!b%jEvv?x^VTMtz!_Pwt+Hnn~HLk|Gi3o=helbI~fZG_vnAZ z-!&~WWp#*5h;Z%m0d!Eq?0wwOpGPlBxA-p%2qfim3Di!l^wZWg}B_5BwZJl^R@=;D5(>^=(A#K?hzHoxbkysBve2y8p12^@Q>&K@KonO zfmNn+A^LeF)e{MG(6fkRfbQ`PK~Vg@7?OyCMsnswHcEeCp(vU2x8(6 z!LoGWT)ex7v~jXB!kKlUA#U>lTZJ1PSx4$}FMy5q()6GI6vq?Ke*xdjpC3fY(9KIs zU!2Yw{_%aS4!2#9#e$M2wNz>*6F1PU115X+OVY*TXwP~{(0Frxe}diHs1GS7h0E$# zVZko2(P!w0(OC-O{1WizS^cnf)Y?VbsXip1%TLgQ24%V8syjva67!EGZY{r7vS5>A zgaZpTiO^@OBgXD4kp*;*+ms*Roy{4NPT{zp#fk2}G@K>a)Puwb@M{<`!E=6(kwtd< zN^J9Dp{G{u*R*If+7P2rx&?s9BFPuNeC$S>qZ3;RqBM1cqJ5qXL*Vl^JlG>(mL#Qg ze}B!V&buN#Po`-lsZ%>wCc0ko6TxYzV@H_6VCM|NMR5b7!i*3Sg>tbaJXp%9&7$ky z79a~&O^RItZ%MMfLAd#b%v1;9Q3@lr5PFd)>rU7Td;PgtTS$|^Xa0y*yrx2v}A;m zQBKh^-;`~$a~@I#qfZw7QS!13=neolkq)V$J)%f53cbIEwE}WQpbL8DC}PFI*fz%L zuREyuo>j3pVgmcBSH035AwunDM@iwfLL)d zKE0ryQ*_a%)5wMJh!Evsqir8`cpVFPZUEFPgo1$BK~(Guu9rNBy`Qa`i{k}L2VIwt z$OxyUl8E@?SpAw*#NY?8PGc};;cGP+sa&WiOz>s@&lh*tw$fe~@mES;_E7Mg;wD2D zN`fAo*_LO1ZT~}T9o*VHK74S2DRTNX_Bnkh_gN?V*sF3hb~aH>w8~~@Z9+q3>;l!? zwVtz&9$wRMNtuV4m=ndj5cXC|P8F`(64C$QYGJe;!B<*Ca3I~s1w8^_3P z5&iD9cwAM6-r5qwy;dxgrvc|)k<0qFnVcQH#hfEFmrsCfoGick28PeqW!>P&y=4S0 zUiE{%O5RM4e_(03^%qxo_&)E4Q`!|BoNeTpO~k5F=sJbk#N?P5%wRRjiqbwW329xI zEr$V9NfXx^7=z*Oihqb?vkhD?;20es9YolZCOx9V>xJje@AhUGUOr!V;dmV5&{RVy z$0BmtU>?5sCp*k2NmlzE1vq-9?HJK{>9#SBvE>p^B}cG_0-TcMXnfa2cti(0G0WBO z7QX;_H%c**@(28B3KM&vNUN}p~ znr7*)7RM0l+#btO_k|z~|EHRj);4+O@ege-T+>Ja(`a?P7>W;&_B)rhonxAZa&U?j zkD9ecmfcnSu>yLy$!GVjlcf0=r5RUAZF2whJY(ex z6QV~Vmi?B0=B%xJO6Ny$0t^q|I}lE+ZelA@hzkgE=;B0IN^-JyVnE59h?LfAu*~kd z5+%%$3(q|SED80b8L*ryTn!mj-WJP<$=)(7sAZ~Uj$SlCN%k%1aKj7_-yTUh=5gzb zBmRX4aCM^baov69WiYIBlD07v0+I&G@A^yW6E)S{Y+jCfO|y2j2d=! zSasY#>?y5_uW_jh9mq4i><3;$S_Ta(I$lt`G<<2Yx6<8I#i_7Q)KV%su9c$MO#3aYeo|G0 zGxO0sAkS@3FXdckfXsqalFQUNl3T2?&!$TXs-T;TE&_`cgn*lW^3Dow~ z?nO&xk^N&Q&@6ctzpCQW_yEv^;-Jy2-&^i7MG{vUPC4i{q+ppg9E+=JzP>}#@5}s1 z=*QOrh^>bp5NO9A$BZ3BOY9z9W%PDZ0zY^ieEIb^DC@k;r{0dmf&O9o&T*nx$zw(8GO|~CY@_@lyvA72~Tir`Y zO6yDWVKp=V3tj{Dc`MRdc{1h#NZOZXrQPaSF?)et8KxMiL^-Z|qFRI?vFFxV7aOl26y3ss1OP z&nw;}{x(}JV96(m8^f!hV|+5!np$_ZYjS{;==pthX;ujHyctZW6zs1)keaUHeU*{g zI)rv}Y+5H@G~5_~3w6>OoyszbqMuAr{Zw0ZS!5Tf%DWZw7QQQ|WVU#&s|>9h0k%P` zI+*{AoUDQ(0k5pH(X~%a{RbFh0E~&a!FaBD_#imW?Pvd;ToKpTJ3V{55aFx-e}KFJJ17g z%Cq5p^O=wc{P%C$lQ@_Ey;Y7W@j3i+O`M4%(_x=;iH{W~>>C&NW4;=0W#z1iZA_|g zsUzXuKOc-*bp+g7i1?#}!&8tYfB>r_fm*tSPQ>Dwf$C;VdxrP3@TC?)H``6x(lzg9 zpZNLXJ8-9S)F!JOqrt`RQrf=#pfkMtTww!;PLP-o5YfAfq(_M2zTjn3PjO|3$}%+B zi5fH(G-#-z(%KW>KBtap+upa-9ya~{ulJKZMV{t2WykKm`3!v%#!Y)gKuf#X#i3FV z$VKM*)O+ypEmD$12(Zq6PdWMvY&f7?CI$?80OCZMWJK#IQoTIy2Q3lfRDqD^*)jPndp&Fy() z3(7EHIGQnA88miM#ih1pim8KV>WxjQ!+uZcG0-rpR&s(aNCAsWB(Q2uJyUXXVg^|6 zU3I#;XM)f!BPP4&*C#b9jnPjpJo)4qMaD74G0bw8BboYyVnpd_^#<_(ZeazN3j_T4jEVPc1Yrd?+L(yH zgc~hHlgnxUo4Tk`wMRmy18kg5>;%OI8LTBazRfm-(lXMy4T=}rCry1TbpJeuegRVE zG;kJ{3xSg~@o3Y>)>#_IE_?4;FSX&$pdtz^@-phnJ5v|<;W&ecO_k9Pd2O9zG*e3s zUyacx3Q6nKJTSX9zTkU5flI2meW1K5k!{<^g%DnE3dkALY|AApB&HHbcBlP0z%9Ia z1uh7{@P_l-uX3fx!BW6vOT!OI|GtYygr}iwldS1_(aJV(17KtVLIm@h&~n4OK}%Ne zsl+Mu%dnFu3f6Ex+q7n1BVa6VfnE==WXGmmwp)8*b)tqcnuq z9dt-9i#JtsVg%4_9`q35!|Gzc)s#~OhC01;M(3ZqWO?JzA_fT@K!I-mg7Ysp|9Z|p fKJfpTR>ME%-14st|6Lgi0Y873SsyDmITQOIaOdGk diff --git a/cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.svg b/cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.svg new file mode 100644 index 000000000000..8771909bfeef --- /dev/null +++ b/cmd/oidc-token-verifier/oidc-token-verifier-activity-diagram.svg @@ -0,0 +1,581 @@ + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ options.token != "" +
+
+
+
+ +
+
+
+ + + + + + + + +
+
+
+ options.token == "" +
+
+
+
+ +
+
+
+ + + + + + + + + + + + + + +
+
+
+ Create Verifier config. +
+
+
+
+ +
+
+
+ + + + + + + + +
+
+
+ token.issuer is not trusted +
+
+
+
+ +
+
+
+ + + + + + + + +
+
+
+ token.issuer is trusted +
+
+
+
+ +
+
+
+ + + + + + + + + + + +
+
+
+ token verification failed +
+
+
+
+ +
+
+
+ + + + + + + + +
+
+
+ token verification succeded +
+
+
+
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ assign AUTHORIZATION env value to options.token +
+
+
+
+ +
+
+
+ + + + + + + + + + + + + + + + + + +
+
+
+ options.token != "" +
+
+
+
+ +
+
+
+ + + + + + + + +
+
+
+ options.token == "" +
+
+
+
+ +
+
+
+ + + + + + + + + + + +
+
+
+ Create TokenProcessor with options.token and verifier config. +
+
+
+
+ +
+
+
+ + + + + + + + + + + +
+
+
+ Create OIDC provider for token issuer using oidc discovery mechanism. +
+
+
+
+ +
+
+
+ + + + + + + + + + + +
+
+
+ Create verifier for provider with verifier config. +
+
+
+
+ +
+
+
+ + + + + + + + + + + +
+
+
+ Verify token using standard oidc verification steps +
+
+
+
+ +
+
+
+ + + + + + + + + + + +
+
+
+ Check if token issuer is trusted +
+
+
+
+ +
+
+
+ + + + + + + + + + + +
+
+
+ Extract token.claims to Claims struct +
+
+
+
+ +
+
+
+ + + + + + + + + + + +
+
+
+ Check if custom claims have expected values +
+
+
+
+ +
+
+
+ + + + + + + + + + + + + + + +
+
+
+ Read token issuer from not validated token. +
+
+
+
+ +
+
+
+
+
\ No newline at end of file From d15f7796b6d35876122ed3853879a6270be5a5da Mon Sep 17 00:00:00 2001 From: Przemek Pokrywka <12400578+dekiel@users.noreply.github.com> Date: Mon, 24 Jun 2024 12:36:40 +0200 Subject: [PATCH 10/11] Apply suggestions from code review Co-authored-by: Iwona Langer --- cmd/oidc-token-verifier/README.md | 38 +++++++++++++++---------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/cmd/oidc-token-verifier/README.md b/cmd/oidc-token-verifier/README.md index 7b53bf65c810..d10c5579c783 100644 --- a/cmd/oidc-token-verifier/README.md +++ b/cmd/oidc-token-verifier/README.md @@ -3,12 +3,12 @@ The OIDC Token Verifier is a command-line tool designed to validate the OIDC token and its claim values. It is primarily used in the oci-image-builder Azure DevOps pipeline to authenticate and ensure the integrity of the token passed to the pipeline. -At present, the tool supports only the GitHub.com OIDC identity provider and the RS256 algorithm for verifying the token signature. +At present, the tool supports only the github.com OIDC identity provider and the RS256 algorithm for verifying the token signature. -## How to Use +## Usage -Run the OIDC Token Verifier passing a raw OIDC token in the `token` flag or in the `AUTHORIZATION` environment variable. -Token passed in the `token` flag will take precedence over the token passed in the `AUTHORIZATION` environment variable. +Run the OIDC Token Verifier passing a raw OIDC token in the `token` flag or in the **AUTHORIZATION** environment variable. +The token passed in the `token` flag will take precedence over the token passed in the **AUTHORIZATION** environment variable. ```bash oidc-token-verifier --token "your-oidc-token" @@ -17,30 +17,30 @@ oidc-token-verifier --token "your-oidc-token" See all available [flags](https://github.com/kyma-project/test-infra/blob/main/cmd/oidc-token-verifier/main.go#L45-L55). > [!IMPORTANT] -> If a token is issued by the trusted issuer, the tool will validate the token against it. -> If the token is valid and the claims are as expected, the tool will exit with a status code of 0. -> Otherwise, it will exit with a status code of 1. +> If the trusted issuer issues a token, the tool validates the token against it. +> If the token is valid and the claims are as expected, the tool exits with the status code of `0`. +> Otherwise, it exits with the status code of `1`. -Apart from standard OIDC token validation, the tool will validate the following claim values: +Apart from standard OIDC token validation, the tool validates the following claim values: -- `iss` - the issuer of the token -- `aud` - the audience of the token -- `job_workflow_ref` - the reference of the GitHub reusable workflow used in the calling GitHub workflow +- **iss** - the issuer of the token +- **aud** - the audience of the token +- **job_workflow_ref** - the reference of the GitHub reusable workflow used in the calling GitHub workflow > [!IMPORTANT] -> Trusted issuer and allowed workflow reference are hardcoded in the tool. +> The trusted issuer and allowed workflow reference are hardcoded in the tool. > The issuer is set to `https://token.actions.githubusercontent.com`. -> The workflow reference is set to `kyma-project/test-infra/.github/workflows/image-builder.yml@refs/heads/main` +> The workflow reference is set to `kyma-project/test-infra/.github/workflows/image-builder.yml@refs/heads/main`. > This is a temporary solution and will be replaced with a more flexible configuration in the future. > See [issue](https://github.com/kyma-project/test-infra/issues/11000) for more details. -## How it works +## How It Works - the OIDC discovery - the token and claims verification - hardcoded trusted issuer and workflow, link to issue -The OIDC Token Verifier is designed to validate provided OIDC token and its claim values and provide a status code based on the validation +The OIDC Token Verifier is designed to validate the provided OIDC token and its claim values and provide a status code based on the validation result. The tool is not expected to be used as a long-running service but rather as a command-line tool that is run on demand as part of a larger pipeline. @@ -49,11 +49,11 @@ During the token validation, the tool uses the OIDC discovery to get the public Once the token passes standard OIDC validation, the tool verifies the token claim values. The tool verifies the following claim values: -- `job_workflow_ref` - the reference of GitHub reusable workflow used in the calling GitHub workflow, - it must match the value in `Issuer.ExpectedJobWorkflowRef` field of trusted issuer. +- **job_workflow_ref** - the reference of GitHub reusable workflow used in the calling GitHub workflow; + it must match the value in the **Issuer.ExpectedJobWorkflowRef** field of the trusted issuer. -If the token is valid and all claim values are as expected, the tool will exit with a status code of 0, indicating that the token is valid. -Otherwise, it will exit with a status code of 1, indicating that the token is invalid. +If the token is valid and all claim values are as expected, the tool exits with the status code of `0`, indicating that the token is valid. +Otherwise, it exits with the status code of `1`, indicating that the token is invalid. ### Activity Diagram From c05237a347c8b3fccfe9d8bcd358222cf3420d43 Mon Sep 17 00:00:00 2001 From: dekiel Date: Mon, 24 Jun 2024 12:40:35 +0200 Subject: [PATCH 11/11] Removed notes list. --- cmd/oidc-token-verifier/README.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/cmd/oidc-token-verifier/README.md b/cmd/oidc-token-verifier/README.md index d10c5579c783..c8e1d81afb23 100644 --- a/cmd/oidc-token-verifier/README.md +++ b/cmd/oidc-token-verifier/README.md @@ -36,10 +36,6 @@ Apart from standard OIDC token validation, the tool validates the following clai ## How It Works -- the OIDC discovery -- the token and claims verification -- hardcoded trusted issuer and workflow, link to issue - The OIDC Token Verifier is designed to validate the provided OIDC token and its claim values and provide a status code based on the validation result. The tool is not expected to be used as a long-running service but rather as a command-line tool that is run on demand as part of a larger