From 26e2926f8fb286d9539d2e0f520a4d348a91fa3d Mon Sep 17 00:00:00 2001 From: <> Date: Sun, 7 Jan 2024 08:07:23 +0000 Subject: [PATCH] Deployed 8ef8a1a with MkDocs version: 1.5.3 --- .nojekyll | 0 404.html | 212 ++ CNAME | 1 + archive/index.html | 232 +++ assets/grub_ex.png | Bin 0 -> 295848 bytes assets/grub_ex_fedora.png | Bin 0 -> 292788 bytes assets/logo.png | Bin 0 -> 20019 bytes assets/proton.png | Bin 0 -> 58578 bytes assets/silent_hill.png | Bin 0 -> 61184 bytes assets/silent_hill_16.png | Bin 0 -> 21393 bytes assets/silent_hill_32.png | Bin 0 -> 81074 bytes assets/statusline.png | Bin 0 -> 3731 bytes css/base.css | 270 +++ css/bootstrap.min.css | 12 + css/font-awesome.min.css | 4 + el/builds/index.html | 237 +++ el/freeipa/index.html | 2934 ++++++++++++++++++++++++++ el/index.html | 230 ++ el/nat/index.html | 318 +++ el/openldap/index.html | 1398 +++++++++++++ el/pxeboot/index.html | 839 ++++++++ el/sysadmin/index.html | 673 ++++++ el/unbound/index.html | 302 +++ fonts/fontawesome-webfont.eot | Bin 0 -> 165742 bytes fonts/fontawesome-webfont.svg | 2671 ++++++++++++++++++++++++ fonts/fontawesome-webfont.ttf | Bin 0 -> 165548 bytes fonts/fontawesome-webfont.woff | Bin 0 -> 98024 bytes fonts/fontawesome-webfont.woff2 | Bin 0 -> 77160 bytes img/favicon.ico | Bin 0 -> 1150 bytes img/grid.png | Bin 0 -> 1458 bytes index.html | 254 +++ js/base.js | 283 +++ js/bootstrap.min.js | 7 + js/jquery-3.6.0.min.js | 2 + search/lunr.js | 3475 +++++++++++++++++++++++++++++++ search/main.js | 109 + search/search_index.json | 1 + search/worker.js | 133 ++ sitemap.xml | 58 + sitemap.xml.gz | Bin 0 -> 288 bytes training/ex362/index.html | 1202 +++++++++++ 41 files changed, 15857 insertions(+) create mode 100644 .nojekyll create mode 100644 404.html create mode 100644 CNAME create mode 100644 archive/index.html create mode 100644 assets/grub_ex.png create mode 100644 assets/grub_ex_fedora.png create mode 100644 assets/logo.png create mode 100644 assets/proton.png create mode 100644 assets/silent_hill.png create mode 100644 assets/silent_hill_16.png create mode 100644 assets/silent_hill_32.png create mode 100644 assets/statusline.png create mode 100644 css/base.css create mode 100644 css/bootstrap.min.css create mode 100644 css/font-awesome.min.css create mode 100644 el/builds/index.html create mode 100644 el/freeipa/index.html create mode 100644 el/index.html create mode 100644 el/nat/index.html create mode 100644 el/openldap/index.html create mode 100644 el/pxeboot/index.html create mode 100644 el/sysadmin/index.html create mode 100644 el/unbound/index.html create mode 100644 fonts/fontawesome-webfont.eot create mode 100644 fonts/fontawesome-webfont.svg create mode 100644 fonts/fontawesome-webfont.ttf create mode 100644 fonts/fontawesome-webfont.woff create mode 100644 fonts/fontawesome-webfont.woff2 create mode 100644 img/favicon.ico create mode 100644 img/grid.png create mode 100644 index.html create mode 100644 js/base.js create mode 100644 js/bootstrap.min.js create mode 100644 js/jquery-3.6.0.min.js create mode 100644 search/lunr.js create mode 100644 search/main.js create mode 100644 search/search_index.json create mode 100644 search/worker.js create mode 100644 sitemap.xml create mode 100644 sitemap.xml.gz create mode 100644 training/ex362/index.html diff --git a/.nojekyll b/.nojekyll new file mode 100644 index 00000000..e69de29b diff --git a/404.html b/404.html new file mode 100644 index 00000000..a87f141f --- /dev/null +++ b/404.html @@ -0,0 +1,212 @@ + + + + + + + + + + + Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+ +
+
+

404

+

Page not found

+
+
+ + +
+
+ + + + + + + + + + + + diff --git a/CNAME b/CNAME new file mode 100644 index 00000000..8d0ac555 --- /dev/null +++ b/CNAME @@ -0,0 +1 @@ +linuxguideandhints.com diff --git a/archive/index.html b/archive/index.html new file mode 100644 index 00000000..1a9dfa19 --- /dev/null +++ b/archive/index.html @@ -0,0 +1,232 @@ + + + + + + + + + + + Archives - Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

This section is for archives. Most of these pages were created by one of our late +contributors and have not been updated since his passing. As such, we have moved +most of them here as clean up.

+
+
+ + + + + + + + + + + + diff --git a/assets/grub_ex.png b/assets/grub_ex.png new file mode 100644 index 0000000000000000000000000000000000000000..c83381e931aaa99d4dd0fc94333dc1c6367ceff8 GIT binary patch literal 295848 zcmY(rc{r5qA2xo?7-nqEAX{XNy$I!ririx>9Ty^<2W$dx)Uf-|-0L*&z z`vcb$U$z4P^oF0e$NI#rV~UJN7Ji4XsD@-~-&=KX!|t$qx^L!aQh;Bc7v7WzmJ&|< z9kXN*esZL>1sxkYZ1-qx@7FyhTB4YZMbn#jY6f7=_9z)Pr!+qq2UKU8ySmc-f`HOB4)G@{$F^>b#?Z;m`cqL}7nIR;~^Y`?=y6YxAW9 zop9>lE9#3x;Yh@6MxEdW(X6rQVI3aXIkcNSDw#jowzQUC;Zk>1^6$x8JaOEYgatgg z!kCvGHMOm5wMxom$T00N4_Wtb0`dv_1;wNva;#XG`%9k3?i2Sz5O)t777Tt8>7v5C zTLT%WlnEc=uo;3eA9Q8fGphWZL`W;-rN^bXK|i*Z@K$&oYpuVB-(c@ z0el?b=luO^0N3`-b?=Rs@;Rn*wR~V58=2W`3$=*aWVl_7_$}e zMtAn8ORlaW(H~ zBLO~VhPvW7diW_Evklz}CXT3q!z0vmx&9K3C2F7_WoS({X@J2^mSFEb7Y{BD?DPbA z>CnWCL0Y#a2qxv-Nb%M^aydgze1H1sJRq*o4`h3p!I@dLYM^9IHmtG;j;6d3I9$E} zIMFN#PHa1GYEsA+jAfwf98lco-=v9($CFgF7vJ*x>Cdnizm1U)JsVQB6IZ3Jtw`ING#e{j=85$&Uqh0M-xTA2I!q57sT@T3bm@_G_KI+lOmZ*!VlqVVShfC0C4JT zPi1gk;R7fKgSqExsmkC~AxyEwjcef_;5hG2SjbaP!XC}?#w;*EGzvzH0_5g42Ff6b z#tGa&0tI=tsnoTyPfNDObQwG{OigOWasDAqh*qqR^>+0xDl36XnwJy7zCHr@xG{%c zmbBEbd4_pdQjGxzZDdx^tb-@j_3>X`G%QL z<&eSi-8zMjEadH*aFzeXW_OwzV5%ZP^0ZpDfz=8Uoq$^m416I!B-5IooS2W!0hLqM z-`6s&S&BO(U_&5D;$zU`wZv6Y*Sh$)UuR?~6KNY8qd}#)@T?tT_;>G?igqLsG)@qbwo*KFxlKhr=Pu|JVWnWo$th;N z9G2#JY}T9FqQCdji9EP?G_CU{iD8SNpFXv^{686#stvF7gHMd`5}nn6S|TAbSjt*o zIn3q=`8c|kVy=A+IuDf5uu_ag$qi6mJ@vde){G?ne#>Gg?|}AncAogY{q@mbwfV48 z4eEA@txs4laLIyRZ3A=~r`^u|divIfQM0_j8D!u&4edGse5O@(@qc;3DmwBlhi8LI zaY%MMiLn;Wa#HA-mKB42CVsDlOa%Ll~g@=Mz>0hsl?Bln#uj7O6L%VhZdixgF=V|wjk;e;={HQuj&aWPXw|_77tkr(|!eLi?_{n`a8BM z`9RxVJ0! zo&)q|xG)#bTq8dz&kY(Ruivb47tDFetsF2~TXY-8%zDxWySYaW)Mi6o+pk)pB)y}} z(0yKEF6Yo{VS*Pk58gD+Tbuqod%k--r^%@*1V>+P^{h_9h$&w9H+%g`ZhuHV%W?s6+cSXW^KelsV~gSm9z6HWAxQV`>17E)E!|rTiVzi~nFUun^cOti$5*%oYl# zjreQ#b2CLY30K-28!Fyct8d&l4}g$nHW4J%pg9Bjq4M3!7rc5baIAy2Q<6x=%hf0; zvAfdyGdBRYo24Y!N*UOHGXKHdv8zsxO760JE0Xy}OD=wXK{_&CjQE^C7|4~!n$Fy@ z%K#7EI;ymp{15I+0sYearmpP;DFkn~#}$hL$384H_$JCbqV&yPwh*Zr=5J%qeV?24 zduZ9|u{8GRq644SfHx;VVE@qwb;RWFuUNTo&rdZuAxlBC5Vem%<5hvL)K%i*KA3~j z^C#_o-D*zRSw0^%4cBS%xr?iu;*GpW2TL}VuzhrX=gcaw_wfec-8EDE!U2t4>v9o9 z29Bz4b^reEf#r|bo7mxsvtGSWTID(ml**N8f_6UvJF>ujgjzXFJpUtiQRd^U#ZijE zO^XSf&>T52Pxu}#nm_G)`W!92TOGIeg_&GU4d;B#STn!0MT~VVo;g1_sgt(bp>|cvTu?*)}_Q*w=Oa; zA7*(mjb20lcg}>cEKnC^P+X2roGB8VzUIYzbpe@0L#r_TDvIlTA|-5x$4x@`j37e|m*_SNFk6tr&|wElFcCJnvc1AW{aJnQU`=sP`$UqF zbsL;kBz5ZM6Q|SuG?~|Txi6HM)oR5mU_L>7nIhM+LN*{j7Q+;YL*y-nd0SmcE1VjO z?gq>pbfO2MNzG3;Koi(}b-0?mV|z#Ef)S|M6V@}j{&eG0lhMIvPy4-qHhiy3_~u1{&5yj_T`gsO3Rk8KQbRvo0HC%30P%^GBq4QT zKe|ebzr^KJZW26`R;>n}T+YaJa{H({r^=;v%V*ZhU+V!jCA)`RRcB1XiutLz%Sqr# z`F)MZPuw?8d}d23aNsm`KA|}ZE7)P`YUU|}Ve?b`ILU_a%F;QZl6C2&fXbEXCz(ZX5E4V&S|0;&zZ-xo43 zW$4WlM+ej$UKc?J12hix(i1)bY#6N|;R1dSgL88M^Y#XCo6&9m>etDM*d?GWI1taz z>tm?`Pb9$$n3giKJ0U;#X1KCr0lF4|vTfar-Rk%8%;)z5PjW@*Z~wMn+Gy6<#&fgn#%=yB(4yUQT8 z>~Qh>*f6%W0q?b2!`7F0Xg;fn;Z;V}{SWQiZJk3Kx^v&Gfwc>JGqtlEot4^u!+fy{ zGk8YX{U@rcbMVX|mgLqa)SkdO#VA70f1w5`fuB4-M9Vq`h1!kKRI>q55&VY4xK{Kn zY2bi49uR5tt(tVth}THN-+&CtuVf*}e5Qre+zbp1B{@D+GyTx!d?VbxA|-pm_OKGu zLR5pJGn6>tUf`{Z9~>0>Jq)4!tQ(HVAKtVL!(@?eHM_eg;84yfrNXs5^Y>%06)(2y zW+v)LSW=?~v{P;*vOKoB(kYZ{$G<;sIxQzICfImzo>D-mdvyD+7s&SVT5V1n;_ooo zRotMk?@n3l2@?og&stW74a}M`@>G=l2U@oaIwul@UX80;H@q+}h2E(mT3Voc+EwC! z1I}Q5HS6VRWT7jMKFEta6pkGp`_=um2?*=6g16IxZR~XD2RhaW2WU%Aq)81f?HU!k z4{rT_Sqb#dcEmH!zm6}xif3M@aAXm9=A{talc}aEiez(lxH5Cda~;`t>c!R4{%bSg zb6?_^CsXp#+~a*+&KMBOgH1(B&Bxe2#DRhjj7WYG;up%70-B9GOK#EnKD>sgn#CpA!oOP$P7qjyW4;;ckWEuR>UP+uD|RW z^`$oXcJ6+onniPNspD3;);dLGr8Jq^B(>ar8*-LShM{)IDK(%$Qk2V^?%>N! z%7m~PA@hd9Cwc1K#>y*{1IjJQO>13kbE|$XUKPH;Uxa_l{brAzR|E=8yh)Tr4)fx4 z%bZ$xnxLarJE%pr+~7XmH#%SzsJ&cTmoGE>71^y)=o~z%{_x+j&!^>S_MrI~ckgr6 zEeH+SE<(>wa}Ns1zRf<7wNypm;qd1-KmSCogO3a=!guMs>^Esox~?DgP{TFm;?KLe zIH46s0q9K3L#tmQ`$%t8z&jbPlH*b+z3%97k3gqJXaa%B+mriOsLB^awl9lvNJr)z zPKToYFDT-md~V+?u!_Xo|Dj*2leKF{gcgn&&Q)SQc9xJSzzyBvfPi}RrAVXw;*d_; zPg;-NNa9K!=O4v$UXSxHnOifB9`>=Kl$8ZIEXB8<1V6FiKgg{e(By0C!~MU~&*w&7 z;~GD#dNyBrJAA>dB#D|$eMFlX;FQDKBDxw1KJgq|cx0eqDQovyj&hqffFGB$n5IG7 zsp${MesPZOt%U>E8SyjlgDGey9#|@HS&G?KUxMYkT2L))NDn9+ojF6wBNxkd?=b#$ z+->EX2R!o~2;cc{Uhvi4h4Vn-%z=k$VA0k@4FOSN;yIezI@EVf5Q=2bfIqB;59q$- z$+VmB3Wio52dC$fLzH%g^*2u+zTd#mJGGAwK-6N8(H}Fn3B0Pq)pC;>bPLqKb!BUBLJo)@2A1v);lq9*r;Rok?irpIe!Iv z-Zw^CCnHmtXtKz`niyNU_ZiP9Y3zupVFM3rEKeL2sIm(mUN7dbZgmI|~D+kCYz`uhYMN zNs%GfpSg;XLkGCpiq#W_b3wy=ptFw>d>@~hQ6GXU)Kn}1&EK|s9l;L4O0=pc>J?-> znVl-03R9ShEKe69X>-6131kT5lr}|M4HAYtzW@gfGm3U^#Qha-U?VPPQ^c1(<;&jT zI8f;Z&}Eh`pY6QzL{r7cor<^3@GRhcK@IpKL*g6C;H)+X$N*&y^pc-X|8~vN0C?K8 zle`73N{!m0#9JN7)_R|N;txO}2NoSDkZa|fHzzq}or@w$<}3xk4D21;)N2lUPr>T@Kw0A~b_l|WCvYB5jc z)U+u00f>h$`)u?|?3@4u7YA`da1)J;u$dKM=2BPEJ~(D@e83>OZa#CPnoU)1kZI$Q zza&jDNuKhQbEw(CA^`k^(HHg|Ri=Avhtvz%b={o+Y6%gosGZ&S>%t`3FwX^P zt6y!_?+cp_hi{L&RJD#5s!MrEe__u%S!IoCfwA#HtYfQ5W99og3Watt zl0>58IQ>yz7M?j^Nd)W#gAuAv^{Y)fBYFuX3!LVV|2oF)WYJov0&6+}yyPQ~7ZAk% zo={i?LE3*fTDMuWuYR>YWq?z)jJo^Voas&Tf9FN!ZgVfK0Qf!99nABcve`wB@8VbMT&P(%8Ffg(@jP;AiqqGJ=13PoW80cOPYS7CJO+k2F1!NXTr9$l$DoY{Wu44 zTeHXO;9ZQx=3pa+?#2te3!Ei9b@0d#wF1n%v?Z}69lWdvn?w3PScR}Y+%CsX2S%fegsvtC03&P1CZ6t#ihsH^X;ASf4aOaQ$H5I^Mk4KyHsa`Uz@jJb_{v*y9vEclIY-4{j4n)j~8 zDnX_}-<6oN@iyDoE_G@cNoP8elHsHX?O#p_3c6%C=ZC}lXZQLULtW=Kby7arJmOAY)}ZXI9uxCQN{b_&rvxHgwP5sKq@-3OfN zB)$FC>7RF|v;3+n1{OZsZIP%9baDw}Ef~tBO<5pY^+qnNm1x9)y#|E87Ik!Xd{f&0 zd;K#>UVvAGPI=VG*_S6zr08b4=X)|^KQ_83jIz-6fWBVB(gd?_xW`B=E#7O>M6?&zlYkgUH@ntsxXL9m47%d=GST#XER=zw?NIETRlE+Rp4^O2j+HMUqf;q z9Zk8B)Slu^DpmrK+mSLHr(-^ou9|%Fhxw?J-8cyxOHu(PISRdINaIhtXvZB{v*`0R zspXmqP+UD9r6H;h&WZBJ&nRK9j?9r3U`HVaXa0WYy_f#MN)+i?9=LkdxuICHvM)%n_ z4|2<9W<}Tv=5AGvtmY{LO0q5>lm!;LE5_h_1l#m2QyLcF=onWLa5Etd&}N))V1mLK z-juCSb)3~;T+;uK#rpPi>vVF!z>Ia^k8%r4NV=q3l>ZD;T-3b=Wc-yvYDFMy9CgA857k z^)Z?BDIr3e}?@sEOu6GYJ1n~1QR;j4-Y z9EYSMOftU#pD+gU39}Dj%~#BR1IEvg4;0Fjh|AZV;=ppi)T$fp5lT6m@nHE+hs2!{;_tZlgy&D*{}=a! zmsoi1dBPr}A+K?qYF+L+srTkRXF`DQkJ$8be+t-QgvZMJPzJiZp!wUvV}17PUiZ7d z&|uNz=9@0?n{mtx5N9MqQF+v#N&K3Yhu;2#CfhSFH^nf*CNd&FQd0^iVk?&o4CI3? zGRe17+;|-45(!&+COXbF3en^77Yl6#tk(_lYin^FeYi4fDhN^EFd>Tk5?hut$F zYJv~NWX8JnrO;&b&sR7mgi`mr8v&+~C(|B~%n0INdI0F}wfwf$s=2-*NMT&JvgAI- zQ5C0y;Hlh95V;Y_S<`d2k4ukgIG~tzQ%6+SgW_T84gry*Q>ljAo>Bp@$?N4SzgH;e zXoeDf1>`%KJXNE2?7RFMkuXo(@$aFhf%&j57&rna@9#|mkuHS1`umw+;2#o@gv0|< z0S2rTh9Bx^>HY3r7+=HOIBaPP{!5<0RE*mKJ$Dy1wwiuFWJPtFAt~8V%KR0$2Db0= z9!S;>-fJy%=6Tsk$PySit_^BK@JvzLbM!b?H4_WY{9`#IVp`OFDPsU4p!_tKB=`8C2qUkJ0ypEiFfi61-aK zJf{x{7n7#e;W%G}C~jl{_&f#|A!nG6l+ z1gC5O%n?O2rWF>tU+f19{r~t^|%Zn-MGRJ&dEjt7vAorDU=x$(Q-c z;71M+se>3VX6NAt@`%=F^l8oYveS7-Wy96>q@Bu)Q+X)!7(s?I5M1@2Q048C5WhRk zw>F)zAN3oEie`58?rW~?S|Q`AC0;%?eKHdFZ3D6nBdwTmN*qja9`{lKv6On&J_-8r zq;*6?C+sGIXy1xk>yBYWpYz}C#jV&nv3(;oZhN~O+DDBuS_s)rW75_p@#YB>LYXo9oyv;=nC{(I^2Xj%hA`py1kP0=i-=Gr05(cw^!0)`c)hK^m&$<-}HXz0R~ z=3l#-<%?681q_uMlr|NhcThWF&pTuCK;7Kroc(i8-P#D!-^0chUnvioO2xOcBd7_ITSKcH_Xuk@hDd5MPo+i2$kw79g7*3KfM)P>I# zp!}cgJ_n{8ztZ ze6UwwU)devO})?U>^SIY&y-`F@x!^;0TqVZqV#5H!ukJHo?G2ER*MWXv5bA_-Dj@A z4ZFpBqy1Phk%6NZC{*sc+!kF?q$I$}jLIB^M%1?^pz)yXIpS2Y1yII*6II>v+~{Py zp3LyQLBQGM#&q^j$cYb&>my1b@x_OCJsJ0!(`r&yPb4S-H(5k_QbQ2pRA$6cScb{d zFuC-77sb>@7?I9q30xMQD+O3qaz;K&H9Rhveb13Y1W&}!5MP>9e_+J^vZ3~yQ*9__ zvoS5t`(Q47`1)7GAKHNS(hVLuavWtn8gHuoQ8d2r`|yN zn`pq4lE9nO>Cn1Z{=JA3ucg=4)>ky&#a#@lKOOF@Ya!HN_wY%l=HfsGu$hdyORavm zTyYs15|YzPp}%tar~}8gruUszJfGw_VlhkTi$T-c9%jqiKqNNY+v?`)7^{FV`Gu88 z>cbEre{fCb)`jz8J>Ne+uzT|et1(*|c4zDxFl`OoI~yd1R^plet=m=$!`QoKSdE4c zk7UOR-(h4oL#2MJM-mOO;nrXP)izX~WbVT-Yn+!i?ZGN0T+*9hPe(>9B(d}`^yCIR`xAlqCKK$1BUDg&|g?d)FTNr`#MRT)&G0!I3j zKM(Ks)s}4D*}!7Hsh-lm$@&#i8z3Os53H!YF{NLd)8eAD{dAO3(`(2^m^*?BWs)bJ z2)7*x^eEZG`d3meC(Z{GRTzY5xZErxUmQWB?e0TL!*g+*sC4kLkr6*ZF8IUB%(YjD z3ed)G{%dCibX$pSrBC~Lb6i_P0$!a`0+s8qem!n9JmPvNIDY3Ws;`d z2*dmQ!~qJEYlpTwlITY~vap5j>|blFB?I1oLc`iz$Jz5P^$g9VD2pGl9d-(Kwwb)Z zwt@F@674;put(1S%C(f$yf>72&H@+$+j>(>d`tlLBNVxLK?9EoRaETw+-;&+`4d;J zJrRbUaY8ppJ+z0KN?W0r>D0Ng0+Dl>lcXd4eA7}-a1J4X)*AHSzp)4Hl$d*FP_xMc zMiN~^Diai|DB0YtP9f~*YcOoGL*3V$+R%XdA|87(>Q)10)%a}COkomuhG+F>c>>uz z4`|t+Rb#5}&9m+c`Y5R-4{}4JXmRvIztsZ>`wR6cJ^>x<`vO1+X_J_$*=+QFHMPLpU00 z_@QE=`UY#)FdNJxOX5fUrVM9+%jknFHbxelpXe3c^QhOes@-)Ay*YirbL?)w<9Y`C z2yk+ZUP7GLJp@B~=TeXidjM@I^CzbRb5gvigA zURGuR_2igGSDY>?sQKv;sfPt}Xn2dCY&Bi%p`G$N&0fJR+%0}CKmLaGO}1LnpRSh>M?r)C}C*}&K*|+zp32p z?`Ug-;SNc3_6}})Bipz&rK*o#u%eG(I85O*4Ij1^OhodZ#m*DWYdbYxn%psR>HGR|y$EXwQik}J+Kq7Oip z)3JG-T+-VR8ydWRjUAdH#|mjp8|14E?YPeu)F`YZ#`uFC%z;|D??tqbLS?VbR|6VEq~P$w4ef2vi@;)?LVbeP&5uQffi<4=>5 zpMod~+dC;=eq6E=U=+w8Yr+!k{V8?BEF}EoJPVe0#P-45Z|F}G;EJQC5SVL^&5G&S zf-6#Bp}_Qt0+|=%S&FnDx8i#^V*NB`2A&U!KcPvOE-W=%Ae$R1V+n@1D@K`rA4jCf0HOb3z;l;7W;o5g&3B|6YVX+P8=>u^jVsIHqGe%D^R@Ni!59 zzhZ{+lcOmhh(x&rq$`=(c4K#Pw4x41jUcMEUjs3Xl&WYby*$DoXR`5!Xd-1jq zimmfSXia&9E-0+?N*_zB9_Cd|o}AFftZ2<{cxD!5AVz?m{FQ=OAy?$=G0Y1wA9I!= zyx9d)X|=-yIHq{Np5RtT=0fTL$iq6DEhK-v~kHsf>o7puqb zOKeATZR*Us6wfC=mc)}ndo3=8NrSC^o-B_lf0eXO;bG`i^?!!^(go<9WR)%IG;Hmn z`?A+Hu&<>9Klz1g@(@9+#O2~@;Dh71Bprz-Aj|}IIH!u!n_}lE5nVyxEtCRwQvd+h z&{k@klW6NB9lSTT)#KK15v4P-+kiv38m$NbZ(5djIIYJFq@kaqe_$Lbm8E)4ng#~+ z1i7D(XV2kGR98q{6cO>mdemaYMC?vaCf!%+HCRH$(be$p%h|IJM6Dk$>1gsPe6-)~ z10&vx-q&@*49xsh0~;HH%GWW8a+a zy~B8Gwb1rEt}z=h*&&m2+qz>LBmQ^dI+w31*m}=y#uKnEaRr#hC~D+H#DMOA8igu5 z(vZ_F5T41!NVy0DEXS-BVml{szm+G`gHnvGpFf~s*oxpAcT)+p_vr6M^8MImJ(yi? zT@7kAJ$=R-_STzu1&SX;RV9>c!MrDO*9TMVGjJZ)Yb*g%y&I@C3Jc^=BWtN40D7{- z7u0ip0fVvmSP$HxppiaRm;y%uSvBO~_B~@CHay@&1f>{!XsY}MPV$%mFpI;?g9kr+IhS#1JECG@4 zr!NX{;b|>hPGc@ah4{}}x-K_Ma#hZ=H1_S9Oaa?JK{`U%6j=-gUH~ZtlS9U`;g=&A zb~VOdCIPw*KJrJMU-EzlhDm3uBnAbQ@?I9eZhY<_w{ptqcDQd6u~j`!l835oB!nKB z1@Ncxy_gQ0S!;v|q$2lZX3|YHGR#}s%L~WOrp@sa;X1CApc!#>3Jic=~aEM>!Fp?pO*Af9GPQ2 zq+(1mHnqU=d^w&H1ejgZeos|AD@AmY<6J^%^=-z5gDIH5WRIacE7!O4RJC2NM^}Q% zsjz{c#-yi1(>In&o35)&Cl&2q>R!B?u$%lpJlwpWTF>39uy=c8GuZ_OC9ow*|5vIm zAe(`*c+9YSYdJXlnwt09Z2^`7n`(Ejc5LknN&^r4epi>E7IL0Y3LCv*htMCWhf#mi zryD;i17){4;3+004h)?IbU%cG*@@OySz~*0^rcc4ZB|>%S|R3HgwJG-N zcR@SM2xT73hh&;7F)P}%lbp{+@@1O~b6$}2_NEo16lcK!c`{F35T?pqa2-b)D#y@ia| zqd&``7;%mGoNy&_d_svwpcLi+FT@}0{RHyPp_tMU4Bj+D;-2GkfTN!@Ef4)n;j|tp z&zF;x0OnkdN6!R@>}`pa5N)E$16rWTv(*r2!G1Oy9A&Bzs-XzA7OX$ZLjKCx%%o!m|{HiRH6se32<;ItfGRtDY|G zUE`Z{a`aW1d-`YCL1vCQ6x<=A8G-JqCz$`u1~UnraEm!{-}W`?sR?4vpPks2gv*6` zeZrl(&!Bhlpn0F~0o+KA-04QeTnJlJM*jZi=F^p=BMw8lhM>LRKBnvb;R}}sw7Lpl zAZa@9{*&4!Q|97^Aw1A#%u}={St$r-d3yFs>!J&2$_8i5US1o`BO; zpQxCe9~|NLn~1ddy7Qef@IzAcs5K%_scxMaP<&rz;I+zKYZ3pOoychz6qA;|ZG%iN zuuqUMR)6C-hUpTIWBKPfcuPEqKl|kZwy8P`AYI^lJJxqX6jXA*0nzxoJ)0uloGRDf zH*Rq?f6DC9P@QP4xRynuql;S)J#lE2Zyh_+X8Vz~wo7Z# zc%K=X6m{=^A)32PK(v}nxHRo@)!pSKdde@^*M02>)WF&%2@}~e_ zfwhFH0+<_r)8NWD3#>x{Y`D6!MVJW!rhCQ>-d~~t%FDG5ykfoM<)gQOX^R_Y586-d zD!zi!#`^4A&)3wTb#m0~>j5FzKIML6_-b^mG=X_G$lI-~ADSW#RE`p9XT_e`}We>L=f!VtLf%?h)Sc2tP*q)a24CTXd=q z)&#!t-2haQu}&O|K{@OKi7HU>z)pOP7SgW&uKh&;{01|;HnSgpS*VtG!1@@|0*!n^ zq-#rN?LHGBYZ8t}A7to~z|Pz3{E-MO#{@2K+(gvoPw@M*kKBJc45#St#=6`}g+R{E zQdlYA4Y?vOU=E@1YG69zb`2B$_qbW|6F?0b){_=4(3{SP+KXyEC13CPTCKieFqf2- zO92YcI?J%ms8d_6u8qQdc*HrzO?l$>#0Tt6FOaN6<`IJ8=32@)7MCvQj?XKvm<`{2 z(3a@v_>4;L+BHlq``MSab=)B|<;J}lp5mQS|mB}jk%QLZ7NT@L0%?CTZh(w)Z z)J3@z(-zbb?0n4=jG(LJxQ&27!l~exg$QPoDwNw&@Q(8cWn7v1K2`yGY%HEWwHxFe zW6lAg&+jTRalykCFNfLoD0jOFjp>*0WgN5Y#|ntgYfzQbcRAKa_%^>nTS zc`jW}Zop=ES;qb8P#hgwbH*NLiL3t5%D0sDk&Ha}uE-KyfkXpGip&o6h`at8DzgQp zVx2m*0b6|uwge6K0M5?e-h(Yj!f=We$WxFE0k+=sv|yUE!q9U-Aax&D#8QTHzekal za)rDTAVs$OJBD+Bcu!`Ec7kda5&)RODLI@DjIg+RFbh&nyh;rq0P^eb29%dwjXN|1 zo%z0|+fZke0$c6qZNlU+`{263J+7nFk?Yc&I9=e$%rXV_zxbcIomW~4+|%Y*2mMNW zzcCAqB7$PAqwcxYk?T#co&Oo&q)X>)>HD=VYbvvcRl&+~Zis4zDEpx_#mcqNrvDa9 z@n4Yzh-nRC;MBr?g#+m(LMXHclUyGdokUgI*m+3tC(?xNH|+j|zyw$;fhNqbt%v#F zE-5Ux@#&X5&C#-xhVr?llIy^9!g=Pl1)^8oz?y|GiIBR!!8IkKtVY0 zZzIoW-jv~k-d&flEgjD^>y8y@D#aOFzV#6s>{A3hTQjkW2v8*qwUf{N=@OdhV%~v| zRDX=*MlQ0ALG8M9_lAfT_`+wA0$^FYS~yon;?j>ai%YH;i4U4eqMP6fm;P;aQ-hjk zkerIT#8>G^4wrGyV-@^*6cSBqgHnoVUMFiFj>(^5t$@ArF?cE?Cd`#4ViZzeNUHgczY&EhN!Lok~~1KfZNiR{xAKbqVq9qik0{*^i9N|!XzS6&^rIFS#YlgGk>XDFs?uFM zFYl3;@!SLd#csba^mbp)D2^>G<6moxT+hOf+& zeQ2CncX%3F+T9ORKC&-J0;_p$Kglf{x5o{pU>A6%L(1w@#z#WX9jxmVjCh`npQ`5K zz&T$2%CUVNd*`0n5mDvx&iz$4DrQh&tcx-Q7VbomGj4}0WGjX~rIXa{w`Z8T_2XTNG4>#-2S zCmIdZzx>hVfKtzU>5m?N!mTy}-A6Vd+y^*14ZCJ2@SM`k5fiP3Mf7aM#DeeTJL4)L zzSpY}Z7A_E#w3!3do;j$R#-VKLm0Dg*<()j-B$gOV(GbPNof zLw!Y!rGVqklYj7?@fk^|zhS}(C}Mc3!d`Z$%Z0k4?#*DxCd>VJPJ-Iv#uq^a(4ZOm zKLO^}Y)gsShjUfV8xX;+_c>_dS5`f98#W2p?z})8J(KP511-o}R=WI2^K%V6o+SH5 z<2Qb*t9w|1<3!snK*1q{yPDuCL+mx=<8YO+u=2o=UlaLJpl?#q^8;Y@dP5DoC?0N~{C`YIsVoK|;7Q2=( zy4i)dg)!~;Qj_1HlOj)Mtw6F|?#0>4$QJVKFbQ;7;UY=cqYBF7HNn`H?5QxvS=W2q z@WE5M_x}HUi7Y60@t1Cpnf4f8lWJGJjmU&`fQ`hV-A+L?7myt<#e4Rz^JH>L*(Y%J z2y2dy9WO_OeBNa2R*&@2V>Ma0(9;a_G7elOnZ~WZNlD`H5fT z9fJve$yUEF?hY97FL?W}!en%o$EB4Bbsk_2>tAbH>_DT>!VFFW_^T_Hr8yrr_lqA@ z?}Kx1vJ9T9g7@>86twN>EO5+hl-#mfNF9W4VJ_Z*qpM0P8XFlKl$bZ~pF?%Q?>i-f zIsw`<()o~i*A>t3lU2@PQbV3RFcTg~!a||%g#23o7oeX3^NVRQDQV?#+?JJhm7N6+ z#iyh;622#BhSZa9W=m7W{sCjw%tDWcVYXyqzI%R-o1 z0AoG@8?6c_R7c3lVyxIwrQ;HqQ(Ma(^76fE~Bg7@YEPBUKNmvMuAY?-VdeDg$76-8^IJ%5I^ zMNsLL5%ea79-cN)b$lx1>aB06vI%IggVdo{LI+PUHk=zPy)m`hu_ht}oZ8s{U2(NE zomeJoSjo@=>m^hI=)M<`on%G?cXGVdF@H3=4eX84V_~S~%*+V~x5`SQ<`f4Pce{7)h=GmjzHf7vTE`E>}(Dg}Zo~5$l4SB_j!XvJW z*HGfLU+q&rKm831gj|0C@UlJZJ~A+|BRqL7*Dvkk2I0XebW!Y2>ajJ5WJFzf&(bg^a3 zU;(lw9APcYXL%^&j-;_g&`g(Pxnh85r7$G|VhxJJ0>sF~=*Kh_Ktosa_K|`{s3lMy znhnWdRj_PVAdd6Mhpxq-A^OOh+>yA7eAMDQxg{Z&g_1AkfD9w)mDj^ET3!L0*y84& z5@P_)S4LQ($DS13xm&nzhfQ$<%hw5+yKso>os{{YaHKbJ@*Jq2`~9%d3bE5IB@mUM z%h3aF@y__%h{b|Iu?4LUea_ksv8_sJqwhTIq@Hk`WI}%uANt#HIv92hHW*~B=p2T0V zFu^lb#D4tZ8=6KnuE1ydfc2kgo5W7$683ITJWB9!LhaBsS3U*S_qU*p`C_MFBzCJv zRE-BP0%OSC$^s;S(imw&O+fsd}v2?#938xQR@%8unGI!rh!h|!o-!fL+<5ukd0A$M#kn%=S zPP~}G*3N+X=b+eEf*Dd-G(7Xg&tgq{s#4(4i#}QvO>^;*kiC=%`GMZ~0R9S_qWfncM@a==Nac8NzCHSe&ec)S zGXPGNjkm?rF>0zQsF+xXhtJ53y8CjYSpKX*w#A8WxnX$hOCn!@qyZ-$Bw=fy8p zf;MRlRL@FvF+~lAG7L^Ois;3rH(2wcK7is82{+M-?fZM(*zvO8qxHes8*JSlId+O4 zV&=&=mj=A1%uNT*66{fog4tXbNQ^d6it`6=(!r*I_?Ky^PQnN;U^%4p|MB$Zflzk; z|Noh>FExWCDPyu0SyEJ%5tSunxhpB56zyoEFxM2K5Fv6Wqo}kI60*#MEJ>qM_Qsm5 z!&qjc*fat-*Nlom zmx%jV;HM$M>f9mL4qJk}7^N-$vsn|Og4NSoA$=Q_At>#AxI-H6S12$qn0+V>Z)xAm zh6tvAZRhMSZ#uf_Gvd1mv0XGxXtOX7$e!u$HIf3SiY0(a7^;DxrwStVhY5Nn)F%#b zg%p>3;VYaz6O^D(*;rje9*HGb7w9|PVXgmM;Ql|(robu*bxuY`I)6cXsY!j4C)xpw z(@?^UJce>zoW2v;Evf*%y3&1}sFm~7NG%WtqdX)=49eel3|)#eVMlqGAp^+45FZ#q zFB`hZ$(`K`*Jto3==wjphCz!Y9e;Rl0O zC*-CFW;3jm-bEZ#^>9b@Ek%@l(}@o5gf%Uq!Ei0~ql3V+OUn5Fxzlny&&8MwK22B)#uB7BdbUqw`SND|&x2hiQov%`eUdzYg3RIh4> zN_(CEO0LQ{@VrCVK-{`#C%gj*vX}L zXcaU~K?NZO9G9=}UOoiXNgVic{|hs6 z6^XbDi7E@!ZH9IlgKvRa5ulm2C;YJ!DdiKjJ}&~6Ym!935X16J|y$PTbD2%ZR`*-+dSau}WNB)im_xXEz1A7a zB=`jU$sDqL)iaxersY|TOBpW%o{-z7P6;$GoDbV?_G2VZ2#-WdSp#7Pgs0eBOYb0k zY^nkqH?2c?F^t*@9u>*>Mu82|)4k~4g-HEKith3z7uT zjOF^pA+Ai2{gia+o(QmUFZS7nJ19&&cuGhf599adi5IgR^LCsTG1AN|5me2TeuQjG4IheUa}9Kkgt3Bu zVZicF7Gn!tnNiWCoGylM1QlJRwXxPP2?Hcu^wu8X@@plO)piad^#uz(H1B#s)A#F_ zvzqVbnvdB}-mNFWui5@&z+&G2s*e@UzwMz1BkHw9h$0HF+Zc%1u!aETb|)0;Mf>qf zg0m3{jdm-{cmd?OfuXx z7$>2k57L+cH<+3*vD$7FcSsbuqe_lv^%S}IIuWg@6Kw?@z0(ZyMkRLxnQvy>JE=Pw z`MrniO^0AE$6-~K-s&P>|(l_=TwH9no;0WYOq^i zE-7;H;22}m3PgPELP(il?_^+9kT_@M_g)I#<~~XBfecH_o0$6{xr;Xu_V}#D4o%@T z<(sESAK!mJ#;?B56tycAquH_5J4;lgo7%G{(POmqp~P41sRnQCN6IH0t_O7eF|+sE zwDiI~9KF;=h6IKB8b$K1V%fg0MMfWGDIH?I$seTXjy$O_XdM(1j@>MHAdQ7^l`0P7 zJU4z3kz|Mv+C5a)dOYy^KFcaIaT|oR@;jpqYR#lm!;4$N-yuS_SKGC)l0ll^MOdzV zrFI+|R-hz7UvELXMA_BHo|x?XmZYALiFa*k|WK?>C73Ct~V;hvF=H!1KINcEZ__Uo38$xhwpE{cAt4y^) zKp&!|%&(jF98>;gR?69=Zh9kO-nns0p4@(+rOHf$By!b7B$OLw-L~m#VPB_t(+5q! z0rT3){*Mo7k^5sR6IXWSNnN7vzQlYrcd;-KEMQh0r7Bz`HHUybiv~oF0pG2D zUgn(m-x|huhI1n{vcRe*+9BYgM(aLVSZtDp71Hj1X7&I<4 zhRak0JzdNx83x__33c@3b?Wy3Bk(|0{9NW5;B|#`t6$;vd~3aM#7S6oeQ$=sp-fY+ko}}H)aC~{*LCtUwwQ@E;sKCGtcpIQYp_*WT7 zdZQy3ss6)CN2I}H#+6-cWym|&JCX(`tE1l2j57=|z;~wL$s=)^LSX&p8A0`m3rhUQ z)26#bnjnZgVv4rNQl``m)ugUVQwoP7v@$%(`krr!mRq#xipe}57|vnry>Oo!>Bz$! z`fi~yv+GZBEA_Dws-W_M6e)*tU`F3->mizxSD5%U1^w4H_HXh0tM4rK zkt`_Yjy(;fZLs<3_}9f+vCprs;uhq2U?v2Asyj#0Q{>qtN2_@*E3=>{bYk9pF#P+K zso|3X{3ffoI9gL-vuMlUw}`g_`)p(7b*t3XQ|+a~C3eIgpd>MO#tO9zp$w9T2a~eD z8pwNI5Io}S{bc6gX`NYjLL@Cs+aP85mji8^D|EOoDbixH45l(0?vi>usgnyn#ArlZ z0_w5x>F7Vw5J;hv<)1$sx_F_3-gB(0&V?=V+@dAo_qGuP-!I1%`y>K-Go4?5mhH)*3TqOPtB z7;u$8!iTa7w&(V|ZVa@eILukJmgf7qV(84kN$2-QHf^RV>jS%YU+aEG976Sg^qFg( z3%`?cJDSe#b2qP1y7G_wlx||&ph4#{tzVBSnPOL3)(X5Au;AVL)c@Yl!t~c^B=O+RU=yj>ax9lJzJwr&?BlSJ+-F7`v_)boP%+r)f7Fzn=Q1IJ-oO4(L=yY#R7>}`$BuQ92I`{y?OUv*usFk2u<{bA+#BpkZ+MSx=SH3-Vm(bu=@h@ z@znEp&%&Y&KgDw2G2`NLU4As7|JSJK+HsuJoYRb|GrTKj1ebJX%q77VX=r0oBHCy~ z``qY63{c%~>EZTqq@|S-sAe74rWlQvUi#ALu?@F_b_q-$;MYC7esxWI*)|ZwGrt!Y zWnr_e+1f6dQTGKglnb(=nL(2ed}JLIv`>fWC0nnPt4a>)OzR$+wV0mqsSI7Hx(6wg zVN%|@wTh4O=8Jv5m_iSe`0@Db$jn6ewt~q|5!yT$ndSd1%dv*M<+uS1dbm{3)5cI6lSpcgOh)Sq`wL$ljdcu;sQ8cL*udVKquUD+CofO3!F-9L0C;E(#?FRO{>H+cv) zBwEFY17FWosPU$#{0g-DsL0-HJ(?|h`QA_GHkU{f-4{1q+P3E#jg%N2E$A7!q%<+2 z(|Z))*@T_tDY?R|K2Ma(KgL7E0XcEkB2rxvF)0R8&}R|Q+P$9G9`a5NZ1U_lskSmA zx_8hR(D_rBr2EuF_gqO@PQNT#@0R(mNk5UsZWvhi_s4_25s*EChR^(=c5%1hxrBx8 zJpR3s|KVPKe(s{AMxe2g!AKS*S%y7_*6L0?NbN)_`6PHogUDrKr6H(XC!?>-CJLj*ZAw6mbzT94oJvUhL9jPO18DK(`iN$DB$rU{G4LSL==j72QlHNKa z_~e(A!9>En2DULJnz~~xR6vi_(71h^qSfmuV%ZbI%VI!fy3=tEEh=Wa9|@4>WZI8i^eaHVv7>_wZaO>{^3Bp0yKz; zO$)*@W<**8rUIfMV-r8|DP%mD-v;A5>Qycp{q2IMerx^IrR~7DJ`vNSsy(jwPW$WK z{)=nfMTfKssY7o_0;(-n`Bcb9a>xt9@il)M`7WA-9$GLOBJ_ER zI$>$q@|~%nE&)y|gShZrpCJdj1p~zjX)reNp{6cOZyZLh!DHxB_{xiX)$RSbs8njb zmijuz+6EI+^;CJz(OTd>KafG@NaKo-oS>;4=Pby%UcLc`(Xw{j2 z*s#dm;xHi<^zhBv6C}SSR-IFFF{T;bQqIW}m_Ba;o(NqXJgJz7y$>FFJ^xH>cY;P? zukq{eCiL|HxAwU)ycw2GJ1$#d;0J;!L9Z_EN}h|^329ySA7!=+LuCG)vBO4I>;s@E ze0TXfj5-RgEkGpUilB994Mbltxq=_bC~=+mv^`{3Z0yreGjM7_dTT1W0;-P@nq%=Y zoX2k=NvT*alwUPIH9+{{K%413f18v`>bMU}S*J8a>B{=~;s@{eexTk?5*XB03=pEW zChFO?Bzbu>P1QYWVjFhJ+eP)Ltl&wVN@U$*wfjhv^^UIusrR9sy)9rs*(pAw^J*y` z%iN?4fI}(A&5v+n+&2>+wzmxit4I-1&xPQuW*b>xyt}isZ||#=0kY9*M^c>3B~5<# z*VOIn$2pSiLQtMm8GA3cymbWdKFd&$xT);B}tV4-AMc#biG7YHnysChw2}Ng{4M(BM3h2SG-n zz(_!^Cxx5RwVtO<5RMgvuUtRD5pOTMH#&l1B)~1#@*+b1;+mFy-7Uwu0mLn7r!vv6QmKz2I9&%!?W7BQMPKJ;!Sb zR}pg>#*HKoY~HQk%%*l?DY~H?c%&SfA{21`(EvgH=rM+U2Y}U-I@b3WbEsEKu$d^@ zsmWgEw5WQfAyJll1nkCuCeqc;KyfR-8mo3iPoi zO&9yf1J%t{nwitUxBGP~2eV27d`#_QygTOKbpqO(_CabQ4Not)uPwCIN7WLzVii(9 zJ?z+t)%WIqz6q>kM$E{chyLqCHGwrS3i{03v>J?ON5_yYqj>E#6uVUPmZ_ zIbpqxU=P5fE3X*DSM)!`IuQ|P=hT87PJFA6TQ1ngiPWhBz~;VGo=1>XDdS{&TR^K$ zPS^S+9rEh4#0@^MJ|`M zB61ipgR0l5uJ|t19>bhE;Xy&C2#?&-MsA)J13}xxjgLWirR*dRiJgkwFz2*jpK9&M z4rv;gvdwpxbpAs{1%&q}1*9#7fnzrfP#X!bYfiXzN-hXc#`j7tv1P#I&mg7ygwsQR z=czE8CEq4FVi(-=eU9dcO>+ND;s#6O%LHQSb3L3gbhiu$itj{M<*jk%0Q*`L6X-$OKWCoFH9_3dhIf-Uxq^wNDId3C06am$f}J{HOv0t}aXa)>toX)E-yClVL~0^Pif zvF&#gm`$X&*1tjy4=8}Tt;G==PA)K6#ql3=!?tgna=)68S8$B}t?cimjZQtR=mZ3} z+#GEF)}W4A_UpMXExIi+r#(e;ebuw9=KL1{cNYo4XS;KXGOX<F=%hy}(8|^^$T>q_F8+0hfP)CdB+TZ66LAGKnzO zB30z{Hz0Th-J^)yJSkdj%=dYESX#6Kb}SMe9m^nzEy%{UVvF)&pz8);Lx9kJ*$L`B zlpeLFhJmq>JVue>U%>!>!7}R$SPI(V#8Y<~Dt~?Nua`$3Gy-r`=k;NHBW$NK@bvn% zcg)@{1lYpTqB1d$;66m)Moe2RpZdA@sH@eb=|X+?R1_%b70-F^{#)vStHsNFF+b*w zjAcNIO~X>^?)Ck-p2_+-vgrV0=z1n${@BvTnl>I>?Lpdb#9*bIz2j1ru09O#4d!H5 zbC-w8(H|}a0%-U%#iD=@*I%D6t1XhnVKw-J_`ar*=`oTxP{5{wz940IuzQJ?j2M2; z5$(Bl-x`9ebe}25iOqRCv)Vt4PpF=+b zFYv(c%e%N?QLx}4`eAK5jiDgD6OWa4^U&+;9n3>khUt_JFTf?V5h))%^5JX3xjnq- zIa7Vm@!;OKq%PkA>#z3nFYhvx%URA;3V)OR`7&r7D(Xobztrv42_+qePQte))4QJ@ zKzj2)1btGHYh@KSQ~$%efdsRR)P%YOM^l>mE$n?1)|;Qttn7kUbUF=DT< zpC4=oZ^t*Yec&}MxMc%4aM11M;juENyrsA1;Cetexuhfib|GQTv}KDXFn-PK*#O=t z4=cwaST@>?`nQ*|UW;_r&X|i_x*uYSUI#?|{VkCu+Q7BfyP;w;2ZfHdlCPT4B$(Q; z1glnVI`NVE_}=+7alr*TiMR}8km%Y8?bR2OBGdf#Hn4V!?2)=&Bb%;qA;zK|7ujNr?m$rZ@!v z3*nw7BevnV|9WAZAm^MC-$zM{pW&}Wzo|&}=Nv`xbGEvRUu>omL#F}VwTJ*CA3}do zhp8`i*z9l=s(Ss74sG}3$OyKHY?ZL$W?89-@BGmWg(n4A(B>h-_ztDXNiP|s%G}~Y z7nQ!V;@)+cuK8iZe%O8YTu7v!6>2Qtk@zY#a86&Uk}3ssJ+OLb0N$(aa_#5+G|l6$ zeQv}hd3(kzf9#>^b>HN~1g`U)udtCePs1 z)JIn$FvCD%wqul;`$0GAk=x{5y@(2Bum*gQ#B6`x(XkYJl7EwRsC+c_xw%oLzDj zL-P2J9fuAtX8a$k_f%;USzj9@Wq+l+3!VoCJ}C(5kEx8rqkI2QD`&M8$+w0Gdxi_c zMdy{m(?boYF75=bJV^p`6!^B+##ipSRuh0aR+|2Lt`b4Eq*LZnxTf7O=$EhgVcZ^o znT9X$*KGKLPG3XUO&UxYvR+PVZT_k=?VwbyW^pTR&!h=vSzOS~=kc~x>Qdg7oe zbCoqVDTAy98JGF%FwZ`rr?m34EpGK_I*iy9y)jz2+#xzYX)#NiO=7eDAOStEB2-GQ zQ5Abnr#k5GXU30}MmEi@cp2F6dwx`%I1in>Z3X|4!$!*5kBM@RymFfcyFf-{ZL=lcw z81jvLi%FHq1xi;Otap5$f=sA;{R>k#^?+-7kd%xxR;2o;s%-CMNWUP}mSE`nrCXh< zhb+*EUA=7ub`D5niJLnjnLeg9B%2n*((IyiNsd?=CQ?6d?`O1LIr=;06zj946i8v? z+(LL#kua8n?0pcUw-ZeFbhQU?@4qAI4Sz^#Fa&y=uF36%A%o)Cem?_oJ^G7Bm4LYW zVi>#wZUC!ZV~t-Rv!!SYwTTHmNo=1iA*YJC`XdR8`p=mErpre0C4f^}fUBR$OP89R z*H{0f9TRmK&O_wl|GkOFi^woPBlp8|BC3S3(M5d>ZbJ9riWvynl#GgjTPK*0FRBGT z%wTrhq#Ro2I#hWJXv(16PboO(I$l?}-a@vb5z& zf9}X!qAT`NuAa$sRyEDdEclUdnlqB^9q-22Tc2ZDf93cZH_3af6MUP$+d#+J=AvqI zK3a?*&51=9wc0+wPZ4c_E!|9vpkBQ?oI9C+c%(PjRBWRgW+ z_Jh7a@xNk#D&#-|NVO9A<|k&MAHSN*`p%^hFety1nMY2erT6-juJ_fX7oXZu{ivyM zZ|-w9q5ep9dK%gPzsQ%+(+?hyLV<6C3ssGX7GvmPUzN_$)1#`jB|uS&hgn8oosU~C zvs*3cvMlVR;G5B>6gWkPiFPd7vCn7j78r5AM@UXMybNn$10iGdz0sSI}!WPRvc1GMSB-KAKQRp(M;e_f9(7VaD-{FV=`+%K)0uAMXkkS+S1nEx0H&bEKOOcC+_*ftoY-Ee;447%4 zDc7=D9dJXKF+a=t*^rK{j9EF@5Ht0n+Pn2LVH4OIE<%>`-#jB%R%NZZJ*+xYnci`+ z(=8&?H0(;bcZurHnQf(=b|oz*P5j?_JRgH{(5K+J154LQJHHyT91QHWh56i&&Qt z(VK8{$SWj4&phA`Phu!T<`1JPw%XOmJ?hba?Q<#IMpHOD#4M)}inMmVPssZ2B8bgJ)`GrCm8B6g zPGLAH08{58HTo|3oZZDdl{OY|LfR%OlPZgWS6iFcl8p?0Ljb3ebh~0jgpMN;`4cW2 z{ZB-(bSD8LL)wU@Ox#8&CNRh`4v*j&a25s6G@O?7w2at1E8{io`6bw}Z1nJ|$bubh z!7?=e7wIsP(3UF~Y~Vi-vP~AUiyoq?l8;y395tOZnv-l z)=TSEWa zw_8AUy=X_)qd+ZG8iwT@OmC>=3yEV1msO6jc9I&C5u5m*UVe9|kufHboQ+I^7Gf9XjynW*u#MA}o|aYDO~-0Ca=f&cn&keEDD0Xv;Vx=tqf@4}lqF z?cI{j5qE6_*|B5?(mycgrc!~u7B-0V3yRQ?=!;+ZSl=~KnEM&My#bAz3cAG0Hx{aZ z6Qkks{{s5gSMr=pIB2Fh%pqdsjGl@XuRZ&`dNF0Y&d-Vozh_yjlGH8eN|Cu@4dbm~ zFffYG0lsG9cz40)>?scl>u>A_$>0QK;MH(XKI`76BcBw7v#ZWH|J+^Tw|oAZdF{M? zL-9~yxk2suCr1s{?qBN6_hWp4{bn{FF0I(oI=(ZB1^_6h~~HR%jQfy;B|~!?yM8j_sQXso(nrxisWx!wqH4AdI;V9AvmjS@$gepB7u!S;j2kE zmkTuwNHw;#qbD8Up`h131p3B0QO`r{*=xt&)mhfU=IVZ)5ml#76J~@^M_ErRB<96( zCjwdzCLHnQd7Ss#Vv8qI*7BJj(Y4bYg&HOpEv30YQx)HX_Z;8nvK#JE10Kt-Fn8XE zF#+;+V9Wb{3}xkFaYvxpyyn#Wkb@+naiFR$xxvlvZhj=Y>VxSprakd4<6_I!oU1Pd zrv#m64Ohm69V;U1|AV3LgB}o6?sPHDV8&@8$NA&rpFDPA$Si+1qQi@q$6%Gk@d_~1 z&&95YVIwH~=pzC1B6bmcM7SMBJ$nRVgb>J~TkZy+dZv4Cqs5&LhOxc~Q=k5ws&JfC z8)D3-h6o6^Nv<_i>Bng&W~?1Gd(FI`Rjeei`h-6_w%!Fc(V)A-Wu_|lx5Kt3L}DEd zgA1~5%7W-GOo{=c4LMTtf{7`#SgSB(p)0irwh3XvvBfS?@WexOet@t>0$h<4IDEYi zqxXixLc_M0!IXfK`HLq0eXqa-tH0l2rAWNm6viF)`l`TyfFRpDKI_{eR8~VC22fTZ z5}-X;D>C53%<95Sh5gnIGvBWG*IRDDm60!3#+(T$2;MzxKgjUDRCuUIE@l2m2DErt zgV3Apf&&Uh*hJ&LNBe)>wn`5u>s_-2=v6@U+vX4SLLb09>Y!>d7Cp9#>t!$V=C{M- zGh613>O1bR3SZALwLA!br8wmaH5D~27RfI<^?OKvB+R_ow9tSY`(CXp$k5`;rk{x| zTz8w}Sro3HU!Kodn-EvD0vw_~CkZ@sM92Zv0`S%^J#;0yltgEbp(Km;iR4UlhL~NY z?qs9XX%`s601{r4jPado7jn^?_lwW%vHh&%S;t8l+;?#WSOsUualdjcQfbi$PK8{t zZ#jlcwFAW3095zxm+$iXV~`I=SElA*evtepBe~l?4jTo;!AVrd|?eh|2%p zagZ^?NPBTH^OC1^;wEd@62K)iExv(!!OeAOAaYNuvazC>6c@gx;o2EeRQJ~#38*2A z1dB!f=z(c_P@VHsw0bp9g-B12%k@*HpPn(VJ_o7Xt^_Q_M|;28poth5Db*R#VHj}3 zyfj72)h*tV;lo3-C)uUD<9Ubxc4&fMm<6Y4%~&_*=jlExhzr|ItqR`rsHEW>y1Nm* zDuTYP-aX}e-YX)mTH$F`0L(iH?h7ogM$8p6M7>k0#8KR57`gu7i`j7!cm)pkyZEYB zB~Qu9kTkWzV_}n%K{>nrc(}#x3ZFsc8w(Ld)8=&{?`a7nN#E&^&+Qj%LE3wOIP{+cx1BC=k`GdqTxDZqfAj*k=BR(V#xM{#AZ zG4rsPAApcL7EF9EI3YR=)1w`s|2}lmNBX*NO_h}-9ZRcyEC_t(PW?oxJ)dBYg9Q#q znM(@a6-#^B9o_H<0wmI%4BtvcV@p1lvA5$sG@v{o)jaLWz2>lT8t!hIZfNiei%OlT zEmP%lll7*pX4NVYj6HbQ&&S`BqI#$WMm-x)-w+-x0cJ);Z^{n@4|rMatEf$NXD_}6TVu4CKyT$9&9||A!>xm~lAqPf5v$dvN*$62U&K9jW6{gTf zG;GI@C=mNRHbGKT#@fGsnM%m+cqKNAbMAbobEcoEoygn1PG5LP@DvU}nJ-?m5vA$C zm{)AJ18v}`IJiZU48kINZ1g8M!z9Ok53i{7$AA)D8u_U#TO7f$p4a<37p-+`ZzBKs z{!1)zgAm)+&reSRezqbUG{g|;GH&G2j;gEQ3EBBUf5NT=f--Mt7<{HgVy`q>mR03# z8+Lb|bJ#!~zkamX=GOt`!oogZgOOicHr?YV`*sa~pX7j5Fi-TORZwpR6YjFRvHfNodJl zR{N2X9NrXYG!YG$)~1mNymi@Wpf`F|mUg@9bwkjn>neWTVdYFp8=&~|q^d8W-?sd; zdTu7DlJ{Yw5i=ol5geiTWeY6A0>4ITi9Vj5!HM?8A=8eqf4+iafeB7LIt{IXhHyk9 z&C)h0y0pgK%k?G_wZ;PC_7@|((*Jh3lB6Td`PA6$f@RHI{wr`!kbQ@pYd|{({XYw9 z^Ou8nUwk5k`AVcYSfU;;l+F!j)R->Bp9xET&VXZ+$0Or{VlwsN$7OR`NfD7Q4R~!B zhe$2uFddSB?uMnIag;PuVsWG8@WvI$%z!+A*d zD58?Dn%S&ol&}uC-lR!Q-GJYwz$ZFO^}dN?xblH#_F7HWaZnttqwWw+ZQ)fPu-fqo z=GV00K|3Ye&r}Rcj)5L|#1g}Y>H+Akc5Xb$({h@| zmA7x8B(?8Ry;?e852P-* zFsG;-sW3Kj02tfIl2V4?{|Kk4DG--<^%#It2jU%Kz?P-gNrFl@4ottO1rX;lzR?hn zCUlNk22(>D;Ge~aB`sj3Tk|h)8!$l2>$bqtc%^l5AM0a8DWLoCb<@!!o*wE0gzWfF zo~?~A3TNIEF5`EG#+p?}i+>05tjoz!CG!Ws)?49;L)&3FzTz=6a+lBjlR=Ma0lh1a ze+Pgzpz+9b3*NZ@_kBUmqF8R9OHjH!#^Lx4nR7-WO_)>3k#krY8=KZEsd!wQV|v-| zeNlc>1oi`g-t+gGUZRix2VdstDNv)eeReQr+KaxedfIDh$--seh`6QiM~Wj2a;K$KU`v0Q z<#PPy9TXX)7^_hh0w^K;bPk_EvByqJQdWx_!}KPdUNy*VwwUsFb=WP=jNT+Ym@nl| zHt759|J-2+Au@Q04wa_tUBH8L4=3k0kvHxdQ2WTVn-flvy0w_Qs86d?e_qsvZIM}u z|7g`Z$9YfVYUnpuh6#dfaM7aHtF z8T-p|wmp}w*&HXuCG%D9yd6;$oIbs7mD`vQzWB z&YvXr@C~N}`@&Yab$yx$hbiKrz*TfX9fAnuP3Xc{En7Gik>(fwtx6OqnLM2CxXhsJ z%h!-$f-4_dN#9~A>Gjv^VOuSCjQ6g33n!Q-mb?zp>r5>AlDBt#Z5F`KpS7dNN?|qtV}wfeejTz~pkJoKmtP7ZX1BoAJDJH6nDY16xP(hl%Ta1IBv=u*olI-u>>BZ% za0p3qxGNy;ZNsDtXLV6U}yj)17#5wxfhci>Nzv z>oaS0I64{SV{apU$rp-x8zVCHpR~xN_7EV0OAVgVCNG}~8Rh>8boN#N;*VhT?o`pz zkoeH^-ugeaJ_b*)aZAlBzX#5d8>mrISk-qU{HD~IRf?!=)@Xx1x(>wBov@W=Qb z0{Np{=C$JKgTqZnELa@EXWDI&x-!^G+X7&Y=z~7it)&bgu`Jvf`A7*+L=NNULDf4UYvAkyF~do^fv z4`)1Gz2dQY@OI#E99L<%stpcpdVAKKb27r_45w#mrbt!;3niGc+=oFPa9)zUjLBSR9)C!e+88B9+^AHn<5|e^u#Wz`A(CE4n zC_bHm2$sEG!-=_C=B-=Hp$zd3V3;MMHy8VeU8Y1dBuj{l(p0p)~fbuNri;5y$IC3p*V0lc#~=0KyGqtRuyw@vv#-qBRP zEG6mcz%#rC{SY!lh2nmJ$~J1hG1%&RcyY%Evq(Hp!|JG#681ziqI%Hu{LZwRKhowu z?h{S>jAXKs;KZV{s)Rn;t#|pU+{+^C86b zA}jmCbJ5%cQm#T$nG}+_ZXg*Z$H1Rii{1XcshZxs5{{m;hFOd{e_P_o_{S7Eb8Az_ z#v7bnB*@8BhOYqo`x6JZ68eOp^5MS~0hn7Kifp&G>%rX}zQn>M$jra0x0xdj?#TDc zZS<)nK(goGqKw6!Kj)Bqi+|ojGTR9Ezt>HXy!#Fb4z4bRb<3=kQlK>Au=OrnqLrv^ z8bZ0aa?#YG-{V0?K&~JlN+6|^jRymo?H-T+=P({V zwyq$lh7hZYc7nc)CbWN6q~VCzwav-`eLrXsN)^flZhp|JpUZ_)(P0weTPd6SB7?=S zq*k0l#PL}gQDm-0FP}-S7kzdJvzIMiZGsIkutD$;`Vc8z zd8}YxAH<@@qyMrLghK1WAp%umInd}#(3A5#xEVH$+J;1-DmA_gN<1 z8$zD}4XS=wix}~w=`9*GVQ$8{QK!nMu`zAb$8*DH_5K|fKW_P2%hx0zII!cDpX8u#0p;^;SRFL! z?tch7u`yD`aLf_wR)!hYt5%GXLIgwV?Jv~eyj96HcAkd%h;cAWKBu`sTlgoUXLbX(-s2G%OO+hJ{TPxd7@Kv#V7*sD;jenwQK zUx|(8Z2P*Mf|G6>u?OyqBMWYT~C;XDafm=@|9B-12*C^plH`uZhTj411 zjY6B-B{CtgT-Pt((h>s-7cBkFFJv$JzdoutrP0KH8@}_5+$hR5il_Bh7tSyzURUo4 zm&M%d+Sf=^ig1wxwO8BxadTC$k9%tA3Q~4e38phr|2>tc)w!!Y`}6i>LE-~XWy)2Z zkt;axOd-s-{etUxFmzT$jEPaa%>JQvXHGJ%1pLn$IZPZPcvWCE zn$d?WZy28SokWCld^LGePSYIYYqY%r`v-lAzC31sQy6n&@;-Qbk_LxF<wg|wEMjtnanG5HcIY{B^hxXVwQgN}e*_Or5(#_9?0(~5 z7Y!R|0k?&CrYs8U6o80Bp5?PYf&yrKVTY7dOx`#O5)}yA}=$%5aye zC#^u~T?h9^91BWJ-;1iRRzkvmZ|2kNl2P?EBqg-9NwDR_X`^8$QRFj3CsE2f2WV)* z@5A|nkEG75+SY1~r%aP;Qto36SgO}<`u~scy%9nCY4Ctbv{yuSJ3%`;NL`CU$3o^( zAfUjjL|?DTBYZ($XV3=DB!)M+Q=!u$cr!_KPhj^YV3_3k-RQRUHt=@41J89LAjz0V5`S0>&moCfz1&_FC$J41dGpRwv*s;213cyuF0{e^kABG}Q0^|9{Qc z#!|K<#F(r_Bo#%*R)``gyi%0VCTWqv%!r~AvgRd5rBW%RMOkK)olM&7MwXOq7|ZO> z=lAk{zdz^ve*bh%e{@bR&*$~LuKVMDzul{gm>S9?W><;_mMrVDh#I9wdmQucXd*}J94 z)DG=BB0Mm!ZX)0Jl{mW-c|Ol-CV%gajMBi^RKTKCz9$k3jR&&OWq+%}d@}&LJe`UX z7C)sMH97!BoWO&7t@>N>0A!JOzNuEk5eHc4XQJ6J{O9SV@!;bYh}R~5NDfz&ELQO#Fsm+a;clY_V)$a@DUJ5SlNF*+;L(M#Gsqp6?#O@u|RwnY-0pE~c-c7Su zGp)!xG1zvGsNcLt+@!yt`PAtwa(!;meL&rpF! zkF;5xFKAXHP|zBgh$={h@v<{3e}kd6#)SE_{_qu`;4@5Pb1mCsn#RhqB2J2`O5M;q?7sAaef(Gpe0TjQzsCW3W-SPR`lDEh9s>(1GWGVMvG+slyYe|-!eQE z_EI32`cphvRO!A zGYb0y;|t`=7H#(2As5@MI_$q-8hum@5XPX`F3`!SV2Y*lxAOtGTgbFGK(_)eZSq~N z@c&)`=w2AY7XjO5V&thPl>le%3f-w#+IGrB(wR8hXQvEBI?&q(qn*YmGjdkkifuHL zkC;a1md;&j9aF725h_>JBJav8yH9;{`BRJE%z4On5a;PWhL(R5_al^R54=inTaPwsfIsU2 zFJFCDKBA{%A&O^^@trX!x;AOFIPi-sqhS!re%IKKrCc!<7vb=-7~A&=tIF5#H^3Os z*|#F`T?1kD$B@K*7~optJu!zSW~Prh==DArd0?O~)&el#mxQ`6cWt z`a<(>hLz7QVe_{PD_vZ3XNO} z;Sm*gvFWn&;%RX9wGi*cV^T`}U)B#E9`3OmI8}a#?2U-&ado~RDTD>WsLP_&%?gV( zWIZzhnFT11sLdC5eR*O_E(Y{fNhfpfUcQ7HsVU*i!YUp!mKN>N>6uGyaN&1!!4o<5 z$MPgBC^?9+{nXlZkvugIKQf17;M#q*0Wc1_7JPU9jc3%%<9jl3e>@fwzgp`CBCkD_~zRRn_FZ9zSn_?_}3xYvxHuM zC!BWAr1q#teMqac5dW%#8*zC*Q!B54xFK>fz#Ea(1IHocHVxe=43h&sO(E}h2;=av z8jBd5wYcH1Gtactww!D6I&C`sZ23$`GW5v#H=OrX^_w;wsfpgUH@jyQW2(lg+q-Up zA7OV8Mkaqp5h$HZ9Z*_U%42#Uf>+S`*Wr%i@6RX;I%I!yBZkK)ib%PsFemu~GLQ}S zvPtr8Lt}R%mucS+q(0Vcr4?CBE`5VIe5I03*>jpy|JI!F>5HG2Zqt@&Ga(Sp@Db18 zn?ug^l9ElmJUhZuJ$zaN`>HQQd-|!|gLXDEAg%p5R{a(1MOg<(a$wjF37uTW+aWYE zMkJ`8rI`NnfHwGegX*t+NFg-_e(m}Luhp$Y^fu9lu?4TmWSadr+x6mQq>Tig% z&?%n6Xd&80O+2roJxOBCgx|~FcxobWT{o=i>V1-d*qaa29J0uR7axKEn^lp)9Io8( zvQZQowA%U}Qd8#|ZFg;ie<|p(QMYf`@WSt0*t%w6K_njEM!j};)*>#8{N+}Zjz~p` z6jpAE(n-Bfmu^D4-o8KmA2Z;6=Z_^_%Rt6FoIViHNOAh*lBUaP!tM4=@?{ZSgA9T6 zFUCwTthWd#-Z=w*FjuaT9>ffY^p}t&0ZX3dN7PfbVYa#S_G`uFCeuuuV%TN&5C0aM zn@?jvwJmu6(`7HMC5p_jvhcS{FHAl_Pl$HvAdg%FFOZ<=L+iV!4LbbD% z@DZz6P7tc`s$eYvxz_?j5A(*N5TBE+~Ve4$yuXoD>`VJnJS|$8mhfl!> zD`1>jSPRdpbn$=S0p5`~XC4r$x1~l3TeXg!{DQhdc*3Of5A&0MU5!H%v1ll)F?DVo zYG6;Xe(Z|e#!zBZ+mJ8}ov7C#&tpNF9hUNsYD|0qag( zSi-m4bIoC`4D6YHh$bI7$CM_+A)nkK4>re!#cSk)3^OJp{@ z&&E&`p^O6h&x@=su-!2fqGT%6IWhD+2arwHC|8WmLMZjL0!PjGVuvq>zUC|;x>i5b z!Ai{cUM4X^kl0jyx$~_2;YTV!QRyCpX08B(!qcEY+`1+6&)6K{M4LHx^O)IGu+%@f|8aitIaJ4v31U9{?Ih^C4E zZoUh#dqGxfMO(K+3&2f?^dbPRrVU~EX3@jNWe3LAFhYl-6ZZ7%J$Qa^6Y9Ft!;PD=GQ0n)VDE6**g2J{`Gb{tyM>WNz7YML46mgxb((7)bW0Vq z2`j&l@8h9EUk5VoDEi`*7I0hFzBz*C@BOwHnz3#*&MonsV7mw&(iIaVmx8Rg4W zu^-4iB@wawNC^RODxu^*k=y1U`58h%`hTV;X5>Qq|Bu z+#(dFZ~WYq5I6XXM^1r&bIhjb;B*Ks$OYreir3BT zhlO$WY(1&3{$(G2U!z~o}!PVhkLYW|Mm~v(NE<-_~Ytppk{4= znnfw8%XUV3yyj%UJvje;2=kbTe?1rsEY0H#(VV0)aH^0Us>CrCs+}=%QDVlPl6;n5 zHhUcdwk#T5xCpN^IB*jN(BKM~ihB&<6Bnh9=MZH_sK=tR!g|75*Nt9J>4ZlOiLrB9`1G*ap()`&(mH-V$CW&k+9v(k8ykSG&vWJUtLpe)UDm z&e4zt;x?P{r3>-9JB8F)D2Ksvn;Bub$wJ^Si>KZJZ{gVj_v?}&pchvwaSvI7Ro6h* zJ`k8a`)JZ2;u^8w?4YQ+5m2PjACLk7qPvNuHT&5&Al7#|MteM!4E?9PCqd}VYC!K= z6e}$=)7R1|x*AF)@FI8kuZD^BiLb8JWu87eGK=O#Eb^JEg@AwsDb54ba%s2<2&qszU^h`|vhBHcF9=zh zm!}k@yi|OZ?*Nx_)sYxpUy1j$ylD5IH^MjwY~S?-kC6w-BUQMnTVy(ha=)jQWH|iR zUPM3Vnw(2CX8+ONQn)D*+R=81)GA%TrmnZc+4uCc(slgF~#ah z^uU-4k`>6>K|}|L8vXr9Xl{(SHPu{&Qz|S_jZ%cw;_$aWFi=FG+~9XQEM;tN_A3lp z=y{cvb-cav%eYrzX3a?I0`%@U;5H}&>kBy8f9l0URqONsZd?gHv?~|ZP}gp`eCg)# zOOD&a-w4J0-uXpI)?}Nr-9z9GM?ih?{^_$N*BH~6SZrJ zbv@`E=@07og^j>4s0jZ;JTYoE@WX*Vs&sW0S&Th-E{sY*_cj>LO6|5HjL9#X{sEz& z0TP9I;sXR8x*kjUs{d_X`U}IR`u2wbAg>-@=)bHXarRrJejO+FC4|uV!Rx-MD7vaS zO8$mTk42CXuv{@xzFX#9N0hsEeK6@PL|FWCXd!!8g)u+6?^`G&w(P}8D!U5x%q zzH>Q?OpR?cYjNSK+~u)G&;}S;C>vqw)xbsVu{14BBDacH?}9I*kptzvFz&+V-!;>) z9>jj!v{abl0GPU8#;?rELy&N@jVrM=N=2}yTeI&mU1XI;w;1Gy%cpZUPuZyRq@*C? z6;<}+o9j;M_jkr2>uXL>e;nGOgKF0a*f9Z_kXKC(P}iugF0dM_s?#zi&{e~Y&yeZ zY?9|J2mT|kx16_rBEL6ejogNuOSKG9no#PZm@WLg)7p?z9U*RfG3J853;BVK%-PpG zyspjtI@sUbXL>tfi$cV5jNg#FI9h~=SO(n?3PC;v6Se|fWGlQ#2N-~vJjfT0vq}Ia z)3@b9IvOq$WG_1@a`abs)sEuhXF|SmKgaaLsKl<{M!S&Mlc%`Dm>u&$xBzIS_NX5y z{O4n+%*lI)(!NtMo%`72g-J4HKY$S|g$Ot|^I(&Mz}e?QLHT^@@zh4NR^0z|Hzb?e;s$fkYsK!V*NER3p+?TpN z7`JAzJU|ZW)XE~ojVo|Bg@JODLPjO}91I%i3hTZZqo1IF(U#IBi`iCoVCOUbmPUBk^wSg+NU^d-5`4 zQFt*_Jib!5UXi1pJptLol6p&Q*gSZRW}DB*MbYj1YlmX6TKdTQGJ@DsFb@Y$j4TxN1#~1e_ z=O7%;>pihIY$FR2M%hdVFRe@@wlm;;I^O?2l(*N&)wZV{YRO1)-N|l0N_16!SozKu zy3*_^zjWZ!qxPdQ5$0TUJn*t-XT8^GttguwS$b7MWzO}+sctq}=f?3Q;Tp?NDUM!agEkTetILO_uKQ@hLM4#Zn z;Zp^xppbaHXWgvSXed}x?qN%-?G0L{gD?(W?KbN25_|-ys5;hmURnh^ICqM+=~oCm zx1_?B9=0hJ^-en^9(_|YmKZPaM6dX3GkcBY)d2XxD0&WB%u&xebHdMvK824E(T;KD zD_-3EF>`51_<%U_XD_97vU;Up>y|q-IGXxT0|S&FGDV8J=msZ_(Gmyf0X z-8m=$1HF$!vq+C8H&bk$jKJFBcQBlQ*2>Gkw)1cUnCb5D_BlAvPhNo?fsU@$1kP;A z(uNNpYupAc(d}(f-y8DkkGw9TJ}x@O7Jc5J204j?0)4KX0g}@Pn=ew2;dsV7o@IXb zhE4&GhASS($;x~wpg*;XZ{#~;aC`t4@PN4*0v=xvvN~i$Dr|DZqQ48G=*fk(>^NSS zJ%Gl058FXMeyEku39_8nWaSepnF;!>HZ4BwR?P!{WnanwFtXiWHscf|30*Wa3Um&~ zZ|D=F^mzFcyDJTEIY%-wJCLL?mP)!V=-a7-C~#mif{dj;bmRokP}9k8q{IS9>} zrmmdw5&WGXe~(9~ws-&!9miL4oqz&NT+Xipr8)>E|5KQ5*GNx&ZflX>$296Fad1(2 z(<^E-XG`l1P#}$Q8{Z0wgsoRK$6!C=B9$dYU_3mhBP;S{N6KG|>3qViA#n5Nm7z)S z*M6{rZ@wE>+L$k->W;uIX$g!k@SP?IWwIb;1{zAQS%|4dA09I8fnDcp#tL4H^DBC} zhrFG})oa!VR=C~%G*Wi;9F=$F4ORL|CQtK$=DtVx!F$qAYwoN%_@loqBE{Mq^&rso zQT@sNLbZ%{a6c4?vdODpz@UC;A$SFly9yiOi0L08v>a6Op>{jN3p>3L7T3>o&fe)_ z!2XHULGO5B9OsW2SSyfLCFd{T&!)tHZN_1Wq?QmzQijP98<*!w|Tl-QD6wVtw<1(z7@~<4_Ti`}xcX)ze$m|})!%0Qq zV2B&Ha?VF0K#6ECgKF82Lrpk)>4vyebG8%SFZ#}F&w1In#)I3!uyg*|(_&e?781^* z_sGwxU6%XAxdeC*rs$5Sb&uiZU570rQVu6<(f_8i?S_R{WkEU_x1j%nLujZOyQ>O| zwWOqh_PD1|?EC+JQQk;=WR?6iZ#g510rb0FR2i{zIFCr#BXp^MelxE2qk&uCdyh(6u76trbKCn87z9_bi~{7l88+kh9uSWnm;u@joU2h9pZN(~?;?}JY6$a$-=d^Xuc(QS(C{P( zkXQpHZs*yM4+;f|(2)EE?&UjQ9csBgl+WPYJ>A>qO6N3jELxL=VydVQAK!|W3$wwX z6nXR3UitV9i~`7qu{eZhuD^O)+J1%u^_@kvG~x8U+I1kEv)y?n1!_$O_CQah)A@UvAyvY|Pd=ubp~NM-$Ec^AuWRxBJIkye%%Fl+*c z+A-i^A)LJ<8{{Z|bU>Fh=IY-Kltm@V>vG|x)|uUPmqv-l@>4<#hwyb1fGOc~*~8X1 ze*tzx`3P?uztsq$4-6Fg?IJ!bB-(CoCN*RWb0@9HUR~1gOrFU#-z@IT#>3xK{~Ss= zrjeH4`n*btFv*LS^7GCN;U2y|Q_VQ50Jv%7^eF$Yke(OJGi4Krz4B?g)Q^0loUvDi zj3B%DJHt$jaQ)f54?KVE5qw3R!%UnpSGn(mimefBzoxer6Cpm^bJ5&>lA*AMWwh)p zoCT&L7{a8yDmcxJEP)R4BKGzNxDOfR0=~HUf^~8#H`#jU_$9;POK_&JH?&+BWmV8~ z5|&)p0B|MA*YD>ep@z#J#!;G7y?ot&wrUc04%sC%-^Jy?pyh}S7U)BW*AM)4jDPg( zh`GN$&lF>;0|#?-bAAGbj{DINPm=~UWtosWzz*vSnU!CxqbY@wk6k^SH5%9d1MZ-h z@h>UyG|w!4f-vC^v`XqP{C8|GOyB*peBK<^eZJyCnm2H@$sYT#Zj$Fmnb^9RM>+W| zV0iYT9uG;mD+i5p9y8FO)Q#BU=F|$C_W8cl$n>t;yyplLPZmo!V7FXvt zh0#Njq(zGVu$|mso5Z5K^I!S2HYVNNk9YuNVd#I}AG>XVytTP+*ke z1z6ztR_*oHlZ~OyBUa~V_I-^Wbe5bf#J;cNF+)oroM(DHs(VnaC_;e?xYG4RV-2>ZIM_81#n^%<*LM2`?_i|*F)&+w|edvpiCz?xh@_tA*Q;IJD6tOwPqzz1e;4kyfQw1TB}h8aTD4JOmq zt`YD4yWs6Z#6>HE)e;zAL^cH0yok8P3y+q;ek>Y0O8JTmCOH_++0aT2pl`9+6lX-_uUt zNOMXgPA7bl>T`wVG6qTWJEQSuh#R*`qYSoU$cSnW|E>o|F*>*mu zCn?{=-=MC{phGhBi~4?BKrh;ItA0)FD4ahB?19%82uG9xEY)E9rNq027Komn$UO~* z$4z8Kh~xXmoj@snr>-4$c2FDqsq=Rcxs2O@o7D>1neT-Msip~B4eLr+l*Rb~9g1BJ z^O-^^g~;rv=!UX_bP{&Bl)Fv03uR{}v#sHGn~LlGvaMG#7b_aQ{8|3=sk^Xc z4i+F`5&$_!Df+-m3F9AjnKQPB8oM&11K;I0nqKHM9m~Pz&Nz%e^f!R#8V+|;a|#%| zfTL_nCx05{hj5dI6{gm3YOKij?;x=F$@pTGuE2q-KKifO&Se<*gWuS*sB#Gh=ri+8OlRSqJx7Arl39>T(hg~FhM>CkXxUqtN(EF)L}yOlfO;WJfe&cR`$pDspj(~Me%pH$x&U9PQ+%|h#f z-+_stf5KzpHNxe&N$13Jh1XIYrpxAGS==|A^@bZnNK5)Nc6UY!j!9;Gl9dog^PSUS zb-^+6H!?_%mw{4OvMCblB1$xePB_x_pvBDKrB(G3(Bl^sPK^bAjrpaL@T4#*YfX1f zh3e|(Hcwa&vq`~*sG~UG$Y4y^?H|c|_(nfFNvb#TH>npgl4!=?MeASgyaDqvhm380 zSV#2^fErdRXH>&k<;QuE{$ zdZf#IwGJSTTDHED}1VEC@k?+r6laW z_Mf&hVL5eo3;sMJ4r7ytf1MQ1KvOCuz~^<8NO8&|QkIfd7t4OuVKzNkX*T=DhsOF7 z8GjfB4gVP1?EgNBI;9FjfmM%!@d2-GlZ>~n5uPyFa`+) zYWeVxJrbDjD`N-?&=;KvSyl=wRz&|MzFFJKGjbw;1K?g3`ONtpIB+6lb~~KqPwwCD z5E=vmsL=lno3(f}Ge8jVesde{~auFc^c+O0~uQ~N%Za3od zTbTnrs*41MJ|}yd5ybabOd9!oQTh2;#wwte8eqBdP3=Q~SW*-?-?YV7iDNv4vbyL& z5Rhh4PqeMJl>~!ISicb>x9|q}?9M;?dY{_FHcy&7-QIAU_Gks$sQK!PmoNC2&w8XT z=)mv0ePMNI&ASS%@RT3mMO#>BSnF~_j@;zC``j|Fi<1ktb!Y$B(28BtaMk>bZB)2y zv_poXsEg(tSw$H`X|`YS1V9hOc*ldEW6f4wLU~VEm*toz1Gc#>a_Sz>nH8MEql7>Qe!p}}#zo;VL0 zx%@o3{I<~H=f3JR$U;YGMjOLk_03%Rx!ev;L~p|34wwm-lD*O}{=C#&msOdu8&uAo ztNa*OBCarm9|7R&(n^Y!Kf!_->1=XpPz7e;X-s`Xdd!N{Gdtg`4e)C!QRx0w;pk9& zBihvBkgIFWh&utz2K3rhpJNWy5z8eoqaCrowN^xjS~XtOcxu`i)*?A0QeW)#5cLo@t4ITcqMGI0+>`fmw!Co zpCDc{Oe_qS=ks<^qT+#7pdqiM6-B*eK&cnAE;`Xgq_|Gp_Hq__<`eNAZ9LXCEmCiA z+3|F~Wsq@qf^=DsmsLZ6VRED2j-SXm}YB( z$^PC^BZpz&diXdXEWO;RFD+#o-e z1gS79XDLn(Z>qjik3Snz%M`J`ZZ{L83_}DJ1lLBuK=K+Ff#O32+cyhfFyzG-{F;wf zm7jxXF{0jLD)~J@JMK!o9d6Kd#^s7;`utx7in#wz)eSGxSd~hz7;O01LtKmX9H5A+ zZ@PMzZUgrJlyYk&e-t>hsRT`?UhbAGjDVS^ork3rI&F;5%r*0?v4(#Q{_Pwsvve&^ zu160;@j;*yUuXWA`!vQ_z-pO(BNHH{24{Vy7<#0RtunX#EbdDaYReuDr+8o44_t*w z^oPqn1-%b_>^$|Ft6X`s#%0E2*FC2qL`knpUG>6R<3oI^G-9O=;D=aUWv8Dc+DO#2 zZ_=H$)3WMJnDm~E4*QJ^lnS8}?*+DEzfgsMm~eK@xb}Mi3g7kzqAr>ry>>pynom3wteprz5jTz7zzoEv^!StIpT1e#euvW&VG3=i z?l3{11xjaB2autikXx;=fu4;HzmLj7x7SkP#?)uQ_8*MEcWoa2L4so_;~AbG9G==N zL6;}tp8N1NG~70Hl0!GXth1reRVz;an`dJ@u9Bhms?XaJ7!p8(M_P{54EFKKkBst0NiQ-xEv#v)!!MN59zqryKGQ2TB!*zcv0;acLg=E{fT`cE;o#wY_r zfdy>=yf9s=i10{>t$=hdKC8(l?HY~VjkmTw4=qMBB4|D zaUu2T)SG~ZFL^fQ1^$>}zZwJNr^KmF=bFIIHiB(+ww55qkhFoM?(vEg_Wh#jlf74w zyG2nje4erz7O@h zC~_JBB8n*PNggzN`M9b2138Oa5Fh<-DryCtmrLr;ZeuiMY=KqpjO3*9WcY6LV!OUS z`2_|I#VhQPxr0DUVzy~0-2tqA4z%I1QZ%szov;T=0?EAzq*T#5bOm;>{LTf5 zy6V;E4?5i-7Hk>7v*t{_ctj0w_m9s~Bjkg1es_-bdtP;owH)6q=aFw40z@$eWwxZTV@AFo!rf0?KfXFS$XSFK0aZ%;wV+tM-popB{AFC%k4F0f6A>#KUkPvWBdZuH-L0 z8{$=Yb;W|YuGu9otKqC}l&M$McZ_Ykt77g=mFC{w2PG7VOY$|rnx@&GJDP->H`T^w zO)h(#hr`T>gkf&vM!rQMEjHGcUcwZI4bnhx`!4ykNnsmx$L&hX+i5f2n2RO1>OU2X zkd&aP8Ic_gQLf%I=QWivU_Hti;{`q@?)AnP&ay7E7ZZBrwzraX7Ad27Jr|~IU*Gm6 zuXBom&eHMYDz*k9tI|O$NapWN7c$jB>AVH3I($7(bu4re-pH|N+Y#hTK$f@t=mLo1aq}lJU#fY)Q;m%JUXjmZ&mp>UjQDZ z5PT%8FLNmRUvp_B6X(-O=6sTJM=BkTZgV$e)sTF*tVh{o7%S zPxOQeS*SWljA-Ax{Yc?{#rIBQ^M2g=bXA4b;-jiCtSQoE{N^P8iKSgF$AIJZAlgD0`h(_jA6Zs>=)NQ%d)g&y+E~ovQY#H-|8; zoWRHa5*QqKd;k+YGt@jr+rd5@Pl7Fs1|7^t^D*QDLbYOSDJ0#KD%bfWEwcKqx~?FUw=mMpBxXO0$U0;{nRe>BQ*Ua|AT4dWS( z?X3tYxWWbtm)h$%9ER*g32?TdfNuEawBH0g&OSfq?M)DUrj8NzHl(Rg8f3Iwgu$>y0 zBq?H7C!(LBwNM~;dk}A?2BJ~_eC6@A8?+ww94pSth>4w~eQKK|ws1!9&Ucv5fwUa+ z&nykB&0mJO8DQ~1OC%MjYZi9AL9Kwldyx4VdF(zFCj5>}<&&7Dw1qh$Y#oIH345vc zLgrN9@MJ4d8$-+5*~2j$qMm5jbusS?^_t^l)l1f&2JX5n1fR$=HbI3Xv}oV3 z`AC5CXzS|=+w_FN3PaA#ijdb#nHYTKxc~Z?63#ZeM=#% z>|ypz;%9WS?HbVSwsfM|N@Bi~>fjg*va_}M2#Gwbip~tFHPn{LS`}KiqQ?~IFryNY z^lt5U8^6UA)BKbXe4i0GyVv_wiSs!IH*%D8^8Lc!ctqVfOT(+z?L^dhg@B_^#a}Cq zDHnvz9g?}-v{6^MXDzwt5h_7s>5`Px8=qeMr^4!N%)+IRAr`%H{!))U<=pPIsP>_E z0smXeEFn`x?`w(Jc%{k8K-9bI>#Yn-e5+Kwn8Z8GozVBT8FZi)J&TZ@<#CuuL}|?@PlEPrVOC1 zB|Y=@vamu@Q!t0xBXKYQk@|{iwwL-ynO}Yux`xUTyC!tmusmMEmbZC$59~7eMsz_w z6QIqoaNhhN*r1AC@qVY(MDNv&W;<8T!5a_;TE=T&6Kq~;49=qUa)!Ad6?Zx0gPFuL zyf(CzL!te``nVB%ZJ_$?M8?%qjSI7Db>F86R&w))Yr@;jr=F}$YaY7%JUXyXnD?x1 z&x3~Q*qvR3!MzPf$&y+nS*L#etlLEqvJ?xFk0Ul~#Z%e%`Ode@yW>t!$Z$ni$!TMq zn1w^CvbPlkzWGD2x7(i5)yK+F;s!XuzJ^6s3e*rR%8t^-sUiGwE^V%(p%?1GF}N8x z)A`A^k->Omi&2i?0!BT#9N46GuUpQ;1<@)KkfGhbErds04*b4rtTo+8iig?ALOdHE ziAycHQ${)jY}riMAw6U6JS%0-c5=Q?tu3U+3Im&IN`u#pBy7YFxokTub{DoHC8VU+ zkvA<8q@W)gn@87JC+;z&3kONX1_ZbuQtti@nJtMvp`jD0 zae6AhN)SqzhTkSJ==gBcYNYH8A|W&xSB{NO3dMEaE(tx-}esy8Q$^njF0dtd;yaDKy+1{ z*%QN8Mti4Zw}RAH{tY=YSU2NCTMoXjiibFbe=?WN2nwPY_N}jEh51wY-+jEl-nar$ z!d;Hl^(}LeuljW>I;X?tXi>a_+=F9ejfXIORuiZr5_GZL7CxOf`<#YWKCI(iw2NWZ z+dmv3VXaa8QmZ`7VbccOA&4b1{Ys+n2&7SNw}c^KgIxYAkY+gO-5(z<1HySRezfmcLEiu7k)?f8!q|1UhEdqJ|rP zB8?p94ZfcvAhqzYSaF322z(hxCrssL=b*FK$(=G=dh-8hU?}!)q^uX)HeZLaETeR+ zySBK;sHQ#N9QHoM0H8kmHo~UYzv0;s%jaNrkMS2tU2DhHo-eT&H6VUL-fo)uv>f5( z`_Nr;n7Mi0IVo?w5`6iTdS-1Az#;d*M!HBq}4(OUIeF&LaS3@2%NFfW#^ z(iyRt)BP31NK^uKrvx7q=ykOAK~`#yoEZ&e6SoLL3N3pY2|AodFY*lsek{sS%>?_PXtq?~P+7 zJ7zRG@Ps;i(-;b2fg5m`B@_i$?EM|4+7;fV(!!dSu$2?#=MM4jDW2Cubxz_nG&EK= z3K{gaj&V%2V6 zpHfuEUCo}TlOkD^%OF|To zBpldQO9g@VOBe&Wb^Z>^vFvq}4{cOOBsG<6mssUWgf%#waV#}hw&Wxxj+TJ?%B^fv@h@lL4WE4;C%uOw}J)AiFj(1myHkQj&bqk8)6NnaF~ zCh&d6Wk~@B>CB+|JkGv+9v=w;l>GH770w;fJ2-gJ=Na{YM4LFE2*g*px?H++2)p20 zQ$7#*7+((UE8veRX!r2mu!k`?%o#agt1`3Qt%ZDxB;;cDH9&eCVb1UO=+Vi(<)fA7 z{4I-Bu`$%kipSCtOV|Xb39j6>Ou2G0t_FsP z{%>`$l>h7`wlSUcN8!*ogv+99y(j(m*o1vUIQ50SW33R=XplTMfhAOMp!71W>H;d%ax8%k1O+S7oKN?Kg{!=NX7u7j_IR&b}^WkK;l)3 z1IXg)ME1RGe;Ks`to|t*n;(4eDCwqx@QU?=>~Ja3IA>m!k|?z$+RY zhx06=8&DncPiV4(t;5CB<@$&}cjYWBh_ivj@^PZ%$35}%P7tsW2cfRwgUc{sk}Qtt zkUwP1m6z1vOGj9DU`m$F`qD1TbnFrHMe;9Iq5Bn}!~~ZiaIP>y?P-t!Qe)8~ za@fa{Yd&8{3mw_gk(`p_uPsNJF^aIK822rUURG>v7$8Rf&}W1D+dk^3!`ji8GIQz? zNi#YRX54FBv>{rs#*K=l^zR3$;n;J@X6JC=C=WHZ4)zY|TwaTJK_InPuVbGd0mX>> zXMTqG8|Z}PoEd!A2pnsI&eoxXRw2hS%-N{jF8(=1dHvZT^wMs3#bK zNQI359YB&4AzN-h7-j(s8KOWjV#pS8E}Uy7662Pk3RrGP?ZlcD8+a)}NU8{Cc$i!4 z3~q#t(43>-!EXGa`}M-5&*15`b0Lc5FbGos6aPrJv^-;$My|d-f!Gj$Z?KQS-qm|wN!!?bbpYn0D}7LRTb7GmY%`@a9{k zFcanY*R2y0qaRd^dS$Wyo@xxw5y`(A#49dIgM@w^9^-0q_y<_i*z1t&&ViWTNrK*$ z>l!04Vy|tff-MxVkq7JV!-UJmDyPif-{0L~iA7qoG!oyY?0jF7N@^gTdWNUoI+P_O z8ty6}HW#rfd?t0oQQR9Ld@|u(9nL_ocZHRM(Ajhnl)jm5#0qDD6=ziBZ(ef++IyZO zSR&ef>%;xS;12652pG~T=j3tCeG$9AjJ^*tgAav5*vd+QpV2f#QW?b(Im}zo3T#@i z-Ze@U2i0#3XX@@U0LRh}Jb5@Wz|F#;i}k|p1-F-(tK7p~AwqyJ=H;LIi1tx5)z|yv z9T4Jj(L2Xn(~4cah}Xttiy@{hLx^6)H2zG0!cp!;gZH1YkjB)vg$f6ugh?$)c$hrf zyZn2{-Hx9jy{2g~ccS*|dtl{-o5|9r(BR*l`g8P`eI&pc8EMl@l2wlTF zp)cWlL(f=L>eTY0&eGX+hLxLvGj@CZZ8q`KW&%jwpNo0%+I&Zy`<(_$of+#rnPlyr z8o79g5eJz0dY; z_hQn=XJ3+Go6v%&AJy$~cvTwWMNJxavgOB=)4t1p#dDUa&o=UQzQbtCZuu1I)f;`d zwY*8yS`L!uacdkaWp1C?XtQEsXO&cdbj>G%oqOex0Xg5ku-d|&vf-VtWg*#mD8>+t zUARG0;kRy)+SEy36?6{*g|+OEr7O+)**)>#*_o>c25u!%cP2eN_D}6_5kLF30*qY$ z=W(omo{%=-jvcQwUKyx8=hGf`tQl|i4+4K>6yK!`!MlN6WwHW1;V}l)$Zhkg_Ixq8 zlZu1=zte>w+VfhV=xtEaPDD%vh~vW+IumKF2u=oLjT;0I`rdbnN49lEL+YvB@dJg2 z(*6UaD1@vjVcb5pd!IR21vy1*NG!-U0!Oo~KW8!1Pn?hn>Cu7#?*t!*Dwo%q`&W)e z71<<>ixp3YI8IA7Uz&Xj@9swNJ1nx8zq@T|(bRG1x};bs)MdOx}jIwiYUyBEYRltsST`#`kr!E{Vn zmq9$@1~&L0EN!rXSHcjn#35>VY#FkAErZ+mm`oMjJo1&52*u zx9k)L(8g)-1d45dVtR4U7iElY}4dBP}_cC;bP3@L=j5*}G9Jt<|YEQuLX)*AH?AtOt6 z!`Noba=(|~`yTK7(a}HBanE&M*Lj`i_xt&Zs28E09!jClLP@J2trX@?3zewKfGq|s z#xW}zRq0LS*5Ap;nql~Uk%Ner8 zMGEbQ1bcsYP3%8c40ZRd#EFns(vX{5(&w(w!)-&T6<1Z~qdymAHFFS{TbG8o?*Qi{ zJUb^%%naErevWNer*PM;Ly6^YrrB+|5*wEHYix1-e-DRyIxnAp)aKXxsZwlIEewWv zM~2{xO00Y8ElszPq1T_L%Ysu9451jH&d`;SYaIGzEl7#Z7sf*rmIyUWM1vz;5?WE#UJp#`}u1d5%yf9c|k7s3!%va*a=lW7|b<>+pc)!5WYIp8`^pO2;|9i zFmo3h{UUqc2oOwnPz?JwiWF%EPCqCniCo3O0o5Sor9bmBoV%g0^*5+_#{4<~w1mV< zL$M}Gw)Vmaz3FH9Y+Rw_kza(sFAeXYfJvZ;)k6rsLvN^TT--_+xLoyD;j;%pvCTZg z7sB(8iM=8P%;RDbH0XRTVP#E7jh&inww3;$V&qh*Yf~5@P9(QmZmk6HAIwB92T{K) z-ABw^M0NHnQXT4uT@+w%hy<~@Ma4s;Ic^=nmYH-q^kiU<>!v-TL;el_74c5 zM+>BmJ85m8CO+UcK2JrG!c!JM#O9`NEX~zUc-oNrpjgb{jJqKc^cTXnpHo!6TUeaqb{U zVqUDmg+rqtb}h)*ZvGM8KfRTeYO@PX{{AbFC|*{axAW+q2ppT>*UO?M@xn#aC##Hz zt~LK}>^_)*<7%LRq&1C*xS~J<{lgD7ZfXqq>hL*z3&cDb@uO$cN04=x0Ui}Y9AdII zNi(-|{5Q`9jj2=g1Su}lP$X?bTL&7fz(x?j%Y`k}S+h&^{ZBWL>jtTH_)Uyg!YOCk z7U(Dy>|dGG0edm#|22iy_n!XkT0l9XvL#9yvwO}lpsUHA(n5@`Zs_^VGEZP$h-zk%;p zB5U_42^5_Lx1k0g>e1*`>$a6>$FAB_4KG#e<_y6drH#oc%9EH?Hl0GF2KeaJ!pKEvLspEW-raLR21I_u`K$q{N1+-I6sc14Mu^=FzhJ<`Pg$7Y zGntG4eTd2S69W>_=$DijSg8;dpp7@94{`~zwST5TYtN*_auOwe==(m?e$gv)7|1CK$r;T^+Zvy>)7bQ^4rOj zKTsNa$f(uSrp04M!+iMQY_cD~iyLH=N&-RgxL(lo2Xie6A+W-|;dxgr5f2 z64=YY9~Dq)mg(>KJ-6492dz4Z?nnY-9x+6slmwQ4=@HSFV-1%5X6Ni+NE}y63^I z6e(W4l4FlgElq46pO zD=8a7SPsq9fb)Lz-JOZ;&}n2Z&96DwvwfdT@d!Qpd1W;-DtaHTjN( z&Imrw;#+KOBSWoZWB>BcS)kDrB87~bz9`E@rUH0pHILARUIT**oy5##mYYL82 z;++^PE{zR~A*P%mpR}2QlUUy#*34FZR^QR??A9As{z}gmuH7hXd-huR=Lpe84Z0wm z``Hoif1C=8Pg)Lz0c<4;R7iCyBgd3w2#Yhuupeo+M-Y)DP)54B#fAt`9b8W)qQ6^3 zB*Vg=ve!zcL z3jFNWf8MQxz_)$i7ymyL?e~+Mp6xcoNPBX}zB*>c?CAUnG|h5%@$rx@wKFO4MRnTY z4LeYv=M2=J_XT~=nW!=Pyq?uMf6H@XatBh_6%ro*dqi*DITG+Wgxv$(PV*JU+*5V+A`3O4Z_a zM}06Wuu}hq4Fx_GRNW1*D$so>gvZbA_voIJOL!QtDhlgDAcO8v&?;}T{y?R$!HqxjS;ImJBO`VWWJ-~?O6H&4eD z_4oQrt+TM(?6Zx!2N=)Qs5H&v;A3rXK{C#z=ncYpYhexy9J8hxk9k+)Xa}DVPfhyL z)jF|Fp9cSnOI|T8Fj0$}Jeldfs623#c2vZw7KaE6O>uGi*(`O6tt1LovPl9a^^H%X zU?RdWBGgPdv}Of>32{!`_-tsg#4T<6ReMi!S_R4h;>D_^NA|xjM;wKrg=l>;o>_Zl)YRPoXEy; z$IO2s!@q0E5@X&$kg?b-%AL5%zr2}ZUwn@#1w$cjb`F$vayWVDKQ3I`X!UdD7{t!)eTCdfmMziK(~qBB(cz+f9g~yKcP#Z zX%8SHa~|=73ih0c53J2d0#|BhdBUho?y^`+CY3dgFn7YxjpHlI3GumWf;KHTyY=28 z#Y_cms z7$qXrYE0@J)+lEvK}ukzgrZfP;Ux||5ZpFEtT(MF2Ov67{NwV$+@;Oo zt&NrKgQILep~+pZAgVneg`$10Z|mPzmM>$btQ1bF{WqDf)9yd|PmSOyS?LyEa~-f) zrpG3{=z+4Ulw0L9 zyV(wlx388SKb<=3cZB|F@TScS%OGReb~cw<+Z4`7rr++91tQuR=Tl} z3TQ`fqROLOW=1BFZ9k4l(>K^zNb@xl82Z1TU%O&H@UsyS?B!t(g({#TaUCaSOW_r+ zX_u9(VW;zZ^GDi^nfW^}Ji4F#6VdL2k~CaDs2g!p%xz zX2lb@`Yl4eFuC{tDhYJjnMKNjMI)AHr=^acm|^=iSau!-J3pUW%6$Oq0u#ELA+w%Y^n}&?NSOec?A=C% z@Rb@7(+^Pu?J{6W3pyv}r2Rc$9 zbIZaA7vryC`dhckKyXi2ygLO>MXQ~;3e}ebrz2Z;%~W8j;;Me7e2{Yc{1Mhr-$daP z|0eth%36$uZ7QFs467?$a$Kv*4=CZwv2D0981c8} zAm$fkGu;PsL&hNm4iYVDed%7I5ZQbJJ)+d1@{g68o@V6Fpre!^PR%oZ%6B{rO8vE5 z6Mu$o{t5f-(hUE78k%Yi@ym?yFn%K0xrcXcY!1kJcfpL(4}vKtPsPw72#wt>~C#|N_<$|Lu0 zX1lL6D=9FLOx4xH2a+Xy)e^+?oD?u>jB2Qa24pG0<719np_I2fhBrqH3`j2Ax%^n z5WnZ94gwPl68FNWS{g3IF+?R)JIYd4B=^nzq_*Y1Y20ug6RKLA@=>1`Cbd&BgWe*O zW_ojoju6%2`rV1BGm~OX)#JhlHnw&0QekZ1IRkM31@J$q)z7)14VDd4#M9o=$U9FB z1voBw+r)~L4cBS5>j=s#a_dd;6eFLd+g_pGt&WEPm?ji0O`bm4Bjy8rzTQ?DLhLv8 zFrDVdOB1w`e6SE+EJhn9?nJjGvyvidWdar+6|4r`PlEI_q8nAj4Y_Dq(#l_GI{;q; z1&A6nLIE9nM9z7b&A7fg?rOQ|$J^ijtSPSirB}NXHSe?DKEzyWmcY|(T-=4Ka~~vI zXT@C)3J8C=l&44~3H6WF_L}uvUKUP;A_DDE7C*iJCUuF}V6}=|{0tF@z?6fJa&hPR z@y=?E+mvhEYeJBp{NgJf$@=EXpAKfmM*S$0aRd@;-fn?dvU-nFb1JXlPJep_OfENpPS)o;$N3)j#sL`aT;e*~sa zyed|xC(X;h$X+wOkiBU8>(>Zz49)>ZH&s;+FVA{=*kjsa^&NF?thb#T4Rh<6_F>C6;xWipqw9SUAlJx6r zCl$mk;gaFKo%r87mByQTY6Kc{y>O~~Ga|-s(-IZT^GG6hF(4KmeCcCvsldINoGMiG z7=YT1tN7=bn=zu8h^gXcVvq5&4_6Ruvdf9AEePd4vAME!k1SQUX9{>)OGeu*&rht(3D8|m*ZSHM_lHiACeYONe25)}2C;oK5_|M;EE&2GET5N-TfO5gL zSx?gR;I(u1q3G5Hne10j4JteciOR6&VYRb=ljc+8SwAK89{%a3)sJjyA-i=?i97aH zztKecC*o}{FtP^RStD|Rg&l!$0N3sbjEgu>1J2@*R~^6qN(0am|9cv7>2QCLOkG3Z z>T_R!HGnih;O+-WdJ!aLu-U`ijc+@MePVPn+^}L7X(KU=L>_@=Du+~ho0?SLBC{u~Nx2A=Oy0p<$ER#qvtFyyYA&?_mi4Q zy>k7i2=> zWNO!TKl*nVNn(JYTH@Z~;R^O$jJAbB_%kK%Yt_)CuWzRGliQ>qHSni*8vzZls7qfL zk4TBl`~NBZ3#8(-%IAlwmi0!Q`#0*2l!eh!Z~5v$04f#+S-A8#EDX}8zL0FgWPRgIj9+{WIn~2y&ZDWDZmyo!-&LDZ8pIdgoobb`tEpW*c>f z(l$FFv>s%!MF?QLaABa1o^A2ClKPrqCHD%P8XTvK=+dJ}3s7h!Q{(W4D$> zYV+-+cnl|MMdjAL77aQhg(wgZa>c&qe14YG^yyyhaYMG9D*x#Fx!65Yk49a!XHL&C z?W)&nEoT1BM3GLqbB_Mh)NRkK!R0AVsXLEJ6_i_BS^XImBz#e0*Y%qno2;?KQ&SK% zT@FbK^xmUh)1=bgVh|b${8mJPH^Ew9zi-TRI5pv$Mtb3F3b- z;Sc!lzyLkiNkz_i)N?k2|`gm{>lH{G&Ve@o*l#+M1#A_ zA?G>w)50U<#NE;xsEJT32&GfisDHGyZlXMIid`=hfr^#+Ug1U_Hgy5Z>zDAvf|DSs z=aW|~f_Y1%t)be(PEw^RIJTJ8iCi=eajzp$wkkeh&9z?jN3`M88COQsmIBUiP5)a; zT0+5Gh}l}++Pipa@10q6#r=!r!ru`dTOC8iUG>(gV}0tM+z#MwCJ7>%gBL4~CHx2~MTnDUo~C+TN86MIuuKPCpV(lAmq zma?&@rjj;~qzU|X$z@EV-Q%A1Z$4;X4Ed`jv&>zIov#irph{VRNe$0E1IBUk|~m>EagyI zBhHm7PQzY*lwT%9j?P9i{*2z>W#|gDj`0h*DFU_x2z*RTU2lc3qJ%R98q^jkiQlQ3m;0*kQQd|geWIk1hYkQFP!rN|{d*;V zwc=cK(%jmLLueXlF+_Y%Y0z)AYViK%*oo7%AEQF=y{pm%=Nd%L$H)9`Ku!1mf0)V% zv5?y<7Y)4k)#Ukjl1HR>(<)c4xIpe)E8W~rx6>EG)pCWuod z9?pR8FY|NHZ=gme{gw>$y!(uP%GWXm>RA?SwdU-HGe-cJuUHCfYy3OBSYJ32Y#pWW zk}39|Q#fsp6!UO)m&VS~zgh2WF(r{n0!5D>c=Sei_W9ENI2eInpkR00^jSPKmgshx_>n`DMR_*a)-G#B(52&5dRLHV zV$F$V-l94KDC{pr1Hx2m#@pg3aA?T^7CEqOerQ4c5x@9BS+UQ!r1MhdmNyQYwWk_m z8rQ#E5YzB=5)gjKbRJ83R!e9gm%j6m0mix2j>HvZ!a~{W--|FV^D;i-Shw;LB|n2g7Gn0Gv-5 z=Te1J%B*${7Vf!Bd#%|d6gd15qy*}%gyyl}Tv$3+Oak~AuDrbTKx`1Z6HW&aCsFnt zK)OdXsd>%X@;cu?|JFvHX+!0&A5^{HXmYdKAd7JoUxsf#9_sjl{3+l2@i1}hfE0#6 zCd3JLbnnt#P{-5~m)%IK+%1R)hjWd+B7b>6bK-krwCt&$-@$m+O`meBo(jY;g-W8r z5h6x?XGfqZ;cL>xjgtx!#|{dWk1mLS|IdrQoSDU?u(f~&>x2|O_JKf*zh9p+obw2N-fn-AyFq09j5Y6W-{bBf4I(kH zk_1nO>Fv|#JTP#05aubRQS8M**By{OfJYV1k>78W17rF)C=n7JhH2%sP75kh4ftuu zEGrQ}t5imN@jc?T8yMV^S{wa&`E9^4jPJUCrF6yB9Hi3RUHYDlv9%iafX_)+>5-7~ z!&?qzBbV{$>raTbPQoo?RF6d_X{us$w|EnWt_J%QbO!)jdi)4*2T*~;vNXRB-cIyE z1rEOQ?b!%=n)b(tJ%+c3f;gJR#dl7V58ffVl@)KE)`3ixPm@o-Gf!8MtrOm~QuPbo z^AA0`JwWS;qFRZH=IE%|iZK6_;El@; zbH)P?4@bR9-H4*FZi*4Fo|q={~OU}*mV3M^KfIm<9H1jf_o z+e~0fycS_&-L|`kTWtLkGdBU30lkR?Xx9Bs>uRVP9^Ny_Q?{2E-KW# z4RnjfW1?NT#EDb!h4zn}PLUN)aBmkz-c3THu~6lV{p+BsVe-w%5CMJ-5C z_R+l=c$oh)Kp<&|ceDRqi3q(4Kc|Leg_#21cbeDXi}l2)z}H@VdNU&%WwC~_h$@no zSRK(VBsyAyJ1C|=0o;a>+0>1(L@98?k70m;5U$$mTX*WtYz{cOHmMVo?j94yQa zGZe>_%?#gsQy$U0vRT~i6uqVYB{4;eHi83kH^oo?&iTD9=L`%8>cHw<7G#W624R8Y zg32MmVd97T%Tc#dtHLgh*ZgC!98Z3SZ%i=G%ln*J&p}FHaU;y!G9G+DtGyuCl4^v! zc!VVGgrQZ(pf^T@a#|ibcnrx-LR9&$3n_xt7c=ZgtgP@(h8iIe&Vt232l2o7k2e(2 z#_LGyer?r4(-^MuusnwC>D#c*6Pjdm5oq>kygmp36-0k|&-blLDlPwr<-AM26Q zo!WwNJH;mT9SzZq6=76>ry{yTOG{QHb9B%@;!JMo`z<#mQh9-|Yg4!9H-}e_+2AKK|Pl>cITwYu6zQY{%EsMrmO9MB%(^cW70|^5u#1n<Zk!pKwgxQ@C4A>!<&Eb~!u#3mf6B8T;zuGtgZCX+ zvLNdJk@DnGIpOFa0EHj}dwKpVdvTB!@BHPPc@PAIYPCDxaua9ue^dn}ZH<%i$jodI zTy)cK&NqtNuRzrugaFW;ctLL$Oqa6Ug%~S%X7Vr`msPU5oOGBLWW9c#H+lVGym4_i zz!7Lt(67!2^XxY&oUe3bnR*sriwg(v7;)8`k{0|9v;9kcC_rOmwds#z_smIcK;orP zSQRkU{^;ziP6{7?CD~|%PJ{L%pC?<<02924D<__tTO30ySxQf%T712U0$FjZ8g2`5 zw?kC%Rms(6=xkS|#84C|F}1#BkT_PdGguP^>`pifcfcFBZ@EUEqtH#1sf`%z&(S9e zMvKW$a&vd$BH%f@^uc>JaRXVg3&jZBQ%6P#&j$1g0oeW|u}dLsw<{z)=nmP=88sZ` zYdHRi9^T0d(Ny02EqAt11NNQjDJnJs(=C`WI|};ruEUc~W9~GctRvo1E1K5v2gPWL zKbXNG^PXY~sBJHWR<9q)HbZq#RZ)5Aax`5-Wd4@@4y!-W2%pu#SV7hA=pdTV~m59*Uwx?5=!8J~oma6qqP7s--OT zr<++_@u{}TIZ;Kf!z;1N=s1~z!x91VARSo;+Al(%4^JItQz#*AqsXe`_d(!haW2Po z=c}-{=8Rr@D9G-Y07pe;Ihi!~W_$}}uOs#M?qU3>fY}s5@)F`kLRiMsLQCV(d~pJYYO1kK8gMw#Nwu{RG{n9rRk*$F0;| zl2HL%1)7{wr;<6E>Uv=qj}_;W6~nLC$3nkx{P|Do zPJ2Z6-A2m3z15l3oL{2yDJugYX~7ig7=k~puF}7uU!dAui2L7qjyWh{4p-Ysb=Em7 z;emSr&ZiqjXF|G8D(`pYE`0LQ=1-AHEfURX6$`?Eg zLcNj%Nz}cuE4BlTAFpi{sPlj6Q!u%!Cs^w2Yedd&eI%^m#GS@6b;U`U=U~r6TbxAS zBC?i&z$1T{ZXf~1qcf-z%TqivXmF7Uo^~VAyu^O6in&Pg?TD>wf|urs-+oUlwH0~I z(Eqzv3pp6=G8F!vxhi($rF~9Jt_0e)k1+lshfxltkaruKQ8eqw^T!1 zCmVxu`CP0*9pLy+WAA{{l|;Ts3cDV?xj87g=}jfJbmvn5#XsvCjaHW3)63ZT>j8nK zUQ~FME+b2!Y{kqarg2>!&glZ~=-&(Jj2WPTt;eHC3g`=Kjg^-z+s)h->ny-IaeDnA zd8|m3YeQ>HMM$x?HVvarhtpa=tSuz;m>iq&Ef`XSgh(^*H32s^FKN0wL)^Dn!m}~NXcM=;3kc80A+AUh(ggYlLARs z(?gq9ZPAWYMr1B|*`iUE|2~rbCYj}Eez5maxKSDM5uJYdt?!ySHk!5p34}i)M$;C` z|M&yrv|-fRPza_(?0{GRk2#E^MXrLFD0B3rC4(7{{x`F-?G!WdlAB2oC>^iHV8bw$ zTIWqXebOv1L{fhiHxsc6SAY%I<3jpI;OOH*)NH1HYB4`atj`fhg@e3`l~Ekcn+eT4 zsHg(s8t3n6G{4`>(=Yrcc1TH1hsoV&i`-Y6jL3FLfzRKvL03JBvBOgzVQf4SH*-h( zr3*%+`O@g~!pa8zfi3JmSGPJZK~|9m!_@iv(+@EgjyJx9F4CpM!BTk7WC(Oz10cyE zLQ$T<^m0RES6Oiht9GJscC~lxAfYUZ-v{N;PjOn}-f0^rCXl@SuqWg~@5CP)kbMIf zOyMXPkj?70Z6_d^7%?mP=Ee!?19-L_50P>ris=PaQP=SrO&&H-B_+V$OE)k9Uck)| zVD6$wjzJ;6qTp_3v?eyX?TtVRUjDw!ncfBiR|pIe?AVMuEji@TWx%OdY=MLXcox3< zE?HK~P_iH@_k6zS*gXOJ^-7{6fwqQMP3lsBmV#n)nDW>y0aJxHd5Eq7k|R&b-xzRr zZ&tEO3ryWV)}WamIB73spPiVJ$n!UQVO03caOKJVPhvEzErw)6Z`nGCf8|)dkEcQk z@VYu)b=$-#Ov5=;mpOVNbt9JmJu-xHS@?ze8XzH5-$-YXbf4}hhoHRSWa`wdcTixzw`BKZgq7h)$JxAy$_dy zyM|Wjo*4e~{Y7324g^{f!jPbDf-Z3)rixiC#hoBF3l6&Uzv*7K10-v(qWB*qp^8*u zDr3vzR*H={{sZ;Y8rsl}M>2U)xw9hOKWkl^kuIE7s;~Yjt5yP#SY;mm(}`$L!sBYg zis{7h^KDoygz7N>PYEw@><@tvG_D<%2-BjDBDXnAi(tUek~7{-O$FdmH89jiwtzew zqe6gBgPnEZ<0R-EnKTf%Y=XIPRndtzcK7SQ8gth(>b`j8KZZH#iVQ0G6;a${M#ZC_ z9U1$)`82kn+DGXYW~P_q+qDGkC0&YN`ieI06U7G-w+_k4hAIY!Vr%|a!C3`l?d2aR zFYhzVG0l(-yas>`Y!+?h%kbr2Q66}c{{;Y9aI&*LvgUt#@*3z>W0C1G!BVmU8T%Ri zH+wW#pYWqSS!1n$)It@bTQD$OH#Yj5E%zEGZx}yNPBrC8B`io0 zmUxRmV|4dSvA<2x&!6f8gE?pLSFu`4o>o|pleysjQV<6i_7>6=t%xePq?G&2+=e!% z0Q?(AzYaaQm2@?AXzi{FIN9Ari9$;dm#JBChwq0(jHbZb5T`5hFe<;qFL{hPYw|sq zWiltFh#pv?e)~KE#R?cyfHOl&JV~1>LFp8B9z`&i&zCEDkzaFbXkzCA>1sFQKcX0s zTr&V(E*R}-;(+O~cuY#Dw}BU|{mOIQh)eqrU!u-aMtm*?pe+@LF*HF2GH_wVo# zd30;QfJ;tLsg;Rlxd_5f32^QQgX)9f-x%bFKuZGU{0BP+yELsYk&`@p1#38W++JAP zu1%FcF03#~M*{{7=N3HIMtsimsSg$v9Y%-+?n_4DQ>8f{k&C#izvh()@I*WWKoLut zHncggk;lLDch0E8v_o5wSRM=u^BGys*)7Him%m^T{Va_37q+0h73yJBxBjW=Cd2!w z;Gl-4m^QO`<2lGlvda3B5y}}?A1PBe8ta;!|)W*68D(J!W)tPz6#Z;Ak@HpXmxG40`!(-2UJ6C`WsL4@Z#XcBKe!_itl6C z-d}hQNHWyB?nvBN;yGx_J1y*oF{B26lIEfxB5SF(-XDsUFa9BV+R&Wwpl^qG!SWpb zU=IZS_j^Mt&v%OJ5}XdPpBBum+c??~@ao)0X5tf=SAEMw?W+HLF$!o_@BEf-U)vs^ z&~;FiDf^DO6$N}xQPOdFX`#O)J$t(SeHNc`hvDb4gCq6dDtWvV%6ZIPdaiNnVn@x= zeopjrAg&1F-4Wv56X4W7t9&mBP`ASx%o>B|GWo^~R|(^T#0`k#^7)m6urvPy(9RGK zN7df5bP6qM4d`ttn1Nm5SCxgpM-^?s|6JVCLRB332-Vl->C)P3W=Syj0-zYMNqe8r ztMW1l+C?y{UNBfl$)GL(xBKUZCSkeFa+QLvlMSMOU`WRCMSK%K$v`wDN}on_ZtbQj zpZn$xooQX-AO)9~g2=`4Ym$1A2q(ck!R^8k*6_MS!!f51;fwgw{+A8`41kV$>WIxWbI)erHQCZtlMj^#U#(y2N--?GX8tm|8d%a_Tok)WQ!I^f}R7tna~n}Sm(c=C{l&^&#UK@zqt+f_APTr6ZuCA8Yne!NMcrZ zG}qMqE=cJ_5`XWc8Y1Q>a1AD9B;WS}!Bcitn8y{PlrK=0DC^bxU30a!8K#)HVZmTV zwC5eW2mLS%8uHVPBmfZ>P~MQONRvV3NEF;A>GRlVK&np|$g9;nxZ%SL4&%HzDR${_ zMlA6?)S5%6EU*q%%PFV|=#3xg&F(_o5VxM7k0e$JwpRob+rE z>{oPOW_9Q1X2O&azWkQei#!w%Brl&(e=UOjc++fwn2G98xbGQn>55V6vAUJvC|~ZavUlh+jkb zWdE79eFui?)OzzP>|uHcl;6Yw=b!FLA6P9pg4++KM!V!sJ(9fm=KWu+=GwDl(TNFe zaM8f-BLT0HmK0y~f5Im%_-T5ItQAG~n^m~}b)PH_wx&H&dv9Ww<@`3`u=!vGgi}$Pb}iIa#`0-{CaImrlhN&wAq;7F40hSomJ3trPZ9YwuPCI|L*ByP zrG*XSWx&WiYfz#jUdg4C^8h?>VA<*d%O!?+uFjm%2X{1Wx%RE}b<9n9Frx^S$08k0 zDa`u2w|aPTCJ^k(daw?h&h(GDb*IyI?CI84dJ;cDTXg$Y6Jm-50q=xEP?hS$LF9Vp zGrLVwNQPQGBQv%f-hMxJvOQ&bexJ^xzPKse2z}j=970X zkiRKWw`RB5u0(wC4Sl&NEFl8ek{UV8~9^D3NNTQnds*$kO0C@wGwWfjywBy2PfdhaI0>>g*kA}3_#3TZ2 z3=lu9G~pQH&{D^lAPz%~+VMHRms9#~%**QEYGxI2A_p{3 zy?k_UgroyXFTabb;@IP|S%@q}}83O~ap31HoaNW7A z{ICNLxhSh2nmaX%P*9Z(r_E6~j+u11NFO$7^j4puVp#{iZewnd7;YQBxatztbGSHV zLaw2@X_=!3G>l%m>I)$%Nfo?JCf`q+d+&Lr@kKR|G2nEet>x6|>dIdg^hdoU*XMaMJyh_qm>Xw{Yyj`|h)pgPPNC-WHZkj@k7;hBHmZatn%P>EEM2?w4~N;7&hq zzZ}{3uw?lH{dp&LYV{zmNIfv)E=GGGP-eas*zfLwrW_AoEQ@jm3<9ZQg*;3jsF-X` z{v`oW`C$*>#V2)&J>c6j2bJET-tNdz;Fe>iO}urvgCg;>+`@mg)4QgQy40Dg1|h1U zv(RAITLb6BHxvaM4NjZ*h6z@V@P_=#D0$P!JP^FOz8`QDJt~uB4A-b3`#@6b(x^&9 zpktr)hgwzd1bQrva;MXeS6uiKY>{}hynDfOBE*3%wgf;?*KlbUhFD7f$@8_6U}&bya~AgjFm3KP$SGZ zGnlwT^v=fum2WYOhd;3QYH^F{4`_fQNrMvQycx;OZ8o&f;uR?ZV*1@Ae^x(#HW7D< zV&*ct{-_^U4>%7>;6jeh6Yc9gFuOb+gnC;>v?+!f z{GG)jR>~IGe(WubxW47peKFczQNot5rY*ZHik96kOI7B-=}_KZ?dgB!3xE5me)$fo z{$BstzvBe&Jc}Awan$y(;>9=c-6fxB&YgQK1MVjcv#eyp{FXv9C~H?Y(hoN>7_HMt z9dy^c=HC8yrc+md3vSw@=`VwVS48tdq*jPmf~I1)PO`a)v{a*jL_n)6HDSJAVM2&K z&GOg-vzLrF?P@kl!jKON&Q&QRcspnmA~zvjgS=-&@*utt4QPOoPuUIJlD*EI&Q*Lu zte5bL4_Ag|3a3UBv`vWb@}i+>YVZdc&&A*$)hN*gF%E(&6h*-3TC0a_bmj5^pfxPG zV6)=jb^;PQ6tA*J1^x|N#luIzxgx3mvAtk-+qev#Nd&&jrk}b)hl;EpP#lA4R|#A` z#KP=&?vpjIAKK59@2(74L^OTuGd6y6N)A=gtyzCeQ|aF5(fhK5cEf=e_nU`)ydSF; zYY4WxoYLd*b6>6*)oO%m!j@Uo4>!7I?_o6WP}M|)=5wo*VznbW|l{h!rS6T2rFMt(rQW&?hWdivGu1}MW7ft^=$kgHd= z`#t}#sc>=>V_crZz4(BGwF&Tl=ID>(#KHufV1p=2QFF4PJyVcd6JwvFb4) z;ZGzkgrZqoz4QEs1ENM0BaRpkd^TZ{PEqBdy1)R5Pep8M#2D}h2F3E`52HbYy~rB& z3TwQ8M~AuNca0+_j0@ONx!(J#&Ys$+iGt%EU9L!QD5wiC&i!d`E4A>?TRzatjOvZkHoySTt>JWW$;ss6j<^pM`sqcDwZJDs>L6qX-Wi5W&M zZ-)~rFZE*Q{NRy7O{~3`FA#EruADImGOt~R;=YiJuBgr3ej&UAU%>!;#4p_L^lIX@ zR^ITCKKgRb`Uo%XcBIV)WD2tSHL7w6)>2W_^g@fbwACjYk>2VzC7sUFVwO<}9hTDHA7Fqgp z?#?;(`){->S4Omkm%KBM|Ex43~>i*tJ!m^<}x*R zZIGk^^K?}@ntqn1=&vlpWjSwIrZ%(;{#p9IQq9fR_-bz5_Jn``$cb&ULmp)?0CH3J-(J%I6#H zg;NJ5z&TT|MWd@$k@i$9`|15UyAwy%Qajl;8kmd%;&H%OmxL%dR>xKy9`m@dc?#$g{t6me^FnxnrtuDWU*Kry(52uw4`((QxL4sAfUnq9% zN7mu610&rIVzdEMsRaFgBf8c)xCtMLPjzV#6@yHt*F}w5)J$y(Rb23M z=9=Py8&^p17Sd(|9{oM5AOW0U>gnt>0>v2~0OzTWzFtr9v*{Cl%Ya|cd+3tuD3xQo zLNN%XMj5hE8>FR1HYp(4bF7L?U^<+f|Ez-S zuY|>9k_7cgzp)G)M#@_-QJ^KdY<;~I?Gr_U{rvv5HOefl<`UV`lrus?B>~Xd;68$x zTYmpQ;J?6DuLj0BNmSVU(TaL^k8i2yYo;V$r+bg#zh<0ygon?*NaasZB^nE#7&YLz z{HIJ+=IgMmeew26RN12_>8&be)thl#PWaj%u~CP6}s<$@!n+WCBy-SjH2TYi21w+TDU=GNy)zU zv)E4N?6nnJ4q;q(`0%~_A;oGbH5oJ7EW32q7I$ezwf*Rysp}S-M4@+kr4(0d%|1)D`EH#$OR>n^8 zrcxwj>`DvTP&7nov!yIy?g?crTT*Xjloq9Im8CGqu6I;K$XHXdj%D__f5+$h`>(F6 zOP6~&_c_nk^Z9rZ&N9(15o+x?0z`2qfhRNrBjdAl${}A6c-asxG2P2!KCyRZFa?&i zgFKBqed6$zT9{#W19r)h*E~@a7>5jfCA`onAvLH% z`&#Y?5vusY1sKHMgBw(NGskNbv@J-8lMF2IBUh^xa$BQ<c_INgpnnyte@it)NHHeaU=`ld_eY3pmz@4W`Z|sn=bpxix;?9KZg^gGow4wy zCda6hFJ{Yp&R3Z2FwbjSu8Dh&@%iG?42w9W`^9V$p;--fN~+dlyfslz1z__tp8{@A zl%}w@WuXwFvfU)BB043mSr3o-^l6O#exVX~YhtX80(e$zo+O-pp8h(sA zog7iyJT!kqv6VEKBnIY9x6?Ytk$MU-iTDY=J+M0PD0G0!9Imo&NE95BR^@FzYiYTm z9Ws^Cbz|t8L(sU{S|f$M0Kj3G3lUTl=h9Y?DSZXdK}l!8ugMzB`+lrSDtc(j1+o@Z z+ev|&9GS0eNOI9LAH)tU9s|^Q4O|OLNKQv-0a)Z6-)Jqaa}qVebN+XJjrGiq^zJ7~ z?y<=kCm-(nZjKzSy;zV^o0~|2H3q7~zV5m$#>kq?^Yhbh#+?Ox#JB62-Y{XpL;si??N*fsUgY2iT;*lZR zMS=cYc%yGf-T&PpqOn|C@chHQJe;Oj}_L}MzEin9FXUlkh>a!C_$}#oP5?h$l z_y_1d$Lxe%($-W68H-m1LzR+9F>K~qMrEp$b5}uog45TIy>&$B;!a#@WfI&1GzXqU zX!0?VyW;=C{B~-}bz^;J5`e9&*PJ|HaTDyD(lhhB2t1qL^z?7U zIN*n#1H9!dJgnRmMk|$L(n-1a>7`4U+KZ&-&dU%|$B`?8h*e_Los^bo@lP@1#1z-* z@^Ie#zYA|I@w=`EJwCWzAoIn9%VFzks2x3uQ5nMW@UJ!mm)GoNN&O(imt8N{W0HCC zA@}=o+6})F-$v6#nrc}}r-{Qhku>L1k4%k>KeM+}PkNft#Ue(tn2YB8H-*Rqn?8iz znns!^8sAdJGg5T5jb*z->NlY}o?)oEtZzUH*{FvqcbLy#&4`==_;e`c0*=Wr>j+p2M`d%cB2v{R%3(cE zJW|54WvAq>DrQcZyr)z2yLSmO_ZNw$?pb4M)S?ie*R9}xdxIh z6a6QLc1ueHm}%P#{0gRl+FDlzPp99Hzg9YGg67Y+^jZt5oQ=~SzUlcT3x*=Y|C#T( zd{ih3S!sb@<;%$_&ii6hQeQxGj5b2wN1a^ShadO*YT-u&Wlg>k# zE`2~X4{q@?kO4Ycf(2p)tl#p@Kj&D`DLuVsWbO6#iQy=RdqX2oZW+@1VOu||0;t=T zlhv31JubA=nbEk@Aku9t=cjx=&a-o;gAjJ9J~77ZN1V#p@)VI5I&}=|y`xL1swST% zXFe5vdcM3rs)yrHr1bRRW+vmp1N#{9uYeFUw>NVr8;x#RZ%KW`6nar0;7dgdl#myDpH{I2H?o` z+Lx4V$C}*@@V_yDECO@P&*JG)7Ioe^Kd>;(bB%^HX?pA!T24LCi_DT=q4dj zdn5M@{=Rnd!L*@hvRkr2ey1HpRobB{=5d)<}mbP5|fz9?~zt*CD|aR z(5br-S_TxJXCT&oXpwr(c%;=Ek=iCHJ7}>G8pZ*AH2g1AQkfUESP_>B(2nB6a1^D% zB*HnU-i&^CoKv(=ySQ>{6{yH%w1u;Xt6Y6V_fH?VO^5{t427!g^kMA5({zUi2u+lH z*9eb+yX!h1^D){PBEKcRl>K2Z6RjVo$I9rB28^twYO?gMFwNB=(8li9I?YM74H16N zo@3%++YfQ?7vul&Itsjg99_bce=vF&rsG4icsuLrmsJ@9!SQdlGD<3s4zqf)N~fzm z%ma#!c%N~7oN{`U7ZI%3u?<;$o-aee)E=mmqmmap&6C))L@?yy3+7}j@tBRGZ&%V3Ed2MAFfxU}!JilWi;b{Vt=C7)4*?{%CG*L?fYz0KV-c zIp~Z*6%Cd`A?2b_s9d6yk|aDM9xxUuhOZU_R$RT~T(77_5uXu(> z`uvR{30#@JVZ06Cp6Z*f(1J;Ee>2+zuE@y3-$qge4wOru7Cci+`>$f^@X79Hr>ziM zP@60Q_qh4zm8VgSH$S))i8QbH9E1AxE~Fwu!3G!*fQrFfyxM~O zaFBg0pLYY3@X*4dtwuAUMsj(FrZf41H#`sJFXWbeO00!evwU-tx)D&qQH3Qejq; zL%f92W?-gO$Kn3|>YmkD@b<}Q6r-{KZ8fK{AR`XToTQ5j&p|@oW1=pM!?eOP zU1)-%Y>p^GXxWV;CnAqB;IS(ZPdzDYeT~-Xg5J)@MY;v(?>Im18$cCB?B2RyEbj6( z_Ht-yV*(X+|R;j0S1 z(x8_Y?|}&mI8~;PTC{F|q`6^E!94ViB85w(~0_??k5_(bDbZ6W9F-1aaVL!-)Z30tc$W{P0fw?l* zZq`aDAZK`lQqsoo{7Q^uW?OOB#i-_*u^2d-8?4>vDtdezEjdh33%ySGL$I1!_$!{u zsgR@M3eXi;T`hznz822roq-8Ppc%Cm6c4SWmun$xk#jvfSvA*GyB!VLomF*zY+{RN zY~g9eydq{%Rey;~!5;0etX zp#@EdMXn0r9})%;BG&uC1EFdI<;L!3>SKrrD4rPjejf*JE$VQ{tAUSM`eI_HH{Z=H zT!~uk|0||Umz){$Rs*v8d4-2@yYOkB$3GupoZR{-*k@xr_e<4&!9ffCiS5y(Jed>q zkl?6r0}Lr~#Pqu*D`E?RlI?y;!gw7_hD7nNnx2&d@!rb%f|rAo*$y2 z`!!%>1fi^^+T1ZZD6RT=h2U0%0}j8l>cW;?pVA-DX7!eATM8QVex#JT8&DhCVdD43 zk=3hKCNpv1O*b;4jMZa2IVDaCPJ^LI_n{0v*;)r3zpC+>@X5NB6rbttK1E3R=_fqE zEQOAWSUsOs$`#c&R=7@< zRv5iflV!ux$Pbdry0ShzJ>2%&@h%bnH*#Rgiypo}n9Cp#-F$K+E)*(v;Ey3pXIsHW znFuRddsYMSj<@{E6uL1&9k4Hr!%w~~DeFF)PJ2p+&|y*oy_T8MY+FuX_^R zkq>}($m7oi6K@mEFJ-h>cvvOCsp+sGYdSQYZ+2W|qzAJ}bF2GxE#4Oy44ghddYs*L zOIt}{@^RtnyYLRVJ~5IOG@JstP~rhrRQ|^1i5S)>=6ci`top)X-yhOWyBn%75J_Dn0G~J994)uo7Su^xDm9-OQ7f zF2+tG0AI6NEcE10+M^rLr+@17={BG9nNd>70Skd`yg@Emqveb5y1#k9l#V_Uv-+(V zpwo7LGpcdv(A7}tJ%SfK;{RXgvpEv4f2aIrbhJjDqbCu>c2D5ik=(wG&o*R@(Qkqv z8H*DFVjM69dmqo163Si+`!A5n*w(^*Q;K)dDlXa@aPO11SgkXKehD?fghI=c{$Gf? z)r$`r35hfX`TgiRO`+nC!F#K~&cPghzk;g(Z7SOM&$8$-m)b)BF@QkDnff^_b))2P z?RMb#h^~{OiZ+#vz+x(91@VKrjDc*E8LZwCSY(2cNb9ceHO0q5ed4~7z z+27HV3tdhN2D|q{-o~I@XCeZzL49s(} z*w`LvFkl3n1hQ9`=x~YE+`T_CCKb}PvM?5=$KMFZ@rYM{8(kD^!zr{N!Acfhw!*pv z25(yX&j(B`b{k-SQ~wPSl8qnRNUrcTU0=IOOAz5oBHd6;SoW@Cnx7C9O-%z(J(jZ7 z>lesPL*&BAt-e7tOE|Ni)*kXWc}E7?JUka((!>Xisce^jaAr7z;UU?}FW;@4b8QzT~z<*k+0zm-kL-3Y!A8rh!sgsO7r(lkq{fQ@IY7 z$lhx(z)@;$v;Tta^4379D(Dru{E(kjGWqv6J?`D>;Dj2*i{(0#gj)}K6hW1(Pe~<_ z1-DV$JrAey=x?@ONPd3v-*U*F$n7(5zOB_jmo3LWzyW1_NO5eqfV9wIO|poExOtIq zVi)Y0l+Qri*(tXC84Pt&!xOF>)F%%bA`&Hl#U8EP-OYYD?%Q5>>M<0RJ|pih2@*RI(w7!ttle9p%-zsq zWXqk@6*J*IyrCGdy(jr|lGFw#1F`AL2Kd^GBj@m*-t359tmqG-4S&RT=g3~MOMoxg zhX(~rD-HC9{&GRDs|vuin*l67;_i}ED|}4-=Xx)|%EB!#hfcMZZQi{$Dl2sNL`clC z8~46lQ-E623CqQdbYbdZeaEGV$v90%>F5)G`n=mo@e6|Tj*-bsRH6KCqk`G?VC;77 z1?dmqxFtLHmrrlN5Py_6_HqCE2cx>Ch}0s_^oKo?;@zd-xO&HIv;_1OnZ@4DdqSF@ z>ejjCnB4`vkEI!2{;jH9qldk!Y-6yAWL7!uv7 z{l%2Xg@TH|jY4UlTXu~;$M^@PW5ms4E<;#Azy*1WmJcs4LKNqL*!zdr_mkLSS>FIV zgbMwY5wZbGl~MB8Ef5u%hVa{GR4Fepd!Do<1j z*8Cz4>Ja@)e{ZmF<#^}9C3b^g<4j)DHHUmtox(Mk-wIaChPf2)4+^SZLC5+QT6G-6kq+&w0WH;zbfv zJ+|JAkp?3jm|A*GS6st>H=-q01)l0yNBlN#pE1bVN}e~MLiR4a<)R_!BC`e}}RkN?Z-lw8^2+_W)0=i_#L`Fqdp7bWle z?vC;CnvMT#&B?8i*Jhcxe?Hi7U3T#z6g+J{Tw@^5S7WBix1e+8oH@D2!5azH-AF9O zP$zgXwBn}H?2FuAA7a|yCwzEW(8>N{-b%T_+Y=Ek4*1uA28YnLjM@odV4!VU<}%p@ z%~&*YU}~M|Ce3h&Sc7u@$*47$f1%By=JRSM34Z2xu2zkWG{m{4p&NOwYRgy>3aiOghS9`a)j^2yw`%Id(6@(1UqM<`6kSR-cxnnghwR@uWSt0zaaK_I_8@MV%JU= zpHE+u?`*!^-9mZxN5piZCnOmq`fdI9Ar`B9v1&HexS>+`z1ZJ3{_zs5nv4Nz{P`|Ie`rO=$jD@Ljov#KkPX1{k zV@M3T0YD|=q`=-T`*1qt{au zN61dzX8pZ{N-l9P$Al{hHn-Bc*V!=%5W3(LO)jCVKCa!tvUf}UyJl{WoWMd97(nJW zV7!OEoz3i<`{@#xPQ&&P8GqkJ?)uaEN^c?%V-tTy3!)Zlz8`s(NOwNo%5g{ilA-qf zr|@x2eCk3@YsIZOy{<52$`X`H_#=ozseJ8)YFTzf?(LogB(P{DlI(kD%n*hF>@=!E zpS4Bau?1ktRFag@nB9Cdb`h5GmFqkyO}zED)K4mU&5-r45`|T zhP!vqD!p8r^j<;~d@+v+ImX9m?tvw17ybnnJw3DfHDa`hn*!}$#AclUu@k3{?}YIt zNiMIy$TzI&dF;P`*I2)x2MyG}nV5AC0aG*B+BHC=2O75M%?E@*uc=Dl0G@+hfgG>F zRJIaGZ3$Jgz+skqaR661lw!Z0x2{vHoL?{ohU{&-bf6DUDA`Jz+W_VFqR|5H-ioc1 z>N$qY?Nh{|o`-BR1+o4`XogKEZPs}P&vG6uNatQs1{QkT+_;Le+`K@b`gjt)A%Qfm_M`dOk)vq%AzA0^l`|(5xHG zlh~7G-O?W9#;txB&C|9U>5%Hr_rCtnSS^Zhb3M|zkNf2qnw$7e>6=qj;nT#D`~rwd z>-anHn7E%LBJQZ`Oc&kYTg*)f=djMuT!`R74+z`;MfOdi>|(P8Ju5>+Q2qK{Yas1; z^uH5pwt?)Vg|H`ZC+_z|;VRd4u)XUImX@ixKk98ZLoDI2v{KqTV>lq8!nD zI8I8U6t*u(TKvjf>H5i*#3(&1*5im(=J2LepFkcpIXiiQZB^;iw?iZbs+oDU$k!nlqc~^MxgK%eo$KW)3^Vmy(GuC8hxk^+OLOFzBJ8{=>7oE?2)i}?PX-d4#tV)Y+O*S=|A zGqTKIf{!-Lm6r~P!c8mH1MK4}OGA6{mLJPS)HxIQt0C_4p1SCFm2!?ZM=X_ZHxvw< zJmH^M&xrH3Fo@A+KSHRY$s+2XJ7^EH$Y-jv_=+;%k{Y-*>iup&8@+y^*}d-+oN%m$ z8%9sZxnoha)7tR5FZ#N&Mec-_ey)c^CNs;uq;H9+O>zM2Lwxr1PRzRNgfA}n%QhQ` z3w7aW9xD;#{tyq8x$-R!`#*fZklRFE@PmKT}2q+Zd1gqRTuyIL$XuRg{h_^3enSW)`gi-L>cX zdM|ETvZoF#EQm8iP6#daga>3tFN#p5XOq(xJxUjiUcBD@?A;sFJ>{%7UNj8dzAB)` zAJg|{sN;VG9ysuqSvU|MVcjLEM(BKIdg@PH|1#$_Z>Hg=3+il_Z*G6SDFLS3L!0S6 zlZfYIk`yL=s3Q=jQWotY0M_+EiYiWNs*SFs=e>}gPO9f77m9XnJo(?FuKnTmoP7UV z(&KTNs0pq<6*0VOL@vu8WR!wgypGCjz$ET7c*8tGx`vXpd33vFT20#Wl;fIEH7=Uw^ za~f&$>#j+FD)*M1ADa^Z5ahT6C#S0ft29&wTHBx62u~bXj8g*;b-n{iA45n+gW4^M%j?xOoi5a&G#NA2nSn zHr`5-<4r8*7?@#1+sbLrEbNELLBdo0Q@i*=qJ z(?}T2ASgOqE1Zx5IqH)i4o_1re27;1tL7YxU!HVnY1Z>LN6uIAxZZ}ULVYv_HiJTT z*G`n^^y7mmP64-~L&I#@&@@`boOR)%uxFxpa?OjoBNW3e!ptj7!q-VC1h2$kWev6H zsqIFG`&dqg3CH{H^F;xREsW=rDAN#4~YC>@T`t%a0-^QaOo^51=xs!PX8!yxQ=AQv##~%B14g zg~i|SbXe^C%UyX@Dw`n-sD~0+`1|Xbk?U;lDhI8%sm^H5H9aUZtCg}tjzSUGAN~I6 z)^8h?GcO|#MI1v#ig%OFGu<=!@?LZaIsbRul=qv*9GFI5mMOin-b*o@vGW;ECxp6| z$hpOcJ%8x5Oyi!%O%&a)B_&#n)`h*(|GpQmX(a7O_X-bkVUI-0eKstRl)g8nrw%L> zwn%|Qwh<)v?OY8;QXssJ6ZBM2(W@ecskleGvm9~yE9D;#K%GYOK&?UxeJv$HmeMp9 zsf(&jzP#=AqT`M+ggB@Co@ z0ua6W&+%=PwFF?1F0@$kx z>ZgEum~$qN@su-1eT(dwgg^;uI_F~Gm$)JMKOKR1)u)t9O=i#Ki?DE(>{B80+t$57 z2J0?^^Z7E-<8J=AjpQBtGQa0Qa^@IgYb$Z)e?_XRQ$t^#Oh+`hZCh8r^%@Q>lmeZz zS>xZstsav;B|lXew-Uw_MtP=_?x3pev+B1t=p6`iyBBb?p`vXbbTdTVKOLzq$Aig> zk%zv-#h%JMHgd1>l@r50J)Dwq%CHY#2uCY?#q>V}4Yyweug5=INlmt(Q zOo}bFepB`NeK7Y-lnsfsy8Etk)S+mh+5L=uqU|kCYQ8D%Wfa!S^3^guEC6z#bzv@L zKZmXjYS&OZstZ|DGzW;&r5`C=H}nC%LeNg-Xb!g2K|r;Yu+9ZJrAfJ=&Xw4U?7j(& zSJK;5tU7GM-ZV3X3YLT z?e1B)iyJGy@}dJ)rjXAA!Y2+kEXLd!y=RzOarpp}- z4kS{?_H8-iwBZnYd|gL=*^SLmtIwZCAGY-WeOB`}?KGJiMnBr252?tXE8XibwfeYx z?~zk1QToUpk00g@r?%lCpf{-^(AQGTt*prMmgK9?H_Q|09XEK6wW6ph^RN&z>B=_B z0v2#T02oav#$l_|M^)OAH^3T5H`yNnW#n;L*q^~*$%vMtFhUJh%BBmLZ4|39K8O7){8dZ5yq_59a zMZ(j3QH3IMf1>AxCQmU7_0&cWv)5^UcT|cum4-W%hirMig7)w>T-fd@lXu*-DCXJL zZHt}xrk8YsT=HuY^QK8kFahKowf5z#OxHa^!oMQYeu6&G`zz%n`#K(+TOzv40gJ^H z95m*9iXacnv=c1hEn*D%_vqXpwR|Px=Y7?s=N1H;0GsdqfJNJPnQotn*0$Z@_jJRd zrqn-z>j_n|s7Gn9?;qcapPL~~wYz5Mt0PQHbNB|R<~+uKw%PCIVaKSW+0aN@+h;sN zhATQf-6zLQ3Iu-HbvH_0$Ul*A4HD4YbK4gR1yaf%8_o7#Qyq&?+@Yeov>BHwsQd)G zPDlJ?h0+)cr!$Dn6lmE-emb~i9-03ba_XvZ1MUj+1g!zWX}FfY!dTposLm(8QD0Q; zJJ_GM#`|v2ne5aPH$}_$&gA%+{P?6EZdJD1_odpodD^R$_=x-P6;zaOOqy9Ok!^3WQl~aBio~hi zlz37*GTc}V85R^uA^hqID<)ALy8j5u%jQo25IJ&Ddp2o=;Ld)Xa^wjKrXtO-UEOFi z{8!1ET#37=wBTtsx*y~^ifl=spAfFrVuXr5CRx4HVJ@Qt)kU>s+a|5!6Mic%9F-+g z%oZ~RsZ9EOJ@Mc#7Tlao9{YO>hG{lUV%m{MY3I6qZItrTu4s$1w@G^cSH>!!K#~8< zshc4C+(iz=V;U_f$jY%iAt)>IF#Oa+gjvkyrExW$KxzQ@mKdm!yT0#qM>J*i!&f@b z{9b?hbtUa^RTJM};b&Xko(5ypO24)v8^gN3fxU@Z-_vB6l)b zO7*jMI&|Y}ARi=Hd(MPP|FIeUGs~6N0>yMKlrm!UF>I$f_PRR9nzBGU$Vc}R!QK*5 zwCu2n_!C4`$im|&zRe0-A%N=8cZh*{IlXJy%uMjxJRIw@^}WtySn!=iI8SUltK$PK zq6;lZyA4Fai=xv?Fbco8u29i>33Ggci5ezu*9pH_Ok4vj3`!V!BTjQ@toc?$7%up5tG$#q&pI`G}NY%(wV+Z*6NufZP^&()kh(Z&9&`^WbvEn{6*Xk)&4M1Ih+)97w( zW3jC8c(btq%_tZf>%ru&^rPF0P+=EfUf?y zxLWTA5}gmQ)W4wj;>6ZMu`TM5sKYyeM+QYZTjAmrDNk*U$fT?nD1OP|Zu(QBrv}?` zLo9HhR|px7qFRgBm7W(64u7EHkc17`*x$j5SshrgYlo*>-xtC(q+|nff(urq_*F;6 zv!cl(Tf%3?X=92OFWugn{pcv3Vr};}y4r6Ji`5`i_Bg7xa%2tN1~EQ?;m4RBK4sS3 z3xD%rLrrs(L4nY6ef>Js+1#o%j~ID{BcqkA^f+bPMYY^{x0gWmSMo*?>Cbk9Ndu<` zyg+K7o@;%8T`Tg^D8a6HUY7Q#V{0tAvxTJE>U&ukv0+$6`YJ{aa%O)t(#9BQ$Sc2p z`_I^-bf}rkcK6-jy9h7-$%qZnWmVoD4oPYCd4~=TxpLmL^K<*cHnd| zU{Y|JY9&-#P(yd%T2|6JOGja_5(8#nyBRI@vQVL6k|grS(DNOG24Ot?+!ceLEFGSk z{}jaX{EO$rUjAH@3jKKKp%&DpWu5*~veNSx%5TMMcv=04bXmcswb<0(E<5pCsvLDt z%Rx-B#_YMj6M_tW(JJu9OmgZbP;HN}Tk=}Z8#)b{GiqZRi4Uv?vminS(%~vBb>PN5 z@DJLvI8eOo2W_nXFlR^2&IlErJ9KWgz58VJ3%^FY8l>jx{3aCG!towV! zg*&g<#QEiHECD)0%hFQ!- zO(!|okc79(d)$QW42S!9`}qMT^S+Ze*2q9=;X6*hw+0$6Z(%3FIx?L0gyu|3o8O${ zed;Ay^m3slt^M-PtG%;<^B?(R38`oN*6sN22TRLdPPgtD_-poQ^plfdw(c{V;!hXf z?IWTJg9QIEmqZTqy zGSG@O7CMWc_6o&{GQ$`R8yiS4g`vEO7GD|NNKfNiez-Bp{*D%4skgj){p{X`4*MQ>aIp6zER@sS7%hOGc^#o;nh=jUy~Mad z8Y9Di7UjWNYR#>IqSAdwR)Yg~3N?JPoTu0FqLk7kXJEzX=0P6Y_b6SX1>p?rhG{G+ z7JN$63c7QQd8!akCYm7wnc9^9DAkpV>6cAq~KtW?J|F}LqjT>(SD>M5EsDl8?3-6(D( zwohnrkGp@)oYK4Yf)p)KktcOJ=HS&1>*Whs&@<=c=U6zd!Z;($9_l$T6G}MSTrv^l zOs^=WiGdht3usq52>SU+wRwgi(iTGU;|*VFu{Ey-tbfJ$&PL8)4Telc_r%lpv7Xob zXh&h#w@n(%9RgVbJd9OIKgSN4Hlg}YkkY=Q+D#aT&KSGTvum;2y(KOHIJ8*aRU~{f z=Ua33XaWiLony5aF2Q2+&27lQa*@nsyY}#ucV{?7>7;Wm%`Scig!G7PSnA*bw9we{ zV_(Ueu!Cuu8~vihAkgVJ_Zq5t`+f=K)+>^%mC)lJB5PICto=9JCvP?$;=6|C-?GJQ zg%^RR=NdQuCh)rqwch)5Xx6L#gb3JMuzt=|e@?O6+$f+tVT0UZ`O~2q`FY z^V=sT>dEG2s}^=|p5JNr$-djs6!yq(%Py~e;~x5$kDKq`q3AMwx5Ab2J35uG20niL|`lc@Lre9cj}27Xj%CX7hXPcUwK28dYq!=Pz2cSvuFSE2_X%U3O6TIua05Iq zDbZVIxwmzm(jEb-6(HKT&{I5I&`|~GSkZ*B(pM5@A0ZrM$-BwVI6?A}_ud)*8(N6X zrB<=;&nY+cQDeiQl`eT|Np(?c)l0^i9XQVfK_H}@$5$g~`BC5L+037P6OXwe+tmPK z4p)>_VsMRj+9r&z*qPmVJl)Ax1*V0`!{r_Cn95UyF!5i$9$0+J{GHMZCHblH58SN? z^NO_kczzk7eG}^Vu$rC{$Nwr`yc6;HV0KrXJRaNpS^rC`GrkX%0(;)Af=+YX#yENH47z|Vu%tD1=?9>bZX1` z$SuMA^QNnc91PROi1)T{jI%{FFvXxZ!CZqOvA`WSp>-aE(#ZN_0`REs<)L3j#SqyxWrnXi613d+A zt=fnWQqRe`iHl#2scfS zpCxTZB^<36;}F<;#v>xza=G1NIO{SN0TG zyz{=_QOq{-FpD5L^!iq`jBY&z88x45gfVu@_U<_4X&&&LP_Q%PYS>{c>L${E9Sb13 za-jiElYf=Bt5(7|iL)6N^W_WWUna-3JQ@%IAGs;k;BTm0$SZvTbRX4n8z+7hJ-tIz zYw+lPU5~Lit&3uwu#R_C4E2Q=9Z(H&CeekU#&GutZ`-^{T~|~Hbdib-!ly6XIDAj6 zw4Z1bixmTMbNj?k35=n6eWYlNRNN6@T$TjG7c%FNJFAp%aN3=9gcJEoQ z$<=^#T5$~YjK=a845*(j;HeAzlAnx5+SXw@^qHkm?545c;{wN;JFAMWDHH)|I(J2= zKoHB0(eSnfbD1>!aL2vhaBn+z60<&tIL|v{wnq$rap~CrVUy1WFX}tLF(UpveI5NZ zZ6mCxV}~Ge0gX=Ii`1HwZ@u`dazdy_aexHVLm24JXfbb4O69w}FbSfyk`_8Kz~3>x zLo(Pqh!Ea!2EqW^^;<}6anBz_i*)lf7zJ~?e&ozxLn$$#*x|QY{S;Rv?2cCW3y9sx1RU* z@ggMWo5O{Z>WICm5;m+q6@_N?CquJpHYcyMVmdyi*s4+6xfZ>*t__oTm)e#1$tl8s1v9yM#OLxFXM2X`OnG!S1=dsi(t*$=bqaCK z?ThM#XW-zCtu=m!TCdHsEqk~Y>`jv|=EJ75y?&AMF^E6nU*uP1$CPwG{#P1o5XW>H z@7p+2adw=m{-;5=x?2;q%Ez)R;YVfeaez~ zoRT@8TR>m@i5u{Vi0_Vo^AgcHIMYh!%kTPO?r;}X76CaYJxjI5uj0p8tM0&FlY17) zT0i=DzBk|@XtYFV2LE&DxfkbJk3PP{ycVDI%JF)9_NRc^B+-p$cA6*bTKZAOH-u3- z-;J}4DaUe}d#%1ke1`az)tB4QBN}5Ty7y?q)cR2{B+qH@!6?LnAR!XdYTkl@0KIRR z+U6ik&E=~C=>D;y!dd!ezBW%Ey-xe<_*G?u(TZ$ZxO|slarNEmc&LKwdJ$lPqOUp3 zTLY|xv;!FNRQhsd*5}49t(yo4oNW+Dm zTpuL4{R%|%{Wx6vrh(AwAt0O{urUwWL#g}q=fiq_aDR;%>8>mr9+<3w0jy8leI%g& z*H`zlr4%bz-B3rtJKc5>0d}|cEp2UHl@YoIV<&LdX)eK=Q%66uWn1i#BxdJDgQ9^jb-%IXeZ z9E5o+5n*E#+}^2*K)7$&Nr4}p1K%AA#ylO>UKw@TTTxyAG)s^IVbe1hVlg|IhrXKE z2TY4uF-704w%Mby?-%_Z47^xYtA>bt>bv5(L~gCI+Ka@zb7rP2@I01_!~wp=RP$7; zK>E@Gc`c${$Yo5!Ur*Ze@NE8jn;(hjh=Ce)y}Wbp%jH-}B{LXR$!9y);VB z0iMZyFEj+ ziryI&?HSkrq{d5R2oSw~1BnPScoZ$YxOF9~%any9(G91T^KY>qMpQD23sVs zYj98zBI{bfWg6A9<=?+(P1O{p3OmvvqzOZXbp2PbBI37;Zoz^goh5V>yTfA=>&h3% z4K?ec{#z&-3PIq~s5`I2Gys=|+k^~u#oRhmz&!8p)=>)jybHIO{L z7*C=y!nFia`$*sRkrI|u2aK z-RV8Pe}uM4aC5ZA>$nJ*bH!M!Ljl$w`vJHA!)7yVN_NRL`s*RYFq+tdJ2$&`*z39k zhF>URd`RQBQ7aw#eg$V;NFxyboMY_v@>sTsZI1H%l;~^7hJ*((0{~YK$``mrh6R?h z{(7)I7I`p{atvi1WY_8AQdd+18Q64~UG-rodnHZSwL&%qkuwnsz`|kWX{H{#CLgMW zvViw&Eco6ujyeHp7|zB6W;ic(*%_*|E8xq0T^LyKkO*!NV7IF^P%gOsS879n_)4Ld zryHs55Rh&T;)rR13R9dk>`XF;#XRc(Zu!K!;NJ@Ouk(40=zB0^SO)Q9YV%kvzT$c` zabLxeoa{RR=?|V>yOBDT%Dx+fr+Pm=xJVvy0^n8E@|%gnY$I)M-VyLDws*D_Nedc? zUcEi~bu6uQT2z6&3Ot^64wR|f{DrVdXbBS_@AgFB@;WUDgh^V>(W@FuVhXo8v91!B zsp{N=cb6i*>_eJxAqlB0^%)JM@ian}2d$%L%H?gOTrl)Z+G4N3`7&Nr^i(dEdeH#4bI5e&lvAPG&`@xL zZ+C*(Daq0)-+#9%$j$9sS4$k_BRBsaO>Z6!<@^5sUo&XNk~K+UOqLW;sU&5Dic)En zR~RL!BqUqI%n;#a-=b8bQYn?CvSb+~dx=*?$k=y=vCV$}u6chyzyCUp>NvRW`@XL8 zI?w0x@f^9MJT+ESwHCb-P8m!HNr~R*w$dLN!B4AFLnE8aKWHNlVy8_yXpx^KLE4;t zX&cxeH%Q4pOR>MH9{9%``N6`$IrN*q2lf_{U5kDi;p??>>B zh5wKvKG(|q+075Q6OoYtN1_Yf!$=<-SXT{{qtLAl8lIuEo<6>$=Zg^+`n2-H?N`$4(SqIJXq z&A~nS^wcS;1W)fbL&7Br0{RliN9*S1?fT7fU8E?wFaZ`ud@$UkQ7`kLk01U~D}Ld} zPSy!U!PQ3IGYCKCVvTu%4e`JJGJpKOhO7e`yK_S+7}Q8uXZXilz(*9 zFrpv10S&DZYXFEQy#K+>>}NoNIt00vw^5iIk-!Ur6Z-R~x;KT4yiz+_zN&dM@Xbf= zwBoWJMb#N4NzlV0v!bg+-?vXHKXnlkEbH<;bj|KrJy0F;S#%b-HsMh1Di$n3nQfkQ zmF=_vnA>e(E7Y(YSF@W{dn==Y5-;<5gf1W*r$bCk<117WB*Bh$tO6IX*(2)iVnys0 zp{kOP6e{F}OY<(xuqsKl7N&uHIG|^0Hm`-NIXskE2PLtm*h=T;>3hXBC%m`CR9$aD z;`aR(t6}9^bD!8H7On@a-Hse@@SaUboi@8z6dNnE`w~5B{VOePp5#W6!Xt4{lyeh= zb;GoXBW2ecF41du3D`j~hw9RMjpkk<`C((h75@M4{tTm#K1#Nq^Y=z8Qs~VD_(=*6 zqo`dH@Z7i#EMQ`m&{im>{{M7+{e$GAEIGU06?or+Qi}c(iJeagYk=OwCd*pe`cD;d zkZ-gK_3T(=4qc;V7BtaIV-QKi8Q`M_w($0#aqQm6r$Qa^pMJ_pxP%YL2) zyDOX|Ny$m+Dt99U04DR8p6T0MLVqd50zlpjkCWktN4c;%65H$qpt=DBFC09=8 zNP=gNMicMo%&u7eODWL$bGqm)VbvuK!$I3=hk2lB;TTuajMRDuF1ZOIjPTmRnqhc< zrOpV+?SFaK;zS94~7&RGzP@>yx%U1Odsouft3PRP-HkZ8%GYu5M+@VT=Dp{FC zA&vw-O$7b7)>lhM4KsRHL3f^m{EuiPGK0YG=`^CS+l=^6ZFgAjH*CbjFkw3wMj$l| z;<_>?FHugq6mmGd3ZUQEcyf{;{aKNHVPHNU7n{y@ZX#>4_MuH_GVwL}>Zv@~a=k=r zWVJ!VMh>kV1-3n{%Hw0Sr&n^y`WdHDmThgumD3(hv-5j~p!BC;9uC?y`*DA|vQ3|i zn`lRHV@{ut5H)R0W)+iIxXebENX6S>#K*{!oZ!o^36`<|o!`(!f_GgQ?((aEy%2!N z^OFRS9TWxDKuj9cM$`KlDn!ck{`<&okQpTs=2gEF-29(@&e_*OF*mFQX@0c0 z_-}X%O-Pxkl7W~hAsnJgq0S3U0?;C2@}`wMSSo09Fjd?(6!q?oX{l{7fu<(D-l7G? zY0u~96dmH<&4dqZE*J`KAZ>mX8Z9Sj{kZ=H+8>t z+o0%ZwY=}0R@B-7H|=Ed8@AV^by=sxk-6uz%1+WFU09-EU%PCKH63u6k(*v;@#(ZR zuiHr8YrEW9uBScT;=ff5_SrK?EEMlW37VREYCcGup{Jhp@khF5Y3KL~VCSh5wMYd# z$@jqbVm;Wyz+Di=@}Uc^4HnWQgs6t@hbgwgYHhN_X2c?z@^w;g|h)ftneoIjeD$i|Br^59ZGa@!#ZG z212=_$rBLjW7F?F(Da^Aaj#;awa{^IMZXs?CO8wU=4cDi`Je)h~?`KjJe6f zaFL^MIy^Y(+N9O|hEg&@hy?yGD7x$qpV7k%2SG_5-+_||vdz84pcD8Ws`@yV+Jlre z5>>(N4!N{BY4fc25(R4FuL;5yd+ARICc$U`xlk0hw5N?r&$-sNOwZT6PyJ$S-(lSSw6guBJ(F9vG1N2E;u zo3hvdfpx=-yQ>*6+lVeDc)}mstu3^ZMD12E@s-u=NTOs+$}eKjD2r++Eje)nsvN!L zh4EW=j@OaX%U1!-`m_F0HuF&t$Aze7N$*Y3D;HYc=0klL+YR8qTY6cNcI`Z_g=9DK zAXe2|W#L%pft$1!6*W1P39sun&seh5Y=jT6=-fVXOCD|oh8mI6hM7<6O>H3)+m7q- zotJ+AkfdHbNO4o>&#vk7P}wrAZ^3Crl=11Rcl0W^SxSZ#tj(UWhq^xz;u)mje@`xMFG~ z?E8qx|_Uc zEH4bwb`r+!(N8NNh_7H#KUNBj*qa>Fg_QwW{DvummEPT*yLMU%&s+RUu)aOmmMzpQ zd4fQ*Jz-m6rT*?Kt5H5Te0vSGZT!5l11kKUCJV*8N2-El%A{S@dHapX{j^6F5_&Z- z(bxadzM->7>m_VKkydsy#Pv|F^swMfz@(O#n|~1aES>>QuuTSTVoJ9N`_~S%^=FnB z8J*wTfP-Z2fTDc)XN2k(xJ!u(!YKhS7Q*>6M%M3Wd-iR_>Mhhbk|3C7HV*fpHGZsN zq#VLDf}nMK@#G+`cMGzrrD|1?5gL?vRu8X?%0qFc4;fj4x(eAYw;K0yB_tdp0rLS` zEkTx1b86;F0ra>ek8|HZj@1T`dm2^YWJ`IOO1|gLKX%D4Y-cnH ziWrqbj}dA>38SqN1kkWad@iAaeC_IH%GHGT%Tc{;-0{8lc>#}Vj)#>q(dTQl*Gp|0oM`0P<nfEk(mBTCiog+=c&xU>bbXJ{;C( zV_J!^1g&ApdXOVu-G->(K|bG%_6XXYfu_hdaRX0{L6V_Jm3o5w0XlkCQV>uM(uNaZ zu%F}dCYyma?RI1`b3J%lt2mRQZieo7jXGO_vB-1>_8N)J1nfj&!`>(@h{VW*^MsGI z$E(0g6ct_qk5*K_Ak>CyPZ|ggY+5?3H*_w*P}l%<>%v*f>qeqR5PWqvz@G{X>27DL zHd36IJc`&#hF^LzHP*8yk?*q9Y$ZyP4u4{9a1+wGR@~YqoOOKg1B^~XJQYh~r7Ek=Ps#!>Ei1Lm7YE&o`~_G~w-`0@xvJ@l_&m#e{` zMjlc=*p?|nKY2q|eu06?G8mz#Qs9+#$oeE z0+3j3qU@tvU@qoXA0?S2fdSuli9Vx;PyxhJKB|vA=h_nDLN8;eP&o^0Y3PfAI`Q?% zhPUxlEcy(9La*wR98BhkR@B0+OYfm|-L>_$%)yU;r2+pE6{feWrEGKg>S5RDJpLg~ z>GZtHjK1d#@u81V69KxnspFlIz!`vnw)_~FkF_c6&?2TkvznN97Kuwj!f7kG8pw=> zPNO>$o(3JYh@_9^Cr8ew5EbEjXXvc*dKRj!-X8${F*k7^9L+>yZB+R`4f5G+3A%^b`9kg>wdO14Dfs`?>~j; zi85YhflUXYf=ihO+a~1ry~uMEfWMw>1fbRb1$K3Z&xBzt2Os~ux#!Tw7gaRm$$dd< z$8RJ;Q5YvLP-qcl()3@2M-*%GghxU%ff^mP=m1?f(}|i1rw>G5>_BD+%0&c=S@e%V zxybeBdkht9q%u>!RlJM4bPLzANRLs6jECjZ&ztv3^C9aHG~13Q z_7~A~9ButxMlWO?ibSP!eCNGbLH&XGqx6*ybDUM9Kx&!i!tejzw_FS9Q=8DL=x6|c zx&HrErjUtD=dW>|Cln(pPfdc6%%+h0e1)D};0V@d57;*O7l_A~CT1^dJ@g$+=JGy? zDt=;ZBofij97yqI&1%ml?!|Mpib3`xgi!lpzqJ1)Q&B#nhmJrwdPx}t=E~&#$w6nr z>6rSjPEzJ21_IqB0}jccnQ%3SXtQz={u=V3=eE6`9YN}W#nREma`11z3Cd!#+>a^+ zfr1K$!qIx$=h2Q!&Y{;#nn9;0jNiFIFr5y)fwFLAs<6nffUA3wUjKaOv(q#sd6G;02B2UAkMMrM}^Jc4G z&dlMvm7xE(JjjD$CYl|KNL|dzX*-a0wEWoQ;UdCDXewb?I~_5Ly_4*p)bn0GRDb8} zSXJIv!kj)&y2c}?Uo3Uy-kHuAVVhFM=c6JXz@@KMVRaAZ<*T{5^3@Kb(xJ)2}s~wge!;@B8zLUH^BQTnvb(z>cjkc*}<_QjRnfTEMSTMT* zeWUgXET(;#&~B1}R68uZJE0^xZ9aNiQx5%M$tADeJK&(lF@nb{RP7xprpaUyYx;;P zfZs7Jn1psiPN3{i|{WU|nA7osG3p8I)At?1&Y4Jm-P!1)YH? z+d&E}udA+C)$DqO>J5h<{auMFY1A!&%>6*pUvUuhZOIJcpR{5No;A*&c3UeRr1p>` zj)o6>)*m=PTT(m(~EPQ3%BVS?c4-#PVfQR}xMg zzD2=ffC@ZW(va+E|5Y8|P!?~wACitv$k|OlIK(!#6{2z;ivdi&wBy_gdzqFwtum33 zSsj zpP6egt^L7gmiI<-25?OmF|eKR6X{7IHl)FB-%3jBiEsN2SLI$7Jl*!1yrm%9Bs<}x zmtuU~kpI)XEKMCa^)El7F#O8qJ|%n9X@tJ*PNJx{zhf+oW5$B{T}-fzLz$0>;j7#a zK*779?z|c?1KuE-^7-Uo{*|ZV;OuY5W##sSo?CyYj$qEQP#Ro7)L@vl5=j}|s}K6m zl2qX&?h^>Tv_wA=gi0}l)1gA5l!(op6cAmtpQ0cTTq3^+*(_fAG5BJ~EQ-2um@c;D z9!aQUJRzBWAIazl)wgWb`5j;a6Pxl6F}QNrWXuOR@WvPpN8~r3mzYzIh}piVD2go zZ{bj4u~vxJEl*sFj&Q=9dubh#k;J#$goI6&TbYdAZ;%62+oddBY5u$0mWf5wkzFOm zInx-&+xbu7i>cj0uwQsj%LvsC`~TNY2FyldplB>p0!WKeqNQ2PkUtSFwiJsF+JgwN z7i=>ZyxYi-zn#i%Q#d=FNc9bXX8Mo|)q9wGWE@7@XWn%8AiGYYyh~0SR5g^ z)jpYkaYOTRnzOnbqpGD%Srtcxi%ZgPr-$AMd|MfE^AI>P_m~j)Aj5`ZAGjOS!R?b)e4;gJKAkn*OEl+xB=w@kuw zTx=8v(nvFwkd*ena~eDp>i&8>=V4cG3@dBuS)q5Y8q0s^5wAf^t1b9>F<~9Pok>LLF!M%G7(j#QB$k7t!ZN8goKV|yA0iR& zPnV~<6Q6P=HFFF4zMke9m<&>IkTd|BBxAZ*PNM*Ao`tDX?W z;;>iF7IZ?F-sZ8y$fPCG^PK&(DcsCpuR!_yvht}}hl^#E=^Ou^fC?}m0bDXh6WR*N zqw{~d$DYHP^U~o0#=;~<2>Uo+RYC6qtxoj1dw^Lf>@w45C0+paZj#`$Gl0SoO#zL6 z?_>_4m}`;;L6U*dWw3p?Mxd~>4{IK9_nY+6f4>mbBYd%T7kKfN168XyDk{@zzFsis zjJCNbf6p4QPM6mogq6omcxX&J2}zm}l?RrZa>?Ro>OdKc;jVyat6%SH>PgX{I(Q@0 z>vDdgADQKA^WN+IY0D+|GcxBe6lM?qlYM?Q3pPv=!2@khV4=f|;)V^E+i_vVXBRzS zhfVJ!MQ^q&oFaFrg-+?qXd740n##&RvaxKdZ52txpXuDuiqM}%wY3ZwakyH$IPhuo z%IT-Dm4F6W9?HBK;~;n1P##zPW!wFlJ(du$K_B^=$b)fc&=GOy(|*(D=1(vMNuGtg zZ$dm`yO=1^M)3o74r>we+ePmVW{6Y--)I$xf0R`XnY7e>H=iYw4fXwaFju|+H;9MM z3Ix-O0^2h>+SdGO+sTr%S=RYIdbcH%>yLGXBMnHAJFy$c7xg{mx}PBo@+e*`^KN0j zcAvdSO1MhRZyf+S%lc~uuFQXjaieg~z0c@ldPk^t+8m|~8d4&NttVnWrba#?s`)xo z?M%L>M>Lux`M1A(jtxzMP8BV#RtgL>osbKUfmgE-$wlcig6$u#63*JqY5eO5Ll@gl zN!p)F5-8r1NfQ60#8-wm_i#zpX{{(AbZqzVpw;N};)s7%q8pY!oS=P>=RWW94qh69 z9qccW5LfjEX*y{q%$G&=ZRa4ZQ;C&438i2-qr@ZGe7K}DxV{#MA_OpYL z?dH-1H~+KCpXNM9YZE@B9J#8dzm?&dzd45Kh60bv18wlW91WX#*XZdR;g3C>7`b-( zl}r=Ys=euXd*hu|OA^0Ka%W1t6*}xTt&sF$;6Lj-Aqnl;<_!+ZCW9~uXJ%DFK;U@+ zX8D4Ppp;qme864T6@qZu#b+{m&@SGO&(T9m*~IM2Hb$rGO#6 zS`)b9^Z%E&bp+>V{!|hiaXfu<;fp#dCtB^u=qni!j8g39b|`UgCx`<(S+P}N)$Q^y zw6=cO#rGJX>hmc+lBnCzx68&@3gMOVNjC(a{7|#*sRXV;C%^0%m76UP5I-e%WgZdz zwS}UfTQ}X~k3%oXgqk9Z^A;GPh1r(}j4YNZ7cFTDwY0Km<2nI@PQKQ5_t2shzs&Ar z!v*nMvSk4ZZT{!ZjWFg&f=%}I5kH_$F#46M2 zt!J=l8{xDB|5%E(z)+@sX85uD>9F0_owOM9tdDn8wX3QOAs*IBlK(C#h!Lq)f8!h? zoy6sGZqg>)9a@)5{=!^3T3Hguv*7=F&rwS7#rnm3{>5(G7)Ii9(;#bPT_n&&j0k1U zi{5KN1@i0Iq~{-aq5t${D?evCaXbL!R4&$EZicd$G9~V>kEEUm|q^xoy!vgf4ET~ox4e5hUIS4R# ze%y5v)KeE`y`*XVv^s`mI$!V0!l`RxT97gM9{+9U2Ei=YH zZYEy!+&H=B+Sd*C8kWd832?aK(MLJXVdoH|5wlx=R*)eU;R>bP3rlV5O`s)T;woJ#qC)8gegYoQ9RH`wTJv&2P6thBcK3yL zHoQvg{0WP5v*`MAr-C*HvGYp&DP*mOYFy`OY)SL$IK4R~hE4kbVoo+lPCtsJ0>lYT`Y} zDvgc>E^0u=ih6)?O)Y$cF=jdAS@vz=DBLXsRJBwo&yETAyRrwk>SdekLI)l3;wD_=NWc#-7l=1&?1Ab8K1QWx zcTszSpdL`8&l(C82VrH3~qHwSx(Jgc)wBqB+ zB;#FW{<#~4tbFdffmf??<~3Ac6f*weZT7md?5u}$= z>i4*b`$2`NhASB}%02#RtO(v-cGtI@xWQ`6L*SX7XeDg99@0pm#&TDSQS;4jfc`=C zq*4Y%E0#GwJ!0+>yX@kzV69r`Yzq}6RYT{&50PF{6m7)2hP4ksO}`gr#T}i;=uQ~# zZKoxRfxBYVHR3nm-j9WSN=G468Pqj@z5(+~D=)ozR~f}EW0N-iF)7}$1?eMf-`oZd zz%Wc_Gr=D2&3ggXuA>}i%6C+SCpy$WiBA`ef!0R+4U~>^h2AwYQru&V?!d#1!qw-h z^pNc4lBLwrpo{?0^pWD4qVKopmTT`^VeSPM-x{|6k+Q7fFXcFUd4>j58d@^=QIayud;eqmL*OdZ&=h2(3uZ_QbTPenTK2eduRO#}iYsK9ECRU~A>PIw+-KXI4<4m7FIBfG9d$YwpYs-Scihg!m z#KzvJ0_c*RsjPByyHTW()Nh$tLEPXep{8ZywtwHjUM5O>+g-QezpLLkzf|IQZg2WD zUrb-kcmB%A6jY}Fce(g6_~f#uxD5y=Ec7te4ffsWs{Z= zEq?s-*>IeL4S#EwH@hVffhF<-V}OnLnDN;|mko_%#exjlXDp$ZRo+UeZ+=^~Jmf3o zD1^=(Ss;@dq{4r|XGQ`nxY;F9fCHCNM#CZt){l&V&vrM}vJDfD&bX1u>n*T*>q15C zcqp20LX1^}mGYv1dMpRZH_7EqBl3-7;+wfBZ5mD5M+S=Ia54d+ob|I2F_4~NS#ef9 zS&W*!OiO-2R*3WVTe+Z3?lIT8ft0Mk$f|}TQm6s}At%IUE&J@x^O2B!N@^rr)!zRl zCEsRddtc(E8x^|t`8jmFG${-+`DZqy@Gl0x{<5dAh-jOC?7o!{Cg%QV5Cd_i8xni4 zmQOy+8OwX7GPO{E+T|LumMn)?>|2%QwjG)ZKIZvho7Nxj^U_;7HS7qH;Gs%}Mwr5t zDCUCt6wzH>#tQiMD(vf1d2DJW7_SM6<0YRoeo-K}+gIQ>!nB{wgM3cF_q z*^ASIPk98%JfKB_^MXV_p%$oK zhMV1O)(IFWAS#ATTrjTdA$H+dF32v^vPfQ(>U6)=Q$4xuW@i;Oox%{(4yv;Zb1xY+ zuL*Wa6|8PF$AHb^SV&OWgur^srnIguH1ZG(ehno*v7kU^1ZE3}mPRRtEK#nk0|qHy zX;2G?En|o+#FzE(x`%ON2;vz09c7`0ZZ#5O(zx_#``i4h9}Y)fQ}#QM-ig}%eK~lDsV{s#!`vn8o3H%s z*8QlG7(APQO(T9W&n@HD{aN?(!}$l}TW-v_41C6_W+6J*g0cCMYYd0K67rN1y;pnX zl+X7;??pAa{KE!Ow(;MjT$3CA5Yop&nvQYxX*b1SP|IA`K_R1XZ-%gXm;tvb#K_B% zVl8~^eG?Cgg`I$!FIKP)y%R-^q3=bAl7UwD5zWcS))P%LM``OaddLG9-SH!QRV*JS z&WLHWeT83jzwc&9loXx?+ays=Q2!+Mb8ANv0oy({hK`0BZaC(X1qECC+&9#cCE$Pc z&iIPMmeInb1)O01Om9|Oy%lu>SoeEv1^)~Ezi^k6rzmOrUdof<;7M)VdVi`r1!Yq~ zoFSyEKRvSdsNm!!872OaG=)h^sw4ldz8Ji9I>StEwlJ6aXw6AD5zHQTboHB!zztY^ zb!qTj-t$pfQ=4+=q35F8_9x*1d0vv;0rZG(O>_dOw^;Z}9UO@Ey3`{n@28wo)>xR) z?l->uVman4+xXy1-?!}>%KmD|pVARZDRxN>-$zC#8M}m6R_jkOtQ_Z;$J}L=H*D&^ z_44OYNnFiFdP6QQBauzZnuf1nwO{Sjbmao_JT&k)Ii9J=G;ZOk!|n}pnLSU20=VUr zNP?ReA5F~w{f;VNoe2F5USZSR>LidYoLUM@SYfrWyuGH}!mOyHdx3~5J_OCv!=yy0 z^*QzaGCAgFRD+O@s~|6r&^}(OlC~y?DXyAvxPhQabPbr35 zLJUVXag#v2Hag^yDhUs|*@afD6`O^Fj_GdE3qVETq(I1<&^U zYjUn6KGRC9e)TQ&U%U-z5s9u39I}task!CtcGAc<8i8G;a8SWytHmRSNeShyJ1HgX z3gIy2(;zvWk1#DS+@$w7Djq+6yw9*`T)()u2P%1PK1-YtD!}11^u}ohtR7~CK%Qt- zsU#oI!9hLN|HgyU>y7~*``?b=_0I`8Ot1b=`=TgvQmAeBVv)qyj~{yT!^ui8_i<6s zZBz{47U)v)i@6GB&R^!hsn=SxMb!(om=asTfWz^(g1wKV9z_t*>RpsoSMtM#;=U1q zQe;TZ*<*nG-aQK4&&!oJ%)q$coHGc;{&3+#hFXTlp%LRCJ3Jz%0Bru?>`RtDj7#rL zCfKZ&lhJ|AxfM2gL0Be9RzgQ>R$mS(orF{GzKHntBMZ;?7L3H5W?x>s%I%>5nFNNf z>CMXHs80Q-ZSKZ4_jRs*X_%_!|JV)toHqViRhVrG4Znm&cz`(fFm8l2?Di&dire0y zn6Hvaiu~s6s#NCw^TVono(U>$a@}YGgE8DYuoohcA9Rhq;V?7k2siLw`d`FD8u+Z1 zNE;&6?K|I{p8}D0a7*uE3JqkSyxCjMcG;H=F9-<;_fL6X z8gfJuWj?D z6ZJKAKe@Xe*vrea7=I<8eQ+(h^aqs4<|^4hi_c|Z*w8O^puJS3ra4?PSEC6uFTRgB zkI^a{V>tz`KDDR}6AAp5HMP3>8r&V~w8hystJuW*i+U}slRJ&1GO8?v>iBsRg;NBS z*9K3fyCqi@KCUuT@oi5_d|kRcMyDe|X+F}|OmVFZ(XZU8vYn9%r`|w5xA6VNKoyYS zP&a@jhZRdeIBTliJ2&fc{4+W8l8pqF`71V8F`cNZbKB?1Egp5u&ibJt6E~A+xBN>D zWs6@Q{hJ&0V_|Cl5Ava4`qo89@je$U9ewGYID!qR*eVl^NbSbhLC}Q!@;Csrmv%b0!uAMR{*+#7AT5dhe#|5 zU4GzBtwDhzdZ&u4w*5*Z^Mv7I;8xvbeK^1;!JuHT-O%+_ENqdd*3kx_ zW5~N#NRLPg{aOOM$49V9BTvN7)8NHC)6C#^4dn0Qh2O(|Q9gdH*hZ|tRH)D(fb9YY zz9;h8s{uC_Da`g$HQqu~f~Zy0`iT>_VT3R2Ou}CC`UfVefu%Q4vf!l(_w<_AC1pP$ z;28;#N7wxl;t~Bk#NwzxVfVnMiviaRZ&gag3KV{x?}RF5`?i#Fsg}94jbn;=`MKQI z#;EAX!T{F@at@?;Cf;aNbn> zr$^+Lu0U`Rn2)g;1)RmM75Bt!wHP)uZt8(eGU(^uCGE zjAjs$nM5|fQuy5*(@0v2e1T13Au>&&lULe=lmx+STagbuetys2FoG2n#D008ssr%V z%Ei)%R}bR+6K5kd(Okm7=O_lM`iYyy%yI$DmD~(H0{p@e9Aq+A%N5TcNw+pHc2Wx! zPeaQVRytICvHdIE-OoWaVKMiYp`LZrf%{DothH z0~$nZhrORFjXsa~0YPd0t6}CJ-`wYs{Jpa&;!MkM@~(9a2~md+f7<@A%rh9DLvmD3zpXdWxi~q zyv0Wdq4lU@DGj|+Gn_s$nHcUXZaIEIPaJm4oJemkAXCeT^?nIgMYJ{Ow}g?d**B?c zLP4^FyFNca>4F^ShO#!aU9=~#7k}{e!T-37aKj7xoI5sVxv0F(Y?Q{hYvo@*{$c(C z@+at@@v<8)LK0Faa~(OKQpvh4`?~T1?fUcoSu*0U!A|6_3HBbwS#wZ(U|b>FxUdMx zzc4Q+oMXDst9j995tDU*nl~a!COa4(xEc%QqPM^3Vk&f8xO_?3rr{HNo#RJdfZ=$q zXF})$rhRSR&p}hGq89e{OT8^@*~y^kf7AW_8odk`hm2o%D+k_R)SvfF@Ht33RL8VU zo}$E&pjoJZem4`>NxzmeXKXO6&9yp0P%C#)%a#W0V1DQzB5|>a@`0S`u)!GbPMi1& zae6{q(YbFvoYW;Zm01d08xg3Rmj@LKjzbH&qeNmFV!$?z;6s;7!=GUnXbv4gg1nqQ zP13`mNc*a^6Q5#{1NvJCpT&Xf<^9rvPaBdcNn$|lZs`pq5m-b()ff%}W}~?&mO5lE|(LH@ccb z^9bfD3Sbce<*$turL#3*%nb`MyK(9y!lVF`T(QAL&Gf&VZl3VCqrF1{>i@o#<_M zloeIEWH_lBLzs`z*%5?=$q)IoO61d)q0SaUjz-!Tw5NVth~+vb^hALTplkj^5+iaW z?}NN%F?WbB6j?VTfleS6Rn%xygSQC2$)ZO>Df3TFSSOp|E$&k=?k_f+5{{#&@lcE2 zs#^sEIg*AAerUbaN7@sbi^h-IjYF*moI&k69yVr)2cj6*Dx_0)ToCZDL48RQY>{ii!JiRAdit@Ci>E@^Vw zuUl`_d{oOHpNLA-Z+@IKuW9So8dJ?%sQTorI;0o!sKHXIQZu4BPpfd&g>Z3ivWLxQ zwKF|QE1}B&HWo)2(Nb?v*-SaV2UJUd77k(} z0rnj1H(p6bwk%1k75t+zbFD%bbR|$Eq0!^r)=^~#7R|XG*>-Rd+8xrAA?Y$5fP847 z{ns;4>^8J=ssp<~G?Z3A~lE+v5N@yI~ ze4y?2Akt?2pl|~K53Mei_cMq$x_B!yh~YS%Mg97?#lr{p?Ix%m`fDJJP~^F5a`4;{ z(`K}h(KC%UCL|~)XB(eh&$P8T$RVEL0uCCe;z<0965gs0zZkwchYHbp6$3 z;XgsWdy6G`GMm|2@J!cLP=9`__UjNxqF}<~cf=+CnY4OV;`XAfk-S+vdwbF4{3wt) zbni{zB|BAgM4Vhi#qzf<($((!z6n1TDcS+hV&r<36TPt_aaGKR=iOM%&Z>tAhhIi7 zYwVDxmM-iY46fKMFV!_x<*e6UwJ>U|@0A6zx0$w4?g@l#mqg`F{ha<1T~B37X({k- z{g^bET?LHI1u&PC-rcz3%TalTv(8#qqFVkFp6c%<|7YJVfF6GFQ_~LH+nH#pJVMZ( z`wY?2)o>OO2(3Mkh{JHL)o5!u$a}v@0wNeR1Hex+aQWOY0Rq9o&fdvbF+en%Dz%rw z_!KZN_fhng-+j$D#-Kq%_t)3xBR^DixW>!FILP~@Z^2gwj3DGCTtR8WRIl!r&^wdA zZzsWi4A9UIKwVCzOX)1d1~E1YWSY^~U5)u3J8u!PuYFK~uqh-xP4Lf^A)m4pGx+nu zb6R)Kc(0^4l&;~zv{@!@MSa_^Y8@oj)V5{rBgQsO;`hK?YJzWgv4-N`Z>c>devXh# z$u<6YvoXgx?s4LTX!-YzK8$X&Tt;o5mHEZQC$n%n_CEg@fA%JELiP+VN?Y8_-fPv) zQ*uqCoe#8!kFWKwNHDDn3BT1kYJAjx{$ax>H+>P72>Gx^)O0enYjzesh>}H*qp8QB zdKf=!)GP6Lb5URN3qtcdxx~#4hF+D1qdpI$MLU4GVCz;S4t}f$*`7fDg20jQ zAO>&BVP`T@wHada9e|h?R7TqkU%cr9I}4{D2os0 z>g?rUw2`2{Ere1(0F8;!+*Uo%FJIlFId!IfMC%Rz?oSi0i3jz&#=+NE!$Nqsa4vQ)6a}U%y1qD8U*~)umdeWT8ezB3;o4|Bk4Y6J-0nWLDq@^;nXuutk&8!# zVZw?Hs`^)+(Ad)T>|e1jgH8%Fhpdr}f7RprH?`x`vm7{ho-mpoLrq|&Rhf?>cLcNP zJp$!rh>EO%Rzf$J3#%+AFW!~e_JmFf1#^8FIX)%fPbB})V$AN|xwQ9pDRI9#m@!}Q zQsTppS$Dw!1KfY%&P!b27zMp#P?|j=l;;6RYe_P()f`%ucC|c?&^lNuHFgy+3-lz88!yqg^~{7?dl& zr2WL$@`x(VC?j=)hh3Uk8P0O)n^Ol#!Ov4?pWcq|{%^?1{3>|ntJ90+R68yES_yrx z2qh~HRhw{|EUEILYbmzLUv5`yUkE<3jl2o5Tl?R^^U><71H6p z!SJv*M|3x6zGajL?9-Vqait@X@^DAmXZYVQibOcojHcl_WKI(HX@YI-4HCjFrEQ1@ zk@D7&qtfv=`c6`WdJu1)?EgKNN;S|OIx40}j+7L%Yie5WPwHsPUj1pse8PV!; zReO^twGKltRw%yOqmW=3cX7}=U%gchLW>mVq?#>%Iw(A&o2^=^*(z{a#6W(qA$7gD z9_;-A76nG7DwjrEb)|m1yJhLYMvnRmmw07-b?&}s-{o^i%@H8)B~>|$%ot*&KKuH~ zXGc^%#hPWfKb3nJps-^N`4snSkRyLet7&ibg2E>P)V`%T%&V}NdBQ>#ePD-osF9O3 zZfK+k3m%@9CeM3Ay%G#D*PZJ0Q4k;n7v21WDkTL5;{Dm##bVE9b{Mc8Xg9ate+?g$ z)_U6)zFB)yE=9($9`cpO$Nc);?hlOyx9|I>h7QAF-qAijsAjf&WsLr}?{~3Z;p`}m zDa}l+()VW8Ml}R|&o@3vvuW`DN=)ui*>*pTtlKod#h_00m+;(lWq%cCsgGm8=%fZ; znU}kQvhbU(uJ?PL$jrCbrYDmz4Gbm9G`6uE{VZ;PyPEgc$XYaIQgCz@c(|;cRS?f6 z#Lx48K~WfYaVqh^oIY);ECXiBcE&4bCuAl>#Y#MLW*F5mMsV)s&>{SqD21*nX^$=+ z2+xNs$K5ekpd05W{FZu6I43Sl8OwWn4u!)Ime=SuONx3HzlT2;ZE9KVocjTeFA8&U z+T8qv=a(tgB_a{^3dAiTiK>9QaRxtZuy`~(bi!C_%^@??&+X0?R(vr*=@=r*!u?>bQ0y;R#ilYvgh!8F zscU#Kc6N4%^u>+CUq6o!Pj!<%_VQk%Yc#P144wg6bnbi~_$6x2y1F}HPzpfXC8XDy zB9Dd>z@op{y{Yc|+v6I}6HTku!L|~qH53MPCe`L|tD)Tk2ZcjN5Y^2>)sI>ax9b6m z9s{KCMO8{2Ek=6wL0sTqTT&e{K7L_?nUXx{pA_QTzd#ZDNg`g9wi})ql_F5M$}B<0 zNh9ebp~(U0-GxD-KXB{U`ew|ZI`>tG)e+A{f&Ri4_VEfse+V#?6TZZn55r)lRoY9( zIC0%$Ho%o7S5qQ{4XV~nQNUnS9ltE0Ba~@@R&1$*IVPGc{DSQyoG4D1Q@Fx6~ zDGK0xWecHTr7jR1?bhqQL{H^QL=3lahJgmUTU^{!yI5_Vw#GsnEhT07CX#!p(4p^C%JdjFGi^QBmVrR2fKgrJ+Vnu z#yBnQf-m)EFyDAoVPSey+R$%l`EfrJ_28_`q}4r#CPBWdG?*sU@s_s3CuY-X8v~yh zq77RPx*&Qi;*;u;P%EQF^$qCgZPjE%AHN5ZEq3lLV`#My+?EXI2KS_B3tD4WY#|xi zhZA*18ZuJ|t_N@z2m5U3>&%|lZ!^DVhRuN?>kVQeVj2X8unE@SM+Cg|^)H@jU{b<5E_1I5M~6bp@04bj1kbEd=5cL ze?GdmIU>&J3+$1wN7fxryP#%z4)sbbGj3%g(FF%(wMUl4@(y2c`DId*pNAw!B3tpG z#r$+n%5a=|PaL`yqDL_Y9GfhS`>*&iIM$c4I=!X1%5yT+e(7LKas^VsQMjj0!$~Y1I?&F24%HIGz}m ztSGeeYI#N@Dj9x5iJRN*>wIv-C~W!hoYG_Vil~j8IQQVs*d=CJDsrCFmLK{)^%rt{ zux9H4>V1KNfzT+%TqJY%uxX;5ye!l^XunJTyX(`6=t;b$qsiSupJ}@dL;oL1XC4pb z`oHme#$Zs4gk+hqMnsZImKl^KiZ)AxQmH6Kg)lR=BKwjhWmGC{MpTFllD)_gvS-aY z_AzGr-M+u`cdv6!&oj?`f0pZdU*g|s=ZDv1vt5`zpFvfV#h#;U6FUcD?+deo_}(tv zgvv<2?ZLahDfX*U5(gg{xEFY1l66!Hmy7c8o987R|Z3x>|&?; zkvq)hMRsn8GaI)hZUHD)$K8K&POvsR@LsSZz`Mj99KP{KARu_Oam$ml6W^kQd64%gGoO$@DF8jvs4U8E)v0wpNz=l{fcEN{-O}t zTQm94|NG(sT}zAK*?BPCAqS$txb^9~Wk=}R8Rm4g4)A)Wy|BE+X$UOluGG6_v1!3} z%=@`8G-huR<->>a5w|)KW&qq}bWHK2KuB|*$tXp9*xivM26Yhg3<4f{*g_^PHNbA@ zaX!4RcNEwcu1d$y_Mp^Xsjul4-Zp{P%)moAur(&2QKvNmD%Yiha|GR%7MiE?GZra- z%)sC(_U-C1A*53kocUp%KLMnw)>L*xPkP;r$xGt+2Qh51Z4x|T7(!*_mSy+Vj26Q% zL$^U5TEp$=1Ak{9um$%3^?cp5Wv{Ejj}jk0|68OGSykL1Vq1ED@3q5dxMEHk8!W8M zIJ?CF63qz}bqh^_N#5>%S`h>_kx+qlg?AOlE<#obZ4_#IM8Wiq;}8dR1X6Mqy-o#T z&-rD+tXA}zxNRKvQEcX*NNP>fyBvyybG`)EIUvQ|Wbnj-XFEAJ88+!UAj#Kr z_{_P0p>$8=ZgKz|r9;TPG)S|2 zJB=hiF9%bi8(<0#Pd7|4F?Ull{6o@p-$WR}J|al; z(R^ztdJk<1nKBv)-KI`0QXmZTY1>>gThkot zK5AGfjZ|6CDebNoC0C8ZJN2nTL_L&h7Nqlx--Y^bni`A(4iKh9+2S#)+UeF*X(qh! z(kxHCrkrb^ocDje`f5+Zq<&_piNO2Z!3Wmo?qAir+-r3^+3y*V`wa{!@m7W-1LL_z zTFluI(9z+a7nBjS?iD?8G&tp_dh-@~Y^J^+WH#-a&?&pN+&HIYejs zv?})>Mi$RIzI)PIy`Fn^21(cr<1*fa=xNPA&{|*EKFVGFVyJDt0&VlmK_QUGwzE%B z*em_pg%Gc6zCv|bqi!tKJN&kb^sYJYezFVGT}!frM#NrGn*-wEc)sdGSq!zQ7dkd3 zHUak%C(?or7Q=GgXXs0ZS}mo0CsrSB z@qH1!kapQJ^nn#4DO37$YiH#v3vO@g+7?i&+jR5IW9h(|om|taB8!2mrJ;5^J#dqo zoQ5?IKMHti0^1(-^Tb_7IW+@zSdcc6uq7ldij6me1j@CL5~fji6KMm_d2C>}_Iwf( zP|X{5jIL^iS{RXDd5k>VM~in+KQwA*AKw&nMP;_RuZ{ZP zKr<7mU1!aGlJ9w^r_jm4EXny%z`w}g@K28IiJt5Jkz0Nk@y7jNsGG{rr#S2STjwhm zxN&gzW5IqdcX6yc$^SZ?DiZ(E{Q_-bu+7Vp;uuQ5=_4!c!U-zJe^bhlX`;P}D4okq z5Z~*0#szZl#+k9SS72yR0$y&G5?7>FwB{MOI)yf?%9;zs5~SckuECHod+@MTR_tT# zh}mgOi{Q(LJuYEeu}_yLYq6R3BA@BGA$H3$U9;S(jrfRde13DDFGk>L)6*8%dt0(8 zAlCD@ZYibli+O9Yl}<#Zg%mH>``aEOf5kIA3?{+#e$tt04xSAsTc+@8%5xt;4>Bj` z@y59)`>cSgi5urnU-9U;-a%{-nO?g76ot^iUo_+DKX1T~ei2_l>_J(jQ2(uOeY6n! z&+%5j+Nv5?4l?zpt{Ows=e+r9>atEFi42CsY}+4pV51`O<_K~HJntYDD;Lt0oOnU# zc^e7N;8xoP`QU_ku(Sv~Fvz`&3XwxPNf9XM9A9~GumJ8;1`xg`*86KZ85|Rv-{;JJ62p$zIhvK=kM-PT+v1{%~@*TNfB~Q`o=Pq&H{ro2IQKPWI zJ=VyfdJ0Oz-~DR_Rd7!g%$M24CxCe0Cvj1qYc{h9(@ykiv5d^!7zJ*sT*tc5`O?>A zlJ4X-2_IRO9LPbE9VtZ4%!vD+{FH*c;HaYwF3eZDV+jcIK7sWvfD1dl{^cUJcWrZ8 z@6EGwiX73if;fI)0`Xgvb+Z;@01e~8D_~@_>ktYsN=1RcH+uebw#ZaA%r79{-3}UH z8y4ff88~s}WtDA6$*T`C%olguYA2m@VR|Ls>l1_Zm*j2!#IhRsI(q~mHxh~gmKJ9+AX2${;m+PLkD7a?JFW=f) zEtnY)xy?i>A!b!^&9Gx>HMNS*_uB@yy#kBmTi!K_AqWM&lpx-_@U{BF*CyK6)ej#F zOX{0Owkm-te@e-AFHfi*LI-`b>MLV!zx+-sUA|*qYOj>8&tcw=W^SBCI<@A)yt;FZ zv^~Y&Pz)L~6*N!Q<-paZcEVVF+=u`gG;K3U_&112$%(w1VNHQcu?uWd++Q(7MmgZ# zx5lsC-`tYS>WhhO%kI;3TF?G`2Ie>##3ZGqrl#Jneqk&K5Ku;C_AeIR`$V1gDLllK z@ru(%e&uEHlhA?)i@1m{JE6?g3nR4^t{Q`4i2{4(6itN$lvE1KYWWdgACL7P52rS8 zj<`24GtA~0X5h4mvLF~@jVT4weE7)E1Nb~3Z)UUG^&+t^0Jrwu+EAq*#Zpj&A%0fe zv)$J0taIq9&|tRk`jI?HO}>aGuWQYiDtJX1#*Ga7`V}C_xMpHqZ*rgE@nb9T%Yr8m`d|*rb@&$Qk(VgAQK2$=a#2_F;v8BC8dosLwh!>XI4)->-S+dM zF+bvTkK)XxMngjAtn^~y#0y{5I=%C9(w9=`;wRVuy^#s3F6a^sEWaegN_n2Xrx&!-2zRlx$vdE;{`Xs zjoD>}e|qKZMNXwpz5WjI6hHV6DP#qo=fV$^i{@c<02d%(1{Hz6A_%w8tK}0k2}Mxr zeh%4hO{*Ej_A=g9SmHcx!>6folEwmdTH5bPAh*nrzqBbZ{VqqJ|MCd!c1>>_bnVpbrXv}N5Hw0$bE)S$zV zO>LAqr(9Rt)nUjIP><<5z=yOn)&f}wDV1o3q(u4&gkB(Nfh^SV#8o|wgf(gqSv zm2{6W-@duS@5~EIHsD^`=L^I~4EOzn7S1%?+rZ-xARqj=L{y`nZi~$e z$n*O+0X*)!C##_fDbz~VHkzb#mAXqitF{|?Dyz@ye&2<&H-JM(& zfL*)2tQm@Xy3lRKyML0K<(9+P%`_H{S=_ncY}d-j7z)hV%f*3tdOPob`EW5+ZY+lH zN~X>B!7&>5XkP1Dz`oB=WMj3of~lg4C8@C0oaTfirbMZlp$Z<&B;_SUGx6mdsPa~w z)@%zbcU{lQKp!_SFet+(Eq|F(Q2&dqE}}Le71=Twr1=Hd)^d>ifL|1L91=-)G`JQ! z=t3X=h=7pC9fFClMo!5e2@f&1w;Qe8a@&@$qR2ao#zeMEbn(+uo1U?o)!6R3f2l5W zq@e0i-WFs&4z5L^r^OgX0GX5hb`pw3a2`)}PC!~j+b4b3zE2-*m}1-i!u0W`aA>=^ zEhLJ#F1dQos8ezThDqiF9BQD-Uy9WBkw1wvbuujN-m>286ofW#6_SR%`N)z}Kgrhy z^uY~9v3vfxb~e`Fsj6xPCTV6nyA|U1h-Tas>JJ zcOxj|zDe~w^& z#0q0~eXM z;GxNbcCx<{?f<3Ub!}+XSW#q{KO5Mf(?*-%171%|s4)8mqIj=n4OTaA1(;S-Y2;QW zzM_bL`S#k=~CEhU40cz6aL>DGK_o3 zM?Us1UTaAl)v*slROQ6Q6mLSzVL&M`FO-R1;ahlKdKE9iR2%cJbwW&)1M-@T#0j^^ z>?;@C6>Im+b0_s{bDFO{d6?J$jU2~X_}-rMN6=6jaH$aI?lPD}d?`zrYQvLq_BqG` zLi^IR>prEPW0yy1%aa%Ie>t|Rao1L4{Frwdxp8jq_#_7SYCo@8%s7Vi4gab?;omrP zK>57wJ(ZrssMBmT5ayOFVoT~zbSB0#oHt@#hPs`H`38TwkLONF8u?bFLoKhJGORlg zRsEybG+o(K6AlU};*FUy&S|+jJP68xA^t|K_!309@%FRDHexe=FMQ1bBV((MqYFRrl-&31w!QL&hf`48ne+p_l#*J90b z81GfC?jZ~c*WJf>PtC~?ucyKdqmE8Mq6Hw@R6@Z4+lA#+P1_07%Ryy?Ww5-b{SH`^2 zqzd-%BHHtQaRyluLP2(MvUv;fj>3i7vRKjP5}KKH$@_w5@3tI`dXXqID2nqq^+aKnm7t!FJA|R*jC@S3#!5#=g zP1HbbfAta{Vf{mm*rad4%hq;^yT8o071>bWQ8PFL&}pTEu`z7Hn>3DS3R{&ahFgfT z7>1JlL1ygcin;^&_0O^RV}|zi@S*l4ik4Na#wB}Phmjr|&*b0PP$}(@;sK{Nl|(X>dmj=d;kta?iHUx&T24(M8Yaw?*2JUOPUc*Gkcm zJ?5h@`$YzsIbYCjkf8%mv@n{OA?A&8=u0rsO&MAd%kuS zLtZ%K{7nT#U`f+y#MPe@wu_bs0>%_X0WG$2fha=w!xVN=YI3ED^As;NmUNxfk5`^zehoc|Ef_7u*8B25(Gv z6iNv8?L!LYO#EDM3t{MdbTv$r1o`_!-U$H3RYh*4pIrkET;x*%yTd5ItZ21|Tp?>k zh^1h1PaW#U2`(DzWJuF0-3f5k4lu@P)|IRG!qu9y2hwr#mll>-x=Ij;+`I5gVUZX) z9{5`HmE@2=^ABxclxGFnK4Pm!(mn{((0=Hbw)|l+uOm`RYc2Ib73;0^U)E-u01xE5 z%c!!3Ibp3@=IwhEZE}f;)~yVvE1fqrxJQ!eziEG+^4}3K)D{wQZ14T=Aa~$w6-$=n z6Z)cRP`H_Q66U$5xvS4kT|sJwCY&QGMUKIJwh2UA)(fdJgI91Oq@YlEpVSB4V{u1@ zNeTc3PXh?>s2()8=A8B^nP1X10NZ{=f$HPT)=ai1i`c-1cgEcYA{x)f#G=5^BS8Lp zc4J&ACW&M#L_Z`M70e*3rc7c&FKz*7A*|;!+DB#b`p`C~l|=G08M~!n!?%j$HYtVhL1m45CP1*4=;7sc%;ya~;J8ZDy{gT2+Ym(uqo=JU0YEKDJrnmqQaCQ=@Ir zlaufApQAaDT2qefnp+_t8i1q z@t}@{1?vWH{L5rgTcRUAA`<&bro=d%@onPsR%G5ur71Zlu9spJK9D!QFXEpLKljXo zHQLh+MLkh$*T}9Hv;76)xw@9(?HhF~7B>(-B=U>I3bD*2M#ju&K@SMulDR%X((r z7Y!{|{+!c*Z6q-*Dde<82f(Qh6H!}wk906^{uk`OP~!RYtmLZZm4w)?7n`J|KYD&G zniv5fH*VQTch@tL||D200~5 zwB+xgs{Y$HeyqPPsB+a67@y9iDIVskt8kvM`F2fdLwWDEf&-CN=H z`uLOV+rOI0N8FLJdu)-!Sqt_K@QFIbE_bB}g#K6IQGQhinswr;}|)ZPDx z(#n56R+A%pv7BV(%Qtm&+z$YuYy9*p_WZ8l>p82%d2~d#7rE7o_09qT5-rEH${#5G zl|L$b^?p~#(W=9f5nDh%U*NBNSIhMR3-uBep zH!cN*B5CW&TPI232!b3b^_tYe{g=`l@o^0^S11v`KKkeIfJ}N|>VkqK5_M&hjs)jx z<&2b-VpXvtMgM~sQ^%B0?-?&0y?0^-in+PE3_ef=GcX{Pc#(l=Z{6f8a(QnJT)v4cQtH1= zo28TBnk#8NE=jTK6N2#P8Kq1E6qb3w*i=kwe26be5|Cj72fs(^(f@zw8iFvzi4gyX zysxgHGaj$6NgB($q;?iS<=BL;rj9jNv+NzTd*cEu{DXh3(RnA ztbJAd1y#AG${r75^Ur=R%CLMJ0OO^WHK{to*pD^cjemA3KDeE8csn)k!St5Pi45QR zS}&(cni@K~b)U(8x&$0tl%=?3@RTYDSl$?pKxRaT1K$RZqxKdtsP2`#_R(9pYRO0z(oKYmXdEryuAaXSHlv}j7 zV23wa{pU%zB2f@Pm!t%w2Wrf3Vzj2+bPH`#i1@V)qJi0|x@Wbh-*9e=Opz$9Y;Kuhk8||7Jn%CQa^5=-~?5a&3n-H+tuoa@weL(>2ac z^I7j_oh z79?+B1fRIzuA4$iWhBpN9$eT_QMpL^Z>hIC;cT9`KNOvPEqU7F&qVu*9iiANyDQ(l zi4Fh!up2=>XjHc(CADx77xQqB-S6vR#AAmqFxKK%>b;`9l}71X#@5&zJ^Ol~>u~o+ zjm!6vhU?~1KF=pl&UbCwFL65@&exZH2h79judU|=xft?(o`NR!MFZAs#iCQ43Yfon z9*&;QyMD|tBW;zK-2tC%5k>_1pCOL?Z{pO6RIQC@kS42y>3ZLX}A4+}cI9 z=%l`ADAmjFP37HvTXiad_+#w>AB^PS5zw^Z9t;R|+$dw!=EJBkkz`$-_l$or(K2;b zQq*SsIW&*k7>KY4J>~m?^L2%Z+krdUK89s{d{}JXUuuziBu9NVYVHh^aaV8=d+5*Y zQ_d>v&=X*Y{z771iSBChOb84oUmktyr83L77ZtJ@a;g*q1&=RH*4{xue-0{l(_5b3 z3?VKfDnRAyX2m~XR>EZ5!{_j9^N3nUpQ$|GY=>*u?{k(BpQd@^!-lS#z;-5NuCpUZ zg8CQcZ;EV_o_*1V{eHm((tyIb_8;qi6n#xhU$)sW@#T*N^=+&*%J9U3uSqK!WG>@B~Dvp%Ihs{b1Pt9+s_!n z4aIg3*qs+y6jBGVA=^rrL<&)@7fp>IJyo13PYZzLB!;wlYhC9$>s9zFW; zwLzOhK5YzQIKl3FT}^3aIV68C7=wq%YoQ-T<3|?VqtAjT@1&hNPt$70gRhZH=Ug80 z+;`#Wa1AAn1QZBcE4(x9&WouEPa~-b(T1(i(90l2)w_M_LI zU6Wl9ANnJE5=oZ1*{biIzff!U{vIDdd+(U>`tJe$XC`g^BBU`K^4a0Np)#=4S#{Cc zKQ}!#SpDdh2DwBd%d3&1DhNtRWZ#AT2E*6bhwBuMaI-Ah9W-hNqrjUxaR={-sC@P& zs4e6$Cmbs^SKWMnPWWl&P=)B24qe^!@ki$@xM5vOy01Jl>YZ*dX)T{Z5}E_%7XLiP zz&nRT4|NOK-$TFOsv1SyoL$0nxjdSE{F#ZE%}Tl2e{aTXE*@3w-DTY%d+ybpGtd)3 z{}yr>-SWgRKy-^2&%DyQQ$EGdSr4R-eJV z5qA;+8c8rOwE=62#zz!$<-kx-`mNkU{jF7&N5$vF^RG?)N*}k0WS1Zaq6qD4I*;9H zK?^bk)cYRh4OuFKlGCZ}6zdwD4+qOE5S$-b#JW-UCc~$Z?!V#>%brUyZdNpfm4QdR z7DKtCJMK5Llb7p?ghG&l}fgJCtOFh=x;^KUDuehenX$6G&BBU(2~=I1IQR3J%J|PGhWFJ2dIrVrgFpo& zDS1s1CjXfM!Cv0cwIzA(s|YY}UDil}hx@WlhT#fD5_u>WEKqt@#hT(-Q-6rZ{fB0F z(H7&D&~A748WwHR6Eg5mEdS+C8T?@<;uGAsevV83U9dZecQ%0GZr(sNPv!{ogAaTj zD>D_kvM@GEa8U1_nV5FyL9n)xJweI(H==fT#e#&PJ4dG3JO!~e;3Eq$1&^#+ z-WvJku)A^K+jRrd2}G6E;?k1P@H^5ABPycGxg2QMkdoOVa!4)HssTWbDxWQfeQX8r zNaiN_8dbJ*h236oP=fTM(YhtnA*NS)9s- zNpw{?`%`EZn#-(ANxCZf-nrmoFP8I;w7+_a!=WmL z_z2to;|F2Cx5FX&Vi8}J?q93`g3w6%`^`7=@eXEvJkPa5#48f|-K5~p+I23f`#yW* zri9dPywlvOm~}xO$eqj{QCdw}G7CM1fJp>8(v|wd(htYZ5bfut#BSW72_S6=;T`hi7pLfn_q?jl*2dgr~8vHN(>W`17C%kAw<0ZnshCM1acuP&V z|F`F}!il*>u`i70RIC8V6dAm)hO!!zZ0V2TMt>c~s(+x2o)Q;S9N~xPPdRKZ<+whs zi$7!gl9cM6fVsXun}2fef1Jo(I_#3p*fnYtg+{rq(oQufk{fyD?k|9c8YJq{J*2Bj zq$kC2Gh9QqEec@(&?)nR+m&`4EQ)|G|Umd?%5#hlaZNthQi1<7JI_@DEFCel;F zw`UG7o}JfJTR--vj(Rz7d&-mJp)Yo!`c(US0#1$+)5ilZhl+yXb*@a>sPC_qunEn~ z5Y2-IgTp-#4=YYWt-Yf`Tq=ew;Nwd_M2g)4Fi_Us{`G;>T<$~C>GDE(;Pj-~WcROv z7JeX^zCH=aFLL1US6Aa1#dDfeFt>fTWA1v%@uJG4Lj~sX&X(^7J!?uW8mm2S@D~<0Mifw7 zO)XTX@L89p5Csi|I(j-wng;IP5Ce0424W`O_@i66;(k7`k7(BGW7`RUFd^C|B&_CY zTagxE$cqQE@DsZi_WAgOh2u-m>Dh0f4j3!=r&NPIdP!%;|Q9)#IQEx~90 zx<3~~2rPFxTGh3wc{otV> zk@P9+oDpB;p`>N4HJ7a)2BYF*N2)wU!D<7nU-0Hn_!0v=lm<{xI4()a099l7JW`oP zf0PP0;rGr-L2WMX`cO&6R$!0L7C4v9fd(sV>-yKrWt68GQxcGgy493Mo|y0)P&%}6w6g-a z?U9BT9yb=5gbBle_jMTN-24YZIy=oaVr8>%RRIY2d@Ie1sDuM>s)0gu3z4@=v3AZ1 zzlm654MIMU0MlzK({G8E+pr$ADAx422eTFT4$~aY97OD^0v5;y!L}r(-{r7}> zmK(1$w#&IkaBn&IJVq*W#v;iFdPyuWR2GlW9@QEuhx0v_akrD42)C|>*w5qR2f05Z z>QmbSGyGIp4`2yoJzr8~bfgIzzLV<=zbb*-PuPb4AQ}xCT&CzOucCj6Nza~?p%5Z( z#*u>jc|JeLli^-n(7k54>!PfB8?f3Yxqg-QDP1z6d#|yq&8(Xz7V)(;&<&eHEovnoQ@I%`Lvid!83CuVYp&4WphmFCdB#B zH|2@8=ajes{XtrPw@V^!AvBh+Ps+%_xjcIO#b7~yUWQCObUgW-{Ej0ucA z%8d(Ujwp@kJr;)$?unAx5~lfh>_1JXe+zP^VG){*VVcluP_^Dm|Mt%iGAQa4#Cg95xn5~~zQt(2^wnaV z5Vag2g%PE5XN>Is=>~}J@t^qlBq-mAH%qvlMJXFp5Wdd|y}WhFnJG-8W&D^s~u7hJ+k;%t^qHQoJ3A0>*Ztc%tvkX~EB z1WV)L9B*^B%pCq+da1|J<%FjRPX!lqMzJ$r>J&WZORQ#pG)_~Z&NSzz9J}^FYZ0OV zr{^p7UMfrW2uYY86u~Ng4~2LGi{H{u2V4(aycX+m6@dG5Qbi>LYLCt*Nwoy%g6 zX>%k~?(VR`pS=2LA@YpjT8~)lkS{-Y@nn><3AS%mPw`gCT#*GmvH`#`Y0hY9-$^FI z@v`@`==HylYKF)w=B?P09>PS+`5QykNRYaQ-73?%h_!-&O5F{4+ z1M_;?C>0@thaLb+a}amBov44)lV-gjR>T(6M-jlh?_fpIzFo_~y48cwHD$iwp3Jx+ zuym^(o9Sxv4D0!y>*mi=Q%;=$seEKJ31r#?RPYuL=Uk*z$(7ec>K+-o9)B=F#Cy@M zvX>yOCx%@Y&s|tmkUWNH@iAgF0f6mZ;_9mR9c*5Ja?~nTtmhcg_-j8j&)?Ai{ zi2^EvS`(5fq+t1P7(&A4^P*S3^^g_c*ez-|DiV@; zckj_K{->D}#k^2V?l+*yvxQHYz5Js%vGQwQh41VZ=$)>W8*bgJ2qI0O$A1``)^jkO zKsk7?W+{;rlFUj_;hBC(=cz-T1i-BQ307PQE(|hb^U1(zvRGaNJ&&7!FIZ^x;-s?e z;0KE4Zc^c$X7k-%9h^u!C<@f(_;CEB%@Tnyd^CM&=j1=n1+R8U673T}l7S)_0^z(M zgd~OwG6G=uf&vz%Ug7xRT%G$9(B@+pyK6#GNR6SVc7sm_K^^prWSs zE_z+JvhBS@_rZMMNTS%`Rm%Q>H^sQ~kAX^!DQu{yy&vw=t#?mnZ&tRC-gFT5G8JD`)1rG}=R=-+#dP z9*!6`Z+PTc}O@7o815Ec*@4vk*>l;5E+B~Mjl~~H)dxtlSpqbF8C7M z$rC#v^ZV@X$w7Hk$h@@yD^V5= zoV{K5K{njP_pU|twVEyJ@PUDK%5gLN;S}N}6&@9F;mM5{$nCV6FCnvgGcDNAD;^38 zCESu zL)0knVTC5XLJ(RNZ*tY9!-&PysngH2$Ez!ZUEZdyJ3r{~Js;lM3Zn|_Pr}||v^3P} zbug}D;lPtNy~{h`=jWNyopZz_$J>61nlu(7g~fl!*(OrWa0g)Zk5;#5OThSMF3i~Y z6`yqCdFCWum65tN8INp+nQZfV41Gx69r8UtVu7f7#1=d;ZyC9!_Z;BzNH`w+ z5#EdCz|GnxIDjEE5e486?YPc`@E0tizJ&hUa(uhaj$PG+xEHA+&g2PMG>1Y>p(y&k{=Y-e@O(?@y4`qWs@(=fA7vz zQ*fPq9}LCvqLE+*RQ(BR2#v;{%)=LN2S5^}^=N~_FUQ#KUGB0;y{s%dqE=6H7Ag7` zdE#yE%b^vu;Z75n($Kpqau!-c{!u-q53a5;OO!!o667|!eGGQDhsK{pEc>P~N*xsl z^Q^>?rByIK`s*n5_!to$nIF=-)~NtU1PIk2#4%P2f-r67#pAGC*-~@bCPe9-9hKVh z|B3OkAh6C1NUYgP-4&Wb{-V~>hT4fxj~w}rs>ttt{O2nCcb?{ooaXKb2dXUP5aT|< zA*yv}>z5q_s5AK2Let$c^R?C}u7sXU!mP-`xA3CRx7rUcgrb?$k2pZkPNgK;;nzeJUQ6KH1r=^V1E}`*_Me2`e(#yo?>GzO6NXQY`1| z?x20n*r&B_zxj*yHGYj;KiUlqyY{Ryx3DS?RdiK6&txx?xBDm8HwK0~weE$?AfsYQ z(6*!os;);W@#_3}lQb;`lt1XBAkM{)fvTtwfIkQFRGzpGOJ+z&?A*e3^N3Scyl5CdOBSK(ifttCt5g6;+EgJy5kxF7e0n z7n}>7pLta4)lET0C%rH6!IT&Bc(ebJYWIjdq7H^#A?txb6-F|WwhrPze*J@yLgvT3 z!4yBsAkr=o8{Cb_CC`V*YbTma$tk@WfyaJhZ}iLL>+dVw2Rx=8Kck-LY)Scfs#^6_ zzm|!h5D8NcGwUiBU4M-EpqDXmvQMW3yVr?wr0}jnIbTiYzCm@+U7r3sdqRDo%zq+b zD{tsKOYMi^ATG~X@r8*(;!u$3mQ|(6V_k5Nv9$8}l4Ogee+1)Nf*4-^#wu^Wv`j#< zV+|Fz;3W!+k$sm(@ln8?>ofl!Nr18fB`_%B!z)b3%v{awf8EVv@Wl;y1%?^)XB;7U zd@}7wsKq;NIv*fObCL;o+*aY*WH&PYAV5Pnjla%n!R{Fq-s890b#5@d zBIh-Cuf7tyDMS8i2o8ayv4iMFw{PB2xe*2XE)1xIJj_4oq44NrQ|NV1vpy;~-yaEb zKT1v(EN*U;_e=J?4_LZG!Ldn<(?k=jwC`9QWK~5;<|At>X05h%b3UW{xI>{+u!s%hqX$ zHoCg?%^mn=et2s7U0<1y@Rx2nb2CIA;{laoLVvIOgh+$O)@QsO%WsZx2BGtYRM)Fs;V=t#;d4<`0$-O;cGEq3kG8&Bt@ zNnQ%d-(jIsLiWPk{6&waNZEtSMs>&?xhXdnp1KPZY!IM(Yyz$~%oiGf!A7oG^QR>r(4lcC^hA+Ezw!K7#N?nt)!Bif{2! z#D@zpF{fM8JZna@$~N!oIy#D1-*fh&;pjpCy zycIx3siCUu`0wEy&Q*kGLyeJl)4|-U63*?u$DE5Ln8r!V_e-fy2W0yqcUKw)&VAZP zaixcE9Xo2Z`1Y~CY_;dhhUv#Dydj-ALoiqIzVtE83DsZik1oqMZaM`BMkK}$LmjVh zav$v;#$SVDD+;#c%lwe{n7Kb#iULWqf?~jG)!%p>I+?rK@B1JUn0yv_NE+#Sz3rEMG|N+AW$j$mS}Tix$~}(u*i-N;g;v+$Od6bn zsFB@a3ct|snHxV7HdN5G`X`G4?;tsH5JYbJao6^Ba|#~zM=L2nm7b-vB>yH|E?X0fgQNxm$G5a#=J9Tke6y5!yEG`{fZ=HvbavO}G`Z1Ap(t~OeFg&WM7?qGJ3 z8iw@=S|VE6F14AjZ(coH_$vMKsF7#N+2b6;8|TE5wG&_Qfew)=cA&iMUV1a>It@?s zw|ct}^n0B@i#uoVocgLuegQ284;No!62l=_LIkQ??M0qrFFkky^cI=9OL)5R?g3k)!o(RXrLey z1fvKfidv!1miST#5=w`dJMcUGXck*|&~t`cb6yYrIO=?RXgA=sLC;xoy$B6fe(&G&kPF!yBk6i03Tk5#UbQb~P zTK}MzK@S0_zgND7Ed6Xww9PN>ZoLQ0TEYYY95E8$Qdt3{BxdwfC|sA@ma%zTYvtOL zv7bB)T@J_%@aJC5boK3U7b6e|2mlu_)F?croib?#c5#f4EOx0Q@e$2IT zs0J6F40Ji}-%66WOBde-wJgYm<%N9RW#n?^GjcuAg9qB4H%+zw`nmWGfK+K`m5v2fNVBSDCB;6z}oAV1K{G%ER4*fnhjC`L*6w8c&LuCGfrJm;C5FtcUK(4~u z;f58S%0K71S5>7#N}v=mZeSKN*B8`O>f;XzB?ZvBz8LQVZ_@3(Z*y+>h@)=N1aiqq zc1q^3Wy73BdtBS*$ZG$?8~S(_ydgo3pqz>5$jC1`SESJwqkk5i3v&-OnR=0Z)a0q7 zoziJ+>FojO37!tR(rA za%M(~#wSEhsjiYFSs8aS%N`jir_v{tvJw^UNJhq$WF;rFtUG7jx$*wJe81n{f1f`- ztM|R%uh;YWn8nFH@C1rFA!JuN%3FEx&%CQ-{~-FNYU@nQL#rOurHM7}FR$7sOYK$E zhJ&_usgF#Zau1i}L6xHVglu`-)2o|&e16M<(C`)3XVGX9x?^)2?YtixbS%K)HxqZZ zXib+{VzAizjFl86&@^@#|0M3R0JyO~WuXeOpU1bNVA%s1Cc?Zfqc%2@9v{eDY9An| z@?lP(D~uD5FRzy*3WAIkBlyp}0>GUgOBZ^Th;ik<_y(k_3zuCP1?tT*D>vYs1dRy zJN)zEvnBU0mP=fqL>Tqw`UHaz_qU1i+*5SqnUd4)3j+id8?9D z?dhlWTBAI%t8)a;aU}H~ckH8!&zzr9Z~~zr)?JKwK>p#)4}7pE9VNH zHo@^z%W=n#4T=9)ozR!@A?EG>I@}}tkFpSmMpIgT(&XqgeX$ViyxuidmemAuUY@>FrSGGs(HUx$sZC$m zAj$Sdx4b(jt*wPB&}@FwneHPI*+iq*waaQN{jB)$h#ipCx@~YkDG29!#j_O zs;6h?j(=G>`lb99U3^nS4u4{n93dJ-kSmrdbt-u_9!{OSZIndFVngrKukj4dia9ccy{8T z@+M`GEOV8~%f0`-KW_Bkxm!T&?-kz0n?MEj=~{=XSNHRMb?NVyIpu>&(G<(Jg#+q{GRS@Ft*mK{{oa!Y zLsrhLVUF>m{%_daNp*Zk`h8~YFgMdRIPLP0r8Bqno10Icz(h)*XT?$6VSv+riN|m8IXy2yVXmz?{PG-TxX|Vt?c+cnlge)+f43&X~#w#IUsf z{%V@G?6>8Gy%5l6?DuarYpb^uC)mE2@DBPWo&5{7rN>)|cb+nFDI9-pRDXizoI(DA zTJU&wY%jhG$jo`uQ2xeJLTOFklpaz%N{fG^Q%?L z(?^pGJ>Iv126?-Ag(gF#yv&wkUb3dKZF4_Vp{9TtHa)_7I<@kPL6By7t{D#I#_fH6 zqzUvnlWR1-PFiKKqHo7V8rZy%emuEpwtk*;UF6SWtB#AQ?H=%v%lPfQIdm?< ziY*;dAfC1KktpXzv(n=3a5hCjeF@j)h8qQH%$64`qX9h1r~`MRg1zEfnepQeY%N9AdIg($Q*DCSm%-_puhcyuif;WdB{j`?IjPS=hPxnlH8sRmSCtsd=NbWV8w&O;_2n%c6NW@D0(#$XA|9iIf1$sT1H|3k4wW3VTfxfC_xV#7YFQJ3`PbdMHSA zj{!cTI6;sWi+gO1J3bu%ywvn3JkM1OqnW z0;GXskF+QVb$qgktCuzF^Kv|uWtIz*UPtRiwfW|)Sg+s1!a`w^|F#E|oU2M6qQb^& z4yU`|2)jV7ji)C7xV~MK{BVqo1UCAC{Qd8oM~~F8ZT>G#oEnwU*umeyT)}f>PYcIv zAK17Mn0`fE{GIjdi*q;MY?!{R|Mn0e7!okkAwI!(@op`7Y^T}xhl1MRW`ACe;(!J> z0WlxZ9&ky5C7V*Hm?c5dt5)(|GH#}H95bX2cBb+~h^mNi&f3k%@ND(r&Sc&@=-_?w zW*qlT2(@5xTm#!Dy23R<7@doBxMEojZP(x`7^mEDb9qtocumMyF3+By7xNC|J(3 z7tlS9DpbDcX0ZEFE3P4H7Jt6>Q1)n7E>Xv=RIRjG$Rnq9@%57?uIfK7{Jdis!7>$( zV!4l1|KeG$3$+fv^~4s2yqv_odX2em*rrWJ-P|7Np)8 z@gGnBj(<3Grj$bJ9E){`?<5|U5+ujFuL4&Sc^Ls%@q3WdSY0)nN~DmsgC?bkd03+( zm%$Z%9tTbZXF~5==~VoP-*2X0fO+%w1h!CezhHLQ(^p4%o)F82N#Y8|Z=9`vv6C+1 z(uE26z6)9~U`>-zX~%|b)zA*#ikuRoSYj=c+k6G5lh+u*$-2CYiP*0Hjx3l-v_+Jp z|AeG&+HJXO84JhOwiLTRmf=#Y&%S#aDWJ_qofY{S3qMHyPIo-Jy1y1f6laOGhDOwT zU(;gw>@*~(T%xncv3D5>hqL=`ygx0=H&?m!=T3Y`!N^#4H%$IMXd42+J)qnyw9spA znZGYkNpN?N`r=Sm#QR5_ON^?&yuiC#12-0HGZsWoe@`^DucrMX#Ml$6moYP6&n$;p zzG?UQIYwrEtbc8m+R}IK|3BsX$XOI9I%t18-qmjxFhAOu;wytF3Bc3Vu*Lr;j=Q-~ z63g36LiWNWyCiAym42LpP)E#qhh?+?Wr`nV=p7k7_)_7m6cd1dSbj(WpV<5rt-ago%r9U`*YD;J!ee7n7+x+h?PCkm_nMXUBPl3JZgwH94Y3IznP7Igzx}=@Q zCc=L68{bSGtZe&&h=~R4==C$?pV=v&RuL(=)nAE;MwyGo1jzi})&1}Ema8d`V#X^H zFtMrbcRnCzc6uiqYZ?n(QZRE`9Gt5x->308ISImgn?Z3^_G-*u@WbU8-uV--MV)BAqKkEdFK zFsbs=&Fo-(CLK@rU*#L{|6A-5^$#^aj}|&u$$tAs$BvH*LdCSYIR1I0w)$;;6sPR{ zioBU{xE&i(11PMX!8e1#aB*3vJ(qMh%m%e_Z>rdXa@?LTU#e#RdO7qU1 z5QSw_xq{$euv@*@P22m|n^Q;{gpEC~_Tw!<=5mcctzsJpjO|?LxaceAyVb{T^%l5c zJ^xzSB6?P*$&Db=G7&{_1ZAQSU^r)iy_*KNMm3=jA$H3efrT*;;PqNDaaO=52i_5y zDOLm2G+-u{b`gl{shzo)b=*7HxsQSqyc4mJ9b)P%hXR#JrBD03u6S~2`pcI0 zreL(>e%baj?TYOj<1?aJRlVa_RzPG|fKtnlgJd5>T<+R1UB)rF7gDX@6}#70ef)m^ z%T#l7do1kHiHiCG{|Ca&$I+BY!op+m)thy^o1NH1vUt6fZ!#AGUiu$FHfjFT0E@b{ zp6kBCHQm>u_0s}$@vUabOSjn{9Wn?lgA@9&maJwR4@Zu-EJ1Cg0fM84q}C~@O^bz@ zJe0$VsbdX~Ua^gWaWSMmA&VrpF_E*khjtHdWQ>Nv3N3=cIpWr}2(S8y)wQZwoiA${ z{^TsKaU_5lrCCd&bu0s~cI;#8gVDZhi|^HH%bwEb;=dy86Xh=@zhao=EujBl;*!-$5WlFrn6U6|7CX@w$28~!mEH%x*hC+`;X0x7B#XrzeP z<~5vly~On8i&0Wa;!o3b?7i*nCx=iJl(~)gnxbvp#!Wg$QQ)#%Ay&ds5i}utHPyv#lWUc1hs&l5-I^lM72e z`|9%C88w2r?pJ<)2$*W~>aGi2!N5QR{}<**FkrJ=HJckMCzQqw$bVgK2Y-W;mc$R6 zDE#`SWd5iW1fvOC!-wakZ^DN18!H&5lz1>~1IR7n^jn~z3fR!>dmC0B9$lDu0k8E| zyG@o{gER)dOANTK8R;T;QSf$d_=TFZD??n4Yx&)CO@+(aj>xR%I@Ce{=cYJN|1feQ zqFDoF)+Y-(<^*>79O<3O&PQpsVN`7hv2F{gK0IC$7PlzP)@&d}wVeK1-O8S*W-0jO zjBV&>W0DmBH&JcK#`9Ivr7LF8^nEb2ZWq$)(iCEXo}I7R;<~6dl7SA&X8-vl1%!+0 zL(g7JG5>rPfkyM9>ormtEsMJR4bxe*q$qKyx`wW*#m7-G$Ha{PQ54DTk!tfPR{T#{ zCv%eWz|18ZDYT0eTs1IeFYi*V7u#P%YFpeg8?}}aMzCFj{O%2Qa=LVb*;q06n0%< zpB6>N?M-cGPgWrora^Bmy~wPf?mb^RNQ5tsa{OvYWC;MslD)OXsU=Qc_>DV5RJ1!{ z)w(Uzg^3#(d)a?*x{I&Qk#&Ey#pTnpoM&w4K=76f)kB*gl5J)});}j-c6YTB#SAqQWaRnQWP2y|H)` z+0AwX_?Q}!#g-Krhi((b5izNhz-zNpYM`}|T6(wONECT%X4vPG;=sdFRIM)dfkE_v z)+NQz;VQ#r*DV*XmH1k|76gSw*r@#x`W-&YmI*B=@HJp^8=@EBUiT22Ih{2^rNFWX zuEUY_vraf?c>oaM=_7@LZpMB8J$v}MbmW@ZRsXx74SW5MXj_XyB=;fa4Lx{v;Uf+T zXX{GIp_4y(0Wd0IpR@GdVt;9ga+wzf(`(m&|U%^ubM~;fto3w$|I%0yXn); z6}00iNAF?LQ2qL7Hq|+!zVQc&xUi2V<}3nwu$K3@GLEx-Arh*@!~oephl=+r^jx^> zG9H?D#whwnU)9`u`(Ojav~2&dk^O3mWkR1I_)6`ouRmT^SjJ}Ue>3B9le%{mg=U0r z%EevzyMB@px5MDpG>*2)+8BC74bkL8_F_*4p>`W!J-TLH7+gueg1WT|aYC68pfbMS zrW3kv1OY~uT)l5&$_zhP2t*yJyZdokP+5Qov&(f6V8V)iOP4@pFoJh3kX0ryj%P(~ zm~*3HdMvyS9<7Ht+$(d*g9~WSdZ!I#>@J;`CkhN;GdsUyY9a84Qddeo>N?*;1?|(H zd$HQ0L6}y=4_0k3KQjMa=+2uaEE?9>UWf9*Gdbmo*T~e2lJ)EY=&!oBWE8qF?eiL1 zeHvz*m6Ry#fz}VZs;Dd^c49EXaO<2t^7Ma#dp^G7Y}5a%-tEphpfe-NX8qflb^==^ zNlckjZNk`n!&%v_>Fr)9#R?azvtNucrNy1*DsSy6-F*e~&WYKtN|e<8bn}44peAi) zARwD-95S@4_-u5FaLc9ch<|}sOPtY){vv$#6PO}4S3ak2lsfTHB44Lk`!QYxafh;{ z#W!C6dqh3IL%Nts>ulM|C0e2q>LtmPi@11j6nIrV;>x`b_Kf(JU<9>M5fA^iQ0b~5 zWK}1!85t0zxjL&-E^`pgE22ai8~LaWRPK`Fpde38NbDfkJz&C~7X)4vgiJKW8drW> zfwE;37YZSbakQ5eKYH>5g63Jak~e_O`}%w~1#5gy%Hmr>h2%ct`0|-Pu+NIvph!9n zMg&TlR(!$#K5@D$?mm)ho8H&%derTesVVK+QdYbcxc!;_Fw#o zQq~Z2w%q=tE?NvV8k)^<3+YlVcHc35<6vCpPkWZe&tXZUuZz_Lu_}Z2}EgvniwDlqg^{Ib1?E4MGU;kY7aL!QYH%x|GPP(mNIaMk@POY*1 zOQVhehyXfVr-`Wih4MHJBsLrY;-&W)VL~3gH?Q~!{el>wW+D{pK6sxPL(9pE$?N+(o#$^6v>K)r3l)zINfXUB4S<31do#fuHRBZnSsP6-tU-7^e6 zS8>l%MW3lKA=aYWn!m?>kT7;#9otraHB*2f;xLlxm4ShO#@iP4hli}VPGSJMy)0Yj z$`z~Q9@?IJqW@E>I~G`oaoX(4C*Rp0w6nYLo}@wDVe!cFN4C+NOS$HZP1m-+_{%9F zB^M&auG-YevW)s&Ta=F2{m;2C$IAoe4Uf&YK?-Sy5@U{o)6MOWJJa^uXUzsSV~D(2 z#xFo!hq8d(dlFn-7y=q(cI3I}+&C->n=K~JKxlC&FI8Dz7PtfwE-)czWMJI+H122*tBL0oqEKi9RQ@Q9fzVC zLLpQmc2l__XpqY_IZuuiuk)LuZf>Iw9>Luwm^YH(BZFO+8sM@eQ5Vim#4??Qd19fQ z+V0CxR@_v(FTQbt^z30%E%c}L^7GO{Z@?YD{lKya;iDjA%HAJMpV}{}F_x4@uz~L?Hgq+Cqs}MPMuvFL|w~hIAL&3g$nu zsdj6_`<;q51=^%De~sNqTa!r(`0*}UmvhG@XsCS(@3m25(Y83_p;uIWHY^w(UvOBt zXqqg@J#e(PWmRD3`FeXHan%XcKkISUS?^sZ<6Y}A2V--wn6a`sgd;VF ztosQya(fgDl^D z|A$iASM*UDYST*3`LH&kqUx~iRorKO2Y_qJcMQIqF5e?&NZ8pCZC3*yxNw`Y zUwjrz@Bt=AkYx-}o^>1A`*woXnorXJA?(^7!cp+`Iug&_^p879_?I@5zl?dXb8L`J z^D%7mWc^akT$$2j+%Fwas+mFhBEwKv6lQ2UZyiB^a*s69%Qb5u~OS z%fNxw6P;>g%ewSoPv-5u!lp+uPdtw=qkiP|;|hbKB>9eFBe_c^t0H#H)CXzvw$Ea~ zf`=G4@aq8U^$c%Y@mUdog4%421%0OV{m{bZ-SXZ(O>RMMm6loyc&|IW(=ZMYX(#|7 zaK|awd0%TfMOXJc9`m81w^~jt%-mP?;Zf{y8(K<(r|tc4Bx#nuOM5e86%~;2r%N`Y zW8FSj^?mbx{5eu{b9<1592oCQJRpT~{gS7)RMAOX`pGpG@~U-8#$V&zOgh8(_TQkm z>ZEjRC|dj*TmZy#xI6GjR0dMmk(!ShZ6=KFA(nIHdOG=LyI=SfNbgR^zx^Z4Du$|6 zz73>%-1uffA@#7m4T8&=tI9DzIGX_Ms}&W1(ngduU~o@vLUiXHn6~5P9lK$L0y1~& z5u*5U0#=04Eg_!LL|xgBo=u}ydR>W6D;;6t1c=1XXgQ~K9o;$pK)9C;1CxJVDKDt=xgqAzS+uOnq9nOFH*InV{ zxAT1GT+#F!zuqrq)m-8rmw*>xA%IZBL3RW5XewzfjIJX>;>EK{WddWR$$97}*wG!Y zTKo`~0f=Sk3sR`eHkiGwKR3ga4iW(?HIndkpMezRGi;?Ea)N8*z%sh(0nxo{ao`#9 z77)8&uN8EB+rYfjUoWj1J^x&+=v$Ms|6UkZ6!nrO zNc~*$;|A%QJ+}2G9}Tfr-GP;Gw&RznO*9fqKXx4dt%kE<>$M3G# zm>E3LPY69l+p9Yft2>YXR`N9EbJ>T(lbAb)rzOLa{`qg$sz(c~CQ87b7xU83`k#@L zn8@9NGS}i+bod2~RP%8vaFRqajIxnZeLRw%&)5D-jp6_^J9K?k{W|+z| z(m6I}h)chONAC6&w$^Q4?RL3qX#Geh*>AF~DSRbF5A3XEHDJ%icuElB1c1h*&+L7! zUQs`_EW*29SZ`V~`nEQI!_|-i$$v*uMSu%*({JHCmjSwXK3)K-2eA?$_YevYZ|VG% z_UKTZH*)sX8n)=!cv*m06-seTeq!fwfBw11__uLJ2k^Q*EB2t&8`>I#AohKRRt4wE z>4A_>S9wM+pv6774g1RS{_TUQ)NZfe^sD>9PI@0E{!jGH4fng}neSEGT{bOBx(;DB z956!qM>xMp_ajng%jrA&cOVL?)76b03I99QCvxrh7TJ7?I^ik@8!0{#4aY_)Vib$a zxgQH5HU80#=kmfJ?e?{~>iVP3IxtWG36os#@Q@hkqf1X0u3ku9jj#LmX zig_^!c3hn_o;o5e1A6LU!iMrs35pdpl? z$49fxB?$jP^ueC(t)f9_8hXT*ds}Q!bS85xN0Viqi1i-(SIjHI7nI2eoSJ=~x_{^7 zeV^w1hewJJOYoGt^B_ZL-aPJUsKei=IehQ%yltVrT}1LNJk#~T(|bJS9z~zD!bA2d z_t4Ffi?U9ZZWAYdbXqRj@4ITn%s-&E8oSgtr8|eWY%Kj_2{<0Ed<(HdMqgjz#_1A4w6!q|ps{6LDZrSBhpy(EFzW};*JqL;OfZ~E<2c4 zvpZnCgfKu8*6hs=rlM7TRnY{AyEu7p^-%$?|y*^6i1-k8Dsx5w404eOeTs91t)3#Hu% zRU*VAtr3&P5_M?CNNRHwG6-7s;nC=&loKvRk!C=wJG?h2ojm|3%C?7S{>biX2{2op zwRT9Ija32=cMWPMcrhdHbETWhbOQ@Dsj6@Vcsz-V7Mg1lxKg`Y4#e1HID6U@7*rll z^p<*`tm0*DB=_wuXM?=ln8F)XD5_E=b_TLNMHk$*ylBBmi;Ly(S?;bI!EC?B5?s^X z>g>1unK#ZBwSyp<2I7Q;RQzNHDJJX;-@<4`q@QzHKdTAur?xHDyg}e4FQB`~=|nsu zmnI*{vD&f1{a+BHO$0QPu%F{}o-B&}Npm2yU)BPHzSrs}$=5kfC}KR&fY^#AVEJa= z)<9J5V&x&#%WlyC`-0e8fGnZeXNx9#myp;3((JS~>!DKvlOzZ-Ilt)~xx;wmUjROw zdHTYh2~8_CU4)qq>_4|xkY!@$0o93D3H!6SqV6bS6`9C&`HOd)PmKdCZF7yW)YvS( zN;@Po<5bNv7NuUj@HX%@V25gPH#ME+D*`y{L)n{2JMu%70^M6>k=jdPL>7|Vjx3`9 zWHg}4FmmfAUv0#uF@N86%(7fjxac3-N6D*!)d~BzT!oD21t*1sQ8j*xAoxL!KPZPy zeRsT0hUu5_kr?#KC+6U{&MSMn3oH-`vx48{_A6VIVYBPVJ{t3oF0G9cnX2#NRJi#_G;`+`{(Ccb*?)#Dsd@jAL$e{>xqc z{czICtsYK`7d%G&Y6L0G94fLO7qWP4@g%WElw!kuq{h#wL@a0V{qUZT2hgt+j8I20 z2{184cxQNCq~Z;EpuQjtU6^VNIN<%of5o+2Sa&dt9YD~?D;Pcup($v0?5`9A#e@IB zA<%ry9(Lqx2a(=~GN%TEw*!g<VisXyRg}#z+V1Gn91fL)gKmR$n&CJNJoknFonxK1yH`lmO zpf9;fb>i)tN{v6?2*UOH%CF!zaF<;0d?!M|84+@3D_>;bo`tC(J1qO*&buWOaiHPN zvc}=J(9*2I--@E_K`N(89{?}79u09*scTTW0ENTc6l`L|z!!2GoLzGSHviS)RwJeh zS}+&CI0vSJct|jQ&^dl9^o>B}PaQY94S>C4@~z~p1dn4kW(NtXNasZ%G$%$va76@| z|LEh_@~}s+Z7@Qn?Aq|%MejJTaNdv5ZPn@`@c=YLnG zpn)~oIVHdt$crCX#R$!?e5%Pelefe)VJ2R{H@|P1mOc?S-p98p+ja%=CL$G)_qaYC z@fqQ8Mr=L!Gi!aTcZQcVHKFw!>@Ovh)m7a~M$#$1Ks_)JG`&wFx|5@g7%lznPRcVFy1-F#rmNI-2wW;)@)1uy<6@ zC_W|yR9>ssI>qi-Klm(}eGLDLZ^Acl`OL6*^nZd8r^lA%5f`~{)Ev}oI&2H!_2#}M zZ2_DAl4F1yzfTBL()0eU)gJk`XYaNj@d|j;Sfz7o&#_y}xh_gBXtmER4U6OKZ51(x zjFnA+*x|XCPCbzML%uEaB~B&hjx8u2H?d3>zo{przhkh^5`^b44zNDTvsSmDh^pi; zh&lH!H0QBCTna6C_7TPF^9tBox_xHScprKXne-ba=MP z-ul-h@j+=zc(GiWX|S?1Yz=~`f(tYa5TX?Xpglp3@ev7M!M5?XGH0cRF~d#)FMxcB;TicVA8=T|++ zDYmcKn+1WA({3@;nT2{`Rg(JSv+i#f<&T@}K$Zq+yd5(><3p1}n^`iIV|KT6qU&Lw z))&uLgy+-2Wh1mcHH1P=wB$$C85{sAe^Xl=YPMO9OW!e`p3$e|@DK*+&|S#1yJQ&J1`k`FDwh?Ojtu_S zth%}QX4ez!6FYJSft&>e#q84zU~Xq73SQ-)&>^0mvFHl2&999NtvY#}O>4x~NX@IF z=j-EjxsE%KhCTD2@#Hh(h-jt>N+``Ga>%);H}*$C}#&$1W#& zC8@YUG|PB9n)IkF;T2!v^;ir1NVh%*=RYq?b>8n=YS|a3v2V=x@+UqCFs zkBmoIM)*biQlov;P^tTTMp zHE-+bZQWQ^e$@Wsvg;qp=1lO9 ziNf04yefG8GX3VDiUf)Z7_pRi7G9BU5YUSrIWg7k`FTi)03Dp~ahXU>4iwexQUhYH z^V`lRl7I8Udyy~Dv^YP2M~vLo@;p0Qc+n58EEu>ViBw0f|0-gI0?RIJJhc4hkG+8M zlv#X(F(-s%$zt;wdin4_Yy}8dUu9>{Pwg1QCv#QjGbz0yavz$Ga${;t#1XLc3BmzD zQCf%`_)yhlBY&q{8+6&HLrP8-H@uZ=X4J>KzL9Qpaai2Y=$+B2S` zv-(pqdv&RXDLCZ=O)8z8a(cZZu*?Ma?Tk*mrOa4Q|mbgaAKu#J^!Jd|3C%bJ>dg zXC~E~j*6jgh!OkF)2iY6MC<;6M}iZAZIdwPj9s7BpN=G%4+wizwRf@^n<7G!QIG!U z4DVr!p6E{Ah1hoSjV{72HFTtniEZls^t1~2_6x|Z=&r(LCfhh?4uRSnJhGjJDr~}t zEd-m@GoluLo7`RqW|Izbpv+MOST5O`Gq>HCBG_TOdhzL4331a&UjgFj5sh*lcJki- zQTeB|tM1zIwUtX+Psokl($1gF+9T7f31|3%sw{VyKAI^GlC<-j7O(Xh)KaKCVCpD<(}h7!JYAmvGiTsTUHTd3F+nf|Ay;Nx3^9$W;OSMZKQX*BjzjTYM@@T+ zGrKWq++aM?06BqZB22ET8s(L@a3-*sF?=!oZ#LZzTJX{DMa%YHFW(Bqrre_yY=$|Q z5&#S@6y=;9Ulb13^?xH6RFw$jZMw<2o?g9Ny*w^!CRhiqhZ8N;n5 zmdlxPV#3ly>Xj$2op07jb{ICUl^>3H{kLvy$5SOMA>jBi#oU3w*!qQF#=-2x^YC9Y z=65!bEIKE2eI9Jm(1!PbDzP~DJmdlQ0!Vat{ldeVMU?q0NP9ws(2*DjHv#$^&C!e( z_J_s^djRVW8iA^Vgo@8J0v&l}Q|t#TyIA=exZmfcE%_U>38eO&9|gJp5gj_5VoU!z z#f-xW33u)zb&iBKBB9FNa9u0SZiBp%^!;U%{iLBS#m9d>ZOi=V@X2a?xJIe*l?nh5%+m%U3oDchnjdhMEu4eT2- zqIR{!iF2I54*~a(FMB_+Ns`uQ;&#D`%q8ZHdg&;D$bsodJ4NRXk+bo z8tkm>pU~xqY4pZ7grllBK9Bo)YmYtTIiWx#U&`6t2uEBw#?1-R?srmXg#kwW$+CfP zM%ZxmO~rqq$7L(w>n)VYgqHxss35o#+1#t-fk0CPSHN70Z8R!iHf zEQS!HxXBf{3ed8cZs>7eIy%zmbdv^C@`M30s#fx9^KU$>50xT>g5v&Y`&zY9ZHPiI z1h2Fq!rP|kM+ab*Ay3Wk}XMA?Ecy_CvN8@f$747!oa+AkmUg?z6 z87?7d`M~qjVd&@zU5b3`E4M)He|TbCTDIb&W}R%(^C>ek0U(9?6ZnG;5i=LYFk8un zsdEr_<>YxDrRtkEC%PpPFCcRix{ZCc7k*PBTJ>$CEGWWt^^4-b@I%wt>V%Nh1R5ovpoNI zG-?6f9^-%5oC0-(_}`^Df@oGK_PIwYEg>?UH*(U;_ry@CO#(kb6WHyAL<{s*u|KH- zB6n;aneIZ)JZYJIEnU)eQF#<&{Zr`I1A$i`hyM5p+FjOK0czCZ2V06ls1=&bp=wKy zDLQpg=`g&99KxkQ(4D}S{W+^2KCP+2#>+7Jv=i^&jNLB9kRv~wf>F5$YmgRXXU3L` zxPlU}*V>P9L~yZRvHmP;?}D`5Xz8=emCCZQ4rZ#iw7;UoXwAKh$VrPJlzEWB-a7}a zw0=2>XAri48cGYT-3J#rH^NjtyB0RhiDOrGV4@~4Wj&>`0a;UlQW-%$xRe~TFhX7b zJehkoCF&U|p>px4d-`A7n2Gv~AP7*sPeWco|NG*`tRYSW>ag?KM^hE=LetUfZ@55C zP&UV17_{G}dPbHhg4$@3z_=0L;m`9ZRwkFj17EyzIB28_&P?~0ICS>dAfKi$TQK2a z(P(z)lHeu+_hI1?!WOQcH7KlUgN9nRPtBjqeu%tj&bixt!z{$-Y(p+;<6?dAEn*&{ zZrorIaJ8#x+Kn)@K=v_O=wQwtybnfTP@#h7r=Kz0=o%r4HTNZ;PzJ&YSdXPju3Xtk zO3I7jC3*|eT(qUz?9R9X^*$r@a`P^Sqgso$&<_NAu8d6=pwz|XA+P23%7>i%c#AvK z7$N@EYi8PvzB{4c%lWABq46t{vaLrUl4Puqjb?ZYXz)lLJD9~XSs~&6H!E~UK$lV+m55Dz`u-#$f zyT>Mhm|Q1{r9mvt!n=EL(#HM^#BO$a3|h_N*SS7v2&1@4_aV~Pfh){)f(4RtAh*Nh z2Cnflh7kcaJY>6MKv%&?`{dq=5X69v!d5d%jO^&Y2O1)E9V1Oo{R#(P z9U`Cn^`U+L^brNEb(A~we)-xrm)>;uC3UJ2>y9ZIr2ODOPj*N?JX*OvJHJKVyTB&2 z{*PDvi4cgaeRrv0Xs7-9oF`mVcaN70$J*d@BpHkx@)w6$nD;rBn?!Dq+6Y1b$I2Gx zjYuIrF-v~e7hE6)`~a_2a~#9i4gyqR&W3Q&cG=;(TwT>gHe1BiC=LD%_8d?6bNs`> z#UiM2a%P0^w5Ic-Xnx12rm`Wk;6Add1u z>-YP!e8J;k35mtKve2o9p|e7qs0DALkdAf4MqnPg@z;z%;)t{$aOV7p(DTklQ+j=x z!lUzmidb7}-;WL(Uf>2{2=cr3Chg1MC=}d;N=N=qhg#AGb$(J7N5Szc)%+fTvFbN$ z{CkySz*-pmunI=Ho}O%qoL_@HAO^C+tThCVJL6<=z&HY;w*$9%1v+)Ef1Y5?C07o$ z(W+UJ3vbk4w9q*mKW?eBPfs}KMGk14;e{2=>R2{zdqF~ZOHoEKCfv+B*u*xD%+2-0 z=2&x5@@Ae)G0FUmQP^wb3}84N?Y}>cQ$@`0@pLt3!_pd|F;{S=0vuV(b~c<^Kr zZF9oq>zaHI5)FP**+{(wQ8S1+OCK&E@2? zpsZwZ_A_S;6tU2fO8F(-p{96>f2zWKM0mF@J0QY2J1*ULJfReRo3k*hfW=buc}DuS&KLO2brZI zF<>O#VRjYLY_VAphg%O3S*Dt67IQ5DnX8#_j9}WPgTh&z378hO25gym zYJT2!Tv6GjxTRq%_n=5sth^2mle-aYT~cbEy-ut%1*|~hfct!XA=vQ)lW9&ZNWXoE z6*|!kIYtUe-bovP{h+LBE1OL8-e=-q88p>pHOiDKC;x(|Xq^WF^*goEI00vfuQg)K zxso;Cu`$D?5Ynh{8i|XveaF&)nL{2^pb|wa7XnaH10Iv4z*hp%ctN_TV-vY8wds0=vg|g!BpnZgG><-E^~9umbl($WT>k^e$kNW$_t=P0EMV4e+3c%#kL=1x zpM@efYI8Rv*584RzfC+t0pb_(k3D?Xp@TxZ2Xav6*#yC#ocrsTB~f6|wfF41zx%5V zhp@?M9JlbZFn3k#h4kI))&$8O>B~*wlKC^!Xkt;IAaVt(QNG>giJN7xcf|)uL)(pj z;gO8G;wUHZ)#qw~EhsxkAJ&loHE(wG4oaZnP{g!A5r)w(C)Rldxx7y;|Zr;7L(5u;cFsyBDZ%OcnRqi8Pq= z%YTtRL;WrhKDr>4zv3Fq?O5GnGs`!jX=hDA?@knGCqHe%LT%cu06|rREeH0TY&0lR zHdzihg^42ZPVRYh(X=(t!o^3{Pqx0yM96tj;p*A{QfS-2SAC))DAb!rc{Ta5OqkR; z)AaLxA%q8*;6`MQFx|4uH42LeabgGV?Kd2&(b*?OX#cfTEqDi}`sdbSPXk6KG_(P2 z=ya$cL3)ihk%W!xF3o`Y=rn%FELD^&0r~l-%_V9O>UWsNzaW3}6WHE8Y|r0tG5o*G zCHHR*Gh1O_p~Iy|YG3rLoo7eff6G^@(O?^FI@;&~Tf&Ny_kZH3%wR z9=uuCDd!`cT)ZjY6x=H|87rv^?V8(rNn|Te2AWV*r=%&`?)=oQ$4wkX3z7<=PaQ^H))=kI>X(T7nduU zMKOt4GJ2VEx%bx*MFhT2GLU$LtT_C}cf+}EDY=k;{g?)?iJ^}q*%Q7BgNabB)o&{; zcTdIV^R(M0-x>G9I5w}@L2;GI^XEG+`6{PwLwsQ@b1T0#1}NAC?^qL%0xu~}ly2(y zd)4`%hx&XdGMb8Ye)hDsFKAX0=@(;98QabvKkj5j#%b_txX~AV$ai_y#2B05VKy%? z0?db&O4E_p!;Do~RpOC%87p_75a{Ju4SSwv7W7vO7yN|uiOh*1>WJD(B}}uF6UwdK zbE0JZNvkIM7Cbjq?%DmKUbT6$ucg$@g6<*%?+E9rfAnKtlW^{GK+N7Y%t(qV>U)zb zk=!pgngoLsE?ba|Pjui7e;*8|0gd5mwU~m>^+S9AA4_K*59Rm%|1)DSvJEO*jGaoB zB$Z{x7D`dQ3lTyoDoKSbGqz~4B$1?%v=`EXEJF!pnUb;_J6RgWHv9cMeZIecJsx@F zzVCC+b*}66dcI0JQg{c{CUrH@Wc!u5#h3j;Wauc;=NJx>7So)fx(vqgcc)qa9OCxe zSZzeXObR$LG(@#FQ|SYAJ8#(NT`?i~n0e4XNoTzahcm1HEbGxeUE?2Q3O{&@7&Qu! zL+%clKuyAtj{?e{F$#wIXvr)L`vV`U2lP6(uLGE!K&^K5sr_BsLYJ$LJ8ePsl8m3K z{T;+2_SUfd$n7N)2Q*lRhG^){tB^<#WNosFyi18*yk`cLA@WxiD0X`Yk4^{_C~804em`PGkY1{ z7O2Z|M5`RW{btw3Nl)MV2`ZQ*0)1zW?4>WKoU=KHo!ehd<=L6+qnj2*(lkWD%9XJ| z4=;NDcvZc@e zq@EuB7p?-48k?AkvfL-BLD3ff;0*?3nKwcOpA!i`oy-qBrdUTc_Rj23Uo~+S1}LY0 z>4&8YP~Om4j2w(_8^{# zfEqI5gO{(5buAlm$$)S&{iz6VE>`vPHs}R={Vx;psJGbx*_pfVPP!LKA4i)P$_?1H zs;7(bue+NK`_GwPW{B2M*kPlW`yZ(bvRANj?|4E-3Eqb^5u34N^Lx(7Yd3+{eAe4zwGI=G zPK~g#Kjk%YV~EOv*sZ9WxVmtR9WG=1pPh>4T^o5-ncH)}9&U|NaQoImJp1^$TiBvL z9B;!(l|6sESaajLm~k)R^_(;*c#VxWW@yvwP5;+?|RuYypD zF^b24m}^SD(DE!vXN;r8ySJ?M^1?B-#=Q~F_o}`-!Ti>et_Gpo=ctXb8ZfWEt{wPF z<^}hB^hta`mxssd-;(#8sA_}i^|en(A%JWQd7N9A4lr$M1A5yW7Ce|Y0N83-t_Q4$ z_XrX`qlmQu00ol4o{o^z44zEvpE%so7Oy3>h$KSkgkzf`%}g@20R?7OZ+87 zJ~so!LA_sBOz+lh+Vxe1ypw6n4t?lyt4sGxKhtVHs)_M`ejnKK4W=J&!w zRvdnfZv_le%d-4(UE1*tVC{F+5qP$QN(c_cXd!V& z{V~&zmrRb1rE4&Rj7Bz!g49yH1p402lpj5anlQLgS27^2cFn5%xICGGNomqC>%tX| z(QF5w8>+e$o)pUYi(_aEoBX#?)Sg#O`(12jSw3EiYU81^+bx@M>UNjVavdLqh$1jA z+T3aBoU@-v{@6KkB)nh(=Kfg|z<647S^4|Jq`NQ3fYi}WE@4}xy=SEbO>=npIB*s`+Sqrcu~)%hfR zEw}ml9`imbS23q6HxUi^J9AcRqgPvRC1$|Vy5R0Bh|2#Ah6duXF!p7Buq%5Dx4Q!o z=(a5LOK=#8c0m-FKLJgPuL&Qxq;mO~FYj1#K7!W7qfUH`2S>3)W<)9rF4$3PIiR2c zBCPraK4cb2PL_tI*1PiJGT54MR2mg73gn`tP%l{WBNtHpd_udH%K@z=?9VFD&<*@~ ztr4zcUBY+u&ZaK8ed{4PR%QA~3#%=Tmy!R#Op6DKfH)DOGP|d=>nPnY)@62Qn#@eq z6wIcCr^asuWA0{Po5tHjWTzsKvj+Jmit1z1!tFfdq87tEf&4=on8U92wA^9$HSeX< zVK%L*?M3IHlc%*d{=iz42R_?>;0q~LmpughmxDtpGn{p{#JTiY1i+X5?)3Bd`To7Sd~whlNsuKt}By4 zd7rwxbIx+POXxYlb2cz8W3EV!kIJakkI&T@(JanJ>e8FiYT#5L=#0G+Pv3KNUp0J6 z)+yZFXP36a%S6k2glDP8F!N6fs0WZMNz(L5VOZS5XkJW!W4Yl6aR%WPCx$D_)SltOc6?bzRd7YkYeZAHI^nGeJZvdd;P-B{tzn? z(-B3dCZ4Mg8=o{M^VVM(miK~mvZB$@TTD1}s(%BEu6yRHZd2~E0@bnAaz~Dhg|4eS zT@Ep5q)JD-u&VqhG5p&1VcgKPVuXZqZdLlgNySxdQM;nf$vmj}EO69Xcf_G|S&8lA z?Vt=4F6ciRi@BQnM)XVHSLl}s%3n7!OIq}JvfBUVa#TrMP2$Y~HZLJ~B6PjwqI(>$ zBW(fa;WYAp_gMB_v6q*In-qCU=!}R*{Ldj!er_PJ7g$2v^JrMeidoTyE;o|z!M04w z@yhZ^eR@RuNP6XlsQZuePuo$yFXxylFkG783~8tjQ5OXB#@ZG`1kpY~O-7a^nL0LV zEW>=jURiTM?vszB#1Pejvr2M1L?5ab7G{aRF5l}}LicMdLURRxbbt0WF8}~dp zBmk6t(F1pfN9i$((QsE3vEqM~lLWFjq^{3#_Sn*)R5?>zY;!CbR|jKkJa`*njt*)j zf867n3#RKemv`+++807lCeK9Knkb1LyZ#itM&Apf*6t#&vK06Ea?9kez1m~t_ncr zdy&Jz6%G3`i%Qgs2*3LEfsw&hj*mfb_o6oV?r)Ic$T%6C_UO}VJv1X{EwsySVtYPg zH?bz&shbzPn*#e|1ry#jjenyBaYlRp_>5kS0}Zv`kl)M5W)w&QP>KWvqif*Qrs|%=Fg+Rv%0c z{ocn}Rnrn|%4(G}RnUuvW^XLPj?h541^|JrJC0X_fe;ApVsrSzTZ@}d|Mj9gyJS8_ zxZ5L%3q)dWkg|vJ$JFX5fv!1?>~5QLZV}Do(TRV9?FxsuEGD#5T%YQi6mI>|_Oe-) z#-tJefM~Sz7&&523@^1Q?pjqQ-}HApPy}#r2qEkMT#Tn-7gYSpgm$5JUE72dyt=ls zn`5GNvdZX(Nc9mNJOxh5xogz>f0nX@4u@$w?M~RuGKoTyVcP4d--Z6O(>fcMOJ+?C z7{Y^(T0;0{j6*T_pOX!A;b=;SA$a#NzDCzY19Uqz^Cg7XFXsvwPf%q1PmL%0V8}%_ zZff8ed#W<9?lcwZ|xYe!7N9&@T z_^KzNm}y2JAN%giTr$q~Z|G|(4n~SNKBqKXtHz?|w!qcUEhN`oEp;TakAPyA z1R^NR{bv_qwL@1qAEjhWkNLnyC}K_CYhtJ5S8T`CGvEZPgM=$KZ8`Nj6v5gRh@hK& z^Q$`XjQq#mbG0%~L;Ko8RR6_K<_%FfYaWrJV|had5S7P*#Irdb&O;lbs@DUSalo0j0##jsfDz*D=e(}bGSU4-t=uz> z-j3#rC%1!&_dN5+eYW7kI-Zn((ZUKvO8%}UWZ4B zT%47YL%=XumOBst--{Nf5?|6}j}Kpxh6qJ|1`N{}TBhU@^P;PW$q}}Va{7x7r($c< zv`OL+%D^)PP%&62somptJpS+Mnu-&^s8`sxz~%Z*g}s(7Nc?;0pswSQhRlBj2s0nK zeV2gI88Z;5kZg|wG|0T-&@8}8qx7(M2L*&o%_%VP@1`C(?7|YW&YH5ekjI(&K?JtI!a39P|Qo;;z z*HwXgprCV8ee5^lgO{yy!y2(~9X*cRz4&cK=5Alwa}n_3iAE9ID1j}#W_8>2K{6HV z&MDa;h5R8jBg~IHlUX!*WzkgBe`nRAbi5KU@|d8hHB>uB+HR1xOkRSv)c0?ZH&U;c zM;>V)))4-T8$uft4R8-Y@HqeQrI!sn6ZaTLl9A?+Vxp)i(5n(v(y@(uj;jkGVA;r+ zL&$^Sr+jyT37r%3lFgPCi54OVrwpL?Os{5W@i&z%^@R~uG@zktj{ri^EDXlz9^ydI zZ`Wg2_3iEOh~xqJfHxFqK~P1P4u!;x_Be^5)*q;??;(kXt%nJ&z1|x;O!_CPQCyHsX0*u*M@k?uD|`qK?k; zKY$`upk&Wc{(f%s%@YfO?_)eg$VwR+^+xvv2Pjh4$n9}heobWFi|pda&sR8_p08gw zGT>`!c88SFrDan*UZK)$v26KpH8@iG_d+jAmEFC<_nw}0zY{<>aTP_}93J@n>(;Td zgJYKS%B;A9RY@v~Ctgj3sD&O$bbe_i))sR$8eX8zJZvlh?DDQlaG=s{^*IWhe=1bi z57C3`*>6iDZ98AGL@#^c_~?g@*%Vp2#XfZSsP8Ch@anlW-!ebuT(^i2uyJ$%Q%sJE@4j%EMxb|PW@iD2X< z1$i$nID-4$!jakm>q&VOG%O+)F8icRCHMw&ja$8sfKaLD6k(hF{~9$dR<{$Y7mSiDx>r zoW1(F{{BogN3-*1)C?ocwKu3nZ)0?8;b#uN0_ECinX`i4bd!zr6`ifj-#CXp{ z>Xq#(cZn~R>~#l;*p=tcOxFd?k|$6ZD~oI={wLyy-M*uAJ2EwKzA zcIiU!l3*l|_Zt#zS29Ah7erb}1=IJn7CjrJFd{h$L$6|V`%zAUO-E*`fR#xcZG@VX zdiY`!I-(7VEN|9|Z)?BTl)ET)K3nBDc~Lz6OY9A;g{b-k8;<%aB+ZxprsuOAj{RfL zlS5j&gu!l2`m@d3{0QQrP`K*#$iqCr-}C93vb`TOWkfLa^0l~z#82KTp7mX?Mj6uX?Z znHZJ7*>y%y6+=`~lxvdFDUyHnVb5e^1-S_ufW?jMYTz8pntLNV^LFaDNFzw>XHNUH2IDVd&($V1EKw0>TE6ROB_Maw?}i(^PkKb=#9E0j9Gq0K^0cq zi`Uq%Rx0le9yMZlvk1K>@Z%ZoWLI}|`v#D;ebHJyCESYIJcpR9Jxx{ASuVRwAYAtF!e&ENG<+Z$i(r6 zdpMXx1?;uuy~+{hJ`Xz!$O{>~bLUb>Y>C;(JAXacqQ?OEX5q<-_%V3?R$tlxiuhs%R~EA? zXn^=j*IB@xC6x=+4gNHM=`e7jj91GD*vRrMeMPaBiR=;mF5f|eu7sw?XtF%MI&$TB zHk9gTb(-Bxfh_}~SgnS*Kxtt!v^ec%t#hgts+FP8AL8duIO}pCFxSZ&-^V)E>cQ&r z{evGe7jpi+6Wa{q7=YSum9vbHF>h?GT+DMqyI}N9mcY4JID?e!@|AF^C@;g0b~YHs zpJH}2X8)tOcjght65d-Sj1#6B6_TN?D8}m(&P>V9Qxg&SS|h$Bp);IoUk9ZphdCzO z=}Hhs8QO9Qx_;imW8aCRd|s1?tOH*H!1pu5ZXLXaQ?L?)l2L{J-?)SLc*0)njvrqI zDRF095*AJre~jJvr0iuqVK3FgzcTbuGFY)Zl}N&r2-llk^O8i(M(VP=$n0(U$d1}g z?}HPY^HYxoi2}1D03l9+BZU&7Ir=q;zqQr9@zj72fl6Q8G2U2j3y}UIz;H>2=p0;&#nTpDjn+G z3o7(rI!C53U&%%wbXcwcs_jchM{sH%5Gto*2XNg=&>D;W{xlKa8LHXgg;nBRiRouC z%J*V%@vj{_RJJi)A_%ED9k9`)UbidOfh2dvUKfFGxivWvaxp2S3}GLc#gbz`@!L@3 zsS;OG3bo`oEiz3?2E*zh3CaHT%NUp$Zt6A)!BpE$Mm3fqUA!hrw688Y%Y9}1NDzv#cDoh$AX&@j_FB8vadPgf_>E3Sq z$0Aaw*y9XT?16&oR_c8%yYhLW+8{%gwElxs%NZGDN8^nR(&sCyWP)lGJH6JJZXafd z)63PVKAP;3@6k+WRx0af{B)mC%l&}Ihzn9;RwBSsi^(c73xn^N(l1K!w@4>lutUp* zHJV>7G=<39cF)OXX!X?Y6iq_~BFI|G=EPXBtGvZcjKf~*3)%&b+U~nLj^xt}Q@6<- z228;c1yE$Es2D`ZF|8NV2D54aqEFxqpZe>X6k2H)?xlk^+(1l=8Ue9j)7h=rY z68kB*<^ElKu=hHwuUC9ILW9Fb2`2>G8kdjCpZBbyg_s)foSWf>H1ope$9?wXg77)0 zv!2)GuOPmM1^c>_H%J0>p3je0gwLjdh&sbgcky|MoymkAj&x?(5Cs^jP!qxdzLBpI z36I7|$D!}40Uz+gkXL~voq>!h%Epd-ZT|ZI>L;6ooR{w5$O+I*=@cI>^js$^qNLv6 zp>wB6WbNzN&y#E6$aTSEK5%H^>e^WQTQe_>WiCgSH|fVy5ylOcPdp&unG0pCbQ>Ta zlk%j_{?Ik z$)OOi@#WSd7)##+Ew97`A|fZz+j%zTwI0;%S`&H#k|0`Dl7No`5gpd?KY+lW9 ziVVMS76wUC7mnRtU_Gy`8{5^;ul~bLuLmD@rPU`^W4_XobZ*W!S6YLXNfn+J>*pDM zK=8wkSR8AE1|Yjv1>{|voa1QPbR4ED9sX;4q>jIT4JhT)zgUVbJupEui-s8WzjrEN z^x=2&2PNZR`2!mh&)wZ@`a!RQRxvvo`r@`ZfK)!XPSln?IEVfrxqn=v5>w5^H?r-g z|D(Vlo46aMV)O44UvVKmVd9OZ(i`apua_}NyYTNXZIy7Gwf(I;OlzpH(PRhTeV4y4 z+gdK5b}dmgIaY^XsnF}Y2ZrfQ9fAIB;&=20*QX8`3~ub|78 ztaX=RKZ!XjZ{2Ls=!{!5hpf`KNIm4TI(GzST%d}21_xr#&(0DOYYGBtsr( z5w)K(QD^P{_<`~@ESDEtNhyH$#4WsQFl&0rZP>7nQ^J=-Jd*(-X-xNrGz`TeFuEn?g@6h#HKsszh(@L{&E)07SG|+pW;Z0g(eFg*<7-u@q_+(h}uG+BE+f(hLL6 z$du*z&6qM>=&w17y-{O@)fZNL+U8S{=UKoU#>_y)!`HCd+h}a zN2gblse2`Vr!mZ}JdqGbc6b6we1*TwaBX447sK%D`L5rx>mX*~T zEn$fO>V05CDwL1NbAj(J3{0>6Z*EP679dQD{y;ir#wTJ823VfO%Wksyib(*s^vKuZ zH!L8+4WO{43XcK_+i&KI3AxVnA)3I~@o)K#k3zl}E#TA*p-H_TbrdS3G})SX4}IMcs5^-5)m$g)b}Unm$wV&&gh|AoB3afT7xyHhI_Jp8%ZJitH2URFdj>u^nOVL4(RBLIh3mA^Xeoh5 z5iMu1Yg|`4;YaA&g%YN8VkyPx4o^%~4NQGNxU195fu+^S!Vxww#6UPj6#OTdca4rYvT!<((rcMJAX7>yo+R0GQLI6Xb` zA?}Mg#pRqT$TC?{d5nyU%1<+Ro3jBNv&<&A7*r#d8{@KySAT=&ajF3|6)09q4y3km&GRHn`wGIuXd5`~htNhD923+fl$@n{=BMK0q zSANB|R)ZCMe+#ni_T`lA?PV>XU{+#&0JT=6bP6W?c5%&QeO${JqxMlMfipF#UI-p` zk?SzW3WHLWzjaNV!Pen^#M*74{R%aqO!O*YQR*Yxx`)s-2E(Y zs1yO}qb-O9L$lG_dS@|<66x^GAmLu_N2iFnn=k0L>kyvD6WX1@t{W`*vEa521fa;` z9x`tgRW)G9G-5K&OC*Rf(kJN=%0_jd z>UR9e48MGbr$DF~%4jKf`}Z!mM04Jb8-4&WbT|88J^@X(z6mG^#aX!x+(zY+yT zzVUQOEYHN+H5T>pbPU$|MZLl+<-lR}_U^y5%v$l=i|PqiGV7voU9++EwIiFQ&Kf|!M@t7l=gT7-D>#3 z>pZRBe~CUXRN^>G{RBhgoLa;+nsga`4e5LSvUG%ZlO0_MWG;G+ZasqC**BsNB_H@* z3n46;PPWc3cxFUq)9=xJBc8@!%bx{~w7%yrQ#9Y1p2+{KK_IF+Jp4Tz`tZ37TF?#4 zWG*ZTp3!$kZ`VRj*-{W?p%$tP@`_LYL5f%2P8)>G6u5k=g<>Ra z3>HQ|{h(oNpNsmrs=KET)|KN%zzwg4;4N}%T z5ULhc&s9iZe?#|Lhl1eL8(i!2B6%dGwQsa);ztg?L-k8eYt& zsQ=J$kdihc`fSMDpaKvE%v7df9%Mi4?n z7Q&qhYy9n?Z_B(bn~&GskmkLL)kM}g)@C4kGWno`mY%HsPsxA22FW?^PZ(_}Nn(ZM z|G_5#t$*UiasIZfB_S9g!8x!hhg9)&s9$URwt#2x_;d%YNV;Tu|I5olWdu18@FRyQ z?Y`pR8dD>J7&_kzZHpEIcL$D>og$kGie&^6jXfXpVgIl;9=}+uj99l`+uxtW5>*97 z|D1gT8|+{)_zcuxQB9+ksJg>dV0*hj+7_sd@i(b0WXx+!Wia&Fnq}|YGW*@w(icc^ zlk*=Q$5t8-AqNeFnr*7B9WUZWqSr?X3U*2vw;Q8Gk02f16#8JL(?7pe?zp{gcyj>fJEOu8sFXxfNJ_|IA>& zSKO_*ky~qhP&WiherMLj$VXQ@EGWh?Jw`$@5pUj&d6%z<5ZscFJ4C=g;EQWA7=+;l z?(JQ7944AI(G%t4kw~X;NM0WV%H15pFE9%# z5IV|}$0*bMlO$~bLT^(cjX?&uZlNqw-}8j}*`!18e_8d~oGK!a zJNt~;J<*=w+p*m-ql8ZFveE>70qk(h1Z$B}wFHvdKeXWqnM)_Q&T?pFFQT$|V4m;vD-zcU)Gi5n&_e|d3}QIuB>(-ZunHIbEFP!}~0 z=V@VY>dbX&G>hITKW!$sX3{iDIO`&v6}y_X^$z~^JLjHnu_%47*S^^>OX+Y+1gUd! zr%2Wt|A)tf{I|aNi^-Y~>`;g~OZ~*z1BOPV)t;u+=;*xuf<ujY(;=2moOAZeI(S z<*#MZ9V0U}L zt=1viXWvvl%zy=r;gfPi{J~4;A)|f@3SB|&Tq8VFC$B;8kYF_@LJt}A=y^%G7V}G< zL6vfMhzOv6Jntw-WqA-94TbN*5dfs02;yW{O|IpE%Om)L68MA33NAHEP?rc@syd5# zo&tx`iV)n0%0+cRJa+3mgy-Ri*JEW^X&F((;9+^JO@n%uj7UKZHvBE0l-*`j@Tzh% z1URk#)_ubAHiv=8Mb)ZeW~&yUsrM!iTHuP*h_KGF1;j8ry1@^894L@PZ4bdom=s06O&!&zUij zk?mWU5pp3-s`6haL4hR~R_MwQ>29=e%=S80!lT*2R42-0EA^Z2&8)q|__WDq;ZC|0 zjp|O5yKwKF%}!=+{jkmh^r&DB#Y5Mf@HYWOIsv{ntBVz?R3(Fml7(Gr*;0+#?8~SwuORhyecD^%NB=a` z>9)hu6&j1F-*qc?|2{27+9u#JvP(tiXAy~(z@C`KxykBTwBC2B_@b@)&2TH9`$}MK z2Bg4kfo})^Sv=BOo00&6+MmGlD?Sh%+DF*S-}HDt zJfpKp%?eIFIhXnmox4vi<~BQ!62Af5OqoOMm)QEG1X)gv)>r(kamr~l5c)(jL(l$; zW83w0a{D>M2BnA%egjyxMyq_N>KTM$e--ua$j|*O&QacG)%|z7MO85k-Qqh$7=bcA z!Uy-4zDl2hJ?PtE$}pH^F0h$^LxBbhaRNj(U#Y~)+AwGv!6`e-BFcdni>t%;BrPyR zn3V@o_}M(OqJ_L?JK;=mHUtXS^yyKjw0LR*_k&XwF8(IT@aIcDA?}( zjbJ20FO<1l(0g(yG|p-0W~=mp<=xHWIP4#ddzr-q2q(4QqS@5?274~k<5#w|WJ}qL z=LMJj+Fu%1F0Cq49Mr95sPa~gYl2;8au1RLSHc7p}Q^@`22cyS?&X5 z$QjGp`l7G-h|cGI%e4s1@@@He_}YWSBuYImYCiO$MR3!*UnN>Rnfky9o^R9< z=M?s|3+k^JC`_FPb!lQ@rFw2}PRgXeMcl3eYdMi;%UG)q6Rf)zjuDc9DyDl^>;S3L zy>IGfv}i+qb0HNn71egy3hGVag`u#dnRymwO!-Ft&GSoUA*TSxYZ_7~c3|p8H%&b^ zX!o65IUG@oiai5Ca0jcC_cyG53TrEvFgnoWvw<*1L6hB1%pfg)X9;?XP7Bh`pUPe1 zV-#AO!ZLC3gwpLs(;-AsYmRT_hFe8%AMUXroIK#dcb=Q%IK9ZCT|f6pyQj!w`LOGu z4F2RW1yyS+h<& z@yg>P(OJ9Sxt+Lzrf6!_l1*1K(seU}uU!`Xq(Y+LRw^4whSQT3>|AAD&0~`8M6!(n zBf8cV=DLXf+tN^EaFCu-d;9{@UgfiKD3t8#TmP7#RU;EA$E`sT*CB970pytJ0#mkV zn*rGx3l^kLLt9qXv%Ri)2QDcO9RwRWN`ysZYQ%@trh)?GyD$IkXi{kB`Cw3&N!5UG zCU9moC$QU4w)Xx`7uao874iB#eQorBzNsOR_lkmUV(@jw4t_MrxD3Yv5;CBf-Bodf zSASuB?ZIA}B)EP?_X?XHDMH#K__bhkWb^`67X54mjNl;@!ltYw<$GK>szNJoEv>_m zg}PVy0XHgiQ+go~hwi4Y%u;{tT2b(aYFeGZ+)eay4UE+x4*cSR6gIppyg9H2WInP)q~4@)5?)BUYCBfc{VHyQ$p?~n+OKH79X zuia?0edzM-ZR;ydnq{ZH-wR#oE@CSweN|nvEETQVy4N>fvD!+-MXk%}Y#NTCi%OfL z-f7uBOTS5yUSMCN4L+m|P|Ml$uY6fD33!FB;KyJbKCcSkSPcKzhb*-#VZBp-s7~HF3athN|G& z^+i!|Wn-PxwLrG?k^eD1(REe1qiwZNX%DNAHrojhurDk&%*pSAky15JXREg+k^ z{N7i8Ox0X;*RXV%5do92V!HCXBX|le@!~Kfwz)W&>4-;luKOs+w@As7Mw5Sb>HMe* z-c0#?;Rz|}4Con<;pJYW#i=O;6GZ*7j0@pZyNS* z1*bUA1`aU!-QA(XCT|%ClPY3Jmhej@9{f?pC>=ibpjV!wtP% z3lx~IV%LZJcR`VMn|iQ2PZR}Rq5_c)l6pSh%};@vBv^bw z+Nf)015hyNQ6K6Sq{AI>Bvw2~f!L9L9&NsU{z`3dNzI0*qQGiDlxDSWg9k| z{${;Qg8X#75kn!6Lh!#(0-btgcLPgzTl^i9_Z$k{Qhk6i=wlOCUyQya(S3TzOr^np zRsnK*>-yajlA@FAk|A7B7^qQCT6_8V`d0DmvrKf_Q%eIC>3dt>UR81{_5WCHHiIGx zHI_}i)k4zsyQRgxvNoAFmd=}RIFqt7!i>yMUxXCCl?pLXkscJljXhdlBfObO3IfEf z?G3wDVpHp)JjO{8&VJ{HF37#hG)Z<^c*P6f8Y3LLNF_G+9c~EKsdf?PCt0}p{M@tc zNAr@m(E|wLt{)I29K8`LB5N>9A>T~=_J8i*Bo>-KUwE@@Iitm!{k+)bq6A5dHKTYxIEsa z4wvXE42*cfU)NuGOFXCkk(dMq+Q3GDtqd8%XI&NvXRn(4*#s$)S1Rkhr9iyaTshhr zq=}cHazchI3-Z@M5(K)+`@HaS93{Y4UEoe5hBLoms!}=0zHDcFnf0_jqAm2GZnbMi}qu|iD zkfGIB7Nw#7D{{-P%j@i$yXquc1>b)+1edrfsHHo#%H7vSAc6bZMf+d-zQagN=4FxS z`-7KdSjMN*(wx2yN;a-J`46QF{6!jeeYPsF=ha*5Ed(NG*=d~c0f9<4RUGNr%`5*b z$XiQE7C_?EiMfanBSwjU8ZyXTj^A0B0hb>>2xK^+$RV`J*DR<0&Ew937Q<}i)rEXs z&UYw&HRPo7rY)e#!&w=_`oPyT2MXHorn>X~I|%LwY3BqU1mt6&cH9Shx#?at!@gCf zBb{1*6iXIBh(PE#34-CYW?=NW6Gvi$tep`q4uwwIuzo1y%%cz+GHxbmoP#Jjc83Um zO2O)#zd!Eo)0wwc#7U6Oo2AHdELj#osaqZ#g$X`&>SH1;wHnj59h>)X6kocrE(`4M zrynoeB>~(|>UOV@-4NS`Dk2Q<3?~{!O&3Hx8l~eRcR%CAzfPayy_us%5_Y4&MB>XZS>b@b+LPOko{=iL;V2pDv+8MrmQE)_bh&gv$NGMhYP*PT9-QJ(AKw32dw(Cao| zdG?qm@&fp-+u)EnFWQubYC14alcpa+21n^F%n%&`cbL90s!fWN9btKQ#%=p#iJ?RDKGyLo zMLQrLPifNl7%0xtayOsWGmvH2jD zdaI1$6d$w6NkTj5egW@4HK+%@y>L0_a`QI1xfg_0Nw^2o(;ka~m1fdw`IvMi(A}#g zFhC+`{HW7(H{|aq9qWz;Ncasa^Of+?nu|S#SeR(8yD1d*0*T*ZPxc6;ow}GM-$$g^ z_n7?%KZphOBxFWh8yj(wDGl!yRV}2tOoE0OY_(0?L#%Nblc!5B`OQ$XNOeq~Vt#ra zI})6?eM7PT3UdljtP>yyO2rw}B&M_;7@9-MB~UMTPjO^;vRuM|DjSf!kZ^J4`aO~6 z*vOkRd|ScOa}91qe0_FPT7s<^z(8GNHu8Z{4F$z6FzkAptd!%@u@#|WCv=R`-P>c9 zV|k~(Tu!)h|K5J)Is<`Lo7o*Czq@z&6-j4MNR-CDq#(2Hj4&{$$CTq6e@95%>q7Oo z94EdLuA=cuZWRrvdps6+7%VE7Rn8!oOEDJ70Rad3n}Yo#_FFqvcV+uCM`cZIVX6!H zKQZ@y_y)>gq%c=eb~f)}5&l{4I_N*yZswj?gMBV{w)F@CT0@!+=B`6NF)MxVPdB~M z+ey+p!&d@X{>zLfF@ZBwA?|A2MT-GcUIU`^xT?LXjMmR>Q0Aoyem)}C*U+li4(KP4$LX7>gz0h{YjG|sc$q!WSh;yp3`37&Cbw{w@A^Pn4JbqUn zNhD*@bYtL~0iySsQgvRO)5UcY*Rh~1i?G%JapIUP*VOsH>j|DWK|=d+J}CxcJFwRK zZ}x^Cu;U#lT^=>n8&Oz@t>E=3Y-Dz26xAFjVZXN>umyF@X#eQ57E)iEi#UfrG=`Ei z#4Xdm#;EACg4gD{=`Dm9srTK;f>E_A`zj9dgdG299UN3v>mx3oC9~%u((d!qX&x)w z1(JpV(nMe6Sbmz>+~h`M20y1KL>A(j%qcLD1Ny0?!Qe4WKJ1>xkK;2LaNH52 z!!`wu)`0arF&ff|WiDp3*1)Z}>&~RUfD8pbHsl>M>B{_D+stv$W^hgsU0NX?Cu+b_ z7fAHV1zG$Roj-*FV-&4gTPMPy>9G}<`OK+-Q>J%(!so)0-VN)QEWdYK7*YHz0WkW%0F7(9DCT5OrRHM59 zD}mIKP=9F&gwh}VjRs^vr5Z8a&|)`CP;i8o`|G)(l~2^Z#ID!o-n>R%pFgi`{F@@L zX#VNZSHcb$F!sucseiaLchiFX1(kD@qV`-NP{-erLtCU~4G2ANOxL{@q1_uI2?hDj z%UrN9nehLfvYhiu6&Gl+MGXhdtV4vz1M1|^TcoRS%?ossHeeJCmfbMmRB(|MYvMwf z_1C9K%ni$?pp@+;I0Pd~1$l1;*E0}hVQ_FT?gcCl^!(i>OD9=>2pgx$1NI7X*Re$_ zj#D7gFoR<`bd@wc33d7NGt;(z1APyaBo^Sc+a4DwT9dPoo-HgK$7UT*CMY`N1OZJ} z*>-`Nya6-279oB^Ak`v^mv8{Uc`{xd+}&l)NbE1ZJ=5vcvJ#OI00|d>Voya?Z^^H} zcUdBTO1j<%#Nee?!@4ubDszKq;y^hna&qIxZ;3)L(xW)budG35kD@X zpZacd*_cb2_R>zQtEr0CYMWwg&|*{2tdh-N6Y5LX3(~Av0d@^oxlU3WM|@$9dBnfv zHXG^|j=q!+4OKdrie^iK>NUZ$f#db`LJ^?#BM`ou1k)DdrNR>i~zqjsv58KXbtijOr)natB_ zi^{LQ5?r^EB=vh;BvVK=i-&Sw1s5*b1dTb%L)yZ{2yZ zgYwWg^31WmX)As%ZrL-Veb7f}j1;j*m9d#MZ`dK|p&kdNWqgwKR(P$R+Iuo-kccz7 zv_gS}HdP$eS)u4W(Uk#vB;Cq7%(Q9$^NZH~2}8*(#?_eL-aTuCA=`NmFQ0U~$U+QJkMh*%J3kw6lYZ4IV|5MBD9~C&DO+&6^^t7gziX4aW&XU`SIP@$LCYzY5^& zWJeXfnE=1&0t`y6y#g-IG z<~pn78vbR(*-zl;; zI%Qb`PQFTyQHw9_ygHnZE#B`H;*MS@c_zZtsF(9h`*13>)B^$0+bB-}YF8}j&flo;tQ%QBJqo=ivewKHrO{?K({Z5d43Gbd2Q_WA2VWdZnqd|qD*|K zr^Qfffr2`VE&DX8KP{wQ84uW*ET2sK-mbyAp}K1ojgLh`_3j{oql;#!A_+G>CU?<7cWqz z(D54c8Kl6GGgP!WxVK6lG=IkqUHG`SMhcYir2mIf)Lrpthr2d5TGcFm;!&hWqo)RN zhrjr;;$a6bJWx3NOcH~Jvx6UQoxL*8HkWyKeS8J~;+XS@UV!A zUHjl^`>G?P6m2V{@8#~Q^iHjO=Yu9&YNYqdjp4T)-o%D z-rW^?-wb&%utX=5mT8!QjgA^be=|8xh2d8|o`!*%mVB+<(e*2*l;g-4BVLFxr~{t( zrOqlBwWTJdb$g~R99#(V{PBcZo=dMkJXZkzcj&h?*mobmNC@Fw1la*v9REI z!iO`E{Mqh7g!ez_WQA8QatH*%eL>OBV;J8`Idc~kVXwI6wy+=h|K6`Qo9WvizP2$M z13T((B0haQBC+&dbJkN+7-D1Ku;>MKE6C6Gy^FQ0OU9QxkRq7%pz$$ezh&qRAhuoG z8pPiZK?_2RGXE>4)`u#;~z`q6VAZB29Vwtq;*uUGq#@kPc4 zXuMSPtI4&EBid;kyLr|9`wqd>G`gkVtQALTZgxEUi?iGxf^413WLY*ry(<7kQ29G^ zcwEkK>(8l_YjJ>kpUx7xl0LVZFqsr0n0DVsn)B9R{vo0vt5#!$M~4XnsAmQ zQ9h)p3no%bH;cbj z0pbBZSGc&mw(3$dAg#pr7tclSnuezeaC46Gr5XKp$%aE^@;~C&g*g{OxBZQ{g&C?{ zSjO}-?)iIbqFVuIH9U`eC;64ob@vCr;6>X8%9{b{^~5cN_(|pngt^W@JUaOoYVolM zsE#2H8Y+$Bdp&i+#2CJYXMJPS^~X=+yXLEkbRNJm2>UQlbrbjW^yxPpMmW&d-2P!J@61_&vQtsXKggkn~lJ zg>Mb<+nyBaB8rH{*_Wd^<2B zSMhv3#^6b2t5F(nlgC>c>fEvN#XS&H{Lcb{H;$RW&E%2cuhfnNH>OAY@+k}a0mZ+NOY^dzsl^QsA^khmRtpq~ zCS}V3J`HQh`jq!xymYM4HR|IO#u3LNP6r0wF*q}@7`_E`4-)vmgKpo$9eYYhzlU~M zfkt0s>&XUPjlU@~?LH?v1@IaZ6%fakSa^G#O)88w`UM}M-gb6lx zX5Y0E%zPy&k2C(%5GUy?5z*YOGsbF5?zN3$0r7m;%r1&ix7J@PQncvGm|Xe<`;lXd za|PZu_?EB$yV?)dUU`C~R*)F_1dK7aHy5f`~`>qOG z7A}4YfdWrlI%1)`SbBc?dC*B_a=D;AU2)~;6^ZX>_uf<7<91>^R?~KH!$p4^ifZHx+-{jMEV5qKJ2l{k+z&R=DHP8LY5qaactqJIM<0Y7y{$n8eo7o?|>^TOG+r0COoFqtDyU~<0s z?dmecLxQIqTHyDW3DS7U(to`kb@?cft(BKU<+H2PSD&StlM25^+1M?Kg}$jn5(bF-Wv_IaHi=cIr}h{2>sMP1#1hzx%XSTzz& z#(7aF?&}wz3w|^p4x}SafM{T>K=jpnZ^qtK%S|77Hf}K;`KR*vf5b z!mZ(WO&!L?v)IjRB>|bg{$NFKg2Qt>#qggC`AzA;ma~Uv_m_-XjzEBGH>nl2E4p{u z@X*%!szZixPLx!ajCgI4TJopO@@X}NOZ(v`sy2;F9y74b4S16Syg&902meBL@r~Y$ z_uH+(o~DeMkGvf~yE@&4CyCUE+p5U}V; z!>k~TT~O%L&QlinqUC<*!`R`rw@(buot#7Ui!-a(WqmvA*U1GU_7(Ljs}jx>$TjUj zu4iz+Mp$qIFo1rHb9Zj)UomITQW-oGos5i0Up*2_uVVA|LQhNL``=F?f-2@LDBR@} zikA+OT>kCGmCdBB*x(LG6N4YFVJYbPP}(~s|cqCvYsjsK_MSLQxn4KZj^tZhdX92y0VKXaJ(I#nYW3~GrW}PDRf@IUWE>YQmHSZMJ_K|8~ zhkF!@vt0QL8q<01r}MCLd+v8imuU)Gg1h4k;EwIZ5yIh0u|Ln89p=YDuvRVa2N$oT0)etZ)tFRbdSbjIt$g23Xd zoMV=s!>}#;)_#3gDVitDI{zKpaA&#If2ja%;luxsg9 zEivyEr(@L((Ssw3Uwm%tXc9x~4=gG^jAG^Osl;aD6q=&8sOwJEPbtDio}_S$zGk!ud6SFne;vgU`TF!y;;f2>fJ|cTw4V1M(4RP@pkg>$6C<* z@&0C)4HuPao&=A2e?mJ{F;Hk#B$l+*thpL zprO4BwJQl~_uFx|sm)s2izP?phU9XdnS6{Avwnu%ga$G2ATv8`CbHzBnBr_r zq5aKIs@UZuGEXkUB)#{Xe0^X0``vtCo$hjq!h=(qy!h>P;0{GUG1aNfy_4bhe64m! z`ZEUpM7w~{H zQR#4-0`D8be9e)rBcmI!05-iWn7kc%UvR+}F+_$TqXvJKMSoheF7o~#ZIX?Qx@i7|Rd_|S!V6KNX=f(=oqTqeLhOSbSE_XLwJ5~}%gXVx zvulT%s1l#bphbJm%3c()EI9%QeY>`+ zry*%uf%;o@FbXx?uYaM4g<0&q+BSF6rg~dAKb!xBXe}V@&Az_hk%zDsAB?-zKOM{E z%bqLyJ$8^!duhV~sA=*#Dsc`}$?{}3*eq|wu=m=}UjdG-^X^ecGpF6Z!%etVl$rkX zVmIqn=ABxhgUN=(NVrVy?=ssbr(q=PO5b|HxSb`Hk83|5Qr(X!sm@^Rb;Ks#)FW7L zPy0;!0ka7dEqoN&a13o)+udp^FQ~%VTxu?(@D$s0fp@g@)v6%mEVr3dBLQc4yxGlP zHHjKCr7Da(2v&kG+^Cb?M@FGXPbQNvsz0JU=rxw209H;gT0Zc4#v+WG!|TyQ z@OmU{-MlK{QK~{n9)vTc7u3&J0Z^EawKMo!`H=OP5SH>TbVTam^JofJpGPje_4RLy zuFSpk9o{!ecfnO)_}eawZPZ6T@<;|1yGPSUZV6qE-@s37Xmqi^*UJNTf#=_lvtx=Y zrORGT50a`FcYe|e<3XerQBPq)x47c2bAcuCZdey=2;|UBiYr3p{hw0(YE2Za39%TK zNqK0%BR($dPs&*|9JBh6yNMYwq>ET{eR;tsE>BRMdmrjWMJDxDsS=J4fX7+w|Xd*uV%Jo zP|s=v~=6skiN&{-coEBTiRfT(hW`#=i{H#C(d&NG=>+R#yQO@k{6*@H3s_C?q%ztlUbq^TfhV%_6UYay3Nj*Ckp{e# z_!@s9b(qmhz_AHN4;9iFL+Iq!g;uQL1Z8Sy67> zTOPxSro1nXW#S&ox=gN_wnnz%KKC4>-z6x-;*{gKLKPzL;+2C30J#L4NK+)IJNB&hWL~2{HAa9ACo38F;ieS zycKdFNy#uNE|<3T8`)f+DiQ8R=I820ZZ%H$FQG{!dr?=ToOeX;TORGjCe+0;gk~Ev z59K`s4CneD_(gfH$==}jBakdu-%a`*+~%QI_C6E;%Vgnv%(+rS(2U4mIDD@dkZ zzpqmNr3iYi*~ZNNM20I{vY0XLg%v?ru+i}a4LQ~$XuAMH{chQ)L&rDkt*)j9mh3<>8GQ>00g2&<23>`@Eyv_6;iU4^KD*H z4|KZ5qa;sTwjr-)nI{R2H=cx_3(g5!^fH`&|I=t8&eR2?|z(#H0^| zo3}RJ42pHzay%;!=dE|bU`mG9lT_&_bCXoyr~B08j&8yh=dh{i?}-F$MFjsH_rA|d zxFMD|#+ohtTmK_v*;Eqj??(jpw+K=B9j^%q^}c1gckqEASs)*>?5P6r{DaVO0|(98 zd{An#RK1l~HHFr-PFGJVx3X9Fh>+uA1BS)Zj^A<2-+404><=y5 z0nqn>T&CW(Hka=EYw!N_t1+HXUu(f5y{p3SvN@uBBy3vw+bcrelpo=x>FitZJBae* z@FzBOdOgJwe49_cpq!%w9{Ci|BpvfmCyd5J3^l!?94W5Ix=WJ&nx7n*wkxLV58)&r z23>y16#n2h0ZTWRl!M6k@~hYvy33k8uHV9#ZK{AbfxYL@)M}3@IWP2=t7Q_)4esB{ zg2&db3yqqaiSr)Lr&fc;e=Iy9vLxl5n2&9%>V**@p4!f~HMOPE?Du+%ma(IK(RN-5 zB_h>Vf)Uh#34AFcwOWZ68L8^;`-C#HjR?cPq6?ClM&VRJ8XSU=|8*EHjbqm)_(Kk=%@QFaK0PlGS zZ^&E>alP}eh*KOgm!?1@1+#9m(;zlpCkd}S_tYPKBQkyhJIi^P6v+n!ZvjP4$4UU_ zaqF6>^_(E&sB0-)vFO{ljq_eYpNlf?G6MUKfW~vj0_!X`aZsMe0cHcV#=hCJgg)@a z)U~X17|EgYs$A#y85>>lo%zvu>_zxyq)1vla`*rj08@ zR98Y?ckujSj>-ekC%?E4?dtW{@0sw?pGLiQ-I>gCTl8D%x1_nPoYs|t!23?#ZR&WH z!266^p8}KAZ=a)|{?fWd=dIUT57)m1JP)n;UNsT^0S{jDv(daj^25omwPvYOZ6 zQs$ppB;;K**L_ugSJpNEHoZb?>E+1^K zdN<^u%9=Gu2~?n^ul6(~TohO12e99~9bAnAx0v6Kpva6BrGDM?pJ*PU zCSPDi!oW&3TZMghJN#I!NSg`54zMOpOb}4@fCIMdepNolWs)pEN_UwOEIPw^ju^w& z7AyoYsSa<|lISOwv5rF8JNP_OFAqK>S>tM~Sw|H(dO)cAl$ipN9C6<3o3PQX28-Ot zxcj{6b7_#uy(QN{zy^nQRUxP#OD?G=MT;Phwf*MiSy@8^-^T%Bw(~+KDJy>}e&|`C z6-t#a&Wbzo%cKdbuGBHmurTa}v{SVdfu}?6Mrnnf+sqR4Pw?;l6rZv8Ur!08L&~)6 zva)x}UuRm2SE^C+fzrzV|*~>Sc%<3ww&`G&&|iT?klC(?uHQ;p;qdl6-Z;mw|=9n?l5|uC)Yk2tS&T zSuy-Gf-Y#h$*ELUNPK|$+4pY{y^j5mhw1f(W`jksb6$cGM&+xM&Jx*Cf+4m3}_ z2{P{AR)%zp8$)JvxunA9vu3s*O8h4G23OJZ-b<5yFCc2{9D+r3<2Z!X9u!_Pv~S*- zze#wV50&RL!wcfzlGI|Z4uCC7=u|#{Qy;C^vi|>+j^K3-Ri7Ech`O zxiE_>r?h#p93n{3WO>`-ENiZU#tME;j<%!U1=3Ujpj0jTx;A6CG>cg)gM&e(A@ zt~8+5==&%0EDq9)#Y*UcaN5W5@?cS~Zb<(V0BiyODK=iegTpt|;O$wR&I@eWeS?Ip z;ILv5`QsHhr#<=4EuTgBNk{J+X^Xh*Q!zEAe9u5;Gh()hEt}n_0F#dkD#Mv78?q-8 zrtZLU|LgM%!2<_)h_5L#M!zYs#nRgt&)4rlFn~EsF@H8GgF2#lgAYb zqqv{WBUrB@Y$Wv|FB)}`2P7VVY#jS0v=aO{EPyQEo0g|>B#G-};U-fDvXTXexDS~t zJ=F4>90HKg%B1wrVjlV(f(fzF&4B%dBJ!t}$8Yw_1669R8ejg=c4~**UncIZ2_3Ud^@-+7^VXXfw=Lt+45N_Tkuj<5X2h>qMCI|HYnb9U1jRb z-Ku5CSLmwsW^Bu5?CTIa=cT7)z7o?!HSFP<kN+E8d3x zfNm7hYj{o|Nk@vSPv1_z@I(6Q+O6dOj2;Y7Vk)YNDmryES}rua;9Kn)gPoC6<7DV+ zP={MZSiq{Sz&7FV6ly-~jhg~%CRQ1kJ=h#&t&IFTzk@?I_Ap}I=Uep9uWzQ3-okeN z$xjkGv7ebh#pcl=!i{w@AJB!=n_;_WE#*X!nGc}Y zAALp$K#9%IBt*z{ZEw@&uE}lmW5w(G5ZG z%Wz&-yBp+-p<)|jyZfh9e(yM;#ro=F>%EZdMk8;G%-!&et3 zOz!lb8+CQflylRhuP8MQ2&adj04u~*i+5R}(ezL~Ufu`>cK9PWWs9bC=6XF(*iRz= zLodqW!JdQ7td};zY*`@*f2SC{U+f!_u%|vjZQU@ZI3xzE&zo&d+*T(0OSGFMXF##S ziL6-POUszrS6O&0ItU(;G&29zb{OR(j)a9CX8Hl`OoAk$pvil13mBawSg>Wc@{9@) z^#DCIV{tD75rZe~@Fd~o(Kh^KF}ojtbDrm;cC9NePK0sY8c*jX1vRzk_9N1jY~7OA z)j62a@1&hCsEvLK>uSGugW_dRvm-(gaZm3J6<`W6dS^(TgThgcMWp`eD=|A1!Axmy z0nunFGVaMT`Z@sG&pA;`viN?iGuh+2m!E8z9SU5dC+JXXTI}hvxYE~FUW%~~-r2Ba zWqH^+!tbEhz;;Ie3)!(|O)mYcDngu~#)a+Fxwvwb`>l$j982eIZ6IrIcWH&yvG%bS zn8Ij3{d{3m-%Su(pK#bk=S239Q$$C`)JH?ShV}J#U4Fs=B7-SYw~NF0o=uQP%Vg8+ z%vGbR$7Y<`Jri_bEAkC8HbXr%;!iQ3X}$r3c_P}CgUmjR5et zJsmH}wHF5|k9rdt^QN|g{WtE)98v(SJX-JWw|SLUV>l9F;$*a$1WQ5_Nso}ErJptK zLP43EVDmo3zTQ(44Wkxa&JS6y_KHNky5M|-mmlu-i zT~`CiQDQ(~xZAztp9z0;e+m{A38o`(rJz9Xoc&U=lyX7*YRo zf;!|;r1&CMq%NH>s&@bfBZCx2)8uWNeozwaXm7DzpLj*sZ}A;jIFhq;p5PmlnH0pW z{|Dy_UcuXS8<`_{R$<9PD9o-=liLIw{b(`($fPmfQvZqO)I~5FaE8r`v!Ur<{uwht z?y_t7ncn=17d%dkR9=xTO3^>u>%AkQ?88lk88MwM*5UgJi>?o8G2x^L9g111Zpk&R z%Uv21nfouI{U9%5`w6@02MInlTx%iBKWLJqFCw=@5(0r!FtrF^u3-uL)u^2#dL@;w z@ADC%oK@cg6IgwY4?`;uj?kz{CQT-9p@GX^Oa%_!ah`cMceWEy`WvN`SE*AOE1VM! zg!s66iAzHJmREp2cvRR~73r{Z3cn6ER@kcqGmglJ}diPy>`q$haXm zAN+|-h{rCx9a=J23jY)KaVU2$SB2)xMfD#pS49+JffTLtRPxf?7o&Yv4D7(NY}T@HQI`JD46v1H|I z7hRhBnPQ9bEgMDgz$WtMVZ2Fa&}O|Y_V9QP#%a=PNim(n+xPUn=BTw;p1Q*BAtJ$H zAL!y^to!h6hnfc(|5_RUMhShuRy1rB+)pFcK6%zBwY*}#En*J?-R4nHm*J$A%y`?; zDQrMfm8bMKnKHMQJcQ%rRx(cC?O}Y&T4=fits+VjpW@tgSE*YJeyZm@6(>XdR@b*g&5> z)}O+F9!F$^APHW^0$+blnJ;JOY{(PK+w&y0@?EMbVw3CrJgP?t$qB;}HgU#GgEND(V0>Y+l84U*>g zBQv2K-BgMuAvN#)ArX+GdZJ>ik$DDp-c;9VOtF!wS@yl5+VO8{iJtG9Fbm8?BbvqxZe}yZ`%-FYANc~l2L-hSy z!fj%qkqf*R#FNqyOeh*<(HC@6zR)D&7APC55WO~#;LlKGyUm1bUPha;+S~n_{RXlL zJRAHlm^SfV+V4p2vPIQA;mP_Y*RHTvH(+7G+@LFOeS3$6P6T#y5m^;u1{ znC9l7(Y61|s>%s@%liaB-$w=;&i#^6O_d^zd?z1|kI<`PYf8iK?Nm9~w6^7{W(T$72)pDLKMY&* zCIu&yNDtimHN~DOqLKQz8LU-rB=>lQ|ksg7yc9!APrFl4%0yoxIwL zYrSr|37l|$L}*;)wumZSARc8otc9;)n>F-g(7jn%ZvIxgYs7<2CR;l-dQeaV0yP zn!RTU!5-}uXFRiZ$Q9?IFhAG76P~Mbw^eo+K;2=(xx@^lOsHnFBc9HVK(d$2@{rMj%^UWW& zEtc+n*nh+?LE*LHR6~4iHEAO9j&ngA>BY*O^02uZC(fE|Es$IZK@r#D&byPyH@7>y zxskr#p;zV$Rm*Q_%5PSnGlCdyTxNlH^OL~K9iLJsktmjBIej_sN++NNPdbNBeM}GG zz-4T@1rc6+Pr>v{GScg{s45w5T19T|*BoZ!n3HjW!l19*fFl6^PWJ_%!NeN?6JMKt zj^Km)1#berwVDjs)PbI#(0=rCp2zkN7XI_z${=u1Um}E|6`PNq2p3Qs+B%!|F5#_l zKk;|a3x-Y8AYpSv*a7nWi84JKTjcVmvSw)~Uk`4c9Ot(yyC0>nrU6UVL}VYaGkOQ_ z$-YCEWNC1`QSLLR;@m4IuL}VQK1UTndj;P zdcO=s7B^g@5 zwvdc*{w&y&w*HyWqzQ~Cb?!Q+t-YsxAx_q1rVS>NK4Y78JFf$kM9h>d*#?a$v7Ir z{|d#azj+$R7j&mn@1lYP4h|rir_OwCu38=8@v?k*d_qQ_mtE#?#NWp@U-io2_!C)P|NHLD`qE~6Hh{Ey=$BT>PlDWp-OIia5gB=y0hRBPn za}Q^5F>K~A0-L_lgB!DKMOGoZo^-24Se<1)_$RH3gCXQ0&t*XNEV74jk!V4egWY{- z9&0m*#lv!;B65UKa+WO(4g!pM<0A)_*c3!E2xcm1=*y61sfZ9#-@9n+#mU9GE zX4Q7z$6~5~AtA-{R;Q!|Ilf;?eHGJ4+zy#iC%03b*=rW@Fil%qFSu&@pN9$~6dIX2 zyfv=LByPClaeUmt#Icsy>)-a4=@j2sH|+6qM}x{hn&Nr4wdfwLFQy;$j`+XSA=2KY zZM>_;{^}z<%h<*f9833QYy@GH_?wS9_a9%mPZZgVf(`MXntz^V%H0+%ZNQx0E{!YO669%p$A_t-xl(;GQhdo3-%PJx9Q)5;-RAZ(D$*B)!Q=2+WQC&bIX+LqqGIwkt#Y% zig14(X|`tT^Zw(8VA>p{@KVp&(%KQvXg6- z%Ms%L6I8Q?JMaGXNDm+Iy>2y$jt6(TX>mNnZ9L@|=@JbQsHxLfvhHzl@*$R7cnQDI z9qt4}K1`W#)B!Ifi|DIpB~F)GO@HS{{F|}*>i3%Bo%Mr5Zrl&AdyP+SGuN-Bczsvm zO84A)Pc(Z<6gFryn-OKVV~4WOAx20VW-$1*5+Q?5d%+j(90wIVC}|6*(+hd z{reJXyV%aQJq4iLP=sdOk zZ`CQ3*(-ID?&QaMZunOwCR_?~E~u$-UvRrxE^C&IuXeql-(?THNB<@SWCS<-erVZ0 zMdndl;=LPU1x6Jczq;meE59JTwzyyg;QH_2#>*j>APASf3lFw{LNxAVVtOI#1Hqib zAX`Z>J5GVZE4%wNCm^UpA&H<36W>{ctDF`s5IMU+ebdhngxe%u^$~X=D4r);+<9=u zhmXV&Gysd-i4?-G8EP9_!+x~vQAcSL&U=u?3>+gz|MgN{+zz%sunhb$$o>FD#foiY z7>UR{WY#Db}u4M%x5{%~cLOY=g`n?(X04Wd&25s;e-mcK2TK@n!1$ zHL4Jd+;elMG!ZrKN1QW?_^BwojE$a+jfKfI%fnxz@A+y4Q|167} zI_6AzfihdDIw0*Q0nSHL_bhb|&^x(3A^gt00nuAnZYMxv{%E@ck3x5Rdu`^%;mi$j zJ%QpO7%M2k5SRMT68yV{A52hTok9^&x$Y8eAk^{BCil~jZwqhRs=@KjEQQ#}T%`r^ zhd!z7kqNz+{fCqh;svjds76)3(7b;~@1aMG9%`^}Pe%BRZDUL^1hV^o2mnZuQb3ix zT+=!AImT;(fZ@5?sm=>Pl0QWvK4YcbjW9Wk+_HPW86Vdc@hmGs zshP2YS@^pXg)aJ=w##|Md;ZGEUeAI7K|d4-o;@slz?r^HT>?_wXSzoFyg`vlIB8^ zxdIP(|<~Dez;G1%rBqL8?hsShiKEV)uIXQvvLDvrd{z6##n_rPAU@ZD94{=+;}GR6QdW; zD6?)jB8tscVrjA~xSouQ+PRG$cZbTFv1czds9&CXFWbAF$4D)2gSms)I?Qrc=d3^U z8k)Zm>Mol=c0CR|Oq$5ShwB5K$4G0R!lyjg7YQ^eMKr@j(JTXb0@H5Ip%1_Jg_fa# z{Nz5MxY%C_ZzM)ML6d6^4S&DUe+=5+|6Ue%(n`DQ(Y_+)_d;O*G6Za+Ggo~N^2t0{ zqu74Ko^^h8DHfOY#r>_U^Xj4UeCcx!C-d#y)h5IIozaF%g2n_En;(xV%v#cm?SLcJ z6Cdumw3*<0j#Wzs+L~;Z+eXo9;1j?2>YeneiQ~s=`=_(P0qJrzkMZV@c`1X z9R*&uquZ_Kbe)=fy>JwTks3(!UNhO{pO0MU5L)4*3^cvZ2!lS+eSDbB5I7S8vsV=* z%$P0sxFq(J4#4y@r0wq;UkEDl3d&8l^hS3JMH*v2&Q9pOh_WAeaxLCCmE`-9n)4t zTlFTeId@q)p2j1ivY_!-3!>QTkLAqkHy{3Kq_)I)VcX337dI!wi-Qz)62a@1G5CAof z3I|tSBJx}z(AQJ;gZ)MTY*l?jXjcyuG|QrIiBz09+IMSCnJ#2C9KCPy8VLNYL+lp? z*{d$+q34rCLlyIkNMv%?sA;9ss2JjO0PDEhtEqW`&V=`nM^PsR&vV$nz*B{yjg&gh;38g0KcudBXugo*rN2|HQ>ArbaRH=uG(n~9?*?m!sJ|~Jz zjxPxO#anbfb>|1fqR87bf+vQpofj6Ma62SnH)5KHxmM0HW;;~a%@{aeb5ZA5Hbi8P z?$lVVT8^p);LnavwDR=fQ2OhAyOwE&U1^q6hvj|Fwe*Y=hN@Tn zDBj=6RMGgu+c)()+o0+Fd(c?DBbSg8ym6B7i5L9j@5WX!USx7*Ev_NC{Bu9mlc-;; z8sdTdLRxE`_&%8C7-jkZJrMc`Gx~QO;Y&mPw;a$b4dj2JMqN0H-}z&Cw)6bwjJ+V5 z_x9$6hTr@|HM+DV@wf};F71Apg!j3aS28Nw(-Udmgt?nkCI@i$YWxBs&s|3gED7Gg z&XaZ_-a?=^KRS~o{_P^Y4QG?6Uz~;teK$kqxl@<2797;_{L>7cI*!k|RCWQMAu1l} zm4s6n8fOZARQOd|l-|#=hLEN!$oAlUnu4I3s!|sRg!v+mjk+zmIQnSx;IE^dJ-^_$ zuAa0qNhW++ZdCxGofw6q)?FL;c+MV;%?{I|2Yy0-95 z*SmZ=M%N+ZeJ3o-3=fWsQ@_+F(zCPalKUAhV_QppVt-RO36AI!)8Zc7V6QcwQ^WVI z>~XKBvC-`oc|Ic#Yx%8l0fFh#<1}?DZ&hK4R>Yuk!}wlg|oXw#I`YSVN-w zER~g~?5WTimFCMl)#c-%K;sEi_kDrmW$uR7338|9a()q;Y!AwlrhRO`nOLlvWD^SG zxSO8DrqMShLXt)`fsu=AoiTw^@os!9pMDKh+P;jJf2k@1rHq&J5IX=y?y-5*=@GGs zWsjTOA2CnKt0RSyk#jpeuI>7E)3y(rdWVE+gf>H__;tfuan;&F;b%xWZ8{spK2jH> z%r?E{yFqzOenqX}%$O$X`40a?91_DNHV$>S5zJZw@Tb3UMeT1Qxe`V$M`pG{c6nSW zr=#WMx>)v&G*o2gL73XR3@<&9zT9;oy1hOrJZD3c-%tT5eDiBe8vk8|pu{~a86+8; z81;3{6A;5;p_`u0IQ^{EfVU$;9e@yzwKCg}ULVKt>Ue!o)GR@La< zc3dPniQ(lZk(b_EwtSVb;f^T&Q0r`W_8jhV^>=UaGJ~HA%)(b=%^;Mf;HTvuyVX71 zM6(=1Zyek5vC$H2#Q>EF^zQ?ju_OKZ1*Icgcyrhj9@SZbdA9|zT<)QE!gUuw#NY0@ zMt^6X+mdZ*@dKBP>1+A4@1@YY+$gbLyEm;~399v(&ev8Z>y(B<3~^~k7K64!Ki}{J zF<@JCW*KHnuOO$=Gs}d8aknxTlur|MHlFZ+lsH;hR@Bv<`i%a}&hjl(OWC{$NP{W% zH;R5Jaqd<6tWWpRJ7H#9xi%@KOm7p-+LKJ#UfjbY>>6M8A%Ep^qlt+5-^ooMmvuDP=qN`pw3B2Cj|Z{O%%ZkMTkJz81(Xj ziwZ)E>nWE6m#vBR^sIFyGvzX7m1_-v6R}1bkM`ZNPn6*Yiz_!jPOCTwf9%5(|d#`Z%lVVmxd|MIcQ*G2WWhBdFxEbv$+H9XEj znwr9PPk7XPy+StZM>*4F{ce>q?bijv85`R0e-cUxNT)+S%&2Ml-=l2VUj8GsF1wuZ zQh9Xei&tG%0{+bV-S3>{AhLEQB6!7iL5q$YHt*?nfj0J5?I}xM@a;7}NVm;w{+b*Q z3d&8%GQEjC8fAaNyd zc||p!M!NtUt=_jGM}-_&_56n4)CO}e>~vcG5VJAG@DW3A0;X?hEl5KkTZN?u(ko3c z%i+R$o{mpF`-ZnY_=#5daq_XR=sxk@(;~m<$#Y#7hD*@tJznN@f@h~LNFqhIagE_3 zI30y?`w`kxd%~AK|7#_&+)WnYxc=;wWp3V)xg3bwhpgsKQmogKP6AX8NB$arIDu1N z#zE=gI$`moB&+@$0a_IHFn1N?jP>EQ`B11P5`o9jbc(VZ!19uYqVEC;MSv4bcDR`w`S#nkb208;jO){Fh=KF#NMga{UCda>(DqmU~Z2yJM$)^vaGg^AOc=S zN=9Zfc603-c6IZDY$vRTI<1I&?t0X;Cb1}yu^Ud8T}6s;mwK)$nHEr)h@N$fwqxPt?_H9FTX?a&g#xnPJRCMn)aKTn_7z8j>Bv@*91a>1P^^<+tj`; z-t(ouf+0)l(dh2A`1;nBw#*ZX1!+C zCw`G6iSR9l3+UNAYBL_^QVGn8S1dJ_XievO<77~nW=u)C#Wf#;`h}Q{mhC&!gLkCt zyxa;EZm41BY<1R%&oEd->26Tgot zOlxxOa^}3XfZ2ykuBgB%7_MZijZ&EsNrZF3fkJ`I65Nnl$-~-J2aqJpHCcw|nuQ9i z^p~Z~+i4g4aZbzVOUA=cJnbCk@z(88YH+kU7YWWnA}>=#v!-1vUnQjfLEG1vuj>7J zg@}Jm`B4Yr0dORlGi9@8;KMFZaz)jZTY*@*C%3I(fQlui(FJ)TCc-gkibSJP+Upa5 z_~rBuNyvhhUpOAh+yM%R4H~D}0r|UvSZc=#%wBzr>RSKxH`Z%(>R1$^dQxrlKtN_C z*=Zbme)zy4TTagpWD~P~4G^0+PA3?qV$E%9I{htN3}FwQE4TjZaaR+gp3R$UsT_CH zZ0!N@hWC+q5ALv?5V6|s#qrD%nIhx9(c&?odR!5M@3V*CnB6y0^!lK*kE#+^)Yi-i6}u{ed;`Xj|hRe<8}?V0MU{d`p)bB1g-zE zbl!nfzW@Kf&ap>`gv3EvDWZ28;u!Td8l-e8=_rYYw2Z>JPbi~tWJS^udM6_^$jCXB z>^dq**0DE-gX1{s{$724zrRc2zRz{N#`F1jw$_&y?~#6JopU{GS@kd(&k`OjFh{bbEPh-Eo> zJG@&Vm_QFeDGCb%cx%Nao2&0|Ukp74S|#twx30c&JcjQz9ysZ*chb4BELh~l8GTD* z*W3ov+^9-eWq;jkfsd`8z9s|{7pU8!6DJ*&J_(h=_Z=VnQUxwI)50GRne&F~Qp#+Z#K50TsQuoEycZ+gI+Zb6x#QTO&WA+NU)OCXF zOP#yfLi-*Aj%oWGej4!$zw&kQX2Payo?Egyax#?l)2v#I62GqjyS)9`QoaYSB$S;-aBo_46_fjx}ot36|>?~`F)ga;s zSol&_M~x=!YmEw1C1IDs`|fy~EUyZ`ecb^?<$zqH*o9kcJeqZf*;Z=kr z&;F@d>&S-7n)*w7vsiyb-(zaZH;H$se^av!b1F|+_?!k`Oy$QGHvYIZixf}uRtKyP_=i*tGX@5vjrG(%A2te zJM3+sgh-3bzBBkQmAv1}(I<4f*!hTlG_h0-n^hwRWdKUPdqlUYH?Sz!jx^FQL|%G* zRCh5{?K{N79t3h>cpEZXM@1_)vK-eoqSQbF+>*n!{7+pV#~1tf3q8c9+P*UTF?1ri zh%UTpov-CT`Ne#V0n3G>x?eQkjuXyrK)A`vXt(SI)nGEaoPXdRP*5Tp>0mRj{vL7jKZCsk1e-UBfW83v)VA%^BUrt zbpJuHLvNc$?@|o))HbOjy(|zlmXs~?zWV4+FzlV@{Zg)8H07(NqH93-nX9xl;PAL% zrw3Ynm2o=o$qGzOs2ry95oW*_F`jwvVa`7bninIXkCKz2Z0m$*9tvqpFR>s5L!K?#jF7*g!&MlPBlM< zKfPh$*bBF5zl{xO;B5g*0#qF~XBJdRB}I^Abe=AUm>+OHd8^Bz#MMH&(#Z4K{d1FU zi~BscVZkQ;W2K0$S8OU?ze5VB*@HIcIoEx?L@V(IE9^yUI4Me=&)i98znY-*i4spR zr>!N+>ow%>nZv@Icc663fh7KhALL1yT|4_iFi%3)>eRRVFLfmH>f^NzKXW+>$;qzf zS9+h8lQ!-znGWr|k#p_68LD%;n;!ZtQV`W%e(%d`q6V+p{P7g);E*V`nJ`ZMLVH77 z!4GSMH`~c!55(!(ri`rJh~mP*A55Kx#RPQFYHY~nT*N&{nmS?3S1k-&nYview&Plh zK^MUm-Th0`{;}&bapB9@tyA8YJZm|pjN(Lv?v(wF_zoG+8{vNyu>>W-;oIo-;mtOO zhD3*fEq^T#$PexMVm%b`o`*n4&}k|(#NeZ@UYb0Ls39uc10ogZ?Ue$UOK8k>KhSy! zLPeu#ui*rezH2{64G#C3bvP*p+NrxUCMkF*6QOFra08CD!fl(b%|^fNnZG@F!SjBi zL+?GjKC)n2JMpJHwa9%pjsy+$0`Gv&yKX-VbZgFN!+i{xRKLY+S7?locWIJx7bShRM49@REJ#UP?$F4%l@VSaTmeR$)bgKAomfafgm4|<;$n?RSz?ZZwu=03RmTQo=24y zwqR^stYigV?uWrx!LLW&olhpR37IV(w8WRT6M*PkU$ZCa%&Hw$4}YIhWy3% z>%`rz+L$nX0;_KwHH5t{?#f1VllW!mtm-?XzFFvOn>5p;vsioZ1AK>K!wqev=RZTF z^hB5&)3{Chb)ju$@go)}VXs<Z2M` zPSR5JFe#-ICTRBX@DhY+-AQO&I>=%vmh7a7(aSQp=z;K=gJQs2IL8+$1?me`H2^sw z;>&k0Fvg5VbpYL!H`leC@`SePs2EA2k5DXHl@%xSGXP^<)#wLmT4)S?ug*yR2|9*; zN!o1>QTGgOfX!f&?i_

J>%3_R02qntaj9Prc%(v=&%k)4o1KR&UnrC!CS)i=-(5 zV9cpI=_NJvv^<0?@Y&>uq3aAvJc{UL*sPzfN)~AyA?_ibR_;CJtEh(NHsEJHc?G+P z^x}!1C-Uzf(kJ~}mZ8hrWhY3tPWt~LEVy5~aOE_T0CgF2Y0s>O(m5{%sH?_F zd#@+nkW?1M%ZztnCU0>wR)y$Mgjvp8%-EU5Qz}H_IYN~0JB|v zu@~IcKEc1s5dA3ijrmE4Z)_M+-fyRpy1U|UP zqTL9^4zdA6_i~i7tYx9N?-2rp)+p9i60F2lxA(wc*tGu*v(nmValkeifkH~tMpWXl zAZp7e;>u5qZhh3-0F9HG)6PtjJJPxK^kiSaNn#S;$6e4>CWCH-eB0*zt}4bvMS*(>mKlT;&9?1!QTlDeRF2iV3g zcwANR_`N-Wt8mG4yvuqpAKBxAA3RNqTrJda|8^^RMlP@PW9w@BBh4Fh0|GM-{KIgs z#ib?GSSAbvSUt_~yAfhPdyH#kpC3c|S9Q4{_iz{}DO#5Nrl0A@e>%&OMF>UvU%e~3 zUsq_fEVT(VFf{%c)(ZcDL*Z}iLm0Xqem_BIa=s|~#-?We2cvVMb7J)`hj6iwl?|_E zYL7T#24)LHw1si2hWCkR^w5VFO*N;dVnCMgEwSDXTvm;xG4ovqSf}^#y`u7O5H7&=DuENYLniKhB2+zp$VZL zCrg8AUyVwMdz=uq6}rdl^P>(pG4Fwa3?b=Q^Y zL|e7xA>p#;*#bmn&hHYV$EQlim-q~R&c3XbABZsAJ4kr=GzF3L{$AbEB?B%+UMzVZ zQZl8cv}XM~7>ZQzPsM}MF2QyM2(H)qLNl2PnLIZe8o5CfcNhOz=;CF#pyusN@Ljrk zM1XwqzGp-j5FW{^cia4;NEuOdNkcm6SKym%#ikH3+&;g3>@6TI8sJbi=UVu;-=n&8 zuMo_|0OlXgodA9j>LF64oyRIJ)6{_={Nx<-RpinS;!@li$xy4Jff221rv#{hXEX?L-emdN0Yn^D?)n!w#rwMKhYxp>s8!#vFmW<*KIvZ23)ofzueCVuD}IFjWJ5fLOqcb9xf%qv^dDU9VY>)WfK^n?tAj{blM|TWMnlq zS;u<=KM2XRYe_oLf~%dG7i2jt_@x`n5pE>!Z%95fXO=*13iAoOMbT-O(q%=hE&ygIB^qN{;sdPkqq_ zmsI399A5+v!56srB7y4xyoWPlUkE6=bS25?1`5PYmId2Tr}=9|SMmCS+cP2j+kGK! znrcYWlEHFHazyWuESu+@XNXWC{r8@q@^c`s2Jpb})`GSF;%~O%z9v7XTZHJgs*Wi9 zA1O1mY5{ATbn|vH;`TpOw$3S9%a$Qr!Ytvb26&Q+=5z_v&e^{@BP3hi$x9kKA%k4&syquE&kNFUuAHIVs%Y?jkkd) ztc}xmE(9dZn!vqDuzMvjan((aM~CMS>t(43U~6Y<$g_o+Z0-UT<1xQm@&#-SfAr8N z*jh+C``XtM#ni^^5|+}MX;NU<(?o8;KRZU>DOna%_s&J!pT1G8mHZbu<$Qs#TeQKr zD+t{{`h}C$eJTN957=fh2dR}l#%YWV>G->eL)5cVX?_@b7$k8)S}47qrk)-62`>)3 zlh7fNlJ|u-5Y?u8v7bbO3;>Jzd< zTnPi3USR0B^j4E)*L?$4bIhb=e9y_=a+eFZACv&&CC9W@Ts#sV(Sz@MrVHkjmR+5A zQp-{<6O37-W!D=uwoTh@GB-@hT_23&$(FMo+~Rtz>l(aG+VVXxmYoj$nZ3$Tm1``J zHMfZ-9kJO{h>;%myZO?vf|-K)|AbI*o~r&_)YLUx7a=0CTGbca1k)+iPzwD1?ym|DR@sIlyLAsx+D=thw zk%-Czdr=k4Oq;Vb5a-?c$DC5y6-)+Tvf&ZBQh0@ZG_0hBdRtty()R5QzV>klqSz74 z8Nwfg=Y?DS?li^`_`6mfVqi7^e~44UYhXd;MDbBs@CxciKQQhy7wdoB5L~i}78;5B zvtgB90vVwD^zb@osONmryBVP_(n_!KK4#*!Xzjp1Xr^8!v;;I3-k_qUi!hQ zD6eH#1&AJIg$)#Unh1i!rEjdf{=!A5(H07gFfMP2YZSm)UAhnQ6J2?+T&T9}Xa6|t zrQ?o6lY#$?_vXa&&i(s+A}%<<=GVxUCLNCBMWM~c&`hOywNuAL-yhi0qK9b`03}Vn zST8#H_=%5K_5DSi){fcvCgeqMbvef|jjl+TXV|kvM%v44nxho(e=)@0S6z_`oIIRza$f`nHgHp-V5XULNgj^i&Fb_;&P z>oSK}-^Isebw9-%^|bm=!L!O|G=Tr$d{6qE++54j{Ei)zOsPe!>{lui|2|waysRRy zzPQOn;B#NIyZ}|GJHjTJW#-=9TDGW8x>sh3R+Z2U@x43${ZcE0eJ4eY>QYmD6)u{- z2TFEsz#st=bE{f>3tFjmv2&v`kC1K-q9eL*c8S3o+=J}r9OF&G^kr`|@y-1V24*EV z>PgGQeS&!qKE6sqT~NX?a{X_BdiY$7xR`SPt*dI}H8~%z$pkyVt^L16d)@z60rpgZ z!Y35X3t^$ao0`9A%YvL_1;JNUnKa@wtGk$A&29jF5Wl)_;04TsZ&Qreogq1d=2!oQ zNvhjDL@Lq1#LhMe(dVNnb-AQE9nk}2q4hqt-!6S%>!~kD*-6sbgZ!KB*-&GDSGZxN zk`8c#t?bU_7i^O}0Io;Uq&f|PkUQ@t&j{YRL3Z%Q;dTXvib~I@1JCA_~MR)_l1$Hu-u=(i*S`2Mf=#4_!x~_}-ky4i_f|9+U z;`6ttRYDmSaxQ7f47m#n>to<@R}IYXmBqkndJZOp@hAZ1bV=628p}zv1JJi8Ol{~p zkP@uizwR&-v(@kNDoDvz43eLC6VOmIFlGwwJ*@W~tcigG60)-r*^gg9H{9QCr#in; ztz==#Yy2bQc&?$#NcyU4@JpJVs=s!?Iy1tMlM8Si;|u1yA0` zGklE&DO)h~=$S7OUf}YG0{E{1VUIz|T|Xi3hJ31^l6i1s)$3yQ=c0{Q7KzR~{eR%{ zED3IG#m9ZDTfu}_k$V#{DjAitAcX)3pG?7!@6s{{`}uDN<#!zU=Oy03a1qA9S?35X z=-bP2hN3&i8@?kH4M}c=*9Q}FF27=`#bfwq0-Q1~p3Yo29g);oZ{9@u(%$dxWqjf8 zV$bI9N7y3i$42$MtNTkoXlZ8h6+AsBsjDhT(tCQZJvcS9o>3l9Ad=PZU1H}!V`lyn z$cHBpO{ND+W$=ES^vTIiQ2@A%XB~MZ(8LL*45mXzwErG9JPYx@X=wBL z7BE`rcRnn~*(QK+2GJ&5u@l{bN;%9j`qi%y@BPd*-Oql+Q*-Mb^JoypCg%21W6XRH zwT0d-8Dc#f!pUREse*MpC2zPK?!nwUKYvUXOo(j1`E}VZ`27>dC|G`B2gp_+Iv4LC zP|?2|zk!w6%9PvNJ$ZTAC0q`OzGmvuw;qR*SHzIE#k*e9j;uWS^ZIF;%Sx74VT2rJ z?ERIs(`k`bYdZeT)-3p$;>Gi5S^&iuT8r{ebG zo}SEUUvjT&BY&OKDed-mMMe0fb>*e;Zp^zylQ{@EsK5Hl&MuNZKsYY|+M}+=%;cSr}XE7t7m9G99lS)n9UyUMZ>`V4!mSf#HI2tLkC=a~m;o zl|A{49Jnr>HH^xQN!^GMY^ky%r`WM$0Dx*zOQo?5eeNCiHwf>YM`9maZBGn~6}nV? zhK~gwWqH&D<{ByK(pQ7%i{+0-F{!h%a@Ehy5TEfvhT{`Ns>^}y-)N0QjCBzHfZ$!+1+}qsX$#{wAG|3gtyJvbHVv<5kESrOL6MgGUsLHNPc?CWj`QXj z-bL-N?tifel}h_f3(NS-$5S0sE7qaGY@UsaaX?7NCJxbwTJKd zbjpjT<;MPZ2V>U1a7%2Zo=V_tSp}C&k>pJv*5_P(v=t}=S$ysAqSG6lj}7*!@*NLG zziC8H`-<}JAjFm3pfE=x=_i6__K#QR#a(RB@&3-NGo! zu@23so|y4@xZAb=hRSyZ<}C#M=TSt+q0a5bxgPrnr8XY#se4pK8k?lS*afOfJJn8w zl=0Js*1=gpyt|XJ{6Q2rOGrJYFOV-6?y|5_D`PgI^9lH-VxwPK zF>Qt&if-G)!5`6T@b(e91K$fNaPB~fx^X!y&-}k2o!=h`OAaHM8wO>{bs?t9?G=yO zSB2Nm=by7(DBz0yvLw%1ArWE`|3#i$Uz3D7XBh9A(Q}z$^!XHu1CxG08Zl!5H#@qj zp0pDO#sPJZhe#5v&xy$HZ|f4+fuSGN_r@X05xH$-YZ(Jfv zL=?}QJY8*o+B#iO1JOfUUklb|I>Ga3&;W&>)J`oaZujhb);G-tA5KKLB)rRX#m9E1 zM<0v7e!I)J>v-8`s*use6K=N^W^BF#yn_@@`t@tr*{Zt6o|3>`%1#TxaCh#P{k^%g z_Lr~P%&M=N#!E3-)^`{5H;)?hcmeXx)uWDjzilUNK?1V?kuv&RnjQGeC5u9ByOCHp zTH}dM2htxffBOW?MQ|;@kL+LRVPENF(=7UNxSwd($nz55sif~V8fJ=rVz}iyndMu# zyer=(b}(2ANDS?D!=07`F9YzdYoExWTcLFa`A%#IUUvrhS5oXJjDsIDvyr8DX<)hP z2@3}3y*U0q;y@Y$#rLxcm{hcOICFRB!R$-bF4DGoR4mnkV(~}HjW%-yUb>$J zCt775Je6)9@p;ujagph=)GiLzWz6g$hMagaq2D&(^RT8DXe~?WI8=2mL!6E4ih+Eb za8-e7ej3YtvpjIsOqm7g%hFE9Vhx=bls5Z-IA=XsGONs zX8W%HwW??|K-jaSpcLEJF&5@Od1UbLRqLdncUD;C#N{`+3x+UQA%V4O4jHA0aXkj@ z76?XHHM;Alc4f`LY=@W>o|4GE`v=0{8c_#fs@i7M(AYyR>*#=%L-X z0Sd@U>A5BaHZL=Xm^_HThYn1dF^upDRs*)H3l49hU;Ptjl$1z|8LNj-X~o#B*Uwb# z_`Tcu%j<;zd+p0TnHSwJT=?%=c!tT04c&aSVrj5obX~)|-y~iijZzm=dEs>!m(_Xl zW8Ld_?>q;qSdz6n78VOc@wd0yKnmD+jJFxgdesOFNa>@l`|?J{KO=|Cv%6@99WOHv zEEjnmOIdO>Z=noImnisIaWe8)2kX1mbsa(tD4L{`ae`jYKRpA1)$JZA_<=smjF}Fc z3BGqSb#mQ7mhMZU-GkCAmM~s(di!OCUm>NM0O(gzx3Sl@WRYntal^D8%^o|vc0k50hTKuBf3)e(wuAbf+eMV$lGTqd= zB%6S4UyV2PGCQ1~m5&cE=r$RO zFTa04dqvy)4aMW>6K`53;}N}K{KvUxUJn-)RM-xOY4Pu>pz>S`n^vAk7j4?TGNO7K zSH5gj)-%DgVcGDOZGgHx=zTg%SEAQnGpGDrG{gBQjByuiGZF`584wPB?5S4jwE<&Y z+supx0Pw;WSg=_$a5dIx*%hWo>ylFf61{4f!(9nKAmzZ-enxdI=v(6AUs`C}=9gMV zuhI}7f?b1kUN-Sy#2VNJ7ZkiE&IKEwElZ-SNf%eoy@1M#-NGI=u?faER)S~WtnFNc z$9Mq1&)Vm^%WJzXVR5e?ScGSXlf}doR@^H~RgYO>NP&NsZo>1I85fLFqMJL}e%bieIkJc-Zg3#$fZGQPGvI5Qn&jQI%O26mQ-@{@MR; z#DT()L4)^8pj4vF%U7sTLRP$Bs~Nl2rlQAVbJ+&P@TVEOB6%OS!23DshKyJ1jT@8|z z=o2UC!(Ko&QPeb%102-hi1U@ehe>R6WFwa1>a|p3sH#-%8_*t@I{Z=r>hrRA3bWx> z(7F8w`dR}Vru=+*AU7xmAqL8|LSd(Q79W(+lXK*?g$V~+5rgPw5)SfB0EYP zrXGs!E1%XlLVS*&ifV91thiob=^(6ng!jEcbZ{hCYpBWF%Kde~*!=i*SJ64}s4$+_} z(TAyB@i(@M+v1HyEeBxk4NijGw|CCfO|joKevHvjzO*;a%-28Wk?O#2nUVvvb#xA9 zWT;HcV~7>~h54IuRae*;vh75rFofgKf;*6croD*Ab2HHsPL^@YIxNG!nt*#de@pC4 zCrSvhnm%xps0iF!57u3Uwsy@`*ggr;{#ioljWxbFAH^RluDHgPFK0AtS>L901m09j z9@FGCl;+5=Vd}ZzRiIl7n^$RgOAS*7Y#Rn$WimDfE(Gb;`Z;}fJ&}LQpKlxfVb1#g zHRjj@MSd;EllNCByQMCCb#=RSVL%e1az>(dN7r>dss(;s=VjcZ*$v}nc7^rrt*`bG z>v;J23baXQz}LE0fql>Q(vr^AZcEpX?c{kAxD!>+X3{y?)@p}V|B8t$RjX$d43!z6 znxBGICmb%WHC$2~!i(25Ar^N)(q>zj;kWk1@`kucztyo3xAl=baf0W7-Z1B(L^j8Z zBxE5tvq6Vkj@$p>K9i4&rcH&V!}J?#)XZ3yEQM+R{XDa_LM3G2hZop2<1A>3fNxg+ zg8=^V&4kRHslV`$lphQ?paV6Vt3bJM3+bI#91_WU!wwXlc&d@gan``b$%EJs?l2Zd z=`!5YS3KMEnnh9ZwwY4vFAn`Xz1UZ04V;{Q;IMZQonjH10l*=`X|Y!L{vCjANixymurxt~en6BH=hX zWzxAl|G}utHwZ!%NGwT#V%rcY5I5+m3ollc(GA@n4pRaSTlZN~UT8^;JeB||Zw0PH zoM*ePO*wwPklE_BXxLvo^lSdW(2AsLhe{jsf0Nk1eGA6cJq>Q5&uc< ztDJ}PO8$Y&cd2M)jf~|T;yJ}seW8Wi;Ap2Ho;Gcgo|+Y~=iTH>Z1E6o?61{$C0KhK zj1+kM$JEpPeW;OO)L)#I=PCwGe*3=tgx%u>6533y`OILwR3bZ{E7n79ubuZBe~y^I zZL>Sa5DG~JKLVM#6)NMO*j`XRIp}rfy$~wBw-MZVQSz8nc zqi>Y5Ok5vIm6_R-L*8%c`(5;HcUV%;jKcs);+`5|PRneRAp!p_FEBf%L$1X)Cky;~ zSOPWOI;90~r6sXS%Z*(Jf7kU_MmAR}2Om75Pdvz1f<$?~CrOvo8x2-^Wq0D^ z(|q7CL4TQW)#N#M<*qP6Sl=KuQ_bgn4^%05KZN-GKZNVTi)+nTzJhmS;yiixdsOkg zH*yN=zrB2vw2%02(X(|Ud2L%g4&&4{6~{5xw(jUgL&=Jt+koYAJ0Mo#gyx;&H4d?{|{G&aFn!-SZFr7 zZ+tYMfnScO!>vIBs)XGQysMW2k|zBAs$JRCfBr}rOndEU-c@2Di_t+vm&inP-j%ro zfNizzm_LPa_wcf7@(_c5^8uEe!<;FWKOK1D+ZMt{1-?enSY?J_N1XKR|PKuIFBw(7o#((Y%!Rx2hw-@=yW3SQ*K8I%dJG39` zt~j7OR8@9vFt05B2eIsrT|>?3|2-eV;5^)<7@(qk5#+0}R~=OY_e>|{l__E^SY79P z?|c1yNME=Qt83Sq)Xwqb#KxZ-KCWaN;R`m)U}hd7t&8tUqho2SqjFzaIL)b?GQO0& z$PHUj@=EXbYnI;mO$XA~9rW3p&(M`hB*m=?Qx<5rJeF#GwQ#77ag4_dp;5&BfQGN6 zDvLC>g4r$*a#pdru~0>w#-t{DP;rd&H5!#^%mdr9<# z`jy0p+l^=)QFV@5qAV_dHPDCfu{hxUw@I;RDA1C>E6^^AXxjE`t5b`VPGdy6++|6y zBH1p%A$KosMdwQOkToDdpt$Ngb5Id2{p#aR96ewp?L9tvwfOTUQRc-%pfv@L)tyW% z5X$TFwg~o+Jr;!9c)Fc|2SrgYB!JSS^42`B(ac7s#Y*#xR6(m7?Qy#JhI?Q4-t*>yw?VeD_O3$#qHP zhVKqciMHcwd+qLSs{R|TCHU()M+9d|=)LI|BO2hJa*HB}WU=Q5H$Xj&D zkWkm9Nn5b`u#aUfhdG|1$2sH@_9!HYbjJa-&4*ivH(a?Fn9;%10%U1Sp_dw1A0-e= zKBTD%vbyj>c73s@CX}95% z5}^CQ{a?L`-qg^we?h6FThDD=T9&d3(3pf>&84#blfr$xBzcg_HHn{Pl$h6V_0Ie- z7U+AJ+D~33gaiwvPo@<=43)C+IdXt>@$?G#xeTRQR#++mosTYQ#U(O}JKDBW&OUjB zlev82scyU9_^@aB4V{fe`8FE0sm53NhwOIz8#HA+mJm`*7>%jVo}i zqK@BsqQ~;~);*N#*>kPuH{8XOulWi$SN=BpQaA2BTQbw&AQquhj+TkZbZo+ zj95$iL`^TN$Yxbj(fUzC=poc(+$Jd@20RGURd)dMZ5u|+_Nb1C9e|-TTn*`Pw=X!t z3=<9QdKy{d`|VUu@DoN=5j!1lBVj;G?xKS z{v7p{uU4N8St;Jv16+pWJVY;qN6D1$1XS(H%d^i+vwCx>=gLL=yP|J8xwJ?}?B-%B z!AdQzSie1)e=@Z{rl=rk+HYO7*VQ(XI~>SUR)gH5gA!ql1-C)z>gs9yIT{~F5aG1J z`kc#*gF@mRa|k}3vxrwwKRBN2Z1-t4TG5y z`HH7r%z5=*&~W%f9Ipe%Yl%sA`Kp=nG~n?~^Q{4DGy5Tc`Qdj6){B22@7mtb?j-K6 z?J-KCb$JxV1z(Rmvs+g-JpT$!HtRcon=1$U{Ft^lSu0o%!K{e9PMipaUX&^6m^&7o z7P%ijX4Cf!nqD&f2hiu!@xmCQa6t|iuD=_ROLXjS-hlWHzC@V?gg&ec&W{MGdx3yOIAEKL&fltvpusAA-@j zK*E%&G|)RU)^MfisQ1_fIDkAH7vj8$FZO0uXDB#s3w&&Ox5$458>;RC6MKPG;fj$j z6+wFPC5z#G2{4vhFWLXK&|UhiEJ~i zS>NVv1MWNT5vhXt?6%c^M=j`ki(>xr5srpb$fD@BX+xZ+OMsD2yS5sKWvnSHGns~$igQP&N!C*ONl&0 zgO<=}(0)l8&@aJ|G4u$W56YAlhbx~poBZ2%lJg+yHqn5k0(;-S>A8y1Mw;{1z3<^& zmB@i|>2vj&5~i~U+dF?gIbS$q8o72|-AiR^Byq{gUgRrHkEAiY2&m$px*05JC{so? zq6Ay^@Twxj+$ll1eJ^IWm6U0I*hdpzKlSL@+yp~R_B(;Q33cI__(PFMf)pew*`;V| zgTnabgF@|HqF?6Ue#(%N_jeiHA{y{h%{SLm`>e&fISTm#LoaLbn4!h5Nf(}PHTh!$ zXG|X!_da`itAP8*FL-qKx37~g*$idHwiED>Iq_W_H~8 zLR)!L;G@Fd(7z)%Yvj`Oq$r3-)9ku*VGD+^R)%-zWj5Z9v$gQR-Ow-M0&ICjsY3G0 z(sYZu_2QfH|NDp?wCOtx+x?Xi-f(61g)wNu(s)un@;kVY7tI z9Z=Wujl37~9F}qR@N-auj>AEFlHO9E4%nUyb)UTw)ac&kv(w;R(CR&2{XeunF$#Mz z31>h80WJ9ZArq`N`e7pn)C2F{z&_2W@05enyT=kX`m`C7IloSItMVa3Q8z!TShNL6 zhz_^v=&j(<;^jdweNfT?v^Jx6A;Nm`4Q*8MXs_pv`;Ci^f-z#6ZAKd5JJUh7=KHIm zq$!hQOIHpr%Rlx^)qp3$sa50UPDx>>%fITdA*g{)3VX72JXj-Dq~URrsl2iEWF359 z*Qz9&e4gBypdPhe|3T)L{98Neth$^EI76}(Sv~ZOu0JV?OM>iaw_xSM{WW_dnTMbxDiuo>e{G$^d1JAuZ_B)qEGO-?gq;W5xhi)w41H>*2scXcvZeMEM;Ek;w1z6 z^UUb*lvN?dD7jPnR7BSsROx)`Wq8r$zhy}RbK*9sub%bnIsYf(Lat@dSr5_tkr0;H zM@NvbYR**$WmNJM=K{MDM16|;Kc%!%_duhAG)$u};2LITQL|&YvIHpcnmhSu@Ia># zNnqyq@Z`tg-e@!iJ)QCM!N+FF9SmX9!HC4^G-t0GDQ`t6ia+=tQyC}h0bRG-4K&0_ z4>OrVuIHHF=1~8uC(npvUAUSXE#;l3E+i@UG_~ElZ_v4q!>F+mVtCgro;!`pw!YAe z896`iS#>~Q_YgfW;Mytyjw%*?wTm$8FLqX)IthJEX(11%0}W}O{B2@W%x?zE>xal< zWGF|qRHV}a!x<|CMa&vjz>JcpsX!9kXByKZo|qYH*5SBGQt=(4~mlU-0KBD`!uq8M`}x=QwPyw(%c-cb2DStK zq%ZV9L%^N~&n6Nt9!iHZAjOyPn^4aao;vx3r>iPNr=IThU3NdBk+o zT8IBTX!!UCQu5sIY#ENu1S4`}S0iUzB#okj7IiM|Y*VB6*;*k2>HOogd}4xr1X zT8``hjx$O~1#sgmM-=!bqA;8+g?|l|!hpO;=7dW{Qpn$5o1So=8c1tlxD7B%=S?t& zmKm?(1X003Fsb$-UMdYQlUH{hLv{{Z0TSQnk{9O+L>tipjBN@^G<+YPB^%Ml&$n*i z`SYD+z+?IaJ64(mh?}_Pvq7kT3E3qVYhLoO4}QX3WpLgta`XvRi3+lDF=sf4br=wS2U$o~ez8fy}vEt{DR?YpcmGErh zZFw&f;n-fVv;LcBJT2xjcj+AZ6(Ah^F>9WhbD*zr_j8d&S7;a0LUd_7P=1zq>tlrE zNuDW4om6N`DHAI_aH0517)6OKR=M>QEvx?N!Fm*F+50?=wrWoTWxEQn{g%PqQlLwJ zGlMOGjbfiEx&H-5%>f`YI5rjPsgJUkCfJ6+Lpm#$#+HV=5$V6z*S3MY2*87-&PxW!lEeNxSL_7w8=)dn zg22kn9ZAIt>J5Z9w$Yj4JR5CKw`@|pQqVEO?Xr+bV{8H=H>nFg4|->rwizlIyE~wU zarJ4J?1b4Qru<+)P7Bc}cDZQdrGv~@PYCIF@Ttf@!08(iyVgOw016ETJOpMcuNmt;u8j=C0<~eiUs}dL{*7N;m7#X6 zFX=hHUeDP|GU8&3?b^Dh-Uy#VZ|DW1|?1aOoYo29RpFgTc2{gAG zR8Fu4sC~2*!B73Ndk=Lz8MaJCwYbax!KTrr`&UuVu9~~%u|`u8py+;{)!n@|GG$4_ z-|PCf8bfcq+hL90-R;kZaCxOmWBl}_BgTmH(Fbb&7zlMet1~RRM~f@F2JOt(A^ohU zt8V-IOeVf)t(`;6S8BCm*Mnb(U@sg{YJpJQtmcRnnAl>V04~y!&?H^@$sQdTRRDu+ zPkdOUexdd&dFzAO%J(}Ni~FIcCOrYw6{nLPsQ$p2ja|DD@*O>BCQQ-eYqb+jF8T>x z2w`azRxW%)SJWe}CxPjJi!V45ZNZTGz3v8b8a7B(zxyvt##rfG*utybHfj3HfJI)*f9^EHmu zjcWZt4ATUxw1A}$Oj@48nI7xzy7_C9NYz|!!t$>D3^uEAwNRU{2IKcf)@Cem0Kob>J>hMXOXB(fD}v+=1Sz1eyQ zaT4C^DG=S`8QU5TRjXXn`|{xv+eRW_3vioH=D74GdE6>KMbBhY-@hj+0Q-p@py4$J z>g{IstqiG;?j_Es@!dy!Xp@g(IX1|`Aq;T%frnv@+7f+gqOCe2yQL{KYWut#D0qKV z%?`2L1U6R}#*4Jqi{8J(F@_9{QEBni=WtKa{|r)i_rBl%_5ud<`g!{3*y9&dqWfrtLxNF*07P+Q`Dg}u&hxQ0G-`E_f&kkFS)9g~Ya&|kI zwITDZA3upIWg9riH&vL$+87nvTYH}lvIGq^ltk3UGeiA1CH=Q@=!ev~`Q#n?`ON#2 zfN5M;#h)P?@#yl#dwTV|%Q>!j*1I!@KU_UFKQH5r7n3^VB44$^F^ zG@&a{{;t)!_1YK^_1a*8yYC{6lPL)#C-P?r|53!eHyPr@{PBy9z8leANjw@dD{WhL zF01fue;FlI5&X=pl;*vea|GMPy+1Pj!fI%-$n&HzKX-`;$}z;_X{`Bi;JwRUbW0AA z!R$*Qu42~J>w3Z#a6e2Iad9aMR z^29cg1U-rGsneF5aCQ&=zm>#%8^p&*m&bdV;Gp3*F+u+Q03~p zxh`K8M-J2KwR_|KkaTE7A-H%nubm8#&G(ay$3>Q; zAdq^K0&UFPn?9T`Jir76Fzz(oD_7-q;?ds=xrCv55*iR)SO$HCs-JLUHjrXr=g5_S ziDoLu?evIPv51z>)~Ms$w5w^39b+CmL}iX9U2RTrK2`*rGAB;LjVuK6p9G(?y;gn7 zcC3znEpWGcl0#$5+ts67({2q@+=dAR3U)Km-G7#~ix2R%v0$_I3izHE(Rv`7-K5eg zzjTx-Ee$3Pa?c)NqZtISf-NFV*e%dNA8@ABU+INQEg zYhXEe+Q{kA9*gLlqQ-(g-I&W#r8>@eliMS=@4R%5c7AteVO;l2Q{;YCY24kc8=2Qd zq;9w*^8a>R&^~cG{zF{o?L+lE5Ms?*BfOpjG`9Y~I-ZiQa3 z%bffbr;==kSe(`6(`Qp|nw16H+zy(K_A@MNglTY|<4y|y=^KiCCsSU!9VvKZ(^D*{ z4^dTpX)TP8fFdtQzMVCla((-j<$IfHDRlKUjY@X34!8ta8VlKxy%!m;^^hLq)w8QE zUUvdh$J#n|!}5&F=h07dRma^xsLi5V6Qi+TH?paUQuStB;^^GFStttYJltZi7I@C} zYeL6+yM}(zaSM-vFFhp*gfHB~jnzO)$nZSp?2=sy+d~wvyTjt?-uFfSn2f~1PY zX`%94BV|U^nX{X}wGtOk%N{ArIbYj-|F0ec$HUp~$?Y6AQvFw0ncMVQF_xpQbKBz$ z?5V${^|g~maU;8dNww`?^Qmf2`8Ds!UR?(}zWd&eQ^A+U#iBbqDC1~GGpNT!#=M3A z8r@d+ED_+i5?qh#o4}!oBB)34q*$e=Yl7q*wdT{-O9z!8?(OelIG^}R$hIPs!Z~WaI79hUOjFH|BA&q%VJ@cS3RmmVdmd##JvRB6>!KGhhG$i~wQhDdh&1 zCR9M*VH0e5h_ct3C=P(wVarsJSEXw49-nZd#m%c zbs`BD!HBqjKp{-%VIM`LM+@P5%r8)jlM*J4b{?pG%l+cZk;d2@NF}^(WniQjKQnt$ zal0VpWGD-Eq;?A#JnbPvna9B{d~!NMe`qvVCwkop>hG)3Fn>}aW+WKx@iGDqTL1l- zb>~K32D|TvyG~Y=_YtP0W~baxnsc(7G3;l=X+}0^(?*FfkUHN#zBGCNw|HR`ac^cs z!&XofgT3#&*kb=!oo;!}V@tQ1zMYv@UPt^V2t%I zlRM`YEC_qv9>M8~HA+ zf`1|S4!K7FEX;2luj*6}kQH-!RsJ@x#x56QCwRJ17&T2zBSjy;UV-ksPvqC>vwk8x zzPZg3#v41l@`5%bN~hOBW|Nst7O^ntGbzNy$7@W~ zmD{ln>zQ}~tKg223R)o_&{jaiSRZjHbYVTVpc&WN^_Z3I{`*f6doAK3igF5nts3`! zLGRz~5h<83(3+8`VfGz@d;wYcdo%FV^-f$%0Z<@s&VC6yXiMH%>^}p{$3^R=-|zRl z9X%rd{`mvr45d>dyu%C#t$2wwvAM@LGhsfx%Ya$Zm9c6jm3u-?T)b1HlLRI!7ERGN3LYfQ(d@56Vx-@+J-tW!rM*2lbm_^)z|q8%7q*J z+9nNBK!?@oMoAVOzb$BEzrMzeyIh`bV~-j=xr)^c@ea@JPlY22Y|44_b{?hf!sMZd z5#;hMY9q(xSynSRL$Gxcxv>?*4{#rL0h3`~G2c3R+c9nr55#IQ-yzTu44uDq%tA$v zvt#%(+|zR>ADSc(_F#Y@F9`XE6%6Z8UD@^ksq5Ia?lK*k!$tD|C2q?bATQ|PpQo$Q zc|9tQ7bwp_A8P)D9pxlKee>K_6}sv4o?1m5f;1NkvW^hBo>!(M`|9&rqYnSEr%rP& zE~bh5k0ST34#1&6X#d>Sp3XSl&FE4H_?&anmqvHK476f*oVfc@?f-K)TsD7_zN ze9Tp5@M)XMX2uYINzHX()Yx_wW30*x|0CGbnZGr3AY}*X8ta9zs`kx@4K5w@twhXE;(cvsxL^2?qOr)Y#;O@w&kE-T@A3E-D_1c`&E+O1q_Z); zC9=_PxgmZY&2>8_@lt8mkXqzJOrAkLUUJ*(G`v^`0#gj3NF^2jD!y*)2y_NAKa?)o zOwDfuj%3Q zmW6@Za?A`*rP~AELEWBBK3Fus^_=qdeHpL4=*b|ta`=BQn=K@VETf1iEXg1qz{cZv zL8ug%a-}K20w-&R@XYNW=?HEw28f1mv88~B<$;@WFUZ4<>NT8y8cVQ(qBORV{QOC# z_tyz5Yqo+7N9mi;BNrl42&-T5QhadVU3#oNr@`^QnT%4kp=d(|VZujE+~?o^16!jT zuqkW;G&oZ-dPyj8f+;gilCgFR;!OT;6|Xfsoe0vlh;kV1{j&&AuN4HQAFXn_vECE zN2|ki?0L_&B!_vd=tYSd#RO8$4uJ#x#zJl{3dpB<$-Z+5i> zeir|d`hKKbR^g}YsrQY*obcRb;QZjxR<@jBqrFG$kUe@BWhHWu!LM&S)5ewR%?N)_ zDq|Et(oE*f{$OXWgQerUJn^|5a$X1ZpJw9__eI%$D*sSF`7DbY9PP_0rPUtTd&O3{ zdk7O0XuA%f$ylfu9GqJu7L-yiT+ zCj`acOI^)vNk*qyu!b$a?xoDW!FEptZgq-0*x2gWowQJ%v6)6`kQ1-u@5f}Xcq108 zwb5@zZVVNC(u%WH;>+Xbx2TXxCKq%8`1$_6|Go67`+27U*UKztZ zC@t~)iKMR!gayDO_HlufBDOV@(CuJ|WNNff&0BDkS!5S{$e~=hgqa%t^8!#MMw!lM zlSIIT7f>GBd(cYsRiMtWeO=V*mkh3*JY8Y7&L}dLec5J$kP={@%Xzk7sJ!~xjHmouNF(gzNCsvGzz>zzVM(gBriwL{*7;s=8);EM0P6T*sG*Csw6a zEz}ojvl=nGA=vpKblm#Z{d~Q1z^1<{_XDLcg%gk%eaq9w7uu*A`Z<=TlB&1ORF->{ zk~NUvs9=<;8o@MXW$%CMRJj?bUM677CM4&hldrl&>e50tgCe#H79S`PF2OPed9ZsA zQWT&T@)r+L9ge#wDd)&&E8Ou5M%UjUweAaRS#F#rJa-r}x|-i|?+Ji20x40V%3~em zF6w>GmaTF;yBY4hP_J!pZqRf=@@5#KA{JJ64*7|qeBKGDtQO@7>z@b-lRu{k_n8Fi zCDdIKzQ@SS#DZh*-@s{AM{obE`|9hU_G>J1S0)(YYsE-|n-#N<*>$QKOE{j0RFXeVQWdYq+R{`^bTxdR?sz@4?TXu|(gar36lZ?)WB%i3^}{U(UzNUr4iWlz zIEPNAMk$EK`BBZa$Adk6`Y5`s`E346dsiv~wk#+QD*hA{rU_jcgl`2CA)Lgl^!(l8 zg5lWh>kGK|r<~c}h>Ll6ZIf1?XbfvtblG^=0!O`tw^QXiX^gb=K?%Pu~>6 zbdNjcjphb4Y{!pXmX>%Ge`>HJ-tGe`wf%8Tcneo@tl&3W3y|eC_PWsk4o0pqP zC&9iP6l}Xx2}AR`*Z+<}36L_2!~NqN>Aa=1}_ zB8xWRa?o#i;$MXF(eE7rK~Em`hJ_v~m4OBm*wRwrDsVGp==wc5(a*r}*o?YnjE$cF`|D(86;kE$fFS9g0R{7_Ik53rz zLJ-W?Kd~d&#fx$%vCke3&v9N5&AJ~Atz|V|2Ds)EE&@3a7?zBJKJ<7oPnrO6Gg6=X z^!`thz@nXVw_ESAk;Sx#mMf5hgAE@SwE(-_7w6ZyTsWr9jissYc#1>?u+f1HSU>kuqlfl`~sOE(pSuRX98 z{{+#(6wO53c0J8Q2cd_4ZWS8Tci?Hr8vC?_WvClp7Q zj3_LT%t8!2V80uT+<0Ygy#2wYf%)8nA&@vI@mu+yVp-le=ak$me|?sfEX%JmKBI$6i`@j+4M3PIL)(RAInaO<7bi$s{%aHbqawqv&N zHaNyLmG1CIk}cN>quNZySHcF=O#sAzKr!J2>`0y*G4C~~eA;(8&55!2Pr>}0?|>vh zIoG3=Kn&>09B@5sIPNj3fjEAZ)P|3PG!E2{)$)Uq83mKMy_&;9of^;m#0XKORsV6w zU$E1*L~^=b_-XtaBRNBX^Z{ks7cW#*;a}cc38phn@}ImP&HT~LbfYwGpFo<_I@df? z@!HWV67F^i#11tKA=&9Z!84WfQ^d!#Pj2wRB(>dzCC3z_R5)xQ@chc;c9EvcrGFPM z;+PU?1W#5Q$|UKNSNkQnnucjtzheyEcztUXHg<1sSpG)y34QjhWk5f3_4rT74Km)) z5}ZZ=4{<`!w#+==Co~l9@VlO#0#|fp=;Mjlf>jf`M*fiC0nohMv_$f`T*4KRk4Me% zU2^2u*x0z`pafSEZ7-$mky~B>o~W+|7(i*i4vU15cYY}x>8;czQ-nV7h00enpU4CJ zT{QcvjaI8W^p1|sWp@oQCNL3nfxN&rK7%mOem zF0NGwlQMWV5nTj zPCRW>@4LNe_7#L94xg8GLiqd2BLr%?_P2Pf^G@X(U~haox&THL$vwBKw&KDB7?@Ee zia~*a>nF*dQAG0!jz$8MuYE7C7B(r>Z+OlgzX!(?>4|obqhC%IXE(NYMJUiM6VbS) z!aR-qK^3i4y2!^R9%r^2&73QvI?x)%5M|T3_fxo0ZADgPF)<9ea7`t)O}4?`TvEln zq6Z)S3!zTXRf2KyyXE(o1<+NogVnh|#zby(hs=qVS{qqm7OErjMoAVKqq$PzcUUeN zWol>Dr0-8X6wc4)TvPRI3YS1+t(wmKHQ2^O6i0{TT$ASzV|?oCvo1X5tvl;gy0D|E zY{~D*(Il5fkFoP4SFgBism|+wk{bRn-S=F|jj#O0n>mjCA9f`lzwB$8^e^ev-= zvqg(6wD9Vd@Kxf#Ebrax&-)vCybP7QpyJ5FOFazOmr(mp~U)B?H+*^jn-D(t6 zJ=ZNkW+KEZZUiAl7Ld`r2rYNq?IR-bgy&Py>G)T|zO#cPWy>GdmMOv zrY`Jx>+}<`L=F`BDh=&*eadJj?hWSm6j9>leEo70rt;jrYPTAe#b$LO%D=pcKf zp~-5dXI;woHk%l>U%>Y8pS^d~N385x^xnDDapc~A}E;h6Woeh$OPR0I3dT_E}&@V!tqlR*pg&B^rTp@>l?kpqsk2b ztgM{^^jkGj5L0i`jFXeeTcSd-E623GZ)6pti6mKZ9bvLpm~-_@F;54sX$CNRDhHAu6ruX_~jAa3mGm5q0zAd0Q%<{EW7 zR~Q`n#FrB!H?S7xJ1k1Ct}xbHYigOqDhrcjHMGWkpA zQbBd)?xcgFBQK$F-|VT6o^$)#@4+1P9~Y&ke>L7MJB1=#4%k(dy!?saQcm6iQZ(Ci zrzfha?uEsyrcJ6`M$3liHzqCmM7)&oc@_~+_@vtNPl&=m2J92x9qU*)cmPurp*AeF zusAb+K_VDK@ zf^@+(2H_1DIVw_IkcN#ohYW4Zp*J?mvjJ}>9oy0SuDDYqSGIbuv=aNQ4 zWlFWwW(2JfkuEzT@Pygkbcp4!hXPswdo+{_$IuHgK)YTZ%1mN9txMXCPj^apBHbST z3PdEvGlQkbg5i;xoUi}D2$qJ%DV?uL3%Gh*MrqM$QQu}{`Ilg^%8!nNT0U^{Lr026 z&TTh~5S%8cVN9s$tFkpljbDuWrS7oD-*H_$zHTbj=PA8ms*V1W6Ml-HHr1Z8teHA} z?2W(pHdb|Rz0jlYg;B;)ey(MF=7J${_eh>veHR;T1&ZR@>UMNfn!0kaBtgP!87`V) z3p<9L(tqbs(3`fAhnO;U!OZ#e_o871kmqGd=Ia@1YgwGqZ!Xi-(TWOxc+kBe=1GSo zpV-Nn4;;0{isEgqa-6PP$0;7-UkB>Q&ORLXf|=dm68h<~ zK|9kWt5F0J%F+k8gOuIeFd&XuoR`ovWj004OM}}LiP=~yHvJ5MP38S zBx(Jk*cYi+IXIn^Q|HQUBQO68gCy^-AI|I9)E#RL1kg~r5y12n{tE6u_%Dd@{dnGv z8Oj3W7m!dWH9>s{O`8gskV$xsu(gG3LW#QwnRR%Uker*73N}=TKoXSok?&o48NWHgMpI;h|=(9NUE} z0EMWV%3*>_sH9VQC`PA4`s4m$; zJfQ#j-OC7-)i9m0kR&+i@wm#LKcuetYcHKQz?=EaQ_b$$_I$&|x~z(?wU8a4F@b(C z)9Qwz$S#Q*0#NlJc3>XM*FrEa+j)mghUT7in1nLoAykZm2nlDd)cR~xU1xcq| zX;@-B*$AEce=+XyY^@JNhL81gdZUiD2fy%oeS$xC~1hU9wX+Jx%W~Kqf zKGirDvh_$6@aYU2D+&}zhUf{%b_c*1reaF+5RY+>{k#C#&eWrXNmty4$z`N}VlgwRBbF6_t{Y2i%$;)H&O z?=9gi^eGH{8*@YST3k7yR#DuPTe45>6*ccH`_a0a)mo=9qx9@*w z(1B9id+70nklsH_r-u?}_I~OfK@qd7MQ-XJyH#%7BNcs%bR2YINbjK6)enGCZ;p@LN~t?O99ynyL6d6@CqgNxq)`YbqCP; z8lPZz2!dDQ9YqU!^L@pfrl`w$5R!n=rwQ$Mp~cI(lm&|7BDbl(pa zf;fXSOc_mNGdg_1e5Ik%&>QL$+7Ppnx0m!r`TA(?0X1nNKCO#K4!_Q&Y}*?-AETFB z@thf$SH-hZ_<5*^ki-%O){eUJF`;tjt)!#%V@Jq2&*lxZI_Zu!1R z&EeRq0+HnqP_*{}Kge03DmDBpA8^jv`TO!}=bS??ofBL>x^&=cTl#hJ_{9_PYpvda zVdu&E*#28E6>xeB+L`f;J)m=JvMi5SxvU!$6 z;eyqK>9w+z0B+$RDT=l2RFg5W3fmIUJE8}@R zgI2Nd!w7D|)J1Y6P$t8#pi|;8Rj=yQ=MDjByM9>^lj$GWwj^3W#RE?thv!=-W!AFz+fMGH1ctNeuCL43oIddy=6)5&Lz>wu;xI4e=2+oJJ`lw zX{t1A+TdTI(g(X{VUz<>_S073gDDe{>D`AOEu4F7@2h0sL#aIaG5bjc` ztMos{&92ZwOxkd}|Lgg{TorQ&&vxW4ir{h)jm6XJj=ca6J}@-}2Tz`rZ2zmlC`~Ae zL)wKg;I$t|@5o5@sS0&uv4Goy$4z_`BD{>JC)Q|~bXtuTLd&RLjzxt01=36MoHpzP zdPtrli$E+lT?1N4szGT1?vWegj|(kZ)(Xcf7#4S_ZA?4Cg<7S_3e?6FjCG704HH;R zPYL+$c2;{IiY(A^!Drxi8}rs{)7`KDmIN~}1odu!<^8`&=~ug6J-9w_)Fti#H@A9~ zaJWvC()5m9q5OkhrK`{_d+GQEu8?l`>4{tD#FnVR`=4*6!Y?W4H>uU2)vEO2*{@rj zlD?=ubN$4G40OET_qt5vdu%fT`>3qdun1dmxr zJ`VBw+UheTJ#_#r6=3kdmKpi37E(S0fPE6}%l3h+;dbs8b~}&S{7J5LRl=G{54QKZ zXa(X`yI8wNNwrrLm~22L!c_I`FLIbl`9?38ipSWIDJ%5@cb2RTUFsX?{zth|)Q`y2 zCC2}ac_F%N%?;wwjQ51b(f2B0{+92>sG3rEc!&dT@Fu*Z&3?Qfz(D#u9%BGia>@Uz z;!|iMgQocDwYE!{te6UN?K=W{h!C5yU;u*_?WOYY_r6pE=N0cfyhJ|RpnMlE5-$Mq zCk$LqO&MFcs{;D4UChd_yG%aiRIZq^0=QeN2$=>`oP2UBUfG`%7v2H0yes3!Kcole zU|;lOjJGuI3(bt7tC$0m<(!BO016WG75TGsge&ov_DWaNtj@3;m@*+r*osAse}$dZ zs3&x36XaWvLeD++u{HH&@8aV29X(#2HKvIV#k!=ty}718CB$cvW~`es{*=fhPt@*g z)7}GJ+ZWAnUt%RmB5jP*={6^C8z)?No8Yd5n78Xswhx#Xogcy+ydO|Y*@9M75}+(j9t{7s!fD)Q z+EluD-BYn&Z_)rKgYSiuzHGb!-cq%P_Jjw&Fc^< zrMy^sV5sfbig#9rFw_!1LlGC{%s_mNID6-{Rjebjx6xg|{*5W1VWrm{L;g1F(e_{E z5#{BL!uSV0B@cKrv^57Jfcx*y*RiXFO-Lk+s;oyP>4F)?r zpHGB3VbvBY3T7|0Ad2>ZFx>l=fF~5waw^_(!W%s7c{x9dYP4aL4VmeGu0sSGjSTrx z0)|_H(yJ1ig5Cvx_ec>(EX7to%X8)X_pW>V_Y?8TT&^*(b^tk@xP$PMS2o5NRgO#j70K2|I=SdhlR)q%jxPP60UVn`|xDDb<|?d z|DAd;liTq9=cbOu+T=_IDh8d9f?Qown7~zup-X4Oc!=TrCJPOPhk!ja!SY{%(v(N;IfMSbf?!k@18i}57y7OXcrH- z_1+y-?Dz9qiR^jCKH$0Ay-1U5^*$2jHAMZJMILY0OV8OG=3CXi>4r!|$gUO}t~Lg` zMEDkT@?CMfi4o%NPVe8fFg7WE3pPjNc8SV2=Nta3cm1AAGWB?@?eQ@)r(pHnPp;-+ zn43%Iks2`2S6cDzuhV&utT*MhN1;UlI$rs}FL`2{+}=GW7i}gcUC0Sx}#I1a_Jq-iwy@do*$oF3VF!X8F+4l`o+M7Qe9?dngxM)u7-3r#=^t!eS04o4rAuCn|1CqD#9jVO z+EL&TMTl8b(jllp9IRTOY@nuwkNDFZo85_l_w{zs!@`Xx5Sk5Ha7og+=xvUQ2ptj-tS#J37!wlLh{1(pO?~+4xyISW) zw!lv~HwAiJR3KXQT%r+7;&A5jFRIX>3RW0E6)L(Jcb8z!3m~R*HzFoGBV!J%Xex=rxN62Sprh*yGyvzZ`Xy~umhP4X75A z`4dAo{O_mN1Q6x@+YJ~f5UH<3pNY0WY^5qDYt|c3#(z{|p)lqUmxnw{nyfjB`xOJB zpfVo`I;dXc(``-Hdi|T+Gep%I8wgs6eo5aF;MzP=N?6b_t zLvv1-$9v0DXDaT9|L!nUW>XpvJiu zWC>b2LYh9r*^TLi_`lq`*epg3JwQs$J1= zWvXHRP7u6U59`!f!Oeu{{lg8A#}rGt4>Q@kjuyNV$G;kygMl|}KKUP1xPJ;2kdYV| z_Ka+vrlJ&koSY%glBPAIi8NBxP!xG2=W7oXt8N;Bq!alI18>A_uQBAH51Qv3E>XgX zuFxGaK+Zf4>@i`{F>FoP#rqzlD^=(MP!t$88#?>RmEw<@GDl z|8%IIpvlWObNHCTD z;#dLyXdz1ie$x3IH&3IZjnThK3dP3T?SG2Ob7!yAjy@-mV(#LOydj+}A(0?>msPvH zl@I{YjL>@8&qIt+WQiC)J*Uh~XhYlqWqDEu!j#dP7{C}{TPlFeSqC1XwF1#s<4xm9 z0){6}8##V~UzNdcKG0Wb_@_C}a|c5Uajy_Z+gI20_EUKT~Pu01=xogac?6#z5Kr4-1t+m6qvwhorGGvD6Sl-*U_a6n z8o8?T0ew99|%et}pNLcGha;I>@NE8g&;wD@nNR=xqjS(l2GBh9$;V>MrQjPF)lRPPe zNb!&sJM>A*5nqH+&5e5^022&oTHuItrPRn`)@FjlyeU)W6r>GOiqpkRtZ~bFB)sR1 zk0I0uDdN32o%U9;IZQaLBX9Y4Ws(#3F%i?S&@XwuEB}T!wcP=ZwG)-1DP^$q(Y-=6ZxicVWrF zQxZ$E`4nn&^1~a12b0L71&!R1LVL`>zt)U&jmnO`y0mV! z4jnO`55u}nc5q`-*Q$A-?Qd3(d;I&cM#5;AOo$eo0JxrqJ$$FOI@mh$TN7RU14ew* zxP+p`Z?{$n4onG{yxBFs2WrFWIVa(cm|wzb)6<@ln;gKkWV(#BBE#Fn zKw>DoDL0{Qpdnvr^2vqToLrK0qm6xq6ZJ+lhrnmemFx5l;x{=uzt{d;xahG?p010r zt|VD9)#3gh)Siw#M)6#cMCpm`n$zC)j`Q}9-^-5Zo*9`py~BYgSLqwi0<}EtSy`Dv zVMv(ztsN=IK5d&oC|#`^c!KR;^z$@W^V+r8$k}gGkBt?By!sUW0 zkKLR6;T!74CbS3&_>)Zd0Qu}P=b|=UlabAaci)j8+9(r^y^J+6Phs#I0=FQw#y(>H z0$t5SJR}pb8WJB2Mv;fGdkC?$>q9nswDu+PkX^Hw=OJ#|TLobK5pswc!q5}dXCvT5 ze1d-4iu(|Fu1=95WP$dhg9k{2WpbjvEu*F&ah1M{p)jF^lt*ku_g2ztwgZgjUlqmb zI9Asp8hWVwZ1@5rD>$#KXR%UXE2EM~MG?h_QN+!omTBT_kpnO_=snBw`x*FL$2X8- z2U1G3M;H;Vtn;Tmo=M!Y?;e|#pP)|!5vQ?j$EGAwm*131^fjIxMf5Pdz>3!34FQ2K z4Xr{?1+Jw!;`yeiW<>e6HpWn$OZcA^P7rk#`SVM3_DQMTiupD9SdtEku+MD4>FmG4 zn@gg1QapIZ3mlpFi#(uc&z2b13<=GJwp@0!>K9jf`nlSp&>o&oHOgJkDD5P@OrR^A zq^k&^NU2^p2X5qlD+l*hQSd6Y9;r>%W#2=T*^s%!aK(8tlBE^`Q6}~c#^x~4L_->E zezVquJ~F1%S?6_?HRoOT!7bJfIzK5iSqO%l5u@kM316`v@n`Av`R7R?rp)6D(eI7> zZ$2lXh#5|dj%rZHh)BEqfFJ~%2Q!+zPd6o7Jp9CwJ9-;fiWg3;jnoNO*1Y~sy08TZ zEb^Zmer+-p#<2S+Hj>EZkp%k~R49=dJXQcDlA1%1cjB3XWIzx#K^&Aa%%Gd$(h`>C zvYsNEt}ne#PGTw}+aXC8f?8JYE<)Zody=5oBYWokn#1^3O@`%!v$F;kP8}27n zjv&ksh9hoeB$7Hu8jPVIRIWW*jyCMXe@^TiV z8E$*}ZiScr>mc)?lV+M;gtU+?onlKn<>$nOz}49e+K)?Db$sXC7DYR|Zg$P>+xkc7 zil(W4(-1W>J9>^~8i7A}-F7{7Y)(zXS6QGKCPp##<|mTS9N{ZTcPe&yy<}JDs%rn_ z9!ZZO>mHkN+AZjWf>J%tLSh{+*8ldl@g4B}v1`TqpAr%e(~T8IntFS2`(cIMKsd=Y z0(8gwguyzy&%C+v^q7M>=6W<~kN~cYaL()I z()@X_8|9m1Mub~9fupW9xHraC+k9LEmY6#@8{QsYzRh0WsJ9-_)me9f_`&M(TVyZ9 zdE^CfE*-3Lx48F(-e0^c=INW&{0)D9H|ZA#snOmRt>_!Z%?9t-`n6RdUN--j5U_TpSK)tkrf6-TJ^fniuUS@h7}<&{6&*`89**wnyj(*J#-P#9T3{Ec4DTf;d5i zK+`q{A9;wpa+QC3#BwmGVO?e!XQs_JN_kFk2|}Z}Huss&k_+@|5ItRef0%C$hakCw zR2i_4K@c#uHcsG*hys{`BhSD=T+GjQaU5lgyc3aca#w0P5qQtJ;x7FT<;G*96I9uS zjX;fV*$L!ZwObJ7mB(!4f>%0{9y)9sdCO`<4C0DF{A%LnxkJ$SORRsq6{ie}7W-Wl z*co%Z+z*dCMK>?{vol?4MF7N^&caVdTOxoELuQNaFftdQUB3Fnbjr#8r$5_afhUc< z@$p?am8)&V{k1Um91X6t3ooZBGa%e_CyaAd{e;J4pCFms%P0-1qU~7Ak(h_>KTgOD z^K;$KgNt?n>|Sr_K_$iOCS|<&vxn2>H>NTM-{&Mrw>mB?PvOos^$$rC^-rgIpMXhE zr&~{tY409fB9X$b{;6W&XV|OG5y9@e{fJfl*66kRr;|wDEJk6)>EDFGSwYgM)1>w3 zw-R3Nl%C$CFasy7*SDjC*o4%DHp5$n63ko)n2h!adeb`ZNr*qaIWCdS=J`?K^>V|H z1cPUagvReAp6HY{BS*IMyk(wl(w61S&;Pw=92Z0(tP9&r;9_$4!4wTDupokWQ~0pc zMAorkE13QQ^4m?wh2d=$Ll*d3t0W#EiJqXvXn~^QYXf9<3oebRg^A}Vb1EC)G*fW2 z$#;D&wKRnj+}DQ7Thcna$e({KKyiszZq4apMCdHoV*#!*|wPKIP)|FuRL`E_n#9 zmgIFbhsNtF+ef5!1tp4yyf|uHar}bvzrDFDJZdYEYc7Id>#lzt_5Us3(S_hDc|>py z4UyNCHE}uESWr@M&Z~s3q7DG`l$x-YdBfXHAqbX~OV=Lch2xKZcHG#NWv)D;K;ufY zQV=TuTd9ax>P^dxP1!Z`In1bMzHa0k!Gm{MLW(pKZobLoWgjOz%49+CfCeHD=WLK| zdmg9r$qwGx?kTdFmn3Gwpcg#P={j@?<%x}0fE*|tZHkE~{WK^5Y`*%|McOho1W@v; z$}3PotAha&5EZz?%~RS*98nE(4*#pGF!IyG|HJmMU+ zl)wDH&fnU!pU>V`rWo%Jg|7k;8SI@QGh`pu(Umpg#QfQ)@I=8e1t(@!yeNvIC}uKH z-?qnaca1AAxGlSLB^ z4{M+G&)LJk+I@=;%sN(5-w$N!N-dWC2xayrxe2j$hSa}fX70Ai+|iMx+L6_|Qo#OX z)3dW*_tb#oqk0L)B|+_;&xOug2#u_4K_I?sx`VR5Mhb8l7TzIZh&s%Rl4o=P5S66C z-53ir|EUYmcjQf~u>+~s&L-<51UvB%wIhC=XB#~JJAR7&1yEwh5OqA>I0=X^$z}?m z4F^S25H9c|m|^F)M6P9!h4v)`!do~dr;xI&dII~(r(>G>%<7gTeP@B)9kK{8NxD}~ zcm=5rneVwWX52slc?-hrbb@CTK@A9;#c$50#MPM39s8JUPK=fZ<2}0}o1(yHcEbQ9 zIZ2{pX8yeX>_4mbX01a6B|odkmLv$~h;h{_Q`<{?(d`f)P4nK3fgUXvstwm`h-&}~ zm=g@L9yqcGvk)P{G}7V+hb8C3&OS6YTlGGH<@c$u^KU|#nCwt*$&vr^|7bcBcc}XR zjh`9&5+dQrS|kzSiAs#Ehm<8Plx37e*+RCMMU+U0q>@HbDtl$iGLl_2QkHCE8-y{8 zZT9o~_+HoV52)*M&YaJ3zwi5XBiA}Bvc}7rnn_U@*~nJ=!ObJX*jL$@?NHvfUqc$F z&kz66k3g6|cPTT8-5`6_dft6~A#di=#8RHoSJ&%7@$7#Op8p$60Ri5i;mX356RtMV zge*cq2OAR*3nhg&tbAq|ni+SpMeUd01-w0To9CsvW*3Ais<(xt zKsV7A;R0}%&P)=bh`pP?4__QoNn&n|N=_|i?&o-JG+vq{47*TZu3oDWgd*Sn>`nLd zX%IkIxMVjIKx6qfxyYq>QW=INL81~w5RCzoG$J$DQeuMSyCTFyZHI~z0L|IU+p&zN zxg9zS4x#u2^g}iC0GcOP$eAH)+4D3=XaAYvlx%VCLdA|}1=?{0r&hw>A<%k-(O4^r zMOyN}Qp}o%SCNoc25K9Wz%h}OfZUt!H}T0~?+8OX7)j>vbVcUdO{z4+QNDuHga%uO zKtl_a2@459QoxOvEGLdo6h-iQ`h||Jq=ozDuDq&@N5ChS9_dVABj%s> z8&xZ4R~vCF+G{jT zL1B*RlPfL?yi+%Pq4b;Kmi>e;j^_a6@yBGEcei%{B@?^t9O+SnGhN}phPK}kbOL); zi60OI@>{v5pOCb_pmtlMCy498&4imk=7lnO*B~$mqygo(?upfh6TO86>1Qrza%K6U z-~E5u29fyS6a=X68auQiDUvwN4r6G6uhNT&5`|82+=QK4P!k|7f8wui0^=ix26(?V zO;)8mP0Jq&%8`%qm_V` zC~0O~4U*WbIwv?idI!D?^^_aU?P(W{QXD3j38sT|mpncKu&=cdO-WLDnV93E%!GQk zrqh-us;4Ac7jP=x0jiSqyI3EeoNS0=S@)UzB=Z3=^Kj2MZiq67PeBX?0=Z zR=HmQL2QsLax5z{FTipj8w~tSR^*#BlhSeNmU^#I7N$RetHlzp9f`1AaXhu=v*nNs z2}vARIStlEG)7Jhk8YKtr+)Y^8H>n}P|&;^@`mHWH!QEkv~e8cdGPsMhw!yojCh|dKe8uqWqh25-B6z# zzp_{LTS8*n&2mx_pVyVUR7hUjb$XyfpZ^azDf)Ej74(XT)TE^9rp{_S0OQHkkQxy9 z*eM*S`k>4MqoPZ5**;KUtjxEs=Jy#XFf~&|CdAg2FBCBv=1B6OZ?A5|TY@l)UpkIg z|MH;N@H`*hVNh0zrtqFCk@ndN3bWdPn^N`pAe1scbgEHh{4_oIrUBZCYB5ln%#%nD z(wJBJGgc*ZN%JmNFneHQ8#o2;1`@Lyu)8a~AE&8Ja|9lOt3gQ&!EY0!WM4nkU|;xM zOZrj7qLr(|NlBZgAj;C^dlX`94$pS!i%avKasCy61n)QS(?P^!F{M%tifX_Zy+lhQ z{u9ATfeE08ipBzI{2?$BvB=ZlYPy#jzpSani-Q+cx^eYu!8Ky|6JXZ@-~t1vV`Jmb z6|%JoFux-juT8>%nE`4%=TS^khzGtkvy8_@_67dqSn<#oXh(6ZPQxZ3zA z(-$a`e|>F%3Um;hjl7Cf$Q+WhZWm~Wv+VyeUjjeqCGxFT=w?$NtzN)sg-l49D#< z!{5k-9pGmD11-yosX=9b)qvw~P2zup3w*}rnZf#X3{u`jX_t54P#NFIF67N#tgJA* zm?KdzVrcn^tQay(6j{U|fCYF@yYl>}d#D#-VVzJ@8-9H1@UunDh{bAZI&STBGy36& zV^$)pkEa)E;vI$vah)|fIe7s5O<0G#Hp1|pa(UGIs9DK_fUNZ%ay*UXJT5bIz1!T`^3*#aSFPMKt{_f`J8Y zopNh8lnyMseYi{(AdgZ|eE49Fg>Ymt_95n+ku5I&ifP3yl<+0pN!~%%61N?j+vUlF|}Pz0|_wB7*4?;5IL$^5usm* z(OsCMxQpR@^dLwR36;ws6$PP9kSBUiLgWH%>pMXWNqU^CY&u2J(rcS>dA zYOh`whTf z*i`d~f;C;_0$gYe+y^xUulxRV{8Q$00gD9Gc`zMs;ztWW#LQkvHRCv6_unhEiPvSo z?<86wuRBH))_@@0S&LEHoPY-yuz^tRz6pDvp=LL7Rk%l!aFF~NCFA(KSDmOkkRtyl z@&@{)C|lXG7t!YQo5%ZsbR!>pOqIlxaL!T4GZ|_7`TeHoZnYEpiAZIS+$EJ@N7A%&AR)QA9NyCG<;ho-!&2$w`OBbSgJBdfO zHnSdnozpGH@K4Wg6c*!&j_D)a_vJAAt!gpT&D#3M;>5ab-~j(!CZcdF$0@CL0_ee6pOws^g+<%me=7&sTGj{hEo zbVjtxKe-gYX!oxFG2@Ro{CM!_JQ0L#HLE%UrCvF{{O2&IyaI<_bxb!AkIQw`K$||WF?!W z(~j+eiG_iPp@7I>PeXo=P{9)#h8f z;ev1I2@NEqIrFfY^yD|u6(CQ6vps$*Nj}&}Wa4)7bm6E4q7*moQN-|nY;dLPC3S$Y z&1x0SovFf~BLc|S)cCWBH)ii|?*Hn6v=$TFzyII7@jO9cH1`3vQGDOgfRc4z`13&s z)H`JYCz0(qDz{n_HqSbdoM&8|+V1+M_}#8w{aj}RltA>LfLTK;=*_}E!rj;n0m}ag zjtSGzawL)uZ`xCpKO}Nc@(vWQbM$y|P97~JbM-Xc|AI3g9{b#5{-0e{y#27(Kj0lv z;r=pkcsVuZ2I0NGR7j8u8jh2BDswG`f}UPHiOQk zgpsa#`(hP#ZU-T*?W*hYuG$yLec{fYaVavopHAG1dA;zeP5e3vwRg>?VJEFUEKpaD z%~6i!9#$ETIQBpDs2AN7>7jb#I51@qcU(UpKx|Oi_ZNHeNioU*TGpr51lDEapobvR zjfD9BiA^nF$Q+hz9KFK5Fvxo1@PyCy^M0Y+4nv*htiFiI-jYgT+~rw_mNUrPSd5u4 zt6LDORoNE~)Z~m!n;T%|&{|Inpx$ste_F5mv{eSG2jE8kyNFMYMo_j?rDad(F?M9D zcxtK^wpf-6sYR#534GA-rX0tDv%1N7%`jAlYxYY%G}{B~PRbmXck(fe5+{7^pJ;i0 z0P0|=4=D*kHz_LY7#H}$;>Y60k>$_jYGAFd&r#pRbsv?ZZr4|;1TU2Z(-O_uCz(47 zc!nT|lL=VfSc}bATVa(dkslF_DJp;T|9y#WE#NvaWGWta5r&@VHXEMu%#`}G%XlI%zivMqeas4X zV3cH0{QY#Gu@SR6Y}l!Nd;8@8HT>ApS7_HRRdH9@h1C5sBteVg^+I3zIcm!UBkSCf zLKzUwH-1U=0{?yc*CWEk#Ywni{gYMGdq=8!@ZFyGbfLkSve~yvzY;c#ldI&t!F1=c ze-Hv{d7{p^=P;vi?*`W3{b=S~|HT%S!3tagO>lM?7Tgw#^B~?%3*23XA0NO-9_er9dY+(Upl5qL_^_P0FfNWo7Xw4R70Y?*E9-33n zJ)t#AjR%LaBA;8|6#Czk*q4mDN_Gg*dbEpP_d!rLXXvt4N>Y5L|&-@QBL?o`FMVzXGIgNJjhbELf4B&rP3 zK*NVE+_(92@R%Yr=xb`zugX zCM6f^uG7gsYB9#Kr?QN&w%9Dp*wvo)*{|*!9+R}mG4PO43az)Y`%IwNQD(J*|J{zd z5#ZgG`RltyRWY8t0AG9zDxIMYw79u&I%-qXM^`t|jlTnCw*CJSN==u-QthioZBiqjX%uk4C1&{Ufq#XejwNO?y=RWuSejd>>pgtf+C z?l!$(@3-MX&O8L@panMgvn!}Q+;5U`ojPf`?T@@auZ;!04Bib2to<;rP@Umqqpqba znBSYbjBbnW@`infk4B9hb#WVR6RMg4klK{hiL{d3`xxXyb$6WykGl5f^8JhBTiEY4 z=Dv$%F{qwin`fsiQu1r)eF$=7hP1Hm-EDTf2A%TZzrHpS#+)*v}p0SJ9|(j zU(V-!N9YWBzG(wFOmul}CbbHy>2n>TL?3!aGLDPL{e*fF1N^bJX13Q}WPu-rt^_ps z7%s>SK03>gU_N=SC}*G|o)7jwT30cRTGvjtNI>zbFRd2e1^Mi7;!DacIc4;C`!Ek1 zyfDT}9HHHT#OP_N&Cg#@UYua+Z4t}`As}=pAmtf8_=$O(ELUNq-Km){t%Q`q5&K}5 zQrZevUzjRZBg^}pL;=AfuSqxbR1S~ zd~qISeM^d(zOtY3kuKPI9~z%lmzrBR^}X!i$R>Y);*#G$tyteIcLR^_Ffps zXcSJf>HyV;syyb0W}^47GGzUBJn;9ecvdF(6ah#GUt_2nOu91`f1zE`yW0EN*Y+=e<9m*tqb#q|1~0*43iV$TW?7U_eofOGS2r*jm}b(3A=OHqLjKC z;r{zgrGQ`NtOn^c!rN>i2$J?8UNpP6jHt^%Y2%~=J%;teUASC;?YDR_%yIj)y3p?2 z{_jhbY1C_?7k7Jq?Am6qcMvSWsB4e(8ytFsH!fHl_ASzOZs?lU#ZyNnf}4I^Fwq-k zt!)0KhKgrn)L`(WceTwf>KAI((xedhZrDZ+h?6isQ3^jx&jOBVww1?298J#>%H{3(oY{FWrN z1nr~4OS^ENI#*SP&i5x_4r)ibeoJy#tY{D_v$zyE&rpU23%h|pfAAg-3`yzVn;k7v zG52D#rgtpAg7AOaa(jT&CfvhDXJb2Ea_Bxh^a}b<6Bd&$L*lcf^46cKvChV(2qR8a zy|ztEF@9fM=G3lw5mKF3WmQ8>H<+Yb7rnc%qi9hm`FZ4%D@*w-opA$#bTajv)c1hf-2kDpj z3pkh;qdBfme}3aa(fujrDz2{chGw63fvc>0G4Kz1S$g{ix<3mOY-^4+(iJl* zJ9%j#W7aS!>~m#xbkt&^RIeoStD-JRt5?Qd{`e6;dP?BlZi20w%|je7CxCtSDvp5F z{k*c1qO!_7#(1%8{FuBDQ5^@5R?<=%Q421|>-9TOEwzj2JF_ccRY^n~eAqbJ;W=aY zV+8lG4sSdE&Goy0Dpc?3PI0Lz$JICdR3Qi>OFg+b-&Mpn_R`m=SHwX=p9J6iYFOswWxHe~*Q5dJ`ltuBD>)4;By)Nvcq z#6tH<+)njdHA747=aBegx=0srKxwkVQx&6g0NugqP{?!qEzkQ_{(0eyT*wUm?{TnG z%s0K(1E)icGaHZz+x@4f7KajU5H(`I-^50IVLHAo#uPF~|2zQ^>Gn}D2h-pHDA@6w z)Lw9Z^?#MZ7n0^Zc#n8Iwu&hE9K{QoVg~~DD$fmanpx!8a1{#Fb2V54VZ9IR1B*%a z`6THNt^ck#S~edfi3fWJQWSmf={wV(eEz}TOQ9d;TUURW^lVDncmnR=@3VsT@0wFr zU|YM8!bfJ4rvFj<7^0K&dnh^p7rc?Q`phTp{*7c{UpU7p`8HdznjJQ7LMOgtytupi z&F3(2_{dViF@+XXl?tNmYe+3)mBo`ZK^?ZK4$FYwU~)@f-16$A0mxOSq19F#zflb# z$dV%?3@RmmT0$Be2spm2jSJ%{Bq%DNj%3<{pBe#zQS}q(PMmZkqGma4D}Hrs_jtZz zC^b(<-Oc&9CmwX`($;7*fN3;->t_}FFY3`lh6z*H+yG1i8&|l)t800g>^-g>Ne+}SD^h|jCe31WA#nl}^QOsKCh8pXe=@~YY10oy$W#Tk}tVhZ^x%>Vk z(hp^;`EWJT=k<@52D=8ztc6~6c(kN#o7GB{p%2dMlXmgxX*|z$If0cNN$eI!1;s{w z1TE~DW0ycE03MvR$~6C|Qd0Q@w!dVH+ReJhv(!l z;(@1M3Ss`W>n>3FJetll$_Pgvyl0{sjhcQ-q)M*3yaQ>+kAaW5|83`qc7x%&IZvd1 zN6+h{J~0A2>3K3S0i+HiC^DfHGl6=VGf5S@#Te$F*9IzkSW% zOF>O6OW^&o7yK7w6$Sakfgf>F7t(?OUchx+R%+R6NGRO8YSYZH2KR-9fhJ%RxPzfL zbv$MzmaEE1_Uxfi_Ce-(JxF{k573t_K&k|`>=H`8=h#_Q2}{^d{?)}R>hZ<>SEUs4 zm!>`!X4^&Vj(QXx+VB$u1Rj-3X=+PC#Y#rCE{{bf3`|*sl;4vu_y0L9nb&oC_s6MQZ{YfHK@pe^*y`H%SMD6rQP8*S& zuM(cl8QpUAHtqt5)v*o7dNw254CC9(lR&0rBe5a|IDN?6qyu(o^s$DVrY>k1)bMtXYw=`EP%`B9DuK)QmoG>?~ zfD>Lz7?#}tF4x_24_@8+ehJ!Y-P#a?j1nJllha`eq^d81wp`EcQ8(iQ#uwWU*y&(C zXb&Hxdvc}p2Kzr-eXj~o#~Bs$=KKBi?H`%1P9+g9OZkc<==Y119~f>>bMLYLmh)(` zKeprgJ#GH}idB4sZe9Ag)TK8jMAZcV(~)m842H|7LIF#tube8=wQ2*~Iu&olS@Vb7 z&t%{zRDeE(xz8+t?Z{KrPV$Xg5#qw`q#@gAySOeYzV*7@-!ma6#Li-@QtAwF58tKk zzzI@DajN$19KLwg5srycHoZLIT3RLPqEoQR(E_diVj*GIWl}Sgx%0GqZGuQHTP0j zImW{)?Sj7#k{ML;dj{=x7F&Orc{zaV^`tNf^=qp@GZ}aP^NASIy4@6zu)0hf?Im4Kb98Sl3sor} zXICKrxmpPc$t>>gReGzbu(^@$w{!AzdCZFAZ^jo8tgJZN&MNI7KA1uc%#s$TGVfsS ziVC}K@l0Upt@aZ)+DfPiQ9z~FbKd0rpbRlSq^g3R+;~4!fYg(??84Gs)S??Ye+!E_ zPi%9ByhgByrkV6+Li(EF0m!wMOT28*cz^y?d6oSnTuW{vZ$#JgF@*?h2!H&UN;EL$ zz8!^5P8>h@U(U%(t2)5uhaMfhQYH#3=bA?r9Nzo>`|!(7jAr4Wk&{un!7lFe6;8^H z7{1+OJe%-DhY`NMQnewMp??;mYRU%MN!%mnIKepW+_@=tdgGpHm8t5mQ>(X^aKCAB z1>B!4M`uI*DF+}`r^g-GtT|(=@A|53)PDVIQ_aS4tpp2?UET(|XW9dig>M6Wtz&kc z8>Y4F3?n>dYWMteg}Z&OPANtX8mt}VNmSzs2gk0|XAh*N<5KEIkEeg>+lXvRyFS7* z1LK$Bqc$t#(q!_W`X5x0lU^J&ewcrGeR`7sJ1~h_hyPQoBcST{T#7-*N#kZB#IuI= z!E>uw1e*Di9ut6IDCLDg>8j?oOy3pqw2HSm16+$4&2lT3iBURU8X$XI-H7c&HDz&j z0^fCdKKd(^IQ&l?y$t_W?$I~RP;va{fR6*EJr9n6?PJ3i*sTT7S@w(>Niz)1O)55X zvyOr)ohzKHYm&3b&f6x^00h_H--oK`C}JS)az;r(y@kONJN=r*1i*;prJe-HmUOrv zr}}c(;-z+0W2L{|;*^w^u`sx4U%@%DEK+mnG(}+U!3kQJ2mZp(Suytf+a$}a-z^cR zEPUbWP9%Q44%#RO)wQX7Vb8bY(&@M(keBW6UGH-Nb-fof2tbs7J(uME`kJ+vK<=>@ zB2YF3*4}k7+f}>nIn;mha?808a-osFD`~LgM(DQ1o)S99u2+Kqg9k}RtV_zzB0%~sdZ&@#{cg{XaLc^S*#r>|fdWlF21rV^d` zC9iWWVLwmy)5OaD(F3qJOZsa~-o~X5+lC6?{!<0sS9@~RKFK(YggmO|UzfG}-pWWw zQH=K^#O%(erOQ)BKikRo0RK4CXPu@=((9iNSU3j8;JrF67`u&4?wvX)AQnA^9=ynP zU3_vwoQG*28YVXr$wSH=IIIfR*eddrDPWN0k6pn@BX1IsU^7u|vv}LnNnBY1;G(C$ ziR_FMG0v9wNH7{c3M~mc_0n8-;g(RPEMq3zN8OLjx|ObGe#Z)8x&bzOv5XEoIg8i$ zow`?i$`X{Cd4;0D);5oJ1>z5x!)vQH5SFSLpUvW&5N@K=5KZI;5vH2jy3U3}15591 zXfDOB%cQsj_r^)Zc6003a$->s3OUJh7H%4R-nes@+^oh@K@_=d(Hip)f5DvN^2Ra2 zmElPWjwm*F9ka(8+tk&kgy0!s(!JFF6aj=%0+hp4e64HAwS|% zSlD^!T&}qQDDFvEj-(Ujpe8gDxBx|4GOJN16ZX-*NPoxF#AeG((r%->o)m8$QYVHQC&pRDK(wlrK5u zUvVf3!iNXf)J(;ECG(HU8sH-wx^TVO9)n8?4xoGO79<$%!h;A-=sW!8?s-mWzU7+;W4A*vV)B!Uwr;7lzgK+zr+4H z&8WEhag{PO6;+LfK+Q?}(EUCm`->H|2QGwaB%U>NR)Y_SMBao^asPkQB#T+XtStGidG zlCj3VkNU`L63c)NeJ@;LRu`!2G3$i zE}bqZC4NQth8WWQw{Hd)4?$o_pnk3`_41GU$B38AiR>jEGk^{!b(;X!^qLN!XI(hI zoTrLyE|r08nw@#h3Hwxj7Suj2gWm0qBk!SLcS1Kz$1C^EAC*rjR1dzh!%VHesnz8X zQTFH&As67YYxna`Uda+ydCBitxgdr4=Mz>Gavuuues_%STmbo`y|PxG!bJ^XcxhM|fALpy&*b@q5Z(DKW#wn}D*jtNce^(mJ4 ziMxAJe{dlu{~28_Fbw{SFu&o`xX3qo7>pWx5}PkBXfyZWxtNhyBt-SFk; z(V1EuILl%Br<`}GAjG`aboc0aIA_`W{?t0SeiS00hk+5P{$ik*4+nf%(#Yoz;k)aV z(VSW^|E4{eR=EoaCXlV5Jug-xT{&M!vF+++(>OiI_Ab=ab#%oOK^3#_5P09vJUpYQ z0G%x^eUKaY%Je?0zzlYQX*FVbf)E+nm!{gJLF__-32jvoM-MdGt!Q>&$6Pup2mUa| z#x{zc8{1BsbhcsRh9lmFJTPV2U}BcWW=v#|c{tOw=tAq|#*&2y4Hd#U`rjj1;sacS zEWAHGRs&W=;&u5Ca=JLyAABGPv_{>5##>eRIx63PPL+>g2tb*)T2JxNra=Csl`_tZ zUV_RW47`X8CN-d>HReE+l%$+{*qgABD*V&)4#hJ|E2<>x^UkX@JDS!f_W?Q>c!%y> z+Y5_yh6=Sj_VZS1@)qwcEkCp`DLYWs@8l=_%iDlud$tvHl;RvWA|K*Rz8b>Do#er; zXN&Bb!M5jBcP)Ms5GP|siCqzQK8etGd=hbfd;a0nxt>&~sk5KWuAj2VY)}&XX=a)7 zG96Q9iOgjvexg}QxIR;{&vmTSTK*^QL^YWQJRU|nJFi)#Xbfwd5BA=&Y||2mnRj!~ zfZV?t9etu=wjv^d7#c%HsA#8tNo|Gur=nJ9{Ox!$*M)PaC+zGunEdp)o@gvzAgCR4 zAa4>cXQa8ohM=F5KeoHep0|R9QYLyqyFlSINLE9N(9K>9|B!>9v!_#F;ctL^+ZDY| ztSYI7%eqieH=%SoK^2q>bN9o#%rygIy{P@}`Lh=S3z`V(>`UT$+M(3j->CWavNs<` zWykKM>WI|@+9+iXZi9-0#lYF3Y5G}Dp$Ya*ZsuVc&5gWd*SKR{b2kOG9i%EZZ*Q|q z0XGj@j?8vwnF^oK9LY9^k4KffAA4EhGL3pSN!y`?JAGnz4nHsq55aotkMaJU%OU$%)N2-~?;({_DBh;k^o}rX847;O9O)8{*_7KWKV{+6vO0*8rKw#E1malsNFdHW+O5f z{%zt3V4Va=cXKaODt0+5_(E+Z>2op3coP73 zGrk)01~9iNFYXYVF%lC@>3gPX!}5THmd}az6@avuQHHn}LE=d0iwvTT4A0J1yPKO5 zFko%mo#3und7wL5mhHf^_)Y5qjqTbopuOE=8{m(|x25u^=Xo1-oSF={qlg)qvKe{m z6L?S7kk?J=#dK9kx}@cM?Rd_8u*BYF{_t8Yv-Dp#=0>jjjDW3Hkco>|GnZjo7I`~i zcXgw&E>@5PGAc$vgQ91v*=Zp&C$&3qKF#YLO3XT?`ofxt9f0**^WTrrk9fGr7GWmJ zXWT^H9ahX1C_sZ|n2!UcTaqT^Nt+DI$s0 zvzk(0OvXdx`!;l)84`ZrkGiMQc`(~A^M+fYB1v^cR{t?g<&(g=iE<;sU1qTDcP}BK ziQG+rn##jJc~ko(Z@5PkGlr`%!DYZh-k!UBN3S0C$zBa}S^IK*SXkVQ)k1Q3Qi0O(6E}=GD6ujcz=(vOJz$!pqaaptouahHu~@*-0wTflGR*IOID^$ z2TIBX_Sh)8r};LA>yD;ur=z^Q_f=dyOMEn|ew^3Ghd&{VuN*u!984o@=LEFBjffff zH2}PO0N!;kRCdxKUmL_8tCgX}@7%<_G+#>~2O*Ny?vJltws&{9jDCo~TVPO}p8(8m z`;(wnz|puA;^_Y3{=Y>Ld};%m#S^}H5XbGF3{Svy=R^sZIMszgYq(aP3ETQ3Ogp^V`+V++Whh} z+XEG^58SJ~g^^|0DWtVOmG`2e>2A!Y|0&SYIFj)*Q}a0Uon89ZxS+>`|!kXiBCuwBQ~`aNE07CZ#& zam5b%v3HL7EzjOjKRRZ`kR|?08irC}(ybg8Wv`r9r(nCyQ?T^b-#XbGWhc0c)gqj70TI2}Y2z))4 z;J2G=Ie2lbePzZ(yxgcPe(*lj^o}lh`PeYLYy&%s!OG4o8MSFWd(EyduOaAiF8!uv z9X&X#Vy?RKVqK}uMB~rWq_rtq#CbaR@WJf;Tdy+1*-c~Mr9t6Zt{NYdV&kl1xe%?{tUv?=%wxvP}j<#Js7h2~j?#YT}O$*oG z@{rj$rz_~6NfT~&kCSeE8GE;&dZ|A9lJd{Cmk}O>{Y%IF5;2z}6@M!K%Pee6?X%#$ zUN%%~Ny`T`9%Lhl>H*zM`C4JB3LUJ1#^VY4jUTuzWM^SKb?9!Z%6Jzs&P04@m~H$9 zgfe~t_$a{OxHH>Hn_5gEJBC6wPT08nrt@p}yesIJtRIYL-@m)CWOX>=&0riRd1^xi z{E$0P8y;g>k0PHuiEmJa!d<3S{*5lg4xV@RxW?_OPhWMQs|||}D8#QBs#@pf-7rAO`K!&@t))3l?W+&m&bG3g^H{V0EW{LgD+!Xu{Izx~s=eX`7p1l;hg9Jz z+WN?VSt7{f^Ta+Ky2B}wYPzE={oVCK7Ix+wc*y9PgMT+o6b)*Y4_WV$i&@Yp4&NH+hVsW?NQ#EM(%9$l)+pgd&8nAZb z%1b^Xw9ZdbiGohuC&{MQA*WXN(`CO2e@(0a(|lc}CDPV~Q|-np86~*kw5IePJZ79U zZ_3(n(zY}!!NhXOC)(nN@z=I93*(_S>l)7(eBe*t`!hIqe{{~A{Q?MQrXTcdYg3qU zqKXI22A+N~`B`4ZZ#PrM&Uc~=Q?>%r4h_$>Ape3C_LXVf# z+jYW#(e_6t8|O9qyNq|Abxl}m>prrGW4yw>Y~_g-@_{DHy7;}_DN?g{ukXtDJkFEe zd#P}msGOM%Lo3nMBN#Ryt7y|U2m`rvL2Rw&xv1}M|IG8 zer%gBT7xmSyV2rmE7|y)dbXkQEze%polfBCg#IuMaH!nrS@?=22%^82zVLLKq{XgM zEPw%ScZ!RAn_QszfP{}uu~xa|<;bKB`Cr63oty`)w`w@ycy_B9shS&UAo)jc z>yB9SsPL3a@)MUN64%3)r=VQ@;pRGOpo6mV0j0q{p~=llhF?t+$Ah`;-SAF6yv3&n zOTK>%AXS7*Gx{2}d(iH!Y$bY6+ns_szmFi{yS#V8&~igNhMq=$%8^_RnqmgCBSVQo zCqb{ukHCVpT}RGqZvG}#maM<(A&5d)7p`g7!j&`@v9Xd zbg;u;L!&x>$g`j`)Vbh7M&O0tY6EFr;8YiTa&`j8Sc_L_kEouJClqi`$FBLF&>J-F zjE!DC$^Q!YBEyreizPTo8u;&S^3=&pRbp?wO82jyE4FG4YXVt*VueF6C-lo#-* z!|*=F{m~sMN0FzcA4a7tB?C$;M!K9lzZ?!-Qt%`B3xBA8$r5y?C+)b}v4@7cs`@VC zD&>nI66$%NHy=0P?UwX@zgrxO5qZ5mh^@0!t^cv4?~Foq-v~cr0*npTLW%!zcAIay z!O^Kkv1S_Vm>$L)d`B<#EfNw%e6B;Bm2#q>koc%2bcPG}!j|EDnrJHFw1jNh1q;1P zT-FnW>h!pL;ESAe+|vxb*mLP;StxDLtSob3vy|fqNG=yP-8Szxk@0I%q@he_rJ9z^WkW64!!7Rlthl^)Vyv=q*fx5w|IMe8?;=j& z{UON7_#UpAD`wxMnI1sP2yGPlVY9i2iVp$QY7n|4Z4Vr-hpAKGg$nDuD#$*K*)N1~ zp843AIRgR&@fI^>c()4b#|QUo{V+-t*MEc&ysRne!T(bA_<5d26;+M_bx~w~*G}fi z@)C`K%#r>+uOpro5A^q_AY2={XyAOp$OhIo=-WRjQ*CAc6n-eQw{O>ls$Y`GQtPN} zslWS&9I|4*&irjvJ~c1@yPN4d$oUxVlM6mppqDwkLHQ@#j9ly!NCW;W@IL=BwCL*{ znsC|F{w*0c9LYL9+`k)FXV)0fsuD2C-f{G=uj`_t*MgE2RGzCH{7M}syFe6x>eQOD ztE9X(EAY}#9)Zjv6mVwG;W}{AbO7NACQrj-QeJO0u|Er*`+T;r^nA@V5QeS`OR;k~ z9~Z^$R)#`O1;pL235=P&i@T0b>(R%mfjI`%6wKBRF}p9;kVFHKj{U#*MpQ5c__r-l zxs1#Nlp)kqW5^^O86K(DH+hLVo_uS2L^h*$Ni^`=>6uD~=3B|Pq{c^?u6)_^($LwJ z*(%wxGpp`u?Oh?)Vr^GcRQa1O8baljGau<5!d}Q?+at=;1h(i0!fti;f63KNe2{9} ziDQcg%iomhw!f@(<*n-C1IRNNaOgry?<4M2)!2D<;@n$o(shD$jyU81qVsdsnGB(x zw$|8BRe~yoO{@U5Cfw#x|<8jm|{xRi&TqLxzpa~J_Kg1 z#wlGOvN*V1X>IFAGp9Ye4jT%tVAa)E#0$tR7rs(e$At`ZD$LH6hUvfwzuOCgT`J(n zd>so9-1A%8L~~FI{k}IEUbP*34{&!cvHl58wElCc^YOl*6RUkEfc0-&{>)DX{`po{ zBY5A6;i;fI3;Q@Qv&Ltf+*w|UlY*7=5rzS>D*$nRTohdLP|omYqHF5#AY%_uYhnG zSSRU@!tc;CIjDO@a3^8JnyIWhWuKz{r1gGuW?05JR!FGEtow zwb|S?L*pYVQU8HwjhsusAWIitl~kAI>n?BnA#W5e{szdFD;GRvX)VvRLboN&LSB2} zJb*&;?vGwVOzDF$6;B$fI>Q4Z)f0XaC`<|L(VS?!{Zg+>d?$VHsLVwO@~h_$q}w$L zK}X7{)ghNlEqL+IHHY2mz@Uet)ug4cm5sNHm5p4ZKzYd#np}KqeV#h+-x`(*qvpxS z;?C3UZWR&z#x(xrIt1_mGmMQr)%XuL{&r>UZw!$>Wd<>1Uv+M7 zR~r;PW@f&7p+;QpQrU0tu-2gUb)Juh4h${GBk@XD8N#`dm=nQ3Oz#htFHC?$?m#qn z19$mDZob*eOxz=_3vy9}#WL2*6s>igRRGfPG8hRt3LTaLm~lAy8BH{NL>fBWpGv_U z;)k?G#@=i^?HS7ckSGYLubU;7lw{(h!YbCRmifrDRaNkWq#-1QMCHxb23xM%UCyo@ zOarY%NB>y>?b$n6ADtjPw+;#INp0tY7ISu>p4pccMUe-G0xXLYxDNwXy$)EH>b!Wu4$Tg80F~|cvPaU7(7n%mA+NRFgzYa(-_TLbU#ge+<~2v*(cyzgg9dF@Z4#aOB@ zvxabqYEVhueJp})RCmc)}lt@hsa3M+JRjs(&j;DCp~ ze*_{W)rMFO)PA1nIUc}z0osrroO)^NcL9)7j)*2Hq%~$EY`d{OY7g8b@Z9h6i$L2o zH&Ys8t&3=6*}4qxS8;G$YdFF^Esh+4$1E91M4B{#Qt-h2cUiH zvBS96cArHd=>BGp@Am9fsZh;Ux1LVaK7UASgYnHorha6|MBfoOtSK-$HBWb8lfUs* z)dc1)s{<|gmR{HXXTu^H*SzXY(D3L)jT>cqF(pCP7iwGf{sc(uHu(jFKiD%oW+dND z`U8yK$+xA>0!-b5%HBS9&z@TR?yi~-vrRqWOfB7(IHJi#4hbqHAyese3usA#F*jRn49{l4de7G4rTN9_q-yx%+$?q*;@DO#Z`rlZ zSxEK7N*N_eJ?{i-cW%8^2OxR74(~je{(mfeX*|^5`}dh)EJGn%q6RV6626JZ3?)lK zA_|S7w8&Z^%S=)BB}=7bR4Szmm8FuA?1WZ|jGaQv*k;V~xlh0Q|EMRuddc-U=UmtI z-gpnnrk$S&gA&N^YAn1ucsWagDO&k_9fJMIT%R)ho!o%gp#EI!^`Pd@izB3bF$<^? zydPbXd9d9uPIThGCuPttVVyupf8{d04T&a*a~Nof@}W&5ncd3O(nEX(Z~9JTcO$il zudgfY8}@hY^g-y{j3TD+QEhnt{YeK_*R1mzUlE6+ z!tuYl$V$&uVVlJO3w1z@PK#%Hx8hQv>Anyp{Z5+4WqKmMdLvB+$ZhrEYi-?ykeXX7 zUyZ&q!kbR@3bU~qoV3h+TzvU1jpq>u_SD!fU4rkV(bp(YK74KpmJ}Rue)xP#wM3Z3 zhv`wzuQg7u&V})hBsk*29-Vs+gRzq9?38<}d`x6>x@@5aizjr%d^z0lPU%fSBZQ_5 zucaf~IHGsw??5_pVAkr(gjbVnn3rmU0biskLX-{Yq1WUbB$NF6O9Y8`BAz@+J%Q^9 zN1!2nvSlJTXWm2?23^V0zRf?RDdX?#WAYH|-c4xSeX=(9%Eb<{wd)+c#Ti8*OjBLV zVLN?(VX1aSFQ*iez(%Y8VW2=&?KC8sur2>!Pf<%Q)t}p7qUe8TJPxC|npfuBO3!;+ zYu?udiW1d(nkU@ac&A+hMNj#pf4+8t zuaq@)+Vd;sMK^Y;!|$%oP4(v73syNp##uuVo_8~qxS@B*4|BeExQUxQb%WfzM0|$k z+_Ul*!=?p&kLLVym`&R?_m73&nKwCO@qsIRq4Qd0v~i|Tu^TS*(Uwmbpt@&O-}30Q z_X&~yvaBdEm*#_#BhFt<_IE1fFy5AoYCfG6hx><|g#ZyC^$-KIBSOxIWrc{%kMCbi ztme*T(HFWQlOUcayI+t@rO~CKf00zJBC)NGRQZ^1H4(4N+xT_u$Q*&;(YmdE+V5>T zm0P0cvGh0>_|9EKbO^k~U)AEd-=dxcMlRE32pH|AxT{%+F^bq=Rqr;ItP9O*CEymK z90%SL?!RIr5TNW7_?~+MhF~D+YA)i`n6JK6%Ju{QEXsYMNkfq((Sb13&vzC9&G-e4 zu8lV3YDi^Zb0Kf;+S&l^(UY9P=MdKT{lGs{{b=8Ghu=Oc#=SeXY3Byel=b1u_X*bR zb;q3tL{HwQj+^_vI|W?IUJ+~rm&NDhWKSr8q!&9HRQt4LJGp~6w4^J;>TD`U<;L*i zFx5_H2>@0XB42I&ArRK76;iA1DA!he6BWoPzR;}t=CRJYXN?;cwpHPWruS9A`8juC zrHzbRZ(AnbSDO;F{}tnBNrhl#Hs)BJg~+BHZr$q@6tNuFnc7AWW8$nSHvilmeo2E{ zdq~$>o|G(W<+qcMUx@Fa+KBVsMS}To{HkjFzm$XF4Dd!4bo0o+&*GP(t|F>p5a!K; zc8KKB-e#(}+kNPgcD{jHJqtxdzS2m-Pi;<%eC%Mb0dsfM5Z9(o3TicSR>k#Kql=z1 zPWz6Id}%L)0o%N20GNg1bY1i0Y;w`hL$jnCn6Pc7>+%48KRQ0`=fpQV9 z9jRuLG#HqAXroh3F){ufP`D8k98&=2BScEfy0b=mBDW&R(&Q|IMcJ@jt`7?i%*LxA zX}tIc%;)K%VC(W(7JV0D;7_X1n%yXRh2D@V0z|4F))1f#Msjk+I>^6YqP703LP?$S zo!n7fXsII~bf2)f_Xbzvy#d;usxj^za=wzEwf=!}#04LT|ID221{2?4tL2ML!=qcL zLA%;3wX&Nf=)iI}bG6R2=cg};67$GelPXlU`69jPxg$-YZy@DZY;#YLN_Y3+XWuf9 zP07}_DWa`k;TjK);f~X_k>m|88(uInF1NdR(MyM9pyd|S{Th_7gK5j~qSH>MiwXlA zG#Wdl93fgnBTQ#13YyL#(N>fWa+oyw{E`kL13eYs@;m3R6Hw#W7BLJSv5h^1z|)%^ zh&}7&GYlBlt&^>u-|;LEGU!*k%6J|X1c`KbXd@R06rLY)07^1UQ|q$%hdF3>Ue3Me z>BujMYD7qu>4TrWAm-8`2@TO58gt|#8T1faB8-kq09(YQUx9yC0K$kg&uvikd$RP* zy%}L0WQ%agf)8r6(eo|@k&1lscU*_cE~0$6$kK8Bv^iHYv>@z~6YTMOUlF#o!?VfJW2?%9U+fL6ni+Tvo5 z_l!~elGfB1PqR<uz~QN{EfCN8~a|b(3`w|n9L3S+;iB+@9dor>KZ~ot%*uYPxtyU z?(-~kt=QPnyj|9U*cngRg#Kc7E>A0L29hZ@CCbj8@ybEGzidAo@X4dZQqfEjT(O$! zzONzJ^ac>GTY+E%Y2&WYqOwP8rBph7Px{ivG%suxyDf~GS06-Wi&&vF-lxXY8lBtZ zwJvrnb;idlINi=CJc#%for@zxZ{G%W>?2vi7vJ&ZmDPCb-E@%kXtK zq_~@}sS_Jm1RXTx1B4p{4lvUbn?w>FGDqc(Q7?z;@CDL@b(a+4@bs766;6v(2nSlq z0cc@)2BjME$>3a4@Mn^6Trz_{qDN5l?N=JDg&b-I7QF8!6A}cv(&V2Pm7L!z-e)Ad zdqvA0)f*&DG|h264wKYu$k)=I-w$3Vl{-Ky3i@!Im@N#<{1Yw5fv0kX`(yjxc~gJ-jP*S`8> zdUNQ&rA(cXJ8rM9X-6!w81mr0SkK+ky#)v_M!0YxB=+f?h>0`#=o%FX99MKf0_bV$ zti3%jc@YyUb!B@^>&tnldEPTFqQCTK{ab-*nP75f**^2k{Cmwlm?(i_PIP}<6m*s0 zjmC_@^EWSt6e|ch$P6v8pU}l;QIxGnjS%$y+r=cSBlcT>{;yTs2uT7Q6=pY8suP=e ziw5VUgl5VFiX2gRE)Rj$DqfeR_^wm;sr{e+#>%8t(R%d|`#hei1USfQCmW^kptfpm ze^LX*Fb}djc+nax(Xrs^(mFj11wX5ppFs=Xp#SIK2r6!%`2}Gs zcz9F|ekZPr@;a;w2wEGs9VR`*BDq;TPG5uTF%Hxq_TJ~hNGelr;)@5D#AqH}zJs6TIGR_T~XT-=O% z#^GXF`*qCAdAAxzJnz5!bpk1dG{N7y5*lxsbp zWbnJ228J%+mv#8;hahov=T-$El1xr8(kd+Jb|u^CpzWBVM^`a#lZ=_M;2?Bo$orn{uN?#;pNaX`s41B zOsvdwSl6O@+#P(kW`NB1HGdwP>b%?SRYeVP1HdGJ1p21pSed6Mv#NJ2ZXj8i?VZ?n zVF?jd{4G7M+gnX6%r14{J$N-xu}dsY#W|0hDdkuqKg}wvC}l>pnbrI=w~q?=;Sn=N z?_Nc`1Hv_Sm~&MPPkuOXHU2{Qc#MaG-)9Q2PSG4`G`K) zBSUN_^o&p~Aeo*maDyfR1`ctr+;~e$%v}ype^{5jj&NK(*@vOJ)) z{L%*$-4)vsrgL!$UuS({c!)OANgl^sJp%eLh@{%s+9qGGW{YI}cwTN@U$9YEtRhpz z&;VyX=~3dnF-gWxTZy6QD|KRB1`A&D6@QLk+v3d(=?ndWnZ%26%>1^I<`8+ZO!wjD7qtY58&TAom)W9q*VYBE z+vRujoaShX%7fKHs|n}8a}GQuwc)w8N;HMAC{-;eMS~9*N(>%0LpFIZMBL*uRqQvE zT*$@MJ)}nMMGa-};&q`Bh;1}$5e^P!Fcvc2Ta(0Z39U=S)@GUOi@wAgM)O&S^ss>BZkD)X^ zw4_b-UcB5%PIt~Cz=f51{Q<#~lqGHl8(^(gcvE{EZ6(vCFtihgrb*GG1=eVN-U!r%` z;?kP>JzH0|!<3o#k}b6!C}MM(bEbwB8S!CW%= z;!NL$m>8YKgRXB5*2e4ptwqFi7U3`E2g&gIp;ulrTPALQB_%^&eM0E;SuodP8)r`T z07L3T9q`HvxjNrlMLw&CJ}-sN{Y)c5@a!>*3R7dad*c%6$39EJrp6WnZt&^nUND$M zxNN99v)M@k0!Mr$3}xAZV*4*KoURWv4vUGshpNKn*PS^@<{H0WqA8gVYOb{!YWjt8 z$=G+v(Xuef$pq?l{M`kYvt#j141fCOpSe>WJbQt@AT4Y4M4(0Lo9tLj=HZE{n?P5Z zEnX=$@6SORo3#cHNq~J%MxNC273fsmVej`|aLo+BA`z_rX2uX1J)SsD2m3W^oc}a?(Re^Fg;0@n&JP(f;H3Kql-)%mT~488v5vgFzDV+x*pf8 zaY+}+nC*YFWB6JEeTSN0%~|MDD<)2McESQT;rhF1YH29~AB_0bpB|8h5a5C6F;ss{ zmU2U{QlpAN{R=8%Hoy%9EJptzSZFnipMT6EUr_{`vXH%l7*zM-Or@FYxv-R1tf5u1#*I z$BzJ3(B++b4byz0qd-U%A+uu|c*4IKMdjjCaQhew<)MZ>nD4k;qJ?d2>{jSL-tkj7Rypg>4#{2e zxA#nh*=5&AvRs3%Dhd(v6bmE)P@SczP3MjtUC`5RiA+g9Z3A>gVp=h%8|QPP6=S2NR@I5GCNFx- zY_sr4qUVxTHEQo`AW1J(Y8g#(%!qu2BF6W@RCYA$p#k{%@7xuA97krBkt4$8=QyhM z_J%{jLsjJYxu6k7+2WUPf_uPa94P|zpXaV1XN8wBFVRG;75vh#x}g~dL{f)q>^Oqc z1r{)>RuV%g6Pp+1uke)d$WghWQhu_y`Ff2)n|JUR z5pu&T#faG?r4;BYp6P<2q~qs_Z6OUT1DOUvpy!CsAJ;`})=tunrifg>Qs0=o7QO#I zxrs4nDD@)y?Zp4m_jRm{>!AN@Gw?^%2Xk6J2;PJzFYKGFDJ1_DI$!980^zhc`6BG0 zmNNrBDXKdH34W2!YuDav#7^EC$}Zef<{o)B|3h!Pf6St$!}s8L@0=LvY6%ZyhxO6@ z^Fg8KxrFl9CLG(C_6w8?V`d*m8(w#;M6(Vr*KY6ql015+oJuIz_o4rsN=Jp?72Z7s zwB2X5yp;I3H>@)WNDZwM^^8(Y-cOipJkeCg$cjb zyp5^y>jZ^?7|QTguobM&LJk2>9bt;L2+xbK&}91*0B>ICTXG7aZXuX04|x)CM_ZvG zlH)idfgT&dXndE$$F6E=b3|v?f>yF?G4=I9;Q5A6m2o9wAev<-kU0u&#Uca=Q1g?q zi%Iw?!qIx#s;3iRYLY6ZJ6UbXgBiMUCvA8+=Fs8oIKP~y+`)o`(>V;M#J9oR0-tgEfML)Z&sBmRf2u z!eShAK8Q{gQ^h%fo_8!n>R&jy-J@IIY?)w-YlByQzw4v6On&cP`ou9A8HhwtQh_DO zz)48ICgoer+j2K8{V!2Abs6FBO%4~hhM5@c_!x@m(qzT_9C?;*|2qzQG3M#66K+fH zw`+s6-}^j*%%^1X@dbO1==Z@c7@hKS@{1*%t-=j3>o?(*q4MUQ_vCcUd!tFLmkqH_I%riAe-HuoH4VkfDvcYPP9jltPUTYd zKk3VUcGa_V&DxAI0|_v75JQ3SbJ2!yttwN`eE@po(YcGF0zP?u#Zgd=CVp0gIasg7 zdWsRqpKe6_a#l0<_gq#Gq_n+*t!@?u^#83x!#{|hsRP%^A(f!0Sb%j9SY3~?A#>?% zf)FlY3^G%a6+y-rL8I<|aY37@rl8ZIECu0FrB_Q~U!sVGawvHwZD1?NN@BoWkTtYz zM84lRYldQ~Av8Tu!c2)9cm|4Kr>BeoMPqRoHNH@dY?17+dZ+8^W$7i4>u1e!YVc&# zo@i6N<)P+PX;S#WJvdN|6Xqi?sMs$)uF-Oshm+do9aW)A-l;2z=zWAy{*p!Ixu3x; zUfig(PhHM(;Dy-G!qUipSq(e=w*TF_KReGemA$tSs>ZZwIj{B3thM@RYo>~@IW~xR zb6~gMK4zTe)^ig7U7!8!zk*dmYI5oq*cMz4wVga-11`~d#sO3x-d#4sOz{=kyxOSu z;Ctp+)XU1s@T6IdpJ!0@6)KfLH5G(T$LwyZrKr!uk4;uIS1j=lgCsxwCgF5@mg-mA z#;DGihXhJzvcq3(sE!BO(^s~P*M9C;H9S*$AJ^-%M2E^QMO4DPvBQjq%L~H2oWQ2& zc0&CI?_2hLBAzqY^>?!8#5gS$f*6!x;pvgM1_u;~tTk0wd{}$j;^>`X5qFl}_PX@< zDt(N`p$}WoSMx+eoOsnD%4saAx9cr8%(ZEevo<63A%$S+OcC8rxL-=5yOp*Ny2lP{}+o zH#OqASjr3FMlX;}akIzaHba(!c-uo~Jdz^H@+pRLv5Bq#0ucvPz3{I&^m>2#admRz zF;so?jTMEO}1swN;ftFk9Nb-$v z8-tk*+no$EHjd#!U1w+%bt1IRU<+w3?>qI0IxMvu-?zhRYi;79vFGl*%FDVJh4-;x z6cg+#HP^n1%E=Nq?8*rIKo~+L$Z_e3k<%>~+s|cx?*6(yvm>h98AFL+N70S?bD7Hu<-n_T+{v z5yZ_bw8no_k!-pQ@7?UJrwx5ExfjMZ#!xbUTwRq*YvOd!^LT-x+=VSByi$yA=0XA* ze2-sQekGPQsX)5mGTFl#zYFdrcrZn`Ph5>efxs(+5dZBr6^+}}6V!5fsluh&!hJEI zr%!%u*+{T|n)>l0WwM-rCnvS>nWSbPkqB9pfdj+^2cxo_*_Evz5N7S6DeogtA?BMO z;`ZQz_%~S)s-dLAj2JA4#QeMP78A$F5COn~)=)RVR+3$?9m9EZ#EF_q9-fh)C|4lT zLEeH+;Az1I=X3I^Fgb~u6<#j|-2BWrnHNAKdAg+B*J65^tU6B6VKI^k4-y3EQj$;! z2Dl5`dADC>$IC5tB&icq2#O$%Z{V|NTeWcCKE8BbYH z3KSgW(-v(g7a!6UP)F42m(QYx9^)|-`jVa&28i*5bp)zo3<+@ERvvf{q!xQrkWRpN zGC`n@)8mNZS0-7(k}PTxnkbO;b$Bzf_?8Q&%C61Lx*Son2`|ytQe?p#j0ejxW(K5u zrHyo>OglD?%_5~XV2C6I>wWfM#lBp1q88F>o`c-oUw^muo&? zeFRp`#~inf>4uPUVjswZ8W?8?iQ0ro#m|f}g4%(&v$qFyTm@nZLEk2B5v4Gc+&{80 z&+KbjNS+eiA5}fNq_R?Ns?mp^M{RqQb68|ufl=1khZjYogtkwb_jC~Yu;95E#jj&D z*>ARv?#z7tZYeKLYhqvV9x{bkmhDua^GMIrB`uW@Z-Mtugg)yP1(Ui)k3W6aZ`Sba z#V7?A`w!ZT7rbX-^8@a6$3Ac%$G4cj^Tb_YnkH)da~Q45)t>}=+2KKV(FrZU~@&U@cl0y zD6BVnm+<^c*WJHw8?0pR$%A#TWVT<-3V-!v+4fTy?RQHGx;_DqV6zcucnu9>=Ba$; zF-9v5jNJvhQA8L7H9*qhrM2-Sbp*+<`l6N$#6J=tP zVa(cB8hC{U;wv&Qt?Ose^?L+4Dl1#Apz6oT?p+(zRw~m&Ia0Oz$0c0{+)=>p zuonD$_V_H3t~SB-OW8d2lf;V5+h-7h@Kp<_C4_C9NIQqyeLjl#Te)nxf7(U3=q;#~ z1_@(0H8@k9q4{_gi8(@s($H$MZ4X<8EU$CKC;}H+ZcjXbJ2$TU2gN@_kZ=0^v8!(R9raoN$T1% zWRg#ux6CT#Zp_)f{j!tQ+B4oNUfhh>=Iut^*#F9~t4fIrHg7lF^w%#oJaIM;|3LA; zYo}8qXRQC`#_9<6q|#ht?Ixj$Z7d;zn*Ya{ms)EsV#&~-B-BwQ8fnjD4JPPta)Nayln z^;p%>>{6zp5*A3V#-|y)cz3Mg1%GY+zT~?58FW`*YTZt5Dkco81NiwoB)fvvx4`J+ z5g^8K-U)%gu}o80a?4L6oFY7-dBw8stjro$5LqKO|LYK#N(J0r^eeWg!#_ZwNF9vb z(Tu%n^%b`Td|jrr#HCKwn_vM=0J~g592w`PM$I-NqdVw|z-?;-t%l$Nul%|~Vp82m zsj3ZEuJLLyBM;FC53Q@Z@wxDLcQ%7HR`A24j8#otiJy8fTLQA=K6%K!CJi4!5trPJ zmc?uKysR;r(mQ`8_PfGJTK{hjcj*gnpgGj|lzul%Ixt82exBQie{BA4{l59k=scY7 zMu8ML_4oHGiT7*6@&@v8%u4>%|70MIWyr8<;++`fT=UP{Q=$WN=c4Pqqv85+z)2l?AQ9zSN(ct=wIOtO#7->0NZbA zS+QZuYpm9|Yom}$eI^6GF?DN0=JQ~57fwp>w($^Pw=)X7`4MmxrjPWQupRg*y!eA0 zTc@)$47hnwmh}=1O70Uz&!C3xsZ(^JuTaY*dXWWH7ot$o;{lS?!Mqv1<^oM??!`JnRu(2A8OMa{fuKZPq?!4Zg zYH?|abZ_J)?Bdf$Glo?5c5&XSA?dUHg}I0QgwM8n?Ke?M0^;_Tt-#iAb(;vSa?a*I zE9fScQr>@QEzG5@43BsMhQjdT4mCSy# z(~*SOOQ9%jef+ZSn3dLjtsYbQ)41#S^8Hh`pQ!h)t_r7ps1@(JyV}p}78+zkW^M`6 z2VZ$Fm;HGB>yrw!NLu!((#f?f#-4r`^|C1}xKDio!|S8=rlEXLMOeQ3(;?@`_ut|k zDV{$2(k!$;PODROHM6az8b1;Af*@olqgCwHFnaUvx*=0dZc6rOH(Xdh-F1pZehhq} zSihp>IUn+u4!|2%IDvN%rTUQ0+^06JIEE`|Bg}j1f|~L>X*316;=d89j|^>*0QgmJ z0M%X_GB5LRzgD5ja)(G;9K}j-xy`KcUGt%~$=FBAim$U?#!qrbS(PA%<8I9(G_UY{ z77q%PUgcylu4qC4@ue9{ft!a0S@#LM#rX1$w>)Y*pu*?;w@vVh`Op&T6e#K~=HjOZ zkwmLMvrBFQlsI8jozpApX`(dkr3*mP>oe2?R|kLI`bknM&aSmM}q1unZ7M;>cc7j-PThDAMj4CXwqq?!9|a9D=e<{0@N2(k76HAjU{5%|4@^HPqi9LQyc@1ZMO zk38*h@c`{UZE6e$t%o*c7T}SrkQ;2P9_LdH20!7#9RC-q$<~U|#{!N^{m<{Am0gVWS^H9te?>_A-;?nT!ZtE$?->dE_V zd>OuO@`M~;>CB*zD)Xpt{V#Aa#*$i889e!sHb}q9i+{q_I-b^1kuu@mg!Rl)KaOa!M9@ zw&dl|KsgU-h_4nz+)AJ-0FZupzBd+b?wZCe9P??GvT%{O&K-cmU@8cq-AW=n7gL4I z+<{-;kS2AC9Dj2{AMN;yn7vwpjoDxQ`Rfk`@<{k_raAfB{skt&E;W`rVmA!LsS7`IEP{*XRW$!g>v4Pjm!zhg{ z-J91dF3i{N4ocmn4?G?EQSh1dj}Cbb75!Y)&=s5`_p0MUje`Q}MpC3%OOBFo zUdap3(-nP%(#IhR*Dw2&{gy~*)aFRFksT@-6Hc=mpNdh!EAHwcgX9sWJ}0lUtv}TT zrTQa7e$M_gm1ZR%!DQ^u)ZD(T5i^~xw3Ivdnq~2?y8Y#%%ae`28xIHwtxGa0h{*YA zp%YtR=cDlV=Dj`Sy@chHD9XQSL1+0e@V&%ju=5S-SUbo;Tme}D-0pLRkHwrLM2Yw* za)>{Sz>C=}Kvltq%U)})@s(J4N-}RZL?Adyt~{%Dq!@b4NbRgBOE?u#QloMFXkew?h%_IUBRi;*pG{ zHKR^rxZ)lhgp6;Fla|uc)XDPMvEQ~nq#omB&W(1PW^-mH&)F!F#zK=@zqlBd-YP!y zB=M9-4YGE((<_-Xk~!ATR}1a*K&v%KeuLZn%)ZcL^J>Izf-cnfslK1H)B5|=IcX7$ z`<|&oHA)+;$evzDxF@^!a>uN&f@6pK_~5vyOKed`s8V)J5@D#yS9gIEyR36O%~%f| z7$}9j9NqWHwhYe~hxm?!KZ^J))Le?s9d-UoZ6p68Z*btDnrbL|$7piLZW`KtWnR_V zB}Cj8+wj?YYBjU9Z%47$=G|vq;oBNQ7tvg`ZLC=`2afC zFL%)YVuJZN@(-RFaf(C@T~`O&?m>Wd3I|M8 z|L0Lw3_@1FLc`!TjYHyQD-okuI1Eut+n2VeP8_6Ti;9t~)Cg3q4P5zGF$TydP(bW8 z>HQv#*p}}@LfX)CGiRFHVNiFbWk-xWQJlQ_YF)cPGG(r@@Y8X6;~xld{dxK>hpc*B zWSAC$s!up_rGa>L)o1k-wO`i<@zJKvkc8Ez;Rf{~`$>(dP@t^t4W^;NR+za6uOXYh z@Lh23+&tQhCjPi+2^SdI7h@*r)3WMYhE*=7?)un!osY@q+Pe+^^VhQr^a*;tKP7r_ z_*l3J%JNuis6>vB7;WENE4~9yuU46*o-?JyhR5QZ&kK;FLw3&Eq5|M_=7@bi`1U*H3uaL1-k5Gw2H>c-x9WIXe3;viXJBd^J-A ztVT2sl-Nf7(ZbYY}~3DX74kKhnso_^5Y+`s51zN_q}N z9xFtdd{%Q$=3LRF?CSo;OiD?_IY^O6QQAXpZvTepBF5@<$x%VFgM{{x3r3Isc%jf| zubg51*gVGm;k^a;`Wyw3zg9&!Bpop3q4Q`+CAgdoS#TK8xubPH8a1qNe%88}Rv$(i ziu%S5xSv2e&_uAmS2?>;ZJxnPzrhneiUdBa~7@Kgkml4mZ$T6E4}xfqJRg z8lLx$>8#Wz9JhXP2@GgC5q;fhP;pB5$l^YZ)Q`Hf^tZcA+A4LQF*KHSTfz$Y7@cqG zW!DYoh_X?EH|tVbve;VjNfY8rs#SEB`!HvE;1{rbK~)D$h}C)pqC)`FfCj z(z5&0G%5dQx4)S3H-L!}m$+8)iUhQ;dij+!vAaeBgs;I+By6COM?hAeLHI#|RUX&) zX$=80wx%3!j=w=B7@SI6lxpbKeoca5TVc8t&Tr85cy5Z-fS%4DpJ;jV^#?h;&40c5 zbkIQ{cHxtLbbYRA-|UwzeZWT;JkTKAEyVy*=^t`|mEipc3=paiY?#jM)d%dVcU1#( z0u_q%ym77_$$HFj(1Ev6ZPm7B@ul~j&b2J5gvNz{wv0?aQ>V&Vw`32)l$~9athcIn zycss)7ap_{>TCb}p-&z^v-R7>hQsi9o7lHZqvC4}wu$}s)4@?oFlFnV$FfmHq@d|( zna43ce!$j_ndg?Q<@)H3Tk0*5RYtPa#3zOGp+(K>{(li9BqM;^<$#n{XR{3}ND`HQ zM;_ixfPwMV?;sDqg6n&#Sq^z-AJfBgQE$(^&6)G;f>M_zf)%5Bo2_Qp8y*D2saf@il9elcK&Y$JF8hGKVbdNhH0xh!-fbaQn$gAx*PT!N!;{zY9<=J>$z z3!5vklG8hW*J<(cbXnI^HGdumORcSew5$qu>+5A2(+^e_-ha zS`s!9sQs@k>sAdQHg}iTZ~6V29}FkrKj8`G@K2+B)me$LqR{lj@a?LBzhJEnC%-z` z_Z8y?TQubIuA(;b{fC_2kuvoYerGDI)1&2JBHuGGWCKFulv*t(=KZX^Y9}q@%pXZj zt_ACu#JPK_2F#r&n=ON6$Fhd| zJu`HF327jQK`S%s(qPGBJ6mdDxd+m0TK z%}m)*94Q^u{-f<>B}71FkU|(-hMvqC5$L}fph32w7o;HLHH zdT9)pPvXVPaUhGppZ-DvVO+3qau6u3S1hk3#J~8ibYxkJ=lyz>umwG~B2fFKHvk!B zPAo-8{m~@92%=a6tZ*THT@-6ACHTQVq|?fKzLae|C6(LCc)ySzc?gcR^%?>nxCxSu zZ9Z-y_;8M#6^F+P$3rgI82-f&MZG?_uc9w{hQOJ8AwY9Pbp!=BX@dCOOoq}pNgiZu zJ4Uifv6QWb3w!?Lta9 z(Hm^H&gcsw?MVHCAOE`9I+^1Hhj;qIk+>A#CPv(#1SB z4&O0nW4Eg0EI_+{9|h>?dvowJZJ2h@|LAJtJ{O26f2T_SyZv29NQ6mJ_+ACRiJ|ti3^o8qB|r<+HFOcbG7! zr>oaP0(PSSn+Ykx*9q1s1Q(Xn0ftTB<0PIBJcmQiki$gJR7Wba5Cc?u{Tl`v!(^Aa zSHajb^~~8*2O}M8tIs*UA92y>OTok_Qa(-^_D?pXO71T|n83JQ0IBaQ#qSiYAT!Tk z;ruAlq)0uIMkhz&m~mk-&6O3_BRH!zGWyA(&m*>FFO~uE+;d0@Z^v(1LW#4?{a-FjD=k6&#G8am z&7exQ|FIr#;{gzPM5ah~#d1=5GF>SP_4E4#E>4hf(!oAF3h1+Q)>!di$6~xOE_x*IZ8wV+C5`%D9^jhd2p&)!H6^&m=bQ!qLi-(4n zY6}sjIgNXppEvgQ?P*eQEuwuEUoijlJQ;clHR@)K29zxPCp~FOP-Z(0FWl~~Jk?#D z)O|E|?p+AHW)DfWR_)KQ54yvy+g^K3Hl;Q=tSrnZN&Fg9dB1>PkT&{`k$ONO-ol{| zHSTRae(KaP&Qu$mNB?bEMk+3*2D_>dyA(C!k}8<|ZeA$QNp|otab2u~%I3^qqyH=B z5QcI@m}uVO*{|A#(c%2CoEFvjWm^*3{DL=W7!)Hi<2|gkX`{Ji`FJH~=WqOb1*rE( z1(}Lq+1p&R`5xSg7p!f%P|~NRHZBl{?UTrnzaH#US!DVwGCB2!UccHu3-?yxGQN6i z*}sH#qd-zEC!9=p2cxPF?m^XKAe$e8zhn7Lq~`SwQ#2zU4>xhVv3B2A3uOVQ=ba|N zF}4I1~2op9y(8m z!r)x~R1gI}3~$Nv2Pb^tMumdSL*!_yRO#!d;ir|u{X&U^*!HHy%57g z*t(CCpEIJ|3EB;ea?7-RoL~%SKA!NE^iZ5o6-963%4E?nk65_bt-p0HIJQPlPx4dC zg$uJQ^q4Adcb?4Y@zM^BGdRBgEzjdVaKUMNE@*IG&v&Q2Tjd_=_9+Avt3tj8HSSd(7AESZ(Tv(i5&?m2aFi zTejR#i666N^mKjoHr8L>)@_qpOAykT>n6gR)(-`wrax@?2k?rLB-k*tYb#&4PK07E zA-Fa^Qo0&oLs`Cyy zZ77%E>asw}bxlgHUb6F{(e;~*i@qDHHErsTTVgZ^SUr$M(wzsP>ce9CFo5bZbxP;Q zJ*Xj%b6k(WKs|_i5L385?6p@!$8a+Z23XJs|JB^!oMByL@aT|9pq3f5ZDi*&czW~^ zXv7?Wm2{Od(o!2u;BCIqM9w15*eZ|MPt2A37_NaTq&@D#9>jVDyVui6%TBBL(mNji zCHdQT$~NMk(i@l(exBE8t`9l!s$~jNNoWe=Gj&oOtG3CnpOb%zs?3dvQl=-0kS&j( zKuATfGj`MhJZtrxuEQ{AJ2&fPDrf3fKYkTDId{1rWl+FKqV`$iQ)hl_m zbjpT=etopwZ`QOJh8wSRV1V+Dc7nEF7Tx~1-SC4N?{)fLu-gaUUu@w1z_Cql{2HLX z4@Kt@f^S9~6HyyYRB6)rLCZB%EL)5yqOyW86td3PcK@1w!ZitSSh#Q4TkAiLf>~BI zcIRAxm+i;!gr?pYqe*p#LF(n)m4G5BYd!#y`jG>`bPIaD!oqb$^chrr*z5Tgcm8P^ zuxBf@X4}o(d6^&^^G(Whq6mcG5%`Rv!t7oL*e%{|HINA(upS?r@)vaZKu%YdN2lmN z7pZ?G&6E$9JS#o)n8&Jgu>AQ_x@ReW{w0q**@FLLkWHTNfL62Zra7z(k1OMYPgqn> zMpn2;3Rq4Fjm)#5WL><$erutRxU(hbmrLjFBt@|P`Vz)Xs~*lTm}KtgnYf=BB{^tv ziBoN8grU zSPW+D9~4k;)vnlp?8rn7#>fSfugXh_|Bi-p4<`_*YAr__F?U_mJ71YzKU-y@_*;Ek z>O%uHsb)7v^nBo2TJ>1<#R1gN@n3Cv;-S@K(1v&dP=HYI0~hpJf^IKFvg=DaY0r3I zLQF)sNe>kj&S+yr{U7835a^>+1FK zEUDr}WR>tUM4SrM$vRGu$ak{!*pL-PgD>8JXq}q&FC6x^?`nZKnSyar+^dgRFnbsy zBa{_UA-zp3j{En&-TZ^9zMDzs`V~g+-ze|2>TyNu=>!ogeTLlHsi+A%H}X(5^`8*n z_tA;JHPev7@E6;`HqCBs zGaKFhN|YDxc-ljt!>pIgULhH57MXCr( z#0l^dKkL|agaJt^ryW`}=x8w)^(zoQv4fK^@v*^of)Pk;F?jxwf z1+-ZK0@Z!%6G!LyR-Hm!pVH}+_I_#g!H9wpZ8js@Mh zPPZw8L{|omCoFx31FqH9((B;_%x_JMnlY_?XGeI@=)>$FGn=&N$4lyz=#pK3(RPlD zHxG=;YJOTOkf@n?%sU9VxyIGQQet15C{G3mufhB`eck`w3u%OH4bZtP z`7{48S6zR|py_+0CkzlJPeaqPfAljH7+Zzo@m{XVkI8-VpjJ$px(i;kpE~+Rwmhms zZVAmLKOgn1J4>rOAtXcR7BvU6pB-{V`2aLMqU z@UXcm%Co^flIn!L(AhhI(G`g33z9p^lgnkfcTGhH1I*qmTrT+jIDz*Z{%2Y1#Yr!3 z2r^oGB?83^v4C|(up!opvfym@ql{^KF&bCyJ@95M`c_WLzuqjZ_hC(0|iq zT^%VM$IaGVMg5Ol#1s90B%OIYlCp0j2+&^nQ7s)@P z_!G-_UwyNJD|8h=vzs9kBk@l=&n;O0IpfMX-Z0lCo$8G{Gk4mN}v(Y8T@3no% zAw9@DzweXk>*Gt}zMYGxZr44_JJW7@5%_C=VlVSBVoA6m)}7;5544;9lDTiNtpodj z%KP=5P;kK-y#hgM!Rha{qQy#5^6Cx0*)!hOJ{%N*&hc=@qEH)0`zt;a5r$Argtjm@ zd&y)cU-Zy3JTl@7`Jt>}L3|3GI`UALTA^}(;KI1l-4($LHpIS)2jb;{)x`s69{oBQ zkr(Od*~1gt6g;<7$xWBlo59D?OFfGw-)v+uEFaA$6i6)U0!!M`Uz~D;xnR89d*tV! z2Ymfrk!3=Ml7Ej2mV^Z<47*IERsYr&_EjX~M3h5%T-~xJ_S-zdcffP=JYQS|Yw*yY z5U+Fk8-oUO=7(RW3q-AiX_NF5AvZ*E0?faa6?M@85tXqXpbjF&FW6KkLbm8uB^MqJ zqdun5bGh$kq=3=MBiCgR{FYZ{v0&{o1fcjxXLf3?4Af4Zz896gfRJ4tm&FX6nWf$i zKIQ(-R~immrGlx83;gubs{`#_kTB~CjSm7|s>GIrY@P_v=eF7g`WVmYJAOj%7*JYV zno)6~cmz4kP@~UEIrGe_QsqVqu0!z;StH`kHRgYhKAsa?7Qupql|3`_x!JtV>GvwN zQPbNNZLKP6u3*LS0t2(D_C{wA-tRDziCp`44WfpA=|E}AkbPkj5)(Go;t&(25S3c^3-gw?x zw`uZf!Eo}C<)@Q`{bQwo0}79>%ur8pt{M~i>gLc)nMaW_GjG*%AjxnlG-nv3_Za%YR^aAX!0I$b3BIQsXK3D~dN z(Zzzxioct@{0kQXye1k8Z`8ge9hU}LeHEuQk`go+rw+b!kSkAZRexDe%o!Oyomr;` z7k-d?Z1g|J7yNj~ z4maA5i}(xjP_W&7GLfB=dVF1_PPaul<{Jsogj6pFB~9buAU zwpDBN0E+s7&x642=MT*I5Ab>Z3R!Yi~Ir`V!GvqL@G~Ns-ZhW{qh3Wf3yT?D{D}W&u zLhdwgxB?Jup7WKMkoApN{|FT~^9;PTCNGTUPiVgXmb+ImR5l{+IUVtwvqO`WobW(h z(`{{HN=2~;nGOa(3G8ejmCnY2V!)b5ErnM7z{z1(5s8z?t$AC2z3nejLj7k#X@(cs zTjk%az#>sA(>v5O7ed)>^t&%!`2%O(ky9@k3(+JsK9SqgehkmE!LT7HS#>1rD!`v! zg>279u4VuQUKjoo8P@qDh%;$iYvZZ&o|>=II(Kk(p7eW)dqz!A1Yeckfw^-A7vv+jSS$rKv=@%&|_GZGEUDV|n@q&CEY_z-4w~I>_KW%Yz56?O4bC z&w#&jYF*%}ONX+*LC@ZcZ_vs!pmiEGx7>LhMBk2y==|I7IZzmQq-M+izr!pFeD_@M z7kD7r+arcgPFOnqaj(Csb7ZQ$YP(GrJI%Ig>X_l;RdIZ!nTd zTIVc>HK}K0agQb$C@z4XTHRW{%61$I>= za8%=kArKISn4|>rh7IrBcy{0?{zbO};|)@dnxI&>q-R|9(o3p{M6uhBJ^*p3FdhDt zW-hRi-F)mlQC%52APN;AdL&tv-dNJ*W@ME#l4q+ z^rRsNcRm&$-P1_pQQK)EHHzuD)s7Zu^?LcXq%3Ez#2VxU)GLXdp_n+7peEsjG$cg) zF`*$#YV2+6U6$Td&>vK#+>K0ppT+)qq|^Z^5m-?DCD2AH1iere*(3fUE%+ju;~r>W zC^6Xp%P@(~ss}pAO*MJ(I<-!Js>?@r&z$+o&h6a=1ZWDsQ*%tVEla|3OW;$ ztA>2uwbSK7=c(i?LNz1t@W9}?7B*z}(^0h_9K@MRZqqV{=cU3bz!GJ0DEqG87X%xr zX893T#Q?g^6t6go+bb*_DMH)&0BcrsQg4!fp8RefZ3?=h2OpDuX~YfF8}S@UJl(nt zxyu0R3|Yc0J5BlWnLM|vR*z-t+{b45>A;F^4W;EKYRhNJ*TlM%fq;So1QgII;MKSW zLO|hc4*UV6yW>#3|C|u!iD;6kT=uztB0f!ck5VdHkEqUXk9C?+aMHbN-y&V7Z z2t_eo@wE>VO?=JweFmHZ8QkM(>G)3<;fvdXps9DBpOK-mao|_=4gBI+-W?STLlbga zbn8V9zZq-vYJYMbI+W;5Pv>Y~=eK)vSFOLNCCq;}j&eNNRw)1u9(&(_W{pjU}(+5|@I*HEc z#2NA`r6$FCa)&0IkQh+H`N5UZFX~#C)hU-zV&^6JYqvU`w5JQkD8Vj7U%X1hk5Gh$ zEJXyWQ;%v3sDLK%&yJD|I8RNOM7w^Mn=PG%YcWyuCk0LbZrLaT>GQ0*S|!hMvMzA4 zbm@9wj?xI%Z&|Hes&(WC{JPY2fS{c9g`WMcE%5cp4$q7PE5L@%VbRoKp~r_S=wY|AVaT1Xpe?Yh>b?xDU^|tQ9K(_oI*qXO%WrL@3kBnfHvSgr4E{A}&iDD^Ps6MOoW>&WU?p2VWlVP6pV|ZBZ z@&WDr0Zd$aDWBD{34_h3K>ms4LWdi67+D_~o?+?;KtJFsRt&vY4DHJ+F4hxdxToRj z_dI>5oDi*kx}GTY$52l#Hs-*@Ow32os5qX8?laF)XsBy-`&@-5+dc3hp$ZcQc@aje zu{%GKLzn}vsND_K!rz(CB-D9_w0=0=c{^1(mSg`3Wu1~g1FYH3JSk1M^E||e3md}g zLj09NRviWx{*!4)iE}<9BlCso9*{y-OvW3(QCGuVdm5RfHKI~&1fqD6yyZO5ikzQn zkW@C*gdyd{Y5VP9;-Xv!8N>UF5^f4nAf`zz+b*F^Yv~v{j^*Q@EPwxo(@QQ)>X;2{ zm+~UU`Q_n<@Alz_k>BJHsonFucf{>*WG~!6Y+K=CB#ReK!pS4CY+uyuTjH9E)U<1j za7}{06m_|N>xuOI4;)y2>1kQgr3{!f9mc_8Pi!{UW|)+Wvz>=74!mkpz%Pp4g|&%H zm&b)FMzSBw-V1rozuju)z**-y`IJRD;ZQU!e>0T(zmS-dxSca9)jGcbC(EiU!hu+n;8J^;m0edW--9GiC z`PmJ7+)k|@$%S&LS4v6rP-C9Zsd1;P@*}^1{1z|y4b=?zv7( z5<{X=%At1lxm9~!usOY@K~!95Gw>xh9y8$1Yg?w^*1Jg5pSRI|{-cg-E&>pBoAxK) zPjKRj1}m2-{{yQD{|xgR$sHs5=dY4Hpo!B0QT{|Z9+u)Y?Fdn|UsSW}Oec|lT!5Cc z`@`Fj^s#i`4-u%okPo$-y0bCEr_mv&na}($K$FXaFJ6dl26+W2t9)z1A64$6cww3g zNxJ}KcuoL9%2A#lHyFu9Zav|%O8&GcYto0K`1~nbHh7&1HhgKqM=KD`P-aa8mSOa-}V_U6c9@`N_Z=O6?;(2#|A6rJq(ht>pM4GF;e(dT-Ye_Gy^ zwLm!)6?!Wjdkc__5-~em=$FlF2&M$7=N(sZ+QUEYT@*AgyCR(7le-dx%D z@6_&vDI+Ht*4yt71$l1~`(uiU0y@K$=I-vtzy}S1DnN~sSOwi*S8dlwf}8<}gq28SFRHcZ zd~T7LR(W-KxY?hwA_|?QI{E){pI<@~UY!r` z48hW=6gx)#5_xO^5iOD?SFN{+{)ZW`d;p5&01NRrSgxy3@mp9QcI?@Zu^@Y~^{)iV zwiFOOwp4)7k=?fWj1OXL!S^XgZaDqrz4On;=|Zuarovh`=pkcN%IUn7l6{n$SJNPgcD*|1kkR#oi@FElV{+tAfxql@Lk*XDvt z_Bl|&5c!AVefS_904l(q?t=}w7^DND7^yJoM5i)acegi6AUHD8%EKx3jzCm^-_r8o z;kmRez4thUEK2YL#ALD1By!$oJ>Yxuaq@X+RE0C|@5L_nZ;|rE9)Y?wDsbJFJ8h~( zp~N)e26{1#uRWAS<3%WlK!LMJ()d%{rC&^&6dub_KefurIu9gE6(Ck|(dvTXya28wU z5@M1#{L;^^wk-iX14bb5Y&Ha&$U>RwEANHQm!n_1Vs(I&tq=Jo_q<+q7)}U~^OD!a zpOX}!adsJL; zYlHw}kfyCuOd!j=vU<8Nt5Jf3!)Vos_V>KWM=3T_gJ`E}!^~wWivB06Ke*O%p+Aklzk; zzuDFcF6b(nrLnF~wJc}jK0JNPlgtWJP@a?vqWRZW=Jp{wiSBL6aol2PlJelN$A#`) zd>&Q?WEcJ-dfNHgjWzf?s!e4B-R3T|kXi~F?Q0LS97invDgT=%5_IcoidcRf?tCaQvrSF$iA1&VT-P9`Up4 zR6vSwBavmsca&!#9wzT4)LarDA%lJ0edTV!9$upKEZ+OJu!4Rs=`crZuBZ&CE8 zN(s^b1kX?wQsq&{I*HMg6_Y`lkbE3h*YeqDh@WLZ%+eWN=SZx44vuQLPA&h|+T#bv z@0qavwmxnI_Vv61h6*DBQ4LhCZhIiY^D+;a%@>vBto(A2;#2N=TzQ>XyG3Iw$Yw1H z_tKA2yKDXZd6%Ic-=1S$?qkGf>sSMZ57&9q=fEFF;GzJ(#E+X;;Nt&Dt#pBLa_e}3 zsH1S?k*G8NBKPd7`gtYLD(z}A(5PqmXl}aPQRmHBeK?XqrA#px?pGrWxnjcRS;nYR zLegGxm&Dr=Jk!`xa8k|r{kfvOdwnk%;Y5L}QR=<&Sy9L&RRo$qv5Fj|MR(@$?A1GK z`jGKpt__DwaF3t#)Al}{HShh6+9gpbzUDBBLR9vTST7#_hlxGm`mV)t4^ER7a<(3- z@%UqF5sSBSSHk71FFosBON?Jrw}N@$IPHamF1@kluA?8`)M|Sk^Z>EUhEVPRDhHmK zcT(m*FoV1bsIK}TfXtZMxa`867l>Lg+_*oOM!fe({2j)T!;fz}c8;(S9jQNaRocoA zC1!VtBKaN~5KOg#q3*#8wc{c6D(s2ZGuUrA z=sh_cEQ}0kXi(>#wVX6CdefDAVKhwy%Aa9}h~S3C`kEX!V-CvI=S4=i^&AUOssA!Y zYPik{cWd~;7ggB8iHpjH`Hl3~C*LhM;hsf&@L$&8h;@Dx33HA^8G&|>*X~nUn~%13 zHNxPwtlbc}J2E-pc#^-Z4&>dk$18vud-cq_ThErTe*Pn#gD1C82p5jpsM?y&pW()8 z?NpP6QsSQX1e=+`=8z$|2WWlb9=Mx$1ArCBvc zP+%TGwMGE3-d8@TXvd*8QBda9IrASNZV*p=QwS=WL0V=3oW@dGZBanh{hun47M|az zG6JS+8t$nWb#xc}kG}ZI|zE z;DVAbFg_NxREQV#jy(8sSt<+mU#S#oUqZ6MHS?V)WwQ|0;?`1A0)mJlGuJS2o{RJ2 z78e$R{c(bJL{hCPAbL z-BA@wG`8c39VUSs=7g=;W`!!A6wep&YxI>(ySl-9g;xXHo9mXTvzT2eh3{?@p5q}k z!)+so*N4dU3E`=4F5NleJf}n6z8Iy@Lk>25?4AQ;crQBX+9}oz=L%%Xrmx3KurL3U zXIRn`^MaUY_BBO{+Xze}4UW%okL&;k63PK$Ip8w-yh}x|gqaQo=3I@CvisM65Kqg@ zR4OfwkDff%xmIcaX=Myuc@AK|89Qa5?@c#dhxD{M`^(p!V#Q8QP_@mK4M8%vr0t&T z%<J;Up+I@|HIxW#)tKBWu{W2l=|i$5u>Xm9?X9pa^dY|i2!1#%AN={tAD9H6qCP^ zRR&C{fEM_ty18icDddwY_tNPbo=O+2q>;^k&+|q7%l}WtziT>^0O%cCOe@CRP=@zG z<X{w~8|sBN!yfD+p+f-rca zG3cREFX((L1?zru;8jA{U{{ZkK-Qhtz2+=^Qq9USm9hL)J>#-AuXj{?$@!l|Y_yNC zHxQ|>n*I*o(^uVzeDjSh6(`|O>I~nR_6&`R1*>_wR#0u^+|-+tHSOH2WNrTe?{Sk) z`zkDOe}vaSQ9C>VQl=1|*|<%AKC(K&4nXw?*9XbX$PjFtqH1^0ElH62ZJypyIX1Y; zSQ{M+49)zKZK0%ly;hWMbl2~u;`}Md{IS*+_PTyU&rx}=jiZDD0mwpd@-=9c@#h|w zo1}66%AuHfRO9A@?|r{v&Pu|a8wV0OEwL2Kw8I}b3OVTXZO2wazKnTyf>sYV*>wX5 zwDICEo?Tii8`WKWoJ8#1KAnL*Ee#Fv)(mY}d88Ho(F?&MYh`>^*W1qS49Ce9E@?{y zOkgF{{_MEx9#jjZ18-v?Qim5cgO>-?4FTxT(@;+g0E393pRVdTk5WbU@I;1ptdUsU zEtM<|trZCCB&$~Uy>5h0bjSe{$m8d>li^p#LgyOcX>KtXtl!P8lxluFzr!jFA^c!J zW&i6gxr|*O3uHF&kD9Dz?Pf;Xy+3Mq?R%dpuQv5{F!+JZgk(6!SDMN5jF7^4K+wbM zpand4VO<>SjNehL(Q;!dveP+Ldw(Z3PwTH-X`2+yng6KnK8wPSsmgLUhP()3>6+Ny-9nRnH&%*>K8ce0{s(+lLh)mD-oQ4IN$$v zGKoNG!Srm81zu$qa#bDTC&;avW${6W-W2r$fBf^az#Jcy9lDN@Ob%ey$l6(sy$Voe zKT^~7U_KdQKjldCL|2udz*6ip_y9DJ2pLRgwSbNj@##ALKrITLd&Xm{n)8>4>|F*6?j-# z`%7G__Nj;Q2Bb~No}TWe7JN`=rbVEx;O0HgIp{X^Gk3WLie1W`ri0*Ra*J-9yX_22X4=eUWb+^d{C>rR&&YWRAUPw1*tFaei1 z6_t&P+}V(uPHNow{&{t1FS;X;9dV2F7`={_UG_0?h-fVAskQHPIaF1ot?Z+|(#W08 z1q~6i5ADdlHa_TL98n!CAvpajgjPdUVIm<$J*s!x?rCHW?gCVPb_UlBwNHtw&csBa zO8WN-Kr7W9X~1hI(y89aF4&5P+uO*+_rkxX ztoo2AxaU?8!eP_pY3IGLPjU<;jRx{K(}@J5i8*3jKj5D_nSrrfl;ae7T;>>4P@kc9 z$%uF+vGngn@7CytuOO>s45IkiR+$_ETt?j?&$U|>fPx{=qCS`V=^J@+8%Ov{L)F#L zDWV6%iyB7`jxhHTSP|Qa<2n?rQiW!x2aj5^j9a=&6!qRwgJ%_OPx|HgY6n$Bs&UOV zzF&Y`1=n&uH?)L5+47t8k>02v(!`nIW^J{|kIOCRi^||zFFkFymF=OMb^&}3(^-0( zAUg22lz!P$Fu$J)!E)>8!gO&1YoLq8DMs#I-6wv`I~=QfYD{LLy8F?R&pXUf z+lTIb#NX@i3t1=?7|VV=fpnXMq68sRCY+K&^eGlf=d@ABjU=h%>i~3d=o5I=Vz7xo zxX@Id^&r%k5dS5KQbuoe?bo24*69%|2j_AWIsvw9e&ob^ccNx&nr(g+?n08`052gHO_Ij=;B|jY7M3PMIx-X zJtJ!-f19jV)1stz78am1PZC~u=}J?pcmZq%n>wR7<>7t&s4lcLEqDGK_zIy>c7ad! z@cLB8L^9mGYA-wi z3S>2LatkSy|4L*_r!DFWSivZ;g6_JIzK1dfN;&0DFQ%dse|%7nqESXy+Pc}Wq3!Rp*n-eq@dO`h zbsU}{d>lu%;VDqqoR2n;H#_!c6T&=Ig2m+|qZ{4e>Eo%4Hb^4SW&)3pft*+I1Dj<~ z+@uMTdj?UW0yIw@)GEe_ZTl6MLy{xw;vvzr7Zex-gKAA$%$?^&iyln~eI>VfLf^>+ zy6pnH1oN;ch!Ng{8*iYce^>dvp60d@n1mH!1tL_xo{9=bKp5RL6+xhT7+3gt-OGb# zL^XW!J@i!6&mXV}Q~Uz_6i1!^Zsb$4M6St|W};x*{7cjH?fl7Cc&}rz*+iKJM-G;l ziGw|GJ#Co}-Dky_B(q<$VBQB!-Gfv{X2o{qiC?Pnj(2JX$n11^4UE8^@PvIk%2gI$ z7#&4A4~y2RxBm?*b09{qx$UL^wJBhh30!97X@QSyfe87{j7o9Z`VDSK>$1gs1h0*_ z5-baPZ4=_P5A6-pH}9TJo_%iJL;OvP?xmUCO)csBUnj=4AK8xWR+=rxu>bj|7bVGk z{%=F@u4d&Y!#cB6?`HMVkMH+9k&jEn?98Ezs05cBF!*d761$J>4YbL?CkKV^l&I1z zyQnYgn?xR(w{+@d|IbxOc-%DY@Z|2aP#s7*!F)!wJM|`PVa-_{bzOCl=jZ&49e7Bo zMS2L5l$+|5cjXNAl>;}ly)55h`V|&edC!v$1T({y z#MjBvzr`cabKrg;GX9x< z|5iFCuIJ5afj(J`b%}6vcf5u2hj{cdEA;dl?Bh>CM;0~p?fN577)h28h)M^i?>fEX zBtzPabhe^-modf}ffi%A@4KJsLMHZnvB4xr z*X{q_l%!Z$C&azUE0;w$*N7Y;*wPm3$ltD5NtoeJ+u;OGMKKbeT%%H~Y_!>Fqp6>f zwnvMQT6u(yiz|FhHbO1#N%3w7besH5TBvNP7wr4F8gc12S-m|;1Q9cYikm%}T5s;O zld#h|(CL&t4*X2b-w47kx(~k=fljn$GHe;5?E+C{(tHcUIL?14#(sXP1{?tY)uLks zU;*HeB6D)!&&5)aS-1e-Q&5M>fiMl2{|ry8)B4-RPCflaea_RKCl6`9;87UhIInU0 zMImM(tjjxl5b6X0mH(;j5B1TLL0L}~uySF4eOxbQjCaKykz03bQ8eixs?De{!qon_ zvE_+kb6IiFVvKtoM_cbyl=?#Zi0&935md%$)Z>ciEF3RdJdG&U-tcD^{TuM_b;zv6 zRFi3&8%ti$zzH1O7#UrkRJ?ryg$|FjLr$Y>Jw%~Xsp5CM6!r{?y+=thZ-qH#F6`bc zoLM?qkgB^7wAukep{Th9pVOv!X=ng%qggc;q)nzaUHOOaOpxo_5eruA0`4#2&` z$W-mC^X}tF1nGO@*QNopuHg^591+<&PuQ9JKL59*)m~F1tJ4^_&evzD9WzVPhwsJ3 zZRxxr_S`|J-h3eOUEmU-Osd1M78@ZxGnP|pQ8ztL^Lxvyf(|9U8De4Z{49gZ2T%@) zE&k%Zd0m5}QylB~Sz3h*VyPA2w@V5fHMaKJ)e`y6ytg+he031HRXx<{v8m&_E#ttk zJ}&;$*vXK0RZL>dVTvZfiL}54$ij;d%|321OuC4*&*0sN%nwLXVR_6{5|g`{#vPgSSZPF1z9^(PjnSBCMsCxl zs9Sjw^NTuJ9MHFUk3n8{L(b&SJZHD!6Csb5FU=&yS*K4l3Y}N!BnK#^DiS=Aqz_Ai z(*O1lzze+pY`ly^0p7t-Yv17&F>|e-jzTYpeK!!rQq%hl|xGJEFs-aU85^W8pR z&{?Nh-FrIu>fD9tJ=X&I+5AOVxpsqjbi||PA4aZ<|EAm+@)>0=z&Xpo3ZVJQGXIm^ z+9ae}ijBLTu3*sJ;P@jHuujx(6(?VKupWT^9`5;gdipJ_+0d<*M|8*lwMfl)uv!#F zvy#J#KRWA2@9b5pIdt1~yM+^K25-^o=@gmc%IIjF>|W4Hp=C2O!mkUkIzl z^}5j`H`2Ic-53vr6729Z#U9vk;;%~3#7WGvfYf>J*b(2w`%LORE`3y*7e$F|85gdp ze{pn3j<2wwspr8qv2vwrZ*Y zujmcxBRb!8egG+p8t1Hn0`o3UGASi|yLlTk@Y#&+9w?@^MS0GuUzy(aZw)e1ou_tp z(YL~R60CFUp+;n`UoewwG5UBY%QF-RZdGw254UL@O5c>DX=;O?7y>~MU8cOW9t4;fDcHg>m$MU9}*e~%*DrpzLGqhE~;PqcV zt1OhP=L8|X|L81kUr)rNYh+-h+e_(03Ek6Xj22ll_e7GFFo)+&7EW?yqyudc?P;aX z!=;JPRmGaM&(x2&?d3YrDTAosH$F_COH1dTf3I%$vUp+NxR7s?Ig!wkc+i_8HdxuM zvR>`Ms)LHjDqVUnP^aQ?0F{z7*~>fE{x%z#5&038JV+42X^KEH&%l6_5e%vU7r-}I zTI7q8a#?M|&)`Ioa1Q1{+0EwHc=4eGV*O2oRRU6~kwNZ6t`!gt0)r0kO3(`^y>TO} zdA{5l>8D&nK<-`5IwI0;>CTq=43s{T|1VL z!0j4yueF5qj{{*T$Z0 za`kFV><)2=i~cmoepo7 z%GdGbqvoy#I&3lf6%m7pml)Mxy$h%>H!cBXn^98FTevQGYD2gg;G~ej)nJwpS@(>l zJDaHWH#)J|;mey&d^=KXy$?R!LzDu%9eOsb`*Xp?uW>G5iaPdQBC0l>p3WX7cOc_# zPFPtNzk4Go0G*PGjHJSHtNYkbBbBWrd5QCz%O1QIF#8^U+_SAXdXX z`7I}Z6W!8bTtun((s*_0M3pb49ZciBo`+>|j_mwN{Yhc19jvbHDj5x^<%TWMKA6hE z9NYJgWYdl3_<7bNDNRWKMmv-4Nv*|`)<-h5tqHu7vDPb9vP*@DI^1*pW3-@&12 z#P{F1Uq}tyU8;m@_u*zck+0?*cDJ9x|R-WyVgD zCEiyLk)hi)jEm+)h~ikz39ERxJAi={BdpU+f4YPbdp~62qOd;(1)}(Cl~n*#-abX4s^1BzSdOLM%)p##{10Ij(!ks z^R4Ym<8%m2%NsIW8!_G4NjSiNDcY7d*05U`BNg!lywi)Z-dyx}ZW_NssC@t1nICV{*1!Ffw_fiww0b8m{ zLiJPWryCFylWc#|`ce@heI0N0t;=1ReIKDZ1OEWlvBf=^T&zLN)Gagmwu>C3kFs!y z+Pj`x5|Mv~gKO|Vv1GW0&-13gFG4QTe^8g%>3I5xY6h*wQVsUZCpBa_rrWpMr?&V% zUr;znF z0B$qv8p4xmsX%S)YIWG7;P759aLuU(hjbZdak0%H6umX4QMO$>Yqgkyj zilzF(&n@JR^`g`?nFcv0DyOBB%|B0#8Bv(!>MP}kW!x9yE{Ureqz7yEyyOYx2~uLbp#vrCjgEBYI~e0s&mcCNi<(@J#GkO%dz?{qIxY$){~`Ap|DhYUIPEQgAJnm+)_$1YU@8?HAbMwh zdDmrVl4tT#=#VrN@`v8wxGfcr1;4kq3Qd|dABk%B#6@8%?F$$}}9a z#%lvo@(Ze@GgSmCE!?Iz983%Nm%fo7&kh-gTh`@9le}7Fp(b!;zlIxl=C_1j1 zSY#hz+ESbm#li&P1``Klz&xQ*<^obo88^v?6^M)iP-DU~@tzuL=celO9sykTWfNnuEkHZlFe}2D8O<8PY_xq^* zsp%W?LGSo#U8cm-jd4$|PZ|P)nq9b|>$uM6qnZ8mnWq9#j)XVW^-l>D*WGxhgwSn) z&*R6ji^P7oJ0$h5``w})u>kFI1u#PSlBwGyI=m(og#&pInJYT=R`=zentOhw5k>;e ztMJN*^Y2IW`4};I1PGM$3PwRk6Zx^x2uvlto06()wc z^Ft1dy(E_) z$@1MNHpwg#txjD09cQ9F@14`uTXV>2kq(B+tN>>vufdwtx=kNE(NqWdgrsd7ShwAV z)8qHXXFi;;yt~+|ZiNzSKiW+R)Pp|&5~28A{Ea=9Suim1{3e*GZ7Asu%7em?^63y! zbYo(kZNQee-?}GT`&5f_FfCZxLR$nvOBVNkotx<1#m%l;F56_+lD5wdcZCE=AMx$4 zolyQZ_!95;D1gsV)wC4ZYXfyNuy*VogZW8*vu#>U#_LT=bOW5PFl@V->!BW2!kJMe=q6ae8UbtS{W5mpd^9frelwySdfxk zGwM{&#%1R*B|qe&+1n%zHGpi@bPaNqz27N$cemL+f#lh>X7c@3t3Hm0-QQ{uPLcC) zNiX4uK2O%tQiIdh?9T6Mk*8R*=}R$rOXMELjkX5ZgxH3v#R*A6j{+tuEUE^nPgx49 z{;M)AFe^-fa6B?FutXD-7f+v46uHZ7v66m>$+ zcDDh2N4R$T5P^yqLSq>JSWgIBxxm${m-~NoqI%${{x;zdTSMN(#A4zu9d2@c5@p-R z>d>VKvMZDx9GWTayy|OC7ts1;yG~R)$u$;TufA{Qc*iN^P7YV+*HhVxBx-vcP9I8M zAe*$dm%)uCD>f2J_{)4tsybjd?n`HAtRa83j$@YG)>zYYB z9A0L942kP{%GX|2SO1S={bQ3uDwZA_TGFbba|cyeXDg|5 zE%JNSLg>qCRVJOUy;?dCE2F_tl3=T|Y#G4_*0>6Vkw)a1p8~z!Uo6}O-bMsFA<=Aq z0NZ7cVfY83)%{twWFvPz!kq3rtVR?*!=5?h;kxDgM~*GRGxx|`_Ddw#J`Dkxm;sHi}!kvp0&^T3|Ut{=E;7Z4)`_$Cjf0M9G$uO#Pxt~Q)_;SLC_^=bW~Yv^vtn_ z6pk6;^fq}?k;1zUm1E9sUv$stLMNUK_1$^f{I0m)M5U_p$dfHsVgXwyxml#!I>&G* zp<&NPLu;lNo=?N<5a!D44~t^S6i)d?TdIi z&8|i~STVUpjC`?&?~|C+EzMa4pya>MeEM{=_K=~@dsurCB~a@0!kcqEtQ@+3s39xZ z3k*Jucw$f8dKqr70OPAjP$0^DU7RONZX>&Yz|tY^^*(uE z#O$#70*GCEiRZzflU&Z&TMckmFQC=W%RZd!Y(3Rq{&*1q{aHmy7k+Y$5f{yP8Z84N zW(P7xwQac$EI|pj_>mf#%be}+2}zJ{c?Q>o{%#RWxQpKAgJcldn@3i;fP2=zF7DhD zFcf=jvrt{5p!yp!PJk)6K;tJ8ZxXltfokTufW_%81&fh?10@~rpj0*SrTKSiHGYLg zTTu`4mCTeaXjlGf@J*GufipE&*6Pj7{->Lt+HKaF;+}%Lm+3p5zv^YaZGNL0Bvqz| zi-Autd!LR0duN{I{#oZ}g7@$}&LnZG1)8~*Um$qy?wiUTYoYC~Gi}hBkXH^&w~NCu z54*!BVzE+`!>fm*85K}}prG)FY}VULp#GShsy7>+IM3bLDL4J+FA?uj5M%w)h|Ev+ znJ3W~n~Y6wDlIp+@lQ$pP!S6@^m0CK+shTv9Z8kO?ljsX#c*Vt0NwZI%A_y;AJDtA z=EbA)I?otmcXsW5q-=2wI&Y?Ms)s6~xse&?YMz?*Vb#Qj_sI!%He9R*Bhsh=!OQF7 zOn(*HI=mI;Ohnol-Zmx!f|WGF*d=K57gm!i5=lg*_&n!SI~*r{Ie>o5*N#s%o``jy z24dr5m_r4>dX{-ln9aE=rFN+ zR%Ntli!Z7dC`u22%y$Q-fa-T_2HHTq~|B(qZt*kDe*)L?U?VVxEaP( z#a;j@$TMAHH1M@!uiM%;1RjK8MwgG-P8t!X+(?Y^-)*!rH^nOQT5UMU66pR@bGBz_n^YgO&x$IYunqme(g5(0C}66@8wetjDIi}g20`1Wl4OjQe-DTwiYa=U)Zb2%QR zI=?)YA!;Um-uGy1C+FOsk)eL>ULE-6IFLK&Y-vB3woAu%y@R3%j<0w42Dre}k#o6Z z#g8XcKQ#}M(b(>#V9pzi0mVHzsZ4my%J8*PbDWG(npC!y|G9PT@1r3<;N%NEM_f0ZSoy0?xpR;j-0n33 z?tA|k?X;#sMIpeQ&ki~K`U1b=n*X~;r99p2SA&beaF(GZcLn7eXs~3A*O!J4t?VI9 zfB(4qlM`P^=Jne)ZKB3ADx^mHV+k8N8U4YOQ4ygqtA2fn05G`1Ry-$w0pG`k^*CB8(?lGz=s5C7C_%6ml-Wr;y2u zwGZ!uuKSpco7`|JLn>(Sg*YiblJ79hSbvUYtG#hiYaL(Ei|Ys?>vv_wTS|d|Kw@9u zCrx4@G0bqI?)H4yGaQ9Zc8bhd-w>LjReV_tK5s@SjxUEImi(1021n;iuJR;2?;thME>^939(Vy4+f?lr zwry-NF;Q#X%AS*4Zv@Ukb#6jGu2_R-aE_6u3p*Wv7+I{VyuDc)SA!PzG9UfhQ|PpuM7bRa1rn z%9-b;3)LsBQY&k|qtv?D?*Aj!H#1H=h|cu+qzaz^in(oH{TXIkic|Em@04}4L66RC zob;U>v?qE+2GafC6Y}1dMOHjX5GeJnId=BJpGNoaEh>e)?pbwV4Bv4nTlgwJaMXy& zAb{Bh5SY7P$C~I!D%~~=95jVP6q(oM!|>-%z7KAzM5XLXA31e8eTuVZsp;{StAck$ z!X|=1h)1f=U&QPVlDu1W(^(lQRx%V?!^vNGTP^lZ7P6AUCfhp@OGN&Uqx0~m^8Nq# z?I5eNS7c>mMDopuoI?~+vO0G-M?!<48DGM#IjLUBaT>v~_W*Yo*1^G$%pm`7cpIOP>ic_lE;$56bHfh9&nZdT`i7D@#Vmb%6&+TvG*ldQOe5z^I1Q;eo02gd^TE}D+rq;NtD zX?q^{o*!LUL?N`Ua{c|o42F(F0XAdcklR==U{#|madw`D0@2|Kd<-;{HOIc~_&#lJ z(z2n>r+=u!FMkL;?QU@c5G{3@Y=Q(f0U}BKfzm#2`+r$lQT`!iGlc(L!&j3fv1~}AZ3)5O03GF> zzk@WJ>qkJhzgqgJ-_(8)v50Kn0c5|1qqv1Y2tjX@{JY z&kW}H8!SEvM9SnN!_pYlH5+4lC(8TTPRRx|a%WQYszS9tKl47JidJ90&Xn-e2yNjV zTl7B|AcyXbcxu~9&NEpsbYk&)WOwmbuA|>!tdN>k^6T`G#HpWicfM&{E&J|3rWH?C>`&+L{E}@)878StH|rfpN6=hEl;s z&DJ6>NpVJ6dimg)AVZ2>JDKmvuBv1mV&+ok!>oIzqHH%OP009eTD64%9FGv%!)`o= z3y=j%{FSS8%MTYL$L5$6$_%oLn88GJT681Z%vdi#F=%I>d z>x+Wf7r5oP3nSH`lh+QS3Itel;N@`C2ir(Be6FM1cSnW|r;Lzh zyX;M4gUgTYaBO{^q>qWn@_m&NKCtTXO^a^gGBW3I8VGLC{nZj?2s3Ko!sR?mdiNQo zQ|0rSfvnNu%%7w&rK1_%uph?#4Roc|g&j>noE#iksFqHd-wynqq)xlGujTFXRHcLX zSRp@M?$tYD)ZI(9ho7jM*PXxam1=WmitRdk!0QIh7o1>hZ55G?YgdvUNes6bK|Qj3 z#~(nbh)+*%PEu=oq&-ZwXQjB4`|bA%UYWC<(HWhhCkQr!_-v;+hgJKSJ`ATFiyt09j7KR@2BweY+(}@(XXH^;a1)(3vRQLa z0IDq%G~ZX17<3qTD&1-X2HpHI8c^jr!6OjtWB?^q2__pgFyTrFV(AxF@Syg4n;LI| zmuNJt^(#vQNU9#}UNLgFR?IgP2K9GIR?U%nCiH&c|zN&#ax*{6*-pw&?NBeQ< zJm34W=!L!6>Ww=sO6PyE2A5)59tI)&4|*JUVPh&SRYK@!=?uWUOc*QuS0O(^!Z3Ap zOPl7sj@3kZ4cE@w$e)&P=>^AYoyR`QX|#_a4--hA4@DRYuX}-S{A?2ASlSahXZq)n z^Ir2iv(@vPX|q}pNsPBBr2&i=J*Vn`(9&K^NefSSNqe{So%{??&j3~&xjA1A7ARO$+1r3cgM0)guj&oRSxSEknb`JmMIG4mBxHC)veSdbS#}(+wR=Y;{@N=9DXrOI zp>+5;0{X=-kYWn0aZqDr+ee@Rpb*KRmfrhH$YlVuEs9saHzeQ{ApFxfvONXDuCyCd zr1ejTp;m;&A|G8enq%m}YB5vAva4=2K<|s02OHAKNKUc)=aU{N6ieS^o0e=4d9wVC z;`5a_Z+sk)>x7wiWy71}qWG9G%1qds%ab8d#64YfJ_^Udx8Xdq`Do;8K}5}o4Q+|u zm`XL!kB}oY?~l^G+xiL*MOjBhbONy3moL@}=Z(efg+{W_Q^6XwdC1M_Q3hijTcU+n z*%BD8eN@HD`jwh>v#TFb>MzBpzy zSH!`&*YgcU?x{!CWU2mOM{IhtlE%}wklXU+UM|v^*0N}9Y{Ss|*XL4s=^*)&`PH&R zg=uN>T|wsJdCUKEnY^}wt~xzjtF|M)vGcm7Zs1T|^46zSMyOPwMA#1Y(CB{MeK2fM zfBW4=$+f+EJo&QZ@*$R`fG%i5ma^j$JC}2wHbyozsihu&|A&{%r zf5gRIJgs=-)KLq|3K8uJzm}3F1uoCoMrS554~VtG54FzitEo=eedjV=L*GX4uq8&i zJI8lSXag1Y!uNoffVa0v@mBs`0|A`Ex(Kscr-awzRu_>AXt1|^ z6Nt~uRer6yk9A6|jf4L~A|pxWv=zvZV3bB6m!sT5?eFHR^>B(&P2Rrr;q3cSe0{L& z--kgdqJ14%{&((jDcsmY-n3i0G;BDAVcV4D#LvCv9!zX1nAwE_Mlq+ENGofvr`r}1Q zQ_q0UR7*4N^I}bMiHq)HqbPL1zrx`m@(-Z~omEIYB2T@5Y6B&xZNca!veF`XxCxBi zI3ko`jlT?PrsF!-`e`<|iO31$msfvJe7mLL%wXNI98PFCu!z|B0LQNSXAE-3L--gCY)ID1y+rE&XVZ2F{4m3}5`mDiXflHR|A28?5rQ4;@UF{n}*Y*fus zVpe*i%Dhq7&)KIvVjqvR(zR z6pb&KNX-(;Zm^hJvG@P?iKp8jN+~jZxvai*?33h?8vG&#v=DO%B_G$2(bxrR zcfGNH)7yc>Vd-Yi(%jJrVW%cFnM?y?#Q-087L4b^|Jkhm(;msV@rr>km?}B5bVf$5@D?E0c6an(ul1uPw7xhGaSOP=5oE4gP5~QCSYQ z4Io;mEc$Ztuns2FXR$b#?Q$D>m7z$u8s{@TIeO+LYV$GXF;;F_gQY`T#30h!WT}CO zcTC$2o2=0aw*VrDWSggTc4Bj+2BfIOpNz!k^KbH7 zuMr%f*2sm^G;%W3uEWb_wT|xE0P1Pbb`sb>oUwNJk1Uu`B!|CPFqEP!rxZ!&CY?{A4Cb$HI47D0o17Z!_i*YmMjdIB%+n=YF9n}m*$K4O z-V?@|gmJQOCXP`yPNT0}aH_MsmF;CI$UHXw%srLKAIXL;v;D+^9Vk)3C-2fCg)Zd-s%2owu?#AoVkbv&+Kizb~;$Y`**_WONCOS3-SW zHfECW%kFtatcXv}y&+1W*3#Trd0XGy*RzhmXKhp=zB*+?`^Oxw&WUd=apj>M3wbD) zbU@wwfcTCAoTC(B`lY)opA&<&T0egR@@~V7DY0yW8bEKi2y+W#%Lfe&gXMF=5_z_hp;+MILx<_iFeTZtvn8_Gkuh3+%)8ITQvTYSH z$%eu2Ix-(wn>#W1_8Bjg9nNjTPZe0R_+ zie;ig$_9B;xkq;|{$;L$%$ZzwBlgj&Bz$qC}ATmbyHG4Tgw@7xj7=XqW zbe_fND2`~(svU?)Kz~F)7PdB5AgBwol{IM)Hc@+@Xh&_7LFMK4+W(R!bV(_$Qw z4r|;e_<`CE2rd>g(z6VI1hWgZj}&q2Dyx3K%v~EZkGwsr9FqUYF#`R@9A6GW)|xj3 z@tykf5^-C$`#uNv>UOiX4p`dUC36~_vdLyjIzQfBWzU;iAH^d{uplePPm|Gc}g za~7rYr@}N5XC+jtu3=l9i&wJl3@qShyPj9p5Fxe|=#9hWF($CWUojHqj082hjz(=6 z|JMho99eozS>YV4aD54_{Zy1X?$@Ncra@^THY0yxOKT6ckM_+@t3&YCRp4K|A>ft$ zy2_@6n|btEcs2O+fhL{e4J%}HZXqv=hcKZ%@Y;*frF7$=`rd^Z0(F3^e-75;284L0 z<4}DQZZ=r&*T60aDqNW%FzzyLx-qY}O7-HtibAZ)95{Od{#2JHFq5_`FFvpL+ZdF6 ztFCjehh#es2B^`v6loX!_v^6JD3>bsy{~B|NDCdg2GouN;r9<8Bh~FF9QGNS+Vu&$ z%ApTb3nFZQA8Oi9nfXe*!r^Bb?{@AZpH-if`8M`-Q)17AB~HHBN$hXowo;$0RPjMp zJBi8b>XI<~tZ4XK#38wn$}5n>nh-ZYN369)vF=zn$+pJkDuvBA!q$30VCobhzxb^s z#xq3&QCI=6gdaAXP@Z=`lYHp01BIwx@j@$NTb)tI8E58U(5MRQZ- zo2F2mH_WW|OD%p^%n%AsSUf)BVI>`?ANOLkgo=LH!2XWigKV6(E7?hwbzPl&gJ|8> zgj|NMuG&#W#g>MeepLivx7xUq%R1E(Wvpy`CB9 zYKko{ES!@~pOYQBX{dOnWSnkVel%mVoQW?%;D_eR%~ETxKF(YOF3#L-_<%ShlmWNO z?!QuGIs)g*xpMg_gwoO>dAg3n-B#M$6?Kawkf;=6duv247WOgM+PyeEjC0nJ9RXgK z&ksNv&MzSEudn>$uGBrSb-w)u)21}ca-S0Pm`K!eqaD&9VQb?q#d#I*q_1D@t1u1C zP-dlc)GDA--h7bWaT4D!dP3wq)f?7khvR%QFG{7Jy>KIMh=-BV6|AqkD0*t@p^=$X z4u}_`I=4*13Nt~X5p2XI?pLBX1FUO>OKCd8vyOev0?X4iqhY`JIkxwvjMZEFe|~`6 zyc?`5(_Wv_EFpUMYwYV>y-VjZU8)%5W2z}vUvzqh6NN}3l!3>L*{yfuCJVQHYJC>B zypUqck2i0;_Pk0uYB$foO%OdE2C`}I#DD)$&m}pxcLE@uP`E3cINr^>G-TcEt?g&J zseI5OVd?`FXpSff`2lsj5FnMKz-94eUPyC^<;>7nA<{e0)+^v@cSQ~Svj!J85va{T z{~e4KOVDbq0%Z>2AURR!ZLZ#+3~K3>2+eoa;d0v?y&i&+R%Epsbx;e3zUN*52ATlw znwlDkuKVo<@)M<%uk`{n6V7}Y`*Ly1WTlarQSrq*!sTxkNFb~W7XbS1uNdl$c;I`S}y6MDxN>Uq?vPm*{MSQnJP z-Vnss1`?wKz64AnJj%z@j@uEtG%H0vWX|bYF!C7DxR&M~m#D0@%V4piNqa5N5frI@ zE`F~BT0QOkjwr6zB|}fJ0`tNrI_=9VT93}kg;N%Qyg*s;5oUzClQNR-oIcD&7J(@%BE0I z5xuT1AX|iMzv#=fc}h%5TvNSua5!;qVWo$N`)^jK`@>$4p%$h(Fr@y8NuP?#Bg%21 z^2$k8>k(|lZh&yj`uV>t1XO%=9d zu+4{Zcfn22^!v5Vf!xYEkJcc))+XrWF_OxYx}Tf^7`F5bTujD(>GWaz13H}cA>UAS zGo5iPi=m?C>xN)~%UZt|TpBw|d2?$sQ6?;LUbajBS$5*GZysS15vO!#Dq1s)1p*gD z!#>O#-FZHSu3&}9qVRaO1rEZGWXFnx19Bx;$Kt^79`~`!Y_4_uH0`QKM?vVx11^JmTI;GUh_X2oY!|x zPn0dBU(Q^0bm_O>PD6z!w3tTj5ju_KU`$|AF~Q?&W6Y7{3dHC${tDIv?JmLR&cNPq zCqF+ePaZ&8%qzL9PrY)&z3U*q;#fokJkuU1?xIW}4EW{Nz=PS3Ql`m)BV69{)=STh z(2|H7P_Ct6`EE6XU4$c!Kr2mf$QHGc zq_m|+Q*I|0Bl#fBRnz{`F8;3reRD`#8oTO(C^ti)43Kp4UCh9GKtz=DS$wDk|L5~t=@I4|3}9!ZNxORRrFFNUrpLz*y+8QxT2+s+)b0M;t- z=s2Z7ML%=mf)jWFv0w?GjHarjuM3}{*@VK_O?_?h8^Hd;KRjKzq~(q%UE-jhcvxJz zd+dC74(e()Rc6R6=WounYngdxMNoCj?yK+D?usSf!855#No+j*p3;G}Rk!sl7G9a- z&nT0|yi|Iy?e%L^_7D6;7+VAJPuC-4?j{F`!Nre$WMF8M6}veqf3=B;%DCwFH7<^3r8|xVAK27U`$x3LK20a}T%vKyme#~0lfI*wW0KEb6CP@-5#=jb z-$oU7(6$-nV`f2zPDhf`N}IJfSuWq`v7SFWOKHj$FU0R{n7@7%bNh0YglliwORAtb zLE5P{^3;UC)g5j$J9aS@oZ=jQ@pLxF>G+m|0G}#!! zx*-p~D>!i$$O#v$s91(^A{?A}9m-84szCyFjECveM(Ph3`G*g(H_;LzgHoFXOH$iL zW&Q%HQyk#1Khuw)S4-vkhZp4{uR?w%aT+@E{W@~hv4DVT9CtOLb7U~pKuP(?J#Rv! zZ=P2c&dqb&YoXN$i-s>fk$PJucZ+@k?*tyA>88s69;1sI%}yYUGJ5g)!9M0+OS{w# zliY~g{BuqBPaHd5u(J4dJcOD1iYGiHgI^mP5V2J18KvBvd@q!*43g{o$?5fBYhkgS zPht1k>*azZqNPMUFQKi2X@Io zj?DuN#*%eb-Pxq2RYA|y=%tq@1S6j32Ir2dW>wmJl6Y4(XRHQ&pkyP@i*Czgj4C;# zCVi2jnApGu+q#DRJ}J*i?Pi?T8iTst--hi!5Co$_IW`YA*g~ygwZz~{SLcoNT0hN<1%8K4F#L^!EouK1B_r@X$2gY^nKCyg@ba5xR~oumouxeR&Bs$#)_@5 ztEGMT=TUS|^Rq@l?E?0|qrjGzVVJtlYgdo_--BNuO~Rfr?re07lqC?T^d2CnrIVRo zwQRk3Rzm6khBPFIp|O6LL)N2zeLTfIWhikIAra^RL3bu^ogBc?J6;7D*LieB8XJFU zl+$O$QE>$pG#jVurn;2Y&?8R?vu55&W$k8fg*{L-qs0O*!`;=%kasA)6T+}=66iICG|-jGiG z{La9~=NIVt`{9b8d@pd*0b|yh6=CEP=sFu{h;C-+z>N|A(V1zwCg`@aY#UTHR1eH+ zqY6O)4$!hgY!&jQYry>@vk&podTyo_=|KPbm>7+uR&>F2|J1=+Uq#v8|BRW!*i)aT zyl@g;)jI)E%a}z!e@W{S%KRJIq0z`G&S`~%+U1o->L*k6=|}K={_VAKX&V<0tmZED za}xMt`Q|#MtH=wbf!ABEUTKZ|4c7m}7BY~Z0dny);YIsT6HL**xZl6=E9y=wj?V4^ zxHvPGrpCS|-OS5=hQTp+15#v`&JdjXjmmGZ>Vp0w9+T@t5a7FPs2#pDzgPleCAiFL z1sK)6tTxc)pTuL(yDX`(8R^)PN;2+{HeIfqmF|Bv)NwL>U2W@?IkasbuF|XCE`7rH zi|l02A@BT0@b^?-VW!-k|K-ZnQCi^BOZxnEI?fms>hQ2A+Z|j&b!Ho|7s~>=TxQBS zc$Xh{Xy5exk*tBhwT9g-w^90B;H`rES4p^;nVvw|Ps{EemjVuc4xBKS<)0;CND8i) z-=t``mYI%2%Er~)4>0by>3tj#Gab+PViG>LG2155>A}zq$n3Tfq^sX68s}M2(-yOt zwfUHjkme&&wk0P!OGDSv1IL3@`b~m6TDG5i1pJxd-(X-?BivRdulnV0ORmgaTR^e} zUYCKr_ZQFhmqbK15w?gt0($~sN-$XZ?6b!6g~`BHQ?D$@_Z0V8!3X%xfstQ*SgUK0&*xzjiGt zj9nqpmi6%CS8_}5K$P@rY2%7Ac|HM&oS9yYZlZ#c5l2&EebU*_!)~5i;kzVpbNp2Z z72Y3l1-eb5rp@SkAzKh`MZla8JP&LY@!NHg=Q~)hica{2>X{HSqHy1_7QgjQrJA#p zpEGn^IF@2)-O{3v)0(=3;Rl}qwow2X%bSnRJ@?1f8wI41e9%O$u8e z+WW*&wSNvIzU3Lme*VUYt#@VPj6KE^DF!wbH`N`ds%j|{{)el&NL3fM>*$n4oq^wC zI`~khg`?b&gS-%;{XY&(`^`FoKUJPLhBX6^YgEij788$^5V3}-Sz(`$RQUR25Z5QM z#-qVn)C1!hkuOC!^3!wF2z4ecU0+tI@vMVF$uis~2`2H6{tdNn*_>=|*xMVN(vsE+ zF!_*ok1wtPEB#LC@od!Cr0$xIVX)>JD?6oYz>_I|&uw|481zY};~z&?)iNLAv8Xvd zjg5Ff9QqJ)B!1FLLs)*#D_xP?)@eE}dSWj@_7#zTH*&&YiWTQgPIVl3Ih|h}^!cWr zz-?vHo0enVeN@(^^?@U)L&l!FWSJ)Hr2?&=oNiUd6yhC%4eX02^irE|&&%n_5>$8jYr))a#aU_p5Fc1N7;tVM)lgok@DOQ_00j$YI&ye$=*JysP z;-R#_iio@DmWFqPqlaj?Mr4ZopHbPF$JK+KTu)x|;4)d0{hs|H*VS94FEO5`Zz(UC z)xLsUUo0FbsFMjU3^=K4JRirNAziw8R#eSP#due(@fIGpgKqVj7L^v>|E`6+b_n-k0RrX?L zSjr#wh@R9z& zkE%v47uY00Wmmq%=+9mX-^2dTob8ql1-KJ&~jg{~qHF1;8O zPWVOn0sr$RJsu7k!V%ZNt&cb~p3N+@LIwh;*DsQ~Fd*vsnb`QFMSfLKM@1fZv#;3< z4dn9fD+4+Wz>`gBAp8oDS)2S-YbA_p>62(Vx+Wv0ES8i8(pjQxR!DIuixF*4(-Zh+ z=?fI483LQ7sP<*iT~X^vrqRsdG{)%z`S#9qk}4d@g-?gekEa`~N__O3L!d<1gy6qZ z?~p4%z#SyY9;blH#vN!_xu3qz%ftAfl?zIpm;|O;#RJGqWxguH>;x1dDCdd|Mue>8 zs@Fx7r_`ZUm(0Z21qhqqC#f*?Fb4X;^&aC z^SndxuL+a|Hay0PtB{m+Lk)S#4nL=e==dC6ozB3P71g0;3Z#oz0-)EfD z<++j9nm0Jx6L}8M9Z2~!ru3*6ciCe5Vile8kg3;ZJVIcyzvJ@ie71Z4enuMj{jjSp zS0FMR-e_OCtgb=ic@%xJap?&HO68lqQF%<9FSsNxFzOjj&f|~MX>2Tsz-Aj@V3>Y4 zZzLHZMgjgmY5gU_!;RP{dAC573@%;WN?286q;_mYJ`Ounp1w=J^rWJw7&EjWSLvGH z8;*Rh@41NTFA4ac@`e`pxZ&o{UUzT2?u+xH8djq*vX&Glj)c;2sx>vti_``vDfLE? zssC0DQ5HEzTap?(JlOF6cHoUi7ICg~veVUf37N{U>vk^!>Q`q?)NDDi$(a)XD*Wp} zh;<5udu)%qPk4wxg;R)$jT=|kQ0ZUKavPK0unH{=N82M*lAzvL{Miu|<+!(iQ_6Hn zn%24W^^kA%{SO#{(M~TK*Z*p*&MeLY5wFPa3Q$rXKCFFpruQHxgow(`i z6~Wwdqa~vq5}~(NQnEvZl6|6Nq72wc!>O4l8PNf`PLhg5UYjgw6rf~OioaVq4YD(4 ze;+>W`!yih(;O!?LHd9|b@X@3i+v+r7-dmbwl**k8$ZTy$4>rNHa2V;%m&?n5^AZW zCLN2FWH9zc71>>u{1Csbd)r0&95^>qovnqJGty$E{K$g$UH>yot2!^^yqND%^dnXK zMgGBt)`h^~B zI`nR0K)jh;i+t{zlz{Dy;C0r73mS+>T7hzqbRk{(q;eUnuJ$2QttGGTT+nQjoNp7c z<$xo!?ti}wijedzEGv-O34D+Sy+9X%d^m@3UCrGX#%%tq(I}1D*MBj1hs^49X2XYo z7|q*uVJl!pGA}pT7A4mF+=qc6U(~(>AJf12`Im^*=9EM6M4uLDkS=Q?d9J6Qrq$Z5(v0n0{#~f z_HyrU5qU(ScUwu&5pmM=Od9j@YsVJ+tOG7SH)rAQhaE{DjW2-~77{ZCXk-M|aHKE~0FD+Sq^n7=-28ZgaYJ16vPX*S(@?=mKF%Gv_8b-n z02R(0E+Mqq!@k|P-vqE#tXBsC5Y(TIV%D4mD=i6nI#9dij!RPeIp8URi&tz;wQQj5 ziGn$_>2w~D)8WAdlk`ZZlxCY^>)~Gi7d#JQ=RXFBVfL*@nMNj?&3`9I*PvE|y4kyE z)u3$v;Ln$lL8JXL4XYhSbW6bl^Pe%njZ%=;;y@4E?$`t`6k@ZX7vBi^p&vHu>EC5N^jHVO`TOSNg0*3H44Xfv*6>OjU_V5!#XA#Q98Fw1$g=g#V9!Y8y>3R%+v*PbZz{xfmX+pU4BIX&>eI?KEOgd=%D47HAMRO1GWH(X` z@)ImPYY6eP)P+`x<@gQ^weWR^cr5>m$pb8X&U_VVPhm#JEB94EFBqTL7}O5l^o`l( z2l!L?CFIx0eZ>qu$f!lWoRht0I^fV?VZ%mwH6yyXR#u^&X@tzpiSfC%+5!dFyLBw{rIze=Q~YuK&+6Mm&03 z#d_BC4mmSxA}jvDxak9>3F@lsV9@20|CqC+)ZzpJeU>lL>h`(@ZndvFfy^m)P2rcH z0HBh1{;qbMzk40y=nzPKySJUqW<_=QVg?F{&y6r$oF?xMekDvlfe%>(>ZR@2+D%B(fITz~f2zhvA(^FKW?8nC4UjKfrwdNd>wj`i;{sWA zd`s2*45l8VxpwQtLiwC_SwPmZh*UC#LX2goGuEI<$#o)dbDViKZ3^&65eF_t{Hlc9 zG+dd)pk?A8uJ4$6g6+(J!>rDE?m6y3s zsW$USZPkKq+-7P04H@!NQcJUG(zO^VjhB?`|3k)RWYMo;%wCj*{puujuP%Fn?bQTNRJTWh8#@1SwJO~&dBM7Jq+yf5u zz77|^67Un1^32|L)788m2VHz0RWc)_kYk#v6sIlTL9R$ya{zTj)QC8$FcoMyM%(YF z^x|5H$I`i55kq*Vb8({i$5PD~AhCg)hsokq1$wi$3*`8qu!0QFbSCe`8pt#@G`zeS z!pFyVhx{X;_d)PZpOE~04Kj9AA5({Wva0i(l1b3ZSLt1@Ql?p|u)1BLuKG*wOK<0` zmrr}}cM~2)n&_czg8Nr<9s2T}&?;aYsP(d4HUyVKnUhNArtj^}-i6@sL2YhE^EMph zL%H=;bYrtR1IMRNsHUm66u7`V*ak)2PGYI-^wkKZCErJ7y~qh_Sk)GgjNpq)gUki# z#Z#PvI}`O4dD8=3h}IHk*b!&y@3^my^s2Q6wu$*`dvP5pTuSB+BkWIAJ&a+P<>dF z@jfrRaTd)n9R!aE=Die0)*Hz0I4q<@PfCv%6VDfggfyX(j&o89Pu^@yX_~b>*48=x zWDdT?2@TE}$3DM_ixYxlz&>>o26wNS=&{3t;+1~5tx^|p+kodE>d#Oz7cPIF#7ZZA=xx7ovSrS`s|s;?H(fhE13m;)x^PuQtK9Af zEl-^_!11^zx_kJ@vN?yLjQE^os=WB4S0On^@^Q!uB02)0x4q+mRIlVgT!+(ISTJaN z9@yo)Gs#9RH~ePV62-@<+mbl5GC6PXuYmGf8)`# z6i`_^GAGNuaVd)m@DUrT%}3=w%fp6z!R*sIiEvy8{Ws+eyxKv3MzBds+Y=+bS|EHP zg|u5~l4dr6D-X1*1h#@_3c-GQDl(38P>kLN%1))Q6@!md$5O$9jyn!aoEE!um0+;> zQKkqmJ|mz+92x?c8frf=at5rL|NjIB#UYDrw&a#N+dd^4mweX+>J7*NYCW;3(ax^= zg{%0U?9QQ>th~`W1$+f*{NqL~|1XjwPK2#8l30e^>Pui)_g*CFi9k!WI8_>!`zf)n zh@oQFh^`FloyO|0X`{Dr1ayQ$DW6; z7#wJ?NA=<++1xzAptFXKtmnTSm0ftEiurkzAIjMlh(F)u5igNP`d><#v>mH1u&P@% zMrzZBl7^Wd7@hW$De8_a$yruawmrv&>QI$)W1V@?$@g{}9du3QpI{z2tRZFFcrNT~ zzw^5ZQtZ;~={inN!PfS@gE?;=^=DM_~Xz7BA2+<)h*21B0bB9(^0 zzXboNW{0X>-!9Ht!i^d_+(>8WSgnX}lG-x$K$VjbQM#Sm%(VJn%$j!de`KqlNC zQ2D*Oo-owS;!uKRJ=mcCvEj6=Kgj<~gy(+YSRGjE+4~7ZzJ?BWx}?J7CmKS8t%d(2 zMRzYqJgP%Iu_ZZc8P!p7Wkk=sFEmzdNaLS0yFlRB;mlUI-7v|H?DSNK*ML6YLZse) zF_F@ig5`&9rt{c(C-`eB>X&Dw@fb{bY^g1*-?+bUA!se)@R?xOD*_Eq8)pWb3Y@tzasn#7orFXzM^4)$N%lj#gH#MY+DMoW8U45U*B_`p|z%H7q_-g$UtVAV{I zoLXTxusBHYI_{%c6H+Gf`_`E;N2bQlYzg!{VSVeTu~uU91**nAE_t0bA6DOta}~Kw zp$yl4QChf~b-K@lp&|aIBnIPeIi(ZXIVABz4-mXm7iw3@y^Dy}4h2*uizi{D6ejA( z^Fm1HyG*P}PJoS%Os^1TPu*Za@p3orSUHPOH23!l;ICFqiHs%*xj^d*t+7=Zu8dni4E_q%x%B7Sl;!p-za|eb&+pk+ zKk4pTlDVO$TtZgDiLb4eC&5KpP&hetnSb+6ljX{1kqw)VuT~a!al)Hkvl37D5RUJJ zMGZX#_PtB}`l8oIpsd`prVF$wudx^sS8vQuVBZ~o+gy3Pt0 zs;981o3mr9idr>Rdc-ijZgc=_MajE+eqsC?#4MbU;({QJzg8u7;*9@f5u6T4jl(zJ zk0;;NqGA7MTd_&-OCgOl(Ol=l#`?e279176!r6|*M1#h{a^1$+w~tJ4FY+p|hF1+Q z_}s|64{S$?8JM;T0G~R%Y93?g^n@K0ko`1R21NshjMI>P#D;MGjc|O~l^^h-?_AL3 z1)J|j6cZ{M{usq&M0C6_3|tYs<&yX6LzrxHXOIYF+GXGK)Q}TWV(^G_xol=LDAvAA ziemHHxv%VZ4HW|uTzF~WP=aBMD-Tlm>p&Kwb@w|?iD~$!hrSFF4W=yHl)@-8Ev9ug zd>g>Jz(tV0FfI-pPN-_Ff~pH|`MZp(4nGMZ6(40h^LdF}bf@_?I2Novftg{j@|v{@ z6fZvCC1j02mX$wU~YFXF@6DNntWhJ?1~1}eAipJ^G7e#ujIXJ$pej<1@+1- zB98_GA3Fx(0O6 zW0%A4Vr0V4Z;R7STy?DI%Z$w9&&K43;rPybW{uLw zPczK|(-b~qeum6}5G}xaPHf?tNBTEx0-RmC8jMVxpy%nonu~H>9~d>eN6a8ey15m~;q6(S3-S8Mn;PFLWSK-hilsN}f~ zpZuuKT7%cC__QFJo^_aw3u^yd#-S#X#`F3}tfw4FlH@;72=te6_7(zW?-c4`p)%;RPRc+cXBhuRl3e z+Tc*T2&hdY%9vMnuqr+2jAm;Ytoo~lJAGA)>wWlRlR=C*$S2R_M?RVL^F9tqcker1 zy(zUd{}Z|tRd)8Vr*LsRP0plqVmiC^%# znDovem&Ax;RH|K}lB$%%x!EH_K~5I0<#a2XA}>JVi7U*_z~O+nX~;r@qNlND$%%hr zzf(4Na~sO}>AD_v>YudL#ZN7*voqoA4fcx%st#MSvJzHPqm?E(9-Pml8a#K3DDnJ{QS-^ax6ci(GsU0~j?l!Mt5W?gE@k&Cby>;In^UFV}Sj79BlovyX7)Dny$ zuiCT*?+RviKxxsldDbA=cly$Xxi}TGYvJn?~hVs6Y>L^6asWV@rU1d9N2}8 zniZ0Ap#94<5AgNeRGQ$dpGiXt&)rD1@%vTwmH&MOHuu}7BkIEii$#W7g(-D3fZumZ z-Z@?4>CO{h&wJ)EDP)R>(i;)BK*-PhoRx!4|jj$@^|%lwjQ_nZSL}@D4tv%E)%+ggmc9)GwE|pGg_$^*V!;*d9y zn^+{yw6t}5u#8M($uX=S(;e#}zkNq2JtML`+X?hfT)7JkxIkBLmy`CBm7+C6o&(`& zi@*M`DBSr>da}i@0|GmbZ7wb8{W@F~Y(ae*ew!>1?{j*QV<6BD3VFuhvYRVi8aO_i z)z`=vX@h1Y*1`^?&r98V&(cWxF00_-x5k(p_aAG?S~`~1q&q14x=I7S2BGMiRL+k( zeJB7NZWh&gf?F4%ReZ$^RXum;@5=45o@%!FfKzR)vNdV1Q0D#QW;;-t3OpqwKRswu zVONec*y)e0>^h)Ye<33*Fa7tikVs6lrNl*+pz2q?zLBV)wh@!Xw`J<8o?2j15Psw5 zhIE476~M&0yvf<3>79J~;QNZ>LXllhMP4FrpE|K?cpO=F7FQh!=XLL8lWj!6LNatF z*L{sW-1#iWx=kH#qY({UUP7BbDg{O2kr^Xdza}8 z+IBYyiMaPiMl8C~J_i(KJzP7E+A#KvSHLHm?>hoNzdz?JPY=2E9&+1c)K02`me7`N z^>L6K1lOje_W&%KEY#lT^hg-IawFOaIH3&W%d?~WDKq>ne*lO84?4i6fLLO4xCL?2 zq&w(XNyIDRyPi2T5xOZFy0QvI+=)a4ivGE->yHk=oliY+{IRSVoFMVCe0>WILbta) z>tT26e2N_>L;ms{@r&~?xnndkOwNs)Drt9JG~tkgj3acLpIyUX4m=NBz~{vfXc{iD&yW|f6YN%LoK~|S?c&lPj^9b$9;AWSChj( zB2D%9hlaC!ZXE)`9mQ#|exG>rRb5pf!s=;ss=GR3j-F4!Htl`7cPL30?04>YI;`>7 zwO%kLF-EU$!haB`bs7Pt@B#bP-{9kQ=%jIHCNrCANY>%eWdlRkGnN&o&Sm{`ou}mY z?;|VL)oC`Sqq16n>&k8fRVLxwMYijJ0^NL9$w{48>^+3%g5Nm9m;TrQTdM~y_9}-{ z10RGMJolBqyPgxwjsUURf+ff`!~cMWISwg;l(*HkO}zt$!26%09kNBn+`%Wi&VCbx z4u&6c>pB!*y_R#|O~$m$Q#e?Oik%xpTnv8+62030S*-|y>zRU}3#g=>LryKepJy<< zka61eEw)Im4%{2gGqyz!csn`O7XJb|o_R_%TGRmvgzyh|csdN$Vy(fSxf_tJN*{PB zypA^|Md4eWX&}|J35o)B-<7^c4R!%Oc28GBw)_Ip3cR3y}lQycw6g(wi<=Ut}V>ZsD*h2v|St> zTmYL7Cb-6cQA+(qRmkb`3D(1`kjza{8fp3Du!M)YcI|{-{~S3qjuG7qt#|9;6ibL~ z4R`HWPh5^eqi2w;4q1aT?sVi1w&6cAJqHA7!KUC3fP-^HsBQ&YJjKkF&Ew|(5KXOc z<`yk;$g$RHC_md2&l6OVNx^vpoXvqBW$j5SuRHbn=7i?0L??WSGGX6L8xf{)J#SSX zLVx!^-+MubY-^5->-gBj=l|TcgAi&ZC}&Pre%^;MNyK?D1IoPqx8W+Z=xA52>PspH z(dg_83;Hj5x8&W6Fx`}ST%|eQc70&UY>)SOmzV=1C)-FFi3v(&HtTtZ33R2ZQQ|ZZ z5^7hA7I@Bto+$P%HGTyih4tGzf`!JvFz)`%(pu?uH`Wc9!TXPDH9Lpr7ni49dbZqW zU8KXRh%sehs}J$D7;~9>8xNB_<3gly1!0Do6J)w4%VaYR&ppBfQ`f_f?_NojG#K7H zQEQkp@f^}OCLSvcL%t*C8JhH)I>#fJCQ>gq3r=!}eA?WvLX853hQ3}cXFw!3ZVcX9 z)r^_NLg2HEUlFE?LM}{r|I;eGIgE3&WBmg(0k}#H*hUkYX2Uz~^N6pQ^pg>4kQ*VE zP_^@lVW?k#IrZCSW7o9RP#kh%`0pUQo!1GbR!lYB^F7Gp?<@41R*@A{9pz=TTQ{2N z2DWHl31E=HjS`%GE#Ri$+MozaHLt74?{$TiLX{T*n$gOzR`hvS^;~p{s!w0KmSSXK z66;{{(Uw_Uln^|3?l|-p6?&yjE8XixYiG;({KqP-ZeDD7)$!Bo?L zCx>~cyiXVVM};p(4*N#)LXn)~91e*TNk%AsVgACmY1$wmZ<$0s%TVZp7c>^Pl7&&|p*W9xR%p>xrJ-8~h?*BSE4}U7( z|Bv6tp4pM?j8G)ma*PVeEK!J1${uB8oKq+(grtn4=tCKYWM!N~$F2?yn`57{j&qK6 zIOp8I`}^|`csyLL`@XOD^?E&@r-AV*Q3SEe4fGffij@fI*GkJnOfi$SX`Jpr%MCWD zrVG#hiO=w6UWeWpAL*>qFo!!c$*6R|dEKQnuIhIc^AtEBM~QOGL8nBkGNBu{WcntE zScj~wR@11Suh3}VI@=i`bPJvOl{qTmYqIy^su&QbA*r2<=zqkclS1Qo^Q~ctQ$Z#o zxKH2UhaW`tbiVHgnb=I5K4=XUV;Sn#heZ)7u zjNasOAl5v7xK!1(h)g%Os`tDtySTQk^Xy*K6nCn>3RP=1!Z&cZhh1Szj+r4%$e;4Y z`*tRJ$5*Gcp89%}ko09`ad$l5ASHw7GerILrAe2h@G9%I;LqZHX~q33i_!itQ(TA~ zk-KviJ9VvuAH1Ag{B;pBV1;AMp&a8-#WG=QYNM*XFa>oKaGJE3ekRp><}S1kxDWCm zQjQwnDx<{Ux7w9kL31{5?6CuhJ+cDI59Yz!0=3M;mkfo4(gE-f3$p)VFH|PCKU72J zFnAX7wp^^X#cZM0FI`#{MB*4Xp!TPfFsPe3X&R+xY85?yRfOV^p%QL<`xRmfqVF$v z@aW)*R@Q45T*y%hwRJVm$GZE1wIm87jx4>o>##0;KWd_{sUzV74*=D{w;Gqp-%s}C ze44qfu(?qCep6DXSpg!d|9H_)Hq#^VE8r`F_>~YBm+y(DqDFk(wzV`CFH5MuM$7r| zi%r$VXrqjK*#iSrI;91F3I108SXCLvlfE-84?-H2un=CEw37q@Q&QKba`g`(0$dpp z!#xhu$DGz(#@Rwsm9xdREwCyr_dbRtEt7Ce9*v35cEd}@1Nvz_F%f4FyL}LE{KuVl zamgOjxuV<0R4bc2dSQ{Xx_gO}B`^xHk){>yiR!yn?H?3`g=)CeT1=(g#;UL`I z64!-kXB!h5?d(fcg`2JS_MzW~bzXl2*t{f0xrHF*JLvdg^% zP&SA*yR!;+==S8Ec=kK;BCxu)$-zZdxpu> z(K*mso(w+^)#+ls852!C+=Lmn3$pLiwob&@{v;_R!-b%x6v{%{Pbu^3N}hKir7CIj zZ2#9*G5P739SoGT3#y9wVvuEe>iJ^Z5f;&lCJd7%As-*nvr+G@j4g7Al?Bj0+?hzZ zr<9WC^DRfdS@tg)eeIo)a)!PdsZkECJkE5e=nRlKK8E|k<8iRrN~2M1sL?la8h zME`1Gee?Nx()#%)=?~cB1vgm#TimTL{tX@eSG{6=MO4CmNV!>-RJpsHkCGs5L%YV! z(oIv5k&=Bs(4{r13$D=TPnVz+{A~{*&U(9Maypf~&MmMDM0=U9p7o#@{8s6csZZU^ zO#9$f%iAv{{$e30Jadl^b)$U@Vtbizj<)75ki29*kHwjcfp@0B3Ih9?qk!Q&al;bI z1m41AR)BsmWGGEz!6ezoVj2SV_OMs61Gq1A=xY(WX@HjaC1O#;N;~*9N)(n?gkh&` zL#h*GyxWO{#!?tL%NvQnW4LKA+T94ZVW!XJ-~4q6PC-zVqhJM<_Go7AwCsq-PSzCj zyvpuND4{-yU$KMmZabE4ubx4S>I-oqbN05~vH#H5QcKJz0&>ju+C0Ro&69xFmARi9 zJ(Af-=rG|l+WTP5ksbMO41ksw_hsMWo|zbF8e{&_t90Rd|3mi+g9$STwxO?4hKjj9 z1jRz%7MSW?T7sw!=lD`v&CLF~0CO$KgPT}M`SF0teY5)e#H~gBi$Ykk{)>QPDGj9} zL2}-A& zt*6IBQvw4Fq7SpH)Y@w{DW?1js&$FM!oO*C)`ri<$B6`b)mwTK^i#rGugte!?!W*2 zU+MX5AAHJm)!HI0vn7X`p+QPD89g=VRQR)f5!4iU z)d+yVL&<2+u9X*?-ONM@bx$Y7n~SVTRNx>2+i{y56R7f7IWBSy22k)V`<7bR-KqkN z*cZUdbhi}{+)re_Dc4M+i~X}NInDfb6|xo5A6p;Xh5-dQeC1CRbfMTBe;UNH9g0D= z({ls5ax;FAH4+9!=Yr){;Q~Y3MVm(e%z-8kFd>jVb#Yd4^8F!~aHtafid*h-bIjAl zuhb*n=f`Duf&8-X6{R|joXppPGEVR5e5bp{90P8YrY1NoGpy(629a@4i>*I0*So6$ zBI|6bP6d5u#Jmu`MGfsNFSN(j^Scc>Z~+FGpelE1RjB)s!++u1G5Mzv!?LtH@R6G2 zE@N;;95oqp@Zg{Enfgm2o6nv9U7F?-(}b!ZF+(g^tqu89zl%t0AAe3vV!O84jy1E7 zaeiCJ)cxvb&nvlqZ=ICAExvrbE;Pz@bF*mqi#>LXN0}YKPc0eMwG=g^vv&3hBT}pz zeWohdkr^I1s+Wh>Y|p`wd}wK`=G$4hAAX-oa(nJ3A5mpu_Cqgm>|-zCJvXCwckeO& zeY`UH#sZ6}czQj1^>5OBE-FxDo~|fMlFXRanLVbO%>3dw{sa6``^rJ|Fkd zllxE)+Di(|jGI7R6GT^~4@B+|ZoPyy=PwqdCp29Izn*TgK6p3WR_PO~WAXt~CV4|3 zoiW|xq))ZbE5(^Pa`#EXN$?6(Ghae=t_j@yrfW9@=Nd`S9ioIh$dNYPdKQ-_qNUnl za}g=J8u4a27KR*iUXrD@)>-^bRUQ))4$Ws=uI7v#^&wT zNYAG^%u(4xk_S*nJ7fV)lB|RJz8DR}oe1pcJOcMSDV3zyu3Fd*Pc&OaW4k>y= zNbv^g(KufOWRs9f1S0RvLdgiL{x3dRyL*UeoZUusaN=?Q8f~JJj<%94Vh#Jk%N2lD6$-N1TPufFp zx0Ln_v9OmdtfgYm!~XEJ>!>F;cbg~zt0fL$(cKLo_`+5KMc_YnsvC`TFQ}5?>^FxPmtGIL?XUEp zv<&hp$HknIoC(Jy#3LHqL6d{(^LO&cZYb`(-!F2-n+ahTK69xk$7TkpcUAE%3Lvlf zFq>8w)92B<>%UB5}$DftiGjK}Ih2QT!CntL0Pi6Xs>zFodMw zeWgA1x=``mi115NE@FsbT-zK2vT=SLQ|XmfNa|1relrVO97Jq|J#7c?U+j_mD*0#J z#c}j(X|FMGLFS#b6G>o}%7TnHDZ@7N8bbQMX!Gi32n(x=Ym9s8$n5I20Mc>IorKLB zv`GLuEgX6fXKO${n}aI38wg!z=5zb4ju=&N?(0bainj@JUNK$_*=k9Dg1WqPG7$^%^UXOZY#&AokHxDG!pOqHU57j9v~OR2*?Ilm13lIIr`m2G)MfZ z{W7M2{b{K2ZdAu2bzkjrwU~dk`ST!3w8+a}SZB~4l$$*f7a8bQGK5Ujw^2BO9vT{g8c+kp$oT{lL_bv5EpS` zb}L|A5PeCg6*Ad&RG!57;HRg&Y6vaR&LPXk6<(?nNxrlz@Au=O4gFYd&z=TAFOg>5 z@-aJ9t|QiMcM2C))lPNQfP((=t(mEj7gKLNd)@{ST$(b2JF;!Q>8Z2yx1x|Yk1vK@ z>~;}yI)Cvwx-!iA<$)2MRgkvcLY@J4nHTB<;419>kmE~sK}{lQ|EMKYx!H6760!3Y zLGB?&GVO>vjT5a7pFF#0{x~fic?2@%aL?26PPWtJtTQPLu{`AQ zDLk7D>Xq`=uOihI)x~>0v@Eh1{%Ws=<9msXR z2c6{05Y);qPpHT^4sELxPUiFdko8#D93vh0Dh-KFz`=D@rXb_k2tsl9SjB;w^W>|2 z0j@tNV~R77yKl)0D1w;-Vc;PX@n;Bhfbh7ttQ}qA(=t4tETb+!vw46fg0%Qntbo

0kxQQqg+JN$7TDDWRp3Qe65Sf5T@-8w#WqE~kT z%+lPV#_qd;-g#2}Y0~R;wYQwvAZnNe z$U3$JKafA<=?5v&0Q$5rA0D=aI`EnIbJ`YgZT(29&$r)Ea+<_@(eNxli1-)MmS>kD z6Dszd|3_Fd;RW2;^g9ncmx~>{gMVvfq(M16hTmK9x!Aqv;@+!5*uTEx1|omOK0=-C zJ=QntsJYfa8S&`GAGwXx`b+Y+4?jLxzV37&C^(b4-kH|&JOLGJ4herCm~lOA^$WlF zn(`b^&eqdLm-&FwED4HGxUs3{wvWjxgm(%8f>B+!e%v`!W^nZibho<~_MShY_pk|a zEK>8J?lPgmSnm`lkB+cPK?^Rl^JgJUhqKW+Ynj$sC z6@%as2BS1tuK4a`OHq~H4;+Yvw@YI>TyDu(6b?nF23!QvcY*>mDGB@;S@hq`5xG6T zljIP3{!wsg4de5v%GZP@2!WXY4W&rguGgU0;SeM_?isUb8>15oF?yLviXfK~l{LjE z#pP21Pddn_WyiyW;IprmJyQ|D1X^kk?jS6X2VD`Wfhy4JZicl*j4*j84%eim`t=IW z11Gje$!1L05(7{=)IMYB=2vV~&@@$`e;w|knG5c*gm+-u1`rNoK|#gY_FAn~56-&R zYn>v$dK*@NS_U6%8WmIy?4CGt_pvC}GUn2(C^X10o7vm{*^A=T1aL&|9!+r4W||$l zU?Uuhll$yf&IPGTDw~L(7@3G7Z7!1`crH6oq;66Xvl(Yxd|V~V79YP8MUOI{6)PSt z+wgT4_k7Q|k+Hx$_2_Y@Y3`Q7$}fF$p6D(g1HJDf%ib4C?&Lw7fy;>ZA{)(e7aktN zA*}D`B#18!P`yZElTO11|5+n;2}0iak36y;AWeE0~#JmhM zy|trqL0>8|D=Jo^)q2TBgg@2E1rInr+n0Z*jbAw=iN2^Tq(nnU?g6g9lcA&?oz)3*S8O--9VjTso{v5gi}Ou(0Z zS3StLGUNZ%TG9?ZRmT0eD40b?%(NuCjg4Xux^#Jr@4t=w1cv!=~b+7s~Sw zjeXzjCE86wq+r3mp8}VU^b#Fnl=*y;An(-xGsCXMliwz29?xuyKk~oN$@vf-;_}e` z45)?|cpTT?cD{!&^`znIW%i>h|L5TX|Rrihh2V~ng4be5u{pgbs1xjwRAzL&{lRW3o+6M&W zcoLNqjuHp=P`mM<0GB4CRKLd9Ah=S)-sk=kpO4@+dnDO!8G(!7 zpj+=nH#XU~E$YPhyjh2GZnsiu7Jtd&SP$s&jSoNSt0+02Q3saDhqQ^Uh{c60KTo#Z zR!V(Ih-iF|#m^ESb+z4|ee&ms0iqic{{m5xvOB>+oA``(DjH(8I5ArRuc^dxUdO1r z8yCb5%GzgT(fmr}D4}j9%bRjIJ6EH>o_qV%F9Mg z!Sg{Va*gz&NvL5=!qNV=unlgex}3|IZ@h!`69wX;0Q7mUd&$Pw8ZN{4SAdgEttrPl zo+EW{NWY+=CU>&EW1D+mcBGr&#=bDzvqw%FmByUXf7BAJYYF; z-_sQOZ_%~yrb=(+M*cw!RFyhI+S+dwa!f9r6|UonJCkb~4+VxVEWh-sg{qd;YMVmY z+ACxz(X^VgmW&LS2_pE!uNw_vzPF00$}Kxq-%}9yEpcMG(>h?CD)D)KpU%jn;)%T^ zpp*qUPh46W1m)I?r*BMQsen1=vp;l1GZxb61*V&n^9Q9e_`C0g5c<2)PCcvdC ztG{}}b)~IcWzmHfIDLJa{~o0CC@zQi;x`*r6c>1o9=?J`h^G}xrha(6#qeP$OcHp1FXZHe%HIH1C{cU2$nUv*0`2cx1dU1z(eV1JeX z+1eM#&Oo~Le~Yfnh*RQ#Y5%VCo9Mzi^gCbA$L%JZ_y{Cishx{zFIfZ4!cA8`|;x%b{fi*XPt%rKF zE0^Oed6Y+bdlE``;j+i449s8vDqaMP7A!@HVEk)(WFO@GIQOArpn+;|YFxXC$&i|i zfoz_9sJ4CjmhQsM&hQ^kTO;CkzbHb$xl1B3kn&aC`-+}jYTO+qyP*Rcq?f?E1o4zc ze@?~uG_~ET>ZQA@A@qiVh(o?i3~TUdKOuxoU;<_VMe0E1ZnSJ|9|pyrdTU%VMUYhb zj_+N$Ki-)a<1K-nE7Cq?Cqvcd1w5{-(2F%qn7xBnL8w|_+TXytouM$J9{0<)=y6e1 z%j0xv7z}`1n4eB3!>!2z?&}Reoh#e;nGdonf8r>AMZjZ9)TkHTsFN`WVF>a1KYk)` z^w8O`UZ7n7{WwkQ3!2@%l^4kiJU@A|G8!q7kN8gvIO02-oN&lvDiQ<6GbIt{p7stx z-$t6lY*O8wDLIT|r}nR&Iubqyr5PaV=n)c&*JJmt-cx10_FGkBs;vS)t-om(EUmA^ z^|Xt)KWgCenxoG%?B*L8Q7;jmJ|zON7Yox>uJ%4KJ;OWWYE-KLGH7*pnFOXVk;Mg! zINg7GiGbRNXaLQ6(Kl;F*Yeg*C~))}<$k24nozhP$G^i6+1&Jh(`{dFc5~?l&5svL&Q}1;*KLpcgGKm22|QBScU)z+a3@4F# z^XML;aw;=;J@UsSx!(=s2R9MH;>Sn@T!$Igfx75Is&*l$-M&I^h-+SwtxKtDYJMyJ z&(dn3q>&fmvVJmrb~V}L-bKLciH1)a4$fk;bNpv5eeq9b>iw!*XJyI4}Uy{MI=7U%H0YR4YDe$YfSOMt!vht>7C@UZgx65K_KqJ1zA1o5 z$GG7ZPMFkwM`7?JIv>0+*g3ZfInb;+BIH0@dT~3eTp^&kYV=?Mb!}d}{4d0{@IH&i z%`U~?WAU0^n=;HUtXHTA0Qlaad>+QJh==zdC|=&)t6a#EwC`BWQeV$VdyTsz9S~o4 z1i7uP`ppeHt*TD4uJq!kioB zny3=4ybvn6M1ADQ`tt^kDtHv%zt`bHtC#{CU~>r81wEy@CJ&kbxsSZqQZ?6^SlMCl zpyb)!RDT=0VYWSm)WC}mO zp}b9}r#O|J7#-jJ6cK!_Hcfjo2nf`HnJ~L!NV)XWKuUrTXu}U+p(xkF`NSN$MS}fO zKFb&Ki>{$^9578yNUTj@!E-}V7PVf17de<`gGSwyIL2octKy8}a$Ue*1gS(9 z#EG}$Cmvi9ukhdD%ZcPHMwZ<9G(zD12dk7VBN_IRuq5ENh`%GY+ICyWFEH3<{aIK#+NZ7Y zwE{Kvvof%}TnvjEPMr-1?b_RGhKt9uVtcKO_5QtKTdY5NG9j)17*4;-J==hJv&T+u zIYGd&>_x!9&iG=eiSRd}*F^L~_c(Us`}5h|o1xagITFWyxG3TkWQajzsnNx9 zHnkr>9Kj(3lC-1J(jyD5kba@_4d}I|(85hB9@cTo;oxD`E);?CZEZzHWlt&hnSR66 z^OC?UTff%D%W#nhdO9vp8_0Y#Aj~PoGhYsCVTo8s3cQG&(&`; zw)nXi6Yk7}CCRb~sG@Sfa$Ojd)p|c$vZz0Pb;?C%YV=HtMSq$5JKME@Ye4sJjM7#VrP&A0mSa zNJ~UXR66dkOcL0R6&}LKx!*Hz<Z`UpEzXTJ@3gi5`g2&ccs|O7AwEws zy%m*_%~XYGB#UhkocrX_MNNt&uJ04!{8ym9-B39|yK2ks zmn854WeZc<_WO5%#6EuT3M8QpZ_aaIKQ%cU<8%A2MYy@P>xpKVRg0wi=zI3c%CRGO zUudQ_K3w}oec^Q_RPeBf18~qez8{7qOb-K<(5CZ7995BP#XgY5D*Ioy(V#53tqxo-;mJG`~1{i$KOtaK~nPIH>V1Pco>PJ1% zHU1x+5W0-<{#k{SZKtv0P|FxyKyFZV=o0fJ%Cjb`zKS0}i?bjuGTS(?*F~_3(h==? zy?e+G9QpKaBK~=HEPByLl`bYvPiwG6-k@>1^u&lO(cLQP-LDXc!`@v=?~kwM>kU%@ zn|`0}zJq{$3Z2|T?IWr1x<}IIqQ-&f?ivt#2QMT4$nTzx)zPd~-^@3$1@87TKD_BQ zKP7eYJr^u9tZ!X5u|Z^7U;eJXuN7_Yy4E_GjzvGg6bU@a+Df>3B^I90e2(wB!cha& zFNMU%qh4Vh`<*9DC+`cenpnn$L{x3ZmdO>g9eA?0=bWwWEhsi<<&d1JVmPqQ-D9Q( zGF6c3&tWMMCc(F<&MSKLI%gtp9SyI>HT!IL$7VV$dISRFWO_aV9=ZN_cO3e&8lvoP zROGGV77DM4oQ-5rJz#lhB)Il*%dp}k@#~G1k}<&Q+Q!l%{uP>iUmCXm$W#~Bq^}N| zS}|^v@2i;8a{~d>g#gw$!J&yj;2KTfBm%>2`V((TmyZ46vg=VzmOvXRWU|K<_(j)Z zb!vZhvTT(rBXbaNmrKk5?5+o>GJq)ShcAg!;OBrq;~vz-;`<6R3vm~jW?aoSaa9Jq zdazHhx*4{uhu(-F{H|2My~B6PrVHPblgS#$TTGxkERx9KNLPj!lHw>LcTqvJj$ zM3KoS$x=^fB97x<|MyfFG3Q zG8UuoBRjx*RA-xVs3GV=t53*hvMmN-#(gHD(w+H%qa?4(%;#t_*D<_SPDExdRp`X% zmW4|19;E{Yq*y=rnQn|NkR-4!6lKM_UU|9a;k3_h1ot?Bd`oJDU;6MB zIzrh|whZUVg%X+evE1$4NV1(3%KAo`O+!uq(%{Kj|2}KpUska;n`+CEQJ20tLfozX zHaWxm)_XvTGE$V8CYZ2N=Bbg@7&+fTzlqFCSgEG7%5S?EoB**QAbbj_8z0P|vpSNT zSh30ZJ;rnOm-^8;VOTA@@0yj84G$BfHwIbu}*S=s`zIHt)VwZ(qcrMbDYvy;~}g{hny1$zL+ z#I~DTmNfvS{n$!Lw%Vn>g9of~_2(lGSK@7@IQjU2r45@H0q<0`z10GXjFCU7lY;fx zpG&f}l_EX(Fv@3T_?|R(IdJZ(Cox^mRzfLBXjlMMsV#65$Y|evPWBxCTB-g^0_h+x236IkR!&$vTHdB-KWp#n2 z>7%D;4X!15%*)l#BN7D-V}DB~9dO*50R(N43|X-4_^q;z{3pd;CUcT!caeT6aP+_! zyRNs{Ol4ofdJ^T4F50Ob5X48x-fI*`z2X+jF)MABaG97;oFyB|# zrhuw4Lg>~1megrkQ;f$$h`5T5TuN!CIxPQpJGZa20z2dmJNX&|WWF68l>6bk{pZRM zLZ$D@eQ3JGb&}>LXOi48`dXQ7MydEXaOpnK{>1(_A*iVLjdppbU*-o?I+{0s5)139< zedD+V8`e_pDS)@Q%bc{pdF__NB1hK=|KJmp8%@pqQaXErm9JA`xFC`x3M_RKW|{hP z=FRxoqCH=y19i2g;o7CehF`NjQ&;yAMrh!!3Hz3xrJo=+qG2dd&eWoDzTdN-H-s<al-9vcRG`L=rC={xYfLAc-!$A^S$zX7;J=Chqw3?P4`Ep*;_ z_`tBW)-_NC|2X5kS2jZEmt&SlKxM$~r$sqqJw$^#Vm9~|R@ZCN3Jja)cX> zbzK10JgqjAe?w9N)>DhpYEdjpx~Y8;PuUS!3S^goj>?CTuHPEa2kK8bOb0{n|F2$r zIfon7AW^IBMLo4v@{FEMyBU$2@vM~fW6ZWQGMG?b`<-!mhjbs1Q10maiO&|4m4E*r zOY{-U2C)$F(GDq5{dLcI^sY}xrvpFWMc!}^m5~Hm+UDn4_`*$d4{w-H?=4}B#P4X# za{#!i0XHRI4eN=jeY%;3#FEB`)+;Mh5wC|XWERD8DF5e7e=T}gl*dK`eJ{XaK^A@OMG(MSCQ-}@Hxon+Y_4^OQMGo{b$Rbk`LOl`^t!nMr24(i zBJxHC8;!Pn|I(>^bW3eU40k&AMyDOpupQH3s7U&FJKF^mL4WnhBP_|Dd<(bHY-tw$ z1gCiBnv1L-@duDIXtwNcDyr-Lc2D+i)G5bq8_PFGXGT~|xgOa*ppYLh)u9K& z=;@dnv@CV{SBU|P9uU}W4Zj*;kBn2@)rO#yES-C(SjPZgLF!-d5COcJQ)XUddZgS) zd#%>b@@?!9_ex=<#hig&((HT~d!M8SD^RJ7JnxO}L>N;#n|Gg0@;09Xkk+JD4xl{0 zCpz&Tn#I&h&uie0uQW@5)Glre~6eG^|FZES8mu$CZw@O#p&AXEfH@CAjX3=;S(GI!k8<@W9}C zh_X$~KgV$AxnnqGqVf{Q4-8v=0{hAi5tpY)*z%aHi=*;?tTVJ`jLUozXtgH0p9c@v zivNZ@b`_rV`^CMJ7^nkWJLOOhy*3)TL&rA2%TJu8M&J9!09s}%gHT$Kp5B@nUTyqr zM&fyM{F!T2Lla#Dk&o69vXY1VfLt<00S6yI!=!X!m9Sxmr%mxZ4)_O(D3M}|28hb0 zFAyOBef}nEsWn3QC#iftm(H3o^aZ(E3LB)9m~ zn@;&si2Ma8YzhvH-125Nz^x4sV$iS4Pf%uS&0XRb^bGh^-qs#r*H0IF+6I^g0dWC7 zN1t^V-61{9YS%aiI4n9sqQFN+v^(ZVBiBqlWND;%+L&=ZnmzF^heyYg?-p}cS9We) zZ-+tdkul@htc{pv7`B^fU)4}u#yu?d<>0}Q0*y;%{J=A|YF3{MX|qRlN{-cTvSg6S z5{`+)J00S~0|;-Yk4v)kA34TFNhIDTv>iQ&k2o_+q=x`Av59+xWmJ89?*Hj3t09!sra(N;@NSuKYwaiW$p literal 0 HcmV?d00001 diff --git a/assets/grub_ex_fedora.png b/assets/grub_ex_fedora.png new file mode 100644 index 0000000000000000000000000000000000000000..db286797a5d50902597f9ef6a0553461913fef58 GIT binary patch literal 292788 zcmYg%c_376|NcE=n6b`CLY6VsM5$DgWyVsrij?FbBPu;wR4NK{rYMvmgw|2%NvY6= zic!f@Y9va?$Qof7+bn0!`JLXL_x*kUu>Il8x$pb4T%YT@?o{6m?y5@jl>h*$o*r&~ z01&WW+U8^Zn|L^!W^2B0)u8Qw0B{jGSwBQP2OwKu=N zaCK3II{-j$d%8Jqjtv=+B|o#WJ9b`I44di9njxpmT-*O^2HcrrhxMQ}s66w->38C$})J}fo#1Gl`h^h?H&B^vF%q31< zTXiLLX}|OZPoC)+KaGq{GGB1xe*Kz_iGn7Pv1?K4RP(9?Xmky87WD3L`@?bJ4I|^X@qGP%^jk z2eXSVL%3h^1uvk31NPn4J_&SDnIl~Vx!3OwMWa)7&=tlN@HB3D_`CRfi+2yp)5S40 zf->>n?;mrJYZJ5PtQqPUNA?Qp1Tux;g(!>I=v`Afe?%{AOznsPQ6#2oqisUv50gyf zjs_QxijA&+i#4yJLqxh(?fKMRq=)md4!Qkd@)vp>g>6xpHW!I9-^`z@ZSSn-9yU1I zcJw;8NPc4!eD5vGrjV+B_H9_{R;v*Gt%y0E{UUTFV8b>f(53Fj%j=Hv>w}EJs#72V zbPKtfApSa@yiEkM(qM)z&@b zE8TMjbqrhXB`9SIt>ATBP1?Var0wyjACon*>#r4jN|-vkQNuD|yQ3*I7EHL%i! zy%2r117x_ezw%e8d7-)y!7$%yF9Ebg;lYzNz}FS1firO8z%Z8*>wAjR$JrQulFagO z2_bAtl`f{wD_ng`5g_b7eNO6P0PK6Hhq0IOM55HOe;*|PoHEx%9+XScf#J`B>r0RE zm4UVeYPbd8X++p9$2M2>6v=6!Co{wvL_Aw?JwwP3?V&oqS^(OVaI69skdYLu2&b(6 zI54r&zP4l+;UkR*9@DD%nj5dFk5U3}olxNrHGK}f>e8yPSu5=0zDo-QIw|y$(YzN$ie8Hp>5sR7 z-y0J)k?JfDstM2n#5qKMJeZHCI5Sj%LbFdMy=UwL`J<322XYX?cclZf->g#s+l8Hh zVjGk(%kYHiV(x!&I@TG--?uYZ0q7br8+tf5+6Q9$hapWdZXsdZDNEw`oYJjO1Q=B} z1*7)SBMFWV`oYN4bdl#8ep>+J*(mMGs2>WDaRJ1 z2I21gB;GsM2U!B`)4;R-adp(Ew5Jsgz=OuvbZf~s@-A1P1*Mdw{$2gLlY%c=AoCaL zH2UlqitwdIuN))@#liK41nqZF6A2oL?qD;+G#L_uI2<69t4|r{1q+rH?sVoQ;Jz+T zg5_GN*_Vw(4@79hU<>Ot%eIg@=igjY%@)~sNo=gp+Rqz-Z}lRO)eHr^%0%(+xkRvL z%61h~=7VFX;tbLFX~-Rxvw%;eLS`q~WXNrqnw|N^Vp6I=vg{szMptZmV471r5G9ZE zhu8O{m*@gt(voOR&PJEw;k@sZ>H@lGOFepXsILh0vQc?pgyX9m0;26`7W?~wy^hIu=?`l3C2rm-B1rw_v>vn%ip}#b8&KO z8BqXJFLAq85!*#qceQC}_0z4T)K{~wF?&v?$!Rcx~V0L{As0zKs+r zWGQX~`TOO%DTazt1HYe}RC}il(=BQ)qEUI{u5H_9Y+Zn%Dc{L<&qm{NPhi+bZ+FKr z%#k&S`+^DLy_{DI*=xsatVC;{?2H7VMq@&18CkonxQCaK7tz2^JY^tE@3kE@J`kJ* zf1nuladME?zg{4}8l~_wRM$= z4-Xp51&mB=gOp4pE?e8nB&*-q)jcyJpkL!3qPNZ5rH5SbGiqYQ z1YHj(eV|)EOKc@Qk%1VVh4OdMMSCf)i}CDo39~I|hPkna>>+s!hYvx-pjD4WXixyE`^vgR^p*A3>8Q!=Ebd#w>$H*>OGetY z+v>-Sx8TOFW*Whl=7RDa=>_zx+hV_XC%s%ZKF|1RfB4ZsqrQs7TEX^a$Ao^mTxq~Q zJ3`@TY5GMF|8S-O2O{t3F|n{QpiBfacV2HB4qw8HqD?ByY?}#35*qlgS@wlgjsND+ zLrt`MXf0?u4PuJ1rUoe=>8EGB=H*S*IU;tTUWl%Ih%hxk##D?jD!!hK$gTPK_zBf0 z{YJ$-IPvhhy@Ce{)y+`u>>PY(P%1KS{qK-jfUEwn1xML7x}nku0|=_|47u_C;;XX^?=b?`Zu zm?2!w%2_zQGQEtJgw^H)FO6U&CENy=eLWSX$hw??J=O6G!Fc#ZUNCj@-(88dQ4^DB zZ2H$R$4OwgWFuEzozN#+OsKACi%(2tUmM}0NMV)hiTij{4l8`?l#x89;z_pS z4WfJG#FFZ@&F3}@xVtbjrg2|0ry`C9;O1V6*-P(3J%FJ=%E>@=R!`7vLganjn5V$v zPO~p~PTAEmA_x_10ZVy{{YO-zZc#!v-|3_Jf&;8})XMW}v3&GO9MHG?x+1|!tTg`x zF$a|%inBs(b)Z5Dd$1RPyb%oQe7sEntk#$6lgbSzACCVOKX3B~74Fkxk6_!~cj+f( zEMNM9->s>1>r1$EHCRvtB0;_jo2U4Sy1j?l&k30%UVxN+hHW2>Sl)xRM8l9O81JUP zobgFPQXD794nQ;}`<`qzVD;S(Nwk`BFSWZIezEt4_4zAOM}px*#J$E%Byc0*6aSE+{@tXu*&cxPL zHL$KqKMQjFvFhgFcJ)VvT2o5pkI`XR<>4kA$ftCh@I6b)>hTH6@ng=Qdf$J?^7HSAUJpCQ6+D zz?YtWcLHF%lbQIGD6!?(bMX$+_{{i!NRTGfYh#AekPLCTADIF|>B{ua!7}qhr0!yw zMke>Ix)`Fc zmvJH^_dWDpK5ZgfrwY<8)Y#vaWrEOHWj00PP3fVw+?Lz|`61I(($Pq$hlgKv4HX{) zE2E5iaJ*=?9smN3!M4^+(OFQTb41Mp?pcI)v)n?BlNF!-pKUbnR!xKKFjytVp^fzLtRkHSt}0)Dcv8bAkU4y zgPYjL=d>_uIL@SQ7wbN1$y9^`sD8`ZfxnHk(!KQ>X)76RV3)N9DCuk$+%jB>;l$hAR7X3 z8NRciH)|@Q-5(f>sq%m=VTr!p35Ny`cda0_J=e^?vL{c2L^EfnEGLwu zHA#t+SB47{45X?zSeyUdgY8LaMO9}g&_5R>f#a*IW3@xozy=zd4t(ELRToR3PlWF~ zz8AxvTT!g=Xv(b6gQp-2$L)1X~k`OLFcfz0VUItzlQ?Oh}`*SZDjIJQ1F3!MYHacr*{o7kIB z@U+c-RhwOZz6XSESAb>l`UfrmOqVH5iVDag<41F66MC{<9x-yMVfwPZ@9Rp-q35bi)}F~C-D}7fRo`BB@s8cfF_PG0(Rm5cas!S?D6dCq|Q?zt@t^Jy5Ee= z8pIJ)D}k3vO$FRQ#qmo5mS-9fXb5${M8_1C7{CKVyjL?vtA@pD?{c{7| zkVZWru0o4P%8#zI|2i6kyU#Ks{H(P&)0DXCYvpspQ=m5px9<8COVm0JfadrNRG1`_ zQSw#6KOAB;p6@G}eNA{e2ZYD305x%L*6%b;$G@`eerd+hrgBSYu+INQX|(dRXyEGt zo)jH-_rOvsVGRKsbs&QfdIQ7;-QNa}PY@}{Y}LN*dv;ExFAZ*f@H-zjr5gMIlK#4r zJdeA?5(iAZhdB6A!>t505;l)hC z8quC00w^Em)Hr6mrZdjlt`nBY0oMknN#9x2=8z_%J;KP4l-)+8jk@}&4!B>L6F(KT zO-5ZLBVPvC#Kj1spYkl93;iYJ)?ENVw5n0{K%BFknPk3B9gD_OUp^g_)QBQ(`a$i{ z`dN7P9r{KL{Pdoxqd*xvS^=xraYp}gdOxI%FPXYySe=xxkWi1Oo16>ZOzLi%Ik1AA z)2~s%pSjq^J88FHAA~*}(5q|vKXbJ5jV#pA1&}JW2Tg`}hnuNMu$IH`4vl@|@c0G< zU^Y^kjf7F=YiGoGB=qZI91ku@-V8?Gag9)<54A#6&eEUq6u{!HHTU&%qU9A|Bn_85 z0*4b$^Qfb19T#)XzQQq1V->v=r; z;nA}h;yD21#0$a;H#9xOv(wDC-lv{CzSrn1>+{Fn$*LQD%%#sI)OE?gMDTfB#FiY} zuY=zm=yYMv%36yby!?j>fUJp6>76$+ds2e?w?`jTbPfxzqgErAtVA|xwU%P?YO%Q;PfC7kiduWpBAO%kA? zcA#)HEWTSvB@GoP!FMR28FE8#XQhi?DFHrWZ5~OXG&|r|DEV8~&pH3h43M&0m<*?o z*DUiws@fk|Z$QkMG~&lGK28kvwp?Wo>{OEn`$*knkQOJqCd{W>4HcJxmm@XDl!l7; zI*7>29~opkA(yUhJjGj!+@3DH!M#M!`mWRZ-x0vjQqB|v15Bh8JI zJ%(cf5a$chz{P>`O)t0ScL&H$RWm=F?xd;##OVRPd@ijoxx{Xn1GFz7{M=e38W^^3 z1`Hv!!`ccIW`oex1O|kgvu)OY)MObTCAILzlhH}Svx6$}wkKq3ed+W6096Nvz>l6n z_vK;d4XaH;KI->{_W_Uss#C+S?Z>U!HeoH~k%!+bOVIk|_$ZCLI~&%eOj>nb5t2RH zlecbbOdeefJT{B(9CS8Du@MZ8vOV;c^kx>*pVIcndf3-BPQo~16Bi){oP z%C(Z-e4s82MkD-5%!x%Pi0})jI*m?0dhmcU*~m z(xK{uu{@$cdIfFCQv`pBxobd%Z)TNp?WeZYT5qOLt%Xx1@X6h}@?b9B4TK(|c3iQ< z6+GczHl_hj^cDd)&w&@YAUciP2c?Zw)UCMc|L|+pSFHw2B*u{dQ1IFrNA2j3H385B zH4`J+v2u*cVY2uRahisqB9R{wvE7;al&?fXk#4S4r%BJbDWXf4>6VVhYqhoa*d&GF zgW}+{MdEZ2I%$Ep{It&J)={PF{^l+F7#=CjKbp%=UFp0{o?`NiCnRT&ST2T?00NenjE`DZ9#W3f3b2?G@V+hOFy`MZ}w-;RECh39r;*^*1J%#z*{1WxY9JP)7jOl-l=Hx|(hnx<; zVSPyf+}4+R&A1-`z9twjQX%LC@RiTyZIasQEof_d4Br|phv^UA%O)?PCqzWQnbeIR zOoi0G=oI1{r_+ZYG}nfQVKUrq@3zUhvfG=ckZ<{zqD& zC9d%3VF6T64?$;l$;<|WAaK~Z}?MoXxc1ZQp1H15UEw`o2}lq+i1ZEyYXUY2 zx7XmMluAb5yg)9(y+`6F_RH!RXW-ihezT=6AEVU4cr5>8-IAtRS`8{aMZ&SR4lFnl zhhtcw0XTN1sK|vK4N7$Jhg}}lY}+_Y6Qt>B?Aw`kGe{l_IE-{64Mn_r12`-_Tr~sM z6;RqZ4845^z+x4(GP1~zbln! zfU9GZK0^K?S;U#EOy&2---OT;S8ue(g5yH`o4PfepE0Xc@)`L}L|{Siea+evuZhvc zjCWE6_uA5zafbQ%mv!b3S+`Ve;>rx_>1uz9XJb~ubLUp&f)UFzo%YZ84fHK?*)cP{ z8guyiK3DH3fxQo33<|FHq36iE#n{Pr)iGo5gKk;?2>s@$T%qxL|MJ&7lWzgzdf%7M zd5LGI2H~Ie@#WZ*<8z>>vono_38zns?%$l_Wn9Va|w8 zBxt5MUBKdSOD|cbn~Gu$V6&K`3g+IXKNNa<6q>q>xsGgWTmy9r(~D5ERet?(Z1#7g!;iE6qDYUmv&pAaOoU*5w@XiImZiGCIhUi`Q;U7f~O1ME~WM$79K z0lew>rCn)1c_rn>fV5u+q|BEt%7C>0l#4t$;nf|_UC(*zh2R+b{1I1JqcC^y!pAH* z_MMe#0vM7xVpUjN1*rk}n$+_P6<@U|RKrwy#t1Ec_i#si0CIxDG8-r??A4}CwdLS| zqgJRTC_J=5D8P=}KC$Wnq7ScRJCSzR@Mq7ht$kcrS7nI7{$YKmEj?FWDpl{`Dg#5& zLO^QbEC`nrp=%@<$9i!}{VM?kPL(aW)TM$?YU2?=HO8Fmv6vxNJ5Zuij!&|kfBkYp z{Ja2`&LOa(1(NSE@t`p5W4@!WOd|=FE{!$Vv&V(~(uW2h{_4S1ps9yP3e3%`em~>6 ztB>wGhgvA9q~t4AC3uM=j$g<q9ms`uX&*xv|_XN zUX+l@^8hafyiXl0H!3CZ{JY<8zt84Ygxptg!%e({EV%)@hH+AN#EAG8R+ znX^Zz1T17}8AlZHY;RXk3Ui%)Kxa*a$Icsm-FdIA<4)NRn)sv@Sq$2u+O2L5Gc}&y!xijqs1Si9J48mGl+pYXne>0SJQ!8lTDuexU*Oo(6txn(9FBx8O3Y3Y;^i)sH#c8rF6BIcoEpve~^RE}8Z3DpGu9hh-^O-ef{GPA0bsu(t{txUO@o)x$z8RvZe!^ggT$l5uHb`0C#q z(#{s4=SFz%=;cOWd=QNE;($T*>^b@}T)?60{oj2b75j!?i&w$-ZU!YUV2E){nGrKh z_lD%(OFUcjO=oQwQyNR}2+T`4M(?>dYB+!6K~bH9C}}fuE(kpa1@`bt3T%_AnY_mw z*uED_j^rH3w_l==_w%b@9n`TH?5@=m$5fCfv`(hW9st8i_3op%>b)f2NcZ>X?fc3t zZH(5Kq?QizvLnt6%kl6em^jy@4V{@JXZ)d6UaWghug=?Ok1LJY=!2(P%Dv=2a~-I( z9;RD%A6vF^@k#lS05K+WDdIMefgS-w(RY9Y1Z=9#MFm~_%Jkc4xd3wc=zK9jUYYK? zBJyMYJ4gxFbI&O{0x&HQQ-}gOU*WPp} z8hpKw?krl!wv=NFhq)S0VCqR`gD@(oJZ47)pLQ0aOo~}KQXLOiKTATz(-0gHXr~`* z8at_zQ6IG|1MSAiu_IRIMw@_G6^!gkW2SuQg^DF*R{Za?qZ&ovbe)QrhXV}>Z)Yn0 zQ3M}_bQN4dx$-!LYX-p0hb~9TNPu<9uEh(#vG~Bj*PJdzrb)1U;RK=+_vWq=sMC1bXPJuW|Lv-N@ZQT2Vq zeW&sSW;l@Qs4b6sdirBSZjS5XOGejS_pWp3j3Nw-TqlO^+thau*T<1#Un8RO>84l@ zpLjpcbw+}|aL*>R&$5R3%5{CEYmhr~AjQean}W4}LNXp`3GinV)};MFtVY+F_u=cg zN?`M73T5`6Q9m&eBf-Aj2Y-rouSib1u8WM3t3~{0x?T z4n5-1zf(DaYXht^6_fjb!mw}?dMS4?Ag#o54>-W-JLB>5q&h8n>n_IECUJYUPEW6R z&BPSaN3H%e?&iK%pGwU{SAOF_>(`E93s9XY)$WN*E5um|Y#rW1qRbUrzveS1Y?tO1 zfP9Q8?f+h@;=EpcYAu4r4w|NdYqtAQbx7-@isJ6te#jgfV7AmpY7p8wH#KR`O9-B> zt9t4q57I4ATm$StiOD*kaU4aa1$l@8G7GTk;{>K-Hi%av{kaT-QJ_#z0(9Nc*M+=64wlu9r(eMx*&4JLH|xrljWjZkgsuU z&Gqm*3h!k_BCYMkeg-Eu6qUTK~gF3@Z5&vxwy841v zQsIlHvxrv<>E4L)l4t4=E(eVUlx$GVpCAuKJ)F^?9M%E(bUbLeFdi}78mF7Py_B^( zd)!hO$u`R_*_XRsKGoq(@l1zYv^%J#f%f|08K@8xg5IMih=9K^?*Q}U+}WT|Vfr0egm@N!*%qS4>yHb5@CpyEyBL=OQT8d; zC$KT%T)SgiMRN8e;>r%Em>}i{_|QC&s!NNl^9Qz-%!%nR3gI0Z=^E(5OPml%*cc0M#Df-3>&i5%GRufNR?@aW3ilXC1lb0P@QZKmdB zJnkcY>LP$uYWg+<-3K?#{e($zgf(LkZK^=!%4b$o6FL1)A)lX%VmxE0Z?ZVBvkVV% zP|DHneLK}U_|J!}k4@hC{27%Eqgu6ORJjZJ$1|P)+?RUtUC+n}v7>yVnZ#KOgvv7% zK~IC`D!qag1*<&bAeLnQqAZ`4i@bPpo98hT^1} z)_(8_ZJQt>XA#?pOQN)Xo|r7)94=LFQF7mCnL8HF7Yk1=-ogc68ftO*t@ zHGc#r?h-?n&Pvn4F?TSoO=GvV2~-j1NB{9C+B|bg-g2cfl#uBSZB4kZVyuBlQ$ksVe_oe#w8?1oO3F@ z`?A;NJ6Z7u3_%L!AD~LT8g;jGlOEV%HQYT1VY;ca8svKf-3aM_CMBEJ+ zQMLoVuQ|sq^iYE}KzX+7_^ihqNS?*5$~@A0cn@2j9D0$>oTkV2bG_&uVQ}7Nah-oc zXh$GisgPjCzeJgAb0>8-Q*n%nS1#Q$5D+_L>W zX_(WBV?MC3hii@+e%+24twJASWX>{z;j5Unqo=M>s#$xQ($D{i5l7of3AOJp>C{)@ zZD3eT@D*ZHpX^6MEQH3*7GG*gw3{G1P5A?445LSOP<&srV+@vow%2Y_c>6ll)4&tME4iTE_vr5R5NdS`(jP>br~|%){5!p zkYXxg;MGV~HWdYxi_oW@E0eC8Lg^s`);r^^>HFnVI^mi({G>M>;kNs z4eH|-zXQjxmH>eA|26U4q$nX52 zT&#RlOIHw9$>VI|WAR1c9_$Jy&H)6!k4%CYimhLR^_J{`nQn+B)e*aXUH#OGs(Xqw z3(rb1bnMk$jDJne{Ap=$cnJDO?+w4-Itd~1C0SXpWho{`(v3}^q)cI*nbx zcKc`g&ov=$o+cjL+Ro{(eC0-^IX9gGjI>Qg$W31yC=8G#8cDcI4k`q)E*X8Z3Fu|2 z^uOFXX4_!2|D*~g_eLN3?(E>uwt8&iyJPQG-a6wXh<*`jOeo<~dx#BxxCbMddmpp$ zlk>FjI~qr0lki)SZLngNL=5ul(JMPO8TIHcu;c~4`$UxH_-&cjj68KMMuj@Lnor3K z>IM}GU-Y*^3OC0x4SJ|MF3~+2@9u!Avx-0cnlZ=>O5t*wiyb##N z>8leYkLAuZy?}iVHMF940sA4s$Ks`#xBHs_Gn%j{93swsJ8%nmnqIyIo0rVZCr~xV zRlBxVZLpA>(NVMwT&s^bZJIuDu86bqg)TLraSMHR4L4!`$15{; z@Sx;hK|UC_dWPnJib`G=_I!M`O#r1i*VV@Qbw)c-KaA znQ;yj3fhoBk@5=~*kORHb|W2lDnf^b5)d=w8qEC(z)LF{TNz<$W=|?$Y8<+=1 z^(Q2?s;1M1Z4F4VwFFK8u91LaoDqjlY{dc6_JBf(;tzJS!g4>JSoCTJq!j^%9EGj)v8UZR9k zW6FqTvzu^iMThs23m`u$ZX}|RbBa@1HQ9{Oq)tv6i>K{z)hl|a0n%TeWv;Mw2AUz3 zc+o$ZTb!i3YTyYj&D1$sGR(h7$$u#EUTV8`bn)=ZO82`LC+|ug5b?{lWVr&fWZ?IX zs-X#{gyaoAeDf1kq@1It?)5+Gj7eIaoQ-tn!vTh$?l~r|e(2wO(`>2bPu##6z~%-_ z>c8)FA7K8A3pMnrB#_17br8kyp(Kg`Fp=~<)Ln*~5<*x_GOOV)6=QAh(lyZi0P~p~ zZcgVNlIQO+B4`tEm_x~2mJIWfz};P|LAAdWKSN(W6yPRX09GBI<`-14GJmGmzpl~+ z*{kQpnYa5how3Q*8?_e`kI`#b#-Q8_KKPVV!ws2;P*VWxw@x8~x_xu9M1ea1g%k*p zTxKjuU>)rGTJu_-Zcu{eqVb3p?X~BYj+9r9TN+Bs_1XIswYv;Lr~MkKsjpeYG#eI7N3 z8cV@|=_#DS+_^(BC4JOc>0^~QPNhoK z3q&?9ZBb{+Q8XE&U1EklOQ&=!25LjNb7s|6oZlF}VT4Xu!X9xa<=4{~h9)v+o$q*x zFJOP2_N-8FDJf%+mgo}-p4~lo>2Um#Omx4FlOWxrIqjKMhqLWbg~q_{-Vstouk5x# zZ|{~wiKF+6tJp4`oL2cmbC}g1qQ2%GK+PP=c29lH=mGib_!!_YGg<(n_BND*fBx8xp+r{32Feg25Eu02ljy9 zS8?!uLGpW2F>Rfp?6WuC-Oh70m+EkZaZ1c%{%m4Y7zKR0k z(|5OD9GBCW-X+Bsz(lXks2Vb+K3Z!0oi%bnl(?Z@dDD@2^YHDkfXt zwoqNhIHizs*amrt5~jI%fdgBsPQ?;G(|~%o+BuCn1!HmUAw8+_)|~e%+aJMoONFsc z$(;eb8@_M#O0s8N#^8Cr*WUELzjKv3UjAAM{D&E9yW!;&BCB(=C$Q!%h2Bbj`9r}! zcsE_D*#cczkdWJ44;>#y zJ&--z49Ijc*VkZ7D?m1V5jAX}dn4ODkieFUZPXKk!xSM)*$A|~7^Zqy*zWq3^rWnC zY1(|(Hu3Bu`pqPuJ*k1I?=7V%0e0^8?mUfcIh+O{p;yZiz+S+Xw&*C(*kyYCElwy{I{<>TVf%oL2-T5Xo)|% zwaYqI!4Opk8ROnV5nW4%ps#E=7h5pK=lO$kB8(vI2Hn3D6yxgTX&|LTzT{l8tQ55FqQZxti#{AEnb6bb?+4o-)7a9;-yLiO~C(H;%vE&~aie%5I{FqdY2Tud~X%%$Mi zA6nlzzQKWFN;hD5z;hwL{FR-P0$jBxOqK_J!#bGWm|bXDN!lgPZ9=`3b%u2wS7|;M7XyRj4JQ=GAExqKrn;&>@ohmBBdUcNI(Rx3w5OP<1 z{crf>Ye1pPpvOf>ZB~RCW*$u?H<;gpld*LpUXn!2cJ&x`2fis60SOd{vS6|tU|0f- zAUz4@pz{G6>#rPs6*mrjVbWqYcIG>%ZlAx@7Iu=UiaAOkvr*1rlwa4YJ=F)1?7yzj zjh-6jTBG!{;;V4tWZv0QyZNQq6@^Sx50pHi%KJoPCqupjwdAGE&n*e};VWU7G6-|MHoX`9v+r!Bc-a?n z#h}CrdBsCZHOIX(GWT=dASd5LY*`Ec!cOLeK4!y=dUjsG{YB?5%2W5f0oAo1^oaN_ zJ%NHrMR6<#)3%Izi0}S`FF9txQ&eAMsgFZH{}j`c6+ASU5Vi>!s>0TvA^HkHw;jfb z>0N}XEkTMIz&aF$=hujA1Xy$SLa>RGZG?uriJogXxPgH4L|%>S0M9=A`)1sk^#1Q1 zyHO(wX!3)M-*Yh!T~Bd-g@B$BfPM;yl-6fOPXUAd+*PM{%P6ipsjt4oZq`# zNNzc}-`RRL;y$-|=9^&7gzL`#$QC{tWK*Pj>~1PO2iE0LFt4`Ob=Ps%0d>5I7~>5d zi0rFiW-7f}i4ADgh9IMvgSn+LA$b>omE>s_L>t>AWM=fLrm$2owBaiUie9V&+JL4IUJ4Zoi+`tShHUUqa#{gqxF12Fdx$F=VG zePEa>vzqB}gSQ6$7PopnpHxO&>$%g?OwQtNg!Q70Wm_W7LXBKrQ9l&GzO7eZgJFqGv6?ESyPZgoMpH}8OiFhW@HICLM zt*+rHew(p-hG##{j>_8O-g_&d1?qXCgq?>Q1^k$q9g7(HxWkj<{6V8oV%WNH0vZ8e zxeHJFX{?ZxTOOGTVeu~sv6IT;W4On~laScRR4c?EiyQOZlYu*zz>UBFm> z;{r7GRufh=6yE}dBCBt`%Y{K#yfCsvbiKRr6YEbvCKIK+T$ww zaU0!is{yj5Xa^=j1>hAvJ(~s$Q@GLf9ldx#Ip%D^T-D%{+A+0*f`ZGw!t_=wzVHt* zz4hfS$y^6P=zja7(#7aCO8&bQPM+oV*#&|d1B#myLS^U1BV1sN_-tww1sR`mN_>8< z9RpPwVD2lYGxQ}*0~_a5CiB$mcm=%#>my*CJ8r)QKJaf4FjCM(#ggy_dLN%TnJdS( zJ=>HlvJ_hf%*u{oS6p6s3iUO_U%Nz2vHTg;_|+M(um%#?cI|L_4t*#jMsdC*=uT5?lv=P?N$aDqcn_;b#B>$5s;kP+9N`8;XnuUr5>WP1Bi0qV|CUyh;wWJGWM)3~^uW+SI`Vn&MiEkd zoAY+Ql=f4{bU3KcPJ6{a>}YnI?O-i-8-#l1>R`XfS$#I>W~0vOZwz z;oF|Qcet>Ixlte^uWO7tF&9y{nu^QlliFjV^<78F{0j!S(vLWB;_`ejati1c9<*`u z2(6nbLOxtXO{5WiFTkKNtfhM3fK>JG8Uv}y z>{8De&7gqx2+_qq-B}tqUgq1IT0Sgru=at? zhaw6@L@fnOtY+I(xlzlX)U_gWRCb8TVT(ysS^d=PDqg}<%o(Bq=2Q@cwm5U}REk zz4j43lB>RWTD0TQl!li`H%!cJn7Uo_Sbj-*=1Vl3R}c=JraCplC)e_6i<7_GhMS zFo4nLcsBNSus=TwYN|(#F;#_SKQJ_%U_rq8*z~?2&oi7R z0S5xRdvMZ9=;KhpboKR#U7ZRKV1Yd5ytEoM8PT#)0#hWOSOX4(hYBL%RYX^mQf|Ip-?>*mZz7SfGp z^^><=Y}?DLG59$$-xpi>_U!`RL#a2H$lj2ORvXOXPJonznq1M!O=x@{cFw53Txk-%tTJvxd%~I-Q!b8JPJ?WHVgw=U@ML zdbW1vguu#yunwk^N5?IKb&mL97m_8Ma{)hIGT(AXC4zr1HDDO&cmXVDiZJS{UbBk# zVA@pHam{0Cf}^8X;|7lm9jhx(yLYX>eWI+dzT)M&!3VyBwjD<;Y$n4wKb#(J9R2@q zt!9BT8t9Zq#U=dVQL;pRxFBSwfzbYY*jT0AV!K+`_`zh@-k^Wy>fAjW`SSZJWI6m} zQTvbF|Mu*UG=M#6X?iwv;1nz;ebDv3%H>*1QJQ1}1|TXctY-(SI*TI@K_#uk8HuJ% zc+bm|50EzMbWv6C8(D?Vbkx!y`epm}oAj@H&oy)e?TbsR&3Bx=n{Zk>(|vr!(P#UL z68^V;BgXv@)=+2?g7n(PC+FJJTb9Mi&Ug>>J?q3A4M=Cs zFMs;%x%RceL1&+Jew5x?8W~r#Fa1;AZmRyKbGjdH`%c>AHa`7NRR2Dm^Tt?wp^Oyl za^^Kw=5@zEkAL!Yr8H)haCUy{*oT9C+PK;shvx#r*HRpR6MS7hzcmf9L__ys!E6!dq3J*L5`V!;9#(Hn&!{ z8jMU^?i$#9fc|yxnYYBIu%U4E+owK@(;uEuuNk-f3JA8pGyMB$mntXXf`eXsJ-Q<;lCyJp zPDgmq)1|j6=0<*WT>I30;D3vsx5#fs(?z(VP{t8m>%uOm9`P$)Hf;al*;4n~;Gp-| z8$P_YX*#;YRMyxfa(wvU`<^R0j|1p$c3)lnrE3CP_To!>mZKMX7ymDq=UGUVEHE|x z8n*7r5zGJX=Fx_{2S-PEUv^>PklWa>uYxKKl2xpqw!wah3(woLXSV$ieWpy}zR#wy z@l?Wo>|;({hW4Ny9sg!fSZSX7I~K7Io8AK96Rq+qYgt7clQ1&&!bU;-b7k)P95%EP zZy^pVzaD@N6hLP$wO3X|Gavq7wbn_`I2_%zt~&fu<@~YUzglzZ4nhz0pMF?kAF%(8 z)0>32LP=+BbdjX+|E9KB0W$@0Y~I@!?~>;)F~|V7R@`G-0KgcFQ)mL|I4N6 z!;gwFdDVB*g7A^q=kt)X)p!4wBfrC;?6$g0{Tj?)@~4*e^mmV~is^3fe*Ibc^?Je> z^3=A=Cw|GRWXCAhVYEG>iV=U1!(;uOY0c+XPCu2tDC3sCu@wlqWaZ*^r>>HhJ%)?QSZUdfeWez^|xwa@D7Tlo$UqYcR&`P?1uAQoDWapL=PXD*4} z6%UApiv^tc-k93|N76WlKqL-WTxD3Bk)^;c1KN=83xOc{ldx~D4)rdZSzYz`eQ!??n4 zQ|L!ABw~n<@z7Bs+M@aN0@@Bgl{|%+WX(!!9EzkS?_*A}R6kK(stq3twdVKwvdH{t z*8W^E^6KF1*{QQJS<>~1be&dV9CA$Xw!^jr1#hc_C3HHnFpGpAi$I%@)dIuIZ!x@} z{~1a|{d>tdoF8W0p_l&yEh6dq4NelkEz?jB@m&Gdi#lZ2cVcfnWY7g;J!YGh1ns z(1dJD;OfrIl`Nr3azmU@f*g3g)Ni8Rq6{@TEQs5oEY}&LEvM?1Kuj$ihkZW4)|@0Y zFz96N{O8?Ltv&vtp$mTv_X{frqmbWBL6wZ=e-owUoFY%-sEx>85@Z+9&+bL)$v>?L z6>bg7Rik6?^~27?F*%UrI~5Boof4euSjZHuSN?!FM8;m@mlo3k!Vo z``DpIve8OY0!R;40cTon4$qiTV`=szJZL^#Q@9BhbpHgHkERp|_x2HY^628|pvy+b zj3<|!)7b$BN}s&43J9sNG(QXT%i)?U3Uc}_G=^tLSzWOI)yvdW#g=_|`j5y_(s0~t z7*|{ZpmjV~33mEQtmlaYSa9MDek@|gu>(G}W5eT8SW1Fh9Brs zmCuLYABZ|lWF-t=nuAfou*@ymQ;k@ zn{quL?$`+?)5Pfj=T_sVbUhH!2eq!tKCnFYcmWz@kL0XmZdl(fUZ?zN5VP&VUZ?nl^#b<9fm znLIssVAJ-~k;gq`y$cEPymp*joAF=KY<~K9zh+3Q6)+m^hyfdb-y0cv5-fL89jLB& z>bKRP`SyU%=XRsfFtl-OLTLl4&W;&tcPcARK7dlnB)@Ev1=AO4D-doTNO{>hz(Mq*MQTa49)o2y6KDV2`FaVbx zftp|pv4b@!V?0$JRe(7i7I$d$IlT!n;j7IMgH5qB0C10w2FaJxyKfF_(b$qB;KT{B7gWC=F+oAW04#CNbA3n zYDk`fRUr5a3{&p7Il41`LFY`>8i&b8a~3)+ga@rh{}uzu372%yB*jJQm|Th_G&8`k zClhKzz)VmX*t`n1rv90-c^Jdls(@!*7n}vaJ-x2Q-(RpyZ-G!g^q2S#W)|${GyGrv z?%k-32iYHnv3c34MNelh8qR-L*1fJLKXp2Gz{s}dpL1`9-<4`D;;9?HGHBQSX>p}Z0eORr5{F~2mCX3@%$&BE^HfQqvOw4e4 zxBv_9^sQgq*{T5Y9w zR(3F{6=&C?)k$+2tj%kt17i*1gEwd=O&>@d!t%D69=dzSN zp;MRp{c`0acg@ibPeTZi*8&V**hvAi?Gb0IL;s}rQH+hdd@w`^DaDHE%& zxblpTT~z^_cBnp-rColmKL7u7#|am2X`MgB%eQ9g2ks;YssT9S6HB7)l*3*5YD%Ey zWnvw+x*1rZpd+XPr={RVFyt>DmUTAuCaBJai`!B!2>1_3Bdbntb}M~Z5a=?p3l#d({i$lC&& z2f2QCy74$W-Ek+~Ii0Cu(|F!yu~$psCgh4+!E~s?ur&-;?tz>e2%fu~wuTn88x9J(yLxsb&ckgoanYkFMc%%1#LEJe-!9gn9l zab>V98Zn$_045-WARksP;h=qXjIloeZA3%@7eh$mT^Wfe8 z;PK}MWJnowMNb+-b)-qyKTnZ@NGJj84_BTDlyTHJSac1VIjcy?l1CmWaK-e6GVRkZ z@u(_w56qRMJQ=sVl55_Zt9k+ITrE$=7;PbEa>M1Q@XgZGPqrvd=~%SqsC=)-F%-DO z!oNjRMXJQWv*_j7>4S7BvoDbS@zgL%E^Sm{YvH3>3-9zFFIZ9lZMF56X*Fzpm$Rit zk_dJajpv3z5}xX}gB@@x>(1Ss#%T3@0KAp(oZ{E{w3D!4t&1{R?QgWF3j8&F_Qr=! zTkW2;PO&67t0QN2-bz^+E6nIw))AT(0b3UEo-BD?Y8ZZ9_p9ae-`V{Q=J=$>0ZKPB zkodc(^H0G4Y@+E0qW+=E6kOcuY*BZnM|eu0@HJ}RCx6;6k1Z+hV>VmjVYHR#%Dc@r z>^6Z1{2b;0z53^8!$Gngyii!iJ0>!LPQEOM#W|J)2$p8RwOywXCaJY24Sv^GpSny@ zp-R7-Cj}@2*y_WDx93V*NpH5((9zFHFvg(h*+PDyG9lHr+Ka9NLr454v= z-ROiQCOT5}*q%_y%lcOP{-#gOR$Et8)%=^n>V_~uO?Ei;j6Wn#< zTo*DT$k@{7CMnSq&e7Lomn<)s&kCK{HtR~;}B zJIWQ`kyCA`10-_k{^w|TswH_YZmOcea>8KhYS=vdph$U#JoREjlo}8jQR*2ZXP}Pg zofg1o2*Smy;9%pk0K6I}&76H5tq!-uQXttcwA2or*eiwLXI>oTujaxWz551{j&)`K z$O2Ek@V(Fg-EFc+vVXv`+i*d$N?xG;c>E8W_h}hLr+2$03xk6DZeN$ zwAnqswvWtT3}9cXq8)J|>mkZOkE@1bSV`nv6oIPQ#>Wc6HLpKg272XGn0{%#Qy=KQ zmDl_c2dLHs{hKx-h8Ux+v-4!ab|637oc!!o0Y=F^CTDQ(+u@MR*QcEjS;E55$1K-9 zaP2vR9(=_Ic1qFKx_Q-g%Hw6JypXxZ;rQmkjYAFaTAX=ajSW@@YRb==Doy zcnkl9F}1|44vk1&{tp5;lUVWCCA7*Y_kG|wmKYe0oRXEWIl3Zx@KdE;zVBtUWgqUP zK=LmN163Koy1e`hR!!VZTZ`=&OGzChGc3T)uG<4am(67nzjNf`Inskd zJ$@=I$zXPE+?N;ykf}zoe^aM@&UtRaltJZfBI> zSH7XXFdk)U!ZmgqY>BV^v3-DSrW418)}Q?{zZ!}cpc(R*eI~oAPigL(=8NDRadsT2aYYL*ItPX^lKNYT5r* zL&xrAw%=dIgV9vUw-0%n%@$>|B0!HFl;eY6O{AG0oam&zY=Jt%+B@mL{#5`%v&RD9 zKNjoEmSmPe%6QOx%1_nAt@bX6f$OX*)GZ^*@`^cf;nIxRrDlk{CyNjRf}&sEj*eAC zV#RT(!VrnzMXO345oZ?z^g-t#(NsJ%3Rj|QvGA{SMV_l!FVRSZ4J~D;&Ty9>pX8IO zCQW0y8t|rjW{6JMo-Z{0D?oq2!VaDGBYRJH;_RaDVk+ye$X4u6BVTS3LI|AgkaCF6 zRwy|}$0`ePJJ^e6)m1V|=k$fTlk*@%^;d_#N-2d5>;*8dW*8X2tN1-L70HDjI`LN?+@ONgdBOYCRddx(Ct9 zK3z`U^p*Z`=R|i`g=t4HeXKuvtJW3^gP!7MAKAr_m#3Qg%gG(d@Z!eahi@uFW~XYX z)|KIXLR^O|JM_{e>}UG$Vv$YsH_nUcJKu&&nCdjkAIP6K1K51nt~bT`aI4)sS{zrEpx|9hybl6aFU`3Wco>P5!L`~3YhTY^4^sj-}IcY z@Ei9+i`T%1I{V3Ol^0I|aVQV`ry&17=%L6UrQXqqO@^u>t!dCX`@Jcunc(MJW zx2!GzzxtC)>7A_pw0+?D%LgKF=cdcm!{N=m7f=I-oR|5{-W!r^=n-W5?1*xX`BYx6AH%*PJY->ji|{U?*> zv;1`r^K-+-(vOvD>BDi&^av!NkFqET?7wFbR2fj|8yeuYp|(Y(QXfc+GFzA@WrkhzjTLq zqMM{6RHCEKR=+0KjKMVycH8qmGiz#?c4$*OGGEsD0p0zMD60G*GD-G}tsX`l{t3>J z6PHgt?GHMvSQJA)Z1O)Qgf70iD&q$L8?5W{ZNq1H+#S)Ov07OJ{q|7?A8mX$&0ce{ z&0zOGw>?U~$&c~ROs zTD-IHT*|~wW31=AC~1a5H9>d2EQvTYvumOKE20jp9VGJV#;a%7<3PrH>0VExQRac) z#lSC8lral;Tr2pHz_4_%LK11aYA_0F`FiTzyu011cO^!}a(@X`PbK3FzI}T-y<#j% zabso%<+vzV5-P)cW0HJbC4t_E#Vcj3QN!?yXF1!k+ddw18Jg-A#K+Kdxb+?pCN$)O z2uok9X*j)2oDxgBLR|}9_4i({bd9JfLes+o&g?YhMMY9^qlVJ~y9+?tc*;mJ6q{;E zo=ZQcH<#2s<(q%+br9qaqKyXTp>~)Xw;K2^WqTij15kY+8vK zjKBVE_RRKu4bdZruifz!zBXHrATjqjM2?FHUi5`3I0XGKs&9>vi2GX$Ka-Ke+#CPLf=k3(CU8T z6t-OdtJH>#5912_X3NE-h#%+pxk@2gV!@`kLm$T&^w-IM)|8 zq0-@gRCRwS$`{(Ns*kn42s_J-r(t$eUIzpggdFVgHlIub+Nobz z--Dr&L=Cl?~S2S4H+`r^284eycyxWw0U4|9Eb zI}X=)n;(`t@Ib@;$x!1hE5}dVO}}$4Qsj6aH7~G^TL1L-F&t6|l;`d)4U5SoP+$I? zG5@jvBcs1c1cV~B*-y~=@6`oLSDY=Sfh;x5YdJQo+k=q#8tu%P#n-ccw4^#E*d~9c z76qI;t2BDDjq|B^>d~X6Rp#pKbK61TzD-l}BEmmbJWFq6_G6&AIRXi7r8H{`2Q+{{ z4a?bLO*NH_c9jB0Th!dvvEu0uoar4Jspq8t00`Ya*AC<-KO! z?|O4}ccq(ANC&JHiS^~y1vVk64nT>YioJxC#hkH9)&A+|=^#!zi)L%AEYb5E5okng zI^sXZQbkH;t;pDg2qQm3M#%|#%6fQby89c~(=#(r1$`Ok&Y<=44=2(k2e#cm6;N?e zu*T}#TGMY4#%uNxJRoK0mN`FIOr}|=q+_JNPaJ@GapJc zk`$WIvdLbS6mBB{NL+NdenIT*sj8jLmRn5s<2#?wT$^tWkYt7v7rth0efJvfn^C>t z+drUrK;mrLd`$|xD7^j7CaoL>WbN7&wZIt#4{kiX6JJuxJUIssvz%Ozt1cD(zqG_) zQDp2ob+)1$N|(WMIL;W|)h2_J&hhtcq<0+IttqZJg|my;@7RE-z5a4Q7`#r8)ege+ebm@akW&PL9R>GE9$?&(3touyyHsT-9{uSHUO8 zD7tGMl7>D`REu@t>pOGB39yH$?JHzSg50X&P}iUt?~iN64qj~+sqe{qXEF%`Xj z`!2k^2SlSx@H<{$8X zv#z*qhs5cA$Kk(xO;1b^)xmf-MvfEi-%IYcz0({odn)Vy%~x-3PJy<1;RLCDc*$OG z@Nd)n@|brH8BgJbl1kdk4xI6?p~$WSaJw9*LzTyRxWCqp{oQlbbpWd!m7+`G8IZ!x z7wiSW_(e2xVmEqKZ*&7(9H>qZ_2eTfj|0g#D1`Soc1^K9gH#qyFRx#H~cA$|S`Rmzf-u?97Ux1Lr9I zp}RL5G?j}e`qa`7X0W6xj!unXDd>KP9pG#_t_FHWu{Sx9%VA++AM>es9h4c<^2mB7 z=-M~eT*-;0jn?_9evzuHgfas*g{{)sBWt-APt^G3AfiX-E!Gs?DW zz^Q?IUmk+MK{ zkJy)sgNpkjh4bu`)jk&?$kNe5FYBBq(zc-jMLO2Fcm0BaJ!33~t#tEKj{cW&Yea$(=gk zNKI14w0-Xd=^;b~u<3i|@CUw7XY9s#wZl_R}p8@JO z1{YrTAOB0XEQEH7_!qhCW0!g%Yvrj3%@ohj6%(GpHXY9wJ|59fnm-7c@-TDxW_iz# z086cfC$+h;5o!fg+uwgCt;|3@N9zMpkCBe{GE<$y zj`rGKxe=7F!B0p`*;h9!(81KiL28u4bqvQ9KL}+Oq3^XN6v4Tja$s#0k1Xv<>2^!X z$O<^{m6Wy`8~hd%UV9$&c=94g&)Q>PDQEILLfQm-zHz^G z{5HU-LT*D%91T{+OXyHW-G_Jm1))|9GZFVt4J~j2lI(@Y_mcZ;?~J>&=nK0px{ymO zDJe^7l;os66D3J?LksVPYuqExSHjo8Ql@4d_ExBy+_qMAjlrJ|XkeX*0sBza4kEuv zv8dMer?R)@_S;BhHj6YDkj89~*LJrD3OL{@T(8HMsU;CP1=o2kt|Fe~h*sj1=KmL)-5P0w`9L57U28HObA(~Q4GU|1Uad&+kPRhS|Hrw>u zio`NY_VlTYYDz_Q5CQ`TRxmfSv*{KGoan ztcr?MSwx2+zx~tz?0DK;_g&oY`7tF?*Aqt)b+i%4VAGz9#lC- zUPnoB9io>awKso$eDLw8@bAaaVk3e{_FekwzO6k9VwHD(ZY~~Pkm+cF>cPw{Y%OTe zlmxF<=PB{84ium&ayY4{)u*w|u#`Wt#ccl`o-5FXMWK2r04=0c?$sG&;5qqfu?I)R zfxSKIeY0?ycK1z?Bx2B5Rr6^1kr&Q=(YH)k*IkqU_-~(mutpSY9BN!dzt&==tNT?z z>4YM)kEC2dJ8TNvzp@$;ouL@P!D!>bG6zXa1U7>{H}D9Ao4@^BdCUV_no9NZVXQey z+G}I&Su}{vq+V*G&~$q9@1;DM>77 zy$zXr(K9~a?A#&cY|*7AvGSduq@n)e_!FLv_ZD$2L6{s^w^d*PzYz=1-nC{v^K%1T z0$1g(x1s>Z!IPP&QuNlnmQsLn(|tpozZhsO+SR%%7p9@hodheoF8cLDxLVAJu^?x6 zD2dWXS45Ls-zJpkB`ogQxYfoy+B*mOR4oU2FSI=QZZQJd0uAk9EqF|(y{siEOVW-R z13S7R>=P!hAoY)zAZ3x;oOxGg(!_v4$&F4TV>NX@N9n+}qWpIb@c1uD>ho{wvgkQ* zJ&RSkXVJBC<>x9lRrDICb)jtf7mz`Bb31oQFgyg$?Pj_gF(cqU3&#H7sZ9hN|NUbM zBYNE(1&ubdgTi9+m}hilQGf6tc4s9`ed4WgzrxIiVSLiUqE2I(WMn)f@H};sihdJh zKOg>t+*2wx7bFU{rgW8DFDW9syVsc|b?_ z6)WowpYQhIV18Nk(a!1_MB#k_|IFy2dr2SrcIOnP#VFlZ=^JyZAwCXxAOphu9j$)K|tfhCCy182eomSG$&grcGAj6HEP$-)7pN2ykuD3B?mkD6> zgHbI-h4U@c6u~lz1_LKpgM0akm4T$z6m60=b;JSbAo0Wydr4H)c6Uol*3m5wiqeJ6 z72gRdtA+TvUVdgO2!*9#PuzMP25t|fx3l8nS5jV4@Id5+AW-g&UKT!9BG3GrcJ#~7 zXX3p)CptVFsKY_&=ha-M2C#=p-s#7xE}vH352vTZTSY;=SqmSv6^3<>(j{?!PZPED zfW(mvcF{b{R8a?0mm{RHEnEctSi+5|k3z+rZ2Ae>MHBH*1v;r1qgA>{_{YgtVFos8jqo;li5&Y=!0wfRfSkj+&D*V>EJuB=nR2mY z&Xyi7FcCKE&k&ylEnL+@s}D~TDMcU2;rsAF`=fB1U044qjtj>kV3axIdse5R=HTH~ zYmKT|j;$+VIN}xLWY_Z>*2_7t4hh|yNa(d==)^v-5pmxd;gR9H-UB9o<=_JT_mF8d zr6YlK>EA%4h(}dGukk|CbDM_rfJHdJBTRKNHB=vk=*|r~)9-?9{G+`DTb!35~fzv2wdNfKRK_P40~%%!s* z_D(?<*tbvQP8qOK^j>Ud!x5-@oD{FA+FIx~yl40?e~f?9i~f(OHfmG3qBl(T z0T`2_Vj+sdp86sqF=YQ?BAgk}Kxi z8<4itrq#ro!Fq@%Rk+744ydAeDQev2lGL5-LS-~@uL zBLTG}CSJnblfo!5%X;TiAlD_IJZk=?iXav9i)a8<<1aNG!>NDD$*G4s1GLR!8R;!dn8Fh{(m^eCX%A=ePFAmW$7I0B(3xY0((6Ue+g26T zEvNH>7JlzwU)BalN%%&`n-HP$HR^!q=hmQ}ebm&!Z9EH?G+(2^96{x1*Tq5FsqN(g znDY6z8@OlBN?U2yswXi@_ednFCM7;J0C+47eM)koYQYuK$}T+}*QU%VzZnSjQf7*2)vF1J#(+#`_!2}a*opF9E>k!@d6AR!@dMOGYx!us1X*vt@FGt6*+rE zD>oO#`0jB8xw`j)zLkYhHf_w0bS%8{0YbmJe_d%)>(N|W!Ao&VzcfcKnYcd}@VrZ0 zXR^XZ8**M6g)&<^XH^6z$2w=jGr7L2es~HD(=cU_XX@nXakMkDTe^bvP~oIfsPih@ z+ixt{R!K$|LN3_${>xKGppMF3w1z;F_P9ZQ`>e^YtcQ_8mW*DLY1;Aw!Pyf*pU8Q< zowt$y_PDKA8}zEh0i7wS3}onz=~UP`{-h9f;N2s-(K`wIRUc;&crZt)}Nu%&-YG2CS8mz@}3LrT9Xn+dCQ5@Jc zq7r117Ohn+aJq4L)L8b2hOylBGb#C-zcoNUJK4d75~vnkz10&7v_11}84(Wr!VX=o zB?r4${x~~eyP&cs6zDHT_KeYeLniepa#~?pe1WGy5ri`D=1F&l`QTCspmJl;?Nezz zofo;{ORk#L&d2t*-D(JzWyZKs>yFu8tEFFwfYZL{fW?I;fEK(`Tp^$pX9x4i4%wd(94- zK9*WrRXx>GP*Y{N(84bLv8E0c;ylO zw5wu^^$zeVWD2Q+glDUfsA3Xr6S;vRT5sNXG2-|$v8_+H!y{-~Cn1O^CWLJ9@y?cr zAInn5a(`Imdg7cQn-yf9SDIYCSbR?ho{kg+3g$yl{U2MA-fk`D+TjIf<)Ck)<$+)B zYTi!gklr+q*LwQ3`YX;9Uj2!k_J>)q2ZfQkR9~nLFn)$mo_?6#tX?Im$267Z6wU|T zCJ^^9V+1VD81{#L@IPMZMf02VO(O1)7c@$0z`ikkF47^t1R@ZJOzn3depi@(jgr44 z!r$adf_9!%gzjkU?r!N5p5yIX-xUFglZJ&-IDGTG1$L{C6!oZqEAtM=ko)$P__bI) z283(-rA>b*Z;KP8KqSJ0R?c^td&|iv6?8RLOt+T^cKNlOj+wHD_4uvYRNnb(}FD}_*! zf>*aCJiU4K@Yan_RxPbjYpat_51;?1&lfG^MD|4<>E8C8bY1U@DM4@M_D|apH|Lvl zmB0UKL4Qf+6pofPs&jUzy6&hJTMT zC8n8YL~z+Nh~&G_s42aX)c|fz;A5lPmURPY7k+16152LptkDnR*XdF_3Hfu~l6;Z1 zb6#j-*Snr4+)C7K`Pfw~hkygH?OH~3Sn7BO%jokCav}yR%3Deu(MQ@ABP_<&?91na z@&>x?S=+GQ0&LJb%D0WrWy57csEKzTB{~n7K1z?i+@T76Z`%|&5Mrc7MX2q7Q#%`V zJS~+#N(|}I6ba`Wfu}X3U&Ulb{j?^h60$d!?PX8DiH_MsI@84OCM{PQ%e--U#If#b zS3SHkF|5n~1$L<^aT6VZB4yik2zAGTx>zhOCE-jToHGRM>&BlC(APqFZp}K}C|YY)vH!|= zs(T7tRqbAgpOHlO18VX1LX;1mzgPQ$ghB#N7Z|~=o~2%njsjg(UjX|A2NZhFk#(_h zkLZ8?j!wG}|1R%l(71S4t6vvceOR7BlInDh1Yg9>H!f7%NDYPb2UuEDSB-LMK8*Jv zQPh5^X@5i|^jM}E`VxLzru9z1##Fzr`PUHc{OIJP6HAu&6hN!!i2?R*kq^7-vR|0S z;Khwc@Zu~mE5G|W6s5ve2{&L9fa#;>b4&BEVkq&;l!%zdk-qL2utR|BNQ#&l3^!w` z>Wttsk<=Je5sq)Wv{vjaAsF%k6UY`yz+JWwb)4DmIc@qlM*Nft0}39XiFbP>sCRg4 z=s@TV0LtZwdJ!pJFnTs=JVI*oI}=9PX_YyY6TEXgsQvy>&~*;<>PD|oE%f@z@{~}_ zug`~V*qrGkuVPL1}y#p!l|LyJIm3Rss91F-VhNP_Y7oOZ} zZ{pY%Uht_EJZBDHk0841`F^=h_W$?d#IR>KDilfAo(6|n>9mHK!iE}Jo5Izz?UkF(9Uo6y`I5VtDAyECy$|&a~arwA1k~f<+!Kdaw zHiw}3GB&LakMk9AoPs#i+-p3*><%pxO>z-veE`}DeZJ+9{A@#Wj9Ts`k$URSS4{oV z&7j5MFEvbM7tg*mTdng^iDM=t$1j?O^0SBaafw!mkstPxEV9IzQcvMXswvMI$$jY` z$!s=U7L8_po9)$Qn8T3CGQ8bnNDhxdmcyONhNC_EY@TVo*^oMCv12^I>f97U4ZZWs zbhzUsaDR=;mkXpLXh(FxNFll%I`H@dBPs5KD?*JzQYiLwE;H6EfxAbvLW-W?PHNZ- z)e}cikC=G6(bz07xC&OyZU1kiNA6}V96?A^fWHm4#Tsfh<(@1(-%p4l?-PuJ>2o5p z8c1qbQi3oZl4%_T%&*L@_g7(6Ifp>ahIp-^t0c%8bCeeDc{4|Vo%SxBK1cKIYl4_Z z=B)!PgYxQ*zbI4)OC5;rv|ZWmz=I2WKXW%6-^Uu?7oEvb#*4h&-9T6JCyId&o1g!{ z`JL>`ZMtQQ{SL{iuCweXE8?xFdQDNns@~3Hz(?j&v-+JsZ!$lo7pvld!K!!5;%#} z0UD%II^QQd82?WUN5lcGeq;=*QDlT~0*Sz=BsX9h<`dkn&|@3<7y8IGB8W&6CKfgo zRp7k25!|X*xwN-Qv8U0yEA-EESA#%J@0mY*YQLBc`=n35oK#Fppf-!)#12gXz3< zu4}_rpP#n{;w_w=xx}a|aLx~OSIkE#3R%rG23#D3$&Fi5J&>6H9zx7q1n{%w{lGn! z!}P?e6}YfJytwa>y-QVJiSK%K@g3bkmmv%uO5%&H^)H_i)bZ4(+0=T{-#j-7IJv{{ zcPNPQ4$Ha~rbB%msV(R<5R`YYVre2mGp{*O9ic8aE{pjIrbc}g{m%iv=+v3}of=>2 z&tGtvDPx2~{I|CCNOAx_WF981&*^*Py;}KS_8+@zl{laJ3@~DZ88}8Acm4t8^iGbj zni8YPIn8*D`DP7VUCF-=0lLa;T_Z2??@wyUBSVMVqC_iGe6P)RS6&SWJ`byWwz68t$+DNdgKhn&< zKn>>2oW&DZy{U@d0)bd|Y2+*QyuDb+Ja$C|a8;=%hD%+bvqT-F?Ro2o@2%$x=?ifN zf`Ck<^WycU@|1)wRfJEPEPhjQ=k`d0jtve~ggVF0+dWK}OXX&n zU>iit)XzHo15Pge`H$|7ioW|mSeoS2FvAiB7hfFT(zASwl#?yJnS23z41)zbdWxzu zQ8j2L+cl9#_5){}skiYT6M>YKul5juHUNt#_vtY!hlw{_qPL&QgdXk@vUC$x(el6c zS`LD%4}&0+2o%{w2$%f4RiHtU`HB;&0Xdq_19q?iK&%K&lz2e{nEePix-73E5;nH* zO_9epiu9QKauQr3MZju_&M}Jv1KTH7R7?gK{4n)`1+~QjzJb8=&~KW)3j(KgvUVR~ zL22itggjBubburdbQUXN4W5*mGko3+Cw(CIc>r|2mnAX*mJ68d5~y za9!c^$88DnjLT8|QUU{m(S75$IVn9MA_;I{6ermwGTtVEuX@lPbVScRJU4|YICmE? zG#)PO^bG6E;*ddA4&A%AUdWdZS~W(DO~q0sG`0En1RAWhIG`n{cQAFq0dcW=<5x|1 zTVk@9X`w?Yz7iTL zqF3J`*JNR=KgYpT+1>$C0r6VBXTNmO85oI(N_0Jn#3(}evj=@E z34rvu(<1|9ae&oR-ZlQuX4`?Mz6yn0VK|nc!>tG}BT2iGZ^JGV52k&w(N5(p|HN6s zOvD52Cd_kcitR)Z?f!;+x0LvWyo;)u-%w!AUQIR`tS1Ox3~e|Kvr0HSCB>X8c;p1h z)kaz%V*@=24s*+*GomxG z@;=|vT`=Bo-g8c058~LMJ(Iw;OufadnVCrKVp6TvMr+u~Ln;_W+U{ncH#gvxQ-CCV zQ2%b!TK85!3Icg$U?B7q3@$u<*uOaAX7r3!T`&E^^UV7XnEXb!OARblOXv@k%Fo$E ztrdau!jH6GU-luYk3fAmuVfTKS54>Iz#(2H)6XH`m-TeQaJ=juuefZfUA|R2e`(#& zOvM0`@bp2IctRxAcpx=6>e4blp#o@&6P0^9bjp>lxoe=luvT_B!)$XZdtK)09Gk!ma<$b~=CHUL}GOZhuZ%n+r`)%5C z5H5CP{5%4l5m&jrX6>ncufUZ~D8S0(zyaQ!t|ubVQc2L8YOa3zv$pvi-}h6hU3|m` zeSZV@8OoYL9KuiP#=FPd>jm2G7yKX-54Mv2RT2`RsT?5(B#~{`5j$A7wKO~n86cBg z$G>W=)UsV*_#u|T(+&4Mk5oa<9<~P7(4^s6;S<8T2z$$QlJ@lYb!FqO&U*~BG4*|m zPbJKQ-2L(U$O&oi*;6Ff!)>%nSKRswCfEbktN&~Du~$Ulq}cn?os{z@2^zwcsS6aDjB!dj@a9QvK2FWg&s6i01B zoY8B7tD^;2^$h}bcSB-V(3g0!bEu|h=<)k>kr+@es_lyC_8N?)4)5lvD`E;dJtZ?l z_aOhw}J7KEz>Cf$s4G~wDe|TyhnO}@r<8)@X-}e->Yrg7o~{i#`$t1%V@&_VeKpuo{xI)*# z4%GOr(g7J$mNEZ$7o#UYgRgvba#}-@jUv&8Qe`7Bkgcfa4 z6q^OL!A{k4=;!82yn7=i9eu%1f~$JUd)tj)4lTGBMYevawUmtI0IU(h4kT4?>IMh) z8`s~WkbbouqffN`&xsClRU+sZ9CiGG1UNrSm|P3s6ZsqR#iTcd8r$Jq=MPQNDK(_> zvbc7~0pVo?qTiLlCSThd%rx?Yn}`$`2n1y^xWCAk_~0NdBT!$v4W7MnV~?XPnaCNEgRfu4a@5<|qqJw$_iZKKRyFIl{tS zU(m1A+0~f11J(M8D|#D8jaKs(!Z<8;%ZWTdC*mNX?UZkl!WHzhw=(ElMhf`#9Ickr zVL9ArdKz+tHv~4s?HME~KO@(`ngwh{Ybrd!CGQV-G%w|8Dif%KmJ{you3OUKBut61E_CnFC5V_z>2`( z7(r}Fbx$W!yX65|qIE|tDt7P9!hf3j~5ei|*pF=kI zCI}4-W-4S0Bm`c#h<#xHvZ(fabU)kztCK_kRP;1~3~T|lxMD)+jrk6ee@Z_z#QdL8 z;^{KLP7cR*w`;b{QVNodk0_fQj1!1=8^D7!L=cf}@8=6Mn&H}#fiYj={YC>`OgV$R z0gade3y&FYLtqkP3*der-px`z#exRgKxb_j(KuI0j#$Nb((PhrV|r# zcEO8AfCawt!*F!K9>hIZE>i?h9l{FFu;I-kwkezLJW!(07 zihb@>KdT5*%S)Oq`$)mSkMB)h=1>3AM*NRTwa$eHqrqUQ(!{j=<3U!1!*WCm7vS2i zBY?ZI@>4}36eT&ZO$X$zqE<8sJQkF)Ye?>!*puG_;ZYImTXJ}+#z~!>tGP}hKqd~z zUub|2ts(cxG3+`FRBy5&GKT7M%5UUJl}2A1=vRp@Zh0l>*oSu+Nm&=QqQ_Mg#0WY- zPbGGqcLRtMfLdhwxXy^%`LD!V4CC>vZ#b&Lu)^z<0Q_I@0>R+u8ZI&BO?L29--TFf z+xxL7Als~jQ**5L4wC)8uy9vwH*agWB!|1J?H6-nFq-URMNYE3-!Vfxs}79p5fN+9 znLfLcy>@Ay)3xWB{h#aJinFIX*PhF@TK(HLImJGd8@1nmU3AW-ZFl^yt%X+QWbS^R zsRW$z6o-ccH=j@jAin2g-`>ln)s|jiH`Ro)TNhMz0e7t#&#B>{L0@>jRRNXNI6Iu@ z@c+Too5w@d{_+3UEV5=Sp;E?VX(5tIMb4n?MM@~5RLV_Ag)lRPkg|vFVzi60l~6LH zWJ%GYQe-CENEpU8GiK&|FQ5DO`#!$^^-tSzo$I`p*X#K*4`anOA_YHLUz1!h9yIQqsT{df8{8xZfRkNnZ69k!Z<64{He=6JCLd@g92n%WL;` zw}j>d%S0-lX}O>QdbIH{Q&np_9?GtYMQC{63V=VCjOyP%;Ue)V-`$(P>gUQ&F5ZSH zXkOo3aIs@BNrYRAvdeZes|ScOr_BBo;HsoHyTIwCp#}^LzofVwGLrc(J;fc)AHRx* zb1~#oHt0z`@~xDRFBN?v=iw@mW_mzw^t^%~Z3`@%PL9OiLN;ynAOO!xYU$@yA`=JD z@6bfK`@u3*zgw{vu5IrHgyr$~d=-Y01YctG8>=s-R;kH&YfG$*#dWcnb6P5~oo2!R zIbU`)aci4nh5CPM2vjqLHLvN(^JxEXYGe_;BRZ41R;Xez?UIaSS=0U`qOvdudZsR< zX82}#gcZz5aImZ%w6v~Q+~8kH-7CZF3XAze&4|jOGO%gE&$1>ALI+_Useujn+nh6GrfR;;{A2Dai1H@& z+7(u~7n_oPWfdvWjx#X9ovD+KlAGZU!Hy#N4ywP3&#t9ziz|@j!0*P)FpDy@q8Jo0S^$4xCPM)HbJAf1sU>2ueKXg;A7hZLsvR%Z`JyukW9o-=!s6cZ) zF>-O5)70%nuiHs9Cs8V!JHwdI*PYjKo-JF95xuiahQW^(_%3+$IH39?4cFj&bnd?= zn4VB~Hz`_GF^COgT==G^Btvzl;V4jVN(}wp zhfJXkJJL~NTrVU->rW;{A4-?R%Gn~{rNG+&r5NwfeK{KN=(Kh%T`GLOVinjx>ZpX< z5_bPwd)!YG+ZObxub6Y-s43~k8vw*byWK>dN60NmyK&odJkLkB&YH8h#`as>CjBJF zu85v|1J3t!UEy;-3He#ulxz(p)t0}E#9Ixc&SGDQbJ~#6g+6KW5#|ozcbW5L%(+%7 zCN_-AKt7>Q^{2SICn#-0JQQyYsC?fRA{e7XO;rOi8S(VUOqhEP+kb)bArg7@w?IaEf_LWIS1qCqKnA9VS|kkh zr21Xr7FqW9!TS6{T!AV?WP0CwnjZK0@LR3QGWNgLX5Y1Rr*oN~iQSHHULd~l3d-4X z&+Ex10G35-Rv|dwBLvSPbI&>gbE*xHt1eo6A71fJaQiU4Pud-isTuX`5|zZ? z4Y5liu2Yx@PlnoI^FIg3?ef~pC z)R?&I-P4+o!h6Wcz^rMH`V&<(-x>Dv@V^ZcYM`SLLdVo0GN=dcQNNDQ&E9+u_xo2w z5g72Zy)RAd&m%5@PDPldCu39o^jPi|z5dLMx~E+onM1?v!8z#=5bPHz4-XHFet;yH z4&|b1sT#h4GU1A6#2Ki(9QgOrEi)TPEZ&;79P~I!!h=9+m^?y0te}?~vt*1>5 z2d=CWT`^>3HP*S!x*xLoptqL8`AogQ_KltJRqygD?tD0_OlmsUvseZ;h|HleIMQjI z&-rMFe4l)-+jQN3|0Di4%C-_quwC__^m6~BJvIF&F=ekMh!C=UB z_k<8k8abI!1%rTK%XG}17f~ThN0(#C)3Rz<_EZ~U_B-GN4x~3CkekUxJu-dpF;^B} zWF<6z=3h9hP46~@6L_$>y{H7d+kv_@nv%Xf|E2Vrp@U+agj(k|zfO4n4spGM9OE9K zO?{1CKO25)r{pytA6}qd8VYraN7G!fmJT}e2{i|~^RW1ml0l7k=fHe*MtX0v-%{*= z*y~*&o+i+2Wnu3eZc!mB{G(zLpu;_swKqqp`k z{$s?hz8D7@ea5#7T=eNIg)9tB4pZ-ciFme;-s&IrmYAtPqTjc#$`rnXE82J7gm=ETQaKnJ z3=ow#s*7a*HN)l&n{}^%T_OL_GixZlBEAxqL2tlX5kU#oEM_DCtvYM8L)-iJxbV{e zb7BzH|7=)K*qsymtm0Ng<|`9**f)WeXiN1q&6yY={CHp}z0cB*uKJZX=Eb+}q_`A)aN1XJk>Vq13HTuF#(PKo;}7D-(^2 zhtYfFWJKu<(zZU{x8XDNJL==NPFaLDaP%a1auytI4_df3nNkG_7i0ou)OntJH*6+k zapc}b4fTHw(;s#pGE3V2z!70us=CGMnN*Lw{P)W?-gQBu9A*zM8ugyCNI*a6P`mts#TIFhoK zL)EQE0*(lBNn~}{nTwSnC0DD4Lmqk*n*9_3)Vkl!%Iw4e zxT(!d4;aYXvBBs=f7iAP#6afYLvJxO}C-F{wss){j!m|#6paeJ_rZklcfsQ zxfLy3+3&v%)%tJ-ZJcLEKMU#3XNTO5r&}$SXRN{kogC4_63ONTK(e1HzROF<71`QP z*jGBu+jqSbD_i6^oSU)OD5y(?&F+Mf_B|+04F=`ZDx{^aE)G@z-WPhDLSfO&QUIPK zY9tB&eRmU_g}rGL=HA(E5^zJa`GtMo$v2H19P!SIECuvoKtC(U*Kg?BSA(8ZRr^zZCp|19rL4Xy)c4Kuh8=2pb~z z8tG~*{@S#(BhM~d4MR7x04*PD**&%%Fs#X-Q{!_l>p%a+Djjxzx8cFzQCgS0FE#E*4si=nYKHApx5EE+L`x;ONoB;MzMO2 z$Pw|MvMpC?*-o>x{dzK6B)uJ<)FD41Es_0GcCv#0mO{8fO#1Ko;XzXL_zJMWQD~Pp zOn3t`TCuciO4@mfxM44B`uQ9fAXJ~se;`VHKQ*hcOB5HmlHCmq2y!ReJj6bHoH}(? zV3;P&_qy5I+|M0r{t!O8RMIE)Q2qJ#4mnM@t$U?HeQ+7d4d5v#e2Eg%gKR#BM_-@Q zj)xD8)?YlUKyOpBoLhDt3w(JYXShy69hfo&2mT$tW6}8o#2NBcdrqp67id+?CU+_{!#MqbQgE9YJ!(QS9jUZH6 z5Sk`A4K`SR&6|LeQxBIhEl@7%p7avMt)DF0IX1WZV_RiRdF^s|hmwg+8517w+|YDX zN&G>Hc~4Tpctzz^Ar`F{AezBRVx^A4@O8gd&TNlI!Va!{s6}(Vs_W*(TZlxD%noW= zD=54Sq!@ijbQPlXItIU%*O@bKJEj(P)uw9>YV2;iD_!H8dP$yq(6h8GgMXvHH6t-c zq^!#G%@wP<3FCC9JSLVjr>TL#cM`)_@HkA#trc4t!*Gqr8<&7~!Yi2<3gAreqRr9g zylqyoGMd%;EG}ay{+|40?j-}%r-$KN*mF?g(gn-1i|N8sL3LvNC5Xxb{(7?Y4eJy9 zlMj`EjgEY?2^jD>^+Xh~Uq;E3s=5dwm1^dQyjM{(M7ErTy;^G)6gHjmjQ1%M5mX@hVNwsi@XeBS)gfi+RR+V{3s zr|m4zL*~+c=5IocU{%ZyOj_syrOA`^JO|b>_wmIcThlm+ZbR+g}|KUhc!_!dCrQpUeR5{yAZXCj6C{Ta` za2II{ksfFll_MGdkhZ6p#yWWutey^ z_y0jP6gQWML!k?vwho0~5(@%z_HQhzBPbI!>9TfOCIZJ68a zs|qDO^@PAMMaORjgBFaLhmU@pthXE42dn3+A#@wsc{OszZ=E%@iZ!Qo`D8iEYi;75 z1M_{JVKMQVVT$~#=WzsqJSnlq{|{B2@<2J#PlcfgfJwW_Z-SNqVArnD6D6NWwdhSs zoY|r4CcLo)F!u?gCkf6YcF>FnM-YZjjW<7ab2$fNIAzC-4sgOhNBveyOuQGJv+Bo< ztr|fkCW#$)b15)-5)M?WUVTVlg;4ez^G!T7S|S37etgXg#@u4EaTo$3Y58mLTZ$FU9z} z5#xJ4nS+!|gdlJ4R~|K;xxw)J`;LkShA2D)*-A_)iic#MW)9Dwfz_`G>9iMNM$$2J z?LPs~1>VW#JAO9C{-(*uY`h8GF4Wp)pUdERYz_w(?@ag|W%F5je{#U*uJ!+3*iH#o z{IShD$IfPkfdIq7VZ1MLaq(x;(tEL~ohR=&NUS-FyR=!p-jLQ_P zqSion4_J#{Z58ha04{9)p$3ODT$?M5Q1CTKqY-B*|`YP*i9Tjysd!K5lz z62bx$r7-(bD$-%HS)n6b8_3AXQ3jE(*@L3%uatlRP;5iKdn;kdKfPiia6mo!YlrI- z1u&}G?0S@D0ViQms3BR@OA$YX;|PWaPBPckz-fmWWo>yYuE#6zh#hlaNp?s zd7&ZDXaV4s4ehB&y6j)Rv|YUA*FD!{ollrK%;cF#a@<;sb>*LLf4-d4U}ZI%HhiBh zn=$({=5&}v9|T_Jkkh(!Y&rbNQ-0nPEjRg;6aaZ{Mnlql5^tVvg zi`{f?(fA+Y6)Nrgw4F@)NTtX{3XIglQm3aq^xEy6zLise35`SPn=xN2MDttCb5wXY zLtg@B!cwgFy}WI|7Ws9%7p{i96PUYnl+rzGqI7oGjWT7y)uL1U@2hKatZ72=&DC=u zA6t-PJ7x?7gkm)9|Er~Ym{P#fu949IXDm2OZm$H9Pc|2y=&T0L;i@KtK^ z{0X?cVV77ci7%%xs(wpi_4+*CR8nt(!dEY-nSGbfm@{in#Q97T79MCt`jqmw4(l=@ zu2jDK9+5Epk2P&7%A$euSR_63jw%y-%HwlKp}IBkwFTBiP{w1Zf*_SM1t;TuN%;DH z*2AcXCV?aEP(08KUn3}MLs3;J;8`4U)Uxp&g`kEl+|fpzV$1%;Zbd5$(^fv+ou|5jCSzod;7|?Cp$U;;Avq%BIr`AHLK*~ z#*O(eQJ)v9OC|pEBzVE~cNvW!_PVE7{!6e$2MK`EBPTXmWw^Cmj!9%cY}Dcz6J=To zeJdc~S0yI%aI$CyW{laP37fa&Y98)Ue}7udj*nw?WGEYt&%XDaxtbzm5dAJZcr+(5oI zSE8k32TH(}^aVvZ8?TcM4IICD&wvAyr3kmRk zqI-qML=}5ERa+sXJdwOIx+3y^ZS;Bcrz%8KWiT?GoCD~T3QB9r66 zT9VZ!Ke$++j($!Pc(*_gb7mcPZyfDXv7iV-D&@s`ka5B0%tiPfm=kNjajCil<1Vat zO{3LhO&8G0S7&#c!>{=Jhw<}Pk@0XT2?{gLHQeW=)y68?M_nFjwmeo}B3tx4gQ_Z7 z0VXVXS`wYSE>mmaMc=mpvK{4-W>~^wq>)t-?Da6oM9Q*#lkTKdf%#nGs7Da>?>q66 zBLXO6J17Pk)8X8Mr+c%-n3nQEs zf)_V1bJ70#=p1x?16>hZ=`rK^vR}-N=1m47YsJgd`E|x!nN)@lTEK?oXv%k`G1j7M zWuni=ypvD|83<{7a1QjHvQ+)#TA_03J7!FaGX#i2)gJ)SL*ZV;AC-!b)O= zZy5E|6V2PlI>^nBtf{hw{O7FqZLv~%gNYlWBKEU%H-n^wVp$1GU2KS68&HiF%a!fD zV=3QOH{#;#Q^nXEAb1>1;_qImEY|rQ4DGC9!}rl=!@0_5Vox{(v1BucSEXQ zE{`MHF7ye^U1^#KX1p(q&fVrW@K2Fjg-`Z2`>e2)75d+4KUEQFaRwB+_A3~o zAp?kMX6)&X*h|X+doh3tt=Vvy4T@ONFEpK>r~vjOsqVR)+z8Rjyw$(aP;zP88CJ#! z358_05_h17m-#dIU7Vj+|AIR={e_aaobKSie3GC&nY>5TU~`4K!C=x`qq}E|tTfp2 zJd0E4cp(Fo!CyY7QMr1m;Wvbo8)HF?;|<0V)mUZxGmo)qnrjGi)p#{VGn@Y z`>Qd0O_=9S#>(#6Dbrik0v}8s{*Cb+p ze%ObvC`-5Q*D>B2$C{~%y40eor3QWtzb>VDaoU2zH$gMO?$AQLd3@k%YY>B=nqOEI zlEr^Q{Ir!O`r&M*LWxPy86w`4Upr;DcgjfduCC}fIsfm`$qj32>5WpXd%yJP@$?@{ zL_N(rp)wp5QzSKT*IELy`Exz5CL8|9!4I6yENw79@Wpnes<5y0pL-$4kW74n9ll4! zsmBB;fyf=LXca`fP;t^A+6i^&gxEFzY69bqpitLIQtlB30X=_BjicI)(K zP2?F&99ll`?sAcdfH7o6o#_?70)CyPQR5ykdM#u*SQ@S3+X}xCG_e2G?VVyJFUgJl zZD%4)wewXst)kQNz6nO_wiU@-{P3A@<>Q{)snJpaQH=CIpwMq-#6t8^z}hOI;M*9e zCZsrT`Nny*0bkC_9g*hTxdYi~n>+eeWydgrilz=5o{mcwdW{#Tx0-nomS6OMt7J*r z^;l{Pz1S3@;o#X@(h6H$GMKRX@$GZRiVJ+YQ;Zx~p%t=otef8$`No&?@E!sa^SmYl zpdc%0LxZrQ6KR9LvFVv8al+t_2dua%%CqhnSO6wYTwc~R;k~RlWFx zUnVhgm}c>#ngUFGWp7I+MJ7kAydSFkP#eqDEq(u9yjMKcye&EsB(HWwQqq*0>n?HMQ^2s-W)`W)jfUHr%pew|r@2Eq^^S-TN@%9Y_NS>b=-N`+7iT*y%~zv(f9N=a$XnA^aT6PA z77MuiNv|%e@cT%cxMSBLzgUa3$pM4A9+He(+}}KxP2#|D+QxU~g~F<1P|?r8N( zhwGYzoE%zK*tDC?`XG7WG8!Ukl#CU`G?z1Gp3;vCkfi_;`xCJs;cJ&gH(Zi2jqhj7 zu7`%ne{0=*S5MoK_VzXgY6^_U>Yv0**68QR$pq-MtNJO>qjv--mn5Rux}m%_RyLNirQXQa7CU? zl2}19ja~zVweJutk9uLLuM|Nr)s0&O=cOpbw?;y*;lE~|EJYo7-$eipMxsf~p;(C> z-_k+6*I9CZG~k^Wt-~^x$w*GXc=T=c@%K^lqn0Uc2!n+PJ4MhUkDpI8DuP{xxGnF8vyu ze6Itcdp#=4?9X)YV+LaaUtaqI{jK&nn)`zvbRJ%b&+}Y|32qdCrQI>P);g66vW$H{ ziGhEp4Rhwn^!TB$K)U+4;tF5!uN!>xi7n#%JtXqB2ies0)I*TkGh)Z-+u$S#xuWvN z1v~Q6NZlX8rP*^R0ZMYlSJF+DU3f%o{L<95l?>U_xUNWb+Sg|U6sIqMAu=gDq!wg| z(r~%-a?KwXwiabA-@Ke{ZYb`QBtV%-a%>BFOvdk|6(Nk(z`~}l#gKbc*i})It&4)^ z#V8c1y@E{NO1jBj`h8X5-B7so^AN|SqXt97UOC#V(@_5Z^h3G=k3_H*hK_gK!qRFX ztYz~^P>}r3#uZ-gO|<}ilhNHKMUo)GdKS6@IG@@>sjCL^{|qfD3Zp@<%_2bhShYBl zA>DCm6GV5Uu5508m_FdBb%-6FI@M(9dkS&Ra8~d5XHau$h`V3!yvk;-+NRfvn6xeG z^EwkTRX+07`UkKB)HD#gb860kM9W4Ck>~&2or#`2YIwEk>mr2qm&_@f#e?5?=$iInU~#mSuVnKuv__ z%O#Ta@giwEtwlw;)Rage#1CY@htnIMVJrFreVbc z{RvZh2qfd#+25u&+@oI<`L{Au*q7y{Eb%@L+YjUNe5Gm_;Iw&65a@l%uhI+pmsW-6nRH%`*?3uXb9z`5)epOZN zhR=MPBV=Xg-1lb^wvB&XebLf1(8cdG!r{e+?zz^eA1c~PMWjtQ37aYpZ>`dF@165Y zelE5M@Gx!u6LPqos*hglV?8Vv+tNU6!=n$BfMQ}nip~FC{wRrVVg28ux0R0~Z&l~H zx-cIMe;JxH<`PS)|<`VQ6d)xnn8bf`LwTN zT^LloLcZ=Z409{Kd`n3gk65@~{+WEuMT1Glk2j!PRL~{0xn5@g$wgn^He%@rg+`@7%SuaWq;xsiog^rkHBET7Ba45a-0a z`_SDSVd!;Bzsb1^%&9$n{U)rYo~klDPD^g7BNNgxfP4{l^BECsIlv!nUuOMz?&L_& zEqX`>H3(|RCnoQ_!n}T@7j6z(#&BElFw>ZC{w;AiQkuuXZg&WgiQ2OL4wxVNW+#~c4+py2JJzD9fNSc?M&woUTG}4;NEIsHZ?>>vm(dgUNHEFNW#3z<_7{?(!K1W}-B;LVci^fU zNuNWxP_?0ig;VwT32B}c#cp_z)sQJ%$MAZb_U_!W@SX3ki_(hxgHBtNZ#XT@7L-a6 z&@9**In3Ja{{sjAdq~VvK`Z*pT&!r77CJ`E+MAp0FPgYqyQ zz_pV!OkrCC^?iQE_%#dpVF&)1Q;#QLjV=lhDA=LI%=(^X&?PsP4Z zsG!XB>Pl43D5ZN~I*&_qc`xHd^40@B(9@z@&ucr6B!K!Au=y?h*z$6T*jWWFRF)_> zAux8E41c`{8sax-Oo;2{n@i}w8d_VF;4$8kln(T($%<=IWyzprZ1g{NT__%Uk zVbh?J_K3(+Fbm=VTrL#K@zwPQ8BJU3#k93k@N=CW1&cA0h*F#R2R$0+=M%_8Qkx{n zcDmYi)oH&}ess~4OlOz;skc$swF5exk%fWAOpfyz-!$d+VTKauQovjhm6S-7gnMOZmUTniaNl~y z{Ali;KEl5q=-MkH*jY!&!~3?;^Zla%iONzUJTTyOLglVVvZeNeOmdXHI3f` zm!Ivrzpigpj0>->PoG>TP#W)2-?`(bJGo)f{UdYgoPnt;VVdRm>M>F)?jCcsEbFc& zG3lq%$)OeL9T=J49bF;2XZph{+A>jTtJbO2m>D096cgP!yA~c716U}10H%-7UmdSx zsKJA4Cc1(qQp%u_=Y)xA!bcClQQG_e`vDPWJ5%3$~xX&!NN z^BR+781joss5K}b2+6olZ{=}6UZ?7`AwrkU>5*A8B!^iwHwn~RLAcH&WaPnyYLITy zkV^us^?h*pHb{+`L2A5VN+T-Ic|;;Fip6zWe4mJ;?mK=^wQ`5`wHt4nLKYTU#n;q; z;;evA{pWSyst;!~g9rXC>JJ`zD1*}$U4gnG`3M{l2jxMLz|ZG2G5##){GE)sRpZh8 ziqAEQmV4kbm1?h@B37t(rekRz+(CL6_Dt%wGcw?)05!A-fKOSmf#@KCbXvVn`@FSL z4Bofu10FD;5SDX#tk|;QHDYTYW-I$Fb7Fnu<21s~v9}X-SKPkbimQ_S6EIr+KsZ_3 zbzBM%E@g85Z^_KfAWEv2f$Vw7BtQbT;3GTY8A(W-w1kA8=(seuYmFa|*d`*)!}P@Z zBbWB5uv(}YFr}@gvpG+}0mEIhLoegTD^wz5SB+*moVuykGE^nzHFYgH?m`j;`zc z;pT^{zH>=K5SAnxYg(Ft;)j^wSnIy)Ez;gu|4do-TQON0lLR+NQzv_WARe6(gxO2N zuCDv(SXaAS>9bLqMt1*!$H4|NCsS8;4~|e_{#lv~*a`=pTCG&|v+uu1fjg(=w;}m$ zhe3Hl_VBXObZQ}%#&(rSZ*OZ(IcN>P>c=8e)_ph?q{A|Y>0Mits?uz?)u&UMDE|}_ z=_$Kmi@e6M(D!&}gty^yWhl)(C^5#-YIsB#%z@1ly<`VW5&}VJ@nknvGz+@t2F1Qx z>d)2-(>%md_2`FrA^88+VlUM)Y;SPV~4%_}DrcVM>fblauwVnxjzDStK9B zq8dxI2N<-2IkQGe0QPcP-6omrTGh0!isR-d^V+Z=g^1x%&s&fuA>4^(8_J zuySO(#quAWE|pX(MtDdDqmK* zw%h zD(;Mw{P>5)_l;$GNO=7f3WaKawGH|bY0M`>Jppu^t^=a;7O}@Lukxi62k14&!3Oy9K=%#L*aI}W^UhX@a-5yax4ONIV{wT`7fxrsSD|A_JS?%U0v9!-nd~&-Z^w;5F?Om3?tEeHO=wH4KF~{5K z{Ugybu^B%u4|n^m#(%uTu*=~)ncQyQ|H&xSTpGB)H)C!UURnw2 zOMfLaZj{KFLLa2$ohQtlrX(|DY5(&$CP@rxuebQV8_z^_Ih8x!oYQGsst(;Xd`K#Q z7SCJp=+&|ATl3bw<4?=5hlfWLPIK{+MIYTnw%>e4cAqqsgQph}MwQA!(_eXy$N50W z_M%pwSD#93O1;_2LtQcC>uBy~a8k;9=I=I_TdeCH>3Q7DCar@_#Hyz=WyH)*x$Ehev?8lyp=EBn=$^S?4v-L#NA(pD%9XvGFk436alm@aCpq&yU#e)}R zXl2dKax(~8CDyElq}B0H&#g4Dh54L3Sfmom*(E<6ALVA&TRmRx8vC-*L^T&WsCjl4 z_e6>DAv5mToz?NQ>aoDm9NS(!ea_8$!Z+5`XOcxSx68=FW$yl6+}$&{vlWpuu2{*P zy_{OlAk~e&Eimav5oe2GhWAWSFT7w3O{b#Yoh1!kLg`KeNwN&4*MXN7d$^bdb=6sr zV3D^+SiNRyb2HsjLP#ye)@%nKU$fXeioAeOo=Jw8lRA@WE^ATJy#8MSiPD?XNV&2p zO@(S(uUP)fr$)qrNqw#fJ5mtU%~=+g`Tbk34WM7Wp8M3u8+P4{f1LGGqP89IdnIuW#K;fg^HN%Oc&0DHh#=oVS0l$l!=Zjat)To^WgOr>@ zc;NNmCICq$&N*j&)zVK2A&H?;a3tCoBG9UQlIkH`Oe4Zn>?Rm6v)NIZRVo|_dPuv}mU+tafI#uACcg8~eII>i;B zF&w~yxR8&v=6A?e+32*)7^xI=86zKfj0JdL_x~oc`$9hZhF~^WciphEPJ9gr17B4d6`I=S-9)CSnR*( z9It0-=Mq=rL6&43P$7~xPX*MJYb?)TY=C(sW>zd+S*VtmG@O7TG40_mwM&JG_TMX{ z;hyXSj48Wf5m3yRj`D5_%$}AuoFJjaAsXg;!YPCN;qbkQA61R`r;w~&zMopDetj_p z#YxpF+~D2N0J(|OFXrdi_B^~ep`kqnSB6P*Z8Rl;i4yg}SoQyRwY8Fy1^&0&11h>! zH;SR}B9dq8B^Bx_GJpgW?X8IzXC2A19+caMu9pMlOIXkaZzy~z(|}m#ua*K0r)4(C zfp_a@a3`vff_&r=Z#DjMeNF!XrN5HD&=qI^oLd5LKq?ViOihCQCrhzh1GeO*j*|RU zKdz@!F3(F_72&w?Rd`Nv{#rL%4JYWkU+`O9u}IJ~};`sOwL(WR9i zYn0O`mOX-_#*&c0QHy`4oSM&j{rAk!6Fg!bnRUswB{~B!IrLq{x;G68FRq0m$B})X z#g*xJ%FX{JBgS0Wn<;TE>Ni%Omx*FXL7!d9tJWBsOo=zVulEfghs9>tIrODS)p4Tw zX|r;67&gnTAL=G7!&5$sXOhA3SI1All%lLQ@fHRT-i>rX-lo*I~lMe{{)qE(oV zr5_3N5X)&jwYs3qJ`PC*83g4Hh+Q8JFjA-fi@Vg_5^PUB>R6uT{nC%97hkW`+n1uE$1QSmF| zjvowj0JInDZ%7+XFJ85zWXkk$Cn`?imUIUC?p>}2q zm23JInvWi0#_*!_<7+#Ysf@1sX{RmV+E?9dZjXILoZ9@E-blyMPDnBTa82q_SnRN5 z!S;%P%7KvSwV#M*6u|{6x~_bb?K^}VeMdD`>cfXSj9qGDw4tRL3CP{X`d*cC$b;fs zPfM}v7(*#IY=&|44x)gA z9+G)Y;4JEIpq>+;4WKYfq?|r0n>}g({~+E0+G2sU?~A>FP42utkY;}g#^>(PrA$Qu zhL$vhhZ?A2z)8HNPW-FNuMD%C!b2D#lnYiOt7Pk-=5R9Y`DfPEy*u;w4kEgAT@9Fh zF~4~2R|VPgYGY3JeMC-TFx_LNIT_IrZs;iBOWy^6+Y8k<3K}!}zsQJX)MGyxOCkQR z>2uKe`h1}7=-4mMXS+9UUz9Sf1)GziHt1=o<=)#dGw=D{+%h-d+{@|j{t^%FlqBy> z_r9$kX%IA`b@mRV8ge(23-lZZ%6?nSc@6lZ_P|fY5{7-14b1B|PC@~Vz@2J6dC`wCtkDG62;|;vU0{b?V7jS`1?AXJ-c8eo&3nSiVzD$yGOQN9Y+b7 zqHy49qD;4q2iHD^d@`Dw8-xS=MpaS3pGJ%DoP%X^{#P$8Dq+QOj%O6yes`YCdA{p9 zcc=QiSD*LDwyI|N1~_56pE@jjwJ4m!CRt;$1aDx7Dz}PUkhms;aruCxdFSp2Nl^E? zp$SL(M@rmK7(QkVY?CEPUzX0lDx#3#VLS}uEf;jF-ilC{LT z)}ZRb)Ei1n{4@!M0wk@#k_*g#x0grS)WAt-h6slc)kClDZC3n9PpTzNxru@`n_;Bb zI#BMv2}6!Ky$IY_Y>Zy8;Ko6RBG1fzZa%=fvEQAt>~FN~Gx$QcJPB?#!Tvjc_3O1H z!SZDxQc?CTXY|_tA(RBCdbplp*zHK$7_vPrs|yWi?&d{o_z4Q%_Zz_S^2=BBkrFe0 z?f|*KZ0{=STEjWh*JZQ`4eR2tg4u{qJn=>{=fyIx!C@A)ukH@9ne-2<@Z1VN46fmZ z>I8WyeB>Z2>wDWilx6X2o?9l4ewjpNV#v3R1c{^awnxYopj;LxSj?bPzT2cQa15jh zVl0*ce2uWfnzA@AAjNw%%(KP=ok_xrc@&a+YIoqG7;X~HNkY)+n;i+32tm74G@m6w z`HgQEL^F3XCgb|X2TYa~KjCCSJhz@eV2^#s;Ut>SH2;s6#6MaW)o!DH zOqSp+D3I~0rpi@Rol<_1-r;)eYx9rD_eYw49aaXeE`F(dnxY+Y_WwR%eJ7%&dH)%P zbW`w(r@7RtPSzo;I2NbR6|9E;0K~KU>3}$E9hQe4RB6697h4v@s2v&3!uY zgNXgi3M`&f^qn34As)`?V${8hub(y5Ww|q@N5A#)7Y&%R(hyB-p(5)C@xAAP06vS& z>Or0!q!tnfSOW8qG|3jQRlIuy2jEW_BH{P&`U8=yz)p*mnjUCMXatE|I6yxIBgHd* z8KTTo(xa-`vwDA>PDZoXzwbbUzJ5KCn>zR1O%mi z`bxE31elGY12qF&h>1}Vof0#Lf(Nx!2%mNbFWwdJmGo(ko9K*d`;#}qd()=dK)H!1 z_RrSYZZ~lkbk0JZt8_7?BJZ^n`onADuX{|AW$*8hO5doqosz<7(;4Vm!Sm&4x&lR? zv4|qBsqdOLlyTip^VF4WNX7l6bzKBt`&(%tIBz}#sT#(3nN}x+? zc0DlcRs4CW$BgVyZ+!(B=9E-pJEJ8wlHDJ-fg-q&xBt=6<()pUZrprR-{B$GbI##) zChkUwxI^McdT(Rl4sn3=IeXr+JaJ*`i2whQ+-00H4D^9 z5hm5)nH=yghF`!p|H*KPJ$d)q4xgDscpdxsJx24-fY6_%)`$TLRE+gr!TF%BFr`^}L_={kSV{ z9P>Q9P%4?OH5Gk22G`{M^@#2lxnmFpH@eDe57{|+i~NPS&FthNw~9>#!=wXDL6|)c zUHt$`1K;PkH{Hbi)AV~a?< z3|1>Fbw?>~QZx7Nu-1%S8}xu2aF&K(X=Z)9j&lqPg!zGaH&hY&BO5td-uxlP)%w+6b$7^HiRW8X^i1dLu2UC#;c&M!Q$b z1yzIH(HnSVHIUfi`2J~^n%=noR7i4}g4*wO&l;|bDl&LvtCkmd~}S^1EmpLD3Yp(s|=T0j)9V-kEXvEIUesY zCgM~L!HLs%!VGUDOOkuz;>0Lke<`O5)TSkgFNyPxNYA~3M=2}~;!3ejATu5) z{~t!$z!@dD4}~$$E}$v8Hi7J6LMtaxHRcAxAuo$~EVJS`n6>_WD~iSu#hb4~u)yw`;%nSiG~jDS8;_&c$ip#&rugA&1~IoUJafXa~AUP*TY_Kxa`;4juu_ zHkJhPYRo3wc~$*oi{L}%VkUo!AjBysau)sgyX*Y^%~tp3er%rk83-Rn;)FS|p;ewZ z0fGnxF|hA%^t_+6vFuEm96Zj&{qJ_TQ6F>=o>Ut)_<}0<6!_?ZXu^b=YQDgn!P>-nR*;4!U%A;1QB)zx0)n>o%&5Oy4}(|o z;GqNXf+jaVjMp$l1{lqnNzCTHe!n=^M$bc^0$qcZD8XUG;*PBfZHRP+tOO1+UbX_= zD;JDs9^1~#MHjd)qfEs}9*8v^c-sId^PJH84w;+Y^^q++ZdSZo^QxP2qNSPyMMH{7%zja(aRFjiJWU_Py$GeW91(Hv? z(y{63i(-~6kZqdkz1&$Q_HCu-NL2m%q2k9|`iO8oS(CA(Cg)oLea5FxntZ4-!d@n5eHN*LTc01@GX4Bi7Wku|-Y~|t#*D8EG3*^)1@#sp=6-T16)B=pRbKe%Q^b)YPw}YvosD+l6 z*jD5k%x^)512|@RxdgS`O?P&e?oRAy^;coN0C=3#Zv~&Tc^o02o0Bpj0p~Nj-eOJ?c0^P(JI#;Wr3p4vVeS+AL#ow* zsq$K~)Cf5=5cdE==hu^0ir)y{zlMp|b>XaAG6>!SX%hP1lGCG+mSbp~q>szWUe;fe z7Pf!PN{`kMJNVMwV0y1!X5WlUJ5*3pBO0PRy`g11(5Uy@l;CiYxgquCS+XKk6A)Ei zLSxX80{fbT38yD13`h0h)gN(Zernt<&aj&xc(dT5W!C0wnnb#n?7EQMF5B4>mn-i5 zJQei>iBFQ4{AT6!{P!8Ff_#2t6~>F`6A>t#AP3J9^;lP`e`cNp6=>}!aIU(jG?qWKA;e|GH1YJr>}KXDn(p}2!z{hq2`*X8>sL9Fl? z(x3V{@APOHjb%G3BU?vZ5AQao36AhE8m&=HYp>~|57lQw=Fg8P@gnLx<0Lup zM#GQcAC;Ctp$=DH_tS5r`rg$U#67uw>r#EA@K1D+^#3T@mkz&@^K`lyKf)EEDZRes ze6^cT0c|m2=ZkJ36v4M0#z_40Du7TXfB^+U*dS08BfdTp5-9Z`O!Y-t`Cv{SD5v60 zL;7O>8+SteagfE0S4fip*qHbLhX>?Q^ zU`>gY6ZJuo&}^(YTTI?~O>QgL9K;Qq98~$Dd54xYubj<;;##31NSv~C=Uck6Ll&qN636-&Sr*Q2DY$b!+;;#Xo#iqIN?h-fu`DdpTQc$oU726|G+3A8kvJA9 zF0bujEY#H{j%T!BXp1L49^H07js_#su_tXW|7s>bbBMa?+r06^jNT}5cALYHjJsI< zlg;MJiAWf%fgX-$#KLRiYqDD8T!zRkqqOOF(Qtb(b?Y;R=0T?X<}|=nmfsxbT$cvV zTt3`44yz&E2{EkDC7#$qaWFuG2$@d*3lG=%0_AhPHYyR~I0z0sK92jAT=zjj3k(@Gb>1%n)SpflF3=CD+i)v zA=wrBavr08n8Jb?O6FTeb0miz`|FW$>B|)*y%8{2$dGB$c9I3KUFR}AtPV1gC1yt4 z7us3U__P>aM^p*4@;LBxvWI1llirJE*FDtId|O~5ai5wm8a!m(?HM6#gI&xVy9URP zA%tj)Rjs}!KUq%iMIGU@jQIBe0hsu{edemqSx@)cs9>8!!djC#ADTD(k_)e3TqU=n z`{7ej=-Bg11P%3JE3nY0vFaC#aD#oX21Y9~LuDGguOMDmY%2tg|&+H@r#wCB4Ns>Nth%M=QqzU$JT)-me6 z>Gx?Ryg27H-#Rcl9+fT=t$9lAUAQhC4(Zb$km2*B>e^HY%z9_-x=UW zDF(kD1lv|Gm}};6wBRLpS4ic;Fg+pJFKjshH`N}OcW$LPCb-vdk63*Ph~x!dqkb?zu zC8(5}I&?>_`e-TBWbF`kU`hy?$7x3MMf9Uhe&ws99Jar_jO~@3h z`hO>3S4!+3m$6^`k(-3)0J96aGsJm)p`*hTUG-~jk>|Xe`-}_3CAq=w$QB+{!uS&a za|xXFVE$eN88iuybK`p%cnhoG?JUSGC#SfH2_|BktuS03P$%OjsxYptqyt#8hq2U- zK;|}Z=2Zm7uOFb!JWGf`*2IHF&YzQVw&sfbWt*8X(wk3F_lA|uy@PMg?l72(DSCzb zo9BQe>Wj2;(Pu>FC7YobmBsw0%)qi@bY9tz+?9nZH{Fjj!b2s~p@j@} z?##Qa{yrovCr-x0%B!5U_r^8{)dS@1v6Eg8NL|{{(Oc$Iw9h_Qc$tVaK0dk{Fa^C% z!gU3NJ9!nC=Tm@Phb{J5sqwf7!XD<9pPx(<%T?@>N17UJyngupe z`u4tg2<;m5ka&$i_eAQlh^Gs2Oj^H}=Cs1`tb44ISFOC;OYo`P%K zL^=+-39_NE=2@NRIvs)2)Aevly51s{(`;D+Bv|d6)QB zrM*exavM5V?D-S2?lA-aqUekHN9=OL&U423VefYsj;vdE%?_(;N6WXzWV(j0a?9y@ z^8HC}(PQ^_ds0?j7owN^L;tl~4I(;VF#{^6n#KxGMXnI}HYf1)D@VZ-2^fEzrDc{!U{3#V9`M zS*6N{C%x7Ip*#BO`U+Gas_zo{&>3`H781<(w=ttPW#K1x`%HEN=iy9@^ogs;48E6O zfz&E|FkB0~4g&B#^$7%Pi`q)yR^5;AMP9n1bQ#(a^A^zRv3e+T7{0eNCu^K2Wsc&n zQX>@e0b%OVJjj&9N-9Qa;sx6}f>Bbb|YYz^XJ0rL)-<8*1&Jk(t z7@Kcluwzil41`n)Pr%v+8A;evsaCRtXOjd)iYhoWqan~&bw6$mJ~NB_ZWSoxrFJev zt8~$e9w#*TF(&J^iw4(krW$j&!c~SM2v)q973cgftTF4e*w496HTob?I(}=XG{C;& zw#Rj0;kDVsD%D{<&h8Sg3F{q`^!s9zUBZ^UK+9~dUJwPDQpffO1_s6sym1zdRpi8} z@h=B5F3m%>Q1TGBL63^H=<_i7qq89*| z?7;+=GfY9(6IOm{i3|odnaXp0;j9CL5d(D9a(Zj|v(vjnE;5n~(Nvq~U-2MB?>_zU zfJ)9#-e}i*(&)5HP-?he!wthZ^|DLk%}X{UipjCy3nWP~*{1T}m857u8DqgJlG(y+Y3kxQdmYpF$6PRzO8s}hbCuH@ zmJl&8dqLKh!7P!rnYIQCuvYPPLl~iMzl}Lz&)g2CI_`DlSKnjaS*v>mrqhLgP!@z# zDa@a70eaIhT`z{wn~eQFQqxT;TKJ{mivS*^6Gi`S221ZWP*wI#T5+GDX6V6L#x*FU zh<6rKY@0O3)YhlF6o2t(rMw%WuE8^-(KLQDS78OVw2+lKOqHDp_{@cDqrGpMr)6`I zQdMwPkCu7PxGLbp^88|$saQGp;^Z?S9Ms<1tDw#CH7TQ9$Vn7eb%h1Z4$cq2pKSNQF^h&;LNtCMR#7Ouaa8+x z3X%2;9ORsWZKHT9v?wj0w3)GYdNIKvps<154+9{0F%3(@)IULFS1K`A*XK|#5rD1O z1kUmO{^dJsIo&c|!=z)sDaJ}Eo(e+gq$(cFO@CmSpeo>H9BWKaLwvtP8{u) zGa6q_@H)t`>-CN{x*{d0FR*-$6QQJcc{O*QSetl>>}`xVE2vt(@$>2oHPGv%(^gPAf95Htr~R9k_<{o0>R(n3)maG3 zr0tTW*_jBg4S{=c`18U}>ff?RGYk(*@Pw`0kTyU2Z{$v>TEN3xf3z0tTu-i3z{KlI zPZY~yLkUyk->PxURRBc3N4{Cb(-wo+;bw;}&XElx<<`uwb=6i%eD_xpx*TA@9jFJv zE0L;_1|6T$%M~4Mbd%{T&*19lmKOH#3QMr|SERT?XZ{`{77FI2Z&y76i6=e2((PTP zN@l{v%dHhJ^zN~+dzDgmrG6Xo`^b0YGmK@};0{KM#B6Dent08Z5ZRYMAuzS}x!0@d zhww%4wm{3RPBEr<>ggt>EABc7@kx3JLXfNh?9{jf_r3>Cayr zU35)%$hUO)t234heImb*Y#!$rG^kpY2vuXl!^64qLvRJ)Ak|vTx040BX`_esMSsiq z8?jKYssh{zG(mMO+h;WVT75{h7iqum8@4K8$GB3|+>fxE<0UcxV8hmz+$WDUkTS)V zEATdZL8*Pj|K51+m_%w_>vK@7@EqKpRT6-1|LuNDVl36xK+5c9`$)Ofm5QJ%Fi`5e zFeqmUw`KA>VYjY$w;x|m=nVf!Z?&D$Wp?+&JA@c&GV4OjVl;N2qUp~%3PP@m85^RX zi}{p#>J=)r+YXOa#db|!ctg&Lbq%;;Zu4|{57B7{weH=SWj+io%IECxV~$He14sO>0yd~-xnxtdd(6f=Vi&%T&v zR8E=TdSO6nR<`^chIq)b^kKPj4Q7Z=lrbzR=U*Ozi@5Z`^)yllIt_3cUg6-xFLJ# z>z?H&nElO+f!yT(oyYeb>XU}CJxSUii+U7(Z(*D9Q@~CUX`;?QA-!FAM9|kh33h=k zmPnZDgq|T!K^?2qb4d(O+_d#%ZOu_M?>b+$MG`|fFV>G+0rJI&@TQe5e>>(5=#Cwp zwM>-VxP;(yUcTKL3I)y6yk%L>6Uh-yQd81|A||jqVvCTYwD=6f)D5qYHS2`UP*7yg zDId8@+rz)8K|Sg&wY)7(A@=8d1I&vZNUmu0wDZtzA4ggyLVMlza1J^pd@DXyNv#H` zoBVmkQ$NAwu&)+8i%Y!?{)LSQXlh&+>udKztG`pmj!3k|rN*8#nRroXaj%>91Gd4} zQxs{9usRO$1gEik+7`VMk_yf5G-Vb(E4020_d9sZ>;>SmOR;NTBdfaQQTevi^B6cv zZiq`9D#36!JPu51yiLnt6$+cG&F9t5Mr@5=EKU9M=-&r6E#)hYqzqNfKIomAPiA2H z?BnO=1Uos{{6#<)Oj#LP$<-N(0_tML^R>#M7)`G&s&P_5*xc*GQvx4&5KB+%A> ztyhH2UNow=IAI9{9#OEgaz)UlvJQpS4bx#-s$j`f_Z=Fjku7FWxadkboX4uE@qb8_ zZ5d^bQdn!#dA0to8uCSfD%#3z$q)em^c?R!UU+E;qMgXp|`n8XpzQ z-q+@@uE|2OIRwm(ri`oP(}JqG8V8!6q&W^vNK(e+3|YGk`S&LI-P{eloEYhYniA39 zfFJX1%Ct<5Qm6MT`Xw1MLnD#j>>g|MAxaI1J=O^S367+t$^FUzx^kF}N`7kdYra@{ z&Azz+z7VLF8W~@LB+wp^VS-*{D&jtI6<~Ven5)r{9YV$oj=hPa`8C1Mv5UN_99qV^sUtlf1d{ZMcPDZj zh2+_d%jZ2lRBr*aoSI%osTG#C9roUc#ji)VRCaZ$i_@;dc=?s?qrYRaB_z%2lXrCP zB_of35h!3k!*JgKqBr5+`=U1Fmu8{l zC?R-47rsuHTF}@S=1^?zE?x+&e|lQUr(drZw*Xjxf2%Sfys|Ty`Ba-M^y>A*{P<>$Bh2ywY}t7498m#i;FW7jiVO$vu7^T_T;Q z0cO2tOx+3q)B)`xEPA8qdWdfD`TOS7=X!i4OaHs*?+3r7hntLo;3e2Z=F@VgAPMPZ zE37vCT_t>{5PM(^n2LaO8a_{dj(D~OF@mH#dtRB4GQ@yehd%o@mficHNszra&(ud0&Q8z>VCuEn+>1BnG((j9 ziATo)hxg>D1Ps%{?%I^Mmdg)?+g%A8PSuSS7EOoq)}a&nvqvi0ohdIL!`k<70>*VL z*z?7w8tJM$ z_A_ZhIS#Z#2?FF3B1Ik0CR-XxnrD?@z`b}7d@eI8c~c@8ax0~nQ=%%P zgAf+MX zcRDe+7RT)2zM8HsT5(@{c(d&1iFu%#PP$|Fh9#kl4CEZ@>lfUIe0K5f)2nGq=5{QW zY>Z9a&^NzBY!930B$Suo0{EPD0Jj#eC1CEikeDT}$u)mSm^alEXG9D&PfXWEjrkX) zhsKqGQ3K-|lIbMTgXH~a4u1I&)3ZDkUbWLi-Up3qkrzX_A;r5U@r9r;J$wVftIhmM zH21`FQeh(fcZ0-9mmZLq%(~k&7ThYk_jwaOh+g+{J^5%|od&N^J*Ihts)+f*$T23y zzvMAwoAf>_fzL{qwa+uf8^^6mg}eVdCc8l%s|@?H%5JhLe(7}x+Ff7_BfayK7KR+y zTtW(vB$(p~dx@ZUQjtw*Sf0hu05tuvtnI=CqDXu}=A)Y|Ste+%jB|~;#o3Po4+D>o;wSFVT5Cw1=`2m@J;6+yih~&TxMC?L z&DPiv`lUMfffyocf7J#L{DnRcRqO`LLMgi({5P?;Jmh>89;Rxd?e`hQLQXCkE^?OM z*xyc4T*Gr={$ZqTQ3r6LeszefE|B}D2Tdu?=rTp^>&lVehcafhrEFT}--0{>2F6ff ziY(R`q~B}M8Rcjmk1ilpkjl>MfRz&=@z*0;MwexB42sIMb9tEKHig~0?p>0u+V?T0 zi~&bd{=H2$vQ7mQk1v-uTZ7FT2`yQS{b7uY9T@}v9f`59r?z@!u&XdgkA@vU?H8lZ z0JslRAwmv>A>M+Yf;_;gV~Jfm!41wSiDp9(SPVhwdb5I!c~{Q#9wJr!I58Bcilq?# zWexB6DMKv0)pX(y^DtnJ_8<|elRi=du#_fTjT%i-MYWmmPp6rbOXTeRKP7cJ&R8$x zoXSr0AY12_MOkQL_i|Or`#Eq3^2t55ri+7R>fm4#wK&0SB$Jzzi!Md%_t%!FofskaI?&un;MOv1 zyNI8$DzutK2(uU>t%6Q-`1=gUSRA);Y2C6;+q8RXy6)Hwvb)8I!(^y*BVZotG!mA# zX#TH^yY>A*^qsj^#vpjdM^AaozE_>0%x7s5Ss(IM3v+YxzVnGQA^+={3MUpOQgew& z?;g*eC)kEal){4A7d4CO^kRttJiUq4fRK*IFyDb&t25sMvO3c#E>FC?_t9?`SU??s z1G$nNs>0QCh7+&M--VjqdyT```G@;rnET))9l$U*MV)gZ<)8s9&?wo9iNh2+K#}H! z9&PjGlfFd`&#|zbma3Qsalj^csQ7Prm{tPI(h#!FLePY7pvP1x`vWuLdj8^ONmvi+ zGIK_1^yO{|EHOyO15>CEqFRgRUu5>6a9~IkC%l6g_H-A`8NF!lON#hM8{Gyo#jr(7La z1Cu5Hh@P(rZnbilj1cSvQz_^LGwmw5}lL2y@o%FJ>-2~=Lyu=yY1hRw3ZS8_26DeM`z8=Kxb zZDX|#`KO^nqN(va)unP{hg7`2M(QhiX|O3{s7(u+$|xbqXGf|le zMZlx`_sG-Mzl+pWa=?=>! zo8AM3)KlN836rqgR10_!bcac?wpYllj9;2l?*yX$vUos~QhW7hy+_huk5ap8 zg^CPVY6Y*hI87?GAhG_=%Zb8GCop#XZ6#QmvlM1xG=JSx0Q+*pF`&O3IS=fxD?(j{ zDxV;Zwi@@kmq%H6^DP~Crgy13rD@J{|2EREOrX~ZpzSd@VQ&{W) zn3jq7>djQfzsHGF-*Sgz<7j_?h z*}!%*owoX&F)9`0G14B~>RG;LOl##Fi2uwAS^L$8pham}Og83KOwiShL_au3W^uxW zcf85LJyhA-d|ZyHEQYy**bkqT7Z(t0UQpBcO1cC%)N2ilDXKi^L;vW1(d*g>HX9IN za@A$%5Ck7D;lgvy5bPkHg%4rSvYt(xRd|~8#U&sY(VJIvhIrLXbYWX}TqJ`2;_M+* zt8&na$1ngzrL@tlj&8`qO4cEri_HeH9=0FE+d(jv!#|N7*PjI`GsQCCxEymIfL8t; zB|_6yb_xMtO(Y6yhQsg_iHgAL7p3L_g!0mkE8ZW6&|6l20VD~Qd*^bS;&r_0GUFCa zU`x3%1AA%1=d6-e9jfjt8w46+{quEQ0RmWutzwSS9?;9S=8d@=^k@(1*%UgZZNFXK za&K&p5p0|<-$m;lIk4g$evF)(#2 zRzOp7O0ri{X&Dul(vnVqBA9*oMbb+Y?~H$jx({*e-N}x;`Xsa2nA5F~{({7h%_q!z zu$qFu_qXD>=Dclj3e2}2f4{jS#D#O(v!T30M{3RUdcyyh)37Px-MYzogOP{c{x~pP z`+_qC1RQLgiyh=3@3qmL#$Xl?)XtN=}5tT0l_*-yNXbdYbU%8SJvR z;7G+BEYT`E$8Q-7k>iGg3b=Ogv=RDYsuKZynWeEFdrC&b8drd=Tx`;xEp7! zHt>{l`V%U)dI=4J`xPP?|cSiQS8_+kTbd zKoA_7CSqtd>bi<`Zm%3#MOxKE2Jk>-cRf0OC1tk-&nk1moe=%6u_1E1T#-3c2a}Q@ z^F!sRdPBHtuYIkpLP-e>OeD-Y7qp6aH*D>5fD#1 zHOn6HS*QYyN(D3-s?4MT4qz9Osfz(T@xY3+b`TsL#Cb*1V@|@@CtyDCYe7$fwTnaH zCV}vq6-C}C-MzK|>{-E6f#ErWSH8nqCpz&9GIf`{S0ru;{Gwm{2jtq=whr#y?@whA z4^o#I@zbAJikEPWA=sMS2ql8gTp?olU8G`W;61N1?tF~4V~2JHJmf^E^b z+8U zpimw9qU!b~lCUcN&4WR31p|T)&9bXd$Gay0F-Nyh4OPwL$$ut*rP|AX6NKy? zQjfl;V51nPcbH9Y{#%%1?Ju>*!*I|gF=9}_{sRFPo0kB1C^DM;29a{(4hEuBqD0kv z?BI9}GasAH5rE)lyJ+8JR)Hw)Zaj$HYKI54%lk_-by0XYB0;Hc=#api_97As^hT59 zf0OJ(C1PZIOC5chL98Oq+{P8YS^-+&S-|EJL^{KFQqs8P?ZY=yJzmK=3-x|s-e2ku zgD9BxTk%IemyAb~t%3(fI#5gI)wLdXvkm8oMs+$qD;8fJ^-fpR`(obzIK6f7`|Gh9 zOhc4YXm+>%4-dK(Vmr)V$5EIyjSGu#_P3ahdDTi@+CsL?_M2_4H33nxJ!tU}O85m> z{J8Ck*DoWqOGskZNywhid;-uJHz)hOwm#(i{|=_IJNhDJz-qkRjeWxwr=wfY8Y3y^ z+k2b)I%kmW1jtHH=XSh3QyfAU%;|sL0TBR^I6Pzlt-3~*Szhx)3TG(7@tf`SZzo`; zX9yO686~o5VmYZWZx;!etuI-LEb7J3hDrHj^u+)I3>?y86gH6_)oxOyura`4%v&e< zf^!Y7-w4&m7x5^}Tx0?K&1N)QlaGHgxL`R!L_AX^B?encEF; z4MLUMbjkodb817#qgvyqe@6*xD>M1`AoNSGdVbG+D}ul&Nd3HxhC^XW^2T#FmcB3< zt;gjQT2=%F%(aayIz{)7MmC>PM`^o{BMb46?Zyx&&fdjvSDq#<_~4 zhY{8vLwDc%_luhKgyGM))hIrO7KLxbV^Yl@RNN} zZ$PvL(hCPWNC(Xc*G5OVuTNw*{T)KIK`nof05-(~lQ|dHyCuPbko#iIKRQ6RnlBd> z+Er$Q*FD8kfq&zZ6WEr!efC*>h28P?u-1EK-}{Yfrd$Hh$FF@eKU($r9~`)M!_l&t zS9`I~Gukt3yAbD9|urYWy_xOEwer5^)g6ztyEe&~rj z^WPHE^U~_xIX>}#ow{Ii7{j$b3Afufoih4%$!}6CxpI^-|G*hiu6&CjvPUsn+(Cr5 z_&RFlFq%+ubL^X7x-6|;7TytSVd~z2ukPN>GJ=@{vH8@@zE(sT5==6EB>vJQ3^UmW zwwHj??676*O}|&j00=bJ>o~zv$(iw$zM0t4J#t+*BDfvAvOak(qS>%ucNW8El)yC( zoRZW+mGv}KTg7u!gWs}6%ZUfc@jb<9pD?t%$CZ%8|29!F186_=P)L%a6~3rdOB4SC zZ)QlFW1G+RSzJL*Zw9(IbjrUQcbtpY&d3Z|Jdu90-&#*%hRzY(_I39MiqGt})tim+ zYpU9^;ciLtdFOqumMb*S%deM;>EbWN1 zmgGA#wM4b_UY-=S*=z^n8@le zJasA@o4*=QgAOPQX%g1}&)jSRrY4|1OVG!|SN%O$RQ$tt)d8}484j9u2YaMn3z(aO zP&4WF2n4z8aPh$AwaP$4IS|)>ldwhnV~ZU zxt%B_*sd7)3n%B-^T+)J>oW|e=KFizyl6RkYW>+|^}>_QO5A6q%!EMtol5glGy5t% zt516dM?B}L1Qtwe3syorxm&Iu;=nIJrv@zB9pdF%#$9VAmYlN&1KWCSOJM92!JWcX zujJ`XC}f|YWa@7kfa|W$61qI(R722IDTLC4Gd4QF@bTrun*Qu@)2&>U z&0y`9O33(&wpF-k^_(B}woVJs%=q_smv;jq%tt`PgO_d21aS^yHfI?{K6k4wpD*in zIVkzI*DWUa@yC%PIAz>jwPIRak}>L_rTD zXP-+XPf>O4lB@MZq@R;v8(>q#J7T_016mzmfTOx){WGQ8O=07Hd)geghwXX2s3Ob( zbmRte_rDtvwb@SJ6g&R!F@uz6`*iahl#ly770KTSh#Z`CEu?ccVD09a$J0SmQkY8g z8Q!Yf`n>3T$iZefqsU_J?hKx#K0so(55EYgca(}yPkyKw)r=B2{_BUr6G>wu!K81; zwR0Vji?(RsxGH<&?0D#{VTPB_Z~Bcw1H9iN>~TQrh=oUBbFkJ+Spe1GCRbj@1Vn#S zI?%rU3wCG%yn|RvMq39*6?Ry>~;O$Q4N!rRMiNlrTy0UgT)RukXNzU z5%Q+o)D<4m~AbzDpE3I@h&xWlM*il&jm|Gux>8{(s=r zjlz4E7;FUiz8`J_p2&IWogvbOHU?Hv==kgHM+hMJ7^w&3k><9euaxa_kwL3M*LHcc zX{*+-L^5+UiIZtNy&9!8yRT4~l$L zQ{TKkDhr(|TaI;7cP&MDOYJR7_6rky=Hv=>x($k_I5pxr{%1uZJ5p44A*$2}h3y-J zK&hOUT`3;S_5Gdql}i7Po`r9V5co?LRcdM)+&`<5zX-eO0aYV4K?m8J!23OmRZ?I#ZD|=UkLtSZio{%2559PQ>VO^jAvoIhalNUz z{7Y<$N#6orSAICgfmrgl5$v42SwkqDvD`pc`T!>cqd!#(u)Evs37HqXn}+~+1m}VN zm`wD{Iy=JF50&rk76jkO``AKmY1aO#FlnpX;?TvC?cp!a8Y;O4fje1@_w;_rkC46o zee+WrXlBAc)%DB4K@rUrn)smsiR837ICY2wJI0EZcc?JAfpgsb--prbAIP6Rt$f}; z_=^klXg4+r!YV5i9fC=?b7J?Fv&m};jQt?T=>e(Jg!zPl$gZoz9ukH)HwT`eKaO}8 zkyFt|*7`nfmpFH|yyRJ!VYF(6g?{;3s`~ZwK zD}Ne|5YbE7%>#1Njg9+r#JG;RfrE)lII3j_8LIe}`l}U%y6Hz)E<99$hsr#H5zoUE zStXidtw~B%7g1GMJY_RLKEG^WiM3*JZ@+nqxVrTniE8HA)e`;_U7XBi~ zdq=9Vt`k}qrsHK`&dcPgy79GKYqO?;P4Td$Qob;D*Ai^uE$6dunocyZ->;>%H=bw@ zIY3r45xg>^^_p_!oW(jZpWc=nGbHcNNIrjP<~=#?`P`T$$tk9V+9E%A&d5YB+H!B% zuTkBmMOy9~;@1>mMTBCV8uyL+vr|Kk*QlbiM$$f8uTaHvA&y%{d}5kLFEz(!A&wB` z&^;)c;cSY_yCK}Nrd_(pB9SmVK-;)<)%rLq{{hZ{6XHES4df|S1r^qi3|Q72U}Q9^ zjHGz3B0je32s_=1HrAaTsN3$kWmU;E`_!`lgC@Td%V#Ziw7d{EYe<}>d7$u?Z2wD) z-6F^!py@(QanxM=W--_R<>skVkiZJ1QApF0K@y2#?_$qfq~(IaFQcCZzf}Cb*avFT zaI{#Zmj?vR8tB(3<~p+y#r7Y%UD@P64u<0qm1&l4?FyO)b()Ap7z9+{tN{Ln;dxu$+AV!{CNA}G!F8%|>$gxOF z6rmJ;EoaD!m{Xl)(6coDjlH3@S(&EW3Kwgch#HkFV|NiS@vwzl#i8A|^&kUFcOb6+ z9G~7HB68Pkb+h0LBrEZ!Pl~&wloC_8#qWNW_KlVzSu-kS`{AkbGN)$Z$sZP*Rogv< z$PXkqUT1cvwQ2Jy+V+8+b9z7h%l)&+Ld6q@9HcrY@-jGw9LGYb+SmeGt? zyPjtg$cf)Kj4{BW^QHi}nB0!t}Y8Iue*EYqA$BDX4x8DrgrjU;flaAaT z&&b?E?_RreDcD1?mYzwmfAZI7WRVI0PPbb^UyO&GL5zn&5_T+r5zyWr5uJlVlm@9Zun-*Rd;ei#Dm4!1v08!C`ww-dFysTCct& z4N!{C z?2HOhJq_Gk0PQEp6m2i(=v~?DWa~2%uB{<)R{-@@E#%FX;Itrby(Ijw$K;}y{|sN> z1X_-j(ci#G00$`s%r}3w2^+&T#dTMp#+9+zxqmJ?ioVzg4w|Zf?|%N;)HfXPYTAD< zx$fb02wo5oR&wnsJ~{Pl@77zoAw3I)%fQDwnQf%@HPTCLhd*vpRm8R^?ZrcvD_&>+ z$Pu(tpQv>GpgKrLSt8?;+DW5uICpQCeWW=%p*6T@UJ$aQ?fMKZm%FP?4cglJM`5iM zf}7Ak?KRjws0a8DTDN^bHv_P5s>*MdOeT-gSkV7kNe*lz@Fn`AX?`zGzc@R}dr@}C zZs0F>d-HvvDfm)7v#+Kj2pGLFg~kDA3Pu1u{&ujm*AL>we5S*AoUU8YrR+$HLLV!2 zDwW!jfzV1In0#{>S<}4g3m5v7R9OO7iHMG zjrj9A`)wn$WzIhQg!|$e=};+mH}qlU?UU@xA@*$S9{ z7r|}Y(nr~dV<=jpUoaed>8KnnO)C}B_9PT#SaU!99ZuRqo$ixWem*Guzyp|8iy0z& z=>eZ!|0j`m@RFUu5kHh5gq3k)dXlVM+M@8V`-V2OtL5((+vg(hWd7Gc&E1UJD%P7p z3~_L3enM+(3;BaB|BC7nZsaxCOYi}aH}Gp>H<$po$&j(3I46QcBkiN9YrEs-%I@L< zS>0}2E~4w)15shSCCcy0AOFFfid=s?%J?wd?j0qQR4fPK!TFbag{-&a)iAZQ{f9JT zdZr2sa>W~KHw*9<5V>JZ#ar@RGv9{Hp6VT8u_$=#>Fvox}R1P}5VDR8q zxJ#l~bP01M&Cc$9z2TL5#W~fiBF~C-+aF=tqrC!-Zts6F1%0SB!Q4Ot!&#@mmx}Ms zgrCg2U^g*&_qt?$2IoNUw4>ex6pL`FYYfplck%&$QAYq+xR5; z4kKc7>xMR#7hu{0Y1lX-esJLbKMR!fHmh9y-@C>}ynDM!c#>FTvtL7i2Fiof$ZWAn zC0a5GPDdNN-|(pGTm;!mm!^LYC|P*ZS&G@;!>#E+YbB&x>R>2b-9Qj|rUn`cG|+cEm8?Q*wTX6f zkYg2L5?WW+5$W)Z)^Gfa)k2+b^B7CJu}LoYBITJ{^V|imZtbJ0;*DEdDfisB{5rQ3 z)>w6kl7lc&Vf#0&LG4;M+%eRiT521aqxcxLgvS;|9H<&SG}L)%tJPL&^iLU}j8%wv z$!etjeMsup3{!PKwL)Iu4q*7IyU{RV8_XlLE^LCf~2=tW*s`K{tGKK)l+ zcRJh{$orsj3nIra9-~soNXw0rfkCR7-GCX-aE23`93YO$jjW5OjpUo5AGm?M?}p?g zj6rQ&?s)TM=Ult!Qz-$&Cza~i{F?Ls6^GJ3P+d0^DEf&Lppm}M-dK{F328OIrs0gn z5{Oc*$^Dk4gOR)p7^69sunb<;bCyHvVE5}y3~k$JXYuC0j%(k$Ccw&pR3)&7gaoDkz=MG)eq5WdCr|*r5j` z=%zG~1L0gUL)K3J{S6}mJQ(}#mwH0 z%!Cd^Zk@?Q3LVhFAwsEiM#>><3x$+PPTi^Lbf;7f<&?u#Ii^}C5i;jf7<1ZYd%u5| z&+q$Rf0XKdx?YFp^YMJE46i-x%WIrWO=sil$2ZW8B0Qn!^}SZnG3u5SPs-Huu@ms1 ze8zfm3%%SA*OO~ku6PTDTV7CePnZliYkClo&d=XPB5OjTls2&L!o?L8eopoP5}}cN zt6uw^Ew7PE8cT3zt3#;@gq@G=c-z8A$@>RG_Wub@4~y;-eZo{;GJa}6zjU7_jFI|d zRg;xS3O^`U*2xP=dtJ%fWh}nFS5VsUeWc$W!QD7hpBc`+!GbNjm3Qokh5I@1}V!s<=o!^laRvj-Db zKaPW(>oik~NmOqaU74OqPoQ7vC+Da4aT$6x*XjCAbcgxF0%w0wG;&)gXWD5ya8DmO zevoE?=Xl(csGeCE!~`X7yptLCCU46QCpzOYc5c)?58VmH2z8^|@40hNsYSOMWd>Ko zsmxgfb(_tNg{4X?-E@0eFslsAv#%J=e^bUV4oT$*V8@kh_KL{TmlExTrFnrvfSx$< zC9r|6DG&!lmdRW>emxF5zwGS!&m&ZEQHtC@fZ#DZcIiB;{?PJcJ|F2<;@HQT5;=p8 zo2|ySod-SZMtU?Km7LbFc@y%$UB3#~vBJ6uJ&@~iEMnv77s}63B|YKuW!WWf+1FsI z_U*{T#8tPS9Go>@TmAXNDt_cJeS69yuF0>RpV#Nw663yFbnZ>FIEd_Q%^n#C=H&OZ zx&OP)pRCjlLCqJNl@xN4oy3&08pJn2G11t6%QE}e*Fdnc%^@i{9&82<5BWvJjF(8$ zX=(|~Z+9GphTKXqdMEJCCx1DP4^nUz-H2IWpPKwtGn}zV2<{1uf>fq<6ejX&{qBUq z)}YEYqEhn$G5V6X>CmX+^H+>}0P%)Q#XmQ@Wq_s8`zy_WaTVDO!PPg9*P=IoU)+d) z!Aa@{&z^(YMx|VXcf5y-Vc=q*ENooaNBdLGYe+hDmrN2*KpqGY^F7R+7gp{D$a1~U z$56~JDWN%VX{yLX>a|P>fMZoI#}B*KRQ;=1Jpud%&AoF~O*)c? zN)wj`sE+I+f&h@`s_^t+ zJvMe6xFk29MKyYSJxT;-7{(%utbms->ymYgJ|Q8}N*%-}VD9)LfK(FRrp~<%_Yld2 zU>NVPtvQeBihl>6k_^7lOguVw=Ar2?bwEz0#N6l;1T_f)_4&pklkqby@bg+BAKs#V zyauXUS}R8aV&-=9`(ZNfe1d;X*_rkksL+1SU1Z;>as3n2$iVfxDzq!@m~L5X&Vw9; zTXWY}E50zT)4e&_iebF&)pSB)SNF`3dPgZU=`l#k^m~XXi%!V+d41HsOEVnp5A4s9 zWEPJ69b#WCei@Qjt#ziyG0FD+8-<2%zSM?Uo5?ETJnweTXTKge!I`@@a=Rt z_jF~wN{?@%7v>cnD4IZ9a?NRa1LUO?;B4fr^O3rmmn)iB4Z{v6(a6tv*8($E0jf>cJT4$2x7J*HbA&{1y$(rauPiGDdBsX3sl zf&kLquxdR8C_Ax8drk(}57Dzu9;08~@rJCN5q8jb+a?C^TZ3P#d><-N*J`|Nrl*Z5 z0D|GzVG^UIrjx{}o0$8=mkCo$_(2S}G8}@)ESuu6&F=kIcOZ(MqXC75R)Fwd7{HTe zP5x@7&V9`7=qha1gj$*d@3wv{T5Yu?Iy1~_Ff?}7Q+#Jf9iLM7@3!gNsS6jBYceG|^39dxGuPfh2=>-jMY>L$y$M!bkqRS4?$0xmFzP`^IDVRdVOc}&`Uuxj6Qmr6%}sMloe=h9Q_R*u zm_E*`p?av&2Q?f!HAL*pH6pnr4)p-=gL@OQwD#tqy~oL}UbW9O=Iua^$B6Vj9kyFE zL*b&2j?+6UpB)Ai{_|HyjKNyv6I;3i&i9Zz_TswQF}e^jYS1|nGH;6a`>84OxA%Ks z$R(r?t-=H9&gkL!5P0xjg^W#u%FN4zEh84?I`59MW9P9@&}1Ehr>UMXt1o_Qf?QFV zJSD5oE#ve?ywTwl^VZ=QVxltTF^aEgtfjYC>TU{b(6v5 zP5|p(NU2$dT~v$Y{7r}sYy-dKK9bUh4n@d9;M#>{TWTU@JK*N;H-EGdX^-pbk_bkQ=i*e!#qP*ZI~f=~mbEl5@0{b8Ih%bQD!uX}kw-4jKlFEO zU$$}^)d{wXZO!wDH5@uC|^BTML)|hK@VELCNLRl%od+ z4MaOVr%&a~dd!5G$G^~s%i-BCN1+kGdO2F{1Y8Ei#C*`T#-Ooj?<>&N8-pO~B_rE( z`KulbRM@J`=}#ZNyKY00^-$ZKRitS6jiOB=b?S+M@ZCzV(q_EW4Rvi91)QlH>Hf7W zzKGZHHorl5hybdmcgD@+`KNs4+b7c3YJ<^RCejWEA}6^{-_Tf=h;_TjXj_JSKEqT z3tQS%_j%UVUHZM@T78eeb~Lvz&K7qhi4`!&>?CuaOkTb!PP?KSuDW1Pt-4m zDMCZBUdX`!-a1-k%?aEx8MaobWO!pt zz5)Hf-WRff6h=X}!Pq$k2saEE4saNndyiq{WTK6L;TyQGhR4sNzQ;$ZHU}!2E5#6I zte4~A9NaOWFf5TwnlVKS_t1{4!B4zR88;bTz5!pgkFTj$SLUz5h&2yV;F$Gv&<)#F zR|Zq@bqcway2grhn@h^T;TbPB5xGNQylv$zy*Y9I7Ctg*^|ZGV#jO7L@LZ_E_+8CJ zs>Rty$ub+-;-@3)lOQ!{9?D)(I;(ukYB z_|1@~1pFrJd}~nl3Nw-M(C~!1;Slo*%}isfIP&h9+uhdi%felJ3Ar}MuFBRIe zRYOj&B{)2E?fdy(#NZO?N6-c3uFK4wCoj`bst~foG9Vqg+_c3R+;LyX`w29~pS<|~ z71Tms9)Eo$h4x=2ol-}sKiEfHn>xA1lixL~)okrQ_N#M6sIjEA?U;yYJ8t2_tjCr} zTmGj>tqYW@L!08oho)J|7s+Rq1Ad!I|2`e@Gb>v>h9S}SzW-%~Bz`|LUK@1_eH3@DNc#TX0+ z+Q29$&c_nEOdMMthN$(v1$NLsTlSgUL}m1C#IkSp;Sv90sZ%0 zyq*ZWHUCQQG3!(<-Tnq&9(ersBrR6!3h|qJ?(FtuJ8^sM9Wl67u78l^^7*S2)x_rVxj zqxtK1mzl*xWJk{PkIiMb)KJ&TlaJ1r4tpXybH)-h^9IwSlY2qe7MZR!JLJDC`(IsR zZF=Zu*ne%9X151oYx|!aeEVg+q9&L!NkTI(PO_oD!LBj-rHMNKb zLg_XcS5rj>vJvdA`L)2KJb}!41;xn@$h%Bev&U57YTukdBS5(PJ5ZGV0d6v}4&n%_ zHKS)bj#b+i%bcrtD_|<3+YmH}FGBBhgfdd+T~~g6Q`oX^WDb-M4jN0qNs-)3NVvPf zgt4}rT86`Sj|~Ux^NQGgCLrYUd49kH__%eWB;ktRO);2jaM>Xb-X@5__-@$rzrP)GO0g49o@*_MjY+@ERuR<#qDx& zue(*mmeUTr>V|A9SLDFf<@2$|-|_!@iZhe6#q;0KT{&%OJ40V|BAGi?sjF%gswU);gz$$LOO)FF)IGbjudU_eRirMtWZ^NE zbmF7;jD#G%)}CAt>N$FNJgJL$(f}dAS-f%&8BRzGG_@mfATxl{eaB=xFK$%vXRFqm z4;?h2b0EbAF@furldR)#D-3s+%nGm_*iaa;EoC65F+!bQ=RO37j29@qi^$N%Ivsfd zW3#P!E5RPw3Abs*DxybOLqt2EB3W}94nv^OsXL&Ez<=Nnk{+Pna`5LSt-G0Nk{iXJ z8{o2LAVMt;E}G7Hq3>OgE2)Dkc71}^`DRz(5f$rH`lud&kH*p7)uSF~p#H(19bL=p zPGYWd3ZD%*Oqh7~u-dHI)MadEF2cO>uVU+S9*)d}-naYge}>VtB=r5$dm8}96c{3( zGzPKIbh7qY;A3hx^nxM&^YnE3sH|{yj|BIky7%a1(_c=VT)oEmrMfHAtjj*KYX+Ji z#p^KCH*P#a-d_Vb$Vd7W5BzG@+SgV}vgLm&k?vQ8wQz|k$ol(FM@Ac6LlW`8y9!!8 zDUusY#8rfH))j-&Coe7&ABeYNI4@Ex_6fC8qpvP~{jRM>vU`-(9{F|*?~$+{m$4<% z#|}jDvg|TYh}FFV^z=3d{Pz723#>Hszrgq?a%@cOYaAo;6@qS$NZAjL5nTFc8GkCk z?hMOGInRW-)c*36CganK>IQx~R)?GI9jVa5YVNuBFN=bwMfg6Cis8*+IIBIgS?jU_ zIsKH8{+U^oO=KTE6cTWlDTk=OD%d4E{bxdfQzEPiCzK3MPuk-a>zEd&o z`PibM3N_y3(P4Si6;VO#gK+23`VFqMROMjYhkY6V$25EaJ8cm z{k;5X)RheUnsxTAsg;_nMYci7$f+6FM*7)Gv=cK^eH;3w(4y=z+fjN$vg;N#hBWU9NmzmTzGr1YjU6;{5a{kZit@W=72Z4xc{6v*ma%%C zfWhWJUCUuYNS~h@5_=D0W1q0;gMfzzZt;1uEG;bI3Q`7Dw^rh0MkE%aLLZngWth}? zWv!!LlUVH0UcUo8@U^STTqi3B>^_EfuHfc(g>d!rKMu4SqT3Rt_SX-7oI39KH1u8v z7hs5^>zOxOOoyFDOKsSZ9s>dF#Aaq69H)7Pf3cGn+dbm-UKK-J!I=Hcc^DcaXK`+c zmGw>6QsG>lR43oM*D7RaDYz*NxImcbPY0Yna#@!%B#GfbD*dde{udNi?ISQQtQreA z`kl4}?jYcND-<)Tg2t&tB{pszii=h^oYgB9Z8*mIn*`?^e%s;50z(Us(0(uOvcx7s z8lE6fI5xj~{H_joXV*Z5I@+WZdVw*RNDoSttU2*GYB5x-rZa90h2^ z-IlguZJqND45N{jjn0m}OcE}yU~UUJWM7$S_3Ph>slU`GMJLX0Um;kzzyI$W_Zc3h zY3jBS_h2JkdDbo~D6g6R^B~1Nm6cdB2sJa!P&4y%PsaTz*BIpM(A?#3bgIR<% zmEQ{s4S9`I4rBkmRf|fZXCSvEcc)|ZQGS+CZWkbB^%?5}8_l(gz;#%Z&#G-&40@RR zA)-6@iL|U$R}NE_#Y&sCFh50g(g1$*P;jAI7oFHiO#i$@Tkf|Q6Et!f_Jj3-PW!xkq)L5G{j>qI|02s#fQ@*2?XAZQ(lGmGxrN=Ji- z-~t6y!~zxcH5SmSos@YdU*hFgb>`eUGfvjO?>MECzR_Rnpa3(c=oGOSIC)yIu}M*D zcJ-@5WCU=WuD_OYarNKFG@?;^IP}=8%=-soU&`d?f4B0FO@0vdB&OOAb-Tn=+ke{M zeC}H{H%WVB{?55D{Q6nDZS^l95P-4O!}shYee%A1RjM=+$0*jzNsA;vm2nF4>C;t6 z^s+(NeyQArzS*iLJ96Qv?4hMW=tB@-`~}k(hPrg|V+ro|lqpOAlPkBr-L7ccqdm+N z3)&3nhJaIxN&ghfXKcmT+>)4}KDyazSi%EdQ`cTV)CNnuzZRaeb`2yE#oo41x(o>nl@5>(;MBlUuXg;xh zJn~&1e@8K<{EzF;R-*l8qd3;@t;FfxHHf$pxm1VYSnd}%3-^L-1&D1cgHBF~RvdT) z^f=A45Q+q4^EEYa76(rDK^zN2pw+Ag$=BKP)pp!?0a2Mb=&j!W+&Uq2`SmXM9hYV= z8=z3jxbhA)CdnGlcA#Ig1FL3U8{DFPtb!50^jqCKa#jQ@?<5525gHzH^UI^4^`UOy zfNTC8P2)zke=4;D1C$_iGbQZ#-BkK=@kjH;Z;o__DanGNxx5R1ttj8f0d@PB7ho&b zV!gHzz6dG(VW~Tk)r=}lK84vG_3jU6jPS9h1J63W@L*=W_0u6c+x(BKgFkt@Pb)XH*WN{ z;^PNcNjd1=UyWmP59^{FelEi{TVE;AbDQ_AWUo~NOQ195i3Cb<3vgXY`G2?0yFZ~W zui>p~QGoBHk@!j~x`GUaB3wM6pk062D^;j=%F!~9sk(Lul(T9P9|SzKY8y4|yYD*F zzka)~3@F>cP>CRY?@Y&ek5O$Z1ljJwNAwf!1Q!DxF55jpaHA<|TeI;Fj7>w8e+)M_ zeIljLL}&r+B>|+hDiX-r?#=YSXzP5VF3(?fgWC#-(4n6Y9AMmf;Xl)v{Ov{0My!v4 z)r5ecfFELpvKu6KL$evoCs42-cnTC0*HV+k&R)Ptclgi)ZHq* ztLx=|YuIppEE7o&xaf9WLZWiX);}aV>&6tI#+Xe^jWC^id%!GQV-!YIO%hXG=-!+B z`^ivS2{)q<=d&E@ppw<8FU&gEdS25_3e|OL-Pu=tXL+>som{?5Zi!ZNAo294cv~Ho zYc!)-R4&cWP(w*jj0IQ4gl^x(z}o#3mT~zD%=XJbiMxMN};3wlRQs7#|Xwx}bY)&Lh+3~)*(A1(H= z>${pzKe9DnvQfZ2w`Y_hsWAV|_4|vifTCAQ_KnjTKQF8Qj#(sgy<@|oks_CX#|dP^ zMDy3H&~0$i)}#H*Hk%#}%60 z3rnRda5MMTK4;p_{E1yUMR5%Q4`2FfgLX-$ zr~dSZM#J=O6X{jR+Qee0JQkK=wzVz-y<;%vbwEUXvAdCeSo#!jzQP8(!FZBqkQALk zyVm~sJ(SdpDVj=QC=ZLv7dWesyJl$}Csxk<+*vFSYw{Q8mLv88PsG@9;7%hnqrde3 z9oEgwPtV<$05~#lt@v&ENBqme100EQQO=L*a8G=$f+A|BmJxcea?g9RJ|H|FWhUqV z&w;$3+D3>Ot>a7H7gj7|?`S|HhQqFEMC;dsl_B{WGyW&ybhlSD&*px}I_~}3=yAr8 zcWY8DpSQQkbPaX}$WyPU_@4-=-}d6YwkUdC57FfWf1@>P;I&gUybs)R5^n`^Z7Nwy zTtS;@qF226u!(@T(p)QyR{KUaUj!a^a8vNY#^8q#mn<

92BMIh7XcOxzUklp!rq zr9#Uf|jH&alhRU;6S@Zi?T=78->AKkiWBrja2>i_Z_-(C7#^5bLWB8>Vs7&;2+ha=_& zM&s{bXyue6hQS=`##AwPjLbpOiOSGMT_D_xH%i>9C|2I$>HMOk_@BE!_Bc&0ovQd8 zwu(7RYG?G7ta858-Cvq3{b_)sk>wQGg7=6PeY8DOjYH38LIG#ZYaz)5eCP+Gy z&5tet_R(LNlmV?WutEaATj2KwTOgzd-@5Q(q5?X+pimF;FMo}ks39Mi41kkoJ8&l6Tp3t> zJctI6dWeFL>{JBq2NVD#0~<})4WsKHjNJT?Cw^TpYJ7kkNC~K`f zO#mKW12+A0Z3Oq?OFv3C`<~sW^}gB?fU0R;&ZOl)A33D5k;*-@d50=?-9D;fBE3sx z*RfSRTw{>)GXIyaj^CoWJeK%)Z`tT_ZtT*h_2((V@7q=14>Q@={;Ha&szBv-l555{ zg~a^QJ!6)-TY$qQqt9kre-@Mv{DC43@Nrq5FjipgIg2x$EBU#xI^Id-#R*WF^u0}w z+Bu{;^*#$JZ!a^M*P{FW(xouA(&xg^;y8Fk!r}pZnK*a6B!)&UoAySXP)k!Qd-?G8 zC5Y=NzE@8RNg{V^I0M5|J6(IZFge3D+Vq4APwkQT?1Q@Bwl}A;T9)8!-(!0u5CiX=hu36WUXb>UEFkm&FlPE_kPTo5{5i!UP(4eQ%(e}cUQ|C+7q$osvSGu3k z5crDnpE#?uJ?I$Ra;<%<)3Bqt}vp)TH|#t ze{pV!MQ-6Q7ys;cHLa#|!ED4}umTH|Fi<)0j}c0{kCtW}L{Iel;=y|SN(>m09%a}f zlqm|j9uIZ-SHa8yaApt##v!ham2v^mgiCPTu$f;mkCjQvX%{c(`&6ilo9M%Nar5gu zgt+GOI4CxS&v_r+zCq1o=El;e&$QpjLk?uqb+(H1;7YvSxBMWIUpNb^i^w zf^uRJYccpWZc?BHWqEw9=J-3Ku}RW$Nqh=(tQGr4QOY-AR> zLew|3%M;{Ag7w(;jDueGYSZ=5Mj|_~*wHzr%CFyK)>Cq)EjeK>p;|PLv!CwehezD& zXG>nDZGKyWo>!*-=Q9M`9Jc#i_SOvoRv6~k;~=V^;pkHBG^`3S!)YzMo(hizxc!M~}WZ3?TD;2h( z6TOA9Ab2%H0bC%sBtPgw|8P}(J>2G{B{bg+zc*lrlRSv)Q^9r}!tm(_8_-e(2wNus zsC%Q;CEsjD&7?NF7If#`7n0Q?UBl9LNK~tP0^c+1!`IaEI67e2ZM00uX2tX;2ShGE zJ)Bo7-$Sk`M{lO(CzQw3vTsSYRV4Nbf1!35&il1cZGdIGzrn%XNOwn%!$52Z0=)`; z1sL?{c=q6$H!N?fn6NPVVl?`4l({lh=^YIk_f*jw2YMVR6!YJcVV?-Jse3JKcss@e zJRd)USY@Yr!tdh;ENeqqJNjZQu)w7@QX9Q75{4ISvx@no5~07Say##OQ#r(|o6STP z@OpdX#I>rF?Wbj%QLF!Nl3E!Ml_?60@wF)DX}!>?zh7@J?Rihr1&eHf7U)`sIXh*B zWmdOt10s6j1qZr{xab1$4)K1~e64mFgSV7#C)x9sIzQ%vF!5le9pG4Eyl0mK2Z~L$ z0%K4URZKzBn`tt8KzKUx2g z-Z7i6d|^jZ1he?KC_j~Y(!JjO+-`(TXG!E}hoK2IuJqt{-&NSoTLwDkqUCH9zzOkX zR4@5XA?@Z1s){XgIE%j2wz^jTZ_=?x{Diwh%&tkebGAp$06#w^PY7HaDnacWpu*_L z`$IV3kf%Oz$)n5SdGv{@Kl>I~-2?4fH@BYsc=R+o0rHN5Zt{i08{ zBSDEDa1&7Yu^{LCFi~%=@^WAddcGn0eNA*+T2x{pb$k%@R2AHkSZ)R|t!^g;ywYJz zD&q@AEth~C9kJ*t66!?X;kYFsax$z#8NaCB0Lp8wOX8=et|CPeIi7dBOo|LI?ya$Q z&M`?L=QJ9I9O)+iIp5nt5P5uZhZt#_pNmH*{VN*K7^N2AI+w3yxRLOEVl4$|i<}6Cvh3DN zGt}f@12}+!Qe3xItqiI1bF#(x*ACtU9lHx*W+tNLM|W8lSkG7-6O~3_0?iDgaW}@I z_Y54A8oj1~U8D7O(>rZOr53&X*T|nV{x55d=F&&<7~vFVHT2qoTu7dt+*womJFX-( zZp#$33kwz4(XY~ZN5kyjSyz+;aP-x7dX2tdXCZHVq+U|{V_QPnqc&@kObPW;31Y1) z;9p}_*(yPMGNUVr_@A95u_iZ`8*Q;ug;NMM@kTFCj!xj)5nlN=VmM3VYP zkbno7Q5H;Q zHJ&s7Pi1CJG9Gl&^x&>}e)$Po#=2L2kP4;%cAGZsWgIVNrwj^TUs&XmeqXLpBMN%} zBSaVihijZ2gs#EA8YHm$8VuXUd3O;9MZNlT62xBveJ~V?Ns%yZL0WAF{YJOf{LaBC z{~7d#4saX@I369kk-^+(ZuAnFFPD0XwIO5_Qoi&Mk3IR@H7B0B1q$x9!&~S0lPh}# zKM?a0HaPck9pi2gbkZlZWne*b@^R}AJ=}|9qtcZ} zd_UOhGAI8%*>>Emj|ydPHG2xaRTII6~qvJeusm7IsLA(*#@N%JSZNZUPRA`l*cR z&ZMOp%g&WvlQ%FO8EheQ=C1CH@-;$?vfgr`nu){MxD+bR_V|QRwtHQfluGr$%G}Tx zcXm=U{e{q2L>!&+(r&Nyc0>qosL9e$cj|zd={i_E9guHyyTp`%$;L+(oL#@6o(!#2 z)U(jWc3IKS&V@||>=qKouq$D0br|@CThkp-c>%v`3m`=t-2w<-ofD|77H)VzMh+0* zI+of1^D`9+66O=AChf!UBeXI;oDTV;y#yR=rcoP*`6}T#>1Y;-UROGQH{AGI5iL$L zaNU2eB2S9)g{v@-U=9_pKyRLO#zx@#q_ZY^4{|472?RyjM)_oECq*_ynksGrSto3f zcg~n51f)&}6F3v*ZOC7^%irA^u>#zlcZM=ViKS@c?%dZY+}rS4e`6V1^-&9~1J7!3 z{*_o7vBJ~zt20eTpMTz3lg__g8M;KdT2Wi>=+mL(OxNC38M899SjvB7Ae}l6Fl^_`4FiimXYYk9>q&Ywa~syfxdZgy~zSnp&N+;0B*+<%iDL zAw9MsGQe3m zF<=A-a`W-+iRGFTL5%K_>#mUt>UNJ-yN1#j;K~Y93D2^bxtk@?PO32;4*0r*M6pq) z)s>=(3xU!~Lvbg{LD$~aShpX|O)O?Wv|;|&9> z=c$jYbsoj{QMW@JIIsn0^82V_$6+GOmRRsakfu(>4f!9p8X5_V*1&B1t$TDv7rYq7 zhQoc96QX$UEZ?vRy@vtZHEVyT3bx<{kx+A|6|q~dF4bgA`uhDPFdFQOE}o48dq4_a z`XJbKL&TrjJ-^%`0Qi#`KS@UC_$KSbEi;}a66XdgCqRc^%RG3$zSZ`7BotWnEWXf) z?qA+_sClcAf#^&w;Ft+A^KlSB+ap0`Z%3!#7-8&O9K*RA8`VD|UJpFvG09MJEZj5e z2~($9SdX{Xuy3RL2Kr5;jFHpYq?ygY<-IOEpx-bj-@aY58=*?>Bvz^*iyYZU$JQ}O zf1d$8Vbu|-cPo0JNuqo7E~@_d6j*{irbWM)kuLNZVCEd7-)OoB$FRTmabDLDTcJAZ zXvcQz(5Sk`S+IOKOIS@CZn;1E$;#yw(1|_JQx-B{T5jMnT_&!ot`c2X@?a zoH4JLy&a~6*&%gZQA>q`Xj!nc6pb~RyPAUDX#P{PKpsC8Q1AIi=6}r_#F?fAk&Sjy zAGJB__0!M%MF|ajOwlN_%fGqhsFmaNhi38Ibo;xr0CcwM0KJb!`4tY|s}+|KDWGd} z+GSrUD~;a8dVTW&Ddtr35o+vFA?=P zNv{>14af@&D>$ayO0jt{?SGYACXs_}Y@{e4V#O(Pcj+vSB8q8~eW=ScnDTYJ_??^M zL#n|1YP;w+p+h!b`>zE<`2)pIuhTvOeMdMMko08Rk_>l?|ke zcCnKzcU>mXj7A>n9PuAH3|7d1O|Rf?0S>+kicH$W9xMz5jDm)lIam#8dxd~)f2&vd z;KW#2-ge6yjS1$wCCcDa95^{O1ZliCDx&Uk_NxBF4s37lttg9{+8B zgs-S~fD~grpa4uwt-A{jCVl6jn?5E zdWgd)){%Zf6KMKMI=z9*RobO*&C*_N0yLk$@f-}HHf*kZ=otnaOCa5gEJJH&FXR> z%vVmYNvf23mS^BCU&*QEZI?i0JX9?Qx5dbTehav2Ez-3$a}nfE%&x+dY{!c_9A*;q zyAKxB3&*bvc=TkM4t{%@a2c0gU-;CH@!d@91T*m_i5{&Qr+kn3I8yDtb1!~(ez?`3 zbdTP`K@UAkp#mr=p~f;V|ZTPMo2^5)tVkU4!}@E*o&@)BM3ToQ-B#jkf=Otq0{u8CT}8y(px zfh4{kM!SknPyN>rviyEkPC7)Vz(!04#6rT5IJ2J&X&F_=`+3|+=9Hvx1id0pg`@dn zQ1$^)9HvquzNye?0)~Aqa3r8UNCHy@^bCC|kExv1RY?`85YyJGO<@!Vi(pHOw?!~m zMpUQu~mgM|DwwvzjvNCGb7Atke&8)6cj&;6fy(E)&Bz zS)t**{gu6hwcA0N(G>IplnX>UsLVLsidx3C19;_7$s;(XPH@I~Koq|L|8AVn zqWtDfuYNLw#k&*q9@ES=<5RF^E*Q=&MT}B-a)n0P8TC!VWs{zldXigWOy=*LSX76% z+AA|rzX@7_%kS5U%U^J>f}0(I-#!!jdhc>9Os9|g@J zvJ}QGKz*!`RXjrc__7xYugHgxSQ9u@Yaq5T_F-ioA1v_x%)W)b#sT%H50KiI#oYQ!+|g3!rHEPEVg$8?HmU&c z*|QUpsdGDPE^P&CA9n>(Ah>D|AqVdR-x+ApI#kZXYoH+_;)JLlYH9wVLT&R|!l{o|dC)b&b+8vxsSod}eyF#&!q2(9N^)lj2q)wi(31@D9*3i$m)H?e zKb0N--z|FT(9T}C!KXYT?pZ!<>EgfHzJ#R@-?-D`vYmIKy9WaPvTF7|=-Uco<05Y0 z2=Xnd)YzqG$g^IDrQr)#PHbf;TG34$X-0h24iNN0F%9?Nf-d~vD-2v|d!am3@HfnQ z<{(ah9-;h?p$|ildYH!3mPW$425Oc(_&UCeTGoi3%0o{X`Z&!ikdd=TPPf=>meCuZ z@nwou7!6V;Rgb+3^y@ZyXtwZrcNn4u(rx!+GegK%Z(2g;Dhmpt;95;=peahLes9=*Nxcdfmwb|EA!{!mVp;%`*|Lgmiv z53l;9CJ<=%df%(I!d7n3V=~$7TS8gtygVX7%_ppw8=3#tR+!%3KxunEzQ?AA?=Gr; zPHlox1n9GY4AG?!3e8A|E>#;j@Q4Jl2W4eE_>#i_7AUz*fK0e^m_0*bGQdfkm=cs4 zyoQg{2f5oAC-+l^^XvbCdY@=@iR|sm#n0JJDuJZl8-3_2m|9NH8R)+Bja!#el>bqI z-2VgUt_6DEh$23Yv9Co2oXlIeo>RbhKK04?6Zy$q36?NZ-i{M}iJoMFVn#OMH<4uh zOlOubWX#;(`_$4nZ-lr7;A)mbzCxJFa7Cf{lzGe0!0qnBJ@8UK+AUB0Feqsv0T|)e zE`=!pM&IG{4xf6>znE@ggsT35?K}lLoV|!vQJBr0#A%y{EK7Y)*&qU2h^31l;ew zoKQNoWg#JM33jwqCIxPoMPZW=q8PLm&shbF#HX(iIS4q(YmZidiWH9hvVFQ~E&Dp< z`hcFxxe$0Xj}_gd+ap{8OyHbPgTcqyaV*z*Ig_d6n;L$jud>^hW`$?~m=zAQ%6AW4 zmCUbZD@Nl%=?~zu$pG!#u#&>@+-9>J+314|`Bu_Iz4VA)=AKl_NbojmhbZV*hDNL{n~fW~~1;QD9oU@`!#JFf1i=ht)&PmviYN%TnMrH#tzbC;(~HGb8Uw3(N~`js-9 zXoB8ILidQZbO2Bt+22pqJ3_rZ5JPvCA#9~`r;Av@<@LQw;qH-B2ZQ8e8FWAY*n#ke zycE*NioILaY@igPqkNamN4lSWB*Ab9%iekn~dEwgK$VchQSyX}D-E;WMo(}Ed zfHXLpkQhIEp^WMc9L9nu-Iam(tw|ME7#usS>x%H<()RuSwdO$xy(5YJHSyB5S~2EX z$RW$Elq+Wz3nSmJUwqW$cGN1ABwD<5lBq^lMF;fhaJiaPtRl30w>mmwE;1rjKps`4 z{da3z>oJ4Ose3*(L&_I-w00f5(c&c_FXEts;vxs3eLi? z2bdXt8QU(Vyi19U9Bp?26R#oi*RW-=!3Z;y&yf=+Al*E`lK7%Jz8|AiIp>!%i<`Bxw{Og<4&KRN%0x~s=|-9kPZl=XQdNgTxiEaPN84D(z9 zKP2ENRReV79;Iqy4}631Et~LNa6N?u`GI{__f*K_w0f=*?X?u50+Y1n(H zp`6F`fl72K-e#ob7^_55Uqbip=b6oB!haH#y%)n7Co!-fbMl_Rtd?xh$a^0sfAT`U z%XeRxGilU)b9%+nMqj%|gprTF*Zns5wEsQbNqqBiB>Ro3&2_|p6lRFRpl3|;wzk(o z92DMUAe_3+LsG8a7w8ur26~RvUKP43^650-7zEa9A>)iJIkh`VpunpYRMhT zC0ffu_Rq@f9~3SJ1@(Jp)oiEb%BJl`gFER}bo#AmnUNxIy8+KP7P+PDJhHEkKnWeodLtzNfH~`&-44;Vl!(G^uiWrNji0~Fm&V#pQ;ND?~JYL-X)fk zX5lUcFxjV=#2H8u7z}JRLBMf?x78y=5m^q58~|qS-&wU>onv>uv0WM564wKxUSQtypr{Lf0`XD|N^Q35pfcUJv^G+FvegF0X4*DOvv| z6$KR_t&chJ67`&QPkGOBe2C7NuLoII4ciPYL-CLIpDKBwNUWd&*Z)J=coxT70Gq3#6=wz{3;HKx&J}lsER}_XmM;NyKa?Y9jndz$zv*>g!+6R^owxs_x`1FftMWIdl(K$ z*6kZ*G78}g0Nq&2GS{L#YF(x`z?Rz(R>yNzo?Fe=4w>byn=@k${oVGi7}wQvG(klI zQ4v?aHPY8AfRa9z9b*|D-nk$Bm8kxlf)dDHzL3=LFRZr(YWt1RN8)svW+Yb$7>dp~ zbUPDZBV`OuZhs3m!}>5A!A8LZOa43A0)xcS!Os zT#aQ;346fZxA(<$_DSD6XVC9)kxs}vD9qT-HpLHN0fA221Ctdk<<~u=f_gl1=%qLy zPNE^HLhsZNvHIonjVVupaiErzcr!v0O@GfG<}YH zb(EM=0p18>-`=B#BQ&#~yhS*m*T&}Q;f>Yq}e|jSQF{xa^mob$sL~O1H$j(7hHy3 z6GD$#xfu_0mVD4sj@=kG=-K#j3CU#qCMT)nj8I25M)T2)!F*oL|6}US!=Zftu>Wfq zdu1sk%TS1jq>?Oy$dXE0P(mT~5t4*3Gqw=f5=t7O(q=77mXTyEWvE2R*vU4GZD!2O z{an7k-*X(#|NW8sp8HzP_j$ffNFVlCe|_3BhYu$JljUu&yKbnAsN!TD@G@>G`&bMr z?MKJ@i#61rVxkgh?T0buXbWf4>beVihy>4+GD?Bn#{4km4fuBt*ENw4gkl31+ z7NM&|`ng^Rp6p?KoEta31Kv`hO1pi<7epQ#u(Vqj|9*JUio>}8%ve#yBaL{oh02?) zdLcn+49gtYN^l(5bs(7GAJ1Zr=*aUp8nl$BafO>$CeRF|WuAjkcr@e};jfb!N!fdx zWNmbuEA@~ry5pbpkGgDVB#ATD%{seA$9sWXmI~_>d~BdoDw9B;PJcK)(9eu2MdP` zcXtm?j5^9syhL-wlzM{e1y?vJxw>P z3U&<9wdRVX;2tgqc24~EO=YFdCbuXx=t+xb{^-ba@sJ;@&^4zDKUn`t^IjBXw{guD zWYih3{6ncbFb_#+dOt4(tq%mpQa{DgtA^+j<2~qwN6g4{+{?I%0Y0(uHysNh>D7cI zm67Re$$hZBpotSB6k6Bvtlgjq_O=&agHg=kwQlZCj#pfWDi7h|QGx{o4e%<>=dhzV zbPVIa`W5Ib{s{X$Wnod_4Q6Z$f6jtNI$Ii+U&BDWO8+VTZ^dr3ViADzq~i_)wTs+K z9o7Y23%R+1B%WIxbk}6mbtWlYj3xAatNgBY!^&oYq zYwDmhRXf4jyaPrA6H4-07SFiv6-ap$I^54+l8X48l^%JBsbOXns$ej+{ zGByy{aw*F;R>lQJ{um+;rZgm)kjYI-mLt;Oui zA?!QPVO{udr&Y}y_)+TQCh5oj)k`Z) zNO;%C0MPA_@5d2{Zi)H`Og;)|jYSu?6%Wnb*z(Bp>3P;;X!=ZwXYa^a)^%cwJQ#up z`@9pTHfv{iQ6_QtVXxI^3B8rjxVtAB+rF-zbsN%#orb!M%?L%lk(%tIws$al(Sp@m z-r2@8RF#-9C%L@cK~cUPdy_E$K*#?HDMskOXa!GHySJ~G)gRHaDTU|ohq>|OmWqg( z;i?gLlO4cK|I!Xg@H9>U=%b;WtGZESt~y3#K7r93E};NhF2OSefy@Iz_rs2Mo){rn zoh_yEHvfSnnxTFk=nU7Kjg8mYu0e~&l6+H91c@~x6lme_!e50@C_KlcG+_x<*<&O| z2XQZ5i@DUJT~e0(c9pDy>}$fRp&DR0yr;`fm{SV&L^gdWbT~AQiNnb_pFk}00}#`+ zV92RBECHemPL%~N*1rrdl5OzWk+!UBzpA&;9jG#JY7<&=r7nYlT1o~(-?}+YFX420 zHPH7BjxSLo2J60)Tc~7WX3bD_T7GbhdyZ%w=E9JZ7%#s&a0cu*`-a(}Li1`cb5$RQ z6|%)zCEg_i&rHR~UYSeb1p;CCR$Xe9`HN!rL2~27_);26hbP9Ja4zbx>MT~mkBS0{ z6_8SmZII+z)&Q$j$+xfqa2%1dhQz-|0b3#UZ%Yg?9E86!;LfPyw(BGI1E#R!_}BJ( zurBk{MvYvF9vYm$Kb$_v&{Z9M44)mWA`Uu1H(1nrETFZ*Tl?Un1wOY4v#<*7qmyEHW-eZ*-O+FAQpa)TK1eS; zc@&!FB53Cu2HHbQ${a`xgRNth+qkwF_)ej)`OKN!|2$k#)hcDV*uz1>H37}r`M&MO zt1cS-nOwOFPX)@H=XN7FsdFc{B7)mqQ`2$xzOHV%FNamR@)36s>|3Z-0(MF!KPwXd zccd}W#tp$EjRh2n{uF{CH$g%IQnzNI#M)I~QR2Xj5Cjmd^MjHS7yEP)44pP3jkS!+?D$0q~d9T6g6<7ZrIg`7D4XoEl7rJZxhn9jh`- z5xibp2=DgEYSMoKB4|w*k9cjEQ~5oH=?#XKRx`TSWARnp%bzjBKJ8BzjvQb8=kdp( z5XaNP)kb`rET|fsuF0_ylS=}*HZ|8UfrCl?Cp%l~ceZM!m;jf(&GL@vQ6(mGo$)vym8jI0>YI$E&4sO`xr|FhmqB@>qM6Bm!Aa(kz#?^wFZ zRHcbM0N5{Eb_VZa^lm<+{j0c$Tl~BUvhrfaiic4RdWy(MWcV&PZntMV-noAN5{huS zOmsCCKv=`X=ZZxR>=FZ;C>#NsvCWd8@XqE#gGbSzW2+Fbqr8$D8VFJO z^D55+o6m~CyEkIkIetq$W=6d2_+uZbydG&|)UPfdkKeqRVu45Zo$qqp1xFF_tfT%D z!d#iA3_McnN9?LO)T5`3n2ImNx&G>n;h&#DWTFw$gq&%BG?$MyUcn{T!4))f=oPR3=y%Itt2o6 z{`ZIkhY`i|Ea`ti#*oCk8&di^P7Kku022khE-P&2qv~*`<%Qm$MVM}BM|kG}A?x@* zuluuJP@GU+m+)Tdnlt7c*(j2M;kc;XvOv&@X2;q82DA8uq!WViK^!Ff)R+Qqe4-xc zZ-N%tb(#A&%Y(hHW4A)n2Svo^#ckpP39e%0iALf=0#iNpPFd%Y_pTz5lz+|oR&lkw zPSQR{?sp0}ty;o62egH?q;VBtO4Ou2?F&@Xc%~qn~KkcNG@?6SO8-Jq3=zYroG_BVbb;J zcMgSrr*i;*c$FLq0vaRIf=5#z#PJLt7_t*gX>x@<&70C00)@%dMvM?d$5;gG9(Zo` z)pb(lPPUBFSaOWi?5j<%^SP@v zzpLdg{|aBXUg2DopZE{k-D?-s;^99VJS8-UQZyzztm=)ROgiWIOYZD`$L0OMkA-bl zR%{opz29O%{+#GpP$J1wdzaJkmNHj0g@F-|=2!ki+>N1a4krQorp+o#Z{Z2`B%Ak_4z#y-VbQ>L3om~}!{A0qX!Dp0bXUT~ z9{VW<909P&j8_SPxr9@5JAm@k=DfM{U|((FWtk<*-8T>iALTeImwO*)i%v_`5s z+TO5bam5I_ElZ3Aje0LmiZ3}@wBmD>xiAoHS)H;J`&s!DVNy(0dgg*l#}ef%3ja{~ zG&bgQRZeaBjXj|h90dGOUua@O~0Jj&h`OC8s(o4fDC zt?2&?%?8r@@#yvcPk9bAJiS3mHr9V96b_Hur->UwpnS20F=X5;BZ2!KV%5UJQ&|@( z%6J?4hNW=!tCqKGK+-&5aF2l$*5(=hvwyU2j~^lzbIe-~r^dKQ&`G;tp{1*%7M%ZY zpr7}3`B{0|uu;*@!dUk!#Zxd%+erMJg|Pr7xxApna$`XM?AJNOR1hu=?+JDdRIdULCFyl0S!};05&yl^PTQsAu5~H}EbJ;IHg zKv4}=m`rjqyJ6^#_IMy_4}uvSqw46diMgqOhH4}fid&$`0wnVTIGXGX`ndTsofhzX z_2a+@^I{LByC`_0ZhKJ0*<>E`j4pG0X?_U&vk(%P;f7(MUk+-aa6|hk9+WctNi4&W6{PUqBr(fYT zS-YyV+wpouz~|S~J(}y@CVS5QQMjL;s5VlEnenELzNm9ReCNVHUP*X_@Alh*J*fC# zttzFKDk7Bsh1?P-tWKBtAaXVw#KVp$Zqe-ea(&L2U+Oq>6O0yIzVgoT&svVSY(NQx z@*Vfm&KsKu#;GTpF{TST?C$c=F?9 znb~gSP;>h!h(Uh~xo3n^rjP*})`BM_ur~7&im^AK6Hz{;iU_6Tfg(E^E8a_@L6joI zd3!Li8X)db;2+#QvAbW7T?`dn30Pb+FZ0v%Jj;#3U$KAof+)@-n$(81Yb5H+0krDB zOAuFlo%oro;a>dU5iiUns7C({5=nG}*+PTR#2f+D;U_z}o6j4=?ufR^m4{WqnRhPU zu&MZ5)&Xl8r0!mwIRZ?+lXde$D2#g)Ng2UbNVLH3y*8p z4c_&wX{?pu`N$6GmjHYVhd16rLT%KoBfl56fcTT}Vdi;{?#0WF)7p^cHmZF6QFT_# z_FbbZnw@KDW9w(9wx0kcTm?l=sF%XIxo#ZI`w^3TW@-!x5UHAkq|-syRD`n45X~rggtsf=y-B$aD*HhZ z46Y8vd>2z>6(yc-^%2QopXtxSOt2nd52?qNoPyMDm>wqoPqyAz;{RltLPM7sOQxk7 zCaFJ39)V*UG@vreje+2wy#w;VEwEOcr8ywu>%H)sbyUejf|Yc-22W=(*SP-7cXKri zuIr~+to9G0(_nF34~7%)@RkZULM-^^SuXVIbH73U@&Tyc`(x}`ZiYnJXXL}C*WZp| zr#y0?N7g~G#GdB%a;{~8hyi` zyyxEjWU4YPtVAb_Q{me#>iV`z*&AKyS$N`6NXEKMr&r9*ftnKBIqn?fHn?k+DWnXU zW!1XMdGpKevT`>vw1BJ@o~+M0^m+bnt)KDi)3&#KYRCO}@eYf6SMh%12OfLwCVV^x zmyOR$lF^2=*ci^HUpk3UYF_IkC3~)r&|qkdp9@X?g80$Gnqjh}1YUGimb*HNjEwj| zfu2Wc?#29LA=n#V?*sQ?7|wdn)>u4nIkE5C8r^HBb6+h)#ymUcUs-Or{bF0=Uz)}>J2`T>tc;RDz(bf z4pTh(%FHix`&j=go}@IFY|U7orlY`rK-_S!?=>j& z?mM~cWMRb?4-3pvN_7bM=5ws1MMIzXwfO>9YoXGU-OT+xwL_-;Y1`toP6njB&iKCwF8pZK|c}zp{sCa4&BmFPYRJIKm_VmKQlh? zT^@D6z@bX(VL$)*SpS+;zIW{PRYY?-CCC&e^Io=$KAF`vS%u7OC6f{<^ldsx97IPS zw;k}hRzMW$nw%6`h7`ZB0v(527S`^3y zIZ9YbKu{_WnC`yAh9M)xs8PFOY;KLe*C$H;a0fCym1dn7lIP}it(UWV(9Kgtymsf= z13R{pSuK({{hUEJv~kR_9zMC zQz5AH{)$#1{YXQzld&H={44b%r>>c5P~UUcHoJUHgTguZJwFu}IBVbW!)P-s?*3Kv z?Z>=iQ9?>7lM30B3i#~RaM;bV7?g19&5~WjI0wxXSnbalAA)u9bN9^aF27EI(KCdi z`NNgzEDL^#5g-H}DeA6X7J!Ld0C|>y;w&RNEi6?sfrQBSYRjLuqny`~;dyd3Eozu)YV;6B)wxeoxX zeid|KBrRFE#ajFkyhzwQ<2y8Yk|AzT(J;_s=; z0dyKgA@esq&FuP@8pwe9VI1gDoR2a*mx*;U!kWA>)W)s*LA z!~mV@%&BRnzPs$n302b=|W$|g|XCO^tB@15_r8hR3r?{>MO57d2!rk;+0i+@T@kcYsSlU{kq0Pw#k@- z9n7q5ub*=zc%u&V@Ma03-ax;H+d*)+ii1VFJ~{|%PNREqXU|uY463wDp4Uk#E~?%E z`yecOirR`a(nC7EuF%fKfPQI&*JdiY!Cm+t_98R}a%3c!>b65L;Sfo(77WW^$-6xj zV?*sPnvpGbd{NXEE$Ys>^eKC8Rg=S)nI^Vv#0n5_Im=rGchUWS_d;51bFzFI$>NE2 z+Z(x~PX(&t;^+-8?k4Qq_m(Y<%YEmZa-vzq|_Q&ZTa2rtUIbBCFwPpxrgz)t> zRq0gx_ho#Mb$*Z^j$a$rlSo|*{D;XZkz-3i36vQM*GpqQb_~Hw_T5_l+mUt?TIlYi zTDX>exTFOb>RZEatR-*ErlC+(>aCbLsezD?M;1dttq6>WKY>ljf^KA(!^wfCAeU0Q zHpdNBJg(2a2(61c&TOQ>%AlR2IaLYE?g;f%#<&FBcN%6gSl<;JHqLU}0KC!cXK4)Vd5FUt4VhL86fSMt{qkIh>zXhgA2)>pcvdc7;scS$t5 zCc+NGKMaVSfu$~9SBP&XNL1LINmb|GL5kt^(;3H#y&;tOcaw1ly&61Kqqgbxvl>1LoND9EJE^O(@#zE;(# z!4xRmYSo2N@^Fn9?S|d6EA_I9W0ebCia_ylQM9ALuIfp;a}ZjcB@AD?erSrgCT+Ar z;|hfO;OZH!8Ov(z@4BzMZ1W9|VH=o@&~_H!_&)f*tIHIEF1}y1@p-X^=)vZY%f!d! zk~~B8+>078IIvW={KL5^?D)nDGs$f}(m0_7^t^{^O4hoe@GoZ>35N$Ojuwrg;$;erE-mE5L;jaZ$LJ6C zATl4EV0{UD?@Q!F3w|?T`~9xRCQ3Kr9Jwd~a4&hCv`~W;fjvfF`z^#dRYtD65Vz}V zvtQTiIi!uIQ^i*5NCgXlXRZ2=vuK7Q4Zx*J4Ez!S_n;R|(Zgs|WBs)zJmSKvo0gna z?tDAexw?~j+IH59hoHQ+A3fElc>rZ{gOjNQ;;~;)4Vb}d4qjMk{XT8G0!SBAY&Q}r zF-Az2bb=h;MIG$I9%bjqzeTPkgj}u<77f-m#&1Do(Bbby$wU?`OC#>4ll!lptv|Ve zdbn1A?Sd7)CR1xWA*0q~&|_e@ObDWt>N<&eR(0QB@B=I}GfGUcXjPO+bm9nHm|iOp z#0r%k4@jMHa-3b;ct;lm33oFFoE+~tsNd2mW!-;6x$$91|8G^R-qA?!vZ~F^UqdS> zuVjdmxO^F^j9jRQEGgI^+ttB1ZDnm$-(;|yLCe6y z0^nq%XJ(DNh)_!5rz5rT=^T0H17kQ4(uG_ACC-93??Ibc`zl^~MIa5~v*L7sh6O;- zX7sc&`S$=fCL~RmNI;%qEF>f@356335eHc2|82Ax1Rf(;1LvJ0e=Pf$+(C#O?iEJiW(% z6C9wYlq_hJwS@sz|8S@k$RR*Wlt$R+3m zAq9`%UATv4n8<3-Xz%1m(B=hbxTgt&h7)Xvd>CLzDe@7yLQk1*Y?!5kIT3TIH0|S zP1r#b6a))#Ixl*m6n@d;ij)=kbXcNhU$}wv?OzAU_1}ZkhR^-C_*ChSCwsfjyib@w zpy8dbZJ+eV4(YKLAOEPlZ*ZJt8urvkZt7GqE9Gb++2CK6YXAuFnybhv6~VeM>y2Bq@Gl^+`5^ ziMfUv*M0RKSGeD;nUqLagN8_ep~DFS3Gkz5V~QUfeaqEtfzFqThOdaFIV_-DeRvTJ znfxyA#J~=sC^^u(y~$@C>TEmFuQqY^pIK;9sK%$r&vuEGz%g`lctpi1 zC6Hw_>6-cir~ThIBgWyBi2M%{pF}c~a)MotO!%Rig?)XFc4Su{^zpkb(eWd>r&_a# z_}M?i*Z&v{;r9m$MvNI;z)$Qd2TXyCe@%4j=z_>RlVQ zuVB9v`(PPcH(xPVU*Ws>n3$Uw$enYXIv1jqKo4}bjbTTrzyT{e3X6g;`h5{lQA<%W z5nst~Bo1#h!@=GCiv`x$-HrD5E46vSGV#3`;o}StjKFT`$iI|wYwkuguhUd=Zu6xt z>yJ0>v!Cw~+gX~qM?p60rZ%N3Iq9E$PW8(57X#DN{ueJWwM%CEw@Ye4zSs0(BM7;RVbuxVdo?oD<#95`>+BoH|KI9=BM({J+ zpt}9o!8MpO8|8Oa2CIdn+_ihQkreOHo(?kb#qivOWtbE*oUp}ej~StN8m4Ta)k9GW zt){PpZrO?Div{D=t%w8!)7V7;NpNGMgGE05(Jd=xz5qCMax2)Ez_P_jb4yM6-!%%T#Gl?YJ(#FaSu#)`p;-M{rNfWyG4}qB z8q}QafTaCGk7L2gG4c4i=-}DUO$H)i?LV}l2ioa!HO6K|P7C?(GS2)Z^!Lt%9SL(j zJs+JYVEx4XBzlmz_I|Eyd+6|}p_Kg;pVEg*^6`OdETNzAhDU$=&F#Clta}K@scl=F zWlEr%5D7@i>`G$kJx9x9=vejtJ?bkPk9wlYn)#&>1t7k@1Az{!26Y}H){^`7m$c)u z_oWZ77U4xgpSu_B#;mN!a&T_N&)w(NsOJ%R!K-(Sas~wrg1`5m?BxD#?u_Rs+y*6| zw&sd#7-zpi_b#FImLLntjm8t$J(FBAA0Q_>AP-CQw#EC}&BYl$lUTOh%|&d}WqzVS zuKu(jpahiaHKdhi#tEhpnW+wKZRfc2}^Qm9gd|LrbTjaf@H0OqrX& z?i623I%t>%C2W* zZ{FvG@cH%_i8%v500d(^pi9=l&38AH?wF}~kAt#ugOv`g}jtWc2n`~6|RUch5P;LOtf<=bLY zv)usmQ%D9Q81n6)I5B3H_sYP*v!qz_Hhjy}ju$@fZmrt{<@RBfm3kxo)6Gr2Yjud! zp{x{CRyZ2?O=)6ly89ub)0>1I!y@^M@sLWiPJFSUI(@%vKToF^-WD^F2Cy1Ml1J^| zZsQfD_#mm;U}02Z11h{b z8rV#G9gWxl0WAN-JtHz@-rPX9*KG}-3-NU*M!~r{ZZXJud6I`9ZR{(Af^kH3Bti`L z(h7DKE+prQ4V~s8n99P7pA=5jdRbGe5R~mGEQ^l64Ux>BSU>nZL!KSJhkZrAH49Vc z7EOys7U%@eaQ?1X^6FwW?r3v+Z4Kpp7`A_BGV4~NjegM$#N+@S!*f^LE9u~Is{{Fc zLigRYlgC3;&7oIu+GT0c-T3STJ=s08!uG@00E5-p5UzJG4ZoKU3QNhhmpBeXTuvTE zNE0UYdMf0O&uYyhtbQ$h}mool1rsSK#a>xwzz<=y0yi9Pr z?SLBO8(RC&W7@D2F%h_Dk7g985TJLF!y_R-%nNd5v}$pP3C>*YF2$#exU3~r1Bwm`anya^2bH@ z$&i=KpNrX&fwK9+q3N$b$&am#x{r-U_Pw&IPP>}lVKjI#+=sTAs@)vpjC}beU99UO zO%5#pLkn+^9ZDr{<|8iq7eSPC9zJzG>Da=ZZ`mo~_$I2k2|38d6|;n|$I*uF z;A1%49{Y_AAgiz&|CJYwIy6x}Ns|`^gUFk0^XEHtmDasSI&z;m%6ktKKifjMLqv*% za4?1Vkog7L>{enMf*OgYvQjvUXs{Z#as;R%T7Akr4Q)?+kX>&Y;6W34~TsS)R%&CTtvNECoMnmlZE`>62>3fyZjE{uc^|;e=m) z=eSB-zRa);83#N^C&>m*&(wwwXj;&4^#UtL`FM+t>(GLuKnVXbklm4J}s+8>+ft>ia> zq5UNGuWL{rCU1q zDW+aO&yBgQm#3h7SzypO`OE+RUIsUVIb%dzh}0O3^Ai)xQ?P<(qkDa!#N|)?pn2*D zaK*G>hu<#Ruph%_=w4VVxNottXUl{@SPfPvn9oybx?He}Di_5X%D`!{ASM+uIydvA zLjWsaVn49(K-yn0H0_Sv3*$4&r2JoROLwBTKN8UC_&vRm9nU-QJd=$t6^e}X9gst- zUG`IJ?C^A&ih6k|dQ%KB1E=F6g|Mv3wk(91&z&lSg#B}D7{+~rf5+CY`gV~jtJg&i zuGWOB<*!Ir?!~=q85MS7D@)ur55Y*?c(abej9O0V5=7ccS_*)-5|AQ|o z?wI}cftN`Ij+gTccOz&PQ;v}}UKQeUAo=`)-^ifdj6>hM23q@9>cmgO-xV`g{(i>} zN)PT1cNiRu5lvov>gtteoSHDu}vFwa*We`!>Q{H{T#kDQ@7+)pG*k3 zx+wY^{^xol9!%O}sIJegaJx8LlHf75S3D(%&s^rqipXk>YurX2ch~+J7Nu76sW>_p z`(TmX4VyB;=T{8G*lp6G9cg&-^rupuU*c~^hp$9j>sb?73}RaTfwjH1)2|{47|jDC zzEwjSi=ufa@?;=ZJy0HOU9;f+{LR|b)ZbT?3w_D|`<~oW@!1#!9ZSI~k-&_Ngz`#` zIr7IpeKr{~MIik;gAIvcI=sNHz$p4@3{LoicKES~#%sF?M_wib#o$h#%dfI2NN`oqQ+pzn(7v@7Cy*(`uz4^F`N9JvlN=fse>c|V0;Kv4;o?cQOd8`$?_o-*E(&IX=P?pS(8VaWA_E6gZ}!H8Kx1vh zDo&%JYQeR75)b`8P@uAdIH=3wK{DE&=VsR+v1|tb3N?werWt!O9mAd?N`H=JNA08% z3hLEe^H=|Dh0gk;Fz>b(s4cZZ9VWywF5DCfi)Grp1T*n}d~sndVQF`*xKaay>q9#2 zxVx9Wy22_H8pQD%E#`oc?XTW(gVL}ODeORQloaC1sp0efnX{!N7LNSIk4iNu_IMsv zZn3WuUQ@67AXQC#ZnJcMGWkSql8&aw|Ml}zV6lF;p4zpY%w<4E}C4GjAEq>JKaKfHBp4{ey+SRi*bsySbxKCo$-zK*X<%aXcOxlo@&`6Y-64!;_5wYb|WtgEsoD z5LL7E2qy)RksJj@&w50t?qd%eMZiv&rw{`sYv7~bi|A6XfT}x(9Xd#M_#%Y-D%5YdYu`n}Da&N?+ z5^N}={HlPwu5GC<1jkrsujiFLn(Mo&k}v!#_E}0tQycCMi%rQ5c^7p4%(es$)Tc{d&f!lB6n&tU?3nZs3#xeK z9vb)em!43QeXjagD{+wbj=1LN<$?Vbj}Fpt{8 z@o4i@Gc}@44_R+qUn%A3I^Xr}YxJdfe90XWtQd7&XBUqLwiqWld`0lvOr>|aUgvYE zv@T)q{)S5525&5e!Zi-a2|Cg1pF{56lcHi|4>p4@1HX)42}y$j6oU^@gfEAdiYNEM z(#>W{oQ@)FiXB?wCJO*JNb!XI6%aON`$6SNsT#T=5Ww@wF=PQGAAWCV>LUa=PoZrdRE^> zx|xGQV}#X^}AfQP93Y{s_Yl?k-5#h+w{LXhXsZpOFSfYP;rR=90V_89j( z>PAkEd^R#AK)k0WS3BN#!{^?U0t+EinRVMtyG;&9#nX4bsUdj$-Q3(*s_UOJ6`U@12kk?4-6CE25T$qS(x1Xu7i9zf|PkgFKTjjNo(od+)*=2lQ_$9nXY>l zy{3=%xIQ=N*n}sseTH=xba;GswXw6TN1&JWEo27MSnzeFCSQd8EdiVpy>AzmmSm*< zIArk(s#ifYjNFcDBA{ce7Ad(@8?gqI$wJa1{U_u@to%6y9q<~ee^UNantZU#o3SKr z!5*zg)E?4{+iq?$ahHUDcLVuCpXbKkA8;t+xKR=BzJR^psL#3|524HqbGDRHhUM`Q zF-$s&YKX<|r9-}iD9l{LU}C88C#zfu_Q6^z-%%!u%=3$bs6=dW9%Fip!&y3W9 z6LT-zFE+~lK9h-U>k(4?gDGi&@?}^IUTP*~!CVk$$_LvOOZGSCqXDW%(ze3kHHZH# zV$U^&^|jyWe};4$C$G3`{KccrS3?1@ zbQRkEt)NY+g(KypYG7+vKGsv_>_tf^oaadk6gHgLUnI3eR*bH$y;q<&e(cfgdG6=A z@^8KCjb3}(>a>ru_gpi$mhAt8>B%2%5F%=2pY!KPzRgX$zB!0bpAVif;gV4%dydKu zOu~|k{H=_pd1FD)rbWm)wfPE{<}wfz&lOhYB%pKL4@JG$d4pz_Ghu&r+Gu|!pxBcYj~Sr2am3wB zfscD14FCAPvtD{D6QiTbm4w?;NbP>&-5A_fTD(~9LkQ}a5%X{Cmt=~106RN(wSSaf zs|PUpmR~%L1S7msrL%5|UhlgvmYd3j4%W-zel^Osp#Opp{9yFaqGC^d8IhM@E5+JW zV3ZY-(+0^@$4<@46fe4t5(Ue+|4J=r#bwL4d z2ECyzU}N9|R0M-FcnRZ&DL0ewkCy$kE(4E?@xi;e1Pkm|_o7a@SksU^1?^VS_dl5T z57H1V(C`%6B{-SYlA9yc9Cm|A<5Ize8Z*U*5rKfd* zH)Y@^O4xpv=d#`H5G{1c5n%vBh~C=pgIk3%Xr&m$X4!CdsOD_J>ivh`6ZKT#bJL2> zH9n4ut+2t_Y}5W@ZxYhCt}H>)jvljEdUuoevcnaH5e!828CyOHdi)B1FL?07?th78 znu{l`mZW~Y@?F_owO535I@mC#j(8dRf9kCarz4BLw>CXx)Ra`)gkTdk;)}sNCXN0z zb>~w3z77l<$MOObce?*g3f>CqA!m~DC{gbRCVEQ4if$QfAZsbF{ZkI6FYbK|CHHOO zC5RzEc?dga?B~5qsOItypW&IYbKxr+$O~~iOdyK$IM&SXjBsLT{O*`^3-8prgHp_b zsfcs+GE%`7Qk>w;xA38V)Tf5&B zB(NSs$Wki@I-;!diUmIpG!;B7tzVSszMJuLSC*qOzn%_Eg)~DJXb8C`aI`S{hYubZ;2gN2`R^7K&eO*yvG<8<6oJ_9{c!P;5_F__nXN9( z{E{AR-h&HrhLjN8|3bPZqN$*!t*(fM4Br zg~6Ml*xB9xh*0H&risS|8#7}e{5>8JA`d@c>^@WM4jxBjMQq4Hl||Z{m13|eH;kGX zN5Pu=Yhy-&pNWbBLRyIGjAWp*sWj;P4}UZjf8(=*9Q5GkQf`$LW7Z+v^F~YEjjicN z(r|HCC0Rx$c?N%6CRHm%l*a1UbF<$rl94O_+9jOTM{=ym&T%0W*n&vPoi=%vK*c2& z(lO?OC1t!|#aMyz-fjG_QA5ASV$k_9%vmLh`K2Pg)0koRkzka|?%-NEko%4wXd-+w zG{>5gEwK{CZC>ZqSPb*%bOq+qm_|Fai1Xt84>b{kvLG9czlofLGr)dtR`> zo$;z_Lj+u;P0O8{x$L-_`?wyV3jK1X@S?S z0z(eC8)~nqyh8Z3zBt&h4Y6V9awWn8+9X5Nj4+9J^MN0rX#=cROkh5VllG^|0&~(- zLg^0X?*9Z!QGGUx0-pUOSgdvm4DpDjd>N3fq^wPKWWCTLnkO-e0IO_nPfh$ zYLb2mUNM=st@k3zL}pTzTL~))ESG)MBI~n1;?7TA=Iz_&IF`IK`CQ3eDoRX)wIA$b z3NQx2#0tUGL}Sg|=>bXHfH(RBF_9T3mcDW5gPvjcneYaC5`TewVOgX^cueIhFw{Ni zf?fX=D{}6~quZ1c!4M7Pz{>$0(AjJP575dbHm;Sk?y{taTLwk#Mg`R8GoS#Twr7)qRhj>>z$wX!-F-oe$-g|AT1^JkjM_yeJ()KZM!?lpN{!$rd z!2J}x#HO6~WD|GK(%IaK#{(5{mo->^E~`D)JeXptQK798#u2Qi{UI=%x#IYE|LO%m z7#(rMeLL(6HRZ(N(KzmArGM6idQSfyj$@(|v4YBMrJ-BW4T#SVQ7#S@FlM~lf9u_c zp?t^jKhGauf1LGD(7GBP7q&b11wdjK)KjDDApiy1u-G}!Q06}I#AzWGR^&7t zE__QDy%NTM*;FY3pHeyHr8ue}k?y8w#*=;AS*)|&X;5B;aettAIp!(;AR4cMwj1{z z1AtxP>_Kzz0VQj`;9HVd?&tOst8g7dlXS1g7G%4@WK8rz@)$KHr->+Y4-8b2i*t+3 zKiN0A-UEe{Mujo|tA{VkNkgL|d__*Hx`Rn$gYmcCz!qc%UNWR^H`r$umZRAx8(lbB zO;I^%nHw?z0QtCCy^ZnJ7vJQSpoqT73>-Nx4Vs?1PxACtzk8*aYhw_dqZA@gSj;iw zF4iu;Zwfw^INE4SH!_1HUGq8=-Ond2S2Wdq-!>j|B0FSzJ0CaN?fCV{ve1%J$342= zOGkS7x)rwRgiZe_PN5sdv@W|iHtc@=$}Ku96lTo1NrzRBjzT{8%=+}H#md%nl2916 zkjxn2xMdrjZ}Ut4l(ME<7;x}&lA@wH`+(WPR@I-6UTUpiL&jZ2IKn3`?wy$|lk0hE zZq)|0SSDi{Z&fJ_j(H4YP^B<-$`cU0$d%x!WzGH{n%+H->G%Ktzc!OeWeB0#<`fZ0 zQjyJ}98yW;kYmY9C4_Pa+nhpjNKU0tsdOZjLk=6sv6{-EoF>PT^J!y;=kN0QzJGt$ zAGJMqJ+H^(aev%y0Zi&P6A(|Y!+f|+iESp8PTPm3kQw9hf5k6Nq*5m~onOfmgsf}! zTK+l^6`ud1HA1MvPG{UZ1$Pw#a)^xkDBwz6JeKJ+d1j8{norcv1tU_hy@K=cBzpNzxp;Fi(kbu5-)cDcVr4~`h3m{(y2me6q zrb`bN5cmgq9)}Mcejg16AmJySrx%{F;+s(r^fX>&_Z84xzA6hXgAtJ1T71cQ0AxO53Gve*T z*_PbL%{bHT_EqS!s3CVnkvLV})mDCyZ#Iu*0;DnP&@`7c7)0X#hqXB>3?Vic&4q*G5E${H z^m<}tW)QroEAf<;%^l(5a=unAkx^aOpW3*8r|WtEMNTFI>kYkTMUFUu<)=o{78fi? zKOmj-{(v7!-AEpMwh3ONIsY2+%R`IfmvMTpqnCSzu0UA?yiomNHkug3bG3=Xs()S# z;tQ^AfM%H9*J6NC3uy2X{8DQaX1No>w)|KznY!b9X*+X>;BAZ@s$rs62~Am)uZDkL&Q^8~1fIzeGqhm^8z>Edd6?>nU|Zv6%)U6cTx!XrI9l*6l8tR6MNYNUM1Gm{zvE(hs>qt ze9hs+^dhB(wKgnaP|v)RI;Yrctpx4DrIGAoMZ_g%yMHgk%`#W2ubkcLaR06tN7@29 z7U2TY3XIS6aZbhwmgnES=>{Mz*KMps;#*McA;ICiqf1i#%yUc!yF6l+U)Ds?x5TUN zb(PUSWmxfi%~U7D6^Dyja+|%(ZZ@Zyao-f*fXL8V#7;0Y=g_k9X4WVXCiuW+gTvti zJjPXE3D$1&T%-Xj8Ixwppey>;{@N&@`-{k2jTK8*X$8LdSh8cCWE zI;FMxQ0KpXEucQbfZAFdp$NW*q5!@K1M)kSoEe-)0Bl?qzneix6XZKv6s<=cDsU&v zc>H=ZYp6^~f;Hjh5t3u+ynY=?61ke0h<*aV3*?jlzaN8D1QvsMjujm9LJ(isa3YS} zOn;vu%`-)je+kbVFzo)f>BWWUF10a_9aV5I@WQho3&B22x&2RtkeAUzUoe2YHbSd4 zKZzy;+#Kn;09#9W37xHzJsucPX#x)3JaLZnqlrG7sElYn%Sk18DLNEt2oxsYa>DR0 z>t%0|thSA=Y2laeJ*4_YET3<|yAyuzv=?*sS7-jnw9JF&C|W{>RFS!-w^^96H1*}5 zZf_N?+_YDTJ=2)}%0&BYW9o3V=Q@=z5m>{^I1h|$3iLdxJbXaMH?=|EmEYg5-%4$& zLJs_7IjWx+()M|l!s&6a<2Vjl^6ocp0sSfcLM;XLtdBWj;2lk&P@$ueBeY{oEUf#| z`+xuc*Ri!`1^za&8T#wS&*Ac0&=Q#4DBAl-9(NqEhgvpc2DCwSaAOizzTO8JShN+u zdHj|bkpOT34yYeH=kGU6dW5FMh*c+4MvocLR(%rRS#UUYE75S+s+Ue>sKq%amr{hnuil;`nd>tb} zCM@wYE!Mt6KfPmVGk_>kqFCraV|}lbzjLlaxBV>^0UsBPa%Y1&83d*@L^CXd;7P33 zBbH)ZzL0fIW##ClS*`p7X1+M!Or(iUYbGhnqM-NbEUKY3@M5yGdsRq%xi#rEHOo<; z@N#qGzhr3sNMBm^6AHve76m@sSI#>IbrMdjV}G})2wWWmd1O$WATuBPs?>>JrbCjb zTm2<$)#}w`hwZGLjsiEgwaD8+qYHJm_Mg`@<(o1U8b~EDHdsa-Y49@ECjJ!M-p4%! zu=;W*2y*7~6~u*R?)h`0pqTJMn9gu3_A0NVxU28fkDYQoKcn_x4Y6bO84rTm+08 z9fF^;^%}4^h3;o@%scJZ@~Vq@q(wkJyqxs?b*}2pA71#;Z6*#djPMoKAEbk7&8+7l zj-1wiN<`Y0F}W#jN+J>paD^bB257=mF_pzQ2jAag9sywILorlT^<19La^n&|b@>by zx0uSuQP#{sYYXERWEi`E@eM#+8qGt+XHX5lPM{g%MhOv~DgY;G1f2~R&B0==PVqP% zbx=2V^b`9(Q*eqN#d_){N=ffi0Pf*%2HSxIP^d2NkImr;n|?}xfrr;rXT8t=-Da|C z{26y}&W&FMCF6pc`nArVR5f_`H~^B@YO>;fE~hT5$aD`uBK*lEQsY5Xt*h9)67+q3*zN z!lqfh|Ka$L8TiNXh{9^5exj^xSHEp{Zcq|P+IJ&06PA2|v=IF$Z8Ky+;}u9!59X zr$O1ki@7{BZ9C6#NlHtgfMSR)pcq1NPz$7MvZAXA&8JPI+O+AROG%!Kf0X{M37^(} zcg{crO-qH-Tw3AS7@PLy&1y4S|Cjw`fSY@50@^UBPCE(XC`+Ea?aG})-MR-mVR5{i z?RCZ`|ZxNe(UW_l; zr{$Wp%h|atd9fuoMF`M#MfF_cN<5}-q!wSAbsKG(e;1&@cCpAwWm(1NC;G*^WL7@4 zc6_!clYQ$AJBlrr=f(e=#b$|sKOTye!mU&Cr(zPG7`>mJZQabJzLc?TXi2vf{(q?)&@0B_H7gxy`i(yO@zN*eJ+gncX}9q-jQl?`WN%O#PqKp zOM6GvOisfez|ny_%@t|a>OLVqFs`x}-Ea|mvGHRgi`H28$=vD{UcfAAbxEkn7!1>U zT2i_cAb?A7lpv5mmk*f!Nu1~+=f|K=2~Y+2`X%b^kXUG`l;)@MMSnve5~O?&QpumvlL_sH`6>a=Ig47*_U=NomT|-}uH$z$n9ya6y$!c} z1Za(q0y13=-kM2%vi|)?Z=<6bvl$+t2rc<|d4#Y2MaP@>xfyR8R$yz-&DlUM1wgISOZ` z!jd0|J)rfuOlBQfz+OvwOPu&uSo5#l8^FidS3%?2MO{dV;~ zGNBQYetSNocV+dV)iEJU<6^2yL_`Jqhg0m%Byp~%&TU59;M(3Fi2Ny>kEZFtbKjyG z8lcDXa`Fw_-j0=@$HxKi8$fD(Og_t|j(&ZyRu8jr_h=9RP!R}sSysn)3%VbB(DF&e z)3J?Fys_Dt52+(=u>k+rNa-B*@@_~DUC<2{276>bLzw7b#jWW{D656_8-yPZy#L>a zJ~9CNyoEXnZ4E!uLr>-XUV3XoZK4j8w0x(i9$YYoCA9Uqh{FeV)_Oi)@H%_xT_}Oa z;jCNkMl<^9=?jN;>BB|k-RLLf3Ee&#VWID?ZJS1u>2oWp0%MJv_wRj?eCROdSTIXC z<@}T!Rz)>XHTpQm*E1%Em(Es%<`GgdS~3`!_83O+^m?k#O=Sa@?>8!p1Ab|2FMT&V;Q0e#esuN?y1XO;v<=MqjE6^f`XCGrs7VxZL6+Lq!$JY3?swe4F_+Hgvt zt&xc(UyHTZ~M{I74O;`m+zwz1oAhe%vQx7441b!`}p&T_c{4_CnSFDpm_6Vr z>*_g0utOYwMk`K9r>pxjhyB+Uz1%<~?_7%>KZRVVq(+M(YU@%f0f+^=l*>irx${dO zM8QqH3U)^rOjOVg@~FqL%g1(?xE9Y<;PT&{@Hm;a5FKDZ-%wO$H0L1P?$qM~1xXu# z`a+mQ9h1Xf`tcsfJCdw!`Fq)vsUVAXkks`ut7;+O-XCjNB z?rLQV5+*i`Pf_jBoyc4;hs%(e0WwRG?}B|wZ9F#ec7qyRz9d`s_@KDV@1hd7m}w)$_VG*Sxu&GR2paI%-$f&C1#98IVZf}#?zs-#w57Lah}(Eu3S_v*rt(epl9!X_2)PD$rXA9 zXTvI7aCJwQI?Xa(FBjg6Za5eQ|EoH`GUvq8^GO>g{oh{ld!)j*s}b4&E{1Mpue#;F zHZtGKmekxxT_UzKKOuo-t9F_8Fo6hU8Cqc(#tg4F)p-R~Lf?JU`WYs45uG3mNNV@G zF)&mW(XWCtt1RN_G$RCXempVU%Vh3tjK0r9>!ipMljjz_n)QHiK(#SZ6CPyJ;gEk}aR2L++%7X7U^Z0PUX$M}~S^ zslUPP+{ByVybH=c8Hzj?Y<_q0@xXH9vz2SkN#@<5Qb+tg8U6b*>+JjKpWg2+Q9;%V zkKg>4eTzCU8T$3YR6w$D7SiL;$}Z=9>8r_+LIdwY#Jh&w6LZgU&gIR1bw2!xB)zw# z94AM-{m#th9S+@=KBMuWMor1O#A~1OA3tT_pw!C8cIbOdhX14597WBz0ITj}3{R>A zg^qPQa|^oP$c#Oam)Rp<4o>_bx2p)wkNJ|HMXo;HdI-DYG+waeVl0>**KW$vi!m%6VQ)jzx^o*=Z@W}kPT10Al!wU3rjR1d*&OnUoQ5~V=b1%pRr!)S6>Kbp?M;5l z-DxtYF9fs`lv?J`gF}zXiaw^cV|9!4EEs z#|jAjZ?Womhb-v?yb}5TI*3BX!|d$0MRUhm zRGyF@<(V9k3fpDIZjV|FXvLWU2Y-~drN_<4H21AVx0|XRwC?6FOF?`p#l1)YVsoWeB0k?>OJWx0az*cG7cc0#7OmjV zL>LCj5LZ8P5j8g7KFw&oFp4;HWD~H>(}GFlSFScJfEQdnoC6vyE3o?e$jnWrdR*M!e#Baak4oZ6`RCLeZ4oIS{*lRr5aNM| zx9us68%F1lBFiNqsk!QN##wM!@s|{hzde>X6IZ(JH_LfMNre;kk_B)}#N;j9y zZrGI~;9bjbop2EdX}3;xYB>a_51pwyvPM@kK(2$b!d@;QV+_ zRT@{wcgdu@oDngS>6X68${DU4u(w{gUy|hZ%|cJv;L*61BewkThm7ebO?=HS;eR-g zf4I!og^ihqazaJ+JD2UQ1k`+jPkpMQV9mfOstR9@$XWlhzaL7CQ~=>R3KWD%@8~tw zK%P(51p)U-=cUMmAWtn&SloV01ZXZ|L_o5oL|^hNx=Y^y_m|`jzendHhzZVd<8PDq zQ&L2S~@^UH%u{!|gkl zSLkUq!7jepl>qVj{XfDN-Xl9G-6rO>R8IApUinDN{R37yBnW&w!?yr6!UMWCL#zVg|b_ z!e`xTN!sr)7?{I6*=k0$*v;+jLfwHWPPzRVV1h#vRr(cf#Q`Uso0dR;& zc3Fh&h0hq6FZw-?Jas%rG0u>KIK#(NRg(x?1P~xzQD)yD;{u3W{iy%O!)3i&cIglL z)@qhLWi(RPwQtV;RcfbA`k4Pt0Rt#2ckiC0x7%Y5lZ<1N9e?k0OBiO8hd>3&q-khQspO zm9ttQH$AwaNXkY)+rJ_Am0<3y=ce+>pf zK_Q#XJO_z32Mq$n&@v};6gGnpN2ssDRH1y?n)W^$h_5)xs*}Dr!MH%qCht( zo+EO4sw|T5mX^0Zp?n=`kkdYe+8HddE70HnjW~Q9=a_02+?1M0N{xEIsrvH=;R^V@ zjhK2Z8f;BM)yWd}0i2ZJu87nbDZc+QCq6v8{vFbik~m?GwW&wi0a+IhHjf1L0g)~g zbVOM9M{ZnvOPn1GTqG$ve?7Jq*p>3Rr&jnnLC`qHU@qz(?^hHR>`t9k1!}wDc`U=N z{<#Ueg%d>8xDc(J3$7L$|W!r`KTU`WgVPi51@ZhY;x>oMk!ZKp|NV1fgtu^q)AFeV(J~(=nTz0vzYgorv`rs+X1=a z53320brwK6B5W)ZAh9wZ#!-XJMZrv!M6jXuF1O=@cpHOE0T}6fBWB0udB1~_9@JJf zY&-z6e||tB;KaJ~pGY%5FxQC;IA+2j<;8diA1e_^9LMl&0JsYnuKIKE#XXXT1~x*# zM3j1{nZGXeGF;X_x}>W)XRg-hzl`*tSJ!~emXW+_DnC=D;x)I;sE9JS{>md%JlLRs zQ5#(UeK3ch{_EPh>emNnyEFC9HK*-Jd^n9De|z=p8*bcvbN0}G=j=NBxx4>;^qY7d z;$?S#D?dl>PKG;N_D|#Oc*$zb%O+_2avSo&0=u&1ZSAIlHuh6hL2{BORpCPLvR~P> zw^oE!d{E6uUh~6a)76)ztOVIfg8LAI*CW~fz)k+C?Wk$QHg*`{TQFgXbJ!<_=jQr z9FZv^+AvlwsGc#h?G-8Jc%9@bE`)s>q^waMfHs!|Kwjzrfn8m)pWR~GdMg6GqP?=Z zIDJ%=;W)T_WHaaYkjcLb2*XrS(0>a)dvGGQpl{4*^vjJ{m>dyMReI!_49r;6Ji6gy zx{2-dxxZdkIZsFrMmN+59w~BQPD*`SC<)eY+im}d+ZG@uymjudQ6%t_L2sP(E67tX z5!_XK2puu;F5vGtwfei;s?^eOb4W3i9tz5C+=MI&=y27Xe>*&z)B$KvIPT&7qqu3= zH+{GWB}bA37;{swaOyinZ`Pe|IV%nqvGg!xFjK^;D%rIIR+F_5u({TB*6kMi!kVEg z-|^YbhaYZ@_~EdAk8Jmwm(!{cxU7m%n}(yD|2`dPHHy>;iWT)pXY|RxPZsl@JJuec z^49oPw}|PhGh%uh9A4-;w4XX)Avt~Ni(8`)_ZjnzP@Y)sg!bbIVJP!{k^-$0*ZfIB zX?~gWYn$m?8h2t+BceA&x9nu+@xRP#VxY zE&k1O-h2mQgl#)ROQSx)pzxHH(O>2)$F2QkL1J)w`s{{TFDR2V!Oy|>nz&U@cNY2n zY17}!jiidE2=g?A(AP>$Plb_kEN{Fz6++kc5(Sa#0Q^X7hl6dYjd(U^?1jKm0Ba~4 z40TN!vRx4QVP$&A++YJx%@raDQ`fJ`G|-vz+y54N%zD`(r`mt6LDS%?1N!8>V1_n9 z022Y?0J!1@&SMF}0ySm9S5bJlFe?E?;Ah>L(T1-brfkQ+mYP~~zp4C-8&!4n*RbQ? z=xtx5ej1)?waoXwDC@hda^NDNX+x1T6 zS%gi&O5IJ)}Ogv5JYgedS6o7J%iw>cgnNkGnI(e07|SXs^{yHCk|b{j0qK0Y8VNGS1I>u7P@d}e z-KG6_=N+!i+6Xg^n2 z@z?S(T&$;N78^DkEEl(b(`u+KUz_vd_KM?;cE7Vx%;};HsJ17J@609&H`SI+E?nGu zzfD(d+g?x@k@hp!%9W{CIBVY&V3f#)y9^7l16*wYxR+!m^coE2QB+Otjcz+p!T!Ya zvi`YiA~tng-;_}Ksv6}J(%XHk*5g;$XQA1YeG-7fJ?s>ypaMVCUPtKM8-PJ9c6xi( z2bYMorzX0v&CF@(ES&pxEQHdg)V#+4o)qPc7~>N@4S8fDA+VML8xvr*|D@{(zM#f& zC1K<#lHPmF)=YraL>>V~QEwL@;G*aWiweTP8*Vn$;w1)|H{sk$5Xpn+l}%bpaC`P$ zp9H|zF6rVBa>6xY;)g7_McGb~Z6`r+23%N>1=wd^36Sh#(bE?iG~ z-D27zt5Y=RCPYiXkwxifI@)IRhay!K4#a1?(%td2$9-oY)0&lI*0VeF?qP`ZQeMo- z9+>wgBDFy zYkT;tQ61ZBQ@s^$3H2mKHA0+!Ve95PR$6kveb#;#-c#;{u4C}Cv654&(ZG-+j$+6n zTZO?-6z#=)Di=q6VnO{+4?td|nolKw59=WELC{U>?PrG1Nga26%`+_!s&W(dS=--l z*4tu^VtDpY9*9Ay5MTO|YojX(f$%x0Ied9)8#5Ju-p1&}6F?-F&HjKSFQPz8Bs)V&CQ*5tNnn*!fTsl2Stg-6tvLbPW% z2FB=itZP(IWTE|_+vN)+_-`~>fSi^hHG8fj4|3pRwwpv? z8n|B>VQms!ay`4bp%o4_hu5t&zqW`NQHw&6s|mRcPdc z$NT*vb-yeE!LMU;bnXLc=;vR8=PZf#p9-7depa8ySuR37JvD7^ka_jVT3_S$cT`eF z(%qzIwuqdDdwz3Oq6JP5y0^dFF?zJoCKz=kW@20E=uN;Fs}upjQ!fbxq>!b$;a}$> zVkE;lv{HR;_Z}|nkBNZnm-o3n8n{g_F{qFkR-7t=Z|FdF%)+&~JE{PC%L^vluCXxS zXOhh@D`bkq&l)j`Tm>JP@N^5O|Ma-LZa9I3G}}}ZnQ+cca&q<`PyvPTuf_MFwr>f3@-jc?Ae9Fb0(aK*aMu$C{|Pc_>>g$g^D3{3#tDd@0ncl@Y0uqz<_DMeDyG};K&3ra^FQj#7$=AY{< zU2PPst00}|`Mer#Miow8K{hA00!A z*Xsy<_`1s8W1j;00EU04a7pMA#jO$ldsF6OX`0_q5}H;W=omJ?S;YvRIkyJ!RUxc` zeZvYd@3s}RH~y0_)Uv2^Rqp%Sq7E+Cd@FSn9{TokAVOj2nza4h}pYH3Qb7G1lCpT`2Ye)~sYt6>7HE0g{M4;w*@WYF6 z(||bV;h(<&{Nr)^U3&b?U=0(H_tcvX9Y%YA?}+{x83n(mVNjN z?yT#K|E3PFBxr7L#jp9hT7ta0FmM$I3 zcE>gYTex|!&98r%!SL40jA<~1`|3Ye#Ql*5KLyn#D11>(pu(mLyoI4a*0ZI#-&7S) zT%livc*(!fxBeNouKPR;{S9`derKxv^%@)}xi5=9d~G8{bJNQIa+f3W2;NWW7e2!J z7PJWQc2^GZX>D>8m|F<;ND!L=Ta4zh$Aw?u$&8ZUyo%Ay9^`$uagVyN+8p#F5?z$O9zKXdM^-Z}w1r zwHqI~a?3jlVGIlI;_@X{6c^zM4UeCK(tdbH68mzBa?oBom*ZDQL9wUixm$NYXu|Ri z0(Z8|*phStP5Up0WI6{Aw|7DV=K*fII=3f%<@Y2=g_3Ca!q`z7n^!0<=)pz6wbgZ^ z!RDD)HEs_Fxeu0trfQ~Ar=-Ui$d^DA5$Cwo1JSBqS~h{6-!1(3NS{t|mEQeLHd35aZwuo^8}Q|`&&NCg8DQ)V8KLVAM`)GwX8X8zLSW5*sbe% zB;>wIS#86I1So8L^5PQQ)z_M<+|aG_{EISf`+K`Lr8gE0gp96ZQDE4rq$m|oPLeG5^53hVt4-8VIi=+u~Y`yl1T2t&$Wi-3Lv*Grd`hn1-bEyNd?T>sDL$-CAxxIVXbF%zgv-%*_3@_fgM?hYKIAZ!o#seus0 z1Txuhs2GhSCs0iw ztK4l$t0TWtFvdp(z4hsGXqc^d^VRo2eujVJifil0rWKFoc|ACCGhnTVJ65fU_l)!m zO#GwUaqNrO(mNITea!50_9yupoPU}YwEp`Gz@+fi@Xd{DzJx9xn`AfQH(c-uch;lU zK0X~kr)v4xUK9!wzj%)QXlx!4(P2ugo=7JeALj|tZi+6ykA!Xvqpxc#1j{el5T z30E?gt0CAlaAs@Mcjm@rDx$C-rU>R|*UWQX31LCa^5`$wnzx1y%*UiyXnvDc#JHO* z?Zd#oyc#mr?A?Splolr%Mtd_>_GfLP>cJjl z{S~Z@S&iv?Ppe8vp!u-IQ~puilrPw5x=;(R_ht-#}Yxc=&Kbr)ss`|{yNsvrz%rT%7Nu=Ge7@fE*yenc|jn4 zPoGoe({@e2rWCm6x>;2xOnlOKMENFRZ zpt39+sWNPsbQtw1YGc|eS4;8NKksGQjFwOuP1h!cCgbu9f^+w4!FT{URoLaG-dR;J zQ1RhImS2D9@-5M;GTdJ{a{Rs-*bYJgH5A!Uh&(s@eGfBEM5Mt-sNtx zU?{b4kF~E~yPG(f4D;k7D7&Iq5)N9;O~4NR0f@#_LzALgNfI8}@5EQLcuh`-90bYh zZ=_0HqqFGo6hmH-EoIG4j+VtpQ6fh~b<6`c5R`&Zms}TFCJ9uVf-p0sL7q{I9qnBp zuwjjTur1xQr+ZHTiHJnT!L#TNPC#gx(f3u^BrN(EVlFfh4HWI{VS!L4ckN;7Loqly z`J+rlPiNK94v2GgCG5|ip$n_S=`g`p7<*KL3Rk>j^|pHWY&97VHa@#$wHaH2V{P~> zrRk~JpN1=DHD*qWxcr|+r zJ6jPrW+_yWyB@-m=Wod8Kzs9&-hZRU%Ym@faMzjX3IQFdDd(d=DjLKaP7M`7PW(V0 z_|rOvNKjUo!+4l3+W=mRqE7PH=-BJJ$rVkk3lYptXV>FXDR7=W3Rf;(4f{ndNu8V( zd0dng%gcJjU4L*Gt{OQwu^_k(6(UP^u84a#)WT=4d!K~Bc?}#~xFnE%92UqgUZlem zm~PD&6%ASRW?@N3o0bvO4H|13!zxk-{DiyC5Q#mjy7Kp*asu}j94>5J&2?9U&k3(tn5{x6%Y(*L&jv)f1ai5$Ow zti!h=WCf{CRZl;di=nzpT34=VOVt}#bmD+vmdRIz{Pl@LL_$VF>K8|o z6`_tpU)P`Pp>+3zaPXdt)9)`63m}{R;b^ceDQE$#fNLBoiM1rB9t0o_;wQx&PL#Q?;y9* z@!`rMX|Ing?Kul3?c=)6gd48(QHjgzA0ClKpNI2OE5SM<+q+;%^`DrPKn%J(Hm`1? zhlIG-pF*%;b7pXr>Z+r{G_58nQ}EeSmLZ8TLrjUZja2uN>VwjhLroP?Dy$KsYWqTe zbUXZSw4TJKwhTo^y%3i^c?=P^F`}ugrrC}~r$V@u0~}C-f?+=#iu_WvsLWS*=dzJ1 zV)=7Rhwu6(DtV}07saz&QSChSeEB_5C4BwDzMNfJMXk+>f=wH1{f6^qK75By&uJZs zL;e1o6+7M*nZXV1%;K9&`!EQ&FHtry$+dq|+SNpAYV3M{d_Jl-`OV6qh9l?fV{`w> zbp(mr|BV0CIq2@Z*~vIpeEU%8NM$rx9bI7WUsHYLrNJnAkA93Zc5Xj$40jb9Q9+{W z|0z;i444Ys`Ty>xQconjpIC&5SXP*Q{#{s_@V?@*7|l7anlf8EunnVoaIOrRP*2+8 z7~u=Apa*s8Epu>-$?Jk@B@r;Yzva$(Q<$Uy5j0r<*G>uj&p9Yz1OgD{?BF7y0;M#BE2JQN5vqY|A%QmW;b( zjT`JNEp6zakeevZvqjTMtoQ8u4%?vgNoevI`PCz0BF6(&8`pl@IyimLF-S>NafT&a z?Tg}JjXm9;oE>Fekk>ftM=w?ciO{k#-fR!u`Y5NdMLt30&ScB3^KaLbHAi$6FWql) z6YIn^UThCk{AzB~BY1jHfaEukYQo;X;wN2=J>ERLc!fL5?&T9DrYzB)Lqk(6NKu7wLA_TLgjJ?`8~p@>Bc~iER15-a1OVK?FHod4;c#o2k4V0a$lQO3b0&r|{)ll=R;}l3AZ}pXDG_RC}Go z(gGF|LH@5LZ8XRqrpTnt?|ZjUHgFNXv>O6Vpy{*#-v9G{7xFY_1(VdO86}&Te&f9F z%tl79=Syo{S3@Dfzy}GD{~OsAe5yd8rrBo9SOOk%H_D0Ek4EuCb%$=#%xAvZhIa8GaUJS^neZYL;sopWtP!Z) zn;8}07Ya188NO!& z!VEEL_1$y(UX9)E?+Hz&Dzxq^yXN*HNe8Q$zPZSBZW=|iG-xm!;5Jh7`mx~m zF#dlp*Mzyx^~-WokNxUN30FlDO3j#$8_&Mp34~xb{fiIq zhP(73OR=>b2#A6c5O?TseO?{8Oc3C6INa%Fq17S(vUm8}ucCl4ha*9UFQkx(hHXP? zPXjWM?7TeP@1(FGy4?6LB!G(L+JV&8fa!#YndClauG5;7J;OTqId=Iz7G=V_z2JLx(&VT4 zV%RgZ){Kt-C!^*XI8HOa(CQuZO+2#?CH>BvwDO78`jPXsuHL1E{y>?UfqW`(YOW&W zO68Bsw~Z3+&v=#GB<(gI&SPwXvFOy0yq3=L$GKfmY|ZGWwP{9-vIlXS&G#k!c3OF4 z7;Ti=s~fMkS?)IXsJo;=Z1ZFX5isPJ@9p19UFfe-5KN<3hut16Ua;`^aK+oWQ+Zir zJNV-O=h|1VDePlS?)-oEeW{Tz)CRy|b^Xe{a@e_+pL<<)}cEnHItg^S+9HNxu4-sgW$|AKys4Jhk5Cd37N zB3TTIk4vvqZ>%tikv~?pWG{Np;-Ly@1qs?GOlwClMD z@%u9=i=<(CR1aD({^f<+y)BrXs`Fv51zkAQ^sE@L8kSc5Exnp|R)GK1b404e z>vZZviNT!X!WsaXS^J}@PU}3}L%YZfF^C^fh+gCIRx#j0m>`rqPO$knZaS717lWCbLG&|CaUq;_c6*& z568ZHc(%R1Ddp*q1EX6I0WrNeICTbY(E?#`1PUH#KyNKj&^x=V@K$J8qj+JuvR$Wz~rU6)_Q@#MoMdpH79Ph7IzarMI|pX26~5)*YtK zI-y)aKL}{_FVZ2mryp7T_GTE(Yvg@VLXSs;lGbGUrWA=eaa+)KkF`G22f6r~FnauI*O}LkhR43%-xl8-upaDx zptWlUu{N`?;-zzPhOvRXm?x9f2lwo{SuHMuj-CFV0;w>+B9}QYIP?)Nmc&3C>cDR* zOr|_?0hOkJ$Y(TepYt1>X0JdEkiIBr@umXzCRhpAIPc3-NeG^Ir|(b%v_g$#``yN5 z-jS2d%t@gzM1hWsF0*IW0pe7$q~PYbdHG9?Z}tmm^rOpv>8EC&0`d*gPJdSG)@7y> z5}|-}P6E{7>a*>ct@h{Z1z63L3vAPJXBo7y)^{P*~AMw0y zWYr4Z1~9HDQiV^HT;#oRzGQ#QSsV}Ip&qLs>IYu&0+EN zmZXo~pSas&%Lw&>(Fcg+=tU2mO9i|&O`+`{?0#yjIOqQRZ$|HX#nQabzZnmS$%qZ@ zNo0QRB%;i_14)GC;aZjZoL2fo3}0WPYK`tUp-lCLMzv2O$98~$H#VavIJIEz#l$b( z&>I@3w;G%?EFBtRb4V%^2U=Vf?4uy!#@!4HU{G*EjP(t|?$FdAxXGFRlpDu$vzWu* zlSkWB=3syrg+#(o#j>ahLc6BOpSPW_-&)+O;L>w)dUa(zzW|EerEe4(ij3 zyF(C@4wEYs8Fhr*L~{QH^*qoo@W;H+sNxbi!UivRed{s((rjbL74?2|VnxcnfY7*2 zLblUUM|SmF($SN4=P{(6$FoMxlOi`FG+&`VCV;F+O@H-*=XA+PoPi0)3|G~#zCjeL zUV1hO_x2c%Rc97rrqt?P?yMn7CE)g7sWq)SHuK@}yF5!tro>i2Q>4Y|7+2|~wmq?a zbU6TS_HlN66tobaMF}#yIX?>oVX#j-+o2l-GfO?*vQ!1r8>HLAq-^*xEtnUS z?!v$gkyu#5ytw^6Z>CfaWUoWP&@)9)RyFEhm9!ST?4=5m^=v$Q$y@q--+_SDrI&*Eq?w95+QuCQ^z^{U6gq^Y5q4cr!vg ztyh6h?pvi6PH!VuA6_IkD137h@)2ozbEI9PVnak{@g7@V!f^l$pfchqun*n}RAPHvR804;T<2_Qx~@FbVN{I6!`qQI&@h6Rd~x)E^}zcw~6&qBk5}c0&Wo zY0^)nxr#|Ut|;dLb+%rhM-brnd9li-%u{z{Msp8wU&^{ut|o0aZhp?7g1 zL(?aLdkB}%^@s&z_!2w^bVABC{hB8mHV1P-$@H6l2KyD_y z8ML%QRF(P18yXd3`F7cRlL>FC+FDrZyVF8r3`YyYg=J=R-H+oRtVABI6D`u_=Xkth zHW=yd_(2@Jo+h}Fozmq!zrz5nHFiW~!-b<&W2=;oG56O>tH<=y>&=UAWvAt)WoK6U z^qJNrvTB<{lAVNadeM|!psje`F?6zWO}DW2jfI?cIIEUALz^8`x*gmbEZ!`>2Mw@@ zxvBskVIYiBSx5UkhI3b4orG&oRjj0x#uf=^_3*oTg(GyIoNYYD)j7?J_6NXWz#L|0 z%qq230r~km#OTApS+4{KS2RLwNv+o`_GO(StOz~l=}KVI_vm2{gtBb+Z{@eA-G zFF0K?T(kxfeJIJxTY#{-Ku(IQzARGBi#`ki-%LsIn0vvS|GvGRBmwPlz@ZQ3lR_#t znmWwtn^j=15e^F0o^^&3sh5u{{EWoP>Q-U~U>8SckLwt0MWC+kDEFc-c$4wME17#J z*2Xv4e%5oyMF}6n%i_oSVWV@Yg_m0@dI^c+*6hbV|)iz Osx5q z&ax4hld~1xP!eZ79=MZRR(3el`!|_lz!u!sgE22G?4Q{e>I6xqwJK6Jx|U%k1>O%9 zi2Ef{*vGv%d%wKt@$&Grx}hM4Z$Z?6P2i5P*2bUE-gpSb`2Scs^KdA?|NoyE+n}

|4r6dcRw3CA(3{UW1gS7}>K8W1IE9f5+$d z{jcllx}tO6_c`bFdOe=cXUjQq<-?@4E~A_->lC62Y_h!c%*n&00ba_18}zM5rNnId zXi=<8)4enm6h6;KPn7_b%~&0X8BK)V84@K$o7i`BnG9#f!V;o~+*|x6awEj-yriJX zyM_1A3J}4-4XWAMVe*N}>an?DPmc?)p@Q{L8zHCyh9-5l7WND2L!99a-x_&~zgV-8 zpR{r;*rJsLA^Ri?vMinZOdWutBmeS?B-xQQ`Y%P!uE@xiP{s{^3oBWX*26H%RIc_I z45CX*D=PVqZdI+a3f+X1ekZ)Kcz7lQuLSCSH-Py;Z?;PF)>BpTt_0XAyIj=xSQO*% zbL3-K+cofB`|661Zb0?rcP^Gy{|S&)Z~D(l?QX8JfDwzux)Oqyu;hbUPwC>~9NQ>Z zH%cnkt2PtHQ9gQIYO;J=3X}r7RIY7NH@37A?+MPElXV1aE=zUpcosiZ9eF?mQIMSR zZJwSrtHyz>=OmdhUuRFv(8uGw=wg?L&B9}ztp1_%*}mBqj69zOn`QeRfvmvTs!8LG z_P6h^4^%Fuxu}t>k#O6U{cyZzcH)qQN8DQuPB3jLQVrQA=MrLrJdlXpg6(DLneP7M zF<0(6$M#v+_wmk)H_4=WNG8bEGrxybD4>0xoQdBDNj;6Mi^jP6AEa1*rl%gs*_O$0 zsr)Sj`Qc1nduk?mg^-MI^vA#wOr3A8hluww9krxrUarKB z?zc9zhfkXWU| zR9+l}#&#lMPM*zSa?s}U>V)<**^>Mf%6RtHS11o;-Rb`KKIyD%<{cH%CfBwTzcKX~ zGiyW@~Aq^>gn~)Y zXBHAe`270>`l19|<0B=Ud)leInLSp{lGo1UuZwSCQsn{foyu=(kJk;Cu9zBt`u)Lm zJJ8e44MF=PXRZy1wFgUGx5XK^g?674A!Cozw>ZnICNUGWr&K%l^8WJekP*f<$b`um zUNoLJvQwl^Q8mzy*%-64j%l{=R~Y4=wW)DUEAYQ@#ItybfiGU&{KuI!61JHnJeyWS z2^WP_H>zZ{_%uA~C~nVw1>vmj4J`q1Y~ik*+F1YC^mGQAXG0X|(eq<2>`<=585K}k zMr5wmehowG2EDfxWd>Z-_Y8ikMtX4RO<0zv=$|Th$NJ;C;)8__^Yy63e9stuH`AZL zd7;U3W1uWcTF`8MtPpB0gXoE3I55L#V46>@$Ljgoy6e0Bv zXoquHR<;g$7)yQ_&Kr431Vz(js|b-VmLEDiryqxUgb+D`;WS}kivUTmE7n~<=d{P?{(HLyl1axzgPz4BAc0R zO4|_GlrUWEhlEqlpY+hYzCDO4>cW|%!{%uaKHh)#CyFu~{_bWKXF3!Eo2j0i&ZT~N zH6Qw1?EgF$5n8EAWlLRlsTPn>s7=+`rw=;;q2ijXvBUOefxVHd+$87vwdy zOCYX|A69Pi9RB$avXk2`h>Sa*t%9G?j*2%lVc@VH+`@IhFcQ<9V>^gK&WoL!%W+A( zk#J&CsN0_=8v74IZ1SLT)A!K^xs5qKbpw!7vzsr!EC6KvGte@iM4o>}7^OFM`_(&0 zLNrJK@a~~d*sQgn3E^L@Pergdt<~u{Vh*j&iN)H2HY$`agdtFG%U8Ji8-icj$di+b zcJn<>7v#9t1hUNAkKu(clL*=`L1K+>1Gl!=*S=P|`A z_wr=JGhtK~XOsTv+@>=Htbbg3x9-V2rdBh|G>zytIK@N#R5)H6!hcj>jaiG&@sh(j zkZ+{33{7bb2e!Ok1zxWQ#Ozj#Tl))G0?Knfa4LyY|Euk`70CH7MgnhOwyavvjQ`j` zO!!X{Td`j=d@xcW)jUUM;l7D3WQ)9Jr+=>u7F1`VTYKdg*#%r*<%Vetm~8S*^xveT zb=8EJ$mOK}HvAd@1Wg77|8L!Qd5M4rCZj~LSY*FoMKiUf&U2ZT<__B1Br>(RGBxO@ z9G{}P^PliKn0iCrd&sNre!LabEJic3ilGVmR*c!uasT1MDRRtOv@)iRP%nTe%~o5G z)p%R&c+e3>A zUXV7a4Nba&HzYwdh1!%mPV!B={4RP6!Nw1I3yZhaa`W|C-JzvEko>eR&~J60TbFG? z`F!x{aS0~pRF3jzeUi3KEWvW9N zEwKc$$M22ZigZy*v^=HL@Ug`=v1-yJe%YR2YQgFjxuT zuyUl13qaNkT}@EG)A`My@bzex^EMR#g`B<6lcACUL*XQudIBIiVY$D-y=AxRbE@Pp zKF=ZH+ze+A`KzRtev=QB$N}w=Fhz16Oj>~ zFuI^Tb|y(8^P)bM+nW93lF_QaPr6G<|Vk zreX)x+HJNdDe3i!;k=ym#=tXyOhKTH@&#`; zex%sFAG-HzLd=77C=L~p2W03&aGXa?hko%ffSQv91HIRRacz|Ar+%W6Jgj(-K7??K z5`|&>UgXz>sP=a=q?L(??ti-y6Mfc0iwQTr^G)tvVC(aTrp4A9oe;4JDvTni4(-ac z4^f@Gw+`%ruxEFne6l5{HEk$1_DmGyyq2N;pUd;xGEiEn>A0t8BNtMkJ>aAl$4Xl zh#4ji1!p(C@~iA3%J`OgjMgL*?={Bu*p0`mJqAH!-QID7Ch4x*5H9&>P0|2P*R?u? zfi8*@3FRWP;u?$5r%5d!OhI3>K#EHB>Ad-)~rKM_#zs?Z4{@hRUvQKTT7Qd%U}Zj|*p{g$Pv zgI-+iGYI}q@jr$LQDt*4ax%2oB5Rnx1?$w4ywvNPZw;kf%~y18SF~f>#LG2zBNlD$Dpkkw6TvpKtKX>+p3rxX2`R?^JMJOpc#kv&&Uj2?dKhy705cAB?Ij8R5X zA*}kuZgQapkNitGo|S-bT=_37waAniOE6E=M5Zw?oWA=tQZq*VTtHAABMQR|zbq_S zFRa`KcB!7}gRG9ClEVn*;uZ`H6oYBIM-c&a#2lK}Yes_lQK}Sor^95JFQlo7&K^^* z;J_7$hv@eg0xV=Ut|gi&1DL6DM?|nzGTi)gCs1lEGuWhy>Wrz4-`-O5fk}&MkNk`Q zF5@pHSTG(@tAyr#-{jjFEqR}{Y&kzjsGp=pv~ey0uaj_+3B2;cWEd)Ri9^}@A`d7p z95YydTkpZkg4!e9*x+fZQKoI><%t=X4?=2dg( zHm3S5>B?rop4N{5`RS4_KFDRd#2e{HDAWBhPup1fn1eC(NS!kklssQ|@9Q54LBT*`MhM$}0EVr;`R?gc!jO9} zbsllb5=s7FWqmyv-$H;hajgZB-KN(>=0lJk*ow9wGtt&|mRVPOIiiBOq8fzD+-_NH&OPUaeeo9WgbKSKILoZQJ^beMZozHHgM$VAI9j=6x(c zQvo%2uUQJ|z35-!Njsb*Bf8#G#65vtMW=?hdIQNMmZ7UOL&foAw#X}qNYlNC-MlmX zPEV>K>l}*duO!K11ZWqRH-P(r;QsmjWaN%?k(Pz~nb*I>qYmbkN`Ct{_eH+HZ}G^B z6b2=k@2(z=C2rH#h?~<z0zPpgl=uTqEp*5GAl!3j`i71Z@`6Qwu z^&W`td5Oe-_5Arl2=D#svE=`M5|V2@j_WOio6Bq2IIXN8Ii+np&1(X3Z6x!9GYo-L z&Nv@z3_kP#At%}ar?t-_&tr^XNuGd_95xuBAIvbvIeD=~l5Y8`3Xq?zQOvode}*Yv z+@ayX?@W1NU_C=kom=$0P!40lPkZ{}{6;fHB(9#-_cKzv1v^q$te7qTY#qX(aPhnbg&Jg-ZJy$>iAUVg=Q z06;~snUSCgB`!O$$Lv_?jbx7-hK~{GY7c&>4 zq0#4fKv1rQ^ruA-{PSCBDgd9K%yNijS(+WE72mp>T~>C1sm)<+;Td0~|HsLe(&4^( zb3wi*ao~=Wmq)6-$LCm;r&|X-^ZKtzpZ9Qr^zK);EXAf~7x~eUQ{ObnL%+7P(FBIe zl=>fDtSjtnygYT9bMk!_Vbi#|n%kW@6ZOJA1XlgMp1j}qTm&MlQLK^wkU{P%Xltm9 z_*zvQl!M!ESMW> zF9ob{dk=^iD7bBMsI85X-Rvj?G}r@v zKxoNVFjV62{n|GdPFBklv@@b%^+(>x7SUkJ9MkwhfVZ@h3%VAC4fyzrVF^d;FjMDi zFx!COKk>fdHPP1z)=CK)_wGN#kXOY|au3eCw4YThG(7NEZtA~i_XyJ^|3T|hCiY;7$0C?`^m-dOL?rU6I~Q2ub0j53Soh2xamf|4A809?U0sN27J;h@JK1)vc!BL~)$!bRYMynN za@n4jq$?2;?^%XFJ)^ZnP*e1?Wab1~ z6^j2YVnCgFRFr3DG+3!D=0!^0&EQ;?rFid@^?OnyP9C4tH-K4YQ5Bz{>6=N68RX{N z<`#VlVhPfSe8cKHSRAE6==YB=EY31fVOf>Gu(|fK`0oEUZTL5BEZY1=vL3+=OU@ht zfUtNc8L}QhD@5KP2?{uC4#rX2&~n9srHwSxPoL3~04)4R8U4(~VY*Im4}uq^6x(6A z)?{mBz3=xpl1Uz|@dpMJ6MdCI11!EAA%(TH{v=<_@E7`e^g&={f+Y;K#gS(bxW6Ft zgpJdN!L`D+>>aO)o{r+*w2&l~!3UP}U$jZ6M%U(#gbhzXeIzkDjlZsinyOZ3j=OvK zigN+c6yUmoP6sBl`=Ipwa0qc2Id={AqJ6h7huAPl`+?FQ+Drx%b8vUC@k{582G2_lv}bahx(ty}qDJ<7y0A%bWaatT&%Y5-UzeeKZiIQS|0ArGY3x zETg6)8J$N#nkzk&MjBXwQho`H9U%7{0rQrrchym)ID%X=;X1o%C-`}XEd!)UjlXs{ zFi+tmhtaPTT`eO@#29R?X{>&xuj<7YBCvgU%P-;IBPpPw_aTK|XBU7*^cOfn|f1#8-bFJ5mHL0Exa-i*@QsHUOq)bVvrH1?7*kl)Jna(77c19RQu6%2@ok5fg|^c% zQ=Q*9+#1)0EU`Uss8aghI;$H}=m-X~y_VY^&=2>$sFh;+r&N<~`u5<0^A*2eE;ty; zk*Ohk4ojWUHi1#y^?o&DAue^P3j^XUt5rOA%Y&psMGSoT@Wc3a+}-zmwp$fn+z_#e zqh|c4jn>nSg;Ix&FL~GAQkBHLaBCq9?R8$D$6RYoi@nn6G(LjQa< z{_2PsmIty6ckZ)13lZ@W%DEFr=Ns8rx9EBe&g~Z44Z@~zs#2BG`s`SEP>lT8GD5#QDiXujuY#R@}e31BXL1E%P z&H3z!cJ4@vJ2=IQ+yu64z&uwsB0KD_5=37SIVZIEjCg^P= zUP&Ffo14!QAY4Lp`+QEQQ|(sGki${MJ|};jazM1hp0J%#ij41UQ_N&RFb!@xxzvBK zWN(pr<~#vb_DsAE6rUR-IxF7Vs744D{1$U6pv=<|Mgs*#)IJ*&^CI2QuJ0iZQTwR- z06A}!DWM?%I+iXdp=WtFj6arypwYa2AZ_2+i~JduCsvO z`E`ob_iM#~!h(n`RN7AYZu$E;t600B*RiXa#O|a11zvBrF+Ce@<|!KktYOD6$c*=1F>Pe+m6CJ*tN zgu9N+AN78let&>z_E3AKHk`D=@)$AvOy@mmpjW7C_V1-14E-sEh4P8k1I_~Esw7-rD)fEx9SfYe2Z9Vp(LkJMZ2rzdDq76z)gQVGVVPlZ8 zq`2G~YMHUR6$S`obDp)25#k8T0l{csEO(t6-<&w<3Fkbb7`trgyHJOJ%kS9+rl;I} zlGk#t{7}9palGhhGc{>sBx!!%F#d(9h*KBMVFo)-U-2(UYe+j5F$JSxy6ir2Pr_kL z5Kc*rw4UMI*y=m9*fz02*+FFLO+xu$lyp~$AF5ctjV*G#%Rj-Edj?~cjM(Fn#z;rz zKiU~*2HFTmmTKP!7QNbjs$y2`N&H6lka+E%GEp`Q2ZA1(5G^x`|7*MeeRN*9{fOK9 z8fJ@K=LId)Nd?q+sP-o~g+=_{jLno9gQr)W{r(Mzt}qg24GA;GpcVih1}mgJCv+I^ zZtcrM6t2dP_Zs-;UJy`Tnu#UMJG6+-Zznguq>oCkr4t)Zhnh zXq(A`_E=Iq)*mLllgG;0Jx?iuR$gRNr01vCvK{i#y5kJSK5>(hvAZbg7fU+U1fWAReRCjF&{5(5uJqCKI)~ibm=F z>c!OCH8LhZGKGezpYj8OgU+xQKjVMwjsWkNUL({sLA`3+2LS`R<>s}isn_4t;dh>T zOw=`10wb8@OdN13_!<3U@ZBwml3<0CIjMbc`1O&33HW2u$bK>L=JB%~=qA9+tA{q5 ztce?EsGEuKOA+5bRsLzz9kR$)ny5YKxKFSTdyu%Wh@OFNLE^YZT*{bl%kl4+g+9>- z6|agqOzLu_?-uVDlGMJ&=x_->O7aVHvB1mRaL{dm##K=@6HLkP_q0a#Hrj#WEfnd>$*Gk z`}^mJSC&mlSN2(It{B#=XHvd5ujm<(J|>_ zct&j67!VsGbE}yT@8$w^DD^5IPCqkkIMKYr02<_BEynlR4x?WpHX-d02M-z+7~fImPo2sDGA2f1s^E zi8a{gj2fQdWP7wXEl2MCKI~b{k)>p_M*gBPSn#TdNrU?Ty^SXzrP51_2wAz2Yr$gk zynNBKpkA3waa0sZyAZ@qC0$_>pR){)|D*{IA5^lhD=?X7$ky^4MSz^@x6H4uzbbK- z`ajKbHomlY56fzfTYdbdIo{B4Vl224Slpte;IIShy=}!K{lBu^QzEl3EfFy=Y+7{$qd;q`i!Q{)RnM;4aj#+KQ3U0v; zxy*1g;N;r1iZg|7SeT1NRNt&0f6>%BAqpq6KLdmJ~`L!WZTkkgp@T@$7JH9}{KI${jc;CLDN)+B4HZ_2x* zhv=fI&geT<4={^GaFDFXImB(LK#P#L_NC`YRB23$>15>;TLbW>r zq4)jI#?U<2y8Bxm;5J4w20>RAoel7xl)k6ysY`0pu}brB9Of6 z5XShyT2_LoJ?im^EDGK>lD{*xJom$(|4yOo8dHg3!O!?7pdG7Y(L?4SlYtbT^r*)#6z>q)eaX&bSWAAf8!gQX^Y?zP1?l2(8)cr@0N-44cR~PQ2%xD+z zw4>$?VS7}N!}Ut!X@5LD`ymg}Sy)&8vcTX&f1opeW8ya87HJzA^G{|;pfAR3@f`_` zKpLmzuf|J;#vb&ziq2@rAN;W~ zd>H?CZ|KThsp~ckdy<+xBkgZVP3D9fNoW1~vOR8O-Hknalk($A!Y4_Fy4WoBV43ZM zj?pRzjNco|`W{>_bAuhMvwWk??BI&dbLWkv)u~A&A~d5jTRd17x^e^zMYtE1COVxD zlZ%&is>F+Lbq#o2!GWbJkGD0i^imBNd&1HiJ6=rLm4qGx#fs`vQPMp5ZWr&Pi}`Ao z;L(fI7<G?K99eW3LV;WLh-zqeDd^{cboQ(@|}K1y)TDnMpJ(^4gSYDi(ineo#aiRdy#BUA7+fX%2X`OGJWm0c9{9-676B5POTA^X& zY1n;GPNoWPpY=KK`?l#wK$VuXPO@u7)VXzL$1{$F`CCZUtAxK*E1Fl5z|`DJ0QHH% zw@mv>AFzC`I&5c(i1xXsdWdqqhcNIM5Cd+xEmv2E&dEGB#y_(mMmK4D+r7cdZ4QIJ z$b=(f(f#`dp|j1E!#DZeqHF?eyQbti-6Yr>{`B@(%-304Yf0NVy;YR10lPW80Z99^ zNfR(XpeU7#(CxO#N7?O0^Rs-jz9QmhG^qpTE*^I`|5X@S6QVzrFr<)dS*&>^OO(lKES-7#p zD71S1$}m2u!P8!I*5}-GJ2SB?W`Bax4L56B!lF_&P^y+yFwcFOI`^Mo3snrb4UI6y zdNVzZD;__y4|6=|FGpzONx2{xd;SiCL&2U+N>|F6-nC18+=cViDD%!40ega!^F&Um z%J)QE8+_3~?{I)J>I`-86N*}us}tDxyujO!+kTH*TeQPt6zA4|X3k#*=qw%#VSoGw z%x@ryB^9x>pHhT}9hnT8fL4+FoFxy=tF)cF7}SZx5H86@&7`d|A}XwkCai(5jLb8U z9V}O=J!tkn|1k!fAPOSXNtm^eRp9MM`NEvK=?aW_j zKnvR&4BM&~Ph!aeQ9PfZ4SE}y62qIp#)a2dAmF^n53QK=Ve5JQM}GU#bcvyfwid{A znMRDtGt%c1FLQR-!V63dVOUtd@n1&eC{e@dqXsWd$&%cy zSQ$wd@t+!#q)9@-8y*Y5FyL309bw=4w;E8wIA|$*Jl{Ce^l7x*vMfgeoQ2DId)DY+ zjiMK%k#txOmp|Uvb0NLzU;ho5nf)amZ+=YM&iMr8V1YW%SF4kF|00{z41f)EQHEno zkDPa2*Z%*RhlRIdq!B|-sBT6Nf%)7DA@Ub$YuHm!fr@XV1i1Bv{)!^bN1=NxIQz<3 z+8^l_3GX(VypUjRAXiG7wbo&~Hi$B;h#5(29#NoO-sU6yQ$d)X9Z$fGU-StDOnOTl zc2>h_L?maGGjau8SzS~BHXmtfEuNObpvi))0qQ^V=aDAys+~f>)vTW+W;L)*l`WwF ztuj-CPZh!t*Rk-efF%RCiV~PmZ~oSrxdQ&xlZymRq8s0!jzDbA_<;dGCNFXa;t2KBCPsp?A zYlsAxGdW;AGckvX*sb+Z$PCmI3xgbT0H6x$_hOR9au+ym4`-3X4QO>+DlhB-Rgz(s za+g;}MH^AEvIGTx!t!PiOeH0zg<0DKsV*Dl(J(F$l_VXX_b~`2SZn}1sHC5Kmkc9a zXEl=++XttiYJsP^F;JcD+)PM1Pk128-BvJfXulww=v^o+M2oT7r@jJ1$aae*1*Sua1UBAH=}3*SE2>N*8*`11*T| zSs-{LQ1OzbT@XdstI^s12ZAHKs~5pM{Ro2MCBXc?pT5`B{&&&JkLAz8W?!z4-XI>* z*2qB+wCby|cm^>7%_+33`KIaKIf-mqgkDKt-50zww@0uxwkGB7rMDZJOC<8JAi52G zIE(6x9$zxNdbDy0d2Xv(r*3B~OK0!k6&N`T4OUm7lrf?262XD|<1akJE9)gyV9OxLdEaI{eHET6lP>hcY5y>4QfSc540?RRO z_tPo)AK$DIS{oh4q5d4Iy!=ge@5D(kf#wCq4CAdct@~>!w@t2)atJ!Pn-)Pw zq^Rx~t9|)Yp?-%qLoGUlbDEVjd7 z4?`8W4BnZzj|JCyqyqe+!DnFBTs1}af@ZvC@yX}l82cpDGatq=RG*G=w_n!+?z8dCqRr+$i)j zX>|H7lD!rGZ9D#Ok6|+w6bsC z*Q)NlRGIrl?RG}eSrVo3W!J+ps~m@^k+kIi^!|bI`fn$sV50hN@53cDD-dN0rU%a0^JFDoNEs1{DygGc4JF|P3SS`1bu8JCa!yf1ouSBS8v}p zWkncriLWME?m?VUPGu!w8?RgnL@9B((%6ei0|}Gj(C-yXz}OQ~o9Z&$x}fYHJP}KkgAlPQ_jT^bWyLqe*g0X=xX%^4E8NVFMAWe zzZLPz>aJ7fjE{_5INibCF-#Q%uXg@?Ud&!Bxs4$w-AdcXpC>wLaEm%(!;}kIhDQ{4 zPL?0K&(_g+979peYv7)a>Uh_i88d!LA(zc@+L6mO5FUz4{+Frx~UN|0Iqx6g8&Lu)QwtAIIYQ zp5V%>QI}o)1>_)^uH} zpjg=vo_Qm3lt=)6s|hMCNVp*3I1tFdCar^+CYzL5IW7csmg}ug*BG@XQ{TvqnOM?# zS=)in)#>5wyPh~PzFfSWaOfY=ZO>dcPRVq~ED*<7*MF}#Kap+xwP~R!>@bF$MsgaT z7K=V$5+Q{x zLoe_;)6HlS+8Kzp+aLlaOa5o!>hh&tL3TRyUPImXXL|=J{mP(Tmn>BxkoP%?@ZHw< z7@QOa!$}4~dDReRaAIr;hQEc1p%%)e)I_#3&0C};r9b|yTUz{!YjGjPUjr9M*cpw0?-0N_Klw?2pur>sLZEKxOg)*kf-}( zfXVY1aOoQkQ#x&(ux>CJ8f+_?N+!XDoYc{YY^+WTSPB7yMzs5o?K1{o~)`)3Tufstx+;*s4gCerSW`Y>lNi>JT^syYDpkhjb z{8b^q7|H~PnAEZXN?!_TevGktbMWaXF#)ejP}XYNQQUDy?T^nRn2Ds70nFN{!#)~x z=tERe^}tOGxbOETVattZ(v*Ws;_@Uv^fP{nnfP)BqS`p*_D8J-=J^Q z{^eFFU;;y6C4Ma@`=d1av#|!&bsw1OnIFBT3!&N}37l_)MaL1gzd%P?Pog%&l<*3f@e>EevABMqkX|i;9UVYoLy`>k{S_$Gc zEn&4BXf7my88n=?hmS-YzKpLC2I<0|fuau9+U{bqbS6 zq~w-E1%}oKXi6=Wxe~E;>t8u4R2MfBrSD2Qqd$HIHJeQ3&uW253$iqLEQ9S;XoQ!J zF=eEJhWDMPOu-VOdy8s^2i$S25iO<>P|dvwI&j>NN_p~;a_)TSOHqvD^)G^y$pHC4 z4C^R4$nR#rdSyGrbo9y8@NM<}t3zE|huzge@9h}Ni>37R{Z7A3^RB#RW>`ml9w4#H z3U};DeboCokOXz(okyi>6;pd1G%FRows@Rymz~;VLi+U3-$*uej^%dK=z=%WH_pJ+ z#Vq&>(hp1CW^I!**!Jx${=3bjD$wd8RY9VfdnWDuvp1@3bxMh<`-#g`G9uU1^lsUB z_lH_f3v5X3flO(ZFO0v@s?5ln^|-_t3)XlF%t+tHerGarjZ!2_*Cr*Y%c098IZ)#& zX%0O|2DzM4Z@epqj$W*!qB0TWk3UEfpw0pV=9ZfRQO0t9QPyVCur?*zN&6)Qc0EV@ zqAJ#!nkPveg5Vy+FD1%RStW!X(eSR`Uw;!x=^}!IGt$8UOuZn*lDq?nu5bsAXrgw@ ziA|yhKP~Bk&V6Qh>aJ~@*tannc4t)i>5vBPDje;x#59Li?({kUitBuYK~gY9q*{8$ zWtu%4aGp_esGX57!IrQ=!XI5|m?;A5jF_*%*gixtiWdnZOrw$rn<|*-yW|?iI_#lx zFoOeUUpk&Vx4rv7jc#{U(E3h;m)Xyg3#?S<-EyA>-rs@vZW8r%npFzgt63CHztg+l zHR{c4wnE?IFKVR^vs-<_fh>GmK<9?OI^mRn&D?`tk97sj*s(RjpB}z7F5*?0%oiE? z1B&b7*80^XButCFO6%uvvI39tgOrwi9`JP}OP}1zCxEU@YyA^ep$$Knc-Gykv+GrW zQ<%2huutEV|8T7_EG>W2tiHZ8ujP2o@h2GOM)Y{26zNi9l4g*{hXLo{&3@a&f|p4< zK~PzJxzH_4{o>8BK|#~{%|t;ggEX8^ho+hL;58NI4nSWdd#IVp`9e%rVd+k+m_C5n zXsPc-&M;$=hT05XAQxbt)E|k0FiJ@@HI+# zTTknT1n&xB!IG&gYD4XS858e{RzqO=jhYMZ46-$2%f_6Y3g!xuSiR|8&v!-!=2*}i zKFt1f8c*qUalM7T644TFrux)%-i6KIphS)KU@)oOPp<+{58dS@-Koz}$=Nv?Jk^hyq=tuy5 zWnaOYX4J48m{L(4{r-gx>o`ZQJzJ!~5A=`|7OJo_#`% z+ZT(2e5zivd}EQrFC(hqMcN2{v$j64@x1|l?QR5lND+#JK3pKmJht?Gz&N(J^$$bT zl$#eSa-SF3luq)p&^Yrlrh=jJ0A91dM3fOc5pfss2bbHui};(vU&aXRxIsCWk4pWW zYnJxE70{mFNFVl}F+NXMd`xH6bqCai)-AAeLPX`O7uh18-eAeXbyd2J`#0JUWx?p{ zHL8Uz;^KqHnuIJrw`OLWOU{22p@%Mh3-R>)1b*)&y9yVFfU5_W5}W#k-cD#2$-dlX zNBa21*mj@Q?`cb(CM1v#Vd~f6QT{#}?6vz0eW#eh84+edq9(p!(3((oBY%Aqz7(${ zSPb*oHj~7_yjeZxVsHj?xXdq&@QUL<9_f4U?vs9);BBEhSx%~*c#EQcPEgK_S34-gzrMoamD{D4ce~b0I_A* z)NA?!kN|c#r!kVcVBTxA{Up$jQfrFawed+_GJWGv$<{~snRy2Z>xmoK z#;JtWr6(sRxSayPtn_DIzk=?KRJFgpxWA5m*ERz=S$V!*rqK*v8cdqX+7#S*x2N&g zpVOPdS6#)r-43Pmc6PHa@B-e@)A#o*$d^;7m6=H;#uSoL`*BWB#W^KVQpBX*M%Ok5 zWilP52td^an2%=E1dAABO*t7O)J4Wn3(U$f-*!R4BPKj4+}cxljG%vpfd!Uve4U%y zFoi1*nAXgaA9zxT8zO$!72Ouq;2E6~oG&b3J#PeXe_|$MScXzyNE3xMr68!_;3GD$ zb$8z+s(($L-dHxUfh}<a!vM#Pq*Wo>emfkWQz?Qh_t{fGju$h$C?`E6QnJ0y`=Yk;^ z{Q9W!a)NuctsU1nFutv_-l&TAlN69U73@ISNRpiov!jBJdt!k{b74K0n#7eCW;(Z7 z4;&Eyp5ImeJpzgkWJ*pByjYm5P5L{nA6&G!Zt@~2O2Kns-|R#yYxODr@&9dRszM|^ zx;!XIWf}>PuyC8Wzzm=Wd@O^sP#OnRusg#)_102@vk#d)0fO`Mo8=aow z7`gYF-9hq8sTi|!5RY&2aLvg~nziWppy+QU9hAD5BLWh)qZ+It;zEzVNA`7UM3!Y& z04`6Bgo~>c!#e$ZZx5ZV|Ij9Zna!L>+ET7HybQ0qStex9*U`BCu+~Eygszv*F?=!I zKu2f4+AqEQR1qU-f9ekQl$EPO_BY6UlxL7MX|}$jfiThV_uyqqZ~!@b`tmoQv@a8z zDemm)S z5-Nn5v4xO*s~DAbMP$n|LqbvH7FjZO5)EUUG0XQkJ5ZDYX3mvc^#Bn_kR$lJsKJRf8LfQD7@U5GYU7#T}paQZIjQa1^_B8$6% z|L(2{oA#3pNI-z+@yUhxhP)Wh6=ciA$kcE}&#PDqLlpi)p<3u2zt6y)MFLSu+FE=> zGeUE%?z1#W(sm{I(7iS*jKc~FgpY#h_8X8GK*_^Dh^WKIhg!DE=q(?)L~OjLNfHN{ zUR-%d7}EcKCu9EgF7tI?;o&`y{DQzPN9|ABlAjh%k($1U`uCp;Ghm`Xo(3}$&dkFJ zX-(?$l}YyJz~d+5_K|iz5{1w~=8f=iAO^>U<%^VRlyZJ$x#-&-jcXQ4VIR`XY_qxX z=V(#qH)AstiH;nTiSpTNST8$j0|tS%Wu@9*y|NgR^T7xwiyt-QKY&^SG;-fcMb-E1+|8Dt0gC;x4}VSfTZ=O^d#WW3cR> zMG8NLYtS}DIVT6br<5L$?-(ec%Jf3y&wEHB*lDXTO6L!)sPq6=P2XES0D<)};lf`S&Zj~MxLJG{6Ua3BsjEkv6{YG6BGL2a*5`iwP<3IZ7?2-lDQBf>R;j+F0 z`#q+EG(AN1^C!NGMbKLu5a+AOpku3HOTDYdTN~;3)EKey{7g-MO5wzDP5clv%6**& zmt4Y(-0QJ((RyqDWkEDc2z+H_g#}q?FR3XdcV5V@i;vPH<0|P&5LpodNyDOuOX^b* zb{Hrx0;o6gUQm=EQ^aqS-Mq&NHsrOBD_txWhexaaQ*XmLkEs?pUPXf`#bGj;8~-vW zgh(lBJV~8ue%{HqxHB)?X2^gSRdJ!=@;$u?mva`sUwn|Y@ib(d+ptH3mF~@VTx!G!r zC>#xyRps{czCol_q+nu&n$OuEwwJ(O2;WrbD-Lvu?NsG{O@RI3NH7qzg3Sp*a*)rN z$*$&BNvG0r%+C+18^3t4p9_p=oo|a=`|D!M2P*6s^6^2z*RK(H?BU4Fw2cBF2a{WB z69js_2&k2{0}vLYQiR7`e%2_*FfZ;@oqi0d(wrl&cKD8A&Yw@IqVR`5lBeVlZzEM8 zuP_|4Pj3B>u8|;g@c8@7U>*jL(u)nCeY_t#s>OI73jrKqL(12^J-Ft+ea9L$0;CH- zl7-zIK#bfh;0k8R-48T+(S?wYg>*85%&bMA7be?)orjzn~IVd7J!eeQ2Q z446CIWcpd8<0lp78;uc=RdUKi`!jdzJHe=?ogy_?=wc!G4C>v=RS$@gPXm+d=8YX6 zDxty(a7jOA2&BB84xEY*aKCUwew3Tx^^UG)%k?btw82f9dDWu&=IV6eOSz!>0j{-W z&`JH?ZagTf_>K}M2zhzG{oYy7G}!ktdOkyca$}c#D)RG8m?B$LM|ZEcKe^E!as-=5 zYID(7{mcCbGF=2+Em^#_^X#C>6$o7_ZXelwPuq&STL&l;-5@ncUKCMK#!xG!CXm|s zmV|)-@_hVa{Cw{E{^=j9aW)k{yS$_e)5}X$^GnmnsKlxZ5}gCe4qY7t3;x3LCP&Y< zO}!C!L=kD$tu2AEV!ws`+@1zMAurS00u=@O{u%cB%I>i)%exV9%@J%=l54{(j}f2v_!*CE=ADtzS| z2;E{rAxy5p3U}YrB{FZf6R&boA=(tc zS?Dk^2y*rz&aS^O21s${v7@eY&L(o9*W%Y@dr5c^h+ub0!UpvRjl`{ zS?e0iTm-4_J{hcICCaf}H?7s00@YDGUPRD#);Mt$-=wBuimXbOr!Obxs8@RAI9Dez~P3(hKvjrsA(Q*VhARSal9aMq!jet0)q1VB&bS~a!{W1Ge z4L5!zmx|>+09G%q0`ngMAP>#J4)?b*!~E@6LkGQA+;(wKrv%lBG-58%lRqXLz)l1C z%H1+UE3Fy)5N`#1Q=bE#_3FMeOEI0ddCFUcu|AGK>4+#3Q-z}8nG;%$C=-w{`{z^aAhjXL1KI#f( z7klP4{A)90@*Fe?8Q_GYo2!04u~_Zpii=TWmTxZ7FQ$MQYTr`jT4VWE;C}!)Zy17w+yR_k z9g(nAa|O8dZ8ww_Rq?Pa^vMV6zB=a8!)>_)axPa@AbIyb^a)Hf?ih0a_s{%aw1YB#~;S!d?F;EfDLa zn{h)FWRH6~@Sd(P5Z=gLskrZSA-C_JLCzDkS##ttuq*jAxwNqS)>lM<J}NE^w}X?ciT}^~5V`FAYmG zSlBiyC;Vzwro6uMzt1E`0ciV@@44l&&aF$S`#dK@$sNB^9GAZqwVrsErHxIrKL7u=W5ZM1D}ubFfai?*APSxgo)bt@OvieRT(CobkPAhx?mM{BqI#m zmM>EWHC4gV1aB@uxWKSHMK_ixc89yXV`j%SaYq-}>Edx6jiqlhxz_i^w(}6;?8?{` zUF(Hv0qDag^bi0(T^<^+2fa3`_#4&8`o(ls)AMp8M_xn84MC(*h8)z^GCAkC_3-MS^fa zQkoTYF;k8E?h`eW_{=6GXT{A?m_k79`tD}|Z5DVnuPrtrS$yAdyg_7L*{Q8_a;a)g z5_3`rDroWjhkH{3DLhthOIr{BociTif#mW-7d1h}S?tK}>JbCiorct*22naJ5m zdswygY)H0?Rravbqv?5kU94hKqES$N+?0E9m#Hu`#B?Z1k)C%O4Z1iQ0BwK0=d{ov zFQ<+YF}_IY)ty+_ABq1t=&o7{woET@1b6=nUA^#bjJkK;|EGaQtDyBOj8`pf{H(6V z*opmP_V?SnT1JBPyx{J>D;|&T9l1~-0UGvctJW;T@1@A6xsiI?BV)I0L#((8n;jEKC)_R2pf-W_;vNr5wyVaB-lhty7e zw*#KKQXLQ}S57p-`YOLkJ|vV2uoVTb-p{-;%Lm-Zu+F!QUvBB69-Dn%B?z9Uf{?sX zqHCG2%{Wi>YA1ogtL~yvEq`-Py$gyE^$v+AVU887?lU;`ICLgBF)7GqdGo>TxVxXj zBik_vs(4|6?`;4iLGvpHp_m*&NF92CrA;=#(m!(Yug1LLr|}I)qyeVE(+_2`0-f%w zE-gQR%_J1*B>>N7QuG(x=RSR~_Ohq&>vI>?K@ZrvrD64WEqw&jDEEkVx7~QkuMTN3 z{oOZOo(_f-VBB&VRAm`vFkxWzw0jEXwCleltMrM=e>%re?(It< zsM%nF{jE+Q_R#oiIx%cSL#aCaN%pcwcUlQ~fe~@|_?=-RMFT6NYUbR%4UIl9Yg>cIZ1|7>WRb(67Y*g}P8-IxC%O&Ba<1Dr?BFt*TAjh}eAz2%_ z821;{<EWVxVbQDQLK!qc8VMum<6D#nyb{`VZ9)5^2Wt#{SSJ|a` z?=9a4W_y6{f-jk|xo8*JiXup^p;OaY(HW5p10XASz*q%5Y%idr(VCV1(Ff)>VpwQm zqOAeensu(PCKt=-|HZN;ez0ZO-_25-htQRURwUq&0LYH@-F^S)MZFC3qquiS+!Np) zKH3uydkmNk#+t$GH%$=wNRloShZgs8HK_l^ngTzsa@oA@<}P1<4{j15$H@y`A5v>R z(If7hBm0=Q1$|Ja)-6r*yVZAa6;0>f8r~<--lir9C7*+zxC@fgmZnIB>r#=WMJ2j? z-;wn4j-s!2b+(~@ldn+YcktO2b`;%${v?*%VgXNQ`*}mr0P|93^#)yM(CaGlo7p|OPAJGpO zEEL<#kRt=G(ua?;>8W9l(4R~wme)Z}G1)F7(n_5T2)YQO6>J$D11XEtEE*&5O^hXD z$F;X&@N0vCZ9kP4&u{-X2?gtktLWM6#^GsmRr&eS0;4x&FMgntk}9TfWZ+L*O#Ixi z1#Wo`h8k)TqaFzP(g8lsGM#@80yrkZF{uzaqAUcycF@(qFypCKv#)6~dMtY~y4Ywo zCTwDdX^X-T&$TDyT#%Vh_sAz)3{&B%L|h7QTok@82EDowfG~Hcsi|Pesq*a9*M$Lr z_2!8+SzQEp(@}*s!FEX`s}7!?+}LxrWNE1juS){ahgKuST90Gbgyncljr9RENJU0K zms*TJMw`YcdTWE^YxQOGjgBrABLwZbo-|?mT%2{5!uMN>nY9&{i>1=)CrG#6NEVaC z5P1=HS_4lTQe*m4xG{UC_YQ{?qR-^+EqPiJK)K#k^+03#FW%#diNL~t;cz{-E^1WM z4A)N7<(h~501+R`GLb0A=378Y#~JM8)uea;ZZ*9zPG6+h>Dj;94mnQfQTI`s7Ht6m z{(E7fZvR?8>0bAA*21=}Y($W9+~8*LP*=i^rlt_U-G>z*Zxnp=wPdF5>19)QmvNPr zx&~oo-jSL|8DMEm3R48gojMRQAE)|H;SD0?!(7Ne4sk{&tY(9OFu<${1-ngLNA4Ou zMtwIAA-}tn^}1+912wM$h=U}q68vFbRlf4+dqjE}pS3{Z>QlEw#(m~J17Ms<2WSsQ zpiu!rCZc|qE<_KTWe$3~ScpNMd0Z-MXF|nN4AoR#Brornh`$Nj*AW+!@&zljwZB^r}~Psw#{a?djIxy)V@Ff*-zjNL3Uviy2l+fUeaR#0&NOzvV_zD z?~$kII^z9s2kZqt_Am()qD)4W^~Wl~M8Qlzd?g#;(=X2G0>SljNggpI2fny%_vv=r ze~Aa3G;50n?P7EXw8AnfKZuAP{8q#!=IvR9pWqJnl~2bF?HB_Z3kc zmbGb2gO6tLAdrU@k0qnI`>s>r+$AsEgl=gZE5PG7CJxfz?}IK)@%Cn|2yO@OpznX5 z^F!G7L_oeh3ponoJX39$jY{sdE>j{tfMVGG*kB4%HlJFwwyMI#8D4HZw5$nv-2&|8 zDdm`3DT}_{UDFG(gmV+J5nt<6xT3qY4+hGOV?v>{){hP=H@(p*lckRYKoID*(sd!o zWkKL)%?3^aRK4r3$t{-6Nkx{86_cs$J)X8fgehG6s<6t(j-0iQ7zFHJE2%2JB!c~J zp0MmXxfF9z`7y;?U~>uYn28x_E>Z@XREB!1kJf)Kw%8Q@Xl>sqp1$?tRAvJfzp|aj z+O(%5EZrf2m`!{L$}8Wo;*uIWWb^lkVW&oMMnfV>Ct9H{WUaH_OR4&`!FreE#+KI`(T*s z0cs-2e84B;(D~=#tH3bw1n;B7t^1&mXC>_Xao}NwX($rtsshP}ZXF z2~1=FwR!F+G&+t_eSS|_CUg2y)Qaf^wnL=K9>5})UNeGBC>DIB?I_iu{1-~sco@Xk zGrphKq5q0dwha&KXbT_KENB=7IC-()WppY-n$$RDB3op}KeR}d4EMjL;{#sONxv81 z=$RdW*##1yYBu06EtuYa$p_m+B7B+&f8kPq3KP{?=eq#zkKMenAUS}rUjw%0mS85T z1vlc{KxAOeXv5PFVfSurYFJ^9M9gN2gy` z0P_m`U7{50URpRlcuWpy(Sq%l5-F-jhE(uKIbU}bb=K;F04(vRj6D=v9*X~{fq)WN zJH+aWjj-kyAfXdzpvWD?LPfhDU(20M1-0HC=mAPV$c3v0(M3it9A)uxq1k@ut)?ha z|EE@=bElw8pe9fCn3*W#nbW3d?(Gw5nmGY}zRb}lr`U~mOsBWjQWLAaOOqzS&EU!F zLXcN~1A#N^E%sC79lgmXMq1&9d#GQEQnQZXqwlR>Vq_e@t`x6PFcfvE<3^;`_DHvM z;j~{-i{)q+CnGRB=nbgM_W_^lHyN|cL*do}-} z?gG@^jum_S=9eY(&~KY)OOH8KgRVb%|Cn2XVaKvw+FyBZ{QcnU!P52!^%b#e>O+^s zNPGD!0XbzNbbnZ)!*?LEbz!D{UO=atD!y!qO%5?5JXD0X)UH!j#J>{|=i#}eT(s8? zB&%8NU+XcG?-c;*5H4wpMX3)?^|$Z!RRREH4dQ?(_G!U~IgHM^0Q`geTYg}2RS}Rs z`=ArY*)j=Yg08{_kGovhN?F|uO~B^UgY9G>c{GuT_L74fk=?dtxq)HWY1$w3AM19x zbBzhhUL06&k3>=J{h;QV{&B+6_2w3{MOD=ePnu$Vp;d&e&4H$JGY}nHVt3E~FtR&~ zf`tK(61}X)P42+WP7!U84bAG7rvG^R@41SSlOFFc_)rdPZL;6<8e~9zEH4>6)qU%H=j+|IE6XWePtX*P zofWsuC?W!g?fk~+{G0K!dKncD(9d@`=w2V%-22+-)o|?2B#vux3px)!-jCou3exIQ z(EM5c>(yb0=H@Oh?x9fJ*{;F+Rdd;~I5k!$mnzH8-$^0B?2Fys8UrLds8auL{oDbp zNf5S~>*!jkEHYhU^3>qY++>4XYEi7<7LmO;7|{DVNRkMkFV*1tF~KI=wVm&EV-Y#y6dU&`Q_Mlk;d`_`w$(Yd}K4w;Jjpe5f)>_h)T{tV#g6bSH59++FWZWO;^` zDD=u}&9RbJE&1D_Q0FQ>bspHo_Y`h{X&MpYnm^;4LQS>Au&hJ6f=@O?dfP(9ayq1J z4=TNCS@zqydaA4U_BEVsHq-UHeT~M0y{|uP8rNIwtctZ5Quj=W#WA8@v}*u;z22)y}rLJuI25=Je68-&M&03ArlR}?j4$3 z6$;XK`irlbV8}F^^|KgOyluv~;23K43ZsSVh@2?sk~=!@y9CjEh=vdvKd1EF*zPYq zZ2h%x{buwgy_%KyVq>*{^S}f00yo!brV!Yq8%qY<)_V|y?{xlmq=_Q5So~*SDM8P79^_;C3^BhJexq5 zzfz@jux1!YIbNBPS)xyN-$|R-Rl70j0qK9%`c$!3nn=D_vhy$u@hrItvCvvI7;E|~ zho>~2*iguqlIdUzoq15Bp?N{v<3Z&6^Cs%l z@a-pf5EGTS4ytoyv$p8d{H8v|q!ypI*(B=Y4;JrF-aJ_pK%3IKtQX{)rrG`Iz{K1; z+vRFLJ+FKp9k#^HvO#uReNRrli)BX#lTe;Jb zY5}}1Kq~Y_6#p}j7n|6ItHY{d8#})HK4YXNo{A6W#Lb69go6|DGy4q)o2OlX??Ya( zDIV3Z((1@YQMRAle8pRC!1s9xVR!z@EIz}*wqIL3{JrjtRg*CEb}-g^-evzd%3GK6G3Y5N?l(kk?Q++J-4OV) z8DqY0x^##zmL$2G(y(^x=$yBNbAOMm(QNE()GVO}+)BMpwNEBF@7~=UGpu01Ou7VT zJ(?s={L?BjJ40vi>30r1&S*8EC;(<4J<3QeA$aGv!|cq-s$gXp+H; zt2qGpyN_(yj!O5v;*mqts{93(B7{xyXvflgw?n%ooq2kHTi?Eh%@r-H&Mkqz971uF zY~Z*Xs{{~ANCQxx5c}TO+$1!xz9zUK6-)G5aI`a}!H`#tPdwS11E%y^p!NOY9At}Y z7MnjqTZ-tq*HH4GAjHrv#^p6C28Q13(;Ay`B;y%newncuq@zj=J$EeVzZP$)eG6)RJWgmNhNa6~{E)4&R1Orbn61Sp%C_vmAA zSs7Q0lpRs(`x|pEvg|4Dg*ka?q~8F5c?G$R@NWo@JUEK>64`erbEa%PVwDPV>nzBn z*=~r&C3TrU`(9Gg*A@C&Re!^=o+h<#qT;zXdmJJFI0>*b@9M2p;ICmn;NzfQAEE6K zvNm86lNBW5z+Tt=y#qQkc{_~exfzPq0Mi_Es4vc&wxG0M^!>>(X$Zo?UPoKMKTEUX zBZKbk{07|6fDpT`US$Dk&MK^YB#=}wNdf6VCwZ{UvM5#{?KZWP(8(xI)#X|hKaCZ| zF5-X4z3SbJC&9WKw-$Hn<}ARbMD0#J@J_VZLqsMUT2yM=&4+yzR|A}GD3XZU!j7Ab zpKtTi4+j(tho;snCJ-v#C!OV+X9T05ZbENC%b8ma8pQ{@o_=}z7|B))B@Zx$9`0Y; z6o&}1KmTx4?;n2KrdapYFCow=(FpLR{aGnbqNUn;->^HncCFh5aCJ`sdAFhJv_cGxsX)8@(W66asq>Im7I>+) zUhgptT&32|QEU+q@ImB|us@akn2mC~t!;385x_m0a}gl7Wy1|_{LGSgu8G!f!|OKa zCcKaca!b$|GWA_bqZq=XL@tK|8YJhavPgBcBHF=@vxMIGEh4u3RPH=QdgBml|CM_? z3(rE31r0kX($T0k7+>rHsAGMeV?%7YK(jlEbGsm~`~ojso9nDRK^xL-79lyY-)|gM zo{SNgNOoKhH^Nmdw^hN@5y=8jve@T0E;WMEqyNxkBk@J)U^v0LCi<@GG8=W)oKVH~ zPCi8xdH!YnxW#)1f}qa@5x=C`1=GEItDzS}YjvJo4glJ>_zFU$+K>L)EXbyS5ud+y z%uV(my~Mk{#_dC$&o#nZUZ_mzvVIzsekD0WWt;laHMmXh_IW7_!`#I~tBgbZ20i%V zI2FS$DEGd_s%TmADj^Kz0kW9&hC=XRY)Xikw$74E{Vw)JcGs4$+$el1?h{pTiV(Rx z-w?3>iKVPF*6l6%f#?l;a zv*B;05}H#ea##2$5zv?t!eqc^0O*L{sk(gZf3|$y+y@-qpo70vZ=%0^&&4oLvZ$cF z$0n%wlCQ;}_|ZAvB|cJFb@|HMeSqU-BBaU&B{hH#pD0cHU*hRePg+2_av zhE}cDt|QnH^v~m0j7N9h$*PT8sm2#Iy_v#nlmFvVlZ$a!*1q~nZqY0b3S6aEuRo9n z92a9T#MMSo!DY?gfa6bI#%hvs(rywXRgz{4caCOy{iSu>^_dspMLV%Kp+nx6uETQH z-Zy$MKDC68Ew<@#1xvSO%I#mIX7TK#=TF+6*Ky(rO+6QIy^p=0oLl$a@>#x)%WCa4 zsI`?_1*HE!)#1v97va4SZCYz7gxz*vo$)l1z^h9ose6e*T>8$rs|$?Q+8YA~$g!?G z?Hz&j%eD9~#ES!blx;t=w0j)2b-?(0$O$CWM1qyXHIbngnJ7~sd~FAbmVr|ftIOa_ z7sBS~w6@D-Vdwu)vq&^1uyUlvv%{e4mhUK5pGnrj2-XECmy`fA8snIt@iDppS4$vX zai62f;99vU1l3tUIZH7&mhT!#rtz4H>mX0n;ZQ=U4ab$4sw^6>0wM2#U@+MKR~X=f z7CQD&E^BN{o2{D{9o7n*Qp-ej1lUY)-!<=5*|DwJ+SjnHOLfScUvv zVs@pO=`&T0k)fP@><@<@VD(sj_*X)De-%oNUFk7^uPe6p)v*V4YDg9&T^bpmiETi> zl)2D(ng=BZ_`U4BOFGAP?{@g%z4Pcd%%%raFphY`|Mi}6l^5a#n=OvaMSLYyIj{_; z6D_uZNl98W2G1qvnUa1ae8}M=fZ~NoNdyFeXrzD{tJmj&AV`74x8L3x?z;tGf}<5t zVBR>kM#}h?(&fV44!yWgZHLNbQRo1Jh%u6KYGpcg$@uhgSHMyPQHPZnlX8YUCzBt03;!{~Hj(#Yg&3K%^dg8U*wp-_X%6^PK+;`+Icb~@PfS(wF8{WO3 znPy6trzn+L?%DH_x5JHBW0oFQ$eH}Gc`J9{-A>&smT_L%g4I!6rUpmL9rP-TZ%A)v zNT&H0%^A^HRfXyxTJ36ur`5nxLTLt%0+aLy1^#?fkADk zU%sWvmx6}(2zdp{3835;!6P6``xMC(HToS)w{U<-l|g*=K63~*w3uDrBMWt}!4gT0 zJA%)2uj3<^Ya*O~#gJz|BA_wpZ_#gb#v8SvvlO_+ko7pNGih?9UH+{+s zX?vaM2_=Gq^wQBRx?-o5-^+3bWIFEd|NY7`c58Jr5C~s47%?^v5G4P?k^|F8cfgM4 zYsYO9lGk5#5rTC5ip^Mk%ji%t2XeR- z59N;|6VKsdpv~FI_B}m`8I6iOv0-R2w@w!2zoftbvdegls-;9(HAqJjv-aj>Togi_ z;QLmOTF#0)FCKXT;#zpXOx@kiQwc(so#YB`hrt-g5g6_fcz|__g}mnG>ScoJj$eD; zdbX-9MuW2n1+jK)NRImdmY9CO5BS-HsK~PVM$=W?8>NYFpaUE0`r|^Vo#rIUR+cAq z=_D(%9rxrgU&jpr)x<&{Rq<=b>VIHqTd&MVXK{9duwp#l$ZJX4^#&lPj5UF4A`1>> zQ4%XNxcd&)UVL?GVpZeH!!L&+^28`3IkM5?!H2ho?Eqo2no>Dzv!SqjSo2=U2q?`B z_X)KlXrd_~I&nodY4kOuT6WvU4De#_KwE?&7VTxO{WB~T+1zf&u^uNLd=dE_DBP_! z0y_}XZ?g8FB)j`tn?m;qd7%aJxE-(gDB;B0TUlgH&%30wjUSEV>GxGA&I){pNfjWj zV{8U6*cM_A61tBjm-3Sq;EKIHZ`(6)pL4orRPmL+Rciy@E}qP%o{sEC2T|CZO`7ZE z(!Z%iAWVWKdV-G~(-04_P=~^i8IW+Z7AR)z0**f5&8-=&{^@j9gP{R5)cxiUj_&u~s}SkBq@Xnwy|7uim&mn2^ZOVaDX z&N{yeY0fCcD|H_6>u&C9IUCk+;p;Z2#bL~R@O9bHpX0M3C)#%CY$xd)9B?^PcYG~i z3uGs5ItZY=cdwe5XXM6zEOvW5_;&YPo3|p^k+$EAqq+micECDv(xjcJMj5YY;1XZO zi8r1H0a;UZPtq^cV~RFZ5LoNwfS26xjS0BCmlIL{>;^d(>>1}zmjhhyKuO5s1R2-5%aZ0}( zK@Lc7`;#_pf98c`4h#K9;SBSLR~@n7Px+m(Ot_%u?b^g{HE37FW+})gpKh-Z|M>(z z&1TGD_%Po)x#J8&L{H{5p5?F!!fSV-5)-RsN`rZd-*XjuZO2?RYze|As7=5zoUvZf zF2I*BTQNEFfOj+BrMc_I3Q9R?apK(2R|FF1mLKD!|BWJvXGIjN#ebGVpu9l|$*`R-3b zF1tUVFmknGN`+|JQu>8h+l2wxaNxE9;z)X1*Lk~Bm$lB}lyZWfxh7pw8rOe{v*bY- zLUQnHG%dgYUJ&#sfOe6V@U!e+^K=+peW;S1F)GrLVTq+1)H!+~^Me0tB%vsKd zAOQ*|rD*Ard(IL#)lOTG(>$yz)!(9^(M*mP#Bqpu0KN(20TQxPE*n1*_By?pkWhe7kp_rV11f8JKsPh=yi~X*FaH>_ zObD^02O9o+*GEpG$>r8u^R4{OZ$J=2HEp0j#q9#fu%%Q{ZuYIfQd||?xZI7739W?nsJ;?xczAqJ>sl~s5J+xpe3EzVv-lh8eO9du>z9t(eTrGPYl)!|J-cS&6 zclKiBALmtcsJS{@u=|@;fv{O@VV{?KG_<4C|4FIS$5`h5DY_u^B>k3*x8}Ox-U;;4 z?g0Dh%_XUGi!CiQ(^qm%A7C5hU|Mng(Y>D9jwCg{0`spD$JAi?U3ZtX1w|9r zP^$6W1-YBV=yEc9WrA9^!ls3coWDC;nn*&|L7v2yV5AT?0737uG>c6Fi$&BApBm9v z{Q5EpZ;Q+PheH#uxlI?N0`A=Zd7*V8scUX;PPxp!%78og`i9&wKvW#)@fe)+wvTEQX{r0dJ-#HWKc~0IuDoC8 zI242t^cD$a1k3*RE!WYlrN_3(r)ly|zo=Dq^Ua3SR`mWlHQt$fQltxGr9%red3FbF ziLbogTwXZ3k^hXE$VG1FB}+#Ne+IHOQUZF?Ff^G1KcA$}seV(|TEn+DT6EyNmNrZM z?}8MxP+d6R+^2od{O#YB&zNkmG2`Eg!e6Vi(4N*&`jPVUzqRNCPcqs~QUzPwvl)o< z4rPnFXaK1Je?RdMhyWQhARR&`i1M6ukO{i1ei86mA0ZWXwI~Begbq+pvSuLFTZo8> z>hO1OTO7E;Pq+1y#B#4%bgM(xU5yh{Uvt4eut*prKmHxW3ztLi4 zR{x1L1?=DBwJ`M@QI0Hrs4x8~^$V_S`L|xRFc^95(t~kdQIKBpq%yFXV1K?!w<;uS&KD@f}}Oo+?r48TPV3#ZH!=F5vncL8Yz7PPCp|YP1Oxe(V5d{$8)mVs3>G5_b8Xk`9|06Wi``(${YxSa zLPd?lDVRVFTV1A}Jsh?V0&>iu{85$1D{{f}TS=k|FCEl>-AQdI`PDWOK1H!=zJrFh}k%Xgnb-As9aK5}z;6(a|J0|Zo zRb@TedL5wCq@ev&`>fkXQr;BlGAZ|pahb&w_Ol-$OiUI8Eo-nt#ver<0S3dOa_fyF zS+~B*$HH77#{qg!EE?Jc6hw7ASi<73b3Rml_5!9{u~e-6Hql@=`{Fr_^n&v*jk-@b z`FSYsr?8_S)X8WD78)-gKH2+f)N;gR$=8w64(t`(+SUS$g*R6jRiwwB%B5?TRE=f zml)=@T&G@ERN9RcY0wPdi0Ym(*~xFZ2S9mj|0BwTnA!iFgs4ri9@tMKUV$#Fo9Cp5 zOU;o>Z!Q&cq4>6Qw$c~s3pky!_Pg%exNV@yY%&|{cJ#`YTSfygUV_hKruFb!4`g7_y%TATwy z2@CL1u5KDXbU#H^BT@#-*MlK{AmBY*H}(e7V@98YigY4FBjf^Qm}Aa-g$$Nq0ZWEB zMfbtkU}?*Y?jPKp5f4bJlQ^G|xRE(-Wd`4FMQZpU#8TnkUj$vv?sm3i#w3X4s3_T! zRP#1t3g;6hFH~fT$Nab`-udLxg-8&hc$XUx3pw)7gTcLFRf?vy6;-IzS-Fo&wtTT zjroA@ExF%KJi7`(RR|IHQTil~qoaMwUkbMh0OcUVd z^tgYOYui*jTzc+t7C%VQ*dUwA#cAY9BJ?0kN`U5_g^I}M&xzmL18n$GoBVYEkyk==Mw7u@)oI~6xJdLx1u_NS2_uAj&IP!i}59p(DhPKb?%_= zVYl%(Af5~a|8C$#prdP|K5W!G)S_7jX=T;O4<+RONDLxN!?EI_1A|?5gjIsNF!a+t z?GuKT4Xg2EpwWR4Vx<}f%NDd4c5!OPH4j#BCk_Gj_$KoBX#{>)06>gL{Aso?>7A-3 z@8I+`1908NR;Kei)yiJSw#zwPyZ+sQIYPTxafbSl8BjAT4v-!mCKuIV$j@;c$N;;b zGP4~JG6-2T=u-^lHj8@9g2@0hlRnJpinf0|oc)!?v(BoL+LM6Buj|H|I;aoo4q!4i z-j-Jy^~&w4$^wobj&0VBfJemz7l;O?oBtEzt7HIdJoj!d6$KgHLg*wCALNTcj{Ua4 zL-NP+sM1!B9z%~~9~S*b@va?iiwY#<`ps8oqIc=kgMG0j^ynP}V!09R+Wbvtrq}T& zk^--ny`l=NP1KJ~Uj|s^G*q?CR}cz>hxHig63k zMVT<(hD2T}XZe1U5ZL9Z4WCZ+2Z|ct94Xz(E~Wl50LF1^rm+6frRRr9F`y=VC?y~< zg=1BU-CE&zOT>z@40 zk*f`rU1uRQATK=Ozy)ZQ8Xs6QZ5E&7>CzBLm=YnQ7w)JnJb2NV-(w^UZ4)TDS7`#F zZ)8w~H(v0U3g>D7d9>Gdzy%4K^oi?=M@LIPVgC9qnih0Z$QitS^_X}_i%%4%fkd67 z#q^6tmgE!tHjM(&RIAH%Krt1>K3$OMv(dMg*`?!z=}y@`Sfb{`vvwDHXr+udo46T0 z^bNm9NzX*#3`_PYu7k4`P{WPHtE#c5hODQn@f>{C>m}Xuhc;7Qb9O=$0+&y``3Vzo z9k}%CH`{Dz_KBP$XAyzvm|R-fgNYa$(pvw?r`{ANFFnonfLwcBZ2x7uzds2wd7RCS zqo@ZVFYwgGg{A_$h+#C8d=h+{Tg&$3!d_DR8M@Jc=#?STR<5&6_mS&vnrt`ltKpCG zR4xia&}D7AFA6!U?sBUge#xIEsuuT4f6nxe8e>4n~Rxm;1s15m>~$O7F6*+sC)w0e1GlSzXnVaMfVAf`XWjY z+bQO&U$d$X2<0ivBm)3^B0XjM5ff?h1Q3Y?R- z)aOGBMsK-=VsZvLY68tTy0BPs6Vog%!{2evwaU59da_!6Wn$^hra3qq#Hdgm)Yn2M@fj0S)%*((c>&G@jB*HMR>i&u0Q&1~ z0!7DH0}p7sQqoD?pBo=1E6j^Qd4A1gmL{Uz?CqRr=y_Z$E_gqrbH35qKPfQ9`mg=0 zvi`{|BM@eIVs2gFUj$P$noZRst*5p1++e0s_}+mj{_`h%`gdWCKYM(dqKJ)Qz_tur z`9cL@@N%w4sK>ctk!D-gRoa-k)azAD*JR{mXlsU!4Jw@UgfjJ|5l4+H=pln~6pZH{##N)3nPcb?g15 zUC-BU&~p}dA>wNQL^|umP5Z@*rqdDdHyA7Nf5kL|A(aW zj;Hed|M+!|bz~hRWE@9EMI@zR9HW5-DIGG4Qc03eM#ectAv0Ocqf%*Eg^V0Zc23F) zIkK}I>+Jh?_5J$%LfCegAJQ%-z~&enHa!~G;jpH5clnYqp0jQ0K*!Ys~il~kTdQiLSH z##5v$M1#Kxu0hft8Sw?>aQPGG}Ss5^XegIIwm z$eSteI7;7P{EP#NTWyANV+N`w0f8kQ;YzFp$M}7)}CA|5#42F5XNZ{#^ z9lQKmVRl3^6cpMn!&vIUyRqdtA6fyKeu%fxKsAws_KRF4!q|8$@`XXmFi@%1Cp>DD z`raD-DZA1Xm-diy^Wo2ym$7_d*f%)qY7gUMgWl=~R6BS2N9}uzNB(@PiV}w=Z>*Zw zvR70o^ZudH(hZ6umNpsZ@8h+VsL1 z!UH3)86w7QA$*5zb!3M3Ug_b_^SjMAt%No2aBJBu0MzzJCii)C3SC!0ji0v-o$`^~ zlE-NO`BEBz@;}}a(tm|inQ&1N!9=G1Xa8u*ScDe1Fo#H8NRqA*%QeAb^TSrkb40sFhkd0y7)_0=s>$^xyw@CcST)3kN1A>f ze~l-9A}+nNWJvwfD!=QJS7RGN8v*yxU*dDKL|DPg@YQOt%Sp{)@}Qn`T=9<=<`<3o z)Sm4+8n$2hzYPe4Nh}|Z=(3x1(?OD%hZGYyUG+I*`Y|^&$J3Q!fkV86<^qxN!|Y}D zD(h2yfS07^oKJ_cR7&7T$X-FH0*0deHh&lRN$B}X{Rtj6&3+;!T9KEeWC61GR(!JI zZhijyK6m80_H=Dtp;f6^S>HHY;BpJ^6mQ$)Io^h9pT_RbD0AzuP|`c52$iq2Z$4%T zy1!|vFhv?he!PqIk6F}aFYePYXg{YLXoJrVe!LxvFvwI%Nl56_UL?SHh%BxeQ;@cjRAtc1o7B2{W|jTB8m}aUlH2Q#vMWOTX1D;e*E&F+~gr?h`8Do)+*d*8b>BXfhhkxN>rNst*81e4-BlA55dXW%Z2R7+Nz?q9+2ExZ-R}1g ziSC_1{~SAT{5rX@lxl$JJ((yooYns8tuVH_c4T;<*B}hDpu=%Bu-mZqe#mQal#&JcecN!uf4?kICe-VsND~?SFKR9FCCRxd;^Pitmi(=$F~=MJ*FHWWFKH1Q{(Ld82eM^ zYGi7dw?~JlaZIHp1Vbqcq|Kz(>Z8_Yxd}E&s-t)w0cv}%$xJKm+w1f6 ziiGtnrt5LzS6@iKH6_1I$?*#&Z>(ewuL(~*_zD}1+cRG2j;HQ( zKOuz1^>P%QQ_JL%Jh~OUjCdoa*=`o;?Jo~xt+;qD)mLn$IO|N~IqR;JXG7+|*K6EC zz5T51x<5}2#+N_QaBJbJcIF6nf50QP)eiCFk6zyNU)#-snU3_;LNushc$9J8Lk2F0 zWROJ4*dyh9>iJeQ+kHrB`PDTVzE%yB&w%FC0kB#UMpuDidD6FGkG@Y#aXV!9pF*zH zIzcT+-27~l-*bG2S=~wNB5k;$ucW|w%eit)@jM#X*ApOzl>33)b+Gp}7l)2nuTENpcIB5sx3;WmQo9)jG6-wOd z^u{k%854&xsNKNfcUm!H_n*PrA0mvLZB)m_p$$R_rzXv7gl z*4km7W)li%L{3jp*MS$!7lv zRt-(wI;YW}uCb=rB{{FuZ1>cynIZMoAAXvTO6OwPqjWMX4))Gh!+Ru>rmd`fF0uwRszUHc+z!*(c>m zp2M$UQZl}_X7E=ak-c+2u;1V3{_OX-A8>9F$o{J|+|O$5^j0}afk*&pqW4Z+Pb$4Q>YBh44}G}JmQvZiVd)6|aj@z=T|U%g zV`00$i0dH@^Bl-;czC{rC~&|GNr8uVkOzW5cs$;ZX9x=&wSSFiXIw%=b^D5i$|kE} zoOLK6v3J+Pdxl!A#;l5~zx5&xoT01(=ncFdRGr=5;Xw43AR+&Ue%~nkI$ttQ`(L+Z zlsBahqMW6kir1myM4qWx9B*K}K{ODIK%{-73>IJ8b{9#7X0<;fv!43|hazYDJ}esw z)Mby|{1``-<;Rw9!PmYXEiAf$kU)pjFS-t2yt$^n@2cmY#u)4n;$=y(f@yfs;@~4~ z9aP$-XYVSBC)&&Bvrz`Y8@_1?f==!7-#62HWSuifFRaIfVX}4$p|+xgpZ0evf@*n- zgS0PKa`D0IeDSQ&@FT~GTkzyo0vq9IibGn+Nj&ZPbMA&-X13Sqg}q8PlBX3{196C% z0+&-limMU8AgU2Z+T^{;M*f2Unfx+cj&E$+?vYmpuS{iE_V_U0c=I=A#2Rh3AYsyB za6P4;sVi=LYRj}_b7X{MEvAe5l0XwPyOr_Zfu@qzVr5fx2Pz*OoAI%rJ3G+NOSD$D z?am|*hAOM^>uz&<`hnJ%hcGDS;iOh$n2qx+B|{XMAd+j1cnJd7bMff-$8f^JUOYfn zNq1HhUriYK&XzD6nGOR&6wFCu`{~Vq*{z@01Yyggwp+l`({ge;EPX-plKymyueE1E;;tg^8&%@T#bQ~V zN`{)q5uHa8L2bH7NWdABjy$C0H1=nkp?Wk~9#ik$N{892 zzV>PS-Xo+j<8#(ae`06K*V@xg=}OLeOpbbeuV`8@3UGp*`~~1UZFWeR0P}VP$k8f@ z&O;FjeUPY@s#H|Fv?$(lhi%~Q zz-XITrr}n>+W(=;7S;c_Fc3}HW`~~7w~x|!ZO2*AbXi~B#I~QY8fxWm-;+z-wAj)( z+5qCw#GvH|mA;LI`JU=FJmEp%v;Hy#a7UdN`XG9yu;}E8P+9c)r$>oCUO|?)^?xTq zD~;+>uweF0=L53wV&u(d45@1XY=6OvSX7Mc!8uR|etPup7=#z5kRcqKTk8(3uH4s^ zG7&eiLE{@2eY`OXc1N2sduf&q)Ghp*mG9_eafp`EMfBQ?6U-hEmr~tlp_~e5zRLSp zRFFoJL}m5BR11Of-=126PW>n>Lv@GSSNr3ADJ@<}CX(ZerR$r=f(Ek|O47cC6vi8+ z)_&m1b8{B&3wAm^UiBa1K55e|9r~;X4W1}L4WqtUz}rqCtu8C>4RYrhZk{fH+@^iu zsw)cFm0LN8XT`4EP^Y1V4JiCP@!2T7yLLy}0Zhfaj?}vdua{b<1+Mb@%zBV->^^St zf7%XUVQS4UTu@?(-if)1o%RtQPklIS$_s?Wdr8uOHh; z>$xfg9)klg2sgK$&`gp5?)L`Z&<#;fAe6C;Awv`npY_N-^CZ{D0=c7<17_~?_|_T_ z*k&RC)AGs74;F~mfT#F#Gr^kb36Og+I{}8nlXVx;TQj*rI$|BTJB-K0ej?4N{SV70RKxHj2>2P^E?@0RckxV3^?EO^$J+(7F zmiqw5fl(+ zt^~XnMYIk;CN($5>l;`KbCVg{rY>lnOAcI*L@qqqfCBt)p_t*ulkAiQFhr4{_9@3l ztx>V-ivGnm-LdpeA1R1xty4Z}^Y>Al*FpXP4EEo{mL(!eixdo47)9OzKtp*h;#!Pb zdE%Fn1joNvVKSF}jK*+MJTI0$OmSq;6HMz(GY?>D&q-+T+O!GI*+JT^B$U+JoB4Mt zshb)(_pfTpzPauZj)9p7m!<* z#I0h=I|tjFX>-N$Jr?-IL2apve#%#^`EGCjS?8~{cfR4v`UT6PYR_#u%{XK}dGx$b z9#sZyl6#l0R=>w4Fk|;hQt7V&KCE!>L1P(d#(XlRt9zn;v7Qs1xy^-ZGYH8;R}Aa2 zxG~rb!s?-n>19(2U)@%cylC2s!kaheJi0vdBKJx7duzYdfRj)pYZ zDp7Y0A+9O%^fTdauB9md9glum!3YxjkB!=x!b@G>Q_@OaDK6M~f%rTvKt zL~B;`1s!KaL={v^xXS(u$ZB))V#9M0^Ag{#y;5t{pB?_u$myaDXgCV3`Fs zfb-WTLK#EAWFa+Gab#oz;KP(3;3SG_?_+xuvhB*~$&y>jNQ_kP$ZW2XbF|!h1|7Td z^!G9kHp7c*10Og$kluQzzRV>4SUj5zg3u7oh$3HlAAMNG%OP9zuaqmpvhTbF1>LIt zW%kos?z~#=UvfqrPx1uLG*+2>BeYVFr~c|Iet62MFOwUCeB_QrmeSTS z2OiAZ)LD@kk1z~_S1W8EWr`bLS$|e_8`z#@|Ft`cRdu5&{QT48IDmxiJ;qVp&G0DT zkGS>#F#N6L(Q{?5poypnE92$E^-jGOwIdSJJe{=9vZBSSYdT9O|I$8Oi_E#A*P&Ik z^2x`q0gW3AYaUV1d0H?Qc}pR9XHbPi?n5zs-@LsiMk}mJzu8yiJV*-^+cH0)H5Jgf z_|@s@wvQsfPDK-WhV_KLgLfe24N}ZQlK%Cp#prs}3H{M(3)ty=O~_UZn6?-c!V)-Fj4B+lzEaBzRN3rh9m|cY4Z~ndQr;|qu>@to5aYR4DEscs!odlCq&6NI zdQbhRY?yN91Yh)j+NJDi_qV&8Tf`vRJh_Zmd#ye2T_VX-ra$vtnovlx?ibHp06bOY z1;HXw?6p%BeIhd2af%rC&~?1 z9Vb|w_H_>oFZ)8%OPRPM000<;^Zeh{wF7Ou zDZ-rzwDXWxlJ*uPS8iJMim_O7MfN^Q{-!MW>Ez33t~F3Js$EN823SU0xkA6)XXdxw z`oexUD7D_5wkJ4$75(5n=ONPBZrD9EyZb1J&Txf91ps=Q4JsSQ3LZgY?#ZDyE@}EA;xn0R=#z%4GS%5DfyTRu3 zUcuZQK2}guzjPet?q1@Qx`B(~^Im>1@Hp)zg|!}zs`m)04QGRWi@Tp(foS`mNf}e( zVnJJ$ik$`obZCCQxC3u>to*78g=b=V(wLCu0MpvJ&&>LUo4LANt-rRzQdSI){0Y%O zettZ11YoN~v4ThZcyZy4bd)sMi8p^`oG@lf#a`E^#Rr8o4Ob;V3t>um(W?Gs_lMkc~C;3opOX4LyJ8fI&==Ai|NCFoS? z=pZePPO;6jr56=e*q$^m537NG+O?X47a!cDyc$U^3YgjRy6ExkpjI$iwK#gbv3yoLBM>`(j_u6;UR zF7Q3<{C{*f)T^-JY)Bq>b{R(CCadg(tU^7q2EXnSj1Yr{stDPDY{W92WnbWfed<=s zRtW2bfg#&nvp4$hcjajpXA_rN9r=9?n7@RhOh-h0DybD=} z3cUvQ=OSXW7E|C@!YSup&s zy(-c3;qI<^^=2`xX-9tIN2vri5b`Zz$8*#1=^A-~`}4N$@1+TG+Wox&f?<$^UQPQf zSlP0&uH%L8gL5XRx-x2OXx*C9#5mpg-iqUo-=ce3vJ6h!Z$NvHf#dhW<#+oPvjd%< zw0|3UBq(-TU@CNOCkZpW@j+mlxq75v7B4Ba>eh>D+-gb;v`up?ehotwJeHJ=yi@=g97Kn8hHS}H zf}VYA!q4Wtv5`<~jYp0~T>1h{+gE{FG})>gY>&VcxvtQj7LMZ9H)oZY#>mWnUK4wL zEM-^BMql&ae2;oFCo$9!c6JyOKkD4OW_i{_F;i9(j$hMQx=77ek^q%0Reb&zaar9g zPZSlj`rFfe$_|5qDM#?)j6s!ML0vr~$scZvftbH~AwLtrZ6dd>ubr38(UUIul)Rw zyjOVP?rOl}R@P)0-!QootFWma9@J|w*e&0K)Avy}P6)bwH@~y9p?_iH1(j0zx{k6{ z>A=lu3HXJc^yh?yz3aOtx_{8^y`8#ls(HC_YaHrB<+@V;az3{8KU~~f@5@pgS^Dgg zIM2n!EW0HbjRme4D6#Z?nPMyS6!6Z0LzbKeYwEI=&aNlQuY6@(_^p%Ee1 zC6Zs3R9e?fY8FeOs`-YTTTM| z)G9)m7GTD_M}rNE3G8DtqV9)YC>}~9U6P`Rq!62fzgr)*EEUnMd63Un?3%ZA8a|lR zeVijX6nY6~P-Df2FiK{Q+(Ru7P6&3-Y5l-mBUrB3n5T7=S^IDLcH%1T=A0~JzFe($ zdd%{S`Bl+gmC1hva`J zFmmXz)!GCVjb9YF7rY-n)>>PSY<|gCM8KL5s0N%QP_eZhhqFi`Rp7|nqxB$HlHeGh zmdp7>vf#0(`!}%LPW|I1C&S0Osm^&Bgg8DXjv&h(mQb_8)2< z!Uc>QF*R)1nHXAWl|w4KAkNJBpLRr%m_Vv6p?CeMBMEd+4-V}Gd-mNLdi{nKcIPa? zDxD+;Vl`69wjjf0F#sFBiw(P6h@*fNWf{xwd9b)4Z)-nO^oct zRea3qzLqy!E4^oYQHQVLH~Su^I$MkwEre*z{)=|7BHs)~)X0~utc$x#BoT4zVY$6+ z@w*z1rHuEQn-!3#)&%&_1jyK#O&X%~xB7lgGfEB$b>fXWqoCH}o@gs3>%O!bMg3r$ zIq6{O-YDG*n{M&SuwIVVHHBKKa`VYsp(CW@%E8at2R;e#4(6{4SZ0hczfIxep^&Yd{WB-{@pQoH3uqs1jS!g4y=C z`v~$Smq|2vJ$iej@@h{*^>0VM1e{Ya?9_wh6k=*~e7(24ygsaVNdi55ZIuQBA=iO@H%bNKa>xDP~8V74F4XtKH3~qcrxmV1xP3{z7X197ODoSF}?16%@G{b*- zP@7kWI#alx?%S~a_S-6xkv-ct*en=j8{9a_5nFjbL0dmvwDd8adu{HMGIGmEfc!&> zxS9$7J^<5|Z~M6?G1HF%U!lm5g}su%DHjJd_EYb04Uzt#_Yt%ZFvQn7mZLCHRN+z{ zp;j(Z3YL}I-~a1MD_FBJ@?k|CJ_=w|1gNHwips>GkL#oBicifFAtz7g4>70OXJ3W( zQwmk;Ps$CM1@qhdc=a)fQw0sbhf5P8iZ(zu9OSoz-_nJrRl{8UW5s5wLHHE4xlD#> z3KvHI9C1fD1NmhQSQV_+;^KN$;GD;!F&foqRow4LWBMBp<8!Kt_7CN=&-@iZw*)|kA{wL zIxvI?qZJ4y6`!`kWg|N!yXn<0jmAEnhSwDH%oVxU;X3KD#?Khi-GiD05tw_wUCW*) z_K4|oyVg*5*NL2Elj|Fcm5$dR?S3cCv#j(#D$N(C6^`D>^cCV;Q!T=*^{1{XYfJ`a z@Ks*>3D;SLXYFqyJ-LNGjzff*9J0|K;rMD9-Y#`u?Yo;G_xZ+zt2(HS;D@Y3UcqiR z3bYushmEaqEF?e+js0y7y#T=5Sv0iDLUP!b(}4VrA3%W+yxuUA719SDRhk60NIBbm zetgp`$FHz2q>2m7VKSj8={&Sq5P6DRwD~5Mi}{SKlGZZZi&YkG?h*^%%XOJL7x(_JEo7>~?=`E~?L*nf#2}PdZ#ObhAxGm?z|{ zATa;stW!Sm&Vk?095e>%rcL(~p5A3yE+>R8o-Pf{SkURis|0LL$~tH z+DO|NerK7v>wg9RNoB3I?2f4sY-s7c(S=}iMvmGTmp`yb#ux3XsP35u`v=?opLh1} zrDpU8ggF0=qvo7w=85YePIgs6OFw-+{oAuhz4WRBO;&tIjQuEb0Spy(P#Qn%9h?>* z$5lv}W4NVng~7qdAxa`C4SI=~F(I^)D<7+^I$M3U%EuOO`Mr|3FiKBj;57cyV0dfg z6y?rS!soox9nc1mSiaQ|iVr;v^y~M0yKn2P)e!3EAhmB%#3Yi#7m7sX-d)@k+x8wx zy2ExAq=#|yD7yMXS>%Ilis^G_z=B;CKn33XXICop@ z?BkviAJ95WNl-WAutS9d2D9QgU4iy3+xcUBNRfuwHu2XtEk$F1H%3i^yZ-Ww9*nww zy$bzl>ttCpFR0y$z`ZJL{ykz%9oEIi)vD%7GeaODqcy^Tl~Hu4O7R*Yl2Uxb<;16X zT+w7d{ka~Ryyw<6%88w-CpL16zIR06-QkRuy|^=-Rp2W?F;3Am_t zyrkyH7xBx=y5p}e>zf!o>)W^&Y}YG!hbEJsbEE#i9zp%A5Kjo=&DWYsc=ZYiVOG|& zx@VIP&KTNG^;nk>az(+9eOYf9*#BJoBkc1c+`oX@$&|n|qVRZ>7#cgkk9rsC0pr@f zG4!oKd@%QukkRT^kgK!YK%g$>xLZYEXMuk&ref4G+>T$Ue)D*L@ za>VDJhlMb>)E1r2*`_uhCJ4O<0b?XvZp_X()g$c!Tjo*{*z5Ek?zq)jjSU)nOpqvB zks_N^oz!6ss>ix!9vyaBL#5t%vU;RX;yX9?{^9a<@G8#2c1h)z-Hjb^Qvtd2>zw%! zdiVj)l}KjX**l#Pu>~tr6c2R4m5o6k+Zl%>K^0n`LBJ{ zKsZR(k)OSm$em!7!Inzr1C+VBOr-4Pl%J3u;6T+8-2N)^^?wZ9<_`UjY5K&-=iJA~ z1jP-VI0tjf)%L#2yRn65aoV?sV&R5Q{c`=887eU(Ze{PIopDY?xSRXNjp0UIBf2PX zyRQO$UPc7R9|X&$*+-%?16vY2zV0`R1GaPJ@opm0P<3&YYeZHCCia-3f5)^RNaiZB zP-GWlzk0WV(el`^A=^6cQ5~jGs7j|Iy z;u_;2)Ls5R2Sfa>{o8(6rhRmKzJ)xGFOkT$GZ>!ZuKq!K<9 zmSl{TcE3ReY2BqOKO@6LS;2iHMuczaghZL&#v6@2s@o0?a%=yB9QJ3lQaY>C?q{jLi`vlDqhla7EN^0Ym(PS89-YuhCF-4n! zL8PAPrgAWOVPw<3X8F!CjR}(m%oU_>)NB%}kyK`n^4;3*#!HDN&@D1ayWG`Vc^e|> zB=C#07 z8eI$fQ_PCkxZ8~-l1*WHEz*jTbc*eUj03iBi@cka}Oem1Yv?2^__p43FHA-GpyY zt*==Xd}GGd@fFdVB_dL=YB+!H*KYgn0pW$>VwgDo1?sec+UTR!b$Ux$Q_h2%)?XlV zV>*M93;DGgBsKmKxd7R~_=u(zc$d1dfwz^J#&UfTzgH}0%^rY)kMNL=Cd4%JPC`+u zD|9SP_NC`eR7yKe9$l!*;35eLERRdl*=e1$Yrd?tcSzc$yWiV%gsN{W(qsQ6xule~AEKi|;P{c>Bqr=&1yU&02~NKvehWsBcn z$f^CjBaIWq>&#NVjN$fIeL{hR4~O}ufcY$CodZMez~{Bxys*SRkG6TRg|6<)#5vFPi-wf=*-ht?OLYFaV4@Ume*O^ozB=?&Y{RPUoR8=e+4b$%-h z6XOcFxClpNR#T$jp6*=8x|qe@wE6F+pF`AE*s6*Lo*|_qb%hYSCW3kBiMW4Tm?c{g zrbhTe`)s82D%=g$10V;I%&|kWiXD>mF(7k6WW|Df5S9X@#LlJX$tPDx5KRxdaTl&CMDfeg2^WW--#k;e4aB_VU+fn=A`7>MJ%Crv{2(vP|j=}ezTs^j0bB` z`*#o1atrKlhTYN_3kyiFJJ)b+7ot8`)6ns75Gk~ta$b-F%t(?6d)ZM#JsbUqF6Mu~NEI4oY zQQ^HPl@)lobIGmULezXJ95v4Qf&uB)FhXAxb&c}Ud{duBf5~NS+Zvw*z6r_siw&w) zhZD}_+#J#V1*cvavnlF@arPr}C7rD|T%O6!i=|EJc5K?GD01mt!g;REsfm)F*HURe zC>B+Bizs?y(x3cao z=nRfv)zDfLFDVL04r&A2iP0B!O1uO3`LJ;i2zEf#G zU|e^f^)I69C{-Aos==5whi^dCRM$_!f+=6BAY=Cria~`LY?ND{H9H&&P~GUi`X?_M zN#njvI7q%4T+b7|P!j;K8D)p|D1+@fULQ@`g@JBzx#yklanF?PvVL3k4EC8qt;?px zLQfUGVivZR&~r_%m34U(S8g!mH09&W-`8;qP2MLziql94s`Ft<4VJ-4V1&A5&C5lD z5Wkym3i*gU=a^efmDzb|e#9`&+lmOXONX@?zeM&iAsR2tO0O2X$;+BBy5*H@*JhN-QF6%T{_3DdZ`oTTANs zw{o0+E2k(4GKOL-z=CSMYP4Mm0qw_IkpZqGCG!df{c?{FOT>o%=~Jdo2N4CxLovs= zi~R`U!Wa&Q4(JY`G=6_2G^M*ai2?h*z>t%*BR)LT2~e_?OP49M4Z~j|WOmb0MVQGiProA32{Pq{j1QPj3&Hwg%=!6RlpCK{}hL#F@ zeG>P{PVg8~PLj#kKFO|N&>gj_E0E^0enak!_2@3~#&rJ>*9n$MHZ=W4GwIhz_{cGy7O(d<%n-kib zPDcoHE`ejGj~kw9Yf5T+-4})<6T+YEct(30G53+)_TqeQ#OhZkn+)6;KmT&BEcbWN zi14Hsiui-SS@>5^&V!PCv)fz05Rx+jOW^(~2v%Qd&@DhM-n@E1{~ufwOpf#uRRx9s zVEC&OObT(z5IVpx1PYeqkDuqwxg(cIoMwU`&=fRxmb;RD#bjFQua9Ms&Y@sbxT&hp z1qK|K3fi(0q^|CwXmXY4Qj0#9uZ+a_Km0UBW00_D?(2ZR*+4;-7lsD4C6xZSq7T}y zRf;NU_Ea^5&J&aM)tt5nJCDnYpWtuRSV)EI<;o(YlRPbXM>1-qW;-jzyUJS#Ew?9W zY0zR*?cPzyp!|n7H(N*EH!VLuV)cVmmd0H&Lzkv4>62T7xqg}?>cQ`*SY zy&^zwjrEVRX(E^l0CS0tA4prW;L6^eQ9OjNUDyn{*UpE2&_-vGwuQ}PI)l1tejSE~ zCw=JX^WbTc_a_jxFS=`LMqt-Wod)EYmo50DpQEIZIf^yQA8)>HPZ<$^k+d24^^~iv z)j{)23%2Nq>(1*#U%5ML%~+c(;B(A`0CNUSw!wTy19QB&FzV3)QLVF1ZN&%wg#N6B z>cuO*WmS>F)|wP-zsLS0YCcj{jMVia+<3Wd9>R^@z{tKc{Bv zLeQLOOuOu+^6YNp_rx+B(U@Y(m(_W{YxyZn%( zt7{CVqDJ~E^$6&N`I-49{wjB#P(0sTqeT5yBTJV}Gm-o_aN8``t-|NXfZw}vK(3MM z$7zt{l~T{``ud>tW3`KKL4+{d^0EH+@vT>tG}jL2&i~?f#MP8<6YN!Jmp2cyE>B-M zbV7q973iormui`?XeSetG_N2NIq^&hHzY~UAi*e|p;ZJMZqq_?uhWK0rixY`5K1Gm z-*5$*st)fhXfWKe@CK4=-%kcxpl<>!3BxD;oq+es?E^xdD`|eAT~wLRg}q`Zdq~sT zB^X}<*&FVeYll#mk5H!w!h-1*bHscU8UHm>P7|rsh{!xP8HixA);6V#B6j6Eup?uL zs{M;4-{eINO(9!Yc4|HH7q98HoEnO(Q0ArQet+^6wc&|pu!CL;1x0l#YVXHeMn4C+m=(M+&w0*gOq`8OdPMN=P@_~i zJ_g4lCcBUfy7y(n7T!jOmh4b-X#8Dl3<*Cr`_XOuITTo3OY(`B7!BX)vpTluz)-3% z+WID9P)7Hj0Dg%$Im%gK_1479(b1n(jT?@&&@6v^JY0s0rDBPQDOgxipbJ3PEl^{J zq}7cbog>!nlRx83NK~ec({60}`z9CptYG zj>xgmc^FkjB#DB}ET1FYsX6N+y0@Ix7KLwr6(q8KT_g?0s~ zjfKCIEUJFP-t>{G(Gwh&S~nXYEZ}uS0HoKPm`VCMT625n&<%8|B-0IOtBOF1z`y2H zTJA%w#_u~{eG0wI zIAQB62*V6Vw$I}HjQv`tFSwbdnODN zh%J#q(=M^+cw4WxE5C1EmHSROzH%#V`~;MhZ#^qvoYTLdI6}epDV;b~yoDuVjH<0l zJvv7d2Hh$1!psc+Up}`7pi2J&MSu+bkuN{SRZ9^ODJTG#F%-xA^|5dFQ<ue2Y7X-P9tm!wX*e3d#n zrL;M5Z9TYA{KrU71X#Y%KW;@~f7&^lWZ!UNSnAfQf11V4HMM5?7w_e5e@KMI z`O&*ngqri;edS=w)QDTtTAP~*=n~_2k~tB%4i=~fU3@3JUCu&1-v(awO_i&ATba_1 zPuxGV6>aubF&~1W-yDj0pEXZvyEP8NxH%s4| zC4%P|2F;_37+M_5e+jraC(fKS(45eZqWMpM)B)QoJfLRKhLfbV?9<^ukDQZoO(&(P z7fh{V+#wqlP1<==ufdC)Fn|T1ZM)A{*i7~ww5UCySIG3rft5Gtb|iVM6Th+g>N zrkMA5&+FjZ1Gqc$f|xUrPC)HIgw&Mr%|5Fvx%{OSh6*_KIGVrRk}a*Pv6+aD*sqk@ zD4$;w2Ne-RK?D9ezLp&Gyf)Xd}x5nqos`E3(${9#9ifqDxeM|wmUM>r=I?QZ`^ z)r`F`cf#A_%no*+d3^b7$SR$$$1`GEjN_XvwA)Kno{aLv6`sMw?;5A2gO3lJ%_E7K zjeV76QLTh{qrFClNn;)dk_B~+U$>9jRZJ!54vs!$r zECnV_11A!OH-d}E7t*AXm5 zz$dPM;3P%ph&5AA5&dyUUl5qz{!~otK~+r5s;D7Ot;fOkrjWXGl(qL#HXOa@q_{3( zM|MtZu+y(EUkO_nQrs;5)(-iFH|(9+mqtz|Q0~m0k2kZ!!l@Piw&?P{)2niyGWt(H z?8W7AG_ISRzaSO*g7=E4eV~#q^T_*gR4nzZB|E70h8kb%>!T(w!i674#Aih{SA3%E zU*-i9k=^XTNAygULl-CVnB}_~n0mA1JWA-RH;C?}Tj;C)G4C*Z(@T39eqa7|nekHH zxm5FnCA)Q@Nw6Z;0A#KQG#Ei$>^1;k;K`zncfSign8{6#7?*?n(QTY9i(yAbacU;a zuk)7~k^y!m03J9x8c1)Pr%ngmD~*ILA&hJmypW29hXgq&v5S5aVZ8#LcPM#p_;RJEK38Xr z@!T_ZB6(3GCmB-vK^im%)zbW;sqz2{)(Ru}k~<1U3HZ?YS0#lC96Y!{nC%I`0#~8o z`SPi|%qoSSk@Dz;pt`R(B2T`MD>WdChDd}JUB0LYD5JNM(2Cj_ZwWUEH(bG01>yC7 z3)kCF6KUfNq%OF<3GQ2&#J9iw4Q*$L(myENcG9ob1 zlMhBmT6pU&h%NX60hjFy9cxFkPSk2Tz7^U5^5cu~f8R5#>i6ZSBiU$j^>6C%iX)ti za3(hiA>?csq?$*WN7n{v|Iq(>WK?b->(`WrCHG!`;99R9Y-U{OAX*!U#DvhBe=r^M ze8%Qcy7#j~;SqT>O=82EWEKx?8I!kqLY_|4Im0 z^!e!VYC4vW*8Tf>#=ZSELNQd>)RGxOm76kH-*)j$Jv~NdoU-%kL-=N=a7T#1jO~1v zD-N{qwJ)jFJY~v~&JuR0pbC_g&0h}tQpW2>wj#GZ3?UE0LmWin3z`1Jy0E{6oc$64 z)hhM-zEX~-lj@&YfoZr(y$|<6jO(cWM!_6zFcjdgft>Hqw?C+g{p?W@E>Bh;qY45# zE6#F|MmG2SY&D9*EQ*jg(hL&1X-_Mn_-bv{pkYhP#;y6;jMVbQyEC*Fe#++tn+&oP zrtW-oays8uC0GQ;5jq`;uJ8s|cL-knLkp_FU5}Zh6_tg!kTTi0tO&ir>ki#GAsfQd z6bdMubN@1%lPyOY-+<0g^W4h0PI_d~cK28tu6}Nbn`^zyIdYfzCXGwY1VDY;fqT|} zuH?>Z@%z05EXy*RJf0^QC8u7mH~6shmwx;y8mRh4rz3f{YoZVERUNuRIno%#E0%>9 zet0z4|KMfiHy+>q@|_GxPP3KpYBRjt{Ck13%XPS0K@sC<{Rw^}))OOOIeG}fBwUOs zwABbnQUyhZZ@E^*vs^IFPfnyZhu!7cwwU?r*i#(*N?@)|E-X4^SKs5!;fIbv6-mOo zKid}~M8*vBYIQ89+-B-h*Xmjky-(nKo;!XF2S@Qxd}rOOza-8Q(cotK2!oen$fOZ+ z;C`BpGa)w_Kc%sk__-0=e?gu>-2gHe_n5HBC=%-(ocn(~oq0Hv?H~598Dm#u35lWX zilkC0BT^`ll7vR#QQ1PaFf*boWecf1jHo9iSwoRQvb9VLl5J!y`&eha@AvBWzQ_A_ z9m&01_jftZ&uN<#ZK)g>Nn4KYdG?VcE}+-u$TIhX!^y0mL!WF7UMXpzIz@e)Q86H5aBDDJ3NqL z{%91uE;V*=;;-p1^{G0dYx_B3d)%k#Nrxz+N2E%Cum)--O8(X-mrk?k3>~B;5m$uG z6TJT>8sb)L>KS4yXT>HeZ6@di>TE4VlL=?A0BP_EkY2a&$KdAgoCQe?=p7@xCg6Je zd@&RZyUh<$##3Os&qYU+0jZdlNX~#EFxFxu|H@?<9ps}F02-Xg`wPVNn8Sdwco{6j zYc9i%GlO-4x8{kY)?}}heCvx}_HgOsZ_r$hAE90(u1SVp5-~e)7?HV)9D+<=j?n=d zOE z%1WaNd4MnRAnlsQiqdcLW+{npbgM%I@v$q9UVQp_>}O=MELYB)6CK3Oz|q-y)oW2RbJ6*TT&948+p|9hZEW!sXsS_~N{my&ysZI=np zi!Q?r6P1qeTI1MH;i!HW+hBw$fdOtSPTK^5lR2eiXtH&lGdgvEWQ=bn$zpf0VOepO zXCkVZj+d&SSCt>1^FE+~6ZuIkm&fLlO+xo00VH%O?0@_;((dzL9=rWj!mWrt9>!lV zrzwH7FD8{iO-5J>9r>uvhv6YhP9lHEiD3AfAG+<+b5e{ZBAUoid}C;N@O$4kjv9}& zzB5!{6j`wyE}jYVv@es{sLfQ7DmX|9wPDGHM8%Gu&svwT+uc`<|51Cj=_OA~7(PjB z2boT@awHSexO$N{r=B1ZR}R1_l}4YzI$=;LHC#^ngNju5Be!`*YM3j7Dev2Mz`{B4)i?~1sZiJv{15A(8eaC=wZ|5biNl0{Cf)?Kd^`cIkq5kyuo~}W zxAs%Lq8m9z5*`R2@~-W?{jz8stH-jKQ;sOY1Ry5j(@o|aV6K-Jov>@kguKaBfitF@{`e3&Hg%(pJyZr2o@h;@rI*T$*N@{p;e?1H zy*hTD8DI|@Ym5HcU}q~)j6*f?t}fb9g0Mo-DD~l~LCgqDh8%mQN;1n(1OB{sB*+2egC@^ zXC4t^rADcmu1H`%8pASfs69BHD$n2j(;I&BHbe1=RAU^0Abc3O`|(3bA|}EhCF{^~ zJTxR19(a&Mc6g#JEnyWW-023c+!3N{^sd7kpHh0IZ~gy!pdeHK7qh=Gl<4QxAHNtV zjGfPNv|>Hj+7#bayx6%F8bR6#I})j#1Sto?@&><6X=w4{c>&7p(bH@@DeMaz#umw% zL4Rz@;3&qjOl+3dc63mgnGlJTwcs?xijn0jdig^F#`e|X!;lGXc922*1Azpk`B?A; z()=#vbnz8?US=?Vm|F&Z-9LuRkKN?#v zuiX~}HM1_D5xUtuffSw3EkQ-VX%Tm`nL0ojgX+;c0v#{0bEhwBZGZ$aW&2>EqZqSJ zzI|K1Y5%Pmy_7j@qe6u1o;hd$g)9afCcK&^7WJ(~`LrQD2y=|El^gt^Ac0)qnP**| z9b!H-KYkgKNk2LzeF>W_M7L@0%_K{6Un*xwUPWb!Kx1Mt%k^F}ai0u0{`>sE4?*BP z2jN^iE%;7BY~js^ZSEbVTxG8lYTTrgQ*>!3H0yD!CO_s%u%HGC6&Wg*!fyUHc*5Il z#ipr_h6#h=b3{c@%j(~!(qL!uInBc|gJX2ffqZMrkWrt3z@1=j;7CBx&CUF^`xhwG z{_Z-g)f?)E&#sQ9>lDFRXM-MVgC65&(VGiroP3q_yR#~)&ob7@_-V|i<|hWdF!&+c z-(UXq^?cc@SBQ1`biDo8!AXUQ6N^#()l;SRBhdz_Vwf*4JK2>N{;a+FW~!325d07I zb;HY91`ez(`Hy$fm|y9B-%`BinjA#j3!waHCV1hnzn< zaz6fp(+C7=1k6idUVg<=9VGm^$E5K2i?c2wW^Ku%m)c}y*$gc3 znV&xGA%C`oDm3xnqvPZ6<%?>d(a@P~`$9&h`tLLg>oa}s%EG|D;dd0h` zdEVzS44b+QOBgUAJen3q`nn}bEr^S2sb^g4Fy>-gT%Die5HmW?jOzPgwr0D<+s zkf$0N8KL4XT3XhqWV0&wob2>cb4;kTBJcv~9RXKFoHxte2?i4cUU88>oihCTKJXet zJYh+@d=);L`^yOeiECn;v1T{axKRg0JDri3(o=Vy?d3)xg}>vz$91)ImCwS;XSC@l z&5V9H&HBNtU}W4)L{@>;@muVzr=-~nnX1co`M6sv1FV*wZ&b37&#O?sZTFf?8tak4 z{>`mV$w{wzHz}HC50YMP6?|ngg>ig?Unh>LRPHcK@I_L;T?I6*p4104&idW&}#rZXBlMxAc3L0dY={L+FgoiJSnnpjOOKc)wod| zfYR$Qh&WiucIMEANcrpSZ~Y`^kGXhn#F{P6R@%_8Gyvy6Rbk*7d}0;ttcFjGq}ubn z+}`(m>!4YO6~skJLF*+U*g2rR!8?YBKG`@MFVN)8)bfmM3TS=$ftD5!f7tXrO&r+d z=!6UiW)7Fah0UEN3}qwNXeNnoZ@jhdhw88nTrJ!r-+Gt|i5%apu46-EHXk$59Ke(bg2A<6A2|=}&P{7CdkINf{)GjN-qO+CJZ{o( z>ogQ*A8Fq{=D5KlZ(K9qyXpE4gBa#axRPxd6_jewlPgP}z?x^isejBd41Zhwx)?nt zA(XYA$9?*GrY`4OtF>Cm#WzVS&zkw$o-fcZ9fCMY?&%6d;^9L7zpL!`)d8$?T@jz> zSIF_SijTU#ylZFewpIpT;O6qkZ}=^E98HWc@BQGIX@Jx5WxF`wS9d^cVeSKCXJXsm zPs@p0Km?|jt8usg-MK}pe%{7NNn3##k!GI);GER`$yP{AL*Vx=h=Zz}^U6ERI9H!$u_<~bP8z>!) zKD(IO9)WW})|JY8=rHXHQZqRk$j?dqRx>y#A4e52X2yHe{~cE;%b)KaJaz|43Pdi? zVkv3$NA6JzW&T8#hYXCN9T>B^Q9xB9sdPmMM0{*WrRR$S{Wy@Tow4Is`pc_zzAhg^ zSs7@A3k@$^M3!ll0xv!{O>aA}RitP{)bNE_qpj?cJ|I4|{cJP zm3MjrZerkZ9aI^#jqt3-ppi=iEJm)(1FyYjmbaf4U1nzNx4XMC5H?NYuj^%UufN#d zAj#0|tJf*8v6Aob{z-hO%hS_#rrkyt*z&U(%*C|m1ak3Gv`cI$e)2`$67K{m$KJ?(V(`02%)KqnL0L3xF56J2XZ$45Z$I(S-1f z6dh7)T%^|4XIPoobR|29Vywna4WF7gsmTRXKMt;U-}Q(gj%kFo`EWnEidig|0h7x} zn+x0wMH%Zbz?!$=r`EV)|ErhPmt`N|&t5XYfv{Vk2OWnw(NYL>e_e8ULTD;M9p5Nf z4$t2uH+mT4$05>+K>L}n;`**Vt_@!WfuBp_!B;ue)~YC6lYqF7PEEu|No;*D|05lQ zv{5NXgiKj1q2A*Ps{ZxF=Nq3StD63UTyswfw->DV)>qL^%+DYl`S@B1Xjjaxmy`>+ z<9Kp*uJPuNluv?r0+j7hy`Aj(ujQIUnq|9(#u%-oHwYGqOx3T6SHw>%>AUM*`8``NvFgro}>>)%(1MN`9HFlGIN40p5;kughT}pKxrw!9UuK-Gg?$;El6-YrW zBE=`LbJ}C2*ie0TnFx!rS8xrJhI(q@SUr-*E0{~sM#mey07$wYW;S3koVrlm)An9* z=XzfyuU93+S;@;`fs(Z|5`Lx&`BH#?etC-E{>R&*wjN}V9m)#7Ic2ON0Q%uFtNmiubHTIvCL6pQ7T2Ws5PiCWDZiECYdra|=;_&e z4Yut9FY7XFulRksmJ$&Beo%Pt#DO(Z)JhaC0`cWP9V1J5xQ|rbo)S3Suh)CFx;oS+ zYHg6RH@<d0@})BVr@@r3AA+LQ zrw*#G=(QW}fzqm>Qf1-Kk2w0FaH4g1?P>A>VWXnic;c=^4T8Sc(L=p^q!$UpJ=Qj!eI#F=YpNmk;1a4Zur8mfo2f zw7Yd1?(8~n?k~vXmlO914+fqoZX^p`B;wA;?9u;h*?toK4)Ql@Dh=H#PCE5n=Vo*v zu{^Ca*+JyE8Z@3tUdW{>jC21E?z;ZbMW-H+HD+%~fR_%F1Bb-;iaS~fd#q8PjA`4( zHjv*=76Qu`8zjHh`~`Zqgmy;jG1U5X*}_jDmQ?QRy;(EA$ip99E-(qZHT#5~lrlOA zR&TeAMdsUZDz%qPw?LP_+EcaHwr3uk`H$mNL@W$=SMc^$+DBOWxG8eZV;1pkBa@!u zmeu=y@4XaB-7BfE_H2k$x`Lmsp8=fY3>APJ)VpWfZ~i zQxx{x|BQYz2Rf+rI%uRVtFW!O&8mx1a^O7BMXcN3-Vgvh71Z0YRlsU@&#kmAv6Omo zvsc27%X-i43OmUcLmXH2hCYu`*>gnSyPviovT&N^wj1LGS!HXrif9>ZRyJ>uw`CaU)73j$5<0KuQ@uWcA)FMnHuiFqKej{R&MGs=Uhf%U_L< zH@o?mR>9G3loEn7PCc}DO@1YvM_q>zVtU(%G^XNeYvcEtI6jYsBk-aIfdh>7D!^>j z5xDnDaewyi#+l)D5K%#(i|dV)HM1cUwxFs299^WEy;MUP&80HE`^%G=8*sxXG2N50 zYAnCVTis57?CKlZ39(19ssp)IgooB(M+TW)jmj>iEf*J1qw5SiStY(3bXL3-1SpRs zLG|i+Cjnp;arc7RH%J8IiB)ag;WU^HQDScs>OVyFRC>z5AMe9x9o^%)(G{}(si=Y1 zcCZ&VFL5R|eN88$n>}(HsU3_K2kS*U=_#An_vVycs{_7mKgpkK`JtrN=!dYDRXqw- zsIfuKZKuCU3b8d}-nMLQJ2#%U&xdGPl?A6_mA6T09tAHm*jtV$7d@?Zqn_-e#(o-K zY7OkY{;-}X#81wg^FF0f?-C!qC-96P{!XdRWdHDdeFi!HM~#R$%O@5zehxG_@^661 zuG=fRniK0BiN98xAhZm@W*UAd#{{3b`-6H`bB;*J!>Y% zHo3rDTPbw4A}{8y%l1ce`BF>qr^X2r&qgFklQgNjwiiv?xuUfJN`;?8Voppr9ilb1 z!huVp07dp%X8C}?y}xgGcnnd7=jfYv@|ylQzL$e=AwjXNPIWMhDSS^%Xe4lea|jO=uvaD zoeAO2sWq_&Ml<>kCTyCx60gZ za-@{nI{1QY$rz|ayrb5rE@6)W+HIE`Y(_Xk*z(e{G5U^lnk-P**C2-7G4YgU^>=Tp zh+9}K>?mhOqOl9v(FUg$@kNuUh6dzAH*(%oW$XR70zV*qnK&2@M*ko#DK zC)aRll^=-x7|-9rlamBjg()471SD$Bv2bTfj&-9nSqL&c_`8L#K9K!qLf5RzF~Td2 zE6}2_1XKf>B+v44gH~u;&4C!`8pRD4GAcRheJQ=y7xsyRhmHLM`pj3h>9aP|)M!hk zqutB{P4H+;q75TpSnl^6Pz~gXdTzw}j=0{e%bqGvel9#P!K@l>bgcyLH}0W{1E!hY zDf~;}B{FY{5x8!uzdn>$f8lPJ)eo)KOAg3&3F+v2Cz7aEHsSH-=(YtR)Qql>T|p|? z+1a|DMdAl^AmOhLy-=z#>Q(2m zi~87gUACA8Pflj#@?WQ4N5p=%o$n_+@^Ny0VJT7<=kCx~+)h+$j$=e>ph_P)s9MqBdf$ zjq5Bnu3CyLtPd07-RgdDDWKwWwADZ8i6+vwr9EF}*AJi!d0vW>r835nMJ3bQ+;Yb*cU-?FSyA z73(f&MFe1p8@{>yX_Zks|+%G=!lVqEDT z3G_|*8H^_VDaF1x&zFRkR|>l;(EFJtR7Py$%G66Hvg95ve-B1qGd{^rf7o}56QQ(- zl;GpW<~J-7;=l%=fRFm{m;>DiFeXRKb~VO2(&_U~$rpFvP?1Jc8a76jmn09ue>Om5 zf8XfR7Dw0xu#L*{3c>L28m?Y!uaZ+A&u>5!95QGgYH?Hj;9T{rKKb2>oK@t8Fd24^ zl*PZ6Ia~M2TBZCY=eW)u6_GkbnV0`by)auxmHy~4-D4<(dClm)P=BIIZF<|B>r<&k zxBjZY(=L{O4EkrFl%^c2HWFCH%$NaB;sSsEJ$+8fEZPg~5XH>FoQ{=O<#7qLjj@kk?zCdcT+s2)Twz77 zD|-pOJ@Z?xY(Mc}>q(Ct&*^HycS(t|kNB02VGoo0uruIz*vRPbBx z4jZ$+PmaZLG+D=oVc{?ugwy7F<*=Lnx53WD|U+SXYI%S@SfhKdVFZ(LNhM8wioHIdyg_jKJprx!6l5|I;k1Rp@P zmRUQx3&+Y!+~d)cOKWBC$`Qgl+oZX{xtOa3wDi4tdS3s1w$hlVH?L+^iraAD`Gp$U#Z2xWx%HHUHwO|N# zo!jKa^W2|uDN;z|dsw*?sO{2o{>O&8^&Bm2Nq5?0d6AZElthq;u7lcqsm24ZlGw){ zJ&tI0kpN$AO)B*$x3QS?Xym3H?MhG{23U;bX}>07qWQ1UOjJ(|6hRS%lvxLXH4EKp zCk(zvel(}_{FlJb{5CW`_?Y@j3alJ}OWB~!qb{1OaAlxs4t(I^p+gk~<6TFfRy^B* zc61#^m19zGAtKcl5{b*l0o&f&!}vg1xcTNCcjcqQCN3hXH;I9=*we3}H>Bp2$E!7g zUML)OXNNr^x<5;mUOM=D3RP352fe`dT_H-t26>)m$egqH6Vd3(j#)M;NKP9&@*`z9 z=;m!g2V3+OXlxCBgm0lHB5nY*{=a*2@+O<|9d0N|LRkE1W?L3lk}z2PG(X@$@Yx#W zNnvUfax;}o;#!+(pf(ew!*sqA+wSbLqhk8sR$$vL;DE@$nRGf;Re)0D^LT9jWFPzs ztQ5)~{HOj;$$`g_uNxQfPR#)Yw4?2)6n4xFENfGUOwU-gJKPikjIA!2qsZ-#pTmg~khm4();9(`fbu*bdw9 zP7v{RnS&Nd(L4R#Iq1c$M!yq0V88ONe52~LPEU#`*M_#4YycKqR@7#8HGGKN?qS8! z8&oj6&GOl4^{OD_mwbL_L~PF(L%5-4wr-7cBHxE08saaS8YxW`o|I}P<5rjvB`?HQ zGszi}g0eWJ+mBQZ($gYbb}fKo4G z%cE7fm7^>@D*0ETLHuvJ8DrRB{vh^iWNE8Ae!Z5Ii`d{JZx(@It5p-Jock`bVmIwgijGb7?(^_LgSwh>Uayea!h8X^q_l(54+WE>z~cmrh zg*YG?Qru2&wbcs!KLV6>37kZrdU?_G0`yJ|sZf=2csZvlA3sctop1T9ha`U)#pm=oiPFmj zc8B>8*Gj*mgT0|HIij^AR$r(#a(vN>(hDKyTJ$uBtLv9|66d_bz7dE?#F+0yMm44|- zWV*m~-)+FXe*1)IxW9^z0cdo*vXPa^dsEs%z3eeFaF@yoo|kOk(0L^3#aZ{r$thHK zC+NkbDoJ3>3{V3&_~@Y{c?9=}fbm_LKk&?VWPhyR#q*YANgdXay1RB2rJjRrC&!I0 z`8)s94%}~^e9YKlJC``P2l_zNe+h7B1BZNmdY$EXpN@z=R%RBdSen)Iadwk-YT%~l z>AU@_WE^`soPuDsbms zk(f||yg^u{G~5`2XR?ISWNZNXbrQ*l+_tujtqacHL*t(0wUA2vrcc3QJ5+kn(P02W zn6E^}t@zOqiz4UdtQmUIw+1E95;eGaSAg<|w!%Q^<f&duWERRVW8N0XXu2bS!EyOu$$ET#ly{%QBRdL3k2v z(gyJh_3b>l%mw4Kz6y7He`spF$$GZ3$+qgj3^h88Be49((voJV*pAcoQ=yO< ztUM)_3oV+_KcL3Ta#{x@vSF!;m$|INNPK?u=YG>LA<#gBORG)AiRilE@46EPqQ@37 z$1vbSIHozziD$ANOGzdDBa1#hc%(7->-9GtWuyFs4@f12$QqLmz>@7mC{*65MXL7K zHV$cC2LcZE zb0p0c+9~}HL{UB1LIi=d+V6a0RlcxYqL-;~58a9N< zA0x>@!=^TSElg%tdIR=03#$lbZUVQrX{?sEsy)v?8#;$o^T%C~r=BA2qtWx!B%oR& zx9`^TV->bu4p4+_^~Y&>gg?b{Tc@+4&d!n$5eg*Y7O6#?%+P;7;Q5j+4{pDa;tUYB z^c&@t>6*JU)UUifl0jzK~>%b z{uw-`QNDroK^+xVqv)v_lEjx7|7;~I0;a6QQD!aY%@7dlQsB435Zfl3vEh!)wQcfsNxtFw=?8E3oH_FzZ}nBa zz1qB!DE2}t<&WlwI=^Gh@8wgdyqcv`7>^2+UJ8uTj=UhzV=9IqIh-YiuY9+ zPRa|Xkd)jSS+eA>h57GD4h9(`S6p8Sgo;g4qFEM z#9@8PucsJ!3qYR3FH+MM^v*7>O)Y8xN0EFO5iP>DyCQN`9W8Mc1ZP6E(G5~p0k~Bj zbYNN_v2=vKtwF}Uc8abIg}OYg&DeHT%Hg~Y;NF+r_fMqGyqW0!axHWiI+)$-#8q+p zUl`E3`y3v^7!4OYqqJtKQ{U{#gH`qYmeF8iP!tU~YGB7RI>;Bt9$}VRMUZjf2q}$c zV(&n{M__4b@*|8JiDX1g#l^mWlq416thHAR)Vt~E-7Q_9E_;=59uPot$t6Fl&qVBI3zg!MQOyxYo zTL-EH?N2NI80dL2hA%2#`^|ljaYl!1eKtk@5(cPt{G&RK+@U2_2g5NVbXT z&1DcuHXpKx|3r;4>rd$>bGqq_U+Y1=)R*ywTc9Nyp8wU14zxqcz0^Mq3QIC)^j;2e z=pzsd2eahD-CT1gIe*XMkkADR0t>i5Sxn(VSwRW+s7C9%vUm*?)|}tTx)cQ z#&LQ;e&V9wo822;CF3j4rlu`$^CL8#)7Q!SYK*L(DzIHllNtuJ5b8ur*c_TNLz970 zw2#$XNQFBsTrsEOKgxc+LK|ec_>(7DDeQU7Wbu6ep^FD8*EeTBH)(Er%0I!wbl&Y< zt1eeL$Iz-KE&QPh=)K#%l6$E%ZRh9Zkk{4Q>N?2P9Z*qArEyYIB5I|VvbVI5vY<8j zJ>%wqaeQ2n@pGOQj87jFq(uLe{5WBTR}nVA@Yr+)6a;pY>m?Sv8!kJbv(Z=I)0jRo zq-YNV1-MCJ@1=-=%-?!&{qJs0E@e4M;a;?peG0L_as!NEzz9m9rKu^V_71xw~lVIjSyGb&6-)ew$_dPxOlv%e8H$d#bfYK3;{(A+Q#? zYoD;kxa}>4%wVEawEg*;*Be`=d_h_?UIWdl-edR@Z&a$WaDDseq)xESX_^wXuaEF5 zxUwT!BwWBt=mYD^e~o@?_R)G9aIA<^BX;?=8E33*c#fUn`EUkjN428w5r$ z2zWqIjVS^YGIu{}^S;P^HNOk&uy?vi+ZnwX`0QgVm~o#GbUoN>dsu8*>`_o*E8z8H zT}^aLB)G5HZTW?oOu#lmkThc2zr?rX>E#|KWa$2m{KzR@JbdRX7L0CKlyqes6LG)6 zD{wzguDW1y1P56CjfTeQ4N1uaNNk!uWtr!xa_t*&*tB=P1^U1r5%LAWYyHfOq63-t zE5CUrl&|gtWp*1ci;C_#_Ud0P`_XF`d7e|}g8AnONvw#@sJbF#nB0#AF4^&*cV4~T z#$@<9rUo?{zy`Rx;_(d3XN)N`cWkx#b4m2_lh+F}lpK}-C*TKuloo^bA-A9p?-F(7 zoHd4Kqe!<@n#YvUDtYjAk7VVs1Jj$ zl&t{NFItV^)DcqjCPWp%b($lLQJ`ANvf%yc;lRlk1q(##XT-aD4;7S3kQ!)`EKFc4AWi4fR&* zQJ*w8)F3c?91Pd+MyDET7a1*#$F(xQv!Mp%&bLyx*^S}3Q%WPLvvcGd^25d6S-u$< z%6uVDkU84Q{5dI!KH(>~G6Z40vT_aEAkyl`?aezBy~k=q=`<};-pu}H_>qj2=JPI& zPQS|kbv>1|R@iv|fd7oK;>8yY;+P6Qk?;DKJj(1p?8ELm@}*^_!(E>!S@JVgz{h?k zX`|t!{-}cfM74?}Ftg&=Ha@Uzm9&nLht4oFQuewiVtsOOD;eLvy2?mm1voB-1&&jx zs9j)*C*SenzgwnAD*bDn3ycS^m`l#B7f%EC@!vIWfi{?gIeLs`Y2N2Gc=_VCHyl(&2uPu+ckGTYI3qq_pa8vIFC}sqHjI) zxUbc>r-^vT`g+Cp)>xb`6=o{SW9Hrps9OJ=6WI{|?@~3?EpO|=FOBatwd?WwHnge( z8fSUAEUijt^S!*N|7gEFEF!Kb)gR06K(`8jO?Dl;otlm;-$k?!I^smZ;y%>9?k&Ne zId4umnn-BfC%`Eyq8BYe@%2J6qv-`BwWJ=gTM)D1IWbWtX=hXe+%l7YtPXO*_@&n| zL`qwO+c@-pRgs{t`RC`NX6oar7dx!>Kk75lw5VG-WSn=-1E$EAF^kho&cFpkZ*@@n zH+}Upw*O7{#%(VAGB(pO76t3kv^b*0$B_2D>uQ@I!!M_C)OC2Eiz%wH*0Tx? z=~oKJa=H5r^(R`qe>}Z78y{F;(DTdZXAA8DdF!YfkQY>`Kz6XTtdLS+K!UJgUi8@L zJ}H(O5J_AE!`Z&v-};n+YSOTb>q?tAO7f~(WMIKPcu5zu8w(-M~CLu%z0aJdoz)w4mg0?QI3L(uyu|WQ7z?6-sY>W zea5FonGC}V5L6(uBxkiM{DO2}z-s`1n0sQu$-d(JwAFGBj~YXQZQGT3mCR))*Kebz z?lzOM6yB9~#g~0|1(A z%JOoutmfCX3)4QScm-w;|Hwer7g5&w5Z>G#GNUvfE(<&NG#J&1=O^CI&sY?=g{Xfr ztJW!6(HQ#g&dPM-ZO`^R0vcI`xD@V*lk><}}_`vLu?H}-dvQZrH3gM$MNl7UXJE{3T7jcl2? z;V>-mNi^K8{+XOTkHlUEJJO?E$7`y8lBeZor`#~x=9Fb|yco(fI~RN~z(}ysJikf5 zRn>rE62x&BWkZ~FvFK1H*F5z!gFYvmuO8+e$V}IrQQ1NhNlOy z`a#=5b;5ARzMCaoT)4#cHt#*3XIt?30$;x*VzZAdf@{vB#)vXhIYzGGCH%Q=l=pez zGFhDE@_}}HwMKX$EQ$65zCrWrM_+g81}RH9{a0NaQg8PdXD901Dvp_EWKd)G;;#(t zKhi{dnmOw)A>jA8UB+}h-J>XU-5tfu2FPhL7kxnwPpG9eLY0ds&_&u|#e7EsiWDfN zcbci;EPrr z=Q_=KHSV@0*P%}vs70kWs3RoB4A$ei0vfnY-q}tFPX-`3FB1*r(tgpo^43Fw4z|ZN zhKAp4y}~%L8s`2pEF3?o-qRy!`h+A{CHZi#%WLW7>_&BNnkKvY#CmX!oqV!Sw2N6= zPV0YaVNLMx3$M?r1DVhUz*n;{s`!Mt61{$^yOzSKOLJ@V(pN7{A8&p6;;Fhc{VsVp zsI!8%X&~+j-e)>Y`YJ=NwfqRv&We{I>n#6OP?c6ftL4lyT#$ofjC07__YEH8V%Vh6 zvM>Mlao$U_be;c)ag#Jaw{~uoy1@vR>|^+uiHQ>t9+8NvaeFpfUm0i6z`0YMm*^4D4VW{@l-3~YEA zr(kAB!H~V*nW9mgq&PU;ro-9e=kBeYYNxp1O!%l|+I2l~?=Cy+d3Nr~cnJWYNc zj*QG>v>YrQsHwi8;FF0c{j8P*s!LUahA*Eennk;f`k=Fj>_;400HZyw2ABKZ_qb3hZm(5dM z)&d;RqlckfbZU56Kl>#Ci)UPe*@^&;y)_=>qSW#D~*uHouPiH&MSn))Gyh)AkGH z%Dn4a-zvBpSlw#4b*0c#Sz9#VvAR&*V(OkNcQPQA;q3j4w{NoDWjfZuUoTa_@MgYn z{cIYvHKIv(11N^dcQ#C3O+yz0-lG#0bJes@r!@9ITarFcOPnr=p0g|ZR)_Q4S7x{v z6)?HyN7Hf6&Y*(@xtS5>tC#`(4_N=4>4aC37z)*=xU$-zB|E%~XZI2jSc*_%9j#|W z#SUMr4g*LuD&&%ggAjf0-@()IRT`8N**&HzVkyE0P|0(kF%{F|hbn?D>O#)No%CiJ zyyhZ^O4^z(-{_ykRQ{?9vW=f5f?23AZKqxThbAsSktSDtl3&Y0jNY`t6qey^0ZPkZ zw|n>tOErFXnnon85CT_NbJ%8v4iagq{Ej4Ey@x^uJUZVojCiD zWCb5<1T#j`MWy(p?WW{=CQl>@()LeOwvZ<}NewM_Vx~J@=c&CXMEnB7!Z2$6E_$M3 z{*l-kuJkEU(Y~E|C=1?4A19=c@z#KolfH!{Co^>GIU|;9({jCd!5|(;1vj@cJe9ku zBjIMN?|#?4@%VvtG~1gYt;*wZw0yzlIk{QpKaFwAo)9Gfz<$%H_pw z)>`#K#b<0xf6)8t4H7`3M((QeJ#tt2X}#xhbqQ_vPo#KH(rHdn@vCcx;KHZ30UdPj zH!X=a_MctJv^LqXiV;>KBua|WVY7t#b_v( ze6j78M^iPb#9OM`<!m~Du$7>3`V`Mj z2-2DeJD8ytX&Fn7FINQyYQ)GeluY!sG*7IC5Gx`aI*uQYljcmei3(rIR9K$(Cg%$yzBzmKbYf8^$*4 zegEE_&-eES^w8tJ=YB8O>$;xT<*}SzBN1Q;OHS!&?F}ovAvk|^x0Nox z5APb!@ZG{XX>xw)CcLB4QsoD9F1YhDU=xibIQB|<%HO>C@=ieG9TOp@vb+U&pPDMy zX7V4t40pfe4ez3w-(vsz+8}OMK9U|hc~Js;NiAjm+m51_-%UIzoA8_aqx_Pu2!{mM z=kVxQQb@?r$(Cg5>p6x*fLp82`mIO`yH19;nYYH0#Xj0^$9*PaO}ziR6KsT+uv$R) zECi>g=7QB5!GmSIHoQwh->VL~9;;=Dx=njLw6%CYVb5HHy)R*0DAh(!ZEeKm<2<=MD=)%B3-X`X7w ze<|ZD3EpO}4$1=P$8O!NP*}c$1HDn7_9S)0t^-AeDUnD6pdV2F+JBrnf37}-Q3wYT z!&`*`%3DfRkLWq;#g@K3lw>g%K2X93U)Y^`OQ+??p{kQ>8+X9~sIp9Yp4$$L@C~ zr3?YmMl75bC}SZXe=lrNf#W+#{Z)gsWn=dq`D_k-Mu?c&*G-(AWbixTiaSkD26;(9 zpXIv=;ho^C^@Uy?*#R;b?i$mt>NYp43Hn%7tr3MwCkpzgc$Y zCP8%JY3M>1WlR4PcCB6}uWeTaqm`q4qIR$l`Tkk?0$Rm^W*N(eP{Nq6jL)De2JA-y z^BA(bTeOQPnaH?n6)#7t_)8li*m~yqr^DlKPT0IQs7vGtXio*&+Id76XZD(Twq)+! z1!xMyN0dKf((U6TU*=+`0(ervTUB}wcxIs>|HYOy^ml{wK87JM~qg_Mdeh&r?#xw(z2hhb1Lz2Z0Y7AAgFGmY1mMW~k$0Q1AWRR{y>|7k z>VT5EnC*yBS0|+4DPr}ks2^YP#sU$?R_RcNGn)vj`2K`!U|{+U@0!!R%~SFQ;8I(+ zg`zdoQTFp!a7gMndcZ=iWbhs++KaD(e@R)VIrYFzzPS6ckf@^S4u)(GwZ7NrER_*z z=;Z~gfcTR395am^&BrO7Ham&;x72s;6XSS(zH2NWYeY$ov;n@81MjnmBbv0x8@7p{ z=gfNM=9^6ed#<=#f4d2lS~<^M^%VN4ZymqE^q1J%MaR~tkxIx-yc=TjvSm`dXSdLm zl=X2N5c|3EgUf9#VrN!rzgskO*8|pClAnnf<x0@VlIBY3O{P5pFG89I{G=W-izdyiZVtb%Aqi{&e=jM~ z4*zMTJd+BbE6;ISS)ZRGgC+(HCJhRz$;_(Aj$1Y-&)!Kc0(m&mIvQhaw1 zEF{YSyg;-Tqs+qdrO8eZ)I}b}-$S7>EBaYcGSN+lzf*!48uAa%z!Vp44IpzjY&|w; zF|_*U4MQAMNxH?q!&FJ`myF)<`182%qwL95Z}dm*a_X_15pBZtOmuIeC1v<&@i>w! z!?PDBRvG>B8urTxOe2U`2bK+{@D#Q;3kmu&p|^WME! zVcX9XrSn2Ki6!L-qT(BaHxXZUw|m%-9$FgROHdlm#cV6rI~=bxe`Dnmxxh^5&bm?p zj`ntmTgG=>+z-AJZ=YViui0ht-mK+cCuw= z$74ul{BJ`WDuf-<-psXQ;?Pb@68O`(=!JnE2J2Z5b~}Y41Zt^RUu(Qee^EPrDsfN{ z@qid8X^pAq3&dT5K}_lPXabjLjve;k$A0Y$M9z!m!M<4l6`5yPl20KP*EsZU<>R58 zy7p9OX=S9BNy83>Q;SFQ zyk#SJqK-`;ERhNS>x*#Vo%0z(*t(lMfsEPgGsh&_SBEPN(a53xHJDg!xKqYb zdC;&-L5|?sx2N7g+ftp7t8?(AWGb9$`mF6u+k#`6mHce}-CYJotY}lkPLl!3MAB~E z(8-fM&UO$R#QsZ*?gTYEL{HGt>vu+g!R4j>59P;fis>R#wGl7HJ!h^icpRyf4+CkF zsT24gUH*J!OBsQm>%Qc39zJ;R)>1%jN;&t7PJsEZ5eyCcAW9UFa>wMb)wC0X8eHS; zP#;4Ut8P%&`O=j|zz{T)`l>iP{NGO3fdMX?hzjt#lm<$gND5j+Zfhu41WM~+oOAdR zQJ%9^uv!;HTZ#^2NYRpcd~sS^A+oM}!?E0S!u2G+2cdHu<>vScNMVmHdkB!~`1DYA zRVj3Bw;Kv3?=nq`kmLFYRHA7>g8_UWQWC%8DjkZvYP;#JH8Oyeg>G6nl#F`AGza*O zRD3$SVVurds6yoBgSE$vZ}QL{I1;si&1wn=-D#njZ~E*F!wNg}F2wrR;r>AUV9%yZ#N4usc`YekXUii*UK*}a6UrEJoVZ|$pjt26=d2>)n_r*6&4b-T`J>5m#^ zqHgzqfSob(>{P zI#F>xt-hlKf-G8L+s!&mwRDwN-sh2hG3OPREX(Lyjs+5;nqfFbACdXnotVB2t@K!aV!5lR7Boy`&-#n_uin)nD#65J&P*fdZWg}8VulLXBtumk;n_sErhCe zh5GgJ_UiB^9#!*}s;!Z$|9zs+Z}I|AV4h=(HOpYz+Acv`H^dKq>4snf`u!|I&(VgREY7-WbKs^1i>xtd~p#VHMmOABJ2W|1M}O!*I(;zF;h*D&A?@+ z#q(CQ53yfRG4oi1+xHG}o+|Zeals{W_4hI3sdj1K#i%}Mc4%I(0b>HcFve}M=16RN zuhT6j_bYaxG;_f?Vjf}+h8i;Bl!v8}KAkY9aStn;m3*VX5&F&9!#`xOF^RW=U9{JB zMi|bDnEQNggO`z#FCA}{W6XsG_iC$6*2OC>sx7R&e?n4Qa^gj4shxkq2$BT$qQh4k zuPzJ770b%|-4EHox_;+t<1N)6?X?%Tm|jpOrewrlx}z59?b3n)4$J_z$`q^5J8(^I z%MNEdE6oo*uMje=+|+Nj+oOH;M1CBF+{|!K;Y42+n^_A{=};9(g(E*ji(4nqiz_(Mi+F!XD2)4ywr_9( zWkCEw?)tFz<2-?rpU~q!*FmevLKdnCpa(DvUIaD!Yr*Y-e)$AM`er+XEYx@f+32X{N>>JI-_Z^Vr9To z6%kIJul;0(L0X(_Q?a0MspfCcTPxwK4K(`x5zsf@^V>Q2cHK9)Gnq;ymu`IZNmh~b z>$u9rVkoGauyySkBvTIuS*y=Py))z=`&AR_;nQ|8YO1-Eof${nee49A+fNmM_N_VN zdm%l)snT^*(&;Sg65H5^uf@XHno2KjN3^=zNxv)hb5}=1K?iCL^Msag;vaa~8zmSezPccm(`J}92FJs_6pv6zX9XSE=^6{;vDs_)Z6Z9QzaPNzb zl|Em!9&6Z+FJMxj+m=-ht6f*i-->)|Lob1}gwAwa*WFscI|R%RxqNt>vKkxlUJZDj zG5onoe{b}2VDr8@VNj7P$A(3{Z`m9O&xUu+O@ff&y%pH@DaJAU!57lL9~v6^PrXbx zqaYqhYe{B~1ah&A8!-vHjjo+QmsZ)v`I!=X#BP_B`#F{pu6?Ii%YDut_l7jue^L$pg;;gEXe=V~F z_`33xy+v+-N}~^4ti@w~eemhfGT1+?tB)3Z^V{VOLx*ltolo;|i7aOUlF`kbexe}E z#4>N3K2i%BHm3WGs|N%Mz{`2II4Dj8W|uv9;rLbql<*;Ue~#AACaAqV!o?vN@A+&a z(IO1($Lm8-(cvgRuCkg*Z+u*`-08v>6b1ikf?H?;Par}B=D)Q;kfvoaY7Z8yCI3vw zZR@pWW;6EZTJb~q-5anhXVIfI&Sjn6x$n9dFUIs~lrXGsWdi zVN&gZ5x$gpNz=|vHA9&kohPMK2m7KtG5(gR%~Q?p=eK8)qIy|kztTg_%qD`^>RE%+ z>*7v2aTXsgM7=uk8WbT- zQoQ}|1`%^EeN~f%JyG?Zzg`Q)*I-Bz@wNo$+s4D$xj9y2933MojyhkC!tmPl)@U}Q zdH@$nq7;bc3cg=L*TckCIB>Bh=`09m#}3MV&+Z_yqbyK(SjdREKYP8c%C1HV?31Cv zxdx2a^$>GHHv&Do>{&Z}C~i1veSyqy0?(`*CSf4}Ton@CMYhdr!7+83btu;20|dDR z%_%%jH8jbDo!6{`tp;p?Ae-+1bRi=9M;TA-@a1-U$1OT`_jUS-E$W_JJ`d8k?$ypV zr`H`700-~95bdL1BX;0USyt&Zu1ZhfDWmPXQ#F2>+EnRmaItAy1u4PW0a4=pqQ{B- z7n0eYbt1v)_tB<~Be5So$bi2VorBiJIqLI6%vP`F-Z;eZdSswwBd(|`FtClU4gS6& zIQ$)MK4lvke=$=po_-BKP_7I8M(Lh2XWvhPmaqBd`j^a0x^!OpDQeVL{+oL3(87rv zt@c#fVx%Up^t!$I$JrxR_)&YD?&O<_H;jCO(E-)YixBmFYtFLbL{h*NVXEc4BURaO zLhPcMtus4xT$W#vjK~ z2hCO8vrwjii?9m=>yjY73Ma9x_{~ty`SvHcpG%XtM-S-vVd3q!yycf$$tMKY9K-wl)y$OYVcW?$t3tW$_I}J)8 zfbFd$D5{fZraWMbFgsI4^r}0Hein=}0wzPz(5m*RGKvP9f}!DfCW&e6a$m=j^-+I= zsXi_IU2WWr)-k4Ec_eWGeJh3+aLsP?61(^KzT&a!sFXZkrELADM!kd%JmKzEYtrv4 zC8=h>t$(9+rB}68NUV|Ryx7}arzAJHJj)2#Z(sBzF*m8|>Lsf=vk$*QX3FEWht}m# z+KG3shV;Ei02;0BGuoH3tTp5BCri3wepD=tG2F7%( zy!jqswZf?vaX7SXwLYZ9rG*mi^y_mtXmk8}Mp=EeChn-oX0Bt&u4pJm%#WQsTs%|6 zvsoQ56@$J()}wQGu1avwLq}q$BUgo* zh47%QmC0Q!$zRDxHY7LJpGV4^y?L(olP-~WmZ8OY) zF+1bnwX?yMf*7^pOG;m0K-yD_%}My@KTFvOZgtq4oZsOXlfc_4P}d9f!?E*8P56Ku|k35BP;)CczC`P*O`%!|VxIsuwx^ z76!m8ny&C34b-ev@N=A6J$drU;Z@E%FYmKIlA&+#-dr8b-kyL|3x1Sc>6^LT8-69n z9N$|JyM8wT%?+tGms;8x@JR5qxx#2Y({oV0FZ6Q@ydTbS-zI^h1U)oTGAr_9>8H7g zekI#IA|Oj9CP!q3r{uT02LJSe7k*4b6IDxSk%euJN8Ii%^IT@w0Mes?G)5Pz3uY;?XYG;^6(SRxjA_30!zA{^%7`2 zCorb>W?+k5=H$D*FGgn(DD#_~Gtiy$Co+hWuRHKxn9~2#TT1{f4NlWDiRSO6f1{V; z?*DPm{mjOY-g4j&N@*La0=?%FnxKQagvHQaoEb3j~zu~GlC$0L}o_n&C8ucA(a`!OM5ZR z{#Nt0r}nl5K$8EG^Mu-jR{zKCXKov`oXT`5_Kk;^Z@ftm?3LKrO3h9Z&3%%xzA}c~ zWdEd}JgW2fE%NS7?K+)kGw*MSI!|vpnVX!MsF;_GP`xTqqvoK?r}cOzQg;dhy@T9S zcS9UQ1BnuZ$*Y-bThQk}n_}~3q-U#d44|b$EboVM>t{v&Fwzc)Q?2j1y71+?AG^k< z>mZi4S4Knjv$Y>@9X-u6(ME5D4iY2Y@cuXQHQx!Ux!ZssEWoO>;XRbYULH_}4G6x2fsT0mOi2E6HrZycZx_27|tslG6CM|!v#Szv?M`U#10k$5J z0m)ynb_s5e%uhoUz8gPf{RDcCbA&9o?^6qy*JEw!e54 z``0m(&+_suJ5`;F3x}~E(>+hQ9$kqVP3Qd@zO zCqJL&2e9oP!~Hz^L>c{JHp`{~CDSTPjRpogoR$OsH`{%JAuVF8L2{iOZ*$lR&J8VZ z_7-({X$4ks%6}3=@Kpi0@oAtsOHvYq`#;LYgTZ!rme`Om`FUNpa;V6f`Gs_>L?dmAXwYolXQfnFPG=n?_Btye^SnVp^dszQF;2Ok$9 z{@0Q^qaF94<2Cejrz8v-nG2^~8fuHothwD1`8w*0PnsNhLuRE>1JUR=j>VAZyGR5b z1hF9151^ju>$Ina3%oq=%GA|G!q210#FEP^RBMJ1Ef;g`h(R4P1i%WxIme|Dw*&&%~v`vv?!%hceS1(vvwiaohYnw%?22K8$xGlFL6z$mvW$XM>Vf)0D>9l%Jh>P;+9}Ew zDL=7-dv~+fq2P`jaS|62QnFP5Tq*X(lwRoiRHo+7{tNhS_bxF+?24~KVLsva9GatQ zl9^{58&dOGHe513dTW~_Vk8JO=7kq_ygG>&x*ad)?NR)?jV-J7DarBcHd~Py~A2g%}pRiVk~=Z{2kjDS(meL!mIe96^?Ntz-&#(w59${jpM7_UXL!m4(qHu zs_R{eHc z;!_Ue6fCgwxZ6Z6-HgK6?o+Qq;%P8Eiu2%Qe8bQ(tVvc=Ycg}5^Mx$qZ!*5R0OUrO zhpBWh$-U7p1i(M^58ihqP6sOh$@E;y#*{5nS@o4CCzDOzuGUFmJ*N4l2pAWh4q{C))A7}Hqih1Z@Z~oNzTRZ-p0Q}7`4iq#wODB($uIzvg>cLUJ7 zNEC!srYPKzNuq#OZcRFj0j^0FALxIo8h6}~#7JR5>n;bD7wr5s-u@Y)^G;tdJtOD$ z1NdIy5^ZbJ!~d;xkQzvdfe-n<3Zam29eloqCH0k~S~;mAW6s0uLVtWl$CA~o&Agf% zB0g<)iYzv*g=4Pc*%A zJ+ZK6^(KnB8lAkV0-Y`(;$pV70y;Ncb!xz#Y2Zb-D)148MK$7UvfEgS6U3mLvGs2) zDvgA=>y|PI9aOvjUcgwaO#0qR*V9C4rKOGkd-TTu%?Ny~{bSvrI^nEw>G))htLXND zPC$Zzcf991aFZuO7{GVLWD))qBPMa+iGeo#H*|uK1W1J*DE|XdlY2)Lqk*n7K(Ewu zaAkvYIPg30NKS2Og`P4+?+?7w__TRas%|26bd*xeQH1qXFEO-o0>*a>R37m%Ola_0 z7?v3>;?*{xyIjYKu#GEjk%>QW6EE-%=C)-P%i)9nTLFL_MhlmoouJGG;$yf((Hgn% z>?N4k?+XkpzOZ$#D#)+f3}JV}k7Y>D@jlCwSg8wL?31S(e#oF&Kb}tio8PMoX940< ziZc#uRCH3@FLDk`_h1r?gO}qDD?C;W5^_Q{=82b=Ob{tzJ1NNv= zpNZBvglC=KinN{o@5E{QhSF$l)N$)4rK`C#M7u9kLHi>E&NyfvQ2b@dGJ>#X?`Hd9 z+?{_s{^#5{Cc&#kQlJYflME5TFJv8q$Cjg-FQ6CsWgiHyGG3a)_Y6+P>62RLAc_+peF+}xyr~L zgwa|(Y+tK`ItpU+KN!7By_!C&h^^`!>y6*~{6b#xUSsIkp~DL?O{o&Lxu!1g^NK3N zW%lJc+VSdD1px?jXP~zXY0`vZ#=F@_c3qUcTbG%Kv`Vf9_w1G_3yx zR<+Q7{mLAsp*%ZfhV5ZR%8oO&|BxF)t6Pb$U9?bAluz>j|8V=F=@T)$=snyx0fS2& zCyD~tvTn~(%OL1h8VkxW(fJu-b;^ncFM^mLhwiJON)#Pziw=VgfTw>d+jB5YRIk@2 zCzqEp!WKpJSBxE3my8Ft#89(s*v^L_nGyDc$AYvpfAZCq!ylXQ7uj?P5Zz!dJTPxf zg590O98^zmxNPq^5T*}B2JP-Pv7DGGuw-Hhouif)DDv7ALT)!EFy)+4aGzNgVu^_~vItNHU69%C> zM7O*81lTPox>_S$umfqwb+8%Y2!BMC@tIT5Ow08wDe@WhE!r|-b z6i39ZOAcn{Q?>Y4{>HqAL+V}S1Urm@2q8QL zR$oC>7_EO)7h`5>!u$|dBkjEjjzKt`lFZQY*9fGz$AB+B{J;^PG-4i9I_4OSJ^A}o zOL)|yFd)Xgk%vo&OzJF(156_qtPy+3vRgKKfQS^Mnz|4>kW>%h02}6oqRn+a(3@h@ zkn7zLHW+58E%>FY6V^iD`W|f?ilPhoj-9$)&SbcNVJd^NpQGyDr3;s(x=&wwUp2Hq z;g%6wGHXyUml{k?!vEH)pT{S!XB@=3dQ2EJy)}pP5S&Y-K~&%86MVB$vX!5%;Y{E# zpp`C`>cmOS$(=J2LI}H+jnXXyf!18bYwXxgn;fN%3B2njr0W5VJaUgI-S0f{(3iTw zdO5YA%O}PM_QrlE3w3bZkG7n%Zm>~c#V+g!pI`GtC}LD=_^|hvd-h1!a~_`hC>RmDvbSmg4J;XF zSjC@-0{P1p0@}@MU-s>V2Km;NzD2H@LX5h`lHoU4w?unj_4yrKOSM;|Dt`B4E<6)L z)bo3#nbP(-;?4ggaJq&{7vDl95zbNJqn^lQ9X!FP{lqR+V+dD<<9p;nfBL-N$8!~h zxO#hHKpIgaKkiN}XGjT-&S3w-u`fpDJCDjTmF>r~x4(-jFr3VEi&qd7OL;}q(&0;I z61OMwcTSy1dF!6S=r`C$zV-h_zjA+A54%E@H4-q-B>w!@=R$W2qOqn5@115CjRA#1nxHYG1&Z~lqkX>n~43e&|DQ)3|eYiiI;W>`r2hP z$tBUwq&SlzX;N#BDt&t!ULF*A^G(bF&4LpHU3!c%pOP30>v{-WrE237e@@UVrEP$U zA~{=tL=xgB`mcpi_juj`_O` zp9ir74Xog<&XP=B{mxhO-fr!kmi!Z-;Ahq9Zu$;Ob!^8c@BEnLtlv|ZKgD>$8MJ|V zgahC6pJbd{5-~w$LEm&$e&T;}?VoQe)&q6o;aUFg>8#L327W2Ka|J?!qcJ{;K+t{G zSa7O|3eipXt`H4LTHe-kX3doh!s@_)J1Y~`Dg@K5MAI6jt~yUQ@VVY`CnsA-WjL9HVjk z9|LYFH3@8jsQHXP2!(=BW~U|)0y_mQsY>W$K=VNkUK)HdaRs;Q?z?p2zPr1=TX9k@ zcsGvYZg-JkB}W=VGKh&|%^_`0$rQh?LVvF7<@9=is@Hy6@88;tdsbr{8a54#$KAb? zVtTUw5Up`Cvm)B;e)u_)?_SzXJ0ZqB&}y9~9y_}2383{1EtJ`vzr{kZsv-H1E^L`aX59~bJ zPCS2&xoIwSpB?M`wX%c9e`$?JZU{*@8c6rhY&mod*h?F!d06;hjW)nZ<%D*IEc#9au{L zCl`KHHM~gQgYJ@(S%_d2zZ0@&lYs67PLd%C5&s&WAkNe6tzv;DDP`q~C=IT(0wlWB zNFZbZ-#&!o!Zy>qPp+cy6V@yB`H&QQJ#8i+=#kZUr%OKdRK&TVG!%ZQ)}3-b0X|>n zK^}pyLKN;;#JU&boOFNOD!8cRV^*2;#kj(|0yD__TeoN12ZF+ViyM%CO1|9G%%-9vaC68dB8*`%;de8$s-0wLma*P)>jvMbS9DnetSav2-)<-t_ zLivs9T7e;qh7g*(5$t1Yv+0S143rvln@Qf;IiTxeB&Lcbd5VJ4$M+iRZK10yEn0r8 zMG)-v&M|J#Mc-N6xnpe07q{o! z!AmxTrqfS_m-1e`@nDPOwu%_?q}Eb8dxo^Ad$D1HDTt(YZ)#q~w0uEnde62W-s9?* zN4?f`^KhwNKD|-C|IIiKf+C(j>f=bJZ!64?K)lTvNEW5Pv6eoD|b!U&&nh9*z zbzt7!!izO@Fm>PwT|a>=g{RJ$N6}Mrsp^G{&l1h+wtK|d4L|NJ=iw@HH4>36xpBIN zBgVW}ar);YPJfhOZ5+55Iyrr~$TNkz*;S74@L+17H5nE-JvbH)@)F-(v~J9}5cf2L zsKJRWdZW4LqHgARrxGXJSBBYe@FsqYFWTMw^)%x4-!2H(Qq22qRDj(HW3<3>utEAN zl=AfwI=MGh%iGM_c)x*VxAN55MCd;SIjznV1pWzY($B}xoVKV3(`;fLFVp(B#cV7c-44E!6qNrImI}L?XGnO;2+~@7B zHY)#iU5KEpi4J!`0SfH~!=yvY?w(J_aU~ieZaj>{+NQV)iyftpuY-c~kJf=`6{e2> z37uU^4SwW`2q+RhxQgaMd+tCQTM9DH7;}RNY|*2qtmlijS&WT_&a9BN-#~9O`0ec2 z8;G%7Q>DVKI&bw;q|Ryw^gS@u?cYFa*Yy7HN-5_UGgX}s{&b(KKnPx_)+9<)c) zokZ8RoBo`L!|9{3d8um#{xzRso@Mr3T*Z*OBQDilljGZ1Kj@CWBQsMz-Wy>-@mN}} zo*Gyr-$!>(KK@d^Z2W3YN^2q2H!W0qMdLZKTANDq8@x)PJSyCJS+5ZZ%7=ZZj?+;# zK>qxV)hrjITb$dEZUp&ZyLCN7TJ)}(yc!QTb3c=AVPlU^v&KbJvjFL9I^y`>3I2&7 zFdK4`fW>bsb-`(499I2OF35EY{c4e^Hr!Sn@Eq+{&ZY<0~1PLfG!~ucE6T=&qEVS*wH;nlB!0_=Fauwvw`s2qR$XI;|}aG}JFWPfcOT z07oq5jZ>ZBdx7^I?!dQq2iD?+_aQfP-REnDhMz3&Pm!Mebf86M^woY+XDI+>+7hrXnI5t!3Q!Flgz)J#0RxKC~9ju0B zOv@g6g1+oYppk@nSTB1a89BVrP=tbYIz4EINNP?QESQUT-}v3X#EA+@_ZC7#XEH{O z1VEbKvpI6m6MV<>LiBnXQ4K5ll?;oV9}NFF5 zW*L+$7<>DC@VY3!8vnVHJ{15R_(AXAMA~I`M@HWE0y2}`Gg4%}$+6<>Q)f36#2l+O zEBLhi{yzi57VB=ib56v_qlp8Nb7$k^dR&JBCv^3h1l+&?I$#8BpOEwV6I5p|1jk3# zZ9{H%Ix!op<>R)fOlRidl|<{)2iCF_#lTZoP2|4;B=%A++4JNX9-PM;4?1u+?;v|X zJv1fWEs5S?@s}enocoGLWIeBj7RW2EQI11}MO7LaQ`2s&!LH%r zpl4uQaL5ZL9in?t2o=!fKKz2a2yvT)RnHG*XB)j-Lgc#%*Qa4C%}t1qW65towK~Fi zTUHCjF(#hPX{p=$3Pdc6RtZ{Mn>B$gNsA*&;s1!k zhUh^IDTOG3xyjO11-{#03%m^RK3Wgp@G`o!8{OAx`hINw2}k`&^Y6Pa!*qa4SEppW zo*?T^Mk*%mej1A`1splGlW2>~@Owr>7CeD&!pnFJdngGGlIm&~d?dlf9^v@$W0+Jw z?za|r#P5|5`0`nRve?UI6kAPlT9m}!_EQY76bmf>T5O3C4I>~6)H}5pTV5bk z`BrsFA8W_MO&Njp7xe{cfvt=!?p?}%UXYP&0=4l7uO@fS=6L+xN}msiq|^0lR?C66 z%Mim~ZlQS=t}BNi_cFApv@-ncvA)O^$Q0UoguQov)|7y-EM>;U@z)&3kIY?v+-vny z{5I)-nVk_SgPVc-NdElf@Yw3|3 zow+Rl)c4|^B=NLN4`reGm5eW4i0#M8tYMsH6aIG-(HR=EmB#5!=zH=GcBcs{GAACt z^CqX-r(NW?(Hq3d78>k1+dv`uF!TbIL1wPgSZ2#LIQ+@P34%0~m&uggAOIq|=@U5U z0-lovkS*UJ zfhlRkG;5>hc&oh-J_Q|iFyZwl2(%pVr|je6#T&yo*L}q6KJkj0B%cq8%)4a=ZW1u* zQp&p5FaFE>Auyn%&pvo;K!>f>V2HH61imBF==$!*rMpwbVF#=>qJDQcdg&NayW`I< z1}YTZl@8~)o4AJ^3E3&DZr|@b;R|+GUDM`o(dSuq3)r3)o$d1hz57!dtZ#7+E9XBh zx#Ib`_pQR#;CF}{uw=&mv!zRSaaS_4dGoI$ep*kFP%KHYsb?jr;~L!?npULY3o>2UK8YXCl=u!qd}jy38A8z2rZOPZiCb) zTMpENQZ@KKQlpjV&0B0oNSn_VabkV&13&L-p@W@qx%1doGfXhfXsvKmT4TWw4a9<& z6+9NiRklDMyNdw$___&a_{R&k;O2pnwV`+WYW&6_a;oOtv4Pb-fAjI5N%c45zw{@+ zJ#bgE6*=_r)+KH3%}#hz1~q{XaZR|qI$HevIxwz+%FFW&;4*ltR*ta$Ui^mzCChiu zA19Eufngbq@qr{SpAU@v#Ab-6`8lB;&N3IdY=qSkyWpQ&x)EG%EG9*Fy39pIe^TXBNS(Dq#>aL(D+` zk@mc$ZBj`{QN zN_g;In@=gf7g$TWVJX{Rh8Gt}z5ncW?&g*riF;k-uxQ60O?tQY8i ze6|xl-8ZZDJ>+ZbKb{6?_FIqCwUet>JZ`dTd6Tcviux9VI$FxGNf_% z5QLlPiSY9OV41tbmm#L}Z+74lse%B`z{qNU@i;qHpJG2z?)2@(5^!42c&|XNT?e|f|jo_spq+%o!2nk!bv2O^TM-%JM`^;cP**AHC0}gs(#DJY3 z&5e3fF7ADc!i3fc#mR`f36!ib2asBsymX``kJYmr=ylvC-_zL=t?| zF%)Pl5VZWxrL1?UPha?vFF(95Wj+=-)Fxs{J<GklgX0=mx}B^I>(% zNGGtgpi@YR25e#waG4HAXrsG?Igic*bW#*SFEHQKmLa26-T2qIGh7+Olp+xC3BRdXM)hu6v5Niw7#%Ww{2d*#NTfe_xZ zjjJC##IeBKF1&lEbobm3%=|jcp0iZ(#Q38G5x03|So?Cf8WxqWHULYphI@X}kZOpe;f~xbpzz%X2FIkJzn8R@a|6_0miTh!`Z?mh zEJS(8TY{U3j-!FeOo9LQSl0=96M1ox>wI#>*#fzFACWRhB~Q)>;nyA(NxAAg^$ zbzQK_+_~s+%ij)a(&sl`SRvklOn^e(#8$NWGzx>~ry4D0$^NE-GF_d}ZmzTDph*(L zqZb;UX%VI2cL~dGsB1n+jyaYlwnbha&yqX#TrvFt!$lAzn*ys7k|08bwihn{)8Ur7 zOKZMMfubZo*Oty>wez}Iwjw5ToT2$4Ui$uJcOU(^_(R(UtnBeFPx<2G#(bR@9WYsG zufU`Icrsl$#1Pq%$Q=ha@Ae;!*hp6zFIn?3{o1t6XgGUCGY;UR0^hoqMKA0 zTS;O?r5_5&9rjq9+;dtK9{)<5zt^%_LJ;@jha0h$!(PbRAJzy&CI6;Qt`aMXYbS7) z5Z#)_gW=2j@crR9=7N zM2F?&lU>v6Zo#4F)1EMl{y61o3g@r@*x=uszp~X>Lhl$n$EVG8yR%=AVjk$>^4BEw zYYR`#Rf*nWNq(ePeo(qm!V@80m>>-#2cn^ya8KvDK21pQ6l`665`~CD48=xR1)mTp z*w)ba-`b>);x2UZq%lBU#B#6&8t>d#%Df@`1-|q<*p$Zd0-AGf@B~U6WlA4I1m3g^ zAex`A`AdAgP!^KU8{5sTn|KV5o-3#uC@CpEDZfBxnebN8+=F1X7@0Ii6TA_I7`T~d z9C2HF`gr>TsHW+TFck9U=-YosjRYn(UArL+j2(wMH74*QGM2XZ%^&b~i=6|U!%a5* zg*<`#D~A?3zpE|OLcsF{E)MQB*y=}=OY)bu@)e{22T?K81eDTK=RHOxR_C#4>7Pqr zSeGlns^rJ+NQv5Bj62WYcJWZcqbdoYC;E4U36NM5H=I)_oLp3*l(Uapy8bF2e_*78 zMyT7^5rr;IV?X}PugG8-`c)I`)$pZnbC1tD?ky1jI5lM?RAz@}j$r7?8iIM7? z$eJu!MkPX_%{DaFtYa7qvz_yQ`u$(@t~WI^=RD7SU)Sg3&<4)=L0p+4O!|*N@|AyA zI@Zpe&>-#)BTWa1^E#jm9$_)*^AbzZE1tgfCka67_hKwz^&C z4v}=lTCwG(sNH$!E1OX;NkBdzQ6?KNQ}Q1KcMa%M&VzX!NrC{3fE zf^u^fP6`1g3W<$T0NVZM3*`A~sobiRd`fabeKu-jDmsgE;n6Rs5bc-qzWrVqsS5*w zz!f2E(t0VVI%jU|fW};c-+bD*I_B~ktAYH}*)jjb-NoN~C)fV2fv(Fxxx1+~_=;ss zm0h)oa^3zQ>4grQ2Hmf)YUd8lvGP~mVfk6kN|W)T0a6p5bF5oEUMq-T7T5c58=hz8LtWk*j3`+52!}#8&eMg`k@u|YtB03Py??i3++k6EEJm74 zDTvV<@r#I2-r#*%o{2Z3!$RdC()SWhFH=ZeNUp`@gadc$JU`ed|L-E+L@wv(@k6LT zqOCvD+~AdV{E-ce5UirR0Vb5e;1vYl!Q98g1*C2GdsArVY2_b&QxxlH9zos`e}S~| z(80q`AHU^?T!~hVpCCdx#|KZF$0Wx*`c2>ZXq9IJW9=%FmiytZ6ytb$9b@tvcb&?W zxPsTB-1$X{KtV=3p@ZWxH+wgn?b^`*+xh$a7^<~h{ilVjYl(?D2u8)1~;gTGwPw)*+(fk+;Ex`sK313N_qpuX-rjdxG}cedtrpItc%-ZPp% zD3TFkQ`_+~G8XNnZ8|vX$)H8UmYeJ$(+BUu{N2>~(`Hh}nisk&_D*;CY`?)EA5dI%# z3hV=gQ0`ytGvt)V-|ic;=7CzTUjQVju^iO-aiqH!15u`fTWdkE$hK8ZoeJhxK_-?p z6@~bFkWLzkaOy{H){Q@=LXdych5tI9UJMu>{x$qy8X~ks7k1&S*If&n>(e?!dPWrb z;&;RZxQj!YeXSvr?u8@6l)!bv*n3disd+z;8y8E84rPv_%)BN8It&#XpGM8%udhBV z13Qjj4Retx=%jl0W&e}oeqDzdge(JQS)r~{?5OPBjnnWM>_E~aYw`{4E}OYLEc<;& z$56gWm^{}wBTA%eX_1c?x1_cI9S3=U1>^a<81jtiaMtRB8#!y*w6wPN2;&_SjURym zScqA}v8j1iwZEfzEoT(}LZ#7K{FSBtE(uF%U`y1c< zL5(f+kiNMbu=+ENQ-&V@KdOi%*~=QJ&O+Xz%wTWGg1~9OXt4>Zc*3yx{G1{CRiS-6 zKk!8m3QB+yN;*KOw7b@Jwy{*fh~`yr&p;tm1$!GeDhc_E4X14cL z)l62^!XA%SErBh;8Nsrc_?%UzE2eI*h^3rHC%mZU>Z;8cR~VO~@0tBc#xHYFOY2P9=IhVi+9LhFYB$t6qD$8RrLG^n@`)Jz z`!|Jv)J9bjx~WV^kFnO+(D@a%_cSlz8SY;W2Ml#hwfj6bI{ zcJo3$nb(xRt1evlAu}E#v=h3d0Cr{PHydlIpvx)p=UACxF-CZhA9TcFiZoQr5WQKQ zMs=!oKwZCTF7U297&;gt9!XP5{KFe_oiG-rRh=mHE=s5&?x5uucXQE*x*51oy4wC^ z7ji=s@~6r}BZ|C2k#aAv@ zd+Lc6@3C3=hi+YwoUyU!$m*CTaz;N#ih$011uU0;1uf~VOW7$ACQ?&T9IkM%_T9#6 zHl30xO~FW0q7w3Zqc0ICQRzOf>YIeLP70cpXnQ($JgZ`k48iL1d-|iyio+#}nkCn7 zd>Si6J@JrLj&p0WlxD*Kp%-Fb> z&2D1mlHCKveEOn*&l+6ABCyCO`vSr5wbiE<<6Ij)d7rxJokl%+Ym3PBvmG1YS?U3U zjE6agHwVcI+JTe0v1mC}s``q6=7;PIm*P(?ITtS+_O41x$M<=11{C@C9cE(FZ*7O( z#6xAhV&7j)_y7%H^)4gtd|Ib}#84F;fdwQzrlWM5U zZ$DHHGwZZ}h18EOGrE&8@VvYjAaJ_CRwq5&-0Xg6=IzDM2B|7Pi#rK1^2zy`d($h! zelr?+?%C8S_yOlmFNXDM&G|KY3S(wmcYSSDXO5)Y^Gx(Js_yxL+Y$`@MUbw%@oN2lde9oH;yKZ_hB{%M#ybaJlIRK?6)|lHn}*C<6RkK zFK?5*krtXc)0Rj&dVL`6(*)Yw%sEJC#o_D1XD8fUQT8jc9CsyAX>9&C5@CRDZK9c` z8nW_6>Soq}7f=xP#(ZL@On{kO-9#70rdbeT81q4y5>U`+(2u8P?Q!a4u|!VF^HStg zHhu>zQl>YcA7JUL1&F1^$3cE>Ds(OX3i0Lr2A}D$5v`H(WhzAept*>#sm{AHFGHaDD8ZD&aTMt~SZ4^m@4Mh3==6<07k@M-&%Y&fM+-y0HeCmV zsvN*`(__LJv84OytweP>vHi@85=yB!cR+WXR0)0w4k$f4(Q=p6qV5wATxEN*=mt2TnUkcBhZ>6;{Wd%BXU(h(Wt_8N4?OiSx~P3OzDbN zG{GASw(Lgal4w_rdfo4>Hs(*B`jTnR@nK7P9g)vT##GRd>obBgv*D-cl$wgS>qr{T z)BW!OXlzAC6;5o30eI5;c%JbHrp5)K!g#b9V>NU3@4yxcTrXM|FwUU2ixX!%f&Ph1Wo%P5}PO z=m04qszCAP4LqNy@%O~0cX=PFB3fX~=|a9}I)VxYt$;()|6*w3&P?$u-tJZxy6{r} zBkyQ`pD{^%pp*M1NQt}`q&arr1=4urJwEukIsmmPMHI4SC-6c4*a2XgY^OJ?pfQaB zGc^JRL639=?DYe_M9}6qUI+6^FL<0I^1BZzFKN+^Tpl-D3aXoaHIm@c;_L|2laZ>p ze6OH`%m@`oh~wU%TCJ%|V8q>&GR8ZfpO@Eu8^X1{xi4wNnll(&Fkz&eR;IYxq`&O= zaVRo-YNIu#{_FB&dxW7V6d!!@&8QN!#KUpe*|ABmy^7NnlZi;coTxSiaWGO24)mwI z#B`P-+R*)m6JClZMSfVjtFl7(f4wNxFHH4ye4lcPWBvv6w>oS+Yu)I4D&s~0f70ng z?hGaOD}D&raHts!_Qtsi42ph&_xP@OP4i4m4(&^ zQ^zQd(F1Uzk2NI=u>#rL9$3MJ#HwqjoGBoOlx-KE)bXcjQqy71t%!LQK(3isayGAy-7hX#DSoBc3`V5v^EjFg1 z!XL?_DlUEzDH6v6<3cDB>3Hn*@+e$+pjBS@acf2=j*;v0o|6m_UfxJEAG6L&{o(nY zPu{M*vX{yhTk%^~cwWwys|r|*SnR}n8|9|4b`!Q8y}$HS_F$Um*`$oK8*lf#4zsJ7 zyCn94BUt<288{$c_kL`ExJsQ!=egq=(f349{ynIy2(g&Ctjq{Da$YK0ZXWeiQ*NgB}4YQcciB)DsgIgRoMH2wf%H`32$%I<`#ONz5my<8dHW51FDYB{dh4UF0DU=W_ z{GTL>a5AQ^6K{bcAlhcaJi$>o>FWZHiemJZj|H5#qd=4}e|Gcjp1DidGcSp+{{<-b z3w@DUq<&N>aEX+T^micC@IHcHbdlht+u z2UvVzRs(*5LDEHOejMdK=|Jbf(nX!5Lc`SgLkWPo%7%vZph0;@hK>cC132BP(ZatY zEHXF6Ai@LXPS!(`@ISvo{hrT_AE|Q6p9vuOx;EL6YoOPE{OjMe{c3QM`BOECb{CD- zTK|oE!RChgL5@jotIDOy_P$ zN|zE9mlE=n*P5|_+dYK_G^w7D+(tHfJt|i7=;OdLflG<1*LF{9@oU%d?kLrI>F`-? z@9Fg|`b%9L>;Dcra&~4#_$-zw1G=ZzQ;~rRg6W>(d)ZMCR9UbGJryKgLmHe}a~Ea> z&J-R+#DnEG+3h3+cHI=xvPgMb7f>zUu*KraS)jrDC?-Q*4T=NS6nC+qN~6C}~|OC7B<$yMud7Yo#3J5jJ6*k=R8)mp3b z3_M=k?2ZhtdZeLQHdtjNdeQLGWQ9LS{E3)aKum8lH4guXaceJU5@c~AjxF2aKjXJ3 zwZi9MR9kd{`7F(>r?-+b19W6_wwRwdHf1&*t84)U%kov;7u20sr)n)GWg*IZ_qpLG zG08_wL$;H;Vp{Le$RId)H4Gr!D@#vA6c$_>AzK!?-ar0f=`-fcq~I$asC{03p-}}f zNJZRNTy{+kvySeW<-lho#%K{fH&{ zBX+K$^3|8#6Z*YWSMDxQY!6}cLwS}Wc#9vsHNdyTK$1E)bxYDd4jUvQemFTid1htn z6q@r(5Zd#D^MzNGWJwip5z)J&KkP1&=cfe@P4i3YQBIp1vwZJ&f7U+}@Mo+2l8N!> z+SuyYtfASNlo`KxvYf;U15;vhb3zeFK)$#9==bXQ6w_>qTk3s1foHqTS)pe#HWZW* zSyH~w6PcUHbDX#;HBG(WILA!~P=#Zwt$?SGwDVdjNP$(YhH%>yrojC34ov`cO+roTMhccl;gM@G*x)A#h`V)g(&bWdwnJtpF zd7#dxcqH{9*me05d7zH?KU&IW5#Y;3;6s7TWHO?T$nt)q@IxPDTJFoRKl`9`P=sXC z`g$phDxa!@lq?9_xVr?5M*0V{@%&cJg_lep`ar*Y^P0o&27YygTB|XjW~Q}S;{VaG z1z`$O;>YruD0`6*Ym7C8zeVUhU%-i3kc2M^?61v6<^tFUGX2%2w`7D+66|z@H3XP~ zVeZ~~;B}%g+O$2-N8F@eyv!r&B02$TGzSYRWp>mL@f(X-_!%YecMb^gT+0)%LVrX* zLzU0YY!4AyGyAgttpw;C@>eE&L-qvAKb}khmItI81z7_B29-~jkq(0tujZ?j8>ADM zRednJn&_@(pS7|*SlcLrDoUA+ZzK@c&pP4-NKT{e*H&kCo$m*J=tqbDI`s3#dX_{! zy|BT!vVWv)n^}tTo1|^SvjeidCyy`4Oim#$mZXs9z4RrivSIa?RKkOqh0hvgpG^&O zXJ`)hF=i%ynH(|>yR=&4Q`^uO>L2?o81S?&j;7e%&`E!YJF-Q|yVIL-7RGTu!m#$0)tGP)|Qa^cq^7To{v7a*=HhhrGFxOqUp(A*{rm z47Da1{Z$6lv@x3e%-ItQx(0#LF`Ng3ekO*l=Mfy8<89wl+vCF&RQ+Z#^6Cp0{UcD4T8QKv8sYZ~1r; zAeEz;vN-uR+(y0J8VxnRTY|4UDtO0IAvJF5yOkMuvIK-yu;lUy@DA9?bIyn_owQCm z-gWpxb%o0ujXV?8t<893~6M)T6q zQjWdev|pvj9qj?v@)u2?hFN|h>#;XM3vB*zTOhEtOzGW)QohYyuL=qAoH&&v9`N;3ivJ?+((rzFEB-%msXeMu0HBd6;gyMRx=QK^eyaKx{q4SA%VS=LekVV(Ws22M+kLwpC+>PBWpN~9y_Onq_FOELyvzMj z^PevF9@l!beJc98kqNf^Xlev_UW$NC8(qxRhy&uk;|F1Ea>NVXwih zCPV|-uC|i6@j&0Hc?wwx^Pf@cz5DQbJBv%hnRsFn&N5%You`C?MIo0pIe8wd7!8nu zG$Tatj;-7gg8sy?PBwFTEeOO9yHO;0b4XFNc!Jctf(L25tC$`5WBgF3o&_xPxiOZ( z|A?M+4Z9L@fekBviTbx z(Yx^g77{=0{4yGl@Bz-q2J^iA;1f<W%i$38?(v2sD~N+Tq42BfA7 ze2LSTZV|<8Z4QHB6UYgdE^Ly-^zJ7I2k6_CoK%;iUX1keK;?o>JFGpx*)eOXEd8TK z+phY}Bzm2N#tf(&r%%ZS*y*=qjPK5BEe%&Fa)|490OvK6o@B&+h{6vC0x)Mss5C4W zsW^<&dG3>44Qo2~N3v1%n%lK@orn~9;*}F~EcLk=`OYrAox`R2{Pt_%CnT{S*j^(q zQhqD5dV{qDqGHaTI|~;DECKGnQ2E!K7&Cc48K`jaw9EAvH8g)EDQzi8052L|AP@Ic zZZ)kSAIX^}{YX5*^8Wf8QbJ1(p6-~(OXK`QniP2kXAVM2)!%wT0#IhAGrd3loUtGr zpi?Sa4AL+gX>N!@Cg+nxD`7cG$g3?B-kOZr916;7OW@GJM=JrjxN7{-DU5k0++g<3 z`4;)a_>JqhK<9HDtS8d<;&~s_O#n4en<>AswAbH}ic;`6qanWP$=-o#P7vS?( z9DDBknZhW$E)fQ$0^ac6N--baUMrxsQeDOqkZ5r14d^K>Hf`!DkI_0|U3!q;t-pvm zQ_jsbGX^a~e*6T3gj&)xgx803FdwRRQbfcsUK8r$Xr-ZY68a`TrX zepH5PPoa-k!8%%uBmJq%&Ve+OF`v)+gH@Z9+wyvF{+R4?Ba%eoxt*HCL`*VQtz&}< zzwLnr=h)*p_Vkbiya42PhY)n3p%e2*oS^T{0(OBcP6ZzXh!3aUrqSmkS%KG?RIc?pv;?rUA{k>21@ z^ZE{eU1#(b<@=)QsKq`~jbMob7CAzw$L`Xsn;jLEp;9wk%LTGWXHF4p1s;YVkVf~c zG{3*11PdqPRd}ElE@m#CEj3FLs&M*ka*&Y(Ovjvjm1(^s;TUUM+#}~A-S#L?sIZOm zQfU0*#X$C+Z|6vSs^k~*VtW`RUk8-CHf0~bSNtz?v!ky(T66^`dQiFI+(l0?BQwhG zH)SWtqrb-=t!in}{T>ccA8Yo8WC)=+BT8b|@Ys6@wT&V)ED`Ci2u)Q@ABigjcG{(q zMfp6d1X%~+hhEQ&lI5M1Sxe*B9VhK%Uj%(rA}1GD?JDAWyeMAk;~`9`zf1enPW^i} zK*$sOg9kFv4eIcA)AF$=pEXG_;cRiqwIm1F%SJ7bMe+PRcnysgq#4W)rMevFt^(lkC;V87f@H{W@x6|Cnq@%?n<;y|4~KX5pUtx>(nt^bJm%E zVX%d}vDuEicc>hByX;)wt9%5@Q>Af9E^eCQnuT9}11YJYgZ>8fj^()ZoTYDE`G^(1 z>f1nkNPRMUIX8XbMXj%Kg*T-Wut7YSf(I}A>Ormbr6_1QtZ(o;X|#)i%RxKS(UFIc z)D_%-Rg?q*7+l9RK5P}HDywVXvS)PMc zdNqdyrt7LW(-DXG#*_$kIcFTe?Me= zWFkq#bo_l~n+>1(Zy`IeWP2|YfvW~CkL3Cd5`9MRhe!o>aAOv?t?zuC*V$51#uKV~ z=6uJ53B=(HHdqUtMwU+BGl;bN-oc)JBA|~Ku4%psC!YfdZ~l{N_Wk&_n~_y0ESlF)4uGV8Z5Zr%99J?9M~6 z0d{-2HbR_c_pOka+i{crKrYnb+mS?yA#X51;yr9c7`yo~0W*06x0Gb+5+E1*L4#D& zyxEI|>%g%1Ef>Ti3RZ&5As}REqph!IbKas_fAn&HbIlT4iWp@6RkLN$1bW(g33$8~ zu{wdLgI4&&JgFPEeT6UVEpegrhy^U@FQ(R?GM__#`T{7i{%t-gcjWo8soVp1h*VjS z#EfF?a^z$Jj^vqgixHcfYVjm`KQE!V0gPk0c0wR@r1TIc8SVKdvD;=*XFs&BnAU-L z$_H)#mz>WcsqR@y><)c+`FEhw6id;)Y2xkk^5bAVniVeI$VCK1SClB?u`_4a*(c68 z9KNdV_*kyL-+D9rjiL7&by#>kD5Hh9&hMO?O*yg41qOW2y0E&?`G0NZhM+JHY|7r3 zoR<+gV_DIZ9ruj2zjl_gIMJfh8#HUoH1&1IJVGCx#Ps? ziqioy=@Ue&e*iC13_g8A`-k0^o4y**vT-$S-+-(C)9u3-s?^_HlrpO~%iEj?RRj1F zMB4rZR>-Y8!RSwP0;>OSm_(E$WaI>!r}(ka$TIfIIK|QyuM*FBIcH^DzYQ{bbGBgV zk~18jyMtSM{`x?++KA!sp@%qmtybF>wBTRI>3<)kLuQrM4k&u+*2i4qFIYN=O{a|ZyT7lq&s(s=0?G`tk_O? z_cVGNv!kWEF@wHUI=Jtu1MPdPM2 zVKf)8hiCRtcJ|?8YyV5fZ|AA+vn<-FQ~IN~=^FS??v_{Q;u0(cWLoZBnY>d0@+>H` z)H*8Y;XVF|f`rT7;3500Tzac5QgMrwG+yZv_PZ*p?5tXlbn{gY83>YU?;bSz zBwv#Mf!egU>#Vy>Tg)-TzaNcsS-(2WN54DagEPky`aqtJ2WRz%Unw;=^*dRc>36Rx zwoIpA?qAVbAfCG%0XyZV<7?({Eop#v#tE6mJTrlCfex@TU4p9um!d!nbvqLO!X2;` zsC05&z!D$~JALe}S-;r$tIQS|$QA4+S<-`|m&?!r^nyF2BrzT%=tQC+a5Rk6GMpVf zuEyA6A@iUN;so(hWS=lz?GhF=*jhQVb$RUGT0d@S8(K;axt?`Hjl*lZyy5jMVU{Qg z^|i?Ox2o8a8z`4dHT6*PpGj+Se@)^ZR9Uz=2!pj*B`eFfW6CgA=y}RZVx%q56ckK7 z_ATE94H`3-H>gipzwu`S7jWz^A%8Fu*F6_+!JY1ag+dZ#l*kii#yaHY{A8{g-_6=W(5 zH<-s{!z71bX0oy>ES0{*ZxfjA^7f`-QXkQ}ry=3n>;8`mH_uVbgkjx1gEZbfRbJ;6 z0k&WBq@Hg7_=HDCH9Y4^nm)I&yL!mwjG{9;bJ7j|U>}b@rU8CBoBDJa zlHaS?TZFoVcMcJW>jMe4WhB|evCA1br-UQL&$iI)pV}P zzoy*D$gZ0&??+~Dj!^DS5ywMxK!G^)fxDs}`)oDw<`40bO^hup3isoiI6?Z5tQC0{ z_ehr)k_uMiWcRnEl*L~-!#?Ege&T(y0m$;Bf}~7$Um{g&AezKZWFO6-0I9`mY(!PA zNo&oG9J3`o^a;D+z;z>Ez=&{PgFb92mS<3ss=d0GPiQ>+Lj_gD^wE>hYZ4(CcLoAp>;zjXz~ zV*D(T?K>b=Q_r&y9eY?v1`cZ8Eh#IHRcT|Eh zxhgHWT4F*=`KME@oW(2v?mlwc*`*_Uyyqw{HFAsjBSY}X+L}K6C>A-z-4MvQ=67E4 z$ZiN4-7HePb+k6SxTJb}aT@+r_+oAE1WxV%`NGlc5Vvpk1oSBl#71x9dYc~4P0~7X z=E|p;v(+TQ2Wc=kqjYFPg%X90fH;S80!_U8Gq76ZZ{jq-W7)yvNoZOZY62Jg+d>Gy zjAwa5Ug&(NOJpW}s}$#G$(!dDq;vbm z^+oL&uiupB0blVKJ=8v}-?1l;2xBtoly}>|MD`H$!@tao>klX)wa0Rp>DM~=>IJ}= zD-MvdNqv0LJe>?(t(mB?=$pOp0ohkw7&AZ!m;YY-jZMLrLQq`me%sqSf4{oXr{Qb5 zU~=_OoZ3;@ORz}&cCsnC{&8~uz?sySu@Ylg<3C${rZz3cXui_d*=@DS8}@|krzAe| zg&RjZ13b1on%w?N_5fXyFil3BgupK3dplX~XFOBHu?hV^BGSvT`Jt}~S82>PK0^3m zc@gzogQ0(c=i-MKspid3@%O%A+?@N3OM+UfD`qdTVs^i1^r_IjRm0H;h(0s$Sh(a- z|5nm_>@(bBa?4M>;o2QcvJ?HC4(ugOdDUlw`Q(k~aihud5UB2va%#*{7i8~0zfVie zU8pgQKMR7moPI6EjjBiF+lK{=J*^%%b=Erd2!>zc z&aWZ?M|KS?*kwd$O@5VaV?Ru9JCKf(_S;eyM?in6Y-62k=&9mJJEDm#9-m=KVl`hF zH)Q^hrayeih4^7Tb=Rk2u*8UGl}TDOyEz+|h!;pg5ZWy(!eTgiPAa+^ry~PYNzdDQ z_YH+J<_qp;;h{5nFQ$5z4S-&pC)LJ=s|8dOLMYRZQK<7v0{fW98y#BS^FxW92%`z# zG6(+41i||S^q33DuapX#1qsH|Jikm(C%%}tk`l7;+aW$hD1BCko{PUrVgjDS^B0)8 zDWZfU>8oK2+8N12Q>>VZN|W{}${$qcqCiK#E7>l>iqwyeN!nyT7e)<7Z|I5c`KvsW zzjnY7SnG}f_BqdNd<;+d;`6e)iXz=*#t?<^YVj9E4!Y#(xt-SbMC- zT=D6TTtZFiDjP;b^sL?fjRcvW?yzu?E)1N#Pn?!sn(!@c5}`p*QOvzkSnr zro*i&yx)+*GRE0L{3_X?kjMR`qkqxc3TPby}5}VrdDc4AM@c`aL;Yge-pfx2%3 zMZ0UQ1B~3*K0cQwxv@#2;oK`oDTwLEq}_*Fr!g1D#qU)Mq3&&D6P0`wq?r(Q;@`ZZVGKWJ@4F* zR2~#LVrr(cP%kEPu>#Z&lGdR0b=cQq4+1TKhlB!7n&>nVWfQb00QCpSzKVy0??Pyp zfxlLrUu60$6Q8B!DszjtSiyRhqP4zfwHt(*_m6}ehKwYTOX*0`6Pifah!kYhpE?cP zc>oah=RZbn-*8Sf=&z`*na6wWsUS*+W7=QIqa zO=DIL?^*!YrERRYry&Bj5wOQnJ9weRylt2#_T{CwD1*cP7H{IY5B*oY_F9$ey=?j+ zOt+q@Z=F9i3hTY_c!#;P|52Ks)a{DR1J;2wUhk&3#JbC+nLirig;$k+t8x>|F2>bm zlJ$cl73Fdw8}cL2XUjFJ!Zh!_+hu8T$a5cCjd1EQMZ{t-|2b=_@Y~sPxZ`o8C`;*C z_AovH>{LPq{S5nSk9L{*NJWd|FZy_;P8H}2&iMsekWM~Crq0Se#|d7T?RDfOTonSJ z%3EokLaGL-9v~9nqfRg=7JjvW^pM(%|GpPa^eP8bs|1*wGeRW|^}$fImH+7#?}C66 zYi=0b1NF!=j_8xww|$mv$%}>-zues7UXt#xPAzW?1#&f*4(f2eB5h_iEBN|Uk~@3vddNDd-^p_? zq`4kV#=o?E59H^`8-0F~Ija&kG(Nk5^StJDNQ<%g)kL~!WY|RCAz~dfjbKv>br&}H zTAtUA$J}Fm!3q@98#{&==1KUEt3E_Ek50^(L5>$w9CW#%_GOh4qY@wI)DYyPXdc0Tk(s*TU|%I#*Gx#o%9gUsfHbWW;c;Kw&c z+x}QuJTZB_b2%s_42#`|4yd_3@R2;6h=>b*T(f z-p!y7)R7=%jO3hw@iO&47ed{-ug zhzzgDCXM&wKl1NVDHCe=qc$8qfz1^HU^DBYsN%G%@t`sCO>7BhRQ4gaQc;>>^97YZ`{Bn34qxOcKboeC_L%=#iuhwd=e3f1n^v*i3%sp_TB>hA%?8rWJ5Y;hZ@&T z0Fnc#5rFTo4>a-I4QaXqFqr#on3VGH`qhpoU%TMG3gPALC+IuTIShNRs1p}xMfZa< z=hq=Zns4zczz=p>69J$PB%V7D(0a< zc|fDTx_W+^2nuYLYr+?29ve98aTA4?eZ9rxkc)Kj!{dfmgRF*>*8PO9_O6&bBqf1= z40wY=hxl4U!7`kPTVIX9a(v_PGelo>Unl~2^ogbkP=Lv2(ERR6l<;aFk|0bs+eBw0 z76Xbr=pwu(`%ZW_-olYa>Htd~%mVSWi5ffV=IVO%a%pBM0%0cW_OO$(AtmLjVDGVM zIxlhsQ07`es$1q#-ZYM1jg?*Q@P(A!*km%;1E^e397n@VXpGBf!(24RSVkF-`E%rR z+MS&dli+t~(r1SvJReZ1-Q3~#pAZ8`b2aDuN{UUihO{Ws*Dx8OuS(xCz+m3}FPL*_o3839KPlg{Vlme1>-Sy z4qyH>+??Biax6(R`uS*<2a-^U*@4#U_p&%rEzCT^r#Y!5u%dA-PyKI7C(Yy6iqvlg zpFJnGlX-xbkN}40k~~JhA8Ew5nQPBVsAJR8Nvpkp?j6UGwuck3#Uu$O0DNka0k;k8 zyH{NEzj4|eg|!0~^;cPt7cCso!fbLz>x8m?N51jD#UM#y z_%%P{?xrILP-Y*^ThC1;YQu@wMBRHzE78ygOi>Lb9y1LB6uJ?<`HwGm|st3%0C)^bwlZ^gD3>CR&Ukl4#9j{O}xrY-Iba$?<4&w zFT&cD-oMh4degRRbziOe*uu%Gh#RD=)s0R(TK0Ik@L*F?pnVNxxVQ>Vqefo@ykf;n zc1yzs%B&LoHMtWbw1T!ESi3NEN=79>CkcD6<8?7ZBex6h9To>>4#J$~ThQ{VI!h_; zpX6XX6?!iX^>XlY*VP%3cM&BamxoC9KODv6KnGFyToFl-b@L;!j;hB8c>%%luqLx( zd(598y%o#IF}8J!cp_Ao$r9efiYhFlT=klq_}Nt;4O0IgXth!xOwu+<%)l28dn@i( z2gSMwNoo{R4+T|*TMG4!)%FiiP^bBtChAtOsuccKBSw;%?N>F zuysSxW+;;Z%z#`19Wt|BEmdG4;nk1_>=Hnq;C5QqtK`?3s9GGjdFQTF^_-cITPitDP>o03xfPs`iwkr z(`1eGxy-IYbZ{i;VoZBqpnPwy>zm(c7iXoLI%Rk)YS3+Gr_kOcO(b#G+mF?h)Yz_b zZluyN$&8+A>=~*a=(CT7rnBB^CX&F+l=xH_x*``LSXhBsNRxp-2Ov@Agl_x|37(tl zT8Jcc0#NVZ%%xM1GV^#LMepV20cT#QB*z)Cp}&2@4^3;gNY^bJzVVkp+E_j19Oo*G z=!5S7CBBLwaD0$6U_NJ*+>*g{W%4+2GM|+_K=MWF5MJpO4|Qso(CKb5V8ya+%iMO0 zLJB?(il}Ds&|V>l8UR!HCq`h3*~?eF>VcYUbIAws&q9w}!-t+* zA+znF0_)y;QfQ8N6@V&}@s}sD^sLcAbU%r0{t==lhMX5|V{8%LDfAlwC|ZRw^T+j6SQr^+0zH732=`M2`MzmKU7XL}3iT#pEaKg1J^69Y!cw}bTfta25OZzv2l zY>+;?4H?k>3|qN+_*~BmCT_v_H5tfv^!3V4vCGnVnuMl2vyWQ9F^ewJ@#GhqSsaZU ziv(+uVuCdFnp-B~{_~Kl-*@L?QyF71=#DuMJF3Ep?;*2?=1`C{_G=DT(o!hBlH*_j zRmy<}c||-(@eww|pcZK}8(4BS=Lb!1W%o0`aX)%)OyGhQ7evxaETO(cJUE@UT9dM# z#bm-N%O^R@s}ZDKUgVwRNGN@R!b2DvfQ{neJrelg@SP4HWQr*9%~=&0TpdsB-_JC* zvny8F8h_8<&6=XBsM&xuAHAp72@%dvg&x64*D5Yy0aGycOiAuGe{*T3wF}%#d_vnJ z+aU|k>nnzl1<$Oa%!Ci`X5FNdq@hAQPBDeKBK{ZEss#H@qi=d+?~*J4-~uF;HJQZk z>rn)b9#_RI8>gEfA!8m`)I^xyumW#!O=90h-Q>5v&rCx%6Y1S*?CewXYFcB;ZZ?ma zh14Uosx$H++e^f^UQhSy_TO9GO(qhoe+*eQ`MtC^PYs$*AK03829q;(=JtlxMBcfE zdzukz|2Sp~jFrzn$)Tuk)N%n5Q<%ez{tz@CG`1JE*}`ip zw0xEGixSV^G0VY^pu9d({%m3%A}<7>lXY;yCV;+J5=ifM@LbBna=uZ038TLe6{Ilf z-!W}Zw;#i1)?Au9l6s>exmJ^XteH+c*9mS>k29R%%rjGh?lAtK@*R|q_P@x~V=G(& zCm_ZtLLK<#aT!;U!>>LRnW}k?b@=XK^Wxui1F-WE@Dz(S13b%`vmmm!P!~Lnk-R~= zv*WtDYU2+p9BKzr4n93G{r2rE6++{GPTwdmG}YZmrep55i@Gm+%x|}t?NzbHK2*VO zI1r%1E|#{_=BxPl@FE;)E0pnU)DDhKT(O&ST?6<&Vyh-nm;q^J7gESM_|C8 zDJoL>LYB;Uu1bnsnSU&?Df+Quw*8PmL$8mIl}U)tjz#9+|$GuTMSOC z_1XK>Oz=Bc**N{TO>W(FK0-^Gunk}M5)(P103mbvpdV0r_6Er|6+kQRrL(si?5yzi zu(>Gy;;Tb(Kt4web!foVg~dFNv`s~-v)|IUs?8iIa?n5omCdXl$Q-d-^8>u)-D1nwO;b=^kKLWT?~s0hHd5)x~e$@peh}F8Us~+=T4!2_9zDh%^ot1yOHuW3eYhinK_AR?SY(D zBi}dLD;q!BQ>o_5lebDZQS8?E3st(bq40NHryEQ%%on3yMFfhC3qqAD>^thr6+2P}zMSaE zb+8-R?zk*dJV6v1a$ch&9lLGk^VXzG@SJ7N9<6Ff1GR{{P`t_(^&ecd9Pm2HqXP#SrvS_e)MUbAC34S`ow`&7$Cb~?9y zFIEt8KfiFtAe^*S3sA0YW7O0L6c946|nfkl_c6g;0YfFe;Ic+*hB@&T1J9+TRnVv7+zoX&SDGebzp2CimSh zovbpElbdq2`sf#u2qc!nIOSgo#SLFh*ugV3qY1{q_rrpGqxXCW#s&E=oWCA(FvR^p zmK`Y~zL?C=z+an@!5`QeDCWE(v!Z_z`)K3%hyAqG{Srv)!0F*UtKRy~+Kdou#+k4* zr49%G09(#ZU{~sF0K{=tf*axlwFX1!G(I4CE~clIBDO4PWp4cs;>X^)wF7BFQ27^3 z@g2+;e3pi|I26n#X$wXQLW#&6L|B4=4Qe?WQ|#N+3x43QEB3=X6K`uEe02?C-#VSw zA}%t4bc=T{T$qDc*|eys&;TG&nc&nP!X~ z=ANEqJ@RSWU>_kWT$G>Ux$&Z@dC%WaOZVe+A6j);J((EbZWQc?LYy0Git=Y1+PcQR zmlts?q6P~mU=1xbzQ#(U4Z!{JET|j&hc}~$@9DTP zxV*=e1G%|jW)RMXJnh9(HBdx_6t9Eon*h{*$f9hMFwmU{WSC|`M4fb^3~y6OxK(MQ zT+B6{6eW;=J3A~B>e}1X!pB`1>wKMsKNok)wvX`QzeFFKqKW7iG}%)wtHuI70#tlD z@plf990Gbf(zqrK8;5|R7%yWh+S*5ednw2&{R)B&#dh4NsS19!^V*f_CKy`?Y}k7coqLERN)Hk0FG;<9U+&IS2%lpP$8I2ABKaw7 zLvBYlKaI$T=~wwR0`Cro7lYm#lM*=S&8NH|4X#^2JyCuOhnxmku;RRXJPhnhX)tL$ zZ2)p|npxg#_ouw25BAnt&d~V>nlJwLagK6~;;$35*7KZscX?JOyb=o(5mNmYhWH8y z9cIG6$Ro|F!HlL5a%Lghi0eAG-GggzwZqs9?TV#I!c>OX_HC}L)HTf1e^Qu5an$XE z208{cSKE1rdkNZis@T`AV0^e@o0ham}K&pC>jKx2hNFn5M^^iM(UWwWA2m=^Q8LBHA7NPh}oW`_-zsP z`E+0c!4R=^N^o!%XgY>2a^9Q^>hi(wf zu=eQ%!f%N{Tt((4h^hC^zy5D*=;YMzmH|yO{#(b+P5R_%$kR6(Wo!$# z)W_q^@_PfJQ>;;}a^<>$Y^`lescqzk>krm9tz{*`*u2*DBi%F*nA04C0ujm+OFq>F z%kjO(fyyF!98E;AqeX}%`$1+11zFI?A-0Nun1egF;m)AO3pSG{^3fC+qG%>U{D*gE zxp`^vPD}iYAUi}Dj;wy70NWitfZ`=!y?|Kk|6N;2$0+pT-b#XoB_tdLyt!@q0>@D- zVy~E}J0(T^Th?xh$KeLSs&}wDlMwqD0H12iO@dJ3Q>jE=R6lLmqXB4(mI;KOQ0%zd)XJT0Z z&H%MYn`oU?n`HOb2T+Ixem!&{E%o(DHcm39Q z<(t1VPW@HeGaO?&qL*{jW#HiSBg+~}tNmT~6XlKOhCkiknaWPnN@3Jp<(_0>l%;N@!#n(|j+){$rTob=J zWBB9RDHKR~3S`7&3Er*};F$2TzyMsh0C*jYjr-!<<8|@s6Uf z3^e5i?^>sKaj}K!<4%%quNQ-a$nPg8!q0j?3NXpqf|5}YAjfEf1pV3kCrsM+*zNjQ z8#;1P1ndg@n14qRyj;e_Ktpcvk6LUM0mP#(X!~dQy5MB)3yfm7hszDq&4{O^sh!k5 zAIwBV9<;HMAO}ygHg8*&Kw-mPT%h_hf!@8l=57Q79~3+n-cG*zxalx=At3^nZ~mQ~ zg|<~fC3ggtZ}RjBukQZ&(D{X2ge)yn#SoF2y0|mm;a{yMYy(j`21lO7y(wErj5Hjp z?R*%Os`p}F#eAR^9TP8?ph*hHAxGKn?P9h|rG)AEh8(gyVl|U?Jb32#^kt*HcdetF znl5drudw&q4))%BpajBXvF9qHpOh(kWTX`EtcUhCb>JjHOzy+7N^?V88r{D^PDo}? z{zB(vkz8(i{IWIiq=rbe@`UtQ0|{M)w%v|)rNbLg2`UDZcciEVOCm)KYY))g#&R&({a>?usbarpF>c390IC7lYM7 z(zW4ET=S*eZ(DxlUt4Ij0@lNK!`(6kvO2#v?Cw_5HLG5I>RlVS`DZg(!ee@AcEWS@ z884jMHcj4(nGXq)1oCXe6?%Q>LCPqbC-9i*A}fJN#05nW{<(x!2_uJS6FN^qdfT2} zn7X4`OsMmRl3BuyZyQKz7XRL=K2M(bn~U%i!ObPTKPIyh*?i8&C@%a_qHWEugR-{0 zJdG+|dOF%xo{(wT%R8X(&D)mAZ)4k)thVp0%^-VH@5X8i*j^bwsAbwn*3CEvv-z#N z+|2Vd=$IJK`C6j3tr9weC8WE4=rqi!kzP+9*<)wgE;$!ochx9D$ZKBg=JG9G`d2i? zMg8=Oo)*94vii5H1d5QD;W|N{F_gbhJgNiz+2)$1E5RfQurxlyA5fXXRp~J%4Q7T1 zQ}*Fx_vj8d@6oF*E1YdB8%mKIjd#%hBJ=m6ewNK!>g_70oqGlu*aL3wzF&iZ0X@Gg z4F{X}MzML~uiH1_MMzEJCGSXvAi3Z4%i~~^fgr(idbrgHDZ2hw&~}f+a(x9*r`g{8 z*nw!>%zB#s*R`8wOTx1{?b)~|=4PFeAXt9&I4tG6Etgk_m#nr_=U;g>^$)~0b=RCf zuSnPysv!G0wxS1jXx9PrMBdKDoh^69$Mev)y$fS1BFTTy6g{ql5l~512F(_p9J^IG z*fd1?1Hs4>Z{#09^ge$N0B3@eK$PMB1Q697MTn&TnG@^ z!-3fO&_5IBWJk_5Kv%KiP~)Y@7Y9OE1ZFDvV9#IlcJ0aQ3XB>J#;GiP{LvVns=bd(WxS5XHA->VoW1ABLSSY` zz7<9xb2x81{#^*aJ^F&Q+cWYc?fX9q0Y`LBbnkU|dh59T4ppmSf=Bn5-86rA1r0b_ z*@oWFs(frDcU`M28g`pLLz}G?%;0;pXT$9A8eHMl@AMz5SNs6$nR_p2g-e zrH}nE$NMMHc>F_=1nl6_r95uvvjV9BcO+ba&`7D$HybkkD1u%ql;jv$$ad_uR$chKAR8=&F?oj zUOY<>-kRRdCp3xy-XByWoW>bl%JPJXshGrYCb>a;uOuh8V69kS-@P@xSnWAxQtW-h zdtA@nT=A>^B8w3(qTxG38Ab6^2CNz0e$E}9zD{5C;UX)CKFpi9&%dk7&)$Qq?3A?p zUE&)o$%tRAs`NfKDz<+1IQH2t>Fx_V-`l1g-4y%$%OW2ec%71$$obqh69_1?7I_{fsI!k#^(5 zfY#WaqJsT1fZ_XQ_e61}^s!ztdMY&-cPpS+ zzs}X{N@Eq8_P3f$bIo}3$+(2}wDFJk9dGs-Go*h&Y=h%}H73wb#iau(Yt`P49fag%w zaTs0d&G$aZaA)Tm^TJo*zc&5z7?O8;RG0GouUUqUQe^@(JvdjN@z?)SK+T#0I7Woi zEBMid7yu`yV%m!x0_#>-ctGM0n!gC~r$e%bM%0b&tAlzN3k@M<-xDTqU&J zDY!d<(}GIgjUloWHlzX5&ySsK3kSMtZ2Ze3N$Gp^rGJnWryI94Nn zyXAI))v2It+{cM$$1sKLsLctrlhNsjRb9%!18i7i#H6}=A%Pe=H*l&1ziB4XYWQ<4 zs>S0mEVb>LFIpMSJFk~Uv6E3(uknkFiK6#IveO=jm0dq=b9`}O(j}xY+ zg?^Uja1{;G1=z`)$Y`JHNb-Sc&-=AcCTkTyUI8=6e9pZ^j0oc{=12;FX-dq!r38s1 zMQ$8K zDYFKXha2~e*9Xm5)?G(ao{`bE6Ztfns8`S9s(uoM32mY!Im^b2(h49jwN_u|el1I- z>NF{>rC=56Pr^(GhKD@AAD#DQ`rR$J;P!b5)>rT{DK9k?L7_G$TYJOU-xxgUaOt)| zm7Z4e-js61t#0u9{_+^BeFQT8HfeP4xlPxn*s#!?8GQb8=w$4x&pGwNNQ*ZcHS`Nv zZZ10))h08K_3o`;%La`GImyQyft>x&h_M_n@^|&~EIfrj)-*Gk30Jfc6xjRee;Uzy zRS(`$si&nZYdoimpTx*lscgjo!^||}c##YHUlIH2?K7WACc4Zw1;F&astpO1@VMxa z?+X^!$qRxw3~8w|F9x~wMnPcTA0uw1WK+8Na3AUv-nWxGuh8pD0 zhwpWR;+yHc+y8Ubio&o+nCLoAJ`^cJG~-Y8ekFuA0tz!fD!ukgZ4Yj534#7{{RB9F zW{(!m7&e?a7O*_gG(tZ?13Dqu)Yc4XVG_=-VJ?Ue4bXLAK@YPy)gXAm2p{~38k&-) zy1SINd6}Yta^a0GF!jcAc5NJj2XHEWf?+<+Kahrdck0f`MAH5cQ?8KG z>NaZ|X5s*LqrzWpLg<$0iW1xXuhu>78nyPZ+bM;j9*4I4`yb(ns z{6D~Bbnl|rz)5;JtlDWKV>l%66@ObwSTP-yd3idVei?4yYU$AB6Wl<1`7cmlD%SRV zrVhR&tl~>0fT?5m{8_G*&>z_gX#t&WZLyk(K0Ky6mvI7<)3UTpy7Bc^!z*v#>v3gV zG4w;=73*31RpG5O-e1i=2{(!J4LBArJxIiuvORBFj}oi|i4?BdQhnET5#nva5I&cT zWB!;>T=J5OTKi!qxN};~rBg8gWxHz82*$MsGtDcF!LfV)G3Le1TD}jiYDY!w);~A8 zl%Z;mn5%9Kb^bWK9*)(U$hdGQf%ho@t^OFId184VJyEueqK5@b3P4H$VAoq3A>A4) z0R%I!FlmyA|9JIK;4{RddB8r*K0JUr(RqrBS5xtymh;2v)7{c$KK#y)d1E@>BB0MVf_X( z6}iW&$?|i-J@pj5DXoSa5up3&P;m8N?+AmHbY>~y?gQ&Ro1woqwu;^`8>iN6hEAo% ztR%0!mS6gMfJrF%hov7Pb>6U6JLqJpH(!eCwxcygaq?*^m}c5yTs%%%zGndF2T&1yR9H6*cX$hPWuIn> z8ZPXzsbvkPIH;Ar4Z6o>8KZtGrW|m_6^X!zBa#wS{5bVt?q?Eq-g(fAgvde|hLqNt z_l{e*P)MT`=Anv|xJOAq|QhXxqig%2X+03n&T^&TWhj86w6$wFU}ayV;bX{Y-yG&7C=#v=o@DGq zBu{G_1fM*H)te&2*L|j)34Lc!(JQif_Nq$5rm7#pDsujkpeT)~FsHlYIPqftfOC22 zk=5`giPFSQ=x&S`8ey=L(}p@K_K+_lN=)fT6QoRYQ>x2^eBt`%k*Yk|vM)Aw0_XRv zTQ0!~;7&n+ZA5U4cijcjuTXogq04&shn8y+pn$-eCL@ak2T9zDu0Nmp4&kAQdaM9h z?0?-6j0iD{r{4_oy+vU10*T{h#<19wsDFETxMLek`WaV*Ne?3#cO6Kx=h(I7$s)ul zBplPeMt-NmdkHn|QW@k$W47pa)0vZf$!oVjqgVkvcYDyb@mxZeJ?{+c1t7Lli!}l> zB~;ZcMynIASTtqv7sK7Z-Fdq9eicvRu45*lxx3f;-Dkd};c6jNqOB#O#_fMs_;Py; zmgAl0W}?JiFJMC64!U+Jh6NSKK{&>+d2F7=VqWNe|G3Sjzr2ETsvy7XbfV^)ma=Oz z8nJ%!uxbu@ak`R2>Ny}n)EP~W5Fr-RHh?lO_`6xyZK~G`u{!(C_m+42u}|zvx?FO) z)-z-d;c9-|_2{CBaI_Bg!m{n?Q~vJwvr8Thpgd>6pS>ZF&kygd4Rad{%#Z-Rm#P!o z3kAuWnaFS0Y!Os-UR4-$j`{o852;;ucicLDsn2R2Zg>Y-cUa}Lt&ju$*6^FEJmz!35eop?|1Bqf|FT|Dm%6G@8T zRi?(2u1kTPy1x?jA2|@cTgr`*S_sQm#*y5Q|i^zE%3Yx z5)J8qEgTPFCwo*d+mu+<$1y%FjT|j&H?E@p|HY7>+E(S0?kE9V`j&|P7VP-yXq9+v z1banL;0Y0B$kXUB1@^Oo`Dd35`BLu*$rwWSjs9?4wDBvJcK#vzyH~S)yL1{|_Sv_+ z<;SbU-oNexTUa6zm;1ec`Kw9A>s}{YX9pWmMSjo5bQc6lO1$2H+q630+KgZ z8l#i<8GIs*Hz8#043ZsLvMsB9zXa}RCoaye<*1-m3E1i{W+($qLo|@*ycZz~P(&e5 z!F4x*y99Xb&e#8V(>0`|Adax7=DZI8nGgKodf31wzY9mYH9?u;rvP?@bN}UgD*+4(J}=a&;}`rfOU-cAYdzc}S${oOiK}~@45_-_3sBY|YavFs zA_?@q$SG_x`m*%Nk^AHL9A{}iI}Fj5@r6yh?OpC&U8=!%JnD1v6Jt=7eFSf4kG%WG z5_Tn?*~HQ2zbyJ_tRV#*`nw6w9}JbW`X#f8jlU1?wq z2Ac!=B|Z;~ z0MTtID7BCW&(RLnbB``z;703x7;{g2G)FmF~h69nDJp;;K z2FVfX3=o;qFAYE99>{Od0~Anh5+K+B9Ao1QfXPpe`~4IVU3wPvNvoJHl0~IkyWX04 zgQhrkCS6p9Ddo)uXtCCyH(`lal_KtE^Ce6s2j7wSX0j>w2B&SP}jj=z{Y63D>6@3;J zt!uX;uEop7Pg(kgFPmO(6SlFz2@)Gt%FP`wOj`L&c;Q0LO<$oicN}7QWqT}Tq5-Qz zqm*Qvq!DYri*(lNF`-N-RuIJ)VsJ9~qXupslyBwdHs5w#O$u@?#nofXdz z zQLHdeO7~N#jAc=?9KjKGbWQmt!+H%cQA>-#^L;Tnsgidz%F1iPEBAh$1(t5wqcp0Jl2YjFO>&>Ja2#1kd6Mlx-id&MKVCj$ z@eNteWL>X`tl~MnuiB4N1@WEOmD7^1_IiY7*^NM_ER4ps0#7Lx4)n+B*STcspx|E# z5FkrjLhraaMLrKdgtvp`y}0#KI#y|ibRKn3tHQ7Pq6{7iB8*&k^)?FXp3BlxIOkur zVu=`!LQ>Ry_iVv`6lsTPII`atyW6sAedtn2Tj(}q%ZO4kk8S<)Efquf-F-e2oB?E7+hEhb)x8ARa-Nann6{MEHP7ijVV7e#hYm)ydWmQD^$*Jb+J+Ox8>;`MNCI{wCSz$)zJ zmM)*S2|Xbed@CN36Xy25r*-@ZvQ63!M}gxty!7G(UtsVe$g+eWKTG1&IJXz_Elif) zOMrvEGr8}Az$~SNP{hfWBP=(tdU5i9i_`BkCn9JQ_Tykz31sOzM~cvRaW|eir1^42 zDOgjFnId!^MVt~CJrp|+vHrv=QI~Pdo0U7W?m0l`v4+gBt%N`V7MY0-D8QexV!6L# z8b{jTG;yTSR+|ovS(N}X?M7{eu7*gOk0kRpj#-#siy`|~ zb5`(6+D(?|`P6-ty@dM@*>ef9l-`c@5Ns3m>$_l5E;@W>ZBy2kM+~VcDJ8Ld>jc`J^XNiB{ zm3NCT02Oesh$bEqg#83pfP$DcL6-^Ji!@u5tusHp1!k6of4~^rAg9k*Fse=9sN0!m zWe9Zkud3#JW3`P6uzXhqu}z5trJloKZ%_`zp!(4IjS&LWBJxGxu#;zL7Q`35HbJ)N zBO3wrlW#lH6jJogaf4oQ21oZe{W@^hZOen7zt+8vW?b%WGXQ(d5!vnQ$br#~ljac+ z5~4K&Eq@#f;*|v#WcRuJnGNg3O_XxaK3aAGYuoKrLMD3iCViz=}^c|r|I%Ng^s!#x8je6q~gPHZp=k3B7OA_GY;Kl6KDdGjMMhp)4`fwDMn?Rpun%VlBHDs#8FELATB2JO}E8Y%{UV}GohqyIqqK1{ed-tit z5~ESuF4@vfGIquayhRSkM@?F^7bcTyfCon-qE-Yf&a^M38Lh$9vCZZ-e268#6)lKU zUPTs-_X&=sB);!>{T(lV`Klz?J+RVF?kmYr;X+;7IRV7HFo#$!ooC3l#aj|p5rQ_ zuv73L2<5@6&x&_xMZ?F}n)h<_L{7O15^_cOTnR+koG*g4* z)j!J7>e8G4BSQ4;udXme3k+OZba&T=jz&f14Mv^26EkGS;uD$&zm4NZ$=b+ajC&yH_wJe#7dqGHBnXZQ;O=qZ+0NI4mYsWbuX14xf1fT;$i0L8zZ344 z5aJ6NKdcmi(VQML6O#kW=`9ixE%NY$>nRN(_z2tL?yh5EAbr{I_C0{@#PAw}cHXFA zx_&BW;yP74f1BN}3Y7bErnph+3v06(u$_%oM6vD>QTCia`+G`SylcAkt*^!zoFSpU zEzxmggm4_}V3TZwm&N^GOTv?nLQ{%*Q$V7VEVrW#>dE^hc-8!^a9UTTh7NQ(5`Hhf z*ZmhYLM}yp)ShHFCVp5D_1XX=1Qsz4iG8fKT_!00dG}XTo)JQ;SAidV=8Lutb)!){eJ1qwW zH`yFzwNJ-w|Gu()qQRS%WTsvzR;MWRBC05~a8$1&dUNfs4DF>m<|jPk8=w;*Nr7!HPo`CL}T$u^_0EKWA(h z7TA;Is6CT+`e$}G|GW2(assMS3H4#Xd}w!OoSh54X^>;*vH{VC^(IJSt{Mq#<;}`+ zq~=LSCPsC*y>hM-@r6B8%A^Q!->_R&%oEb6<>Lb}8b<5RPOSvA=NKvVzmrmhPK)Lu zXI^p4>I9eC2>OV>@JO~0egjURfOfRt2QA+WQY{pYfb(x~hA@m&I`MBtsrgko&NC?- za;;Uxd`WKC;8h&hLHOeRzXiLgxWJFYHR~2y zNUaI@(F)TMTjQ~a^IQ?z?gkQxd!<$>&MjI_duy<6yvl?Wro={#+J!!=_xpDE-Ym8; z1qrgYnH_JZFw#3-u1yRPa!b;pS6W|&27Z;!hL$PmNl$?v)LW{+Zrqu-`B7uhOuR5X zBK04hW80z2E*kR8F-{_)ZIb#pY~ID1T9fxpXI06ioTga+C_rF*1U!*es7@^8`Ln{i z1NkY>W=scS@S5#_I2eLIm&NP9NJ728;Q&Em>mmME_Hd7J8+v#7R~DUqxqVsz>PzuI z#6QG_Mdq!cQ`ds{-#T0>yu1FFF)s;iQHLqA5i2R{Nkez{_m{QQDxzG-*8>c}{0p_W zT!ULn5Zt6nUR(Gloy)e>Esq8R?*H1*WV zX~UXN{+0iUhakx1346JJtVM0*^aHdPqZHcbqtr^ zrPw)ryV8{(X>p4!J)|{r7#aoYTbLt~M$G?u!*n;FUYl$5Cw2w&ff&SocF=r$)nC zAR%A5W%H}E|064Rew{$U$G9J7#ou15 zGc?i)C%+IEN-~R{-1sm)=x7X^x{%(ZL}96@#kKJ!jpFrt4gXav4ElyhCFDugbtb7z zoh`&jMd{EK1O4{sb+?{3K0;7@J$nc{ESXTP0r4Nf6ZlpTJPAQkr=*yBoTUtt6-p1K zojP%^+iJuu0ml`>P+#2PTI_YJWX>!wP5ZH7yn+XNq04IL^xG1_mer$U&%tu^mG-Mr z@m%V86gCG~mH)}mqiKsWkK4`gBmX=}%&TMFcAxgQ@8wz)Fa=UCp(;%R#Bg!2!{Y$n zh1e|bw}k)?Q)NNRQ`~kmvFD00l5jdme>ps@mV=_ID}Vty2G(b`TMRd(vO471x*>Uf zPkyLX^wU};;iG6=ec@9DQ7gf{R}Va-mu5zmsm99sv{yHWc?pG%^2Q z8Y9{P91-gY0r*8}Cg}p2pvNltv}AcyVAqGdi9*ERlXEwJh&SMB@hlSDN|4>V;?shF zj3+_S6pGqJDP7j|SLwq0ruI45Y#9HjRf%0m);D0dC!bRQxkCdJ7$%}5LR45hid}gV zi=q^?$~h74$rB#Id9)$g+5oY2LClbf&87cItO_Q=j)UN<>YFr$ojyUmBO#;7ZCZ7p zgr2NUWk#E)&pM7)gAaGTWXwULvLq^fym`sZ;tNg$y_*>`+N7e~m~m=L+D$nh=NO@< z3+Tt50;wI2_c=mjJ}*@p9NO3!PYr+r@blibO>hMHJvQ-w>5O-j@p4PW8PxbFVNiIu6XO)q z+@vr`cNM%T(6=S!;O<%gsQz78|E)dNoBYFxlQ27g?|VLgpSbG==JW>~xx_6WxEn6RrBvqG8>^hZ2ul!z()unx*A&EDbWGllTAw`JkrAq*m?T=lMau}9whIf4j6dz8ga%$I zYj#;j+YAicTDnu`Zk|O_LRAx7u1BrZWfU#jR4Du|tNmB<7)1H<blsuGgxN0yrTH*wT5b{OkQ)B1Aob-cox?s~Gra zPb*?xgg<{=*w(cK|F;ZBO$3a4^B;ioj)GI|X;e6H8ZS%hXN&b%zTgXw+s}G&WnYK| zLqXi%A)0BMZ+}StR9eSMiu^Y|-AJ&7Q-C`?h$`#Bc}&!tZXO*q?iiJ>zc&70(1Fkm z%Se!ezdunEl16~Ure_YsTb*%SRqMREi+yO~dz_9kGrHE~n`_a0@Nv+yyCmJtHE9Gh zlsSyMUa#|gv*!EGWbu#&{!<=TMG2`~`+WI@2QliE@wor|QNiE@uy_5u2zs8?KL=p{ zH1^bCw5pSuMMO|l(Xw~wpK?WTn}?iM0+-qD_i;<;WwfmV>NmHqkVGO4byu3<2QPFM`v^yDZ+#DmRdtzZ)v&>&yd9V1$As-k3j1EM{$!JMuj$I$JIDY z!9;JAPf#MRBbTI89b=6cCX8r>MjgJKFD8zcKt2xgOA(K?ij$ufI&b?-R|NFOpLK<< zhMx?#JYNMA6p6_r;=lD#kBcGpXo_YZn1y?g5vYjD>rSw$;UP@>m(B&xir=#&LNd>_ z8==LLtNZwH?X)F<47+Mw!yJk@NN;`ut&c(`-&?nH%1ZmlAE&che1;7KPzD0~=QRT3 ze-0iY=Ah(OpO1-vr#vCWczHvAKYUo=puBNGtez%7#bW5*_ z7w4~GR%iJd$oyHY#Z(2ye~FR$SNgjmFY->OZqJ~(AwP?H3KxQ+E+k$~#7)%yx8jmz z?=^}-ZlZg9xRfI_)!lizys2Ot^KgBnGLvtl^J7V^0Zmj!9YX=0QpL9RAa-l-;L%0t zN*wN*38Fi|T)dy6M{C6SUT<^xmy2yahj`x)Fr4`5QD56Vy(=+%F8tufAc{yzT2`{- z%R>xzCqezsUUCkrAuPEh{9h{5SeR|pb99QEVh5|X5#M>Ux~zKfppv;_c7rycz8vXq z7RzXO8AT0Ws;B*HN1dl~Fp)L>TnR&-;vcn6Z&@_Y88fB#UkJYtvwr)6 zrLX}y_~)g0KR*}TJBF*T(CJT_qt9h3ZQb4vvTu)s-<_8{k*XCddVfQid zP*pfbZFGNLY&MXg&Xouc{uelyv3x#((TgT~2P+1#MkFMokxPFI29G5JcoR z3>^gWh6qst;#kNq60(1$mg~0r>%LYC3^9DNT zAMfgj7|u;CG>~?oyOyB`!mcWdw{)sLvprwQoOgV z0`O2TV3ZgkS=q1OU^$LFjiR526GWf(W7ahGGnX7h@04bPKoI=#)SH{Ov0Crs&$c&D z?s~#kEWHrv%@EbSxiWO|7)!;AJoD0WXHZE}{`*$jxp+3RB1%V2`-`3Env#4`ldQOjaN(aif#q;`F{f2zZsT5%|<*OWlw zl~{1ADBF>z93T+7_>g5l2W{V!^JTC%ebCuqV%G*MWI5%@ufH*Qg(|LFAZ9zk{j zs5AjYxjjM*6Rs(bHp;pUP2Lh^^o`$})#LPk9L=L6XHP;)PC>mN3XGl**vaBIY12Bm z1R=69CDvB(Msf*FNxJvl(Puf_wo@n*%2y2JXlsgi)ne9`BLK@go>b(c4%rQQ%||~( z*X>P@e8w>Bb6a$z6&vwwJ7YR_Q^gODT)#(RYT+_$1`c0m#C5f{+Y(0w-gLwzwNeZ> z`Sx$^N1Zkg$@fF73e5iDO4j*z80Tf+6`k72N^|&piZ{-mr7r@m5oEDB8jcP`4!&tW z@%2I8<4fnh{}i?DyM*>VzTj98M%!BZ#F9ig3IPBlI&Ek<%?iK*KT3I(dmd%`p5Sqc zljGzxel)?`of~xDg%_}1e%QW3;q(K@^a@G%aoF>83W3{8zMg>j!u>pswvD6;N)c>_ z-i`-Zt48}`Cx7Noh??O*#Ml|m_n;MQ4lx#h!L%2%28YP9s z7_i-sC2yOmU91genA~i3vU@%|;(j>N>Q{=k%PX4NJPRktOTo{3(L@S-B8@?RHdycY z2TdddPN=sndk@eN?d?G&3v%(@8|X1itWD}I9?b|q=(ys_LCD@d$Z&u9qjuc#h;Xp8 zJ9C{N%J_)y%TGX!lS^t*{#U87H5EsuotY1Laq~j|V_#44+om$~WQ?T8*AjFD*i4RT z#&6o&gQ>ONkTV<`?C!igBJJ7UCa9EOv2gk!eI(Ra)>sl$u%J*^T>&KwEfN^+G?aJs z@+FFeyamqPjQsCzdCvz&J-=H`^tI3XVW-vWY)GG%0BprHNrx6hTv>}r0NCl@I(S90 zF?QKlaN%K)))av{{IU1HV}Bvki6_e5(=x~vz{?t*vf>XhZ0uV3nI}D8EVPpFm-!8RhGJOzBn!tDJSQobz_w#y8yePDe^@s6j%@ zB=@i19oi2oY}L9Q1Pj(9?YE#FLvzbD=-)@eUw}%^rfik3 z0=FvilMI%UN$>_Abr>a5M^ltn&X zZL~wrVSChJ|A@Rs*SW&S#;^nFUd)p}fEo{wg>M*93{-HrUSyy5rxYcs6b?G4=W1I>$Bwmbof_|7mXgwzWQJiVz_=w!+aUNp!`DGZ1?#UiHXMjGgY(WF^KLk0WbwMn`&7Jr`39XAP%6j$I#I6KO;qL?gFO&N$|Z zMCF;FN7!dmOcCU~d_9qhCTQA@bM^QExa&W$A4w=SHNvHNe-_T8UZcEdO0ebTgCb5_ zU7cLTlf~HnsKHA4r43Yh5l>3xPVob=f)TtSu>B2f&4KSADJ&N8+cC{H&h?D4O4}`_C`*-&Z$MTbO8dq_%v`$|2)ezp_A!IG)8M)n(WS z$3FL@9{(rk;k4!3sy6vmsKZ{18QuKUf1Cc0tW-qg5+ry+zv%LeO&#mx;whg`q*Ui! zp)*~>r>PVCid@`&*^Q%0-528_7Arhs)f=j%K{mh%(zGc--qO57Z<;R2U5x(Iw9ean#Q zLdR934R0(PiEaYHp9Z978#a1}ePMG6G6)8R#`zXL94k`=FeZABEOCf1>~=osoet-c z?6`)76V4)=;MvuY`i%Qj!zW0MCVu!=HMt1$l@$4j(Y0x3Ss}~*Y3A{h8!bEIub+t# zy}&4YEW!8s{YnV=O1xqB|2R6+K&aY2j2~OpLiUHU6cQ1hERm5?C`4%#8j(~?LRrGh zD9RS1P-H4vm9dm1%TUY^nHJebMz&FwVK8I1Gw=Pp-+c1r%(>71zW&$syS~zHD9@cd zF(eB$c+=i~qbRvz^H3sJ&f{0sfp;z{)*E|&=W?uhyXkn#MJzj}xut{lERAO&8GHb) z2S7|XLjmKAglys!0`r_9BRESTsS_of&i!@ocR<>5&bOU&qjhMu1oWKoqV95KG|QZ} z@lpbaZdBI1rPi5;UJ)7pg!g#2YHc9DzG5F_N8~Zk+xfugjb6n$rjj!URk-FY{Q4MW z5U&7w@}g*4oeA{yC$<1@BJUo7{b{11pQ z&1nz{)NOIU;X2gvh{dk+dT#fM6r)kExOq!>BiG91su}M!^tJwdOkXtEN+q)w>@O!S zh*)Sl(Yow+F-q~lil6l4Py0y$TiZD1X@v0&?7=QD-@xe^kMclH(m>daSe6_}3MWgA zj69ptHaCM#cr6}eN%!*^awU?=&^ntRx%Go6q#}|RbJ)>Yo3XpKCQ+?TtqNLFF!+Ib zrw5FkpG_Bfb=Z%`MhM*SraSbZsh1S#KNnvXZJ(Nz-I$_~7ne+vG`hPzFUG-P<00vg z-Sl%~9uPdqhS)H&T}ylGvBCUcuz{}7Oh~x%o)av{n5U7ZSXu#)4fv)}I1l)m*Dg~m zl_8d-Fur)m;SzOGyok0DXP*8SU!9ZubxssF@d-%H+%jnC3*00eyCv!fg16?e)7tCn zovc%DCQM@V5iH{*bD(^T2Z?mv?iZUkwmH;;RfZg{u|psM-himPR;(bW= zv9xX(bhOg7(;kS8 zg(@e+b3amw_?9n-au5jA##6CU=F;}Eg0TYRTI|;|lb{g$wyIF0>!###(n}er`cZt# zu8v3bd(_KDH2lQWpuR=XD;$~(6PWoQ{RZTGd20EpAwfd@4xO zvecYgz)aI-2=6fVQoCiKd@9`J1a+@~`tsL;&sw3?p`0d6!TM#pX>IiMYi!5%v0IYs zsiO&g;l|II^2=sO!r`;PEV*tK;Euc(dDBrXw`WBqnJ(CNVm^_NU?Lf0zOR{@=!ak< zkUekS;>mnO+%2MJ5fL2fXa#TmNsl|Zr5!9|~2qHQs2L=|Y>p3A$j zl1h-{*QLLaPEw(QJ3KHvs+)=Kc-KoitFT;8N}-|zS|VE5Qb~I`^AvyYjuv3H4L086 zA&qqg&(*?Uz@6`2Dl!uAAuJpe#+J{9c@IRWK-nWLgm-4uJB8ziffrRLS?NOsDgDla zF5=CVNxefm()$KS7-)$_w)#{Eh&lKc`X=-e_svqKSZ~i(Z{>#Rwk_Etybm5}=ZM*C zP4E=Smi~y>F(ngn!;U3w%1rpo^D(f6cV|Ew{p`4Q()A50RVQgP)fIvEGtUx-W1Aoy z0JGMES~vWM+%8v!+P+(gKt00c`@;R>=`D9;q1OnB=DzAD2eBKNaUyM;jYpG`45P+~nd(a;Pzc->17WOj2=VXVq%Zca%z%CEzz$jV=F`2q(*~gGlPZjKRC>)9j zcZj$-e*|tDOi?eu(#)73L)qLF4yf;WLKBt=c2IZ(yq_+=2PJTIG{MfcNRdDvm{ur? z%lF>;6bSP#efI&Ha`hU6r>UAhC*94qp^>W5XxInp3Ipk0{}Ey_6Jxp_Dga5D9e+H) z9u@qNHfm{)O}n1`7AeGvG4T>O8)2d~?g(1uvP)$TTn;S>->DnH-3Ao5S;F^&{4dED zBJ_y$oy*IOHLNpSjmMVCYZo4)77Ng*t6~Qhvxp+Gtlk_L=#~*rNmz9SQobDsv+bHWS(=a5mW+~A`5*(&HOIW#&n7U z08q)gv_rzRhlzACj&E1(4%|?ydhW}*ZRbQDtBC5rKJdonHsUDVie}I#IeL;8-Hckx zF&1WJVo8W6QsXNWfZe6B83RkVsobT0>?k)!&(YrTE0wrrNDY%hMC5$Ws>hr1|jd`!l8+$&5`Cbsbxqy!mGVJ{P?qUqIuM`&b2leil2e&16W|Cbh;sQFv z-;mp0kU4U+wPn}2NA)=)=NE$g%mmH5sFy_A`T}5pY{1@7SB<|i5Hm{b**5}4Jj{lm z015k79|`Kfm}`Ffsq6K2?k%ctL~53D^rGQ0;H?!BR;;-KUsSu22ocR zwmbAGmw+>d73Oo-?_Hgv4l0o~R==a90ZucD?r%3M`@y^b1t7S@YM=w7mFV~NpiGXR zj)bt}%uISX@@lnnZ&Sl}wz3mH-=he7Z+9}q_>(uBTp-+Nhjh2l*!A55lpl=BO}XA&B6;J5Rm;rNfW@57>VAaacH`KHrjeJwehZ> zu@)?{FQwkKVP4)rYxf^UhG_9ReSJUcBKCr1JS9>(YLV=p9Z;nPt*YNxce{mF?33bwEWF@=h|WMNn%jrX zhldy>Yj9tSdfVz$wHCeDioH{|%!6B1Req3Q?^Vxp#JczB4@?HyolB-e=X3+X*ZV&9 z<}^`R1Ui!ND+2AjuCePseup|K_G7Cn|33VWCF|LR%e_2wB6wI*(3QRwnQIx?XEFjW zZ3Y|NG|mWiscA9~6apz^DesX!ur+%J;;s zcTzaa=BDE|gukdV8RkItwaejpTPD^AfHc2QJzxNk--$P6pi83`CbKF^6CwTUZio$f z3`YKz95v`lN!m7PLgM+bv0%$FX8O>z-I(4;uvjUdHwLttn*R_rZElL=hD3Bw@n&GH z5$6}3fm^$6CqN$U^!~PJx74?oqa~qBakeaHscKY+a)LtC zukEEH>ew5$-ErSZM@jpX-aPrdqE@OPtOPMy(3ztK9pW6O87!GhWL^cX!?|gG2``wA z>=Fqw2~`z&c$6sS-QYvj*oxTdXSe84^C0iVfllL?vxq}?-eyfUgRi(A`Q}zq_b!FLlcx=aa3W!FGAo#YRCVl7;WOvC! z7d`=2afRJF49e4df%wE1s=VIzB*!~POjRM~3*m$9_ik961C*kc>u6oGFX(il;_&01Q~QNRX|gA>4`y#X`aHq=jqY5UqTbd8`@@D) zTkevHhwd`u>#UatC7@&U5MXiHst-n-HCxE7M$@40u*r0sh0}cD#itmr5xZqmXI$CS z_8+h2W+N3h?3&4hToGxLZJz`zV_3QeG3IG!c*gOVC|0EFno`svRbQaBHTK%Pt0H7> z<6&p!=jSrx_lX(6MlRVWhTAOexO6q|?PL2IVOGFUj#sdTIjJMz9@p2fdp)MUP1PDB z@mP%=8VM+<m*xUdS40@>Y~0W11^*VgTfx(`Yd->0mH(pWfz>XQ3+)Jbu0&yU+!E9!WkzHM(e z!l}1xskv#@+T^ejHhvBPj{Ax}O5oNW*P15RSgCjUXmPS;OYbcOyWlsI@yPv&8nm-3 zFCz`U-#6&TWWuV*!P2FYPlM1`+Lp2wF7J3weCAz1PeS=Qt!#ILA8CVyV&0rc{u|4J z=zY@qEVYI+P?6L%RvGj)12X1pO&++hP-2&Avpz9ubZko75kAgZkwIVw_$%khy%Q8U zy;d1n&KrT$*63^D$`Hu1m-8nrt2$HcTleJtOl&!_RVkZFv$V6)%4gSJKoon8G%Xy= zcGqjY5xHi+Y@-xOT+k+)$U#16P zrl@0xp0Ee7jQYkGOds63#E*P zRLse81(*%>!WAE^@L_5T?aYPlmFAYqjeUbl%Ml~SQ7^)a?_Hj9_$IyR@p)b~Kk7{t zhH^hzOR+kn@=@0-X6h;<_t;^Pz%3nqo2ZL3TLx;A@m{?Za4TXe*cTRgtHi(j6r?v~ zy43#B{dqj*mHnYRNs0hd_q7Lc?5TTI$w{Zr57VfewZVszuL8$P5{yOr*&iqSuhZ-@ z_+n;|6i1#vRIzI5-9gCpb_m0JO)9BWcsWCe=d3eS-X-3n@YX%1Z*qQEVw|a!U(~!+(fkv#h=*w|EXe%@{B}7_bJ~}Gu zaMB|fMQITr-)00A1p*4}encm*f%x~kez4O(bTt1HVnaVjP zflKvUkq2k1C@yj*OjAJT(b$G?(^o@Nj-&)GgoDU@a5q?GfD(oGe#G-g_o~Vz>fdHk zkgGQp;L^8_UoQ)gd7ErJB?LZGbL$${Ms?N?JIdVj=p$^_qa8C>$%sG->y!9`h^S4= zrZpg!0kM{4cl`16g{#fV8xBZgLln@dUAwA>cETIydP1ScQpaRLNiL%^x0Wh@6c#)X z#i*rp0xpP4aob6ktCG7nOm?D|wv-yvZJvUcqE&g`{d@I7aPfM?ymt%vj@H_#K8uJN zX)FmnfxZ3{vHae=(F0)jr-UJ~pn&Qr7oYycE0ufiOxw)MYBNU{fr=@>WmT3(fPR^Q z8GIS`S@ga;x%;21h%mK=uTPyu-BI8g<@?%|dhyZ1qx^i90`ahm5#sOhmvN7S_Phm= zeXF_z!ZIwRdfDV_&jg4)Wt__Gq8VbGD74yKA&KQctW z7zo};{O3us2q#vDeW3UZOLb*2o(GZS4CY3qz>OojTF8nytRm5S~lbI`sjht z*mr!f`Os0X?2&rHi$cE2H-atNZZLN)^1>r;*uB8m`?axgWSZB@q0qp_B!T(ij0p>q z;KMJgJwZB6#X}a#4TXNcj@sK9R9&|&mo&3-ui5ivYHk~P#aC=`Db7#=rxz*8ufISo zC6D{EC`ui)>^l<$YIv5?dIoOT4lvdTR?tHv`fo z*&H&3t}+5jWHYdv3>MwE5A-+!%+l>9K3)xCH9XpEHU;)!Q$jlEaM5Q_#)Zp!l&V4Rp>*3TI7Z2~cm7;Tik;0fT4uk==7q#Vk%nfP~lj;oXm$ho)L0~K}=t6FL| zMO1}Y72I5*0$0O8(DnZ68X}z_zTWVVlHR)iZ~DXNv{xWP?V@9u#?@$QAVk}%(gPLN zq+d%_IbaGgK%h9!0k$}o2OFhBHw+`wN@OVA%-+YI)0vaFuF3tGHUpK|P-P+Zd)+<~ zJ-uQy_srLBwwxCPx~6?iv1Uh8Jnu&LmOrHG`~Z9A-C5SBn`Z4Ga{0)X(v@7_ZPEzl zNv^1))VuAxoFItobArG3k|40_i&Ij%a_zSMhD@!uKc+@<(#zq^L}Vsp zhf2@o+u{$oU?rS!>lwFCqbBB*7AU`I&afAgLjRTh331q_lxFyf`0@CnXoHiK-P`t@ zpM!c6C)<3@4h{1jIlmebGMB<2pY>X)rKe79I;+UDw%Nf8efi0R{l`X+dwoZFeaElI z7nRWV7QTNa+NMC*4lBaqKutGFg+8ol69J?VW!-MwEvz6mbhn_|vB{%^rF`OF?A1r( z#ry<6V_?s7Y~RK)^ks(XY|1OuJ9G9_=x@S7hc^kRn}FTPnY0#Yf*>7(4?<~|M07xD zWj7YMro3810dS0O3Vj&Kv3e7d%jw`YHRjSrri=E&8+Cd&mG?`wp8N*O<=RaHs4voGKV#Y7S_azpAcD#+!4$JZyN2Hz0W$0M#6yN0;|mXn zqykC0qb%>Ap2-7T4eiW@)6kBnL>DD$?v?Yof{ZTfPtkb?V;?iNhZ-`KGg%6Pt;$fH zUYpe>Jx>=!f{tl*e3PIpQyQR*YX}M}|DL*>x5>Ni)t8_{9M3v9(!P5yeFB!YdER=5 z6w+r@_q;+ejK82 zCrb@rgUYiu-S~jJL+0Kp@zhU21qoPNyWUH*I(%yljz3SP(1uS60z@9?JfIwzV+#Vx zBaWvspOrUISyct6=CgM7X{Y$Ym8TWk`off4TtELg=#5WS<{4LQFIN6xJHk9JlyM(* z#@`4*0oFkO$}yvr)d_qjqzIn!rpRe*v)K3>sjvHFA=-klkwRRZq>YLbT`@AST^@g% zsth!oGdOhwb02$~2Z?LN%2XA_3NWc#newi*j;1+J*U)%C1f)7JbxPn$#+gFMx23+0#t{Vt3sjWhd)(5@Oh=UHqe{vU&YS!xrqwK}^ z1=R~2vdM$3)rhE{PSAFT6s$T;MkF`sE=X?$s$-uJS;?m%b#8GAp1}wenGZ4f31b6A;drm@c>2=lGqdR=1`^<2=^}1Jw${hY!&3ThuUeL>QB8yj zXM&3m&LdrdN`!vNpL4|9WNzGNGo$Z_tcVr#@&RII^IBoGdLh+FI0{s+%h4jZ;O3kZ zdo~#k;5RuaO(gCM$s?xMy4EqsVRN?=^Zldo?Bj}$!|H9>MP+=W^(5XHaqW+&<7arP z0KP%DyRd>*>Mu!9rL9>n*I|O^X(P4JZWcW*Roc9|^Y#u;btYnzDC@S!7KBbV(z0Js z8Lxtq67TYAF}sZ+ovjw1CoA4Wp%w^9W2luM7(zk_ufm8)qfy56kCw-t;+9?h_`=Y0KVge| zI34iBQ;1GA6ecB3J12R(cs62z8Z&_gbWG4KhN)`_&TDa#YNYG#C!mMMSh3YKcKqlV zg0*ns;^E5sbDj%%vyKTI_=rDU#1Z&ftpU9H-4qVSvUDc z{li4rSeJw@R^1~cZ2fm#nT1ZsXJxe;lk3gjnNct7b6>ZsHpr;5EM-65_}@yJXXW~# zzH_ws?MU51(!4`!#1Y$<;nj7!rZnP+;nZm-cCg=CsGpf(BP|Epkux0VgjPB(`s3=>8jnY`|x$iwoM~* zqq_!}>oMJLN6x?F4-beZ6@%2wbzp>=QN{rj^CnoT+N3p+Li+6&*7 zp?UN4&|!z#4Mzkz1)F+=8_2KG_bW)(%nhnq8G6)+9JC2Z>EYGPR-^5I9yL@9Igu#i zqnG%)!r^BKS!kieT#EqAUAnNV5oB`1kY_DI@P-dE|GEc)gbTrE5jXVl<@n{+v-7|rpez_>-I8W)wD-Jw^|IX@E&hzi z_+H&r_xZzh@!`d;$(tg_GN52!B^c{ya7DYk-@d)cPy)Ea#%*JMkIjs*dA1-AXwDdB zIXFbQ(>s4As`4WfF7(*v#yh>=$hRt@Gdk?V9fo;1GSJW>If5E2qC*Q1CuKO@bNeI8pek z1M9g|KaO7K)lo2W)(U3NY7VGCRvN$R>KjI9>PC?D)_Qauo}Hg&`l5#E*wZA4v;6vC z(w^I1!1hNn(Ide1*VGanblIU&e?oy~0P_fI%z$V9-wy6OW{!Midw*SNy=wZt@J=q) zPzEw!7zur9z7d8lf1z~{--qZz!MY4x_FH@^R;H&p`G(`EKNJ8psDb-{UJt|5hIivg;`3-@(JYh!4~hGE0gRGs-7J2~%YRW^)@;Ie?Z14Rox0YcF`Nm(92H*0=C;#|Ny!i*1^uCf_S~w{&KqyS%#j zVh$L!h@592l;A$sBT51sgp$d})DZi6pW=wxq1*n0b;)4t?)-Pz zfD<8CL#(Y|oAf&qoatIk3*s#g(JrD*VV~>=XR7Q*5H+#(W^9#a)H}mjWWVhtY9FkE zTlQ5~5^c9KWmVWn?!tyqQ$)iTc&&P5%TaQ5f*&F_1l9A8!*iE?v($RyXBWa~k2bhJ zmNjZJZMz?EOQogXL!3IZ#Ii7}e}#F@sK2J+N3Gj89$lLf5w>jJX!l}Vw#YLTR%ez?H6qusI0S$b-ptUA~G@6zeZfHQX008r3Ihp)vz+9pBVkzgA{TS z*XYkb(Uoo>4s^9TA;ccHPk1iGZNP12vPE=ZP2z-hotdBmaFiL=4^A@WzY<0op!L#MC`%d5Xg*RW6Pwlo%D;mFbUj(2zI$VNuRbM z$S2_`H#C^UY5;1`S`p&Z2QJNZ-!E9cjELNnG?n8|zB=jp_h((uJRu60 z$lHF*-Dx3ED8v=v^o2>HU^$28aNH+q$2qS9Hvz`!xnifa1V1D++j;W+ zPrY`>{D^OZcW;!wERu+7&Ax}Gw*E_2t#4tk{Uv5tf8eMpJVi{FL%T)fC3F-6BA`%@M_km1&FDV>A8Bu+8dY{a z6-FE+<}N?#@|ni}krA2DfQ*FF+XH&1tL4>z*$EW@Db$$i4m0Q$J1!SQM_{jsv@tuQ zC5m)&z?jh3A)G{O24T~&;d#G$uETF=Wa2lrE`mYWuSYwZEz?`wPLBJ zJYCw+so@9oy_dq2huK5l>nKMWH_1YNi)X3K^{~4jzWLul4bGPr{gSWIz;afHN6x$e z=jA)mw$>!8)`-mb``fL2D=Ev(jf@F=ps*2`Vv3JzeHuX2u^k^C0f~DlC{a%OU)gKU zYxq0bytTc1r_47Dpy;mVPIf(Ddu-IHl9vchxX%OlkM^OegUla%;4V4*Zk~-+9nAjK zCw(MtGCZkn!O5)rIut4LrF#0e)l`3D1DaYF_m}8Yh<|oE+?a&f%nQuasJE*D@tuaU zn0M8=3~z_a+V2-ij@W&wzQi*r{L8LW;G&xf{eH%Pbd}M>Ys&D!gu|WwI`n*t(rA+) zdPo9=A_J+~^%)z@h;n8IIg zzjTaJokrplz?ZE-2pqg}61V_v%UiJ2d8#c3bOSTdIFHM+zYp6Tu^Afit)sv6y<8y} zV%I&G%8dC+m*#l7%*Lkl*NZw{d?9E-_e@e(1$={v)-BOzo7}MD)kBqFrv*w(2DDf7 z{p@B$E!!DXF6<6}t2+T*xDjzjV_sggAfBEa5FQ|<${KH@sV}o~x)}?kasQ0m2X%6}Pfc4mAPv4olcy=gy-*)DfZveZ1+abGuajM~R)6(rk zq#iQ+>?O>6g{^fi1d1P!3W8H$wcz-A8LJ zFvW&f)S(mX3r4I&FRDsFjzJ58cf|TTHI*Zm5Uem_#-IA1{G?(B(&OnT#!o|m9picW z{w22H^O#vVryPBuzOkBtu2vm8-wm$sWmcO1|GiW;$Lh8I4!#hOUauxX8(|5ybSNHx zhhCWP92`@fd@i7aBi?l)p2+ecVRmsY9AA**MjGN6x2q!1Egj&w1{0)Njc6^b>4MyU zQ*4;k^RQyT@<&m#N9=sNiv5qH!is3 z>>$TEwkTA}jqu(Q)K|4syBdloS{Wg3lMN3?*0Nf##^UGjdDq4qF3ol8Iilp+Y)I5d zW8pg}mnnYz+(di6&5V&Y3hvb|yjbN`lUYXxI%A@gt;2e%$F_d&dx{Ug5h3cKWAzNt?F5n5 zF)q9=Q~IxU<+a(l`ugg|M}jzai`MVlfQAIu@T9kI3l}x~9CopjM8;9WoS~dkZ;gLn zOP&)CFp&0*mgzex-hkR|n@}p4(Y{Bt_JCGLK3?ZH@J? z@}>3@OLRF-s>{t&SnE1z`++hEyq6%Mcv^?U4%GpDH9yu;Q!L%y*)2;3ZQ65Y`nY-T z?!q5*7Yn3yX-ey&aooHrEpwmmpJ1y~*6BHRVz(SLk~YADHt4RtYK`dkbqZtMMoTdKT0u&f%eDLAhR z6O@wdmx;@Fw(u9R8LK_I!;+T6_`A!WuA_y9STr$6sIUVPM|Jwd`#&NYuUU^%;rqQ} zh1fO;T(L8hNFa7`%ninl_-Cm_5yj65{SH#)6(hVorhJ6uEctV#PEE2pRK3;1CWX%Qb<^;p1w3;Hid1Q9usdWQxh6Ff2G~Jharu0qIs4}h}}QO zELEYY(MMA^mH8umNy)D4yZi_#FJkWvzOjGy@sa$1hap(E*k_&n%hp$ZgE0Iydu-M- zJLp5n*kN!2YFSCTa*F{u;KXmjxaFgdsEf7_m((_#-8$VMImu1JV=o}|W_)UF9&g|K zDh%nXl`Pt3So{9E$NO8ByBB3_H+^qTI}&3yP5DSee5>q!e{{C5hY0g6i4(-`1$ghx zb497dPvxhi;5{y-5y9~;vy5P}GFk3F8{>fKlt1B1%1xPwZe=Wd3x zbG?Z!S`^8J42&UHCJ$={C02B;R_Od@fRXGQ;v-)6D;@qy!mi&(ndu23u#d@P;%QV* zFsa5__XY2?_6}EUTI$mqJx#8E^$ttm?ku$9TFQf| zUHHkcb3(bk>IDWkv&rWWohqm7pSxVGKaZ;`W3|ovlF_@CqR32ZSXl8g*^00DIIp6Uq|H?aIZ|i-Fy{Lx>Ry{ygp?AqbHuXcu&2MKU zyJB^Q$hMnE0k`Nz=aL=AB_O5q`qP?#Kke0c=uo5KS2Lp;q2xGC@|ow8bNqm%VYyUy``NZG6VX1oEGxEb zEN0wq2Ni9r_RQwqUzOKkMW6#|gx;KwE!(yW{O(o=Wxh zU$M!Kv|Xa*Q!i!>-~Or#%T_sywK82W=+3)$og_{p**4$tzk@xS7dBbE6lBM;J4?cl z-sHy1fpeYrkC7>F!vlwH)85Ig=LRk(GO)`{(A4ST5=r+BE%g?9m1j*8MndBErS&f&~SX_9}~5Afr})Ve|zufVh4q^dX<%wvYT}M=N0g#5+3dYn71C>f%- z`5q!^T6?HrO%(Uv9%Dy4;;9=)LZ_b-9cwzMciv6$3Z=cg4dK+y2^%;`cb@=2#JpLL z2~EI8N=F$%=S*sUZETxFM3VN5l89pX?-)m=@B*~z>;+9yULs1Q(ZB0vPpn9qsACg1 zhrg4osRnr$yr^1NvZ~wfjN8X14o$pXz2Q-moc16nEU1bUPQMl#X|7shUmobmYA?xu~8nb9!$!MjBEG6YJR;=v<-9Suxnl9E+LV_|Dko0O+(~RY3)|G)y0lF31V5A&SUxoz!bGx zad4)SC9NJBlyuZh;6w8FW=XzYRr+N9Vkv)$I{Iko_#5)JoV?}O{VMDO7I0eHmMMGi z<(H;d?w_990j#udT#|xy2cjH~LF>;8SW|>wDbZc{70bIs;2avXTK0VSSQ7kEvbXdc_^%J)ldc1wC?KoEi^VD+@+cxp6T(bs(;!K^Ui=3k1 zOQzijUyW#hc%6{P$R*Zx@yzxCVfP5&4^3;2UrJKC&=sHi5tFHfdZOO@WD1rsfxDNk zVkb1QOPt#@{@Flkj;h#c#c|2gmBwyd<4dEvRR5D^w~Q8eTA=i4JOi{l)3ARi=BF^r ztIOJV)stJiTx%Kq=EgI4=e@GNxoF`h z3WC#zx)5nPZ-F-fEbGP1Hlt<5N`;3l3<3J z!;|dm21NeJw0+ni z=oG>>UzjpodMZO-G0DImYQx;0ym16$hh0816Z);s(@a>$z~k3Vrs;|uG@s%@`mHNY zXF}(_|IWRtIWurwCTC^A_jU)@y+a7}j!i~HdW*LWZrJ;qAc1SxL(JeQY9VmyQwROqqG;W4*3N01IQE%KZVmX- z{#y`r2FSv(!gfCu$U@a3pc5ryzrC1b=iHX8<#+ZK(J71FcmWd@y?lFCRG)HVKYUxX zZO6i(Z`Vq(CLW>=cH9&V$UXj9*66zlxs5amia;)G!do8Pm(1U0I*or8E#33ydqgAi zFR>m!-R@uZ4w3q5hZ3+Nd$Tlliu%Hjc0f>;yL70x-rlcgCQ8uof(^4}_mabtv~%?9 ze#Cz?bqJYRI-MN-p~#JM)mB|6l>Ue%CMjYM_PyY0P3iUf_mtbWYP&pP1ahpuAyFE> zyC9qaUp@aG##QCJ;qhtTn$F8~(=kus(IL7VHO4fCL&5O)Q=zsO@gcmX+UnxRPX3gl zBYzzO641q+11ov_uQQ3xBI7mdnpU@aS|0&StpC@GWMt502l*}W^TNx;p55zBPhEM6 z8ud8O+M0hgpm6YRqbH9I}X!4;%~w{;t0!v_*W$h7`9}gUIwERx?gdZ zBJL?%73Z|O8}p+gs3m2Y zzirCE)6O%CdM651HN=B`3O*AuU3FVkNpm+siBB$_?nGRy=_^V>aw?CKPl6rkRMaL5iL_>Z81Wd{@v0;raSfl^o(#1a@#5R*}r;==&1nb!440{U8> zKXS4w$O&NU(&o-8LeVObSW(kIMx0PNCLVMYoPZuTfeIxYI+m$fb@b|Ev&pEwU384S z4VJZ)6B;)8gI3qDSF$UyYeDbm1Pz$eY%(0Yyo$vlj>96X1%FUY%8%B<6Iix&M0b9` z@6r8M&*mw(hLIwVliKB5jkA?DKca6a=bHgP=-ah4JHRMe+_{`Zc!WUO7%0-meM7%i zQ{xNu;L5;@_`FDCow0LTF0O_r6dg%hRyP)vATsZ*5cPE;v8vkZ49;Xa3{hM02b-qU zj*baQrtnR^@vvE7);<2V|FC`G3Hc?sMiO9-BM zekU{~{o4~$F!Ro4*ND?%p+aM+^Jm1&#R!e>?H_&*V=k8?C9e z*~h#oUY~r8jRGEBRugnaS7>PK3X}D4kKGU}7VU`k2%h|h)(7wKZ+_%RP>tZD>F#@n zlS%@<>vpr`*(xA&F44Q^%9<%8mV|cbY4`O&9Ddu7hku4WKl$0-2)?8IJ4M_!M4)mt ztmaykztM+1-%m#;darEy`cLkGFW01Zjf3>v-wJR%{BH1=I`Cn`rK3SfxxB=EDJk40oF(up|!?PTy?61(mSY>$&Fi zbvF^{O^4o#OL#r7R?lS;*HE$-WHXu(H|70b>oR+opyq+^qZ#YN&G-8cEE^&+K3K5C z5b_408=&I!W@l10)bvyCH%ZSa|JG$#wa3chAf3XL9&5}ET+ZbyKl@D2O z0up~aLUc2#6LGhuR9OS4a?k8>QE$iNg?E4S2%AixC7WN()x7luFt>F|VL zi7A}i0r@uP@hoBPJWpW!rl%ED z0t~h95Fhuz;RRoih=pzb3byp1p7bGiyH=4JT?GKH!jH_N+diN{oPV2}*l&)u0{`kb$e0Udo zzhYYlcPAUXu3RPmS;K$-2o3GjC&{3=LT%4x{x;t<+UCND<^tAy1v)*a-Pa(+M>i9K zIP*WrW1&jtH=q^HZJxK>!126v`MiZSv#}_z;dwK&HMsg0|E?r?hJG6Xx+nwjx2x*V zS!*xkV#~K5h*9;uQxRyYf4aM>QX1B2w?VG?J}Swnj=a=&{M{8I>csNxgUb%*h+x3d zK9VHatz0&BrZd^pG-ZC*+3ph(kY6E@%pd;D-p5{!pCG!1g+&FV!kbKME}@~MM7jNS z#vg|KU;Liv3nFH`t*-NVMNA_ce%q3CxgnrL{xY3Hg*t~S5MgZt#J6Q#tA1Y3Fgus^ zJhG9&$(vW}9n%CF3d{TXnS3JXvOHZ-KRM=4MOE(+Z&Ey-m;MC8@oix}OOc2n3>=I}_256)D`}H{ z@y5fa*jv*V!qy7~oMk)H&!Lh-oT+#|KSn~dr#NczgqLYmo4ofHv~ggi!Ot6)-DTee zzX>#bo^?FhPT|i7p#%8l*Nk<;GP%MX&~^aa@tBfuZxG+Aq{pf(>JrwmglJ*-c`f!7a{9NcDr(y1y4X97dG)WDh%=onzMn&)TLG_2XYu~drNe?+R>tO4EyzFa%D-aB2ka1?S#4{z(VsK7r3Q;DI1klE-Q+k`bZfypLBgZ>bTy%n9IS zKeT+w%&Azt$p^vId+@<7#H->+nLi~k7?n#Gr~vqd#gyAJ*e<$&=4{>N#mDMu zQO{ixpWS(ZRG~YL&dYzw0*?Ay2< zDi~C3_8q=EAIxJlt_h#Ha(O%>)zI(6fcD#M5wu2lNKpdnC|e&t2O91{L%Cyz%TVhM zuJtXz!>xX>6EAR7leFMHnNoO(S6TgIL5Q;x}h zw853He=ytQd6vgm^}giJiV5=vlSz7mtcW^>VA3)l?_o)E^Ma<0O zIq$W_8oT^Qih8zcIBU2eotXTEH>@oP6{C{|G$ium`5E?Nr$U$U-3Z}kfQ@LwD+Mm( zWMH3mU?lQ+8-1YN-msFgMC-#?v7*4(@^VU*y8fTMVK5UdtN}ZW5hx-QnM%yX21W_r z0Jg9tp<8%HT&L7a>evmUQ#PYRcv%EW`5K#hHTIYgJW}5&**&!3I8qtl1fw`txkT7tZ09x)_2IYyFeeo6Cm9i_awlzK0Z+ z-zO;~l#x!HHhEhnJ$FelP?JF(+7i95{!kL)6n|wUbuv`fWB9@EJolIC=hN!>kFKbV zsM~3O`f##MD=S0y1E(U8h}UxC?XvNFl8z9Ie~nI6-c929l1`M42nUA#34aR@cTp;W zso-+k0b>A6IpSv@?FFLkgZs`3|05Z*+TRB5ec!2G?m$&vRIBQx{nn6xaQ=2ih4f(MJKJBCMj>C zWVu;~M1B&@yI<{aZHT&1^sfF4TA=q2aD61p$KfF`&0M9zH0F6X46vR+^Mw0}t7i&6 zB=jZmvhRTH!7|+OpW#gh^2K2ewWu_nN;N4d(3*FCH!{6x%}xkU#y$w4zX27^sN^2j zL9pJZkf)B|dw`48NRzS`$bfVdW=**j__zIFQYA>u%b1BU%NyFC2B%JW^jKO(*Egi{G?AGpn=n*(u%-bhX6+ zUt=xnL*JKdjs#2VU%fH~(D}^A?RV!3DudJop@Q7@MMrk)WsbO`CH=Om7mmC1vyEZu z79v?GH@pwU0G6lAx+vs-xpe3YW=p^D_ej1w)+;r&ihb!;Af&??b3?g44HFA z)Q8&Jx>kJ=q3nzHuGVQipT^@6yQn^<+aeD|NMnqqFtj z>7~jonZ_R?=m5gbaijlu@~1T=fICy1mN#Da!WzkC{Fp{mynl@iKTZ(iBo3DeLLdnR z4468Me3HX1a>50OFxdjzR6I|?t$(Y;+c|i}Cup_hy=7Iv?6E7(XR`L-VA_U(M{#$+ z3#1-!o>FZdvSiJcRs0U_>f84s`L3G1v@tprx^(2dw|PqBE07JB*yINH8S|J!&oiIM zFHasbz)|iE(Fq5xz=Of}2%wuq`2!=rhPPZ6ReWEJmcFgT%zv8u&^V#?b)s+mS6?zd z6XjZfI5>kL{1u|TyKd=(d3c_AZ!&0Ng!GG(2x?`mK=n71Tsro)`9QW}vy^I;q0RGf z%PLhJj>Q4P*6CXne;aKN!9hXPD-^7Aj&^Ex9WKiH8RSz>`1Gd8(E4sDL$~{3)VoDu z%YLS*mmGc}aYg##xelLCxA6(be3ss=z)k@Aw=L5-r^@4M>eCKxovTNR*PDdDkKX#W z^sxZv!(fmoWV6C-cALi3*^9q%SE~bJvWK`nGe__NJgOY&AC`o)o{E;?`_tz`{Gzs5 zORRY_w@(3zo&PEDqG3D2ZZPw-aEl6;7oBGL${P{aY2V`6H-XDF`!-PDdBw~`zLA@fuW?Z8@Y+@?P)NQVRT zR6Bn>*{DDcFWJa41v#4Ro<}ZaZ0JHAH>ro-ck_R6vU526R)d?(xRSbAX2cP z_=AsJAu@r4lm5<*yudAUSB=H0H zoTjD~q|Qpp_Pz{dTR|;T(T|&c#PuX;Ph#LxbXf`Yr{ zN>^hbY41mi`73OLKO_7yvO(d`0<&upM)ttvGzapez;%gPHZl-94^iRs%_kKKu z=9v|$5=x0-n2!3%U@(!N!rp)r-bN_c%I%ZgB+9h{pXH0`JlvHCGJk5-$-onu8;Qwd zqLpbX;R>U7ORr1czauqR@WzqC(yZEORt2Gu(;l|Sgn|-2w$dYxfyr#|tr%dZ=vKyJ zl-q(c#nyLPg@lJu=IC_&`@2zyQJaN|$>=oem@?m;LmE zN^1^~ji#;H#)zfDNc3kxuQOosJ$vXj54eZ0Dx4HGlF|>&U*poDOWAo5OT54Yl%X4; z8d~!yt;m$@1Zyefpz5LQY$h-JJ5qHX--cO7gzj6D(y$2P`wi6dTmz_UXbUH>gZsee zI73$hr*(I$(eOGp=_$Q_kE5c@kO6pFb4g4;@CyD!E)fSyXFHadZuOS%dZq};J{r~+ zDa9!?(65Ui4oqhlD)Y{*Zg#9C1Kv@Ud@zseNLfPGhMPTkBdLr)vnUPw{)!- z{~gV+pYS`~{8ir=pS>nTQ5vm3{ope9kz(Odu4ko$w0{fnvIHKjY@ZL$T)*L}74Y8U z@vgl1j&VVZVhLe;>oP2S`85yZ(|0XC=5&4tpzWsn{J>R*l8_>nm?Y0Rl>QTsHg8rr zWb`@`lSx6~{C)`?IqUy1zyyb8KX=W_Td|b?cw#wQi^>V%r11>!v=1VjP}2&&+2lIP zO<=LIkYs9hH_mYSGavu(A2rg2j-H!Xcm`#2fJV&&+OcT?!(yfN2qR6XzJw99_OXi7 zNkt#21|zhO|lZ+kJ`-JtmQsGp(UH{R-%ExYF9(wo4Y zC<(J%RO0l2O&yMg2L_*t-iA_Zw(PN>K#uvjSjGcdXM#m2&OdLM82?QDL1xU`fi^?Qd|q739~!4 zw8HqEKAXHH2+V|4ROVuGCccKWKC^_f&bQvkZXxT!U5hR999m?|!kfYuEC;lG1Alc& zXhu~0Ng{U|RTGYGB{F}Xl;WhN?+OO%3sj$YnJS*J`FlYm>v*QKe!k2>#(0i<@{i1r zuVfzy_|rLrBrN+Y_dTAJ$Y!B7ym>UR-RXS+kW03f+UGZU`mXBZg@6Riev(O4`QJEc zsVVyRz~tnWJ^HxdW6dwE>)S#Z40$UkD4}Sm-p`S;9RNi1ilH?DZL_=mnUWd)GR7K^ z#Es-J6rEEY6d1u<%CuYK&7&$Qa@GM~`EwuAr)@k9M*0J-!&@@saIWLw(&o`T=C*86 z+rM~#3jMppL4FTiF6}-=%W|aQ%9`T%cbo;GmL!F$!Iwcfjp>4W=x7b@qfgXiIaWD0 zHZX#|x7yKhsxgYQ{n}gC`=SO+0e$W5`FNd{75@!Y52+J!obefG~ zz)!)z78I`1?ZnP~BMoIt-ZV*Q=5b{=!lBFuzh?jo9IPt)ru~f?cK;3YT;ecki`q`# zUC5$e#&AD+Rx&K^28@+L*kj#t2E|U?P~OK>y^!Ote+s~CPV$PoFFW6crJ71Z?Kxi{VBV~D#!uq;-;_`LX!iOZ z4DA-VRIm)B4NeQzEc(~FeN%d-Mk=o_dNYTJ+YyOLVlE>e#F(=QixM`-j?xJJV^V0I zs$&RGR^9p^Gtyx3O63ED0?qK00K+BCOSr(-zMActPH^BK;GrD#DYkh?uHy++FdzH3 zuH-pSv)}_v$6>#-U1{sKjL*>F+;I0LKRT}l-(KW8O0+@OXKIB9I>gc40^`qG0G44r z7WlHm`;2)&hy4cyT@r-Z&IZwrr4Vc|po%=2RD^nnD8)Sib~zfaQ@^&zj@1Pm0-&Ov|I2)`zWCkboI~5*g4!oF*DWKZ*ZtZ&KO-c^s?!w0z*MO=-=^VcYzIn+ce67c)MmK+ zy?&tExG(+S-*SW7pq9>pnR#4=*4oJzso;=J63QNC{2Dpv^x;)0xilC3gIsb)?uR6o zSWy??efsp#_)?ueSxeK7)DO`D{zQxv6wV z2mT*L-ug|C5NFm7ra|K?A9{^(SVZ!d9Ec#Fz3%l2d{WuQb>B9h$RFIHA<}(1=x7WK)gLkqyo>F7v#=R@fYyG0`|SHsltob`(Siv?f$@7U|7Tg`XWr|=$WWvD znGf*S>|3ycLDf&(X7r3r)uxOvQUH_=xJldi)0q3&TYgUXLBqU3^n@&p2tK3lOp$Tn zpT5Lz@vAUg*m2TF=SIxv%g2W`I4zwu!~Jnl1Mk^|I))eBEPA)xplZMtPNXWvOJnrihAfGm)ROSkLZqCxN^qP^f&Rtw&gC#=g?BJx6BwDEmTVjs)iCXlMN(9qb(C{c+Y!dH00=%He8fjjOnLeOI@h z7!VRAYhyCB=1!_q+m*>l78;Hx6tlzT0>X<(GRIJ_+N;MRma?z?U?*Qk9^_u-#YYIxRtV*1I4?k&D6Vi(Bp*aMvl ztCubkH5$&|M_VZfcDWdewI#y7EKuvw^2Gs4ebifozYG`4VUmm$x5y?mSWBU`w~8 z02y7i-92?NL+)UgH(|qW@Cw{ye95%axL6)3*u>SETwu_2+(*Xe_KPN{6CBiG_eaR~ zuM?u#sn3X&G9PeR4m4f9Oo9>{rwT?Gj~-=zGYKv}GfOoRE%esbfA}|1#?g$}KpoAD zF)>sq5A|KnW4Cu4qk252T=Q*eq0WTVJnJ&dNSMpY!FeqXH6syT2Of7BaVev{ZXmhW zRMG0})Q;CoK=?Y$(K62;IXJk(RW)lw+*bq?Dx=!(bNZqbRCx5~ckOWPrL+`Xghp4< z3T~2>J$T&nTOGVu-z$psF_8Mh?2Q@1W|bt`7JCs$_b>g! zRhzS|S65U(^H|f-lbSpbun_gtv87$70&p{Ax~-{5_Vk`}bCOO>aV1*BDlbQp&e>hu z;#hrFHm@!G&hQsN=ITrMzhHqi9N`nX#-!-$?8jq)5fDToHbU-+N}ZCA{CGM={m@+5 z#+f5St4gswCGz5b8Yb4C2gi*S9NZ#B-?8r-77!TGV*zT~k8Ki@Cvpxa#x%&QH<`1$ z$bsuFWykQOf4Ql>cZvv*2uW7tYq;wHwnaE>lOVPf8DL8dqKD_8F{pe?zJz}2M z*#DqWX)C@_Nd+%wD(MMs4RH@XuHi=30$v~}W&`}S@+KJFkNnih@c$MTxXGj7|Gy+0 z67FP#cs}!z>4C`!nIp3&@fK+7O9`~7fs@0r3VZM2qTl!Du3rRJdiSX1gOMlCRoG-+ zjSM7Fr>`=17F^pGv{{j>kg?ASE5ghs7^h^J#=6UVb|uUmwn$f?mVZdtD%ONwH?MbgiR@U<0+iQznC=kEfQE2%WRp2icWAH z8Wmhc@#bw9=;=T;$!o?|w5++)3aFiZWBa_ORvH4{Q$6SoA=IU_JL6k!95p6F^;r#4 zup61X1kla;YD2$=JVJuZ+x2>pj;LKy1pRV0SN>P(r(?b___R~>6ID8@G%*=#D2l4~ z12e5##YFbb3%>6HPztdD1pJm{IQDXWOI;}F+=k0P0WO#7ayEO2ST@43so~LGQJZsi zTFu(stI0akS=|jjshIoe(6htHC!h@37sKO|T)Sipkt#XYKSqm$S)WYXH&+*O59W2? zf1L-Hhk)&q40CG2rB=Q=)zPnb;g|*EcH~on$gp-vNw7*QvF(*d%B@$uCPQ1K@S;;X zw2(zn))JdR?+^RjvDZuCQ50`Hq6UtIsx{;K@|XdccNbkBf9jJH=<|=-GrwXzzw$ft z;Ed<0AqSOCT2>tKuA5%wA)6O=1m(qJ#c576>&LsL8ye&}-*Fb+Ke&|m^yjMd4+Zt2 ziVKal*$ShKq-iVNl zGW76JEmCB4Z%TBWDqE!8HB-uAI@>Mv8W0Qb%b~c9xLP;9m{C}p-q>y(4>IW@k+YXb z)qkTTio%8h3-$`Zzfp{SMI=6uB@_7Bm%r+d`t`F(3ELGt>#rIiogpe~due^1vu`y_ z78ggjCGX*%@PZuA+9xPG6vr?C_>Lh$g} z{$q!r?`t#895>OH-3A9Ki0!Gjfx0j?zNvjgibix4I&2-Is>&%7jt^o8D4-MBVt!=K zwz7FI&C0U7E+%IY)(uG7zKsb>-H%u0Dj$r7nW?T{+$o85zJE!64J&9d!V&k8^^#3L?a7?>d>GO!&sjy7-%GLJ%}O>mSD~3sGN)Nb zS3M_XF4y{X(|K<0lSJ3al+T{ObxsPZH8pnVpw;&uM5GojVQwzDDJiy-f2VUXt{f)s zrD#?0)f)Q^Msh_}Z)ve4HFu~P@EDjXJA*p3)38AdYC?wy&6w_c=C9zxP)ok@dd2(2 z&4xECkJ~Z@F=(SpoS=*^;k0Nc?(0cU)!Jo)rqZ{~X6FW!sQ7kQj0-CQTVqGp^Mxs9 zeVre!#*mS56Vpa@(+mj=o^5ECWXh~dXEW{)AgCVt{(h0yW%tQfxVZq*^U3u-I9Bj( zTH^~)$Lo6i-RD3sCM~w};&(#}Nywdz+5S%yyUu){he^2ua^mrnX87-jN%dQYOk?vn zlnOq_-3F)x=<#|9aRv5w1uLQK#B4N=vM0U@?=`hd6^)3b;PoepMn{q7=-VbxA~V7& zuKz~Yclm?T|BQwp4+C0=2{hq%HRUpgC1CHE2Hn^234i8nE=peezyTtr3v;(|;x zvz8755N0~GcA`_HkKPE5Q)!p@38h+iwz-ela z>v#T*BnbUtR-Tsbv(<1~Ast|v6BSTf2P}8Bjb{5-s4bqSuAfvl%ld;6UL=TaHLy2= zyid9s4AtPvbECoigRs7gk<2c&eQ+c6%2oRL>vD;|t?DG8V0W37c=-m`dhI_&;)6^s zQRl9A#@eRry(u|;zvFI`nmi?{BK08O$rcOF-VD8(F&$t%WRrt%XK$ehxT!1%MMvq|FVIp@ zu;&{2{j)9sNOKo#jq+nVeY~U3b~kf|IC}vu`X1-}*n?yNC_Zo5V%6AwllS~+tJ<>3 z1#VYe?!^YPBl_Sd`q47gi5u{O0wW76U$Wv`j(heYOR8Od8tZKXo}4x2+7<4q@RVvX z^nV~-CbseT>UzOo<050&Wa^0!5V0AVrI<-Wht1NVu}4vjKE8Bn*j4;e8pjj5F3h@@ zC`tDlm4{q*1vRP3*%OE@Sr>MGH+crk-CJH1lMHBxE%3JF%n<{uI!$DRH8ucANK^_KXCNWZL6ZFmtktt@hnzL{C; zhy>fH^O5iZQt8#Dws?gJghNDGRPG};Ic=aIFncWtX@%PhRTr>NwrvqU5W6^x^(;Tm zgO-BY|J(%s@Ibc#_G1dMKA>2wHw9*xskX+~zAOABm4t-st%N3~g7nW<*qKQMw#1wr zjC!(c+POdK*0Zp*)JrCviJ?bC29&So*i!=fkKC!4Gb$*Vt9^bUa-rau@*3$Ls6MW-ZQ(W!cz(L~tNqC}XDqHJ<$WH&zXHi;K zSmwGHb=uiP@6Rs`;{e!=PqhMts+a?iU~5S=?D>IW{taK?9Ha?n3P37j`&8*?DfPHx zaVr!;=q0`qcXXjU%kb_EjGEOh|D%nQvF_=*5H#@c#X!JV;B8cku%i{k_fZ0Eq0TvH zyD3|~c5f^h$>}OwHKglVK_>T?{2`+=?(=#%StvdDAl!VTZu;eP7m-cZe$UKu;BaJ6 z99APoSPE7TRk?GEw4on5;jMdcpPV@#JCO8cbcQgjLZbn##F=b%0`ZJ2MjqXsR{3oE zi3OX;9h>xVO|9p{Ned3#vWaY*J(LHcJ?5X^RoIHC^C@lNqSOE14p!lNHS}-@lM9$jH%Jv#4xNXbq0hI@H z_8tt&?yUUd^Z6KQ_deXb`$m4On$_0%xb8YQI}n0}W) z7APlz*KVWk3kX_tZ@K`3G@c8)@2;1_L2V!}7Vf|TarIZA5a~7fUIXYh-gf2g<{qRY zwcx&Hq=96X=DXX-tP4!}oQ)G|GtFdF)f|y8F6f^+5tKti-46uS^W{P&I$cR>bCQo1 zdM`)M8(iI9=kD2tn;(LM6BX)MW}^pPFDjc+136}%>_7&wR{o`(2XH6D)q%{le{L#i z6}9I%&LSRJlW(TFk~KvmD0LuAclTnokERkaiwB-fbTzjzY}g20$doI0{$O4-!FlTD zCp+1e<30Yin@66ghxWkD$8WS$3*;jP3&hZ+p(V4|Y4&@gdJ9}W%biX9Zhv)ti8EQ# zo~_r@1U%LL)R6J_L$^kvM$;hm5xP&b4)NJSHSrloe$qe;C(paq^uEMnbDOl=diqi> zip(YmEDI>cjq3kiqTpKVmyF!4zYir|nX%Oo@~z0Q34O0Jd|-W#n@ImHCkhu9gIl^Z#@+DUW8sqdM@Z%p+^ zh0l9-gi`7?Q}}zw`oo*&!h9H7f%cc(axseSbvZmx(#-1Sp!Q$2CNRBqHNjjGsv?eq zh2y<6g7Fv+wozd5OKZsb@VV^af#-y~azuxp&&sAxoSJF)>fC{W&sH@s{YAH)Ea70Q zo?v|#dx8Bx7_)15E=6gj^)1uEdszY!lVZtwz|4D)8sO+s{U0NuVxbPn>81g{ndT_| zU@7_tfGG!6ZJ+?9+?TqGs!NBgHi#`j3g({ux zMV0{geHV=Ab|LCXf{fH4tbMRSjUq$T-sQc%uUV)i4EMd%T{Op?{iCKoJ1Bm?U=yMH z?(pkfwbKL3$5~zsvpK2ZKfRbpD@@x_-O??OoX|qrcXKyuyzc=5i)(a%zq6tnbE-qc z`+dL{O%90JHe|>sXkR11pG(y=FyJj}Ke`Wf9@braL^wF=!c;w1|K=yUYG-LdcB3wr zD%hZyl5epqK1L(JZY%gffBkbVcEh320DpQn z_k|v08JrzG)Q-Cmip-9YFc9awWvZ)n7|aA#yNY{a6SWOwd5ir%^eeGq&lBz2%6ee$#ingnku2QHb#noFT>;jY3 zJ7=E{`iZw=VBCNC98okRD2Kwo_;WnOkTi}*7OTV`%I5 z*L|Z-4yhpL+mXKoA=x^caLEAiaY^?@CAz_Py}8-H^8*d?xoJ7_(8t0 z@gVdd2!Y=(g;N2ohLJhUmw4G+9Lw%qG!o}e6W-I~r?~S8pNk1rvEr1l zzCum$-lHu1U@3bFS9%cytNLPAgrEbYmS*z@CJ_0K--#Yn@bi{V!wW^v8co#?@%9jc z{9xG82P7-3+OFgQ%o#)JtJ9>Yy6K1d&bQ7dfJ4&eR58p1OW*8O-9cX?3dV0T5Q+@@C<5N3>OoJVnEZ3eHS9i}Pd?ZX!)SI1Yqyc4@)Zr#g5;~f} zVcEoAkWpz{tK{@thGD^oZk}rV;d~F$pqtQR!p*6I%%{kb5bZCrc^!}2A!^WL&4ww6 z4IW4=rUkIaB*JXi7JM|(SZNU02~IZ^Tr;;_hiU#f8^fhEqqYTjsteV%flW)Nc0zt3 zte^^V&;rraKpFWz+RwFpJkaMQv@KiKa#ru71}9ZwrEu`yYRY=*O=xdD%lp+GBR;*jJAiG}SJE zQ^gKVMKAV==beHeA`yOB{l5r)ML(034KvEUp95|cq^_j7>0@;~J|HT*z4viU(u0+P zjZX~%Q5CW5TN!B=ZvQ0mt=*{z(&9iqr(#uy3_%~{!Kcj~{rYz4*cI|9*~*jEMYd#~ zH(FDey(hQwhFTGZ_>no8_&@g{d?_Kc5o+;Snf(r$kG%~6rv}#F(C^pFs%+bsvCxuG z;v&k7d9z^?agGQ5NgX`8Dfk#$_7feb{(B(>-M~VC#c~7*S)03E2_1g_@-asx32BAf zYB)*wi1$U}^9*cvO+eYn#?WTXJZ)XvF?1QV@zUXe&FILO*^B4$GQn?+2HNI zD7{v`TQ2AE!|#IM#fl$^xY{s|twL%??v6S!m(w0vHTba}oTIY2RXHm@Fz6@@gDSXw z>a#ef=PPEH{$}UoofLv#L&sHytnyeZ9WDWjJ>WGSu)L(posJTVk=7iJOG7_@ACy+G zF5vRwa=*f>S^JBN0$QjSQwdtEjIPr{m!a#N)#Dcn6OMZyXUDwgQ51hMA~Nl69qg`& z5D#tYn04u&Z2a3Vyg0^?yS?00q8Mrr(SfTrtrLKH6gjm*UA4)PhjtCl^yrnz6g^%( znXwc;a7!M^ZQQAXQ(6O%S1kXkXm(iY1Nn9wDK)TJ9vx9ke2yG;9Cg3Bc181N-|Y|O zyO%#}>%Z?sPEs3VJjL#1tzO>XNKLZ(wuA3+nl!$TlL5!WuD?>lzaU}fvhGtme!^5v zlOHqVrT)7hAeM3J4MW%s`CB{+$ihVb>ON`f@DIPU_q}sfU3hlQk z%Hf=GXCbY6K=c{gvGEfhi4%ZWS8juI*HvdXDeiY;5e5C_|Lj)Wbw7ANfgDQx!5KRL zUdznmqs3zWS1%K5)mRxh7!jYF@3-19xty(RLV0QXFiUW!l0!ckqsq*`0+r>&?#WWE zhbFABf<`gG7aTY?>1cZ}pA$*ItT zn6>i5E0kZ6xg*Jd=YQMbH*pCgOY@(Wd9n?6sSuYm@e$d*RUX`*usRIo6`Zu3y>@X- z^5Vehjsq^cfatecAVa7-6}*lZKb`jWZ=od2ck!NiZ^?@uo{shEo$BA^`%SXzMgU1B zlDq|eU11$U9!5-MR+KJWtDZzU5i<6IlYIjyIeb5irU&ZL{f=J1({RBVUB8>?o-_A; z5B#sTSYF(bryYq-@aKUR>ef!adtiZiUWoTIxny!Sz$5n#aH*x{pxf}w!VRG%t3(sm zM_izc9IV4OenH%4mPIBK8lr{QqOp~Zzc~8_c_I5*hr#_SDfouJruTDVIzE(yEs9=q zFMLyT5Amh*pFgeJx%Y_)fCDr6rFq?H`OKAbU{|8@W%<-ku0Ru&uoQOzdNh<`lIY2g z6#q%ggSTuAVpLfse|s4V0Ka9)zK~H8e_D@qE}wJVBp>5ti8m6*+y{Mx9jz8o&DnRt z-DcH7kHWi3<(WAFFOk%%^q>Zp;-yC%);*5e@;UV#zpDOWmeo_Ho)oM(7yKP_5qwuc zweUF~mL-_DitlX_vnn74mtsmv3i4k|*;W64%WcSZuSu^7SvrW_! zj|Uv^Jpxdz8aW)+seNG@@7Qr-z1;QndyCm9rOS{^`y&6uBc@2>8)9pea3G8K*^c@J zXoRqx6_XP1ojc9wZ@GJFjDOYpujLC$azYR0Q^Jj7<2&vtwUDKw6?RVUUG|K@@^rw-HzT89 zPCKINZWl2jhU?l}g$us7q`9&|&*tPUNd%4?zAK1W8w~G#!VE*U0-VlbJ~Lsz-yn&z2AM0d z&go6zUyt*MOc7~_jZgxd!kGhCXv1J25&c6FmZl8~QAdJfp`w#9nBj#ArZ?gL*zbmOI)+J;*haTr;e-0_x7T+SseO#YQN&g3DZzX$5Y7-v@3UYXlD9Y1`( z^Vo}}s%%G#Ti~=a6Ves?&6uH9%iIV^)YhVO8ZbkibF<~Ag^ppAU*WFKdz? zlWX_rjmgJI`hW!q5^_w(90C36NidpW1L<(hoP$yH9HJ+7CX<=4>uCPSmtSx*cRuk; zKcmmfg3T+^)o_cz8sMb<^Xx)^t$4eRO~h_c{cpYTLMw9 z=ZDP4)fQ|2G-rCP8B_-?@$z6p83btv+^f2yYQ!L3Y3LS#kMKg8Wplyn?gBEEt;jt0 zkl|7f1@F2***UT8`L4?8kSAY>F)y9hWs8UYhn=A}MW%q^ly&JGQ6wI7CYOImzdC(+l*BFO>AsNBRbCn)kMlh=t-K1bA;&g*Yv4!1#5GRyb&WX~M9 z{ei8MHi%I64qj%CjfVVg&YL@!*L3_lqOAH~!_%BW+u`}V*>CP{)$v7A?-6EIf{y=* z{!#tx;y`yn@44|W4mB91mg)-@?RYhTR<8@h^2}IIovvU*h^D-y*!8_L#ILG*k7oVZ zoO^}Y^9Lhi(Fry(c5G42pMw3v@!@U57Swl@+L}Ik($Mi}k3Va2DTaBshdz-x%bc0ZALiM)Q~(3Xh?vhpP6V=SkzXFH$lAOY!g{Wwu@b(t&r+_!rziWBh1 z_tNkD&~sv6q&p}wPWNvv`%D=yzmuuJE-0F(^kMkQMY3SKy0F#eCR5Y~6zj z*rS5*_Uw>%U~Zc&f={*}c%)`_=N6P0k=H|O4uwM5Vip)dan{anVFD)ht4^E_+x#8JfBD!xn|bU z{9O{dXkw0gifeIC`uynpSpFF9p^u;~h4%+ixwA~0$&|#tKRGJ1jFAziHeQ5bQpD*& z>yI`g^lQlqd@}IZ`+1jmyt(qv0u94g$WF*OHcoeVZ@a$M?7sPSdQ74!=AneMW=p*N ze}W$)f3dAvvIN0g5^G=kB=63_bg1~?y2O7z&qfET(?sN7_bg_3rY(y*RqhUcj`z%P zuzq6J!sAid+H-8b8ShjfXL95Rf*6L{sMe}B0rtx3^OD_>@_yZ}YNrXyRLNLXjtw7U z8uZ;USYGJTnqEdcTgp+iq`R5h->TJ83R;~&-dP~nu--3;s74sd1K!CI&n{LNZcN_MDM zO2k#)z43A{2^|oC=E{xlSEt`zcw2(JzzW*eyv>p`<*V-n=$$X3E(pAxS#bZ=D*7+hwM`~ zl}sO3K7V#r0=Alu-T9RukQr5b-`4PK{Fdc`m$YI<)h6DqX_BxcbQopT@oHmz3$v-* zo&<040K3)Dn`^?Q?S*;xZlq^&b*G41YW1Jy5H-$#0R^!LVpq*uT$-$X-FI?nbrefj z%Mg8%$ZEL(pgV7oeaBei1kg=S9K<^TX`}j_-4nv8UZ!%;A&xeRBk8oOZAnw*cySTo z!IuPJY9smf&79{wo9=8wr*Xf67N0|eOS1tVgq4pA?%4MP{w@A6M?(o}pR@mJ{Oj5^YXp_0^omT1wdERjJvy9tg96ljTlbHMJ|t9U_$xeUU_NX2#z;b~*vY+aUk(r z0miJop_oLm*f{qE`0=e{QyHcf-^joPbXVG(vcFUJ`%I*r>qLtZJF0hP`BCO?L4=#s;;xlvuO%R4nLo@R;*=;HUIb>WUpCo;4DXWvr&M`hf5 zzbxu{by7}{No+PX#^g9A+k5seXsB9dm(M9!9{B@kqobFMKj7st4pQ*f)AD@}Yoa87 zBWgmlsIoewgSg+(&4Co)88K2EUS!;43N>@G?lc9!T0CFvmi zt9H9J2ax!tL~uCG2EE9CKnTEr&ABYva=K}XMigea`DD|_&f2>`s}0xt&#{#jGzS%D z4*+CV4k9J8zd?SQVuZT@L8w>Hl5m31@7J9=K2B^6rw#B3X3Y&1bVbEB;U)bjS`EC# z?$BK4my|&JMc#1-F+zL}=04Awh&5(bY%o&N`G#@zBh%(P%sOU1^SG$r3w-V{yvqYV zJ$;-(GA>S$?^}&Ey1iUIWUu0P@rhw{W$)9>1}T)F_bx%hiLuBxpA6Ip_OhFw|D zHy6uHkD7%m{z~T0>h=sh#P7-C(xoYO#3sdL;Qu!)_u@~0y2`s}{aum7ht(F+(kbo< zI|kv=Zh`41bLm29o7Kv*ANIOMi~oI^Me=c*RXkFhb%@yacXYHV-QDazOY4ZKi0lc2 z2h(qPAW=eGk^0VEt{~^A<4kSIaG@+vk?Lg$0JWYD4mkXR>hQEc<=88b^$p<=M5xTy z0$ELt%AE5%Ch{%h6$Nl^ioX*I2nu7hWNB!x6vnjRdlH9nvVM03wUwTdp!Sc!r#vjH zJ%uw}Du-;hv{Rhh&`Lj0N9hj7*CI-pTw>dP)mNZkYbMF)CfA=okkVw5!@2GV{o?Mm zL=SfBG!OK6TWe4x?CHnGG;{|!wZ5(PxTheZvBT@ufN{3}Q;X_|(m&S_q^;c~Er_oH z-8%fJ%kZU~U2k}DYJGa+qtE_>V`+eqZ**3+H8^nv8T+^|PID^K+*h3(MZWplRw1g(U+Nv3bXrLy;OUqLI)S z-oBjorOhW54-Z&Kp9=A_u0~%KZ&7_}e(Ad~3^(!OZKvoXf;dCF-uHheEOLV?l&I3w zZ>`MV2vT&Q(c@H_WO#^!(|5m8K-QPMNA$s;dvIe~(A7a9t1YuqeD_RmUHsJHuJ0J< z#KLpw(PObTHKK)4-rtVcf1mX@J>z;N-Efz=o=j99^2D=+eRPKR;&>MpTfeeeq~3&1 z=_W1-r6s|ke+6GnXvcvQW2i{S>E@zKF(G*o3)!MpI`jxdcAhSZ?xQT`xyrLC|Q82j?_9SB;wGl!UVY zjwBtZpdI}@l|v@czWlG8W6qCJ^+h<5Bw=Ov#siA&k7Z_%vOIS?U7?n{AVnY=w60PZ zjYzqZ#xl1>Dghy8o`2saIQymOuNQIM39#8POvU7BwPjI`*$~nt*r$ObDq84HQNEE- zp>tY5FJA0(pQ14JQerUm7bjdA`>Aqve%2ITeKd3B1fQb>ol;l*K<2>9>;`SCDcKy; zvmF;j-XvCY>E~_V+S_%<%gj=NEPH%lwv0yNdO}F(bt#+T0AeIqUdJ5xTFJ?eM!1ia zU%ZrAYBm&S8u_eK{(I>sW#1K1_fqY-gzJdI@^x8DrJ(1J;w2p{G)fJd9XUaBpZWZ^ z;cMiZ#|+8Q6Qg&P=FcXc^J(n;BFGjszBJvH-E|tgI=7|1hMH#6`it6cd*9;`cX~XZ zLws&#yp?kPcErVVJYgQ@v-K$wLAhZ~emnhBUz**ZRpY9GXA&6R^^z~M>kVuN5*r^Y z-Qo((CF1H3Fdpb0OQ4vIOowpn+YG=dSgPmXTd)kp{F!o7~8s#i4FeaG?I(Gm13v`1LyQgrB$LodJ zmtBWY%;|_<$Uw$+(Fke^R{+$7U=Y^)3lZR!j$lH9+##tj(|&iT$-EGaEPcT z;|@nuN0>aHeJ(R5_g2p2p3;ID#)UySuiTZ|a6l)b`QJD7>($5o?md{6 zu!6d#PrtvWI1q1N1L%Npk*XQ;c_cx&mfCgyGOzbVD0!0XaiOrrU>v{6F1{r6uv9MU zOR{oH@6K8N`Qj=M7Fq`y+0uAq*fO?s8G3x?WSNr5y(I~P1X1Bn2EEQ@qF86t zdkwuNm#fBRiXME>+iHzxQkiUd&gf&xe%>3Xf^#O-gp1tW`dvGpd!x43&R4~CD5SqchLvfV{nEka4Bev<8Q#AX~ALx&-oqR zHTBx+Zuuz(&}1!N0bA1@>1Nu(j4pI)d>3Qcr010~Z^Te|F(c>K$u59Z>m(q2Yx3q5Rc zCo>JoUQ+9b_XB9hG3Q#+Q^vZoYSZjww2dJS>vN#?(Q^@SZb!P*aKZ^xKU5B+6c||U zrIsLReX%dx1QVjzzo@v8s9oQA)5Fzg#Frnq%%2(CE2($=Cprquwe^>jQvIy3EnWL^ zq7s@6EH-V}-`EPf`xW17j_SR(xviI%Rh3TL=UQ)~6A>{G`bT}jpC=cNr3TRCUEK$M zcfim-smS)y(dwoD!Oc5$r=qIf%dB|E@b-a7Y-#X#T;k{1fVRrc%IpRgoFcWb)!$`$ z76IuSYOmR`nnM05($q@=>do}I`;cdaY_Xey5zw?pFS(YNH#9Wy37_9!X zA9wLLp066WW_YvkLBwSg$gpd1t{Ye&^Dt_qxEnMF@+R-0{|>yFK_r5Q^BUdoM30c- z&MC9r)PlV6SIXuBo5tstzd$VuTC^;>`-sxU>D&bYextrv)#0hGc5m`}FwASW6eE5r zHSOffw5qhrlh+S@(wjT|IFa>xqW+3#i3EIZ#3PVbN$mq#z*DK~Ukp-8ZTKlm57h&C^^&0#*&WY5vP;|qf#L_93>g{zX)uC( zFkTJL3QFTDEqbSHFbi3%2oI==&Hx$R6`O#r&n7+52XB387DD=I$R(;YX%+$|lm!6( zws{0coyd=s6AUn<^FH*?UcpkxRKY8S`@^ieKl=chNsB%zRnB%iu4hunZaG8l&2E9j zkAuB3kC(bvN<1F8DXqUVvl?)yk;~Z6fOIyGzrpNTUr#0e4V8^QlM?$LY+_$K0IEKp8do(!oL_wsjl9kHq`mC`U)T%~Pnhft z7uePQ-OjpUUYbAl@0yJedt^i0K|DizC4PIG2P=fe$wZ`xY=N*3BWTL<{85|eW14Ry zCH?pMU-Us+UGBr~Ux!4ZQo^mjAR~!_&=x%dPS%~%;Xu>;)#J;5k)tBRG?z1UUO{1) zju?42w$g9LpGyN`4n`E+t79AJ%;V#IS-&sR4b9rNXJ0WB{;#7m4TP%i!|<80FNN$8 zgP80|C6Tc&Wvw)18JUVFTPS3i8S-RbvL=a&C^58H!VG06qn@%evJJAYGiG~F?{}Zh z8UJ(6?|0wVwf_pJ5r-Iqe0nhGJU%sFqIehwV0LLjlq0e?(whSV-R|ykD_j z({d0KOvsopMDv2j5!qO90B$L!X3a9$djKivr_2Z`+-fx92yt@?)^4|WI)Bu~AZbNM zm7rZ(rC0j*Xu#~@O`w7~bN5H2V4-%npW%K}19nZzo+-ekKMjf3hXs{qDo@m2tElBa zQ`a+Vch#N)$wbhKA~H5cYXcr=iRNQv+~%;eJ*Tv`A5)3fS*uSD3$q^Gl_SV1`tnRH z9-rzKck9AfGtjy!bkcg)jl-lW@f>k$06hDqlHZ@T>X?KnKR1`5kMFZrLzl4Q<7AfH z*Daw;c<9?tj~M8tfiq?K*t?zpkQqhR`azC8r@-t-Y8>XmjsLwz%Xr+)nB=2AnLqWG zU0i`g9)N#pewBUnvj6~YbUN1`f7H#SNsH);(yI|7!N(NVGDri2ztiKdsQ zwnm?o$aU3VjQv(-(pJm{p8d(A>Z+uye+D)R!vtG1xK;~WpMU*9zvy56IgqEGWmfU; z+)MV7MriB3(b@ z8IUb~U^hKZ<*f;SY&P9QQpTHpZ{wo z4x(G4VB5!TG&*tOCa^+-&otQ5+7zr}0%F_h2qCWTZuf8TtJUTm$hU*|X~n+r$9)4d zP>q9yuY8y+mQk9Q*M~KT%F&M+Ti?AU@!uyzF_ZB-dVX{E!buFy+gN|9?zVv>sFp~* zA0pVPL~3)Ui@UI}+GE_ohd$Siz(0?8-YZVYqbA_2k$kAK>~)Xsam}BTG~pj>58fsU z7#ely=BT@VQ+3*6ab9MT3!%7WxH|)qL4$sMkNA2^W;~ItT|7(K->7H3VTQk0cc^O! zID9_5qyv!v67w=yY7G87jHL|%jYcq*$frl0O@&}=#7izfPPZGoW40%r$(}a=Jl&2< zJ?EH4>~?)2l`hKHggBGYn#IePN@|25KUsm6631G%9FR=4Tld#C&!?3u;=cFPgsKdxgT*`8I?w4*L|f>nq1MKoBDfy~ zoo4!F&zY;Qs&q#I_E~f^Mm$)CX|x}2&oar~L3(fhx-X+OWY;Qw{P!V0{Fh;4d7U|> zxdm3y{ddVTyFXAS9!1R#hl-kPXkBs32w zC=g5&x3${MB~zGVdrs3e}HrY(wb4*jV)>t-B!=sak%x|ceci3 z(c5*T*zWN@{5wdze;ToWnII0-opG=@X3eJ^p+RvtC!`djp#(aAtr_G8B3_D>33E@h zPuLCNGiO(+t1Vkl=`r`tOYZ7Wmv=#KQIGfiyrSpI_k_3`5oSr)S>z`w97VgI?V-Hg zLw5vtZBUkTzTQDh4Qi4aFm13?U&gKiQ+=;?;KxDKMS;BWgh_MO?iCk?Ph#-p4bsWS zL=E;u21hq$-jNlX6;bm4rxoIHBz94*wTe2VHLFyYW+Q$3a!I!0pt|6e5P0oRj26f0 zkDdQB(e`n&v%U79F|vR`REG@9111 z_T1~pn;D_pZ9X&~P!<&0K{-t-$|w(=ovU4H#Iw@b_T5b{MI%2JrT&?z{D??#nkcr= z9+dPw;@KX3)XEz2_Y%L>|LmUH{UJ4rT6lE{fA1wzBECZFAr-vHKi1<6AIPn=n7Z+w z?>fCiVl|nk=NTlj^fZBJDxzPGkw1g21*W~3w$?wiowlf-U*fB>XPiM9ffZ4ax#)05 zrmN*BNcDL#xhG^gLUJ_KHhCxY>NrzOnXcRJ0>VX}41&!0?n+iXAJYZsW?9g9E)SvF z-hq{QqmE+zWP}FPIP+mWs2NeF^Uq!3O3q;fdIsug43Ibmq&pi8?fa)SSak^i1tjCzhsbq4r{e8T1+}u&X8`WkY?(9cyB^V z1`6s|yD;!YUDF}tV!T`cyzx%67}aWUhIJbDtH@mY$MNR$1lw)QpiNZnI{%Ezfk{sr zRaT7@eQe3wGr8jD-65e&Cw!6I%=M#kSX+_zMLB6)*IPr zcLTG9EK>|b4?B%l}Gj>z^!vs<~@bwfpps%kN0AO^h^8Xx;tGh4uMH3Zn+s zsZqAQ*r`(a97W?(3oTu>47kFwm0%W@yL0fID%Fa&0Gx|4m25XMk^vtiQ--od(zyj!0(&d5RZ(Q?{=KVGZRllKJW``(42E&`fX zuV1goRce_07ovU?T{@xnPg;!J!?Uu*L~<~THbFfGTm?=to;`D?$;Y>3kEc|)8+Q;g z*9;E=Soh=%R-(g-TUrsrusxCStxf&e2aUYou2W&2!zzZeFFJq!CgTpsX-_6VG*?Kk zvv(3=uU78Go4dDpvwuK=x_{e4$E7uPkO~m2rtrmIfnLXgHHw)V>_pP*qCYu<+%taT z1~-K%KCu&==`yPiyHRBWuUey(oPY)wPRAKCn71^#I_UCwmk6$#-Id!L`E~@4tmP{$ zyvstY(mhniWG?RU9gMYtiCSrj>+CDkxyVI%7`PD2rWaa&NAf0N6M5F4i^)Lcj69f2 zu96=&k^IVqJHZc9B_NL-uCf)JfG6URr`_58;as?!h-mRv@2sVBd2HD}E>KJtldA&8 z9x6|aB4Kz^+qUeq1E2O6#w$y8z)L>sLag$ZSUVn!DaVqBP%Q^os6c;TtGhxmPI>7K zENHsR>ZO4gWTkmLs-=ntP0nS=)D39>)X#;{D#`>Uu58~~Zv^Sz;*7M_XP`ZpL`cFK z@(z-cP@jfogwET5@xQ6LQJSp8inJRWb9l8`P8@hd@`%Pn$OLPm^nJcgG#W*DWYKe_ zUL_gsxw6D{Udxo56W$*wzr|EGuHkVa3bbGU#F2H^LY(e=Ekt)$kLB9m7{lE~hScYM zNF*wsC89P-`%|QzF!zW9W}Q)uC@kxP67lUd=Hj`FElEbi$P@qV5sAjk39J!c^HHX*hMO?2I`;+rWNs+sYLK#et zxej=Jci7s_hFOIiXY14>z428x`~Ly%_|z6U6Pv)V^s_|7&@WZE$St$qiq=DQg^Qc)-Omgfo?Em2LHu9 zAHgpU?Y~;tx4~Ut(2H;F6<>}JI6HZ-6Owy%-t!eDjeU@cUr@24dFqf)orPCN&OY1z z6{rnN_v~lZsYM2H;zhU4@it5SClYLT4vp9h1+g79Br&7yFfB%Pmb<`nlat*DSV4eG zRPP$BL9e^{?Yh_z_fdS}$dh`5e2mdjbUjFv=%A=1u>x1Z2F5nK-PniNYuG?Z>GdbP z^weuWO+?}Ll|uHF<^{%w==wSNn#9Vw`WKQ*R@ObwKMCZF;NPE5xbm+Nh^6w1(?Tb= zgB0>znIF}R*X< zY{|iW0(4e+ou$<`*i)sm4phCt*D$LGel&;D6@fL+U5DhK2JkI1IHxoKA$OTCF~)F~ zjX1_6ne_r}?`&UOv71Uz1ja59t2ofQ*HV}GfrpDeZULy)e`Vhj62VT+TdGpmCH%oG zzribSiD1{R>+<~^FsALr$n0IG_KY^Ew#F$t2?dY9*XaUh!n#jy`1`dsu1NZ68} z$)KU9Jnj;473k1KL!tHh$Ke9^ybODYB#|sqDZ@ZiA-ut1SHN`6;~?PB;kr;wD}Au} z*KA-}fKhR7m;U2WK2|ub%CSmZw8Cq{yXg1sm< z-8|%ngt7&vF0*vxqH}O!bD#Kp4Xtb3Jo+y{oC%<-h8Hoi zrw=uLm$>V$w55qg-@!TaFZAzfuH{1nMWvrj;0w1%CT0dx-l2dbEB|-DC&hry2skBUHAp8>~n6L@6MLjeMj$ZT8`0ER4Q^vl$bq=p7KGLGon7M|sd zF-hNy5pTlf(3Q;7EvuD>(fF@4>p`ozbL8RRO>rP^&zK);0oE~kDWITUX1d;TGn~eA zaVw(&Ts$ukOyT=JH4GlACpONFv8jtivD=0cDE#0C5_G|pgQQee(xuN?SXfyxxX9Du z2KSyrHY-lR1_1yvV|v+x5%cKr#!ORk&9R*XBAkcBy!$bMx3WJUYKMjrVxac!V*$hNaOqtnBNYi}Tq0$nj3YbFahP_3Nwtqp-IhK!AY7%GJp| zz6ZBh{6#wtg)v++`PB!g+?5=L^qqb_mvTdUgY+`AFj&e~{d0VpQrgc`w8JrH_p+*^ zGCE$sBYEsY;IQfcKDFfxoO0HQ{bt^FlY# z(kf~GsqAFHGsa+DB55C7%`HASGVUN8_)*7&2V_Is%}5{i4qswIznhbX*0=1D>mM>Q z8k?4hd{~~&`=RkW+C2!EG-Ab|jWSLFXUTh{El(}zRT0E;lx9;6LR2ES^Wg1ZvG?qq z!v1e7Uz%*yfp)3}{|OMY3*K2=6_y^uHmp9T1^D}ocWj^6FJCUavFYh}lDpPkBmMX0 zDHf+HRkuCD=3SMW&+`n{cM02mxqB2MgE3e8CuRILzC`$1H;aJqY7;PI~69eYM$G;RGIxljJ-JOowkQLtC}4 zvotWreG7ZpqSXwfZDcO>VFp$j%y*+eY3O{;EhYJ03i8jZ)j)7d@NX;mF}wQjDe$E9 zRYpeICTK=!XGqX{!c#M&NV5T|3~>cUG8hMPrtyS#(1ev4x<9F3f|%PRL>-zoGVs+> z)+hYk1H%-3QDt`0kxf;NZA&<-b?d$(`5(wMS3Qd(|3cKiiyklLVXlUK+32g}uXB+h z>CzHzWoJVC9cHXjZ9Fd;UBcGcTpTc<%0}C|{P{Fd*t#A^EE0;$*uY$|jY1IW#RbC@ zCD51el~ZDeyn;aT;yjs>jxIs3fH;66 zeEGX87w>y-+P&qIZo-Mh#2z&e{_}R@eEtc_*UAz<(kP_ssgpS=4BFZKvN#xVfwVb&zxy z6&pHH7Q;1dVF4(!G1aMze_HoE*pfZiSKWv?$t?uf7rxL@Y*F-&qTEch6qM=> zTF#J4V8UJF>H6uEi%w=qh`Tz-Q$|V_Q(lchF!+^&TLWn-%Nz>-q%R{BEbz$`5s$-9 zQ5~nipy4Dp?OH80r`giFXt$9;Ie0qp+-duQ^}8~knCA{IbDNDl=$ZXDJu$L=?bB4c zVkU=Z}3Z#&Sr(CXEQ~V zhBn@af;%SA9h1|q?$Vxd;F)N1??;NEap4^Vbmke}%EdN!-|RB=kO9I&0rz6P5nIe4~&KQ52%^K!p<0EW0cgQJN%;a#(Hv&-pKB>XxQbdTTK)WX@b zAW5v$@(C``W5=8Our-(AQmh3W4@;d4-VWC6=XeAKI*(m?Amq(ve=BMkP_huVQ2y9M z08ABcm>oYJ4?`;`{^sh28JETzvaKeczI{IatKMg9ws>;7J1pGUZhxdll{8|W8+E^5 zp>uKBJRs4<`np4R!I37dM<`KgA?~)qlRr(E#vQr^uNDHi?_W!#D!wr|d$@7-!Y8WI z)heFfcHs6SZCEXAy4YiS^}~Nyxy6>Pm`i^fJStci={^mxX<;@A*;s*y<9)tHt{_?*~o}J75Vd zW`Wssaq9`5TFI^_-kW8R!T12&zXM(`!Z$h8v@3!iPK%tW7olm4>z=auHpz8I#ak|} z7qLM>Eat_xhMh@OsS~7JD9B+YCu@ET+S(lbXT5gyO%!pFK|Lq;9bAJ!_8MPt8~Z`K zw^PpK-XEn+&L4C%Y#^<>%l&nO0a z>YO3;y}?_s%D8byd7eZms(ep&T2vTnJBb7hZ@3)Hzg1-`l-eyJ^A?l0>vOJKLXT!| zFmEAnw|1NwHq?A$irkSJb=ef-&gUn)iHS=UT}fwtemZGp-}7f?TXrP0n>`4Opo_-= zz!xYH*~qWX8`CV_AoJXO!X(w>dc`rdrU1HGIutqEA$Z;J5g~H+0#;SKg^~7192BA zcnFvC`v;IoW~tk#L=Sj34B)uxHy^e7_1bA((y5E&M3N(EFJ=Y)@Vw_EP zHl4_rBN|BF()!H}v{&}HDc{tx8Lgx;Y_z22wB9t@E{um3^qHqWi{e&!?aU|;qq}Nd zT7@eN>EZOV2c+xvRMsMb#wa)v@mEjFLBtw;eKnL)+_Jhod=z-@Mkao)PV>N^?D#Ka zAHtb;aArp2(IN;pD0S$J!lB(WwK(KbH7szvFU$b4yunIe&TOuHWP+g=M;w!T#ZUp0 zZp^BkIJ%?ho)zni>gl$%5^msJvoh|ckh|xr*zT-py62LqHPJcYrrI{}4_L zE6ZUk1K{pZe?h4!L}yw?5H&$33mXKCL}X)LFH8YjWg~c)Ig7tx9kKs%s2jF0#ikQE z@~2f;7A%iM*W?1VZfO5-B;P_|h1s;eUi{SWV6LvC9vnc03hsh8o`5ynBKXkFR?`wr z12~)YfJ1<_X3A##yc+~oBkB?&?V8YfG~vSL!Apo2oj3$MsfxWhIg}L1YEEKm-mI#i z4C?#NO~m^HKwdqhpG!5;s-n46w5i>@{1D*8G5dZXB{uV{ldh_BY0cYcV^jK))O=*u z-s_4(z~B^i<=gV65wm3i6%|NdiS>t8?CT99hjoFhG<=Y49~y4U>?R<)U_}|Gw#7 zT&R!Qtu6N$l3X;$a(mnO7TdvphM)2SDqKpuGaS#{5uJ9*XRGsF3wFuRnuoM=7O2nK z`)+A3obRpOk_|(jp4w}3tkR+YSceLgZ!LQ1GQi(&l0=P0NCjljgG+b|B?H{? zPtMv`3hbe%7(WJY4I{b=GFXb>TMEC-uwg+uZ+RHs9|U}9#AaF*Wc@$Yh)d8C1Iw?!-jcyu7``<9xZX- z%%-m_?0SYZLx87@VZ*76RayqL zM?v9`PHIGIMcelKDS^c~gpMkhf^l)?uN15To_b__!>;0N{uJH$?P`r;S940ZkG zacs$!>$G1qbB~yU$EQ`2S=if$0NJMe$X@^;n_bgB?w3J63QT6~9jfI@jN!S%_qK${ zFR^6uUh+l(r`qewq3Mpa$T88>q@$mnkdJNf(zm*MP=zR&J-6$gy!kX6 m-*jHx(axthiam}EVsrSJRK8YML4e2+0I;#JH?KDJiu)f3tVJLI literal 0 HcmV?d00001 diff --git a/assets/logo.png b/assets/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..f48d532304ff2d27ed001f1513b15e717d872b79 GIT binary patch literal 20019 zcmV)6K*+y|P)ZgXgFbngSdJ^%m%08mU+MV!_B{QUi$)%^Vb|Ni~`|Nj5~ z|NZ~}|Nj2}{{R12sLYz!{g=}G`}_Qz*ZuqY`jyf6T&m8R*8P^z`(3Nhj?D9w(D(lT z{hQPMR;J1S{r{cQ{r~^_eZlEls>_Yc@^!l68X6mm%JPxV_g}2ibh+9hA|q?H-I&w; zn9}%Tt6ur+x(c;{h-+W|Ni|A5E7f!`!O;yXR_ILyyWxq z^M%Feg~sk39UYU-^_kT3m(==qyxLi)%IE0lNJ&Y4z~Xzq=zqiL`1kjs+We8r@O!@D zA0Qz8|Ner+>peX^a=6vxgt-+_-?h`so(Z%v(qUlDQB?PfPsN= zx!L>v|Axu%ZnoD|rO0);*O1KYx9R;kIy&Is;6y}4hsWxp-1yVf)SR82(9h2T5Ebn0 z?GqUt{{8J0hK7cByWTA> zE;lzguduPIiYj*r^bVjmK`lxy#N3p07*naRCwCtSAyj;Z+?+*KdLqqF`sD#MvWLPK!8-J<*H0f-HjNhtgD=7> z^z`=P^QZl2>Iq*ZUUAKLdq1fmx3B8|Uw(yok_7i`3Hhg`y916Hv5Erc4BmN!H5KM_ z)6pL&hJ3Z`4*Ao(f1g*F)dhfIf(5FUE>AH|x0`Pmf5=IhFkyi2VE71LL_?IVl3pSB z#jgHOv0?~d-kN7*Wc%hkw&qgIVW#^{VLXC`1Qp{S@#4EFGN9=d{66stKkkyD=3f}r zv4A;Dp}>j%YGyGJ^C8@+bL)XS?B9de%K%R!~%?k=CM z{ySjB@E)HKgY(%aWR+pnrHetrwWLvL?EDGq?A>{kTvf>3q7_zeKFjVKDtfTRzls&( zVGU&V=P{~|FCMw2kd|(qoP9&1i78q&@DXeO?ZClgyrRmY)=AehUi4TkTpc6wzOSU5 z{!eob&UGW-cW?tXv4|FV_@^b8PfLJ`cm$TwBgXDXPGuD2MD;=Y6}_HY*Mva`pXwzAXFa zMM3%+cunYvHAf)VC^%gXGZTY6!V#ExLxaDc-Rq=w1^M0zSHF4uXGgYAKSp96G`P6J z>>vT~&{B<*C){7Zu$|WRXvj@$T$F)ui^1ANOC)VsLFi3%L)58`SBj#v^?IM>+?t-) zch{_(#n6gpssWJ@EsU2{o!mH`TehX>E0_7zh7I6REw?_ zEj{~}WBa+=?+6R4Jur+*JAmp*qjaPq1ElZd4CUebxqd%=dd~Y;++j3`nn=K8;GcMI zFyi)(gh*P>(w-pQp1nG< zR)9F`l6D3+4T9IX^?GninrPPL(k?jImZ`I7SS01LHB;Bg81^JuDk;P2w9i(lUJ3e8 zQ~tF;J^g?&E%nk#0?rBqHnXqDdtS{CN4s%LK&@^&NEO<6QQXF0sHa$AE?irGbzqe| zwj~+~vxzox08lH7jk5L_gOXm!G=Nsd=3LZR~}DhrOE z*bU{)gYOM@kx`)9t9JKnNk@>UOm-ETOfij4=ueGp?)>eXqldnIuch^6f$?F9II}=y}HyNQ7!B>-dHN9RB2|# zjn}VyUV=Q`L@4XR@NjU6;ypkA3OA=_)?~rHCGLh9w))N;od;6VBzZm>28Xb1#w1IP zX?lQ2?Om1$bFwJvN@YpcSF80h4td?MPa5H^^+m{56dQUgDjjlDarYByzS%Iv7>2u2 zSsOrar!7I#r=^`t6>qlEqF58_%d*tB+o#ZHk;|sD7kAEGz3zP4_dY#Tee7c#E~D{b zdtictyp7VWaUTY=*cC^!yaJ3Bxt)|6UJ+fax$C>q02X~Y9|gR*#z<&Sd;4HT-OFXX zXx0oK8q92d_;9jTnMg{#E7Elv)9YP~W%+(bQ6M7o1*_}Ws?W(+1SyQRM zq}pqsbnB++i&Bpni5&dhDxP72@Za-FjQw(C*EcYbapb(UfX-m}_voCPs6hdpOO zw4U7s0Q6+J_t3!dVT4Db`d3@nSNv zRnWIz9j>aguCzO|O@C2O*YFz7+;}!gkHeqn>S_1<2mZaF}QQtN(M^{vdbW2p4sL*t#04pg@ z8*7ktq+?AP7Wty6BJ=i)C#a^Url_*tw$j5E{E*H)+inVZC3tJliIbOYtk57NmZ@g3 zGPE`_*Q&>ML$#jcQ#YKtvi95`n5K<{x~#CM^(Il#1B%2+e%yQl`Q%v-3%_bznC zrnY|BG<2qktpW<$bLh$ex+M-kE?T3CA1mn$m{CB6*~v?Kf&@S2KNi6twbQP z^R9u9o!M_Mf6#9ADynNy_-+X7-2|T@O`aj~0fs;zRZ^q~1Ti)ttr3g}k`y{NVk0(! z(L%(ZpaY7Ch1OO+(A|6IM?KEyoI7(l&73oyBr9v}wZ5Nahk-upjU!N+ahOAO>ZbVK zi7;`T%O0*_gxm8VMEXh0zrC$G&(A9cxiby3m!Y9xlG39!>P`)X7aDzD8Rf1>3^m{F zL&g&@KJ9XqI?5nrtXSaD0~3WU`yehICetb zO=Y!`UtJ>QO>t1$;ET|0C<`AR>^xu28@uOug??|nw_vA?tL0ss)p09gaVIe)vmJ4Y zmnbF_TJ(6SdecbMih)~Il9H5L#j`!tMw1@R%KnXzn)Uyb;xXBXj!{*1JsNTHNx(Q< zo-YEmES4`l@y*^bB(HcdadTOo=EY->=MK+j4hn;n2S8--QP>rY4eQFddF$uhSq?;@ zm7FAUKXzo8YLZ0KQ43`*@Xx-03889=rrPAWAVeNH zul2dO+7JK)soJD|E9@_9!P>IX-Xg`t%*G9d1Y(?yy1SI`?7czIns#DD)kD$ zC&TaC9w|eBetYV%P`B_&`*>eXFt%=Rc~Km@VI}{5d0N8&PNc@NXe-?UAZ$z-4<<>j z4m`I2%vJlu!~E!{ss+CHS>mIF6nz~leJ@+72SBF4WUryPt$)9U}aN}Hsp#;{*5cQAQjA@Cvwg$T`Dw;?M-q(VPH1li&&|B z!H%S%e-#|l;%3`>_b()}gdwn$6#>#Q)U8t@9Q)AkVHRIq@sag3Ru;bxg;(&$2!aa( zgP*Fg+W;K}x8a0wl4xAXaBid>OxZueSDGKal6;gRA2Rpe1s+aO@a^?4y6i|GMm(kB z0k79x5KlL9?T$8Uy}*dbI`N8dROu^c-KbxSi4Q~zQJKJ0=pwPMjXt{7hoR1Vr+-2# z5FA=6_e%tSC0icToFE#*iyNH$k(#N zf(SfSP9POk5z5fQv&>Q+ZcXhIdoK_n+Op=Yzt}yw;xCY13tdew{OAQ8zSJcs{(F3l zvL@P{n~u-O1AgxQ=|JGD%PM$&%<5y|l>75kV=m@s%Xuk)D+G=k_l-Fvo3xRuTE+fytXKUkDRm5Y1O8|w5Qe&k46)uosi5O=0y^Dstu06`J-oQ8 zC1)No@d6rqtGTwdIX{)-=3AQageK;yquI%&g1nwpOhO%!n$lAjnqG^!qPt(*Z;Iy# z$e3eUj_GOu9A$9=2|N<-8_GCE2MXbp{-}qEblUd&epQ)nc>NG|gh66(X>+MZ=cz zZ)SUPj=l8Q)*}g;tZn-E6qr!LIl&ez*7 zdIfdT(jkPu6>I9WgWZNO(vlS`4!yGQZVqhTgQ08TE~T|vwm54}IcY~n^oPJnK}$aw zGnKg&f@!^3t)a7lY{c6eToSW3fEyeCs2A6U9qjNJ(~FA<0g=Ui2#O7Rv6c2@Nep=_ z-fpz;IXz6rM{nYKi=zDXS7QDmRz}^lKhEB^-(F%Eas_3D`0k|BrbDbI4aRMK+c?S;pM%9P@M}=3U zww!|pZG?kE!|C~~30iHm>XYIwjfMGay<}l+P>Bjm?h+hTlAgt{L(Z>IyGoGLE^c;4VLwnV<7ONg5%qzR6nFmZB z8v7EyO>4FY(bo%3|9n5IC+)Z!zH=+d#xJ`se+;~V^e^+)`;$hR$8W+gGvq?%-H{NJ z3vcER=&Ql3Z+c5ZLPNX@a|xRp!g=VXnGj!W7f69n2{h$L8oim%od=m;A zk+Gs6@lG`2MUd`<9_)f~58DgyvRm+FxqP5GA*Er5tpl7r=dn+zGx;K(uksGt(@iu( zlW*sT8IyA;-_bl^4i=V514jK=X7t93w9s(NUnh>K3cariyS|^q^8}uoMVKmFZxL)lW?Iq#!R z?}`wmps<8Gi#og88gc1#=oPHjG_BJc$Km^?hRvd0Cj#5pt+74QB=K7PigOCKBkIlI zcniQB)02LdUJ4gQvtGxIhEOJAi~#59p)5ZJ*s@X@!j|7??w*wT0}MDZu9)=&*p?eH z&K?g`M$2C}+FG%;OpiGUlI;;=X;aHIC-z&WhK!?Dx9uHbBj za4VQ;O7{!d8+a@Poia{^;~~^$*x7Q!BjLoWmn>~U-rb)7-GHToXH{DV&;yBNIv5kf zCMF;NR)&f2e78p$1?{ysJd#<0VAbL*g6sCb?8zMnYt-(V0>@FXi?RN!s1y9ODVNKj zNScj;A&nRHC+h3X3BQ~qg9TdL&2n1BnldJ~+UjT29WDC}RN;LHvDI`I9{{Q$5{*Vy zNIV`i(d~r`eKC=bhlq^8cf%#4Vl2-OMM=Uvm9eDlA~z6VOb(Y>v`1L=KIcodVwLTZ zv_?FVu3qnnR&sEfEco1L7Rq7gI9HFm`uVR;Y<5*8MCA`d?rv=(3zNq@=}PZVPW8y@ zR4vH{P*F7=)7$;H_X>qFF{v~2F=vZ6-jfTFgnw8UE5TMzB}5%4pL%c9sTHd)20nnK z)lF$hr^`lPc{+7Su60%lg_Y0|K2L=|x#_EH97=;sg1^C%7U9GRPH^V!u8|Jp-zG${ z8*SvuB&X*m1A8M+tyoJ&E*!~Cq_Z3+jd<0&&c)x{Ts}Op%8X~0P~l4s@WOaJp*wM+ z9-_UJ$e~9m7;n++#2J|>UDR>uy?w`8u?D7jjxWYIk+Y{Q`y?eh9>h30X3@Mb{-%hL zi%BAfBV(A0gD{Z;qGV+pfs0U4*5%ez|7aTfJmO(vL zG%|%szDbwSp7%MNlifKBL*Thu$hF73jO^b0M!l;t;dub8;5)n%j>uFKns3=BF{xCf zZHR?`u8Rzg#DXhZy2vl$9p;x$fc&k-vVIeU>Z^wH}tjkow^ z<4ldGFVxj+lSLC!P16G_j9h^wcrIbVPdt$a;}r!?b>%=%y=%0i+T5-@Vs~WBs+pZZ zvvMjbFA9YSuUk%*I!1!7o|X`?#}U_@55M}7JsllpM`cSv}$qH?g#5Y;D55F;z`@IWaf*G~uIwML=p>R{;=SQ?E=0RkwL zS_2Y*wNntZWL+|8P%^Yip|UY>qgJa`Qg!gNOu}7SCE6{G2JeVcyZ?6W)<1Wlwu+{*TCPUWH zq4yErAfU3aBm=d)tU;?(QHW={jgXa@lHb%Ip%8Mk8!8pU;P+7TO54_k)X!G+=sWRM z4dR!~?MB!)a{ek7$Y&OJ+Qg%ifs^XO>T5%Ns*x&{b zwz;|4)XXl!m5fr`29zc%Sg|%JYUPzA-<1v{8Yr1It&A10F9U59!n(uiFj%w)Hkw*) zZkmd8-2^drGd6-$hxF~)G8SQ2%?fQ ziz=CFB|?qu7kQjEA~TiF3qeVecv*^`d^~CeT>xdLs+Nizfq|;QJCW~5hpA+e!caji zlL7yP!xt$mWwexml7*IuMmvIOg6p*_zW({Sxw-l6?R(FjJ$d$cdwz}+`CvE_P_){x zRb#MdAA#qC80yhrtpl&bs1&U#!r)FPj6Batv0#5XiaXROUMlg^AdIS2rCQc#*t%qs zFFQXov--p4*4^^@t#yz`Pq&^3G0q%II07X2tU7}siIa`mqRuX^`rI z>1ox`$?f^oAAY)CUT8n{K`#jWb!xD)v+wiH^0yl^sk3~dWKwFAh9sqtqt<(bRRw+( zbT#9QnO)yM{bqgr)~)qN_qU#G&!=KzVMj*@z-maAG8n9k+M5>UXYV|?yLP+tj10B+ zTrW`j;cx%&$B!F3%Uc^W=g-bLEnwmX8LQ&G!g^IGi^&d&An z{RbPfb8|+aCuboDmSSmj$ouoXnVEafzq`Hm&#uNZUtGQnKraK--)Ix^M%fG z`QhWQ&!>j{+BTAc5dFSkZM_PihDG%b$J&DZym@nBap7N!<*n88sd+z2Pbj(Y`IWJv{l-O%5=92Kn@??AUpUin z2G$QNZ#;ea_s5QX26FxS-L0RWJYEHyn-3m-_sO6B`j5X{ym<0&jeQL=Rsbr?hadHI zHKH9Vm+#&=e>P!J;9TO@#R}*kmxm~0fGh%*0`ArCO3gl8Y-~Su?i{SX?{}wU?wk%kx$mi%==>` z8bZ!FyQocb2?7gj5~jJ#icl4#xL~M!Ln<2NLgQ|=7=oexv2-}n;spXI zail7N38i+ZQt>@hRd(9@A#>0xv#L;=q*WII>k#}^bH^KpOZ&e* z>#zMoJFu>B`nP+O(-=4@q(@htp@V*^1QN2djzGnqobpsNozJY?a~q_t72Eilm30- z_V&gKw-FB5<24j71zZr;F^n~7dZB+<*R zye}Gi3ueC;Hh@~`?C8**SRNd{-qY6U7Z_iy(JKf>#==n)S65;!E|vm!t;^*K!OhjZ z_GilsHVcQ55+Y3_-_5cDIKX<~^w_=0r|Fg>88q=v<4!NF(7cSI7P@9I)jYC7cC4%< z(8R51RVoSd>LaoAccEjhPQO<$8U=x2ahyWN=}W8zi5A3dZmR}swi`3Q(r3sKPG~~iR;H+|4DbXhhb?@6Pu=>dA@G3O|S`IHlF7xjLK>`)9~3}F+ROb z=N$`{AK9hUbf~k+5@`6BFFVxAi@StUw)tSq{$mBy91Yrx0xOZoOpWyhdmn~SDOqad zaZE;)SZNXrBDXGUz=~rpvgcSur=HU>7kVAb-&d+DE7dtxK$YLoj!-vfPza%QS&1}LY-wrq}ly5F}-}7pI$m@q04MRg3jTWI^2|~RI zZD_L>TR95iZU!rfvGhy`(+_0jaSDD__-QQgr(c7xc~=i?)4f4mIP5bN~$HYu{7x< zS@t=Sxnu=@pe!W(Xm~6gJ-s)vu0xY!g^ZL)G{FrSq^2gt0x4_E1FJ&1Dy(4Lq19Wq zo!tJ{gFEXT!SwLePP@(HG19as;vC1#U?q8=g*c^V*>mJGd^*=ZL0u*-v@?>t5_R+) zE$GNqod!AkCK8#<eK=yb(NA6nT!5T^KRpVg!2I6b^|ART>!w9_1-<5g9_oXR%Tiie#M_4_wCm8hquW2) z{prq4r8Q+>OO^y;{k|h&MUumLNpM`Q%X#VXRQzdQG+K82k0(|apqJFOi#Be1cI0#{=x{j7%gY_H z({~;{0oVnQKeTe+h>pJSWmucgJHS<{REy9{Y(pE*o&502HC3fGHA_IrK>enwdspD3 zj@=zkCc_aHdcthlna(YUl@cRYN7BP*!=we1+%)U0xl9bK4~P4{8xX05z>3-o%9Lfr zF!{4nh+LRRI~-;8I}d*J$@UN4+JCS=5RA4&!2lOM=>PW74yAg?+yE_H5!9lWW(9xU zrB*3a3sgmKZ2RQkd&_HGO-)@K91MpC!l@L`)8FrdNOB?gGR=yq zGY`JGU+dO$SauYU)q^;e&IKl3zc&2PjqA8vM9*YJK4Nj=@#NE6>8K-6R$hi2>X(3* z?z=T{b98j{_O0Gvi=!pB=ENI>xj?OI)yS-~J$f!y`5jGE1x4%jepyvo9#~SpT&A3S z@?`STrBe}@P7PUv&c0s!183v{uV{NUkcA=DwkdJcG2N(~m5-c7`c1A>& z)JcAu?=2-CHlcvfaTFVm4~~zHK)Me&0*+`fJu-Ut!eBBv5DuTZ_|+H`cSkh#_6{?l zX;rCz3@f_kMXN3%ezU)-CJ^Yoa&v5a>eA%opVIVT}n=H7`2e&NI`_aKL6mG z+t;p5OniMk8BTdTc8@XA)!x|He(^4--cq_BBCbf4)phplJ{PM>3RT6q&+8%4-WdOC zaPZWD%Lfj;`!3pAyGhbb0xf6JvuL`;MKT|)GOAG;x0~(7%SsHS38h-p3-P=U&o;zR zoDdPoR=87WSRf^#QL2_%p>RQt2FK_0h?X@uosm=+SwzHjB`Y_tv@yPlimrIY);$-; zZ$(><|K3cfGzy7T^>VD0DuqI;{q66{0{u5G{q5A5fp}vhkb9R#IYQd?^NZ3LbwmOb#Alh7aSCuspa7Po|tC?_~9)p4RE=j1V6l ziFNCWf75P0FiqZR97hytXRj;NzHr+*N~=QYAKI5dPn^`QjE3gzO1%v_OK7l8{)nT* zdOJwmb;Bb#M_~+S8X^;yw7p)kWO}!{$eC(l0ny>k>w)9ypYsIV*eRfL)5YEMd*7C! zyUX$}>l1=0VBYuhexHB8=l6S0o_wxuV|Vb|Q*Ssweewlp*Q2aSG+0+8znS#v&VJ{u zJJZv<>)iMOG`8MN3H#jhUT<-6aVi(%uvo0@$2uWUIo*hx&E>QA7Ut*g&5nhN)49lx z)3aGxElbPdie(|pVzb$VuzrVo##&oL2iyUl&*dU;OozH>_L8>ZX|myfpJr#XNXx~H zJYY4NbZl=+U0YjQ*NFT4rFPAZ69*ZnD_}5bvZkdmRvtg*9Qx+|^ynvL1mWl=St%Fx zdJ`cj>9``2H9Z=n-}^AI60VNf`GvW;xtW=JmR6lH1Xd$9T8uWE(THSmH$#5GZ4OJQ zd&E03J2yA$8}Jd$Hd6w{N|BOJ5eW?aaTJxCE0XYFogv|ntaWX5-HvA0_+`!dzr2E0 z2+7p$G%Z%<_K%$X-`$^{9<6h@42}`+Mrx-NMQbZ$88JkdQ7n^*WxA#F6E+pEE|;&o zvfOumY;s}dUUyl|$hqM8v9Yo7@v+IV^T8nawgb0V9PY`5xv9BJGZ!!3SlHzoAet@M z5>d(Ci<;NKKiMoX1PuqnfK{zl^Niv?Z%Yg0CnIk4UAX$!l4I{Omobu1J4=(5`HOAq zoF6>^S$B`PA(Ct%Z*)Jx+Y^$>umj+PAQ4<1V0BAbQ63gM+yr4Y2yH!~;M~mo?Bpz2 zF(^ZyCnsmY=I3r)M0R6lVRp8I7=Y_6VNH#)0xkN+Lab;;DUzs>NsMKozP>HRCZ4sT z(igm3lKBqW1WryythD;3st?~o9(*6kitbuy#E^iXCx!+`0E(vFA`v&2%VKG>A7xF@ z)nGOo{1Uq4(AXUCT?9nvbC6MZQJc93*r2pK;P!zF;}|P}jrvWBbrF_C=jC-@4}R`gr?+Nu#76P&@UZ|3xP&a(+4tb$$>e$6HagD_$;%Qe= zxrl0>QBs0Gg31G37gRV721N?KQ1sX=8KfWQnlfCKYnz%p{yVn{Up&D?$5pGUlIiLC z>IcrDJJX}1haBaV9+lpV%p;Y0JZ5X2-EJ4EshE*SsF+=3jb>$tF_{bvx>xB;#j^C` z1ahU9SlpVJ9<86yI<~gLXZF)FG;9>JIa+ou_7R`LOnWfmH2jtHDcw8)AQ z6#N9QJi4~N$rG9QsxWg~jFnEjGOM=!CiB+B=;&xm*rNhOvzc#}^QC&JiZ7R24R#?I zxN-(h!UI~k$Ok{L_t(ka9LnZ6`GI%NCd#3DM}fImXAazs%hQIQjia=B`&pth;L zJ`kDsx^VrGWO9>w=XL!zZ~x;^ zT_hYv`-vXXhgB**A9Mw7g8>&tVI?+_6=1aqakKx$imt8T3u+s3I(x&zw}Evh$y!CT zzB0G1>;LZd;3r*?a3ByMT;&k8;KvmRRBo1=tyTk0DGRIs%Ozps$10O?u}4uMX$yr4 zxxTivv!HiZr0e!w&H8u9{rNOa*zfmW2nRq~!c6XmoB5=$R`fk@5f;3d zgDOvUdfZsEq2MfKdEmuRc*vYg79-PB+`Kp)P{9^i zGlb|MhFK*jYFKkRr#cYv4+874zr|Q-%}n2X>9@|aSB6_!`XZ4?xVbstf;Peov;rv@ z;st@N_QzSX4M&YaHNZ5eVqY)6C-Uo&H3iV3Vocg9(rBbQa zgSNm5$v9ef;>nsov2tRpC|ZTM)yzk-raa8q90*4SC$98s{Q4Im%An|MUfWdPnUmAmkhKZXlCCVzvn$lXe7Q1A%kH6IafbWbR`&GALGBdAREH zXAZvma)0}&secX*wt2T4zzJxaq>%UW^Yb^9)*?Sfta%2=#cCc2i)w6KGI5L*%xFU% ztiUN*H>^oXd06iYguj@$3Cq{tk#AH2E6ue!diUwG-}kq-e|3FgxUQ^5g5x-3KB*GX z0xU=?(5qk>fEwcr5*CXeD<=kPMCbk#IBt+vplDt5#IuL12Lh2Vz8NZ9w=J33h+Yy& zqd5!T%Sc-BRMP7^hcxY{{&l^pMaO~12@jL62iVTehN2=w3&N7H8Kf7Z>=buaBe3E~ zRuy7ho$~9$)g9sBwKJN+m$xT3E=MOR=(3`B7vX>GJq~`{e(KBdu8_r&p~yp*P!?_I zY-lJg0za1WAr%|Qfd!9;SUD{1_k)<9$r52f2QI_m##q6F4RUlN8`i8&`DN$kf%8{S zy|3B-hZo2<73u35J6W>)r6X@S-)}!NHQsF@)OI=FBNb$oHuaVk6=l_K5=iAyFGed_ z5gNy&Q|rzj+;HNfpMGrB$3|!Mbh<Kq_mqcQvciKBLQ@*?;%`t>KO{SJx_^_5wQ3Iz#Y% zjAH!m?CYZ=3lHx8^>|m1+>_fFInqR-hs;=S3y>@3C5uuUST{bA^##(xjhj)$;j!BZ z)Gtk--6FA;m)q*hoijT1#?f`oyu?Nr+>*kG_o30R(2^QSe);2XY)w=^$Tu|+;+AdfV0UN3>H8qbG zI=22w$=6b5bayM)ZPw8u;qYLe_4vJ!mTz3n5jx$I87p7-tfHKH zzU-Y3qO*_Z$cm?p6xgg*jUm!W-U<1HCsS4#RJ7tKC#gfH1oV0= zVlYhJ8|nBZ6OiEAh`gNN zMo0d6VW__Uwee;j!CDPXoknvVR&1jOVW+!W)Wnxr<@r*WC`$M)KFyHoM^y`pWm!S$ z^?Hl7T7o6nF+mo*!RsZH@fO!oq8j8l-U{D@G@&j$-2Rux3BMw zKDaQ{*z=qPh>2MN>aHNUY6E{}^t$_%&7b(=XBfzq28^D<74WWap?9 zZ*6V;Xs)rb(LY_Ii^afdC&g0OspoW}0-6;yHd&TepcsHJ6lZb@!AgHB>$F%#t(JU~ zTtutwE~0P5;fM+}t12sp8qqGK@LESFFNKw%WR{BlVKrMrEuLh+S&q)t&Ex=5uLqoJ&2{l+w%N2DALw++9+j91h zs-#3IUBQ##T)0YwyE}G&hgnIlM{3kMUrdcc8|`D==mBtZ(iA#>J`@U}{cHk-?0mpV zX~DKP-q^+`dnq*tVe|re)H3ZBE_9@BR6bbqWP{o1eEXv1&SeEI0SSnbup2@vcOCnpu5ngTxvTtlFK@umIDd z#woAJ;-U~v_P!zACb11UAA05ZJE#x>wU*~wDpR2K_2rU)j$FM5di4OkF-V@tXip}W zlKG`ek8Y2)ynASVeqP0_U(J+NNvtLBTx-2^H{Rp-Pmj-}v4&A)^HkP$lU66DCh!he zP(WW=tidfISFg+p&GNxlmrJmU-oF(;nz`(FdAF2!oryAzF;iUHHal#moFC@>>L&qJ0# z6-V*0QG=IqnToVUT2?7*lZ9*-It|!Z0)appFzFQHCdXtqP~eN@m-?1Iy*=9T?(W>& z^*qP*`O`Wtz&e(jcm2}ngE>D~&q=IJ%<44j`+H7W`b?n-@;+^+PECYdUT!r>-O^Y4 z228HrZ6K9dDe(hsmRHNm6ylsmJ)Q$Y__l?VsFy;e6iAet8eKc zDK>g={aB7txYd;>o}ZglnOl~p`eAhB<2k?I-+zo*b<3<~eWJ@^8F-IiPqm#Q8}=5} zNSU!L5hLxXVJ3)#->tnhaKo1*Md~ z`6fxR!@oW-mb*!cAQ`i&_I-=;;T5bJuo}_fnXc>UI%zrn-cF*O2<R72-J^7Hfv0JZ# za$m-*c}lRJjV^q4C6Vw`$XUtiBu^X&^aM{@EXOPQjt^8=$R-gaDEwp2&0?|ib?=;* zI?VC)Fa@0{Uay6e4Pq8R4A(|ObxJ{mqoZ(-00!GA{4hEO$D!3tP|p=R;3KMikv zD_5}QWXd|Pxcp&s_CB%p?;5X}(Fs=C)fuHUkzHqh9R_ClSwk4E2#A5GATE?3SKK?* zCW6ug@}>dYw!yA9fNvJ0WTf;j9&>8&%&CyTKQ#MG#9q!cfNK-J3%A5r&{gCaU17U!$#$6(B}$a;Sm?7=ts!<=F8mxo z2tOI4fU`uYKUvr0xWj3S-~9Jz%OA&H3TyTgSz{W0!f8FB`z#=hDUqCs%&Uj*qWu`8 zT*Ok58SpoT5j6it+xf>deW!6eq(Ivx#56H8kX{%5sELiqWU9XGg(mCpy20>*7iWA8oAU}%KI|U>9$C-F~ zNACT6KHmb8%O$SfQz(3!Lcg!i`}sW2^Z9=JeM;d~QOFRNt+0@e&oWc6VSt?gD_;KU z)%A)`3$4ZH^Rkd_He|ot`-lHK>n@=$>8q#=87yEmimd!}2c7UBI0m?7 z%W~jkW`Uc(#pJEr{3l-JifX>Y1m&aNW`K> zf$Hm-KsAv^9X93i^m0yCmQpFNKI9l1zu~T^v|5@Gn-KF6@)c~vNnS*hH}}8!qEXbO z*hwd+e+eL>+q_wv*Qq?p!!EfmkWyk&>{A)FDlKzc#rmsPwORySl?w2Ms1A+BC9Osg zi8R-$E8XPht}kR2?rVgqh-fs;Fiqqt@(NI4OJJlIR2dPIIyDguL#?-a zy~7Kwg2=k2$KcDe-cn{)UlPDtPONZZErca$MdP?B6Q>tbgtj>^&1-f>e&1W7rKUB@ zmjFm!;rrAN=tI8R6vbrwVKY(&Sv;;1yuEdb%L|P|I%cY;eSX! zyhOUzyQ4M}USF%_qz6UIWnpB+POKP!xtA}iOa8nsRRrzlq&)oQ<}y`53RG)It+s;J zVj+D&r`0mw2B@YTMxwfXqh7CF57yH28PN3=ux2asxUL1|0rrMH64prjwhYVUU1iIX zBgU{anJNm{{ACpo)doDDrovJ#Jr}{X9i(b*HoCJ~88WHa$p*sUazz6HcX_?fJ3Xxj zt5AGi#&k_HHc{5ftUkn8eeOWOWol<*yqa~Hcg2>snYwh&R-C{;Z{~BE`@4d>yQnIj zsA&eONUAotqLoN=m7$c#CX+4n&h`SY-EQ~Qmt(T(_4@ejheGl7Om=Nfx~x^%y1b7s z2!qKUpAWAQ4p81PlCm5&_eIi!YX(3}lx*@YhcIzkvydd#4>TRMq?*NQ<&r|Zih$eA zt~bCEi&~huA!dPBf3`*M-BFNYotqJgJ`rPZddJozRXSZ(*)~USvd3=M<3;RYmqnuz zy*QVnu3=sMlP3~3bJqkg9>c^!iBJ`Yz9K2p6lj=}<@IE=geotvBkY3jOv`uJ53C}w z5pPNMmu~!PcB*4>TCDOmUDmO$gptJ_eekfy9MpS#(OM0qK!juBdC`aQ8$#v^yOCF~ z3Ld9c8*^SNVIF1!1GEb@HDLGoyanFj*^!2wyLF5;&Gjo- zby?c{8p!|v3b9E|+K~lR+NC99?o#g3!GlKJqn<%U zvt-m#&6Bz@4At_$tZXhnz#n8e6`I;?)JhSV6QqZ`yGuIAy3C$|pvP?P>T-IVPABaG zltu9985$n%YjqsoOZ|W(@-&Z2V7_MM$>djd3J)INBy(bnr|kh#JIi^joFT?sx>r$w z(~11w+>RUNMQp3cSJ$w;fXOuFs6=Wb)B1pE5d9r2!? zx#U=ruiaPl(lkpyVFa>sd>Hj=DO0cYrlWx^}}#O3a`Q>T7n` z<8#lS4z>!XPiAB^vL&6eEj?Db46L$s*NXh}&+Zegb6}vQ1@XzoLC87@o7A)rC&d?Q z%4(?!;4YwDQmrv9s@+cZcl1X#8*ptlS6~#P9wyYfx|>cC5-*8a%AD9-Lh_msG|mjq zP0ssE9bbRLI?(YZaPk-Wuf6=aE3B0y%D=o{G?=)5pRN`4fEB?Q1taMunk9v4WjkzR zcQBIIVreITW)?{q--M%+A6QL%s@jlK!$f)*-uijnR4g`^yfb@m;@<3Hay&6Ne0#tH z=s(xgZ1Tp3$Dcm(( znz^cpZdSVCi-VfjuCofy%H4Sta0;`Tjgc6Vh%_1q4-HYoH6sYcVu{&_zumoi_rX~2 z$VhK*Zyz;mNemAU$KxQqH{*8{Z9HGyhV{*X1N6xsN>=@+wa&?sZot1ebyV=r)1}=v zrv}WPA$^=GmrAPN4DdZ>mr?!#Bq7Ow9C-P@f_J=J%i8_Q91uN?9*C$pJZX zd`{Vim%rWC?{8`q9D-xx#og7Juec{K9gHN_%&d36a6s9ZvkOMCkmb4QcpPOLQZ8M6 z7v>fSqokvPj_mArzqPxg2JYlEC&6gtjt$TKStwMg4g_xW{C#4qskNb@p|rHPD1Yba zU0-}~^7mzJ$~K*h)}(oP)Cm}9>&j03^RtVGj$XKSgUs_MpSf?bTo zVqIp!MJ|ZNJgkKCusUv;iAGFKqnGn`x) zYyzl||NckEub=zo)c5a}9h1v5F#%;jY-6p4bvpJLEz+EvJ=H(#&5>qg{2zKP%UOT$ zV_A8P-+v0&dy}!4(?hsU=hV~`r9b3`*yP-J@(x)taT}Xcthf{3HgLA)jq=J6V>EF^ z4F;>hYBf|=1V&NjP4q(2;*A$RyHZ`&NXDCZR>`ZXq!~J$l703UwS#PwNi(S-`?^di zy$?1cHL$KN4@=iSpP`>%rn1r|x4{9c7pY)ATBR|Zv z;!;?#(9kqC`*>Y0hXcLqZJ6xh}`r&Iy60;xH|$-zy9{fG08EY z9FS&UZsti-t%q5AL^)q-UnZL2z+v)mkAsM zFI@$DFmQ>oqKBcE()8-AH#YIA4;H92kg+L*6`7<#h>Fz3tB75D2$NW)D}W zr|$1}&Y9iWnirMGI`KtJ zw7t`(`|pyv2rqzNYtN6^tjcA>J@VA&+^ja`wR9m;d^}vsJIL& zI5lvmEB*4hX&INN@J2CU8)GVF!FGAX0@nB)2h-;DgRjbo-*NHfH}?)g-q2Fmda$X*y1K>W{7M5C4Mic0D=_^Ex|w`}UFJ!^_M4 z>;JqMG_9lKzd-6_-+_LDQAq=jM3$zoVvph{)aC;!^Aapkq=rJ@5Bt=D40v!_RYT{g z#OP#X2ziiUMaBsyoB|moVcej$(zk_i3o3-}`RxyB4BTCOEG{mj-~8TfI!1HTh%6(2 zk1(wvERgd3RpvsuCU(GR96Lyr3ZGX|G%+*5P2swNkBVBExW~#6E|b^dp}49D79C<> zWDV}e$h3WFvb+=IIxxLkYn$7d%v&6p&3VXDR;Aqn)lmdPD9f2z&J)Gsr0O}RF3^jt zUe#o6hrQ>_jFSbi0zA0K{FQjya2XB zy}n~?s;O_n9i16}0v~&-C8}^labV|x0&4aLU};ZR9puxk>i35!jz zgi#JS$+}4Mnk~sG&4aTCilR@lZ$&)1RHWEM2xo@)%$bUONXVCwre8IpXfcFi;gtvn zI2UJLi7!S8xpdbu_FHX-a^5;Zeo66SQ;|kVYe{QKYe{QKYf0<(8vg-Rz%w O0000Yj~_dhH$C6a;05+;pI%O?eFR|7cxE1gE;{%vO*=Qb852*ooYwxj<@@s6 zN!#5mluTU+o_OtOjXiwaI%(u#zpcHU3sXvK35AnpoB!$FIBEzSIW~+7+PL?9$fvvO zoQ}mNesN<4yKX;wbH96E0C{5^5m;{(5bvJIV|muO?0;NG{XiMNjzP71zXl)oYa#NR zBKFPUeAiZd?1vuR&TG1P`&eH)=gV7*`4MjZq&f%R^oA3PzoZ^{VHJ`$_L1>$_vY-I zN$i_&eU_H@N`Hct{>=To$!4+fMmLQiHN6iuWdTJs{6aJ8>us&>exmPbs5FwB^{!LM zj^VE3V=I=|%{|9P{m{fp%U7HrT)n4efpY<$M|t1X&hMnGkPQ>qbn}=$7U)GXX6??& zNL{-<#+iBqe7lYwx-qayq@ix$os5F|r>9ZaR_q!v^>WD{OmqbpjH}NtK!U?t*`f*{ z6Q6|Fv{>{+%1j6967qY;L}UySLC3kQv2c~5DO>O~XI8ySm)kjZ6#^N9WGTpog$2I4 z;EqbuDhqu5YH7Zkt~}Mco0&Dv7l-!!OKY-Hl%VaLy7FY>oTk>9%kM>{@v7g;nkP25 zGvqkwUPq11>n}LHh*WsdUt9d_O+sk-SmvdbJ`LRq2sz{ z^S~F|3a*sxd`(-L>-vnFrrCb=Gs~{^u4(1sF{9B=_2c#ix!!c6G9-<5P0i0V=2!JR zu}JzR1)Z5OJq7uW3T}RWkmG(<2}Uy4-o%5T@@@}VgX2yUtx+*EA^g+w^y*t`Yj+Aq z+RDb5)}vj9ll0n$#6Cg!i_`i$nUxlAv+fYTPFec1wM>te-q5`NXhWZ7fF?KO7^-v7azT^VTcKh|5~#T_}@3`=2z&^jsRh2l{<1+#sizjLT=3O(~XIj*g}6D?<#=#`)}( zg3RiyZRuEapem9yjtjLGS2VlG7q|2Lim2mUa+d@xrvMW>$d_c%n9}bRwmNsFhHRRJ ztT3LdUf;SSOVN(Yyd%gmekewrI)CG-p5Z=i`Zm8olD!POCMBbM+>|WqpLrL0{)$|4 z-o2KuhRy0Q#)IeU-cD1p_Q0r_yv8ibLeDut=uTG*_mhKzs_>@yk?)8`hhE+uL zee(0f*O~g00be^_y4xRiqvFwI?e_@0OMkOv?B}+9c43ik1?BPi+HnbZ%YH0zmVo2% zJl8+`{D!vE%6nw>zHZsp&MsB_7dZgWCJ*djAZnnEdNp^M&!tX4+H5Tg8;TAf^zxN$M7=-6SHK{R!(Bn zJJ9yPLsL4^jZvY^j1CDJ6ZfVdrn`(Z3__q*ryO<`QsG#)D_H!Q{0{ds(T9ptEP#0A zqR;BrnJLBqN$J@Sa-knM@iIq2r6JM~0?5J<)7Ch@z1>in;a|NobJa`4QUrVT`%03A?p_l&!E299?^BZ^ zS6x!gX;#K!W?-+N#x*z$LN&tkg8jnud)y07WqQ!}>Z$#|^ZrTisv3`6T#8kI#!Q+H zQIw`o_XuAnbvk7%QlWTvf5RS2zm2`-cs*Ag4;Zm-t^dO{&V*;Q1uG8DN417&VW6o~ zUtuVzpP^ZWo*8Pjrf#{n4z=o?FTmWc(gR;EB(ebqQzj-oIfnP+NQ~aEs9M?eqpaFV zLOYs19li%_aqyOzZOK99D*}ovnF-nItXSyeC7S+#d0&u<8!q^3SPRHs?E?_# zU(!4zaS38Mi;%x3b?YEGv+RPq;x!KA#fS7I9??;I)$%M89Y>6cdIG1N{2OQYDq7Mc z>v-cqt$TAsoGQ7PelPKwpedp!gs#X$#);^oEJAq({QM=&)gtoE?oPZZ_?s`e=!jV6 zX->**PFd)g##Xs9UCxl^44lx9I4Z8+SYJ;Sw1)9*vifKF-Fy1H*}aiDyfDzd`Wnm3 zV%F9avB3|Sn%!0sx*D`78c&`Ni&Qg5QDAqZ9MNJ;=Wbbyfg_S`mnVM{Y7hGI1sg?5 zxj&iB&}vvmfEo>gh%Q)Ap{sskkQTQ}qOpO5+;gOh{Fye91$mm3zw#ny!oG?pg%2*8 z6wd}qcAcp?J*VcjHT$5s_1 zBzRn;kT_=vZghzQj>0`+XLvByx*E6*J*Q67<&?M2)S$42fl}zPMOiBa_T99(jzmv@ z2Wf!ZgvR%AVwE9FX^3v7){5vjn3>_(-vA>p#gLQ`Ji3?{%an061I7EA5H+w3v*f_u z5Z#On5f@ZEnO4t=m{qW7mo zNmhOi7hgF|JR})QY&1)k-U#B7?AwDW=^SRe6gr&6UzYYC<-(Rp1f;dS_kZn-n3K7U zCM918YS39My>`TO9hb#f6rl$TFdVj(GB`qdrMC=x75{fBPrsKWo z^=)uJZyN(Av(nF_s7Y;atb$c_Q>{NS!6h2)GnaHlDV2ZrCJ=EY^q`FJs${@7n`;G& zf||*Q()}f91{w(R!zKb{MVwRr0|sN8V2{&;26Fg{eKdjgs5>KCNw_ecks1GK&ZP%S zMZ8SKvKcmq5kpjQ`!C&_rxXfC@MS>yRffXtEIo+l26z;h z?b?uv5c2+mo8Zr(Q|M2cKd;^kxxNkFt>5KPD$3UeyMWlH2yA(Dc(txyBE(LEElm{~A-ZP~WJ^1s`6 z{1gmgI}=7um86AQ;mFm&8XDOR@bfoBg$REM$bBY%LQU&3&a--MJaR5niV7v%KLJ(GzP z2rHU3x`ZUQp7q8Ls{YZh=C&Q-_+==*Y!^mmb1^TF3~RV$azuoPrh(Ve5_tyVYZx>&O(<>rhpnhdg0-oE)FRZLU=b2aZzp07=2;c83?CH zuNfy~@SI?4VK#-t9=Z+KPOJ(D8v}nmU3LIKmp~KxBRGPBf<3wYq zKws=R6a_^j2Lt>|dIRGI{qhm)Eq9^gmwyZ7{nzFe5IGQbDdnJKl4or+V<{BAD@nQN z=rS)Nzo4v=5c1+X^|i){e#v3$=ktthk!VOeXij)*qK2_JZ>!Nz{OCuKiFufy)g^54 zx3PblATk{vsOt$!-zsE1G#^o|M#@r+6Fh|s`cjRorLeizFW6&e^>>Nlfg}cACjg?% zX(}X|wn2qY)*;4V+D%oAnAniKtXQlipI2M3TsfHVApEhqu1r4B*+dLdB;fmBWcQQ= z*u!xWZWY|38xmO&h(8nfrQi{suk(3!UCP)&VJ;KGFX5aIlljy8w z+$nG^Q!>b_^_6|Pg~4zgv&mowAi~A0cD)Jz755Ly?3c<_q7-m9gK2`fg54oedxnda za!!DT4|_XjgCZ(WqL>HU47(15bsb3}8;f<(g)r*K{V5ooLq(bS>j~R{?jCTw1ZBv z122PZb_fB(?OwbM^kSv&mr${^c@u{w{?r<9`)zY=np6oOH+kp4;nfrOgDp%ZszWH6Z)V4wSED8)Q{KV?28I zkf!EnD4x`8y$=l`n1*5O$i%5`ah{fsY`q4KEj;v90vSe*JKWE89OY>2PFU-w zUr>U{W$@J^SDpzh?h}Qym>3dZ&@R$DD%zVIu=#G)9Tq*jMga;)KU4+X|6x=fo& zyE&dA43_YKE#)o@ z&lCf}h_M;&uB;!Ktii7swnNDY9*8CiRZbW_&ANy0RH8Z)N~9>5A(e56P;I{@;!U_dxS81kexJcSPGsc1QZLWsDPXTbA#5-qc2!bjBV`6{Y`o>||X>tCQ* zDjW8Z567H)J;FMJ6Qu%qEh)chkwDkCr6`HfufvTm*a^aoNh?&PhUschnN3aKtDPaVYkdid{#ASQai;?!tLzeSaa9hVTfbjb; z8p$dA08!`WVT%J1eZo7GaM#Jjm(yMsDA?`Jx%}nuVr%#Mjt@&1MMXUr6+E7n5H5J} z<|7zbmtcyKWCCvCbKDZ?*dn>$4y2QEoxjf-A`Cl(ll)swsHf&*<+cPW1nw@Z?!BSq za$s6iV-WCRe*{T4jh*emb+V=~J#C$~V#KFvVNeixa}J8c#fKRQm!+A>(sw2w$^D7m zDU2UI@h3#?KtVm*Soo;@o+3@&JA=ZX zu^`Jc_*=oRMFHL2O-C_G_KGqq|0-VO!7pRVZ+l@FbdB3A&^4IeFQw0)C{@=;9C!R&Mila={g?n;LGRZTy>iD8#!d9}u z7^w^b{&k5*c6^|E@MRh+N5o%d*ftTadXI<|SKoLgv_OVY^S-l^JuEHHkuS`7(v^&b z>`|ywBOqZ7`<_T?G*`U3MiOm6HN>>XPR)TMMuN^1p(k(JN=QWCjBU!RO8!wXOm-2@ z<3S^i-=%t49~en7=}ednQH{E!>y$b+OZ@4uZI*pni)CK%udny*?RxK$P~{_YS30ao z?|e+)+;H_0ccIRcy)$=`WW2yY#3n)E?FFa!C`Sa6hxdL7K3|yR7@D8-jT>YNd`rOJ zhz5Tx_ptKa6TH+5#T(KEpK{s|yKR{bwb)uq3@v8#;f_S1HhA80PQ^mg_w_vJ=I(0ohE_dQ zCkhS&gp7pW&etL2KNSr93GE$4;*xs7cu_2!0`yy$VTKT*-2%97e>X(BXxjL6`FVtd znLGZK)M652K%6H0X3Iul-tB;8j8C*DxaeV=V}8eWD~jNL2Ldh4NzZpHW{4wQdYFOy zgy_r@N#_YsAG=s)?CeebBjjPBfcV5eE|bWxv*#~}r+(<&YRkfWe9DM6z1NSUd@0AVZWFKT6*_H^kfuhsu`|{}AIGQF%_mP(Fg2XHxP93tN#Wn`Dk) ztag(t;r_}2??~E(T{(z=V?9&gXZG^LL!XIHEZAQ-sen>^cfUt#Qd~M}HNIY5`v5gf zT7rn*u|5UJZ?J`kh=P=e$p6A#0P$w~B=AZ03la?KDVG$gK>rHoG%l0F5)~t8gcB=6 zu?$fql&Q{}DJGS2aKO-pNAjgtCDhJ#ak0mQ=tV}sR-+cfroHl$DiDi?9)5FoyKs0w zLb0U$nQ61*U!fsRhJ~qoq{4C;$#`o3!grXKQ9doDM3B34Ld4&-F6N&4&?+F|MrFm? zLyb1gx>g&`5njr{kaNTD5RSQvaK&|%E`&|tyW6&XjepS54>pZ}J37GY5UxJaT>H1L zQon3Kd0;ELLa{5}k*nV$szI}&c8Ko@K1jpHB;$lV47Hyul|(2w5H6CYS2$QT1_K>- zInMJjjG$YTF+^L8*^xdU0keJw`Xgv#EwgnLmV*`ta#_#%#RvlC6zs0T#*cW#^$p@u z09;LTR<9bAEw5NDOY;%ta1DyFIxDjtTKgO%NWRT_BzCuycGt1z1=mLz@30+`dtr4Q z?}gI`BympV6^fG+Li{GV^Ze>Oc7FYxZ}#v4T1e3`sli^O4Pfw4hTkPbK|Vge@;ghD zfHSc6k{V7RAn@p)KcFC)**L&SXlE%|G3Xt5bSz}pxHJbb5D*d&DN&&x?#riZ9@?00 zxfdU5IU#$s7vbUfU|;fEBw~2BiN0ovqVrhE|IKjTxOLvhZ9REC_u<{2((yF?%LkCV z<*D3soS29qpQ!Jv*eIe3KU6_cIqi|M8;>8L-N78yMF;8g4t5O4R9q^$8r_L5p0CU8 zXzOs{8+-OygHZ}O@Fu^4wB)#Q;RwT!iZUJTqQH;_qX5SR+W#Gd=dp{p!9PAfZXcWk z=`ua(+-9#-89H&+u5_lc(?kY#=P`)~fp+Tp>8%vDt#N8IX4<&2%O)j}0}lx&R;78k zyBb_r2p>P|J4y_q^psQVSr~?yAx)=?6t>p~!P`_)$+ms)v5gAs)hFSc5eypq()-^B zZ}8~2`n^0oZ@RW8AdsIY{|s0;8=4+2?dSCq*hm#TcYTl&oM*2x(elr$smUhz9JBX_ zu!mZLWX*yU3AP*NL}v=$6AnU)O5^m(j;e}x3=|g&@LIu-?;(y{5QWoB+@0?M$?@iy zq38SyHSnJgkfg!>yaGj7xb<@e{%;3pVWb_u3h^QSPxOAH5d7( zkC!w7LvupY^D2&yo{RUbZe=|?@qbA#&z7)?&qyZFZ(m(lPO4GXWYoQ+GHo*qoo^S9ldW+?@t$!fZDpRmZ|{^gZ! zBM+qoO@9*l)BU4GwKjtVM@{7`x5?fDE-PoiDEhEr<2R4xPfHB%D%xQTi)vaqQ_sq* z{q_}fW^OgQu{>hm6dz=Cv|mylzxU(a??c>Gj!{MBAAx{Fq@T~(G<`ZpT5YWYh_{cA zyY(RJeAgQzbQhP5iON^(YxqZjkBhH`MdY{wwlZ<7fN3`MQg75B{Pb~nJX%GH*Vw71{*O--5$%t4d&%27s>$%2W-Ff#c{r}%n^zJ`AZM$~Z|Wq{ zexz1|sjTRblR&NnB1ymv(Y!L4(Xd1){4uI*#)BB%-0oSGeq4dy@jRXu5qH64)`Bf9 zJ-&E-$B4z0y|UH9q?<10xeU|f-3jj`B9iyJ^ioN&U2y$d`h$ucpP=(eP(mve+b^R6V8Ch?#;rX-^96x{^FUl{O&}sdKtX|_pr8mE z6%D>P-kF9X;La7DwQ4iI9|*h=r_yWo_`S(@?`b-~0uF~;@~~;pk(Zc#<55NGU43xS z6!1F#nirX$FPIpHxHr~_Hnpd{d7WYiLXSmv<-ig>Dp_KiubZXGr79zi*O}s zg&dA=nlQ-7H{49TywRbd;?s_#q@;(=ZH#FrpLUpMyEwq4_eR+2@$|am_XcffWVCDj zK$gC7%;M+xFEY=XL=7V(jLLX($EY~}GLkx4i(VC^8Y2xAN1u$(#XW8T7i(UL?C)%X zisgxBDm-#~!{5Z(8I;QTpK=EeaZ!|3_s+t?fgrU&Ac03riPHNth!+K4Ka;#^lil!S zq+W0JZ3V-^qS48Ake6m%5_# z`OP=|^NdNLak!01{wO8@3w?Zi!ZX3d(2gW{T}yf!71Q<0Mx#1=F>x8PP)=+w7a}RX3grK!ZzMAkp~7Q5r+|5C#As$ySJmI<@dDZNVl3>6*r-gc;no^ zg)Dr9f3e*fj*Dl&<>*9M(#PQxU+8|dzr88zSWUaBn@hH@JN{~nsBt@`cAEdeY9?#) z(ACeGBPWmiR7G@?TT#X4#USCpNubTxChls>Z~Nd@gclMLI^w;1fs$r~rzb;$Rpk5_!t2Hd1>0jBp!r{J&drW6FBx2UU& zO8-?LKpH0emn1SSQV2xXh>MN5`svB-MO9UU~k)r?X;GynEE4NDQW zxzM+ZfJSO2WVAxMhvPk==1PrDG=F6N^_lkj)vfU$FfbW*4h}Y(F;N0J>J1{EGlnEK zv;7~ob90G$3c)`ua{!4;OPWvx=qKaAT+ zA?#T2e8MAQ3xA(-yS8^q1Q2M7|0u8M>b)&bl9a+bcFDM%!!YILjrdz1sSD|7j(c2N z-IW`1W15hg88~We={5@-^!0f(l>MsdKH&(1`;0-9qdTjwZSfHv@-P;Er~l+d{w0QSxnWg z5bo;I?0TBG)GYWspL&dq)ilpLhoPVoM*LeA)p&A=B@&q3F+gumO7cp04J4cXmT#hc zz07?>xKQ!mx~(T>Iy&gBon&6O+fEbCC%Zi(mo`T4-9yLwMHc`3EF@dJ{wgzyGD+fm zmUaW36v&>RuMQmlPkjpm`)SvoXJGfXOGRDUJ7XVwx@jW=k6p)MKd&1=rb}*L`+`iu z6G03sX3-jIdtl!>bMpM|t57p*;MTS~@Ok@o80Od+60~QhZeZ)73dzFB-C`$#&!Tlh z5eQUgm%Qf$rkKSNmVU!{t8L~SQTvwmXI5)qa+hlU! zvD&x&&*i=n9gwHhU@g&<4FBEet69*2d~N4epdHxq-zAS0Vb}a~8kebp|L4gR$s1<2 zjqNiGU$;L8gR))vU0m-oeE_%rZ%O^Xqd`Gd$eT+J3r-*5@*#l43`0_I4qjBrL=e~Z z6qxDRv>hn%hdRV0&-^YDhXje4quX26`UfLL5qC5l|7~{y_Vbb9#4-FwwA1`)F+!!= zs-VqCr%-s9%w=-5T0)ImszOdd+xKEF&-s>cj07zh*sf{l&6YiT*L%X}E?idsXM7SR z@}6TVD*gL^QPI)E;?_k0Ng{;mJ0ONcLQkK5IYQ!W%a_RrQi@+GYg)aa4TQR6PbYHQ zFr@a$$-79nY`OOAub(4i zZph4R`yvAxuzQf4h4coK7GVGO*kqltsV{c&<+9b_X~dG z%lfd5mb2iz_UySfxVe$OJot(@8e;5WngH^sD~fbd&;6dZT9?lB;$4Jr|LOVp@}c{Q z@`S_s=cUpgNVUOr+?Kn0T8*PO>k&KdSoBBC$87CtBZe8`M&R~cwp`>%gd8+y$r>u%{V-bCA<~FEj^YQ9v&@xu|v_MhqEv)SmXK@e=u-m#O3^mgH+nE zcI#jyzH@T&62v1!l@uY7#<(36$Kl*IvF-zHVcx>geHMO#y|O3!-Q69BiT4Gg{r>cz zAx5vT;tN%hfCv=w^Ll5-*J?eP=5g=e?@nWMUlcJygutO|okzi%E*3?4b=F(TE5@D? z^%V5<{M1g4u<^mi-aK08=SIU3?Hq^t$_xjA)S$Qd?x-bDp4~Iq{yAV+M7i3Ao z-64?hhTgL5oTRUVIb|wf|FrcNg2x2`!!>eY0I3yBqtGU()P;ln4m{4ZT&%Q&!Ox&~PW-qtDFj^o$WoiPUS( z{MWp$_A06>9Uo7(2o3sYd^!~#VqJr?}1eD2jPh=iCp^IidLa9Ef@o%*BqES9D1e7)(N zG}OR@*-|3pYUQtkH)Mgc+A0mUpN@|!JK0=r>ugo!(-U&rZZaU^-uF%k4j zjweM8jY(`hn|{MOGy;NwjtLDwKyIF#j5k_QTCdmV_=BKZsn!hWGhbduO)I&Vhx5H4 zxq7UbXAb=XE?DkJ*^8sU&Ca{LWX57j|88y$15!F|>hw6`Fn#b-)+hYRNMgsawN+Om zpV536Z|n{Vaj*)N08LIxhwba#7mu&vVDOQ+=1aY;Cs=Zn!Vo8IZjjp30WaA1iJbTiMhUHn9oT&a=vDH|dTp0%`TwmXf zyX4Z+7z(2wcy@1h;Fa@Kg+*i@o|EX_k5^Fgm$_+NQFnQEKdY;Af6r|hn@sJlA9s$)SJhfa7rIE8|y8=J2 z2aetQUZ>oH#SXUC(_qxJV^vG=b>tZ1gP*%J+NZJcT+|G&&IkhjI{jv?(%zGo${mO- zumotc5GnMbdVOE23%^HNV(*Rsvw7a$fFKEOhAl|~*7ThA2e-C2VD(fP_4>l{yyXV( zq+j1&-5vkI0nv?GbA{RFnBx6;o%)A%jWJ*_?oW2P20QyTOSgLqpYb!$!^!>T>>^e| zTbtgl_t49Sm7>tp84d3|PT8UEzSGU)x$t#(x>zM(h z&WWAjSkr}EaP=w%NFtW=-Vt=_`IF{ za-~s$-;n-*+)lu~2aPBS%yRhq}j?#^fzP+RMw@=!9inH32Tizj2Eh z$M+1=)y1!K{sClz#l{1W{ZJ?nARm==DbCtvfJ4X4ESiIoFm?NfU)B=keNP%Cjv8D( zdR4R_=khw|1=1Ox%|@M7P3bW9rnX$JnXiKd?&rzjdSDGl!Y^GLy_vJ{Y3P1k65M=Gt3koUby!%iDjJL&-N*}oy_(CI%*Cfk8y_qnAC@FsaCDBW{W?;5zVm@aQ4zJ{I_h9_Ec>XH@w2S_)BIdq zs=Z)M(&0yMn-)`7goevXk{DkZW?^Y5e1INZgzN3XO@zmTO6Vyp>l+M}@hIQ@M7&6V zxJcj{N`W+dSX5ZCwy;3N?U+p&RX;L0ZYJpMXZ;Od`NkkC*CWv7O5m-33|HQ(0mm73g7vH-*Ef;Ry? zorZzVj^k{9k~=Ucu#2bKrm3d(;d0C`Zv} z&1rq|D>eT&BQwhftC+1TR3pFK`%?5s%!l+@154%_ar z*__d>O`$EmS1mbkG;40>YT7jeN6swF1|Z0?1Pj$rkEuiA@Tdj`XTmZ-07Q&g6JWNe zQ|Ig4UzhPP2Lq)-KUseRYS4&in1edZIQRWL{-nvsy(lghs;uGx($i(9e2K8DnFJ$1 zIoIpdG&Ii;;NkU6w&PqC(WzBqC2^CL=uG-*AtJ_z1~*=KAR{B6{c$*hB`!ks^Ao6) zmE~=;gk0kC$X@HfG=Dmi*wwjDrbfmei^c9d=0 z)V{u5kB^VeIA0t9)1i{Z8Rxn15pI|aEu?upztBB$)&YQo>*=zDhKE>~2PlCx7iy_4as{7 zolb9Sbl7hYUIYDcbHjId3=^KS&W%nM3mctEj*^iv)1L%9vcSxUl$hT!`bnb!pd%%R z$Bjrg@;O|?t6Xe=ae<;>VvY{L8gV%>mae$yb*chV8^)r%AN2C(#^lGdlV-QrST4`Z>h-VFMG^%_hMhaGL_46k|*N}Z-c4K-P|-XP^5JE zX~#{cR9N63KqbqGzb<}E8vGRC1-Jm}p)BlouBV z!yT;+TrSVrH8pvEij)9Zo+BqQzpAl&fW7V5din71klc$CGvrG7J-2;|@qX`qPaHws z^s3OqdZiBEe>;&?SVUM-ifCVhv0Bf1Tp_-v^;CO*Dr1ZGNm5Rlf`X!WhebtYYHzpB z+?NVUWZcJI#u)<~9ZH||3E=kk$vqT^_|k&@qqC+e%2zCSd;)+)$?l&X<=$8^ z0IRsBo7Rla#vKFr({$U;^B@{FHr+<#r?df|q2}8|O-QKJdHI(5Q`6LJN?%Tu%1H_O z^73y9j@`b3Csi0?NztKzK5x_up{cq!Yw9Iz_C`B)_W(j`~yo`gVXip!_AIeuGS8&kIDEv;SW_+H)3s-lm~(5XbG%oaylohZ&@*R zaXA#ET>>-LwMUUAQBu;<0|svKUZi=+yP}`@S=-h2L{{h~wcWkFu2tazso~gAL_4^SpJUoUL9mc6_p6Lk-WzMvmaiCV8I@rHC(d!&3pItir z*soo<6KF8Stf(lYfuk%j@$T>~qCWgpG4?|2H?$q10kjmLRaDBWyLw~ip>^bQMyZ&Y zqES(`?8Bdau zks%cIN_H+y{G8MqZ!Y`{f*=67+qV$9KY4H=Utq-Cc5G+H`QiIS{Emef!g6I`%;1-e zzvMOgzK`>4;TH!_*k$G`@92ppV#+@p;p4UF`^?*9N@w?aB&*Gc85EZ#BqIK{iQLiM zEzteG7xj9v@lmJabNP08I;~n~vQlkpH5qakBknXFG+}um(ngW6lUFGCw|}U~do4kdkwyCdEyz2Lt~Nfyd8{xSFru14<)~ z!|Gg|%|%L){K@D9@O-ZGOGAmoKxM%RJ+(E*7Z)=N3q<;7tcw&CTa@f!=^GC*?CJ8& z^V@{tkT`7F#XxTz=RctefDNyCO3L79;4-1U*s^1==fHizX-rMmu~RN@SU`~+XIDYa z1j}3r{}~vHF9t2Wk=*-V8yDt}*)zpftdzW%nSH^HLjgydf=~7)G{3K>_f>CzKxPfo zBjolEnaAxoxf{?RWZNM499=Op1wrVea*^H2|3OPB09xYUC`TYlbd|`9I5uu8(U8mh zZ%~g8z~)1t{|-^MdqW-n13>>F&i@AOJBDy8^d|ko7{VNHxk})2ZR2az9wc{W=&~!W ziWvCxxXUsF6D7yz>!EB*i2gUr__;7=|GO6eIPc!`yuT-;`F){jsLI!)YEM>}fvwYT z=p}MD`hP~31B|X)#Z~x(Sk?-0t*V4R7sXdgVPW~TvQgtc>>#x?|FN)orvm+I}i7jg9}WNB;_OCne97bDM0XyWjjKkn_5lft~9U8Q3>Y z!0lMMc8fb(n%|}Z5R~OJZa}yf_-WHaBl)fzP?H0dzcQ7)V9mmgYdb9i1JG_3QKz5h zUwQ{J9ZkoNfyQkm5Gr{*`5!+h^lX=Wr<*Z11Y$MVh^eT!;c^P?f%s;_bFTmdy;&!G zBCJTDy>HI0nFq2ILHbc}#1>`=?Q0O(2N z-veqxpinTC$?Ma5ew;mt1FiEG@H8~=UZ2W@*i3 zNCzg;u2Rx$d?UFFV&-_7^;J!HF0$JWOuC##lty`E?b>C7y5ulzcRMmDesE?pVwaTcec}hqacnk{E`jk>`b|?EzE8c} zABtF@C&R9Hu?XI?DFi!_#e)yzsEVHs$G2QS83z!ZB4y`K8SMYai6Le%{T^g|u&<($p^&9}j+`C$ zEFIci_?rxA{d|oGC%@qXgm4KkJDXj5ZAK12r8Qlwepk6eWEC%AvFKAr5C_k!sIxgB z0=n<_o@W3P(aDY4Efxiem;j-g(m#e`v%itf+9=7$vVor2)vFgE!+>wz8}u+FDyMq{ zgwWKD`cD?-6y);qm7CrHW{}b(n=5PQ=@metBTO_D92bS&be~-Zfn^0>D|Hd>P)GT= zCmTQLi_U$9S?-G%dIq{-`>~$-68Isie{ffvxV$@Ku>>DOPX z^+pT2aEzD+%sA?AkB-O36T3R*#D&0&BxEO#EO&Rrt=XCZqEl6%DO;ek6-i9d{keRY z%XOO_=<%MyIw6%N0d27!Hmlsto?dd@@Bi(lX!V9A_Pyo;MC=t%JB_N)0cA}#rw5cj zS3_x?!H$~s;w@$YY44|gG*{o8is_ywS7dX048LSJbc8$v+H z@qXM|R#e#P+nOKR$9(&yna<~wd63DD7X#2hv)MGgB$h8R4NC`mS&E-X!{{@^d0HVj zs+@6Rwf-z9Xv7a&z0p6k0X(^L9}pUXHM5_lR#Wh5*h@Lx2FHYniix}alB0|fOThQ1 z8oHsfvag{EkoCW#XV+r@D$~5+;}7iDX)RT2aC|}|(-PodCe7t;SehjVy21dO#3?6N z=B_jYqI>%T5zq_*w+Ap5a9>%OBoq}w&$+$*@dVfOby`&QwyT>S8QT{d3bW~)(rwR@ z(oTR0-Q6OA1OBDxyoU#Jw+{t~E1woTd`h=|E4YR+wWrBm5PH>qdQ_-v7CzE`~HLvcbD3@K9b_@fcCW_)~?fLwEQ zypfWVyY-C0N=rsXBM`N>M*%4(R~iBSY5L5Sjf!07e^7V6e3+;;e*H?A&2n1Z@2Bkf z@iUv%j+8XtcLcx*356Fbag}k|?LipR@H=(m<-n{y$~=a?u@Uwj8h; zy#Qey zdwYd2?zb$C6Br~oOSk^nR4tWuz9zs1dG8O=T+f#;S~FVFNqdEW0@%=~h=)%cpa+YY zHZ9uKL~A4f5%3CZZqDcX;zI!k$Cw5$AfSgKws6F9a;gmh390BEhFqSSqH=k3pofN{ zZ>YOZj~0foy(7;73~-<)*j*_x)FbuoipBBzmaArgrf2C?8|b&&1N0c!bpqcxj$;k;B$%Y0NAe^zGZ(r*vCPn?Af&-7ErMn6<2 zS;?}8ReAp&dCn0*j5nn+Xb8H>5t(r`-#*6@^DNKq_)x>aF`*M;N&&=$5lg!e*bnf) z|N47n`s+8%#X76J1zj~gVq!8f&j+mlfY+1t^)1W71IoCdu5MvraHcmXJ@0E4AZmq8 zRPG4<_&pXCfQ~w_@9EFX%;FIXD-J@s3>5;DNOSM1rA^=TG&V6YvHa*51F)Hf4e+UT zj|+5w$YF?Wx%oXv*Gz>B8eYwHZO{T+9Ax!;C;dLAyL%TF(uRh_r*e5VivEOj!S5Y- zSpI{nce)T*{z@4GRM2Rx%XAmfp+QOCY{|O+bnZ* zSKdUWvGl?5w(R#ksrG+*wFH#IZXOjM{VYQO7!07Uxz~PncXyW#06S|~9Yv+5!H(mF zD3A!Fb!(tWm`VH-$P>$3bfp05T|i1&OyReHj<>*+`uNy_bi(CBl{K+6dv$Yj2k{s1 zE}BSS-yj!1KcKy-NBcw3&>f-DwUE zhbeo5sodTg^1_A#2?q{BG*0fsw%E;LlM#nt+VIGpqoVr}tA>*)fRTYzksHR;xfYx= zK5F#mRR&08Ui0aPG@k*)_`0-f{nW#s(_&Ep2o1SAE-#I<|5`covZjL_a787=z!xHv9kuZu`L5rCQx?F z+T^-%`cP^8uM1yzj@i+P9nC1OkN$4In=G&c9M=Ef0B97{87>(nCZahk0-FRzsDTg! z@ChzJv8K=s^0rz+l7~?@xURhZU5b)OHOv>U)}!yk-H}@?CDyW zSvE2`ya^>y2S&_z_MF*3mKtL79Q}U_+_e{;$^+|rkJr~X_oI-~fK;?ZBWgLX*b^^e z-?42-ClB{A3TJM@1!-y8nnmcI5O_%5HfPiYx?k=eMbpbw52iMR_}_d6$)gUu#Pzs5 zp6Q3Rh_5@)0c=d~WehqwIr*6kS0-N^$6c?Pbg!RV&E_kGRsPN6N3-(lcK>k#FRrjm z8$KMb;!*D)`M+3u%djZFwqJNqxf{=rm}( zdlHeWWM@n04N$}Xjb%%RS{Ic%DXV!0G8r71{@5I5BZ_{z`i0`wOP@BUWn1cCkd~B& zhYk^lKU(f^WHp(2Kz8tIe22h5<_&9LK$gAD&9t1XkinbYJw@|pe#wl)!+k&%%2imC z(#{x}29(_mxHo2raI`mh4&+Cg(YIH+8bc_}--I27OF1bFD}+unBZxzrWr2`qUQzv2 zQpE$yze%2_%=xPlIrH_qnN^z4|4=xj?aR1X>?GTOeM8zq|#pb<-U)x+Da}n&GA+ZPC?wJIjSUAbhu?PHI?`;`9eIQqTFWq z=cNP;y>Cv*qjmCft?jJ|dd5Oz&)O(?P5%CHL%Ilr3+$3JCT^sswZ&bn=_6@_R`I^q zatT}8q~K=U0y0KT$9n8Joe3m5Mm+(8H&IX$BLQsCZPEV+LgwLn_}-b%=l0j|-S%?q zm-6!clU=iMuQcFNfhry~X_22Z*>#dw#OuVhn^|Lh{wy}Zb)6FI%T|49Lqmu>p4rJs zQTpMq!|?xZm-~7y{bBU~%W#8EJyQl3&%)}__UZ+%=3RX3VJx0D0yF*uP8~+&PwLYTHDlo+~t#|n;9$(D>HEoQKq);EJ4%uT>Z$#@F~$Eo^LW8aAAjv+ z4(;Z{EJDK%cIb(|C)iL6b7^i8!lBIw_G0KRH!KvX>V5NDTO%iNK>#KRFlhBJxdjCN zyJ5S3Apj%L^q#G^w_qfV>tletBmt^Ng#6ILeTvccDa{r>PC~kC)iBrNT_dON0E;0Y z$zF{g_#55vx6?(T8$!72e_$#}Z|c>w)nnF^{NKsrpPt-AKi`p-3aU0W!aMT0qOYy} z0D#Kr-E?VjNmD1Vv~`=jfmfw z914Hm9AA77Wu?&j_owl?Osh8GdGkdbyyDYRGJ`jI86R6v@Cg&+-#AVwK@Cqp=>p-= z$$9A~_dRyaNBjCMwrYi2gBK5=%0g&2j30n09>i$VxVZaDpV(iGkGXp3Z9Gsl& z<`*1L$N>4ja-EDf{hw&bOfFaKfE(3s!SU7kBmi)Rt>S8dHe>ovB@WEAv(Ltw`4ypl zAHZ10{le|h-9JqY#RRI&-~0&z>fHbUWL)0YA5v}LL8hV$plaXy)!D2TLIC$>Ts0*Z= zC?LN=qW&=j-F&D3U%-j%oig(N50XczUqllDv>3$uAUOIjyCxUX^&DEU13UdD_wIdc z{zEnDZL9yoGt3GKG8a;RhlDT%7kA!yR zp6!c&ocCW8lvmF;<`+e;9mj71*V$yaE@Qdwy7@!n_M*t&jTNtSc;G+I)lFlSaTak| zh)@jzC<@@?&E>_~R~=)Ijxx0lMn^|~7IbZ!j@J|m2>i(Eg9_pjX0|)8>ueX{Y6M1# zr_X=mqX6m;l)XO>p;-*9mOiqZongwvQ-22x!$!b4ZF4v3nQ)@LD!AOY55HFue zE!X<)Ze(n1Y?0}93e3s+Vrl3_NE<%IPEBOZ*AQq z$`i-WxzY?6m}zdkNE2Vg{CPb*HfXYxrYs>9F+%SZveWkcXrG`WkWJ_k)K~SXM zsCu3!Yfar5fbl`!0i!xYa`F$;tacIg zo!4y(O@Uyz2^C%ts@`(h&5zCh{&RJGdoqQh_;gKOEhdBKUeEJ?@X^|5x&8;6$5YOb zk6%#_fSAw%`JHO_VVCimiUmd}bUg9S?#X{=B|7%&wh60!M(GDpzomik$_KhjyfM!F zP}Q)bNGS9ijrso-de-E$ux$L-5UgzIY1@*fd8f{kf3RvCm{DnL_AV_zb%0vSAh6p6 zO?3Z-Q~!?MLIcr%AL$94rsdpLj>lrMJ8wA;J<`X_w?W|)#dbl|Bn%HwNgV%#~Nqwcq;kNh+KpD|04vw3FM&% z*|U*+q)iK3TcF=hO;~^g>NJo)|FqiO0-^WrcX7YvdkYD>iB0FGf#K!>?$Ea0b?24y z8`}S64QT9N1BKe{wvucq)dYCm(e#P5*|Yl&&C5wCDb<%96pVPKUYpSJxzQPXTGzUC zAg5*Pd0c&Pw~|r<08X%VZvmizkJ*YNo!!!c-1u1QMvP##2Y4|2u1Ak6_4mJi7_U6; zu|q&0D~;FWrDCOf06+*^?)LTd!2I0YG-=uA>N}5YWVsarx;1;D;yR1(eVkMz$fy&< zCj>2Sr`QogFRnB0(2=k5KsiB0ZT^u9#htpWd^7nWP0!``!&U^%Dlay>wsYoDE}hWp zoE(ZWA1_{zvg&8I0hr4)Ydr5*1?zuCgwZbh!2JFQbP$R_gxnIMf_K~R=j%|4ro%f8 z4R_AyQRPVjCJpl^jg3HRjg6ZFlZZ%c<}+b7T|PCf`@pL&%x8bTgnCk|rFZl-vWZp)6zZB9V z2NUV16Bbp++bPe1O9KP4WCOteVck3D&@Kbf#^lmo2r4mGkPq9WSE~sIu(qGiCbV)2?mfXBB|!oG{uiA{3=vh*5MMbNr~OG=Vb)V`Xp zih@Ci)BKZ>kAfM|2Jc}Ex599QwAVj!?Eg63De}{H)4k_aq|b^63S)7>fvd zgrVIn6JToB?Ucv&7J-Uv>(IakvB1lKre?T34QNa+RvBLeme8blxYvf=y}pNybS`2 z7la0jOW6|v@r=Y9={2i9sq}Swt`Hc$*&oMa8aK;@`@cIBf^D|oXqI8agQm;kO75ph zIvR>yer^%+axfqbGW3&uez}g2T+jyA_wLW)W&V2^XjQn>$P(BqULgw9RpXD5tgy7O zIOwCe6d>@>2|Kc^yatNy#J=(GO1Z43#-rGX7 zJ@ST!7{a0u`)%u0_4LHs=Tc6=;I9LTfLBt|RtmyfX;j6FGxh&dZ@;`F0xlZsb$yNZ zf57#B(eb4UqQN}ad)uW3B)`TS|8J+rmHQ*$tv5RD(pP>tBe?{QVzYqI3UDNf#@<7h zFp#+;#ie87`Ch>Vc8bV3Qi9?qt)^4a*@6O>acEvW+PAnb)L~q8x-?y?1>72NuLYZI zApnL8fN>&^cIjBT^SjS{jywR~xz6wC#AFFj{nb;h{P(6QuogppUl^rdykoQxDmr)c zB<8l;F31uVcaYVJ6*m71p_gpp*goE|-4M7R{-j-0Xvcj8Tw4%OdN`4?!% z!I5xqu#BA{1Y*8r@#UYzA15bunV=*=Ys2bt`7h_C7OlwkcCtD%V&>G+{@Y*ne7ufl zuz-pImKmP~=E%X0l5Cw{+WxS4umG%7k)5)i08DM%0#D=@yn@20Ufp#Hzh(8`b}yH+ zwD>g3CPe-_-%s3GkCO>=RaN$MF1zh2X|i?Wbs8W)W`6j9$5#&4(Vf@H$@Sy>?P0^0 zit>Zq&mVK}Xpy)6odrN0nNY?;2@6A}touUHJjdxG8BI?Vy|UHU!p42%=_H)k!oA(f z*4X%hjfit{&R908s-A8xIt(!k2P+>j_l%3xY3veVWH4#EaAL&WM>u1Bgx<5Vb$n%9 z+w-87L{m@w>`QTRaGieSQQgs#-UNLP#{u#Nx@3?LSm%Q%fE!EoRL|16 zncze*5m64po!C;rA;q}KJPyCO)luBuy`$NrVhZ~9?UkFyC!O}-Et81TQ)C<*p)LS4 zM-4C=N#qK!9UGTkCZvB#fiWPn3%Wq>{8`P`avy?rey(k5YDPiLgSZ^{#9?!Xsq>Y5 z9Jy!!EE4tt=_k%NyrWWGKZU!frbuSBTYl4*6uwEG%Du;M;N?A0;6$5uYgMbAzogJTH%TRufc9|kGMT}Hvx$N( zd5n(Et0!)?ZQW>w8&ftr&%l#Wo0S-!S?^sJHOS^|fXss*xNdwOP7y>gUq65MijeR6 zmaXT~)(XDxb;K)2Jxlb4=3+MMKAg8|YEPq{x?c z-QjLWKUhCHLMT^{tT{uCBIC!VmJOhmH4A)6+yv($sZ z;I#SpQ%Hqwv;RDMAtetF;)hRs)XTD>GO^@mXc&?yGP6<2RFoezXJg6mH@mh=W#nw< zI*KMOFg<_1Olhq_1YPkbi|HRUQuf`^yisCSA6LZoX}p&$EnVy)ZvYEKp< z+MXc?KZ%VXrJ{&mKFH6nK?SEbhYddK>ztoQq8447IWPs2wJ1ZhZ1ixY1_m+24oE!s zPFTXfS3-*u`=L`7*>uRUq`2!6CRc;v(r*lZ<)2(ta_a}bk*2ul!UY}kTS{?ZAzpWg zP~dLin;=~ZX+1r`ibtQsaEtC)yM|+OT8vE6Lm8Qt?t!>mx|RR6obeD>C#q_+b-w3g zI5;}9=5MmPuoe_M*kjp+$NhWrfmI{p{!E-UtyKxxf$r~q1P_s~kE5ty`~SC>O8w`5`TJ8vv_|SD z;8g{pznWGei^?!NLzf?UPOq%{wB5Hemk&MBJ?Yu>M6i^OEBNd#)C*9QsL3x3_cjbr3MA z5hs)|VQp!8sJ?op{e4}FsR4zM%M`?>zn{$QrA#9p&K5`ZQzXBTK(UbenLD(|EMHRe zio-AE(_P(?Fidc6E_?n1IVNo8JB(g;zFCHkZCN=~785wxaA+zo6k@;|H2rKFzbm_? z3%zll%o*(tHf>asTD7=5upt&rRdKM}b&8PhatQgly#ChhK9T(N+z#Aq=$2Le zO83V?clQFUjRxio{QM9cI5Fm@3QutqYAvWnKC$5n1_UzlRT@Z;fh2k159jiBi0jBGnpGY2U+!}4Of@Zs_?)RygJw1Z#Gl+#!wn&^` zk#2~mG&CO`>&{!P<>4Y8~yRx1Xn`R}(V*wq^ ziCXr|Xp$&0mjiabl^kz=;MtL`+TM3ojH4W`pedV3i!mqWsONREw3AAUu2Zd8KU}Z) z<~20Hf~rT3WNK!%Ibv5u$G~Ez_B61x6s1ssGBNA z@$Jl++}Rel3M(kPR5)@+-XhCdE3+g%;9}Y{ng=*%ZfF2qRQG@ z_SfPV9Le?mdjw@|?VGn~q(IB*+c|PslXXDyfJHF6YfzqRb7DE-JU>6b^17FT_`QB1 z4q61XW~R3<&X!CxoCp0^*>4h(yK@3Sh(RL7fn5m3L>ePhyC6VH zH8jhIHy{))7y{;mSW!v8lQ{;Ha7b>>4YCikWJQy9ilz~85?R$EGo-eMIkDlNd|kr= zlrpN4%hrav*fveTfn=fn4;WwWaIvIcP&5Z}7Rqa&+|ii*Ro zEs^Sxc_>;)6t!|`argCHq)cNvvmB|74Qu^uhb0CBs=_oj8z>oKiHXg1B4g=JAEsAK z?3|L9YnDdEhTi3)YBQk`%KE|kYcmD&m9vnN3I$>bbu?BNDbMGz;MC$GzHW?AmP63> zmFTY0gOE7A5}BDGrz0YV`7{;oQ3z&m!^}g;+1X1ST;P0ewh@PhhSq;?1tkv~NLbwn zs%s?rV6F3bUkE(>`B5J?XsQYB0H5oxFa%!r5#F(}u{7ab-aF@GM3BqZ>8I-Io}l7E zOs~6xL`wx$=SoI{-S!E{D931Zq|aE7Z(%E-cT>N6MzG)IWnu$os`ho{%BpO5O*zK)W2TvGMx&*q)p64rOPoqnLd+{_$%ErPf*G9u$d+=S@N&-@cJ$gO4dB zv~n|Jk~tdeSCIj2h*FQBtn}Wk6jTe#4GqOD$Y|GUGcoHnMNF(v;MFhJ?mIxQBN*%G z9B(I)ba#gn^9;?FH}{P^R8`hODyU``A37>5WdHD5z8!(gPO+ObDzRuh5J)y0L?Dp4 z-c?ZgrMMhUVR~TL6Oly`W9MwunE6$NvbuVVvQ9z4s<>WW0q>&`%$6fB4ziJ6jZ@K^ zFBQd|qdMWy?+P72z6%x(zGHq+_N_2hAg};<_<6zPITZhY7Q`POpt;ykJ3~dX-Q)JY zUHkr#zzp{V13yA?a&p-v_~HfOHyJ{q5q+zrrPjc=vr81vUNp43@tHFbkDCx=Y^<*# ztZ~2bOY_C1u7Ojrk{7nMxnD{+)jX}>s%8Atv}BAbJ8D9oiZ$`GCNADDCHLe{=Q9x( z0RdeShvqRt?;E#uD=%KF(wD67Yp}I~9k-Omcy241!W2AFnV3RRVIkNH9zOEdG0V3E zS&k+NKd`7WpCcn6AXwCD*Vyew>X4*w&<*i)MaJYtab$pbXR#b5%^z2w_<^}|c8?I1 zpQsQ9nQR(qM3&9by2^k2k$97|8iD(BExu+p9HZx9Ky?DfSFX29Mloq1mdTBe&F; z=1d-WY%3HvN?KZe{Nh>iwt|kCe*GKS!Cq!!d51BbtaAk` z1f=rlIBgGG9rR~(&Y5$Vffp&kd52+>AT^4GeoB&B1cIH?=RtHpAxII6>Ts@s;IHYv>48|g7@;CPAET}ZR8__Qki z*!faJ2Z=tlR8RiW+WG>5G#D^0V~n9SS3TN8+DrF2Ru!O^zrL{XE?BqgDX1dvLPEljrvf zCX)g4XtunZoD){Hpi75T6Yt+w>c@5m zeVKfX>QpdAnA7U1O&wdudP2yIpuI8HQ7SyYVdQY-Dx7UB2^E3~ogXzw%o@4;K#)7<4KrWqt$J?N1cp)qD za&3`g56@3#)rLh9sKJ36Cz}rjpnt{!)xmi9lK1vN{%aL%!!-NKk z4`b1mJn16(>M}gp0J!Xn^1vfU%r`gPSgY(WV;=v46(2^zhxqCv>c4~zsmTv9B>cfh zoBf98)(j%bI3*?4_BX$;``S_<8X6j9+9%i|m@=}mlG^Z|tF4I%$e_dM>wbd(7z!YN zSa>U=HfgzoAvekQE1~j_HFJz?H=DXxT62tKGn!`9k>!mahKUSxbFM><_=?e}YhWqx z#Tga)k-HrVIm?^0#G=Y6W_3+i4ek|o;h9r4r8^|j@W9nFB@cu85yVu z7y5#PJQ{c)6-gvGHRR7BwNXK1@lwel60PtPGe4CS=&}os@e3 z$;nmNg7>b|iaJR8@=UTQOpV$qD?5}MDX+^?lByfUO9Yu7I(^Ny`|!kUZ|1Ab6<=pP zgfbMpDe5lD@)_dY`8wFrxG2gB zUs`UCGBYzZYprloSPamUODJ0GRaCG;(1`nzl)o%7;kk&)4otQRhEG`$I=+0KlVdGv zg)h)YOQKF%;!=-nW8HbERUQh^He53r~}Y{F=xCmhu%HaxsD z<~hIp@tSDgkD-Z;&K+7?YZ+#Fnd*XZcEQt?2~__IO@FY zuHz}JFKnuj6g%A947|U+>|TA09WWz`hR^c3q2EoL{&e{zjAlI~YqKx9oByaK(ElmI zx0UgUU(0Vl>{4!dnJx_vqg1wD5b3*b<2E!jAQF*XEqv9IX*5bgPM`+WTIP9h+{Mc! zU)>n(0xIWZJ~|m}^cY8HN1ANNadykf9#J@|TpT&pHrM=FLS+;!C(|M99{ z*#3&uvreO~v#uBs2|pgs+Q!!EnzL60#J{SjH(;`GqmJBEhrSlys5sF&yK4_Nwj%N> zOxxSrcU0&#MQj2XqjR)#NO(g$c z(OvtS@B2?2a#liHpawD%o^n3#Tg%`Qf(ZQgG8=d;SHs@+!C zSL}2QG&q@mFe5b;~6VV+?^OdTcPZC=mTx(!D$ji^F&W@a-K424baG3 zsVe9jkDE7}b@;)!o$X=mci8;8J=oZIQmc)YEEjCM+(aQDKmx8D0gpZT=B+u;$td^; z%gwI+PUC{134J`ry7CF5HdQz5*pBzR*`k5Rqui^0)UsX|^X4G3vieC7GbVjegqqc6XddUk-X;3?Wje02Lw+s} zt*(-lYE<@Z^hU1l?OB|(HV#=`z2P9HpVetNSGP-;%1NNK=PW|U#g*Jk(M6y|Am3M} z*@&=sJMD;R`W!KWbsC)psC@D4TsZjnn}dn80r?~lQsD=az}xNN)GCvHbcjgNn+(k7 z&!ce})H@az7xx;yZ!dbsg&(8BpV8*lvDHwozABLzNq5P0b#&|k8#nDbSV7D4(_%jT za^R=DC7Y_}?`gI|j80!Dd09hp7ZrsRX6eN!OVPaBJ zbg-Q;VF6N?Nq}Wa?UWVGjd79CEq)qfnquN>#mg+5ql`xM#t|903yE6x6(JeW>oqkA zp!z13lf0o74fnly*yqnAcdL*0Wbmj2e&Ft<3kp+GKG~lsXHPf0E@K)^zL_UIt)&_B zR80zwT`JRS##?Usut{^swEpA=(bjCjxn;C>b1l}XeyfKOcvb*&qs=6yrKZ`(*CF7> z=(hVjPv^GVq28jQp}E>hRK&!_4zO##uT!JDhk=2)y4kP9!p9HA*LU+zjO*{~GhV2% z42y~~jS>?(!odI3tD>)8En+SIEEopf=eTvY%Mm3dFC%vY3q|bhSs(V>A5f~zMvW6_KLJQU!s`eNu86p< z?&swp+EA!YTO&Hf44=~X?VXd;)m~mKIGrgnRo`Q9uLUd+ls~v~Zh2rUX)Iocd|#+U z_to>#*7bc!iTzS0Xou-!_?lXL?{ zy@Oe>Fhw!J2?m!++S*neNM{F&_<;x*T$B-FAEmBe5P3F4hbequdXZeK)Oa;!ayyF6 zi-_e|*L2!g9%hMeJv=}wF2DHZ_0R{M@Pf2kt%ViiMZLZGa(AZ^rigr_<@T!$6tks? z&C6Ba{s>%#Pa`~&*xwc!9P*TT-V55Uw1i7W;u(RuG*@L3s-C@A={EDQ|Yvj)C4Tyf)RY~pbQ zkrW&=an3@N!_u#VWxi@Ayp#RdgDEDzHEyd`hK3GJPt_}13x(YwI6}Z%h1{8!v{`KwE_bI0*V|_AFeiILFElQ-=C!t z64F1upZ2vI^Xc4iN%;6N98^gXu;1tEY=}!rOWkkl1iRzpgto!@xthjuqM+>I+FNOK zLV$yVvzV=T?&MQ%yPU0Fs;sYX8{gZbLOJ46!6_mA9#PQxF7z6)K=7`vQ8(x+jFXJ5 zCWJg<^vrU9i;-Hm>a<46-9nCmE6cH`V5ttT%Lau40|}`UtQk8T%iuywMx8oT@XFts z-j~Z38&MVT^76V}Z>Pe^HvIIY=g8zn5PG;WQQi!0P2}OUJ0;(H$~xtzf2{lT>1{N1 zA%$p{YEYr3k12}pfaFwT7YrlVw-03MR zcUs-6(cutq+mgI^^EoUm4DssvTC_kV2Ppg3*Vhd$2SjbxJH+_~1xVPh*-R4(E$MKO zK^_J+K0bbLzM9tKY!60JQSr;$mtaf^9Qcvj(n6x8r3H|;D5(5zvV?4K;9r*oFJMy+ zx{fH#c&R%x_YUI)ha6~HSkOTc(!_+)+3$HU-O~mNoV|;S6u4nS!^0=X>*7n`YRk&X z@;L3F9xgYVC#o4(beH~=5;r$D-?6*bM{3(|ZEXc-Ed`rry2A^4oQdp?W#p(7J4QX= z{5uPf{q`laPl16b0iQd9larGM$8BU|V`C*SUoW>({=?Xofnv6MdiohCp1|%XojfP= zxuQTP6&R4UI8X~sNn%Qk@5VD;OiFPU%8N>KtS6M`wUOyKKV*pZoerU13i?8f8jGLBy9*Q7Cmz;l5(1$d6KIfJ?{6N86Kt|3^bt|_0u0c} z9#vcUb)WL#f8@Bk1-)FVeUbwW;NZv?mjIy?Ul+xa@M42^EVVnDDM)kZ)SFj+lIlahR#Ib4`3%&_MqpI9H>7)ki0;2inkP%CywW-+#qo z6&4n5IUQmErxl_Dg3f!Cr&64)Qan**B8^JG>c^WIAMX$L{#x@Yya(pgiJ@$Twi zu^sq=M@{cc71#_rAT8HB>1jL;l;#390EN|RM>Fd+W&1upXf`?1|N8aotLu@z*GVt_ zz`($o7lMxU8K&nJ?u0brLZefWmQ2S}1a#IEO^R>xczRwzNhgIb>gtkGkMuV86E7TF zDbkBWi4z?rq=HD`Q=GdM?e9i|3s{)DbV@ah&aH=`!lawex~`kM2Luv=P8#-8l~!BL zOG5)+Vmy7`bi?6;L+4}5J-jtyrjK_wtM3>pP_ye-?@$DY_q*q_DaSpDSk1my69~Nz z^M{j(dB?)k)$!mBS9yLk2UA(8ZI*RWo#V^s?SRF1Q)~X~&-*RIF{el1r)`eTYOIxW zs~eA|m$L3R(%WxRD5Z2{p1Lg{Hm_H0Y#6gAm=IWN{+8kqhlPb@?Z-uiPzV5{OuqOskB5LxeJp0vZmo%=|Za8_#EpJ-mtv-&_=59D_}T-#1H;QFTf zhyLlsC%^e5I%}p(K8AJ&wu@B3Hpp7Dk|!Bx$GLBkPrZ^*e{di zCY~^uZB`KE{@mR)S7!m|O1)odz%n1t?A;nngnPD>*45bw6N%5#_oGy!%In&3OridQ zvTIaf;98}M*yr)?&o~w#p{4V|Xgc>t83tpd&jp^Zw5?jUbfR&zJ8L*1WL33?8@aN+ z-7^&mq%`!!kNy~p=5m-~UHLu8wWm4%^WyhC(&K~Uvxocb7t}OGhGS)x5Wk*$9NiY@ zA0?h14b9z?gH?lDU`{a@sPKEZ#+g4~3JBnE+bzRODqlG~ijEaX3HD@O)&L=rF^&J3 ztIE`|=jX4n`l3cyK74L-%;UDd9&)4sDiAVg$J%e3^BaGx#+t`)tomIb=|Zt{ktA*X zVlf4Mt8kZ}hbJvVRYSx4+*EOzqv^vw{HH?E1Zpn3m8k1KyXjid4MGabWflFldiKdiEkLqQ#_`(##{8o}P@=5W;NG76pfbH>XP* zEavZfzi)80lWqr_w+@K24hjXgV4c;Em(@JW7-T{{phQ9$ne15^CuxmTcZjBn_0iV= zg&afs_z#}V(*x<djO;mju@C)6{41KA% z(YU!eTUuM<99W(~SY0oiu5QxHzpx=?Z2kP{AN}H~h8wj)fs`5g` z%T+}4in|rtNjkd&x};Ew$zCXuAS9QfSaA}Wnl4G(WWev5FpHL}8(l;d1IGh!3|kuN z^#H`)5cw1c?C>;jvi{|N=YFGTPJPgBOSJ^Q>K2zCDz8z&-hZ9B{p(i%;q;5m(r6tR z$V&~4*B?31!NB>K($fBnq_^PvTnuMp5z=m>Nl3$i%Duj|7X}xdtRa68UdwNpk*;LGut~kiOa|!zI~be@pKelR^oAadHFfm z`dieSz~Tm6G7JbN2aEOb85z;1r;flEpi7nmU7Ui4hd?|Oz4z*5bA5f?sOIjqGS1EA zQS5Y)qRC(a4Ug*~Nu>cd8ECd2-8u@-lLi5Q$!j-oaA1pwh=2|Eu(hq|l^C_Bzs-vk z>H?6oaW`|z^s}HR9=Gk1h?&_7IXSts_t7gWD~N!p0j3NNX$$uAgRsMauVlw)c0K9? z0L;(#@pd)W+o{}tJ!0fDuhUnDO)2$lc3xgWz*EJHjVVF@Qc_nB0pBjr(AWrO&hZ1` z(Yk_=p0Sz^U{+h>gMH(9d1wThof!kMS9rz(HU;-v4nVF0eINd0NzKlD|8DqjcTGn} z_w}XnTPJCns^qnA<+>*}O=is%waMwFM+>Ss7Nl8@-kRcRiH?27wx=1xRx9?e8^Aej zB)~}t7#U%lSw%n#>nJQ2&aR24Q&ZD0*{{j+gU*S$^4j!KTwS@7QZ*1$xH%6< z3l%aUwc5R($w+62>#?y#PkQ{EU0nL^c*oa^0;QEyx@@0kvD$L@2ppq;%Zi1!@C<4$ z);$*n^)?#1ACCMD;*v9-0^esOUGO=tJK94qRo3%}e12Dl`^$84*(ZmGhq(*s@+o55 zCl?o8HT0WRHvO@5FFl@c*Af9o2T{oG*VYL*pRxNoO+I(u_J)#Kp9i5HI{_N4j-&R+ z8kg$oRPOvdo#X9!N9v05c>PNUm}Ex13@qe=o21r{U+XY51EI#Pg>%OGek!%B@kv)B zk2e>*>>#}o-Ikl}uYBR>#dVyYKiAjS&x_pcO;SacZ-%S_qoGe89rCKr zEz?Z7PXGHflWNBBQ433%0l*^94<6Ca`B}--2>jK~y z1AOw=SwhbN3+ECO6N}o~-`NQPBH!PY>~Z$RaKV#{M97OE6obsH7SGe&or0f#@rxj| zf`eygaVq01u8Q3UD12P__725t^i!|LAygIlus=gVPaj_W27^=p%ujJw*{upeI^rnA zznYB_MLp-Akzod(^kAX(`1G_3fSh4jS9TJ-KHp4aQ4I zU_^|JD8P!gKiQCk3Px@_AI-mlE?g~iaoBuB`Qin9`{P5iq@1L6R8N=m05~wS%KO%( z`s{aQ+s(_3jSU{AniMHRs{`1KVa3Iy&-Fm9wP`$vHghn@IXh&)c}E)gxllCFJbaA0 zq7f5Mdb}6Fob~ATmM6fB06Ek3uen99f=D1B=9g13X_fZ)6)JZl!!?gh0gL)gmLNv7 z)Kkd7kdGgTdt6<)<>~8Ss7O(M(SgV$NC5Z5TAhJw|83WSsYFmHTYuN>S>Nc@VoOAS zKqEUi8O41|cq_)~MrTAa(is%)4Q!>i-!TVs%34Uk$-^zynqZlurFmk@`}8O5DXFG1=m zwen$Q4v%AMDw>-X7YA?Sk{HcF-P+0;3Z?b+Gt0(nplcB7rV~@qAD<61XWT>m-~6ql zkXJL-SvLw@DcYSu6(8*FMUGZlqYn!vE$km3yi13&voxPReR=|9o9_8WBgqoLQ9!Tm z0g%^5;)*G}e(XZm+ry4a%;(~_*4fc2ne}YNJDM$BLZy9xPJJJJpnM022Bgk>8Iw*x zR%yGx&^gT+`T3vDjjavv1jS5|GZVG#q zA^6TcpS!s-p;GnoE}&Sr59Z7rz2BRwqRP$78%4YhM!}z`G!SmNSg`&a^tn89wnDFa zAfC!$dkEL$n`i=5kvA)(KBgBbf9HisY}pHX0N^Yp7qELLgS1&|9sW-PzFFItWX*Ba ze{UM!eL1C#gPh~Yt@eCtbY=ZK#h&ULnh7^vcj`=+`N3Q(hWmAw{}mc7hF}iT(KInE zBIp`Cyu1PA4K4t&T6XbJ3^kMq31WCluo;!-c;{xtomN}U92aA)ijd`1kI zuQw;;ekO!Cm{2P4G8uUuUe2FjYkM0UtS7-3lNrdgdcfg?weFEZ0iJ(yb@D6{o+~1k z$3RTy#;?F$wG?$8Msc5VTJ_+~0iYw6{sYuEwI0 zS_55`{pC2cRf1pqUY5~w#u-4aq^#^uBcHOiP-}gBd_}b<0+y7=#qaQ>B%Da#ZBbdi zi>%3Ym7dxJrSyc3~!`0avoE)>FxUp^u@t;DtL@v zu}Aesq6#)P;uhdrz`ATQ%D(i3tF}96JIKq)o$SXyiyPifgB7OU#oZre6*n^1pfEbCS7DB}9jZcj>TpeXG!V0sZY1#>`MfAw4?{Eh4C2 zb$Do-5`TL4B){<8+HYQ(6vj`XcI}J)e}iJmYFadO2=YcYWM6T-#XQ;Y>;PuUefzBf zTcEt>6U$)4go-deTb6+Pw|P!*rRx@qyXs_5S}#|+dn57P2kSY5ypGp8rDoIx0Umf{ z)sia@e`)w~AHZ_}H^5_WwTdkjKdu7jcF<84~@?= zF_~~F!Mh&8t!FH3tcj`sr z-mQ3iD7yF?wl54t+S{PW9gwRPCnv{0N>^VH0aRu)ddAdwkk7wIhJ{W>b|fWV%K+~4 zt9DnE-^d8Txsw4!Fic%j4Ak;M{|?u4rSvZ@qWHt;N&MJ0yR%tp%81&%M;zlh9MWQp`dlsY+R?oo}wB_iB30{fJQnjE)uExMcpG%|7RFUz2Ce+ z2Xc6a>_D*Tpju&WF6Br%H-?&;n$$NWbo4&!%2u<$5a zx%H3*+o(B68B4CCM4OIZ)f&fT#)pF_l-qT1@Rza@G0{#cYU-8FD~G&eu=D7=&IlYE zQSDl*u-i$5V*V4l53!f#i!d(BcKnFi9g5};;#x9<;edvPH3RMj6*j1s8;AF4Gt)i? z07IXgjW;+viXsS55Q=PT^VeZS(I&KGVHK_*jB)322D>wEso7LkQqq@~+aE<7pPEVw z4t_=xpZ9yxA|kIt*QodaT#fLQdX2o=ntawR?es3`dG9C?#h6ZSUrD zY%46#Pe!u%pYmUlV0vc&6Zt~Vlg)cb0vfMa&_+949S=!Q*Ul%2zU|-aSLC_%V^X5S zaWfy?Cr82tIUrZn=_<=%7qfSMl?Ey}!62#J4ZcN*)n~~9%tCIQ{#c!CRCc$phSiDs zkTyIjYJv3e;7^9@iqSXnUq{e(2s8~xTT+~F6=~YxE1pM!>XB8Nv$z#MdclrOyN<`l z$2aMXz%@H0)g52gu`yh1abN3zdHtCOtJ-{=tEnIA)VUt&DyQEC>1wFLB=9Q8 z{jE__jFCoV9=tuHbAP;bNEGTBoMdgmMl->8@=+PH>J?l3UI&${w4*~(lj=F7&|@Xk zK5$kS#{&~!qz|-DNjosq1ueDEj3GGUFhL3l=53OotA3>Z?92L7*>FT zeXo=rThcsGBBQ@a{~A2m8BK>fvI~!GvE&D?4?0k&U#XaZaY|ED>P=O~x7-ztqGaB^ z_KCnjzB-#$JZXQtZEs1jYV&ZgIn-_SsGW32z##1bWEJlABh8GW>NOUuztip*IGng^ zub$I-#&9@=32#{O(GEx?P`M*&2$PH~Ryj{9r>#w2$;>$SJ3)#oKy_&xKVxMSK~NFo z5Y%hq|39|AGODVmYZnETlJ1lS>2B%nkPhhv=?0}cq`L*ByFt1^K)SoT`>yl7?>FxK zaep`%I1YQCv(MUV&-v8k4{fQHDnJwfUB)RW=Q>74W{=JRB-Xp!>gk?<%R%As^8A#{ zWZ;L|cyoS^R=ZD1p0%y$XDwxHdTY1b;y!$v-{Xbd(hC(BCa8; zjK$OaR&Dq)3s^%Yne1aMC}#2YECQ;l(E+Sb`G!!L?Ixs7Vjtiy1UzoOc z(A>t$?8!S1l#f0SfTZLa>T{M2kxUs>D0fSp9#iz0ZunL~=nEcDrIedq-fyAKFCuRm z08F13QBZ0>iXCPwGRd~MxL5&t9#-Kt+a(?{;n6AVBQYX+icUGpEgKLdQ%a(QN}Sr` z9f)>%v^go5NeLo0a;BW+S6n{fuzGNTjR8Clzka%|`a=F=@b^a@3q<1E8o|B82(b&Z zu7No?HaRjH?t;(d=8`D#G^0C?benbzNkeCV$jb<=Gr$pe1i<(3HaoM-qxINKGx;vr z7J-1z;`*?wA>|6#``=SW{nzOZRj-w6X>%Wcx5Gjkr^wo~InAqCOQ~QgVQ)vPE zZv)SY5i&0|HJMCoRMb}hL?^@5Yj$}*FfibkKaY2pGJOI#xBjs)2~ZFu8v!%~!r;Io zAh_!q-ey|eH&(_y^Q)-KkDHV?mqos^o?F z(iyptSNfB;C-<*n8I|6zaBb}GhwT8b%TN+yFvz}}GcFl7uP`4c1$D5d&C|rnAy3#yi0oo#PV42aL85rHmPaQ4%l@8s{Uo__h<32{$yq&2mxEX ztzUN&WTjF*=1FennHa6F(q*myUF~PQY%S_s995)2nWZ!CVjZRL!m$!_*e*uh=^bTn$0@K z=MUtHTs%BgXl-F(@GXz$Lk&JpJXEo$+O`?;X2vu-WL;iYtI$Fyy9@Q@h1CoO z6I*7h58LkX@$Ldrs72EK0&)lw$;JYbH*?GQ%qF!?WYy2E;GC!(mQt?=>*uszP9VES zIAfc+Y9XXX$l%2W>Pi<1Ct<0b296qm(zn>2xxYAO9ca{S!s2B_A^hw$j&>BWfbC=} zqOJ@g)n-HlBAsqiJV}jVt~G3dF^99knj_g7Fa;Z#fyF%XgD~YM7j|AtNXqQ38tLU2 z8#yNsFmPIlSPj5r5!htJ16Uw(6l6p905-fN>e$c%7uN4jBtGY`n%d=gbz(dmzsg~d z5JNphS!Beu+e#X5XiSd7Gbk+AyO0Igc;_<>H$71DLqcM|TcJh|O*9t*!P+Ar*$ZyZh}~A91Dg zff`W6gp;ltmd*x!+A@@irU=lFzCKz=8=wLn(U=cf@HvNR;MEamxmo%1^>%iy#Ta5r zSaOTP_&!$yeuyTws~ynI)Ut_*v{Y2Vp;vNB7<_zuACiVrT4C$jIE9ryYfXC2>llTv zxdIgtA+L*IfimvYR&jY-C+O|y)JShhw>8#PMt7e7CDQNMRE~X(Jy){<$`4=+n`ZfX z;KZY9Yvn!5PqM|)Oez1MxLlsq9yhltgZ(+DkVL0xsQL^p zJwysYJprHg7`WbBE#_u$A+cQ@e?bF7Pr~WBZgECqmyo~Mw=l$2TqxC7_v7m<$33z4KE=fLDm)4TE!i9MN^;jh*&x~BBgpM9cjQ1xNzO&lcoh* z=xIEQ<%vW&pP|hK^%cwBqa1SnNDcv7A{Z)9D-rCl$oIBZjXj8qb+;7If+i*fDPT~O zS88j9F$)ATitH3jy*Jg?GOMfEygnD1T4@G(iLyR`X(&0G`v=p}2LjBLpxw= z$VVKnw2VSAC-uP1?I zR(EFmP5CD`*D-~PF3xpkYzafj^xi*f$??}yle&eMW!b-k)aMkWo8B#*q7(Q!8tjFK z1J~bMU8BQksvZiETEhnHY!#Lrke*Vz?nsz<=tS;r9U0JaPY;1z0|RjJ^1+?CeYZ!8 zZ-9f%I&PC1w2XZ1=0qO{X+OjbDe9MtIh^Zu>oi30@LJR1^SFKR@@lc)J+)6eu0Aa2 znSES}qKp*+mPueC_midcmoF5NmnRy{Z2txV)kFC?^WH=qd84B%EaI)3TFl!|3N54t za3+2rBkPj=1hg8fH8F6SUrRC&!P9O;hY_Oh(Dz5Ci&hz(`g!jOOh233+np;bS$9iJ z=)W|El1ARXN`NQiabl{9F*P>UX!V<1JSHz4@fJJeoxvCwu>LIgo_^C~SGOTGEkwGQ z_HfG*{nJ*Enk|_+R$OG3IA%@ND+u50e)k6I8-(gNn`X0KY{{tge`$Eho+2qI>Ddh3 zSlu`Z)P)!$YY<_Cfay;rTuiJ28}zfi$j#TUpwctanJhP%=rs9=wd;?n+`q`kN`LqF zKN`n-T_p8Ln(3_b<0FG(Noa26T5CoM_tfeGQ})6-zgux)gVF z<8qYO)g=Vr;Q&vaed%TGHM4e!^4OG_mXQ-~8)9AQWMRvhZ_{^g{MfIpGU2GGW+Z3R zAO6>93b8=X&2i&!dr>P-o~!{lAer}p+v{mW4Y0a~JyjG9URQ6$BSQl6{GrQMLL`7g zl2SA>2>e!6<@oh<#t4|ofD;M5H!>(X8k>NSFgD=|3LqQ|T&Hdx9v^DdVIkDKv$M0W zMkGshvg0G~J&7eikP}7$V$k4m^cMIFIy8d;#?*6Se}=>B0Ru7|6fbY#t_isU0Eq#b znFu`8&|{(Riv5`2ns+O_i_R`-Nq3(H-)6RhvrwtHe?-IsFq5x(4TGd!3`i>eYv`tL zx#qxlxOQ5pk{cfkjzhp}|CW(1Gy1O{NkhiJm=KfQ)$cfe+Zmy=Ad1LF-~2cZOYyk0ZtHNDL?Fq)5-Qi2%dfH^@{b9P~h(EScs zX?%A>YLe}TigL=zo$(yN&w&#w;Bpt}XDh76UO{vxpB~0IWmj%4FaPAesjhrJ7-=yv zJs`F*cwJ-iOP^Y|A*Nta*{XrRwE4O!{zA-63gFRzsZBNld+F|SD=!NRi-t()*^|vt zKD*oLm%P8W7-F~u#n>X$0abZ;XkdEJlt9u+Dk$O%W-AQD`$);i0Lwh$t{@{ac}7w8 z>KpI~BnOJLct6xlJ=JncRp}vJS9x$y;a1;N%MNgB>!Vgx)ls~*r5&)5OLUM~H0uti z-Ne(kNDU$wS^Xt<@DBaIq%7f=`czH=^y8TSva+(!oeNYY*wenPDN_ZI^pWqcGS0Sw z{s&0%o>F!?nt)reS%}n%e9OouKnxO1ViSFkVT4xCYgYhvi~NI}*>}`&7oR9B?X2E? z=pTJH!tqZNrhxRPk^he;HmD_ax?^Yvz11`D%VZ+4qPlvp1xTp)`^P7w@hdKd7zq_8 zv6)XeFdyQ8ZLl{A_j?u+5rDYx5O&5om!aD~0Iwht5>hg!Cy&GV`70+czYf6KFKlmyWpy&`R&gI1o3hZJ)&<|i(7?XN~$s3J_oB9gy6AEuJ z2~0utM=u;DWq%?9pm6Tah^Ukl?vInj9(l98~JtOx#&yq3^nyL-C0&$dG`I zGvLWt-?A$D%@P&%fqX~^nzX{=02$!U&`=mj@wtvvzQzLPlA%PXL}3kSaDFCO`x^>* z1v=JmB|J3-kEGHY6LXJj3Zf$;O-NaHnSlZg;2W8aeih`p^)Z+LA1~WoYOWtY0m{Js zfq_b`>!2&^!O*l1u-!mw25Ce4s1!0IfX$%t2c1l*hwv5!>}zx?dA4v9LVSE$tsGRN zS{rGW&}MXC0WH2>I#qnytFQMRWbuIMlT7Wp z4^Nbwnk2Bm*iVEZCItBXiV9eeR3j#5G!fL&5`21o2?YiGHe{TfSt%G3tStD3l?Z~r zRN;eO4~>jSXlimB*^mCmS!+fJ${8PihaV*OnseNs<24&};bhN<)z-S_zjfnWEVj#1 zBqygNqir^DC@C&BY8x_U0e5#)^^ReRl@X(!*jUV$@cCA-lB9QnP^_Ow?^iG9E&v!3 zx#jg=2A7Pl1lzWoBD-i;%HL~fD0ZQUAQ>b{0|6-o3xhORxf{#gN>!|)Nu$ryG_)d? z9$hRIYQ;T)GU}-FyfENiBjNY^3e2&Jsv_+&ZE=ImEEVntNI=H9RzNYH%<72Og8$%; zqe)qq&k~?x_jHU;H26q3-%PcRj^;i@_d8l3FkiL5`z^0{7P{9aqSph)AjYL~<1J`@fWb9~Nk=NSJqQkb;-Zbjnk9aW4Di`Kxm z7YrP&(p!TlBA+0woQS7S`}SxCk70MU$lB^E6bL@JKJv0ZaAC0{j2M)f{M+si%xZZO zNFp-~8QD|&AL0f8c>&hOkY|4mAD75l_8%D;EIh&)bjwNzr8#HLu2%dxnavHX@UVgG`i>FgQhe^ph-PL~|EB-J-(W+7q@4}m z;cjr+;sKk=+FhVy0x`>JqNWqEFT7M^ z?Pfj&mCvL({I!z-^J6AZLI(uEkm);skr5CM4FF&0Hm#^th?R1udU|>QE()6Kem*E~ zchGXDcTQsVcJ0>K3@GUdI?uDf166NlI3u3KKP_NY03uSdL5dEvyA&erI_nfA;vDL* zSYqOoO)YMNG}e+zI;|>)Nj0y*9*w@z%0F7`z1>@FomXYBngceqvej4m+Pd@I8mT?h z;f8}o(M+*k0a-F@rdA?3#uE2q+Z0>Y_@CZ)QcMu2olVyrxb)UYNj79e-0I_%oI*d` zn9${UL9!q~Jw_tno|wQFOCGxGUR~k*z|d>SXLs#XJcP?_jG_}S4d$`nV~BMu452&X zpQ!78e(&na-n>=+6KmdszHOlm0mG#AL?6Tpq=z^D`@&xSKb&c$)*o70T3lia60j9? zfLhITE+I)hJNpzBj7hR8`!%?w_%Q*{scNx{Kr#a|smN+vVdb+TD>V}TKRH|ikrnK; zlv!_TXy6)SvZ~q^r)}jo$#kvz>TDK*Agu82ERbK>pKnTmv)QA4R{3H0D{vq9lB`3R zOqghZz!we|7q?}zvnEr=#IU-|9@S2J-UD!0fQ=3kKI=2RC@P{pTx!O)x3~8@MoR1- ztN6rfIxHwD84~*l;vv57{w2|CoQoq5mnx#*_#tHlECL~o^eqw*2O$Q&>=aJci7s_t zOARB@5=E6z^GdWuECWlfygqH|n5Z0>bHc&gRHq z>MBr6fE2ASkF&AhIShJmeAT(X^cA#zO>dZJ8gzAaK>7pnrT|@qR^tB?6lM*xP3x#l zwZaiet43E@m#<*u7-1EJegh;;LBqqcWZaF7jRrt!)DlOukl&S5(Rca)q!NvF z>mdCS;!`@W53o*6OkmvqUcfSwv;iP;E~niX%_jkX>lESl*;mGKWUW-JodGk)23R0$ z;S#NmJMw^6a~PDN)3n@gSo@jZ{{uAE?c7PtaQHM>lhKVKYzt3!4ve#Sze1uV&wC_y zNJr~5QhFNP?GyZ?|6XL69ca+AiNi<6dBKOEN?35nG=|c`&t%)my)(B>=X=5jL*c+M zaOvF|EigqWM5&9+o|XiTof7&djSoMV83|%Ne)L?d9&W<;k;kN@M6&KY`+Ck05{uQ= zWyM+JeP@$2e?=2E5$=SU&-qFW1|gR^46|9Ub$`lANT7up9&7U>wh#)PWD?~ENjUNx zNopbKZ-SD-JQmG64`g#A!-vDi!^elmhuhvh?SUhQ!|6AdJA4CiWZEqUG;2)3tLZ>j-N$6WB4YlL_j$4qWZ2|;jl{#wvMxmeODVT{KrlUkW( zbn{6QVFWV zgU3q8`cfhlBm!YKQ7)pid%-Eo3B!)#)`wS6NmUF+Q>iOo$GYud;oyX(x2y@c$WL4x zC>V)ll3x6jx`IEDk`f3-kX)_mQaoq{9hOf!c&5DX z>RNB%;63bO(T- zz(YCd-tU$(xTPj=P-d*7WDFc{-yspAq9RFf%wS#VM5Y?%hw8~Es3;HC&hN?Q)Fuu9 z#T!IC6MDST?(55U^-l%(0HO>xQ79G&ZCR{HQv8v)2D!sGaTI(h>i&}3D*UzjTK z$RyHr08xtZlw_@q;4j2?@9_d~Sxsj%+JRvLV#=WYy__egWvewi>(!qYztx)xV$cOEUc{TwQm&YOZaQG^J$Id0r&a0&D(RK zacgS}Lbm)S44y)Bu$Tw_)s7*?_6V@DQFC;G-`jLJ*?^OwLHK#9Xr!}_)vz13Ynv)_&3ZW=Y&*?CLvZBWpZuPXBOTAOzNKEF-p@lJ#fT2*^?ETdZ?jCO}L0WFVH8U-BDM zYS5*Ln5&+ev#9weKu3X6aUo$2_@J4rrs=@EWG*Ke`%4X8YHCTKjBm?7GMavtT`6ExahIMLx!b?bdGfLR8N4qqHVap4AqedNmZ_LMY19dTiHLFbr&>SRe{%Ag^;MevqwUtoLhcoK;t37lJ9fZs@M42TgZDG%!Y^0auco2x1~3N%@BGuCa1#AOv{cb^K6K}c}0NV6ABCtO;X>PcYz ztV8p@ahFzF0VaQ?b-m5d{=)uk2P?FaaF-h*-YhZ+2?;eLW8d_VFDWl?FnsVT_FuHO z<5QtpM+hO7m@aEZmh9b%;jIqi>H&3Xs;UqxNH0W zQ5dkLtb(UdRdgj_FaB1U$PjRS{j+A|MuF`Qs&~>)pNK?)5K%L-l9NM#h!q}~9J+JG z!ecTs%bGHPrxO>M?-a`8=9pe)8Az28c_m|CvbU2i2f|JJ+$fXC>TP| zcRgzair=?jR#kfoaFBn0N8|g9SsOZX0K5s+e_nF_-an+KwUc5rlL22z6N3s7~3<%k4>^aONCY3a_j zu3$(i#3q;r1{kNDoE%_W7Xw;*z^Asz&Pe1;XtDYj!<{chgbb!Xeg5*=!~dyUpl%%1t@{`t_@qbW2=U3>_9` z1I2|sXK9h5BC|%n$)pKQX(}&blkypIogWUXlR0egj++h`7M9-#|JUrMl2E2Y2yBRJ z5bYmmD0NBK929Ui<9ooGG6IVr_hIUn$~)j~P{;5A2EV_B3dD!Am0dLBF$>%~fgx|+iu3-pzhNf(|=cHlXA|4H{37-dkAe7@CnRyhki znqX_iM^g&4BSdw0{XJW4#GytdTMHY`HS`?IWRJqwrz=b|#pqJ*STuDyRLH1-$@NlS+2_p6;+atf#)j8}CA1^X$9c4F^%^1Dh~E&?*F{ z**1Z&?ATPQrJ5QxNF)H*X#q9dxE}&rcFQ1hQSWwU2$VsXz(`zV?oVvMjnIegs=J#6op`agot<$E9t| zlcv%-{v6NIJ?^1ThU!9p5@(LPk{_U>rBHT>&F*5o(nbgt;O@U)arFELv#D`${=kmi zsB5~cI(UWQ>Rk};NkLBfT@Y4h7Zq)Mj#PID|4J()D-*q~n74ylWqff-NzvvKI(xro z1ae0k^+lOa{l-k?w2K0P0ixpKAeqqrO|hN=|GTafZ-4I&pg=CLSROE}y9Jq;y0r-Ehr6Ip8RQWIO;XC}a}{re?^_0o*$JUqa+ zPlGK76)d2s)I%Cm+j5<~lr~=F_S#I`x5L4_{{H1Fm&1S}Uc(h>UD-Sh|4$4Xp%KxI zUk-8dq-CPniWgOxnIDUkHMrRs51R5gcw{6_&L@q8Ht1A;;(78-Eql!=@QBe&x z6T4!|j_R1DH!|$qu~g*wd&%)>tWnv~3| zQgB%}j>izvCDAhU@~OqN@?HNqB?Q5kcvnVV>5+FN#({u-j!~ zxv7|cy(AYY&k&hvklXtucray0AU1p+Fu~|bjK1nVH@E!(*~*fj!c=EKO7B^`TM{-v zOZ?B(V%V}ddM(jlm{w;&Q2GJ;o@dh`;jfu8x1 zg7yZL=qMMus~VXQuvAo@7E+d$m&W7NW9{*|%b$@tR)o*#TcQv~DNtZVha*3YADo>h zHOJ-9#zkv6l=ps80J|XX_`#NRo)aVe)fZL2-#u5|#1Fq>ds!5$74tdxTf33XjIyV7 zg_bn)-3-@GqLwTV&!Zl~{FFyce6XL91KSfS+}3=@f%zyt>2shduOkQaN!yDrmm`=t zRh>k4k98xPn(Ju~^X}co_lJ|7BO^PJrG7~;({6oprSNoZINF~4sOXU0+w-OqJzBsI zB((EA?#AV=fc=W;=~o|>!y;xLp-HuHGJqu>C& zAYF!q(qj&th53W7b%lb!#cL$OPp_eHTp!FI&9)zK1kQYtj;Gp|-V@Ov#|;Dk#idav ze;mlf4a&~`AlqO?uT4Ha$9z>BXFpftW-2dwU8S~Ky$uF?*X^hc__@o^PtCdU&CRM?k%d@tnJ7>MXJU2?Kd%VXFDv-_Y4cm|^=+N?QQt=Iusm*EAwQovuZ=G8sH_SufRKy?AVVhWeB5NoCkIk2zaqz^?XK1M~E-ga{Q9 zZTC&z=aI<3z~FYP@8s<8k_rl{)x)JvVF=4;C}?W7!H44Kr^|2jrL-+>+W)Hs0FT$z zBToIUxM+c}_Xj>b(<29`^8$MDwZ#B6z~`_Lvam?VB_<+@3W7VEZM3RCyd(DJ!&mt9 z#E10a+JB#D>xTgay4K&m_0{mB!3sPn-;nI}F{Dr26w4>z@31#uoHP%b? zR_ZpV>MT10=PD1d`dU67vun1RDF5nFEiw*rs1KZxf9ZOJ!ev@!N#9If^vJo|aJqLX zq-l5I!Nb;P7&6>3kZ!s(i*k>dgAg2|tZOFF?HciN03te~!G@qLF>$?4iR^3N?0AFc z1jgpJUPo=I_FB8XZQ8rwT@p*Lz`m zPuE*G^|sH0ii4}cTa?O%2swjn#aV5GJAv~u_6&F$B1x<&pq`33GhDuwlh7kWQX_yDyU5&>60 zclXb*y0RA=vbRXB?{%ARdPW6YjrP{oHspI4fdHv)>7j!eMh_1DT-y zj60)0l_CT`6e&CN*(>N%S6EKY{5Bu>HL^U6@O^d6D1vixy!d4IDL~jJ>&EsH^VI-W zoK47*2F#3wZn3PVVbe&V4t%laJ192m)3*0nFE4-*GDGhHnU8xXnwsD?Hf%W z5bO$oSy(Zx*1YsAn2X5%uyc@ETu_kwGV;P?c&q5NKTGs*U05_~2U01gOIN;~B+*q9 zK3E?oHF$Prn1kaaF_?_^3w}UhE0)SU559J8YjL(CduT_872gf^kT^Ko9!)!*J?@u3 zxs6ANw-2{bmv?twl&1+cBO=pjiVw6(Wk)BpT5iE*Ffp;<5>PtxQb$2Wjapwvlba#n z^?7ZxpvS1ark3UW`n%v)ll8xo#HoYPgE4}NlM?@~$$V>VrCzjynh90nTv3|WnA{7wG^5Fjtt_CbjJNZHFh|5W1xulL#fU&l8%hY{zvwuSI zG$}Z;47N7{xC8t^!*+G;$>nj`aFkwq!0~0{UjMACDvS9h+}-Ug!FN5Qenrq)mTedd z!AIj69SdPm{2wX(5zhVfULa&!>Yzj)PDq%oF`>Q0Nr#qrb@lQwmP9Xmvj%XSc;y!J=mN0Zpo)xVo3kNvLr^icPoj%f5E`mHiL#5#@u8OgM3)O;?w!4OouX> zsAo{^fbt3)CM5mS zA#Ri7|M!n!VMw?B_e8?#*6X^v&^P++!EaCKh$3t3l!`c+%5S?ae~0P0<@S+-v!<} zH5oN!nIle1vo6_nzs|eXu(6quo<@_q;Z?R>s6?Nhk>>vL-oFTgQt4S- z)dHbwwm`h;mQb#NK6vQBHrIQl7>9cZDNIZa!Z5{Fg|O#b-FdzhS_Va(bJGyncHY zH`{WBTw^^>&=rIzni29qlH% z)YMWzv6p;w5)*?0_NDO4_NmyzwpP#e(=|2>Ol%bdN*ue1bxSJjZA{N(<$FE#;UyW# zW|=bAp#@ErMMwHk6uRh#k3!qpGAXv#_}#4|pSRMdv#Yi`FcG47X|Cp_c3MRS!5}pQ zg~7&evX1@5`@&N#`^guBEN|ZBt&Dh|-mDbb^zpcu2P+6j@;LvQS)miQ zmx4oE$NzGkAF6Tr3q(30;L)@yuK%G#;U6E&`?dT z2Y&C<>T?_NrENx=yl|UcsB)~5qBL$6C_7$f@6XEz^?!Z-rn7oik7@%)ghJGD5Aw4nGSn32rj|X?ZGp^{EQgQ6Dpc0BVlGsHL zA%86D7)lKGKDyA-jG-)rS;SPgD^|9Z^B;<}$-xi**5LS_sx z!yu)ja$}5t_ir10Du+$Pq#29x7>JT&;BmE#RuFhe%@skbiS+!PS=+?fZ@+id=Ga+6 zC>=502eo~4&Y>0|@?xPIF??pqxvBc?K3+mF&f%Ej%mpSKTHl_8rk>Z7;>-oU(JG8jq=1G|DmL)K~4HR5%}%rAk&+?mKL3} z8z0V_j%DwG29Mf!4N4*Hg&j-S=4Scnd!!%Z{9JfZ(4Bbd2bAg15ubMgKQCxMaTbq~ zRePgGuotyO`Oig#pO`fxmS}Or@G`U!i(db6(U&}|SwsBjR-x#=F<-M2QHz~PVb-Z>h0#VS zDu)7z5q2sxe#e_0yhI(MH>GiPJ#VTa63r5W_6G_I?(F^FJWus}B0jpNtN{$fUK}JM z9>1~--dw3Taj4&3&A~`*m=7vQmd8Z&+H8F>-=9!XiIAYcAm!d~&zyM>IS~uvE2t*t zy?}fB$~r5<+`PZXK^(V^u4v4%e#Zg2(QRXY2z`?;p@Xx6T&GbSvcqO`Qc=`=E6?lp zdjh|qAoPA+b0%P)soqCOiTSIJ&U@gj6Z37?r--Dc?$YL%$&feYkDNG%H*A#5ai7>- znN${n12qHonql!rqlnNYC(H8@%aC&F6%=CZOh#&K`?kPt?d^u_?38>yLc$$o&p-rR zZT5fhtVuM;3r$^RgmBR!b>6R_6kvt!vZ-~s-gvWlC65a%uD!b)zk$AsK2P7sI$GX@ zGto(;lhIMyRJC_6(BZvPR~`s#C*X2|0gYKQ%N-HSyEi#CC5Tqjwu0L|bPL?U&pcs; z#93kS(7`~Ik#%d)W4Xv-NDXYvU)Bf)Xx`Z{x;wln&>77f4o~{~dyC!ea_s>Xg8(Lc z&M&WTveM~}vCh%sYBxyQv4FnU47Jxs|q{>mCxSM5 zrO7+gT0tYxEf$eR%lcKmG)eHQ1tGmMa&ntU(lW_I_sI_cF-bR`#5<%31V$~5n~^U` z7$@Tn5g;Qq$gWs3y_B2?YEHU0XQg(FyirHGJ+`iMg$nn_{%|D8{jZ@sMpgbp153$Q zDb6aT5B#uAqf0-eFh=q8O>u?ar);1Q1utF6uEsH_4hFUj2=}Nu34|)RfA$bwu@K^^ z+W@OPH>2~x{$T^HAf4G$n9fsY)t_Eg;deYMWqCa7&o9y4^4dI|8-DN!+Y96N5BKN~ z@s24Db+r0DF63&1Tk}c%H|g)@!yP{D&o+g=Cm%)STZw30x|b7X8J$YraFG zJZ2)1&xjTL%T_|&Q1z8YXhxIYmCJ?8JuNfbTS$_Is(_$PbudMh`aCY<%hZj)*!+h5 zjD>0TnOb1ZV*kaPj==50=&`oW@XT`uZr92QI-RKaA#|t4_M_4~agh(^sim84+#A<% z0r-p_4!!JYTc>7HZam6^QZzTelt&|^Uq6M{j33&ZvWr1!?nlqDbCYi9$YCpwcWp}6 zX*0J<0pyYmk=%hl1&*un6CT#2M{9LXV7!C!VC1ICF@?)Oi=0u)m|gaX*7rA*?#4kh zK3Zz-RV|{&v{jS!yTw)sB;LW39f!p%;s2;%VM;f?g|M*-F|L=0(}EQ16IB|jtp6U0 z_9kIINA<_Q?Q((?OL>K4>p{3AlIHXS<&y+c(s3BSlRjIaMbfo0UXD^lP*~e8$VhY3 zY`s+;Jj(UiBhXtkBM-qh@tSxLZ!vWyh8jXOjoB79UP8!UG_3rlP50R!J?VsUv1|rq zoD$_x+ShQxK=~dY8UbGTYemw}&s2qR3gBqs%7eJ9gXw)wX2T@#h1%XMzL}n|^OAR~ z9bHA_psj%VvQW38OW=1!7yzzI!J?vcW3_7vU$;;)lG!bE;rXL~@SnxT35#RI<{+|( zGRZ*zGIy98vE9YTDckPu(snbyj+nmZ)ZEH!qZWX+ei)`lq*wBdD;iKJ86W$9>OK}k_5yC|OVs1}MUTz;*#%Z~QrmW;;>HZH}^=|oPwsPx@xz;p849({|` zsf~3@jhqtAOU*%hEDBb1v#S6}aeSHvQ!g7~m{R1sTxVm}?f~(;qAHv|cm;#59>Uwb zMLX)+c|7 zKFj3R{3Q*Q1Z`Up{}@~_!&4Owb7x{8y->yFucokx351{8k1GE#GPX+~`7U(*+F0yLPCV9TpN{;GSBa`;PS zk3zKn2oJc|$kh)jk>!n-K4=9k`>tw64S(b*@h^T-dgmxJv=YCQh;BHRgq8UNK4c|_ zBmexrR-{rgZK0ymFwC#^?iH!{@Q3e2r5n3Pk)wTrT$E-uLZ?+M4~@~pa67%!3s{@Z zP@E##UY!u!VKh7Zu;~kI+rXA)%*n2j{NS}fyEVO`V_qJi%s_9(phCo6pHxS-X5U}O zXwOUD@8UE?{PQ6A;OTq2Pt9kM)o*V$`*@FO;ib8g?sRRv^Xo`jFCSIR6$Owm6ELB^ zm6TZ1>0TpLF_<+QU(+&vibNK;AKvIe*DOR@e%uMyXt|Ui;Byi^OYiW%H~9O_=XSHY z{PgA*Yu$>Uzu(_NS7b193CH(vG19r+=4Yt?>WgE0QoI9AZkHkR_5HiQwX0ax+)oHB z@Dpn?1zw_gsFJjNVJba^_I2dYjhO08zt1Fx*=X&EcSxcTL1rd7s-JRqHi+qgpKKLuB)Ryd9%}9b zWvD?p_LTSCGGHd&VO%DCO1kl~M`1i*Z9T7ZY{xr%=7k-){Ke|+^^ro)zhKHnYu5|Y z(9Dxh5eEAraew^c@fDq%FrLpQoZ@xpdkRX1T-pU*4$&oLt^JJpCPN2MAN3XejqS+F zX|@ax(j;oT{WJ9b^iRj3;G!L&7x0mCy?)wwFtFL?VS1a~h>Oo)18#Z|lwnySmBEhh zc4Krs$LUXQ?Hg7h2$4z!@%7 zI_7MKBDso;2om!PP}*anLE8xdTc)&h*?N-x%sObfLZZStFR2Pi z+1Oz0TJHIfh~&GKG_Ic6XzLXkEn8qm8zq-!f2YCTS6`T|H@!APP$KCkXC_mMyY zz8MdFyVj>qIL`&z{&eoN?-LWsJ&xxW2&dca0x&xSpargYc*=|3@pFt~u76KODfyvb zQLaFT$75->fpNaiwJUM5IL6E3-Eg8bxUBwYZ#%nXXOn9OT)b?yJr*;#UU{#37)p#X zL{o!R|HAk9D)HtH@5IIJP4tQHRE{zcDn<}b2Wo?As!d@wkO3S7_kI~$HTi9dk#!r- zYD7Eo-0t$1QyRgYaIcv6olh5AP|h;R)^tTs1=SWukIuQS6uY|2gd8QhcqC3lO&*nX zpNG>)80X48)D|Y@?pz)|fDFGQoBD+1<{GluE~1Qm;(wnt@`SfDYPOz%TMa@ogWb$} z>7WF?{O^-_wmx}X-+85va7FVtlb&uGA?JbOdZF$G4yxgoox)?4;d?z_tG9ms{-^V_ zV>zFTv2GtuCjZmMYt^>At=<{#%0pf`xwP=7ZAXRu^kuvW(Rq1(T;+YI+!~Ji5sZ`M zZj@Z1x@u#M8_E4(h&WjV>y843D#mP77PY*D$C*@wB_A5EgNr-)eb|+oygP#)@8hSo z!)sr+iXIp`u4-B4`!IG3*7}gB;&2tDO?8a*l=vGl7@>-2)Opd`?gJa*z_Ims^_`(x zy8gaRf80DlJ_(kmgyU+#A~j!~M4ae&?Rbo@__*aR7O0I4A?2uqj^FkaWW`Jha0v)3 zEc(s>Ols3^v($#Zh57k;`^okgf*y-2DKSHRV7)-AdwhOpyFaO-wsgF7Abz-5iwy*i z&`@AG8r~_i8=mLGaVTfHuaR=tF298;Dq-9B_lq^8oR~^x5Q6kC9_5{8DYSi1mVDct?%&k6Va{&5qX_X(}?zPffwGPFqk&JH&CH2g_4sl&l$q zyfo5x8?*{q{M6US(lIKn%2yv*WCD-g=~Hh-c!n(g$UhkO8*g>v{+wObXr_vWrhM!! zOih}hX2?LgfYMwETQ+IARG2l^m%@r$)&5ycZN9Cqw;M=TqjqmfhUS2Vt?{rH0^ZP& z%xET6L(Jz73)ZN#G^XKV({@wF@IWWK5*-+xnA6Y@(5v@4QVQNLUMb$ebAyk#(91Xv z^~)Ex)*}JT5u9mr*u<;{&3r^`Rg7FA4d`HLcVP`^fmzh21 z#agRW!}N2qH+#Fz&v(2F~I6xXq1R<;)gx__Ue?4 znE&YGMy&#^#-s_V!ZbS558tuHX?@=tejmIkq>ITuhdsWu3_2D8XWsi^C&hI6YrCZB zN0fr!ZXas#^}x2wAuy9XQH_#bY=72b|10yMYP6d~wvA*i()qQ7Rp1Jkw}NdDkm7Eq zd|R%mttGQ}KCZ|ISY>@`HYWDm>vf*_j*tprUb{aRUM@iczVk>JHS$SBA%!M(g{$7z zMJiRlz`Ee=vQ9()%9v)OC;9gkb~#y9U$wM-{(zewBpRd7!?Og8m)c%Baa*-t6Md*( zyd#is-D=sh)&B%L=|ExCxkA(x;y{eiwe6H2Vn~u&>`v5wes|UqTWSv8WJ8%|M7LdE zkTyT*iSEbPIUw>HCUlax(W_WuZH+Fn3tCZB_jYWVH@EcZC}t|(0xg3CV+nv@Ulbr0#m{_=Cz9@ zT9nbe)IYeEy%{`F@UsQrY`_oW#)d8v>K&yox9uFoh6p#jjIoU*nb$ZUr~ZZyny#^6 z)=>~=Om}){b)i0k9Oek2sk3NNR0)ulmL{e`5m}F06rDwY!@si|_ZhPJKJtiVDM?0n z$5?Jk+RwGWxL-ZqfE-KuAsF&&IqKK1mO4F`n$X7<h%d;2|#2{CA#ekex?&cOxKbqwqW&$l`x*n@wzSNf>#P} ztR{r6FLKYbEINZSKzrZ7vtLkId9vI%@AWS0oAALPQbKB5ppkl!PSPw~Z1OeTbKb4usIn zls#B3Rw_P2Z$b@!YiVQuL{&bm^^4&m^yj4-s2n2rEYT!WqP)f3&;CYe#MUJM5lA*{UwW$p5I5iuZpFvp77P41~xbaWKy0bLZ?Murs~0ojnT1)8ZKO?-$+Nf%XuNtTiJN( za~N6AO(NHB22be(hwcz2kTF2+mKeP+n#1a7VGhR*8;_5)*wA@|RL$%w#>N;tr2cMV zFHCk7++E1t$G|bCES68Fb9o77XYRmPYU1(^gw9q#$GjZvEZ-v*MG@1&Shlu?j)nqq z4L=&`y=;k_`^?6j%u0mAV(@{zQEqx8)wn#19)m1J{J#H;&;07SJcd3xVg==KkL@W3 zb`Nurmse^GM(fWi$Dai%00tbNUv-?pgkx|~c9cseT?KTzM)-I%L&zZt$M5`CR>>)8 z7~yPdQ0P-0TAVa_)Mk^vDOT7GdNqyO2#-+2JsI!GiBnoAp0hqOd_GP_sBEJn2|1lQ zO4WgHl_~Us*hUtTwre)|4q9w0zI%&5Gu|`s=+sU@r?Ja9rhETOEe&&5*P%UFZ^Fnr zjFC&kqaJazPkE_Nnye=$#G=9u7H2x8f-y<6`B_qdRV4JY`DuY~6#@#_n#{$ogDyPA zEjG5GmNDG8cN2issm2+3oZr>W7=qLK%I7A3Xn*YB(tt|66|P(#riR9(^7u1F6dHY? z&UCpDa3Ix(sN^Yh~faQp*)We68x#D1SoPrekwn;));xD{f61ud0VDaK8$zSb&rCXa_-Oz>XO zgXhSlmc0dMc*AM-VHH8L1LB<@J3Ni~%kmK3oPxN5Mf_Bk1QU<{CN^e}K?lLuzK|MXWmk;a6Rfh658D6w``IWDMR`(=JnyCnZXbbkrwOF zuu)?(ikV2uPuu2v+@9x}OKUZT>FW`STqvcW%`63;#Ql(nogPsSruGl6??p2 z-WjDHkt$QVrn>$tqTLi{NbfcDk!L~)o5k_!4EFE_(-1VvB3Q6L<{nKY)oKnnI7oLil zi@cOtm988M9``9Dzs&};Dm9B-knn$ou)lu`D^%|HX9plIT?7nN1*N2=CCs==aS2Gx zmGx&!9xDYu4hT!opP0mVO`seuFfcw&j}9j@}#T6N-m zm64f_CljG=)s|ADVz(O-KmYg?j4MU3DuGR8c7Ad;EWl_R3Cz5XZ)-l}h1A|AjvPU{bkkErvPOocae$e-!`h0-d+BviP)+WLT zNgJY+`^Ly(pCxwf7akcN90&w<`Y)0!JP+)cSnPi+9ja*;JfdxO3RSAh`o8d?n1psN z9r65<`0w4QgPr|$a*6i8e@|EpY=0UT*DdILcvr)nM|~_ znfDG}EfCtz6mIq0XvxNi11EXnu_$;@Kni6NEH0N5*8tPN`#A7ucZNMA@Kn)Lmj*zm z?AFTbq~EOaZmG@;tY7l?I!LTk4Ra15*M81_fU}ynb`kT$P%7uglA21ZPoWvEkoL?V zE`CX3pxuZBri1zHPUG>Xk%h9$!~8CBA1m5}2O6A7{um`Y zyxO^!xu(3K3XK1@pXy!%PBwZcHxqRZY$?+Aa1YR9L}}UB5{EgnBQ`$Kdr7W!)n>cb zyC!XXqCc8bbrdrvGLBFL{DPt8Xj_bXN`IMBKnU;BDnGvUT)a-|C?>oS2D^2&*;( zZ?TzB<{ZE>8?m(d#i+sA!KP6wQ>PU8E7Mw+`f2@q<4=EJ!G^S9V_)Z6 zWXYB~eEM^abGLUF%M3^WZ+8&bAW#^<1pp?p6IR}d_k@=(5^n@Bmt}9T(@eR8y}fDjHPvnCZ9*OoJBfA+WWcXe>?phBMqRm-2e&h-pY zhpSD!({TxluUOSy3B94A$qt3lI!&)Fwn zpodVzuMas*o(B@SI_(VU8(NE}0I0w%bsGQU6e|eVa9dD0S*WZG92r4zJ;_K5BGLoS za}kmsUzKiUYBtMQ&(h}CW(k!wu7$n@l4~!L9-@^(v{@9Geo4704YiX`N07<$ucC7q zT!b2S9);byG0Qlts0w< z@DYGH7LllVV9FR1#>z}rHx`95odhn-=Nx8_GvTzaKYo&&YgP8~k;95RmF}1V9(xX- zWZ&_eWrDRyLuN~{Zw(WRjGI`-O&1-rsH5I5z8~6M*}2^bK><|1PaK?TMi)JRkk&?fY)B2mjxg{B3&(72GQ#bAjMM;%gL7KBtmB% z;Q082k)%AE-g{Yk*?O$p`{w%ci4@#tMOFk|IWNAs{7_yM=G*ihTx`EVHKWERy6LIe zuE+tx;;(OM$R6T|+d7`P<1-`kH`3|MF@XLyP`+9a|C zL?bL5N~-Vw3;X5Iy-66+L;13H7ME2^TKn>A>~`w8tDGKepJrInsc*Jp>qIxETN&eM zshdXw15mL@1oF@^@gSbHoEv3=>1l0m_6)5O=&>YkG+*Y%pL=lQ`uYDWy}}2HjG5U# zGsSNTK7w9lrTKko4$h zO-7oG+TD9+2WKi`Ah48$^f3fKoH#`E6K%_-YHQB^B;G#)ohQ*>X&n))Eee-r2MvT-PoqFcvXxNsRBSG1x(3tvg>NTA-o5q8d46uPAeO) zszwwM5dL|7@AZDz4|{gcxn^hXnS0Kh*?3)TRk|A-H%LfG=+xDe^hrp_0TL3jU21aT zh)VD0BH{pvF2Yb*)f-`NBaR4#}~D@w_#O3BK>q@<OE-BXRTXtDH4Pm@Ju3;gGF)CmQCU5+dDTGA+}6THL&H!(MICAB zs-|vWZfqw7mqj29o|!tD8rj066z#(c6qK|TRWz*4oGeX|)@BX}Edv`fCuvy)4TPSK zwwbAswKl?tcqb_#XK9QSmsVC(*08Z~R#nq~X6~e?Wul@=e9h3r(8^HXT2IGBQA|uz z!^lv_!qmW8Nkvl!VWOs{ZEa$2YG@-WE@`Z9rK4-2tfC8rz--N(^mWY;nuf*(Hfm}* zx;hr-Mz*3)MC9PArbc#(a2XjzCAf?d6b5&)@m7PwjSMXHb&a$%brs=amL|4OU}8us zS1oNLLw$>9#&#;IS|VcN(o%{DbpuTeEip-XF;SSJf|7;NGYwTeOCwu#Rb4e@Z8PhC}0QbN__ zzxTDF5V*Rctf7vnD$%}hB^5<22{E|3l9H~bp(I>ROHEfyN=Xa`mxF7}Zn1hWeLf=3fD)ymsLsd>)RQ#!&w2X?bmX0Fa z#y~?|K~r8*WW{7%Uw4HDM<>OlTbdY3!R4{QdTx55e>Q+g ze(U7yIWYA#u5bWb(ekorY6*Yj5t&<(UsKaF?_s4^h?~r)9T#$Tp(VNmsjt4a0g2r9 zydw$8Z4z}QdBcFkgB;noB@OODX1kx$#Vtn(QNNN|OcLdAkE{~riZ$L|R;!5D$+IdxbL=80@=^~C2w zcC!i9wY3Y!=Xd}UyV@Rj9&<=J-}fa)%xmqV%)JD1uhsTY`5dZa);0mL=NDfL4#t<7 z(WrIk$#%5`C{|f76QkO;l4Ac?c`xYP8e(0=8vC=g&bU^Ko^WKx`6*F6@faeo`9x^j zHpA?iW(JkvQgv!S)@S+Bf6s4aZ#0c2TT+eLp>vkBmF#U1=}YGeIRkCkfQBgu=Z9sF za6#j*CsAcLd?{j!FGL*n8w#1i5?juFPx;{`I4VhAu7;Ck84H@)ptnYx&!SO|?v4A_ zf~=1R5A7@g6zuaRnGJotfKZzzinUKiFt<%oIdZY0{44j=RIqvp#0 zVzIng6(sdYZAMJa(;Sf0dqvr_NhYH}Y0JqU_v9%f{|}j!xsNL)W&rW3^0nmaby9J9 zXmQLk?2+{;*yZLEQqqPvj<|0ux~3zu9y?@cwz3Z)9`{CU;$duRVJ(}Z523NY!UfmO z%G2}O*bQUv$hAH(-P9hkNs)cZy$D$`%~Eu&lHFNcrf#gW6P~R><~rGi*Xzn>`f=fX zX{z3fyILOxrjgWhv^KhC)^&sZo{Sa@gAZ-a|D|J9Dvqr;iw_ z%1_q-&ys%&T9+i$PGH=XUR{@|d82Yn!K__1I?Lb$Eio7|kf7F~!&CKwzD0(HNoQ3r zeNqPbbVtkqPe<7JA0xx+2*NsIw_7bJ4n5O?fdIetz$TCVmQ>fV2G{84#fq9XriJ2F zEgv3j#^p%ZJ;X#;4U~kDBT2Y@EROFE^&M3b%t@6wj6PL3k&ej2so6fH$H;mt2Ml^B zE=Sy5dt;0#ey0-bVkdnvtBT%8bnkdi`Y_Hb*W~7_d-9?{pIzAzOEIKa)Jhjivnp0IhB(@8I*_5)%|`)5|po8@glsV0FOlC z+A^uBP2<67ti{6_H5*|{{x@t8%idQ^Q#U%t--^ghYb?4nWF)Az$u};(cKx7&WHuTb zcTK+?og+S;Kr#49T!}K=J{LiNuKoC!sz)NYWQG3Pekh+XuL&7w9B?KbE-a<=TJfg` zfu|Zj;Mlh7iVOM6*`;(LFQCGL=emYG%Ns7vUqasf zmOS7>a4(6tA~)&rJg88ABpiQD>$;xo!N(d!(??5bK1Xz-=~0M-%4^7PX$3S3i~jW7 z;N$y+DsG@r;W=+J2%FdRd>*#<9*Lp*eoG&yFuloEK;G}&oYDCA=^8i~L`CtnjIhCO z&s8$N*?j+_FSZ-uU4UuG#1hgy71JF2m#`>B43d-CKx+JCE62faA0OcN#;!e{(K&Cj z%0SRStF>bQRe2qE-(WnMDj}9;wa1%P6wzdbF#`rG3zHb4Ap*rXfXW zhufj@*_#)al60B#8i8-`B|S}ZzvuO7iCgJ-AkDP*)Y?D}UEf^imv*6x_9zrZe>E=? zj6M!Dcc{?1$*}Ddz_=K6bPo`uwk}v202O$9Q`}kJFpGt5|JKJLMm{m}f7@(S0tV&R zQ?^wGsskd5Qy%K(@y*O66gdX_SEu-n9=EoSX-r5~Ophrp8Ce=el-dd^@Nww)HmYdO zRt@cbfoUN|)Qy$0j%(-(W=u5OF2@l2i`7%B+~}{(KN_K!N$$Mx=O!*L5)lcyXV#++ zMT3tv+fn-kLqDD``=NK*i#Q^L5(3u`&zm|x!RO*MJAsMg!h?rbv8iIoD7HK%Zlu=^ zs(q(RCEyqoe7rr5JQ&YurUYaIj!)G6HD-VDylFgwv*D2|t~(0`b%X%vEJU7kpxwVe zLqQ#@MABXD3_U;l?e?JCDfs}FC1~2_vqR50`b_@sY_)}MjLw6r2=u6b2Aw~Vmj9{_ zhTRMP^=$$_nB3z1{Eb$rfrU*@ymC@YTi*tQe{9n4;pMu)`6Z`?XF7!6>L8udc|~a0 z<)qEUuSL5Mp3{r3(&0KKN?yLtncgW)?PdjzZ&CC|=66@yqTBv0KvL$0-b-=NtA>UJ zqB}xMIG7Xj%K+bl!AgP-8&di-!S!Oa#hlZ~l{210Ra6vy$NdF_QuL_sfhzB5^q-+J zXvD$HX>ij`9(eo9t4sY}7rFg~dMCD7D$D#ikH`~rK1FG=PPJ(AKmxMjvUzwaL&pkj z7Vs>UbohJ*bQ-=&d3 zO2QvF%tVv6JZ>iyBPBTzH7cQivz8Hea8EzOVXaynVtadJ(r?obs{)}-@$Lm-1ckHJ~Z zgY(D`ItV2c9(u9%&lSy(%JJ?NE& z$=zCCi?ogtAcS+CGk12E%v=Wy9T?y~2#|l6 zwj0Ae?@6~pFMRGdC$|fH?LIp8BZ}%K2zeT!)Ra1rf`01i_4J+bf=hu!_9ypjn#Q>@ zlzr?7t7AA@5ojhL`k~PJNx)O`xHt9!!J?O8hbLDxynxbki`C#>&{fpKybJF;K$ppl z5F^l)dc&zzs4m)T%$;4ZtL(*RBYqnp7My{H%t-jy*aU1XgP*IZ|1h zMH5-B0M`qz^;0`^a1qc^`yRNe*vF2E%uHue0lH6ow2J`68&ytiuIL{H9Dke`zgDOY z{$p3iG9ncgkq6LDAyCfiR==}^(ri9it_mP3PdCH?q?xdPtNe%5oj{ETKJHp73{f06 zAB*Op(%o=igXA$oXlaF3$zl@ve9&=rz7pH~7_vU=&?(B}|5V~^bn9C?D`3xzB`wO2mv;CE~$uvyL6yqORVUdjTf9IUGKCj8_laJ*R=z8sg`_a zKVE*6&HX*zn%t?kflR3UIwgGd!`}l^(y}w$0?JQZ`J7LydtziVtovOoR&iwTC zLa2d`e>5$fMI2q5YC&g7QM)G91=1q$o1st4TecOJ@KyXY=XII8I`~?|?tI z-Rcdr?|g9b+$oR$D8zsq>3E6(MaeKkXCbBd4_F0So4R2jT7O{JAIc|g3!!cEzt4C2 zW`j*T?2Joc%=O}i&HdLaSM)s$H?wRlcd?ZNah?=DYtE309|xw}7ze=&9aP}C3WS?x zFxFQ3{q@qdhwp3332gm102+aoyx6lJxoz@Lh&0eRp1@8d3*D6rwhsbNd6rOEc5txh z$%&Rth}Xdo;T7nnJ>49MNrdGGj;_~#`NIEP9lYyu16!~T2AV$ZgI!V~5UgY_kqK!_ z6zMGGP1k#7+{irXc6(X!?%qipL0#h@lP42ann;L1)c;gdQbtg|U83K#H6njV7Rlmr z68x#<&!-u+pY?3}X4Xe7lgSbVQ&f#|JkMuk9VDo_#Ln&|@P6jmUUuL}DZGDb?QchXX zc;oq=>sw(d*nnG~>4Lbvl~8$X*5-pGp=^J<7!;lR9Rru;$B&S;rH_zz*%|hGal0qP zMXW%n7#F?m?{=0SU1!5D7-5b{yegUQoV#qFC9Uj{q-MU$Ir*MXUO|tFo8QJ^L`OVt zW&CzHCEy2}z1BD(IqXzaRD+MO)-K5U=+R!&NB9wXU-#+}0WEkIlDxYEwv7- zSz#oO7UMv6V0ZC^p8X(v9mpifF<{@i(d^oDF3|UNn&ad1KhNCJnlR(T-3PGhJtn~H z4&J(oV@7U4yHaKe(Aw2HUM=Z=T49w~8JEx(P?)+$-f@6m$4%g#0xZj=t8bY8azJbT z<(spm!~_^t77ftK16Qsv))nk8 zLRRHfI+~lsVo}3@lN}QCW5E)BI9OoULMdZyq~(W|ZRSjERxWd}lzA8{%hDZQ4~HXSamuK!NAQrl0U+BHm0>GNvo5a;>XHAKfl1uslydvC zpfK07>AXjnP@T|#JXfQ~k=MUn-<-L|DTTIL<^Ye*#yy_LnO7T)!Q(}dV=VcDSO+}f zP$DMjKIT(MIXYE$&&~sBIGAE`u8eYbMe67Yv|)DaX~P}F(N<#vRmRNHuu51BkJ#RG z`ni#T%%49pN_Fxp7IFGVhQcxma_rRb_6fH(w|Gov(8vO-Dz^%HzQ9 zLzhwIxcADc0D6DWuh9e>=7O$#`*&bwzyFl{<|NiVQ4T{JCz1|rte`;FVR>S&V{Tuc z?g?_8P}S(G!%hQmrx_S<>9Zy+LWVqm_+we{TJfO+`e*!j$+ zhk*1_|Ak}gz^k?Uk=Qy^FDx%5Hgu$-Tz>q5X`r3k;EC&7gX0++X@VXtn4K7nOpQS_ z-A_pCAHrDa#7u`rC1*%Zc{saI50{$LG2?ph$9*;ecdopnQ01^on%I9^Y%IfdOsO6r zVcNH#4`RYU+u{Wb%>0Jl*uyKu>B#D!TH@tni=RWvGGlf`jUvY>uwSG$Y?yca{SVy_ z?AU=u4G-g`JP!~c`7T{$&H=i;XgX`>IX;^NH3*?hD14AW19n3DA}}tSATJic_I4w* zmR$Ycm(NUD&=^d|v;pYck_ma***pJP{>cg=p@rWG$(9JK@pz9ZR=1in`)%ZIsZloP zhWE*{C+ladUb~xC|GG5!^QSblL_U2v1ds}k476?3X?bc>vM630(}2b1lbMf{8DOEe zS!HEk!2Ge2g|q6!;E|(uXKrtK)wOH^59p)6ue4Ex>)p#?HJOp*I<`X};@#Pj*B`yg zWhY8V;)wq9ZFs9_vp(**YYIxm0Aa>CS*jwgS)|GJ95oi`CwxS)Yq)5kUVr_)f!AJY z{J#%7bg_N$V!2z)Tzf}ptBOOXUZqG5JhpHCRS#(Gf?cel8D+7Q=`Xr7S^Elaj6Y2Q zjZ*R-ZvBl4sbR-=X(n^Lg1#ts>5O;6DB5O%XL9vv23&6cM!hZ?YQFAdKK&LUQ;v~o z-4wM)OT5zNPeeUp7wxq@D2RKsZ+d?QY>y1f-P~8HoTz9{+OH=1QUyu#BA*r7i-=Z17e>3JYT2JgHDitJk%!RNM_K!iqx2UyIdC_Z1; z1EJnXg;pONd#t}d?EMh<1PHNu2pHbR0w&ylPSe*;pUpTw4JTx@COluMf>L%wq6QLZ z@&LzAl#tS$tom}cJ>m;*wz11}=Y@m` zem1DepfB$v1Kui(y7icf$GrM{nyvS0>=jh83bOr>A25}iNio(D1P7NTcd#&!@7yil zR{1?S9VGofr?Nw~c;;ccIHyEziOm2L>>X-DZ^|*lKo;3w8C%3{sz}sr7%LI$l}21R z_LO9!((EP6Q3ijQzn(F6&!t@CT{E@K&|jds`iXRLrycnX6c6SdVY$^lLWbA-< zG0D8jqBYtqD4`(KhQyQPBZ7^WTPElpXmptLH7c6%Wj7DQUVx5pf!I6kXLlzVFQ<2X zALU@ZQ@clgX@t9_d=cf@8gCeuk9LO`9qVTUWp{#lXJy% zOmDTiPfa10YO&)POVguJ_#=1A#-wH|ULZ|d)f0t0qJ`gZ&d$C(tk4;R$IHjmXZE|E8M=-q}I-kQJ|ETbc+EFAWdG z3=~NV4&Fo(gFwauG=(F?UEgi_fOF*_Wz5`aIMdi3X1sK|+7bNRkwm^~&M@PIJ>%1| z`C0qV$-?1cCLvq&V@TNPj}H)mtI+Vp%QpDt(MlT*zVXe!?O#}PEjc|U5Y=Pz;su*Y ziNql-<)M5jW@5Kt=}_v$(R%iNKunMPwR#NQuuZ_l?qiw-+XIE>@@6+Q_E%YRMenip z?-&!~DR%-JhOoCd58zs_;j_vywLHjdt26$prO(a`!1wc&HW1=@e#}P!7&lsFW#xz( zbW@Jt4f#g97|1`^I0fHDpB0{be3zOTYZH)LDSwT5^zW%bjfksmF7p^YlI;e*q7Hkc z=fw!roBu8mQ+tgO1qL(f2~6nbSx+QOU#RY~5sY$R1i0osR|lQkpYUw{2z>zW0dp!2 z1@6@Hjsl-gDH41pew?PhHHor`JpIosfnet5vIM843WE;PM#BD?n_qxVrI947!Da8{ zZqte3)aG?KB{H~ocy-I(F=vc6wM7gxDsNea;gJoaMc=%6bFCwI&I--{1!^Vm+OHeH z9ULVY(ry(-K{?(vEb$w!i;?_2-ucYSd|vqP-$a+}+TgbX;*R{~8c~5unHDp3Tgb`^ zNZ!g*AbV3%W&?NGg+#wxpEZZ9N?rW^xFl%1%%6}CO4xa{bxFiMV7Uz_O;!MQDXG_NbuJZ{QDkB-UKT$@Ni#_#O#QH zpRE8E`yUClv9T-eZ|v%z1{cu`tM5`#Y}|bOQO@WT%o{WEwWb1bessPIn%%aE;GFLe z(p7&mj|&iLz`R<}(2|+UDb05jOTzkA^mrFeJmC6=A_YzqY6257Y%H_w%@eSe#R@8F zM(Ag~07d)1%gCg7yr)DdU%-optqQ_ufu|zFh0JNgxLx1(n@RD^LH{y3>R)&u7s$kW zl4xBfixLBY2uoV|QxvAc0%U0V>T&AGo#^mvhG}Yf4kI?&(fXR!u*TqgzYbKUMPl41mi07XZP^=aia#Mv(OGFEnU!uz`wyA!E2;hz08V=6mgZ(n|r7ok+xrYgWK%z!IMMwT%n##=iQgd z}z3(d+l0B==x&?&xv$udoh1@RgSBw|_?H@git6QKape3Hh2jp(GO% z#Tn=qDXF%Rd24HH*2F8vygTLoX2YIEFh2AG;2o>YivE6wj|N$TaVg@Erwlq5N&J@u z--$O4DA`l)ABrx;iFbyg=ct$DQ#v9RGbvlzdlobKF!4L1qlr2LcI$SESe`~~ zpO>qIpb4atM~IIWkH!*y8A$rsmdLhZO24xp{Z43L$dWHWreQ`-JZ!r^$lrSv~8DKdv7Rbxbote4|ymMUf(gF=rQxgP^(oK1_{-st^4i19wl zRVNJ^$zTjS;h2pA%Njd9tcJl(WN*nX$XJpN9YO%O7;2Z2p@+yN@ffzZn3guTF_`g6 zW=@W5J;BAt5+*cA=Ti-%q~1;mxYbrpYVW$$8zBfr&gnE^_oc(!#Zd8>`xqj8-pm8fFmxDh zCp!k+n$aNx`&bKtH0K+k0Iim|U`6*r38Ndntq}@8aa$sQ#B!w6AR_^^Fd;G0HOF?$ zZekmbgApti=7?_s7te>1bLO-!-U4g(FMz03e9zOYDwj}pW2uM=c99<7soY95)$817 z&q*lbhr3y|l*sz^;a^^)ebO8KU{pD4&GU9lyxmPGJu8d?Rx-no$3xljF3sS0k$Uar zW~(4I&Rem>M!@za%E8cMc_%g3`OUS*lJ`OU^Pq1lJ*TCs9WT*4BbYy!`H!ynm>P`9 zTa1ycBgCHD3}@kD$;#cdZ!T!HUX0l3mQV@1dahF zb@j%@bgOq9A2|5Fw9ud@{P>z6a!al=Y!TW7ZN+`e6{M?$$|Tf$tcI5 zZh+mK_sy=37A=7PNC=stHB$AcO4*~V72~$tNV7r80AGP*LvXH3M6`_nv`9N|q-d+F z-w`*ps|4MKjdgU$ghT00TgT&I z(D&t!b=I%bf~kf+)Bw{)Kz0@atuq)-kQOyi^}UE?FXz4;_!K-iI$t#7y0@#P2}uVz zB6|XS(WAa&G|D2=y|=!J+nfq}*@FjZy-`-QYj)2xa#j9+F90$=UZX;cfQ$QABtuSO zRhB@^`shr2a47EtJ9`ru=`ul5WE-prx_$gC+&<4^(-E;MViOn`*h%O#^8}0s^WGWq z&jFXh3-fwWmbme1(VcrBO=@5c5MK&dbKcv;Nr*4lqul9?VqNjLxJK+7;--*-cP0|6 zq^~b?AC&BgkEuhAFlRDb-M8IFk(@@tC{NDGeA&WVr+}KJWmGE zci9Zsdjg)KQCXYmo?AEE(L3Or-@rzMD-z#dCD{YG`XEGyL<78umbwG$Y{HC|Ff-?& zG5bxJj-I|}7dZ>2<6sNT+-pSqEsEa)9nZ?pLNW&R&}}P1Uq%}V-sl!??FvjGXsL|? z0)$vc_XN1OsB@j^(+ej-O1n>8ok#yvv6n7k3G3#{J*IXk(3)gMJm-zmT>3Bxu8&Z@ znX1j!S#R;$&Nmn;2LX^Kq7&1Fo&bvQ?_wm^0^rXTDopMNRa*a=j?0;!M@3556ZzRa zLM8fgx8IU;RlIH^P)AbU*j9)j?* zP2~fo3#Vy5dq7QdrE0~#pHfTGwHLQWt(V+hgtkd?+u@xxx8L-DmgLNzY}|vI!B%y; zFuPB>+V&}6aOEIIoBX^xjVEnkb2pu4)z$rSG4HwoeWH-*7$cYV{AlQx^PgWwkB^Uc zBM$p}6LSkdOSG}s(0t|I*JJN8H8nMHw@mzna*W*a%G|?>EH!ES-WpZ8)6%~9=W6t3 zxun}8_?zpuSKvX3aMb|&Q96?CYO>p%FRz4%dW^)p!QcGxRt3GYy$Q+?ZvV&@BM zE3;}Zf5c<50C@25#9=F;aAzJI)oX+ll~BlnzJF4todf-3DCLL5# zT0(sg0?T-%)BBI9Q!xMYh6_5+0jc=2Ct}L~-AM%gmt2R;nqY|lc}V9#CM()YqP%GYKin;z5$tJu@%Py2bch$ogpbBnC>VRVyZ_vS=`JhYQS4n- z4Esld=boey;CaW%<&yL_;t4By0B`{UUItIm8ebWM9)p{y+-a%F`)+?N!*G4YbH5Y@ zy~e^=!E4ViC}~Tnkgp+J`kgZNMQ5WK!UJ|F2L}gL9$n8=&P1$)!o+* zJK2)_k9%Ca?Go_g9*72TX(GV=P@$m@Ks$^`5_U-EBCcYqUdATVs7l`YcFI+yeEOm( zMEjqbX!X;}vvBuZ{)DUR?#sOFR4~UBaxP8%e+>Jp>ODBaM<_8-Ycbh=JKEn6ByA&# z8eg;sI?A%`t0$K3m+U>=(d-JhU%Mf-qeu<6)1lib^G9cPpZ+>#k-;snWMPW9&F`fi zAu(|H!IxUU8?VSh`<7f;ewbGqKC0Rn^)`4sa}6IWdP622bX*hEB>}j-ZE=6)ad8MD zUI!obce|q=s3dK?yI<54BUZdom9s#6in5Awq8@x%xrg z){1&j>28q(;fobkGzGqGz;p@ZhSaFo7@)U9Jh9$)MoV$E%7cCM1wpb68~-Rt zJ&*P*eejN#D?TJ0R}5YPOmF3TIrbyU;AL`ch18zmm z1>(w3C?vPmo*XST0<3lSfiq2>^&|%V9wO_;!i3^6JPH?&`gVIjBV8Wm z?zCdq@1*EICnpI5ch}I7*oVoA%-Rzo&lCi++FPiWP6z7Qx_?-3(L$)m$F3NDJf_6! z^7DO?_?O>t`~t(PxhcL$3%0Jyii#LrdXlLb3IR#hFGoa@+C~Y!hB8reu*05G_sdaf zZ%vepT-;pF|DjtKA@7Y??2$Xw6hVnN09cpE;$Bk(?InsL3rm=crpp)DnaJ=xn z(xfZJtpEDUsgC4laP48!gs6iK3G(O`LFo4F=hRDfKVGkh9ko~IHM8OMdK4~3g)x1n zJZrHiN_6~YKY+Pz()tIL59LdL6KA&Po6dnw^cb9}Yz688 zp@bp@>f~zaJsXQWXd3#)-1X~a?A=A!W%l`){gXREJn#^;PC_cb&K_v4@*NAZxcP}_ zubm|!^}2F@0<{_mdW-H$WuW=&eHHx-RtXm-5Xa5++Z;4;Lh6K!UBel1ZUcUq=q z=*tM(|1;kk-$BC`7izV!c1Tf9gX1@iJg62?F1%hdG#xR<`H?Th zW+f*98SQ!1el^fjxid`lOCTiWup$T^!+t&CgP(j%B%@4u<+T@%c!z|C&4;CGKVuX$I%313^6gw~*5;{MiFW z`njg)(hDco2k9mb$$}oCLGn=g{}fxr!Q*d&iC@si=y|)(WS(*Bb92{`o9rNyNJIjb7378`SfV$s?`P}w-_k18%Tg))4W$|j}^;;IZH{;g{nGz*ynWizjSzm-7=9NPO2m3!#%31D6N*H zoOKydTWJ|C4e60wuQ#mxPWOhFANiC3!!}VC)iW=MVQQzm;{u;>T3UNgMF@UWJ!&O_yJO-P~@^Uq?$;K)1xU zoi%ipUaMMt61U8?GY}kyav{YA1I$35KYdWH^+|*lj_=HcJQa*Jzt@XB$%M^3BpbBj z79(OZBLTZ@_p_$$rKBJ2T$heeVU6ex#Ec zSe@P!n$ei=W`6lb<6*W`w%pk`Ynt}GwCsC|Bfhs z@bxx_C7A`YdX*hUJQ1gE{6JR|7t*)pP!S{1#W6VDTCRO}fV8_3G-`gaMI!2$Ozz(^Ni8t zzAl31PzkfhXHj4e1-N=MSrf2aZ*lq}=RWSV>@wsrzfy}ysqKckPu)XQKssNG%sG}4 zevGhr57=L)le1;Xsl-|sKuc=-qU=6!G=uRQH?*77GEL4HksnN_#be$oE^vwv!=RR* zS|AQp^BW*KRSlr2kH0hZSnF5`Q-782$_Y(JR|h;8KgJXa`Dn1+6x%MY#4d%9lWPuw zV&wUK9_OlI;#Y}h@5DScuLj1>yljr%VHFvFr&C|yFyw0flNK|M*K@-&%deWd7n0dD;dlPqEOon^Zk|f}b)=U{426`b1T2%nv zK>Hw$eVXi}St9o!tEEW${}7-K%5a&PA*2D^OcYM0nfkAZ`J3& zQxcrEYyNQ(nofV4l%F~Yn}ck(N4JcJ)W#lHi(KbO?c}>#|7D3bC1)fJ$!Wm$KUZM{ zu688>nGNw0?{}nl76TR}tKaLtfHQ;#vVa?^n}&K;T3K1W%g?`>0ST`_0ab&X>E&ob zrAaLdzNHg8zF9}-xvTMIvXR@V4%7!#v8M*{zR{F={^33evA;U?d8OElceX>JR=t*A zinD^>?iKLHP5+ww$mreNVF}SEOTOA%cF&Wr$YlijcnNwrO@aO}J_n({KOE@T9{`R( z4&sfo>xC@}8K8 zEQ8Q3+9>%ir~K+b$lsq16!#- zuH(#iw=cN7JsR3N?gNq#2RxHdQxIZda^bG1&}4YS-c#Zb-ET|;v>kr7 zKAWEvS6y3c0;xfVPn0xC8e%v3Eo$c-9bCKBMV{W$yXROjl^CsM$D|fz5$cyNF35aq zCe<%n>d3zyP3XyM8paL`C&-3&SE&>hcOx{((#c5nZ`D? zRsc*URnGgPSN@}t*)miZzbL#-86&|K3gK zHH>V?sT|3aosSPON;s4igjMpgJpP;6WF$&ktZm8=Cf;A*b+{oi3G)bMINT*Y5CqPM zRQn;PUnJ8+wB%VtpCAT|3>9P-!AN9I*zbbcMCp)1`t20>R3>~Xy-moonM^2sv+bDG zHWit$74PRHtOfH7&Rf(v90lb_BWdGk6J)D2Kc{@pd^47nZmH9rD*F#8m3a6NIA4zErH(FP_(!k-47#zGt)!b@uZ zd#Z%~UIp-5b(mxCBEsjtD{V44-q6oZP*-N0bz(o{Z} zkcPH3HN`xWS?~DuZGGM5sU)0L)PHThdI1#6LxvYYVY*21o2LO!fA9+ZXSXtfn4L6} zpimMOQFW=1?O9f3(jc}|AWozsfUubaT1v9)1}#`6U}0?(xkHT#6|60F?->uTt@AUd z!+zTLY5s`t@Mr6sdH#UQA*o%cI+3K$*GKW71vH^)h?F-u6IK+S;0oA{8=mMTf}aVv zBdl;B+C_~|ZL@6;`o6LPyeRvmevk;eP$wJ_Axqb5$_%+; zLGOE1<|GpSm%0<%cWY#botXcz6mGzEEGv^p;a0t%U+~Z~mc*#2s57JzF?|!V;!joQ z!ry2OnmGyjO`6!WUatSQ=(``QtB(ZW=>eSDFM#;h;!!%P1(N@z4Ws(_t+pBQS>*Y7rDg6_Smz!{?Dl$e=2RqN%nE83;N(=Ahi(bb4|EVhdxRvOG_bn7t^!pK z2CsqqCm4`|e)>A5n&m(4rAThvxk~O3ar8i1Y>KP!39XbF*y_5mFr!_ga?&zbpdeOo z8}06v@cPJ5d+*!HmZ8`oRR-6|>q3w8*=b|uZC0Z!zOj1wUoCb4JGm=rKQ+uXMeb|{ z_%$rb1cymwzmpK*^)k3SW1kpuV|nBdad~atTbvYm@sMtpWZ%3A4BWumqOmS`CYxo< z)mNM4$AZAjqKXF$y&r?R^Mu9Y;=Bg}^NY#+(It6KI;C8Ba+Ki`G*x-Wnf5 zuANRlq_P1aO#~L>FgPx08JQl4qpQ%p&Vjr9HX$J)RhpbM4WPU3V(4dK-}}C6Ma@I3 zA;7;Z2t4eir9YY{qZo6@)@a*qgBHunJFB<3==`-9P>GQBnEL{45`Xc6KJ68_ng>?4!j?keGKBjM`k+yD9UTQ>dh6Wo4zMPwDvs*;MM1NGeMs ztH?iQG2Wn@&I%)`{fNmw3zfv$^A_ONy(62iH$kNl(2jVRiYP3O0=cc_(idrmlZ;^_&Liw(RPY7 zf85ZXcROj?4G|0hf=VF>h$;!5F=FY#_jLsowzs z3CB|4>g;Jh_U94OFK-0oY&GUp`A4s1dO8`#l8!w<3DI3c+Pz{Hp&C-@n}-Oo0fZoY z2>N@FSU0Yj8vP++hgdy3kN6aWwQWyYJU#M2S_*RGJDP9P6so<%uRcluOm%{~fIs^K z3on!UjR}K7`Cjsoi>9>1vb@cS**M#~iFCtfdH7yn)K#Ohljh~2tRvvBjBX%ddHIw5rnpf z_cKY92Gx4UNBuMrC4>B?av5PZLhg6}lIZ-g&2#;Dga4y1XefEl5PY1)y4Vf!v=0%! zJ(x$aQd#-fM&NFtEfIwxHti2V&teSoZKb*XpHex1B?wWv=PvjcQ;8zNQJAXzjQW-Q z9_CNGxmjsZQ$q@dT{r(RXU$6d&3;46y-FLkOFMLrs=ML2B|=AP!B%Ruj_YdN{qx_g ztrzRu{oE=to`PXl*0q0#%`^M^`%_a>>#IW*o_!`&$Jf3oB)o^hPV-}br%4ud6*7Zh zg4T=<<;(;|WcrH@jfcw|;ZS#EzxiE7;<5IFGmyyY)F3FZBC8_EQf~qRLznhu#?>$Y zsJe`u4Ie*S&>9#ZYFwJf!_uk<)+x+_U%&95wGeR}M`oNkK@$mi$LF%aMMJQJ1$R zsjaDCf)z55b+I8c4qMILbqFsn4*pG+4)DxyeUX&#jgc4y5LnlrF zyTW@EE_nF@OyOn&YQsQ!H2YDGxX5z_v(1UlOOnXaRAnpr0{BT%x%x|V{%%5nCNmi_ zQ27&yK;jFu#l20YlmXZ$$)emt+Q~^X+^>m(rbMCX-q!+-%?|Ud;YxRf%m)^^OZ+gG z-nVV})$f(G)BcceAH8QW*78c4^g(Idechj|Y%uo!wAqe8PpKjPC)ZjHEXjbf|FYyR zw1(wT&&03s3ieYow0m%hUs6(V-@>>2^$YCWC4wuKSG`a>O zTSg3rLp}Lb+DU$l|3}kxxU>02ZF|=qu{X6UQG2)c)@rF8Vyh9m_STZ1lv1mus7%cfb6;>-*mKAIN)hu5-?FpZmTaO{qUTU)!3Rn%dgv%HA-gGH)+3<{t^m z+F+p}CuR=h;8E4wj~8SwGG^1&c#@macklooh|L*-l-UC_I)SPW@-i~lKk&*Vlv`}x z0y+d>astSl#w6%l=1b;YgymCA{?>OQYJV;uW-9CV{`&~4g)0Y%I&`>FDL#s;z9yHF z+?PE5Ib#?VOOpqUt3>RLzk9b7> zGb!&M-Q(>YrFSQJn)prF?aZ4Ye z>}^_`*cK4(3s)k}sIROU(_=3UU3t5!$UwM0|q#78`PygBaQ`op%;~XMd zDM@ADJs4`I|60K{Gxzm~JQMs@J6Vh*awkEu#*X=D7oa<0#y_9-{+AFBY8tfQnjLL~ocW1OM7udiV%EvB7aaZ~vRYZ@6v9m-L8S4j zXx|W66l7{u@R(^4(}q92q=8v?FtB<@lwK_Mfi0k~{+0uz?38Y_UJC#Zm)6clZG)vr zez1}Gv@7-mXe}T#VGy_0*X5e@O>+Ow1(1A#g;Hgf(uqa8IHB-R_qHIvC&lCj!(Sd> z({#^k8FTLm-R0n2=7o{zXImaG);^FmzdmDIdo>`-szg5FI6i+m(_?IpWB$Z7**Y|+ zk631eB*Leg(-aQ~*L}-XAyi@Nrf@20s=Y(?y?ylD6mSBr>M(|2Nb{)Og!<=?CinS$ZY%|P-f>8arC1^Titzl@mH z7`bD4^_C*Zf3lX~Q09JsS)l5$W6^bh?YuEEfYMuqSEM~x6k;GGa~%Amk^dpU-`rX! zrsl>(8aZOPED19qLv1qnUIP^^D3QyU0&N`Z=-jyV9e(S4UbImUI*49#9rMJK+f$!m z%O2};AM?CrW_5L=p73K;`qM9R-7>mUuB!REuN zd?1^jHmo@Q51!XnKlz22%w$pxS0<|-pXeEDXDq+Ifox{o_~5^<;MSIwTU0-V^Is>R z_9%^G(D9QZx$h{BEJ<6-?3cSN4V6US9)Ve&vOU7m3}vAl$~%*^`9PhJf@x zW&tP*%(%I3c%RW93pEAm2Y#kRAx}>W?$$iY8IfLI66Z9idJK;XCDDb*eGtu(OjNKj zk8_QKwpIXP_AD&0RLaUokYD8wCH(ohg@wsy$L)BU9%TZOf^0h z_3Cek%^CHmj=qzw9^a?#Xxsz2lD~eG5Wi%Kd``X^U@#Pl8CXF`0@mkaF%EfaDzWQ8 z@?jKSI(DU7>i}h^OwrWn&ARKYsG0{}v>1~aGla!1kA;Tpb8F;3gOWAW8PbOP;w|7a z9;&DZT5m-S%ZjXdoYD<+Z{)UJa&H`pgwg?|kN}e$RrWvK2v@*o3J8O(#OzQws0hpn zXykTT)2#oDId)AUPkXL9>(KEosG@%b%~o7)7A(k*lgQ{=GK?UkgzZrLi-#JsL1c}0 zW==hmX-GEylje@FhOy8{_D%O3OZ00;vWq0iz2rOd*XhURKmAf9Y#)d`DJ*tQ@(n`5 z@Ssm0%=7A%y1Q_R$jhhnwxU<(GvD1r2(HkPu(}#6?XSPuDz_&q!b&nF?HY0Ah1&(~ zZEoTjIN7xjWB@cudYk3q@hokw?(QsrE6dAj zD@RwIWCpiuVSYmh@SQJDk+?EnZghw?GBYanMYkSh*omazVy24$&neYs8+m`&-qq&| zXMU`sq|4>X&jb+Os{X4f0E#N;9iWlsy*X(&qTw+N5`XjvB?W_0kJffr_bZt&^V>-+ z{+UGT^dLxI2UAzDAWx@|H=FmvBh&y3qOk_6*lwM@Gn;BQ+!-IA+(gxWbvKh^fOPN` zt;eHZ9yk4hiwl8hZW8{w=zF=C#DS?sel`Qo+rP^XJ;us89B*;e+92*H9aQM z0iy9rux94W?{q^ABXkye&QULMaA$w`?YfMYuGr`ho2Ci;K=-6qaXQ~G@A~zRB-jM| z`SFpFj^K4R4OhP<`TPjYCHt9;WmnU{3Yz0M+?2RP*H39(>=>gjqWmNSi^CW>Xp2g6 zb`f#F2h6kXT*ps5`%WzK)C;Ql2a61)29e*T4SeL06Z%}Qgj^q3`x-HIs z9`5mBiO0*whe!RyTHEvZ&6{!J9yvZbg2qn2zMWs$*GfU#ha1S07$}QOYgl+xOqRI? zNLRj^sFG$-+7QUW;v>d7Crv3#Hupin0Vw@+wD+aMU*(C7U^p~imm~HO13mK1BP2ui zVaZLi5^Ij2GaDORd_{5e?3Ia$|19cm_jj4O>_Ya-1@k8XEYv?(`O4-Ep4@8h3Rw*3 z+M#@8W1^IVKG1URi4P8_gnl9g&jLJ%P|G>XYCQn_^Bd5L_aXuCfwm`LAul%p+R=T5 z{%tF)eMA`K&WLRHfHl%?11?=*9zw_#DL6WWGr+^&wH#d+)-G}Qx%g(PAIW6UcDSnT z8q5S<>Y#UJd1*(WU*Dlfhcr)^q0`+!9Xyh*TYF7`inUeC11L(7{EG*in7$Bv?)79& z0Ka)6(popBF=5+Y_(GPwJ6Why=_6*78+>~)YT<)t1k@~Q`NA8 zM5x*Jq=-bqfD=C9YTSKBW@#ILePrzd!ot|&yoO@36uV3i(KgWNW#{FQbRI;eplF+N zGI7RM*Gfh2o$PJxm)nVa>&xvAyDW~D_F-^`-KM%YL&m(D7dQ_iD*E6?g=QC z4MsKQh}0q5BU+!q`k0iOwOoT`=PN+%_kg2=x4lfaZnxz%hIe6h@Oi0r2iW;$R)jYD z?z=upC96t->AxEyj0#WkXFpF^2kj=uhSAs%Jna#=@nV(AA+a1*oe+Ebi+$DQ*D&CG zzcE*Jn(@cBOhM+zt^Qm11fx4`}Q)HZ<8GhLu0Uv9n?XJ@ne zS0(q#FcQiIfi(>ICoel2tJ`4eXOM8N5$|)c0D37!gGU)uZ&X>lQbRtmoe&4+p+xb_UQHQai*N5tM>?u{o_`vc*x;W69n0bh z13IV)Xck_;xgdR(kh?udIZbHTk)B6?qKF4BvbveM8zCa%5_%jm3b?#;r8?|;&xB$^ zmD#o;hDwo$pGa$eOmbdJ;a0MvJfG{1!_+P(GQ}0(^p8{u*LA)>KA~$X_l!*qIuXss z-K(rei#zI#QyP3$IV+JyReYO_>lNNVcD>V`4Kdx8fxZ4~B^l9_57Q0zY)DPus_!J! z{JQ<2@#FWvjX-7TU-*Sl3NP<%Y0jw=AsE4_IMX9fq1+tp%?Z!}Mx9grn zY95kVuL4t9dVjt0eto}q>+QiXA&GAn+KnU& zz+{K>Lp|Q`lq<*;_TQVc#Dbi5jhB-^{`WRgqH=aEQRip}|&h`=N`p1atj?dxY4$`6k=%m4mr zb`**d_3iEFUc~IBIUY)CHW6*5hK|;oAho?KK_ZY>482!Iw5T#ul++||kT+!Js-rk{ zYH)=Y)SfKi-nf_~Dv&a8{OhkRKvy-_J`zo-^Zs#mS$K!c@U4omyuMd4E6oex?CGkC zNhQIpEk4_CJ%|_jhEQaeeBvfhkxX4i%2r4lKF{ki%F;v4^;qg|9hXpxz8L_ztY5G) zz=bFpkWz)oljg{>T6N03;KK56S;lBg$=e1@=N(Ov*F1i(!c<{@fMXn)02j7dMLJkm zaide9#M+Qyz-p;So5||fE6on;{j}L8%-cf|9V=CH^-XwY>q>y$vfP5PNGODyKo2>_ zV(^o=1@SGnn$`zS6KeEq*7$#eLxoN3TYkln+s*o8l}|T7sHhLG06CS11qgg3NLG?sv}{xS%0JLIqRU!|Xq;sII|XZN zGJ4k8)bf4N)n66i%t5$XME9U6l$3&QuyBhLE3lT!>%9UV6m0i5JlS9}W4kH9mLfJH za4UvJe}i%@m1ifA>ZFE&omkXGFHEMlUQhH^d(&`(BeR4?D9(YE8SmWyc!GiMtOUr+ zxx!@7$J7{Qw2mO#$}`j*aLkFwE=&!9L*eMxKtEzrLZnI(`q&Yu$e4tWQkid{KsD4A zFJqa2oPPr_Er<=3iwe-Gr~%8bSh>pka$EctMspi@(4NyP3hZM8n`{|aW9^G&cLOk- zzt0R9E2yer^xSv0K!b@aWUwd0^Nm_q{j0cH?LjPcQxo}^F5S(7u4IPe560OG?1%PJ zup%E{mTnE@I8`8^Ams6Ie*g1z6Ns<#u9$sHVZp&HXktoy7eRzt8*%jtZymYX&+CI(` zLE%n`df-B)LOEGc8$W)4DnV9x67C5#E~}ETLVjTm|EC?iT9N|z?N|dn(X>G)xWdAPme<{^))o;``|bCCugxVa(J(Gc3P8TmW7A8IiQc=ljdS2U!>8ugsr0 z%*hz;-Ow9FDlg+fmc2$PIVCej{#$;$ka#E&bdis6k{o_mTT{L$Sn}W|e)5lE(|G*k z4r43x{O5j-%-AWqweS1B|kVegFz0Md;{THkfWTdDnQ8a$u!W|cQs)>+eUk>Sx7JkizDg} zfb^@owOdJx?PEX?C(=_VL3Vudk*)Anz$;qn4I8CSM92G@e|oUpSJ$_I|B`U8Gr*<1 zW-s$0T4Ky%N@~=rvCuLiFkr0$9S|ciMv+}XSFk@)U5ngMghBQzpv_t^{(d#6czA>a z;F6&N6iQPd|N34Lc?~G=D%@3W{PAX=#l=2faee+w%6)n7E479I$p^8+V__8Xig{h{ z?ECvBnW^DTPjxo;f!Vn-f%a>V`}xA zI79yz+ED%|?AaGXY?@!WlofKiDHs0yWl(}^3dtC85Q-`NzL$eLQJ(>#kbF63{ z4bAk9i~KO@a&G_Ra+Px%7n`TNAM#5unb&R%OWouLDx%ZpBuZJw$RV@OFF4qRdk`## zyUpk)Y9Nq)^B@ZZ`Uy}xIK|vQ$8EtvSJ1y01#S7SQG5Zd_!pQ(R{QuZXMb!&^7iY1 z#)jy3RvR2Kn|jfHN7iT!*w8u~+_D5J#gkkPAWOL3=g(zRl;7?y;Vdfo=g zUFcG{pEu}?de72AIdS#3_Jx6h5^c_Bl39_8uQyx~pZ^U0%qFfK*!-S|m2!;HnPT9q zyT#%DB=+?~VX7BS!GsA%WY50t1@IGJY7F~P(j>~CzUKKraK!Oz%%OHQ^!5=8xgaf} z`&*fa+tWCTe=j!Ta%i&M>h)R14{O;~gps}Z`aJ9g<3GuImcPI1{ssT-EXALRRXc+x za`!|ubT;zCWSZjIneTk4Gdw9VzyNQ?Q=Ol${)Y3URi?6;1X)S$WFdu23-zn}X*_mP zRRVNhae!sXeiO1IM&6VU{XlNiPj_IU!YbHNzd`BgVS~pku+yVjkIRQ<{+U@7`DFF_ zxNAmbz1lOC_ce&OQM>#FW>3^~L61vWl;fH9y!Hca?I2(||%gS0hy%;YZ8E1esE8C4{CxkqW5n zdmH&iq)1&J1aL%=GQ`Bc2!?A^zGzc)WpPX5)c>8kTRjE4W@cX|+Y(Uio@4Uq6z{y@ z8`rGsnv5}MbdTd!Nc!G5r$|64y2kxVIK?`;*V z9eYjYz4&m~w4{FcOU$I}k-K$kz_W1semP}uP}{Es!pbV{vdb{6Z;KTfwGv4DRM_ZXfi{??^c?G-KZfOrtX7D3Fy7Q}hHL@j$I@u%ZF1?ATm)azl_{%}qN~^LZ9!yld<&|7V zI2GM1;_+_mGS>~6g&gAO4>*Ik8lT-jmun|G^2jKZ3Mt@ReopUorCsMLNEQ|Z%5exk zcJ1t*)Fk7X?j(NDO4H*`b^S1vC2m7;I^=B5Xvwu`o7e(JEyz)mK3mKCBpTL3&=MCH zcR_7hQ}~jsK0W6(mO;E)=^`{}n)EhPn0U93^Qj%1Y3pI@h4)kDed-?izcYbZXYn*C zt8F^9yFSLL@0NzL56C~QNUFU35WqjrUSw&}E%_Ryu9B(fFB_#usI@-@I^JXzt_-78 zd%>cnFt_p8{kk48ZLO)u592da&=_QVxH!PjI2h$PsyL8z*8yEvI(@V|vJeZ#@`~eY zE>~c2?_BrW;ieN@KoArV_LvPapbIFI%EICYTqa6Nxt_)6_{&E^qhyl0=9agGBBA?k z&?WDGN3`MS9*=)5Sg86!usjQ^Rjt96YY*oJb0pLjZt@pJp7SYf7-G>xhK$qcM=TEZ z0cHZcQ>~yF004QVZHk&>v~z?P;8dVFIx|Aar@5571xfhl(dlU4WGs}0*Cvl0HOz;# zsf)U?;yBm1Y;5{j*(8habX^X|g_j^d?z4C0#SHSWxm`y`K5ZN&NrbZt7abVKy7Alg zhpZ%`r4)F{JcOfJU$Nam4nQ9oetOJ-GEO@jlyMQb%o-ve4@*k&F1v7 z>vd>8zU$`^s*}_ooxss@7nd+Oo}!s1xnIs8U4yLo4WByvtSp7VzO1an9VYV}HYXXe z?fNqnLKl^T*~c{m5NOlEft&fW(BFIk@T968+*VBM9OT_v((UzR*gl~V86lkZKQI-& z-kWL3)*ZU6d}HM6h?h!rmgXmiIMCU%YF-M=So&88$zDtNhgD}{D;3Q2uo4P9Q@2^t zC3v6Emk~hhwFG-c_4s-3|X1LktpALRkc{b z5P_bVpU-i**|R2wW$pCFIXs8PPCKa4U-OxwhF$`5t0erI5r?ZuBDARdax}f=5WX2| zwz5URy_mNDgGjqL(tm8M0S9)jvlu@1Q6G;ON3DjdZ-ci&3_sHjhb~JcaJko+v`+G| z+X>jTVu57pzWVh*#q#DZ;mBO=K4;e8%#Zg5JYS!CrwR0WCIs{W%K-#{q*X1}4YcIVc^ zyZc1SLxBU$(K#8J_bDQ`?wFnVuMIb+&nxrW#k?ya*7Arzn*f zome|G9gCum&IT&W|5!CsGi9nWSv;8FFr9vXzUXEfPU56c$*+3pbM%P^qEqdLTY-bO z*OZ{8!>1W~vCp^+zI+7_i^8sdw6@$4mWMZ^(YN~}q*xng6)=zS;9%H(E`u zlj^)Jp>&O@O&DDxY+ZKnf?y$kAvZU)W4tMTUp61iVE)AM*}5s2XANog>m0KTj4J>7Mtp754p5T8jjB5Z>S~NzXUl z)O{bPY(lr6DK+A?yfl0?&IKYFcU{)Q2YN44_}SO=XgLyxTWiFas0Id=ah4TyzxMr* z6(Tjfm3glWQ{?Ii_rlF;cQ*I^79ZyYLaQ( z9j<_p~j| zwx4+Kooz&2d$j$um8FvWaDxrcK^m`1Fj_tFoJ)U zcYL9n>0WVk5^R*u;n{o4{qB>%yHA4ca)R;eya6)cyFbGWgr_B0cpDnI7S^+a*Mln` zveK>}dYk$Mzqwa6TpCUIJhv5Ir{%5SOK9mD{D22p6d|bA_GieS+`Scz7>-lveW;}B zT_Zf9lFno=-24m)m+)=tLbT9^=byZxf}qE{e4JN&C?E_Zk@nGi=s^(9`5 zX7-(*h!oh$p!l^)q*ODHSyxu!OGwuS=qtSo=1`NV5M#5HgOBoYnZQKQ9^?+|LVUE{ z$JO=2MpoEE_Va#7gqNQyYo7lG_{)_s!t(Tb1A?-M=whK^EXeaOVZskKuyZ0xhJ>2D zOWUL;_?V!t61ieZI6lAULE(|+h#lNSuB_G+)eXv>U<$jxIUmcBJ2wR;Rx%)s+rIZ3 z*A`MTGg1N5g~|wEQr^Qjg7r$Y1)uQP^Zw0BT{3%P{PqX= zS*x?bRQ?67Q5sR{?-kL5Z`C&4p6^=-9WLC)cA~dYN$g5&Y;2)o-Mo0!ugP@CIn#$y ze{oT3E@l%qMT;;TV}>xBgd!_kNk8$yL$$oeIH3!^!wX;dGV-X3&4mIh#Iy7^=g;(j zj=97-%|E>?h;eN6#g%0HIbo_o0@UOrc3OIfABD%Os zxv~;U>nv_;eAQay`zHIaXkWZr zsGuwBiV!r)iuyEZ`Df|C?=?)hf{y;}vkGtAt|k=ErPq-5Nb2U2!*g0r*ut~Cy4T7A zC4XE*%m1;6Gd@`iJ2JOmL>hyY!XEBMv!oiDHpxWlQ;3v~ZNm(azl4x~5VstmSZjHT zA@Lg%Do9R4!qSL6h^X=e0c8?a|FI@Fza(LSp6VCu=B~RNmebiGs|cbaa2f(iIk5)^t%M+tDsIY!?zXl|@^wt)FMg08y-pt>>c*a9< z5by%FI~?q{l)a(9$>Xi;k z6!)EiVtjsq)e#PCxm%eWQu6B!ER4193ghzH<;tu@j}*l{)!5GiChsq$=p=G}p0MD` z8;SnN%6GM4LQTBZ9b2%*3t7l-`hRhy=j|$ZE1OrI7f71-eV*`hBBHj<^EP7TGSo33s;K4 zxT0=%G1vO!E6??3G-wJ?R&~dEf8=m11h=@kEFuO7ZhqT*Po8Suk9{>20qQ(qRV}p= z!K(X#)%fV7tD9Q|O!3B>`4{M^hnw+V+D}C|l1iw0?8XZmPE(6lB|EC0I5RpzZZDJ= z2Lso4q(nOr%kKSty<7a(uQtAaR!~5sdtZG0{*$@2KXu=l*7Zd)pC%&kyi}9#2T!Jr z7;LohXT;WEHQo>hqa(c94To|PBp+2;K&vyhfHmO_sn*Mo+4x*2^nzER9w$bq~we1qldHndVofJGLXPKkyUQ-nR(Cf#k(kv|aRPj*| zsAvM1{U?9(ln@n`!;AE1MQXX`0;F6rzQDI;romnx*D|E04{`Oo5$R*DR!73XCzp^` zNi0aYz~|BN68Ca9vfhAEaBBn9RTw5Ec}Ne)Gxx|&La&Z9q3pyxvN5#}@8=1!o@|Ra z5Y>{3MkZR^nYlh#6TDUS758Wb6-liCcHz*rYr|*Q?X$K)+lG3g?@=dCAIo?W5)$HH z`R7^KlONd)XNw#*ENIct%q4J`l2GWD;AdFwFa&8fu=E>*Z1gL=47faGCDCwSrW-s7 zoFlVq0Di8s&T5QG)Jv%Q#>Ao%2WKs5%0P(^KjbjL8SS#EW6kOSB5gzl0Sfm^g)$Pp7AvuN66@) zz1r>o+$kVT?|Vy)BqSq@4QUS!_6#`Ii9nmaLmiQN$j3_^rkiQ`{*bEt69^HOG=dq0 zExiqvS(&r7$mKw;Ftf7>llNzoQ(NNY+CPU;bqcn;-;4M{0Vx-g;M~D_WL0-iD_^r5 z^@HV;nXBBZH>RFVf(#C((O9oU2+};u7^O&lw1MCAmcFvUPMZb`skkq{z83ao%qy8$ zP=kl`u_O+D{^Iw|t?+njlo>RVYrfxi{&0^Wx`{2#d|6Cr@!3vX)i7N)T(b(v}38~WNK(;r7dq8u!W2XfOH`h z9Q+sPe*f#H z6<;jM$dPjakXhTD1oZ3?oPmNAMhfdt^|i1WqB!Sz6W zx_OM-s#amokq(L4tzvqJ&~V~AFt1bpOR`I9_9j-&CG80GyS@OA@$uqFG$}Z{yo$f# zd-M&o(brxa#vsN>jIz59o!0X%jzdcpnJ@ldypmP|WC8xUXSwCLkRy0Y;o+n+xHY?z zu5m0)YUVYuwh9aR+>Cd3U|T4E>ennz?utYldU4z>MkwA=eTwy1k_qde0g1%~z;Fys6*f<{!*cjF{aMZDX z#6Egy{qgE5s+%LlmpE60`gbx&!^X3UmscMHeh$*OSJb#*)JC60O`c|EX1=>R=G-DO zR}oG5L%;zmeqKD4sY4wk0L^|?n-{*#FL5xNFc%#WAb3i;zyARo!=(EZ4ho@v{zq5* zdqf2fVcw3NuKTz(YXw{wsOS&)x9Ht6yW))*{MbalYm?(TCI=U--%u!M^4LqaW~t0K+p zVD;sz=`s^^3Hl&RQQ3@1@TnCb{6UwmJ7Ya9jjmkn9PwoY-5&S^T5xSEg59tJm<;&4 z^6_UnesMvAlY)a03`vGsbMd>AY~QQ$81j7avFWN${&fCZ^=zD?mOxy0y*wd7pL-0R zy&k}rW436nO@{<#z>Yd(h(WU^RpVv?*b8ad;nC33?|@>5%6!*_j>Uu( z$p+qoa~=vAz~y1vOX8Bqgq`0>=#6VBxCw6T z1VHjYgA^4n#iR(wg*{qtyl6f47xGj8DS5Q69KnTXPLbFS*vaL|$1%(zrJu;Cc7J$K zPT9$CVK*b9v5^hmpTE@*66W%MD^TnV{!;qYr9#kyNm^U>Rc(RR{Ag5yAb!hGQGsTW z-+Ffp*!r1E*JERCRk@cgX1#(Ai8GT|3!iW)bn!U?F*ldYT3y5(JxuKBx(7C479kkn zet||3Rs#t#xZ`jBUmU81fW#r7RxCO0d+f3dlx&LKl4+y1$enf}^2l<#T?D|ygx=U) zyeJkVJyV8wHf$ULjX(nc?5y6|QRp#KNb9~u4dFX^4~weem8-Fg6-12}YP-ZHxa{T1 z6U-GhxxISzy8{~5kx~~1iOc_Z04Dt%B~}?5dcKS-dFfJo9?f7?UQBFzY^?%xu5Zrw zNJ&WtoZ5WyD=1F~9rzi^z1&CRMj}X(-KZ0oJ2&_mzpjtw7D%u+jdwbSL?V?k`OE0V z#Yzx(TF{E+A$R7Crw3Q2{oaH;w7+7%+(%}ZA+(KPg8<2l^q@Z<31*dU7Pa_ z)ht^5CMUG99^fEjZO`_RqY<$sXZ5>Y!`=KIRg!47cNB#`ga_zTj!L~61CR0V#S`{4 z;PqrZO(DQ3TK_D+?r0xL0jRmx`mxyX10c_c<7Uh2)cbPSI2p`hIE0Th>JG3;0fa5e zVI$=Vz+^H(u)Ulyi+=1apw;<6M>7C_sNr+l;6d-85_U)&?3AjrvzB|3(iQl-jelus=XmF8-? z@#PzJ4H6$+TU&bv1A{rr+Z6&_Z*kS$(JwXtN0I{DY~C-n`y+9; z^VRohwO6#LbId@1p~9I4qE`A=93giumsZSEiB-To^+0VvSi96A&E7vR(EN+}-;l$_+N9K8e@RrA%$8_UuS@CYVu$=KmZ=gt{wTa2=e|NvjOs1FZU(~HVQ-5n#Sggi1Cp20g zB#Zm?3R%B34Pldt*%P*m}hu{5kq@djUF`ys4-@Pd%+TA4z*NL?+sTg1YYX3PCAXJM~ zx-AyN_VSvWFOX2&f6MB(6zq{9AqfckJae_m*>5@>8a~&5faA?_gOui3W>F<4$?I6B zYgTydBX<6g=dUz(JiU+7{?XCX4_nk;a?KoI8>;WN-#Rz(aO2&f@W|2NuN>{mlv}XQ zx|w%97=LN~gf}&!nAHHJTbiP<*m>r` z7T%%0;ZQMJ)C~~UGNA@MRNwAFFxz~2Dq<4?tL;-n`cK_-+X34NW&#>sO;Ut$m)F3z zK!@x83Kh`$^~8sz8R?#YEC73dNIb~9w05+o0xB|Siu(SG33qcdr2=}HJ%a%c4`qi3u^jlve2h(kfi;KfLpxmp1FER|}Nl{7~ zLs|X;d7fzpxaN1V45_K!=8wVcO-&_w9!%@GYcCh_{TzZkp$-nK!!U-}uM4nbhgxFH zp;nT`S8HQ;+De(PysAg)qE>&z#)w!(51neIEw;^*`syi-T?x)-T#M$4x|G1SPj)Jv zo~phI-|X-0=n1JWe4o{pL@$p51+9QO zKM0vZYQL4)!aF39Gz~}(J_mSE8VJNzjb!zJr^0z0;i$x@s~*nctNOkG3)fbs3TR3u zDzHRxh$)Jj>sGHEw7m5JY*C@Vz;r1zZR9F%>M9R{^*10xV2u}9w*pA~nXBYG*$(M; zdDm9y-%Q1TFvpny#Z*EHHZb|CAKnv{LwnRkf@J-LhVvT&c)n7;!)COccPH;XiE zJaD`2`#LyEuihX}(*3#!@2G$Ar@Fnxua{tjcUf5?X(uTLfK9CXiLQdLindS5z6fH_ zb3KvQ1=#BKH`eX;3HKwmbBcX~iS~;;4L^UrESok~A2?{2P1P!%T6a@+CL=NKVrt>9 zvug3rxVk_;<6EPg-g))C7X)-5jx=ZV#u=qF{PqF@h}1Q!pf4%Hi51y6%bbV9rV{#o z3##82^U)3D3hHp+RveEC$~2QuFg5?SD=eSXtyy=%^3aswS9*dh!rd3Ld0R?`jU1cy zpaokD@!Gk!#dcjy6nq77^#)XTdnv+J&&^9k8Bu9mF#oY`!1S(2C;)u<7`rbDptHtu z)R#R5ht5yz<<04W+Dmh{# zDvik^Ce+H&OE}b_A0^s>NXqP+*2*mEo0AhUx>(N%u2Le~xyUXe#H(F-JKbnJd~A~) zUf%?%EkW1)l@sHw5CUQnS~l|TouTKAL)Bsfy9>>58d?=ei@|S;pChCj%VOz1!Ai2z zh<#%o|HLA1PQNVs7}$0G(Luil|mv1H$sM&H$P z*6L5`RRWa0cLypkBNnosRn!`^-vJJ(*1^EoIyiTcKn93~ds;luVUJ;E#!&%jZ}O48 z|4G_so$f0|gdWHt>&@>Raio!J@Ig7cv3KtL$v5&40;EP>;!KV)oRUAEWa#l?z16kx;NG5i^m9YO z=4p+=DSqG3`?sf+awX&$+m9R@e<&jd8N5&E`lwTd401r`&3_V}v%WH9aY_>*i8@hp z?h~P#cx=3S%l-iT=M;TdW955O#ZdTj6Bm+OvsS0+d6nT>RgI{v}xFKiJJT`=inEv@~a+GUp`AbnN2brR1}0aAP*n4Bf}-OD7Uy}+W!-(ppH6cJbienoZ=kg zpN4FjtgyA_#h2V2I`4|Vh)?E_$7gj%F+qgckkc$noZ;-8=c~>4a%gmGDZRl(+1iwkoq5wsje*SPxAMUc)~-MIUf! zeDHog#;$y|U+eRjV@Y01BfOONY8vb5S>T41eNVob?q5jMrgmX>e`~fxr6f}tn+iah z4D4sS+;MbPOlr_#K+2`+y5S9w(Go+eOTBShTHRM3e8A-mz=SEy zrC{=}1hO{(kz-{T=F5&M%>(bU4)=hpGHm7h5LhT054b_)SBVQ+j3Q%UbA!lrzgjU* zVoaH!bBw8R*EbFgm;r=A%u%N{Z%5Gk_`n7Q`h60TKrs^REwiA4(^w&kvc((|O>H*1 z1dZ_fYA)`M)QBmz*3!z5YOQ^(>aq;2&Xfaw6k~1ile{F^xyX@v{tKSD<=Sn>H#qvCC?zJ1`TqDU|#nI?sFMf#WqY=GGc4K4!zx`03RjRB~{NGmoHyl>7Myi)K=bZ4j1?)U{IVPHxx`x2ia%k8+> zyC~<_ElLx=R`RCy-xd7X416^zPdtu}{;IBfs>A#SSc?9eV@m;-W5@u3Lxb&pL@p(y z_&0ua5TG~9DG9p4zI_}4{dPO=(Wu?gU~OuFvzxE`g{X)wGhPTcvOQdi;%F=selG?_XTh-Xr2oo zjbK&v5`GR>6mcgpg3~gt7CMuJPhGX%AtcxcArQEU30#7p`J;x^-p#!j%#jd8eiM2s z71){eJh{}i*NR_QjHWWbvL8*^EtA&z_?xZZx92zwxRL`Z)qSlT!9hW{c~;5k-VR(j z>(8$9rDZLbdUr~KX078WS@`@1b2HaepJ6D#jucb53Rx7sEhK3n* zk;IWin1=L`+v8D(Q#Zb!>fsibN+!HoGYe@vrsx|1bcnub@u$U;tvmUBNhLZ5o7xLX zs{JVw7Ce6mi^?0arK06w&O;UA+pCGTFn1m{+IIEsNAoohvDF({43Me+WZJ9CXCCnH z5rCZ~*Z?raXHAZrH)ZWa{H^ z(Dc=DO@H72(%m&e0qNd|(MT$dbi-hP(u^(z>DWjqDJ7+)yJ55_U4k$~8iz>7Z|~3d z@%wkL*Y?^y=e*9n_uS`sKC50RE-&Oh?=vHpsaf;^)p~_wMZ((Cb`KrFWk=4l-d#DP zN?~;m{vy$6OB6>KVT>|IGz^DUuL+&?9XTBaxDONq-7BvEnk`klC%z-YCi(+O-Q7C# zNo)Rn$eA!HG!N*kORJACtF)fwXD zyV4hgQP0h#Cs@VPwd%nWZTv+Clbi$XaoG3ax&wD*XZq-8P-oMsu*Wp0;l|m<-iHgd z3i19xLAa|c4V(@+#RAvwJ_j8Oz#nEkqwt|mq@52IqUuXc1D)VF0|3804E9a0L_ODh zz*HRRobn6@I>dN>>~jN#hCa;i(nrxH!#5C%%(H4t2c%|2}7(Mm=<}84z?JI<&!wr(HAZHl-NYUEo7g5mc%iv zm_qp|`)9@*LEq;AcIFYh3GdOayN~B5NE;dL-JhFxVhOHeKS^EoIAO*qaCVd|Y$ih* z;nlMqwFqX?pTrlhd22?*ytd`s?pK%>H{%Sg9NbfeYtU&GV5YTvV8JulySJdX%l%QR zi7=sP^tb|^lz3RaWxjpyQqCSHpl%3Imol+)gNuqm2I2;1WlcDJn4K;{lum2>af0j2 z!dBnW~+WlSLL!#eDUX(jl6sFuI*R| z$GX1vpOQjiaS^pinu9x*HRjG~CD~>J7>dB$h5nh}^sNVVB97_r4exWAM`m9PLc7`_ z@J*IrT867zC)Gj0H@Z>v;DTTLaJ%4y9<50zqmz6J{d}B8LrDHQH;*UbyU$rJ z2UL;ukTrwa;k4H6m}?UC>;CZ_%|C46qeu4q2gYPyEIW{GR=gbEPmM(aV-n81+u1zY zF>ALkXwQ_la}uvo_s`G${g@3?&-%2_bcJkf@-qKi^3CsO14LXpxB<32@ZV3!SgqsG zo+dpS7&+~-SeSSMHT;I+JR#&DH@7-ziuZu7e<=xDniY!H019&g7~o8LP%AN7PwGB` z&t|V6c^0^xivSpdn5RDG5TChtLe$ESORhPBw#9cUQ-$f728wyJ)$B2t@6eC_B%$Sq8R{|r@Q!~iBW0x4P zE|A;*!h_MhD?os4m_;t|jtJoDuKoErX>}c9xFiYnOpm!7ST-|aRH?ySZ1AHk7=Fi1 zPcWw~m7f~3dph5{VP#QPUXH0Oh~^giLQ0zbC#XmMEN(t-^|+gHw|;tW-SfJVz47@d zYay>vllqq~seFbMZu#Z+z(!Wt#%Hz+lrzDqASu8>j&>gfK=weN1i50Hyfze~DUbyr z9mod@O$n_d%&Z6N*wu7v25VoT}+@oo1j&`ueze3E=z3iB;B$|olQ@)KYoF4b1}COK^bmUatv8FXL{Bb1 zg^~?Ve?;iVgv=K`g$$FkJylUxwL^`^8GmVM!(^Jd7)yNzDAh9ckRNrsj(*t?omAoY58jn{Nc1y+nJBHKLU4gkO;34`LQ1gF?uvOX96@x(K|Cm zyeUgXS-!H#U7PJ5naItm4C zFTtXOT4s@d@VYF9r`Rhy{gnlz_npmi7Dm?3K30ps*0oK0rEkQW{HIjm?d|2}AORn} z-!f-irQ=G%365P7;eRgq?1k&GfX~O6D7M;MX_oX8=-VJT>8@4g39hLb!d|x;;m|DjE<{UHrhrXb zj(kWPx)oEF|9Gyd;&sd?S+jj%A-_l=;=l$vH_)gdXyu2JU|mMIT|#WaBdb#NpBhc} zoZKRr&XtRke$`1d>l42kvX_0c^y|^zl47WboB?2FK4z-9PoMoRpRlqFVu;o&&5J-~ zf!u&FIylK7YYchLA~Whd8!&B4h7`%?=nstHJqJFqfFtr00nlA11^lex>@zP!@_+@_ zA@!^iXBJ?jIyK%G0gCK`Fjb2IZO8}5Thipb(V z!LYN_2N^BtknO9G-&fBn%f1GsoWnf6Q+T({Gt*w0^CSn|srHtS2kAY0r=D4UqU7d0 zGP%GlF75RD)#7_+GNpQKL-Q=AoRggro*3ghJ3Mg%w}|@eq2K`T6u2YKPZ3$II4<}l zpDufjN9yBAWBciQ-;?#jbaPFtLW6v^x2@@g^5W}k=7c;cubiBKM|J@Ll3V*8ccX;A zLX=5jKx6chh5>s^qV%G0yAEP|#JD5XEd+ux{rDQ>mRmXH6CET&oC-Q~?MlVFONPJ9 zST!Gg2X{C<3yBFzM()=sH&Z75V2-{8lJ2>Pk>+j=)G-iY>jCdw00#>Vp4d=ge=6j3 zTk8IDqev2(bg>!=FSb6GqR?lU1eOS-vRXYB%@Ue z0J>2ch#Rj0J&M_s$#o4P=jVEB2V6fNw%REUe#Y#A`1>93>dEl4$FC4HUe&d*tp#2EXr#2&7_a-M+)cx-kA) zT6slxzDj`91j(=j2=jm3oRo0hq8di!|tmT5r${s)mFr;6;+94c=V zX`lzt1E@fb8cfs$nYi9=4MJ~U*In~Wm|{}@-BBYQyt|yA{>tth`r-@nB(`3&?n|S& zCCEfSj+J=rzSE-I!3V60D%tfP2VDe;yTVE?S>Xv+F=Te%D3 z;?1&X4f^8summ1F1cv3&3nFZSqy<64jj7r5D9p;yZn_5{9>g~wMk=7 zs9zs~p|CN1XTywD0h^Ct8i_ZI!*YuHIf=>+)WOYyx^}@j1GO0Y*HtjS3YhB=aWfX9 zT?NoYlmJPjnf2{^ybpjh>axE{B;%hJrg)DP9pn}bW&fKwkHNj*d5zuI`OeBtB*)z2 zJK-BQ8RQw}jSeaEDGC+P| zC8vYS)Fn7`XKK+;Moh)T>5YT$s>6&zZ{P-?(IQ*z=LM!kYZ0jw;KM89Z{KcA+c9;P zsYY42Nm@U)q6lA-VLJKQ?RA(t+M|K?kDIOQCUQs?Yy5bxVL)kh1W#~#si8?_&l5&e z7T&+fNd+F{9Mmh2Bl4j7=VAP14^yMU2w$`e;kQ?1`&AIjRg|&eqHuRfp+9Q>G&VPL z^}hbfMN8xsRKPl#_FKq26qdDH^vHtLkbS(2LI2x?=6l)FFW^8&N9R)ONwx~`;sbXM z>-Vbs%bCL>=g|RWgQ4AjKiMa2GPf;EG@RI$IvN{knid?MV!#<0n4=7Q6bz&D#1n^J zewzj86zV6yX9SRR5=3_Q7n~fuzaSvMIXW|Xt6xZoqLZa^tNVgkRhI2d5d=z-{MT*zL&>&jxgz@!idB@!IkbK3gPX4I7Z+$58N%1SMYEX=$V6f!@U z_q7?vRz~|>9)$txY>$|SdLCz+N7i%^+f=_v#?1*C(hn5udEHiABb07z!T=K#Hj>p~ zS>;dkYWPY-oa@jpiTq-j=dJIthyk&0CSr{Y!YZmb zrH)be(pSdTOa_HFLn_H%{J~ zz)##MMgoPAZCNE6btoCUA>I3_>DKz9-2W04Gh8pco&%Y*(1r&e2A#8IEd`UrXB3TVnCD@#yqfDFLk6p5&25)t?_HOpLM7dw0Vd2Z$lAA|&Wf4F z35J)Pj_bOY;L*nP+#tDZ4v|rGKTgZ^l7gk z3-4(O`bon_fwua7pMH+q{Cu*3S6WnQ{Xpv0Sw8zVxlLl}o{N{|wz$p^zn@%n#42FP zX-|)f=*{E&+L!W@s!=Q@&%ZQ}jilZ7a_%N1?bP@5JAGdw2`xHhEH%t#qNeL5tT^f( zGM7T>NQt*3%>0*-%^|l{geV)4q02rIyw;j6+jumNNCdj7y`2VnI6Rv>*-8Rmb`#TS z5TD`))a`l8AzfW%EkwG+XrYC=k+4YgZ&w5q-u>}o6`eU$uigUHo^IFmo(gpy`k@BH z9-9C&X{tJwejF*1Gs<-0#y5hpggTHP)ZpPRI0bYvaZIszIu2Qehk(lbY$I#nkVdsG z4lBppG5eD&bj=8}>nky~e?{L9;gLB4q#JPzCt#All_!omKo?V)M%HVL=`Tp(OQ zyQPAAYl8nPKLjxQe#BHBzW?3+;HoBeG5~9rYw~IRQ& z-`+6MVNZ0s8JiRGdj}}Qfo)fcDdk)~{(1>O`4@NVpKVg>NsSGi$(%4}$#+`4fci-> zCvj0yibfTD;WAklWDv1!v0Zs7)nD0#_g~aKbA{WQfatGo!jXVD{?yeD-qjkbqI^;m zf=ta=AkV4{z*7_mpLnT<0n9$2j>0xZB3m8 zTck9O^q2JKm)+IqlaVH5rp6AxoLt-Zg8P#l(p8;i37KY$k}%mfLbvCpBzQddf{{Zn zjJW4*vbGB@+s@@GhT3z`=Dnha#~?hLkRt(P0cY|s(Ga`;OJP|jp_@AbHuaRElM+gKR2+TztQGzlrMv9^`#=9NU*4#zIs%T?0Ue3g+~ z6Yc*T1;CS6hkyT`dvARx=g@1T)tK>={{53|BHB;ZE7!4RqTP$;=uecbt~7Bt``qwi zbDWd&b9sEgG3>v0^aip+%0KjPk_XtPX|=TO zwlzQnhO&ZD9pIY!g9x{~jp_3_q$lRFFeoB&N>qm8Yj!;}`c5yiNV z2+Ty&v6MrskjbC8uA0rIpSPa>z`Beip{S(_sjtn(vmW?z$PCwXkF9J0VzfK{1|c}w zw=P+~ZKqTz0kL)9-r~y8IC5yrdSa6ugfzqp_n>%@VS*u-%pyk-*8&Ldj{^=Qi6j-t zFS#-gL1fO>A|f5^Zm6$|>di=4eCLc)Ji8a~cKnQ|DVCw;jmM_NCYUC@0!)|QS(T}= z^`POtd5vv#*v)xO4~qc8;k`oZq-zst^H<3?LJNamw^#-!u-C^?^6a9y1Yj6}s9xeL zL5JpXPuXsRh*uliXDesh)*BZ%VW#l<7eY1>T#}+NtM_X*TtF@7PserZ~|4G{YVh>yQ^<$#Phye9Lszak)Z z$bCi#^@mse8pTBd2Hb4HfLvSUf{sjRo+XL}#cqzGMcVBOJ^a-1BIIUTC$K=py@8+@ zX^>9*!L=`KlWNcsEy(ZXgV~KU9gG$!j@SMc0AB&S+QA%+B+Kz;19D-i#j!(w#j3X5 zDrQzzhKJbSuT)sH7Ls|MHn#2=FORFC9(hJDTDNVP62PNbz{vAq4tM9!INiXThxi$fI@6|y31`=1bR6-e{SOs5KK6$ zoqZNF_z{5P;2DAG%6~KVmctE%w0i~@Ax8Qgo2OAdj+>sI#<5%aU1^TQL49IxWLb4V z1}Z_v@PK6|g0dV}s znW9$xq=ng7FV$dG7seKR}fhX%7e)HbWIo~YYiq{jl z{?`5bY!s<`o}yIZOK$!|6nE^2Tp-XtAlNO~&HK8xbvH<9kYW&2JiLJu(^7&PnmOYg z7u_1khScD3D%>mjNGkN`lVWty}|H@o4bRoJ;+-gQ2$bOFS8K**$UGQS#PNn zcz)mU7B4*#x;D(jz=*Pt!;T__HN=rMn)6XmLBGmcm;Ep($Z0$@upm0?hIv+!tYRvO zFPpvCQ#lUanRI;HMLGDN`-Xs>!`5Y15X_QmFYtRu?d4U!j0YzTE~>@naKLU%*S-QT z);i?V)~uTSw>Ko`YDLo7crlhez{p^z|H+JUS>8#%r&1eyFtEVTX#Qha6p= z30;3^#jKbCsHrLL=&9skjB_yFh9Go8fv%IG*J$8DpRZ)JrP(+S0+wjF0`Nq={0()r z5}6GYaz}8it0LySnnv-On3$|vb$w26 zm-gIz!%g*lO-t2PihvU&PW^k#EoeumfJ^T+7Cs~!rR}{Ni+DumQfU;+p805{$t+io zw=8>YyZNzq#IT)-y9xeR3q(g&(cJBbakoW{@o11!F)68hY}zOB8TZ;&_01HZuE zzFC*uoQ{zXo(LNSJ>i4%JovVGAMI#ByJ&^Srd0`%x3v+GunH=J=nwldXB)Tm#cO{A z;m}}1z+XZN?6i9oe*NkiBvTUA&%aD47kcDWEg;J@ariqDh0X zVMz=>TV)rO?6OEZsaYX{Y;F^Yf9YUSOzbCYjM5tl)?|LOI>khD>VU}20k}FQ!IID# z_HzDh4c=%YGbk9zxFDtddEV~(E8FD*C}Q}hZVqzaqEcqc_k~+NkzMhJ6VnP0{|cjv zezV`j^UlshJYFQNwAW8cts?Enyyqk(8plTXL2_OCVfkH~KW?Pxr56;n7^UKi+q2Sx zc81jmGm{{1q7GW>>Wsn#! zWFo-oa2j5GSNxB2b@;raol5QdniY?ySRxkgC@gsArKk>d9;4!=R7#Q#cUllH7bD6@ zh2iHXv<1|%ll$^5ASy2E?a!;SPfQQWs%I(Md&2blZLEO_wxT;u`@CDnrRw@FXLOn? zNiIj9-S3NhP^M1Pj5!5)dFGZkjcLuz&3;^E2KijlNR9;bz~MkU#mJ=rf83F~IkN?h zU8v_H_{m0Z-QROnkc}qPs>aElbUEVk9cwUm1Kp+3Ao)+G+{{`xcn~E45ZuzXlEe<4 z#nZ+hC2qy6sa&N1gQRH_5{78u+_;w=&(ol{To$OK121%GxKoA(TI7b6=16e0tS`F)DNuJnlal0*i{1mxG=@cCNqm~LQNZDPLE|E z-n|jmAZ#M6wDg5kG{=6{GtAewskN175JDBw*5)q4lNHI^cqQ&%u;N>3i>f94{WghR(uaex_5_rSu=2h39aP z@hr(^njOq_a|(8WE1IsMdrG79iccU!YK-@N!$kK+&EIq?!FLYw3=A81ZT()!c%$X< zRy-OXnk^pK>#+WW&*8^$-er240u4lm5O?n%Vsg8D6=wCN zSw&!Ej^O0n+M!$9-ZbI|s-Ud;_yk88|k7)mzz&r!~MU0vP%HhKX|U%r`Osl2t~gPjt^drNB7 z6m6Cr!#+V{XsxhGmNcJHth2L{Xg#wOD{k^3I*=o=d+`qcUj5kp+>o5PG( z(*+=X(T@q`1J}Yr%$g1vv&yyf!+M*`iCW+iM;f~?@O~MW8CA!*1d!a* z8ARE2bpiy1b!RW=I{~*WDBDQ-GID4SL+Jf4Hqs;%x(11qoPa!@^Pj zlf;#Zi%M=l&Vl{pTyMk9zy6e{FILw2`;Y}KkmI>01BknhJ~wx$S*h6Yl16%p#KF-Paw(Qy0sDJYDp*Z%6s zV(-0icUBU2ev)DDZ-;$MCHbT~_+Q1w&3s*@%qzC9zw2ry3n^EYl0g*O`X}Lu1?22M zdzh0_rM>!U)BRkYHe#r(+xw z4wI{s^br=%QEYiE%d{%#`StG$i8sH}(zc5s06^pS35+148$XWop4UKpA0UVtr_JNn zr>hb$TW?tJ+Pl38_%kNdc%A15Kzi^YJyIaUo&>dEjR2IreXWQytRrPPWh!(y`(n^B2g_W2z^rlH|3^3+;-q=#R);p`#*lZ_v1hH~kwHlBe zFjJ4H|0?zxHJF5+$^@^!-tH_z#Z&Ue|w%ymL zy)7kIR8y^>TD13IrEXo5OV-X}#s@}EU7?2q7taf2&DN^(IH<$UdXGTs#;_2AlnbTs z(c86C{?)oNL`mpEfnyQc8Bkh^U`B`xmu`yV$I4A>*lVZaN(1qa&KUY84AqS$96!Lx zuB*YEb%M2d{vTQdOxC^%@ikOWDxd5*J1iGTPUsYViel#lMRCZsr2%YgY`8UF)ljCe zE%(Xku2OSF8f%AKL<{>9s2eDH$GxqqC&%T_4`3y>E8v<89k%Zzgsc5!1RfK?((G=SW3H9>j1+lgn+M;62R z5V!o7kL^e^t})_20@oiA&-mO!Yh72e=U^xzy!+)yfIx-xO5l7IB7ST2Su>E^on@p7 zDcIAi1@9Gjf0A)>R0sAT+oxU0)|N8o9aMH8?PeBpp5ak1J6sjt#FgR_LYNwHy%aHa zO3b@LN?8U~iI!5&5#^LGitzgwma?-(K^-)6Vjfp|2>fgjq()_Es<}WF65@3r8S;H> zjHxNT+{$(ZBzRb>oNccx@scD~qE{GN9;81$H9p$fAL{&=h%H>0N95m4s?y`mAY0JD zjZ@>gtQK@=L?HHgAgL1`=TMxyNRnopM-sJrup)b)PQA|gC3Npb3mU?;X7HKn$CTc| zp1mv3sqgZey_-KHYV*xVV4y9qg~a0!gajKhLg4khdg6;L9EkZ4w-<}<*G)ZzF|Zye z{KBXK2xgtbLh0e6hJ{^FX-5SLxGRAY*3394X>GZt6{%xI=8=EvgG=+skF+0WY=xDC zeOnc|j+`nll3f!*^9nNcK1lN7ShQ}cyDBsg$W>1Mz)$pCuhBS;FD!qgg4d)|HuZH!Q5b<(Mv*5*U6p!i*RSG2}ePbg(8I zWYtb%$GV#P?WOkPyTSL#h-6F8U8i3h-tpQQY`xUvAW_9A{emh4@M{{S) zHQ}fkc4Z9vr+F~x<;sK2dnaDB=E7bj>fLwq2TXseELtFT;cw2jFIBoKl5wtdaBf}N zzTsG6S>CvsC=NfGmFxZ!OX3|RHvD&nb%tp2eS?(;!}1TcPTa)|`WQI%GvO*4h>>y=~Mm%`&f7hf|RQ!k7TLBhGTJ@Bln$+KfS!J&Qe@CTEQZ zDt3$Fb$`<=Y!~{*=SByVQw0FtV`iM-g+TuzOTa_|OdWF+E(}s|F~QyY0PbmUCqw

EF3ek2W8G~D@{t^y)W=N8>CAMUIi-$ zOc$3kZ3b&I-@hS6hOMrwpW2gZ;vlh5;plZ26c~;QcD)I7m+OuN1Q@*FS{j$^%S_WI zjagRtczSWox%S~xiq|TWT6BjhQ$qfdo6WhA!^(HKR+UNvrGtslX4|fnp&>HRS~g1H zwL?sX@nl(pc=GaQl!>CQM|wU(+YqKOHC-TIb;&7x9H(qrFkq)UIbEcSm2*PfU)xm+ zH%$>p_4j^%JHup6#aUNVljDbrJE_BErPovPcPh+KdiEvu57#8N0`{S61^d1oilILP z1Ij_wlV0QK>~-}=+MU|oeNqq>VD0jT{^2ZOH7K!(2(Ab5YQ~bf@`PwYGMM`@QNxRLcycjp!OR>bG=h!FkSb{G2t?j`esw`rd~HTwWNtNl zLvC~h{o{{Z`eE1A*2YURrUTml{Q_bHWLX><_NMev43sr0)Pok)QT8wir;$*_C65M*{T=2H;_d~<-4OS zj;Vx^7FIm&jPs|qai{g}(#IiWR;)9%9n5Wy9KXXzqpiaV4sKu|2-8&-&9a=+>v~|g zct&bkzVW!n@0iIq{*Gs-#hb7=#Qpu-T8cXp%DN~HX)=4tJ~GOt+6^rj35R*AAmSDI z&qf(AzIPOrwbSsU#M94r(OD7J10S+;nDRexD*1 zvJSG56N$hP45gTHa$+_9U;N-Bn-y+mb>Q{$BO(dIdti7?-#hphzsLV)iS=*D)H`;y zQp6O6M9nLR9Ags<^Q|?Nm25XC_SLWBW>`-E&`I)fJn4jHh5zhMPszN+FRF|;YRlbh zGki6|389pupN&1T=IejN9nPh?)7Z+RR9h`ag~S=YH>up(tOb1XF2n6hTb%W=D|7J9 z8c43u=28aj%I`BMcT$THo`@zuL|*+m@E_wEm{#V)%8ttWt6vm4d}@smUI-V}w@$0< z)OzlHvD6vx5=pi2=%W_Hkw_K1fW_V4oPju;ATGk8u|V1BL8 z(fmY4i#97Y?tkuvLToxaTP?rO}8y^K+S)07+j&pgK(?rt$Jm^iM~n2-{m z;31DtaLt{^*n8O8c4|&7uOvcNUVgCKYZl{DXJnWvNX}UJR-*IFyFAoUR&EyAbjp`N zqmkqgL&2_ycH`<8lvCo~#&GN2-k{{b>0j}Xz@@&m-n<-ZfTP~CRQFnlC9}- zUy29=)K-=_DMBMuwE6xxrEx7yb}{A|S3TEPElo%gCWb(EDh$gNy?y+IT`xq({9-r7 z?b3d1BzonKVE|XDv6Q@)S6ZF_4X-;2{fry{J@9uKx!m5pUb!BvNTr2W*%)_)0m4kd zmY7lgx0C!WQM(<7`XU)gxT8c$Bz^fag(cMLPq&{Rt#F{qL+=wvNL#Zt;)IP_EriQ;y}39RkuZ$(Nvdc{gVR2~=9KeupQG)B#z zA1vOzJv-1_tg1bJTZ_;Fq({3oqfg5x9=_VKl(U2-u3Va)oiuVH$A~#&+s6R@q@RP4 z@im)61RB&_SA}?|R$8gP9lYf3mWHow-8#!Y@^47x^Ad#*%sk)99_!kVzZK$GngEF9 z+}<&K({jcfs`QzFdd`(2*z?p?R5xFf=B{m%sF>L~8(R4O`f(SCuMt7En7U@gNWw9N z6vO?7?Rl<-z<)R77sRXmvw4ufe`RoxJ;0X=8MRga+qv$c{CzB+q_QE?U>E13NeDJI znp)re*~89Bp|j&5Ko*&V=0pmhS6#7C88Y^3Pmo{trG{jp(U;x9!Wg!SUsDH?jgU|t zt|at}Bs5P_{eYCO=?izOd3|OI%Ol5^a&ofp4b`OI!vKmW5{kMtEygDE86`DO4+Oxl zCad6_VJ3+5V#HLf1>^jCGioE*;r2tATW&@av0aaOh=E^d5Xp?*pk#KWZIZj@I^Waz z6hU&7WdiNT_cOrf*tp>`R33Ke4w;{tPlMh&&}U9ZdpY!X;AdLBK7oI}9*n|)CSJVu ztNju@l3r6IWH8!VupaT72)}Zu;Tiq7fw6It-Iadac2jwIdP9A^QcFE&&LF+_$P(y2 z4s^@|Iv%MQu}kfaLz4_-x4FC^X%C0ZlYUqM`NJQh{uUtyd7dHxo(LfM%H@}E*yH!G zzw97gYI_*}msAzu*w5ZiKBp?Sr&q>2M_lrm#cSZZ6&HW|PDc zg~@nIg8g%~Yx+};pf9upl+$t4O%IgHsd4PO>pgEK#t1FGO#sD^8d_$VmDst4$A^cU z0d)J+g4%238>!we_?Brq0qQI-=IJ}V7!LO}0*u+Zo{;Vya-^*u0fCM4TU6GU&%2_o z0-zk`1MM_w$n8lduc~iCkMho$|8s57NTArQD6#aR7IaM-3t0!G+%AN}1R!ez;_;-& zHyBg+!>4tb19YQc)}|KBu^OW)|NE@h&pq@+ya~p<5*SzuYWby{5uWhzCE|0avEq&~ zBbOY#(PZ)qxK$IIMh^=S?;`jmM7u^Hp+gx}8aODt);92*j?iE1F%oR_b zr_^}fUrhD)zdIUA2$3wiL_CI$T*@Y+%eDie{;~jiNpO@ZWn_}yp}#D8)Cj*FCvN}2 zr15(WxXuQD@bUU`?fPGMj5ebQcWl3wBW#CH((2@(?ko;%>VQV@lNR*JSrhtv?=`em z!zyl}&ya)iC|jpZBRMIlq})haKV9rAT?p7bN#pQZpLP$Yl`&md$MteEs0zg(*A$BD zD(oF$zE*jj#<|*%DPW&I5Gi~m!Y!m9el;Y#@*dzrpCD4GoE9pP;9^KT$e&I^G^#G) zm@t7=j%xTtJ!n%|+b%X^6D~9b*)Dn{m1i_+{Nv}x z|HPlKC4I`7PJb~rjdzgwdLMQX(tTWs<)<<_3E1$#1o#OX@4rn)bM;ry^Gxc$~_wTe*fnSl;@$9|AhTPn=Ox=@_wTEL8r-#N0};Sg^v< zvt7TC0NpZ#K7CsuO<;1#?B}1~HMmFH;|?ozH5hbHX@60Da8cdXr_ESukfD>4F7k1) z2fs;Q@HTK*bsBH=%m%4f#NqnCIhr5+2N36X2eNId#a1rIK1zd=^&(((vJA);Z*_`y)$XE*gx@-j(fq9OO!%C`D`GC5 z9u28eweXp|ck(2GGwUW<*7>unK**=_eE`TKi|TUIzP9k!$A5)Irx0-3>p_6l zF?Hk6%4TMqsjzE|d2qq<18I#wtpC4Kah%=lvW@aV>X5Sw4BJ4>=hV(0wVaG_^O!3L z?Sq$Kr+)Ti*pJ?gM(WU)@@ma%2mc!eDS*J7ZMCfqL{1#U4JYt>K<}FNT`JhEN%W4@ z?%BBfpN$$JYvoz{-O^2HRN=+VX0J15(}gIN)y?ocPJA*}q!;|~GSuH)T%kww&5>1= zgK?&RQnOIH$?MvqmyOXWzfR2*sJzVyM+Ak0(88+1YFC_G>XAcQ%5Iu;eCgH+5dg*= zTtY4QFF79Ki7H39BX)@?1AL{THi3dm3z->1YZ;@NhCY1_CRuE~ySsal{6r%yy~#G8 z78`!A*=48uci-yHX-EuM<_bX6B|X*HiN<}xjMeI$w^K{`)ZBn9#LNXcacNKcU$R=a z3-x*Ux(5xdE=&eJ!M{Lz0Zb-utA;OOTNpGDW)cttJZ!r)!H7}3=mXu~D$G89+rcSS zui9TkczF;fHoSM3Wy7gF`XU^AaccHi{4~2S!!^7sm8Dj?NU(@s>6mRYOnP}Pot_%H z%Oz+hv1U*}<&#T02(er@V(b!)YTue__7yAO4RQ}tu=+*+;(H=sD;?(%fV8nk-)%w% zb13Xg*uf!4q|7NIB2szb;uS}vcNQreld6rWv@Ibs9Y#&lpUP`{GjXVwfhREYQLiVU zuD0MYGScZ2vYZ_oxoSpT(%jZX8XYQi&(MD3J}>TfOJIEa7Ep(Hn^cbp_`()&txG7A z@@v%Q>8bZOWHDX!;6u+P+e&toQIeT!=C&T!+4}#-0%*UtsxjD^HF%yzkP1?FLNw)7 zG%D;zg^ECyYB6ebIyJ0x$kq%$NKp`TM3&%6ZMUE zx0(G22>_7R@)OfylKxv{uTloO2r|VpJ$2GjZAkABSkh#fu#WOw+TOAR$MspDD+_My zvPAW+eENPbbgTBs&1d%IJR3zXLB{X+-;!?h(+(?hHoqj?m!0&x)?bh@-)q!T&#n2e zi*{cauK*WQhPdqhfVm~c@;o(TnV3;;DZ^9t@dY}Iye!^ zm$w|x4SiS)b+L!B%o8nEeD7=kr03IKzccs7aSPu!@~Bxcyu2^@RX$5erpNG_8Pc<1 z{B$4vaDPTCTQ=jq&jh)@#RrP0W>r}ywy}~FtzyV$h9>nB{g08hWTLQfb-ez@RHjuF zpfeesjx&T=Hk8A3m;3a8kJh4+cM}eaIEA6cdj~r=*}Y}$RqJ2`*wHu=g0YD@^?uXIgd}SLZygx`zj+s3pr6T7)%K6(kK%U0 z_udkn-u@G%bMKy&ao`kyn~Q30ELNc>H?x_zkA()S7rB}If}tATtVH&@dbkKEfg_3d{%2V+&-=+T`d$DdZH9AQf)G5H8CNU3C{kA6ASudxmhGzKzYQd9w>JAP5aCJ4t}1fj5m<ub((_SqhTI>D%q@JJR&g8TS?Hq3;uOqSBMXYs;qyllqf+{z&;ot50g4Lp+g zX6?^;ARbk}o~9ros@~Ppl|FjfQ1R_aCR-{uB0V;ZrPw*H+LC)Va50M8hg-%KeWCR; z*-|FNg5CwJwg2p(FOnjCi^ZxH-7I4A#5Fue-iz8@se&z5o1l+(SCA52NBMxxoj1aP zB}ZnjW=+Lp-kampJnq{2k<9q(7h5Q`UmaO=&lr}c1_Yx18K?pj5Srz{7rbytj6~ot zj1X%*J7N4-%)iEaS+LYn&DSyX1l(NB08tP^prH4Tm^tVkcn-_M#Ca=5+DuE~H3i3V(~oYN((zxvAiB;}?Nvg-NL!`LO)t~=lr-u6OAHxZ zuJ8*LbI`Lo(hj=p9!p2;70Y|8Nr^?5xfD8iKxpFkS;SnBl3Ge}L+i*GF9i zJUdu-cLXKI+yM5=&SCt<9z5$=%{%dgTwbn=L3L4yTHq@j z{d?f*bYaQ2(^VRd&Yg5hlWm7<~6-^i6oJiRd{(@q(3 zBXUmGX!0}wH^{VZFiCXPOv*ZJ=mF)MjyudDw}mo}%mbN?p3I+LnvY}SU;W+erIWkPSU}!w2Ddlj zj9q#%+R{5%HP@s*|JiW7#c4x&G>abIJ3PqM;>ohi=k~**}=OaT6;i)cjAm@dx-pr{B-CDiZ3*x8RsM zXD3GNZ5YNOv%E+XSyiwQ?V)pLxso@uY10Kn5?^rGXUJ6GQD9#_jCaY;p_;X;W?W`X zO_XNlm>g+%F3XnbkVB5dQuWAddplp7d@mrIF7;Zvim z>k;$9w(=%IUfSc_Ng?oMP>nc${|O#DNVT2<(t;ThSAEji*4Eb4bktwS0}RFCp8CCT z$OHv@gEC5!@iB+S}Wqkr5a|F)k zx29$+V5`kJ^;)q+uONZvw+3gbUWS`V{SLJo2?7<|$+?x&*24P2^-r75F>KrM{+q&i z)4uKQeMK(&z{AKe_GDC%#|!+>B6-=g?4CXp1NxeN&AzNLQ&^XdA{payc6$7=}bEiNThe(=cgqN_XD!$iFlpXdC zjk@`hUAsjdFxQo&F{-dzE?RoFHaMtO&?3!vnnvix>xX5APyDHvwd{qQIPeLK z8mk!pN3Fu_Qj4F_@+1n{G@*~_sIU|Bg#|P<`7=fuYhP2%dhl^3d5ER{sp?$O{dBWd zyD7HyLhBvcWk9^b7kbA$xOOs?8E~QRg`}I>8IzHCsKntjOHaDYq0Y7d`dIwn@f1&K z_SjM5$mcRP0xBeeVc%4bj*sym39y>lbj5o&_rxsq0g053y1G#3$Z%0~@=GHEpr}zq{|mgmsY^@@)_T9uNP9|2cH;ZSkGc!fQ%H3@(GeI{vHWpzN9qBcjs! zl`XP<1^9Wr5hz3i8^Y0dZ}iw%36FR?bLu+m$Qw3>Y?$+JPJ(Vw0uwwp$;WaYCTu>odHcz(cNMf`@e{jBf zqvBlmfsB|}FTF+v73W44zxLuaNAX1H!Ha^VF;C3xdgA`^a<5>al5BNW_UcW|zqCf+ zOe$mbZeb&pCEgdksx0Y0c}2X1R~LnfrIRhFTO$ru0!?mXVRfxkFQo$WLXu7D5h`?WRhI03;nk zV1G2sd#oO^g9p8lFibC60;vv3nqv0#?-$2A>Y046oXC&;WOKeFDVfwek*|!Q_-c4P z!+Jz28LvW00vg2zObGdc9p~25P}OQ2xivjj7|{O9LTDYEoBSPo-$K$@%HivO&Ql=| zl;S7<^fyk|`LFIPbS|~j#e==%i4c{Jk5_@6bPq(41w<3>GQ*nT@#v-VPZ}~uJA0;~ z-t$M6uidLqW-&R>zH?YseVtdy)Xu-|h=x8xMP|_{ew{Rb*zeEtg}<)_AhU6*+M)VV zpK_$>w$ftj-#>S4gH+Pz+Mcd3aay8sSu6*ckFBxIb`-z2tPYPNvjTHBlj8~NNWtl2 zax)zc3qNC?e~u-k*Y^Y)ZSyl?$oXs|nxBXO-zr?p+kar%auSX=g?t7i+dI8~bp0-r1L}Eih%!3Ue^5@L z64sXG`*jO=fq%F1?U4dX;-Kx=a>T$+!x%E&7s;zf`jY|4z0h-CuQDy+J6XU@4wm6E zT4uSPjY;s>Yo4AtSP&ke`zRdI)6v#Op6Rcp)zAN+01Wsb(*+9$+cv)&}0|Ie_=fgE-%aJTqUOEcsGsRH%~ zCHDN9GX%BAFPtH~jz5|D=+td|liD_xH(ai&`ifl|4DHzHj9sXlY}Q~x=`XsebeYS# zO-#$Gdp0|nq5PUO_Pp&-NCYJ2PLhu#QY8rUwoTsUd0Q$mrIxV1RV|yq(Y6g5*HQZBMabII&fTTi}iSKnGjb z&o`={^Oh<*%=`A^;nZzi562>`AbSFWB>vtpny5e*C(Z|zSc@ETcTmQcFl}vNe6P$e zLaF4$EPlw8x&`WM&o1-v@iDKW<-S`{i-YOAyG?IpVzj}H*Rx`O_HmU%tf_dTi9)`b zeAj|GINablc0Y=Ndvk{1M9#{xLfSg~{q{eYBRo7TzwzQ3(1+&hp-O<0Nf7q3G`6nU z3X0dfM1AlSKVaaD-5>Ynt283C7?bRm94`DUHEu*kjx~3;YZuYw(%CEk7Ga%ds-6&yX~1RtH4+V%E;vHLgjqiYicJ zI25XPu?dQ%tNvZlA#azdvR<`hhx#C<7Ir7L_4M>q>)^oiGrvV`Y_2GGv?TQ^pP@?% zVU`=at-q6(H(MVnCjzC%gJsz23--E6WFGjkHfTlw-qOKJN!(v&ik=Po8;0}A0Dn)l zBRcFIXtC=}2pgNgR=dLiZgRaH|KlaT2$sWNkr%Lny3OF58*zSG?9(pxavO6FwpQ|f z;2cKh>YDbvAJwfDRf8$hO;t+7Ql}rJDM@|YhvIF8adI<#nDuMV zij0hY)$3@8TlF+JO=ZFbwv>}uah88vg+C?m{_|3Lv{+924$tP$znKI+8;ZmY<0nBq z>XCNC5cXpb0*_30L8dcq3On+3lCgV4Lq*%d9WM`^{rpZ#G?GWGHb`e^Rt*gBw+T;M zv{JZ4i)jZoPJS;UjUSRvWeA|4DFdK`AITjc@_|PBx4k^+pk<466SnBeYjmlFaBYXN z_a346)1#UyjAM=QEOi%`ID1lQg%|HH0fMsR@$=UUI9~N)iV%gU#A@PA<-(*GYfGNU zTpd&fDOUf=8?PU)<$<4Tr=WXFEvH&2Zp4Zn;@?{Q@z`zP(FZ^h=In2{(7YGtdN2{H&Kl$Fp2k3Ar@F{vZ)oY6p& z9FN;^L%ZBC(^EwdGF4XFGiIG1hkSob8zh(#a?k6$oZDOPO=jv&?7Kxuk&$mEaSIuEl(OlY4%=0qxVL! zE~4)>TKa^aEC|1?cxp@fa_L_=4bUMb}gV=5YZdSX%N#J+Sihz zp@D3%&_0wpwlwp{6Qf(RnyEdo^XlDf2dACX@(bCLb|3YlM@q@?5eZ7=GM;|SU4G#N z5}pUsVKF*N;=;DONtE_hp*VS4%ks?uBrE^{QJ_Q-Vc!F9;+cU)o%bewB_GuF#o$!5 z=JFLPl1&L_Rk|Si;-O`8{RtaCJs?Roj(oU|=!EQfu06OSUc2hX;!jFJ<)i1ZbmoI0 zLf(v|{C1Qi1oAM-oNm}tc$Y?vw-c(-{Kp%C8CSH%j^QLEcB&yw8IuwU{~X}$(Ko~E z8apB=+AmQNXqyCI;UK26ryT!FQP0VeZ2+$8i~_Yohkbnwd)m{oV;6v1n*$nKPe2yd z%zkOIB$3u(#gz@~wThvi=^azfLFW>$7plG#dP*wI#!6v~l?xD&O`sCiX-z^Dy;p6s zboRhghVTN7#4ymi_3aSo!Q$ggRz>Dc^3mAP#v-zbTJxCOwJ~Aco3ymQ+-+HHMI`i% zBF(v}zui*jV;srkWaSTG9{DPSR@uY6ELPENJNflzFmtQNHy;v23!1tKbf#QtjP;xh z#T~y=#$q@%|u7? zLV*8$t?Hcin@bPje)I2Il53_L6*41PyO`h_9u$(n;x77w6mc@m9+~no=(Aeck6x(G zfK8ib;T(Z+)lI(@v)BLfG0())5`&d;uE&Vu#0 zvl8Cpn*hC(`upEcfn8Usy1_H15ra(2RE`a6(PPsPk*wWAxAs}>uNdMFowyC90rN6`WeiYe=pG2>FY zSDbv~NO74rh8Q8oGA+3io(jYBNs*E~o~Y&BqtAa9BjOp6dLPLz;}z01GticSKtm=e z4<4$Q5FH## z($?h%&^6a^+Y7LLhd6?*A(1;2C(4S|WS#apdV%_S$@KNr?p{!{Ys!yGRz$qL{)Op_ zH?mjx@$k}=XERG_U8>^`B&G>(E}~|V8Fplt`!Q6}@hLLlwqIg1R?Nd6bO$w1osv@>&0XvhGNmYDzH+)?|7Nbh!IYp`5(zm}+ zP@{Sq`8oVLX4a4uvqhhA4RzX%(zK`ydcdi_!G;L?JqC&Hkp^SWpMvfY+CLr^1ctT? z2Sp_l@qttxv2;>Y9iMm;RzJWF9M!#z*Wm2By+?iT-ty$i z?N;M-#a#`n>a0Q6`nPcDSuR^EyV-k;qEC8_{YRlYrfjYCbw4a~n@XENzC2D`sb@Sf zJ=fXZlY+UQ^h@U%$-MD=|0a4 za$j9x-E$-UyS{Q4m6&+G+Eo%?N1I{Nxa=W^HjmmaW6>iJdSU!r_pO)4rSQ>syuCB@ zXsY}}p01FOrEuj&d4~N4|Ezsh29Z#_=_zvr*7UY8{c=46)yVoPm7!|%h(OM;N zXD0Up|BfOUMqB7j!?5N5DPY)TOmUZEGc{Vl0LrQoA1t!&9fHRrytPU!i%rMFj? zoK~pTmly2XhEC%TWZ}Q&6N(~>_Xq_3X!kTkGP3l`62kQRgSN}$hI^%hX+k+e57lmr zl7CNNEY2PlHFO~nytZ!vy7{UfkDjM7l~V3&h&EGYf@uW%QjdhcZ2@WF%M0@obQ8|( zggiN9Ak=t@0b5H-VmfTHO7(AK-^tWJnq5BP#i|B<--xVv0F}bj88D|RwW_5#7?l$z zMpk4C?39h2eh(2MLL13U)_Fss41TCc>RXTL)|Frwv+L6f!)ziD$xT|AzzQlR<2D_d zYn?kgJK=9F%i<(`UUF)iM6tp-Jkj9WBIVK-rh(~R3&H= zSNJ}uHEcAGO{%Yk>Y#HQ{FhZZnQknND0%RA8nNTwn~;+3xS_i107V2+|IJssj)wwl z$PSDW$ejl@kB`*lgt165=*o8#w7Qrb@16%|fI|>|bh|0@%^*_S%LLRmx9eQz2 z?TjygZM%|&BxE>KVcAIs-^6!w0BXG$~NqC{z9pblRz0^A`Y zV&bI-B&8Re_x&`}{m>+7@9hQe@-s@`kMntVoZP&$u;43Qe0!OwiCkS@NI>Ir^|pkL zeEyT+M={&n9IXKrdl{dR;%FkQAK)AKXKseVLmv*q!#DX0Er^i<96CKGDzJc$Upatx zhe~ImxC?u23~pfIPuW9oB4iD0b1saBK$415JGzD9^$HP^B${zpF{}Ujk{*E((5h&M2?;@u}XUR)dO^MY66NMi$!60=#hvsg5O;>#FvM-@Hm=-rMiqa+M!RC#3Cd z{nl~u)68~SIX?JCJlpTT{`lX8p4vpFPZdhcBGdU3pH zlmF-YjmH7=tZ!g}zmJZZD%~WxsNw|JrPA1Eqm61NTKUzgrN+nVQ#fgrJk%W{#Wd0( z{K)-^Rl=T&V)VDKOG^9mdathoo(WK5M?ODE3c%Tm1V6Uex6?)tyN8FxCBmxpoG`~1 zQ=@iBuus6puNClN5VVx3t51pA(Z%0@7Y~R>88E2CN(_fe?nVfSTN>$!B?y)ss&=-h z(~^U87qS?K!vY)bk=WNW*UqOStZ zR?JhjXDSsz(u#%JcEWnwu*$Q8rR>tch_l(RC3r<%<*XK-TeKaiePS0MQ8dl=c zZ7h-wgDXiL$QQoOVlv8~^|?_Pp8G4ci%I=o+`*T>=2O{_0QjLuf5Rjg(IF>qL54yg zI^Njj_SY_HE@T(GW?#36*HHVg>AA`{jR7^k!5|CRbHX!;uBXFO={yQNEz|3=v z{NVdV3o>YLFw=2JgQuGsf;mcv9uMQiv|@^y@5y2XX`wbc+eq;-^0WPq2z)!J)Y?r1 z3y1`mw+8}wMqC5f^I9*ta@jZx0M&c88KKGmQ7u1^4Lp86J^$x zJrtH(P4(V;5EuN>sfS;0JDfd_Q`GWR&(AU=bcx<-S6kcJ3GUr(377jJ1YtTLU`}bF~s|PlQY|XyA9HuPr zKm?Ocr63J$i`!kcuBWj^=-Cn@sP`GgfKm3uM}xcv^^z3jAp9i;w#U>iz~9%{PTneJ zw=mY^C&6GSk_aMtgpbEP3)4XVRg=$98-m5^R>&%OK{Sl;_T#C(NE=QE@~_F3wMXG6 zWGf@jGd`k2?rLN>jl|NgS+4o-WpS2qjIFO+Jt7drBiG6uOuY1Vd=y;RjuXN@>&zeU zz2k$;n7c=eI3@8Wx169;Qqm%FDjY~I;(-IKdL#S>7LuLZ;+a5e|6$7#i{r%bB|KJ;BhTPpS+ z<)VMMpf_68x6+#Tdk<<3mcLS+{-m*o5+}U2VRldS_RVIk>DJ3hwCex?Vs^s7mYcl9 z8rvU>KhGrohzGuQ2lU#&Vi`zlm}EDyZ~Ip@hnZNpiwA_tN&BpV8?{VWVGV^_c2?~* z_m98I7Ysl|L-wqX_JsCxCSLl0vOSlJPlFLOvy|zAA&MUi^I1MhxW_)|tAV=0FI9uw%bnJP?i)a@ zhgVNhpnNq*9~1S%Pf=O8LWcE*jECiN*Oflf1IvMpoLM;!T&)76Rdr?Df3sIu8kt3Q zzF_}Et-LmPld07?Sm;Hk!7y3O><#0Q9+*%e1}d zkE22O2rzr2W!7bsg@(-PL2-2;8z^?y?VJn1OKN`nWY4X6cGVO$crtpW->Gv|N}XsV zZXZ-N0r8t3>bmW>G~+-?v0ohhl_uU!IwLSg!amA#vuRbK@8IRBjKjIqJr)I(%Re=> zq^~05u)W>4>6;9RJ_OLPDM)=+U}kmo*0|5fzuAAnO=XNRKV+F}q8mXlX`TA92W=2? zd**MY!|r`bXqJOA+C#e>fd=e<-`s#2+)b?Wk&O}Euk909ruG@w)>3BNqSEmk?E-H9 zGc^>rp!|b-{0Pg*VQ+dT{B9rUjNR4}WBF^wv+-k{Ym!=d;5M7t%y=h-dKV~{pgc0ydt@^{st^x@wwOYjvpht^xY^;(dn!SdvhpPM|MB;~jN+CdlX?ax1r8aw zVb}Ip;HRjuLJaW?55D7qz|EkY4{e5hBu=A@*0J{(Hu3wMWHG@(h%z=X_1mHb@c8Q!EM0 z)s9A9K`P1JR#nE~Rt8gmH||wucef4eD@Ct`7R_XewIE-iL*?B8K^E&t;nO#|*T#AK z+qJ$trvveOJw3G#)2@?sO{=5eZI=E9{=Yqo!v&A}UIe;L*1tUHT5e`x<_fF1Z$#}r z8LLg&C#4qjsj0|nF+`-0EGq(B;R+u)Rx>T52i`O-N=~7NNJ@v37NX(ZC(O1iJc;*6 z7Qs_%IqKDCyRE489uepYUG)En4)+n{b6$5*ldc5V+(gn1KR(p+@+DiBF;^hN!hpw% zhgCdIZ{HBHpp}6mTo<*_Nx|xllR}?{*S%EVin9O_k`oVxWEMsSg=eF;QK$SQUfy^1 z9ex*C7L~ExGySkbK20}%enyQTz4|hcKwR?NVdVdWY1hF5aECuIs+leBc;&+S&7mUL z`%D6q(zRKJ3XJFP{8XLZ)1onX8MvvGDiOsDzQ_v7NHW@A4$N<_d7`wTx<71gR~tNB z^4myDI%3|caxWQfo0&oxKsVy8WZ~FzG>Z0XC&0W4|Np%H$249|nmU5KlE;LF3+LFb zZI^{H*VY)7h*NtlO*u6t8uin9m~xKKHp>ZWf%*xZd;visE8sMXeMP#S!b$#P>|*14 z`LOI{6ETloFmbAOs>;ZFVyKx2j9M@Ccr+$_E7{7mW#MQW{lCV5HwnBwIHjzXA+ScV zAU@P-Pr;+_%&)rKO1!t17yrJnv8_!cFpv*Q4z+g^q=g{pYsu*^3Gg2cHC@$e I6eOQ%aWck$Kl z!CaVJEla&>dm6cUNc2ZH% zLG}vpg6imi`S|!iIv^bt9ppP0RxfqBHw{PD#*7t^niRopcfiK}Lm&YV zaDc2Bl1Cjd1fp{DR*a7x`5XcUgMk$E0RhkeuULqe7g$A>o`N2%1AzuW=>ZfFkdBV5 zSW#9bNCgxNO@$yokdoYpD(eN-X{?0N1L%Q3F|PoqiVg^g8W^NfS=0#D0S7>kEZ(37 zM9Ssmh3tf!Isgil!!VU2T;0BAp~9}3Z_tb_$XQ?s(NMA4nnkvetW4nLT1+w@7}i9nQ36534RD_>-|n*PQ8kT!Rxo@ofe_iG{Rgh%b&2SA0V4GlvbQi z>#VO*>nu~}yuP(nIKFA-rt9Au@4}*Mpjl$T#S;L8wQ2$E^=Iv>XYK4a_@jtm?y9W- z5EMuNyZH!2Jgf3}4>5**Wg~zAKupll52hSIH+HX8wx-QnLR5cLOJ~*I#&$ulE1i#w}d_zYyM_bOZT+VL>(pCMPGg zOUB!NgYcUNE;nME8&>|Ib)#|cI2e;dYOwEL)d2=b+y3;w z!K_f<;tw>f0C?8e?lJRYsD-}8mP5-83x7}r*ki-5o`>FrCz&AS{kIj(t;bzByav}H z`T56q0r0e4_cN?j+r|;2n+g6w>;}{Kj1bS=sdno*)Qx$nF*^&u4aWb-H8T;CdgP;! zv~)S8@(b(}NpwT|HwfHN$LeX@>gg1ydjn$|f12V)V*AkO@v|j`-`w5kZ;B1JY3ApZNr*k03MrLfIL1^ZGyLGDn^NIV2&%KE%Onv3&O?b?YPbad$Q?YV-~GsY!I><{I;Xt)_7w~F!xvC zd|^jAmzT%aV#8aV$^MS&5oAL7&1aplvm^xA>{-rIotbv?;q^6(qB$!Ao$c-mXP3U! z(;ff8WsV89{;K(+Y%OYem$2X|>`=nQ12!2~l)?^0G!!B2=|4S@tp*P0W;1WasM?{p zi0?(>PM`IdL&KRAotw^KpJ}J2=a5TxO_H4JOugGKER1;JXm7bk73llbA)GjZf1W%g zJ;uTLx5|G*HRG(ls=?jmo(*s70eMGSHF-d`r1uQ{E^$JR;Zbnca}j?Sw`GRHc$jDc znnc~81IhIX0)7+%wz~QkSMXUQJ+sOMeLV%zm&IRo_Jce8P3Yki3xkOk120xQLi9=u zo3D^)R@=|NfBTXLBVhVFZ+OdZvE0?6$Bg{*_l40bz+q~K)=uM@`uy;0HKhwfepMfb z*LV1Ywm1cU;tec4(--`?zv@9{aV>%Ntp(z6zCR#hNRItm6F0wZ7AQiIjhisOkpD?h z(B+3ZOM}FlfWq39kl%A??4T$)4^XJ-JUFyC?balzh)Vger6?wrs zB7{2j3)(&lIL^3lc{P{C;IeO1tCGWx13w?=3mbHTMtAT2H5mj8`k z$ZG%E-I35&MZ1^h$M$m#d_qFZaU@k?aKsW5EvR41kyWPKD?BEpv-qR3chI-Lll)#) zJducSZp6sus6N~3bhSNFqrQA=qXn7>6eq#=B%yBbt0J~iYUnkQP8&YR{lv3|gV}X` z2=VdhPdI$g!lTW$ZsYgL0h4v@KFC6UAy~%`Tgccz;k_`t^nD#kGW%el$S{_(ltQ5Knq|zw5QJ>dNazH?31s_(MJix4Z?p+8XYtz7gZ!^S3-fmjn zr)~wr3T(nwp1bu!WoV0E))RSCFF)`q>}Yq41J61}S$TZ!ctLs>J>t9XF0&*M+7Fam zJ+%*l4}@yo4{mexZb0$r;#vq#{o=k(et-)NtJT%5OWhnF96Ee1%-qZnQ6iEST;NxykyW5+=MyGEMM~63c%8j8 z?n+bAs{TdnueBlg*>>a$r#ui>OSL)|3u%fL-PMs^z~1JLXXs=4;#(+6y>eMa~LSzx;*VmsY^G1uJ)kIvr>_kDzJ)f3fWZ^ZH4pZ`TupOydnVBsc?^i40 z<{soI1)f)5DOv5USyPL2DyIX6cT+75S(3@nJlCZZ_iSStP<3k;lh#ty*_Fp?EKudH z>!nw}C+GmFA%?=E>(WDbN15p?!hE8NCahheMQLVtKt>qQw?MWBuy5{;Y)7_VK*AhV z+sY|+6ELoXi&9gm4-M5!Zgo+%DPDBUwUjNFovD@g;|1iUnI@(<((F?_bWCHqvw#o?Rr9#um{jQoto4-Wn8^zFVfOCgdu0b z?XnB$l=wHa0RYrnjKl-nSjfNdw2cXkZbX|^LS{dW+%0w#(kx@Cz!$o`d*$Lj+Ypswrz0qKBs6ehdAZaKl5uz@EikT7z?T4G~L|&urXIgk}a_76$cCP%2I+p4Mv! zy9OSOs%^{hN?*zw1ai07nXNzGTb6sz7vN{-tWK<2AoO&lG^Nes2X(b~ZUZh0^LFp6 zZ|&qDPAgl47`-4886Vg|VyZ!7^3D$t9fAohG1upUJBm?r}BDcQQlZ`wu zZx`}OdBjRRcJ*;zT??t(CFSE=U|+KUUX6z!8ubPslSEF>UESO?so$elS68oNIjb5q zJpaS_!{4g;$4(H=7{^bUeF8tr<|uI?GfX3lzxMOq394y9U9owfqkp;1AYQJWKHS74 zw?IVGHm!VB$#WMz>hbutj(_9s9RqACM69kB{J>Cqi|~0udVR59{hT$(FH65^!yniv zpIu5_+vn^oe%){0AbM>m_U%N{=mMAR{cqj*5ktv&o{5`9(G<46osz_ft69z+mr=ZDdV1#Q?#_%)e?`4MGqhag>0%gn1gR zRlK^q%Ox1Q<+NRDQGU>HHO0$%Q8TAx*T*tkVnN9G#)!k2lWQV8Ba)TzWw3&qoqaWHEtr^5+F>H z1r}n;N3@b4&s{F2Z#F^WUo;8S@4*rzObIx8(J;sH7%to%pYCbBV|&{C?coTz%YS^r z-*t(=V5`EIvyBzQqbVxs5&Uv^D6_GYxTxSRwBlOws8je7FPsAMu)*s%e23&N9(7T9 zbW{u*K4qxQKomV*{Me5{EN#5kgL#tN)6`>T(Vz_R`%G=hd(Q^sGZ%Z`wkIkM-;G0` zQ!bv(eS-BX2z{AgzX4Zh)ynN-0w6+C&>ISOd=XqtntGD#;N18F6JigEkVycy4Vh(4 zcVRi!2MZLuD<)}SF5dC^j$yT|57rW7W~V=U+=mLar-RY{Ra-L{I@-~7on`VimNE-? zA%738CV29m*=Hs#0#--W!pXBCU>GA`uQvJ&S6PSj=QL#&jX2%*BEf3IXI3Vjd*Ax{ zI6G`t>%#!%iXwbbOcorb??rOid9XO+n+mB;f^BOX(>?8(at3jsZf+V5%Hzzd8 zf5Y$n2&#lMcspPfpQ-Xue6vsiuI3surtgRjPB8X6tm7}8e0mk?onMt!s>r9^@{&pvjeHbneh&aUo#(`WJTnz+w&^F$Z{Y%k8^3|txkfz z2wkqz)2WG}w?1(VQs@a^4nLP*aXSU9GAg9t=;$uhMKP#{9qtKlEWqz3kiDzbG{u&3 zlYdNf+l#&i_?;hZuMg*_T^X^Jz8{}MUGYVyfwQhO zyZpp3HvY6BWr)a1d%20rzOphYPiQw;;o8R_K z(F$rK4dYMc;wfICbtOT+z2X;*dUJ@{9z~wI1gud}?^LI>=5x)=daT>wk;NuQ_t@?A zuqizpq4wOPf<;N4D(J$>7+@wdikYcp6sBB-gR%V<)4iD=rIx>j9)ZWO$g{&10E*K0 zRD`>H1Uu}ZOfZV>W?dDw{Ua0{kZ)W2`Qz`wz%&3?ph9?96jA12f0cQ(m7+0Jj>C9e z(C48E8u51)2Bk9k>LcY2Iq7xpE3JgrWLY8Al``)os-jc&`ZOg{!~ZU~e}ameO^L{e zX<8PCR`W5ZiGRzsWX#F-w617%ARW0>b(PBdQQ!_VdSUL@5^N=bmes< zxowHM&T{EAgC(l7Y}j8eFhA~0p+b*OSSHQ5AJ!QIFYxxsJ!n-or=DsoP2F3O-2t#C9t1DNn|8VBEuPu`D3=rvh+!M0%~r1IYa6v>-*upU9hA!*U)({O zc@aIFC#5nlQ5;GdZKqIM)3cVpJRv%CSD3L!wb+Cs_QIO+y^3r*Z;K7ugD%hb> z9?AJnm8LIJch)~R)eMkx6Zl&2-uZVZf>hK13TRKm!$nM~%D?(Gh=R3hw;~!}`EbLd zQO~ygJr)CObim-FC$VT2K}h$7w}nMe)X%u*!Nq#a(T_`O0ce5cQc_ZTs8(*D3f?)s z5e&P(*9ctKR<_~_4NpBoCiRVtjZav(sJLc6dU!f>H~Znn-$_(Q|elnjWUaA@t%Kd=JI^k^wqeYVtM9? zCt^{8*Z1sT9hqvgr}4a-_->}E*VVJ0L8zu8YC4rDq<8_iE!gaIp=dN*M&~DU#lpPmaNWGJ9*7fZ|^s1I? zYW6PE=eco0z}=ASiGvxQ!dC+6X#cg;KQ1o)4$S4_hKr$Y`3En|sh+DIvs_g91=p;u zVor>pS7$J1x(X($&v+U{Gpe>mya$~r4LC%_)KHn0ux;(`myEjB+ac`xtWSvSyB+W( zGy_pC5o)!I9fshcA{>}=OijKyLf$nd_}ZRIm97COFsb;}2kbSW>|p1SwPluMg4&I% z=hnSwHWkgN`5fiH#)x=l#MC%#73BLYo@BZRJ?LC@qhFGzea5T2C)RA5(dBb3t3dgv zE;T9T#1YH6sDSeMxpwSfgk-AJ3bxc;h9~Zxp4||m{#WgLv58Np?cyFPzt?M(ua3?z z9^$6_)IK~&m&6+UFlQ9oNDY|7~D!<6%k;_-bq50w_j|F|oV5i%WM zHLPS%-@KQ9JuByYvJJx20aKk@DTX{S4fk2?CxunEb4&3>8R7x;MN=uLh72XL8t+&V zFk5s$sh1b>SYt@U1BdK<>cuz-$H%4~$G)cur+&d6Toq zxp@)S{o}6n-sao%p92OajYHATA%eZFK#d)V)=Dm3g zi4}ZJlaDu#D=X>zzX7=*D)ic97sH@HCz{vBj^u8_$6t{F_o&eoK0KqgbdR=p&C?|R zUF?AGMZd{Ie^DO0kw6v_@`qTW4wQAcEq=}$>9XT_s_L_=GbsYQ`WC*G4}I#+oi*LY zHF;)z6f>?fF|Wa<9qh{&p91Xc?5gfsNlF{;Mazj$`l_L!3lS4vR8#T$Ytu$|FkcF0 zn~q^?KF(-(NsX?5@feR>vPfn{9cZw)m{oRerCsp;v>QKSb+_5=?TID8@8p*;Z*y{+ z>~kil&b6gV!jB4Kuu4>vStH7=e24Z9e6VsqZq+lJm!9OBYUJ2oy?SOaS<>I~_>O^r zfn8${hy>Tm!J)LVv8eV?I%cgpJit_@FHQDxxhDa6dW7D!@&CB9tTTgkPojT$FOCfBf@=lHGP*+(MKefdA5xq$&5|f1L$fgcx+i#&A7)rz!IL zzKb4nl|`EtZr*N5Si{42ij|Q76<+c-Z5@|-9hoa-H%pU+Dz2U&l$VPf8r zFkdbz1bsC)1l-4)bw`8e^24DH(ij`C@<#W`4DKaudb#)B}+}w?vF#R zRyHIm&s}#wGs6FnA2uy>O8Z4Bx~4_Hs_=?{KG-sdq8fa8mNy@Wte;a?j^1*HuAOnD0gJeqsO;{44ftlaqs4`9emm)GozPsXB-ItEIQt+* z>YLb^H&aR%{;6qY`%VTQU8{S`1e3Ee4y&aHv~pyZOj2MV^#zwsKy5{K$lKNjAX1{c z?3qAbFSXMlvT;5(S#HkQEn+k3<5ilq;eZ?;Itk{ol-vttq=VtwQ!j_y_<`p?lMf){ucZ;7eBN!G#@i5s^RU+a9I%tpk0K@`32^9J$o>x)2f z^2m?)qj3Ze^3?r*Sq6`RWaWK}B6r49s4N(2^V-{AyMsXflzcCvF07PciPhm|uM$*p z7?D@$NnPLTzW4S%XY4%jwpLciXz8r)9G^MUeaTv4E`t^JRkSN3=@TXLI)L%CYr}~k z&f@vcJRnJ}`q&Tm);Hvy^}Q*@jnUNoy-H6sQU1FO;4VJ_C_e7+a%mi6W}=-HJcy&ISn3Ap+s zx3=nkmXtdNfOu9x3#?`6fiI6&Q?< zqzgm7Yzk|RHN!&o)8?6Fp!pP^fpF`WJD*30-gC&j;}NYJj^tP9ETxOv%JYFbW~ID6 zeGMA^!lCHo|HSj?olD^9q{Wmdxb7tVxF2Tz7#4p{!QReg)1n&`#256nn7 z!G$1S;ADR}0KLrfCF7PZTx;ik>Ablg><10RK56>QR9xNqKScC`5{Kyl>eg36Pe!LNya^a^i#uhegk4_M*6_X66NnXFjXBNO^6k(22HB^?X&Ytw*EdQG4L@z z>`Oqo2}dA?MMvE{#s;%GH)5=Eqj^#${OBdklbtsnCO+8bBQ+LYjX_l7#d-8uIHKbm zObcGeJ5OIf1Nq|Yj}_@&*x|ONRzcb+U{cnljBI7GLJ)X(lIXL|fU`P=ct9*h{x|cT0+jp7!pEiJ1L-b@!wf1*RpE zrmhrssj3I9N|z_TIMK6#)vVh=H?6jWJ)oy$zc}^#(S*H@3cu+vPfy40YeOhnz2@FG zu3VH&Mm^4HpZfM;Va>Qm*7wZn7sWuseyO=|X_P4s4biO#0V&M&8o=-YEar`44c2gC z4CIcUxE*a=Xhy~^A^V91iHi#RsxO62$m5v1GM9^>4X>TKMmc|dI|F3>L4jSw11_?3 zDjtmZbknB;NArxv(aR`LWT_cEeB}CvajlpP5%cToXMo0vE%o`2qo2ExSAJvBbb+?S z-Z8C$MdrA!el5?z3(AMCD%@+OW2qGH6Q;h&Z+!f*zsj6x@Tp;x>*KA=A3QcG31GbaA6?_Tu0akT9#Z2wg=y_^gO6=N$B?(KzLa64O{X{gmrY1hv zOIo5OTL|$~xp9G)f7zz@ML*0u6O}|Qjb9zez=Z|i8_S!nf7zQ!G^?A^Bm3!9fCJ-2 zWR#{SpIK1L#Gu>HH)Rp=jY?G##17{ZmUVG_7&+!=NU!$q+glAXkMWB=2d2&?ejkHv0MXH{ zwo6zHRs&e;FVm5n%P`mY>QqtiiPAfUpyqV=k>WbQEn@5Y9eFT z+hw8F8;|?K=funf)8hqRAg|cc0Tygzislv;E*8HupXhq&@2wdxJxTZ(rtT)PdYTjf zUncYEF{V%Zv~5E6IhJw?a0{S6#ub4EQdV^frT=zdU84PZM!dGu*-x5{p8miWkS?s?;L);rx@FBd zc+aZ?^T{)+hfkh9>VjEjya{l7Zb%XJ1X(<>3Fp^m8P{|>cQ<-@{n*@l%GRx3zqzU) zzn*kdcbi(7IZLcPzqyfcEh9@X^JV^2T7FM=bYY05cWz_tPM7SDHn89c+I*tMQuO5-bN5|P{Mmif`jUpWsiyOA;B%sJmu4Le@CGv8FYiUbX1du)T` zIOE?uFZJcqX*3KiL`RWwGsmta$F057S4uOGbzl zfcC!9C~@LFx-s)Bb++(1)>nrI4aepD3>Nj?X^M02rlrbGs^y#9X&2}wOTH)IRg08D ztVb>tA56@Y^UPOel6IIGe&Q3tUjCt@hhrZKyiA=del&&f3U%v2uez5gu5_H^X7#8j zKeFQSmNT-rN4V>g^-&f-Ii=+&&3MLEQ=f5q)u}p9b5?h$?0J-cor~E#4pE-(m(WUr zfA2oX0HEO+jHOyog39fUZGerc<)$T`$EZf$q;$1{yll=?--{LAIvf1Z{Uw9NcTWED z8%_BkQ=j+h?I?*4Qha5|2eTG6aCQ^}79aM%WG^a4T%7JB-91k6g@@YmeDX(Ths`^Q z65^vQhwRitPiZxeq|b<#J7eTF)FrAI>mwg1P=bK#7*ot7Kq03%?gV!%e}j7~((|K(Ic3!0Ny(mnFNm_`u3z#1DVp?GO;_>l zUntLK<}{0+XC4%bas`Wg;;ynG_@2I2O7pe;+rAkCt3ks@Wxaz-Lhgul+z>Zy%k-Fv zMCw*EU2KwaM_aS{`tsz5dkYQ{^{t5lZZep8!-L8(zIHE2lhe80p6wY_Dv9L7rl@jz z9_I-bw|3dhDMirWVfp<{=KdQ}F&f!0W`2#mLeVCiWY|Bd1x;(#jLKU=!VcS6Dhc-aAG zxQ;;eK{xr_yJO|{iK`{d;`vA?S65eGUq#H+QuzEZ9c1!+K-BlV$g)!pd$m)b37Cgb zOxB|+lcq61U7%csF%`~Yzc=VO_&9BW_7<4-s4(Z${P7*rs+T2C!s2y3L{uyoN`@f* zoh2hPG@3=WI*_>oWm?lm)oGZUZ$n<>@1jW53_$yhH@#y;N3GyCcyq5sg2NY97wA?c z+~cfZT3EeQudRM$lf2O;K&Jz!k_A)i);{eWH1S*&TZ*gk?ye`NSef69F1u7L>ZQb( z4jb+G-sCbm#nm@kP9N$?ID1rRtDAZxK6wRt^1lfcKcHt=VL9>ru;yn$^{s<4vH;gSGPYGNbSfekYnOT8-3HpUrY7w#Nt8t1qqjEtc^LrrCAz*rewSIdP8&JbXHB znx{J_X1WUe(A&1LjH&5+}xxr~|I%c&wGxbyuBh3+&}w>*Gw zjTS0*rbfL3?uSw}qH7K|>8SQAFvLC8F=$(bqj9`j^6wq{cvi+tF212Zh4o9e_{TVB z_5VaisPIv?ssx%AXJb=o(#TUiCz4d%H-fz#2I|_&c2LoV2vG+yEjWnM?y+dMNRXNs=&Xq=0D5+x}azdlM!=H)gEW z%EEZ9k$O3Inc6S%Q>`hb&eZk-ftNnMZe?xPj+*r3fvlrVhOz2i-lp{%Lc@(Nx-vn` zAdI{FO%|UoKzI+9lAd^MJwK3;FyMP*@*RqB)xcf;g3UUlnMwtto_+L4w}6-Zjai@C zi)-h&0DCK6w6*ks9os?LBF4c|hHUXW%kMyq!o|_z1iLT;Rht^6^TyPAl3QH<6K=xs z+2Sid%xLN`Q{G?M{7KF?%Cb~jEj^EQM*Iovm9hrq)&c07Dwe^CQZ4ob!rvi2?ddOr zl89{X-v@~Su>J6171pn!}l9+x7_E%)uXGf&ki@6(Sjd|$Z{$X!HS2)g#gj2j3?z-4CHCbN7wdGz!d-W zZ{JQ_P4or_JnP%hRvwrOa53|EvC8yMxKrDuKQx}AahZ$GTdPEoLml2T0n%_2fyjbu z)pfcx+2)F7I$rUxx-Q-ej!xz}0y+sGY?d%f!aes_6y&G|GxU~{R~~ga9Tf9(5t0vC z-!1hQPqMfS?Ynm?YMg$9_^6Gp!|LAv=lGB=BHXdg#^n{^?VAqryUbg5_6I}>rt*^ zQ_>Z)F_C+0+^cMI^`!UL@!6SzH|9 zC*z17PtWmyI?SoF=jB%BV65UAd)ts8*_+uFx{RRYBYl148TVG+U55P2u$iplu)v*q zo6j?DPoJLEtTazB5mbu}dU%l=dTICEqWs77iDA6hQ7aT9SV7_&_0~3*E_UjgN>>zlz_8~tS=xUJb>zLKto$aP37v=D?V%Rq)uMfjH zKpu$#Np|C2!4P$!6+n!w{Jau%BKpu2H%nE8{c#oXK>kp^=4PD;dc|{&(&_bO%4YA= zveUP>&UWF`@4xzy+I}C)Iio^_%jE1`K0vYHdBPG-egMWx;m^e$OaS$6!4rv==X3v>+$ zY%~M$0ZH*AF*(movqD1y#!&gTqI##R-mX#2pq2c2@a|Ns7sB7@qa(a{c zX&oEM-}XgpFxMkr%X)5ule=@7b-iuulMko$0W*`;zmC= z%Q7j{6bz-G+0yQu6_g54JrjOLEyC~8Fo4G9^qcw^!!;;R+*l zRHz)jcTz}-YHiKgPUR1Uv1=p;Xo zQDbK>k&-)0rf!)S^M5hUd{_<;@z`6sx;!U+4=$mRtk$>oK3vIP9ZiqljaHO9Ck;TML=xDh9H;+yJhz)Pc^J@?IeW`6k^8Pig7)yT zXHnup3d)9naYJE9BVUS`tUh3vljclLzI(Sh*9>*3+L)@>?CG6k>`_6R0v|Gsd5oN4 zH3GNxZZ^AMfw=%6lh>y+8D6woBK$deC4~|y>RNYIO-Q{yd`wEh$;%mSG=02I#VhF* zN$B8N=WU|8r1(N(oi(Ce@ClBw{2<(F>WS?Dk@o~yt6fsXC_mjt$d&d|*-+D12WfTV zV3G1pO)RQQv9;2JfBXNY4G-Mx-9?yQr_TDuuuj=zOQP~j4G6!Efqe)gKA;XTe21a! zEf4vIal+d~SwFwVs0U%wEf9W=Sv7-b}cYgV+y!MI-PWKLHlY}CJ{uOO%;CQ<#EKj=cFJ^sUm z|Hgn3CGQ*)uw0df*LG0fxg~9-A}aZ5Z3;8$$89In<1cLW**>PZ){4DhJo^?JiUAKr zZ+2=->m!$-+HQ<$Is0Bj;sjZf`TQ$KQ|-)JNR(2{>Hi6K9Akb{)t>NG)}_y@^SYR& zpWowMf;Ax*Sr*RTl07DhPNLWeoyhv;Vc5J>6k5ZI&vG;Q$8N%p2Cv5}b*2_<`)6sC zL~8F$=G5Cii@tp>b6xIsRTl-9CV4-&gD}GA1+ZZ#m3`A&dL)4O=@7$fE5Fz)gX)XY z{Eg-uhj1R%rWD)5Ca!~J)UR?HZF@oU?O?QY$cxR-dWA14pFro`a0Ltk=0189*YnI% zZ8P8RpcxrtR-Sa~8+CZMogv#qUrQW_B{88PvX#4ot57RqBuI76l_gT$A5oQrOB3hF zpF*A9$+&naovx{@99*Gu%cB2mRKrFW2GPj}+H6~^a|x^QsWs^DhTz1#meF!F5Ui%_B``Et9|#~CbLaslH%M8Q6*Ve?h{ zAIz6eox{88uhIgJUDJ2k(2Ae(tzO<%17Rovo5)t|4uIea! zzLwzw);f^|B0m44n^wvO!$Y&*cj(v6M&7M{nqhuu2mZep4mj(s8~lJ!tb91Q%3oWv zoXi0G(bg=%@%4f*8}-%v$YRS-$%bFP!04sC-18n%;MLr?OqOT zsbRB{I0)kVqpQxN*s`wC=N(U}P=r;+ej5Mp8l?R;k=nn5dHB^Pix$E^CmtbHqIql} z@mU)Nt{W6?KX@>c&0*RijX104uAAsC5#qWtaIw_Z=AXVeWmioCN{acJRgzoAqb^hz1F|iAQxguMgwxY~RY^8}30BdcLX2 z&3*}9=+f;ie=1+b;Ht1_HKM@a?f+F`Tgc>_$B({r#b5L9Usb98;=(hIQ4tOJy3WbX zmc2y@^G?Gh8V&-Ps7i%BvOFcaG@X(n8&-RS9XVTE{|!}lhVe%jk@2HXSkmP)7>ZBI zMgMPmW+jF9G>gDEdL0VxLm~8Gh}amuRdd2M&F@&Cu{&SQ`DPM|HjT+>&{ea$v*U(d zd%ey5P|59I>{Zrh{;J;ZSJ+_ofBc#q^^}E;TLdm%*sbyq9u&0O z=If0EY8Ak2#1NcH=b9JiH16s@n7d;?KB(PuZ1w2~E+_CCocWd^G|)lk*&T&J zuKKK2d$NyOsU_yjr6tlyySBDGOC#J#^m2Fqp_-^`RfkC8u^twE!{T{ChQ zh-FjH``sL8U7eogmtaRDn?O7bX7S@HsRB*u>Cv4bh5}2sc|qGt4FW9N2hX%$k1@2? zl!RDk0$1$leC8+C@Zpi+n?uTaFRlh=W$j0*+H>5A>~NkKku=9P*gn`u0gGFNlnB<{ zgKm$EF`%G4#lQJ~0dASz?`Td~2!=on?m0ClLTH%sk1;==@r_*%CwEofmLH7!+wsW#CVL*TwG;xgo84NtJzHv8+oZTo(}mSZ zs$H3E8z>v9GfT?yLN%QVm4Uqpj!W&&H9c2_`EOSwc9@W?`C-{YBR;tArzd0_zo6d^ zWR3e-pE(HTw)x1TC%0%fRz%m=HNwFp*mW>n5!M_*EN?38F#W$50V*8V zh{SRSW45I7vIKxkaEm=O#DzP5jyS3BeF3`4%zf*f)bErP0DfMde_zMar1xvd zT(2DKVc_kEjPRYKk?c@W11-V8nGVI}!v>A?r$)l|e&Pcdh@C|Z)!4abEdg?=UvLC5 zJTReR&gT4|fi$&5rb5ypU*yCq35?^pC-`Blg1!I^N?B-Uua~pmbsFg6C6R&S+;sQp zs-pil`GJ}7!LJ=$fyF$hGf@#-gH)Tya=n!TdCvIss@jnDh+9U{zzO9t!AV^Q(!L^K z9Z_B5rpCqY02j+VZTQfxlHH~E&|jc~=v?)_%j0ds9JvPz6+33z-@~Y@$V(pg#$Q|StRb8c zbq4z3E-R6e7M47y|22>J%!j*{09-65D z(Hvp-ZIHP_{=u^*uKpt3Bbf6FEDGz_@N?4#xL>{du1lS)UisC&+8oVsajSM*G9oU~ zu*;3F?MgrHk`S%b!r*D?J7$&r(GILOQfSWN)6D$DUlM$}=wv8G02@n{5d>h|O6>j= zwFuvV0rd#8$`>${d5O*Ze^QWEN54JbbcyCGwiHx!uOK%SpQyicOhBGp#tWMbvN5?p z{@dFV1K3wjmzQ(wow%k4&#|;BDDZea3C;!#pV9Jsj85bPiJ#)7dPsU%9IB~ty?k@l zx+HoKdyMl$Rwda`y{=#sUiSh&_O_y4LNP&#c&2xlDqRSMswn!C8Ou21%siAUq9dM^ z2R7E;Jsu+%tpk72OvGYP1Vz6`AS(pj{39cdM~4MWdR^~Lgep&YDl{#s9}7f0Q3b3{ zK3Sr-btB_tkW997^*h~@FzU_HUp5XkcvDD5ez@78AvJr2&>|_QWa<1e)qoeMWj^u0 zS0wYea7*hhboKOX;RjDRX80ZGLp_2l`-6)$eloEa3T=A2QZd+iYMTfOFPMJHOq^uT z{>6sZ^OvbCAs>eA_ZC(Ps*yMW408IBCU6)jZX}c_2*|A$$6-VF{(W%(Cr+g|7 zhrqY}qh5q07q_eAbl(mpsf|c-_E{Xc3WcqJXY97qGAzy3t8cYUCWyNYjsaNmObcP0 zDGM{eFLnw~-+YlHO!1hJ-l_MiXg)|W!eSG~qkZbD|EuQNF-|Sw$+kr=LQ;1`Z|E?s zd{p45S)&xXy-h)D%GZqT~Z zsIfqw%QQ@o9_AP`Yd3B*ZC5RBG=KTZsNqQBEL*a4y+K{U{0GEx+p*R2M+HR*M^gc7 zjPo6RY8ZE}-A9U;kh98Sde(oDL(E+F%ueGG9Wg~s#HsQ;%N$GI1m!ZJ_Q35gE^%%6 zd;3rYU+}~F1n02C06goVSLb`#DDVWD*#A?ubvUx2t#R6__8L`c#i-X@+}gxmwac|i ztx_vyL~Lp7R#78pxRltV)QlMoQadQUYOfj$Z0fWp=*YA8Pj@pqa*+b8I=l-U0jhZ47s8amhmI9>1Ie<0Z7#dImzwnIf_m z3x5kwI^N~`NPRG7Fu0w17?8%V!0~a$^LEX&QEY_aCNE2GT@Fs?jd05xZZuLga7^G- zO=aoj4WuA?ai~m;*Px8`Jo<3&UZDzMM`clojr|8p>e{|S^Kqqgn>ZA{Q$vW%aBINj zEx)Fh`TSP5J<=rmxY}*vhxto9J1bd38ZC_zU9MbybWL$KBP61b=A?geud3KK{$(#? zTs!o9aT;mo{Y2wc#Pt{+CIrq4JB1Bg!R4j;|MBYu7dbEM|SKh32(- zldT3@PHS2+y9Ufp9u3^l`)ES_F`Z8$r2hU&HQANL=j6$#l|VA5{s5+?;kiSc%&ZEg z?`+IKFDZ_M8r_+1^#!n1q8DRR0RGh_;c9Z64a1t&=QFoU$bw!(caqqk(jojHo~-4q zcOy&|R=H*-E15?{a$mXU_7z?3HXdGHXIi0DcX%k>e^}sE6&H7qbNOF@82hJ~!RAy= z1~RaHF#B?KR=+qO2|J>DVP69J;GhWW6Q{J5-d&=cc2T8JCZS*De?HWl9g4H6Xm~}8 z&(T=ayG3u(JX;C#p^Vb0By2qE4gjOI{yc#m31UA8Myk?n$(3<;tV*WIF^xrJ564f;P_t=i{sSv#)*2u9fDhS2~sBNYS>wzb!l#e6BT2n!7=qs4(00 zN;ivng))B!?ku#BUBIn^=LZyz;bY-U_x+pw8nYZsu8GOW8y}}ngmNy8Vaxdj=Fp zo$jwwYOi=aUqLY}oQa!7=9*8dLQSV!sXs&3kAwP$GHOSla-nk*S??Cue6L^i`zn$h z^kuMPMrUPN=J(9l7jJYT4Gl+UZi{3q<5k6UyJ$-E!l!yCytl-&rE1T6@kqPOBTT80 ztJHW&?+#~3&TQn(HAFX>yTA7N@Wkt8kPx-Z(+P3Z#i;t7A%xbzYNms`8bG0(ijd7U z$0}e(||UW0i= zx!8xfYhxOUWjWwXiOd9b8{VyN)3Y;+opkDyoa5155zHuy`-5DpcHL;u9z(g2XzTUY zp2eCP3FJ2?3n~KSxk?aw_phgN`z{}JUfgnjSGE4oJ>VOyP+pQ%^AfA&(^I3EJ`@;e zBK!ikik$L5cz;{iv-<+?d#+G?6#D>jlT|EA9BEJMz}9i(ihO#Ncl=`$pbTP_Uos0# zT7CbBDpf8)k3xWHboafkh4q(3K&98!0#kiUUQfzACB6gFv9V83z8i057*mQ_q3v>) z75kTFVGgsln$@&O!?G<*o$$za;cSF|_Sx>S(A_A<#nQ!E$Gqr!eG0!j)ceNI${Ej2 zzBy&gRKeiNE(!v&?(C)VREDV@1F}IXGodgL777R}l*X#{tO`llU>)!9b`EDD*%<>N zzJ`;jED&Ck>;G)fadZ!#8O@}KqL7ibyRf8A7b*W1M*HM#Kp7g%#MR~Jz{EZ=) zlYn|;Jb_;}2j`rWOp4|9dHJabj%`^Bt4V|&pPU4Tgjg4W^pnk+Ogv$muHl%(KuL7! zHa&`by=ViKltgM9cgK)tf2Y@ubYgJPyL4IY zG>Z5(kBlmL`6f1x7Z=@-kzdtHRV4{NDGZK6%X%9Nv8mc2r8|=c8#kS!vly^*%pylWCR*pWUlX>_F)(8dVyHK!f;dZNUn zHQS+s2i6-$xtq3xq_Kpoezgh`9>|YVh zIu`JV{q4?e({A%i*iVdw6?rR5h!@optEMUM6CPl#J~YmjUd&v8%-K!DzUb`tK>2_p zlt1JrwjLE^)`Ov$C^LIbbNVbOV%W|z+~XJ*m~S&RWmiY4U7Ch7!GieXbTzb}p*uZ3 zhsfo+lc7ZNsRl)Zx|6Occgx^#E4a>tP8IT#ZXV?HhZ1=ozp_{!3%1SVUvgF|7cB@& zD_Vqnr1dC)61Fes{7F&zq4x_+pdc9!);66r0ycD;;+1eNynkKdfAAAgNcCC{yr43n z%0h87ZrL^>OTJMe#CVk(hoF>f|R2YBVj zJ--=SoeULjn8Iju;H)GD{>kol zhk;NeR=#;IXJL$;8!@^)0%6aH309?Kx4jwNRJCDAaA_*1`c{Rt$-3an25$i5Ky#fu zxpx=cFdjh^KM~v@uKoV?Tiam~fWC>9q#@w~Fum7#dExOfKrtQPWdB>6-?Z$|<8`p& z?w^I-7$8*{4V?f0 literal 0 HcmV?d00001 diff --git a/assets/silent_hill_32.png b/assets/silent_hill_32.png new file mode 100644 index 0000000000000000000000000000000000000000..5aa5abfd02d5f38ba909aec804d21cafa69f5a3b GIT binary patch literal 81074 zcmXtebyQUU7cHS8QUU@)hlG+dAl=;{-7yT^LwAS501DEjq_iW_T^DHq>1GI#99j^3 z^ZmW|{+M;w-1WKVp0m&1`*ZHP_w8#fWuhlEPq47Ch*VV+bg{5-0W2(>y~ntiGfKS^ zC71)gr;3R;78U{de?M%joIDU_71nDFeML7rUnvDeIYmuz8CelYMHgFdc_nRETOSvg zw}gy}n6#3VoSLYV5+;U%in_eAnxw3%xQw!}q=JZ)l$?^Pw7j~Qv@+(TjJ$@erJJaf zqNKcnt%Zw(jGQCXQ&vIQ%)&`YO-oo(N<~fE73OVXXd@;qqpYecC99ySrZ20c;%wuk zp!`}*-2iIlBqk#54D*svP&P8KlvPxbRZy`qb%+U0wy|)QRnUZ4x>%bz=<1l88^g4; zO!W24q!pCZH4JUcT@3XtWaO1>EnUT>WnXI>S(`ZuKt!Yz6fCS06syIy+c@|bkB4D75hwMfT?q}W@# zTiZBcVi_AiEllinbxdAsnh)64`=;-O1O35kOS-L8!YTDYl>FZj)4NsF% z(16*xni|@usq3g~>c)qqTAJD!>Ra2`x_Enp+S_^SXd5euh&VcUDywSAh=>^IS(zHy zDq|wR;HKt|8q(5{fr&vrG0G}BFmq=o8@P(vYjt%UH4R;JV>?xi*YZkQZni!;I>z?) z9!k<88X9^|j$XnNa+;dPh{%k%(049QKAM{PBEnMU7PbLiQFiw3X2v#98xIK?c{dlo z#E5hy6-^0QMYvmtzOI?3l8m&RvYNWS3`9gkLej>@SxehM03t0Wq8J|V*3T>4(b~h< z&RF|_t@4S>Ns9iSc#_P$c`7)r>?iHazyYKV!-$SJBzO2{iJsk5-MD=BDN zL!F!){5)KOTpayHRm4OUl+|Gtu3`RfRMm78RWy{OrD2xNGQtpfS=CVg zIGCBUilR363qEl%S#@O{6&X=&bwhq`elZ9{S5aC?S>u&}m^i3A;2*` z*2~Y;t5n4L01Jx=OI1NuKVb1-Mbe|{JHsG6=W$Lbo{_%KtFY%z+%1T9dV>VL(l3oo zY+{+8;1olloA$nzk-q7hK6^(lGR+;1c>w7~}_*cs$U<+d>m)%5Vfoa#sxSRs0?xFiCdET4Ljtulo1AIp z!Ed-$-`oNzDJhM|iO&UM5%jT$CAwcX)MD+eFn%8bHlrWuPFT7X0=o46h`BGZ5X9|7 z^QL;k)$dP@E`Yreg5#dm{-DqJ%9*Zj zGl+em$N5@o^ievHg2l%DRxd>U6Tn^@w1nPmLCew2WYJOY z7B@zjx6f_gu2zW<_644}oSt~5Bad$}Eot;{xB;jv`f90{hIUOtO)9mj{a2S*1*oTW zDJs#9)VJ{Z!m(&G&~2#wUy#yjL6LI!{}x z9e9QEM`EwP&WI$m4{R2{gFm_cdmIA~TDd;w%yzfw)LXbuKJPH{s9$RohUn$h=CnNZ zwKr!nY5q6#l_ru9<_5~$o2Z2}4ws$fl+li68n&jsd4Te{iJyi6v(62=BA-{D!OE!t zN(6>1AaYG=yn0#4y=jdUln^DQW|>IPZNaY(&5`xQhk=caA|Yfl=eU+*Oewfuy2sJZFMu zhCq=6(t}%Qm0%RtmOIc%INYnsdRc$X_#GyNJ`h0fAeMjADES1)aO3c?CPaOLT$04g zgW_cQ`045YQbpM)YpK6SwDnzVKeX0QobGTzPO_ zi~4x5`Wc> zI?V)Lv=45ps6Nl|H-<`ww-~#Q;@X86c-@a0LYCPqg=_PjhgwPC1Blz}$M*kad>V>E zgZ(J^x-i)?^9$YFvicev?(NR7lcQ(CYk91sv<$FeXyS5xU-&UN|FMV$u+!k%S!G|5 zAy6Ao|GSA>QWs4c5O5uDV!jBrtoyGOn5bZO3l*(7;-`F4p#nl${^Hxzy8{&bQjHOu z!2KQ-zmW*F`=yr)qk1;N=&jQ4~f>jBj z&cbJNk&`^I?7+DzNEuCE^CJ{KB6uLnxq33Q~O5MXbZpWlm^uIV^+|tVzce$tDLMeUk(@rB*|Esc9;J;j4OK1Rn zSWyD7+d+pA-ZwPv}m>e0*DK!4v?6~GF%)E!xRn)&yyR^dl zh8Z@K5(208677@ae*bC4{vYHIfGe<2=$gj`Hx_K_IiP!}-fnCXfPFsO3IDXUHL!p5 zu?|c~l}qB5{C05{{1(?@q4Ws~CHnq5Q^wC|xLx`$Nz{chXaGTl!3NP_=UQz8n1T8N z9w1z$}yT$f0#Z3cA> zaTlW1D@Ng9@)9vhy2>4U0{HX$SudY&C;82p*EZj>*B@9~dd0yv9+vYDHL%qRiuVjx zQ@;*xU3J>OaelhjQ-r~l3PJQgDq+I@$Evgf2(OFdCU@7@0U6G?<^-y;xg7XiTYlwR zK|#}Ohfx*5|CarCPY~c{DLHOl_-tu$!B6Se5gIK9!#>Rd8L7B$fO|oJFgPsv9~`q- z?mriXF53yN>LiKVA9M%&L{w!yePK(d{H-;3SyGy$l}6aBQeVp0M2r9n0B1nyj8ORm z7_Z5v=19hnh~0v}mVx1pKbCojAi5+eHSUNzUe4{lXY^wX}_r+bRfDb{_v>h(@C;IfEe_^ge z-P&*YM|0X>W0C(u?mtMf2vd-lZ7WSE-u^UogyERAv7aBv-pkt?Ny>%aE6h!Sss68v z{)b+P;`g%AG))1i=^1J6NcWz*(>;8fgHY68(JyS@|6>PK19NjsF#0)r3DUg`@a#p@ zv?(8;^$<3)8HPfuQeNydO$c*h*nFTkl4wQFm-TzFndK^g+)8-^>N75%t~i0fY#slv zU0L5=Dd`ZeDp%{KiWAof+=FWrXgs4%_7r1xLd8jJhPO9 zRNI5Zm^DZt#0W9ge+jJoPlBjbu#iyhUD!WWK?bwm+&>+prY1!W?>u0Q30r(a-3o;yAxxFYZ?BP5R9p{ z4t}fFdBF?XtaNmFKF`RXdK{iubu25$4rbtlRbp_N$s+vb(Z2Mj(_{Ez1DGy%9{pnb z4}+(*gg(Z>a4>7A=}{prvr(yzY7h+nz`nm-1vgWjks`-Sap`j*TU!obM=Y_$>8gx zky{{bsQ-hD&+}DneUy8y)9`gyL@e?ill%kB+_HM0bv(D^DpXH+7Aj=MU3(e0a+0Op z-J9jST-aYKXzxTj3!iLTH_i4d@;FY3xeG zrDkXq2wjNtt3peI*;_n-3|}sk9jNnRPa8By=iC|6Yo{WSqDs9Jj|U=GL|ADfB%k$V zIeri5K(`P0wFx6)`+xU>4P*aoh=bWVE72^E?~{U~-#Ws^7-ArkNSZ-}^a9)hV*e)b za|PfH(o0e;+-yAxbP@=>IcVxVewnEg{f8M-xlUh}&v#7KN`uWaB+7#9^la`sz8tXM zKhCs|R)4h90cX%^0?K8#-qs4w1p`X4X;^L`EsYVVJX?u@(jR!zFAiPV6tDLF^qYpt)ZZVeEt!+z=XjyIO3XF|`7l1oi5csg( z09>;Z?Fahble~F^+CB~#tSV&`wddFS476z@f|76kqS5HZppIc)U<+^tW%AsMU;%c$ zBKtSQpr!+O9E4ri&-R1!fl>PfwV;CWQ<08r?(bewxSv!V}1fj*h0STZgnLsG#k$nOY;Ywygp!#SQ~4n!|L7X0sibpL#b|sVbzBCw-%bQ+iGhKI11GkMtnoNOM_}{^n5Ax z3efyt0a8x^-}SL#5gZhM3*_yx2#iyPQjE!B4vsHpru5fyMct=g%HLm1f?#09vTiW3 zgDA$ty4{#Nz&*dBf96D=8H1=7>JIYgiU@k}!dim#HsUditObqltB7gP7VyV_bhw;J z^USUs7ss5aFQSOsW>kG74Ga*kk?UgV5Q^g?WKTG|jo4d~Sg#hx(guUZ1C<5{+XjzV zgfC$T3bP7p?j#URfnsM|M>9prIg_R)B4 zCW#;h0v&zzQ23rn*pT#@XK)9@>n+z95e8Vu?__G^_}F#E-LEnL_dAOZw~D(^&OAV_ z8V4I@&Gc~BG7(}&q|`bgZmMQ}H-+mh1l0SC>jr_un}`Kqe`^Mz%d801Tu5!L;mYs_ z=gO26WS9eg6#5e>P$CI#G+LQ?gy0)WBA1FCDghv~Q@vU8u3plsi%G$}z$^t+1EgJE zRuiw>mCwKp&kisph*&Ph@a7o4;I8AiltO=+$=K4?QxiutXH+s&BPD92!KVW znZurwH|JA+`j9+{QY+PEMetcZl=9H^O59iPYYuTlXs({(*8ePnb2 zxubKU#*cF73HBA)9T$CBE`#zd$l|^Mu$d zfNBL)f4Yx?HJIADU)C7EtHVd>Lw3d*&AB?am7#7ek5M5N-@!*ak1>pV1$ktzsr(?v zXFB`jnFZf1L}^2GZ>J`JZ#OM@!Aay#oVbKhOvGXNN>J}pz7{9z>v5W-pBvm@eo z>`1*Rw)N%gt6jPJ1+1TpqcUd;AJ-V?FPYTtY&RxbRdqWc0>TwP-}^TFZsZp$cGJKY zJqC>=C;qCmHkW=3RCC3k3_P-%Zg}XZb&ushO(JPg6V45bNVk~D#zW#^Keif@M}(gE zUeYHA7jHrSi8088TB9nh+TT@meB>zH7NoS^;j%L!j2`S>7K4;rPhz#HQf6 z(x|*KQlA?~3!0!=Vm!A&@PO7AYFQY*@v0B>yvoH9W$XV}|F$#=-cVdJ2>JCsw5_B( zo^HirIzBvf=wv~20!XR}t^hbwt?Sqn9{^F7I)|+2gQEy897{F?($Tdx8ZfPk2cfRB zSPbdAv)(W7z0gJBO1?pd-~tI=1WWZM!jhrm(}xcWGWXKNsf4B20dijivI9>_L(9V% zv_xlpY1W|F+vwg-0o0ESi0rRHwt)D4<6ZXyyDH7{%tqQicfT2Vv3D(Tu<={(-fJ?* zcs8v(KKWBOm5)P{)~skz-TUuVZB2C{-1t3yDdPs5P!iV5-tH}p>(%-1r=3?nQO`%~ zk5eqoC?%4tc;Y@ud)ZW(^Y9{BrYx8{H~IeU>8}u71yZ5HoZUw^p(puRtmHrolcPV-^)?YrP@1US5!^25NBFj13w>Py48@2mSz^)T5U9=O;@1S*82F^F_4AOT# znkA|6KeF6?tpIwpZFj#l*NH0C>70?od0wS^r!gtnBx%hTz8E9mbOvZ7q6fEbuil_mFQGjKH5$24?0%R5B1q(|> zo-0e&K6#Y)Yt*tV2fnG-73zZL7(LNl zlRiO$6A~4>o3}2WY4sY@m==@9BH5|*U|@S@o7df+*$`IWJc3*s({$hBkr%a|r#dCC zRD7GUl2DP45lD};4SeRoIhs@jBI=`mL*x>%xhxQDSoSW~jPd<|V4VAik(B)ebMWQI zt}faUwVJXUF`WRus*sh$T>7p};p?7_Un{fuHYs|KUv9WCrKYe7vm@#eaKT5gFIy(U z!61Lk9F+w&^h05{pa*Q)|0z=VXAla6ai1!)T5Wgyv>9eg9`w&iAC9}`^&|n^jtsas z+NDzW5isU?F`HPA8bv`Imi4f>uc-)wS@9s0KN|J*-D=)bg5-Mwj))b0taXK{GeC^q zUnVt6cmKOmlAWr7*Pm%Nlre9So9)|o>FER!C~m|CW^zmyxFDc*NaI(D1BwXq&Fion zP9P2=DhtT$Rd4e{(ACD|d$9dAPQ)#Yj^Wz$?Zz`mvaFaSqA4_2QkzW^F;Ec$zGsBy zi6g{A!>3*Po3$}xOAMO24N1rW4QT{XX@B18&K0@3wb!#Zex(hJq)yry5384q_ldoM zlrRD9G^1{R>6k?6WQf1@WYEG0Y_=01)xYFQ;O8kSanG0Rhnw5N;WE5P#^k>nvB|qp zuRQ)-F-nJp-2EZX@bFk`eQP^Rh|-NSq!YTlcpu{}sj!+#p?!T!$#p7L{hf{t+<*(G z*yD-bWiCv*ePy)%Q}GFVf+SoZq(ZeEbno|eS=8rKU{6+36?r5Yhi~^Q*z&6Q1SavO z=X&Gt@NnDi@yOMc^kZ1>bqS~mA7+5KqtCQO{Ch6ON(N*`B5xd6j(4PEbH9_vxL^lC z6%`2JFa4fwL*Mt7J#l-r<(K4wAczG6r>#A^5MNZs#!fcb)Z`Nwok}Kzk`NE9lnQU& zS5CLo)H!@rI!2t4de|MJmDjQ0)$%ubZ^`R{w0bgn(``F_TZ}qH`xSzRXS@5$@$ED|0;J`OD_- z+SOWo-}dQt49E;Kc4>g>nk|84A@Bvw&+mJCnnS`#>a6@|9*m z25BiNGGI3jZd)pEcSWvl7GN8R{6#!pH3yFu{KnAh8_4U0-)@Xhq}`MGA*xaRm^2=5 zjQnNfM~F(y#|;9z1Hn@Lcu_h7d)e}^HOeH2PW{64T%A?RKJVIEX7Qxs_32mhuiNkN zXETeX|2=>e#Cl48#DeAB(s=|2-hDVwRLjd~r*4@bKHnI~hk^`im=zm^w z7Rj?9J}U|2`Q&4=$EazjEBymhbA4jTtCs_d2Ad7CQFCp}U<7Rv5PJLPPs@Vqsi8TW z#6wZ#!=jO5l_N3!Av8hbR;m-BH8*RrwZe94pKL`pB(RR%VymeSn}d)EZArpIz5aPr zFjuO#rt(s$?~n;_e_r#4yly54+faFJ-e#!%>fb@Wv^MPsWw+B&yo_8(468xGi{~w# zD1fZA;pnq@^J0`US3s1a|u}bt*9ce3+4zGO3^7RS*N_vMT@z?ov zeuCbw9zxO9*-b1uo<{D*ZO%&~nXU*+V^ZHtRZ4-U53l@b@RoDyYxgALm?3@_f=MRy z;=n5+ZmZ!rHL_j^Z{|i~g&pB~&r|jJSxKN6O6ZGwcwgG+E(U-lrp={h0{ZYRCTCZ((kY?;_qKWDgCVcZLh|Uh5t{a76+uMeHReJOae&P&b|Z zA~=XPNmBW`UW2qNF-TlurB2&hghz{>LFPc-vvc4By$>&B4>bP~VvWV?JeK zJ!P|FNfUZS)#to5MjtB(I`!dWu@(`vXn-gS3*Xy);$sd~X&sZvk8;5Ds! z8co?#uqD*SlR=Jy{7Pe_pj;}mm{IyhnN>nULjOCph1vqWk!PhT@j_#s(_*>FX+8z? z$z#HmzI5k!a=}{y@yuAFXGpWSrwCt$@_n+F8lpe0HZ+ZW-``nnrHd!PH=IEe%ftvO zr2*qQknEh0Qu8yQSIzSGDamx7vU2yS&Oc?w#$x(Nq@1S$;?EzKnTA)0g`Hzz1Uyh5 z;lKe}qd*+z3K46zJ3oNcCS?YAn>w!FlhEJ*rkTmLNqE*0VQ!-ZTqAe;KY%3hM9B7- zhl1@jX;m$1`Bnh$UU#l~{nLE+c4lLf16;K)>J4AknUVS;sr{FC8^&zPdK!JU7OELM zIEWc>_rB4YFYlanp;4wWp(H-^1eMut?aTWY&hP`j$7X4kLAzw{)VWei=PQMPu^luT z;-VLRcjF6#MZd3ZO$;=4nA(l}34GNI?Kma-@o`0~m1&>Mjn4hmi%`Y&Y}MlT;^N}4 zlrK{tEsda%zgXjy^FufsoUu6gM4uX^)VmwiKxW);mJGUNGFIHa8pV9eii_t|TVK(W=7(5K8Sc6WxI=LiX1|Zu6K{46m!-U6D4p ze4)4zZ25~PrV~z|4K6UE8!4T4t)PFE`zJ(d(Um_gcP!q5Wqswwe2uEMPTrL=g=!J} zZ9k*jP*ox0^Nu?6I~xh{+n5G>&``QQn*%}BEgq$zAG}fyYv98L?iW?8t3khoM{XQU zMcrMI5LLYrP~V=t-X}=UwVw?gA_3iAnzZe%*8Km!1xN$0B3L5f^|wX0_=~fAtiZ*D zFFESBFYK>ZHOPn^qzx|M{Tqa!3hHTaLJ5{8Q2@z8N8x*Vh$?>~SVfXi+@}CrL?Uc3 z!0fKTr8~gqQ_DJysJmfcp&+pC@iip=r;uMMRwu_s5@&_7{V1} z!=Cq1IOu8TJdRoFfM+ZAuNZh7&I3EPU+}gG>RDaBdJ9vi7@g0tm449t2d&KN?nu1TB1H1r2o53qBDP+1hKYBs+P>=Jh$+be2H7pM`l> zyGenk{57c{wj;|MKAnLri8_2>0AiCjl8m&T>=k(|&j&=}q5fc=xbcDbj|t4n^Vh@o z#(gyTmd|14^fV~Xzo0I!pBHz7ÐvM_>jeTIqst2^Jt`lW;LByT4W_>=W41*tnS# zQ721VS8mfTNsLJ3&U8rhSEO~xY}r$otMMJ-)1up{y^u?xBvt?N6jCzo*UYD3Qu35| z`dB+SrPM$p&Vn)(D{gdzKXsi`G370Pic#ZFoO0_mmLcr$Khli|m?RsP59wLbyKyR+ z4I7P6YfzJ^^!=@S-Ais;ce+F;+^h)uxRv~T`X5t*$FUzWh&OQ28^2D;AZK&E6)*`$ zr^rnSLBW|9b`-EN)7Ge(5mGJzmIsf+jxT~H=By_9v4*U3d1>uySnPF(AmiA`-KvM( zVLN+cVe=*-`enyEXHP+ycu@0ZH_)y-7l3{HF*m_xl$B}Zy*h$k=UFtLYUqRDOdQns zYC%7!#m!x*@D(5)0ZDs!mih!1c38>Y6vXysFd6O1F9ED4-*5~Dp#Oj%tCug2xIuMV z;LfB)k=K0E0pJ1-uGEQJ=45#sFN%M!Y5gxVToJ<0%Yqq$Aok@0GxL)`yM1%%;EEiKc-+57w57gHc* zotPuu`B>0Tz@Sd3wn(iOxRRmGe5+YNgtGMb{ijQX`h{J8b5?~8k0?Wgf-VU%vxI^xwMay%4IYy>lIA#-~HODcR2Uj3WA|9Aj>R z*ck;n(^-GP@uRfMk)oMT<2Z+bg0ZbWCxO!}575S5CkwQ8eFrPCz_7h&fM@fvAo3AGKZukccwD)y`YruSL=}$BIPzK_7W;J}_5K$6*AWh%ED87v z%8c)6&Wl6ZS9%g{j&bM2x=wRmzClvR)5`4>WK$3E-lYcToOy<3>sPSaS+XrLf1k`w zr|1@WY=fp^8p5VO-Z*usbku{>^g`U5v?eAdmJSWO)*MP07#RE*l}L(tVOefx8L#An z^$_O?ML8zwF#sceEqmft1EnaXR!5cnnx;=^1Hp1< zw$dr1uXjrxdOjKW`;8$%MK%N7k}?x)B%k!VCu3-OIM<(jNcF}OkQ04@K%1DnNqUHy zVnV2|+8n!=yhaU(ytG*KR{xiL01D>oECL&b_R+u+Qp0dbr}~jQnKpE}FB0`cfqbp~ zn32G$nMVfgO-v*W&pmN{o8vT9t&halLw!UQzUtq~EwRoHLJ! z5_ppr*7l5y>qzi-GjxFuB>SO05(=;fzoFP(xKZoNcFruRhkF> zYB}deSX|Unk~xyIda>x_*#mmfR-4LSe*ELy6&#K{?!U)tcEih@1MG)gnVUztGBrda zSiH`A%)Z1_gme9f3c#~3vEsg(+uk0yI$qP(p5Wuv;+^kGBd-k?&Y}M?d1xq*P#_sx zCRRjD=`48VbujypnQ8y&wZNfYwdP-cMY_Y2e>RtDYdo=B=H{)mW0sZ5_K9>aTKg?$#g!IvI8^7lAJB0MoVttz7E+4|QH z`(m$EI9<>@rZr{)*~P^V9SjxDoyKIR*N36T37!z7sDYdhO)0JJd5lro$(2xJMqz?+ zESwD=wkBK-*(f&%AHEp8W zm=59}(r(H{HaF^usSMYhwrRNJlMn@(Z6BiLP;2QmnJ0vI=1_xbv>K{eDlGuY+>O z!1tbhevO7pl^WnqE0Fi$5Jaj0QhPjy513QbM}&S8GUPPTQ%#46()2ULaA2mKdkV}b z3<5;)P{MQNNztrs=4(bE|8KlfLf_!lF0h#&#HH~Bv?p+D0qLG=BdB?e+n$mjm)W^& z2O9s7V0z?H6$~htx9iTa6da}(eg+H-121)yg+&$pQ&*T8l4up{=8H!x9Ii=eA_kS%y<%a zF7O(#K}A@}b(S)_Jj3l8>|OUm8N|Y9&!6^=_2^L4qVir0H`iDr%*5NcG^V{&n+hKz z)j0dD?ZmFuvGdCIEx&uW5(_O>9vM_Wt(7}YxqDRI2Bo600V=I`EPgkT-cPJ9+yZX4 z*njVn&MUGLSTj89Ww0uJdrrR)Vb4{J4tE=DLUY|xfk!w-cp$uzACTC@XO#y1-*GZF z@<`&1zxWz=rxIdkM7AxD2A{3A|5*?F&Sl4TY?dfaM;tHUvFfo(dlaO4v(8xeC#TWs z%b#HOCyl-*W5OiIC2X&DXdw4NiRdRFhbkKh8iOaW?Z|XtAoyq8CV3({`IFJeRdBG! zQy5nE>S*5!{Y|O0;^F@HEufS}kQF1K%^=mDNt3%6gj(86QvQ{+=H&5L`UKcQq~Idf zWE48CmOSdJg~z||54TMh6Y}*Q-NXf=tc0jhd{U&S;45>)!o0!AnFQmM;jTp@xbqyN(M0-<)8ExR>qSBk?ZR^1dmQbMm19VUAU-T z$Ak5xKfi5Uu7>1)*2F7F%po~-I)G~4N9)|Ob;ix&Rle^vbB_>n>&qoRet5JK`2`)5kcrP-QRu3^ zE#H^s^*LtDAb-cSQuEA^Cc3?Hv9j{folQZbIK#;JuWt{`#^qPN17+oLSJi$#ikAL& zKHa2Wmxw<33fjd%{iOjjm{X#xGP(nrl@MoKeIoZignF+-7=Rt23+W>P+vksFu&0{! z#9j@5oq-7H^`tQ%@N%Q!NBQl%h(UF02?SK)F_=Lu{V^L)@3p5dBHj$~4}`c#2_9ns zg}(`a(d*M9h?cHEEP)?tR%ksSM^^wY-$$zmNLHp$6P*TG6RD5I?2mT0vpD$* zMgvtAf1S`yp%uCcdDSPxWV}Lu7K%5DRRsUeQ$%omI`{lV%*XqxeK6-#_}f;FVHh17 zk2=MPA?eiem$Q)X$(&B?H$1#!UyQAl81PW5SZP1!6)%e?Qy5joCnh$!MDq(rzsb+~ zSIT}9u=g;ZY%mM3TXbZUY>J|%}7Z_Cp#?Fgvmk)kFuVW1*gi-#Gw7n{+J z^vuy3Tjb7x8l|%8!I^V_T6-JaaL6rLJD2yCa_S;5JSFjR?oMf)*@Uxk(X~%2v0x1c zfrkxrt>Pf+N1)~gU2UMkzKMumw`K@P817c^eiB7zs)|>?+aq&5QY0*l2;ALV4sX4l zfl2TZQ^V4E`wJl|^Ww_^2t58gPY8o6yJhP`w-T0k96?PVCj|X|U3MAK+rKJH8numlj5SnVHeH!93c- zi%KvflZuF$RVwJ_hrNiG`8{j+=IvLF9qyE^qwd~_z-D&bo)9wam-w#O*Rr*Ud^F(tlL*Y$s6rstjD>-?%6Icr0s(A3GVvu0A;kSu3 zYDo=5p9bx8SQS5Mly!%2nh)FP6n`k@8+ozci8r>$tIagRC|x8gcU5D=73g?IzDigj+s?)}O|*1W!1T!1hD} zXesPO$Y9=yTv5m`;n>a;tJhB;wWF|=lfzOI65PS-MDuHGe!Q6%b$)(FM)r~#5r%F` zqTlo%MImL(DyZBmpl%WHC16PEaeUpxPxI;^%_JnZtgWwe`E>(WuO$&_#LwTL@UX>h z`rOaXd%;*Tjea6U@pfuth!V9F0g;*|TDz|bk4}V0k$}V8?*05O8K86)+39t+rvedH z3LpvpHZox5!p59^m_DTm-tCce{l#T~9z<#$O2=~Msh zp`{IC8_Djb5#5<@O?os#8->i67^9_P-KKMixzA)(%%Q9%*NxyIw@cT)biVxXqkM`k zEAzF2>-IA{Y^@Tf-nX2!f@v2Fp6*eBDQo^{F~a6_k0r?A^5cy#Vc5sT*wwe8~YqT*Kr{=J=E?jszPUJladW;qs#2BB%(04Q93d)oOakvbMbUi_wO%S1=qUXcQ>8m0nq#e|&py%e61y8Q# zca!|FQBBt_GcoY(02n;HDt2k|!}n2l^)(8#XmT*hH4)tq2%~3(X;a}->XQ1J{?b$f zn`v4zcXD4ff&buJv`6&v56)3gsUX6hR2VGTfM}-mS|rM*3I zH9Pj*pUnE@@^%Xu>ypQoe&93nf4KMPqekSQ!c3z(6aA-0r>%Z|MbfY0Nb**DIDkPa zDrE-;hZBLIMOxJJk$;`H9>He|U7nN#*<8qqb|w2u`OhD5pTLGH2Fu&}dEmyoIWSXR zo~c?r@N!fQM^Ms_s>dTxbsh;ugJ*!&lU6ppYeo;Y5S#v`FD<8r76iXf8%h^lEBM*P zsbJEHPnbI?VVv962)luY1VGlbCGoM^wsF&Lt@{?YOVcTD4k2L?D6#B=*XdwLr!F1r zMfX`2G6e*DeM<&Q{5t3$4M2weo?19WIo}`Y~+*~dw1)E@1$XrL`wcxM2eC;lUQUBb~n zPT!*g%@_+;>*f5~rkNHLwdk1hx}4J0qo?n8s!N(^Vz#H{dwG{LWSIZ!LppLq=oUyX>Ww&i1L&WrKd%q>lG=c7VWN?8GAl&)h~>eze*edv-!B?0T+cEbyo6|&Lm?y)q89|!KHLl_0df!vpfzM$~ zzh%2)V^02<3u^9N_t1RAdii7W+*>%e#8pLU&Wyk`!t)c0i3%(bX8xki z>K*!g@d~)))_+}%>LN=&n#FBFcvE;TAFz3_0s8(N9T06AI$9rOww)+qe+E(;49+OF z5}%4jf^I;-7=`t+LU}rEGEz*?Z8j1G7t(YXhGePq(+QhD4AH`vUDqdJ~o6>vIo|_b#V^Fg1)V?VAY| zP`TkB;~CyZH(C=-_BmgvR4!kOy&>xv>)&L1Pn~Yuy%pcn!1zji(fkOv`CsBc5lVzx z50W)Ld{(OBWcm~f0eE(^rkMQMlciYa%VfLZhvN^+NWZO>j9JnDS~M1sNXKq8(`Z#f z(I)XV$kx3)-%hNjBKeSq-tW<2;v4_aKED=@{!m*}*&1-kL|&7vRjTZ6CtvQf{9u-y z@@iZA`$Iw>&T4rs#R^Kia-p}TIq#I$Q`;)F=%^$kY$>Kh;9WhF`Yq1g8}kpm*hBOS zP@0O9CQNx5C9>*fgR0U*+$DbdGZycaZM;cg%O~pA8YXw3L_ML0u$6?jtF=+^4nlxD z-xbqT&VdVt&V;xV_5Vu3O(={7Nq+&Ec@ToUVKKsf z9+jkkHZ|&HT^e5`{PEUIAZmy`0M%fFXsk|GEvMO)7aGl&;P3gp_v}|NEK08=LL$p; z8ce01qfz?!n$)kR+GWdFzb?OLJkj$hVk?_Yp`<3;{h-g(mf#~=+qHj@& ztZ@ZNAL#H#qO4^C#A)X7g<87laLk_6{tn&m2r`&?o>KDuFK!nyxU#CMs(y^y(0-S;PXBt@ou1~7iyIji8#iug3d*2SnY?9r0<$`@GYxEYlB>&}-z3BP@k*K-Fs{yjtxvcnqE4oG#7dz&u^9V@C~m2OlP zvdv>n?mrz4uXc{L^4cTY!|rxoG2dRekn0rw4Y;vA+G*@;ZVm_*X$`pc93Ct7@~jTt zGi`X*^o3zn`i%5+1{_9YJvc%1Hdkg+xZc{wyG`J{bwh)VM2KQ(l9uNEW|3EEy(s%& z=EmiVaPSXGJGs(5k!Rj1fM*wLUJny#aRiSKMv^~#4Q;9hSK z(z8FDLj;Nm_Nf&Obgs!namKR|eXoByiIYR6pZv&Zb~~i{wA={k_bKF=yK%|*CEa;- z%9koV`{pH9$v<^|nj~Tpk})(^%%T$QG|yZf>5*NcmfrrNM{%1-uW=}wJny9>iySP^ zRrGDyZqS$F(4kLCAIQ>k(h}-4f0n9^T`M%y9Ad_#7>Z$123nO&_p{ z9bDA${4sC)!rbsm=hF^HEYhlMO#pasTJj;TDFGSV3nNUXNWun`b8SMtQ6Rz%R-0!) zW=d2vsMx_~9gy(Y1(L6Q=%c*eV&$aV72*eJNhIP6pjXj2j@NZK9kA} zR;>rJhh4140dFlI23gvUk@N8AC_2-gS8ywN2@2CtzKALucU-1$3LD`xrg*qQqd-d$ zgnoWz6lbAYSd%w_y0OC@j+x8tx$+jz=glnbWQB&W+!fY zIc2o&II19oo8=(qEZ7kw@(|F!uf|-Bl7sd0MT*uQm=8iI6YCm;e++-bXoBwP< z?tMDo7YPtb)*12ubou2=v>RLI2nbusu#zSB9aOGUYK9=mC-QBoAFHNA3lGB|n%!0s zF?tQ9Q{xs5+c0`nqkof3Gq0YA7Q8lMST@m0!nOZ5^vS0lB%IIh4ve3Px*~l`EKWB! zCksZXL|v8kIU~y5e?8|V{mJ8R#MpI|_oRkU zWPtQ{iFbA5=irM;#St(3y~?TK$^olbxx`^Iz+h2^L8zMVWhwXFgWMp`nR$}3l@)On ziQK{2)wgrzrHwBpwQxdQh?MP*EAd_e{1K+|XS|4+Z93GEa-qDtc0Qtc$1}^AEwJcw ziH3L1%RiO^A_I~o?^IXPlrN1pUzC&n){iw_O?Z>^7A({<`)ni2hv2u#EG3LMm#RkL z2kcEW)p^b_+{K&cNwX4h>i}CkJeT(O!K1S$xq3#>YS<1I>NOqU>Z-fXa{I&USv!@* z>>G$-Uj@gj0b^Y5MV!e$VUxGRoP0m^CPsHabHae}?^wgp-LsH<=dT4Nmb%qO$y$jy z>}7nJ&xHfyLA#73z`^pIO&*?IQ25Y^n(SBN$bgNVpvI&+MoN1OHe|l}_ z8N_{&)M~Z-WG*o&qh3Y(96zlYoj!gqL|!s1J^t*Xr>$tgqP%4lb$xxkj#4siY_ifc zo((N!*HraVic6a3;4^D(0T3}M6oEtKOhh|r-@=YTxf#>dUlQ{~uV+gVIF2a2!y7tS zQyuNh7Ii#sEV^MAgW-3(hUpCK);?(S`_^x+mF&*mD)YS}=AJ52dfp$S!QqA;t^!O1muh;Y1|mCA(zcKuvvE+ZQ8*A?rV^IyWw~q4p3MD!K_$B1fH6}oGE$b+Jw!XS=oNJTM`&K)%|R%Z=oGGr%JIwpdl^%f;fKew{&PNeZi7C_^t0TUFTX|POX!K3Jc z=2OIs-AuUVpO4>2>daSPLbW+3G%CUXAvK7cf{?m^RHk)WDeBwVUs|Y^Zq0`A$BX~5 z03sM4axf!H=V^o6_FjzTe4D(;KfJtM7Tb!#9GH@qeoC3X7s;u|QAK=|w32Ox+Hg%y z5^-?{y_dznk*D+(>0S|CWG7isA~j4FOkwpbBc(9?7fY-mu;cCynkx5AqojB?m(LZEq&_ zD`(%(Y}H-(cLjv`K#0ik_c)}wDIDSwAPHbz2GZMg3IpekV6Nj=NLNy4qpnFR3fy!~ z^SkLvpU+))`MW(rco2!>fkn@XHbZ#UDc^Lcuv`FV z95EWs8V3F7Z=k>kAGw0hid&B)KkcCmJ3BiUd4h=ZI#5nCkGMpvit6_e+HQ5`uEb7~ z*UVuRV#@b6NvzA@X<-B0L6?`jzVeM0XTf?Dr;O#duu^8brvGZ@mk~x;ceo~GzCd@}Zlsz>+$K+&2Zan{YRM1~5#czwYcBA5YX@~3!6`dLwW_RN zsN3-W`ug|enymv=!ig#m!~{%scxoXy0e zU;Avd%3Mqfw1DpNv>A3XwBaIu;Q@Jqz#uc|R*hGJwtIuBo8O`ue_{azL@rza1U|_7 zLb(rO#p!13pfqefpY*0f#0e?1KJY;uq}5&zu6c-HAt4IfjWk8>#WbdUXYhR>uDDEB8IJ(O}x zokI5fsQKqB1G0mZR0Bgjcj0=23YVpnfG;|2cp z@j)|;b*7B581V+|(V)x*$q``@OFi7{jY_SxRd*~iLb2SShDb0bRMpf_bnaVu)Ooe( z729XOf1{^lH2!|he;K#7rhD@zB%qd6h!n|pt|lAf9Rnc>lB+FyEzE15^556yj-D0x z9VUV6COz)_OU;->>z;PvNPPY0i!a)e?4XwHtc=qJ_NP*CRPKna4)L67Ix$Nizrso6 zyBd<+&QsV`waf;uo-6ZxMx=<8u-nW*?p{%_G+4@d>VOuH$4|V^Th2*WR4oox^O-bw zGFO}w?x^DKoAR=!2gFly;W#(^3cfVwWh228$|UqT{%iKZh^kU?ySgovNc{T-dg))D z42OJ^MKkfN^~|IN{fTD@rN5rm^z+bDn~;bdbTQG)@eT3NCEO3^@A|Gd?mhIhpK&cj zU5vOQ6N6s5y8gSz+h3h}*wBs}A_n&L?`E)pnX_=xA>Y7g-@_u`v;X)npLP@3wBh(H zsb9Kynr>d)4N7c=Y7H3FQ6W5lQ=!tf6VMr~XtVZHq&P*MR)K~3zb%A;bbOOzs4j5z z1ZsBMQ!9`UJtmC`NQ#JshTNbjvk+2{zsd|1aNxlQ%~A~CV^t=`P+AMVkmaHz$YNdD z^i?x$5govMA)3>}fw{)4ck=)1GI0jm%G!>9<&4ek6&3A)XScJ>fgbiFkB~W@|W@TEXM4$@-x-|1jaBb9BwU-b^4mY`~cS zU>0ug_tu|#Cd685E++N_AORbnpOP5Caym#C8i0Rd8{{j>4>%VCG#=^V=g~w&mhDRX zx#kXY=>?Ysz;5qn5L~CUdBFR7EberG9Dj9}2psRGfrX@xKwx1aVbb-r;#@xZS^3Yv zn)2D{g%paz&vN#s65=sU-4ZNkCVxMk)rL#BU>E+$jo)URX5)#$CBUX)@*wPEOD4&? z2a17IZ#y5C^Z(SQB&t5h-Os;g4-IX6t+2TdIYWGv&d@Co&I){IZ}qH_G~Vw_9PQzL zk2|<$R43b|O{8nOms6A;E_r7j6pHoY&EIyflf#mWzOE2s(^c#HO_SusAvTMo2kY*@ zyW4u}nzQs~Nz>%PPs^G_X73zKtG`D!-Zn|i6IL1@77B(L3aZxT(N-UML_02)zqpJ( z=dV2FU&(t%asi84*%$ba|A60eIYbeSlEtcGhJW4&gBfqo0i%9B-mUEL6;X2s1`T+QJzX~CHuC9bc_wG8 z=^=eXDYas5&O$bryLMGrwAN|%)o%Ii{OQqp11<&3IYJHfsAjK@L61J10AyUkSs4xa z`Lmecxq=-vhr?C$thY62p}BW4_OoH603j)#^-u zI5Aq0Sqa-8maMdjS5Rv(1uMuKi*#*u8BNfy`j@x0-DuwSx7i3I^ptiouDx%!?!?Ma zbFk%Up?S-136INo_jC_A{+o23SAO8D9!?2O0xUIUiLE)=n}(jHCAG&}*@DZrz4~Y? zu^tIR-QK-7haTl{@V30h+%&ApM@&i4^7GLoIWJx6+6Uj3qy&OFe7uHgoKfHY`NaVP zp3edE-os#tMp*=YNhM^Ler55ClDn_Z=QGv*6K)Uvm)6NzBHz`g1q>I-`RUtCzehcb zpZAD`J+FsSK&r2vt^AdAnj8~xz<^%OM)OSz4}OAX+BH_$eTUjMdN_W7ylV-Aj6+>4 zIs5@5^$s^{=e-n<^h6nvFWp4BZzIpGfrUkFZ`CU4Xp8R+gYKd35#d%BN?zA{#duqfiR*q2W|i@rq=tqI^nZfm zI_TJ0WFlT5zliiXe1*Mfc`?{=`V8z;GuQ%ivg5h@T3ea;a*e-!ASdBqhR-Btwx!`4F|1-hlZQ9L!u1lAA3-Jr?af)vIDG2C(uFEK!wR}mZVs={mHpDoSRo)mR^n_Wud04n2CqBRXntG7@v4WB zSrCznHj^5|KC2*|U_LI{XaDOkAUm1;q}h#+ud(Vdz}fn1Nx=3<-w-hJRE8XhJpa2!w29a=H^onc;9JdI^;NF^>ooqA&|ImK*{RZexsg#<+M=EV zLAzq?XU*o^>?@HKoNDbWwe#Uny8Xg@8P+ZSIsXs;*SgH=OfR3xeY7F|CiX*g*2dQG zq7m0`@;v~HA$@(So=fINoJ{yfI+>L^yIbx&-xbhPzhklfa%bKnCsWmZ} z6(Vp7wyc4g>LM5>OSmzRi-OGYHIviQZiU|JidiO3Fkdw`?B9H&;PpHUIeiwG!E3O^TKMD~T`B zQXk}-$_)UJ;Yyy(TvcyNkM+hZZ~c8hbV_qWZ06_0@Alg+)^+QHZ|4|wgEbb`hyOOL za~j3qFly<^Jr?J8p;a>0a2<@OWDc4K4}?ic+uHp4av5?ur6?O!rJEs3qh(Pn@YUWi zfP*PIwU0WQlEWXrZCe(=AIsH8ty7hc)2o5$jH|T~HHRcG-~MHF_vOCMq79#^c6NEb z_MXSTuZwHCLB+ik#rBQ5kTQ}+)dQ2~+Wig*p^d;PNw1)5{I2nLF}iF(GtXey0It(^ z4#xJQ?<M>MlM2N(QX6<9leir2EQI z*d8)Jfl8??Tz?H<5hFF0&uGx_;f_SlKw4Ru5oH-x8Je{HlPaM0cGC|39*|&66@)PD z=Oh9Y)UArJ{^;DOkD$1WfcXjXR|gW=t$Gk6`R&B&_TuCaw?)8Jd{0Ff>QQHr?;Jm>j3wq0dK$SNzoi6|mDMqpyDgpdGtIrxHM=8u%BH zo`o}_CyjMgsn+uG)jAH&JCB&#nYLT@TLFJ}FI{vxmG zeEXt^$>XV0?mPQ-RxVqis0MjBqNd2bZaX~i{}AISaNZx9o032FgFSXTa5~T z`P|0ktIf?$5D_8QYoyy5)RJvs4zo4Avsz0{pE25u!dVF=va``w zAEmzjtDQ&9%Z3HJmJGGt>eAJaH*qffbvWex@TIe}^B2yi$Y&E`!O?h&FmG$xe?XKvo6K?BJ2_?@ z6s(@jz3EiwpGAT3f=)tYtYIm1T_)W6i$U{P!&FgD2_`Sr=1eQ*R0?xYv!vaF|~f*K<#h!^PY|(<=+Uq)zuG( zgUBzng&gZe0CITtMn>MDkr_h^o5>f1=Kj6R4`9Jjz0Qyvs2mEL|5z3=6W7Gn zg%2FZMM9XLTNHIv*~rCFn|Qmd`tIn99Dn)CR?=|rlHt5_q;ZCJ;tenQazW~?g=(hm zs>=Ic;W8|2IE~MA!wTMKdQ6yENF0wYzp7S?f3d?DBQiyNQTD~izsJE~&LmWeGXzF> zDO5uMZmOLap2u7b`&A0sjJ|O+k3ciek&k|jgoxw-d$3Z2h)`^?_FRZb)h^V)l*A6c z4uSgXn)@e%fl(r{9mc#(sh5G=FGgkmE|^tPK3dNf#m=tfMCPSC6;)0e&J1V737>8J zKpLv=g&=#HrHTei(K7XS_awUO)Z66r7aIOUTjhfiC2}K)Tfo zBb;5J6Sp|Wftrc!NWUENm!l~4jStyg-Pg~C|7rWzW29Emd+nR+Nj`}OR5;fBXso#R z8)c8PXW{=HM`oetv8ZK_zkL@3N;tMreaA*3UU7>7l=@*qm&(-`>_XrVq58i!q6Swd zQ!FHbEl%BT9|vg6tNuJN;qaEne?mW)80MZM3w6Gtrlu4r3=CA7L@H|_cfXeuZypR9h*=*QAEz~hy+}2>MYPBsWRXWiSP7hlG|MKIhU`zzp;?ept{zN--iATJj6*9BbN ztPPce1|leLvGFQUVwxRYnhH3-5PTlzC|j?uw{ZW))|J!J3?0 zH(6yazgXPTH#RHgDH#_~@0(J&flMrdpNg;owu~`TTJ2kYVBYG@!saDeOo^M&z&;G?d|K07Xl`{E-+M0`?{(mDlH$An zDC^4{SlBvz7oHq zhZKy<{R2B+gDT%#p)G@`{kkVWHO`d?X}X(5-03&>EaqbEB_tNTGO@(M~N!~zXTwj7SgRlO#k&i4;QFv%RyjtMif*#9-0H$k zX?6na2f?_>c5DJ9)8~pDcwA0q$C@ZeMf6(+#AmGj(+IwG(?7lYzEiw?XM zwa*NP01NT6>kXoXj+WEV74_f-$sUs;X$2`|^+5w8LuAxhzy?1=9dk`-ZyAiurWcwj zt@7>XbA%wUXxDhI3NN(G-u9HC@OylwrSdPeqr%H`VsF8E)6MpUzg{~yB9IF_|6PYF z&b@A63V9_~2QGzP%hzVU(Xr^6XI{>f%d+u!yXJ@&4dXQEd_Ja7E97WS^WwdQ2P6Lo z7}-yu>KAGIUb^D{rqLXMJObvWseXG z`KCn`Y;s74oUyT!%N(Q}JjsM~nLCa__gyD!KZCey`WMw87kOCFy87GW39#p5KPZNt z0qB!xfaJ7^vN}?G+8|x%mKSSSmeb{G$`MOiIpDz1NQPrAs@sEx+HM+Pj@}N*jRXBy z(fOf$&Npg4cMPMYAw(rWl)R=|QKZx@+J;dWJ zNg%1?-Lay-(I(ArNUDg4q_XKZelRxf*f?JsWO7Yy>Ji)Ij0=0kC}OjG9RYa z4pPq6oA!=JIjWar&Lc7mi^bp15ilZ4U)Q@LF81bN{b+B31ml)EHu&$q&y-?91QaqT zFi)rf44VHc#1?Z$`m(Frrjy*6O)|9fSkXJqS!Faab))MhwvNkBW*$!70^@{m>lLu4 zGOSq=PVw|P@$7)bqn^bz5@eSy{If|U%=ctyGZJ3QDA!2=QRU*QMeqV~#{|gpNXW&f z`NSvBok4F;abRd@=-2>$&Umf@IX-#v@-SUB3WXV;e&n-&Q=l0B)@^U%oJT?Ql$W`e zL4o2PZ-K2%LPu(g%7i>_bu8YyCt68d^abQyFcG&eJ`MFlX5BaY1A3MHP;%gLfoUNp z*0Sw)7rrNRk2%M2SHg_i5StJlSvB#{KSFpJ-jkX(6b8C&_VVGsZHp@}!eww&{!aMs zwJlOhavmu0mU$~2^hn|eTkc9;Qo)bLo4QNv%EEH9L?eZjNgwjwjk6H}ZgtYW5F zZOED-rivh+D-uLBmdvMQc8OE+V))O^OGQW6D#C=MoE*Ml8L>uNJ-Tnc!9L|4%J}0E z7*Q6ryTBKJU-ca^In%G;3>Rp^ZT%ikEdLg)+n0B9o^giltqxfRc>H830@58!uSfC_ zg8dE^ISVkI--kP~=j1oeiay#s%)Vl=u`Hrj z*2de9X>nLhU6HO8P$YxgHj#b zqN!d4qn1F(#7)G8GFa8CF5yT8?AhGcBK!)@&9v~x*wg_F?WM+pVNA}mib_u$Xkfr= zCdD5V!6=8g<(5uv$JGnRd<5^HwA2OWvXGh4GVl}V4y+Rh++3h=rVDxom97P0Jg7FH zj=)@$`v!0d3}Ei*EE_dmZfT=>@;y+xp92jX7=U00OmIi0S8GN+bGdgTKYVhy$TY?I z>O9OxdWMe~|EnjnJjmzqsA{fp3~kbu;jH%L2$jw*TiNB_Eu=9}@L%4LQIKMZW*GUq zJeTc|q|nmQG3z~5FyWx*`i=!lpt!|xZ2ck376iD)`)oF{Bq!+`{ZntLvAk`!q53Q? znJ~og1$7`_VX&<>W zLM>>+3kJ)oX6Oq$b)_oDUUjyT&6L^Xf4dhlhV&2!btcJvDnjco;>M}FM@4`nm!e@F z3~=rPwSkru7T}x{e9W!q6^eS9$D%6Y4X=ffXPmu&E&@E&x^O1{w?NQSx%8howXqv5 z-DmT$uYgBq>uccrx!G!v6+E;vsjbQjALp0|sWuPX_P4YiI_D#9MQ4C1lGuteCAj|R zNSw8lr#;eZ(u{g^hWH7vn8`AO*Yc&ENS^UJ^m-RI_pY~7nfm*DTyE(WV}&~xAdo!g zT&n1Q3$`t~zZ~gW9TvdMI5xp2aj~)6BL?Jd&{%~vtM$nxfvrYOd;v}QL^>8sDUtjf z+tNYaN$BG{ZIOCCj}CX)msK7xZ9Vz;9I>63zd6JxFx(1lLq6#J+d_ABVZW!o*KF<$ zw~@8V;wG*c=#>1nL%$UUtP)h|}zC`9W>d^(Ff|z?tw&nhTu^o2PK4$%htyjVAO+s_eac zAC6$3Txspke3k7AvOJ?3glc1=yWMVFY@UV6+AErD{u3<&=YaQr?r6!izS73>?klhy za8>-r=AzQ4^=9XAngIQ)*T{HLVT_!Jn7f_otwyEg+$BU^A zztRWHVqsP5#jSAZ`+yu!yL68b&ls2p6y_Vi8%tM^TR3nxU(p!UO9!N5sqwBd{Er2g z88~j|{d3&~rv3NDr=C2T2}9r?rC|MsDTbp1VnD}P=s^;=3`N;d0jK>#EjOAC5XpZ% z$8T!GSe8LHAV*~o5izn%03ap41wNt9#D?QeH(0r$4ki7y*5!zm8X2ldNpj>q6g*#! zJu<{dA^L7CT*7fQ{>S`B4f*!5|1!(c*b_VbehCPUdDm4X8LM2>{%5=FzE+p2&e8V? zH@bf3D&dLd=X2CJ8Ir#vbNpH(FW;owrL!!*AR@x`Z??|S+)d!o`OQ0o3B zpZT$4@hg*#J8nPgpKk?S2T|8tN)jPB7M1kBzlnox8uAUl85UUOb9bS?kRtSpAv(~S zA$So3lBR2jh>yU>o3bU8aPU>0w0-UWy@VGl&wn?#bs)0C_p!XBB++-3H}`c7RF8<# z!$ZNi+_(F(e4V{)W@N;$IPDOHZk3^e3bV?$zc40_f027(OCN0E^Gl40z%51Mn#ix7 zmNi|?cw(lm&R%byC8)^LCBI*p8c$Cz{lUQYDBR0ldhWjZ@NxhqcKGvUyW0byu#c%_zuL_&-*_go zHPX*s`(cJ$S`mM)F+h=m!Kht3khL)gs)W`sYTj{RMm-M_^=P*jRfbYugNOu857UAJ z*25sQ2?^#yU+hdg2VJR<7~m%894&+yD zl@lZkFC>Kft(b~+U?YitBAl?1e;)~vhs@yhm9-bhO#?6{+AV>-(UK@p8#wT}y+1&W z+^b)RLLHKT4C4nWPw5MW#!J zsr`Ndv>XPB2Sjhm{Y;4%jx6YVe6xxD(cQ*!1=C*9)2NkW2*OmbCO7~e4J~9) zI{6(n#={io+7tGJPMNs}bSXgJ6xKX69)^)_ue$k~i7xFn>@aIa>zVVhqpK~Cj~@k| zJk5ZZ3u|XNyZ6D?z(T=pncGV(nf`VG+^HUK`+;0i9*;vJHdwG4mCmo&7i`Zj5M;ZNFMl7dNJd> z+TV#=p0bl)eFMB*^$x)$)tOJa^Oh5r(ep30)=5)i)5Zp+4b2)#Mb_6+mVZOGySVFa z!alsz=w=;MG8TCAI^E4xIGDer+&Y2Vm>a`}y?pRx;Sc90i&Zho*IR}C?SPj_l7(IO z(8@uN&?+Uelc>MN3jhR{G6WOtkYg#eEv{G#_LJ)U;0@xuQtt+ zy_Be(iq*b^XH{gjx`$?|2*Yf^_IciM`jh?sf$|7lIn-8W@Xe4E3sw6-D}D~7!E+o%Nb6j^`ItAcNn+LNX_yTD=;2LI8QR-N zL0kE^@nxqTqQWk6P47>?8h5{Q?rc`9wGGP`lDt4N?lo}1&0fABwb5Qk zGH^LK3B?v5gGJON;MzX_Tm5`+mr<&Peu+lHlTEX+S>bnFTuEV|h~(oz5{qp$SNqa4 zdS?cY0=>`R2M~w~FI51^i;I+Pbue{+=f1~>Lj+T;SJx?l$D=-PjTg|zOln|GzDMZB z9r7@AeJz=H7}R@}^c|ouHR1tcmMQfR$v;*XS828afjv*~gIfuIaa&;Tl}HupBu}h^ z66hp^uWT`)4CJ*7Gi@ncNaEh+^KFw@nGa(LNy5glGpVLyMScF@eJ?PE;^%!nvZak| zBuaAo%d1QdZ9!$LC3YSPU~9C?v2l;`{84J+k~fxJi)lM`f%?@nXEDs^5FcE6AnIXn zK|5kQuff2?0SEQZ+Xywvk#%frf8%XDK|zWB&gg?iQzP1%1xjQgmb?VOrR?GAT1No< z)$T_=fnYixKUEcTZSC5@%N&L2pjYxmvc`=0!L`G3RM188gwERbYr0;%!)MU5y52?a zZ;0%0o+J-ias+J5{D;H=#{jvpwaECHNp@}a`)4*v8H+! z>Wr^5nO59a#*%LY#%}o|_<6V^`_Y9sf)=awwf2m^26Jcnr7Ku?P?zHbzUQbu20~hY zu2k99=Xudo!bMnl&G=@pzR}8PPyJd)`+lX=yuyRTOVG%ON$ubuKV+v}&O=Gh(G!h> z56G$d^EG~bVO(-O``gbyVsF5%q4YH;1x*V$bfz5PRie|_u->l^Xr?t*JW}z6uInQ@ zBOL*bzK6x-{~{xax`V?LqM0sY%cB|x-#fyVcY3_VTx%v@Ah(8q#i*7zSQ*4*9%|Fu z(!dQ|oq$vgP8RO=@i{OUawEj`=UmmVvQg*y$ZvgtD!XRyz=r+A|zR7 zZVbPGJs(ggPUsZN6^SYhM@2zsd8DYovCTt5c4mhzIewrxi7`qR+KSJ@@W?C(t?1YH zljnADJPx$oCV(7zx&IxA{jFIE!U2|WvhN2U#VyL-Up;bbZ}?Nz9TV3_2wbDvPlOJx4Ets^|>{NEqJw4P6u5Ip3k zp#0fzIg~qbXfggyd27JH68==ew$l4(Z`=m4!YYmTL5vuTpRE*+iWb@w^p+k}6Kh>f zDmR^6Qt(7{I@|k(lQ?Qim)m@2tfCe>N=a2pu7c>23OZCnz3TPFWpc+;c}R-~VkE|v ziS!>dC`<}|#*B>Ms6^C$qkL{6)%Lrvr#vt-G9Ld8M9t*XSiNnr-g>g<^uuX&@rm8z z{1hI)ymv!X;dO z-lT%kgyJyoY*{IcUnQKzYrKeU4cSgH&GwG|Qw&k9ra$xTkiAU_sNqnm)+qdnf*}_1mg8{Cg{+6pj zv%`0emrNyq_gs&V6Kx+TNb=9r^(|!EE}-{HtFOh*)ToOB>WCo9<_|=IbJzHQn>erl z{z(*nbz?$r`Ww~JGq>KWb59V3U<_RCk8YAQJPVpt6HW+K@Axj7uG>uW6=+vox$ z-xLnb4UE7@Wu%-R3;s%=VmVl@TADDHghd@vNB_LpgxjW?lHldHX!DLgHmb4z-n<+q za}#1uU8Hc0LafR}d1lf-@ zi_FF?^c7u3IR|f&F@&Iq?Oz!F+xe=T*zM=$@Y)lUm6Gd^rLzyrdb&6=|FuGp*O8C@ z=hE?$P-Nno0msTh+L<|e+UqEckF!{V?}Q@YFblJK#dXunf#L;vzt}goKPEpH&5SHO zCSID!$td!YiOUJ)5&z-@dfZ48au0B&tiF5lc=`WS9p0z<2i|N}l|qO9s#Vi7IlGPW zIQ5^$w%2&`S^iRtK_{io$q z%NIJ|o9OKXCAIy`x~cs2Qx6v5H+x}?9kZbZdpg@2=iD9I<3s8RZC7{?yjC>EIY4o4 zd2Cud=0FCRyBkxydj?4j@+NwMtz&Izj1PZ_XvU2`8R|eTlp%S@_h8`1D{-jcqnBsu z@|z^htr6bjpERpN1CD0sWGcZ;`OFzzxr!6}=gAMBCLD<@s1l3Hc7dJK4Ou4+(4Y(c#}GSs}q;P6>i?aJngb1OFGG8ap_Sxvw!hpwr4{wWQ3cMc6^9HRkM1|M8Cr0sILH;Dl?% zaF#D-vk8K$r+*kPq=IUSxv*4jF^~s+-i^JK6mS1hK(ntvEXJTqy;=L2gJuAE^nd&1 zl?S30rQ1Up*9-{Nfh6|fW!ha0&f(p5xTTL6fODmNU8Z{#enDVI^{txnvdU>%@1p}OJN}sxeBnK?V$B!3z z8M3*T97VW0Sf=Bm&J-Y{)!DOLbZwQ<+S5~au{jrHBA0`Mf5M%HKRX8HA&w{l79)HL z!DeaW!7i{V4%xfJq@0GUp7j23Dw#C}p44Bz41{zo(>er-=+j4S4vz-L{R5H0+k_6% zlzwax0$H=f{D~*Zsp(zDs+v-Bmd44t`yY?yr)9(LnpW1L-(!WdhmQpYjSVRow^iK9 z!=%R}awB9pEzf85w53oRX=i4})$2bA6bi8agcf4AN|oFu?^;(J(3VtIK(_sDpw!0P zK$)#M0XH#n%hHsiRnv$Xsei8ln*4NR?LwA+I^uYQV>1PU&ZB;1f=$4HSpO&aoK^C` zP*9LozKfyk(TTJ37uf7x&VxT3Ioc!CCIUwUio!>QJ=g^Lge0(l5g+h2Jhpm(GAIGG z61zQC57d9X&cXqBg$F1*M`ZMogLpneRlVKlhH1wH z(3h$4Ewmt6hE#?NAz%oRu=wF|70O%!@H`%JzZLM$h%NE9Wm7%wtnz@8r1A>36N1 ze(8qM#r27?;4m_B@dfu=c;f0A=$d2?oe{eB6IJKS=s6sD$!u&>IFb>=^#Pb>xMN7}8*?03U&!RertJ9TD@j5WE>)Gi`wYgwO^WZgv?^gyY-3e(W6?cV zA3H@3EMslF$KC!&qRY4kHsgTVE@pX+6Gf*{*@mt0C2L0hu#X*{Tyge_}Qnw zy)`*Rhf^d=o-WhwHZ%Sd@bSbAnJ~uby5_jdk^WEHzimY;(+J>9{UYHP<2%dZ4o64F z$0PnuG^UCHE1CkwTY@CZAQln+f@g?VQ8DZqfwqRdSBCq{VHOd~T#8Kc6jk`Fb2zw9 z?fUam=P=lZJYsR8e}-=w_CkG|+G&OeG5@4ViC+?q*UY6jAo#r7zcs)4KU zzAO3g+S(b(`?EZ*Xo?Wjz>qgjy_?V%Zcfj*8i|D+7#lolKINvK_8HGR;mO(Xt`yffH@nBozE@Tf zyiJFBO9dA|@7(vA`|A1f>DYK`4;iodi5A5oj&!8C<8~$FbEutfN6=aXc>Fi2R*njn zd9Om>^B4S$<9Xr8m>m@3V*_I{*YiSQZ}5UYqOU^?~T8fARF!Iba8 z(f^%qBPnJMl_(^YeTOhGL3vWs2q^RT=KIZ4<_T1yZr#l8kR)))=>UN` z0Mqz&i>9HKsv91(evh&ea{I)18;$Q=Q`jN4j^`$fUwDfF$2#$)X?yPpsZ=oZEpdTIQfaiy3c+ zrm(+`Kfs_sh)YOX)!HBY0SBTaF&xR^%u;+Fx$YqRc1@!wSFV2`0GAKwZ@C%Zv>4Fd zrYMnttufp&ku9vLDr*HC~?)KLD0Ib zXNw;Qx|VxDRL81CB6$8y;}({x<02n}H0bDCn{VMz%O=$Ws|w$k^Q>RL z-s=3unUWB}b9%2Bc%U@lD^(K&Imph`+_%i(&?M{rA@Ji%4Yu|0@91falvLB~HzSp1 za7eghGFb@T8moSPKP{OC23+)DXx3+30fiZ=3MU9lKG&DSnW%e*{UY$MGMxoae45Mh z&@b+IzWwrMjWpZdXB6T;s$BT1XLXs(DHChaNCK*~bLYrpy6Xe&^cD#!@+s*Vp_Ux3 zU6ySF17V>#;?V*cSU!F1g(gHB!npjIJU!=a^n)I7#9=Qs9WAZv$(43<#nwj1tzxCa z4$-$?9;ZVce;R#_x3eqYPH>N)^{S0FkBS`?Itkn;Yg9ph`K% zG#i0+0J|II%3AGXmo}W~(iv@razH^v`T@7l@l(AMAn_q*}^`8~0^$Elyd?eeBIDDeI1Rrh~!nMYv{;9bWK zuVp&j>-U1?vb5p`7XCvU9yyIi)AI-CreP}6C2~K-pY>uTq0Keq{-}q`ZJ_G)6wCM; zin%YE=2pLs;Us8c{w}zV&L+q%M_2wv9naqQH30pLlSkpD9mOUt=cNB0V}-^a_soM} zC5RoEQMKAM>m?G_Bc)xN$8>&>!WNBKo$}#X6k4x$+iO6-ec>&Y9+cV%4!dD8rGAhC z$2x=OK~x@kL3MNYDnw%Tt9@5zB#^)WGq_neG06TCk_!HGl}-Vx)J}k!R!yWinsZZ< zrrAFB3(O4D>>Uq5IdtQMI*y7C^Zd}UJu)v>b#H$r??beD@|Nnz1YALUhq|VwCUaVJ zB6!93ccof1rdMKd4&0;^5WH(CG8#Dw4$F6P8egW3u&5Xrztp1}50H!{D1iwnLG4)I zdr_+z@I&msQQHZ9Rgx3*Ap{?4W+2W{m(6mdM2b-;l zS&ZhcfzDqElMcQyOd|b+{RyuW>B6xT&E<7LEYpbuGbXECML*&`(4^`0n{sb!ON_|v zV|%jYR{lmM%;3^;bGQdfx5iPFiozmG@G^sYV_Rkv)s5u9}4{rqQ*@AlNN`+Fz@^=Ac*h%GT{G(tH}ngweY2qOd;bv zD*jK-xTM!YpkA*&zaUOxC!+t%lhK%KWl^f;@brAZKGR(>ZHOA{@d6Y1$PZX}%NGg& z4)6tY|GS{CFjj&+DtH={x)Kmt1R=|VVdhwXLp01Y5Z*sIAk-lTm;Vkla$bNj@n`|w zzN;Pf0q={0ejzJ(;i>uE*;>1op8!QONz|y&&6>m!#J+X z{nNmXlv3Um!<6);s#O5YG+@!tMrtPV1CR!?uE$rx4&DX5lyY0lb~uqD3?|1}Uqmk2 zTNCgidURLlXI@ZYnkh>!12zeXOntS5IjsL^DTM`~_Psn*bnf4KzgZHN`PS^8R~+X~ z?Fu&Oo`B!!=y`Nk`+n}cIdFpUDeJs{g^21mVCu;Gmd?QB;OuHhEHRSn7--jm;MDMq zn&oLsfI^|Kzv2PSucy;N51kv$m(Qy~CA86B#OLs$DtfN=W=a|qmD&5txOq{{L8fEV z)6+rcWE9E~gFb;3jR~UM2}@mF=!d?>)$|8Ub+;Lo4ZM}vaOT{;B>{0BaUee98-A)Z zZHS>#xht9jHatl*DDZrLt|Tt7cLF5ynkbz4xsF0Nu@0A>61oxR)99zoPGmx?is-BRW`GdihB8V0L_PvG#bnkh_q!pP66?>~1F*Djmq0J?~YfK8CDw!Fh%+2cCxBI45bjmWfr;z#gv=9fNHRVVN zp2n6QD+NakvB=0rfm8R;nKl1`$!nwA{vS5gRq z>F(}aK)OK$>6At~F47|1v7nUTf~0`Ye&?Cr&g{BPu z+dW~TZ0ef02N6}`?-SlhBD@)-2(LDr4E4Ez_sSel=Re`l&Bx)u>2li7MDu|NlHVA_ z1J_X?QLn%TKFGzz6(bga^br6O6rM5$eYISB+w|+!TKeL)MI9(PnCqg+G;GwFGqp8D z!yuH3$Bg7Wm=T8kS$12MRdoa!TSv;4dHH?!O$lKU(_8Ax@23_ zPz8yCHRoJ92MD*ycPASAXK-z^n21kDuJjYT8!ShJg)vf!%727Xg-{d_4V5LmlO6(#idt6 zngp={WoGzbX}rr5n%WQhCib+<*EI>!%PFiu)%i*48s@3MQHv!?yhPfy>qF1(XT+vK zsT)62P^wdRsoeET1-jR5#h+v{rUb(69950h7q_K2Hg%DfDT#AW6Vtxfx7B~b>K-e} z#AK)GA9&A#NlD3I$dutuE+F)OS^#L2V$R_BpX2Dyt&!1OU$PYF#j@1%Z6&IQertpZ z6TDnT>z;McGjIChl=dd{nt8vaue}`)v?hbM ziG%%@mVp@o@HiC0bNK5S7F6nWRShAs#{_ZYFeJ+S;xwsol@M9sgV4Z5a5*o%08gg+ zmyRMEGy2=n!gQu%(c0+7!S=oMi=@V1qEr6eDB=-cayoe;fXWzso^~s^bfpetTlx9D zq(Y`S^tX4LAy#RS2VQ= z<{U{S6~DyBCc2#TBBs+<7no7Z{mnm#-A;`LF81*U(xZM%=G_gW)?Rw_*SC#kZS7o9 zj(|Ttt=;GUViuofjKMf7f5xDy*DFJj8;*oUX5I-1slU6XV_eRt;P{M3=2DWa?L9on zk*811J0vcqW1~O7$Fi`asb8*2KqZ!%aL0W|W6N2?&qMI!mCU~#?fYWQpZrpKEz=W5 zBL-#fhjp0pCu2!JS4(Xc1LlYEZe6nwu%k|Gusvtk*XAdTd+-a;djgoRHv;v$@UEl8 z-gN*O&*t0%HekxB(463XVr6CJbjyW56;K|IxBEigOCC?dGPpuYN#lH1MoaaWCV8v( zgB%GBJ_i*g6${uvyOB&)StI*~?krg?D`L9N?EZLX_zB#^l@!w-*E#=0XO<@giyKbe zqVJGkm-A|2|rq9{B!Y1VL*)uuov8wzEeq$%OuTaqLi|n@M6A zXplH5RJ3D2aj-{OxvszV6z--w@qr;xhFN}vWIgqF;92G?b9=`2WYt{;9F8I{mz^w) z$5xW&{KKyoZD5>os%e5uOCMy%EXgUhufFZ>{uRq|T~BBZdD^=5Nw+k0)SftprqomI zpw@=(?7Oz{p6KPKE&rRpM){-||HVJ;>QwE_FeJ~kEjwHVW!Au!jmme5u zy;RTsY#tO96}(1BQxY6zZO!Lhz_Y`gw!1W4d{V`11Yg{E7{B}QmB-a|Aisw44f*wM zXvHrD8H}b3#l=Bos1jdI9TtlB$D9y%0!`iL{Tk*s@gstbhT8-(aK7>b!e;VUh7l1s>?qwfiBe8 zC^-nXL;SnBMvYoWp*~X%()MZtjEs!?^hglwYJ9pOn)*W?NG1knH~~d5Eegmhks4@S zw-jJZ53TzX>()XB4yyy=6I-zB91lwj(S~^VEaSjeZ^UPkOo!eK#6h$9AsFeq zK1U+&m6I5=wlT4v5ll?W4PA4`vfH2nu77WzPCOtz1^|U##feWgaj1=mU*j(aXz3ZI zEwEhj`L(Jx*A8CSgzLEQI*>|;w@D|{Hon}IM-AI{%vZflu%r=ZZADe2<%nAjH})v#*aBRl?H<7Xr-AtO4EUQD#2S8UO*OSxNJQIhFixFByuLeF>+q1CEfUJ)iDb)Sk@byNUc=o8+K*{Y{ZE?cbkuh` zD|vY9{yM_GlH*ShQED6~>Vt&q-Z4@E{;Y^yZ&R>PJ3+YvSUj41wsFlBm`M4|p9C30 z#CWpWM)Y@Hzs|(ZT|X|Cn}DF}e!-ZzpNz?;$Q7}fdDeYt@-g(=udkzg2lS@bTD&iZ zKRwnZvU(-Mm%}n{Nrx0$+otXzkJPHIGVOw>!DeVk^+cXI$gAoywk%0tbu%Xxks&i^ z!$zWXZh-~rv=zM_Tz#e^O!=ZAEUrH|aJSgHV*jR0a^q^H0J+s~ zMWJ!j=0nL;x7Q)0)z~L-I?bfA(lCqP-y6guQAASRL4OlQIgCZPm!s^tTzbUBkCO!w zW)EH;t;H$2TX?q4-PoNayQ63)>Z(lv2Jhk_1uusM<(5j07P_A!Y;{GVf_||+3|dBI z{AJH>xT!SaM1CFkUzge`?u0*q>24_{)#H zfxXVWdjHIUUEs69sH{KqlV^}Ys3{Fh^;q{wD` z%G{$cPbjas*S<1;Gv~oy{`va-ESp!8hmqmzvEbj~S)^`Ikc){|e5Jhu?)jF0d_Wm~ zhVpQ05gEvchX`p&K=Fd&nD8UxcvL+jE}}em2_J2*vY>O~1?LIjbV>+~yMVJ5t5ZPn z22eDG7A_Hk=mx+P;yl@U24Q#btQK8M_V?TOn;DLOYdXf8?Cq(_r)pb}gj>u-n5ncUTipW`q8Zl|mjr52iIhZ= z_saJAWughw12`5yIy65QBBu~YGf|^AwH#izzg~JWoIoW#_tdkMf7>UsDWfS{l@R8c z4Q?~3NZ_Q=aR$5Yl3}Wn?Pxp7a-muF8~a{?Z&O?cPHN||7C(iA3iu-VTTax@7HM()m%JXC|wWfYk4YoF?-tk&<;McC? z(z8yFtCMvH!72DB&*Q3`!XEAno~B#TXu&Yr-EjrNIU;`CnM0?6=foD1KB7Hl0A1zDmL;<9x*=B+@#|y zu5mEw^jhWjzXreu%R<#Dp|aF|Omf2GUd}>7@)1(;Z(p|Y+TX>xd!vQPM~IH9=>B#o z2{5q$jdQyGDTBz!ktBgj^u7Q+B2jm3lk%Fa)3v|wkw3lx8mH9Ag9kwWDzWjMHYeng zAF6(!KnWK1iAo*y^e-**fg#s_v=iO1rLqFIfQOEib6RP$GkpP2c?=g}SL};$LqCDA znmywsdUUWkSvncZXA<5>IkM*s7)0u}^mo%DF3cXXW%x+y7YV^iFGGn@Bv=&JrX+7) zP7{n8Zg~Rk8>O#qf&lW@FhHACGL${*@lI3dVDGKv+8PC@w%2-+fW8WkmzIF{ez$)P z03==PP&>ArdcGJ1{BGUnCXfNrBPGNV@H;KEaVc$UA%W`OVML?59#J0<32m*$Dpbcn z)*O0NEd%EKE&boLPL(U$kVEY=qTlu(nX0;J@{0RDv&=vKfJ+_$z$H)9`mzP%2drz{ z_)g9_D_PI2*WUxPq1DP!C94ph7ZBcvIc@Y`Wd`XKdE!3bJ@@yVLE04CJC8Zrhg)sb zty}c}vNYC;p72|G@t1XN>OWe|jO;qi1zfzI`O0l|o%y+H=7qp2Z}9v?PN7GCpc>R_ zi2vH*@seNM=(BbDi;g+%3L83}hk);2a|HgheRpnSBm4eFO{zundC$68`j?R3M!Yn% z(}<~W6OfDQp91oPg|A%e3=Dsee4w*-bgq+nsq}%jx$QAh&A%hZI)L9hf+gWg0XNU% zZg!f|^GvBHt)ohk11d@|mPVdTr&pEusu&q{0V)+CcC@%it3@wta&^q@kruw*OwBt{ z5jtxc-LUJop5vJWX@-$Q{&GeBP+6O8)ss1kKm9=GZ1+Z>ixei@XA=m(fV-e+?5ygR z`S(w-;AnccBtHC0EQi1LdM(=5Z3PQF{|zY%zNmvp`MtuAwj^GM6oRyNsj$_{$}J=*?6ciNe(w;vWUD>2_Y~TRD5@tdeU;X!W z4?1J-M}bFl)zrr~LVZ8%+#cvtvIopche)DuyY^YXFTDweEH8ZDg0Lpw#xSwp2U!F! z7+6ZgJMe^Q;Ou@YfBj#?MA8(-u7{}3lfPK==!?eXVwU4q2zJ?MF9 zPitqf)pD24Mb>buql*<)xN*T#)$io6&gso;Y|U0Br3J0*D)ij)`FngHZXFhRJ6y*o zp_^#tD@X?4aJzGiv=h%q{5RI`pMH|dCn&YrdtOh!68POIN4)uOyY7!iH1FJQ`2Jd` z5?@^=p-z(^Qnmd`<^p%dBfc4>uz$fBu%>e_DK zbj!Qnm9JQOc}a14yZvlgXp!$}2)^i!$g-yZiiQ3HnEYoAk1fy%Tt)uTpS0o%pX7hK zqr9#x`}w-CyRZO=mUXw|AWz@fs27O6 z1~vieo4fNHbYJn0&f3}8*~SJ-YW{BaYa%tvCKsZ&0L|9!So^wUAXW5_xW4_H$$yAN zJ&Mu1c2wVwg@pwSs)m^*XU8^V-d1B{e5qZtO5v^WF-&yVDxiDV|rTr*)?h0CCZrmmb8bKbZD&UtbM??k^L0AqoyjuH<6Q_&2F!Wr-w#Y%Cf%Q zU7XXz`}+B8FF>}xBH1`Yoqr~b;Fg57lK5NFmzG6>TeHm?l3G<}nWaEXU zQ+OgDE@C)CqPIxshg{B)F}B6AwdFAzgm<+{hc31;|M7WDD<}v}OLQ9_@KrWKGI}?F zeu*eTe54sG_${mnVrFb^9&-L;H;6S!8)@kNv>K7q z_li%2sd`L%UM~|4H-?Yx9Y&I<+jKC0h%U75Gz5YdavyUlF<`Q#lwIpAEiNr6XKQ9m{=$yr)$=_L&$!8A4=xQ}UelWRT-TKq zE%y4lLv^7{*kj{#yf$c>*c#>D_kWtFLOV<#N z;Rn}+sghY3=;<1C66V6}g^dY#hG(<02Wl5Y?0cUK0Xi6kl9e<=6}Q7Y(_0-`gZv(^ z)5H-978PNF+3giS|Gxd8O_(Fo;;q@u?O;;27$YcU#oUfe3PvPl`6^W@{H!Rlz)=Z& zW7qa3=b+|j>p!vzwYAKxE=mIcGUq{;NR5#rt8Q1 zEt5v8uqd{342QCH+T%}LqFK4qRh4J9p`|p7>{260 zU$V+9zi;}6IA0#~j(IaU6Va;U6%DhRykn63_ZK-bDem)7x~N^$k=5LnAurOre0NxV z6n8rLBRy5A&)&}??ehM4P60hj=-vWj^JT>SyoXKD8w6CHzZbNkfj3mX`Ehx9x#=qT z<2Fyk!8UnwXOFAWSw64Zs}_KFJeTK_ak$SB>aS^trBeRNn=*%8Cz4d&KbmG=DDp-*2h&2MMm|M*`~E+O1c&m$LHges z`q6JkCnVr0fRq+KHKBWk)Z+?kq{(Rokdyy`b0ty$BJmE>5w&uQ{tm_ePVo{Ll=qY# zNfCxp76!Raso|d4--SL*=MS_Wu|mAR?7vwjK~m&a%>s+dG;LCU9pj;9`^iulE=XOo ztF*~+jDEV1*+y3_q^IQt__8T&gBL0#a$$Zs#VVMzi`Pe05&@-g>|(lZhy%h6ZBs&t z+=7Y63f+aVM)r4h$qD=M(1<|D2d1w;baSS&M9n2c6cKR{L4*>+j%ZqV#Ss1KnjbRx zF~I{xkc#~u;}eHkg8#qCsw$lMdfO<1B17DkcUE^E23=H{>3X?1eOmAx>G$;_Li|)i z@TIZ3BEG!6MaN;A0p`>Qw_rX5J|={hK?ux{YX(jA>#6+5hK1gYtvh$VotK>S5?7?iiSWt^Iho2s(?6(4+5Ys~kR z6`4*Xn*|R%+wDl^HIwi;p>zKN&BJ4O>2_AS^gxR9Pk!V-=APD`o|f+Jr;=7An?5_& zWW)vObLVA@C1c``)_&^Ns-t7&6a2oGgw;}$9|T&g2I}*)SSjj6tqIBhkr`iSy-*N8 zlv3Mxl{hJ`a#o3~B8w-bO6Z|rWXm}st->RjqTu_`Xs5W|DD6mJxzCAr`n}lP?DfGp z?I{bm7Se8xkQRYH1pWg;D5AGXV0YIi>(csoG)U6{1HcFyUU~NnJl}*OToR)j^YOyH zeWih{M@X06UlEVMaYNuVDH>HSv)B(cqa{H~+~op3a@cS_GUUfZH&g@Ur0WF&8PyGq z4xz~IKZz;U5LjWt+%s(XBaddA1&mbl8LQ$O0`R8AzU&)jT)3eQ1fy8tg=hbkj;~yU zFQ%_K?ioe{?^73Byy}QD-6|!>WdXN+6SI@DlBJaT}qj_e!&JL6Bj>XAU!gwBso&tF(~SEFwf?JVXe3U6g-|+VU$%bN-acAKvETef|U@ z`R3K*e6w)3-wW~6Cw8LyEjoCG9+7*sbw5#ygzs6?Gn{j|;{)8!(q4^O8$NFH8A2wI z8Owi`n8v^R&GPoGR)t=*?QWH-DEKLL_fy^TqD@LdQ^{O>zMsB9{~m&vGiS%!+&Y-i zrSSHk;e7&a>W^hZIuX_zn|F%5+G~FIc%~)`ZyV-)Wst^j=G(7`%P-76UeT3T??b2d zMp|OKiV2zI>F8gP{4hwdjs8h$qeL@%?fX#p~lObg#}SxV+5aR zr{EK0>X1QUJ-#5F1NR;_cAw}fO?_RD)x!1sU#rAq2BfTi^+0Z-+vA$X#KwBaW%3Zs z-x7GA@k{j#xJOq_hw^Hq;*LpiOSn-6qs$nb&Xb^5j@$i|y8uN4 zP6&N4^c+*~&EqEtOiOs_jqiDP8;rj`rfA_UJZdO-YgPKp&M%jNukLw-Xq%XmweFL` zfo!F!yW2PMf@*if>#F^~fBYzWMBO=}RX8X8#p`I8TjotT8BeYHS(Z%A`%V7hV0WSo zy?>0c4wXi~2A`-RWPyhVce^ao7%R&c{YoMs&yQ)5Q6gA^pV#z^`yF?zJ+pbPK4;v| z9SnvPfeDZnkXaQOB)hi4z3jioJ6 z#RxiCKi9!B1Y-Wh0QG@<5MCzGm;h;i!4Bz(JH0mu`Sel>edV7%L0)5mjF4cLS`=jy z_~>k8{>5i7s2LP5F+{RRrmgsXAOaW#z-uf{6NmRR6?*1MukBqgM~0kh5MSH zi0+x*Spo-v8mZ6U3)I_AhPTJpgMB}@$WX58IbeIJ29H(;Mz8F1g*)$rjYS{!qey1Z zdW_9TohcYK&c|gxAKPA%=qZ{1kq107=Ny zy@8f9_P%Fi*fg!m{GiEWPW7DQ`G$ zv~2sBLEsgA^vIs(ndEom_LF|kr^)#I|0oFy)k&4|e&~}FT5>zk`pT0ecoLw*UM(uO z(oWToj!o?Qsz)iGlsAugD$Z4Q?#Xp!`xL(1nBp43F!G*Fu%aib_&#@&L>LVudDeJt zku2gE>$)&;sf7vLX6>EWOIu8FlPx>uEDE3ISX?Jwuj))4uApa_R=YW&vtAC3Bs&D5 zjQsr^IXf%WE8()*okYBK1)Dg+0>)D|JN8`{E<*goa0iQYuD1ZM`$A+**!$&DWV=&G zz21`Hc+fxPgtpwxnYe2fyU?p?+MJ4H!V(vjHR?+dK;vA|#0r`2rMe zc6F*9?InS#Z@dJD;e$*0wt7>22BrFQoUfwMN+8}cO}?b~#%ZWC5!g=1^D(>-*+>N< z1K@#|k3D}T{GS$pJKZ?dn=}v|==cciab~rK9TT;IH{Y(JVG@OjZb6<7U4%fIkd!<^ zqlm#O@hS$jW^8#(=J1k30JFx;xk6})uwRrP%4-1pME`;nGWGI>Djj^2&dD;lH9HE` z9@bd+cAo_~2rc{u1VlnZueIYE=@K#R8X2t3-W{`(TKlFp^C`XiFkx-3Yya7$$OA9J zs;poQ&TTor)4>K&jJUIP3JJz z9@BQo9c+0{gvBYKKXz>LfPyQ}L zN!w2g1mA~$1?qibJ!mVp$LYpqooN6wX=Gex-1k|Cis3+5R@1bM@~7Um)ZalVThK_q$+XwYe&iL24@v-8Z$;yeo`-tzvS^B3* zsQ~kWBAzyEOfI`{z(7Z#D%ZhU2lG0&@pIjcL^&^aj5p8Vy_H+pcE-k6Jr#*cT|boA z)Oyk%tPUA|OqGSQGS>Vmfsd|Tl`2ycP>k89L*V zHmEB0i>3qScRs&1_A38<_Q5K4`p*!+BJsqDQ2jvEltuWFDDCm9>=vTvu!e~fC(Hn9 zz<}hdnGbLk?()h4+RleBRq^UW!f$4*l351XXHrXe3F|NN*E}H+OvjTp-DY3u+?Cvy zs;>0AgLUUqGtl8^>RRyy-agg3rWZZ_^&0`Ew>wqn`u{1Y$1a`~hB6Cv3!((AEcgHB zzU4}MZ5+T_#+ErEoLHsy;uWo0`G!e#?KidhhGCi!FDqyFg|sA2L8|s5RTo2#63&U| z9ko+4ts0VouCbzKP`OuRxZBLSB5o-nO(>)Yu3+KSbh@S&8> zFKfK4oSr;__Ni$7{FAs|4>{p=*YM>R%)h0BjT~wP=U>kI4&Yu2fA0DIr_$2B2=AhH<=GcO}--AKCN~x}|wK=iu#L|9Z9$F`t1-ktC zTWK#mHMFx#Et_uZxT;Ts4Rr52WMXf8D@-YZDI$sN&)$Eq5h$HfZvEmEO5e z>Q#)J(@C2zHoU5cJz^%Jd_S?cs9!VE8gEl!(UJVI;w3}CS&2IQs8{*Qk6Z0TK~5x2 zTya76WsYFf*2kJ7)QcuS?u;l5Dg_e;=bj5uYWs)e#dJkQNm@+sR6{`H|3GL+LX?nyD!p6nf<4xs8gng!yW@XH1_33%}bs zL8TxbB5y9p*9{9;Ny!G`o{E!swho+NQhP3`3gSTWDX2A(oCN-~M5rJ&G^DdOFjp~$ zgX0>5faia9DBRJWAtWYvDhducY;LUtq3(t~cG@?O%;~`w{w!!J=u1!(t+sfp zAOJW=9?f0?tm^~B>|dx`C<@g+R1vMaGrz8CNey?(S=ctD)n=Z8nHtipRPaJrjo$$C zo==J3X@W2A;$O2SCNyR|I?9>w?4F;8t&;=e=ZJ_@nSw;<>Q$#WzT&$uw?uxO_@B(I zLIb`?cgV?wS#PjYOQWxq?9mPt-&CZg8mnU{YE9u{baeDb&yc8^ato9*7wh%TFY0;E zCnN%J9hGHyq`SP*WrjmoCd{!Z?j-R3LTvBQS|Q(_o4wG^G#qM<_Z#gMnNDyk7hZe0*5sV5JTJ3E7*BnA}(&HvtP>2t&Z=Up{CwTuRnL{lab}BQ={3G(zs!V z``GBNbp}cMh}Mi(y>G2KU~55Z@9)tf(SAVkMMQku{O}9Ra~Y}dj3>ilZH@<5Ju`Eg z_=W2$skM{$8yp@C`NjZy)by$IeUoOaqavDgsiK&|OZ-acRjm=D?s`1;6is}R7~EU^Ht}ywqM}m0 z32mBY0cqWW5CKAH!(q&nHt{%BLPhUe zs?64{bW|Y$-2+O;Jj{KUj=A2mC&(oie2!#iE6ZlI zSo;@>nvRB=Y#nn?uhF>&IZ&ALlk|-_S-Y{yDt1sY#v_Xz8QD0#D|q}a9|FX?dAIQP z`Y8lR3U;d6jxKIHIYyXS5|Ub0?fHWBUq=H|V3pN%r#-csI5ymWWj&xrHbmg6y;Nex zLAxFuM0NPosix$my&fWPSC*Cv;8Izzg})x6>YdTJX!|}lc>U+k|31ja9Sa~}IeCH> z_T|-8{bTs9>tiG@RP}Ia_}Z=h-NMEp;V~&p=TBG(@zA(LSh1pIs#bYb&7I}F zaYForo2RjfnA_rd8hqJU;(LbP8_TsHeJ(9V#hkn`alUoE@(wlbq zvobi|G4S&KN))cI`vRK3`ZT$zENPnfqB0gpP_3^6Dv6d%*%9I|n9O{p=W6yoYtm@< zk64>wcb=M4@=i$TGzioPXOb;U6E1fBY4$t`#%j%*bue!U==&CrV3?h`B11~_i3Th} z6hudD;HhcZvKJ&av?Qi#hA$s!?-Dqs#?J*nza2Yb40bfXV z7_@yo9~((4GIwdZ0LCc||7md>ldddJ)K<;a4p${!(WUh&Mv4A-T!+unEmTb%)tAb^!5-P~-R0x;-f4A>bb=E& z9^x;Eon?NNU#_e!FW=m)y3jKJ5X;l>prN28NE#?i*|~}-DERg3SAEUyH8ag?uKxnm z>S_V)k-|hOJ_Eze zMpDbhigPiL0rsNX0&96FC~M5r*uuh8K`$jxfj!B{l->^DnASBm}D&z|lQ8cb}I^7S}G^F(E(z3z-?=7UbY?bY49y`fw%* zicWhp&3&ffx04I{c6RnT209@3`e;|jiU8OA!jgc9v%T&I4`aw3ia)aj1MFZ|QBhgy zGcr-pxvt3B`%Za^=G^eqSU|{Gk{r@T2R>Q{>}MLO1?+PEVPCM~*P|MEh)cHZhn_+uzahA`B!NKxL`P3tq3ZI55u0Vw9JccQG$=@Iba; zT^$`as;&+;tzUKwSvALb-OJ~(j!t%LOsX0ymfptv)?<)(^MG27;r>@;Dp|6EWzE07 z>rYXe&+#oa`Z@kZMk*gSsP`2Mclt77cUzxG+%ly`wQd$Ghx*xtOo*?+o7cP;d99oH zWd5Rabd{3afjV(`Bk#K)rH9Tu(%x(jbNFf_(2crfev$g>LQRDBXbuS*x1qw~yo7GG z9E)pT`}(B^Egqu7HuiW)zqG6~SI7gqqfDpa+maUBxmQ%?lct^aVkoxrPTbUScQLBTn zp&@cv5%bG$G;dD~g(nDhcgCL+^f-}5QyMgIFNb=*e+GjwF=Lq{V%`hcz${)rpMa&q z-ir0pM#Mas_yGGo5Kc(abK9l+PyhbGRF|j4dIUvqL-Wq4_VDEJ(ElRj{#Lj4X`L0E zPCd+R%hJRqiTB>uqALIoG1&Zt%cd@Y14_BADus~4NACQGct?kDI3+|*$s}SZBV8l2LT<82(zszb% zM5|F|QF3V_MnrT(Q^AMEMe^OWfM2( z#_H%wKezY~oeSZBD|msG`14Q}qy0o7q9OAy?2^yRh9W z8;{zjQ6X0+rjAx*0YWfk>7ZtGv^G|!mcjSY21slMDNzU}AH&f5`lZAp zd=Mv0Kc0C6rM=Z?V?xqD;MQO(V5MVOgU4Kpg}Up?%RSy+*RDCbv;3joXRv5u*s1`J zQcdgFc#`O_=$*jw*A!99s$D4359pdg?ezBc{3=@!8w)^$PNL^a(1y*sHpMj&3W@Up zQdmL*jS?%YUqsot75Og&buy6C3ARBM>;xY!&!>r6+sxDYC!i?}B9yezX0-5|>V(Ep z&xL(hZgYDfXyE>k3X_=II&gTNsZRoTG~Cjk@Wey1T(~7Z32L36Z}E;MYP4|6XF^IA zI6oc4CKYEZx0j@Z+aw!dYhBQv&afabky>)JJ|a$2oj!ngfEHNl1%1H?m68TFUm(PT z5wt%6B!Th27a+QSn;8ItTs8AP7jQa7yG2T8jIY(G!wAZ>wYvQ*G7_P$w?lJw``a_( z+|W3IvcLq_Ph({cXoN(yeRRJd_9j4@5m5t^Q%yRk&e!BMyStK5i=N7MT&m@ zR491m$GLgbI>pnK7nLRsU`Y528Kty-N_&O3xQiHVDBD0NAzWCQh>)TP!%af2fG~fb zU<6V|>Lh&BXLXKRY;71Y<7L<;PN#y;z06L=RcMhd&nr%>l$aSN`F2nif)FQum{HayweJ~P31l21Leh>vd` zeDh{Pg=C^qEAkG9rbKn+^c!E#LeFi^-hcehYS4^Dkz4u;dx|MGM7K9F`~>UE!zGXO zXmQ-g&{LW0BjqF5P{6dRMKc7H{C7c(ai3&TYXT zfsaynP4Y}dv`;a9p3~v6ilT4Y>D~2(j%K}lBvNjM!X}-T*>QDtPAV#`kt|DT!!z1| zmCLeG+6)Ezr#YX*{70SCLYf?t9(mJ(GPF3pnD9$n_6S4ChNHTS2{LO#Ob{+FML$p- zTwGpyvn8VJg+Z51Gf5YKFR?#+@rD2)@)9iFKC>{%!$YzYfxo%{Y$-(AlP_!|?dee{ zYFi}ph_BhN{BjO5Z9C+lohA32#z1`{W5-In1^So+78n6xs7_Q|27Jye?#}kcsgTfz zhrd@9i9Fp=QT-6!A}E-%(w>(uj~LD-^48@>RNM9xsM41IU{^(JtdG{J;WvIeo=$r= zvL(^94~@E61?6w^^ZtfiNtt{q@Vp3GS-tECJMKiWfA#aX5)B*AZ+?9tTb2U(x3@jW zJ%4(FQgEK4?U(coFc6UHuG{r^&qf+Ug7a+tn?8q{fo`Z@f!Ni_c02}`>#@-#~q3pY zy|gs&H-!>W)$fy{ou0-(C^P-irxb41dwWPLbrS>YdQH$vde$47G{8LU=!V$SH>GJe zAPq?IOJE;XjT+^#MZow+q{a)oD%i7DeU-YDxM@AwNM2XZwBBDHs<3t$N%8oxG@W6n zW89FbKD(WEV$mSR#)n&#RBn7+N~vmhhBylziY{P|Y=DoMMsZY9*9k<9KqF=S(HiAXUfHC-Dp`K}r3#?Hl=7ZeJ0pD{pK zKlVU~>_udTQ-s3qu)s5$iCkl?s z`wdvDiud-c>2~EqRQt^K_bj=aL@~#kD0VPL3_iY%2#>7_t5od>*ZRNPCksR!q*V}`E!9U_Iy>0mP? zBn;;}r%r(^&X_a7KQni7*GLU!OJ=Q9-|lO(dGgcatyb~&)2jWicmg8D8>ZinSv_pt zepv}sE{sRZ!|7DCw9B#0v$_~qWh-#E^J9LXizE)UDV`*hkw*)@-S1x`r`bfu^fgs} zs2y&bI_Hl1iNauovcGc?r!3ePwjoU&lwl0pRZFyz+m!?a@HL#J!U{n{;aN7Or)Jd8 zu6VroBw8dsA_nTcYa1K|S13V?i%w~Qh}Z$hZ$DM|NKm)ZDzk(DqRF{GK(R`LZZ2K2 z_JJxA&EHr`fc`tMZFv_k&^{s++PDHFyA`~{KU*I; zM+-_B$&t_5z-OJXu;S@1g^MzFRL`pmuq$aI?JR{idP?17snoYE_A1d>n!RbD!Yq8M# zF(azeS{lEC28da3ct;12+mtC~J;Zx@s5j2F@e;7RB$R6e>X0p6ZT8|GGFhY!4iaZ;7@?*6Au}#$9*F)KlZCShS zq9L?AF!QF5K4^1j-TJX<-v%0}vYHeR1<^g2dE7@-Fs~&2 zW}PwCm1W|8{}cLj9z{m+D>tSW_F~GfQY<=b@8-f!3qNxsi{CXkkzNWOv+*~3WxwWv?rSk zDZXDRT!vx${geN@&wu*8&Bkt*6Wku**IsVztO?ioPz2fbb8S&8v4@49Bc_jzkIZ1>Z+ahQ;`%eJ%@@s0XOV z*-L%Ar5IU0WB4*>w3}vG)d@2Ww!1M06*b&zJX0IVwg3qa*~ZNm|5K;kq^~kV;U_`6 z4-dAc3P`?~z)RB|3rtCxt^w}-5y7g`Vtu6c3!|4?r=5wKL7^KJyx&b_O=aKGcV$$K zr{Yplj&kO?CX*6t=gdEe+$V#rhX0C-s`n!fUp&Zmpgn%*CnQKpN)i?p4*qFdYJdCx zXgbTNsNU~yi5dVQW+bIMhx*bjAR*n|acDuhYeYImq!FI^ zKWqKo&6`ajXAYqv08@!<#7 zjWn&79w8p$>5v-I{9w8Fm@0OQ7wu(W)sk&M+Cm?SCYpscm)r zdLQkOBhUu8H+p_!{c(>F(wRsN8;15Z7t}Rx4FExM^2A`rG`dyMr%UY<{0U+h^Y>is zesUWxh#`=2p!aU5$-iP-((72jmdSDVzy(SkubcH-efgrxi%DCvI9qh4a;8$9Pi)3w znDyOh--qbpNR#`ubb>OF+Eu7%9Ps$2B>3X^{#;Y_ zNOx+>-qz>s6bbJNEXgugqiNHiG&w>Ga%VFgQu_rw;)2*n{vh%HPtQHoyF$}Y|Hr-U z7w;&rR&2kWV7{FByRJ2_dot@?Rk|(ntz(T@)ecinjk1!HTb}*}b=T23=O%aHeowuC zPhYl5V1apc^M`!3jG_r|Nq9%!*Q-qTwrGAe3c7c!6&7}mC$9x&PvWV6G1jvATN3>j z>T^A5ja;*GIn3LFX;y1% zZB$ih_g@K}!h%RB8Xnh=&Mco_mR$E~ti-+b5EM+jLpqt>{kw6Kz|R${2>PF&;_C-T56 z^W$XQ0Azk4XRBR6jt2u#lh9P?+R`c9^ngcu)I<+Eo)cj4eg_n&jYh+fA?9OSAa8G4 zIzBPTeD`XJ1NkOZbSw@Z=2euE5JHC!n|4tI3{$3?YIs=0@&qLfh)%)Us6I!5L@*dz#^qsDb|G zd6|Nn4RP8s%vl+hANfzj2_LbJMEXr*#*EaluPPHV`2E02JdHaGNoa^eYG?*H|b~hC(x@ z@nPknvCy>XQek#QksTReR^|x|Qo3BJF%G4|sqY5j*L!Mq-XRPt=Fl^|KNVyVaM)QI z#IfO`!T6}B8JZyCmqO0B?YY%J2i+JMHf&sptD}D``5luN(Ore$3>to?hUJn`O3iygk~tzltZ6(1%0Wl zHSw#wxFTjhMF|utsNS8$^Hdx3PNTsww)hflw0iW`g{bE>gLGeDiajA_6shIhOei|P zNcsyl*5$EVw}2@yZtz`O>I z4+aL_5&Z9s8o=IrE&ui#JH<+^aa<)5mPyk>`zE39=C4@x1X;@zil}~kvEUVObG;X^ zyBGBNdZ3hN3e>i%P+8E}ifmv7V4M?+Zx$$sCB`SydqXQ*_lA^evL!+L{~CL*)c?I= z0JWJw$@}!&ggRRb^aSKMCK{d<4tIElXu|=CaFL1A=7{a$o;14+Jm}gxAE3?cFnPxJ z>kZ2lBxS<=3n3yA4;mY8b|~cas$$o-2T+4Zvw)<5;^?W*?{^L>1TK&t^I$TEorN$i zazks$lNMp@up(Y4g0=^tKfe+g$c|BjIKHopIfD=v^?CX@to&MPcI869?7*^eaA3OT zdBzjPgx`l*b|VLcpsh(_9X@@{oes+88MgdwI6Mu`uf4Y@SeIBP1pd#|z*tR@z(>Nt3eqx#)&PHr2b$aJXYQSy)MN+ClJ#B5&U8N63#)5lBrl#F8gIVwxbNhWgMW0F|5v5L}z~ zc{;-(d@=1)L!D(}qFPsrjyCz%r0Rh9zB~Y)c zl(q0H;lHth0t_}4y7_K4K^2$%OM<^*+%A83x!>vYCcm&yFhIAv0q~>U2x~`{wY0DQ z=wm;yGDW&|Ic3YqiNwal+_nkutsaFDUTu8W^A|qh46aRXF0LZ5c5- zU1U!-oT>hUV!u#k&U|f^lC~I@u(z~?sk2t7i@ry0Y9on5Q&$ypjOEqr(6BfY2OpS| z+F|=3R7y%7A^qjgM-8yoT|^js4p6c7VAUs*>qkh#h~^J5e$v<`b%oYTtJJp@K0eTT z&SRuV7B%=2X>yU`IV)1Dz;+{RbjC}rz5N*3`C@eP&dPBmUb%X&mk^c`mip1qt6KsK z*2?lXK0${x$j(=zIpKNso@IBM2#8&)xN#(~|9+_C$68)&baOhOSzoH-jqDK{-z#3h zcyb-C`V z2K}S$vjvB@+n>LEJ3hCfmVNQFr^9rm{mVfo1p+u)(VAlRr@S=Yy!f!3qN=%cMD%my z)8-W=uf1=a=(555gJM@xq)D$kf`#+-%e{AWW<*dN@9tAM*SJFmg|2k6U}SZmS<7MSs7d5$NV_4(-w!f%cKWIUud8{nj%saNjAnNWKkl^* z62LQp)ujYe65^@FHkT{;*Iu5`yHt9qU^|JBjmo!H10&B;i|XWN4_4EXjy8mJ!|tWd}V|Q7CM>?-cz|Nk5tEnXhZVNcq=IfTjr-J-PGpoZQC;4*s`<8* z349o%t7zxi7WBYMfH%o{uI+>6&eQCXqva<5Yt&%7%V!V1m&*gSPAAL&3DVUI5q|a1 zuCEpdYw{wp;RgkgF!~r!Yz$o})&QqiuvwA}B#}37#}%Yxt_;MSXaBiERXo9>IFB2;+WYcJu`t2}m%R(H1FJ5g$7< zrDbe}>{?V7mc?igvk;vP>PkIBKphd`Ga)sd^)o;E(o8cIQ}M?KFkV4K7D}y67`J~0 zw3d5w$b>YGweC%d_ZlQgxTy2AuJSuQ_=dq>LvYL4_m1u{$X_x@dzbf7wf+pBnGJC- zCLIx#2xTEl5ql}5+q}-K#fU?P6u4x~kpycBr~xHFX%-FF)=o#tYGlQJN)3;1rGxhSR3FFaqu9wV|8uG0I`oW zljs!T^H#-X0(-oJP*+QyumWHArK^D=Q@Ye@_X!H*20avgrecc+#6AMy*56`0+})}C z?|-Eqb8;s~(Q-`#{d$G3Umj>%rm$OY%LLBlJr#)l;b1VQv?sXGmzg(ALUkKW(AGl> z2jk6oE`AEPwqE_Co_~<=msQ(R=<1;F-eA};FmNu&Q_0WB_PyYF#s84EwY4R3D&Q*X z>f*ZI?z?$|B|*-4A}PT0{?Tw+wQYckd+o39Rv`jKDu|fC;wqaWmP^w&Ju>2N{7II^5W zQqwm>QOhlMc^_FR9Q~%Ys1M(3R*l=6+v6Q)6?2fmR$gBtFOCuEl7_F{_A~SyBZiKe z&axor$dpQh_+a=yzHzAQz_Z6npP?zO#{&d0HAyT$lL}%$il4=LIshR4^5y(8y85}r zO5jl<3fd^33lSX%t_fb~*2fy|PSf@o*l`%M3w2cHY71-reiWV3qIT5J@S%l>V`AhI zR_>pP3v)nU$|`{=F{ssn0j7>(!2fe3)cg)j@cnK`_=UegD#JX@ERLWJ>DyY=%&^qY zYcP}j46(0UU?Z|Jo9qd~aC-8IiY)kdz00t9nk3fKA#<|}HkglgHv-SDH%QgcBtQB! zE`tCT6V;rV;Dao>Q!Mp6pS4|_>wksxNV7@4RbD;$|DB>zTNBWQcCDGojyf@J9B)K@ zooVRqJl0Z1?5$+K$Wj(1!UKg(2~e|ax_0mVm3OZlV7S7m7ms;VmceR$TE z19o6n5|efnzL#~J(<-*`ev~ac#vW5g6sC70! zTa2Y1-P|2G>@qht8 z);4=SduFs6sqm7`uI!RHF)T`#hMY1u;8%d$5?-(&?6aBj>}2UL`c50}nD&oGkJiho zqN10Qo-XbL7jb;7l4acb?=9p}Q`p;6k_nH-jde7+<|>r*I|_$}I8numYMA2J-g@Hr<>tc`EJ}>3(i)yAaPKzx8@8;?@FMg$)F1t%T ze`J@14OzS2@2R>AHzq^!WpoDt(@nxJ!fH^*J0Uf!TlyKeV67X$LlNn~Q5npKWo!>Q zYTm9vh+NIK0H*iYL}_7d#|FMxMmVrR=W?l6AU7?DmfxJgR=y?N@oY%5f`a!JHa<8DBmxqf@y47G?qcEQ` z;uUr|{44|dzHQz-=DECbtZ?OzSX7j@&PS!`-YZ{N82QU>sD6XvAzi0I(_Qde<}qQn zcdDz`yDn6h>O!T`p?>06ANS1x(aajB=StL#)pl1hYoR)RI1nO1a` z<|p0pjuXv`Bv1RBr(jdDGoM~C(Lwt6ywkaLSoo49t$d_d2NK!=7k_CD5gI?pdEuBK zQ*O>Z`e%Qi9N_hmj1nEt3#yR$!mlKNZCKmy2kz?&bN1gT%YK(7khxuyeCO z%-|<=aZ1tuM z$6+F`sE~#TG^yFuF>qA@dZz!DHy{O_B6FW+`QZKuj@qs(gOaiH`y`j0{OT{j&}xm` zsj_;liP-x^iWGr2u&J-Vl`j>c_h=*(_0r}Gp$((aqSA(H zlj3O3>j(<_%Ixgy+}wFDh+AaUfHv$w5iyZ_zp3o*5Qw_IM%~||H){8wsf>K%1F_q9 z+tVghqOA+l5D}#!`0eYJe(Xl3c*8vIElsqclt+%oyB@>U(H@g2C#l#yj;mr7Av_ zWA>QIKYIi}5~6{^{Qme@YYwdV^seA=5_JWXWHWr7lQC*sM5?tWD#~7336rI>KbY+OAK$kxfgGq6L~6Le=^Ho?F{*+i#)_Mh7%1sGkZh~^UnEt@teP& zQe*^cYN(##1UMkt2B5@F93aKg77%CMFBar$FdvQzBR~!;LQVQ}?O1{5(ozT{Au{|7 z6zdcRE(HL&k0MjxnN@!?gSvbDl!DcJ|%rtq>i2vlkJP`5~zUvKIZGFS5sJVWSJ7 zaN2}_rL~VR?#%1(i{4oKNyuu3bU6X$U4{5%diE5#@Y)0S<3GFl)suF+I_V* z4YWNYSQ^zthR^Kh)HS_xEWth^(iL4}PSxiqh)QsqV*l*o?~hgw|F(KH8NR25LF8l< zYdJRTv_NFxNlLx4oU-c|B(x8_N*NXWP4L0X<{Fp0q4SO=q?~b2K@<3$scRd; zG$cJHk(!!XZRpS62YEzzpLV>+u>LfbXfp37!|;F7`Tn0sNS-O%pw27wZV++p>v>P% z?1Qb?FDDz4`eLQ0QlvC**~oTqdmK9Bg%7sOKbdH}EcT!iqWNwt#9Mf+F)?`n(^{1Z zQ>ImNXpnfBRY+4c9)|Md0xL6LM8Jpl-d^8p(IZbk01xN0(xwff{!F{KzZ5EpEsXdh zP-oX>Sw=L-^HFmNdd9myN`S`-U^wC`38Y%}c-sDXmgQEWP7nK%(s0lSIuU^<6PUoau8@=&bOIQm!Q;{Ej{xVl-fqdh zH$&p;mj1^*05AyJ%@MxE*(nYJt$hT@V`ET-JfE*$^tZ-Bb5~w1i{N*@06j(j{&D!3 zZ{E)LsThVV9p(8Jne>4 z8N8t~2-=a1URRQ3Kt9Kfqy8Km&y6;wcG_YfL|qZO!U)}UQm|o73lZ+F7!_C}v}EvY zX>Zk-5&1(4F~Em~e6N9+ZH$exG;ENuyLD~s2SRbvE zgjZ`(kV4dY@FS?JqtQwIalf*!EHGNC;kNDmEJv=s1TP^ z`fV=EWhtKk$@{{U-pOpt>wP<0c13{+law)$*@yCZO6kIP;(WSEJkEGSh9CxS)k?1# z63WGU*IWpgeORTPoDSlf)7U)qNpk+l9gwl5TCi{S_`f3^T;nQoZAVWb!(mQE`9E`p z-ynHa6hcpg9D*~$YM`cz34|G_50nhBJ1cE&69=#?YT;wm-aZ{XCKknj@^a@dV~}~w zMhixi&Tf&{JYU|5WS3kBI(m=z9=s`qw#ON4#8PN4(pjqeOU$lzBeK^m> zSAcsHAg42=fJv@2Z1(F}`H)**%y4>(9-e;vMLHc~0KiCRPLaZNyl&As5142q$j6hp zBjhEf@4RI?x$az-ngoVnU9!5hj9J!;c+055##IZSXcX`N9k|ij$7qgBcj!NPxFjR_ zIsK@@a}ENE?q-uGu&rdX7+jZcLWpfKIkOep^wR;0@~F(qV&4; z4tO^Zc@pY_dbYvcX`Y8PU{7y3AUy{OJ4{NvcmbTzkP2hM=K763F;>6(?-dnjy4K~t z9tm$FGJRvw?yZlg7*-C27D;R81VaNPzM?4H#59?F-t1PV_HSZtI=jHl?TrhkJqll%z@$7BVg}N7M=BtU!w&T2{4~f8NHx@t*S6Gw=8CE{u;?rr`Q%gVsPz}ccJ>CR*1goyvIR8~FKtR{UyWq%dP(|Y z4Q(gu1JA=rD#b~ZQCbJYfU}DR34{aBY;P-1-YI2RMN>|QXB@vy1~`4Ap1<)|IA7-=a_0bRs* zVaBIweOa^#uo%k0!ZLGudYie0Xt=Gp#ESs9&^T=|qaD5KU^6nCeguN#bn{Bsy!;`hl=DpZyy+Zji_4cdayhL>Plkc~J z!^m=r5ZDTO_|T+tx4^#a9#eqly!_w!xm$xk5o)>Q_5pTsXiT?Q`RIKRo#LCRr+7gK zl)KZj$G_$9m7nTSTJ=n%r6~mAmo4dr2ou`Jm)h5@QjttyH7<;h4DuNfme)kLZ}kw? zP#nrv?=`{`wgSiQNm?$myeG15p{&CfUefuR3kB(~3d+)N+jiDmen?_I6Lc~@mJItZ z|Bkw?ZD(i4sU~jkk{2=f@BY`XUw>sxGeTg83?ko5tVo-?FGoj5SG4){_HhDV2@%ty z41z4eRn*3C&?$HpMH}K`XW&J_&St4>56K$9_LC;&eH@A%{?h-&x8D;yC zlNF+E8gk4B`O&9`{oU6SF>f_^MV(6m7Gi@0hzB+3F+b!Ut&pR$YYBnKC-4*3_+avZ zz2kpc;)m;K7qCsvvJp2KimP+b_zqyp1CZt?2gOPimGI3&!LuSRSsZD$*l z?7mdXCp4zC&h$P_Dxy5UFq#duX{KS+Lc6M*N1{-n7-dlD~}>2 z3+039TBAtyRgM2%OC4zWXeT}MqAjJFyA@?FU&7VS?d_Y(epJcYo;@~{6%0pPC;2M2 zT!;U+3!rFQs*_{vtIB%Qdnue?sIoYg#5UK9w*=~FoM)wd{O&vJp_k~XA}RJcs6VEZ zTe301!pL6@I50ZSl>$+&2<~fOkVzUuTi5-&R&ueC7_;`)A_)EdFxq$PXsxsZjNXVE zxp4!?B5o-VsluQt!0vpKknk!c=EHnmb-ak(&jTNIBB!sQ@;Qt3ClbSYPS$sMaK2X^ zu|23-NNiY!Dv$a>-jIjI2b&elR4v`78xcCpCvALGJ=k#XC$rnjyl}!Vc0nJ_5y1jH zD#GAzUPq7Q(9LOEvUcV(0W6_+givNFiJRD>7$5vd0f4ab8{uoVSJZJw0(=u_oP)ej z91Jo{-=ON_RVXMdEaauEaJzoW$BXX||NIQX$XY*;PcPD$EPMEK&!#|+XT*1)x9a|$ zL3Ik(pd<<(_H%aEK?*+6d-bzGAwJq2o4WEh%s#xn_mR%3Q%)|`a{QWOIsogTiu8*? z8_81GBAfpvBt4dxm3hWanp>t~W*y|@LqScZ0Qco)9C#T~MiVXg_Ya1e@)!vHGkn+izMu4MtB+{B9E4zGSrX>G0g&G3|rgggH^it{@x*X$GJ_ z=H1uCiMd*a5ct*asVf4wd-;}i)aZNO&b=c!vujB{L+zg-r!u^ z;3VzV&x^DuPua}`kXvsF?>>D>=7#uH68MjzvG^ZvKI#>XVF_^cKDy0ZUG;Aj5mlBx zbMOe+u(%tXS2{KM4Le+uJFvPmDx}3K;{f$Pg!kelvWC@AP{RyVEh&f857UEayD-l` z^@vommZ!4@vS@4NKCLGI`Ma^(GZ1Pn@e2^80{9^&W_RE1kP?VXrwG&mHrNyj=N|x` z!>78CD?9yoVcgdo4`Nm8L9#z*Zq9J6zFZh3GV0@AyRGJ?oK@saQ&hKVfVF8?F|eaC zFA+sZ*(7%6n?KL`%99-n#y@$#B61lUO#8KO`!Edfiao`EJE`%M%-;@}4z7Cf)f*-tto{t1XaLH=A?t3ZE)5caT_ z7g_Ubf#@+tvk{`LDFP0`1u5-2=X(}bV75p)3yA`eO0{XwBLtO3pDGSKm!gD7gTv?b zsGd83i5&EPG2o3pq{Bo|Vl>;y^cZ>F0C#q9xC6WO!X~=~cK92hnYOeM>5%e?Ca3K5 zuCKO*uLXk3_BWpOc7AQe-piRxc&)0eBK{9+KY&pXEDAr-d@!nb@Xv7tEAZ)43bNAIjd`27G?(- zVS=|%{;A~Q-PB*qzMjm!yzPa@@b?`p4o-=Hlc0Jciz?vwW&4wrY>yXfnVbe;tuvI- z?&FK3446;6#T}rkZ@2W+y=pymGyO3PT7y%T)}Ll$Y$E>GQu-=830F^!0M;nU1iC(? zbN~g$|G~ALY3j_B|BFZI|Jn3<`@5_Ka^YwEh%T^;<3q`wH$>jJ-=hV{EarjSYeCo6 z^v&A47kUAD=yoh4#~&8hcr-jM4yrtLVxdx&H~q%#c!P^@r_Zy*nlyo=WwJaaum&)_ z<*Y;%%=ZC1GGeemwrWC{WcQr8Iv@BsCZr<9qwyh8xa0yR0j?HQovg3V9K_xM59OTT zOe!tX6dkib4)VxzW5TZB6sv_zzCiH9kGcvch}cc*+M9+@_*+>ODKa#Y+-oL9fYisG z4UA-`Lx+sG+@fdGHot%Od43`;o&JLlbF_f$kav=5b&Clpe@t)K=ODJ653;lt`6%d- z^IFY-qy6WJN}6Wg{>A1r(XOK_U-lR>z~(uVuF60f-BXh^ldYa2Sm%n69@9jj(tabAA@2N5Y9g z?Cz_Tp5}x|)I|fd@<&mOG(A{&4SoN3)F*qaFy^4n23ZMuVk=jXf(bB<{BkVKaRYb@ z{aH(-+W}WH$J*M|T~JqjVQ$maauHJr`$z995A;iXrdL-=-LLWeY5AgGki&b%Q_ESC z_?Y1=N|N$NDvUqVuqDJ@@sNp$iBQ5kHI|~Mh8iSQgIx+C`yUQjeh(N{a3aP}Neoy#F(p)bItj}+U#@~fPHiYwh<+rRIxAyU7}4LX!HIXFIB$+(@jW~88Ft$zM} zeW5tm`%?%igU04d__=&8%k+y`m2Fes%};!P`%N&&23KHXz~ZogT_%^h4NS>J(SJQB zH@DYtXyC$B2t>Pe$YY=xZ66R&GA0Y3jkksN6VGwOX=>i;yK8t@GUCzJ%QTM9UZvK3 zoSRYm_Ws|S!YT8NZij6V?{}IaaonEzHwZE=g>X%*=my(5C2pdJs}iUP)%z7*urL#S zQgFbyox!W{Ybf6uHaNV4-VG8$kerYrgNPsWjJ1OwrHfF>hcw3oE!*;Jt!drfw!{av!CPfOZLKBYKn6G`LcaQWh~+${AKrRa$q- z1?e*v$cX%p(cGx2I0rg%8vRA?duxSGw7mM3dY<}M(Z_#qo>ZwMd6Y>Cy>%zN67=Nb z`mJaS?e)xR2nOkJ|*wMS;V3tG{I-)=ihTEwqZ`~_O!9tBixt)PNdORT6%$v zs5*|sVeY>gt8L+DI2xTAoDs5B7r4~NoJ{?KBTQn?Abgy99}p<;>Slf+4n-AOpxCp? zXJHiVt^*6+-)F9Dcs_^tT4D$Sm<0pj!bo%vLJs_n}0Ro2tcH%8Bszq}}S%TQ8X*R|G znw!OB1vt^hQ>I0q;Jw9V!lHV4&Gb&YqjJ8g^9DA&feA3}%xj^9l z=}^!>z=t(5kLJn#2hZ*L&8W(V#HI|mvR!Y*1)*;DrJ<}~rtXJY|Ajw(?Mmag`Fp<_ z8i;Rkrw)7{bkk|3`vDcB!yV%(>IbD?4fo7Xrxk$FE(xu(MM3x8_2Y}ia*?Kx4N74N z_K|z@q99jFbd_thHROqwsWKqemhEJVVY@M>VKn}0Ek+lkCCO*Z4`g%SiejbP zUk zpR+<~YBpY4{L!(vLm>y-uv$$=zULTJ%zYmkYTz?gWzIT1JG;e6hnF1QLs*tl?8`tu7NaxvIu7M9`wX_kl@mxD>grD%c#ae z&@DnQtP!YX8HgiwG-}Z5F?i4dS(`w>ZA&Y9p%;EO;`o!t6i#pvrV9safKwiF*#P`T|qeX|kN9QZn&09cr zpZF`fS=C|{cq6Ee8!X8Ei(||Jp6X_avEjBQDUS$!-uxw({z^1W=6vH3#E*9}H#avN zuBK3B>Q8ET^53x91Sw1k^IIAbj$?-tmiO?+l&*o+a#31C`~|69>7znQjoGjnUv4{7 ztwIYN3Fnc|_Hw?T?zV4pC&tG$QrYG-YWkuY2BX@3<_Mbfhr;FF)w;#pytR?+F+{!l zrpGB+Ji6u16v0Z~098$OWU#nwAykvd!iVvyPo;M*FUjazDoCSP5l>!LX#8QM0h7*B}q?Uf}I8y z?ZS;Qf=q3eNnucai=%UbV@9)tOPovL$Fnb64+SLHXNagl{eHL4cUq@Ib+fZ(W4IP4 zZykJMP|pM4y7z716)iFgC=l_>B!ZC@>2OmaTPcyD1h95Skb z*j+_lOj{({r#ba1p1U0AGV~7zCj1-!R{6^VCr3yBzD#vI0jmfRxblab1I-h}->nCl zt$LbMFkwPLJYDHN*|^9*+UD(97|0k`hpaL>zbBafGrlRaV?EVqL5l{8T=jkF)h^CU zp|+7m?nU0!8T@C$E_Win1K%1S>8{qVhKoeUISJa7i{&qL!1tg94eKz#pI{fi;f{jh zvznNTxny4&uX4C^d(IKwVKuv++66`zig8Sr@Lg?}sgyU4NlBtr;^vaq15?)a-?Cs# zaL=X;JB*JA`TIg-V)>`-KjJ02ac`C9(D_axv!>l2H*FbGm9xrnMZ z6LHsaYU++(hY~smMZZsH2rG)ZbSnv;?t7Unvj}B`sE<*->VKks(RU`F&tyuSDMNTf z(Q#}07Y64-s7eYEfy2bis-(Fz7UjoXk96Hu!_U#<7|cMpsoB`D9HQqLQS%=n5kvw1 zi4Y=_7M!p^#2Ex3Eg;91ea-9ZP9>I-!k|a3S(Y4AhK(btUFVepEr>*TiBW^Hk*L@( zsGi$)RXK2*8d8%R0*7cKBpv)4=>eiTow3Q0n`v12Cm3I;h?Mdyc)JL>pNc_I3r>L! za&!m4t>7$(Zfd5`ceS}j0B$JEs1V>E35=rA#4L)p>E5PgYKb?SE-mZ8>EB6lkW!L3 ziF%pKPXFXPwl2M({s(JhEar@*-AbgkT%6pTixJ3|k>dNT7bulHCoF>|8#aS0_y!p; z72cHul>m9P>98)+=FubM^pQ)y=bwCEXXkE+mB0Q2uo21<6@X&Al}|;tfhpq!|Gp($ zph82*M?BJ*b8L0=hazfd_7*0KevO3Vyh#qtcME${rRQ@1^<>bA5OevLT3>+B35U^X3`#MxzzIhmy0$VLS5xJygC2j+7cCSp z9g85)1$S?$8P?Oh?r1#=(t^v52;-%zjL1eCn9T;mK9_w7 z+m=V_eDBX~)iR*GMeJH>1dplz33HRmS!i_prX*P0Ep&lsUHP>YJ;B62{IT0oCZ&n9 zNJufDC?8#!OA_;*fv4oR-~yk7ty(Nr3G*_iMQ21w)0o-Xvfc43PRiAd#zqr{CRD%6 zOCyP+OprZqx#^^Zuoixz6;UWTxv$EmZpamqlUJj*BA$HvwxNa1UuTG;j*2nYSzP3l zZ(Q-g=9(bT}2gWFnlgmC}kAovC-27#I| zyGddrL3Wr#qq&jNK=VsXL|*$p?p{wRGGxOZ^tcr08V!LLKSC_iK=_Ky+P}oW84=3g z0q z^A_Qx!hx!$+Mtf05$7k^fpH!~^-$eFudDh)+nk<_$9Tc-8VlY0C%!owmnw%tzj%3h z{k;(`V`WWX1^zg(e}Y{!M?ha)Bq=zcK0ZE_z3ICU$*sNXV>Ik&ViHgJQU4L!DMTGH z(eJVm}&T31U)9|)2?-i_%uAl z1B0LT{Nn=O3Tml~4SrUO_}p)S<`U_FX;lqB?=jBqA5zl%Vp5=R4zSk4#q&VmW;_7I z=QrUL!0mmJ>KUI(^79>NyIvGD^x}kf{Yy;zQju6iM@G16xB4v`%RelGnpc&plHaq% zFXSXD(w;q7Ya08Wo~{Zbhb>8sad}IE1nSrp#$9^giuf+CMbYwzX{)~bE%uoRyTw=o zbb48#LXQ+C1Q(X`8=E$cg!cl<2PMiE38W=8l*4D-dG8AWr})!2260aZHmM7l3ZtNn zFwXKta(0BGs+3LkC6(Ljavr_AdY#%5|7)9=;Yy!*?s^-`x_e$BT^T{DH<`NyJ` zgu#b10Cy)fw8r!iShxk{BSR>=Bb4!gROvT}xLWg-7wUAEet&?}cdDd2U(y2Ld$#p8 z4LNIy{iXEgd-F!18FC=DqWEk!nLU}7(z)xSEVZMnHscfT6hVu_&Q%tkHY0PZo-2{A zt+1bKJXfQ}xYExPD=r11g3S?|^cyc@ zgQ2*bw_?3`(BBV{%;OG}$jAaUCS2V%!d*gSro}Tu)~^9q@pMx4SvtC*tMF*y4;3bQ zzP?jJgJbWA%YKXM%2dp^kC8Aq+X}eWsw{^#`bkK<;KnJeH7p>zH~yv~hjEAe?P!Jk$WNpL zj$rObMnHj|yY|z%-G|Y&#Sk#T2m_cdP6s3yI9w(LhFSEuT$k(Dk9^|F^Qx3ewsNk{hq`?vU@rcGXi1dd@j`Gu9I)%qaAUKHMOhC zZe~p%5LRr9Q?FDn|2nz(p6_>fokvwCBcKWTM8vFM0(ZoNyRfjG&f!ZCu5vC6GEsp? zc8DqpFgX(n9>0aSyCH6M5CnVZ>>jyXnjDvQ%*V#W*vKy`D(F`zI#B2p)YX3=5&Mk@ zVl+sP=^wEQ@Gw?-W5I`r$=;V+yDS2lIKlA(4mvJ_+kvWDi#tV`Vgs|4<)c8&!+!&w zCFT-5X)5xRFx^2{MfHhKc^4+CWx@N&WUxyA!0psQsL(1j}mXUW#}?$wogR%~Wt zNSQn~84!-BB(UwSRqUXz-#{EWJj`?AaI#N@@#z|Ap(BHi_E za>K}uzZ@@-R`i;@XIGR>FDduTA5ut-SzHw6M@Zt?og9wTc*1crD<~2qAm%E+riSotWnz`$TDDD-60d@| zJ|F#<`$&Y)E(?N-i>!@1);(jbBZ;ir{_0??K`cidl-C3RPOUU$cI$s;=zg$ zj50k7!-yKGxMvthXCnkjabe5}SExP>0jyIy^P32c<-xCckV7yZYkOuWFDCjL`r~^H zHYg}K@ZF*vE{|Z4HMD(#pTPsZmq$1$0)6_0wZmMX^&72WaXVOSO-($kVOvj-+Oq_O zVdyt2u(gx-q13|F;Rm*cSSJo-$hN?IXvM54ims8ws`ez92VX{uh(z*D$+?xx%A9~h z`;dIH31{T1egw1Be^?aVZwEx~3PU4GVk^hTV_>n+xMCx6WoVCq>Ps+}BsK0SBy3w7 z8yx$4WWH<=HWyHHgo$0G{v@q1wOoW2@AdQLX`1t=J^iu<6o((Kf)*q}4=SoDHkS8# z-yJ+>xYS+Ax}aHNKK_skd%*fZzVV?b9BwwyoW_8p0`&+NX$71cCJ?AUyR!sj7V^*GqBv#@_(pX_cN0(YQt3nPn4#^_C> zcNedReyJm!J#b{HHMdjYOy_xj99C_p0Zq~BdQG!T?0bZ4iF%Vz9+ey&?cMc8ncV`V zLB%F}Sh8~A`RpCXrs16B4weyvRK=En%}_e4ecz{9+oKu_I({WX=vX5bi#&o%GIKCV zEae%0PBBFyAx3I=czD+v!G!w-`!yOuch@A-PK1l)XN2MK@L!cbgkMM;H)~x5#X4Fe z6UXr-)Z|O*8;#T`?2JY-lr(-;%+~uRw-IS4T|Eved6zv{XiwPZO5{YTI_oUh@8muZ zgL^bd17LU0z(otb`VBB;ja_ev7vf~TU|>FoV7k|R%L zpzc2+P!NY|a+S(WJM^ zn8iI7{t3rukj`x(pvu25j=?A)g!E!-B(i4X^VU1EbF8X4_Bd zejCilv;MTR>E!mH-Frt<-+2GroyaR0MxU9YRN1j=oXI5*I2|4x5xu+gv<{Db${H#j)RzbFy@WTK#e-|zo*bd_OIbbng~;h~irS{kHw=?0~x1nJym3F+<-PXb)9QY-M>5HRagyz@3tA=w)4`B4no;ElD$JG zSl)`r4&vcY6>fDneF<*MeCGCBkoocnc%N&+ArJ{AHnNkuXnu4*_1cU{i}Ko;Evw%O zNqdHU!RzZ}5;=*9SgV_ORG_-a<>mz-g5LQ!Yi=6W_-;yNh(@p1`ByaG!%!5s%q;j+-*)@ItPysjzGS!fFo&*Q{!BH@P?E# zi4c=Ni_EQ)l0#2q(JtFdtC}xspHG}AiF^u`i|%D;eNGFF_-5Y^u)ZGZ;9dYMFrqb> z8RB-`(lnC>oFIpIgZ*N+A0fw{46HD9-?p*k#Sx6IAfi4%2|0?e{Q7zV>4xfSg2q)x z)#`pDU0NO%IkSl>AnR9%XS<1On1ObdRHvrm5eR8`(<`=NWRye2`_Wt(r0klTp+;?0a#5%+fRFeRWtlg_sI+&J4I>e4NXn4 zcK$kl1NiM9)H+T*wlKbATr-$X@=Q-ZgRe!{H8E})e>d4DeE4X1ayWx*kn~5H@~tq{ zRssPchPmmX;(rD3wb4KpSeyKC)8L|EN!Jjk8Pr|IP;z&%(mGPRqYSl zVd`33BgzRBALXsod0xh{i9+5wW3NLvs1;jf-nUpF9w7s%MovnBw~J^EWs^BP1ZLea;^ z7EXYR62Q1KMT+z9KEmShRtB_hF=*1RQqOGcII9jO#Pcr zG8p_!eNCizLNV@avGKS+;5e2qhko+cH|w0SfpfdWS8>y?W&JLX^N0{3k0s_54FB;+ zEEK>3At8gW7sy}A?!=Y_jc;L0EH{o0dzi}&<1^`8TwH!1-D&ciPahn`D8RQs=D_xa zn{Tt6ycaij*pCJuBo5#GXm}#I{UH03G2yyEbVAe@H8(X4O&{&Khfg`Uv0gf!jZ&Rw z>I#@NmwXX>Np(!zy~!+slot70_JzRljI-xOj&^DyYp8o>s_+k+H*w|qgcoJH4^@3B zd+`T^Ckwx@YePV{H$}PJ>wJBN&VB=(FTYS{=CHTW#%XB1RG6o*UT^&F#Rt((7EGL8 zfST{W9tm};JikiS3B)k^LA4O*o-x@i4jn>8&Sk(*we>o6?7=P5q*!IiEJn_FA$J2xG0GQ z9&bTP9M;7N%HE7)E!J`A{i+$pM&7BuMRAn=e%tc5*^KtL1Hium{nrwKE+C2EH!3q& z&5Qp#JMJ{Cdbd~V0&7+n?v>O-cGv-xdG@rRzcY#l(|5m^6o(U`*K2gc!xxP8F``uA zZp1P8Tyd-&Vu}jQHJP{nz1*jxQ(-9lg@;GDz^6+FC8jgMdZs4D7)L?L-$%rsf} zpK`q=r8wEL1`^8VS6Pa`#I-m$QKuQOcaGH|U~cSxb>fn0HD4YPY8h2d*+?9|7U1sw zheSM9I%!hB>wbHA`Qoj@_<@aw7!B{t2PPk!!7LYjeSHy;w}oGCHo|W8CqI{x6yZ&z zP>Hw`6x(Zt^1p#fwEQ;~bD23CZRM2GX23O78Pcc{XstzNP{AZ@%0@23Eis10H5vIr zyli=Km#07w7WmPUhq)NDo90B-b0Fw!`WEvDK}+veowE=(?Hg8v^@cFc$o z$tCrWG6H`4*3CKx_7#(#TZd_+1j&3#yW`?J^P=4NIlyo<#G9WE^%4i^MK}YM8IG^7 zi95&^VLz-YwL?K6HE%JFcFdImlwf$drFyfQ(+>Q;NK~Oty{T7C>`misIdKI?P3`|@Dl~eT* zh*gR&bR5*i+avr(PMgJBd?cnmpd4~B)Ylr!2EkD_paD5Vkb7?_LIN>&LW~~iO_Iq$ z(&xBZLU5f86f>jk7upW3-*~PBUnLY*3d%v)ag*wbU=%sJ<4JQB7+g~ z5T+}$#G~OzD7Lx>RR%R`yt-PG2K>_0*aqcey-0BasK(M7;_Iunz*ZSmByQ4Y%P~jP z?C0;Hce35iOhnejnn}i(r6=t^tnmYtpOT=liuhIg>BiN+L$!s+J$-T*<^GFa!@pX( za^>1(B14OtSE*<%e^L?oZpErn2FcO*U$ ziAc=dX)WzZR^wqmdx6_axCN2H$3ff(l$sK9^K$oR3VVE$O|0h(?`JAaxL;9MvpOfg6;x#hVDi@VPZ*Tlp|MLE=Ij220^ws7R<43VE zPcO?_-=$s0`E&koR$4RD;TgSX@68^5hNNS+h%{EFO``}ov_?i2UYL4Je>l|Km=4vK z2FW)k0A0tX`h$^b8AGjYoM4l79wTaeTpZ~3MO*&pYkeI2OYp+hI|9(!L3}MmjA0G& z^AVScOvDe@LHO36fQl%LV5sZ^(R;zIy+ZhWER^Wnjwj6Rxd()A4Z*{VSwM;;Bhl+@ zkewh@zc|pc0~_PYZ{{nCyG%9vI~3-2b^((Tgvzk?Rj)mkxlc#U5f;l8WhVsI1q}KD z4AETOnLNC_;!^VV!I0`wahmfX1mt1rsPzq1!=>ElKn1V~zcjk~s=Ut|`Z-Ddc!IFt zKh^l?-YhrxqO$fRVp0=Xf8XESIv&%~*9v~H^mPBT8eK2p|47iCx}h2y@^5lsBe#18 zZ2~!+KRZeEstdllJq=>Q)C3d%qXGr%T=Pb}g&`QY&n9%}ugVw(b+>7W#IR?Xk6xay z2_w(pg0hSTU{%$CK6%n}ME{59DVud2ti{Qp&}(N!8J?nETj%$8HKeVwD2&!MrZfy7ZWo43$A}3{W|x65fW;V_nH2)TOFgw zu~ef3o2;ni0PgEpphpqK?gEr%jis@b`N6Sp=lfIR@ zj&a|FDAx&Zjdy87$w``{8Yec)%3@}wxsF7HcE8O&yZ=a+9=!Hg87QtiPWZ?c=zm*% zLi_tPxIw@fgZ9|}b??@|z*2dKGg`7iE-w{DD!OUQo*Grf#sdVWb3JyhMI-~+xL$=% zq((O=Uk3o}lgLkwe&FNB5#0Y-1}H4;QnO8R!awKw7Hh?OAL#mRla>QA38>Req1o{}h)HA0-le5>plMtr`9A;2Jofd)Fccj#7f7{+UB@4hRzP zyGe}O=kvHFRqJ{K_UWeJS4Qs?%R@~k7ZOl$ZxL94%^t>#9j)ZW61MheV>@8((KXIV z_**TjGH>gQ(1EOmW$U4z^*jtkb}U@&wBtP}KS3$7solW>R(9J8%Y3iq2?7-wB@>?Z zeut5VI@gcyEsv&nHN3wYVTG}r?mgPRsL+(7cYN?V>Su<0y>G=$c)2x}@=!xDkYFUfJx^{OOsKDsx7+JCyH+NexQGMN~opbs{CTa}x6g z=^$R4xoigKKI9A!T1y-vL-j;3q77A^X1Qukhf2e&0W))D=7gxlNc7)xc-7@*q2V{f z@7gV_&EAS`GyvrYyXWIVTD{n8lae%rDwoyD1;Luk?8ae9_#+$9F^liNj8BZQ2R74Y zBe!5Yc{-e)tx`<;oL#(YurnE^7f^Syjll}0~58w|Cc9(Q#AXXUTd*UmpO)~Vi*@BG2a8onuvhKm58b)HxqcEs~{k# z$@m}ALUs|;)%$I6T14W8metk}ZXjQG??qmpujc`fu>&_9aufkmPcb8h%r=APrjACT z>qySf#q>YQbD|wz_e+p6D|UT?cTbvp4`Q>=={Bs#UCvCA($^_JQG~H01 zs23Hy%N!wREUrvZROSq64l0|MbJ2bN*w^f^NvX)BT=!X|ds{+OJ%n7@`v-&TUQD8? zmr}dZ7gI%g=MN-QsXh--FFMRv09o03E1#C5flT_aPYU}zWQMoBeOHwpng0L0Vuf{? zcnHQ8HZU0+{k|UqV&yh|T2k^e$jVs%xk6KFr6tSIg?~xcBzgUwoQ1aEutrjr1T{CO zXIk}vP%x>uSeEA8Abc07ZG5Cmkiz*<=amFl`Rd2PM}N^Ufhh#yvl^KYwd|YqB`8$C z-_5mboH&C$H*C2TVlE8zjvIj*BsE3Oj)ZIPy?O0qx!^qYl^(4Vbo`(%Zt z^>d5)ugI7CrIKD-DwD|E+R8?KqVXypf8_y}(zX7s;@@0HwtXIRa{(c46-EUFa9WVj zF@P4}HtTfy3^Sl5H9GK3mq6M8iG%H(zsWSri-AxNz>Cc;Ss|L*&AIEd5 z4n32djh9adXaAHATyzl;>jn4JI#N{iobG85M474E^*%p{#sMe3m;e#0TVxT^8RX>8 zL$~c|tedd(zB$1N(WcWnK^%~pRc)kXF6nvg%#ytYE~qRv3&(l3!4BeH0vnG&*$z64 zoB&Q&Oy{DoP!$&-4*3T_;{z~}v@%E*SrBfHENTN5qC_IP|Hz&;p+iYf@hVp1-cj4x zW4ngMBZr5F0VH6+Da4sSzTQK~hvvKru{sv#c5V+SFCgpdK184MNC6qSK&_BFLY+AB zd9ihNEAt&)#mgZFhqyLU2_EISvig#ok{p=`mW=T>yE%?KoOfy!75^5mo}85H&#!;_ z7k%bbrmPw$VlTg6V?=Lt{t?@M-CD1@`1hnl%gSNrlQn|}t~ml+(-K$rnsJ)XdsY@b zou$Qk1P-%weOwVfm#{*$gWJPet%76v!x5UkRNnv22igcU|NSRZ9NCPtQzoP$r=|(j zE=o8#>he2fKY4|>@;YMP`vb16?lpN6?($d9K_4rlRGiW}@(XoSd9-!q1H(-DXB?Cf zdi5q$kssycM2tkH0#{Smw5{$H4T@_kM{9<}i(QN=XoHakG~xrc4{Cn(FD_X&Lq*zK zHIW4VUr&eqQwI=56T;%7g+NhT42)3P@@nNpJ`pm`ZCG;~DX_Ra$n=UCi4c(dB~PyH zwc_t-LI_ib2Ky=^S8zbXzWh$V^egc$H>BRfUF#;C&Cy4>#g&$;XE3@B=K6{K8Q zYweZa*OSfSZ{lzf4y&i(@d&$|XS6Oe#RFL|xVzMuG`Tc?$eOuCLvbw8`hNwFUbVM9 zr}){23PSX>dbmG|+b4U-y3nhYzsp&PBjEDeeVMdC0Z%FQd1$lV-{iAca>XIlP5TI|+Fk#rg*qqe ziYxzi{0FXo-rm_s#RNCcR(zDE>ji|l_cwcg;BEL~__9yzkK3_9Q-)4m5u4SkXl^)7~WVVOR=3n#((>ZJSaA7ny)GKb@_jqBt>L4 z%JC8sF=rEqyS$9n3%=JMM7hF-*cMTHtv17y-T{th51tx5(dRDjv0XS!E>E%@g4i=T zRo7D?X5@5`vHtRGi*B$(LA&OQT(Qps1<~i%N;_h2yCbm>l|aMFw2UCKG!9Vn>xI_z zaK2*~SL@f=F)X!LC+_iW$V?pKoW2iy0=Cs!_EXX#Y%PC0g_KCn@Js(EO~=&+arZCpwz{W9j)%M8wIZ2i#Ock4d}gjK*eE=J~Fh z9M`7S6!l{1^Dr`RE~a@6q7xWgC$~}W?=vxh13qhO_T4EYrx2AOq&oSjjh6?4-Sxjq z#Xpl9dLJZlkR#mu)L_^52+eZ`h~^mWVf=Ppdav2clF;LBT$;HlnP`|69GH~Sn;mQt zY=QFm>5(Dqavt|xnP{l=+BVt6LQlSA^Rwd&i|$4Wu-8}4nIat1t*7+aL_ndGm994- zEJON~o&8I8aCI`TS%S-Rh4`wN3u#D+iJa}3N*u64T8<*8V4yvtq}BBiVZB9 zX#%MmLF#FO4_FhC#;6$UGiTM<)jpcv32x(OS6T^fCz(KGfTd|`H53*8>Zgv9Oo9*l z+lma5xN8p%kvpCJqWZ$2zx+IdJ+$(FS8tc!_SCk&0#^V2$3PsAyh4f)xA+55mrc8) zFTg|6re!|~L}pJ128{?i5UgP_cF+k0D&im{3}FZ~IT=pT%5NU#*Lh#e_P1axA!c=_T_&VC>rgDBVdz3S-D0Wb0SCsNq#cv!U?8CXEVNUl<4lvdlNy$ z%A#=9cwWut`O8=}`SkiI@W%PTG*Me0TBYBjkWhi5Uo61H_1Rs1ne1R_FH z7ajkM4g5tyQqGz9(RjFn?_h2n!~aoZBTlP`u0`jDrN;r8BeKJ*h-Ex|Z54z{cONnhtBBQbJTtl)TC`s<0b z4k+@6^v?W z%#KV=(METT4&(tXpnr;B?z4x}7a43T<^@2aqEcYsif#tp?CoFN)K$8v-@0I8;@5p?eERR=WjzB2^_ylPGou z#a0$*ere46hRlfJ)?86sfpG)x%up%A)BGE5ddr4lE)o$H6(wub*4Oy{5Ks*80wn3IA;dXvz$@L_kN$Ikj*;GxJX42c&cDG(1lb?IKndTpbn` zYSQK2H@DX*`AGy^ydnM^4+^DZzw?dtEmAwS;A#jzJ87-y>zD^?4xDP2fj0G`zm3~d z7lSnO$Fm;iS!u$=>T~3R%n5sHIt~P_kKYW4ox-dBIU{27{1PQ94pAFptXWh4Wlrpf z#5X_dJj#KtyZV)8-_KWZ(vjv7I!?AF0ZM1D z;OZt(Z||ymeLIf@2leEmy*fB$^v*VHkp)l@D0{OW15$JnD4+zb}f=-CYU}`9sjvY4Qy{ivo_q4KiMF zN+mu@OU=EDS>1s)p)~&bF8FpH-YW#*@7Nf~&^;Fg#@~b6@6VDiSKs{iz30!9j@hL- z&5`NUURbmih2!ic?@d^B+*SvPBCf>EsfDQ!f^Hs8ScKc(%Jqd_Qn}w(3n|Y5?)*}F zD=AC`x{aMKue1r1y@57a2sbE)~fFE(3tmG4sX2z;SS5EUSoKVnDc>Yf@$JYZnO2DuCD$>{0R}5iXysY$6q$Y@fomr9J z8c(;@V2y)6Bl>l92T59B;WAFUz%!lWF@uDp?uie2t*_p^{Yvs!&_hl!GnplXUD_R}n&#QaluDoCsPW9K1 z`#cX3+ds26)pCEiv8$!7zC*l`4B{;AMqJuq4vrD@WIEX}_=S+RNVxUaY;ou@p4Zn9ErUE?j-yf0m%=3n(T= zi2BS1Zf7Bf5d2_9MpqWOieKax@)&G;R;bADf6tM>iR}7(E1+Gsc?c<2IGvzFm6VU! zJ=?U;^O{!efv+Lb;&$OVm=}#IYQu5<<383Jc?&e}?Wuxm3J=A?% zIdpk%`}@{tOQq()#9Ikt96~`O(Kvl9=K;1pF>R4vCf9&M>n*$?N6A(So_Jz9F>)T$ z{i-4g9x~5)Vyh-G8bis&T36U(d}7LD$<|8qxdVgqii!YlZv$?-{NoQL_xc74wdUsm zwdRT?dwC{e2hk>!roT;=4dw9xi>9S7QidO(B^#gTU*`rSqs<{rGTM1VYh!HHoM8mca*>N7nS!P6I0zN?rKn^+nIJ=hyNB*-6yS2&(5eN^IQsl0Ts*4w&&r z;!Hmrv+qB78&2z8JL_o3O+?!3JB5WRm((W>F^`lEllLr`NHe75d|KVJ_w)ZPd@yMvz-#{VHfAmyHX~Mn_}*U zTsadol^hxc9Z>yH2U3Ka$5GI>#J1^ZT7G;(lZ}-fOS;JqlRvA8RIOCwN+&b>K|gC` z2>wCwUWK+dCE!0sZrtBqPD>3&qGL8lbR(`mT;+}r@3+X1)KRBy_FpA(J2?>eyrD0k z>-YLq(n3=U@mUL=DB>9rFIyyeN1iv8@U;~OWZ)jvF%}Z+&S0{d2>Y&q`8S6?WHEv& zdNYJu>7z4s0$a})mV@Oy*_)PA5r;FA_GuRu4g(M4X~kcKQK_0`Gg>FqzbUbx2a`K? zCO1U@#*2Zgz5#$}Jpf4$P+`0+7_h*`YDj(-P!IsA>Fy>1i=HJnlc9_ZY45M^y48`k zm*Mq;Do;>qBw&U#L_g!)4wYiogbtUd6{WjB4TZ?yA~_NsqS|G_?u*{m;{-R_qF(AL zpZ%x~Vz`hWJiR5KC>=7us93oB_H`YHEaX#tMoMr4jd-6!WGEbKIOh)$5pJBN1G|#K zjxC@_ou#KUz>;1v(37bZmnle3umq`n8aT?eE$B1StRHR~z-twMP2FW~H30=jLq>Cu z)H{(49j%TxnLcE=A*;ma9p042F37l#&vNkzHtHVA^s`2;6n;aNQvBz6_ECp3U<8(U z@}imZ?LVP+e^cMKP?3_O7lvg3iCA6P`AZDl+C9nRC@z2)Fp>Z11c|?~Jd8=!l7z-f zv)C^@dZ46jNsGw8`5h0DIR>w)2vC9?;FSe{67M(6v!>W>gh}~6L9#5nUaKs|xsmI= zHmHW7gR${)~!2RpKVBP|2n?g7U2G?9Oznkl}706(KB zNHi#DFR&k7?_0GT2{mq|BF0XWtCP6yD-w0ji(*dpR4YFysjD0>;Yw0r#%8~G#lOb9 zF!Jp5b4AQ+TKEL7O1WOmOZuT#lF9nmDEvlFVXxShfj3u2BWUk^2scxTn+wrZLq?-E_VecCg< z>v~O-l~w47#A0Gz_{$(&%u@3{SPvD|o`m^v|D+bRIzWv`z)!WM;niE-l=1caj1p_H zMdJzn><=vuC%nm!%*JhL)|G!}FsBs~#1W4FU1+@BuX!rLUI1KYl;HIb^5PvhgKN{iNNyxX~@4R$k~+GeR6kOd&QqT%TF$w@pUBK2GZe0QA< z&2NL|uQ4D*`fXnOz)iWy;&D+sGd}iFQP(`<8s;0-K{ezSouai$9O#%wcK$p?LbD)+ zo8;wy7<>8PwWMZr@xY3r$O8_BUe?j{HES$Pl(SR3At<=U4z~7`+{$Q0;04}SL5l?r ziv?F>7Ja0tP}BYUnv zukg6YA#KycrpjafJ5!ED`N_7~je7`8SvH1+(4U4Zv|{}9mI79_FToEY^u%W7)QOs@ z(K`AKy{zfSEY4Xkzw9t?iS7W-p=i(c$6$MKvg;S#N>sZvILkxPBLj(1@fj9kfXgn;e! z249n@$J0l9hbpNAlbMf3Ml-q%Uh@|S|1n_W$NEFUJeeQe4Zl$@=KDJ?$Xj*ui^|_0ynL88zZbs<0^-(YAzd_LcAJ7w;ek+i7;uy{{{GLq=uJT+h#yr{9f_hLeXVlJRY)IqSQif{v%S9)`Gi_C9))+peZ-*-63w4+hnP?ODF>U zHQ#&WJ=|0bIw1|9Q0@}y7-z3oH~)74LfuXaNx%UXGF~}%u=!j9w7(?;X*cp>@}xPKA6UWJ1`V;xP}{HRo@Df0*&dmx(YnfISE6_~ z6&B+kJK?uLA^FoM{?KH4X9-ApELGHp*O_~S`%O!QUkzy~#@{bA>ks;;mHcviZMLgE z^}1`V*)4uX9lzmUzXE&N{y^rWk^O}6i_yIVH%XUX)4oOt6&~bws(SO53f z@$?va`Pst>YaBn_-KY<@4%*oa*;}NL3C^@mIVE`?@k;2`yDTQw_Ys-3IMY!1|3{FZ z`*u%6UR@x+YoIiLDpAOLsdlzZ%*P2s~-uJtVHVw_kllIeEhNv~*LyC3lvhQ6n|K0UpV;4s}XwSF2h~w{q-?)1H!= z{}lok`)@$uGURcdqwm*hppi^I<8&Ps=;pesO;yH5I-@Xn;7(un#@mwaHG5aOgjZYM zFx!6WnspqgM{!d%5#^Dfhg6`U`C=4@zV{v!JD=@OBSDn5hU{>?AfaGZeG@pzk7&*j*ls$s}6M-_U zQGrF$AW1wlkT%vScG`{z*9Sjg)V!x_$3YjLuzJvda`orVj*_|#)J)1ZNl1gqHfbS4 zP16&6PgQ~iX}Y42QL-Y5a1gNG|7IFkG$2ox{tF`%d;;?$@BA8g z@CkXOS&;EeGcDFW>djy-K>PGztD&Dk2G9pMERI0N8%tRd>EG{r%czr!LqMOnjXa(M zFKZDE=wKKX0lj8LxVe#pw%_N^9TzEmzE2MWUv0E}UD|A-|7I4+9bR{AEK^)>{upd{TaDCMA^_jHcc9( zvf{lK7b0is471zOfkcRIpNKE+`o6?#Riu6d3R5XS@DN6<;P*`3yaGGN@nag~CyoCI zC}?E$sLQbDlc5uUEm9C91!EoxAZ|Bcw>NwMzW`{yes3`ihyp0hEfqoYM(-p@@bA62 z`XNn!OEMJ=(n!W*KH*u%H}l##AM|CiR9GcX@96{&4MN{Q6XV7ybs~6?wfR5%NlxML zL5vDc_^_3H>W;R2hkj;Jeq7ReGX|tLX18kDTV+B$Y!89rTX;xn>n&7Egs-2h(BG9H0 z%7;2P3EK!JN7Q`5LUOgeN+BLC^be! z#Nl@%&0b*enY?NDP4G7g=u&fH}Y?^ECbh|5tI``T8N`c#x1HLLcHxH0E*MO)H zcYdBK1E$+1y?Si^;!el)Y3|JZ$!?`Hzfl=Qca9=I+rL(|!6#)+hLPjcgO{ zlz?haT$D~`s~|Z|ggVw~uGyApj_0Rb%Pl>*J+jfOzA#p8*>_rkszEq#n z4iWv7U359`6at0hgNMy!najN@RFGU=sn$H-mAGc!s&CR@v|RpvuCJXoXmLz8h2|c; zK)(C5&E5x7?g4g2RI?}?h9DOX3bMEeCfNfq@Ke^8XdvY$pHNfZ)w>dSV0&?sMHl8? z&mJHrI5&zJ!Z#4}*5YFuhSH}{eM0c~g&%uNa8$t{z%5LTc*E)YONs>LfnPima7i8( z$8S20Fl9y(&>-qQ--H4gGti5qZ{Ftq4B&rul&DSSTt@c)PU&dgw{e4YqQ@@b^^G5< zERWu>{D46jo@KLsRi334OVK^#ijP9-A>pd4D|=m@Y~ITa2X_{>f8q zmP^ksB(rgPb7S>fs;6@yMex}k+3H8uUMnXzu?c!0qOKt(dps@2mPAO=1L zq=OL1*pW^*Pz({sjSO-L90NA~L(I^2LnT@>I`-v)-0%B?pVI#z@c1cPB2ZJMawa(V zhxkpfl6S`6nE+5Rk_q4-SqWAF>daI?|&a0rfRCc#4EUefO%9EH5F=J!ovO! DpklBF literal 0 HcmV?d00001 diff --git a/assets/statusline.png b/assets/statusline.png new file mode 100644 index 0000000000000000000000000000000000000000..cf07125e5618f40167f01bdf49622ee4c2a0499b GIT binary patch literal 3731 zcmV;E4s7v>P)_${q2nY!H`0^tqCNVNBX4&s%XJtHk zhSb!}Uz^!DTYv%r0tpKY87?v!F*f-4@X*oA5E~r~5D^X+8Ct*66CosNYiLK6qhQP6 zBq%8j6&58(P8cjN95y;tw8mr8=t!5QJbZ{;!q&~r$g;DpVa(uP%HC~mY$hlvBqk?a z#@aY@f0dS!V9w(vOjJo;Vr13o@bKvf2?^fb*u}-a=H}jujEP*s*AyZp4HFb1LP>Ua zbyTpz3JnfMk)Yk)*F%b#880(AJ3268Y&SSLK|@0;RbA=n<3Wd%F*7scoJdsel` z7bq+|1T?bq1QGc`66A0Zz+LF?@0Em>k9JVJ(tfh#UAV$kI$PgWHqCn-`{B}!4p z$iZL9-Bz~ADpXt*CMqjfU|q%8U(4T4PfaaaV?jbZKZB4yKRH{#)XB-iSGmg}Kt@oi zyN{5HV$tV1c7h;2Ma#^_S-sGmq@t&%qFKAn>gwc6ovqy5)$i}<8#6eptf!ltm_$-l zprM>2MN1GG95rlr4;dS~ytYtYU`v{*zQVpfKtD-JN%HgSSi8;8(8^M-zrVn`goT1f zNl5ng@LphD=;+`@kDkKAzPGotPNlU|tG%?furOe0LQhdnl%XanEGjZIJZf`Kr?@X( zW>&Jp$<4@O#@UgQj!R8TN0g#8W^jFdd2euTWM*SbpRXn@F5uzXP@k?WHaJ#eW{HZ2 zQ($9rbaB?%(@B)0M2?&`Zh1(Ur&Lx_K7o!se~enb(WtAYMMgxUq@RO>eK~Z2v9YX2 zhm%clcuQz*GC4a{r?)paGFfG3WN>gtSX_pWjvhHaLW!1`nU!j6X-Jl(O`)+aFfc1D zCU0+PG*ekZc!M}zW=fBpPk4b*fs0d%l}3Y*x4gH5jEiY?b>!sTc!PtivaYADtD&f- z-QU>K)6H30SB#B^LVAQTN>DjpXDmNMH$Xu-Lq%Ahtw3{qYISx&c7b1OZI+&#)78*0 zVQN`fR4n$R%K!iiIY~r8RCwC#n+aSKS02YpR2vUNCMZlE+F>=UF zxD*w^pdv_B5W#wIcmSRV%32k5tykApt+j5|PwU-9Tf6!Zt+JnX+wGNJ+uiNn_nQfG zWF{Oz%11w$-{%8w=Dq*CnfG|#`TyU0gVT?H^g}17AMoPEYt-b#Q^$)JPaQ8_JaxQy z@#3lD#fzto7cX8sb-Z}-)bZlQi$xuHOnry3wA3vT8v(rrcs)gWS7@L9ijA(0JSiPD zGSmr>zD}{yDrc&A;D=i#)egBK@lu_$Gr`Wgyj7JH@YyFkdK7}PaHz9WNo?x&jCCyP z1iupwMBSHc>eipbY*9y!hto@~vUfhvXf|vbh&ql~)cL~M3Qb*hRVG2*Or=( z0cXNN<(pv0)EUvD?&d0Peu79)QydFG)ky?7wsG(XQznPMyilnk08)1b#h)nOe>`d# zi$r<_?I!K4;tOAEU)Ou!tzMG4_kxxhUa7AO!KUvuoZSFJ&%AxPxd+lQ>}Feo*<6lc z>DMpjUWe!J?JaL_+i4w)3+Q`jr8>P-3c*{HvLHJJ1`Io#W1L$cb*AD43&KMIc)2h> zL0=0ayTX|KW0nhhrs2JyR!LPmC_B|u0t{!W9`ZVpy0KCPfloqOfz-pFz8@*lK3JKZ zU9t#(aJ^0{jb~CfQRGn6MSLV=QukTlKQ6YtC={OG`^`67&kKcH+a{%^e$IsMFvg@V z@EHtqb)&{ZuX#p}*~|bhV>bk@o~DkpZ;y-4@PuA&jCl=S(3=bMPkGMfQupe+fJq%b z#36M88T{M&>jY#ftyx>NvL|B5)FFxl^3XY!U3e)50O=V39?l&ybrtB#kUEntvgnOq zoVFOXT0NDZE?9|9wM89x?FH+3UC;*V)U_cwXkJLhW$b1cmTowWVPUZBL>Mdyvb@`F zHic+bU59~1>b%`~tc950GI{}|6%a|$d;wCC0zmCapcO;vlnW7LrV{p?qGzpX3Z%dY zCdBN)Ew}jL@u=7%6dbIj?2ZwyGvhI;9`ZWc*IDopi$lT868e5rpxb9}{4W44Mwk)K z_H~X$-JG|DR@B{{;rYe+J3`@CUkZg^Uxyi6t$p2k0t_y7xH7nxpBsrJ`0rxt@yw**xd=o6}KQHNxy z;E+fvF`1OcAyYR|6^qa7;;SN2eG+1s*QqS?yT}TGP3pk@SFNbqw2r1O5DQy}Eq%p8 z*m4Y8-oBgY_r6{Z$?1eM;5H4GD0zk(E4)94OI;bsZuXfqu<{x*t_HY5!)z8Oy_2Q@2bm zm&xSvYmP$Qgm;A2)ZLMMMxQ@7^eG zl()cx`#r?D_&)w(@*(ZI{Kh*wht91g>!GgWPzT`}=SSU-dJNKDAZnDwu6B4|_qLEl z-7h6~EC>JoPutReaj2V(4V5}Ki3H-LX@_HJSGx`B$m__05QCeBOWko`o4RW#zLJ72 zAyfFiEIjI5NH4#YR;E4LU)FECgV90&D$saaWm76t2$BFtfhb|<)M;f4P_K!tj{sPU zwlL>)EvT^{>iiE=&3s97I^+374t2db(B17jLFA=BXlMAk8y3T4Njew0Kl!k!6Syz4 z40_zxt-yU9O#R&jkOsn5tA`#=38@Rnx2*VxVe8}d2x({1t3@lWx@*aL$m{x}j+4=%QCA0N9dWj(3xUFiMKbKFkgmKQDA#Mo9LsY{e}Vy*@lc?QAWIz11T ztZLHChMn02=XJkovQ6FlHQae!F`Q?qivj3K0wxbQuPcG`wUi=?hB7n@JdA-cxkzcb zOx&miNwKt@)Z<#Ihc{i%AkADLrfQg>;sBhBk9Atsl)t@nh& zd!F#%(@%w)&$B~Jn!2F3u=Hp*dOWZqOwC!`*D+R8NP9MQyAA2d8Q*f}b(Rp5LmfC+ z<+G?TiB2b~LGjvvW(IZcl^X}3PK2gp>iq=ld0kCwnjoTEiXi#8uN!nVh1##n1YM9i z&{d$*sm77}bt1y&RiY)fsADdsU`>(-%wD4+%&^J1CtN4TVV%*rxjS+HR-W518NQs- zSJfMEOl?s29dj{-q|RsI+?b6J{?bONN}XU?n@m|m(_n1PZn@Na-={UJk2<5uTeX_D ztAeCvE9rVjA1NgkNtX$vQiVIdC`nRB+Oet2>dDTo#rwye3^f%of(so7d!+&E?4%mmzr> z$=o$eVmXDT&QGpDtKTY%~Glxb)pgPtdXMb6YdvbBceZ!Ofz}vMq``YzAwVgjVg7R@0MXv*S!UO zQmI4!iG45BX>Nh1jXKBu4iovhj@`R?S!>#?ajH7jS*tW!938*u6p8=~U=@U!~gJnIrQ z3+mT+8uq-)xBr`k+s(SncPB4iBM@OWq{3f||35ar+S|ZfH-qgM14H$eHF<1FU`a5& zp6vrn-6$9Zqkww3uA1!*FxQ=rn0|8Cc~EY1K7Rc89dNEYKZotkXs#Otqk#IkuB4(1 x)UV5$GMz2B8QQO_fY8&cZ;$4>Q7{UK2LQ}JCHS!4;t2o%002ovPDHLkV1k-Y6)6A! literal 0 HcmV?d00001 diff --git a/css/base.css b/css/base.css new file mode 100644 index 00000000..5ea2fd06 --- /dev/null +++ b/css/base.css @@ -0,0 +1,270 @@ +html { + /* The nav header is 4.40625rem high, plus 20px for the margin-top of the + main container. */ + scroll-padding-top: calc(4.40625rem + 20px); +} + +body > .container { + margin-top: 20px; +} + +.navbar.fixed-top { + position: -webkit-sticky; + position: sticky; +} + +.source-links { + float: right; +} + +.col-md-9 img { + max-width: 100%; +} + +pre, code { + background: #444; + color: #e0e2e4; + border: 1px solid rgba(0,0,0,0.125); + border-radius: 0.25rem; +} + +pre { + padding: 0.5em; +} + +code { + padding: 1px 3px; +} + +pre code { + border: none; + /* Override styles from hljs theme */ + background: transparent !important; + padding: 0 !important; +} + +a code { + color: #00bc8c; +} + +a:hover code { + color: #007053; +} + +kbd { + padding: 2px 4px; + font-size: 90%; + color: #fff; + background-color: #333; + border-radius: 3px; + -webkit-box-shadow: inset 0 -1px 0 rgba(0,0,0,.25); + box-shadow: inset 0 -1px 0 rgba(0,0,0,.25); +} + +footer { + margin-top: 30px; + margin-bottom: 10px; + text-align: center; + font-weight: 200; +} + +.modal-dialog { + margin-top: 60px; +} + +/* Style the admonitions. */ + +.admonition { + margin-bottom: 1rem; + border: 1px solid rgba(0, 0, 0, 0.125); + border-radius: 0.25rem; + color: #fff; +} + +.admonition > .admonition-title { + margin: 0; + padding: 0.75rem 1rem; + background: #444; + border-bottom: 1px solid rgba(0, 0, 0, 0.125); + border-radius: calc(0.25rem - 1px) calc(0.25rem - 1px) 0 0; + font-size: 1rem; +} + +.admonition > * { + margin-left: 1rem; + margin-right: 1rem; +} + +.admonition > *:not(.admonition-title):first-of-type, +.admonition > .admonition-title + * { + margin-top: 1rem; +} + +.admonition > *:last-child { + margin-bottom: 1rem; +} + +/* Style each kind of admonition. */ + +.admonition.note, .admonition.note > .admonition-title { + border-color: #304f6f; +} + +.admonition.note > .admonition-title { + background: #375a7f; +} + +.admonition.warning, .admonition.warning > .admonition-title { + border-color: #d58910; +} + +.admonition.warning > .admonition-title { + background: #f39c12; +} + +.admonition.danger, .admonition.danger > .admonition-title { + border-color: #ca4335; +} + +.admonition.danger > .admonition-title { + background: #e74c3c; +} + +/* + * Side navigation + * + * Scrollspy and affixed enhanced navigation to highlight sections and secondary + * sections of docs content. + */ + +.bs-sidebar.affix { + position: -webkit-sticky; + position: sticky; + /* The nav header is 4.40625rem high, plus 20px for the margin-top of the + main container. */ + top: calc(4.40625rem + 20px); +} + +.bs-sidebar.card { + padding: 0; +} + +/* Toggle (vertically flip) sidebar collapse icon */ +.bs-sidebar .navbar-toggler span { + -moz-transform: scale(1, -1); + -webkit-transform: scale(1, -1); + -o-transform: scale(1, -1); + -ms-transform: scale(1, -1); + transform: scale(1, -1); +} + +.bs-sidebar .navbar-toggler.collapsed span { + -moz-transform: scale(1, 1); + -webkit-transform: scale(1, 1); + -o-transform: scale(1, 1); + -ms-transform: scale(1, 1); + transform: scale(1, 1); +} + +/* First level of nav */ +.bs-sidebar > .navbar-collapse > .nav { + padding-top: 10px; + padding-bottom: 10px; + border-radius: 5px; + width: 100%; +} + +/* All levels of nav */ +.bs-sidebar .nav > li > a { + display: block; + padding: 5px 20px; + z-index: 1; +} +.bs-sidebar .nav > li > a:hover, +.bs-sidebar .nav > li > a:focus { + text-decoration: none; + border-right: 1px solid; +} +.bs-sidebar .nav > li > a.active, +.bs-sidebar .nav > li > a.active:hover, +.bs-sidebar .nav > li > a.active:focus { + font-weight: bold; + background-color: transparent; + border-right: 1px solid; +} + +.bs-sidebar .nav .nav .nav { + margin-left: 1em; +} + +.bs-sidebar .nav > li > a { + font-weight: bold; +} + +.bs-sidebar .nav .nav > li > a { + font-weight: normal; +} + +.headerlink { + display: none; + padding-left: .5em; +} + +h1:hover .headerlink, h2:hover .headerlink, h3:hover .headerlink, h4:hover .headerlink, h5:hover .headerlink, h6:hover .headerlink{ + display:inline-block; +} + +@media (max-width: 991.98px) { + .navbar-collapse.show { + overflow-y: auto; + max-height: calc(100vh - 4.40625rem); + } +} + +.dropdown-item.open { + color: #fff; + background-color: #375a7f; +} + +.dropdown-submenu > .dropdown-menu { + margin: 0 0 0 1.5rem; + padding: 0; + border-width: 0; +} + +.dropdown-submenu > a::after { + display: block; + content: " "; + float: right; + width: 0; + height: 0; + border-color: transparent; + border-style: solid; + border-width: 5px 0 5px 5px; + border-left-color: #ccc; + margin-top: 5px; + margin-right: -10px; +} + +.dropdown-submenu:hover > a::after { + border-left-color: #404040; +} + +@media (min-width: 992px) { + .dropdown-menu { + overflow-y: auto; + max-height: calc(100vh - 4.40625rem); + } + + .dropdown-submenu { + position: relative; + } + + .dropdown-submenu > .dropdown-menu { + position: fixed !important; + margin-top: -9px; + margin-left: -2px; + border-width: 1px; + padding: 0.5rem 0; + } +} diff --git a/css/bootstrap.min.css b/css/bootstrap.min.css new file mode 100644 index 00000000..287e4b7e --- /dev/null +++ b/css/bootstrap.min.css @@ -0,0 +1,12 @@ +/*! + * Bootswatch v4.4.1 + * Homepage: https://bootswatch.com + * Copyright 2012-2019 Thomas Park + * Licensed under MIT + * Based on Bootstrap +*//*! + * Bootstrap v4.4.1 (https://getbootstrap.com/) + * Copyright 2011-2019 The Bootstrap Authors + * Copyright 2011-2019 Twitter, Inc. + * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) + */@import url("https://fonts.googleapis.com/css?family=Lato:400,700,400italic");:root{--blue: #375a7f;--indigo: #6610f2;--purple: #6f42c1;--pink: #e83e8c;--red: #E74C3C;--orange: #fd7e14;--yellow: #F39C12;--green: #00bc8c;--teal: #20c997;--cyan: #3498DB;--white: #fff;--gray: #999;--gray-dark: #303030;--primary: #375a7f;--secondary: #444;--success: #00bc8c;--info: #3498DB;--warning: #F39C12;--danger: #E74C3C;--light: #999;--dark: #303030;--breakpoint-xs: 0;--breakpoint-sm: 576px;--breakpoint-md: 768px;--breakpoint-lg: 992px;--breakpoint-xl: 1200px;--font-family-sans-serif: "Lato", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";--font-family-monospace: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace}*,*::before,*::after{-webkit-box-sizing:border-box;box-sizing:border-box}html{font-family:sans-serif;line-height:1.15;-webkit-text-size-adjust:100%;-webkit-tap-highlight-color:rgba(0,0,0,0)}article,aside,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}body{margin:0;font-family:"Lato", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";font-size:0.9375rem;font-weight:400;line-height:1.5;color:#fff;text-align:left;background-color:#222}[tabindex="-1"]:focus:not(:focus-visible){outline:0 !important}hr{-webkit-box-sizing:content-box;box-sizing:content-box;height:0;overflow:visible}h1,h2,h3,h4,h5,h6{margin-top:0;margin-bottom:0.5rem}p{margin-top:0;margin-bottom:1rem}abbr[title],abbr[data-original-title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0;text-decoration-skip-ink:none}address{margin-bottom:1rem;font-style:normal;line-height:inherit}ol,ul,dl{margin-top:0;margin-bottom:1rem}ol ol,ul ul,ol ul,ul ol{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}b,strong{font-weight:bolder}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}a{color:#00bc8c;text-decoration:none;background-color:transparent}a:hover{color:#007053;text-decoration:underline}a:not([href]){color:inherit;text-decoration:none}a:not([href]):hover{color:inherit;text-decoration:none}pre,code,kbd,samp{font-family:SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;font-size:1em}pre{margin-top:0;margin-bottom:1rem;overflow:auto}figure{margin:0 0 1rem}img{vertical-align:middle;border-style:none}svg{overflow:hidden;vertical-align:middle}table{border-collapse:collapse}caption{padding-top:0.75rem;padding-bottom:0.75rem;color:#999;text-align:left;caption-side:bottom}th{text-align:inherit}label{display:inline-block;margin-bottom:0.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}input,button,select,optgroup,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}button,input{overflow:visible}button,select{text-transform:none}select{word-wrap:normal}button,[type="button"],[type="reset"],[type="submit"]{-webkit-appearance:button}button:not(:disabled),[type="button"]:not(:disabled),[type="reset"]:not(:disabled),[type="submit"]:not(:disabled){cursor:pointer}button::-moz-focus-inner,[type="button"]::-moz-focus-inner,[type="reset"]::-moz-focus-inner,[type="submit"]::-moz-focus-inner{padding:0;border-style:none}input[type="radio"],input[type="checkbox"]{-webkit-box-sizing:border-box;box-sizing:border-box;padding:0}input[type="date"],input[type="time"],input[type="datetime-local"],input[type="month"]{-webkit-appearance:listbox}textarea{overflow:auto;resize:vertical}fieldset{min-width:0;padding:0;margin:0;border:0}legend{display:block;width:100%;max-width:100%;padding:0;margin-bottom:.5rem;font-size:1.5rem;line-height:inherit;color:inherit;white-space:normal}progress{vertical-align:baseline}[type="number"]::-webkit-inner-spin-button,[type="number"]::-webkit-outer-spin-button{height:auto}[type="search"]{outline-offset:-2px;-webkit-appearance:none}[type="search"]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{font:inherit;-webkit-appearance:button}output{display:inline-block}summary{display:list-item;cursor:pointer}template{display:none}[hidden]{display:none !important}h1,h2,h3,h4,h5,h6,.h1,.h2,.h3,.h4,.h5,.h6{margin-bottom:0.5rem;font-weight:500;line-height:1.2}h1,.h1{font-size:3rem}h2,.h2{font-size:2.5rem}h3,.h3{font-size:2rem}h4,.h4{font-size:1.40625rem}h5,.h5{font-size:1.171875rem}h6,.h6{font-size:0.9375rem}.lead{font-size:1.171875rem;font-weight:300}.display-1{font-size:6rem;font-weight:300;line-height:1.2}.display-2{font-size:5.5rem;font-weight:300;line-height:1.2}.display-3{font-size:4.5rem;font-weight:300;line-height:1.2}.display-4{font-size:3.5rem;font-weight:300;line-height:1.2}hr{margin-top:1rem;margin-bottom:1rem;border:0;border-top:1px solid rgba(0,0,0,0.1)}small,.small{font-size:80%;font-weight:400}mark,.mark{padding:0.2em;background-color:#fcf8e3}.list-unstyled{padding-left:0;list-style:none}.list-inline{padding-left:0;list-style:none}.list-inline-item{display:inline-block}.list-inline-item:not(:last-child){margin-right:0.5rem}.initialism{font-size:90%;text-transform:uppercase}.blockquote{margin-bottom:1rem;font-size:1.171875rem}.blockquote-footer{display:block;font-size:80%;color:#999}.blockquote-footer::before{content:"\2014\00A0"}.img-fluid{max-width:100%;height:auto}.img-thumbnail{padding:0.25rem;background-color:#222;border:1px solid #dee2e6;border-radius:0.25rem;max-width:100%;height:auto}.figure{display:inline-block}.figure-img{margin-bottom:0.5rem;line-height:1}.figure-caption{font-size:90%;color:#999}code{font-size:87.5%;color:#e83e8c;word-wrap:break-word}a>code{color:inherit}kbd{padding:0.2rem 0.4rem;font-size:87.5%;color:#fff;background-color:#222;border-radius:0.2rem}kbd kbd{padding:0;font-size:100%;font-weight:700}pre{display:block;font-size:87.5%;color:inherit}pre code{font-size:inherit;color:inherit;word-break:normal}.pre-scrollable{max-height:340px;overflow-y:scroll}.container{width:100%;padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media (min-width: 576px){.container{max-width:540px}}@media (min-width: 768px){.container{max-width:720px}}@media (min-width: 992px){.container{max-width:960px}}@media (min-width: 1200px){.container{max-width:1140px}}.container-fluid,.container-sm,.container-md,.container-lg,.container-xl{width:100%;padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media (min-width: 576px){.container,.container-sm{max-width:540px}}@media (min-width: 768px){.container,.container-sm,.container-md{max-width:720px}}@media (min-width: 992px){.container,.container-sm,.container-md,.container-lg{max-width:960px}}@media (min-width: 1200px){.container,.container-sm,.container-md,.container-lg,.container-xl{max-width:1140px}}.row{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;margin-right:-15px;margin-left:-15px}.no-gutters{margin-right:0;margin-left:0}.no-gutters>.col,.no-gutters>[class*="col-"]{padding-right:0;padding-left:0}.col-1,.col-2,.col-3,.col-4,.col-5,.col-6,.col-7,.col-8,.col-9,.col-10,.col-11,.col-12,.col,.col-auto,.col-sm-1,.col-sm-2,.col-sm-3,.col-sm-4,.col-sm-5,.col-sm-6,.col-sm-7,.col-sm-8,.col-sm-9,.col-sm-10,.col-sm-11,.col-sm-12,.col-sm,.col-sm-auto,.col-md-1,.col-md-2,.col-md-3,.col-md-4,.col-md-5,.col-md-6,.col-md-7,.col-md-8,.col-md-9,.col-md-10,.col-md-11,.col-md-12,.col-md,.col-md-auto,.col-lg-1,.col-lg-2,.col-lg-3,.col-lg-4,.col-lg-5,.col-lg-6,.col-lg-7,.col-lg-8,.col-lg-9,.col-lg-10,.col-lg-11,.col-lg-12,.col-lg,.col-lg-auto,.col-xl-1,.col-xl-2,.col-xl-3,.col-xl-4,.col-xl-5,.col-xl-6,.col-xl-7,.col-xl-8,.col-xl-9,.col-xl-10,.col-xl-11,.col-xl-12,.col-xl,.col-xl-auto{position:relative;width:100%;padding-right:15px;padding-left:15px}.col{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.row-cols-1>*{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.row-cols-2>*{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.row-cols-3>*{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.row-cols-4>*{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.row-cols-5>*{-webkit-box-flex:0;-ms-flex:0 0 20%;flex:0 0 20%;max-width:20%}.row-cols-6>*{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-1{margin-left:8.3333333333%}.offset-2{margin-left:16.6666666667%}.offset-3{margin-left:25%}.offset-4{margin-left:33.3333333333%}.offset-5{margin-left:41.6666666667%}.offset-6{margin-left:50%}.offset-7{margin-left:58.3333333333%}.offset-8{margin-left:66.6666666667%}.offset-9{margin-left:75%}.offset-10{margin-left:83.3333333333%}.offset-11{margin-left:91.6666666667%}@media (min-width: 576px){.col-sm{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.row-cols-sm-1>*{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.row-cols-sm-2>*{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.row-cols-sm-3>*{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.row-cols-sm-4>*{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.row-cols-sm-5>*{-webkit-box-flex:0;-ms-flex:0 0 20%;flex:0 0 20%;max-width:20%}.row-cols-sm-6>*{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-sm-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-sm-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-sm-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-sm-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-sm-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-sm-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-sm-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-sm-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-sm-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-sm-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-sm-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-sm-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-sm-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-sm-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-sm-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-sm-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-sm-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-sm-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-sm-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-sm-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-sm-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-sm-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-sm-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-sm-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-sm-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-sm-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-sm-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-sm-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-sm-0{margin-left:0}.offset-sm-1{margin-left:8.3333333333%}.offset-sm-2{margin-left:16.6666666667%}.offset-sm-3{margin-left:25%}.offset-sm-4{margin-left:33.3333333333%}.offset-sm-5{margin-left:41.6666666667%}.offset-sm-6{margin-left:50%}.offset-sm-7{margin-left:58.3333333333%}.offset-sm-8{margin-left:66.6666666667%}.offset-sm-9{margin-left:75%}.offset-sm-10{margin-left:83.3333333333%}.offset-sm-11{margin-left:91.6666666667%}}@media (min-width: 768px){.col-md{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.row-cols-md-1>*{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.row-cols-md-2>*{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.row-cols-md-3>*{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.row-cols-md-4>*{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.row-cols-md-5>*{-webkit-box-flex:0;-ms-flex:0 0 20%;flex:0 0 20%;max-width:20%}.row-cols-md-6>*{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-md-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-md-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-md-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-md-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-md-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-md-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-md-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-md-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-md-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-md-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-md-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-md-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-md-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-md-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-md-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-md-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-md-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-md-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-md-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-md-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-md-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-md-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-md-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-md-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-md-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-md-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-md-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-md-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-md-0{margin-left:0}.offset-md-1{margin-left:8.3333333333%}.offset-md-2{margin-left:16.6666666667%}.offset-md-3{margin-left:25%}.offset-md-4{margin-left:33.3333333333%}.offset-md-5{margin-left:41.6666666667%}.offset-md-6{margin-left:50%}.offset-md-7{margin-left:58.3333333333%}.offset-md-8{margin-left:66.6666666667%}.offset-md-9{margin-left:75%}.offset-md-10{margin-left:83.3333333333%}.offset-md-11{margin-left:91.6666666667%}}@media (min-width: 992px){.col-lg{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.row-cols-lg-1>*{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.row-cols-lg-2>*{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.row-cols-lg-3>*{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.row-cols-lg-4>*{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.row-cols-lg-5>*{-webkit-box-flex:0;-ms-flex:0 0 20%;flex:0 0 20%;max-width:20%}.row-cols-lg-6>*{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-lg-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-lg-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-lg-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-lg-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-lg-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-lg-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-lg-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-lg-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-lg-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-lg-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-lg-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-lg-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-lg-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-lg-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-lg-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-lg-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-lg-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-lg-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-lg-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-lg-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-lg-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-lg-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-lg-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-lg-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-lg-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-lg-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-lg-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-lg-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-lg-0{margin-left:0}.offset-lg-1{margin-left:8.3333333333%}.offset-lg-2{margin-left:16.6666666667%}.offset-lg-3{margin-left:25%}.offset-lg-4{margin-left:33.3333333333%}.offset-lg-5{margin-left:41.6666666667%}.offset-lg-6{margin-left:50%}.offset-lg-7{margin-left:58.3333333333%}.offset-lg-8{margin-left:66.6666666667%}.offset-lg-9{margin-left:75%}.offset-lg-10{margin-left:83.3333333333%}.offset-lg-11{margin-left:91.6666666667%}}@media (min-width: 1200px){.col-xl{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;max-width:100%}.row-cols-xl-1>*{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.row-cols-xl-2>*{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.row-cols-xl-3>*{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.row-cols-xl-4>*{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.row-cols-xl-5>*{-webkit-box-flex:0;-ms-flex:0 0 20%;flex:0 0 20%;max-width:20%}.row-cols-xl-6>*{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-xl-auto{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:auto;max-width:100%}.col-xl-1{-webkit-box-flex:0;-ms-flex:0 0 8.3333333333%;flex:0 0 8.3333333333%;max-width:8.3333333333%}.col-xl-2{-webkit-box-flex:0;-ms-flex:0 0 16.6666666667%;flex:0 0 16.6666666667%;max-width:16.6666666667%}.col-xl-3{-webkit-box-flex:0;-ms-flex:0 0 25%;flex:0 0 25%;max-width:25%}.col-xl-4{-webkit-box-flex:0;-ms-flex:0 0 33.3333333333%;flex:0 0 33.3333333333%;max-width:33.3333333333%}.col-xl-5{-webkit-box-flex:0;-ms-flex:0 0 41.6666666667%;flex:0 0 41.6666666667%;max-width:41.6666666667%}.col-xl-6{-webkit-box-flex:0;-ms-flex:0 0 50%;flex:0 0 50%;max-width:50%}.col-xl-7{-webkit-box-flex:0;-ms-flex:0 0 58.3333333333%;flex:0 0 58.3333333333%;max-width:58.3333333333%}.col-xl-8{-webkit-box-flex:0;-ms-flex:0 0 66.6666666667%;flex:0 0 66.6666666667%;max-width:66.6666666667%}.col-xl-9{-webkit-box-flex:0;-ms-flex:0 0 75%;flex:0 0 75%;max-width:75%}.col-xl-10{-webkit-box-flex:0;-ms-flex:0 0 83.3333333333%;flex:0 0 83.3333333333%;max-width:83.3333333333%}.col-xl-11{-webkit-box-flex:0;-ms-flex:0 0 91.6666666667%;flex:0 0 91.6666666667%;max-width:91.6666666667%}.col-xl-12{-webkit-box-flex:0;-ms-flex:0 0 100%;flex:0 0 100%;max-width:100%}.order-xl-first{-webkit-box-ordinal-group:0;-ms-flex-order:-1;order:-1}.order-xl-last{-webkit-box-ordinal-group:14;-ms-flex-order:13;order:13}.order-xl-0{-webkit-box-ordinal-group:1;-ms-flex-order:0;order:0}.order-xl-1{-webkit-box-ordinal-group:2;-ms-flex-order:1;order:1}.order-xl-2{-webkit-box-ordinal-group:3;-ms-flex-order:2;order:2}.order-xl-3{-webkit-box-ordinal-group:4;-ms-flex-order:3;order:3}.order-xl-4{-webkit-box-ordinal-group:5;-ms-flex-order:4;order:4}.order-xl-5{-webkit-box-ordinal-group:6;-ms-flex-order:5;order:5}.order-xl-6{-webkit-box-ordinal-group:7;-ms-flex-order:6;order:6}.order-xl-7{-webkit-box-ordinal-group:8;-ms-flex-order:7;order:7}.order-xl-8{-webkit-box-ordinal-group:9;-ms-flex-order:8;order:8}.order-xl-9{-webkit-box-ordinal-group:10;-ms-flex-order:9;order:9}.order-xl-10{-webkit-box-ordinal-group:11;-ms-flex-order:10;order:10}.order-xl-11{-webkit-box-ordinal-group:12;-ms-flex-order:11;order:11}.order-xl-12{-webkit-box-ordinal-group:13;-ms-flex-order:12;order:12}.offset-xl-0{margin-left:0}.offset-xl-1{margin-left:8.3333333333%}.offset-xl-2{margin-left:16.6666666667%}.offset-xl-3{margin-left:25%}.offset-xl-4{margin-left:33.3333333333%}.offset-xl-5{margin-left:41.6666666667%}.offset-xl-6{margin-left:50%}.offset-xl-7{margin-left:58.3333333333%}.offset-xl-8{margin-left:66.6666666667%}.offset-xl-9{margin-left:75%}.offset-xl-10{margin-left:83.3333333333%}.offset-xl-11{margin-left:91.6666666667%}}.table{width:100%;margin-bottom:1rem;color:#fff}.table th,.table td{padding:0.75rem;vertical-align:top;border-top:1px solid #444}.table thead th{vertical-align:bottom;border-bottom:2px solid #444}.table tbody+tbody{border-top:2px solid #444}.table-sm th,.table-sm td{padding:0.3rem}.table-bordered{border:1px solid #444}.table-bordered th,.table-bordered td{border:1px solid #444}.table-bordered thead th,.table-bordered thead td{border-bottom-width:2px}.table-borderless th,.table-borderless td,.table-borderless thead th,.table-borderless tbody+tbody{border:0}.table-striped tbody tr:nth-of-type(odd){background-color:#303030}.table-hover tbody tr:hover{color:#fff;background-color:rgba(0,0,0,0.075)}.table-primary,.table-primary>th,.table-primary>td{background-color:#c7d1db}.table-primary th,.table-primary td,.table-primary thead th,.table-primary tbody+tbody{border-color:#97a9bc}.table-hover .table-primary:hover{background-color:#b7c4d1}.table-hover .table-primary:hover>td,.table-hover .table-primary:hover>th{background-color:#b7c4d1}.table-secondary,.table-secondary>th,.table-secondary>td{background-color:#cbcbcb}.table-secondary th,.table-secondary td,.table-secondary thead th,.table-secondary tbody+tbody{border-color:#9e9e9e}.table-hover .table-secondary:hover{background-color:#bebebe}.table-hover .table-secondary:hover>td,.table-hover .table-secondary:hover>th{background-color:#bebebe}.table-success,.table-success>th,.table-success>td{background-color:#b8ecdf}.table-success th,.table-success td,.table-success thead th,.table-success tbody+tbody{border-color:#7adcc3}.table-hover .table-success:hover{background-color:#a4e7d6}.table-hover .table-success:hover>td,.table-hover .table-success:hover>th{background-color:#a4e7d6}.table-info,.table-info>th,.table-info>td{background-color:#c6e2f5}.table-info th,.table-info td,.table-info thead th,.table-info tbody+tbody{border-color:#95c9ec}.table-hover .table-info:hover{background-color:#b0d7f1}.table-hover .table-info:hover>td,.table-hover .table-info:hover>th{background-color:#b0d7f1}.table-warning,.table-warning>th,.table-warning>td{background-color:#fce3bd}.table-warning th,.table-warning td,.table-warning thead th,.table-warning tbody+tbody{border-color:#f9cc84}.table-hover .table-warning:hover{background-color:#fbd9a5}.table-hover .table-warning:hover>td,.table-hover .table-warning:hover>th{background-color:#fbd9a5}.table-danger,.table-danger>th,.table-danger>td{background-color:#f8cdc8}.table-danger th,.table-danger td,.table-danger thead th,.table-danger tbody+tbody{border-color:#f3a29a}.table-hover .table-danger:hover{background-color:#f5b8b1}.table-hover .table-danger:hover>td,.table-hover .table-danger:hover>th{background-color:#f5b8b1}.table-light,.table-light>th,.table-light>td{background-color:#e2e2e2}.table-light th,.table-light td,.table-light thead th,.table-light tbody+tbody{border-color:#cacaca}.table-hover .table-light:hover{background-color:#d5d5d5}.table-hover .table-light:hover>td,.table-hover .table-light:hover>th{background-color:#d5d5d5}.table-dark,.table-dark>th,.table-dark>td{background-color:#c5c5c5}.table-dark th,.table-dark td,.table-dark thead th,.table-dark tbody+tbody{border-color:#939393}.table-hover .table-dark:hover{background-color:#b8b8b8}.table-hover .table-dark:hover>td,.table-hover .table-dark:hover>th{background-color:#b8b8b8}.table-active,.table-active>th,.table-active>td{background-color:rgba(0,0,0,0.075)}.table-hover .table-active:hover{background-color:rgba(0,0,0,0.075)}.table-hover .table-active:hover>td,.table-hover .table-active:hover>th{background-color:rgba(0,0,0,0.075)}.table .thead-dark th{color:#fff;background-color:#303030;border-color:#434343}.table .thead-light th{color:#444;background-color:#ebebeb;border-color:#444}.table-dark{color:#fff;background-color:#303030}.table-dark th,.table-dark td,.table-dark thead th{border-color:#434343}.table-dark.table-bordered{border:0}.table-dark.table-striped tbody tr:nth-of-type(odd){background-color:rgba(255,255,255,0.05)}.table-dark.table-hover tbody tr:hover{color:#fff;background-color:rgba(255,255,255,0.075)}@media (max-width: 575.98px){.table-responsive-sm{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-sm>.table-bordered{border:0}}@media (max-width: 767.98px){.table-responsive-md{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-md>.table-bordered{border:0}}@media (max-width: 991.98px){.table-responsive-lg{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-lg>.table-bordered{border:0}}@media (max-width: 1199.98px){.table-responsive-xl{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-xl>.table-bordered{border:0}}.table-responsive{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive>.table-bordered{border:0}.form-control{display:block;width:100%;height:calc(1.5em + 0.75rem + 2px);padding:0.375rem 0.75rem;font-size:0.9375rem;font-weight:400;line-height:1.5;color:#444;background-color:#fff;background-clip:padding-box;border:1px solid #222;border-radius:0.25rem;-webkit-transition:border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;transition:border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out}@media (prefers-reduced-motion: reduce){.form-control{-webkit-transition:none;transition:none}}.form-control::-ms-expand{background-color:transparent;border:0}.form-control:-moz-focusring{color:transparent;text-shadow:0 0 0 #444}.form-control:focus{color:#444;background-color:#fff;border-color:#739ac2;outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25);box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25)}.form-control::-webkit-input-placeholder{color:#999;opacity:1}.form-control::-ms-input-placeholder{color:#999;opacity:1}.form-control::placeholder{color:#999;opacity:1}.form-control:disabled,.form-control[readonly]{background-color:#ebebeb;opacity:1}select.form-control:focus::-ms-value{color:#444;background-color:#fff}.form-control-file,.form-control-range{display:block;width:100%}.col-form-label{padding-top:calc(0.375rem + 1px);padding-bottom:calc(0.375rem + 1px);margin-bottom:0;font-size:inherit;line-height:1.5}.col-form-label-lg{padding-top:calc(0.5rem + 1px);padding-bottom:calc(0.5rem + 1px);font-size:1.171875rem;line-height:1.5}.col-form-label-sm{padding-top:calc(0.25rem + 1px);padding-bottom:calc(0.25rem + 1px);font-size:0.8203125rem;line-height:1.5}.form-control-plaintext{display:block;width:100%;padding:0.375rem 0;margin-bottom:0;font-size:0.9375rem;line-height:1.5;color:#fff;background-color:transparent;border:solid transparent;border-width:1px 0}.form-control-plaintext.form-control-sm,.form-control-plaintext.form-control-lg{padding-right:0;padding-left:0}.form-control-sm{height:calc(1.5em + 0.5rem + 2px);padding:0.25rem 0.5rem;font-size:0.8203125rem;line-height:1.5;border-radius:0.2rem}.form-control-lg{height:calc(1.5em + 1rem + 2px);padding:0.5rem 1rem;font-size:1.171875rem;line-height:1.5;border-radius:0.3rem}select.form-control[size],select.form-control[multiple]{height:auto}textarea.form-control{height:auto}.form-group{margin-bottom:1rem}.form-text{display:block;margin-top:0.25rem}.form-row{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;margin-right:-5px;margin-left:-5px}.form-row>.col,.form-row>[class*="col-"]{padding-right:5px;padding-left:5px}.form-check{position:relative;display:block;padding-left:1.25rem}.form-check-input{position:absolute;margin-top:0.3rem;margin-left:-1.25rem}.form-check-input[disabled] ~ .form-check-label,.form-check-input:disabled ~ .form-check-label{color:#999}.form-check-label{margin-bottom:0}.form-check-inline{display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;padding-left:0;margin-right:0.75rem}.form-check-inline .form-check-input{position:static;margin-top:0;margin-right:0.3125rem;margin-left:0}.valid-feedback{display:none;width:100%;margin-top:0.25rem;font-size:80%;color:#00bc8c}.valid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:0.25rem 0.5rem;margin-top:.1rem;font-size:0.8203125rem;line-height:1.5;color:#fff;background-color:rgba(0,188,140,0.9);border-radius:0.25rem}.was-validated :valid ~ .valid-feedback,.was-validated :valid ~ .valid-tooltip,.is-valid ~ .valid-feedback,.is-valid ~ .valid-tooltip{display:block}.was-validated .form-control:valid,.form-control.is-valid{border-color:#00bc8c;padding-right:calc(1.5em + 0.75rem);background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath fill='%2300bc8c' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3e%3c/svg%3e");background-repeat:no-repeat;background-position:right calc(0.375em + 0.1875rem) center;background-size:calc(0.75em + 0.375rem) calc(0.75em + 0.375rem)}.was-validated .form-control:valid:focus,.form-control.is-valid:focus{border-color:#00bc8c;-webkit-box-shadow:0 0 0 0.2rem rgba(0,188,140,0.25);box-shadow:0 0 0 0.2rem rgba(0,188,140,0.25)}.was-validated textarea.form-control:valid,textarea.form-control.is-valid{padding-right:calc(1.5em + 0.75rem);background-position:top calc(0.375em + 0.1875rem) right calc(0.375em + 0.1875rem)}.was-validated .custom-select:valid,.custom-select.is-valid{border-color:#00bc8c;padding-right:calc(0.75em + 2.3125rem);background:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='4' height='5' viewBox='0 0 4 5'%3e%3cpath fill='%23303030' d='M2 0L0 2h4zm0 5L0 3h4z'/%3e%3c/svg%3e") no-repeat right 0.75rem center/8px 10px,url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath fill='%2300bc8c' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3e%3c/svg%3e") #fff no-repeat center right 1.75rem/calc(0.75em + 0.375rem) calc(0.75em + 0.375rem)}.was-validated .custom-select:valid:focus,.custom-select.is-valid:focus{border-color:#00bc8c;-webkit-box-shadow:0 0 0 0.2rem rgba(0,188,140,0.25);box-shadow:0 0 0 0.2rem rgba(0,188,140,0.25)}.was-validated .form-check-input:valid ~ .form-check-label,.form-check-input.is-valid ~ .form-check-label{color:#00bc8c}.was-validated .form-check-input:valid ~ .valid-feedback,.was-validated .form-check-input:valid ~ .valid-tooltip,.form-check-input.is-valid ~ .valid-feedback,.form-check-input.is-valid ~ .valid-tooltip{display:block}.was-validated .custom-control-input:valid ~ .custom-control-label,.custom-control-input.is-valid ~ .custom-control-label{color:#00bc8c}.was-validated .custom-control-input:valid ~ .custom-control-label::before,.custom-control-input.is-valid ~ .custom-control-label::before{border-color:#00bc8c}.was-validated .custom-control-input:valid:checked ~ .custom-control-label::before,.custom-control-input.is-valid:checked ~ .custom-control-label::before{border-color:#00efb2;background-color:#00efb2}.was-validated .custom-control-input:valid:focus ~ .custom-control-label::before,.custom-control-input.is-valid:focus ~ .custom-control-label::before{-webkit-box-shadow:0 0 0 0.2rem rgba(0,188,140,0.25);box-shadow:0 0 0 0.2rem rgba(0,188,140,0.25)}.was-validated .custom-control-input:valid:focus:not(:checked) ~ .custom-control-label::before,.custom-control-input.is-valid:focus:not(:checked) ~ .custom-control-label::before{border-color:#00bc8c}.was-validated .custom-file-input:valid ~ .custom-file-label,.custom-file-input.is-valid ~ .custom-file-label{border-color:#00bc8c}.was-validated .custom-file-input:valid:focus ~ .custom-file-label,.custom-file-input.is-valid:focus ~ .custom-file-label{border-color:#00bc8c;-webkit-box-shadow:0 0 0 0.2rem rgba(0,188,140,0.25);box-shadow:0 0 0 0.2rem rgba(0,188,140,0.25)}.invalid-feedback{display:none;width:100%;margin-top:0.25rem;font-size:80%;color:#E74C3C}.invalid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:0.25rem 0.5rem;margin-top:.1rem;font-size:0.8203125rem;line-height:1.5;color:#fff;background-color:rgba(231,76,60,0.9);border-radius:0.25rem}.was-validated :invalid ~ .invalid-feedback,.was-validated :invalid ~ .invalid-tooltip,.is-invalid ~ .invalid-feedback,.is-invalid ~ .invalid-tooltip{display:block}.was-validated .form-control:invalid,.form-control.is-invalid{border-color:#E74C3C;padding-right:calc(1.5em + 0.75rem);background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' fill='none' stroke='%23E74C3C' viewBox='0 0 12 12'%3e%3ccircle cx='6' cy='6' r='4.5'/%3e%3cpath stroke-linejoin='round' d='M5.8 3.6h.4L6 6.5z'/%3e%3ccircle cx='6' cy='8.2' r='.6' fill='%23E74C3C' stroke='none'/%3e%3c/svg%3e");background-repeat:no-repeat;background-position:right calc(0.375em + 0.1875rem) center;background-size:calc(0.75em + 0.375rem) calc(0.75em + 0.375rem)}.was-validated .form-control:invalid:focus,.form-control.is-invalid:focus{border-color:#E74C3C;-webkit-box-shadow:0 0 0 0.2rem rgba(231,76,60,0.25);box-shadow:0 0 0 0.2rem rgba(231,76,60,0.25)}.was-validated textarea.form-control:invalid,textarea.form-control.is-invalid{padding-right:calc(1.5em + 0.75rem);background-position:top calc(0.375em + 0.1875rem) right calc(0.375em + 0.1875rem)}.was-validated .custom-select:invalid,.custom-select.is-invalid{border-color:#E74C3C;padding-right:calc(0.75em + 2.3125rem);background:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='4' height='5' viewBox='0 0 4 5'%3e%3cpath fill='%23303030' d='M2 0L0 2h4zm0 5L0 3h4z'/%3e%3c/svg%3e") no-repeat right 0.75rem center/8px 10px,url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' fill='none' stroke='%23E74C3C' viewBox='0 0 12 12'%3e%3ccircle cx='6' cy='6' r='4.5'/%3e%3cpath stroke-linejoin='round' d='M5.8 3.6h.4L6 6.5z'/%3e%3ccircle cx='6' cy='8.2' r='.6' fill='%23E74C3C' stroke='none'/%3e%3c/svg%3e") #fff no-repeat center right 1.75rem/calc(0.75em + 0.375rem) calc(0.75em + 0.375rem)}.was-validated .custom-select:invalid:focus,.custom-select.is-invalid:focus{border-color:#E74C3C;-webkit-box-shadow:0 0 0 0.2rem rgba(231,76,60,0.25);box-shadow:0 0 0 0.2rem rgba(231,76,60,0.25)}.was-validated .form-check-input:invalid ~ .form-check-label,.form-check-input.is-invalid ~ .form-check-label{color:#E74C3C}.was-validated .form-check-input:invalid ~ .invalid-feedback,.was-validated .form-check-input:invalid ~ .invalid-tooltip,.form-check-input.is-invalid ~ .invalid-feedback,.form-check-input.is-invalid ~ .invalid-tooltip{display:block}.was-validated .custom-control-input:invalid ~ .custom-control-label,.custom-control-input.is-invalid ~ .custom-control-label{color:#E74C3C}.was-validated .custom-control-input:invalid ~ .custom-control-label::before,.custom-control-input.is-invalid ~ .custom-control-label::before{border-color:#E74C3C}.was-validated .custom-control-input:invalid:checked ~ .custom-control-label::before,.custom-control-input.is-invalid:checked ~ .custom-control-label::before{border-color:#ed7669;background-color:#ed7669}.was-validated .custom-control-input:invalid:focus ~ .custom-control-label::before,.custom-control-input.is-invalid:focus ~ .custom-control-label::before{-webkit-box-shadow:0 0 0 0.2rem rgba(231,76,60,0.25);box-shadow:0 0 0 0.2rem rgba(231,76,60,0.25)}.was-validated .custom-control-input:invalid:focus:not(:checked) ~ .custom-control-label::before,.custom-control-input.is-invalid:focus:not(:checked) ~ .custom-control-label::before{border-color:#E74C3C}.was-validated .custom-file-input:invalid ~ .custom-file-label,.custom-file-input.is-invalid ~ .custom-file-label{border-color:#E74C3C}.was-validated .custom-file-input:invalid:focus ~ .custom-file-label,.custom-file-input.is-invalid:focus ~ .custom-file-label{border-color:#E74C3C;-webkit-box-shadow:0 0 0 0.2rem rgba(231,76,60,0.25);box-shadow:0 0 0 0.2rem rgba(231,76,60,0.25)}.form-inline{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.form-inline .form-check{width:100%}@media (min-width: 576px){.form-inline label{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;margin-bottom:0}.form-inline .form-group{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap;-webkit-box-align:center;-ms-flex-align:center;align-items:center;margin-bottom:0}.form-inline .form-control{display:inline-block;width:auto;vertical-align:middle}.form-inline .form-control-plaintext{display:inline-block}.form-inline .input-group,.form-inline .custom-select{width:auto}.form-inline .form-check{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;width:auto;padding-left:0}.form-inline .form-check-input{position:relative;-ms-flex-negative:0;flex-shrink:0;margin-top:0;margin-right:0.25rem;margin-left:0}.form-inline .custom-control{-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.form-inline .custom-control-label{margin-bottom:0}}.btn{display:inline-block;font-weight:400;color:#fff;text-align:center;vertical-align:middle;cursor:pointer;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;background-color:transparent;border:1px solid transparent;padding:0.375rem 0.75rem;font-size:0.9375rem;line-height:1.5;border-radius:0.25rem;-webkit-transition:color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;transition:color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out}@media (prefers-reduced-motion: reduce){.btn{-webkit-transition:none;transition:none}}.btn:hover{color:#fff;text-decoration:none}.btn:focus,.btn.focus{outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25);box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25)}.btn.disabled,.btn:disabled{opacity:0.65}a.btn.disabled,fieldset:disabled a.btn{pointer-events:none}.btn-primary{color:#fff;background-color:#375a7f;border-color:#375a7f}.btn-primary:hover{color:#fff;background-color:#2b4764;border-color:#28415b}.btn-primary:focus,.btn-primary.focus{color:#fff;background-color:#2b4764;border-color:#28415b;-webkit-box-shadow:0 0 0 0.2rem rgba(85,115,146,0.5);box-shadow:0 0 0 0.2rem rgba(85,115,146,0.5)}.btn-primary.disabled,.btn-primary:disabled{color:#fff;background-color:#375a7f;border-color:#375a7f}.btn-primary:not(:disabled):not(.disabled):active,.btn-primary:not(:disabled):not(.disabled).active,.show>.btn-primary.dropdown-toggle{color:#fff;background-color:#28415b;border-color:#243a53}.btn-primary:not(:disabled):not(.disabled):active:focus,.btn-primary:not(:disabled):not(.disabled).active:focus,.show>.btn-primary.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(85,115,146,0.5);box-shadow:0 0 0 0.2rem rgba(85,115,146,0.5)}.btn-secondary{color:#fff;background-color:#444;border-color:#444}.btn-secondary:hover{color:#fff;background-color:#313131;border-color:#2b2a2a}.btn-secondary:focus,.btn-secondary.focus{color:#fff;background-color:#313131;border-color:#2b2a2a;-webkit-box-shadow:0 0 0 0.2rem rgba(96,96,96,0.5);box-shadow:0 0 0 0.2rem rgba(96,96,96,0.5)}.btn-secondary.disabled,.btn-secondary:disabled{color:#fff;background-color:#444;border-color:#444}.btn-secondary:not(:disabled):not(.disabled):active,.btn-secondary:not(:disabled):not(.disabled).active,.show>.btn-secondary.dropdown-toggle{color:#fff;background-color:#2b2a2a;border-color:#242424}.btn-secondary:not(:disabled):not(.disabled):active:focus,.btn-secondary:not(:disabled):not(.disabled).active:focus,.show>.btn-secondary.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(96,96,96,0.5);box-shadow:0 0 0 0.2rem rgba(96,96,96,0.5)}.btn-success{color:#fff;background-color:#00bc8c;border-color:#00bc8c}.btn-success:hover{color:#fff;background-color:#009670;border-color:#008966}.btn-success:focus,.btn-success.focus{color:#fff;background-color:#009670;border-color:#008966;-webkit-box-shadow:0 0 0 0.2rem rgba(38,198,157,0.5);box-shadow:0 0 0 0.2rem rgba(38,198,157,0.5)}.btn-success.disabled,.btn-success:disabled{color:#fff;background-color:#00bc8c;border-color:#00bc8c}.btn-success:not(:disabled):not(.disabled):active,.btn-success:not(:disabled):not(.disabled).active,.show>.btn-success.dropdown-toggle{color:#fff;background-color:#008966;border-color:#007c5d}.btn-success:not(:disabled):not(.disabled):active:focus,.btn-success:not(:disabled):not(.disabled).active:focus,.show>.btn-success.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(38,198,157,0.5);box-shadow:0 0 0 0.2rem rgba(38,198,157,0.5)}.btn-info{color:#fff;background-color:#3498DB;border-color:#3498DB}.btn-info:hover{color:#fff;background-color:#2384c6;border-color:#217dbb}.btn-info:focus,.btn-info.focus{color:#fff;background-color:#2384c6;border-color:#217dbb;-webkit-box-shadow:0 0 0 0.2rem rgba(82,167,224,0.5);box-shadow:0 0 0 0.2rem rgba(82,167,224,0.5)}.btn-info.disabled,.btn-info:disabled{color:#fff;background-color:#3498DB;border-color:#3498DB}.btn-info:not(:disabled):not(.disabled):active,.btn-info:not(:disabled):not(.disabled).active,.show>.btn-info.dropdown-toggle{color:#fff;background-color:#217dbb;border-color:#1f76b0}.btn-info:not(:disabled):not(.disabled):active:focus,.btn-info:not(:disabled):not(.disabled).active:focus,.show>.btn-info.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(82,167,224,0.5);box-shadow:0 0 0 0.2rem rgba(82,167,224,0.5)}.btn-warning{color:#fff;background-color:#F39C12;border-color:#F39C12}.btn-warning:hover{color:#fff;background-color:#d4860b;border-color:#c87f0a}.btn-warning:focus,.btn-warning.focus{color:#fff;background-color:#d4860b;border-color:#c87f0a;-webkit-box-shadow:0 0 0 0.2rem rgba(245,171,54,0.5);box-shadow:0 0 0 0.2rem rgba(245,171,54,0.5)}.btn-warning.disabled,.btn-warning:disabled{color:#fff;background-color:#F39C12;border-color:#F39C12}.btn-warning:not(:disabled):not(.disabled):active,.btn-warning:not(:disabled):not(.disabled).active,.show>.btn-warning.dropdown-toggle{color:#fff;background-color:#c87f0a;border-color:#bc770a}.btn-warning:not(:disabled):not(.disabled):active:focus,.btn-warning:not(:disabled):not(.disabled).active:focus,.show>.btn-warning.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(245,171,54,0.5);box-shadow:0 0 0 0.2rem rgba(245,171,54,0.5)}.btn-danger{color:#fff;background-color:#E74C3C;border-color:#E74C3C}.btn-danger:hover{color:#fff;background-color:#e12e1c;border-color:#d62c1a}.btn-danger:focus,.btn-danger.focus{color:#fff;background-color:#e12e1c;border-color:#d62c1a;-webkit-box-shadow:0 0 0 0.2rem rgba(235,103,89,0.5);box-shadow:0 0 0 0.2rem rgba(235,103,89,0.5)}.btn-danger.disabled,.btn-danger:disabled{color:#fff;background-color:#E74C3C;border-color:#E74C3C}.btn-danger:not(:disabled):not(.disabled):active,.btn-danger:not(:disabled):not(.disabled).active,.show>.btn-danger.dropdown-toggle{color:#fff;background-color:#d62c1a;border-color:#ca2a19}.btn-danger:not(:disabled):not(.disabled):active:focus,.btn-danger:not(:disabled):not(.disabled).active:focus,.show>.btn-danger.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(235,103,89,0.5);box-shadow:0 0 0 0.2rem rgba(235,103,89,0.5)}.btn-light{color:#fff;background-color:#999;border-color:#999}.btn-light:hover{color:#fff;background-color:#868686;border-color:#807f7f}.btn-light:focus,.btn-light.focus{color:#fff;background-color:#868686;border-color:#807f7f;-webkit-box-shadow:0 0 0 0.2rem rgba(168,168,168,0.5);box-shadow:0 0 0 0.2rem rgba(168,168,168,0.5)}.btn-light.disabled,.btn-light:disabled{color:#fff;background-color:#999;border-color:#999}.btn-light:not(:disabled):not(.disabled):active,.btn-light:not(:disabled):not(.disabled).active,.show>.btn-light.dropdown-toggle{color:#fff;background-color:#807f7f;border-color:#797979}.btn-light:not(:disabled):not(.disabled):active:focus,.btn-light:not(:disabled):not(.disabled).active:focus,.show>.btn-light.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(168,168,168,0.5);box-shadow:0 0 0 0.2rem rgba(168,168,168,0.5)}.btn-dark{color:#fff;background-color:#303030;border-color:#303030}.btn-dark:hover{color:#fff;background-color:#1d1d1d;border-color:#171616}.btn-dark:focus,.btn-dark.focus{color:#fff;background-color:#1d1d1d;border-color:#171616;-webkit-box-shadow:0 0 0 0.2rem rgba(79,79,79,0.5);box-shadow:0 0 0 0.2rem rgba(79,79,79,0.5)}.btn-dark.disabled,.btn-dark:disabled{color:#fff;background-color:#303030;border-color:#303030}.btn-dark:not(:disabled):not(.disabled):active,.btn-dark:not(:disabled):not(.disabled).active,.show>.btn-dark.dropdown-toggle{color:#fff;background-color:#171616;border-color:#101010}.btn-dark:not(:disabled):not(.disabled):active:focus,.btn-dark:not(:disabled):not(.disabled).active:focus,.show>.btn-dark.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(79,79,79,0.5);box-shadow:0 0 0 0.2rem rgba(79,79,79,0.5)}.btn-outline-primary{color:#375a7f;border-color:#375a7f}.btn-outline-primary:hover{color:#fff;background-color:#375a7f;border-color:#375a7f}.btn-outline-primary:focus,.btn-outline-primary.focus{-webkit-box-shadow:0 0 0 0.2rem rgba(55,90,127,0.5);box-shadow:0 0 0 0.2rem rgba(55,90,127,0.5)}.btn-outline-primary.disabled,.btn-outline-primary:disabled{color:#375a7f;background-color:transparent}.btn-outline-primary:not(:disabled):not(.disabled):active,.btn-outline-primary:not(:disabled):not(.disabled).active,.show>.btn-outline-primary.dropdown-toggle{color:#fff;background-color:#375a7f;border-color:#375a7f}.btn-outline-primary:not(:disabled):not(.disabled):active:focus,.btn-outline-primary:not(:disabled):not(.disabled).active:focus,.show>.btn-outline-primary.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(55,90,127,0.5);box-shadow:0 0 0 0.2rem rgba(55,90,127,0.5)}.btn-outline-secondary{color:#444;border-color:#444}.btn-outline-secondary:hover{color:#fff;background-color:#444;border-color:#444}.btn-outline-secondary:focus,.btn-outline-secondary.focus{-webkit-box-shadow:0 0 0 0.2rem rgba(68,68,68,0.5);box-shadow:0 0 0 0.2rem rgba(68,68,68,0.5)}.btn-outline-secondary.disabled,.btn-outline-secondary:disabled{color:#444;background-color:transparent}.btn-outline-secondary:not(:disabled):not(.disabled):active,.btn-outline-secondary:not(:disabled):not(.disabled).active,.show>.btn-outline-secondary.dropdown-toggle{color:#fff;background-color:#444;border-color:#444}.btn-outline-secondary:not(:disabled):not(.disabled):active:focus,.btn-outline-secondary:not(:disabled):not(.disabled).active:focus,.show>.btn-outline-secondary.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(68,68,68,0.5);box-shadow:0 0 0 0.2rem rgba(68,68,68,0.5)}.btn-outline-success{color:#00bc8c;border-color:#00bc8c}.btn-outline-success:hover{color:#fff;background-color:#00bc8c;border-color:#00bc8c}.btn-outline-success:focus,.btn-outline-success.focus{-webkit-box-shadow:0 0 0 0.2rem rgba(0,188,140,0.5);box-shadow:0 0 0 0.2rem rgba(0,188,140,0.5)}.btn-outline-success.disabled,.btn-outline-success:disabled{color:#00bc8c;background-color:transparent}.btn-outline-success:not(:disabled):not(.disabled):active,.btn-outline-success:not(:disabled):not(.disabled).active,.show>.btn-outline-success.dropdown-toggle{color:#fff;background-color:#00bc8c;border-color:#00bc8c}.btn-outline-success:not(:disabled):not(.disabled):active:focus,.btn-outline-success:not(:disabled):not(.disabled).active:focus,.show>.btn-outline-success.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(0,188,140,0.5);box-shadow:0 0 0 0.2rem rgba(0,188,140,0.5)}.btn-outline-info{color:#3498DB;border-color:#3498DB}.btn-outline-info:hover{color:#fff;background-color:#3498DB;border-color:#3498DB}.btn-outline-info:focus,.btn-outline-info.focus{-webkit-box-shadow:0 0 0 0.2rem rgba(52,152,219,0.5);box-shadow:0 0 0 0.2rem rgba(52,152,219,0.5)}.btn-outline-info.disabled,.btn-outline-info:disabled{color:#3498DB;background-color:transparent}.btn-outline-info:not(:disabled):not(.disabled):active,.btn-outline-info:not(:disabled):not(.disabled).active,.show>.btn-outline-info.dropdown-toggle{color:#fff;background-color:#3498DB;border-color:#3498DB}.btn-outline-info:not(:disabled):not(.disabled):active:focus,.btn-outline-info:not(:disabled):not(.disabled).active:focus,.show>.btn-outline-info.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(52,152,219,0.5);box-shadow:0 0 0 0.2rem rgba(52,152,219,0.5)}.btn-outline-warning{color:#F39C12;border-color:#F39C12}.btn-outline-warning:hover{color:#fff;background-color:#F39C12;border-color:#F39C12}.btn-outline-warning:focus,.btn-outline-warning.focus{-webkit-box-shadow:0 0 0 0.2rem rgba(243,156,18,0.5);box-shadow:0 0 0 0.2rem rgba(243,156,18,0.5)}.btn-outline-warning.disabled,.btn-outline-warning:disabled{color:#F39C12;background-color:transparent}.btn-outline-warning:not(:disabled):not(.disabled):active,.btn-outline-warning:not(:disabled):not(.disabled).active,.show>.btn-outline-warning.dropdown-toggle{color:#fff;background-color:#F39C12;border-color:#F39C12}.btn-outline-warning:not(:disabled):not(.disabled):active:focus,.btn-outline-warning:not(:disabled):not(.disabled).active:focus,.show>.btn-outline-warning.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(243,156,18,0.5);box-shadow:0 0 0 0.2rem rgba(243,156,18,0.5)}.btn-outline-danger{color:#E74C3C;border-color:#E74C3C}.btn-outline-danger:hover{color:#fff;background-color:#E74C3C;border-color:#E74C3C}.btn-outline-danger:focus,.btn-outline-danger.focus{-webkit-box-shadow:0 0 0 0.2rem rgba(231,76,60,0.5);box-shadow:0 0 0 0.2rem rgba(231,76,60,0.5)}.btn-outline-danger.disabled,.btn-outline-danger:disabled{color:#E74C3C;background-color:transparent}.btn-outline-danger:not(:disabled):not(.disabled):active,.btn-outline-danger:not(:disabled):not(.disabled).active,.show>.btn-outline-danger.dropdown-toggle{color:#fff;background-color:#E74C3C;border-color:#E74C3C}.btn-outline-danger:not(:disabled):not(.disabled):active:focus,.btn-outline-danger:not(:disabled):not(.disabled).active:focus,.show>.btn-outline-danger.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(231,76,60,0.5);box-shadow:0 0 0 0.2rem rgba(231,76,60,0.5)}.btn-outline-light{color:#999;border-color:#999}.btn-outline-light:hover{color:#fff;background-color:#999;border-color:#999}.btn-outline-light:focus,.btn-outline-light.focus{-webkit-box-shadow:0 0 0 0.2rem rgba(153,153,153,0.5);box-shadow:0 0 0 0.2rem rgba(153,153,153,0.5)}.btn-outline-light.disabled,.btn-outline-light:disabled{color:#999;background-color:transparent}.btn-outline-light:not(:disabled):not(.disabled):active,.btn-outline-light:not(:disabled):not(.disabled).active,.show>.btn-outline-light.dropdown-toggle{color:#fff;background-color:#999;border-color:#999}.btn-outline-light:not(:disabled):not(.disabled):active:focus,.btn-outline-light:not(:disabled):not(.disabled).active:focus,.show>.btn-outline-light.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(153,153,153,0.5);box-shadow:0 0 0 0.2rem rgba(153,153,153,0.5)}.btn-outline-dark{color:#303030;border-color:#303030}.btn-outline-dark:hover{color:#fff;background-color:#303030;border-color:#303030}.btn-outline-dark:focus,.btn-outline-dark.focus{-webkit-box-shadow:0 0 0 0.2rem rgba(48,48,48,0.5);box-shadow:0 0 0 0.2rem rgba(48,48,48,0.5)}.btn-outline-dark.disabled,.btn-outline-dark:disabled{color:#303030;background-color:transparent}.btn-outline-dark:not(:disabled):not(.disabled):active,.btn-outline-dark:not(:disabled):not(.disabled).active,.show>.btn-outline-dark.dropdown-toggle{color:#fff;background-color:#303030;border-color:#303030}.btn-outline-dark:not(:disabled):not(.disabled):active:focus,.btn-outline-dark:not(:disabled):not(.disabled).active:focus,.show>.btn-outline-dark.dropdown-toggle:focus{-webkit-box-shadow:0 0 0 0.2rem rgba(48,48,48,0.5);box-shadow:0 0 0 0.2rem rgba(48,48,48,0.5)}.btn-link{font-weight:400;color:#00bc8c;text-decoration:none}.btn-link:hover{color:#007053;text-decoration:underline}.btn-link:focus,.btn-link.focus{text-decoration:underline;-webkit-box-shadow:none;box-shadow:none}.btn-link:disabled,.btn-link.disabled{color:#999;pointer-events:none}.btn-lg,.btn-group-lg>.btn{padding:0.5rem 1rem;font-size:1.171875rem;line-height:1.5;border-radius:0.3rem}.btn-sm,.btn-group-sm>.btn{padding:0.25rem 0.5rem;font-size:0.8203125rem;line-height:1.5;border-radius:0.2rem}.btn-block{display:block;width:100%}.btn-block+.btn-block{margin-top:0.5rem}input[type="submit"].btn-block,input[type="reset"].btn-block,input[type="button"].btn-block{width:100%}.fade{-webkit-transition:opacity 0.15s linear;transition:opacity 0.15s linear}@media (prefers-reduced-motion: reduce){.fade{-webkit-transition:none;transition:none}}.fade:not(.show){opacity:0}.collapse:not(.show){display:none}.collapsing{position:relative;height:0;overflow:hidden;-webkit-transition:height 0.35s ease;transition:height 0.35s ease}@media (prefers-reduced-motion: reduce){.collapsing{-webkit-transition:none;transition:none}}.dropup,.dropright,.dropdown,.dropleft{position:relative}.dropdown-toggle{white-space:nowrap}.dropdown-toggle::after{display:inline-block;margin-left:0.255em;vertical-align:0.255em;content:"";border-top:0.3em solid;border-right:0.3em solid transparent;border-bottom:0;border-left:0.3em solid transparent}.dropdown-toggle:empty::after{margin-left:0}.dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;display:none;float:left;min-width:10rem;padding:0.5rem 0;margin:0.125rem 0 0;font-size:0.9375rem;color:#fff;text-align:left;list-style:none;background-color:#222;background-clip:padding-box;border:1px solid #444;border-radius:0.25rem}.dropdown-menu-left{right:auto;left:0}.dropdown-menu-right{right:0;left:auto}@media (min-width: 576px){.dropdown-menu-sm-left{right:auto;left:0}.dropdown-menu-sm-right{right:0;left:auto}}@media (min-width: 768px){.dropdown-menu-md-left{right:auto;left:0}.dropdown-menu-md-right{right:0;left:auto}}@media (min-width: 992px){.dropdown-menu-lg-left{right:auto;left:0}.dropdown-menu-lg-right{right:0;left:auto}}@media (min-width: 1200px){.dropdown-menu-xl-left{right:auto;left:0}.dropdown-menu-xl-right{right:0;left:auto}}.dropup .dropdown-menu{top:auto;bottom:100%;margin-top:0;margin-bottom:0.125rem}.dropup .dropdown-toggle::after{display:inline-block;margin-left:0.255em;vertical-align:0.255em;content:"";border-top:0;border-right:0.3em solid transparent;border-bottom:0.3em solid;border-left:0.3em solid transparent}.dropup .dropdown-toggle:empty::after{margin-left:0}.dropright .dropdown-menu{top:0;right:auto;left:100%;margin-top:0;margin-left:0.125rem}.dropright .dropdown-toggle::after{display:inline-block;margin-left:0.255em;vertical-align:0.255em;content:"";border-top:0.3em solid transparent;border-right:0;border-bottom:0.3em solid transparent;border-left:0.3em solid}.dropright .dropdown-toggle:empty::after{margin-left:0}.dropright .dropdown-toggle::after{vertical-align:0}.dropleft .dropdown-menu{top:0;right:100%;left:auto;margin-top:0;margin-right:0.125rem}.dropleft .dropdown-toggle::after{display:inline-block;margin-left:0.255em;vertical-align:0.255em;content:""}.dropleft .dropdown-toggle::after{display:none}.dropleft .dropdown-toggle::before{display:inline-block;margin-right:0.255em;vertical-align:0.255em;content:"";border-top:0.3em solid transparent;border-right:0.3em solid;border-bottom:0.3em solid transparent}.dropleft .dropdown-toggle:empty::after{margin-left:0}.dropleft .dropdown-toggle::before{vertical-align:0}.dropdown-menu[x-placement^="top"],.dropdown-menu[x-placement^="right"],.dropdown-menu[x-placement^="bottom"],.dropdown-menu[x-placement^="left"]{right:auto;bottom:auto}.dropdown-divider{height:0;margin:0.5rem 0;overflow:hidden;border-top:1px solid #444}.dropdown-item{display:block;width:100%;padding:0.25rem 1.5rem;clear:both;font-weight:400;color:#fff;text-align:inherit;white-space:nowrap;background-color:transparent;border:0}.dropdown-item:hover,.dropdown-item:focus{color:#fff;text-decoration:none;background-color:#375a7f}.dropdown-item.active,.dropdown-item:active{color:#fff;text-decoration:none;background-color:#375a7f}.dropdown-item.disabled,.dropdown-item:disabled{color:#999;pointer-events:none;background-color:transparent}.dropdown-menu.show{display:block}.dropdown-header{display:block;padding:0.5rem 1.5rem;margin-bottom:0;font-size:0.8203125rem;color:#999;white-space:nowrap}.dropdown-item-text{display:block;padding:0.25rem 1.5rem;color:#fff}.btn-group,.btn-group-vertical{position:relative;display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;vertical-align:middle}.btn-group>.btn,.btn-group-vertical>.btn{position:relative;-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto}.btn-group>.btn:hover,.btn-group-vertical>.btn:hover{z-index:1}.btn-group>.btn:focus,.btn-group>.btn:active,.btn-group>.btn.active,.btn-group-vertical>.btn:focus,.btn-group-vertical>.btn:active,.btn-group-vertical>.btn.active{z-index:1}.btn-toolbar{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.btn-toolbar .input-group{width:auto}.btn-group>.btn:not(:first-child),.btn-group>.btn-group:not(:first-child){margin-left:-1px}.btn-group>.btn:not(:last-child):not(.dropdown-toggle),.btn-group>.btn-group:not(:last-child)>.btn{border-top-right-radius:0;border-bottom-right-radius:0}.btn-group>.btn:not(:first-child),.btn-group>.btn-group:not(:first-child)>.btn{border-top-left-radius:0;border-bottom-left-radius:0}.dropdown-toggle-split{padding-right:0.5625rem;padding-left:0.5625rem}.dropdown-toggle-split::after,.dropup .dropdown-toggle-split::after,.dropright .dropdown-toggle-split::after{margin-left:0}.dropleft .dropdown-toggle-split::before{margin-right:0}.btn-sm+.dropdown-toggle-split,.btn-group-sm>.btn+.dropdown-toggle-split{padding-right:0.375rem;padding-left:0.375rem}.btn-lg+.dropdown-toggle-split,.btn-group-lg>.btn+.dropdown-toggle-split{padding-right:0.75rem;padding-left:0.75rem}.btn-group-vertical{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.btn-group-vertical>.btn,.btn-group-vertical>.btn-group{width:100%}.btn-group-vertical>.btn:not(:first-child),.btn-group-vertical>.btn-group:not(:first-child){margin-top:-1px}.btn-group-vertical>.btn:not(:last-child):not(.dropdown-toggle),.btn-group-vertical>.btn-group:not(:last-child)>.btn{border-bottom-right-radius:0;border-bottom-left-radius:0}.btn-group-vertical>.btn:not(:first-child),.btn-group-vertical>.btn-group:not(:first-child)>.btn{border-top-left-radius:0;border-top-right-radius:0}.btn-group-toggle>.btn,.btn-group-toggle>.btn-group>.btn{margin-bottom:0}.btn-group-toggle>.btn input[type="radio"],.btn-group-toggle>.btn input[type="checkbox"],.btn-group-toggle>.btn-group>.btn input[type="radio"],.btn-group-toggle>.btn-group>.btn input[type="checkbox"]{position:absolute;clip:rect(0, 0, 0, 0);pointer-events:none}.input-group{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-align:stretch;-ms-flex-align:stretch;align-items:stretch;width:100%}.input-group>.form-control,.input-group>.form-control-plaintext,.input-group>.custom-select,.input-group>.custom-file{position:relative;-webkit-box-flex:1;-ms-flex:1 1 0%;flex:1 1 0%;min-width:0;margin-bottom:0}.input-group>.form-control+.form-control,.input-group>.form-control+.custom-select,.input-group>.form-control+.custom-file,.input-group>.form-control-plaintext+.form-control,.input-group>.form-control-plaintext+.custom-select,.input-group>.form-control-plaintext+.custom-file,.input-group>.custom-select+.form-control,.input-group>.custom-select+.custom-select,.input-group>.custom-select+.custom-file,.input-group>.custom-file+.form-control,.input-group>.custom-file+.custom-select,.input-group>.custom-file+.custom-file{margin-left:-1px}.input-group>.form-control:focus,.input-group>.custom-select:focus,.input-group>.custom-file .custom-file-input:focus ~ .custom-file-label{z-index:3}.input-group>.custom-file .custom-file-input:focus{z-index:4}.input-group>.form-control:not(:last-child),.input-group>.custom-select:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.form-control:not(:first-child),.input-group>.custom-select:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.input-group>.custom-file{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.input-group>.custom-file:not(:last-child) .custom-file-label,.input-group>.custom-file:not(:last-child) .custom-file-label::after{border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.custom-file:not(:first-child) .custom-file-label{border-top-left-radius:0;border-bottom-left-radius:0}.input-group-prepend,.input-group-append{display:-webkit-box;display:-ms-flexbox;display:flex}.input-group-prepend .btn,.input-group-append .btn{position:relative;z-index:2}.input-group-prepend .btn:focus,.input-group-append .btn:focus{z-index:3}.input-group-prepend .btn+.btn,.input-group-prepend .btn+.input-group-text,.input-group-prepend .input-group-text+.input-group-text,.input-group-prepend .input-group-text+.btn,.input-group-append .btn+.btn,.input-group-append .btn+.input-group-text,.input-group-append .input-group-text+.input-group-text,.input-group-append .input-group-text+.btn{margin-left:-1px}.input-group-prepend{margin-right:-1px}.input-group-append{margin-left:-1px}.input-group-text{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;padding:0.375rem 0.75rem;margin-bottom:0;font-size:0.9375rem;font-weight:400;line-height:1.5;color:#adb5bd;text-align:center;white-space:nowrap;background-color:#444;border:1px solid #222;border-radius:0.25rem}.input-group-text input[type="radio"],.input-group-text input[type="checkbox"]{margin-top:0}.input-group-lg>.form-control:not(textarea),.input-group-lg>.custom-select{height:calc(1.5em + 1rem + 2px)}.input-group-lg>.form-control,.input-group-lg>.custom-select,.input-group-lg>.input-group-prepend>.input-group-text,.input-group-lg>.input-group-append>.input-group-text,.input-group-lg>.input-group-prepend>.btn,.input-group-lg>.input-group-append>.btn{padding:0.5rem 1rem;font-size:1.171875rem;line-height:1.5;border-radius:0.3rem}.input-group-sm>.form-control:not(textarea),.input-group-sm>.custom-select{height:calc(1.5em + 0.5rem + 2px)}.input-group-sm>.form-control,.input-group-sm>.custom-select,.input-group-sm>.input-group-prepend>.input-group-text,.input-group-sm>.input-group-append>.input-group-text,.input-group-sm>.input-group-prepend>.btn,.input-group-sm>.input-group-append>.btn{padding:0.25rem 0.5rem;font-size:0.8203125rem;line-height:1.5;border-radius:0.2rem}.input-group-lg>.custom-select,.input-group-sm>.custom-select{padding-right:1.75rem}.input-group>.input-group-prepend>.btn,.input-group>.input-group-prepend>.input-group-text,.input-group>.input-group-append:not(:last-child)>.btn,.input-group>.input-group-append:not(:last-child)>.input-group-text,.input-group>.input-group-append:last-child>.btn:not(:last-child):not(.dropdown-toggle),.input-group>.input-group-append:last-child>.input-group-text:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.input-group-append>.btn,.input-group>.input-group-append>.input-group-text,.input-group>.input-group-prepend:not(:first-child)>.btn,.input-group>.input-group-prepend:not(:first-child)>.input-group-text,.input-group>.input-group-prepend:first-child>.btn:not(:first-child),.input-group>.input-group-prepend:first-child>.input-group-text:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.custom-control{position:relative;display:block;min-height:1.40625rem;padding-left:1.5rem}.custom-control-inline{display:-webkit-inline-box;display:-ms-inline-flexbox;display:inline-flex;margin-right:1rem}.custom-control-input{position:absolute;left:0;z-index:-1;width:1rem;height:1.203125rem;opacity:0}.custom-control-input:checked ~ .custom-control-label::before{color:#fff;border-color:#375a7f;background-color:#375a7f}.custom-control-input:focus ~ .custom-control-label::before{-webkit-box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25);box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25)}.custom-control-input:focus:not(:checked) ~ .custom-control-label::before{border-color:#739ac2}.custom-control-input:not(:disabled):active ~ .custom-control-label::before{color:#fff;background-color:#97b3d2;border-color:#97b3d2}.custom-control-input[disabled] ~ .custom-control-label,.custom-control-input:disabled ~ .custom-control-label{color:#999}.custom-control-input[disabled] ~ .custom-control-label::before,.custom-control-input:disabled ~ .custom-control-label::before{background-color:#ebebeb}.custom-control-label{position:relative;margin-bottom:0;vertical-align:top}.custom-control-label::before{position:absolute;top:0.203125rem;left:-1.5rem;display:block;width:1rem;height:1rem;pointer-events:none;content:"";background-color:#fff;border:#adb5bd solid 1px}.custom-control-label::after{position:absolute;top:0.203125rem;left:-1.5rem;display:block;width:1rem;height:1rem;content:"";background:no-repeat 50% / 50% 50%}.custom-checkbox .custom-control-label::before{border-radius:0.25rem}.custom-checkbox .custom-control-input:checked ~ .custom-control-label::after{background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath fill='%23fff' d='M6.564.75l-3.59 3.612-1.538-1.55L0 4.26l2.974 2.99L8 2.193z'/%3e%3c/svg%3e")}.custom-checkbox .custom-control-input:indeterminate ~ .custom-control-label::before{border-color:#375a7f;background-color:#375a7f}.custom-checkbox .custom-control-input:indeterminate ~ .custom-control-label::after{background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='4' height='4' viewBox='0 0 4 4'%3e%3cpath stroke='%23fff' d='M0 2h4'/%3e%3c/svg%3e")}.custom-checkbox .custom-control-input:disabled:checked ~ .custom-control-label::before{background-color:rgba(55,90,127,0.5)}.custom-checkbox .custom-control-input:disabled:indeterminate ~ .custom-control-label::before{background-color:rgba(55,90,127,0.5)}.custom-radio .custom-control-label::before{border-radius:50%}.custom-radio .custom-control-input:checked ~ .custom-control-label::after{background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='-4 -4 8 8'%3e%3ccircle r='3' fill='%23fff'/%3e%3c/svg%3e")}.custom-radio .custom-control-input:disabled:checked ~ .custom-control-label::before{background-color:rgba(55,90,127,0.5)}.custom-switch{padding-left:2.25rem}.custom-switch .custom-control-label::before{left:-2.25rem;width:1.75rem;pointer-events:all;border-radius:0.5rem}.custom-switch .custom-control-label::after{top:calc(0.203125rem + 2px);left:calc(-2.25rem + 2px);width:calc(1rem - 4px);height:calc(1rem - 4px);background-color:#adb5bd;border-radius:0.5rem;-webkit-transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-transform 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-transform 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:transform 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;transition:transform 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out, -webkit-transform 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out}@media (prefers-reduced-motion: reduce){.custom-switch .custom-control-label::after{-webkit-transition:none;transition:none}}.custom-switch .custom-control-input:checked ~ .custom-control-label::after{background-color:#fff;-webkit-transform:translateX(0.75rem);transform:translateX(0.75rem)}.custom-switch .custom-control-input:disabled:checked ~ .custom-control-label::before{background-color:rgba(55,90,127,0.5)}.custom-select{display:inline-block;width:100%;height:calc(1.5em + 0.75rem + 2px);padding:0.375rem 1.75rem 0.375rem 0.75rem;font-size:0.9375rem;font-weight:400;line-height:1.5;color:#444;vertical-align:middle;background:#fff url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='4' height='5' viewBox='0 0 4 5'%3e%3cpath fill='%23303030' d='M2 0L0 2h4zm0 5L0 3h4z'/%3e%3c/svg%3e") no-repeat right 0.75rem center/8px 10px;border:1px solid #222;border-radius:0.25rem;-webkit-appearance:none;-moz-appearance:none;appearance:none}.custom-select:focus{border-color:#739ac2;outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25);box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25)}.custom-select:focus::-ms-value{color:#444;background-color:#fff}.custom-select[multiple],.custom-select[size]:not([size="1"]){height:auto;padding-right:0.75rem;background-image:none}.custom-select:disabled{color:#999;background-color:#ebebeb}.custom-select::-ms-expand{display:none}.custom-select:-moz-focusring{color:transparent;text-shadow:0 0 0 #444}.custom-select-sm{height:calc(1.5em + 0.5rem + 2px);padding-top:0.25rem;padding-bottom:0.25rem;padding-left:0.5rem;font-size:0.8203125rem}.custom-select-lg{height:calc(1.5em + 1rem + 2px);padding-top:0.5rem;padding-bottom:0.5rem;padding-left:1rem;font-size:1.171875rem}.custom-file{position:relative;display:inline-block;width:100%;height:calc(1.5em + 0.75rem + 2px);margin-bottom:0}.custom-file-input{position:relative;z-index:2;width:100%;height:calc(1.5em + 0.75rem + 2px);margin:0;opacity:0}.custom-file-input:focus ~ .custom-file-label{border-color:#739ac2;-webkit-box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25);box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25)}.custom-file-input[disabled] ~ .custom-file-label,.custom-file-input:disabled ~ .custom-file-label{background-color:#ebebeb}.custom-file-input:lang(en) ~ .custom-file-label::after{content:"Browse"}.custom-file-input ~ .custom-file-label[data-browse]::after{content:attr(data-browse)}.custom-file-label{position:absolute;top:0;right:0;left:0;z-index:1;height:calc(1.5em + 0.75rem + 2px);padding:0.375rem 0.75rem;font-weight:400;line-height:1.5;color:#adb5bd;background-color:#fff;border:1px solid #222;border-radius:0.25rem}.custom-file-label::after{position:absolute;top:0;right:0;bottom:0;z-index:3;display:block;height:calc(1.5em + 0.75rem);padding:0.375rem 0.75rem;line-height:1.5;color:#adb5bd;content:"Browse";background-color:#444;border-left:inherit;border-radius:0 0.25rem 0.25rem 0}.custom-range{width:100%;height:1.4rem;padding:0;background-color:transparent;-webkit-appearance:none;-moz-appearance:none;appearance:none}.custom-range:focus{outline:none}.custom-range:focus::-webkit-slider-thumb{-webkit-box-shadow:0 0 0 1px #222,0 0 0 0.2rem rgba(55,90,127,0.25);box-shadow:0 0 0 1px #222,0 0 0 0.2rem rgba(55,90,127,0.25)}.custom-range:focus::-moz-range-thumb{box-shadow:0 0 0 1px #222,0 0 0 0.2rem rgba(55,90,127,0.25)}.custom-range:focus::-ms-thumb{box-shadow:0 0 0 1px #222,0 0 0 0.2rem rgba(55,90,127,0.25)}.custom-range::-moz-focus-outer{border:0}.custom-range::-webkit-slider-thumb{width:1rem;height:1rem;margin-top:-0.25rem;background-color:#375a7f;border:0;border-radius:1rem;-webkit-transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;-webkit-appearance:none;appearance:none}@media (prefers-reduced-motion: reduce){.custom-range::-webkit-slider-thumb{-webkit-transition:none;transition:none}}.custom-range::-webkit-slider-thumb:active{background-color:#97b3d2}.custom-range::-webkit-slider-runnable-track{width:100%;height:0.5rem;color:transparent;cursor:pointer;background-color:#dee2e6;border-color:transparent;border-radius:1rem}.custom-range::-moz-range-thumb{width:1rem;height:1rem;background-color:#375a7f;border:0;border-radius:1rem;-webkit-transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;-moz-appearance:none;appearance:none}@media (prefers-reduced-motion: reduce){.custom-range::-moz-range-thumb{-webkit-transition:none;transition:none}}.custom-range::-moz-range-thumb:active{background-color:#97b3d2}.custom-range::-moz-range-track{width:100%;height:0.5rem;color:transparent;cursor:pointer;background-color:#dee2e6;border-color:transparent;border-radius:1rem}.custom-range::-ms-thumb{width:1rem;height:1rem;margin-top:0;margin-right:0.2rem;margin-left:0.2rem;background-color:#375a7f;border:0;border-radius:1rem;-webkit-transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;appearance:none}@media (prefers-reduced-motion: reduce){.custom-range::-ms-thumb{-webkit-transition:none;transition:none}}.custom-range::-ms-thumb:active{background-color:#97b3d2}.custom-range::-ms-track{width:100%;height:0.5rem;color:transparent;cursor:pointer;background-color:transparent;border-color:transparent;border-width:0.5rem}.custom-range::-ms-fill-lower{background-color:#dee2e6;border-radius:1rem}.custom-range::-ms-fill-upper{margin-right:15px;background-color:#dee2e6;border-radius:1rem}.custom-range:disabled::-webkit-slider-thumb{background-color:#adb5bd}.custom-range:disabled::-webkit-slider-runnable-track{cursor:default}.custom-range:disabled::-moz-range-thumb{background-color:#adb5bd}.custom-range:disabled::-moz-range-track{cursor:default}.custom-range:disabled::-ms-thumb{background-color:#adb5bd}.custom-control-label::before,.custom-file-label,.custom-select{-webkit-transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;transition:background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out}@media (prefers-reduced-motion: reduce){.custom-control-label::before,.custom-file-label,.custom-select{-webkit-transition:none;transition:none}}.nav{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;padding-left:0;margin-bottom:0;list-style:none}.nav-link{display:block;padding:0.5rem 2rem}.nav-link:hover,.nav-link:focus{text-decoration:none}.nav-link.disabled{color:#adb5bd;pointer-events:none;cursor:default}.nav-tabs{border-bottom:1px solid #444}.nav-tabs .nav-item{margin-bottom:-1px}.nav-tabs .nav-link{border:1px solid transparent;border-top-left-radius:0.25rem;border-top-right-radius:0.25rem}.nav-tabs .nav-link:hover,.nav-tabs .nav-link:focus{border-color:#444 #444 transparent}.nav-tabs .nav-link.disabled{color:#adb5bd;background-color:transparent;border-color:transparent}.nav-tabs .nav-link.active,.nav-tabs .nav-item.show .nav-link{color:#fff;background-color:#222;border-color:#444 #444 transparent}.nav-tabs .dropdown-menu{margin-top:-1px;border-top-left-radius:0;border-top-right-radius:0}.nav-pills .nav-link{border-radius:0.25rem}.nav-pills .nav-link.active,.nav-pills .show>.nav-link{color:#fff;background-color:#375a7f}.nav-fill .nav-item{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;text-align:center}.nav-justified .nav-item{-ms-flex-preferred-size:0;flex-basis:0;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;text-align:center}.tab-content>.tab-pane{display:none}.tab-content>.active{display:block}.navbar{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;padding:1rem 1rem}.navbar .container,.navbar .container-fluid,.navbar .container-sm,.navbar .container-md,.navbar .container-lg,.navbar .container-xl{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between}.navbar-brand{display:inline-block;padding-top:0.32421875rem;padding-bottom:0.32421875rem;margin-right:1rem;font-size:1.171875rem;line-height:inherit;white-space:nowrap}.navbar-brand:hover,.navbar-brand:focus{text-decoration:none}.navbar-nav{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;padding-left:0;margin-bottom:0;list-style:none}.navbar-nav .nav-link{padding-right:0;padding-left:0}.navbar-nav .dropdown-menu{position:static;float:none}.navbar-text{display:inline-block;padding-top:0.5rem;padding-bottom:0.5rem}.navbar-collapse{-ms-flex-preferred-size:100%;flex-basis:100%;-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.navbar-toggler{padding:0.25rem 0.75rem;font-size:1.171875rem;line-height:1;background-color:transparent;border:1px solid transparent;border-radius:0.25rem}.navbar-toggler:hover,.navbar-toggler:focus{text-decoration:none}.navbar-toggler-icon{display:inline-block;width:1.5em;height:1.5em;vertical-align:middle;content:"";background:no-repeat center center;background-size:100% 100%}@media (max-width: 575.98px){.navbar-expand-sm>.container,.navbar-expand-sm>.container-fluid,.navbar-expand-sm>.container-sm,.navbar-expand-sm>.container-md,.navbar-expand-sm>.container-lg,.navbar-expand-sm>.container-xl{padding-right:0;padding-left:0}}@media (min-width: 576px){.navbar-expand-sm{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-sm .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.navbar-expand-sm .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-sm .navbar-nav .nav-link{padding-right:0.5rem;padding-left:0.5rem}.navbar-expand-sm>.container,.navbar-expand-sm>.container-fluid,.navbar-expand-sm>.container-sm,.navbar-expand-sm>.container-md,.navbar-expand-sm>.container-lg,.navbar-expand-sm>.container-xl{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-sm .navbar-collapse{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-sm .navbar-toggler{display:none}}@media (max-width: 767.98px){.navbar-expand-md>.container,.navbar-expand-md>.container-fluid,.navbar-expand-md>.container-sm,.navbar-expand-md>.container-md,.navbar-expand-md>.container-lg,.navbar-expand-md>.container-xl{padding-right:0;padding-left:0}}@media (min-width: 768px){.navbar-expand-md{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-md .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.navbar-expand-md .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-md .navbar-nav .nav-link{padding-right:0.5rem;padding-left:0.5rem}.navbar-expand-md>.container,.navbar-expand-md>.container-fluid,.navbar-expand-md>.container-sm,.navbar-expand-md>.container-md,.navbar-expand-md>.container-lg,.navbar-expand-md>.container-xl{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-md .navbar-collapse{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-md .navbar-toggler{display:none}}@media (max-width: 991.98px){.navbar-expand-lg>.container,.navbar-expand-lg>.container-fluid,.navbar-expand-lg>.container-sm,.navbar-expand-lg>.container-md,.navbar-expand-lg>.container-lg,.navbar-expand-lg>.container-xl{padding-right:0;padding-left:0}}@media (min-width: 992px){.navbar-expand-lg{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-lg .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.navbar-expand-lg .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-lg .navbar-nav .nav-link{padding-right:0.5rem;padding-left:0.5rem}.navbar-expand-lg>.container,.navbar-expand-lg>.container-fluid,.navbar-expand-lg>.container-sm,.navbar-expand-lg>.container-md,.navbar-expand-lg>.container-lg,.navbar-expand-lg>.container-xl{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-lg .navbar-collapse{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-lg .navbar-toggler{display:none}}@media (max-width: 1199.98px){.navbar-expand-xl>.container,.navbar-expand-xl>.container-fluid,.navbar-expand-xl>.container-sm,.navbar-expand-xl>.container-md,.navbar-expand-xl>.container-lg,.navbar-expand-xl>.container-xl{padding-right:0;padding-left:0}}@media (min-width: 1200px){.navbar-expand-xl{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand-xl .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.navbar-expand-xl .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-xl .navbar-nav .nav-link{padding-right:0.5rem;padding-left:0.5rem}.navbar-expand-xl>.container,.navbar-expand-xl>.container-fluid,.navbar-expand-xl>.container-sm,.navbar-expand-xl>.container-md,.navbar-expand-xl>.container-lg,.navbar-expand-xl>.container-xl{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand-xl .navbar-collapse{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand-xl .navbar-toggler{display:none}}.navbar-expand{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row nowrap;flex-flow:row nowrap;-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.navbar-expand>.container,.navbar-expand>.container-fluid,.navbar-expand>.container-sm,.navbar-expand>.container-md,.navbar-expand>.container-lg,.navbar-expand>.container-xl{padding-right:0;padding-left:0}.navbar-expand .navbar-nav{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.navbar-expand .navbar-nav .dropdown-menu{position:absolute}.navbar-expand .navbar-nav .nav-link{padding-right:0.5rem;padding-left:0.5rem}.navbar-expand>.container,.navbar-expand>.container-fluid,.navbar-expand>.container-sm,.navbar-expand>.container-md,.navbar-expand>.container-lg,.navbar-expand>.container-xl{-ms-flex-wrap:nowrap;flex-wrap:nowrap}.navbar-expand .navbar-collapse{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important;-ms-flex-preferred-size:auto;flex-basis:auto}.navbar-expand .navbar-toggler{display:none}.navbar-light .navbar-brand{color:#fff}.navbar-light .navbar-brand:hover,.navbar-light .navbar-brand:focus{color:#fff}.navbar-light .navbar-nav .nav-link{color:#fff}.navbar-light .navbar-nav .nav-link:hover,.navbar-light .navbar-nav .nav-link:focus{color:#00bc8c}.navbar-light .navbar-nav .nav-link.disabled{color:rgba(255,255,255,0.3)}.navbar-light .navbar-nav .show>.nav-link,.navbar-light .navbar-nav .active>.nav-link,.navbar-light .navbar-nav .nav-link.show,.navbar-light .navbar-nav .nav-link.active{color:#fff}.navbar-light .navbar-toggler{color:#fff;border-color:rgba(255,255,255,0.1)}.navbar-light .navbar-toggler-icon{background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='30' height='30' viewBox='0 0 30 30'%3e%3cpath stroke='%23fff' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e")}.navbar-light .navbar-text{color:#fff}.navbar-light .navbar-text a{color:#fff}.navbar-light .navbar-text a:hover,.navbar-light .navbar-text a:focus{color:#fff}.navbar-dark .navbar-brand{color:#fff}.navbar-dark .navbar-brand:hover,.navbar-dark .navbar-brand:focus{color:#fff}.navbar-dark .navbar-nav .nav-link{color:rgba(255,255,255,0.6)}.navbar-dark .navbar-nav .nav-link:hover,.navbar-dark .navbar-nav .nav-link:focus{color:#fff}.navbar-dark .navbar-nav .nav-link.disabled{color:rgba(255,255,255,0.25)}.navbar-dark .navbar-nav .show>.nav-link,.navbar-dark .navbar-nav .active>.nav-link,.navbar-dark .navbar-nav .nav-link.show,.navbar-dark .navbar-nav .nav-link.active{color:#fff}.navbar-dark .navbar-toggler{color:rgba(255,255,255,0.6);border-color:rgba(255,255,255,0.1)}.navbar-dark .navbar-toggler-icon{background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' width='30' height='30' viewBox='0 0 30 30'%3e%3cpath stroke='rgba(255, 255, 255, 0.6)' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e")}.navbar-dark .navbar-text{color:rgba(255,255,255,0.6)}.navbar-dark .navbar-text a{color:#fff}.navbar-dark .navbar-text a:hover,.navbar-dark .navbar-text a:focus{color:#fff}.card{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;min-width:0;word-wrap:break-word;background-color:#303030;background-clip:border-box;border:1px solid rgba(0,0,0,0.125);border-radius:0.25rem}.card>hr{margin-right:0;margin-left:0}.card>.list-group:first-child .list-group-item:first-child{border-top-left-radius:0.25rem;border-top-right-radius:0.25rem}.card>.list-group:last-child .list-group-item:last-child{border-bottom-right-radius:0.25rem;border-bottom-left-radius:0.25rem}.card-body{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;min-height:1px;padding:1.25rem}.card-title{margin-bottom:0.75rem}.card-subtitle{margin-top:-0.375rem;margin-bottom:0}.card-text:last-child{margin-bottom:0}.card-link:hover{text-decoration:none}.card-link+.card-link{margin-left:1.25rem}.card-header{padding:0.75rem 1.25rem;margin-bottom:0;background-color:#444;border-bottom:1px solid rgba(0,0,0,0.125)}.card-header:first-child{border-radius:calc(0.25rem - 1px) calc(0.25rem - 1px) 0 0}.card-header+.list-group .list-group-item:first-child{border-top:0}.card-footer{padding:0.75rem 1.25rem;background-color:#444;border-top:1px solid rgba(0,0,0,0.125)}.card-footer:last-child{border-radius:0 0 calc(0.25rem - 1px) calc(0.25rem - 1px)}.card-header-tabs{margin-right:-0.625rem;margin-bottom:-0.75rem;margin-left:-0.625rem;border-bottom:0}.card-header-pills{margin-right:-0.625rem;margin-left:-0.625rem}.card-img-overlay{position:absolute;top:0;right:0;bottom:0;left:0;padding:1.25rem}.card-img,.card-img-top,.card-img-bottom{-ms-flex-negative:0;flex-shrink:0;width:100%}.card-img,.card-img-top{border-top-left-radius:calc(0.25rem - 1px);border-top-right-radius:calc(0.25rem - 1px)}.card-img,.card-img-bottom{border-bottom-right-radius:calc(0.25rem - 1px);border-bottom-left-radius:calc(0.25rem - 1px)}.card-deck .card{margin-bottom:15px}@media (min-width: 576px){.card-deck{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap;margin-right:-15px;margin-left:-15px}.card-deck .card{-webkit-box-flex:1;-ms-flex:1 0 0%;flex:1 0 0%;margin-right:15px;margin-bottom:0;margin-left:15px}}.card-group>.card{margin-bottom:15px}@media (min-width: 576px){.card-group{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-flow:row wrap;flex-flow:row wrap}.card-group>.card{-webkit-box-flex:1;-ms-flex:1 0 0%;flex:1 0 0%;margin-bottom:0}.card-group>.card+.card{margin-left:0;border-left:0}.card-group>.card:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.card-group>.card:not(:last-child) .card-img-top,.card-group>.card:not(:last-child) .card-header{border-top-right-radius:0}.card-group>.card:not(:last-child) .card-img-bottom,.card-group>.card:not(:last-child) .card-footer{border-bottom-right-radius:0}.card-group>.card:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.card-group>.card:not(:first-child) .card-img-top,.card-group>.card:not(:first-child) .card-header{border-top-left-radius:0}.card-group>.card:not(:first-child) .card-img-bottom,.card-group>.card:not(:first-child) .card-footer{border-bottom-left-radius:0}}.card-columns .card{margin-bottom:0.75rem}@media (min-width: 576px){.card-columns{-webkit-column-count:3;column-count:3;-webkit-column-gap:1.25rem;column-gap:1.25rem;orphans:1;widows:1}.card-columns .card{display:inline-block;width:100%}}.accordion>.card{overflow:hidden}.accordion>.card:not(:last-of-type){border-bottom:0;border-bottom-right-radius:0;border-bottom-left-radius:0}.accordion>.card:not(:first-of-type){border-top-left-radius:0;border-top-right-radius:0}.accordion>.card>.card-header{border-radius:0;margin-bottom:-1px}.breadcrumb{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;padding:0.75rem 1rem;margin-bottom:1rem;list-style:none;background-color:#444;border-radius:0.25rem}.breadcrumb-item+.breadcrumb-item{padding-left:0.5rem}.breadcrumb-item+.breadcrumb-item::before{display:inline-block;padding-right:0.5rem;color:#999;content:"/"}.breadcrumb-item+.breadcrumb-item:hover::before{text-decoration:underline}.breadcrumb-item+.breadcrumb-item:hover::before{text-decoration:none}.breadcrumb-item.active{color:#999}.pagination{display:-webkit-box;display:-ms-flexbox;display:flex;padding-left:0;list-style:none;border-radius:0.25rem}.page-link{position:relative;display:block;padding:0.5rem 0.75rem;margin-left:0;line-height:1.25;color:#fff;background-color:#00bc8c;border:0 solid transparent}.page-link:hover{z-index:2;color:#fff;text-decoration:none;background-color:#00efb2;border-color:transparent}.page-link:focus{z-index:3;outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25);box-shadow:0 0 0 0.2rem rgba(55,90,127,0.25)}.page-item:first-child .page-link{margin-left:0;border-top-left-radius:0.25rem;border-bottom-left-radius:0.25rem}.page-item:last-child .page-link{border-top-right-radius:0.25rem;border-bottom-right-radius:0.25rem}.page-item.active .page-link{z-index:3;color:#fff;background-color:#00efb2;border-color:transparent}.page-item.disabled .page-link{color:#fff;pointer-events:none;cursor:auto;background-color:#007053;border-color:transparent}.pagination-lg .page-link{padding:0.75rem 1.5rem;font-size:1.171875rem;line-height:1.5}.pagination-lg .page-item:first-child .page-link{border-top-left-radius:0.3rem;border-bottom-left-radius:0.3rem}.pagination-lg .page-item:last-child .page-link{border-top-right-radius:0.3rem;border-bottom-right-radius:0.3rem}.pagination-sm .page-link{padding:0.25rem 0.5rem;font-size:0.8203125rem;line-height:1.5}.pagination-sm .page-item:first-child .page-link{border-top-left-radius:0.2rem;border-bottom-left-radius:0.2rem}.pagination-sm .page-item:last-child .page-link{border-top-right-radius:0.2rem;border-bottom-right-radius:0.2rem}.badge{display:inline-block;padding:0.25em 0.4em;font-size:75%;font-weight:700;line-height:1;text-align:center;white-space:nowrap;vertical-align:baseline;border-radius:0.25rem;-webkit-transition:color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out;transition:color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;transition:color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out, -webkit-box-shadow 0.15s ease-in-out}@media (prefers-reduced-motion: reduce){.badge{-webkit-transition:none;transition:none}}a.badge:hover,a.badge:focus{text-decoration:none}.badge:empty{display:none}.btn .badge{position:relative;top:-1px}.badge-pill{padding-right:0.6em;padding-left:0.6em;border-radius:10rem}.badge-primary{color:#fff;background-color:#375a7f}a.badge-primary:hover,a.badge-primary:focus{color:#fff;background-color:#28415b}a.badge-primary:focus,a.badge-primary.focus{outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(55,90,127,0.5);box-shadow:0 0 0 0.2rem rgba(55,90,127,0.5)}.badge-secondary{color:#fff;background-color:#444}a.badge-secondary:hover,a.badge-secondary:focus{color:#fff;background-color:#2b2a2a}a.badge-secondary:focus,a.badge-secondary.focus{outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(68,68,68,0.5);box-shadow:0 0 0 0.2rem rgba(68,68,68,0.5)}.badge-success{color:#fff;background-color:#00bc8c}a.badge-success:hover,a.badge-success:focus{color:#fff;background-color:#008966}a.badge-success:focus,a.badge-success.focus{outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(0,188,140,0.5);box-shadow:0 0 0 0.2rem rgba(0,188,140,0.5)}.badge-info{color:#fff;background-color:#3498DB}a.badge-info:hover,a.badge-info:focus{color:#fff;background-color:#217dbb}a.badge-info:focus,a.badge-info.focus{outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(52,152,219,0.5);box-shadow:0 0 0 0.2rem rgba(52,152,219,0.5)}.badge-warning{color:#fff;background-color:#F39C12}a.badge-warning:hover,a.badge-warning:focus{color:#fff;background-color:#c87f0a}a.badge-warning:focus,a.badge-warning.focus{outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(243,156,18,0.5);box-shadow:0 0 0 0.2rem rgba(243,156,18,0.5)}.badge-danger{color:#fff;background-color:#E74C3C}a.badge-danger:hover,a.badge-danger:focus{color:#fff;background-color:#d62c1a}a.badge-danger:focus,a.badge-danger.focus{outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(231,76,60,0.5);box-shadow:0 0 0 0.2rem rgba(231,76,60,0.5)}.badge-light{color:#fff;background-color:#999}a.badge-light:hover,a.badge-light:focus{color:#fff;background-color:#807f7f}a.badge-light:focus,a.badge-light.focus{outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(153,153,153,0.5);box-shadow:0 0 0 0.2rem rgba(153,153,153,0.5)}.badge-dark{color:#fff;background-color:#303030}a.badge-dark:hover,a.badge-dark:focus{color:#fff;background-color:#171616}a.badge-dark:focus,a.badge-dark.focus{outline:0;-webkit-box-shadow:0 0 0 0.2rem rgba(48,48,48,0.5);box-shadow:0 0 0 0.2rem rgba(48,48,48,0.5)}.jumbotron{padding:2rem 1rem;margin-bottom:2rem;background-color:#303030;border-radius:0.3rem}@media (min-width: 576px){.jumbotron{padding:4rem 2rem}}.jumbotron-fluid{padding-right:0;padding-left:0;border-radius:0}.alert{position:relative;padding:0.75rem 1.25rem;margin-bottom:1rem;border:1px solid transparent;border-radius:0.25rem}.alert-heading{color:inherit}.alert-link{font-weight:700}.alert-dismissible{padding-right:3.90625rem}.alert-dismissible .close{position:absolute;top:0;right:0;padding:0.75rem 1.25rem;color:inherit}.alert-primary{color:#1d2f42;background-color:#d7dee5;border-color:#c7d1db}.alert-primary hr{border-top-color:#b7c4d1}.alert-primary .alert-link{color:#0d161f}.alert-secondary{color:#232323;background-color:#dadada;border-color:#cbcbcb}.alert-secondary hr{border-top-color:#bebebe}.alert-secondary .alert-link{color:#0a0909}.alert-success{color:#006249;background-color:#ccf2e8;border-color:#b8ecdf}.alert-success hr{border-top-color:#a4e7d6}.alert-success .alert-link{color:#002f23}.alert-info{color:#1b4f72;background-color:#d6eaf8;border-color:#c6e2f5}.alert-info hr{border-top-color:#b0d7f1}.alert-info .alert-link{color:#113249}.alert-warning{color:#7e5109;background-color:#fdebd0;border-color:#fce3bd}.alert-warning hr{border-top-color:#fbd9a5}.alert-warning .alert-link{color:#4e3206}.alert-danger{color:#78281f;background-color:#fadbd8;border-color:#f8cdc8}.alert-danger hr{border-top-color:#f5b8b1}.alert-danger .alert-link{color:#4f1a15}.alert-light{color:#505050;background-color:#ebebeb;border-color:#e2e2e2}.alert-light hr{border-top-color:#d5d5d5}.alert-light .alert-link{color:#373636}.alert-dark{color:#191919;background-color:#d6d6d6;border-color:#c5c5c5}.alert-dark hr{border-top-color:#b8b8b8}.alert-dark .alert-link{color:black}@-webkit-keyframes progress-bar-stripes{from{background-position:0.625rem 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:0.625rem 0}to{background-position:0 0}}.progress{display:-webkit-box;display:-ms-flexbox;display:flex;height:0.625rem;overflow:hidden;font-size:0.625rem;background-color:#444;border-radius:0.25rem}.progress-bar{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;overflow:hidden;color:#fff;text-align:center;white-space:nowrap;background-color:#375a7f;-webkit-transition:width 0.6s ease;transition:width 0.6s ease}@media (prefers-reduced-motion: reduce){.progress-bar{-webkit-transition:none;transition:none}}.progress-bar-striped{background-image:linear-gradient(45deg, rgba(255,255,255,0.15) 25%, transparent 25%, transparent 50%, rgba(255,255,255,0.15) 50%, rgba(255,255,255,0.15) 75%, transparent 75%, transparent);background-size:0.625rem 0.625rem}.progress-bar-animated{-webkit-animation:progress-bar-stripes 1s linear infinite;animation:progress-bar-stripes 1s linear infinite}@media (prefers-reduced-motion: reduce){.progress-bar-animated{-webkit-animation:none;animation:none}}.media{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start}.media-body{-webkit-box-flex:1;-ms-flex:1;flex:1}.list-group{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;padding-left:0;margin-bottom:0}.list-group-item-action{width:100%;color:#444;text-align:inherit}.list-group-item-action:hover,.list-group-item-action:focus{z-index:1;color:#444;text-decoration:none;background-color:#444}.list-group-item-action:active{color:#fff;background-color:#ebebeb}.list-group-item{position:relative;display:block;padding:0.75rem 1.25rem;background-color:#303030;border:1px solid #444}.list-group-item:first-child{border-top-left-radius:0.25rem;border-top-right-radius:0.25rem}.list-group-item:last-child{border-bottom-right-radius:0.25rem;border-bottom-left-radius:0.25rem}.list-group-item.disabled,.list-group-item:disabled{color:#999;pointer-events:none;background-color:#303030}.list-group-item.active{z-index:2;color:#fff;background-color:#375a7f;border-color:#375a7f}.list-group-item+.list-group-item{border-top-width:0}.list-group-item+.list-group-item.active{margin-top:-1px;border-top-width:1px}.list-group-horizontal{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal .list-group-item:first-child{border-bottom-left-radius:0.25rem;border-top-right-radius:0}.list-group-horizontal .list-group-item:last-child{border-top-right-radius:0.25rem;border-bottom-left-radius:0}.list-group-horizontal .list-group-item.active{margin-top:0}.list-group-horizontal .list-group-item+.list-group-item{border-top-width:1px;border-left-width:0}.list-group-horizontal .list-group-item+.list-group-item.active{margin-left:-1px;border-left-width:1px}@media (min-width: 576px){.list-group-horizontal-sm{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-sm .list-group-item:first-child{border-bottom-left-radius:0.25rem;border-top-right-radius:0}.list-group-horizontal-sm .list-group-item:last-child{border-top-right-radius:0.25rem;border-bottom-left-radius:0}.list-group-horizontal-sm .list-group-item.active{margin-top:0}.list-group-horizontal-sm .list-group-item+.list-group-item{border-top-width:1px;border-left-width:0}.list-group-horizontal-sm .list-group-item+.list-group-item.active{margin-left:-1px;border-left-width:1px}}@media (min-width: 768px){.list-group-horizontal-md{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-md .list-group-item:first-child{border-bottom-left-radius:0.25rem;border-top-right-radius:0}.list-group-horizontal-md .list-group-item:last-child{border-top-right-radius:0.25rem;border-bottom-left-radius:0}.list-group-horizontal-md .list-group-item.active{margin-top:0}.list-group-horizontal-md .list-group-item+.list-group-item{border-top-width:1px;border-left-width:0}.list-group-horizontal-md .list-group-item+.list-group-item.active{margin-left:-1px;border-left-width:1px}}@media (min-width: 992px){.list-group-horizontal-lg{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-lg .list-group-item:first-child{border-bottom-left-radius:0.25rem;border-top-right-radius:0}.list-group-horizontal-lg .list-group-item:last-child{border-top-right-radius:0.25rem;border-bottom-left-radius:0}.list-group-horizontal-lg .list-group-item.active{margin-top:0}.list-group-horizontal-lg .list-group-item+.list-group-item{border-top-width:1px;border-left-width:0}.list-group-horizontal-lg .list-group-item+.list-group-item.active{margin-left:-1px;border-left-width:1px}}@media (min-width: 1200px){.list-group-horizontal-xl{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.list-group-horizontal-xl .list-group-item:first-child{border-bottom-left-radius:0.25rem;border-top-right-radius:0}.list-group-horizontal-xl .list-group-item:last-child{border-top-right-radius:0.25rem;border-bottom-left-radius:0}.list-group-horizontal-xl .list-group-item.active{margin-top:0}.list-group-horizontal-xl .list-group-item+.list-group-item{border-top-width:1px;border-left-width:0}.list-group-horizontal-xl .list-group-item+.list-group-item.active{margin-left:-1px;border-left-width:1px}}.list-group-flush .list-group-item{border-right-width:0;border-left-width:0;border-radius:0}.list-group-flush .list-group-item:first-child{border-top-width:0}.list-group-flush:last-child .list-group-item:last-child{border-bottom-width:0}.list-group-item-primary{color:#1d2f42;background-color:#c7d1db}.list-group-item-primary.list-group-item-action:hover,.list-group-item-primary.list-group-item-action:focus{color:#1d2f42;background-color:#b7c4d1}.list-group-item-primary.list-group-item-action.active{color:#fff;background-color:#1d2f42;border-color:#1d2f42}.list-group-item-secondary{color:#232323;background-color:#cbcbcb}.list-group-item-secondary.list-group-item-action:hover,.list-group-item-secondary.list-group-item-action:focus{color:#232323;background-color:#bebebe}.list-group-item-secondary.list-group-item-action.active{color:#fff;background-color:#232323;border-color:#232323}.list-group-item-success{color:#006249;background-color:#b8ecdf}.list-group-item-success.list-group-item-action:hover,.list-group-item-success.list-group-item-action:focus{color:#006249;background-color:#a4e7d6}.list-group-item-success.list-group-item-action.active{color:#fff;background-color:#006249;border-color:#006249}.list-group-item-info{color:#1b4f72;background-color:#c6e2f5}.list-group-item-info.list-group-item-action:hover,.list-group-item-info.list-group-item-action:focus{color:#1b4f72;background-color:#b0d7f1}.list-group-item-info.list-group-item-action.active{color:#fff;background-color:#1b4f72;border-color:#1b4f72}.list-group-item-warning{color:#7e5109;background-color:#fce3bd}.list-group-item-warning.list-group-item-action:hover,.list-group-item-warning.list-group-item-action:focus{color:#7e5109;background-color:#fbd9a5}.list-group-item-warning.list-group-item-action.active{color:#fff;background-color:#7e5109;border-color:#7e5109}.list-group-item-danger{color:#78281f;background-color:#f8cdc8}.list-group-item-danger.list-group-item-action:hover,.list-group-item-danger.list-group-item-action:focus{color:#78281f;background-color:#f5b8b1}.list-group-item-danger.list-group-item-action.active{color:#fff;background-color:#78281f;border-color:#78281f}.list-group-item-light{color:#505050;background-color:#e2e2e2}.list-group-item-light.list-group-item-action:hover,.list-group-item-light.list-group-item-action:focus{color:#505050;background-color:#d5d5d5}.list-group-item-light.list-group-item-action.active{color:#fff;background-color:#505050;border-color:#505050}.list-group-item-dark{color:#191919;background-color:#c5c5c5}.list-group-item-dark.list-group-item-action:hover,.list-group-item-dark.list-group-item-action:focus{color:#191919;background-color:#b8b8b8}.list-group-item-dark.list-group-item-action.active{color:#fff;background-color:#191919;border-color:#191919}.close{float:right;font-size:1.40625rem;font-weight:700;line-height:1;color:#fff;text-shadow:none;opacity:.5}.close:hover{color:#fff;text-decoration:none}.close:not(:disabled):not(.disabled):hover,.close:not(:disabled):not(.disabled):focus{opacity:.75}button.close{padding:0;background-color:transparent;border:0;-webkit-appearance:none;-moz-appearance:none;appearance:none}a.close.disabled{pointer-events:none}.toast{max-width:350px;overflow:hidden;font-size:0.875rem;background-color:rgba(255,255,255,0.85);background-clip:padding-box;border:1px solid rgba(0,0,0,0.1);-webkit-box-shadow:0 0.25rem 0.75rem rgba(0,0,0,0.1);box-shadow:0 0.25rem 0.75rem rgba(0,0,0,0.1);-webkit-backdrop-filter:blur(10px);backdrop-filter:blur(10px);opacity:0;border-radius:0.25rem}.toast:not(:last-child){margin-bottom:0.75rem}.toast.showing{opacity:1}.toast.show{display:block;opacity:1}.toast.hide{display:none}.toast-header{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;padding:0.25rem 0.75rem;color:#999;background-color:rgba(255,255,255,0.85);background-clip:padding-box;border-bottom:1px solid rgba(0,0,0,0.05)}.toast-body{padding:0.75rem}.modal-open{overflow:hidden}.modal-open .modal{overflow-x:hidden;overflow-y:auto}.modal{position:fixed;top:0;left:0;z-index:1050;display:none;width:100%;height:100%;overflow:hidden;outline:0}.modal-dialog{position:relative;width:auto;margin:0.5rem;pointer-events:none}.modal.fade .modal-dialog{-webkit-transition:-webkit-transform 0.3s ease-out;transition:-webkit-transform 0.3s ease-out;transition:transform 0.3s ease-out;transition:transform 0.3s ease-out, -webkit-transform 0.3s ease-out;-webkit-transform:translate(0, -50px);transform:translate(0, -50px)}@media (prefers-reduced-motion: reduce){.modal.fade .modal-dialog{-webkit-transition:none;transition:none}}.modal.show .modal-dialog{-webkit-transform:none;transform:none}.modal.modal-static .modal-dialog{-webkit-transform:scale(1.02);transform:scale(1.02)}.modal-dialog-scrollable{display:-webkit-box;display:-ms-flexbox;display:flex;max-height:calc(100% - 1rem)}.modal-dialog-scrollable .modal-content{max-height:calc(100vh - 1rem);overflow:hidden}.modal-dialog-scrollable .modal-header,.modal-dialog-scrollable .modal-footer{-ms-flex-negative:0;flex-shrink:0}.modal-dialog-scrollable .modal-body{overflow-y:auto}.modal-dialog-centered{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;min-height:calc(100% - 1rem)}.modal-dialog-centered::before{display:block;height:calc(100vh - 1rem);content:""}.modal-dialog-centered.modal-dialog-scrollable{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;height:100%}.modal-dialog-centered.modal-dialog-scrollable .modal-content{max-height:none}.modal-dialog-centered.modal-dialog-scrollable::before{content:none}.modal-content{position:relative;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;width:100%;pointer-events:auto;background-color:#303030;background-clip:padding-box;border:1px solid #444;border-radius:0.3rem;outline:0}.modal-backdrop{position:fixed;top:0;left:0;z-index:1040;width:100vw;height:100vh;background-color:#000}.modal-backdrop.fade{opacity:0}.modal-backdrop.show{opacity:0.5}.modal-header{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;padding:1rem 1rem;border-bottom:1px solid #444;border-top-left-radius:calc(0.3rem - 1px);border-top-right-radius:calc(0.3rem - 1px)}.modal-header .close{padding:1rem 1rem;margin:-1rem -1rem -1rem auto}.modal-title{margin-bottom:0;line-height:1.5}.modal-body{position:relative;-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;padding:1rem}.modal-footer{display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:end;-ms-flex-pack:end;justify-content:flex-end;padding:0.75rem;border-top:1px solid #444;border-bottom-right-radius:calc(0.3rem - 1px);border-bottom-left-radius:calc(0.3rem - 1px)}.modal-footer>*{margin:0.25rem}.modal-scrollbar-measure{position:absolute;top:-9999px;width:50px;height:50px;overflow:scroll}@media (min-width: 576px){.modal-dialog{max-width:500px;margin:1.75rem auto}.modal-dialog-scrollable{max-height:calc(100% - 3.5rem)}.modal-dialog-scrollable .modal-content{max-height:calc(100vh - 3.5rem)}.modal-dialog-centered{min-height:calc(100% - 3.5rem)}.modal-dialog-centered::before{height:calc(100vh - 3.5rem)}.modal-sm{max-width:300px}}@media (min-width: 992px){.modal-lg,.modal-xl{max-width:800px}}@media (min-width: 1200px){.modal-xl{max-width:1140px}}.tooltip{position:absolute;z-index:1070;display:block;margin:0;font-family:"Lato", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;white-space:normal;line-break:auto;font-size:0.8203125rem;word-wrap:break-word;opacity:0}.tooltip.show{opacity:0.9}.tooltip .arrow{position:absolute;display:block;width:0.8rem;height:0.4rem}.tooltip .arrow::before{position:absolute;content:"";border-color:transparent;border-style:solid}.bs-tooltip-top,.bs-tooltip-auto[x-placement^="top"]{padding:0.4rem 0}.bs-tooltip-top .arrow,.bs-tooltip-auto[x-placement^="top"] .arrow{bottom:0}.bs-tooltip-top .arrow::before,.bs-tooltip-auto[x-placement^="top"] .arrow::before{top:0;border-width:0.4rem 0.4rem 0;border-top-color:#000}.bs-tooltip-right,.bs-tooltip-auto[x-placement^="right"]{padding:0 0.4rem}.bs-tooltip-right .arrow,.bs-tooltip-auto[x-placement^="right"] .arrow{left:0;width:0.4rem;height:0.8rem}.bs-tooltip-right .arrow::before,.bs-tooltip-auto[x-placement^="right"] .arrow::before{right:0;border-width:0.4rem 0.4rem 0.4rem 0;border-right-color:#000}.bs-tooltip-bottom,.bs-tooltip-auto[x-placement^="bottom"]{padding:0.4rem 0}.bs-tooltip-bottom .arrow,.bs-tooltip-auto[x-placement^="bottom"] .arrow{top:0}.bs-tooltip-bottom .arrow::before,.bs-tooltip-auto[x-placement^="bottom"] .arrow::before{bottom:0;border-width:0 0.4rem 0.4rem;border-bottom-color:#000}.bs-tooltip-left,.bs-tooltip-auto[x-placement^="left"]{padding:0 0.4rem}.bs-tooltip-left .arrow,.bs-tooltip-auto[x-placement^="left"] .arrow{right:0;width:0.4rem;height:0.8rem}.bs-tooltip-left .arrow::before,.bs-tooltip-auto[x-placement^="left"] .arrow::before{left:0;border-width:0.4rem 0 0.4rem 0.4rem;border-left-color:#000}.tooltip-inner{max-width:200px;padding:0.25rem 0.5rem;color:#fff;text-align:center;background-color:#000;border-radius:0.25rem}.popover{position:absolute;top:0;left:0;z-index:1060;display:block;max-width:276px;font-family:"Lato", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;white-space:normal;line-break:auto;font-size:0.8203125rem;word-wrap:break-word;background-color:#303030;background-clip:padding-box;border:1px solid rgba(0,0,0,0.2);border-radius:0.3rem}.popover .arrow{position:absolute;display:block;width:1rem;height:0.5rem;margin:0 0.3rem}.popover .arrow::before,.popover .arrow::after{position:absolute;display:block;content:"";border-color:transparent;border-style:solid}.bs-popover-top,.bs-popover-auto[x-placement^="top"]{margin-bottom:0.5rem}.bs-popover-top>.arrow,.bs-popover-auto[x-placement^="top"]>.arrow{bottom:calc(-0.5rem - 1px)}.bs-popover-top>.arrow::before,.bs-popover-auto[x-placement^="top"]>.arrow::before{bottom:0;border-width:0.5rem 0.5rem 0;border-top-color:rgba(0,0,0,0.25)}.bs-popover-top>.arrow::after,.bs-popover-auto[x-placement^="top"]>.arrow::after{bottom:1px;border-width:0.5rem 0.5rem 0;border-top-color:#303030}.bs-popover-right,.bs-popover-auto[x-placement^="right"]{margin-left:0.5rem}.bs-popover-right>.arrow,.bs-popover-auto[x-placement^="right"]>.arrow{left:calc(-0.5rem - 1px);width:0.5rem;height:1rem;margin:0.3rem 0}.bs-popover-right>.arrow::before,.bs-popover-auto[x-placement^="right"]>.arrow::before{left:0;border-width:0.5rem 0.5rem 0.5rem 0;border-right-color:rgba(0,0,0,0.25)}.bs-popover-right>.arrow::after,.bs-popover-auto[x-placement^="right"]>.arrow::after{left:1px;border-width:0.5rem 0.5rem 0.5rem 0;border-right-color:#303030}.bs-popover-bottom,.bs-popover-auto[x-placement^="bottom"]{margin-top:0.5rem}.bs-popover-bottom>.arrow,.bs-popover-auto[x-placement^="bottom"]>.arrow{top:calc(-0.5rem - 1px)}.bs-popover-bottom>.arrow::before,.bs-popover-auto[x-placement^="bottom"]>.arrow::before{top:0;border-width:0 0.5rem 0.5rem 0.5rem;border-bottom-color:rgba(0,0,0,0.25)}.bs-popover-bottom>.arrow::after,.bs-popover-auto[x-placement^="bottom"]>.arrow::after{top:1px;border-width:0 0.5rem 0.5rem 0.5rem;border-bottom-color:#303030}.bs-popover-bottom .popover-header::before,.bs-popover-auto[x-placement^="bottom"] .popover-header::before{position:absolute;top:0;left:50%;display:block;width:1rem;margin-left:-0.5rem;content:"";border-bottom:1px solid #444}.bs-popover-left,.bs-popover-auto[x-placement^="left"]{margin-right:0.5rem}.bs-popover-left>.arrow,.bs-popover-auto[x-placement^="left"]>.arrow{right:calc(-0.5rem - 1px);width:0.5rem;height:1rem;margin:0.3rem 0}.bs-popover-left>.arrow::before,.bs-popover-auto[x-placement^="left"]>.arrow::before{right:0;border-width:0.5rem 0 0.5rem 0.5rem;border-left-color:rgba(0,0,0,0.25)}.bs-popover-left>.arrow::after,.bs-popover-auto[x-placement^="left"]>.arrow::after{right:1px;border-width:0.5rem 0 0.5rem 0.5rem;border-left-color:#303030}.popover-header{padding:0.5rem 0.75rem;margin-bottom:0;font-size:0.9375rem;background-color:#444;border-bottom:1px solid #373737;border-top-left-radius:calc(0.3rem - 1px);border-top-right-radius:calc(0.3rem - 1px)}.popover-header:empty{display:none}.popover-body{padding:0.5rem 0.75rem;color:#fff}.carousel{position:relative}.carousel.pointer-event{-ms-touch-action:pan-y;touch-action:pan-y}.carousel-inner{position:relative;width:100%;overflow:hidden}.carousel-inner::after{display:block;clear:both;content:""}.carousel-item{position:relative;display:none;float:left;width:100%;margin-right:-100%;-webkit-backface-visibility:hidden;backface-visibility:hidden;-webkit-transition:-webkit-transform 0.6s ease-in-out;transition:-webkit-transform 0.6s ease-in-out;transition:transform 0.6s ease-in-out;transition:transform 0.6s ease-in-out, -webkit-transform 0.6s ease-in-out}@media (prefers-reduced-motion: reduce){.carousel-item{-webkit-transition:none;transition:none}}.carousel-item.active,.carousel-item-next,.carousel-item-prev{display:block}.carousel-item-next:not(.carousel-item-left),.active.carousel-item-right{-webkit-transform:translateX(100%);transform:translateX(100%)}.carousel-item-prev:not(.carousel-item-right),.active.carousel-item-left{-webkit-transform:translateX(-100%);transform:translateX(-100%)}.carousel-fade .carousel-item{opacity:0;-webkit-transition-property:opacity;transition-property:opacity;-webkit-transform:none;transform:none}.carousel-fade .carousel-item.active,.carousel-fade .carousel-item-next.carousel-item-left,.carousel-fade .carousel-item-prev.carousel-item-right{z-index:1;opacity:1}.carousel-fade .active.carousel-item-left,.carousel-fade .active.carousel-item-right{z-index:0;opacity:0;-webkit-transition:opacity 0s 0.6s;transition:opacity 0s 0.6s}@media (prefers-reduced-motion: reduce){.carousel-fade .active.carousel-item-left,.carousel-fade .active.carousel-item-right{-webkit-transition:none;transition:none}}.carousel-control-prev,.carousel-control-next{position:absolute;top:0;bottom:0;z-index:1;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;width:15%;color:#fff;text-align:center;opacity:0.5;-webkit-transition:opacity 0.15s ease;transition:opacity 0.15s ease}@media (prefers-reduced-motion: reduce){.carousel-control-prev,.carousel-control-next{-webkit-transition:none;transition:none}}.carousel-control-prev:hover,.carousel-control-prev:focus,.carousel-control-next:hover,.carousel-control-next:focus{color:#fff;text-decoration:none;outline:0;opacity:0.9}.carousel-control-prev{left:0}.carousel-control-next{right:0}.carousel-control-prev-icon,.carousel-control-next-icon{display:inline-block;width:20px;height:20px;background:no-repeat 50% / 100% 100%}.carousel-control-prev-icon{background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath d='M5.25 0l-4 4 4 4 1.5-1.5L4.25 4l2.5-2.5L5.25 0z'/%3e%3c/svg%3e")}.carousel-control-next-icon{background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' width='8' height='8' viewBox='0 0 8 8'%3e%3cpath d='M2.75 0l-1.5 1.5L3.75 4l-2.5 2.5L2.75 8l4-4-4-4z'/%3e%3c/svg%3e")}.carousel-indicators{position:absolute;right:0;bottom:0;left:0;z-index:15;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;padding-left:0;margin-right:15%;margin-left:15%;list-style:none}.carousel-indicators li{-webkit-box-sizing:content-box;box-sizing:content-box;-webkit-box-flex:0;-ms-flex:0 1 auto;flex:0 1 auto;width:30px;height:3px;margin-right:3px;margin-left:3px;text-indent:-999px;cursor:pointer;background-color:#fff;background-clip:padding-box;border-top:10px solid transparent;border-bottom:10px solid transparent;opacity:.5;-webkit-transition:opacity 0.6s ease;transition:opacity 0.6s ease}@media (prefers-reduced-motion: reduce){.carousel-indicators li{-webkit-transition:none;transition:none}}.carousel-indicators .active{opacity:1}.carousel-caption{position:absolute;right:15%;bottom:20px;left:15%;z-index:10;padding-top:20px;padding-bottom:20px;color:#fff;text-align:center}@-webkit-keyframes spinner-border{to{-webkit-transform:rotate(360deg);transform:rotate(360deg)}}@keyframes spinner-border{to{-webkit-transform:rotate(360deg);transform:rotate(360deg)}}.spinner-border{display:inline-block;width:2rem;height:2rem;vertical-align:text-bottom;border:0.25em solid currentColor;border-right-color:transparent;border-radius:50%;-webkit-animation:spinner-border .75s linear infinite;animation:spinner-border .75s linear infinite}.spinner-border-sm{width:1rem;height:1rem;border-width:0.2em}@-webkit-keyframes spinner-grow{0%{-webkit-transform:scale(0);transform:scale(0)}50%{opacity:1}}@keyframes spinner-grow{0%{-webkit-transform:scale(0);transform:scale(0)}50%{opacity:1}}.spinner-grow{display:inline-block;width:2rem;height:2rem;vertical-align:text-bottom;background-color:currentColor;border-radius:50%;opacity:0;-webkit-animation:spinner-grow .75s linear infinite;animation:spinner-grow .75s linear infinite}.spinner-grow-sm{width:1rem;height:1rem}.align-baseline{vertical-align:baseline !important}.align-top{vertical-align:top !important}.align-middle{vertical-align:middle !important}.align-bottom{vertical-align:bottom !important}.align-text-bottom{vertical-align:text-bottom !important}.align-text-top{vertical-align:text-top !important}.bg-primary{background-color:#375a7f !important}a.bg-primary:hover,a.bg-primary:focus,button.bg-primary:hover,button.bg-primary:focus{background-color:#28415b !important}.bg-secondary{background-color:#444 !important}a.bg-secondary:hover,a.bg-secondary:focus,button.bg-secondary:hover,button.bg-secondary:focus{background-color:#2b2a2a !important}.bg-success{background-color:#00bc8c !important}a.bg-success:hover,a.bg-success:focus,button.bg-success:hover,button.bg-success:focus{background-color:#008966 !important}.bg-info{background-color:#3498DB !important}a.bg-info:hover,a.bg-info:focus,button.bg-info:hover,button.bg-info:focus{background-color:#217dbb !important}.bg-warning{background-color:#F39C12 !important}a.bg-warning:hover,a.bg-warning:focus,button.bg-warning:hover,button.bg-warning:focus{background-color:#c87f0a !important}.bg-danger{background-color:#E74C3C !important}a.bg-danger:hover,a.bg-danger:focus,button.bg-danger:hover,button.bg-danger:focus{background-color:#d62c1a !important}.bg-light{background-color:#999 !important}a.bg-light:hover,a.bg-light:focus,button.bg-light:hover,button.bg-light:focus{background-color:#807f7f !important}.bg-dark{background-color:#303030 !important}a.bg-dark:hover,a.bg-dark:focus,button.bg-dark:hover,button.bg-dark:focus{background-color:#171616 !important}.bg-white{background-color:#fff !important}.bg-transparent{background-color:transparent !important}.border{border:1px solid #dee2e6 !important}.border-top{border-top:1px solid #dee2e6 !important}.border-right{border-right:1px solid #dee2e6 !important}.border-bottom{border-bottom:1px solid #dee2e6 !important}.border-left{border-left:1px solid #dee2e6 !important}.border-0{border:0 !important}.border-top-0{border-top:0 !important}.border-right-0{border-right:0 !important}.border-bottom-0{border-bottom:0 !important}.border-left-0{border-left:0 !important}.border-primary{border-color:#375a7f !important}.border-secondary{border-color:#444 !important}.border-success{border-color:#00bc8c !important}.border-info{border-color:#3498DB !important}.border-warning{border-color:#F39C12 !important}.border-danger{border-color:#E74C3C !important}.border-light{border-color:#999 !important}.border-dark{border-color:#303030 !important}.border-white{border-color:#fff !important}.rounded-sm{border-radius:0.2rem !important}.rounded{border-radius:0.25rem !important}.rounded-top{border-top-left-radius:0.25rem !important;border-top-right-radius:0.25rem !important}.rounded-right{border-top-right-radius:0.25rem !important;border-bottom-right-radius:0.25rem !important}.rounded-bottom{border-bottom-right-radius:0.25rem !important;border-bottom-left-radius:0.25rem !important}.rounded-left{border-top-left-radius:0.25rem !important;border-bottom-left-radius:0.25rem !important}.rounded-lg{border-radius:0.3rem !important}.rounded-circle{border-radius:50% !important}.rounded-pill{border-radius:50rem !important}.rounded-0{border-radius:0 !important}.clearfix::after{display:block;clear:both;content:""}.d-none{display:none !important}.d-inline{display:inline !important}.d-inline-block{display:inline-block !important}.d-block{display:block !important}.d-table{display:table !important}.d-table-row{display:table-row !important}.d-table-cell{display:table-cell !important}.d-flex{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important}.d-inline-flex{display:-webkit-inline-box !important;display:-ms-inline-flexbox !important;display:inline-flex !important}@media (min-width: 576px){.d-sm-none{display:none !important}.d-sm-inline{display:inline !important}.d-sm-inline-block{display:inline-block !important}.d-sm-block{display:block !important}.d-sm-table{display:table !important}.d-sm-table-row{display:table-row !important}.d-sm-table-cell{display:table-cell !important}.d-sm-flex{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important}.d-sm-inline-flex{display:-webkit-inline-box !important;display:-ms-inline-flexbox !important;display:inline-flex !important}}@media (min-width: 768px){.d-md-none{display:none !important}.d-md-inline{display:inline !important}.d-md-inline-block{display:inline-block !important}.d-md-block{display:block !important}.d-md-table{display:table !important}.d-md-table-row{display:table-row !important}.d-md-table-cell{display:table-cell !important}.d-md-flex{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important}.d-md-inline-flex{display:-webkit-inline-box !important;display:-ms-inline-flexbox !important;display:inline-flex !important}}@media (min-width: 992px){.d-lg-none{display:none !important}.d-lg-inline{display:inline !important}.d-lg-inline-block{display:inline-block !important}.d-lg-block{display:block !important}.d-lg-table{display:table !important}.d-lg-table-row{display:table-row !important}.d-lg-table-cell{display:table-cell !important}.d-lg-flex{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important}.d-lg-inline-flex{display:-webkit-inline-box !important;display:-ms-inline-flexbox !important;display:inline-flex !important}}@media (min-width: 1200px){.d-xl-none{display:none !important}.d-xl-inline{display:inline !important}.d-xl-inline-block{display:inline-block !important}.d-xl-block{display:block !important}.d-xl-table{display:table !important}.d-xl-table-row{display:table-row !important}.d-xl-table-cell{display:table-cell !important}.d-xl-flex{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important}.d-xl-inline-flex{display:-webkit-inline-box !important;display:-ms-inline-flexbox !important;display:inline-flex !important}}@media print{.d-print-none{display:none !important}.d-print-inline{display:inline !important}.d-print-inline-block{display:inline-block !important}.d-print-block{display:block !important}.d-print-table{display:table !important}.d-print-table-row{display:table-row !important}.d-print-table-cell{display:table-cell !important}.d-print-flex{display:-webkit-box !important;display:-ms-flexbox !important;display:flex !important}.d-print-inline-flex{display:-webkit-inline-box !important;display:-ms-inline-flexbox !important;display:inline-flex !important}}.embed-responsive{position:relative;display:block;width:100%;padding:0;overflow:hidden}.embed-responsive::before{display:block;content:""}.embed-responsive .embed-responsive-item,.embed-responsive iframe,.embed-responsive embed,.embed-responsive object,.embed-responsive video{position:absolute;top:0;bottom:0;left:0;width:100%;height:100%;border:0}.embed-responsive-21by9::before{padding-top:42.8571428571%}.embed-responsive-16by9::before{padding-top:56.25%}.embed-responsive-4by3::before{padding-top:75%}.embed-responsive-1by1::before{padding-top:100%}.flex-row{-webkit-box-orient:horizontal !important;-webkit-box-direction:normal !important;-ms-flex-direction:row !important;flex-direction:row !important}.flex-column{-webkit-box-orient:vertical !important;-webkit-box-direction:normal !important;-ms-flex-direction:column !important;flex-direction:column !important}.flex-row-reverse{-webkit-box-orient:horizontal !important;-webkit-box-direction:reverse !important;-ms-flex-direction:row-reverse !important;flex-direction:row-reverse !important}.flex-column-reverse{-webkit-box-orient:vertical !important;-webkit-box-direction:reverse !important;-ms-flex-direction:column-reverse !important;flex-direction:column-reverse !important}.flex-wrap{-ms-flex-wrap:wrap !important;flex-wrap:wrap !important}.flex-nowrap{-ms-flex-wrap:nowrap !important;flex-wrap:nowrap !important}.flex-wrap-reverse{-ms-flex-wrap:wrap-reverse !important;flex-wrap:wrap-reverse !important}.flex-fill{-webkit-box-flex:1 !important;-ms-flex:1 1 auto !important;flex:1 1 auto !important}.flex-grow-0{-webkit-box-flex:0 !important;-ms-flex-positive:0 !important;flex-grow:0 !important}.flex-grow-1{-webkit-box-flex:1 !important;-ms-flex-positive:1 !important;flex-grow:1 !important}.flex-shrink-0{-ms-flex-negative:0 !important;flex-shrink:0 !important}.flex-shrink-1{-ms-flex-negative:1 !important;flex-shrink:1 !important}.justify-content-start{-webkit-box-pack:start !important;-ms-flex-pack:start !important;justify-content:flex-start !important}.justify-content-end{-webkit-box-pack:end !important;-ms-flex-pack:end !important;justify-content:flex-end !important}.justify-content-center{-webkit-box-pack:center !important;-ms-flex-pack:center !important;justify-content:center !important}.justify-content-between{-webkit-box-pack:justify !important;-ms-flex-pack:justify !important;justify-content:space-between !important}.justify-content-around{-ms-flex-pack:distribute !important;justify-content:space-around !important}.align-items-start{-webkit-box-align:start !important;-ms-flex-align:start !important;align-items:flex-start !important}.align-items-end{-webkit-box-align:end !important;-ms-flex-align:end !important;align-items:flex-end !important}.align-items-center{-webkit-box-align:center !important;-ms-flex-align:center !important;align-items:center !important}.align-items-baseline{-webkit-box-align:baseline !important;-ms-flex-align:baseline !important;align-items:baseline !important}.align-items-stretch{-webkit-box-align:stretch !important;-ms-flex-align:stretch !important;align-items:stretch !important}.align-content-start{-ms-flex-line-pack:start !important;align-content:flex-start !important}.align-content-end{-ms-flex-line-pack:end !important;align-content:flex-end !important}.align-content-center{-ms-flex-line-pack:center !important;align-content:center !important}.align-content-between{-ms-flex-line-pack:justify !important;align-content:space-between !important}.align-content-around{-ms-flex-line-pack:distribute !important;align-content:space-around !important}.align-content-stretch{-ms-flex-line-pack:stretch !important;align-content:stretch !important}.align-self-auto{-ms-flex-item-align:auto !important;align-self:auto !important}.align-self-start{-ms-flex-item-align:start !important;align-self:flex-start !important}.align-self-end{-ms-flex-item-align:end !important;align-self:flex-end !important}.align-self-center{-ms-flex-item-align:center !important;align-self:center !important}.align-self-baseline{-ms-flex-item-align:baseline !important;align-self:baseline !important}.align-self-stretch{-ms-flex-item-align:stretch !important;align-self:stretch !important}@media (min-width: 576px){.flex-sm-row{-webkit-box-orient:horizontal !important;-webkit-box-direction:normal !important;-ms-flex-direction:row !important;flex-direction:row !important}.flex-sm-column{-webkit-box-orient:vertical !important;-webkit-box-direction:normal !important;-ms-flex-direction:column !important;flex-direction:column !important}.flex-sm-row-reverse{-webkit-box-orient:horizontal !important;-webkit-box-direction:reverse !important;-ms-flex-direction:row-reverse !important;flex-direction:row-reverse !important}.flex-sm-column-reverse{-webkit-box-orient:vertical !important;-webkit-box-direction:reverse !important;-ms-flex-direction:column-reverse !important;flex-direction:column-reverse !important}.flex-sm-wrap{-ms-flex-wrap:wrap !important;flex-wrap:wrap !important}.flex-sm-nowrap{-ms-flex-wrap:nowrap !important;flex-wrap:nowrap !important}.flex-sm-wrap-reverse{-ms-flex-wrap:wrap-reverse !important;flex-wrap:wrap-reverse !important}.flex-sm-fill{-webkit-box-flex:1 !important;-ms-flex:1 1 auto !important;flex:1 1 auto !important}.flex-sm-grow-0{-webkit-box-flex:0 !important;-ms-flex-positive:0 !important;flex-grow:0 !important}.flex-sm-grow-1{-webkit-box-flex:1 !important;-ms-flex-positive:1 !important;flex-grow:1 !important}.flex-sm-shrink-0{-ms-flex-negative:0 !important;flex-shrink:0 !important}.flex-sm-shrink-1{-ms-flex-negative:1 !important;flex-shrink:1 !important}.justify-content-sm-start{-webkit-box-pack:start !important;-ms-flex-pack:start !important;justify-content:flex-start !important}.justify-content-sm-end{-webkit-box-pack:end !important;-ms-flex-pack:end !important;justify-content:flex-end !important}.justify-content-sm-center{-webkit-box-pack:center !important;-ms-flex-pack:center !important;justify-content:center !important}.justify-content-sm-between{-webkit-box-pack:justify !important;-ms-flex-pack:justify !important;justify-content:space-between !important}.justify-content-sm-around{-ms-flex-pack:distribute !important;justify-content:space-around !important}.align-items-sm-start{-webkit-box-align:start !important;-ms-flex-align:start !important;align-items:flex-start !important}.align-items-sm-end{-webkit-box-align:end !important;-ms-flex-align:end !important;align-items:flex-end !important}.align-items-sm-center{-webkit-box-align:center !important;-ms-flex-align:center !important;align-items:center !important}.align-items-sm-baseline{-webkit-box-align:baseline !important;-ms-flex-align:baseline !important;align-items:baseline !important}.align-items-sm-stretch{-webkit-box-align:stretch !important;-ms-flex-align:stretch !important;align-items:stretch !important}.align-content-sm-start{-ms-flex-line-pack:start !important;align-content:flex-start !important}.align-content-sm-end{-ms-flex-line-pack:end !important;align-content:flex-end !important}.align-content-sm-center{-ms-flex-line-pack:center !important;align-content:center !important}.align-content-sm-between{-ms-flex-line-pack:justify !important;align-content:space-between !important}.align-content-sm-around{-ms-flex-line-pack:distribute !important;align-content:space-around !important}.align-content-sm-stretch{-ms-flex-line-pack:stretch !important;align-content:stretch !important}.align-self-sm-auto{-ms-flex-item-align:auto !important;align-self:auto !important}.align-self-sm-start{-ms-flex-item-align:start !important;align-self:flex-start !important}.align-self-sm-end{-ms-flex-item-align:end !important;align-self:flex-end !important}.align-self-sm-center{-ms-flex-item-align:center !important;align-self:center !important}.align-self-sm-baseline{-ms-flex-item-align:baseline !important;align-self:baseline !important}.align-self-sm-stretch{-ms-flex-item-align:stretch !important;align-self:stretch !important}}@media (min-width: 768px){.flex-md-row{-webkit-box-orient:horizontal !important;-webkit-box-direction:normal !important;-ms-flex-direction:row !important;flex-direction:row !important}.flex-md-column{-webkit-box-orient:vertical !important;-webkit-box-direction:normal !important;-ms-flex-direction:column !important;flex-direction:column !important}.flex-md-row-reverse{-webkit-box-orient:horizontal !important;-webkit-box-direction:reverse !important;-ms-flex-direction:row-reverse !important;flex-direction:row-reverse !important}.flex-md-column-reverse{-webkit-box-orient:vertical !important;-webkit-box-direction:reverse !important;-ms-flex-direction:column-reverse !important;flex-direction:column-reverse !important}.flex-md-wrap{-ms-flex-wrap:wrap !important;flex-wrap:wrap !important}.flex-md-nowrap{-ms-flex-wrap:nowrap !important;flex-wrap:nowrap !important}.flex-md-wrap-reverse{-ms-flex-wrap:wrap-reverse !important;flex-wrap:wrap-reverse !important}.flex-md-fill{-webkit-box-flex:1 !important;-ms-flex:1 1 auto !important;flex:1 1 auto !important}.flex-md-grow-0{-webkit-box-flex:0 !important;-ms-flex-positive:0 !important;flex-grow:0 !important}.flex-md-grow-1{-webkit-box-flex:1 !important;-ms-flex-positive:1 !important;flex-grow:1 !important}.flex-md-shrink-0{-ms-flex-negative:0 !important;flex-shrink:0 !important}.flex-md-shrink-1{-ms-flex-negative:1 !important;flex-shrink:1 !important}.justify-content-md-start{-webkit-box-pack:start !important;-ms-flex-pack:start !important;justify-content:flex-start !important}.justify-content-md-end{-webkit-box-pack:end !important;-ms-flex-pack:end !important;justify-content:flex-end !important}.justify-content-md-center{-webkit-box-pack:center !important;-ms-flex-pack:center !important;justify-content:center !important}.justify-content-md-between{-webkit-box-pack:justify !important;-ms-flex-pack:justify !important;justify-content:space-between !important}.justify-content-md-around{-ms-flex-pack:distribute !important;justify-content:space-around !important}.align-items-md-start{-webkit-box-align:start !important;-ms-flex-align:start !important;align-items:flex-start !important}.align-items-md-end{-webkit-box-align:end !important;-ms-flex-align:end !important;align-items:flex-end !important}.align-items-md-center{-webkit-box-align:center !important;-ms-flex-align:center !important;align-items:center !important}.align-items-md-baseline{-webkit-box-align:baseline !important;-ms-flex-align:baseline !important;align-items:baseline !important}.align-items-md-stretch{-webkit-box-align:stretch !important;-ms-flex-align:stretch !important;align-items:stretch !important}.align-content-md-start{-ms-flex-line-pack:start !important;align-content:flex-start !important}.align-content-md-end{-ms-flex-line-pack:end !important;align-content:flex-end !important}.align-content-md-center{-ms-flex-line-pack:center !important;align-content:center !important}.align-content-md-between{-ms-flex-line-pack:justify !important;align-content:space-between !important}.align-content-md-around{-ms-flex-line-pack:distribute !important;align-content:space-around !important}.align-content-md-stretch{-ms-flex-line-pack:stretch !important;align-content:stretch !important}.align-self-md-auto{-ms-flex-item-align:auto !important;align-self:auto !important}.align-self-md-start{-ms-flex-item-align:start !important;align-self:flex-start !important}.align-self-md-end{-ms-flex-item-align:end !important;align-self:flex-end !important}.align-self-md-center{-ms-flex-item-align:center !important;align-self:center !important}.align-self-md-baseline{-ms-flex-item-align:baseline !important;align-self:baseline !important}.align-self-md-stretch{-ms-flex-item-align:stretch !important;align-self:stretch !important}}@media (min-width: 992px){.flex-lg-row{-webkit-box-orient:horizontal !important;-webkit-box-direction:normal !important;-ms-flex-direction:row !important;flex-direction:row !important}.flex-lg-column{-webkit-box-orient:vertical !important;-webkit-box-direction:normal !important;-ms-flex-direction:column !important;flex-direction:column !important}.flex-lg-row-reverse{-webkit-box-orient:horizontal !important;-webkit-box-direction:reverse !important;-ms-flex-direction:row-reverse !important;flex-direction:row-reverse !important}.flex-lg-column-reverse{-webkit-box-orient:vertical !important;-webkit-box-direction:reverse !important;-ms-flex-direction:column-reverse !important;flex-direction:column-reverse !important}.flex-lg-wrap{-ms-flex-wrap:wrap !important;flex-wrap:wrap !important}.flex-lg-nowrap{-ms-flex-wrap:nowrap !important;flex-wrap:nowrap !important}.flex-lg-wrap-reverse{-ms-flex-wrap:wrap-reverse !important;flex-wrap:wrap-reverse !important}.flex-lg-fill{-webkit-box-flex:1 !important;-ms-flex:1 1 auto !important;flex:1 1 auto !important}.flex-lg-grow-0{-webkit-box-flex:0 !important;-ms-flex-positive:0 !important;flex-grow:0 !important}.flex-lg-grow-1{-webkit-box-flex:1 !important;-ms-flex-positive:1 !important;flex-grow:1 !important}.flex-lg-shrink-0{-ms-flex-negative:0 !important;flex-shrink:0 !important}.flex-lg-shrink-1{-ms-flex-negative:1 !important;flex-shrink:1 !important}.justify-content-lg-start{-webkit-box-pack:start !important;-ms-flex-pack:start !important;justify-content:flex-start !important}.justify-content-lg-end{-webkit-box-pack:end !important;-ms-flex-pack:end !important;justify-content:flex-end !important}.justify-content-lg-center{-webkit-box-pack:center !important;-ms-flex-pack:center !important;justify-content:center !important}.justify-content-lg-between{-webkit-box-pack:justify !important;-ms-flex-pack:justify !important;justify-content:space-between !important}.justify-content-lg-around{-ms-flex-pack:distribute !important;justify-content:space-around !important}.align-items-lg-start{-webkit-box-align:start !important;-ms-flex-align:start !important;align-items:flex-start !important}.align-items-lg-end{-webkit-box-align:end !important;-ms-flex-align:end !important;align-items:flex-end !important}.align-items-lg-center{-webkit-box-align:center !important;-ms-flex-align:center !important;align-items:center !important}.align-items-lg-baseline{-webkit-box-align:baseline !important;-ms-flex-align:baseline !important;align-items:baseline !important}.align-items-lg-stretch{-webkit-box-align:stretch !important;-ms-flex-align:stretch !important;align-items:stretch !important}.align-content-lg-start{-ms-flex-line-pack:start !important;align-content:flex-start !important}.align-content-lg-end{-ms-flex-line-pack:end !important;align-content:flex-end !important}.align-content-lg-center{-ms-flex-line-pack:center !important;align-content:center !important}.align-content-lg-between{-ms-flex-line-pack:justify !important;align-content:space-between !important}.align-content-lg-around{-ms-flex-line-pack:distribute !important;align-content:space-around !important}.align-content-lg-stretch{-ms-flex-line-pack:stretch !important;align-content:stretch !important}.align-self-lg-auto{-ms-flex-item-align:auto !important;align-self:auto !important}.align-self-lg-start{-ms-flex-item-align:start !important;align-self:flex-start !important}.align-self-lg-end{-ms-flex-item-align:end !important;align-self:flex-end !important}.align-self-lg-center{-ms-flex-item-align:center !important;align-self:center !important}.align-self-lg-baseline{-ms-flex-item-align:baseline !important;align-self:baseline !important}.align-self-lg-stretch{-ms-flex-item-align:stretch !important;align-self:stretch !important}}@media (min-width: 1200px){.flex-xl-row{-webkit-box-orient:horizontal !important;-webkit-box-direction:normal !important;-ms-flex-direction:row !important;flex-direction:row !important}.flex-xl-column{-webkit-box-orient:vertical !important;-webkit-box-direction:normal !important;-ms-flex-direction:column !important;flex-direction:column !important}.flex-xl-row-reverse{-webkit-box-orient:horizontal !important;-webkit-box-direction:reverse !important;-ms-flex-direction:row-reverse !important;flex-direction:row-reverse !important}.flex-xl-column-reverse{-webkit-box-orient:vertical !important;-webkit-box-direction:reverse !important;-ms-flex-direction:column-reverse !important;flex-direction:column-reverse !important}.flex-xl-wrap{-ms-flex-wrap:wrap !important;flex-wrap:wrap !important}.flex-xl-nowrap{-ms-flex-wrap:nowrap !important;flex-wrap:nowrap !important}.flex-xl-wrap-reverse{-ms-flex-wrap:wrap-reverse !important;flex-wrap:wrap-reverse !important}.flex-xl-fill{-webkit-box-flex:1 !important;-ms-flex:1 1 auto !important;flex:1 1 auto !important}.flex-xl-grow-0{-webkit-box-flex:0 !important;-ms-flex-positive:0 !important;flex-grow:0 !important}.flex-xl-grow-1{-webkit-box-flex:1 !important;-ms-flex-positive:1 !important;flex-grow:1 !important}.flex-xl-shrink-0{-ms-flex-negative:0 !important;flex-shrink:0 !important}.flex-xl-shrink-1{-ms-flex-negative:1 !important;flex-shrink:1 !important}.justify-content-xl-start{-webkit-box-pack:start !important;-ms-flex-pack:start !important;justify-content:flex-start !important}.justify-content-xl-end{-webkit-box-pack:end !important;-ms-flex-pack:end !important;justify-content:flex-end !important}.justify-content-xl-center{-webkit-box-pack:center !important;-ms-flex-pack:center !important;justify-content:center !important}.justify-content-xl-between{-webkit-box-pack:justify !important;-ms-flex-pack:justify !important;justify-content:space-between !important}.justify-content-xl-around{-ms-flex-pack:distribute !important;justify-content:space-around !important}.align-items-xl-start{-webkit-box-align:start !important;-ms-flex-align:start !important;align-items:flex-start !important}.align-items-xl-end{-webkit-box-align:end !important;-ms-flex-align:end !important;align-items:flex-end !important}.align-items-xl-center{-webkit-box-align:center !important;-ms-flex-align:center !important;align-items:center !important}.align-items-xl-baseline{-webkit-box-align:baseline !important;-ms-flex-align:baseline !important;align-items:baseline !important}.align-items-xl-stretch{-webkit-box-align:stretch !important;-ms-flex-align:stretch !important;align-items:stretch !important}.align-content-xl-start{-ms-flex-line-pack:start !important;align-content:flex-start !important}.align-content-xl-end{-ms-flex-line-pack:end !important;align-content:flex-end !important}.align-content-xl-center{-ms-flex-line-pack:center !important;align-content:center !important}.align-content-xl-between{-ms-flex-line-pack:justify !important;align-content:space-between !important}.align-content-xl-around{-ms-flex-line-pack:distribute !important;align-content:space-around !important}.align-content-xl-stretch{-ms-flex-line-pack:stretch !important;align-content:stretch !important}.align-self-xl-auto{-ms-flex-item-align:auto !important;align-self:auto !important}.align-self-xl-start{-ms-flex-item-align:start !important;align-self:flex-start !important}.align-self-xl-end{-ms-flex-item-align:end !important;align-self:flex-end !important}.align-self-xl-center{-ms-flex-item-align:center !important;align-self:center !important}.align-self-xl-baseline{-ms-flex-item-align:baseline !important;align-self:baseline !important}.align-self-xl-stretch{-ms-flex-item-align:stretch !important;align-self:stretch !important}}.float-left{float:left !important}.float-right{float:right !important}.float-none{float:none !important}@media (min-width: 576px){.float-sm-left{float:left !important}.float-sm-right{float:right !important}.float-sm-none{float:none !important}}@media (min-width: 768px){.float-md-left{float:left !important}.float-md-right{float:right !important}.float-md-none{float:none !important}}@media (min-width: 992px){.float-lg-left{float:left !important}.float-lg-right{float:right !important}.float-lg-none{float:none !important}}@media (min-width: 1200px){.float-xl-left{float:left !important}.float-xl-right{float:right !important}.float-xl-none{float:none !important}}.overflow-auto{overflow:auto !important}.overflow-hidden{overflow:hidden !important}.position-static{position:static !important}.position-relative{position:relative !important}.position-absolute{position:absolute !important}.position-fixed{position:fixed !important}.position-sticky{position:-webkit-sticky !important;position:sticky !important}.fixed-top{position:fixed;top:0;right:0;left:0;z-index:1030}.fixed-bottom{position:fixed;right:0;bottom:0;left:0;z-index:1030}@supports (position: -webkit-sticky) or (position: sticky){.sticky-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0, 0, 0, 0);white-space:nowrap;border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;overflow:visible;clip:auto;white-space:normal}.shadow-sm{-webkit-box-shadow:0 0.125rem 0.25rem rgba(0,0,0,0.075) !important;box-shadow:0 0.125rem 0.25rem rgba(0,0,0,0.075) !important}.shadow{-webkit-box-shadow:0 0.5rem 1rem rgba(0,0,0,0.15) !important;box-shadow:0 0.5rem 1rem rgba(0,0,0,0.15) !important}.shadow-lg{-webkit-box-shadow:0 1rem 3rem rgba(0,0,0,0.175) !important;box-shadow:0 1rem 3rem rgba(0,0,0,0.175) !important}.shadow-none{-webkit-box-shadow:none !important;box-shadow:none !important}.w-25{width:25% !important}.w-50{width:50% !important}.w-75{width:75% !important}.w-100{width:100% !important}.w-auto{width:auto !important}.h-25{height:25% !important}.h-50{height:50% !important}.h-75{height:75% !important}.h-100{height:100% !important}.h-auto{height:auto !important}.mw-100{max-width:100% !important}.mh-100{max-height:100% !important}.min-vw-100{min-width:100vw !important}.min-vh-100{min-height:100vh !important}.vw-100{width:100vw !important}.vh-100{height:100vh !important}.stretched-link::after{position:absolute;top:0;right:0;bottom:0;left:0;z-index:1;pointer-events:auto;content:"";background-color:rgba(0,0,0,0)}.m-0{margin:0 !important}.mt-0,.my-0{margin-top:0 !important}.mr-0,.mx-0{margin-right:0 !important}.mb-0,.my-0{margin-bottom:0 !important}.ml-0,.mx-0{margin-left:0 !important}.m-1{margin:0.25rem !important}.mt-1,.my-1{margin-top:0.25rem !important}.mr-1,.mx-1{margin-right:0.25rem !important}.mb-1,.my-1{margin-bottom:0.25rem !important}.ml-1,.mx-1{margin-left:0.25rem !important}.m-2{margin:0.5rem !important}.mt-2,.my-2{margin-top:0.5rem !important}.mr-2,.mx-2{margin-right:0.5rem !important}.mb-2,.my-2{margin-bottom:0.5rem !important}.ml-2,.mx-2{margin-left:0.5rem !important}.m-3{margin:1rem !important}.mt-3,.my-3{margin-top:1rem !important}.mr-3,.mx-3{margin-right:1rem !important}.mb-3,.my-3{margin-bottom:1rem !important}.ml-3,.mx-3{margin-left:1rem !important}.m-4{margin:1.5rem !important}.mt-4,.my-4{margin-top:1.5rem !important}.mr-4,.mx-4{margin-right:1.5rem !important}.mb-4,.my-4{margin-bottom:1.5rem !important}.ml-4,.mx-4{margin-left:1.5rem !important}.m-5{margin:3rem !important}.mt-5,.my-5{margin-top:3rem !important}.mr-5,.mx-5{margin-right:3rem !important}.mb-5,.my-5{margin-bottom:3rem !important}.ml-5,.mx-5{margin-left:3rem !important}.p-0{padding:0 !important}.pt-0,.py-0{padding-top:0 !important}.pr-0,.px-0{padding-right:0 !important}.pb-0,.py-0{padding-bottom:0 !important}.pl-0,.px-0{padding-left:0 !important}.p-1{padding:0.25rem !important}.pt-1,.py-1{padding-top:0.25rem !important}.pr-1,.px-1{padding-right:0.25rem !important}.pb-1,.py-1{padding-bottom:0.25rem !important}.pl-1,.px-1{padding-left:0.25rem !important}.p-2{padding:0.5rem !important}.pt-2,.py-2{padding-top:0.5rem !important}.pr-2,.px-2{padding-right:0.5rem !important}.pb-2,.py-2{padding-bottom:0.5rem !important}.pl-2,.px-2{padding-left:0.5rem !important}.p-3{padding:1rem !important}.pt-3,.py-3{padding-top:1rem !important}.pr-3,.px-3{padding-right:1rem !important}.pb-3,.py-3{padding-bottom:1rem !important}.pl-3,.px-3{padding-left:1rem !important}.p-4{padding:1.5rem !important}.pt-4,.py-4{padding-top:1.5rem !important}.pr-4,.px-4{padding-right:1.5rem !important}.pb-4,.py-4{padding-bottom:1.5rem !important}.pl-4,.px-4{padding-left:1.5rem !important}.p-5{padding:3rem !important}.pt-5,.py-5{padding-top:3rem !important}.pr-5,.px-5{padding-right:3rem !important}.pb-5,.py-5{padding-bottom:3rem !important}.pl-5,.px-5{padding-left:3rem !important}.m-n1{margin:-0.25rem !important}.mt-n1,.my-n1{margin-top:-0.25rem !important}.mr-n1,.mx-n1{margin-right:-0.25rem !important}.mb-n1,.my-n1{margin-bottom:-0.25rem !important}.ml-n1,.mx-n1{margin-left:-0.25rem !important}.m-n2{margin:-0.5rem !important}.mt-n2,.my-n2{margin-top:-0.5rem !important}.mr-n2,.mx-n2{margin-right:-0.5rem !important}.mb-n2,.my-n2{margin-bottom:-0.5rem !important}.ml-n2,.mx-n2{margin-left:-0.5rem !important}.m-n3{margin:-1rem !important}.mt-n3,.my-n3{margin-top:-1rem !important}.mr-n3,.mx-n3{margin-right:-1rem !important}.mb-n3,.my-n3{margin-bottom:-1rem !important}.ml-n3,.mx-n3{margin-left:-1rem !important}.m-n4{margin:-1.5rem !important}.mt-n4,.my-n4{margin-top:-1.5rem !important}.mr-n4,.mx-n4{margin-right:-1.5rem !important}.mb-n4,.my-n4{margin-bottom:-1.5rem !important}.ml-n4,.mx-n4{margin-left:-1.5rem !important}.m-n5{margin:-3rem !important}.mt-n5,.my-n5{margin-top:-3rem !important}.mr-n5,.mx-n5{margin-right:-3rem !important}.mb-n5,.my-n5{margin-bottom:-3rem !important}.ml-n5,.mx-n5{margin-left:-3rem !important}.m-auto{margin:auto !important}.mt-auto,.my-auto{margin-top:auto !important}.mr-auto,.mx-auto{margin-right:auto !important}.mb-auto,.my-auto{margin-bottom:auto !important}.ml-auto,.mx-auto{margin-left:auto !important}@media (min-width: 576px){.m-sm-0{margin:0 !important}.mt-sm-0,.my-sm-0{margin-top:0 !important}.mr-sm-0,.mx-sm-0{margin-right:0 !important}.mb-sm-0,.my-sm-0{margin-bottom:0 !important}.ml-sm-0,.mx-sm-0{margin-left:0 !important}.m-sm-1{margin:0.25rem !important}.mt-sm-1,.my-sm-1{margin-top:0.25rem !important}.mr-sm-1,.mx-sm-1{margin-right:0.25rem !important}.mb-sm-1,.my-sm-1{margin-bottom:0.25rem !important}.ml-sm-1,.mx-sm-1{margin-left:0.25rem !important}.m-sm-2{margin:0.5rem !important}.mt-sm-2,.my-sm-2{margin-top:0.5rem !important}.mr-sm-2,.mx-sm-2{margin-right:0.5rem !important}.mb-sm-2,.my-sm-2{margin-bottom:0.5rem !important}.ml-sm-2,.mx-sm-2{margin-left:0.5rem !important}.m-sm-3{margin:1rem !important}.mt-sm-3,.my-sm-3{margin-top:1rem !important}.mr-sm-3,.mx-sm-3{margin-right:1rem !important}.mb-sm-3,.my-sm-3{margin-bottom:1rem !important}.ml-sm-3,.mx-sm-3{margin-left:1rem !important}.m-sm-4{margin:1.5rem !important}.mt-sm-4,.my-sm-4{margin-top:1.5rem !important}.mr-sm-4,.mx-sm-4{margin-right:1.5rem !important}.mb-sm-4,.my-sm-4{margin-bottom:1.5rem !important}.ml-sm-4,.mx-sm-4{margin-left:1.5rem !important}.m-sm-5{margin:3rem !important}.mt-sm-5,.my-sm-5{margin-top:3rem !important}.mr-sm-5,.mx-sm-5{margin-right:3rem !important}.mb-sm-5,.my-sm-5{margin-bottom:3rem !important}.ml-sm-5,.mx-sm-5{margin-left:3rem !important}.p-sm-0{padding:0 !important}.pt-sm-0,.py-sm-0{padding-top:0 !important}.pr-sm-0,.px-sm-0{padding-right:0 !important}.pb-sm-0,.py-sm-0{padding-bottom:0 !important}.pl-sm-0,.px-sm-0{padding-left:0 !important}.p-sm-1{padding:0.25rem !important}.pt-sm-1,.py-sm-1{padding-top:0.25rem !important}.pr-sm-1,.px-sm-1{padding-right:0.25rem !important}.pb-sm-1,.py-sm-1{padding-bottom:0.25rem !important}.pl-sm-1,.px-sm-1{padding-left:0.25rem !important}.p-sm-2{padding:0.5rem !important}.pt-sm-2,.py-sm-2{padding-top:0.5rem !important}.pr-sm-2,.px-sm-2{padding-right:0.5rem !important}.pb-sm-2,.py-sm-2{padding-bottom:0.5rem !important}.pl-sm-2,.px-sm-2{padding-left:0.5rem !important}.p-sm-3{padding:1rem !important}.pt-sm-3,.py-sm-3{padding-top:1rem !important}.pr-sm-3,.px-sm-3{padding-right:1rem !important}.pb-sm-3,.py-sm-3{padding-bottom:1rem !important}.pl-sm-3,.px-sm-3{padding-left:1rem !important}.p-sm-4{padding:1.5rem !important}.pt-sm-4,.py-sm-4{padding-top:1.5rem !important}.pr-sm-4,.px-sm-4{padding-right:1.5rem !important}.pb-sm-4,.py-sm-4{padding-bottom:1.5rem !important}.pl-sm-4,.px-sm-4{padding-left:1.5rem !important}.p-sm-5{padding:3rem !important}.pt-sm-5,.py-sm-5{padding-top:3rem !important}.pr-sm-5,.px-sm-5{padding-right:3rem !important}.pb-sm-5,.py-sm-5{padding-bottom:3rem !important}.pl-sm-5,.px-sm-5{padding-left:3rem !important}.m-sm-n1{margin:-0.25rem !important}.mt-sm-n1,.my-sm-n1{margin-top:-0.25rem !important}.mr-sm-n1,.mx-sm-n1{margin-right:-0.25rem !important}.mb-sm-n1,.my-sm-n1{margin-bottom:-0.25rem !important}.ml-sm-n1,.mx-sm-n1{margin-left:-0.25rem !important}.m-sm-n2{margin:-0.5rem !important}.mt-sm-n2,.my-sm-n2{margin-top:-0.5rem !important}.mr-sm-n2,.mx-sm-n2{margin-right:-0.5rem !important}.mb-sm-n2,.my-sm-n2{margin-bottom:-0.5rem !important}.ml-sm-n2,.mx-sm-n2{margin-left:-0.5rem !important}.m-sm-n3{margin:-1rem !important}.mt-sm-n3,.my-sm-n3{margin-top:-1rem !important}.mr-sm-n3,.mx-sm-n3{margin-right:-1rem !important}.mb-sm-n3,.my-sm-n3{margin-bottom:-1rem !important}.ml-sm-n3,.mx-sm-n3{margin-left:-1rem !important}.m-sm-n4{margin:-1.5rem !important}.mt-sm-n4,.my-sm-n4{margin-top:-1.5rem !important}.mr-sm-n4,.mx-sm-n4{margin-right:-1.5rem !important}.mb-sm-n4,.my-sm-n4{margin-bottom:-1.5rem !important}.ml-sm-n4,.mx-sm-n4{margin-left:-1.5rem !important}.m-sm-n5{margin:-3rem !important}.mt-sm-n5,.my-sm-n5{margin-top:-3rem !important}.mr-sm-n5,.mx-sm-n5{margin-right:-3rem !important}.mb-sm-n5,.my-sm-n5{margin-bottom:-3rem !important}.ml-sm-n5,.mx-sm-n5{margin-left:-3rem !important}.m-sm-auto{margin:auto !important}.mt-sm-auto,.my-sm-auto{margin-top:auto !important}.mr-sm-auto,.mx-sm-auto{margin-right:auto !important}.mb-sm-auto,.my-sm-auto{margin-bottom:auto !important}.ml-sm-auto,.mx-sm-auto{margin-left:auto !important}}@media (min-width: 768px){.m-md-0{margin:0 !important}.mt-md-0,.my-md-0{margin-top:0 !important}.mr-md-0,.mx-md-0{margin-right:0 !important}.mb-md-0,.my-md-0{margin-bottom:0 !important}.ml-md-0,.mx-md-0{margin-left:0 !important}.m-md-1{margin:0.25rem !important}.mt-md-1,.my-md-1{margin-top:0.25rem !important}.mr-md-1,.mx-md-1{margin-right:0.25rem !important}.mb-md-1,.my-md-1{margin-bottom:0.25rem !important}.ml-md-1,.mx-md-1{margin-left:0.25rem !important}.m-md-2{margin:0.5rem !important}.mt-md-2,.my-md-2{margin-top:0.5rem !important}.mr-md-2,.mx-md-2{margin-right:0.5rem !important}.mb-md-2,.my-md-2{margin-bottom:0.5rem !important}.ml-md-2,.mx-md-2{margin-left:0.5rem !important}.m-md-3{margin:1rem !important}.mt-md-3,.my-md-3{margin-top:1rem !important}.mr-md-3,.mx-md-3{margin-right:1rem !important}.mb-md-3,.my-md-3{margin-bottom:1rem !important}.ml-md-3,.mx-md-3{margin-left:1rem !important}.m-md-4{margin:1.5rem !important}.mt-md-4,.my-md-4{margin-top:1.5rem !important}.mr-md-4,.mx-md-4{margin-right:1.5rem !important}.mb-md-4,.my-md-4{margin-bottom:1.5rem !important}.ml-md-4,.mx-md-4{margin-left:1.5rem !important}.m-md-5{margin:3rem !important}.mt-md-5,.my-md-5{margin-top:3rem !important}.mr-md-5,.mx-md-5{margin-right:3rem !important}.mb-md-5,.my-md-5{margin-bottom:3rem !important}.ml-md-5,.mx-md-5{margin-left:3rem !important}.p-md-0{padding:0 !important}.pt-md-0,.py-md-0{padding-top:0 !important}.pr-md-0,.px-md-0{padding-right:0 !important}.pb-md-0,.py-md-0{padding-bottom:0 !important}.pl-md-0,.px-md-0{padding-left:0 !important}.p-md-1{padding:0.25rem !important}.pt-md-1,.py-md-1{padding-top:0.25rem !important}.pr-md-1,.px-md-1{padding-right:0.25rem !important}.pb-md-1,.py-md-1{padding-bottom:0.25rem !important}.pl-md-1,.px-md-1{padding-left:0.25rem !important}.p-md-2{padding:0.5rem !important}.pt-md-2,.py-md-2{padding-top:0.5rem !important}.pr-md-2,.px-md-2{padding-right:0.5rem !important}.pb-md-2,.py-md-2{padding-bottom:0.5rem !important}.pl-md-2,.px-md-2{padding-left:0.5rem !important}.p-md-3{padding:1rem !important}.pt-md-3,.py-md-3{padding-top:1rem !important}.pr-md-3,.px-md-3{padding-right:1rem !important}.pb-md-3,.py-md-3{padding-bottom:1rem !important}.pl-md-3,.px-md-3{padding-left:1rem !important}.p-md-4{padding:1.5rem !important}.pt-md-4,.py-md-4{padding-top:1.5rem !important}.pr-md-4,.px-md-4{padding-right:1.5rem !important}.pb-md-4,.py-md-4{padding-bottom:1.5rem !important}.pl-md-4,.px-md-4{padding-left:1.5rem !important}.p-md-5{padding:3rem !important}.pt-md-5,.py-md-5{padding-top:3rem !important}.pr-md-5,.px-md-5{padding-right:3rem !important}.pb-md-5,.py-md-5{padding-bottom:3rem !important}.pl-md-5,.px-md-5{padding-left:3rem !important}.m-md-n1{margin:-0.25rem !important}.mt-md-n1,.my-md-n1{margin-top:-0.25rem !important}.mr-md-n1,.mx-md-n1{margin-right:-0.25rem !important}.mb-md-n1,.my-md-n1{margin-bottom:-0.25rem !important}.ml-md-n1,.mx-md-n1{margin-left:-0.25rem !important}.m-md-n2{margin:-0.5rem !important}.mt-md-n2,.my-md-n2{margin-top:-0.5rem !important}.mr-md-n2,.mx-md-n2{margin-right:-0.5rem !important}.mb-md-n2,.my-md-n2{margin-bottom:-0.5rem !important}.ml-md-n2,.mx-md-n2{margin-left:-0.5rem !important}.m-md-n3{margin:-1rem !important}.mt-md-n3,.my-md-n3{margin-top:-1rem !important}.mr-md-n3,.mx-md-n3{margin-right:-1rem !important}.mb-md-n3,.my-md-n3{margin-bottom:-1rem !important}.ml-md-n3,.mx-md-n3{margin-left:-1rem !important}.m-md-n4{margin:-1.5rem !important}.mt-md-n4,.my-md-n4{margin-top:-1.5rem !important}.mr-md-n4,.mx-md-n4{margin-right:-1.5rem !important}.mb-md-n4,.my-md-n4{margin-bottom:-1.5rem !important}.ml-md-n4,.mx-md-n4{margin-left:-1.5rem !important}.m-md-n5{margin:-3rem !important}.mt-md-n5,.my-md-n5{margin-top:-3rem !important}.mr-md-n5,.mx-md-n5{margin-right:-3rem !important}.mb-md-n5,.my-md-n5{margin-bottom:-3rem !important}.ml-md-n5,.mx-md-n5{margin-left:-3rem !important}.m-md-auto{margin:auto !important}.mt-md-auto,.my-md-auto{margin-top:auto !important}.mr-md-auto,.mx-md-auto{margin-right:auto !important}.mb-md-auto,.my-md-auto{margin-bottom:auto !important}.ml-md-auto,.mx-md-auto{margin-left:auto !important}}@media (min-width: 992px){.m-lg-0{margin:0 !important}.mt-lg-0,.my-lg-0{margin-top:0 !important}.mr-lg-0,.mx-lg-0{margin-right:0 !important}.mb-lg-0,.my-lg-0{margin-bottom:0 !important}.ml-lg-0,.mx-lg-0{margin-left:0 !important}.m-lg-1{margin:0.25rem !important}.mt-lg-1,.my-lg-1{margin-top:0.25rem !important}.mr-lg-1,.mx-lg-1{margin-right:0.25rem !important}.mb-lg-1,.my-lg-1{margin-bottom:0.25rem !important}.ml-lg-1,.mx-lg-1{margin-left:0.25rem !important}.m-lg-2{margin:0.5rem !important}.mt-lg-2,.my-lg-2{margin-top:0.5rem !important}.mr-lg-2,.mx-lg-2{margin-right:0.5rem !important}.mb-lg-2,.my-lg-2{margin-bottom:0.5rem !important}.ml-lg-2,.mx-lg-2{margin-left:0.5rem !important}.m-lg-3{margin:1rem !important}.mt-lg-3,.my-lg-3{margin-top:1rem !important}.mr-lg-3,.mx-lg-3{margin-right:1rem !important}.mb-lg-3,.my-lg-3{margin-bottom:1rem !important}.ml-lg-3,.mx-lg-3{margin-left:1rem !important}.m-lg-4{margin:1.5rem !important}.mt-lg-4,.my-lg-4{margin-top:1.5rem !important}.mr-lg-4,.mx-lg-4{margin-right:1.5rem !important}.mb-lg-4,.my-lg-4{margin-bottom:1.5rem !important}.ml-lg-4,.mx-lg-4{margin-left:1.5rem !important}.m-lg-5{margin:3rem !important}.mt-lg-5,.my-lg-5{margin-top:3rem !important}.mr-lg-5,.mx-lg-5{margin-right:3rem !important}.mb-lg-5,.my-lg-5{margin-bottom:3rem !important}.ml-lg-5,.mx-lg-5{margin-left:3rem !important}.p-lg-0{padding:0 !important}.pt-lg-0,.py-lg-0{padding-top:0 !important}.pr-lg-0,.px-lg-0{padding-right:0 !important}.pb-lg-0,.py-lg-0{padding-bottom:0 !important}.pl-lg-0,.px-lg-0{padding-left:0 !important}.p-lg-1{padding:0.25rem !important}.pt-lg-1,.py-lg-1{padding-top:0.25rem !important}.pr-lg-1,.px-lg-1{padding-right:0.25rem !important}.pb-lg-1,.py-lg-1{padding-bottom:0.25rem !important}.pl-lg-1,.px-lg-1{padding-left:0.25rem !important}.p-lg-2{padding:0.5rem !important}.pt-lg-2,.py-lg-2{padding-top:0.5rem !important}.pr-lg-2,.px-lg-2{padding-right:0.5rem !important}.pb-lg-2,.py-lg-2{padding-bottom:0.5rem !important}.pl-lg-2,.px-lg-2{padding-left:0.5rem !important}.p-lg-3{padding:1rem !important}.pt-lg-3,.py-lg-3{padding-top:1rem !important}.pr-lg-3,.px-lg-3{padding-right:1rem !important}.pb-lg-3,.py-lg-3{padding-bottom:1rem !important}.pl-lg-3,.px-lg-3{padding-left:1rem !important}.p-lg-4{padding:1.5rem !important}.pt-lg-4,.py-lg-4{padding-top:1.5rem !important}.pr-lg-4,.px-lg-4{padding-right:1.5rem !important}.pb-lg-4,.py-lg-4{padding-bottom:1.5rem !important}.pl-lg-4,.px-lg-4{padding-left:1.5rem !important}.p-lg-5{padding:3rem !important}.pt-lg-5,.py-lg-5{padding-top:3rem !important}.pr-lg-5,.px-lg-5{padding-right:3rem !important}.pb-lg-5,.py-lg-5{padding-bottom:3rem !important}.pl-lg-5,.px-lg-5{padding-left:3rem !important}.m-lg-n1{margin:-0.25rem !important}.mt-lg-n1,.my-lg-n1{margin-top:-0.25rem !important}.mr-lg-n1,.mx-lg-n1{margin-right:-0.25rem !important}.mb-lg-n1,.my-lg-n1{margin-bottom:-0.25rem !important}.ml-lg-n1,.mx-lg-n1{margin-left:-0.25rem !important}.m-lg-n2{margin:-0.5rem !important}.mt-lg-n2,.my-lg-n2{margin-top:-0.5rem !important}.mr-lg-n2,.mx-lg-n2{margin-right:-0.5rem !important}.mb-lg-n2,.my-lg-n2{margin-bottom:-0.5rem !important}.ml-lg-n2,.mx-lg-n2{margin-left:-0.5rem !important}.m-lg-n3{margin:-1rem !important}.mt-lg-n3,.my-lg-n3{margin-top:-1rem !important}.mr-lg-n3,.mx-lg-n3{margin-right:-1rem !important}.mb-lg-n3,.my-lg-n3{margin-bottom:-1rem !important}.ml-lg-n3,.mx-lg-n3{margin-left:-1rem !important}.m-lg-n4{margin:-1.5rem !important}.mt-lg-n4,.my-lg-n4{margin-top:-1.5rem !important}.mr-lg-n4,.mx-lg-n4{margin-right:-1.5rem !important}.mb-lg-n4,.my-lg-n4{margin-bottom:-1.5rem !important}.ml-lg-n4,.mx-lg-n4{margin-left:-1.5rem !important}.m-lg-n5{margin:-3rem !important}.mt-lg-n5,.my-lg-n5{margin-top:-3rem !important}.mr-lg-n5,.mx-lg-n5{margin-right:-3rem !important}.mb-lg-n5,.my-lg-n5{margin-bottom:-3rem !important}.ml-lg-n5,.mx-lg-n5{margin-left:-3rem !important}.m-lg-auto{margin:auto !important}.mt-lg-auto,.my-lg-auto{margin-top:auto !important}.mr-lg-auto,.mx-lg-auto{margin-right:auto !important}.mb-lg-auto,.my-lg-auto{margin-bottom:auto !important}.ml-lg-auto,.mx-lg-auto{margin-left:auto !important}}@media (min-width: 1200px){.m-xl-0{margin:0 !important}.mt-xl-0,.my-xl-0{margin-top:0 !important}.mr-xl-0,.mx-xl-0{margin-right:0 !important}.mb-xl-0,.my-xl-0{margin-bottom:0 !important}.ml-xl-0,.mx-xl-0{margin-left:0 !important}.m-xl-1{margin:0.25rem !important}.mt-xl-1,.my-xl-1{margin-top:0.25rem !important}.mr-xl-1,.mx-xl-1{margin-right:0.25rem !important}.mb-xl-1,.my-xl-1{margin-bottom:0.25rem !important}.ml-xl-1,.mx-xl-1{margin-left:0.25rem !important}.m-xl-2{margin:0.5rem !important}.mt-xl-2,.my-xl-2{margin-top:0.5rem !important}.mr-xl-2,.mx-xl-2{margin-right:0.5rem !important}.mb-xl-2,.my-xl-2{margin-bottom:0.5rem !important}.ml-xl-2,.mx-xl-2{margin-left:0.5rem !important}.m-xl-3{margin:1rem !important}.mt-xl-3,.my-xl-3{margin-top:1rem !important}.mr-xl-3,.mx-xl-3{margin-right:1rem !important}.mb-xl-3,.my-xl-3{margin-bottom:1rem !important}.ml-xl-3,.mx-xl-3{margin-left:1rem !important}.m-xl-4{margin:1.5rem !important}.mt-xl-4,.my-xl-4{margin-top:1.5rem !important}.mr-xl-4,.mx-xl-4{margin-right:1.5rem !important}.mb-xl-4,.my-xl-4{margin-bottom:1.5rem !important}.ml-xl-4,.mx-xl-4{margin-left:1.5rem !important}.m-xl-5{margin:3rem !important}.mt-xl-5,.my-xl-5{margin-top:3rem !important}.mr-xl-5,.mx-xl-5{margin-right:3rem !important}.mb-xl-5,.my-xl-5{margin-bottom:3rem !important}.ml-xl-5,.mx-xl-5{margin-left:3rem !important}.p-xl-0{padding:0 !important}.pt-xl-0,.py-xl-0{padding-top:0 !important}.pr-xl-0,.px-xl-0{padding-right:0 !important}.pb-xl-0,.py-xl-0{padding-bottom:0 !important}.pl-xl-0,.px-xl-0{padding-left:0 !important}.p-xl-1{padding:0.25rem !important}.pt-xl-1,.py-xl-1{padding-top:0.25rem !important}.pr-xl-1,.px-xl-1{padding-right:0.25rem !important}.pb-xl-1,.py-xl-1{padding-bottom:0.25rem !important}.pl-xl-1,.px-xl-1{padding-left:0.25rem !important}.p-xl-2{padding:0.5rem !important}.pt-xl-2,.py-xl-2{padding-top:0.5rem !important}.pr-xl-2,.px-xl-2{padding-right:0.5rem !important}.pb-xl-2,.py-xl-2{padding-bottom:0.5rem !important}.pl-xl-2,.px-xl-2{padding-left:0.5rem !important}.p-xl-3{padding:1rem !important}.pt-xl-3,.py-xl-3{padding-top:1rem !important}.pr-xl-3,.px-xl-3{padding-right:1rem !important}.pb-xl-3,.py-xl-3{padding-bottom:1rem !important}.pl-xl-3,.px-xl-3{padding-left:1rem !important}.p-xl-4{padding:1.5rem !important}.pt-xl-4,.py-xl-4{padding-top:1.5rem !important}.pr-xl-4,.px-xl-4{padding-right:1.5rem !important}.pb-xl-4,.py-xl-4{padding-bottom:1.5rem !important}.pl-xl-4,.px-xl-4{padding-left:1.5rem !important}.p-xl-5{padding:3rem !important}.pt-xl-5,.py-xl-5{padding-top:3rem !important}.pr-xl-5,.px-xl-5{padding-right:3rem !important}.pb-xl-5,.py-xl-5{padding-bottom:3rem !important}.pl-xl-5,.px-xl-5{padding-left:3rem !important}.m-xl-n1{margin:-0.25rem !important}.mt-xl-n1,.my-xl-n1{margin-top:-0.25rem !important}.mr-xl-n1,.mx-xl-n1{margin-right:-0.25rem !important}.mb-xl-n1,.my-xl-n1{margin-bottom:-0.25rem !important}.ml-xl-n1,.mx-xl-n1{margin-left:-0.25rem !important}.m-xl-n2{margin:-0.5rem !important}.mt-xl-n2,.my-xl-n2{margin-top:-0.5rem !important}.mr-xl-n2,.mx-xl-n2{margin-right:-0.5rem !important}.mb-xl-n2,.my-xl-n2{margin-bottom:-0.5rem !important}.ml-xl-n2,.mx-xl-n2{margin-left:-0.5rem !important}.m-xl-n3{margin:-1rem !important}.mt-xl-n3,.my-xl-n3{margin-top:-1rem !important}.mr-xl-n3,.mx-xl-n3{margin-right:-1rem !important}.mb-xl-n3,.my-xl-n3{margin-bottom:-1rem !important}.ml-xl-n3,.mx-xl-n3{margin-left:-1rem !important}.m-xl-n4{margin:-1.5rem !important}.mt-xl-n4,.my-xl-n4{margin-top:-1.5rem !important}.mr-xl-n4,.mx-xl-n4{margin-right:-1.5rem !important}.mb-xl-n4,.my-xl-n4{margin-bottom:-1.5rem !important}.ml-xl-n4,.mx-xl-n4{margin-left:-1.5rem !important}.m-xl-n5{margin:-3rem !important}.mt-xl-n5,.my-xl-n5{margin-top:-3rem !important}.mr-xl-n5,.mx-xl-n5{margin-right:-3rem !important}.mb-xl-n5,.my-xl-n5{margin-bottom:-3rem !important}.ml-xl-n5,.mx-xl-n5{margin-left:-3rem !important}.m-xl-auto{margin:auto !important}.mt-xl-auto,.my-xl-auto{margin-top:auto !important}.mr-xl-auto,.mx-xl-auto{margin-right:auto !important}.mb-xl-auto,.my-xl-auto{margin-bottom:auto !important}.ml-xl-auto,.mx-xl-auto{margin-left:auto !important}}.text-monospace{font-family:SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace !important}.text-justify{text-align:justify !important}.text-wrap{white-space:normal !important}.text-nowrap{white-space:nowrap !important}.text-truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.text-left{text-align:left !important}.text-right{text-align:right !important}.text-center{text-align:center !important}@media (min-width: 576px){.text-sm-left{text-align:left !important}.text-sm-right{text-align:right !important}.text-sm-center{text-align:center !important}}@media (min-width: 768px){.text-md-left{text-align:left !important}.text-md-right{text-align:right !important}.text-md-center{text-align:center !important}}@media (min-width: 992px){.text-lg-left{text-align:left !important}.text-lg-right{text-align:right !important}.text-lg-center{text-align:center !important}}@media (min-width: 1200px){.text-xl-left{text-align:left !important}.text-xl-right{text-align:right !important}.text-xl-center{text-align:center !important}}.text-lowercase{text-transform:lowercase !important}.text-uppercase{text-transform:uppercase !important}.text-capitalize{text-transform:capitalize !important}.font-weight-light{font-weight:300 !important}.font-weight-lighter{font-weight:lighter !important}.font-weight-normal{font-weight:400 !important}.font-weight-bold{font-weight:700 !important}.font-weight-bolder{font-weight:bolder !important}.font-italic{font-style:italic !important}.text-white{color:#fff !important}.text-primary{color:#375a7f !important}a.text-primary:hover,a.text-primary:focus{color:#20344a !important}.text-secondary{color:#444 !important}a.text-secondary:hover,a.text-secondary:focus{color:#1e1e1e !important}.text-success{color:#00bc8c !important}a.text-success:hover,a.text-success:focus{color:#007053 !important}.text-info{color:#3498DB !important}a.text-info:hover,a.text-info:focus{color:#1d6fa5 !important}.text-warning{color:#F39C12 !important}a.text-warning:hover,a.text-warning:focus{color:#b06f09 !important}.text-danger{color:#E74C3C !important}a.text-danger:hover,a.text-danger:focus{color:#bf2718 !important}.text-light{color:#999 !important}a.text-light:hover,a.text-light:focus{color:#737373 !important}.text-dark{color:#303030 !important}a.text-dark:hover,a.text-dark:focus{color:#0a0a0a !important}.text-body{color:#fff !important}.text-muted{color:#999 !important}.text-black-50{color:rgba(0,0,0,0.5) !important}.text-white-50{color:rgba(255,255,255,0.5) !important}.text-hide{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0}.text-decoration-none{text-decoration:none !important}.text-break{word-break:break-word !important;overflow-wrap:break-word !important}.text-reset{color:inherit !important}.visible{visibility:visible !important}.invisible{visibility:hidden !important}@media print{*,*::before,*::after{text-shadow:none !important;-webkit-box-shadow:none !important;box-shadow:none !important}a:not(.btn){text-decoration:underline}abbr[title]::after{content:" (" attr(title) ")"}pre{white-space:pre-wrap !important}pre,blockquote{border:1px solid #adb5bd;page-break-inside:avoid}thead{display:table-header-group}tr,img{page-break-inside:avoid}p,h2,h3{orphans:3;widows:3}h2,h3{page-break-after:avoid}@page{size:a3}body{min-width:992px !important}.container{min-width:992px !important}.navbar{display:none}.badge{border:1px solid #000}.table{border-collapse:collapse !important}.table td,.table th{background-color:#fff !important}.table-bordered th,.table-bordered td{border:1px solid #dee2e6 !important}.table-dark{color:inherit}.table-dark th,.table-dark td,.table-dark thead th,.table-dark tbody+tbody{border-color:#444}.table .thead-dark th{color:inherit;border-color:#444}}.bg-primary .navbar-nav .active>.nav-link{color:#00bc8c !important}.bg-light.navbar{background-color:#00bc8c !important}.bg-light.navbar-light .navbar-nav .nav-link:focus,.bg-light.navbar-light .navbar-nav .nav-link:hover,.bg-light.navbar-light .navbar-nav .active>.nav-link{color:#375a7f !important}.blockquote-footer{color:#999}.table-primary,.table-primary>th,.table-primary>td{background-color:#375a7f}.table-secondary,.table-secondary>th,.table-secondary>td{background-color:#444}.table-light,.table-light>th,.table-light>td{background-color:#999}.table-dark,.table-dark>th,.table-dark>td{background-color:#303030}.table-success,.table-success>th,.table-success>td{background-color:#00bc8c}.table-info,.table-info>th,.table-info>td{background-color:#3498DB}.table-danger,.table-danger>th,.table-danger>td{background-color:#E74C3C}.table-warning,.table-warning>th,.table-warning>td{background-color:#F39C12}.table-active,.table-active>th,.table-active>td{background-color:rgba(0,0,0,0.075)}.table-hover .table-primary:hover,.table-hover .table-primary:hover>th,.table-hover .table-primary:hover>td{background-color:#2f4d6d}.table-hover .table-secondary:hover,.table-hover .table-secondary:hover>th,.table-hover .table-secondary:hover>td{background-color:#373737}.table-hover .table-light:hover,.table-hover .table-light:hover>th,.table-hover .table-light:hover>td{background-color:#8c8c8c}.table-hover .table-dark:hover,.table-hover .table-dark:hover>th,.table-hover .table-dark:hover>td{background-color:#232323}.table-hover .table-success:hover,.table-hover .table-success:hover>th,.table-hover .table-success:hover>td{background-color:#00a379}.table-hover .table-info:hover,.table-hover .table-info:hover>th,.table-hover .table-info:hover>td{background-color:#258cd1}.table-hover .table-danger:hover,.table-hover .table-danger:hover>th,.table-hover .table-danger:hover>td{background-color:#e43725}.table-hover .table-warning:hover,.table-hover .table-warning:hover>th,.table-hover .table-warning:hover>td{background-color:#e08e0b}.table-hover .table-active:hover,.table-hover .table-active:hover>th,.table-hover .table-active:hover>td{background-color:rgba(0,0,0,0.075)}.input-group-addon{color:#fff}.nav-tabs .nav-link,.nav-tabs .nav-link.active,.nav-tabs .nav-link.active:focus,.nav-tabs .nav-link.active:hover,.nav-tabs .nav-item.open .nav-link,.nav-tabs .nav-item.open .nav-link:focus,.nav-tabs .nav-item.open .nav-link:hover,.nav-pills .nav-link,.nav-pills .nav-link.active,.nav-pills .nav-link.active:focus,.nav-pills .nav-link.active:hover,.nav-pills .nav-item.open .nav-link,.nav-pills .nav-item.open .nav-link:focus,.nav-pills .nav-item.open .nav-link:hover{color:#fff}.breadcrumb a{color:#fff}.pagination a:hover{text-decoration:none}.close{opacity:0.4}.close:hover,.close:focus{opacity:1}.alert{border:none;color:#fff}.alert a,.alert .alert-link{color:#fff;text-decoration:underline}.alert-primary{background-color:#375a7f}.alert-secondary{background-color:#444}.alert-success{background-color:#00bc8c}.alert-info{background-color:#3498DB}.alert-warning{background-color:#F39C12}.alert-danger{background-color:#E74C3C}.alert-light{background-color:#999}.alert-dark{background-color:#303030}.list-group-item-action{color:#fff}.list-group-item-action:hover,.list-group-item-action:focus{background-color:#444;color:#fff}.list-group-item-action .list-group-item-heading{color:#fff} diff --git a/css/font-awesome.min.css b/css/font-awesome.min.css new file mode 100644 index 00000000..540440ce --- /dev/null +++ b/css/font-awesome.min.css @@ -0,0 +1,4 @@ +/*! + * Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome + * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) + */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.7.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.28571429em;text-align:center}.fa-ul{padding-left:0;margin-left:2.14285714em;list-style-type:none}.fa-ul>li{position:relative}.fa-li{position:absolute;left:-2.14285714em;width:2.14285714em;top:.14285714em;text-align:center}.fa-li.fa-lg{left:-1.85714286em}.fa-border{padding:.2em .25em .15em;border:solid .08em #eee;border-radius:.1em}.fa-pull-left{float:left}.fa-pull-right{float:right}.fa.fa-pull-left{margin-right:.3em}.fa.fa-pull-right{margin-left:.3em}.pull-right{float:right}.pull-left{float:left}.fa.pull-left{margin-right:.3em}.fa.pull-right{margin-left:.3em}.fa-spin{-webkit-animation:fa-spin 2s infinite linear;animation:fa-spin 2s infinite linear}.fa-pulse{-webkit-animation:fa-spin 1s infinite steps(8);animation:fa-spin 1s infinite steps(8)}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}.fa-rotate-90{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=1)";-webkit-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg)}.fa-rotate-180{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";-webkit-transform:rotate(180deg);-ms-transform:rotate(180deg);transform:rotate(180deg)}.fa-rotate-270{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=3)";-webkit-transform:rotate(270deg);-ms-transform:rotate(270deg);transform:rotate(270deg)}.fa-flip-horizontal{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)";-webkit-transform:scale(-1, 1);-ms-transform:scale(-1, 1);transform:scale(-1, 1)}.fa-flip-vertical{-ms-filter:"progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)";-webkit-transform:scale(1, -1);-ms-transform:scale(1, -1);transform:scale(1, -1)}:root .fa-rotate-90,:root .fa-rotate-180,:root .fa-rotate-270,:root .fa-flip-horizontal,:root .fa-flip-vertical{filter:none}.fa-stack{position:relative;display:inline-block;width:2em;height:2em;line-height:2em;vertical-align:middle}.fa-stack-1x,.fa-stack-2x{position:absolute;left:0;width:100%;text-align:center}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:#fff}.fa-glass:before{content:"\f000"}.fa-music:before{content:"\f001"}.fa-search:before{content:"\f002"}.fa-envelope-o:before{content:"\f003"}.fa-heart:before{content:"\f004"}.fa-star:before{content:"\f005"}.fa-star-o:before{content:"\f006"}.fa-user:before{content:"\f007"}.fa-film:before{content:"\f008"}.fa-th-large:before{content:"\f009"}.fa-th:before{content:"\f00a"}.fa-th-list:before{content:"\f00b"}.fa-check:before{content:"\f00c"}.fa-remove:before,.fa-close:before,.fa-times:before{content:"\f00d"}.fa-search-plus:before{content:"\f00e"}.fa-search-minus:before{content:"\f010"}.fa-power-off:before{content:"\f011"}.fa-signal:before{content:"\f012"}.fa-gear:before,.fa-cog:before{content:"\f013"}.fa-trash-o:before{content:"\f014"}.fa-home:before{content:"\f015"}.fa-file-o:before{content:"\f016"}.fa-clock-o:before{content:"\f017"}.fa-road:before{content:"\f018"}.fa-download:before{content:"\f019"}.fa-arrow-circle-o-down:before{content:"\f01a"}.fa-arrow-circle-o-up:before{content:"\f01b"}.fa-inbox:before{content:"\f01c"}.fa-play-circle-o:before{content:"\f01d"}.fa-rotate-right:before,.fa-repeat:before{content:"\f01e"}.fa-refresh:before{content:"\f021"}.fa-list-alt:before{content:"\f022"}.fa-lock:before{content:"\f023"}.fa-flag:before{content:"\f024"}.fa-headphones:before{content:"\f025"}.fa-volume-off:before{content:"\f026"}.fa-volume-down:before{content:"\f027"}.fa-volume-up:before{content:"\f028"}.fa-qrcode:before{content:"\f029"}.fa-barcode:before{content:"\f02a"}.fa-tag:before{content:"\f02b"}.fa-tags:before{content:"\f02c"}.fa-book:before{content:"\f02d"}.fa-bookmark:before{content:"\f02e"}.fa-print:before{content:"\f02f"}.fa-camera:before{content:"\f030"}.fa-font:before{content:"\f031"}.fa-bold:before{content:"\f032"}.fa-italic:before{content:"\f033"}.fa-text-height:before{content:"\f034"}.fa-text-width:before{content:"\f035"}.fa-align-left:before{content:"\f036"}.fa-align-center:before{content:"\f037"}.fa-align-right:before{content:"\f038"}.fa-align-justify:before{content:"\f039"}.fa-list:before{content:"\f03a"}.fa-dedent:before,.fa-outdent:before{content:"\f03b"}.fa-indent:before{content:"\f03c"}.fa-video-camera:before{content:"\f03d"}.fa-photo:before,.fa-image:before,.fa-picture-o:before{content:"\f03e"}.fa-pencil:before{content:"\f040"}.fa-map-marker:before{content:"\f041"}.fa-adjust:before{content:"\f042"}.fa-tint:before{content:"\f043"}.fa-edit:before,.fa-pencil-square-o:before{content:"\f044"}.fa-share-square-o:before{content:"\f045"}.fa-check-square-o:before{content:"\f046"}.fa-arrows:before{content:"\f047"}.fa-step-backward:before{content:"\f048"}.fa-fast-backward:before{content:"\f049"}.fa-backward:before{content:"\f04a"}.fa-play:before{content:"\f04b"}.fa-pause:before{content:"\f04c"}.fa-stop:before{content:"\f04d"}.fa-forward:before{content:"\f04e"}.fa-fast-forward:before{content:"\f050"}.fa-step-forward:before{content:"\f051"}.fa-eject:before{content:"\f052"}.fa-chevron-left:before{content:"\f053"}.fa-chevron-right:before{content:"\f054"}.fa-plus-circle:before{content:"\f055"}.fa-minus-circle:before{content:"\f056"}.fa-times-circle:before{content:"\f057"}.fa-check-circle:before{content:"\f058"}.fa-question-circle:before{content:"\f059"}.fa-info-circle:before{content:"\f05a"}.fa-crosshairs:before{content:"\f05b"}.fa-times-circle-o:before{content:"\f05c"}.fa-check-circle-o:before{content:"\f05d"}.fa-ban:before{content:"\f05e"}.fa-arrow-left:before{content:"\f060"}.fa-arrow-right:before{content:"\f061"}.fa-arrow-up:before{content:"\f062"}.fa-arrow-down:before{content:"\f063"}.fa-mail-forward:before,.fa-share:before{content:"\f064"}.fa-expand:before{content:"\f065"}.fa-compress:before{content:"\f066"}.fa-plus:before{content:"\f067"}.fa-minus:before{content:"\f068"}.fa-asterisk:before{content:"\f069"}.fa-exclamation-circle:before{content:"\f06a"}.fa-gift:before{content:"\f06b"}.fa-leaf:before{content:"\f06c"}.fa-fire:before{content:"\f06d"}.fa-eye:before{content:"\f06e"}.fa-eye-slash:before{content:"\f070"}.fa-warning:before,.fa-exclamation-triangle:before{content:"\f071"}.fa-plane:before{content:"\f072"}.fa-calendar:before{content:"\f073"}.fa-random:before{content:"\f074"}.fa-comment:before{content:"\f075"}.fa-magnet:before{content:"\f076"}.fa-chevron-up:before{content:"\f077"}.fa-chevron-down:before{content:"\f078"}.fa-retweet:before{content:"\f079"}.fa-shopping-cart:before{content:"\f07a"}.fa-folder:before{content:"\f07b"}.fa-folder-open:before{content:"\f07c"}.fa-arrows-v:before{content:"\f07d"}.fa-arrows-h:before{content:"\f07e"}.fa-bar-chart-o:before,.fa-bar-chart:before{content:"\f080"}.fa-twitter-square:before{content:"\f081"}.fa-facebook-square:before{content:"\f082"}.fa-camera-retro:before{content:"\f083"}.fa-key:before{content:"\f084"}.fa-gears:before,.fa-cogs:before{content:"\f085"}.fa-comments:before{content:"\f086"}.fa-thumbs-o-up:before{content:"\f087"}.fa-thumbs-o-down:before{content:"\f088"}.fa-star-half:before{content:"\f089"}.fa-heart-o:before{content:"\f08a"}.fa-sign-out:before{content:"\f08b"}.fa-linkedin-square:before{content:"\f08c"}.fa-thumb-tack:before{content:"\f08d"}.fa-external-link:before{content:"\f08e"}.fa-sign-in:before{content:"\f090"}.fa-trophy:before{content:"\f091"}.fa-github-square:before{content:"\f092"}.fa-upload:before{content:"\f093"}.fa-lemon-o:before{content:"\f094"}.fa-phone:before{content:"\f095"}.fa-square-o:before{content:"\f096"}.fa-bookmark-o:before{content:"\f097"}.fa-phone-square:before{content:"\f098"}.fa-twitter:before{content:"\f099"}.fa-facebook-f:before,.fa-facebook:before{content:"\f09a"}.fa-github:before{content:"\f09b"}.fa-unlock:before{content:"\f09c"}.fa-credit-card:before{content:"\f09d"}.fa-feed:before,.fa-rss:before{content:"\f09e"}.fa-hdd-o:before{content:"\f0a0"}.fa-bullhorn:before{content:"\f0a1"}.fa-bell:before{content:"\f0f3"}.fa-certificate:before{content:"\f0a3"}.fa-hand-o-right:before{content:"\f0a4"}.fa-hand-o-left:before{content:"\f0a5"}.fa-hand-o-up:before{content:"\f0a6"}.fa-hand-o-down:before{content:"\f0a7"}.fa-arrow-circle-left:before{content:"\f0a8"}.fa-arrow-circle-right:before{content:"\f0a9"}.fa-arrow-circle-up:before{content:"\f0aa"}.fa-arrow-circle-down:before{content:"\f0ab"}.fa-globe:before{content:"\f0ac"}.fa-wrench:before{content:"\f0ad"}.fa-tasks:before{content:"\f0ae"}.fa-filter:before{content:"\f0b0"}.fa-briefcase:before{content:"\f0b1"}.fa-arrows-alt:before{content:"\f0b2"}.fa-group:before,.fa-users:before{content:"\f0c0"}.fa-chain:before,.fa-link:before{content:"\f0c1"}.fa-cloud:before{content:"\f0c2"}.fa-flask:before{content:"\f0c3"}.fa-cut:before,.fa-scissors:before{content:"\f0c4"}.fa-copy:before,.fa-files-o:before{content:"\f0c5"}.fa-paperclip:before{content:"\f0c6"}.fa-save:before,.fa-floppy-o:before{content:"\f0c7"}.fa-square:before{content:"\f0c8"}.fa-navicon:before,.fa-reorder:before,.fa-bars:before{content:"\f0c9"}.fa-list-ul:before{content:"\f0ca"}.fa-list-ol:before{content:"\f0cb"}.fa-strikethrough:before{content:"\f0cc"}.fa-underline:before{content:"\f0cd"}.fa-table:before{content:"\f0ce"}.fa-magic:before{content:"\f0d0"}.fa-truck:before{content:"\f0d1"}.fa-pinterest:before{content:"\f0d2"}.fa-pinterest-square:before{content:"\f0d3"}.fa-google-plus-square:before{content:"\f0d4"}.fa-google-plus:before{content:"\f0d5"}.fa-money:before{content:"\f0d6"}.fa-caret-down:before{content:"\f0d7"}.fa-caret-up:before{content:"\f0d8"}.fa-caret-left:before{content:"\f0d9"}.fa-caret-right:before{content:"\f0da"}.fa-columns:before{content:"\f0db"}.fa-unsorted:before,.fa-sort:before{content:"\f0dc"}.fa-sort-down:before,.fa-sort-desc:before{content:"\f0dd"}.fa-sort-up:before,.fa-sort-asc:before{content:"\f0de"}.fa-envelope:before{content:"\f0e0"}.fa-linkedin:before{content:"\f0e1"}.fa-rotate-left:before,.fa-undo:before{content:"\f0e2"}.fa-legal:before,.fa-gavel:before{content:"\f0e3"}.fa-dashboard:before,.fa-tachometer:before{content:"\f0e4"}.fa-comment-o:before{content:"\f0e5"}.fa-comments-o:before{content:"\f0e6"}.fa-flash:before,.fa-bolt:before{content:"\f0e7"}.fa-sitemap:before{content:"\f0e8"}.fa-umbrella:before{content:"\f0e9"}.fa-paste:before,.fa-clipboard:before{content:"\f0ea"}.fa-lightbulb-o:before{content:"\f0eb"}.fa-exchange:before{content:"\f0ec"}.fa-cloud-download:before{content:"\f0ed"}.fa-cloud-upload:before{content:"\f0ee"}.fa-user-md:before{content:"\f0f0"}.fa-stethoscope:before{content:"\f0f1"}.fa-suitcase:before{content:"\f0f2"}.fa-bell-o:before{content:"\f0a2"}.fa-coffee:before{content:"\f0f4"}.fa-cutlery:before{content:"\f0f5"}.fa-file-text-o:before{content:"\f0f6"}.fa-building-o:before{content:"\f0f7"}.fa-hospital-o:before{content:"\f0f8"}.fa-ambulance:before{content:"\f0f9"}.fa-medkit:before{content:"\f0fa"}.fa-fighter-jet:before{content:"\f0fb"}.fa-beer:before{content:"\f0fc"}.fa-h-square:before{content:"\f0fd"}.fa-plus-square:before{content:"\f0fe"}.fa-angle-double-left:before{content:"\f100"}.fa-angle-double-right:before{content:"\f101"}.fa-angle-double-up:before{content:"\f102"}.fa-angle-double-down:before{content:"\f103"}.fa-angle-left:before{content:"\f104"}.fa-angle-right:before{content:"\f105"}.fa-angle-up:before{content:"\f106"}.fa-angle-down:before{content:"\f107"}.fa-desktop:before{content:"\f108"}.fa-laptop:before{content:"\f109"}.fa-tablet:before{content:"\f10a"}.fa-mobile-phone:before,.fa-mobile:before{content:"\f10b"}.fa-circle-o:before{content:"\f10c"}.fa-quote-left:before{content:"\f10d"}.fa-quote-right:before{content:"\f10e"}.fa-spinner:before{content:"\f110"}.fa-circle:before{content:"\f111"}.fa-mail-reply:before,.fa-reply:before{content:"\f112"}.fa-github-alt:before{content:"\f113"}.fa-folder-o:before{content:"\f114"}.fa-folder-open-o:before{content:"\f115"}.fa-smile-o:before{content:"\f118"}.fa-frown-o:before{content:"\f119"}.fa-meh-o:before{content:"\f11a"}.fa-gamepad:before{content:"\f11b"}.fa-keyboard-o:before{content:"\f11c"}.fa-flag-o:before{content:"\f11d"}.fa-flag-checkered:before{content:"\f11e"}.fa-terminal:before{content:"\f120"}.fa-code:before{content:"\f121"}.fa-mail-reply-all:before,.fa-reply-all:before{content:"\f122"}.fa-star-half-empty:before,.fa-star-half-full:before,.fa-star-half-o:before{content:"\f123"}.fa-location-arrow:before{content:"\f124"}.fa-crop:before{content:"\f125"}.fa-code-fork:before{content:"\f126"}.fa-unlink:before,.fa-chain-broken:before{content:"\f127"}.fa-question:before{content:"\f128"}.fa-info:before{content:"\f129"}.fa-exclamation:before{content:"\f12a"}.fa-superscript:before{content:"\f12b"}.fa-subscript:before{content:"\f12c"}.fa-eraser:before{content:"\f12d"}.fa-puzzle-piece:before{content:"\f12e"}.fa-microphone:before{content:"\f130"}.fa-microphone-slash:before{content:"\f131"}.fa-shield:before{content:"\f132"}.fa-calendar-o:before{content:"\f133"}.fa-fire-extinguisher:before{content:"\f134"}.fa-rocket:before{content:"\f135"}.fa-maxcdn:before{content:"\f136"}.fa-chevron-circle-left:before{content:"\f137"}.fa-chevron-circle-right:before{content:"\f138"}.fa-chevron-circle-up:before{content:"\f139"}.fa-chevron-circle-down:before{content:"\f13a"}.fa-html5:before{content:"\f13b"}.fa-css3:before{content:"\f13c"}.fa-anchor:before{content:"\f13d"}.fa-unlock-alt:before{content:"\f13e"}.fa-bullseye:before{content:"\f140"}.fa-ellipsis-h:before{content:"\f141"}.fa-ellipsis-v:before{content:"\f142"}.fa-rss-square:before{content:"\f143"}.fa-play-circle:before{content:"\f144"}.fa-ticket:before{content:"\f145"}.fa-minus-square:before{content:"\f146"}.fa-minus-square-o:before{content:"\f147"}.fa-level-up:before{content:"\f148"}.fa-level-down:before{content:"\f149"}.fa-check-square:before{content:"\f14a"}.fa-pencil-square:before{content:"\f14b"}.fa-external-link-square:before{content:"\f14c"}.fa-share-square:before{content:"\f14d"}.fa-compass:before{content:"\f14e"}.fa-toggle-down:before,.fa-caret-square-o-down:before{content:"\f150"}.fa-toggle-up:before,.fa-caret-square-o-up:before{content:"\f151"}.fa-toggle-right:before,.fa-caret-square-o-right:before{content:"\f152"}.fa-euro:before,.fa-eur:before{content:"\f153"}.fa-gbp:before{content:"\f154"}.fa-dollar:before,.fa-usd:before{content:"\f155"}.fa-rupee:before,.fa-inr:before{content:"\f156"}.fa-cny:before,.fa-rmb:before,.fa-yen:before,.fa-jpy:before{content:"\f157"}.fa-ruble:before,.fa-rouble:before,.fa-rub:before{content:"\f158"}.fa-won:before,.fa-krw:before{content:"\f159"}.fa-bitcoin:before,.fa-btc:before{content:"\f15a"}.fa-file:before{content:"\f15b"}.fa-file-text:before{content:"\f15c"}.fa-sort-alpha-asc:before{content:"\f15d"}.fa-sort-alpha-desc:before{content:"\f15e"}.fa-sort-amount-asc:before{content:"\f160"}.fa-sort-amount-desc:before{content:"\f161"}.fa-sort-numeric-asc:before{content:"\f162"}.fa-sort-numeric-desc:before{content:"\f163"}.fa-thumbs-up:before{content:"\f164"}.fa-thumbs-down:before{content:"\f165"}.fa-youtube-square:before{content:"\f166"}.fa-youtube:before{content:"\f167"}.fa-xing:before{content:"\f168"}.fa-xing-square:before{content:"\f169"}.fa-youtube-play:before{content:"\f16a"}.fa-dropbox:before{content:"\f16b"}.fa-stack-overflow:before{content:"\f16c"}.fa-instagram:before{content:"\f16d"}.fa-flickr:before{content:"\f16e"}.fa-adn:before{content:"\f170"}.fa-bitbucket:before{content:"\f171"}.fa-bitbucket-square:before{content:"\f172"}.fa-tumblr:before{content:"\f173"}.fa-tumblr-square:before{content:"\f174"}.fa-long-arrow-down:before{content:"\f175"}.fa-long-arrow-up:before{content:"\f176"}.fa-long-arrow-left:before{content:"\f177"}.fa-long-arrow-right:before{content:"\f178"}.fa-apple:before{content:"\f179"}.fa-windows:before{content:"\f17a"}.fa-android:before{content:"\f17b"}.fa-linux:before{content:"\f17c"}.fa-dribbble:before{content:"\f17d"}.fa-skype:before{content:"\f17e"}.fa-foursquare:before{content:"\f180"}.fa-trello:before{content:"\f181"}.fa-female:before{content:"\f182"}.fa-male:before{content:"\f183"}.fa-gittip:before,.fa-gratipay:before{content:"\f184"}.fa-sun-o:before{content:"\f185"}.fa-moon-o:before{content:"\f186"}.fa-archive:before{content:"\f187"}.fa-bug:before{content:"\f188"}.fa-vk:before{content:"\f189"}.fa-weibo:before{content:"\f18a"}.fa-renren:before{content:"\f18b"}.fa-pagelines:before{content:"\f18c"}.fa-stack-exchange:before{content:"\f18d"}.fa-arrow-circle-o-right:before{content:"\f18e"}.fa-arrow-circle-o-left:before{content:"\f190"}.fa-toggle-left:before,.fa-caret-square-o-left:before{content:"\f191"}.fa-dot-circle-o:before{content:"\f192"}.fa-wheelchair:before{content:"\f193"}.fa-vimeo-square:before{content:"\f194"}.fa-turkish-lira:before,.fa-try:before{content:"\f195"}.fa-plus-square-o:before{content:"\f196"}.fa-space-shuttle:before{content:"\f197"}.fa-slack:before{content:"\f198"}.fa-envelope-square:before{content:"\f199"}.fa-wordpress:before{content:"\f19a"}.fa-openid:before{content:"\f19b"}.fa-institution:before,.fa-bank:before,.fa-university:before{content:"\f19c"}.fa-mortar-board:before,.fa-graduation-cap:before{content:"\f19d"}.fa-yahoo:before{content:"\f19e"}.fa-google:before{content:"\f1a0"}.fa-reddit:before{content:"\f1a1"}.fa-reddit-square:before{content:"\f1a2"}.fa-stumbleupon-circle:before{content:"\f1a3"}.fa-stumbleupon:before{content:"\f1a4"}.fa-delicious:before{content:"\f1a5"}.fa-digg:before{content:"\f1a6"}.fa-pied-piper-pp:before{content:"\f1a7"}.fa-pied-piper-alt:before{content:"\f1a8"}.fa-drupal:before{content:"\f1a9"}.fa-joomla:before{content:"\f1aa"}.fa-language:before{content:"\f1ab"}.fa-fax:before{content:"\f1ac"}.fa-building:before{content:"\f1ad"}.fa-child:before{content:"\f1ae"}.fa-paw:before{content:"\f1b0"}.fa-spoon:before{content:"\f1b1"}.fa-cube:before{content:"\f1b2"}.fa-cubes:before{content:"\f1b3"}.fa-behance:before{content:"\f1b4"}.fa-behance-square:before{content:"\f1b5"}.fa-steam:before{content:"\f1b6"}.fa-steam-square:before{content:"\f1b7"}.fa-recycle:before{content:"\f1b8"}.fa-automobile:before,.fa-car:before{content:"\f1b9"}.fa-cab:before,.fa-taxi:before{content:"\f1ba"}.fa-tree:before{content:"\f1bb"}.fa-spotify:before{content:"\f1bc"}.fa-deviantart:before{content:"\f1bd"}.fa-soundcloud:before{content:"\f1be"}.fa-database:before{content:"\f1c0"}.fa-file-pdf-o:before{content:"\f1c1"}.fa-file-word-o:before{content:"\f1c2"}.fa-file-excel-o:before{content:"\f1c3"}.fa-file-powerpoint-o:before{content:"\f1c4"}.fa-file-photo-o:before,.fa-file-picture-o:before,.fa-file-image-o:before{content:"\f1c5"}.fa-file-zip-o:before,.fa-file-archive-o:before{content:"\f1c6"}.fa-file-sound-o:before,.fa-file-audio-o:before{content:"\f1c7"}.fa-file-movie-o:before,.fa-file-video-o:before{content:"\f1c8"}.fa-file-code-o:before{content:"\f1c9"}.fa-vine:before{content:"\f1ca"}.fa-codepen:before{content:"\f1cb"}.fa-jsfiddle:before{content:"\f1cc"}.fa-life-bouy:before,.fa-life-buoy:before,.fa-life-saver:before,.fa-support:before,.fa-life-ring:before{content:"\f1cd"}.fa-circle-o-notch:before{content:"\f1ce"}.fa-ra:before,.fa-resistance:before,.fa-rebel:before{content:"\f1d0"}.fa-ge:before,.fa-empire:before{content:"\f1d1"}.fa-git-square:before{content:"\f1d2"}.fa-git:before{content:"\f1d3"}.fa-y-combinator-square:before,.fa-yc-square:before,.fa-hacker-news:before{content:"\f1d4"}.fa-tencent-weibo:before{content:"\f1d5"}.fa-qq:before{content:"\f1d6"}.fa-wechat:before,.fa-weixin:before{content:"\f1d7"}.fa-send:before,.fa-paper-plane:before{content:"\f1d8"}.fa-send-o:before,.fa-paper-plane-o:before{content:"\f1d9"}.fa-history:before{content:"\f1da"}.fa-circle-thin:before{content:"\f1db"}.fa-header:before{content:"\f1dc"}.fa-paragraph:before{content:"\f1dd"}.fa-sliders:before{content:"\f1de"}.fa-share-alt:before{content:"\f1e0"}.fa-share-alt-square:before{content:"\f1e1"}.fa-bomb:before{content:"\f1e2"}.fa-soccer-ball-o:before,.fa-futbol-o:before{content:"\f1e3"}.fa-tty:before{content:"\f1e4"}.fa-binoculars:before{content:"\f1e5"}.fa-plug:before{content:"\f1e6"}.fa-slideshare:before{content:"\f1e7"}.fa-twitch:before{content:"\f1e8"}.fa-yelp:before{content:"\f1e9"}.fa-newspaper-o:before{content:"\f1ea"}.fa-wifi:before{content:"\f1eb"}.fa-calculator:before{content:"\f1ec"}.fa-paypal:before{content:"\f1ed"}.fa-google-wallet:before{content:"\f1ee"}.fa-cc-visa:before{content:"\f1f0"}.fa-cc-mastercard:before{content:"\f1f1"}.fa-cc-discover:before{content:"\f1f2"}.fa-cc-amex:before{content:"\f1f3"}.fa-cc-paypal:before{content:"\f1f4"}.fa-cc-stripe:before{content:"\f1f5"}.fa-bell-slash:before{content:"\f1f6"}.fa-bell-slash-o:before{content:"\f1f7"}.fa-trash:before{content:"\f1f8"}.fa-copyright:before{content:"\f1f9"}.fa-at:before{content:"\f1fa"}.fa-eyedropper:before{content:"\f1fb"}.fa-paint-brush:before{content:"\f1fc"}.fa-birthday-cake:before{content:"\f1fd"}.fa-area-chart:before{content:"\f1fe"}.fa-pie-chart:before{content:"\f200"}.fa-line-chart:before{content:"\f201"}.fa-lastfm:before{content:"\f202"}.fa-lastfm-square:before{content:"\f203"}.fa-toggle-off:before{content:"\f204"}.fa-toggle-on:before{content:"\f205"}.fa-bicycle:before{content:"\f206"}.fa-bus:before{content:"\f207"}.fa-ioxhost:before{content:"\f208"}.fa-angellist:before{content:"\f209"}.fa-cc:before{content:"\f20a"}.fa-shekel:before,.fa-sheqel:before,.fa-ils:before{content:"\f20b"}.fa-meanpath:before{content:"\f20c"}.fa-buysellads:before{content:"\f20d"}.fa-connectdevelop:before{content:"\f20e"}.fa-dashcube:before{content:"\f210"}.fa-forumbee:before{content:"\f211"}.fa-leanpub:before{content:"\f212"}.fa-sellsy:before{content:"\f213"}.fa-shirtsinbulk:before{content:"\f214"}.fa-simplybuilt:before{content:"\f215"}.fa-skyatlas:before{content:"\f216"}.fa-cart-plus:before{content:"\f217"}.fa-cart-arrow-down:before{content:"\f218"}.fa-diamond:before{content:"\f219"}.fa-ship:before{content:"\f21a"}.fa-user-secret:before{content:"\f21b"}.fa-motorcycle:before{content:"\f21c"}.fa-street-view:before{content:"\f21d"}.fa-heartbeat:before{content:"\f21e"}.fa-venus:before{content:"\f221"}.fa-mars:before{content:"\f222"}.fa-mercury:before{content:"\f223"}.fa-intersex:before,.fa-transgender:before{content:"\f224"}.fa-transgender-alt:before{content:"\f225"}.fa-venus-double:before{content:"\f226"}.fa-mars-double:before{content:"\f227"}.fa-venus-mars:before{content:"\f228"}.fa-mars-stroke:before{content:"\f229"}.fa-mars-stroke-v:before{content:"\f22a"}.fa-mars-stroke-h:before{content:"\f22b"}.fa-neuter:before{content:"\f22c"}.fa-genderless:before{content:"\f22d"}.fa-facebook-official:before{content:"\f230"}.fa-pinterest-p:before{content:"\f231"}.fa-whatsapp:before{content:"\f232"}.fa-server:before{content:"\f233"}.fa-user-plus:before{content:"\f234"}.fa-user-times:before{content:"\f235"}.fa-hotel:before,.fa-bed:before{content:"\f236"}.fa-viacoin:before{content:"\f237"}.fa-train:before{content:"\f238"}.fa-subway:before{content:"\f239"}.fa-medium:before{content:"\f23a"}.fa-yc:before,.fa-y-combinator:before{content:"\f23b"}.fa-optin-monster:before{content:"\f23c"}.fa-opencart:before{content:"\f23d"}.fa-expeditedssl:before{content:"\f23e"}.fa-battery-4:before,.fa-battery:before,.fa-battery-full:before{content:"\f240"}.fa-battery-3:before,.fa-battery-three-quarters:before{content:"\f241"}.fa-battery-2:before,.fa-battery-half:before{content:"\f242"}.fa-battery-1:before,.fa-battery-quarter:before{content:"\f243"}.fa-battery-0:before,.fa-battery-empty:before{content:"\f244"}.fa-mouse-pointer:before{content:"\f245"}.fa-i-cursor:before{content:"\f246"}.fa-object-group:before{content:"\f247"}.fa-object-ungroup:before{content:"\f248"}.fa-sticky-note:before{content:"\f249"}.fa-sticky-note-o:before{content:"\f24a"}.fa-cc-jcb:before{content:"\f24b"}.fa-cc-diners-club:before{content:"\f24c"}.fa-clone:before{content:"\f24d"}.fa-balance-scale:before{content:"\f24e"}.fa-hourglass-o:before{content:"\f250"}.fa-hourglass-1:before,.fa-hourglass-start:before{content:"\f251"}.fa-hourglass-2:before,.fa-hourglass-half:before{content:"\f252"}.fa-hourglass-3:before,.fa-hourglass-end:before{content:"\f253"}.fa-hourglass:before{content:"\f254"}.fa-hand-grab-o:before,.fa-hand-rock-o:before{content:"\f255"}.fa-hand-stop-o:before,.fa-hand-paper-o:before{content:"\f256"}.fa-hand-scissors-o:before{content:"\f257"}.fa-hand-lizard-o:before{content:"\f258"}.fa-hand-spock-o:before{content:"\f259"}.fa-hand-pointer-o:before{content:"\f25a"}.fa-hand-peace-o:before{content:"\f25b"}.fa-trademark:before{content:"\f25c"}.fa-registered:before{content:"\f25d"}.fa-creative-commons:before{content:"\f25e"}.fa-gg:before{content:"\f260"}.fa-gg-circle:before{content:"\f261"}.fa-tripadvisor:before{content:"\f262"}.fa-odnoklassniki:before{content:"\f263"}.fa-odnoklassniki-square:before{content:"\f264"}.fa-get-pocket:before{content:"\f265"}.fa-wikipedia-w:before{content:"\f266"}.fa-safari:before{content:"\f267"}.fa-chrome:before{content:"\f268"}.fa-firefox:before{content:"\f269"}.fa-opera:before{content:"\f26a"}.fa-internet-explorer:before{content:"\f26b"}.fa-tv:before,.fa-television:before{content:"\f26c"}.fa-contao:before{content:"\f26d"}.fa-500px:before{content:"\f26e"}.fa-amazon:before{content:"\f270"}.fa-calendar-plus-o:before{content:"\f271"}.fa-calendar-minus-o:before{content:"\f272"}.fa-calendar-times-o:before{content:"\f273"}.fa-calendar-check-o:before{content:"\f274"}.fa-industry:before{content:"\f275"}.fa-map-pin:before{content:"\f276"}.fa-map-signs:before{content:"\f277"}.fa-map-o:before{content:"\f278"}.fa-map:before{content:"\f279"}.fa-commenting:before{content:"\f27a"}.fa-commenting-o:before{content:"\f27b"}.fa-houzz:before{content:"\f27c"}.fa-vimeo:before{content:"\f27d"}.fa-black-tie:before{content:"\f27e"}.fa-fonticons:before{content:"\f280"}.fa-reddit-alien:before{content:"\f281"}.fa-edge:before{content:"\f282"}.fa-credit-card-alt:before{content:"\f283"}.fa-codiepie:before{content:"\f284"}.fa-modx:before{content:"\f285"}.fa-fort-awesome:before{content:"\f286"}.fa-usb:before{content:"\f287"}.fa-product-hunt:before{content:"\f288"}.fa-mixcloud:before{content:"\f289"}.fa-scribd:before{content:"\f28a"}.fa-pause-circle:before{content:"\f28b"}.fa-pause-circle-o:before{content:"\f28c"}.fa-stop-circle:before{content:"\f28d"}.fa-stop-circle-o:before{content:"\f28e"}.fa-shopping-bag:before{content:"\f290"}.fa-shopping-basket:before{content:"\f291"}.fa-hashtag:before{content:"\f292"}.fa-bluetooth:before{content:"\f293"}.fa-bluetooth-b:before{content:"\f294"}.fa-percent:before{content:"\f295"}.fa-gitlab:before{content:"\f296"}.fa-wpbeginner:before{content:"\f297"}.fa-wpforms:before{content:"\f298"}.fa-envira:before{content:"\f299"}.fa-universal-access:before{content:"\f29a"}.fa-wheelchair-alt:before{content:"\f29b"}.fa-question-circle-o:before{content:"\f29c"}.fa-blind:before{content:"\f29d"}.fa-audio-description:before{content:"\f29e"}.fa-volume-control-phone:before{content:"\f2a0"}.fa-braille:before{content:"\f2a1"}.fa-assistive-listening-systems:before{content:"\f2a2"}.fa-asl-interpreting:before,.fa-american-sign-language-interpreting:before{content:"\f2a3"}.fa-deafness:before,.fa-hard-of-hearing:before,.fa-deaf:before{content:"\f2a4"}.fa-glide:before{content:"\f2a5"}.fa-glide-g:before{content:"\f2a6"}.fa-signing:before,.fa-sign-language:before{content:"\f2a7"}.fa-low-vision:before{content:"\f2a8"}.fa-viadeo:before{content:"\f2a9"}.fa-viadeo-square:before{content:"\f2aa"}.fa-snapchat:before{content:"\f2ab"}.fa-snapchat-ghost:before{content:"\f2ac"}.fa-snapchat-square:before{content:"\f2ad"}.fa-pied-piper:before{content:"\f2ae"}.fa-first-order:before{content:"\f2b0"}.fa-yoast:before{content:"\f2b1"}.fa-themeisle:before{content:"\f2b2"}.fa-google-plus-circle:before,.fa-google-plus-official:before{content:"\f2b3"}.fa-fa:before,.fa-font-awesome:before{content:"\f2b4"}.fa-handshake-o:before{content:"\f2b5"}.fa-envelope-open:before{content:"\f2b6"}.fa-envelope-open-o:before{content:"\f2b7"}.fa-linode:before{content:"\f2b8"}.fa-address-book:before{content:"\f2b9"}.fa-address-book-o:before{content:"\f2ba"}.fa-vcard:before,.fa-address-card:before{content:"\f2bb"}.fa-vcard-o:before,.fa-address-card-o:before{content:"\f2bc"}.fa-user-circle:before{content:"\f2bd"}.fa-user-circle-o:before{content:"\f2be"}.fa-user-o:before{content:"\f2c0"}.fa-id-badge:before{content:"\f2c1"}.fa-drivers-license:before,.fa-id-card:before{content:"\f2c2"}.fa-drivers-license-o:before,.fa-id-card-o:before{content:"\f2c3"}.fa-quora:before{content:"\f2c4"}.fa-free-code-camp:before{content:"\f2c5"}.fa-telegram:before{content:"\f2c6"}.fa-thermometer-4:before,.fa-thermometer:before,.fa-thermometer-full:before{content:"\f2c7"}.fa-thermometer-3:before,.fa-thermometer-three-quarters:before{content:"\f2c8"}.fa-thermometer-2:before,.fa-thermometer-half:before{content:"\f2c9"}.fa-thermometer-1:before,.fa-thermometer-quarter:before{content:"\f2ca"}.fa-thermometer-0:before,.fa-thermometer-empty:before{content:"\f2cb"}.fa-shower:before{content:"\f2cc"}.fa-bathtub:before,.fa-s15:before,.fa-bath:before{content:"\f2cd"}.fa-podcast:before{content:"\f2ce"}.fa-window-maximize:before{content:"\f2d0"}.fa-window-minimize:before{content:"\f2d1"}.fa-window-restore:before{content:"\f2d2"}.fa-times-rectangle:before,.fa-window-close:before{content:"\f2d3"}.fa-times-rectangle-o:before,.fa-window-close-o:before{content:"\f2d4"}.fa-bandcamp:before{content:"\f2d5"}.fa-grav:before{content:"\f2d6"}.fa-etsy:before{content:"\f2d7"}.fa-imdb:before{content:"\f2d8"}.fa-ravelry:before{content:"\f2d9"}.fa-eercast:before{content:"\f2da"}.fa-microchip:before{content:"\f2db"}.fa-snowflake-o:before{content:"\f2dc"}.fa-superpowers:before{content:"\f2dd"}.fa-wpexplorer:before{content:"\f2de"}.fa-meetup:before{content:"\f2e0"}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0, 0, 0, 0);border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;margin:0;overflow:visible;clip:auto} diff --git a/el/builds/index.html b/el/builds/index.html new file mode 100644 index 00000000..be97a346 --- /dev/null +++ b/el/builds/index.html @@ -0,0 +1,237 @@ + + + + + + + + + + + Auto-Provisioning - Linux Guide and Hints + + + + + + + + + + + + + +

+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

This page goes over various ways that installs can be automated without the use of PXE. Instead, we can use templated scripts with pre-configured commands, boot images, and mirrors for builds. We cover the following here:

+
    +
  • CentOS Stream 9
    • +
  • Enterprise Linux 8, 9
    • +
  • Fedora
    • +
  • openSUSE 15+
    • +
  • Windows Server
    • +
+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + + diff --git a/el/freeipa/index.html b/el/freeipa/index.html new file mode 100644 index 00000000..9c551361 --- /dev/null +++ b/el/freeipa/index.html @@ -0,0 +1,2934 @@ + + + + + + + + + + + FreeIPA - Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

This page is a series of notes and information that goes over how to +install and configure FreeIPA on Enterprise Linux 8/9 servers with +replicas, as well as configuring client machines to connect and utilize +FreeIPA resources, policies (eg sudo), and host based access control +methods. We will also go over a scenario of configuring a trust with an +Active Directory domain. The client setup will work for Fedora users as +the packages are the same, just newer versions.

+

Overview

+

FreeIPA is an integrated security information management system +combining Linux, a Directory Server (389), Kerberos, NTP, DNS, DogTag. +It's a system that can be loosely compared to Active Directory in what +it attempts to solve for Linux and UNIX clients and even mixed +environments. While it is not an active directory, it is an +integrated Identity and Authentication solution for Linux/UNIX +environments, which means it does not support Windows clients. One +problem that FreeIPA attempts to solve is giving back control to the +Linux/UNIX administration teams of access, authentication, and +authorization rather than trying to integrate directly into Active +Directory, where the controls do not work the same or do not work at +all. And because of this, no third party software is required to be +installed.

+

Requirements

+

Here are the list of requirements below.

+
    +
  • Enterprise Linux 8+ or Fedora Linux
    • +
  • An active internet connection to install the packages required or + available internal mirrors
    • +
  • 2 core, 4GB system with at least 10GB+ disk for /var/lib/dirsrv
    • +
  • DNS domain delegation (if a DNS appliance or server already exists)
    • +
+

Tutorial Preface, Notes, and Recommendations

+
+

Potential Pitfalls!

+
    +
  • Leave SELinux enabled at all times. You will not run into SELinux + issues
    • +
  • FreeIPA runs better when it controls the DNS domain that it is + given - It is recommended DNS is delegated or that FreeIPA run DNS + entirely
    • +
  • FreeIPA does not run DHCP. ISC DHCP can be configured to do dynamic + DNS updates to FreeIPA or hosts can be configured to perform dynamic + DNS updates
    • +
+
+
+

Recommended Information

+
    +
  • Keep selinux set to enforcing
    • +
  • +

    DNS - You must be careful when using DNS. Here are + recommendations.1

    +
      +
    • Recommendation 1: FreeIPA runs your entire DNS for your + network - This requires the DHCP servers to set the DNS servers + to the IPA servers. This will be useful in the case that your + clients will have their SSH keys added as SSHFP records to DNS + when enrolled as clients. This also gives you the added benefit + of a client updating its own DNS entries (A and PTR records) if + the client is DHCP enabled and the IP changes if you so choose.
      • +
    • Recommendation 2: FreeIPA is delegated a subdomain of a domain + used already in the network - It's not required for hosts to + live in the subdomain to be a member of the IPA domain, but you + will lose out on kerberos SSO. Do not try to hijack a domain.
      • +
    +
    • +
  • +

    Consider setting up a trust with Active Directory if you are in a + mixed environment, eg Active Directory already exists - winsync is + available, but deprecated and not recommended.

    +
    • +
  • IPA servers should have static assigned addresses - Configured via + nmcli or directly in /etc/sysconfig/network-scripts/ifcfg-*
    • +
  • Try to avoid running FreeIPA without DNS - while possible, you are + creating higher maintenance
    • +
+
+
+

Trust Information

+

If you are in a mixed environment (both Windows and Linux/UNIX), it is +recommended to setup a trust between FreeIPA and Active Directory. +Because of this, they will need to be in different domains (eg, +example.com and ipa.example.com, or example.com and example.net). This +way, you do not have to create duplicate users if a windows user logs +into Linux resources nor use winsync.

+
+

DNS

+

As noted in the previous section, you must try not to hijack a domain. +You can migrate records over to FreeIPA's DNS if you'd like, but care +must be taken with that approach.

+

While FreeIPA can do the typical DNS server work such as forward/reverse +zones and various types of records, it should not be considered a full +solution. It does not support views (eg, you can't have internal and +external views, assuming you have domains that are publically facing). +In the event you need to have views, that's when you need a different +DNS server or service to provide this to you.

+

There are two ways you can have DNS entries updated dynamically: +--enable-dns-updates for ipa-client-install and DHCP dynamic DNS +updates. Both are sufficient. The latter requires additional work and is +outside the scope of this write up.

+

Delegation

+

Throughout this guide, you may find or see examples of domain delegation +where there is an AD trust, as it would be a more real world example of +bringing in FreeIPA to an environment that is already in place, working, +with a DNS hosted by AD or by an appliance. Majority of the examples +assume both IPA and AD is delegated (when it's normally IPA that's +just delegated while AD hosts the actual parent zone). Using this type +of setup, it is not required for clients to have entries in the IPA +domain. In fact, they can be in other domains as long as they have +A/AAAA/PTR records associated with them. This assumes that there could +be dynamic dns associated with DHCP or everything is static and lives in +the parent zones. The caveat to this is SSO will fail.

+

You can setup already existing DNS servers to delegate an entire domain +or a subdomain for FreeIPA. This way, you don't overlap with a domain +that's already in use. So for example, if AD owns example.com, you +could have AD delegate ipa.example.com or even forward example.net. If +AD is not the DNS provider for the environment, you can have the +appliance delegate the domain in the same manner.

+

Below is a bind example of what example.com would look like when +delegating the IPA domain:

+
$ORIGIN example.com.
+@ IN SOA ... ( )
+                        NS      np-ad01
+                        NS      np-ad02
+np-ad01                 A       10.200.0.232
+np-ad02                 A       10.200.0.233
+; Many other records here, pertaining to AD, eg msdcs and SRV records
+
+; IPA records
+$ORIGIN ipa.example.com.
+@                       NS      np-ipa01
+                        NS      np-ipa02
+np-ipa01                A       10.200.0.230
+np-ipa02                A       10.200.0.231
+
+

Note that AD can send nsupdates to a DNS server if given the permissions. As of +this writing, FreeIPA does not do this, which is why DNS delegation is recommended.

+

Server Setup

+

Required Packages

+
    +
  • ipa-server
    • +
  • ipa-client (required as an IPA server is technically a client of the + domain)
    • +
  • ipa-server-dns (required for using the internal DNS)
    • +
  • sssd/sssd-ipa (pulled in as dependencies)
    • +
+

Optional Packages

+
    +
  • ipa-server-trust-ad if using an AD trust
    • +
+

Installation

+

To install the server, make sure the hostname is set to the A records +and NS delegations you've put in DNS (which won't respond to a DNS +lookup). If these are stand-alone, then you can just keep it at the top +level (eg, example.com). You'll also need to modify /etc/hosts, set +static IP addresses, and then run the ipa-server-install command.

+
% hostnamectl set-hostname server1.ipa.example.com
+% nmcli con mod ens192 ipv4.address 10.200.0.230/24
+% nmcli con mod ens192 ipv4.gateway 10.200.0.1
+% nmcli con mod ens192 ipv4.method manual
+% nmcli con up ens192
+% vi /etc/hosts
+. . .
+10.200.0.230 server1.ipa.example.com
+10.200.0.231 server2.ipa.example.com
+
+# Fedora
+% dnf install freeipa-server{,-common,-dns,-trust-ad} -y
+
+# Enterprise Linux 8
+% dnf module enable idm:DL1/{dns,adtrust,client,server,common}
+% dnf install ipa-server ipa-server-dns ipa-client sssd sssd-ipa -y
+
+# Enterprise Linux 9 (there appears to be no modules)
+% dnf install ipa-server ipa-server-dns ipa-client sssd sssd-ipa -y
+
+# Setup
+# Enterprise 8 / 9
+% firewall-cmd --permanent --add-service={freeipa-4,ntp,dns,freeipa-trust}
+% firewall-cmd --complete-reload
+% ipa-server-install \
+    --no_hbac_allow \ <-- If you want to have HBAC allow_all disabled initially
+    --no-ntp \ <-- If you want to host NTP from IPA, take off --no-ntp
+    --setup-dns \
+    --realm IPA.EXAMPLE.COM \
+    --domain example.com 
+
+. . . (show steps here)
+
+

While not officially recommended, you could have two accounts. One for +administration of servers and the domain and one for your workstation, +similar to separating domain users and domain administrators in active +directory. You don't have to follow this, but at least there's a form +of separation.

+
% kinit admin
+% ipa user-add --first=First --last=Last --cn="First Last Admin" --gecos="First Last Admin" flast2
+% ipa group-add-member --users=flast2 admins
+
+

Replica

+

On the replica, ensure you repeat the same steps as above.

+
% hostnamectl set-hostname server2.ipa.example.com
+% nmcli con mod ens192 ipv4.address 10.200.0.231/24
+% nmcli con mod ens192 ipv4.gateway 10.200.0.1
+% nmcli con mod ens192 ipv4.method manual
+% nmcli con up ens192
+% vi /etc/hosts
+. . .
+10.200.0.230 server1.ipa.example.com
+10.200.0.231 server2.ipa.example.com
+
+% dnf install ipa-server ipa-server-dns ipa-client sssd sssd-ipa -y
+# Enterprise 8 / 9
+% firewall-cmd --permanent --add-service={freeipa-4,ntp,dns,freeipa-trust}
+% firewall-cmd --complete-reload
+% ipa-replica-install --no-forwarders --setup-ca --setup-dns --no-ntp --principal admin --admin-password "ChangePass123" --domain ipa.example.com
+. . . (show steps)
+
+

You should now be able to see your replicas.

+
% ipa-replica-manage list
+server1.ipa.example.com: master
+server2.ipa.example.com: master
+
+

Replica Automation

+

It is possible to automate the replica installation. To automate the +replica installation, the following requirements would need to be met:

+
    +
  • Server must be added as a client (ipa-client-install) with an IP + address on the commandline
    • +
  • Server must be added to the ipaservers host group
    • +
  • ipa-replica-install ran without principal and passwords
    • +
+

Once you have a server added as a client and then added to the +ipaservers host group, you would run a command like this:

+
% ipa-replica-install --ssh-trust-dns --unattended --setup-ca --mkhomedir --setup-dns --no-forwarders
+
+

If you have forwarders, use the --forwarders option instead.

+

Server Migration/Upgrade

+

Performing a migration is a multi-step process. Typically you are going +from one major version of Enterprise Linux (such as 7 or 8) to another +(such as 9). Regardless of which version you are migrating from, the +typical beginning steps are:

+
    +
  • System's time is verified for time synchronization like using + ntpstat or equivalent
    • +
  • Server roles are verified in the current environment using + ipa server-role-find --status enabled --server ipa.example.com
    • +
  • New system is installed and enrolled as a client
    • +
  • New system is added as a replica with required server roles
    • +
+
+

EL7 to EL9 / Two Major Version Jumps

+

When jumping from EL7 to EL9 or two major versions in general, it is +recommended that you have an "in between" machine. This means that you +need to add the in between version first and then you can add the latest +version. See this page +for an example.

+
+

The below is in the case of a single master installation and doesn't +take into account of multiple version jumps. Let's say you have two old +Enterprise Linux replicas instead. There are two approaches you can +take:

+
    +
  • Install a new Enterprise Linux system, add it, reinstall old system + to the new version, add it back.
    • +
  • Install two new Enterprise Linux systems, add them as needed, power + off old systems.
    • +
+

Below is an example, with X being the old version, and Y being the new.

+
    +
  • Enterprise Linux Y system is installed and enrolled as a client
    • +
  • Enterprise Linux Y system is added as a replica
    • +
  • Change CRL to Enterprise Linux Y system and adjust settings on + Enterprise Linux X CA master and new Enterprise Linux Y replica for + pki-tomcatd and httpd
    • +
  • Test user is created to ensure DNA range is adjusted
    • +
  • Verify DNA range
    • +
  • Stop first Enterprise Linux X IPA services, remove replica, + uninstall, power off.
    • +
  • Second Enterprise Linux Y system is installed and enrolled as a + client
    • +
  • Second Enterprise Linux Y system is added as a replica
    • +
  • Test user is created again to ensure DNA range is adjusted
    • +
  • Verify DNA range
    • +
  • Stop second Enterprise Linux X IPA services, remove replica, + uninstall, power off.
    • +
+

EL7 to EL8

+
# Enterprise Linux 8
+% dnf module enable idm:DL1
+
+# Install necessary packages, ie AD trust packages if you need them
+% dnf install ipa-server ipa-server-dns -y
+% ipa-client-install --realm EXAMPLE.COM --domain example.com
+% kinit admin
+
+# Add other switches that you feel are necessary, such as forwarders, kra, ntp...
+% ipa-replica-install --setup-dns --setup-ca --ssh-trust-dns --mkhomedir
+
+# Verify all services are in a RUNNING state
+% ipactl status
+Directory Service: RUNNING
+. . .
+
+% ipa-csreplica-manage list
+elX.example.com: master
+elY.example.com: master
+
+% ipa-csreplica-manage list --verbose elY.example.com
+Directory Manager password:
+
+elX.example.com
+  last init status: None
+  last init ended: 1970-01-01 00:00:00+00:00
+  last update status: Error (0) Replica acquired successfully: Incremental update succeeded
+  last update ended: 2019-11-07 22:46:15+00:00
+
+
    +
  • Change CRL to new Enterprise Linux system and adjust settings on + both replicas for pki-tomcatd and httpd
    • +
+
# Change CA master to elY
+% ipa config-mod --ca-renewal-master-server elY.example.com
+
+# Shut down all CRL generation on ELX
+elX% ipa-crlgen-manage status
+CRL generation: enabled
+. . .
+
+elX% ipa-crlgen-manage disable
+Stopping pki-tomcatd
+Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
+Starting pki-tomcatd
+Editing /etc/httpd/conf.d/ipa-pki-proxy.conf
+Restarting httpd
+CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable.
+The ipa-crlgen-manage command was successful
+
+# Verify that the /etc/httpd/conf.d/ipa-pki-proxy.conf file's RewriteRule is not commented
+# If it is, remove the comment and restart httpd. ipa-crlgen-manage should take care of this.
+% tail -n 1 /etc/httpd/conf.d/ipa-pki-proxy.conf
+RewriteRule ^/ipa/crl/MasterCRL.bin https://elX.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]
+
+# Turn it on with ELY
+elY% systemctl stop pki-tomcatd@pki-tomcat.service
+
+# The values should be changed from false to true
+elY% vi /etc/pki/pki-tomcat/ca/CS.cfg
+ca.crl.MasterCRL.enableCRLCache=true
+ca.crl.MasterCRL.enableCRLUpdates=true
+
+elY% systemctl start pki-tomcatd@pki-tomcat.service
+
+# Make sure the rewrite rule has a comment on elY
+elY% vi /etc/httpd/conf.d/ipa-pki-proxy.conf
+. . .
+#RewriteRule ^/ipa/crl/MasterCRL.bin https://elY.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]
+
+elY% systemctl restart httpd
+
+
    +
  • Test user is created to ensure DNA range is adjusted and replication + is working
    • +
+
% ipa user-add --first=testing --last=user testinguser1
+
+# Test on both systems
+elX% ipa user-find testinguser1
+elY% ipa user-find testinguser1
+
+
    +
  • Verify DNA range
    • +
+
# There should be ranges for both replicas
+% ipa-replica-manage dnarange-show
+elX.example.com: ...
+elY.example.com: ...
+
+
    +
  • Stop old Enterprise Linux IPA services, remove replica, uninstall
    • +
+
# Stop all elX services
+elX% ipactl stop
+
+# Delete the elX system from the topology
+elY% ipa server-del elX.example.com
+
+# Uninstall and/or power down system
+elX% ipa-server-install --uninstall
+elX% init 0
+
+

EL8 to EL9

+
# Enterprise Linux 9
+% dnf install ipa-server ipa-server-dns -y
+% ipa-client-install --realm EXAMPLE.COM --domain example.com
+% kinit admin
+
+# Add other switches that you feel are necessary, such as forwarders, kra, ntp...
+% ipa-replica-install --setup-dns --setup-ca --ssh-trust-dns --mkhomedir
+
+# Verify all services are in a RUNNING state
+% ipactl status
+Directory Service: RUNNING
+. . .
+
+% ipa-csreplica-manage list
+elX.example.com: master
+elY.example.com: master
+
+% ipa-csreplica-manage list --verbose elY.example.com
+Directory Manager password:
+
+elX.example.com
+  last init status: None
+  last init ended: 1970-01-01 00:00:00+00:00
+  last update status: Error (0) Replica acquired successfully: Incremental update succeeded
+  last update ended: 2022-08-12 18:11:11+00:00
+
+

Set the CA renewal master to the new system and change the CRL settings

+
% ipa config-mod --ca-renewal-master-server elY.example.com
+
+# Remove the ca.certStatusUpdateInterval entry or set it to 600 (default) on elY
+elY% vim /etc/pki/pki-tomcat/ca/CS.cfg
+
+# Restart the ipa services
+elY% ipactl restart
+
+# Set the value of ca.certStatusUpdateInterval on elX to 0
+elX% vim /etc/pki/pki-tomcat/ca/CS.cfg
+ca.certStatusUpdateInterval=0
+
+elX% ipactl restart
+
+elX% ipa-crlgen-manage status
+CRL generation: enabled
+. . .
+
+elX% ipa-crlgen-manage disable
+Stopping pki-tomcatd
+Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
+Starting pki-tomcatd
+Editing /etc/httpd/conf.d/ipa-pki-proxy.conf
+Restarting httpd
+CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable.
+The ipa-crlgen-manage command was successful
+
+elX% ipa-crlgen-manage status
+CRL generation: disabled
+
+

Create a test user to ensure DNA range is adjusted and replication is +working

+
elY% ipa user-add --first=testing --last=user testinguser1
+
+# Test on both systems
+elX% ipa user-find testinguser1
+elY% ipa user-find testinguser1
+
+

Verify DNA range.

+
# There should be ranges for both replicas
+% ipa-replica-manage dnarange-show
+elX.example.com: ...
+elY.example.com: ...
+
+

Stop old Enterprise Linux IPA services, remove replica, uninstall.

+
# Stop all elX services
+elX% ipactl stop
+
+# Delete the elX system from the topology
+elY% ipa server-del elX.example.com
+
+# Uninstall and/or power down system
+elX% ipa-server-install --uninstall
+elX% init 0
+
+

See this page +for more information.

+

Active Directory Trust

+

To initiate a trust with your active directory domain, ensure the +following requirements are met.

+
+

Requirements

+

Package installed: ipa-server-trust-ad

+

DNS: Properly configured that FreeIPA can resolve the AD servers A and +SRV records

+

This can either be forwarders to AD, a subdomain that IPA manages, or +delegated subdomain from the master DNS servers in your network. This is +completely dependent on your infrastructure.

+

DNS: AD forest has sites and SRV records, including priorities, are set +correctly

+
+

When the following requirements are met, you have two choices before +continuning. You can either use POSIX or have the id range generated +automatically.

+
+

POSIX vs Non-POSIX

+

If you decide to use POSIX, your AD users are expected to have +uidNumber, gidNumber, loginShell, unixHomeDirectory set. Else, you will +need to setup ID overrides if you already have that information for +current users (assuming this is not a new setup for the environment, ie +you already have UID's for people). If you are not planning a migration +from pure AD over to IPA with a trust, it is recommended to note that +information so you can setup the ID overrides. Afterwards, any new users +will get UID/GID's that you will not have to manage yourself.

+
+

You will need to prep your master(s) for the trust. We will be enabling +compat, adding sids, and adding agents so both masters can provide AD +information.

+
% ipa-adtrust-install --add-sids --add-agents --enable-compat
+
+

This will do what we need. If you do not have legacy clients (Enterprise +Linux 5, Solaris, HP-UX, AIX, SLES 11.4, FreeBSD, the list goes on), then you do +not need to enable compat mode. Though, it could be useful to have it for +certain apps or scenarios.

+

You will now need to open the necessary ports. Do this on all masters.

+
+

Ports

+

TCP: 135, 138, 139, 389, 445, 1024-1300, 3268 UDP: 138, 139, 389, 445

+
+
% firewall-cmd --add-service=freeipa-trust --permanent
+% firewall-cmd --complete-reload
+
+

Now you can initiate the trust. The admin account you use should be part +of the domain admins group or at least have permissions to initiate a +trust. The former is path of least resistance.

+
# If you are using POSIX ID, use ipa-ad-trust-posix.
+% ipa trust-add --type=ad example.com --range-type=ipa-ad-trust --admin adminaccount --password 
+
+

Once the trust is up, verify it.

+
% ipa trust-show example.com
+ Realm name: example.com
+ Domain NetBIOS name: AD
+ Domain Security Identifier: S-X-X-XX-XXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX
+ Trust direction: Trusting forest
+ Trust type: Active Directory domain
+ UPN suffixes: example.com
+
+

You should be able to test for the users now.

+
% id aduser1@example.com
+uid=XXXXX(aduser1@example.com) gid=XXXXX(aduser1@example.com) groups=XXXXX(aduser1@example.com)
+
+

Disable Anonymous Bind

+

In some cases, it is a requirement to disable all anonymous binds. If +this is the case, you will need to modify cn=config on each master as it +is not replicated.

+
+

rootdse

+

Some applications do anonymous binds to the directory server to +determine its version and it supported controls. While it is possible to +disable anonymous binds completely, it is important to know that if you +disable the rootdse binds, applications that do anonymous lookups to get +server information will fail.

+
+
% ldapmodify -xZZ -D "cn=Directory Manager" -W -h server.ipa.example.com
+Enter LDAP Password:
+dn: cn=config
+changetype: modify
+replace: nsslapd-allow-anonymous-access
+nsslapd-allow-anonymous-access: rootdse
+
+modifying entry "cn=config"
+
+

Client Setup

+

Enterprise Linux & Fedora

+

Ensure your /etc/resolv.conf (or other dns settings) are set correctly. +Ensure your hostname is also set correctly.

+
% dnf install ipa-client -y
+% ipa-client-install --realm EXAMPLE.COM --domain example.com --mkhomedir
+
+

Mac Clients

+

MacOS Clients are an interesting workstation to setup as a FreeIPA +client. It takes a little bit of fighting and troubleshooting, but it +can work with the right settings. Note that as of Catalina, you may +not be able to login to your account nor will creating a mobile account +function as you would expect. This may have changed in recent macos +releases, so YMMV.

+
+

Other Guides

+

There are a couple of guides out there that you may have found before +(if you looked) that help setup IPA for Mac. There's one for much older +(I think Lion) and one for Sierra. This section was made mostly for my +own reference because I found some things in both of those guides +didn't address issues I ran into one way or another and couldn't find +any information on. The FreeIPA users mail list didn't have any +archives with people having similar issues.

+

If you are interested in the other guides to compare to, you may see +them here (recent) +and here (older)

+
+
+

AD Users

+

AD Users

+

You cannot login as AD users on a Mac when going through FreeIPA. You +can, in theory, point to the cn=compat tree and set the attribute +mapping to rfc2307. In my tests, I have never been able to get this to +work. This section, I am going to assume you are going to be logging in +as a user in IPA. If you are in a mixed environment, add your Mac to +your AD domain instead.

+
+
+

Anonymous Bind

+

There may be cases where if you have disabled anonymous binds in IPA, +this setup may not work, even if you do use a bind account. You will +need to experiment with this if you plan on using a bind account and +plan on or currently have IPA not allowing anonymous binds.

+
+

Check your system's hostname. You want to make sure it has a hostname +defined for it in the domain the mac sits in, even if it's dynamic via +DHCP/DNS.

+
% sudo scutil --set HostName mac.example.com
+
+

Get the IPA certificate. You'll need to double click it after you get +it and import it.

+
% cd ~/Desktop && curl -OL http://server1.ipa.example.com/ipa/config/ca.crt
+% sudo mkdir /etc/ipa
+% sudo cp ca.crt /etc/ipa/ca.crt
+% sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /etc/ipa/ca.crt
+
+

On the IPA server, you will need to create a host and get the keytab.

+
% ipa host-add mac.example.com --macaddress="00:00:00:00:00:00"
+% ipa-getkeytab -s server1.ipa.example.com -p host/mac.example.com -k /tmp/krb5.keytab
+
+

You will need to transfer that keytab to your mac.

+
% cd ~
+% scp user@server1.ipa.example.com:/tmp/krb5.keytab .
+% sudo mv krb5.keytab /etc/krb5.keytab
+% sudo chmod 600 /etc/krb5.keytab
+% sudo chown root:wheel /etc/krb5.keytab
+
+

Configure /etc/krb5.conf

+
[domain_realm]
+    .ipa.example.com = IPA.EXAMPLE.COM
+    ipa.example.com = IPA.EXAMPLE.COM
+
+[libdefaults]
+    default_realm = IPA.EXAMPLE.COM
+    allow_weak_crypto = yes 
+    dns_lookup_realm = true
+    dns_lookup_kdc = true
+    rdns = false
+    ticket_lifetime = 24h
+    forwardable = yes 
+    renewable = true
+
+[realms]
+    IPA.EXAMPLE.COM = {
+        # You don't need to set these when your DNS is setup correctly, but it doesn't hurt to have a reference.
+        # In my opinion, you shouldn't hardcode these values. You have to have a good reason to.
+        #kdc = tcp/server1.ipa.example.com
+        #kdc = tcp/server2.ipa.example.com
+        #admin_server = tcp/server1.ipa.example.com
+        #admin_server = tcp/server2.ipa.example.com
+        pkinit_anchors = FILE:/etc/ipa/ca.crt
+    }
+
+

You'll want to do a kinit to verify. If it works, you should be able to +go to the FreeIPA webui and check that the host is "enrolled" +(Identity -> Hosts).

+
% kinit username@IPA.EXAMPLE.COM
+
+

You need to modify a couple of pam files. I'll explain why they need to +be changed.

+
% sudo vi /etc/pam.d/authorization
+# authorization: auth account
+# Putting krb5 here twice ensures that you can login via kerberos and also get a keytab
+# If "no_ccache" is here, keytabs will not be available on login
+auth          optional       pam_krb5.so use_first_pass use_kcminit default_principal
+auth          sufficient     pam_krb5.so use_first_pass default_principal
+auth          required       pam_opendirectory.so use_first_pass nullok
+account    required       pam_opendirectory.so
+
+% sudo vi /etc/pam.d/screensaver
+# The krb5 changes do similar to the authorization when on the lock screen after a sleep
+#auth       optional       pam_krb5.so use_first_pass use_kcminit
+auth       optional       pam_krb5.so use_first_pass use_kcminit default_principal
+auth       sufficient     pam_krb5.so use_first_pass default_principal
+auth       required       pam_opendirectory.so use_first_pass nullok
+account    required       pam_opendirectory.so
+account    sufficient     pam_self.so
+account    required       pam_group.so no_warn group=admin,wheel fail_safe
+account    required       pam_group.so no_warn deny group=admin,wheel ruser fail_safe
+
+% sudo vi /etc/pam.d/passwd
+# Helps with kerberos logins
+password   sufficient     pam_krb5.so
+auth       required       pam_permit.so
+account    required       pam_opendirectory.so
+password   required       pam_opendirectory.so
+session    required       pam_permit.so 
+
+

After these changes, you'll need to go into make some changes with the +directory utility. This depends on your macOS version.

+

Monterey and older

+
    +
  1. Go to system preferences -> users & groups -> login options - + Click the 'lock' to make changes
    2. +
  2. Set the following:
    3. +
+
Automatic login: Off
+Display login window as: Name and Password
+Show fast user switching menu as: Full Name
+
+
    +
  1. Click "Join" next to "Network Account Server"
    2. +
  2. Enter one of your IPA servers (you can duplicate it later for backup + purposes) and click Continue.
    3. +
  3. Ensure "Allow network users to log in at login window" is + checked - Make sure it's set to all users
    4. +
  4. Click "edit" next to the "Network Account Server"
    5. +
  5. Click "Open Directory Utility"
    6. +
  6. Click the lock, edit LDAPv3
    7. +
  7. Select your server and click "edit"
    8. +
  8. Set the following options:
    9. +
+
Open/close times out in 5 seconds
+Query times out in 5 seconds
+Connection idles out in 1 minute (this can't be changed)
+Encrypt using SSL (selected)
+
+
    +
  1. Click "Search & Mappings"
    2. +
  2. +

    You may either select "rfc2307" from the dropdown or select + custom. It will ask your base DN (eg, dc=ipa,dc=example,dc=com)

    +
    3. +
  3. +

    If you select rfc2307, it will ask for your base DN (eg, + dc=ipa,dc=example,dc=com)

    +
    4. +
  4. +

    If you select "custom", you will need to do this manually for each + record type. You're better off using rfc2307 and working from + there

    +
    5. +
  5. +

    Click the "+" to add a groups record type or scroll and find + "groups".

    +
    6. +
  6. Select "groups", and ensure the following object classes exist. + You can click the "+" to add them when needed.
    7. +
+
+

Record Type ObjectClasses

+
+

Groups posixGroup

+
                         ipausergroup
+
+                         groupOfNames\*
+
+
+
+

Note

+

"groupOfNames" is optional here, because it seems that the directory +utility doesn't understand this concept.

+
+
    +
  1. Expand "groups" and ensure the following for each record type. You + can click the "+" to add the attribute types as needed.
    2. +
+
+

Attribute Mapping

+
+

PrimaryGroupID gidNumber

+

RecordName cn

+
+
    +
  1. Click the "+" to add a users record type or scroll and find + "users".
    2. +
  2. Select "users" and ensure the following object classes exist. You + can click the "+" to add them when needed.
    3. +
+
+

Record Type ObjectClasses

+
+

Users inetOrgPerson

+
                         posixAccount
+
+                         shadowAccount
+
+                         apple-user
+
+
+
    +
  1. Expand "users" and ensure the following for each record type. You + can click the "+" to add the attribute types as needed. Do not + set homeDirectory otherwise you will fail to login.
    2. +
+
+

Attribute Mapping

+
+

AuthenticationAuthority uid

+

GeneratedUID GeneratedUID or ipaUniqueID

+

HomeDirectory #/Users/\$uid\$

+

NFSHomeDirectory #/Users/\$uid\$

+

PrimaryGroupID gidNumber

+

RealName cn

+

RecordName uid

+

UniqueID uidNumber

+

UserShell loginShell

+

AltSecurityIdentities #Kerberos:\$krbPrincipalName\$

+
+
    +
  1. If using custom mapping, click reach record type you created and + ensure the base DN is set.
    2. +
  2. Make sure each record type is set to all subtrees.
    3. +
  3. Click "security" and set an authentication bind DN if needed
    4. +
  4. Click OK
    5. +
  5. Click OK
    6. +
  6. Click on Search Policy.
    7. +
  7. Double check that "/LDAPV3/server1.ipa.example.com" is listed + beneath "/Local/Default"
    8. +
  8. Close everything until you're back to the users & groups section of + preferences
    9. +
  9. Open a terminal.
    10. +
+
% dscacheutil -flushcache
+% dscacheutil -q user -a name username
+
+

You should get a return.

+

If you want to further verify users and groups after the above succeeds, +open up the directory utility again. Click "Directory Editor", ensure +you are searching for "users" and check that they appear in a list on +the right hand side, optionally doing a search. In a default setup, you +shouldn't need an account to do (some) anonymous lookups. If you +changed that in any way, you will need to create a readonly system +account in cn=sysaccounts,cn=etc.

+

Login to the account for the first time from the login screen. Once the +setup has complete, log out and back to a login account. In a terminal, +you will need to make a mobile account.2

+
% sudo /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -P
+# Press enter and put in the password. sudo may not function if you don't do this step.
+# OPTIONAL: Allow the mobile account to be an administrator
+% sudo dscl . -append /Groups/admin GroupMembership username
+
+

Go to system preferences, users & groups and ensure the account is a +mobile account.

+

Ventura and likely newer

+
    +
  1. Go to system preferences -> users & groups
    2. +
  2. Set "automatic login" to "off"
    3. +
  3. Click "edit" next to "Network account server"
    4. +
  4. Type in one of your IPA servers (you can duplicate it later for + backup purposes). Press enter and wait for it to be "green".
    5. +
  5. Click "Open Directory Utility"
    6. +
  6. Click the "lock" to unlock the utility
    7. +
  7. Click "LDAPv3" and click the pencil at the bottom left corner
    8. +
  8. +

    Select the "from server" portion under LDAP mappings and clck + RFC2307. You may also leave it as custom.

    +
    9. +
  9. +

    If you select rfc2307, it will ask for your base DN (eg, + dc=ipa,dc=example,dc=com)

    +
    10. +
  10. +

    If you select "custom", you will need to do this manually for each + record type. You're better off using rfc2307 and working from + there

    +
    11. +
  11. +

    Click "edit"

    +
    12. +
  12. Click the "+" to add a groups record type or scroll and find + "groups" and select it. Add the following object classes
    13. +
+
+

Record Type ObjectClasses

+
+

Groups posixGroup

+
                         ipausergroup
+
+                         groupOfNames\*
+
+
+
+

Note

+

"groupOfNames" is optional here, because it seems that the directory +utility doesn't understand this concept.

+
+
    +
  1. Expand "groups" and ensure the following for each record type. You + can click the "+" to add the attribute types as needed.
    2. +
+
+

Attribute Mapping

+
+

PrimaryGroupID gidNumber

+

RecordName cn

+
+
    +
  1. Click the "+" to add a users record type or scroll and find + "users".
    2. +
  2. Select "users" and ensure the following object classes exist. You + can click the "+" to add them when needed.
    3. +
+
+

Record Type ObjectClasses

+
+

Users inetOrgPerson

+
                         posixAccount
+
+                         shadowAccount
+
+                         apple-user
+
+
+
    +
  1. Expand "users" and ensure the following for each record type. You + can click the "+" to add the attribute types as needed. Do not + set homeDirectory otherwise you will fail to login.
    2. +
+
+

Attribute Mapping

+
+

AuthenticationAuthority uid

+

GeneratedUID GeneratedUID or ipaUniqueID

+

NFSHomeDirectory #/Users/\$uid\$

+

PrimaryGroupID gidNumber

+

RealName cn

+

RecordName uid

+

UniqueID uidNumber

+

UserShell loginShell

+

AltSecurityIdentities #Kerberos:\$krbPrincipalName\$

+
+
    +
  1. If using custom mapping, click reach record type you created and + ensure the base DN is set.
    2. +
  2. Make sure each record type is set to all subtrees if needed.
    3. +
  3. Click "security" and set an authentication bind DN if needed
    4. +
  4. Click OK.
    5. +
  5. Click Search Policy
    6. +
  6. Double check that "/LDAPV3/server1.ipa.example.com" is listed + beneath "/Local/Default". If it is not, select "search patch" + and set it to custom and add it. Click Apply after.
    7. +
  7. Close everything until you're back to the users & groups section of + preferences
    8. +
  8. Go to Lock Screen.
    9. +
  9. Set "login window shows" to "name and password"
    10. +
  10. Open a terminal.
    11. +
+
% dscacheutil -flushcache
+% dscacheutil -q user -a name username
+
+

You should get a return.

+

Login to the account for the first time from the login screen. Once the +setup has complete, log out and back to a login account. In a terminal, +you will need to make a mobile account.3

+
% sudo /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -P
+# Press enter, enter the user's password. sudo may hang if you don't do this.
+# OPTIONAL: Allow the mobile account to be an administrator
+% sudo dscl . -append /Groups/admin GroupMembership username
+
+

Go to system preferences and ensure the account is a mobile account.

+

General macOS Notes

+
+

Group Resolution

+

If you want groups from IPA to resolve to the system, you'll need to +enable the compat tree when using this setup (RFC2307).

+
+
+

Password Notes

+

There are a couple of potential issues with this setup that you should +be aware of as it pertains to mobile accounts.

+
    +
  • If you do a mobile account, changing your password through the + FreeIPA gui does not change your passwords on your system.
    • +
  • If your account does not have any keytabs (eg, you haven't had your + mac on or haven't logged in in over 24 hours), you can login with + the new password and it will suceed. The system will cache the new + password right away. However, your keychain the first time will ask + for the old passwords and this is normal. So you can change them by + hand or you can log out and back in and the system will ask you if + you want to update the password and it will just update + automatically.
    • +
  • There have been reports in a github issue that states you can change + the password in the system preferences but I've been unable to + confirm this.
    • +
+
+

Below is a script that can be adapted for you. It has not been tested on +Monterey and up. This assumes that you took one mac and set it up +properly and you created a tarball with the proper configuration. You +could optionally setup a temporary NFS or samba mount that gets mounted +as root and then unmounted at the end, if you so wish.

+
#!/bin/bash
+serverName=server1.ipa.example.com
+krb5Conf=/etc/krb5.conf
+krb5Tab=/etc/krb5.keytab
+pamDirectory=/etc/pam.d
+
+# Add SSL cert to chain
+mkdir /etc/ipa
+cd /etc/ipa
+curl -OL http://$serverName/ipa/config/ca.crt
+security add-trusted-cert -d -k /Library/Keychains/System.keychain -r trustRoot /etc/ipa/ca.crt
+
+# Stop and flushout the Open Directory
+/usr/sbin/dscacheutil -flushcache
+launchctl unload /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist
+
+# Pull the plist and pam files needed for IPA and deploy them, this assumes you setup one mac and zipped up the configurations
+# You can try your hand at dsconfigldap before pam, but I could never figure it out, honestly.
+# Relevant tar: tar czf /tmp/macconfig.tar.gz /Library/Preferences/OpenDirectory/Configurations /etc/pam.d/authorization \ 
+#                /etc/pam.d/screensaver /etc/pam.d/passwd /etc/krb5.conf
+cd /tmp
+curl -OL http://$serverName/macconfig.tar.gz
+cd /
+tar xzf /tmp/macconfig.tar.gz
+
+# Add steps here for your keytab! Where are you getting it from?
+cp /tmp/mac.keytab /etc/krb5.keytab
+chown root:wheel /etc/krb5.keytab
+chmod 600 /etc/krb5.keytab
+
+# Start directory
+launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist
+sleep 30
+
+# Kill the loginwindow
+killall loginwindow
+
+# If the system doesn't reboot here, reboot now.
+
+

If you want to move your local files, you will need to tread lightly +here. I personally believe it's always good to start fresh though. Look +into the ditto command. I suppose something like this can work:

+
# make sure you're logged in as a different account away from your local account
+% sudo su -
+root# cd /Users
+root# ditto localfolder networkfolder (or maybe an mv?)
+root# chown -R user:user folder
+root# /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -P
+
+

Another issue you may run into, if you have been using your Mac with a +local account for a while, a lot of directories in /Applications will be +owned by localuser:staff or localuser:admin. It's recommended to fix +those too.

+
+

Discovery

+

The directory framework in MacOS has the ability to discover settings +for a particular LDAP server that it is being connected to. FreeIPA does +not contain the schema, plugins, nor the infrastructure to provide the +same things (for example, mDNS/Avahi, among other things). There was a +(WIP) plugin created in 2017 by abbra. However, it is unclear if this +works at all, nor is it clear if it ever did and will in python3 (abbra +noted at the time that it "installs" into python 2 directories, which +hints to not being tested or working on python 3). Please see the +following resources for discussion and information.

+ +
+

SUSE

+

To setup openSUSE with FreeIPA, we'll need to do some manual work. This +applies to SUSE 12 and up where the freeipa-client packages don't exist +in the main repositories.

+
+

freeipa repos

+

There are OpenSUSE repos with the freeipa packages, though they are +considered "experimental". If they show up in the base, then the below +steps will be removed. However, if you are willing to use the +repo, +a lot of the steps below may not be needed. We have not tested this.

+
+
# On an IPA server or client with the IPA utilities...
+% ipa host-add suse.example.com
+% /usr/sbin/ipa-getkeytab -s ipa.example.com -p host/suse.example.com -k /tmp/suse.keytab
+% scp /tmp/suse.keytab suse.example.com:/tmp/krb5.keytab
+
+# On the IPA client...
+% cp /tmp/krb5.keytab /etc
+% chmod 600 /etc/krb5.keytab
+% mkdir /etc/ipa
+% curl -o /etc/ipa/ca.crt http://ipa.example.com/ipa/config/ca.crt
+% curl -o /etc/pki/trust/anchors/ipa.example.com.crt http://ipa.example.com/ipa/config/ca.crt
+% update-ca-certificates
+% zypper install sssd sssd-ipa yast2-auth-client krb5-client openldap2-client cyrus-sasl-gssapi
+
+# Setup SSSD
+% vi /etc/sssd/sssd.conf
+[domain/example.com]
+cache_credentials = True
+krb5_store_password_if_offline = True
+ipa_domain = example.com
+ipa_hostname = suse.example.com
+# Client Specific Settings
+ipa_server = _srv_, ipa.example.com
+dns_discovery_domain = example.com
+# If we have a trust with domain resolution order
+#full_name_format = %1$s
+
+id_provider = ipa
+auth_provider = ipa
+access_provider = ipa
+chpass_provider = ipa
+
+ldap_tls_cacert = /etc/ipa/ca.crt
+
+[sssd]
+services = nss, sudo, pam, ssh
+domains = example.com
+
+[nss]
+filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,tomcat,postgres
+homedir_substring = /home
+
+[pam]
+
+[sudo]
+
+[autofs]
+
+[ssh]
+
+# Setup kerberos
+% vi /etc/krb5.conf
+[libdefaults]
+  default_realm = EXAMPLE.COM
+  dns_lookup_realm = true
+  dns_lookup_kdc = true
+  rdns = false
+  dns_canonicalize_hostname = false
+  ticket_lifetime = 24h
+  forwardable = true
+  udp_preference_limit = 0
+  default_ccache_name = KEYRING:persistent:%{uid}
+
+
+[realms]
+  EXAMPLE.COM = {
+    pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
+    pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
+  }
+
+[domain_realm]
+  .example.com = EXAMPLE.COM
+  example.com = EXAMPLE.COM
+  suse.example.com = EXAMPLE.COM
+
+# Setup pam
+% pam-config -a --sss --mkhomedir --mkhomedir-umask=0077 \
+  --pwhistory --pwhistory-remember=5 --localuser --cracklib \
+  --cracklib-minlen=14 --cracklib-dcredit=-1 --cracklib-ucredit=-1 \
+  --cracklib-lcredit=-1 --cracklib-ocredit=-1 --cracklib-retry=3 --unix-sha512
+
+# Setup nsswitch (you can make it compat sss, but I use files sss)
+% sed -i.bak 's/compat$/files sss/g' /etc/nsswitch.conf
+% echo "sudoers: files sss" >> /etc/nsswitch.conf
+% sed -i '/netgroup/ s/nis/sss/g' /etc/nsswitch.conf
+
+# Depending on your suse version, you may want to set the nisdomainname
+# It does not hurt to set this
+% sed -i.bak '/NETCONFIG_NIS_STATIC_DOMAIN/ s/""/"example.com"/g' /etc/sysconfig/network/config
+% netconfig update -f
+
+# Start sssd
+% systemctl enable sssd --now
+
+# Verify
+% id admin
+
+

In the case of having an IPA-AD trust, you may need to change a line in +your pam configuration.

+
% sed -i 's/use_first_pass/forward_pass/g' /etc/pam.d/common-auth-pc
+
+# The affected line should appear like the below
+auth    sufficient      pam_sss.so      forward_pass
+
+

HBAC

+

When we first setup our IPA servers, we had an option set to make it so +hbac wasn't allowed for everyone. This way we have to create HBAC rules +for our systems. I personally do this out of habit when working with +IPA. What we need to do though is create an "admin" group that can +login to all machines.

+
% ipa idrange-show IPA.EXAMPLE.COM_id_range
+  Range name: IPA.EXAMPLE.COM_id_range
+  First Posix ID of the range: 686600000
+  Number of IDs in the range: 200000
+  First RID of the corresponding RID range: 1000
+  First RID of the secondary RID range: 100000000
+  Range type: local domain range
+% ipa group-add --gid=686610000 linuxadm
+% ipa group-add-member --users=flast linuxadm
+
+

Note for AD Users: In the event that your AD user or group of users +will be an admin, you need to create an "external" group to map the +user or users over. This isn't required if you don't have an AD trust.

+
# Create an external group that the AD user/group goes into
+% ipa group-add --external linuxadm_external
+# Add the user (or group) into the external group
+% ipa group-add-member --users=aduser1@example.com linuxadm_external
+% ipa group-add-member --users=adgroup1@example.com linuxadm_external
+# Add the external group as a member of the IPA posix group.
+# aduser1 and adgroup1 are now effectively members of the linuxadm group in IPA.
+% ipa group-add-member --groups=linuxadm_external linuxadm
+
+

Now, let's create an HBAC for our Linux Administrator account for our +group.

+
% ipa hbacrule-add --hostcat=all --servicecat=all --desc='linux admins all access' linuxadm
+% ipa hbacrule-add-user --groups=linuxadm linuxadm
+% ipa hbactest --rules=All_Systems --user=flast --host=server1.ipa.example.com --service=sshd
+% ipa hbactest --rules=All_Systems --user=aduser1@example.com --host=server1.ipa.example.com --service=sshd
+
+

You might want to create an HBAC rule specifically for your IPA admin +accounts to have ssh access to the IPA servers too. You can follow +something like the above to make it possible. Or you can just add the +IPA admins group into the HBAC rule we just made above.

+
+

Group Types

+

Groups in Active Directory have three types. These three types can +actually change the behavior of how SSSD on the IPA domain controllers +resolve them or if they'll even be resolvable at all. The three types +are 'Domain Local', 'Global', and 'Universal'. If at all possible, +avoid groups being 'Global'. Domain Local or Universal is recommended.

+
+

SUDO

+

Setting up sudo is relatively easy. SSSD (1.16.x and 2.X) supports IPA +as a provider for sudo. Based on the last section, let's create a +sample rule for our Linux admins that can login to every system, we want +to ensure they can run all commands.

+
% ipa sudorule-add --runasusercat=all --hostcat=all --cmdcat=all --desc='linux admins all sudo' all_linux_sudo
+% ipa sudorule-add-user --groups=linuxadm all_linux_sudo
+
+

You can make this a little more specific, such as /bin/bash as everyone +or otherwise. It's your call here. If you want to create a sudo rule +and add some commands to it, you can do something like this.

+
% ipa sudorule-add sudo_rule
+% ipa sudorule-add-allow-command --sudocmds="/usr/bin/less" sudo_rule
+
+

Legacy Client Setup

+

This applies to Solaris, Omnios, others based on Illumos.

+

Solaris 10

+

Setting up Solaris 10 as an IPA client is an interesting feat. However, +it comes with security issues.

+
+

No SSL or TLS Support

+

Note that for Solaris 10 to talk to IPA, you must use clear text +communication. Solaris 10 is too old to use new ciphers. However, while +LDAP may be clear text, kerberos should still be secure enough for the +time being.

+

If you are using an AD trust, the user's passwords will be passed in +clear text. Highly suggested that you decommission Solaris 10 from your +environment. Solaris 10 will eventually be removed from this page.

+
+

Create an ldif for your service account (optional)

+
dn: uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com
+objectclass: account
+objectclass: simplesecurityobject
+uid: solaris
+userPassword: secret123
+passwordExpirationTime: 20380119031407Z
+nsIdleTimeout: 0
+
+

The solaris system account is required. So now, add it in.

+
% ldapadd -xWD 'cn=Directory Manager' -f /tmp/solaris.ldif
+
+

Now, set the nisdomain.

+
% defaultdomain ipa.example.com
+% echo 'ipa.example.com' > /etc/defaultdomain
+
+

Configure kerberos.

+
% vi /etc/krb5/krb5.conf
+[libdefaults]
+default_realm = IPA.EXAMPLE.COM
+dns_lookup_kdc = true
+verify_ap_req_nofail = false
+
+[realms]
+IPA.EXAMPLE.COM = {
+}
+
+[domain_realm]
+ipa.example.com = IPA.EXAMPLE.COM
+.ipa.example.com = IPA.EXAMPLE.COM
+
+[logging]
+default = FILE:/var/krb5/kdc.log
+kdc = FILE:/var/krb5/kdc.log
+kdc_rotate = {
+ period = 1d
+ version = 10
+}
+
+[appdefaults]
+kinit = {
+renewable = true
+forwardable= true
+}
+
+

Generate a keytab and bring it over.

+
# on the ipa server
+% ipa host-add solaris10.example.com
+% ipa-getkeytab -s server1.ipa.example.com -p host/solaris10.example.com -k /tmp/solaris10.keytab
+
+# Transfer the keytab
+% scp /tmp/solaris10.keytab solaris10.example.com:/tmp
+
+# On the solaris 10 machine
+% cp /tmp/solaris10.keytab /etc/krb5/krb5.keytab
+% chmod 600 /etc/krb5/krb5.keytab
+% chmod 644 /etc/krb5/krb5.conf
+% chown root:sys /etc/krb5/*
+% kinit flast2@IPA.EXAMPLE.COM
+
+

Create the LDAP configurations, bring the certificate, and create an NSS +database.

+
% mkdir /etc/ipa /var/ldap
+% cd /etc/ipa
+% wget -O ipa.pem http://server1.ipa.example.com/ipa/config/ca.crt
+% certutil -A -n "ca-cert" -i /etc/ipa/ipa.pem -a -t CT -d .
+% cp * /var/ldap
+% vi /etc/ldap.conf
+base dc=ipa,dc=example,dc=com
+scope sub
+TLS_CACERTDIR /var/ldap
+TLS_CERT /var/ldap/cert8.db
+TLS_CACERT /var/ldap/ipa.pem
+tls_checkpeer no
+ssl off
+bind_timelimit 120
+timelimit 120
+uri ldap://server1.ipa.example.com
+sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com
+pam_lookup_policy yes
+
+

Now init the ldap client.

+
+

No Secure Connection

+

When using this, you are not creating a secure connection. The Solaris +10 SSL libraries are so old that they cannot work with the ciphers that +FreeIPA has turned on.

+
+
+

AD Trust - Different Trees

+

If using an AD trust, you should use the second example, where it looks +at the compat tree for users.

+
+
+

No Service Account

+

If you have configured FreeIPA to not allow any anonymous connections, +you will need to use a proxy account. We have provided the examples for +this configuration.

+
+

Without an AD Trust

+
# Without AD Trust (no proxy)
+% ldapclient manual -a authenticationMethod=none \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com \
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+# Without AD Trust (proxy)
+% ldapclient manual -a credentialLevel=proxy \
+                    -a authenticationMethod=simple \
+                    -a proxyDN="uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com" \
+                    -a proxyPassword="secret123" \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com \
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+

With an AD Trust

+
# With AD Trust (no proxy)
+% ldapclient manual -a authenticationMethod=none \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com \
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+# With AD Trust (proxy)
+% ldapclient manual -a credentialLevel=proxy \
+                    -a authenticationMethod=simple \
+                    -a proxyDN="uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com" \
+                    -a proxyPassword="secret123" \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com \
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+

This should succeed. Once it succeeds, you need to configure pam and +nsswitch.

+
+

AD Trust Information

+

In the event you don't have an AD trust, you can change the "binding" +lines to required, remove the pam_ldap lines, and change pam_krb5 +lines to read "required"

+
+
% vi /etc/pam.conf
+
+# Console
+login auth requisite    pam_authtok_get.so.1
+login auth sufficient   pam_krb5.so.1
+login auth required     pam_unix_cred.so.1
+login auth required     pam_dial_auth.so.1
+login auth sufficient   pam_unix_auth.so.1 server_policy
+login auth sufficient   pam_ldap.so.1
+
+rlogin auth sufficient  pam_rhosts_auth.so.1
+rlogin auth requisite   pam_authtok_get.so.1
+rlogin auth required    pam_dhkeys.so.1
+rlogin auth sufficient  pam_krb5.so.1
+rlogin auth required    pam_unix_cred.so.1
+rlogin auth sufficient  pam_unix_auth.so.1 server_policy
+rlogin auth sufficient  pam_ldap.so.1
+
+# Needed for krb
+krlogin auth required   pam_unix_cred.so.1
+krlogin auth sufficient pam_krb5.so.1
+
+# Needed for krb
+krsh auth required      pam_unix_cred.so.1
+krsh auth required      pam_krb5.so.1
+
+# ?
+ppp auth requisite      pam_authtok_get.so.1
+ppp auth required       pam_dhkeys.so.1
+ppp auth sufficient     pam_krb5.so.1
+ppp auth required       pam_dial_auth.so.1
+ppp auth binding        pam_unix_auth.so.1 server_policy
+ppp auth sufficient     pam_ldap.so.1
+
+# Other, used by sshd and "others" as a fallback
+other auth requisite    pam_authtok_get.so.1
+other auth required     pam_dhkeys.so.1
+other auth sufficient   pam_krb5.so.1
+other auth required     pam_unix_cred.so.1
+other auth sufficient   pam_unix_auth.so.1 server_policy
+other auth sufficient   pam_ldap.so.1
+other account requisite pam_roles.so.1
+other account required  pam_projects.so.1
+other account binding   pam_unix_account.so.1 server_policy
+other account sufficient pam_krb5.so.1
+other account sufficient pam_ldap.so.1
+other session required  pam_unix_session.so.1
+other password required pam_dhkeys.so.1
+other password requisite pam_authtok_get.so.1
+other password requisite pam_authtok_check.so.1 force_check
+other password required pam_authtok_store.so.1 server_policy
+
+# passwd and cron
+passwd auth binding    pam_passwd_auth.so.1 server_policy
+passwd auth sufficient pam_ldap.so.1
+cron account required  pam_unix_account.so.1
+
+# SSH Pubkey - Needed for openldap and still probably needed
+sshd-pubkey account required pam_unix_account.so.1
+
+
% vi /etc/nsswitch.conf
+
+# Below are just the minimum changes
+passwd:     files ldap [NOTFOUND=return]
+group:      files ldap [NOTFOUND=return]
+sudoers:    files ldap
+netgroup:   ldap
+# the rest here are just here, up to you if you choose to set them.
+hosts:      files dns
+ipnodes:    files dns
+ethers:     files ldap
+publickey:  files ldap
+automount:  files ldap
+
+

You can test now if you'd like.

+
bash-3.2# ldaplist -l passwd flast2
+dn: uid=flast2,cn=users,cn=compat,dc=ipa,dc=example,dc=com
+        cn: First Last
+        objectClass: posixAccount
+        objectClass: ipaOverrideTarget
+        objectClass: top
+        gidNumber: 1006800001
+        gecos: First Last
+        uidNumber: 1006800001
+        ipaAnchorUUID: :IPA:ipa.example.com:8babb9a8-5aaf-11e7-9769-00505690319e
+        loginShell: /bin/bash
+        homeDirectory: /home/first.last2
+        uid: first.last2
+
+

I recommend setting up sudo at least... if you want to use sudo, +install the sudo-ldap from sudo.ws for Solaris 10.

+

Solaris 11

+

Solaris 11 shares similar configuration to Solaris 10. There are a +couple of manual things we have to do, but they are trivial. Solaris +11/Omnios will use TLS and sudo should just work.

+
+

AD Groups

+

In Solaris 10, users who logged in with AD users (with their short name) +would appear as their full name (name@domain). This allowed their +groups to fully resolve. However, in Solaris 11.4, this was not the +case. Short name logins will work but your groups will not resolve as +the compat tree uses the full name. To avoid running into this problem, +you should be on at least SRU 11.4.7.4.0. Note that on a later SRU, you +may need to setup an ID view (without overrides) for groups and sudo to +work again.

+
+

Below is for the service account like in the previous section, here as a +reference.

+
dn: uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com
+objectclass: account
+objectclass: simplesecurityobject
+uid: solaris
+userPassword: secret123
+passwordExpirationTime: 20380119031407Z
+nsIdleTimeout: 0
+
+
% ldapadd -xWD 'cn=Directory Manager' -f /tmp/solaris.ldif
+
+

Now, set the nisdomain.

+
% defaultdomain ipa.example.com
+% echo 'ipa.example.com' > /etc/defaultdomain
+
+

Configure kerberos.

+
% vi /etc/krb5/krb5.conf
+[libdefaults]
+default_realm = IPA.EXAMPLE.COM
+dns_lookup_kdc = true
+verify_ap_req_nofail = false
+
+[realms]
+IPA.EXAMPLE.COM = {
+}
+
+[domain_realm]
+ipa.example.com = IPA.EXAMPLE.COM
+.ipa.example.com = IPA.EXAMPLE.COM
+
+[logging]
+default = FILE:/var/krb5/kdc.log
+kdc = FILE:/var/krb5/kdc.log
+kdc_rotate = {
+ period = 1d
+ version = 10
+}
+
+[appdefaults]
+kinit = {
+renewable = true
+forwardable= true
+}
+
+

Generate a keytab and bring it over.

+
# on the ipa server
+% ipa host-add solaris11.example.com
+% ipa-getkeytab -s server1.ipa.example.com -p host/solaris11.example.com -k /tmp/solaris11.keytab
+
+# Transfer the keytab
+% scp /tmp/solaris11.keytab solaris11.example.com:/tmp
+
+# On the solaris 11 machine
+% cp /tmp/solaris11.keytab /etc/krb5/krb5.keytab
+% chmod 600 /etc/krb5/krb5.keytab
+% chmod 644 /etc/krb5/krb5.conf
+% chown root:sys /etc/krb5/*
+
+# Check the keytab
+% klist -ket /etc/krb5/krb5.keytab
+
+# Test that you can kinit
+% kinit flast2@IPA.EXAMPLE.COM
+
+

Create the LDAP configurations, bring the certificate, and create an NSS +database.

+
+

Solaris 11.3 vs 11.4

+

Previously we had 11.3 and 11.4 configurations. We have removed 11.3 as +we no longer support it.

+
+
% mkdir /etc/ipa /var/ldap
+% cd /etc/ipa
+% wget -O ipa.pem http://server1.ipa.example.com/ipa/config/ca.crt
+% cp * /var/ldap
+% vi /etc/ldap.conf
+base dc=ipa,dc=example,dc=com
+scope sub
+bind_timelimit 120
+timelimit 120
+uri ldap://server1.ipa.example.com
+sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com
+pam_lookup_policy yes
+TLS_CACERTDIR /var/ldap
+ssl start_tls
+tls_checkpeer no
+
+

Now init the ldap client. We actually get to use a secure connection +here. Kerberos is hit or miss, could never get sasl/GSSAPI to work.

+
+

Different Trees - Trust or not?

+

There are multiple examples of how to setup the trees. If using an AD +trust, you should use the second example, where it looks at the compat +tree for users. However, if you do not have trusts, then it is perfectly +possible to still use the AD Trust example. Try both and see which works +better for your environment.

+
+
+

No Service Account

+

If you have configured FreeIPA to not allow any anonymous connections, +you will need to use a proxy account. We have provided the examples for +this configuration.

+
+

Without AD Trust

+
# Without AD Trust (no proxy)
+% ldapclient manual -a authenticationMethod=tls:simple \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+# Without AD Trust (proxy)
+% ldapclient manual -a authenticationMethod=tls:simple \
+                    -a credentialLevel=proxy \
+                    -a proxyDN="uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com" \
+                    -a proxyPassword="secret123" \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com \
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+# Without AD Trust (Kerberos) - Only works if Solaris is in the same DNS domain as IPA
+% ldapclient manual -a authenticationMethod=sasl/GSSAPI \
+                    -a credentialLevel=self \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com \
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+

With AD Trust

+
# With AD Trust (no proxy)
+% ldapclient manual -a authenticationMethod=tls:simple \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+# With AD Trust (proxy)
+% ldapclient manual -a authenticationMethod=tls:simple \
+                    -a credentialLevel=proxy \
+                    -a proxyDN="uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com" \
+                    -a proxyPassword="secret123" \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com \
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+# With AD Trust (Kerberos) - Only works if Solaris is in the same DNS domain as IPA
+% ldapclient manual -a authenticationMethod=sasl/GSSAPI \
+                    -a credentialLevel=self \
+                    -a proxyDN="uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com" \
+                    -a proxyPassword="secret123" \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com \
+                    -a defaultServerList="server1.ipa.example.com server2.ipa.example.com" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+
+

This should succeed. Once it succeeds, you need to configure pam and +nsswitch.

+
% /usr/sbin/svccfg -s name-service/switch setprop config/sudoer = astring: "files ldap"
+% /usr/sbin/svccfg -s name-service/switch setprop config/password = astring: "files ldap [NOTFOUND=return]"
+% /usr/sbin/svccfg -s name-service/switch setprop config/group = astring: "files ldap [NOTFOUND=return]"
+
+% /usr/sbin/svcadm refresh svc:/system/name-service/switch
+% /usr/sbin/svcadm restart svc:/system/name-service/switch
+% /usr/sbin/svcadm restart ldap/client
+
+
+

AD Trust Information

+

In the event you don't have an AD trust, you can change the "binding" +lines to required and remove the pam_ldap lines. Optionally, you can +set pam_krb5 to "required", however sufficient should work just fine.

+
+

Without an AD Trust

+
% vi /etc/pam.d/login
+auth definitive         pam_user_policy.so.1
+auth requisite          pam_authtok_get.so.1
+auth required           pam_dhkeys.so.1
+auth sufficient         pam_krb5.so.1
+auth required           pam_unix_cred.so.1
+auth sufficient         pam_unix_auth.so.1 server_policy
+
+% vi /etc/pam.d/other
+auth definitive         pam_user_policy.so.1
+auth requisite          pam_authtok_get.so.1
+auth required           pam_dhkeys.so.1
+auth sufficient         pam_krb5.so.1
+auth required           pam_unix_cred.so.1
+auth sufficient         pam_unix_auth.so.1 server_policy
+
+account requisite       pam_roles.so.1
+account definitive      pam_user_policy.so.1
+account required        pam_unix_account.so.1 server_policy
+account sufficient      pam_krb5.so.1
+
+session definitive      pam_user_policy.so.1
+session required        pam_unix_session.so.1
+
+password definitive     pam_user_policy.so.1
+password include        pam_authtok_common
+password sufficient     pam_krb5.so.1
+password required       pam_authtok_store.so.1 server_policy
+
+% vi /etc/pam.d/sshd-pubkey
+account required        pam_unix_account.so.1
+
+

With an AD Trust

+
% vi /etc/pam.d/login
+auth definitive         pam_user_policy.so.1
+auth requisite          pam_authtok_get.so.1
+auth required           pam_dhkeys.so.1
+auth sufficient         pam_krb5.so.1
+auth required           pam_unix_cred.so.1
+auth sufficient         pam_unix_auth.so.1 server_policy
+auth sufficient         pam_ldap.so.1
+
+% vi /etc/pam.d/other
+auth definitive         pam_user_policy.so.1
+auth requisite          pam_authtok_get.so.1
+auth required           pam_dhkeys.so.1
+auth sufficient         pam_krb5.so.1
+auth required           pam_unix_cred.so.1
+auth sufficient         pam_unix_auth.so.1 server_policy
+auth sufficient         pam_ldap.so.1
+
+account requisite       pam_roles.so.1
+account definitive      pam_user_policy.so.1
+account binding         pam_unix_account.so.1 server_policy
+account sufficient      pam_krb5.so.1
+account sufficient      pam_ldap.so.1
+
+session definitive      pam_user_policy.so.1
+session required        pam_unix_session.so.1
+
+password definitive     pam_user_policy.so.1
+password include        pam_authtok_common
+password sufficient     pam_krb5.so.1
+password required       pam_authtok_store.so.1 server_policy
+
+% vi /etc/pam.d/sshd-pubkey
+account required        pam_unix_account.so.1
+
+

You can test now if you'd like.

+
root@solaris11:~# ldaplist -l passwd flast2
+dn: uid=flast2,cn=users,cn=compat,dc=ipa,dc=example,dc=com
+        cn: First Last
+        objectClass: posixAccount
+        objectClass: ipaOverrideTarget
+        objectClass: top
+        gidNumber: 1006800001
+        gecos: First Last
+        uidNumber: 1006800001
+        ipaAnchorUUID: :IPA:ipa.example.com:8babb9a8-5aaf-11e7-9769-00505690319e
+        loginShell: /bin/bash
+        homeDirectory: /home/first.last2
+        uid: first.last2
+
+

Automated Scripts

+

I at one point built a bunch of scripts to automate Solaris servers +talking to IPA +here. +However, it is likely the scripts no longer work or contain outdated +information.

+

AD Trust Double UID

+

Solaris 11 once in a while gets random regressions when it comes to +authentication and ID's, among many other things they randomly decide +to break. Big shout out to Oracle.

+

In a brief discussion with a user in the #freeipa IRC channel, the user +was trying to find a way to chop off the domain name for logins but also +have sudo still work as there were some random issues in general. We +both discovered that in SRU 11.4.20.4.0, even though both UID's are +present from ldaplist -l passwd, sudo was no longer working properly. +The first thing we tried was to create an ID view and override a user +with a new username. This successfully removed the domain, but did not +solve the sudo problem. He instead got "no account present for that +user". However, I wasn't able to replicate this.

+

However, later, one thing he noticed is after creating an ID view with +no overrides and pointing Solaris 11 to the view in the compat tree, +Solaris 10-esque authentication ID reporting started to occur. Running +ldaplist -l passwd user reported back the double UID as expected, but +the FQDN comes first which resolved his group/sudo issues.

+
# Create a view... no id overrides required here
+% ipa idview-add solaris
+# On Solaris...
+# Take EXTREME care with the group and passwd base DN's, they need to point
+# to the view properly
+# This example uses kerberos to authenticate.
+% ldapclient manual -a authenticationMethod=self \
+                    -a credentialLevel=sasl/GSSAPI \
+                    -a defaultSearchBase=dc=ipa,dc=example,dc=com \
+                    -a domainName=ipa.example.com \
+                    -a defaultServerList="server1.angelsofclockwork.net server2.angelsofclockwork.net" \
+                    -a followReferrals=true \
+                    -a objectClassMap=shadow:shadowAccount=posixAccount \
+                    -a objectClassMap=passwd:posixAccount=posixaccount \
+                    -a objectClassMap=group:posixGroup=posixgroup \
+                    -a serviceSearchDescriptor=group:cn=groups,cn=solaris,cn=views,cn=compat,dc=angelsofclockwork,dc=net \
+                    -a serviceSearchDescriptor=passwd:cn=users,cn=solaris,cn=views,cn=compat,dc=angelsofclockwork,dc=net \
+                    -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \
+                    -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \
+                    -a bindTimeLimit=5
+# Make sure you set your props...
+% /usr/sbin/svccfg -s name-service/switch setprop config/sudoer = astring: "files ldap"
+% /usr/sbin/svccfg -s name-service/switch setprop config/password = astring: "files ldap [NOTFOUND=return]"
+% /usr/sbin/svccfg -s name-service/switch setprop config/group = astring: "files ldap [NOTFOUND=return]"
+
+% /usr/sbin/svcadm refresh svc:/system/name-service/switch
+% /usr/sbin/svcadm restart svc:/system/name-service/switch
+% /usr/sbin/svcadm restart ldap/client
+# Verify...
+% ldaplist -l passwd adusername
+. . .
+% id -a adusername
+. . .
+
+

Thank you to "mewho" on libera for finding this interesting workaround.

+

OmniOS/Illumos

+

Some steps between Solaris 10 and 11 can be followed to make OmniOS +work. However, we have been unable to resolve why sudo will not work +when using an AD trust. If you are using a standalone FreeIPA and no +trust, sudo should work just fine.

+

Legacy HBAC

+

For HBAC to work on Solaris, you will need to compile the pam_hbac +module found here. I would clone +the current master branch or download the master.zip to your Solaris +system. Each OS has their set of instructions for compiling.

+

First, create the following system account. We will need this when we +are configuring our legacy clients.

+
dn: uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com
+objectClass: account
+objectClass: simplesecurityobject
+objectClass: top
+uid: hbac
+userPassword: password
+
+

Solaris 10

+
% /opt/csw/bin/pkgutil -i -y libnet ar binutils gcc4g++ glib2 libglib2_dev gmake
+% /opt/csw/bin/pkgutil -i -y libnet ar binutils gcc4g++ glib2 libglib2_dev gmake
+% PATH=$PATH:/opt/csw/bin
+% export M4=/opt/csw/bin/gm4
+% autoconf -o configure
+% autoreconf -i
+
+# Yes, SSL must be disabled for Solaris 10 to work. The libraries are too old.
+# You may or may not need to set CFLAGS, CXXFLAGS, and LDFLAGS with -m32
+% ./configure AR=/opt/csw/bin/gar --with-pammoddir=/usr/lib/security --sysconfdir=/etc/ --disable-ssl --disable-man-pages
+% make
+% make install
+
+

Solaris 11

+
% pkg install autoconf libtool pkg-config automake gcc docbook
+% autoreconf -if
+% ./configure --with-pammoddir=/usr/lib/security --mandir=/usr/share/man --sysconfdir=/etc/
+% make
+% make install
+
+

Omnios

+
% pkg install developer/build/autoconf developer/build/libtool \
+              developer/pkg-config developer/build/automake    \
+              developer/gcc48 system/header developer/object-file \
+              developer/linker
+% autoreconf -if
+% ./configure --with-pammoddir=/usr/lib/security --mandir=/usr/share/man --sysconfdir=/etc/
+% make
+% make install
+
+

pam_hbac.conf

+
% vim /etc/pam_hbac.conf
+
+# Replace client with your server's FQDN
+URI = ldap://server.ipa.example.com
+BASE = dc=ipa,dc=example,dc=com
+BIND_DN = uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com
+BIND_PW = password
+SSL_PATH = /var/ldap
+HOST_NAME = client
+
+

PAM Configuration

+
# Solaris 10 - /etc/pam.conf
+# Modify the other account section... It should come at the end of the account blocks.
+. . .
+other account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail
+
+# Solaris 11 - /etc/pam.d/other
+# Same here, only modify the account section
+. . .
+account required        pam_hbac.so ignore_unknown_user ignore_authinfo_unavail
+
+

In the event you cannot login or things aren't working the way you'd +expect, add 'debug' to the end of the pam_hbac line and watch +/var/log/authlog for errors.

+

Login with AD Users to Legacy Clients

+

For AD users to be able to login to legacy clients, you have to enable +system-auth to the IPA servers. Without it, users will be denied access, +regardless of HBAC controls or if you're using the pam_hbac module.

+
% ipa hbacsvc-add system-auth
+% ipa hbacrule-add legacy_client_auth
+% ipa hbacrule-add-host --hostgroups=ipaservers legacy_client_auth
+% ipa hbacrule-mod --usercat=all legacy_client_auth
+
+

Legacy Active Directory Trust Notes

+

Just a section of notes.

+

Domain Resolution Order Oddness

+

If using domain resolution order, AD users get double uid attributes - +but only if they login with their shortname. If they login with fqdn, +double uid's do not occur. But shortnames do not work anymore. Have to +restart the directory server to make short names work again.

+

Solaris Weirdness

+

If using domain resolution order, Solaris 10 gets the group resolution +correct for short named AD users. Solaris 11 does not unless you are on +SRU 11.4.7.4.0 or newer. There is a way to chop off the domain name from +the uid using views.

+

Domain Options

+

This section goes over "situational" scenarios. These scenarios are +reflective of the environment in which IPA is installed and not all will +fit into your environment. These are more or less common situations that +could occur during an IPA deployment or even post-deployment.

+

Remove @realm for AD users

+

A common scenario is that IPA and AD will have a trust, but there will +not be any IPA users with the exception of the engineering team for +managing IPA itself. The common theme is that because of this, the +engineers and customers would rather not login with username@realm.

+
+

Info

+

The following is only applicable in an IPA-AD trust. An IPA-only +scenario would not require any of these steps and most pieces would work +natively (no @realm, sudo, hbac).

+

In the event that you are in an IPA-AD scenario, please take note that +this can adversely affect legacy clients. This will cause ldapsearches +that are done in the compat tree to display multiple uid attributes. In +most cases, this is fine and the user can still login without the realm +name. The whoami and id commands will show the domain. There's no +workaround for this.

+
+

On the IPA servers, you will need to set the domain resolution order. +This was introduced in 4.5.0.

+
% kinit admin
+% ipa config-mod --domain-resolution-order="example.com:ipa.example.com"
+
+

After, you will need to clear out your SSSD cache.

+
# sss_cache -E is insufficient for this.
+% systemctl stop sssd
+% rm -rf /var/lib/sss/db/*
+% systemctl start sssd
+
+

The below is optional. It will remove the @realm off the usernames, like +on the prompt or id or whoami commands. Only do this if required. Only +do this on the clients. Do not make this change on an IPA replica.

+
# vi /etc/sssd/sssd.conf
+
+[domain/ipa.example.com]
+. . .
+full_name_format = %1$s
+
+

This will ensure EL7, EL8, EL9 clients resolve the AD domain first when +attempting logins and optionally drop the @realm off the usernames.

+

AD and IPA group names with short names

+

You may notice that your clients have intermittent issues with name +resolution when the following are true:

+
    +
  • Groups (or users) have the same names in both IPA and AD
    • +
  • You are using domain resolution order
    • +
  • You are shortening names on the clients
    • +
+

You may want to actually search for them to identify the errant groups +and then correct them. You can correct them either on the AD or IPA +side. I would opt for the IPA side.

+
% kinit admin@IPA.EXAMPLE.COM
+% vi /tmp/dupecheck.sh
+#!/bin/bash
+for x in ${ARRAY[*]} ; do
+  ldapsearch -x -b "DC=example,DC=com" -h example.com -LLL -w 'PASSWORD' -D 'username@example.com' samaccountname="$x" samaccountname | grep -q $x
+  if [[ $? -eq 0 ]]; then
+    echo "$x: DUPLICATE"
+  fi
+done
+
+% bash /tmp/dupecheck.sh
+
+

If you run into any duplicates, they should show up in a list for you +address.

+
+

sAMAccountName vs CN

+

The "CN" and "sAMAccountName" attributes are not the same in AD, +depending on who made the group or other factors. The sAMAccountName +attribute is the value used to determine names from AD, whether you are +enrolled with AD or the IPA server SSSD is pulling the information. This +is why we are searching for that attribute, and not the CN.

+
+

Sites and AD DC's

+

By creating a subdomain section in /etc/sssd/sssd.conf on an IPA server, +it is possible to set an AD Site or AD server(s) directly in SSSD. By +default, sssd tries to do location based discovery. There may be a case +where this isn't possible (eg, only a set of AD servers may only be +contacted in certain "air gapped" networks).

+
[domain/ipa.example.com/example.com]
+# If you want a site
+ad_site = Site_Name
+# If you want a server(s)
+ad_server = dc1.example.com, dc2.example.com
+# A backup?
+ad_backup_server = dc3.example.com, dc4.example.com
+
+

If you don't have access or a way to find the sites using the Windows +tools, you can run an ldapsearch to find it (or an equivalent ldap +browsing tool).

+
% ldapsearch -x -h example.com -s one -WD 'CN=username,CN=Users,DC=example,DC=com' \
+  -b 'CN=Sites,CN=Configuration,DC=example,DC=com' cn
+
+

This should report back your sites. If you want to know the servers for +those sites (in case you don't want to deal with the sites, but just +the DC's themselves), you use ldapsearch but use the base DN of the +site name.

+
% ldapsearch -x -h example.com -WD 'CN=username,CN=Users,DC=example,DC=com' \
+  -b 'CN=Servers,CN=Site_Name,CN=Sites,CN=Configuration,DC=example,DC=com' dnsHostName
+
+
+

Hardcoded DC's

+

If the DC's change at any time and they are harded in your sssd.conf, +it is up to you to know when new controllers are being added or removed +as to not disrupt the connectivity from IPA to AD when performing user +or group lookups.

+
+

Enterprise Linux 6 SUDO and Default Domain Suffix

+

This issue with the above section is that once you do this, sudo rules +will begin failing, they will no longer work for Enterprise Linux 6. +This is because sssd was changed to look for cn=sudo rather than +ou=sudoers. To enable the compatibility fall back, you will need to +install a newer SSSD.

+

Set Default Shell for AD Users

+

By default, after a trust has been established, the shell all AD users +get is /bin/sh. To change this, you must change the sssd.conf on the IPA +masters.

+
% vi /etc/sssd/sssd.conf
+[domain/ipa.example.com]
+. . .
+default_shell = /bin/bash
+
+% systemctl restart sssd
+
+

Automated Kerberos Principals

+

Once in a great while, we run into situations where we need to have an +automated process for creating principals and keytabs. This section +takes a look at some of those examples that we've ran into.

+

Hadoop/Cloudera

+

This assumes you are using Cloudera Manager and not Ambari in any form.

+
+

DNS Information

+

It is highly likely that if you are using AWS, your nodes are getting +stupid names like compute.internal. While there is a a way to change +this if +you don't change it, you will need to rely on something like DNSMASQ to +allow the nodes to communicate with FreeIPA. FreeIPA will be upset +about the stupid names because it can't do a rDNS lookup.

+
+

Cloudera Manager Woes

+

It is likely you have Cloudera/Hadoop, it is also very likely you (or +another team) are deploying and using Cloudera Manager (or Director?). +You may be running into issues that involve direct Active Directory +integration. Maybe you're moving away from a standalone LDAP system +over to Active Directory or even FreeIPA. Maybe you have FreeIPA in an +AD trust but the users or contractors absolutely insist on using AD +against their better judgement, despite the problems they're running +into. Whatever the scenario is, we feel your pain. Here are some things +you should probably know:

+
    +
  • +

    Cloudera Manager (or Director?) supports Active Directory out of the + box and obviously not FreeIPA despite the devs wanting to work + something out back in 2015

    +
    • +
  • +

    Ambari has support for FreeIPA, but we are focusing on Cloudera + Manager here.

    +
      +
    • Cloudera Manager supports custom keytab retrieval scripts
      • +
    +
    • +
  • +

    Hostnames that are longer than 15 characters, regardless of the + cloud provider or onprem setup, will ultimately fail

    +
      +
    • The NETBIOS limit in AD is 16 characters, which is 15 + $ at + the end - This means hosts will enroll on top of themselves and + your cluster will be broken
      • +
    +
    • +
+

FreeIPA does not have the name limitation and using an AD trust, AD +users can freely use Hadoop when the cluster is properly setup. +Enrolling the cluster nodes into FreeIPA and using a custom retrieval +script will solve most (if not all) of the issues you may run into as +well when it comes to keytabs, which Hadoop heavily relies on. The +custom script is simply because Cloudera by default likes having direct +access to the kerberos infrastructure, which is a no-go for FreeIPA.

+

The Solution

+

To summarize, here is our proposed solution:

+
    +
  • Create an account called cdh
    • +
  • +

    Create a role called "Kerberos Managers" and apply the following + privileges:

    +
      +
    • System: Manage Host Keytab
      • +
    • System: Manage Host Keytab Permissions
      • +
    • System: Manage Service Keytab
      • +
    • System: Manage Service Keytab Permissions
      • +
    • System: Manage User Principals (was not actually used, but who + knows what we could use the role for later)
      • +
    +
    • +
  • +

    Apply the role to the cdh account

    +
    • +
  • Create a custom script they could use to enroll the servers into + FreeIPA (out of scope here)
    • +
  • Create a custom script that utilizes the cdh account to create + services
    • +
+

So let's create the necessary things we need.

+
# Create the account
+# Note... you may want to make this account non-expiring since it's just a service account
+% ipa user-add --first="Cloudera" --last="Key Manager" cdh
+
+# Create the Kerberos Managers role
+% ipa role-add "Kerberos Managers"
+
+# Create the kerberos manager privilege
+% ipa privilege-add "Privileges - Kerberos Managers"
+% ipa privilege-add-permission "Privileges - Kerberos Managers" \
+    --privileges="System: Manage Host Keytab" \
+    --privileges="System: Manage Host Keytab Permissions" \
+    --privileges="System: Manage Service Keytab" \
+    --privileges="System: Manage Service Keytab Permissions" \
+    --privileges="System: Manage User Principals"
+
+# Add the privilege to the role
+% ipa role-add-privilege "Kerberos Managers" \
+    --privileges="Privileges - Kerberos Managers"
+
+# Add the user to the role
+% ipa role-add-member --users=cdh "Kerberos Managers"
+
+# Optionally, we can export the keytab for the user with a password
+# You will see why in the next script
+% ipa-getkeytab -p cdh@EXAMPLE.COM -k cdh.keytab -P
+
+

Now we need our special kerberos keytab retrieval script.

+
#!/bin/bash
+# Created by: @nazunalika - Louis Abel
+# Purpose: To retrieve keytabs for Cloudera / Hadoop
+# https://github.com/nazunalika/useful-scripts
+
+# Disclaimer: We do not take responsibilities for breaches or misconfigurations of
+#             software. Use at your own risk
+
+# Variables
+# This can be anywhere, but it SHOULD be secure with at least 600 permissions
+CDHKT="/root/.cdh/cdh.keytab"
+CDHUSER="cdh"
+IPAREALM="EXAMPLE.COM"
+# This can be any server. You could make an array and have it randomly selected
+IPASERVER="ipa01.example.com"
+
+# Where is this going?
+DESTINATION="$1"
+# The full principal for the keytab in question
+FULLPRINC="$2"
+# Shortened name
+PRINC=$(echo $FULLPRINC | sed "s/\@$(echo $IPAREALM)//")
+
+00_kinitUser() {
+  # Pick what suits you best, we prefer using a keytab
+  # Password based kinit, based on the keytab we created prior!
+  # You could also have this in a file somewhere, I guess. Just
+  # has to be secured.
+  echo ThisIsAWeakPassword | kinit $CDHUSER@$IPAREALM
+
+  # Keytab based kinit, obviously we created it before right? It just needs to be
+  # on the right system, deployed in some secure manner
+  #kinit -kt $CDHKT $CDHUSER@$IPAREALM
+  if [[ $? == "1" ]]; then
+    echo FAILED TO KINIT
+    exit
+  fi
+}
+
+01_createPrinc() {
+  echo "INFO: Checking for existing principle"
+  if ipa service-find $FULLPRINC; then
+    echo "INFO: Principle found"
+  else
+    echo "INFO: Not found, creating"
+    ipa service-add $FULLPRINC
+  fi
+}
+
+02_createServiceAllows() {
+  # We need to allow the service to create and retrieve keytabs
+  echo "INFO: Ensuring service allows to create and retrieve keytabs"
+  ipa service-allow-create-keytab --users=$CDHUSER $FULLPRINC
+  ipa service-allow-retrieve-keytab --users=$CDHUSER $FULLPRINC
+
+  # Let's retrieve the keytabs
+  if ipa service-show $FULLPRINC | grep 'Keytab' | grep 'False'; then
+    echo "INFO: Creating keytab for $FULLPRINC to $DESTINATION"
+    ipa-getkeytab -s $IPASERVER -p $PRINC -k $DESTINATION
+  else
+    echo "INFO: Retriving keytab for $FULLPRINC to $DESTINATION"
+    ipa-getkeytab -r -s $IPASERVER -p $PRINC -k $DESTINATION
+  fi
+}
+
+00_kinitUser
+01_createPrinc
+02_createServiceAllows
+
+kdestroy
+exit 0
+
+

Place the above script in a file that is accessible by the cloudera +manager such as /usr/local/bin/getKeytabsCDH.sh and ensure it is owned +by cloudera-scm with a permission set of 775.

+

During the kerberos wizard, stop when you are verifying the "cdh" +user. You will need to set the configuration for "Custom Kerberos +Keytab Retrieval Script" to /usr/local/bin/getKeytabsCDH.sh and then +you're almost there.4

+

An important tidbit is currently Enterprise Linux 7+ and higher use +memory based keytabs and java doesn't support them.5 Because of +this, the /etc/krb5.conf should be modified.

+
% cat /etc/krb5.conf
+. . .
+# Make sure the below is commented
+# default_ccache_name = KEYRING:persistent:%{uid}
+. . .
+
+

DNS Forwarding

+

DNS Forwarding to DoT

+

Presently, FreeIPA does not support DoT (DNS over TLS) nor DoH (DNS over +HTTPS) (this appears to be a bind limitation and we can't find +documentation that says otherwise). However, it is possible to setup +unbound to do the forwarding for you, in which you tell your bind +servers (or in this case, the bind DNS servers in your IPA domain) to +forward to that unbound server for all forwarding.

+
+

Keep it Separate

+

It is recommended to keep your unbound service separate from the IPA +servers. Spin up another instance in your network that will run unbound +or run it on a standalone bind server that you may have on a separate +port.

+
+

To forward to the unbound service, modify the DNS global configuration +in IPA:

+
# Replace 10.100.0.224 with the IP of your unbound instance
+% ipa dnsconfig-mod --forward-policy=only --forwarder='10.100.0.224'
+
+# Add 'port xxxx' if you have set unbound to another port
+% ipa dnsconfig-mod --forward-policy=only --forwarder='10.100.0.224 port 9553'
+
+

Logging

+

Audit Logs

+

By default, the audit logs in /var/log/dirsrv/slapd-INSTANCE/audit do +not get populated. And the access logs don't show much in terms of +modifications and what is being changed. There is also /var/log/httpd/* +logs, but it may be useful to see ldif style logging for changes against +FreeIPA.

+
# Modify the DSE configuration by turning on audit logging
+[label@ipa01 ~]# ldapmodify -D "cn=directory manager" -W -p 389 -h localhost
+Enter LDAP Password:
+dn: cn=config
+changetype: modify
+replace: nsslapd-auditlog-logging-enabled
+nsslapd-auditlog-logging-enabled: on
+# Press CTRL+d here
+modifying entry "cn=config"
+
+# To test, I'll add a user to a group
+[label@ipa01 ~]$ ipa group-add-member --users=jbaskets aocusers
+  Group name: aocusers
+  GID: 686600003
+  Member users: ..., jbaskets
+-------------------------
+Number of members added 1
+-------------------------
+# Let's verify the log
+[label@ipa01 ~]$ sudo su -
+[sudo] password for label:
+Last login: Sun Mar 29 16:42:36 MST 2020 on pts/0
+[root@ipa01 ~]# cd /var/log/dirsrv/slapd-EXAMPLE-NET/
+[root@ipa01 slapd-EXAMPLE-NET]# cat audit
+time: 20200329223754
+dn: cn=config
+result: 0
+changetype: modify
+replace: nsslapd-auditlog-logging-enabled
+nsslapd-auditlog-logging-enabled: on
+-
+replace: modifiersname
+modifiersname: cn=directory manager
+-
+replace: modifytimestamp
+modifytimestamp: 20200330053754Z
+-
+
+        389-Directory/1.4.1.3 B2019.323.229
+        ipa01.example.net:636 (/etc/dirsrv/slapd-EXAMPLE-NET)
+
+# Looks like right here the modification happened 
+time: 20200329224007
+dn: cn=aocusers,cn=groups,cn=accounts,dc=example,dc=net
+result: 0
+changetype: modify
+add: member
+member: uid=jbaskets,cn=users,cn=accounts,dc=example,dc=net
+-
+replace: modifiersname
+modifiersname: uid=label,cn=users,cn=accounts,dc=example,dc=net
+-
+replace: modifytimestamp
+modifytimestamp: 20200330054006Z
+-
+replace: entryusn
+entryusn: 900028
+-
+
+

Certificates

+

These are notes of things I've ran into before while dealing with +certificates.

+

Renewed IPA HTTP Certificate Stuck

+

This was something I discovered sort of on accident but never really +"noticed" - Though I'm sure I would've noticed sometime in 2021 when +my certificate expired. I was running ipa-healthcheck --failures-only +as I do sometimes, and noticed some weird certmonger things pop up. But +it made me look at my certificate list...

+
[root@ipa01 ~]# ipa-getcert list
+Number of certificates and requests being tracked: 9.
+Request ID '20191106025922':
+        status: MONITORING
+        stuck: no
+        key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
+        certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
+        CA: IPA
+        issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET
+        subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET
+        expires: 2021-11-05 19:59:27 MST
+        principal name: krbtgt/ANGELSOFCLOCKWORK.NET@ANGELSOFCLOCKWORK.NET
+        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
+        eku: id-kp-serverAuth,id-pkinit-KPKdc
+        pre-save command:
+        post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
+        track: yes
+        auto-renew: yes
+Request ID '20200123075636':
+        status: MONITORING
+        stuck: no
+        key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-ANGELSOFCLOCKWORK-NET',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-ANGELSOFCLOCKWORK-NET/pwdfile.txt'
+        certificate: type=NSSDB,location='/etc/dirsrv/slapd-ANGELSOFCLOCKWORK-NET',nickname='Server-Cert',token='NSS Certificate DB'
+        CA: IPA
+        issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET
+        subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET
+        expires: 2021-11-05 19:55:33 MST
+        dns: ipa01.angelsofclockwork.net
+        principal name: ldap/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET
+        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
+        eku: id-kp-serverAuth,id-kp-clientAuth
+        pre-save command:
+        post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv ANGELSOFCLOCKWORK-NET
+        track: yes
+        auto-renew: yes
+Request ID '20200123075639':
+        status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN
+        stuck: yes
+        key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key'
+        certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt'
+        CA: IPA
+        issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET
+        subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET
+        expires: 2021-11-05 19:55:48 MST
+        dns: ipa01.angelsofclockwork.net
+        principal name: HTTP/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET
+        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
+        eku: id-kp-serverAuth,id-kp-clientAuth
+        pre-save command:
+        post-save command: /usr/libexec/ipa/certmonger/restart_httpd
+        track: yes
+        auto-renew: yes
+
+

Interestingly, I wasn't sure what +NEWLY_ADDED_NEED_KEYINFO_READ_PIN meant and I couldn't really find +much on what would cause this to happen. And I know my certificate +isn't expired, according to the output. In fact, I checked with openssl +just in case.

+
[root@ipa01 ~]# openssl x509 -text -noout -in /var/lib/ipa/certs/httpd.crt | grep 'Not After'
+            Not After : Nov  6 02:55:48 2021 GMT
+
+

I'm not sure if this is just a result of migrating from Enterprise +Linux 7 to 8 at the time, but it seemed easy enough to remove the +tracking and put it back in, which ultimately fixed the monitoring state +and now it was no longer "stuck".

+
[root@ipa01 ~]# ipa-getcert stop-tracking -i 20200123075639
+Request "20200123075639" removed.
+[root@ipa01 ~]# ipa-getcert start-tracking -f /var/lib/ipa/certs/httpd.crt -k /var/lib/ipa/private/httpd.key -p /var/lib/ipa/passwds/ipa01.angelsofclockwork.net-443-RSA -C /usr/libexec/ipa/certmonger/restart_httpd -K HTTP/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET
+New tracking request "20200504003758" added.
+[root@ipa01 ~]# ipa-getcert list -i "20200504003758"
+Number of certificates and requests being tracked: 9.
+Request ID '20200504003758':
+        status: MONITORING
+        stuck: no
+        key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/ipa01.angelsofclockwork.net-443-RSA'
+        certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt'
+        CA: IPA
+        issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET
+        subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET
+        expires: 2021-11-05 19:55:48 MST
+        dns: ipa01.angelsofclockwork.net
+        principal name: HTTP/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET
+        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
+        eku: id-kp-serverAuth,id-kp-clientAuth
+        pre-save command:
+        post-save command: /usr/libexec/ipa/certmonger/restart_httpd
+        track: yes
+        auto-renew: yes
+
+ +

Like with the IPA httpd certificates, I noticed at least 4 certificates +stuck because a PIN was missing. Turns out that it's actually easy to +modify the tracking request and fix the issue entirely. Below is my +example doing this on the auditSigningCert. This seems to only occur on +Enterprise Linux 8.

+
[root@ipa01 alias]# getcert list -i 20200615180351
+Number of certificates and requests being tracked: 9.
+Request ID '20200615180351':
+        status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN
+        stuck: yes
+        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca'
+        certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca'
+        CA: dogtag-ipa-ca-renew-agent
+        issuer:
+        subject:
+        expires: unknown
+        pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
+        post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
+        track: yes
+        auto-renew: yes
+
+[root@ipa01 alias]# getcert start-tracking -i 20200615180351 -p /etc/pki/pki-tomcat/alias/pwdfile.txt
+Request "20200615180351" modified.
+[root@ipa01 alias]# getcert list -i 20200615180351
+Number of certificates and requests being tracked: 9.
+Request ID '20200615180351':
+        status: MONITORING
+        stuck: no
+        key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pinfile='/etc/pki/pki-tomcat/alias/pwdfile.txt'
+        certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
+        CA: dogtag-ipa-ca-renew-agent
+        issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET
+        subject: CN=CA Audit,O=ANGELSOFCLOCKWORK.NET
+        expires: 2021-03-13 23:15:41 MST
+        key usage: digitalSignature,nonRepudiation
+        pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
+        post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
+        track: yes
+        auto-renew: yes
+
+

Default Certificates with SAN

+

A question that arises now and again is how to setup a load balancer for +FreeIPA's LDAP servers whether it's an actual load balancer (layer 4) +or some sort of DNS record with multiple A records, or perhaps with some +sort of round robin DNS. The issue is that the certificate verification +fails, because the certificate being presented is of the IPA server +itself with no SAN. To address this, you have to create a host that has +the name of the load balancer or DNS record you plan on using and allow +the IPA servers to manage the host.

+

CMS Communication Issues (403)

+

This isn't necessarily certificate issue, but more or less an issue as +it pertains to the certificate system itself. There may be cases where +during upgrades, a configuration in /etc/pki/pki-tomcat/server.xml is +not properly reconfigured. In that file, you'll notice Connector lines +that have a secret and a requiredSecret parameter and they both have +different values.

+
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="localhost4" secret="AAA" requiredSecret="BBB"/>
+<Connector address="localhost6" port="8009" protocol="AJP/1.3" redirectPort="8443" secret="AAA" requiredSecret="BBB"/>
+
+

The issue may be that these aren't correct. This generally comes down +to IPA and pki-core conflicting on these attributes. To correct this, +you will need to find the secret in /etc/httpd/conf.d/ipa-pki-proxy.conf +(on the ProxyPass line) and ensure that's the same secret in both +fields.

+
ProxyPassMatch ajp://localhost:8009 secret=AAA
+
+

Make sure they're the same in server.xml

+
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="localhost4" secret="AAA" requiredSecret="AAA"/>
+<Connector address="localhost6" port="8009" protocol="AJP/1.3" redirectPort="8443" secret="AAA" requiredSecret="AAA"/>
+
+

After changing, restart the service with +systemctl restart pki-tomcat@pki-tomcatd.service.

+

Kerberos

+

This section goes over some stuff about kerberos that we've ran into +and might find useful someday.

+

Accounts with OTP Enabled

+

When logging into a machine with a password (first factor) and an OTP +token (second factor), this generally works without a problem. You can +easily run klist and you'll see that you have a ticket and everything. +In the cases where you're calling kinit all by itself, this doesn't +work as expected at the time of this writing.

+
% kinit account@REALM
+kinit: Pre-authentication failed: Invalid argument while getting initial credentials
+
+

A bugzilla was +opened about this issue in 2017, a +pagure issue was opened in 2014 +about this exact scenario, where IPA is configured for password+OTP and +a user has an assigned token. There is currently one workaround, which +is using kinit -n to perform anonymous processing.

+

Footnotes

+
+
+
    +
  1. +

    For more information on DNS for FreeIPA, please read this page and this page ↩

    +
    2. +
  2. +

    The -P asks for the password of the username in question, that way it is cached right away. The directory service on the system then has credentials to compare to. I have found that sometimes if you don't use -P, even if you're logged in as the account, the password does not get cached and you'll get stuck at a background image the next time you login. Again, this is only sometimes. Your mileage may vary here. ↩

    +
    3. +
  3. +

    The -P asks for the password of the username in question, that way it is cached right away. The directory service on the system then has credentials to compare to. I have found that sometimes if you don't use -P, even if you're logged in as the account, the password does not get cached and you'll get stuck at a background image the next time you login. Again, this is only sometimes. Your mileage may vary here. ↩

    +
    4. +
  4. +

    Please read this page for more information. ↩

    +
    5. +
  5. +

    This may have changed. However it is up to you to test if this is the case. ↩

    +
    6. +
+
+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + + diff --git a/el/index.html b/el/index.html new file mode 100644 index 00000000..bfe198a1 --- /dev/null +++ b/el/index.html @@ -0,0 +1,230 @@ + + + + + + + + + + + Enterprise Linux - Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

This section contains various articles on setups for Enterprise Linux and Fedora systems.

+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + + diff --git a/el/nat/index.html b/el/nat/index.html new file mode 100644 index 00000000..ebb9c15b --- /dev/null +++ b/el/nat/index.html @@ -0,0 +1,318 @@ + + + + + + + + + + + NAT/Router - Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

This page goes over setting up a router or a simple NAT service for +Enterprise Linux.

+

Requirements

+

Here are the list of requirements below.

+
    +
  • Enterprise Linux 8, 9 or Fedora
    • +
  • An active internet connection to install the packages required or available internal mirrors
    • +
  • A system with at least two (2) network interfaces
    • +
+

Tutorial

+

Interface Setup

+

To properly setup the system, a few things have to be done.

+
    +
  1. One interface must be the WAN interface, in most cases this is set + to DHCP.
    2. +
  2. Another interface must be the LAN interface or a group of interfaces + must become a bridge with a static address
    3. +
  3. ip_forward must be turned on - optionally if you have ipv6, turn on + that forwarding as well
    4. +
+
+

IPv6 and NAT

+

If you have an IPv6 prefix, whether it's from your ISP or it's a +brokered prefix from he.net, NAT is generally not needed. Instead of +using NAT for IPv6, you can just do simple forwarding. This is covered +in a later section.

+
+

FirewallD

+

When using firewalld, Enterprise Linux 7+ and all Fedora\'s can setup a +simple NAT with masquerade without having to know iptables or nftables +syntax. This may be more or less ideal for some users who want to +quickly get a NAT and router going. The drawback is that the syntax and +knowing how the rules work are hidden behind a frontend. To setup a NAT:

+
# Tell eth0 to be our WAN
+% nmcli con mod eth0 connection.zone external
+# Tell eth1 to be our LAN (or a bridge if you have one)
+% nmcli con mod eth1 connection.zone internal
+# Doesn't hurt to re-up
+% nmcli con up eth0 ; nmcli con up eth1
+
+# The external zone already has masquerade on, but just in case
+% firewall-cmd --zone=external --add-masquerade --permanent
+% firewall-cmd --complete-reload
+% firewall-cmd --get-active-zones
+external
+  interfaces: eth0
+internal
+  interfaces: eth1
+
+

nftables

+

This is for Enterprise Linux 8/9 or Fedora where nftables is the default. +While iptables exists for Enterprise Linux 8 still, it is being +superseded by nftables. It is recommended to stick with nftables.

+

The syntax for nftables is a little tricky and quite different from what +we may be used to with iptables. This may be an oversimplification and +may or may not work. For ideas, you can view the files in /etc/nftables. +This is a rough example of what I tried on migration to Enterprise Linux +8.

+
# Disable firewalld, we'll enable nftables later
+% systemctl disable firewalld --now
+% systemctl mask firewalld
+# Flush all rules
+% nft flush ruleset
+
+

Rest coming soon.

+

IPv6 Forwarding

+

Coming soon.

+

DHCP

+

Optional. Coming soon

+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + + diff --git a/el/openldap/index.html b/el/openldap/index.html new file mode 100644 index 00000000..26f8c9ef --- /dev/null +++ b/el/openldap/index.html @@ -0,0 +1,1398 @@ + + + + + + + + + + + OpenLDAP - Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

Deprecation

+

Please note that the OpenLDAP server is considered deprecated in RHEL +(and thusly other EL derivatives). This document will stay here as a +reference for those who are still using the server software on +Enterprise Linux 7, potentially using the OpenLDAP LTB version of the +software, or using the openldap-servers package from Rocky Linux 9's +plus repository. It may apply to Fedora users in some contexts, but +there are some differences they may never be documented here. If you see +a need for corrections, please open up an issue on our github.

+

Most of this information should be considered out of date. OpenLDAP +2.6.x makes some changes that the below document may or may not cover.

+

Preface

+

This tutorial goes over how to install OpenLDAP to a Enterprise Linux +Server and options on configuring and setting up accounts for host +access, etc. This how-to is the method of implementation that I used, +and can be modified/changed to any users preferences if preferred. +Enterprise Linux and Fedora users will have the ability to use SSSD for +SUDO (and it's relatively easy to set it up).

+

Overview

+

Simply put, LDAP is a directory service for authentication across a +network. Rather than have local accounts on a bunch of machines, LDAP +can be used to have one account across a bunch of machines. LDAP was +once an easy setup in RHEL 5 but had changed in RHEL 6 and 7, and here +provides the necessary information needed to get a simple LDAP system +running with possible SUDO support and various options of how to support +your LDAP system.

+

Requirements

+

First and foremost, we have a list of requirements. Keep in mind, if you +do not fulfill these requirements, you may run into some issues down the +road.

+
    +
  • Enterprise Linux 8, Enterprise Linux 9
    • +
  • DNS Server (LDAP does NOT appreciate IP addresses for the URI)
    • +
  • An active internet connection to install the packages required
    • +
+

Tutorial Preface, Notes, and Recommendations

+
+

Warning

+

Potential Pitfalls!

+
    +
  • The incorrect configuration in your firewall or other settings can + cause login failures
    • +
  • Not using certificates (TLS/SSL) will cause you not to be able to + login (This is a EL7+ LDAP Client Requirement)
    • +
  • SELinux is a pain when using mounted home directories or + certificates (primarily in Enterprise Linux 7+, will you have + problems with certificates/home directories)
    • +
  • If you use /home as an NFS mount, you'll see some nasty side + effects if you have local users.
    • +
+
+
+

Note

+

Recommended Information

+
    +
  • It's recommended to use colored vim syntax. Root doesn't use vim + when vim-enhanced is installed. You can make an alias for vi to run + vim.
    • +
  • Turn on syntaxing in ~/.vimrc -- syntax on
    • +
  • Make the vim colors brighter in ~/.vimrc -- set background=dark
    • +
  • Export your EDITOR variable in ~/.bash_profile -- export EDITOR=vim
    • +
  • Keep selinux set to enforcing
    • +
+
+
+

Note

+

Database Information

+

We will be using lmdb, which is recommended over using hdb or bdb.

+
+
+

Note

+

EL 9 OpenLDAP

+

Enterprise Linux 9 has fully dropped OpenLDAP where there are no server +packages normally built. In some EL distributions, openldap-servers is +still built and provided in an extra repository. Rocky Linux 9 has +openldap-servers in their plus repository. EPEL also has it available.

+
+

Installation

+

Below details the process for installing OpenLDAP to our system(s). This +includes installing the packages, setting up certificates, and +configuring the LDAP server via LDIF files.

+

Packages

+

You will need the following packages. A couple of them may already be +installed. If you don't plan on migrating local accounts to LDAP, you +can leave out migrationtools.

+
# If you are on Rocky Linux 9, you will need to enable the plus repository
+dnf install openldap openldap-servers migrationtools nss-tools -y
+
+

Certificates

+

Enterprise Linux 7 clients and other newer distributions that are non-el +require TLS/SSL for authentication when going toward LDAP. because of +this, we will need to create certificates, regardless if you are in a +lab or not.

+
+

Note

+

Certificate Information

+

NSS should no longer be required. Anything NSS related has been removed.

+
+

I have two ways of doing it, we can do it manually or through a script. +I prefer using my script to take care of it. First the manual way.

+
mkdir /etc/pki/ldap 
+cd /etc/pki/ldap
+openssl genrsa -des3 -out ca.key 4096  # Remember the password you put here
+
+openssl genrsa -out ldapserver.key 4096
+
+openssl req -new -x509 -key ca.key -out ca.pem -days 3650
+Country Name (2 letter code) [XX]:US
+State or Province Name (full name) []:Arizona
+Locality Name (eg, city) [Default City]:Phoenix
+Organization Name (eg, company) [Default Company Ltd]:SSN Studio
+Organizational Unit Name (eg, section) []:Channel Maintainers
+Common Name (eg, your name or your server's hostname) []:SSN     # If you want to use a server name here, perform this step on another server first
+Email Address []:youremail@mail.com
+
+openssl req -new -key ldapserver.key -out ldapserver.csr
+Country Name (2 letter code) [XX]:US
+State or Province Name (full name) []:Arizona
+Locality Name (eg, city) [Default City]:Phoenix
+Organization Name (eg, company) [Default Company Ltd]:SSN Studio
+Organizational Unit Name (eg, section) []:LDAP Server Maintainer
+Common Name (eg, your name or your server's hostname) []:zera1.angelsofclockwork.net    # Set your common name to your server name for this certificate 
+Email Address []:youremail@mail.com
+
+openssl x509 -req -in ldapserver.csr -out ldapserver.pem -CA ca.pem -CAkey ca.key -days 3650 -set_serial 01
+
+ln -s ca.pem `openssl x509 -hash -in ca.pem -noout`.0
+# Do an ls on the directory and save the hashed name including the .0 somewhere
+
+certutil -N -d /etc/pki/ldap
+# Do not enter any passwords. When asked, just hit enter beyond this point.
+
+chown root:ldap *
+chmod 640 *
+
+

The scripted way.

+
#!/bin/bash
+# CA Information
+CAcountry="US"
+CAstate="Arizona"
+CAlocale="Phoenix"
+CAorganization="SSN Studio"
+CAorganizationalunit="Channel Maintainers"
+# If you set the below to a hostname, you’re screwed. Don’t do it!
+# Only do it if you have an actual hostname you will do CA signing on!
+CAconicalname="SSN"
+CAemail="tucklesepk@gmail.com"
+# LDAP Server information
+country="US"
+state="Arizona"
+locale="Phoenix"
+organization="SSN Studio"
+organizationalunit="LDAP Server Maintainer"
+conicalname="zera1.angelsofclockwork.net"
+email="pc68xl@gmail.com"
+
+certdir="/etc/pki/ldap"
+
+mkdir $certdir ; cd $certdir
+echo "Enter a password when asked."
+openssl genrsa -des3 -out ca.key 4096
+openssl genrsa -out ldapserver.key 4096
+# Create the self-signed CA cert
+openssl req -new -x509 -key ca.key -out ca.pem -days 3650 -subj /C="$CAcountry"/ST="$CAstate"/L="$CAlocale"/O="$CAorganization"/OU="$CAorganizationalunit"/CN="$CAconicalname"/emailAddress="$CAemail"/
+# Create the LDAP server cert
+openssl req -new -key ldapserver.key -out ldapserver.csr -subj /C="$country"/ST="$state"/L="$locale"/O="$organization"/OU="$organizationalunit"/CN="$conicalname"/emailAddress="$email"/
+# Sign it
+openssl x509 -req -in ldapserver.csr -out ldapserver.pem -CA ca.pem -CAkey ca.key -days 3650 -set_serial 01
+ln -s ca.pem `openssl x509 -hash -in ca.pem -noout`.0
+chown root:ldap *
+chmod 640 *
+
+

Make sure to obtain your hash. Your hash will be different from mine.

+
ls -l /etc/pki/ldap | grep '0'
+39642ab3.0
+
+

LDAP Server Configuration

+

Configurations done in OpenLDAP are done via LDIF. Your passwords should +be hashed as well. Before we begin, let's start by generating a +password for our root DN. This is required.

+
slappasswd 
+New password:
+Re-enter new password: 
+{SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+
+
+

Keep this SSHA output for our configuration files. Next, we'll need to +make a couple LDIFs.

+

This is our suffix.ldif file. This file helps to create the mdb database +for our LDAP structure. It also sets our DIT suffix, root password, etc. +You should change the olcSuffix, olcRootDN, and olcRootPW to whatever +you plan on using. The olcDbMaxSize is set to 20GB. This is normally +sufficient and can be changed. The olcDbEnvFlags can be changed as well.

+
dn: olcDatabase=mdb,cn=config
+objectClass: olcDatabaseConfig
+objectClass: olcMdbConfig
+olcDatabase: mdb
+olcDbDirectory: /var/lib/ldap
+olcSuffix: dc=angelsofclockwork,dc=net
+olcRootDN: cn=manager,dc=angelsofclockwork,dc=net
+olcRootPW: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+   
+olcDbIndex: objectClass eq,pres
+olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
+olcLastMod: TRUE
+olcDbEnvFlags: nometasync
+olcDbEnvFlags: writemap
+olcDbMaxSize: 21474836480
+
+

Now, below we have our primary modification ldif. Comments describe what +each one does.

+
# Sets our cert path and information
+# The "CertificateFile" has to be set to the hostname of the LDAP server
+dn: cn=config
+changetype: modify
+replace: olcTLSCACertificatePath
+olcTLSCACertificatePath: /etc/pki/ldap
+-
+replace: olcTLSCertificateFile
+olcTLSCertificateFile: zera1.angelsofclockwork.net
+-
+replace: olcTLSCertificateKeyFile
+olcTLSCertificateKeyFile: /etc/pki/ldap/ldapserver.key
+
+# Adding a rootDN for the config.
+# Note that this isn't fully necessary as you can use -Y EXTERNAL -H ldapi:/// instead
+# So, treat this as an optional thing. If you do want it, consider a different password.
+dn: olcDatabase={0}config,cn=config
+changetype: modify
+replace: olcRootDN
+olcRootDN: cn=config
+-
+replace: olcRootPW
+olcRootPW: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+
+
+# Set the password again in the mdb database
+# This is because sometimes the password set when making the database doesn't 'work' sometimes
+dn: olcDatabase={2}mdb,cn=config
+changetype: modify
+replace: olcRootPW
+olcRootPW: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+ 
+
+# Sets the default password hash to SSHA -- Refer to the 'bug' information if this does not work
+dn: olcDatabase={-1}frontend,cn=config
+changetype: modify
+replace: olcPasswordHash
+olcPasswordHash: {SSHA}
+
+# Changes the rootdn information in the monitor database
+dn: olcDatabase={1}monitor,cn=config
+changetype: modify
+replace: olcAccess
+olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=manager,dc=angelsofclockwork,dc=net" read by * none 
+
+

Let's make sure we turn on ldaps. It's recommended to use TLS, but +some applications insist on SSL. (Very few, but they are out there.)

+
# vi /etc/sysconfig/slapd
+
+. . .
+SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"
+
+# slaptest -u
+Config file testing succeeded
+
+# /etc/openldap/ldap.conf
+. . .
+TLS_CACERTDIR /etc/pki/ldap
+
+

Now, we need to add our LDIFs into LDAP.

+
rm -f /etc/openldap/slapd.d/cn=config/olcDatabase=\{2\}hdb.ldif
+chown -R ldap:ldap /var/lib/ldap
+systemctl enable slapd
+systemctl start slapd
+ldapadd -Y EXTERNAL -H ldapi:/// -f suffix.ldif
+ldapmodify -Y EXTERNAL -H ldapi:/// -f info.ldif
+
+

You may end up getting a checksum error in your logs. To solve this, you +need to do a simple operation against the configuration.

+
ldapmodify -h localhost -xWD "cn=config"
+Enter LDAP Password:
+dn: olcDatabase={0}config,cn=config
+changetype: modify
+replace: olcRootDN
+olcRootDN: cn=config
+modifying entry "olcDatabase={0}config,cn=config"
+slaptest -u
+config file testing succeeded
+
+

That should do it. You can do a -Y EXTERNAL -H ldapi:/// instead if you +wanted to. I did the above to show passwords will work for config.

+

LDAP Structure

+

The next piece is to get our backend structure built. In EL7, core is +the only schema that is there. In EL6, it's a good chunk of these. I +like to put them in a file so I can loop through them.

+
+

Note

+

ppolicy schema

+

As of OpenLDAP 2.6.x, the ppolicy schema no longer applies as it is +built-in to the slapo-ppolicy module. See the upgrade +document +for information.

+
+
/etc/openldap/schema/corba.ldif
+/etc/openldap/schema/cosine.ldif
+/etc/openldap/schema/duaconf.ldif
+/etc/openldap/schema/dyngroup.ldif
+/etc/openldap/schema/inetorgperson.ldif
+/etc/openldap/schema/java.ldif
+/etc/openldap/schema/misc.ldif
+/etc/openldap/schema/nis.ldif
+/etc/openldap/schema/openldap.ldif
+/etc/openldap/schema/collective.ldif 
+
+
+

Note

+

rfc2307

+

If you want to be able to combine groupOfNames and posixGroup together +(similar to Active Directory, other open source, and commercial +offerings), don't use nis. Use the +rfc2307bis +schema instead.

+
+

Once you have your list of schema to put in, we can loop through them.

+
for x in $(cat schemaorder) ; do ldapadd -Y EXTERNAL -H ldapi:/// -f $x ; done
+adding new entry "cn=corba,cn=schema,cn=config"
+adding new entry "cn=cosine,cn=schema,cn=config"
+adding new entry "cn=duaconf,cn=schema,cn=config"
+adding new entry "cn=dyngroup,cn=schema,cn=config"
+adding new entry "cn=inetorgperson,cn=schema,cn=config"
+adding new entry "cn=java,cn=schema,cn=config"
+adding new entry "cn=misc,cn=schema,cn=config"
+adding new entry "cn=nis,cn=schema,cn=config"
+adding new entry "cn=openldap,cn=schema,cn=config"
+adding new entry "cn=collective,cn=schema,cn=config"
+
+

I normally like to keep all LDIFs in a folder by themselves to avoid +clutter (non-configuration LDIF).

+
mkdir ldif ; cd ldif
+
+

Let's get our base created. Make sure to replace my DN with your DN +that you chose earlier. Call this base.ldif.

+
dn: dc=angelsofclockwork,dc=net
+dc: angelsofclockwork
+objectClass: top
+objectClass: domain
+
+dn: ou=People,dc=angelsofclockwork,dc=net
+ou: People
+objectClass: top
+objectClass: organizationalUnit
+
+dn: ou=Group,dc=angelsofclockwork,dc=net
+ou: Group
+objectClass: top
+objectClass: organizationalUnit
+
+
ldapadd -xWD "cn=manager,dc=angelsofclockwork,dc=net" -f base.ldif
+Enter LDAP Password:
+adding new entry "dc=angelsofclockwork,dc=net"
+adding new entry "ou=People,dc=angelsofclockwork,dc=net"
+adding new entry "ou=Group,dc=angelsofclockwork,dc=net"
+
+

If this doesn't add, make sure your LDAP server is running, check +/var/log/messages, and ensure you've completed all steps before this.

+
ldapsearch -x -LLL -b 'dc=angelsofclockwork,dc=net'
+dn: dc=angelsofclockwork,dc=net
+dc: angelsofclockwork
+objectClass: top
+objectClass: domain
+
+dn: ou=People,dc=angelsofclockwork,dc=net
+ou: People
+objectClass: top
+objectClass: organizationalUnit
+
+dn: ou=Group,dc=angelsofclockwork,dc=net
+ou: Group
+objectClass: top
+objectClass: organizationalUnit
+
+

Add Users via Migration

+
+

Note

+

But... I don't want to add my users locally

+

You don't have to add your users locally to the system. This just aids +in the creation of users. Go to the next section if you want to add +users and do permissions by hand.

+
+

This is the fun part. We'll need to add some users, set some passwords +and migrate them into the LDAP system. I'll make three users as an +example, give them an ID starting at 10000, home directories in /lhome, +set a password, and proceed to migrate them. If you don't want to use +/lhome, keep them set to /home and their home directories should get +created automatically when logging into another machine.

+
# mkdir /lhome
+# mkdir ldif/user
+# semanage fcontext -a -t home_root_t "/lhome(/.*)?"
+# restorecon -v /lhome \
+  restorecon reset /lhome context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:home_root_t:s0
+# groupadd -g 10000 sokel
+# groupadd -g 10001 suree
+# groupadd -g 10002 ranos
+# useradd -u 10000 -g 10000 -d /lhome/sokel sokel
+# useradd -u 10001 -g 10001 -d /lhome/suree suree
+# useradd -u 10002 -g 10002 -d /lhome/ranos ranos
+# passwd sokel ; passwd suree ; passwd ranos
+# cat /etc/passwd | grep sokel > ldif/user/passwd.sokel
+# cat /etc/passwd | grep suree > ldif/user/passwd.suree
+# cat /etc/passwd | grep ranos > ldif/user/passwd.ranos
+# cat /etc/group | grep sokel > ldif/user/group.sokel
+# cat /etc/group | grep suree > ldif/user/group.suree
+# cat /etc/group | grep ranos > ldif/user/group.ranos
+
+

We'll set some aliases for our migration scripts too

+
# alias miguser='/usr/share/migrationtools/migrate_passwd.pl'
+# alias miggroup='/usr/share/migrationtools/migrate_group.pl'
+
+

Before we continue, we need to modify our migration scripts. This is +extremely important, otherwise our LDIFs will come out incorrect. Change +them to your DN.

+
# sed -i.bak "s/padl.com/angelsofclockwork.net/g" /usr/share/migrationtools/migrate_common.ph
+# sed -i.bak "s/padl,dc=com/angelsofclockwork,dc=net/g" /usr/share/migrationtools/migrate_common.ph
+
+

Now we can use a loop to convert them. You can do it by hand also, but +that's up to you.

+
# for x in sokel suree ranos ; do miguser ldif/user/passwd.$x > ldif/user/$x.ldif ; done
+# for x in sokel suree ranos ; do miggroup ldif/user/group.$x >> ldif/user/$x.ldif ; done
+# cd ldif/user/
+# cat *.ldif >> /tmp/ourusers.ldif
+# ldapadd -xWD "cn=manager,dc=angelsofclockwork,dc=net" -f /tmp/ourusers.ldif
+Enter LDAP Password:
+adding new entry "uid=ranos,ou=People,dc=angelsofclockwork,dc=net"
+
+adding new entry "cn=ranos,ou=Group,dc=angelsofclockwork,dc=net"
+
+adding new entry "uid=sokel,ou=People,dc=angelsofclockwork,dc=net"
+
+adding new entry "cn=sokel,ou=Group,dc=angelsofclockwork,dc=net"
+
+adding new entry "uid=suree,ou=People,dc=angelsofclockwork,dc=net"
+
+adding new entry "cn=suree,ou=Group,dc=angelsofclockwork,dc=net"
+
+

The manual way.

+
# /usr/share/migrationtools/migrate_passwd.pl ldif/user/passwd.sokel > ldif/user/sokel.ldif 
+# /usr/share/migrationtools/migrate_group.pl ldif/user/group.sokel >> ldif/user/sokel.ldif
+# /usr/share/migrationtools/migrate_passwd.pl ldif/user/passwd.suree > ldif/user/suree.ldif 
+# /usr/share/migrationtools/migrate_group.pl ldif/user/group.suree >> ldif/user/suree.ldif
+# /usr/share/migrationtools/migrate_passwd.pl ldif/user/passwd.ranos > ldif/user/ranos.ldif 
+# /usr/share/migrationtools/migrate_group.pl ldif/user/group.ranos >> ldif/user/ranos.ldif
+
+# cd ldif/user/
+# ls
+group.ranos  group.suree   passwd.sokel  ranos.ldif  suree.ldif
+group.sokel  passwd.ranos  passwd.suree  sokel.ldif
+
+# ldapadd -xWD "cn=manager,dc=angelsofclockwork,dc=net" -f sokel.ldif
+Enter LDAP Password:
+adding new entry "uid=sokel,ou=People,dc=angelsofclockwork,dc=net"
+
+adding new entry "cn=sokel,ou=Group,dc=angelsofclockwork,dc=net"
+
+# ldapadd -xWD "cn=manager,dc=angelsofclockwork,dc=net" -f suree.ldif
+Enter LDAP Password:
+adding new entry "uid=suree,ou=People,dc=angelsofclockwork,dc=net"
+
+adding new entry "cn=suree,ou=Group,dc=angelsofclockwork,dc=net"
+
+# ldapadd -xWD "cn=manager,dc=angelsofclockwork,dc=net" -f ranos.ldif
+Enter LDAP Password:
+adding new entry "uid=ranos,ou=People,dc=angelsofclockwork,dc=net"
+
+adding new entry "cn=ranos,ou=Group,dc=angelsofclockwork,dc=net"
+
+

Add Users via LDIF

+

This is for those who don't want to create the account locally. For +each user, you need to create an LDIF that satisfies their account +information such as UID, GID and their group information. If you plan on +having NFS exports to /lhome, make sure homeDirectory is correctly +pointing as such. Otherwise, keep it as /home/username.

+
dn: uid=zera,ou=People,dc=angelsofclockwork,dc=net
+objectClass: posixAccount
+objectClass: top
+objectClass: shadowAccount
+objectClass: inetOrgPerson
+cn: Zera Nalika
+gidNumber: 11000
+sn: Nalika
+uidNumber: 11000
+givenName: Zera
+uid: zera
+loginShell: /bin/bash
+homeDirectory: /home/zera
+displayName: Zera Nalika
+userPassword: changeme2
+
+dn: cn=zera,ou=Group,dc=angelsofclockwork,dc=net
+objectClass: posixGroup
+objectClass: top
+cn: zera
+gidNumber: 11000
+
+

That's about it for that. You create these for each user as needed and +then add them into ldap.

+
# ldapadd -xWD "cn=manager,dc=angelsofclockwork,dc=net" -f zera.ldif
+adding new entry "uid=zera,ou=People,dc=angelsofclockwork,dc=net"
+
+adding new entry "cn=zera,ou=Group,dc=angelsofclockwork,dc=net"
+
+

For users who are doing the /lhome thing, make their directories. When +you are changing ownership, do it by UID and GID number.

+
# mkdir /lhome
+# semanage fcontext -a -t home_root_t "/lhome(/.*)?"
+# mkdir /lhome/zera
+# cp /etc/skel/.* /lhome/zera
+# chown -R 11000:11000 /lhome/zera
+# restorecon -Rv /lhome
+
+

NFS Export Home Directories

+
+

Warning

+

/home vs /lhome

+

If you used /lhome and you want to use NFS mounts, you may continue +here. Otherwise, skip this section entirely. If you use /home and still +want to do NFS, you will need to do persistent NFS to say /export/home, +and then setup AutoFS to use /export/home as a way to automount into +/home.

+
+
+

Warning

+

Potential Pitfall

+

Do NOT use NFSv3. The steps below show how to prevent user squashing to +allow the user to have access to their home directories. Typically, in +an NFSv4 fashion, it tends to mount it with permissions set to nobody. +Other solutions have been to force NFSv3. This is NOT recommended. +YOU HAVE BEEN WARNED.

+
+

First, we'll need to install nfs-utils, set up our exports, and modify +our id map file.

+
# dnf install nfs-utils libnfsidmap -y
+
+# vi /etc/exports
+/lhome *(rw,sync,root_squash,no_all_squash)
+
+# vi /etc/idmapd.conf
+
+# Comment out the first Domain line and make your own
+Domain = zera1.angelsofclockwork.net
+
+# systemctl start nfs-server
+# systemctl enable nfs-server
+
+

Sometimes you'll still run into the nobody problem. Sometimes this +helps.

+
# vi /etc/sysconfig/nfs
+NEED_IDMAPD=yes
+NFSMAPID_DOMAIN=library.angelsofclockwork.net
+
+

Firewall

+
+

Warning

+

Keep your firewall on

+

It is bad practice to turn your firewall off. Don't do it.

+
+

We need to open up our firewall.

+
+

Note

+

Port Reference

+
    +
  • LDAP Ports: 389/tcp 636/tcp
    • +
  • NFS Ports: 111/tcp 111/udp 2049/tcp
    • +
+
+

If using firewalld, you can add these ports by service.

+
# firewall-cmd --add-service=ldap --zone=public --permanent
+# firewall-cmd --add-service=ldaps --zone=public --permanent
+# firewall-cmd --add-service=nfs --zone=public --permanent
+# firewall-cmd --reload
+
+

Client

+

Setting up the client can be straight-forward or troubling, depending on +the distribution you're using. We'll be going over EL7+. Fedora also +works here as well.

+
+

Warning

+

Third-party Repositories

+

If you use third-party repositories, you may want to disable them, at +least temporarily. Depending on the repository, there may be conflicts +when installing the appropriate packages. You may want to consider on +setting up priorities, and ensure your base and updates are higher than +the rest.

+
+

Enterprise Linux/Current Fedora Releases

+

We'll be using SSSD for this. We need to install some key packages +first. Some of these packages may not install because they were either +superceded or obsoleted.

+
# yum install pki-{ca,common,silent} openldap-clients nss-pam-ldapd policycoreutils-python sssd sssd-common sssd-client sssd-ldap
+
+

Use authselect to configure pam and nss. You'll need to configure +/etc/sssd/sssd.conf by hand after.

+
# authselect select sssd with-mkhomedir with-sudo
+
+# vi /etc/sssd/sssd.conf
+[domain/default]
+
+cache_credentials = True
+krb5_realm = #
+ldap_search_base = dc=angelsofclockwork,dc=net
+id_provider = ldap
+auth_provider = ldap
+chpass_provider = ldap
+sudo_provider = ldap
+ldap_uri = ldap://zera1.angelsofclockwork.net
+ldap_id_use_start_tls = True
+ldap_tls_cacertdir = /etc/openldap/certs
+ldap_tls_cacert = /etc/openldap/certs/ca.pem
+# Add the below
+ldap_sudo_search_base = ou=SUDOers,dc=angelsofclockwork,dc=net
+
+[sssd]
+# Modify this line and add sudo to the list
+services = nss, pam, autofs, sudo
+
+[sudo]
+
+

Now, let's get our CA cert that we made way long ago and download it. +If you used a real CA to sign your certificate, obtain their +certificate.

+
+

Note

+

Hash

+

Remember your hash from when you were making your certificates? You need +to obtain it. In both examples, we created it while using a symbolic +link.

+
+
# scp zera1.angelsofclockwork.net:/etc/pki/ldap/ca.pem /etc/openldap/certs/ca.pem
+# cd /etc/openldap/certs
+# ln -s ca.pem 39642ab3.0
+
+

Now, modify /etc/openldap/ldap.conf and add the following to the bottom, +ensuring your BASE is set correctly.

+
URI ldap://library.angelsofclockwork.net
+BASE dc=angelsofclockwork,dc=net
+ssl start_tls
+
+

You can attempt an ldapsearch and it should work. Search for one of your +users.

+
# ldapsearch -x -LLL uid=zera
+
+dn: uid=zera,ou=People,dc=angelsofclockwork,dc=net
+cn: Zera Nalika
+gidNumber: 11000
+uidNumber: 11000
+givenName: Zera
+objectClass: posixAccount
+objectClass: top
+objectClass: shadowAccount
+objectClass: hostObject
+objectClass: radiusprofile
+objectClass: inetOrgPerson
+objectClass: ldapPublicKey
+uid: zera
+loginShell: /bin/bash
+homeDirectory: /lhome/zera
+displayName: Zera Nalika
+
+

Automounting Home Directories

+

If you chose to do /lhome NFS mounting, proceed here.

+
# mkdir /lhome
+# semanage fcontext -a -t autofs_t "/lhome(/.*)?"
+# restorecon -v /lhome
+# setsebool use_nfs_home_dirs 1
+
+

Now, let's get our automounting setup.

+
# vi /etc/auto.master
+. . .
+/lhome /etc/auto.lhome # Add this under the /misc line
+
+

Let's copy the misc template and make a change to it.

+
# cp /etc/auto.misc /etc/auto.lhome
+# vi /etc/auto.lhome
+
+# Comment the cd line, and add our mount under it.
+#cd             -fstype=iso9660,ro,nosuid,nodev :/dev/cdrom
+*               -rw,soft,intr       zera1.angelsofclockwork.net:/lhome/&
+
+# restorecon -v /etc/auto.lhome
+# systemctl enable autofs
+# systemctl start autofs
+
+

Let's make our change to the idmapd configuration.

+
# vi /etc/idmapd.conf
+
+#Domain = local.domain.edu
+Domain = zera1.angelsofclockwork.net
+
+# systemctl restart sssd autofs
+
+

LDAP Structure Add-ons

+

Here you'll find my value-added portions of getting LDAP going further +than what the above presented.

+

SUDO

+

Getting SUDO to work in LDAP can be a real pain. It doesn't have to be.

+

The default sudo schema provided by the LDAP packages, which I have +taken and converted into the proper olc format.

+
dn: cn=sudo,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: sudo
+olcAttributeTypes: {0}( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s)
+ who may  run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMa
+ tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {1}( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s)
+ who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMat
+ ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+olcAttributeTypes: {2}( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Comma
+ nd(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1
+ 466.115.121.1.26 )
+olcAttributeTypes: {3}( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s)
+  impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1
+ .4.1.1466.115.121.1.26 )
+olcAttributeTypes: {4}( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Option
+ s(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115
+ .121.1.26 )
+olcAttributeTypes: {5}( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'Use
+ r(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466
+ .115.121.1.26 )
+olcAttributeTypes: {6}( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Gr
+ oup(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.14
+ 66.115.121.1.26 )
+olcAttributeTypes: {7}( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'Sta
+ rt of time interval for which the entry is valid' EQUALITY generalizedTimeMat
+ ch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+  )
+olcAttributeTypes: {8}( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'End
+ of time interval for which the entry is valid' EQUALITY generalizedTimeMatch
+ ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
+olcAttributeTypes: {9}( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an int
+ eger to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrd
+ eringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+olcObjectClasses: {0}( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'Sudoer En
+ tries' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand $ s
+ udoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoOrder $ sudoNotB
+ efore $ sudoNotAfter $ description ) )
+
+

Save this as sudoschema.ldif and add it in.

+
# ldapadd -Y EXTERNAL -H ldapi:/// -f sudoschema.ldif
+
+

Let's create our defaults. This will start our sudo OU and give it some +defaults. You may change these if you so desire.

+
# vi sudo.ldif
+
+dn: ou=SUDOers,dc=angelsofclockwork,dc=net
+objectClass: top
+objectClass: organizationalUnit
+ou: SUDOers
+
+dn: cn=defaults,ou=SUDOers,dc=angelsofclockwork,dc=net
+objectClass: top
+objectClass: sudoRole
+cn: defaults
+description: SUDOers Default values
+sudoOption: requiretty
+sudoOption: env_reset
+sudoOption: env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
+sudoOption: env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
+sudoOption: env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
+sudoOption: env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
+sudoOption: env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
+
+# ldapadd -xWD "cn=manager,dc=angelsofclockwork,dc=net" -f sudo.ldif
+
+

Now, let's create our first SUDO container. It will be for our +\"admins\". We could specify \"sudoHost: ALL\" if we wanted. But for the +example, I chose a couple of hosts.

+
# vi admins.ldif
+
+dn: cn=ADMINS,ou=SUDOers,dc=angelsofclockwork,dc=net
+objectClass: sudoRole
+cn: ADMINS
+description: Administration Role
+sudoCommand: ALL
+sudoHost: zera2.angelsofclockwork.net
+sudoHost: zera3.angelsofclockwork.net
+sudoRunAs: ALL
+sudoRunAsGroup: ALL
+sudoRunAsUser: ALL
+sudoUser: zera
+
+# ldapadd -xWD "cn=manager,dc=angelsofclockwork,dc=net" -f admins.ldif
+
+

If you used authselect with the with-sudo option, this should have +turned on sss for sudoers. You may want to verify /etc/nsswitch.conf +just to be sure.

+
+

Note

+

SSSD Cache

+

Sometimes SSSD likes to cache things or never update things for whatever +reason or another. To get around this, stop sssd, delete everything +under /var/lib/sss/db/ and then start sssd again.

+
+

Now, let's test.

+
[root@zera3 ~]# su - zera
+[zera@zera3 ~]$ sudo -l
+[sudo] password for zera:
+Matching Defaults entries for zera on this host:
+    requiretty, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL
+    PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT
+    LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL
+    LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, env_reset, requiretty
+
+User sokel may run the following commands on this host:
+    (ALL : ALL) ALL
+
+

Member Groups

+

Member groups are extremely useful, especially for when you're granting +permissions to external applications (and SSSD if you wish).

+
# vi modules.ldif
+
+dn: cn=module,cn=config
+objectClass: olcModuleList
+cn: module
+olcModulePath: /usr/lib64/openldap
+olcModuleLoad: memberof.la
+
+# vi memberof.ldif
+
+dn: olcOverlay=memberof,olcDatabase={2}mdb,cn=config
+objectClass: olcMemberOf
+objectClass: olcOverlayConfig
+objectClass: olcConfig
+objectClass: top
+olcOverlay: memberof
+olcMemberOfDangling: ignore
+olcMemberOfRefInt: TRUE
+olcMemberOfGroupOC: groupOfNames
+olcMemberOfMemberAD: member
+olcMemberOfMemberOfAD: memberOf
+
+# ldapadd -Y EXTERNAL -H ldapi:/// -f modules.ldif
+# ldapadd -Y EXTERNAL -H ldapI:/// -f memberof.ldif
+
+

After that, we can now create our groups. Example.

+
dn: cn=Admins,ou=Group,dc=angelsofclockwork,dc=net
+objectClass: groupOfNames
+cn: Admins
+member: uid=chris,ou=People,dc=angelsofclockwork,dc=net
+member: uid=zera,ou=People,dc=angelsofclockwork,dc=net
+member: uid=sithlord,ou=People,dc=angelsofclockwork,dc=net
+
+

In SSSD, we can make some minor changes.

+
ldap_search_base = dc=angelsofclockwork,dc=net?sub?|(memberOf=cn=Admins,ou=Group,dc=angelsofclockwork,dc=net)
+ldap_access_filter = (|(memberOf=cn=Admins,ou=Group,dc=angelsofclockwork,dc=net))
+# Change this to rfc2307 if you are using nis
+ldap_schema = rfc2307bis 
+enumerate = True
+
+# systemctl stop sssd ; rm -rf /var/lib/sss/db/* ; systemctl start sssd
+
+

If we were to do an ldapsearch, we can see the groups show up.

+
# ldapsearch -x -LLL uid=zera memberOf
+dn: uid=zera,ou=People,dc=angelsofclockwork,dc=net
+memberOf: cn=Admins,ou=Group,dc=angelsofclockwork,dc=net
+
+

Make sure you turn on referential integrity!

+

Referential Integrity

+

Having referential integrity is absolutely important. It basically means +that if a user gets deleted, their group membership disappears also. +This prevents you from having to clean up manually.

+
# vi module.ldif
+
+dn: cn=module,cn=config
+changetype: modify
+replace: olcModuleLoad
+olcModuleLoad: refint.la
+olcModuleLoad: memberof.la
+
+# ldapmodify -Y EXTERNAL -H ldapi:/// -f module.ldif
+
+

You also need the overlay. An overlay allows certain plugins to work on +a DIT.

+
# vi overlay.ldif
+dn: olcOverlay=refint,olcDatabase={2}mdb,cn=config
+objectClass: olcOverlayConfig
+objectClass: olcConfig
+objectClass: olcRefintConfig
+objectClass: top
+olcOverlay: refint
+olcRefintAttribute: memberOf member manager
+
+# ldapmodify -Y EXTERNAL -H ldapi:/// -f overlay.ldif
+
+

ACL

+

An ACL (Access Control List) allows permissions to be given to those in +the LDAP tree. The problem with a default LDAP setup is that, attributes +like userPassword show up in an ldapsearch. This gives little +protection. So, to get around this issue, we have to create ACLs.

+
+

Note

+

The Manager's Rights

+

The manager has all rights to the DIT. In previous implementations, I +have put him in access controls as a reference and would put \"write\" +as his access. This isn't needed, but it doesn't hurt to have it.

+
+

This ldif creates an ACL that allows the Admins group to do anything +they want on the DIT (similar to manager). This also prevents anonymous +searches from pulling up a user's password.

+
# vi acl.ldif
+
+dn: olcDatabase={2}mdb,cn=config
+changetype: modify
+replace: olcAccess
+olcAccess: {0}to attrs=userPassword,shadowLastChange by group.exact="cn=Admins,ou=Group,dc=angelsofclockwork,dc=net" write by anonymous auth by self write by * none break
+olcAccess: {2}to * by group.exact="cn=Admins,ou=Group,dc=angelsofclockwork,dc=net" write by * read
+olcAccess: {3}to dn.base="" by * read
+
+# ldapmodify -Y EXTERNAL -H ldapi:/// -f acl.ldif
+
+

It's highly recommended, however, to disable anonymous searching, +especially if you go production with LDAP. A lot of LDAP implementations +disallow anonymous searching by default. You can do this with ACLs, but +it's not recommended. We cover this in the search.

+

Disable Anonymous Binding

+

It's recommended to disable anonymous searching. This can be handled by +making a modification to the global configuration and the DIT +configuration.

+
dn: cn=config
+changetype: modify
+add: olcDisallows
+olcDisallows: bind_anon
+
+dn: olcDatabase={2}mdb,cn=config
+changetype: modify
+add: olcRequires
+olcRequires: authc
+
+

Once you add this in, all anonymous searching will cease.

+
# ldapsearch -x -LLL uid=zera
+ldap_bind: Inappropriate authentication (48)
+        additional info: anonymous bind disallowed
+
+

LDAP Logging

+

Logging is of course, very important for an LDAP server. There are a few +types of logs we can do. There are the standard logs and then there are +also audit logs. Audit logs allow an administrator to view changes being +done to LDAP in an LDIF form. We can setup both.

+

Let's create our modification LDIF. This will turn on standard logging +and enable the audit module. Run an ldapmodify against this LDIF.

+
dn: cn=config
+changetype: modify
+replace: olcLogFile
+olcLogFile: /var/log/ldap-standard.log
+-
+replace: olcLogLevel
+olcLogLevel: 256
+
+# Keep in mind, if you have other modules being loaded,
+# add them to the list
+dn: cn=module,cn=config
+changetype: modify
+replace: olcModuleLoad
+olcModuleLoad: refint.la
+olcModuleLoad: memberof.la
+olcModuleLoad: auditlog.la
+
+

Now, we need to make sure audit logging is done on our database.

+
dn: olcOverlay=auditlog,olcDatabase={2}mdb,cn=config
+objectClass: olcAuditlogConfig
+objectClass: olcOverlayConfig
+olcOverlay: auditlog
+olcAuditlogFile: /var/log/ldap-audit.log
+
+

It's recommended to have logrotate working for our logs. Here is a file +I've dropped into /etc/logrotate.d. Experiment with these options. +Since I work in an environment that has tons of transactions going all +the time, and thus, my rotations are at 100M and 250M respectively.

+
/var/log/ldap-standard.log {
+missingok
+compress
+notifempty
+daily
+rotate 10
+size=100M
+}
+
+/var/log/ldap-audit.log {
+missingok
+compress
+notifempty
+daily
+rotate 10
+size=250M
+}
+
+

In /etc/rsyslog.conf, optionally, you can create this. If you find that +logs are not appearing after the changes above, use this.

+
local4.*                   /var/log/ldap.log
+
+

Password Policy

+

Password policies are a great asset, especially when working in an +environment that have or require security policies. First, let's load +our module and then add our overlay. This LDIF will do both. You may +want to remove the comments before adding.

+
dn: cn=module,cn=config
+changetype: modify
+replace: olcModuleLoad
+olcModuleLoad: refint.la
+olcModuleLoad: memberof.la
+olcModuleLoad: auditlog.la
+olcModuleLoad: ppolicy.la
+
+dn: olcOverlay=ppolicy,olcDatabase={2}mdb,cn=config
+objectClass: olcOverlayConfig
+objectClass: olcPPolicyConfig
+olcOverlay: ppolicy
+olcPPolicyDefault: cn=default,ou=policies,dc=angelsofclockwork,dc=net
+# Set the below to TRUE if you want users to get locked out after failed attempted
+olcPPolicyUseLockout: TRUE
+# Set the below to TRUE if you want passwords to be hashed.
+# HIGHLY RECOMMENDED YOU SET THIS TO TRUE
+olcPPolicyHashCleartext: TRUE
+
+

Now, we need an LDIF to create our standard password policy. It's +important to have a default password policy and then create separate +ones as needed. Make sure to read the comments. You may want to remove +the comments before adding.

+
dn: cn=default,ou=policies,dc=angelsofclockwork,dc=net
+objectClass: pwdPolicy
+objectClass: person
+objectClass: top
+cn: passwordDefault
+sn: passwordDefault
+pwdAttribute: userPassword
+# If set to 0, quality is not checked.
+# If set to 1, quality is checked by an internal module which you setup.
+# If set to 2, the system used to change the password must have a checking mechanism.
+# Pick your poison.
+pwdCheckQuality: 0
+# Password lives for 84 days
+pwdMinAge: 0
+pwdMaxAge: 7257600
+# Minimum length is 7
+pwdMinLength: 7
+# Password history of 10, cannot use a password that's in history
+pwdInHistory: 10
+# 5 Failures till a lockout, 10 minutes for it to reset, 30 minute lockout.
+pwdMaxFailure: 5
+pwdFailureCountInterval: 600
+pwdLockout: TRUE
+pwdLockoutDuration: 1800
+# A user can change their own password.
+pwdAllowUserChange: TRUE
+# Systems that authenticate to LDAP can warn 14 days before an expiration
+pwdExpireWarning: 1209600
+# Allowed binds on an expired password.
+pwdGraceAuthNLimit: 5
+pwdMustChange: TRUE
+pwdSafeModify: FALSE
+
+

In the instance you want to use the built-in module for password +checking, your LDIF would have these lines.

+
pwdCheckQuality: 1
+pwdCheckModule: check_password.so
+
+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + + diff --git a/el/pxeboot/index.html b/el/pxeboot/index.html new file mode 100644 index 00000000..d9e953f0 --- /dev/null +++ b/el/pxeboot/index.html @@ -0,0 +1,839 @@ + + + + + + + + + + + PXE (with grub2) - Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

This page goes over setting up a pxeboot system using tftp on Enterprise +Linux or Fedora

+

Requirements

+

Here are the list of requirements below.

+
    +
  • Enterprise Linux 8, 9, or Fedora
    • +
  • A DHCP server setup that allows you to setup the next_server directive or setup the tftp server location
    • +
  • Optionally if you are using a local mirror, httpd or nginx installed. (This guide assumes httpd)
    • +
+

Tutorial Preface, Notes, and Recommendations

+

In some environments, it may be better (or easier, depending on your +perspective) to setup a PXE server and roll out systems in a lab or +otherwise in that fashion. It's one of the most straight forward ways +to build out systems easily and consistently. The difference between a +typical PXE setup and this is we're using grub2 menus, rather than the +classic menu style. This makes it simpler to keep all configurations +consistent between classic boot and EFI boot.

+

If you plan on using supporting other architectures, it will be easier +to use that architecture to run the grub2-mknetdir command and brings +those to your tftp server.

+

Cobbler

+

While cobbler is a perfectly viable solution to setting up a pxeboot +system for various distros and configurations, it is out of scope for +this article. It is unknown if it sets up or directly supports grub2.

+

Server Setup

+

This section goes over the server setup portion for the tftp server.

+

TFTP

+

Let's install the tftpserver package plus some additional grub +packages. If you are wanting other architectures, you can obtain the +other grub2 module packages from your distribution's BaseOS or +equivalent repository for that architecture and install it manually.

+
# x86_64
+% dnf install \
+  grub2-efi-x64-modules \
+  grub2-tools-extra \
+  grub2-pc-modules \
+  shim-ia32 \              # this does not exist on el9+
+  tftp-server
+
+# aarch64
+% dnf install \
+  grub2-efi-aa64-modules \
+  grub2-tools-extra \
+  tftp-server
+
+

Let's make our initial net directories and ensure the selinux contexts +are correct.

+
% grub2-mknetdir --net-directory /var/lib/tftpboot/
+Netboot directory for i386-pc created. Configure your DHCP server to point to /srv/tftp/boot/grub2/i386-pc/core.0
+Netboot directory for x86_64-efi created. Configure your DHCP server to point to /srv/tftp/boot/grub2/x86_64-efi/core.efi
+
+% restorecon -R /var/lib/tftpboot
+
+

Now you'll need to enable the tftp socket and open the port. +Traditionally, you would use xinetd. It's no longer required for the +tftp service.

+
# Note: This is port 69 with the UDP protocol
+% firewall-cmd --add-service=tftp --permanent
+% systemctl enable tftp.socket --now
+
+

DHCP (ISC)

+

On your DHCP server configuration (typically /etc/dhcp/dhcpd.conf if +running on Fedora or EL), you should set the following options:

+
option pxe-system-type code 93 = unsigned integer 16;
+option rfc3442-classless-static-routes code 121 = array of integer 8;
+option ms-classless-static-routes code 249 = array of integer 8;
+
+option space pxelinux;
+option pxelinux.magic code 208 = string;
+option pxelinux.configfile code 209 = text;
+option pxelinux.pathprefix code 210 = text;
+option pxelinux.reboottime code 211 = unsigned integer 32;
+option architecture-type   code 93 = unsigned integer 16;
+option pxelinux.mtftp-ip    code 1 = ip-address;
+option pxelinux.mtftp-cport code 2 = unsigned integer 16;
+option pxelinux.mtftp-sport code 3 = unsigned integer 16;
+option pxelinux.mtftp-tmout code 4 = unsigned integer 8;
+option pxelinux.mtftp-delay code 5 = unsigned integer 8;
+
+

Whether this section is within a subnet block or not, it is needed to +ensure the right bootloader is called. Note that we're only loading +x86. If you are loading armhfp, use 00:0a. If you are loading aarch64, +use 00:0b.

+
class "pxeclients" {
+        match if substring (option vendor-class-identifier, 0, 9) = "PXEClient";
+        # x86_64 EFI
+        if option pxe-system-type = 00:07 {
+                filename "boot/grub2/x86_64-efi/core.efi";
+        } else if option pxe-system-type = 00:08 {
+                filename "boot/grub2/x86_64-efi/core.efi";
+        } else if option pxe-system-type = 00:09 {
+                filename "boot/grub2/x86_64-efi/core.efi";
+        } else {
+                # BIOS boot only
+                filename "boot/grub2/i386-pc/core.0";
+        }
+}
+
+

Note that in your subnet blocks, you should also mention next_server, +which should point to your TFTP server. The DHCP and TFTP server can be +on the same machine and there's nothing stopping you from doing that; +next_server needs to be set regardless here. See an example below of a +full work dhcpd.conf.

+
ddns-update-style interim;
+
+allow booting;
+allow bootp;
+authoritative;
+log-facility local6;
+
+ignore client-updates;
+set vendorclass = option vendor-class-identifier;
+
+## Allowing EFI Clients
+option pxe-system-type code 93 = unsigned integer 16;
+option rfc3442-classless-static-routes code 121 = array of integer 8;
+option ms-classless-static-routes code 249 = array of integer 8;
+
+option space pxelinux;
+option pxelinux.magic code 208 = string;
+option pxelinux.configfile code 209 = text;
+option pxelinux.pathprefix code 210 = text;
+option pxelinux.reboottime code 211 = unsigned integer 32;
+option architecture-type code 93 = unsigned integer 16;
+
+option pxelinux.mtftp-ip    code 1 = ip-address;
+option pxelinux.mtftp-cport code 2 = unsigned integer 16;
+option pxelinux.mtftp-sport code 3 = unsigned integer 16;
+option pxelinux.mtftp-tmout code 4 = unsigned integer 8;
+option pxelinux.mtftp-delay code 5 = unsigned integer 8;
+
+subnet 10.100.0.0 netmask 255.255.255.0 {
+        interface               br1000;
+        option routers          10.100.0.1;
+        option domain-name-servers      10.100.0.1, 10.100.0.231;
+        option domain-name              "angelsofclockwork.net";
+        option subnet-mask              255.255.255.0;
+        range           10.100.0.110 10.100.0.199;
+        ## EFI Client Catch
+        class "pxeclients" {
+                match if substring (option vendor-class-identifier, 0, 9) = "PXEClient";
+                if option pxe-system-type = 00:07 {
+                        filename "boot/grub2/x86_64-efi/core.efi";
+                } else if option pxe-system-type = 00:08 {
+                        filename "boot/grub2/x86_64-efi/core.efi";
+                } else if option pxe-system-type = 00:09 {
+                        filename "boot/grub2/x86_64-efi/core.efi";
+                } else if option pxe-system-type = 00:0a {
+                        filename "boot/grub2/armv7a-efi/core.efi";
+                } else if option pxe-system-type = 00:0b {
+                        filename "boot/grub2/aarch64-efi/core.efi";
+                } else {
+                        filename "boot/grub2/i386-pc/core.0";
+                }
+        }
+        default-lease-time      21600;
+        max-lease-time  43200;
+        next-server     10.100.0.1;
+}
+
+

Ensure that the dhcpd service is restarted after making the necessary +changes.

+

DHCP (Kea)

+

Kea is a different configuration style from ISC. At this time, we do not +have a full working example.

+

Web Server (httpd)

+

If we plan on hosting the installation mirror in your environment, it's +recommended to stand up a simple web server. It does not require any +kind of special configuration. We'll use the default /var/www/html/ +path. If you wish to use another such as /srv/www, you will need to +setup a virtual host (this is outside the scope of this page).

+
% dnf install httpd -y
+% systemctl enable httpd --now
+% firewall-cmd --add-service=http --permanent
+% firewall-cmd --complete-reload
+
+# create the directories for our distributions
+% mkdir -p /var/www/html/os/{fedora,centos,rocky}
+
+

Setting up Grub

+

When you run grub2-mknetdir, it created a core.* set of files. An +accompanying grub.cfg must sit next to them. To prevent a duplication of +work, it can be simplified by making all grub configurations at +/var/lib/tftpboot and then symlink them next to each directory +containing core.*. Let's make a very, very simple one.

+
set default=0
+set timeout=60
+menuentry 'EFI Firmware System Setup' $menuentry_id_option 'uefi-firmware' {
+  fwsetup
+}
+
+menuentry 'Reboot' {
+  reboot
+}
+
+menuentry 'Shutdown' {
+  halt
+}
+
+

Now let's just symlink it.

+
% cd /var/lib/tftpboot/boot/grub2/x86_64-efi
+% ln -s ../../../grub.cfg
+% cd /var/lib/tftpboot/boot/grub2/i386-pc
+% ln -s ../../../grub.cfg
+
+

This should produce a grub menu for both EFI and BIOS systems that +contain three bootable options.

+

Adding Distributions

+

Now that grub is sort of setup, we should add a distribution to it at +least. Below are a couple examples using Fedora, Rocky Linux, and CentOS +Stream.

+

Rocky Linux

+

Setting up Rocky Linux (or any other Enterprise Linux distribution) +should be straight forward. We'll download both Rocky Linux 8 and Rocky +Linux 9 and setup the menus.

+
+

Note

+

If you plan on not hosting a mirror of the base repositories, ensure +that your inst.repo/inst.stage2 commands are accurate to a mirror of +your choice.

+
+

The below assumes we are hosting a mirror of the downloaded ISO, which +will make installations quicker as it'll be confined to your network.

+
% cd /var/tmp
+# Rocky Linux 8
+% wget https://dl.rockylinux.org/pub/rocky/8/isos/x86_64/Rocky-8-latest-x86_64-dvd.iso
+# Rocky Linux 9
+% wget https://dl.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9-latest-x86_64-dvd.iso
+
+# Optionally, if you plan on supporting ARM...
+% wget https://dl.rockylinux.org/pub/rocky/8/isos/aarch64/Rocky-8-latest-aarch64-dvd.iso
+% wget https://dl.rockylinux.org/pub/rocky/9/isos/aarch64/Rocky-9-latest-aarch64-dvd.iso
+
+

Here we'll copy the data we want into the necessary directories. Any +pxeboot related images will go to /var/lib/tftpboot/rocky-X-ARCH (X +being the major version, ARCH being the architecture). If we are keeping +a local mirror of the DVD, we'll put it into +/var/www/html/os/rocky/X/ARCH. Below is for x86_64, but the same steps +can be repeated for aarch64 without any issues. Just replace x86_64 +with aarch64.

+
## Rocky 8
+% mount -o loop Rocky-8-latest-x86_64-dvd.iso /mnt
+% mkdir /var/lib/tftpboot/rocky-8-x86_64
+% cp /mnt/images/pxeboot/* /var/lib/tftpboot/rocky-8-x86_64
+% mkdir -p /var/www/html/os/rocky/8/x86_64
+% rsync -vrlptDSH --delete /mnt/ /var/www/html/os/rocky/8/x86_64
+% umount /mnt
+
+## Rocky 9
+% mount -o loop Rocky-9-latest-x86_64-dvd.iso /mnt
+% mkdir /var/lib/tftpboot/rocky-9-x86_64
+% cp /mnt/images/pxeboot/* /var/lib/tftpboot/rocky-9-x86_64
+% mkdir -p /var/www/html/os/rocky/9/x86_64
+% rsync -vrlptDSH --delete /mnt/ /var/www/html/os/rocky/9/x86_64
+% umount /mnt
+
+% restorecon -R /var/www/html/os/rocky
+
+

At this point, we'll need to setup the grub menus. We'll setup +non-kickstart examples for BIOS and UEFI.

+
. . .
+# Rocky 8
+menuentry 'Install Rocky Linux 8 (No KS) (UEFI)' --class fedora --class gnu-linux --class gnu --class os {
+  echo "Loading Rocky Linux 8 kernel..."
+  linuxefi rocky-8-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/8/x86_64 inst.stage2=http://10.100.0.1/os/rocky/8/x86_64 ip=dhcp
+  initrdefi rocky-8-x86_64/initrd.img
+}
+menuentry 'Install Rocky Linux 8 (No KS) (BIOS)' --class fedora --class gnu-linux --class gnu --class os {
+  echo "Loading Rocky Linux 8 kernel..."
+  linux16 rocky-8-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/8/x86_64 inst.stage2=http://10.100.0.1/os/rocky/8/x86_64 ip=dhcp
+  initrd16 rocky-8-x86_64/initrd.img
+}
+
+# if you are setting up arm...
+menuentry 'Install Rocky Linux 8 (No KS) (aarch64)' --class fedora --class gnu-linux --class gnu --class os {
+  echo "Loading Rocky Linux 8 kernel..."
+  linux rocky-9-aarch64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/8/aarch64 inst.stage2=http://10.100.0.1/os/rocky/8/aarch64 ip=dhcp
+  initrd rocky-9-aarch64/initrd.img
+}
+
+
. . .
+# Rocky 9
+menuentry 'Install Rocky Linux 9 (No KS) (UEFI)' --class fedora --class gnu-linux --class gnu --class os {
+  echo "Loading Rocky Linux 9 kernel..."
+  linuxefi rocky-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/9/x86_64 inst.stage2=http://10.100.0.1/os/rocky/9/x86_64 ip=dhcp
+  initrdefi rocky-9-x86_64/initrd.img
+}
+menuentry 'Install Rocky Linux 9 (No KS) (BIOS)' --class fedora --class gnu-linux --class gnu --class os {
+  echo "Loading Rocky Linux 9 kernel..."
+  linux16 rocky-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/9/x86_64 inst.stage2=http://10.100.0.1/os/rocky/9/x86_64 ip=dhcp
+  initrd16 rocky-9-x86_64/initrd.img
+}
+
+# if you are setting up arm...
+menuentry 'Install Rocky Linux 9 (No KS) (aarch64)' --class fedora --class gnu-linux --class gnu --class os {
+  echo "Loading Rocky Linux 9 kernel..."
+  linux rocky-9-aarch64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/9/aarch64 inst.stage2=http://10.100.0.1/os/rocky/9/aarch64 ip=dhcp
+  initrd rocky-9-aarch64/initrd.img
+}
+
+

The Rocky Linuxinstallation should now be bootable.

+

CentOS Stream

+

Much like Rocky Linux (or other derivatives), the path is the same for +setting it up.

+
+

Using upstream mirror path

+

If you plan on not hosting a mirror of the base repositories, ensure +that your inst.repo/inst.stage2 commands are accurate to a mirror of +your choice.

+
+
% cd /var/tmp
+# CentOS Stream 9
+% wget -O CentOS-Stream-9-latest-x86_64-dvd1.iso \
+  'https://mirrors.centos.org/mirrorlist?path=/9-stream/BaseOS/x86_64/iso/CentOS-Stream-9-latest-x86_64-dvd1.iso&redirect=1&protocol=https'
+
+# Optionally, if you plan on supporting ARM...
+% wget -O CentOS-Stream-9-latest-aarch64-dvd1.iso \
+  'https://mirrors.centos.org/mirrorlist?path=/9-stream/BaseOS/aarch64/iso/CentOS-Stream-9-latest-aarch64-dvd1.iso&redirect=1&protocol=https'
+
+

Here we'll copy the data we want into the necessary directories. Any +pxeboot related images will go to /var/lib/tftpboot/rocky-X-ARCH (X +being the major version, ARCH being the architecture). If we are keeping +a local mirror of the DVD, we'll put it into +/var/www/html/os/rocky/X/ARCH. Below is for x86_64, but the same steps +can be repeated for aarch64 without any issues. Just replace x86_64 +with aarch64.

+
## CentOS Stream 9
+% mount -o loop CentOS-Stream-9-latest-x86_64-dvd1.iso /mnt
+% mkdir /var/lib/tftpboot/centos-9-x86_64
+% cp /mnt/images/pxeboot/* /var/lib/tftpboot/centos-9-x86_64
+% mkdir -p /var/www/html/os/centos/9/x86_64
+% rsync -vrlptDSH --delete /mnt/ /var/www/html/os/centos/9/x86_64
+% restorecon -R /var/www/html/os/centos/9
+% umount /mnt}
+
+

At this point, we'll need to setup the grub menus. We'll setup +non-kickstart examples for BIOS and UEFI.

+
. . .
+# CentOS Stream 9
+menuentry 'Install CentOS Stream 9 (No KS) (UEFI)' --class fedora --class gnu-linux --class gnu --class os {
+  echo "Loading CentOS Stream 9 kernel..."
+  linuxefi centos-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/centos/9/x86_64 inst.stage2=http://10.100.0.1/os/centos/9/x86_64 ip=dhcp
+  initrdefi centos-9-x86_64/initrd.img
+}
+menuentry 'Install CentOS Stream 9 (No KS) (BIOS)' --class fedora --class gnu-linux --class gnu --class os {
+  echo "Loading CentOS Stream 9 kernel..."
+  linux16 centos-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/centos/9/x86_64 inst.stage2=http://10.100.0.1/os/centos/9/x86_64 ip=dhcp
+  initrd16 centos-9-x86_64/initrd.img
+}
+
+# if you are setting up arm...
+menuentry 'Install CentOS Stream 9 (No KS) (aarch64)' --class fedora --class gnu-linux --class gnu --class os {
+  echo "Loading CentOS Stream 9 kernel..."
+  linux centos-9-aarch64/vmlinuz inst.repo=http://10.100.0.1/os/centos/9/aarch64 inst.stage2=http://10.100.0.1/os/centos/9/aarch64 ip=dhcp
+  initrd centos-9-aarch64/initrd.img
+}
+
+

The CentOS Stream installation should now be bootable.

+

Fedora

+

Let's put up a regular installer with no kickstart for Fedora. This +does not involve pulling down any ISO's and will rely entirely on using +upstream repositories.

+
% cd /var/lib/tftpboot
+% mkdir fedora-x86_64
+% cd fedora-x86_64
+# Replace XX with the current fedora version
+% wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/x86_64/os/images/pxeboot/initrd.img
+% wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/x86_64/os/images/pxeboot/vmlinuz
+
+# If you want arm systems... aarch64
+% cd ..
+% mkdir fedora-aarch64
+# Replace XX with the current fedora version
+% wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/aarch64/os/images/pxeboot/initrd.img
+% wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/aarch64/os/images/pxeboot/vmlinuz
+
+

Now we can add a couple menu entry items for Fedora. I'm making both +EFI and Classic entries to ensure we can boot both EFI and BIOS systems +from the same menu.

+
. . .
+menuentry 'Install Fedora Linux (EFI)' --class fedora --class gnu-linux --class gnu --class os {
+  linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp
+  initrdefi fedora-x86_64/initrd.img
+}
+menuentry 'Install Fedora Linux (Classic)' --class fedora --class gnu-linux --class gnu --class os {
+  linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp
+  initrd16 fedora-x86_64/initrd.img
+}
+# Add the below for ARM systems
+menuentry 'Install Fedora Linux (ARM)' --class fedora --class gnu-linux --class gnu --class os {
+  linux fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ ip=dhcp
+  initrd fedora-aarch64/initrd.img
+}
+
+

Now the Fedora installation should be bootable.

+

Customizing Grub

+

Grub is customizable. It is possible to setup background images, choose +menu colors, setup themes, and so on.

+

Colors and Backgrounds

+

Colors and backgrounds are perfectly possible, even in an EFI setup. +We'll need to load a few modules and then set the colors and background +we want. Note that if you're using a background, it should live in +/var/lib/tftpboot to make things easier.

+
. . .
+insmod all_video
+insmod gfxterm
+insmod gfxterm_menu
+insmod gfxmenu
+insmod gfxterm_background
+insmod png
+terminal_output gfxterm
+background_image -m stretch /bg.png
+
+set menu_color_highlight=cyan/black
+set menu_color_normal=white/black
+set color_normal=white/black
+. . .
+
+

The background would be /var/lib/tftpboot/bg.png in this example. +Selected items will appear to be cyan and the typical gray selection box +is now transparent, which is done by setting it to black. Everything +else should appear as white text with a transparent background. Example +below.

+

image

+

Special Submenus

+

Submenus are easily created using submenu in the grub configuration. For +example:

+
submenu 'Fedora Linux' --class fedora --class gnu-linux --class gnu --class os {
+   set menu_color_highlight=black/light-cyan
+   set menu_color_normal=white/black
+   set color_normal=white/black
+
+   menuentry 'Install Fedora Linux (EFI)' --class fedora --class gnu-linux --class gnu --class os {
+     linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp
+     initrdefi fedora-x86_64/initrd.img
+   }
+   menuentry 'Install Fedora Linux (Classic)' --class fedora --class gnu-linux --class gnu --class os {
+     linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp
+     initrd16 fedora-x86_64/initrd.img
+   }
+   menuentry 'Install Fedora Linux (ARM)' --class fedora --class gnu-linux --class gnu --class os {
+     linux fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ ip=dhcp
+     initrd fedora-aarch64/initrd.img
+   }
+}
+
+

This now means "Fedora Linux" will show up as a menu option and it +will take you to a brand new menu with the two listed items, and another +color scheme. Note that we created color items because submenus will +reset the theme options. Example of how it looks is below.

+

grub menu example

+

It is also possible to place everything into separate source-able files. +Note that when you do this, you will need to symlink those files just +like you did with grub.cfg.

+
submenu 'Fedora Linux' --class fedora --class gnu-linux --class gnu --class os {
+  set menu_color_highlight=black/light-cyan
+  set menu_color_normal=white/black
+  set color_normal=white/black
+  source fedora.cfg
+}
+
+
menuentry 'Install Fedora Linux (EFI)' --class fedora --class gnu-linux --class gnu --class os {
+  linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp
+  initrdefi fedora-x86_64/initrd.img
+}
+menuentry 'Install Fedora Linux (Classic)' --class fedora --class gnu-linux --class gnu --class os {
+  linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp
+  initrd16 fedora-x86_64/initrd.img
+}
+menuentry 'Install Fedora Linux (ARM)' --class fedora --class gnu-linux --class gnu --class os {
+  linux fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ ip=dhcp
+  initrd fedora-aarch64/initrd.img
+}
+
+

Submenus can be nested too. Here's a deeper, working example of my own +setup using Fedora 35.

+
# grub.cfg
+set default=0
+set timeout=60
+insmod all_video
+insmod gfxterm
+insmod gfxterm_menu
+insmod gfxmenu
+insmod gfxterm_background
+insmod png
+terminal_output gfxterm
+loadfont /unicode.pf2
+background_image -m stretch /bg.png
+
+set menu_color_highlight=cyan/black
+set menu_color_normal=white/black
+set color_normal=white/black
+
+submenu 'Fedora Linux' --class fedora --class gnu-linux --class gnu --class os {
+  set menu_color_highlight=black/light-cyan
+  set menu_color_normal=white/black
+  set color_normal=white/black
+  source fedora.cfg
+}
+
+menuentry 'EFI System Setup' $menuentry_id_option 'uefi-firmware' {
+  fwsetup
+}
+
+menuentry 'Reboot' {
+  reboot
+}
+
+menuentry 'Shutdown' {
+  halt
+}
+
+# fedora.cfg
+submenu 'Fedora Linux (latest stable)' --class fedora --class gnu-linux --class gnu --class os {
+  set menu_color_highlight=black/light-cyan
+  set menu_color_normal=white/black
+  set color_normal=white/black
+
+  # EFI Only
+  submenu 'EFI Mode' --class fedora --class gnu-linux --class gnu --class os {
+    set menu_color_highlight=black/light-cyan
+    set menu_color_normal=white/black
+    set color_normal=white/black
+
+    menuentry 'Install Fedora Linux (No KS)' --class fedora --class gnu-linux --class gnu --class os {
+      linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp
+      initrdefi fedora-x86_64/initrd.img
+    }
+
+    menuentry 'Install Fedora Linux' --class fedora --class gnu-linux --class gnu --class os {
+      linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp
+      initrdefi fedora-x86_64/initrd.img
+    }
+
+    menuentry 'Fedora Linux (Rescue Mode)' --class fedora --class gnu-linux --class gnu --class os {
+      linuxefi fedora-x86_64/vmlinuz inst.rescue inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os
+      initrdefi fedora-x86_64/initrd.img
+    }
+  }
+
+  # Classic Only
+  submenu 'Classic Mode' --class fedora --class gnu-linux --class gnu --class os {
+    set menu_color_highlight=black/light-cyan
+    set menu_color_normal=white/black
+    set color_normal=white/black
+
+    menuentry 'Install Fedora Linux (No KS)' --class fedora --class gnu-linux --class gnu --class os {
+      linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp
+      initrd16 fedora-x86_64/initrd.img
+    }
+
+     menuentry 'Install Fedora Linux' --class fedora --class gnu-linux --class gnu --class os {
+      linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp
+      initrd16 fedora-x86_64/initrd.img
+    }
+
+    menuentry 'Fedora Linux (Rescue Mode)' --class fedora --class gnu-linux --class gnu --class os {
+      linux16 fedora-x86_64/vmlinuz inst.rescue inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/
+      initrd16 fedora-x86_64/initrd.img
+    }
+  }
+
+  # EFI mode for ARM
+  submenu 'EFI Mode (aarch64)' --class fedora --class gnu-linux --class gnu --class os {
+    set menu_color_highlight=black/light-cyan
+    set menu_color_normal=white/black
+    set color_normal=white/black
+
+    menuentry 'Install Fedora Linux (No KS)' --class fedora --class gnu-linux --class gnu --class os {
+      linuxefi fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os ip=dhcp
+      initrdefi fedora-aarch64/initrd.img
+    }
+
+    menuentry 'Install Fedora Linux' --class fedora --class gnu-linux --class gnu --class os {
+      linuxefi fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os ip=dhcp
+      initrdefi fedora-aarch64/initrd.img
+    }
+
+    menuentry 'Fedora Linux (Rescue Mode)' --class fedora --class gnu-linux --class gnu --class os {
+      linuxefi fedora-aarch64/vmlinuz inst.rescue inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os
+      initrdefi fedora-aarch64/initrd.img
+    }
+  }
+}
+
+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + + diff --git a/el/sysadmin/index.html b/el/sysadmin/index.html new file mode 100644 index 00000000..254db0fd --- /dev/null +++ b/el/sysadmin/index.html @@ -0,0 +1,673 @@ + + + + + + + + + + + The System Administrator Experience - Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

This write up provides steps on the System Administrator experience. +This is not an end-all, be-all, and has many variables to keep in mind. +But can provide a baseline for you.

+

Please keep in mind, this is for Red Hat based distributions, mainly +Enterprise Linux 8 and 9. CentOS Stream works within reason.

+

Also note that it will be recommended that you do things in ansible. The +RHCE for RHEL 9 will require you to be able to use ansible. As such, we +will be focusing on RHEL 9.

+

Recommendations

+
+

Note

+

Software Replacements

+
    +
  • Postgresql can be replaced with MySQL/MariaDB
    • +
  • Use Katello/Foreman, straight Pulp, or Uyuni
    • +
  • You can use any hypervisor other than KVM if you wish, with + specific caveats
    • +
  • nagios can be replaced with icinga
    • +
  • You can replace firewalld with the regular nftables service. This + may be required for your virtual host
    • +
+
+
+

Note

+

General Notes

+
    +
  • It's recommended to use colored vim syntax. Root doesn't use vim + when vim-enhanced is installed. You can make an alias for vi to run + vim (not recommended).
    • +
  • Turn on syntaxing in ~/.vimrc with syntax on
    • +
  • Make the vim colors brighter in ~/.vimrc with set background=dark
    • +
  • Export your EDITOR variable in ~/.bash_profile with export EDITOR=vim
    • +
  • Keep selinux set to enforcing
    • +
+
+
+

Note

+

Hardware Requirements

+
    +
  • RAM - Minimum: 32GB, Recommended: 64GB
    • +
  • CPU - Minimum: Intel or AMD Quad Core, Recommended: 8 Core with HyperThreading
    • +
  • Storage - Minimum: 4TB, Recommended: 8TB
    • +
  • Network - minium 1gb link recommended
    • +
+
+

Please consider on building an actual lab machine that you can do this +on.

+

Certification Completions

+

Certification guidelines will be updated later.

+

Notes and Changelog

+
+

Note

+

Post Experience Notes

+

While this write up uses KVM exclusively, you may want to enhance your +learning after the fact by setting up another virtualization platform +on your virtual host. It may require you to redesign everything or +even start over, but it is something you can consider which you like +best overall.

+
+ + + + + + + + + + + + + +
DateChanges
January 07, 2024Restructure with markdown
+

Begin

+

We'll now begin the system administrator experience. We will provide +from beginning to end, what to do, without giving away what has to be +done or has to be configured. This is on you to perform. At the end, +there is a "wiki" that you create where you will have a chance to +document everything you did. I recommend writing down or putting in a +word document what you are doing or have done throughout so it'll make +your wiki documentation much, much better.

+

Setup a KVM Hypervisor

+

Now you'll need to setup a KVM Hypervisor. You can do this on Fedora +39+ or Enterprise Linux 9. Because EL9 is a stable platform for libvirt, +I recommend using going that route. If you want the latest features for +the cost of some stability, Fedora will work for you.

+

You may want to make sure your hardware supports virtualization.

+
egrep --color 'vmx|svm' /proc/cpuinfo
+
+

Recommendations and Options

+
    +
  • +

    Create multiple datastores (storage pools where the VM images will + sit)

    +
      +
    • Example, 2x2TB means you can make two datastores, 4x1TB means + you can make four.
      • +
    +
    • +
  • +

    Attempt to use LVM as the backing for the store.

    +
      +
    • You can create a Volume Group and have the VM's live as Logical + Volumes.
      • +
    • You can create a Volume Group and have one or more partitions to + make "more" datastores
      • +
    +
    • +
  • +

    Destroy the "built in" network that libvirt already provides and + make your own

    +
      +
    • It already makes virbr0. Make your own OR modify it to not + support DHCP/DNS (eg, static only)
      • +
    +
    • +
+

Hints

+
    +
  • +

    Most of your commands will be from the following:

    +
      +
    • virsh
      • +
    • fdisk/parted
      • +
    • pvcreate & vgcreate
      • +
    • mkfs
      • +
    +
    • +
  • +

    To get the most performance out of your VM's disk wise, consider + these options:

    +
      +
    • Avoid QCOW2
      • +
    • Use virtio for the hardware whenever possible
      • +
    • Set caching to "none" for hard disks on VM's when using raw + volumes or partitions
      • +
    +
    • +
+

DHCP and DNS

+

You'll need to setup a DHCP and DNS server. You have a few choices.

+
    +
  1. Create two VM's to run DHCP for HA and create FreeIPA servers to + handle DNS (two replicas, doubles as authentication for Linux/UNIX + clients)
    2. +
  2. Create two VM's to run DHCP for HA and create two standalone BIND + servers as master/slave
    3. +
  3. Use your hypervisor to host DHCP and BIND (not recommended)
    4. +
+

It would be sensible to do "1", if you do "2", you at least get more +exposure to how zone files are created and the like. For ease of use, +we recommend choosing option 1.

+

Also, it is possible to allow cobbler handle DHCP and DNS or integrate +directly into DNS such as making changes, but this is outside the scope +of this write up.

+
+

Warning

+

Do NOT run DHCP from the FreeIPA replicas. The FreeIPA servers should +have STATIC addresses set.

+
+
+

Note

+

When you are setting up DHCP and DNS on separate servers (such as +FreeIPA replicas), the DHCP server needs to be configured to tell all +the clients the true gateway (this is either a VM in on KVM or a +hypervisor of your choice if you are doing straight KVM) and the DNS servers.

+
+

Setup a VM or your hypervisor as the gateway to the internet.

+
    +
  1. IP forwarding enabled (/etc/sysctl.conf)
    2. +
  2. NAT enabled (firewalld can help you with this, check out the zones)
    3. +
  3. A virtual interface (hypervisor) or a second interface for your + network (as a VM)
    4. +
+

When setting up DHCP and DNS:

+
    +
  1. Decide on a domain name. This can be a domain you own or one you + make up internally. I personally used one of my four domains for + this lab. RFC expects that internal networks have world routable + domains. This is up to you. Do NOT use '.local' domains
    2. +
  2. Setup DNS forwarders to ensure your VM's can get DNS requests from + the internet. You create a forwarders { } block with each outside + DNS IP listed in BIND or you can optionally set them in the + FreeIPA interface. You can list as many as you want. With a default + configuration of FreeIPA, forwarders are not strictly required. Do + NOT put these extra DNS servers in your dhcpd.conf configuration
    3. +
  3. You need two zones. Forward Zone: This is for your domain, name to + an IP. Reverse Zone: This is for reverse IP lookups, IP to a name. + FreeIPA handles this for you on setup if you state you are handling + a reverse zone and what the subnet is.
    4. +
+

Bonus Points

+
    +
  • Setup Dynamic DNS - This requires an almost specific configuration + between dhcpd and named (bind) or FreeIPA's named.
    • +
  • Dynamic DNS needs to be aware of a domain name
    • +
  • Use SSSD for the IPA clients to update their DNS automatically + (FreeIPA only) - this may not be required if dhcpd and named are + configured correctly
    • +
  • Setup an unbound service running on port 9053 that forwards to + 1.1.1.1 for encrypted DNS
    • +
+

From this point forward, you are to ensure each of your VM's that you +create have DNS entries. If you have Dynamic DNS running, you will NOT +need to do any manual changes. If using FreeIPA, you may not need to +make these changes. You can use nsupdate or the ipa equivalent to add +additional entries as needed if you are implementing static A records or +CNAME records.

+

Server and Content Management

+

At this point, you'll need to setup Foreman/Katello, Pulp, or Uyuni on +a VM. I recommend using Pulp if you want something smaller and simpler. +If you want something close to Red Hat Satellite, go through +katello. It is a combination of pulp, candlepin, foreman. This +recommendation is primarily because of Satellite 6 existing in a large +amount of Red Hat shops.

+

Katello, go here.

+
+

Note

+

Heads up

+
    +
  • You're going to be hosting repositories, I SERIOUSLY recommend + creating a VM that has at least 250GB starting and going from there. + Don't try to host Fedora.
    • +
  • Katello is resource heavy, you may need to tune it.
    • +
  • Pulp may be easier on you, resource wise.
    • +
+
+

Bonus Points

+
    +
  • Setup errata importation for the Enterprise Linux + Channels/Repositories to properly see Advisories and Information for + package updates if the repos you are importing does not contain them
    • +
  • Create custom kickstarts for your systems (this will help you out + later)
    • +
+

Kickstart examples can be found at my +github.

+

Connect Content Management to Hypervisor

+

Next you will need to connect your Content Management to your +hypervisor. View their documentation to get an idea of how it works.

+

Spin Up VM's Using Katello/Spacewalk or PXE Server

+

You will need to spin up two EL8 or EL9 VM's via Katello or PXE. Do not spin +them up using virt-install, virt-manager, or anything else. This will require +you to connect Katello to the hypervisor. Ensure they are registered +properly to your content management server.

+

If you find the clients aren't registering on Katello, click +here.

+

If you find that you do not want to use Katello to perform this task, +then you can setup cobbler and work it out from there. I currently do +not have a tutorial for this, but there is plenty of documentation +online. There are also ansible playbooks you could look at for +examples if you wanted to go that route, but it may be time consuming +and something to setup at the very end.

+

Setup FreeIPA

+

Setup FreeIPA with two replicas, using CA and DNS built in +configuration. This is recommended if you do not want to setup BIND by +hand. FreeIPA also provides authentication to your systems without +having to go through the hassle of setting up OpenLDAP by hand nor +having Windows AD.

+ +

I recommend against setting up OpenLDAP for the case of UNIX +authentication. For anything else, go for it.

+

Once FreeIPA is available, all systems should be using FreeIPA as your +DNS servers and they should all be enrolled to your domain.

+

Spin Up Two VM's for Databases

+

Create two new VM's from your Content Management or PXE system that are +EL9 and install the default postgresql on them.

+

Attempt to install and configure pgpool-II for master-master +replication. Note that this may not be default in Enterprise Linux and +you can safely skip this.

+

Spin Up Configuration Management

+

While Katello has some form of ansible built in, it may be +better to create a solitary configuration management VM and hook it in. +Spin up a VM that is EL9 and install a master for configuration +management.

+

It is HIGHLY recommended that you use ansible. Ansible is the supported +and recommended system by Red Hat and is utilized in the certification +exams for EL9. At some point, you could spin up a docker container for +AWX if you wanted, but this is not a strict requirement.

+

Spin Up VM for NFS/iSCSI

+

This VM should be EL9. Ensure it has an extra 20GB disk attached to it. +Install the following:

+
    +
  1. An NFS server (nfs-utils)
    2. +
  2. An iSCSI server (scsi-target-utils, targetcli)
    3. +
+

You are to:

+
    +
  1. Export an NFS directory
    2. +
  2. Export a LUN to any server
    3. +
+

iSCSI for RHEL 9

+

Deploy Bacula Server

+

Bacula is a backup service. It is actually confusing to setup. It's not +easy. There are plenty of write-ups for bacula and RHEL/Enterprise Linux. +The digital ocean write-ups are complete, but do NOT give you everything +you need to know to do it "correct" or to succeed completing this portion.

+

Your server will need the following:

+
    +
  1. Ensure the system has a large disk or a large second disk (this can + be any size, start small though) - You can also use your NFS server + or iSCSI's LUN.
    2. +
  2. Ensure it is partitioned for ext4
    3. +
  3. Ensure it is mounted to /bacula
    4. +
  4. If using iSCSI or NFS, ensure the disk from that server is bigger + than 20GB. 50 should suffice.
    5. +
  5. Bakula will need to be configured to use postgresql (digital ocean + does NOT use postgresql, you will need to do some reading)
    6. +
  6. Register each machine you have to it, storing to flatfile
    7. +
+

Deploy Two/Four VM's

+
    +
  1. First one/two will be web servers running apache (httpd)
    2. +
  2. Next one/two will be app servers
    3. +
+

This is a typical "web/app" configuration. Some shops use apache +frontends to weblogic backends. Sometimes it's tomcat backends. Some +shops opt for other methods and software too.

+

If wish to setup Wildfly and host a wiki, you will need to do the +following:

+
    +
  1. Setup Wildfly Wiki or on your app servers
    2. +
  2. Setup apache to forward requests to your tomcat servers for the wiki
    3. +
  3. Do this as a VirtualHost configuration with the ServerName as + "wiki.domain.tld", replacing "domain.tld" with your domain
    4. +
  4. Set a ServerAlias as wiki
    5. +
+

If you wish to setup a Git

+

Deploy Load Balancer VM

+

This will be considered a "VIP" of sorts for your wiki and other +applications. This VM can either use iptables round-robin or HAProxy. I +highly recommend trying both to see what's easier for you. HAProxy is +recommended, because it's an actual load balancer application.

+

You will need the following:

+
    +
  1. A DNS CNAME for this machine called "wiki.domain.tld", replacing + domain.tld with your domain
    2. +
  2. You will need to configure apache to respond to requests for + "wiki.domain.tld" (virtual host configuration) and forward them on + to the app servers
    3. +
  3. HAProxy will need to forward 80 and 443 requests to the two web + servers
    4. +
+
+

Warning

+

Dynamic DNS

+

If you are using Dynamic DNS, you may need to run rndc sync before +making changes in the case of standalone BIND. You will want to use the +nsupdate command to make changes to your Dynamic Zones. If you are using +FreeIPA DNS this is not required.

+
+

Deploy Postfix VM

+

You will need to do the following:

+
    +
  1. Ensure postfix is listening on all interfaces
    2. +
  2. Ensure postfix is setup to send and receive messages only from your + internal network
    3. +
  3. Setup a gmail account or another relay to allow the above to work to + outside mail (this is sort of tricky for gmail, but doable)
    4. +
+

Bonus Points

+
    +
  • Create two relays as "mailhost1" and "mailhost2" for your domain + with the same configurations
    • +
  • +

    Create a CNAME for "mailhost.domain.tld" for your load balancer, + forwarding port 25 to both servers

    +
      +
    • Optionally, you can use round-robin DNS instead of HAProxy
      • +
    +
    • +
+

Setup Nagios VM

+

This will be a monitoring server on EL9. You will need to set it up to +use snmp to monitor the communication state of every service above. This +means:

+
    +
  1. Is the right port open?
    2. +
  2. I got the right kind of response.
    3. +
  3. Filesystem Space, too full?
    4. +
+

If you are planning to use full on SNMP, all servers will need the +appropriate SNMP ports open and they will need the snmpd clients +installed (with a monitor snmpd account)

+

Setup Syslog VM

+

Setup this server as a syslog server. It can be EL8 or higher. Ensure +that it is listening on port 514 UDP and TCP in the configuration and +that those ports are open.

+

You will need to go to your servers and setup /etc/rsyslog.conf to send +ALL logs to this syslog server

+

Optionally, setup an all inclusive logging solution, like graylog, +elastic search, mongodb, fluentd. The sky is the limit here!

+

Document Your Work

+

On your new wiki, document everything you did, right now, on your new +wiki.

+

RPM Build Server

+

For fun, you can setup a new server that is your designated RPM building +machine. You will need to install mock to do this. Optionally, you +can setup koji, bodhi, the things that the Fedora project uses. This is +not for the faint of heart.

+

Git Server

+

Also for fun, you can setup a git server. There are many options out +there. A popular opensource one is Gitea.

+

Ansible

+

Consider setting up ansible and the open source tower. Automate +everything via ansible.

+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + + diff --git a/el/unbound/index.html b/el/unbound/index.html new file mode 100644 index 00000000..6849ff84 --- /dev/null +++ b/el/unbound/index.html @@ -0,0 +1,302 @@ + + + + + + + + + + + Unbound - Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

Requirements

+

Setup

+

Installation

+
% yum install unbound -y
+% systemctl enable unbound
+
+

DNS over TLS (DoT)

+

Setting up DoT with unbound is straight forward, whether you already have a DNS server already or not. Let's go over the most basic configuration.

+
% vi /etc/unbound/unbound.conf
+server:
+        . . .
+        # Set the below to an IP address if you wish - as I have multiple VLAN's
+        # it is just easier for me to listen everywhere
+        interface: 0.0.0.0
+        interface: ::
+        # Optionally set a port - I have bind already running, so port 9053 works
+        interface-automatic: no
+        port: 9053
+        . . .
+        # Set access control rules here. I'll show a few examples with just two of
+        # my networks
+        # REFUSE everything
+        access-control: 0.0.0.0/0 refuse
+        access-control: ::0/0 refuse
+        # Allow localhost to snoop
+        access-control: 127.0.0.1/32 allow_snoop
+        access-control: ::1 allow_snoop
+        # Allow the entire localhost subnet
+        access-control: 127.0.0.0/8 allow
+        access-control: ::ffff:127.0.0.1 allow
+        # Allow my main network and sandbox network
+        access-control: 10.100.0.0/24 allow
+        access-control: 10.100.1.0/24 allow
+        . . .
+        # Ensure tls-cert-bundle is set
+        tls-cert-bundle: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
+        . . .
+# Create the forward zone for DoT queries
+forward-zone:
+        name: "."
+        forward-tls-upstream: yes
+        # Cloudflare
+        forward-addr: 1.1.1.1@853#cloudflare-dns.com
+        forward-addr: 1.0.0.1@853#cloudflare-dns.com
+        forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
+        forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com
+        # Quad9
+        forward-addr: 9.9.9.9@853#dns.quad9.net
+        forward-addr: 149.112.112.112@853#dns.quad9.net
+
+% systemctl enable unbound --now
+# If you are using bind already with forwarders, you should edit it. Example.
+% vi /etc/named.conf
+options {
+        . . .
+        forwarders {
+                # This assumes your bind server and unbound server are on
+                # the same server like I did.
+                127.0.0.1 port 9053;
+        };
+        forward only;
+        . . .
+
+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + + diff --git a/fonts/fontawesome-webfont.eot b/fonts/fontawesome-webfont.eot new file mode 100644 index 0000000000000000000000000000000000000000..e9f60ca953f93e35eab4108bd414bc02ddcf3928 GIT binary patch literal 165742 zcmd443w)Ht)jvM-T=tf|Uz5#kH`z;W1W0z103j^*Tev7F2#5hiQ9w~aka}5_DkxP1 zRJ3Y?7YePlysh?CD|XvjdsAv#YOS?>W2@EHO9NV8h3u2x_sp}KECIB>@9+Qn{FBV{ zJTr4<=FH5QnRCvZnOu5{#2&j@Vw_3r#2?PKa|-F4dtx{Ptp0P(#$Rn88poKQO<|X@ zOW8U$o^4<&*p=|D!J9EVI}`7V*m|~_En`<8B*M-{$Q6LOSfmND1Z!lia3ffVHQ_mu zwE*t)c_Na~v9UCh+1x2p=FeL7+|;L;bTeUAHg(eEDN-*};9m=WXwJOhO^lgVEPBX5Gh_bo8QSSFY{vM^4hsD-mzHX!X?>-tpg$&tfe27?V1mUAbb} z1dVewCjIN7C5$=lXROG% zX4%HIa)VTc_%^_YE?u@}#b58a4S8RL@|2s`UUucWZ{P9NJxp5Fi!#@Xx+(mZ+kdt3 zobw#*|6)Z(BxCGw^Gi+ncRvs|a|3xz=tRA9@HDV~1eqD)`^`KTPEg`UdXhq18})-@}JTHp30^)`L{?* z;c)alkYAc@67|W!7RDPu6Tsy@xJCK8{2T9-fJw6?@=A(w^}KCVjwlOd=JTO=3Zr+< zIdd?1zo-M^76}Jf!cpLfH`+2q=}d5id5XLcPw#xVocH5RVG7;@@%R>Sxpy8{(H9JH zY1V)?J1-AIeIxKhoG1%;AWq7C50ok3DSe?!Gatbry_zpS*VoS6`$~lK9E?(!mcrm1 z^cLZ1fmx5Ds`-ethCvMtDTz zMd=G1)gR$jic|1SaTLaL-{ePJOFkUs%j634IMp}dnR5yGMtsXmA$+JDyxRuSq*)bk zt3tSN2(J<@ooh3|!(R%VsE#5%U{m-mB7fcy&h(8kC(#>yA(JCmQ6|O1<=_U=0+$AY zC)@~M`UboR6Xm2?$e8Z$r#u8)TEP0~`viw@@+){#874R?kHRP|IU4&!?+9Cy52v^I zPV4Xd{9yc;)#l?0VS#6g@ z`#y))03Laq@^6Z#Z*uvzpl{$JzFJgn&xHlNBS|Eb!E@}~Z$^m!a9k34KX zT|VETZ;B_E$Ai8J#t5#kATCAUlqbr&P~-s)k^FfWyz}iK@`B$FI6L0u1uz5fgfqgU zRBmB>F8s_qp1HWm1!aXOEbpf`U?X|>{F`8Md500U3i;Mh9Kvbd(CeuC>077ww4g^h zKgM(A48W`XEDE~N*Th^NqP#S7&^w2Vpq+df2#@A*&4u~I+>t)9&GYcop9OtUo=;2d zGSq?IMBAYZffMC1v^|Z|AWdQ38UdJS4(H(nFI<|%=>0iAn3lvcSjIR(^7r7QuQI0a zm+@Z9QXmf!efG1**%Ryq_G-AQs-mi^*WO#v+tE9_cWLjXz1Q{L-uqzh z-Vb`UBlaT|M;ecG9GQJ&>5)s1TzBO5BM%;V{K#`h4juXPkq?e&N9{)|j&>ZKeRS#3 zOOIZ6^!B3<9)0}ib4L#y{qxZe{ss8}C5PC)Atkb2XK%PS)jPMht9Na0x_5hTckhAT zOz+FRJ-xk0*b(QE(2)^GQb*<<={mCZNczb3Bi%<19LXGc`AE-^-lOcO^Jw^J>ge2~ zT}Rg*O&{HUwEO6RqnV>GAMK$M`~TX%q<>-my#5LOBmex)pWgq|V@{jX>a;k`PLtE< zG&ohK;*_0|<6n-C93MK4I*vGc9shKE;CSEhp5tA|KOBE|yyJM=@i)g?jyD~Db^OKg zhNH*vXUCr$uRH$ec+K$#$E%LtJ6>`8&T-iBTicKH)SNMZS zB8UG!{1{Y=QL&oLMgLzR(}0Y>sN0TqgG|kLqv_VcVSLD)aJ?AC^D!bLa6K5Ut1)YA zghRXq;YBrYhrzOK23vXorq6v~v*CBb?*bYw$l-3J@cY5H}8Gr;t8{e8!J}L*5e>!hOQnM3g=8eoXDiYZBlmBW?=(Qvo;ib;hP4-|5>J zo6*MD%*UW90?aI=ncV;fJZB$fY|a73<^rd=!0(I%TsLE9TH#hRHV<&~b~82~@n<2= z1-*oTQL{zWh}4H zGjX>}SbW{R;(k^VBouiebp<&Q9S1P`GIlM(uLaz7TNt~37h`FJ-B1j-jj@}iF}B$Yhy1^cv|oM`3X|20-GXwq z0QapK#%@FUZ9ik|D}cWpad#li_7EK6?wrrq4l5kOc5H@2*p5ENc6Pxb%`OEl1=q{i zU1`Sdjxcu562^8fWbEEDi1(A=o?`5)DC_=i#vVX^45ZpSrpE35`g>WA+_QYDo!1%Byk?;4A*Y^%H_McC{^)mJp(mf6Mr$1rr8Klp< z@9$&m+0Bd{OfmMH!q^XxU*>tneq@E)#@LU6-}5Nz`DYpXi4*QA#$MRP*w045^)U8x zl=XAu_Y36n%QPIqUi^r$mjH7JWgdEmv0oiv>}BNj>jtO;GSSiGr=LO--M;f3$4%-kcdA5=kp1;?w1)iU%_3WyqWQmjf@AcVZ3xc<7I~# zFHgbYU4b-}3LN4>NEZft6=17@TlH$jBZ!NjjQC2%Yu;hJu9NWwZ@DynQp=tBj8Wjw$e9<5A{>pD{iW zZqogXPX_!HxT$LypN98z;4>ox_a@^r4>R7`&G@Wh#%HG(p9^;e{AczsK5r7^^FxfE z1>DZ=f&=UVl(8@Y2be_)+!n?cUjPUAC8+bcuQI+Aab3F@Uxu=lJpt$oQq38DE=X{7U3=m6P!eKVy6&>UK5q-?WYKFCon} zcwbuv_Xy+HBi;48;XYwJy_)eGknfFvzbOHS_{~WFRt)zJ zijpU?=0x zkwe%IkXL3J<39wBKYX6?A1iQgGX8uw<3E|t_zN{~?=k)}E8{7uHGX6%I@xLJ5o5hU3g}A@9GyXR4dV3$^??m7ZGyeD0jQ;~={sZ6d0>}3fa8JQ~ z#Q6Kj>z^jLM;Px_;9g|>2lp6?Oy32JW8UD|ZH#LugXW9=mzl&9Ov2uUBsVZgS;-{zFeKKwOfnbOFe$i&Nu~HMe}YLB^Wk1(Qs^2cg^_pF zV@!&4GARo9*fb`^0bBDClWMmysSaUvuQREB7n2(BZbV*M)y$0@8CXG!nX&m5FyO}f|^_bYrq)EtQ3jEW$ z;E;a$iwt`}|2xOlf`@fNIFLzjYz@1@vMcQB;TbKpR_b1>hK{W@uw#sVI6JqW86H;C ztQ;P%k-Nf8ey^cATop^SG>2V0mP~Z;=5SL5H#}UQ-NIABSS;9=rYBEjx70^!0%|%? z6H%vBBRb1si5UK{xwWyrI#6mdl~NhlB{DFSQ4f#HYnQ4Tr9_9++!S!BCwdbtt-PhV z2|9^MD=%7f(aK494ZCcz4t6dY`X;_62ywrIPovV+sT0pH?+{mwxjh%^> zh_?T`uiv2^KX}>z4HVY!Y%V1QDcBvi>!sD@MEbj99(bg@lcBxTD9~gYzfIm>7jFFl;^hEgOD8Clhu+6jw>0z&OhJ=2DoJ42R3QaA zWOOLCseE6;o!xG!?ra~f^>o~D+1yBE?qxT0^k{Eo?@YU;MW)Dk7u-Ja^-t=jry`Nm z^!iU;|I=I9eR|&CLf`eUDtM5Q2iZ}-MO8dOpsgMv)7Ge`r77T1(I!FduCuw%>+xyh zv~lQApLDjitE7#8{D!C9^9KL8O}^S6)E?BVMw_qP`rdoia-YG@KjOf%Qh4Bnt8Mcoi9h#JRYY3kEvn*UVbReO50BrmV+ z;MZw4c4)uX7XS38vL%mZ(`R5ww4GL|?R_+gqd5vmpyBRdmy(bdo1(0=sB8@yxdn)~lxbJjigu9=)pPhNBHJ@OCr@Hfy7 zMKpelG=3bck_~6$*c^5qw$ra?cd)OqZ$smlOvLJWm7$z_{bM*t_;dW+m52!n&yhSI z0)LYKbKpO(yrBb!r(;1ei=F17uvjq5XquDp?1L{4s1~Hu@I46id3j>UeJTcx0fQ!$ z&o9RBJJn}4D52n3P@|_Z2y%SzQ!WJ22E$LC;WNiX*{T?@;Pj!}DC|#~nZ>-HpIS<2 za>P22_kUiz%sLYqOLTT7B=H>lmeZ$;kr+*xoe54)>BRz1U!muO7@@$$G=552gn*!9 zJ(lYeq-%(OX#D?e|IqRz)>flsYTDXrc#58b-%`5Jmp#FEV%&+o&w?z>k%vUF^x&@! zd}aqf<-yN_(1OoX0~BNi5+XV}sW1Mo_rky5sw&#MPqeg*Iv+ow^-qi|g!>=1)d@|( zIJ=tJ4Yw%YfhiFbenxIIR1N1mmKeveFq!eFI?k+2%4<3`YlV3hM zS45R<;g^uVtW5iZbSGet@1^}8sBUEktA@_c>)?i}IE-EQTR@N-j%b9$Syc1{S3U?8e~d3B1?Lij0H27USiF&gR}A>wG-vBGIPuh*4ry;{Khxekv}wCTm%_>vhFZSJ)Pw2iv6Q4YVoQ`J2w?yCkiavVTWeVa)j|q=T9@J0pTtcQX!VHnIM6Al- z^*7Og!1y$xN4)5fYK&2X5x-Om4A;1k20|=O+$wl^1T}IRHkcq<^P$a{C0fAii(ypB z{ef1n(U1a&g|>5}zY?N{!tOqN_uYr3yPejjJ>KeR7IW!#ztw(g!*Hj~SpH|bkC%t5kd^Q2w*f{D8tJPwQ z++kT&2yEHVY_jXXBg!P7SUbSC;y1@rj$sqoMWF2=y$%ua1S%Nn_dvGwR*;O^!Fd?1 z8#WkKL1{>+GcdW?sX2^RC#k8D;~{~1M4#fpPxGDbOWPf?oRS^(Y!}arFj}-9Ta5B$ zZhP0#34P$Fx`;w}a*AU%t?#oPQ+U$umO}+(WIxS!wnBcQuM;%yiYhbKnNwXa7LiRjmf+(2(ZG}wiz%sgWJi>jgGIsPnZ=KfX?8mJ2^L!4-hBx#UR zZa((80+3k2t!n9h@La(dm&Qrs_teRTeB}Y= zShqm6zJdPGS+juA6^_Mu3_1sz1Hvx#*|M6pnqz`jk<&F@Wt;g%i&gunm7lM5)wE@q zvbn6Q=6IU;C_@UMWs|fmylAcBqr(MowarQT7@9BsXzyH534G z1e0`Rlnqb_RAIW{M7dQoxdg$ z;&VZRA?1jrgF9nN0lg?)7VU>c#YI}iVKVtMV&I^SUL2sA9Xn2<8mY@_)qZF;^OV!$ z;QVMjZTMUtC^eDXuo)DkX75sJ*#d6g{w?U1!Fbwid(nlSiF_z zStRqVrV`8MJBg{|ZM^Kzrps2`fI(Eq&qUZ%VCjWLQn)GthGkFz0LcT(tUy)_i~PWb ze1obC@Hu0-n}r4LO@8%lp3+uoAMDWnx#|WFhG&pQo@eXSCzjp(&Xl4$kfY60LiIx^ zs+SA=sm(K<-^V>WxOdf!NXC0qN&86q?xh#r;L)>)B|KXvOuO+4*98HO?4jfcxpk`^ zU^8+npM|PWn*7Nj9O_U%@pt)^gcu2m|17^}h}J6KWCJ>t zv@Qsc2z0711@V0%PDVqW?i)a)=GC>nC+Kx~*FeS}p5iNes=&dpY_lv9^<|K`GOJMG zE5^7&yqgjFK*qz6I-su3QFo4`PbRSbk|gNIa3+>jPUVH}5I6C)+!U&5lUe4HyYIe4 z>&a$lqL(n;XP)9F?USc6ZA6!;oE+i8ksYGTfe8;xbPFg9e&VVdrRpkO9Zch#cxJH7 z%@Bt~=_%2;shO9|R5K-|zrSznwM%ZBp3!<;&S0$4H~PJ&S3PrGtf}StbLZKDF_le= z9k)|^Do10}k~3$n&#EP*_H_-3h8^ZuQ2JXaU@zY|dW@$oQAY%Z@s0V8+F~YQ=#aqp z=je#~nV5}oI1J`wLIQ^&`Mj01oDZ;O`V>BvWCRJd%56g!((T@-{aY6fa;a0Vs+v@O z0IK2dXum&DKB?-ese^F~xB8#t6TFirdTy3(-MedKc;2cI&D}ztv4^I%ThCj* ziyQ90UpuyI`FYm%sUlWqP(!Qcg-7n%dk-&uY15{cw0HD+gbuz}CQP*u8*(+KCYFiz80m1pT=kmx0(q(xrCPMsUH1k{mefDSp) zD5G^q?m1N%Jbl&_iz65-uBs{~7YjNpQ%+H^=H7i%nHnwimHSGDPZ(Z;cWG1wcZw|v z%*juq&!(bo!`O7T>Wkon^QZ-rLvkd_^z#)5Hg zxufObryg!`lzZc#{xRRv6592P5fce0Hl-xEm^*nBcP$v z0`KR64y6=xK{a*oNxW9jv+9)$I9SxN-Oig_c%UK7hZDj_WEb$BDlO#*M?@b>eU7 zxN!%UE+w#Wg$bqFfc# zeDOpwnoY)%(93rx(=q9nQKg6?XKJZrRP#oo(u>h_l6NOMld)_IF( zs6M+iRmTC+ALc}C7V>JEuRjk9o)*YO8Y}oKQNl2t?D;qFLv4U`StSyoFzFYuq>i@C zEa1!N?B0BK0gjTwsL04McVmu=$6B!!-4bi1u_j7ZpCQm-l2u7AlYMmx zH!4a*@eEhENs{b-gUMy{c*AjMjcwAWGv@lW4YQtoQvvf*jQ2wL8+EGF4rQjAc;uiEzG%4uf z9wX{X3(U5*s$>6M z)n+q=_&#l6nEa|4ez8YOb9q{(?8h1|AYN<53x+g()8?U_N+)sEV;tdoV{pJ^DTD)ZvO|;^t&(V6L2z~TSiWu zI&#bLG#NGMHVY^mJXXH_jBGA?Np1q;)EYzS3U=1VKn3aXyU}xGihu`L8($R|e#HpJ zzo`QozgXO&25>bM*l>oHk|GV&2I+U-2>)u7C$^yP7gAuth~}8}eO^2>X_8+G@2GX0 zUG8;wZgm*=I4#ww{Ufg2!~-Uu*`{`!$+eE)in1}WPMJ%i|32CjmFLR8);bg^+jrF* zW0A!Zuas6whwVl!G+Vp(ysAHq9%glv8)6>Sr8w=pzPe1s`fRb9oO^yGOQW^-OZ=5? zNNaJk+iSAxa}{PtjC&tu_+{8J_cw=JiFhMqFC!}FHB@j}@Q$b&*h-^U)Y&U$fDWad zC!K&D&RZgww6M(~`@DA92;#vDM1_`->Ss*g8*57^PdIP-=;>u#;wD4g#4|T7ZytTY zx(Q8lO+5Ris0v-@GZXC@|&A*DPrZ51ZeSyziwc>%X>dNyCAL zOSDTJAwK7d2@UOGmtsjCPM9{#I9Gbb7#z25{*;Tyl-Zho(Oh~-u(5CLQl;2ot%#Nl z_cf{VEA=LuSylKv$-{%A=U+QBv0&8bP;vDOcU|zc3n!Nu{9=5j6^6DL&6tm-J4|~) z9#1w(@m3N|G3n9Xf)O<|NO+P)+F(TgqN3E#F8`eIrDZn0=@MQ%cDBb8e*D_eBUXH+ zOtn|s5j9y2W~uaQm*j{3fV=j|wxar?@^xjmPHKMYy0eTPkG*<=QA$Wf)g`tfRlZ0v ztEyRwH(8<%&+zbQ+pg>z^Ucf8Jj>x$N*h{buawh;61^S+&ZX>H^j?#nw!}!~35^Z# zqU|=INy-tBD+E^RCJdtvC_M2+Bx*2%C6nTfGS!1b*MJvhKZZPkBfkjIFf@kLBCdo) zszai4sxmBgklbZ>Iqddc=N%2_4$qxi==t>5E!Ll+-y(NJc+^l)uMgMZH+KM<|+cUS^t~AUy&z{UpW?AA~QO;;xntfuA^Rj7SU%j)& zVs~)K>u%=e(ooP|$In{9cdb}2l?KYZinZ8o+i;N-baM#CG$-JMDcX1$y9-L(TsuaT zfPY9MCb3xN8WGxNDB@4sjvZ10JTUS1Snvy5l9QPbZJ1#AG@_xCVXxndg&0Cz99x`Z zKvV%^1YbB2L)tU+ww(e6EZYzc6gI5g;!?*}TsL=hotb0Mow8kxW*HVdXfdVep4yL` zdfTcM*7nwv5)3M-)^@ASp~`(sR`IsMgXV>xPx0&5!lR8(L&vn@?_Oi2EXy)sj?Q8S$Mm zP{=PsbQ)rJtxy*+R9EqNek1fupF(7d1z|uHBZdEQMm`l!QnDTsJ_DX2E=_R?o*D5) z4}Rh2eEvVeTQ^UXfsDXgAf@6dtaXG>!t?(&-a~B^KF@z*dl$BLVOt|yVElz!`rm5n z&%<$O{7{?+>7|f%3ctTlD}Sc0Zs_hY;YO-&eOIT+Kh%FJdM|_@8b7qIL;aj#^MhF1 z(>x4_KPKYTl+AOj0Q$t3La4&;o`HP%m8bgb`*0vs83ZT@J#{j%7e8dKm;){k%rMw* zG9eKbw_mh1PHLUB$7VNcJ=oL;nV~#W;r|rv;ISD5+Q-FH5g~=&gD`RrnNm>lGJ1GE zw`K+PW!P*uxsEyAzhLvBOEUkj>)1sV6q-RhP*nGS(JD%Z$|wijTm)a5S+oj03MzBz zPjp$XjyM!3`cFtv`8wrA`EpL(8Soof9J(X7wr2l^Y-+>){TrmrhW&h}yVPonlai>; zrF!_zz4@5^8y@95z(7+GLY@+~o<>}!RDp|@N4vi4Y-r@AF@6Q7ET8d9j~&O$3l#Yuo`voKB12v8pK*p3sJO+k{- zak5sNppfOFju-S9tC#^&UI}&^S-3TB^fmi<0$e%==MK3AqBrn!K@ZCzuah-}pRZc{ z?&7p`mEU5_{>6x=RAFr4-F+FYOMN%GSL@mvX-UT3jRI;_TJH7}l*La_ztFn+GQ3;r zNk;eb?nh&>e?Z$I<$LDON!e1tJ26yLILq`~hFYrCA|rj2uGJHxzz@8b<} z&bETBnbLPG9E*iz!<03Ld4q;C140%fzRO5j*Ql#XY*C-ELCtp24zs*#$X0ZhlF~Qj zq$4Nq9U@=qSTzHghxD(IcI0@hO0e}l7_PKLX|J5jQe+67(8W~90a!?QdAYyLs6f^$ zgAUsZ6%aIOhqZ;;;WG@EpL1!Mxhc_XD!cTY%MEAnbR^8{!>s|QGte5Y=ivx6=T9Ei zP_M&x-e`XKwm+O(fpg~P{^7QV&DZPW)$j@GX#kClVjXN6u+n=I$K0{Y-O4?f;0vgV zY+%5cgK;dNK1}{#_x-Zyaw9sN`r9jST(^5&m&8IY?IBml#h0G3e?uSWfByzKHLe8) z9oCU{cfd~u97`w2ATe{wQPagk*)FX|S+YdySpplm-DSKB*|c>@nSp$=zj{v3WyAgw zqtk_K3c5J|0pC zSpww86>3JZSitYm_b*{%7cv?=elhCFy1v6m)^n?211803vG_;TRU3WPV`g7=>ywvsW6B76c-kXXYuS7~J+@Lc zSf%7^`HIJ4D|VX9{BlBG~IV;M->JId%#U?}jR@kQ&o5A3HyYDx}6Nc^pMjj0Jeun)M=&7-NLZ9@2 z)j60}@#z8oft^qhO`qgPG;Gf4Q@Zbq!Fx_DP1GkX<}_%EF`!5fg*xCsir}$yMH#85 zT3Y4bdV)bucC=X;w24>D>XjaA@K`En^++$6E!jmvauA$rc9F%b=P&f^I7M+{{--HM z0JXFl21+}*Oz8zr@T8JQp9Td0TZ7rr0+&rWePPKdaG}l-^)$@O*ON;2pkAjf4ZSg# zy{PLo>hhTUUK_q5L{o!vKb^7AIkbXB zm3BG{rbFE>fKfZsL4iKVYubQMO_AvYWH<3F_@;7*b}ss*4!r5a-5Mr{qoVbpXW1cja+YCd!nQ3xt*CEBq_FNhDc93rhj=>>F59=AN5 zoRmKmL))oDox0VF;gltwNSdcF9cb*OX3{Gx?X{Q-krC~b9}_3yG8Bn{`W6m}6YD#q zAkEzk)zB|ZA2Ao`dW^gC77j#kXk7>zOYg~2Y0NyG9@9L)X=yRL!=`tj7; z^S=K3l)dWTz%eniebMP!Z)q@7d(l_cR;2OvPv7I~Va{X>R@4XXh- zOMOMef=}m)U?`>^E`qUO(+Ng$xKwZ1|FQ|>X41&zvAf`(9 zj3GGCzGHqa8_lMGV+Q3A(d5seacFHJ92meB0vj+?SfQ~dL#3UE!1{}wjz|HPWCEHI zW{zYTeA(UwAEq6F%|@%!oD5ebM$D`kG45gkQ6COfjjk-==^@y6=Tp0-#~0px=I@H# z7Z|LQii;EBSfjse{lo}m?iuTG`$i6*F?L9m*kGMV_JUqsuT##HNJkrNL~cklwZK&3 zgesq4oycISoHuCg>Jo;0K(3&I(n-j7+uaf)NPK7+@p8+z!=r!xa45cmV`Mna1hT=i zAkgv-=xDHofR+dHn7FZvghtoxVqmi^U=Tk5i*(?UbiEGt9|mBN4tXfwT0b zIQSzTbod84Y<){2C!IJja=k65vqPM|!xFS?-HOK!3%&6=!T(Z$<>g6+rTpioPBf57 z$!8fVo=}&Z?KB-UB4$>vfxffiJ*^StPHhnl@7Fw@3-N|6BAyp|HhmV#(r=Ll2Y3af zNJ44J*!nZfs0Z5o%Qy|_7UzOtMt~9CA*sTy5=4c0Q9mP-JJ+p-7G&*PyD$6sj+4b>6a~%2eXf~A?KRzL4v_GQ!SRxsdZi`B(7Jx*fGf@DK z&P<|o9z*F!kX>I*;y78= z>JB#p1zld#NFeK3{?&UgU*1uzsxF7qYP34!>yr;jKktE5CNZ3N_W+965o=}3S?jx3 zv`#Wqn;l-4If#|AeD6_oY2Y||U?Fss}Sa>HvkP$9_KPcb_jB*Jc;M0XIE+qhbP$U2d z&;h?{>;H=Sp?W2>Uc{rF29ML>EiCy?fyim_mQtrgMA~^uv?&@WN@gUOPn(379I}U4Vg~Qo)jwJb7e_Pg^`Gmp+s5vF{tNzJVhBQ z$VB8M@`XJsXC!-){6wetDsTY94 G*yFsbY~cLNXLP73aA74Mq6M9f^&YV`isWW zU@CY~qxP|&bnWBDi{LM9r0!uDR`&3$@xh)p^>voF;SAaZi_ozepkmLV+&hGKrp0jy9{6cAs)nGCitl6Cw2c%Z0GVz1C zH-$3>en`tRh)Z(8))4y=esC5oyjkopd;K_uLM(K16Uoowyo4@9gTv5u=A_uBd0McB zG~8g=+O1_GWtp;w*7oD;g7xT0>D9KH`rx%cs^JH~P_@+@N5^&vZtAIXZ@TH+Rb$iX zv8(8dKV^46(Z&yFGFn4hNolFPVozn;+&27G?m@2LsJe7YgGEHj?!M`nn`S-w=q$Y4 zB>(63Fnnw_J_&IJT0ztZtSecc!QccI&<3XK0KsV4VV(j@25^A-xlh_$hgq6}Ke~GZ zhiQV3X|Mlv6UKb8uXL$*D>r^GD8;;u+Pi;zrDxZzjvWE#@cNGO`q~o7B+DH$I?5#T zf_t7@)B41BzjIgI68Bcci{s-$P8pU>=kLG8SB$x;c&X=_mE3UN@*eF+YgP|eXQVn) z)pd&9U^7r1QaaX{+Wb-9S8_jQZC19~W) z*_+RuH*MPD=B_m7we#2A@YwQv$kH2gA%qk7H)?k!jWbzcHWK497Ke<$ggzW+IYI2A zFQ_A$Ae4bxFvl4XPu2-7cn1vW-EWQ6?|>Qm*6uI!JNaRLXZFc5@3r48t0~)bwpU*5 z-KNE}N45AiuXh{&18l_quuV$6w|?c-PtzqcPhY)q{d+Hc_@OkartG`dddteZXK&Je zGpYJ-+PmEUR`sOnx42*X$6KT~@9ze#J>YvvaN24jI}4QG3M;w<>~!2i@r)9lI!6N1 z0GN((xJjHUB^|#9vJgy=07qv}Kw>zE+6qQns-L}JIqLFtY3pDu_$~YrZOO$WEpF>3 zXTu#w7J9w+@)x-6oW(5`w;GI8gk@*+!5ew8iD$g=DR*n@|2*R`zxe7azdr7~Z;$%< zSH@*lQ9U(Hx^%Fb|1?Smv({(NaZW+DGsnNWwX(DFUG8)(b6Rn>MzUxlZhNbVe>`mS zl&aJjk3F~9{lT-}y>e~pI}kOf@0^%Vdj&m(iK4LTf6kmF!_0HQ$`f-eBnmdTsf$_3 zR`hz2EjKIKWL6z@jj1}us>ZmY)iQInPifzSiOFN92j9$pX*CuV8SPrD#b%Qa97~TI zS6)?BPUgFnkqG8{{HUwd)%ZsvurI~=Jr8YSkhUA!RANJ;o|D->9S9QB5DxTybH&PGFtc0Z>dLwr|Ah}aX`XwTtE&UssYSEILtNijh)8)WWjMm$uT;+p1|=L z><4lEg%APBLn+FRr&2tGd)7icqrVXFE;+3j`3p~mvsiDMU>yK$19$B@8$Dy4GClfzo4)s_o2NuM3t-WhCrXE>LQ z_CQtR*!a0mhnw#I2S=WxT_H@^Saif`)uhLNJC zq4{bSCwYBd!4>6KGH5y~WZc@7_X~RqtaSN(`jfT!KhgGR)3iN50ecR$!|?Vq8|xa+ zY#*+B=>j4;wypclu7?wd+y06`GlVf2vBXzuPA;JgpfkIa1gXG88sZ*aS`(w z_9`LL4@aT0p!4H7sWP`mwUZRKCu@UWdNi-yebkfmNN+*QU+N*lf6BAJ$FNs^SLmDz z^algGcLq`f>-uKOd_Ws4y^1_2ucQaL>xyaQjy!eVD6OQi>km;_zvHS=ZpZZrw4)}Z zPz(rC?a`hZiQV9o^s>b?f-~ljm1*4IE<3plqCV}_shIiuQl=uKB4vUx2T$RCFr0{u z1v660Y3?>kX@{19i6;*CA}pJsFpo{nculW61+66XAOBZD< z{H|h`mJS5C2;ymL##}U*MC%fL0R97OSQ@lUXQ-j?i{z{=l-!$64H{LlTLo{Ln<|OV zBWq*5LP`KJl74fC{GzzP_Z;;;6i--QpZUrtHC@+RBlt+=_3TyV4gk=4b{TBJAx!GehYbTby(&-R337 zQ%g2)Uc&K|x|eL0yR*VCXDBqZ89C(obOFYYht(k`^q0OaQ*Y{)@7xE~KQ7XN)hGlZ zl5$1<#s!tyf%>mbIG(9WR`R*{Qc_h(ZGT^8>7lXOw^g1iIE2EdRaR^3nx_UUDy#W6 zy!q(v^QLL*42nxBK!$WVOv)I9Z4InlKtv#qJOzoZTxx86<5tQ*v528nxJ^sm+_tRp zT7oVNE7-NgcoqA#NPr*AT|8xEa)x&K#QaWEb{M34!cH-0Ro63!ec@APIJoOuP&|13 z9CFAVMAe@*(L6g{3h&p2m!K zEG?(A$c(3trJ5LHQ@(h3@`CB*ep}GDYSOwpgT=cZU;F&F6(b=V*TLLD z*fq(p>yRHTG1ttB*(Q8xLAl4cZdp^?6=QjcG;_V(q>MY0FOru|-SE}@^WElQTpCQZ zAMJy_$l;GISf1ZmbTzkD(^S!#q?(lDIA?SIrj2H$hs*|^{b|Kp!zXPTcjcCcfA+KN zdlV!rFo2RY@10$^a_d*-?j7HJC;KhfoB%@;*{;(hx_iP`#qI(?qa{b zH|YEvx~cE^RQ4J}dS>z%gK-XYm&uvZcgoyLClEhS(`FJ^zV!Vl&2c{U4N9z_|1($J znob`V2~>KDKA&dTi9YwyS#e-5dYkH?3rN(#;$}@K&5Yu}2s&MGF*w{xhbAzS@z(qi z&k99O!34}xTQ`?X!RRgjc)80Qud0{3UN4(nS5uZ1#K=^l&$CdhVr%4<67S=#uNP z$hnqV471K$Gy&){4ElZt?A?0NLoW2o_3R)!o~sw#>7&;Vq954STsM(+32Z#w^MksO zsrqpE@Js9$)|uQzKbXiMwttapenf8iB|j(wIa2-@GqE@(2P#M09Rvvhdu!sE0Mx&cK&$EtK}}WywYEC~MF5r3cUj%d$|lLwY4>`) z_D++uNojUl@4Cz8YF3nvwp>JWtwGtSG`nnfeNp(_RYv`S2?qhgb_(1$KD6ymTRgnD zx^~3GBD2+4vB9{=V_iMG*kQTX;ycG^`f{n+VxR4Ah!t~JQ6Z?Q;ws}Jw|#YE0jR0S z+36oq6_8xno^4J?Y02d!iad3xPm+8~r^*Vvr4A<|$^#UEbKvJ9YHF=Ch2jF`4!QS# zl8We8%)x>ejzT^IH%ymE#EBe2~-$}ZXtz&vZ_NgVk4kc zOv-dk(6ie2e{lAqYwn9Q$weL#^Nh?MpPUK z#Cb)4d96*6`>t7Zwsz#_qbv6CnswLS9Jt|b`8Mqz?`?H1tT99K#4#d+VwAy}#eC74 z;%UFxaNB!Zw`R9){Pncrny4>k;D}TV2BU0ua-+Fsp>wmcX#SGkn`h0O`pN*`jUj8q zIlnc7x6NRbR)=wP1g`-}2unC>O6ow=s{=NV6pfEo3=tY8 z=*$TKFk8Wv0K8B_**m*Q>+VW*1&gD#{#GSc(h#YQL?*<(ZUx~>L^RyAG3}j0&Q|mJtT7ec|Y7cr~ z+A`Wz!Sqz9bk0u-kftk^q{FPl4N+T(>4(fl@jEEVfNE$b*XSE)(t-A>4>`O^cXfrj zd_nrA-@@u?czM(o3OVDok%p3(((12`76;LwysK$;diTl$BdV)!p5Gj=swpb=j2N>b zqJ1D5E#zO9e(vJ6+rGuy<(PS-B6=gHvFat&)qr%j7T`vT1ju zIvHwGCk5)id{uDi@-e?0J*(-W-RGZs)uhSeqv7TA&h|CUx(R0ysoiQC8XnxL&RXI3 zO`H`8Pe&^ePw*`{rIJhzUg@MuhUL`IONG^*V?R0h5@BRDFgEF45b0jSrg0r{<4X)nw^c)uQ_Ai_p>ic!=K$pmnyqYb=`6fUo40ru#Gh= zMRJxOD(1n?Mjz_|IWyJK5^fh3*n>eI0MmEKq%=-oIdGd4F-LT>RL)Bp5FWxb4aNLNXB^o?YBSXQ`SwN zI*N~(CQW~P$HpzwrMG4IZKI>TVI4nQ$a-#)zV}LE(xgQ5MG@L#e!e@ ziNtg{Ph&qpX9FLaMlqMh>3)Nu%sAO#1NEsbe=#4Vqx0Y;<~+mV!xwj%}Z=xZn= zSqjxSH4T~v>Xd*=2wmHPN?@+9!}aQz-9(UIITZ==EB9}pgY1H4xu^-WdOFSK!ocZc zd-qhN$eZcN#Q^0>8J%)XI$4W(IW6R810*ucIM7Q#`twI|?$LYR1kr>3#{B{Z4X(xm&Cb21d^F9MKiD=wk_r+a=nyK!s^$zdXglCdshbfKBqa5aMwN#LmSNj6+DPhH4K-GxRl;#@=IJc zm{h}JsmQFrHCioWCBGzjr5p9L4$t4`c5#Cz(NJ#+R7q-)Tx2)6>#WZDhLGJD964iJ zJXu`snOYJYy=`<+b*HDiI9XPo8XK$TF86)Ub5=NC@VN#f$~GDsjk01g$;wDY!KqOh zC$x={(PT7CH7c?ZPH{RNz}Tel$>M0p;je4|O2|%Yq8@sCb7gRhgR4a*qf+WGD>E8~ z`wb<@^QX)i-7&*Z>U6qXMt_B2M#tzmqZTA1PNgzcvs|(|-E z4t*ZT-`kgepLl0g1>H!{(h8b`Ko=fR+|!L_Iji>5-Qf34-}z%X8+*Qwe^XrIS4Re$ zWUblH=yEfj!IgeIQ>m}+`V(4u?6c;s&Ym_6+pt|V`IQ1!oAC@R1XC3tL4BQ7`!TnU zWaoqG=nhI@e7dV7)8VzO8ivuC!q{hcxO7fo#2I=<`rktP0OfAO-CQE!ZT@}e7lw;{c) z@2l7RV$@&S5H@{=Bj~^Kp5At=Jq=Y92rXP@{-D4j>U=-a^gM2s-nIZA;u=fbm2BP=Zca5W81_cA>Tr z)x+r@{pu_la2Q(wm`Zqyd@GhNDNT&4oNHb_>w4{jIU}m&iXykMxvi;WL8;y7t}cp& z9CEpR)WlI1qmOq!zg4QTmzv#eP3>NLd7V-+YKmuyLFP533rd>WnvL$F3b}g39PYk; z)^hXQ%5jO(B}-TMio7@t<(V?7M5!ycd)u4Z+~!hym9+KwPVO^Wkhi^Dc7$R@)o$oh z^mRbgQ@5EvalJa}V4Bi3cs^w5pYtbXXz5W|e%+z-K;8M%Lf~BlZRvNI7=)cG6lbjg z?)l8iOw!mU`uaKN@UL4>d#edM9^-ePb(VICy6Cg-H^Ew$n_s801w`A83W!_Z{D+1G z(<9A>WB@>)D%cxw7c?Xv7N}6gg?&TkLX|0@k&VL)YMI~SsE^dzj2^3BKL7SM$!0Lt zj;ytKWw|(58n6_NNH$JVRh!W*wewMr7)H2jOCruuJAIIfPMFpf6j=hL!D3nVT9Dpo zut}|VoG<%v&w;HrQtz<%%T&X##*z5{D!!egoRN}R_Xxuy+E3dhx6!7mlNyuqsKR-P zlP#8EKGt{Ij~8kXY?&*%q)PkPG;rziWPd>HefyPwV49!>f&Q_@Fn{8Cyz{HCXuo+( zJMu<#{Tl}^-dh%nM0IrDa@V zMHgAog4`tk;DNK-c{HwRhx%Fn%ir3mex!XeZQ4QY)vQ_iZ(j4-GcO?@6Z-Y*f?u7_ zmf!}WRoGkI#BO9;5CFvMobtV@Qm?#eNKbbX!O@xEVhnm z6LFnWu=E}6kB82ZEf!g}n5&IuivccTHk-_5cazDAe+O!_j+dQ~aUBy~PM34Eq0X-LOl zjunFnO<4Nq|BL`!xwvyj&g9Q0(A_*xLT~l{^nM&kGzB7+^hP^L&bD7iVdXe3wobJXVX~o*tX$ zI5xthE?gAl!4+v~+ASbN2nYIqNn_#3>!fi2k=g*Hg_%caA#plNQR+RtHTiW>(*OFG*-nzu~6DMCrX>xzP`3sj}D!||8 zf3dk-w(NCUMu^C%k|t?sa>9gU_Ms-R2Hhm~4jNfPPyH!3Zy zV0QFf=MWK%>|(eV$pB5qOkC)uou{oIJwb_i4epV{W95%N)`+uOrLx7fNtD^czsq4B znAWb+Zsk|YX}a?b+sS-!*t2w1JUqU6Ol`&Jrqa5=4eeLWzr1DX1fWW`6MYf+8SOW< z+EMJ|fp${RJ7q9G7J+`pLof$#kBJP^i@%wNnG3fnK?&k>3IUVo3dbs9Nt)x_q|wIB zlBAi#1Xv-<+nr<13SBfkdzI?dJ|3~?-e>MzG(yRsA}I_oEd{HEGZ&7H|Km9mEbL6r z{Ubhh;h6_QXN_?>r(eWJ@CM1-yn6Y#am!aXXW!EfCpu}=btdYT?EJ>j+jeuc%;P2g z5*J%*$9La$^cy>u0DqjO#J%*IdaaPnAX#A6rRQ+sAHhY@o32==Ct3IF&sM14!2`FD zA))>ZKsccTyp$U0)vjABEY_N5lh(@e+Gj>sYOTgf?=82K)zw-?JX2d$x}n2Y0v%SjDtBXDxV2TyyxQmN?2%8zkKkKF*!AA$P$1#qrF%fUu~URt`tp3C_(>^tkcbHhO0Hh0A zpTVQR{DjsD=y-Bsl#nuTVKRxYbjpSJg|K+SEP+^Y*z3S9p(_-s9^YP5Zc?Vz*o(Qx z?f03co`dGfW}0T>UdEZaW>s0XVEzlw@s&bc+B-9;^^AGsx$AE~!1-7?tn9z|p4}_? zRsM&sjg1>#Rb#6jFBRKMeZ>I_4<%=&rF3yqUD&Lik@7<@2*(0rC)UqPj`Gfe8L&{S zhGtB67KhF{GnLZCF}gN0IrIPU_9lQ)mFNEOyl0tx-!qeCCX<;7*??>lNC*Q7`xe43 z2$7wD3MhiII4W*v6;Y775v{FSYqhp+|6)6BZR@Rdz4}#KZR4%=+E%T%_gX8-9KPT4 zo|$Aa1ohtUet#uro3p&@^FHhEX`OcGjq==$UeAQ~<6AZzZ|l75nn<#}+mo0rqWv5$ z1N<|1yMgX+Qmz?53v|%P=^&74bwqfH?xIC`L()W{|G`j^>kbs7q<$hb6fL@S za#nHyi$$TJ7*i!6estChR}QriMs#yy!@Po#AYdeWL~* zUR%)FT#4Q~O-N!O&it}b8zFOmbe=egH*Ka<9jT?dFCMAcagAo<>tKrW%w?P_A_gd& zXwHTn>a>WEWRzimu7EJ*$3~Jfv|@bLg}6iH4mgJB!o60eP#_N!xYrQoMf4&rGLau~D9ila zYGD*3*MNN?v*n6op+dQM!Kkr@qH1|^ zh7skG&aC;+$C$OSR2!ke>7|B6JDpjV%$Jo5hI14PGyx1I=Diw7>h@vzL?PLTzC;`; z?}nkmP%J6$BG!9mxz?+Np zIHbVy&<#H&Ekz1(ksSJ_NDQ+XHyg-!YcW8YvE5v*jFQ->F;|Q-IB@Mw6YP~v=jY$~9n@~8MVO{1g z@g=-I$aXs1BH&>hK(~|d>Y9n*;xRm&07=pLuqVYV-bwyCUIKgMdLSrovEs2f3{b z<++d|UX&}*7)y8){Ntc{RL*udOS8r%JV4EZ64fUF85n7%NAWejYbLV}NB|lS>SnYN z?PFpysSR*OodDcNK;OVKsSbKS^g;|bSdogA=};1?3rYq|Nc_tR!b2ln>=bNTL59uS zZjF^Y1RoS7qF^>LEqt<#Mu0ZjpiUNLtsc5%t*8}5lW4OWwFXfqGn-q~H)5}2mSRZ^ zKpfQxOe+KC(M5V`tz1zQ)@pTTQ2?NgStmwpvPCi&U9wd)m<^I-w&{(`Vb?Q*4ApV5 z(G}DMfgox!S_C+OTa5UkEbB#G$SC<8vLrDPPT_Uq5N~7`%Js5Ut3!o!f@HJm?b;(N zbbv90V6J7=E&)E`b|}N4n`VOOuvo$IEMx`%EkX8mpug0yY80enF3?M57gI zQ((b(;dv_v7PDKFgL|6)q^sb%Gp_aU)wp^uX96>jGEsOmBhyuDZ8}+y{bG?UqGqyDfYMtJ{6@xXI>fVC9g+uG zbQzl4fY>P6VAkv8GEpapl2>quqSIoui)Mr95Nuw@voGBux%Mq zYqG!&A9RXvoI%gZRwI->g2SYPB1tbg0U9UkC70cRFPTKU0L{E!2e?|as;p-wNwA;> zm}yKfYURNzE545Jz^T+srPZUGX{3qx0H&3ol`)Eow3xXj!2lx+DkB=}EoF`(n^)2W z_26hljpwvSdw}akJQN9;WAQnnHTN=3Ko19hR`Qqt#60*^1acxN84Oi8W-4nXd^@w0 zVpMzKqWw_(cHwQ`*uQ>F4F;Ncc?}XU{q867ZF>zihsu1j_i%f38%41S53RkO-5Bq< z<^ffy6fQNDn;z=lDz2OXjU+MMr0ziZ)HseHI3+}-N8v$8UWEK_n5pL6VPUS@YH^ z-F?^bJ%5Vt}@l0B2B$XfpF!7J0KUW$rc!~hPD3+Ms%)ia=pl{0nuS0_) zMk9rt16uqE&;%{gtVGqhUs{u$%()O~zzC_11`vYVVXfdfEU}YwTDn~JYTSiTDRNih z4#ap?$m%48h4*c`rhEH7?VLTW9aCi~b>z~)W0xM$c|y(8H%u~4?Yic=Yr3WyCvBMC z9P;P}Ra`!CY1TVd3~%qgX48EO<*6O5d**2Osm_lAM&ZKw?7XUKU$o?gjCIcqH|%NJ zuxtIAj>_t$YW%D0ShIfD2DzU5%qnHsRN0vm^B3-wcim7D^;K7~Uj8EuKZ;X3tlbVD z(=eh%wxAVAWPvDL3Mmg=TPKpMGzTdG=aT&qTw(TFBIg<;`kFOrB)&>#;&>KE1kb>+ z2B2dhdAN+pj}^ZH_t#P}WOC_RDs4ppbD0<}eknMnviR2G%#`AniYwzKw-y(_5*$-_ zmw5S-TNmxQbkR$TmM>p=*`CF(EG{@lszbazB$k;2MYhTooy&w{`02hJ3>+yIKEOe7 z@JMkSHwDW^-jsRwlSM}sEqQs-p1n(#FUOllp3=O)Tup&?1<^)a@`nk7JGz35N>n$} zBOy~(>fI9qX^_jCE*5|=cn@Q((|dZ4jk)4MmOAk+0xA#wuDRF-%lTtBwIA!9Gr9Ct z$c`7mj%LBTedqC%Rm_T=dk5?Lu6Ta&XaF9q!a$AUtk$ z*e$72Su7q{Rad`o)%w|Sbyv5rzAip{{VH|GtUY1tf`Dk1!6*HuN9YH|>@$Gpvq}N6 zCzbi<_XLxmE|LLdr@JCzPlDyUYO2J>kDK?krp5CY@11*7)8aCVVb&~zrEGE2O>>tojkD`+_dDb1*Ao``HQpP(giSRL)4OKuTMcNVOb@(m7M?noGc?geUJ;8t6u0>WYa5RLDJ>(^Zu~>-DTzEbb z=Pw6=C#Q(ao#It|Sa^jEBWtV8YNL5Ce+KO1 zHqBg6?QNQUAP0QbaOG=Lqb?5ZLlZP3JdqXFBbSG?_!QPegco`UzEDBCfy7n?l|5O(2uWh*{9fh*}OFkZGv)4J9g^Su_Z-y zktO~$6KAdO?4HIhm;a)+gVRbF%BNDw_qH-YUp3>pUiriPU-DaPao4J;%WF%Dllm58 z#~3FQnvO5O$UIv}o~Up(EN-l>@f8Ipwl+*yG^2h|U81N>`H9+~R;Nq6WZk+k_l_|; zqH`}-wki9Eekf?yVOxp~wx$i7mS&wyRfA;|YZ$pD0iFQM7=^Of;Mb5{*g%Q+MV}ZZ z4uCY|_@8q>JQ{}h=B5NG!svf6mRKr5#bVli@?ZR%doi+~75m0rb2XFdcTK&}XtK)Y z#n$?!<(KX3?3gc;rSMQ3)+>e{<=;f)h)dXgJA+DdJ5q_(=fbyjlD zyxOq~%LPEFsh*KmXEIW|_M9hDm%Gdrv97&s&LCvUqb)02CoZ4W(b4X%EB2q(#G5YM z&@wJkH_qwtRocyZt7Y4`(pa=cD4!kEPl#4{yum=*q|U{&O2DV&=)yXRws%3})r>`7 zty6tM=kuW2FpR*(!{^GYty*Jp1woSmG%(Qs4H^#!;!Q>OdkH@{*K(vzM1v#qO$_R{ z7+Jto9d&*4xTs#V1lt-9mM`tTxU{8|32n(X!6M-UNsS#R?m__F|Gn3X9 z&{djT%C$c`e{S8Bi4#KMy0LTS?(Vvq%{y6Caq7xk-@t{Re0DV4heM^6gkrEpL-{{% z)|>$4EU3Gq;JmPH{E@zsRX+#@>gc;qk2i2FwVHuCI??#%xdiMweM zWaT78*EG!|+OV634wd0UaR@TenRhksaP%AUUdHC0VcZ2nT> z|Lq#TX5O&2h!GYviFiX{IRHYEViDCLf^Wf)se&K4oOU>MQK$_!7!L(|E5Bx`dn|^Z z8D!P9pUu^~tYLFpB<~24WRqgt9Jadj5ce6JRV}}8O%6hRA!!0JH5LHs91WhgWWLJ- z!KL(|#^$p^amdJ5g8rZ$Ggy6?%`B;J_Kppf<0XMKcmmW9@>-TJn~gIShXI5aI(xEx zlSd-_6cOeEGR2J$MBqWpK*2%7D7_wEFG0(EP;?Sr1EpZsk|pld3%9nq47KjwNtga; z^X`AUY0HzBudMExSE>hYgVxdT>O;3bbp6&zv#t6lVjtU=7OitgFDbdK>r_jozEYb*t7qdj?MRk%pu)4==CR^bNgHOU-j*emraW7T2WR%b?1^<K?p<`lIUQwM$W=cui|bx}?bTOb6E1v3`QcM^BdcQe z=PpkFc*njs2H)6MH*NX+$l&D3bkD1=@_CF6^b#6m7%YZwDoKJobt%*>6l7EZ=V>@G zzzY{zEr!q?#B%Vk9VD%4E~MxbJ)hcn+q^0Z=@qNy9XNJiUX{8Ns(OzNq-fqrsbhbE ziWT!T7SLhKQavnveOJ`2^uK@O;eGSx?>nsSlq%#_#sdo9iphZ#Jwo|{FhMbfSrS>R zQiwFss8KQy?9j`|&<*8j64q^OVgV#e63^ksE_l^9($wb9f`EyHv4&?kqn<@TAOMm< ze1YGL4dcENbcWZd&n7h~Atmwe(#RoslRpeyDguGF}j}$MRo9?SM8!=4Q2wU($EzceOopeaHDv$UhoQfY3;W=e^g5xM87H z;I{8*GeL)G;HH8ITBt8$#)NOPnG>ql&Qh*h zWt>ty34rm;*F33uigBg#?eg{u7R{5>Q`U$R2j3@_Lkx_M{bOC#*zx1XR_*c*B-IGq(GV|B@o{8hJ3p1*lD@AJn%&$i*n1|9(=hKoMs|KsjeFu0HwhG-gj z6NR02xQ2KllvU2l&Q+ddYuKj6LihSj-&!x-tUR@F>EtCIlkybUel`o1t{IyqKm3Y# z^I%x~1FN64cI~X$=bbnBPUd;Rxn=jXhSG-2Z`jT3lX2q?hsL#({W072*)OlJJQjT){R0dcw$MIV@Im_3E)riYBiU=q`Y_6ca&e9uVeb_jW)Y(*6X`BKYM85 z!b8t)Ui*XT*XL>UuiVO9x8B8yUlNM}WBcAqm)&yESfoE>5R7X!w(jnYSbl8TpaivJ~v3;LD^f$vOykiS%0kDp1GRq zVCg_iC;5ATIf&(~gt_DK_8Vo2`%JbUh z9jfe_*S6Eje-d8cyItyiX=UK|B_;1L?UVG9n?6x~K;xR|0vZ5x!At8OJYq-&B}jT5 z#x}{P70vb-p^szS5EvI&o&q#3;_jrm%4X&6S8u*@Sv#ZVm@V<@Hf3s4l;7vm>@w-r|)yZS%w?(I1*QeIrsG=I+5nepzsGxrc~ z!pSc|SCA)uB~*o*q}1leH+COyX<6)cl^Ly@AOH2^A6)<8mq0BH{PW9E7WVFW74(6f z)`kEd2^SPxr15s^#3*QkxXWqEyk{wqj1GtNbEQ|(J1tK6 zUnIYs&2$CihuMv=&x^lu`v>+G339PrtlYp%HorK*>MU~Tjmr477+hGhviLYl@>d-K zU!uTPY~kv}%w^h&xW}uU?TFq&;?(Rl#6glkWN>Gw4B#URl`pWSWHsaPj-^{T?+Rl%;){@`StD{A2dwJ|V96v& z$16bph~Zles|b2KXKVo$Gy2J6qqP8xDY~bRh4}rn$()b-mt@e#Fwd)MdNQq8Y*-I^ zKqOSY68uyOQhX&e!epDI){mhNNM=IwXQLY2+&brLfPWf!2x1u(hS5ey?BxMlyyvL* z=no!g*pcWU2>q^rYg;4Lqki3-zG)X;d+6E=r*#^~7*m$_EGg_eQ=4jA+oZ8YMYWd6 zb?&a!UGBQcmfE7Cu~J)W?WPsCJoTfeZdoCs5nPtKdb}+(w{hma1+}#c_RZX|z*J-U z`YpG79lHe^?%Xkc?nU**&Cy^m+F0WA*VWfFHrCYF`F$mgbgj9#{-U|#cig$|;T=<^ z?0A^d|2~dA8{jc0T&>LodGPkA2Ce<%xn1wIlX?a%!@Eq4Md6Y$Pjh8C)#tL9&B{-Z zDl*AaMfM==qY6ZMs*j2-_o&#DtOvEgKO^o#a!G8V!FLJa99SgR=R+3-1WD>6kPt4T zQEnn&KOhDe*4&&kDJBfJWl@4anq%Se(e27Iv}pbO#r>3wvWJpUt}zNZYx9klkhS?P zCbrI418eh@4+uTT5z<4YR!}Wu!0bb{)|g-CHs~wgPLx_;gZ}Pe*r4aOmyr#+pp0lb zHFY6iYKHu9A$fn1?OWE+XV41w8uJSK1!e3*OLwh>v1U`ou!Z{BA27G z@n6d|J;N3qwe4uQiV3KTDcpf57p!m?0p3so1Ax@X#2IiaA}2>9&SUXL^1&>Xh8#Oo zQ?C?L-8M|oiJLpU6Q{%GGh;&0K{owhQSY%3!h1qcSn>U|R_L;f`cCNUO-efJ#sSbh zkg5Hb9y)Ys=YeAvt+X|EzTjRz37BGClh(UmXfNBmxvV{Ttan9870vRhk`;uSF?`m! zyWBXXtg*^vTY1s31F*aP^xb!Xf`+yrz9*G!3+V51{2PK^bPhMbp(nxq$mtS*2*~V% z(N&JbY2FYBI?V#24?IeNyZFFOpZ~&zB|@M?sbh`bnlV9zkG}tHdLK zx+5aQXm)byO7#8XHFtDn$5~LO*5aqH%?m z$2wT6nTmGDI)?$JimeWHNO7Kra|S#r4ugug1UgoGf)+&L03keV@p1OHE$p^lBA zt*GJGLDNniq=XZ4I+Mb*82pqbfoQ@+p_JGdB0aQaeTB!Lr#Z$97FjWL@MMe@Z^D+s z&IK)jih;Wbb%1MocDc@#$)|IKVWN*g2&aNVGFMmdoaL`cE`T^;1?Tcf@^i>q-czu= zA7p!sX62V=__ATa&S(g9I0rd{)J6Sdr^qB}JA4(U(1Y-`7)a4D)MA`g7I!Mwm6+KC z^C_nUK7sX}(ukntS*u>(uyyY=UeDi#4Mlus`)o8@(xaLmYhKp;LGw3oP&Rni)G|cQ z7Ur#P!U!VO1g(pNoJAP;`R9fA(}??`-wW?AJpaG_{Fi;Nu)eT^;QuU%IRlFc*+_>_ zx`&U5+e^|ih7FuRhmOU(m+aK71UlNUGH`jW!KA(Xf;sb)=69M;|L@O||H&xL zl74Wt!{fDxvzf&5M8E`Lo>IUfK@P&dqXA1j9Ysfw#32a=jPn2f=>Dps?=)zh0y=nF zlN*J67GXr@2Az6He%|WXWJyrTG^F6<|JoS+k`Xm{tCR{6!43_i__z|&s!LT*4`;a3 zwB^UO!_$ZGtWdT77?_S^7Dqv~y|xiDP)-YnK8%pxr7p+Lxp?4~wPvULd zUmZLLn47GQg>WUt!yAzB$G%F{zYS~B=am%aex&q3x^I|U4B;Xp?}AZk z^YIrlk>Jo6{xrIjl;V~Ot%d0#DhpmMHo+{Xi^Rz)*c5L{kRh`PE-|>;1QQ0h^lDfo zd@>|=U5Y91Dt-M)<#*Gl`Fr}3$-Z}Nfx!+IeZ!v7G% ztcDQl>kp+vdVk8V$G)HSg>V(Daj1A4`JRB+&HA5cq3-~n7Y2oBATKb2YG`uA6X8S{ zY?6>Vt(nsVyAxRF6YnNNtUn~CLrIFaIITfuxMVt=e)j}2Or%oj&|p93A5+|pOZ*pd z#pmb`Sv&G65piAWD5e2SoNSIcgY-cWl#06J$28$_X(YT)8umd{pHg7Zo=kQW0->a_ z7yr))>upwE8ZMWr(itk!ke5-mNGO~-u?owjq}8&~H}EaBRQUYJk_kzaMJ-j~1H#0S z1rxw$&lCSsY5*5Eh9p`{{~@y^&(mjM(r6cji;VSvEmZ0dZ}u7v>WxNaH@lu48ujuc z{04p_HtH?AmEG!dXI$pv!-8`CYpz_XJ(2siAQuczyy!!@pi$wT{)yp>!Xhe@`nl`z z1^zAe8p<`=WnrFL1*!@PPZ=huBJ={PS>a{s$9bBsNe$AX5$!cHKZH|luaOs}hA*pi zw$Rj=>@_5!LqS+x4X9Y`l2I@7_L`@81m(I&E!VL96$Z9khIpPCg?Db=MU?BT)g7f3 z1oR}eOn#rEov2`=TqatC@g-cu`;n}|1~nUG-Vnn;qJfhg6hp5T(E`dSLj-kY;GX6Q zi-z9$l?TDudYiv<9p*t?+4_WO=CNA5llp|}o}F1=q4CAqvoxnl z-+26xjr)Osgn&kH{tC8-tSujYAX&ByDk<0rhH0A)eE8>_MbIX>Z9mf=3Xu{d5DSGe z{bXd;!bUBGMEs02AatuZk6h5A3ny8K=vdpjVylr_0=J@48tARLevxvQQ6xQRF2uMT zDdlo6=qryT!$n?JVgWh91v4nu1G=%?-N5?j)BLSd2l{{#%0EAV&&xf1Dr{4qxZQ5= zL(D1c=mH9)qTh-=!wPQK;G!Plb9%5!QL&)AKmk+G}epRD9NQD(&9O0C6ZElh(DA_jLN=MkxobFd(kGnzu)+M~#d1*vxjpI7N&Q;y&0Q(nt9Ov@ z0UAx~93%#q(<@Bk9CzjhzLPRMRY32Y!M4>0SFb)OeWL#Q0u->@`-CeGuA;1us}BAQ zc@mIQK>2shoeQcVJ#!PiaLyd@Kj_ibnQy2+9_9fE%1-skgH%88v00xH6V6~l&y7;< z3z*+Y;rwAP`&tJ>jA`DJcZ`7&@iupQ%b%(G56`bmS<#9BG;0CU_T(luy zt=;C3Nlc<}xz{ z@bcSeLnyAw`PUGAL>*F~12pf(YnG!XZdkkO7$`Hc?ByN%$Z$rECfLDLP%2`Mw2Lkn z%iuczcuO)T(Vwa}C$&16nxS+qnzVRQ5p9I84;?;p=#nva%=pfXYl&x;$;i_ zP|dt~6wqbsm-{)G2ROAL$rK4<&wrWS4F}$7>VLjZ~K@NB#Cl zO&Qzj{Xrj9Q?1IwthH&{H`*sEN1LX>TEL$T9bDBnzAi-V%H>rqOSs{8i9DPnOQEm? zKnSNAa;HMY+M##OP3;`0pT=G%gsg(SQ~>24N?A+(Cl^G2rTi+Y_Xmo`>Wi*@@Y*8% zxO%^0U>2&c=s7QU*VIcq8^q`sm^J3$P#9i9SGJWj|-YQ|Bbro{q^IrwHjL#@aw6r zO5(p)w}zsz_FT2}`msf*s$lq^*3AS90U;2;%8zQ$AmjS~uU@58ERcbWhv?f>K#BeL zYN8qi*%SY*!e{wB?9^3;*7vWVA<6l3`r<8_4JXqkECB$U^#wWOuf$1XFNlXZ{n58dU(CAELUC!&Oi-&kb(YyL&bkw zFG94K{HSTIT!grnt(x7Mt9azgH#FZz%{*?b|DaQ#z(AfKI!4Z}p<~>Ge#1Se1*{80 z*9-3X((C!(%0GrhVCY#e9J%8rDwB&WM#Ib#hh$(WdygIeQucm3{$#|=Kl+eJTk1Z-(L@12&%MZxw-kLv=48+WES(PWIT1Ks z0C<=YX2Yy?Fc%$1$a>sE6N@S(ydbyNTznjed+MRp# zqQd(Tx2JkitUck{ZkFv%h>+T$y361us*p`!x@ITML#@u!?BZJ-!@DqEXFzk1cNoI{ zJl=+S{D?*ZKK1{XW)YK5yzt`pzw`QU#6SP_sM{sCSn6GMftpB-*B5YYd}6E1T{V8s zBM)6)8@_GeJO87$68vfVhG%-%V?Wnl^6Z65%hMOv_5&oUSnJohv?fUse?PIwpgrjj zbkDBTKUc**{+~4@My+3;_M*cli^%=z;`psm^74d} zCj*Zab%E6QT+owC_c5m2HMR6aD{F5vvrm4M^bRUw2oc1;q9jPZaA_vxsFaP~U?%O27@cleW3dOF$d>Vq0Zl}ZBVHjH ztf_?4md<5`q8EHId=*llqXPIzIAX%~1B?b5_S~HV>kar}&i$g+Smv7ZlTat1QzXxJ z$_Fac3X5RMSd@80O63eVgMA|`7viFSV3ZmRpY_8pOoLm0i@%=q@I7J=7Vq5YX9ffA z{>R`WG+DU(#C;6O|HMaLg9l zl)V7Zh_060KjCS9biA=f=azMILnJ&h}h zly@(WRadr83lyzrB*7h*#Kz%c#TEcwRZLH44Gb)Vv~oEAv$QE>6AfHr(F(C#@+ zLJlGHE;Y1|WL2(ysP_V;dWc_?Nl(dVTAaYOpjag5{{*~1y#T?AsgabJdOGqoA-oeB zE0oxN_!V3X&c0eE1?A93*;A)ACcg=udm8GzJ~h))e_kxCET|AT%Htl--e2VXnV<@TsN3YA17M0e6&-Kk=YQOE2LMDBtsJQIke# z@?QDP5g#LZ(1S@bh&gBDacz8F` zRpD-jIg8-ap`Ym@6rNlM3=JFCvr)2b9N_9ODp{J#8`v;h=Es?IOxlxNiKM<#Q9_2M;_jSYUH}t zqe$Y&x^->4;JRt+*3Xu{ylQW~6s%=u)@ z9}!qmL7OlT#T4rTQru(OPi>~6!BlKwMiZNC$FYcG5yvTlmyw#v=M)cWYQ~gfFJVt> zq~`S7oR)6J2?icV&xW6Z&I8CNu=}8Y!-3V5*oU(pJV!{pyvacr8HA5P0nDoEQ%(JY zi_HlS4K2djpeQwr8f|LDf-$pdJEIqbnAcQ(`R2Mwiz8zq+ZHaqq%>Mu7wuYe%n&tL zfGjDLMa5%lx}tTse#w%qZMbXkq~r%<8NgEgk(yfXgz;U~-7DFX3+bnQ@#AqBY=^OF zLbS7X)|dq=R(4l+ji2DHt%>*r30Rp-(iA+JEy;u?keU%+qc(@`QA$BS9Orf!N}fVd zAL_Iua?ljh5MAJ^c}*yLOiMzDF9{(p(30MIi+m$<`Ua+XOL>c2D0t=$9GupiRQ`FA z{BOl%>K)}7|3O^Dzk_}@em{Rc@>6mR)GzU+fJP3!_lP56}Ebt+|2<0=uUVxPy z3)N6@44izF$8~7*yh5H)fjBg#!VE4emB7mt}4}d2r)5g#{ZnU8q)|NhnorPaQnz>S+LontCn2s+La0 zh$jQ|3fkihRKrX7xJMtz8qh?orW`edrfqDgrtxfxOwvIr^UxInxzk2wXb_tKnHl(z^v|lS3R^;C5-qU z@k^Q^e256y0(|hy8uo+8d0&n6hRC-))pyDz3Z=lgVFfaOs{79aG081CD(x1Z!z{a6rfg{`f{nt;>Z~S~76JTgmet|iqonNy9qSRCrj5SG zE*k8okuHXMA1b|YZ0qc>KB6<%`;DPFQ>HnqYN&4EGLuv20mv@Zt>Scu^WHjG$A{{M zn0_!1B4y#@2tE)shK{KGiRKDSUb&Ams?2};;|q5pJXA^P3}#c(A}>+?UHMSdS`A5u zx!-7KdwaT0vc*icx+RrkWvS1Vqu=l9QLeTd`z1pXyttbcEn$YF%gs^<``o$khc~%U z9?(+A$FHjL21BG2Kpc=@FYF5APed6YZ)jh=UwQm-OL4H}p<%olMV739mlk7y|VeJq6h({N-N`F)AkKU*9A zZncuEumPCb0)>TTg$*!DALN=JPBdym6qG@%J)>S~Clne0KH`mlb{f%P!tPP}AjxA# z93;`Q1V$D?)kIu!LsQfhjw9EQ9F=y_B1`piC?(juo)nIC0- zDn9&Z<}dFxHQlKEWj$Lbgq~n;oLYO|eW)MPm|++FFVI|Qe8Ff4uCPwVdtGoTV=nn! z9Mg!5}_H(v@l9y2_n5lmXZ?=E&S(lJU6Imo&ZWZIn@mAKqMS=Au89C=0ru@=+;YS z)498q9ZI9JWB0j$+}686F?+mvy={HRr$^I7WzrL;!!dIDMD^t8ryc8UdcBwRSe?@Q zeCZwRQ~JDm!Eo-)4?J-5xd4^sKe}D^^(*(gg=;zY{*Cfo)5#lh`mXYC@C%ts-TPOr zx4Ya5jAH>O zc|Naas2cQjC5qX ztN*_ zp0iX-C5(oALou489mBshd<ac}LWi(CgsaDL(eO*GXYH2uLp{vr@SV&-2TX_wJ$c zu;DVWH;0OocbL`LWcxFSsKaT)I-4jmq{X-c2t|aJQkL}QXiTVMz=F`J*S(Tc{UO0! zi%CAn@koN|GR(ehQJ(p;)$Op{@wSOMEh&o|_Qx>8!DwP- z`FJ}oaQjgCpV#o@Nx!OH&py^S(Mo<6#&dsVsr*A}PIAih}WFPR&w zCRp$^BQjucQVv0ZvdTb~5Y%*mLkorYIJsDrg^}#t?y#MKoS(VfIorvSE~hJ+Nkv_H z1NyT0bd&Z4`Byk{k++vY9$qbIp;T4E&6tF`tlp*!>j)C5KxYI&p)K>A@*LYD^nxH$ z?vczftYFCQBHl2#E4np$pk;es%l>Foya6Zs>Eu9EYEz!e5Y{R^h4l>CRPYp*(qm5H z=D~}jc&KkX?%Ns_4@L11PWDH)q8*0URaN#UIU9C%a`k~+cScW=kFDx3OHQ<-c(1A| zhLPT?d~EY|Lya>!Q^W8jeqE%Xq@>T#)`R;Q;n0=BC`ofPQDBM+{rFksZ55a(iGAa) zU*eU+_dJAYMzc*kC0`CJJP^FOO9?7Xpo<{uSO7rZNrA__;wfikngXyqdcC>NU}wp6 zrPBc|2Xff6WKjHOlr*OB8%+b_HySNtDX$lf;WU+r55_k%G}>I?y}14c>;mc66GV=~ zB>p6tL*)LIuB-?uX}lCp$PRoG3NBNh#Q-2Qmv!*o*&zk*WvQ}QR7jc9RyUZv;eI1q z1myA@D>js9##>)#Y7`z3u*P$CtoC0yo8w|Q6F271w2yF)%8KD0_2xTV;x+lRX_)S7 zLESy7mmECL$tj(~EAaM1nhN5QP)RT+`Em;B3)pSP8(VtVYgUKyj>BSg0P|KE5JF0S zre930DlR@=+*Q0v=*uq{`_A#ko)-3hEcA%gLXTvULWp5*D*ZywDm-z#xOi1heo6D& zsfhffDTW$dtI)HAE!7yiAVDOsdl1 z^kJ2l>S9UXuCtekeIpWyAb)r;s3gmj-+uKnaX)3%EDkWLFD+A&-j7eww|&#xTfkW^^2cYa9_rm4Q zin3x4(yLf3=0BYT{IwK{%rJaGAcrfB}x_x6~ z?NgR#`|L{eSv%T*Hvmwtyp-4g+;<#Yu-bvpE@#a&$atCK%V}j(r9`g}0;71P)B2$A z^>07GDy&Am=Vx|<@=_YGAKMS!>s6Le->|zU{Oc`LG~#QV)<2JRJPc{DYNOS8_y_LC zl{@TCrW62$lakMd)^-st?P%lI2t z)Hp`>W4-6c4x>S@{PH(^%>AB~t9w+1&30NhSzJq;*3A}|Fx76iJC$XzW&Y(3cE8JR zb!47(SvFgpOI(&s!0&j{;v!y#gh|u^kVZJ9B^rTLKq!cWhf6jz7>B3{VIyUy6St8` zt}7v#!kob_%sj7rhkZ`%r086h2XZFre!9|+So+}e;-=^KDM@y(a^Sx%DRgARg`+6@ zF2u-VGLQ-ZWzz#K(++!YiRJ=~3|GVj`!3)x5$zUkh)3uGfML}Os*EV|5hF(UJ{A{; zN;^ys#azEYS4VvUT}QTW$g@cuN;(_~!om}CfZ=y>M0q>J?!6&0ot>C}-$GouFs%Hh zTmXOk#{D|~3BT@JuRegi$szQ;LUnyKd=u@?UxB<`_Ui-kIc(E;I{yK`ZY?|iTsd&P z-Ds3oUP!mxQvQ9=j3s~$dYyr~$?Q9b+{-|eMivJd_6zn%Diy*g%^dgph0WMnjlyQm zYvbd%&X(IOX1{WrZT72MGXRGk%-(<@szG$F^a0wjK{JzM4tXi@39NXYNK<*-69LR< zHA_JJax@?fIF6fq^$B30HaB2{+{uk~5)kSg_1^k+EuCO#z)8DSy4iVj*ToiH!~Bac z@4lm}>JH~j*Yjl;)*~sL(K7eK*OTEpx-0KkaM|Wbua?%#Xj@*tK(C(|>l{C&ZhWb0 zMo~pu{jBOKI=QucYE5gb!YQVnoLhYCh8f$YkM&BY2iPFc51wjZM;I&Xyq~eb&xB70 zb!DyRW$vzMsVFjQ1?9U8snP5KICcCp+z|F5YaW9djR7^>S60XQbPOU4qinn+8ToxO zNmqH=nTD{Wfv@awt2Of=f=NR|5D_7WgKt``%4VxKRM|4nPih20e86-edqM8Km6$g( zF)F>V8F&FIKjPI0*Fu5JJohBIjc8gc^_8vam+bbN) z^b&a)S?@-wcXYVkV5Z!+PTi!3PaWYx6x{?3=UUM zy8MhLFoOTujq!`V*3tMSxoiS#=D?7Pp0%n(Q89qC3)`8F5QUBrh37*5=v^&^@-+(> z0htu_oq#P)lq8+7G(S15;V0Pkj8^Mm@ObujJiy12bM!;%^Wpm2hU;Hg%d@u!H?ron zhpV7{3eP3fX1D@MX!O<)`U>hiqBVv!FrlFe?i{Tt*v_Hf&)NWd%*!uj=XwWu1V=%m zC=E2Y%d?O9C>(f5K@*3!6y2GKU?CtUfo5X3XhJ~Qjcg?3QbPGiIU@?a)bx-J>E7bj!{QCXu3mQVoR({~yqt$+}u$pqisO>>~0Lk}B@ByTU1@@rY z>u~r$XBHw_V;CUK2l9wfE-|f+u$d`;80<3WWT;92N!SjR2{H~6qAwgjz)%Q~BE5t{ z5sXHIfmk23I8e_Z=spyPNqq^MSm$uq;)aRIt1IR@rrxz|-rh(cR#D{NJiasR3>XYL zQ?c6>sGBu5Y=Z}>%ZU`B67$U8nWmTEokDOZfCCqnPOb^fozyaELUjAIxk6bm033#B zK)9kPDhNB1%fimKXjQzX&F%7()mOHa`eSoz%C&yCm5&2z3k}+W{3v)^aQ~O=ST2;{ zqh1e}hLNfmPB0wKxK4n)$lD{=B-9?QB4!5iAyd1#&(;uI5^TqO<*$<7Dnfn947Tvt zS#<%IyV#^N7y{04=lIS3qKa4`vUlFHyQVtkR$QH&Xo%Y!jyh4ywM6DmD$Evdk4Gmh zpTE=U_G_b+^J4zew#xc4kIUUw6R(Q4Im646I|U(HBwPXSFjgH1mI-sGZI4bs!_5s5 z3VlxJW8l7`)tX5d8S9bLfPC=@;-9uH}`2fVh;~5}+A$u3Um=pMOMiBA#5(f+jB~MSC zn)!Lx?D_0_9r0+`pq+|DG;S}OtTT^^ggZJy6=Tf00YNken;J_z?vjl`&(-CAEmN*Y zCIyenIJNpZr0o0Xx|%6Qw;Ryo*9)=h0Xy!_Sk9T#&@^8c(nn0QS=duDz9H!G1RKVe zc%JC!;BeL*S`*&RKFe1V{`u~DM2I|G-q7&DbY%s5VEO^&mde^;UG{pRiU8kB^nWzuB+3UUR4BQ7)%rO`tFm8O&c}Ju*E2W7p9T9;I7yo!5lX z(M02^IocHA0|sI3XLKxj9>WcSSUt~xtJ8+~5J5C2jfxN-A*?|}r&Io+23KzE5u-v> z$p^6hGe@ZSLfq%|`r@qnoO1>zZdIP&vYv%jtSCiNV75YUt{d0P9x(tvw|d2j+HuYB z@9tg+vR3!~V7#LD=YyVw>~Aj&yNQK8!ugN z9UCp~oxz?gj&*j#ii=|%ov~uJU}aN%okhQriOygttN7OrFRS%-*41?$TfI8-OZKsH zO_fIsv2DtwH7}(~ORJa!MK2%;=)9#Q0e- z_BW5)m|^T*v&rE5TV+7}mC2O(gmsyWM(^LM{K_LvffdF7!z*rZDzod#Dcu7mwar$` z*4sUU=djGz-40u=a6w4CiClcL>lMlWR2F#kgGfL)E^!$C{h|!XpPfWluYi?|c7qNc3!frpzTKbdDdEx|9tNx80$qoyY*K46?85f0sW& z!7aa2ZZbRGWXiX!R!fDr&>YFc1tlDTfX&`!!oS+D8#!ILKE()Z+kfC_7D`;pT=h~J zBhY)eOM-}%pyjLp^|L}=3dbtO3hGJ%;x`FW2IZS?*ETc@zhv(z#m_v*Cd`@z?SI%G zDz$1|ag-7Xu5}ewtF<)b4}(GsDA&ELygY7vMMZRq|I9nAAvVB{pUSXJ24sg9wMM(o zrY%~PNZvB0^154YNvyzv?6VoQqUfS5)sk!s6`k=rvd$y_Iq}U&@DFME5PHT1kJKP} zEE^;b^Tc&c&>7%g!ecN)VEqyZlqJhD3)xb|seD(iW8I2Rd5A4z ze^$P$IK@fI%gP_wWaYhW%I|O^7V&L8tQdZqg7Tj9rt(MS6=qfbuKb7c6ILP~P=2EP zosEO=Vggafln`{`kuTQ?GZ?HQo+QOOT z9l{$Ong7}-Y~1)3dncttGLMU)9@dYzj8x6t-@Ho*98n&*MR;;==JZ~1Z|3qI;fhoD zo;ZPVIc$SdeJ>VhHsNXxx8JS}#q7!uNUUwQid_t{L=-8{Fsd9E_Udc(|1mz31cb(?I^6JaRZ zOzye$B}*=ydBfR%5-yO9@4d2IXr z(+>fwmj~Z*h2;hVYeof&)GC0`+b19}sRuI!+(055HHC{*^C?{$8X}1Po$Hc}qp<{*!Dk8*^uyoeAHZJU8U%?shoMt&Xib zYl<(OwlbyH9~UkQMhyC~<8{XJKyk#ND=F6NBZJPshK^b8abrb?-d)}l>3Pm>xa~G= zd5ie;1B$=2vDk4S7Tj(w853+Y)IY!XJ2L~drKL7goinzKq9^I6`gfQW4iB zl2x2%Fos>-71gXdzIe8N`N3XMNYqZh`AK(2yynh_YGNH8OI>;CFJ22*)VG*q+r7%> z`^<8{Humn%zh7QzyVl^S-u|WnM2=W>gQWLXXqjH?v~2l46QA&xl}Y1RW&YR{?x?Qw zy0NsUFij`?*r{2|!NL28 zsjd^jAOi;(BavJnJkV5@q6Njrx_pnV*!;-$`QZm=?(7`rmYGiaFE&qk+!E>-H~;02 zBJE6QS+!@+L?QH>z_N2MTvjXVl;wk&Q>BefNa&bv=T|ex#<8>^A^`R?a_9izLs%{U zRyz#ZBUff=dwWf5MPreXAx*?dJ(G)?HgsNDz3k3))2?Or<+tCQr@YKpImX9s`YD@k ztXaBwY0)>8)e|o6og%Pt(%Ag!lmACj$e`|sn$To(P86!}giq}j+a3JN9kL(9`Y z{Ef9%UIYG44HLEL>^n)PM^>{TZ54Di;NP@qDndc2gsadLfSJs%0vZVKL>I%adq*nDoUyd%E&iq!a(OQ%d)xUk{) z(OY-yczEWP&E>UgH_q6-y0LLVWXd7s-ICJD&CSscan9_=7?KCFDf{<77Yc>TaU%cy zy(5Q9OUuirR3tkZR`1yN3+b{+bLLELcAB(Dw{0CG+Tm`l`qF8*ueg}y4qyR}!j*y$ z0Mxzk?aWg8)20S@k!zRW%qtMWj59&|43(l zRJX}G;SP2*@$+4~exA6>qSKlWR#hD|Yju{)(cDwjt*ux`iSPOxO`=Czlrud(#EbK_y0L1SShwjawriLP+%D;20XRBpcdlLLkoHhta{ z^Z{xF;tp98FCrCAgdqm6q(YM3jowOiLFwCZj(R6>PGxJRo2b$0UM!pZ&2S<>8&R`n zUrgV^M@nVkc9Q|AcjZ-*&4_qD$p(`w8qDrlhMGW8GnNH=QI#WB9u9gff}qu! zbQZCAL9^FW=p|LAIrKz`K!ZhG)m9I;zuz}q$8H2&*a%a$KunOLo)9!W|Th6I$ zoiwXyoGBg(hea#1+5+~Vw1K&p){Ik|XtHRPZl(uZm)?Z-H6oK4I$TihaQbaUL3@d@ zTvsiRyTI+9eBZ^Df>e81UA(Ofz7Xx*r4?S!lybd@%#`(wOq^QeLacmJF0J$!MEwC9 z1W4TksMIEu*=ouJ(PUsHE^jHTs*r3}vyWK=vfgKd1B`>24GzQqOWS*Z$5EYa!+WM| z@4c_KuXm)KB}*=Hmz!{J;EH=$7dkdzzy@rv=rM+bVv4~K1p*-uz`UjeUW!S8 z03o3UjIAAi_nDP!;gG<4{nzg@J9DO=Iprz$b3a-so`jY9I1>j66mTJ=@l)$fIt8a- zfa8&};F79ws#SG91uJvZ7d3mNzp6COmD?@8dbisIw|K)Gbrxs4M4>B)vAXKw0(-Mu zFK2j#tW2*P9+68698FNSO)Il33nn{_;Vc!KV{kIS-w>VoX*u#mvr4!&8GV8y#^Wl3 zoNyfBTrAIg#z^Iij%YMePQ$|jqGkzq@_DtxX0-zLY~)PsF1^gC@L183@s-?J4nk@) zXxVCm$~IA@FA9egYEEek1ls&&p4I4bq;|DcrEAt26jFy=nx$o>d1Vbz!&7DL0fk*} z_0V+QbIY5}SCuV&u6up1g?L;!`r&}3Di6xhT1ghHCIw(Tse_keCZxa!8>CMEC@gPmB+B{eEN#oA z1IAc_fg+2Kz<3QQEg&oBsg)HQoGB8eXNjW;IHZ6pDjz~C$4PQ#GK{|bx=oh`b&q|v zz1ET?{889VCXFt+_VV?SFlU^%X2a!uS)_n{=YRe%F?-2%{a;~HXGR@9(J^Ypfr8_`djf#7FG;gj{on>7Lh|!^&$cLg14JiQ18@Y;(tRcsrUG z3+;eso*#O7N`aS=bwnIyon$&@w6X#g2swm6!^;6&2#s}x&kI=yAv+`PiDpH|v|Rwd z7_Chj>zYZtg~AX`Lo5c=K`Me|#9587gAgM8 zsU=O3_6aq+x~*BG8%oC%=ahI#O20kOcJY!%vgm{TTjzJST_v1)a*2NQzy{&z26?Mw zYz=Djv%|PD17Ve!3((nH1d+{kg36>_HLwOjNdpL5V*u z=6|HfKUmY*pv6QRmWYl&qh+8mnc_e+Q7Mrs2td3+mLH7y0U=4O)brQ;?-hu4YAon2 zXoRmw@qPYZJ*BY<5Wu$0BdK|9;HDCKwmrUW+v5bdkX$l;yD&#*1abG51&xgbAU1Ux zb!6{$;b3k>%ws31MT>-#o$a9~Y|A_=ctwsQ&Yq%!2ZUWXT|}Yx++VnbQD=kChukQm zE0T><5$KBlSO>8v$U24N;?uB6nt}y+0ebqEicfM>D5AgY)k3dW-V1sV^3vJoNQr&a zBJpEfLz9H)gYk>jT>&+=S#6;qV-(Ai>2UrO#wOI-Lp9YQd+mhm0yu=YN#_hOpOLq$ z?L9sxnRNOI zjpoF3Dd1?Nq=(lT)F)18^w>*EGJDnP%wFMT?A2>doKTD3JjFkScnu?3s3c6sH9D+G z#SsvhI>TaCS~25#c}SF$Da8i`4r2pcKmRPRctm*N(ELB1MmX8lt1(|jrVAGx-$zr- zu6ULhZ_G0o{S&6_I(gly3$lG$*{67$@<;matPy_w=2j3Nu7BpmZ`Qp`-1}}Mwm)r@ zGTGU_k*}<{?&PjgqfZ+{pU&8%Gd}HH`ZdI%3S+VV-*Eir`nb8|5H<~F?$92LJtrl! zJ4>--?h<1JiKIVCi$pIhx$7(s2YNCi$vWLD?SXxuk)pxS>T{t0Bc@1f1{fD%mj=B; z;XosWnIF(9N?{074C0VzbMT{43=jkn=!aQWX%Cn@nvTK|UT%DjHzyls7Ntt(v{h?$ zkDA?f&?g&Ss5(v`==gmmFs|OmcH9TPRnvXPokB}G^#oBq!5}5`!PT!K7QtkCme*%z zAwPG2$`y@jw66f98#n)Tc`w2!NhEV(<}$+DjO3yxop;e=xQ%bQsx2+kN)znAayW6$Ci4qlA^oC@uqVxC@94?~JFB#t zbTC$N#^8$9-OHxg9m?S1`8#T)ET_vMMzxja^>TBWPVXttjkz_9)TmJM3<5VCH5#Md z8h^YiZgy#93B@mf%WUiBbrG+F z4;Z|sM-ba&`ZK+bYeOii|R4-PiVHNXH+FB6*2!InG{fP0yA<503J#ROk-<} z*re(pQVIiHP7%pk8i5N!42ldDFHjEc5*Nj#@f}fyYvLvaXu%m3ow*%!j)9RDtFd{^ zN;wiMdSnK#*86b&UzRKyQ&{-w!X-1HBlZfXcfBwCuU64Z$gcNcD~PmT{W~Eod@OwX z`qnE_2gv01hI~${)k&pSyit&!&+uBMx^ims%5e^pJlBQ?Gf%3w=Wx8!UPH!DER8Bk z%AIm|sIKnbiS8n`&%OTZ{y>XP>+}bPWx4ihTs+9vd|F;LeQr-EaCpYFsV>jMH9gn0 zXl?)4mHFA(eATx3bxo@uUA%&DsRI|cC$G_}(F&OA+WHk5ElBf>RSTFI)7Mwv?s$g! z9u4kp&*n9wdeSRgPGgCy>rnHsxKZk>D3m%u!f{r%SPlz`iRO!^Gz3wo@Q~UKASs|p znM26XjDgaCXie_?gU|l{;N{N*g3kzh(|>vxFm*2e@SoBTkC-2kxccf7e68T> z7tWjYCb2(3hP{!_5k7fy7TMoVKJvaHpnJl8NM(n0kkb%NNVF^!RizS`MlkbYEY>ox zo`BJov6a(xp04vSIK>Ni=>41)8V-i1I?O*>+L5Jnm0y=NY5M$G(?`|l4ai} zb05i_8yY@+(##2C{mY-fWO=68P?#bXkXFdHkh)j>+6ek`gLtm^RV`%%XTz7+D3Oz z8rxE?({WRsGFyGT%E#D7Ztkk}8qs~&YcG}AstY1av4oRYfPwxyTz3>nZWiOKLHqq)>>1s5FqT!cnZjT$io>v){#=BbB;qt1GGS*1GmWAB z&%t19AH`Ow2g1hGk^bj?K|B~zMNog{pv-Ih4;cdn{JA;*EpNa;bUhgw+xPG312QtX zbQ)xGi=-T*fK3#~AfXu(mi224wJiu1$y#_nBhY* z?N1NAx0fjPJxp@yww1qs5r~VnzUy3`LjI(8{dQJmaFo_hZya`>On5()3JPHE%*d3Y z{4VAjBJkF+(2p_2V93OblQHR1l^OFE#d9IPn|^6L{ve`*S1S+xZA@Ndyo$Rrm>bn( zdAC+Ca4mL~b*L&!bTzu>o}2&j&dH(vBX;YbrE=jLQ%~hP2g?8Wq*^x3-eYendnob0 ziHBgAc9G5fXZ*ve+;EJJ~ zrU!<`Y~@l<3P*n1t2Mp}7=}V)`*iTvs6`=Jt#jIt(Fbxm8m|M=kARQ|rmvt0%^yj> zxl-OAVHRI-ODd@`$*MX#s}Qb~Ox*V~NX`Y*J_Dt(3m;`Vur!6dL3z6sh6)Q<^GFj-iI~arAz&Pyw!emlrWp$-_ zp}bNZYnAnfmWI4V*A)qGL~@D{tON0#93{ueQ3{piG=7I=baJ47K*L2e0PUk^v(nN_Hq_^KsVXqabL;TRA*y^fdwtP8U||3%%{Y4=vh##I+~ z>Jq{W3Hi91!VX>HMvtX-Od@aJf_+YFO;;lC=6GfYfL`VD@$}&MZ5C_I_?o<%7u;d* z?jGlQl| zhSFC)I0?YGN!x?8q>fL7>&Q?L2@6Vzz_an0jg2!4pDI-6C@W%YGFFku?(d6L)P@Tm zj>Nq(RG+Q@?h7HSFnTd&t>j9uqcNq`_YX%#E1Fe(MvxfwdXto>Yv)%Qey0j zk+MS&10M;|?h;B^q@2af*$l)Kh9@n~*|<94%MXPs-}ob$_SRd%rzHLvdtW&H&9$p< zC6+(Y6s0Ni9qCCj|PMBy5(bAJooxH476d1n0HDI&v_AL9~=?{dP|bgwBak5^Q=lfjY7T})HDR;6N|8AhHZu`6`CCI7&a z)qZ;IOB1!)=&Y)X4JU9L+Ftk%#5q(#{Ir)LzB<#hLZw+Y8Jtv@0N+XrnmT|LI?BDrrNiJgMIV>QbpV^ul?g6 zS8sh^IPw10qTy4!!kD(tj1x5OH6R%&dL!^bvZ(b0`Z~3*m53liw3!k(9jMw@VogwD zn@H3IxCMnJpo$<*fgcZRqPqtR4puvWt?OVfJUdEYbg*)*dVQVn&pJKgw53IB*Az>Q z!m+aUc)XqbHr`%_wNov#Lt7uNf1VbG%bo9c9%e)~n_b2)z zS*F+3)#>z7X>qaiHCzmBsXI)sS=LqD66%%`SAMuG-X1S0<}JeWvhHw8aj;6~^6Y%! zg`HUrUF8#JMwUzm#~4G$Q(8|MTd)rG6coo((N;y9Ev+Y7O<~bMO{+(&Ct6{&qEI=J zXabW2{5n5fRj6f34-Jpl(5VMf5_?diiGLo~Xm~xJ^KuTa7leYkg8XDY>B{`R2?&O7 z*-hmKNxqNzU5YGE8n~L9mU#1WYqFgDmj~|oQtI%L(xD3xn0z=?h&`(>c`^FbpfQ6l zKqMbK14|KK5aJ(X0}tWj13;BpA_Lbv8qkkmk~6zk_O5hCTzgh@jalI`n_T3w-Snrs zX60=w$e43%>C9nQ-KeEYMhPF8T`u#QbzRGsjV72(-KO&Q*KIPp+@|$T_xjNYUb^pG z13Mj~ZTR31CYuv-sfG-`;y^)vdyJ51#tr zexk0e628upRT7j{d<|gw%BhSYB(<#F5K+H9`;|;8(G;YFn9Dfnt zV8AqTc76Dt(w~#z>&cBTz4THSV@dy=3>O}w1vfEf>}eIiD!HEfxIddYjD5?5t8h#! zbC`Jl1UAb4uG_or$P}Jg9n!z3T`P$1kwmYf6)whn3|Z6D{v^d;Ln4l5#faO%%*MIh zhqHFXb6xJ7xbUxm6=u`@8_gzLV&aBlrHvc!eqdvJ)8oeywHsO6&>Cc#Q{9LyHjpu? zDfBm8Ow>=YBdcae)7!IOHZcpZ8R~xwtK`Iw>sKksKCO_wgt=p@dd{M$C~Rst#Wl%mQ`*2euFzN+Y!(PRk?B*lRc{ckhUVvz~+7*JzTDEd29}5?fTlJ z@I%r0ZRA!qSXo*DLV{5ZZeduDRGF_f9rG!(*|h`+B*M&K3tLv7H@sqDqSl+J*N6Ar zcjWr>82G~Yu*{?OI>J`Jvp%~6Z9=K{wOcinwHC%1pSI~nGv{1t)$45RLakM!1VV^t zvJ7FXL1$%Sdgr6P#i0Oew(E_iyf$Z+o<)#{FX?u~VvI`n25*t;q!8d4Fr4Rl{muf{ zScM|rO-KisF~bsy+VTyRrVgDVKH<*ia#@8^VJerY`o}qQedPree7=eesUIj3j>1Ku zQ^6LR%V=cGN;A+e=?!Dm(qiE1>6J4&t`XzQKY;@+mrO%eB?*8S8EXjIi3lG@8-ag> zT1PUyOoY^do`PyPu*(Cd0QMT30+cUpM-e#YgN0dcPkh5s;qSsx;p5j+(dw=dU4TaTxMo8oD!HI zMyJ&oq@0=*TJ!VWW5ph9nGFq{NkVGd>IfSs$X@gE9m3y!yLiPPh`V?4 z-5ZvTNP3j=usLRTPad;3;u-1E*oO^Ywdo*6GqAV}$Pix4lHHOu7!P!Ca7F1Spvpla z0tMS91Kq8)q@HDMkg0(C^szET?+_Rva0t4-t(@ix!WmI&PEX)iFtD)+AN8mJybq8! zWo3#2)(BQMHd@cr5t}%0a0R`4ybbq_*Dq}wzh?3!A478$3;qO;D{EIera!rS}GJvcS^Py>|TYrTPiKZcyK#3eS&(>4A)q-m!fF zy(9j5n+{LZ;lb982@3=WJ6tv}rlQ`prcllYx1v z{)$s4m`Bp>+*@-Wp8e;!`NxC;rdBw4OL=VTt}6eyQD4=|m2%GQ=i2UTopJSeoiD5; z*Y}^)rVC^mklrKS2kLJD14XwQR2VO?hz~P+_&76f+O z1UD9EkQx{%tJepaAP{f>-C3BDO1@-_TUy4DVsc!kvFX&TP3J^69sAWIy7Fe=B)K z@;)T7(+G|90VGg=rX8Fy`$I0GF`k2|g{5HO{XcE9Khr*buKk?5pSCAFoY?+EyW{`I z>;GTd=ef^w?lzyK2BA|Dx+HxW`k%AxKmTbh^-B*tdmMuXJ0va8f4cJ76T~&zjFYqh z{vQ@nIPiWD?OakUh2v*V6~6wt)d$ZUFogH$XID>ATA~b}40HBDfA+Ng|HH9EE(TeI z0iH?E_3=IMBO?Agve@K>o2wGOR z(3=6+y(7HS|GWsTO9?3vT310r^Z@sVAJP*(%3$j<_LLOtT{`HWrHE%7gPw?~mg+r_ z9jRUd_&&s(0kH>Z)Jix2Tg7}aFfs)LG-*tD$kEtG!c;RF5T_uYsUwqWJ2uo{*}1+( zxMy5v$F>%6K`viKjE@EC8*`h#sBcWSKf3hpqhxsPq)5&BPP*JcW_ONj+15c9T&!l% z$QAqA=yGrR*yvSD_O*{*z2xS?XM|5z6x4cD-II4sIQHvR$3`xyY2Uj7%eH+h=C2;z zzHiB@(d{=cfo(5|n65sINi;ST@)?Ywbk<3jGOvm^W%`!S$Y(-G))Zp$XDlDT`<~t7 z*)OkoHr)Rr?N)3&{OmQUZ*IQ%8+DNhOg!rz&$iI-kjfA8{@#bcMJTGBUj z_iYgVXF>Nf=|__Z(9+4@JW5QLzIU0yyJT(2-G`oP>%96+chjaR4|iqVwRXh%aaGQN zZ-_4__CGJ|KY4hQRx!`dIsPwd0}_psc=!Sa*}EXAng@P(j2M2DLs!h8(kW9DTVg{b zCyPoM>Ipk0>>!&i?7eDHw0&IX{kN|^@9>iw7-jQtvX@-HC3VLw7r#_@xvH&rnM&YV z79vRhcR%)m3D@-hW5u#ta>|xgj><6zPe0Z@U3lQFW%IK-hAGY4AGmkxC3pNb5F;0? zt7s(3PQ0I}Yl)nWGWcJjkOR)3B`9(;K;?O=1Hi~aHCV*|4!%Qq!Ym2W2(tjx1p^O_ z%O(=pN~8r>y>Qi4FQj+un(uPW?`-h-Zs@RdnX^{4&S#H4v}yB04{hG`&~D*hM}!gT zr?;R)*DA-ba+@6&|HK#D*WtGz@tjzwsk8`KFrG#+`- z5LQc-7OHrJ={KbBC}Zi{(|$)$)6f=07#CmzZ!hm%wyamsuk5Or?kFp$S>v#m)^=IV zU2K2GGjgf|bYX8Tqj_c!X9oMHg(OF^ZJinzx&v$*9lLN@M`iJsNIF$**kVT zzjKEKY~!aVNWTE)Sp%zVKJ?@fltBt^XFv?`wV*&*UC@|W(7P7Utcr;!uwM}7prNrQ zS_7aG2}e!PdA&T%4k|+cTm&TvHk_cqHNG5Dy_Id&F~U^zeU(h72rwh_4qaP+UXhRG zo~eppC$ejr2eTG{K)#HpqEE z@fK$SNBuA-QrH+ZL!f0;6VxAV9ySVLAjgqrY5Ml9?1{;YU6Gb3>+eS9g^QHrKFh_1O$xC6bxt*_Sv@CAs7DRfH_Dn#k5n z1@u25ZbBZ&f{t=rd_M^!E6RV3_YxHlOox8-$OQcqXO@^B0ind_8d&nj0plnk%8*0o zbA*&cC~-ziWY#k}QCj$vDdK#V?85RRvI_`p!;Xj}7<5E-7=Yp?*PdCVz&Vc- zBEtFNV#ruyk>moGM6oafY*=FK5rueA$6$E^r8Ev_ury07HK8;l+7k!M0VKfTb!14a z1UJw7JK>_6a$HtEYx|PF90WGN-4pzW@W&f>7X=+M@479-_Nra$2riCo5+1z&PrWu@ zwom1`=-2y6{ydAxll#&+ejw74Wm*wX0Ymg2Yg0Ya3B0 z3wwPz@^EvlI(y1F&LBceBMs4aEuh% z;i*4`b&}7$ntt3ToaYt3@RCBN)l2q!iNTA$XTbj}6%uZxM2i`gX0)#XW`7)Fd z(F7vK2uy{5NYnCC0Q}GH$gCqE92{t+NJ(NsY%e{|ge`00+^x(m(Z+~SCYJ7|b0Byx z=twZQh1fi+NmeZGV@z>OIkYt(hcp_nDAmydiH+U?#veV=C>5X)A{vF2fa)r&NkQ3(-heM@gEEYzonr^c(YK_IBQTJe5D^-}y z3aOTC5#G00lrlYIG%|Xba=OW+l4A|qa@9dd-XTCLuy zCu%j(TXnB%jZPzxO4Wc6z-|u6`rNxN?Ek06=pNtm4DlM`l^5Q1$5)I>snsge|N2U) zDLclr>*WY%)l1V)lD`wBOr?-%$l}x{g|1v9?Fz%iV9^;;I{r3#nAUQ)exEvgl${dFuG0rse z4kn2ce!=PJJ1fz5F2R_DQ4^DxIBX7xGd7vQPxC1g3bv*$TsYXo=848Dv!H!b{R0k+ zOmGOb^8(^VZLl=vpqfEDhItpSjRhnNEuuhe804@&635@D88L=96vkhecM-U11vsLN zKjMa^>m&eO0C%NedfQIcDAmFr)MOToHA_pt<5gN+b*&dc+(gK7AjFs;wbyawo z)%KMgMOu#AE}Gcr-6?5w%-t+p>QR$Q^+_W_;bNrsq=Xsc^va5@P_94{AM@L*g_ANh z;grtUynKa@Va6}LbW_*fl9~K+`NeyXdnQt`imwg+Pg;F)6_T!}(@*rxML`pvv&Wj+TU*o7~HYmz= zLDV=~8vogvUeI#K{*;Ub@iXDs)c!kKgx9)f@eBig0U~9tUVb&hBlenM_*vb*pxW5f zqVyv2k=d!2+t~o3J(=qfrr2(FT4)|&K1;#))9)*MAj5N-$s<4$p6zd$dKml5>Vbv= z1mPK|rrux#`v&PYo2d+_D5wp%5eh+E2);uT`?Hk*Dmcf8dAyRxOLIt4!7l0`!REea znuJf==W%L;pAb%}TG%1H*Zkzuzn~gETe$F6nMuw`IXGZ%UAT}Kh;z}R{W25B;yUX6 zsFN>+k7zp(u|(o{lX?FNDuMozUMkiA6ifKGp`^g|NSPghL!c82rS<&zcg`ZM(=O}C zX&TjDU(_XBJ(cjQ*Od7x>U_WK1@G3`Qe9)#xJ--EuM;~Eg8r__KHX2fQx4+Xf6+T( z2#UiS#8LGM;dVd!3S6pR(npOSqkES^oc;yRO^`yWkDijk@k@IlwwxL72kkOJFoh+M zhr0{U4A2dLH=coC%g=w8ASGD`Op#&@Fq&c*G=Zic(>gOCMl-1taDwzdTk~JXz!Z`P zF*_E?uX*npxn)*rlr?Zf%=N}0{lJ+&1ctHSLr$Jq1FAM0?{lTKg_1t$Uv zBW3hkVWJzD?=tPL64_~||H7|DLBCXPLZ(Zq2vHpf-fn=p^iVp{3vE`t$hs0m5v7o& zB{%^(_s@P=0wIUyj=T%$S&)q7E2qvD{9vt#Y?xrD`Pr#Z%t9=POLj4>7Og_~o+yw^^Ow9b@)&2% zCAb1oXQun;`x9k1QKIet+xJhvb};1^zF8fO9mQB{qrP*5BO-jo4@vvOI%1#Lya7{&d48vLyz?3}H+{eE)=e&kL-c~re%iXYG_KKc~F5+@dTDxx4 zfmJ(iJ9_BBr>bO*rs@Wxuc{=T{GZ$Em}j4}T`GKit24jI5MO@P2jI=T;FY(9J;E2y z^&I%ea1uM*_pf7p`!^F#9nG3IW@7iODUZK7;L{g!&L@zi zI6P=@hVEwI!;n$XpEH^GVA04J!mWR1rU(xT5C86WY$?{h5gzO$dQ4tlUO`5t@8n+k zo$xTxr0--)1N|>q@+|!?1p;g-R!{&-&IM%N`=Kpc`rjeD4!wWzBab{X?R_#2^pjs~ zAx!8H*(KbVn|?3bmVQs8VFI>n2KkAY03`YMC^;O(gVPt`*Fc7ym}!$#6~k1Q%Rttl z*blLyZ6fX-ehw+k&R9aFO?sHP&&!K2(FnC(X1)n_WwL6?mt6Mw-JFg+)rwHwdp^Hl zs``!#XLODr(TDCL_S?zHKmBUMW%Km)>ZZ;_XJLt7cAX>?j-E zUYR?pp|P!NN&UKenErx4th?h=qWs&P7d&1b&0TR@)lElk6+XXRY8Sp-w{w=cP212^ z9&gTR?&@mJxoY*=o#!o1HkMWn%M|ROuPTnk1O9i)y-A~L5-2|>Xdsk@S1GY20KzCs zM5V|hi)A1xGiH^Gxn+5fz#z@MnR(&gq5n*uu>IiEUH5c7ed?>H-R`HmnMSf9Q}6=G zq>5!{Ki%E^G*Ih5ffUwahnt>CuW(Ss6~VgVm|vPs&W=udbu%CQjA{6 ziC_{jfE}X|4TFc?Ps2B;>6ZrM>A+I~7!h5e3>AoY7lYjkIA}ek)?%;RW*oqlo8*6f z7Qy1NWQCt^8(uQM6OinvTjv6uV0M0vRx>|3(rhAt=-%4vkFuO~l-oToughfe1t8UHkOQTpF4kRD`LB6e|+5u(v^{W#I~k}o*RR`YMNxRWGzrXH)680 zL_$$O(C`mR9q5H*5q-i2YcZ@=G>TCM3kHxtwsIED45bvhV?z@}Y=#UVAKEPGUMx#+ z0bB+H<-lRl@(`GGv0KDm;)Db}MLdf(1%R5*1j9h#rol01f@LTSo?UoUxMg9LC$HhU zcMJ{bzl^oIDre5D^qRVYyu50maLdt(2E#koHRP@PRIB~O*L1kDyQpkxSy6Z8;U?cF zTJ5L)#>3T+$iKURM5jC!ODfChttojbXmuSf?XzWrL{5`p*N{$coiWI znoB+ueveq0-+y??B_EO+#IDqQ_|Q*ukhzW0SMCiImsI{LZ-SaJxNFM%hsaHb{1p}M z*-OtCJ_+3W3W)916Y_plS;9;ioiib4^wiGVnv7p5m0uZ~ZtI*X7ESB8t=agcQu(E^ z`L+%w(#WVLre)fq znR7$!ot>e`T_Yrdo%hfB1z%-qT$6QEyc|2p%~>48|#zg`tjqsOT!yIp5+rt=IdBPbKK5`=jJyB z^+%eLTHa^Rlj|-RWkDrEHt255c-whUEDS7^_m$^s+>R19y? z`@uwlI)&{73vrf%Mpr_D<*3|fDWyLOL+SvlRUAD1mB`<6=uLiGtMn> z{$s}8dCR?fs%xq@Y*x2od`NH+X)?Lu>NK^gr8Bbl=(>0Sk@*c;% z$1&4d=hbzWc;ukYlUgD@(!WX%>MFJ4C)TFF99da4dQ^3lb@u!@?9|$>Yc3%#y`Wa+ zW^aDTCXYmY$S&y3A6qFLbyO~Dzq5wR9)G@@vmY39#o@yKr}8H==S>gzr=<5ze&F}f zSWVBQYBB?C9#3_Y2eUUk#R=DL?XyKz=DJY_3EOv;R3MzL6eK4un;VCI7+OfxSnX`R^TYKhc{kv_@ax7yJ|`TKC_x6 zj4anVF&a`>3>K9h)-b-h%{(?C2Q)nS&-jWlNu6AqlxN@96>MHLuEFe6Rhu~^t1Mch z;W@dnEgNPhkU_p}@|&yl);jeSB)6t9VJWW~*)nT%6+gB~Tc##FPnQ32aqe=RIm_aM zk>;jh=5Rp{XP2I5w3>Jru}D7n2c6~NSk%K?ruP)(t~$t> zPm4U^e#ppeB8M#PqjcC4N2|fra^|Ot2@d8!yhP&y3fQPD5u&Ujlv$3VS8P-w4S{=J zEMb~UvU3|7bF*1TY0Qb>% zWIM|$IRmr#?H7?vp15z{{%N}Y!q+E0e13Sx*Tnnvjve2i{ZPBWY4i z_f3B#ykYcc6(*|?3$tuc3O<7u-#s~(jAmyDfwOmiQ#fo9@BaJWX|tndw$E}>%jfn# zdl|F2|E~kjkeL_D#4&-&ANX<^UAB};h69}+?Ew^0s1(s^4nq%wN%7-Sc41nWF^Gts zVNl^pK$!U9zI%li&IgMBGNn#0YkO_={3kCTGv@Lq=g&OUav4oWEdUi5i+Z;%BBpEi zA@VSNauB?CT!iAWZsB>#&2`Oor9*zXf>F+xkJFFhDy@x|BLOzW64K1vTjnfT_wo&y zENw~f7xci0@}qatLFSW4vb2m|l*2(D@}p?7twMiBvKB?~xd+KL=Qs{|3B>N92MLe< zn{TiVJ1}O0U1!^&eVy0B{Pg*)$B zvno3r67>k$Uns6^Fz*OO5H|rCC80KIiY^@LaUv))!AeSh*>m@uvrV%W(KMB$N9bkx zD5!6M*R8j|_xN$CB%O8qY#|HO>EHoO^7!%oUTP*CEFluGIbfTSq+m2orMMsM5rADi zOBpwCm^cPz#)2^Fx5P@bhoBBA&mKl{%%fpCuV$efV?r(EUkyv*5(%b$Hp>mUmWfXNs11uDEuozE5 zR|)R=%UMtGbm+g-bC-kp+AUH8=NYe{FOd@o&!* zdZ-eIIguCrrV_I<@2wrT2i16TGjJlO|I$$s0Hk zS9X1&pi6~V@`QNp-ho>gjl%}-k0;9DRK>dGfXm01hn0@?Gv}Cq2!Qr71d>OhHa?t? z$^c7171WpRQ!j3h z32zLGMu(A{7+M0T{;BGNu_?m`Rgc+}W(}bhhTD+4?g$+nGG90|Q3CmJ&Ndy<=;-yI z_J`>%KMo51+>t-O-ybjIIg#U`j)R@S%OQZ_M>nV2nOU8}_4{Zu!D7fNll;lz^waJL z!$e%n>7U&FAI>7Fv>F6B~0i|3=)Q5JAE;XFJO2j3kToIaVB2zXbyQnZE z(dgOLT@lxoEv`uV|8NSqT%(-NkU2_?p{!#>XH_^{)j0wVg^6eHIu4h_h3V%OeI#Pr zr7Ug~y#w@wsI8ru005!^HVDDenc9payEPyOfNEis&uDY}nKb~coxp5i;Qm2oXFh?d zhEbYsVkG~SUDp2=r8+_aE|C2Wu5o>7>`(X6nE;661-5jO>Fb9lO)N+P6fUum#PQ>_ z&cvlS#-p8zIw0g+*uOEpa8ZH@Dq@615NL3*5Wmv@4Tps#yL)dJst*ghA0`Vo6yDyu z8<^*X?O|c*XXKj5LasWp0LW(?Q@BAqX-BeEcff)W*J&hkBZdB{HiUf^%J4OnQziArTgI@?1AXGOO^WKk$=5m16h z$|*KrKs&Y=66IEQ!R7}y;~)8MQ}^V}n49`Rv!v6aIQ=Sum@x zbQx)ZrIQH1US3j|6^C5*)H#l)X!!;?=F{vJM!j8VCeV@68m(2)vKr%Z~PMQw{(FsuMxco}qr z6XO~q*v4c;U0kpq(+|PoDc%-gxSk_bi#8@K;ac=yl3AHC zbIpcH%!HsTcbZNaG^T&|eAKM$(8)p1YAuYBIR_i1CWGx=il3r+YN#J4C4RfJ8R3GE zTPyG#@%2P0j}8n}+8g?x%CHF5rMwOZ3>Zr3;Ew}dNIm&9DO@_mOW-db@*hGToZM3Q zzg0ZqK~hUc{{ZAHK|>N!ry&5c67f8&4fx~5-~J@q*Po=L1(!V4=l4apw@-;!RW6yr zsW}pj>v z0P9qg`B6D%j_ummwQ)Yvv3cv}5v*~Ka^&Y9e?C&VM{-)FzVwqD#vj}~yNWUFRst|Z zQe@3`*5l$4TiD%~%0*$``2fDD3jo`oj339Rs}& zqnj86MGcdHK2dc}96-?60JOsp1xRZYN+7H>us~3+yNF1KQ2K?@I#CGZIU+olVECxx zl*P^}g2s@7k8HbW-fx!9joVcOF~y^9EExUXvMai~XB(NZL?yfhEdD2azK59**j%(| z8M|)W8ll#$I&9A(4;Rg& zWJgx1I#GI+zzPovY&Z;g1cdlyTv$vCWGV%9p(#j{a^MSKz^9@jG#Qz-6rmLq_(DY+ z*oVSU;n>mytVpHjwqn_%mut(AAd6L>+*+kd3g0rwj;XuN;9NEQlHU+MeAoQDm>Y(T zUcV1S%|(%#=!6!lt$oSXo0%(%^NI_=u}k_=4c6~|9ej<~-2{8`39&iJu|#r`oeGfD zC)NOmpcyq)XrJ7&+9NQ`mh>iOtKPM0`rP5Rkj0zjS6v+-Yi2KOb_6U|KXJ(SmZuN( zSlijBPl*@f#kOfbQ#UkPA{WsHNoe|$FcQoIK6{;HpX4#gA0!`1en8$k2kI25u*f82 zExZEX8WogD&H?2x!Wh9*kBoapaD*8d)D>*%G+HVc0BSD?XGS#>56Yrgi`z;QtOdN1 z)x=U7Ehz<<2=-^hVU)&8L!#+Ntnd(Gs5q)1id*FaYXMsziXoN`vKW4gOX5^-w-(zh zR*TF{VDJt~k*pVxGflx7H{UzVDI>k00ROHuummRZcA9Ua;~ zeg1M=R4RJC;z3-7z5-k^i2)08g6@mbJC&Zj3$9|N*TqgeBz+a}y64{XM<)#I9DE>I zAc#gM`sHX|Zd{A9yTdXD6I+zl6L7tQvUWzm=4PaBocH9VW5!&1Wd4n*ZPRDmzG>=| z&6}r8owjwx^lhmd=O3Z_o}70hGe>5Su^x_>N_iw&;^ho75rGs%`~z?(OHNs>CZpAA zG?6=N_!e@B74nVAc+wWK*+Q34%p?qIqRkzkN_rNGP9A{|J4>ha*>zs8-|O*v@A7yI zPMT=Mt$VOgYjfDlY7oYF3pIA1!>n=mJ^rn7jmA_|wzX%kH&n%=z z%%6uN`rl$%q#@FnbsCLOiOf|<{fb)9@Ocrt!)UTk%<^Sc93cnY_Fyl43f!LFoq}$$ zjxBCH_Sx-b{Uswpp%L_dbCcd2tBaZK0V%^Nbt=2oZuZkvgVtt1)Q8Mk>&nh{)t2mx z`Ld!WtIn^^isJl^Am`?AqTa3{_K00=*IzMssda<9uV`M^YR<07Hlscmu}0`ah|feh zzVY?218?%t(4j!&i^zC6Oo$TH+0zg%(?`aEVO^jzBK!e()Wr$i7y zsX{nL7IJJ2jE`r!6y`EfL>lZ>qAwYpj`of??RBC<2AoK0hKE2nC@+M?O!TG%29Nl_ ze^M$UujuXK|K>F$l_3wJ&T8Eu>6b~9x&DW-vq#OC(Vk!9ZD=6L?1abSvUu!)?8>~F zP(fI3a$AdRIeD$6Nn#CW7uVMpA6va*#p=h%C8HN~)K#3q|Y|^eR zR~AK>-_x5el#>a^j|=xGD!MD$D}{%y)Q>DI6CS#V37t|`j2v0PeTyX($KekcnBy4a zXx2gxbpvG;fi^k{zOR=hf58aOgZMK99L!80X-dI$MF(SyYhhd5Rz`>4l5pmSWPbQk z#4ZQpvS8E_j0R<(@--Ps0aG$-Iav2mhR`6tErHW4fGLXuWDxnO2S+DNj5cwshxnhs z0PK%@nexFxL(qb|M>8WdoqNSC*%=*I+<|e@Z$ay#|7Btf5-y0AMkfl9!IQ31!a-2} z0FZ#O7{^k?wCJJ}%iwij#X_Vn6!#52CiD=JX}~xQqCVOqrX%XZx0ZVeFim3P#y+Ik zIJ*yF zd2w=HzqN6C<@D{2OB^jLdoEZwzLU8@WpLZ0_H4zb(PNPXgd5%U%K5^(Z@qQHb=UE) zW!lyfN5b*8X_=YvAg!IvmdqZna8x+{8hGT8_ zR)wlYT{m^zcIU;85nC>*m*wbuptyB~JX6m*f7Wt#!s7JBqec}c%12)CR*ipH%u`Fg z_S8fc7Ybj!hCekmL!_C)(|& zY%zr*;3?1dTV@fR7nUb%`@L~RP-j)jW&$wgNw36RD{xolfbbR3rB_ahCl0_=c zav)S9Zttv)n}qpNrRf4WY*^?0h450PKeo87y2Wl*EA(K&Qz-ZC)+=~s`F3upT%#mQ zD+W%{to-*=h#u*r?j>54(1Y}eCSnR&aXTA%|3_0XwXqD0=St`-CBPd^#5lefabH(R z_Gac`OsG`)<%4uFFz*gXoRA!W1u)5q~4m((-dPA8D<{IR3#ij*}=vm()!ss_8(ruR9F%d*4&kGb~_jH*ie$LHKKHPc(_WG2bX zg!DF<1V}Oo5K1V45Qx;!JA__D7&;0lMG!$SE24;s;@U-w?%I`AS6p>1aaUd4RoB;D zT}U#Q@8`LbgrK29ZNvq?a;IcW*mv@~9S511Xthz~oXu+4 zFp$p6jrK_U*x$o~PTU5sSQT_gXMIY>}9Qzx0p<#K&)cJ){SPDfezTqimnj+mM zoIrj5vx-x_$>tH3^EgE9TtV_2qTGct357-r#1Pucf4|Q>5Y{|Ec>yy-9(-saeD)}0 z8Bs~-6G@Mg%&;Iprx4jMu;>ZX)N?!1%3AVNTIn}h6~74f%t=)pEme~m=`I$iHV#i` zq4eR#Y8Eh9nzSf8E zj^v9#kVD9>L69yyLSoSxFyj&NKv#yS+-1|_e$EF)ST}g->eAPxubJu9l)71?N=z$E zn+EMX{n(BDcWRU?mD-M;?kDg9|A~(ZJGY=dgGd_TKV* zUPiS_qv11u$&00@AEE)04PyFH2U23766Kg{;f_L%E%x4as~g|yh#;nrk2f{(%4+j6%Dy|XN}UTnw*;`7TrGS zSEo1sY0KE{J}9a*;tFI4;8uxo?!?{=Re3;q|Dekg{?pTlY3T(#LG8@;Epi?|IX@p% zFekW+^VgKkziUdLo=e?B&MKi5{E%@x+ejxll`_ zMX5L={cGaKvvJ{DTKQVQ9VuQ7$k)opW`8oNEhJyt5-pEX0!=l^7|k+;RCMXup#~(+ ze}@8odR%~fk&*mPIih+_w)F6pDXZ5#GJ#vyr{hWgwmK$A-~Zv-vrBuc`j?a&dl}*? z;Y6=gOsuYGi0rs_{1fZLqq%;??LQ2i?-+Pq`sc(uURxm+_*1-96Z@o5ASBU-XuD*0 zqv^>A)#y4jq`|Erc$GR5B3Y^1$XP1oGqi2BlMiMTI~I}lG&5gyha?&Beq;pe{EJF7 z^3;KzciE=+(;b!Kq9VK2m*~n&jZJqrlG18(vTM^^cBel!HPe;os~s0TnIi9GcV3g7 zQ=69LaHP{UKfOghiw6ScgYqIo|6oLER}3l%)L0W!60N>*+|TZW$*7Z<5S!pIn5=Q} ziAiyBQ0O>tAW=RlZ?RBI^lV~$^z4r=jE_rjw7}fcB89qsO}uGXT}>bTzwzKT&}8-|qV_y-mZug_yK4wtYYKG8WOznTvzQ06iXEq-ZAZAM>rvNOBSoNAMK z;hpe4&d?=fi_`LG7!Tv|MsD$s5!}%%dUe-;eI-tCjt$oDv($L1l=b*`f z!p#u-YLC+XVAoV3&lE1;ME`^*77zY4H7#8uaQSJ)P&-&B`n8?`g|%xr)0F8+=>-X_ zuFsTeXQ_X{h;ZGEN9Xdw#8V5NoM_Ya%~*2H(t~%-Zd#V3PIdH33ziJcn0Ih?PcJX_ z>HSq&y*H85>$tRBqcLq@u{O!Jv{q$mY)DcY6MMyry{mWU?w`4GP=3?n)7kt-7cWeR zT~Isd)bcqe=B>0(?mfP=zdvCI_gPPmFuC8$HeSMxO@>uKaYg3cG*aw)DD@3&xaG_O zSO>5;Ih+Z-1ki3w2zUCiMpwM-6)UY;kZ&H+3MA0?N@wCOolH=NOn$fU&=qfF zQm1=tmnZC=D+(jie{%7_G(gdpv9NX%Di?+a7(3R9J?r<+1$76lu_$2+EXp3CZ1tx)>pbH-6&lgQC%tBZt*^OlOamX;Y zWXAQaWCe$f`PcOy$y*AKjp@eEc!Gti-R;R|qzh;E{Jp;7W)|K&YyWSV`b@0U;Vd%f zpwXVZaq}4_KNnA$a(~5CDKq}g4-mMz1ew1cgH;}GnMJ-tsR?eY@*FASACOl^GAv3p z)OTPGhS|T%o@^zU9|GcnCIeqgcEQIkh>iz7kCYgr%N2~)sfa>?<&(n2oK{DteOQQE zgp&q|sm_kM&Qx)b=yM4^m+vo$wn*5Pm}uj|Hg+EwgChzo!f~@Sr;&MX3`;nznd4-- z9`;`@hJ~F;Nlq#3%E{ptrY9z*Cq~9cj)wy^HGyz+$&GJX#9kP_qHo_7!=>Ic<#}N{ z=9CMV7jg(&fMRse73eEM8ut^!Puqk7C5I7!c+09$2U5b6Bl{G-KMu&==nDGixVjJ7 zqAcWfu5e1f56GVLkBvRH8B7Eo4-3X zn=LI!+hpGKf%Ln(e~{))dz#K}#y-nG@jcr=?Mzw$_vh-u!s@~?V@4OGrWM?D;sNRH z(_P!M9{3-&Iklj^{%+}aA8umW_X^VFJ(mCBCh3Rw3Mj5Z2dAy?F&EOeO+f!&E@O)G zP76RCQ{-6b98?WXVFgZDR8y3^oSd4BS2V9+H)_&C+AxYnLDP_;!X*R?a08@WnT5vO zW5;3O%OLcOW+gOA5GDk9;-QDCE(Z#eY8Gk>hqD}E!MK_yCvlF(mEXtlPb^t}+*c~? zbn)Jln2c2E_1n#EW8c*^c~;wqS({S~PPg7yT9srgJQ~;M;*mceJ_tFWM0$CtHzp>t z|Ja66NhVdS$tWcDFLQ^k@$$m;8nuTTSv=|L(?xDNE{gY}D{g z&mnd^r&qu75#E8LZZ8|*GfXu7O||NbI8LSFw@j6;fiY?F z2dN$3r`@$P-Vi(7T{|^YEFI}pvFFZ{_b@IqZ>S|dpc7pwMTu4*wpguciSdruob3aW zm%3sA*mRCl83KcE8=2w>#mqLxqCYtpEHH$f} zmJ15bbo7xgUV83trX)|T#|MT!`n#9P)G-#WqCzn0)qP)l^NknF)CPm- zaaRI~K-2dH{?#`0aQX+n0EDa&d_fZM%4Cm6$h#2WAuM{pnsx5bNQZxz*@h;g;ocb< zf?PFVkvezyRynt1bCdL~ya9pzjcuQ9Vc{*GZjbWB8&(yNE(EHunOyNqplaRr#`ZTFw{LG0@*1~uk1nC7&_ZepR2CIg z2HG5s&*|9b-Rl*H0+p2kX{O!&a7HC}dl7mPn1}vkIOnbpgHPq) z_et;X`;rBvGtwaG4E!@^At~n zEV=|`@*uL>(@EDb5rVqO%i--v*E5Nz$i2JTf^$q9v)s8}k)8Jas(RwQBa zL)qqWdhtwn3HVj1K^~gJpw+{Q#X?9pP6zLS;|aVUR1PSwaFf#RShtxrSr8iY{ z+BKZlZx&UBfS=0c&}(>~U&94>YpRv0Dvbj7G8fw$*(j;_MMmhfbW?expq7IJfog@zuC+)hx%PnE!D8%j+SHi zCzR!FO#dCn-@9R$$ZfDE3({>GjSZ^@)M{sn#b&d4V%0Hhgph30XxMZy*@kPNXAxMM zkN&PLUPCJY^rqB#3u?!J}DhkzR1Qur{-A8OD~z)M=Qnt zBjzCG)$1W?cOom6?h%Z*`m|DHtEyP#T^~MuTFnPwo;T@FGrdlF`3UR%)kkXS!jPA_ znAT4+fp_{WD>UwsKK(F@ZExq$5O%Z|`~(FlAIYVD_*nY9<9g{cmhk64SF<_Dh+#wv z+%^i5DD_nt|DQ1L6tYpZTMLPA-95e?g^z9G0JiYhrjCDZdQ5oZ!BCErm=mhZ<{LIW z!)CTsZ9aQ;bK1k~9>Oq}Y&rd+^kx(2&2_L)P-gF5=;4BbM<=1+NaQ!C9SE7sqVPs{ zL_&%yR=~g6!6P}Pl(N$HI%|Am6q`PApmc5I`9%}Uo48`>*iz)on3iskK9E8yXYs## z_SCk+3)qm??6sBR+|^Q&^z1cb-(XW-zoBy6;>feowS&g7ja={czHB;YTQOnQDybZa z?`;K@qn)p_nuP~9KhQ}Vkmu`PvhOcZa&prI(?LH_aceO=)r$+=3{xGkEAnxk1YKuw z5aG#mNX`!BEOx499Nx6Xdf-6o z^Y^Zuv--htuiSUvcfsG^eDI?Oo0qJ8bNQRc?|Vg9)vhibfAh`bON9&T=gw`vtF)4j z4BxeDcn6=El{$ZZ3co|R<#1I;U17n@d0?W6k3NpMdA!U;Qv?=djbG9`|Kj;5j|%$I z6KO@JEig2G;Id7$x#WfPsmnHlwy}_K{A%0c_OI@0PrK`@b#t`8T0C=jHp_T=f5$$< zw)>8AAKG0mdnA<}03atUBVW^!-A_xYPTrm?Zy&(&uDiba>aJzaBYbZ0ulhaq*L@xP zt4ch71kLrM4a#L%LI7>2JZ*${lLQ13%GH*QZ0`Yh?Un(xdjS0ThQWWg9x*8sL7iv8 zk983um{!7@bv>-C*8^vCk77TtFpewEV?>bZhg^^~P?_2(dd>OcAD~5@J${susOJx^ z0=V<%e{{ak9{iaroB=wEK>wfo5CbDqf0{5D!p)1Zfhi-k+n)|5qiALTI2{Ial%%{? zDmpGi)Z%SzFLC?1V{I>uL^`ABzY60VV={g&c|F@WVvcdnD*RS=t~)B1FxygQU&?IQ zxV+u|xOXYi3|@Ks+u=*Qp6m5Swr_a+@eLavdrW%I-?x8Xf76tBKDpoIq+m&Euy#bS zSGqlAuo2vNn#N^_cf=$G10JZQc1x$&s7n55$5iQkG5zJ2rFWJty}8H#n^JN;hLoHX z`sqD6DJeOg+(|hpIrN*Di;(s=(|+_%x^KkND-SIlk#@y1@%+@sHbzU!u1o8s0V1|N zzpx@h>&QyZ$yG5O@(u&TtT!|AI$p^k&lb)1Jo?^JjK5uwbxiORzfy(;hx?P@JUQB^ zSY|XP-`;xkXe%!rZN2^WR@PdPec|2gii&LZKvszRE|kR{$gW`9>D*Deuxas8p``6h zRz*dY*q@fa`W2RVBk`f>pkMD{Jr2|hxoTyBC`To83q)1Oqd_b{yfC)Fh_5RWNLu;1Ip0#Av!Ma1gdE@r!@79a%M76=*cZT%+ z`YoSqV+rS0ojT%QLgJtGOF{1dM|zxT+S z!3nE2Z&@`V_}HySo~$VolB{+^Y@lKOvUj$=&P-!>+g+-XuAkmG;=TH&U%;jH|SFgI`+P`8dF_u3_ zmvq3r+u`L-zZO-SnBt5&0YNaQ<9+;H)y0*Tc&Uy*Fwymos|=p&j!Syv;3=-ezC2iIM8-Uz6ITRz89wPj@`WoqSFDhFiqO zNv%>FyM~2fsp|+?dRsa|Ca4F(7LO42@QTPR?$(YDUI+tnGTiYO?pAq&g=b0%ORl*? zVY3MebFPI0egUGPVf*iMJ}6_?z`$wF4R@e)UBp_M*)Lt zRET+5@AxupZ;)ZJXV-q ztVTvqFvKiI`9`p?vLQeN6&?@an2e3(YA871UDHi(_#kw^keTR5XFzTV>ws<~y6aFC zs$4u5YHXy22sbhX$7#n@Pf;bRrc{psUJCx{@Sl$n^*Xpe>(g?qTD>ktr`K9@()3OX zKsm%1o-Tny?;U$rcN|!~SCf=8GBEBP2lw1t<^gH$EZ6+L^Ici)v;pR~o>L{fGpgd6 z3=<*>LKGqu3UdVlr?zsO70@jf4UaT+9(BChrb5Q>xYQINB%~stUX03ygB}68Dow|+ z)i>O*x@^hy3#Y_?5DLY>U!*jne0PSoyxg0yyF8<`Bz@$FPdw|JZ=!h=S}?dc2vdH6a#b?oX$O#h8f&HB~XrkD{U1~xAACR|bs=vIRd9U6P>BO#gY z58pa1D~VGqt^de{7#d$}#AB;oVojJqCx5+k)9#yIx$ySV2c6OjsWyvwUv3r@@M0Kh z@hf%i?4Prq**;XI`?Pt{iv#D?e!4Ni-=!H($X*C~n^2JC2xq&TuEaS@kc0qp&V3aL z@$W_2_bf_wCqtqm#XB_jSE}2i{D%U5D6QaeN6<{@fp3DFd{LoMgJ%%T3I;*tf{B9< z%D@_EHCU)f%)8R#gfvmalyIH1q!_;T_3x#&?_a;RYT2rR@mYeH9N)XKG#$}Mc~dt& z^Y$|vr{?j@m|oi0J3d(yvf>A>T2>{6k=i~Asesn22{0(d8|7SA6*J0`lgnmQLW||r33e72nPH0u+Vy8msqDTzhd(siII)*BiaTYC zPq0gQhxdGNA#-pjEiE)S^8)d39CYSku|tlnfi_5?A_rwcm4{z)RF?=7N0+wFoWr0n z#TOPVX=E$HPY6rzz1K>5Kj;#n4vcOd_{WAA-HuPToMaiNpsGw zuP%>XO*gG$>*U9@g)i5INQtb=5W<*u%c8M!fCW{k;P(BqO&IXO!Uk75P#n+?kPY+} znUbiKU4`b$_nbzf$|Y%(UmM+gPkQh4p5qk=bRA$2G&aD{t;`tGu~6mJR&yZe}0Uc-oX;o4ax2Tw8+abbF_%jM^aDALO~F3YgTeIm?5y ztG$5&f%g7|`cW5wJ_SSo0cgHJSEU36MbCGAjdfS6-~NAWj4?6yt1CWeP+Zz-utc_9 zu9k>?g|CC9#jy3#(U-4YL3ASX;n!HE(@<57%s1_gJ-?Rxt>oC!d4wMF-_(u19n_fJ zki(rLq>G3}hm8}ot`n)a*nMRqh`-zj_{i&uW@zHId0M8K19!R*Rh)1KEQT#}$8??; zS9+A~J^Ej^5_N-@j|LWLnL10Ipk3O8w(jw9=1uB6F|B0Xx}UTn>3%>nloDdrOQ6%Q zfpw8AGY$^v-hbNfJwHQ4sE1(IbRgZj381okfy|I#x&%#Ozz@R1;2~~;*A#U*q)V1! zHvHp&{Q0AF20ZYU{ps5~OngYql?4Y6o0%Cn7l2S#qp&EFnli(eFl|BddSqWdUG*}>I!WtblG7ZD5 z*mK~)0x1tD_<<0k;w)!g7_u;>D1bnWc0+SP67|ai)Wwun^t7QBj%4Y($KH~T^;`bN zzFM{BhCgjv@yBcA{?p^jOMOxv-76nNfa@La<9|o^qvJd?yc+m$8yb>tK?C9dLJ0yN z3XMHS+Goj0cdo~T4&@KJzk&mBTz5^A9munB|didgX&N!xjvh~Tmr(W(Hl?rr0 z#ABp&84c;7g;OPu{(fnxX9;mO2tr)($uRlxCZsU@3Pz#f(WQYp2Mg@h_d- z5O~*^BunpREq9l8bay=|bT?rj$b5=yck2U*;mSEP3Xw!o9SyA>vuE(K$K=n>qvv;O zG&vwbJBMF6pANq-di=ig|9)P5XQwtE576uyapn9v{J!Y%`_9Yl`qO!qyClf-Y^j{j z(E&_n4uEYi>spF~fo=vRAj`U4j-Oplp_jV_7xi&5apCuv|CIF3$t|Dk&=F;6rf=Fj zAzFx6ATYiXttSX&Wr}{b;}fFyyll0;9DUG) z<8p1!2O3B+4nHpc52T1?xdBm7slTo!l0*sbC$W@`k7LD>=Jn zR@DNa$-fV{r);hE3F&?Ljhlb2jLi3hR-28B+e4SD#38E~9uYn9L@PB#E9Rk7ETg-9 zq6eRdzNO>qpUkWBw;}ydl!xr%&uGF#9FU9aDy+;d%0EQ33|ICfEi?&G3jgOz) zFf3H!-6tWkNHn#6Iu zan!s8s1C{3m)4-|wnCmLC&Us3j8`Z&SSBhYsuPT+BXfXN0P`zX2s0c0fKuG;5Qpha z6?9m-V90Q*NQPcZG5=cpJtAi|EzB+5GIjURL5v?5o2ZOcS&eFS!2mI(f63$+t+8qS zmnWuAKk=o6)v6KS9R*ou&R15gdPVy3*590zCU2j=>J_e_K_hBCnf^d|_THv>W7XsP zIe5L@wq0c(tW~K8hXQ#jX+-Bkuv-7>@h^wX7H85!q;t}judJH1mF<7%_qXE79fJ}Bf5jy^ZiQZ)3N zf*V!`W-OmRxnH`u4FAlHLn+A&^}(>}Uvm8l6@+fsRX^&92osReGUO%dP$3U71PV}E zK2nFt7z-+qT)&cW?d6I(+;kdn#ps=v>-oqZ_r%4s4?iVNgF>p60twx_14*) zS5){A8*<2IO-xFR_jcDe^6}3<}_O5Q|AsXT#4L(ySAtzr_v_aV|D}gwKbR9VGwm9aK+asZPABUsxY{yvv z*J0a1XAgvK{{-7%G%)5goRn>$4%y2EfqWhnG{kUY4|x2ZKq2YKk=!s87HDhxu{Erpq?rG%QXz#}!Yv&wJgpc&)_4V`D|!!o+vs~}u1Q7x z3It-3!PCf}ssgGOkmR&NOJ@Qk8czc8{p}B*H<=vmtqzmv{KM_w%f6M9IN`~l^-pc- z2yc8`e8rfaZhS?2d?O#;@>E-koU@6&K`>AB4~=@oyXCR{bMNm;z(nuw&T{&*W%*My zXK5$`tDL;aLXnoADONPqD|?QL73sM{Wdvt&=?2iD75M%XV^5ejXdVzyP=2Sxr zmm~<|+vg#1=a<@Cr?AYHXuPE0XLTH9TCTeNPjSim5BSgcj%NmPYdB+~Qu+>BCX@^9 zj4?@gT!>QWiLVatyB}eyBa76PNb17LsP|i}V)P}Y`cC8?j>akHD*D5+-ocd20`FNb z=zL!`kd0)MfJ3>G{hB?;-h%-~;^0sy5>gteU7(sk7V~H(X1`Avl($KA@+qU&V6MeA z49F>+;5z>3tP31eh+3+04!T|kcxOlSiGtTaX^#<)0C+XHW<-~Oe^XeP{jLG0a&Ev<36z*n$Lg|I&(VWrEFU=#2jo9Du>`K zPD67Pl>^7bF27lcdgCSPR3-95qs&S`(a;eR_#J#PAq)CY8md-tkP0H-1+ItU*OaPM zl*uUol^Z+qJ*oBrFI7ubjNFg-Lw)2&i2z%tRw0jG6rX*h_F3Wr92=E@N)@Sm);PE} z)g?F_rTVcc*+aJFrRTOS(T|C4=5Q~wUa1Kw#lE6Mv1tS{2)9oA$J&HN*R2@IeW$jn z*!Xa9UV|etGV)vJ*nD8>a-vnOj58#tG`hqjm)@C}8gH@bRDlNMPc;tbQhbS`KF7dw z+Fn|t(b=DsFHUsZ)utiN-hjA4TIq!Ryn^&Kxn(o=TyM)L@|4E_3o9_SZ+#jQRltg2 zd~fGq3uem1MSTax0`@#Z1NB6fUQG0*a3c&FbxcD*t70}wd}^Z8;E7MrY1N5(r}VvM zluJlRw7G|;#_9XH^detUXdL1)Wa#V;lk4JH*C>t0nwXHD)L$Q$>NOSy1}7Av)Wao1g6+*LehE>mffHY95VQTk2|n3lIWL8;WGY?Th0dX*Y2 zfO!`OJjZ)CGv{6RG5cW;fM(29#`uy#XzEp3PN`AFAh)blm|H5uxJ*E4{BoSPM+ zHfwq(v60A);qSG&K}_9PTsTJW6n^vk)ZPA*v!lclu+oy%I!*|-_fsiC!Mb!F&{ zHvkdSEW{d+%*JTUFldrFQ_O3>et~Ng8&+lb2AFy6n8MpNJPzM$;`U9!_$vbdV#askxc zE05z3*EuZ7I<3Z$l%&xbY=$ItOd>v+aWJPH5b$M|d(2*KoJB-t0-&4dlN{rDYnk;&aHqm8Q^A7;_Xu9{>B&)C@V@q$n z+h7RIFd4OM=~}-3*8J)2xFm~UO}chRvZ42u45iUDz0zE{c9DR#yk;Kn_wBM;RBGF% zz8tsd__F24k1t;)`Opy)R$x%+_(A=i6dD@P?6%RPL?ic7pOtZHrNwk}61UN*-}OQ; z|G8WBcEC3g#*m7Q%fOIS>+?l5fSvFVrm>l=I>4=&ODi<$9KAj%4b2kSY%mR6p^FL3 zD-P6hT;C5WN*0$DZJ&a~2>|Z0I(2$oUB8sq?e=~7sScjEC-x1q+~O*qhYcHw{u67n z2*~4bc2b|6#q$C&x|P)?Lq3X+#Ms0$^wR(+8T_u1Jf@M)`wGtt=0dx|E+Y_0Qk9E2 zSf%Bt#D6w!pE6~8Wa*Ucjg8wQ<4WgkyZ$%OF0#^hcl`dADcO9+!1-&3JuxF`^2Ek! zU(AR@(&-b@2Om7WacTelp4?2j3AfWy%~kQ;w?-pW2>WmrWpjbCMTx*ZM`xxYLUg1Ur*5EYYXMjx z*hMhU7YgJ>1BFdU5+?v!RS;S9D9Vy2YcEkCZ~N_4aG@i^O%lDU)fB1;r1my1A$`FTbMMpuU(@|ICPy?%-!#(6 z#)+FYO^j~sJ$J6-MtDsSCreATEc!@i>=Yn-Wh)bSH3qzip5CZ1@C9UUibU=%**EsQ&7?sWlHESQ&cHTK}bD|V2`6XBwv)BmjjjHN(+u4VlkgFk?L^BcmCtpha?@Ph| zN8bkm(j`&27P_QFyd4Zvst2wI(Nviv^g@+{P&H!qg#~i@kBu*DZLz20@^sHgFInSb zV$#!NViGLuYozv&(r~y2r`d0DPBdqTtr=#~s-Sl$cyRLYaaAz4oq)B>HV>9=ztRJ@ zQ8#cT0)^%xdD~fxGki#DfsP^+3Q6BKA8`-Dt!SZ zlERb=IC__W^PT_Na0hZdU`aV2Xe)vi!w3s=G|K1(R7y*2s8OH|NrH{)hzj9NKshYn zNzt=bSJn-ohn+QKJ!=U~q!$u)S5+x{FtSqo8;WiXm#IGH7MHTSl6!L+tTlg^5C3-L2$kF}sK336IXvY@)pY|Z7h)zmTIz7~DRZw~%IeSUEh@9z^rajEAGZs8vFbeUdjnShe=^c$F zgGS*XWJ#C*c%VT}X;~B1Za-x!cjPOV~^4 ziH{>)dxxUy)l6|giz|-s=n%}EUcxuyTq7<*CU+`Y30_Sfvl9 zt8Pzrs~BLRUkOnJuoaQp$%zjXqzG&S6Ixl3^jh!1eVU9& zuH{)=q*70Pa;jQY*c5~O^vd+w#$}DQ=}O_o;sGMB?w1p+;vshr=8LbuA0iz}SjM^~ ztb=&Orj}C=FhH${=v%+Jm=XiYNEry&a0^ThBfXyf z>(lt(D>9@PdsBK&`VLQcZ{_XGaO8+IbjSC1HQph;^W?qKA5YG>=PO=$MRnvpr|9O@ zz*~wxnuUKHnMR)Xm*;62(=Td603V?YTlMWwmRj{fNN){Ks%n?H0RgN7#$4CAW|>i- zgN<}q=V4*k<%=h=@@84zN)N+h=vpM%rar1rhp{4G)&M+K>JcRdT?}dI&}1rfuTK4M zO4N(S1AiY16^@#t%Q2&ogR-n57P|CnQHu+7!N7=yGFTvx8bUhhKA>y??NnR@ncx-d z5ko~f*GNoHTZ_#4G^SS=Bs*=gzuBj*ooZ))qn$`aRc>xouCROJjr%t5yK!RmlIgPr z%TS9jd-{^3L(nA5DD>NJhJV3nZuM9q7E;Ww@L>NER{D*cy?}8$CSa#syv>m zWrKA)-+c5*mB*uc^3gYU>aKdUr;allIwu7Kx`4yd9o?G z(6uLqk#lCz+_};ssr_=5Atmm?h}gr#%f}*plh!}<-R8~TJ+wYalh>dA`$nR_MEft7onoo}H(#f-?1*zj(cxMDOJ4*+@NU;S2t! z-{9Os4|N!Jy_}Kp@~$iU)4=~_iBqraPfC@Cut5Hc&UF1e?##UF(XIaTO8lfF74F$n zNImL`?_h*=dobwXk4Q=o4#_!czsI0fAd?iX zC@_o9#dnddy+pL-V29`iXdqPPkfAXtkqjNQ(vmKLWf+%`TXy%RpThV+J86L%RRp#X zoy1s_v=%@m47R+Ohj8Q$<>ge#i&R$ZM_w6-#oGB=`DlUPpux$?0#QA>vb3tt?34ue z^qu+z%BI>#c=UYfwV}JF=|ts@$wfJXgfPG%Cg$}+WMrM|K3cctrb_SnD@g2(>y^eH zPV4mp9d=)rUa97)a>8p0hlwm)kW!qlx@r0kg{9Ka*xcHt<)c~p;F+z{cCpDD?E`46 zQTr&Aji3|xKw?*rVpx`wv5tfKmYRtghgt^B0+~aO5+U)l>&ou7K>Qf;Z17Q*%uo0d zB%Y8upW`Ps9>@to48Lba+qh(Q0B`SI1KdIXk1j!&HcNvu^WAxIYa>je34d`$pGf@^`4QTY`tL|f8FiIz;0siMG!tc|X;FCr^q9f6u`FK39z5-I2W zGH22JQG;1sW-(L*uWe7Gb}ua&kmHkH3Gd1eh_2-Wd|KE7&54_8=N>Ts{lMJF^oAYw zdMEedz#)d9C#On#NLyQQNr8>cdUd?r>nI3mnhinTd_i3kNUt)y6hfHK+!rb`XLcy8 z^|}FB+--rHb)J0b-JJ63oHyR6&QgyIWDGKcVs`dDSsqN2@$t};Fbq3+!ZPOVW>)AU z&<8;!Bt^NC!dKgaF-b;YxeH>%$|KqdyGQ3{v9P{uVH($WMN_SW zgf7ybA|KT@-LsP2nGqQ^eV@9rsaDxCG4dOKsG|}AS0=NzFqsc^v|w93D4Pq9PcIQe zTHtjKsG5YaoNv;zvREXjU>Ma(MM-|gKW=|XIsywr?dhAEYTYaE32&P=VwStM>0%3; zc4R%TFY?8^Q*&&|J~vV`8nSwqq#KPbN#03S?s%W-s6Hp*d0Bxak4f3rumBjWpjkdY z1wG3Pvd0klNdQw!YdN5n?}Q{le7-W3C-3xBOn=d_YwfX#218sw#xg>hWYVVsUPC;L zT~RuS+c3n7eC*X>tF1Hi;xg6RiRMjX>o(fzX4y8@U9-h7VU_AyZP1aIk{>tcKxu&_ z_OH+Pm1*u=zeiK%%M0_L7<+4As{|gLom7>o3zR zi$B0uTvAM~VS7povmNZi1lPpv+WPskMoM?G`$o=MI#zqb#Mo3xp~^J5bh?}8lsEaL z&4tQvo-Z4-1J|>d>|>L@GHebsbv*~h!tpRocdm`z9s2pG!KNv1xM5b z8oA!V5#hu0KHvt}$EvnXdT-eRX?JL3lnl9*@3`Xn+9jA>v4Ji5SG9x^M0-XT5z#LuC5g1AjLkm|MFk(F{VBU>~sj zNl(x)WMHtM7PP7A0f*NfuhwtYR^{MuvnJGDslG5Xv*HC%rJB%7hN^VvZ4G(oz5%=`mjy18Z9Idcz;ACk402(i>I z4i2WdjvcPZXQOQKIaS+Crc6ts^bu{Rxmcsc2CVE^j@ZbG0gH0Jf^olQMKv5~pdTHCG*8;MB7-JsBf`?)9kAvn&##OnR=MDl*tWXA0yo6sz zxLzq($%%cS5Cm`)MIjJG5yNCn9)|oi@Y;FDqTdFuoj>TUKy``JTLr@~rqSxR##mU+ z(`x%Fo90Y5v&3xEYc<2MzR{-nK&$2T!iO5$F1>|sU9Puuye;3HWzjD;SghKP3cXHi zj^Tz%V-bvbZ{(pEvsP>1pN%nFBNt*5RH+&SeVM6Bs8A=4r3R7By`ymm1QHHes~AO< z>*D80ff5Y@0gVSzLUbN5mp?Ck`=jScHSi*T_}d$A{FV*vGNbgYcQ$B^oau_eN)K(2--ihb z97gvLas)}S<?ck0Bl{6I@z&V}9WabcIzcen5?o&E(5a0>yaP-o zozbKY=#9K7D=;ei=HEWY$KXMuRq-4eO8EtXMw zfzu-|kQD_dY{c!Ib_BR|)x7X?AA6;)T(sC!Qj7 zsa4e?x@Dgdg+_3y{2CV2@cy7v1Lsi{<64Q>MH;#06ODr;H*0-X`j~6xnj?+aXRVU^ zS>|b!!dxpUR_TO%868fhi#ji(+dgSzVd~?uyejLB$dAPj(up@Y;fv!8`ZZ$E9|U48 zBKxoGy4>r?L-1uoOQZB9bEc17FZJfL*b7o`WC3vED050*rjO-^UZs+cB1+BK@C+`Y z8^gGzioJka{|AqI29Lvy4S>-5X{RJz^#{<`rJ-%Cuq#BfYz_dD(|83cLe7F+y|T-y z3aoeHTMLSz&_nmc7Uc_&4XzGcBX1!(oSixC(c9@>)F*#KD=7 zHjq3zAes}YPlIBKd_p{O@^fwn9BG1ZTMr5wgTsTt;T`_P&5QA0*s!>E#FE9$9RrRn zU3Tow&yNWkk1bnz3_BekOaJrCb#Jd-`}TFu@b^j*;tZtaZ{Iq8?EZ7yNa;IdK}AXh zwoYK{v&uCK4@nmeZ~3A&ca*N)UHj#h!_tLA3pM3gY{7nZ+n-w54O~L>^+Ar_UOb83 zxp*;?%g`df_!#^A*s;%#N$G4IGp;?~c7Cm(TeNWep|_VWee>WXcs}DWJ_BAW2!-nl zZ+Y@I>B6l|(@L&&toBY@d@EDm_T()%K7DZ$`pir?;2pv|tHHN`zp%m$?`kX%k|mP? za?XKA5aldafi0F1k>M001GOU0F?k*3AmthPA-Mqa2NFUKM0{UqyYvIo0=Y*k9e8}x zrpGt2EWMyl&-O2UX)x2dTrtUGlKZ_ReV;rAo5@T!=+!0u>~vhBP0I^;L|fIMrqc0u zd3~NxUK+O?8K%$RNk5!=Yp{8H>LsxT)FJ6+G)LqtOZ3HoNIFBE%H1< zE>)G1l4M~<#V(e}-Nh0A%b9#`gygz^qCUQT;^v7HH?u-*TAyUCZ|%kv2?@!4(zK5B zeswn$-k9%jXdGpZXO;}ZQsZzuQ?zSzzx07;rGK71i-bUHdP1GTa}Q6N82P~#E5@l~ z)6*=LI5F0i-6tzxD7rDP^8rhTMjv^$$Pmct1FyB1v-C9fMMr4mJ@>5STd>5JC4N4v zd|V8}kB@x#WC2n}V+4RVq(DeDmpO8cjPEH6-O8lOaoazWo_*j!>DkY>PY7|(=BBcn zy#w+g`#&u`otl$BAdT(!h~e>-k&6#XEuU}O_BjhZ$f-gT+TZmMz+(OYkMs&F_6*1` zOp(@-PKTi^2SEd7QJ)hLSp-uBq8Jf;kqSgGkKF()Jq0qWLG6j&77*=G2QIi}`H(?8 z007oP90IAg7V`$`rVB^@7QAHOV%aRdD$i%jwCy6oil9oBb} ze8)J}x1ZfJ-@ULRw*O=nI=|0azQl80|Cx$CVHnsap1sD{j`GNNo>|;u`H@Ro;BfLR zZ+oR+=@`+cF5nV-r}pXCJ-v(_&hWEO0|U4MmdoYjRR6vIJNtwAoGMMpSUy)?AXR&i z`k24y%QwKElgkozwTEh=e638QwXo?d0av@X2gM`F6Cuv5T=3ddXbL1vfNQWy)_;)S zaEhN2%n^+v+9k_NMpAGD36>WUQ!WNyki6b8bAuJ8)F;pYK-_|KZ*x>&V467c@aW0R zT*1ijk9gwZeJKUt4JK)pZ{0DOmyW4cZQePFyJ0q;7$@la4Eb=A34DW+nFbAc@qQL- z)nkxwi;pG`(CWngh6S7_LD0w9Y{ObN8#z6$GY+hH?E!y`&b#Q=a{6N zN8J7J$o|GToYy7jlhXN`Pc|C?BY@Wq>UZvb<}k%5tuZl8hg`T$tkN$i(da`pA8m}` zs0#W)f018~Vq7i|x8W*NmP|8P=iKU0q!2m|Bg>lChtE}2b2oi1{gdr) z(9Mua+D@NtJFQf3Yqoyl*WA6Aow)seX?|qRO*bb=WuA*{{Rd1JJRm(IeHf|RV&E2S zVihZtxZ`vijVr`aLXY&aY)x=0fC&o08i-!Ri_;i_M<`J^mD8_;F|eF$2Z*Z2Jm`0^ za##n^uh3smc0plva0Vvu+oaE=0rPuXst?Z6>6Yj-zFt003L;_x`E0@@3UE#g1_BKN z3@gEV19lb(NCgH!a~fL3Ky>B&G;EOG`26wb4ohFnthq)IuBn;HY=@sazFK3F>&GE^%L86W$bF3xPI@#`Ky@v z=5JX4(~lBw%2sw7qdEnX#WQ9wEY`kV~?+5Xugcq6Z@qbhxwP>8nsJQe{Xm)*G&5Y`~qv!8k{px_ii!V$W zv-FlVkL65d7r1xDcW>JL2X1Uh-rnaYj=ue$Tk4iE)zap^_psSNj6iw|3!BWA#|NiY zEj#%rd$4Y5b?!ZjwzaPvGqG;aM_XU#hTM4eEUFlte^g=2KSn~={;@|`)T(LkG6r^Q z-2&K>XD6IdDXjX7FhGLpz)T4!HNj&O+cm!dqG2$kVCnb!N%+1RecHlxQ|9S@w z!AmJbmtlch`4-uNN#$~2Ui>S{PuE^nRjIJHCD|x;D#;HY0mTb$(2I zRYL!>$Bw-;+}A6lkI^}E^WD=QpthBB*NCfSeMzyd0#g)Kb%*h^E`_6ao)Q-wDGEGr|*4vly)8^c~?~OP2_AX8|njjPUbhCF48aR92 zz|g|YjSp=dyldx+FYOG(a%$xNwI|!n`~sJ&<2*}Wo3mie>UU~KX6Gbpbh>!GMm2Xv z_~tDe5-cEn`i=M8dGLCja&dVmRMFJ5ch;ChwK|dU;|8pqIkmW?B#06Vyw%H%l1r>D zs}fC|(V)^+R+*A4VpXNtl`v$*!Z{;rCrqdvHQS>~Fq;ym^=Eb5_QqM~_U?Pbq$?;? z^Stt=Su?5!)(&crru7@V^})$6?Ap0AkisGTxmt7@xf4d`LMbU@v^8f!?Z`Pz>opP&nU^)=EmtwLTRWs^_e8tTs}dcNkG3}MjAG6F#<;oAT~La7Py=kUbw~=dogF= zk6>!R?E_ZLz-MrnDde~Z!t4Vql z(daPh%QxKm@rsq-JbZk5ids-=^wuK!!%a9$=mQrZ8XzaOWm@MM6teH${P-|f8 zfd8*@Zb8mkX>)?tXVCvSeYn-CGx%0+-@R#ec}c@{t9DK+u&0bw+WQvuwMg%0jazqm z=JY$JRK`UbtE&c&b{YE2UQpRrsZ6q(f+PFomycgQv6sdOggjw+{)1!E-!je1uj^&d zTC;C;s5Cr)iK5A3InI=)RK>7+lB)_bbh=jWFq=*1=rcB5nOAqy_|ZEj4(^qx;nr8W z1DwM(YB>C537(sJ|+!H_AXVCJJHXb@sXt6LfNtIPb%1p9ZbU)Irl#?Mx z6N7^g60wY~F2QKoMIj?SwuNvT94%UjcDBk_^w<;?LyIo^uQU?*ZR}h|ku{=TsXeya zEEIakg?{`b`Jq>|j}bB{wGnx+b(%M2>kDQA2FIme#QyBz*VA45C}v@_Y0*|f7>*$= zR5LDw+)xS;RRvgDcQf#c%i9djOjl{OaM4iKjGLnuM&1$>EkCKVL9YMst2Y#hK$!m( zoqfU&&PDDM-pe3s6vurzlAe&!NEAngqW`mY7)ufOXU;@p%%6Tb8g<^af98y)!~Nei z%`FJbzslp}fPZ?t)cXIey=;)9(t#QRtXO#U6KE2eiW*2>{NFW@=#&)5IwQ44Tjm26 zZL0Rh|E^iMzLEl<%kF4<<7x6^BfbBN#voZb%JU|5(h(B=z^!zyFhzHF|wFm&D|vAM^8g7eqt!jo!d*7tt6EN z-tEP>_@g{Wc`42!s)FjSkf)nCf*;0M=v3cdrlwF~Q-3HVmtN(YTJ5gH^tKlHy`gAS zsvkvRi7q0ERk?*Y~*0% zpw?hDW0%7&H=CR7Zja?c?Tt{jw?xRvssDZBeh77ebca8FZsFLHv6-T-Z;WVtM*qlOdHA`-l z8Y|YS627=%xBY}#$tf&Wy;=z*9jg+|dRxe*hJw+Gx!tBlWB&9Ae@UUWwt-3K88$@l z?DXA99&$q-qR15^_;PZH?bHExWmM@}L!&KAM(an#~5!gihJ+=mfgm_V7GDdeYo}Vf0lzJb?@D4xxYjU z@EV=bA$knn_`JM+{&A6;PBH(z_folKI^Lt)IW%|u7{OHN)Hags1bP`TPe2O?)G}D+ zG{E~oAnmFU>8S(0Vjm>)auK>PctA4L%f+r*voEFD(vdfB+Bh~LHs|2AnWY2DUSreV ze3Ol&3Rl;>AhqRJipE%h7ZFq&!>RJ@y<%OuBad7*8F7#FsByIREWG2Z>ziI3QqVYl zWW{`+QoZ9VX8B6maSDy0exRR04LT#31S8l&b--DYGbsHUraZ9m>-%QRxbJKEJ8A@l z_%HN8CA`%2M5Td2ZDw&uBY`ys@e3woc}d$qF7-!FOYib4Bd1xqaFn*W5z>2f6fMaV zqb{{5?-xUI9J-Q0;m`YcXv$Q65-5Vj4yT3Mkv4JAB07}!Yo)W&uRptSYF5Lbddq@g zu_tnFtDn5gndJyp7S5WX)~_iItzvcUeA`#j6lo+=HM1(F96Hs0OZp9J&4wM)Cu1)D z>R0tU;@R~&HGSi#9#sK(kte@m~gm za=r8h-AnyCs(S`w0bj8C&ii4faRyjLFq+#4(I0o)6VD>%5N2!S9TzNsgO0FD|(zW^%wCkPf)x*s0X2LHS!YHx9LF z^@CZk5O{!84i_Ay3wHFG=NN? zx=)vNGr92N8wqO<*?OV|8N`ptMi`KD@@4SChU^rfpX;9%s z71kh+VDS{59tlUCd@6#4pa+BZfimy?A>Z%XcVTz^o);Hx`f}(W7D~6j@+;~6x7V$E zoB4iqo-LL_+#}0iDF5csE=&2NNOp1jy4(GY+uhkQ+Uy?|t-4|Ng}n=3+*7}L{&n}X ztb1E}AJhYnc!#T&nj;b{_Fd+6>H9CGWz7shBqizS+ivhFt@wt7)zXPa5cDv=8KD?v zAUZQ~U*ymPer($#j|;ck_C>y86Qr1qd)Rb<>TbNH%?lmlQg=RALW16?A z>@=F7uPMaEvi%gq(q2&P;&AWfd+;noWBots-UB?2>gpTcduL{QlXkVMu2oz0w%T14 z+p?PFZp*z}bycit6*r0n#x`K8u^pO?3B83-LJh<~0)&JTLJK6s7*a?=38`Rf{Qb_% z$d(Psn|$x{J^$x#YiI7OB27?qt;@uqGejpF5p{d=MAqr#Fzo z?`}uB*XQ%5JEEZL?tI;0b69aK116lB$mtxvY7i#=08co^1YX{Nz5*jdCAX%rRGdvp z$_5ZJ9SV*l=%tNup#*+LI{2$tXbJOxvjwhIS(SbYm>+mlx+V*J3=vB-(VAW(+9w|| z8chc0iQ6*^olz;?6kk*`c#p~sP(EUhZuV8?7ba#!yS$0{1+ntAo=aDf(9X(BJzcQ{ z`H5avbXH!P-Crlb$6gpEfKsaKCXEZ|9-~wio z|G~t^U@y+by1(J@gz)|^FfLh;NvOoRL<>d-!fV7;1n-cHT)?{~f>;W$p;hfptB&!) zW!m0_jAsBV>Tp`&1wT^D=FIXdEUFCWsVHJQDO7;IuRdgO8ggQ-)|5oEciZdd>^c_i zZS>?+=`)SFx(+{>avNN3Q#-#hVig#l`5EGo!7+>Cr7r zx67O3b;aAFdwZj8@$psB?2#!=F$G1jiGsNzdFHHheztAz*2D$g>U_`K{cr3aSa8LQ zpWSucN1n$%lArrs+>=}Hzbe%hH9fwI@viu)3|ssa^>XYBX}0L9_*~A0}Nt$Vj3PmAMLZh(kbpaUoX5thz%5kMGrcDrx!qhctbY6 z(sNm%sAzoQoDjym1aGoY`sMi#Z{Pm#`5zD8kh=HdzQ@jKh3R5bV!@IPi}MqV-o)Ol z?BN5^1>yDUW+ysEuIS9kS+nbfZChTvV6{IvFPtC6^{)6}Mq#4cu`)BWzAe}6uRnjq zyz|!0E>3fqxoy?xl#t9>$Kv>c ze1D)I&1NWDJ#@+X1y}88sR%CK&|O+MJ1@y>j`oLFgq<$NsupC%`oqOjlHw}D)nyIg z**Gj9_*Lm9RexP~_UQrff-tKUDQ3)aMdwRVN~dkWk!W~!r@6y$WoJH(ou%5%nu!rK znJJ`&*-3f5>giV1Kc7U)sq!{BZ-O@cDQ$S2uZlSf!3knc5BWI3_KCPoM4}P;IpdiZ zovG8#4zcX7_U`>keg{|fDYZwL`zohO2})--{P=hFeswC>0+pZj_0K>XPt&jD(eP_M z2|S>x^P}g)>d7UrBmb_izScjd$4rw)`d7VEruN1uV2DjsWa2fC zo2fUS1e1YS4TPa4!Z&^Jfewg4(^-ze{=Ep4(rnVR13VEPpHOxn3x6cW0XDr*2#QD% zv!#+^9@iDl zG7dXPu9QXM)47l51nHU?#}4CL@dw=s_1^4*Oh*phrN>Kgna9sxcTvQ3+3Gt~dG$M1 zU*?Kjw9Yc401;##{f>ee0`=hdhQg^+3;6*APaNeCsXiQ^F6O|Lc3fID!ssNqS?Q|N z;TXi{i0Skqho_0}%I)m&l>?M$V5K~h-I!la;c~!#DsaiKK_>{XGY=10=>i>o!Q}={ zoXC`0sz97`f{OH0A%YTxkK{TXqWO%|Goe%wa-|TJApE*ot`_8S1I%SsvoeR-ES5|0 z^5csPu}7U|ldwQW=mQ*9A@pOqAtjqxO<^S^o4LpkcT|0UDn#X&h#iHa^M4+VJ*l(W z?MGwf$FRIPS^2~r4@YB}`i{+_ck+u9cdM1=fT-)iIM z!+raO%l7X((ZXJ10sMb${GjgSI*2O#02$aI5avIvOfCMLT<4ft#7SVdK5`vi^JT9sjd@DX z1^Jy`Hp)hO!8Lec{3Cqh#JZvKk#eA4q&vkq(l|;wr(Ut<=OXSGota=O$`oWRYHx7J z(KT;g*EoLo6X$)PS|q%{cKoQz2MDx@KIJ~%tiAaurJE-x$>+%_69x>AxTC)si}%O7 zqb1y))S}S=l1?}|Q$H>}j+t(TyrLIAzu*rBQfOta90(K^Y%gGpN+|5@5@Ju> z2%{ho_6px8KQjLL^K#&MV?Zj77;unrqY$e+8ilG8Ccep*7sG-lO!_tBH}ZDx_)ht! zF?qJ}OND>n$*aJH%5OW0IYFl`=p}3f(wU+|o&~b2EI?NGa2Sl;1GrNl-_n$wS_b+G z{YBiiXf}5EurQ-*&+adq*~)+JyFkuXY#WTVt&+zd+xAMOYo4p}m2Hp7}X9wAD z*}>2Gk)z{ptj*x8X>N043uEUUJ@Vvj9orAS-@THtmEG?j+}?59ljKkyD-Xem>C|{m z?6X|p{^w~r-_VmF&t|kQJ@o_j%Y#dK0}+^5dp$%Pu(DJMf0I^XLV8>{0na#J$oH^i zB$hkgEM!@YK6%&cugkl9Myu5*zGK9e?QwYn-}5V6jxDb`o?W$kd6oE1)pEXZY)p4@ z`*xYEAL!KZiCZbhN!>m7U``s3XQK>p{ec4q+^4gVB}rP3v1tVCr_icIqS^Fck0W(R z>p-lM&P^$XvqFhy`K*WsCqN$qznC!e#D%f0@;$GmWvnu1WmQF1hVo5fe&fjSHFK|n z`;buL{GZB;=WSdvrLu5t7N*fNEcEfEi<2e0&Bp4wV>q7m`cq2^QT^T@Y-KK&jJ_E8hqf+-`xG-=A}!$aLSm( zW8tO)AENO-@f~DMgX~Up;_C{TLGFaS`WRyYGzDav02P<@7c0tk2^;+7stiST=o7TYoY!Yg|)iz zteU9K-fgeQADva9T>K3?DWYNOfxn4YM14F9{fkv+VjtzA$!W+^IbgV#0qpgVQBjQj zQU5zwCS+TQ1>lCLr?RU6PXPf?J<_@LQocAXM=#`82KLjuC9IEC*Iw#de7dc_8s3lvS;ec{O=7#* zyU)0B`#U#Y64`b2D{C(uN?`dbZcdhJS0=sbHAKt5i7BcJ{NBy(>Y`%4dV1QPk-cB- z`~JQ?EBmf~8DB+v#tC|#By?9}UYt76RtaeaqX3X(QxCh9BW{=rQ0!We3<>QBNr+bw zGT}Zr!%F79DyU`B`gV%G6$UjI#fQnVQu4Gszc0zFM8zbOrX+>(R|Lzml1fcZi?P=% z8n%6S!F!*|CqB8SqvM`Wn5f*@)n^mMjVMelmK_T;Rwly*OH0f`2Q>_W(x z182D4#S{OPeRTp!_b77?n?ynJQO@YNfow2h>XGCRq&U+3S#TW-$e{;6^N?szh<#^l z?b@+5?6RqKcKK?^ga`)9Hgxbl@2#{Z~h(BIaQ@v(Qb0~}L2nm_eWFh50i1D(2-ou2Ik>+r4 zP4D=#%w>Pa?vj61W{#Hs7UQz?d>oL8{9drd-uF=@@(9aD<7bgqhz|1aZ}c?%Al^aV7m)?$YO znIZ|y9TJxFV*w_{4J-k|OBgJBV2?q_pQKR1v#0lvy94afhMB~|=)bZ$xPY^WNra4` zd%)P!dq9mN3Jf46296b!2yD1fjuM4!xPf=agR(HfUS@`OeQcUdZuXT-1Yxv{UPSU5c?MK6^2{UzlI(?P>t4ri5w{D*da|pTIgmV@wv|=fNseH+=qH22wy9jj(oy zGjj&*C}o7y)eK~X^M%nSo580U-lTB&S10Df|I({Ot)Ko&`oJuS(KCRud2;~jd5^gHdM4ME6yqmwv?$}RH#jwV~F>Z zEY%c4CLZYy1CLh{Y3Ff0IEsqUfJ=5Nq~51D;1RWJa=4IZFpgt4Hj37@l~L zRbg{0f|YdO- z{><*kjyi0ydw#YrYX8=hg#klKL(w@`WltBS;_Rh!3q!-58S%mcr&7eH7bL~0X+&d2 z+2mBw|E4NtPh{y-7q8~9i9I(|o@z|VN()`6-MJFWqSND}QleP0uw zr(p6IGH_?e#SZD+VHtG5>pV!cfas$M0=uWUUG&&RUF35FK}>%5Bgx3hPRl6u9@s!I zeA5RGe^N?%M$o(FhVf^QjXz~gv)*a7>Z@`2IDTgB1#4clrST&gxbM}#pM6N~?dUFr|q~~c%f~`fdMZP#pPJ<_@esS8$-VJ*jJ*zxc{nTh?;*Jw% zsOf=9h0L4uF6`0AflkF)83}?I^ymjt^YQ>12ni5h7GxE@QF@Vhzvvt~we*5YRXPn+ z7Jw~R73m@{3YYreyV2mKWI!4G_fVShW@UBvMrF(>5)-X%Gj~=yUHl7&QSWK2PPyYT zhu)lI^se9WVDs*qvQ~usx3bj2LLUxz8$)>>$pCo<_Tg7E&UvaIrVuyHlZ41E%RMQs zZQ`r3NhuC*rTmXe@|P?qf;@rMJfDT;uNl9?U}J*Qw9e?t*pss6fos>_adBv@yDpJ= zvjVgHsoB%lZEDUnae@8qSnsiCFL#;bYg^@SX9yKlHp349Lk#Ea+aX^!4L;&_qjyLY z7Jsx0M#&l=kg-1iX@0Irvuhh6ZmD2d7*;GfV*%25AW<8#Yo7 zM%wQRo;CpUl3)?^mz29pdv>7*DN(o#1`ekC65gLyvNzi@OJC#zGxD%0t0L@YqFkL* z0n5`_?1}Mz%jT7mz^kI^0jB+v5^qo_JTv_>>7O*5XT< zlW+ysGheiDn?rOITgx`^oV}sy_tSDqGyfQ8PfML23ys*XVq!AW=eqxVu_Goeb3xQI z5o2;Jlt{~SvdV>~=zZB0cNb2T+kAOqxvxAM@`k>tIaxtgEmh~F7ffAmo}QUez?(B! zq3t~HqE!D&=Vfv~{2oXwWkHiHU1ZQArIGz(OQT7z#vXtXu*Lh zNw7+fr4VU$;|RXmO@;9TSW{6lni!#G=Gd)`=dsz(dKj4wnI7j)oa}DH7CD? zD2vN{Zna!*sLT=m`Kie^r2_o>th`uuuEl!kk#&M)sYzZ@T&B zo8G?WAA3`(suTZy=iQ%ta`&qFwv5)fN90%9ndH0t&e!i>Gb8QrxA|Mgrks=?pSxvy zrfdDxap5VMOXKsCoy#h__w`Mi5ABFaeEfJ_4!FJbpn8EBvj7qk#3|-BTuoTzUAuS7LTxpIY;^$AI-Wkr(@P~uWLq4c4kz2O>nb6I46|* z`PbHj34Yi@MQ%>{CK_tmI^&x`+|e-8vPinV#M+~1)t47m2#TZC15=G|ifk2bV2@2^ zhlwXWbsb5DtfH(;w>8@$8l|X=UCUmW7X?`qYqmKi9d8WPyF8b0qr+(}wWn9-&&k7;+(w6wJ?3birdl`x|+Bn)*X{%^*Hpd zOOqr|p-0MfnUd3!@n>{rOCEOoY(5y%Ilvd(h&}Eaj6aYvfh!HAGWCg808%E#0YNbq zM|8r3J`?o^NtO}nQ9&I&M%qf07bG!7!&X}3t~V<2F|u%An8;%CvaJdn>|Fl* z{Ah4cKuftncqnjiDL2}kwo+SqjS2@f>9(NF;V`mGneL3q03fihtRbms4G5+O7i0hk z{PX?uxHC=#0*jr1pooCLtO9|_l_z)v%UN@Q5pP(rbxl~$E~(@XfII^t;8hIVZZMZ5 zW&b4TiI#-$Rv}~xf}tRWIa-G)AbHEGL=e>`-HgH7kjEpKOTCVUnnq($mwb=>>$N{G zTHtidd~C_ic~5}mHd*xgXC1z=V|!)Y#fx_}=31Hl(vOd@z8_1jicmv&(B8rQr88TC zwdZcG)$0n^Hq6c~(no(%m^9s=uTOc=esAb}XR^VNFxQu9OY!5x-6G$SWQbkGSz=*Y z6!?4kGS&|-LncRB!R*2Z#QDwVTvfAp^PE)mOhvJu+5nn)J?uY|Y#W&T!0(fOX<20k zSS>mIBd$Jh`=lSxBi!Ge@e6XuR??gyl#mhaQslCsi$I62%0znvQ3_Q4C%yiY4_w)AJynX_(SpIo&5*5 zuJg_7z=a^?c*2NfST3Ty zz>Dfnxxv(EbQW#MfJD_4gfzpdeL5n#uusA2qbxPb8wDd{K1!rtFG6~qwzPC?tlX$q zDS#zAi;`p0M_W5(5y!HGy^2DuQyXY0=OFh8(<=?~2ust-)6&W>%$b^haXOXYX&Kj+P>7RPj5xFva7d9tqzzkXkGd18re@WLx*MI|?dk0md8 zaPL5yO>U@et)AXKosZ7_R_pw$%8J)?gjQuh_*I;{jCt#(R?45Q5vSy71(czXqVm zr~>{W*Xs7^bnq95Nhd+b*g%>|I9Ds=XpaNl7$9mbK)DJnAfIGt22BE}FF>f}bV>9+R zYUiLRxWa%uP0bQ>ah)|(A*NZf>WdiUZ1~}Lzr8*&=uNbgms_JU;zKDlP7IeqOX(CG znyKuaPHzJs{0+hYRI(Qx=wTTc8{!p!ys!&Ej^K0q!5knV1}Rw#R0#&CH+%(^2aB;P zrlDcmZT(VHabsm;V6DFYwrvd!F;zy(_)nQ(u|oc06b)U*PRr^q**)(hghsoz=xf9KeN1C;PJI6N2f z$gI9<$wKo8m@G_z9t|(c0LQ}>g^$fFq*Rm|XxyL)&`jd7VF!W!LMG}lSZ$J?%`yt+ zygSYpvvL>C$z&{Z&VqcuwB?R0G&a+iU|Ii$G(UevEMu`V@?jjBms#SUUp-@u{Fcy| z+d$C`xsAfxKdubf4Wu@xnE9X%&N+uY4;NbV=Tez-=ND$=9Xqx%hYytEi_

5q!RY z*BeMp5!YRitn`g&nth8{m6Dd0QYAj0ZxqJ;!r>+5bAHQflhf0aYx(Url?1GY6U}5F zylvy$dA2fK(`58 z4KJ8nnOPF^3Rx@@8g_Vg6GI*_Bng?U4A#>qx-1Jv@{q$QbMPz!SyL+_iFRlz_(NHK z0V0O}tchz`Cb(6e7?+~x9pfb%8)c-+N~ShwBa6&z&P!?UfKd=_feP)X9~S=&MC3F( z*fN(l@lMz-Sg_16J{@jx<&VV<$8Y)g2W-?OuM)0zALCcypa7@C54l}4jp82+hE{_p zzbA6zM`9T_Oj{2RAI9}Nc{4Y$2PA<_)4TPX&X=UEl76Wmy`q=?CUS>c{DGdm^`|%G z(s%#%Hrw?koB7l6V{b8-VY{XAvxUrI5`qnSe&|K^v-^%e^oLtN=Nq48kKc0Q$&at- zZW5)*hobU>eO7s-$XtWXd)6mnm%lcTUi zK&*foQA{K#vaRajK9rcS7^w0jBmjFlBtBqCDQ+x!lKgTGJR=daf)T>G+sSz z>3!F|bshfrxlql3dksJ;yki`JCk>MLXg+mixfSh^nFV61GuCX5b*731Gb8O4vs+sD z4ZYW1+uL*PwerFv_UNOOT|#!KNGU?!W7<_aPf)(m1c|p*IQ7F$KslqsvIdML5`{$z z0qCeH@IM!*f^8%E$}_%2`zkHzlwXZbDe}9@bPMTFJd+e=i*a)@X7LHY13w}nwL}8*;!Y- zX2blTm}2po@Xu>WVIroz;-*=>PVN;djL-t96631*$$`%G82II>ph;?=TR4h2OMLSQ z2;d3;a80}nlz<;SHDQ`N9Q8jut4l5tVPQt5)YGAfWfy`Xy6Bw73Vm@xer|4VenPRn zqA@3W4m762OLl&L=g#koX_H0iV;tizI$~lRyxb8pIi6uPkq;}DBs2pY@?nAnJs^TD z8|!JS5EC74lgaH!6f4?##+LEvRQOK$x77r0bYambGsZy|W;q?ZfFQGZ5=^R43MD)+ z6i<$Qt^anS2UQ>elc`i$>dK&I$F<#sLe2x&ChT#9G~oMJ&o1ngsLNFmOi*H=P&BPU zE%f!18&NkWEbGE^zTUBW{);XJ1bwMMA8S@RNVDicF2Bdt*M5m!(Yp7|v1MQDVfLib zz2nWNI`Y#~z5BOQaVG)<*(#Jz?qZkt@@afP>W-7vV$y2Q#<~IOO|h;-EJ;N!4Tpo^ zU@8)hpk4hC!wy5Z)+7DJvtx7JcFpS9~Tv{OBpIM#U2D zk8XI`IcLd|InI}FIB@^{{6VN6P;wTAVBz=ve3qTy(=>t;n$`JeDcSLbsnk>E0m)Rm zW;_r~w&+rLE)V!M3z+;R)%Nb?WP5k7{P1TeUF_R`TC8z@?dLmK?~c#!(i*JSku2pS z--8$Fh@<%s*^)j0|Hg>bt>QjBE@Ipwk1==?343tLN;5Apv7hZkM!Shz~&+WynJAc08`uE`A{YtbCi2_ziC%N89v&j=UV=9qCt+GB%BC8;6h8AOLkTMEk zmx-ycsJ!u=#_~lu7w>+0_wJ|J&2VsFBTHw1WwLR$zLvoJ2*eqifiaekEnhy?+g>qu zZUvMf6i_~XSZe<2FrZa>nW!ptu~C5*5DIxY4HuAXNgnh}=7P5nA$+QwLt^``9#_+H z`mfOG+2|DlO&aD@zvygqs~}VbIiMpZi`#jGF-KZ`QT1chMfGWp>G|yL{OMzgD2xcf z&2eS^aeS+cMN(CcBrQxb--Af)ayk_`(~P!%i4=x2Cw_f+-HJeUbzsH1aM}F%>=s2% zM?Q*#8b&>34M=@f(d_9+*56D?Cr|Z%*N>-GXSyHS;W-Dk(&ZigO8Ro{e)| z{{oOe9gI!SmzU>HpVXWG_x(8bB|uKEg4`tZS&zOeJJplyEu|O751;DAFHVI{_uT2Y z6Ay~b#|bRYM44Q%QFaXTC?4xNd0&1-8@TY3-3 zAO33h?)O>J{;hv};kxBFUs|-Ta#}6_1WHvE^7Ha@@(<-7N99dz$V+mztm%#Hmv<&K z_OGe&&wu#3!(#WjKp8E2Vr{y2@G|Zkmfe#|!58R;hVaITt?gwBL01ilO z3ZFxoXLNL_9Mm{*e31+Tuo^8#Vy7NKITuBG1;>E_=_lK;$bl%VrP|4lA`n66UO>>; zpAzE?H7L6DBr}1{9C5%&p}?Iip-(U^m1ib7u@_Ve$B7W}G$G9eeN%KUjA3F2^CMpj zvrcdO;LWT-zsonhwPf=-f#p2T?lwu&)02+B5bsY<5-Z~UZ`Z}G%5qu^PJba{q69~t zw^lIQDm{`Y`26svo|_baJZrQ*Ve_>mGaE|ck`i1wfvGuDvl5*~yP@+UWrg#?xstWW=82!@sC2}|#8tq6 z1uss{tST(5%51I5b4wBzoR++2wv}z|>)jj-0_YgN!Z4Eqh( z#6fa_%rF{Q1v5Y;0ydA&QhX3^yT+8|J8?KE#u@u7&SESEi`)VT={;J_d%r;+;Wzwy z`F^YXkR>tBFoVH5i)5BB`N-3CTL!=3n-mH#v0$Eu)+w8El3a>)m8>vm`-(DXhJ*72 zfB;Ys@uq;74|>^vV{n17eegk})k9i06F*LvrJ-`HvSF-#DuPq%pM?4DF;&QKObL%2 zQT~zg`_%RrVb6)tnD(jjcNGXaiW=7y?3%yx$tQO{E`P}kk3X`5zd%pp6+76as&b8@ zU_*`m|Ge#d&-nju+s^jL|4-T;DkW>X|8HSt&z}Dqh|&C2D)4Sn=$j%~7X&3a0qO9yeGA>hr{%c;twgFkKCw@86vM zU*w<2r`PgL+@u=xvT6$`$KR7uhb^|n?gu0S&eo_F*ooTumu!(V= zZl~^Y-G1Fc-EF%2bl=lGMHYOq$2OcI`G_3II`xEo_ry70SQ(#iz^~oa@jCrH5kGmy zJ_W2ETHF<&An7^cLxTBu8f*fdiSj4%Pu%}i`De#ZJnPAUJ!rq_HRHOP=`LF}_A0y@ zcK)Ih7c197<+^uLSd9@EtJFHUXa_d*&MWN7@mMUd&Llst+&mekM4U0rm5xH)b?j@o zU;no;YHjSuk-J8pCE9(H$I~C>^+r80de;&59co*2;iRil))_J5r?v-tY{P*CF1zo{ z#ubhP(#hu%%uP%xM=f*lzl~ArQudG}>!_1ttj*QX_1g%DP)J0dO3L||o7^TqmPPqb z=F2lc$0-yW(U8RE2lYqdqG7P}v7et1?FU;>Igx^jJ4xB%bOYQ6I?|w14k+s==dU<; z5{^Zs#Cqfto>+)aAK}UJU*9nzr65A9=B8&Jkzf4YxyNp9V(f=EL6S{iM$R0@eaE&M z4V!+zgez}lMepqxKepqE9Xp<2xAd$tg0}G*%$2pH&u`p$#AdFmF&knf?ld;_aN(l& zFTCoXSF@GN2i|U7y}I@7{uOsJ-RJVT%LS{cINAqZ@*);^>|s`Lr`gbZ-|xqJBoD(z|^>f}mZ^yAq^oCu3R%L4-r#J=<4Ooig-dkn*oo4Vcpo!xc5B0c5-8YXx z9<_P$zK>ykW1Gpy#<}k7{oBM*k(&4D5!!vz1!Jx7UlbpNg3bzDughUkIULxV_62H7 z&e$4jd|Sm4Jm@!a1&{r{fX0m#A)izODZ;2mMy?5QEHV=2Dxs#qx*uFl*>@IxD zH>5q4SAJR4odE;XpDK=5V2K=Ie~qj!WP$M^`4y@88)$ge!Gkz5eC?a)b>h|P3>@nR zOyQ$H3SmF`hq^b=Cw`dw@Icyv>?c9K4I4K%+6W6p%q!19G?!yjT2)z|)GK&;jrWc$9ufXrw99RU~#s+9!Ivp!ekG66gjP#Z3p< zWrf^OC6;;=IT?@oUh;VTS#}W!29oPYf&h@xSz8^+;>fmI>_Mlz+UPYHjRvpLa46lH zZu48M>TN4U8H^q$+mm)p*k35lnP2Va9)nA77bL;(oZ$7P>9bePaOGO99DY~?A+KC- z-mr9PZ(_0`qco*pxjk{J(-z2b720ezb3uuX;|we_InI+FNlRV*h?Bv*SWI4S4un}v zz9?^bY)Xs`PKC2KNG#E26O$p??%<|$?upBF*=??Z=O0a3zA2%or)zrF-!YI6VZy1aKN#^Q>N zho*lbG9`&ZV$+_G-Q(;lDolHHrqg1Lj;r)Uxuzv^y@^Q<39iR-GD983og+!Pdc7f# zGkr>3ZE`q1HaYCi_gUf|WTxie_VRVhmI$0}{U#995sm{M1Psmu+(nVTFiG8&3NFY6 z0#d-lBW`Auh&UWFA}T#q3emX3@)?>wGE8 z8^(W`=#XZQZ^VJCzzb$w0n2^QY_AV6c`iuJ$LIU2sGt9MDY(51x|P|XznE%2NWz97{`x-sjWl?W*k(jiGvfG zDiDdSL_&N6#`n?<{w!D}jB=H_Aa-0RrKP7q%Q#T#ff)y|RTQm_5E7I@=;Q19D%Uf{ zC8OPB!tNcuieO*U0@L@RAnGN(5ofW--`}>4J-FefM7Q-&Prr^L!vqVlSbzYxi?9i!!v#fD(@+Ji>SV#- zhrj^|6jX77FNHXf^jV~GO~?b8NYf39?)r3}PJo~<{Mq1@w@`q%2GVhCca;BtyKn|< zXhe&f^^&dd{GQR2s6(}EvApiiIG-Rc&6Kv~rR66}htK`F{QgbX$ba3C?3jA{w|3`b zr)HZ(;ryT6vaLaMl&78Z<-=EJW_r@$Of2-8JihypoJ%i0FDvWHEzf;A#~$DC>sO1@ zX06G{ByTx$pz^MdO3wuHD4f|7ND{bIkzEVtS4P+LTdKKbNzU%XkR#1^2o^jl4*c@i zkC29{1%^*IPcMLXz>*_ytsO4p+`P+Gs}46yzb`8j?$VKy(qAx%uKT- zrgr|+jE#S()aTUJ$Hh8LuDF)imQ1(UeDk^*i`DCIW9Kr{?)k6De;iJ=#KUOuYS`xs zoY%c3KHl2kzvRjtxw$;X5g(h7U^S;qHTw2n{?aYOZHZ})IaB=$hUEr~U*<`x{vGMB zIH@WI1-e49IE7__@IRvQ?2sb|1@$Qf8OgCH^+F}um0fT-Y0Kv<)7!@Q<0VAPVkx~L3EgHnVH!c zsj)UT{*&!bw8WO~IKsTQ=B&usVtY;ACCk@aZ@x7F?j%!Qdzub`o>p)AYhG(JE_&ea z@~to2%nJVc`nMuE-etEA2dX6dX$S z?24eHO)}jB(9OOQdfE5G_7CJv$wDR0Q^|5=>Hqebte64SYEojbq#NTV`3J?vEy+FL zEa89kd}PpB?8F}|a{k-9_}%jC6GzBqs!*L>4#Mbv&Y~0vmY>t<^x^lPh7Ny)3d*x3 zs_eLta-xLK|A#w`4bv52eOrX}?JA-*0j;27Ag1Gi5TB44g=ctmEu!r-9mU|CVqzsq zf(9D4&=aD5m?c%PVO#);3D-sq!N=zI}Liha5PM|k0Bvc zhE$6D5LJg|Cey|;!$_e|zT*k6&1MgHpD42hX4*RBKfmVWv8g%EL9iPJojIwo-1(aP z=MLMENC zlPJHW__Pcs<(lHzEvY@WQZE{{;jq8doXPTUlwbHXIyc2-j2?T7WC7nAi#EDaa-%A-cnmns=lx&RbO@RAPk%5=Soykq1~<)B)@SZtN7-EqHFDoCGNR7m4^nhuYq9Tg)YmlhQ)6kbmT-1T^(v4)5SiTP=d47`;gJ!5Fx``YNp zd$)BP5c=8Z4a|KnnPL8=7_8`9Y zuK~nM0Zg)GW#R`jNPe9CPd0sY>O7ug0)&TeDZT%ml7|+=d>$juV8s{8ud#PO@BEBy z|H0y?`7~P46`W&C*()jdimRIQ))>^fOn&m3paOu*0Flg z(~H(Cxsd;KNqqA+P=(mDo@9pA&{4OJcXS`=KE*de6w41m zS8OY=Wq>RtCWKzuVnB~s-D?OjdSwft>=M9@P`DCd5(W=@1Il_&s}49BSbvbCiZKu7 zoMHu5XIJ?an5Gno35N*;4|X6BD2bW@l8)grnwKcjbN>ei^sP>^eOfPJ#S_D(gwGYI!YV=NrJx&muiF}3C zkd|Y$;4&VQF&&F|bTqD#=(3jA_^krX3jt|*QZdZv-x!x;ArzOHEl`|?)ybUsBt~6te+nqYz>vSY0 zOmjLN;VS->=yW)!8EDM+9dKG2PB!OHMvL9x@JIi};?MN@jd$K;N@9Me{AFUOJ=SCs zQtnJvD~s35??&as8l&hUgu_->bai}!HQF`K66^fd@>;jc%BwfZU(TB@G_IH6;do|2 z*X%X+jaS}WIrZY9C8lNPS9r@}3^h%=XFC@+ck)4Zi5*|9T+zTJxCh5)i>?z>+-ag1 zlbt4sUSUJRbbNL~VpW=Re5oT&6r${oczpaZPuS@&=ZAf;`mc*+e%c8s|B7_YS{Ob! zba!fDj-A90wXgur@8?=r)LB@(7M66d{iB8Th~KP*4Z1}<2P!?d3I5?tC^r0IDlxvsr=9`9!^0Xn{M8i6eL(Qq?p=at& zDr*RJv?G0=(rrD6Ye6iQ2LwP662wfN&*9^dj_}`n@e@lv${JnXYSOWDt5i)VvlImI}KE{+kkt zFj8u-^edxPgv{SmW>GIbvVS;&_X>?ew}17IKZiFAl#qZ^!acf6amI9&?rPWy+N-;g z5xR!ERY;K=m=WGt&CG&bnhoTpgE^rB7|mSF&0?_Vd08y{wZyXoNLwUtLO%i*>UNtOv}uKIl^putByFHc*Dy2u#9mVw>TOd@I|=&cVj` zJcv(jXJhOFb|KrrE`r;^U2HcbNiKov>K=9(yPRFYu4GrStJz+54co`|vjgl~Fv@lv zyPn+uA3+CUq5CFwnBC02&2C}0vfJ40><)Okx{KY-?qT<```CBb{p`E!0rnt!h&{}{ z#~xvivd7?V^$GSQ`#yV$JX+Fo>{S@i z{TX|m{hYnQ-ehmFx7j=F7wld39{VNx6?>oknjK{yuw(2)_7VFHtf~GEo{K(ae_(%P ze`24oPuXYebM|NU1^Wy8EBhP!JNpOwC;O6p#g4NRY@EsLB-e4qITyIdB@S*1H|o;3 ziJQ3v-hpf!h6A~iNAYOx;%*+pJ>1J;0=5xpT%eM zIeadk$LI3}d?9b-i}+%`ME5#h%9ruwd<9?0SMk++4PVRG@%6lkH}e+W%G-E5kMIsC zJ#_JIzJd4fUf#$1`2Zi}8~G3)<|BNRZ{nNz7QU5l=cIDdja$-mE^ z;!pD*@FV;g{w#lv|B(NPKhIy_FY+Jrm-tWkPx;II75*xJjsJ|l&VSC|;BWG`_}ly) z{tNyte~Tgu$p6GY;h*x)_~-o3{0sgU z{#X7t{&)Tl{!jiT|B4^yCpdIt`AIE`oLaLA^qzf5Brr;N{glr*4$QAO0e4#)9FHR^H zN`!z=DgxA_}lh7=*2(3b!&@M!T4xv-%61s&A zLXXfZ^a=gKfG{X*6o!OhVMG`eHVK=BEy7k|n{bYBu5ccdNVW@O!Ue*G!VcjgVW+T5 z*ezTvTq0a5>=7;#E*Gv4t`x2kt`_zR*9iNB{lWp^Tf()%b;9++4Z@AWLE(^alWwe&M^q1G;@uXK%~!u+%p?+})-hjslmcibZtxav+Lv6hg)HxVw88Kj~ z236H%q^2kZ_71f5h#kExoo0MY`(W2Ve`MIaX`pwsFVckeShOHjVA8^)gZhm_Z3FEQ zLo2!icVVQZQ^aprY#kWrG17%rcxiB`yMILA*3uUlY7uF9#rxiNefLNU7DCHNWXniX zSA?iQvl8Ci-9FM~#=Fk`rrt=$h*b?@$sCCcS=0xGGPJ4T4Wq*&-5py+`W8!fe>>8t z`LwW-*51+57NK5i+SJ`1888fXw~dSrMf8J_{lgD8Hz}4T@myU4VZ0sBr@34+S1muxn-!`*3p74oOm)$1Vrj|X|M%A0Kga+G=Tb{ z(zfKalco=rmo>X+Ll9+Xco4fc)>HxXc%`?~wJphX2DCE761qugy9 zM1=@NCh9g$=SATbZr_y!_{n;Newzc#|`rBKE^h4Mx4D=b=2KxFi-uk|l z&i=@Vd7{5Y2T%1QwGZGvvN;kNvEkDP2dT(5Ojv6NpfEC|R%X#2s0j|O;hQ2uAV*tz zqqOI)fuZhgL>=~;0P#(2fQu39$mZ@5z@^&p1Y`vE%9B-v_$E|7G$8auwu+d|!$z&i z!?uyG(Z1Ha4sG(Jb0~I?^HBv8dP`{+icZ&kzYDM;m$*Vq^ zl>|y=gZ9D3iEq`bCF@6lhT3{805MD&>fm-^Xn0uYYHv5T0vgbH{bFmRx7X4}-P(bU z9f_E`FpNzqbSpuc?*=6_I%rbv)FDwSa5kNW$mla-lmZ-QM2!xfnTd)44j*WZ=r<2x z&UZ;8EyF#-dSF!anW=TCJJQjHO^lf!SDhzP=g`3DAka#Gj|6}mZP&L(T7V&hw$Tv` z<=|HHV9THaKiz}kF!rxz8l9$A0BR2)ZeR$&#YcPjKrb-HPX@;`+GER!N6jA3M}8GRlZX`(O1 zJfR>asT!bewWvX*uP|?b+53mZ;ejE58ZJsUgA&5znONBfM6gDvuqLA20|1y#z<)cI zq}Bn9u|)%CN@<+{ZF(RaKLU6i!7gvm2uL5o*tY;90_T~5+q-}?M|)e1zzZ1X&WK&< zVx<|hbXnC$6;chfls5IXTab68YhW0iA2AM(c8}1A840MUMtvI=sz?MY%mA=5t(3}g zLZ8q&+TDxU(rHBIL0WfAEq$oHrN1qr?~AnebdOj%s7a`0Lj+BaU>)dE`d#cO?ubOS z4~$}lfxL!=I@5dA`5q|4BW)qSv~-3T(N#XWN0tGc7k%CGBuR1L>hY|AZH0@r~w6H(Zn`&H8Uw_or*%qB>}U#whBE%n}ybqHX@TFrc-m)soc#gzu>60&Z^YC75)QI|ID zLEM62Hqk|iK9z<#)6fpM0Z|Q<4gzojd4a~lbLUV?pS}Y$ZO@R<(%vt2l$4d&Tf0YE zf!KkK)nNc8>>aXOP7_nMNzbE$liw0tIVZhUr}$=&xdWSr4Vb1w1KsTs zCdTL%G_$*v)|TO(t%F$921bX5H;!Ua0673q8PInCE%!!5y3hhX(mf~)kJ8YF!v@;i zbZ?3Xt)rcMQ;)Pc(%m|MjYB{Fkf1DJSH2z7LB-q@7mQIqU}6pKRY`Dq6}GnzfF4k` zA6n;^m0LG~6bDtRv;@aqncoGP%W(%1qF+dDOik5 z!D3_z7E`8@V!F`V63SFUnMzPiumsfvODIPPqGQmzuQ!q?9!juDcjB%kH zVXdhR$~(#wF2j&?DDNm!8NDc@Ol6d*j9!#cHDy!{B%P7CjY3pS8RaOa9OaaQ;37zH z5hS<>5?llcE`kIXL4u25IpwIJ92Jyz$GYl1e9R}P#~ndpd17gApiv~$Ppr- z2oX?(icv?X7ZaA%cidafP%g0$hq9fkcSP3K2+z2qZ!T5+MSK5P?L9Kq6E^ zl?14g0OcTH2oW%Z2pB>H3?TxB5CKDofFVS{5F%g*5io=Z7(xULAwpjvn6|=&a+Fez zQp!q^DF+4}7s?T?KyM=lE|dd@ekAZhiUx7H2z^4|8PK^ zmVp|rg*ED&57Y$Ime-VOcXh%AYP6=-s53uMQ>MKy*X|SL)o9PP+PzM@*K79~>b+L0 zw^pmSR;#yGtG8CGw^pmSR;#yGtG8CGw^pmSR;#yGtG8CGw^pmSR;yP-nt?j4-a4(` zI<4M1t=>AV-a4(`I<4M1t=>AV-a4(`I<4M1t=>AV-a4&b4Yvj~+#0CY>aEx6t=H<+ zFl<1>uz`B5-g>Rxdad4it=@XA-g>Rxdad4it=<`0KhO9-gZkGMYOgEQURS8Su2BEF zLjCIsN-365OI@Lsx + + + +Created by FontForge 20120731 at Mon Oct 24 17:37:40 2016 + By ,,, +Copyright Dave Gandy 2016. All rights reserved. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/fonts/fontawesome-webfont.ttf b/fonts/fontawesome-webfont.ttf new file mode 100644 index 0000000000000000000000000000000000000000..35acda2fa1196aad98c2adf4378a7611dd713aa3 GIT binary patch literal 165548 zcmd4434D~*)jxjkv&@#+*JQHIB(r2Agk&ZO5W=u;0Z~v85Ce*$fTDsRbs2>!AXP+E zv})s8XszXKwXa&S)7IKescosX*7l99R$G?_w7v?NC%^Bx&rC7|(E7f=|L^lpa-Zk9 z`?>d?d+s^so_oVMW6Z|VOlEVZPMtq{)pOIHX3~v25n48F@|3AkA5-983xDXec_W** zHg8HX#uvihecqa7Yb`$*a~)&Wy^KjmE?joS+JOO-B;B|Y@umw`Uvs>da>d0W;5qQ!4Qz zJxL+bkEIe8*8}j>Q>BETG1+ht-^o+}utRA<*p2#Ix&jHe=hB??wf3sZuV5(_`d1DH zgI+ncCI1s*Tuw6@6DFOB@-mE3%l-{_4z<*f9!g8!dcoz@f1eyoO9;V5yN|*Pk0}XYPFk z!g(%@Qka**;2iW8;b{R|Dg0FbU_E9^hd3H%a#EV5;HVvgVS_k;c*=`1YN*`2lhZm3 zqOTF2Pfz8N%lA<(eJUSDWevumUJ;MocT>zZ5W08%2JkP2szU{CP(((>LmzOmB>ZOpelu zIw>A5mu@gGU}>QA1RKFi-$*aQL_KL1GNuOxs0@)VEz%g?77_AY_{e55-&2X`IC z!*9krPH>;hA+4QUe(ZB_4Z@L!DgUN;`X-m}3;G6(Mf9flyest6ciunvokm)?oZmzF z@?{e2C{v;^ys6AQy_IN=B99>#C*fPn3ra`%a_!FN6aIXi^rn1ymrrZ@gw3bA$$zqb zqOxiHDSsYDDkGmZpD$nT@HfSi%fmt6l*S0Iupll)-&7{*yFioy4w3x%GVEpx@jWf@QO?itTs?#7)d3a-Ug&FLt_)FMnmOp5gGJy@z7B*(^RVW^e1dkQ zkMHw*dK%Ayu_({yrG6RifN!GjP=|nt${60CMrjDAK)0HZCYpnJB&8QF&0_TaoF9-S zu?&_mPAU0&@X=Qpc>I^~UdvKIk0usk``F{`3HAbeHC$CyQPtgN@2lwR?3>fKwC|F> zYx{2LyT9-8zVGxM?E7=y2YuRM`{9bijfXoA&pEvG@Fj<@J$%dI`wu^U__@Oe5C8e_ z2ZyyI_9GQXI*-gbvh>I$N3K0`%aQw!JbvW4BL|QC`N#+Vf_#9QLu~J`8d;ySFWi^v zo7>mjx3(|cx3jOOZ+~B=@8!PUzP`iku=8-}aMR(`;kk#q53fC(KD_gA&*A-tGlyS3 z+m)8@1~El#u3as^j;LR~)}{9CG~D_9MNw(aQga zKO~TeK}MY%7{tgG{veXj;r|am2GwFztR{2O|5v~?px`g+cB0=PQ}aFOx^-}vA95F5 zA7=4<%*Y5_FJ|j%P>qdnh_@iTs0Qv3Shg)-OV0=S+zU1vekc4cfZ>81?nWLD;PJf5 zm^TgA&zNr~$ZdkLfD=nH@)f_xSjk$*;M3uDgT;zqnj*X$`6@snD%LSpiMm2N;QAN~ z_kcBPVyrp@Qi?Q@UdCdRu{^&CvWYrt=QCD^e09&FD^N$nM_`>%e`5*`?~&bbh->n~ zJ(9*nTC4`EGNEOm%t%U8(?hP3%1b;hjQAV0Nc?8hxeG3 zaPKiTHp5uQTE@n~b#}l3uJMQ)kGfOHpF%kkn&43O#D#F5Fg6KwPr4VR9c4{M`YDK; z3jZ{uoAx?m(^2k>9gNLvXKdDEjCCQ+Y~-2K00%hd9AfOW{fx~8OmhL>=?SSyfsZaC!Gt-z(=`WU+-&Dfn0#_n3e*q()q-CYLpelpxsjC~b#-P^<1eJJmK#NGc1 zV_&XPb2-)pD^|e^5@<6_cHeE7RC;w7<*1(><1_>^E_ievcm0P?8kubdDQj%vyA=3 z3HKCZFYIRQXH9UujQt#S{T$`}0_FTN4TrE7KVs}9q&bK>55B|Lul6(cGRpdO1Kd`| zeq(~e`?pp&g#Y$EXw}*o`yJwccQ0eFbi*Ov?^iSS>U6j#82bal{s6dMn-2#V{#Xo$ zI$lq~{fx0cA?=^g&OdKq?7tBAUym`?3z*+P_+QpC_SX>Hn~c4gX6!Ab|67K!w~_Ac z_ZWKz;eUUXv46n53-{h3#@>IKu@7En?4O7`qA>R1M~r=hy#Got_OTNVaQ-*)f3gq` zWqlf9>?rCwhC2Ie;GSYEYlZ8Edx9~|1c$Hz6P6|~v_elnBK`=R&nMuzUuN8VKI0ZA z+#be@iW#>ma1S$XYhc_CQta5uxC`H|9>(1-GVW=IdlO`OC*!^vIHdJ2gzINKkYT)d z3*#jl84q5~c0(mMGIK+jJFO2k6NLvlqs#h}}L0klN#8)z2^A6*6 zU5q!Nj7Gdit%LiB@#bE}TbkhZGoIMXcoN~QNYfU9dezGK=;@4)al-X6K6WSL9b4dD zWqdqfOo0cRfI27sjPXfulka7G3er!7o3@tm>3GioJTpUZZ!$jX5aV4vjL$A+d`^n- zxp1e$e?~9k^CmMsKg9T%fbFbqIHX;GIu<72kYZMzEPZ`#55myqXbyss&PdzkU-kng%ZaGx-qUd{ORDE9`W-<*I${1)W@@_xo| z#P?RjZA0Ge?Tp_{4)ER51-F;+Tjw*r6ZPHZW&C#J-;MVj3S2+qccSdOkoNAY8NUbR z-HUYhnc!Y!{C@9;sxqIIma{CrC z{*4;OzZrsik@3eKWBglt8Gju9$G0;6ZPfp5`1hya;Q!vUjQ{6qsNQ=S2c6;1ApV)% zjDJ4@_b}tnn&43HfiA|MBZsgbpsdVv#(xMHfA~D(KUU!0Wc>La#(y%O@fT{~-ede{ zR>pr0_Y2hXOT@kS3F8L=^RH0;%c~jx_4$nd=5@w@I~NXdzuUt2E2!)DYvKACfAu5A zUwe%4KcdXn;r@iOKr8s4QQm)bG5$uH@xLJ7o5hU3g}A?UF#a~+dV4S9??m7ZG5+_} zjQ<05{sZ6d0><|ea8JQ~#Q6It>z^jLhZ*lv;9g|>Fxqwm@O+4TAHKu*zfkVS4R9I8 z{~NIVcQ50g0KQKVb`<_&>lp7xn*Q?{2i@S=9gJ(JgXqP;%S_@4CSmVFk{g($tYngU z2omdDCYcd#!MC-SNwz*FIf|L&M40PMCV4uTQXRtTUT0GMZYDM0-H5Up z-(yk}+^8)~YEHrRGpXe%CMDJ}DT(-2W~^` zjDf-D4fq2U%2=tnQ*LW*>*Q@NeQ=U48Xk01IuzADy1ym0rit^WHK~^SwU449k4??k zJX|$cO-EBU&+R{a*)XQ6t~;?kuP)y%}DA(=%g4sNM$ z8a1k^e#^m%NS4_=9;HTdn_VW0>ap!zx91UcR50pxM}wo(NA}d;)_n~5mQGZt41J8L zZE5Hkn1U{CRFZ(Oxk3tb${0}UQ~92RJG;|T-PJKt>+QV$(z%hy+)Jz~xmNJS#48TFsM{-?LHd-bxvg|X{pRq&u74~nC4i>i16LEAiprfpGA zYjeP(qECX_9cOW$*W=U1YvVDXKItrNcS$?{_zh2o=MDaGyL^>DsNJtwjW%Do^}YA3 z3HS=f@249Yh{jnme5ZRV>tcdeh+=o(;eXg_-64c@tJ&As=oIrFZ& z*Gx&Lr>wdAF8POg_#5blBAP!&nm-O!$wspA>@;>RyOdqWZe?F%--gC9nTXZ%DnmK< z`p0sh@aOosD-jbIoje0ec`&&fWsK?xPdf*L)Qp(MwKKIOtB+EDn(3w-9Ns9O~i z7MwnG8-?RZlv&XIJZUK*;)r!1@Bh4bnRO*JmgwqANa8v4EvHWvBQYYGT?tN4>BRz1 zf1&5N7@@!g89ym5LO{@=9>;Y8=^ExA9{+#aKfFGPwby8wn)db@o}%Z_x0EjQWsmb6 zA9uX(vr-n8$U~x9dhk~VKeI!h^3Z2NXu;>n6BHB%6e2u2VJ!ZykHWv-t19}tU-Yz$ zHXl2#_m7V&O!q(RtK+(Yads868*Wm*!~EzJtW!oq)kw}`iSZl@lNpanZn&u|+px84 zZrN7t&ayK4;4x_@`Q;;XMO4{VelhvW%CtX7w;>J6y=346)vfGe)zJBQ9o$eAhcOPy zjwRa6$CvN-8qHjFi;}h1wAb{Kcnn{;+ITEi`fCUk^_(hJ&q1Z=yo*jRs<94E#yX67 zRj)s)V&gd0VVZGcLALQ|_Lp<4{XEBIF-*yma#;%V*m^xSuqeG?H-7=M0Cq%%W9`2Oe>Ov)OMv8yKrI^mZ$ql{A!!3mw_27Y zE=V#cA@HopguAWPAMhKDb__-Z_(TN7;*A`XxrMefxoz4{Seu)$%$=sPf{vT@Pf_T`RlrC#CPDl$#FnvU|VBC$0(E>+3EG z&3xsml}L_UE3bNGX6T~2dV6S%_M9{`E9kgHPa+9mas{tj$S<&{z?nRzH2b4~4m^Wc zVF+o4`w9BO_!IohZO_=<;=$8j?7KUk(S5llK6wfy9m$GsiN5*e{q(ZS6vU4l6&{s5 zXrJJ@giK>(m%yKhRT;egW||O~pGJ&`7b8-QIchNCms)}88aL8Jh{cIp1uu`FMo!ZP z1fne;+5#%k3SM7Kqe|`%w1JI=6hJJrog4j?5Iq!j=b=0AJS5%ev_9?eR!_H>OLzLM z_U#QLoi=0npY1+gHmde37Kgp)+PKl=nC>pM|EJCAEPBRXQZvb74&LUs*^WCT5Q%L-{O+y zQKgd4Cek)Gjy~OLwb&xJT2>V%wrprI+4aOtWs*;<9pGE>o8u|RvPtYh;P$XlhlqF_ z77X`$AlrH?NJj1CJdEBA8;q*JG-T8nm>hL#38U9ZYO3UTNWdO3rg-pEe5d= zw3Xi@nV)1`P%F?Y4s9yVPgPYT9d#3SLD{*L0U{ z;TtVh?Wb0Lp4MH{o@L6GvhJE=Y2u>{DI_hMtZgl~^3m3#ZUrkn?-5E3A!m!Z>183- zpkovvg1$mQawcNKoQ*tW=gtZqYGqCd)D#K;$p113iB1uE#USvWT}QQ7kM7!al-C^P zmmk!=rY+UJcJLry#vkO%BuM>pb)46x!{DkRYY7wGNK$v=np_sv7nfHZO_=eyqLSK zA6ebf$Bo&P&CR_C*7^|cA>zl^hJ7z0?xu#wFzN=D8 zxm(>@s?z1E;|!Py8HuyHM}_W5*Ff>m5U0Jhy?txDx{jjLGNXs}(CVxgu9Q4tPgE+Hm z*9ll7bz80456xzta(cX+@W!t7xTWR-OgnG_>YM~t&_#5vzC`Mp5aKlXsbO7O0HKAC z2iQF2_|0d6y4$Pu5P-bfZMRzac(Yl{IQgfa0V>u;BJRL(o0$1wD7WOWjKwP)2-6y$ zlPcRhIyDY>{PFLvIr0!VoCe;c_}dp>U-X z`pii$Ju=g+Wy~f|R7yuZZjYAv4AYJT}Ct-OfF$ZUBa> zOiKl0HSvn=+j1=4%5yD}dAq5^vgI~n>UcXZJGkl671v`D74kC?HVsgEVUZNBihyAm zQUE~mz%na<71JU=u_51}DT92@IPPX)0eiDweVeDWmD&fpw12L;-h=5Gq?za0HtmUJ zH@-8qs1E38^OR8g5Q^sI0)J}rOyKu$&o1s=bpx{TURBaQ(!P7i1=oA@B4P>8wu#ek zxZHJqz$1GoJ3_W^(*tZqZsoJlG*66B5j&D6kx@x^m6KxfD?_tCIgCRc?kD~(zmgCm zLGhpE_YBio<-2T9r;^qM0TO{u_N5@cU&P7is8f9-5vh4~t?zMqUEV!d@P{Y)%APE6 zC@k9|i%k6)6t2uJRQQTHt`P5Lgg%h*Fr*Hst8>_$J{ZI{mNBjN$^2t?KP8*6_xXu5xx8ufMp5R?P(R-t`{n6c{!t+*z zh;|Ek#vYp1VLf;GZf>~uUhU}a<>y*ErioacK@F{%7aq0y(Ytu@OPe;mq`jlJD+HtQ zUhr^&Zeh93@tZASEHr)@YqdxFu69(=VFRCysjBoGqZ!U;W1gn5D$myEAmK|$NsF>Z zoV+w>31}eE0iAN9QAY2O+;g%zc>2t#7Dq5vTvb&}E*5lHrkrj!I1b0=@+&c(qJcmok6 zSZAuQ496j<&@a6?K6ox1vRks+RqYD< zT9On_zdVf}IStW^#13*WV8wHQWz$L;0cm)|JDbh|f~*LV8N$;2oL|R99**#AT1smo zob=4dB_WB-D3}~I!ATFHzdW%WacH{qwv5Go2WzQzwRrv)ZajWMp{13T_u;Rz^V-VF z@#62k@#FD#t@v9ye*A%@ODWm-@oM_$_3Cy1BS+(+ujzNF@8a7?`$B^{iX2A-2_nA? zfi2=05XV^;D_2G}Up$eFW|Ofb^zuE)bWHkXR4Jm!Sz0O?)x6QD^kOufR`*v0=|sS?#*ZCvvr^VkV!zhLF3}FHf%+=#@ae1Qq<4~Y1EGYK$Ib1 zg!s~&&u27X&4Ks^(L3%}Npx!_-A)We=0v#yzv03fzxKZ8iV6KIX5U&?>^E?%iIUZ4 z2sD^vRg%kOU!B5@iV{&gBNc9vB)i{Wa@joIa2#4=oAl|-xqj_~$h33%zgk*UWGUV# zf3>{T#2buK?AZH?)h>10N)#VHvOV}%c|wR%HF|pgm8k`*=1l5P8ttZ1Ly@=C5?d9s z)R>B@43V`}=0??4tp?Y}Ox0$SH)yg(!|@V7H^}C-GyAXHFva04omv@`|LCuFRM2`U zxCM>41^p9U3cR>W>`h`{m^VWSL0SNz27{ske7TN1dTpM|P6Hn!^*}+fr>rJ*+GQN{ ziKp9Zda}CgnbNv#9^^&{MChK=E|Wr}tk?tP#Q?iZ%$2k;Eo9~}^tmv?g~PW^C$`N)|awe=5m{Xqd!M=ST?2~(mWjdOsXK#yVMN(qP6`q#tg+rQexf|*BeIU)a z^WuJyPR4WVsATp2E{*y77*kZ9 zEB{*SRHSVGm8ThtES`9!v{E``H)^3d+TG_?{b|eytE1cy^QbPxY3KFTWh&NZi`C?O z;777FMti@+U+IRl7B{=SCc93nKp`>jeW38muw(9T3AqySM#x@9G|p?N;IiNy(KN7? zMz3hIS5SaXrGqD(NIR0ZMnJT%%^~}|cG(Ez!3#)*o{{QjPUIVFOQ%dccgC0*WnAJW zL*1k^HZ5-%bN;%C&2vpW`=;dB5iu4SR48yF$;K8{SY`7mu6c z@q{10W=zwHuav3wid&;5tHCUlUgeVf&>wKuUfEVuUsS%XZ2RPvr>;HI=<(RACmN-M zR8(DJD^lePC9|rUrFgR?>hO#VkFo8}zA@jt{ERalZl$!LP4-GTT`1w}QNUcvuEFRv z`)NyzRG!e-04~~Y1DK>70lGq9rD4J}>V(1*UxcCtBUmyi-Y8Q$NOTQ&VfJIlBRI;7 z5Dr6QNIl|8NTfO>Jf|kZVh7n>hL^)`@3r1BaPIKjxrLrjf8A>RDaI{wYlKG)6-7R~ zsZQ}Kk{T~BDVLo#Zm@cc<&x{X<~boVS5(zfvp1s3RbASf6EKpp>+IFV9s`#Yx#+I& zMz5zL9IUgaqrnG*_=_qm|JBcwfl`bw=c=uU^R>Nm%k4_TeDjy|&K2eKwx!u8 z9&lbdJ?yJ@)>!NgE_vN8+*}$8+Uxk4EBNje>!s2_nOCtE+ie>zl!9&!!I)?QPMD&P zm$5sb#Le|%L<#tZbz%~WWv&yUZH6NLl>OK#CBOp{e~$&fuqQd03DJfLrcWa}IvMu* zy;z7L)WxyINd`m}Fh=l&6EWmHUGLkeP{6Vc;Xq->+AS`1T*b9>SJ#<2Cf!N<)o7Ms z!Gj)CiteiY$f@_OT4C*IODVyil4|R)+8nCf&tw%_BEv!z3RSN|pG(k%hYGrU_Ec^& zNRpzS-nJ*v_QHeHPu}Iub>F_}G1*vdGR~ZSdaG(JEwXM{Df;~AK)j(<_O<)u)`qw* zQduoY)s+$7NdtxaGEAo-cGn7Z5yN#ApXWD1&-5uowpb7bR54QcA7kWG@gybdQQa&cxCKxup2Av3_#{04Z^J#@M&a}P$M<((Zx{A8 z!Ue=%xTpWEzWzKIhsO_xc?e$$ai{S63-$76>gtB?9usV&`qp=Kn*GE5C&Tx`^uyza zw{^ImGi-hkYkP`^0r5vgoSL$EjuxaoKBh2L;dk#~x%`TgefEDi7^(~cmE)UEw*l#i+5f-;!v^P%ZowUbhH*3Av)CifOJX7KS6#d|_83fqJ#8VL=h2KMI zGYTbGm=Q=0lfc{$IDTn;IxIgLZ(Z?)#!mln$0r3A(um zzBIGw6?zmj=H#CkvRoT+C{T=_kfQQ!%8T;loQ5;tH?lZ%M{aG+z75&bhJE`sNSO`$ z`0eget1V7SqB@uA;kQ4UkJ-235xxryG*uzwDPikrWOi1;8WASslh$U4RY{JHgggsL zMaZ|PI2Ise8dMEpuPnW`XYJY^W$n>4PxVOPCO#DnHKfqe+Y7BA6(=QJn}un5MkM7S zkL?&Gvnj|DI!4xt6BV*t)Zv0YV-+(%$}7QcBMZ01jlLEiPk>A3;M^g%K=cNDF6d!7 z zq1_(l4SX+ekaM;bY|YgEqv2RAEE}e-Im8<@oEZ?Z81Y?3(z-@nRbq?!xD9Hyn|7Gx z-NUw`yOor_DJLC1aqkf2(!i=2$ULNfg|s8bV^xB!_rY+bHA;KsWR@aB=!7n&LJq(} z!pqD3Wkvo-Goy zx1edGgnc}u5V8cw&nvWyWU+wXqwinB#x7(uc>H44lXZQkk*w_q#i2O!s_A?a*?`Rx zoZW6Qtj)L1T^4kDeD7;%G5dS816OPqAqPx~(_-jZ`bo-MR_kd&sJv{A^ zs@18qv!kD;U z5Evv$C*bD~m z+x@>Oo>;7%QCxfp-rOkNgx4j-(o*e5`6lW^X^{qpQo~SMWD`Gxyv6)+k)c@o6j`Yd z8c&XSiYbcmoCKe+82}>^CPM+?p@o&i(J*j0zsk}!P?!W%T5`ppk%)?&GxA`%4>0VX zKu?YB6Z)hFtj@u-icb&t5A1}BX!;~SqG5ARpVB>FEWPLW+C+QOf~G-Jj0r`0D6|0w zQUs5sE6PYc)!HWi))NeRvSZB3kWIW|R^A%RfamB2jCbVX(Fn>y%#b1W%}W%qc)XVrwuvM!>Qur!Ooy2`n@?qMe3$`F2vx z9<=L}wP7@diWhCYTD?x)LZ>F6F?z8naL18P%1T9&P_d4p;u=(XW1LO3-< z`{|5@&Y=}7sx3t1Zs zr9ZBmp}YpHLq7lwu?CXL8$Q65$Q29AlDCBJSxu5;p0({^4skD z+4se#9)xg8qnEh|WnPdgQ&+te7@`9WlzAwMit$Julp+d80n+VM1JxwqS5H6*MPKA` zlJ*Z77B;K~;4JkO5eq(@D}tezez*w6g3ZSn?J1d9Z~&MKbf=b6F9;8H22TxRl%y1r z<-6(lJiLAw>r^-=F-AIEd1y|Aq2MggNo&>7Ln)S~iAF1;-4`A*9KlL*vleLO3vhEd(@RsIWp~O@>N4p91SI zb~+*jP?8B~MwmI0W$>ksF8DC*2y8K0o#te?D$z8nrfK{|B1L^TR5hlugr|o=-;>Yn zmL6Yt=NZ2%cAsysPA)D^gkz2Vvh|Z9RJdoH$L$+6a^|>UO=3fBBH0UidA&_JQz9K~ zuo1Z_(cB7CiQ}4loOL3DsdC<+wYysw@&UMl21+LY-(z=6j8fu5%ZQg-z6Bor^M}LX z9hxH}aVC%rodtoGcTh)zEd=yDfCu5mE)qIjw~K+zwn&5c!L-N+E=kwxVEewN#vvx2WGCf^;C9^mmTlYc*kz$NUdQ=gDzLmf z!LXG7{N$Mi3n}?5L&f9TlCzzrgGR*6>MhWBR=lS)qP$&OMAQ2 z`$23{zM%a@9EPdjV|Y1zVVGf?mINO)i-q6;_Ev|n_JQ^Zy&BnUgV>NbY9xba1DlY@ zrg$_Kn?+^_+4V4^xS94tX2oLKAEiuU0<2S#v$WSDt0P^A+d-+M?XlR**u_Xdre&aY zNi~zJk9aLQUqaFZxCNRmu*wnxB_u*M6V0xVCtBhtpGUK)#Dob6DWm-n^~Vy)m~?Yg zO0^+v~`x6Vqtjl4I5;=^o2jyOb~m+ER;lNwO$iN ziH4vk>E`OTRx~v#B|ifef|ceH)%hgqOy|#f=Q|VlN6i{!0CRndN~x8wS6Ppqq7NSH zO5hX{k5T{4ib@&8t)u=V9nY+2RC^75jU%TRix}FDTB%>t;5jpNRv;(KB|%{AI7Jc= zd%t9-AjNUAs?8m40SLOhrjbC_yZoznU$(rnT2);Rr`2e6$k!zwlz!d|sZ3%x@$Nw? zVn?i%t!J+9SF@^ zO&TGun2&?VIygfH5ePk|!e&G3Zm-GUP(imiWzZu$9JU)Wot`}*RHV<-)vUhc6J6{w&PQIaSZ_N<(d>`C$yo#Ly&0Sr5gCkDY(4f@fY5!fLe57sH54#FF4 zg&hda`KjtJ8cTzz;DwFa#{$!}j~g$9zqFBC@To^}i#`b~xhU;p{x{^f1krbEFNqV^ zEq5c!C5XT0o_q{%p&0F@!I;9ejbs#P4q?R!i$?vl3~|GSyq4@q#3=wgsz+zkrIB<< z=HMWEBz?z??GvvT54YsDSnRLcEf!n>^0eKf4(CIT{qs4y$7_4e=JoIkq%~H9$z-r* zZ?`xgwL+DNAJE`VB;S+w#NvBT{3;}{CD&@Ig*Ka2Acx)2Qx zL)V#$n@%vf1Zzms4Th~fS|(DKDT`?BKfX3tkCBvKZLg^hUh|_Gz8?%#d(ANnY`5U1 zo;qjq=5tn!OQ*-JqA&iG-Tg#6Ka|O64eceRrSgggD%%QBX$t=6?hPEK2|lL1{?|>I^Toc>rQU7a_`RSM^EPVl{_&OG-P;|z0?v{3o#pkl zC6Y;&J7;#5N#+H2J-4RqiSK^rj<_Z6t%?`N$A_FUESt{TcayIew5oWi=jxT*aPIP6 z?MG`?k5p%-x>D73irru{R?lu7<54DCT9Q}%=4%@wZij4+M=fzzz`SJ3I%*#AikLUh zn>k=5%IKUP4TrvZ!A{&Oh;BR}6r3t3cpzS(&|cEe&e{MQby|1#X`?17e9?|=i`sPG zL|OOsh`j@PD4sc6&Y3rT`r?-EH0QPR*IobE@_fkB8*(886ZkjkcO{K8Sz$H`^D-8P zjKG9G9A`O!>|!ivAeteRVIcyIGa#O<6I$^O7}9&*8mHd@Gw!WDU*@;*L;SYvlV#p( zzFSsPw&^UdyxO}%i)W8$@f}|84*mz&i2q@SlzMOd%B!BHOJ<(FYUTR(Ui$DuX>?85 zcdzl5m3hzFr2S@c_20C2x&N)|$<=RhzxI!}NN+yS16X^(_mtqY)g*Q%Fux5}bP3q$ zxQD|TB{+4C1gL>zI>g~-ajKMb{2s_cFhN2(I(q^X!$H(GFxpc6oCV9#maj|OhFZaI z;umX6E*fQVTQ@lyZauuv>%E)5z-?zQZne18V5A}}JEQmCz>7^h0r)!zhinBG6 zMQghGt!Do5h%HmAQl~%m+!pr-&wlrcwW;qw)S$6*f}ZvXd;cHw=xm|y~mHbT3yX>?hoYKfy--h+6w9%@_4ukf0Et^zr-DbPwFdyj0VJHi}4bqRetSNR`DoWd( z(%n5>8MQl+>3SeL-DB@IaM{NDwd{{v_HMIO)PKO}v{{##c@ihB0w$aaPTSP4^>n3Z zC8Il%(3dCLLX$-|SwWx1u7KVztXpzNhrOZQ78c$jd{B9lqsNHLr*9h;N9$i+vsrM1 zKzLB_gVdMCfxceejpIZat!MbR)GNZ%^n|fEQo?Xtq#Qa_gEWKTFxSL4b{g}kJNd{QcoQ}HUP-A)Rq;U(***IA*V_0B5mr}Xp$q{YSYs-b2q~DHh z?+muRGn~std!VXuT>P9TL_8Km9G{doqRb-W0B&%d> z^3@hs6y5jaEq%P}dmr(8=f}x~^ z*{I{tkBgYk@Td|Z{csd23pziZlPYt2RJW7D_C#&)OONEWyN`I19_cM;`Aa=y_)ldH z^co(O-xWIN0{y|@?wx@Y!MeVg3Ln%4ORu5~Dl6$h>AGSXrK3!pH%cpM?D|6#*6+A# zlsj;J0_~^?DHIceRC~0iMq)SJ&?R&if{fsdIb>y;H@M4AE`z8~dvz)(e}BqUWK^U~ zFy`PX+z*Bmv9VxAN;%CvMk(#kGBEMP;a-GgGZf~r$(ei(%yGqHa2dS3hxdTT!r>La zUrW2dCTZ!SjD_D(?9$SK02e_#ZOxdAhO%hgVhq54U=2$Hm+1^O^nH<>wS|&<)2TtD zN_MN@O>?A@_&l;U)*GY*5F_a~cgQb_3p`#77ax1iRxIx!r0HkDnA2G*{l|*}g_yI% zZdHt2`Hx^MA#VH7@BEN68Y_;sAcCNgCY7S&dcQsp*$+uW7Dm@$Vl7!YA^51bi} z*Vy8uTj{neIhIL|PhditfC1Jeub(uy}w|wV5 zsQz)04y;BY2$7U4$~P{k)b`hZb>gv1RkD)L#g~$*N^1N1GfNMS)4r|pT*V<&KE1M9 zTh}rzSW#Kcci_#(^qf0gTW3&QN&zsW%VAQ+AZ%-3?E)kMdgL)kY~@mC>l?RH28u;Y zt-@_u^5(W>mDdtqoe){#t;3NA7c@{WoY9bYFNoq+sj&ru;Z`x>4ddY0y*`HRtHFEN% z@mFkp=x0C6zDGgA0s|mP^WNEwE4O}S?%DOtce3At%?ThxRp@`zCH6MyzM)dA9C7IP zI}t;YUV(Jcnw$4LoD4H(EM#!{L-Z|&fhNYnBlKcQ$UScR#HH>scYBTf2u|7Fd8q$R zy5Cbt=Pvf^e}m4?VVL@#Pi3z*q-Q0MG8pGTcbS|eeW%R5bRzKsHSH#G(#$9hj9}0O7lXsC zbZ7#UjJM^FcvdKK3MOEl+Pb-93Px}F$ID&jcvZdJ{d(D)x|*`=vi%1hdg(dd-1E>& zoB4U&a${9!xyxoT%$7gFp{M<_q z9oVnk*Dcp$k#jA#7-pZbXd=L8nDhe<*t_*%gj^Vx>(~KyEY~i&(?@R~L_e^txnUyh z64-dU=Lc;eQ}vPX;g{GitTVZben7||wttapene^dB|oSGB~tmAGqE^`1Jxt$4uXUL zz5?7GEqvmLa{#mgN6la^gYO#}`eXyUJ)lFyTO8*iL~P z$A`A_X^V#!SJyU8Dl%J*6&s9;Jl54CiyfA`ExxmjrZ1P8E%rJ7hFCFo6%{5mRa|LY zk^x76W8M0tQBa1Q(&L`|!e zrczv>+#&b2bt zuD1Bfoe>oW0&!ju$-LI)$URptI!inJ^Dz|<@S1hk+!(n2PWfi-AMb5*F03&_^29MB zgJP7yn#Fw4n&Rod*>LlF+qPx5ZT$80;+m*0X5ffa3d-;F72#5un;L$}RfmR5&xbOf(KNeD|gT1x6bw5t;~j}(oMHcSzkCgcpbd>5UN z7e8CV*di9kpyJAo1YyE9XtfV1Q8^?ViwrKgtK$H60 z%~xgAifVV#>j>4SN10>bP9OV9m`EA-H{bzMimEQ_3@VZH%@KZzjDu` zRCG*Ax6B^%%dyLs2Cw{bePFWM9750@SIoZoff4mJvyxIeIjeZ{tYpbmTk4_{wy!_uygk4J;wwSiK&OpZWguG$O082g z^a3rw)F1Q!*)rNy!Sqz9bk0u-kftk^q{FPl4N+eS@0p1= zhaBFdyShSMz97B%x3GE|Sst~8Le6+?q@g6HwE1hJ#X)o^?{1!x-m`LlQ+4%?^IPIo zHATgqrm-s`+6SW3LjHB>=Pp{i<6FE#j+sX(Vl-kJt6sug<4UG9SH_|( zOb(+Vn|4R4lc8pHa-japR|c0ZAN$KOvzss6bKW^uPM$I$8eTr{EMN2N%{Yrl{Z`Y^ zaQ`-S_6omm((Fih26~Bjf^W$wm1J`8N+(=0ET@KFDy;S%{mF@!2&1UMxk>jTk49;@ z*g#0?*iga;P7abx1bh^d3MoAy*XQp{Hl*t(buU@DamDmvcc;5}`ihM!mvm36|GqRu zn*3}UmnOSUai6mM*y&f#XmqyBo>b=dmra`8;%uC8_33-RpM6;x`Rrc0RM~y9>y~ry zVnGanZLDD_lC%6!F%Jzk##j%?nW>JEaJ#U89t`?mGJS_kO5+5U1Gh;Lb3`{w<-DW; z;USPAm%*aQJ)UeYnLVb2V3MJ2vrxAZ@&#?W$vW)7$+L7~7HSzuF&0V95FC4H6Dy<( z!#o7mJKLMHTNn5)Lyn5l4oh2$s~VI~tlIjn09jE~8C#Ooei=J?K;D+-<8Cb>8RPx8 z-~O0ST{mOeXg+qjG~?}E8@JAo-j?OJjgF3nb^K5v>$yq#-Ybd8lM^jdru2WE-*V6W z>sL(7?%-Qu?&?wZNmmqdn?$FXlE!>2BAa^bWfD69lP0?L3kopYkc4>{m#H6t2dLIEE47|jcI$tEuWzwjmRgqBPkzk zM+(?6)=);W6q<2z95fHMDFKxbhPD-r0IjdX_3EH*BFL|t3))c7d~8v;{wU5p8nHUz9I?>l zVfn$bENo_I3JOh1^^ z+un~MSwCyixbj%C?y{G@G7mSZg_cf~&@djVX_vn8;IF&q?ESd=*AJHOJ(!-hbKPlb zYi-r+me!ezr_eCiQ&SetY;BocRokkbwr=ONGzW2U@X=AUvS^E9eM^w~aztd4h$Q&kF;6EJ1O*M7tJfFi}R1 z6X@asDjL5w+#QEKQE5V48#ASm?H7u5j%nDqi)iO@a1@F z*^R+bGpEOs#pRx9CBZQ}#uQa|dCH5EW%a3Xv1;ye-}5|Yh4g~YH5gI1(b#B|6_ZI; zMkxwTjmkKoZIp~AqhXp+k&SSQ)9C=jCWTKCM?(&MUHex;c3Knl(A%3UgJT_BEixIE zQh!;Q(J<0)C`q0-^|UdaGYzFqr^{vZR~Tk?jyY}gf@H+0RHkZ{OID|x;6>6+g)|BK zs6zLY0U>bcbRd6kU;cgkomCZdBSC8$a1H`pcu;XqH=5 z+$oO3i&T_WpcYnVu*lchi>wxt#iE!!bG#kzjIFqb)`s?|OclRAnzUyW5*Py!P@srDXI}&s2lVYf2ZCG`F`H-9;60 zb<=6weckNk=DC&Q6QxU*uJ9FkaT>}qb##eRS8n%qG`G9WrS>Xm+w)!AXSASfd%5fg z#fqxk(5L9@fM};~Gk^Sgb;7|krF-an$kIROPt4HLqq6+EL+62d@~4Hsy9nIU?=Ue4 zJ69;q+5+73nU|TQu}$>#v(M&Vx1RD=6Lu`d?>zHN?P7J&XWwsvwJt|rr?CZu+l>m4 zTi^VLh6Uu2s392u(5DLaM%)Dr$%h3hRB>V7a9XG`B{ZsWgh4IyTO9R~TAR^h^~>ko z(k|Hy#@bP}7OyN92TKE%qNZfyWL32p-BJf1{jj0QU0V`yj=tRospvSewxGxoC=C|N zve$zAMuSaiyY)QTk9!VmwUK&<#b2fxMl_DX|5x$dKH3>6sdYCQ9@c)^A-Rn9vG?s)0)lCR76kgoR>S;B=kl(v zzM}o+G41dh)%9=ezv$7*a9Mrb+S@13nK-B6D!%vy(}5dzbg$`-UUZJKa`_Z{*$rCu zga2G}o3dTHW|>+P_>c8UOm4Vk-ojaTeAg0-+<4#u-{>pGTYz(%ojZ`0e*nHo=)XZS zpp=$zi4|RBMGJDX{Db?>>fq71rX3t$122E;cJ(9elj+kBXs>3?(tq=s*PeL^<(M$8 zUl;u9e6|EP5Us-A>Lzvr+ln|?*}wt;+gUmd>%?@Wl@m%Qm{>Q0JqTcxtB`ROhd6TB z$VY<7t$^N6IC(s*Z@x2?Gi%eB8%(hYaC zKfY5M-9MeR-@5h zZ?V`qr%%FlPQlW5v_Bp^Q?^)S*%Y#Z$|{!Lpju=$s702T z(P}foXu(uuHN!cJRK*W-8=F*QlYB*zT#WI-SmQ_VYEgKw+>wHhm`ECQS`r3VKw`wi zxlcnn26L*U;F-BC9u{Csy#e%+2uD$He5?mc55)ot>1w`?lr$J zsrI^qGB@!5dglADaHlvWto@|S>kF5>#i#hCNXbp*ZkO$*%P-Sjf3Vc+tuFaJ-^|Ou zW8=}1TOlafUitnrTA2D0<3}&zZz^%y5+t2`Tk`vBI93FqU`W!zY;M%AUoN1V1-I2I zPTVFqaw3Pr-`5HcEFWuD?!8Ybw)Y>g7c0tt=soTHiEBxlY;RlQ`iYY-qdd94zWjyD zFcskM^S{_!E?f3mEh9waR7tb6G&yl%GW%e&Sc5i;y@N)U5ZFLcAsma^K?Cg^%d{PO z=SHQq4a|l`AakzEY;A{n6Rn1u`7v~#ufV*6GZ$`Ef)d2%6apsU6^>QJl0@U& zq|wIBlBAgf0j!YaozAgmhAy0uy;AjRA2%(!`#&e>`V` zg`MfSf5gWvJY#?8%&|`Aj0<@aZ;-q#tCx=-zkGE|_C4)TqKjr-SE6po?cX?Z^B%62 zdA!75;$my<*q)n@eB<^dfFGwRaWB25UL#~PNEV>F^c+e2Be*Df(-rIVBJo2o*an$1*1 zD$bsUC-BvObdmkKlhW<59G9{d=@bAu8a05VWCO=@_~oP=G3SmO91AK_F`#5 zwXLRVay<~JYok|rdQM-~C?dcq?Yfz_*)fIte zkE_g4CeLj1oza=9zH!s!4k%H@-n{6aB&Z;Cs8MK?#Jxl`?wD>^{fTL&eQHAQFtJ_% zNEfs|gGYh+39S{-@#MrPA!XpgWD;NLlne0-Vey1n0?=ww18{L)7G|$1kjI(sjs z@|alUMcx*04*>=BWHv_W-t=rCAy0q6&*;kW&ImkwWTe$lzHJRZJ{-{ zl-mK6+j}V`wobm^^B&2Tl?1r=yWbz;v-F<#y!(CT?-4K(($wWtmD631MN9?trDG zMI7;9U7|UsC;urLP%eH1h%U`LJxT3oM4=gpi%X@lpVR9N6Q(uhJ00RWXeL-Z*V(O8 zsIyyVUvf=RXLBKX`!peifjIMvMs1YT0n$0*B;K^yZf&HN8$N%e=EgOejqihLPBT|< zs)z`nNU}BOdT7wYLy}R10eXUksn9o)jG)&=qteGc|XNI~h5R6UBfaPeIHbA32@*>orZsCB4`Q79}A=z@najfekt-_eTg7a}Mcas^D1ELlN6(y28c{ur|tmueFvIDOQxXs1)_lKrA`L2-^^VNC#miFvO%l6w5uK2bFyu?hyNLCjTCNRRVW^i+GX``giwc&TpV~OHu(yN&o)r2$K$1kjh@>iP z^&`?sCk#?xdFX+ilAb(;I7<$BQ#6j*jKsu%LEhQKe=>ki^ZICepr3#_2#pE`32i4Z zu%eXsgL)3x3Q-^OPPRhm<^!TEPoek6?O^j+qLQ*~#TBw4Aq~M2>U{>{jfojVPADAi zurKpW{7Ii5yqy6_1iXw3$aa!GLn|$~cnvQnv7{LMIFn!&d6K=3kH8+e90Zq5K%6YfdLv}ZdQmTk7SZ7}>rJ9TW)6>NY{uEZ zY^9PI1UqUFm|h0Vqe60Ny=wCFBtKb zXtqOa3M?2OEN=zDX7z}2$Y{2@WJjr?N`auMDVG9kSH~FjfJRNfsR@yJQp4cQ8zaFkT4>5XQqSVt5c}`-A#Z=3-_mGZ^)Hqayei zhJ}wgZ5UDln%)!;Wz@u=m(6C_P@r9*IMPe7Db`CSqad3ky-5-EcG=*v8J&{RtLJ(E zw2h-ghGYcDtqj4Z^nU7ChgEXO0kox=oGaY;0EPqeW89T6htbZg4z!uU1hi;omVj+3 z0B%$+k$`oH5*SeoG`Ay&BAA%nAUjQxsMlNdq8%;SbEAPVC#qm!r7j75W=A)&a6)3% zdQq$fCN;@RqI!KPfl9l=vmBFSFpD1cAxb@~K-$ZIlIL3W}?#3+|2p{|vZVq`YA zMbx|Xl57kJVwoetAo+opiewCkCIO=uBLEaG+!0U$MRdReNsx>+PIJWN6dW)pfeZ(u zQ8ei-Ht69)ZV`qv=vmorhOkF)Squ;)8AUfh<7A_xI8FGHMRW>~%o`1Wt3|8IMrM%& z8)|@=#ssro9=f9HtN0F#O085{Bf6PJnurfzS_yg?qqszmnQIYDP{N=xqPfvl;VNsK^qpoy2&App~Fe(MB7KCI)$p1!&YEB&%$9gTk zmvlt?t7!>_paNt_fYJvw^~LCqX{4opLy!n)md7}<_s?`gytfSAdoScQWTy&Tbr&~( zg9myGVv)l|4-umFBL0)Y(d}Rvt11)(O4ij#zeao~K$vh~JDn0_@3RjP2M0|79T&9+ z?>Vx&M30Sb15&<{RtpeYUf|n7n5GHyc+-FtA=7H$p6Mh=&M0O!so)tze7#WT>pp|x zfWae>0++DfscU2%>|@oiCQj+6O827)1}KsN^a>NSI*4?#ylfG-{q?3MMXX$dUH^S6Ni=Ve1d0(janpz@WqGJ?cG&sewpq294Qa zL{huwuoARdt5F4Dbh#?<2ruzSS{VeDAOtY+52t^xJW=!(0f3P&G3Cs^%~Q~~Wq{YA z!QrEk#>oXK{sc&Z7VB1_>fA1^#YyU1Ff<^9G(!V0!JW`n@EDdj$$2SVK6*7$!BvXP zmAC;h-W75(Nnzpro3CE9eV=~Lp7yS(vXnk@$g3{R`!(UG013==W*Hj{-*F!ujl+np%IX?E0*I&-K^u zY1z1I!`iOu+Ll`UtL|F6Vb?~vk=x9w6}eE^*<)O?pZQ#8YKE#b($x>w$3E*F0Kfk zfnyCo#zOpX1(P2yeHG@fP7}}~GB|&S27%6=@G^V=rmeTB$(w9rC6J@uQmcAMq zQ=Ce?Z0RkF_gu30<;5#jEW32il2?}$-6PZ?au16Y)?kUFy3L?ia1A@%S3G-M`{qn8 ze+|6jh0vqfkhdSb0MvIr!;;*AL}QX^gkc+q0RJ4i9IyOo+qAyHblI+$VuZ3UT7&iIG7640a)fe&>NOVU@xZ*YE`oy!JGMY%j}bGq!= z`R5xY(8TK&AH4b6WoKCo>lPh6vbfu1yYy02g^t9bDbexN!A`*$M5`u&}WqF?+*m?ZoW85&MFmXqQ1J{i;_Oz>3*#0?lWa zf?{tv`_JzP7D3x2gX&ICRn(aR$#>;ciH#pO?<*}!<}cYh_r{hb6*kkXSteV>l9n6i zwx63=u%!9MdE>@2X)3$YXh=DuRh~mN2bQFEH&_nHWfU{q+4=t07pt+Jfj90Or;6JX{BCQrE8bZe&wi3fwEXHRp zz8{VAmxsWU)3nT;;77X7@GCm7_fL1p_xKEG&6G~luO;Bc3ZIa?2b(*uH7qJ!es71c z{Buj4(;Jds$o78u<3df_2~DLq`e9*$SGmrR9p2OoVB5Q(KL3M{1>eq+;+lHK9N?xvyBPHni<#j$sZK{QrKEcdR9+eQD0V? zGPaq!#<-c#a>t4bt+R#Hu_|}dlIGeve@SR!d((u)Ga45+BuhHfA88G0cPrw>>(`ID zZ;aIyn|qmhuDXBthoW{J(WN+`Yud=y(wvd0rm&1*4>6?#8&)Fz z&@V=a0w4)F{^!&W_l6<5xg|-0F!~>aCALbeVsZTd*)M*^tr*!)O8w)mzKThWyQW@X zw%BFs5_@CIic5EPcTJu8=CmynV;``)3}gJ`Vl#VY_3Yib@P-KvBk_%!9OVu#8tG|Nc4I~A>8ch-~X%M@!>yk~ERI|QEcwzgI66IaaY>gx0~lm<@f z5-k^OY#SGC80Yr-tDRP(-FEJ{@_4LHsGJ=)PKZ@`eW75-r0ylN%0Q>&*M;@uZLdJ$ z)rw7Dt5ajr;P;~1P>jID!><(7R;w|Yf}qI&8klT?1dTfc@us5mKEe;qw;YKR(cp-D z6NmUMP8x7cM%~ytE@l*Mp^oN*mCF`gRNhw3gpO1PVi_^JzCJo>#mX(q+iJ(Ts$5=! z13b45gILEULS!=)SmZ{qsC1)$8-4eADGR?v z>~4k_SvdvPHAC}=4(!I^OLgQ@9EMDE7d$PvJbi+K%-HTh`P0#Ea|Jm6zj> z?R)(YWtZoIRx>AqzlG1UjT@6ba>yE z{Wf<5moh^-hu;ptAtPG}`h$4PWcOn>vy`#bH#Ss>OoAEE1gIbQwH#eG8+RHG0~TJ$ z>`C`c7KyM^gqsVNDXxT|1s;nTR&cCg6kd<-msrdE5Ofk=1BGDMlP2!93%0c@rg~4` zq)UFVW%s|`xb>;aR@L^*D>nkSLGNmM?cv)WzHZy3*>+*xAJSX;>))*XRT0r9<#zIpug(}{rSC9T$42@gb zy8eb6)~}wl<=or)2L}4T{vum>-g)QaKjtnp5fyd^;|BxHtx~2W^YbKq1HfB7@>Hw@U5)?b^H=uNOpli?w6O#~V`eG;`irLcC(&Uxz`L_Cl zS8r24e*U71o@dV6Soupo-}Ttu*Dk&EwY`h4KdY-k55DSqR&o7nufO)%>%s-Es^5Q_ z60#cReEy=$4|nW)bLh=|4bxW4j}A?qOle+wjn88oAeYb~!eA+EQ;8Ggp-UldAt$3M z7*E590amz>YB9L(z?Xx&?I37XYw?Os-t+05x6Z4vkzBE6-hrbB=GAB?p{DQXV4CKg zls@_wh*&XC<3R(CEZxg8*Y(6a>cIOq9Nss7{=UQ7Nv%O_WxSyBqnH{@(<>A&2on@z zn57W4Dh*E)o#rJ2#tyxV2;C5#rl8%%As$4qB=IbMt-z|jnWi>>7Ymq37;AW!6Y4nx z1Ogx#!WVdA92mEipgUxzy_?ddg|x)KOCyK)P5v@usc;0sN3{=0slt4CuwaxK@20eO zhdp~Z8iJ7GWrkq_-X`~(eBpthn9|`tZEUCIGiFpJjjxPVE9I)#z3Q$3tw`a69qxjuf+~ z*?v>d5~pcH-AQ~0)8PyIjumD^?SM8!Wb>KZoD7hOlc2nA0_(eG!in>}Ru}>6)>5 z@*}T`Hw{I^-?PS9>(#UFBQpW72* zsfj(2+_9@5x+57aN!`e`f(Mp_I(D>}p8)@&g^g+X1%d{ z%X5boE?hEoj0CiwTh9)#8^?~;|wgor_=Z1BI9_dI{ z&t*f95n?ZgZ5CnQa!v(p|JT?y0%KKgi`Smi9k5r!+!Mkz=&Z$%CFl;?AOzV`YBKrY z0#Y6~J6&dA=m>T@TYb8ukaV4z^Z?VX*MCKcp13-ye1*`gAj_Tm@r{fpm?K!U@Xg2AfndEo6jZN} z=XK0GRNXVLW2c?}B)rH^yR>u}b?|p(W$!TkQTAgu1AIG>MFfNchMQB_^-AQxRE$Th5-E_tBP@v(Cy|ojjP5LEU|JrM8 zVF5;$>Hl^jlHWDPChrTH(vh%bARyj5#TPb>omAs-)4zN z9?9(wybd0$Z5s+}Fiytv}-8U`IC<{6U2_NqEAkv;7lys5Qcq3EKt z0-!^Xy3idllgZ~qX^QTe=i*oGUCJNk>Y26?+9U(Ks|C81S{-v+6ebc`c(yibQbuB% zxM7mk>}dI-TfUi5Jqdu6b`4SqF)y5humuCaHhssdcR(jKf5ZGprx;Oe7VG#G6TA1+ z8oZLl<+ey(L+$Qsck^4fi{I|)p15MX73gHFUU!l${lN{)Ht_Wb%j#UE6cZ9}Wq^>+1wz z9TBA@%f~tby^0YWafmn&8Ppjn1Ng{d;S01WImtMzV<`!zU7;+8e-Xko>qM^OfOZ`Y zEZG#vcm>EGF??&G6+v(3l`X(xMn8ESv=@LdMfdcxFi%g1?0HDPG>blldR`OLlWN80 zz<$t+MM9%1K~JT@#aBZjOu9*G{W$u7cqTM|&a1)0wR8R^*r$<&AhuCq1Z{-aUhc5P zdyaaK{$P=Y6R{40FrWmLbDOCijqB(1PrKlnL)Tm|t=l}toVLAZOXJ*~-dx|_A&o65 zskcpT@bs+d@ia`f)t8ivl{(t%H?O?;=^s3O^GXqopx7E3kz06f^UQq<>gyNmo4Ij; zrOxuzn{WOqP75~PwPXC;3mZ#YW1xy&DEXsl~)u4`-v_{*B%R6xNH3* zJElz8@d#i4`#JV(ko%x;u{LMqLEEDmwD*(ccB9Wp;u*9I?=sC7g>%L{%$4m#zhbjm z)gK{LWQvE1>_yl|4T$nYKNVZ<)vza7FKU5*W~4)KNgN@;SA<9&ERxIfA&UZnB=r%N z5YD4fY$9Mkzy}!G+`KUy>3l(FSi1 zw)t)*w$E4#ZSxfm3cZLC(o3aQQ7uHk>_@fMTHoM0=quh%mfN6%{`O($pyzg0kPf=2 zjA%M7bRl4BhV5{{d4HbnTh`HM&YKw@N~47e7NFGr*9Yzi(7XQl-FJb4hPEKOC!K2x$nWy>8=PJYE)T$=Cqe(n*ChZE zklF{Ms}h0Jd|@o;Gz(~b;9d&c#0O^j{1?tF5dtMj9dG`|j0qZi^aF1r{<7KC5hZ`E zNX2nxJYEr@>u86|tPjTDet;fLn1R+IOm6&3b*}TOyNpIaid@W9c9!jIfiJOgK-aw=xb5Kpb)`E9x%CU82 zEQg_v`e+tWYClJHl=_EsSW?LZO3)o#ox(#2UW9|V7I8fYnz5fRtph`u)dywWL9}UV z*hdU9-BBK5G&}j~O6&dSdWDIpFX;&Or5wNbm^Y+A-x6(K$$Of6JTVl9n0gFY&=T5p zZX?pCxA&w{J)eDSfb?Zh*LT#AdiPlB;A%p|-`Aw6RP2mYTh zLmL~zM^VS0V@*4LkOEG~nQR)HyRB+;*KWli%QqKt&%16HWyMXRhtwdCgyoTm*5#itgp(Wap66 zyr-dgKgjl&t?JLMuw}!Boz)TOa2|37p^FAcPmxX0apWmfp$B1WF_@-dsK+?1F6~yY zEwi!-))Q_CbOP%?p%bx|=d^nLBig-_$e!nh19^Ps`s{SNq{nnW)V-qnz3y+Ipd7HS zsb}z%!+}y8izoy>Nyyj4m_br&8TGFcze#gP4?v*NEdl zzGBLM4qpvdu;5vCFi9^zXU;sW`>pPi|NFD# ze=$xI@7q9B4WPsw4CAO~UJ(S)s@u41E>#9D>!?=*N5m$%^0E` z<0RjkAj02TN9RLX3Js+GArg=Nu>E5z zPa!vMuMV06#7$1dLbwv+VGT(5V_&A~Uy3T^+|y~Q2>lA|=hZZ)ex%G`rhkN54C5gq z>w?qN=A+LgB0-@s{OJs7Da|z%dK)uDH4?m5Y=K(N5KWL)uqDxwBt>QmOk(h~1u6_s z>9x>G_+@bJhBQ;(Rr?20>Tjn}^Y`|rQvI3Ua5$aGq{HFf4BhwAFVk2oHNbk)hmAri zjQ_!g*-c^AKM>A@je&H)i1PsJ5929F<8bLXvONK4;-n6d;Zm7Q=G|k6Fp*AY!b1a`eoS*c zF413z6`x;!NZV1k5)sv;-Dqjt?t&|JLNGSA2yWhU-RYC^oiWI1+idw;6*>m1&Io`^iPgF6c$sN zw9j3KFYs@%*HNz1Jr?F^RiLV%@DyQ^Dnc1h&59pWKhD#AMQV~3k7}>c@gdw=dyRf5 zHGNU7bA_hHWUnI-9SXtjM~LT>U5!uS#{ zKSOhB>l^nUa&S8kEFoAUIDG}(Lr#|uJCGb%29Xr>1S4yk0d)9hoJ7#4xNbi?5Dt?N zBp45evje1L)A;&Smy9J8MJe@1#HwBFoYPv$=k%GOaq!kd58)tzBI~EkGG3Rqy>GOTce-p>jH0rb~c(K z1|9q=$3)Vdgcwyvy&>S3p(f~O;~?XK{)Kch&2!gs=%kNH#-Ee-i}S+a@DNWR(Xnv< zv7kIUUD(c?RS|JmPeXBC6cbxUl6qRxl;fFAiK%!>EzFa zJ$-mz?G%WqC+P-l!DLX&nfxzGAnLaFsOg^Vq~gaW2QQ<(qixj#J=;Y{m`?kHkfO)i zdxQ*`2Jr3iXdj4QE%|AlQ;|Wx~pKrr7xuNnTe=t-AO)iha6xDYpH}>yZ z+FD^H2VS0x4us;Wo_95^kElZ$>j2HW@wyeLi3i%Q28NXxQT7V1{iHY}Llc~!Dkv8* zM><6X$}-pv0N#?+N%W`5%}K0Is%8kCOC~LuR6+;gtHYPi9=dqUoin~Q^MhE;TSIe$6dEI=Xs(`oTlj_C-3c4KT+wJvpu4Kkn_RZVg5jE+RF`XNx?0xmaV~bW?v}wVTXn4{5 zO&2X+*pF%!%qu@3SLRk-npU5?`f_cV9;|pa#ktlD9VuvRx;TK+fWUv_$vC8-@TcO4 zN_-D6?7|-4!VWMEgQ}TUe(c3w4{eyxe8C5t7pS0MFe;X@U&B?sVDIGR;u>?mPyb2F zV5WLiQ2mX&1v=E#B`oe9yk4Y2^CFRk8*rV6k1!uW{m47&7E!m%(ANz&+ixrB^ng(;#RLHnX%tfsjJWM- zyBo5Of=eNl8*;gm`ozE0weGdP7~Iz5$$pI`$C5 z`U46T|8cnpt;J+VO?%~H_`Ph??bcn%Jzu`2`z~tc^PoA?r znJlfFuxIeRC?a>J?C!EC2Bn;dnhn3XeZ}sbjb-10*a7A?aS00$P{m0wm zO_v_`nJOwO*k6S$tHR@xmt`N`;fR%l>^^ZvbfRm}PUBtryK5pTwRdIZgj<#_irORP zr7I?yj7m&+KkD(;PKtLXmF-s9=>`j_AFjI$YN7_w1g7hD(md1~ysZj9;u_Y4i3Ssz zgRH~g_UH9AHR4A!67Z@2zch=Odh*4WzWc2=ekK0-ueW&=xy{z7Gz9CSbv}Pk+4ST# z#ZxnW&!Z1tS0A}`@LT_*wh{sv=f-Dy+2cPoUi{nzYTGjx)eit9s#G5^D0+(|iNBlJ zV$vUX35MrZ8K19VAN|i75_}Z#DO`R~MZQy~2$6gqOvN0Js%d70SzJm|ER&Jy5k>-I z!fh9^fC*zr22w0EG6&Uqo`eqC7_L8gi(#?!A>;y86ak0F7|oHQIhmW!15hHkZ(*|o zF+vd5r!A(imA-b0}qc4-&FS58}j>!?PW$SEg*;W8H~a^e%b?2`O8 z*`i%!x17FmIo=X;^83K2Y3Hja(b_rMns6%ts^>=(bA-9V<9O1I>564?R3a}v1yYtH z*l6T7AY0T66-95WtZgaP8(}|MBGlfNdh@=~Y1m!IA7($BPUtE`qT@h@;M3Hd z;_dtQw^?1x7-WaPK4XDxuqd5+qVz|PQlALGw|x}&MFa4RtVSK`(e|RtFN=u%s&M?) z7+HD3$diG_iYZuX{0ijc(*2C7cTX)p*3LRRtn3r@wq>%<@A9jY)yX*dv zSq7pIH0)jCA$)wa^7RfPVlWXzzoH}vzHmu4?W&f|zEC#fi<;dYS!Z*G+=!O(wLx7} zkfS~!6{@R-(Uw86L(mJl7`6&&tfKDx<)c+WIlqL)3pSX=7*`N5ysyr`8ap$bd^E3w89)ZgPiCBi|f{Ji^U)|AMCk%95n_gVk3|_XmE_Z6(keo8NCgI|@0sfZs3_s1} z$KK|ZCF;AE#cQiOrv*z^HWTBHM`H8Hwdx20FDq8lu^{(Q!@5s%Urrmi_ZX=7)j%7* z2x#|wO+pMI^e#2DpLkU+erWUorFxiNlu1s>XIg^5wIEm|joek2Rd2IsPtNkBRLQTFsnoh4v_<(`f@uV0I_G*I9RD+?L~j{1bx`#0ta zEeZiTNBzhh^|GEN+1vl7{w)Wm!`yhLKAuC&Ve`GhjRo0c|E^`tZXfkQW;&_kBLS|M z7!XYb?!E&&=u`h5Ld{_dyivFMQHW{aI!yVS7oS=ttZ_4U4sb{P=wmO6wCrO3g8Cir zRxN0ht{}^=kNOy`2fdgiLzr_8?$^fWMSdbcHb<)&+4+$`i%$>mB*aF7fv0tiFWhcK zRThLy0Mtx?A6Q34Vn$tJOcHkv?-ldg8_%9Jr8YX#=C;}%u*pWq^?L5VVi61EUkC^@ zTi3LAgna%bC9aB?Qos0?XlUZtnp9cISx)1AbGeO~JGb1<*DpHId@iRrT4e7+!$h07 zWDZ4FAXQ;*hdB%9)8U`#Aq1XW1`G)sm$Ol@ZCv2#2r5~I^BXuYJm%NgOkCQOAufat z)Mo2&C`TDc7EDz1sE;V{`=Bx<#5gYrDb+@@FE3>Yx=pZB79-7UjD-g%Z#qc&td6cl zI`S1u2Q2b!m^1LOg{LEV_eV*@cFW|i{!+a94itA#8 z2;?I%3?C8LQn5B+Ac|?$1Ejde^`AH_B}3`>#H=np*@XDR^y^=fZDd~Fz;wS>e@!M7JaPvv zPU?=U|2$6iw_+;&j{0oiARgl1!2p}_PMTg!Yxs?H%{HmJgU62_ghA}_;}{7x*brZc z@>!rSz|M}1YPdKizI;?B3~2O%LY`8A1SF;-m z+Oxu{+PYOU-V9O}bVd$T!;AU2M<2*KtciMEC29!H9V-u9ZUJ$M-4#Nb$5QVy@LP8HyfiyK->WR(e1g77J;isq@ zxu$>@C(@*mf}RY@L8hJXBrWMOEKDqt3i8iwFSwpR$W>G_j=iMN>(!1>S7GdmXt%UH zpfdn%XxP3S<>d1=1{yBn9c@?(YZkyNN1 zQx^M4-32#mo8SKR;r8t_CV3=RwbSNzS!Jbd%GS0L=qT*0!ERw05x~DzSsUKHYQ||Y zuwKD!+2nux!l3~g>0-F=;qnW{w$F|jqXuhZz#N`4WtzLDj_MYvu(*X@fb3G;s!oPE z?QMW|e7J7#=?C#3QWQRp-~(1;_=?J(Y^}oNmHRoN$^y4Pv2Z8cL)EmwWVNJh@>2ER z)el6y-IQ`!2h2{kx3}jwTf$_!N75)(mi|n=?Ylj_>QzqjfMiO67Wc4{rOcF4JS+{j z&z%duf1`r(U@ZlI{F=sZFnCGJv}cN<(cA|5AP8m+HUK z@vG9%#_zOu)ChxFSxmKsBSSO9XX%g4SU79e4=G!|Cgo(;VeA8dsRxIZ$Eqhj(brh0 z>Jh)P2`<<#u_i^?L>%2jxXAxZX%?<7l073C+~1p!t{Dj_9ZxL$sz|_G{C#{Hv@t=B zP}EsMr62u$;U#=d%MRJHCiNv=5OI3(_o-A=G_9B~AsrRui@pzUDE@tHg#6PmWEuT^ ziPt|@8=kjTNmkqdOlyJS!m{E9I87hqn;%9rT0<0-L99QeURoyK-&OxH^mcao3^t~WeS^K zH`XC|VCLo6*duA78O!ugN@5Elxkhd!CmdSX&*f=utfmDFD9PkBHMk3&aFB&)R8NL4 zD&i)OQLO z(Z_o2Zs~o#^$zu`{XU~$I{T&vAH3;ofJ*ZpJ&JR~s{J0}8cw}`t#a3NvWA?#tMY67 zLG}{Q{#6^CipQ$*V2|W$g2v->Y9+4=(K+K`;I4$BFUb9!Nrk0B*fL+v z_lcdO1uEs@|8I@xoKCB{68@q=)}90JCVF33Lb?M@bC5mog<2~vPXXzk7B$|75Lya& zL)t=%E&Pk`S-PznN<)4iAI;NU!@f0_V&wOND{4!~b@1&pAN$Goqzvq>;o=lr=43Xx{tUtEaN3B>CWZ)Uac%%Y9--wFCA~Ek7aAC_APm}b zpXAnlNOIF+;t%pPlAxIkvv1neXa8*XxNLX6ZDDR(+U5bi-=^>US$+3TyUFaf{gSPI z&A@*!TUbRQ-p-3$KUDc=Hp9j|c+t%)Z{KNid2DyGia&p6lgtpOkDeM{Qy=)H&22V` zFBRKM=Etf98a&;o2pD`R2ctkyWxz`aTDZXBjY52aOspy*2=?xDIZi>&&))8y?Pe*( zt;DkFm|`@cFI!Kx=wFn7fh&cqy-f1RZb2KRCK7JNBsApYHWk=M5J&|wBQOdb+2_^g z*;b(s3o^wX$sWZHhUhNh^+UU2+hPaWw)eN~kHy66akHOp4#cDm_4zDetK1Mqx+sR1`nMz9wwQP*hL>=&Kei3+FtV>|yg%{T(6f`N5BR!MdXj8xHG^3) zqCJiEswQF>ZLP}3Hs3ciKciD63}0Z^MFL6+`V473sGm^=U1^Mx3`Y|Mrl>H0pEcT6 zg^H5MH*WeRUNMs9VN5fcZQ=>}GHBs};LS}+P-y~P#IlYJ0P8ym@R(0L;jYe*1D4ll zwDy~vES0HtyCCI2411OeiC>SA#1wX;8DRXzVihdy^T9BjrZUmN_=b)~n*!R4%Wps~ zkbFH!%W;I*pJZ#8%)c_#RUtKlOksrV!Y3i%vh>?b076sjL-)-NtH_t7E8;OBZOPa@ zAofQ3jdT&<%k!kzaG)7qW3j4HcvQe1&&jd+f8}J3!f+>UDx7H_B8^6hA&r*!PDQ-B za5jys`+BVIUd>7lmgi)Y&fyh!`yosPQAwyIh?7D-h2#b7);pTpdfDrCm->#&W_JPe zRvi?=>OgitOs_62y`!|JbhXf5STOdjJDPjj*#EK7D|Q>bl1&L=hPkN@2)(QE#vP@l zt9uJeTG&n{WG78N)aYu19%#`y%8i44oVsSwNLRxgR6hF`tsw;8VRy)COB4`B4i4SsLAa4`Y(WRazi3X`Vv!fMiDilJX?r1a{9%U3-*f6J-iKJh{i^La~ z$yJ?ASG(MP>=IKImh$g9bD7xJqR}YghlfIHszUwEmoF2yQ`Xet0HgZCGNmYge2TvH z+d^IF=q3{GD`-m8K+R-7AdPA64e{l|c4AofbmD)4hUvwM1bw^%@mXLok{H%R#q;qz z+gU3h@JZH-G^8$-2?T_&a!E51(fhSa5Q$w^j>=mA9b7)O1^G1VKyM1v8fOAgDLfFwlSN7aDkBbh=1Vofi; z{_|sQ`!zOY>fWC264~Y0Y;ZbE!j3Cqv4wlfV?E8SiTe3tr;ceTaXo*JV!Oufp0KT} z!>xB&7aARQo9It=F0Wa;$5j)X(=fKBtv5LhYKFC6eJA)BwZ>zny85O7zI6@a-&ln8 zLF2LorHz$i{9dO!8mb#Jp?&t4L$8*9&!)KTkLxQVHBP8FA!bZwX zC$1xtlqa{pU|8*e#v_V+#E4OT zjwi(7(vGZ$V!mG>tD`=FtRvSqWZ9$*B?GPmVd1ek!0@{$s=gg&_gx>I&W_E$e<7Y+ z5K(_sDS$qH^8rKPSita&*B->#;u88_rMf;Axsguitwh`|=XF8(EVlU^L*PKbu#TN~ zwj8|9X*SENE}$egSAG|3#!^5By}_`$$?RM3+{=QMMid7b`V01GIvvI+&E63R2wQNp zn}sc$*2c&2oUL%!tO4~7wk4n)tpFT)D3<_3R0r=|=}&0KCf!VqIpm|jC(z<~qb-#Q zZxk@2wJZtt%hiN1;J9w_Hzt9B+S-HzVkb8@NIl-+0XLm`=_dDWyDqXB zn&w}0*`hmpYVLH;R9>jKpbgr%Tssmku7 zB4?i;DJ=yE$6)n>a-tiWd=_(RksK=Y6Abz5;b5mLI|>)(FA9o zGzACes-Q@1Vend}5C)iY7*G)}1M%Udge?eW(1HnSXri;yq(~2bXQq`x;Yrz#0k&ke zS%JGlk~lDWC_ny*-Pvc@4#dzy&@`+2PkV%% zOIv<3)+u>drFF184*~^AoZL$_J<;#J>d$8hF1HEz)8d7HT$%mI=(a%Fw_CitukY~T zzCPh-wvU#V(e-YoddEiUO$O~Gr_8a91@$Jc+rpZOpW6;!qTct6s-1GiRv51Kzn!ku z>d;8_q{~ie0yF5Z-59^#vLXATUx*cq!zD=G$XZeu&u5Te*HqWE4IIDJ=3 z;X=s*MnE=AeJ9|E8#P5YEW>Y3>i7+gy{D`72zWgEJ6_;p$$k1u>hqEMJ4WhXT+1`J z2UoHdw1-mEKE?MEYBN#+HGKNk5c-SiJgPNDBrxIO3hq2zQ?Q-Gzn`%I_?VYp&dv2M zvIvf0jiNBnpf1lm=3_A6ApuPS)>4!*8O26GMgpxwaM6T-up7}x$fShgk;qe5v^RIo z>TaB#z4r{2{wUbivuj#sL%^MIIAif88=Zo8VO`(VhtJ#lK)G7`AVbhecjuza-rrB| zo4s>x>$20;IoY}UyhY=kM#Bz+WZSjeUwYHVtw){{#_rt79ybJJr`6`3xa`^N&f)n! zT=yimh90T==dW``)l)vNIle^QUoEWPPd=w1q+I0(zj?aa4;5EaZaQsy5FJ4LeF}5{ z$zg##sP#GwKG2!Ph}IYe2=jqBViZeEZy;=DiXR5O3_2O25Y~Q9y=cg)D}9l1=&&Xw&3l?g{8))$`(k@{a1p3a{ens7utuI^2=vshxrlD-kY-br`D+hAM=))3(PZ zpyB3*357l{^D%K-(OTUkjEoJ4X>x<^UfmPAA7hlXG?QgK21ybCZk1lxS0Sifv<291 zEjcA#Q%-#E!a(4PJtQIWk)#atL{s*GU*JZt07Zc#S!1%fwV7fXkwZu$LI=?Jii9b& z9N7&))d3Vh8fPHy4GD@Ijl7yD&?%NGuJ_OccYXkIaDN7{Ux?ntALbeUyb?sbz03s# zLfJD@r)GcJGkZS!PFErpG3low5RJ#jCL63{qLHqyaMc*AVNejQp_b+{ucvHN$a_^~ zK+n|6Qz^l#n5WiWi;#UEURyWC?C}74{5m0i9bm^jS=(82np)-?!p5j&Hj8-6#y5q$ z-cZx{GVhaJT^!E3OK(B$?9)Oq;h*nmgonr@l}$~5ny#*74^BUz-dtT@>WZ;S_3r_} zQNaQi9BKB}jHzND-dA1Yeacj3_qnU%q4vw$L-Baogt=3ig3Ri*h;4T_HQn8u6~D8% zu3dIGR>z7KUO$}07IDA zm>ULZ#zLtQpB=zl`Xly=k@2w#_&57?*Xi!kJ;wQT>Y(diU_s7c9> zJt9NLo6(QTdY?<&%(7s~gGuhxX6Ia@TxNd)1c%NSn z1vg!?!9F%t+BbteRT}T^ikFtgySn40Y{9CQ#s-^l6%*Z|a#r=PT|QRt>uzZ1KDuU2 z_UG&)_39e07-r|Hmy8d@CawADtYBN~ud`dnC6l4WwkC7cwB?%@#G0C73m(O(B@{A= zKYo4MwAZI+m;dFW_8z_0tM6&w{t;apJRSqCB|8-3|G^xy4{cteem4EFg?KyO^H>jM zvPiWhJ7a++c1XQBBKT_Aev;X1adZCx?O6i7i}=MPVM!{DFhM1no>Vgi=FJObSSzE4 z!cz06q4?jt9&?tl`>Ym||8Lbn@fQ|L_G8v#F`IpVs|l!&x&>B}_z$1B(XGyIsHAWY znA8qOJ=@^)4xPoaU-h^g^}_jK@kTQ7$?aFf|5I6D)sIC2%qiC(coF8shYu$ie*)ue ze%G2{U`NRIn<&=&^cNmI;H`MZjd~?#3I1s@KF{obqiu%g9@l{o^DS=Z{*u!j)-EktzHk%L~ zUeueNeuutfbuxAHnCfe9zB#!P8?xVF){CM-QK}``94{Bxq4Q=lI*@*(t$ z0*llTSuC3*FY_i0Esz=DU(#!`f?@wi{if=Z>r@~3asMrB8H6RvvkTcW)vbP8ZeWX4 zzxps+&i<@^TXl<*)K}C$u*vFs=c>O<uva_OepgZ3^mp(p%~u)K{5Z{k!@f>W^5N zctHJ;`gb-C%!>u<(kED#4A{XPx$+SHa}?%+(O6P8P)JhxL-2PKS-#1p!TbB=d;5nL zMMOs=yP`{Yvn%^wn}ki9e$C!VtI_NeVz`$Lz%L_RchA@F7J^6AM{gFM+M7MOSKOPu ztXH`F#C^w(VO);r;56Hd1-i|6n#b*T>ceqoYd9adu&Oc+x`?PF5k{oi7$_HEV@K2z zymA4)N+`DI{|3bN<-4D@&N)YxIVoqR5q@8N=Kc5COtz?XZfomYb%y==nU^drYn>b!5Ctr?PZ$sZJGC4(Lx<*GmYK3@9};69v2?xCz*86!x1fq z9-^Oe{|eU+0lSwM-%%oRlZiDYBcsgabpN8BFSM>vThx{{TLd#395z2-=dkJ; zUPumj_0A`QOXa%S$dG#HKaV)PHrXJUqTZlMEURp*D&K#c?PX)`>TojQ>yzh(U5ggE z+}3v2ww-mQmrPrgHX82`E)7LZ#9*S)OrYMVHZ2*%Ix2 z-f6n^R()lg_{@W9puD-%bs!$vZY>)VYBn{#u=iUtgZ1U*4oibOw!C4kr;~&cIo+d? zul5rmlh}%uY=)i|^mJ>IyR&mweFZIu_7x~{W-C@zr5Q1cK^!y+OU~frPEZqXZ04#L0$|tY}D-NPT^J>z!>2 zLk;VdDSg7vTYSmLjc%I1lCVSm>+G7BEY6w@(XH|*G{ zSt~)o`-!M-5J4aV2N@%gOd!0FRFIBn|vW}Drt z-eWVGJOi3H9hf$!nudR8+Nmhg011-@!@NC3DA2QVhVsnWtq@_vVUsn7Lgo{)!})lf zHnxUxXX|Z}q6~&9Cutz=WXN1iJCP;&D8)pBPR#N=xfBTp2pd7-lFF5XXBc!;f}%nR z1Ca6zjC^CAo!5Zpsbiu(lgpE2dZaZQmR3Pl1Nu#$p&}HOO1KhD0hr0cDxiUoC%PDR zz2y;b(?1FUenyXAUfrc`fgeIi%?Q>s#3O>1`S`d7)!ab-ztxcdp zi(oNgfzqrSy+Qa-h~$kCFl>tV#u zT0yo>Sj8|%X=Z5eLYl_j3H$wFA3GlQ`NIC8!J3ZtWgQ*Tf>iySj%6K(I%;b=*zAUs z@a=8sq4nu=XBezD!_2jBtet7FSqQn zIF@m`p^X#2_+Y@)f(;Nc7NdxOl%T-$NRFKpzZ*Diiyv-9$byI~Y_VA7@fF$z4H|Dx5g*3@-my-zW{NS^+s=4LU=S;5ULvFYRU7E$thNp8*A(h3CX5s zqQ~5@=c+ot#VX*Ndavjg1ef4*RI#r4+51F`-Xy>#L9~eMYl6w8mrb%>5bZT?ljVD6 ztEdNv0*uOqR@o*xU>7I~%q&O{-x-#ny*Sp3}O21M?Rd(O98C84<|F{P!iYQi+&Y*nsLu5^Ihu$V)k)=GECZL$l#xZCMb z%xz~?w@;eYGR~3+M_}0ce(?P zl902^TxqD4$DQx-Ouql3YC)>Mv?0+^0b7X9MdejK@03cTh{%+U%}ktHqQF-^C6`xw zO``FD0}P~L0z_&PDjancf@m?ZGR0TUYN{lM-RfudpltLzU;yJ{R+GzQ*P|q&zCuzY zP@pguLKr`*Q*oFilK?v&y$CF+j-b`jSz!_lC6mW>m+2px;ND~mcq=BCmMTz-PuXY< zOa5z2j)rQ{(LTN*&~0=Yh5whf_W+NhI=_eaPTAgjUu|FYx>|LuiX}^yT;wh{;oiU% z_p&Z@Y`}m`FN5C~v?rUXJU2@qOB4H#QH{+~N5*}@@#Jm2%V%+B2D zcW!yhdC$u$WMz8Y@Q7Sm;An!nZCaUSSuojY3}>m>9D|bq{)XtxPsx!lnpMKJ$>l0=VE#0Q${LhbVQ?(avB~M5H(A<6VIs~Hmen|XCr57cj;wDg~y7PjIZR* zau8CZLCaPfRJMsKeNi~1P;*LSAkgMF^Q=afBekooDqXYIppZJ`(kv}2%`0n&8lEg` z4=C(+1ET{^|A%kM#z zXK7m|9Wcfc3=~;>1jcJfX#rU|Ppz!j;7pMyJxd%-z##=(QTY&BIZl!@lVSAb*KE2t zsC)F&?X{LH;g7;@GHGHi9oIy36f@s3g3 zRt#I$TBG}b-9;4UrV$&5Ij9vP)Y;Np6VLT3k-c!=P<<;z&y-p^C+_T2?PjhnuA3&) zZg_w4iMx50MTey|GHd-~Qvv|JOonzEpncEx-PZbcYu(#|MF)Yep>~>mY?NK)j*MDlofYp2?IA zdWFjqQYB^@4u{F4kONMK_E=?Xxs$LThk3UpU19S{Nzmr?e_{2qb`9sV2yanqH0d@5 zKGJp8aZ;((RpJ-E(g5Ey-P)#3bab(6W+bgQb9J5E$fs<9fcfNuxIvFo=h1Dgwcy+w zPuTU(HesXi2ZPm;XEiGog3BROSUdQwi5UwQ_J3+1m1G-UYluB@01JOMr|AGf`7CDG z0ig`8Ee4)kL6qbPGy~CNdwL7bt`jNhr{b~f<0Mqx@25+$lS$DH(Vxp|&m0t?&qQTw z7?k*9V*W>p{DU=}4O&dJVTtJY(^>`^lPL~F6O|IFf&j!DWck6E9}tqnNz(gl(B;1+U04#Mx7H@PM!jr;8}`p8X5AFzRgZ z`H&lBbVagpDgs^cAL}3%1zD$XOne$PNmH;OFF;TKQt?TS2u1Xly;A5E%X>i&LS8)c z94WDnS|omqYiN=XeK3B}x+|c@HmfZ(WQ<~YG9AvJ!q|jbd#I*5WUrl&T>ys=H|eYa z=2P;fwY|sZguD`qxdX)M>uI;{{E0Cl55B`!K{}wLHeN|4VH*YnBfJf$tm5E77<2U`gq>@HG1qNC7Hcyb!M;d687pf$B(PUZ=T|xM7)L(EmRVw z;~E{-q~ZvOOr2pdE3KGuy*wmJ%9P@R0*A2yuAhIFS3E2{e{lXEPa&La>y?-W>-8zjMwKGjQ$BzcAdCp)p^-It?U!LP5Hxpchm^Keq$?$57$5a!Z+()BJRD{ z6WgCQN}23z-^iC&TytVqsnMs6p-*RQ(ixw2F8vzfP=&GB|8F?{vwhrLatNCSGk0hY z#-0-r+MT6XGIxqGf<)4vq(!0^mfU%UhXXyCkz}3fmG;0s&`8l>X!W^JfDuz9HUo@{ zuuFqpp>Uv)!psk76{RqQDF$&!v^n_ECT`}V@{zZoqC)oA7_w~`M~N|5Q|_k zJ;Up>vyh*=Kjn%>HQJW}(v6${w!9Z%lq8ZlF>@K=Ek<&|IT4DB~B~Y_O;v9%9bdID;FI$4}a;O}@l!+Yy zZ67)fU;`NEa8WOT7DH7N_&*q17&?q>qwQXMcFgOOnF<0N*-^sEWbzzvC)kr_vv+i5 zgPm2{O*$B>IAd@{>+WUK><(pc@%$Y%QkK)@5Tn}4^Ln|tOsDsh=f>O`Mru?jc?N+S zjv9?oZ;e0J6*s%IG6n*@)S#6c137i!nnDgDIU_YINmjH(${tUCloc<{sdVK)q-C~s z^SX%F!SQCb+A?8SAq-ab;ILesL&}?2F1w-0Zdb;3_7dq1y_J`mAZv20%2Kk(?Wvhm z?BgJojYahs`X@A7)HA9Qm5P}EkW30FIDr{C1ON{u z1g5dIMr=}b5GjQLE~kiOEsekhAqGW;iWew{c8QDP()f-j!!>b}0<_?aiq6~yI>*3B zi`CdXW~Cg76+JS8SL=N!|F26HjVUaAW#N(;&=GruQ@h?1{-Ra%60++(*a{-;SN={& z3m*yJzP9zU)P6F#y&<2IYIRcSWv>_H=QF%ksji&bymFkwB+s?s!OWBD?KvFpwAYaF z6HB9tl5(fq9jdFlXQI1E?Q^gHxncuVOg#lH7*|HYd$Tnnm)HD6gV_v+Ekb4 zp_-m+TC}!*?8^M?Y`$XK{JN&qk1Sq6xYYg&+mlym)o2Awb#46$jTWSN#;OI(jOptu zaCbaIeUAorw`cR3Q9bDuE~l}?)pf9WSllS}RTN5{AmKP8TP%l##64O+ z<9w~)>KD$L^#-v&PKLdn&JjL-V;0%hPd@a%E}(nDen@49b&%5#O-QsX6;-7Ym_{)3 zVl37&u%3X?ma&!7b)K&CFgV2vcWds-QvlU}1h5qyxV^(mlpUfHjzhVqKa?A?iY8<~>_=ad! zk8dO`rvOwQj>Y9oP2*Ot9wKK_hBC~WVtf!r`yU%(p%oD8e+cg4QUi%h2a{}O5}EG* zZ-HLS&Y#FkWd<|*0G}o#4taLmE^k0-iGxUlg8Xl6I@jpH*%~?tx@JuRJn#pu1 z@%_I=rNM%Y&`YFTCG|8jY9=GAaO%H4EqhwG9gJlaZKg1oi{db>rau>VdE^b)^5%>b8}?cL9itw!Y(Bor%WpI?%Pj4J{j!bwjl?n=A z?##%PqWmuA8zS)5vCxk(#bC(9jFU0xQk5C=7R7TRzMFn&JpLe}gI6mL{C!MbWW0*I zJeV8RWO=t%FK{h(m362pOLR55=AN7W`u2&T{v&qlpQUo)8&gl^+xyG^_=H+E&E8{g zDtj>Tm&AiGOuNYD{?mSBc+fDm!jX{TQ=#IZQaQll|>^G`1^D^SV zM+ZBRqk?)b(96%pKAv6kG#;Gx_9RUJOrL=Ch#REmXQRXa?RfD@|1DZPOH<>K-+Z~L-ZeSdCe_=8y zv$DFgjbD+f$Xn5p?QtF#T$_pgT|@$@QGPJGo8D>TeAt8fg6onA*w0M>p@iDdM_^a=-IIAa==ijmLcDs$P+!j}iuEj;;q_SK-hF(6t&u*(3 zU!LE)pqCz!$h##W9aWv*rYjeIUm+JxEFjgC8ezyBN-_G-vS}?09R$E(jR6BMU5U^@ z(V0P0B}3^eADjeW+@$S6T2jX+!gXXQh=c{DMBthD%*Muwk`k2(;0!J{>|O2$aekt_pC0cNlWBQj*NqU$H3%h)ui z?qoV$6o>@NL$D;;M02ATJ{}%ng;dfcXd{fw1p6fDH854f8 zL_5c+rAD;odO-?4m`z)jE@0QsIP#m%s{3yxi%G|qJ9mC592Bk*4$?J5vvrf&4==v> zL*Z%RPT^^~#-wiB-EW#fR>F=Qt#Nm25b;_CbGzR|l<+O7jV3LT3y%tNHaS?@`}o41 zF$uNZFw7Y~77Aa>jb2bAph2cqyb2hF{`0@kc^4I@JroH*5@Ck{3%HA7J ze{=QfTZrXPG(~C3e0zG=<=@}#yeD$(it9e|@}t3Eyl(l}7SBEY4FhdhBIcb^!*gCl znFlPvfq4vU4akQLkM!yPH0F@Xp4CK5WGsrIY#-Z~%66Yny0cS6LL^vZ{#CoPf547v zDOQeSMJf?e5Ldtea!LXg_#yu@^rU^*gZ%^VuaIC)(1`K^c$#TLNtk$0pons6AR0!$ zLUWQKxeJ{spst%xMbvmTKy*u_|1@&<2(Jsb3$Ne98JRk3nUx!DJ=x2tx%A513Tb^+ z6{A$>`g952ZR_y#^#BMQ;Q?NEWr8Kwqc!wGt6zh&EFKrvp{{ zN~{S=Y!iu^0Jos91XK~^De&WAO?3BQ!NF<=uyq~mg=ar(~#oOa0#k@s$PSzc6DGpZY zT%MiJKfg1}p{soS^vIIw;22}*cuMOjV++=yo`T|dD%z@Ov!(S!t0^oRsA=_x^+YR- zRun2H5=~%|fM4gQs|vMD>7n5f8#?tsN@5RaH1W^l8V#@Kb6(2f^@31PSCF5~CtaD} zHvqx#ExV!o0Lk}Jze|zj2?JMi!xC>^ZcUbx|8oD`UrHT5QaV&bC3|pDTvIB|$&v2% z6%>eP4*a&})c8hn-$b+WaF^U1-Y9%4?aZpl@s?;DwsrU3yUt6`1&HKhr(r4L3qt&ZY~Ue$d;q9YOJv}hM+5p1Omb%T%HEakh-=S^t}!cIW|NCt zvYY;N*Q~sC1sQXeEuA^!svEU*$tdANv&&^(v#x9Tve5*SsoPZk-nva@m)o@7>0Un? z!Atj^ZD6Nk^lh>fKMh(sMon0&1|FKqIv6qslh=z6Ed%72Dy!IIOJsI&k(zNe{r5j` zk_^X6`ZxFWKTWP6!%seNfB&|pQNmWNqVSmX-rpQQ`2bN0Cje~8WfmX!`rCUhuDV6| z?tzm(+(*>4Rl?Uf)zvuzW2UIDP+k<|WI}{Ib%x>RC*r31(n%p}+BT+-9GkW+IrRJX zl4DHYwrN6EI=PMW4E<6fuero2mvA4UMJq5i)7)epXyn;=e>z3@9f-LGcf5hMl*Uci zj^i)l8w{96&a4mrQ~GllC9!c~%TH#{M$B;EW?N3ttH6-F_R*bkE z%xs+9eK>1JJlEyUi3|T4SYbBZx6y2}B_?h-TH3hruKPE(H$8SVQM-|~4Xr_@In|BW zVgnhInnHim#YFuiJF;qqG`&6hB@?p%o1y+ku}Y5rxPFzA>{ANaiBNe-q$cmhZ(g6f}5CD+Sf>5JC1{YNhE(3F0!pqbX3(RwM@_N|c zFzw=ol!l+B7sM0Mdy|AsMx{HQl(76 z$#hO*p?1?0eXP0O(<)bIWm(nM?>D&fvK;|!P?al}G1;T~4{9s&3~cWA(L?15m&fK{ z)~>Hj3O^K`+eU6-gO#NfAS4*o;1-7UNR|0&(@~!?n_WwQKqAZxwyrJL|JM&?c06U%ORPS!-dO@oAf`H*?OVR=v)~F4S5z zN+5)YCd&}E8gy1RrguKlTO10oX1m^K%4>6G=~)DM_>yi%EXJsGuk#kUP6`2@0mFH& z*Y7NFja4Y}-Gp?I88a-Qs4d@6Y3k4^;uG$8HkVZ>6{d2Ts(+j_*H>Op!RM>kkox{2 z;Rsw5Iu&f8xr|1}tTY4tlHM>@EiDGFo?bbl;~Fu({1Z6Pa>+DgRgwURk+FuLorv&p zv=R76sC6XM%S1>W=qad%1G_wM3Sh6nDM0zsc0|E!6pSFE;zY!kd0?&wr8l1tn`~l0 zKjN<7P2T10Tav&7>10G6STwUFdt$Ckoo6!J;)Qlku~Vxs*jOESa`jr1$`w?}mAukM zx|OzkuRpal^rsm`;TczAm!Ag(3+p`9y^Z2s;Xjy+&E`xnc2|LnIxpPt&XsPg6uUf-7ft7w~JT& zfw+4o-?d@ch@?j;51V6l_vA4*Mm!^38vC%}t2Q0LXa*LS0U5%JS+ZNQ2IGMa4z4Ku z1XMXlM4({XWT3mXmejMX4KfvQpFUQG=p6zh1P(#hx0TaeK{z8y&FKjo3kEhe;iDcE zfcF9NrmRd+z#75I#zyOzI${$C4z8egkGJ98@%p80)mt99&dA=tEGF*_>L9oaR=CWYsR-P*G_o6S+z$z#(P~a{(6#ymX0~h z+zw|!lNvkPaUB%ja-FB?(Fv**Bgd~HFZW*OO%_;My4Q{$zEnTq*A43HRN?uNFg=hl z(mS>Jp)!boM~Ci|rMz6Z8QFl};xW z+VC;%K?kAOOY{Zm7ozQ4hK7!RFs`B9d6c9mQ-&9ZPv@IOdauhoi;5;SiiX_ zWHK;M)?aq=IP-A2oqKccL$m)pH~*+mz|;ySZZ3~)-BsluH|nc;xl+!#{ao9QcRBNG&Y@@wdtJbh8!GYyZ)Aw zzW!rQ{z;Ot{z+k{O^#r%wLyJLxwd z^XJOJx5eNf7|~5`*>4^z8HR_EXsbFq6_{Qh=&*U_cl%k zwM=iU2Q-PXbe70@^dA>Q@*j7JJAQ6|4-hly6bGu#Guf4I3#=NJmMq+jRMnDLMGTM8 z6FZqoQTr`j5OI0-s_>JgLyrB~1ISJSSW>S5iIM8Fd`kT8G)kmiG74kB5_qw%knBSo z@oyzBOWuPdb_$`9K7a)3Pq%~9W`D>*IUiM@0O!f@)4ww;cr6QD5gESP1B%!6;MicH!*-Y@P77+wB?U{(vm~ z0JN-bp*I7tds}$B|2Yv_ml9GUw621L=mG8zKA?tYOyL8Y$OA*gF20al| zE!BG;U}OpgXwsPQkfX7WgsEmUAWlI(Q%5G%c5JA@ zvU7cnaQC>*j%_XCf?T?a7#|JPH|92fQQw$ue`M)hN67HnNs*fMopiZ@%w_PtA1jc&hb32b{w#B}vxOro)&kk4QYrL#`LlzCOWDbu%nMm`flvZfG|KV$j$ z-FNRE&whE;GvWRhXt!eH;b*Q&eRI=I-{8}UJ`2g|xFh(1d6<`@`9woMA|kP%%i+S5 zK1F0WhSZW`Qt4EZc`V(MZsAXaeCedS(Vb5ELclEaS@QrmjTB5H)0hpPEE5EQNlSt? z21ITlh|EwEWF@giEs@COAQx(+_op}^iJXqHgKDa5asPlpLpVlbgj@6s?#6S zYL9`li=n^zx)AA&B=wJxE3xcTD*N=wh_LiAeKO-y5#$mc`A=Xw@xj(!AZfrCg?F2! z%%%|*5?(3e55O%Be>hdJWqz|Y>@NYc35+My#uxNsQ%rG0cZ281FRKs`l-S?BR7$Qh z-dVrO@Xl=E(CcZ!zjWz~bC~pbD^8Y^*o%J<{*O3DPI*%37d~UUCSH7g{XNT97LQ$? zYDwS3-Mc~fzXjb-ryofsKuafo;|MWb{O%5q#oGdD3s3+{Gu!C$mzxRqo(e`nj_uaPooI_7+V3f_n$&KXNEvegYzVOAmOI2;f z%Txl_vJgS~zx%NlOt`B5A1jvKoKv>6a#W5%cB9YQE}Ng#F-&RRe*ZmNFS`A= zffzY&T}2~NcH;d+T}$M2l)?WJg&c4iEkTi+0V>Z^9RNlas=*@uckms`6J|+}MwkVl zE*N-dTsD!&Rw6C9;`uACcs{*j*L;_2erJQvcU_02%bc~Ubv}FK!A+YVd~oxo2X_nq zIxLJ(Kec`BV~&r=1*4{GtdwIw_4r|;;(YY{D^5OnWS2C@x2K~s>682AHEryBn;yjZ z4?M8>3E?~8cUvB~Zsk;R?@dJv+4DFYRsX`H578avc%LRj22up7SnVaEaV$dP+@Mb2 zq4CIrhOkSI?M#gOW_%ee~$=YyOXUUtta- z@3Q5iMlTbdyK_ZVk=cxE)U2`ldFI@H5%zHXu&HYiR*LHY$S&l*@|^Pwk?pbS!QI|E{fuLT9l>Vn41g5I@&W>ri?f&GFo z2Mvui(Ha1iNH}VO&gaA?EjuED!@2g}wMSvNZckt@^ zbBcT{_aqY7%7ddWm!=M@i%rJXYvdmtmEHZ<%5=2wE#Ya?`{vOxdvUPHUc~Hq)u^&+ zVxd}piz@JUQn_L0+rqRxfv#aS1_Qa)SFTn?$r9m8tB0)&yDHj4Q)OzVO1NO^@T(S# zL(0QB&KiTUe&dAnr^5A~AR?Oh+sP8L@Ls*u%05spT>iM4%=WoC#%#@Vlnc)Y*M>(1 z%>k=bX=I0!#ZUiZtZ{s3P3^i(18oF$Y@`P&pb7q@ zvO&%Rinll&IO>Nvk;2BP83HY%nxOt@^RQ6}1388?OVhV+Wsgs0?25ERVP|+&EE0^` z9;D*zmtfJOHEx^cUSPX*CM%hFt8IaM+BUL@o;Mw^gE?}ONuG9OHsL}9goCExOl6k9 zcBF9hZPPbzo-Rz=Cbo417-4=XMb6q`w5^}k)dn8)rye-Nvy7(}Gh*3HgK@Lu%)3+n z3oI%!*v)_P(IJ#lCcqSZfges}9(VST_vZX!8Iyu_9WRljFOkeF&%DGjD#;zAuOeiL z)kL;tDxm*yaTD@D7Ic(j;`>P;SyBFLyqBneU^?`pM<(c}IK9OD2nZ!U*T9lL1{g;P zQHC5spChCsLWwhCBD+2mm(S2;iqgWTOcCcZWEYknl3hS(8+Jq-!Js3u!vGXFx%%`X z1GZyXL7}pT{gaax|rmpxnPf6C{R0 zTib|2S=j5#k%yaW)!9?dat0A=*X;8^v`SQ&KeDAp3DgrAcLuh@xA;PZBR zg`=d<4p03_tdo51mGomi;T*5W zBR30JjLniAk}JV|c8{b_@+!PN3ED$3pu<0a5gVJRMq0Nr)(md5j3YKqt%Cs={mM&V zt(QUujwTQ>MqnxgM4FbD0^omUM`j%X;ov|kMM@GAVteUvCTv*~XK!V8i8e-rGO=_w zoddypK}UkYEyU(oO|oKfA7hGR%Au_RIi%5mMX8P!NNn^DF#hO?MyUXe5YZ^CBuAyz zAaoLmQ4tEOMf%#4pPP{;jWHM)?Ifp@kt=LAg`7AKI~*z{W3ezw)pVPUQEMy~jk*Wh zTB*WpR!FsEi}0SsqLk?wqmj|el+#Tnl^ko>maAr>%xuC2=oZxEl4o@~9aI9XR%h1D z(rWcqJyENP-l}^|YjhfkRH_Dq0Csag*5}@Ne*Zr;M)&xhr-|1PuRQ|g&-ss8aV zHQ)cOM)PgI#`o!W$Vm6yr&5JrWzH40eATw{n%~Tk@(&l_f~OwphL< zCqVa}HZY$G%oj?XR`mrDRG?uJ%%7|Dde!ITbG2SC$p5Y}8a2z$XEq>ISjNkZ>1)ov zgE4B@ZHNjMe(1B_iMB^&AdI3IXEcx*Chj7 zB70ZAgoM~V!p$$OCVPKo`w;0RGhZ4!{v}p2VcgvrJjUJQ`tKgHL2`y{a5*?8l{pSS zVw`E_9ZV7@{DRZbcUGeBT!b+Rqb4RXao8LXXKXTqpXO606l_ghxNxwE%@d7RW#3 z3UEXjf7lI6*9ic+0Pae`^tPR>QL2SMsL3oEYnGOP$E&ou>S`~7xQVo(=)(GU4qQK3 zr?C@W$tk9f*D9E@M03cl(WrbDVpAIxG#Fl;5L{*BOWVj61YAL>qYM>lvf-j@87tpW z>ZJvtU!o^7M2?;aC>6H~*pz?_@A_f43oiSGu}SQ@oNif|jUiqc=UP!8 z=>_F32*pk3PFPZ*vcpA%CN-p;Wxmn4U-oTG7E0BO+K-oF$b+b15-I&yI4^>TevPA| z*`O%f1ySQ{Y5ZqvdO^$W`%*F%#Lt9hQ~Pdj5nk<{#WM`}1&EZna`}}EkJxL5;b(RK zf@)(^i_(k8hi0cS63J zs|Oki5QJx-ntFo~>>H%pY^E}xqM$b5MkoYvA@~kW?9WyLsNftU=J84%FU=uI1-qz& z1e^PwZW2CepU0^YenL2@YGH@)Zu1jQ{eo)vbm78VWF|Q$<=}w5W#K|%AkIaL_Q^~f zi|eTOp-#ROKBVnH#1e_)P3HY8s08{;dZ}0gP%Po!hLQr;BV~334uMWAl-Bd--#Lr4 zPP?Qdr)gAseNmTiQDw`*c6`PC1Bk z|3&YFAt(-S5J%N3gxme>D{!fPNgp+SjP6|uarzfLH$e)iK6*+D$1m-L*m8QjAGFH^ z!4#H29_}tYGe9>0-gpLnEkFNVf|O((Fhz0>mN{pkLJV{|+nAL!+nm@Nc5q(1;$0 zM^XlI4futW(0Z&+Dmx`;z%>=+F$`--08{c%b07caoO2rfcx&P4E_cI%*(-V`x`@j; zY3;gE`&aF}^~k{oo~)8NnyMR&zN(UV^8aqFW1e}|cCqmFEzbNRLwxxa?}InfKOla<+Aw3N@!C?SkfJo8^8o_ zI-fw6;_#rs8M>Q+4?{*lf6ip$gGD1_2)F*3nIb$OJoLNYv87o1MtGo;=rMVHc^Mg* zzJq)5cfvzNlfHv34fMZg$+Pso7znVXSU~|SIp>ji?}fH(>3^H-I{4m&4?q0ywD-t7 z&`*A`g)pImWS4M#Zu;G9Tl!s%h6&iR8RREo0+8h2rQ~oF4^Cf%UjrF-Vx~<}RSZ*I zE(2MIVn4)+wu!iV_&KCBJ7WozHtAvFJ})oAL?hICnfWHzmC33lUvkOkcX2xQWGg~> z@BaL}sp{L$pV2vjL?679*l!~z{`9L2m(0`GtD8C#ot^Q#F%1oEW0p0nz3W%&ub4Tl zv7>Bsdu8sZhQ_w8CH3p>X8H^MuC2*;raREK{(9zN$DD5BT3H_a=?1Nud0!pn*^pUZupA z00^Tj5tSm3ES7<&%$QX!=9c9_0)sU3X6E^ShyF8t!uA7Cb=}?d)XA@&a=V}EW*W(c zOu_RclPZ>-{Zx1NQ$Vf%1X5Uw9d3Fmy}|)ud-_SSfJENUoGgFpK<0AjCt1h|evE%Z z;>VXe18_1@Fu#N{v}Dy$lYcahh+FBgOa3nO3B5w!-!FNJjDG1I;T;eXh*@fdciwr4 zjDCtq-A8v`@^_NF?=`aGOWz0iLhnbEgMcy@d_;QkKk$7ipcWA}i23ZFsLEMr>E*^m zNiljMCxS`D0CtQRk`;cwZFtH2PC&AwZk-Esg4y{wTFw0ENVACmqI*lPKgx2}QEvCVye^Z; z7cdw4Cy!~hT58(tTvkqTwpOE+DP#Ggikowbz?sCpE1Y-gkZ|y`3z*$+64-JWdFkBM z*Ij#OYe`h^Gw4gVEuZc6IEwvFsdR;*#pxI9Sj47n+C_64wj)Xcy{3t;pT-^ zp1g)@-ZnI(|2o#{s+>8q(rfAp^75*M!p%o28Vqk=(~!6B6Rq}RU(=z=?xM1(WkubU zhnjpJYqg*F8xK`aD#}}&S2U^mP@|C3P(crm1S=Pk9!@{A(q$bR3U-;imDb8&gx;j0 z;T429XfFCd_&s7}e*eKm7kxl#5W7Zh_&9LS%OJK_PssaKWeGE7bk2mF(NjBbZ8CnPRDNY_y0vqvSTwEU)@I|E zO68Zv=36_MNF$?~kh8xcr^0{F%jpBc+=KqI8uz?&m(F%qRQMx)?AV_(LB-(KX^Hq` zc*ZkN%k29pbUyV*rbJ(s3^CW0uoy3ptf1(|FpOf9QHdS+wI<@yAcjwBu(VmQ6c=8m z6b?EH45R20DOnSoM;S*<`PnH@ znU-mbX3h<@cXoy%caE$qshO~gkdgW$q6rpc|}mM zfW4fn2@zHg?ak<`h$MyQiiQ`Lv=lS5hhmgJXsl0?YsZi4E)8$=c$QBnnXh9F&2c*$ zo}1qk)E{n2YI&bMPp&&}lpO)v=eQDNTY=41B&;b>thIE#&z#?7w)+at2l>OB;qvN; zop}qqD&bJPd~C*5L)|+2Gh=x(#-YO)hiLs$8|GplsgTtp7@+wT*fLZpU7J+vUEW}w38eItqmZNf`rIh|C45G*4gvtuv2ThuDXc4 z_`F(~o4xr#n>-TrA-kYAe{7|2#8J7Z{f-(gd;Ga>&c1)lWrqs;pUj`koHIS(pOU_D z^8LS$#%g*dRg)QD^LVnOJea-VNlv(W8>d}4abi{VBvc^g{(<%>=A~8;kSobx+W^dd z&`(FbE}}m!n<$swWH;yBxQ58)FmSG&`4)_se1oQtH6u;oagR#y4*UV% z$RlzEQQ?Bxx~KCmCdnIwnIbM2*apCK_K0`0o;qZC^gB zrnD~peLitnc+7HIOQfYaR@=5i$KjSiQ`sTL}ZLR4Z5zHCAtN>{bMsjN!6PEI-ku9@ESMg(;v}J0-^JMuS7w0b5 znX@cD7-?=8W)2tRaCYfAMyrX35sT!5f6!STjzv9;6_lBvK768%HD@<*NHttQXnIdk z?y7^F`IN{L?uU%rCUVHqK1zo@akLs-EoXkZnBZUz#7i_Tpn#3a5+TYeLYd_#dc{U1 z(h#`k#S*5uBs;gUF*loal*U~7`L0;$=f#;4=AN=BEs2&1-}$2Zg%57C1^v#VI#-t> zJzRMAY0~-3eWdazv*eQV6Mxve+y^*iS4kA#R|fn- zu&3e;qG3vLMn`=l-=NG{P!dW@q#yXDaL&2329-vr{@Uo%C`>lC=j2i0{4mP|q$wR{ zgn!v%CnO%Y0uBjp+Bjf5$TTk4KkHU)cFe@~QB_pz^SCGfJ*?JQKf0@!=#AcW;GQ7N zoi;maX8SBB zw0v&=GnX)%`~NoZ44HYcOdJ!a{DCi*(Pc}iWH`|I(H=k{g-Q{v<}ma?m=r%QWf!J} z8H0%E83q-u1cZqn?7c^L{#>B=FH!3BvbI-O&wt|5F=H-$V*bp7Etk-A)B;d}v8Z?J zB4WCFFCq`qCkDZL$3!R|>lU7)++0^}S32aEDj4OA`8fRuuF~3gDH32)EFsOzy=Bgl zbuV3)$8@b(Z6hmq6?u zdXVtQzxf91Fn&M9rzk%aFfXVsQ6;NGq(q#$=}<**)WJ{ZWib+A-;a)nqTVnf6_5cn z4t)>}4PzEXog;w~#$Z1ki{Lk<(qh}xw}&MofCb9!BjRB5?P=tIsR5L1!lWmvIA=!w|rhUdd}Y5$nj z@Zd2XuQLzdk4WtBzY3^hY>D1*R4J-QL@7{T4h1Gs&|F;1!b2qrcn-4Ri{yl`y@Yd0 z*^pzgBXmX3x!4)Jdgi9aQKc`rW~P=gL~>^9sMO=stc>u zp1E|DPH z1|+>G%%}<4&@;lb7~m`>2842kdFnKRX;3oaB^xJ=tNn^$zN#HJY2(KGHZfn-jm65O zv2|Y|sE=$MDk`P#+f=niuhp-qLb%_?NizMK%8mDJtX!j)P1?vF8!9)6SVmEIG{8bp z2aE9}WF=dHrxwk=qJ>vZKCOv%Yh zo)At7f2FjnBAx2PwiC{psVaa#f^a&N&m&A4FlmWM^^S9%ZFIKlfmIcYLA zle~cwab?#R3c6H?C69~O?j5+5(Ku}I{&=DcPF1X14!C@Ld06RKKXaA|hyZ9WLm+u1 zYU9HRsSL0LRFN&gn`8*8j+(;EIWTVc&J}Lr|J??}oqO%vFY7Pd{Y6}OUwA+M#qNvh zzMOllm$Y2A^8D}4UwIj6VU8R*BHYKNenP=LIsAo_?BrvlN&QmChJE`sbiAY%o;Ws{ zJ^8}+nDF|rXml9KiJ>Kc>Yu7U7@IPDQ1zHiY1R;GVYn5!>kiY=A@hYZ6D5!jXKm9F zjgDUbX@8jR^5dZ3&mH;m`~C4Uo)bA9>NwaLyc_};espuXotf1sT)&St6D)?TGRdDT zPCw<2Figb7ochV#|KTi>N(;hPVQX42l#brCNgD1 zvWp5s5{;f&-4$_d+2V?%|A$k^r5fdYhRjiF3}qc7I;+Crs?HH`C`>$a*KxQcE=)hS z=pzx^E@g3}=pCRZL~ZT#1ON~Xut5lx&eUcc*{uON08|U3d`6q&Pp<)B?F42E1NRRy zJM%GAHH^}96C?Sr?6UqhDb*1YaDnW1aE>TLszQtvMYxNSj>v)_3QAO@Im7ql1+=foE6>vkVT=e zML-E2DW}+g0qxjgNR(UI1)Cq(jDO_2P2H0>Z=T$}>HXxWlfN2Uojavei`8=j+%dd!-BCV*E({dFq=jrOQYQES*I7_41O!tkCj<#5M2QaG8ryvdqK7=gu9TZr8csspKTHAy4i_ol!q6 z<&!|m64QwpObHr;Z$XeC@yn?D)x@T*VtiL!l|DIvw7dzSd8F_dSYno+%Z(I9k_YJj zv|M0aC;$HDo7~;~Dq$pkFC_j<8=icM@OSfRWQ@v%95YffhmKT`I%QJSENWZSf?);l z!poo|oEX;_!8Rr%>f(a^n0^QrUm-z17`_DZ-=T;mxdE-G&1&Sa35xRsy&xnq5mJN0 zK!wb!qvfZ98jkQ>%^p&%D|XmjyV>G3!aoc_lNykvoS^23*1T~x2U{uIUmA95?=I9L z*Jlw~^}!~T5!peeSTkrd+Vf# zRppW?oSGxi$X>^L&`5?#8hsNQ=(QGe0tSE&-C`W$&(dQ$TdnBh+>We?VZv27Gv#S`x zZY2OyBt_P2SMC;6st1M5LWQvTL6yp|2gJf0<7BwUm3uT-o3rxrvdkMw@MpJCqwJhC zsZ*&j?k0Nqf?0WWb$PpuYUTD_yS6LUDAXx#+PCi}1wHVwKmF-3dLTu?Q9A&nV6oSo z@k-UhPdpYrmPL~F=$s-#*jh4}6K)VM{Y!r-HzX`A;+Gyg=WM=6{lGoW=DZ`R5fm3e zUJ!qT%nyqa{2SQ%$wGES$NUcb69&&849DX!S%_!9&{1|m^t$s{#zpXjSU!ThAZ`em zpMkBPEKH+)mURqx;F(k6X~?W8PDi4?A>1LBv62%KdYqIl(To)^r+k4rkHRibtuKrp z+A+}kFuI9BP}DF9=o3}v!~q124L~~#QGm2Yp#;K80}BN8x{HW(2&G>btrLYno+H9@ z35Jh4PFn1&B4`XL_{g>k=KW^r+_+su5K}zr`hwB#F1xI|d$y4oOH{&}z~X<*=X;n5 zfz3sWma*%`tr432PLpt_&gu7BDvm9EuOiIYq6=p1X{ncj7rFYuMO!}UiUBs)BTs*) z1o`Z5JrSoV`*u2pM+f-Tl<-D7;B|slWs{gddl4xwg@uU$RM2QL(h>#HgZf$A;YVLG zl0$wIQT7Opo4-^W&Ft;P9i#4#aYx_(jN}G|+H66>&7adGyzLmnne=3yCCIN}dz^55 z%q53NnLa4o_=l&E4%Pk62f{t%3gK|tBrIdDXQSypVUnQ#)ZYSK&Dbq7n*`JDF?m)27D?iLX(kMOA%T@ zfiG0Ffqf_p6^<=Uz=~9Qb}N=Wa;dfq39?xAiLF(tr0^|+?3lV+4bD}=FZvDP!*|ZV zleuo#==FO+)Lay)iB4#-+S-?Fy@|QJIIp+>9J{11)nNVZ*TGkL-3_oO9~YaG97`l8 z*{J|YePRu82%1q-h4#rUt33k4Y)Nlow(4E0rq3O23t7Bbe$|x$vS#+eW=Ftc^%IBu z#`5&R9&0=M)JgGTyx2DFr|X7BOXMQjAPG%>5=Me~z-OXC8J2#zo#gSvuEokmLq13>Ks;moLJ;z3yyYjIm? zg0+BGvYJ>*qa~#P6T$wBIE>PGX-G8vh!q|}3>8NeL~*NpU@c$^L@~tDK^DVraY>x& z?bc$O#cGkc2@KvrDU$WVlNFHR@nrPQ)cb{S2>N5OmC_7h^vhB+a6Q4DaVe_5(lU!# zw4+1&r_Wz*i%LbWS3HQz&{u#fCNW?^PSAZ(dZ*GecfnPx^t#xIhor9}Uia*q{^*2( zor4b~3k1>VM86!(%Z+PMc6V6DU}B5XdIGL@P}a@}*xZcN_4A&%c+8lK56{0owQc&0 z+cr&|vU&5AsnfR3n7%D_{rtmp-xKq$XXeNZGSNw8Bf?kHe2W-ikXB#O|-cKR7uZ5(TT(GVQ1;IKD*BA^?N;j z@0}ix!ATR1xOEQ{YHbdiSq;J%Z=uHSbC@*_zsJ8-uF;r^io9-jp=FLI67~A6TB9W( zn-kh*Q+vJO4pAtKQNPEeH5!aIo6)4#n%(}Fki*jDi6SSb_5z#QlcAS z@#%&1i23tyME{#Ci!?+UvreNCDv`Mgsb5hG8a^*#cNk6fiCMnPiX-Hp+aBztPl4Oh zyHn6D*0IHn$3DB=tiNbPC^UlpZ*J0?V|6jJJs@Q`rA}qn+Rc8tYS7vYi29IOYhBsd zuG*5FF<(~HWYziASy7zd5#-z)PSo2q#2&G$?fT0GFSTxP_hrrNTFu!t*=E!SBi0Cg z2=SRH$2YzncHm7u96A(;d=Z&(Qi-??nsK-hIGvf`4q1jA~oib#XKO7tb8)6w1$r@c;e$bb_`&F~Ni2jzvZn2Fw$ zz~B)d_)khjggJGS~kwcJ`S$EEhn$FG)b)C?Be?Rg4{?f);@1;dk*(~!#;TB_6ue~koujG{(Beh zUbt{KVXkcLp4__g$fK)QtXTahxoGr)j=G9-8WhCenK&*7rYIphp6F!0FZDa$cKI}A zbC$PH6CR9|P9~in$MVcdqgHQm<%JWmV76W(Ra?!jyjZd}yEEKSQq&abG|$;JC;bSc zi%r_Ko|C*fHU5MMZZ-d!_K;<@%9@Wx|6OFrky`ijgBLxNotf;yC;P z19KdM9L-wjp>Ck8BG5)h!T0r&0%+sf$hTN2Lv zkjxKXirD2~To#O4g3+K1RK6xdDPT%wEeGp9$`BglwrgN{jB|EL-iaRh)`YmW(^uJ7uLBa*m(&$7XGI-Ke zN;nA09{>_C7UNiom=;}hVi~*+tXPQjh2p-!$Alh2G7T7~LDWZk#B@Y`_||eS0j5c8 z+}MXS8)x<*jNC9-9f5cm&Im-bpfa@rDJ#}aeD&mfrlGy%ww*gk?W`wa$f&eubjT!agn2CWzTsF$9FQLv-MyCyzdwe%0(XgSv}M>Fy@F$&>plh^`XnrC<3lF=|wT zxwE#mprEjD7ST?yA%cmit*xpe>+d> ze4^cc(iT%F0-o}GzhxHDd0~0Nw%;391a(%WY$gC>p7cuGwE}l#_6uJTU3%q&Du-Sv z1BNQ6(xHc+GOV2wta51Ju2zM;w9pK?-$vo<7hb5Tx!}@jjIK(9#}tXZhOa3(4AZCt zeR8mWs=yNvM86y>IS;5hz*qP;0}qHi0D~PqBaSeil!iUQlCV3>8lbEi7?siLw38X7Ay0^wp7>Q~U9X90Kmz9u zGh;-Yf!@kam`UQaU~ zKC^g{E;aY>7jX`w7r}f$FY=D2T_qmcXkvb7<8v^QFe+0lBwIdIEMQiJi?iI}QvaG9 zFIlAGEc-(x;`Yw!xJj5VRhrI|!-jRvUkNW&`eTdRs$1-4wL%XTJcV-aZoPtMmT%{l z$~8)|v|`{C&B}j2h3Jt^>K>w12|Y-kXd!bQUbiuM2zE$ z5%+bOo?z+mdio*1I#~xKh1Nl9@bD{9rvijuq<*AxPY@W|#D%3Lf z|LDW95-oJ%uc7PzKjz*$Fsdr;AD?r})J$)wlbIwl6Vlsc5+KPWKp=z?2qjWO?+|(s zVdyBJ6hQ>RtcW5iifb1!x@%WfU2)a5#9eiDS6yFsbs@=IzMtn#5`yBo@BZFDewoaj z+wVE&p7WfiejXa4W`Z0o=tf#%Y#8W@tEJz+IKR>U~HRPH7}){FA_g z2@RTRpp84qzJ|6Tbl~m%2s1O8`iyqZ5(?E!d*MNCf_fBIp0pN>Y$)^p^{g6c-qdT) z2G|`q!rdp`_EOQ1xd-;oeZW1skI7UsOBvE8XfB>qbJ|9n@GEyp#)N$*zuR$;iHTMl zMb6o*mJJixJe)xE3Q6_4>)`+&0VYGZT=+r_+-_y*&qQ=9TDu^?KY|vD9{9zI3DK(5 zME=Du$arMS#9PPZ2`ya}-Oqi0SJ|R6){pAu>P}GuxC!H>S(E&)JRvc zK(%pLIt!%_Ggh;J!P3mN(C&zQ%b!{2zgdp>O3i+p(=nue_40cDaryCg10&jdx17tO z(^oG`_H-m)1cDqwb`64b;Smyx)_@t0hzGhdMCC4<9`|!TD8jm$rK?L{m%e7ES5xX| zjVv*(Fl`#N^Ymjk_TQ;du2gC}db*#$3;ZWOD(u{Xf?=5$H@|z8nKTK#24ycWnW{7M zAKQD&^LZK7DvgHE{3S1zo_>f1NH&P+M;%Csfl8EPu7x`aIkw>Sb*g?XAd3zsX^HUS z;UC1y6~<^aDLl9k{x&4~;8i-HtfOnX;mQ^KYx5>mteILiZ%SkHXs&4RwL5E-R@LO( zM6u}hNxwS1`A=KMZudb^r4d&kLjbo*jB_XUZm7xw()$Npp75WZModdD;0bDHwr`R1 z_{sVCpn^HUU7WwBZ2nzSn$~Q2(Y)xssf8Q^yiQfaGpCL)?csqTYl$*OC+Z@HVq^XB zOye(GF$~=Qgsvvqt>JX}F)?~g{W!WMD}jH~8i`yrp|6CFShk_1l1@(nOjnF*SpCVK zPZ>c(Klp(l_zKcZz|T@YCZ0yA0EZ^D{lW`$b84Z^U^;j-tpQBvB00=t(w>;jRGNw zHbmPcyBkeUMyN*Dp&<=!4Z*9_kr2sB-A2w*DIcMAtDSr>qu8;Cw5OT*sv9K9fcGOK zSm!4y(a2K=dfsK5;!ihJii?WuI$xqIGc`8d;YdoW%gL@wbJ?B#*wjo{qOWdT^k9m- zk==Ptc1~SdlEaZs=lt{%`6zA(m=DT}5dFZ2(yka(5~#H%rX*T@>g=_aAidv5RVz4Y)D3sGFSTS2r^}yJIAKH`4lg%ntx|R z@g|#cj@ugfX#OhfWp`jJqBtUbHkZ4DSHKDHin0O4ELt|2GH9gHaP!L}3}X%RMu9^v zuS(%Jt&VKN;Q3N&Y~gBXg}t%bWVW+k1Gq)5L#s5@ZkEsLIw^XNABqBodZ8Z+V-=0W zNfK@`WLS{B9Hl>p2R#J6Cms(mA4-IIVD5qlOg);Cpn%vztqY4NIw=`LQ{iB&^7#Wa z7a&uV)>V||WdnY{zt5auLkdb=`8s!>hE*dQPt81kI ziO)fk1BII*_SGJx{lTuOLY^sHz={3|Pb?n%Yie4$M&R<(ilKI}PV{R%0}AWba;7QM zlhO+kSbd)<)y`7?fZ^f#8IR88g^8yYJUP*(>zlFUnxzNtoZYl6N1f{El@=@+k}>b# z?4Dj;?9= zS6nw@ob*rWHR+$@M%;ibXjl5MM&Dm&83`?45etEsp3Zfah6&wn{SbZWiSl#g2s8QF z!b4X)kx8BIv0a|9d#)&qO#jKn1JeLSU&g}PO{iQL9$?_n`%N@9{Doli;kV#$3Nk1^ z#U4_1qX>;tNcxH3ovQtK_!)Q;noSJxssaap?qI9Elad>s5bi2j#ytCs3 za>OCS+>#mBw~`ecHs)WC{zzU^cx+5Je#R3lToHj6;g(tCOO%@6wkpq&GX4R1 zbtJ>0R7-sa=3topyX?tUg83mJE@(3F#$*?KY=Y=`;PXg{F}hsA=r60uXOmHR?c0m~v#F!u!V#*&AI! zFCAz1AzPG%yv`L)O!?wt1!(?ra)UJ3BIHo!{9Yy?_5{>Guyf`FChX$Fc_I zzkl<0r)IOI1!D?xv z|1Xy@#d)U%ppGeWtaJ{l2B)wBCoHNdN?uM*O~xylSFjm1X(4SGMWdi;NKxSuf(5t$ z(yq)xWA3qIH}GW;dPcJn8YKu5f;{oiO;wizg-JCFwS~i3j<8^y&6ATjN8`%xe@W3ZTPIsDF&xo?<=iJvK1bU>vQqQpAR2|98e;? zywn>Lli7c4!^k9)D%NBa68o3AL)UnD;d+hQ!;L5&d5@<^J+vey>4Buo;w7UeC9Ww; z>UC`7uuab)c08w7zw+VUfg^7(8}2hqI@xh>QPckSg{{)#cJ`ZoB^^z5>Wnx}rQ)|t zm9Bv?Y4QiD9p9(jwKLujJIq}-HB>Ae=~c1k&Xe~rE;Db4B|o4OT`5J0Rv@-mt!atz zj@X>-1Cp1zVgT55j#C)|HMfmO@q}V#n`2Twx+XYdZTw(Y`5GfTH>Yk!#zc-pZW=AdnU&ctSGLmPRA#Yl%*st2 zE5@3|99PQ)1!p??$QLg?_qS8cq3YGk^9J=x+wtQaLmvIzOJ(X93s+Gg81?GDFTVN4 zi)CtqLG-vQfkdF``vU)J8+thXfiD0dYXo1A1iUiY;}P;M1b7IG9)w;9FLlWY2N_j$6R}D_C#tuFLyR zQg?8Y>?h+f4n;=rDT>*O1&SreUa?-W86MDk6bIlb(X6-=xcVo7u>QE>DaBdEvx-;o zHejCOiI7E?piCY_R(m?>8YV(eH+fkc1o9v@DE}J~P!EEwJy^lDDl0jm&=M6(WjI1} zhsug1OnxZaJWem}2`>S^DmBPMa~QOGSg}|L3CHQ+J#ajM_k+p-7#qsBCaS65;S<0J2iW7)(J59wVcB6%k{?6%EJ!OsS@Utz_$(y8; zY_=t%V?5*DFrIlzZ{ki!YtM2>w{6Pe9$-Sq>~eHS?^dvtrb=lv8>;ST64@AOhk#MC zHzd7!sHq55P!v@j9C-9X0WZ0+LTk2bC|f@z1F_*7DLz zruI=vvH$QnNO|>oNZOsqiluu5BhEgp6xpgOR(aQlPoGxv0hs4a`qNCWlU_c;dVlqi zTDma!WiF=mlT6^9KFbP?yQEJ)%wpTyIW&YF?FBzULCQyRsUJR;KJU0*`iv#~`OnpC z4l-gG(E_)Pgd|FRRmT4(%sYi_RPEM6;$3%-Z%5%{n>c_iJhrLhpPL>N-gq#SBPHg9 zDzo{9P0z5IZB?7kp52`GFuR8^%q3e+zbL)g1bTBFEEJU4yBB)6py1I-C^!=N&1nNd zCbKBK(G8K1;))gUZ+7rVPAR3Vw7t$6-x$fJPaG&+8+m@w#PTMtSUR>8IWwlE8>A1U z(8^i-@18xi?eGFN_%(Z7r8sxBlq5ZS&Db~Cl-F;l9Je^~taR<5acm>kyS*=)&e>K> zn6*kON8)>1LFFjt>#TO+!OahJ(gx)D`j_ncOO%}4G{JPx7gXF@3{UmqLN~)yN9>Bc zpC>`rSsX-oGVPMHLph6`su_njt$XR&Kiz!upPqdwyjDEi%D68N9r}`S(*JBYcVz9o z&$k{p(E9wnYv-(faNH~R-S=Ja_ctH>=)vYCYu{Y{=JESp5mvRUOUK`Q^Y~KX!uq*$ z+wUr^XJ)0&pP$0-5Nl^v=I{ zJj$bjzVt*|k!cGIjUTvd6KyVeA${ty&7gHGB<#Q1y14zTyV}$4`fA-A?XMQk9G1;8 zp5EWF&#>*jJebfrN6kWh2{r0A9OgK6uv*5?N2oX#x;mx`pR@Uo*GrC8yA6OX273VP`NcBT5$Qr0j?G(M{{P7piqRt*) zN=el73s(VL`SV{oUT6>g%o)xA9Yvu3PritOk*PmT7!2X&#aO|Vk=pG~2a{1WGXR_p zgE>l4UMm$H7b0r$wzikJ{oJv(mqs9+QS`6EILDZbuS@=&Z5%$wIA;~Ut2=)?DwiM7V8y|a2de7gte_wyolz2Y5-{hoV zNoufec(7NxJ*CD7ZahunGQ>M#l7ayb)Ka^pQ*2}^2^dYOPAi<uj~;F1rK7F4-`>hvE3z-Vn_W?n%^t`Kao>fq*aO)WY&#u0N+&ig zJ}Q*7oyn@G$P)Y0@>jpY5>F&PG#&KoJ^YRX^+K*%Ss=<$$y_-}L{UXErgc(E5-&jp znr?_BbPwuI#L%IiL?tQGQxhLhEFNIO&2PPbbo8M$OJ>hnvg%;{q2Ii5`}B85i|$0V z!QOX<^!@rRpKN0Z=T@CRx@XJQI$o|_piwYoJ1MS+k z4@{;Nph^J0Rz&vw*R{6pWnO9y>5qG@xbr22mF}0)L#gr~)}4H_qp>6$<~$925GmFS z&0^K?9>3KCfKji9ml=9*)MPGa_6R~d<|%laTO_^BzGM?4)z`l!wMngf1bd$Dc#b>y zn)D5~h>eq4r8agA3&T>^5wi5Qbc9S$4}>iqA?)E5ky+fW9UZ(72IOS8<1gH;@(K&j zloXa+bBDra6BOoL3kUoHL_@>&^ECv-8f4FE#sp1A{n>?AMziib z$qd)|3UYAtV1Drc0u&k(6_1!N+06DIJd)YHfVjlPDl1-ccwBwGrPxwmkM*Bj&`JO9 zczs)T=dI|h&|7Ak>vWhY=o3EevYFqaC&{Tq z)3qak!8J0(ysUS8nYK5}M38q_I^SDc7B9UZ{n3JhIN{&iL_m^m`s*5hGQUi*X#Er` z6bg?OrWdP`5fltDi&4H2EUat@&_IR9LpUa5W4Rg%4tUpe(;Ger9WZ1j`qB}QTf#b^ z3yJPJRD~)R&xINrsUgCROu=#5G1XI4iK;2pV}O@}KOO%07*Vf-`?EeR$EwxqVsv_~ zH78B)v;dStjN$1NIP~7JcXh{s)q6EbIU@q&-f?ixy=5Md=FW1>?>pa>4E#k(Gs<^oc+1PZ8N16fN=wp54FANlzWFAaH=&b{ zfQAnN$J&Hh3yED}MWOIH7)ogV@}!cEsZ;SyN(m5WYD~`QDI`rOS`C|IRmP8uznuy3 z6YU4j3nT_Wj2)#Thq^tT0U!@=r>Blx9f|3`@u^wA`q~sTeE7h|h2DfqiUHkf@F7ED zuYDvW)BRyvr)4E^ilw7Jav_Gs7aQ@|s+U+3X3)W3FWt2JrdKY!z4Sq+^g^o5V&0dV z1qHkqhFbheojd#ItY@|lQRzNyUi9L?d3B#|Oz?MU#uKs^g5D++Bss#_E~hJT&JrXc zz?^emMMC_0k@h`{lHJLW=t%Jn&Ha_?_9*|MfFDXLc--MM6MEpA;3i*GXw={t1haxc zP`O~@;Da)-23idkDiZUq^f)0+6fq@S=PW6PuYLV{sqOpMudQ0PYG8bpASTE6ZY)hl zG*aHwjnBOO%*LsCJTs=3HujEB7KN<%fvc8PNnxb6k3uS-^=bnQO7TWH*Hy)gvgG8l z85Q}%i&JB8E8I|<5bHDvy5v-s&E`r=ju8y8&IB#)g!{#$77yo#OK1lAl0AaH(6h4> z(VSQ$yN2aB^90#@%0m!-u!JJq(ht2_FagGX;(L(h1it7V^eiZib?`=sRIu_INiKC4V|*i)2yOAx9uOS);1I@Ox3+wfauYF3K4 zOuA;4)LOn_QC(VE-J%WUtrDkDYIq@X0)YDCI7@<^#YJY=;(>PkSyL*zZ_nWm%{ET# zC5_}x+2RxIQr_V`A6&?+38kflYBDbn563}g9u_;~*cxbq6e@C1CRBO&B}a9MFmZHg z>&!U}3RApc!IDO{B7B9g^xk`|r1yg^5$eF`>Vbc3h|%r%WXnmGaS946*%m{#AHL;7 z=?R!_dYl?{EfP$pnC0-+&-WUwd!@fx$VwEwO6D^=?VyBEslcEkgpa6}lN3z`4yHZX z0PJK?bdvJ0Fj_W+No&{9n%>9*>{puinPiN$s+-au%71qGl-(Z(C}l zy-X=>xb4;D(X;8Ib!?q{o3`-fx)3Rmbs0h!^KMx*b`G$h3KiVGf3^t&K3Le`N(YJq z`T??m-Xc>Hm9neQeEFW!XjHi*jq+ootM5tgo!)c20)egr?CPwRuUfLyNo8iMvLbTl z7wD>#prGjauD7x7YW3UykBu=V=6-d>2Mvl# zTMd@Tw#(HL(Xa4!u(TMqUOM{n)hmcjWIp^F%XAv5s*(Aoy|L%plHZjaTRM->L;jn( z(Yu2hvm0`_bA)sevFNaIg4T5+6&Jg&Yy|O_8v!qQUC|6pyf#nEG;`oi7ov(2?tsOx zW$u{H1LI1Mvb{(D%T}Up@bb~XA}v#AsS~tIo6y!hUe3Hpod>3stXub!RwUgIXogZk z%z6oQ`n9kwl4ZuhA>I2=`@QF9hzRu%%$g3QTQ>nzmM@SQ5=@t%DGc~QxEVaeP4Jqc zE{Alb9FSjsl+J($zLMM^QvCIE_uhN%b>{Eb2iB!!>8wMCW-XNs%-qH6SFXIC z3q3(Y{R#O1|M$bvH>XTjkfI*9XHkN54q(mprAzIAYmU6KiOt`%2|=Delpg<6>)oYM zq5=0I!8m-lQR)EeDAT#pyIcQs9D(S9f?ZOoh&EIM?{pHpqp#BEz&v%nL&nrW6Gbh|z9nE=Zz&d4Rf@@`|1|q{5LbefQW~ z(y@Na-`H2D*4*%?Z7cqGjog2Fym_fl%A@S)Jyb3{)5Cj6+>5ufz_Gs;=VK3ci$ultSBF&OH3*5JvSrRY&ov&|RRcDKAZ z(cw&Ty~QfLtM*D4J5(^?V^3o8Thg=GgEmxl+BF8F4JW{^@$+qnKJ#x0Zx>;LPPL%3 zDdoN=vwA^5&Z75q_c;@~T)1b`pb6d5zaIJc$>lpxad^4*pst56UgwNs`X^hT+WSqu4jr1Y{0Y7^+WF+oE2$aU?qR7TA!Y3_<4M?r;FMCY> z>^ypYr$&JXSqv) zJkOTO`5Ya&wv_O*k&sroHp^$Wtud4XmQ7u&@r=;Yy;MG736DQB|-Wj=&+b6p7iRe>0zW&L)D!&`j4@G&%F8+)rOvC}XxURy=?4n#mJfM>!i*&PxL}F-W zkK9IO;HJ||)yaiLUj5NCL14o|7!omTpTvmD-|p^AUS5hQg_f_|cA5JFKL-naH`m7n zI=RB=4=O-BzC3o)xxBqV0Xqb!Tu66N_d)rAQ6f+M;=QQ_1*y{N7hRv__Fq%6 zbo;TFUW#~VpBOGkZ9AD-z}0_ob4dyNou+y3yBady!b zsk!m-lN*MHO8omWr)7?;DG;?sk|%t|#pff(gj0?OGPsDT8jDC;_neTvuR;&>6WRxhYVu;z}Q4(tjcOss|yB*Dg8?( z$7qdB>%TlPefo(nCH$-!{@qcKb>@6!)v8ydFK_+LNon%-`Kw;x3K}$`)|2TElxOd4 znm1NGzMq5F+ilxb_8P59T@woAsifhZH^I;PSC4-=bhbE?ZX%tNzIxlhm1xPGGD9ey)#?$3zhFH_?bxWu38Tp`)Pc?nRWaOu>(v7H@ zlDf9o9vj%k|G|rRTJ#G<8O$^XX>W<(?povI(@G+4a&HDuP4}|f?kLjO$)v~`g&X*S zz!hZRIEaPq;YHFl4|uw~M=0fi$Bt7-bx&?hoe~UINb3*u)8{@Rbbc6V9X8E&&~9{n*uB*L8l|I+P0y*hf| zNK4U>ZwhW$9hk9v`s9A;<}&=58;4Mm8R~;!)xYHW6)Fhbu&aL56A>mLqh-iT)S*Hi zVh9wVw0xuvlQ9-lBDsDgKH@D7cZu={LF`@K&_guDLmGUhP(n_=q-cY(TUG*b23?^S5*O33rKQWp`|kc5{)N;`2O~X&znq+_Ev|3VnupxP#M8lT)F{tXa(Ls#n=<(4Vni86uEij zxr*|XIyD@2Vjt;y08EWu4f$gMAVxChP$i+o2Wl3vT ze{-rKhD#EJ@$K`FxbsVGu2WcMOEg|m@UuFOGA&o#{-?NP{RjMKe8)2bxiy?IQ7L@~ zEfdOxcE*?_JT62j^u$+(_uY>$)saQ&N+fmRWYqgDRx#?5Qhg_K4@cvaa~1tzS?^#< zW`Xyt7j(Wa8^}hmNx-38$$rhAWADKLBXMvj6bUJf)Gkm>Ad7i46SLo^49e>yI{B2* zb1>K990uf+PH-K6bk+q9Dnu<+IR{;@1H7{%dPl))ptQ$`M*zGUTr;9ez`u}u>kM>G zdt?g*8%I+e)b4ngzX&&rURUgJB1?hOLAO9)H9pXprr|v~f`#QgMR(BzNda6c;P(@r z03L%p=H<{f(h)kKOoh=j`b@ino(y9E)c&-jn&BEcOpjEmQv41l;wO9}o`;I#a@++C zlTUGFbVU%HM*z_j)J`r69t!#tAQWWU3>5J`RR9)gdB0CAhvqY&gwCAycq!YK3^4~= zgvuc}i__2?MdiRTvCB_ZqTYCjI#r4M&?vJKP&BlM1bzo!Ovr*hl!mHR9HfHCSApxH z_%)>}6=iY?K;_1Ud`+soz)RIq6(jc}KB$j;D-mGp)GFlBi{i77)ILjGfMX*QP^lu7 z&l(5Uruqbjqf|dOC42C;y!70*CHgVZ)g10+)+;q3rPx=LC^ij82I1Ce|5%%_=(-gn zxbM_f6&oKe&TDW)Mnrz=9GeeJT~4&Bm2rjyl}4ACISiqiVXrP|R(u;|{6mGadqmF3^XjRN+iBC;*8a(j{I;}cU z@07mRjC2VJi8lAJ)Hr=VmtN#c3XOwZh76tEVRBtO>l&%?SQ8V{lltr9QoY8)prCou z(8rpVof99&zo$0yyxyFi#bTw_FYdbQi@S>F%w;NV(uQP>AWGk<0n_p}Cn%M=l&#W1 zQ?F8^1u*a8faiGcX6C%>K4w4c0nm)O${1f#2u;08%PBRg8040<3Uf<^7?%ksjlYiN zigUAK)MicZBsK!MG5oz&H;Abliwno-ox*RPpL%?X(#a)jVzRVWpmSMAb2e^;|)N>Gz+l?B(pIZGYpz!&J^?7uV3IA#fDWGz5!-lJEpLB;|`NorHQjTszjmC z-ebKXp;DtqKHLSOI69@rx=>|QXD6fq?ta z-5z8G>m>ry0eLfV$5^$`?5;@f6{yy5`LRZHqQn?YqRFDyXcJv_HU9u$kEVOCO|l9r zGPd;AyA6iW43kmImagUdZ_S_Xj!Uu#)}(89BpZ5f$xs?i(<{xDYZnP<%WLNGe%~&u zMWwcF>dSGPjxSq&{P^-^k`Em*VFd=2jvv(TNui+u&2AetQZ#Ze^;sFGR$5FqCvh8{ z`du#s^Pjs_ZwGu6VGOC*xC{(QwLV`|1K0^SVH%s+ssr4bxwJx~&e7|W($FlC%?8uJ z6}p(fyy8F|$MyZ7qGWMd(e^1woB-f1t5c`f)%Qzz-EQBPpX%Uwdt%=(%Pp?*dDze) z=s&SGi-0^1XD9X9Sv)Tgqgz>RGUTK9NQ_N9Lq83GlELp9$zvM%ysz-gU@o*P>@ot8 zBvrYXgP*h~k1U+C^6S?vCHzG9{bO7&w3J&?jaj zO`h0T?TZV?l6?;3_||BI3Sl44qHHcOwkQ$U=jhB-M2LSD|0j}cLI< z(l?ECuyNw1O%tPQd(WNgxDj3x#L3bUEsH+V89N2YUfIe7UX1~7qNg`14158Zng(zOWHZZB`0%GAORjEQ%lLEDZf_T|T3sl8!I;#U` zLC?`F!N%B3r}6U1%@mY$MVS)1%M?`#QxHb|q%`cV#bNea923nMVrzz3v?}Ns3Lcz1d|VaGZ6{zYv(1C0 z+pqM%ZPX1Mi9n&bNM3gq;|L#;TA-r{g+kJ|O$amzg;)r_FfI5sH8n9)NDQ}1jp0aZ zYk2S8a4Y8yvu1fU+MIZv9M{m5?SZ7OAgFjHo=>Bx?N1NlS0B$s*YYK&MZ+^&$qq(y;2J`Akhi`c2ew>|nRVJ|Sf!+aP6 z1uA_3C6dCF3pjd}fa9HiZMXut9k>Xpb%|a}7jksHyp5k|E3{*c{y2Oi_|PAG zh`OFh4RBc&G$TqC@@WrJis+;irPD*bRt2ROlCzhji^!QyY1+f=I%C1(1tSq(+8Eti zlHSo+GH4`rLZ(DJcgdJa%=4rhKoU48cD#7g_!Jcr?WTl_Jqf3{>OxY?6EV_v%-xQT zUBX^UPkbEd+B+0ok7kMsTAXo&M~7hU^b)=q#~N`GGPzUHO7LiUnVon@I@HOJ-Z=_6 zDirXC>;@!6f{D&`N1+2C+EK9_`LL3i+Z(_!_!&XEfd~XsfPsT%7pdMLl?I|2w}EMg zTKqJ4TXlP~Q?0%AR;}8pcRBf(9XpU=*4aMi(;@xluMTYQmB9vauS}aUf6bctGp6Ou zPE1_?*wn17sgJFn!PktbDh-XS0y`;{vcC6PhqjmsMA(v`xE#REiM-7hCt#Y66{;ft@pA0iz} zSjM^~tb=&Orj}C=FhH${=v%+Jm=XiYNEry&a0^Th zBfXyf>(lt}6&c)%y(v8>eTO@|xAJyoIC4Z9vg7-^8t;(adGcQAk0)o`^A)eWqB?S) zQ*`rc;4Q@;&B8y9Oe4?x%k#91=@+#jfR9jyt@?H-ORah#q_>7ARkh39fB@D3W3KC1 zv&<;a&PF<|bGI<`^2w7}d9$oZp~+O} zUY+{il&BYt2mU@3DjYROmt#gF2W44BEOhDDq81nEf`JhYWw1aXHH381y+hdo+Nrn* zGQlg@BZi7}u929YwicQ7X-uy$NOoFff3r_rJJrtqMjMfes@&YFTw(Xb8~1JAcjLtB zCDUgMmLV2l_Vgvy?TV}I6+)DKArj)lxMkb-GKVQIL>(R~uayoQSSqiWaPQozjwvmWi`5;Z$A2@%HvTz`RJQFbywZnQ^%PNos)tAUBF@Ka(SRW84X)B!CJ#z22<*6 zFILV6JQ&l^M}Q6(c)JH(8`__uVljNax%qswO+r-n#_nxVZllNzLw7H&?od=O-96Om zbXsXk=-Lv)$T_oU?p$e+)PA|jkP`P`MC@VW<$aO9N$Vf_Zu92v9$KHI@}zrIS8hh> zCproGM>Y@@;Nkzjs$nMc*boqi&}q(}iu(OxwOTtA8vYwi|HV6pd_H97;{N}6O{&Vv z+WKw$`|0(`$?H%5eIwCdqWzc4PO((~o43=5~p6-pOh*OVS)S?o$2~{+?jdTqg(ywmH0_V zD%`WDkb2Y=@4*P`b`9v^k4Q=o4#_!czsI0fAd?iXC@_o9#e0#hy+pL-V29`mXdqPPkfAXtkqjNQ(vnVrWf-TBTXy%VpThV+J86Ln zRRp#Xoy1s_v=%@m47R+Ohj8Q$<>ge#i&R$ZM_w6-#oGB=d2fN=puxe)0#QAxvb3tt z?34ue^qu+z%BH$Vc+`C9wIREv=|ts@$wfJXgfPG%Cg$}+WMsYTKKgCVO_kpDSCH5n z*DH-ZoYw0H+U>qBy;99p<%HK14i#CrAf-58b<^}83QMISvAK0k%SW;FnwhQBcCpDD z?E`46QTr&Aji3|xKw?*rVpx`w@f!#AEj1H04z&!L1u};mB|_q9*O}dIf%q}x+2Err znV;|_NIW5zU}}w{6RO-*6RHmRLV;Rx#SL)}rWC7&h}cK_-4AbHnrwAW+coDF^$^2# zBO-Nu7op@XQJ@X$hVgiuNT$^GE*c)VO9#;?@nOf$#J9K zcAdcO&UtQNnXqe`S-EqLWJu4H<`178%;gmQ$ILyD!XBEoODLoI%RG#1>xFj%ydpNI*<~C9GFl(tM$4k0N>uX1e^R$82$DfY?lLM-#^|M8<&5`68_?lI zW}+zONRW(_aFD}MYD}OJQ}BB<$_SQq*+!ufh5XaUDxBptqSQY3z=64ovj&epFgGWg zTZWn7!2B`N{S$6Fe9V^`4k@*!YL~GJViIz;0siMG!tc|X;FCr^q9f8_xFK39z z5-I2WGH22Jku|J7vluFZ*S4ooyO$OX$ni<9gm>i!MAz~GJ}qp4=EO~Pa}SvReqe57 zdczL;XeamLz`=%~C#On#NLyEMNr9EkdUd?r>nI3mnhinTd_i3sNUt)y6hfHK+!rb` zXLcy8qjdwaxZ47?>pc0=yE*06Id8mCouwWT$QWb>#q8{RvOJh3vil}EG_c8|{0VqtyR!Zfb$ zil#aV30s_eQu;?G-UNINjDl>lDw0u-0?ouQGHIr^Rfa<9+R@KVF55$ zL9={*3VN0oWRD^8lK`fee&v8#z7vuJ@%hSBp1jjjG5tlyuC>Q18Vqs$7|RH0l1ZNm zcn$F|c17tRF2fKn^08NkuC~t5i_27NCz>~nt>0*?pJm%vf6W%dgjK3*wLwQ-N`Bm& z1EmF$*nf1suS|32`aPO5UtWmc96wD{?#r#>m#GBxbaj!3do&}3wU^WuVW_?y8pI2s zTz{EnS^NRM;*w%=E!$ICnC)O6Cb%YU*N&b)YlL(syKls-rDL@>OpHyH6sk;-CEeXEy{d`^M~UA#LiWpps$zpKvy!{UCw86PWiw7no zP1=|^!8E%nQV=DC`{xYobKtLT=B9rU^MRz0!mkt$p_Ww?B37WOaq4@$`j(`Z(L4|u z7aU$2XykeahldZ(`+yr@AFJ9n>AhtOq}`zrQ8GB^mQ*fv?g2RGft&C8cD51mja~(1 zv7Mp-OGapv@?00KVgP|-Q5U9UB8o&0sS$u?X_TP|8;v#u+1bLLF4)iOV(`qOG z_+Z!c5$&Z+J^^45xIOwhq5%T9hKM7@C1MbZ>b|+VoTKeK8Y0u@9{9WYz}&h`iDnS0 z1p9#HPkMre!2^Q@b)ZdE4>-K`c(s1Bwkij^n>C^KO7(@AnH4X9D%FNwGE}8QZ=0Ak zKsVaD%RDF}FhZSG{l*(P)#W+TyZN4VwE=#$v*Ot4NfV^|$IL$frkh)qoiq2q_`z9= zi4aTeVofm3b?k6OJ{xI^&#BsGGG$s4rH^Pm&BYomHehAXa>Pbf3|N%&CFdmlC=^Bp zZ+30l--!od%UJJtpe*)(UenI&eMUaJ{~-y3b3542idFMO!6?b2KL*5!Ij$J_G7Sr+|rgT<=t zsL<=Q<``~>G#0^__eLIyF>AF3{@EC_HF6;~L6xdO(3hF2gbH=ySZWa2+&dbFKp^3e zwTe+xxh{U56e!Uk5YTuaB}C^z2aFt77)hW|=r)j$!9=k1^^Cgqj;cXLuOmT+^`K4t z++l9Xd(sZG!DMC& zq&w(71cMWseA~_!yk3%~qR#;naQ4Kj;5Z<%w`pUifwy#_ugmdESS=N;VdElD$UO9S3EG< z^u$wyF14y!M7QiyqR!sd&7JEVJjVu68>}5{r%k;7QkgHVkQADXZ z8=k=_bYU2mRIwLu>Hpw%&){~rumKQyKkbyHtNsA`x-_(n6?TPamdyb`avHBdMaWsO zt54Qu4p-qWPhP7B zf;c!c(gu=82Sjrs^=VKnkxz(6PJYhqfFn&1ZtFo|V{lk7IIP3JxOp-Dg$;}AhA&y% z+%e$T(q+f){QQ`(@z}DZ$FR}yvGhOBT=(|cwQpbd41cdAAGJjgY=W z7F48EVCw|7KC4`_@Q`%j@Rl#?a!2Y$yX(H(a#*@>XrZP&i!IpCZu?U!yMarHK0e6N z(~Bq3GZ!yrav56W2OndfA3OH>F)5v`W5%`T+s>~Qbc+^_KlJwUrEeab1kY#e#%sW1 z1)*?#;Vn+n&4y`=>8%LZ6ul2fRa=XEk^i@E2CN;a!ad zLb7BsK+ZYv2%?eA~Kv}WS~~$IVP{89HcxWKO`4m{y;*=fr#%bZI^yvS|Imm zr2~&|+VuD)mZcZ;>Dm6JFV!%e%N3J6Cb{2B()Y<@u$s(tgI-N9 zYAPLnm)GYB<)v}Ukzx7_?)1Z%r`X|56DMriG+|=o?u6{LUY@ub`ylx)dY7v|{EuBO zy=x5J&t4Pf>6Mn9U~?HP@q!^W-hrIw@fL$io(saV-c6`NQhcNa(eFK6<(5t8fviTe2ViJK=*+{_BKX?>ElzO@@yBqSvF zNz*#g`_dQso>?*!OO31{6cAu<(q3FiE&KoQp620ZwB10gn54_f5&eGl37agIM_uR9RZ^068 zmiYOw@^LW?KR)u|lLbf_jS&FekOCpqT;|9%GQOuQbSsl8$8G;idiH?_rDs3iJ|VBZkLUMlL=mwS2y9+vhCwAg2mVXn)s30E_tpJkl$y z*fSu%FhyERIvs|x90U!RMSV_0WD!gih+;(WMJf=%Jaz-H^c2Xf2DK-8TR^l&9k}3@ za?<-kgq;!0Yef+X4#trn3C^E&f>#~#I zcUa#^@*U$?-+p$_eD}hN*#47Q==?rw`4Z20{bwrngkfNxc=j4&JIW*9d1i5sSO+*FW&%vPA*H>)gG#i^0hLJ*21Q<1YGUj9u$uxPlPzLa=~j;p(&6w0j|L+ zS^q(P!zq4BFh?|wXqPN68A-trBv@WZOt~0*LGpUX%neqUQlCHr0C5Y_z0Fa9fobB% z!=ooNa|I*AKjMjt_oWnoH<+YZzIDfBUOJ{)wRz_x?uOZXVw|AwGx)7Q(WgKmaY(sufE+i9hOTeI~Wzvk|}?8NQ&OYpx(+-~s6w>BC6< z76Z3v6RTLE#1*I8Xj~zV5_+VUWov?40ZdQ`)3ig zD>3e{*bD1=6;7)0mX&HCJ~?{D_r2%3!Ka(|&r8Tu_sbqTJ;Au=dIpjraHH>dSNigj zf@NRW#740JEOVmt7Xxn|v4qS1U0*eLL?(_%RXOvtPxs3lS_1FKLO&<;PUBP-y_%mq zLRXfVTr)E;{?$`HU;V(7Y}}%u(md(;^_LVM+&8V0#-aY0&r)I0R}c{s$Y&EKQGjz| zFc4@EU|0#>8?duTKq@c*n$yrK2BItHr(uKi#^;YecUbyrX6-eCa82z@W;^`c@zv7n z_aqq}kbe8=R^qWALW^|ox{6UHZ0e_fW>ZV+E3cF8L%B&lG2y*^3onlV>?GAh z6;vKl>Hz=(uK@)_A<5SwXz?m}ivrRK(C1|69|uod5tMf1oQo@D2Uq6FA=L|rV*7?a z-aPI80(N)FXVSS7Pu=tBU0-LLC%njPkN=|rsYT;lM#ZIvLbFHb)y}A%J8J&k)vpdH zy!gVDF-vb*^H|PQc7c0WeD|i^f8fTJra!*Haxu&~K& zd3Uj4$PD=Lq^=Jk;J18h({2%8Y6Ds~_sB6=z^7_BUrp?G6 zT%8{iUzO1R?6G4n4fFL1>0@-x+sQbsIx~uaN~w| zd9+gKA|&h41|$UX>Y>0*d5PJCqE~_#2Nb#j&t^)>Yal@%pFk=(qQm9f+!=92Mh841 zSWLm`=&O{olfYx_X7odvtfHF`HL0~aU!x5w1^AiMGf)EHb%IKE6_qZg`_Vx>e6@1% z-b2TZAG~?d;_{3bp{P(~mc)XYQ^T8g-?Sw>MX5E$*wZ9?RfRp#Y}9JXt3<8Q#97o; zRVJ53uT)i5T3iY2#hmOBb?B0DEpqtnIf zHLAHY!Z&Z(kYEAn({H@z&V$$Ml#9zlp^B!ay|cz7s?~{%A2(p_%&EmCB|(%};H_S6 zq+DWcS(Rwwj0TmqvdWZX5vwZAu7trW7S0(_H(^5E$k`rMg4vWftv{>hwl~f?w|Czg zCS5_Hn&*`_&6-g?ux?O;G_7CF)(0oQuxsbeKnjQS=W5Yucy7%YzsSdmLWT!Ev3+G(b#j%Fj>TBSu>f^ zpw__F0smj++=867(&hxO&!GQv`Y@|iXYj4uzI)T`@{)$@R_&ZtU{4vVwD&FQYmwg1 z8n^EB%;|Sbsf>#>R#(-GavA!}UQpRrsZ6q(f+PCnmycgQv6sdOggjw+{)1!E-!je1 zukU5hTC;C;s5Cr)iK5A3InI=)RK>7+lB)_bbh=jWP@7HX=rcB5nOA?)_)$A2*7Qo$ zaO*4G0nXta8BFNAV*bedf|`lLQzA#lGi!P#y-z zl9w(wls=@q58ZI?bE1^#wBlgX7XKVt@AV>*=n26tghev}h|K z49Acbsu>qTZYYI_ssb#nyBT=J<#h&UrmM7CxM&D##>LSSBX0?cmY>wwAlHA`)f=OXtB?`4oRisQZ4=|BwuRxG^w2{Z{!MGYh`{_h${bV>?josn9j zE%O13HdTA$f7dKrUr7PbWp}i_aX0z4k>3ABV~{Kz<$04j=?Dpb;8r?+FhzHU z-72GEc6M{Q9QHYionTo|*EUFRa|#+Hd(T-CE%&e%V`MQsn!8EJj~<3v{KOC(JGYlk zTS+PlJll(L@ke=%@=}~dR0Y*tAx}4P1V41{3Y zb3@UnR7HAX#~FtDqpEy}jiG8i15RE?NGR0)(x9MQ3GA`4H;@>?i%F*Q6un*M8VW`$=60JJjrr3({3V6f+6E?_ zXIK%zv(tMgdB_cUh$2^v;LFJ&wo?b(l~JYZ7aDC@IueOP0qa<er^N)+%bc*@!y_d=@)A1hV&Y`*M#|WlEr?!!7C(z4)c>-EE zpq9Zhrvcs%0%=!;NKYN`75gBWmy6Ja!2^<^UM_akntdtFmX5r6)5ft0u{j5?%`6>I z_8Ob^=9_E;Rk*tL1*t8+QZ&X2yojLM7*3UE?-lFP9eL!k$%uQTM~$PkXW<=RUElQT z;DW~SBP!~LDB9cdLiEuuqtzg9Xc{ra;Tr)D(_ z8f{rHH1A@gRZ519o0R9v4Ahw=+5h5r*Q^hr$K^pAYa45O%)_JW!dBpq#2?hMh1s_ zNS)-d1Kf}l;-q2RVAu!lE@1XRlIuK=%E9l9sZEZXH!m)^HfD0b9gq&V#`}VRPuER2}!z+-;9AM#K$N(^$dr~Cf#Vz za2h}+P~E4?x|v+~@r{7BhipAjgAC%wWFrj7Ir%bpVMBI`Q1V6Rmv&2a(w_6W!t!PHqx-(kdM)E)4Q#Px zP-b~U!`iXZL$g`dAA66kU)FZV*tHD}#*n6!@*Q>d?xtGqR)#);Cnba`p7RTDL z4Q1sG+(W%5$K@2jXmcy{0MJ0?lQJ~u#~R3rEIzM7x^I# zQlrkL(`qx)(=)VMZL%)2K%*(RKo1+c7JY+ElPhpPBBke;u550~+o(>)t6n8i#jmf8nW1XBHhB>5lJLC~XT4=89`r<8QxX zqo(%VG->F%p(XKvpA?60yrrwZ%D(kcH2MUE0zD1Ak!E1(kZ^knV785N)rA@bqOc%O zP!I=&sVE@{{0sZsTw|meq5(^x*bM>FMr&&o+{dHyl3e#>)E@J@7ph2zpCI6rl)!;} zbZJoGMHSW{k6`f>o*oHDoqQ^Sg`fw6_kl9+{lVYw+IM01=shnk-1Oy;KP;4Pf8|%w z`){vX_crtW>O5O4g}6tS!BGCqqg|HrN0IE}_;t7Y8@Ic&W3<^nELwHL?hAVtzPM-f z>iO5*)3WYu>3vWS+~OUsT566+u-JE**QM{jl$JF!1d)`aqi?&xr?lc75>`tm9zoE< z{APq=n1Sfb#C?%N6Zo-hk325iZrd06icOGWI__c90jj(4mX42>@#7+Kjgvd>V#B%h z9UpOM3VF^}hM^NAd+v4UC~`(}NOzE4kg^8SU36W<8;LqX;upt~5M_!Mid`J8y?hPsg=j2!n+uy7P56f~wevR;29`yHc6Wcp z7?p{+Jy{-iw$DD)WbUgnRVP?#tmy^Jq>2%{&!hX8T1}V#BPJFihc&5%`_^P?;+n9K zze*Ja{BAR*{=e$p13ZrE>KosCXJ&hocD1XnRa^D8+FcdfvYO>?%e`AxSrw~V#f@Tt zu?;rW*bdEw&|3&4)Iba*Ku9Pdv_L|PA%!HAkP5cO-|x(fY}t^!$@f0r^MC%fcIM8V z+veVL&pr3tQ@lQ(H{B5hU3cf}4x7V@V;L~v)I?6_*wq6t@dtRqF(&Zxdh`_-87jFo zg{9(bQc^a6km*oxBtb82j0+|3Gt$9d#X?J%2b?W%t;(wOlfeAIqtZ25;A4nbqKVe@ z8qq%asL^OLI8WZ5S?G*P@uv8q)`9n^>;UDX_ULuK%KXB_tZ0`vF~1;IzRt6IISK77 z-|gv)Eyz#wx}viZ3-c>|-7zgy^wCu`W4o?X0{{rKZ1(}3OoJ%xgbRfJ&Tt)B>$;bt~Ya)oH02^A> z?zHL{FI=YWUC4L_u%Zs96<+WowQSBTzrv!*aGs7Lwv$2y=zHr!2B#q>)@n^jG<&zc ze%{XG;hsiMezkXY7Y&E#ncsi?kFPxOhr2$1aeo!7dhU;Gm3R31ubRC%u~1x$o<2R= z8k`#4%yc`wIbK)1ExM;C+7=&Q70n)*)D%-t6q_iRE0U+rIPYg$_ijm?=dI57%-;XT z{{DGazWCW)*MH=B>?8TP-^D$-<^HQvZBbL>I~nhcugb8+Us*55zK~{%u8P0)+2_6; zKQ$`angE(21O97%3H)Kw^?{5e3Q?J>K!-R4#1|JrMzTtP{cS}&H-*?hL0I&l<9B)i z6o@xu<10Ov6^e?+7tRS`%uDbl8>L@f`0%!E4`2B4(2c2kKkj|(ycU=)HYFA;TE8$q z!RSrw$;uu&5M2;nyJlvhWBAIBoSaoVU)Z|&#fw(@lk>v)QC#ne4`vi5x*f|iGwWM( z&Hnlem(96g&CKF7mzmpEY}>YC<+g1 z-E18(f+jMBv@km*uT?$Ws`}>>XgO8h2Io!Cra!F>uk%$gXCXL2%;_N?C)hp_*NI3p zLO*9c^P;nL+SwtN{ng&RU&-&_%08v`D05%sR4GB}+=id{&fc$1=bESTv%dZrXyY0B zl{^}LttWv8RCRvzoLD`v1a|b__0`w<=ggRC@<{)xcgob>IE|eDZEy5ZXQ)H;UvvRJ zdjbx$K;{Ty_n9R3hq1t>(ZxW(1Ldb;KSs(Ir|$s|xUMuAwG~zi!?c^=p=Xxp=9N5eEhR^|KX^olF;(A#aC4bl_-Q$^6);{6eB9CdQM8S1*_Np2I_X^o_%P!ZYABl3X2mGHCDR>zQW zM&Suv;SA%DgXBtCBtD({cutV6nQ`n0z7>Datx)gle30qL!MpT$DK7KGg=;Q}xGrCL zhbpgr$I8oHkxSNCrWGK9?4#dNFioHy99v&Fd2%5?fZ)kv93s_6;?u<(n9`0*t40`| zB(GDt>P$EW@i}5Ty~yEd;=6Jidwh96CF)-;PiHsfms7YL@Sh4?@@vou0_@DgLsq&# zhhK2HffFY(<(4WC=bWG-{d9<+MByX3&V*<_x!eGAnboY! zVK$59QoQ{50z>REr`aUTlM(s=hgAsum~KePrdLx~Ny(-!FvJ~G-=7XqIVNI9;pqII z$6`h} zUU)nZq6Cr^WSIYowj~UDC{{Lwnfvzd-?yE;CcnZ0a`CA(tXe+0Mt6$8THSy5Gk<^P z?*8iW0Q+#?e&O={`%X5q*H{4mUmH89JGBO)3O_&wHUI?r!jI1{DLMbgtO5wHLJg~P zGaEJlV5LoKmoBp`3*P!%#3>-bN!W00}QqoFh(U5 z_I3)fCvSpLkO+H)?~@-H`}}!1@Vqe~6-Nv>$hb*}RUVB()kzcIXv>RX!ILKas?#Y8)jb>rWA^~=6v($U zWv7;bzCwQyw=J5D9yuaR>)f;J%XMt|KlfcEXDhZ1Mq5|NV~=fprP4LWRr$)+$KUT=ltlgu{Ty{aMm#cPR0)3*R$@YWTsR5O zIA6&3uq7mxJGM^9vKoEz&eva;clwN0t5JN%h%MXW@_N4KSGXKsT6H43YU$D{@tvxr ze8cFd?$owzGFd;+so|5iQjSx)d+x!UG@i&t8RFUl2M)N;WFt$Gv>s#A2-r`dRf$Bi z>AxOF>X6ofSS6jCQVeH>63_Bk5f4s)J_ddop~SgAl^4$0uxL_c;p{9-qi0y?N@4$dG>VPyZ;IP+7B1L zH0+AXb|$CfMJ`#pILf$q_uUtd_-ge+T1HGIX8whfFFttPFP~?DOJ@u`aOZFC{&3Uc z#a=jNOyaR{(}54sc%S$VvZg_HCpz$Th0GxOa8#?DCEGdhE2#WZ5~D0D1?v+*oGL@y z5~4St@wFK#p0gJL8!tbqFgW?1{-==hxP0QN{{E++Ft;7OwL)25*Re+~}0H_}6{CX*0oRXs#@+*Y&tIGCWw(8|;cD7%( z`BrA!|Gm`Zm6GqX`1)k_`wVMT-pgz#XJ2RMzOIw+u3x!l?^F9u>>b`S`DOn1hN7`w zU@^4~_>H@!av%5N}n6I9m zvS)bjSNp!dZ_o1HYhK1z(VlUf-X{s&m6#W&542T6n!zXlB-zx%Zsmv@<^mME79>ML zJ3cXrLWL~$buQ;TKC1C5o*G0`w)>7%&%^hp`% zPFq|?O75ft_f)HXp&{OU^dVM<;wBa=KYGqq1O1V8N|07y+)a?xn6F!hKB9F>;pTuu zgG6>AWXypxT=3$F|H{5PfuwtsIfqT6p!g_fblgBT7%}xo@&{5J>HaLZjs@h9%YqV%e4vbA=;aBYfUvbgnw@=pZFuUNz%ud1nDwW_*iEIp78 zsneHMX_ zOssGM6bn=xAm$numq;aA5H6YM&=B$gPUVSqYj_0A35IkspBaRNOlh)^@*l)_*+1`L z!t%(vaBx-6*t5)Kf5+~Ue^q9Vmj4#xvhjRVG@E003zJT~Ab(+ZyY0;SBD;<`5~t*q z`YYmL8HL&7%l&ydRY_6&al}`hiH{qPhcZr+qvu&HZRLV_`A)#~k&iZ*wwh>!m-}4xID_ zG^|!*hXR=*3CtZ5mh)o)CdLgc0m4fdEPG&&LCBw^P{FgO_mH~-?9zsr#KP#mvO2hc zvxrHAjG%kK*wcGJjUx&SASDKl6_f~UxKWN0g>ATjcg2IUFv4DDhIegjnoVz(j4U&g z86~scmKM9#o8d5-jErZ*FY~#vuc(+mH7P|el=%H6I9dNlEq>- zCKQOK&1)^5DOO{2RMC>MI;)}kUHOZ5ySHYo%3v(oXq_V50rfescC*N3;p{hNyS_($ z<_6j1L5esaFF)`iMXdS*)BRx;MfGCI`>FhUYz4v5ql z6V~H?*!H|}6V`n|7DZcb6R+jmIa+B5D*-w%hIi}vUr*BND`6?@Q1GX~hzUw=5E#tG_8d-|q?Y7r{^tJ9yvIzVGg7UAc>DpVJI{$37J zKpTy)c84=_2JI+igw)j%EJDmdjF=*-sZBi{Y5Ne1L-ndKJ{HihqBxqi+G{X96iGlL z|G{@8Be)RJB-ucc0UeJ}_x-rqMQFffI}}py(;M-K+BG>`$TJwnFg_$_(V_dU zLeDGQZ8H51d)NtVcac%BMhudDsp>4h$Wvc*%4@ zB_<3{JjklBxfQ`oWI|$avv5WXcfRUy;5Gb@BO}I239C$V8ZsbNLdEKfQiTN%)(V`vnnc%4~>T=X>a7EQFGF(W|S5SHevO_?5Ko{=$M%3jD)D{ zgRAvU=plb*cVtH$vDiI7+ZVNeOUnF!A*G?{ysNXPic)d*;@O3vp^l7r;epdB;?oO~ z;?y*vF{5l^s_1`H6|*O@bgGM2bJ)b59V$;XrevjsF4pc`iDl90@lh#JtZh-o>?o5d zYIeq=HqH|^8`4>|x5T!IS#D%eZE=RGdGV8`EsjD9(N1%LIS@VjeEBG)kpFh0{8^hP zJw;8yiZf29$oLm!1Gf?ltM2PuuqZx{B-E7iYs@JhQQXAA2mQw3r&xPZW+JwBFm*)p zlny~C5zSLD`3o7iGvs22^zN_>I^cC4q*_4q(FB3rQ`|0j?2=CMIf5W2Km3toWM!vi zlzI=WCm25bfy1AalAaOtuDWsT+2dnRS<|d{TCMtOTt1GUUVG81S8Zwhs0QwPHSlL2 zl6yOPQ0GZmbFeV0cu8}`dWEfdIH$JCpPo~+ymb<0&)DTuEJ{tY>h-wVK8~Ayeb=g2 z!F@Wz4|c=GODFXP0G$2^7||CBNkB(Kevkr?=O9%lQ26Ma(f}5Hq)bnvvkt6}G@~@5 zCpaQkML$Sj9Q}2!bu^*H27(Y&q1#d!Y^YE4CPuN}&a=hXR_)?K$rrKtYxmE(`Pw)p zdhD|ca$}N`J%-q6Dd`n)9m^K(T@j;qNrGi#Z}EI4NT$cmQqCJos0+Lpu)rd9YxVMb z{q|J3!hW7)oXb7OYd+RTUGx2>y@&KXZBekLD7MHKhskO1B-JlWTi&yNZ=+|0$Eu$k z%}m^J@+>tyP^pl4lir0r`Z&<3I4dJT5Q855Kx$qdKm#EG;>&`pqBlw}67LtCL#LKr zP^n6%fyx4~<*FiG1V-UfAAC0&yp#+mgZ~~%Q{JqsuAZojX+>h9)otd^YNv~T;V|kw zjnyf4Jm%1wlZ@WA+aFxF>u}bxu>V$;T3G1A0dHd{&m$Qi&%i$XYT9{E^}!V4#yOG@ zxn-#*#kEy@H8v^5;jNVaaasPNc}0*Xu$t$x(A-sHcNlC;aGKT_T^V~)Ry}at+B+@{ zjds-~GH+I3hCelX>Y9z~a!p)de>>iD{Mjp9Ci%J+`P&&nMU~C)1Hcf&Ir}!q*G++s zxLxQS5{1Pd?SfIV21sPH1yE61Ks!KUYfG?yMm_;z`P__1pOuD?$VxJ=s`*pE`x!CslJ5wr>oJ+y}lyT%s!BB_805*;dH&79sLC)5WEie6Y2K2gqSDZl`=kM z0*kfyQf4Jw$@R<^E!^f19mUqN^*m>9sQUf1+|tZH#@W+S=f*-K_N$nf%=FprKVRyI zNz0rU^-RQ=91A7V@|>)4p(%P_cE#O=ljT-lo>=ZH&xX9AZ*opnkX1|7Iq3zH*P5qh zW)$#snXJ%ufpGPsoaB|xGLx<#c9?O}`6n}NPQ^}BrYr$x(!G2%> zr!KVMK$Rp|rN>f;J5Bo(?6!P5qU|vT%3c)Pch0badE&A0SC%xadgP)DLtKPqj?|r8 z?o4ln3%Y;A8_*G&Kvo5>0)u2`c_B+7F1@WH1_DY3yFQvf#;ko&!`5i?`K#NYoc!vw zZuhEF-$IndWj?=Jt~XTX2><-lWSdk0{(V+nEIZ#~zf4?zEI*C=4Br)kB`oTJhvkp! zW~`O_65UI;CT1r-cp*$5nG6r}itnyY&N8{3ZmY-W6;2F3Z*!TeoxgF(pZq>$PRf

|iJ)rNwdGr)EOmirSOj@aI>%6ZNkal&y#akd%Z!h9PH=pX zunSE4#rHx6xEAD*#{#Db`j(nTHb$rq( z`SIDCw`IE4UK1Cdl({%QKiRpYvTI-Ol)2E3n83%6*X4lQTMw!im@x|=F;1LfZo~Bi zz8NanVFA(DOnN3USPvw4gNFtrRu0qgkpyHaDRvGISd351$@kpw`x|c>3KfXn$u&2; z`YH>)`XD!_1eR6A#F*dni;b15*+r!}i>5Wk&f1YAUQr*cES(1_$e9xt2lm;#X>q1N z^~f!^j11l7%FB=Wh5XVRZ?du2qN$s&8EW$xAD=en{wJ`EcLpk)nsQzwbcYS z`Gd1Uxu1V+O&I5g%~#~+ly9P;rmZu+8N?k8GcAjx>r1RXidKDjVTGVLT0Jn;=%&b4 z;Rg2DM0S{X%2U^#WXLMY%5+<^EuvA1%GkN&g*j1>MX_d^W76@)P`%T0883Go2a({ALKF?KFD>=KXUSYGYYJ3Q7Tk1Ni}n_TnL=PkP}eZH%SJ7V22 zNmh?T@7kRtc?vyJuFI61o{T@EJ6rOw6X){5n9c#d;0Ek*S7H2tlnGpED3z&Cv;vSa zF%Afdu{fd=#`T$~KS;8SP>%}g=rPh(qP!r9DH^uY8h5@~kzlghqids+!c%8YwPtRg zpBPMh53UQm?!}(WIA2w`YGpXMVoJCwB|bBDQB<7UXm}4v=IzL^PMtF~nB=H+N83#a z)$d57Y|nX>TZ*nWBxEG|@?BYpj>LtRrdlofq=r;Wd8SR0(sQyC60&pBCCQOlX-REJ z(p#*)-3yQ~%bk~!kQr~dvUqFdWm_=^&YauN$6lVGU&EvSYZy4!f`Oz{;h+$3V9B;B zaIj;o02H~N=!ESD}J8h-5^cocoYSL{%o5NvbyP58+$p9d*FRvk~X$=Ub z2Ipk}2>f&XbGS231p}FPi6cOn+?AjyX?&<~CXM`ez-!(c^n%-K7h6Hs)HHe)q>mS?`Y}S4F6yJZNv{ z{?h5q!P@gT)#`PHs~cwK7U`ouDNLH`&)28CXumgfp)=WFNSN)*w59lQ;%<@eNHWB( z;4HB)EeiZSeHrV6mm!lQtzc&11LE9u=UrX1aMP?*^-M*vpV|PLc`fWelWZH9{J`%M zerZ`{23RdQ^CPZ4aQlQG&?DU6o%IWH$X3#vA(W62?Na2jp^HF=uF6HqmHu?hmG#yG z`BM*eOqoC5?w{kg&zn`-ad1+}gKuTIj(s9YpMF3I3a1?EsGAAop5<3l9GX)2z?+#d zNRfO{{>!0F?;Kpc`rtd84l&!onPdH9{rnpK!?DR@lcgVy>BxTpA1z3+&zo7_acD}> zgKuYgKKfj*|Ma*k`|StwY7TWyn=#*>3&|$?{F!x~hbaXr|C3(-$p^0Nw;n8-a=5c< z{yck1;SuJ5q2+fsZ+e$3HamFo7?&?%+qlfOefbl1lTgOs9qiBK}bP zSV!N%Eo;293od`*1>x8KkdwXXWuZBXda7=zaJ%IXKYCJFdh$1!Mt*y1V_f6{$v@*z z-^sD2{Vr+7ijV`Y20{@JRSICq&Z6Yl^wHK%S;Vm{VXvZ4>(mBX$~nkA!t_dmJi_9%^0c(_i*qJt=OiWP z+?zc)Cnq^6=Q}yLPaeN9>tgwx`_Fsx>V+|#7jI6UQl9K9!>`YmT%K5B8@Tw&8Bxhi z;p54R9^BjCYLgqPTdJqFP30rAztuAL>ayZh?V%MJ5PlVBFJa!g$(8b_tHeopS^;G! zq^Nvl&&D<3;D%|wtQE757RN>x)b!L&^0>U*EtunDoy)$wG(BO`vPBh=)dq0!I}c{Z zr5BW~6n|e?R8(2?)#AbAyu9SWkZxNYBoUo{l-2Ltox2TJG9myfNxy{BQ);oi>mE`510-d+FPV88sw+UkSx zY%s4{&0kks-^g4k>kNfQ2g^GvF1zW%#X%hGK+&Mk@9w`utges@Qk28R^sz9avHSDn zlE#U9_&CUpkd#0$3$77pXRdG+A+HS>aAHI;VM6I}830cLF{KlU3}L@sKJW|c1&ytj zU*5WAa%a!}Bgc*%x$P%xMQ?8({;}wDNC>_uHRX~yE3SI}s!5SHlCOAu6Q%288_%T< z&>TfyjLy=t@Bnotz!;F60oD&mrd&BL(<{=?pc4Rg1Y{n)uH-wn&Xhk~a_cKcrp_6C zWOUBdr>}2qwLce}yWFzd9q)&}>f^=s;G|;tJJRyFf%;XWqpRu%;_CAqJSUoyvllx1 zUH}AA53Fm5s9PM$y8v{hG1t?dc1>}O1U%O@ z`h1N(y~$h=A4o6sT(IawV+E^xz*Cty$FjQi(2bJMnqZGHvYerTc|{fdQL{pBABPLm z`V_+@>((5s?YLt_#m^EG@^ayI-(yx(4*81yDu%FC@$8S$Z%8YhNJ zp`~;R4$V~dPG`0O5dH>X04mvw4)m}Lj1BP$Kwj7dAV=`I{a_A|5QCH~2C4)D)EmBn z%7evN71PkL^|n5#skpJSF|bBy8&r!3Er2im7X|g ziAS7ZSqK+sje&V{XU$zuyigcCSx8FM!s`x`p)9I0v}Q}AI3qPPGp#{t+_ENA8C7O5 zjotZ!DaJTU5QW~gK%lp&GlZSPC@W}*Gfw$|adKLL$5Z5+O6vvj-PCU_fxmO?zyV75 z8XTSrd1O{!wPc}r1WXntL63%)Wq{-1io(Zc7E&ro4K!}h1ZXDk*sy~@e<2g~7_2r) z&t@3~bKV^nidnhyXJs;$Icr|NU)p>}78;vrOt7qdLz;_UBRLp!(2j`r}o`(yqxwEOv*>ejs@{S*0p2Pb~@x^Hu zH48pp!0Qd9rig1UN>=(tG|jw4tV&5sOQ{l{&o>HVe&NWX@>##-waMw}$+i6U!zBT$ z;p9594|3nhbxNlnDfbVuW+^$nBsR7rJvrmvM-~#e;M_O{Jh?vtuZ+tb#p{w`2gr}T zXh63STn#UnT$x!C^9ork6B>4Sb`wJ$FeC|?tPIxED7q{QNAi%vD0A>E16flmB8hfr zD)>WLegPte{;ct9Sthtuo*0*+=pExF8yjV$%Sxs;Xd{cvY}QL@?|@MdZGj5yrymyo z4MgM=JJ>Q;H1Q7DE||B(Fg6u#apjN2cE@k|*avLHC9e=}a3AMa0Ho1%B?H(n@7TO|ErL3%|m{Y~T!xA+4+ zd+Sec%BAoA?QOR6O*Z|fW5?fOFvE6B<7e}k!z2V7^!(6^>}U6#c<2wee$F>M%O1bw zGKiT=^{mMt6|@=I>tls>ga$z-7bssm@rlIo6pf7EF({ zRm^N|<~R0ScU@2Sb=S%BkJ_V;QFaO0p(3RSeUEBa?L0yGMiV67R^ZeRI|1d44$B%a zmPiy9Ed-#WCc*z)pbEB)=qu0q7VWFFq!Yh9=3JS2QB*&zxNv5X&uN%nJ9e~oKC}iF zgd{^CrXVTDpOaJ&6W|ZIZ0l$ijbG2|1)J*>^ng!P(|ZxKSvVh`+Ko?^A4{7ubH$vT zx{i*z;#KSC2E`PM*MxswO9~S)?G-o8>UCnTP+^1?NR=2@%})+=u1CQyPX$d<1Kq+A z%vs`_k3#@g0Dx=aWuOH7=&5nj+~KJI;aOdBkq8SjGNqmgjW4?p6wyWJG*;+~6Y_I& zbMq65^%add(X*g29bUBK`#W}gUrd`QN+07Gd(jaSu_U1x;E<0H zEa(9dY{_VMYlWETaGOkSN1|BK+C932Po=_l$iJ;7aH9*0Mwu}Vx-iR`*m(q*>n6aY z3Z+oO14HrD=-2vh2YOHi5-^!cm8Gr>YIa=PT`1%{fNk6!M@R#{fA#FbPKml)6~P20 z1`0*f8q`8xKe-Wgv%<12JnQQnyXU{?Qb5p`3iPpcN(X5cJ;>$v=-S#Z(JNZ_zB#(& zYdy@KRJwO;-RX|}^mOn3?R4D907142$qzqz zTB}j9g!`i#Uv|z~v}l&|IamZg&|n@y+5C0C-@AF;Dly%K3Yn4d|@i} zw0S@>)vg&21d}bg6rRfie$4_Ve@V5ydj;9v-77!*8A=y>_n#4K++X|ocGk1~^SiVL z>vbec`N;R6hI!SMe`d3l>?fwb{MAjWtflFCm> zqdjdEvu9U88A1W&6Gxw%8{gnN#=VHsa?*bB4?V>_AimbaQ4Kn53gAksICqyTN5su zJD1&}$mz((kWj;@r>z00&nlWd6UqA4QPPQ1{onQD=~bGSDuBTM6;91O2d7F3(W2s9 zLYn8|T-Uz|(uGlC$j(HT1b)7sgrKj;IXEZj>WT+fM&LD1J_OR4Ls*l*q z(0*St?x?Cn66Xlq2=RBXfAIcmuf0F3!jl#b&CDrGE$O=Fk~`|^*v=7bS7u(Zditi- zwW-ZL2jmZbwQJY=ENTCiKfZAN(wlb|t*M++%RhlqRfYV#{G9wl`NvUtlN<7qoXx9x zBKzeX35|WLYW%Zc^=lYDzVEu5<-IgK1gx>U`KST(A29 z7zKa>5}U&3kmea3T`C7PP8?q(!vL&C%aPcrM^Mg1kzT=ZU_koGHY{==3Tvr$@}meu z(76{7H1?;&I71DJEHUJbY5U7kF&c?($w^%6EDR3)04!Cc>mjVaVxT%7K77Y zh?pqBk>{-y%(hC8Bnm!1{Hf0!vV!feb#LkwVyxaMx5<@y*LL}%dvho98^~G} zG!Mgm12%DxTp%-y23ElgP>F!e<8u@r#M`blW%*7XNs4jC{))30i@_o{144R^Rr8*2 z&`0p*=TzY~ufG2^DI z;q(2Q)BlV7uRm}~M}+kHr>C!dWnn&ErK*Cu zE0x>r%5_Y=!9E*3GS~n^U_5eSLiybZxnwPulF6?oQ?HO%i>G#=8S&=)RljeYeqj9x z@a&1IUpOl(sV3iSmhVvVt^C?Gs8pfKH-G)@yI)IBZS@Byro?W5#*eMGzbgOS`0-~wIj{%qH??L=S2NXR ztHxf1SHsRpw0yA>v zFz!3P#c0_0114N`D=T_$``GdAPi)`*1iPhsjS;ks*I=%!9eIAkj-xhnU5(igD{-f> zshbOzynpf4|Gb7RU)uk6%gU84Z}%;`lj%N}&tEE7O~uhZ@RAp>z+(@yf;-KIp8I}x z!DI5P^955(tf|OqvWk_zW+iuA#iVDpn#>zsli$mvI=7$FZGCgP-e?YHo6X_93;UmF zwmN>eWA&Yr&E}k-$*7<8?giVAU#2(g{Ie=s13AS}aA?3%B=_Db)9(y}j{!}bz<8*~ zJ?g%B6!NI+Chq$f<~O#PjBK3i&fUL_9~G&2j~%7mH(fB+3jam%K`7{~!1cNu7L~(+ zy=h;dw&bj>vBtMm9KnNrBUkX)?+a+$*pYEY0AHsXIp-+-6y9(hF$h$CqJVmdLqK&a zaz)CwldWB7-owEOwgIH1fMZBlS);Sa6aa|k1qDt}&g~oVTYJssk3Tk>_X4fr9*@9T z&wOZNx4r$Zl4;pQ*Tg=hzCoX2Y{;`c@qPYdySUmWO6x80W2*PAyVU04t~7VT^GVy+ zhnU@kPx*$lr}N4$i@LL5fcjI#@d_-FBkZq{^@S`jHYmR$t@{QVp0)EJjtpP>CVHKC zwK@aG`T{8vN%%r}=W%B$ z(_Hb|gBcG?AUFkN5Y~VkE(GrtKO*q7;wN+fJOUo29}*gAigXo;osss59xv!U`MCtT z0Y-7tL3UXoH<G9z{;ZqrR6sUVoNd1cHI&I+7p&q;$?!N3uAwtrmOGDX%no4MwBE zYcw26x2D_tR;zm3LQw{z$I14jT^sfninHcc`?<&9(%S_|Fgz!CeQEma<*PGWbp4^j|Y{)20DOhSxob0p(vRs8Wo6THMV&gai%S?{*q({Z?zGt@82bgi}jd`<0OI%h}?mLwImJ5vIN5RxqA_FrH zs@2572~8G=#8x69z5(NV=>~rmtP)1KN?i~;E|k*J)1YM>DD}XM1K28x)-O3(Ze>l-?J=9$=Cy(7F3C?I= zOiomcQC#KDxT_pC^QMT7w4}n6kv>CmQNZ``#3MQW;Ul8Q=rkAw7UD+1DS2AAFt5=8 zA(0!o*B50lJByg6e69S~^~sLO zw|{F_PIhXxNfa*p$t_zOL`Qkrd0#$!O=hMi9nQo;ugPP(9?98#=>=I?S8aao(^>ZT zhF`y0oHk=sMkaa7nFW=1eN=iTkVoP4?m&{jrHbrYIKMKwrruJ`EsJt?C59YnzC*C! zQE}jx$A82GV{%*XJUltl`DgiwiySp_^I88y9q~t86c=iP4J! zOUleNTViVGPR`iymr8w3ZGBv<)8vY4j&06#i|cM)Q)97u{jKbLX4*CPHTjQ2sg`&c zEnW%xe1QwPR>j9#8~m4DwLLeN$2j6+6B4ZEl*vZl{wrR(WvDeV%`t1Tf8LPXfbq*b zW!1kU{S_xw#h^f!DHf-&ED-(&wMYUV2B-?j z6~eSPWM;Y7&#Oer#)Pmg3sa{oS+olnaA``?^re-%BGFb@dQ7QI$e5a!8S92~PqrcW z%%9*w@2k%r?vR+n>=#QrVX2g@V=IT<{4WbG{r+p;zjT3mV*@q6gZa~+$nVMWBaO)= z(wr-w`rxy_AAe~0qngDl_DX%?Ehd@uOH~qD* zwHg;Z@OSyv7j9++e|`O1ksR-mTZaNy$`}2WEw7hQ^6Gt0{p{86?_I%@+xEVSsR4Ns z&@>7TC3|*7(9tHD?tbWIUj@DF`(gVBa;IdW66dL8xw72&(=`%gnh zzCs1%*%DQD!bmw$!sq|PoyLagim<*d!1{JI(VBo(P%#kG@j!@A$c(}>yt)?AcAAc2 z@J=zY5+y+c4O{4OQ9sO*D%dbC07Zs_2{OW>#H3(>#ID;VMJbP904q|7Nu-?yyrbMn~K9OnSo4Fk@c z)L8C(P5yJcZF;~~_JlV8LqFap?nsI^<-%FC;u!KJ(Ug!T#wSog@j;JP4s(1%Im~fR zISKJ%T7pTGUs8NphLdtl@$8n=Zd<7rjaq-iUuw=|`8UZgd>Wmb;xa~$zD2TtZ;eJ9 zT`9TIpR$UZaXdqZN7Igq5s^!a3Kj~lCj;(!JkeM~M1#cqv_}Ts%8;Hh zH12(EWcaYY~)7fzL!mxZ`r)XYE+ zt0PLtbgAx?I7Pm7M1JY^N97k^h`WTX8fIm;KgP;mi1REbqDk8un00no0QaC}BysLa zx3F|qR+-lT;-vs4*|IY6gBc`0&i*HwK019KPci|*!?%>)e^1Fn^I|@ak*BfZi{;nY zyPtP_#j9P|C%d zIzDS(x!~yqYn5Ecf2Jh9=^Lm*>{(AS!%FC^F4wi_dSGSZB6y*CRQIgzW!*cvk942n z8zGA2hoCFA71%OBmJ$;}uWT`($E@x(gc!ZDg-~`0;6^B1i7*L+hrI!1y{AYTqa2d@@6zTCo1Q!H`o@u428IC!p?{x+;^E?Y0l5?UBS4;X7dxD;~Fnwu*TU^wrhboN7w;8N~lBoLGfs-|Qr^6m6 z2+l;l%xXx>v088$i^-UZMLaqhS4nhP%WM4Bgv6RlriFS|_PQ@RG{wp~{yIG%EZUUo zugVZZ>+5|x4?i${#-&@97wLlyF}@Rnc9YvxVpFd7iqUC_a7yKjN)&H{44Es<7~^)Q zj`cVli3wAjPDi+ket?a>MUOv_72z=D&!M?0i14E< znc=Akr;1+YFkp|BV2duyO}yg#tJ$WZ$8Pq0S2##myV-&$Vlc3FA#2Kmc5Q-#L0 z5dz+Ga;S1VUEFbVF#@!6v5 zh!ce$wCeIJWPazJe&>?M~T7=80Km%%z<$p*1`g0SAVL7MV*HckBHJs zx(s}m8rCDeNedfv-)7sjuu&Jww`gIL&drZ#VT&%8Kcj{1y2*k7-b6p-jkmzhX%}o^ zbi&7&51O0JIJbx(G##NnXf$m>H~1emZ8;TqtN9^B958d9Djx*_BnRC2c=rLL}j zV9Q`vN9VAwzIkKBH@&&9ZHq5ZToNwy)%5iElvhK(!N^c#aATwm85+=@KD43+_=!sE z2Spn}bbsG)&8Emue=i;uBBlfKE3@Y{^Evd%Nyq}q^SR(#-++v4WW;ybv|7X-&TfSF~Z~hqFWjn z9O~-t^92jb3X7GG{Lcz+#D_%iDb#h;r4bw)Q78J)4gJcsQ+e}ELq&O7k#4+U?Z~0# zRP)d?btjcIh&tMkzE|nCZp1Ysmg2jxAdDb1UP>Qw(Nil@5796-_C%V8A{eLk$e?ey z-#6SD@tqmkp-Ag6eRz96UgAwV2Fo`**xVNBZ656QH4hIDcD0NsN&5PSyILbd+CUGY z76PVohI(+=cY3V92^Mu{U`eNd>@YyM5+r&NdQSb`=CjHyRK85tIXpZ7y&h^_vkFUv zUH$(}2}KwwwO9I-(JDgbZz{8>2Orrt6v2Ci#-ZE4`p2Kc8wN^9z$xJ#-EN#QU9GzY zwu1KRu406);cgXD1+m@36aLx@U1YH&13UfBU`{0vPIbGEn!R9GPWFkVOFwLY&BcM z*0Lt-|C(6~@Y!cN8*624EW+AZ2kT^AY(47+^Q{;9l>KagZGa7wAvO$?up8MXcq8A! zwzBiEF}?ueliS!RyNF%PwzEs%c5o-#1xb?2pt`z;UCypxSF)?v)$AI!mtD*DvHk1- z`xcC{UC(Y{H^N8IL0ITM%#N^|*|*s(>{fOgyPe$uPgi%byV*VLUUnb*4!fUymp#B9 zWDl{2+4tBZ>{0d@+^s&ro@C!=PqC-j57<#y<9wDq$9~9u#GYp_uou~n*-Pvv@Id`C zdxgCUBf39hud|=CH`tr(E%r8hhy8-R%id$ZWWQqXvtP4g>;rb3eaJpyzkxN?-@$Xy z$LtU6kL*wE6ZR?ljD61j%)VfMVSix4=7)jl*ytck(D6&0XBhW4MQVc`T3P@jQVi@+1y^3#>Y)@-&{#GdL_q z@GPFqb9gS#c`5L~KH}Q46nYZv( z-o_)m9ZCR% zG2hNF;XC+FzKdVVFXOxU9)3B$f?vt6;#WgcbuYh`@8kRV0sbw19lsuQ|Bd`6evlvH zhxrkHGygWfh2P3=F#jHZgg?q3=tm{3-r4{{cVBpW)B)=lBo#kNETa1^y!cF@K5wg#VPk%wOTJ^4Iv!`0M=V{0;sl ze~Z7(-{HUD@ACKfFZr+d`~27Z82^AD=O6Nq_;2`c`S1Ae`N#YZ{Ez%k{1g5u|BQdm z|IEMOf8l@Sf8&4W|KR`RU-GZ`34W48H>a)ewVPskSv z1n}a7VxdF`2&F<07AV6)nNTiN2$jMlVX`nqs1l|M)k2L>E7S?~!Ze{lm@do^W(u=} z*}@!Qt}suSFEk1ZgoVN)VX?48SSlMn~gl3^dXcgLoh|n%{ z2%SQguwLjEdW2q~Pv{p0gbl)=FeD5MBf>^uldxIXB5W1T6V4YdfD*|zVN|$CxLDXO zTq5icb_%a^VW$O5rNuYT+7TuW+rfPuMRU5WXc`CtNSwAlxY2BpehD z35SIv!p*|Bg2=@!$6&}#-lRA2uhlZryk)f_u z{ZOQNu(i_|>Dw6T=^uzlop>G=hlZO6&2(vs^bQPf5l29^i0xfHy~g3rCQu+95kA~$ zpm5jFFz@fy4@P?XH%1Iw`}=#Fy84XDy?8^<5?BLfsCb@jFMZ?+8dG;e8Y?HX+DiJ;Db zNb|4(OEsvfP9rr%DX^!%wOefOY3?xNW7-Bf`}-n8=8gS5BfXI(w8x?asREN09vRSY z7;Notix^ta9k>g_%^f0sLt;yRf47k?w8BdRgI#^Y`qt*&$Y8Tb%PZdZwCTHso3RjD zh9jGYn>r&z1)7!crmnW(PBY$h^fmQF+J~)b5KHE8WYD5MD3qa14X+;=8t!V}BGR{5 zy87CXPR*xW!>{q|sHvXV|f@z>l%BMx zL8TQ&H9Rt4Rs#w|C|yKwgysx&ZH+XwkM#6dweV1Hb5D;mvbnXVxwrXrv&4?B_F)l( zV>{-^V8j^N0zkuPm?+TN(?1lkqQCmO`Z|=hOX$zOh_SV~C(_r}Jg6VUR-wPw(AwYI zi}BX?Hh1(zhRx&sH8OCzAE|u+_u);E$gmBcJ}^Ku?5h8&g&CfB0W8p zR_fMvbnI}%+=*dqQlVQ3(tI~4p^*WTa;FZ7Qh~GS3`9ns6{8g3I4f#o;OtCP3~+dV zOGLkE5Ocm$8g3ry9?}D&qR&h%gI$sKR%~L-1i9)wkvazZM+Sga`nn|mS5 z$Z!*VDdq_UF-g?`b*n`UDt(1{1I*qxBo6ft0@QF(vKf>RCeQfFMj(PULWMOE?d}J_ zbO8R_uq3tgV~i~tI8#dNIB3%Y;rL;|>o9hC14cmlAjZBK7!f$n4BXxcq&d>lVgz2m zICn(sN*625pry;IKB|yvpry2_x6OjQ!=3#@==_LrXrybHM$AY+MK$VMu~0=KSYi5s zm1(6^mJ|AfmXWR=%$5!#G7r$YV`}b2?ah6y5q)o@t-EX3(oRi6E$bs_dIal0r_%3Y zdvSXts;z$n1J#6f;!2$veO8PLe`iGj{?2-)Q8Ay%Z&8CvMxz=gjH;ARNeyk0p>8Z2 z`kv+ix+#D%Z0+rDq3=>=qg8`<1>VdXM*4@ z*#IiVra)PRWx~p085+Ti#PsbN09cQ-s39aPFSQPgY~4zI*A;1vU;(89iOR8`2@;{B zAL{Ii^t9Q>7aFxSQM5!g0lfl-M!JSN(W8Svb`e^5Hn+9`L20YDf&ml&IV(m5kh7u) zK~2o0AgIpa-ky-yIy6+O2W$dmnpLby9jRc^A*_xrzrj<OOZWXSXNDEchhc(j6pqt1Gw_b9G3NSBax3s%#S zmWaBvX%FIN46}(YO7!V8)R~4hzzv9MpmY#`n|t-`plQ1Yh32+CvAv|M z#NN_1+ycZ7Y^)9gFk#Q2Wmvf>QI4K|RCI=zvQ2m%8JPH%;L17Stvbawfz0jSG-SXu z9qjLFlQ1zxHlvwcEwr`_b#EEKqSik$IJ98|ivq|2fJ(o<9cZ~HBGQEx@ZqijVQ7Sg zHXJt4=B8_7L}(f5;2XQ8O_8paerz22@P`Ct0lV_;m<}rDrnq2?`T^r>aF0rY)2pz( ztsnG&vi;CHzpUK45u`Y%Ql(8uRbFgUS2iW0sh^?(bSb3^ja7MwE@8Tq(WRU&6^4<% zu7;ADV)S)$31TWJQ$;B~Ql<*ZR6&_4C{qPxs;Cf~g2hUX778Ipuo%?@i-T%uwJ0c9 zj7-5|WC|7|Q?Qsal@!y3-j-0N63SG9YJw%GCRjo_N+?GOI4p?)>g>sZ?&8yc6tS?auu2)h})>5rX_)S#0r9Q0P zsqi3`5u{p!RBMoG4Jt1vYf#HNjVcaN#UUy-M43XADMXnfL=X`ohzJoxgo-PqjS=8d1PLTUR91*UB19k&B9I6XNQ4L^ zLIe__5~?IXl>{gU0Yiv@Aw<9sB47v+FoXygLIeyU0)`L)Lx_MOM8FUtU#BTP9k=(tdha0PlBIdGvI7<7av2Mv0N z20es9$AxmxpoeJCLp10i8uSnidWZ%+M1vlpK@ZWOhiK44H0U83^biethz31GgC3$m z4`I-8p&Wz>LWBuIzy$4qvWPN20_EzA3Q$d98u~B|eOSW>fpT>^1*pC-0YI1lAWSGB zOt2KD@ekAZhiUx7H2z^4|1gbzn8rU$;~%E+57YREY5c=9{$U#bFpYnh#y?EsAExmS z)A)x2>a+~hXf3Q!=X{_hptiiGRJ*GaE>NR2wML!!ftoVyeYtiYFRw;>uGQ{!+Pz-8 zPgC!;TD`Sey|r4swOYNkTD`Sey|r4swOYNkTD`Sey|r4swOYNkTD`Sey|r4s8qy5Z zY4z4=_10?v$(?k d0mRO}xo^G_%I z2O^L=ATW7lM&^H<^*^2eAN0eSJq3(x4DA1L)&F4euaO6sK5joV1E+r+DAqq4sQ>Wu z0|aVj?P25hA?l{GgpFa`oP%>HM?@(=7t5y$lA|Hyyb+&}%lcF7Py zVOq>>oZbI%cmJ;c1Ox&!PmnY&6cmq2?4Nt?RBbj#@*S#u% z($dm;AKJG3Yv)w@yrS19dscW!&dp@T$utcaiktwRu?l%Fgn7##v*Q%&IaI$|O!P}5 zE!tXI-Ss#N&%~+2xwep6)=D=@bER^nrNZX=A{Jq3H3E=sm}xcLG|pUA-88}8wRPyv zPnoSTxscjcm{McuVx_s+*=h#*Xv3UB1T}&E{uxPi!CD1QZy{>6F_-GvT;_v+@h3%S z3~p6JKLUMaO+O0%W$iTHs4{|UN^?L;ts#@G+64bnV>gujTO1A$SfkJKhUN{&{#iBu zbrz-NBAI4CWjjIN*&fwVu4RubbB`IvgcJ!WV;{$}bpWy2K1lw(2Xe|eWcN9U#V^J= z0v&sgD$Y5Kh^J4utKJ8w`)YkScnEwZDG=2~oYvdtqau)|6HAhwqW$r>MKydMdi-xf z|IPEi=Mls`ySoS4Uu8Lk>GP(?uENKw#l^+NO;vrl>caNS*3!n4J~PMG6%1?`Lo`8D zP!I`IikK!Gm+D~0Tx5dT2;-4lEPJvvNz@Roxn4bK2&F(-3ukKoTzvdLw9r!ZsOd)GFakMtPqh`I$P>j#E63N~^t! z8t)N`OP-Ey8cNVPKsgcS6B*&w9LA&4rPERq64J$9K^)cnN)EQxZgj#nJKXDP(AwtHNPvj4d!y|3WE|h>aXutjp#eR1Va1(D~!1cD@#G$XK@| z8ScdxW>*_WC0A}fCWQ_Gk+039h^tbyU`-AaRQXE3C@|xuc#bIvB-u`7jVA9qExYjR z=L}OyA;5`@PuJUM+d|rr+H3CQORerU?U9!{Bot;XUqe}i%R=!=DIcZf5IBHt${UX7 z$u&nXerDE=@3Wd|0@Hz$q*rpVDJ+Wsi!-OJ!$UKaeXQAz3oz@z3unQS7l<)x)linz zAH493JdOfC{BNrjX7CVfZBLDtgiqO>03bm9Y%opN;dZI*d!CgC7s1So zx$n!T6vhxG4g7BozT_i+(EXciSh1 z*WKx5dLayUw$Hadz3+<5D}%BZCKe`cE4yNK&2O zC_2B@YGbYTJ=@>6O14_I7;gA)sBiMPW}zMqr`$mljy|@#K)X4 zywlOE7bt(D_<9aY(j=81rYh}wpQBZ2>BFX$_0y{XD7Q1jV-(PFSPU`4DYgBSjuXGW zB&TypZ4-Ia;ZDv{*YiZ4BK%bLvA^d#3^`kw)^(lO=^V#PS}I{JY8vD2<6?gDUgByH zoos%w5n5SA70~&_wmZ}=sE_CH+$5D%I~M^tEkJ<ZQI7BsvH)rso$j0Tno$9{71< z@V}SCAhApjLIvlX0Pxk%zZqkf%M1LSF2n#NI}?5xPC=! zobSQlu20xcw~DY&-wOel-n@?qJ&by)A02bP=f7VUb$6h9A&zxij{$poi1x&>usk&q z)o~Zd^jeapPeoI1Jmh>Rc-6+ws~2@GiSZz{hBgw^soz#me0J4++L57M=6^+@00R~q za2yth-1NjYw%qz!q2gOQL3>x?qI6L_n5iR9jUE#0ppndAXQSaxXgAAg+?Y2ZVSq`= z9KUjbab4|QH-zBoMtL>BP)ja&OJ4O?2yYF#*>9aH4X@u0(otsJ5@}kXX@!4~Fy4Wh zDN>w`7i{CSlIi9?H2YDBB_h~K`_cJqA-9`a@G}pVc;w6b)PGdJz9MqO5mS;`wb~72i`W#}dhh!aglheCet+(79kLz+P{)7XRuyhb{YxtDFZ#1N?6e^# zh*vvtce7F3I~yiY){1)rPtn#OV%8zxe}b9$IU5=66PVl01yCBSd^dXUKhK1G0R|IV zcvk_Ac>q2IN6uR13{;c-_cRbEqYJTB_{Fr4IijaDP_s&jXx0$`sG}^H^o5 zz-Q`#Xift$p?Wb<=fxuzXVyNKg#>QnXBe)ocjuyk{hgW=c?V zRs~?RkX9n-Kuh2ogdASyGctZ-79U~PP*d!u<<~CRR3B7LYtxF8T{?!Nye0d%0n1-I zI4RC68nKpBKg^rfqiJ-i4HXbQx4>=dyxjLao>lA4TIu938pOX`7jX~@WPeN@jr_P# z^lTrnNnS5FJgePCzFZ$yZEE2?4_z#R){UKOsw3qqM;Tb8H@A2_3MP!1!fsit%Vn(B za_2OfhiiPV49y_-YDhUHAURUHq=tlP%rx5l^&mD@G^8z-Y=Z-tIt3L`u!>WVQxz;^ z&9LZUjm7~;VIecrymMSz9sAiMQWB|u=tF>$?NZ<_+~80;Rt&KJZ1cdqEdhb%EWus! zdJaxE0R*U{g1~6{#~l&e3R1mY+6nb{2=-5{7mcd@paR4GV(zxv{CelE`s$Ei#`XXd z)c6s?t)+nM8@GOItmYqze$tkR-@pNBhUdU3!dN9ILMYJOj4^aUvZMFQFK=P@cL1r6 z@U=sJ<=N(Bq`QQC3-wJHuee;+1OIT=^WJf^vichJbLK-(8A>DTum-ya`_|C7PvY^V z-X#zAoguBv{!+QTW6rx3-!1S_UiFDt_}ti$D*F?fI@AHKaETKn;7R7C5HXlh^h{!o zsrxdvVOX}7A?4Tr{6o+@q_3pMQZTg)Ea1)Q8|O#l$}N5<%GqV~ZE>N)M!~x7JUKA5 z9t(l39F)9Tiu!T`O`2ZQdW$v?+Qe4m558`xNHnv~bX8j4G6ay*PnvTLCWgm@K+IP1 z^SI~_P^NN)(Qy;gv`8wrCM0r zdu^7~mAS%W$G8dDhB^z`1T=lN-^sNz%Wcwkz4|)K)IQg@u1iEb91XhJ5xEwYDfvM6 zkLOfT>Goml>)dkK7RrcGd}4t$1w4`Vi@x?8r-Xz-T@erhoTTvYj;62sm##V72KMKy z7jCvo37#eEob8=(e^%k-w*#CwiWcoBL~yaY-mZ;3#7$hwrE0n&Z&_iqW9;qZ8h>;~ zOjAz(rmb4$^7bp}HHOIkg&1oXJz&O9f5ETRc`KDiwH!c>87$jXR}9R=#e{N-{typMNosUZX^8aPu^3Zb=_A_|$kJ2>CKI25a~u?@$|xUD0E z3rV0H2Dkhmtcz}Bqr1R;PGC&s1*q_(cw=w!eh^JIxmYy6ip|~R@0t~6h9kSKF8k`r z-rmZ)soKb2jgHIODnmo-1=6%KLu=Va>yJSJgYnC@P2eB{+<2U~g=4b-hjNb|x!65z z5!Z3c@32#?=kl#m5f8>l8a@f=Wi6&X>j+N1+ruaQG?CtDV~PXb>@WWf2Q($z>z7U+ zMBlz(Z=2s-T8$d;Ue6M3l3xRuVhSxm5s{3BKIpgmi-?-oisza zkmgcLp`Vnlx?L~qe?(H=WYV)H)PPR{pA7{5h`m_l^X{d`q$MOR49YduCf{c>9PI^G zU)!twAe$_^TtGrD{jAw%Wfw1k)5`DgJXWP`-7XNQ20MryLW6t0#t42k2 z0hnOio5PA`bpihQ)A=v&;|;YU&l?F@fC_Npa}OspB^Vr!zTb{NLwi)Hy`}19z@fr? zU3Jh7xd)*wL=El;v+()ck_u(iI_w^muPd_R6?OAcCyxtX2(vAWE-tjbs3u$PJ&jfGp*j;7`8P+@e0HF88@NU#6t?jH*EMz0L$My9PHiB zRVebeoyHC8Wl&pm$IT(G**{Utw9Bh)HAE_^TCH*ta-8|<-fxJ&aV4hWUSV75)+$)r zdIu%X^B9`Hh`wv*IW6Ho^#zL)v08Di99QNKyQ4Ex^x@3G;Cg6K(hX}D-{D_(j!D%6g}xd;qA)E>mv@<*$ZX$rUpcaK+~5kxF2pAac=%N>3B`6+-EO>fzLHkzfcD>r`}fy+!N&}- zUH9`HP&unio@pV+24r=ON7xE68a7?3>8!kAzHyK4Lb=YbvQ+HBn+||W{Eg?GVcYQ!l ztSPK!t!;Un>i4P0$ET?I9pdIh^EU0+RcYthPqRm& zPB}LVBWJC5;`qzHr{VN*QZ9;5?qvVIY@^viP)2>OQxb+mdkWDzLq#%PR5z67y??M+ zSjDiw%%q&n3QENt>Lwj~Ps8*c{0xvFm@csrU=eyiH}Cpb=6h0&O92O%dTc0WV%R`6~bS z;QT3eZTz7V7f#K|S{Kj{_}e_u;Joz^)V0uvH!H@e3WnVKG*Y;R5RQx=UKb=?4!qeb z=_DKa-vz<$?}ZxrbHii^hC> zLN`k`gS9^kaeye-(%)p=Q!i(kFa)B=q#!VbG7-calS3zKZMl8Kg`I^HD#h_iN?($! z>66rNVaPiYq<@#JX$rYXkw1$h7(yVDzNky$V^i%H!;0ZYI+ZXhW#@zfK7#lXMnh2Y z^3kcr0*7W=&Ss!urbd>4di6HWv0K><1f+uu%DQIF7AJcpusQzmE==J_e z-fwZbee~KU31mUe(k?U$jD<>ni>OKvN0|-t=m-(#j;6O&G~<{8=r6^gv3$D&K-xY8 z-A~Ae;#6^CAZ`&J{>W;EQAqsZ`r@~1+yiz(zXcIDK*GBO!0caA&f@eEcUcd0SLAp% ziK^4%9xfj7AK-j%&m}#)l$Krz(B|KAu~u{JsH3mYsRF-@7#pkE z;OJGjbEEV%#{Qt8>G*G(Vfh9<)rQPk1eaSAEZCJ)F~PoR(h+g}tl-VX($ zYO0R@KF7}dH^^v=pHnQ9YSNiTJWm+f!v@BwqQ$Y$ei`a_1{_|I-ss`3Ry;b`bNIE$Rnb+z+c*ky}aexvI*zKtJjccvTTZIqk!Rw!$+NgN&BT7q-IM^YM>9lAFF3qsj z{Ui)Y_-SRrj^=N_HhESJD-ltQtL~Y=Od(%jfPRpq8P9`F;O6pc)s_oF{z{=|n6er5 z!u-{h;{bvm_L%5agg+m)4aA0YAb@K`Qv~YLWx~sGmt6*V!|?F z%7PdL2(eqp+SqbvQ;>6xmHK-4tnG6El;(blqDJ+}Q2=*wlRYGBr%&K>9+K^{Aa z9GQ#O*$%Ki>UYmph71RnuwA?#!9vfTIuG|p%N;AWWwB5C+IE2*>xGPGkT?t@?Dvhd zt%Wpg_71*1_@0kBba@@FZN^TvjpVY+rkq1h2gtm zJPXCjvMjf7K+`s#pH$0kv}>*SPOV2H-e;NChSuuNAtqhRtEe-DVqBG7vr*enVEmVd zAv-&^RqMyAthD#nN)(w!Yp^GI_VB1e$~skiRlP3K6DJObNVTJM{r0E+{x$grTNFbh z_uBsc88W7$jtTI-pPGD>}Uj((F_m&nMmhI4lhx z;SZUOC;SP$w;q=0ux8Ozq190iFGeAoD%-HBSfOO9W&PK~Tem;KeV~3gA0dW>Pv6I1 zYNn)N-+Qq-I+AJB!=V9uxeoR-tL7t;-ZGy%%>9l;tMtQJm7z}(vh)}z8v;!QqkT%c z`Pr;kXU{<7gZGe(<&Zjp1|1&SGt0&iI1JiBIdPElDo}oD(oS=FPy1_j?dy9UkEB(@ z9bfbpt~myqXy`*o?NPpA2S*3Iq3$t0QzT^=d^GlO7pmjpsXe^IwU{J-P?mtkdD4jT zbfg}pfa66t&>R@5s6DBCTElqWD~=VAB5A$Y$g3nSX4Ol}s9ozugn47sFrns|d)D7D8mh1^h>F8%3W z2a5TI9W)%RgrtE1+L(i!DwwV@xZ@VytBSnvu3ay?9Y$%KBd@=bFp#4X>B};lBl^>;B5%>LW8TFDeNLsW?@@;#fCxMm!*pX9lfHt)uuajgiV$d zT#h**{Ipyhjltvp#_fvwZ6(9T&)Rb;VTsa~=gJDe$;q~EJzFO3Apn2EXrlA~F^1;i;H_jG>WmV*SvFHky zf3twjY=>%B`6@dr95pk37;>@x#zI%UP>yJ?6%2RCAY-s(SLIof9c#sG+>FEDjD6gU zD+r3UOyZKt5Q%XW6oZUQHH@|K!@vgu>y(j~#NpH5x9l+GPE6*P91EzHBE}krNo7~5 zb|0;8aj<>dJDCakJW=LK#vk^V^`8D9UP$2lLk&K$X+Ag;(w#ZeR7?dFGzJkJMi;Oc zoicM8#T@0|)<b|u?YyW0!6Ew$>Y~pX2XU`J zDYoQ`d*fm7~YwxoZtL1W7$X*5n>+fi8oUqvJri& z6nm&FFcO9AAX=7k9_;yussklMDtxu6t5OkjY3tvL7s1PUqGstoYssPT_ItLMXX))Z zJ03DK>_IPJgIKX7x8Rw<+?!kIc9MEA5hw)}5-iqzE8VFOr%mr5VC50inCtJ#tAQL} z1%tXg16rH5cZ?pPJcaYO6~hh*gGh%x5*s)RLDozXG<$(Q=kn_7fh78e%R|8C^X%4F zm9*vMr4{4*^7ibRo5iK-C*+ed7*^J_i&Im+>V~x=%ybD)(9wLptciZLN_)YB5O^v@ z{$Ja{Qtd!!GiH0^v6Ue$NG8nsD)~)N*JjWChU+1?Ny%198}eb+iG#cLFl;OopkF>K zIJg1zG{!THV!AKNdnO5aW zt-47+g@#B%3Z{it%Q@M`87PUsQr8-l>(V z7?crSbh@OEA$m#}=67-ZTp889W3?AU=1tjMdw;Ne(Izfm0-RQ+6jH&8gwGA_(Q}sf z2cqudmvKpmxhIPXLGEOm41F$3^s>mhI5{xLs3uHjw&8hlNfyhYWJ>LMMzm7Au8{{4 z-78CWHW(hd0`W;PqChl|g^3)t!&RZbm@=i00BhlV_)wg0=hMU42F)9g3L@3ao5I}H z8I}fZ8eb0a?<61oj=9=X+T!Eq!RN*aH=0Y9i8s}rg8IT>C(zNJ!Th>8L<=0PZ>~y% zhz0Bh?ag(U19g*K4YsztBIx+FBiiPs)+@S)uF6ph=|=6xgUL*jcixtPvskp*56`B0 z={4aNiYE!i0tq@Z1;pR-k?I3o>lQ~?sYinu)T9ag!9h~z6;ikT8&2oT|A@)-z( zaQOIKXY~=W6~KLycubCWOz(G95I!BBDB0Pny<_|zlgVmqx-mrqM_VmHhiBtJ`$Z5w zCPrd45%V_Ko8gYvDbKOB4l<(Fy#)}+&?NnmY-1A}rTwO$s?$(4W6U5%XfMI)w58zk zbnp#zcaX9eQujFlW$d|exgN>CX+D9ODCFX{GoRcYei!0W`_4DPA4@ELI0BSq?GTP9{qy5{Jp>{!$ilU=1r*;&BcRg z$*q-IA(UIbR;y$MuoVtrm}_sru-Iv6QF-Z$*v_HQLPEzhFGyrl8>MSf`fNpzygHW~ z_QJA574ufXwN23TR!mhNU*^BKQw@5<dJs*_=x{mDYt5qy%uW6HuIrYQdUw=BHHG z5Nt@%wEdaq4{)mv_E2B_!pNn?M`+Gf3%JA^GCHQY{6Z+#==o?VMBVKN&I-5tw2=+-ea|`(iVDzDkf` z_o4ZdXMG*j@}fOMk`);6@zP0?jJxg|pqYLnuYp;NEjq=E37d$523+{9c|=_m;Y=FC2zr0q z9ABp`#xa?^D8x?{^m9Pb8P5(LYi&GbahTA*2ISmx(8c(0gM7mGV0*-m^P2+5>2y*D zK>!ty(}TsN$-pvPyv8MaFTTJ&O7I6s@>;4;BIl36G56wWqHwlP{~pWLHf$Uy#0Puy zeV;G?gvis^Jxj`$>M5o?zm}_}UVzVP!9jt89Pwn(1x#nRAN`d2;9sJ`tk0AOz$1+E zH{8RxgaNe%M&|1hrS+*9C*P^Q=fDJ&p_?m6QWaQ!V5kK*vuF%HaecM^I*D{f1%Ubp+IA5m}APs2n1ZJu)J^J{Rl04s^nuyFN`DfFR|@!RJFA-DyQV<_xaV4SNKY62@hT@DgkLAq~ zhG+%xacHfgNfA`ZaU>zuj+4n`fU3TLj}&960XK1bcKm{wvmh9SVn*;5QgF*KxDXp> z;Zr51Q6HgH%jqJevB^Jiu6LMSlE`WNR1ubZUzzA5+#sU+UBVg8!D?yT@>=FvY+EEQ zC!*yn>I=^d@TLt~CRiEKJXWgp@5P+?!Jd%4yZjSDVZ z`OkMD7`^B2*g{%}qlKpgf7Zmo0$lvg7&BQ)Aza@3G~b|J$Ysk*P8I&CB}bAMZW-~Z zIR_wi6Up0t%hZXSOGa=}k*;=(xjt200^6TTRMf=`GX0xknXv$dY&rT#xsb_X8RNyA_$By$)d>6vNs2f?oR!rfdl)uT3^wm? zQwUBwSI&b&0r(I>$MjJH`fi%N1_>bz?&Ie_?js~TGj-`X%$+E9%n{r<<}`S$e`-p) z=*`trS)6S1Q%@D>CURjquWCtl()2l|<=i+Y;!j1i7jdhWpckp=OwWUJ0MIi}l3TJ6 z%ie2wuVKrrw_6uhff+-6)=_Nlw(qWRJwWbgGK?~1p|U<-iQ8R_>vJhnE;jiLPcBi1 zRW@hF{B?5XRh6|AR&h%$^yWc*ouol%@U#QTr4H?XOSYZzd|Vm2@o@5F7Ops_jl7Q) z_!ybL>GEq;&gio9wM`Qi-TlKa5EY2IY0@jteHNx%WR6`sJuJP1f$&aYFSPnLp{u4Y zEC0QDql)X^>kq8ecE4t_gb{C=2=3N2Gdry^aVqO$<8QdOeXI3e?r5`^^}Z(42qSR{ z0UzZY8>scj$7ip(7LQ+vQ=uIKkHj_~tcpcgSP5 zl5+MbW(cv;e_PPRsa@@MkrcgqMx5Z%N!L9-bn~Ur<+53s7!rjk3?KlB}I?)Qdv;%ICl2PJN$ftp)ow;+k%4wA>Ck$|vtQ zY_;32dscrw)Oop1ekSSV`gS{<%RUw@3VxU0lDzU1SQNO$YkfWP$ke$i6f&=S)<#|) zlsaMpADLw$TU8oa^N=>@h~Cf?=Nn=+j|^}w(vlxqQu54&1r>x{W^6ldqjSsVb<$rwy}rmwYQ01Baz>U?dDE) z6Enk8YWv#EPCC25t@EorUGU5O{POaAz%~D^imu19F!K|CcOQ6u9A(3jzt&6Lx23hJ z_sY^Wy`DrdJCS0duxEW>Bp16>_r;eS+N9O(hQNvjVv4ZBkPTG)KZS(quq)nebe34H)H7M%ti+!MZpA9N4oWcss21+ zAQwnD0vc>}2(d1Q#3z7x%6;?j6E#S26$>I+F1&^X5Yhyy)jZx2)-|Upucn@=gqJ|1 znjL{ulPOb0eXL1wk8Ah>PJa-YixeC}tZx!&A(kWBz|&k)2zfAfgt^NQ;Olk0Vk3P% zSYd$?<92$LGI`4r+F>*)w>2H8@J!QRnSiB-i2PD1f4t*yB0TW=VEPmk1ex?YExNMN zI9GtnDg}xUYG}IWCAHvEm4{~@{-51el6Asc*;aKov?K-kv&2q9S;tVToYnO+c-B=` znQKkgiC7CwY$Fiqj<-%#M!D%}%W?y{P=lzvRFF$pViFDB=NX-O>E6kM3WCB9`o^B* z{MM$j4lm`~NPO5-ia@%@awPiq@h@2GFf=ysU@*00s(yk}5oIaOg0TGff)nIUWYyxN zcEn}cZ}y^F)#s&R>KDsgsBwSUKb9_R?p87K-R`$x3itD)iTviK$x&+bcHFT*Q!eFg zNcceU!8YQz_sVsSd;ERa>;c4~o)C6(H5wX?RrI-;Mgfj(au5r*P)ju{uKG+ds!M@l zW?klvU;Oq*8pDCohHSQ24f7DeFk&%(PZcU>rFa>O6fcD4U}U3XS#+b?NZOc2maoDf zS5>B4E6*}7JnfMM)^Z2!u|FFCSETDqB*+}eo{nd-W7`sNQ!;2e+6~Ni)KbM22iZWB z%yRrZnm~6U0RBToY0kZLy)+s{VKacat74^qa)$4)&Ph1*?@Ov-g?MMEm?8Zb;eqt! zLvhaQgRdzKuk?`*jXV%Juuj*{CsQsj!V&}8J|X^iw$%6jIW)vwOI{HkFX{!z0lWlKgw@5_{( zOMVy%4F^Dsc0R@>XubIc?i6ec|UaBw?M>gea5yPFzj5S zT>m(ee^IdLw=-~?{o7xKpf^)qkrM(2p!((az6XGrED0(FM33D<0}i-zg79zA=DNXS zEsb+Zs~m#O<|j?o&r=|HRfL83{B0M~P{4zigdGU_Y0sk`&i#!eN@q9FI$Eh0D@$c= zHCwJI_FH!WbsFo5orbP4n^#UY>8;Ped9MS08=u=>R+PXtTkh6>nUbtX-mk~TlT<&} zv`4nQ78`LiHas=DuR9r3LjJaDID5~MGzV7ac6>D$N#lJ)K*b$#vtKZ<$~-Garg^@I zP>8fe%19Y_zr@ojHZ~{hg_(b+=~elZnQQ=ZFK<0h^nP0I2;dD#pcOcEKg%FDH|FA= zgCO~T$_6o8I$2SShA9w6s>(w(SXOn4pJ?h|oFzAC(qSCg$%!_$fG;Qnflw=yLUdWW zA)3k1AMBe)===HMKi6Z+RK3K-|6!Nf$WbMb-SFwgWqST%&t-)@hRVSed2jSKYbX^_BIu^IWwbNF9 zpJnu1Rn|Wqa>o_q$=jWj4UQukG7HKuhoijLbIp1FaSe$CRlFxs!%%g2>DL85wjvj( zy86kPCL7BS#|tDau=B}#QE|ffG7?kw$s+S;oe~>*PDr08^U!7HjxX!ohnTQt-D1S< zv>{kD2r9{5>ItH#v8$A+WSK86m8%+ql61HsP9hz+9q#mvT0C!ly1bL)-)G``ieJy& zd%tNl6e$!ua=U}>dM}XA>NTG{gA*PE_J3EIFWC8k4~p(C2wkZV>yfP7W~hmm#ntLo z8zO~R9Z9@lS@sMv$@L065Op;&QPR1FUw{cSF>(@B%9&rewXJ#8_cAc=o6*#1DT$xOzeycmC9E)Kw;29{@u_qV|P2(ZS zxS}xa+vYYvo$*1@$w1$QXeJ2ZsA|VX769oq82C&5=~|MRo4VlmF*%RSB7`4{P#pDd zHVO!rfZDXw4$Zpt!Il+oD?D$1+{uEk#nJjBK(eeJY%HhD`*}7)n_Btv{`Im!O4a(D z%EQ}+PvTbP=WADI;~|5XOqn2(kOqamX)kKHqw#y&_tnem731aRZGz5@?m$TdETNl9 zYS>UXk-v4THB7I;csa~%`a0{~6#Le+(mw=byX1PI&dDx!XDsGYB|_m zcnJe4os^9}S8d;{%WfLBg;;#j0-p7l;vBtSuFqcnEiu4ur+K*sVg3u1YtU+w(t}S* znYH047Q2SAnx}fb`rn$h^+M=ct#RG8&mx;^A;cRG6M`R-O{L-D%KMi~ug2yjTfo~> zH4VQ8Mvs>gE0<^aSeNJZh7>i+(1$u(`q{(nwWQK^YY{7>(QcDGjqqfWJw2Vyf}@0< z*0q@`%Zi=ABF2bB1I%U^tnxIB&zV$RNhKpCH@w6qHX=p|SL^r?GC$PTAhC+K`1sxu z=1&f_c)8l2Cc3u2W@J%(6;VRUbf0Btl2F`Y)VYf`m|vxeoTi>`gW96 zdvwr9$IR>Y)MUHq$%$rM=IkMf`b<@d5=nY#^q%C`fbwITF7v&Kd~K}4z;F$*^rQ0@ z4Sj#ac5hQzCLMN`*^3>aRyVd2a?)5z3k(T7strykphhh$nsZ>Qc7_&FaAzY51H=Kq zn4HbEn!l9dl5~X1xNQFng5l~P)~B!E-}j`fMweF^Ns421yno{$UANe9e-h$_dT3dQTzRcqepkzHk^z|s)HyzqDH#~EbY*nE z!3acTnuFHKm4Be2=5dmGaC(Z~Y(EH2Sh?kod(}((&UA6`XTR-YOn2Lq=K8Ed9J;;w zkQ210aTLZ=kK-~tSZUlpgbb=&zrtSoh^z`D-34aSz#KFN6OkBL#w9Qm3&c|6wm}xW zpST@|N0Y+_&$;v!^lp@ufMv?cYmi{r4I{lR1#NwKkwjJrH|5aRv8PE^P+iKQnnsxV zp9t{@(G&~gYy7pdSBcci0$eh7${KG?ZP|P5B!Hh!V~Ydjpyepjlz9e_y56W~f?UN1 zT}>?Ii^u;+sVa<|K{^5K$KG$V_fNK*c-!7`SKC-ilQU~8d^Yh?4bl^Be3ZK^lT{8= zS8p}8Foc24u}xec3~k@==9w{AJZg;u$Bsi94Ws6U%vuicdGkP86 zxPP_v64Oubdj3pnSIZt6EKDi*gaANFtS^9aDeN6?*l&Po^l(+nHNdVjB*mkA<#9R( zcBb{DRXMY=mRP1rN=ufcI?i2TqDX}okf?on<4}r zl;fjdikvb6STV!q@K~{=8VjL*l6Q)k40Kr!tD_9n-j}cIQH4J3L)rJNMja`rb^JJA zOox=e;F?5I3T&fsrC0_^(Yus3APsM;-FFE!Cx%+-tsa;5@zPj%AVh-)t$ zF+X@&4pt>X7%PsBv14&KggqdqHG1W^!jSt~HJUay?gXlvWsLkQPE0grR#Im*_Tl>X z$Zi}x0nE$Bk%)~}`lYFe!RX7JuD=ox%p`whlQ6|bqgsXfHaF81jT$YIL9{f(HSak? zpn0T?m@}WjLFh8hI=OyV6rERA*m#w}U1h2qzjXGbsml6#Jw&N*zdT-dd=15Ie+EtT z*#yE+H{;eR8(c31v!LGR%vg8(nR?iWQ!X zgB&?&SyDYVk5FD=GAgy6YMPzYc)U?f6w91AysneldB*ZfNwqr7o)r^k6yycj+5=oG zIsm{uOIXjQV$7>=Gfq1Zc(Qc~$x7f?D4xDB3DhOeHps*Sz*-D^I+uTCI|L@ z!^~0YFTBJ!r7pCmhdi8L0w%yf7id5|2Cex45Bt0=AS`Qc>_st%GM2eiFurXA8)&vn z(v1_c41I0zS)vsNNO%C$bu$RG48L{WZ2&C)?)C# z>17e@z3yu@{by7YpJ=5K$JiT#A#la2nF;S3f; zDSR=#+R(v$PoqqAEtF7EmCxP>bl;Bz4el=aO=r4jf0+oz{lpsf`JTJPo^$7U#Lirz z*rL0Ew*_?NZcc0iwo4?}+q1LDEVUGyv&xom@Y2<247cIV0>W%XhlS_CXn+GXfhKB1 zlkLEMF9fYoKw9yoIFBEbwmtAoO2?fPtK2%89$@3BqiiYqJ(gJ#O3CSZtS5)QCq#Td zD;_7RGd7geKFUW=+l}kCIyx@xSzhNHB=BU*rOC2NCU#BeGr7%XUc3KTRu(22MeP|OfeK}h6Sw$9 znybF@fKbPT$!GsTdDghElPCbj>FE=w$Ot1AM3OO`xCeU~O~LnREf(PRSZF*d#^Q?o z>;6J)+eJi7qg3szm{M%>vS1BMpTSV>egNC$?5H3hAr1~m4Pbo}?=89Nzi~9tHbPTP z;2V^AM16l1wX0b{vq4OIUpnQ|fwiRQ8kTb|JSWSTROq@C$lwruW0aX#qk-YnxK8H> zHw!#`jFjBf=_XQx5f~Oa{a_)-ei$&AuTgrk;Fu{BoqrAlS)sby2vM(P>jNt|rNgh>#=@{8vwQ;2CN+C+RNN7dj;t?ykeFtlMtesE?J!WjV9* z3rus4%J)WW(aIZ8p^48E4n3tHQ9k8b_cpaLHU+paT&KQ&zhG@L^d~+YM|w33YEs); zo?4rq3NcCzHtF8B$38y_U>LwR7r2++O5|Bv z#$sZ13Jk+K41jjkomNzn@>A+j*ifN0KeIZ^$OW<*yfL`NGz?~QZUTT{3buT*ARp{p{y4spA`#PCdq%(!t zgVbI=WSZrJZYhdd&(h!^D?ghV6EWy@F=6~$$K`8cR2A~~Yg!i~=>Q|o`GeD>@AK1s z*Uv*oP}N%In7?%8Abm7D=%i3{BPIHITKaU$uuS!$8KP0af*C~(-(~u;_{URw3*`*_ zdq{v!3xx93adJg%>3)ftaFArB(~d`3U&FxMhmx>t4)wF+v~l@12ZgHeOpelk^&}8 z>}dr$wl6ypRB);DsHO8~b^1t@aoA=_md7tRbz;K2)jSa&9J7=@>-9u+J;6&>r7Fe} z1Q+j@6rI;ze+5kFhp}4Uw>xg0GSfUi8Zhbz}Y@6}@->kHZ+jo_eNB zh(V%q_s&vwdO2BFfGpWxY$G-%v(_2hc5_AcDm2Jepu?qKUkzVEKPk4WM>j+2dM@ow z8vq`m^&8RJX*`fav$SU)?UJt_67BmEgZxsQOvV2JJV3+0J-Z{8?Apzzotf{|zIMm{ zv!jhM>cxsvuURNkE@|ysfs8o<_zT7QN@VBJQPZ3}3lcCuLXJ*(Vf-n-Y6LJ=XrD6d ztc1sN0qxRH0G(w}9yLBmu9JSRk?N^2Appkvq5mzs20=JsXT)mCPH|p0tTyVyWvdgg zFNy5FhuyPMb=0E4S|_06JTmFIA{Aep?DP~m+37hq-Z^Hn+1lxt zjM>@#ipY5E0K9@)7GY0>x+%?jWiTetLN0y zEVe7E>1ZOYDLtsHRm(ok5FV|sc~;NMl_AU6R$a+j>o`YW3Kwcu3mdMoaHyt8>hvJi ztWh>ls2=G!J$JBCIlEm~jLh;lFuvFj6jER{Lt;v4rIl!cMM*%Xx!m-4piw}Fxh>dAv%`Oh{%GoMl%m&=Avcrz zha=aWj=EV2(W6)pt)ZS4nWhCY?9WY&>4|QM(#Dh+q|(i4CW0erg?KVggqHH&GZrj>>FO8onE`P~>Jp5+Qe*(xghpone*3 zu1DM1jR5gVrXYiMOB;=6>H$|z)2x)cOke3Fn~-#fv72Fx=vyIaCjK5x7wtYu7UH2y zLT24kfdm$wx}YVs4BMkNA>nVV1`C;nts)i#B-$)Wy&Zc9@e*t@B2jO_27`#O6(d3f zQ70iH5)l(4vDyrxo=5_+I*Bd`ZwZPf{sW51Mjs9JdX%( zA>}GQiTJA7Gl{)M} zh#*o$5avbfvtlA(tb<&{U~yv6rqjDcLB!Z>auT6hXE50Xt6vJsSTIUh@ClI6sk78M z1cEWI$09;bEVuyMDLC~9Yl2At^On5i86XGx%Y{aA|c5HRqkDqve$iyKc zNpBn+=_%prn2e*^$A7B%LVg zWb8%&7H(uS14v;QdcBtj&=W}%3^t`B-iD(fdyIE)BbuN+J z1Hjl=s|20iY}O0NVkM%7POR0$TLmwSrGY9}IG_Rm2jl^`t3p2+aIGK&TbgU&-=>v>s+%nlBRP1Tm*_D-F+c#|3O2I|S|Agvju6c28f}K4-G;3MQTwF;jYKaR z&B!iPI|xqze2HK&#K2`YN;M;x*q2|8Z3>7gbgv0;-zr;{WR!>9^6WaP0KdH^d8 zVS^|P-yVJh>H%cIL|dzaX{L}ypaNJ{SQG$?t3+72Myw~i4LU;%adVx$%IfB&Y8}&# zaGi09w=$Z^MKvKyD89a^kxS)QYXQue!~|#K*taO0lHl@apQF%FEBv{_QmUi6UQzI| z=)?FePs_XaXv#qCyC&Fd>TkX!Jb07dYA@b}{2r1=Hc~BCd~D6bXn%C-9nWb@rC_bG z-gs|kjzX! z{0(PIY%gm5;t%KYP}*An+WRJfV{)o)schzsDjc(KMa6}i>~*TltlOR8WL2ggffBez z{#Ok(s$B3f!*-nPLw`W;*ECS2V!nLOO_Z@re6@? z_~N%!=oLKu5cbuSvwSa@ilceTLf3Y;3y*eQdwYlAQZRPiL&yIL~}Uiw~k zk*Ck;F=Z3DM!pQBXD3jJ@sy@YK~m`>Mw-nmD+EQg@t_%5tU%N!(B=0-r%N9Ux?g=l zed2yPK*f&%-H$GZ0NH0U#poRxOM@mT4EL^ow@$B$T*xrLR{r(-BNu zi3t!xUR+Fp7e0N}9g8;KEcWf_nA$7wxdS&2AG+~?jy~~bP52Q56fT^HE^BP^L~8CXSa#ff_m0%s zZC6}6HP)1Bg1^|*ORw0rR){m%Lba~=sqDg2^A_GDY`eQA;%RC`>se$;Pwjqjv+yAo ziw2^{|F1O6x^s;(QIsPOiO ziw`Wm=*Nq9+_ZH0awvJUw`k)s$839Z8eDMHKnpdgNI!_BUBgPXNXota)ag8Im-lYP zXu`=S5$c#Ru>MfPZO^0JQ*Xl_y5~1(zx5=V@WQ>_ht~J?)cyqMjq72}nVEilkXn6b zP?ymp`-_q`P4pNDqG-w$F1Vlb33>@xcyw&=D&a#f06BR3^}(H zmpa4Q6HG9d$!ONIZ^*FgXohW5A>rbrQ|4ltnc-&SL?TYQnaLn1i~6Xw6)1#RaYqv5 ziXxZ9jQN8*Lu(}(;|y&?r~O2z&6#a>OJUwMIv#N1HH-H=aM#imMrqBWJqH#~)0=nh zH0!4=KCoxe8cAqqx@hkMdls*eAf@ga{AG*XX3o_L#D98Kb9~{dE9OMCSM$Pnb9BxX ztF#xg3wCJlJjwJ9RBSVgs}Y{d)jsv+BYv13Jv}Hr}V^v*_?X!fW?1+PP83)pHRp zLBA|9>K>+eLYA~uT=sNALP0$W%JdK^exfs(E_=km(v47Ih<*_Q(N989y8_cXbL!7g zQ-M9di#kxZRP5S**amTB`oZKQK!7WL!IZ zmDlV1z-YA3)M{L-%V2h6l@rl*#YLhM*Bk)7r3FnQrOd zxmsB9{jh6qm1n_Ui5W^N*NwjuIh zDv_kvrYJ=-3Ht>H;g(Gc*Y{4IG`XhfYM*XWShh{Etw(b&O>|=Qkl51O+fq~29J&RV-l}mAJ*F{yQYFKdO6j$mz5UH5H9OeJR^BrqBbCImq)JXt=8jaZOE($K+EIK zc*=uC)4OH&$jE7TSg_$lm9cgWTO&GRuI^0ksb9KiYi(OC!kyVp*^H1yoEYj_e(}0x zZB4EAu-zqDf##O$o360nC9n7I09t=ybhcawZ^`QQRhApfQSlx1PdCr&2)6hg!LYxrefHz?*Bo5hG1V19m@G9A zGgi!!*My9s)hES_vU=xtHuX18X`dVjHn;TkZ(r~Pn)`B9_|)yCxp8oup)A8O_L~Ct zaZhO$BP#oDALAc8HviN9vGtApMkxJGdBrE{E8L@FRPNkypFCxyo07Xs7D1pQab=r^ z=-#qZ9dQ!Nc%c_eP*E6~SNVlex(`>Md8}xULT37sP1M2%5WXnP6tILut>#!upXKY!LZ!58LIB^o^PRM0)Iu4MVKth5Dp^$Ke0O2O) zD$tNZxp@h#+5)BA;e}FKXiZCb3oS?6mjbc1`OnO*4j&=B@BjNgh_$o3v%531vop^# z&-46#c%*0p;51w2hak8?{yi)cPo5NG;)|lla(H|4m6aKt6SG&l{pcpHlmZ}-lVPS&85{;Y5Mk9GhZqr%A{xj4Dn9cH)-#oi+0E$s3k{i#|D_Sb=hN>&lb+Gqn>Haxk@WWbpmY z%4P7Tl=$Iv`Fw}A!nVHoiN8$V^<-b~6T8nUpEbj1V{|NMseR-A8}GlouNha)9<6Da z?_BA$Je40~ymOKN;cz_&|7qSG7j`!E?7D2?+S|RXPN=Xrq}D};-?{se2mZdW*}r{Z zam|FybEnqGD_7r|4Mfh_w%kNs!`O*FTSQRd1Zo{|Txv5Gbb^s+Ac|xhTf`O_DWTFg za`NH#X!rQ}u~k=HwQ6Zg?>RU24-E9*_X=2i?z!io|A3e;!@?b|&^~8fEO5)?qix0UoTI_``5>_HnA!vfJrG-6}# z__6%cH*b``e16-u=Yjb~;Cby=+aKO_V&~2iyXIbbR(mmr^s2`V^r{nYojCCp-1w&a z>{B=+CNHoB>wK0 z);6*cMUUX2|$Yqei7s%w7PUQH4LMqk(gY+B9 zn2C}hcm}8#3?<14jMkZu2w4(+7D-DWCDmnc9+28d(Fx^RQUw(O0RxZ>5zK)U#vDii z;wvF34*ANp2`ULOLVz*LtgAvBV9h@FASRK2A1TA9oP-G`ugnUNpaZ}JDYNn{9Db82 zd`Nxn@YtFnii-G%Z)6bjL5`kV`(aNyDY56Kldwmj&d$zvOmeW_D0!Kl!KB2zmd`_i z`)7(#u;<((TU8v|y8dfXY`-LM;}*V2?)#xuM-dgOC+@x(5S zMw0vP?GDD_flZLuzJoCg9Y*m2Qw~XBK?$+qsx(o`LU~04=)1gO%J~rhBIi$O_z{@e zP`s>^o$ zAq*DGIv9}$6MS`1i71v7Rr86@oMqRy&Fo!H-uWYFJUfTP{gtcu7Iwu|7kd+u6@7)G z-e&QM=4#-x1xSb`SSCLSR)BT$;GEU#ez=;sR(@*sg0}fKz5Ems`#~qPmQ7jLcJxj9 z+94nPM^M|ja%JbVv(Fy-ApH^)*YB7V@kG+^f@{H-a=m#o>i z^L13l(o;6>Z|rZePn&NTXe|y-^>8@emsO9oG9(NI)f*T0$?v0`HQ`8=zRDd?d%xLIB+O2nqE@Nq-+*_#C+VvjV6VjP2Ityoof&i9| zl@;7PM%F!mD#xo-8-mf`Il&;nma%exo+UslhccOUA#{P>uGNy2G9$W`-i>amK{vNS z^ceK4(OFTc#>l$o6jhGu63$_GDE`Ely%k$Frsra-v%;Jds{%NRo%nlTF5!|9IWit` zz|1RlA4`V$9V7`0GSDlVuh($y+A4lc^K!Gb`_=r^H@@gq?@&^Iw zYK&$D&H-ItUIWOP=}@IdJ_7c*Dh0Po-pkHto^hbGdq(pXLCNt7*=$$xrR2ds6cv2{ zxF_*VuK7}aJTopRm|J!{|4~R#L$VKsq~~J_8huI39Aa`{To`^}I2soLiSCkn~*E4ZCWUitU^n_ih#+p}bL+c_al zbLHQG`1fDsfV*s#F>t$n48li`=GGu^>_#KCI=>d#I@E>mTlfwX1@PVY2}t~-7t629 z|GuNI=j?#Lup&Bh`Yk|r#~tZAF>b=~GoUN5jo%AZ;Tk5{`{>#^H`mwCvr5G}q4&{O zAN}k8zn=kWVep$Xqb%&Y-~<{Uz$uEp2#sMr#SW_&AmS3M7$;O`cr;4TK^*Y1UDT&P zG8Qp9i-mbX?qf8fQDlG3IL% zSqbyGKjsf#4@F83l21pHBaeBE7;Xc(30}eTvH4UKL7u8FRYD4TWQwfFj=9%W2bFyi zcv#v4F>+sNeSSD%DwWAS#$H`lDswG9n(C@c)#qfB6w+pAQHxc%DC6*sk#j7uT4j|H zt4&40@vkDydUo{!gz0#)12MAWfB3lwsfB=hMe~ zZ@#$~i!ik_XV$_FeaI;3s;Z_n>qkNRp}%n3!eg(E4r`$^8pCoS_$Dw zER-@?yNU*B#BQvCus+3>;v2PC;>*Txw+tsmA*=T^l5Fw1yPU-AjA^o(2~(&J6eyS9 zfmF`eQeVoTl+A?af+Swb2mQdC#fnXzi}KG;lXu>)EYoAtiqVATgPyEhNw{FlR4KKT z*d|F>xvDdv=2xQ{tO`?hBu4bzxD|W2WuY;!W=I0I$eYXjVR!Nmy9I4#t+{P;P1n}i!dTGl z4%QVpoK>|Ib#)cBRZd4y9X=K-tlipGv-!4FM>kKHu=yw%{}t?67l}b3%hWmBkisKL z+$GF;xRjw>pt=HQW<1$184U*c=UOdD5UR)?Oom8MCQtSgl;0i&MH2L&TA+VAln*m5 zCNM&z1brE>NV2q?g@nvt1QKqdD2V|s&sl&nwk%8#$bN@inWaQwfZTWhlTr3yGRhS? zn6Wlrbw0K>-wx=eDJ%L8kK21c>=8uJL+m{LgaNZ3RcnReZDNDo`+nSGd>d5!_+abd zzOL5d6Qj!*CXUMrK1J3KH=-g!oVJYkF{l;p(&ZKQJIdHE;F_TP27@5Vq>Vw3B!70A zLT38A8vnJ3>d9Gj*sQMx9Y#z@|hsip2 zD5hQ}q_}P9gN?l%_QuJZ`ZrB!DA)%k?{M>e)xX^R;-NiUAnAB&aomSDmXm12~beaIJq-laFD z_~Mf_A?5AiaABKrhDZ{%*|3Ev4GMhpz3+!yoX*l5z;5rp;^RPbyx51+fo6-2bA{f& z7awYvf?9`GoDLGLD{b=jBOiWvWS{l72MMHxrvyoHqI@1%y*nhLoe~ek{9p%vYu!f< zUTIs|ike2{`c&+ySep$hzENxr9v$gUk*q6}ilH9Kctpwl1l5u0AEJ_q3lyaGElr?< zOcH~}?ORHt^dOSA6wjxDq14iSEVU1{X)Z=AG9p6k`$vV*iSHQ*_PqkX6xlGL%JzQp zrb%UiPwDii!92B z#X^zeXqY&@54+m2sdN&37DHd*kAT*r4+Sdlusy^XuYY9vTf&(E(dbQk_Z?U4zDoRx zgk}Q;19vWAG_Z{{vhx-n=0pYR3~$K+}5} z|Nr{>GvyyyUyKND$#`3i!eYX_(pfPrhu2Nz(x>v$^l6TtF8zNaKRnIx;bq47skm+g z7>mkhe;>%!^k1VZo_8$$uQ3jemHI!GQ6B4H?&sw77<6<%5#aLNf$<9DcYHHXQNO3Y z`hWkG{BL?`)-NNkzZQTD-#{Qb+}o%HL~Nt+?IXUd2J?TVcYojBcM5C5XdJ|8r5BP@ zdF4r}_sjH6kU*m(=D|t)AM2xM=ut!0Gf6KVu)Tvx(y!>0QqZ2BtYejuuFQQtfLtLD zgpkmY$nuzD+iNpM2Fka-5(w9fI46!In^P>%&wH`W8EtD9STd{d-A;M0*;e zifKh!OcLpbNe!m@bJC(09R&Sj*XHx@6e2VD90V60TPips-~);XUQS0NmH;0JW2;~^ z9F1c`W;7mgprg?ysQCJVh=WDiI-dmchjRZwLjL_E-26TLi9~;@$Lmd|Qc173Cx!Qk zFf<7S69b?pc~AorUi3dw!vw7t^bdGbUX3&9)S&GE==W-|BADjV~aZN6xnv}ZW(i~Eq6gz>hgM;SCRB$G!zOnAY7mri*TINstE6`d|8QmNF3M?fNx zOs2d;1H(8|G4n}|E_H<8qXG{?@DE4f01-bvnac6j!VGh2zU?-p*sd@IM#hGP2Lu^= z0nq<3!Z&e5xxNpV>saNIQ%c!V%CnSGB}SG^A#+VAr5k<$Y#d%Nh~(@U^uL%0lH$f; zjdmm#F0Td5SO?)&U9HZgldE((@D@tc>U8oBupb;4^YAf}B1h1Vl4XayLpSzeQZ6GZ z*MDZpMdf^3a-6!%SO?);{BY&I`_U7~O~G5JTw@)EGnBHDz5QUnTH-3**oSesW>8l% z5oYeN_8QI)A&zyBiJYm{!w!Eos;Kz+;QTQUQ%bpxp>l1_Z?6#?6XIA0QMpcA-7yZs zW20X#%7F_u#$h}bq5cK8lJ|&9r3EADmQhDia}Vn`^k-u?78&1A-+*(o_x#?S;B;@B z+;avnG7);Na?k(43k2t$?w#O!R-$`u&6V?eHa=Z>n&wpP(2Cqxt>C5Rqx2}Ye5)s` zk=M0?Xxg4n85#2U!4zHy z?N?x%`sqz(bHCXPC z_aNf{KQ}za}--K*7MVC)=<*B%t6N9($#_rVs$xPB$sFlj;+&^LXkdHKHO%l9!~s-|}Z z&}{F%rI__`>Aqj~O~)DK|5BuN#gLx92H$Y{bow9o(&g!Ul#@zGg1kk!G9$-k`z)1@ zbis{8B~g7F^E%@&{#szAF{FYDVv7C2+4AB3S2jz;E1}WxV%lWj4Q7*tWdp4%H{WvG zN=#ZSQxeu8(FYHIeRmY}|4{xj?{{e}R+Bcsb;Q^7Z=WA4HsF|Dk`4c06j%A&A7rs) zDe~RbP>b+PAOL?As3R*|A8y| ze63fwBj?<^;rhF8*th=P4H5ShptpNoN5{P3KNnr_fK9KrJ#fLIOQ%-~Lgn;Jf#!{i zW^8H>XgO(I>*@)+-u&#yoJHH#&YBnS&Y8J(+rruX!@nyBehccjhrgQd9DNnGB&3R` z6FKuUCXF3Mpfmu> zxte_XGQMnW?lx$+9`W6dT{k;{@l)*m*y93!F8_nNX`Hp=)ml{-xSSeXS2_Mat6QX? z+MKDD2Hgf#6>9&tb<-2y{c>#O&-fwYF82MalnlAjMBju-mmK<^)kHB0f+zk*g;(V~ zv{7c6_V2es!i@0mDlt<5e>lJ?5D>mvIw1-vQAi4+67i5p!h~8GbtAw1cIwdkhf;6L zZ-a`r>EzoWHR>9iTt}*-dUz3>@?;WJfCm6(F*jw`MetaR{iyL=IhR^NZJ>5gmy(s& zd#J~V6(7|J4F{+m@w{|6FOBk`_lDA_7Qxf!IpguurP=(nC7X`oeTlG>jkF1vd(7xx z(mY^B|I|H(G7lkvk?t|4v**bMjJ=!L%9OgF+oIcU!WVptrq$`uZwYoLM$iPCNRBV_ ze$!u$IwX&=qi%q*QUA&PB%c|_pAIGQAAS&xe-)8Bp{~{0sWNH-mew-9LA-_Vgb-{1 zFv4u8S_d=HaoEw6$)ZQZiQ8)?Vhj!L$p`n(XhCY(`;B|nQZ~V=P6v&sMSb8_;J8$D{l$4 z#-&XL)+}0a>`$idEb75!R4p}`+Je7Bj<>}m@{7{pC>koYs5xw;QVtuc7dnaRYP0|U zY8E>2#4E2o_R!n!(x3e8Mytfu8*8O1S4E)0?r=$KpV%N-%W5t-_Tc_X-wlHg{jb^z zI#cE~&-8#tUeKKX+(x1~w*oR%)+oV>*88HWBtV^qr>w?O{6C7S2Uz~}$FhQw=2 zNG>7k2PFy{=ZN(KyLDvzDeN3;K|#kl&d58OO<*DoWxy)ze z`3)+^=&IGc)4@sdm5jsCYBVxnyOMxck6D5JW3NOp zzLQ^}i!F@9$m*3ux_9i#<$U9xrEC~e2iP+3G`K<-w~_$XVIm5}Pg2D0dLuH~&=Zg- zOAu@nal2?-Sl%j0oY7w%E#x#-jxK=ZHzwY>Yj_@T+wlj%i<2?BiYj|!NAOAV790sM zqw%KQyXy@WpmBkN_f45)92}8PK3VwlV~VT_PaWg-umhBiDn)guL~T!794sBy0*T@4)%W=^;2Th|FW3vyNlPiKv%AwNdq5{zS;}a3izc4AXOId&HeiPdcSWfV zCV5F1m%-Y^vN=SfNj*XE*8-nn0nD2De5x;nqUh#GsN<;j;dMOX^im1urjzLJ7?aGH zDu()pSuW_g|3>{qtNof7c2L&ep}(Fy>jvGEXW{r-t3|p0J#A|1LRVSXLUx_x66R^LnM!_p>J}HsA6^_PFKwOVDp*{H6?b%quFIumldITL5G-q+ zr5;qU?vo^z(}=Y9Ad+;KQoYnRYOl%=tgbxTtq#Q}miV}Y^5jJ}8>0}$;96)0)6zg*EG!EZ2psuQ zo9zo=anEsIUsx!AE(UC%dtUmcFXS&&I2|COWAY;^Vh)&TgV*HUCjC$4*5IaL4+Pp% z6zK_oY$AE#xC11A{{0#OCrkw5>^hKjV{d~$*O z6We-)G>Xc*<$c2*hR1^*^pOmab||9W-f5Tsj=lv&2GD6 zUV)`JC{@nAKHzSwE=v>@oMqPR)_IIT*V=niM%RY;d-h-+t$gGQg{C(%k=gJ!OOKr0 zlFAxz$dyQBsIXBYsc_LKKxA3i3y@R|W9d|gSxXE{O5iJ`R-zwImUm>tLnKWb5Uz5o89GOdB; zwb1H3c|QmM^8+6-A+14cDEsIE`78Oi@c!4`g<_(wy{)R%7pe*C-AjW-6LzesU*6PM z-t6mE<{=jQkkNZl-8#Qt-PqIDjsE_1`+Hhu=;3wiKIgnECaqdMjX87G-h16$2}aj! z;`;W+j&L`r7eKn##jJuiM+LDDyB#mXkRA~t^B7(^O@i(;B|pM_WzrW6B}0vAD%561 zX&R+zlqNWPOw>QUaEPiH=SN!xZI$)D_sLk=t6*di^lXeLYxDD%6ebj{%f%jJVjneb zpc?qY{-_0GWMDxT2QX&>mI*Bqri!uQ=EqnY3IPyO5EjoG*IC&SJkJa4djG|}RW0)Z z;{xZ*o_D?{=&1^JuQ;p?YK;IwSRAAeujmd|q2uSz?>-0Rn%9!}Yc*h5;0#n$+8b)R z%jYZsPtL}tE(+fqW|7#Ti#7y1Dm%x`TD)XVd3Q~Ny|NqsL}HZIjRC-J|FYIZVdtj1Ra>x;1CUFy?oR0eeqb&+2=e% z$~&q)yU&x+xIagyW8NZLd1w0iEzZ_yoa4bRW|Nh>@_e#OrLeVvlUDzJp`GK)pdB;>@7<$p`HuiC$DPtZWNvO@KGlI(6RZ6DEme z6}VQuV!a4^0I$V$D>>!m6uV?)u5Q4JrB@oW@DT(bq-tbSxcu>02{u0U6G0U?Z+dk0 z7Aq9wB(F8-6GnEv{9p3lX-?24EQSG{8SLumJ`UyqRLh$cqmmiEds=*T<@xB* zVHJ?xp;f`(^Pdl2LyuE#hi(fZ@@u3Z^yHDx$ECtWQ;PW-%7?Ew)AK<*mWg&zAn>&# zp3hvJR~so;NiebjfYJgZ3kyaTV2pQ=X?|^{Ax6G~%2D-FUc$(w<p&={&Y211-(yzcTTRn`)<;I4W|;^f2$aBJ}s1dJd5rt`Qknxu^-C+ z9(q4Lc?uX;1bzrU?iiff$UGAooQj6GSLCmN9<09puDifoFz#n+TbX%j92DwK-1#wM8;kZc8hOXTWOdlrk!v(g2;SK#-^cux!keFA4IM5Sc;|DiJ&Mc}6jWbN6Y^+S9;oR__{BE9E~mL0O5f<*Tuox#%@ zr7@25ogU>&ovbe_mhk0T9_E1gk&^W^o|L?To0L7|qZK6_;V~BcuGxCxX>ty!CxO z5RFNr6Q(Vo7)uyI2+byk4`} zVj6{$eA*oOvW%srAmjK=LgF-BiGv^}^XxTk(ofBo)YkiHV_?8ZBLf=sjg zd>Uh|;;ZU#ZhTc8z8+pXv@M7(>feO&Z3xl_g6JZ&vpcw9Si2~?|HzQ#F??AShgo`* zUoG)oRhAfrd#mR7_wxGouoZ?g_;uk0$|17mLn}ybIft%fKJO_U$gbDRwS*Q`$w}|c zr$9yHBq|YolD(KJ#D3Q0AO}{Cy}<)H`d|8_Sen8?S2m5t(62RvM5Ckq~2E?EaN1Epf{! zbW=IyvY5gAqdUm}}cfVfXIXhj^SM|VEr3QlwhK4oQV<1asbP(k8~-7Cvm)go_7q?N7BqPS)$?!|4HXXLz(F@M zMSJsH3`aR2f>bgIW~Kjhib5Ls2gFHH$qiSGn38jNZW!^ZQpM{~J{r^vBS(snt;Ad? zI^>izQIb;*(NYSNr8ld7o<{8RIsDDh%L2u6!tDmB;y@tn9p)4|V*DCWCS|x#2Z=M6 z$x@n5mRdvynk6PmAmP}4`Z9rg0)ap=NV(l|qFDaj_b(IiQ&#N1F$XwfnG*Q^0p(f0 z&$oq+=-hYZHKhf&ZTjyt8Hvdi^y|ZUj$FCrjxFn{oZky-NFdo8;7(Dv8@Eg0 zEEz8q#6KSW!){H1?qWTFTDGucdDpw5aH&y}FMC1(H3n4ODT;mz=?^Ovp7pGViM<%x zFz}OOyaLgS*IVgul?EH?vTIG4rCY6rN+pS*h3L0_bwm^{H%b$Cb$1l77SlT3Y|_Hb zdxOE*yF9_}x>&e!X7$8zRRxyk?~sg_3u42D_GXc@7-nlsf{}K_TNjqCxWG~toL*HO zt?!9X3cA3GTRw0-j9cSjZAE3oiJo=24njR#<<&nx)lnU4ov=uKXM52*Yt6{u0^sc`Q*f9H zXPt-RSpg=Lk;5~g;N`&Xz}A|*qVRy@?H}C_N(7z8_Di!?ejQ_dY}$91U7k!b3mW>GYNjjw8r7aOGob3_51*en?@!+BA%Wv)m- z4UwpU%8R6RUqA)&S7A!B-AxfWYB9nxQeP#KM&oKE)6HzT4rk@yl7~>IATf%-t89NG z|4gINiNBC^?@B@4IR0lE+s`aItw#RUyQI(k0r-_IstTAU3hRv0d{O8%N^qjtY!>B( zp@q&x7I3d*7A)!KBxA22&Xnir!IAbamYEF;_}{$+Dd>_vvI)%BaRj zd;4%yS0C7zeo1}^d`lKAdC7Qx#zdX5TSNCt^tzWWk`v%AdCz~JKhlv69k>ydeY+s$ z@egSz1Cn+M&}e%e>KRf%vRfT>F)8kI_#)u|K7f=U<$$6i(xk`G0a{^_rn9BZjfZsR zz4)YITRTr@7aVwOtB13XOa}mL3&`(#!ChAdCW9k0@1Bj0Z1lf?;3+#Ur*XLp1HF$IGVpgX!?{~3hfpur|&OJ_kB{+8(>)LPD>DVP3ahB`+kD)PR zJ}5`(GlLnv9!e&YX{1Wa@1PxY=vXr8MZGkAv(pKC(XXI`y+qblR+hmclhNRmZw9?i z<=0>|$q%R*uzp*AiemnX+A%^+C745YOnf3Rye$y*hiw6iAALq~Bn4R_p@0QDC^~B6 z(TFXEflxg(U022U2?%LzD~ET`)PQzcIp$jN#_ijTd}QXfi|5?hU3RNDReGs-W39%_ z>5N?)-%j{$ol|=2tew3rCp;BXnitj1(r6k(9W@iGYCO`Ef|BOi&hiO7+vJ~E(G)5X z>Ex4Lg@>=4a?a#xJ9BCf3{j`RQxR|ofZ~pO0T}ukel^4wH=Uinqols1z`#NI$AD%H zW|zMTeB+Dw96AmF`86~>Xaq-bm4b^wuqD)ZNo?eIuu9Be-jvKxb^+Wh2gkVTOWmfREs<6p@(we=^m8 zsqmQempb|9I-@}^r|?Q#iukf%x0jCe(_phfi%HWA;$JU-ars)#q!+ZdZ{CszrdR)~ zdb<4K!>_Q8W5G+u?iE`;K9?lTOBOM{mv=0Zyt}^4zUs=Gaev)+L zB-xQk=L9LTbBZE6=(lIATIWH(|MLtNc5A@? z5p^Ec8o74zW~;Jgtfl~4&fEZ`&$F+qeZC!g1P6(cpIGis-{*r?4DB5bh2x4G8V_Jz zLN)3Me*hT30Lcj0?E>?WuoD+G)wOnZ)J{&{d74Up?yB$JKB=|JDTYnvU})YNGqlaF z==;IJb9deAk<0G~kk^Qx#q1$aOy!qYT=4JK+-Jc#O>q2yHJh8xu%E495x; zL|>Z~lY&7WFE3Fcmpd4AyF&dTmrQKD!0QSz{c#grWwDsT+Q!6XC0&+@w=bNrE8q&1 z6gYcpI((u_tL62DR>@V>S?x1vfh38vpkaV*<`!bLLHC62Yyb!PUC>tH?P{rS06jp$ zzi9|=n$!i0-L7%~f-ZPTK@h?%iG@C~Ian61XtqkW;@Z+?k2BO&;pd!IVT-!vkH-B3 zi7|7lIE>ksH&TNS+HFJ|h7RlmL*R@t`7cyxjMXN=?a@SI4mI+}TTj;z>*HYaO!;q& zMxaH}3bZC)b!U}JvKH!jt=1*_I%;~I1tlR@VAqU=w@GAhvNl(Q%Yx0KZ((8!guw!Mi7N;|xyxM)yC!W4 zHlT*<@?sSF%vy$)*pbSq7StN6sf($rs5_}gsb3IY6YLp}SIHt6S}lkKM)ZG_MSrRh zFQP8rTUgac2xYu`^LYt6sS1AS zCH)ME_k1`&z%XqQOms>-wvf1_EZkur4vSijfLe}G3wSpbSRy%0p4dVj7_I7W{I0HWjX@fgjS7fsmt##Wj^E){pUy?{bo1~jqeueyZ z`Lio3Cg`kI-GuV}FtooMrPIctuN`xPS5<`MT1|LQ4?%<$pS%sTepn9;&mIjVl44-Bns< zds15@*u~P2yXlf9cPLcU&^00A0tTC&uD?AJxxFq;|731O6KgWDO%)4|Ju1Vj_1;^;2^ebV9-R=m3 zIcJ?U)VM)@Y5i*8UA)-i7HP0pW2hP*1IM(MSZ(>@#g*e@7A=^w1PyCdkGaF`9pS>F z@T93oQGx0H1q?V!@$QB~D(c=_`5ufXT>56Wz`7n~zsSmO+~EPtWX zRUdmVy?%T=?w)Im=t?FnTsJEii3DdILz}4Et)+kQ)}%>qO-?WTbX!w5XR~qLO`AT) zY2Iq(QJN9t&GJ8hY1)Bx^W<+QKRg><9qN9#8{cG(Y>c-Coe^+AzRm~jY`uP>(gI? zZoN)t|Dwz(9}^)c2>-)QuMy>GResD{fL@`=R0&p_Z9`{)^etA4sS=*&rLU>XjM2*2 zBxU(U@OlrnAlPWmfxWQefE)pKK=xu`fW&aeDC5f>Tk+GPhS%(VUaQrZpDC8;IB$8@ zBgt!!x^4A7E%F+zJOpmh{C?OXH4Q%S>kXFQ0{Mr6U@W0$8v^MtlzjoDV1xGo{7>^0 zqcLkJ9Zxa;MyXD+hA-7J#Q=leD{S^f08?|CfPnM_U#O%SDl-Y{*)1SM_~u)=NDTf8 zd?Xh>^8je*>;zuH=k$66P70$^0wD1vf*^RjP9GW}2IVW>klz?zQ&JL~;2fPp@Pa{b z^T{+=r)3$M=5%I;Yn1#SF;BXjouuz!v7CAnHK>;x?@TDeRxiKa%Zig=|OqxZ`@T006KsJsT{LMft~U z6__JC>l7)U2!vf_^WZilWz^0DjSle^NVcG0`i z7x%zRPTqCo$QZsCv#51BFP97$Z3gGI#2-R(5tfcW$k&Y#4@G?$AJ8|d$_bN~Mm^>tw{GPWReo8)X^!-VC*mrFr zI3FYZWg^+g*G#kup*m8&G;r%hk6d)oBk&Qj$?zB{U*OOK_?Y@H|2YuNUYG}5^05&u zh{S!vT(ziQ%jdz^aycqTm-j*)7#xX|a7ccA06vzU(GP0IicjulFJbRN`UH-yY{z{8 z*tsx{Gm4>iSB1%P(Mv>cQ$p{#ghjmpJ5D2MQ6ljWNQR`*{M81KxZ?qw#1Y(uAUe$8 zGng|YUczGE54u{jJsK`543%`oHwrJVY@1Fq*DqbN^CRojiW>O?`Lpt>gy>lsZ~o~0 zw&>CY8k4c2WWgIRtgD(bCt)q{a^fFhe89$;pK#4*E6ROC@~z(-GTDqQ548cCOG_8| z>q|VlkAq!c+-=Qf0Pkz-@>=H1v51By%Z4o#g%?g*lGJE!hCAH>t){w$*ZEzA0WDut zsL=$5MAw@3PV4w;+M==gqk*31&DtAo;QaOU)A!3xPhFv9PsqK=P&Ce6r>%Wy*F#fX zl^%~tUnK??R&`lh2@b6Ct~6w{Z$vsdVYdzuD&kn2gtL=SeF?V@9y77>fksuSE*1)- zkH!QDhaqm*80J%8IbLaN4~>p9SXU8835MNsO3Fcbc-}P4qJ4cdj8{&+_DO4dxZ<`4 zD?;ryW0l|Y;#GoYqfHGfmL$yNU>n~ zf;7#C3z)t>&Twn}YAKo4q1 z%tL_cz%gK`S^d}^h=-Lb8cAYN)Sn2#pwH&BSUso(=|{R9k1XyzwrQsCfvHpy zGye@{$d4Mm?c-;@@mZi1!1|>ZT+j%;@46N)+qkfj<>f^~>64zis0YA&JHNsp8%9%G z6^vSZQS8ux20k7Mg!oylV3aL%Q)@+2NnL>sfK$|Q4PXnRYdZFpFT8Elq|3qG`RzCT zDLZhKj&p!(egP)yDi-uED7a5v-mtB20tDlk>fyFf`cwj@QQa|Wk9};F9)4vu%6IFG zf=<4}sL@(gyg;P1ndPKT2a;wvarc>G+beh~VgMy#Iz;`I%89aqcFrrX!VE8ju3Zw># zA2Oi1lzLCaEQPnau&^HR(=e(^ z+gN5N8lS=u3NqZP3elazYG*fx=UtMlS+Zb4%k0^an{T{+^X8*d*Z2A>SFWA1V|iWO ztiXf=@`pv9wpc9KPEViq2%ymnGhz4c=e=H^AMLRJ{OHg@kH_zyP?BhmEZ=<5i_FfJ z>C@X{qMp0)oDJh>GtC&X{`>@sT#*haUSPB0t zeJ+fqcMN^L8{SBtH}o;Q1G{xAxU=jYGT#>>NpuF%fhejrM&>6*-LlForgUxv%8~?B zwqSLaEG~qJjSvS~V()tF$y$uv7;vCCPreNG!>F}`54;YC*A9+*?RKwYXt1ogX+d){ zGb>R!y?H_Nf#&kEW-zTP0e`$9IkYNy&J^BYG?W zDsO5+^C*_Pz9pO+Cdv;qNEHZz2Z0f{=dcESr;P*gENxUn`)gEYzp&14Z zSmQcXDhvO#Dl7$d^9B)U z#}&}PU+6A^Kx^T39HZwg09c(CD*$$_CJco~5-0Yp1rtRS-kd zg1Ml~67u`pb|Zuwr{|4y;jEb5R%WMxr^qNeW@#YcG&U~-IfjL>q>3$NtPg0-bg@TM zCRBwPBL`@!uIhrzDja$PM9<`Gv;#s5w3|vm`^@xRw4T#KT1V4*8r%c57LL`j9HfOZ zQLBGkXP`NTp#??*W2})jX|*g3fetc^M$iDW0OM9WI$?pu?bLIcYHKTZ3smjs-vCpgN>Y0;{? zaC}Flo-2Zs>Jxcg!!kMXdnsA<=A= zboFPIHnns{$LqshpN|%RU~-w=%o-p8&VY7JwBE?cbAZOevKl>VUmdN%FC5CZicV93 z+gzmc^X2UL^Q_jkySJ4>rgCRhxVcy~fYv#l61#1JUqgEUsI3F^!~)60GYQsHYSYr1 zJtm|;@(mLKXec&S6hm6C1x1qG1IkJmlVETF!NqDECOv=_V9;8$0*6XMbH$9rAPJOV zOb!4HX33;ww2);Pj^=^T>@w(Ei?uXg&^ErKh-$YhZMu-{0x8vb51u#yJgky{SX6Xt@Fn=M`wKqHaRi z^3%F$ey!7NFT!-*YhxYOYwI?>c-F3R8z^#@9qCxHWApl^Hy74SDTUAwM?7x5NsW)kvY0@5ksMt`)l#k00_;^34AB8>^v4`y zbSTXD@GR|6=z!5!f(8mN8{+XG2mE}D#q&GbVWdzPUqwcfR#59<9I;^$1Z68BG{8MZf>nuNIEmc*D>?(4-D$J@ZZ1 ztV_2}+Bv1!^bvgsXszwjcTXz7s}LnKCU-PP%RRcCBlNHmd?ja_vGAH1`or-0n$~5! zaM6d07vHwLLofpNH}Bjx;h#5s(Omq+$J75pp9{cs_ewu{+chcHY?J+eeH0i95)GY& z(K6PFx)+VK0~WqC79OM8ey!AUtbbI|)c|uRM`}H^;(LXeh#`)LEe3>J9>>kn89PcV zREW1Y!ZfR(&ta)3h6x!(j6KKP7;aoNqo&tWSSFedmUonvRJf`eHa*nSk=)oGnzo?% z&{=kG_k_sonzGuW+Q@%D*!hEv6TyZLkL>N8(Rr;r_}oTwx4HvZyaV2=og1rg>YY4q zHoGh{oIbxZQ5j!cRou3*vt>zhP$;nr*3xjqTUqICu3UO)aPszpM?UN}Z+s50*LKe6 z-K*@#gLsGN=M_kIc!k8Wv{4--;wobgi4%PCT0&DC%CmCD;+zhK4gR?~c$EF#r49D5swLbYDMy*C(Ztpb2 zyXMdrtVr1JWLjr1Gk@Xm`>lhIp$GK1Ohu->EjDy*Sy9mad8fQv{*}dUtFT*jTG?H| zYwca^-uQ~XzM)SopaEP;jaYY3G?h`FnrFZ`#dc{TGlK!uVw>IT54lbflMIV~Qw*{9 z4pD@d91=?|vFFl4E>kEISBCws1_=M7VucFR0h?qeeoVv2S?c0aG(f9tZ6x*^$?}<) zAC{^wjTHU4@@s9#m6}-9Uo|o13TeNt{Bu#HwB8J;&UGNUt`ksZx#!aVxb)Kh00X7< z(mnWsOO>)RxU50qiK_~` zfzxc2Hp}9(QT5&RiHS=ml0TH*)D4r}o8$pf8ag2>Jb67sn@CCCl*i*OeNZMCf1tm6 z(2Ah)QMOA2w@u<5NcaN5DhCh z&Mh1yG1e?`3l4^`3n!K{<3Zvh%*F}XJi+i`i6gGV&Zd^!_Rgp8+_ps7fQ^hA2(a7=X5$VsO@1*7Q;8+7|rM`s8!Ay49Z#gb#&Hj{N@{js{8$vy_gbF52b>5 zT*Jc}M@GO%ZAp-0)S*s{l@Li8LwsPzVIqk$pU3K-lwW?l_t&S^9{p_ZK{Q{6mdlq7 z+>R+`x4r{|Ty1?8(%9&GL`m-TT?mwYz@#%D;BL4hnC- z1vp;a&B1Zwif6vD^@fv&B4V*ns$iRODb=Q3u6i&MbG~nsAOEP>mP8(!23(u}1*0=3 z$r%pwVEs^m|D%Qo(g(4^f*Ox0%oRI1yNqT`bkMp`PIGj5i zHVSXp%wp8~=PmuXVj<;1x~Aa&WZ&!P|f)F}$^yO}A}WyEI?uczUqORQNyr0TI; z2+fT&8ucAkLV?J(mJPP0zAWrfvr;xZ(ims z&;`!vy}FsB8B-Y$4R)3_Ypiu9b5X3kw9p7SQLAI2z;gx7M$v4K{>PlC)h+N43G|#r z(1`xB)?jlrgG6%3S#`i0uI1=&5+8e`k+KGN84_vXrDw6Gkf(rQtpS9(o9;I1~?Sx!Q-CPV9OwHpeHnitg+vOrVP*xOk;(P;2%p*dJXR7!dM_Fkacr%KcCk9>!A@(~D33l{qFO=^ zPys_@NV`;2${;yL4xtlRWydNyya$_pXWHyy$Lwtytx+iAEgr%1MCG40ZkSzNeWGvU z3Zx_U%cli>FPfWH`aZaaaDPs7^`V7@;|;}yyZ$-kpKKCb zKK~@I`!=JSW%b5lfz>Zx+f(9yX2r6l?xH7}dv2I4I6gb1Y_93J_R`+g_8m{1vlTGO z2Y)avah+g5y#O|~v~4vCdeosB*TWUdch#e(qcXJh7}3+6<5=UYp7d6?ORROzdAws% zROE{5t2x*7eA!|PrKKdy7f<+Yk*4jzYo3tDq|7D2%%g$QVrN9=+@mi%fAqjF{efS~ zx20cw;(k!VM4xyy{TL{@-@knM!fy^9{Dy6j-9z%(tKJ39XThZ3q|4;LzPkz>83KRt z{6>COS?fcx!%ifpZNO_UG!|7kiYF)^Xe<^WHXi`=am8?&#c8$}#G+L!()$?!X*g(j z!fPV}{*XDGWOsTOE$>~md{(pBvROXzrsQ%-$3XeolBvrVtz0nIx8RUA%ot z$BH=%5|!NKi&rjaiTLa+W6-##)Yl22NawlDB`jwZH9S&}gzDI$6_<3taLdg3^SYWW z7Dp}ToZh`-+cn@P-P>BcwBRYw={}Ob1+Gv5c;~nvYK#@r_ROue24;3uT-pz4NLz~P zr)`~FXpzP>wYAll%sV?d>!fL$HecOQ(Aj;~qPde}CKI#N#XH)fjm6M0^Wr%z9ua*$ z^z~Qpj;5**tU+Rn4aqKlV=3ZEZYA+mM8X1!&pxpEEch>I%P=xAf7?2{K^{tfF?%cX zo58Zo-`3gm%-LIkd*b{Z^1py_$NY(4@+s;Rn2LU`YHy#nV@IBxi4n?b)cBw=X-w^> z3GQN&Dv@c1WK$tBeek;iz2G%t@R=U{u7Iy$GO=3L;cTq=WUS(8%ZfQmaRGBwteDBP z|2qpipcWCdVP;f?kySqRouwTmzbk8|xnho#-$z*+sF2HQQNqqFRvbh79RX@7>|13} z!^RAup%=eLJQ$C@{o-64zIYnO0M(vb_FcRIYIHsDekXl^>f^o)$>cUFh9g0VIEJOM zxC76vR0Ip94l)|i3XoWwkc(nVgXFXMaI}|1pIX}}zxnL#^4GVW_>pDjA;3Sg=bi1) z-FS*JnoBKT$feF8-2*kkg4o36y&XYtzr5ZIepPDu2rPT`u|M1fw6{M2%33dt{qeGA zH|Cme$)G41-hGa{u1nugYic%i^xW~M_fHOcpL>7H zY2<%NJq_P+5Z|Rao!031B(oI-bP((?xg7Eib#ojr7YFw-a<9LP%<6pO8eTynea1~H! zjj@kC>McGZ!4Owez{k<#=D?A@K92Vz@e~N49MF+kIv`<)Uf^LOtS=N_hot2e47n?6B961WqG6M}P#$nCuIyP>bjKY< z%X+F7xqz1us%tw-z)M5gZJ3D#B4VQL{7}iJ63_S> z#>>A6m5p~gu~#T~6AXYiv4<#Q^cC2;6YBSYu|(z&|785JVhvHTA|a(Rm&_0}v;jJo z46AOeNW;t}Rd_qp5K=q_f;7v1(K>h8L-qW;rs^4{xcqWlGq1V2%M`z*$ksADUUB>S z+g$}(Kz=?aJ+U^!~?f*yHcfdzgW&gi>-+S|>w>Q0J`lKf_nVIxXfRKa`dT60{2_PL| zXkr5urKl)T5gT?aD7snuT2L3a;Ln1)xVyHs7a()_-}~N72+00)KmY$fFz?;^%6+$- zbI&>769Z*&=?HR_*glK7a&$buXKoKElE}L~AsJqgKU5P(FP2Kt>A9d{{)Kxr*@7n3 z1v(-?mv&@d2GXwVL+Kuy>A-2c3`wM#O$4gJKqV6TgxlkNDK@RXep=ykg~}XxX_&4J zmnO3Ndc&nvfx^c_v_tLSEk=XU!s8GP6uz4CbxqEk0Ec`A(>nj4L0PM^q(LcaA10Id1)q5Mpm{izktGVY2Q2Q*gQ*eJRBACr@puIbLIEL@7DPWm zjku>lcqhI;$s6>={lta0XyS>feU>+wg*6a=TgdV8SP7NI;H4T8kewi2ZsJsyKaS%; z;sXT7P3s%Lq8I`ZsuTP?D{`?0p>G*Nj%v{AB_o@h2R&;uI_84kDJ2!8iU{(6(UE2|vUSj0y=3{EPz<3MEAZkh4?@ z-}u~5geN5)?UET^(Mg$TyH4l@-XwIC1kaixiL}410I|9?8aO_!p4Hbli-VRA!v8_#;~WRI1yY20!=v6?X8MN?3Zmg^1^!cmM}mWf2H#pUM_M2ST>zjS z{Qe8iCfOTAofg0o0R{?YAoqc#xc_go)X4~&` z0@ru0ER4rW%N@18Hu(Ae>YSeNB8%V0-zi?j;{K{A69Jq2>txg#-bq;I|8C!nK(}n zyH_vOCP*VpL^&`hDAAMswTM3r*c@Tg6sIXcfNg>y-b_4v3)rTZo}wjO+R(#{4@@-T zkCk9<&_7_7z_Wvi8LZV-qkmUxwGzFgXw}MMi5?v*X^zF3!S7}-%aE$MaE}!Oy$jsTzR>bSvL0Td++;NVs(S)dH55%@kQ}9 zC6b&R$u4(6flxDj9-LF@ZezX+W#!?k=jO0_^u44tt1`zGQCZEaA9!H3)uJi}Coj&I zxbW;l5SbHc@Ueci6yXI$l@ljmV`)W|D!_$|qywF&CONJ1(w<8lLHq8d9V3?74ZIy( zxr>}SD=)ocDHw4f|8m$~J-mC-aP*16Za1u4-LYhGJHU&ngO7i-dY!@U;Mdq3YucAA z0S{cr)sQ*rPA~X_C50G888F~QV%`c z_X4;U3_0`YBYm4*z$tX;a-trS+WXMYXC4J|bUL@9A{Q>W|J&~mUQvEK`ti{-ryd5% zs&e#gPDMq|Kz@bbeNX}7W?XcSdJ+1V?M>C9tVx?-FE}x2Q|-X-+XGI(-c6HGR;qRr z<2+wsPl|swDaHH)_h=cuk4~_54+yw9WO?vdflmkUNCHFa?10A9=U@nWiX_|&4LD~oIt&J{VgAvV4G-hI#pqgGW-vSqTyMOA{?^xV zXUBdqu|GIqe8~iC)FR?rh!WUtV)HQ|q)h{PbGihv?SMkuCq{n3h?`nsxpqfR4E>M} zz;zE_X5h_o2?ek;|GJo<5eSx{NlTr$pJ9?9>3G4va`nAm>yuP(DYul~0kR zHfJB@;anW`_dSJ!;OFz(S59T0m2q$4`E(<7gnErSO1)40o%$#BDfK1w72!c$G*Qr3 zL#}}J5lvDT=LRMm4T=UNC5dW?rw78K3Ys^JNNkfO5zqSqM{Ukf*ie#2=^%oV5Sc&( z8#!}AO`8)1T&Mu%5Z5c1EOo&eU^HXmPFf@CED?oO%%#!fg7}F9$}VB%fCx+-s)kWK zG)X2O#i=o)2Gl_2&$M4#E4vOtwpB>|Bxz-yq#st5{-?!Q>L@(G*198G`hylksi z?Nj7RIhZ}X?~uAQPefLxcyR$w0~ljS=AUV)}eG5SO1d|eseqLIbM-1TxU zEtAXmIH%|vWy^KP3rg911?^WpQiR^t08XQjav&F~IC!Z+2b8I`BbAb30E8=xJgy#( zv42x$Op{HbHsNJ0nBEN``ms8qxjEnENpAGphYlatomjdb!WL&kQ`xTNtFvrvb%PDQ z!Yqd~w)SoGIeHuY<4?&@MaQs?LSEhMt8)4Cq#Mfe4(1yDqZ>vhLJ?kV@)lzb!ywOc z&@|(*bIQ$yYK>f(XE8`Q15`0`MnXf4TBDONN>FIZ&v%R*1;XX!VE}HK*mRAlM^*GZN`LxS7LC}Tp=s~i2@Nv2#zU{1ib`}XIQdz67W%>n10p53?ab~WbNn>tsHZds}vbw53O<>=-m>M_qWDs~HH zTzh)(KWA;Bv1KNl)nY4XP~wc{IYP$mdz=kVjZrLZ8@&>|)w9P{TVQPJTs3+~w|2~f zb;>=8z?@)!6oh(m$L6`@j`*Le;qX`uey~;3nhk|#c8*>(d9Wj|Q7AGeeM4961EUp7 z8FTBUiqTItq@OpP)sSx+HfxpWw?o9t7(|VuCQwtT+0;DhO6pFspA#$;T-Aj{WzJAq zLopE~)1ky5Dstj~g3&S2y~JaI$b|$QPf=x)78Epnq*OwXh9x4bIRpYa7MSS}o_5WE z)!|P_ZXqDTi2EW!U1GY82N%!@qU=yfNGE8wBy?;f4`&*6a62#?40*X+Bh%0@!os*| zNsDoVTGt4rv!o#xgn+e~EqXZvBmqTv;S4CRSIDdk18J*+wwBZ?FJl?iTQsK(x?DE1 zngO)OP~_)z@VT0+&-@IZNHsIZXFWdSue0)xp#oTiPTv*}Z`@Jt88!Ty8mU~$I6TbI z2L?~MZnVZ7kb|9lr`4$fPQ?<1Xbon63m|56D;NWKjpn2>gOiQH*=@$F~Vxs zSpv|}e>?!{|1Q6)CtR9JGRevH=e#T5>0Lf3Ma|naxn4qrOT+jvy259Y{ndc_VnKA# z)c>Xc*bb=Da1Wx0H*catFQL-1n;L33o&y$9>je*j4^h9P-l9Ijl-OCI0d7zTYA&+l z*Y6}zYof%~zv&oRLGG+Fo_tUy{=zWL7Ioxp)bf0vzI~=G-RIqy= zz2En$pjwwiNkO%)6!=L2$H|kV!Y86`9h>&OO!iZpg4AdPk$;JN52hUnUjjs5F(AE! zvJpm4EGqEq=kwwW;xr~Opfte-2?)MnL~;t#XUgEXs+P5t_}IFp65ThdwPjP2Z~#{= z2l}VHHTAiTU)9v7nxE{x`)x3!YFw~#O)ELB1v6SlHEn7k2PRxOzisK>q2zc=>R9{o zMSGjuS1h`<@CEeg(t;|dqI3L?F~=TUeynYNW%Dgd@p0(hrE^xaH}74vyuJC>Ma2H< zECq=#aHEL1$eYr}?&8DaXNSE@rsPAvt=Hy<`BRpR-gV!u(e&5XzZB?uUC;!J1zx&7 z`Q5Fzes>O2Bx85v##B7ev7vmRA|FviQcYup2%D&wYDvOmDp?DkPBo>P*wcP@s@75O zNY%Ri1wq(r$}_>glfT!XaQQlzB?e2 zCx#EB!DujhD(FGA)>+X^!jqaqyC((UQoWj`+)}@NNvl6 zR^A2V`@5fg_SsYw>hf1>PpH)=ApRp~ZM7ft1Z%ZVgX{3IS1#|>)&^1c)7n~5rh=pt z3-No)aJvVo0;-Pe)*3xDK{gH2n8J%fj~6pPl-MIVkHHl1L}DdAPs~Gjb)P3dJdfcV zp~KQX4_Ar+INR6REdhJ<2WpniW!WVH;E z8#X_3aO2kfzw?H{C96y8fxI=tYjGKz`w&5A?e|(B?7^Bd`ez|RnS%icMF|7t1Hv3q zh{u(nK0|HEVc<@4&PhSvv_e2(q7t8I@wxMP`T1-iB@%(3>|cz_$3Y+ zZkRIXW;qzY>)5efH~tZREaQh&qrZqB=%?+kZre6v<~BOJXYrEZ?TgW?2bPu>84UOu zl`AbC7A_P&=1qepuDoV;-?5#$j=ggudJY6ufOl~^>Y1@^+pF8R5w!8MV> zh*J`DAVCz@*f^%@O?0CMqKSCyD>#kJ3)}Jz-B2^N$W1fP=^!Wd4ZlW`JfbY-^@DGe z{^J;T-`~nop~Cmj3;f51_OPYcS7a%IyWiC-OscTI%G0Fq{u7j~-TpqBwAr76%EMPBf_D|%LupDifIOO`dql`u{(^jd|*IYIx^%=U!>7yBr-47Ol zc@Jn!Ci>ADbj>qLFvIO&puv=9jiZ;)&On>b;5C`#dU^<0@WPiP(ba}A<8PkSpi%+a zuF+J9eWX?@_Ia|e+i(sog7@IoB19zDpEA&J)RQqF%{UUl?MJ$YnW!*;6O%Vjp1gS@ z{quNek)I`m?`CX zY04@_DTGP(Byqi&6pxsmOXAXZPF}x$GMcnWw5yep={8DLU_QQe0I&AHJg|tf>`8mX zGV>X`S#a*%(a_T{GX}gj;}Ozea?>R861C*4G@- zhW-T8O%{g`xo3(k--|pwtyrawaCHlinyNY~P&b4|2Fu!9_TYU?{>(HYQztLlM zXS)^7Ef4Mk`Lm6@GxyC4;pdyO_@!Q1uE8m_&sNyK2phNMsG?S%)U#IQ1G+-<&|!sK zz~#=71{$lB*%K}h1_9BRE&e7vp@xZHHjd^nj~&9H1fTFQ6ne)3%!tj~?n1{vp#^;k z&fqY}XWmIY?M72w=qnc}go9mRp9|<*cJsh1dyk{KIEaWj&(GgPXKMwPM)$JG*_y&p8DY%xvJzCY}QIyR;rbx zo&}!+Ij4|uDzG5AP9|HIlr_Eex=jAsTQWQ{KmXxNh2qN}lx*MkD%JOWD)(nUYGvGy zpGjoM1Q(*sKXMBFk6^7{F&yQ6FIDj0gLipF7Lt5xG=2+C%T%hA4t|Eu zAI5e8fs~@M{0ThOkRAFeVEW%SNqDs_(u55s)(=!sOsnQjFo#fc;#avQa*2G9EjZ;<2+8&q=@BuQPKx z5AmlgC|eT|E)b+;WD{4y8O1$w4hnwzh&?+X)*(i+2TN=YDquvgzsIkQ516u010XTu zNsgGj$MC<9ful*$5V?wk4f@EKEMbp0!ubw!ugd~p9w<25P^VC9T#@@TaTmLwYe7L`ijHUhI!FC)hA$^^2PjE)Wk8#F5X zI08b260F_26PnnTsJ+w$S6D7>DN-}cW?_ph1H&A4G@>hHXet!F4=&~}=FBWy0N z*o2uY0D@tUr2?Jilz@@j!n5;b8VE;sU$L&^mPlA*ER;Z+b*&k+AK5LJhsV*Yb2_;I z9cCDS>zZ(Tq~^x$m?&;oIA&3)!r}mcI9h02<@gk44GmIt~kvezZgb zd?f|MH5&m|C$yapw>TY*{c20kZQ8#t$bU5|I2n5 z`P}r}VY68|i(i_7EJx380lvoG z7aGu~&9fOLje8d(QOs*WA2vSw{BLN6&*sg$o#Um9gyCe&?epdV9k9)xzmMY?8ed1b z54XwJ=#z|&%)s|A6?B1rYYSkGQuNb}DGh?`2z)v+atYYtufKB^7(D69mYjy+%{4_G z=(>r3U9qynU0Ut_Z7+DY#+>XJvC_`ZPyGp4fKu=281L3x?45F`$Zwo^be>qk3>Z;e z%J8eNz$E*qUb6Yo-qVd~(%(FGHR;K{X2~>oK2^jrpAE zv+>v8!AHQwbwIEX7PO$_d@M?wB*HWq4U&S%*M_TPQpf#DaA)DZzv0vwPz_%)+S_Eyj-?UB` zGhQS69XBN61n5y45|PzRS^;$>6d_(g3jj$m2r0kbIWdt#d`BMGL>Plj2ejajo8PcO z8#fqP-HaJJ)~J8hZWudO9}hylq=bjO;kV3A1yWP$1aT#Kx3F(~wr0{Fg%}A( zdI4z`wG90PWU}A1j?u|XU4V}ezke@ze<1G!a@j?`e}WoD@RNSin^hCrQ9!iciG`_P zzTz=)wBWZ05LI_#zKE$@OepYTS&|w0^^e~rwJD+sTKdEjQW^(r(!Z(k%c|9XyD%Ls zS83o?(4?wKpMO(};41|2mA?B9Um=LE1oCqyrUYv^s@O1^zH4o{32a!$+aH?4qWoq zduTWM>gBF`zZ?R>hkJiG*1K;#V3eV(*(1hwPM`4fU(zytPMp^ylpJ$Ydd!(x2{r%^ zbOAOIl7T>G!x{5#IyQi56rCaMRE)4BA`AUjH~~G19{>IC=_n3;haPPOTD*9DeKlxH z-Nn55d-OO^rS77m-o7`DdB(msysRC zbP4)u1AzWRUH}zq*IrX7R1-<5M=*>1mFQ()_G-vQy@r$r4alafZ_DNya&gaR6 zf`p?Vz=P=B>v1L!m}jD`kiiRgvC;G{9+%Mp^La(DTGB;VesMRWq0bBkkiGAVOC~D! zFPqXj41^v#04#Tc({J3f_R87X8f8OkqO~=aH=?d?=!nI2tM0yM&9&1e)wh(iH<#rO zud5&0v8ZPCeXy_KmDT${1@eF1b;;B5Q0~$@%5Oe$JNn{Ii3NSVdi!+4P<35HJl2@g z*wN9LbM1;%+ovw5t&f%s5)-zaZ+{?SZxXAT1mQo66Ce>RNrWU?DhnUI zAx@ta7ktaIW;_9NCIfu!m#Y7;7j3@(`HuTKoFgOy@x^>#j@0j>6WU8IGv@p9InlG8$3E~Z0(A*-Lpql>2xaE>8+2n zH_w{0aWG1u8UMKPXV4+iJwjhoVm>!awNsO*1=K3)O6n%!ZzJd@o)hqY%+zuC7}O@r z5{{@{6Dvk87EgrY33Ht0h#{ARsP33?7fb|0L~EOLOOlI^5qtrB89Y&@i-qETN{f%8 z?j^2}AXS7~q$^MZjA0njIOaSxczWL3=(c&~&b+!C-`CZp{x;HNFPk>4%*A*3SZVn@ zblcmdb-MR&tjk;dsapLncf;Yb&Z3fuB}JWOha24gQma4p)E}-GSCqFPuV`Gw;d+!) zS4xTpeP#1N7o(k4W;c!W`#N}6nW@YdBsVFodk1s@)z*{fMRWkYcyjC3lb{lGg36PR zU1WgFs+YWV&|4fSyC-jq66ze4C7wgz=0l#+Qpb$$h3H@2gKtUdfpSdVJ!KI%p*?3z zPW!~xI~w%g$mQSY8}0x{K)AnXohT$tYPq9P|FvBHwZ8F=78tCDiZMC&mgbat4!)JT zAI&=CDXDbKUf4auQCjK=dT_?QIb#$M-x{x-1&uuKcKakd(*p1gSF_@q9MhRreZi_ph)aweN8Rc zIeJuQG;o>IxnxXaj)vAX#w>JTR(^v|d!(UO&AKglQq3j9Ee;u)YEOVo1!i**S{ae8 zGIo3nmvtB{?!sj>fX4&zil7C)=TF1~{#bnE1sJaqsu9maM+6LPt+0o=fLcMkdicD= zzXDBGBoZJaL-3?7AhWPWt;Z{)A6bUpwwBFrzN?bS9=*`PSneHh_2I(4=kmwH zsgu2)38`DgKk{NIT-i0Q0!(3`IC2e22S2-b7G}cyxrm>U`g`WoIeo75t5y0#=X+ z4#q(u0VCU9K@qu;n4}O3aRD1ffSn}TyCSd<*<=>LkBMRhCPL`uCBrMD)v=%Qf!)aB zVWKt$n;OGagSCr$z`ysR?{2GYFq&D`Z;X~reKgt9l6>@ed@7Nvg4y!gNqhgg{5GIs z3_Xi|4a3nkWHEW5-LUSv-#xyuvU8X(r+sk&9@yXSRkHznXGWE-j!#pU%rS%wYJSc3 z6@T43aW7s6_33qxAT_5IWfKHigjjA%+(c`gjALL-Q&j|o(#H{aO|yvBly)g2DB9xQ zCOVcO`{@Eu3=vg`jTF-YwbY~nI`!epu0FhFOL0eK#OpRFK|)V6tz$!enNep{XaOd& zDuxW5|nhM~>yJ>Fv| z*P5!8SA*Qj`h+oF-qtj|y__A{pe|7YmIX`xupoDd#*k%nL%`fT$Pg&VVJwoVdK1q= z27vr9t+B-e;gA!W0ECcMJX=j0vKtr~h!+4pLw8kUI`eq}C)|T+tF>^Y)+pr{*O zJQ?61L;8a-I73{*Pf$e&vK-M~F^iycT7gnE!Ny2-Zhd`jHf@cD?fLokaP*5}F$Eqh z36Ydg3Hs3;x)+_i)9mxuimL4$veXdt;R~SkrH4V;F}Uc;Wr{0#1IPW0 zydx3~hoWeTBQM|X$j<{`U6^nmb2B=%x2>6`<%|xlfA4kRz85&|-27>(X4#*{KE5!p z?OWjbcH6e^MEnxTS==4ZV`22CoP|Si+|%r&h`yM#s$z=P`gujIVF{9qQ~bPxs2s;U%19f5Mz- z)_HdYnY*U%33$NDz`*;azCnN1JJmAYgu(%u_DPaH^!f*Y9-<#O}NGCH3wut&Th zi$u;iguFbP%MK-S0l&aUkUm8X@H;{@h#RQE znA$OVVu4?13VUL_(HA3U`og>m_sVcN;-(UGp&lr>*Gl8M_4M_eI3b}@StrgV(#dmS zSbO3`Uk}+K9RMO11UL?$cnDcTFH87SgCd#+dzUhfJ1@Rt&+mPVw;h7w-qXE)6 zvv4||omk8Xv2mt%%QMfQAD@9}&%|{&xMkf$Fb5L2Hxfj9AOv$JLW&f5W{c8vXbj03 zbI7C=tKpCZC!RM}15}Kn{GttP9J5TOsJNAkml`hP94{dl#QwsRkEJdfH>&Cz2*0Ts zHSV&@9$p8(sUC>~<3?701J^waE*nTHr5;{azEZ2!t}I{oFfPJrSC(D&@MUEywcNPN z=o16!Ca#}%)ZuSkO|?+ts2P}hpeSM6SJ>ed1QUrkFcX|Tjevk~j**KJT=j?>@WSSC zT5HyXm(GE)xY&1v`7@MOT@j?}BDPD32#scdgA7I11qbrv2CGVuqxWtYWu>1g_`Z?n zYsVAZRP;9j%PPRBK5=_3ALAR($dxMj1er{3lXuGBS6CFCa=FYdn;^^5s|DbbF7<K-!j}4CKp$084w|1zSKMPRxLLb1-CP z0|^P2;E7SNIl=OrDUt~B0XP-7fqNmkmHp)&5VLUStgmY>-}O}teT+VieYI-nBo3Cjq;4%G}^0bPvlf+D(p$Du&<5-GZhJQswu7fnt*?+8K|w8OLiO)Zd2A+!-~ zOd(ygecNL|1*(Da(6;ud?p&Fm9VP9-6a6~y1H6l(B^OKG5wvgEU=ODLiz?tMm3$5a zGvz8>Nz1U-@<5=xby!OY8hft9D11qL;eNSa8W+JJXz!GzalrcLC7vJ}5kX%jK@cTG z%%C6IjqMM?-k>dLLwG_y#aZCL2)wNr#WVRm7Ow9&fjRbVnD97eky2lLhz-r2JYTo;_z96;Tlf$M|wn2O-sAnL|t3fBrn4uh9Snd<}1^KsqJ zz;yvZ_HR9_l>Afh+h?T81+PQ{Q4lWT>(a$y>LxD0d&bQX7p!LSsMm|ucL`b$`=|XS z@PhLN7ci&S0HZDuH_>y~Ke`_O2S2Xs9KU}3_|A17*A72(&&Z1034tw~QUyI59QF>@{g{P2iBwR@(%Enomm}-b2j?>p~b$e z!sueq1fUe42bV+&v;0dA0sHKoff75E)9{HQvt|uRHEZl8q|IjF^>A-mPD}74aL*Fl ziRt(RvB5VcfDU*#B7WuRf{q?CcV?fh!Of(|#TZ=7r$o#!tSWp2blXPuda@ZB^YKbns?YJMo*kSw%50^}xO<}koBF;&HLLR#f#t8aNgb(9wxYZg zT`sj}gVyq}j1IzEXr~6f++YFb0=3HpnlFpU9D$-;lH=>q`>HIdY;umqs8q|FA8Xg}8fj+kZ8je}!+_S{Jt zxlf<^{i`8^yhS60m>?+(gPHf&OL(36gEGOsUzFn{&$E57Q$9?$5}!5r>j_kzPJnrg zo%bU&tguPw(HXe&ARRn0hC)P=pAsxJSPEgH>D&(!dBKvPBzc-ru&-m9uDktIvb`Hn zq|#YT-O-d#kLs7l3%|Zvx>p1eW@^v$dfY+gy)%NYDpQ-pRdXm6_h$ib!Hws(5tuGZ zk6NQ4;l<2K+KMJY^!)@NFaiI{=OxaF1@arOEkZhvDHt41t~ch-7fiNuo5J}%FXg!NTGNPtw*J3{bLG+ zZnyjy$Uqxpo{{fX-C)Sd%gZvXjo`msdX>C&+_+Y`O1}$erE{m}RafWj(ktbgckI|K zSK>sC?ACqzZk3UOPrvcT)1)BLf)ng!gni6`QmGnh7&VfbPR*y*;K6x;PdMtoJQHk4 z5!EgdADA`}>rOjB2YVom3zEZ#UIchuI3e*w4;vV}Xd*qVWljtJk23W$=6EbV3Q4cG zl$;hM=PW+P=83h*fAG3+Laz^uT{JP31m~pp@T{2CE5K5V{06#9NTaFK6e%YmN8%Ch zEX95$A-H;jgnba`@e!Cj0v{k4L6MEg3Lv<@5hf6#WFfkAGWbH638aN4N@O(BF;V)J z-ZU0@^Q=LZNkBGaJ!7=cGN0ZrV}qNv%zmhQR?MORG{X$Psi6JC#aDNB&d|e=K!J{% zob6FYLwKlUJ!rXhumZPj4(&)S~YpNC3?pI@|IgTOR^!;J};%aL=Ij zHG2WrQ538UjcGEOn-^`o6<$-ES6t8(*MQz+o$1F1eebfGo0BaiKMUPSijUA6*e;W2 z$rCFJ{n}>J(4_D{j+D&$fSpyu%{jq_SHZ%<}*f(6);A8OBE z7^9&`G!ZW;1m0X6iADV-{X%_z#O!0lxfsXd>5$j#4S9otGzCwy#gUkx+FEQjnv9%- z_>1>R0#PE#@^Yg0V|>+;Xv7JGlhGU{P)r#%y9VGp2T6uGA@2MN`{rI4lxD2nh00UqpUOeS7$GU<76S0&p7wwf?~!|P9*{bsX& zE76%G<;b2pV4zS5g40J_PHUD%?Y3xKE|1IUaUF0vbvEK?#G!e#P;IuF4N8;8<|T!BDN>wVpsL17T6dGqbgCUp4q}Cg~+)V!_v(n{q%B3=yKIC!oYQ0WxHtTt< z+TidUb-6TlXDH-!sJEDvPA4fQUGH>iN<$%sQ{6^1h9RLyAwx5e#Dpg#Pd$6!0AlVR zjhkvVX_nFRK^3SRIUOBC?@pf%@<9HY`RE1o!aP!9&TL$w?>J5C3@VjDqf((VNXuD3 zT0zC;1ua%RZyB5A76Vqlm7JV_5uO5y?L(Aq$ur=G7>)BR7K3){Fu#8o`876Z4dLpr z!Qz!bMy^p<)E0w>1a)e&&Z4$*rYd`Ow!JE{J?zd3@g|K&nH9qITYQXz!4IfwbF zZXbFP-HQweNj$b--vje@&6~Fi!0QHgjvu`J?Wa~OUAp2au(f?|OLghgIvMb^CVrMC zT3Zv`&xuy}Q`BR7-|kkG%v{nu2|X5!jt8y(3g;Q*dbQSQ&kH2NzHF^ZqBI%odEwfs z?AAbCq^Kd-YM8lWX6i|(36I;c;hLf#e39IAo)nBZaRS{ZEA1?8E<=x9qiriJL62>L z{xizbwzg8{dweA1xW50}K}?aWF(2x{^mq_+qr<5Q)KThhcm`*I4ER9}m_|{2Gz1c4 zGRE^-z#KD|km)xP5KllnvC$B5>dyH>MqkLs`FOm_Ma>CdP&3{jo)AMECiKk-T+Qgy zMUCRc`i;1BcwsaPb3G>e6A`i(m^ea$q*sW{;LxORazRK5@u;*nDbG_@JdYbxm&W z%cgtV#BR7U>Utz$MlZTc-!V6S7LTAi!PrE}F=K`ML8+91x-$1Ym8pD-$*Qljcn8(p zTvU!ew;FA_I)Is0v%abJree&O{PnN9Z@dwGSr31jwQil)TO9G0gg376`-+QwUs-A| zyUb$^)TD}e@`1>mWtQtujE1{DXvgw9T&89%NKVQ%FEH^6&2%E zv!*lBu@=i2b66(xI^+2s<8+{LfqN`C?s3IrK8;DvO#>R>OkIlaT8i%q??vALP3qDy zKe1?IYZcwCO8E}^zi`=|%0!_*(r-l)?1M7T@)IKmMS#D{_D0_X@wO9!65uyq$spF?VB+!0C$w906K~nN=NB=uI{Ym=g6n{Ur7DJ+0L}Jgfs!Ns9sMfl{wE(PO58ST;#f z)Aq(8GY6GBD)o$N5D%W0vaJekULLC(#!5r^phJbD)LF2uwR)dHxJZYR`Q=4ygUChj zdO$AnfvQ;{6s_mssiABRo=KpB5Bs?#=h4;61I1a6K-9A`#|7pq7~{SEh!Edi5#!Mu ziJZSgDyQMpzX4Vv_kBx0{I&ZMSp?GDXB8@9<$!*C<9MiB8fy#eNo@&&kB~;>l->+3ySI*Lhd4Ghg(0S zYeZ2LGh1C7^aZ-=yx`ER!YpMDxKg9aDwNAN?Xs0>3wP~;m*j^B*T$rqclonMMypU> zL483%J^gS|WOCP{n#8=B722}Fxdt=)Gd!P5S~V!(lbvvlnf7T#omFL0+dSP_!BA6q zokeZdx~=-f*@0}}TeQ`(z9Ys}yB}h#Nfw{_^4KvXaum)Eet< zMQI&)k=(fueZIJ+cJq>CWges8 zW0|Znz(in52pU_Q_@}C7h#QH_<`Z7L%tX~*VygPGr3BUPdUq!PlvZ0YI%_r)l>+(C z56kV+Q8@54AL$rZ75eNsX=!_@bnSC7a0kwT2hrYFOIqgb+Bxr`tkD%(?aOLuyci{rJXL)lb-f-WySMLF=gEtWUdIPWDFbT}Z1w?zcbMIlobVM8373zQZs0^fC zGipKq+a)|fI-w`l1HbxWjQA=;Q$NuQa~|I^>88#irZ@AVJK+xpsuop&hEc!zq7SEE z4tx%O9=EJ!+JY!bqFV9AH#`HhQ_)`Lp03~e;{6!MY_ea@l^~i!#CM@Eh3Z7Kr(cT$ z4;~sG3CCvq3W@{7m+=9S5chH1#M29;E)LT)Fq}F8dW$$YdO^<7i}dO)(Sd^?a0Ia? zO&O>8FI-+#M(>3EZt8fMuK~ zXgU&I1OhokiI6U|lTc3Hs)5>48L=AtPdX^fx}i%~mA#3+1lrfVBWHJ%YL{y_4Y}r# zC$~3VBa^I<$oqaxM+F>R7-`GJKP47n%7)2Ou}&zCxkDuV54~zr%z*7rWS1mX&wR`oJS9FUG zPK!bi^F->${qDhAf&7-iwS1{WsbCeUn=O`*4ah=O%iA#ZKQYrp*U6xwSgBOWMs|`* zf>Pi(x*Cn^*V_{I^?YPck1}bAO^`tYh&-Qo1Ytuw@rs!i+7o{lG7thrN#l{pAJ37? z|0uV~=ceuo#9lv3)g}XQ!dx+J&PS8_UV^o~sa^?n1pPGWqd7S7k8+`GvKCOU$Aq#% z+MJIkpRN_k_NMj7kRXT5PW$NKsLWnFhzpJzOq7pk+7eylL^UHB-ZVEK9ojN=)w;(g z!gUpWPlvXS1PuD&FKeD#TFy0=R%^1=*1G0db0pNHrkZi7tJh38ygoS!HpI{T*s{Ph z_)qBjNq4-loQ;IMf%-`me$9FE(ENThJprLQB4B8W5SK72#31Q5f|trPV6hAGMxui$ zV#jgj967v#75T}E@r z;>&e8g6*ARrdNpMr_1CQwELYVQ<#+bWfdV8*XeGrC4Ldaf3@x1XQ&~iv0=Q!>)?Z( z@IOY9M5yDiTkIyambcm*POFvIs!ce-A*2c+P}?i!I&5O@1qE$ZyQ#Om8}y>u%&(i) zwvHSYbLLsH+~vU=TmEB29P@&_iY0Wo$4I{Wi|=p(wHkFosZ1fUOh}*hx5QD*SgMOqk_5My5p{+o zA>v)RAGAcY5y5L06xE@L6BH3`TOxqE5-F$817<>IIbH`pcdu(|{PPwh?$`MP0H63He zHJ2*rhZePsE&@uEi`igvn4626=vs--nQd3eCw#Nx_ksA7_VvRrcZ`@jF1+Z`uAZ-^ z)Wr69{b0{+0PL9i+U|+L>S;4BU%Dgy>eTj}$}G1zzhZ8aR(HvMhBoIY?D_2UVk0ot zpSKo_6=e2A_b^nF*}n3bFex1p@kk5;@-1HYOoHMnOWMe66zBd#KXkD$%(>`AaO(Gb z=JSVT3@rA?b-=(+3duc#qU~#;cIpggIARAQE2cJ?%R+;OCr8eFVjj&*dT`;>lMIT= zoF(Iz?%6-5`_clb&y?*?l(yu|-!tbtKL#fssF$k(4yaN9~_rE4NKcOZPz%b zRO86DvE@zI74Dq1Vn}iKQ!~JVCl+5~w=8TQ^5C+$_sm~moKilatTAN28h&!V!2_L^ z@roFtQR;lpyMD5rz+^wR*QU#%ar zzWw)^)qij1(ev&IQ2Npt8shr%9!8k|iHZk45$j6}rj7_I7yiyQL=+;?lCcqrVlp3i zIFp$XK>3O7f#460&<$C53dtfq$`T>6jFNtXQwYx{xTlTc(H}~O2;f>Y0#Bot!#>NA zx*?m79NE0|;X9w!mx09~3uR58Yh>9Yn=7jx)W}U5qfh_fq$5BID$yyl9i1B9REPHI zJujL2?m3K30q*dUnO6#`l^_Wo8~vfE80j$p#e|uML9!|9jQa@s`N;KOjjp*7Bsb6A z`67@Wv7kP4iCWUL?x6+jm$tN)vGxHhwFeA!tokLikxo@7?#|~kG zE+*&-{?lPdB@GUT0VWOLASs-p@F8iPEqesm!5CnFL^jt96a(bHPzjP|r_+p*u7U!1 zN!Z~CJ5m!;cO_%PhQ*TN5l-k{1YT}iURk-k4VBLl)`cr@-}@P_3k3vQfD(ti@a-@U zE#g>3Jp=_xFeC7Yf-H}TA(Amb7z0s>68C|SIDb?Cf#CEL=pa0ouun$(sd|4T;)l=q zfz;fWL&Eem!nWF`=M5?XLhO@vou zU6Igfkycz+Lab5z;zoswNkjzrBoUGvj}s$K4u&MYwCgoY%(nLudifI0jKD=bvUBNPRjf)O=l{r52=007PrgGJ=BHl23_GYizoTUnu)jJK* z+pHC*ZvFc$d+>KEMSoZtP%3j9$Byf8YB`Hm!#EnNvTDZ%Xy!_p)B{JvJMQ(ANLx#l z&WD`2@g<`tJ62aYv+wL^+w{ByN(!z|E^3pnu%_kTNda?+Jyzm8ye-9Jm$s%Cy)quw|EUkM>eecFQ4nKX(jrXWtXRD%RHF8@# zGzI?osQR8v`WsAjgrvtp#R;&`oiEWi;F#2{scT2GR-Gi@<;s`n&5}H@74UG{Sk|Ir z3tYWFQ&4-`XdWMB+FRXuEra0DT?O3T3|T?m3erAr`acTTcET=Ds_y zi6i@eXNy+77h9HP$+9F@xyX`igJs#6Vr;;eX1eL7n@)g$=p;ZwPk=zU5K;&!dY-#w-%u2RwxZHj3`~Bkw*6!@=?Ci|!%$qlF-upaI z6WM{D(kdBY5lRFpuAIJ3MICZ4hPU2> zqe)9idMC+ZL5CD*tn_WHwpgmy`6>+o#JW#NvKahEOVT97-3JWxpei4{=Bq-%w2D){ zs?}SXI?gw3+0w)oG;N`uTZnVP2iWebEH19}wHu9JFb|rnN z>*+0tz6)tIHDfJ8dkV1Q|B{>R3U|Ygc3%Yn_zD~VUjYHIhMskNX(Y7t`0=Go>(b-k zb=n=d2XX%tD5D?hia(CKgQ*jbaS%0vnnX2IbE$>Ya#Nd_@&<}LQI7%0zZFWEY39u77f}@L$ zsA3L)?f?>N3TWIS9@tGzlqZG()`D$nzZ%@7#dm*ivhgqLk|S=g5gxxA z9tX|Z?8sO^pI5!|vO-Ni0$068XTxvRx%88O4QZ^#2)tAQmZ>Y@2rx(-Y2m;~xRpht zWLF5jd+7AhM_3?!%(@?BefAl9_LPWOrjG8u2>*z_XJ&Ne7VvfU2;lr-0|SiWOPmPGhk8#Rf!?e~VsM;Fl=FeOt7ufWi<8O-lb zKe74XTrluGLwzMT>o%AQPmdmT9!xrWXXTg$(bI6{fH7blUDnYXOr`Zp$IVy{gYaXe zzNm7z=`5(7ckhNLW3)j`vHu{tznGHi1TQ~iha?B+{D{r=du>>`lZnSOc%h3J8NoRn zPrO5!{3d?d!S$=poc?0Zo-a1sZKkT{p)2EIsT=o8v_m7=;hh5$wE*-mP&)8D-+L~FjIvy&mWTJz&Zyy|C za&jGW=A<)Q*?SIFMTU8crqAXCKKdA%o5yzATa5dk%b{<&?gCg%Kw2TR#R|A9R{eOr zl^o!gR{b;_MhAH1)?seTcMo-BJoMe_nbO}Zm_9fUWWTyMvRk?N#4-94gVkz?I&eZ- zhmX-+lMc;x~%Y-3xxx=lMVHj_j=}v42cqZAt1zP$byS z2!7fO#8aD{_-f0e3Mn5|N|jTUR9~tF(dD6tGLNRlBkDYZnoZ587E#Nnm54%bL=<{E zqS1S){nRn)A{r4`^y4H)pWT41*GxTs0TZA2!!C&ue*oix{mKvD_ZkBKt&9Q|&Kog)MWkAKq7!fTs<;DFA zEJEXNJHdO%?y-iwm2qCojVxv~Cf?t6_;4Eo54YWae;a74$h&qauc9IkJeeD!e+uP- zC-W-67JTn8PS~>GFk908N^V6(E?13@zxfS1#`w@oM87Vh^B6?ExH#Mq-?cwa1kD&9 zkQKZ{P>B#pG0g#=u*nfuWfvasbNc|h=Yx+9k2tVmVe^cI%kLd_;J4@RpL%HoXS0Zv zhThZQ&ucb*z8R#PTYmBI&W)RnjhVi2?L_MgjXq8D$NS4>mluguhU8vPO*jSFQs%|? z-q>~M{lK{88#XQ<7kGaEp_gjQ*;JiDndEDnv-rbJXMuXu)`uV2I%?&#iD9QzuN|zv z|GYETX;A4>`qXs1=1f(^cvP}zj}RwyK@ec#G8HR}m*FgS(2J!O#D^~lM86hv$OTpMcWucX-vORWV(!IBB9z%> zbkZl^6T~L!WR;BN0ejNyV!G#o1JOjqa;6nhNls=3pPD397hsG&v(j75G657+Xw!^N z-qnR`kLxYy;|~*hn<}nGPduQRfUzh5{?j^hl&e^`8@+ZnVls7r!qC`MboYN;Yuzs3 z#5dr_yL2e$8@6t>KXXAg{1 zU@y8r&xaSlRWLr-6#W;1BeCFb1~4b}$-*m9#n%(w1o>AvLW8 zVXd7F+Zif4gWeyBFf8%65&4GRPXZu39a7qSO@z|xSxS?yr73L3i7Lr|kLIEp>K?@D zQydn{^KJq~{p*K-U>y5T56;9y8U}BhYrNRar~yNOVjm5RrYrTodL=M8IUk;8cpdu4 z;W5L8Y5m$^!%+C29&n;xyFaWwFCkUv1C8E#GAwKZg-=@bnh$h|IsNMEKnP$HABg&k zkfH9M{eI={ZTN0OgHG2F0!~n7E|->p9Bdp8FP2Hm&G1e5u@>EI_|;5UvjDjnAAelj zmrEaNDMi_Js3mnO0Afxc(__9M1vico?0_0;XE7)s77U|1#~u@KdoiIEh%LrvF%}V! z7C?Ypjl7q)GIXe^2{%Nz2~adG9ocUZZ{a8P8!07vx-#^~$T@{fqctfqJUXdDCYLFs zI!}heq}9k2oSc!7RN#SKw?+2dwo8)g8R{GJp^<+515MuyTds9Z?>W|7TSi~a2e0!f zA2w8s&Q^oga0r`7g~D_ZON(_htrOF%R>JT+YZsfvdS1@5$&U2ojLjN+=}PXO@&^2X|yUgF$EZj$n3aN#@WYpWD|QxjVLR5Jj}C z4son4*xE%&W2*`m*(f0*P)CB`+tq0kZlz6jFP4M`$X+|{?lGYRV%1G}uL*Im0lVNL zorv2rf&V5MyErPZUib2h-+Zr@4;j+GX`VCX2GzGy3|?24wDMVE4i+A~X-aM?O)VPn zsnx}?uB514-*2HVWg5QuUyIi7xci-J7ZyEbf^RzXTFvhK+zqe1!i9nOmF_Zk@b?*~ zw$$;mFOSTBtN-l!FW05GcXjYlM5K2$}DXvGpBKE zuDSp6#Z@ruGKT~cC)9eiJ`ncRHW6P}71PSo(#oe*6b|t_`~(b3w;g@| z6d?F=(V2_@&3PD@R>aHDjDU9&>@kc;+7x840G$GboRnpvJGI5y=nhT|78o5|zt=?R zMnk%2SBaK(&wzK&7dv!$vbDbxIdapv#c=ct*cMznzdj?Qe*W5E8>A_bgkhtPXtneh zTAN}3$P|sjC*H2c18CxXmepq9y(08u!|?Luwl2^ZA-L~vYvr=7pKm-4 zvY&`hLXX3HKTPW<@I};@5|Rq)M6CJ=pgp+h>s>0{F8F7yu$zOQO56vwYW5ra1 zP!e7gFEkU}c@j0MfY?A@D+DjY%O`gps}SileGTH=*6&(##i`{Qov0%EU{@vB-wl9& zc^J3yhJ;5+a6=O4|H;F^FrewAIz>Ng-MU%&6!poDD+yI1{ejFiRn$Pd=Nwabk5>bO z$Nh`?;V$B*FcEO#@g1)eOJSS&_}5r{tNQKz+d8=#*xp@wrIEU^NvVx)PWU#cv!Jg- zy3D2Xx21RXp(e`)Jzd!NL*y%1sW`q(|{rrM)N0OOGHq<_HX+VC<&8gBCf@Y?Nj$kQ1X zEi&lfAENK92Xof1hkM{JrN_Q#d$?3+a>S6csv$#EFalzU4JMVRrAFrr3Z2#e`8Y1%Xp}t**kD27h|~19-I0lJmRk#gaR}*u3=P(WL(*rt6jd+%6IcDfWSn&|f6{ z=`jW<-}Qa688sx+iW(3_z@JbA+mzVXCjJn94o1wWADt4-IQr?b&41pj62@RCG1b6{ zl0_&E9?`p!+aD%}Mj$91xqKJA9^nxegkmgdAHdTn2DPCmwy!Y|wc$9b`B&Ny z^_hQ*FcEhnLQ|5yM_9dpOO1P9XP;A}E*I|6gf{q(XFq#s$<~|3?7{1|o05UzrM8!L zJ@IyIR8nCK6@aREIJW{E3UdKCgbbO=?C7CEJH|pI--`5aLf<{3r7)eS;s_^BRwcm~KY1Abd6!PL>+4Mif%XZt@Y#-y6P|fnr+Zt-XxuS!qa)mX9zrWR zKFqF;*M*><3#CpVmm&)5@d@0P(d6~TH$m-jFsk^s;pggf@FPizBu^@R5q=b-@&BZZ z!1bb3nuij1gu1Fk&qWo69|<>J6sRDYhn@i0o$Vt;z9_sU^8HQoD)}~8J|ysvoj`CD zUJ)Rcx04OP>>?=%dO_^tNBM--B@ANpKB5yo70*<$UJ`w`$2$>$4YL?e7=yRRm{F>; zJ7X;`3SRHzBR6;TR&)Xhb0+QUibp3Z0f#Lk!Pln78^DUM-T+Z0!~nxyO($^NV~(OC z2fXbq>sR^JD=HRkIeO+y)Q;o0aFL_^xTA<3_U)dM67YM;kzJ2{8+{zz80jdYV(;QG zeXGMeVR&7@8i~`;CXNl010GkWDwjQQ-!-+R%90uy+u7;&2 zW>jxVm1fAS#_S@eQliQk!`qtc%c~p5gaQ*P3R4sxKXnHFJvlYmYNS=(Avs3ou{o#i zYA)Ugk2Jk-eC?o6iFl$?f|B2IcJZQNI2jJ2|P*sh_$s`g;Tu%eO8OJ?Rjei}yK z%55mfkyyqss)pHf<8tX0sO>hP^+XUOmQVsR3DG?#>+FEwj?7535doEh46RpbqecJ z<6oG7(%egKu(o)J7E(rSSYSv~UB}LSM}ozjgDqz$n@f#x1wo93P0%8V&ja?j_6Tus zZiow$IB$FfgEdmIXS|8<_0KUnKOF*13Y|^?kLVPw3LQLxFF+Hyh}!Ck0aZN%i-vfE z&EIcYxlTXio~Q2_qStL0@mX;l9gYF~!~1W3TF5urT3q)-(Ve&XrY)H|u}`L^9R1TY z)fLBeqWOQ2`gy653H8H0Q3V9F3;_$!S6o4c7)DzqG97%x{gvYh+(KeSjW$wE!hChr z^V#bX$rg!1DY<@KqEw(D4)lnL8lH7JhZ#)WDtrJ8JfPQEQY~g@XMLle{qsz^VxD#S zea>M_SLIi%(1=nzcE2-0FIG#L3H>6hlAxy_`-JhXXYbUc0h9>M?>DG+M97H{hz{+$ zuy5Z5Zsh0pM?>fmBcX)=Ci4XA3>xv>eWCk5N8xZ6mM*4aMxy1ycnx;mZm>&mUw7Mm zUWTZ==+Laz+6sRNfEqXr9z_4AftmpPp|urIpbuC9`ao*VB@qQft>M;4D}zs}WHp)fb=XKz!Mc z#EBEi8PWQeH%7wiUf|wQWoD}0;a*tBgg3t2-b#Enf%6#NsS|H5;oUicG~(9prxV^! z{mZg^A^0o}McWuCxHJu6E0kLnOK|lHUdP3XCSJt%YVJgIXesf(Vj-9}8Ztq|+<9Xm ziP0pXu@8B-6VKHWAVkt5l9M!Qm~Tkc>y%b-g9*{b=%3lymI4#(PbWujj z`092|PfYc8st1xfdtA_dOQMF~5Q!h;Zp7@A^QmfT5ETI;pam(wiRgT9&>sv16Tlp> z4Ez^(9b5)i0i+e^^I@bk7r{w0a#-4pJu$moq5ugKr)DA{4OT$#8-X{SkAdsBW80a< zF0|C*gR~U@BjTNnLXNDHIH|_i?Raq!I~EJ;Tazy~?cu#p#Kz&NE(oyr$6Xxo#GXT| zKE0JOVSptUPcW7|tUCk4ECswl23vQT1d%G>4Oj~ml^7@T27#5_AtGWz7+KJz1SaA05QSa*6k-yL1a8WK%4A}Ri+T}x#$hOO;%f1Jp8%JK zeL$kDIKO}ms~3t1J{7yP$vzr1q@YR_^DbSo575I>jK)&MsPw#nn+r1Y+ZQTE3PBJ3 zHpp_Mr2AdP7OrJTeM?K*l)tS?nScAzq4ZB;9S_Ea{RNH2=+NlzOrr`%z6@wiCl)0u zQ+SEYl4@0$EDp0)FXMfUGKoYrm`-a(9$faN@c1B!37qZL975qK)JsjXewhE zn&r8a!h)jA75U}Uciy4TF182d^f2I?+GTk#L@aOgNqL~xnjIFC(r!+XNyQe03H~f;u(Bx@y=|}~S<%O;;FuDxYM@n_ zEi)L^*6XiX8zgp}B_%VpT9NExUUgQfO3N@(uJ7xNa|19vbOIO-+8ID=s#N9@ zZyLw)Qd%V8vfWY?4w37?mnpDM_Q%^7sDhO}dF| zT%PUft6`)gz5aDu)lOcLtTR?|tk;kbZcM3^C>(arT#g%&o)BiMRN}l8M^TPRH*n_6 zJu^R=o7bmzjVN<&`xRN5NmH_*A5G_HCnskW(9FSMMs1o*Dlw*}N~B7?GF2?Mpiic% zp{0F&uAHD<yL>9Tk zqSh)TQj66fW}Zw`SmwNg{LYCenFa`bG*?b@!>@?!n^-ZZ`b*y1I}jxAXXU8p0bEJcG##ti8565H5_ znq5DE2f=N*0tCZ<)kOfQZ)WOfrRRSfBK> z2E*<`hmm0nmfm5I@2_&%!JsbgbM)%N@x{Lm!w=p?SN_vl)0 zrb)?3O}6}!0Yj(FsXR2syLjUCq4mAJX=;X6TZ_E|dkqf^jq4o5{BorcRM1*#2KMGc zb@x<+5goh1H0z2GD}wlTG|zikvRLFh#R*vXhPJWVxXrW9An4o)AlHcNk6*cLqMlfY zY!-Y1zW3RN4WEHx&;W{YC_49Mr00cdwN0%CD`(X@QpplO)iG4CY>t~se?X$wzqFp5 z&%rC_m?oDw5{?6^bFCXbgYWft+wX3H3mqM-hWK4=>QJrEQKngl9^e7@K4n?=t`g#;0+SI*_!1jMp9tJIK z|9>hEjX2W(v+~fLgOybeR74!UV zV&@X~AM4(h>XS|;7syV*Gdi*&RNw&8I;}O)&|Z{OAr7g00~&2!%rM$CeiOV<-ed;V^7P zXLU;pP=~m18*B<(&q8E{zVq6%ah@`!HEh&G+I$9i9g+#!8$$@`*njDjaV4&pdfZ`8|Em0v3jvcMTCAG!Wp92 z2uj6-v2)ZY>cKZqdh82Wc#5S!+&^wR7W$(I!RG@GMJdvQ!Zhwh_yJ15&OsGJbxP}$ z5qV=iEJk&&Rrk7S9Pt{0#9BHGUZ=gQs@Qw59sN*0^Vwrrq1CugLh6cZg8qb}Ggx$l zHJ(tdqg1#ZMRMrZfo`BG2!1JWMEntkz!(e9;vY@UFyM}FU5HF}+-rH3iZo#W6fTrmLR=Js+f_v`6g2=FY!YHiG9yhT0~%1I zib}M#5fQ)26m|kv0sPLm^aImw>~OK0rO@(gsqz=)@F!sFKpndToXNDjU}?&XQ1Mp- z>Y5a#IK-e10c@Ei%n@|22_?#m6$1BDQ38He68ff<)NpDlvAXO8B=mQNjb0;1oTZ>K zX~5tRHm48ceHWAUB6fG>B9_bnV!GxNJZ@t@q#FCprcV6*X(q9B|9+|1q_CP8`PQwB z4467*ep%ON&TYOeS=nF!{mztWb5^XFGi^#iv&FLJ`N_Gtlb>HRjj0(~RT^rjLhK|g z1%DYhu{%Ujaj}!5x6#~_Md>V93)nVL4BsoO>D8iA17KfJ%!?<#G+E4hTjVO57G>5q zEpDpM6tQ>t`*Mu9k0(&Ypmlc*>j2_2-A0 z9)KUd^cej3__RmAV?^C?u$XSV8saUv9<==?{Ah!t%Ye;DaQnKjslqx%M=O?YvLS^o zJfW(Cka`wP2WafX?;SZ3k8HxpV$tlNuEY~S@W_$)op3BJ=I>REX*bqo^-<;22x=~t z#b7BN#*x=_%6~hhzG(T~c|lOd<4M@KOiS2tA&Q0mB9oQndPay^5$&X|V+u-vXO$J1 zG~vS9$?QfqWmYJmfy`ikF-%@H*#Q1Rwht?+^7E_m*&XBW+Pz`-UE}*LoZ8H4>$Gh1 z)P?;zs9VLdA?$r28e+mI%l4nU;E6aHdMOE&_U~Ux0_uF6ePmM2;wrnnYH^Kh+xySG z#M|xsOV7Q(O?J!JL>XruH3;=uHO(8fag~QI7hGy>z(s2kHu1@A5M+FIG^R~fY;mV# z40hDD-5!*L3tv2PVev5Vt(wR&;e8tAExG?O1^JmS1 z^I=By3lO3B* z({2Z<-@mL@TZED@KS-(;8IjO;T`r8v-s?Xr zJA-<=1C4`!r|2V?kt0g|&(HXJ#`FGvzvSnhembJu{&sfu+uOVMr~d!D{v_h^*&Mi4 z9M+YIKa`+5L7`cE7Wyt^w>RceUE>x4sMIFBPef=uDtbWYj{%MeY2ArIcMcg`MaGG?PAv8eV8gY(@c4p0RUSCZdIF!@@*VJ!y87;8^o;sgl!5xb9h{p zt!iA=0awUZi&b$$^i%16zK*LB;%(1tS(K(TP1!#49&w%W_My@G-g7fx*t>7m;G*qQ zOu95KT;++j&}wWR8vXGGb=F(!%SnfnH#Z&ZwWWZch~4Oq@dWe^&+Glm+3iy_qHQyw zGBXFx8PXicr>W|Zv-YKfr>AUZ%j5e%f)20?&7uRT$=HuEhu2qvm?dBrRK`1zrn#89 z63>Yk%zp~-MR-GobQzu_7`-?u2pDG^mYOrfFh>G-dy*k{1si`p=DVUCc!_Bw7W8mz z;mM;FreF;RJ7(?MH)}!ez_I&gdGhGRXaMhN?(Ty}tr=AwvmP`QR)7!=!A~vP z9JRWlNUsG=){JkXOOuSg+B_$%jFJ^8ZMy22Kc}Gv49oGOCFpxwGH|<>7WehI;5*^% zg+9)@q_0c5@4`NfWqtjueVV`Sn-!hfxYaPiM8DO4pfX_hR7np=>x*tsD6l~xHXEGA zqLAc>GQeoAiEDkCRmwA=+F7-;-mJ)(9-(w2WPNk#`+T*l?S=4?C)m$({(Qe&@lap( z0L}K!zDL%B83Z2>^(4^g#IGDUJDC;y5!^x;Xo^wSA}klin8o0R273%O$!jNC6|q$T z9@emk55x5>@QdiD^(~Js0}p0L8>a3SSGLrPTE|C!>kdUK z%`Qf*k$TgZP^1-w#RKx_@Yu`}E+j2VgMF(eps`%2R)F%PRIF5Pc8REx!pPt5KLZb8 zk1r?hZmG8|do;Xx%8(hh`j+dhV9KF2jH1|OwmCfdG?&d~&Q<1?m1L?^t*OolRW`GW zKdkViyg>w50wx~j?TV5oA!MlTQ(@j%wi}_XKHS0$WTc;m3L%(j==#9#8 z%lVbkfUzLGFnQ*_(jv%Jk0^ANOCDUaQ&R3K2r(PXQzSuGeigHrXT?*+#di9+>~zpk zQd^9M>e$8V92m@{K2d=Q)%I%Cl&>7C<~ z9FXF3)K-~n&&*(p3vTd=!UeAANP3K`pekRbh<*a@b$Y8jN;yooEVjb=wk$JPnbW7Z z#{Bi4SReoVa)XcGC#M*2d`6S^NH~**B|xy+wlvRf?hSl9%iO<-q=d zqIyJ|s-84D4Q8=ogS5(nqK`;I9hKs1({n1`L{zCZbVgZ~>8oWexqW3LblWupvVB9v zx&6+c_w);T;H5(Q>RKOjo2laH$qD1&<0I$nL%b5bIL|X{-`Ih<3os#u9b8Qy!+P{! zMImU=n>|&V)#@Cr1%8Ud8CKAw)fZKO8OEgO(!TROS7{TbyU{SMbmrBz|HYpJhSfBT zh3~jLeTz%+te3F`zUQm$#DU?TVJRw^@Q;RDYwi>oIh~Owv2Gd0^-4!4;@HRS^63QN zP#xKn)(My}qjd`Sp;ob3p@V-^=(I{ES)pTC)WInq`TjE-Fmg(I)!HBTWOK4YZwxpV3F?Bhe;w4cegX zG_W_pFx`fQocIPwhNIJPqF6Hg*yl|kOm&kR;diTXfV=ddwK<0+H`KNv=jRDn0q zqyLSvJB6}C4>p49x9F5uR((Z6aT%zbI?59Bve}m!hI(kYyH|ktt|}K(FY^;8!o*h! zNrkC?Ml9qN)a;dj0I&fJ%~fQj4aGq^uF0#jD~WnKmIh*t4zx5U@Wr%`sLj}k^K*J@ zz~v4E+^zt-E-*L{7#wjgII;l!v1=F94_Ub2NTl!4MT?I<`1MhC-OJ;k5(vB*9!TcQ3f_i#Bj4og%zGK;yUjC*XH3SO7>FTFHx#0`&X(D9i+_foj#o z_KT}n+5CB94_sKX=>2;qM0p&IJ_C9!%X-&%?|JDycx`{nl#-Rk+niGt><8leUb+Xx zPhHT0`ponj6nlWsMIF``CSZ-|V9<9d=Kw3f9?5xAO!*zHK4Z$|0jzc8VFW!SD~o6; zRxGjtrZ?OIe*sdk97y557uK(TVLixIu!_t)_o6d3KxVbd(?+KCIRk%A8;OExKsMmr zh3>pelth|Q5VCXnssSyfV;^$5?4g1TdI^xe{0hqHmsef}2iK1uw|@P&@zIA<@-njQ z$u))nBo~F%T73ro-HHMuaejuHWP4UdUW(qT)S6kP!)){>C!4iOYXW{4Px+}J(N>M` z+IxVASJLUOd=kQ%M<%Q!gq>ue85LckqrW(x#{4g>cG*N~qwOZ~@%`gBj32)Nc%>P= z(xk3c>z1aZr1i>>8Z-M0yW4wLq0uNYmK#qk9E6S%qw!Sn_Thap`@aVN{@QCmPOnIW zI%OcvX?*k-eG-=}PRh*CYLmGneO|9zpR)L_f>;KN>Vzy`D^~h)djTzwzlL)I-*(40 z6=V=Epn7Wszjb(#Lo}fgIfywg@8rlOppz99rB;sF@)bP&l!G3+Vptp~Y%5xIHiJBctxaRM$}&^zLJ@ z&#}#`NUEL)LKk=If(z{z6<_h-MP>h9X7C;WTZ7S`>@(=+3!^tS0su}k`ge*JjpSV7 zBHB{s=oQ&9wHzGGc7rc{ed!{QPkTK5{#yOv-asMEXNUkOq=QAUpFIjS%yn0x5+JIQ z%Wm%o)h6I+OQ|GkA>wLxB~U!P@>H@s2(nH+kFl{)`=eTtRY4lrZpDB&1Tq`ZE3#fv zVLm^AF$vK{KJn~_Io*7+E)Ws-ZC30L7!BnLG%y7XkHi_f+ibu*Yfm=2(u+{G6C_JE zZJo%#qx|v>+a}O=HZzuFR?%zVC+pRSArJxefPrs44w7^VG)U+Lhtv8>Wn8s#E^SX? z70G)2ptcPvT7lB3`d7U7q+2d?&flL_B9*bF$`NZmgqPq;@Y08C)_e#uK|hfB;b*s) zVCeN`7cP!{7~NMqch$PFqUbC9yp`+6_I~>~tyL+c=`DwBeNdLws+qLY$|_PbncB}c zs2DkZ?SMY#9tTFXT%?oBTMk%JI<87Fw?v`{)qc88PU9*l27E(az9z9i^xA*MM}gSf zYNXOJIu5`)YfcyXT>cCRFtP#0g=P}9)2O8p#c%>Y?asjXB#5vuxBvKuZtM|lAPek+r{E{iVH=h7{Pmz>spuqr2#+fo_b={kvYTL|+%6g| zteGGdQ3UW9Vu;Qs&70gJD>ekeSQ|vy{$AD*?-FhF`(HbIP>+ z?wui%EmUNGzu3Q?Pp>J19yU0V-^gT5eVJp4w+mA zxGX1z;~xEQ@`6)mQKU|pLVc6MT=(_@qid%F{lV9d-3HG-nyP#f{_e|7xNkhiJOT>Ag9o-WFTG>wfw$f~ux#_P*_-d- zEc14)8Q;D=dwcu%HM{1`Sq{W|egM@cpTj)~EQ?%gg^#VS7+wMKxBSc z!4=raq81Uwjrz!^N51l zY5ismpR?<>cl&y;zd32-qI*_6@0kp)(U-VOcklQkJ*uQ&*Bj%9-~acG!xjU6(UIPd zg63a_!0*w7GZ8E?2PRi7KK>kdYS`p{`H#-u+_7rp_+bM+-E@{7c-L#M#pP^aUhp%5 zaRF|*t7*7tztESsF-_?d*U65hNZ8Gc+5p*zh>(p4&=j@d4NFm|Y67q^Bw+;aXEJ9a zg8oZwF$1T(Wr8| z?tG(PNrp$sBx!Xl?X{Lpgg+KkSF_)OVst8a`hptf(E98_ft7W(?DBMnL8{e{=$$vH z)a%fI3)NgWG@@kb#@UA^j@C(j82earbpe-zA8h}&p!x$aWm?|AeuZ*#RZ8`1M~|Kv z?8*u$67u!unQugW_%@@{)ekW7HdHR^3k<$~1;&hUU&q4Arc{MSMD?ybVMW%r`?6KgBNfSeF6E4vj61P_DGwQMB zTMQ=#mw_?rJBx}_6U}xq5K)a5>^gAt*u8t^F9>GK*ij%6;v{qbIrM7AnBEGUxYfS-fdGdzVfB4gf^$j^HASo`AI(q|V z%FI2x&%eK`%x_Vt(Q3~nYu+)SfAj4Ap?Mpcp59cmecM}Sw)v81vD9ufq!~2KT&p#5 z5oE6N%w2KYhxJ4AJZTb{%&d^`v!;djY+Re7MWj!$?$HPDy+bBi5DbMXT3U9^7-?Bht`i9SKrWV z=TkIl%am#`jNZ~Tc z3kY8x4HPFaK(sOjpeM!%{&JvXL@Je0r3kLw|Jl-IKRk16YPy&eNflh{9Iz1_cn#bu z)9BN^8m+{Tui*@KbFMB2h?HUpC&K!_qFF_rRd7R!)1_4WDRZz+CsVqXZP~HDIatzo z`|@p5iVW$aM26nQy|wV8+%c<9PM`X~q{`%IQ@^U3;Z|j@=DC%Px+V{k+WF|ia* zHxeB%C4|{!nPZhpptDzWhB%Vea z{eY!fZ>qBp9(?PDs_Wh-+=z1_eZtuVapodaxzqPh%nsdT)c>Eg!zgTJ{>m$Yjrpsu z3RdUw>sMZpL~Q?A)7*3G>^iSu+yAb;^k^NGNtIx%Scw3d6lZ)%K=05UblPYKcq&}w$kNg7l9 z=rUg?dh#O5WsYnFk1JhfD4aTkcytuximb5qAznwQqClsdJPv-~Bs(RYA|pR|Z9|Zl zeGUhYfLwS1Ho^-ug)6h`oYta!6tt?M3-BxGyV*kFHpm5!)S-LlcHv~p9u;JoPV}8W zCUcaN=-?0$RF}A=>tkW0rg*WssA&wi0ke??(fd;Ac1vbEu{Whdf>kP&X^Ff71QS(; z;H0&;W?HtBlr(Bv_K)bRZ?|ATNP-0BGKVZ3SBQ?knQ0XO!ccOYrnOa&w~HyRgXk6G zu}lej$vhCbom^aF+8;pN7w7bI8cyRx{{cGlUs{aXXgDb;dT;bzsZyswmo&Pho9Sj- zM-muvlEN+$c|7fz>DTNpiVo>z_Luf3`^)7H zX`*acgG%L#&o_9Zmb4@)kNp-g@r`gitZ=buN}e>;L&HxnP5YHapud(rXm}C1I6NMFGdw5id zp9Sqsw}=xFQ_Mh+4`3w;tm;V%j#I$9-A_Nlsehk0?Qz&%oG#ZhY!c^G+Er$yire+@ zkKjJ=Ex3=aO@Q?j{(uKQ2roaTeY`}<0HsW2~THYO4)HHTz#T=JNy!AVv{SIz@0yT#C$v#RkqBE?TRUx)e>@$^k24s!~ zqJ8VWKQV3EiSNmGl&}={57Yxil$26nDy>0(AQ_M|HsgipKTUpUz>Nm(=t+2qSr$DB zGTFm8Ob>yVaV(J=Hr!|xJ918d&pbCiUCL8X_ zyi+V$yA^&u^7?OnGh(Y5+#wTpu46?4E`yXHYuf>%v!f0yqS`68{F6_jn?Csjl%t7( z0>|iOAPfF6dIvlo@7M8XwNxcFBKAB_Ft-ElfEzp7=FmzvfYp>^pdi==3$39Hb{|@G zVvQYdz>$tQ>Ea*_d_+mlr?I1zTr3?f2eVCHo0dF#c5+&+e4@|hgZpgB;0Z_7fWnO% zn(FjYMGa`(E8=JXPPx7ju`DA`p_lr3j)vcxhMDBbez^E-t9{tQ8F)OCd%sqQ%pUydK`Al+coq zLfxkl8ie1L4o zaoLDri`yRF%pFF9oVM)ckQd*)=GeezuD3?*efiP2YPx%t~4S7i;Y?4`JQfYQ(X0}u+ zO_SvmNhC$r@XJQ6B7M5=4O;XvYL@~meF!pm8wzVW*sToe)Ebc-v3?koD4+zq-S1)Z z(F&?BP>w-4zlRTOfAwdY`SK41z18$eu`M{Hq1tHN zeErP>^jE9Dd3W!~KfL+!jaTL$ZLpd9c;V*2K-ymentt~a7(Ti8`U!(p4=ORM0N{qK zyC>dXiEh1sMxR1asHeqP3fv*F5lJVr~ojb1Wn)lYu5x32`{n6Id7vM*TdY~*mr2D}mQTS08t%N^c zg^P~>VorkE$%g9D7Q@qx;SmJvz^wskh|bY=!0nD67{`oifA$6Te*Ny~cVHZpM;--J znOYQe`N>8rB@1T2BwDhGC> z$;uJFJ`VCGtRzuCy-sS}9lT( zC%4Qt+b}tZD;=C{n60s)d^Bp0lO1DI(;tgn;#Q88YQtr-of$z}hPo-9xmMYvPw~6z z+*!WTn)Kmw_FdRFXLx!|sV~c2=kllMOZ%g*(!W%lVGCwBXP1SwdRcef03MBEJK;%) z@(ZQLHb7ny>Y>!KdPqq$S_0_j*TW&tMAy-qZ>6mgY#9s`@E?GEArb}(F!L6hCzys@ zM&HGaxZyHt5H*STAa;x5_)T~pOORC?O_ohuCjK0(amf7rZ{OAN=SP1$ zvo{EWzx@jsYg)X&eUd3FNoSU8`}fz%iz~E~0JX`KWzv}y+BtKy3bQ$=1<&=GXvoV? zvM|z8YySZ&-(RuoHp^gBDA!oK_rl)!gYP=?*GKn%X?)>J_}g!iU%u_h9d?DL!rTn# zW^*t@VZN&xCcTxe&<4#9zW&<>%oQ4~JO%L-88;~I3fYIBhuBCm>*28~;4)$l2pl$l z!Gbibo|^`UPg2&6x8Hqn5gWnya%2M!ODw*KS5qrvvWmGYtDjl3=9$%37ag?kx;poT zm6QDrxx|t;Y*s^Vir8eCPuWEEUtEXg3UDc~c)!jb6rXXD>r4^&stQkFK&6-oHCzlQk4bJW}a(IJRsmrhQ zW;pVDxs~bpDOMUxZ!qWOx{C7B6?|aK!aF7m-m!jCX>r4>nO;v#PO4O@b@@m6)j9xz zgPln(e?hO*8~=(u8s5~B-CUT55_15pzt&bawGY#y zeg0|d1QKmE|5a#EQHpb2{FM>(l-#B1n?K{J6@2Z(_uTHJyXeCN5yh=oIfCp^+d zLfCIJiav2LI$i4ZaH>wnI7H(|ULQV^$w&qiSv27Tm7D?ByNX?iMx!H!;|jyKEJlOD zXaS{6|HyTQPqHU^+_eAZ1||5Oz!WMTzW?*jV|I4_2BzcCLO zXzp?|9>ft5HEUIMa_wI$u4@Eac|-^CZ3Tn8V2hM0yO@K zwIv#)1Z9({*|T@=p7r27JO_$k!Hw}C1Y5^bH|XDo<{v-(%jx6uL-7Fk)1JM|w!M2I zlfZdUg#Mq89-?lHho|5v^Z;l|<+7!F<9!^)skmPkREe`D0s@JxoPHxs~IdpnC7ERM1wbJtPyQl+-9AV_Ar70GnWV^lS|vXXoTK-^=b}Hp35(to z7jXsCc%?RSACp8b#Y`|Fp_eLh44^n75si)BM^80HH^TP}Ig03=%s?FXJL&|G@t2-CND>*niCpz+$CwJ?)l z8-%BfhS3*RoGa7S>B`QncmYO7Px%oX0$+neKhmvj(F@};XfUz1seTdwx3{&vd~Euf zL!ZuU1fX%|r-#-|Klbwb!ekJ~ZivfIgmspV%0&EtVDoKo_;kb*nZ4^rME$_c6XTQE z6o*!39Qx~_w?{LPNQC(bJ_bf$wcKbETrOrWiP4hnML3Jz`UyIG zF*4YZ85}t>$X*JLq!)z4)QvT3AVxo+gmC0R{KO6FvB%Ju6nA8zJlF~Q_U+SmJvOqN z&Pp1dl|XF6UX%u~wvNfl;(b#bLjw;-yKQn5kHOgtzyXxBhi1afC0oy@XN;D*-N9*% zzFY~LTfcbG?%MqT6!|QJ-h&Nw3x@S7^VGW0FgguOqM8f)ndOUTjLk2 zbCr^0qf}xsr_gg>H^b+NfRo-j|5fzl7qH{i`SV`|9IyiJRagtpz%S3OSaA+mKnbvr z(3xAUe?}Cih=M^;N^zdZBR~A<=>CS}0x6rN-@1JHR(%#LEl4)>AN}cJxkq%Ah*KBz zcoPoIS#b`2+2e(<;8tpAsMl8``u%dOjR&9@BQb{|s~;VKwRgufI8l3|ZZGlxqLYge z8qwtDqy?pEJtzv0RRy*!#Cn28ZdEmx%a&(}nA}pvad%+P9b?b#+%)};KN zWt{D==4vbWHbbt-ISUqL?P+e_Gc)qhtT9`6y}GAk*W#_c&(gp2%a2~pE&)uRT=2Mf z!J13=-7#&`&U54LT$loKNBzdiRW+twH1S&al_9@R(YJc=Xfw{H{k8I~i+8o}d1cSm z#<@GsQayeA4ko_fdieOoC;_~Z7B;&{bddRf)qM$k8^zi8&g`Z8T4`n7vQEo~WJ|K- z+luWti5(}7bH|C}-1iANNr)lj;D!WJAmnO*aJD7Ta1|P$C6pFOxf@!V1m3ok5-60m zkZAMG%*u}Kgwnq6_x^t0msmSHv$M0av(L;t&&=~Y|1|MyL12rBHcM1iGJ#$lG`OL+ z4kDJbKYvRv&p{OL$8LGtwM8MX%SvJvN5bPOFP@mJ2)hzWgIcjz#qjGtyz2ck(z#C` znmhNQPXR+haO+^ExV^VT6F41juX0;VW~ZL)<2CuK1Ac?n7Vs2SJIwVOu7kI$jy?t& zQE~l?m7W;HN~87&pQqW$L_VxTTuV2$k?md0K`ju%2w|vid4NC@T@4})JFs>S>2pX( zqy^b0rw8!Z2criQ1SXHLAN%qlfO=S^1Bh5Ps2u#DXX@0RPH;m_qfWY&*D*A&UJnj5 z+Vt9Zxywew7uoTCMrAVdyx=jandqC=DXm^`KhGm(N?KCXnU@#f)G>cu0rs`Ff!^t% zm1;A$Qu-yWplLPpi_RgL&d$t`tUvA-t>B1;hqOX_y|hcpbuJ@(3Z>UwNVoN-AIasf7?=*A8z}FaxKP@# z61PV39-vIg`@r2@c!eWKTl}GF(mqY565$tQ=$q#4edL7X#g07oGs+KYdq*qUh;4 zJzV-crO4*=Eap)^BK&;L@||$IDeQqOMyzXc;EH(m(Gk;cJ}#@o;ueh)&3rW9g~CA@ z>JOu23Mo@M<;JE-d@6^Dht7z{{2+16M{}|^J6;7(_kJsKF7t?WM9m=W>${N1C09ey z%HlzpQB>QEb;0u1fXY`ItTWo+WxZ$Bxhv8H<4Awq@I)!CrKj#GFggMzi^UXh7z_4H zW8(%ldUOjZ25j`8#Q&pmhn_4$WM{y46tKHIPvqis0&H+jT zeK`W(QuY9wV}WWyJnU4w-%YfmLf$?-Da4!-Yzh)1JrRj^xqiwK^?$ja(s+*qaq+!& zcNlMn4u!F*8{@?tMEdP(D7fayYv$uFgbAKNn*_oIzCgmdYayoLeW&yxm&YGST03`V zUpSq8R^!v$uhDQBbokgltl_H8*R?))G)L|`a^w#_#Be+~BKMQ@jAS%iI(|mwLb9y6 zFVavK@<(EmW>ur!lf3~Ki%RurI1U}PAKQlAxuElPP5(7~Gc}2zE@21{+0S@xj|Xq@ z=U9O-X5}$U0Ez9stcC9P;k^ztKjI#hb9z!oe2M22#uFENN26zI5krW$LbJLm+1%u` zI*s5DqqG)n=Qc=}eUVq(b$iQ!oi@OTy4I3Hi_0zYc|$$^O541N9XlplIDw_rtCy6H z1~jXDa)5DO*3lS$Ij*JwoRyjMa7dRgRqC!_6>U&FJ>+A~cUnNsAZmXcs4o8m`6!lu$p=Ob>CXLBvCyV9!%F#HUikUmcQYAO>bZ4TP<9 zOfvdvSiVA9k@oxgVA9Q)fN;~$X+&&=vPu_0(M))aX2{E~f!qN8iP5^O;qZdR#=y`R z~Cl}lmm+I+Zs+rIF`ROlX%AB}qRy(R7CMIy_qR4VY{ zH$$&@c4;yNR*z)qIR__*9$`K6dY;Rpw^m92xVCugs2BjOM%4z&+d8v{crBm}%4rHA zaJ{GV(L1^hZ7=Ux(C7r#aC~?uzo35F>h3}%q`_CG7oUFNMnNgvF;n_}fUd05@;^m1 z1kn7qi9JizQXPnop)hJHUPi!DFe*7mNZ4l!_E1s++*?&ah99J1sfm70fP$|cy{G1LP{S9D%Rd0UUud_KUPoH1| zX8;ZI)Lu`E<0i-fuZg}_&*)1v>4h+|qdfD0uP_n(#HRD*x8(tq^o_+5^tYP-x?OMa z1xFd5pQCW+0S&B(ge&OjrrQcCAB@&Wv%E!2g}0(0m}0#(k#G`Z*i6Jv<3tiByJigOz~oF zBt@Ss7`B4ZkeP6ArG;TsypA)$CxK?E@p6qxwPEUPpaQS&G@Come-9<81=WU()Wlas z=zpG3YO5=0sUlpI2R5j6*D?!F7W<%={}G)m1I9-mmp*PB-X$${nkTGx7B~-IX$Boi z{&86Oqp9w&(rhqmM1_?;yYeNipvoBjOOQVOlV_yorr&2?(wdbhVGW(+^Q^3tl7`br z=H=-T&Vr(BBcm$jeh&7Om(#@>=_%FR&Sk&^EXy+wOkMaatS)e_pI~-6%~u{aGJLNd z+4mTUU4Xd!7{SZMqp7T3N(KQd$LG{>y;yQerNyur>VYqeVV=Tb*b)l6kzj=v-LP7b zJpAH;R0dXJ>^pD!!=HBS-2TPR?g?JLq3zIzr$EO^Z$o9|SNrzqT=`=+4KLBt>GX&# zla^%1ww)L*z`_?7`F-~2vg$5JOP+TH_`$pT4jkC`?#_Sg@YH3Tf4~31Pd|Nda+@|V zv-PO-+HAmjZ@mAFA9fD)?f*V}=XCXX>8aMWn}R~ut+rHkaGbr^Z5Us*;I<{TZHs#S zW0ASTPDQ9Fnoq|O4<1B)jLW$Tz&IHMCE1&z3E&kkR)drg&lX{kO%ja*0& zN)IPvdExaS?3oG@g&!Oc-6}G54&3fNFE-9~@!?oFXx0>{83k($Y#o1Wq>*J*ngW%@ zkFM~Ut>U#%p*Ls}I)A2kSfprpQO2)JXbn0AycU4Lt6|rOtbS5P;Pj%#B?>kJoGy&^ zkD7R|f3z?i>hsJNmqyfc!gVfIjEZcbpmh7)=ucrTU`23t@H!Zv^r#(HpmxBmkdkr0 zWJM-|J4hUGS#$7UP}Xb8*)z$_BsZH(>R5vU%8n)y@f>(L-M;nhN{3RXGc}l8sruG> zO>pyQXVUpTuP|H9+qP}nwkDp~wrx8T+sP9@v8|nV zYv1>++O68%`{DGdb8mm?TXpa0?thK(sW3*xydMYL%wnEf8l88wnXm4nLs1$VF1F5C=m< z^0OsOTsTCI{6`A{st_D%kTm&^5=GJIW^Y9UkVbiu{i@sYG83~Ws2;<>qZe*P#G8E- znL~<9SX5X;dKeQTtz6N(br))Mh6VdCMgMcO#W zmlgCpAM%=GCZR~HrO(EF7dpp1UIy|O*d`jiF?{_kL z1iLIm-L>4YyV1XBb&_g~0#eCdAnMD8i*VTrp|`PkKI|1gfG%-7F4~ly&yMp6J@*j^ zgf%n|udr@K609@35ia==-(d&*d}L_dE}ZIJ4*uIfC2j>*fw}99)|254Hj4T&b3Rv# z0$21kaI*T-bA#ZnQ`R-QX|8A3&U@YXWKfAy0>@^B*~B#zv2wIgjsurBM#+4jTPdC_ z2>zH!lg84RpfJejhbqpwUihLt$mrnM#k!Zwb9I)v9bL!X8q?eJcfyu>K&S8F+K3wz z&9wRHP<(CyMfQ7L{*N7ws%>_QU${8E9;Y1_51SC~FOwW|5AY0mFUQdvx0B*=RFe@5 z8`tuwWr;T)>lFQ%7KD;nSlchSy0N`u<@yHKTzdR0DGDiyDVD6d(lsUa1z(;68z8@> z3bLPtSQquUnQ!nMxj5FXSXI-#d;V&v^wf&W8PO&0s}Oh?TMy`5Ow!K#9=gNsf>B1mqqc`#*k+b^Ux~g)Sd(nm z$5~c5?)IWe*|rJdwI;g^4V#6z`I*J)kXp@d*1Ee)XS0j_>tP_1(oAz4)XHck^{Fg{ zie54eQLKMM6jii_f()4k++#RJ8v)%kOA4IUmLeUDx@D=_6YtP)UE4eUGU}LmBMu!& zT7r>6(6m8f?%+oSHAYpGAB%lSSNV9)f}ZZhSDM95%IDZIpR4m_F|>g1^ZSC13-!Ta z-q;F6=$JOw-XwGt$9C(v$8^b!qwfRI)A+&i)b!aeI;-lLE~8HoK%MCBvKUR1CY8r( z`m{Fiw=l*xz{E<02Z?w4-{XIyUQC*D)}wPoQ$Go1EL*$TMoB6D5=ANd~KUtR;v!IxSJN+jziV| zmS!+_d%q7SKA*o(Wc3?OsotPuLo|Q3lkd7rk56#)xw<@NuWR=0$Fj*tjV_0DfbnvG zyBwIM=Pwyqi-q7hJm3~_Q3PQPi0d=`%7TrQ<*K}ZdX7op#|xOXc|VtU!aK#*`rgWE zGC$RqZIx3tuxO3II@?ky=`?k#cmQ)xwDVH2P*AW~bkDdjC6o@PHM(I8eC5 z8I&o#Ev{7R3FC&q{x{q#q1_uPteoE)z%kk|3)1)+%QR81$CeQ#vJyHUzr9c(yH*S; zXHLZdSwyZ2FY-5u!p3V)G=fi)m>%RoZb#D%+YQ&%(PgdS4gXT#p({qULZMb`r%^z-PN@ZHb(2E7iv4!K0)6>CNc(zsDhH6!AvTZT6rmJPP_DWbA z<{-5uZf0^$XDPj8qJcJ-r1G=wU7Mmj%QoY9+Cm zchaL}2pl7Ue5Miam&AHWELLunG}Nr4fjwI+!$>&!F36<1!w`^^vBS#M7O*wtpkhb~ zEvWUsQ{$fY?5Z6jlTxrWIZ*40yeg~qvSdZlw3RHZ?DYe#mEFCqeAIk=soNfQ9;c^M zxx={MY5G0Nt;8gaG`^j$24K&1CQYUVIAFsI4tYsRF@FEPdGmIC~zQRn?X4RF=L} zl@4f-N7CE;^LI?Jm*dDB6YfEailXZa(=H}RB7Oo(tBBQu5Q|j`4MiDnWA=4TtMFR} zMt*{0eRU)3hU&l-s(TSv=c|cD)S3>473l@#AB`e`g_X_5Y#im(eBKSc#gnwTp&~ zlF!RU3z|d$#`ZKws~>EdQ0&?#A_%mdDaM355}(EG)PU;IQD=d;9m%u2vb%`y+?bO5_m`8 zIV$y4{W($SWX(qM%LY!3X6gqGKBN#%7!zxm^O`try(?0&7mbvBgjZq2pOqoTcsVT- z&7z#6kAgeLNQ7mu3sVjL(hw&a8f|c6pk0G8A+D9}WR#wrp%BJ4oVNaL50q?waq3Ru zjIZV!x-p53+rR10fh#AXu=$cFzYbzK`KgI{?H3}W4@@;m@x+7P@!|~z!W~E_Aq(sf z+EkvGKl!ZWHH+dca#Faj9VQk6x}J_9hib5d7S58hx&31bZCBjU==_BZ-a9(jqxo?e zp63aJgUoMKgC5w{Uik1&YM(d!xravA`p>3$!Mft4X}qm>=9kA`7KHEje0f9Y41r|` zxjx4SSs1bwYiue4z*ovXTXY$Lp+*zL`iDGXa0ABvah3sSy!4qSvL zi4oE93d9LC*i5>_a_+(tc$zzf@x10>&N0em3BhB#c6tT=^LWnn*6%L>WKwNc)t+rQ zkvX0nkc1p}+fPDKlgnqO9))~2p-lM*`z|BV$i-YEE}aSNO5b-3KN@q}DT4K_e8v@J zcLrrGHc51`i^5~-k|M!FRatDw)EcxQZ_+9#A36He4}Vxf4U7Y~&V>G!-fxDO-rHqT z49hO&!@6W1nW-*_a65r-gHijG7F%WJ&PnDs4N6qIG_BK1dj2Ij$ls2GK=nD86DlE} z)ch#Ma*jpZxhi_$I$FNdDtsm{(_*Kc?$L#rFgvNyqE_m8fvOEKtffn6<|f~ZUFvqm z)b^(V^&w#d3JKzS(pSqET;bRPbt9iW%8Mcp$(^51!Dc4_W$#ZX+`eD*3W!IIiy+2l zD?Td@N0H288#Eot5>7@&Mh!*DRkrcz+R6#ivDOeX$ z)r)yslFRGsKoOETT0CzL#$Jp0YU$Am4w@A6o}`NGmU0W;>aj3~KVNevfj`oz9VcEu zmN1ni_8b=S$d9fU$xOiXxBPV?NrQfa>+JujpvU(BTkFc>9Ve7{^%xEVZFYmkgiY&j zF)B|@7A?`Hw_iK|4j~sqdvFsUeY?8O0~PTv$~ZcgHMsBHX89__fSgS@o_2p`JIv@^ z`K)BP)XgRa|6S1?fC@WRh3PH4+TVd?V~LjU6~amUI6>4ADv_EatsJgD8`DD_XAqUO z%F6$^p%QDu9t|r5+m6z#o3+RuUS|I$>;3Wj7Z@63K<~Sn$mCiBUATtF_1hleo)I?u z2b!c*o0P!UInl@<>?5-xXl44EbtHN8Yj7r+J6whffhCiU9Q1rvT!eE6qqxD&WC{NmYTtXg0En8yr=}tO&trS7RpmF} zm4iOSkheF&p*0^;{Kzkz%|K8Q{Z5Ub0pn818f8dO2Z(;g6L=R>%s*bN?Ecy!x04*X zJ~yLj(YU3t@v#Ih+f8G6|K>o6oThpgg;KcB7u{-|Z!0-I?DD~R=h7DTUM}}~*L?x2 z#~f`_w99r|T!csB9MikdVOx{FE@#Ibd7vzPR;Uc0M@=0Z&#zhLW&yD5f8!s$-yg}D z`15IuLN;VTcpeL^5P&cy)Em1tby%qDy_X$!o4H_6GX?W0sU5{Gp(~6Tgd-2JlHS6z zq0oHM78NAiE$jba(d6!?1zqlIe{F6@c)m?u52=}_ihpo4lLROP&QO;Sy^|q?rb-fC3u?Hum6}s)Tmt{n3h{6Sd{7)xQHHS!S%gy8ZU&)D*t)a|wNOZ$`f=!i|Ni>o z!3?37a%L9klEJSXt3OyDo8)`&^$AeAA6X_>bdmEw?6{i}Yo5Di2$~{3=t~y}yxZp4 zxoj2h!xhm=u&n(4v;?VJRf(n+^c1LimCvDbfEe!M*<4ZLuIQS(aD_^ClPjaT0y2u{p+(<*hh?%h%(_ zK#dOnhyax5Z8}}xp2j=G*;58Nz;x)LbTgGUW>?McY-p>E25LQQBjC%U> zM%^=QTm=pXCbK=zY1vHA*;G3|)tJCu9-V8Dr{89Jn`!D*yp+F`t|$BthDSB>Rs2s+ zZPgOX!V$mKC-+a(zw>0(LJ;D=ruj%HIB|Rsy+T_+hf_6Qjdn-4M(g+BX!QLU&dYob zTY(fG%8A@n(HO;B4(^NR6WB5S^L;1hZ~gO@f7(dGGtW<2Ykj(DLA1sfQ%L&WP`<%{ z0Yc0O)&&#mvRFbG95)zsGQIadoZmYjTYgj_KWb;&l2R{7DSjeQr!0QTl*B?8;c7BP z720x2N={`-XZ_B*VPy(!#u6j8@Cpe)il?1c<5QdFlVbxmm!4whdzVV6-<=bm@JUPv z*na4&(xb8K}*;B3G0 z%6Yo^-@om)2Obx`rMD+hQ@DkCi#iSk>NwusJ*@e>N22Dx zonqnruw*?;pna+wO2w5>%jvD@TavZq^rY-c>HB6k+N8O+$ApOAu5)oZd-O*-2pwt^oc0$s$ehCgF^23VTTP8AltR8*&y@ zX{3Sf@nyAAuLnCzB98C!h)-v0ObGJrxV|e`eXmX}?F@SmP`Pkq)tk}a4{#7otu~VQ+i4YY*KcJ@` zf=7@mnTkFSK1|$ss=)5_=PlK_x8`Huw8yDd!aYt?fK&#)0<(F|iDfE1n>?v01h44d z2Wq#&*Oc4T9$$*Q3xl2jJBJW?`AoP)+xs`TvEV5j`ClET-h+hXJDtW*g>m$_rKTtyg+W9LQRHvN%fB< zwg}ZRZ_z`aN8%2ugfmIWXlrk?}X-m{v@I0SmU z?iT@oLMxczO-(N~wV}#1bz81VH8upLTQ6Ex%2I~l2R1@ozexcHh$M1aACKc?DwbV6 z?puFBKYF`#L7U_f@;ZH~c+gu4LMXE5s+W=Y52u5qh4Uh-5;6tsMM^f=?L6NdpqBO*+v+=?4;;Qq< zO5d?>(xm&yk4(g$neRl&W~{Q=V!I+cu?a`!Z~|M~2Ku1RTp*it${|M_{{1}^6aP|l zqsXiKYe5wp))f_G!x%wU?|-rYF0@+M<qQ{w`ezR;XuXcRGlEj- zJrJhYv9mija`6^MNF&d{{o`tFl^$KT>>nNyfjEyKRK%14g@VrweM}>od3JkU`wdw154l}2Th+A32y-zT&N$i4k5(th4d*~>pKcBZ#rz!x)e$@xayog3zro17Sh z4_m2sCTc}db1WZ}+>C^~bgj^j@#$yP3Z~^!XR%ObVf`HpgoE0R&nHeFd-44E0C)B< zjVM_AP8$n)6f>P&1`?WA(BeGpbf2V74}Y!Uf?|PUQ4lD?oU0NcUpT*pv2jcr5rgVW7ji>ZjPw{= z09}|c@xBHM&xf|1h__r<;lbOq+6kp6z!Rh zak@|q(|V<7k>YuHHcGvBDwHp&CV!jj&QYy!+`+-0x3f`5kH5Jm@?lXu)|*E87xMO% z>FoZr@B^JP8~GuGhZte780f!AgQHB6E|7KC&ecmY$HJ=?OPON5Sa@+OxDNJpI!mhe8s!VE8o>vVW zDLkZzK&(EdtJ0jn5oAfUS{utL;JK0sQ9pnt@r9g)paR(*m;RNw3oHo>scyh;qdi&Ueddl z6GS9FX$2Zt9Q#Ft!&^9nF`~z6N&}1Y7ll7eF@OLJAM;m#1#b5V5wHn!P~I~ zp&O_>{Rt=6$rYknGe4aEnVE3~wisT{wlYUs4@%kAf}h6UL2F>AF>eSn7yL2`k>lP~ z%H?`FodpY9Am%XZ!pTal5IgAe9$SakZJWAS=1>70+bL@;zRTdLKh!h!728;-pHM)K z60cIB$O#o2j?VvrHYY?L*fGV;J-r?TNu-{{A;NM?EXr;Qf(tPM`~g)%tT~3{>%}b= z)?h%!QB*V!WnrT?M6PO=WwHSLR98s(rD%XQ#bUEeT~G4*VNlFa?7$!3O91;&iIkN7 z4S@yKIgtF1iZ#i!8Q}au@sDxy#CzfiWoQ1VQ6D%sT)gYUK2RL1}Qe!8lCUuDg@ z(Dkhz*?kX6*3Sk=%0&W8qjfiitY7# zS|aE%cYJtU`_jp(igde#%Q0SLQgHV6Kgo4@x4)PiBZc>|)gs{YO~G9@{A!&?KkZR!982U0^cF{&Z~jzY+)mifl<-j` z3We66@JaEvr^H1E^Q}NE;&IrVrn;#A(Hev$iT;;B456MqC0l;q(JnHxKqV!o2im)A z2@3>zB-7iKj^xjBf{+1#SYN=i?KcPZ2Ns6FMfH!ee44xf3CeS%(YX(HNWUx{#yYCa zz0rDBbeKho@BIyFSo(sxqv}@??{kUsl5f^7tzPz_U z?(cqu9~GEdb`U4#LBWre^vx_IMB6MX=p1m@ti1h`5b0?Fe^C8^dxa@-eZlGi!!%Wh z>TnMHLOBBY%y-6fA3afIUZ4SAWIm!+-54175ZeevSF_&xQWQo9AMubGn@NY^3m#m$ zM_7UIEgLIF;teZh$-lEdt;wfG-snS0F_*K%JaU=W48o|g5E37Fl zexM%cm+P?W*e@%rt&(-egFq1_9CjEq)o>TL6j#~txmn$UL`Zl#-5UR z*Z~btbX}lpktV87Kn2416yyrcm7^=zmeiI+mQerEZL5}imL!(2AL7;^%Me1%B#m%% z_Vc}PqOqDUu3@tHTtq{Ol!MihHOQ1rnFetv?)h@vlw&9v43&Ix8ndQrASFZYsLvQa=k&x5{9vkjk<6^pWHP87tNU<<#jYv znbf(9aSU~ix?wq%gfg$xG5)z_n3hZzD7^msX3Hfi57UBWBt(qgCYjsFr~$B(UaklT zGvK;~>r*jyCsP=hU>vuZo*4}lZ2tB?E#}T`S?wGLf8*?6&X>;<+dwZBNo|=5OQa&R zqKgRQM7WHziA-WDXc_lfJJdiHfY^0~_ymDBepGuYnQZ$AU;_cmAMqMRnoqn|IN za~5cmttM`bMh{(>n++McGkmb4wQi_r&0YN68-%W1mvG?TRPjH;nShV&IOWU&^E6^i zN9yQlA(pw=hwCN^d^ovaLCC^_V3`F4scH>)@R}j$Krd1guI5t9g8NbUw!nfWY|Giz zU^SSQxYY<*gGv!08%d{c{u0CEmC zqok%mO-#iVmW;4C=~~2oe2uyG*T##|jMb)Jk@DM7S%|93wgz14Twi~sZ8ioGGkWbp z3yORQbnWRE3);vfRE5%n84FjZFsWX_(j~acSh&Lb9Um+ zT(o7eA1e2gH68;%RAKj8K|nw}vrP<54Gj&Ac=`5x#Y}norZph#-64_MjeS>sihqB9 z=LIGGfge6HG&BY|0|7Dp1-ts6eN0|v`}_MRZU}#JVq*uAj0alLfcU^b%>26_t1e@M zCWKV$^}rjGMH`OJ2Cgn8n@k&34ir1CC+LYJfQuyA7b6L#aIyZt{z4om>XYuSQDaf# z+igy&mf^4L>g?QEPMTV@*f)4fqu{ah)-Rb*R5{YA;H^=x4L}?7bWTJM#gafp<|CtL8URQHJHfb(q8bfIkzRjPi8E zbMR8VCO%i53l-dWqL7W)!85X@iGZepxh#AXr{ft}G->vWSuNRN5^Sw(N`&AoGqn9r zW?ij-z1>BhXKWad5}>P%oBA zee$ustjIrTy}3#J#9{C~Y)5W=Y{|Lsq2}=SZQL~v=p;qh+u$8)mV&;8?DObZjaP?d zlSB6~;@#)mi!BFgbrwVU_U8reVvKW{6N?`>pSwu^2S(U{NFC~>B%(N9H}Y74d)g)3 zZJyx0)xE9r9{sy>F>AL-$z3zT{X(7kOKIbUt*QE8b(Ac`mrjq_)4BW?`0gpA#!?^R zkwYi?Y|@*RgA1-ktcN#ujrZ5qnNnSaRw&rL)@L3|>%ge;r`OcE3{eEXz}`L0uWR9$ zs+ecrFX_+T8gJ`TsFpW^kRx`87d^oqHBq`g#R&IletSSyj9WiXNXv@G^Ckpvi9n&I z4$vcKCa%>x*Oa_^sk>$?m=jV1}dKxp*&ViPG*)QjrQ0uzjuF1Jv zXGJC_;B;)tT=x;mtF7=;xK9G%(raUopur&}_j*-Cr>VT}>l7Yvy|L{Je$yw0GAkws z({puNd#LNzjcUrfjpn^`&F~20d+V89lIo*6Yk@bmJ9{8c-w}?4V>K=O$21DbnD_uG zx`U<3DoZZ>w^kZ?h1vH@zsRmWeMk51_3XW$ z{6b#f#CIbAjt z6P>vW21pQAs1%~f%33&g=J&z!b^+caq?CVV3j*9fQAU+`x8@}IG0l)>+R6Fti~k1A0lx}g3RIM5(;_7glACnP7_}~@6adqq0^mZA6_}&IxmpA;=6qmVEhr4nnmS-`F-5tm1q#+j|T$?PMrAf4f?AwxMiXNosq8}vUMXb zO`+a0>pD>$lj&N#?|pz-XI2J@AsF-4AGtIctJG(tjw|X1J|rzDx6bg_HqON@584r< zZc|Lq_EOpBkDkrB*Ct?F95?v3fxF_~cBU9v>67Lk8?xJUOB=z2I$RMtdpWW@?E7s4 zRz7b!7l9HmnI44>nA{#J4u~vU5rpqI)&d{OrzugpP&YRq+=%-DI2Ppa{1HI6NbZOV z7w~^1K$(ciykWeO6D3!?kO0V*xT0^)d!C>bR9=OJ1JZMfd0!X>`KADzz8Szf_T3C~ znXIct;U1pN3BZlOVRmTmN3U+a1V(og!1vEuG_X4~b@D>*III1~NmaGMP};d=`%K4p z_yPRB1M`8-@OGgG!g<>(#&uv95$5idQ|kA=?2g4XXfLnm;xA{ydwjlu2#OnDX@CBm z6P0spi+!#h{kf(v3&y2fMW^`Xc_EpyySuzem+avva!P373*kzO% zl_qADVt-W;Q=It8RE7v|s-@)V&Q^_Q!@4(ySBYEcx6a~{oy=xa2p%K;wjYhRLrr=r z77@>iBZKV3){V2?f=e;$Lo@GGbC8v0RKa-^SP_sOL=)`tW?($rhr}C{%F=MY@l1lx zHMwQV;v%(cmeSo`3ck-X3-R*wmleSZnow{;6?L)nx(bQ>1kkf=1LpV?$&=d&9N#JN zkT#PDdb&ZFdgd2!uipR;g!@BtTbKl&Yq0T2rwVmnRLo$2S7@2RsvD@tE+Kwr2f|e81 zE+oC^^0xGLvMDEMoV3PPxY<;up%>MRqbW0p9*sgXbiaTc%6nWs6u>0DDT?#%zDM^< zh)WBOgN6$R%B>l^?#f*+M$b90FYcN2Lvr5_mcU-jgn7qtHvRI#VQd#aI|3gl6Qly; z=ds|hid)~BrR{SQz<~EW=pexLp5a05jgbFJ^ock~2EP;0Z}f&|#DG67vF97}hW)@h zW2^9wR74!uvp97M*E8dsI;kB;w{2;6uscO&$Bo==Vl=lyuYwL=8lCv-==e5ZFR zy!huiUgZs5Qt=-RU1QtKdIbboKn$bhhxrV3AJTRgj%B^?yMef*`D&QH_A62X}V0M)&MAU{=7&Be%INeD`-&=u28+3{x3agKlm6|5oa`0x?IBu!8}8&wv||)m$zgk@UH3RJ<@01ORv*&UQkbKZ zZfy{tOt4F&Jx3=#pY~UA&gvR}OT30%#Xtzm^tUHcX(ijzM!xP7WCy{w+cyKNn2&qT zcNFx8dVwhWAp8I`>&bKdul$mGigY4>2IPmV;MC7hI5-4DelQSxN>I6fxnfGvt~II< z+GyW)v7Ak@;kwz^R<2@y`;CGj<-SRPrt(_rwGn1Hl`JVH!fg zZp`inHE_ZK2MQC^24OkLV-AbskJp)Xi26(3u#nfWG2BUnzb~fiV$i#^n2v}7beKx+ z1lsxor7CUR((g;o&WoEq=slB!NlQ#ikGxR3$aC@ytiRrm4@;Gf`0*F6 z2Rn6_6BSmEXX&E2NVFqL?KGOhnypc<6EAf|rP`0X;wmy!tPo7orDiHVlDfB8)wZs14g`Y`>YFE8D+t!j+#PKjUg{YS{_IVdIx7*Li&5~fuqR0}m zzAGQmTp66he@C8Tn*nY3D&PF|^*Q6OM^3**Z@4PFG*A}3z6qH=LB+^39&TZ0qt}o< zv;8z6To1+@-PAISDX=w5+oqD&QnP6l3^Ou%8n;{7Qt4ue7$>LxUGW)DOnrV+Q}yu~ zmBml8#~&{K@(ZNfz1w~c8dOxWpM3%^IG728XeIX2dU>7nZYF1`OEnd^%55d~kl?|r zrbMt@<3mVj`9Fske-zcjr4GSpLgNmM)xpM!UhllAr@tXx~~U`uE&^(fCUJ*|D+F>0Vub_ z(MQk#q}yR?!)*ZC?Fh9IxB&5XX!~#-fOaQlMw zLhlAU40!;$ZunmKKS2C{3Ir1lDFDiDSYEh3e)vQ81se=G0NQRKKM?#80|EsG^8m9q zm@hOR@LveufdPYkfZZFy7lu+Kq(6+Y*i*&`_Z9e#KVdb8jqnDPbi*f|AZmwW9Zj~t zIYy=(UABI-4c9o@Y(egZZtlCc^IZkaTm^US+qd&v1^Mjjw{u*DyzgVhnLtl! z3W3R0?}N+l`?m`a1VZf#c`_0NS2@CzIYC<7D)Pc1j{Ulkb9hyV;bA#OM^}k_s)b)6cL5H!@E`bJ1pi*tu)tp4EyIh(2ksaCchL86z+T_2z>9%2G7^eXCUbHL-jP)# zjB2qFPJxp4zZG|gn&MbXlZ{aJl4(nqjo{Ye8cUmv@Ey_31@~sYOF^Cm`DT_&;jRVy zW}ZtSp9TG9j!TjE1*}+=-+xt!Lu4x#z~vVFn+5O%p%#Q(8S#ayETc-T!p%<=xnmH@ zegP%9qvA?UfSTNKab>7LQSRUJr7A#G?pXOU7N9J5^h~J>P`7g4%Ty@`XNgpd&RQkH z_Marcxm?1}d7_BzP(_efj8)>kSunaeb*2m!DBKxIUn&Ds?u?-?qX9~HM%9+u0JS^g zYRhne;+?4oAQcgO!-c<^e;jOAp@-*WH(wHowq-r4&E}|dwA5}^t$+IJb}32PSEayTxbHfb z@3pcNI6&mMj$Kyp&X!uIqLzwul`Ztzutj8D`R?w8!<|6o*d9uyG`zcc6acwajBAYE z;U$>L%BmSps#5EM<@Hlh6oBoq_MJzXmp>dzPu;e9VPITpQ6E)fS5=neh_Mzf|DBY) z#kE&CI#btGv20oVz$`wm-JF)0Z~Cwwy}$HNx6|Z1(m74tM11X7oZ2WjT8lL<#~9R> zSih9ljNH6;XSqOo(dsgAQKi9?&xBt_Ofit%fO6p*q$JkM887nJ=fm-`sDDg`61e8k{}G z`>9v^#``})6gz_nC!#`fF-pL7zinD_@~BO&Hr&-;HY6hwgPf=E>z}Dv{lVdNssh0F zy~uE~+JE(Y7O0nMzVfYJdwB@!iqcsR)DDx}4^K}Te(nE4A-r||;ZsxDLNbQEa+zmm924D!y}qE`j0(cw%8g>VjGXG;^1eHX19qvnK|DWGdK8c;mYF~m^km2)N0G# z+acU}PYg(|{q}wgT&0F;lYKVrSRjl7lNxi@9^vdHWg?@vcaFqzy6{h%&cHL9i4I0^ zunBdDzvHr9I&{JlzVJ_-=$SEYuwxP7yA?vg4<$dSM|^QS>cupPrVuR(napy9y@iF& z*m3l)U$td+VLy|BqiP&^Sr`Z9m_Yn-#`>yUkNa}-cG~HjZ7dSkG6IELDI8(8bQPDi z->SP6)om(@U@EphzTquVyJbk4Yq$<6@~4ehvUCsYYDLX`=Y(f>B2;}2z7bE!i$%n3 zSG^`2y*!wcqk|%&^;%qCdxm+4;CJSFXCtSu;x8C2>3D^aJLB&)eeU{WRiT+Ob&DeR zb*I`{|G{yg)xF5QO+9pX&p~$!%Ki4k`{t-sMGw{RX&VmCDT&xCq{;E~y>p(jCZx9f;keo|<~ zil$7BWv7x}^->yY{Ab&MC zA-*>H_b7*h`X`Tzw!zGC_{SwFmVX8BH?Qx_6Fpe6KXXQc5g>dSC)2|FIpOG_Llzjy zAr$P53h7~iWY=cF1Pr8$`&G+jxo3wPc;~!T87GXG?<5SnD0jz}TahBLT^$)GEXNmS zTvo5fSW%e6bzGAxBRu$loav+!B)xs7kP;2VL6V&p()C6fr8XsJrcP4kRFKHKlD)mH zW36##Qqcxkl!!j_8!gW6t=5$C`OF1)2f#OTy04qFwZB$z2qO;t&twuT~;5c*ENEE=ZfA)zq*8CZ8#0$}| zor^Y6snM;KG=gJrW{*Ad{?(bJZ6$y=Y{*8|KT-!_@pPpp&x8KY|ZxgYgGfzq(Ts9l~Usv*3=Q|~qX4|Ok4XkqnWEbrn~>>AO|v9ZsgUe*QZ5OCj3PM> z-8;ci^6--vmFzz01Gd}o;Wf#`_5Gks8WA$8zsiy7sNra(XlhjC#pzRGe(!U)Y9_ub zE1dDNFqVz9dZ2PJmdb)jKQhtg4oy4Nv7?dQtWt_8Wt61MvvAVlsKnHwpsB!F`N_k0 z@iFJx14n6;v6O!r>mnTlW3Ad`5iGU7pG)U0YM`u37CmX*QjNW-B- z!1H4e7ZZ^~5SNzA!WcIu+NT&}ucK{65&jgGHL9m-$4VtL|5vc?zk|>Q;#x>%Ldg)s1dM-!%YPPQiF<5k9X{l5jPOl+jaRu*E8bLP8QGBqUD665Mi zu%~&7yewF+|5wyQ{C>uAM{Am=%FBZ7y81Y0xw|RTL;ZdxN`;*5w3<9;xwt9QRXu6O SdSQM28?+M|D(2r_;{O0|uQ74} literal 0 HcmV?d00001 diff --git a/fonts/fontawesome-webfont.woff2 b/fonts/fontawesome-webfont.woff2 new file mode 100644 index 0000000000000000000000000000000000000000..4d13fc60404b91e398a37200c4a77b645cfd9586 GIT binary patch literal 77160 zcmV(81_!itTT%&fM`8Do zgetlXfhX-f>pHa>CezJ5a+CKJB5E?t-D3Q@I zv;Az_{%F*wqQWVk+*x^)@=9sx>ldws&U_`?fwx|)6i0%hGq@6No|Wjj+Lhc2#LbXI zik@&>S#lthOy5xS4viawbfqcF5t#22r#4c;ULsQqOn&iMQrAORQWXh`G=YxhM*4YN zTfgWxZlU6?d>wP(yNq!jqfNVxB}>Ww7cSen4lE1$g!lMN&~*PN_7ITCO&u%|6=U~^ zD`NV@*N5j%{d4(V*d&F9*Lp4o^=-wV4E$&&XJX#);dbqZ^8pUYCyEa?qdKs=!}D|N zZKGn0G1#bWFe1l-8nC}AR*a~P9;0KUBrGsNR8Um3F%kp&^sGD!?K|!B(qItgwkPpO z4nOg8&Z#<)4^Bj%sQjrANfD$Zj098^i(7$$Vl;{o&HR7r?C&hE&b-&}y`y4mHj%mu zNlfW!ecOyC;56fuZ7e6t7R&P^z1O9)e^Pe=qGENxwk%7Q3&sYU;&zJz+X!u6Ex^F$ zTu6(Z`;JIR{;Knn>IcTcKbV%&ZSxB`P>8MADLLm#sD>oQy@;IWvGh3j=*Qa5&VIQ& z#BvplZofSw5gN50lul%1ZW|#duBPzgJG1nxIGMaB*-obI9wC1%7zRoi%C^%k;Mn?+ z?pUuq3@j1^4v?E3B49cgqW>EY2?-#3jqje^;JgycOCcwp0HG~LNR*rji6bO_n_6Fl zxt$OawF6EyR#iAg$gdotjwKXO)cf75+S~gE2n>cpa0mh<1W_5Hw7c36opP+~qRPFS z?z(HcYuX#9GugKj(K=EQB_0sAfiipahu*36k{xIzyD2!y5%vK1@c|DQ3Q0^$kT!Po zBklXM?*0ZWJJ6;!hoDZHGR|mrw+{{o{_lUy{_6}+Pm!l|BNl}Q;&@bv@2Wy(0-c_O zab6Z9oUWgiKYRW)Vv0%P;3X|rT9E6xVx&Q%6AWJDG0oX-H5vJ?>5A8;PEnm%C;H~y z%@URb{E<@x+!!CGA#@@j24G?{>Gvg*2lVeVHM;^7(Pnl#tDV)(Y|gCiIh;CbXJ$WV za+~#V|9GDufDe2U{2(L>iu$ z&FbBmZ9gV+TlVF2nNyNeYL2HloUh~eKdpS)>J9Pm#Xd(4%myqFVno%qUa9n|Ua803 z8#-)?GmgDZL7HHzH4B_FHnRat`EXP62|?edFIDRb!q%9yytA|?Ib5`-)rNGqg%GbH z-}d(Uw;KH$fouQgEh;fvK+gfZPMGsl{cktu>gD1?zL z`z7_05U{qkjReFC1qI#x+jpODe!iG=?eIufIBbyAS`i6yq~pK;J!P{R?B6jf<_85Y z$&N8sKi05v?h+0-IZ#Z-(g8koZ#f{v7%?Dp!%F^s91LTw|BvSLb7Oj@878i9HK*kSp)6{%ZXlv-PQ)RD zE`x4f_xM$H9{@mn{1`uWwLbR;xgELO9FcMuRbkvnQXmT&j}ZE~*Z9?u0F(1c4Md6G z%ZpLJy?$`%3V_^=J3F{;`T31Z7#Ad=bomK731~(`S)uLTR8OErP908ueHZaDB4D$q z{GZri&j-sW%|A#W5to*SAH-ai&E<86{%v3LDwPh%=3Mm7wrS#iOV1$&8oKgshx_jMlowl4ED4$f#L1!t6C1g9p~=ODPt z5-F*yQZ*RmNQ`~4r~k{Ouxs3@+Z>Q5N}1kIzW_;y+Y`2(U+=Sj1(9)2Vkg!}$DaT~ zSw&5w0~|KUc7%a7st`^}4doR9Pl!$j8b%9FcqlQFIssg|->XC5YmQ@}VmJj+^a&GW z;TT&?6ewkE94j()E$+}^)|h0Xjx{@?P9)U!BBDsDj}WU31 zAtcV{=d|bI-bs8=m>_-=CKKcXWW_GX0~^$^=>jcb2lM)283`*Z!V{7?x-M-}_~|s` zV|lNhxg(2J)xt(s?g(|g4crMAX)o}cuastffHd9kY=i3#SX1;l!-O06F-4v5y)!_N z{n~32h};!G7bhd5ytZSkz1eQ+sUW)X74K7DJFF%9?n#Q!!7ID?F7r$p*h2z%vFq+0 z9=`hOhOu`E+Rawmf`Ea#sNtl*!}&#cW`0Ouz3DI?ydh+i=s;0>PiQfT7Zu*A>rw!Z2oWMZdTlLANQLT4}czIhYZic*axDrD;QpTldic#?)QnYZQ#V&@GPdWKu$ce zkR96D(D?F+uOEL7E{&8{@#anN+7VOiE7M#=o-3l-Qlfm(Hnj`lCvjX<;N1eImGc}P zIfq1q23S0QB<*mCfZhipyXl3dlKdo_(zgrVEctLByL0)aRMXBH-Ttp)yZ_WqYe|tF zU*@4;)#eID=!hTcSCgMs|CA-!(RT=~eyOCyMAVSk!pq$%^Rswq@*cQ(TXI^ehX9#d zQzf)Vo7@<4U`9OSg`E*=es@n8G*SbT@I9!qVekl|qYka=BE@A6$s=C?(x-c+DlyNW} z6eaQe@Drh#XmE?Ex(!VKoZcdgD?X0w=CviN3tmmjikMECbJNHMagMY-l@hQIzV7AZ zriQRf5j1k=Eh_KlCFt5{BiAK6a8T){lxWsNJ@?M~+S(158s#PwDXC&%gvLuu_&~q; zp5%18A)_>(Gy@` zHu}fy7?5gdqUqRaZ9G+VYFVjT`f3hBTtJLx%QHo4W^k7Hn4dbj+U@EPSKG&~pSs!K zvyPmU&Tyr~vom3Dulo^!F^FVgi})a%1Gn9)rTvJRN`lw2KOkz(aW}5MO~dBSW@edL zwPwp4)N=wJup1;S7@U)OkZj2gQGo~o4#o=@iYEeNjFZoLvW2r$?(LKzQYnI52$jlzP&K3-Fs?@ z8TYz{a*Ip6o|)y)qHif|*~IjRGj3tOR55>Cr^87ZMJVZQz4x-c--DZz!bJ3J`mBFt zv$MzMB*TT@cUYc?%vG%XC_t5juJ=v#VIpp<4lLvW$%%|VH?JfU3&D=q@FkudiARUh(d2N+ zWLd~2X5t4S?fb`JHk6Khs0b;)4m))>Bf>MuG>~md#IxJ@3UBxJiBI@&t;m6*b~tLF z>Y4m_C`-#PTHIv21B#D$$;E^HZ8uiYUtFhV*G%O%3~-xR^LiE@?1e}-zAdW`mbEM> zF-u5dt!0p?EOIRw9HXESaG^}g@5b$*Gd<>1m;%N!sdSMt*}PbmYdWd4wf_iOfHlC+ za|MYGa1MylQ*%_SxCI*3>pCu7wYNkflt8fcEw)9s%#j8m5R?-^jqs5&y2-XJ@J1PZ zvCEQxGD63Ll8sRsnbjBI1u1mJ!>4@OBQ%73++6qLsDSXuV7F#t5G=NzBh&|HiRm#q z*)7%le!&>OD#^0421Im4)tJOE2i~}o^A-DsEaeX+t0KZ z{sQInfSneVRDtp{f^<>g*rTZi2sAuCI!Z9Zh$ZFSky>G5VCcOA>UPbn{DxunR4-Zq z0{Rr3Vcwm`(344N37c0jkQV&${exerkPtp8!}^!LNFtPq`QzzulIshDd^c?rMzvmA z&&_^jixC$vO7ZGm0Le*_7u+*exgqHorQCbdJY~!;JgCi-!q5HtGLD2^A9dP#_`PVfh~Qf+*{6POoKUi6l2P%*Hl&QKAyfLqkaIKd`D8JY1@={Zhq*1zZjQU5-VVG9EdQhh(N}S^W*!YLJe?QZ~`l?e_yw z5+Rt%0P61dAXbLEnF=K$2o+w?V3$raPx6eS5Bi3KtXuINb~@n7ggV*iUfP^;*T3fx zK(YWg|IErMMW^{br`nI~*hvLG+;Qa(JTE9Xz2mD|`K zWkMsBLSxbz*}wwmYD`=a5~IW|zFKINTi5zYJdLXS5AlQ;aj16QewJ%pn@7XW)l@{k zKU1m8+14)_#x2y>CEb#Vl-cMv42b@BrfGab7RyPY#BuR=W2k^v0h<(f44SbZ&kQd& z1c7+0f=Eva?9UId@{fgyyLhy>XLZ>Hs_gVQ>JLK39^$?US5+# zF8FwgP0>wLKjyriCrA1t{C?ppovgaV>1c~smv@h!4uR$(`2`$DeE7c~B> zpO)wsEU7ZQ#)-uJ6()96NKJ8Y@H7-Z0#aPGy|SvlSYbSo*fbFCmK;D$X{<=pL|?w> z37bU`XR6OqiFvV2n$yv2RQ}kYO5LsvtCo2WW6I7VnMg|XEFd+Y{o1b`B?Ku6B<2+= z&U7;n*3GsPjMqSY02HvKv_gCJS?}VwnX)lP$9Q?8>7cln_TCYaRXg*#;^hb%1uH+IT+qbi5QUIEkAPwUL- zZcK{joDF?6iF-BK80ny(qch>Bj2#sVh;E9olq4i9E2BhC2h@ZuNbOcWnAb?Aj+ol{ zPjg%dw*~)|Ezvu`S2h4n_?1nG-8izHMroCi)H}Y7r8gOC^D?nEB?8ux%nux4T`W2w zjmomxy+te?pWb^_g#G~wZee%3vH68gXQ75Jt@23+IdVE`poA6wl8hR#JV_HpwK4Eu zBw$Qpa>tT{f!Cet&Rr4Zc;X#7JyIEVCMr=i=zs(;dVe1C%lLUbh~NS0gJ4a3_SBi0 zWKV|KrDg~RR0H=-#?#LMUi65trDJ==U20Be7 z%Xwpj z8rGRuVi>6*eIn2 z4sdTqnx|BWhY_zMYaCA7zUpjza))jPvt-vupa&k7+<6n*ist$5`NN|BwO~KBX%LYryjwYCD`L@BOz&Y#&6yLk zrl09#3<5$~a4xgYhziDTTr}+GvxUZ_irgNJWb6?^#5mb!Oz(fO^4&7G%H z5^GS_GXIRAC_Q6#bn~Jjo?A1S$rmQJt!U~*P6dbvJ-70Rj*C#qoAg1nM--Cz!Y317 z=u#u7#!Wgd*X$9WGk^)j?$&fleixkNGkSM;Ai$K^JD4}R=>kur91A#{$yq51$wX5{ z_^yQCFMy;I)XX=RX%FBGjUjh=$~M62v?QPtjW|Ux>QrIgjQe~*2*&>nXZq^b5AiNL zZOI)6wC_3KIl*(?NODXbHzum22a=JFGaEv41mKQ*TW=5nCK7LT+EZuu)vXw=D|?|q zMZe$WYg*z7q#{n@ie%~;HG`r$nwUvewW8XJl|HLR?P9D;g~!gQW+^ITmZnEFJoC&$ zpqK!kl`d!W6#u8;k_s8NrGXb9K``UKExyy)qZX#Ac7FthR3Nwo1`lL3ODL!o z#aVG+vZ|XXb=~EAEWJ7~DkOX|><)vPi!TI8y2~t+U`4!!=-3qTcu*UzvmX| zU;vxoFY7w$fXLF*)+alS*@;#LhY>_6%d`y63v$W)kPx*5f^bYS(x#$=iQiEsSbWTj#TRZs?$7t8|iN~L%c(PyNt zN>cc8olk|i&vOa$9mc_tq1qTUO?Q~7+#U@N=prKaG!!!T;ppICO~e}UM7l3dA&J#? zf-}{*xAKAEE{qjsE0aKYPnTB6aq63DUe`n4s;NtDuJ@l2EaI^^NCY{ITBxi%Cb)05 zg&!!x67sqr4))=f2=^B;|&U9nAtxK%O?JrH(qLN-KLYGA2ys`5Pbca_F5=9yX0 zI@KWOZ;?E|06C&Ni~*hajz+-M`jaFaJ2KXs*J`w}5c=M_?075|63ZIOft^DH#ZttH zbQl)6uo5JL99BwZ9>Hda#W}|*0Iy-0IZ%nKCgAwd#WqiGzSaX5Y^gk*)brv38S)wL zWOF?u0W-yO7LT=1Ezn{_pw#>#jSuWwImbE(F^wt}}lf1z<$?f+@!t&&enhvFSp|oAa+s9!U zHXe30?GjS`pv=ByF^BCWSWJbRy2A=eiD6-y5fj~pEXMQfgpkY{A~P+|N8}+K%cVH8 zxAHg&eBe|%Q{GUMi~=9Hw)OFF98FTLS>9sw=B0b@E4xqqW!sxF_VU+f1*fUgb*|_4 zRz3PvJ}t!oYhpH4pAwRi(5Y}*;!VBKPpDx3vfLzB=tRMJ8;%jV@j>6aqg%i<1&#b+ zk^D-3Kdxp(KRuW4k%?rmuP94I&g0b4>O%zd6?@oyO6liO1^U`$YEO(w~dfSW-)I*JFbc95RKnhH_Ueo)^V z5O<-H?_2BbD+u?V6s?hlkNW{&D{7-4R^P`fkDgL0;{mp{b)#&5Aruay{_1@GD<`i@ zS^hSgHnz=Q2J4n}WYT?K1Ba~KTmN}=+nAMVj->#wyKf}M<5@kRd1_Le5osxl7MTWO zkkpGzVMHjsSp8MXcS#7V+PhkS79{jH0@}OoIU2e8CV!dMG+M*m)+daUL`I+W-4I(& zUB!OpWEez0R`B*0QI%Jr&CRlbeRfkm!A=eXZTHE;D+5#BaqzefNU;B5|N6>RA@|Ob zujYmt7m3)_czpI-ihZS1NN z{mBusZ?O_Oo54A_*Q29z84jB*6Wst#IvTqXn1FOd0WHRQYg4!CYPDfB?VoaEw10XJ zM*G{lAl|>>gn0kjc8K>kTL8Snq(eBCBR95iHQy_>TsDaOw3GMV`td+(amo3Y-6~SVgFExhSbYQt48O)0=vGOBz@93V1J{b z%hnjMkz5Lb^ba^Q<`P+L@G)XOzkbHOO0N0Xg0Ihy$^3ajb3G!GhUm=0X6-0?ONj*> z_f3DrB8?gdNMPm0cL=p(y+ve&>N;XLt~MwFIj|UsJns<6WB+W8-IyLPg}oO15Nn;A zXX*?`q_n+^0gs7HP%P#UtYbBYu|?p@^*>8)y$gH5q(rM|2sDE3?Nr_ z6;wk|U!eBTYxBbDj4oegyx`H4PD;~E0DDx)A+w4$lWIO__?$4^47wxdhTYj)uj=EM znyJ8s%uB-ov3ip%{vp~EGl-_rGMMKEfwnp}WIi3G1!!q)Mb=!*J@7~jy3`z6D|(ulUfoM`T~yvcgH%qlR3L>cQz}3KH_#K=7el_UiNveh$%U8? z_LGuK4xOlJQHD;H94v&y2_rh?&Qj5;yNIP~_>vbFIhO?$;xT|Nf?1iDP{&TfzW|C{ zCb@Y`IIq*W&G(5WFw0|-!FC7~@WzQ;j=+kc@=CQq%FR2Z@=-e+m0g92{YkVJKEF#;crZ%nQcFJ%ER9s%lZuHyt zzJCQXZKOUpq-8^{@!U>*5UtJX?PJ5B=GmY497K(+_9#(mFzjTf_-f`njzVGrbu~ zIo%B~2+9wdNd~?$Ckbz>{gcoZ5?p1VB{W_&eWQl99s=eyg47Eg{UFjXJqPm>4W7YD z$9-*oALJ8xuo5PzsHx8)k^U}Y)`AIEyYYQx=Stt&>pC^1 z<1Ipzi|(09mqxhhS;O1DqBDH|#e6Brh?)T?##hqzUdF1q6jPRD!uP? zbWjmu@AiW4LERk~L~lO?LlBOkXS8(lwDr(C^0>rF%Uwqug_tr@MLb@WZA&whtoIbB zE8!EYJKqhOTZ^g|%QMT``HvY}F|fSBy?KOoxP^}j7bAZUs@!njJZjWwL(^eq=6+n~ z8%LxAL!~qu?!w+=bz*cNLZC~R!u8OxQEj~wJTO)h@b)gBEo@zQDyI4YXo5}-(Ea; zYM(shM=smh)qbs|w%6;$>GU<*xxL%3UDH z0vH0D^OBr9a`sG=$rh?)7@YIo7tGXb<&x^?G`z4x$kihn?Wt54!tl=`j5ks~^J>k@Dr0)P<4=`SHK z9HqZCbCIW(RVN`J;D75Pe20ytLgS&Ts0!l`bX*&cR3jPU^U~6tO^zfhGHzeRUZ*DYv5=CgnUBb27sKfkX_*_QW8g{ZJrxy%`UQ0*MHZ%`jL5C?){`F! z&C1heYOrD0xYm%Mlg`aWz|)=J6XL61(PaYmoZu*Oee#}dZ#fyd`&CdjdPpQ^urvhm z*}68VQ1kadK;l>pC^5~>n9Trx;doyON_o9|l{4Dr69cU$EWU&B<4x-^ZkyN@g+6xh zPwMoB)w72E_{3`d-x8SCuyV~Y<7PBtbGlz8b|q|+<4fOKPHB=WR`~8S-zT@E#MIz^ z=alPCn@!+HKuGW89YXG6E7SeT?x%L$Rz`6^7@OU(bxT^EXsU2P?CnJ`_xORo0LS5ZqJMxCVbRWeo-#hK z{zFi%iIA{N#Sai5nrc7MZU}T|<(}BnT?3{T;ZumX`1pI_wN=xH1(7Hxv$bO9qbFvM z=4UX|gWc*FmBdU?L8VP}WEBU@DdV#;!@A>HA=Y*PjwWDlg|GfH5>Q(U8=Ya^l!UuA z`@jrShkPR|fU*HMN(H2f3L_iHxXfRx)nrwvq&6c~8APszz?(uMOM~~;e4-k-z`+?7 zfGGlRkkAmSbZh-=1DfW@EUpy$Y!T?8>kso)AM7dJxn-C&fjmLF2(TVpFr4e2U+g#7 z+4k*TetXy?4RKO}&ah^a69N0{Pzn%X8X;zvwD}fTRfDp#XjmKaqHNo}UcvD?D4zpu zpg)quKs{n;XPMnk&6ayDlWEX8k|(r56^l4OXTtD$NJe@v5fJxV4@4v5kU@+YF81KM zB`3Ckcdb1#4>KC1$+)+jS|{?MNO*>ms=Mx+CI?BKk~GjUN$;IXX{4>cn`P*Fl-e82 z)6I{U{cqygw40B6gQ97V*DIRULB6*KLPT`CR2Q|GilRB@t|Z3gvZLw#C-?I9 zy!hb|Fjj~seB&a|1(KNJ>wxs3916gZ*He~34@x1F)sNqi(l*9MHd0)QHWXaHyE(K7 z7cKZ-J*L4?vm!Z3S1w#G4ti~Cddo)5wN>F(8-aiB*r&s{6%BN!A zfXYqSk3jA<$0DOjjri6<$##L%7TK|6qVIW0hR0*(fg#o6fLB0H$oz`;1a}}DIS=m zbyp1H(H}*@XgRD90l;D@8c^gVE|w&ON1VYZKqwZG5%G1S)>4fd>}E_8%j0} z>CWmY4@fF`)8Fw6=$}2#(#%l{FRR_s*mX%Ry$HHIkK6B%!5A!-uyP}Uc?5jE0|so# zJYf39QTYezJ;eLe`Rl1hBpc|f(m|4R>6nc&+U%5MHUVSI^MY5$rR0aBG=BCa?{*tv z8T?`Y(3M|9)vn`N-fV}=sLpm8aiki6a}XqLIP~HXQxETrC1SUhA1v?k|2gmVR&_R2s(seFN2Y%r46JqWZi{zMzO@6d9I)pcW^+TATpWS22)!K7 z{@c%I{Tj3rhq(T^vsRbu&Ze%9K%2Jx;;cHVUtnV^eewPNOqD#*TeOfPRjbx2AAHc} zt-4#2+gs(Qnd`dLr*F8*$-Dx&zg#^>Qus?OAzM6)zDVOgj)gmgIpO%m1%Wz|)Je^w zE56KO{+Rh8zqjowkH|kGk|#&d2je}T?ZiXYJha&VyO4V8#=E9bh(Tco8rT zPe-~LXJF3m-dlc?;6F}7;88&8_{fAd=8#U#frP4_L49h#jzVGc!5lN~#ic3g6~oWV zv^sIRNviD2sp=g0o*CI#Z^KCv z#FxvQ-B_rBq7Gjt0mKsW!!`BC6$k3Nbv~=i32Sh;2_&#wx~G` z(eO_m^%*b>b$6$%N#e-yrUExgrg)Xbt1_?iT*?_%W<73Jkye1Kq|hQGIg_l`b~tzn z`?hTr4-{}gX!g?+=y~FiGlIKtQ3(zuiP@z5*mQMqJp{b_?lasFliFvhEL3A?EU$@}>?(xy?0}JwQH8W)@ zgM%@G>PXH-ueM<_`@adULW)`<8U01d5R+zQxRm%!F$xyv|chrOou44}{FQ zu6YqRf~q96u+ODLO0G^H%4Fs2B8k-be>oiK3g$C0AW6*^ms%)ZC=G0PHVrTJK#p08 zLXKYE*x7xsPgH(6W4>d;@{V2knw5LvDa+k`?zu!b?IaU>6Z`Pq6UTXDmMjv=q=0+& zbV0gTGkOq6NxG|T!|+7LG~A?B1pV4nGi0U@Nzx9T^F)#<4HAstN!zTAE&*ige(75b zE&EHBUNV4MV+@np3f(yUgLS?vS?RQ1T-jfytki+QU-&E97h_7L+8iXKTrxUZSLO`W zV$?#Q?RP!b+FLOvP6MA=R(dp(9y_!AD3@k>PN&3w;8lV1W+;Df)|ucTc-JF?m*BR~ zOsPF17R8HHWkv%j8E+8z^ns8d>p9D}&pP2~Dkoz~<@M#QkC?n$ z&e?ks$b<$?W~FX=nO!(W5x+0$ryG2dx-rUj?F|2CK-5Y)v02RT)wWJ`+B%|S>gH%j ztfKJtZwjIKzq@q2O_0W5goIMejlWX#_i4d8d`{b6P$HnB{fI(9u(`CzAZ=h_p7o2O zI!*lxi_iiR31c$L#i%^U6{h{zleCsq2#-&VQv#A)oq+%)VO&84x^U<84CMIggs<|k zy=BH+=Ey;ktf{G+F3hldr`GGNcZSEmemrDYNoc|SQck^RYZ`Xo=5O44Zl=_nqJ53m z?jA^dWvppdl~<{u*c`_{q0Ag3%_vJcw7Cau9bggfCgx23cwR=Xk^w6xrQHLW>mJ6~ zoLc6EiL#W%j~X5^KVItxMGgd}D4^Y)9{5DysmOKYi5BuUui;d}nD6_L6YasFOjC}# zHczo(ZSUG->j%o24td8i_|W>9e3D++Qxe`w@T9$cDvUBrFU6PyDH+cIXb67yo5J#3 zG40794Me%jg^c&;B&HbEF_T9x&XsSefG`7I4C>qZhx=cAaV){D41BBnVE){<2L>v7 z@O+e}#wYA`9CLORgK8)rap0>`tBHC{KGDrK|BkwuzlaI=96JbeGJ_Pwi(vS%g;$GU z{Zx5S_h+a9Wo0lHhxZH-?es7(>U}TAl)Q~QXj^ng`9!-l)?P)w#v|is_sESpWZ=t+AIf!#G5rs&Syz>JIdC**R%{28T7 z3V@q>j&C4r)}lPRp4ColvW%S&W~ir4e=5v=&{fKhhgb93U!Md&2bOjoJ19Yb8HK3L zy4q61UjHC7w>>t}Ha#-tZtH%1W3Rmx2ar!UlUNLfmEdH$tN}_H)_jlNOi-NOoqi9^ zg{k`SIGQU_MC|n7T(8vT(ya@_ty9AnT&F$vRoQmT4Nc^QnjT{!Vf(8~JI_I`92Py) zsKlD7l)2VxfdNW{PJnQm=uIU-Qee^9h&$N%C=>g=hc&|xSDL-sJ+%mnhFKt;XD#Gj z2zE4q&{%)2*@^mvO4vZ|*FE@S$1}z1{Oo{4vd%e)yV|NLF_6$95=Yw_z4vQ4lC3tBMDGfINUylPM{vLdC8$PvGww3M z#7!FCN}^#}-qt^>V~yZ$FrFzti)i5lP8Wc{b)L^3ngy~Q{tIn0A4raVvcVtQ$}w_8 z{3pGv*4Hunp5VvTf00XaophUX0ZP&+jLmekkfXZY#_;M=VNVsAyL*H&%BP~bR*Q}dWg0oT^8Hb z+8?1G&z0BSPn^-$hiXOPI+G&__cnoUIy{k1=Mc@&b;oJ3rj6kk$$N!*-WU(H*D=bT zr0V|Tqw7^x$?|Od3@g!L!cOqQSF7ZW$!NRFDNm;|d2K~(*`%*Q*3~y3q@}A_QE>1T z_6D(LLad5BIEtTzyE_8L9|e!)^p^N1XG>BwZkhJX2IjpB!BjvAu5P?4wikmTJr-d# ze~F%~qM?I`uv&gYSC`RHUPM?eSZ1ec==@HA#jy~*aWwx=5(dFZKo$AuQ_>Rp!25mj zSZFWpKHMx~mgDF1I61Y+^zJP>M|=fW1(A{|-QHr~ANxVa>i9KBlioZk*_GScI>eu& z1|bw(XKH?{PY2&7|BF?JPV1t%IM>@CuK1MYhZAS<3|$8;R~lD;C|B%GHu9HNvEw0;77(X?22w1IM z%aiOB(=+-KA2<0vs~0Nfhj)MhXFr;#l`0{U>G=9ec~qi63stjc&eM9u(Mj>TmCs)n zqy~jI(kAj;bc_&x@JKEnS@BxtC^T6o>twE#!UOw>4wdD*?dko{h9uAd6M2~^-V^XtQB8iDT>SuRV5`lF@KVqR6BpM!C7IOSK==Vpw&g(pxj3)fUkzqW=b~T@qFwtEZ zW+hV>@`(tZVIO~PD)HCr*ovK<9kXxHykgqU{en1fN;#jwg4p7qn!+cTEpyI5hH}vG z>x6~8sZ_AKr9oJMqy|Y0(OfufU3-I1W($>IBOJ=s6IioUUS_%(HTTpfCmY%9#O%-* z7Wh}nGS9alcExi=;#_~8?TAqrbG4o*nahwsLFg1}QWPF4TIl>4u;pQqh|II-98+uo z(Uzi8j9bgxoMgNzDV@owyPUubP~^g*#Jxy#7^83fyfvKkIEl$Fgu-3GXv3c-G_7y!TzN53|0z0QrgQ7caCIUODsHrJxMO^Wb*kGR?`kWpC;A=J&>1(h7!{7l6brcI(kLf%V{TT2<75-6 z8&zYT427ft`=>CKA>vVv&c z>9c-_$@t1_qhpRP6z0#+ww!e6an%ezStolEC*FwaLF8jo@%>hTO&IniscS@-4Xk^{ zrtKJ5&7a4q|Ll#BJS?d+UDhcz~oPM2|KSxUs4*+p8fP(ywu!Bkt8%c6sw78 zWyNMQf4$PiP-wJBw)J zFrI&zxy$w&L>{f?;zPdE1W50pp&X*=#w>q9Fo{|y964+OygHpN!b_)=H+o!D;6hCIj zaWcvUbE@H&Wtj%YJiK-AP$vs@i<*4hd0{uunqN#iOC>hj6>gO$NE&}#blRdD+`i|#RqLfDYEs|E;WZS(Jd4JuKXL$d|7$*@si*w5&^NgZ;jfd9P&&PAfyK0 z@-#u^rMW!<3dHgDRD+nfKzz(tB&HQ<8g4F2+(~@yQiKAa_dwrJf`{u|5QPP|UW&x-B%aYvU?T(iBW85A*9V0nld}B|2ByRyeWvN&^j9@JKZ@!Qbsb8_^ zONlcJ=M0REj)N6&mU~$eu?2^f;T}P5TkRP+t4-So4XIQpAtJu020vP`T?2z@1x3Vd zvJ1qX!amg}mWG+-dq>E0of@wos@EzJey05Ent8dE>tKl|t3mre*_a~%{M0D|w-9f} zC?w+bfEz#g9_ATATsZS!`bnjtFS^eH6s zdY{~Fa>v+oy@j+DD2O^9u(yLph#W_UVr5pQccN(|L%vTj^!N}UkkH#>=UUua>^w(f zJbJADK(RUlt4b}v)x_UlVCbm>IDnyO(zDGhZ+jkL3o0&`h0 z@{No_wWBu{*EDzEFzZK`(=~~~dX2&bK`()oMNe|h|4Dlo1x#xHR(r?t-E^1H#SqLUK8XTlHbx)yx-zJV%;W zKH0>$zqd^jvt0{Zv#3t^*dDNRu~*%VWSum|q z51|7P!|^AB8yP?XE}H1sStdAo3W_XgHx(MPwWI3&GkMs-JB@+sRef+T-$|bg0qg$@ zcvks%*4}As_(r{2#p-68|I7JkSlVNUnAGeZE@BMm>Ov~4d?vr*k9=pVw`DKNYshuG z{&rknNQbtbo??Qa3K@Uo4zmWL7IK@zzE~4tS9XEc*vZt)r;Y|JJv<;-Pq|0 z%OO{|+~4Q~2Y_nK%zLWsoY`7QB;R_zdr#gJaIYRa=XjEGnV2kj4}%4b7WKja_3cjMco6HoZV~yG2pj)qF`7L zVJc{QADVF*X?0cOT;3WMsv=DOy3n*h`BatGSlLolhrUJwXZBrl<;2|=MZwM#05d?$ zzq2)~RxsboSgg_(FUIe6>$S#fx_X73LiM~S2ib$bO1gL%8=}nT-y8|%NqY0{0f5ps z`ihbDjgrz?{)Wz#?J;z;zqWa=h_}v~Uwwh0e6)CN<68v4cmhg&di-qj$o@o|*H)MN zhH~@QV{>G4ak_TpTan|pCJ~N~V4rVQwtu+3Z0kPcpe!WQvt4J6;&li^~|lB(=48NU`r2 z$5ptqRbX95wQEDI>V|^m?Dw++2AZ+`PnhjdQ-wp7;&+p8j}{AOe&HW^M>tULnR|Ok zuD>oM_4^m!6*k2o77=|29Aq>saUVY9U>1M`Y;3hvO+r$Wxlm;ShBD?sjWJS$x#CFt zalGMd2ttrizow=n(pRG;iN|8%w`f9%viT0fnpPY@C_nri9kzc)_XwUrm{EN^M?~~8 z9KsqptPf>CkY>~*A_I*VIO4tc$c;w&m!_F!^Xs=YV7%&ksTIJ23`_L&b#~lbrq5XC zwJVsP@(gweY7>RvwgO%>J>JhSGf$I)DB$V(zS=M?Nr#PQOVRaGpb^N&Z?Kz!PpG`j zY2z{z2Er-Wh6fb0NAky>3RpbR633Wj$86{78f~M+Q_WnU=k|wC%-kU%`fqsdB*QBV z7l{ai1U_VJ?Zx0LjOU$ViklGOPDxDz7Q{@2g^ zTzoYk-lO!p*rq7Q`jeoGlGu3*@oJ@Ulo@R(vh4SO=F>b}N0A8?-ZIw*>G5P#o*45` zoR=`K^ynmrr?zg-4U}@Yt^%@cxh{CkoMm5 zoPXV&&8X3vA}~MBUNYsjSVrfKEPHdn=5k+U5I|P0`W2GF@sfF;XNZy%{u&bu&Q8i- z=V|l^j+gs)0&%@NSlY-OMMQ(3T%oOEF&Z96qmn4Lq!5jYQghe9lB!h2%iZ)m8(i9n zQU3Xn0y1<|34=SAp9^4;)!bVf2iYvJ>OpJ1qf4XeVnl2s<6=0?EM1vtT&$b1{(Ngg ziP`1QcuaAAau(eR)Xs)Je2aR_jJpp)irmA=VV~$?#P>g8-w^PChhYw9GrTaM=nm53 zC<$un+#*J`K`QNg-=oW9v|YuSD_BV8lzPB(|Jl~}3*`%1sRC2!;!GV6;0|>541kSrttz3llsEV32psoEb>y#`{&)#REmCm={YP3 zkS~Izr@rF*wXZJjgaYCHsz`u-g(1b@h09>l*8)ZPyAQk=cp3W?_!Lk1+m;~P8*K!4 z0ZFiI>Zi2PkyUz~diHB7y()Zd<(bL?Dhn<@{q^^L<@~-4$mL_}__@FWXmHolKV{8X zmtDCkNPNtjG0*go`N(BIsa87)*ry2&G7*|kQC5h&l5AHtZ5%aE5u`I4Cj;AF{i3TJ zcoP!fEU41C8?#|4RP34arDaw7u5&RktJ~QYgl2R(7ZZT|fW!VA{8YQHd(t7WicG+# z(LnD{Opce;bjQ6R$qxFtUgJz5bgkxTAoiq|Uby)>LlXGRQts9Xg1wpWOPu`;5H@|AnueaE;&Yr*p!z}53qVrc-7QXPLS&p48sckL6*~l23wsvl+#eZ@qD?{k}E!>@*~j(GCw3uZe+c6>cFUF(NmvF zC7+C~{t{)_o_?MERiAN})$tgb3cTL4+0ux5*#%N=;LyJ;H-rU?%dzP961Dfy#l=2g z7sV9@3e7L;bw(0rhldkSXDLwUl}hx5Tq#%^zXWR_Rz@Q6=mT7I_Se|Ta?%1L^4NDp zU9)or6R3XU9B02{=iu1H`}AmFc}s^F;7ukNi;7i&ih z)Bjxo@;ow7%fz+n`CL9A&@#?$i4;Th0(zq zq4@P%1npcbS*gTbO0&BD8R^ft-;ju`#KWw9ySA545D}A}9Ns}CKAj7;@tFi&)#MX0 zP?>BsaJb-4lf%)F2=;+n%78RaK%c^)5i9`50Me|Ahl4GHEE$u}8Xyn}nlhj}i8BndXM!{V9@ULn(5BO=r$<`sYbb4v3~;t~tLvr= za%ox-M$LVSxQl5z$uH~snh+g~V|q}Z#dTK2Q8`78(k3U&FYF74k#^;r@~!y%rO(}G_EA+zTka?F#8vv(l>5w`m)5p>zc?}JARmg2a;0vX@8X)$ zxrGwVeI2^a3I#e75dbX2(7D|AHX2wrq@S+utY)mi8fBX&1q}yIO&OsTGH`r?G}-iU zHU*Hj0#KEWC4DbARw|3e#iG>jy*FKP&EG4~32 zmoC^Zo2~LJm+tb7QgYY%8DF{mc~wIt63q`c`uX!V5sy>UWxeE81)SF@eNm%^c75VZ*KB>B;`2 z;ddS|3p!af%~7->3c!l$pDPw;A`&Gk9-}fE0qJzh^_pOfN2QS6w51KeW;$q2Gwc>K z#ui=$hJHLy5Ccv6zghsx1S)re`Nq%I(vb2=FrXH2AtGRbP*dgt3ry$(6*dbBHmpzF z)DwFHCb+zC5sVNNXL5^sPFcLNv>-LCj}*in zB%n`#2xa~aM{dQ&bC}^Iii}(a?`ivB<3!fj+0pGkwBNo3JMsYP=y%-A>orw^cxry` zw9KZ~+_i?Pr}WmHpFW3q)2ZL~;3*u^Zz*gl-tLh|@GTvdJNwA=0|P7Be32N^D_f*juK7AWtCz#4>hE>(_0DNNN*N>a1aA&IDhdw9bkWyB#<|~n11hB zccL`+tIBq9mMF%!i3+ z7PVFGOz=o-eeG5ewfKU|_u7UZRra6A9V$XI{cMyD z6jD%T>j}|h1Ft6zzWU8PYR1716h*Dx5hTjS2M1bZcwGy(MXMlwbkF7HBmQnTJ*tKi<85{MeCN8$Q(z-qr#~Oz!UG+tI~i0b9dl{Z0yvB||xj zSfxDrQSI$sY5BX_?~8CORUpWb6c-C0RKtn(ev$1}t}+)WCwF|-FPf`DGZX;A>ao}8 z=Sm1HyL1Zb9^CP)S7%I4B=R6z$X4V04t(CenRdWvFj$>f{tW5tn$OTY+iH$z=lPtr z8Hs8z(9U~uOipdHt>#->Odj?#Q?Vpj2!j##rSZy$6MhZfhoyg#kxQPix~=gT-67Rc zMJU*dnv;ve*-$zrf0y}tug1L7tTc1QlZk~_Ofx}@Hic3R5ovZU6*mP_5IUbsu`{i( zWd@q@?zuf)s*8!Q8KT9eG|RKUGzP*?L*MCAe%z3Zg-%N_D`O-kGnP%U{MPApJUXQ! z6v^u>OgO2=!ar*yf>Yt8mk!+9#p4YSJoDfdZ?`D-Lm?uLxs_J(rRaWjcjl(l~; zK?+iH{>VLBM7RoSIUI4S@8WhIf6qhQZf^tPol8<4GKO~FDaOszF=U)$eMFfuYdkqW zz+DbI#5nz-fBL#YQYm=$%cDC;(`mGQd(AgAp3TY^G|!J)7Q_n--a2QRRtGJ8K)4{? zp&DP;fJ#t$7p1e0`iG5`SUZ;~VMI#JKc$bHToof&lELh9>6+(v@NK@y&Hh32(2g=( zsSVvd5#}~IYKcssUrw z(x6waKfH!3`oiD<_5Zy0<6z!{&xf)jL%o2P%Lo|7Lh768S0_TN!+x`?g3bM7;bIK{ z6Vm?g+BJTCVDQyJ)=e?_>fj3~(wvuFsXmya5;| z*x|VcAa9N&-KDBKX7XU7%%a%*bg{X~pGvPJ-}~dLNFV;?TIB!)5=)iC)QW?#9M5Y5 zz$*|;0d4KA6yD$OQZgQ-<*qUGEUuZslsAo76}LL=}fX=+YRK2vu_!3iu+bq88_~6K6d23g`7+NXELRGw=j@D~xdDR;< zSpN0LOT*?Y4Kwiy?nVFt`{lej7~*hC>vfK=u+_JN3zv-9agadwoS08RcK&%sH1PV6 z%ii8DEN!`?BSa!z%+aHV0XS@=QCjt-G4=C;tI$J~uAk^!t2A#)+^CG`?VgGcm8PJD z9h3cJL^kJWTc*5x8kyHj(HvdXR``B_E{4}Sw&@Ox#uCibFnTHl7##W;6`Dv`*DQd~ zzt1>$l zy`tr!xYPUpkWSf{f5Sj7i_}-tF$F}i2YMV^5W%qGTd++fR^~PAav?M(Rhe?D4Rhk4 zHzj$00OwBGN+>_2Zdq-K9wJl|`a_LPZF2iA1n!vKw0mMxPE?E?>|H7uedv-Kc3`Tc znERrYG3s7Oo#pO}({__iZ|+swhCx#{SD8=QiDe60DB8|K5d-C-&7B^FbZ;?Y&#M($ zNP_3Qd(pu4q<+gzfPGdS%Zu5$0B^FA6+DYRBgg%sZ>sR_zEnm;BJUd|H}5m9tk*8} zC_fdxX19`qisj~A-_rG9A@!WVvHZZlyfGzJ@APp@I_R9IsL!~3k_7ueI4AQLE3Wlc zsJ2%gb=#nVoiKlk3(I{VD^xFu?on>(6QJU35bBa=XfzR!b_H+p_jZ;uafnByQ$ZFzeFCn{3?&FTXjn(nbO86K)<>eWp)YTN2fr4;#I; zuOdnA*$U}^3y!5y|wZ%gt2Spw?1r~Xs#>Bj<$lV% zOegfQxuQPduw&@N;gU{38I`@@s_{4=;TOt_ihJyWm3kCn_5?TuUw8;s;?(fd+}bD} zSR!4{l&r*?O*VJ_ETm@WXJ(YsE6toKRI1fV8&wE&J`FACU3z^38-{PADv@nR2gSA@ zmNAJ_%^i$9yRo{v+qLC~{I@2mg%vs%mzhz6dhtl@;cB|QY#OF&{<%y6?i>x+MlAdP z!SMKxVdz<^A}37CtcJ<7rLtm5aC`Q=mo}}{tLCH*Xp`pAT@$~J5N)ar{YBC}t_#wB zlImumyV?Xsb{vY|>W4+UU`1DHZWeWT;5Z>iR$1piKQ~KW_7y9eTQawn-6dbFZFl6l zbHiG->gi2dKiqcWY@V}|IitB|q=-+-49|NU`Le1kvnM&LFB^Ro01Z@q<;)xF%I7xO z-d5{+!?gc)RT8;d;?ZPO9xPvV>Q>6_qvS=+D?%1Jfq3HKVUJlZOf-#h-B8Oh@*)wf zp>D75YFjB-bJh_xG>!EE+aSp_bLCUYHr>IiqVf!TnJ5J;iECG?hY&ZGs*@ zMqi^@Gv{UkUbjpVm1gT^CmIz%)EFjBH@8MGdxDJTl@dp%im_D4Ld4O|(=V?dX1LXQ zabx&hE=(>-5wdPx9=)X5(pRBtl-4Ni5NH~T-D9L7$ejA?u6*K(CD=bDz|dU%gf`t3 zQO3ZuZYsH%Fu(%jvnLp<87GR3j?-7JXvC@GpFR5k?!}!!NfITQtWVex=oEq$Qbdv_)@$k~&IuRwktnFF{qbwn&9`6Nb>Uc41%a?M zgG${LZ>@pdbjP58^&MamShIiV3+(fVYy{dbgx)RP)TyehuE7}!6jVYZ%RegiAp?{fle zrZ~A&f3U?pW+7v@D4I(fNcW2BgHx@`=twsqOz=~`E=0rvH0O&X{@H$A%i7trVZ2A_ z0-AHLX$VU&kiqv@&@*~q_hy|-?`nyJ1?Y7xt?`{TNyhP**=B8&I%%g8dVJT|pQ!OT)J~x!odB)G@6&^!F&Xx#i;#~kuQXG?@y9`0` z8jmoU@C*%0W|Oo=J$eg_#%Ba)iUY57W}7z`OL!oVThJ2as~-$ZUM^d+rqr!I^IFjX zWBVC5Xt}pViP5L?6Ps)lU5J|-On4|x5|JRH{|v!INPmIG^6cHduk;ZDTpT-w*`2b=}lq&|5&VzP9gpLxa=Pdj-IB)8~jZ0xqAXJQ<(_Q1Ei` z&6%0u5p%gQxx6o&7S&E2IIwkfqP;HDzf-DTa)fHDUASDWrJ7-OUX|n{3@uxM!@ zW_&@H(PqGBU3px^=npz&)a3oneUBfD$JMVB=SHsCO|dRb7o{ys+C!t{MTlnUx~#vf zb?xF@Q79BkjoXBvQfjTMxl;QQ$B)tPFSYPn%>=h~4pdKK4y21jI}=0Lw_^g0MZ1>0 zMaEQ9al_sGXftG#+bw$q{AO5i7R1BwHm9v<4_%_U+g77UVKY3f)!YDfnbb-^Sf=9X zzUTJMO~iU+Qp!wX1*0>fkuR76^az-TxMX^$BA58{Kh%H&A7|P+L|>&H(ZW!uzBj$C z!e7~-%Tr?&eZCc;mcswvsPxK}{4kIt`JFHVrJ!^ByWpEmM2C~*PgS#&h!5i+1eBY&9lSe`3@5A=D2})4dQ=Lbi7ELpiQ@aGf`O>dG~-{rIee z9&s}0(W>Ca(zF2gRl|+DEbGjMZCmj6<=#PJ)7>Vh$6hE6ad&nj>*K!(9`EXsj{E;E(NN#n zqq}mP(>xZHN;%~eYdXK62QEvGuyRNb#S zGVo+VAqX@L`QWZD3X+OWkpnnSEM~p>rxKihGE`|+4RwpLb$8_IQ< zXVLJ&lFU1%8B25DCl6kvrxKufD}x$0RaH-&sQW^h_|UfME3G87B~QCKWo*@@Dv{b_ zK&puaMu`OVV>T3LX9e_4RexXEelcc*rgptnyEP4o5c4fo4V&CB9gi5nAQvfLMDcsQ z^VG9qF&i0{BT;b8BYvnDRc3XEhGa-0g&L$J zwlZr`49qW!tK8Hd13py~UzBx+xJKWsC_4{hGpMNf*5q8{KjbHZJNA z^jbTY%}}r_Ptz%g(^#edwhcZ=ca_8*&Y? zl{cCt)2II&xO<)-uML|M;dle8ZJ`~f2E8$F(2}$CX@l``6R_kU5=z#}+)tXXCsrYe znIg9musw++6$%Z}mo$XJ_)Al|E9#NL$|hRc+nIxrC#2?vrCE*+;Lu*%7Pkduz6Aoz z=6?VG_kH4)EQP{&Cn9sBZ{MzDvB&+fAEV#BeS0nl=WFQ5$W%&MJ7#9;mhXj**J`Ir zR+6|Jyh86Q(e`S^+yNbNO|Dl=uOgcpW%Vze*S5RgyIE$L{fzW@ccMx4@;YnlkxA?5 zaW003$Fc~VWK36SZSMTIvt1ql$(QxQ$NOCkX3yfdDS|@b>U(Um*1NaC9boQ^vC3-J zexu%o-s!J9#DP10tv9j7EqX!0@7UK^!6&TF4s>Fljo2K6S5MV0n9Cm|0Q3e&Q!rA= znpX9Z$)8+E81nn+%5I`6XaO5-DT|>j8V0%P3hEr&E5R&YWX(0Rh&Q}B338(XS`fzLR;O0^i zd>Hn<8c&)sFK*C4k~U4@vH;Ce=+&!2e5nwaToqMrp`;65!)&i}-NFU5JrG-atd}08 zK?AM@KeF)*dP-jqQZ@nvt^QL%gXO>D3BQc`kD#^uZ_*#iOk;S?;n2L=z$7UxKT4FBS~l*jqV5r3fL zc?yV&`?|@ewX^2-Wh-^gXstuOJjO5YEOQBWd8of5@oLxDN$2purs%J=pL_ArjuQT~ z`pGQWzw#ySrGw631ydqhJG9;XUw&X4AwKL~`rM8aD$d$;T{udabsN{W56yK?!3~Mk z4%MMZK8T74XzxsGaW`k;61Y+_7WOR4s*$=FT3yC`ppYc2Lt3S*wviCb!H35qsum>>o?g+x^38-2Cux#N_m_E3sN z0tqF7xNdRLU5MqF$v(gd`g-)XXqjy=ke8ct%L6}x@&+Ke05ej2PWVuP&-WV7*Xz-^YdpaeNVp4 zS347URKFp(y4dzcf?Euw`K@p14Q!Q&zAE|}u&1=ZO9lazgiD9wRd%-AyvB^#t4>)o zn zTIh5Ujl*cs#>u;pQp2VJM{vf&6*oV2Nj_6aiBDkj?Gq;%?$-RYrP1murR10)yKlB$jpRoq* zU7O+1_k{A7X`)3)%S6uynj4a-7SL)p zY{A_GL;yC~rxz{!hK~Zb)WIvKeOgsCpI)x#cu%$6yq%wB#r)V&9!U5b6c7uI!s=B! zB1wDqDUsYUg#?XSz_9olF7?xcD{h2wDDc&ny!|Y+GD2sBK(aaW{CO3T&3Tvuj8CNjN6N2 zc^<8pBeum+YM(Y_a(^QMr^u1Bg5DHL?aMT55*qSP76$I$#wd9XhZgTn_04@GZH^3E znglJ&eDjmkh${UN9h6h?id^^6oQ?kIhlxNE{|n1N3fR(~3Up*`2 zijvce&z>hx^xV344M)^U?$&HBi@N=CsB!yR$aWt@D4j$@85l>8CgVft*s;SQ5ux&v zuRW5-qk1%jf{J!1qa-^6yn6Hp>aAVR%!xZca8VP7<010#C z&pr(kf!0j6UhAS}@7lX}z714Y-k-Mr2U6J$%r9TLNgk@iro>GrLVqrvwAd_Anl0%1 zNXlv{{r)9TfBC(>^h9tn+sIz+UU!XPOV+D_OXveoVLr~j@2jP1&!}hW_$mEMQ~cA} zyb|tYM@Csk%p{W)s+AS^SYU_@HzktNfMc>tk=jufPq`bxkAWgW)u9_gl_#s{wq6h} z>tG`AhC9kff1(D{|A5GBWz>?bPhM<^gF2Z}8KFMxG&N-#7Wf)HTQ?+ny{83(w0{iY zX}{%0@LVcF^bQm!$DPJOmJ9`JZ{7m9kmpTCW4yrK5Wa+krveuUd*Pv0edJrHe_c_J+3K;Y0fGo2K7-^3KpC?_WFK2zB=YrOQX#|1ZRY}N$ zsjg3wbQaq1zOBrX2Esqh)oYCB=NAGx(#X}&Tlw5RR8wig^q~--1elwg97Q}g_Zmel z?@kHWkas)hZA1u-uXWbPdM8_271IRIjYHLUr-uPBp=?(Ras7yfm^#HYOSK& z`wvMb^~2LMmRw~tZiUa+5rruoQg&l_>o4?H(nG{Q-Ana{or#-gdml%+`dImrvbG{( z7p&tb<2KF1iyEl$<3+|T(cr$3H{GD2`gSx^hn7h3?N z-7f#2g>parXHTO6Xp+A#C2Zuc{Zdc36GglYx@H|9PCaBM{&in*V!%HPSi-P^+!JO5 zI@rugFRTlbeLpC5i#EQCqt8&7BKWgRe%EPME#GG`?dVxT9A|p(!G9fnHgQW#ss8N_Q1c&3xd57=V@14Ul( z;Oq|aNiyHKuw+(mm2ptbABVYXT46HV*GPgdjvGBFxMN#vS0!oI8@L~%w_{iUf@6pe z!J}wU#&NgP={AWH8DsoS@;|-{eIIF4Xopg5(CA$r`Op>xj-ym(=xp)QE=7Xv{$V{4qbf+kT65`SQT( z!ZyvE*xJEVow#eKj@8VD4<6E)84uEj`&>;30OfqZbRZDZHBUS=J|IdC=Y78387%)% z9dc1B&9C;GL0lCl^(lD;dekR|9TQ7r*scadjrLb$X}myZdUYo;Torx0UU9+a&q+K6 zK4o6kXer21DjvD?6l{8}e?ow4KMQBv`LY4j_lk?k1Ir+oK{PaH?B{SH*qzj};=~S$xWpk*YrTFKJ~fRkm`kA6J*@ z(N}Xe3Y2Hsg` zd_4%nK)XGK!B0X5uzJQ&ykzsh$u(ATY$O1^q0w5^ggB79gS0qa&ySdKa40%KHcB;6 zSuzO;!>CpsnY9ilN0f=q%y4Dq;hn8qwyJ1qlNKKx4x-X>n%%9B&MK?4XR z6VrUXNWt|*BRA29)zaX!+%fR}Xm1 zh)0bC`jGnm?+!;tk`SQRu6~VKx=N|OR5wj=Uc%_QBZ4r2r{vhfwQ+~O1RC?#%j#l_ zFq%tNZ*=in4T>4nmTeIZUgv8d7i+Y-Eo94Z+TEXj|F2#QO7z`i_A{c#-IYcf6OTsE zROZjR+n1d=Z%+j1JTn zd+6vm8?`#Qp7VM|4Fn(8W8II^OkLUcMnV0%8i zr-c?L`(fwaopm_}=js0UIS}xkC!hfcsZ1Uc`D4(y%EXaKXp!_}&7Sgy>)}~Pk7k*v z0R*+iSy#a$v~R zeX^24%(kxlnZBzNfrHfi>tqOoyp%v43|w(75S}?G)apg?N;OE`O0+b$p?Yc&Fa4;>M((f(+qN5a0fa6{?2lCvuLHUtJ~ zs?$>|(7(8KG&DIi>SSt=D-4F6OKZ8(PI2i%r5OSRluhu66AmjYKYItpG80XMn@&o9 zR`GQZ{5deuBqL;2oG;ZZDUr_&L2EFS#)4iOjE8~wMjVvio6QBl+}v)l0*m+ix|BR6 zq7j@*t-zf3jCOGVB%GV-9-qnRuVe{8>Sv@<-AIjL3V*mP=gMK7dWVl_LqBz>zeAM?E0)b*m z(-tW@b|C-yqZl(%hEkVNw2uUR%ev%$PwfoW32O$$RZzsii+!`7Q&yF){S3^1cz<&M zQOa^}ud$yq9;5$y=a4dqMi8Wo()uUXucO%AZcab&9@l#!UG*^*LMtD{)wQJ!^~{{|qje>0#VA_7t-GV0Vt=7IO_^w2S|1KGCn=&7 zIiMqlKFliD13Y7lJK7x7ntg0O;-~v1`zg0pU=VC&Sr_guH7d{#*$<^ee(Eg@iS`F% zHA>;eTJ<4O1GTx+rl($J0Z@RWFJ@}K3xQP1SdkK<1Xw00W+4cO!<}9e@|b5YYCH+E zFWSfJrGrx^O4gG#;Z|M={+0UQpTC}7#2Ib8d!Ua7GQO-kqNNQmX*UEU0pJe@7AE4U zwf@t!j*X40k61-dQ|KSSc*Zpj9>=l0*@|=`jumLC5r}r@uU|vj7K7zem7BeOK_t37 zhCmC^0leiNW{O-pQ_NwEDVnA>L($P+o!;NhiVSBkC^Ts;Yr+#e1qvfIbcC$AnegCRn?NkwemQ9q{hZ80)DRKKV55>n@+ zrF_6xec$!x3-5M?t7hpcw?AKqOMFRL_1?t$qmqSty(Mj6DiAf?M7yNXV2p=OfuA`f zBa>sjholVH6rcqddf`ip%Fh>sbg|fg9}8rHx@*{h-8b_G>|28~r~`VU8QhR8o~FUQ zVm$X6d{aD^e%QJ#Rz-f)Y+bL?@#<8df815HKiz1(<-p~CrfcD+F|np^Vcxs=+ty|2{Ww#AoH6&% zo#cyzwgikJ)APFGIg@CG*hvi-ht@)l>k0=EIZLZ=Unl@u0cII6x44LJA^Z!4lKC?+ z9iBtCzQH?K4wgx1B&ErK=cc(pgvCHGS8NR*-4R`eCMk0^@ZhL4ck!fIkTYX0{Nqgm zXA54u6v#2s$LYCGvvG4HO>^;rGg?keO=~o~A8voFukYHJ1yE)-pw)>!Y}+;oIY8agmiMNa9*?C0;5E;h zHZt=0bU-%>p5aW6&N2xd_SY96bo}-0C)BUNVo1v5@6@~jh<6gp=2vF&@wdr}H$BYT z{4PCWcnu{5WIqkMf5GmJVYAB1Ad)%YW&d!Hr;EKvkJ70OOUUK-T=0;^+mHL5gr0C3 zEfR5KgQKbmo0CAPN#e)o^I~h<*%Y~*smuj4Wl)?JMmXI8iCS${OeonAC~;6QHNP2d z87I7@!9)1R!d8j3ifO>Ls+-yplcA1kmC*3XzXVu6ap`AXI@6oLTU$`DRye7g8L|tZ zpEjfb+C53hi6{uQV+PGfmYNmYK&cfMz2Hn@A#As71>D9s->gk`+WGpOc2;8bao>Iw z+|m*+q}t6T$4O})h=stm(t^*S)}vJOojv*?LbHPePzF;5I;L%%b*y%a&;$ig1fR%r z&(EdrJEy-Frq5agd~+-oM}-f|I^f1|NcM`aXW8ji6?K547g`8XK4#|3K%L?MWfbCz zu0Te^JT~LavfwTq1(Ui=feqFWFM%nOSdLj|`ofd%rjvvjgu(Vy^JZUHZQ6_h6WNlg9F`pn0bGzs>?3HLw0ZOK&|M5DU zPKimPl{Zeo*d(cX7TUPF^a~>+90YH4G8YBWFps2b{&?jK$gEYWx3(D1 z!<21adU``7ytCf#r&HikiojIc~8C+D%CNYW3!UMh+0Xdsi zJa%p$1_QS`eLF%c*M|;d-cycTNT3ng2n@+=H5Bb2YKy3*W@TT9jMnMqPRxN}#5li# ze0*p1fWUan)K^A~Y4FG;5kt>L0VD19O>3u&F_-A{u@MHIcSe0TnJmI^0V)0=rO?PJ0vAVOUPhak5s4~M34*5kF z25O02RuL8fQ>{_BoGq=8f#?NIsMkGNodk7Ylh7DoD8 zzPfI@YFNx}*sLL!U@enFT-YvoYpfdnBm?&Bf@OHevw%+U zNRBWjHA7s0U^svMzgEe2yb+DSJl{eE#<^>v`hffK8eg-Ib!p$35ZH= z5}7G;Zk%*q^70w$Uk`XiORbbdlm;NByg~_?BxhNeLBCc$A7><$B}~vTOe5~&dmARs zotTzJbPr_fT)?GJloLIi(i>qk;>rz=9}hSpoIKo}ii>mnOkQ42-`w&=W1Po!xvcF- zEnhzAm-46a){EHM_yRk8D~DsL$RUfV1i!Yw-s%fDz8_C7(k|$ygu(YpZpJvgCa5gz z5rLK^>vQvTkX<$?3u_0KNH*~diAHfFDBFo!mU)+qkEVP3!7wP3Uf{|L*1y4G*7)n! zqpZcO4g-UdfaDhx0NmOOot^!(ktSw_&U!;}Nr}%A5Eb1#&YUEYt0*XFT+&5E=|j=< z9|0W|t=$~l^XX$>=y>)o!GlGDE;{5K{rqWO_{J-W&Yzw!e;C)M$@9{JN@+AeU~GqY z5Kiw*B<7HqHp9|Xm#W1QE}fP?(CUxm4>Si|42@W%F=%{!XE;1D$fP_A?m$ZdjhZhO z$MvEw3*)8HHSKT#$bZ+I%5UrFk#v%-aEB0KAZqEQbl_q|krJE>MX7oAwZ0-PRqgo|BCn>&`IF=Y?=7?)5<=Q#D7yDqGNhr5l|ces8J$>Q}~C`goaq;?B(t0HPdZ@otlM-AqfX#@VUglq#y zWsHU;X<;Tgvt)_3&m3ev^ZX7iX$`k*O%m?D+_2dep;STdlq9yCR!B#D=dR@7LJ z85N`5m3X>xbXYH-LD6v6GPDl}URyDKQhVzb^W8M3^|hoU-b4nq-D5+^lon2;PL zp(ocvSOQQmHb;Zou95p}Tj@NO8%~3BV^2n9QToa)l4ofo^B7W2=o7O2Zy7hzS9+Qa zUv#>;B0uVSJW_+F zhC<5xXSd1N+X}5uO%?u&Sz?xr+3NE3!%pTXIOg(K;@F{1e<)9X;eFV@x8p{La*u76dWsCAC0 z;3<~x07XE$zic`7(5?15A?1C^k-R-y@)9btnLDSgvH^s3d$6>z1M4mtq?T|Iz2YM3 zA?o4=EdIQF9Ci+?4{lBwn@bE6?KU%Y0AxOc_BM={1iR09FGv=mecTfslJU`zg93YT zOo1Jo@g$P+4GQO+;4Q?&^kJcoTaNzub94*cZc~hIGLFQb;6R~&lI|MOw~CDqzYY(N zjCe>+aKWO9$K$o$5FXMp@zCQ4CIsQ>3o`==r}2dIkaDmk(QT?&E&SMTv9|S&6XJknCMcy%W2@rdP%wEgdul!cz zeevkyGTT7sO3FwDl~dss9`+PIA%681n@s6mWE&6(nC5c8(lsyV9gs(PP7hc92rczs z1*EYX;^fJiOiBZui#@5-C{m?XGQ-G^>`gnqI*TpO>_G@HJQ>KO2~5KWF-$y0DAG#q zt@IR34uMfZFui753z0sPh|B0G^vM_P~}qobEq zrQ0l5Oo}5#*R0Y-wylJR92l8TH7-l~!I80%rumsuY;$h{jKzA1WRep%|$Mtgz z>Xr+=pZTauYs&7%qXV9JSn}5Q%GN$Inb@Zcg!Jn~;z5y>%z8 z^3vmGU7;TFwL<%I6im0bLCFC%Q-^5POQUw?oOW(4%3o!?IS^&_RtF+&ldlJfLJ~Uf zM+45QzIfJS^;%d8uD;1{8XM`_dH&`30P?~}5KCuNoE&~*P6xuc7wzHzhfi8dI^1I1 zK?i^(IYS9uox^YP70QEYqMHOIy;UmhPlW)g916w1eH_QvJjhlsxs zzRRIMb@u&1a;aLGnikCh(OuI)>sTNZU)6T+O%J?}F;*Owza|+_T<_`~#Wq-@lQQe; zoozSdrLkLV(vK&*9zm(eQ8rS$3sVd2QGM&{l&w>T>}7wI?C(l~^;=Qa)VPBkGn3IpP+HR#54sm{HY` z+mRkD9%1=qq|fB0SeqliDuv(YXIAV~ZgKgK%|}d^D44=pDbsI+P4mHNj^!aETG1E; z%18w+gU}@LiOGOh`t`J+uUxQjskjx;D#*6=jSCkq50sTIXTH*TAUTuoOfr{&8gQp5 z(IZ+dDQS+uxbwB$YU{MpYSgV6Js%ppFk+MQ@*7}oqcGrMU7Tw&lSwJMSnWmIIA)e^ zM6u4dyCpc1LsKr^Z`u`$#G4rQPG{dIe`MWotu39|N|QZdx{AG7JZ#+T$Dj;p*7UX{56pUxSdX5*+lmX{xiD172Y)8r^qOtsfs`JakDoOQx94|Zfum+8Ls zezZtV@&Kz_v2H}f%*thGFWQJGGO015Xk}l@lu>S0J&{A?_VALZ`AGj98-GQO?`Ion zey1g>LZ#y|HU7rnV|vAv3w8~GK4I%wfbk`UB}`S4+3I45lSh*7q z+hO`l8Q2kJcgc&M^(|;weL5bf!FXvPPq_skm5O+LD_)Dkv9d#P0VRZg1LnA0ds|x@ z9@udrnhD%^KuibLb#T>`9o55XyXu1r3*6Q%0o~}MTRq8ti@^1h*ru{v4Dn@&i)wLO z{w41mvtC!Fhm;x_C*nwI(|N*U>hvW_IEolaZFrT!HA2U&7A(LOnqvi2eC;=E(YKM^1`El#k zQ}QEbC`U9$-j_)}w5QbIh2(D4+Jr@t1`hn$ssHzl@?M0Sl7Qxy%a@DVJVYcuZt+M* zTgMhni6_ZJ)FzV0xF>J;a#d{z1%Moi#u59?PRq~TzJGU00Y8ZnP-B1t17 zR+L{Za&t*>4R9ORsqnewx*$Ff1j%AY>`r=>#l14Jah6z<{Y3dmuGV3S_LkZwNdFL4 zgH)oe?3}!rpC6S)$#jo=`r1deGnOa~Z%=e`N^B385_1APJ3fuNIMJ8rg!Roe5xQJDC_U?_s{tY_J-Nuwi)+f zWY`BH3AvFA+bwfZXCvY)F-@=*oP4jXFR69SX!cT+vC}QbE^8!5_)9F^g)w0jJz=Z- zj9E~}LB=d`lqDe%*8d7mP6ZWuc1||eUZutZKJf0wtU>8^+)9T=@YB7`DX_^3FP)i+ z-l}ZOlBq&7M@<==uP0j=kQyv*To%6Pj9eXS-qE8CZ7~IF59R2j!o&fVtm}T)n)zyOF+NOMiR^UwBUR5fNa=fSkCVa9152N(|@>YDi4> zO%JI&l0c6qkRajwR%$ zO>Wq5=AjE(0Ms-6Kt3n-O}y}A4gOiWEJ6fSvzK+T!b$J6YU+fqO93Djd_VvMQB)SN#!#r_D+d_kI&~iIvSZzS(4M_ivYX2bq40%5HH_M* z$^tksg4Srrsj8}+r(w65Ms@aBOk-Q2Zcf*zcyvzRM4MRH#VQd_I0ORy@W$NX!*e$t z0v3rCeE9YlhRre!e~<-Idp>cWJ{Hro9peUl!p4jv$vgDAsPKfCX;7=1yl zVD}F<8`K3jl<0sMOc_Wlt(rF{w;X`k) zw9awDr~6u`W$5Pfn!R+azh&bYS84v0w}D z2dB>*Lf_-4s)9MGaRN8iK=~Q5i-NDXC$tjK?G_&6p5gi(t6M!~9vq3pNGo2^m%7E? z>R~VSM}-qMjC$2P@HQ!V(6)!=L`dX!M$6Ch;}dq}`uZ|%M!hK|!({mL?*qB+E}bdi z2o%QKl~6Wb!?$t?jpGD+s%ZDfJc>-pKeI__E~mGcjsvS!7Y zusJ3)F4{W)=5srbLX5AK{q_nHnrrs;8QkXe^_70lKB#Ib&#-wSRLkR?ylTBoRU3f< z>157=O}yQ)t+ZSJghcUYG!J_kE8*RpAE}H2p%*%;JcBuLsRFkF{z1=w6aoc*p%r%r z2~2&v#X&v7qc#&8uiKzycKF>vbrF;+Rr+85ANEn+GiKgDpXB0|8&bDimk2NgQpNxn ze+{HkULf-<_n7Ne(RYR1SE3so6@q`V?lR(FK?xt_cBx0HJUI&wlgc!1SUaIVy9165W~)bEVdWK?t&E>anro9=REA^l2S{WD}o3I-yMc) zHONyJ~x~)-!6B6-+T3?r`y=Z8V zO!akq*TxVy`3(ue*5q20roz;H@kvO+I>w7{OMSbH3d~_IE!AtI^LSQqFvJ4Fa>~ws zOhb@g;DiViL=ZM;Cg{79Q>AfzaNnr%J(?J}els|}5TWs2c#c!wp<}+N)i_mc5wZ7W zemAhVwjT7ER#jTZI`nqNuM6Z`ZRtLRzY~Bz(+$xG;BXs#^j`+y`4DGI214ERq58vL z3MK1bq-Q<%Noag7-KE5Z^8Qv1UNPj8x-bbMdy|$ohJ$T}bI>`+59*tyv-HtI;PvcI zo|H+!6L5#jX?qG?N~|F25cWDvxT>YndE_OD#dU_~)dm2+`bXvj&Hq-`fuRDm3+B=R zYXWOLZz&qidpsRa@kdJ6rJ;C3PHHnP%c>iy@9_{QpEUqGU2?+IsT<#j` zWPWZHu#qxyaxzb1yEcMbmQ;b((h5=-535UK%USd1ii`NKG-F+nKC~31jRuTxdElq! zfocYDIvNB=U9Vcu=-9|45-b$pGVH3D>%Bu-UOz|o_*Q1(?DprNv9bjF7brsO;7Mik{3{fR zIjt7%It@V#4hzHeobL+%ymqLi)X+54QbM;#AlG{5(X)B%eE)bGzOJ0squW0&_+)V&)k&ZlVcwHls)yDF-7GhRwz{SlA71SeGBHRa#K0Baw`(tc>suBaw4;>+a^8 zyE`uH>D?LzyZSD4ir1++>Pr?$R3{gKHkcZf%5688(jxLY?;7mlzHc#ftUNg=wW9_cFMZljE zbDsz__PRp@cT8%1DH*Z(;yfsZo>_26cjDdiSBqYf{YXrVEem$b+i-;W#F0P&cizO% zpK!&@xt&$|OSqT7p*}I|w}A1)Ov}EhX5s`eaEZ{)j+Yxf)L-k2@t+|J2|508##_3& z!N#qw`E-OWV_Xf@2|(3x@m;c#;6p)5w6Ac@P+@O;9(k#3PTuN~dk;p2^C~m5M$q`n zcuap(cA~Vz<#{E6V7!wZG^fW|(pzO%7JafdOZ-X&%c+Es63hSqUL!oo zoyiE#N#9>D?yfR3EkLnsvow~=`(VoKP~trS=1V3$E-C5F)tp#%Osa^*X0dPC3!RHX zM_t~ojTX`?0`iOI*n&`bxX?+CZmCva=4&l}Q;fxA(Craq{Q}ryRkxQe+Goa>C*2@1 zPKy2YtuRm_^Z*E<&aZ-pNR{oVT}WoI5}prRv|7S=%N^py1zaw|Ad%pJy(^+zUlueI zVwk2+cCQ-$f{KzOyRP=Jh{bjxf^5tLEYx^B>>5N9cu7tIEk+Z9>}4!3iCk@h-qU2X zP+3&RXfPER%PaAAh7A(j2^#CyZFwKZ=7^+l2SZ#n&oRS1XbWI3xcA+g0SYCJwuqw z0lq`Ao}SV699L>VoU*kH+D~c2?VpULl4)!(2N*|mV?75{qY12aHJv=!gz<&?Cryez zBL$AD4emjwM2Hrm!{oMw5TYsQZG$4moADV~ArKBN>X*)(VZKrxm8ycdnP08+k$ovU z%{w*|#qZFcvM7#@Z#veL{Bc8G{rSh0?Wy~%+qLPfK|PLo`5I5}2V%+zg=B<&_{zoG z+xxbS*Y0R~mu@dgewfFq#iV*u=qyTtrb;6+#jV5h5NQkH|5|=uqI+Yzj2>NY2bN+| zI`nor>!afKKV?4&bXr~3xZl;F-)GgTO=}M778E9qdU~I6vmfOp!&O69Tv^`QyJd6r zwuU!pcB145xvW~3WbX(X6cL|PsTNk|tWnHEjvORy1jLMMz-bKKceKX81rj6k=C3;s z&G^iV$q6NS%SRurI6yTzd2uPUsH}YAjI2)G=RN(j#_Yx2Le_!BUR?gEQ~5Yu2LkK$ zs$H5td%U1>SNXN_(p!Hm?71sf4;Z9z*(qK!)%f52$1TXr8%s-|6fkEriA>VG?j}$9 zvQtpJWbNProyDFlZL$@B1;;-3xZU%Bhi>e68_H36S>?2j0Ak@B;)!{tLlRM%2%FBw z`auBC8Ivgpn2$os>qKBYV3LUJnZef>v$3-91?j*3H=fA{k-H^kBBfc07Lyf?`#!dk z+0dv*UEEZC>R@OSr8JmDa98lcwx9A-gh3Sj zPVeG{tq5mo-YMS6?BXV>ie#Ap47xQ7xHPSQA2fbzEiy~0qEPxGWkKaZ_zYE#=I?FR%$ z`X}qka2xh9=8he`O2Zg!>S6}k_RZB{TkkUOvE@H&OK|}lr?Mf8h(Ik~SvfcNDxH>Z zFz|tqX~j*_Y~(%l-@5#^wC$?DrIPl(DCsw6sl2~mtKY|&#{^g9*rTM=E-w3x3XBeL z&D$R6Yov?=pRNn;BM+?e`1rwNT?Rnl`2+5kl8tc#i*K597G11%OOC*4UDHDqD;=6k zHr5L*?Jp-&qRZ%eR;uAfBX9-Argcvy;pJx@^m>V@b@JeJlB#%ROq4E)sCM3S+)ZZh z(Vsvs(E-}a6UbJ? zi)t=*-PZ9{NTKsE!OCsNmDboQGZLu0htOgNbTfdX+Q}&4&m=}8vBXe=XnIucAv-Yc~5wEt#<(A_qRo#V9!r3PQ(T_+p zvDb$fg~Kxb)%*&vb!|;U&7}tCp>S;~S<9`fi_$p`0m5Iqo$}%pN)cPc^YgkcIkeX% z^WiLVfJnG$--9^Gg`n?Y!p+vm-x-%%zfK;QZnOS8jze;IOttTF`ARb4c4HV6{^UM* z%?bRR?$#0HN*;nEb>pN5w>oZFlNOzreHv`^dcxDLwCP@1JD#@Wv3j)Xvlr8etTDh~ zH+qA1FPfNN=bV$U$_{&w&l^1_REHp7O4+=1b4=r+>{F zJz}v137f{^?qY}leL_mwIf;h)#KP2$@ky@pJwsMfjkzVxOw~oop1wSB86Z#E4XT z@RsOP5gsq4QI%Q#rAz&e71cMl|C^R(y%bQy;I z=SraX>8v=nGuK(Qwce=wMqWCe%!=cD?vBcuIAC&p;8EwnXh!KY)$5|VY9g~bYoanc zYopFCEbk`%)_U7iNk+F+dH6k@OPRtu!fW|{B~$mW6rG`^P9mMg|(`OwEA(}UJ(8eEa{%8cMe z%`O7PK5(|??Uy0VT|B4)+wy5mxdFml#Mz~8&TD!I`8A0Vy9 z_LYqv+(tyYkaA?dME-0IVQF zq6on(SOc)SW|R7tuYcQIk^a?H%$GdpFj7aqHr3b^DfUK#a1 z1%xQI+DKBV)IxZTwM^89h-xhu@a^wm+Hf4=b(#WY-J3M zntBML_NYog>eV&+tKxaMLl*~)Q9x2sae`0zr?5OP9ponQ9Z5$f0xfVrUsEr;ZEmLZ zzu3Y9W2TT=H9Pe@c?1a<8hSkmdIs)AmE+0`hl$i@S+5i(+8GNE>~;xS&2k6 z&H+5_A3=)xrPCLtkWR;}m6~bAM3wdqP9%TAHz4izE`}h|E6c!V97&vKp~gD3BR}D| zq)>H7mlts>H9RPj8PD3TEl9gcM4ub4xZqVWCTHxs&b}jAxdIp?eZ+&1i3cr|bE6eJ zNt(*JjbP4uHo}2$*i)qYnsq_zoNa9ui${ZSJP_@f-1>9)PibQ?0?M|6b-x(+1)Y?f zW*)*dZzB(^lAMws+SM-aZ(W6Kt~@AzN$b^?E6^ZY6htkSvC|S{q45O2aUJTNyWuGr z%RE(3ad~f1UNkvN9Gem&2`a(A@g-jV=Jt;wRv&hR94als=IV3Vc`+hRq#?sJ#t86S zRV2}$%8OgA%)m{3f!~o&zJGE8J(=}OEs+NbiN829N#(8n-Yby^$|$iNS!8W!ucpP2 zh@1sXVW7MuRhd+mt_t>)L-!~K4+Os2<%%7S9VZ}2CqF1Ij&~sytX# zm#$Hiq{;({!UaqYDMn3;hhD2bhQhpsaK+vjh3_!~%tE-2YOpH34hR`f@__ApPq7XR z6fA=70*d{S?l8&Uu&>Iw0?@tlh%6j+?umfI=!E>h!V0uVbN&)Fz23yK*~(I-)#@mv zhx7G~E2PjyyG+L)KSpRHeo7bg^1U$+^^}&D0vrpJw4o4iDNiEJElS7|{c#Wtn*zy$ zH^+50mDecSgrdLqtL*>omLX6;f$9i88pDAxlnMZ(CKMSbj&n1u*@uQ$EbBR0gBN_i za~iADLC8Zzc5udg%(^8Mn6m^kxHlhvlwT@%L+j=^&k8)FB8(p!Cn86|wejcDAqU;U zqr?!T=T`OWv#H>7z$QF4L@jNekHMRviw=Qwu5_My=y5gvw<2x#jIX>(>)h;pU;HRu z4!v#dCsv@do11eI-U8dSM)y7v4}B_g)>g?C(}x2VBCw{Q%=c~lx3{eZ@BI9z)fV)r zId5^Oxu?3(`Fp{XZ>*3Z3_K2^e_eM6zd&IQ@FQW2#Ob+N*I9jO!J?GJd?V6w@6ufM z2J(rQNelv%U*DODS1a4gBJGim|J+X8o`Nu!e3$2^Ij1=2*1ZZY#d&6sq__z0ZtVVZ z%b@`1Vwk_qejRWsHAN!<@&$7W%XUuQIX=*1$>iv>QAgDw>wv?W#}9!x{`}C2k$JN= zCaTH|y)81ceo_0D%K(8}^kLz-mYD0%z9}`;ALHZM>0euyk$Uf6X&&!%s^#-yDBrCf z8c(E+J?KL(`pMv&4DAlE8BjDo3=cWxRLd*^?lAzOuhp#56oxs`%_8+?z2M1E?yRO= zQ@i!sAJm+GC?7C(H2ZVUN(XadwV7^Fw|nXA{04o^3?sonr2X>u?#Yj!@t+x(RoTJ& z6TPNhzMN7k7=bS~_a_Pxq?eExi;EG+OK7L}E$!b%_;Z0ZlUV+=-j-PWd00{RGlh;?}k=%CeTjT3gH8S}klO z-cE{TlvhYs2G32%Ul`E}R@0~Cc;<7H^_E#ihG;W_N+Zn02X1Gb;|^{|d`gISN$vPb6iA3F7=ul4nrMeB6Y z*XQm7VkWpe4VXpfU+eMFaM3VIbb24aSPZAFLbS5=tS(aa?fUf!E=9uP#EzhpbuBPY zQ$oYO7;OpS+ttUSoS^aIlk6G?U3Qcf-(;O&w|~pSomd(FQ2*eZ;`*Cg4Ht~+R_;U7 zG*1wbjFGjFzxOaEddCv@3C?)J?>!L=pYD~CkOjz=7SenIVc z)*kS@Lr_avssNX67ObD=zEWqrym-PZ&h#5;d>goL@yeXy@sc>Kw{M&maZ0mb1Dq7= z{6`er;eHH;iOH33AW#bDI1sRT4|Q>Z>!P*U!U)Xz*6@&^wfdQ-jg6m~)r>vHwx1K5 zRNTV1ZZdGK61l%&K^-sQMq3SCD{x-6wMMlUo5U!}^Zmj<$*ePHX94rG_1O*t>`^JS z0mH<^inR_zOl>sxm`6LmKR7YhThXi3RMB&PllwK#Z)ue{h&rb({Q!uxKDj+GFHFA&Z ze4l{Gq>7VX%s=>geYaciqQHSuR|i%1y&m=(u>|Z?eHwv{KTOxa_W2G~&0f2}jLm%* zObOC9Xt+4r4eny%jmM5f+OPs{yf1`J0nyn(g$@MlHp=4b`?ixdO=}c9>CAOGjc+w6 zKXIuEBgQZ>Id!8!F3N3K0v4%h$g1*YXU0)~8k4uWS8wtDXRScS>lk&cJHrXdZxaa*E0_iv+lS{OF)}dP)V5I@OJP>2nDX zo-+~l_juI0*DOc3Ae~K1WW1WNb{8dL?XhpZgMSCsd;;M7t=eohrFscoVM9kddRA<> z4j_DA^}`RQ{cYf{w?(O1QEZ&*yN*Z1H?2wk-`wgXYdgN!d(4dHe{W=Gps5=uM& zs6F0!cNRdrQoq~f{&Bh)TmuqoOE7yfbaw4920bEo4KRPiPTm)k1NFRe4X;G*ZrTQe zN?$c1TWqgUorX6^!WMtQ*YhxV8~87K$A$rMu#mwxJ~l?O zz78iaDhNkh@=@Di*Caawo@j|?6aYm+*ZilMLlU}{gtskV88Cs}0V(j0gL#x&Xv&e1 z_7lIvR_c`sNHU&qLy8%+cu}=b!lm%&IhqnaCVFS#fUS=zl`Ct>yo4vk6u-(>U!;CX z`L&M0P-kEF5JOLUV)5e6%$A9xs$tc)^R`aO$RP00^a`i@enBS=l`jHG+2!qwpKr36 z_39rYrwrQMtQsmXcLJxux%04r>yAqrqfbnDi~EUbF~ChKf6IV++?TO?nIM~O&1Fiu zAuLZP_NZDiPKs>~!Vd=GI;gac+@dN+$6(;}cwKYSwj*XlT$m930rI*Pqr^r@f}Kcr z^X**{tEvE!Nela;kw3UMBNfPkRf#U~HFq`1uFg_FH~ZEXkPoipFdUIOy)&u5ZW94; zCOIbOR&{W&9kirDMstu9n~WP(V>?NGyCGbU7_L=z!W*>ZeW-*1VuHU9nR+_S&CWS_ z9^4@yQrXnl*Ur9^?vvj9smcmYKq-kZ-jI@VOCAy`-Pzor;FIKC~AnIxkg#JEFRE_du zH#B0&q+aZPUhF6-dB+q%QNXQ_XSDMmyplN_Y;5q}yR-|V~XBWrhISFaFAU8k6$!ku*yc^EJSGK*T z=KmJrv-}|W)j{&|Q29k__J?rgrdiT*(u&d(@*R>&7U2?b7&pUyR-wDvz_&Qyw99Xw zKbNE0@4L&_{_7xztJ>$S{4*m;MhQDpY&H;4L4auz-G8eDr11qq-w*6&e^fA8@^>Br z!b$u0v@3qp9<*DRuxmmcu?6CjG|@3k`KVi=D)YuWFKW~JOaVbnFj(b%KK&4}xuml7 zF64CBx^)%E!*m~Njk3gPT8+5sHpJ|qDdP~aq;(PO9%T5M_-^B_`~<+cm8-v=e?OG8 z*~-cl?h1o^ZZvONyYo0m+b^TgXw@OB-2?`GgGoNA*A^e%{NH5$Z)T`L)kW06IxI=<98b%6lU} zd;iB+CHAF5u!l=cJK>D$!T?2$D0_BP5;hA=VVhZf#%kkFlZ?@=RQAxazhDq`AhEds zgq7{P%O6U_+S`NmGG>G^_TNOB>Eo_1pG_M4=u(X_vqNHs79c<)55!(1c}OC*V*}wO z8{dE%PE)z|3zSu&W$!s?u>Xg-9gr~?|U0uB@mjb^C5Ev3=!e?GFI*zjmb|Q4D zyu~u@3=`&LVB1jIu!OhXiT)16P)2N6vDfmM}z$}e0Zi01L{OR))P zfu4}63BO`^8d`|I>r7G-zM8sey-&v|J?^%A((R=D$5wrax+(Cr*S?+LTU!C?AKFm% zThH_E@opW=^W-w@Hdz;)ORAL#zf~Aa6PkSkl2;ipB!Ak2QaYfg45d#1{WD2wx+u<) zA5zwZN{xUE@R2E}ozxcj?YE|}u?71ENSjIfgV}DJQ@1F~XP8Usa0{iV?=qWQpO2;v zZ%*CsfgO2a=)0Qsufd);lqckn+HkfGu_YUS*8xkbMMbG+PZ-5pIx5W9xDWu(4{*Ae z;MPsxlNSsOfn>me1GePI-i?ZjASVHTm#mzJl7?24ui?0DtQoTo zs!1+h#mj{W!Mq+g-|#}8Zy>e5meHZgrj4= z8?!cubAI>-pzZ=nX>G6<7U{7Tqq%Fdj{ zJ6-jjMV`da96|v>(2xaDnTc#7lvUN*e}?e2EZ#%xDgF@TCuW;Nd)!MzhF#ilBPbjN zUh&S~9u>OfdG`);J-nG1Jyp5fYHt>9{t)nNR%I0Sb;+PHh2|qcnGMo#QJl8w2aXxPeRIhTR9(X3!3R|_iCoR%=rf{e*YNuQ9J2MWPNq6ar z4!pI1Hcme~o3T7?Cn}71MA!X4BthWHg7F$S4~b?XA~449yUJQg`8$lGAYb32RT5)I zYp5d03mRD>Vh_R)3Wq#$U)jJeROYo@y{cnAjje|rbW=m_5v zdRhre4peW9JI6TY%}C1-uZa$T%TOO)MRQaN5+_TXK*8h&?#~4G3<`vF_JKn4B}QuG zWJA+`gV)!p1{Mu(u^pqXhCoacn)1(OF^k+Q143^xvVp zbL#KqOr9Ywh(R))QuiPaAe%G_qZz4~f;t^%wO@@YTXY1Mi1bq`U5>vt73?g58&5gA zGXtii)TcZ5eX>j{;)dPC|}Y;umdv*NnW%@a{bJ%bE9HM1yc^v49`?q&f!})o1m8}dVgcOqEpVx4TXOF@ru2`4y|3%+mhgT=W*RK8 z6(O@ep%JM|2AZRqIayLNy6|@Ka`{9v@5Cqi3d8uB4@&O^R@KgztCSwA@*G zejM6|)v@YSADEAE&J1%pcDX={?om(r#j7lDc9prji1zFK94xnCq5@^uO7aSZC05 zUNoyxd;YU#6dH<5$q{+ee{cxV;hLJs1^_YMsC=+b2Myj7GTY!a-XaVP@^r~n;5w-WnAY*kzmT$khfH&2ouL;on2i6_id@}sdR_6ReKn5@%}+F;L77DhvpWU# zR~PA$Lq(#_o)&Wd<$LE~$tH=!EFUNI+jRfk>=llRTR6cNap8$|?)VBVD91|dUAvex z4XE1lnX>E3xizcj@L_rUw+d)z`dP94nYb?R{>wC-2Wlp;wi=T(-|~XCVfGxN_6vh? z%O@zB3xze{mlYEogz~r)a~g_R!$qCdnJxh~9m-+< zUmHO+y#4ztJ!HJx;|xB;xnC|B?y6|d&&cRFbVA{Cxacs%4@gSJABt?8;h}6>RY)}U zb}k9K%06AjC<<$gIWC|eRg^(GEI}<5tiQ&0=7o96u#nP;%kfs=YF1SYoL;_|fqk%i zcYjn!!PA&59|J*g$S^xB^IAkIuG}MgpS-PX%t$xj)nXn}Snn`HfyZRcbwbgi^)=FD zs6EYAuv}CSJnQ6K_r6wz`$U7Gvh4EHB^h>UCRfN0>oF8QmleUAP=ENiR0;ep?5Ol1bMx<)P ztE$4zlNy*+vINO|PA7Ftq~gOIq0xAyhbD?C3aK`Ca&m7+=AbkI7Y(t#-b~w4x4H>u zZj^{xVV|S9z?36&D-|;2K51ql2!9gKrM(;xDaXF~J}@LE+sg!Tq`(lp4;Ai?l>b_^H}p9?N?P7 zRV(TIQAf_v`BC%S#^2;KEadAi;3bMhZ=9n7j^D%HhYl3gyyy<+^p#}IH+p>p4I>>- zw{&}XL?ScctP8us^h=)3WUiI)AbUe~H~o+&(hV9zDQ<)?dmhg;tZSyNkSKf!btpCc zm31j1>wLBpRv`YAS8^1dobY9?6!C7|e{PfB>sVKWPadRukA#v!b(vRHhXx<1k}NVz zA&n@DOMSSa1CaEZr1Qc9y0`qCHF0z6pl^ZoF$ia4Lg4a`fI&`~0(aoLagn+LQRlq|N5^ zAo?@Ty_40YcT(~JErnoFdR*_*r;T>$0D)ulk34{L2mpz=&?+f^;>O=4ZRfvdPTZ#M zx~)lhvVJ4yn>s?eeeZjjL=Y<9{s&aT4?=5{ZP?qoUOTkK1S_$(jNz z*h0Td6Ql>gJg;ZuO-W6E2>{ur0Ok9R5*P^K&cZ-$X5avZT%h=U!L(!^9B-Jyhlz~s zj9V8rTdqPRthzZZx1Lg6)q<1a1_o5keeHD;K_r_i!DZ5-6g0+b0Q$R*b|>%Z>HMFT zUP}nh?9$2{7&Z-IJ2+%5cq_Hl;YtTzhIJKRG7Qe5N3Q_~%5no`Jsq7tz})-WD7O9m z1A&SYcZZZ4FE5lR#{yqqy*2uG&M%%XD>_(xw_5yI*1|4wb;yuWmVlRmS0?QP++|gB zKYxLG@PAH&(tK)a1R7t+O?NXfhvdf*9}gpO7D`)n|5rxvc=^t{UL!E`&pX(Tml8^17>keUn3>qx z_9L=9pXlpN>w0}2baie1xNG~4aEF#*Qx>e4uAb8tATslC7%o9xQ!$=jE_X*CVQ(cj zt}IhkSE-cMl?pfKZDh11MfN=`+faqx>Zx1Ou+!y=nyU5fY>MsY@k@|BGrB%#I&fMy zf7hQMyJvp?-Xrgd)H@t_M6Yz)-%q=y{(RZqbke$g)YT?gIsND76uQQ)aAI{;TV0Te z@t9P)qS(&4Bf{aTRn|ste}4HEdCt|Ps-evg+l9%YLdZI~68eRYJi;uE+=( zy^}oQq7v`}YQUPoHF>1bgKy<2UAm3$u`IoWwkzme$12f8jI200yT!cXn)Vf@plwr% z-BhJX%=S6ry14`6?As!${;kAcOG{^H#qcJ>TwY;4qze*QhNm77#{DRX9CcvsvmK>v zXHOd}i_?jQ0%(1K`;y*ys0JjN1KW}kq$CXAMaKJE)9GT8$L0*PTpikq$arjiTgC9c z0MXNIIk91iyVMQ8uU zLx2A$raTpYXSZbU+t<*ba!q?oSJJLW2WS#E{5i8%_eRN_EOSx@h0EWSdPq0Yde526 zMsj0FOZ@-%8sBdjQ?B9TMqw}+!xpW2vVoOo$3vn|?*Dyxxe6SAQ39 zr}o=50!rC%N7bOy()6@2%<7C^)zpoujsV|rSO3JAl$Z*CT{W0^43YrJ_Mn~?;Q2Aj zd3Dkz=BEy?I7rBkCljCkJEYP;yF5|ucJ(;9gp94ebyloA9_F{nrbSsP7Au+WbZ)t^ ze9qsp)l0SXl?>D$-RZT}Gb)M87O3hX+x)fy_TH-_BOCf2@VMIzlF*J$*=Zt8L!(BR zTETTx2nyZ7gQhq1?GWmDTs`;EhQ85}V+55CSXm@0=3d%KPU~pyaU2D~hiJ(>hp_C2 zqSERdTekq`t%i}cCBccsRay4VLGDNNIGk-8UXIXnAFZ-=7uLeIlanMi33PpWqwGzZGc^&=nRnea|NaiXT#nC$KguRg@; zFjIWnUqNM&XRbUl%s3GJK&>n3u{D$lGy7*ta5~oM@T^4#>P+7MLU#X4uda)UYWq6k zz3wU|dWDqT;HmmB;tp0I3qB5^%}2CY9sWZ~qv}cWPqOz#awYkt zVfMKTxtqb&36J<(y-k6*{Go|<^2nP?XLx;d4Oo1rBJAW;$YLuQ?P3oWpZMX9ftu~R*EY_5 z>qxKAn}=;AoSJlH)-f#}#G4B4{I$Hh2uEFMx!joWsF~ooB)hs%I&KH;M`>RX{u zppQp9s+yUpG8&cB;`Wa`y;aBL<&N%mu$7#ct}8v{IlaZZ5 z=Zq!ATK!0?TvF(_71yry!WnJoSz3fFUExbel3UtEw-Cd>$K)?;JKtu#>kZqP{YrS_#AOR!cJRfQ$C&JWVVDMyly zLYXAKMK@e#{8`quROGJhxW@|h21{q&-^sT-qBk4wAa}2+LTLUe`D=yE%`~!&m;dQp z^Rse1!g_VVt8}YVd}~=Kb&KS0C0xZ>O05*hZ^(wj(LXfpj?Ltv2gj zo8?Ha&UZ5`5o>v?l+mGht-Qj4$}B;K*S85};;G9chJ`QG=>2rtb9JnpBl?`eIEl08 z=F8#vJ7>(744v9t$Nn5!hks;X6vl6}u0eqaY>4|9XCt>DZ~Z{tULNz&c1aGSL$$ev z65-Dm;A_w05pn{E{A-9!a0?dI)PUjhOP!6*ZEg-q_%@``%^}1Idxd&YNmfpta)EM1 z&RUkbaOAbpSEY9-TX`D!9r>%W4Jryw`9t|r#SViZe<6Rv*rQ|A?vR9|{=&j7ajm`3 z9#wZr`#owb!W-}fozU3pz0hm`9__JPUUN*ob?Iu32|rp z;kgF3`_32QV@_zB`;`4u!hd$xDOa20WWvcA?On%R#~mt3*&W9n#uA)vzN8Pqkp@@8H+}ttZw5(A?hRnQ>%D5kf1xQip0-5#VERy0HuB#4XRgf zb-G*_%N++ublNIM#GVdz$~vmkTjRb=*K(NNEugEZdHhGvZ3=6HEjCLRzdeFE0oX)7 zxkqdEzTys>VMG}2Y&qaOYTX-Em=toaod7orjI7}FYP7j3?FLS4rMtiskCPWEIKdHW zkTR6eV&dsj%fKEjVTzk`^Y7?1WFRaVrU76Cf;a{N8y;#fUq(YJxDqy{6sL(Qzgr|< zTp)2LI~YSUY(&;c()klTBjOkFI^I@rEht}`=}2MBxg?|{J$Jt&7HtMYDna2fN{boQ zP`M?VbKqnur#jT(B?*1#y6e$2szFjX?!3eW28EfE_{ z5Z5feEJ4dm=;L*?TbY`i`5n))QA#!1CwiHc51K$u)Sb^-%!#K(M9x5?C{R{pY?G{9 zI8Ny%ES#_@NnN&NtLCIm^Zw7?Sr#}eyUL#GU%Li(pajnQ?EiJ*rHbr0*CYGnEAue| zWbHU}Hi41@^`6J98-3-YuMD5!(ezb$i}Ge;kinU_E6UXSAt{Z>rnBBLo3|CdTj#P) z>#+3d*L^d`u1QC%+jU)z+jxH7UWLk(m^2EVnVWHB>E@UNxLY1Rlq`Gft}!F=UNfri zNks3P>pkmn2PCm2@}SA3!t**oDuLcZX9^2a$-%@x43$EZhDiO6m_Xzq9#n4qn-$u3 zwrt|f%dPMg*kK41v0d)X^U18T!x8iYdNmW93$@Z1@d$f*-xkI3G13H5CV-D@o?KVa zpOpJ&g7BCCl0`|`k#s4C9-;_@IFM4PRB$Q-SxuYTi}&+2B-&RZr>_BEkOW6iu0HSQT6zh@E+HVE_|mVKdIxxk8`>1o!DGj-sSrnCDQ&I zXOi=DGG0uOBRfl;Fg`o7AH&WekdqSmQ&UOR$NU5#A+Oa3NQXY4Q`HpCe7r)w&$Y$1 z9#KxO2rMM47A#8d%Paw{pLz3Pjy^%6@B;TDR0rTw=z~q2&(;o0mcIVc?FS;mN$jhL zoGYn2JEhaS=%ril>EShyttwvSo-rYb-8%qn$t^8EcVb>;nW95!=uZ`UuXQ+NQ_LD#8ldFQlyV_ z8HXb>1RRuE-_{gBurj>nfll`}UR0XDDRo=S6+Sd5ZX@FnDtDj4vPxo}(%t{AB*>(d z)E=s3(*NbiN^unI%{*&L$8QE%m_qn0VNpTH{VTY6%{GUaZg zuKcylw5TpaOh234XZoLP(=yv!^^_y0E?1bU@>yW%9UfOlfx$jY+qzNL&<0zYOH9myL{1h`)?iN&`dd|p}^n! z7iWqFt?}fCgs5W3CA=oLvS`R4-gv;)OrWhPdkYsRW^eYJf9z13NEw#vp2vP{7nYM9 z@z^+`AT4w1v@^RXAqyE^1G zVw`VIzDvSXlD}vkciQLJQ687Z7k>%5uqox8f!!zyy=j=owihOFIgy-@n4H}nMx$i+ zNr1riQ}Ca9vDMU~rRM_Hb#a>)6=&YvwCPqv(OUE-VECHS0RM1( zorRg7`C$_of#;R$EI$ml@aH&?&=3{}=9!!PONO3bm9Moo%xB_11kiGu5mzo%(E(|W*UN~m%89UW)1r-Q6OpSdONsqpjp2Ot(n^TqzQUf6`KywCiL*z>t6&C{%i zl^o^l9z^GW2ADjOt;6+-B{T(sGCl4f9rw~S+mk;$^ z{DUY6{rJd1(1Yq-c<;e!@mgz;u;U~(pzH-z+=z%j16r!JPW}TrHQZXizX1Y6<^?BO z>fEHteIFEep{Lq@NJZn`0j*X}C-YA_sZz!L7^r+oC9Dz@*r6B#%+y0JUf{XM+K%O5 z%i3qnkSH@DwvS;Aj9W0tm<|xay8t7gsAFAfq1ziNn1Nst8}HI`b4nqlDr&X`5))(f z2xedul)Z1uE9MQZ@9iBK85=uoc&NO%c>jSQwHz`$bH)`l)%uP=gGf}ueTlDLjo?s$ z$T}5ud;K1)P$#w5?b-M*wYsf7Jq>*bN=t96o0S<2VG8A`>R3+Zx-H=ZzDv3TI}~_K zKtLVAwuzKs9gFZR1mcOv5vZ!nbzL3Lx~ZL2ELrwDN$p|S%de~@7J19UTnUIAz$3Xb zBA{fs!4ZjJMc%bOP?dhKKW@dKc3pQ`#P7^m*Q^50?~bvs@PM~rDTwCYGo3SZGSKnk z?+^E_RQ~`_rlfhpY%0L9PhA9Y0^}0ZSl-pTiU5kN?3J{ed?992iu_-l6d{b!&^W!t97dh zt7nGy_wxIp0OCNv9gF-c`XYb@lTt1dK~s=an=7sdI8z6JnXxl+3Q#O@-IZ2egk}Z0 z0NvAKnfBV9U1WS~unHP@bWsc3!=yc;6FTAu1aU(z(Z1hH`ZnY_K+X}&rnLV!+k=fM zuj4ibZPja!&x;?05_)@ycKx-r#X}Mc>+MGqt@D(qX?TwE6ZjpAfQr9ybd8y6PZFl%4DfeL*&Dg(7b!f@w@i zj2)gy4>kF`dEl4hKLCM*hk<;r)>UOKhti_VXkzQIEM2{_TZJ zSRGrEJGS)UgfvCVXd%c#L9NT*Y8S5)TFE?oI%csOp`rtcAC`KWJiqwjRGUIa5yKXTRWOv{SP zW~}#b%gqQ$4{p!(NZ1vb%^hjkaaCt$>W$?o(}$)MX&&`08eyybb!p7YG%R6zo*-_% zStPKyoB2rXYf2eo)Xqu>0XRU3bTL7ad5`M*r8uKfQO+qS=MBMea{fHE!s)9gRK)+3 zGEr4UzVlRwsD~847orT*s|ud!(keteAq12X;-#2i@|3Fuxm}VlUf-fCJ;$r{s!4na zUcM4f{b6{cyC;|9iA2y;QxZ}&f_wc(a05#XI2<80k7E^_AxkZi3@j^aVRxL^>^7Ob_S6Y5u&tBC9%x@o1b>UV_z88v6zBou;Epp^(tqoxe1)JWq zLX6^&05_3NIkO?P_-9EVGV6l`X-`5QxvUGiDtpMPA-yKLM%)l{sKHaApYP%5ZFJKr zR>ta)V`zM}lFFitCJ;qEqpd{*mMenOLQ0?}Q6evK!eo)(=gmy#4Aj$-=1%U@W5BBMycfgJo z<+z#TBC6zRsx;upeL|I~S2LO4tnTCPTW>U3X1UBFiyi*b(lapwM1ODEl)b=m!Cgax zs)TUQyg_+vu%c_pH&Y-?uFYz}stxr(**^XGbNVI!@#-+!DRmLGLAoH_IsJ$&UV9oN zc=#`&-lj}j7GUBqFRhj+iQGTJs9DV^hS-~73XFG2d*ZER&16FeF|U=j+1>c<+K}2u z@Qh@I5^9OOJeK2t@fz}^Qm^YU@G50lL$OYCNhp3UmL))Y2Dz9MFs%#?Dv?0Jg6 zV$n;z&Aa&yk);Mi$il9-nupzPd` zE|_1o6$aDR|F39^B74{v`DgM++YxH6-RBhHc@PHS!WFHDJ0Vz%JBr2|gZvgl3P`Au zDrfd`Es*{@GD$nKf$(JG`c#tFSn9+j5?tM87gVhG2bG)0no@J1-);F2$1UzJERG$^ z!aG&4y;ZW?-}$i+#C9!vg{PA}m2OW7If4M4@@s$}5mm11m5`mP?&6aY9t7@-65;LE02$&Il8gBz;kB!3emQ*ocX3=7?L3q^K^<&Wvva# zUN?1o&rq%0|9-~Q#t=VNTzFlgZ$^f1XC|I^HBYD3 zZ|f{GmD{RpOjP}!*2A^j8HP@71^HEAdZ%1e7tT#@_oYT_{jk zoYC=^^mrvQin?FQ<(`=5GG{>kMZlkz$!CV7NNT&wbm>j)`wods5$ZPfMozvB+hbn3 z$_4P*vb^oB@?(+J>#Tn*O5jA)U&jS5EAgRBQEY)vkpl?AWaR*0b(6cNAG|xM;nt>A z{bKECm@DWJeNT{G=H|2U?!oXA4%&&swIR$Ie`08u3B~;4AJYaBj>ma2FZLvTEi?nZ zt&lAOf%g)qqT3vOmf#tDkbYdp&o6E1+KA7wzyu&(gd{Qpp3RivH6z^TzQ9}$flyq6 zYgn_i4vfEaculM+#+4LLYzDw7UielyW-I#?baRbryb;>S%auyJsS~XD3||t4~R3@K@<}WEJcd zjW53+n)c0Z-w?3!@hQ;xFr@qIP$O6}Klwt(hO-f=DT_4=G?taDB ziL0FtwWGmVSeAtY#6csIUoe6elBkN7YK0{o7b8l^^Eh9nyqRV$=kLVG;VsUJUdArq z)+Y*#WOc#*?BavacnB;#a{um}vLlgYv6Hr?f$}OrTFuJcg~bzFQz~l=q4l-I?6iRN z=txez1Q%4YvL*RNorE2g7WsCJL4xMUV~SGWS(G+_;s9jp%)6^u+_C|s02>sC4g&o2 z%I|?6ij7Am2mcvk1Bg81^lzS*kS5}6^LKTOy+2GyT9mVtZk&y)O({e#^HrR2*0MXl z8}__A>JJ4CkL-_(?hL%f_GccAx3dwOxZNoM%F*4Ts-LBd|GBq$4tIQBeq`Tl1Fse) z$-Y42ook7pXevXu7dHH!|z2d*cX8Ip# z{kDk+QwQJGz|@gMRJxTHo|TnN72+7l0D(^>NgMu;YJ1l~a zd+L1`ge=mW+&!(obC2F`jEOzRx=%?v_9TC*?$U7b?ZPK%CTolz+&8Y-`n^Xk?)I?~ z=KYPj58d|7bo2leFzOp}1-0l6CmpT)Vq7_cs&apk+wKi)XKGK}+AVSn-2Rem@dINL z#q5j2H)&&SE7Ktrt3;Pw)%1zZVKF_?q&0DYi);pejt{L4Z139!)uW>&5tWg&8q$&d zYQzag_heKG!Vh)=FQfGN3H690_Uw-zsl86#zSUmA40w~A>_VB_ic2YEP&jVFGdTLc!J;94=7^~+UF+< zNCIV!sC4bz6>ob|mVG2|MHFKDu|Ju^*%g7ytnQ;hp$~Z#vu4}=nz2JK&Yzrn-PW^p zH+tlfj~$O1lh9a4wsxVi)&APsEmuCjxvgJ*nQPCZl*sXqh?JD>zp8fba>$!$f+iua zDk*`p2pw`s_3YAOK;`VJmL*L!(4BLWAx@jU>pj&oXv8I8fgM#d2C|Ni^?6o&433TD zaEK2G(`zg?uGZD9id`#v6ZZ7RMb4L8z!TJ7+0z8d)&qHN+mtRU9Z`CfO;5A))xZDg z5Jc}0?%gNsRF(fzT%s_TS5+r9`;@*qnIqw7&V@l0CCWuwx5}I~Vzttos}wd(F8f|_ z=hf}gw%S2n@nfyOw5crG$6I zp%;9$_}WhPcK~EzdnHly31gpm*wJT^{Zg}@pq#})IePD)ShWX2PM&-<`Pq@P5rmcNLB753es^X2f~1W|_^o1I&Auz<&NSHfmi1H{v*L*{8t1yQ(X;9&T25C| zsAdqu9a^S%sgey+x6K}}eIAnt%=gsI9;-#y+M;z{!1t|v+YOnluowS5*1R+1u|q-Z zY(re*qbEfU&Z#NaE{kF=E&9jzM?(Cx?wr_!^6p4Md|E|^d5p`g(|Peo=iEB~4ErRF zh7%`>ScUd>AIUQ&yLs~hR#8eXxw-$ENnYvG#oGz$Cp22`|5;lZeLnoelWrEDoY?Ec z(XHkg#iMrUtNv7PXIFaLyts14F>4KdP-E~eX8OgQ>Gl%) zOhDwfUV|;&&^PdKYJ_j8vAdjd&7|=9MB=uz3vh5tbn=1119BAlk5zrjBxh|(bdW(% zgS5kTt=-EE9B30N*|O!$n=SXX{aVm=CdFh(t7?2Sw@}6oIiU0VvEDyjU4ME7cN-Yn z?gAhY0DuS@cliIKOq<~k2bjRxdd(nuz=i1^xS-IfA=UUU1uG{kdYoc7`|b#Xrw=OM zt|W`z>W0p0&W0?4wKwWwL*|76731rYZ=NsO_g%q7tY|A9x)Qe|P)@2D$T|%l(#JfX zMB-BrUsE&?I}Xm)Oh+HAu9@BMv+P!1{UJxQsW_L2%A6&z_W~WQXK`JycUZaH!W$S8 zTzU&#h(ecFu=@;$&b!xo{p?gz`F5c6Y}3l{@X8Q{hE}*MBl?Qrp`5C-G8-wq!WLcaLM{2QQ?{dvP@$dI>&A3HC%GgKa ztTc_@6Pv%q*5q>Gt1sfz4Kot5m6GO^s4?rjQ(CK~6i zdwsMs1Mz*Gz4wgQ^`ae?U{VKF1Lt|CtO#jtqE;LlZe@7ico^8PsAKnrVR7J4wd7P6D5A~O2YX{c0+BVIFD-`b~(KTMT)m)-DY;4N7F!3bYEvH=O zw8lx8O++`GPZry{(&MdiRr(Cd6gpAbgPSotJJJa)tC;IL7~y*Bulimk@o|v6LcUr{ zicv)C=*D{m(wCNa$8TjNv?_26*A5mpe6=lfJYL;+*rU*5RQ~NMZVZ*>ea_pNZ_vui zp4TYz-2v~kvV*4t*Vd0agHj&rli=;pMSiD$>gx*yz$ZS@6+m89wm$!o-B&dWfWRd) zBUp(w^adi|w&%FD=xuj@46e86BP{5DEU`oNIO&#!omY;}Pd&uD;)WR9NcS5z>*GDn zw#CdEIxEo);gg;yPUWmT&BAUXT|3#V;Y11w3M+?AeFU{xVAkgs2kg)2)5z)!Pu0FclNz#B-?$EVx zRIcV37GXCe?rjqKeH@89VZ*=wZEG&XG}9j3=QpbHwgb3Jblr=TLi>CC5Z=!p^Pag{ zJ)@C-`z!cKp%?n5;pCV1cl7<~lW$I`F0YVM@gi%kPc>+=ycJ=&y+f5tkT4rhuZsO2 zP^%<_FS~nj%XM4964t<9X6s)fE|7QRc_i#ODI#xJh&waDG+HO*@{^)RCZ4SHZ`tfM z8=&%M$gBxl3p|iOUUic2NB0~0l+0H!Ij%(Fu`Z}fizb5rLM1#qf zAN<)s3GuptNw~=3G(7BVoI@h*V86&V=lrF?-ZvJ|iz@iPDW%5_Z0mX&NDg0$dQFsz0rFIT#po}Z_E^|Zy){2{g*c?4<954(@xJKZV&hT28|^%(^pbnZIM$^O~b&S73B9a06;F7-`6OMF4A)GeU>Yu5D5g*Vf-5?5YJ1dp zePd7h?(6*{Rv@AV`yI@sDV;hD&+cZRo~S6pz4B2W>hK^O^v8hSDyhm_!_~E)lC0r= z#4TWG_`oqKI=_g+1%}d@oEW#lZVx~$$j;q?+9y6^6DYEu@$b(*ET*ZkkyS8`E>WNE zuYc~_FN~yfRVub?qTZ2GF(xKEdz?Kyq#g-T0i_nTkYvM!QWY2_q?H||u~M%Iz@)v! z;-^MHA`*$t_7w<*Gp=CAKV9D zzVQDa3?B2({|te`TO+C0$IRgnyjljg?%FTFgb+DcO-7xl+lPA+;KAHC^8OwI$eEC_ zoZ6}6^v~iOw=0STXoj=H!~b(cW+5Rj*Tvd-#@P#d+_?16J@xKqFg%GB%&8}^@X zR`WtFMQJ$6w>hlP$ud00$Wwk!2}|3l#BkFmhr@!PhX;TvkrmdQ)^}r9M&I^hryi)D zOFzO|K}rzW#=50&H`KSh^I{;;X@~gs%S%ksU|q-SXUUFmBy1^%ar_IpqQSA!jaIQj zAErZ(Dr4_}{7bKCa(aIuku&JphqfHHvwSe)-$t{F4Pf*KTAM-ynNePz_IiCHA=Rl( zkFNM~A`8D;-WgJ|j2iEez)e5x$M6q^xF8d~A2*il3*iZeWK3inNGn*=>GxD{ox8U6 zmmfQwjNiLgwa?GnGmnOAK5F`>S6!f6_XPp^(SnyzRDSpeH#xOMojjXz1(lI$@uwi6p;$ww{h(GIasiWY zPNqh$6O~Kvd^tH$Q0JKT8e(BB{eB806#|h*7H(LOfIm86E^q;6E*~BO3n9X;L*ZtK z0EFL!S`Q@o-0y(;z84DW;nv-rT-b?fwzR8_a(2>Un=$(2z(zC+3ME1y5C|W+LJeyo zy>hZF9VDmpB<#ukT!}YJm8~`2bNBOZU&IW)(JS@!v7;4swY{exitI@gyIAUmMv+dfhbcfG*UTOs)P+I(p#t@!OC)kW`bXDpV+m32 zQe6$9zg=Zq6+<8pcMx9c%DT+}@R6RcS2o_NeM~}p`RLNInW(ciG4q{L3=Oo=aBe-4 zhYTGIVi1%aK0s>*v;G!Dwo=#E#*9J?z&vE@7DUWXOP%N5XL?HOGKFn#1;5>TO>PB6 z=Y2&>N5EH<oBbrabh`Y z3qxPPeo*Rf*7fjVt(nSzz%lTYK4RCYijmXYY1Vdz|C=^58FgO>oXI<8Y90f)FEJ;1 zuo*eGL^zva(I5q_x^62LE?U6y7-n(*xjw;K4$Q;zRFIk$&Y#Y#1od+^r|Rj;8V%R( zAMK!bqgD(btUxLF!RiQs_TYCHF{ly#yR%@@XzvLFrhHm=vXG0ahWAyo|7r8L4<2Ez ze|z{{=d%7Hs+SNo3y4_vAg@jLp+s0_Y{_c^VWW_Ex60Z2C$Kp-5+SFwF}5mTn4YdOpVi8d2WxACwK?(wTJ7cuFiuCig@(&A zgEey5VNpsJ3l760&i#KYjuu+MEUHha>Cb5GPYvig`Wn_)6$d?Fr%%7;Fo?knjuhXE z92|_iS3L4g9n3qx%6nV0z8;+X9Mfem#a_2Z=g7|8tiUaM3_89h9Nd=mR-qOdPaZvV zU54|#wa3x+G{%ohMtw0+tXBb0%6Z}wKu@K9YxnV{Tkk7@xnrLZ3`btN%croh%9}h$fRAg3r~5fEUv2F?ew`DbVpE%N4HtN`|X z@7sX+?i$ArIa94w60cVPfgw-I8luvbr0HO2z`8%1FPJ@_r1J_O@NdWYBKMgZ29G*8 zg7`r;0#-}LBc_p9t{=9DpovLw^l^_%g^umqc`VVmgF0SNL3I#*-`(pn%^z zi(q7tnQSt3*xDWcb`3V2HDc2J3z^5Qt+0Vh)Ax4k{O!>ek8cZzfQqim4V`ZjqnQdx z(U7G$5Q^v!FpB8NO^p2c?FoNVf63Sv5>6lX`~{ZOCQI)--3 zMF?UJO4^h4Fp!i>B9LI@M}JzM(bsOF*+^DaN~^NI7L!8ku06qi~X2%kd{V?eTHWTz%dFj>j}T?yx{aH-F$- z!1EKCceWN;HRa}>-su}K6gHFpzSEe^>d=ybAhaqe1GDJtfb)8{M;7W+JOM67IU?ua zLt)M#dW5c{id(*Z#ZW$)lHIgp1CiKTLjR9q%rtBs5W zfodp9m9*8I8?rixaawOBIU*p86`#rCgU{hKX~5E zfLHS{O)aaXH_{p(*qNT9?nrW0s4@z-krW+C>a^}W```%c;^ru~+~&Cz2JH`=4K;On zcWOd(h0Fit9Et`(k+84Uk8c+bhV@)!8#7tqj{3DsT<*%cYiuKP|8vmGf0Pc(ugn`1 zM-vX{V*f8|=Fr4KS}>OKauv=*xoCw%*cx#;;r>_a^PkdsvqK$>9XKFBtjQAq(?b{P z1vHU_w&I-e6^br5qrz32dtawq(GY--UwtDXe0r29F*3MMhmW1F1iG{Q~9EjEcD;1^ddH6j{7%L#klChR8DOCnXZb_w0aTTWQ>@HiwDn zXiP?u3auGPPhGwKgofVdqYaHs6`kSkBHP?m?b0!yP~g=H4_grO9=VMrfBomA;m43jr2Z+86zdY~WEfX1T?JdSS5b7@3(9@(KUv&Ewa!}^=C z@YNGDZC5VIdon8r*r%-S%XE?#V(@^K#Y&xm1eRmh3j`wSy~_nT3&qaEkycKV6N+Hs-MIds`6X-C(Is)myLbJty^QX0>P7dsg$8M5?956AuVueKNd@&q@_h!q62|?-?G{EKJ8TgR<=lmw&r=_zjry990o;ft^oeJW!XNQp~8D2yN6oL*2$1klFP$Ib8h(%=6y$c^E z9SBn+mem4qOQ6W_fJ7dc+W|!Uqze1UnhX5!>KaXmIYQROG)Lhc^JPHsW{!T|yE_A6 zez#XoYYNvxOabWejv!Qq=aqb*JC@yc=qcimvtdXUlD7<&z`5{xu03pdPWlw0Q(pS( z2H$u`hv}~{7^($k-^O?$Ww-;zxGtJGm8QVrTqp_$|0r&6L1|CjK($AN!?Ap4JMQH@8Aa9@G|DGS zJp4edx_k(Wm^5C1aS43oT;+fJhE^3H;_VxsF>s&{C0oWLQ`GO^BkV@$i~8dC&)6ff zs4b>Lq)GAG% zCM>7Si{DTetjkQUS>fL#IPk!rKK9ZN(LMOWTgTRS+&l&<2}2lu&Ljd{n5CXs$yqo5 zn^z=R;gf%{tX`0uapFcLMTOSc*Fn=1R}->PsT4QLd)4sht&fTkWD3zq%%hh)4} zR8UUkko^dEVzQ6B)SQD|9+UZIf7 zZ%2H-o#7)_Duaqe{pm=d2+@aDcwKEI@7mRmkxNQV&kr<4EvuIpZ&B+*8=b1Q+A`6{ z?Xw2DGjT72RG(eFDe)Z^JT@+BcyGTid_zHArdwk|>N2V0d_f7hdvAZxF|CzLd+`P` zK^0(6t?>*SMmW2|JEzqrAij$^5(E;)fIwnW!(Hx_qsq6@aV%EaZx^3DD)5r}_-wrq zUXg+bjRt zs}9U9vKC{UYi=(3%kOp>mLxwqi|>i1f$!Xx-^IZGV#j;m6U||I1Henb!|L9nWSK{6 zc~;i8yupR1TKTWdr8>9FCt8jbb7z|_0=ofETo*4Z-)Z|UgrzlV%04Kejtf14|32~v z%XS_L+w^xmH(Y}>z8~4(--vnf`hF?c$#EG@O928G0&}Tze)2hgJfheOYYm*>w|is( zhNj=vZ~4QXJD;`3TIh|0umt8o#8Qbgr*?9~txe5=meI2L63T#{my0IyUp}>PJYifW z5ZzK1^IvhFzs+wAKv*JBT~t-xFnPb|zIGYlcC-t3*6RJGbjn@jRn?ak?P=c&hddQS z)8g@Iu6R9TF?KgOiYR9J3hYhlYxCNKI+G{bstUVF>WU1N2KQimdCmwqMD4t$@imfe zj__3uI=VwEFFrX{$3`e4Wl5BLl}jPI+TqZWlWZ`kq%$_L*>1;7N0((PHcn*?FUyP? z?bMFf#j0v*)tcjX`n0X{W%b23a(vN(kl=)r_nW*Tlp6uNXgF)(=TFq0c zLvjk%ltSZ4o3d_nhuYSDwJpsfTH{u`f4kbqcKX&G8%(mSLIE3c`KKZ|#g{dn*uy#C z9)LJj2EOXJc&rC#>R)7D%Q};Mcx_h!D4(}}tKSX!P3n1pE2SwT5+%xlwV5Av{i=nX zf_~nwz83q3(TR&HxAdg9#Y+>Tlvs{~ukSqg&(UYA`!@i5U=V=K+SYm!u*OI*l^nFs zX=_=SJu=4@7UbdY`{iy8U;Ec}|5(5NM^{$TxsHyrfmvNIOFT;MRAg=zow&GJv+d^f zN=-IE;OBDPjhq|vPWxhNzVFjS9XPdoAkD%jgERm(*b+=Y{vkc#Nu?AQb$@#5Z4R2s zkY2spNmV+O5P<2JWdDuB-HZ}p4nJWsXaX;gu*7NZdBr=}*KP(;x{3JbZy?z3kdr8j z{(-f3BUf<-_~!{pVJD6ygusKR@**+z#_9 zUupR8uaaG&#iBsBkip|rei7U`8GFp^9aXe&t^7^>*;pOdkf8-?`ozgo>6@unIy&#s zKvoo!R@uIQMiy^b`(7xJK9Pg5Ifgw}#EUkT$JQsde_T;h7pswSZdX`o zBSt(hd087`3w@5%ml>7RcLn^BBO^zV(9mOrW?HmyHMOy3adL2Lc{&>mzfYG}-gIUR zvQ(uPmV|mCv`7+D_a;#4$`4*Z79Nbok%`0Y9Sy^dOFK>k@$5R(jS-`_ET71?$G^1j z#hG8oLeZ3y!I zIr!2KKxMG`e%y50jm)j5zrxdGk|6RbETSD?hO(x>^k(_Cb8uRYT*DnIqva{A%}LW! z%?zE2exenF<@3*R@AmFSnk+t(IaEI3HZ91nt3`wm?IQ@KIu4F2GPNIFgW1w-^5Tjr zzliSakOP*e2+4~lXJqpP?xT`+QJ^t(OKNuLq7nQ`U_{~f^uX0Vf+JtzdIy!v3*TE2yxCq+3 zmx2?LZ@vO7E!oLXgADFuhj0Py?`ao@9K$>RJRZX#?8>k$SNF?|r3xP5aU*ScE6enB zWo2B_tEVq_xcR+Q;G}N9c<1B3U&`F5BT65Q(LlpRp!gFOz}T3DZOMUSZxE8V`)k*N z1pVct^9@hQl-|Lh@LZ@r5e~>B@eQk=Zv)hL&FJlozmJ^-vaz?bkE?{3W4|B?9Wl#rhXOZA@F^c##c(~_f3A^44sA8$3F=Yvq)2`RJ&I76~~@H!P<-0mJstYKMk^W z-sKgB0TZBoVR*UQdEOeOoXp@X?j7Q1#^VJ=N6~R*JeikR;1#*8w0Kj3_tfuvYGkcg zlALYL&ie#>9tu!z{eYXNOosb&YI;j2*As}Sbr*4<{#7@5yMvCd+RmfXXPZ>?LQ~cW z43IOF(h6MlNq0h_;<>zwepxd2Xo4-M9|&lgk_ExSSZyl2d&6@uXGa3mru04xOC7_2 zeTxNLP5zdtLmE+qnSt>7%*McATI{_ggapmw$ba4 z)47KnvtHpDgRN8Gd6DmD&VU@!V-#;qkolx`T~Nfvh6ST*^iw;4i!0=K2GrR(yB425 zx1z7lCDO16g5L&2!UyWzO^JT`w>I_7nVv$&xDn16db~&w(;2%dxz5GWS!@?W+l%RL z3d>o2*5&Tx_q9OdM5w!~h?hpmOUgYmi z>Vw5{pBc#t(lo#3iIUn=PL(2~eA%106>GSzBJ4=nWSQ33(9U#p+#cGAG;K6Cc${!w zp!zL!oX6YK? zPhI&O*L7gLVKK|yzjQ0m;&LnK;Ar(MF>(?R5;318I+O4Ld6FyC$%e^z+pvXz{l~9jfQxHf$)q$Ogb2+$5*WC2&13Btc zb|lHGdOF1yW+UPX`?*(dB8OU(XM|dJ_Tb4nu{2yl-EaSin=LoZjtvhQzi(aj{?xA2 z*VWyZZK&l1(=@1>ty>FcK=r+|ygG0RWE?!6kGnY(sWxIc3{F3!r2vugB~K?sq}csb z*>s$l@E7}ykdc*@i7ikw)1dHV851~GR7?paz>g7f2uen=i2HLeyl+Me;22Ebi^j89XnvHWgModvFZwFxteCyK_{Pfc`AnRn$l{Z&4W~^yrjq~P04i4Zpid?a^vu2|4`97BKQtU=SAMAT@hYg!+U8x>1a5l(k z(q}(LUBdg{{}lW_cLmPA9Z(({PJO5ffHP+-XyQbV#q3g zT;LT1k;*N|TQC}{og&qHOz}EtP5mBAdbb~5M<8m&Gg_RNN?QpvQB7oRPq!G@8=J>B z8VMwEe~f5`3lqY{!Q7CL**EZwt*40;t%UYAGeSk~8_lQ|*+?I{(Im zM6Iwe%GQCFR)G>y@jLRz)B3 zs#dSsj8h|R7nSjZdgw`zOOz|qmmt4pks!F_i1;7XUbJ0Cz(oD zbOuVKkK|Bnk6Kha)c7r81k~>!B zER=eoTxlpY+10w!Bfp91QnDKHMfQA@lk!iHeX7{aKbI{xi%wg_XiI~7R5UWI*rr`y z^!fLsU!velyQi>BR}f)mg6~7VNUHx5Cl^>S*vrI`Z<0SPWEZ9&R|YV50^yR%glz0C zj^_?F*>#p(F`47~xliY!W(4pzl_dS-b`I^$h8ZYJC?-nae8$odxYcTT=i}WQ7mjw# zgHPv--!4z-8`0NNptNVs+m^UC1z+DSj!*7;(4E`?{$HGn|LQS+j9Ru$Q0Mt>bebJj zeHFCu_jeXCcIaMY8*LR0P}}X-l=Xj{ULfjIKh&6cNM6Gwm|=tRs{v=kVXMiX@6%dx zLr+l#>wYSMIwgGbo6<<=B7&|ga_(B{^Vooo`bkYEnk}vvDj;g377=`jAcR>i8tPZAUT~)gNk>lRbaFvK3 zWD?)4LaDVe;q?lv3x8skl7JoX=$CQQ5$dnY{d+OuLt=6)#YesFT(Z!;@3W#F*j9AdR6S@TTvC6kCu--xuKO z%(~|<I@d0!?Ze^g<`QT~8HQx3YR;=bu2MQm^$aQ*E}bi|yq7K?87K)e zIOR1`-F(r=sugj$^Ap%yeFiYZEoM{$$&hb1?k`=>>__`<5w)(jrLeMxqql7GaA1fgXZW_ zjvEU2!V#?mf)!f|A`)i0DSej9*3%r)yLVD@COY^44&(BZIhx9)@DVSl!MaX4p8KKq z`fH{%V$bXHe%>x*f>;tBe-NyB%F~m+M<(j^NpfhL1uyMtySiU9cTqyg`L1$AnkFsq z6g_0PLKn?PReWp!6$rgew@b@KNcI;?fa7)yDh+sN-vlFNb@|nwtz2Jv3>5G&e8d+0 zMCAq-v8Y+|q9y(P|LB1B`C^m}GWACf5Ja1!6V(gpsp~!%B}ww!q3$(WywZyIjim!W z92<}wiR&_v5hXwOdws{{;_Mwm=RE(ty!y3{ zO7313dtvL9vSs+|`jZOodR1h8n+I1VWOEFnPHv&PBLo z|3{e!zMSRyk!UU&*;xx-4>t=TA8X}|NUNAA>}1A@a7(gcyTggq!|Xi6)&Ako=o5S2 zUXOQo-+_dk%60*Z#ar~Lti@-T#T;J`U16m?8+_%l+iLiq_V+N3ZgWJrYDjU*$!)(2 z<)_E6eG}h?MP0}LQpqIG<`=jx|K^w2m{etqeH&7+1yp3E+52@f>Ge&c|1`!taDLo< z?Ry`q?!;wX3uJcBLmiO8CU-{@6GP)Jkq67jz-m(rI6PuXlqD)Mo#Yn{ChH^3JoTrG zN{>9^GkZ2n9r(P zVNJskC(vRmgm0vq83Mq~zJPen*TUaG+-9HenJyK%_2mtJdY=h$hfPnamJ?W$iA~csmYBI6DmDi%%vn=XSWpGJ$OI5;gcSJwdPv?1Bd?m)mrlW zJ$qNanNc{sn=d;)ub>`RBE8-p5O^f22~?p-NblrO5jkR>OJA>yzx33)aJQXOhx}y% zAT(BNCoiCnwv#i}>79@jCv4(F$c?~cRDW&gndWeF8Ks&EB9o7GLV`kfQjS*W)b-~v zA{NyEK`xZS&V+yB)1>beuI_yWiYqJKXzKy?}t9UZbjUEgSe|1tF`&$~7NYRvxz?25tbyRbAe27dHI>nK= zhFZv@J7UY@v$A8IIK8!;uFzE#&-hkIK)?Oi_omncEP)ih?^`@WT&zmKMw?T?<#o4U z0E8)}taVbxW+J)BL2Gbl_xbFzAvr)iZ3VB&Fx9X_9~Bil+GY$LJS= zu(5Qq>zQjyj)t^d=5&>>cV)U2e>0aOktkZ67U0 zzaM+qMdXXE-m{SRi^~!+B(O4a@kAOIV1Yw%G8S3NUieQ{ z@`=%UqY^ok@;kyO+gKB^0@B;C*l44)wZBY-*1Qa;46fTrGvSyB$(NFN(RSU!j=aC& zs@kBXkRq>@lPtu5@(S57qR9%?Y;QP_pGFKTOPJJ*b$G#`g0o5Lpng(K7L6wc3jJYE zWA0}1YjK`yIlTiswHaa`F{!pLv7c&OHR$c#KB35I#*r8{HOF<>-pm@HUn(9)gb)Xs z#151Dy*9Tqou2zX*1y)bliHDNv75X?7#8Q}CX<=cF^MlxPJYRL z-p&K{r<)xG@b8_zZd9^98(9sDS-EqmV61Mjgy?!Lw?{N4=>gDN{UaJDAK70tZ2{p5 zlnkJmk6~^j0Q_QM{ws;j60EQ7!~I=!pN;eDmxlL9lSupqM)~O5%<^qqBZ}TU5>iqk z^EYF-dmkjr4syM-(x8IJ>>X(~z%px4wL7VW#aO*`n;mmvcfSd%z?`X+%B-wS231>v z(KrLy%EF1C)|2f*5E z35$#~9)VjnVylbnQv7s3OXUi`B}S%VL!(I9^)G_4>bz0 z;Zt4&XL26;b3-Cs&%rH#+VWH+|IFIZt6OJVs}Xt1WQ|SF3I)v=1O12#J3fXC^gMC0 zmpv6?TBJm5Yhi(*-f+Zo2%wfnq>>3@0h^QXZa=F2ow?#!WWk+S@+?L|NjKAE8<$^| zLkfCH^7vpF7x&a36OtmKKNt5TLcQHU-^bSKx7K|$sy1u`od2T$QkJv0L!HFkrb>?h=_O48fmctYHQl!rtQL>13-$W5(BbyiJ}MoRrs*1IF91XV7YsfBa{aVl2s zx57pJzH2CNk3p4**K0Gw{VaQP^R_d?eA^{SWqYY-VH)tjNX6$lns%fag+BmciwTD; z{eVqUm4Mgr3)34~grHgkOhHM1NIlmK)DJ;NPEBY=^bL5fof%EdN2GAc*tSba|5 zd%Da_mCezJ-OR#}B5eCDOYKr|h*?#syewp!p-?V6K2h15S)NpCOho4^p0%JDK5iEh zx5E`Egfd;y$Z2-YWKQw6dL`Uh+8l`BJ0L5q7U=v+RZic}Zm1hu}UNe`mO z=LptzGSdq5EKUf?`+YG^;{mRZ>MEv&WAW2kl}mE-NCVt17>JK7Wgxm{we_u2<8t}k zhE3`2yO=e>c54;}iy6mEDa~O){1F{NO2EspIQ_)1BZPC>#dQK?im_j?!XC+>TvujUx`O zrP>n6kf(ZfC;SY5DVK1NYw{0LRH(j&?q7GP^!vy~O?pd-yJBaRdj5PM2kMk9%57Lq z8{48QQJxx3-?aAE)fi{#%_G-5f|VtP;dT|evh}ysUl}sn2)6>_4#d`5)A05UZPLX1 z02wc&ab>YE*| z00wzTjq#4xcwee33dNraE!<1rf#}rrLC>Ne*Hz+OPOl;ShcE&{W3yKE(nV^p6KB=` zRMYM@Oo1fB_Fum@?w?s^yJuO8^%W-k>^AFHd7i`>XSn}I49ca z=gHReK08-Pi5@6RFtZAuUM|6SAmr9D@_T~cKyi9ccIdqOV(_+7_q`0!Q~}bIJ)p&& zW{@X%7USX^sK)VIDH$%xZw&JAFK)XGZ*H5^hV7)=SIL`3%j>^td5j9#)xL!K>sfi& z?cYH2ZOjQlvHR&piRSs_6lh@}Fy1D3bWyLXRg>DSOkm@f2&XQ#-T~XVg*Xa+Hzzm> z(gA&X*`GJTi-N~5ukS-Mho#wx7!m1QlKQ3LjFDcuw^Q0VZ0*zsb4BrpU(-i{iRjxZ z4wO`zbg%Kr_q%?k8tX1bhjnJ%E;{f`!2~Od6BuwtlWYrt-E_9gK&;Y|FbP3`P{}?M z?*aFreO^3N5_5SLsoPEJFHiDa>%XbLV$8Z*TJ?HoymC7LVZcg7WTsE-x}QtvjkteE z)emmI$xS`a4?+LBe*!!~@gDlt&DDD1dMDe?TRB)09>_d7wn* z>B%%mKS|5ch9vpQtJwXuLJjOM2Z}vQpox06_V}qN{w1Hf;cu>$RMe=8G?PF*FVnZ< zlGv3(nC%)xH(B;wJMqlj{ebX1v|JYhFlX+7n zbOM7NWBYsG`uS@hqD#v^z^BId-Y#pPr(%W@#^g(|t?qMl-|B&F%?8!`c&j(aaz0d{ zGRmQ$2!<3KgmgVe;%z+tR>_L5{q2jsae_f=KcLhRe{PNxD2qyj1QLQAg#pu3`yOas zD@2DAgAQrzZLUC)(Avl_%KNLYno*aAk#w*|2=AMjyPsokxx--ms^V$9V1_pjI3=1Y z#8SZ|$E_JsT`3M5xPrvD%0an8oi56j=9s90h3n8&sNajoTxSRe2822S-r=;hF%2DM ze8e+Kre}(!T_RZ$(U4rL|I%ZzEV~EFNNeM@N8t6~7*%c>!R!d8lVXBl zVJWn=l4EWf;4AzSakR{LSO?S*SHc4=Xh6ACdK~c8lySDg_f`pkFa*>HU#k^?Mk*9{ za)hMXOej0CYjHfP@rr~g=bzpZWd>K)z(RWS24$;J{WoGXRRr;k!7#8hjdn`O-U8}5 zo6@7Qu$vlPAwxkd&&~X!a5-rWMK9dA?DB9=jmEx5D3{D5oiT{fXLI@`D=Ux#grhuG zD^+!nEA~NcC)v7i@}e#|#_(t9O%4YG-k=tCW>)%JiM~ScnO!i>TNad-?#I#}>v((J!f2=gHwtwVc_EHLQC){JFeq7&ps>W$Ag5{AA z5%-n%)m`Uk9s6B0JIB6kaJrH3z;!O?qLioid$n=1i4lrqDOhOBjy_{)&~}-)5yfq~ zDifYQW_zyMSN{T4L=Pc#ME$CI0va)*OlfjUkgHml<^y$ie%U+w2tv?6msX5G3P$2| z#}ZAU`GSWiS?V@OD{M@e!KF@7;%AG)l_V?oK94RRx+$P-W{4>of3`BKkt$%=Cw)rH zdIYbw;3}9c=gIK<(6$4kYGoOTejN0P^d6Erc!4g3XYGDqwO^ERSQsi+-!=}GN!)X>w*ji{P1H>wZ{UH6 zX{an&UKRFSLBQ>AVwy2F&Q`XK_T!efPgBi&dArxpzkCbg)}*sMQ3d!ynYcWix z_|npYGkjM4H_VCfl1lDfoX0C$VNvA=MKO()qiafz$U5Uzd^r!`sw6gjbZ`=$i^_!5*E*mpvGd zg5%DuZ3wIxm4a&5e0xsqmgD* zYGLt_w3+$h0%!yaVq;0um3t$XEA$yK5Pw|pv!C9zSh@wc?lNT5)5EG6KfIzyluy3k zUv3{ba}*4FG$(pmR^nCj0s#eCNQ4~D zqf!&>E;YJNTW#siz8Z?A8ZLGxgC714l~`@O#>4Wd5=#=oawdMM<77yT(2db7k@4Wp zE%_OM$dm`us47x}?QgqM7)?HZM=$E)8)}u-P|8J5me;Vs-QgJLa01hjt`-GZf4WXYs8)21~d#k7r)eGs%T zoTM@mjdY}?b}Wv#jHbE*Kz`zf{tRkAt>Qc*%XqotdNs+gjp4Eba2n*ly|eRwCt$ys zh~nX>+L&#zD&EyQzPT7a-T4FSO1;b<&IKtjfrbAlppEY|+K)W=f(08x4LSchxPcZ; z&=#FTV)*|ywEy4&Mhf@OGx`^f5+SBVpmLE zI=62U*W>|>NHHU*R5SE{tCw-<<`9FC;fkJ1!6_8;hau))x%lmF$sfp7&pD(kD96H)c$SxIVbZT_~A3 zq=}nfv}2Lwr=d1$v7i?b+##9FLkXQFg^h;+o~eoUixID_yyG_rQYZ@APz*{54#pA0 zKa>pR#RSC`{ME;>CYUt;d;KKSEM)0R4s_P8I^L$4pB(rX9NTKK(#8fN{R*CJBK6fj zg$x42U%7H@19J?CBoA$x)b)Wp621#55p_mM7E4!7(moooafA6ECF-Zt^1qol{;FtA zId&y37DAx8Lw|yrU@Kx3nm!Z4dtT`gHi}vb$}j&kSBP&eGZ2SUb=dNsnEsur&WEKT z)j_QnLZ)5KOXZBcM8xs9Gw{W^CwZ=9$>@IzmDQpcEd(2W&^0pw4EE)QCw7R^@bLL; z`;jKBD-xYQQ2yd6a!O3cQ1R6Y?8$v6opn%hlyAYLdyZByBqP$wt`$?@3G?GqjI-WI zFr(&N%W-LTiVx^1Ho9CEPW9Z5AOL?Gi|-iXg08;`9bHFOX<@)jh53F(ufGo7X8;-H z0l)YvMmC@|H(*Hq)5~Lc+wpVu7B-~+C=Jcxyn+Svys26)m~PyI-+W15v=_={`XO5l zHTRU5<6Q%(;GtU{_)M$_Z@txr^r;MoqLKj!*lxsJ-o*}P>e`FX{w*=TWA)e>mkquq zR>aObeoL>tvlW0b{B)@!*Q#MRNDVE1iwYTY0jEF7nOpwz-CzpVB)}t%DHnxnklM&j z{5nE-m_I0{MuyF@X{w^ZXId;$ZzxX3PofMm&=br2L2ZV2EG&HUL-^jmzMYczD$O`Z z?tN3awcrjqUCwXxK5<+SI?>|?PR!D$t||ghxxLKVr-Z6Dw@24}CgX^Pq}kM_7!5qg z%Z*9SS}A#;Gxrf6Yzc??{fJaAfRlxa)hoqd(HC= z7O1`LmWceuZ0Io0(jzpSr>;rS>W?x`vcp>fVVJl1r4thU;2&FV>(dCwX&XK8S-%w< z9R&H4wYnRLSj%_btvh@R$#$Oo0`rfNf}|CtyFYe$!fDRQ{TCn#B2oP}ys`rt2n8pY zPr*hy=n`c2!FY)-Q6avwsaI|ld#8}B@=2^@?xy>AgA!eO(n7ietiyp6B?7 zzEjdImQZsbH{m6+$_l~!C_p?uVA-?$aetr2!i(>2oJ8*9svS$rL?LjaYe}8@!`*TQ zq#ig1wLj@;6j;-piPNt2DLzE!!*!-C3&;{_h7O&)YC#HO4{G<&N_9zob7B%}yt1NC zn%`Mm`%Yl-g?yhDxiV;rXh^>0f5my?!*A)t)TMO`3`(N+D9}1!YxNnLK)>@{8hpI5 zD`Qq^)g>Q(N6@}yx=%cj9sNvX@vp)=nn6ncK;7JEiZgd^P2j%)6VR%zgBZHuTvAw6 z>wG|E*}P>alWtK8B}_gAdu^xWy(?U(@8_IgZ{Dg_YfH_i| zcEU*ZONGosHYDv&Sy(wA_rub(!|ZW;oHgD9RV~OgubHzEy>?~?K2bePVezxt2%>;P z-?ra7<4n?x&FYaE?cEGI)-)$tD$5+muBu}U?sPHFKe+hV5?aCTUXV`J=9AHC=o-*Q zXUuT@-0>M!)m+!o+T(oHaeB!5lJUF^EcXIqSUNsvI7$4;|X#{w!e5pUJ_ zak1J+C*mxrK*L>l)}}XDmB5!T;U_ev;jCB9B2`6t)Wa`7=7pam>YPepUHy>E1}-i| zx=cTq2|P}#Ey5pcy4D8*2oic4dykynV%zxoUkQ#ZS%}$Wd?mL`_nI;G*TmEF^KJp z_vh{DE5H7`9RZOzAku0+?DJ`Ocwh zS7jB5f%YHF1(sTSKSuTtezZh?ey859@nDV}*wx8We3^(^>c;D^k{15Qf0gLJdBw#% zK4AOfnWngIHTLC=dT)#w{3rZBSpE+*HU0+;Htp>`-fzW8*#W`aU5e&a;9&m+kS-Mo literal 0 HcmV?d00001 diff --git a/img/favicon.ico b/img/favicon.ico new file mode 100644 index 0000000000000000000000000000000000000000..e85006a3ce1c6fd81faa6d5a13095519c4a6fc96 GIT binary patch literal 1150 zcmd6lF-yZh9L1kl>(HSEK`2y^4yB6->f+$wD)=oNY!UheIt03Q=;qj=;8*Bap_4*& za8yAl;wmmx5Yyi^7dXN-WYdJ-{qNqpcez|5t#Fr0qTSYcPTG`I2PBk8r$~4kg^0zN zCJe(rhix3do!L$bZ+IuZ{i08x=JR3=e+M4pv0KsKA??{u_*EFfo|`p&t`Vf=jn{)F z1fKk9hWsmYwqWAP^JO*5u*R;*L&dX3H$%S7oB$f0{ISh{QVXuncnzN67WQH2`lip7 zhX+VI$6x$1+$8gMjh4+1l0N#8_0Fh=N#EwpKk{SeE!)SHFB@xQFX3y+8sF#_@!bDW eIdI-IC`$c%>bk?KbPeN9RHtL<1^)v~#xMt8oB^@` literal 0 HcmV?d00001 diff --git a/img/grid.png b/img/grid.png new file mode 100644 index 0000000000000000000000000000000000000000..878c3ed5c196539c4e2da35b7787ab08e98b9cca GIT binary patch literal 1458 zcmeAS@N?(olHy`uVBq!ia0vp^Q49=>MjUKFR#nCEMj*vm;1OBOz`!jG!i)^F=12fl zLsS+C#C9D4%n8IWc}2f)ZEm(l45;BJwtuC;Xu7MDalsFrAb+- z$t7TS!;J%bz$r0ZA4%9oA5*oBKFCE#E`)d=EDH3$9hZ$hJS^?Fp4#&|GB7Z|@^o^SSJTd6tq0S!DeK!2h*Tl*`P5Yzc8-3Bx*#7*P z_lIZyDoaaS`}OwX=Dx>2?#BS1xgR(Q!d=p|X>EOCN` zXA4VQu*xH8*v`wH|7Kg_&!-n1cjuav&3^o%1B-!38l2qsw5vX{)ww9+?vCFTf>ud~ zg*GO3KC`e=!r@T3xzf`*c)d-IUlfFk;PBjy4K6tmi!A&4@cAEP$Px9s?lqTci7~T+ z-}^{4afY_30{uixxSHt*N>9t^Tda&0H5mQ_1`yCs#p`NH*8Km)_~-KFoNo=!_8c#s zWAa>N-HQ`bo%5fbxey)esBZQ2{nIXNu`Os-bmok|{*PU&?;Wq;K7ViC-rR_~+KOL= zH4)jidxUns0>)Izao*FaI~PF{%uT~Dk@j=8|5Dta{K8wv>d|%Hcb{Lgz3+r2sU6kg zmTAw9&-`i8w14I8wx>P5N6NF;+MlVs*O$JfT6WJou)_P>@A@uXTleG5F;Ur%rwkr} z9Cy=jOL!Yh{`u60)j+55f37_IN$UUe9sghL7uuB@5hwlYz5Q2Eoi? z8|G~6tcc3~n|batFcfpX-rfHA^NYK3=QY>WxaPaUGs?d6cXxkJIsW|O^e4z^d}6ZQ z{XhH5lWzwfnEw0KbC6*c*P{6UH^(HL+Z_Lz)%(e&^e>X(pJ#64-W$DObB_40RoL^? hufEOi_HxMn + + + + + + + + + + Linux Guide and Hints + + + + + + + + + + + + + +

+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

The source code for this page can be found on github. This page contains tutorials and generally useful information regarding packages and system administration in Fedora and Enterprise Linux (Rocky Linux, CentOS Stream).

+ +

Here are some quick links to solid documentation:

+ +

Notes

+

Due to the number of articles out there about disabling SELinux, we felt this note was important.

+

Disabling SELinux is and almost always will be a terrible idea. See our antipatterns page as well as the Red Hat Enterprise Linux documentation, Fedora Docs, and Rocky Linux documentation.

+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + + + + diff --git a/js/base.js b/js/base.js new file mode 100644 index 00000000..b0f4726b --- /dev/null +++ b/js/base.js @@ -0,0 +1,283 @@ +function getSearchTerm() { + var sPageURL = window.location.search.substring(1); + var sURLVariables = sPageURL.split('&'); + for (var i = 0; i < sURLVariables.length; i++) { + var sParameterName = sURLVariables[i].split('='); + if (sParameterName[0] == 'q') { + return sParameterName[1]; + } + } +} + +function applyTopPadding() { + // Update various absolute positions to match where the main container + // starts. This is necessary for handling multi-line nav headers, since + // that pushes the main container down. + var offset = $('body > .container').offset(); + $('html').css('scroll-padding-top', offset.top + 'px'); + $('.bs-sidebar.affix').css('top', offset.top + 'px'); +} + +$(document).ready(function() { + + applyTopPadding(); + + var search_term = getSearchTerm(), + $search_modal = $('#mkdocs_search_modal'), + $keyboard_modal = $('#mkdocs_keyboard_modal'); + + if (search_term) { + $search_modal.modal(); + } + + // make sure search input gets autofocus every time modal opens. + $search_modal.on('shown.bs.modal', function() { + $search_modal.find('#mkdocs-search-query').focus(); + }); + + // Close search modal when result is selected + // The links get added later so listen to parent + $('#mkdocs-search-results').click(function(e) { + if ($(e.target).is('a')) { + $search_modal.modal('hide'); + } + }); + + // Populate keyboard modal with proper Keys + $keyboard_modal.find('.help.shortcut kbd')[0].innerHTML = keyCodes[shortcuts.help]; + $keyboard_modal.find('.prev.shortcut kbd')[0].innerHTML = keyCodes[shortcuts.previous]; + $keyboard_modal.find('.next.shortcut kbd')[0].innerHTML = keyCodes[shortcuts.next]; + $keyboard_modal.find('.search.shortcut kbd')[0].innerHTML = keyCodes[shortcuts.search]; + + // Keyboard navigation + document.addEventListener("keydown", function(e) { + if ($(e.target).is(':input')) return true; + var key = e.which || e.keyCode || window.event && window.event.keyCode; + var page; + switch (key) { + case shortcuts.next: + page = $('.navbar a[rel="next"]:first').prop('href'); + break; + case shortcuts.previous: + page = $('.navbar a[rel="prev"]:first').prop('href'); + break; + case shortcuts.search: + e.preventDefault(); + $keyboard_modal.modal('hide'); + $search_modal.modal('show'); + $search_modal.find('#mkdocs-search-query').focus(); + break; + case shortcuts.help: + $search_modal.modal('hide'); + $keyboard_modal.modal('show'); + break; + default: break; + } + if (page) { + $keyboard_modal.modal('hide'); + window.location.href = page; + } + }); + + $('table').addClass('table table-striped table-hover'); + + // Improve the scrollspy behaviour when users click on a TOC item. + $(".bs-sidenav a").on("click", function() { + var clicked = this; + setTimeout(function() { + var active = $('.nav li.active a'); + active = active[active.length - 1]; + if (clicked !== active) { + $(active).parent().removeClass("active"); + $(clicked).parent().addClass("active"); + } + }, 50); + }); + + function showInnerDropdown(item) { + var popup = $(item).next('.dropdown-menu'); + popup.addClass('show'); + $(item).addClass('open'); + + // First, close any sibling dropdowns. + var container = $(item).parent().parent(); + container.find('> .dropdown-submenu > a').each(function(i, el) { + if (el !== item) { + hideInnerDropdown(el); + } + }); + + var popupMargin = 10; + var maxBottom = $(window).height() - popupMargin; + var bounds = item.getBoundingClientRect(); + + popup.css('left', bounds.right + 'px'); + if (bounds.top + popup.height() > maxBottom && + bounds.top > $(window).height() / 2) { + popup.css({ + 'top': (bounds.bottom - popup.height()) + 'px', + 'max-height': (bounds.bottom - popupMargin) + 'px', + }); + } else { + popup.css({ + 'top': bounds.top + 'px', + 'max-height': (maxBottom - bounds.top) + 'px', + }); + } + } + + function hideInnerDropdown(item) { + var popup = $(item).next('.dropdown-menu'); + popup.removeClass('show'); + $(item).removeClass('open'); + + popup.scrollTop(0); + popup.find('.dropdown-menu').scrollTop(0).removeClass('show'); + popup.find('.dropdown-submenu > a').removeClass('open'); + } + + $('.dropdown-submenu > a').on('click', function(e) { + if ($(this).next('.dropdown-menu').hasClass('show')) { + hideInnerDropdown(this); + } else { + showInnerDropdown(this); + } + + e.stopPropagation(); + e.preventDefault(); + }); + + $('.dropdown-menu').parent().on('hide.bs.dropdown', function(e) { + $(this).find('.dropdown-menu').scrollTop(0); + $(this).find('.dropdown-submenu > a').removeClass('open'); + $(this).find('.dropdown-menu .dropdown-menu').removeClass('show'); + }); +}); + +$(window).on('resize', applyTopPadding); + +$('body').scrollspy({ + target: '.bs-sidebar', + offset: 100 +}); + +/* Prevent disabled links from causing a page reload */ +$("li.disabled a").click(function() { + event.preventDefault(); +}); + +// See https://www.cambiaresearch.com/articles/15/javascript-char-codes-key-codes +// We only list common keys below. Obscure keys are omitted and their use is discouraged. +var keyCodes = { + 8: 'backspace', + 9: 'tab', + 13: 'enter', + 16: 'shift', + 17: 'ctrl', + 18: 'alt', + 19: 'pause/break', + 20: 'caps lock', + 27: 'escape', + 32: 'spacebar', + 33: 'page up', + 34: 'page down', + 35: 'end', + 36: 'home', + 37: '←', + 38: '↑', + 39: '→', + 40: '↓', + 45: 'insert', + 46: 'delete', + 48: '0', + 49: '1', + 50: '2', + 51: '3', + 52: '4', + 53: '5', + 54: '6', + 55: '7', + 56: '8', + 57: '9', + 65: 'a', + 66: 'b', + 67: 'c', + 68: 'd', + 69: 'e', + 70: 'f', + 71: 'g', + 72: 'h', + 73: 'i', + 74: 'j', + 75: 'k', + 76: 'l', + 77: 'm', + 78: 'n', + 79: 'o', + 80: 'p', + 81: 'q', + 82: 'r', + 83: 's', + 84: 't', + 85: 'u', + 86: 'v', + 87: 'w', + 88: 'x', + 89: 'y', + 90: 'z', + 91: 'Left Windows Key / Left ⌘', + 92: 'Right Windows Key', + 93: 'Windows Menu / Right ⌘', + 96: 'numpad 0', + 97: 'numpad 1', + 98: 'numpad 2', + 99: 'numpad 3', + 100: 'numpad 4', + 101: 'numpad 5', + 102: 'numpad 6', + 103: 'numpad 7', + 104: 'numpad 8', + 105: 'numpad 9', + 106: 'multiply', + 107: 'add', + 109: 'subtract', + 110: 'decimal point', + 111: 'divide', + 112: 'f1', + 113: 'f2', + 114: 'f3', + 115: 'f4', + 116: 'f5', + 117: 'f6', + 118: 'f7', + 119: 'f8', + 120: 'f9', + 121: 'f10', + 122: 'f11', + 123: 'f12', + 124: 'f13', + 125: 'f14', + 126: 'f15', + 127: 'f16', + 128: 'f17', + 129: 'f18', + 130: 'f19', + 131: 'f20', + 132: 'f21', + 133: 'f22', + 134: 'f23', + 135: 'f24', + 144: 'num lock', + 145: 'scroll lock', + 186: ';', + 187: '=', + 188: ',', + 189: '‐', + 190: '.', + 191: '?', + 192: '`', + 219: '[', + 220: '\', + 221: ']', + 222: ''', +}; diff --git a/js/bootstrap.min.js b/js/bootstrap.min.js new file mode 100644 index 00000000..ca013b70 --- /dev/null +++ b/js/bootstrap.min.js @@ -0,0 +1,7 @@ +/*! + * Bootstrap v4.3.1 (https://getbootstrap.com/) + * Copyright 2011-2019 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) + * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) + */ +!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e((t=t||self).bootstrap={},t.jQuery,t.Popper)}(this,function(t,g,u){"use strict";function i(t,e){for(var n=0;nthis._items.length-1||t<0))if(this._isSliding)g(this._element).one(Q.SLID,function(){return e.to(t)});else{if(n===t)return this.pause(),void this.cycle();var i=ndocument.documentElement.clientHeight;!this._isBodyOverflowing&&t&&(this._element.style.paddingLeft=this._scrollbarWidth+"px"),this._isBodyOverflowing&&!t&&(this._element.style.paddingRight=this._scrollbarWidth+"px")},t._resetAdjustments=function(){this._element.style.paddingLeft="",this._element.style.paddingRight=""},t._checkScrollbar=function(){var t=document.body.getBoundingClientRect();this._isBodyOverflowing=t.left+t.right
',trigger:"hover focus",title:"",delay:0,html:!1,selector:!1,placement:"top",offset:0,container:!1,fallbackPlacement:"flip",boundary:"scrollParent",sanitize:!0,sanitizeFn:null,whiteList:Ee},je="show",He="out",Re={HIDE:"hide"+De,HIDDEN:"hidden"+De,SHOW:"show"+De,SHOWN:"shown"+De,INSERTED:"inserted"+De,CLICK:"click"+De,FOCUSIN:"focusin"+De,FOCUSOUT:"focusout"+De,MOUSEENTER:"mouseenter"+De,MOUSELEAVE:"mouseleave"+De},xe="fade",Fe="show",Ue=".tooltip-inner",We=".arrow",qe="hover",Me="focus",Ke="click",Qe="manual",Be=function(){function i(t,e){if("undefined"==typeof u)throw new TypeError("Bootstrap's tooltips require Popper.js (https://popper.js.org/)");this._isEnabled=!0,this._timeout=0,this._hoverState="",this._activeTrigger={},this._popper=null,this.element=t,this.config=this._getConfig(e),this.tip=null,this._setListeners()}var t=i.prototype;return t.enable=function(){this._isEnabled=!0},t.disable=function(){this._isEnabled=!1},t.toggleEnabled=function(){this._isEnabled=!this._isEnabled},t.toggle=function(t){if(this._isEnabled)if(t){var e=this.constructor.DATA_KEY,n=g(t.currentTarget).data(e);n||(n=new this.constructor(t.currentTarget,this._getDelegateConfig()),g(t.currentTarget).data(e,n)),n._activeTrigger.click=!n._activeTrigger.click,n._isWithActiveTrigger()?n._enter(null,n):n._leave(null,n)}else{if(g(this.getTipElement()).hasClass(Fe))return void this._leave(null,this);this._enter(null,this)}},t.dispose=function(){clearTimeout(this._timeout),g.removeData(this.element,this.constructor.DATA_KEY),g(this.element).off(this.constructor.EVENT_KEY),g(this.element).closest(".modal").off("hide.bs.modal"),this.tip&&g(this.tip).remove(),this._isEnabled=null,this._timeout=null,this._hoverState=null,(this._activeTrigger=null)!==this._popper&&this._popper.destroy(),this._popper=null,this.element=null,this.config=null,this.tip=null},t.show=function(){var e=this;if("none"===g(this.element).css("display"))throw new Error("Please use show on visible elements");var t=g.Event(this.constructor.Event.SHOW);if(this.isWithContent()&&this._isEnabled){g(this.element).trigger(t);var n=_.findShadowRoot(this.element),i=g.contains(null!==n?n:this.element.ownerDocument.documentElement,this.element);if(t.isDefaultPrevented()||!i)return;var o=this.getTipElement(),r=_.getUID(this.constructor.NAME);o.setAttribute("id",r),this.element.setAttribute("aria-describedby",r),this.setContent(),this.config.animation&&g(o).addClass(xe);var s="function"==typeof this.config.placement?this.config.placement.call(this,o,this.element):this.config.placement,a=this._getAttachment(s);this.addAttachmentClass(a);var l=this._getContainer();g(o).data(this.constructor.DATA_KEY,this),g.contains(this.element.ownerDocument.documentElement,this.tip)||g(o).appendTo(l),g(this.element).trigger(this.constructor.Event.INSERTED),this._popper=new u(this.element,o,{placement:a,modifiers:{offset:this._getOffset(),flip:{behavior:this.config.fallbackPlacement},arrow:{element:We},preventOverflow:{boundariesElement:this.config.boundary}},onCreate:function(t){t.originalPlacement!==t.placement&&e._handlePopperPlacementChange(t)},onUpdate:function(t){return e._handlePopperPlacementChange(t)}}),g(o).addClass(Fe),"ontouchstart"in document.documentElement&&g(document.body).children().on("mouseover",null,g.noop);var c=function(){e.config.animation&&e._fixTransition();var t=e._hoverState;e._hoverState=null,g(e.element).trigger(e.constructor.Event.SHOWN),t===He&&e._leave(null,e)};if(g(this.tip).hasClass(xe)){var h=_.getTransitionDurationFromElement(this.tip);g(this.tip).one(_.TRANSITION_END,c).emulateTransitionEnd(h)}else c()}},t.hide=function(t){var e=this,n=this.getTipElement(),i=g.Event(this.constructor.Event.HIDE),o=function(){e._hoverState!==je&&n.parentNode&&n.parentNode.removeChild(n),e._cleanTipClass(),e.element.removeAttribute("aria-describedby"),g(e.element).trigger(e.constructor.Event.HIDDEN),null!==e._popper&&e._popper.destroy(),t&&t()};if(g(this.element).trigger(i),!i.isDefaultPrevented()){if(g(n).removeClass(Fe),"ontouchstart"in document.documentElement&&g(document.body).children().off("mouseover",null,g.noop),this._activeTrigger[Ke]=!1,this._activeTrigger[Me]=!1,this._activeTrigger[qe]=!1,g(this.tip).hasClass(xe)){var r=_.getTransitionDurationFromElement(n);g(n).one(_.TRANSITION_END,o).emulateTransitionEnd(r)}else o();this._hoverState=""}},t.update=function(){null!==this._popper&&this._popper.scheduleUpdate()},t.isWithContent=function(){return Boolean(this.getTitle())},t.addAttachmentClass=function(t){g(this.getTipElement()).addClass(Ae+"-"+t)},t.getTipElement=function(){return this.tip=this.tip||g(this.config.template)[0],this.tip},t.setContent=function(){var t=this.getTipElement();this.setElementContent(g(t.querySelectorAll(Ue)),this.getTitle()),g(t).removeClass(xe+" "+Fe)},t.setElementContent=function(t,e){"object"!=typeof e||!e.nodeType&&!e.jquery?this.config.html?(this.config.sanitize&&(e=Se(e,this.config.whiteList,this.config.sanitizeFn)),t.html(e)):t.text(e):this.config.html?g(e).parent().is(t)||t.empty().append(e):t.text(g(e).text())},t.getTitle=function(){var t=this.element.getAttribute("data-original-title");return t||(t="function"==typeof this.config.title?this.config.title.call(this.element):this.config.title),t},t._getOffset=function(){var e=this,t={};return"function"==typeof this.config.offset?t.fn=function(t){return t.offsets=l({},t.offsets,e.config.offset(t.offsets,e.element)||{}),t}:t.offset=this.config.offset,t},t._getContainer=function(){return!1===this.config.container?document.body:_.isElement(this.config.container)?g(this.config.container):g(document).find(this.config.container)},t._getAttachment=function(t){return Pe[t.toUpperCase()]},t._setListeners=function(){var i=this;this.config.trigger.split(" ").forEach(function(t){if("click"===t)g(i.element).on(i.constructor.Event.CLICK,i.config.selector,function(t){return i.toggle(t)});else if(t!==Qe){var e=t===qe?i.constructor.Event.MOUSEENTER:i.constructor.Event.FOCUSIN,n=t===qe?i.constructor.Event.MOUSELEAVE:i.constructor.Event.FOCUSOUT;g(i.element).on(e,i.config.selector,function(t){return i._enter(t)}).on(n,i.config.selector,function(t){return i._leave(t)})}}),g(this.element).closest(".modal").on("hide.bs.modal",function(){i.element&&i.hide()}),this.config.selector?this.config=l({},this.config,{trigger:"manual",selector:""}):this._fixTitle()},t._fixTitle=function(){var t=typeof this.element.getAttribute("data-original-title");(this.element.getAttribute("title")||"string"!==t)&&(this.element.setAttribute("data-original-title",this.element.getAttribute("title")||""),this.element.setAttribute("title",""))},t._enter=function(t,e){var n=this.constructor.DATA_KEY;(e=e||g(t.currentTarget).data(n))||(e=new this.constructor(t.currentTarget,this._getDelegateConfig()),g(t.currentTarget).data(n,e)),t&&(e._activeTrigger["focusin"===t.type?Me:qe]=!0),g(e.getTipElement()).hasClass(Fe)||e._hoverState===je?e._hoverState=je:(clearTimeout(e._timeout),e._hoverState=je,e.config.delay&&e.config.delay.show?e._timeout=setTimeout(function(){e._hoverState===je&&e.show()},e.config.delay.show):e.show())},t._leave=function(t,e){var n=this.constructor.DATA_KEY;(e=e||g(t.currentTarget).data(n))||(e=new this.constructor(t.currentTarget,this._getDelegateConfig()),g(t.currentTarget).data(n,e)),t&&(e._activeTrigger["focusout"===t.type?Me:qe]=!1),e._isWithActiveTrigger()||(clearTimeout(e._timeout),e._hoverState=He,e.config.delay&&e.config.delay.hide?e._timeout=setTimeout(function(){e._hoverState===He&&e.hide()},e.config.delay.hide):e.hide())},t._isWithActiveTrigger=function(){for(var t in this._activeTrigger)if(this._activeTrigger[t])return!0;return!1},t._getConfig=function(t){var e=g(this.element).data();return Object.keys(e).forEach(function(t){-1!==Oe.indexOf(t)&&delete e[t]}),"number"==typeof(t=l({},this.constructor.Default,e,"object"==typeof t&&t?t:{})).delay&&(t.delay={show:t.delay,hide:t.delay}),"number"==typeof t.title&&(t.title=t.title.toString()),"number"==typeof t.content&&(t.content=t.content.toString()),_.typeCheckConfig(be,t,this.constructor.DefaultType),t.sanitize&&(t.template=Se(t.template,t.whiteList,t.sanitizeFn)),t},t._getDelegateConfig=function(){var t={};if(this.config)for(var e in this.config)this.constructor.Default[e]!==this.config[e]&&(t[e]=this.config[e]);return t},t._cleanTipClass=function(){var t=g(this.getTipElement()),e=t.attr("class").match(Ne);null!==e&&e.length&&t.removeClass(e.join(""))},t._handlePopperPlacementChange=function(t){var e=t.instance;this.tip=e.popper,this._cleanTipClass(),this.addAttachmentClass(this._getAttachment(t.placement))},t._fixTransition=function(){var t=this.getTipElement(),e=this.config.animation;null===t.getAttribute("x-placement")&&(g(t).removeClass(xe),this.config.animation=!1,this.hide(),this.show(),this.config.animation=e)},i._jQueryInterface=function(n){return this.each(function(){var t=g(this).data(Ie),e="object"==typeof n&&n;if((t||!/dispose|hide/.test(n))&&(t||(t=new i(this,e),g(this).data(Ie,t)),"string"==typeof n)){if("undefined"==typeof t[n])throw new TypeError('No method named "'+n+'"');t[n]()}})},s(i,null,[{key:"VERSION",get:function(){return"4.3.1"}},{key:"Default",get:function(){return Le}},{key:"NAME",get:function(){return be}},{key:"DATA_KEY",get:function(){return Ie}},{key:"Event",get:function(){return Re}},{key:"EVENT_KEY",get:function(){return De}},{key:"DefaultType",get:function(){return ke}}]),i}();g.fn[be]=Be._jQueryInterface,g.fn[be].Constructor=Be,g.fn[be].noConflict=function(){return g.fn[be]=we,Be._jQueryInterface};var Ve="popover",Ye="bs.popover",ze="."+Ye,Xe=g.fn[Ve],$e="bs-popover",Ge=new RegExp("(^|\\s)"+$e+"\\S+","g"),Je=l({},Be.Default,{placement:"right",trigger:"click",content:"",template:''}),Ze=l({},Be.DefaultType,{content:"(string|element|function)"}),tn="fade",en="show",nn=".popover-header",on=".popover-body",rn={HIDE:"hide"+ze,HIDDEN:"hidden"+ze,SHOW:"show"+ze,SHOWN:"shown"+ze,INSERTED:"inserted"+ze,CLICK:"click"+ze,FOCUSIN:"focusin"+ze,FOCUSOUT:"focusout"+ze,MOUSEENTER:"mouseenter"+ze,MOUSELEAVE:"mouseleave"+ze},sn=function(t){var e,n;function i(){return t.apply(this,arguments)||this}n=t,(e=i).prototype=Object.create(n.prototype),(e.prototype.constructor=e).__proto__=n;var o=i.prototype;return o.isWithContent=function(){return this.getTitle()||this._getContent()},o.addAttachmentClass=function(t){g(this.getTipElement()).addClass($e+"-"+t)},o.getTipElement=function(){return this.tip=this.tip||g(this.config.template)[0],this.tip},o.setContent=function(){var t=g(this.getTipElement());this.setElementContent(t.find(nn),this.getTitle());var e=this._getContent();"function"==typeof e&&(e=e.call(this.element)),this.setElementContent(t.find(on),e),t.removeClass(tn+" "+en)},o._getContent=function(){return this.element.getAttribute("data-content")||this.config.content},o._cleanTipClass=function(){var t=g(this.getTipElement()),e=t.attr("class").match(Ge);null!==e&&0=this._offsets[o]&&("undefined"==typeof this._offsets[o+1]||t+~]|"+M+")"+M+"*"),U=new RegExp(M+"|>"),X=new RegExp(F),V=new RegExp("^"+I+"$"),G={ID:new RegExp("^#("+I+")"),CLASS:new RegExp("^\\.("+I+")"),TAG:new RegExp("^("+I+"|[*])"),ATTR:new RegExp("^"+W),PSEUDO:new RegExp("^"+F),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+M+"*(even|odd|(([+-]|)(\\d*)n|)"+M+"*(?:([+-]|)"+M+"*(\\d+)|))"+M+"*\\)|)","i"),bool:new RegExp("^(?:"+R+")$","i"),needsContext:new RegExp("^"+M+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+M+"*((?:-\\d)?\\d*)"+M+"*\\)|)(?=[^-]|$)","i")},Y=/HTML$/i,Q=/^(?:input|select|textarea|button)$/i,J=/^h\d$/i,K=/^[^{]+\{\s*\[native \w/,Z=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t||(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10|55296,1023&n|56320))},re=/([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g,ie=function(e,t){return t?"\0"===e?"\ufffd":e.slice(0,-1)+"\\"+e.charCodeAt(e.length-1).toString(16)+" ":"\\"+e},oe=function(){T()},ae=be(function(e){return!0===e.disabled&&"fieldset"===e.nodeName.toLowerCase()},{dir:"parentNode",next:"legend"});try{H.apply(t=O.call(p.childNodes),p.childNodes),t[p.childNodes.length].nodeType}catch(e){H={apply:t.length?function(e,t){L.apply(e,O.call(t))}:function(e,t){var n=e.length,r=0;while(e[n++]=t[r++]);e.length=n-1}}}function se(t,e,n,r){var i,o,a,s,u,l,c,f=e&&e.ownerDocument,p=e?e.nodeType:9;if(n=n||[],"string"!=typeof t||!t||1!==p&&9!==p&&11!==p)return n;if(!r&&(T(e),e=e||C,E)){if(11!==p&&(u=Z.exec(t)))if(i=u[1]){if(9===p){if(!(a=e.getElementById(i)))return n;if(a.id===i)return n.push(a),n}else if(f&&(a=f.getElementById(i))&&y(e,a)&&a.id===i)return n.push(a),n}else{if(u[2])return H.apply(n,e.getElementsByTagName(t)),n;if((i=u[3])&&d.getElementsByClassName&&e.getElementsByClassName)return H.apply(n,e.getElementsByClassName(i)),n}if(d.qsa&&!N[t+" "]&&(!v||!v.test(t))&&(1!==p||"object"!==e.nodeName.toLowerCase())){if(c=t,f=e,1===p&&(U.test(t)||z.test(t))){(f=ee.test(t)&&ye(e.parentNode)||e)===e&&d.scope||((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(e){N(t,!0)}finally{s===S&&e.removeAttribute("id")}}}return g(t.replace($,"$1"),e,n,r)}function ue(){var r=[];return function e(t,n){return r.push(t+" ")>b.cacheLength&&delete e[r.shift()],e[t+" "]=n}}function le(e){return e[S]=!0,e}function ce(e){var t=C.createElement("fieldset");try{return!!e(t)}catch(e){return!1}finally{t.parentNode&&t.parentNode.removeChild(t),t=null}}function fe(e,t){var n=e.split("|"),r=n.length;while(r--)b.attrHandle[n[r]]=t}function pe(e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)while(n=n.nextSibling)if(n===t)return-1;return e?1:-1}function de(t){return function(e){return"input"===e.nodeName.toLowerCase()&&e.type===t}}function he(n){return function(e){var t=e.nodeName.toLowerCase();return("input"===t||"button"===t)&&e.type===n}}function ge(t){return function(e){return"form"in e?e.parentNode&&!1===e.disabled?"label"in e?"label"in e.parentNode?e.parentNode.disabled===t:e.disabled===t:e.isDisabled===t||e.isDisabled!==!t&&ae(e)===t:e.disabled===t:"label"in e&&e.disabled===t}}function ve(a){return le(function(o){return o=+o,le(function(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument||e).documentElement;return!Y.test(t||n&&n.nodeName||"HTML")},T=se.setDocument=function(e){var t,n,r=e?e.ownerDocument||e:p;return r!=C&&9===r.nodeType&&r.documentElement&&(a=(C=r).documentElement,E=!i(C),p!=C&&(n=C.defaultView)&&n.top!==n&&(n.addEventListener?n.addEventListener("unload",oe,!1):n.attachEvent&&n.attachEvent("onunload",oe)),d.scope=ce(function(e){return a.appendChild(e).appendChild(C.createElement("div")),"undefined"!=typeof e.querySelectorAll&&!e.querySelectorAll(":scope fieldset div").length}),d.attributes=ce(function(e){return e.className="i",!e.getAttribute("className")}),d.getElementsByTagName=ce(function(e){return e.appendChild(C.createComment("")),!e.getElementsByTagName("*").length}),d.getElementsByClassName=K.test(C.getElementsByClassName),d.getById=ce(function(e){return a.appendChild(e).id=S,!C.getElementsByName||!C.getElementsByName(S).length}),d.getById?(b.filter.ID=function(e){var t=e.replace(te,ne);return function(e){return e.getAttribute("id")===t}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n=t.getElementById(e);return n?[n]:[]}}):(b.filter.ID=function(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((n=o.getAttributeNode("id"))&&n.value===e)return[o];i=t.getElementsByName(e),r=0;while(o=i[r++])if((n=o.getAttributeNode("id"))&&n.value===e)return[o]}return[]}}),b.find.TAG=d.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):d.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r=[],i=0,o=t.getElementsByTagName(e);if("*"===e){while(n=o[i++])1===n.nodeType&&r.push(n);return r}return o},b.find.CLASS=d.getElementsByClassName&&function(e,t){if("undefined"!=typeof t.getElementsByClassName&&E)return t.getElementsByClassName(e)},s=[],v=[],(d.qsa=K.test(C.querySelectorAll))&&(ce(function(e){var t;a.appendChild(e).innerHTML="",e.querySelectorAll("[msallowcapture^='']").length&&v.push("[*^$]="+M+"*(?:''|\"\")"),e.querySelectorAll("[selected]").length||v.push("\\["+M+"*(?:value|"+R+")"),e.querySelectorAll("[id~="+S+"-]").length||v.push("~="),(t=C.createElement("input")).setAttribute("name",""),e.appendChild(t),e.querySelectorAll("[name='']").length||v.push("\\["+M+"*name"+M+"*="+M+"*(?:''|\"\")"),e.querySelectorAll(":checked").length||v.push(":checked"),e.querySelectorAll("a#"+S+"+*").length||v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="";var t=C.createElement("input");t.setAttribute("type","hidden"),e.appendChild(t).setAttribute("name","D"),e.querySelectorAll("[name=d]").length&&v.push("name"+M+"*[*^$|!~]?="),2!==e.querySelectorAll(":enabled").length&&v.push(":enabled",":disabled"),a.appendChild(e).disabled=!0,2!==e.querySelectorAll(":disabled").length&&v.push(":enabled",":disabled"),e.querySelectorAll("*,:x"),v.push(",.*:")})),(d.matchesSelector=K.test(c=a.matches||a.webkitMatchesSelector||a.mozMatchesSelector||a.oMatchesSelector||a.msMatchesSelector))&&ce(function(e){d.disconnectedMatch=c.call(e,"*"),c.call(e,"[s!='']:x"),s.push("!=",F)}),v=v.length&&new RegExp(v.join("|")),s=s.length&&new RegExp(s.join("|")),t=K.test(a.compareDocumentPosition),y=t||K.test(a.contains)?function(e,t){var n=9===e.nodeType?e.documentElement:e,r=t&&t.parentNode;return e===r||!(!r||1!==r.nodeType||!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},j=t?function(e,t){if(e===t)return l=!0,0;var n=!e.compareDocumentPosition-!t.compareDocumentPosition;return n||(1&(n=(e.ownerDocument||e)==(t.ownerDocument||t)?e.compareDocumentPosition(t):1)||!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C||e.ownerDocument==p&&y(p,e)?-1:t==C||t.ownerDocument==p&&y(p,t)?1:u?P(u,e)-P(u,t):0:4&n?-1:1)}:function(e,t){if(e===t)return l=!0,0;var n,r=0,i=e.parentNode,o=t.parentNode,a=[e],s=[t];if(!i||!o)return e==C?-1:t==C?1:i?-1:o?1:u?P(u,e)-P(u,t):0;if(i===o)return pe(e,t);n=e;while(n=n.parentNode)a.unshift(n);n=t;while(n=n.parentNode)s.unshift(n);while(a[r]===s[r])r++;return r?pe(a[r],s[r]):a[r]==p?-1:s[r]==p?1:0}),C},se.matches=function(e,t){return se(e,null,null,t)},se.matchesSelector=function(e,t){if(T(e),d.matchesSelector&&E&&!N[t+" "]&&(!s||!s.test(t))&&(!v||!v.test(t)))try{var n=c.call(e,t);if(n||d.disconnectedMatch||e.document&&11!==e.document.nodeType)return n}catch(e){N(t,!0)}return 0":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(e){return e[1]=e[1].replace(te,ne),e[3]=(e[3]||e[4]||e[5]||"").replace(te,ne),"~="===e[2]&&(e[3]=" "+e[3]+" "),e.slice(0,4)},CHILD:function(e){return e[1]=e[1].toLowerCase(),"nth"===e[1].slice(0,3)?(e[3]||se.error(e[0]),e[4]=+(e[4]?e[5]+(e[6]||1):2*("even"===e[3]||"odd"===e[3])),e[5]=+(e[7]+e[8]||"odd"===e[3])):e[3]&&se.error(e[0]),e},PSEUDO:function(e){var t,n=!e[6]&&e[2];return G.CHILD.test(e[0])?null:(e[3]?e[2]=e[4]||e[5]||"":n&&X.test(n)&&(t=h(n,!0))&&(t=n.indexOf(")",n.length-t)-n.length)&&(e[0]=e[0].slice(0,t),e[2]=n.slice(0,t)),e.slice(0,3))}},filter:{TAG:function(e){var t=e.replace(te,ne).toLowerCase();return"*"===e?function(){return!0}:function(e){return e.nodeName&&e.nodeName.toLowerCase()===t}},CLASS:function(e){var t=m[e+" "];return t||(t=new RegExp("(^|"+M+")"+e+"("+M+"|$)"))&&m(e,function(e){return t.test("string"==typeof e.className&&e.className||"undefined"!=typeof e.getAttribute&&e.getAttribute("class")||"")})},ATTR:function(n,r,i){return function(e){var t=se.attr(e,n);return null==t?"!="===r:!r||(t+="","="===r?t===i:"!="===r?t!==i:"^="===r?i&&0===t.indexOf(i):"*="===r?i&&-1:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i;function j(e,n,r){return m(n)?S.grep(e,function(e,t){return!!n.call(e,t,e)!==r}):n.nodeType?S.grep(e,function(e){return e===n!==r}):"string"!=typeof n?S.grep(e,function(e){return-1)[^>]*|#([\w-]+))$/;(S.fn.init=function(e,t,n){var r,i;if(!e)return this;if(n=n||D,"string"==typeof e){if(!(r="<"===e[0]&&">"===e[e.length-1]&&3<=e.length?[null,e,null]:q.exec(e))||!r[1]&&t)return!t||t.jquery?(t||n).find(e):this.constructor(t).find(e);if(r[1]){if(t=t instanceof S?t[0]:t,S.merge(this,S.parseHTML(r[1],t&&t.nodeType?t.ownerDocument||t:E,!0)),N.test(r[1])&&S.isPlainObject(t))for(r in t)m(this[r])?this[r](t[r]):this.attr(r,t[r]);return this}return(i=E.getElementById(r[2]))&&(this[0]=i,this.length=1),this}return e.nodeType?(this[0]=e,this.length=1,this):m(e)?void 0!==n.ready?n.ready(e):e(S):S.makeArray(e,this)}).prototype=S.fn,D=S(E);var L=/^(?:parents|prev(?:Until|All))/,H={children:!0,contents:!0,next:!0,prev:!0};function O(e,t){while((e=e[t])&&1!==e.nodeType);return e}S.fn.extend({has:function(e){var t=S(e,this),n=t.length;return this.filter(function(){for(var e=0;e\x20\t\r\n\f]*)/i,he=/^$|^module$|\/(?:java|ecma)script/i;ce=E.createDocumentFragment().appendChild(E.createElement("div")),(fe=E.createElement("input")).setAttribute("type","radio"),fe.setAttribute("checked","checked"),fe.setAttribute("name","t"),ce.appendChild(fe),y.checkClone=ce.cloneNode(!0).cloneNode(!0).lastChild.checked,ce.innerHTML="",y.noCloneChecked=!!ce.cloneNode(!0).lastChild.defaultValue,ce.innerHTML="",y.option=!!ce.lastChild;var ge={thead:[1,"","
"],col:[2,"","
"],tr:[2,"","
"],td:[3,"","
"],_default:[0,"",""]};function ve(e,t){var n;return n="undefined"!=typeof e.getElementsByTagName?e.getElementsByTagName(t||"*"):"undefined"!=typeof e.querySelectorAll?e.querySelectorAll(t||"*"):[],void 0===t||t&&A(e,t)?S.merge([e],n):n}function ye(e,t){for(var n=0,r=e.length;n",""]);var me=/<|&#?\w+;/;function xe(e,t,n,r,i){for(var o,a,s,u,l,c,f=t.createDocumentFragment(),p=[],d=0,h=e.length;d\s*$/g;function je(e,t){return A(e,"table")&&A(11!==t.nodeType?t:t.firstChild,"tr")&&S(e).children("tbody")[0]||e}function De(e){return e.type=(null!==e.getAttribute("type"))+"/"+e.type,e}function qe(e){return"true/"===(e.type||"").slice(0,5)?e.type=e.type.slice(5):e.removeAttribute("type"),e}function Le(e,t){var n,r,i,o,a,s;if(1===t.nodeType){if(Y.hasData(e)&&(s=Y.get(e).events))for(i in Y.remove(t,"handle events"),s)for(n=0,r=s[i].length;n").attr(n.scriptAttrs||{}).prop({charset:n.scriptCharset,src:n.url}).on("load error",i=function(e){r.remove(),i=null,e&&t("error"===e.type?404:200,e.type)}),E.head.appendChild(r[0])},abort:function(){i&&i()}}});var _t,zt=[],Ut=/(=)\?(?=&|$)|\?\?/;S.ajaxSetup({jsonp:"callback",jsonpCallback:function(){var e=zt.pop()||S.expando+"_"+wt.guid++;return this[e]=!0,e}}),S.ajaxPrefilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Ut.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType||"").indexOf("application/x-www-form-urlencoded")&&Ut.test(e.data)&&"data");if(a||"jsonp"===e.dataTypes[0])return r=e.jsonpCallback=m(e.jsonpCallback)?e.jsonpCallback():e.jsonpCallback,a?e[a]=e[a].replace(Ut,"$1"+r):!1!==e.jsonp&&(e.url+=(Tt.test(e.url)?"&":"?")+e.jsonp+"="+r),e.converters["script json"]=function(){return o||S.error(r+" was not called"),o[0]},e.dataTypes[0]="json",i=C[r],C[r]=function(){o=arguments},n.always(function(){void 0===i?S(C).removeProp(r):C[r]=i,e[r]&&(e.jsonpCallback=t.jsonpCallback,zt.push(r)),o&&m(i)&&i(o[0]),o=i=void 0}),"script"}),y.createHTMLDocument=((_t=E.implementation.createHTMLDocument("").body).innerHTML="
",2===_t.childNodes.length),S.parseHTML=function(e,t,n){return"string"!=typeof e?[]:("boolean"==typeof t&&(n=t,t=!1),t||(y.createHTMLDocument?((r=(t=E.implementation.createHTMLDocument("")).createElement("base")).href=E.location.href,t.head.appendChild(r)):t=E),o=!n&&[],(i=N.exec(e))?[t.createElement(i[1])]:(i=xe([e],t,o),o&&o.length&&S(o).remove(),S.merge([],i.childNodes)));var r,i,o},S.fn.load=function(e,t,n){var r,i,o,a=this,s=e.indexOf(" ");return-1").append(S.parseHTML(e)).find(r):e)}).always(n&&function(e,t){a.each(function(){n.apply(this,o||[e.responseText,t,e])})}),this},S.expr.pseudos.animated=function(t){return S.grep(S.timers,function(e){return t===e.elem}).length},S.offset={setOffset:function(e,t,n){var r,i,o,a,s,u,l=S.css(e,"position"),c=S(e),f={};"static"===l&&(e.style.position="relative"),s=c.offset(),o=S.css(e,"top"),u=S.css(e,"left"),("absolute"===l||"fixed"===l)&&-1<(o+u).indexOf("auto")?(a=(r=c.position()).top,i=r.left):(a=parseFloat(o)||0,i=parseFloat(u)||0),m(t)&&(t=t.call(e,n,S.extend({},s))),null!=t.top&&(f.top=t.top-s.top+a),null!=t.left&&(f.left=t.left-s.left+i),"using"in t?t.using.call(e,f):c.css(f)}},S.fn.extend({offset:function(t){if(arguments.length)return void 0===t?this:this.each(function(e){S.offset.setOffset(this,t,e)});var e,n,r=this[0];return r?r.getClientRects().length?(e=r.getBoundingClientRect(),n=r.ownerDocument.defaultView,{top:e.top+n.pageYOffset,left:e.left+n.pageXOffset}):{top:0,left:0}:void 0},position:function(){if(this[0]){var e,t,n,r=this[0],i={top:0,left:0};if("fixed"===S.css(r,"position"))t=r.getBoundingClientRect();else{t=this.offset(),n=r.ownerDocument,e=r.offsetParent||n.documentElement;while(e&&(e===n.body||e===n.documentElement)&&"static"===S.css(e,"position"))e=e.parentNode;e&&e!==r&&1===e.nodeType&&((i=S(e).offset()).top+=S.css(e,"borderTopWidth",!0),i.left+=S.css(e,"borderLeftWidth",!0))}return{top:t.top-i.top-S.css(r,"marginTop",!0),left:t.left-i.left-S.css(r,"marginLeft",!0)}}},offsetParent:function(){return this.map(function(){var e=this.offsetParent;while(e&&"static"===S.css(e,"position"))e=e.offsetParent;return e||re})}}),S.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(t,i){var o="pageYOffset"===i;S.fn[t]=function(e){return $(this,function(e,t,n){var r;if(x(e)?r=e:9===e.nodeType&&(r=e.defaultView),void 0===n)return r?r[i]:e[t];r?r.scrollTo(o?r.pageXOffset:n,o?n:r.pageYOffset):e[t]=n},t,e,arguments.length)}}),S.each(["top","left"],function(e,n){S.cssHooks[n]=Fe(y.pixelPosition,function(e,t){if(t)return t=We(e,n),Pe.test(t)?S(e).position()[n]+"px":t})}),S.each({Height:"height",Width:"width"},function(a,s){S.each({padding:"inner"+a,content:s,"":"outer"+a},function(r,o){S.fn[o]=function(e,t){var n=arguments.length&&(r||"boolean"!=typeof e),i=r||(!0===e||!0===t?"margin":"border");return $(this,function(e,t,n){var r;return x(e)?0===o.indexOf("outer")?e["inner"+a]:e.document.documentElement["client"+a]:9===e.nodeType?(r=e.documentElement,Math.max(e.body["scroll"+a],r["scroll"+a],e.body["offset"+a],r["offset"+a],r["client"+a])):void 0===n?S.css(e,t,i):S.style(e,t,n,i)},s,n?e:void 0,n)}})}),S.each(["ajaxStart","ajaxStop","ajaxComplete","ajaxError","ajaxSuccess","ajaxSend"],function(e,t){S.fn[t]=function(e){return this.on(t,e)}}),S.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===arguments.length?this.off(e,"**"):this.off(t,e||"**",n)},hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}}),S.each("blur focus focusin focusout resize scroll click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup contextmenu".split(" "),function(e,n){S.fn[n]=function(e,t){return 0 0) { + var tokenMetadata = lunr.utils.clone(metadata) || {} + tokenMetadata["position"] = [sliceStart, sliceLength] + tokenMetadata["index"] = tokens.length + + tokens.push( + new lunr.Token ( + str.slice(sliceStart, sliceEnd), + tokenMetadata + ) + ) + } + + sliceStart = sliceEnd + 1 + } + + } + + return tokens +} + +/** + * The separator used to split a string into tokens. Override this property to change the behaviour of + * `lunr.tokenizer` behaviour when tokenizing strings. By default this splits on whitespace and hyphens. + * + * @static + * @see lunr.tokenizer + */ +lunr.tokenizer.separator = /[\s\-]+/ +/*! + * lunr.Pipeline + * Copyright (C) 2020 Oliver Nightingale + */ + +/** + * lunr.Pipelines maintain an ordered list of functions to be applied to all + * tokens in documents entering the search index and queries being ran against + * the index. + * + * An instance of lunr.Index created with the lunr shortcut will contain a + * pipeline with a stop word filter and an English language stemmer. Extra + * functions can be added before or after either of these functions or these + * default functions can be removed. + * + * When run the pipeline will call each function in turn, passing a token, the + * index of that token in the original list of all tokens and finally a list of + * all the original tokens. + * + * The output of functions in the pipeline will be passed to the next function + * in the pipeline. To exclude a token from entering the index the function + * should return undefined, the rest of the pipeline will not be called with + * this token. + * + * For serialisation of pipelines to work, all functions used in an instance of + * a pipeline should be registered with lunr.Pipeline. Registered functions can + * then be loaded. If trying to load a serialised pipeline that uses functions + * that are not registered an error will be thrown. + * + * If not planning on serialising the pipeline then registering pipeline functions + * is not necessary. + * + * @constructor + */ +lunr.Pipeline = function () { + this._stack = [] +} + +lunr.Pipeline.registeredFunctions = Object.create(null) + +/** + * A pipeline function maps lunr.Token to lunr.Token. A lunr.Token contains the token + * string as well as all known metadata. A pipeline function can mutate the token string + * or mutate (or add) metadata for a given token. + * + * A pipeline function can indicate that the passed token should be discarded by returning + * null, undefined or an empty string. This token will not be passed to any downstream pipeline + * functions and will not be added to the index. + * + * Multiple tokens can be returned by returning an array of tokens. Each token will be passed + * to any downstream pipeline functions and all will returned tokens will be added to the index. + * + * Any number of pipeline functions may be chained together using a lunr.Pipeline. + * + * @interface lunr.PipelineFunction + * @param {lunr.Token} token - A token from the document being processed. + * @param {number} i - The index of this token in the complete list of tokens for this document/field. + * @param {lunr.Token[]} tokens - All tokens for this document/field. + * @returns {(?lunr.Token|lunr.Token[])} + */ + +/** + * Register a function with the pipeline. + * + * Functions that are used in the pipeline should be registered if the pipeline + * needs to be serialised, or a serialised pipeline needs to be loaded. + * + * Registering a function does not add it to a pipeline, functions must still be + * added to instances of the pipeline for them to be used when running a pipeline. + * + * @param {lunr.PipelineFunction} fn - The function to check for. + * @param {String} label - The label to register this function with + */ +lunr.Pipeline.registerFunction = function (fn, label) { + if (label in this.registeredFunctions) { + lunr.utils.warn('Overwriting existing registered function: ' + label) + } + + fn.label = label + lunr.Pipeline.registeredFunctions[fn.label] = fn +} + +/** + * Warns if the function is not registered as a Pipeline function. + * + * @param {lunr.PipelineFunction} fn - The function to check for. + * @private + */ +lunr.Pipeline.warnIfFunctionNotRegistered = function (fn) { + var isRegistered = fn.label && (fn.label in this.registeredFunctions) + + if (!isRegistered) { + lunr.utils.warn('Function is not registered with pipeline. This may cause problems when serialising the index.\n', fn) + } +} + +/** + * Loads a previously serialised pipeline. + * + * All functions to be loaded must already be registered with lunr.Pipeline. + * If any function from the serialised data has not been registered then an + * error will be thrown. + * + * @param {Object} serialised - The serialised pipeline to load. + * @returns {lunr.Pipeline} + */ +lunr.Pipeline.load = function (serialised) { + var pipeline = new lunr.Pipeline + + serialised.forEach(function (fnName) { + var fn = lunr.Pipeline.registeredFunctions[fnName] + + if (fn) { + pipeline.add(fn) + } else { + throw new Error('Cannot load unregistered function: ' + fnName) + } + }) + + return pipeline +} + +/** + * Adds new functions to the end of the pipeline. + * + * Logs a warning if the function has not been registered. + * + * @param {lunr.PipelineFunction[]} functions - Any number of functions to add to the pipeline. + */ +lunr.Pipeline.prototype.add = function () { + var fns = Array.prototype.slice.call(arguments) + + fns.forEach(function (fn) { + lunr.Pipeline.warnIfFunctionNotRegistered(fn) + this._stack.push(fn) + }, this) +} + +/** + * Adds a single function after a function that already exists in the + * pipeline. + * + * Logs a warning if the function has not been registered. + * + * @param {lunr.PipelineFunction} existingFn - A function that already exists in the pipeline. + * @param {lunr.PipelineFunction} newFn - The new function to add to the pipeline. + */ +lunr.Pipeline.prototype.after = function (existingFn, newFn) { + lunr.Pipeline.warnIfFunctionNotRegistered(newFn) + + var pos = this._stack.indexOf(existingFn) + if (pos == -1) { + throw new Error('Cannot find existingFn') + } + + pos = pos + 1 + this._stack.splice(pos, 0, newFn) +} + +/** + * Adds a single function before a function that already exists in the + * pipeline. + * + * Logs a warning if the function has not been registered. + * + * @param {lunr.PipelineFunction} existingFn - A function that already exists in the pipeline. + * @param {lunr.PipelineFunction} newFn - The new function to add to the pipeline. + */ +lunr.Pipeline.prototype.before = function (existingFn, newFn) { + lunr.Pipeline.warnIfFunctionNotRegistered(newFn) + + var pos = this._stack.indexOf(existingFn) + if (pos == -1) { + throw new Error('Cannot find existingFn') + } + + this._stack.splice(pos, 0, newFn) +} + +/** + * Removes a function from the pipeline. + * + * @param {lunr.PipelineFunction} fn The function to remove from the pipeline. + */ +lunr.Pipeline.prototype.remove = function (fn) { + var pos = this._stack.indexOf(fn) + if (pos == -1) { + return + } + + this._stack.splice(pos, 1) +} + +/** + * Runs the current list of functions that make up the pipeline against the + * passed tokens. + * + * @param {Array} tokens The tokens to run through the pipeline. + * @returns {Array} + */ +lunr.Pipeline.prototype.run = function (tokens) { + var stackLength = this._stack.length + + for (var i = 0; i < stackLength; i++) { + var fn = this._stack[i] + var memo = [] + + for (var j = 0; j < tokens.length; j++) { + var result = fn(tokens[j], j, tokens) + + if (result === null || result === void 0 || result === '') continue + + if (Array.isArray(result)) { + for (var k = 0; k < result.length; k++) { + memo.push(result[k]) + } + } else { + memo.push(result) + } + } + + tokens = memo + } + + return tokens +} + +/** + * Convenience method for passing a string through a pipeline and getting + * strings out. This method takes care of wrapping the passed string in a + * token and mapping the resulting tokens back to strings. + * + * @param {string} str - The string to pass through the pipeline. + * @param {?object} metadata - Optional metadata to associate with the token + * passed to the pipeline. + * @returns {string[]} + */ +lunr.Pipeline.prototype.runString = function (str, metadata) { + var token = new lunr.Token (str, metadata) + + return this.run([token]).map(function (t) { + return t.toString() + }) +} + +/** + * Resets the pipeline by removing any existing processors. + * + */ +lunr.Pipeline.prototype.reset = function () { + this._stack = [] +} + +/** + * Returns a representation of the pipeline ready for serialisation. + * + * Logs a warning if the function has not been registered. + * + * @returns {Array} + */ +lunr.Pipeline.prototype.toJSON = function () { + return this._stack.map(function (fn) { + lunr.Pipeline.warnIfFunctionNotRegistered(fn) + + return fn.label + }) +} +/*! + * lunr.Vector + * Copyright (C) 2020 Oliver Nightingale + */ + +/** + * A vector is used to construct the vector space of documents and queries. These + * vectors support operations to determine the similarity between two documents or + * a document and a query. + * + * Normally no parameters are required for initializing a vector, but in the case of + * loading a previously dumped vector the raw elements can be provided to the constructor. + * + * For performance reasons vectors are implemented with a flat array, where an elements + * index is immediately followed by its value. E.g. [index, value, index, value]. This + * allows the underlying array to be as sparse as possible and still offer decent + * performance when being used for vector calculations. + * + * @constructor + * @param {Number[]} [elements] - The flat list of element index and element value pairs. + */ +lunr.Vector = function (elements) { + this._magnitude = 0 + this.elements = elements || [] +} + + +/** + * Calculates the position within the vector to insert a given index. + * + * This is used internally by insert and upsert. If there are duplicate indexes then + * the position is returned as if the value for that index were to be updated, but it + * is the callers responsibility to check whether there is a duplicate at that index + * + * @param {Number} insertIdx - The index at which the element should be inserted. + * @returns {Number} + */ +lunr.Vector.prototype.positionForIndex = function (index) { + // For an empty vector the tuple can be inserted at the beginning + if (this.elements.length == 0) { + return 0 + } + + var start = 0, + end = this.elements.length / 2, + sliceLength = end - start, + pivotPoint = Math.floor(sliceLength / 2), + pivotIndex = this.elements[pivotPoint * 2] + + while (sliceLength > 1) { + if (pivotIndex < index) { + start = pivotPoint + } + + if (pivotIndex > index) { + end = pivotPoint + } + + if (pivotIndex == index) { + break + } + + sliceLength = end - start + pivotPoint = start + Math.floor(sliceLength / 2) + pivotIndex = this.elements[pivotPoint * 2] + } + + if (pivotIndex == index) { + return pivotPoint * 2 + } + + if (pivotIndex > index) { + return pivotPoint * 2 + } + + if (pivotIndex < index) { + return (pivotPoint + 1) * 2 + } +} + +/** + * Inserts an element at an index within the vector. + * + * Does not allow duplicates, will throw an error if there is already an entry + * for this index. + * + * @param {Number} insertIdx - The index at which the element should be inserted. + * @param {Number} val - The value to be inserted into the vector. + */ +lunr.Vector.prototype.insert = function (insertIdx, val) { + this.upsert(insertIdx, val, function () { + throw "duplicate index" + }) +} + +/** + * Inserts or updates an existing index within the vector. + * + * @param {Number} insertIdx - The index at which the element should be inserted. + * @param {Number} val - The value to be inserted into the vector. + * @param {function} fn - A function that is called for updates, the existing value and the + * requested value are passed as arguments + */ +lunr.Vector.prototype.upsert = function (insertIdx, val, fn) { + this._magnitude = 0 + var position = this.positionForIndex(insertIdx) + + if (this.elements[position] == insertIdx) { + this.elements[position + 1] = fn(this.elements[position + 1], val) + } else { + this.elements.splice(position, 0, insertIdx, val) + } +} + +/** + * Calculates the magnitude of this vector. + * + * @returns {Number} + */ +lunr.Vector.prototype.magnitude = function () { + if (this._magnitude) return this._magnitude + + var sumOfSquares = 0, + elementsLength = this.elements.length + + for (var i = 1; i < elementsLength; i += 2) { + var val = this.elements[i] + sumOfSquares += val * val + } + + return this._magnitude = Math.sqrt(sumOfSquares) +} + +/** + * Calculates the dot product of this vector and another vector. + * + * @param {lunr.Vector} otherVector - The vector to compute the dot product with. + * @returns {Number} + */ +lunr.Vector.prototype.dot = function (otherVector) { + var dotProduct = 0, + a = this.elements, b = otherVector.elements, + aLen = a.length, bLen = b.length, + aVal = 0, bVal = 0, + i = 0, j = 0 + + while (i < aLen && j < bLen) { + aVal = a[i], bVal = b[j] + if (aVal < bVal) { + i += 2 + } else if (aVal > bVal) { + j += 2 + } else if (aVal == bVal) { + dotProduct += a[i + 1] * b[j + 1] + i += 2 + j += 2 + } + } + + return dotProduct +} + +/** + * Calculates the similarity between this vector and another vector. + * + * @param {lunr.Vector} otherVector - The other vector to calculate the + * similarity with. + * @returns {Number} + */ +lunr.Vector.prototype.similarity = function (otherVector) { + return this.dot(otherVector) / this.magnitude() || 0 +} + +/** + * Converts the vector to an array of the elements within the vector. + * + * @returns {Number[]} + */ +lunr.Vector.prototype.toArray = function () { + var output = new Array (this.elements.length / 2) + + for (var i = 1, j = 0; i < this.elements.length; i += 2, j++) { + output[j] = this.elements[i] + } + + return output +} + +/** + * A JSON serializable representation of the vector. + * + * @returns {Number[]} + */ +lunr.Vector.prototype.toJSON = function () { + return this.elements +} +/* eslint-disable */ +/*! + * lunr.stemmer + * Copyright (C) 2020 Oliver Nightingale + * Includes code from - http://tartarus.org/~martin/PorterStemmer/js.txt + */ + +/** + * lunr.stemmer is an english language stemmer, this is a JavaScript + * implementation of the PorterStemmer taken from http://tartarus.org/~martin + * + * @static + * @implements {lunr.PipelineFunction} + * @param {lunr.Token} token - The string to stem + * @returns {lunr.Token} + * @see {@link lunr.Pipeline} + * @function + */ +lunr.stemmer = (function(){ + var step2list = { + "ational" : "ate", + "tional" : "tion", + "enci" : "ence", + "anci" : "ance", + "izer" : "ize", + "bli" : "ble", + "alli" : "al", + "entli" : "ent", + "eli" : "e", + "ousli" : "ous", + "ization" : "ize", + "ation" : "ate", + "ator" : "ate", + "alism" : "al", + "iveness" : "ive", + "fulness" : "ful", + "ousness" : "ous", + "aliti" : "al", + "iviti" : "ive", + "biliti" : "ble", + "logi" : "log" + }, + + step3list = { + "icate" : "ic", + "ative" : "", + "alize" : "al", + "iciti" : "ic", + "ical" : "ic", + "ful" : "", + "ness" : "" + }, + + c = "[^aeiou]", // consonant + v = "[aeiouy]", // vowel + C = c + "[^aeiouy]*", // consonant sequence + V = v + "[aeiou]*", // vowel sequence + + mgr0 = "^(" + C + ")?" + V + C, // [C]VC... is m>0 + meq1 = "^(" + C + ")?" + V + C + "(" + V + ")?$", // [C]VC[V] is m=1 + mgr1 = "^(" + C + ")?" + V + C + V + C, // [C]VCVC... is m>1 + s_v = "^(" + C + ")?" + v; // vowel in stem + + var re_mgr0 = new RegExp(mgr0); + var re_mgr1 = new RegExp(mgr1); + var re_meq1 = new RegExp(meq1); + var re_s_v = new RegExp(s_v); + + var re_1a = /^(.+?)(ss|i)es$/; + var re2_1a = /^(.+?)([^s])s$/; + var re_1b = /^(.+?)eed$/; + var re2_1b = /^(.+?)(ed|ing)$/; + var re_1b_2 = /.$/; + var re2_1b_2 = /(at|bl|iz)$/; + var re3_1b_2 = new RegExp("([^aeiouylsz])\\1$"); + var re4_1b_2 = new RegExp("^" + C + v + "[^aeiouwxy]$"); + + var re_1c = /^(.+?[^aeiou])y$/; + var re_2 = /^(.+?)(ational|tional|enci|anci|izer|bli|alli|entli|eli|ousli|ization|ation|ator|alism|iveness|fulness|ousness|aliti|iviti|biliti|logi)$/; + + var re_3 = /^(.+?)(icate|ative|alize|iciti|ical|ful|ness)$/; + + var re_4 = /^(.+?)(al|ance|ence|er|ic|able|ible|ant|ement|ment|ent|ou|ism|ate|iti|ous|ive|ize)$/; + var re2_4 = /^(.+?)(s|t)(ion)$/; + + var re_5 = /^(.+?)e$/; + var re_5_1 = /ll$/; + var re3_5 = new RegExp("^" + C + v + "[^aeiouwxy]$"); + + var porterStemmer = function porterStemmer(w) { + var stem, + suffix, + firstch, + re, + re2, + re3, + re4; + + if (w.length < 3) { return w; } + + firstch = w.substr(0,1); + if (firstch == "y") { + w = firstch.toUpperCase() + w.substr(1); + } + + // Step 1a + re = re_1a + re2 = re2_1a; + + if (re.test(w)) { w = w.replace(re,"$1$2"); } + else if (re2.test(w)) { w = w.replace(re2,"$1$2"); } + + // Step 1b + re = re_1b; + re2 = re2_1b; + if (re.test(w)) { + var fp = re.exec(w); + re = re_mgr0; + if (re.test(fp[1])) { + re = re_1b_2; + w = w.replace(re,""); + } + } else if (re2.test(w)) { + var fp = re2.exec(w); + stem = fp[1]; + re2 = re_s_v; + if (re2.test(stem)) { + w = stem; + re2 = re2_1b_2; + re3 = re3_1b_2; + re4 = re4_1b_2; + if (re2.test(w)) { w = w + "e"; } + else if (re3.test(w)) { re = re_1b_2; w = w.replace(re,""); } + else if (re4.test(w)) { w = w + "e"; } + } + } + + // Step 1c - replace suffix y or Y by i if preceded by a non-vowel which is not the first letter of the word (so cry -> cri, by -> by, say -> say) + re = re_1c; + if (re.test(w)) { + var fp = re.exec(w); + stem = fp[1]; + w = stem + "i"; + } + + // Step 2 + re = re_2; + if (re.test(w)) { + var fp = re.exec(w); + stem = fp[1]; + suffix = fp[2]; + re = re_mgr0; + if (re.test(stem)) { + w = stem + step2list[suffix]; + } + } + + // Step 3 + re = re_3; + if (re.test(w)) { + var fp = re.exec(w); + stem = fp[1]; + suffix = fp[2]; + re = re_mgr0; + if (re.test(stem)) { + w = stem + step3list[suffix]; + } + } + + // Step 4 + re = re_4; + re2 = re2_4; + if (re.test(w)) { + var fp = re.exec(w); + stem = fp[1]; + re = re_mgr1; + if (re.test(stem)) { + w = stem; + } + } else if (re2.test(w)) { + var fp = re2.exec(w); + stem = fp[1] + fp[2]; + re2 = re_mgr1; + if (re2.test(stem)) { + w = stem; + } + } + + // Step 5 + re = re_5; + if (re.test(w)) { + var fp = re.exec(w); + stem = fp[1]; + re = re_mgr1; + re2 = re_meq1; + re3 = re3_5; + if (re.test(stem) || (re2.test(stem) && !(re3.test(stem)))) { + w = stem; + } + } + + re = re_5_1; + re2 = re_mgr1; + if (re.test(w) && re2.test(w)) { + re = re_1b_2; + w = w.replace(re,""); + } + + // and turn initial Y back to y + + if (firstch == "y") { + w = firstch.toLowerCase() + w.substr(1); + } + + return w; + }; + + return function (token) { + return token.update(porterStemmer); + } +})(); + +lunr.Pipeline.registerFunction(lunr.stemmer, 'stemmer') +/*! + * lunr.stopWordFilter + * Copyright (C) 2020 Oliver Nightingale + */ + +/** + * lunr.generateStopWordFilter builds a stopWordFilter function from the provided + * list of stop words. + * + * The built in lunr.stopWordFilter is built using this generator and can be used + * to generate custom stopWordFilters for applications or non English languages. + * + * @function + * @param {Array} token The token to pass through the filter + * @returns {lunr.PipelineFunction} + * @see lunr.Pipeline + * @see lunr.stopWordFilter + */ +lunr.generateStopWordFilter = function (stopWords) { + var words = stopWords.reduce(function (memo, stopWord) { + memo[stopWord] = stopWord + return memo + }, {}) + + return function (token) { + if (token && words[token.toString()] !== token.toString()) return token + } +} + +/** + * lunr.stopWordFilter is an English language stop word list filter, any words + * contained in the list will not be passed through the filter. + * + * This is intended to be used in the Pipeline. If the token does not pass the + * filter then undefined will be returned. + * + * @function + * @implements {lunr.PipelineFunction} + * @params {lunr.Token} token - A token to check for being a stop word. + * @returns {lunr.Token} + * @see {@link lunr.Pipeline} + */ +lunr.stopWordFilter = lunr.generateStopWordFilter([ + 'a', + 'able', + 'about', + 'across', + 'after', + 'all', + 'almost', + 'also', + 'am', + 'among', + 'an', + 'and', + 'any', + 'are', + 'as', + 'at', + 'be', + 'because', + 'been', + 'but', + 'by', + 'can', + 'cannot', + 'could', + 'dear', + 'did', + 'do', + 'does', + 'either', + 'else', + 'ever', + 'every', + 'for', + 'from', + 'get', + 'got', + 'had', + 'has', + 'have', + 'he', + 'her', + 'hers', + 'him', + 'his', + 'how', + 'however', + 'i', + 'if', + 'in', + 'into', + 'is', + 'it', + 'its', + 'just', + 'least', + 'let', + 'like', + 'likely', + 'may', + 'me', + 'might', + 'most', + 'must', + 'my', + 'neither', + 'no', + 'nor', + 'not', + 'of', + 'off', + 'often', + 'on', + 'only', + 'or', + 'other', + 'our', + 'own', + 'rather', + 'said', + 'say', + 'says', + 'she', + 'should', + 'since', + 'so', + 'some', + 'than', + 'that', + 'the', + 'their', + 'them', + 'then', + 'there', + 'these', + 'they', + 'this', + 'tis', + 'to', + 'too', + 'twas', + 'us', + 'wants', + 'was', + 'we', + 'were', + 'what', + 'when', + 'where', + 'which', + 'while', + 'who', + 'whom', + 'why', + 'will', + 'with', + 'would', + 'yet', + 'you', + 'your' +]) + +lunr.Pipeline.registerFunction(lunr.stopWordFilter, 'stopWordFilter') +/*! + * lunr.trimmer + * Copyright (C) 2020 Oliver Nightingale + */ + +/** + * lunr.trimmer is a pipeline function for trimming non word + * characters from the beginning and end of tokens before they + * enter the index. + * + * This implementation may not work correctly for non latin + * characters and should either be removed or adapted for use + * with languages with non-latin characters. + * + * @static + * @implements {lunr.PipelineFunction} + * @param {lunr.Token} token The token to pass through the filter + * @returns {lunr.Token} + * @see lunr.Pipeline + */ +lunr.trimmer = function (token) { + return token.update(function (s) { + return s.replace(/^\W+/, '').replace(/\W+$/, '') + }) +} + +lunr.Pipeline.registerFunction(lunr.trimmer, 'trimmer') +/*! + * lunr.TokenSet + * Copyright (C) 2020 Oliver Nightingale + */ + +/** + * A token set is used to store the unique list of all tokens + * within an index. Token sets are also used to represent an + * incoming query to the index, this query token set and index + * token set are then intersected to find which tokens to look + * up in the inverted index. + * + * A token set can hold multiple tokens, as in the case of the + * index token set, or it can hold a single token as in the + * case of a simple query token set. + * + * Additionally token sets are used to perform wildcard matching. + * Leading, contained and trailing wildcards are supported, and + * from this edit distance matching can also be provided. + * + * Token sets are implemented as a minimal finite state automata, + * where both common prefixes and suffixes are shared between tokens. + * This helps to reduce the space used for storing the token set. + * + * @constructor + */ +lunr.TokenSet = function () { + this.final = false + this.edges = {} + this.id = lunr.TokenSet._nextId + lunr.TokenSet._nextId += 1 +} + +/** + * Keeps track of the next, auto increment, identifier to assign + * to a new tokenSet. + * + * TokenSets require a unique identifier to be correctly minimised. + * + * @private + */ +lunr.TokenSet._nextId = 1 + +/** + * Creates a TokenSet instance from the given sorted array of words. + * + * @param {String[]} arr - A sorted array of strings to create the set from. + * @returns {lunr.TokenSet} + * @throws Will throw an error if the input array is not sorted. + */ +lunr.TokenSet.fromArray = function (arr) { + var builder = new lunr.TokenSet.Builder + + for (var i = 0, len = arr.length; i < len; i++) { + builder.insert(arr[i]) + } + + builder.finish() + return builder.root +} + +/** + * Creates a token set from a query clause. + * + * @private + * @param {Object} clause - A single clause from lunr.Query. + * @param {string} clause.term - The query clause term. + * @param {number} [clause.editDistance] - The optional edit distance for the term. + * @returns {lunr.TokenSet} + */ +lunr.TokenSet.fromClause = function (clause) { + if ('editDistance' in clause) { + return lunr.TokenSet.fromFuzzyString(clause.term, clause.editDistance) + } else { + return lunr.TokenSet.fromString(clause.term) + } +} + +/** + * Creates a token set representing a single string with a specified + * edit distance. + * + * Insertions, deletions, substitutions and transpositions are each + * treated as an edit distance of 1. + * + * Increasing the allowed edit distance will have a dramatic impact + * on the performance of both creating and intersecting these TokenSets. + * It is advised to keep the edit distance less than 3. + * + * @param {string} str - The string to create the token set from. + * @param {number} editDistance - The allowed edit distance to match. + * @returns {lunr.Vector} + */ +lunr.TokenSet.fromFuzzyString = function (str, editDistance) { + var root = new lunr.TokenSet + + var stack = [{ + node: root, + editsRemaining: editDistance, + str: str + }] + + while (stack.length) { + var frame = stack.pop() + + // no edit + if (frame.str.length > 0) { + var char = frame.str.charAt(0), + noEditNode + + if (char in frame.node.edges) { + noEditNode = frame.node.edges[char] + } else { + noEditNode = new lunr.TokenSet + frame.node.edges[char] = noEditNode + } + + if (frame.str.length == 1) { + noEditNode.final = true + } + + stack.push({ + node: noEditNode, + editsRemaining: frame.editsRemaining, + str: frame.str.slice(1) + }) + } + + if (frame.editsRemaining == 0) { + continue + } + + // insertion + if ("*" in frame.node.edges) { + var insertionNode = frame.node.edges["*"] + } else { + var insertionNode = new lunr.TokenSet + frame.node.edges["*"] = insertionNode + } + + if (frame.str.length == 0) { + insertionNode.final = true + } + + stack.push({ + node: insertionNode, + editsRemaining: frame.editsRemaining - 1, + str: frame.str + }) + + // deletion + // can only do a deletion if we have enough edits remaining + // and if there are characters left to delete in the string + if (frame.str.length > 1) { + stack.push({ + node: frame.node, + editsRemaining: frame.editsRemaining - 1, + str: frame.str.slice(1) + }) + } + + // deletion + // just removing the last character from the str + if (frame.str.length == 1) { + frame.node.final = true + } + + // substitution + // can only do a substitution if we have enough edits remaining + // and if there are characters left to substitute + if (frame.str.length >= 1) { + if ("*" in frame.node.edges) { + var substitutionNode = frame.node.edges["*"] + } else { + var substitutionNode = new lunr.TokenSet + frame.node.edges["*"] = substitutionNode + } + + if (frame.str.length == 1) { + substitutionNode.final = true + } + + stack.push({ + node: substitutionNode, + editsRemaining: frame.editsRemaining - 1, + str: frame.str.slice(1) + }) + } + + // transposition + // can only do a transposition if there are edits remaining + // and there are enough characters to transpose + if (frame.str.length > 1) { + var charA = frame.str.charAt(0), + charB = frame.str.charAt(1), + transposeNode + + if (charB in frame.node.edges) { + transposeNode = frame.node.edges[charB] + } else { + transposeNode = new lunr.TokenSet + frame.node.edges[charB] = transposeNode + } + + if (frame.str.length == 1) { + transposeNode.final = true + } + + stack.push({ + node: transposeNode, + editsRemaining: frame.editsRemaining - 1, + str: charA + frame.str.slice(2) + }) + } + } + + return root +} + +/** + * Creates a TokenSet from a string. + * + * The string may contain one or more wildcard characters (*) + * that will allow wildcard matching when intersecting with + * another TokenSet. + * + * @param {string} str - The string to create a TokenSet from. + * @returns {lunr.TokenSet} + */ +lunr.TokenSet.fromString = function (str) { + var node = new lunr.TokenSet, + root = node + + /* + * Iterates through all characters within the passed string + * appending a node for each character. + * + * When a wildcard character is found then a self + * referencing edge is introduced to continually match + * any number of any characters. + */ + for (var i = 0, len = str.length; i < len; i++) { + var char = str[i], + final = (i == len - 1) + + if (char == "*") { + node.edges[char] = node + node.final = final + + } else { + var next = new lunr.TokenSet + next.final = final + + node.edges[char] = next + node = next + } + } + + return root +} + +/** + * Converts this TokenSet into an array of strings + * contained within the TokenSet. + * + * This is not intended to be used on a TokenSet that + * contains wildcards, in these cases the results are + * undefined and are likely to cause an infinite loop. + * + * @returns {string[]} + */ +lunr.TokenSet.prototype.toArray = function () { + var words = [] + + var stack = [{ + prefix: "", + node: this + }] + + while (stack.length) { + var frame = stack.pop(), + edges = Object.keys(frame.node.edges), + len = edges.length + + if (frame.node.final) { + /* In Safari, at this point the prefix is sometimes corrupted, see: + * https://github.com/olivernn/lunr.js/issues/279 Calling any + * String.prototype method forces Safari to "cast" this string to what + * it's supposed to be, fixing the bug. */ + frame.prefix.charAt(0) + words.push(frame.prefix) + } + + for (var i = 0; i < len; i++) { + var edge = edges[i] + + stack.push({ + prefix: frame.prefix.concat(edge), + node: frame.node.edges[edge] + }) + } + } + + return words +} + +/** + * Generates a string representation of a TokenSet. + * + * This is intended to allow TokenSets to be used as keys + * in objects, largely to aid the construction and minimisation + * of a TokenSet. As such it is not designed to be a human + * friendly representation of the TokenSet. + * + * @returns {string} + */ +lunr.TokenSet.prototype.toString = function () { + // NOTE: Using Object.keys here as this.edges is very likely + // to enter 'hash-mode' with many keys being added + // + // avoiding a for-in loop here as it leads to the function + // being de-optimised (at least in V8). From some simple + // benchmarks the performance is comparable, but allowing + // V8 to optimize may mean easy performance wins in the future. + + if (this._str) { + return this._str + } + + var str = this.final ? '1' : '0', + labels = Object.keys(this.edges).sort(), + len = labels.length + + for (var i = 0; i < len; i++) { + var label = labels[i], + node = this.edges[label] + + str = str + label + node.id + } + + return str +} + +/** + * Returns a new TokenSet that is the intersection of + * this TokenSet and the passed TokenSet. + * + * This intersection will take into account any wildcards + * contained within the TokenSet. + * + * @param {lunr.TokenSet} b - An other TokenSet to intersect with. + * @returns {lunr.TokenSet} + */ +lunr.TokenSet.prototype.intersect = function (b) { + var output = new lunr.TokenSet, + frame = undefined + + var stack = [{ + qNode: b, + output: output, + node: this + }] + + while (stack.length) { + frame = stack.pop() + + // NOTE: As with the #toString method, we are using + // Object.keys and a for loop instead of a for-in loop + // as both of these objects enter 'hash' mode, causing + // the function to be de-optimised in V8 + var qEdges = Object.keys(frame.qNode.edges), + qLen = qEdges.length, + nEdges = Object.keys(frame.node.edges), + nLen = nEdges.length + + for (var q = 0; q < qLen; q++) { + var qEdge = qEdges[q] + + for (var n = 0; n < nLen; n++) { + var nEdge = nEdges[n] + + if (nEdge == qEdge || qEdge == '*') { + var node = frame.node.edges[nEdge], + qNode = frame.qNode.edges[qEdge], + final = node.final && qNode.final, + next = undefined + + if (nEdge in frame.output.edges) { + // an edge already exists for this character + // no need to create a new node, just set the finality + // bit unless this node is already final + next = frame.output.edges[nEdge] + next.final = next.final || final + + } else { + // no edge exists yet, must create one + // set the finality bit and insert it + // into the output + next = new lunr.TokenSet + next.final = final + frame.output.edges[nEdge] = next + } + + stack.push({ + qNode: qNode, + output: next, + node: node + }) + } + } + } + } + + return output +} +lunr.TokenSet.Builder = function () { + this.previousWord = "" + this.root = new lunr.TokenSet + this.uncheckedNodes = [] + this.minimizedNodes = {} +} + +lunr.TokenSet.Builder.prototype.insert = function (word) { + var node, + commonPrefix = 0 + + if (word < this.previousWord) { + throw new Error ("Out of order word insertion") + } + + for (var i = 0; i < word.length && i < this.previousWord.length; i++) { + if (word[i] != this.previousWord[i]) break + commonPrefix++ + } + + this.minimize(commonPrefix) + + if (this.uncheckedNodes.length == 0) { + node = this.root + } else { + node = this.uncheckedNodes[this.uncheckedNodes.length - 1].child + } + + for (var i = commonPrefix; i < word.length; i++) { + var nextNode = new lunr.TokenSet, + char = word[i] + + node.edges[char] = nextNode + + this.uncheckedNodes.push({ + parent: node, + char: char, + child: nextNode + }) + + node = nextNode + } + + node.final = true + this.previousWord = word +} + +lunr.TokenSet.Builder.prototype.finish = function () { + this.minimize(0) +} + +lunr.TokenSet.Builder.prototype.minimize = function (downTo) { + for (var i = this.uncheckedNodes.length - 1; i >= downTo; i--) { + var node = this.uncheckedNodes[i], + childKey = node.child.toString() + + if (childKey in this.minimizedNodes) { + node.parent.edges[node.char] = this.minimizedNodes[childKey] + } else { + // Cache the key for this node since + // we know it can't change anymore + node.child._str = childKey + + this.minimizedNodes[childKey] = node.child + } + + this.uncheckedNodes.pop() + } +} +/*! + * lunr.Index + * Copyright (C) 2020 Oliver Nightingale + */ + +/** + * An index contains the built index of all documents and provides a query interface + * to the index. + * + * Usually instances of lunr.Index will not be created using this constructor, instead + * lunr.Builder should be used to construct new indexes, or lunr.Index.load should be + * used to load previously built and serialized indexes. + * + * @constructor + * @param {Object} attrs - The attributes of the built search index. + * @param {Object} attrs.invertedIndex - An index of term/field to document reference. + * @param {Object} attrs.fieldVectors - Field vectors + * @param {lunr.TokenSet} attrs.tokenSet - An set of all corpus tokens. + * @param {string[]} attrs.fields - The names of indexed document fields. + * @param {lunr.Pipeline} attrs.pipeline - The pipeline to use for search terms. + */ +lunr.Index = function (attrs) { + this.invertedIndex = attrs.invertedIndex + this.fieldVectors = attrs.fieldVectors + this.tokenSet = attrs.tokenSet + this.fields = attrs.fields + this.pipeline = attrs.pipeline +} + +/** + * A result contains details of a document matching a search query. + * @typedef {Object} lunr.Index~Result + * @property {string} ref - The reference of the document this result represents. + * @property {number} score - A number between 0 and 1 representing how similar this document is to the query. + * @property {lunr.MatchData} matchData - Contains metadata about this match including which term(s) caused the match. + */ + +/** + * Although lunr provides the ability to create queries using lunr.Query, it also provides a simple + * query language which itself is parsed into an instance of lunr.Query. + * + * For programmatically building queries it is advised to directly use lunr.Query, the query language + * is best used for human entered text rather than program generated text. + * + * At its simplest queries can just be a single term, e.g. `hello`, multiple terms are also supported + * and will be combined with OR, e.g `hello world` will match documents that contain either 'hello' + * or 'world', though those that contain both will rank higher in the results. + * + * Wildcards can be included in terms to match one or more unspecified characters, these wildcards can + * be inserted anywhere within the term, and more than one wildcard can exist in a single term. Adding + * wildcards will increase the number of documents that will be found but can also have a negative + * impact on query performance, especially with wildcards at the beginning of a term. + * + * Terms can be restricted to specific fields, e.g. `title:hello`, only documents with the term + * hello in the title field will match this query. Using a field not present in the index will lead + * to an error being thrown. + * + * Modifiers can also be added to terms, lunr supports edit distance and boost modifiers on terms. A term + * boost will make documents matching that term score higher, e.g. `foo^5`. Edit distance is also supported + * to provide fuzzy matching, e.g. 'hello~2' will match documents with hello with an edit distance of 2. + * Avoid large values for edit distance to improve query performance. + * + * Each term also supports a presence modifier. By default a term's presence in document is optional, however + * this can be changed to either required or prohibited. For a term's presence to be required in a document the + * term should be prefixed with a '+', e.g. `+foo bar` is a search for documents that must contain 'foo' and + * optionally contain 'bar'. Conversely a leading '-' sets the terms presence to prohibited, i.e. it must not + * appear in a document, e.g. `-foo bar` is a search for documents that do not contain 'foo' but may contain 'bar'. + * + * To escape special characters the backslash character '\' can be used, this allows searches to include + * characters that would normally be considered modifiers, e.g. `foo\~2` will search for a term "foo~2" instead + * of attempting to apply a boost of 2 to the search term "foo". + * + * @typedef {string} lunr.Index~QueryString + * @example Simple single term query + * hello + * @example Multiple term query + * hello world + * @example term scoped to a field + * title:hello + * @example term with a boost of 10 + * hello^10 + * @example term with an edit distance of 2 + * hello~2 + * @example terms with presence modifiers + * -foo +bar baz + */ + +/** + * Performs a search against the index using lunr query syntax. + * + * Results will be returned sorted by their score, the most relevant results + * will be returned first. For details on how the score is calculated, please see + * the {@link https://lunrjs.com/guides/searching.html#scoring|guide}. + * + * For more programmatic querying use lunr.Index#query. + * + * @param {lunr.Index~QueryString} queryString - A string containing a lunr query. + * @throws {lunr.QueryParseError} If the passed query string cannot be parsed. + * @returns {lunr.Index~Result[]} + */ +lunr.Index.prototype.search = function (queryString) { + return this.query(function (query) { + var parser = new lunr.QueryParser(queryString, query) + parser.parse() + }) +} + +/** + * A query builder callback provides a query object to be used to express + * the query to perform on the index. + * + * @callback lunr.Index~queryBuilder + * @param {lunr.Query} query - The query object to build up. + * @this lunr.Query + */ + +/** + * Performs a query against the index using the yielded lunr.Query object. + * + * If performing programmatic queries against the index, this method is preferred + * over lunr.Index#search so as to avoid the additional query parsing overhead. + * + * A query object is yielded to the supplied function which should be used to + * express the query to be run against the index. + * + * Note that although this function takes a callback parameter it is _not_ an + * asynchronous operation, the callback is just yielded a query object to be + * customized. + * + * @param {lunr.Index~queryBuilder} fn - A function that is used to build the query. + * @returns {lunr.Index~Result[]} + */ +lunr.Index.prototype.query = function (fn) { + // for each query clause + // * process terms + // * expand terms from token set + // * find matching documents and metadata + // * get document vectors + // * score documents + + var query = new lunr.Query(this.fields), + matchingFields = Object.create(null), + queryVectors = Object.create(null), + termFieldCache = Object.create(null), + requiredMatches = Object.create(null), + prohibitedMatches = Object.create(null) + + /* + * To support field level boosts a query vector is created per + * field. An empty vector is eagerly created to support negated + * queries. + */ + for (var i = 0; i < this.fields.length; i++) { + queryVectors[this.fields[i]] = new lunr.Vector + } + + fn.call(query, query) + + for (var i = 0; i < query.clauses.length; i++) { + /* + * Unless the pipeline has been disabled for this term, which is + * the case for terms with wildcards, we need to pass the clause + * term through the search pipeline. A pipeline returns an array + * of processed terms. Pipeline functions may expand the passed + * term, which means we may end up performing multiple index lookups + * for a single query term. + */ + var clause = query.clauses[i], + terms = null, + clauseMatches = lunr.Set.empty + + if (clause.usePipeline) { + terms = this.pipeline.runString(clause.term, { + fields: clause.fields + }) + } else { + terms = [clause.term] + } + + for (var m = 0; m < terms.length; m++) { + var term = terms[m] + + /* + * Each term returned from the pipeline needs to use the same query + * clause object, e.g. the same boost and or edit distance. The + * simplest way to do this is to re-use the clause object but mutate + * its term property. + */ + clause.term = term + + /* + * From the term in the clause we create a token set which will then + * be used to intersect the indexes token set to get a list of terms + * to lookup in the inverted index + */ + var termTokenSet = lunr.TokenSet.fromClause(clause), + expandedTerms = this.tokenSet.intersect(termTokenSet).toArray() + + /* + * If a term marked as required does not exist in the tokenSet it is + * impossible for the search to return any matches. We set all the field + * scoped required matches set to empty and stop examining any further + * clauses. + */ + if (expandedTerms.length === 0 && clause.presence === lunr.Query.presence.REQUIRED) { + for (var k = 0; k < clause.fields.length; k++) { + var field = clause.fields[k] + requiredMatches[field] = lunr.Set.empty + } + + break + } + + for (var j = 0; j < expandedTerms.length; j++) { + /* + * For each term get the posting and termIndex, this is required for + * building the query vector. + */ + var expandedTerm = expandedTerms[j], + posting = this.invertedIndex[expandedTerm], + termIndex = posting._index + + for (var k = 0; k < clause.fields.length; k++) { + /* + * For each field that this query term is scoped by (by default + * all fields are in scope) we need to get all the document refs + * that have this term in that field. + * + * The posting is the entry in the invertedIndex for the matching + * term from above. + */ + var field = clause.fields[k], + fieldPosting = posting[field], + matchingDocumentRefs = Object.keys(fieldPosting), + termField = expandedTerm + "/" + field, + matchingDocumentsSet = new lunr.Set(matchingDocumentRefs) + + /* + * if the presence of this term is required ensure that the matching + * documents are added to the set of required matches for this clause. + * + */ + if (clause.presence == lunr.Query.presence.REQUIRED) { + clauseMatches = clauseMatches.union(matchingDocumentsSet) + + if (requiredMatches[field] === undefined) { + requiredMatches[field] = lunr.Set.complete + } + } + + /* + * if the presence of this term is prohibited ensure that the matching + * documents are added to the set of prohibited matches for this field, + * creating that set if it does not yet exist. + */ + if (clause.presence == lunr.Query.presence.PROHIBITED) { + if (prohibitedMatches[field] === undefined) { + prohibitedMatches[field] = lunr.Set.empty + } + + prohibitedMatches[field] = prohibitedMatches[field].union(matchingDocumentsSet) + + /* + * Prohibited matches should not be part of the query vector used for + * similarity scoring and no metadata should be extracted so we continue + * to the next field + */ + continue + } + + /* + * The query field vector is populated using the termIndex found for + * the term and a unit value with the appropriate boost applied. + * Using upsert because there could already be an entry in the vector + * for the term we are working with. In that case we just add the scores + * together. + */ + queryVectors[field].upsert(termIndex, clause.boost, function (a, b) { return a + b }) + + /** + * If we've already seen this term, field combo then we've already collected + * the matching documents and metadata, no need to go through all that again + */ + if (termFieldCache[termField]) { + continue + } + + for (var l = 0; l < matchingDocumentRefs.length; l++) { + /* + * All metadata for this term/field/document triple + * are then extracted and collected into an instance + * of lunr.MatchData ready to be returned in the query + * results + */ + var matchingDocumentRef = matchingDocumentRefs[l], + matchingFieldRef = new lunr.FieldRef (matchingDocumentRef, field), + metadata = fieldPosting[matchingDocumentRef], + fieldMatch + + if ((fieldMatch = matchingFields[matchingFieldRef]) === undefined) { + matchingFields[matchingFieldRef] = new lunr.MatchData (expandedTerm, field, metadata) + } else { + fieldMatch.add(expandedTerm, field, metadata) + } + + } + + termFieldCache[termField] = true + } + } + } + + /** + * If the presence was required we need to update the requiredMatches field sets. + * We do this after all fields for the term have collected their matches because + * the clause terms presence is required in _any_ of the fields not _all_ of the + * fields. + */ + if (clause.presence === lunr.Query.presence.REQUIRED) { + for (var k = 0; k < clause.fields.length; k++) { + var field = clause.fields[k] + requiredMatches[field] = requiredMatches[field].intersect(clauseMatches) + } + } + } + + /** + * Need to combine the field scoped required and prohibited + * matching documents into a global set of required and prohibited + * matches + */ + var allRequiredMatches = lunr.Set.complete, + allProhibitedMatches = lunr.Set.empty + + for (var i = 0; i < this.fields.length; i++) { + var field = this.fields[i] + + if (requiredMatches[field]) { + allRequiredMatches = allRequiredMatches.intersect(requiredMatches[field]) + } + + if (prohibitedMatches[field]) { + allProhibitedMatches = allProhibitedMatches.union(prohibitedMatches[field]) + } + } + + var matchingFieldRefs = Object.keys(matchingFields), + results = [], + matches = Object.create(null) + + /* + * If the query is negated (contains only prohibited terms) + * we need to get _all_ fieldRefs currently existing in the + * index. This is only done when we know that the query is + * entirely prohibited terms to avoid any cost of getting all + * fieldRefs unnecessarily. + * + * Additionally, blank MatchData must be created to correctly + * populate the results. + */ + if (query.isNegated()) { + matchingFieldRefs = Object.keys(this.fieldVectors) + + for (var i = 0; i < matchingFieldRefs.length; i++) { + var matchingFieldRef = matchingFieldRefs[i] + var fieldRef = lunr.FieldRef.fromString(matchingFieldRef) + matchingFields[matchingFieldRef] = new lunr.MatchData + } + } + + for (var i = 0; i < matchingFieldRefs.length; i++) { + /* + * Currently we have document fields that match the query, but we + * need to return documents. The matchData and scores are combined + * from multiple fields belonging to the same document. + * + * Scores are calculated by field, using the query vectors created + * above, and combined into a final document score using addition. + */ + var fieldRef = lunr.FieldRef.fromString(matchingFieldRefs[i]), + docRef = fieldRef.docRef + + if (!allRequiredMatches.contains(docRef)) { + continue + } + + if (allProhibitedMatches.contains(docRef)) { + continue + } + + var fieldVector = this.fieldVectors[fieldRef], + score = queryVectors[fieldRef.fieldName].similarity(fieldVector), + docMatch + + if ((docMatch = matches[docRef]) !== undefined) { + docMatch.score += score + docMatch.matchData.combine(matchingFields[fieldRef]) + } else { + var match = { + ref: docRef, + score: score, + matchData: matchingFields[fieldRef] + } + matches[docRef] = match + results.push(match) + } + } + + /* + * Sort the results objects by score, highest first. + */ + return results.sort(function (a, b) { + return b.score - a.score + }) +} + +/** + * Prepares the index for JSON serialization. + * + * The schema for this JSON blob will be described in a + * separate JSON schema file. + * + * @returns {Object} + */ +lunr.Index.prototype.toJSON = function () { + var invertedIndex = Object.keys(this.invertedIndex) + .sort() + .map(function (term) { + return [term, this.invertedIndex[term]] + }, this) + + var fieldVectors = Object.keys(this.fieldVectors) + .map(function (ref) { + return [ref, this.fieldVectors[ref].toJSON()] + }, this) + + return { + version: lunr.version, + fields: this.fields, + fieldVectors: fieldVectors, + invertedIndex: invertedIndex, + pipeline: this.pipeline.toJSON() + } +} + +/** + * Loads a previously serialized lunr.Index + * + * @param {Object} serializedIndex - A previously serialized lunr.Index + * @returns {lunr.Index} + */ +lunr.Index.load = function (serializedIndex) { + var attrs = {}, + fieldVectors = {}, + serializedVectors = serializedIndex.fieldVectors, + invertedIndex = Object.create(null), + serializedInvertedIndex = serializedIndex.invertedIndex, + tokenSetBuilder = new lunr.TokenSet.Builder, + pipeline = lunr.Pipeline.load(serializedIndex.pipeline) + + if (serializedIndex.version != lunr.version) { + lunr.utils.warn("Version mismatch when loading serialised index. Current version of lunr '" + lunr.version + "' does not match serialized index '" + serializedIndex.version + "'") + } + + for (var i = 0; i < serializedVectors.length; i++) { + var tuple = serializedVectors[i], + ref = tuple[0], + elements = tuple[1] + + fieldVectors[ref] = new lunr.Vector(elements) + } + + for (var i = 0; i < serializedInvertedIndex.length; i++) { + var tuple = serializedInvertedIndex[i], + term = tuple[0], + posting = tuple[1] + + tokenSetBuilder.insert(term) + invertedIndex[term] = posting + } + + tokenSetBuilder.finish() + + attrs.fields = serializedIndex.fields + + attrs.fieldVectors = fieldVectors + attrs.invertedIndex = invertedIndex + attrs.tokenSet = tokenSetBuilder.root + attrs.pipeline = pipeline + + return new lunr.Index(attrs) +} +/*! + * lunr.Builder + * Copyright (C) 2020 Oliver Nightingale + */ + +/** + * lunr.Builder performs indexing on a set of documents and + * returns instances of lunr.Index ready for querying. + * + * All configuration of the index is done via the builder, the + * fields to index, the document reference, the text processing + * pipeline and document scoring parameters are all set on the + * builder before indexing. + * + * @constructor + * @property {string} _ref - Internal reference to the document reference field. + * @property {string[]} _fields - Internal reference to the document fields to index. + * @property {object} invertedIndex - The inverted index maps terms to document fields. + * @property {object} documentTermFrequencies - Keeps track of document term frequencies. + * @property {object} documentLengths - Keeps track of the length of documents added to the index. + * @property {lunr.tokenizer} tokenizer - Function for splitting strings into tokens for indexing. + * @property {lunr.Pipeline} pipeline - The pipeline performs text processing on tokens before indexing. + * @property {lunr.Pipeline} searchPipeline - A pipeline for processing search terms before querying the index. + * @property {number} documentCount - Keeps track of the total number of documents indexed. + * @property {number} _b - A parameter to control field length normalization, setting this to 0 disabled normalization, 1 fully normalizes field lengths, the default value is 0.75. + * @property {number} _k1 - A parameter to control how quickly an increase in term frequency results in term frequency saturation, the default value is 1.2. + * @property {number} termIndex - A counter incremented for each unique term, used to identify a terms position in the vector space. + * @property {array} metadataWhitelist - A list of metadata keys that have been whitelisted for entry in the index. + */ +lunr.Builder = function () { + this._ref = "id" + this._fields = Object.create(null) + this._documents = Object.create(null) + this.invertedIndex = Object.create(null) + this.fieldTermFrequencies = {} + this.fieldLengths = {} + this.tokenizer = lunr.tokenizer + this.pipeline = new lunr.Pipeline + this.searchPipeline = new lunr.Pipeline + this.documentCount = 0 + this._b = 0.75 + this._k1 = 1.2 + this.termIndex = 0 + this.metadataWhitelist = [] +} + +/** + * Sets the document field used as the document reference. Every document must have this field. + * The type of this field in the document should be a string, if it is not a string it will be + * coerced into a string by calling toString. + * + * The default ref is 'id'. + * + * The ref should _not_ be changed during indexing, it should be set before any documents are + * added to the index. Changing it during indexing can lead to inconsistent results. + * + * @param {string} ref - The name of the reference field in the document. + */ +lunr.Builder.prototype.ref = function (ref) { + this._ref = ref +} + +/** + * A function that is used to extract a field from a document. + * + * Lunr expects a field to be at the top level of a document, if however the field + * is deeply nested within a document an extractor function can be used to extract + * the right field for indexing. + * + * @callback fieldExtractor + * @param {object} doc - The document being added to the index. + * @returns {?(string|object|object[])} obj - The object that will be indexed for this field. + * @example Extracting a nested field + * function (doc) { return doc.nested.field } + */ + +/** + * Adds a field to the list of document fields that will be indexed. Every document being + * indexed should have this field. Null values for this field in indexed documents will + * not cause errors but will limit the chance of that document being retrieved by searches. + * + * All fields should be added before adding documents to the index. Adding fields after + * a document has been indexed will have no effect on already indexed documents. + * + * Fields can be boosted at build time. This allows terms within that field to have more + * importance when ranking search results. Use a field boost to specify that matches within + * one field are more important than other fields. + * + * @param {string} fieldName - The name of a field to index in all documents. + * @param {object} attributes - Optional attributes associated with this field. + * @param {number} [attributes.boost=1] - Boost applied to all terms within this field. + * @param {fieldExtractor} [attributes.extractor] - Function to extract a field from a document. + * @throws {RangeError} fieldName cannot contain unsupported characters '/' + */ +lunr.Builder.prototype.field = function (fieldName, attributes) { + if (/\//.test(fieldName)) { + throw new RangeError ("Field '" + fieldName + "' contains illegal character '/'") + } + + this._fields[fieldName] = attributes || {} +} + +/** + * A parameter to tune the amount of field length normalisation that is applied when + * calculating relevance scores. A value of 0 will completely disable any normalisation + * and a value of 1 will fully normalise field lengths. The default is 0.75. Values of b + * will be clamped to the range 0 - 1. + * + * @param {number} number - The value to set for this tuning parameter. + */ +lunr.Builder.prototype.b = function (number) { + if (number < 0) { + this._b = 0 + } else if (number > 1) { + this._b = 1 + } else { + this._b = number + } +} + +/** + * A parameter that controls the speed at which a rise in term frequency results in term + * frequency saturation. The default value is 1.2. Setting this to a higher value will give + * slower saturation levels, a lower value will result in quicker saturation. + * + * @param {number} number - The value to set for this tuning parameter. + */ +lunr.Builder.prototype.k1 = function (number) { + this._k1 = number +} + +/** + * Adds a document to the index. + * + * Before adding fields to the index the index should have been fully setup, with the document + * ref and all fields to index already having been specified. + * + * The document must have a field name as specified by the ref (by default this is 'id') and + * it should have all fields defined for indexing, though null or undefined values will not + * cause errors. + * + * Entire documents can be boosted at build time. Applying a boost to a document indicates that + * this document should rank higher in search results than other documents. + * + * @param {object} doc - The document to add to the index. + * @param {object} attributes - Optional attributes associated with this document. + * @param {number} [attributes.boost=1] - Boost applied to all terms within this document. + */ +lunr.Builder.prototype.add = function (doc, attributes) { + var docRef = doc[this._ref], + fields = Object.keys(this._fields) + + this._documents[docRef] = attributes || {} + this.documentCount += 1 + + for (var i = 0; i < fields.length; i++) { + var fieldName = fields[i], + extractor = this._fields[fieldName].extractor, + field = extractor ? extractor(doc) : doc[fieldName], + tokens = this.tokenizer(field, { + fields: [fieldName] + }), + terms = this.pipeline.run(tokens), + fieldRef = new lunr.FieldRef (docRef, fieldName), + fieldTerms = Object.create(null) + + this.fieldTermFrequencies[fieldRef] = fieldTerms + this.fieldLengths[fieldRef] = 0 + + // store the length of this field for this document + this.fieldLengths[fieldRef] += terms.length + + // calculate term frequencies for this field + for (var j = 0; j < terms.length; j++) { + var term = terms[j] + + if (fieldTerms[term] == undefined) { + fieldTerms[term] = 0 + } + + fieldTerms[term] += 1 + + // add to inverted index + // create an initial posting if one doesn't exist + if (this.invertedIndex[term] == undefined) { + var posting = Object.create(null) + posting["_index"] = this.termIndex + this.termIndex += 1 + + for (var k = 0; k < fields.length; k++) { + posting[fields[k]] = Object.create(null) + } + + this.invertedIndex[term] = posting + } + + // add an entry for this term/fieldName/docRef to the invertedIndex + if (this.invertedIndex[term][fieldName][docRef] == undefined) { + this.invertedIndex[term][fieldName][docRef] = Object.create(null) + } + + // store all whitelisted metadata about this token in the + // inverted index + for (var l = 0; l < this.metadataWhitelist.length; l++) { + var metadataKey = this.metadataWhitelist[l], + metadata = term.metadata[metadataKey] + + if (this.invertedIndex[term][fieldName][docRef][metadataKey] == undefined) { + this.invertedIndex[term][fieldName][docRef][metadataKey] = [] + } + + this.invertedIndex[term][fieldName][docRef][metadataKey].push(metadata) + } + } + + } +} + +/** + * Calculates the average document length for this index + * + * @private + */ +lunr.Builder.prototype.calculateAverageFieldLengths = function () { + + var fieldRefs = Object.keys(this.fieldLengths), + numberOfFields = fieldRefs.length, + accumulator = {}, + documentsWithField = {} + + for (var i = 0; i < numberOfFields; i++) { + var fieldRef = lunr.FieldRef.fromString(fieldRefs[i]), + field = fieldRef.fieldName + + documentsWithField[field] || (documentsWithField[field] = 0) + documentsWithField[field] += 1 + + accumulator[field] || (accumulator[field] = 0) + accumulator[field] += this.fieldLengths[fieldRef] + } + + var fields = Object.keys(this._fields) + + for (var i = 0; i < fields.length; i++) { + var fieldName = fields[i] + accumulator[fieldName] = accumulator[fieldName] / documentsWithField[fieldName] + } + + this.averageFieldLength = accumulator +} + +/** + * Builds a vector space model of every document using lunr.Vector + * + * @private + */ +lunr.Builder.prototype.createFieldVectors = function () { + var fieldVectors = {}, + fieldRefs = Object.keys(this.fieldTermFrequencies), + fieldRefsLength = fieldRefs.length, + termIdfCache = Object.create(null) + + for (var i = 0; i < fieldRefsLength; i++) { + var fieldRef = lunr.FieldRef.fromString(fieldRefs[i]), + fieldName = fieldRef.fieldName, + fieldLength = this.fieldLengths[fieldRef], + fieldVector = new lunr.Vector, + termFrequencies = this.fieldTermFrequencies[fieldRef], + terms = Object.keys(termFrequencies), + termsLength = terms.length + + + var fieldBoost = this._fields[fieldName].boost || 1, + docBoost = this._documents[fieldRef.docRef].boost || 1 + + for (var j = 0; j < termsLength; j++) { + var term = terms[j], + tf = termFrequencies[term], + termIndex = this.invertedIndex[term]._index, + idf, score, scoreWithPrecision + + if (termIdfCache[term] === undefined) { + idf = lunr.idf(this.invertedIndex[term], this.documentCount) + termIdfCache[term] = idf + } else { + idf = termIdfCache[term] + } + + score = idf * ((this._k1 + 1) * tf) / (this._k1 * (1 - this._b + this._b * (fieldLength / this.averageFieldLength[fieldName])) + tf) + score *= fieldBoost + score *= docBoost + scoreWithPrecision = Math.round(score * 1000) / 1000 + // Converts 1.23456789 to 1.234. + // Reducing the precision so that the vectors take up less + // space when serialised. Doing it now so that they behave + // the same before and after serialisation. Also, this is + // the fastest approach to reducing a number's precision in + // JavaScript. + + fieldVector.insert(termIndex, scoreWithPrecision) + } + + fieldVectors[fieldRef] = fieldVector + } + + this.fieldVectors = fieldVectors +} + +/** + * Creates a token set of all tokens in the index using lunr.TokenSet + * + * @private + */ +lunr.Builder.prototype.createTokenSet = function () { + this.tokenSet = lunr.TokenSet.fromArray( + Object.keys(this.invertedIndex).sort() + ) +} + +/** + * Builds the index, creating an instance of lunr.Index. + * + * This completes the indexing process and should only be called + * once all documents have been added to the index. + * + * @returns {lunr.Index} + */ +lunr.Builder.prototype.build = function () { + this.calculateAverageFieldLengths() + this.createFieldVectors() + this.createTokenSet() + + return new lunr.Index({ + invertedIndex: this.invertedIndex, + fieldVectors: this.fieldVectors, + tokenSet: this.tokenSet, + fields: Object.keys(this._fields), + pipeline: this.searchPipeline + }) +} + +/** + * Applies a plugin to the index builder. + * + * A plugin is a function that is called with the index builder as its context. + * Plugins can be used to customise or extend the behaviour of the index + * in some way. A plugin is just a function, that encapsulated the custom + * behaviour that should be applied when building the index. + * + * The plugin function will be called with the index builder as its argument, additional + * arguments can also be passed when calling use. The function will be called + * with the index builder as its context. + * + * @param {Function} plugin The plugin to apply. + */ +lunr.Builder.prototype.use = function (fn) { + var args = Array.prototype.slice.call(arguments, 1) + args.unshift(this) + fn.apply(this, args) +} +/** + * Contains and collects metadata about a matching document. + * A single instance of lunr.MatchData is returned as part of every + * lunr.Index~Result. + * + * @constructor + * @param {string} term - The term this match data is associated with + * @param {string} field - The field in which the term was found + * @param {object} metadata - The metadata recorded about this term in this field + * @property {object} metadata - A cloned collection of metadata associated with this document. + * @see {@link lunr.Index~Result} + */ +lunr.MatchData = function (term, field, metadata) { + var clonedMetadata = Object.create(null), + metadataKeys = Object.keys(metadata || {}) + + // Cloning the metadata to prevent the original + // being mutated during match data combination. + // Metadata is kept in an array within the inverted + // index so cloning the data can be done with + // Array#slice + for (var i = 0; i < metadataKeys.length; i++) { + var key = metadataKeys[i] + clonedMetadata[key] = metadata[key].slice() + } + + this.metadata = Object.create(null) + + if (term !== undefined) { + this.metadata[term] = Object.create(null) + this.metadata[term][field] = clonedMetadata + } +} + +/** + * An instance of lunr.MatchData will be created for every term that matches a + * document. However only one instance is required in a lunr.Index~Result. This + * method combines metadata from another instance of lunr.MatchData with this + * objects metadata. + * + * @param {lunr.MatchData} otherMatchData - Another instance of match data to merge with this one. + * @see {@link lunr.Index~Result} + */ +lunr.MatchData.prototype.combine = function (otherMatchData) { + var terms = Object.keys(otherMatchData.metadata) + + for (var i = 0; i < terms.length; i++) { + var term = terms[i], + fields = Object.keys(otherMatchData.metadata[term]) + + if (this.metadata[term] == undefined) { + this.metadata[term] = Object.create(null) + } + + for (var j = 0; j < fields.length; j++) { + var field = fields[j], + keys = Object.keys(otherMatchData.metadata[term][field]) + + if (this.metadata[term][field] == undefined) { + this.metadata[term][field] = Object.create(null) + } + + for (var k = 0; k < keys.length; k++) { + var key = keys[k] + + if (this.metadata[term][field][key] == undefined) { + this.metadata[term][field][key] = otherMatchData.metadata[term][field][key] + } else { + this.metadata[term][field][key] = this.metadata[term][field][key].concat(otherMatchData.metadata[term][field][key]) + } + + } + } + } +} + +/** + * Add metadata for a term/field pair to this instance of match data. + * + * @param {string} term - The term this match data is associated with + * @param {string} field - The field in which the term was found + * @param {object} metadata - The metadata recorded about this term in this field + */ +lunr.MatchData.prototype.add = function (term, field, metadata) { + if (!(term in this.metadata)) { + this.metadata[term] = Object.create(null) + this.metadata[term][field] = metadata + return + } + + if (!(field in this.metadata[term])) { + this.metadata[term][field] = metadata + return + } + + var metadataKeys = Object.keys(metadata) + + for (var i = 0; i < metadataKeys.length; i++) { + var key = metadataKeys[i] + + if (key in this.metadata[term][field]) { + this.metadata[term][field][key] = this.metadata[term][field][key].concat(metadata[key]) + } else { + this.metadata[term][field][key] = metadata[key] + } + } +} +/** + * A lunr.Query provides a programmatic way of defining queries to be performed + * against a {@link lunr.Index}. + * + * Prefer constructing a lunr.Query using the {@link lunr.Index#query} method + * so the query object is pre-initialized with the right index fields. + * + * @constructor + * @property {lunr.Query~Clause[]} clauses - An array of query clauses. + * @property {string[]} allFields - An array of all available fields in a lunr.Index. + */ +lunr.Query = function (allFields) { + this.clauses = [] + this.allFields = allFields +} + +/** + * Constants for indicating what kind of automatic wildcard insertion will be used when constructing a query clause. + * + * This allows wildcards to be added to the beginning and end of a term without having to manually do any string + * concatenation. + * + * The wildcard constants can be bitwise combined to select both leading and trailing wildcards. + * + * @constant + * @default + * @property {number} wildcard.NONE - The term will have no wildcards inserted, this is the default behaviour + * @property {number} wildcard.LEADING - Prepend the term with a wildcard, unless a leading wildcard already exists + * @property {number} wildcard.TRAILING - Append a wildcard to the term, unless a trailing wildcard already exists + * @see lunr.Query~Clause + * @see lunr.Query#clause + * @see lunr.Query#term + * @example query term with trailing wildcard + * query.term('foo', { wildcard: lunr.Query.wildcard.TRAILING }) + * @example query term with leading and trailing wildcard + * query.term('foo', { + * wildcard: lunr.Query.wildcard.LEADING | lunr.Query.wildcard.TRAILING + * }) + */ + +lunr.Query.wildcard = new String ("*") +lunr.Query.wildcard.NONE = 0 +lunr.Query.wildcard.LEADING = 1 +lunr.Query.wildcard.TRAILING = 2 + +/** + * Constants for indicating what kind of presence a term must have in matching documents. + * + * @constant + * @enum {number} + * @see lunr.Query~Clause + * @see lunr.Query#clause + * @see lunr.Query#term + * @example query term with required presence + * query.term('foo', { presence: lunr.Query.presence.REQUIRED }) + */ +lunr.Query.presence = { + /** + * Term's presence in a document is optional, this is the default value. + */ + OPTIONAL: 1, + + /** + * Term's presence in a document is required, documents that do not contain + * this term will not be returned. + */ + REQUIRED: 2, + + /** + * Term's presence in a document is prohibited, documents that do contain + * this term will not be returned. + */ + PROHIBITED: 3 +} + +/** + * A single clause in a {@link lunr.Query} contains a term and details on how to + * match that term against a {@link lunr.Index}. + * + * @typedef {Object} lunr.Query~Clause + * @property {string[]} fields - The fields in an index this clause should be matched against. + * @property {number} [boost=1] - Any boost that should be applied when matching this clause. + * @property {number} [editDistance] - Whether the term should have fuzzy matching applied, and how fuzzy the match should be. + * @property {boolean} [usePipeline] - Whether the term should be passed through the search pipeline. + * @property {number} [wildcard=lunr.Query.wildcard.NONE] - Whether the term should have wildcards appended or prepended. + * @property {number} [presence=lunr.Query.presence.OPTIONAL] - The terms presence in any matching documents. + */ + +/** + * Adds a {@link lunr.Query~Clause} to this query. + * + * Unless the clause contains the fields to be matched all fields will be matched. In addition + * a default boost of 1 is applied to the clause. + * + * @param {lunr.Query~Clause} clause - The clause to add to this query. + * @see lunr.Query~Clause + * @returns {lunr.Query} + */ +lunr.Query.prototype.clause = function (clause) { + if (!('fields' in clause)) { + clause.fields = this.allFields + } + + if (!('boost' in clause)) { + clause.boost = 1 + } + + if (!('usePipeline' in clause)) { + clause.usePipeline = true + } + + if (!('wildcard' in clause)) { + clause.wildcard = lunr.Query.wildcard.NONE + } + + if ((clause.wildcard & lunr.Query.wildcard.LEADING) && (clause.term.charAt(0) != lunr.Query.wildcard)) { + clause.term = "*" + clause.term + } + + if ((clause.wildcard & lunr.Query.wildcard.TRAILING) && (clause.term.slice(-1) != lunr.Query.wildcard)) { + clause.term = "" + clause.term + "*" + } + + if (!('presence' in clause)) { + clause.presence = lunr.Query.presence.OPTIONAL + } + + this.clauses.push(clause) + + return this +} + +/** + * A negated query is one in which every clause has a presence of + * prohibited. These queries require some special processing to return + * the expected results. + * + * @returns boolean + */ +lunr.Query.prototype.isNegated = function () { + for (var i = 0; i < this.clauses.length; i++) { + if (this.clauses[i].presence != lunr.Query.presence.PROHIBITED) { + return false + } + } + + return true +} + +/** + * Adds a term to the current query, under the covers this will create a {@link lunr.Query~Clause} + * to the list of clauses that make up this query. + * + * The term is used as is, i.e. no tokenization will be performed by this method. Instead conversion + * to a token or token-like string should be done before calling this method. + * + * The term will be converted to a string by calling `toString`. Multiple terms can be passed as an + * array, each term in the array will share the same options. + * + * @param {object|object[]} term - The term(s) to add to the query. + * @param {object} [options] - Any additional properties to add to the query clause. + * @returns {lunr.Query} + * @see lunr.Query#clause + * @see lunr.Query~Clause + * @example adding a single term to a query + * query.term("foo") + * @example adding a single term to a query and specifying search fields, term boost and automatic trailing wildcard + * query.term("foo", { + * fields: ["title"], + * boost: 10, + * wildcard: lunr.Query.wildcard.TRAILING + * }) + * @example using lunr.tokenizer to convert a string to tokens before using them as terms + * query.term(lunr.tokenizer("foo bar")) + */ +lunr.Query.prototype.term = function (term, options) { + if (Array.isArray(term)) { + term.forEach(function (t) { this.term(t, lunr.utils.clone(options)) }, this) + return this + } + + var clause = options || {} + clause.term = term.toString() + + this.clause(clause) + + return this +} +lunr.QueryParseError = function (message, start, end) { + this.name = "QueryParseError" + this.message = message + this.start = start + this.end = end +} + +lunr.QueryParseError.prototype = new Error +lunr.QueryLexer = function (str) { + this.lexemes = [] + this.str = str + this.length = str.length + this.pos = 0 + this.start = 0 + this.escapeCharPositions = [] +} + +lunr.QueryLexer.prototype.run = function () { + var state = lunr.QueryLexer.lexText + + while (state) { + state = state(this) + } +} + +lunr.QueryLexer.prototype.sliceString = function () { + var subSlices = [], + sliceStart = this.start, + sliceEnd = this.pos + + for (var i = 0; i < this.escapeCharPositions.length; i++) { + sliceEnd = this.escapeCharPositions[i] + subSlices.push(this.str.slice(sliceStart, sliceEnd)) + sliceStart = sliceEnd + 1 + } + + subSlices.push(this.str.slice(sliceStart, this.pos)) + this.escapeCharPositions.length = 0 + + return subSlices.join('') +} + +lunr.QueryLexer.prototype.emit = function (type) { + this.lexemes.push({ + type: type, + str: this.sliceString(), + start: this.start, + end: this.pos + }) + + this.start = this.pos +} + +lunr.QueryLexer.prototype.escapeCharacter = function () { + this.escapeCharPositions.push(this.pos - 1) + this.pos += 1 +} + +lunr.QueryLexer.prototype.next = function () { + if (this.pos >= this.length) { + return lunr.QueryLexer.EOS + } + + var char = this.str.charAt(this.pos) + this.pos += 1 + return char +} + +lunr.QueryLexer.prototype.width = function () { + return this.pos - this.start +} + +lunr.QueryLexer.prototype.ignore = function () { + if (this.start == this.pos) { + this.pos += 1 + } + + this.start = this.pos +} + +lunr.QueryLexer.prototype.backup = function () { + this.pos -= 1 +} + +lunr.QueryLexer.prototype.acceptDigitRun = function () { + var char, charCode + + do { + char = this.next() + charCode = char.charCodeAt(0) + } while (charCode > 47 && charCode < 58) + + if (char != lunr.QueryLexer.EOS) { + this.backup() + } +} + +lunr.QueryLexer.prototype.more = function () { + return this.pos < this.length +} + +lunr.QueryLexer.EOS = 'EOS' +lunr.QueryLexer.FIELD = 'FIELD' +lunr.QueryLexer.TERM = 'TERM' +lunr.QueryLexer.EDIT_DISTANCE = 'EDIT_DISTANCE' +lunr.QueryLexer.BOOST = 'BOOST' +lunr.QueryLexer.PRESENCE = 'PRESENCE' + +lunr.QueryLexer.lexField = function (lexer) { + lexer.backup() + lexer.emit(lunr.QueryLexer.FIELD) + lexer.ignore() + return lunr.QueryLexer.lexText +} + +lunr.QueryLexer.lexTerm = function (lexer) { + if (lexer.width() > 1) { + lexer.backup() + lexer.emit(lunr.QueryLexer.TERM) + } + + lexer.ignore() + + if (lexer.more()) { + return lunr.QueryLexer.lexText + } +} + +lunr.QueryLexer.lexEditDistance = function (lexer) { + lexer.ignore() + lexer.acceptDigitRun() + lexer.emit(lunr.QueryLexer.EDIT_DISTANCE) + return lunr.QueryLexer.lexText +} + +lunr.QueryLexer.lexBoost = function (lexer) { + lexer.ignore() + lexer.acceptDigitRun() + lexer.emit(lunr.QueryLexer.BOOST) + return lunr.QueryLexer.lexText +} + +lunr.QueryLexer.lexEOS = function (lexer) { + if (lexer.width() > 0) { + lexer.emit(lunr.QueryLexer.TERM) + } +} + +// This matches the separator used when tokenising fields +// within a document. These should match otherwise it is +// not possible to search for some tokens within a document. +// +// It is possible for the user to change the separator on the +// tokenizer so it _might_ clash with any other of the special +// characters already used within the search string, e.g. :. +// +// This means that it is possible to change the separator in +// such a way that makes some words unsearchable using a search +// string. +lunr.QueryLexer.termSeparator = lunr.tokenizer.separator + +lunr.QueryLexer.lexText = function (lexer) { + while (true) { + var char = lexer.next() + + if (char == lunr.QueryLexer.EOS) { + return lunr.QueryLexer.lexEOS + } + + // Escape character is '\' + if (char.charCodeAt(0) == 92) { + lexer.escapeCharacter() + continue + } + + if (char == ":") { + return lunr.QueryLexer.lexField + } + + if (char == "~") { + lexer.backup() + if (lexer.width() > 0) { + lexer.emit(lunr.QueryLexer.TERM) + } + return lunr.QueryLexer.lexEditDistance + } + + if (char == "^") { + lexer.backup() + if (lexer.width() > 0) { + lexer.emit(lunr.QueryLexer.TERM) + } + return lunr.QueryLexer.lexBoost + } + + // "+" indicates term presence is required + // checking for length to ensure that only + // leading "+" are considered + if (char == "+" && lexer.width() === 1) { + lexer.emit(lunr.QueryLexer.PRESENCE) + return lunr.QueryLexer.lexText + } + + // "-" indicates term presence is prohibited + // checking for length to ensure that only + // leading "-" are considered + if (char == "-" && lexer.width() === 1) { + lexer.emit(lunr.QueryLexer.PRESENCE) + return lunr.QueryLexer.lexText + } + + if (char.match(lunr.QueryLexer.termSeparator)) { + return lunr.QueryLexer.lexTerm + } + } +} + +lunr.QueryParser = function (str, query) { + this.lexer = new lunr.QueryLexer (str) + this.query = query + this.currentClause = {} + this.lexemeIdx = 0 +} + +lunr.QueryParser.prototype.parse = function () { + this.lexer.run() + this.lexemes = this.lexer.lexemes + + var state = lunr.QueryParser.parseClause + + while (state) { + state = state(this) + } + + return this.query +} + +lunr.QueryParser.prototype.peekLexeme = function () { + return this.lexemes[this.lexemeIdx] +} + +lunr.QueryParser.prototype.consumeLexeme = function () { + var lexeme = this.peekLexeme() + this.lexemeIdx += 1 + return lexeme +} + +lunr.QueryParser.prototype.nextClause = function () { + var completedClause = this.currentClause + this.query.clause(completedClause) + this.currentClause = {} +} + +lunr.QueryParser.parseClause = function (parser) { + var lexeme = parser.peekLexeme() + + if (lexeme == undefined) { + return + } + + switch (lexeme.type) { + case lunr.QueryLexer.PRESENCE: + return lunr.QueryParser.parsePresence + case lunr.QueryLexer.FIELD: + return lunr.QueryParser.parseField + case lunr.QueryLexer.TERM: + return lunr.QueryParser.parseTerm + default: + var errorMessage = "expected either a field or a term, found " + lexeme.type + + if (lexeme.str.length >= 1) { + errorMessage += " with value '" + lexeme.str + "'" + } + + throw new lunr.QueryParseError (errorMessage, lexeme.start, lexeme.end) + } +} + +lunr.QueryParser.parsePresence = function (parser) { + var lexeme = parser.consumeLexeme() + + if (lexeme == undefined) { + return + } + + switch (lexeme.str) { + case "-": + parser.currentClause.presence = lunr.Query.presence.PROHIBITED + break + case "+": + parser.currentClause.presence = lunr.Query.presence.REQUIRED + break + default: + var errorMessage = "unrecognised presence operator'" + lexeme.str + "'" + throw new lunr.QueryParseError (errorMessage, lexeme.start, lexeme.end) + } + + var nextLexeme = parser.peekLexeme() + + if (nextLexeme == undefined) { + var errorMessage = "expecting term or field, found nothing" + throw new lunr.QueryParseError (errorMessage, lexeme.start, lexeme.end) + } + + switch (nextLexeme.type) { + case lunr.QueryLexer.FIELD: + return lunr.QueryParser.parseField + case lunr.QueryLexer.TERM: + return lunr.QueryParser.parseTerm + default: + var errorMessage = "expecting term or field, found '" + nextLexeme.type + "'" + throw new lunr.QueryParseError (errorMessage, nextLexeme.start, nextLexeme.end) + } +} + +lunr.QueryParser.parseField = function (parser) { + var lexeme = parser.consumeLexeme() + + if (lexeme == undefined) { + return + } + + if (parser.query.allFields.indexOf(lexeme.str) == -1) { + var possibleFields = parser.query.allFields.map(function (f) { return "'" + f + "'" }).join(', '), + errorMessage = "unrecognised field '" + lexeme.str + "', possible fields: " + possibleFields + + throw new lunr.QueryParseError (errorMessage, lexeme.start, lexeme.end) + } + + parser.currentClause.fields = [lexeme.str] + + var nextLexeme = parser.peekLexeme() + + if (nextLexeme == undefined) { + var errorMessage = "expecting term, found nothing" + throw new lunr.QueryParseError (errorMessage, lexeme.start, lexeme.end) + } + + switch (nextLexeme.type) { + case lunr.QueryLexer.TERM: + return lunr.QueryParser.parseTerm + default: + var errorMessage = "expecting term, found '" + nextLexeme.type + "'" + throw new lunr.QueryParseError (errorMessage, nextLexeme.start, nextLexeme.end) + } +} + +lunr.QueryParser.parseTerm = function (parser) { + var lexeme = parser.consumeLexeme() + + if (lexeme == undefined) { + return + } + + parser.currentClause.term = lexeme.str.toLowerCase() + + if (lexeme.str.indexOf("*") != -1) { + parser.currentClause.usePipeline = false + } + + var nextLexeme = parser.peekLexeme() + + if (nextLexeme == undefined) { + parser.nextClause() + return + } + + switch (nextLexeme.type) { + case lunr.QueryLexer.TERM: + parser.nextClause() + return lunr.QueryParser.parseTerm + case lunr.QueryLexer.FIELD: + parser.nextClause() + return lunr.QueryParser.parseField + case lunr.QueryLexer.EDIT_DISTANCE: + return lunr.QueryParser.parseEditDistance + case lunr.QueryLexer.BOOST: + return lunr.QueryParser.parseBoost + case lunr.QueryLexer.PRESENCE: + parser.nextClause() + return lunr.QueryParser.parsePresence + default: + var errorMessage = "Unexpected lexeme type '" + nextLexeme.type + "'" + throw new lunr.QueryParseError (errorMessage, nextLexeme.start, nextLexeme.end) + } +} + +lunr.QueryParser.parseEditDistance = function (parser) { + var lexeme = parser.consumeLexeme() + + if (lexeme == undefined) { + return + } + + var editDistance = parseInt(lexeme.str, 10) + + if (isNaN(editDistance)) { + var errorMessage = "edit distance must be numeric" + throw new lunr.QueryParseError (errorMessage, lexeme.start, lexeme.end) + } + + parser.currentClause.editDistance = editDistance + + var nextLexeme = parser.peekLexeme() + + if (nextLexeme == undefined) { + parser.nextClause() + return + } + + switch (nextLexeme.type) { + case lunr.QueryLexer.TERM: + parser.nextClause() + return lunr.QueryParser.parseTerm + case lunr.QueryLexer.FIELD: + parser.nextClause() + return lunr.QueryParser.parseField + case lunr.QueryLexer.EDIT_DISTANCE: + return lunr.QueryParser.parseEditDistance + case lunr.QueryLexer.BOOST: + return lunr.QueryParser.parseBoost + case lunr.QueryLexer.PRESENCE: + parser.nextClause() + return lunr.QueryParser.parsePresence + default: + var errorMessage = "Unexpected lexeme type '" + nextLexeme.type + "'" + throw new lunr.QueryParseError (errorMessage, nextLexeme.start, nextLexeme.end) + } +} + +lunr.QueryParser.parseBoost = function (parser) { + var lexeme = parser.consumeLexeme() + + if (lexeme == undefined) { + return + } + + var boost = parseInt(lexeme.str, 10) + + if (isNaN(boost)) { + var errorMessage = "boost must be numeric" + throw new lunr.QueryParseError (errorMessage, lexeme.start, lexeme.end) + } + + parser.currentClause.boost = boost + + var nextLexeme = parser.peekLexeme() + + if (nextLexeme == undefined) { + parser.nextClause() + return + } + + switch (nextLexeme.type) { + case lunr.QueryLexer.TERM: + parser.nextClause() + return lunr.QueryParser.parseTerm + case lunr.QueryLexer.FIELD: + parser.nextClause() + return lunr.QueryParser.parseField + case lunr.QueryLexer.EDIT_DISTANCE: + return lunr.QueryParser.parseEditDistance + case lunr.QueryLexer.BOOST: + return lunr.QueryParser.parseBoost + case lunr.QueryLexer.PRESENCE: + parser.nextClause() + return lunr.QueryParser.parsePresence + default: + var errorMessage = "Unexpected lexeme type '" + nextLexeme.type + "'" + throw new lunr.QueryParseError (errorMessage, nextLexeme.start, nextLexeme.end) + } +} + + /** + * export the module via AMD, CommonJS or as a browser global + * Export code from https://github.com/umdjs/umd/blob/master/returnExports.js + */ + ;(function (root, factory) { + if (typeof define === 'function' && define.amd) { + // AMD. Register as an anonymous module. + define(factory) + } else if (typeof exports === 'object') { + /** + * Node. Does not work with strict CommonJS, but + * only CommonJS-like environments that support module.exports, + * like Node. + */ + module.exports = factory() + } else { + // Browser globals (root is window) + root.lunr = factory() + } + }(this, function () { + /** + * Just return a value to define the module export. + * This example returns an object, but the module + * can return a function as the exported value. + */ + return lunr + })) +})(); diff --git a/search/main.js b/search/main.js new file mode 100644 index 00000000..a5e469d7 --- /dev/null +++ b/search/main.js @@ -0,0 +1,109 @@ +function getSearchTermFromLocation() { + var sPageURL = window.location.search.substring(1); + var sURLVariables = sPageURL.split('&'); + for (var i = 0; i < sURLVariables.length; i++) { + var sParameterName = sURLVariables[i].split('='); + if (sParameterName[0] == 'q') { + return decodeURIComponent(sParameterName[1].replace(/\+/g, '%20')); + } + } +} + +function joinUrl (base, path) { + if (path.substring(0, 1) === "/") { + // path starts with `/`. Thus it is absolute. + return path; + } + if (base.substring(base.length-1) === "/") { + // base ends with `/` + return base + path; + } + return base + "/" + path; +} + +function escapeHtml (value) { + return value.replace(/&/g, '&') + .replace(/"/g, '"') + .replace(//g, '>'); +} + +function formatResult (location, title, summary) { + return ''; +} + +function displayResults (results) { + var search_results = document.getElementById("mkdocs-search-results"); + while (search_results.firstChild) { + search_results.removeChild(search_results.firstChild); + } + if (results.length > 0){ + for (var i=0; i < results.length; i++){ + var result = results[i]; + var html = formatResult(result.location, result.title, result.summary); + search_results.insertAdjacentHTML('beforeend', html); + } + } else { + var noResultsText = search_results.getAttribute('data-no-results-text'); + if (!noResultsText) { + noResultsText = "No results found"; + } + search_results.insertAdjacentHTML('beforeend', '

' + noResultsText + '

'); + } +} + +function doSearch () { + var query = document.getElementById('mkdocs-search-query').value; + if (query.length > min_search_length) { + if (!window.Worker) { + displayResults(search(query)); + } else { + searchWorker.postMessage({query: query}); + } + } else { + // Clear results for short queries + displayResults([]); + } +} + +function initSearch () { + var search_input = document.getElementById('mkdocs-search-query'); + if (search_input) { + search_input.addEventListener("keyup", doSearch); + } + var term = getSearchTermFromLocation(); + if (term) { + search_input.value = term; + doSearch(); + } +} + +function onWorkerMessage (e) { + if (e.data.allowSearch) { + initSearch(); + } else if (e.data.results) { + var results = e.data.results; + displayResults(results); + } else if (e.data.config) { + min_search_length = e.data.config.min_search_length-1; + } +} + +if (!window.Worker) { + console.log('Web Worker API not supported'); + // load index in main thread + $.getScript(joinUrl(base_url, "search/worker.js")).done(function () { + console.log('Loaded worker'); + init(); + window.postMessage = function (msg) { + onWorkerMessage({data: msg}); + }; + }).fail(function (jqxhr, settings, exception) { + console.error('Could not load worker.js'); + }); +} else { + // Wrap search in a web worker + var searchWorker = new Worker(joinUrl(base_url, "search/worker.js")); + searchWorker.postMessage({init: true}); + searchWorker.onmessage = onWorkerMessage; +} diff --git a/search/search_index.json b/search/search_index.json new file mode 100644 index 00000000..ebf1d438 --- /dev/null +++ b/search/search_index.json @@ -0,0 +1 @@ +{"config":{"indexing":"full","lang":["en"],"min_search_length":3,"prebuild_index":false,"separator":"[\\s\\-]+"},"docs":[{"location":"","text":"The source code for this page can be found on github . This page contains tutorials and generally useful information regarding packages and system administration in Fedora and Enterprise Linux (Rocky Linux, CentOS Stream). Quick Links \u00b6 Here are some quick links to solid documentation: Fedora Quick Docs Fedora Latest Release Docs Notes \u00b6 Due to the number of articles out there about disabling SELinux, we felt this note was important. Disabling SELinux is and almost always will be a terrible idea. See our antipatterns page as well as the Red Hat Enterprise Linux documentation, Fedora Docs, and Rocky Linux documentation.","title":"Linux Guide and Hints"},{"location":"#quick-links","text":"Here are some quick links to solid documentation: Fedora Quick Docs Fedora Latest Release Docs","title":"Quick Links"},{"location":"#notes","text":"Due to the number of articles out there about disabling SELinux, we felt this note was important. Disabling SELinux is and almost always will be a terrible idea. See our antipatterns page as well as the Red Hat Enterprise Linux documentation, Fedora Docs, and Rocky Linux documentation.","title":"Notes"},{"location":"archive/","text":"This section is for archives. Most of these pages were created by one of our late contributors and have not been updated since his passing. As such, we have moved most of them here as clean up.","title":"Archives"},{"location":"el/","text":"This section contains various articles on setups for Enterprise Linux and Fedora systems.","title":"Enterprise Linux"},{"location":"el/builds/","text":"This page goes over various ways that installs can be automated without the use of PXE. Instead, we can use templated scripts with pre-configured commands, boot images, and mirrors for builds. We cover the following here: CentOS Stream 9 Enterprise Linux 8, 9 Fedora openSUSE 15+ Windows Server","title":"Auto-Provisioning"},{"location":"el/freeipa/","text":"This page is a series of notes and information that goes over how to install and configure FreeIPA on Enterprise Linux 8/9 servers with replicas, as well as configuring client machines to connect and utilize FreeIPA resources, policies (eg sudo), and host based access control methods. We will also go over a scenario of configuring a trust with an Active Directory domain. The client setup will work for Fedora users as the packages are the same, just newer versions. Overview \u00b6 FreeIPA is an integrated security information management system combining Linux, a Directory Server (389), Kerberos, NTP, DNS, DogTag. It's a system that can be loosely compared to Active Directory in what it attempts to solve for Linux and UNIX clients and even mixed environments. While it is not an active directory, it is an integrated Identity and Authentication solution for Linux/UNIX environments, which means it does not support Windows clients. One problem that FreeIPA attempts to solve is giving back control to the Linux/UNIX administration teams of access, authentication, and authorization rather than trying to integrate directly into Active Directory, where the controls do not work the same or do not work at all. And because of this, no third party software is required to be installed. Requirements \u00b6 Here are the list of requirements below. Enterprise Linux 8+ or Fedora Linux An active internet connection to install the packages required or available internal mirrors 2 core, 4GB system with at least 10GB+ disk for /var/lib/dirsrv DNS domain delegation (if a DNS appliance or server already exists) Tutorial Preface, Notes, and Recommendations \u00b6 Potential Pitfalls! Leave SELinux enabled at all times. You will not run into SELinux issues FreeIPA runs better when it controls the DNS domain that it is given - It is recommended DNS is delegated or that FreeIPA run DNS entirely FreeIPA does not run DHCP. ISC DHCP can be configured to do dynamic DNS updates to FreeIPA or hosts can be configured to perform dynamic DNS updates Recommended Information Keep selinux set to enforcing DNS - You must be careful when using DNS. Here are recommendations. 1 Recommendation 1: FreeIPA runs your entire DNS for your network - This requires the DHCP servers to set the DNS servers to the IPA servers. This will be useful in the case that your clients will have their SSH keys added as SSHFP records to DNS when enrolled as clients. This also gives you the added benefit of a client updating its own DNS entries (A and PTR records) if the client is DHCP enabled and the IP changes if you so choose. Recommendation 2: FreeIPA is delegated a subdomain of a domain used already in the network - It's not required for hosts to live in the subdomain to be a member of the IPA domain, but you will lose out on kerberos SSO. Do not try to hijack a domain. Consider setting up a trust with Active Directory if you are in a mixed environment, eg Active Directory already exists - winsync is available, but deprecated and not recommended. IPA servers should have static assigned addresses - Configured via nmcli or directly in /etc/sysconfig/network-scripts/ifcfg-* Try to avoid running FreeIPA without DNS - while possible, you are creating higher maintenance Trust Information If you are in a mixed environment (both Windows and Linux/UNIX), it is recommended to setup a trust between FreeIPA and Active Directory. Because of this, they will need to be in different domains (eg, example.com and ipa.example.com, or example.com and example.net). This way, you do not have to create duplicate users if a windows user logs into Linux resources nor use winsync. DNS \u00b6 As noted in the previous section, you must try not to hijack a domain. You can migrate records over to FreeIPA's DNS if you'd like, but care must be taken with that approach. While FreeIPA can do the typical DNS server work such as forward/reverse zones and various types of records, it should not be considered a full solution. It does not support views (eg, you can't have internal and external views, assuming you have domains that are publically facing). In the event you need to have views, that's when you need a different DNS server or service to provide this to you. There are two ways you can have DNS entries updated dynamically: --enable-dns-updates for ipa-client-install and DHCP dynamic DNS updates. Both are sufficient. The latter requires additional work and is outside the scope of this write up. Delegation \u00b6 Throughout this guide, you may find or see examples of domain delegation where there is an AD trust, as it would be a more real world example of bringing in FreeIPA to an environment that is already in place, working, with a DNS hosted by AD or by an appliance. Majority of the examples assume both IPA and AD is delegated (when it's normally IPA that's just delegated while AD hosts the actual parent zone). Using this type of setup, it is not required for clients to have entries in the IPA domain. In fact, they can be in other domains as long as they have A/AAAA/PTR records associated with them. This assumes that there could be dynamic dns associated with DHCP or everything is static and lives in the parent zones. The caveat to this is SSO will fail . You can setup already existing DNS servers to delegate an entire domain or a subdomain for FreeIPA. This way, you don't overlap with a domain that's already in use. So for example, if AD owns example.com, you could have AD delegate ipa.example.com or even forward example.net. If AD is not the DNS provider for the environment, you can have the appliance delegate the domain in the same manner. Below is a bind example of what example.com would look like when delegating the IPA domain: $ORIGIN example.com. @ IN SOA ... ( ) NS np-ad01 NS np-ad02 np-ad01 A 10.200.0.232 np-ad02 A 10.200.0.233 ; Many other records here, pertaining to AD, eg msdcs and SRV records ; IPA records $ORIGIN ipa.example.com. @ NS np-ipa01 NS np-ipa02 np-ipa01 A 10.200.0.230 np-ipa02 A 10.200.0.231 Note that AD can send nsupdates to a DNS server if given the permissions. As of this writing, FreeIPA does not do this, which is why DNS delegation is recommended. Server Setup \u00b6 Required Packages \u00b6 ipa-server ipa-client (required as an IPA server is technically a client of the domain) ipa-server-dns (required for using the internal DNS) sssd/sssd-ipa (pulled in as dependencies) Optional Packages \u00b6 ipa-server-trust-ad if using an AD trust Installation \u00b6 To install the server, make sure the hostname is set to the A records and NS delegations you've put in DNS (which won't respond to a DNS lookup). If these are stand-alone, then you can just keep it at the top level (eg, example.com). You'll also need to modify /etc/hosts, set static IP addresses, and then run the ipa-server-install command. % hostnamectl set-hostname server1.ipa.example.com % nmcli con mod ens192 ipv4.address 10.200.0.230/24 % nmcli con mod ens192 ipv4.gateway 10.200.0.1 % nmcli con mod ens192 ipv4.method manual % nmcli con up ens192 % vi /etc/hosts . . . 10.200.0.230 server1.ipa.example.com 10.200.0.231 server2.ipa.example.com # Fedora % dnf install freeipa-server{,-common,-dns,-trust-ad} -y # Enterprise Linux 8 % dnf module enable idm:DL1/{dns,adtrust,client,server,common} % dnf install ipa-server ipa-server-dns ipa-client sssd sssd-ipa -y # Enterprise Linux 9 (there appears to be no modules) % dnf install ipa-server ipa-server-dns ipa-client sssd sssd-ipa -y # Setup # Enterprise 8 / 9 % firewall-cmd --permanent --add-service={freeipa-4,ntp,dns,freeipa-trust} % firewall-cmd --complete-reload % ipa-server-install \\ --no_hbac_allow \\ <-- If you want to have HBAC allow_all disabled initially --no-ntp \\ <-- If you want to host NTP from IPA, take off --no-ntp --setup-dns \\ --realm IPA.EXAMPLE.COM \\ --domain example.com . . . (show steps here) While not officially recommended, you could have two accounts. One for administration of servers and the domain and one for your workstation, similar to separating domain users and domain administrators in active directory. You don't have to follow this, but at least there's a form of separation. % kinit admin % ipa user-add --first=First --last=Last --cn=\"First Last Admin\" --gecos=\"First Last Admin\" flast2 % ipa group-add-member --users=flast2 admins Replica \u00b6 On the replica, ensure you repeat the same steps as above. % hostnamectl set-hostname server2.ipa.example.com % nmcli con mod ens192 ipv4.address 10.200.0.231/24 % nmcli con mod ens192 ipv4.gateway 10.200.0.1 % nmcli con mod ens192 ipv4.method manual % nmcli con up ens192 % vi /etc/hosts . . . 10.200.0.230 server1.ipa.example.com 10.200.0.231 server2.ipa.example.com % dnf install ipa-server ipa-server-dns ipa-client sssd sssd-ipa -y # Enterprise 8 / 9 % firewall-cmd --permanent --add-service={freeipa-4,ntp,dns,freeipa-trust} % firewall-cmd --complete-reload % ipa-replica-install --no-forwarders --setup-ca --setup-dns --no-ntp --principal admin --admin-password \"ChangePass123\" --domain ipa.example.com . . . (show steps) You should now be able to see your replicas. % ipa-replica-manage list server1.ipa.example.com: master server2.ipa.example.com: master Replica Automation \u00b6 It is possible to automate the replica installation. To automate the replica installation, the following requirements would need to be met: Server must be added as a client (ipa-client-install) with an IP address on the commandline Server must be added to the ipaservers host group ipa-replica-install ran without principal and passwords Once you have a server added as a client and then added to the ipaservers host group, you would run a command like this: % ipa-replica-install --ssh-trust-dns --unattended --setup-ca --mkhomedir --setup-dns --no-forwarders If you have forwarders, use the --forwarders option instead. Server Migration/Upgrade \u00b6 Performing a migration is a multi-step process. Typically you are going from one major version of Enterprise Linux (such as 7 or 8) to another (such as 9). Regardless of which version you are migrating from, the typical beginning steps are: System's time is verified for time synchronization like using ntpstat or equivalent Server roles are verified in the current environment using ipa server-role-find --status enabled --server ipa.example.com New system is installed and enrolled as a client New system is added as a replica with required server roles EL7 to EL9 / Two Major Version Jumps When jumping from EL7 to EL9 or two major versions in general, it is recommended that you have an \"in between\" machine. This means that you need to add the in between version first and then you can add the latest version. See this page for an example. The below is in the case of a single master installation and doesn't take into account of multiple version jumps. Let's say you have two old Enterprise Linux replicas instead. There are two approaches you can take: Install a new Enterprise Linux system, add it, reinstall old system to the new version, add it back. Install two new Enterprise Linux systems, add them as needed, power off old systems. Below is an example, with X being the old version, and Y being the new. Enterprise Linux Y system is installed and enrolled as a client Enterprise Linux Y system is added as a replica Change CRL to Enterprise Linux Y system and adjust settings on Enterprise Linux X CA master and new Enterprise Linux Y replica for pki-tomcatd and httpd Test user is created to ensure DNA range is adjusted Verify DNA range Stop first Enterprise Linux X IPA services, remove replica, uninstall, power off. Second Enterprise Linux Y system is installed and enrolled as a client Second Enterprise Linux Y system is added as a replica Test user is created again to ensure DNA range is adjusted Verify DNA range Stop second Enterprise Linux X IPA services, remove replica, uninstall, power off. EL7 to EL8 \u00b6 # Enterprise Linux 8 % dnf module enable idm:DL1 # Install necessary packages, ie AD trust packages if you need them % dnf install ipa-server ipa-server-dns -y % ipa-client-install --realm EXAMPLE.COM --domain example.com % kinit admin # Add other switches that you feel are necessary, such as forwarders, kra, ntp... % ipa-replica-install --setup-dns --setup-ca --ssh-trust-dns --mkhomedir # Verify all services are in a RUNNING state % ipactl status Directory Service: RUNNING . . . % ipa-csreplica-manage list elX.example.com: master elY.example.com: master % ipa-csreplica-manage list --verbose elY.example.com Directory Manager password: elX.example.com last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2019-11-07 22:46:15+00:00 Change CRL to new Enterprise Linux system and adjust settings on both replicas for pki-tomcatd and httpd # Change CA master to elY % ipa config-mod --ca-renewal-master-server elY.example.com # Shut down all CRL generation on ELX elX% ipa-crlgen-manage status CRL generation: enabled . . . elX% ipa-crlgen-manage disable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable. The ipa-crlgen-manage command was successful # Verify that the /etc/httpd/conf.d/ipa-pki-proxy.conf file's RewriteRule is not commented # If it is, remove the comment and restart httpd. ipa-crlgen-manage should take care of this. % tail -n 1 /etc/httpd/conf.d/ipa-pki-proxy.conf RewriteRule ^/ipa/crl/MasterCRL.bin https://elX.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC] # Turn it on with ELY elY% systemctl stop pki-tomcatd@pki-tomcat.service # The values should be changed from false to true elY% vi /etc/pki/pki-tomcat/ca/CS.cfg ca.crl.MasterCRL.enableCRLCache=true ca.crl.MasterCRL.enableCRLUpdates=true elY% systemctl start pki-tomcatd@pki-tomcat.service # Make sure the rewrite rule has a comment on elY elY% vi /etc/httpd/conf.d/ipa-pki-proxy.conf . . . #RewriteRule ^/ipa/crl/MasterCRL.bin https://elY.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC] elY% systemctl restart httpd Test user is created to ensure DNA range is adjusted and replication is working % ipa user-add --first=testing --last=user testinguser1 # Test on both systems elX% ipa user-find testinguser1 elY% ipa user-find testinguser1 Verify DNA range # There should be ranges for both replicas % ipa-replica-manage dnarange-show elX.example.com: ... elY.example.com: ... Stop old Enterprise Linux IPA services, remove replica, uninstall # Stop all elX services elX% ipactl stop # Delete the elX system from the topology elY% ipa server-del elX.example.com # Uninstall and/or power down system elX% ipa-server-install --uninstall elX% init 0 EL8 to EL9 \u00b6 # Enterprise Linux 9 % dnf install ipa-server ipa-server-dns -y % ipa-client-install --realm EXAMPLE.COM --domain example.com % kinit admin # Add other switches that you feel are necessary, such as forwarders, kra, ntp... % ipa-replica-install --setup-dns --setup-ca --ssh-trust-dns --mkhomedir # Verify all services are in a RUNNING state % ipactl status Directory Service: RUNNING . . . % ipa-csreplica-manage list elX.example.com: master elY.example.com: master % ipa-csreplica-manage list --verbose elY.example.com Directory Manager password: elX.example.com last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2022-08-12 18:11:11+00:00 Set the CA renewal master to the new system and change the CRL settings % ipa config-mod --ca-renewal-master-server elY.example.com # Remove the ca.certStatusUpdateInterval entry or set it to 600 (default) on elY elY% vim /etc/pki/pki-tomcat/ca/CS.cfg # Restart the ipa services elY% ipactl restart # Set the value of ca.certStatusUpdateInterval on elX to 0 elX% vim /etc/pki/pki-tomcat/ca/CS.cfg ca.certStatusUpdateInterval=0 elX% ipactl restart elX% ipa-crlgen-manage status CRL generation: enabled . . . elX% ipa-crlgen-manage disable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable. The ipa-crlgen-manage command was successful elX% ipa-crlgen-manage status CRL generation: disabled Create a test user to ensure DNA range is adjusted and replication is working elY% ipa user-add --first=testing --last=user testinguser1 # Test on both systems elX% ipa user-find testinguser1 elY% ipa user-find testinguser1 Verify DNA range. # There should be ranges for both replicas % ipa-replica-manage dnarange-show elX.example.com: ... elY.example.com: ... Stop old Enterprise Linux IPA services, remove replica, uninstall. # Stop all elX services elX% ipactl stop # Delete the elX system from the topology elY% ipa server-del elX.example.com # Uninstall and/or power down system elX% ipa-server-install --uninstall elX% init 0 See this page for more information. Active Directory Trust \u00b6 To initiate a trust with your active directory domain, ensure the following requirements are met. Requirements Package installed: ipa-server-trust-ad DNS: Properly configured that FreeIPA can resolve the AD servers A and SRV records This can either be forwarders to AD, a subdomain that IPA manages, or delegated subdomain from the master DNS servers in your network. This is completely dependent on your infrastructure. DNS: AD forest has sites and SRV records, including priorities, are set correctly When the following requirements are met, you have two choices before continuning. You can either use POSIX or have the id range generated automatically. POSIX vs Non-POSIX If you decide to use POSIX, your AD users are expected to have uidNumber, gidNumber, loginShell, unixHomeDirectory set. Else, you will need to setup ID overrides if you already have that information for current users (assuming this is not a new setup for the environment, ie you already have UID's for people). If you are not planning a migration from pure AD over to IPA with a trust, it is recommended to note that information so you can setup the ID overrides. Afterwards, any new users will get UID/GID's that you will not have to manage yourself. You will need to prep your master(s) for the trust. We will be enabling compat, adding sids, and adding agents so both masters can provide AD information. % ipa-adtrust-install --add-sids --add-agents --enable-compat This will do what we need. If you do not have legacy clients (Enterprise Linux 5, Solaris, HP-UX, AIX, SLES 11.4, FreeBSD, the list goes on), then you do not need to enable compat mode. Though, it could be useful to have it for certain apps or scenarios. You will now need to open the necessary ports. Do this on all masters. Ports TCP: 135, 138, 139, 389, 445, 1024-1300, 3268 UDP: 138, 139, 389, 445 % firewall-cmd --add-service=freeipa-trust --permanent % firewall-cmd --complete-reload Now you can initiate the trust. The admin account you use should be part of the domain admins group or at least have permissions to initiate a trust. The former is path of least resistance. # If you are using POSIX ID, use ipa-ad-trust-posix. % ipa trust-add --type=ad example.com --range-type=ipa-ad-trust --admin adminaccount --password Once the trust is up, verify it. % ipa trust-show example.com Realm name: example.com Domain NetBIOS name: AD Domain Security Identifier: S-X-X-XX-XXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX Trust direction: Trusting forest Trust type: Active Directory domain UPN suffixes: example.com You should be able to test for the users now. % id aduser1@example.com uid=XXXXX(aduser1@example.com) gid=XXXXX(aduser1@example.com) groups=XXXXX(aduser1@example.com) Disable Anonymous Bind \u00b6 In some cases, it is a requirement to disable all anonymous binds. If this is the case, you will need to modify cn=config on each master as it is not replicated. rootdse Some applications do anonymous binds to the directory server to determine its version and it supported controls. While it is possible to disable anonymous binds completely, it is important to know that if you disable the rootdse binds, applications that do anonymous lookups to get server information will fail. % ldapmodify -xZZ -D \"cn=Directory Manager\" -W -h server.ipa.example.com Enter LDAP Password: dn: cn=config changetype: modify replace: nsslapd-allow-anonymous-access nsslapd-allow-anonymous-access: rootdse modifying entry \"cn=config\" Client Setup \u00b6 Enterprise Linux & Fedora \u00b6 Ensure your /etc/resolv.conf (or other dns settings) are set correctly. Ensure your hostname is also set correctly. % dnf install ipa-client -y % ipa-client-install --realm EXAMPLE.COM --domain example.com --mkhomedir Mac Clients \u00b6 MacOS Clients are an interesting workstation to setup as a FreeIPA client. It takes a little bit of fighting and troubleshooting, but it can work with the right settings. Note that as of Catalina, you may not be able to login to your account nor will creating a mobile account function as you would expect. This may have changed in recent macos releases, so YMMV. Other Guides There are a couple of guides out there that you may have found before (if you looked) that help setup IPA for Mac. There's one for much older (I think Lion) and one for Sierra. This section was made mostly for my own reference because I found some things in both of those guides didn't address issues I ran into one way or another and couldn't find any information on. The FreeIPA users mail list didn't have any archives with people having similar issues. If you are interested in the other guides to compare to, you may see them here (recent) and here (older) AD Users AD Users You cannot login as AD users on a Mac when going through FreeIPA. You can, in theory, point to the cn=compat tree and set the attribute mapping to rfc2307. In my tests, I have never been able to get this to work. This section, I am going to assume you are going to be logging in as a user in IPA. If you are in a mixed environment, add your Mac to your AD domain instead. Anonymous Bind There may be cases where if you have disabled anonymous binds in IPA, this setup may not work, even if you do use a bind account. You will need to experiment with this if you plan on using a bind account and plan on or currently have IPA not allowing anonymous binds. Check your system's hostname. You want to make sure it has a hostname defined for it in the domain the mac sits in, even if it's dynamic via DHCP/DNS. % sudo scutil --set HostName mac.example.com Get the IPA certificate. You'll need to double click it after you get it and import it. % cd ~/Desktop && curl -OL http://server1.ipa.example.com/ipa/config/ca.crt % sudo mkdir /etc/ipa % sudo cp ca.crt /etc/ipa/ca.crt % sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /etc/ipa/ca.crt On the IPA server, you will need to create a host and get the keytab. % ipa host-add mac.example.com --macaddress=\"00:00:00:00:00:00\" % ipa-getkeytab -s server1.ipa.example.com -p host/mac.example.com -k /tmp/krb5.keytab You will need to transfer that keytab to your mac. % cd ~ % scp user@server1.ipa.example.com:/tmp/krb5.keytab . % sudo mv krb5.keytab /etc/krb5.keytab % sudo chmod 600 /etc/krb5.keytab % sudo chown root:wheel /etc/krb5.keytab Configure /etc/krb5.conf [domain_realm] .ipa.example.com = IPA.EXAMPLE.COM ipa.example.com = IPA.EXAMPLE.COM [libdefaults] default_realm = IPA.EXAMPLE.COM allow_weak_crypto = yes dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = yes renewable = true [realms] IPA.EXAMPLE.COM = { # You don't need to set these when your DNS is setup correctly, but it doesn't hurt to have a reference. # In my opinion, you shouldn't hardcode these values. You have to have a good reason to. #kdc = tcp/server1.ipa.example.com #kdc = tcp/server2.ipa.example.com #admin_server = tcp/server1.ipa.example.com #admin_server = tcp/server2.ipa.example.com pkinit_anchors = FILE:/etc/ipa/ca.crt } You'll want to do a kinit to verify. If it works, you should be able to go to the FreeIPA webui and check that the host is \"enrolled\" (Identity -> Hosts). % kinit username@IPA.EXAMPLE.COM You need to modify a couple of pam files. I'll explain why they need to be changed. % sudo vi /etc/pam.d/authorization # authorization: auth account # Putting krb5 here twice ensures that you can login via kerberos and also get a keytab # If \"no_ccache\" is here, keytabs will not be available on login auth optional pam_krb5.so use_first_pass use_kcminit default_principal auth sufficient pam_krb5.so use_first_pass default_principal auth required pam_opendirectory.so use_first_pass nullok account required pam_opendirectory.so % sudo vi /etc/pam.d/screensaver # The krb5 changes do similar to the authorization when on the lock screen after a sleep #auth optional pam_krb5.so use_first_pass use_kcminit auth optional pam_krb5.so use_first_pass use_kcminit default_principal auth sufficient pam_krb5.so use_first_pass default_principal auth required pam_opendirectory.so use_first_pass nullok account required pam_opendirectory.so account sufficient pam_self.so account required pam_group.so no_warn group=admin,wheel fail_safe account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe % sudo vi /etc/pam.d/passwd # Helps with kerberos logins password sufficient pam_krb5.so auth required pam_permit.so account required pam_opendirectory.so password required pam_opendirectory.so session required pam_permit.so After these changes, you'll need to go into make some changes with the directory utility. This depends on your macOS version. Monterey and older \u00b6 Go to system preferences -> users & groups -> login options - Click the 'lock' to make changes Set the following: Automatic login: Off Display login window as: Name and Password Show fast user switching menu as: Full Name Click \"Join\" next to \"Network Account Server\" Enter one of your IPA servers (you can duplicate it later for backup purposes) and click Continue. Ensure \"Allow network users to log in at login window\" is checked - Make sure it's set to all users Click \"edit\" next to the \"Network Account Server\" Click \"Open Directory Utility\" Click the lock, edit LDAPv3 Select your server and click \"edit\" Set the following options: Open/close times out in 5 seconds Query times out in 5 seconds Connection idles out in 1 minute (this can't be changed) Encrypt using SSL (selected) Click \"Search & Mappings\" You may either select \"rfc2307\" from the dropdown or select custom. It will ask your base DN (eg, dc=ipa,dc=example,dc=com) If you select rfc2307, it will ask for your base DN (eg, dc=ipa,dc=example,dc=com) If you select \"custom\", you will need to do this manually for each record type. You're better off using rfc2307 and working from there Click the \"+\" to add a groups record type or scroll and find \"groups\". Select \"groups\", and ensure the following object classes exist. You can click the \"+\" to add them when needed. Record Type ObjectClasses Groups posixGroup ipausergroup groupOfNames\\* Note \"groupOfNames\" is optional here, because it seems that the directory utility doesn't understand this concept. Expand \"groups\" and ensure the following for each record type. You can click the \"+\" to add the attribute types as needed. Attribute Mapping PrimaryGroupID gidNumber RecordName cn Click the \"+\" to add a users record type or scroll and find \"users\". Select \"users\" and ensure the following object classes exist. You can click the \"+\" to add them when needed. Record Type ObjectClasses Users inetOrgPerson posixAccount shadowAccount apple-user Expand \"users\" and ensure the following for each record type. You can click the \"+\" to add the attribute types as needed. Do not set homeDirectory otherwise you will fail to login. Attribute Mapping AuthenticationAuthority uid GeneratedUID GeneratedUID or ipaUniqueID HomeDirectory #/Users/\\$uid\\$ NFSHomeDirectory #/Users/\\$uid\\$ PrimaryGroupID gidNumber RealName cn RecordName uid UniqueID uidNumber UserShell loginShell AltSecurityIdentities #Kerberos:\\$krbPrincipalName\\$ If using custom mapping, click reach record type you created and ensure the base DN is set. Make sure each record type is set to all subtrees. Click \"security\" and set an authentication bind DN if needed Click OK Click OK Click on Search Policy. Double check that \"/LDAPV3/server1.ipa.example.com\" is listed beneath \"/Local/Default\" Close everything until you're back to the users & groups section of preferences Open a terminal. % dscacheutil -flushcache % dscacheutil -q user -a name username You should get a return. If you want to further verify users and groups after the above succeeds, open up the directory utility again. Click \"Directory Editor\", ensure you are searching for \"users\" and check that they appear in a list on the right hand side, optionally doing a search. In a default setup, you shouldn't need an account to do (some) anonymous lookups. If you changed that in any way, you will need to create a readonly system account in cn=sysaccounts,cn=etc. Login to the account for the first time from the login screen. Once the setup has complete, log out and back to a login account. In a terminal, you will need to make a mobile account. 2 % sudo /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -P # Press enter and put in the password. sudo may not function if you don't do this step. # OPTIONAL: Allow the mobile account to be an administrator % sudo dscl . -append /Groups/admin GroupMembership username Go to system preferences, users & groups and ensure the account is a mobile account. Ventura and likely newer \u00b6 Go to system preferences -> users & groups Set \"automatic login\" to \"off\" Click \"edit\" next to \"Network account server\" Type in one of your IPA servers (you can duplicate it later for backup purposes). Press enter and wait for it to be \"green\". Click \"Open Directory Utility\" Click the \"lock\" to unlock the utility Click \"LDAPv3\" and click the pencil at the bottom left corner Select the \"from server\" portion under LDAP mappings and clck RFC2307. You may also leave it as custom. If you select rfc2307, it will ask for your base DN (eg, dc=ipa,dc=example,dc=com) If you select \"custom\", you will need to do this manually for each record type. You're better off using rfc2307 and working from there Click \"edit\" Click the \"+\" to add a groups record type or scroll and find \"groups\" and select it. Add the following object classes Record Type ObjectClasses Groups posixGroup ipausergroup groupOfNames\\* Note \"groupOfNames\" is optional here, because it seems that the directory utility doesn't understand this concept. Expand \"groups\" and ensure the following for each record type. You can click the \"+\" to add the attribute types as needed. Attribute Mapping PrimaryGroupID gidNumber RecordName cn Click the \"+\" to add a users record type or scroll and find \"users\". Select \"users\" and ensure the following object classes exist. You can click the \"+\" to add them when needed. Record Type ObjectClasses Users inetOrgPerson posixAccount shadowAccount apple-user Expand \"users\" and ensure the following for each record type. You can click the \"+\" to add the attribute types as needed. Do not set homeDirectory otherwise you will fail to login. Attribute Mapping AuthenticationAuthority uid GeneratedUID GeneratedUID or ipaUniqueID NFSHomeDirectory #/Users/\\$uid\\$ PrimaryGroupID gidNumber RealName cn RecordName uid UniqueID uidNumber UserShell loginShell AltSecurityIdentities #Kerberos:\\$krbPrincipalName\\$ If using custom mapping, click reach record type you created and ensure the base DN is set. Make sure each record type is set to all subtrees if needed. Click \"security\" and set an authentication bind DN if needed Click OK. Click Search Policy Double check that \"/LDAPV3/server1.ipa.example.com\" is listed beneath \"/Local/Default\". If it is not, select \"search patch\" and set it to custom and add it. Click Apply after. Close everything until you're back to the users & groups section of preferences Go to Lock Screen. Set \"login window shows\" to \"name and password\" Open a terminal. % dscacheutil -flushcache % dscacheutil -q user -a name username You should get a return. Login to the account for the first time from the login screen. Once the setup has complete, log out and back to a login account. In a terminal, you will need to make a mobile account. 3 % sudo /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -P # Press enter, enter the user's password. sudo may hang if you don't do this. # OPTIONAL: Allow the mobile account to be an administrator % sudo dscl . -append /Groups/admin GroupMembership username Go to system preferences and ensure the account is a mobile account. General macOS Notes \u00b6 Group Resolution If you want groups from IPA to resolve to the system, you'll need to enable the compat tree when using this setup (RFC2307). Password Notes There are a couple of potential issues with this setup that you should be aware of as it pertains to mobile accounts. If you do a mobile account, changing your password through the FreeIPA gui does not change your passwords on your system. If your account does not have any keytabs (eg, you haven't had your mac on or haven't logged in in over 24 hours), you can login with the new password and it will suceed. The system will cache the new password right away. However, your keychain the first time will ask for the old passwords and this is normal. So you can change them by hand or you can log out and back in and the system will ask you if you want to update the password and it will just update automatically. There have been reports in a github issue that states you can change the password in the system preferences but I've been unable to confirm this. Below is a script that can be adapted for you. It has not been tested on Monterey and up. This assumes that you took one mac and set it up properly and you created a tarball with the proper configuration. You could optionally setup a temporary NFS or samba mount that gets mounted as root and then unmounted at the end, if you so wish. #!/bin/bash serverName=server1.ipa.example.com krb5Conf=/etc/krb5.conf krb5Tab=/etc/krb5.keytab pamDirectory=/etc/pam.d # Add SSL cert to chain mkdir /etc/ipa cd /etc/ipa curl -OL http://$serverName/ipa/config/ca.crt security add-trusted-cert -d -k /Library/Keychains/System.keychain -r trustRoot /etc/ipa/ca.crt # Stop and flushout the Open Directory /usr/sbin/dscacheutil -flushcache launchctl unload /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist # Pull the plist and pam files needed for IPA and deploy them, this assumes you setup one mac and zipped up the configurations # You can try your hand at dsconfigldap before pam, but I could never figure it out, honestly. # Relevant tar: tar czf /tmp/macconfig.tar.gz /Library/Preferences/OpenDirectory/Configurations /etc/pam.d/authorization \\ # /etc/pam.d/screensaver /etc/pam.d/passwd /etc/krb5.conf cd /tmp curl -OL http://$serverName/macconfig.tar.gz cd / tar xzf /tmp/macconfig.tar.gz # Add steps here for your keytab! Where are you getting it from? cp /tmp/mac.keytab /etc/krb5.keytab chown root:wheel /etc/krb5.keytab chmod 600 /etc/krb5.keytab # Start directory launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist sleep 30 # Kill the loginwindow killall loginwindow # If the system doesn't reboot here, reboot now. If you want to move your local files, you will need to tread lightly here. I personally believe it's always good to start fresh though. Look into the ditto command. I suppose something like this can work: # make sure you're logged in as a different account away from your local account % sudo su - root# cd /Users root# ditto localfolder networkfolder (or maybe an mv?) root# chown -R user:user folder root# /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -P Another issue you may run into, if you have been using your Mac with a local account for a while, a lot of directories in /Applications will be owned by localuser:staff or localuser:admin. It's recommended to fix those too. Discovery The directory framework in MacOS has the ability to discover settings for a particular LDAP server that it is being connected to. FreeIPA does not contain the schema, plugins, nor the infrastructure to provide the same things (for example, mDNS/Avahi, among other things). There was a (WIP) plugin created in 2017 by abbra. However, it is unclear if this works at all, nor is it clear if it ever did and will in python3 (abbra noted at the time that it \"installs\" into python 2 directories, which hints to not being tested or working on python 3). Please see the following resources for discussion and information. Pagure freeipa-macosx-support SUSE \u00b6 To setup openSUSE with FreeIPA, we'll need to do some manual work. This applies to SUSE 12 and up where the freeipa-client packages don't exist in the main repositories. freeipa repos There are OpenSUSE repos with the freeipa packages, though they are considered \"experimental\". If they show up in the base, then the below steps will be removed. However, if you are willing to use the repo , a lot of the steps below may not be needed. We have not tested this. # On an IPA server or client with the IPA utilities... % ipa host-add suse.example.com % /usr/sbin/ipa-getkeytab -s ipa.example.com -p host/suse.example.com -k /tmp/suse.keytab % scp /tmp/suse.keytab suse.example.com:/tmp/krb5.keytab # On the IPA client... % cp /tmp/krb5.keytab /etc % chmod 600 /etc/krb5.keytab % mkdir /etc/ipa % curl -o /etc/ipa/ca.crt http://ipa.example.com/ipa/config/ca.crt % curl -o /etc/pki/trust/anchors/ipa.example.com.crt http://ipa.example.com/ipa/config/ca.crt % update-ca-certificates % zypper install sssd sssd-ipa yast2-auth-client krb5-client openldap2-client cyrus-sasl-gssapi # Setup SSSD % vi /etc/sssd/sssd.conf [domain/example.com] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = example.com ipa_hostname = suse.example.com # Client Specific Settings ipa_server = _srv_, ipa.example.com dns_discovery_domain = example.com # If we have a trust with domain resolution order #full_name_format = %1$s id_provider = ipa auth_provider = ipa access_provider = ipa chpass_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, sudo, pam, ssh domains = example.com [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,tomcat,postgres homedir_substring = /home [pam] [sudo] [autofs] [ssh] # Setup kerberos % vi /etc/krb5.conf [libdefaults] default_realm = EXAMPLE.COM dns_lookup_realm = true dns_lookup_kdc = true rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] EXAMPLE.COM = { pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM suse.example.com = EXAMPLE.COM # Setup pam % pam-config -a --sss --mkhomedir --mkhomedir-umask=0077 \\ --pwhistory --pwhistory-remember=5 --localuser --cracklib \\ --cracklib-minlen=14 --cracklib-dcredit=-1 --cracklib-ucredit=-1 \\ --cracklib-lcredit=-1 --cracklib-ocredit=-1 --cracklib-retry=3 --unix-sha512 # Setup nsswitch (you can make it compat sss, but I use files sss) % sed -i.bak 's/compat$/files sss/g' /etc/nsswitch.conf % echo \"sudoers: files sss\" >> /etc/nsswitch.conf % sed -i '/netgroup/ s/nis/sss/g' /etc/nsswitch.conf # Depending on your suse version, you may want to set the nisdomainname # It does not hurt to set this % sed -i.bak '/NETCONFIG_NIS_STATIC_DOMAIN/ s/\"\"/\"example.com\"/g' /etc/sysconfig/network/config % netconfig update -f # Start sssd % systemctl enable sssd --now # Verify % id admin In the case of having an IPA-AD trust, you may need to change a line in your pam configuration. % sed -i 's/use_first_pass/forward_pass/g' /etc/pam.d/common-auth-pc # The affected line should appear like the below auth sufficient pam_sss.so forward_pass HBAC \u00b6 When we first setup our IPA servers, we had an option set to make it so hbac wasn't allowed for everyone. This way we have to create HBAC rules for our systems. I personally do this out of habit when working with IPA. What we need to do though is create an \"admin\" group that can login to all machines. % ipa idrange-show IPA.EXAMPLE.COM_id_range Range name: IPA.EXAMPLE.COM_id_range First Posix ID of the range: 686600000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range type: local domain range % ipa group-add --gid=686610000 linuxadm % ipa group-add-member --users=flast linuxadm Note for AD Users : In the event that your AD user or group of users will be an admin, you need to create an \"external\" group to map the user or users over. This isn't required if you don't have an AD trust. # Create an external group that the AD user/group goes into % ipa group-add --external linuxadm_external # Add the user (or group) into the external group % ipa group-add-member --users=aduser1@example.com linuxadm_external % ipa group-add-member --users=adgroup1@example.com linuxadm_external # Add the external group as a member of the IPA posix group. # aduser1 and adgroup1 are now effectively members of the linuxadm group in IPA. % ipa group-add-member --groups=linuxadm_external linuxadm Now, let's create an HBAC for our Linux Administrator account for our group. % ipa hbacrule-add --hostcat=all --servicecat=all --desc='linux admins all access' linuxadm % ipa hbacrule-add-user --groups=linuxadm linuxadm % ipa hbactest --rules=All_Systems --user=flast --host=server1.ipa.example.com --service=sshd % ipa hbactest --rules=All_Systems --user=aduser1@example.com --host=server1.ipa.example.com --service=sshd You might want to create an HBAC rule specifically for your IPA admin accounts to have ssh access to the IPA servers too. You can follow something like the above to make it possible. Or you can just add the IPA admins group into the HBAC rule we just made above. Group Types Groups in Active Directory have three types. These three types can actually change the behavior of how SSSD on the IPA domain controllers resolve them or if they'll even be resolvable at all. The three types are 'Domain Local', 'Global', and 'Universal'. If at all possible, avoid groups being 'Global'. Domain Local or Universal is recommended. SUDO \u00b6 Setting up sudo is relatively easy. SSSD (1.16.x and 2.X) supports IPA as a provider for sudo. Based on the last section, let's create a sample rule for our Linux admins that can login to every system, we want to ensure they can run all commands. % ipa sudorule-add --runasusercat=all --hostcat=all --cmdcat=all --desc='linux admins all sudo' all_linux_sudo % ipa sudorule-add-user --groups=linuxadm all_linux_sudo You can make this a little more specific, such as /bin/bash as everyone or otherwise. It's your call here. If you want to create a sudo rule and add some commands to it, you can do something like this. % ipa sudorule-add sudo_rule % ipa sudorule-add-allow-command --sudocmds=\"/usr/bin/less\" sudo_rule Legacy Client Setup \u00b6 This applies to Solaris, Omnios, others based on Illumos. Solaris 10 \u00b6 Setting up Solaris 10 as an IPA client is an interesting feat. However, it comes with security issues. No SSL or TLS Support Note that for Solaris 10 to talk to IPA, you must use clear text communication. Solaris 10 is too old to use new ciphers. However, while LDAP may be clear text, kerberos should still be secure enough for the time being. If you are using an AD trust, the user's passwords will be passed in clear text. Highly suggested that you decommission Solaris 10 from your environment. Solaris 10 will eventually be removed from this page. Create an ldif for your service account (optional) dn: uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com objectclass: account objectclass: simplesecurityobject uid: solaris userPassword: secret123 passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 The solaris system account is required. So now, add it in. % ldapadd -xWD 'cn=Directory Manager' -f /tmp/solaris.ldif Now, set the nisdomain. % defaultdomain ipa.example.com % echo 'ipa.example.com' > /etc/defaultdomain Configure kerberos. % vi /etc/krb5/krb5.conf [libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_kdc = true verify_ap_req_nofail = false [realms] IPA.EXAMPLE.COM = { } [domain_realm] ipa.example.com = IPA.EXAMPLE.COM .ipa.example.com = IPA.EXAMPLE.COM [logging] default = FILE:/var/krb5/kdc.log kdc = FILE:/var/krb5/kdc.log kdc_rotate = { period = 1d version = 10 } [appdefaults] kinit = { renewable = true forwardable= true } Generate a keytab and bring it over. # on the ipa server % ipa host-add solaris10.example.com % ipa-getkeytab -s server1.ipa.example.com -p host/solaris10.example.com -k /tmp/solaris10.keytab # Transfer the keytab % scp /tmp/solaris10.keytab solaris10.example.com:/tmp # On the solaris 10 machine % cp /tmp/solaris10.keytab /etc/krb5/krb5.keytab % chmod 600 /etc/krb5/krb5.keytab % chmod 644 /etc/krb5/krb5.conf % chown root:sys /etc/krb5/* % kinit flast2@IPA.EXAMPLE.COM Create the LDAP configurations, bring the certificate, and create an NSS database. % mkdir /etc/ipa /var/ldap % cd /etc/ipa % wget -O ipa.pem http://server1.ipa.example.com/ipa/config/ca.crt % certutil -A -n \"ca-cert\" -i /etc/ipa/ipa.pem -a -t CT -d . % cp * /var/ldap % vi /etc/ldap.conf base dc=ipa,dc=example,dc=com scope sub TLS_CACERTDIR /var/ldap TLS_CERT /var/ldap/cert8.db TLS_CACERT /var/ldap/ipa.pem tls_checkpeer no ssl off bind_timelimit 120 timelimit 120 uri ldap://server1.ipa.example.com sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com pam_lookup_policy yes Now init the ldap client. No Secure Connection When using this, you are not creating a secure connection. The Solaris 10 SSL libraries are so old that they cannot work with the ciphers that FreeIPA has turned on. AD Trust - Different Trees If using an AD trust, you should use the second example, where it looks at the compat tree for users. No Service Account If you have configured FreeIPA to not allow any anonymous connections, you will need to use a proxy account. We have provided the examples for this configuration. Without an AD Trust # Without AD Trust (no proxy) % ldapclient manual -a authenticationMethod=none \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # Without AD Trust (proxy) % ldapclient manual -a credentialLevel=proxy \\ -a authenticationMethod=simple \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 With an AD Trust # With AD Trust (no proxy) % ldapclient manual -a authenticationMethod=none \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # With AD Trust (proxy) % ldapclient manual -a credentialLevel=proxy \\ -a authenticationMethod=simple \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 This should succeed. Once it succeeds, you need to configure pam and nsswitch. AD Trust Information In the event you don't have an AD trust, you can change the \"binding\" lines to required, remove the pam_ldap lines, and change pam_krb5 lines to read \"required\" % vi /etc/pam.conf # Console login auth requisite pam_authtok_get.so.1 login auth sufficient pam_krb5.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth sufficient pam_unix_auth.so.1 server_policy login auth sufficient pam_ldap.so.1 rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth sufficient pam_krb5.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth sufficient pam_unix_auth.so.1 server_policy rlogin auth sufficient pam_ldap.so.1 # Needed for krb krlogin auth required pam_unix_cred.so.1 krlogin auth sufficient pam_krb5.so.1 # Needed for krb krsh auth required pam_unix_cred.so.1 krsh auth required pam_krb5.so.1 # ? ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth sufficient pam_krb5.so.1 ppp auth required pam_dial_auth.so.1 ppp auth binding pam_unix_auth.so.1 server_policy ppp auth sufficient pam_ldap.so.1 # Other, used by sshd and \"others\" as a fallback other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth sufficient pam_krb5.so.1 other auth required pam_unix_cred.so.1 other auth sufficient pam_unix_auth.so.1 server_policy other auth sufficient pam_ldap.so.1 other account requisite pam_roles.so.1 other account required pam_projects.so.1 other account binding pam_unix_account.so.1 server_policy other account sufficient pam_krb5.so.1 other account sufficient pam_ldap.so.1 other session required pam_unix_session.so.1 other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 force_check other password required pam_authtok_store.so.1 server_policy # passwd and cron passwd auth binding pam_passwd_auth.so.1 server_policy passwd auth sufficient pam_ldap.so.1 cron account required pam_unix_account.so.1 # SSH Pubkey - Needed for openldap and still probably needed sshd-pubkey account required pam_unix_account.so.1 % vi /etc/nsswitch.conf # Below are just the minimum changes passwd: files ldap [NOTFOUND=return] group: files ldap [NOTFOUND=return] sudoers: files ldap netgroup: ldap # the rest here are just here, up to you if you choose to set them. hosts: files dns ipnodes: files dns ethers: files ldap publickey: files ldap automount: files ldap You can test now if you'd like. bash-3.2# ldaplist -l passwd flast2 dn: uid=flast2,cn=users,cn=compat,dc=ipa,dc=example,dc=com cn: First Last objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gidNumber: 1006800001 gecos: First Last uidNumber: 1006800001 ipaAnchorUUID: :IPA:ipa.example.com:8babb9a8-5aaf-11e7-9769-00505690319e loginShell: /bin/bash homeDirectory: /home/first.last2 uid: first.last2 I recommend setting up sudo at least... if you want to use sudo, install the sudo-ldap from sudo.ws for Solaris 10. Solaris 11 \u00b6 Solaris 11 shares similar configuration to Solaris 10. There are a couple of manual things we have to do, but they are trivial. Solaris 11/Omnios will use TLS and sudo should just work. AD Groups In Solaris 10, users who logged in with AD users (with their short name) would appear as their full name ( name@domain ). This allowed their groups to fully resolve. However, in Solaris 11.4, this was not the case. Short name logins will work but your groups will not resolve as the compat tree uses the full name. To avoid running into this problem, you should be on at least SRU 11.4.7.4.0. Note that on a later SRU, you may need to setup an ID view (without overrides) for groups and sudo to work again. Below is for the service account like in the previous section, here as a reference. dn: uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com objectclass: account objectclass: simplesecurityobject uid: solaris userPassword: secret123 passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 % ldapadd -xWD 'cn=Directory Manager' -f /tmp/solaris.ldif Now, set the nisdomain. % defaultdomain ipa.example.com % echo 'ipa.example.com' > /etc/defaultdomain Configure kerberos. % vi /etc/krb5/krb5.conf [libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_kdc = true verify_ap_req_nofail = false [realms] IPA.EXAMPLE.COM = { } [domain_realm] ipa.example.com = IPA.EXAMPLE.COM .ipa.example.com = IPA.EXAMPLE.COM [logging] default = FILE:/var/krb5/kdc.log kdc = FILE:/var/krb5/kdc.log kdc_rotate = { period = 1d version = 10 } [appdefaults] kinit = { renewable = true forwardable= true } Generate a keytab and bring it over. # on the ipa server % ipa host-add solaris11.example.com % ipa-getkeytab -s server1.ipa.example.com -p host/solaris11.example.com -k /tmp/solaris11.keytab # Transfer the keytab % scp /tmp/solaris11.keytab solaris11.example.com:/tmp # On the solaris 11 machine % cp /tmp/solaris11.keytab /etc/krb5/krb5.keytab % chmod 600 /etc/krb5/krb5.keytab % chmod 644 /etc/krb5/krb5.conf % chown root:sys /etc/krb5/* # Check the keytab % klist -ket /etc/krb5/krb5.keytab # Test that you can kinit % kinit flast2@IPA.EXAMPLE.COM Create the LDAP configurations, bring the certificate, and create an NSS database. Solaris 11.3 vs 11.4 Previously we had 11.3 and 11.4 configurations. We have removed 11.3 as we no longer support it. % mkdir /etc/ipa /var/ldap % cd /etc/ipa % wget -O ipa.pem http://server1.ipa.example.com/ipa/config/ca.crt % cp * /var/ldap % vi /etc/ldap.conf base dc=ipa,dc=example,dc=com scope sub bind_timelimit 120 timelimit 120 uri ldap://server1.ipa.example.com sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com pam_lookup_policy yes TLS_CACERTDIR /var/ldap ssl start_tls tls_checkpeer no Now init the ldap client. We actually get to use a secure connection here. Kerberos is hit or miss, could never get sasl/GSSAPI to work. Different Trees - Trust or not? There are multiple examples of how to setup the trees. If using an AD trust, you should use the second example, where it looks at the compat tree for users. However, if you do not have trusts, then it is perfectly possible to still use the AD Trust example. Try both and see which works better for your environment. No Service Account If you have configured FreeIPA to not allow any anonymous connections, you will need to use a proxy account. We have provided the examples for this configuration. Without AD Trust # Without AD Trust (no proxy) % ldapclient manual -a authenticationMethod=tls:simple \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # Without AD Trust (proxy) % ldapclient manual -a authenticationMethod=tls:simple \\ -a credentialLevel=proxy \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # Without AD Trust (Kerberos) - Only works if Solaris is in the same DNS domain as IPA % ldapclient manual -a authenticationMethod=sasl/GSSAPI \\ -a credentialLevel=self \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 With AD Trust # With AD Trust (no proxy) % ldapclient manual -a authenticationMethod=tls:simple \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # With AD Trust (proxy) % ldapclient manual -a authenticationMethod=tls:simple \\ -a credentialLevel=proxy \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # With AD Trust (Kerberos) - Only works if Solaris is in the same DNS domain as IPA % ldapclient manual -a authenticationMethod=sasl/GSSAPI \\ -a credentialLevel=self \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 This should succeed. Once it succeeds, you need to configure pam and nsswitch. % /usr/sbin/svccfg -s name-service/switch setprop config/sudoer = astring: \"files ldap\" % /usr/sbin/svccfg -s name-service/switch setprop config/password = astring: \"files ldap [NOTFOUND=return]\" % /usr/sbin/svccfg -s name-service/switch setprop config/group = astring: \"files ldap [NOTFOUND=return]\" % /usr/sbin/svcadm refresh svc:/system/name-service/switch % /usr/sbin/svcadm restart svc:/system/name-service/switch % /usr/sbin/svcadm restart ldap/client AD Trust Information In the event you don't have an AD trust, you can change the \"binding\" lines to required and remove the pam_ldap lines. Optionally, you can set pam_krb5 to \"required\", however sufficient should work just fine. Without an AD Trust % vi /etc/pam.d/login auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth sufficient pam_krb5.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_unix_auth.so.1 server_policy % vi /etc/pam.d/other auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth sufficient pam_krb5.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_unix_auth.so.1 server_policy account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account required pam_unix_account.so.1 server_policy account sufficient pam_krb5.so.1 session definitive pam_user_policy.so.1 session required pam_unix_session.so.1 password definitive pam_user_policy.so.1 password include pam_authtok_common password sufficient pam_krb5.so.1 password required pam_authtok_store.so.1 server_policy % vi /etc/pam.d/sshd-pubkey account required pam_unix_account.so.1 With an AD Trust % vi /etc/pam.d/login auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth sufficient pam_krb5.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_unix_auth.so.1 server_policy auth sufficient pam_ldap.so.1 % vi /etc/pam.d/other auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth sufficient pam_krb5.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_unix_auth.so.1 server_policy auth sufficient pam_ldap.so.1 account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account binding pam_unix_account.so.1 server_policy account sufficient pam_krb5.so.1 account sufficient pam_ldap.so.1 session definitive pam_user_policy.so.1 session required pam_unix_session.so.1 password definitive pam_user_policy.so.1 password include pam_authtok_common password sufficient pam_krb5.so.1 password required pam_authtok_store.so.1 server_policy % vi /etc/pam.d/sshd-pubkey account required pam_unix_account.so.1 You can test now if you'd like. root@solaris11:~# ldaplist -l passwd flast2 dn: uid=flast2,cn=users,cn=compat,dc=ipa,dc=example,dc=com cn: First Last objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gidNumber: 1006800001 gecos: First Last uidNumber: 1006800001 ipaAnchorUUID: :IPA:ipa.example.com:8babb9a8-5aaf-11e7-9769-00505690319e loginShell: /bin/bash homeDirectory: /home/first.last2 uid: first.last2 Automated Scripts \u00b6 I at one point built a bunch of scripts to automate Solaris servers talking to IPA here . However, it is likely the scripts no longer work or contain outdated information. AD Trust Double UID \u00b6 Solaris 11 once in a while gets random regressions when it comes to authentication and ID's, among many other things they randomly decide to break. Big shout out to Oracle. In a brief discussion with a user in the #freeipa IRC channel, the user was trying to find a way to chop off the domain name for logins but also have sudo still work as there were some random issues in general. We both discovered that in SRU 11.4.20.4.0, even though both UID's are present from ldaplist -l passwd, sudo was no longer working properly. The first thing we tried was to create an ID view and override a user with a new username. This successfully removed the domain, but did not solve the sudo problem. He instead got \"no account present for that user\". However, I wasn't able to replicate this. However, later, one thing he noticed is after creating an ID view with no overrides and pointing Solaris 11 to the view in the compat tree, Solaris 10-esque authentication ID reporting started to occur. Running ldaplist -l passwd user reported back the double UID as expected, but the FQDN comes first which resolved his group/sudo issues. # Create a view... no id overrides required here % ipa idview-add solaris # On Solaris... # Take EXTREME care with the group and passwd base DN's, they need to point # to the view properly # This example uses kerberos to authenticate. % ldapclient manual -a authenticationMethod=self \\ -a credentialLevel=sasl/GSSAPI \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.angelsofclockwork.net server2.angelsofclockwork.net\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=solaris,cn=views,cn=compat,dc=angelsofclockwork,dc=net \\ -a serviceSearchDescriptor=passwd:cn=users,cn=solaris,cn=views,cn=compat,dc=angelsofclockwork,dc=net \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # Make sure you set your props... % /usr/sbin/svccfg -s name-service/switch setprop config/sudoer = astring: \"files ldap\" % /usr/sbin/svccfg -s name-service/switch setprop config/password = astring: \"files ldap [NOTFOUND=return]\" % /usr/sbin/svccfg -s name-service/switch setprop config/group = astring: \"files ldap [NOTFOUND=return]\" % /usr/sbin/svcadm refresh svc:/system/name-service/switch % /usr/sbin/svcadm restart svc:/system/name-service/switch % /usr/sbin/svcadm restart ldap/client # Verify... % ldaplist -l passwd adusername . . . % id -a adusername . . . Thank you to \"mewho\" on libera for finding this interesting workaround. OmniOS/Illumos \u00b6 Some steps between Solaris 10 and 11 can be followed to make OmniOS work. However, we have been unable to resolve why sudo will not work when using an AD trust. If you are using a standalone FreeIPA and no trust, sudo should work just fine. Legacy HBAC \u00b6 For HBAC to work on Solaris, you will need to compile the pam_hbac module found here . I would clone the current master branch or download the master.zip to your Solaris system. Each OS has their set of instructions for compiling. First, create the following system account. We will need this when we are configuring our legacy clients. dn: uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com objectClass: account objectClass: simplesecurityobject objectClass: top uid: hbac userPassword: password Solaris 10 \u00b6 % /opt/csw/bin/pkgutil -i -y libnet ar binutils gcc4g++ glib2 libglib2_dev gmake % /opt/csw/bin/pkgutil -i -y libnet ar binutils gcc4g++ glib2 libglib2_dev gmake % PATH=$PATH:/opt/csw/bin % export M4=/opt/csw/bin/gm4 % autoconf -o configure % autoreconf -i # Yes, SSL must be disabled for Solaris 10 to work. The libraries are too old. # You may or may not need to set CFLAGS, CXXFLAGS, and LDFLAGS with -m32 % ./configure AR=/opt/csw/bin/gar --with-pammoddir=/usr/lib/security --sysconfdir=/etc/ --disable-ssl --disable-man-pages % make % make install Solaris 11 \u00b6 % pkg install autoconf libtool pkg-config automake gcc docbook % autoreconf -if % ./configure --with-pammoddir=/usr/lib/security --mandir=/usr/share/man --sysconfdir=/etc/ % make % make install Omnios \u00b6 % pkg install developer/build/autoconf developer/build/libtool \\ developer/pkg-config developer/build/automake \\ developer/gcc48 system/header developer/object-file \\ developer/linker % autoreconf -if % ./configure --with-pammoddir=/usr/lib/security --mandir=/usr/share/man --sysconfdir=/etc/ % make % make install pam_hbac.conf \u00b6 % vim /etc/pam_hbac.conf # Replace client with your server's FQDN URI = ldap://server.ipa.example.com BASE = dc=ipa,dc=example,dc=com BIND_DN = uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com BIND_PW = password SSL_PATH = /var/ldap HOST_NAME = client PAM Configuration \u00b6 # Solaris 10 - /etc/pam.conf # Modify the other account section... It should come at the end of the account blocks. . . . other account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail # Solaris 11 - /etc/pam.d/other # Same here, only modify the account section . . . account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail In the event you cannot login or things aren't working the way you'd expect, add 'debug' to the end of the pam_hbac line and watch /var/log/authlog for errors. Login with AD Users to Legacy Clients \u00b6 For AD users to be able to login to legacy clients, you have to enable system-auth to the IPA servers. Without it, users will be denied access, regardless of HBAC controls or if you're using the pam_hbac module. % ipa hbacsvc-add system-auth % ipa hbacrule-add legacy_client_auth % ipa hbacrule-add-host --hostgroups=ipaservers legacy_client_auth % ipa hbacrule-mod --usercat=all legacy_client_auth Legacy Active Directory Trust Notes \u00b6 Just a section of notes. Domain Resolution Order Oddness \u00b6 If using domain resolution order, AD users get double uid attributes - but only if they login with their shortname. If they login with fqdn, double uid's do not occur. But shortnames do not work anymore. Have to restart the directory server to make short names work again. Solaris Weirdness \u00b6 If using domain resolution order, Solaris 10 gets the group resolution correct for short named AD users. Solaris 11 does not unless you are on SRU 11.4.7.4.0 or newer. There is a way to chop off the domain name from the uid using views. Domain Options \u00b6 This section goes over \"situational\" scenarios. These scenarios are reflective of the environment in which IPA is installed and not all will fit into your environment. These are more or less common situations that could occur during an IPA deployment or even post-deployment. Remove @realm for AD users \u00b6 A common scenario is that IPA and AD will have a trust, but there will not be any IPA users with the exception of the engineering team for managing IPA itself. The common theme is that because of this, the engineers and customers would rather not login with username@realm . Info The following is only applicable in an IPA-AD trust. An IPA-only scenario would not require any of these steps and most pieces would work natively (no @realm, sudo, hbac). In the event that you are in an IPA-AD scenario, please take note that this can adversely affect legacy clients. This will cause ldapsearches that are done in the compat tree to display multiple uid attributes. In most cases, this is fine and the user can still login without the realm name. The whoami and id commands will show the domain. There's no workaround for this. On the IPA servers, you will need to set the domain resolution order. This was introduced in 4.5.0. % kinit admin % ipa config-mod --domain-resolution-order=\"example.com:ipa.example.com\" After, you will need to clear out your SSSD cache. # sss_cache -E is insufficient for this. % systemctl stop sssd % rm -rf /var/lib/sss/db/* % systemctl start sssd The below is optional. It will remove the @realm off the usernames, like on the prompt or id or whoami commands. Only do this if required. Only do this on the clients. Do not make this change on an IPA replica. # vi /etc/sssd/sssd.conf [domain/ipa.example.com] . . . full_name_format = %1$s This will ensure EL7, EL8, EL9 clients resolve the AD domain first when attempting logins and optionally drop the @realm off the usernames. AD and IPA group names with short names \u00b6 You may notice that your clients have intermittent issues with name resolution when the following are true: Groups (or users) have the same names in both IPA and AD You are using domain resolution order You are shortening names on the clients You may want to actually search for them to identify the errant groups and then correct them. You can correct them either on the AD or IPA side. I would opt for the IPA side. % kinit admin@IPA.EXAMPLE.COM % vi /tmp/dupecheck.sh #!/bin/bash for x in ${ARRAY[*]} ; do ldapsearch -x -b \"DC=example,DC=com\" -h example.com -LLL -w 'PASSWORD' -D 'username@example.com' samaccountname=\"$x\" samaccountname | grep -q $x if [[ $? -eq 0 ]]; then echo \"$x: DUPLICATE\" fi done % bash /tmp/dupecheck.sh If you run into any duplicates, they should show up in a list for you address. sAMAccountName vs CN The \"CN\" and \"sAMAccountName\" attributes are not the same in AD, depending on who made the group or other factors. The sAMAccountName attribute is the value used to determine names from AD, whether you are enrolled with AD or the IPA server SSSD is pulling the information. This is why we are searching for that attribute, and not the CN. Sites and AD DC's \u00b6 By creating a subdomain section in /etc/sssd/sssd.conf on an IPA server, it is possible to set an AD Site or AD server(s) directly in SSSD. By default, sssd tries to do location based discovery. There may be a case where this isn't possible (eg, only a set of AD servers may only be contacted in certain \"air gapped\" networks). [domain/ipa.example.com/example.com] # If you want a site ad_site = Site_Name # If you want a server(s) ad_server = dc1.example.com, dc2.example.com # A backup? ad_backup_server = dc3.example.com, dc4.example.com If you don't have access or a way to find the sites using the Windows tools, you can run an ldapsearch to find it (or an equivalent ldap browsing tool). % ldapsearch -x -h example.com -s one -WD 'CN=username,CN=Users,DC=example,DC=com' \\ -b 'CN=Sites,CN=Configuration,DC=example,DC=com' cn This should report back your sites. If you want to know the servers for those sites (in case you don't want to deal with the sites, but just the DC's themselves), you use ldapsearch but use the base DN of the site name. % ldapsearch -x -h example.com -WD 'CN=username,CN=Users,DC=example,DC=com' \\ -b 'CN=Servers,CN=Site_Name,CN=Sites,CN=Configuration,DC=example,DC=com' dnsHostName Hardcoded DC's If the DC's change at any time and they are harded in your sssd.conf, it is up to you to know when new controllers are being added or removed as to not disrupt the connectivity from IPA to AD when performing user or group lookups. Enterprise Linux 6 SUDO and Default Domain Suffix \u00b6 This issue with the above section is that once you do this, sudo rules will begin failing, they will no longer work for Enterprise Linux 6. This is because sssd was changed to look for cn=sudo rather than ou=sudoers. To enable the compatibility fall back, you will need to install a newer SSSD. Set Default Shell for AD Users \u00b6 By default, after a trust has been established, the shell all AD users get is /bin/sh. To change this, you must change the sssd.conf on the IPA masters. % vi /etc/sssd/sssd.conf [domain/ipa.example.com] . . . default_shell = /bin/bash % systemctl restart sssd Automated Kerberos Principals \u00b6 Once in a great while, we run into situations where we need to have an automated process for creating principals and keytabs. This section takes a look at some of those examples that we've ran into. Hadoop/Cloudera \u00b6 This assumes you are using Cloudera Manager and not Ambari in any form. DNS Information It is highly likely that if you are using AWS, your nodes are getting stupid names like compute.internal. While there is a a way to change this if you don't change it, you will need to rely on something like DNSMASQ to allow the nodes to communicate with FreeIPA. FreeIPA will be upset about the stupid names because it can't do a rDNS lookup. Cloudera Manager Woes \u00b6 It is likely you have Cloudera/Hadoop, it is also very likely you (or another team) are deploying and using Cloudera Manager (or Director?). You may be running into issues that involve direct Active Directory integration. Maybe you're moving away from a standalone LDAP system over to Active Directory or even FreeIPA. Maybe you have FreeIPA in an AD trust but the users or contractors absolutely insist on using AD against their better judgement, despite the problems they're running into. Whatever the scenario is, we feel your pain. Here are some things you should probably know: Cloudera Manager (or Director?) supports Active Directory out of the box and obviously not FreeIPA despite the devs wanting to work something out back in 2015 Ambari has support for FreeIPA, but we are focusing on Cloudera Manager here. Cloudera Manager supports custom keytab retrieval scripts Hostnames that are longer than 15 characters, regardless of the cloud provider or onprem setup, will ultimately fail The NETBIOS limit in AD is 16 characters, which is 15 + $ at the end - This means hosts will enroll on top of themselves and your cluster will be broken FreeIPA does not have the name limitation and using an AD trust, AD users can freely use Hadoop when the cluster is properly setup. Enrolling the cluster nodes into FreeIPA and using a custom retrieval script will solve most (if not all) of the issues you may run into as well when it comes to keytabs, which Hadoop heavily relies on. The custom script is simply because Cloudera by default likes having direct access to the kerberos infrastructure, which is a no-go for FreeIPA. The Solution \u00b6 To summarize, here is our proposed solution: Create an account called cdh Create a role called \"Kerberos Managers\" and apply the following privileges: System: Manage Host Keytab System: Manage Host Keytab Permissions System: Manage Service Keytab System: Manage Service Keytab Permissions System: Manage User Principals (was not actually used, but who knows what we could use the role for later) Apply the role to the cdh account Create a custom script they could use to enroll the servers into FreeIPA (out of scope here) Create a custom script that utilizes the cdh account to create services So let's create the necessary things we need. # Create the account # Note... you may want to make this account non-expiring since it's just a service account % ipa user-add --first=\"Cloudera\" --last=\"Key Manager\" cdh # Create the Kerberos Managers role % ipa role-add \"Kerberos Managers\" # Create the kerberos manager privilege % ipa privilege-add \"Privileges - Kerberos Managers\" % ipa privilege-add-permission \"Privileges - Kerberos Managers\" \\ --privileges=\"System: Manage Host Keytab\" \\ --privileges=\"System: Manage Host Keytab Permissions\" \\ --privileges=\"System: Manage Service Keytab\" \\ --privileges=\"System: Manage Service Keytab Permissions\" \\ --privileges=\"System: Manage User Principals\" # Add the privilege to the role % ipa role-add-privilege \"Kerberos Managers\" \\ --privileges=\"Privileges - Kerberos Managers\" # Add the user to the role % ipa role-add-member --users=cdh \"Kerberos Managers\" # Optionally, we can export the keytab for the user with a password # You will see why in the next script % ipa-getkeytab -p cdh@EXAMPLE.COM -k cdh.keytab -P Now we need our special kerberos keytab retrieval script. #!/bin/bash # Created by: @nazunalika - Louis Abel # Purpose: To retrieve keytabs for Cloudera / Hadoop # https://github.com/nazunalika/useful-scripts # Disclaimer: We do not take responsibilities for breaches or misconfigurations of # software. Use at your own risk # Variables # This can be anywhere, but it SHOULD be secure with at least 600 permissions CDHKT=\"/root/.cdh/cdh.keytab\" CDHUSER=\"cdh\" IPAREALM=\"EXAMPLE.COM\" # This can be any server. You could make an array and have it randomly selected IPASERVER=\"ipa01.example.com\" # Where is this going? DESTINATION=\"$1\" # The full principal for the keytab in question FULLPRINC=\"$2\" # Shortened name PRINC=$(echo $FULLPRINC | sed \"s/\\@$(echo $IPAREALM)//\") 00_kinitUser() { # Pick what suits you best, we prefer using a keytab # Password based kinit, based on the keytab we created prior! # You could also have this in a file somewhere, I guess. Just # has to be secured. echo ThisIsAWeakPassword | kinit $CDHUSER@$IPAREALM # Keytab based kinit, obviously we created it before right? It just needs to be # on the right system, deployed in some secure manner #kinit -kt $CDHKT $CDHUSER@$IPAREALM if [[ $? == \"1\" ]]; then echo FAILED TO KINIT exit fi } 01_createPrinc() { echo \"INFO: Checking for existing principle\" if ipa service-find $FULLPRINC; then echo \"INFO: Principle found\" else echo \"INFO: Not found, creating\" ipa service-add $FULLPRINC fi } 02_createServiceAllows() { # We need to allow the service to create and retrieve keytabs echo \"INFO: Ensuring service allows to create and retrieve keytabs\" ipa service-allow-create-keytab --users=$CDHUSER $FULLPRINC ipa service-allow-retrieve-keytab --users=$CDHUSER $FULLPRINC # Let's retrieve the keytabs if ipa service-show $FULLPRINC | grep 'Keytab' | grep 'False'; then echo \"INFO: Creating keytab for $FULLPRINC to $DESTINATION\" ipa-getkeytab -s $IPASERVER -p $PRINC -k $DESTINATION else echo \"INFO: Retriving keytab for $FULLPRINC to $DESTINATION\" ipa-getkeytab -r -s $IPASERVER -p $PRINC -k $DESTINATION fi } 00_kinitUser 01_createPrinc 02_createServiceAllows kdestroy exit 0 Place the above script in a file that is accessible by the cloudera manager such as /usr/local/bin/getKeytabsCDH.sh and ensure it is owned by cloudera-scm with a permission set of 775. During the kerberos wizard, stop when you are verifying the \"cdh\" user. You will need to set the configuration for \"Custom Kerberos Keytab Retrieval Script\" to /usr/local/bin/getKeytabsCDH.sh and then you're almost there. 4 An important tidbit is currently Enterprise Linux 7+ and higher use memory based keytabs and java doesn't support them. 5 Because of this, the /etc/krb5.conf should be modified. % cat /etc/krb5.conf . . . # Make sure the below is commented # default_ccache_name = KEYRING:persistent:%{uid} . . . DNS Forwarding \u00b6 DNS Forwarding to DoT \u00b6 Presently, FreeIPA does not support DoT (DNS over TLS) nor DoH (DNS over HTTPS) (this appears to be a bind limitation and we can't find documentation that says otherwise). However, it is possible to setup unbound to do the forwarding for you, in which you tell your bind servers (or in this case, the bind DNS servers in your IPA domain) to forward to that unbound server for all forwarding. Keep it Separate It is recommended to keep your unbound service separate from the IPA servers. Spin up another instance in your network that will run unbound or run it on a standalone bind server that you may have on a separate port. To forward to the unbound service, modify the DNS global configuration in IPA: # Replace 10.100.0.224 with the IP of your unbound instance % ipa dnsconfig-mod --forward-policy=only --forwarder='10.100.0.224' # Add 'port xxxx' if you have set unbound to another port % ipa dnsconfig-mod --forward-policy=only --forwarder='10.100.0.224 port 9553' Logging \u00b6 Audit Logs \u00b6 By default, the audit logs in /var/log/dirsrv/slapd-INSTANCE/audit do not get populated. And the access logs don't show much in terms of modifications and what is being changed. There is also /var/log/httpd/* logs, but it may be useful to see ldif style logging for changes against FreeIPA. # Modify the DSE configuration by turning on audit logging [label@ipa01 ~]# ldapmodify -D \"cn=directory manager\" -W -p 389 -h localhost Enter LDAP Password: dn: cn=config changetype: modify replace: nsslapd-auditlog-logging-enabled nsslapd-auditlog-logging-enabled: on # Press CTRL+d here modifying entry \"cn=config\" # To test, I'll add a user to a group [label@ipa01 ~]$ ipa group-add-member --users=jbaskets aocusers Group name: aocusers GID: 686600003 Member users: ..., jbaskets ------------------------- Number of members added 1 ------------------------- # Let's verify the log [label@ipa01 ~]$ sudo su - [sudo] password for label: Last login: Sun Mar 29 16:42:36 MST 2020 on pts/0 [root@ipa01 ~]# cd /var/log/dirsrv/slapd-EXAMPLE-NET/ [root@ipa01 slapd-EXAMPLE-NET]# cat audit time: 20200329223754 dn: cn=config result: 0 changetype: modify replace: nsslapd-auditlog-logging-enabled nsslapd-auditlog-logging-enabled: on - replace: modifiersname modifiersname: cn=directory manager - replace: modifytimestamp modifytimestamp: 20200330053754Z - 389-Directory/1.4.1.3 B2019.323.229 ipa01.example.net:636 (/etc/dirsrv/slapd-EXAMPLE-NET) # Looks like right here the modification happened time: 20200329224007 dn: cn=aocusers,cn=groups,cn=accounts,dc=example,dc=net result: 0 changetype: modify add: member member: uid=jbaskets,cn=users,cn=accounts,dc=example,dc=net - replace: modifiersname modifiersname: uid=label,cn=users,cn=accounts,dc=example,dc=net - replace: modifytimestamp modifytimestamp: 20200330054006Z - replace: entryusn entryusn: 900028 - Certificates \u00b6 These are notes of things I've ran into before while dealing with certificates. Renewed IPA HTTP Certificate Stuck \u00b6 This was something I discovered sort of on accident but never really \"noticed\" - Though I'm sure I would've noticed sometime in 2021 when my certificate expired. I was running ipa-healthcheck --failures-only as I do sometimes, and noticed some weird certmonger things pop up. But it made me look at my certificate list... [root@ipa01 ~]# ipa-getcert list Number of certificates and requests being tracked: 9. Request ID '20191106025922': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET expires: 2021-11-05 19:59:27 MST principal name: krbtgt/ANGELSOFCLOCKWORK.NET@ANGELSOFCLOCKWORK.NET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Request ID '20200123075636': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-ANGELSOFCLOCKWORK-NET',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-ANGELSOFCLOCKWORK-NET/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-ANGELSOFCLOCKWORK-NET',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET expires: 2021-11-05 19:55:33 MST dns: ipa01.angelsofclockwork.net principal name: ldap/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv ANGELSOFCLOCKWORK-NET track: yes auto-renew: yes Request ID '20200123075639': status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN stuck: yes key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' CA: IPA issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET expires: 2021-11-05 19:55:48 MST dns: ipa01.angelsofclockwork.net principal name: HTTP/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes Interestingly, I wasn't sure what NEWLY_ADDED_NEED_KEYINFO_READ_PIN meant and I couldn't really find much on what would cause this to happen. And I know my certificate isn't expired, according to the output. In fact, I checked with openssl just in case. [root@ipa01 ~]# openssl x509 -text -noout -in /var/lib/ipa/certs/httpd.crt | grep 'Not After' Not After : Nov 6 02:55:48 2021 GMT I'm not sure if this is just a result of migrating from Enterprise Linux 7 to 8 at the time, but it seemed easy enough to remove the tracking and put it back in, which ultimately fixed the monitoring state and now it was no longer \"stuck\". [root@ipa01 ~]# ipa-getcert stop-tracking -i 20200123075639 Request \"20200123075639\" removed. [root@ipa01 ~]# ipa-getcert start-tracking -f /var/lib/ipa/certs/httpd.crt -k /var/lib/ipa/private/httpd.key -p /var/lib/ipa/passwds/ipa01.angelsofclockwork.net-443-RSA -C /usr/libexec/ipa/certmonger/restart_httpd -K HTTP/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET New tracking request \"20200504003758\" added. [root@ipa01 ~]# ipa-getcert list -i \"20200504003758\" Number of certificates and requests being tracked: 9. Request ID '20200504003758': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/ipa01.angelsofclockwork.net-443-RSA' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' CA: IPA issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET expires: 2021-11-05 19:55:48 MST dns: ipa01.angelsofclockwork.net principal name: HTTP/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes CA Related Certificates Stuck \u00b6 Like with the IPA httpd certificates, I noticed at least 4 certificates stuck because a PIN was missing. Turns out that it's actually easy to modify the tracking request and fix the issue entirely. Below is my example doing this on the auditSigningCert. This seems to only occur on Enterprise Linux 8. [root@ipa01 alias]# getcert list -i 20200615180351 Number of certificates and requests being tracked: 9. Request ID '20200615180351': status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca' certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca' CA: dogtag-ipa-ca-renew-agent issuer: subject: expires: unknown pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert \"auditSigningCert cert-pki-ca\" track: yes auto-renew: yes [root@ipa01 alias]# getcert start-tracking -i 20200615180351 -p /etc/pki/pki-tomcat/alias/pwdfile.txt Request \"20200615180351\" modified. [root@ipa01 alias]# getcert list -i 20200615180351 Number of certificates and requests being tracked: 9. Request ID '20200615180351': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pinfile='/etc/pki/pki-tomcat/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=CA Audit,O=ANGELSOFCLOCKWORK.NET expires: 2021-03-13 23:15:41 MST key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert \"auditSigningCert cert-pki-ca\" track: yes auto-renew: yes Default Certificates with SAN \u00b6 A question that arises now and again is how to setup a load balancer for FreeIPA's LDAP servers whether it's an actual load balancer (layer 4) or some sort of DNS record with multiple A records, or perhaps with some sort of round robin DNS. The issue is that the certificate verification fails, because the certificate being presented is of the IPA server itself with no SAN. To address this, you have to create a host that has the name of the load balancer or DNS record you plan on using and allow the IPA servers to manage the host. CMS Communication Issues (403) \u00b6 This isn't necessarily certificate issue, but more or less an issue as it pertains to the certificate system itself. There may be cases where during upgrades, a configuration in /etc/pki/pki-tomcat/server.xml is not properly reconfigured. In that file, you'll notice Connector lines that have a secret and a requiredSecret parameter and they both have different values. The issue may be that these aren't correct. This generally comes down to IPA and pki-core conflicting on these attributes. To correct this, you will need to find the secret in /etc/httpd/conf.d/ipa-pki-proxy.conf (on the ProxyPass line) and ensure that's the same secret in both fields. ProxyPassMatch ajp://localhost:8009 secret=AAA Make sure they're the same in server.xml After changing, restart the service with systemctl restart pki-tomcat@pki-tomcatd.service. Kerberos \u00b6 This section goes over some stuff about kerberos that we've ran into and might find useful someday. Accounts with OTP Enabled \u00b6 When logging into a machine with a password (first factor) and an OTP token (second factor), this generally works without a problem. You can easily run klist and you'll see that you have a ticket and everything. In the cases where you're calling kinit all by itself, this doesn't work as expected at the time of this writing. % kinit account@REALM kinit: Pre-authentication failed: Invalid argument while getting initial credentials A bugzilla was opened about this issue in 2017, a pagure issue was opened in 2014 about this exact scenario, where IPA is configured for password+OTP and a user has an assigned token. There is currently one workaround, which is using kinit -n to perform anonymous processing. Footnotes \u00b6 For more information on DNS for FreeIPA, please read this page and this page \u21a9 The -P asks for the password of the username in question, that way it is cached right away. The directory service on the system then has credentials to compare to. I have found that sometimes if you don't use -P, even if you're logged in as the account, the password does not get cached and you'll get stuck at a background image the next time you login. Again, this is only sometimes. Your mileage may vary here. \u21a9 The -P asks for the password of the username in question, that way it is cached right away. The directory service on the system then has credentials to compare to. I have found that sometimes if you don't use -P, even if you're logged in as the account, the password does not get cached and you'll get stuck at a background image the next time you login. Again, this is only sometimes. Your mileage may vary here. \u21a9 Please read this page for more information. \u21a9 This may have changed. However it is up to you to test if this is the case. \u21a9","title":"FreeIPA"},{"location":"el/freeipa/#overview","text":"FreeIPA is an integrated security information management system combining Linux, a Directory Server (389), Kerberos, NTP, DNS, DogTag. It's a system that can be loosely compared to Active Directory in what it attempts to solve for Linux and UNIX clients and even mixed environments. While it is not an active directory, it is an integrated Identity and Authentication solution for Linux/UNIX environments, which means it does not support Windows clients. One problem that FreeIPA attempts to solve is giving back control to the Linux/UNIX administration teams of access, authentication, and authorization rather than trying to integrate directly into Active Directory, where the controls do not work the same or do not work at all. And because of this, no third party software is required to be installed.","title":"Overview"},{"location":"el/freeipa/#requirements","text":"Here are the list of requirements below. Enterprise Linux 8+ or Fedora Linux An active internet connection to install the packages required or available internal mirrors 2 core, 4GB system with at least 10GB+ disk for /var/lib/dirsrv DNS domain delegation (if a DNS appliance or server already exists)","title":"Requirements"},{"location":"el/freeipa/#tutorial-preface-notes-and-recommendations","text":"Potential Pitfalls! Leave SELinux enabled at all times. You will not run into SELinux issues FreeIPA runs better when it controls the DNS domain that it is given - It is recommended DNS is delegated or that FreeIPA run DNS entirely FreeIPA does not run DHCP. ISC DHCP can be configured to do dynamic DNS updates to FreeIPA or hosts can be configured to perform dynamic DNS updates Recommended Information Keep selinux set to enforcing DNS - You must be careful when using DNS. Here are recommendations. 1 Recommendation 1: FreeIPA runs your entire DNS for your network - This requires the DHCP servers to set the DNS servers to the IPA servers. This will be useful in the case that your clients will have their SSH keys added as SSHFP records to DNS when enrolled as clients. This also gives you the added benefit of a client updating its own DNS entries (A and PTR records) if the client is DHCP enabled and the IP changes if you so choose. Recommendation 2: FreeIPA is delegated a subdomain of a domain used already in the network - It's not required for hosts to live in the subdomain to be a member of the IPA domain, but you will lose out on kerberos SSO. Do not try to hijack a domain. Consider setting up a trust with Active Directory if you are in a mixed environment, eg Active Directory already exists - winsync is available, but deprecated and not recommended. IPA servers should have static assigned addresses - Configured via nmcli or directly in /etc/sysconfig/network-scripts/ifcfg-* Try to avoid running FreeIPA without DNS - while possible, you are creating higher maintenance Trust Information If you are in a mixed environment (both Windows and Linux/UNIX), it is recommended to setup a trust between FreeIPA and Active Directory. Because of this, they will need to be in different domains (eg, example.com and ipa.example.com, or example.com and example.net). This way, you do not have to create duplicate users if a windows user logs into Linux resources nor use winsync.","title":"Tutorial Preface, Notes, and Recommendations"},{"location":"el/freeipa/#dns","text":"As noted in the previous section, you must try not to hijack a domain. You can migrate records over to FreeIPA's DNS if you'd like, but care must be taken with that approach. While FreeIPA can do the typical DNS server work such as forward/reverse zones and various types of records, it should not be considered a full solution. It does not support views (eg, you can't have internal and external views, assuming you have domains that are publically facing). In the event you need to have views, that's when you need a different DNS server or service to provide this to you. There are two ways you can have DNS entries updated dynamically: --enable-dns-updates for ipa-client-install and DHCP dynamic DNS updates. Both are sufficient. The latter requires additional work and is outside the scope of this write up.","title":"DNS"},{"location":"el/freeipa/#delegation","text":"Throughout this guide, you may find or see examples of domain delegation where there is an AD trust, as it would be a more real world example of bringing in FreeIPA to an environment that is already in place, working, with a DNS hosted by AD or by an appliance. Majority of the examples assume both IPA and AD is delegated (when it's normally IPA that's just delegated while AD hosts the actual parent zone). Using this type of setup, it is not required for clients to have entries in the IPA domain. In fact, they can be in other domains as long as they have A/AAAA/PTR records associated with them. This assumes that there could be dynamic dns associated with DHCP or everything is static and lives in the parent zones. The caveat to this is SSO will fail . You can setup already existing DNS servers to delegate an entire domain or a subdomain for FreeIPA. This way, you don't overlap with a domain that's already in use. So for example, if AD owns example.com, you could have AD delegate ipa.example.com or even forward example.net. If AD is not the DNS provider for the environment, you can have the appliance delegate the domain in the same manner. Below is a bind example of what example.com would look like when delegating the IPA domain: $ORIGIN example.com. @ IN SOA ... ( ) NS np-ad01 NS np-ad02 np-ad01 A 10.200.0.232 np-ad02 A 10.200.0.233 ; Many other records here, pertaining to AD, eg msdcs and SRV records ; IPA records $ORIGIN ipa.example.com. @ NS np-ipa01 NS np-ipa02 np-ipa01 A 10.200.0.230 np-ipa02 A 10.200.0.231 Note that AD can send nsupdates to a DNS server if given the permissions. As of this writing, FreeIPA does not do this, which is why DNS delegation is recommended.","title":"Delegation"},{"location":"el/freeipa/#server-setup","text":"","title":"Server Setup"},{"location":"el/freeipa/#required-packages","text":"ipa-server ipa-client (required as an IPA server is technically a client of the domain) ipa-server-dns (required for using the internal DNS) sssd/sssd-ipa (pulled in as dependencies)","title":"Required Packages"},{"location":"el/freeipa/#optional-packages","text":"ipa-server-trust-ad if using an AD trust","title":"Optional Packages"},{"location":"el/freeipa/#installation","text":"To install the server, make sure the hostname is set to the A records and NS delegations you've put in DNS (which won't respond to a DNS lookup). If these are stand-alone, then you can just keep it at the top level (eg, example.com). You'll also need to modify /etc/hosts, set static IP addresses, and then run the ipa-server-install command. % hostnamectl set-hostname server1.ipa.example.com % nmcli con mod ens192 ipv4.address 10.200.0.230/24 % nmcli con mod ens192 ipv4.gateway 10.200.0.1 % nmcli con mod ens192 ipv4.method manual % nmcli con up ens192 % vi /etc/hosts . . . 10.200.0.230 server1.ipa.example.com 10.200.0.231 server2.ipa.example.com # Fedora % dnf install freeipa-server{,-common,-dns,-trust-ad} -y # Enterprise Linux 8 % dnf module enable idm:DL1/{dns,adtrust,client,server,common} % dnf install ipa-server ipa-server-dns ipa-client sssd sssd-ipa -y # Enterprise Linux 9 (there appears to be no modules) % dnf install ipa-server ipa-server-dns ipa-client sssd sssd-ipa -y # Setup # Enterprise 8 / 9 % firewall-cmd --permanent --add-service={freeipa-4,ntp,dns,freeipa-trust} % firewall-cmd --complete-reload % ipa-server-install \\ --no_hbac_allow \\ <-- If you want to have HBAC allow_all disabled initially --no-ntp \\ <-- If you want to host NTP from IPA, take off --no-ntp --setup-dns \\ --realm IPA.EXAMPLE.COM \\ --domain example.com . . . (show steps here) While not officially recommended, you could have two accounts. One for administration of servers and the domain and one for your workstation, similar to separating domain users and domain administrators in active directory. You don't have to follow this, but at least there's a form of separation. % kinit admin % ipa user-add --first=First --last=Last --cn=\"First Last Admin\" --gecos=\"First Last Admin\" flast2 % ipa group-add-member --users=flast2 admins","title":"Installation"},{"location":"el/freeipa/#replica","text":"On the replica, ensure you repeat the same steps as above. % hostnamectl set-hostname server2.ipa.example.com % nmcli con mod ens192 ipv4.address 10.200.0.231/24 % nmcli con mod ens192 ipv4.gateway 10.200.0.1 % nmcli con mod ens192 ipv4.method manual % nmcli con up ens192 % vi /etc/hosts . . . 10.200.0.230 server1.ipa.example.com 10.200.0.231 server2.ipa.example.com % dnf install ipa-server ipa-server-dns ipa-client sssd sssd-ipa -y # Enterprise 8 / 9 % firewall-cmd --permanent --add-service={freeipa-4,ntp,dns,freeipa-trust} % firewall-cmd --complete-reload % ipa-replica-install --no-forwarders --setup-ca --setup-dns --no-ntp --principal admin --admin-password \"ChangePass123\" --domain ipa.example.com . . . (show steps) You should now be able to see your replicas. % ipa-replica-manage list server1.ipa.example.com: master server2.ipa.example.com: master","title":"Replica"},{"location":"el/freeipa/#replica-automation","text":"It is possible to automate the replica installation. To automate the replica installation, the following requirements would need to be met: Server must be added as a client (ipa-client-install) with an IP address on the commandline Server must be added to the ipaservers host group ipa-replica-install ran without principal and passwords Once you have a server added as a client and then added to the ipaservers host group, you would run a command like this: % ipa-replica-install --ssh-trust-dns --unattended --setup-ca --mkhomedir --setup-dns --no-forwarders If you have forwarders, use the --forwarders option instead.","title":"Replica Automation"},{"location":"el/freeipa/#server-migrationupgrade","text":"Performing a migration is a multi-step process. Typically you are going from one major version of Enterprise Linux (such as 7 or 8) to another (such as 9). Regardless of which version you are migrating from, the typical beginning steps are: System's time is verified for time synchronization like using ntpstat or equivalent Server roles are verified in the current environment using ipa server-role-find --status enabled --server ipa.example.com New system is installed and enrolled as a client New system is added as a replica with required server roles EL7 to EL9 / Two Major Version Jumps When jumping from EL7 to EL9 or two major versions in general, it is recommended that you have an \"in between\" machine. This means that you need to add the in between version first and then you can add the latest version. See this page for an example. The below is in the case of a single master installation and doesn't take into account of multiple version jumps. Let's say you have two old Enterprise Linux replicas instead. There are two approaches you can take: Install a new Enterprise Linux system, add it, reinstall old system to the new version, add it back. Install two new Enterprise Linux systems, add them as needed, power off old systems. Below is an example, with X being the old version, and Y being the new. Enterprise Linux Y system is installed and enrolled as a client Enterprise Linux Y system is added as a replica Change CRL to Enterprise Linux Y system and adjust settings on Enterprise Linux X CA master and new Enterprise Linux Y replica for pki-tomcatd and httpd Test user is created to ensure DNA range is adjusted Verify DNA range Stop first Enterprise Linux X IPA services, remove replica, uninstall, power off. Second Enterprise Linux Y system is installed and enrolled as a client Second Enterprise Linux Y system is added as a replica Test user is created again to ensure DNA range is adjusted Verify DNA range Stop second Enterprise Linux X IPA services, remove replica, uninstall, power off.","title":"Server Migration/Upgrade"},{"location":"el/freeipa/#el7-to-el8","text":"# Enterprise Linux 8 % dnf module enable idm:DL1 # Install necessary packages, ie AD trust packages if you need them % dnf install ipa-server ipa-server-dns -y % ipa-client-install --realm EXAMPLE.COM --domain example.com % kinit admin # Add other switches that you feel are necessary, such as forwarders, kra, ntp... % ipa-replica-install --setup-dns --setup-ca --ssh-trust-dns --mkhomedir # Verify all services are in a RUNNING state % ipactl status Directory Service: RUNNING . . . % ipa-csreplica-manage list elX.example.com: master elY.example.com: master % ipa-csreplica-manage list --verbose elY.example.com Directory Manager password: elX.example.com last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2019-11-07 22:46:15+00:00 Change CRL to new Enterprise Linux system and adjust settings on both replicas for pki-tomcatd and httpd # Change CA master to elY % ipa config-mod --ca-renewal-master-server elY.example.com # Shut down all CRL generation on ELX elX% ipa-crlgen-manage status CRL generation: enabled . . . elX% ipa-crlgen-manage disable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable. The ipa-crlgen-manage command was successful # Verify that the /etc/httpd/conf.d/ipa-pki-proxy.conf file's RewriteRule is not commented # If it is, remove the comment and restart httpd. ipa-crlgen-manage should take care of this. % tail -n 1 /etc/httpd/conf.d/ipa-pki-proxy.conf RewriteRule ^/ipa/crl/MasterCRL.bin https://elX.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC] # Turn it on with ELY elY% systemctl stop pki-tomcatd@pki-tomcat.service # The values should be changed from false to true elY% vi /etc/pki/pki-tomcat/ca/CS.cfg ca.crl.MasterCRL.enableCRLCache=true ca.crl.MasterCRL.enableCRLUpdates=true elY% systemctl start pki-tomcatd@pki-tomcat.service # Make sure the rewrite rule has a comment on elY elY% vi /etc/httpd/conf.d/ipa-pki-proxy.conf . . . #RewriteRule ^/ipa/crl/MasterCRL.bin https://elY.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC] elY% systemctl restart httpd Test user is created to ensure DNA range is adjusted and replication is working % ipa user-add --first=testing --last=user testinguser1 # Test on both systems elX% ipa user-find testinguser1 elY% ipa user-find testinguser1 Verify DNA range # There should be ranges for both replicas % ipa-replica-manage dnarange-show elX.example.com: ... elY.example.com: ... Stop old Enterprise Linux IPA services, remove replica, uninstall # Stop all elX services elX% ipactl stop # Delete the elX system from the topology elY% ipa server-del elX.example.com # Uninstall and/or power down system elX% ipa-server-install --uninstall elX% init 0","title":"EL7 to EL8"},{"location":"el/freeipa/#el8-to-el9","text":"# Enterprise Linux 9 % dnf install ipa-server ipa-server-dns -y % ipa-client-install --realm EXAMPLE.COM --domain example.com % kinit admin # Add other switches that you feel are necessary, such as forwarders, kra, ntp... % ipa-replica-install --setup-dns --setup-ca --ssh-trust-dns --mkhomedir # Verify all services are in a RUNNING state % ipactl status Directory Service: RUNNING . . . % ipa-csreplica-manage list elX.example.com: master elY.example.com: master % ipa-csreplica-manage list --verbose elY.example.com Directory Manager password: elX.example.com last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2022-08-12 18:11:11+00:00 Set the CA renewal master to the new system and change the CRL settings % ipa config-mod --ca-renewal-master-server elY.example.com # Remove the ca.certStatusUpdateInterval entry or set it to 600 (default) on elY elY% vim /etc/pki/pki-tomcat/ca/CS.cfg # Restart the ipa services elY% ipactl restart # Set the value of ca.certStatusUpdateInterval on elX to 0 elX% vim /etc/pki/pki-tomcat/ca/CS.cfg ca.certStatusUpdateInterval=0 elX% ipactl restart elX% ipa-crlgen-manage status CRL generation: enabled . . . elX% ipa-crlgen-manage disable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable. The ipa-crlgen-manage command was successful elX% ipa-crlgen-manage status CRL generation: disabled Create a test user to ensure DNA range is adjusted and replication is working elY% ipa user-add --first=testing --last=user testinguser1 # Test on both systems elX% ipa user-find testinguser1 elY% ipa user-find testinguser1 Verify DNA range. # There should be ranges for both replicas % ipa-replica-manage dnarange-show elX.example.com: ... elY.example.com: ... Stop old Enterprise Linux IPA services, remove replica, uninstall. # Stop all elX services elX% ipactl stop # Delete the elX system from the topology elY% ipa server-del elX.example.com # Uninstall and/or power down system elX% ipa-server-install --uninstall elX% init 0 See this page for more information.","title":"EL8 to EL9"},{"location":"el/freeipa/#active-directory-trust","text":"To initiate a trust with your active directory domain, ensure the following requirements are met. Requirements Package installed: ipa-server-trust-ad DNS: Properly configured that FreeIPA can resolve the AD servers A and SRV records This can either be forwarders to AD, a subdomain that IPA manages, or delegated subdomain from the master DNS servers in your network. This is completely dependent on your infrastructure. DNS: AD forest has sites and SRV records, including priorities, are set correctly When the following requirements are met, you have two choices before continuning. You can either use POSIX or have the id range generated automatically. POSIX vs Non-POSIX If you decide to use POSIX, your AD users are expected to have uidNumber, gidNumber, loginShell, unixHomeDirectory set. Else, you will need to setup ID overrides if you already have that information for current users (assuming this is not a new setup for the environment, ie you already have UID's for people). If you are not planning a migration from pure AD over to IPA with a trust, it is recommended to note that information so you can setup the ID overrides. Afterwards, any new users will get UID/GID's that you will not have to manage yourself. You will need to prep your master(s) for the trust. We will be enabling compat, adding sids, and adding agents so both masters can provide AD information. % ipa-adtrust-install --add-sids --add-agents --enable-compat This will do what we need. If you do not have legacy clients (Enterprise Linux 5, Solaris, HP-UX, AIX, SLES 11.4, FreeBSD, the list goes on), then you do not need to enable compat mode. Though, it could be useful to have it for certain apps or scenarios. You will now need to open the necessary ports. Do this on all masters. Ports TCP: 135, 138, 139, 389, 445, 1024-1300, 3268 UDP: 138, 139, 389, 445 % firewall-cmd --add-service=freeipa-trust --permanent % firewall-cmd --complete-reload Now you can initiate the trust. The admin account you use should be part of the domain admins group or at least have permissions to initiate a trust. The former is path of least resistance. # If you are using POSIX ID, use ipa-ad-trust-posix. % ipa trust-add --type=ad example.com --range-type=ipa-ad-trust --admin adminaccount --password Once the trust is up, verify it. % ipa trust-show example.com Realm name: example.com Domain NetBIOS name: AD Domain Security Identifier: S-X-X-XX-XXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX Trust direction: Trusting forest Trust type: Active Directory domain UPN suffixes: example.com You should be able to test for the users now. % id aduser1@example.com uid=XXXXX(aduser1@example.com) gid=XXXXX(aduser1@example.com) groups=XXXXX(aduser1@example.com)","title":"Active Directory Trust"},{"location":"el/freeipa/#disable-anonymous-bind","text":"In some cases, it is a requirement to disable all anonymous binds. If this is the case, you will need to modify cn=config on each master as it is not replicated. rootdse Some applications do anonymous binds to the directory server to determine its version and it supported controls. While it is possible to disable anonymous binds completely, it is important to know that if you disable the rootdse binds, applications that do anonymous lookups to get server information will fail. % ldapmodify -xZZ -D \"cn=Directory Manager\" -W -h server.ipa.example.com Enter LDAP Password: dn: cn=config changetype: modify replace: nsslapd-allow-anonymous-access nsslapd-allow-anonymous-access: rootdse modifying entry \"cn=config\"","title":"Disable Anonymous Bind"},{"location":"el/freeipa/#client-setup","text":"","title":"Client Setup"},{"location":"el/freeipa/#enterprise-linux-fedora","text":"Ensure your /etc/resolv.conf (or other dns settings) are set correctly. Ensure your hostname is also set correctly. % dnf install ipa-client -y % ipa-client-install --realm EXAMPLE.COM --domain example.com --mkhomedir","title":"Enterprise Linux & Fedora"},{"location":"el/freeipa/#mac-clients","text":"MacOS Clients are an interesting workstation to setup as a FreeIPA client. It takes a little bit of fighting and troubleshooting, but it can work with the right settings. Note that as of Catalina, you may not be able to login to your account nor will creating a mobile account function as you would expect. This may have changed in recent macos releases, so YMMV. Other Guides There are a couple of guides out there that you may have found before (if you looked) that help setup IPA for Mac. There's one for much older (I think Lion) and one for Sierra. This section was made mostly for my own reference because I found some things in both of those guides didn't address issues I ran into one way or another and couldn't find any information on. The FreeIPA users mail list didn't have any archives with people having similar issues. If you are interested in the other guides to compare to, you may see them here (recent) and here (older) AD Users AD Users You cannot login as AD users on a Mac when going through FreeIPA. You can, in theory, point to the cn=compat tree and set the attribute mapping to rfc2307. In my tests, I have never been able to get this to work. This section, I am going to assume you are going to be logging in as a user in IPA. If you are in a mixed environment, add your Mac to your AD domain instead. Anonymous Bind There may be cases where if you have disabled anonymous binds in IPA, this setup may not work, even if you do use a bind account. You will need to experiment with this if you plan on using a bind account and plan on or currently have IPA not allowing anonymous binds. Check your system's hostname. You want to make sure it has a hostname defined for it in the domain the mac sits in, even if it's dynamic via DHCP/DNS. % sudo scutil --set HostName mac.example.com Get the IPA certificate. You'll need to double click it after you get it and import it. % cd ~/Desktop && curl -OL http://server1.ipa.example.com/ipa/config/ca.crt % sudo mkdir /etc/ipa % sudo cp ca.crt /etc/ipa/ca.crt % sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /etc/ipa/ca.crt On the IPA server, you will need to create a host and get the keytab. % ipa host-add mac.example.com --macaddress=\"00:00:00:00:00:00\" % ipa-getkeytab -s server1.ipa.example.com -p host/mac.example.com -k /tmp/krb5.keytab You will need to transfer that keytab to your mac. % cd ~ % scp user@server1.ipa.example.com:/tmp/krb5.keytab . % sudo mv krb5.keytab /etc/krb5.keytab % sudo chmod 600 /etc/krb5.keytab % sudo chown root:wheel /etc/krb5.keytab Configure /etc/krb5.conf [domain_realm] .ipa.example.com = IPA.EXAMPLE.COM ipa.example.com = IPA.EXAMPLE.COM [libdefaults] default_realm = IPA.EXAMPLE.COM allow_weak_crypto = yes dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = yes renewable = true [realms] IPA.EXAMPLE.COM = { # You don't need to set these when your DNS is setup correctly, but it doesn't hurt to have a reference. # In my opinion, you shouldn't hardcode these values. You have to have a good reason to. #kdc = tcp/server1.ipa.example.com #kdc = tcp/server2.ipa.example.com #admin_server = tcp/server1.ipa.example.com #admin_server = tcp/server2.ipa.example.com pkinit_anchors = FILE:/etc/ipa/ca.crt } You'll want to do a kinit to verify. If it works, you should be able to go to the FreeIPA webui and check that the host is \"enrolled\" (Identity -> Hosts). % kinit username@IPA.EXAMPLE.COM You need to modify a couple of pam files. I'll explain why they need to be changed. % sudo vi /etc/pam.d/authorization # authorization: auth account # Putting krb5 here twice ensures that you can login via kerberos and also get a keytab # If \"no_ccache\" is here, keytabs will not be available on login auth optional pam_krb5.so use_first_pass use_kcminit default_principal auth sufficient pam_krb5.so use_first_pass default_principal auth required pam_opendirectory.so use_first_pass nullok account required pam_opendirectory.so % sudo vi /etc/pam.d/screensaver # The krb5 changes do similar to the authorization when on the lock screen after a sleep #auth optional pam_krb5.so use_first_pass use_kcminit auth optional pam_krb5.so use_first_pass use_kcminit default_principal auth sufficient pam_krb5.so use_first_pass default_principal auth required pam_opendirectory.so use_first_pass nullok account required pam_opendirectory.so account sufficient pam_self.so account required pam_group.so no_warn group=admin,wheel fail_safe account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe % sudo vi /etc/pam.d/passwd # Helps with kerberos logins password sufficient pam_krb5.so auth required pam_permit.so account required pam_opendirectory.so password required pam_opendirectory.so session required pam_permit.so After these changes, you'll need to go into make some changes with the directory utility. This depends on your macOS version.","title":"Mac Clients"},{"location":"el/freeipa/#monterey-and-older","text":"Go to system preferences -> users & groups -> login options - Click the 'lock' to make changes Set the following: Automatic login: Off Display login window as: Name and Password Show fast user switching menu as: Full Name Click \"Join\" next to \"Network Account Server\" Enter one of your IPA servers (you can duplicate it later for backup purposes) and click Continue. Ensure \"Allow network users to log in at login window\" is checked - Make sure it's set to all users Click \"edit\" next to the \"Network Account Server\" Click \"Open Directory Utility\" Click the lock, edit LDAPv3 Select your server and click \"edit\" Set the following options: Open/close times out in 5 seconds Query times out in 5 seconds Connection idles out in 1 minute (this can't be changed) Encrypt using SSL (selected) Click \"Search & Mappings\" You may either select \"rfc2307\" from the dropdown or select custom. It will ask your base DN (eg, dc=ipa,dc=example,dc=com) If you select rfc2307, it will ask for your base DN (eg, dc=ipa,dc=example,dc=com) If you select \"custom\", you will need to do this manually for each record type. You're better off using rfc2307 and working from there Click the \"+\" to add a groups record type or scroll and find \"groups\". Select \"groups\", and ensure the following object classes exist. You can click the \"+\" to add them when needed. Record Type ObjectClasses Groups posixGroup ipausergroup groupOfNames\\* Note \"groupOfNames\" is optional here, because it seems that the directory utility doesn't understand this concept. Expand \"groups\" and ensure the following for each record type. You can click the \"+\" to add the attribute types as needed. Attribute Mapping PrimaryGroupID gidNumber RecordName cn Click the \"+\" to add a users record type or scroll and find \"users\". Select \"users\" and ensure the following object classes exist. You can click the \"+\" to add them when needed. Record Type ObjectClasses Users inetOrgPerson posixAccount shadowAccount apple-user Expand \"users\" and ensure the following for each record type. You can click the \"+\" to add the attribute types as needed. Do not set homeDirectory otherwise you will fail to login. Attribute Mapping AuthenticationAuthority uid GeneratedUID GeneratedUID or ipaUniqueID HomeDirectory #/Users/\\$uid\\$ NFSHomeDirectory #/Users/\\$uid\\$ PrimaryGroupID gidNumber RealName cn RecordName uid UniqueID uidNumber UserShell loginShell AltSecurityIdentities #Kerberos:\\$krbPrincipalName\\$ If using custom mapping, click reach record type you created and ensure the base DN is set. Make sure each record type is set to all subtrees. Click \"security\" and set an authentication bind DN if needed Click OK Click OK Click on Search Policy. Double check that \"/LDAPV3/server1.ipa.example.com\" is listed beneath \"/Local/Default\" Close everything until you're back to the users & groups section of preferences Open a terminal. % dscacheutil -flushcache % dscacheutil -q user -a name username You should get a return. If you want to further verify users and groups after the above succeeds, open up the directory utility again. Click \"Directory Editor\", ensure you are searching for \"users\" and check that they appear in a list on the right hand side, optionally doing a search. In a default setup, you shouldn't need an account to do (some) anonymous lookups. If you changed that in any way, you will need to create a readonly system account in cn=sysaccounts,cn=etc. Login to the account for the first time from the login screen. Once the setup has complete, log out and back to a login account. In a terminal, you will need to make a mobile account. 2 % sudo /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -P # Press enter and put in the password. sudo may not function if you don't do this step. # OPTIONAL: Allow the mobile account to be an administrator % sudo dscl . -append /Groups/admin GroupMembership username Go to system preferences, users & groups and ensure the account is a mobile account.","title":"Monterey and older"},{"location":"el/freeipa/#ventura-and-likely-newer","text":"Go to system preferences -> users & groups Set \"automatic login\" to \"off\" Click \"edit\" next to \"Network account server\" Type in one of your IPA servers (you can duplicate it later for backup purposes). Press enter and wait for it to be \"green\". Click \"Open Directory Utility\" Click the \"lock\" to unlock the utility Click \"LDAPv3\" and click the pencil at the bottom left corner Select the \"from server\" portion under LDAP mappings and clck RFC2307. You may also leave it as custom. If you select rfc2307, it will ask for your base DN (eg, dc=ipa,dc=example,dc=com) If you select \"custom\", you will need to do this manually for each record type. You're better off using rfc2307 and working from there Click \"edit\" Click the \"+\" to add a groups record type or scroll and find \"groups\" and select it. Add the following object classes Record Type ObjectClasses Groups posixGroup ipausergroup groupOfNames\\* Note \"groupOfNames\" is optional here, because it seems that the directory utility doesn't understand this concept. Expand \"groups\" and ensure the following for each record type. You can click the \"+\" to add the attribute types as needed. Attribute Mapping PrimaryGroupID gidNumber RecordName cn Click the \"+\" to add a users record type or scroll and find \"users\". Select \"users\" and ensure the following object classes exist. You can click the \"+\" to add them when needed. Record Type ObjectClasses Users inetOrgPerson posixAccount shadowAccount apple-user Expand \"users\" and ensure the following for each record type. You can click the \"+\" to add the attribute types as needed. Do not set homeDirectory otherwise you will fail to login. Attribute Mapping AuthenticationAuthority uid GeneratedUID GeneratedUID or ipaUniqueID NFSHomeDirectory #/Users/\\$uid\\$ PrimaryGroupID gidNumber RealName cn RecordName uid UniqueID uidNumber UserShell loginShell AltSecurityIdentities #Kerberos:\\$krbPrincipalName\\$ If using custom mapping, click reach record type you created and ensure the base DN is set. Make sure each record type is set to all subtrees if needed. Click \"security\" and set an authentication bind DN if needed Click OK. Click Search Policy Double check that \"/LDAPV3/server1.ipa.example.com\" is listed beneath \"/Local/Default\". If it is not, select \"search patch\" and set it to custom and add it. Click Apply after. Close everything until you're back to the users & groups section of preferences Go to Lock Screen. Set \"login window shows\" to \"name and password\" Open a terminal. % dscacheutil -flushcache % dscacheutil -q user -a name username You should get a return. Login to the account for the first time from the login screen. Once the setup has complete, log out and back to a login account. In a terminal, you will need to make a mobile account. 3 % sudo /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -P # Press enter, enter the user's password. sudo may hang if you don't do this. # OPTIONAL: Allow the mobile account to be an administrator % sudo dscl . -append /Groups/admin GroupMembership username Go to system preferences and ensure the account is a mobile account.","title":"Ventura and likely newer"},{"location":"el/freeipa/#general-macos-notes","text":"Group Resolution If you want groups from IPA to resolve to the system, you'll need to enable the compat tree when using this setup (RFC2307). Password Notes There are a couple of potential issues with this setup that you should be aware of as it pertains to mobile accounts. If you do a mobile account, changing your password through the FreeIPA gui does not change your passwords on your system. If your account does not have any keytabs (eg, you haven't had your mac on or haven't logged in in over 24 hours), you can login with the new password and it will suceed. The system will cache the new password right away. However, your keychain the first time will ask for the old passwords and this is normal. So you can change them by hand or you can log out and back in and the system will ask you if you want to update the password and it will just update automatically. There have been reports in a github issue that states you can change the password in the system preferences but I've been unable to confirm this. Below is a script that can be adapted for you. It has not been tested on Monterey and up. This assumes that you took one mac and set it up properly and you created a tarball with the proper configuration. You could optionally setup a temporary NFS or samba mount that gets mounted as root and then unmounted at the end, if you so wish. #!/bin/bash serverName=server1.ipa.example.com krb5Conf=/etc/krb5.conf krb5Tab=/etc/krb5.keytab pamDirectory=/etc/pam.d # Add SSL cert to chain mkdir /etc/ipa cd /etc/ipa curl -OL http://$serverName/ipa/config/ca.crt security add-trusted-cert -d -k /Library/Keychains/System.keychain -r trustRoot /etc/ipa/ca.crt # Stop and flushout the Open Directory /usr/sbin/dscacheutil -flushcache launchctl unload /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist # Pull the plist and pam files needed for IPA and deploy them, this assumes you setup one mac and zipped up the configurations # You can try your hand at dsconfigldap before pam, but I could never figure it out, honestly. # Relevant tar: tar czf /tmp/macconfig.tar.gz /Library/Preferences/OpenDirectory/Configurations /etc/pam.d/authorization \\ # /etc/pam.d/screensaver /etc/pam.d/passwd /etc/krb5.conf cd /tmp curl -OL http://$serverName/macconfig.tar.gz cd / tar xzf /tmp/macconfig.tar.gz # Add steps here for your keytab! Where are you getting it from? cp /tmp/mac.keytab /etc/krb5.keytab chown root:wheel /etc/krb5.keytab chmod 600 /etc/krb5.keytab # Start directory launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist sleep 30 # Kill the loginwindow killall loginwindow # If the system doesn't reboot here, reboot now. If you want to move your local files, you will need to tread lightly here. I personally believe it's always good to start fresh though. Look into the ditto command. I suppose something like this can work: # make sure you're logged in as a different account away from your local account % sudo su - root# cd /Users root# ditto localfolder networkfolder (or maybe an mv?) root# chown -R user:user folder root# /System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n username -P Another issue you may run into, if you have been using your Mac with a local account for a while, a lot of directories in /Applications will be owned by localuser:staff or localuser:admin. It's recommended to fix those too. Discovery The directory framework in MacOS has the ability to discover settings for a particular LDAP server that it is being connected to. FreeIPA does not contain the schema, plugins, nor the infrastructure to provide the same things (for example, mDNS/Avahi, among other things). There was a (WIP) plugin created in 2017 by abbra. However, it is unclear if this works at all, nor is it clear if it ever did and will in python3 (abbra noted at the time that it \"installs\" into python 2 directories, which hints to not being tested or working on python 3). Please see the following resources for discussion and information. Pagure freeipa-macosx-support","title":"General macOS Notes"},{"location":"el/freeipa/#suse","text":"To setup openSUSE with FreeIPA, we'll need to do some manual work. This applies to SUSE 12 and up where the freeipa-client packages don't exist in the main repositories. freeipa repos There are OpenSUSE repos with the freeipa packages, though they are considered \"experimental\". If they show up in the base, then the below steps will be removed. However, if you are willing to use the repo , a lot of the steps below may not be needed. We have not tested this. # On an IPA server or client with the IPA utilities... % ipa host-add suse.example.com % /usr/sbin/ipa-getkeytab -s ipa.example.com -p host/suse.example.com -k /tmp/suse.keytab % scp /tmp/suse.keytab suse.example.com:/tmp/krb5.keytab # On the IPA client... % cp /tmp/krb5.keytab /etc % chmod 600 /etc/krb5.keytab % mkdir /etc/ipa % curl -o /etc/ipa/ca.crt http://ipa.example.com/ipa/config/ca.crt % curl -o /etc/pki/trust/anchors/ipa.example.com.crt http://ipa.example.com/ipa/config/ca.crt % update-ca-certificates % zypper install sssd sssd-ipa yast2-auth-client krb5-client openldap2-client cyrus-sasl-gssapi # Setup SSSD % vi /etc/sssd/sssd.conf [domain/example.com] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = example.com ipa_hostname = suse.example.com # Client Specific Settings ipa_server = _srv_, ipa.example.com dns_discovery_domain = example.com # If we have a trust with domain resolution order #full_name_format = %1$s id_provider = ipa auth_provider = ipa access_provider = ipa chpass_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, sudo, pam, ssh domains = example.com [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,tomcat,postgres homedir_substring = /home [pam] [sudo] [autofs] [ssh] # Setup kerberos % vi /etc/krb5.conf [libdefaults] default_realm = EXAMPLE.COM dns_lookup_realm = true dns_lookup_kdc = true rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] EXAMPLE.COM = { pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM suse.example.com = EXAMPLE.COM # Setup pam % pam-config -a --sss --mkhomedir --mkhomedir-umask=0077 \\ --pwhistory --pwhistory-remember=5 --localuser --cracklib \\ --cracklib-minlen=14 --cracklib-dcredit=-1 --cracklib-ucredit=-1 \\ --cracklib-lcredit=-1 --cracklib-ocredit=-1 --cracklib-retry=3 --unix-sha512 # Setup nsswitch (you can make it compat sss, but I use files sss) % sed -i.bak 's/compat$/files sss/g' /etc/nsswitch.conf % echo \"sudoers: files sss\" >> /etc/nsswitch.conf % sed -i '/netgroup/ s/nis/sss/g' /etc/nsswitch.conf # Depending on your suse version, you may want to set the nisdomainname # It does not hurt to set this % sed -i.bak '/NETCONFIG_NIS_STATIC_DOMAIN/ s/\"\"/\"example.com\"/g' /etc/sysconfig/network/config % netconfig update -f # Start sssd % systemctl enable sssd --now # Verify % id admin In the case of having an IPA-AD trust, you may need to change a line in your pam configuration. % sed -i 's/use_first_pass/forward_pass/g' /etc/pam.d/common-auth-pc # The affected line should appear like the below auth sufficient pam_sss.so forward_pass","title":"SUSE"},{"location":"el/freeipa/#hbac","text":"When we first setup our IPA servers, we had an option set to make it so hbac wasn't allowed for everyone. This way we have to create HBAC rules for our systems. I personally do this out of habit when working with IPA. What we need to do though is create an \"admin\" group that can login to all machines. % ipa idrange-show IPA.EXAMPLE.COM_id_range Range name: IPA.EXAMPLE.COM_id_range First Posix ID of the range: 686600000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range type: local domain range % ipa group-add --gid=686610000 linuxadm % ipa group-add-member --users=flast linuxadm Note for AD Users : In the event that your AD user or group of users will be an admin, you need to create an \"external\" group to map the user or users over. This isn't required if you don't have an AD trust. # Create an external group that the AD user/group goes into % ipa group-add --external linuxadm_external # Add the user (or group) into the external group % ipa group-add-member --users=aduser1@example.com linuxadm_external % ipa group-add-member --users=adgroup1@example.com linuxadm_external # Add the external group as a member of the IPA posix group. # aduser1 and adgroup1 are now effectively members of the linuxadm group in IPA. % ipa group-add-member --groups=linuxadm_external linuxadm Now, let's create an HBAC for our Linux Administrator account for our group. % ipa hbacrule-add --hostcat=all --servicecat=all --desc='linux admins all access' linuxadm % ipa hbacrule-add-user --groups=linuxadm linuxadm % ipa hbactest --rules=All_Systems --user=flast --host=server1.ipa.example.com --service=sshd % ipa hbactest --rules=All_Systems --user=aduser1@example.com --host=server1.ipa.example.com --service=sshd You might want to create an HBAC rule specifically for your IPA admin accounts to have ssh access to the IPA servers too. You can follow something like the above to make it possible. Or you can just add the IPA admins group into the HBAC rule we just made above. Group Types Groups in Active Directory have three types. These three types can actually change the behavior of how SSSD on the IPA domain controllers resolve them or if they'll even be resolvable at all. The three types are 'Domain Local', 'Global', and 'Universal'. If at all possible, avoid groups being 'Global'. Domain Local or Universal is recommended.","title":"HBAC"},{"location":"el/freeipa/#sudo","text":"Setting up sudo is relatively easy. SSSD (1.16.x and 2.X) supports IPA as a provider for sudo. Based on the last section, let's create a sample rule for our Linux admins that can login to every system, we want to ensure they can run all commands. % ipa sudorule-add --runasusercat=all --hostcat=all --cmdcat=all --desc='linux admins all sudo' all_linux_sudo % ipa sudorule-add-user --groups=linuxadm all_linux_sudo You can make this a little more specific, such as /bin/bash as everyone or otherwise. It's your call here. If you want to create a sudo rule and add some commands to it, you can do something like this. % ipa sudorule-add sudo_rule % ipa sudorule-add-allow-command --sudocmds=\"/usr/bin/less\" sudo_rule","title":"SUDO"},{"location":"el/freeipa/#legacy-client-setup","text":"This applies to Solaris, Omnios, others based on Illumos.","title":"Legacy Client Setup"},{"location":"el/freeipa/#solaris-10","text":"Setting up Solaris 10 as an IPA client is an interesting feat. However, it comes with security issues. No SSL or TLS Support Note that for Solaris 10 to talk to IPA, you must use clear text communication. Solaris 10 is too old to use new ciphers. However, while LDAP may be clear text, kerberos should still be secure enough for the time being. If you are using an AD trust, the user's passwords will be passed in clear text. Highly suggested that you decommission Solaris 10 from your environment. Solaris 10 will eventually be removed from this page. Create an ldif for your service account (optional) dn: uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com objectclass: account objectclass: simplesecurityobject uid: solaris userPassword: secret123 passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 The solaris system account is required. So now, add it in. % ldapadd -xWD 'cn=Directory Manager' -f /tmp/solaris.ldif Now, set the nisdomain. % defaultdomain ipa.example.com % echo 'ipa.example.com' > /etc/defaultdomain Configure kerberos. % vi /etc/krb5/krb5.conf [libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_kdc = true verify_ap_req_nofail = false [realms] IPA.EXAMPLE.COM = { } [domain_realm] ipa.example.com = IPA.EXAMPLE.COM .ipa.example.com = IPA.EXAMPLE.COM [logging] default = FILE:/var/krb5/kdc.log kdc = FILE:/var/krb5/kdc.log kdc_rotate = { period = 1d version = 10 } [appdefaults] kinit = { renewable = true forwardable= true } Generate a keytab and bring it over. # on the ipa server % ipa host-add solaris10.example.com % ipa-getkeytab -s server1.ipa.example.com -p host/solaris10.example.com -k /tmp/solaris10.keytab # Transfer the keytab % scp /tmp/solaris10.keytab solaris10.example.com:/tmp # On the solaris 10 machine % cp /tmp/solaris10.keytab /etc/krb5/krb5.keytab % chmod 600 /etc/krb5/krb5.keytab % chmod 644 /etc/krb5/krb5.conf % chown root:sys /etc/krb5/* % kinit flast2@IPA.EXAMPLE.COM Create the LDAP configurations, bring the certificate, and create an NSS database. % mkdir /etc/ipa /var/ldap % cd /etc/ipa % wget -O ipa.pem http://server1.ipa.example.com/ipa/config/ca.crt % certutil -A -n \"ca-cert\" -i /etc/ipa/ipa.pem -a -t CT -d . % cp * /var/ldap % vi /etc/ldap.conf base dc=ipa,dc=example,dc=com scope sub TLS_CACERTDIR /var/ldap TLS_CERT /var/ldap/cert8.db TLS_CACERT /var/ldap/ipa.pem tls_checkpeer no ssl off bind_timelimit 120 timelimit 120 uri ldap://server1.ipa.example.com sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com pam_lookup_policy yes Now init the ldap client. No Secure Connection When using this, you are not creating a secure connection. The Solaris 10 SSL libraries are so old that they cannot work with the ciphers that FreeIPA has turned on. AD Trust - Different Trees If using an AD trust, you should use the second example, where it looks at the compat tree for users. No Service Account If you have configured FreeIPA to not allow any anonymous connections, you will need to use a proxy account. We have provided the examples for this configuration. Without an AD Trust # Without AD Trust (no proxy) % ldapclient manual -a authenticationMethod=none \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # Without AD Trust (proxy) % ldapclient manual -a credentialLevel=proxy \\ -a authenticationMethod=simple \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 With an AD Trust # With AD Trust (no proxy) % ldapclient manual -a authenticationMethod=none \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # With AD Trust (proxy) % ldapclient manual -a credentialLevel=proxy \\ -a authenticationMethod=simple \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 This should succeed. Once it succeeds, you need to configure pam and nsswitch. AD Trust Information In the event you don't have an AD trust, you can change the \"binding\" lines to required, remove the pam_ldap lines, and change pam_krb5 lines to read \"required\" % vi /etc/pam.conf # Console login auth requisite pam_authtok_get.so.1 login auth sufficient pam_krb5.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth sufficient pam_unix_auth.so.1 server_policy login auth sufficient pam_ldap.so.1 rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth sufficient pam_krb5.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth sufficient pam_unix_auth.so.1 server_policy rlogin auth sufficient pam_ldap.so.1 # Needed for krb krlogin auth required pam_unix_cred.so.1 krlogin auth sufficient pam_krb5.so.1 # Needed for krb krsh auth required pam_unix_cred.so.1 krsh auth required pam_krb5.so.1 # ? ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth sufficient pam_krb5.so.1 ppp auth required pam_dial_auth.so.1 ppp auth binding pam_unix_auth.so.1 server_policy ppp auth sufficient pam_ldap.so.1 # Other, used by sshd and \"others\" as a fallback other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth sufficient pam_krb5.so.1 other auth required pam_unix_cred.so.1 other auth sufficient pam_unix_auth.so.1 server_policy other auth sufficient pam_ldap.so.1 other account requisite pam_roles.so.1 other account required pam_projects.so.1 other account binding pam_unix_account.so.1 server_policy other account sufficient pam_krb5.so.1 other account sufficient pam_ldap.so.1 other session required pam_unix_session.so.1 other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 force_check other password required pam_authtok_store.so.1 server_policy # passwd and cron passwd auth binding pam_passwd_auth.so.1 server_policy passwd auth sufficient pam_ldap.so.1 cron account required pam_unix_account.so.1 # SSH Pubkey - Needed for openldap and still probably needed sshd-pubkey account required pam_unix_account.so.1 % vi /etc/nsswitch.conf # Below are just the minimum changes passwd: files ldap [NOTFOUND=return] group: files ldap [NOTFOUND=return] sudoers: files ldap netgroup: ldap # the rest here are just here, up to you if you choose to set them. hosts: files dns ipnodes: files dns ethers: files ldap publickey: files ldap automount: files ldap You can test now if you'd like. bash-3.2# ldaplist -l passwd flast2 dn: uid=flast2,cn=users,cn=compat,dc=ipa,dc=example,dc=com cn: First Last objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gidNumber: 1006800001 gecos: First Last uidNumber: 1006800001 ipaAnchorUUID: :IPA:ipa.example.com:8babb9a8-5aaf-11e7-9769-00505690319e loginShell: /bin/bash homeDirectory: /home/first.last2 uid: first.last2 I recommend setting up sudo at least... if you want to use sudo, install the sudo-ldap from sudo.ws for Solaris 10.","title":"Solaris 10"},{"location":"el/freeipa/#solaris-11","text":"Solaris 11 shares similar configuration to Solaris 10. There are a couple of manual things we have to do, but they are trivial. Solaris 11/Omnios will use TLS and sudo should just work. AD Groups In Solaris 10, users who logged in with AD users (with their short name) would appear as their full name ( name@domain ). This allowed their groups to fully resolve. However, in Solaris 11.4, this was not the case. Short name logins will work but your groups will not resolve as the compat tree uses the full name. To avoid running into this problem, you should be on at least SRU 11.4.7.4.0. Note that on a later SRU, you may need to setup an ID view (without overrides) for groups and sudo to work again. Below is for the service account like in the previous section, here as a reference. dn: uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com objectclass: account objectclass: simplesecurityobject uid: solaris userPassword: secret123 passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 % ldapadd -xWD 'cn=Directory Manager' -f /tmp/solaris.ldif Now, set the nisdomain. % defaultdomain ipa.example.com % echo 'ipa.example.com' > /etc/defaultdomain Configure kerberos. % vi /etc/krb5/krb5.conf [libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_kdc = true verify_ap_req_nofail = false [realms] IPA.EXAMPLE.COM = { } [domain_realm] ipa.example.com = IPA.EXAMPLE.COM .ipa.example.com = IPA.EXAMPLE.COM [logging] default = FILE:/var/krb5/kdc.log kdc = FILE:/var/krb5/kdc.log kdc_rotate = { period = 1d version = 10 } [appdefaults] kinit = { renewable = true forwardable= true } Generate a keytab and bring it over. # on the ipa server % ipa host-add solaris11.example.com % ipa-getkeytab -s server1.ipa.example.com -p host/solaris11.example.com -k /tmp/solaris11.keytab # Transfer the keytab % scp /tmp/solaris11.keytab solaris11.example.com:/tmp # On the solaris 11 machine % cp /tmp/solaris11.keytab /etc/krb5/krb5.keytab % chmod 600 /etc/krb5/krb5.keytab % chmod 644 /etc/krb5/krb5.conf % chown root:sys /etc/krb5/* # Check the keytab % klist -ket /etc/krb5/krb5.keytab # Test that you can kinit % kinit flast2@IPA.EXAMPLE.COM Create the LDAP configurations, bring the certificate, and create an NSS database. Solaris 11.3 vs 11.4 Previously we had 11.3 and 11.4 configurations. We have removed 11.3 as we no longer support it. % mkdir /etc/ipa /var/ldap % cd /etc/ipa % wget -O ipa.pem http://server1.ipa.example.com/ipa/config/ca.crt % cp * /var/ldap % vi /etc/ldap.conf base dc=ipa,dc=example,dc=com scope sub bind_timelimit 120 timelimit 120 uri ldap://server1.ipa.example.com sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com pam_lookup_policy yes TLS_CACERTDIR /var/ldap ssl start_tls tls_checkpeer no Now init the ldap client. We actually get to use a secure connection here. Kerberos is hit or miss, could never get sasl/GSSAPI to work. Different Trees - Trust or not? There are multiple examples of how to setup the trees. If using an AD trust, you should use the second example, where it looks at the compat tree for users. However, if you do not have trusts, then it is perfectly possible to still use the AD Trust example. Try both and see which works better for your environment. No Service Account If you have configured FreeIPA to not allow any anonymous connections, you will need to use a proxy account. We have provided the examples for this configuration. Without AD Trust # Without AD Trust (no proxy) % ldapclient manual -a authenticationMethod=tls:simple \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # Without AD Trust (proxy) % ldapclient manual -a authenticationMethod=tls:simple \\ -a credentialLevel=proxy \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # Without AD Trust (Kerberos) - Only works if Solaris is in the same DNS domain as IPA % ldapclient manual -a authenticationMethod=sasl/GSSAPI \\ -a credentialLevel=self \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 With AD Trust # With AD Trust (no proxy) % ldapclient manual -a authenticationMethod=tls:simple \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # With AD Trust (proxy) % ldapclient manual -a authenticationMethod=tls:simple \\ -a credentialLevel=proxy \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # With AD Trust (Kerberos) - Only works if Solaris is in the same DNS domain as IPA % ldapclient manual -a authenticationMethod=sasl/GSSAPI \\ -a credentialLevel=self \\ -a proxyDN=\"uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com\" \\ -a proxyPassword=\"secret123\" \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.ipa.example.com server2.ipa.example.com\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 This should succeed. Once it succeeds, you need to configure pam and nsswitch. % /usr/sbin/svccfg -s name-service/switch setprop config/sudoer = astring: \"files ldap\" % /usr/sbin/svccfg -s name-service/switch setprop config/password = astring: \"files ldap [NOTFOUND=return]\" % /usr/sbin/svccfg -s name-service/switch setprop config/group = astring: \"files ldap [NOTFOUND=return]\" % /usr/sbin/svcadm refresh svc:/system/name-service/switch % /usr/sbin/svcadm restart svc:/system/name-service/switch % /usr/sbin/svcadm restart ldap/client AD Trust Information In the event you don't have an AD trust, you can change the \"binding\" lines to required and remove the pam_ldap lines. Optionally, you can set pam_krb5 to \"required\", however sufficient should work just fine. Without an AD Trust % vi /etc/pam.d/login auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth sufficient pam_krb5.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_unix_auth.so.1 server_policy % vi /etc/pam.d/other auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth sufficient pam_krb5.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_unix_auth.so.1 server_policy account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account required pam_unix_account.so.1 server_policy account sufficient pam_krb5.so.1 session definitive pam_user_policy.so.1 session required pam_unix_session.so.1 password definitive pam_user_policy.so.1 password include pam_authtok_common password sufficient pam_krb5.so.1 password required pam_authtok_store.so.1 server_policy % vi /etc/pam.d/sshd-pubkey account required pam_unix_account.so.1 With an AD Trust % vi /etc/pam.d/login auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth sufficient pam_krb5.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_unix_auth.so.1 server_policy auth sufficient pam_ldap.so.1 % vi /etc/pam.d/other auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth sufficient pam_krb5.so.1 auth required pam_unix_cred.so.1 auth sufficient pam_unix_auth.so.1 server_policy auth sufficient pam_ldap.so.1 account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account binding pam_unix_account.so.1 server_policy account sufficient pam_krb5.so.1 account sufficient pam_ldap.so.1 session definitive pam_user_policy.so.1 session required pam_unix_session.so.1 password definitive pam_user_policy.so.1 password include pam_authtok_common password sufficient pam_krb5.so.1 password required pam_authtok_store.so.1 server_policy % vi /etc/pam.d/sshd-pubkey account required pam_unix_account.so.1 You can test now if you'd like. root@solaris11:~# ldaplist -l passwd flast2 dn: uid=flast2,cn=users,cn=compat,dc=ipa,dc=example,dc=com cn: First Last objectClass: posixAccount objectClass: ipaOverrideTarget objectClass: top gidNumber: 1006800001 gecos: First Last uidNumber: 1006800001 ipaAnchorUUID: :IPA:ipa.example.com:8babb9a8-5aaf-11e7-9769-00505690319e loginShell: /bin/bash homeDirectory: /home/first.last2 uid: first.last2","title":"Solaris 11"},{"location":"el/freeipa/#automated-scripts","text":"I at one point built a bunch of scripts to automate Solaris servers talking to IPA here . However, it is likely the scripts no longer work or contain outdated information.","title":"Automated Scripts"},{"location":"el/freeipa/#ad-trust-double-uid","text":"Solaris 11 once in a while gets random regressions when it comes to authentication and ID's, among many other things they randomly decide to break. Big shout out to Oracle. In a brief discussion with a user in the #freeipa IRC channel, the user was trying to find a way to chop off the domain name for logins but also have sudo still work as there were some random issues in general. We both discovered that in SRU 11.4.20.4.0, even though both UID's are present from ldaplist -l passwd, sudo was no longer working properly. The first thing we tried was to create an ID view and override a user with a new username. This successfully removed the domain, but did not solve the sudo problem. He instead got \"no account present for that user\". However, I wasn't able to replicate this. However, later, one thing he noticed is after creating an ID view with no overrides and pointing Solaris 11 to the view in the compat tree, Solaris 10-esque authentication ID reporting started to occur. Running ldaplist -l passwd user reported back the double UID as expected, but the FQDN comes first which resolved his group/sudo issues. # Create a view... no id overrides required here % ipa idview-add solaris # On Solaris... # Take EXTREME care with the group and passwd base DN's, they need to point # to the view properly # This example uses kerberos to authenticate. % ldapclient manual -a authenticationMethod=self \\ -a credentialLevel=sasl/GSSAPI \\ -a defaultSearchBase=dc=ipa,dc=example,dc=com \\ -a domainName=ipa.example.com \\ -a defaultServerList=\"server1.angelsofclockwork.net server2.angelsofclockwork.net\" \\ -a followReferrals=true \\ -a objectClassMap=shadow:shadowAccount=posixAccount \\ -a objectClassMap=passwd:posixAccount=posixaccount \\ -a objectClassMap=group:posixGroup=posixgroup \\ -a serviceSearchDescriptor=group:cn=groups,cn=solaris,cn=views,cn=compat,dc=angelsofclockwork,dc=net \\ -a serviceSearchDescriptor=passwd:cn=users,cn=solaris,cn=views,cn=compat,dc=angelsofclockwork,dc=net \\ -a serviceSearchDescriptor=netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com \\ -a serviceSearchDescriptor=sudoers:ou=sudoers,dc=ipa,dc=example,dc=com \\ -a bindTimeLimit=5 # Make sure you set your props... % /usr/sbin/svccfg -s name-service/switch setprop config/sudoer = astring: \"files ldap\" % /usr/sbin/svccfg -s name-service/switch setprop config/password = astring: \"files ldap [NOTFOUND=return]\" % /usr/sbin/svccfg -s name-service/switch setprop config/group = astring: \"files ldap [NOTFOUND=return]\" % /usr/sbin/svcadm refresh svc:/system/name-service/switch % /usr/sbin/svcadm restart svc:/system/name-service/switch % /usr/sbin/svcadm restart ldap/client # Verify... % ldaplist -l passwd adusername . . . % id -a adusername . . . Thank you to \"mewho\" on libera for finding this interesting workaround.","title":"AD Trust Double UID"},{"location":"el/freeipa/#omniosillumos","text":"Some steps between Solaris 10 and 11 can be followed to make OmniOS work. However, we have been unable to resolve why sudo will not work when using an AD trust. If you are using a standalone FreeIPA and no trust, sudo should work just fine.","title":"OmniOS/Illumos"},{"location":"el/freeipa/#legacy-hbac","text":"For HBAC to work on Solaris, you will need to compile the pam_hbac module found here . I would clone the current master branch or download the master.zip to your Solaris system. Each OS has their set of instructions for compiling. First, create the following system account. We will need this when we are configuring our legacy clients. dn: uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com objectClass: account objectClass: simplesecurityobject objectClass: top uid: hbac userPassword: password","title":"Legacy HBAC"},{"location":"el/freeipa/#solaris-10_1","text":"% /opt/csw/bin/pkgutil -i -y libnet ar binutils gcc4g++ glib2 libglib2_dev gmake % /opt/csw/bin/pkgutil -i -y libnet ar binutils gcc4g++ glib2 libglib2_dev gmake % PATH=$PATH:/opt/csw/bin % export M4=/opt/csw/bin/gm4 % autoconf -o configure % autoreconf -i # Yes, SSL must be disabled for Solaris 10 to work. The libraries are too old. # You may or may not need to set CFLAGS, CXXFLAGS, and LDFLAGS with -m32 % ./configure AR=/opt/csw/bin/gar --with-pammoddir=/usr/lib/security --sysconfdir=/etc/ --disable-ssl --disable-man-pages % make % make install","title":"Solaris 10"},{"location":"el/freeipa/#solaris-11_1","text":"% pkg install autoconf libtool pkg-config automake gcc docbook % autoreconf -if % ./configure --with-pammoddir=/usr/lib/security --mandir=/usr/share/man --sysconfdir=/etc/ % make % make install","title":"Solaris 11"},{"location":"el/freeipa/#omnios","text":"% pkg install developer/build/autoconf developer/build/libtool \\ developer/pkg-config developer/build/automake \\ developer/gcc48 system/header developer/object-file \\ developer/linker % autoreconf -if % ./configure --with-pammoddir=/usr/lib/security --mandir=/usr/share/man --sysconfdir=/etc/ % make % make install","title":"Omnios"},{"location":"el/freeipa/#pam_hbacconf","text":"% vim /etc/pam_hbac.conf # Replace client with your server's FQDN URI = ldap://server.ipa.example.com BASE = dc=ipa,dc=example,dc=com BIND_DN = uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com BIND_PW = password SSL_PATH = /var/ldap HOST_NAME = client","title":"pam_hbac.conf"},{"location":"el/freeipa/#pam-configuration","text":"# Solaris 10 - /etc/pam.conf # Modify the other account section... It should come at the end of the account blocks. . . . other account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail # Solaris 11 - /etc/pam.d/other # Same here, only modify the account section . . . account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail In the event you cannot login or things aren't working the way you'd expect, add 'debug' to the end of the pam_hbac line and watch /var/log/authlog for errors.","title":"PAM Configuration"},{"location":"el/freeipa/#login-with-ad-users-to-legacy-clients","text":"For AD users to be able to login to legacy clients, you have to enable system-auth to the IPA servers. Without it, users will be denied access, regardless of HBAC controls or if you're using the pam_hbac module. % ipa hbacsvc-add system-auth % ipa hbacrule-add legacy_client_auth % ipa hbacrule-add-host --hostgroups=ipaservers legacy_client_auth % ipa hbacrule-mod --usercat=all legacy_client_auth","title":"Login with AD Users to Legacy Clients"},{"location":"el/freeipa/#legacy-active-directory-trust-notes","text":"Just a section of notes.","title":"Legacy Active Directory Trust Notes"},{"location":"el/freeipa/#domain-resolution-order-oddness","text":"If using domain resolution order, AD users get double uid attributes - but only if they login with their shortname. If they login with fqdn, double uid's do not occur. But shortnames do not work anymore. Have to restart the directory server to make short names work again.","title":"Domain Resolution Order Oddness"},{"location":"el/freeipa/#solaris-weirdness","text":"If using domain resolution order, Solaris 10 gets the group resolution correct for short named AD users. Solaris 11 does not unless you are on SRU 11.4.7.4.0 or newer. There is a way to chop off the domain name from the uid using views.","title":"Solaris Weirdness"},{"location":"el/freeipa/#domain-options","text":"This section goes over \"situational\" scenarios. These scenarios are reflective of the environment in which IPA is installed and not all will fit into your environment. These are more or less common situations that could occur during an IPA deployment or even post-deployment.","title":"Domain Options"},{"location":"el/freeipa/#remove-realm-for-ad-users","text":"A common scenario is that IPA and AD will have a trust, but there will not be any IPA users with the exception of the engineering team for managing IPA itself. The common theme is that because of this, the engineers and customers would rather not login with username@realm . Info The following is only applicable in an IPA-AD trust. An IPA-only scenario would not require any of these steps and most pieces would work natively (no @realm, sudo, hbac). In the event that you are in an IPA-AD scenario, please take note that this can adversely affect legacy clients. This will cause ldapsearches that are done in the compat tree to display multiple uid attributes. In most cases, this is fine and the user can still login without the realm name. The whoami and id commands will show the domain. There's no workaround for this. On the IPA servers, you will need to set the domain resolution order. This was introduced in 4.5.0. % kinit admin % ipa config-mod --domain-resolution-order=\"example.com:ipa.example.com\" After, you will need to clear out your SSSD cache. # sss_cache -E is insufficient for this. % systemctl stop sssd % rm -rf /var/lib/sss/db/* % systemctl start sssd The below is optional. It will remove the @realm off the usernames, like on the prompt or id or whoami commands. Only do this if required. Only do this on the clients. Do not make this change on an IPA replica. # vi /etc/sssd/sssd.conf [domain/ipa.example.com] . . . full_name_format = %1$s This will ensure EL7, EL8, EL9 clients resolve the AD domain first when attempting logins and optionally drop the @realm off the usernames.","title":"Remove @realm for AD users"},{"location":"el/freeipa/#ad-and-ipa-group-names-with-short-names","text":"You may notice that your clients have intermittent issues with name resolution when the following are true: Groups (or users) have the same names in both IPA and AD You are using domain resolution order You are shortening names on the clients You may want to actually search for them to identify the errant groups and then correct them. You can correct them either on the AD or IPA side. I would opt for the IPA side. % kinit admin@IPA.EXAMPLE.COM % vi /tmp/dupecheck.sh #!/bin/bash for x in ${ARRAY[*]} ; do ldapsearch -x -b \"DC=example,DC=com\" -h example.com -LLL -w 'PASSWORD' -D 'username@example.com' samaccountname=\"$x\" samaccountname | grep -q $x if [[ $? -eq 0 ]]; then echo \"$x: DUPLICATE\" fi done % bash /tmp/dupecheck.sh If you run into any duplicates, they should show up in a list for you address. sAMAccountName vs CN The \"CN\" and \"sAMAccountName\" attributes are not the same in AD, depending on who made the group or other factors. The sAMAccountName attribute is the value used to determine names from AD, whether you are enrolled with AD or the IPA server SSSD is pulling the information. This is why we are searching for that attribute, and not the CN.","title":"AD and IPA group names with short names"},{"location":"el/freeipa/#sites-and-ad-dcs","text":"By creating a subdomain section in /etc/sssd/sssd.conf on an IPA server, it is possible to set an AD Site or AD server(s) directly in SSSD. By default, sssd tries to do location based discovery. There may be a case where this isn't possible (eg, only a set of AD servers may only be contacted in certain \"air gapped\" networks). [domain/ipa.example.com/example.com] # If you want a site ad_site = Site_Name # If you want a server(s) ad_server = dc1.example.com, dc2.example.com # A backup? ad_backup_server = dc3.example.com, dc4.example.com If you don't have access or a way to find the sites using the Windows tools, you can run an ldapsearch to find it (or an equivalent ldap browsing tool). % ldapsearch -x -h example.com -s one -WD 'CN=username,CN=Users,DC=example,DC=com' \\ -b 'CN=Sites,CN=Configuration,DC=example,DC=com' cn This should report back your sites. If you want to know the servers for those sites (in case you don't want to deal with the sites, but just the DC's themselves), you use ldapsearch but use the base DN of the site name. % ldapsearch -x -h example.com -WD 'CN=username,CN=Users,DC=example,DC=com' \\ -b 'CN=Servers,CN=Site_Name,CN=Sites,CN=Configuration,DC=example,DC=com' dnsHostName Hardcoded DC's If the DC's change at any time and they are harded in your sssd.conf, it is up to you to know when new controllers are being added or removed as to not disrupt the connectivity from IPA to AD when performing user or group lookups.","title":"Sites and AD DC's"},{"location":"el/freeipa/#enterprise-linux-6-sudo-and-default-domain-suffix","text":"This issue with the above section is that once you do this, sudo rules will begin failing, they will no longer work for Enterprise Linux 6. This is because sssd was changed to look for cn=sudo rather than ou=sudoers. To enable the compatibility fall back, you will need to install a newer SSSD.","title":"Enterprise Linux 6 SUDO and Default Domain Suffix"},{"location":"el/freeipa/#set-default-shell-for-ad-users","text":"By default, after a trust has been established, the shell all AD users get is /bin/sh. To change this, you must change the sssd.conf on the IPA masters. % vi /etc/sssd/sssd.conf [domain/ipa.example.com] . . . default_shell = /bin/bash % systemctl restart sssd","title":"Set Default Shell for AD Users"},{"location":"el/freeipa/#automated-kerberos-principals","text":"Once in a great while, we run into situations where we need to have an automated process for creating principals and keytabs. This section takes a look at some of those examples that we've ran into.","title":"Automated Kerberos Principals"},{"location":"el/freeipa/#hadoopcloudera","text":"This assumes you are using Cloudera Manager and not Ambari in any form. DNS Information It is highly likely that if you are using AWS, your nodes are getting stupid names like compute.internal. While there is a a way to change this if you don't change it, you will need to rely on something like DNSMASQ to allow the nodes to communicate with FreeIPA. FreeIPA will be upset about the stupid names because it can't do a rDNS lookup.","title":"Hadoop/Cloudera"},{"location":"el/freeipa/#cloudera-manager-woes","text":"It is likely you have Cloudera/Hadoop, it is also very likely you (or another team) are deploying and using Cloudera Manager (or Director?). You may be running into issues that involve direct Active Directory integration. Maybe you're moving away from a standalone LDAP system over to Active Directory or even FreeIPA. Maybe you have FreeIPA in an AD trust but the users or contractors absolutely insist on using AD against their better judgement, despite the problems they're running into. Whatever the scenario is, we feel your pain. Here are some things you should probably know: Cloudera Manager (or Director?) supports Active Directory out of the box and obviously not FreeIPA despite the devs wanting to work something out back in 2015 Ambari has support for FreeIPA, but we are focusing on Cloudera Manager here. Cloudera Manager supports custom keytab retrieval scripts Hostnames that are longer than 15 characters, regardless of the cloud provider or onprem setup, will ultimately fail The NETBIOS limit in AD is 16 characters, which is 15 + $ at the end - This means hosts will enroll on top of themselves and your cluster will be broken FreeIPA does not have the name limitation and using an AD trust, AD users can freely use Hadoop when the cluster is properly setup. Enrolling the cluster nodes into FreeIPA and using a custom retrieval script will solve most (if not all) of the issues you may run into as well when it comes to keytabs, which Hadoop heavily relies on. The custom script is simply because Cloudera by default likes having direct access to the kerberos infrastructure, which is a no-go for FreeIPA.","title":"Cloudera Manager Woes"},{"location":"el/freeipa/#the-solution","text":"To summarize, here is our proposed solution: Create an account called cdh Create a role called \"Kerberos Managers\" and apply the following privileges: System: Manage Host Keytab System: Manage Host Keytab Permissions System: Manage Service Keytab System: Manage Service Keytab Permissions System: Manage User Principals (was not actually used, but who knows what we could use the role for later) Apply the role to the cdh account Create a custom script they could use to enroll the servers into FreeIPA (out of scope here) Create a custom script that utilizes the cdh account to create services So let's create the necessary things we need. # Create the account # Note... you may want to make this account non-expiring since it's just a service account % ipa user-add --first=\"Cloudera\" --last=\"Key Manager\" cdh # Create the Kerberos Managers role % ipa role-add \"Kerberos Managers\" # Create the kerberos manager privilege % ipa privilege-add \"Privileges - Kerberos Managers\" % ipa privilege-add-permission \"Privileges - Kerberos Managers\" \\ --privileges=\"System: Manage Host Keytab\" \\ --privileges=\"System: Manage Host Keytab Permissions\" \\ --privileges=\"System: Manage Service Keytab\" \\ --privileges=\"System: Manage Service Keytab Permissions\" \\ --privileges=\"System: Manage User Principals\" # Add the privilege to the role % ipa role-add-privilege \"Kerberos Managers\" \\ --privileges=\"Privileges - Kerberos Managers\" # Add the user to the role % ipa role-add-member --users=cdh \"Kerberos Managers\" # Optionally, we can export the keytab for the user with a password # You will see why in the next script % ipa-getkeytab -p cdh@EXAMPLE.COM -k cdh.keytab -P Now we need our special kerberos keytab retrieval script. #!/bin/bash # Created by: @nazunalika - Louis Abel # Purpose: To retrieve keytabs for Cloudera / Hadoop # https://github.com/nazunalika/useful-scripts # Disclaimer: We do not take responsibilities for breaches or misconfigurations of # software. Use at your own risk # Variables # This can be anywhere, but it SHOULD be secure with at least 600 permissions CDHKT=\"/root/.cdh/cdh.keytab\" CDHUSER=\"cdh\" IPAREALM=\"EXAMPLE.COM\" # This can be any server. You could make an array and have it randomly selected IPASERVER=\"ipa01.example.com\" # Where is this going? DESTINATION=\"$1\" # The full principal for the keytab in question FULLPRINC=\"$2\" # Shortened name PRINC=$(echo $FULLPRINC | sed \"s/\\@$(echo $IPAREALM)//\") 00_kinitUser() { # Pick what suits you best, we prefer using a keytab # Password based kinit, based on the keytab we created prior! # You could also have this in a file somewhere, I guess. Just # has to be secured. echo ThisIsAWeakPassword | kinit $CDHUSER@$IPAREALM # Keytab based kinit, obviously we created it before right? It just needs to be # on the right system, deployed in some secure manner #kinit -kt $CDHKT $CDHUSER@$IPAREALM if [[ $? == \"1\" ]]; then echo FAILED TO KINIT exit fi } 01_createPrinc() { echo \"INFO: Checking for existing principle\" if ipa service-find $FULLPRINC; then echo \"INFO: Principle found\" else echo \"INFO: Not found, creating\" ipa service-add $FULLPRINC fi } 02_createServiceAllows() { # We need to allow the service to create and retrieve keytabs echo \"INFO: Ensuring service allows to create and retrieve keytabs\" ipa service-allow-create-keytab --users=$CDHUSER $FULLPRINC ipa service-allow-retrieve-keytab --users=$CDHUSER $FULLPRINC # Let's retrieve the keytabs if ipa service-show $FULLPRINC | grep 'Keytab' | grep 'False'; then echo \"INFO: Creating keytab for $FULLPRINC to $DESTINATION\" ipa-getkeytab -s $IPASERVER -p $PRINC -k $DESTINATION else echo \"INFO: Retriving keytab for $FULLPRINC to $DESTINATION\" ipa-getkeytab -r -s $IPASERVER -p $PRINC -k $DESTINATION fi } 00_kinitUser 01_createPrinc 02_createServiceAllows kdestroy exit 0 Place the above script in a file that is accessible by the cloudera manager such as /usr/local/bin/getKeytabsCDH.sh and ensure it is owned by cloudera-scm with a permission set of 775. During the kerberos wizard, stop when you are verifying the \"cdh\" user. You will need to set the configuration for \"Custom Kerberos Keytab Retrieval Script\" to /usr/local/bin/getKeytabsCDH.sh and then you're almost there. 4 An important tidbit is currently Enterprise Linux 7+ and higher use memory based keytabs and java doesn't support them. 5 Because of this, the /etc/krb5.conf should be modified. % cat /etc/krb5.conf . . . # Make sure the below is commented # default_ccache_name = KEYRING:persistent:%{uid} . . .","title":"The Solution"},{"location":"el/freeipa/#dns-forwarding","text":"","title":"DNS Forwarding"},{"location":"el/freeipa/#dns-forwarding-to-dot","text":"Presently, FreeIPA does not support DoT (DNS over TLS) nor DoH (DNS over HTTPS) (this appears to be a bind limitation and we can't find documentation that says otherwise). However, it is possible to setup unbound to do the forwarding for you, in which you tell your bind servers (or in this case, the bind DNS servers in your IPA domain) to forward to that unbound server for all forwarding. Keep it Separate It is recommended to keep your unbound service separate from the IPA servers. Spin up another instance in your network that will run unbound or run it on a standalone bind server that you may have on a separate port. To forward to the unbound service, modify the DNS global configuration in IPA: # Replace 10.100.0.224 with the IP of your unbound instance % ipa dnsconfig-mod --forward-policy=only --forwarder='10.100.0.224' # Add 'port xxxx' if you have set unbound to another port % ipa dnsconfig-mod --forward-policy=only --forwarder='10.100.0.224 port 9553'","title":"DNS Forwarding to DoT"},{"location":"el/freeipa/#logging","text":"","title":"Logging"},{"location":"el/freeipa/#audit-logs","text":"By default, the audit logs in /var/log/dirsrv/slapd-INSTANCE/audit do not get populated. And the access logs don't show much in terms of modifications and what is being changed. There is also /var/log/httpd/* logs, but it may be useful to see ldif style logging for changes against FreeIPA. # Modify the DSE configuration by turning on audit logging [label@ipa01 ~]# ldapmodify -D \"cn=directory manager\" -W -p 389 -h localhost Enter LDAP Password: dn: cn=config changetype: modify replace: nsslapd-auditlog-logging-enabled nsslapd-auditlog-logging-enabled: on # Press CTRL+d here modifying entry \"cn=config\" # To test, I'll add a user to a group [label@ipa01 ~]$ ipa group-add-member --users=jbaskets aocusers Group name: aocusers GID: 686600003 Member users: ..., jbaskets ------------------------- Number of members added 1 ------------------------- # Let's verify the log [label@ipa01 ~]$ sudo su - [sudo] password for label: Last login: Sun Mar 29 16:42:36 MST 2020 on pts/0 [root@ipa01 ~]# cd /var/log/dirsrv/slapd-EXAMPLE-NET/ [root@ipa01 slapd-EXAMPLE-NET]# cat audit time: 20200329223754 dn: cn=config result: 0 changetype: modify replace: nsslapd-auditlog-logging-enabled nsslapd-auditlog-logging-enabled: on - replace: modifiersname modifiersname: cn=directory manager - replace: modifytimestamp modifytimestamp: 20200330053754Z - 389-Directory/1.4.1.3 B2019.323.229 ipa01.example.net:636 (/etc/dirsrv/slapd-EXAMPLE-NET) # Looks like right here the modification happened time: 20200329224007 dn: cn=aocusers,cn=groups,cn=accounts,dc=example,dc=net result: 0 changetype: modify add: member member: uid=jbaskets,cn=users,cn=accounts,dc=example,dc=net - replace: modifiersname modifiersname: uid=label,cn=users,cn=accounts,dc=example,dc=net - replace: modifytimestamp modifytimestamp: 20200330054006Z - replace: entryusn entryusn: 900028 -","title":"Audit Logs"},{"location":"el/freeipa/#certificates","text":"These are notes of things I've ran into before while dealing with certificates.","title":"Certificates"},{"location":"el/freeipa/#renewed-ipa-http-certificate-stuck","text":"This was something I discovered sort of on accident but never really \"noticed\" - Though I'm sure I would've noticed sometime in 2021 when my certificate expired. I was running ipa-healthcheck --failures-only as I do sometimes, and noticed some weird certmonger things pop up. But it made me look at my certificate list... [root@ipa01 ~]# ipa-getcert list Number of certificates and requests being tracked: 9. Request ID '20191106025922': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET expires: 2021-11-05 19:59:27 MST principal name: krbtgt/ANGELSOFCLOCKWORK.NET@ANGELSOFCLOCKWORK.NET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Request ID '20200123075636': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-ANGELSOFCLOCKWORK-NET',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-ANGELSOFCLOCKWORK-NET/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-ANGELSOFCLOCKWORK-NET',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET expires: 2021-11-05 19:55:33 MST dns: ipa01.angelsofclockwork.net principal name: ldap/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv ANGELSOFCLOCKWORK-NET track: yes auto-renew: yes Request ID '20200123075639': status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN stuck: yes key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' CA: IPA issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET expires: 2021-11-05 19:55:48 MST dns: ipa01.angelsofclockwork.net principal name: HTTP/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes Interestingly, I wasn't sure what NEWLY_ADDED_NEED_KEYINFO_READ_PIN meant and I couldn't really find much on what would cause this to happen. And I know my certificate isn't expired, according to the output. In fact, I checked with openssl just in case. [root@ipa01 ~]# openssl x509 -text -noout -in /var/lib/ipa/certs/httpd.crt | grep 'Not After' Not After : Nov 6 02:55:48 2021 GMT I'm not sure if this is just a result of migrating from Enterprise Linux 7 to 8 at the time, but it seemed easy enough to remove the tracking and put it back in, which ultimately fixed the monitoring state and now it was no longer \"stuck\". [root@ipa01 ~]# ipa-getcert stop-tracking -i 20200123075639 Request \"20200123075639\" removed. [root@ipa01 ~]# ipa-getcert start-tracking -f /var/lib/ipa/certs/httpd.crt -k /var/lib/ipa/private/httpd.key -p /var/lib/ipa/passwds/ipa01.angelsofclockwork.net-443-RSA -C /usr/libexec/ipa/certmonger/restart_httpd -K HTTP/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET New tracking request \"20200504003758\" added. [root@ipa01 ~]# ipa-getcert list -i \"20200504003758\" Number of certificates and requests being tracked: 9. Request ID '20200504003758': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/ipa01.angelsofclockwork.net-443-RSA' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' CA: IPA issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=ipa01.angelsofclockwork.net,O=ANGELSOFCLOCKWORK.NET expires: 2021-11-05 19:55:48 MST dns: ipa01.angelsofclockwork.net principal name: HTTP/ipa01.angelsofclockwork.net@ANGELSOFCLOCKWORK.NET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes","title":"Renewed IPA HTTP Certificate Stuck"},{"location":"el/freeipa/#ca-related-certificates-stuck","text":"Like with the IPA httpd certificates, I noticed at least 4 certificates stuck because a PIN was missing. Turns out that it's actually easy to modify the tracking request and fix the issue entirely. Below is my example doing this on the auditSigningCert. This seems to only occur on Enterprise Linux 8. [root@ipa01 alias]# getcert list -i 20200615180351 Number of certificates and requests being tracked: 9. Request ID '20200615180351': status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca' certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca' CA: dogtag-ipa-ca-renew-agent issuer: subject: expires: unknown pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert \"auditSigningCert cert-pki-ca\" track: yes auto-renew: yes [root@ipa01 alias]# getcert start-tracking -i 20200615180351 -p /etc/pki/pki-tomcat/alias/pwdfile.txt Request \"20200615180351\" modified. [root@ipa01 alias]# getcert list -i 20200615180351 Number of certificates and requests being tracked: 9. Request ID '20200615180351': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pinfile='/etc/pki/pki-tomcat/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=ANGELSOFCLOCKWORK.NET subject: CN=CA Audit,O=ANGELSOFCLOCKWORK.NET expires: 2021-03-13 23:15:41 MST key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert \"auditSigningCert cert-pki-ca\" track: yes auto-renew: yes","title":"CA Related Certificates Stuck"},{"location":"el/freeipa/#default-certificates-with-san","text":"A question that arises now and again is how to setup a load balancer for FreeIPA's LDAP servers whether it's an actual load balancer (layer 4) or some sort of DNS record with multiple A records, or perhaps with some sort of round robin DNS. The issue is that the certificate verification fails, because the certificate being presented is of the IPA server itself with no SAN. To address this, you have to create a host that has the name of the load balancer or DNS record you plan on using and allow the IPA servers to manage the host.","title":"Default Certificates with SAN"},{"location":"el/freeipa/#cms-communication-issues-403","text":"This isn't necessarily certificate issue, but more or less an issue as it pertains to the certificate system itself. There may be cases where during upgrades, a configuration in /etc/pki/pki-tomcat/server.xml is not properly reconfigured. In that file, you'll notice Connector lines that have a secret and a requiredSecret parameter and they both have different values. The issue may be that these aren't correct. This generally comes down to IPA and pki-core conflicting on these attributes. To correct this, you will need to find the secret in /etc/httpd/conf.d/ipa-pki-proxy.conf (on the ProxyPass line) and ensure that's the same secret in both fields. ProxyPassMatch ajp://localhost:8009 secret=AAA Make sure they're the same in server.xml After changing, restart the service with systemctl restart pki-tomcat@pki-tomcatd.service.","title":"CMS Communication Issues (403)"},{"location":"el/freeipa/#kerberos","text":"This section goes over some stuff about kerberos that we've ran into and might find useful someday.","title":"Kerberos"},{"location":"el/freeipa/#accounts-with-otp-enabled","text":"When logging into a machine with a password (first factor) and an OTP token (second factor), this generally works without a problem. You can easily run klist and you'll see that you have a ticket and everything. In the cases where you're calling kinit all by itself, this doesn't work as expected at the time of this writing. % kinit account@REALM kinit: Pre-authentication failed: Invalid argument while getting initial credentials A bugzilla was opened about this issue in 2017, a pagure issue was opened in 2014 about this exact scenario, where IPA is configured for password+OTP and a user has an assigned token. There is currently one workaround, which is using kinit -n to perform anonymous processing.","title":"Accounts with OTP Enabled"},{"location":"el/freeipa/#footnotes","text":"For more information on DNS for FreeIPA, please read this page and this page \u21a9 The -P asks for the password of the username in question, that way it is cached right away. The directory service on the system then has credentials to compare to. I have found that sometimes if you don't use -P, even if you're logged in as the account, the password does not get cached and you'll get stuck at a background image the next time you login. Again, this is only sometimes. Your mileage may vary here. \u21a9 The -P asks for the password of the username in question, that way it is cached right away. The directory service on the system then has credentials to compare to. I have found that sometimes if you don't use -P, even if you're logged in as the account, the password does not get cached and you'll get stuck at a background image the next time you login. Again, this is only sometimes. Your mileage may vary here. \u21a9 Please read this page for more information. \u21a9 This may have changed. However it is up to you to test if this is the case. \u21a9","title":"Footnotes"},{"location":"el/nat/","text":"This page goes over setting up a router or a simple NAT service for Enterprise Linux. Requirements \u00b6 Here are the list of requirements below. Enterprise Linux 8, 9 or Fedora An active internet connection to install the packages required or available internal mirrors A system with at least two (2) network interfaces Tutorial \u00b6 Interface Setup \u00b6 To properly setup the system, a few things have to be done. One interface must be the WAN interface, in most cases this is set to DHCP. Another interface must be the LAN interface or a group of interfaces must become a bridge with a static address ip_forward must be turned on - optionally if you have ipv6, turn on that forwarding as well IPv6 and NAT If you have an IPv6 prefix, whether it's from your ISP or it's a brokered prefix from he.net, NAT is generally not needed. Instead of using NAT for IPv6, you can just do simple forwarding. This is covered in a later section. FirewallD \u00b6 When using firewalld, Enterprise Linux 7+ and all Fedora\\'s can setup a simple NAT with masquerade without having to know iptables or nftables syntax. This may be more or less ideal for some users who want to quickly get a NAT and router going. The drawback is that the syntax and knowing how the rules work are hidden behind a frontend. To setup a NAT: # Tell eth0 to be our WAN % nmcli con mod eth0 connection.zone external # Tell eth1 to be our LAN (or a bridge if you have one) % nmcli con mod eth1 connection.zone internal # Doesn't hurt to re-up % nmcli con up eth0 ; nmcli con up eth1 # The external zone already has masquerade on, but just in case % firewall-cmd --zone=external --add-masquerade --permanent % firewall-cmd --complete-reload % firewall-cmd --get-active-zones external interfaces: eth0 internal interfaces: eth1 nftables \u00b6 This is for Enterprise Linux 8/9 or Fedora where nftables is the default. While iptables exists for Enterprise Linux 8 still, it is being superseded by nftables. It is recommended to stick with nftables. The syntax for nftables is a little tricky and quite different from what we may be used to with iptables. This may be an oversimplification and may or may not work. For ideas, you can view the files in /etc/nftables. This is a rough example of what I tried on migration to Enterprise Linux 8. # Disable firewalld, we'll enable nftables later % systemctl disable firewalld --now % systemctl mask firewalld # Flush all rules % nft flush ruleset Rest coming soon. IPv6 Forwarding \u00b6 Coming soon. DHCP \u00b6 Optional. Coming soon","title":"NAT/Router"},{"location":"el/nat/#requirements","text":"Here are the list of requirements below. Enterprise Linux 8, 9 or Fedora An active internet connection to install the packages required or available internal mirrors A system with at least two (2) network interfaces","title":"Requirements"},{"location":"el/nat/#tutorial","text":"","title":"Tutorial"},{"location":"el/nat/#interface-setup","text":"To properly setup the system, a few things have to be done. One interface must be the WAN interface, in most cases this is set to DHCP. Another interface must be the LAN interface or a group of interfaces must become a bridge with a static address ip_forward must be turned on - optionally if you have ipv6, turn on that forwarding as well IPv6 and NAT If you have an IPv6 prefix, whether it's from your ISP or it's a brokered prefix from he.net, NAT is generally not needed. Instead of using NAT for IPv6, you can just do simple forwarding. This is covered in a later section.","title":"Interface Setup"},{"location":"el/nat/#firewalld","text":"When using firewalld, Enterprise Linux 7+ and all Fedora\\'s can setup a simple NAT with masquerade without having to know iptables or nftables syntax. This may be more or less ideal for some users who want to quickly get a NAT and router going. The drawback is that the syntax and knowing how the rules work are hidden behind a frontend. To setup a NAT: # Tell eth0 to be our WAN % nmcli con mod eth0 connection.zone external # Tell eth1 to be our LAN (or a bridge if you have one) % nmcli con mod eth1 connection.zone internal # Doesn't hurt to re-up % nmcli con up eth0 ; nmcli con up eth1 # The external zone already has masquerade on, but just in case % firewall-cmd --zone=external --add-masquerade --permanent % firewall-cmd --complete-reload % firewall-cmd --get-active-zones external interfaces: eth0 internal interfaces: eth1","title":"FirewallD"},{"location":"el/nat/#nftables","text":"This is for Enterprise Linux 8/9 or Fedora where nftables is the default. While iptables exists for Enterprise Linux 8 still, it is being superseded by nftables. It is recommended to stick with nftables. The syntax for nftables is a little tricky and quite different from what we may be used to with iptables. This may be an oversimplification and may or may not work. For ideas, you can view the files in /etc/nftables. This is a rough example of what I tried on migration to Enterprise Linux 8. # Disable firewalld, we'll enable nftables later % systemctl disable firewalld --now % systemctl mask firewalld # Flush all rules % nft flush ruleset Rest coming soon.","title":"nftables"},{"location":"el/nat/#ipv6-forwarding","text":"Coming soon.","title":"IPv6 Forwarding"},{"location":"el/nat/#dhcp","text":"Optional. Coming soon","title":"DHCP"},{"location":"el/openldap/","text":"Deprecation \u00b6 Please note that the OpenLDAP server is considered deprecated in RHEL (and thusly other EL derivatives). This document will stay here as a reference for those who are still using the server software on Enterprise Linux 7, potentially using the OpenLDAP LTB version of the software, or using the openldap-servers package from Rocky Linux 9's plus repository. It may apply to Fedora users in some contexts, but there are some differences they may never be documented here. If you see a need for corrections, please open up an issue on our github. Most of this information should be considered out of date. OpenLDAP 2.6.x makes some changes that the below document may or may not cover. Preface \u00b6 This tutorial goes over how to install OpenLDAP to a Enterprise Linux Server and options on configuring and setting up accounts for host access, etc. This how-to is the method of implementation that I used, and can be modified/changed to any users preferences if preferred. Enterprise Linux and Fedora users will have the ability to use SSSD for SUDO (and it's relatively easy to set it up). Overview \u00b6 Simply put, LDAP is a directory service for authentication across a network. Rather than have local accounts on a bunch of machines, LDAP can be used to have one account across a bunch of machines. LDAP was once an easy setup in RHEL 5 but had changed in RHEL 6 and 7, and here provides the necessary information needed to get a simple LDAP system running with possible SUDO support and various options of how to support your LDAP system. Requirements \u00b6 First and foremost, we have a list of requirements. Keep in mind, if you do not fulfill these requirements, you may run into some issues down the road. Enterprise Linux 8, Enterprise Linux 9 DNS Server (LDAP does NOT appreciate IP addresses for the URI) An active internet connection to install the packages required Tutorial Preface, Notes, and Recommendations \u00b6 Warning Potential Pitfalls! The incorrect configuration in your firewall or other settings can cause login failures Not using certificates (TLS/SSL) will cause you not to be able to login (This is a EL7+ LDAP Client Requirement) SELinux is a pain when using mounted home directories or certificates (primarily in Enterprise Linux 7+, will you have problems with certificates/home directories) If you use /home as an NFS mount, you'll see some nasty side effects if you have local users. Note Recommended Information It's recommended to use colored vim syntax. Root doesn't use vim when vim-enhanced is installed. You can make an alias for vi to run vim. Turn on syntaxing in ~/.vimrc -- syntax on Make the vim colors brighter in ~/.vimrc -- set background=dark Export your EDITOR variable in ~/.bash_profile -- export EDITOR=vim Keep selinux set to enforcing Note Database Information We will be using lmdb, which is recommended over using hdb or bdb. Note EL 9 OpenLDAP Enterprise Linux 9 has fully dropped OpenLDAP where there are no server packages normally built. In some EL distributions, openldap-servers is still built and provided in an extra repository. Rocky Linux 9 has openldap-servers in their plus repository. EPEL also has it available. Installation \u00b6 Below details the process for installing OpenLDAP to our system(s). This includes installing the packages, setting up certificates, and configuring the LDAP server via LDIF files. Packages \u00b6 You will need the following packages. A couple of them may already be installed. If you don't plan on migrating local accounts to LDAP, you can leave out migrationtools. # If you are on Rocky Linux 9, you will need to enable the plus repository dnf install openldap openldap-servers migrationtools nss-tools -y Certificates \u00b6 Enterprise Linux 7 clients and other newer distributions that are non-el require TLS/SSL for authentication when going toward LDAP. because of this, we will need to create certificates, regardless if you are in a lab or not. Note Certificate Information NSS should no longer be required. Anything NSS related has been removed. I have two ways of doing it, we can do it manually or through a script. I prefer using my script to take care of it. First the manual way. mkdir /etc/pki/ldap cd /etc/pki/ldap openssl genrsa -des3 -out ca.key 4096 # Remember the password you put here openssl genrsa -out ldapserver.key 4096 openssl req -new -x509 -key ca.key -out ca.pem -days 3650 Country Name (2 letter code) [XX]:US State or Province Name (full name) []:Arizona Locality Name (eg, city) [Default City]:Phoenix Organization Name (eg, company) [Default Company Ltd]:SSN Studio Organizational Unit Name (eg, section) []:Channel Maintainers Common Name (eg, your name or your server's hostname) []:SSN # If you want to use a server name here, perform this step on another server first Email Address []:youremail@mail.com openssl req -new -key ldapserver.key -out ldapserver.csr Country Name (2 letter code) [XX]:US State or Province Name (full name) []:Arizona Locality Name (eg, city) [Default City]:Phoenix Organization Name (eg, company) [Default Company Ltd]:SSN Studio Organizational Unit Name (eg, section) []:LDAP Server Maintainer Common Name (eg, your name or your server's hostname) []:zera1.angelsofclockwork.net # Set your common name to your server name for this certificate Email Address []:youremail@mail.com openssl x509 -req -in ldapserver.csr -out ldapserver.pem -CA ca.pem -CAkey ca.key -days 3650 -set_serial 01 ln -s ca.pem `openssl x509 -hash -in ca.pem -noout`.0 # Do an ls on the directory and save the hashed name including the .0 somewhere certutil -N -d /etc/pki/ldap # Do not enter any passwords. When asked, just hit enter beyond this point. chown root:ldap * chmod 640 * The scripted way. #!/bin/bash # CA Information CAcountry=\"US\" CAstate=\"Arizona\" CAlocale=\"Phoenix\" CAorganization=\"SSN Studio\" CAorganizationalunit=\"Channel Maintainers\" # If you set the below to a hostname, you\u2019re screwed. Don\u2019t do it! # Only do it if you have an actual hostname you will do CA signing on! CAconicalname=\"SSN\" CAemail=\"tucklesepk@gmail.com\" # LDAP Server information country=\"US\" state=\"Arizona\" locale=\"Phoenix\" organization=\"SSN Studio\" organizationalunit=\"LDAP Server Maintainer\" conicalname=\"zera1.angelsofclockwork.net\" email=\"pc68xl@gmail.com\" certdir=\"/etc/pki/ldap\" mkdir $certdir ; cd $certdir echo \"Enter a password when asked.\" openssl genrsa -des3 -out ca.key 4096 openssl genrsa -out ldapserver.key 4096 # Create the self-signed CA cert openssl req -new -x509 -key ca.key -out ca.pem -days 3650 -subj /C=\"$CAcountry\"/ST=\"$CAstate\"/L=\"$CAlocale\"/O=\"$CAorganization\"/OU=\"$CAorganizationalunit\"/CN=\"$CAconicalname\"/emailAddress=\"$CAemail\"/ # Create the LDAP server cert openssl req -new -key ldapserver.key -out ldapserver.csr -subj /C=\"$country\"/ST=\"$state\"/L=\"$locale\"/O=\"$organization\"/OU=\"$organizationalunit\"/CN=\"$conicalname\"/emailAddress=\"$email\"/ # Sign it openssl x509 -req -in ldapserver.csr -out ldapserver.pem -CA ca.pem -CAkey ca.key -days 3650 -set_serial 01 ln -s ca.pem `openssl x509 -hash -in ca.pem -noout`.0 chown root:ldap * chmod 640 * Make sure to obtain your hash. Your hash will be different from mine. ls -l /etc/pki/ldap | grep '0' 39642ab3.0 LDAP Server Configuration \u00b6 Configurations done in OpenLDAP are done via LDIF. Your passwords should be hashed as well. Before we begin, let's start by generating a password for our root DN. This is required. slappasswd New password: Re-enter new password: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+ Keep this SSHA output for our configuration files. Next, we'll need to make a couple LDIFs. This is our suffix.ldif file. This file helps to create the mdb database for our LDAP structure. It also sets our DIT suffix, root password, etc. You should change the olcSuffix, olcRootDN, and olcRootPW to whatever you plan on using. The olcDbMaxSize is set to 20GB. This is normally sufficient and can be changed. The olcDbEnvFlags can be changed as well. dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=angelsofclockwork,dc=net olcRootDN: cn=manager,dc=angelsofclockwork,dc=net olcRootPW: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+ olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub olcLastMod: TRUE olcDbEnvFlags: nometasync olcDbEnvFlags: writemap olcDbMaxSize: 21474836480 Now, below we have our primary modification ldif. Comments describe what each one does. # Sets our cert path and information # The \"CertificateFile\" has to be set to the hostname of the LDAP server dn: cn=config changetype: modify replace: olcTLSCACertificatePath olcTLSCACertificatePath: /etc/pki/ldap - replace: olcTLSCertificateFile olcTLSCertificateFile: zera1.angelsofclockwork.net - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/pki/ldap/ldapserver.key # Adding a rootDN for the config. # Note that this isn't fully necessary as you can use -Y EXTERNAL -H ldapi:/// instead # So, treat this as an optional thing. If you do want it, consider a different password. dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=config - replace: olcRootPW olcRootPW: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+ # Set the password again in the mdb database # This is because sometimes the password set when making the database doesn't 'work' sometimes dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+ # Sets the default password hash to SSHA -- Refer to the 'bug' information if this does not work dn: olcDatabase={-1}frontend,cn=config changetype: modify replace: olcPasswordHash olcPasswordHash: {SSHA} # Changes the rootdn information in the monitor database dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base=\"gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\" read by dn.base=\"cn=manager,dc=angelsofclockwork,dc=net\" read by * none Let's make sure we turn on ldaps. It's recommended to use TLS, but some applications insist on SSL. (Very few, but they are out there.) # vi /etc/sysconfig/slapd . . . SLAPD_URLS=\"ldapi:/// ldap:/// ldaps:///\" # slaptest -u Config file testing succeeded # /etc/openldap/ldap.conf . . . TLS_CACERTDIR /etc/pki/ldap Now, we need to add our LDIFs into LDAP. rm -f /etc/openldap/slapd.d/cn=config/olcDatabase=\\{2\\}hdb.ldif chown -R ldap:ldap /var/lib/ldap systemctl enable slapd systemctl start slapd ldapadd -Y EXTERNAL -H ldapi:/// -f suffix.ldif ldapmodify -Y EXTERNAL -H ldapi:/// -f info.ldif You may end up getting a checksum error in your logs. To solve this, you need to do a simple operation against the configuration. ldapmodify -h localhost -xWD \"cn=config\" Enter LDAP Password: dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=config modifying entry \"olcDatabase={0}config,cn=config\" slaptest -u config file testing succeeded That should do it. You can do a -Y EXTERNAL -H ldapi:/// instead if you wanted to. I did the above to show passwords will work for config. LDAP Structure \u00b6 The next piece is to get our backend structure built. In EL7, core is the only schema that is there. In EL6, it's a good chunk of these. I like to put them in a file so I can loop through them. Note ppolicy schema As of OpenLDAP 2.6.x, the ppolicy schema no longer applies as it is built-in to the slapo-ppolicy module. See the upgrade document for information. /etc/openldap/schema/corba.ldif /etc/openldap/schema/cosine.ldif /etc/openldap/schema/duaconf.ldif /etc/openldap/schema/dyngroup.ldif /etc/openldap/schema/inetorgperson.ldif /etc/openldap/schema/java.ldif /etc/openldap/schema/misc.ldif /etc/openldap/schema/nis.ldif /etc/openldap/schema/openldap.ldif /etc/openldap/schema/collective.ldif Note rfc2307 If you want to be able to combine groupOfNames and posixGroup together (similar to Active Directory, other open source, and commercial offerings), don't use nis. Use the rfc2307bis schema instead. Once you have your list of schema to put in, we can loop through them. for x in $(cat schemaorder) ; do ldapadd -Y EXTERNAL -H ldapi:/// -f $x ; done adding new entry \"cn=corba,cn=schema,cn=config\" adding new entry \"cn=cosine,cn=schema,cn=config\" adding new entry \"cn=duaconf,cn=schema,cn=config\" adding new entry \"cn=dyngroup,cn=schema,cn=config\" adding new entry \"cn=inetorgperson,cn=schema,cn=config\" adding new entry \"cn=java,cn=schema,cn=config\" adding new entry \"cn=misc,cn=schema,cn=config\" adding new entry \"cn=nis,cn=schema,cn=config\" adding new entry \"cn=openldap,cn=schema,cn=config\" adding new entry \"cn=collective,cn=schema,cn=config\" I normally like to keep all LDIFs in a folder by themselves to avoid clutter (non-configuration LDIF). mkdir ldif ; cd ldif Let's get our base created. Make sure to replace my DN with your DN that you chose earlier. Call this base.ldif. dn: dc=angelsofclockwork,dc=net dc: angelsofclockwork objectClass: top objectClass: domain dn: ou=People,dc=angelsofclockwork,dc=net ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,dc=angelsofclockwork,dc=net ou: Group objectClass: top objectClass: organizationalUnit ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f base.ldif Enter LDAP Password: adding new entry \"dc=angelsofclockwork,dc=net\" adding new entry \"ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"ou=Group,dc=angelsofclockwork,dc=net\" If this doesn't add, make sure your LDAP server is running, check /var/log/messages, and ensure you've completed all steps before this. ldapsearch -x -LLL -b 'dc=angelsofclockwork,dc=net' dn: dc=angelsofclockwork,dc=net dc: angelsofclockwork objectClass: top objectClass: domain dn: ou=People,dc=angelsofclockwork,dc=net ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,dc=angelsofclockwork,dc=net ou: Group objectClass: top objectClass: organizationalUnit Add Users via Migration \u00b6 Note But... I don't want to add my users locally You don't have to add your users locally to the system. This just aids in the creation of users. Go to the next section if you want to add users and do permissions by hand. This is the fun part. We'll need to add some users, set some passwords and migrate them into the LDAP system. I'll make three users as an example, give them an ID starting at 10000, home directories in /lhome, set a password, and proceed to migrate them. If you don't want to use /lhome, keep them set to /home and their home directories should get created automatically when logging into another machine. # mkdir /lhome # mkdir ldif/user # semanage fcontext -a -t home_root_t \"/lhome(/.*)?\" # restorecon -v /lhome \\ restorecon reset /lhome context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:home_root_t:s0 # groupadd -g 10000 sokel # groupadd -g 10001 suree # groupadd -g 10002 ranos # useradd -u 10000 -g 10000 -d /lhome/sokel sokel # useradd -u 10001 -g 10001 -d /lhome/suree suree # useradd -u 10002 -g 10002 -d /lhome/ranos ranos # passwd sokel ; passwd suree ; passwd ranos # cat /etc/passwd | grep sokel > ldif/user/passwd.sokel # cat /etc/passwd | grep suree > ldif/user/passwd.suree # cat /etc/passwd | grep ranos > ldif/user/passwd.ranos # cat /etc/group | grep sokel > ldif/user/group.sokel # cat /etc/group | grep suree > ldif/user/group.suree # cat /etc/group | grep ranos > ldif/user/group.ranos We'll set some aliases for our migration scripts too # alias miguser='/usr/share/migrationtools/migrate_passwd.pl' # alias miggroup='/usr/share/migrationtools/migrate_group.pl' Before we continue, we need to modify our migration scripts. This is extremely important, otherwise our LDIFs will come out incorrect. Change them to your DN. # sed -i.bak \"s/padl.com/angelsofclockwork.net/g\" /usr/share/migrationtools/migrate_common.ph # sed -i.bak \"s/padl,dc=com/angelsofclockwork,dc=net/g\" /usr/share/migrationtools/migrate_common.ph Now we can use a loop to convert them. You can do it by hand also, but that's up to you. # for x in sokel suree ranos ; do miguser ldif/user/passwd.$x > ldif/user/$x.ldif ; done # for x in sokel suree ranos ; do miggroup ldif/user/group.$x >> ldif/user/$x.ldif ; done # cd ldif/user/ # cat *.ldif >> /tmp/ourusers.ldif # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f /tmp/ourusers.ldif Enter LDAP Password: adding new entry \"uid=ranos,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=ranos,ou=Group,dc=angelsofclockwork,dc=net\" adding new entry \"uid=sokel,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=sokel,ou=Group,dc=angelsofclockwork,dc=net\" adding new entry \"uid=suree,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=suree,ou=Group,dc=angelsofclockwork,dc=net\" The manual way. # /usr/share/migrationtools/migrate_passwd.pl ldif/user/passwd.sokel > ldif/user/sokel.ldif # /usr/share/migrationtools/migrate_group.pl ldif/user/group.sokel >> ldif/user/sokel.ldif # /usr/share/migrationtools/migrate_passwd.pl ldif/user/passwd.suree > ldif/user/suree.ldif # /usr/share/migrationtools/migrate_group.pl ldif/user/group.suree >> ldif/user/suree.ldif # /usr/share/migrationtools/migrate_passwd.pl ldif/user/passwd.ranos > ldif/user/ranos.ldif # /usr/share/migrationtools/migrate_group.pl ldif/user/group.ranos >> ldif/user/ranos.ldif # cd ldif/user/ # ls group.ranos group.suree passwd.sokel ranos.ldif suree.ldif group.sokel passwd.ranos passwd.suree sokel.ldif # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f sokel.ldif Enter LDAP Password: adding new entry \"uid=sokel,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=sokel,ou=Group,dc=angelsofclockwork,dc=net\" # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f suree.ldif Enter LDAP Password: adding new entry \"uid=suree,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=suree,ou=Group,dc=angelsofclockwork,dc=net\" # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f ranos.ldif Enter LDAP Password: adding new entry \"uid=ranos,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=ranos,ou=Group,dc=angelsofclockwork,dc=net\" Add Users via LDIF \u00b6 This is for those who don't want to create the account locally. For each user, you need to create an LDIF that satisfies their account information such as UID, GID and their group information. If you plan on having NFS exports to /lhome, make sure homeDirectory is correctly pointing as such. Otherwise, keep it as /home/username. dn: uid=zera,ou=People,dc=angelsofclockwork,dc=net objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetOrgPerson cn: Zera Nalika gidNumber: 11000 sn: Nalika uidNumber: 11000 givenName: Zera uid: zera loginShell: /bin/bash homeDirectory: /home/zera displayName: Zera Nalika userPassword: changeme2 dn: cn=zera,ou=Group,dc=angelsofclockwork,dc=net objectClass: posixGroup objectClass: top cn: zera gidNumber: 11000 That's about it for that. You create these for each user as needed and then add them into ldap. # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f zera.ldif adding new entry \"uid=zera,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=zera,ou=Group,dc=angelsofclockwork,dc=net\" For users who are doing the /lhome thing, make their directories. When you are changing ownership, do it by UID and GID number. # mkdir /lhome # semanage fcontext -a -t home_root_t \"/lhome(/.*)?\" # mkdir /lhome/zera # cp /etc/skel/.* /lhome/zera # chown -R 11000:11000 /lhome/zera # restorecon -Rv /lhome NFS Export Home Directories \u00b6 Warning /home vs /lhome If you used /lhome and you want to use NFS mounts, you may continue here. Otherwise, skip this section entirely. If you use /home and still want to do NFS, you will need to do persistent NFS to say /export/home, and then setup AutoFS to use /export/home as a way to automount into /home. Warning Potential Pitfall Do NOT use NFSv3. The steps below show how to prevent user squashing to allow the user to have access to their home directories. Typically, in an NFSv4 fashion, it tends to mount it with permissions set to nobody. Other solutions have been to force NFSv3. This is NOT recommended. YOU HAVE BEEN WARNED. First, we'll need to install nfs-utils, set up our exports, and modify our id map file. # dnf install nfs-utils libnfsidmap -y # vi /etc/exports /lhome *(rw,sync,root_squash,no_all_squash) # vi /etc/idmapd.conf # Comment out the first Domain line and make your own Domain = zera1.angelsofclockwork.net # systemctl start nfs-server # systemctl enable nfs-server Sometimes you'll still run into the nobody problem. Sometimes this helps. # vi /etc/sysconfig/nfs NEED_IDMAPD=yes NFSMAPID_DOMAIN=library.angelsofclockwork.net Firewall \u00b6 Warning Keep your firewall on It is bad practice to turn your firewall off. Don't do it. We need to open up our firewall. Note Port Reference LDAP Ports: 389/tcp 636/tcp NFS Ports: 111/tcp 111/udp 2049/tcp If using firewalld, you can add these ports by service. # firewall-cmd --add-service=ldap --zone=public --permanent # firewall-cmd --add-service=ldaps --zone=public --permanent # firewall-cmd --add-service=nfs --zone=public --permanent # firewall-cmd --reload Client \u00b6 Setting up the client can be straight-forward or troubling, depending on the distribution you're using. We'll be going over EL7+. Fedora also works here as well. Warning Third-party Repositories If you use third-party repositories, you may want to disable them, at least temporarily. Depending on the repository, there may be conflicts when installing the appropriate packages. You may want to consider on setting up priorities, and ensure your base and updates are higher than the rest. Enterprise Linux/Current Fedora Releases \u00b6 We'll be using SSSD for this. We need to install some key packages first. Some of these packages may not install because they were either superceded or obsoleted. # yum install pki-{ca,common,silent} openldap-clients nss-pam-ldapd policycoreutils-python sssd sssd-common sssd-client sssd-ldap Use authselect to configure pam and nss. You'll need to configure /etc/sssd/sssd.conf by hand after. # authselect select sssd with-mkhomedir with-sudo # vi /etc/sssd/sssd.conf [domain/default] cache_credentials = True krb5_realm = # ldap_search_base = dc=angelsofclockwork,dc=net id_provider = ldap auth_provider = ldap chpass_provider = ldap sudo_provider = ldap ldap_uri = ldap://zera1.angelsofclockwork.net ldap_id_use_start_tls = True ldap_tls_cacertdir = /etc/openldap/certs ldap_tls_cacert = /etc/openldap/certs/ca.pem # Add the below ldap_sudo_search_base = ou=SUDOers,dc=angelsofclockwork,dc=net [sssd] # Modify this line and add sudo to the list services = nss, pam, autofs, sudo [sudo] Now, let's get our CA cert that we made way long ago and download it. If you used a real CA to sign your certificate, obtain their certificate. Note Hash Remember your hash from when you were making your certificates? You need to obtain it. In both examples, we created it while using a symbolic link. # scp zera1.angelsofclockwork.net:/etc/pki/ldap/ca.pem /etc/openldap/certs/ca.pem # cd /etc/openldap/certs # ln -s ca.pem 39642ab3.0 Now, modify /etc/openldap/ldap.conf and add the following to the bottom, ensuring your BASE is set correctly. URI ldap://library.angelsofclockwork.net BASE dc=angelsofclockwork,dc=net ssl start_tls You can attempt an ldapsearch and it should work. Search for one of your users. # ldapsearch -x -LLL uid=zera dn: uid=zera,ou=People,dc=angelsofclockwork,dc=net cn: Zera Nalika gidNumber: 11000 uidNumber: 11000 givenName: Zera objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: hostObject objectClass: radiusprofile objectClass: inetOrgPerson objectClass: ldapPublicKey uid: zera loginShell: /bin/bash homeDirectory: /lhome/zera displayName: Zera Nalika Automounting Home Directories \u00b6 If you chose to do /lhome NFS mounting, proceed here. # mkdir /lhome # semanage fcontext -a -t autofs_t \"/lhome(/.*)?\" # restorecon -v /lhome # setsebool use_nfs_home_dirs 1 Now, let's get our automounting setup. # vi /etc/auto.master . . . /lhome /etc/auto.lhome # Add this under the /misc line Let's copy the misc template and make a change to it. # cp /etc/auto.misc /etc/auto.lhome # vi /etc/auto.lhome # Comment the cd line, and add our mount under it. #cd -fstype=iso9660,ro,nosuid,nodev :/dev/cdrom * -rw,soft,intr zera1.angelsofclockwork.net:/lhome/& # restorecon -v /etc/auto.lhome # systemctl enable autofs # systemctl start autofs Let's make our change to the idmapd configuration. # vi /etc/idmapd.conf #Domain = local.domain.edu Domain = zera1.angelsofclockwork.net # systemctl restart sssd autofs LDAP Structure Add-ons \u00b6 Here you'll find my value-added portions of getting LDAP going further than what the above presented. SUDO \u00b6 Getting SUDO to work in LDAP can be a real pain. It doesn't have to be. The default sudo schema provided by the LDAP packages, which I have taken and converted into the proper olc format. dn: cn=sudo,cn=schema,cn=config objectClass: olcSchemaConfig cn: sudo olcAttributeTypes: {0}( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMa tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {2}( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Comma nd(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 ) olcAttributeTypes: {3}( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1 .4.1.1466.115.121.1.26 ) olcAttributeTypes: {4}( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Option s(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115 .121.1.26 ) olcAttributeTypes: {5}( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'Use r(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466 .115.121.1.26 ) olcAttributeTypes: {6}( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Gr oup(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.14 66.115.121.1.26 ) olcAttributeTypes: {7}( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'Sta rt of time interval for which the entry is valid' EQUALITY generalizedTimeMat ch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) olcAttributeTypes: {8}( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'End of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) olcAttributeTypes: {9}( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an int eger to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrd eringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcObjectClasses: {0}( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'Sudoer En tries' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand $ s udoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoOrder $ sudoNotB efore $ sudoNotAfter $ description ) ) Save this as sudoschema.ldif and add it in. # ldapadd -Y EXTERNAL -H ldapi:/// -f sudoschema.ldif Let's create our defaults. This will start our sudo OU and give it some defaults. You may change these if you so desire. # vi sudo.ldif dn: ou=SUDOers,dc=angelsofclockwork,dc=net objectClass: top objectClass: organizationalUnit ou: SUDOers dn: cn=defaults,ou=SUDOers,dc=angelsofclockwork,dc=net objectClass: top objectClass: sudoRole cn: defaults description: SUDOers Default values sudoOption: requiretty sudoOption: env_reset sudoOption: env_keep = \"COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS\" sudoOption: env_keep += \"MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE\" sudoOption: env_keep += \"LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES\" sudoOption: env_keep += \"LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE\" sudoOption: env_keep += \"LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY\" # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f sudo.ldif Now, let's create our first SUDO container. It will be for our \\\"admins\\\". We could specify \\\"sudoHost: ALL\\\" if we wanted. But for the example, I chose a couple of hosts. # vi admins.ldif dn: cn=ADMINS,ou=SUDOers,dc=angelsofclockwork,dc=net objectClass: sudoRole cn: ADMINS description: Administration Role sudoCommand: ALL sudoHost: zera2.angelsofclockwork.net sudoHost: zera3.angelsofclockwork.net sudoRunAs: ALL sudoRunAsGroup: ALL sudoRunAsUser: ALL sudoUser: zera # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f admins.ldif If you used authselect with the with-sudo option, this should have turned on sss for sudoers. You may want to verify /etc/nsswitch.conf just to be sure. Note SSSD Cache Sometimes SSSD likes to cache things or never update things for whatever reason or another. To get around this, stop sssd, delete everything under /var/lib/sss/db/ and then start sssd again. Now, let's test. [root@zera3 ~]# su - zera [zera@zera3 ~]$ sudo -l [sudo] password for zera: Matching Defaults entries for zera on this host: requiretty, env_reset, env_keep=\"COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS\", env_keep+=\"MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE\", env_keep+=\"LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES\", env_keep+=\"LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE\", env_keep+=\"LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY\", secure_path=/sbin\\:/bin\\:/usr/sbin\\:/usr/bin, env_reset, requiretty User sokel may run the following commands on this host: (ALL : ALL) ALL Member Groups \u00b6 Member groups are extremely useful, especially for when you're granting permissions to external applications (and SSSD if you wish). # vi modules.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib64/openldap olcModuleLoad: memberof.la # vi memberof.ldif dn: olcOverlay=memberof,olcDatabase={2}mdb,cn=config objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf # ldapadd -Y EXTERNAL -H ldapi:/// -f modules.ldif # ldapadd -Y EXTERNAL -H ldapI:/// -f memberof.ldif After that, we can now create our groups. Example. dn: cn=Admins,ou=Group,dc=angelsofclockwork,dc=net objectClass: groupOfNames cn: Admins member: uid=chris,ou=People,dc=angelsofclockwork,dc=net member: uid=zera,ou=People,dc=angelsofclockwork,dc=net member: uid=sithlord,ou=People,dc=angelsofclockwork,dc=net In SSSD, we can make some minor changes. ldap_search_base = dc=angelsofclockwork,dc=net?sub?|(memberOf=cn=Admins,ou=Group,dc=angelsofclockwork,dc=net) ldap_access_filter = (|(memberOf=cn=Admins,ou=Group,dc=angelsofclockwork,dc=net)) # Change this to rfc2307 if you are using nis ldap_schema = rfc2307bis enumerate = True # systemctl stop sssd ; rm -rf /var/lib/sss/db/* ; systemctl start sssd If we were to do an ldapsearch, we can see the groups show up. # ldapsearch -x -LLL uid=zera memberOf dn: uid=zera,ou=People,dc=angelsofclockwork,dc=net memberOf: cn=Admins,ou=Group,dc=angelsofclockwork,dc=net Make sure you turn on referential integrity! Referential Integrity \u00b6 Having referential integrity is absolutely important. It basically means that if a user gets deleted, their group membership disappears also. This prevents you from having to clean up manually. # vi module.ldif dn: cn=module,cn=config changetype: modify replace: olcModuleLoad olcModuleLoad: refint.la olcModuleLoad: memberof.la # ldapmodify -Y EXTERNAL -H ldapi:/// -f module.ldif You also need the overlay. An overlay allows certain plugins to work on a DIT. # vi overlay.ldif dn: olcOverlay=refint,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: olcRefintConfig objectClass: top olcOverlay: refint olcRefintAttribute: memberOf member manager # ldapmodify -Y EXTERNAL -H ldapi:/// -f overlay.ldif ACL \u00b6 An ACL (Access Control List) allows permissions to be given to those in the LDAP tree. The problem with a default LDAP setup is that, attributes like userPassword show up in an ldapsearch. This gives little protection. So, to get around this issue, we have to create ACLs. Note The Manager's Rights The manager has all rights to the DIT. In previous implementations, I have put him in access controls as a reference and would put \\\"write\\\" as his access. This isn't needed, but it doesn't hurt to have it. This ldif creates an ACL that allows the Admins group to do anything they want on the DIT (similar to manager). This also prevents anonymous searches from pulling up a user's password. # vi acl.ldif dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by group.exact=\"cn=Admins,ou=Group,dc=angelsofclockwork,dc=net\" write by anonymous auth by self write by * none break olcAccess: {2}to * by group.exact=\"cn=Admins,ou=Group,dc=angelsofclockwork,dc=net\" write by * read olcAccess: {3}to dn.base=\"\" by * read # ldapmodify -Y EXTERNAL -H ldapi:/// -f acl.ldif It's highly recommended, however, to disable anonymous searching, especially if you go production with LDAP. A lot of LDAP implementations disallow anonymous searching by default. You can do this with ACLs, but it's not recommended. We cover this in the search. Disable Anonymous Binding \u00b6 It's recommended to disable anonymous searching. This can be handled by making a modification to the global configuration and the DIT configuration. dn: cn=config changetype: modify add: olcDisallows olcDisallows: bind_anon dn: olcDatabase={2}mdb,cn=config changetype: modify add: olcRequires olcRequires: authc Once you add this in, all anonymous searching will cease. # ldapsearch -x -LLL uid=zera ldap_bind: Inappropriate authentication (48) additional info: anonymous bind disallowed LDAP Logging \u00b6 Logging is of course, very important for an LDAP server. There are a few types of logs we can do. There are the standard logs and then there are also audit logs. Audit logs allow an administrator to view changes being done to LDAP in an LDIF form. We can setup both. Let's create our modification LDIF. This will turn on standard logging and enable the audit module. Run an ldapmodify against this LDIF. dn: cn=config changetype: modify replace: olcLogFile olcLogFile: /var/log/ldap-standard.log - replace: olcLogLevel olcLogLevel: 256 # Keep in mind, if you have other modules being loaded, # add them to the list dn: cn=module,cn=config changetype: modify replace: olcModuleLoad olcModuleLoad: refint.la olcModuleLoad: memberof.la olcModuleLoad: auditlog.la Now, we need to make sure audit logging is done on our database. dn: olcOverlay=auditlog,olcDatabase={2}mdb,cn=config objectClass: olcAuditlogConfig objectClass: olcOverlayConfig olcOverlay: auditlog olcAuditlogFile: /var/log/ldap-audit.log It's recommended to have logrotate working for our logs. Here is a file I've dropped into /etc/logrotate.d. Experiment with these options. Since I work in an environment that has tons of transactions going all the time, and thus, my rotations are at 100M and 250M respectively. /var/log/ldap-standard.log { missingok compress notifempty daily rotate 10 size=100M } /var/log/ldap-audit.log { missingok compress notifempty daily rotate 10 size=250M } In /etc/rsyslog.conf, optionally, you can create this. If you find that logs are not appearing after the changes above, use this. local4.* /var/log/ldap.log Password Policy \u00b6 Password policies are a great asset, especially when working in an environment that have or require security policies. First, let's load our module and then add our overlay. This LDIF will do both. You may want to remove the comments before adding. dn: cn=module,cn=config changetype: modify replace: olcModuleLoad olcModuleLoad: refint.la olcModuleLoad: memberof.la olcModuleLoad: auditlog.la olcModuleLoad: ppolicy.la dn: olcOverlay=ppolicy,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=angelsofclockwork,dc=net # Set the below to TRUE if you want users to get locked out after failed attempted olcPPolicyUseLockout: TRUE # Set the below to TRUE if you want passwords to be hashed. # HIGHLY RECOMMENDED YOU SET THIS TO TRUE olcPPolicyHashCleartext: TRUE Now, we need an LDIF to create our standard password policy. It's important to have a default password policy and then create separate ones as needed. Make sure to read the comments. You may want to remove the comments before adding. dn: cn=default,ou=policies,dc=angelsofclockwork,dc=net objectClass: pwdPolicy objectClass: person objectClass: top cn: passwordDefault sn: passwordDefault pwdAttribute: userPassword # If set to 0, quality is not checked. # If set to 1, quality is checked by an internal module which you setup. # If set to 2, the system used to change the password must have a checking mechanism. # Pick your poison. pwdCheckQuality: 0 # Password lives for 84 days pwdMinAge: 0 pwdMaxAge: 7257600 # Minimum length is 7 pwdMinLength: 7 # Password history of 10, cannot use a password that's in history pwdInHistory: 10 # 5 Failures till a lockout, 10 minutes for it to reset, 30 minute lockout. pwdMaxFailure: 5 pwdFailureCountInterval: 600 pwdLockout: TRUE pwdLockoutDuration: 1800 # A user can change their own password. pwdAllowUserChange: TRUE # Systems that authenticate to LDAP can warn 14 days before an expiration pwdExpireWarning: 1209600 # Allowed binds on an expired password. pwdGraceAuthNLimit: 5 pwdMustChange: TRUE pwdSafeModify: FALSE In the instance you want to use the built-in module for password checking, your LDIF would have these lines. pwdCheckQuality: 1 pwdCheckModule: check_password.so","title":"OpenLDAP"},{"location":"el/openldap/#deprecation","text":"Please note that the OpenLDAP server is considered deprecated in RHEL (and thusly other EL derivatives). This document will stay here as a reference for those who are still using the server software on Enterprise Linux 7, potentially using the OpenLDAP LTB version of the software, or using the openldap-servers package from Rocky Linux 9's plus repository. It may apply to Fedora users in some contexts, but there are some differences they may never be documented here. If you see a need for corrections, please open up an issue on our github. Most of this information should be considered out of date. OpenLDAP 2.6.x makes some changes that the below document may or may not cover.","title":"Deprecation"},{"location":"el/openldap/#preface","text":"This tutorial goes over how to install OpenLDAP to a Enterprise Linux Server and options on configuring and setting up accounts for host access, etc. This how-to is the method of implementation that I used, and can be modified/changed to any users preferences if preferred. Enterprise Linux and Fedora users will have the ability to use SSSD for SUDO (and it's relatively easy to set it up).","title":"Preface"},{"location":"el/openldap/#overview","text":"Simply put, LDAP is a directory service for authentication across a network. Rather than have local accounts on a bunch of machines, LDAP can be used to have one account across a bunch of machines. LDAP was once an easy setup in RHEL 5 but had changed in RHEL 6 and 7, and here provides the necessary information needed to get a simple LDAP system running with possible SUDO support and various options of how to support your LDAP system.","title":"Overview"},{"location":"el/openldap/#requirements","text":"First and foremost, we have a list of requirements. Keep in mind, if you do not fulfill these requirements, you may run into some issues down the road. Enterprise Linux 8, Enterprise Linux 9 DNS Server (LDAP does NOT appreciate IP addresses for the URI) An active internet connection to install the packages required","title":"Requirements"},{"location":"el/openldap/#tutorial-preface-notes-and-recommendations","text":"Warning Potential Pitfalls! The incorrect configuration in your firewall or other settings can cause login failures Not using certificates (TLS/SSL) will cause you not to be able to login (This is a EL7+ LDAP Client Requirement) SELinux is a pain when using mounted home directories or certificates (primarily in Enterprise Linux 7+, will you have problems with certificates/home directories) If you use /home as an NFS mount, you'll see some nasty side effects if you have local users. Note Recommended Information It's recommended to use colored vim syntax. Root doesn't use vim when vim-enhanced is installed. You can make an alias for vi to run vim. Turn on syntaxing in ~/.vimrc -- syntax on Make the vim colors brighter in ~/.vimrc -- set background=dark Export your EDITOR variable in ~/.bash_profile -- export EDITOR=vim Keep selinux set to enforcing Note Database Information We will be using lmdb, which is recommended over using hdb or bdb. Note EL 9 OpenLDAP Enterprise Linux 9 has fully dropped OpenLDAP where there are no server packages normally built. In some EL distributions, openldap-servers is still built and provided in an extra repository. Rocky Linux 9 has openldap-servers in their plus repository. EPEL also has it available.","title":"Tutorial Preface, Notes, and Recommendations"},{"location":"el/openldap/#installation","text":"Below details the process for installing OpenLDAP to our system(s). This includes installing the packages, setting up certificates, and configuring the LDAP server via LDIF files.","title":"Installation"},{"location":"el/openldap/#packages","text":"You will need the following packages. A couple of them may already be installed. If you don't plan on migrating local accounts to LDAP, you can leave out migrationtools. # If you are on Rocky Linux 9, you will need to enable the plus repository dnf install openldap openldap-servers migrationtools nss-tools -y","title":"Packages"},{"location":"el/openldap/#certificates","text":"Enterprise Linux 7 clients and other newer distributions that are non-el require TLS/SSL for authentication when going toward LDAP. because of this, we will need to create certificates, regardless if you are in a lab or not. Note Certificate Information NSS should no longer be required. Anything NSS related has been removed. I have two ways of doing it, we can do it manually or through a script. I prefer using my script to take care of it. First the manual way. mkdir /etc/pki/ldap cd /etc/pki/ldap openssl genrsa -des3 -out ca.key 4096 # Remember the password you put here openssl genrsa -out ldapserver.key 4096 openssl req -new -x509 -key ca.key -out ca.pem -days 3650 Country Name (2 letter code) [XX]:US State or Province Name (full name) []:Arizona Locality Name (eg, city) [Default City]:Phoenix Organization Name (eg, company) [Default Company Ltd]:SSN Studio Organizational Unit Name (eg, section) []:Channel Maintainers Common Name (eg, your name or your server's hostname) []:SSN # If you want to use a server name here, perform this step on another server first Email Address []:youremail@mail.com openssl req -new -key ldapserver.key -out ldapserver.csr Country Name (2 letter code) [XX]:US State or Province Name (full name) []:Arizona Locality Name (eg, city) [Default City]:Phoenix Organization Name (eg, company) [Default Company Ltd]:SSN Studio Organizational Unit Name (eg, section) []:LDAP Server Maintainer Common Name (eg, your name or your server's hostname) []:zera1.angelsofclockwork.net # Set your common name to your server name for this certificate Email Address []:youremail@mail.com openssl x509 -req -in ldapserver.csr -out ldapserver.pem -CA ca.pem -CAkey ca.key -days 3650 -set_serial 01 ln -s ca.pem `openssl x509 -hash -in ca.pem -noout`.0 # Do an ls on the directory and save the hashed name including the .0 somewhere certutil -N -d /etc/pki/ldap # Do not enter any passwords. When asked, just hit enter beyond this point. chown root:ldap * chmod 640 * The scripted way. #!/bin/bash # CA Information CAcountry=\"US\" CAstate=\"Arizona\" CAlocale=\"Phoenix\" CAorganization=\"SSN Studio\" CAorganizationalunit=\"Channel Maintainers\" # If you set the below to a hostname, you\u2019re screwed. Don\u2019t do it! # Only do it if you have an actual hostname you will do CA signing on! CAconicalname=\"SSN\" CAemail=\"tucklesepk@gmail.com\" # LDAP Server information country=\"US\" state=\"Arizona\" locale=\"Phoenix\" organization=\"SSN Studio\" organizationalunit=\"LDAP Server Maintainer\" conicalname=\"zera1.angelsofclockwork.net\" email=\"pc68xl@gmail.com\" certdir=\"/etc/pki/ldap\" mkdir $certdir ; cd $certdir echo \"Enter a password when asked.\" openssl genrsa -des3 -out ca.key 4096 openssl genrsa -out ldapserver.key 4096 # Create the self-signed CA cert openssl req -new -x509 -key ca.key -out ca.pem -days 3650 -subj /C=\"$CAcountry\"/ST=\"$CAstate\"/L=\"$CAlocale\"/O=\"$CAorganization\"/OU=\"$CAorganizationalunit\"/CN=\"$CAconicalname\"/emailAddress=\"$CAemail\"/ # Create the LDAP server cert openssl req -new -key ldapserver.key -out ldapserver.csr -subj /C=\"$country\"/ST=\"$state\"/L=\"$locale\"/O=\"$organization\"/OU=\"$organizationalunit\"/CN=\"$conicalname\"/emailAddress=\"$email\"/ # Sign it openssl x509 -req -in ldapserver.csr -out ldapserver.pem -CA ca.pem -CAkey ca.key -days 3650 -set_serial 01 ln -s ca.pem `openssl x509 -hash -in ca.pem -noout`.0 chown root:ldap * chmod 640 * Make sure to obtain your hash. Your hash will be different from mine. ls -l /etc/pki/ldap | grep '0' 39642ab3.0","title":"Certificates"},{"location":"el/openldap/#ldap-server-configuration","text":"Configurations done in OpenLDAP are done via LDIF. Your passwords should be hashed as well. Before we begin, let's start by generating a password for our root DN. This is required. slappasswd New password: Re-enter new password: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+ Keep this SSHA output for our configuration files. Next, we'll need to make a couple LDIFs. This is our suffix.ldif file. This file helps to create the mdb database for our LDAP structure. It also sets our DIT suffix, root password, etc. You should change the olcSuffix, olcRootDN, and olcRootPW to whatever you plan on using. The olcDbMaxSize is set to 20GB. This is normally sufficient and can be changed. The olcDbEnvFlags can be changed as well. dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=angelsofclockwork,dc=net olcRootDN: cn=manager,dc=angelsofclockwork,dc=net olcRootPW: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+ olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub olcLastMod: TRUE olcDbEnvFlags: nometasync olcDbEnvFlags: writemap olcDbMaxSize: 21474836480 Now, below we have our primary modification ldif. Comments describe what each one does. # Sets our cert path and information # The \"CertificateFile\" has to be set to the hostname of the LDAP server dn: cn=config changetype: modify replace: olcTLSCACertificatePath olcTLSCACertificatePath: /etc/pki/ldap - replace: olcTLSCertificateFile olcTLSCertificateFile: zera1.angelsofclockwork.net - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/pki/ldap/ldapserver.key # Adding a rootDN for the config. # Note that this isn't fully necessary as you can use -Y EXTERNAL -H ldapi:/// instead # So, treat this as an optional thing. If you do want it, consider a different password. dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=config - replace: olcRootPW olcRootPW: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+ # Set the password again in the mdb database # This is because sometimes the password set when making the database doesn't 'work' sometimes dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA}CuaKctEx7rl/+ldG0EjktMzJdrxNc46+ # Sets the default password hash to SSHA -- Refer to the 'bug' information if this does not work dn: olcDatabase={-1}frontend,cn=config changetype: modify replace: olcPasswordHash olcPasswordHash: {SSHA} # Changes the rootdn information in the monitor database dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base=\"gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\" read by dn.base=\"cn=manager,dc=angelsofclockwork,dc=net\" read by * none Let's make sure we turn on ldaps. It's recommended to use TLS, but some applications insist on SSL. (Very few, but they are out there.) # vi /etc/sysconfig/slapd . . . SLAPD_URLS=\"ldapi:/// ldap:/// ldaps:///\" # slaptest -u Config file testing succeeded # /etc/openldap/ldap.conf . . . TLS_CACERTDIR /etc/pki/ldap Now, we need to add our LDIFs into LDAP. rm -f /etc/openldap/slapd.d/cn=config/olcDatabase=\\{2\\}hdb.ldif chown -R ldap:ldap /var/lib/ldap systemctl enable slapd systemctl start slapd ldapadd -Y EXTERNAL -H ldapi:/// -f suffix.ldif ldapmodify -Y EXTERNAL -H ldapi:/// -f info.ldif You may end up getting a checksum error in your logs. To solve this, you need to do a simple operation against the configuration. ldapmodify -h localhost -xWD \"cn=config\" Enter LDAP Password: dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=config modifying entry \"olcDatabase={0}config,cn=config\" slaptest -u config file testing succeeded That should do it. You can do a -Y EXTERNAL -H ldapi:/// instead if you wanted to. I did the above to show passwords will work for config.","title":"LDAP Server Configuration"},{"location":"el/openldap/#ldap-structure","text":"The next piece is to get our backend structure built. In EL7, core is the only schema that is there. In EL6, it's a good chunk of these. I like to put them in a file so I can loop through them. Note ppolicy schema As of OpenLDAP 2.6.x, the ppolicy schema no longer applies as it is built-in to the slapo-ppolicy module. See the upgrade document for information. /etc/openldap/schema/corba.ldif /etc/openldap/schema/cosine.ldif /etc/openldap/schema/duaconf.ldif /etc/openldap/schema/dyngroup.ldif /etc/openldap/schema/inetorgperson.ldif /etc/openldap/schema/java.ldif /etc/openldap/schema/misc.ldif /etc/openldap/schema/nis.ldif /etc/openldap/schema/openldap.ldif /etc/openldap/schema/collective.ldif Note rfc2307 If you want to be able to combine groupOfNames and posixGroup together (similar to Active Directory, other open source, and commercial offerings), don't use nis. Use the rfc2307bis schema instead. Once you have your list of schema to put in, we can loop through them. for x in $(cat schemaorder) ; do ldapadd -Y EXTERNAL -H ldapi:/// -f $x ; done adding new entry \"cn=corba,cn=schema,cn=config\" adding new entry \"cn=cosine,cn=schema,cn=config\" adding new entry \"cn=duaconf,cn=schema,cn=config\" adding new entry \"cn=dyngroup,cn=schema,cn=config\" adding new entry \"cn=inetorgperson,cn=schema,cn=config\" adding new entry \"cn=java,cn=schema,cn=config\" adding new entry \"cn=misc,cn=schema,cn=config\" adding new entry \"cn=nis,cn=schema,cn=config\" adding new entry \"cn=openldap,cn=schema,cn=config\" adding new entry \"cn=collective,cn=schema,cn=config\" I normally like to keep all LDIFs in a folder by themselves to avoid clutter (non-configuration LDIF). mkdir ldif ; cd ldif Let's get our base created. Make sure to replace my DN with your DN that you chose earlier. Call this base.ldif. dn: dc=angelsofclockwork,dc=net dc: angelsofclockwork objectClass: top objectClass: domain dn: ou=People,dc=angelsofclockwork,dc=net ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,dc=angelsofclockwork,dc=net ou: Group objectClass: top objectClass: organizationalUnit ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f base.ldif Enter LDAP Password: adding new entry \"dc=angelsofclockwork,dc=net\" adding new entry \"ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"ou=Group,dc=angelsofclockwork,dc=net\" If this doesn't add, make sure your LDAP server is running, check /var/log/messages, and ensure you've completed all steps before this. ldapsearch -x -LLL -b 'dc=angelsofclockwork,dc=net' dn: dc=angelsofclockwork,dc=net dc: angelsofclockwork objectClass: top objectClass: domain dn: ou=People,dc=angelsofclockwork,dc=net ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,dc=angelsofclockwork,dc=net ou: Group objectClass: top objectClass: organizationalUnit","title":"LDAP Structure"},{"location":"el/openldap/#add-users-via-migration","text":"Note But... I don't want to add my users locally You don't have to add your users locally to the system. This just aids in the creation of users. Go to the next section if you want to add users and do permissions by hand. This is the fun part. We'll need to add some users, set some passwords and migrate them into the LDAP system. I'll make three users as an example, give them an ID starting at 10000, home directories in /lhome, set a password, and proceed to migrate them. If you don't want to use /lhome, keep them set to /home and their home directories should get created automatically when logging into another machine. # mkdir /lhome # mkdir ldif/user # semanage fcontext -a -t home_root_t \"/lhome(/.*)?\" # restorecon -v /lhome \\ restorecon reset /lhome context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:home_root_t:s0 # groupadd -g 10000 sokel # groupadd -g 10001 suree # groupadd -g 10002 ranos # useradd -u 10000 -g 10000 -d /lhome/sokel sokel # useradd -u 10001 -g 10001 -d /lhome/suree suree # useradd -u 10002 -g 10002 -d /lhome/ranos ranos # passwd sokel ; passwd suree ; passwd ranos # cat /etc/passwd | grep sokel > ldif/user/passwd.sokel # cat /etc/passwd | grep suree > ldif/user/passwd.suree # cat /etc/passwd | grep ranos > ldif/user/passwd.ranos # cat /etc/group | grep sokel > ldif/user/group.sokel # cat /etc/group | grep suree > ldif/user/group.suree # cat /etc/group | grep ranos > ldif/user/group.ranos We'll set some aliases for our migration scripts too # alias miguser='/usr/share/migrationtools/migrate_passwd.pl' # alias miggroup='/usr/share/migrationtools/migrate_group.pl' Before we continue, we need to modify our migration scripts. This is extremely important, otherwise our LDIFs will come out incorrect. Change them to your DN. # sed -i.bak \"s/padl.com/angelsofclockwork.net/g\" /usr/share/migrationtools/migrate_common.ph # sed -i.bak \"s/padl,dc=com/angelsofclockwork,dc=net/g\" /usr/share/migrationtools/migrate_common.ph Now we can use a loop to convert them. You can do it by hand also, but that's up to you. # for x in sokel suree ranos ; do miguser ldif/user/passwd.$x > ldif/user/$x.ldif ; done # for x in sokel suree ranos ; do miggroup ldif/user/group.$x >> ldif/user/$x.ldif ; done # cd ldif/user/ # cat *.ldif >> /tmp/ourusers.ldif # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f /tmp/ourusers.ldif Enter LDAP Password: adding new entry \"uid=ranos,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=ranos,ou=Group,dc=angelsofclockwork,dc=net\" adding new entry \"uid=sokel,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=sokel,ou=Group,dc=angelsofclockwork,dc=net\" adding new entry \"uid=suree,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=suree,ou=Group,dc=angelsofclockwork,dc=net\" The manual way. # /usr/share/migrationtools/migrate_passwd.pl ldif/user/passwd.sokel > ldif/user/sokel.ldif # /usr/share/migrationtools/migrate_group.pl ldif/user/group.sokel >> ldif/user/sokel.ldif # /usr/share/migrationtools/migrate_passwd.pl ldif/user/passwd.suree > ldif/user/suree.ldif # /usr/share/migrationtools/migrate_group.pl ldif/user/group.suree >> ldif/user/suree.ldif # /usr/share/migrationtools/migrate_passwd.pl ldif/user/passwd.ranos > ldif/user/ranos.ldif # /usr/share/migrationtools/migrate_group.pl ldif/user/group.ranos >> ldif/user/ranos.ldif # cd ldif/user/ # ls group.ranos group.suree passwd.sokel ranos.ldif suree.ldif group.sokel passwd.ranos passwd.suree sokel.ldif # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f sokel.ldif Enter LDAP Password: adding new entry \"uid=sokel,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=sokel,ou=Group,dc=angelsofclockwork,dc=net\" # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f suree.ldif Enter LDAP Password: adding new entry \"uid=suree,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=suree,ou=Group,dc=angelsofclockwork,dc=net\" # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f ranos.ldif Enter LDAP Password: adding new entry \"uid=ranos,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=ranos,ou=Group,dc=angelsofclockwork,dc=net\"","title":"Add Users via Migration"},{"location":"el/openldap/#add-users-via-ldif","text":"This is for those who don't want to create the account locally. For each user, you need to create an LDIF that satisfies their account information such as UID, GID and their group information. If you plan on having NFS exports to /lhome, make sure homeDirectory is correctly pointing as such. Otherwise, keep it as /home/username. dn: uid=zera,ou=People,dc=angelsofclockwork,dc=net objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetOrgPerson cn: Zera Nalika gidNumber: 11000 sn: Nalika uidNumber: 11000 givenName: Zera uid: zera loginShell: /bin/bash homeDirectory: /home/zera displayName: Zera Nalika userPassword: changeme2 dn: cn=zera,ou=Group,dc=angelsofclockwork,dc=net objectClass: posixGroup objectClass: top cn: zera gidNumber: 11000 That's about it for that. You create these for each user as needed and then add them into ldap. # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f zera.ldif adding new entry \"uid=zera,ou=People,dc=angelsofclockwork,dc=net\" adding new entry \"cn=zera,ou=Group,dc=angelsofclockwork,dc=net\" For users who are doing the /lhome thing, make their directories. When you are changing ownership, do it by UID and GID number. # mkdir /lhome # semanage fcontext -a -t home_root_t \"/lhome(/.*)?\" # mkdir /lhome/zera # cp /etc/skel/.* /lhome/zera # chown -R 11000:11000 /lhome/zera # restorecon -Rv /lhome","title":"Add Users via LDIF"},{"location":"el/openldap/#nfs-export-home-directories","text":"Warning /home vs /lhome If you used /lhome and you want to use NFS mounts, you may continue here. Otherwise, skip this section entirely. If you use /home and still want to do NFS, you will need to do persistent NFS to say /export/home, and then setup AutoFS to use /export/home as a way to automount into /home. Warning Potential Pitfall Do NOT use NFSv3. The steps below show how to prevent user squashing to allow the user to have access to their home directories. Typically, in an NFSv4 fashion, it tends to mount it with permissions set to nobody. Other solutions have been to force NFSv3. This is NOT recommended. YOU HAVE BEEN WARNED. First, we'll need to install nfs-utils, set up our exports, and modify our id map file. # dnf install nfs-utils libnfsidmap -y # vi /etc/exports /lhome *(rw,sync,root_squash,no_all_squash) # vi /etc/idmapd.conf # Comment out the first Domain line and make your own Domain = zera1.angelsofclockwork.net # systemctl start nfs-server # systemctl enable nfs-server Sometimes you'll still run into the nobody problem. Sometimes this helps. # vi /etc/sysconfig/nfs NEED_IDMAPD=yes NFSMAPID_DOMAIN=library.angelsofclockwork.net","title":"NFS Export Home Directories"},{"location":"el/openldap/#firewall","text":"Warning Keep your firewall on It is bad practice to turn your firewall off. Don't do it. We need to open up our firewall. Note Port Reference LDAP Ports: 389/tcp 636/tcp NFS Ports: 111/tcp 111/udp 2049/tcp If using firewalld, you can add these ports by service. # firewall-cmd --add-service=ldap --zone=public --permanent # firewall-cmd --add-service=ldaps --zone=public --permanent # firewall-cmd --add-service=nfs --zone=public --permanent # firewall-cmd --reload","title":"Firewall"},{"location":"el/openldap/#client","text":"Setting up the client can be straight-forward or troubling, depending on the distribution you're using. We'll be going over EL7+. Fedora also works here as well. Warning Third-party Repositories If you use third-party repositories, you may want to disable them, at least temporarily. Depending on the repository, there may be conflicts when installing the appropriate packages. You may want to consider on setting up priorities, and ensure your base and updates are higher than the rest.","title":"Client"},{"location":"el/openldap/#enterprise-linuxcurrent-fedora-releases","text":"We'll be using SSSD for this. We need to install some key packages first. Some of these packages may not install because they were either superceded or obsoleted. # yum install pki-{ca,common,silent} openldap-clients nss-pam-ldapd policycoreutils-python sssd sssd-common sssd-client sssd-ldap Use authselect to configure pam and nss. You'll need to configure /etc/sssd/sssd.conf by hand after. # authselect select sssd with-mkhomedir with-sudo # vi /etc/sssd/sssd.conf [domain/default] cache_credentials = True krb5_realm = # ldap_search_base = dc=angelsofclockwork,dc=net id_provider = ldap auth_provider = ldap chpass_provider = ldap sudo_provider = ldap ldap_uri = ldap://zera1.angelsofclockwork.net ldap_id_use_start_tls = True ldap_tls_cacertdir = /etc/openldap/certs ldap_tls_cacert = /etc/openldap/certs/ca.pem # Add the below ldap_sudo_search_base = ou=SUDOers,dc=angelsofclockwork,dc=net [sssd] # Modify this line and add sudo to the list services = nss, pam, autofs, sudo [sudo] Now, let's get our CA cert that we made way long ago and download it. If you used a real CA to sign your certificate, obtain their certificate. Note Hash Remember your hash from when you were making your certificates? You need to obtain it. In both examples, we created it while using a symbolic link. # scp zera1.angelsofclockwork.net:/etc/pki/ldap/ca.pem /etc/openldap/certs/ca.pem # cd /etc/openldap/certs # ln -s ca.pem 39642ab3.0 Now, modify /etc/openldap/ldap.conf and add the following to the bottom, ensuring your BASE is set correctly. URI ldap://library.angelsofclockwork.net BASE dc=angelsofclockwork,dc=net ssl start_tls You can attempt an ldapsearch and it should work. Search for one of your users. # ldapsearch -x -LLL uid=zera dn: uid=zera,ou=People,dc=angelsofclockwork,dc=net cn: Zera Nalika gidNumber: 11000 uidNumber: 11000 givenName: Zera objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: hostObject objectClass: radiusprofile objectClass: inetOrgPerson objectClass: ldapPublicKey uid: zera loginShell: /bin/bash homeDirectory: /lhome/zera displayName: Zera Nalika","title":"Enterprise Linux/Current Fedora Releases"},{"location":"el/openldap/#automounting-home-directories","text":"If you chose to do /lhome NFS mounting, proceed here. # mkdir /lhome # semanage fcontext -a -t autofs_t \"/lhome(/.*)?\" # restorecon -v /lhome # setsebool use_nfs_home_dirs 1 Now, let's get our automounting setup. # vi /etc/auto.master . . . /lhome /etc/auto.lhome # Add this under the /misc line Let's copy the misc template and make a change to it. # cp /etc/auto.misc /etc/auto.lhome # vi /etc/auto.lhome # Comment the cd line, and add our mount under it. #cd -fstype=iso9660,ro,nosuid,nodev :/dev/cdrom * -rw,soft,intr zera1.angelsofclockwork.net:/lhome/& # restorecon -v /etc/auto.lhome # systemctl enable autofs # systemctl start autofs Let's make our change to the idmapd configuration. # vi /etc/idmapd.conf #Domain = local.domain.edu Domain = zera1.angelsofclockwork.net # systemctl restart sssd autofs","title":"Automounting Home Directories"},{"location":"el/openldap/#ldap-structure-add-ons","text":"Here you'll find my value-added portions of getting LDAP going further than what the above presented.","title":"LDAP Structure Add-ons"},{"location":"el/openldap/#sudo","text":"Getting SUDO to work in LDAP can be a real pain. It doesn't have to be. The default sudo schema provided by the LDAP packages, which I have taken and converted into the proper olc format. dn: cn=sudo,cn=schema,cn=config objectClass: olcSchemaConfig cn: sudo olcAttributeTypes: {0}( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMa tch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {2}( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Comma nd(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 ) olcAttributeTypes: {3}( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo (deprecated)' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1 .4.1.1466.115.121.1.26 ) olcAttributeTypes: {4}( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Option s(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115 .121.1.26 ) olcAttributeTypes: {5}( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsUser' DESC 'Use r(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466 .115.121.1.26 ) olcAttributeTypes: {6}( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoRunAsGroup' DESC 'Gr oup(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.14 66.115.121.1.26 ) olcAttributeTypes: {7}( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotBefore' DESC 'Sta rt of time interval for which the entry is valid' EQUALITY generalizedTimeMat ch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) olcAttributeTypes: {8}( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoNotAfter' DESC 'End of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) olcAttributeTypes: {9}( 1.3.6.1.4.1.15953.9.1.10 NAME 'sudoOrder' DESC 'an int eger to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrd eringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcObjectClasses: {0}( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'Sudoer En tries' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand $ s udoRunAs $ sudoRunAsUser $ sudoRunAsGroup $ sudoOption $ sudoOrder $ sudoNotB efore $ sudoNotAfter $ description ) ) Save this as sudoschema.ldif and add it in. # ldapadd -Y EXTERNAL -H ldapi:/// -f sudoschema.ldif Let's create our defaults. This will start our sudo OU and give it some defaults. You may change these if you so desire. # vi sudo.ldif dn: ou=SUDOers,dc=angelsofclockwork,dc=net objectClass: top objectClass: organizationalUnit ou: SUDOers dn: cn=defaults,ou=SUDOers,dc=angelsofclockwork,dc=net objectClass: top objectClass: sudoRole cn: defaults description: SUDOers Default values sudoOption: requiretty sudoOption: env_reset sudoOption: env_keep = \"COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS\" sudoOption: env_keep += \"MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE\" sudoOption: env_keep += \"LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES\" sudoOption: env_keep += \"LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE\" sudoOption: env_keep += \"LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY\" # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f sudo.ldif Now, let's create our first SUDO container. It will be for our \\\"admins\\\". We could specify \\\"sudoHost: ALL\\\" if we wanted. But for the example, I chose a couple of hosts. # vi admins.ldif dn: cn=ADMINS,ou=SUDOers,dc=angelsofclockwork,dc=net objectClass: sudoRole cn: ADMINS description: Administration Role sudoCommand: ALL sudoHost: zera2.angelsofclockwork.net sudoHost: zera3.angelsofclockwork.net sudoRunAs: ALL sudoRunAsGroup: ALL sudoRunAsUser: ALL sudoUser: zera # ldapadd -xWD \"cn=manager,dc=angelsofclockwork,dc=net\" -f admins.ldif If you used authselect with the with-sudo option, this should have turned on sss for sudoers. You may want to verify /etc/nsswitch.conf just to be sure. Note SSSD Cache Sometimes SSSD likes to cache things or never update things for whatever reason or another. To get around this, stop sssd, delete everything under /var/lib/sss/db/ and then start sssd again. Now, let's test. [root@zera3 ~]# su - zera [zera@zera3 ~]$ sudo -l [sudo] password for zera: Matching Defaults entries for zera on this host: requiretty, env_reset, env_keep=\"COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS\", env_keep+=\"MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE\", env_keep+=\"LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES\", env_keep+=\"LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE\", env_keep+=\"LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY\", secure_path=/sbin\\:/bin\\:/usr/sbin\\:/usr/bin, env_reset, requiretty User sokel may run the following commands on this host: (ALL : ALL) ALL","title":"SUDO"},{"location":"el/openldap/#member-groups","text":"Member groups are extremely useful, especially for when you're granting permissions to external applications (and SSSD if you wish). # vi modules.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib64/openldap olcModuleLoad: memberof.la # vi memberof.ldif dn: olcOverlay=memberof,olcDatabase={2}mdb,cn=config objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf # ldapadd -Y EXTERNAL -H ldapi:/// -f modules.ldif # ldapadd -Y EXTERNAL -H ldapI:/// -f memberof.ldif After that, we can now create our groups. Example. dn: cn=Admins,ou=Group,dc=angelsofclockwork,dc=net objectClass: groupOfNames cn: Admins member: uid=chris,ou=People,dc=angelsofclockwork,dc=net member: uid=zera,ou=People,dc=angelsofclockwork,dc=net member: uid=sithlord,ou=People,dc=angelsofclockwork,dc=net In SSSD, we can make some minor changes. ldap_search_base = dc=angelsofclockwork,dc=net?sub?|(memberOf=cn=Admins,ou=Group,dc=angelsofclockwork,dc=net) ldap_access_filter = (|(memberOf=cn=Admins,ou=Group,dc=angelsofclockwork,dc=net)) # Change this to rfc2307 if you are using nis ldap_schema = rfc2307bis enumerate = True # systemctl stop sssd ; rm -rf /var/lib/sss/db/* ; systemctl start sssd If we were to do an ldapsearch, we can see the groups show up. # ldapsearch -x -LLL uid=zera memberOf dn: uid=zera,ou=People,dc=angelsofclockwork,dc=net memberOf: cn=Admins,ou=Group,dc=angelsofclockwork,dc=net Make sure you turn on referential integrity!","title":"Member Groups"},{"location":"el/openldap/#referential-integrity","text":"Having referential integrity is absolutely important. It basically means that if a user gets deleted, their group membership disappears also. This prevents you from having to clean up manually. # vi module.ldif dn: cn=module,cn=config changetype: modify replace: olcModuleLoad olcModuleLoad: refint.la olcModuleLoad: memberof.la # ldapmodify -Y EXTERNAL -H ldapi:/// -f module.ldif You also need the overlay. An overlay allows certain plugins to work on a DIT. # vi overlay.ldif dn: olcOverlay=refint,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: olcRefintConfig objectClass: top olcOverlay: refint olcRefintAttribute: memberOf member manager # ldapmodify -Y EXTERNAL -H ldapi:/// -f overlay.ldif","title":"Referential Integrity"},{"location":"el/openldap/#acl","text":"An ACL (Access Control List) allows permissions to be given to those in the LDAP tree. The problem with a default LDAP setup is that, attributes like userPassword show up in an ldapsearch. This gives little protection. So, to get around this issue, we have to create ACLs. Note The Manager's Rights The manager has all rights to the DIT. In previous implementations, I have put him in access controls as a reference and would put \\\"write\\\" as his access. This isn't needed, but it doesn't hurt to have it. This ldif creates an ACL that allows the Admins group to do anything they want on the DIT (similar to manager). This also prevents anonymous searches from pulling up a user's password. # vi acl.ldif dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by group.exact=\"cn=Admins,ou=Group,dc=angelsofclockwork,dc=net\" write by anonymous auth by self write by * none break olcAccess: {2}to * by group.exact=\"cn=Admins,ou=Group,dc=angelsofclockwork,dc=net\" write by * read olcAccess: {3}to dn.base=\"\" by * read # ldapmodify -Y EXTERNAL -H ldapi:/// -f acl.ldif It's highly recommended, however, to disable anonymous searching, especially if you go production with LDAP. A lot of LDAP implementations disallow anonymous searching by default. You can do this with ACLs, but it's not recommended. We cover this in the search.","title":"ACL"},{"location":"el/openldap/#disable-anonymous-binding","text":"It's recommended to disable anonymous searching. This can be handled by making a modification to the global configuration and the DIT configuration. dn: cn=config changetype: modify add: olcDisallows olcDisallows: bind_anon dn: olcDatabase={2}mdb,cn=config changetype: modify add: olcRequires olcRequires: authc Once you add this in, all anonymous searching will cease. # ldapsearch -x -LLL uid=zera ldap_bind: Inappropriate authentication (48) additional info: anonymous bind disallowed","title":"Disable Anonymous Binding"},{"location":"el/openldap/#ldap-logging","text":"Logging is of course, very important for an LDAP server. There are a few types of logs we can do. There are the standard logs and then there are also audit logs. Audit logs allow an administrator to view changes being done to LDAP in an LDIF form. We can setup both. Let's create our modification LDIF. This will turn on standard logging and enable the audit module. Run an ldapmodify against this LDIF. dn: cn=config changetype: modify replace: olcLogFile olcLogFile: /var/log/ldap-standard.log - replace: olcLogLevel olcLogLevel: 256 # Keep in mind, if you have other modules being loaded, # add them to the list dn: cn=module,cn=config changetype: modify replace: olcModuleLoad olcModuleLoad: refint.la olcModuleLoad: memberof.la olcModuleLoad: auditlog.la Now, we need to make sure audit logging is done on our database. dn: olcOverlay=auditlog,olcDatabase={2}mdb,cn=config objectClass: olcAuditlogConfig objectClass: olcOverlayConfig olcOverlay: auditlog olcAuditlogFile: /var/log/ldap-audit.log It's recommended to have logrotate working for our logs. Here is a file I've dropped into /etc/logrotate.d. Experiment with these options. Since I work in an environment that has tons of transactions going all the time, and thus, my rotations are at 100M and 250M respectively. /var/log/ldap-standard.log { missingok compress notifempty daily rotate 10 size=100M } /var/log/ldap-audit.log { missingok compress notifempty daily rotate 10 size=250M } In /etc/rsyslog.conf, optionally, you can create this. If you find that logs are not appearing after the changes above, use this. local4.* /var/log/ldap.log","title":"LDAP Logging"},{"location":"el/openldap/#password-policy","text":"Password policies are a great asset, especially when working in an environment that have or require security policies. First, let's load our module and then add our overlay. This LDIF will do both. You may want to remove the comments before adding. dn: cn=module,cn=config changetype: modify replace: olcModuleLoad olcModuleLoad: refint.la olcModuleLoad: memberof.la olcModuleLoad: auditlog.la olcModuleLoad: ppolicy.la dn: olcOverlay=ppolicy,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=angelsofclockwork,dc=net # Set the below to TRUE if you want users to get locked out after failed attempted olcPPolicyUseLockout: TRUE # Set the below to TRUE if you want passwords to be hashed. # HIGHLY RECOMMENDED YOU SET THIS TO TRUE olcPPolicyHashCleartext: TRUE Now, we need an LDIF to create our standard password policy. It's important to have a default password policy and then create separate ones as needed. Make sure to read the comments. You may want to remove the comments before adding. dn: cn=default,ou=policies,dc=angelsofclockwork,dc=net objectClass: pwdPolicy objectClass: person objectClass: top cn: passwordDefault sn: passwordDefault pwdAttribute: userPassword # If set to 0, quality is not checked. # If set to 1, quality is checked by an internal module which you setup. # If set to 2, the system used to change the password must have a checking mechanism. # Pick your poison. pwdCheckQuality: 0 # Password lives for 84 days pwdMinAge: 0 pwdMaxAge: 7257600 # Minimum length is 7 pwdMinLength: 7 # Password history of 10, cannot use a password that's in history pwdInHistory: 10 # 5 Failures till a lockout, 10 minutes for it to reset, 30 minute lockout. pwdMaxFailure: 5 pwdFailureCountInterval: 600 pwdLockout: TRUE pwdLockoutDuration: 1800 # A user can change their own password. pwdAllowUserChange: TRUE # Systems that authenticate to LDAP can warn 14 days before an expiration pwdExpireWarning: 1209600 # Allowed binds on an expired password. pwdGraceAuthNLimit: 5 pwdMustChange: TRUE pwdSafeModify: FALSE In the instance you want to use the built-in module for password checking, your LDIF would have these lines. pwdCheckQuality: 1 pwdCheckModule: check_password.so","title":"Password Policy"},{"location":"el/pxeboot/","text":"This page goes over setting up a pxeboot system using tftp on Enterprise Linux or Fedora Requirements \u00b6 Here are the list of requirements below. Enterprise Linux 8, 9, or Fedora A DHCP server setup that allows you to setup the next_server directive or setup the tftp server location Optionally if you are using a local mirror, httpd or nginx installed. (This guide assumes httpd ) Tutorial Preface, Notes, and Recommendations \u00b6 In some environments, it may be better (or easier, depending on your perspective) to setup a PXE server and roll out systems in a lab or otherwise in that fashion. It's one of the most straight forward ways to build out systems easily and consistently. The difference between a typical PXE setup and this is we're using grub2 menus, rather than the classic menu style. This makes it simpler to keep all configurations consistent between classic boot and EFI boot. If you plan on using supporting other architectures, it will be easier to use that architecture to run the grub2-mknetdir command and brings those to your tftp server. Cobbler \u00b6 While cobbler is a perfectly viable solution to setting up a pxeboot system for various distros and configurations, it is out of scope for this article. It is unknown if it sets up or directly supports grub2. Server Setup \u00b6 This section goes over the server setup portion for the tftp server. TFTP \u00b6 Let's install the tftpserver package plus some additional grub packages. If you are wanting other architectures, you can obtain the other grub2 module packages from your distribution's BaseOS or equivalent repository for that architecture and install it manually. # x86_64 % dnf install \\ grub2-efi-x64-modules \\ grub2-tools-extra \\ grub2-pc-modules \\ shim-ia32 \\ # this does not exist on el9+ tftp-server # aarch64 % dnf install \\ grub2-efi-aa64-modules \\ grub2-tools-extra \\ tftp-server Let's make our initial net directories and ensure the selinux contexts are correct. % grub2-mknetdir --net-directory /var/lib/tftpboot/ Netboot directory for i386-pc created. Configure your DHCP server to point to /srv/tftp/boot/grub2/i386-pc/core.0 Netboot directory for x86_64-efi created. Configure your DHCP server to point to /srv/tftp/boot/grub2/x86_64-efi/core.efi % restorecon -R /var/lib/tftpboot Now you'll need to enable the tftp socket and open the port. Traditionally, you would use xinetd. It's no longer required for the tftp service. # Note: This is port 69 with the UDP protocol % firewall-cmd --add-service=tftp --permanent % systemctl enable tftp.socket --now DHCP (ISC) \u00b6 On your DHCP server configuration (typically /etc/dhcp/dhcpd.conf if running on Fedora or EL), you should set the following options: option pxe-system-type code 93 = unsigned integer 16; option rfc3442-classless-static-routes code 121 = array of integer 8; option ms-classless-static-routes code 249 = array of integer 8; option space pxelinux; option pxelinux.magic code 208 = string; option pxelinux.configfile code 209 = text; option pxelinux.pathprefix code 210 = text; option pxelinux.reboottime code 211 = unsigned integer 32; option architecture-type code 93 = unsigned integer 16; option pxelinux.mtftp-ip code 1 = ip-address; option pxelinux.mtftp-cport code 2 = unsigned integer 16; option pxelinux.mtftp-sport code 3 = unsigned integer 16; option pxelinux.mtftp-tmout code 4 = unsigned integer 8; option pxelinux.mtftp-delay code 5 = unsigned integer 8; Whether this section is within a subnet block or not, it is needed to ensure the right bootloader is called. Note that we're only loading x86. If you are loading armhfp, use 00:0a. If you are loading aarch64, use 00:0b. class \"pxeclients\" { match if substring (option vendor-class-identifier, 0, 9) = \"PXEClient\"; # x86_64 EFI if option pxe-system-type = 00:07 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:08 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:09 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else { # BIOS boot only filename \"boot/grub2/i386-pc/core.0\"; } } Note that in your subnet blocks, you should also mention next_server , which should point to your TFTP server. The DHCP and TFTP server can be on the same machine and there's nothing stopping you from doing that; next_server needs to be set regardless here. See an example below of a full work dhcpd.conf. ddns-update-style interim; allow booting; allow bootp; authoritative; log-facility local6; ignore client-updates; set vendorclass = option vendor-class-identifier; ## Allowing EFI Clients option pxe-system-type code 93 = unsigned integer 16; option rfc3442-classless-static-routes code 121 = array of integer 8; option ms-classless-static-routes code 249 = array of integer 8; option space pxelinux; option pxelinux.magic code 208 = string; option pxelinux.configfile code 209 = text; option pxelinux.pathprefix code 210 = text; option pxelinux.reboottime code 211 = unsigned integer 32; option architecture-type code 93 = unsigned integer 16; option pxelinux.mtftp-ip code 1 = ip-address; option pxelinux.mtftp-cport code 2 = unsigned integer 16; option pxelinux.mtftp-sport code 3 = unsigned integer 16; option pxelinux.mtftp-tmout code 4 = unsigned integer 8; option pxelinux.mtftp-delay code 5 = unsigned integer 8; subnet 10.100.0.0 netmask 255.255.255.0 { interface br1000; option routers 10.100.0.1; option domain-name-servers 10.100.0.1, 10.100.0.231; option domain-name \"angelsofclockwork.net\"; option subnet-mask 255.255.255.0; range 10.100.0.110 10.100.0.199; ## EFI Client Catch class \"pxeclients\" { match if substring (option vendor-class-identifier, 0, 9) = \"PXEClient\"; if option pxe-system-type = 00:07 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:08 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:09 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:0a { filename \"boot/grub2/armv7a-efi/core.efi\"; } else if option pxe-system-type = 00:0b { filename \"boot/grub2/aarch64-efi/core.efi\"; } else { filename \"boot/grub2/i386-pc/core.0\"; } } default-lease-time 21600; max-lease-time 43200; next-server 10.100.0.1; } Ensure that the dhcpd service is restarted after making the necessary changes. DHCP (Kea) \u00b6 Kea is a different configuration style from ISC. At this time, we do not have a full working example. Web Server (httpd) \u00b6 If we plan on hosting the installation mirror in your environment, it's recommended to stand up a simple web server. It does not require any kind of special configuration. We'll use the default /var/www/html/ path. If you wish to use another such as /srv/www, you will need to setup a virtual host (this is outside the scope of this page). % dnf install httpd -y % systemctl enable httpd --now % firewall-cmd --add-service=http --permanent % firewall-cmd --complete-reload # create the directories for our distributions % mkdir -p /var/www/html/os/{fedora,centos,rocky} Setting up Grub \u00b6 When you run grub2-mknetdir, it created a core.* set of files. An accompanying grub.cfg must sit next to them. To prevent a duplication of work, it can be simplified by making all grub configurations at /var/lib/tftpboot and then symlink them next to each directory containing core.*. Let's make a very, very simple one. set default=0 set timeout=60 menuentry 'EFI Firmware System Setup' $menuentry_id_option 'uefi-firmware' { fwsetup } menuentry 'Reboot' { reboot } menuentry 'Shutdown' { halt } Now let's just symlink it. % cd /var/lib/tftpboot/boot/grub2/x86_64-efi % ln -s ../../../grub.cfg % cd /var/lib/tftpboot/boot/grub2/i386-pc % ln -s ../../../grub.cfg This should produce a grub menu for both EFI and BIOS systems that contain three bootable options. Adding Distributions \u00b6 Now that grub is sort of setup, we should add a distribution to it at least. Below are a couple examples using Fedora, Rocky Linux, and CentOS Stream. Rocky Linux \u00b6 Setting up Rocky Linux (or any other Enterprise Linux distribution) should be straight forward. We'll download both Rocky Linux 8 and Rocky Linux 9 and setup the menus. Note If you plan on not hosting a mirror of the base repositories, ensure that your inst.repo/inst.stage2 commands are accurate to a mirror of your choice. The below assumes we are hosting a mirror of the downloaded ISO, which will make installations quicker as it'll be confined to your network. % cd /var/tmp # Rocky Linux 8 % wget https://dl.rockylinux.org/pub/rocky/8/isos/x86_64/Rocky-8-latest-x86_64-dvd.iso # Rocky Linux 9 % wget https://dl.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9-latest-x86_64-dvd.iso # Optionally, if you plan on supporting ARM... % wget https://dl.rockylinux.org/pub/rocky/8/isos/aarch64/Rocky-8-latest-aarch64-dvd.iso % wget https://dl.rockylinux.org/pub/rocky/9/isos/aarch64/Rocky-9-latest-aarch64-dvd.iso Here we'll copy the data we want into the necessary directories. Any pxeboot related images will go to /var/lib/tftpboot/rocky-X-ARCH (X being the major version, ARCH being the architecture). If we are keeping a local mirror of the DVD, we'll put it into /var/www/html/os/rocky/X/ARCH. Below is for x86_64, but the same steps can be repeated for aarch64 without any issues. Just replace x86_64 with aarch64. ## Rocky 8 % mount -o loop Rocky-8-latest-x86_64-dvd.iso /mnt % mkdir /var/lib/tftpboot/rocky-8-x86_64 % cp /mnt/images/pxeboot/* /var/lib/tftpboot/rocky-8-x86_64 % mkdir -p /var/www/html/os/rocky/8/x86_64 % rsync -vrlptDSH --delete /mnt/ /var/www/html/os/rocky/8/x86_64 % umount /mnt ## Rocky 9 % mount -o loop Rocky-9-latest-x86_64-dvd.iso /mnt % mkdir /var/lib/tftpboot/rocky-9-x86_64 % cp /mnt/images/pxeboot/* /var/lib/tftpboot/rocky-9-x86_64 % mkdir -p /var/www/html/os/rocky/9/x86_64 % rsync -vrlptDSH --delete /mnt/ /var/www/html/os/rocky/9/x86_64 % umount /mnt % restorecon -R /var/www/html/os/rocky At this point, we'll need to setup the grub menus. We'll setup non-kickstart examples for BIOS and UEFI. . . . # Rocky 8 menuentry 'Install Rocky Linux 8 (No KS) (UEFI)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 8 kernel...\" linuxefi rocky-8-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/8/x86_64 inst.stage2=http://10.100.0.1/os/rocky/8/x86_64 ip=dhcp initrdefi rocky-8-x86_64/initrd.img } menuentry 'Install Rocky Linux 8 (No KS) (BIOS)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 8 kernel...\" linux16 rocky-8-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/8/x86_64 inst.stage2=http://10.100.0.1/os/rocky/8/x86_64 ip=dhcp initrd16 rocky-8-x86_64/initrd.img } # if you are setting up arm... menuentry 'Install Rocky Linux 8 (No KS) (aarch64)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 8 kernel...\" linux rocky-9-aarch64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/8/aarch64 inst.stage2=http://10.100.0.1/os/rocky/8/aarch64 ip=dhcp initrd rocky-9-aarch64/initrd.img } . . . # Rocky 9 menuentry 'Install Rocky Linux 9 (No KS) (UEFI)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 9 kernel...\" linuxefi rocky-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/9/x86_64 inst.stage2=http://10.100.0.1/os/rocky/9/x86_64 ip=dhcp initrdefi rocky-9-x86_64/initrd.img } menuentry 'Install Rocky Linux 9 (No KS) (BIOS)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 9 kernel...\" linux16 rocky-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/9/x86_64 inst.stage2=http://10.100.0.1/os/rocky/9/x86_64 ip=dhcp initrd16 rocky-9-x86_64/initrd.img } # if you are setting up arm... menuentry 'Install Rocky Linux 9 (No KS) (aarch64)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 9 kernel...\" linux rocky-9-aarch64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/9/aarch64 inst.stage2=http://10.100.0.1/os/rocky/9/aarch64 ip=dhcp initrd rocky-9-aarch64/initrd.img } The Rocky Linuxinstallation should now be bootable. CentOS Stream \u00b6 Much like Rocky Linux (or other derivatives), the path is the same for setting it up. Using upstream mirror path If you plan on not hosting a mirror of the base repositories, ensure that your inst.repo/inst.stage2 commands are accurate to a mirror of your choice. % cd /var/tmp # CentOS Stream 9 % wget -O CentOS-Stream-9-latest-x86_64-dvd1.iso \\ 'https://mirrors.centos.org/mirrorlist?path=/9-stream/BaseOS/x86_64/iso/CentOS-Stream-9-latest-x86_64-dvd1.iso&redirect=1&protocol=https' # Optionally, if you plan on supporting ARM... % wget -O CentOS-Stream-9-latest-aarch64-dvd1.iso \\ 'https://mirrors.centos.org/mirrorlist?path=/9-stream/BaseOS/aarch64/iso/CentOS-Stream-9-latest-aarch64-dvd1.iso&redirect=1&protocol=https' Here we'll copy the data we want into the necessary directories. Any pxeboot related images will go to /var/lib/tftpboot/rocky-X-ARCH (X being the major version, ARCH being the architecture). If we are keeping a local mirror of the DVD, we'll put it into /var/www/html/os/rocky/X/ARCH. Below is for x86_64, but the same steps can be repeated for aarch64 without any issues. Just replace x86_64 with aarch64. ## CentOS Stream 9 % mount -o loop CentOS-Stream-9-latest-x86_64-dvd1.iso /mnt % mkdir /var/lib/tftpboot/centos-9-x86_64 % cp /mnt/images/pxeboot/* /var/lib/tftpboot/centos-9-x86_64 % mkdir -p /var/www/html/os/centos/9/x86_64 % rsync -vrlptDSH --delete /mnt/ /var/www/html/os/centos/9/x86_64 % restorecon -R /var/www/html/os/centos/9 % umount /mnt} At this point, we'll need to setup the grub menus. We'll setup non-kickstart examples for BIOS and UEFI. . . . # CentOS Stream 9 menuentry 'Install CentOS Stream 9 (No KS) (UEFI)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading CentOS Stream 9 kernel...\" linuxefi centos-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/centos/9/x86_64 inst.stage2=http://10.100.0.1/os/centos/9/x86_64 ip=dhcp initrdefi centos-9-x86_64/initrd.img } menuentry 'Install CentOS Stream 9 (No KS) (BIOS)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading CentOS Stream 9 kernel...\" linux16 centos-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/centos/9/x86_64 inst.stage2=http://10.100.0.1/os/centos/9/x86_64 ip=dhcp initrd16 centos-9-x86_64/initrd.img } # if you are setting up arm... menuentry 'Install CentOS Stream 9 (No KS) (aarch64)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading CentOS Stream 9 kernel...\" linux centos-9-aarch64/vmlinuz inst.repo=http://10.100.0.1/os/centos/9/aarch64 inst.stage2=http://10.100.0.1/os/centos/9/aarch64 ip=dhcp initrd centos-9-aarch64/initrd.img } The CentOS Stream installation should now be bootable. Fedora \u00b6 Let's put up a regular installer with no kickstart for Fedora. This does not involve pulling down any ISO's and will rely entirely on using upstream repositories. % cd /var/lib/tftpboot % mkdir fedora-x86_64 % cd fedora-x86_64 # Replace XX with the current fedora version % wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/x86_64/os/images/pxeboot/initrd.img % wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/x86_64/os/images/pxeboot/vmlinuz # If you want arm systems... aarch64 % cd .. % mkdir fedora-aarch64 # Replace XX with the current fedora version % wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/aarch64/os/images/pxeboot/initrd.img % wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/aarch64/os/images/pxeboot/vmlinuz Now we can add a couple menu entry items for Fedora. I'm making both EFI and Classic entries to ensure we can boot both EFI and BIOS systems from the same menu. . . . menuentry 'Install Fedora Linux (EFI)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (Classic)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } # Add the below for ARM systems menuentry 'Install Fedora Linux (ARM)' --class fedora --class gnu-linux --class gnu --class os { linux fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ ip=dhcp initrd fedora-aarch64/initrd.img } Now the Fedora installation should be bootable. Customizing Grub \u00b6 Grub is customizable. It is possible to setup background images, choose menu colors, setup themes, and so on. Colors and Backgrounds \u00b6 Colors and backgrounds are perfectly possible, even in an EFI setup. We'll need to load a few modules and then set the colors and background we want. Note that if you're using a background, it should live in /var/lib/tftpboot to make things easier. . . . insmod all_video insmod gfxterm insmod gfxterm_menu insmod gfxmenu insmod gfxterm_background insmod png terminal_output gfxterm background_image -m stretch /bg.png set menu_color_highlight=cyan/black set menu_color_normal=white/black set color_normal=white/black . . . The background would be /var/lib/tftpboot/bg.png in this example. Selected items will appear to be cyan and the typical gray selection box is now transparent, which is done by setting it to black. Everything else should appear as white text with a transparent background. Example below. Special Submenus \u00b6 Submenus are easily created using submenu in the grub configuration. For example: submenu 'Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black menuentry 'Install Fedora Linux (EFI)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (Classic)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (ARM)' --class fedora --class gnu-linux --class gnu --class os { linux fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ ip=dhcp initrd fedora-aarch64/initrd.img } } This now means \"Fedora Linux\" will show up as a menu option and it will take you to a brand new menu with the two listed items, and another color scheme. Note that we created color items because submenus will reset the theme options. Example of how it looks is below. It is also possible to place everything into separate source-able files. Note that when you do this, you will need to symlink those files just like you did with grub.cfg. submenu 'Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black source fedora.cfg } menuentry 'Install Fedora Linux (EFI)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (Classic)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (ARM)' --class fedora --class gnu-linux --class gnu --class os { linux fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ ip=dhcp initrd fedora-aarch64/initrd.img } Submenus can be nested too. Here's a deeper, working example of my own setup using Fedora 35. # grub.cfg set default=0 set timeout=60 insmod all_video insmod gfxterm insmod gfxterm_menu insmod gfxmenu insmod gfxterm_background insmod png terminal_output gfxterm loadfont /unicode.pf2 background_image -m stretch /bg.png set menu_color_highlight=cyan/black set menu_color_normal=white/black set color_normal=white/black submenu 'Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black source fedora.cfg } menuentry 'EFI System Setup' $menuentry_id_option 'uefi-firmware' { fwsetup } menuentry 'Reboot' { reboot } menuentry 'Shutdown' { halt } # fedora.cfg submenu 'Fedora Linux (latest stable)' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black # EFI Only submenu 'EFI Mode' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black menuentry 'Install Fedora Linux (No KS)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Fedora Linux (Rescue Mode)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.rescue inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os initrdefi fedora-x86_64/initrd.img } } # Classic Only submenu 'Classic Mode' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black menuentry 'Install Fedora Linux (No KS)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } menuentry 'Fedora Linux (Rescue Mode)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.rescue inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ initrd16 fedora-x86_64/initrd.img } } # EFI mode for ARM submenu 'EFI Mode (aarch64)' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black menuentry 'Install Fedora Linux (No KS)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os ip=dhcp initrdefi fedora-aarch64/initrd.img } menuentry 'Install Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os ip=dhcp initrdefi fedora-aarch64/initrd.img } menuentry 'Fedora Linux (Rescue Mode)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-aarch64/vmlinuz inst.rescue inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os initrdefi fedora-aarch64/initrd.img } } }","title":"PXE (with grub2)"},{"location":"el/pxeboot/#requirements","text":"Here are the list of requirements below. Enterprise Linux 8, 9, or Fedora A DHCP server setup that allows you to setup the next_server directive or setup the tftp server location Optionally if you are using a local mirror, httpd or nginx installed. (This guide assumes httpd )","title":"Requirements"},{"location":"el/pxeboot/#tutorial-preface-notes-and-recommendations","text":"In some environments, it may be better (or easier, depending on your perspective) to setup a PXE server and roll out systems in a lab or otherwise in that fashion. It's one of the most straight forward ways to build out systems easily and consistently. The difference between a typical PXE setup and this is we're using grub2 menus, rather than the classic menu style. This makes it simpler to keep all configurations consistent between classic boot and EFI boot. If you plan on using supporting other architectures, it will be easier to use that architecture to run the grub2-mknetdir command and brings those to your tftp server.","title":"Tutorial Preface, Notes, and Recommendations"},{"location":"el/pxeboot/#cobbler","text":"While cobbler is a perfectly viable solution to setting up a pxeboot system for various distros and configurations, it is out of scope for this article. It is unknown if it sets up or directly supports grub2.","title":"Cobbler"},{"location":"el/pxeboot/#server-setup","text":"This section goes over the server setup portion for the tftp server.","title":"Server Setup"},{"location":"el/pxeboot/#tftp","text":"Let's install the tftpserver package plus some additional grub packages. If you are wanting other architectures, you can obtain the other grub2 module packages from your distribution's BaseOS or equivalent repository for that architecture and install it manually. # x86_64 % dnf install \\ grub2-efi-x64-modules \\ grub2-tools-extra \\ grub2-pc-modules \\ shim-ia32 \\ # this does not exist on el9+ tftp-server # aarch64 % dnf install \\ grub2-efi-aa64-modules \\ grub2-tools-extra \\ tftp-server Let's make our initial net directories and ensure the selinux contexts are correct. % grub2-mknetdir --net-directory /var/lib/tftpboot/ Netboot directory for i386-pc created. Configure your DHCP server to point to /srv/tftp/boot/grub2/i386-pc/core.0 Netboot directory for x86_64-efi created. Configure your DHCP server to point to /srv/tftp/boot/grub2/x86_64-efi/core.efi % restorecon -R /var/lib/tftpboot Now you'll need to enable the tftp socket and open the port. Traditionally, you would use xinetd. It's no longer required for the tftp service. # Note: This is port 69 with the UDP protocol % firewall-cmd --add-service=tftp --permanent % systemctl enable tftp.socket --now","title":"TFTP"},{"location":"el/pxeboot/#dhcp-isc","text":"On your DHCP server configuration (typically /etc/dhcp/dhcpd.conf if running on Fedora or EL), you should set the following options: option pxe-system-type code 93 = unsigned integer 16; option rfc3442-classless-static-routes code 121 = array of integer 8; option ms-classless-static-routes code 249 = array of integer 8; option space pxelinux; option pxelinux.magic code 208 = string; option pxelinux.configfile code 209 = text; option pxelinux.pathprefix code 210 = text; option pxelinux.reboottime code 211 = unsigned integer 32; option architecture-type code 93 = unsigned integer 16; option pxelinux.mtftp-ip code 1 = ip-address; option pxelinux.mtftp-cport code 2 = unsigned integer 16; option pxelinux.mtftp-sport code 3 = unsigned integer 16; option pxelinux.mtftp-tmout code 4 = unsigned integer 8; option pxelinux.mtftp-delay code 5 = unsigned integer 8; Whether this section is within a subnet block or not, it is needed to ensure the right bootloader is called. Note that we're only loading x86. If you are loading armhfp, use 00:0a. If you are loading aarch64, use 00:0b. class \"pxeclients\" { match if substring (option vendor-class-identifier, 0, 9) = \"PXEClient\"; # x86_64 EFI if option pxe-system-type = 00:07 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:08 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:09 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else { # BIOS boot only filename \"boot/grub2/i386-pc/core.0\"; } } Note that in your subnet blocks, you should also mention next_server , which should point to your TFTP server. The DHCP and TFTP server can be on the same machine and there's nothing stopping you from doing that; next_server needs to be set regardless here. See an example below of a full work dhcpd.conf. ddns-update-style interim; allow booting; allow bootp; authoritative; log-facility local6; ignore client-updates; set vendorclass = option vendor-class-identifier; ## Allowing EFI Clients option pxe-system-type code 93 = unsigned integer 16; option rfc3442-classless-static-routes code 121 = array of integer 8; option ms-classless-static-routes code 249 = array of integer 8; option space pxelinux; option pxelinux.magic code 208 = string; option pxelinux.configfile code 209 = text; option pxelinux.pathprefix code 210 = text; option pxelinux.reboottime code 211 = unsigned integer 32; option architecture-type code 93 = unsigned integer 16; option pxelinux.mtftp-ip code 1 = ip-address; option pxelinux.mtftp-cport code 2 = unsigned integer 16; option pxelinux.mtftp-sport code 3 = unsigned integer 16; option pxelinux.mtftp-tmout code 4 = unsigned integer 8; option pxelinux.mtftp-delay code 5 = unsigned integer 8; subnet 10.100.0.0 netmask 255.255.255.0 { interface br1000; option routers 10.100.0.1; option domain-name-servers 10.100.0.1, 10.100.0.231; option domain-name \"angelsofclockwork.net\"; option subnet-mask 255.255.255.0; range 10.100.0.110 10.100.0.199; ## EFI Client Catch class \"pxeclients\" { match if substring (option vendor-class-identifier, 0, 9) = \"PXEClient\"; if option pxe-system-type = 00:07 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:08 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:09 { filename \"boot/grub2/x86_64-efi/core.efi\"; } else if option pxe-system-type = 00:0a { filename \"boot/grub2/armv7a-efi/core.efi\"; } else if option pxe-system-type = 00:0b { filename \"boot/grub2/aarch64-efi/core.efi\"; } else { filename \"boot/grub2/i386-pc/core.0\"; } } default-lease-time 21600; max-lease-time 43200; next-server 10.100.0.1; } Ensure that the dhcpd service is restarted after making the necessary changes.","title":"DHCP (ISC)"},{"location":"el/pxeboot/#dhcp-kea","text":"Kea is a different configuration style from ISC. At this time, we do not have a full working example.","title":"DHCP (Kea)"},{"location":"el/pxeboot/#web-server-httpd","text":"If we plan on hosting the installation mirror in your environment, it's recommended to stand up a simple web server. It does not require any kind of special configuration. We'll use the default /var/www/html/ path. If you wish to use another such as /srv/www, you will need to setup a virtual host (this is outside the scope of this page). % dnf install httpd -y % systemctl enable httpd --now % firewall-cmd --add-service=http --permanent % firewall-cmd --complete-reload # create the directories for our distributions % mkdir -p /var/www/html/os/{fedora,centos,rocky}","title":"Web Server (httpd)"},{"location":"el/pxeboot/#setting-up-grub","text":"When you run grub2-mknetdir, it created a core.* set of files. An accompanying grub.cfg must sit next to them. To prevent a duplication of work, it can be simplified by making all grub configurations at /var/lib/tftpboot and then symlink them next to each directory containing core.*. Let's make a very, very simple one. set default=0 set timeout=60 menuentry 'EFI Firmware System Setup' $menuentry_id_option 'uefi-firmware' { fwsetup } menuentry 'Reboot' { reboot } menuentry 'Shutdown' { halt } Now let's just symlink it. % cd /var/lib/tftpboot/boot/grub2/x86_64-efi % ln -s ../../../grub.cfg % cd /var/lib/tftpboot/boot/grub2/i386-pc % ln -s ../../../grub.cfg This should produce a grub menu for both EFI and BIOS systems that contain three bootable options.","title":"Setting up Grub"},{"location":"el/pxeboot/#adding-distributions","text":"Now that grub is sort of setup, we should add a distribution to it at least. Below are a couple examples using Fedora, Rocky Linux, and CentOS Stream.","title":"Adding Distributions"},{"location":"el/pxeboot/#rocky-linux","text":"Setting up Rocky Linux (or any other Enterprise Linux distribution) should be straight forward. We'll download both Rocky Linux 8 and Rocky Linux 9 and setup the menus. Note If you plan on not hosting a mirror of the base repositories, ensure that your inst.repo/inst.stage2 commands are accurate to a mirror of your choice. The below assumes we are hosting a mirror of the downloaded ISO, which will make installations quicker as it'll be confined to your network. % cd /var/tmp # Rocky Linux 8 % wget https://dl.rockylinux.org/pub/rocky/8/isos/x86_64/Rocky-8-latest-x86_64-dvd.iso # Rocky Linux 9 % wget https://dl.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9-latest-x86_64-dvd.iso # Optionally, if you plan on supporting ARM... % wget https://dl.rockylinux.org/pub/rocky/8/isos/aarch64/Rocky-8-latest-aarch64-dvd.iso % wget https://dl.rockylinux.org/pub/rocky/9/isos/aarch64/Rocky-9-latest-aarch64-dvd.iso Here we'll copy the data we want into the necessary directories. Any pxeboot related images will go to /var/lib/tftpboot/rocky-X-ARCH (X being the major version, ARCH being the architecture). If we are keeping a local mirror of the DVD, we'll put it into /var/www/html/os/rocky/X/ARCH. Below is for x86_64, but the same steps can be repeated for aarch64 without any issues. Just replace x86_64 with aarch64. ## Rocky 8 % mount -o loop Rocky-8-latest-x86_64-dvd.iso /mnt % mkdir /var/lib/tftpboot/rocky-8-x86_64 % cp /mnt/images/pxeboot/* /var/lib/tftpboot/rocky-8-x86_64 % mkdir -p /var/www/html/os/rocky/8/x86_64 % rsync -vrlptDSH --delete /mnt/ /var/www/html/os/rocky/8/x86_64 % umount /mnt ## Rocky 9 % mount -o loop Rocky-9-latest-x86_64-dvd.iso /mnt % mkdir /var/lib/tftpboot/rocky-9-x86_64 % cp /mnt/images/pxeboot/* /var/lib/tftpboot/rocky-9-x86_64 % mkdir -p /var/www/html/os/rocky/9/x86_64 % rsync -vrlptDSH --delete /mnt/ /var/www/html/os/rocky/9/x86_64 % umount /mnt % restorecon -R /var/www/html/os/rocky At this point, we'll need to setup the grub menus. We'll setup non-kickstart examples for BIOS and UEFI. . . . # Rocky 8 menuentry 'Install Rocky Linux 8 (No KS) (UEFI)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 8 kernel...\" linuxefi rocky-8-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/8/x86_64 inst.stage2=http://10.100.0.1/os/rocky/8/x86_64 ip=dhcp initrdefi rocky-8-x86_64/initrd.img } menuentry 'Install Rocky Linux 8 (No KS) (BIOS)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 8 kernel...\" linux16 rocky-8-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/8/x86_64 inst.stage2=http://10.100.0.1/os/rocky/8/x86_64 ip=dhcp initrd16 rocky-8-x86_64/initrd.img } # if you are setting up arm... menuentry 'Install Rocky Linux 8 (No KS) (aarch64)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 8 kernel...\" linux rocky-9-aarch64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/8/aarch64 inst.stage2=http://10.100.0.1/os/rocky/8/aarch64 ip=dhcp initrd rocky-9-aarch64/initrd.img } . . . # Rocky 9 menuentry 'Install Rocky Linux 9 (No KS) (UEFI)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 9 kernel...\" linuxefi rocky-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/9/x86_64 inst.stage2=http://10.100.0.1/os/rocky/9/x86_64 ip=dhcp initrdefi rocky-9-x86_64/initrd.img } menuentry 'Install Rocky Linux 9 (No KS) (BIOS)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 9 kernel...\" linux16 rocky-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/9/x86_64 inst.stage2=http://10.100.0.1/os/rocky/9/x86_64 ip=dhcp initrd16 rocky-9-x86_64/initrd.img } # if you are setting up arm... menuentry 'Install Rocky Linux 9 (No KS) (aarch64)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading Rocky Linux 9 kernel...\" linux rocky-9-aarch64/vmlinuz inst.repo=http://10.100.0.1/os/rocky/9/aarch64 inst.stage2=http://10.100.0.1/os/rocky/9/aarch64 ip=dhcp initrd rocky-9-aarch64/initrd.img } The Rocky Linuxinstallation should now be bootable.","title":"Rocky Linux"},{"location":"el/pxeboot/#centos-stream","text":"Much like Rocky Linux (or other derivatives), the path is the same for setting it up. Using upstream mirror path If you plan on not hosting a mirror of the base repositories, ensure that your inst.repo/inst.stage2 commands are accurate to a mirror of your choice. % cd /var/tmp # CentOS Stream 9 % wget -O CentOS-Stream-9-latest-x86_64-dvd1.iso \\ 'https://mirrors.centos.org/mirrorlist?path=/9-stream/BaseOS/x86_64/iso/CentOS-Stream-9-latest-x86_64-dvd1.iso&redirect=1&protocol=https' # Optionally, if you plan on supporting ARM... % wget -O CentOS-Stream-9-latest-aarch64-dvd1.iso \\ 'https://mirrors.centos.org/mirrorlist?path=/9-stream/BaseOS/aarch64/iso/CentOS-Stream-9-latest-aarch64-dvd1.iso&redirect=1&protocol=https' Here we'll copy the data we want into the necessary directories. Any pxeboot related images will go to /var/lib/tftpboot/rocky-X-ARCH (X being the major version, ARCH being the architecture). If we are keeping a local mirror of the DVD, we'll put it into /var/www/html/os/rocky/X/ARCH. Below is for x86_64, but the same steps can be repeated for aarch64 without any issues. Just replace x86_64 with aarch64. ## CentOS Stream 9 % mount -o loop CentOS-Stream-9-latest-x86_64-dvd1.iso /mnt % mkdir /var/lib/tftpboot/centos-9-x86_64 % cp /mnt/images/pxeboot/* /var/lib/tftpboot/centos-9-x86_64 % mkdir -p /var/www/html/os/centos/9/x86_64 % rsync -vrlptDSH --delete /mnt/ /var/www/html/os/centos/9/x86_64 % restorecon -R /var/www/html/os/centos/9 % umount /mnt} At this point, we'll need to setup the grub menus. We'll setup non-kickstart examples for BIOS and UEFI. . . . # CentOS Stream 9 menuentry 'Install CentOS Stream 9 (No KS) (UEFI)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading CentOS Stream 9 kernel...\" linuxefi centos-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/centos/9/x86_64 inst.stage2=http://10.100.0.1/os/centos/9/x86_64 ip=dhcp initrdefi centos-9-x86_64/initrd.img } menuentry 'Install CentOS Stream 9 (No KS) (BIOS)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading CentOS Stream 9 kernel...\" linux16 centos-9-x86_64/vmlinuz inst.repo=http://10.100.0.1/os/centos/9/x86_64 inst.stage2=http://10.100.0.1/os/centos/9/x86_64 ip=dhcp initrd16 centos-9-x86_64/initrd.img } # if you are setting up arm... menuentry 'Install CentOS Stream 9 (No KS) (aarch64)' --class fedora --class gnu-linux --class gnu --class os { echo \"Loading CentOS Stream 9 kernel...\" linux centos-9-aarch64/vmlinuz inst.repo=http://10.100.0.1/os/centos/9/aarch64 inst.stage2=http://10.100.0.1/os/centos/9/aarch64 ip=dhcp initrd centos-9-aarch64/initrd.img } The CentOS Stream installation should now be bootable.","title":"CentOS Stream"},{"location":"el/pxeboot/#fedora","text":"Let's put up a regular installer with no kickstart for Fedora. This does not involve pulling down any ISO's and will rely entirely on using upstream repositories. % cd /var/lib/tftpboot % mkdir fedora-x86_64 % cd fedora-x86_64 # Replace XX with the current fedora version % wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/x86_64/os/images/pxeboot/initrd.img % wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/x86_64/os/images/pxeboot/vmlinuz # If you want arm systems... aarch64 % cd .. % mkdir fedora-aarch64 # Replace XX with the current fedora version % wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/aarch64/os/images/pxeboot/initrd.img % wget https://dl.fedoraproject.org/pub/fedora/linux/releases/XX/Everything/aarch64/os/images/pxeboot/vmlinuz Now we can add a couple menu entry items for Fedora. I'm making both EFI and Classic entries to ensure we can boot both EFI and BIOS systems from the same menu. . . . menuentry 'Install Fedora Linux (EFI)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (Classic)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } # Add the below for ARM systems menuentry 'Install Fedora Linux (ARM)' --class fedora --class gnu-linux --class gnu --class os { linux fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ ip=dhcp initrd fedora-aarch64/initrd.img } Now the Fedora installation should be bootable.","title":"Fedora"},{"location":"el/pxeboot/#customizing-grub","text":"Grub is customizable. It is possible to setup background images, choose menu colors, setup themes, and so on.","title":"Customizing Grub"},{"location":"el/pxeboot/#colors-and-backgrounds","text":"Colors and backgrounds are perfectly possible, even in an EFI setup. We'll need to load a few modules and then set the colors and background we want. Note that if you're using a background, it should live in /var/lib/tftpboot to make things easier. . . . insmod all_video insmod gfxterm insmod gfxterm_menu insmod gfxmenu insmod gfxterm_background insmod png terminal_output gfxterm background_image -m stretch /bg.png set menu_color_highlight=cyan/black set menu_color_normal=white/black set color_normal=white/black . . . The background would be /var/lib/tftpboot/bg.png in this example. Selected items will appear to be cyan and the typical gray selection box is now transparent, which is done by setting it to black. Everything else should appear as white text with a transparent background. Example below.","title":"Colors and Backgrounds"},{"location":"el/pxeboot/#special-submenus","text":"Submenus are easily created using submenu in the grub configuration. For example: submenu 'Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black menuentry 'Install Fedora Linux (EFI)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (Classic)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (ARM)' --class fedora --class gnu-linux --class gnu --class os { linux fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ ip=dhcp initrd fedora-aarch64/initrd.img } } This now means \"Fedora Linux\" will show up as a menu option and it will take you to a brand new menu with the two listed items, and another color scheme. Note that we created color items because submenus will reset the theme options. Example of how it looks is below. It is also possible to place everything into separate source-able files. Note that when you do this, you will need to symlink those files just like you did with grub.cfg. submenu 'Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black source fedora.cfg } menuentry 'Install Fedora Linux (EFI)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (Classic)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux (ARM)' --class fedora --class gnu-linux --class gnu --class os { linux fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os/ ip=dhcp initrd fedora-aarch64/initrd.img } Submenus can be nested too. Here's a deeper, working example of my own setup using Fedora 35. # grub.cfg set default=0 set timeout=60 insmod all_video insmod gfxterm insmod gfxterm_menu insmod gfxmenu insmod gfxterm_background insmod png terminal_output gfxterm loadfont /unicode.pf2 background_image -m stretch /bg.png set menu_color_highlight=cyan/black set menu_color_normal=white/black set color_normal=white/black submenu 'Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black source fedora.cfg } menuentry 'EFI System Setup' $menuentry_id_option 'uefi-firmware' { fwsetup } menuentry 'Reboot' { reboot } menuentry 'Shutdown' { halt } # fedora.cfg submenu 'Fedora Linux (latest stable)' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black # EFI Only submenu 'EFI Mode' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black menuentry 'Install Fedora Linux (No KS)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os ip=dhcp initrdefi fedora-x86_64/initrd.img } menuentry 'Fedora Linux (Rescue Mode)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-x86_64/vmlinuz inst.rescue inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os initrdefi fedora-x86_64/initrd.img } } # Classic Only submenu 'Classic Mode' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black menuentry 'Install Fedora Linux (No KS)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } menuentry 'Install Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ ip=dhcp initrd16 fedora-x86_64/initrd.img } menuentry 'Fedora Linux (Rescue Mode)' --class fedora --class gnu-linux --class gnu --class os { linux16 fedora-x86_64/vmlinuz inst.rescue inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/x86_64/os/ initrd16 fedora-x86_64/initrd.img } } # EFI mode for ARM submenu 'EFI Mode (aarch64)' --class fedora --class gnu-linux --class gnu --class os { set menu_color_highlight=black/light-cyan set menu_color_normal=white/black set color_normal=white/black menuentry 'Install Fedora Linux (No KS)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os ip=dhcp initrdefi fedora-aarch64/initrd.img } menuentry 'Install Fedora Linux' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-aarch64/vmlinuz inst.repo=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os ip=dhcp initrdefi fedora-aarch64/initrd.img } menuentry 'Fedora Linux (Rescue Mode)' --class fedora --class gnu-linux --class gnu --class os { linuxefi fedora-aarch64/vmlinuz inst.rescue inst.stage2=http://dl.fedoraproject.org/pub/fedora/linux/releases/39/Everything/aarch64/os initrdefi fedora-aarch64/initrd.img } } }","title":"Special Submenus"},{"location":"el/sysadmin/","text":"This write up provides steps on the System Administrator experience. This is not an end-all, be-all, and has many variables to keep in mind. But can provide a baseline for you. Please keep in mind, this is for Red Hat based distributions, mainly Enterprise Linux 8 and 9. CentOS Stream works within reason. Also note that it will be recommended that you do things in ansible. The RHCE for RHEL 9 will require you to be able to use ansible. As such, we will be focusing on RHEL 9. Recommendations \u00b6 Note Software Replacements Postgresql can be replaced with MySQL/MariaDB Use Katello/Foreman, straight Pulp, or Uyuni You can use any hypervisor other than KVM if you wish, with specific caveats nagios can be replaced with icinga You can replace firewalld with the regular nftables service. This may be required for your virtual host Note General Notes It's recommended to use colored vim syntax. Root doesn't use vim when vim-enhanced is installed. You can make an alias for vi to run vim (not recommended). Turn on syntaxing in ~/.vimrc with syntax on Make the vim colors brighter in ~/.vimrc with set background=dark Export your EDITOR variable in ~/.bash_profile with export EDITOR=vim Keep selinux set to enforcing Note Hardware Requirements RAM - Minimum: 32GB, Recommended: 64GB CPU - Minimum: Intel or AMD Quad Core, Recommended: 8 Core with HyperThreading Storage - Minimum: 4TB, Recommended: 8TB Network - minium 1gb link recommended Please consider on building an actual lab machine that you can do this on. Certification Completions \u00b6 Certification guidelines will be updated later. Notes and Changelog \u00b6 Note Post Experience Notes While this write up uses KVM exclusively, you may want to enhance your learning after the fact by setting up another virtualization platform on your virtual host. It may require you to redesign everything or even start over, but it is something you can consider which you like best overall. Date Changes January 07, 2024 Restructure with markdown Begin \u00b6 We'll now begin the system administrator experience. We will provide from beginning to end, what to do, without giving away what has to be done or has to be configured. This is on you to perform. At the end, there is a \"wiki\" that you create where you will have a chance to document everything you did. I recommend writing down or putting in a word document what you are doing or have done throughout so it'll make your wiki documentation much, much better. Setup a KVM Hypervisor \u00b6 Now you'll need to setup a KVM Hypervisor. You can do this on Fedora 39+ or Enterprise Linux 9. Because EL9 is a stable platform for libvirt, I recommend using going that route. If you want the latest features for the cost of some stability, Fedora will work for you. You may want to make sure your hardware supports virtualization. egrep --color 'vmx|svm' /proc/cpuinfo Recommendations and Options \u00b6 Create multiple datastores (storage pools where the VM images will sit) Example, 2x2TB means you can make two datastores, 4x1TB means you can make four. Attempt to use LVM as the backing for the store. You can create a Volume Group and have the VM's live as Logical Volumes. You can create a Volume Group and have one or more partitions to make \"more\" datastores Destroy the \"built in\" network that libvirt already provides and make your own It already makes virbr0. Make your own OR modify it to not support DHCP/DNS (eg, static only) Hints \u00b6 Most of your commands will be from the following: virsh fdisk/parted pvcreate & vgcreate mkfs To get the most performance out of your VM's disk wise, consider these options: Avoid QCOW2 Use virtio for the hardware whenever possible Set caching to \"none\" for hard disks on VM's when using raw volumes or partitions DHCP and DNS \u00b6 You'll need to setup a DHCP and DNS server. You have a few choices. Create two VM's to run DHCP for HA and create FreeIPA servers to handle DNS (two replicas, doubles as authentication for Linux/UNIX clients) Create two VM's to run DHCP for HA and create two standalone BIND servers as master/slave Use your hypervisor to host DHCP and BIND (not recommended) It would be sensible to do \"1\", if you do \"2\", you at least get more exposure to how zone files are created and the like. For ease of use, we recommend choosing option 1. Also, it is possible to allow cobbler handle DHCP and DNS or integrate directly into DNS such as making changes, but this is outside the scope of this write up. Warning Do NOT run DHCP from the FreeIPA replicas. The FreeIPA servers should have STATIC addresses set. Note When you are setting up DHCP and DNS on separate servers (such as FreeIPA replicas), the DHCP server needs to be configured to tell all the clients the true gateway (this is either a VM in on KVM or a hypervisor of your choice if you are doing straight KVM) and the DNS servers. Setup a VM or your hypervisor as the gateway to the internet. IP forwarding enabled (/etc/sysctl.conf) NAT enabled (firewalld can help you with this, check out the zones) A virtual interface (hypervisor) or a second interface for your network (as a VM) When setting up DHCP and DNS: Decide on a domain name. This can be a domain you own or one you make up internally. I personally used one of my four domains for this lab. RFC expects that internal networks have world routable domains. This is up to you. Do NOT use '.local' domains Setup DNS forwarders to ensure your VM's can get DNS requests from the internet. You create a forwarders { } block with each outside DNS IP listed in BIND or you can optionally set them in the FreeIPA interface. You can list as many as you want. With a default configuration of FreeIPA, forwarders are not strictly required. Do NOT put these extra DNS servers in your dhcpd.conf configuration You need two zones. Forward Zone: This is for your domain, name to an IP. Reverse Zone: This is for reverse IP lookups, IP to a name. FreeIPA handles this for you on setup if you state you are handling a reverse zone and what the subnet is. Bonus Points \u00b6 Setup Dynamic DNS - This requires an almost specific configuration between dhcpd and named (bind) or FreeIPA's named. Dynamic DNS needs to be aware of a domain name Use SSSD for the IPA clients to update their DNS automatically (FreeIPA only) - this may not be required if dhcpd and named are configured correctly Setup an unbound service running on port 9053 that forwards to 1.1.1.1 for encrypted DNS From this point forward, you are to ensure each of your VM's that you create have DNS entries. If you have Dynamic DNS running, you will NOT need to do any manual changes. If using FreeIPA, you may not need to make these changes. You can use nsupdate or the ipa equivalent to add additional entries as needed if you are implementing static A records or CNAME records. Server and Content Management \u00b6 At this point, you'll need to setup Foreman/Katello, Pulp, or Uyuni on a VM. I recommend using Pulp if you want something smaller and simpler. If you want something close to Red Hat Satellite , go through katello. It is a combination of pulp, candlepin, foreman. This recommendation is primarily because of Satellite 6 existing in a large amount of Red Hat shops. Katello, go here . Note Heads up You're going to be hosting repositories, I SERIOUSLY recommend creating a VM that has at least 250GB starting and going from there. Don't try to host Fedora. Katello is resource heavy, you may need to tune it. Pulp may be easier on you, resource wise. Bonus Points \u00b6 Setup errata importation for the Enterprise Linux Channels/Repositories to properly see Advisories and Information for package updates if the repos you are importing does not contain them Create custom kickstarts for your systems (this will help you out later) Kickstart examples can be found at my github . Connect Content Management to Hypervisor \u00b6 Next you will need to connect your Content Management to your hypervisor. View their documentation to get an idea of how it works. Spin Up VM's Using Katello/Spacewalk or PXE Server \u00b6 You will need to spin up two EL8 or EL9 VM's via Katello or PXE. Do not spin them up using virt-install, virt-manager, or anything else. This will require you to connect Katello to the hypervisor. Ensure they are registered properly to your content management server. If you find the clients aren't registering on Katello, click here . If you find that you do not want to use Katello to perform this task, then you can setup cobbler and work it out from there. I currently do not have a tutorial for this, but there is plenty of documentation online. There are also ansible playbooks you could look at for examples if you wanted to go that route, but it may be time consuming and something to setup at the very end. Setup FreeIPA \u00b6 Setup FreeIPA with two replicas, using CA and DNS built in configuration. This is recommended if you do not want to setup BIND by hand. FreeIPA also provides authentication to your systems without having to go through the hassle of setting up OpenLDAP by hand nor having Windows AD. FreeIPA FreeIPA Guide I recommend against setting up OpenLDAP for the case of UNIX authentication. For anything else, go for it. Once FreeIPA is available, all systems should be using FreeIPA as your DNS servers and they should all be enrolled to your domain. Spin Up Two VM's for Databases \u00b6 Create two new VM's from your Content Management or PXE system that are EL9 and install the default postgresql on them. Attempt to install and configure pgpool-II for master-master replication. Note that this may not be default in Enterprise Linux and you can safely skip this. Spin Up Configuration Management \u00b6 While Katello has some form of ansible built in, it may be better to create a solitary configuration management VM and hook it in. Spin up a VM that is EL9 and install a master for configuration management. It is HIGHLY recommended that you use ansible. Ansible is the supported and recommended system by Red Hat and is utilized in the certification exams for EL9. At some point, you could spin up a docker container for AWX if you wanted, but this is not a strict requirement. Spin Up VM for NFS/iSCSI \u00b6 This VM should be EL9. Ensure it has an extra 20GB disk attached to it. Install the following: An NFS server (nfs-utils) An iSCSI server (scsi-target-utils, targetcli) You are to: Export an NFS directory Export a LUN to any server iSCSI for RHEL 9 Deploy Bacula Server \u00b6 Bacula is a backup service. It is actually confusing to setup. It's not easy. There are plenty of write-ups for bacula and RHEL/Enterprise Linux. The digital ocean write-ups are complete, but do NOT give you everything you need to know to do it \"correct\" or to succeed completing this portion. Your server will need the following: Ensure the system has a large disk or a large second disk (this can be any size, start small though) - You can also use your NFS server or iSCSI's LUN. Ensure it is partitioned for ext4 Ensure it is mounted to /bacula If using iSCSI or NFS, ensure the disk from that server is bigger than 20GB. 50 should suffice. Bakula will need to be configured to use postgresql (digital ocean does NOT use postgresql, you will need to do some reading) Register each machine you have to it, storing to flatfile Deploy Two/Four VM's \u00b6 First one/two will be web servers running apache (httpd) Next one/two will be app servers This is a typical \"web/app\" configuration. Some shops use apache frontends to weblogic backends. Sometimes it's tomcat backends. Some shops opt for other methods and software too. If wish to setup Wildfly and host a wiki, you will need to do the following: Setup Wildfly Wiki or on your app servers Setup apache to forward requests to your tomcat servers for the wiki Do this as a VirtualHost configuration with the ServerName as \"wiki.domain.tld\", replacing \"domain.tld\" with your domain Set a ServerAlias as wiki If you wish to setup a Git Deploy Load Balancer VM \u00b6 This will be considered a \"VIP\" of sorts for your wiki and other applications. This VM can either use iptables round-robin or HAProxy. I highly recommend trying both to see what's easier for you. HAProxy is recommended, because it's an actual load balancer application. You will need the following: A DNS CNAME for this machine called \"wiki.domain.tld\", replacing domain.tld with your domain You will need to configure apache to respond to requests for \"wiki.domain.tld\" (virtual host configuration) and forward them on to the app servers HAProxy will need to forward 80 and 443 requests to the two web servers Warning Dynamic DNS If you are using Dynamic DNS, you may need to run rndc sync before making changes in the case of standalone BIND. You will want to use the nsupdate command to make changes to your Dynamic Zones. If you are using FreeIPA DNS this is not required. Deploy Postfix VM \u00b6 You will need to do the following: Ensure postfix is listening on all interfaces Ensure postfix is setup to send and receive messages only from your internal network Setup a gmail account or another relay to allow the above to work to outside mail (this is sort of tricky for gmail, but doable) Bonus Points \u00b6 Create two relays as \"mailhost1\" and \"mailhost2\" for your domain with the same configurations Create a CNAME for \"mailhost.domain.tld\" for your load balancer, forwarding port 25 to both servers Optionally, you can use round-robin DNS instead of HAProxy Setup Nagios VM \u00b6 This will be a monitoring server on EL9. You will need to set it up to use snmp to monitor the communication state of every service above. This means: Is the right port open? I got the right kind of response. Filesystem Space, too full? If you are planning to use full on SNMP, all servers will need the appropriate SNMP ports open and they will need the snmpd clients installed (with a monitor snmpd account) Setup Syslog VM \u00b6 Setup this server as a syslog server. It can be EL8 or higher. Ensure that it is listening on port 514 UDP and TCP in the configuration and that those ports are open. You will need to go to your servers and setup /etc/rsyslog.conf to send ALL logs to this syslog server Optionally, setup an all inclusive logging solution, like graylog, elastic search, mongodb, fluentd. The sky is the limit here! Document Your Work \u00b6 On your new wiki, document everything you did, right now, on your new wiki. RPM Build Server \u00b6 For fun, you can setup a new server that is your designated RPM building machine. You will need to install mock to do this. Optionally, you can setup koji, bodhi, the things that the Fedora project uses. This is not for the faint of heart. Git Server \u00b6 Also for fun, you can setup a git server. There are many options out there. A popular opensource one is Gitea . Ansible \u00b6 Consider setting up ansible and the open source tower. Automate everything via ansible.","title":"The System Administrator Experience"},{"location":"el/sysadmin/#recommendations","text":"Note Software Replacements Postgresql can be replaced with MySQL/MariaDB Use Katello/Foreman, straight Pulp, or Uyuni You can use any hypervisor other than KVM if you wish, with specific caveats nagios can be replaced with icinga You can replace firewalld with the regular nftables service. This may be required for your virtual host Note General Notes It's recommended to use colored vim syntax. Root doesn't use vim when vim-enhanced is installed. You can make an alias for vi to run vim (not recommended). Turn on syntaxing in ~/.vimrc with syntax on Make the vim colors brighter in ~/.vimrc with set background=dark Export your EDITOR variable in ~/.bash_profile with export EDITOR=vim Keep selinux set to enforcing Note Hardware Requirements RAM - Minimum: 32GB, Recommended: 64GB CPU - Minimum: Intel or AMD Quad Core, Recommended: 8 Core with HyperThreading Storage - Minimum: 4TB, Recommended: 8TB Network - minium 1gb link recommended Please consider on building an actual lab machine that you can do this on.","title":"Recommendations"},{"location":"el/sysadmin/#certification-completions","text":"Certification guidelines will be updated later.","title":"Certification Completions"},{"location":"el/sysadmin/#notes-and-changelog","text":"Note Post Experience Notes While this write up uses KVM exclusively, you may want to enhance your learning after the fact by setting up another virtualization platform on your virtual host. It may require you to redesign everything or even start over, but it is something you can consider which you like best overall. Date Changes January 07, 2024 Restructure with markdown","title":"Notes and Changelog"},{"location":"el/sysadmin/#begin","text":"We'll now begin the system administrator experience. We will provide from beginning to end, what to do, without giving away what has to be done or has to be configured. This is on you to perform. At the end, there is a \"wiki\" that you create where you will have a chance to document everything you did. I recommend writing down or putting in a word document what you are doing or have done throughout so it'll make your wiki documentation much, much better.","title":"Begin"},{"location":"el/sysadmin/#setup-a-kvm-hypervisor","text":"Now you'll need to setup a KVM Hypervisor. You can do this on Fedora 39+ or Enterprise Linux 9. Because EL9 is a stable platform for libvirt, I recommend using going that route. If you want the latest features for the cost of some stability, Fedora will work for you. You may want to make sure your hardware supports virtualization. egrep --color 'vmx|svm' /proc/cpuinfo","title":"Setup a KVM Hypervisor"},{"location":"el/sysadmin/#recommendations-and-options","text":"Create multiple datastores (storage pools where the VM images will sit) Example, 2x2TB means you can make two datastores, 4x1TB means you can make four. Attempt to use LVM as the backing for the store. You can create a Volume Group and have the VM's live as Logical Volumes. You can create a Volume Group and have one or more partitions to make \"more\" datastores Destroy the \"built in\" network that libvirt already provides and make your own It already makes virbr0. Make your own OR modify it to not support DHCP/DNS (eg, static only)","title":"Recommendations and Options"},{"location":"el/sysadmin/#hints","text":"Most of your commands will be from the following: virsh fdisk/parted pvcreate & vgcreate mkfs To get the most performance out of your VM's disk wise, consider these options: Avoid QCOW2 Use virtio for the hardware whenever possible Set caching to \"none\" for hard disks on VM's when using raw volumes or partitions","title":"Hints"},{"location":"el/sysadmin/#dhcp-and-dns","text":"You'll need to setup a DHCP and DNS server. You have a few choices. Create two VM's to run DHCP for HA and create FreeIPA servers to handle DNS (two replicas, doubles as authentication for Linux/UNIX clients) Create two VM's to run DHCP for HA and create two standalone BIND servers as master/slave Use your hypervisor to host DHCP and BIND (not recommended) It would be sensible to do \"1\", if you do \"2\", you at least get more exposure to how zone files are created and the like. For ease of use, we recommend choosing option 1. Also, it is possible to allow cobbler handle DHCP and DNS or integrate directly into DNS such as making changes, but this is outside the scope of this write up. Warning Do NOT run DHCP from the FreeIPA replicas. The FreeIPA servers should have STATIC addresses set. Note When you are setting up DHCP and DNS on separate servers (such as FreeIPA replicas), the DHCP server needs to be configured to tell all the clients the true gateway (this is either a VM in on KVM or a hypervisor of your choice if you are doing straight KVM) and the DNS servers. Setup a VM or your hypervisor as the gateway to the internet. IP forwarding enabled (/etc/sysctl.conf) NAT enabled (firewalld can help you with this, check out the zones) A virtual interface (hypervisor) or a second interface for your network (as a VM) When setting up DHCP and DNS: Decide on a domain name. This can be a domain you own or one you make up internally. I personally used one of my four domains for this lab. RFC expects that internal networks have world routable domains. This is up to you. Do NOT use '.local' domains Setup DNS forwarders to ensure your VM's can get DNS requests from the internet. You create a forwarders { } block with each outside DNS IP listed in BIND or you can optionally set them in the FreeIPA interface. You can list as many as you want. With a default configuration of FreeIPA, forwarders are not strictly required. Do NOT put these extra DNS servers in your dhcpd.conf configuration You need two zones. Forward Zone: This is for your domain, name to an IP. Reverse Zone: This is for reverse IP lookups, IP to a name. FreeIPA handles this for you on setup if you state you are handling a reverse zone and what the subnet is.","title":"DHCP and DNS"},{"location":"el/sysadmin/#bonus-points","text":"Setup Dynamic DNS - This requires an almost specific configuration between dhcpd and named (bind) or FreeIPA's named. Dynamic DNS needs to be aware of a domain name Use SSSD for the IPA clients to update their DNS automatically (FreeIPA only) - this may not be required if dhcpd and named are configured correctly Setup an unbound service running on port 9053 that forwards to 1.1.1.1 for encrypted DNS From this point forward, you are to ensure each of your VM's that you create have DNS entries. If you have Dynamic DNS running, you will NOT need to do any manual changes. If using FreeIPA, you may not need to make these changes. You can use nsupdate or the ipa equivalent to add additional entries as needed if you are implementing static A records or CNAME records.","title":"Bonus Points"},{"location":"el/sysadmin/#server-and-content-management","text":"At this point, you'll need to setup Foreman/Katello, Pulp, or Uyuni on a VM. I recommend using Pulp if you want something smaller and simpler. If you want something close to Red Hat Satellite , go through katello. It is a combination of pulp, candlepin, foreman. This recommendation is primarily because of Satellite 6 existing in a large amount of Red Hat shops. Katello, go here . Note Heads up You're going to be hosting repositories, I SERIOUSLY recommend creating a VM that has at least 250GB starting and going from there. Don't try to host Fedora. Katello is resource heavy, you may need to tune it. Pulp may be easier on you, resource wise.","title":"Server and Content Management"},{"location":"el/sysadmin/#bonus-points_1","text":"Setup errata importation for the Enterprise Linux Channels/Repositories to properly see Advisories and Information for package updates if the repos you are importing does not contain them Create custom kickstarts for your systems (this will help you out later) Kickstart examples can be found at my github .","title":"Bonus Points"},{"location":"el/sysadmin/#connect-content-management-to-hypervisor","text":"Next you will need to connect your Content Management to your hypervisor. View their documentation to get an idea of how it works.","title":"Connect Content Management to Hypervisor"},{"location":"el/sysadmin/#spin-up-vms-using-katellospacewalk-or-pxe-server","text":"You will need to spin up two EL8 or EL9 VM's via Katello or PXE. Do not spin them up using virt-install, virt-manager, or anything else. This will require you to connect Katello to the hypervisor. Ensure they are registered properly to your content management server. If you find the clients aren't registering on Katello, click here . If you find that you do not want to use Katello to perform this task, then you can setup cobbler and work it out from there. I currently do not have a tutorial for this, but there is plenty of documentation online. There are also ansible playbooks you could look at for examples if you wanted to go that route, but it may be time consuming and something to setup at the very end.","title":"Spin Up VM's Using Katello/Spacewalk or PXE Server"},{"location":"el/sysadmin/#setup-freeipa","text":"Setup FreeIPA with two replicas, using CA and DNS built in configuration. This is recommended if you do not want to setup BIND by hand. FreeIPA also provides authentication to your systems without having to go through the hassle of setting up OpenLDAP by hand nor having Windows AD. FreeIPA FreeIPA Guide I recommend against setting up OpenLDAP for the case of UNIX authentication. For anything else, go for it. Once FreeIPA is available, all systems should be using FreeIPA as your DNS servers and they should all be enrolled to your domain.","title":"Setup FreeIPA"},{"location":"el/sysadmin/#spin-up-two-vms-for-databases","text":"Create two new VM's from your Content Management or PXE system that are EL9 and install the default postgresql on them. Attempt to install and configure pgpool-II for master-master replication. Note that this may not be default in Enterprise Linux and you can safely skip this.","title":"Spin Up Two VM's for Databases"},{"location":"el/sysadmin/#spin-up-configuration-management","text":"While Katello has some form of ansible built in, it may be better to create a solitary configuration management VM and hook it in. Spin up a VM that is EL9 and install a master for configuration management. It is HIGHLY recommended that you use ansible. Ansible is the supported and recommended system by Red Hat and is utilized in the certification exams for EL9. At some point, you could spin up a docker container for AWX if you wanted, but this is not a strict requirement.","title":"Spin Up Configuration Management"},{"location":"el/sysadmin/#spin-up-vm-for-nfsiscsi","text":"This VM should be EL9. Ensure it has an extra 20GB disk attached to it. Install the following: An NFS server (nfs-utils) An iSCSI server (scsi-target-utils, targetcli) You are to: Export an NFS directory Export a LUN to any server iSCSI for RHEL 9","title":"Spin Up VM for NFS/iSCSI"},{"location":"el/sysadmin/#deploy-bacula-server","text":"Bacula is a backup service. It is actually confusing to setup. It's not easy. There are plenty of write-ups for bacula and RHEL/Enterprise Linux. The digital ocean write-ups are complete, but do NOT give you everything you need to know to do it \"correct\" or to succeed completing this portion. Your server will need the following: Ensure the system has a large disk or a large second disk (this can be any size, start small though) - You can also use your NFS server or iSCSI's LUN. Ensure it is partitioned for ext4 Ensure it is mounted to /bacula If using iSCSI or NFS, ensure the disk from that server is bigger than 20GB. 50 should suffice. Bakula will need to be configured to use postgresql (digital ocean does NOT use postgresql, you will need to do some reading) Register each machine you have to it, storing to flatfile","title":"Deploy Bacula Server"},{"location":"el/sysadmin/#deploy-twofour-vms","text":"First one/two will be web servers running apache (httpd) Next one/two will be app servers This is a typical \"web/app\" configuration. Some shops use apache frontends to weblogic backends. Sometimes it's tomcat backends. Some shops opt for other methods and software too. If wish to setup Wildfly and host a wiki, you will need to do the following: Setup Wildfly Wiki or on your app servers Setup apache to forward requests to your tomcat servers for the wiki Do this as a VirtualHost configuration with the ServerName as \"wiki.domain.tld\", replacing \"domain.tld\" with your domain Set a ServerAlias as wiki If you wish to setup a Git","title":"Deploy Two/Four VM's"},{"location":"el/sysadmin/#deploy-load-balancer-vm","text":"This will be considered a \"VIP\" of sorts for your wiki and other applications. This VM can either use iptables round-robin or HAProxy. I highly recommend trying both to see what's easier for you. HAProxy is recommended, because it's an actual load balancer application. You will need the following: A DNS CNAME for this machine called \"wiki.domain.tld\", replacing domain.tld with your domain You will need to configure apache to respond to requests for \"wiki.domain.tld\" (virtual host configuration) and forward them on to the app servers HAProxy will need to forward 80 and 443 requests to the two web servers Warning Dynamic DNS If you are using Dynamic DNS, you may need to run rndc sync before making changes in the case of standalone BIND. You will want to use the nsupdate command to make changes to your Dynamic Zones. If you are using FreeIPA DNS this is not required.","title":"Deploy Load Balancer VM"},{"location":"el/sysadmin/#deploy-postfix-vm","text":"You will need to do the following: Ensure postfix is listening on all interfaces Ensure postfix is setup to send and receive messages only from your internal network Setup a gmail account or another relay to allow the above to work to outside mail (this is sort of tricky for gmail, but doable)","title":"Deploy Postfix VM"},{"location":"el/sysadmin/#bonus-points_2","text":"Create two relays as \"mailhost1\" and \"mailhost2\" for your domain with the same configurations Create a CNAME for \"mailhost.domain.tld\" for your load balancer, forwarding port 25 to both servers Optionally, you can use round-robin DNS instead of HAProxy","title":"Bonus Points"},{"location":"el/sysadmin/#setup-nagios-vm","text":"This will be a monitoring server on EL9. You will need to set it up to use snmp to monitor the communication state of every service above. This means: Is the right port open? I got the right kind of response. Filesystem Space, too full? If you are planning to use full on SNMP, all servers will need the appropriate SNMP ports open and they will need the snmpd clients installed (with a monitor snmpd account)","title":"Setup Nagios VM"},{"location":"el/sysadmin/#setup-syslog-vm","text":"Setup this server as a syslog server. It can be EL8 or higher. Ensure that it is listening on port 514 UDP and TCP in the configuration and that those ports are open. You will need to go to your servers and setup /etc/rsyslog.conf to send ALL logs to this syslog server Optionally, setup an all inclusive logging solution, like graylog, elastic search, mongodb, fluentd. The sky is the limit here!","title":"Setup Syslog VM"},{"location":"el/sysadmin/#document-your-work","text":"On your new wiki, document everything you did, right now, on your new wiki.","title":"Document Your Work"},{"location":"el/sysadmin/#rpm-build-server","text":"For fun, you can setup a new server that is your designated RPM building machine. You will need to install mock to do this. Optionally, you can setup koji, bodhi, the things that the Fedora project uses. This is not for the faint of heart.","title":"RPM Build Server"},{"location":"el/sysadmin/#git-server","text":"Also for fun, you can setup a git server. There are many options out there. A popular opensource one is Gitea .","title":"Git Server"},{"location":"el/sysadmin/#ansible","text":"Consider setting up ansible and the open source tower. Automate everything via ansible.","title":"Ansible"},{"location":"el/unbound/","text":"Requirements \u00b6 Setup \u00b6 Installation \u00b6 % yum install unbound -y % systemctl enable unbound DNS over TLS (DoT) \u00b6 Setting up DoT with unbound is straight forward, whether you already have a DNS server already or not. Let's go over the most basic configuration. % vi /etc/unbound/unbound.conf server: . . . # Set the below to an IP address if you wish - as I have multiple VLAN's # it is just easier for me to listen everywhere interface: 0.0.0.0 interface: :: # Optionally set a port - I have bind already running, so port 9053 works interface-automatic: no port: 9053 . . . # Set access control rules here. I'll show a few examples with just two of # my networks # REFUSE everything access-control: 0.0.0.0/0 refuse access-control: ::0/0 refuse # Allow localhost to snoop access-control: 127.0.0.1/32 allow_snoop access-control: ::1 allow_snoop # Allow the entire localhost subnet access-control: 127.0.0.0/8 allow access-control: ::ffff:127.0.0.1 allow # Allow my main network and sandbox network access-control: 10.100.0.0/24 allow access-control: 10.100.1.0/24 allow . . . # Ensure tls-cert-bundle is set tls-cert-bundle: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem . . . # Create the forward zone for DoT queries forward-zone: name: \".\" forward-tls-upstream: yes # Cloudflare forward-addr: 1.1.1.1@853#cloudflare-dns.com forward-addr: 1.0.0.1@853#cloudflare-dns.com forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com # Quad9 forward-addr: 9.9.9.9@853#dns.quad9.net forward-addr: 149.112.112.112@853#dns.quad9.net % systemctl enable unbound --now # If you are using bind already with forwarders, you should edit it. Example. % vi /etc/named.conf options { . . . forwarders { # This assumes your bind server and unbound server are on # the same server like I did. 127.0.0.1 port 9053; }; forward only; . . .","title":"Unbound"},{"location":"el/unbound/#requirements","text":"","title":"Requirements"},{"location":"el/unbound/#setup","text":"","title":"Setup"},{"location":"el/unbound/#installation","text":"% yum install unbound -y % systemctl enable unbound","title":"Installation"},{"location":"el/unbound/#dns-over-tls-dot","text":"Setting up DoT with unbound is straight forward, whether you already have a DNS server already or not. Let's go over the most basic configuration. % vi /etc/unbound/unbound.conf server: . . . # Set the below to an IP address if you wish - as I have multiple VLAN's # it is just easier for me to listen everywhere interface: 0.0.0.0 interface: :: # Optionally set a port - I have bind already running, so port 9053 works interface-automatic: no port: 9053 . . . # Set access control rules here. I'll show a few examples with just two of # my networks # REFUSE everything access-control: 0.0.0.0/0 refuse access-control: ::0/0 refuse # Allow localhost to snoop access-control: 127.0.0.1/32 allow_snoop access-control: ::1 allow_snoop # Allow the entire localhost subnet access-control: 127.0.0.0/8 allow access-control: ::ffff:127.0.0.1 allow # Allow my main network and sandbox network access-control: 10.100.0.0/24 allow access-control: 10.100.1.0/24 allow . . . # Ensure tls-cert-bundle is set tls-cert-bundle: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem . . . # Create the forward zone for DoT queries forward-zone: name: \".\" forward-tls-upstream: yes # Cloudflare forward-addr: 1.1.1.1@853#cloudflare-dns.com forward-addr: 1.0.0.1@853#cloudflare-dns.com forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com # Quad9 forward-addr: 9.9.9.9@853#dns.quad9.net forward-addr: 149.112.112.112@853#dns.quad9.net % systemctl enable unbound --now # If you are using bind already with forwarders, you should edit it. Example. % vi /etc/named.conf options { . . . forwarders { # This assumes your bind server and unbound server are on # the same server like I did. 127.0.0.1 port 9053; }; forward only; . . .","title":"DNS over TLS (DoT)"},{"location":"training/ex362/","text":"This page contains the necessary resources to help you prepare for the Red Hat Certified Specialist in Identity Management exam, EX362. This follows the youtube playlist as much as possible with various examples and ideas. Soon to come, you will also find our own example practice exam for you to try your hand at to test your knowledge. The list of objectives can be found here . Note that the exam objectives can change at any time. It is the responsibility of the reader to always review the objectives prior to studying and taking the exam to ensure success. Note Affiliation and Exam Information Please note that we are not affiliated with Red Hat. The materials and examples used are our own and do not reflect the training programs provided by Red Hat and are educational only. We do not disclose any of the tasks, questions, or material on the exam as it would violate the NDA. Any questions sent to us about anything directly related to the exam will not be answered. We also do not provide any one-on-one tutoring or online teaching courses. If exam objectives have changed to where the videos and this material are missing information, we can add on at any time upon request. If exam objectives have not changed but operational tasks have, we will note them as we find them. If there are things about FreeIPA that you'd like to see in the videos that may fit into objective, we can add it also upon request. However, it is likely those extra things would be better suited in the separate FreeIPA section on this site. Overview \u00b6 The video series goes over setting up FreeIPA in a lab/VM environment by following the objectives as outlined by Red Hat. The list of objectives can be found here . Exam Information \u00b6 The EX362 exam tests your knowledge in a real world format style test - Meaning just like any Red Hat exam, it is performance-based and you perform tasks as if you were on the job. You are evaluated on the tasks you perform and if they meet the objective criteria. The EX362 is related to FreeIPA or Red Hat Identity Management and counts toward the RHCA (Red Hat Certified Architect). To take the exam, you must have at least an RHCSA. If you are attempting to become a Red Hat Certified Architect, you must have an RHCE. Resources \u00b6 FreeIPA Red Hat Documentation Trust Anatomy/SSSD Troubleshooting Directory Server Tuning FreeIPA Workshop Curriculum Our Page Hardware Recommendations \u00b6 The minimum requirements for IdM are fairly low. 2GB of RAM, 1 core, and a 10GB disk. However, we believe that's too low, especially if we plan on scaling out. And during upgrades, you would need at least 4GB of RAM for the operations to be successful. Below are our minimum recommendations: 2 (virtual) CPU Core 4 GB of RAM 10GB+ disk or partition for /var/lib/dirsrv Per the Red Hat documentation, consider that with at least 10k users and 100 groups, you would need at least 3GB of RAM and 1GB swap. If you end up having 100k users and 50k groups, then 16GB of RAM and 4GB of swap is recommended. In fact, in larger deployments, it's more effective to increase RAM than disk, as most data is stored in cache. View the resources above in the previous section for directory server tuning information. IdM Server Installation and Configuration \u00b6 Install IdM in a scalable, fault tolerant environment \u00b6 Server Name IP Address idm1.example.com 192.168.15.2 idm2.example.com 192.168.15.3 !!! note:: IPA Servers should either have a DHCP reservation or a static address. In the event that you have either, DNS should always be pointing at 127.0.0.1, especially if your replica serves DNS. Both of our replicas serve DNS, so loopback is sufficient and recommended for our name server. In later versions of FreeIPA, there is support to force network manager to ensure resolv.conf is loopback without the need to set it by hand with nmcli. # Set a static address - It's important for your IdM servers # to have static addresses or a DHCP reservation. % nmcli con mod eth0 ipv4.address 192.168.15.2/24 % nmcli con mod eth0 ipv4.gateway 192.168.15.1 % nmcli con mod eth0 ipv4.method manual % nmcli con mod eth0 ipv4.dns-search example.com # You should set this if your replica serves DNS! If not, set it to # one or more of your IdM replicas that do. % nmcli con mod eth0 ipv4.dns 127.0.0.1 % nmcli con up eth0 # Examples of using ipa-server-install # RHEL 9 % yum install ipa-server ipa-server-dns ipa-client sssd sssd-ipa # Installation, interactive, does not setup specific components % ipa-server-install # Installation, mostly automatic (recommended) # This will setup DNS and the necessary pieces for an AD trust # Optionally, you can use the --netbios-name switch to set your forest netbios name % ipa-server-install --domain example.com --realm EXAMPLE.COM \\ --reverse-zone=15.168.192.in-addr.arpa. \\ --no-forwarders \\ --no-ntp \\ --setup-dns \\ --setup-adtrust \\ -p Passw0rd! \\ -a Passw0rd! # Configure the firewall for RHEL 7 % firewall-cmd --permanent --add-service={ntp,http,https,freeipa-ldap,freeipa-ldaps,kerberos,freeipa-replication,kpasswd,dns} # RHEL 8 % firewall-cmd --permanent --add-service={freeipa-4,ntp,dns} % kinit admin # We need to make sure that any A records get a corresponding PTR record, otherwise you're making them manually. % ipa dnsconfig-mod --allow-sync-ptr=True # Adding a replica % ipa-replica-install --setup-dns \\ --setup-ca \\ --no-forwarders # Adding a replica unattended without forwarders % ipa-client-install --realm EXAMPLE.COM % kinit admin % ipa hostgroup-add-member --hosts=ipa02.example.com ipaservers % ipa-replica-install --setup-dns \\ --setup-ca \\ --no-forwarders \\ --unattended Creating Users, Groups, and Policies \u00b6 Users Login Name Type Group Role UID/GID John Smith jsmith Normal admins Auto Bob Rufus brufus Normal corp Auto Larry Dufus ldufus Normal helpdesk Auto Robert Cole rcole Staged Auto Thomas Snyder tsnyder Preserved Auto SysHost Management syshostmgt Normal Host Manager 10000 Groups Policy HelpDesk helpdesk corp enrollers Enrollment Administrator Roles Privilege Host Manager Host administrators Host group administrators Netgroups administrators Host enrollment Note Custom UID/GID It is possible to create the users with a custom uid/gid with the switches --uid and --gidnumber which you will see below. It is also possible to set random passwords with --random. See ipa user-add --help for more switches. Note Password Expiration When you make a user with the --password switch or use ipa passwd to set a password, it is automatically expired and must be changed on next login. If you want to avoid this from happening, you will need to set a random password via --password or --random, and then use kpasswd username to change it to the desired password. This does not make the account non-expiring. # Creating users with a password, create all the accounts from the table (except from syshost) % ipa user-add --first=\"John\" --last=\"Smith\" --password jsmith # Create the system account with a password of Sup3R$ecre7! and a UID of 10000 % ipa user-add --first=\"SysHost\" --last=\"Management\" --uid=10000 --gidnumber=10000 --password syshostmgt # Stage a user % ipa stageuser-add --first=\"Robert\" --last=\"Cole\" rcole # Preserve a user % ipa user-del tsynder --preserve # Create a regular (POSIX) group % ipa group-add corp # Create a member only group % ipa group-add --nonposix HelpDesk % ipa group-add --nonposix enrollers # Add the HelpDesk group to the helpdesk policy # Add the enrollers group to the Enrollment Administrator role % ipa role-add-member \"helpdesk\" --groups=HelpDesk % ipa role-add-member \"Enrollment Administrator\" --groups=enrollers # Create a role with privileges % ipa role-add \"Host Manager\" % ipa role-add-privilege \"Host Manager\" \\ --privileges=\"Host administrators\" \\ --privileges=\"Host group administrators\" \\ --privileges=\"Netgroups administrators\" \\ --privileges=\"Host enrollment\" # Add the syshostmgt user as a member of the role % ipa role-add-member \"Host Manager\" --users=\"syshostmgt\" # Set our user passwords to CentOS123!$ so that way we don't have to change them later % kpasswd jsmith # If we already set the password we want but we don't want it to expire without making a policy or prompt for a password change (NOT RECOMMENDED) % ldapmodify -x -w 'Passw0rd!' -D 'cn=Directory Manager' dn: uid=syshostmgt,cn=users,cn=accounts,dc=example,dc=com changetype: modify delete: krbLastPwdChange (Press CTRL+D) New Passwords Expired \u00b6 The common question we receive (and even the #freeipa IRC receive) is \"Why can't we just set the password to not be expired right away?\" See this page for information on why this is. You may also look at the pagure page and the Red Hat bugzilla related bug . Implement a SSO \u00b6 To setup a very, very simple SSO, you can setup a simple location that requires a login. % ipa-getkeytab -s idm1.example.com -p http/http.example.com -k /etc/httpd/conf/http.keytab % vi /etc/httpd/conf.d/location.conf AuthType Kerberos AuthName \"IPA Kerberos Auth\" # Keytab Krb5Keytab /etc/httpd/conf/http.keytab # Kerb settings KrbMethodNegotiate on KrbMethodK5Passwd on KrbServiceName HTTP KrbAuthRealms EXAMPLE.COM KrbSaveCredentials off Require valid-user IdM Client Installation and Configuration \u00b6 Install and configure IdM Clients \u00b6 Client Name IP Address client.example.com 192.168.15.10 nfs.example.com 192.168.15.11 utility.example.com 192.168.15.12 Note Depending on your architecture and setup, IdM clients should either be pointing directly at the IdM servers for DNS (at least two of them) or pointing at the DNS server in the environment that is delegating that domain to the IdM domain controllers. In our lab, our IdM servers are our only DNS servers, thus it makes sense that our clients should point to them. In that scenario, you would configure your DHCP server to use the IdM servers as the name servers and/or configure them in a static manner depending on your environment. # If your client is not pointing at the IdM DNS and you # don't have another DNS server that's performing delegation, # change your name servers. % nmcli con mod eth0 ipv4.dns 192.168.15.2 % nmcli con mod eth0 +ipv4.dns 192.168.15.3 % nmcli con mod eth0 ipv4.dns-search example.com # Optionally, if your clients don't have DHCP # reservations, set a static address. % nmcli con mod eth0 ipv4.address 192.168.15.10/24 % nmcli con mod eth0 ipv4.gateway 192.168.15.1 % nmcli con mod eth0 ipv4.method manual # It might be a good idea to set your hostname if you haven't already % hostnamectl set-hostname client.example.com % hostname client.example.com # Install the ipa-client packages % yum install ipa-client -y % ipa-client-install --realm EXAMPLE.COM --domain example.com . . . % id admin uid=686600000(admin) gid=686600000(admins) groups=686600000(admins) Configure Kerberized services \u00b6 One of the things that you may end up doing, whether by hand or in an automated fashion, is creating kerberized services. In a previous section, we addressed creating an NFS service for both a server and a client for the purpose of automating home directory mounts on a client when a user logs in. So you already have the idea of what this entails. # Create kerberos service % ipa service-add HTTP/http.example.com Not only that, it's probably a good idea to actually get the keytab. % kinit admin % ipa-getkeytab -s idm1.example.com -p HTTP/http.example.com -k /etc/krb5.keytab For an example of automating keytab creation and retrieval, see the CentOS/FreeIPA page on this site. IdM HA Configuration \u00b6 Configure and manage a certificate authority \u00b6 By default FreeIPA stands up its own CA. And because of this, this allows you or your workplace to be able to issue certificates, that can be used in a wide variety of services, the most common or obvious one would be for Apache httpd. There's a couple of ways you can get a certificate signed by FreeIPA. One method is to generate your own CSR and request it to be signed by FreeIPA. Another way is you can do it all from one command, ipa-getcert , and optionally, either have the certificate in PEM format or an NSS database. We'll address these examples. # Creating an SSL certificate in the PEM format % ipa service-add HTTP/http.example.com % ipa-getcert request -f /etc/pki/tls/certs/http.pem -k /etc/pki/tls/private/http.key -K HTTP/http.example.com -D http.example.com New signing request \"20190902000318\" added. # Verify % ipa-getcert list Number of certificates and requests being tracked: 1. Request ID '20190902000318': status: MONITORING stuck: no key pair storage: type=FILE,location='/etc/pki/tls/private/http.key' certificate: type=FILE,location='/etc/pki/tls/certs/http.pem' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=http.example.com,O=EXAMPLE.COM expires: 2021-09-02 00:03:19 UTC dns: http.example.com principal name: HTTP/http.example.com@EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes # Create an SSL certificate in the NSS format % ipa-getcert request -d /etc/pki/tls/certs/nss -n 'Test' -K HTTP/http.example.com -D http.example.com New signing request \"20190902000756\" added. # Verify % ipa-getcert list . . . Request ID '20190902000756': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/tls/certs/nss',nickname='Test',token='NSS Certificate DB' certificate: type=NSSDB,location='/etc/pki/tls/certs/nss',nickname='Test',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=http.example.com,O=EXAMPLE.COM expires: 2021-09-02 00:07:57 UTC dns: http.example.com principal name: HTTP/http.example.com@EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes By default, when a certificate request is performed (and succeeds to be signed by the IPA CA), it is typically tracked and auto-renewed by default. This is done by the certmonger service, which eliminates the need to have to renew anything by hand. Create Secret Vaults \u00b6 When a domain supports the KRA role, it can hold password vaults or anything that's considered \"secret\". You can add the KRA role by simply running on each relevant domain controller: % ipa-kra-install (more to come) IdM Users and Policies Management \u00b6 In FreeIPA, there are two sets of policies: Role Based Access Control (RBAC) which are the permissions, delegated or otherwise, that allow (or deny) access to various pieces of FreeIPA. This can be users that have the ability to reset passwords, modify groups, or perhaps they can issue keytabs. This was partially covered in a previous section. Host Based Access Control (HBAC) which are the permissions granted to a user or users to access systems on various (PAM) services, such as ssh or logging into a desktop system (eg, GDM). Configure Policies and User Access \u00b6 HBAC, or Host Based Access Controls, are permissions that grant user or users access to systems via any number of services. The services are PAM services. No doubt you have looked in /etc/pam.d before and have seen quite a few files or even modified them by hand at some point. % ls -l /etc/pam.d/ total 80 -rw-r--r--. 1 root root 272 May 11 2019 atd -rw-r--r--. 1 root root 232 Apr 15 15:28 config-util -rw-r--r--. 1 root root 328 Nov 8 2019 crond lrwxrwxrwx. 1 root root 32 Jan 14 2020 fingerprint-auth -> /etc/authselect/fingerprint-auth -rw-r--r--. 1 root root 70 Apr 24 06:35 ksu -rw-r--r--. 1 root root 715 Apr 24 05:38 login -rw-r--r--. 1 root root 154 Apr 15 15:28 other -rw-r--r--. 1 root root 168 Apr 6 20:08 passwd lrwxrwxrwx. 1 root root 29 Jan 14 2020 password-auth -> /etc/authselect/password-auth -rw-r--r--. 1 root root 155 Apr 8 22:00 polkit-1 lrwxrwxrwx. 1 root root 25 Jan 14 2020 postlogin -> /etc/authselect/postlogin -rw-r--r--. 1 root root 640 Apr 24 05:38 remote -rw-r--r--. 1 root root 143 Apr 24 05:38 runuser -rw-r--r--. 1 root root 138 Apr 24 05:38 runuser-l lrwxrwxrwx. 1 root root 30 Jan 14 2020 smartcard-auth -> /etc/authselect/smartcard-auth lrwxrwxrwx. 1 root root 25 Jun 15 10:18 smtp -> /etc/alternatives/mta-pam -rw-r--r--. 1 root root 76 Apr 6 20:11 smtp.postfix -rw-r--r--. 1 root root 727 Feb 4 2020 sshd -rw-r--r--. 1 root root 214 Apr 23 20:48 sssd-shadowutils -rw-r--r--. 1 root root 566 Apr 24 05:38 su -rw-r--r--. 1 root root 154 Apr 23 19:40 sudo -rw-r--r--. 1 root root 178 Apr 23 19:40 sudo-i -rw-r--r--. 1 root root 137 Apr 24 05:38 su-l lrwxrwxrwx. 1 root root 27 Jan 14 2020 system-auth -> /etc/authselect/system-auth -rw-r--r--. 1 root root 248 Jul 21 07:57 systemd-user -rw-r--r--. 1 root root 84 May 11 2019 vlock On a typical Red Hat system, the most common ones (such as su , sshd , sudo ) imports the system-auth file, so the login request is processed through those means. When defining HBAC rules, you either must allow \"all\" services or be selective. For example, if an HBAC rule allows \"sshd\", a user is allowed to ssh into a system, but wouldn't allow them to login locally, as that goes through login . If you want the user to be able to run the su and sudo commands, you would also need to allow those services. Otherwise, the user is denied, despite sudo policies being available. [label@mgt ~]$ sudo -i [sudo] password for label: sudo: PAM account management error: Permission denied In FreeIPA, there is typically a rule already predefined that allows everyone to access all systems and all services. This can be removed or disabled and this removes host access to everything immediately. This is typically recommended in most environments where there are security standards and procedures in place. # To disable % ipa hbacrule-disable allow_all # To delete instead % ipa hbacrule-del allow_all When performing a FreeIPA installation, it is possible to add --no-hbac-allow that will disable the allow_all rule. Below are some examples of adding access. # Allow all admins to access all systems % ipa hbacrule-add --hostcat=all --servicecat=all --desc='Allow all admins to access all systems' All_Admins % ipa hbacrule-add-user --groups=admins All_Admins # And then test... % ipa hbactest --rules=All_Admins --user=jsmith --host=client.example.com --service=login # Allow the corp users to access the client system only using the sshd pam services % ipa hbacrule-add --desc='Allow corp users to access client on ssh' corp_access % ipa hbacrule-add-user --groups=corp corp_access % ipa hbacrule-add-host --hosts=client.example.com corp_access % ipa hbacrule-add-service --hbacsvcs=sshd corp_access # And then test... % ipa hbactest --rules=corp_access --user=brufus --host=client.example.com --service=sshd Configure roaming/automounted home directories \u00b6 You will need to configure your NFS server to serve up roaming home directories for users and then your client should have automouting enabled. Note Client Kerberos Service It may not be required to create an nfs kerberos service for the client. The ipa-client-automount command may already handle this but it does not hurt to create one. In fact, the host keytab is used on the client side anyway. Creating an NFS client keytab may have been required back in the EL6 days. # IDM Steps % kinit admin % ipa service-add nfs/nfs.example.com % ipa service-add nfs/client.example.com # Setup the automounting locations % ipa automountmap-add default auto.home % ipa automountkey-add default --key \"/home\" --info auto.home auto.master % ipa automountkey-add default --key \"*\" --info \"-fstype=nfs4,rw,sec=krb5,soft nfs.example.com:/exports/home/&\" auto.home # NFS Server Steps % yum install nfs-utils -y % mkdir /exports/home % vi /etc/exports /exports/home *(rw,sec=sys:krb5:krb5i:krb5p) # Make the home directories for all users and move them to /export/home % mkhomedir_helper jsmith % mv /home/jsmith /export/home/ # Create the necessary keytabs % kinit admin % ipa-getkeytab -s idm1.example.com -p nfs/nfs.example.com -k /etc/krb5.keytab # Verify keytab % klist -ket /etc/krb5.keytab # Enable and start nfs % systemctl enable nfs-server --now # Open the necessary firewall ports % firewall-cmd --add-service=nfs --permanent % firewall-cmd --complete-reload # Client steps % kinit admin % ipa-getkeytab -s idm1.example.com -p nfs/client.example.com -k /etc/krb5.keytab % ipa-client-automount --location=default # Verify keytab % klist -ket /etc/krb5.keytab To test, login to the system via ssh or console and verify the home directory has mounted. /var/log/messages and secure will display errors in case of failure. Configure IdM as an LDAP backend for external services \u00b6 Most services and applications that authenticate users do typically have LDAP support. IdM can be used as an LDAP backend. You typically need only a few things to authenticate users from IdM to an application. Base DN, this always ends up being the top level of your domain: dc=example,dc=com - All accounts share this common base. Bind DN, this is a system account that binds to the directory to assist with searches and authentication Attribute mappings Groups, depending on the application Below is a table of common DN's you may specify in an application: DN's Path Filter (if applicable) Base DN dc=example,dc=com User DN cn=users,cn=accounts,dc=example,dc=com uid=... Group DN cn=groups,cn=accounts,dc=example,dc=com (objectClass=groupOfNames) Bind DN uid=account,cn=sysaccounts,cn=etc,dc=example,dc=com % ipa user-show admin --all | grep '^dn' dn: uid=admin,cn=users,cn=accounts,dc=example,dc=com Below is a table of common attributes that may be used to map user information in the application. Type Attribute Login Name uid First Name givenName Surname sn Email mail Groups memberOf Full Name cn Below are two ways to create a bind account (bind DN). The first way is the LDAP way. The second way is the ipa-ldap-updater. % kinit admin % ldapadd -Y GSSAPI . . . dn: uid=binder,cn=sysaccounts,cn=etc,dc=example,dc=com objectclass: account objectclass: simplesecurityobject uid: binder userPassword: password123 passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 # Press CTRL+d adding new entry \"uid=binder,cn=sysaccounts,cn=etc,dc=example,dc=com\" % kinit admin % cat << EOF > binder.update dn: uid=binder,cn=sysaccounts,cn=etc,dc=example,dc=com add:objectclass:account add:objectclass:simplesecurityobject add:uid:binder add:userPassword:password123 add:passwordExpirationTime:20380119031407Z add:nsIdleTimeout:0 EOF % ipa-ldap-updater binder.update When this account is created, you can then specify the full DN for that object into a bind DN field, along with it's password into an accompanying bind password field. If you'd like an example of setting up Ansible Tower (or AWX, the open source version of tower) against IdM, you can click here . Note Kerberos On some applications, it is possible to use kerberos authentication rather than a straight bind account. The general idea is the same when picking out the base dn, attributes, and the like. However, instead you would create an account with an accompanying LDAP/... service principal to do the authentication. Creating Trust with AD Domain \u00b6 Create trust relationships with Active Directory \u00b6 Note AD Setup We do not cover setting up an AD forest here. This is out of scope for this series. If you are using Server 2016 or higher and you are using \"core\", look up the commands: Install-WindowsFeature AD-domain-services Import-Module ADDSDeployment Install-ADDSForest Server Name IP Address ad.example.net 192.168.15.15 For our trust, the AD server will need to be configured to be the example.net domain with the hostname of ad.example.net. This way, we are not colliding in DNS and both AD and IdM should be able to communicate with each other as two separate forests. It is recommended to use Windows Server 2016 (with the same domain functional level) for this setup, as experience with that product is a recommended prerequisite for the exam. % yum install ipa-server-trust-ad -y % firewall-cmd --add-service=freeipa-trust --permanent success % firewall-cmd --reload success % ipa-adtrust-install . . . # This is the admin@REALM IPA account admin password: WARNING: The smb.conf already exists. Running ipa-adtrust-install will break your existing samba configuration. # Type 'yes' here Do you wish to continue? [no]: yes Do you want to enable support for trusted domains in Schema Compatibility plugin? This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users. # You can press enter here to accept the default. If you have BSD, Solaris, Omnios, HP-UX, AIX, or RHEL 5 and older clients # you may want to enable this. Some apps may benefit from this also. Enable trusted domains support in slapi-nis? [no]: Enter the NetBIOS name for the IPA domain. Only up to 15 uppercase ASCII letters, digits and dashes are allowed. Example: EXAMPLE. # You can accept the default or put your own. NetBIOS domain name [IPA]: IPA0 WARNING: 4 existing users or groups do not have a SID identifier assigned. Installer can run a task to have ipa-sidgen Directory Server plugin generate the SID identifier for all these users. Please note, in case of a high number of users and groups, the operation might lead to high replication traffic and performance degradation. Refer to ipa-adtrust-install(1) man page for details. # You should always say yes. Do you want to run the ipa-sidgen task? [no]: yes . . . # This will complete and list ports to open and such. We did this earlier. Now that the AD trust components are prepped, depending on the setup, we'll need to do some DNS zone forwards. It is likely you have IPA and AD running their own DNS. Note : This may not be the case in a real world scenario. # We need to create a forward zone here for the example.net zone % ipa dnsforwardzone-add example.net --forwarder=192.168.15.15 --forward-policy=only Server will check DNS forwarder(s). This may take some time, please wait ... Zone name: example.net. Active zone: TRUE Zone forwarders: 192.168.15.15 Forward policy: only # We should probably create a few dns records... # Assuming the AD netbios name is EXAMPLEAD, use the syntax hostname.NETBIOS here % ipa dnsrecord-add example.com ad.EXAMPLEAD --a-ip-address=192.168.15.15 # Same idea here, but we're only doing the netbios name and saying the name server record is the AD server % ipa dnsrecord-add example.com EXAMPLEAD --ns-hostname=ad.EXAMPLEAD # We need to allow the zones to be transferable to the AD domain % ipa dnszone-mod example.com --allow-transfer=192.168.15.15 On the AD side, we need to create the IPA zone. It's absolutely required. C:\\Windows\\System32>dnscmd 127.0.0.1 /ZoneAdd example.com /Secondary 192.168.15.2 You should probably double check that the DNS records are returning on the IDM servers. % dig _ldap._tcp.example.com SRV ; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> SRV _ldap._tcp.example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14793 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.example.com. IN SRV ;; ANSWER SECTION: _ldap._tcp.example.com. 86400 IN SRV 0 100 389 idm1.example.com. _ldap._tcp.example.com. 86400 IN SRV 0 100 389 idm2.example.com. ;; AUTHORITY SECTION: example.com. 86400 IN NS idm1.example.com. example.com. 86400 IN NS idm2.example.com. ;; ADDITIONAL SECTION: idm1.example.com. 1200 IN A 192.168.15.2 idm2.example.com. 1200 IN A 192.168.15.3 # Same with the AD records % dig _ldap._tcp.example.net SRV ; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> SRV _ldap._tcp.example.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12195 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 9 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.example.net. IN SRV ;; ANSWER SECTION: _ldap._tcp.example.net. 600 IN SRV 0 100 389 ad.example.net. . . . Now that they are returning, intiate the trust. % ipa trust-add --type=ad example.net --admin Administrator --password Active Directiron domain administrator's password: (type password here) ----------------------------------------------------- Added Active Directory trust for realm \"example.net\" ----------------------------------------------------- Realm name: example.net Domain NetBIOS name: EXAMPLEAD Domain Security Identifier: S-1-5-21-XXXXXXXXXX-YYYYYYYYY-ZZZZZZZZZZ Trust direction: Trusting forest Trust type: Active Directory domain Trust status: Established and verified # Check that an AD user is resolvable. You can do this with DOMAIN\\name or name@DOMAIN % id EXAMPLEAD\\\\administrator % id administrator@example.net Authenticate users with an Active Directory domain \u00b6 As we disabled the allow_all rule, let's create a set of groups first and then the HBAC rule. # Create the starting AD group % ipa group-add adusers # Create an external group. This is required for AD users. % ipa group-add --external adgroup_external # Add an AD user into the external group % ipa group-add-member --users=administrator@example.net adgroup_external # Make the external group a member of ad users % ipa group-add-member --groups=adgroup_external adusers As we've made an HBAC rule before, this should be simple. % ipa hbacrule-add --hostcat=all --servicecat=all --desc='ad users all access' adusers_access % ipa hbacrule-add-user --groups=adusers adusers_access % ipa hbactest --rules=adusers_access --user=administrator@example.net --host=client.example.com --service=sshd The test should pass without any issues. Note Group Types While this may not be required information while working on the exam, it's important to understand that there are different group types in AD and the behavior changes based on the group type. Groups in Active Directory have three types. These three types can actually change the behavior of how SSSD on the IPA domain controllers resolve them or if they'll even be resolvable at all. The three types are 'Domain Local', 'Global', and 'Universal'. If at all possible, avoid groups being 'Global'. Domain Local or Universal is recommended. IdM maintenance \u00b6 Back up an IdM infrastructure \u00b6 There are multiple ways you can backup IPA. Full backup: Default, shuts down IPA before performing a backup. This backs up with raw files. As such, it must be done offline. Data backup: Backs up a copy of the ldap data and the changelog (the IPA-REALM instance, DogTag, IPA backend). This can be done online. # Turns off IPA completely and perform a backup % ipa-backup # Backs up and gpg encrypts % ipa-backup --gpg --gpg-keyring=/root/keys To restore a backup, the ipa-restore command is available. % ipa-restore /var/lib/ipa/backup/ Perform a backup without interruption of services \u00b6 The backup command allows you to pass an online flag to ensure a backup taken doesn't down the IPA services. Note that not everything can be backed up online. # Backs up data only and doesn't take down IPA % ipa-backup --data --online # Backs up data only and gpg encrypts % ipa-backup --gpg --gpg-keyring=/root/keys --data --online Value Add \u00b6 Use the REST api to query IdM \u00b6 When you invoke the ipa command, you are actually communicating with the API that runs on the IdM replicas. Operations done are sent via a POST with JSON data. The return data is also in JSON and translated to be readable in the terminal. Because it's JSON, custom scripts can be made with say perl or python that communicates with the API to send the calls, perhaps for specific tasks, jobs, or other operations that could be automated. You can also use curl to do this also if you so choose. The question becomes, \"well, how do I know the right data to send?\" You can issue the -vv switch to see the request being sent. % ipa -vv ping ipa: INFO: trying https://idm1.example.com/ipa/json ipa: INFO: [try 1]: Forwarding 'schema' to json server 'https://idm1.example.com/ipa/json' ipa: INFO: trying https://idm1.example.com/ipa/session/json ipa: INFO: [try 1]: Forwarding 'ping/1' to json server 'https://idm1.example.com/ipa/session/json' ipa: INFO: Request: { \"id\": 0, \"method\": \"ping/1\", \"params\": [ [], { \"version\": \"2.251\" } ] } ipa: INFO: Response: { \"error\": null, \"id\": 0, \"principal\": \"admin@EXAMPLE.COM\", \"result\": { \"summary\": \"IPA server version 4.10.2. API version 2.251\" }, \"version\": \"4.10.2\" } -------------------------------------------- IPA server version 4.10.2. API version 2.251 -------------------------------------------- If you look at the 'request' section, you can see the data that is sent. Each request has a method and params , where method is a command to be excuted and params is simply an array that contains positional arguments and a dictionary of options. If you take a look at say, group-show, you would see a different request. % ipa -vv group-show admins ipa: INFO: trying https://idm1.example.com/ipa/session/json ipa: INFO: [try 1]: Forwarding 'group_show/1' to json server 'https://idm1.example.com/ipa/session/json' ipa: INFO: Request: { \"id\": 0, \"method\": \"group_show/1\", \"params\": [ [ \"admins\" ], { \"version\": \"2.230\" } ] } ### Lots of output ### Let's say I wanted to perform that in a simple bash script that uses curl. I would perform a kinit and then run the script below to have it login for me via kerberos and do the work. #!/bin/bash ipaReplica=idm1.example.com cookieJar=my.cookie.jar # Login with Kerberos curl -v \\ -H referer:https://$ipaReplica/ipa \\ -c $cookieJar -b $cookieJar \\ --cacert /etc/ipa/ca.crt \\ --negotiate -u : \\ -X POST \\ https://$ipaReplica/ipa/session/login_kerberos # Send user_find method request curl -v \\ -H referer:https://$ipaReplica/ipa \\ -H \"Content-Type:application/json\" \\ -H \"Accept:applicaton/json\"\\ -c $cookieJar -b $cookieJar \\ --cacert /etc/ipa/ca.crt \\ -d '{\"method\":\"group_show/1\",\"params\":[[\"admins\"],{}],\"id\":0}' \\ -X POST \\ https://$ipaReplica/ipa/session/json Any of the commands ran via ipa can be reviewed with the -vv switch so you can see what kind of call it's making and how it's making it. Thus, making it easier to tie into your own scripts. On the Web UI, you can go to IPA Server -> API Browser to find more information on the specific API calls. Implement an IdP \u00b6 While not strictly a certification objective at this present time, there may be a chance it could be. FreeIPA 4.10+ have the ability to implement authentication to external identity providers. FreeIPA allows you to use RADIUS proxy authentication for example, but using this same method, an OAuth 2.0 authorization server could be used as well. When it comes to an IdP, you can instead configure IdP clients using ipa idp-add and use software like Keycloak or otherwise that supports OAuth 2.0 workflows. We recommend checking out the FreeIPA Workshop Unit 12 for more details.","title":"EX362 Exam Prep"},{"location":"training/ex362/#overview","text":"The video series goes over setting up FreeIPA in a lab/VM environment by following the objectives as outlined by Red Hat. The list of objectives can be found here .","title":"Overview"},{"location":"training/ex362/#exam-information","text":"The EX362 exam tests your knowledge in a real world format style test - Meaning just like any Red Hat exam, it is performance-based and you perform tasks as if you were on the job. You are evaluated on the tasks you perform and if they meet the objective criteria. The EX362 is related to FreeIPA or Red Hat Identity Management and counts toward the RHCA (Red Hat Certified Architect). To take the exam, you must have at least an RHCSA. If you are attempting to become a Red Hat Certified Architect, you must have an RHCE.","title":"Exam Information"},{"location":"training/ex362/#resources","text":"FreeIPA Red Hat Documentation Trust Anatomy/SSSD Troubleshooting Directory Server Tuning FreeIPA Workshop Curriculum Our Page","title":"Resources"},{"location":"training/ex362/#hardware-recommendations","text":"The minimum requirements for IdM are fairly low. 2GB of RAM, 1 core, and a 10GB disk. However, we believe that's too low, especially if we plan on scaling out. And during upgrades, you would need at least 4GB of RAM for the operations to be successful. Below are our minimum recommendations: 2 (virtual) CPU Core 4 GB of RAM 10GB+ disk or partition for /var/lib/dirsrv Per the Red Hat documentation, consider that with at least 10k users and 100 groups, you would need at least 3GB of RAM and 1GB swap. If you end up having 100k users and 50k groups, then 16GB of RAM and 4GB of swap is recommended. In fact, in larger deployments, it's more effective to increase RAM than disk, as most data is stored in cache. View the resources above in the previous section for directory server tuning information.","title":"Hardware Recommendations"},{"location":"training/ex362/#idm-server-installation-and-configuration","text":"","title":"IdM Server Installation and Configuration"},{"location":"training/ex362/#install-idm-in-a-scalable-fault-tolerant-environment","text":"Server Name IP Address idm1.example.com 192.168.15.2 idm2.example.com 192.168.15.3 !!! note:: IPA Servers should either have a DHCP reservation or a static address. In the event that you have either, DNS should always be pointing at 127.0.0.1, especially if your replica serves DNS. Both of our replicas serve DNS, so loopback is sufficient and recommended for our name server. In later versions of FreeIPA, there is support to force network manager to ensure resolv.conf is loopback without the need to set it by hand with nmcli. # Set a static address - It's important for your IdM servers # to have static addresses or a DHCP reservation. % nmcli con mod eth0 ipv4.address 192.168.15.2/24 % nmcli con mod eth0 ipv4.gateway 192.168.15.1 % nmcli con mod eth0 ipv4.method manual % nmcli con mod eth0 ipv4.dns-search example.com # You should set this if your replica serves DNS! If not, set it to # one or more of your IdM replicas that do. % nmcli con mod eth0 ipv4.dns 127.0.0.1 % nmcli con up eth0 # Examples of using ipa-server-install # RHEL 9 % yum install ipa-server ipa-server-dns ipa-client sssd sssd-ipa # Installation, interactive, does not setup specific components % ipa-server-install # Installation, mostly automatic (recommended) # This will setup DNS and the necessary pieces for an AD trust # Optionally, you can use the --netbios-name switch to set your forest netbios name % ipa-server-install --domain example.com --realm EXAMPLE.COM \\ --reverse-zone=15.168.192.in-addr.arpa. \\ --no-forwarders \\ --no-ntp \\ --setup-dns \\ --setup-adtrust \\ -p Passw0rd! \\ -a Passw0rd! # Configure the firewall for RHEL 7 % firewall-cmd --permanent --add-service={ntp,http,https,freeipa-ldap,freeipa-ldaps,kerberos,freeipa-replication,kpasswd,dns} # RHEL 8 % firewall-cmd --permanent --add-service={freeipa-4,ntp,dns} % kinit admin # We need to make sure that any A records get a corresponding PTR record, otherwise you're making them manually. % ipa dnsconfig-mod --allow-sync-ptr=True # Adding a replica % ipa-replica-install --setup-dns \\ --setup-ca \\ --no-forwarders # Adding a replica unattended without forwarders % ipa-client-install --realm EXAMPLE.COM % kinit admin % ipa hostgroup-add-member --hosts=ipa02.example.com ipaservers % ipa-replica-install --setup-dns \\ --setup-ca \\ --no-forwarders \\ --unattended","title":"Install IdM in a scalable, fault tolerant environment"},{"location":"training/ex362/#creating-users-groups-and-policies","text":"Users Login Name Type Group Role UID/GID John Smith jsmith Normal admins Auto Bob Rufus brufus Normal corp Auto Larry Dufus ldufus Normal helpdesk Auto Robert Cole rcole Staged Auto Thomas Snyder tsnyder Preserved Auto SysHost Management syshostmgt Normal Host Manager 10000 Groups Policy HelpDesk helpdesk corp enrollers Enrollment Administrator Roles Privilege Host Manager Host administrators Host group administrators Netgroups administrators Host enrollment Note Custom UID/GID It is possible to create the users with a custom uid/gid with the switches --uid and --gidnumber which you will see below. It is also possible to set random passwords with --random. See ipa user-add --help for more switches. Note Password Expiration When you make a user with the --password switch or use ipa passwd to set a password, it is automatically expired and must be changed on next login. If you want to avoid this from happening, you will need to set a random password via --password or --random, and then use kpasswd username to change it to the desired password. This does not make the account non-expiring. # Creating users with a password, create all the accounts from the table (except from syshost) % ipa user-add --first=\"John\" --last=\"Smith\" --password jsmith # Create the system account with a password of Sup3R$ecre7! and a UID of 10000 % ipa user-add --first=\"SysHost\" --last=\"Management\" --uid=10000 --gidnumber=10000 --password syshostmgt # Stage a user % ipa stageuser-add --first=\"Robert\" --last=\"Cole\" rcole # Preserve a user % ipa user-del tsynder --preserve # Create a regular (POSIX) group % ipa group-add corp # Create a member only group % ipa group-add --nonposix HelpDesk % ipa group-add --nonposix enrollers # Add the HelpDesk group to the helpdesk policy # Add the enrollers group to the Enrollment Administrator role % ipa role-add-member \"helpdesk\" --groups=HelpDesk % ipa role-add-member \"Enrollment Administrator\" --groups=enrollers # Create a role with privileges % ipa role-add \"Host Manager\" % ipa role-add-privilege \"Host Manager\" \\ --privileges=\"Host administrators\" \\ --privileges=\"Host group administrators\" \\ --privileges=\"Netgroups administrators\" \\ --privileges=\"Host enrollment\" # Add the syshostmgt user as a member of the role % ipa role-add-member \"Host Manager\" --users=\"syshostmgt\" # Set our user passwords to CentOS123!$ so that way we don't have to change them later % kpasswd jsmith # If we already set the password we want but we don't want it to expire without making a policy or prompt for a password change (NOT RECOMMENDED) % ldapmodify -x -w 'Passw0rd!' -D 'cn=Directory Manager' dn: uid=syshostmgt,cn=users,cn=accounts,dc=example,dc=com changetype: modify delete: krbLastPwdChange (Press CTRL+D)","title":"Creating Users, Groups, and Policies"},{"location":"training/ex362/#new-passwords-expired","text":"The common question we receive (and even the #freeipa IRC receive) is \"Why can't we just set the password to not be expired right away?\" See this page for information on why this is. You may also look at the pagure page and the Red Hat bugzilla related bug .","title":"New Passwords Expired"},{"location":"training/ex362/#implement-a-sso","text":"To setup a very, very simple SSO, you can setup a simple location that requires a login. % ipa-getkeytab -s idm1.example.com -p http/http.example.com -k /etc/httpd/conf/http.keytab % vi /etc/httpd/conf.d/location.conf AuthType Kerberos AuthName \"IPA Kerberos Auth\" # Keytab Krb5Keytab /etc/httpd/conf/http.keytab # Kerb settings KrbMethodNegotiate on KrbMethodK5Passwd on KrbServiceName HTTP KrbAuthRealms EXAMPLE.COM KrbSaveCredentials off Require valid-user ","title":"Implement a SSO"},{"location":"training/ex362/#idm-client-installation-and-configuration","text":"","title":"IdM Client Installation and Configuration"},{"location":"training/ex362/#install-and-configure-idm-clients","text":"Client Name IP Address client.example.com 192.168.15.10 nfs.example.com 192.168.15.11 utility.example.com 192.168.15.12 Note Depending on your architecture and setup, IdM clients should either be pointing directly at the IdM servers for DNS (at least two of them) or pointing at the DNS server in the environment that is delegating that domain to the IdM domain controllers. In our lab, our IdM servers are our only DNS servers, thus it makes sense that our clients should point to them. In that scenario, you would configure your DHCP server to use the IdM servers as the name servers and/or configure them in a static manner depending on your environment. # If your client is not pointing at the IdM DNS and you # don't have another DNS server that's performing delegation, # change your name servers. % nmcli con mod eth0 ipv4.dns 192.168.15.2 % nmcli con mod eth0 +ipv4.dns 192.168.15.3 % nmcli con mod eth0 ipv4.dns-search example.com # Optionally, if your clients don't have DHCP # reservations, set a static address. % nmcli con mod eth0 ipv4.address 192.168.15.10/24 % nmcli con mod eth0 ipv4.gateway 192.168.15.1 % nmcli con mod eth0 ipv4.method manual # It might be a good idea to set your hostname if you haven't already % hostnamectl set-hostname client.example.com % hostname client.example.com # Install the ipa-client packages % yum install ipa-client -y % ipa-client-install --realm EXAMPLE.COM --domain example.com . . . % id admin uid=686600000(admin) gid=686600000(admins) groups=686600000(admins)","title":"Install and configure IdM Clients"},{"location":"training/ex362/#configure-kerberized-services","text":"One of the things that you may end up doing, whether by hand or in an automated fashion, is creating kerberized services. In a previous section, we addressed creating an NFS service for both a server and a client for the purpose of automating home directory mounts on a client when a user logs in. So you already have the idea of what this entails. # Create kerberos service % ipa service-add HTTP/http.example.com Not only that, it's probably a good idea to actually get the keytab. % kinit admin % ipa-getkeytab -s idm1.example.com -p HTTP/http.example.com -k /etc/krb5.keytab For an example of automating keytab creation and retrieval, see the CentOS/FreeIPA page on this site.","title":"Configure Kerberized services"},{"location":"training/ex362/#idm-ha-configuration","text":"","title":"IdM HA Configuration"},{"location":"training/ex362/#configure-and-manage-a-certificate-authority","text":"By default FreeIPA stands up its own CA. And because of this, this allows you or your workplace to be able to issue certificates, that can be used in a wide variety of services, the most common or obvious one would be for Apache httpd. There's a couple of ways you can get a certificate signed by FreeIPA. One method is to generate your own CSR and request it to be signed by FreeIPA. Another way is you can do it all from one command, ipa-getcert , and optionally, either have the certificate in PEM format or an NSS database. We'll address these examples. # Creating an SSL certificate in the PEM format % ipa service-add HTTP/http.example.com % ipa-getcert request -f /etc/pki/tls/certs/http.pem -k /etc/pki/tls/private/http.key -K HTTP/http.example.com -D http.example.com New signing request \"20190902000318\" added. # Verify % ipa-getcert list Number of certificates and requests being tracked: 1. Request ID '20190902000318': status: MONITORING stuck: no key pair storage: type=FILE,location='/etc/pki/tls/private/http.key' certificate: type=FILE,location='/etc/pki/tls/certs/http.pem' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=http.example.com,O=EXAMPLE.COM expires: 2021-09-02 00:03:19 UTC dns: http.example.com principal name: HTTP/http.example.com@EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes # Create an SSL certificate in the NSS format % ipa-getcert request -d /etc/pki/tls/certs/nss -n 'Test' -K HTTP/http.example.com -D http.example.com New signing request \"20190902000756\" added. # Verify % ipa-getcert list . . . Request ID '20190902000756': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/tls/certs/nss',nickname='Test',token='NSS Certificate DB' certificate: type=NSSDB,location='/etc/pki/tls/certs/nss',nickname='Test',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=http.example.com,O=EXAMPLE.COM expires: 2021-09-02 00:07:57 UTC dns: http.example.com principal name: HTTP/http.example.com@EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes By default, when a certificate request is performed (and succeeds to be signed by the IPA CA), it is typically tracked and auto-renewed by default. This is done by the certmonger service, which eliminates the need to have to renew anything by hand.","title":"Configure and manage a certificate authority"},{"location":"training/ex362/#create-secret-vaults","text":"When a domain supports the KRA role, it can hold password vaults or anything that's considered \"secret\". You can add the KRA role by simply running on each relevant domain controller: % ipa-kra-install (more to come)","title":"Create Secret Vaults"},{"location":"training/ex362/#idm-users-and-policies-management","text":"In FreeIPA, there are two sets of policies: Role Based Access Control (RBAC) which are the permissions, delegated or otherwise, that allow (or deny) access to various pieces of FreeIPA. This can be users that have the ability to reset passwords, modify groups, or perhaps they can issue keytabs. This was partially covered in a previous section. Host Based Access Control (HBAC) which are the permissions granted to a user or users to access systems on various (PAM) services, such as ssh or logging into a desktop system (eg, GDM).","title":"IdM Users and Policies Management"},{"location":"training/ex362/#configure-policies-and-user-access","text":"HBAC, or Host Based Access Controls, are permissions that grant user or users access to systems via any number of services. The services are PAM services. No doubt you have looked in /etc/pam.d before and have seen quite a few files or even modified them by hand at some point. % ls -l /etc/pam.d/ total 80 -rw-r--r--. 1 root root 272 May 11 2019 atd -rw-r--r--. 1 root root 232 Apr 15 15:28 config-util -rw-r--r--. 1 root root 328 Nov 8 2019 crond lrwxrwxrwx. 1 root root 32 Jan 14 2020 fingerprint-auth -> /etc/authselect/fingerprint-auth -rw-r--r--. 1 root root 70 Apr 24 06:35 ksu -rw-r--r--. 1 root root 715 Apr 24 05:38 login -rw-r--r--. 1 root root 154 Apr 15 15:28 other -rw-r--r--. 1 root root 168 Apr 6 20:08 passwd lrwxrwxrwx. 1 root root 29 Jan 14 2020 password-auth -> /etc/authselect/password-auth -rw-r--r--. 1 root root 155 Apr 8 22:00 polkit-1 lrwxrwxrwx. 1 root root 25 Jan 14 2020 postlogin -> /etc/authselect/postlogin -rw-r--r--. 1 root root 640 Apr 24 05:38 remote -rw-r--r--. 1 root root 143 Apr 24 05:38 runuser -rw-r--r--. 1 root root 138 Apr 24 05:38 runuser-l lrwxrwxrwx. 1 root root 30 Jan 14 2020 smartcard-auth -> /etc/authselect/smartcard-auth lrwxrwxrwx. 1 root root 25 Jun 15 10:18 smtp -> /etc/alternatives/mta-pam -rw-r--r--. 1 root root 76 Apr 6 20:11 smtp.postfix -rw-r--r--. 1 root root 727 Feb 4 2020 sshd -rw-r--r--. 1 root root 214 Apr 23 20:48 sssd-shadowutils -rw-r--r--. 1 root root 566 Apr 24 05:38 su -rw-r--r--. 1 root root 154 Apr 23 19:40 sudo -rw-r--r--. 1 root root 178 Apr 23 19:40 sudo-i -rw-r--r--. 1 root root 137 Apr 24 05:38 su-l lrwxrwxrwx. 1 root root 27 Jan 14 2020 system-auth -> /etc/authselect/system-auth -rw-r--r--. 1 root root 248 Jul 21 07:57 systemd-user -rw-r--r--. 1 root root 84 May 11 2019 vlock On a typical Red Hat system, the most common ones (such as su , sshd , sudo ) imports the system-auth file, so the login request is processed through those means. When defining HBAC rules, you either must allow \"all\" services or be selective. For example, if an HBAC rule allows \"sshd\", a user is allowed to ssh into a system, but wouldn't allow them to login locally, as that goes through login . If you want the user to be able to run the su and sudo commands, you would also need to allow those services. Otherwise, the user is denied, despite sudo policies being available. [label@mgt ~]$ sudo -i [sudo] password for label: sudo: PAM account management error: Permission denied In FreeIPA, there is typically a rule already predefined that allows everyone to access all systems and all services. This can be removed or disabled and this removes host access to everything immediately. This is typically recommended in most environments where there are security standards and procedures in place. # To disable % ipa hbacrule-disable allow_all # To delete instead % ipa hbacrule-del allow_all When performing a FreeIPA installation, it is possible to add --no-hbac-allow that will disable the allow_all rule. Below are some examples of adding access. # Allow all admins to access all systems % ipa hbacrule-add --hostcat=all --servicecat=all --desc='Allow all admins to access all systems' All_Admins % ipa hbacrule-add-user --groups=admins All_Admins # And then test... % ipa hbactest --rules=All_Admins --user=jsmith --host=client.example.com --service=login # Allow the corp users to access the client system only using the sshd pam services % ipa hbacrule-add --desc='Allow corp users to access client on ssh' corp_access % ipa hbacrule-add-user --groups=corp corp_access % ipa hbacrule-add-host --hosts=client.example.com corp_access % ipa hbacrule-add-service --hbacsvcs=sshd corp_access # And then test... % ipa hbactest --rules=corp_access --user=brufus --host=client.example.com --service=sshd","title":"Configure Policies and User Access"},{"location":"training/ex362/#configure-roamingautomounted-home-directories","text":"You will need to configure your NFS server to serve up roaming home directories for users and then your client should have automouting enabled. Note Client Kerberos Service It may not be required to create an nfs kerberos service for the client. The ipa-client-automount command may already handle this but it does not hurt to create one. In fact, the host keytab is used on the client side anyway. Creating an NFS client keytab may have been required back in the EL6 days. # IDM Steps % kinit admin % ipa service-add nfs/nfs.example.com % ipa service-add nfs/client.example.com # Setup the automounting locations % ipa automountmap-add default auto.home % ipa automountkey-add default --key \"/home\" --info auto.home auto.master % ipa automountkey-add default --key \"*\" --info \"-fstype=nfs4,rw,sec=krb5,soft nfs.example.com:/exports/home/&\" auto.home # NFS Server Steps % yum install nfs-utils -y % mkdir /exports/home % vi /etc/exports /exports/home *(rw,sec=sys:krb5:krb5i:krb5p) # Make the home directories for all users and move them to /export/home % mkhomedir_helper jsmith % mv /home/jsmith /export/home/ # Create the necessary keytabs % kinit admin % ipa-getkeytab -s idm1.example.com -p nfs/nfs.example.com -k /etc/krb5.keytab # Verify keytab % klist -ket /etc/krb5.keytab # Enable and start nfs % systemctl enable nfs-server --now # Open the necessary firewall ports % firewall-cmd --add-service=nfs --permanent % firewall-cmd --complete-reload # Client steps % kinit admin % ipa-getkeytab -s idm1.example.com -p nfs/client.example.com -k /etc/krb5.keytab % ipa-client-automount --location=default # Verify keytab % klist -ket /etc/krb5.keytab To test, login to the system via ssh or console and verify the home directory has mounted. /var/log/messages and secure will display errors in case of failure.","title":"Configure roaming/automounted home directories"},{"location":"training/ex362/#configure-idm-as-an-ldap-backend-for-external-services","text":"Most services and applications that authenticate users do typically have LDAP support. IdM can be used as an LDAP backend. You typically need only a few things to authenticate users from IdM to an application. Base DN, this always ends up being the top level of your domain: dc=example,dc=com - All accounts share this common base. Bind DN, this is a system account that binds to the directory to assist with searches and authentication Attribute mappings Groups, depending on the application Below is a table of common DN's you may specify in an application: DN's Path Filter (if applicable) Base DN dc=example,dc=com User DN cn=users,cn=accounts,dc=example,dc=com uid=... Group DN cn=groups,cn=accounts,dc=example,dc=com (objectClass=groupOfNames) Bind DN uid=account,cn=sysaccounts,cn=etc,dc=example,dc=com % ipa user-show admin --all | grep '^dn' dn: uid=admin,cn=users,cn=accounts,dc=example,dc=com Below is a table of common attributes that may be used to map user information in the application. Type Attribute Login Name uid First Name givenName Surname sn Email mail Groups memberOf Full Name cn Below are two ways to create a bind account (bind DN). The first way is the LDAP way. The second way is the ipa-ldap-updater. % kinit admin % ldapadd -Y GSSAPI . . . dn: uid=binder,cn=sysaccounts,cn=etc,dc=example,dc=com objectclass: account objectclass: simplesecurityobject uid: binder userPassword: password123 passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 # Press CTRL+d adding new entry \"uid=binder,cn=sysaccounts,cn=etc,dc=example,dc=com\" % kinit admin % cat << EOF > binder.update dn: uid=binder,cn=sysaccounts,cn=etc,dc=example,dc=com add:objectclass:account add:objectclass:simplesecurityobject add:uid:binder add:userPassword:password123 add:passwordExpirationTime:20380119031407Z add:nsIdleTimeout:0 EOF % ipa-ldap-updater binder.update When this account is created, you can then specify the full DN for that object into a bind DN field, along with it's password into an accompanying bind password field. If you'd like an example of setting up Ansible Tower (or AWX, the open source version of tower) against IdM, you can click here . Note Kerberos On some applications, it is possible to use kerberos authentication rather than a straight bind account. The general idea is the same when picking out the base dn, attributes, and the like. However, instead you would create an account with an accompanying LDAP/... service principal to do the authentication.","title":"Configure IdM as an LDAP backend for external services"},{"location":"training/ex362/#creating-trust-with-ad-domain","text":"","title":"Creating Trust with AD Domain"},{"location":"training/ex362/#create-trust-relationships-with-active-directory","text":"Note AD Setup We do not cover setting up an AD forest here. This is out of scope for this series. If you are using Server 2016 or higher and you are using \"core\", look up the commands: Install-WindowsFeature AD-domain-services Import-Module ADDSDeployment Install-ADDSForest Server Name IP Address ad.example.net 192.168.15.15 For our trust, the AD server will need to be configured to be the example.net domain with the hostname of ad.example.net. This way, we are not colliding in DNS and both AD and IdM should be able to communicate with each other as two separate forests. It is recommended to use Windows Server 2016 (with the same domain functional level) for this setup, as experience with that product is a recommended prerequisite for the exam. % yum install ipa-server-trust-ad -y % firewall-cmd --add-service=freeipa-trust --permanent success % firewall-cmd --reload success % ipa-adtrust-install . . . # This is the admin@REALM IPA account admin password: WARNING: The smb.conf already exists. Running ipa-adtrust-install will break your existing samba configuration. # Type 'yes' here Do you wish to continue? [no]: yes Do you want to enable support for trusted domains in Schema Compatibility plugin? This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users. # You can press enter here to accept the default. If you have BSD, Solaris, Omnios, HP-UX, AIX, or RHEL 5 and older clients # you may want to enable this. Some apps may benefit from this also. Enable trusted domains support in slapi-nis? [no]: Enter the NetBIOS name for the IPA domain. Only up to 15 uppercase ASCII letters, digits and dashes are allowed. Example: EXAMPLE. # You can accept the default or put your own. NetBIOS domain name [IPA]: IPA0 WARNING: 4 existing users or groups do not have a SID identifier assigned. Installer can run a task to have ipa-sidgen Directory Server plugin generate the SID identifier for all these users. Please note, in case of a high number of users and groups, the operation might lead to high replication traffic and performance degradation. Refer to ipa-adtrust-install(1) man page for details. # You should always say yes. Do you want to run the ipa-sidgen task? [no]: yes . . . # This will complete and list ports to open and such. We did this earlier. Now that the AD trust components are prepped, depending on the setup, we'll need to do some DNS zone forwards. It is likely you have IPA and AD running their own DNS. Note : This may not be the case in a real world scenario. # We need to create a forward zone here for the example.net zone % ipa dnsforwardzone-add example.net --forwarder=192.168.15.15 --forward-policy=only Server will check DNS forwarder(s). This may take some time, please wait ... Zone name: example.net. Active zone: TRUE Zone forwarders: 192.168.15.15 Forward policy: only # We should probably create a few dns records... # Assuming the AD netbios name is EXAMPLEAD, use the syntax hostname.NETBIOS here % ipa dnsrecord-add example.com ad.EXAMPLEAD --a-ip-address=192.168.15.15 # Same idea here, but we're only doing the netbios name and saying the name server record is the AD server % ipa dnsrecord-add example.com EXAMPLEAD --ns-hostname=ad.EXAMPLEAD # We need to allow the zones to be transferable to the AD domain % ipa dnszone-mod example.com --allow-transfer=192.168.15.15 On the AD side, we need to create the IPA zone. It's absolutely required. C:\\Windows\\System32>dnscmd 127.0.0.1 /ZoneAdd example.com /Secondary 192.168.15.2 You should probably double check that the DNS records are returning on the IDM servers. % dig _ldap._tcp.example.com SRV ; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> SRV _ldap._tcp.example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14793 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.example.com. IN SRV ;; ANSWER SECTION: _ldap._tcp.example.com. 86400 IN SRV 0 100 389 idm1.example.com. _ldap._tcp.example.com. 86400 IN SRV 0 100 389 idm2.example.com. ;; AUTHORITY SECTION: example.com. 86400 IN NS idm1.example.com. example.com. 86400 IN NS idm2.example.com. ;; ADDITIONAL SECTION: idm1.example.com. 1200 IN A 192.168.15.2 idm2.example.com. 1200 IN A 192.168.15.3 # Same with the AD records % dig _ldap._tcp.example.net SRV ; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> SRV _ldap._tcp.example.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12195 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 9 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.example.net. IN SRV ;; ANSWER SECTION: _ldap._tcp.example.net. 600 IN SRV 0 100 389 ad.example.net. . . . Now that they are returning, intiate the trust. % ipa trust-add --type=ad example.net --admin Administrator --password Active Directiron domain administrator's password: (type password here) ----------------------------------------------------- Added Active Directory trust for realm \"example.net\" ----------------------------------------------------- Realm name: example.net Domain NetBIOS name: EXAMPLEAD Domain Security Identifier: S-1-5-21-XXXXXXXXXX-YYYYYYYYY-ZZZZZZZZZZ Trust direction: Trusting forest Trust type: Active Directory domain Trust status: Established and verified # Check that an AD user is resolvable. You can do this with DOMAIN\\name or name@DOMAIN % id EXAMPLEAD\\\\administrator % id administrator@example.net","title":"Create trust relationships with Active Directory"},{"location":"training/ex362/#authenticate-users-with-an-active-directory-domain","text":"As we disabled the allow_all rule, let's create a set of groups first and then the HBAC rule. # Create the starting AD group % ipa group-add adusers # Create an external group. This is required for AD users. % ipa group-add --external adgroup_external # Add an AD user into the external group % ipa group-add-member --users=administrator@example.net adgroup_external # Make the external group a member of ad users % ipa group-add-member --groups=adgroup_external adusers As we've made an HBAC rule before, this should be simple. % ipa hbacrule-add --hostcat=all --servicecat=all --desc='ad users all access' adusers_access % ipa hbacrule-add-user --groups=adusers adusers_access % ipa hbactest --rules=adusers_access --user=administrator@example.net --host=client.example.com --service=sshd The test should pass without any issues. Note Group Types While this may not be required information while working on the exam, it's important to understand that there are different group types in AD and the behavior changes based on the group type. Groups in Active Directory have three types. These three types can actually change the behavior of how SSSD on the IPA domain controllers resolve them or if they'll even be resolvable at all. The three types are 'Domain Local', 'Global', and 'Universal'. If at all possible, avoid groups being 'Global'. Domain Local or Universal is recommended.","title":"Authenticate users with an Active Directory domain"},{"location":"training/ex362/#idm-maintenance","text":"","title":"IdM maintenance"},{"location":"training/ex362/#back-up-an-idm-infrastructure","text":"There are multiple ways you can backup IPA. Full backup: Default, shuts down IPA before performing a backup. This backs up with raw files. As such, it must be done offline. Data backup: Backs up a copy of the ldap data and the changelog (the IPA-REALM instance, DogTag, IPA backend). This can be done online. # Turns off IPA completely and perform a backup % ipa-backup # Backs up and gpg encrypts % ipa-backup --gpg --gpg-keyring=/root/keys To restore a backup, the ipa-restore command is available. % ipa-restore /var/lib/ipa/backup/","title":"Back up an IdM infrastructure"},{"location":"training/ex362/#perform-a-backup-without-interruption-of-services","text":"The backup command allows you to pass an online flag to ensure a backup taken doesn't down the IPA services. Note that not everything can be backed up online. # Backs up data only and doesn't take down IPA % ipa-backup --data --online # Backs up data only and gpg encrypts % ipa-backup --gpg --gpg-keyring=/root/keys --data --online","title":"Perform a backup without interruption of services"},{"location":"training/ex362/#value-add","text":"","title":"Value Add"},{"location":"training/ex362/#use-the-rest-api-to-query-idm","text":"When you invoke the ipa command, you are actually communicating with the API that runs on the IdM replicas. Operations done are sent via a POST with JSON data. The return data is also in JSON and translated to be readable in the terminal. Because it's JSON, custom scripts can be made with say perl or python that communicates with the API to send the calls, perhaps for specific tasks, jobs, or other operations that could be automated. You can also use curl to do this also if you so choose. The question becomes, \"well, how do I know the right data to send?\" You can issue the -vv switch to see the request being sent. % ipa -vv ping ipa: INFO: trying https://idm1.example.com/ipa/json ipa: INFO: [try 1]: Forwarding 'schema' to json server 'https://idm1.example.com/ipa/json' ipa: INFO: trying https://idm1.example.com/ipa/session/json ipa: INFO: [try 1]: Forwarding 'ping/1' to json server 'https://idm1.example.com/ipa/session/json' ipa: INFO: Request: { \"id\": 0, \"method\": \"ping/1\", \"params\": [ [], { \"version\": \"2.251\" } ] } ipa: INFO: Response: { \"error\": null, \"id\": 0, \"principal\": \"admin@EXAMPLE.COM\", \"result\": { \"summary\": \"IPA server version 4.10.2. API version 2.251\" }, \"version\": \"4.10.2\" } -------------------------------------------- IPA server version 4.10.2. API version 2.251 -------------------------------------------- If you look at the 'request' section, you can see the data that is sent. Each request has a method and params , where method is a command to be excuted and params is simply an array that contains positional arguments and a dictionary of options. If you take a look at say, group-show, you would see a different request. % ipa -vv group-show admins ipa: INFO: trying https://idm1.example.com/ipa/session/json ipa: INFO: [try 1]: Forwarding 'group_show/1' to json server 'https://idm1.example.com/ipa/session/json' ipa: INFO: Request: { \"id\": 0, \"method\": \"group_show/1\", \"params\": [ [ \"admins\" ], { \"version\": \"2.230\" } ] } ### Lots of output ### Let's say I wanted to perform that in a simple bash script that uses curl. I would perform a kinit and then run the script below to have it login for me via kerberos and do the work. #!/bin/bash ipaReplica=idm1.example.com cookieJar=my.cookie.jar # Login with Kerberos curl -v \\ -H referer:https://$ipaReplica/ipa \\ -c $cookieJar -b $cookieJar \\ --cacert /etc/ipa/ca.crt \\ --negotiate -u : \\ -X POST \\ https://$ipaReplica/ipa/session/login_kerberos # Send user_find method request curl -v \\ -H referer:https://$ipaReplica/ipa \\ -H \"Content-Type:application/json\" \\ -H \"Accept:applicaton/json\"\\ -c $cookieJar -b $cookieJar \\ --cacert /etc/ipa/ca.crt \\ -d '{\"method\":\"group_show/1\",\"params\":[[\"admins\"],{}],\"id\":0}' \\ -X POST \\ https://$ipaReplica/ipa/session/json Any of the commands ran via ipa can be reviewed with the -vv switch so you can see what kind of call it's making and how it's making it. Thus, making it easier to tie into your own scripts. On the Web UI, you can go to IPA Server -> API Browser to find more information on the specific API calls.","title":"Use the REST api to query IdM"},{"location":"training/ex362/#implement-an-idp","text":"While not strictly a certification objective at this present time, there may be a chance it could be. FreeIPA 4.10+ have the ability to implement authentication to external identity providers. FreeIPA allows you to use RADIUS proxy authentication for example, but using this same method, an OAuth 2.0 authorization server could be used as well. When it comes to an IdP, you can instead configure IdP clients using ipa idp-add and use software like Keycloak or otherwise that supports OAuth 2.0 workflows. We recommend checking out the FreeIPA Workshop Unit 12 for more details.","title":"Implement an IdP"}]} \ No newline at end of file diff --git a/search/worker.js b/search/worker.js new file mode 100644 index 00000000..8628dbce --- /dev/null +++ b/search/worker.js @@ -0,0 +1,133 @@ +var base_path = 'function' === typeof importScripts ? '.' : '/search/'; +var allowSearch = false; +var index; +var documents = {}; +var lang = ['en']; +var data; + +function getScript(script, callback) { + console.log('Loading script: ' + script); + $.getScript(base_path + script).done(function () { + callback(); + }).fail(function (jqxhr, settings, exception) { + console.log('Error: ' + exception); + }); +} + +function getScriptsInOrder(scripts, callback) { + if (scripts.length === 0) { + callback(); + return; + } + getScript(scripts[0], function() { + getScriptsInOrder(scripts.slice(1), callback); + }); +} + +function loadScripts(urls, callback) { + if( 'function' === typeof importScripts ) { + importScripts.apply(null, urls); + callback(); + } else { + getScriptsInOrder(urls, callback); + } +} + +function onJSONLoaded () { + data = JSON.parse(this.responseText); + var scriptsToLoad = ['lunr.js']; + if (data.config && data.config.lang && data.config.lang.length) { + lang = data.config.lang; + } + if (lang.length > 1 || lang[0] !== "en") { + scriptsToLoad.push('lunr.stemmer.support.js'); + if (lang.length > 1) { + scriptsToLoad.push('lunr.multi.js'); + } + if (lang.includes("ja") || lang.includes("jp")) { + scriptsToLoad.push('tinyseg.js'); + } + for (var i=0; i < lang.length; i++) { + if (lang[i] != 'en') { + scriptsToLoad.push(['lunr', lang[i], 'js'].join('.')); + } + } + } + loadScripts(scriptsToLoad, onScriptsLoaded); +} + +function onScriptsLoaded () { + console.log('All search scripts loaded, building Lunr index...'); + if (data.config && data.config.separator && data.config.separator.length) { + lunr.tokenizer.separator = new RegExp(data.config.separator); + } + + if (data.index) { + index = lunr.Index.load(data.index); + data.docs.forEach(function (doc) { + documents[doc.location] = doc; + }); + console.log('Lunr pre-built index loaded, search ready'); + } else { + index = lunr(function () { + if (lang.length === 1 && lang[0] !== "en" && lunr[lang[0]]) { + this.use(lunr[lang[0]]); + } else if (lang.length > 1) { + this.use(lunr.multiLanguage.apply(null, lang)); // spread operator not supported in all browsers: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Spread_operator#Browser_compatibility + } + this.field('title'); + this.field('text'); + this.ref('location'); + + for (var i=0; i < data.docs.length; i++) { + var doc = data.docs[i]; + this.add(doc); + documents[doc.location] = doc; + } + }); + console.log('Lunr index built, search ready'); + } + allowSearch = true; + postMessage({config: data.config}); + postMessage({allowSearch: allowSearch}); +} + +function init () { + var oReq = new XMLHttpRequest(); + oReq.addEventListener("load", onJSONLoaded); + var index_path = base_path + '/search_index.json'; + if( 'function' === typeof importScripts ){ + index_path = 'search_index.json'; + } + oReq.open("GET", index_path); + oReq.send(); +} + +function search (query) { + if (!allowSearch) { + console.error('Assets for search still loading'); + return; + } + + var resultDocuments = []; + var results = index.search(query); + for (var i=0; i < results.length; i++){ + var result = results[i]; + doc = documents[result.ref]; + doc.summary = doc.text.substring(0, 200); + resultDocuments.push(doc); + } + return resultDocuments; +} + +if( 'function' === typeof importScripts ) { + onmessage = function (e) { + if (e.data.init) { + init(); + } else if (e.data.query) { + postMessage({ results: search(e.data.query) }); + } else { + console.error("Worker - Unrecognized message: " + e); + } + }; +} diff --git a/sitemap.xml b/sitemap.xml new file mode 100644 index 00000000..d8f70603 --- /dev/null +++ b/sitemap.xml @@ -0,0 +1,58 @@ + + + + https://linuxguideandhints.com/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/archive/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/el/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/el/builds/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/el/freeipa/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/el/nat/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/el/openldap/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/el/pxeboot/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/el/sysadmin/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/el/unbound/ + 2024-01-07 + daily + + + https://linuxguideandhints.com/training/ex362/ + 2024-01-07 + daily + + \ No newline at end of file diff --git a/sitemap.xml.gz b/sitemap.xml.gz new file mode 100644 index 0000000000000000000000000000000000000000..4ced9731379112fd7a5b3f0561837b87ca815e49 GIT binary patch literal 288 zcmV+*0pI=~iwFq2TbgA8|8r?{Wo=<_E_iKh0L_(6Zo?oDh4(py#ooqotNzI*yPlvu z0EVfJga?;_*tvai5>;MTs>Eyto*qx1kVey<*2xxU@MIiz>{!*T08~yJ96I*-@m{{L zlQ^`|TY^v|Gg8OK5au_|mu0EQ1eoMZmGc89HKq&kyU6S6m5D=3XH%oZ0lqwZ3oVVkw0x)B zVE8Z1AGoAfqd7yid|-1%>!Y!nawbesU}l*!BFd06o|^%!PV=8J + + + + + + + + + + EX362 Exam Prep - Linux Guide and Hints + + + + + + + + + + + + + +
+
+ Linux Guide and Hints + + + + + +
+
+ +
+
+
+
+ +

This page contains the necessary resources to help you prepare for the Red Hat Certified Specialist in Identity Management exam, EX362. This follows the youtube playlist as much as possible with various examples and ideas. Soon to come, you will also find our own example practice exam for you to try your hand at to test your knowledge.

+

The list of objectives can be found here. Note that the exam objectives can change at any time. It is the responsibility of the reader to always review the objectives prior to studying and taking the exam to ensure success.

+
+

Note

+

Affiliation and Exam Information

+

Please note that we are not affiliated with Red Hat. The materials and examples used are our own and do not reflect the training programs provided by Red Hat and are educational only. We do not disclose any of the tasks, questions, or material on the exam as it would violate the NDA. Any questions sent to us about anything directly related to the exam will not be answered. We also do not provide any one-on-one tutoring or online teaching courses.

+

If exam objectives have changed to where the videos and this material are missing information, we can add on at any time upon request. If exam objectives have not changed but operational tasks have, we will note them as we find them. If there are things about FreeIPA that you'd like to see in the videos that may fit into objective, we can add it also upon request. However, it is likely those extra things would be better suited in the separate FreeIPA section on this site.

+
+

Overview

+

The video series goes over setting up FreeIPA in a lab/VM environment by following the objectives as outlined by Red Hat. The list of objectives can be found here.

+

Exam Information

+

The EX362 exam tests your knowledge in a real world format style test - Meaning just like any Red Hat exam, it is performance-based and you perform tasks as if you were on the job. You are evaluated on the tasks you perform and if they meet the objective criteria. The EX362 is related to FreeIPA or Red Hat Identity Management and counts toward the RHCA (Red Hat Certified Architect).

+

To take the exam, you must have at least an RHCSA. If you are attempting to become a Red Hat Certified Architect, you must have an RHCE.

+

Resources

+ +

Hardware Recommendations

+

The minimum requirements for IdM are fairly low. 2GB of RAM, 1 core, and a 10GB disk. However, we believe that's too low, especially if we plan on scaling out. And during upgrades, you would need at least 4GB of RAM for the operations to be successful. Below are our minimum recommendations:

+
    +
  • 2 (virtual) CPU Core
    • +
  • 4 GB of RAM
    • +
  • 10GB+ disk or partition for /var/lib/dirsrv
    • +
+

Per the Red Hat documentation, consider that with at least 10k users and 100 groups, you would need at least 3GB of RAM and 1GB swap. If you end up having 100k users and 50k groups, then 16GB of RAM and 4GB of swap is recommended. In fact, in larger deployments, it's more effective to increase RAM than disk, as most data is stored in cache.

+

View the resources above in the previous section for directory server tuning information.

+

IdM Server Installation and Configuration

+

Install IdM in a scalable, fault tolerant environment

+ + + + + + + + + + + + + + + + + +
Server NameIP Address
idm1.example.com192.168.15.2
idm2.example.com192.168.15.3
+

!!! note:: + IPA Servers should either have a DHCP reservation or a static address. In the event that you have either, DNS should always be pointing at 127.0.0.1, especially if your replica serves DNS. Both of our replicas serve DNS, so loopback is sufficient and recommended for our name server.

+
In later versions of FreeIPA, there is support to force network manager to ensure resolv.conf is loopback without the need to set it by hand with nmcli.
+
+
# Set a static address - It's important for your IdM servers
+# to have static addresses or a DHCP reservation.
+% nmcli con mod eth0 ipv4.address 192.168.15.2/24
+% nmcli con mod eth0 ipv4.gateway 192.168.15.1
+% nmcli con mod eth0 ipv4.method manual
+% nmcli con mod eth0 ipv4.dns-search example.com
+
+# You should set this if your replica serves DNS! If not, set it to
+# one or more of your IdM replicas that do.
+% nmcli con mod eth0 ipv4.dns 127.0.0.1
+% nmcli con up eth0
+
+
# Examples of using ipa-server-install
+# RHEL 9
+% yum install ipa-server ipa-server-dns ipa-client sssd sssd-ipa
+# Installation, interactive, does not setup specific components
+% ipa-server-install
+
+# Installation, mostly automatic (recommended)
+# This will setup DNS and the necessary pieces for an AD trust
+# Optionally, you can use the --netbios-name switch to set your forest netbios name
+% ipa-server-install --domain example.com --realm EXAMPLE.COM \
+    --reverse-zone=15.168.192.in-addr.arpa. \
+    --no-forwarders \
+    --no-ntp \
+    --setup-dns \
+    --setup-adtrust \
+    -p Passw0rd! \
+    -a Passw0rd!
+
+
# Configure the firewall for RHEL 7
+% firewall-cmd --permanent --add-service={ntp,http,https,freeipa-ldap,freeipa-ldaps,kerberos,freeipa-replication,kpasswd,dns}
+# RHEL 8
+% firewall-cmd --permanent --add-service={freeipa-4,ntp,dns}
+
+
% kinit admin
+# We need to make sure that any A records get a corresponding PTR record, otherwise you're making them manually.
+% ipa dnsconfig-mod --allow-sync-ptr=True
+
+
# Adding a replica
+% ipa-replica-install --setup-dns \
+    --setup-ca \
+    --no-forwarders
+
+# Adding a replica unattended without forwarders
+% ipa-client-install --realm EXAMPLE.COM
+% kinit admin
+% ipa hostgroup-add-member --hosts=ipa02.example.com ipaservers
+% ipa-replica-install --setup-dns \
+    --setup-ca \
+    --no-forwarders \
+    --unattended
+
+

Creating Users, Groups, and Policies

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
UsersLogin NameTypeGroupRoleUID/GID
John SmithjsmithNormaladminsAuto
Bob RufusbrufusNormalcorpAuto
Larry DufusldufusNormalhelpdeskAuto
Robert ColercoleStagedAuto
Thomas SnydertsnyderPreservedAuto
SysHost ManagementsyshostmgtNormalHost Manager10000
+ + + + + + + + + + + + + + + + + + + + + +
GroupsPolicy
HelpDeskhelpdesk
corp
enrollersEnrollment Administrator
+ + + + + + + + + + + + + + + + + + + + + + + + + +
RolesPrivilege
Host ManagerHost administrators
Host group administrators
Netgroups administrators
Host enrollment
+
+

Note

+

Custom UID/GID

+

It is possible to create the users with a custom uid/gid with the switches --uid and --gidnumber which you will see below. It is also possible to set random passwords with --random.

+

See ipa user-add --help for more switches.

+
+
+

Note

+

Password Expiration

+

When you make a user with the --password switch or use ipa passwd to set a password, it is automatically expired and must be changed on next login. If you want to avoid this from happening, you will need to set a random password via --password or --random, and then use kpasswd username to change it to the desired password. This does not make the account non-expiring.

+
+
# Creating users with a password, create all the accounts from the table (except from syshost)
+% ipa user-add --first="John" --last="Smith" --password jsmith
+
+# Create the system account with a password of Sup3R$ecre7! and a UID of 10000
+% ipa user-add --first="SysHost" --last="Management" --uid=10000 --gidnumber=10000 --password syshostmgt
+
+# Stage a user
+% ipa stageuser-add --first="Robert" --last="Cole" rcole
+
+# Preserve a user
+% ipa user-del tsynder --preserve
+
+# Create a regular (POSIX) group
+% ipa group-add corp
+
+# Create a member only group
+% ipa group-add --nonposix HelpDesk
+% ipa group-add --nonposix enrollers
+
+# Add the HelpDesk group to the helpdesk policy
+# Add the enrollers group to the Enrollment Administrator role
+% ipa role-add-member "helpdesk" --groups=HelpDesk
+% ipa role-add-member "Enrollment Administrator" --groups=enrollers
+
+# Create a role with privileges
+% ipa role-add "Host Manager"
+% ipa role-add-privilege "Host Manager" \
+    --privileges="Host administrators" \
+    --privileges="Host group administrators" \
+    --privileges="Netgroups administrators" \
+    --privileges="Host enrollment"
+
+# Add the syshostmgt user as a member of the role
+% ipa role-add-member "Host Manager" --users="syshostmgt"
+
+# Set our user passwords to CentOS123!$ so that way we don't have to change them later
+% kpasswd jsmith
+
+# If we already set the password we want but we don't want it to expire without making a policy or prompt for a password change (NOT RECOMMENDED)
+% ldapmodify -x -w 'Passw0rd!' -D 'cn=Directory Manager'
+dn: uid=syshostmgt,cn=users,cn=accounts,dc=example,dc=com
+changetype: modify
+delete: krbLastPwdChange
+
+(Press CTRL+D)
+
+

New Passwords Expired

+

The common question we receive (and even the #freeipa IRC receive) is "Why can't we just set the password to not be expired right away?" See this page for information on why this is. You may also look at the pagure page and the Red Hat bugzilla related bug.

+

Implement a SSO

+

To setup a very, very simple SSO, you can setup a simple location that requires a login.

+
% ipa-getkeytab -s idm1.example.com -p http/http.example.com -k /etc/httpd/conf/http.keytab
+% vi /etc/httpd/conf.d/location.conf
+<Location "/">
+  AuthType Kerberos
+  AuthName "IPA Kerberos Auth"
+  # Keytab
+  Krb5Keytab /etc/httpd/conf/http.keytab
+  # Kerb settings
+  KrbMethodNegotiate on
+  KrbMethodK5Passwd on
+  KrbServiceName HTTP
+  KrbAuthRealms EXAMPLE.COM
+  KrbSaveCredentials off
+  Require valid-user
+</Location>
+
+

IdM Client Installation and Configuration

+

Install and configure IdM Clients

+ + + + + + + + + + + + + + + + + + + + + +
Client NameIP Address
client.example.com192.168.15.10
nfs.example.com192.168.15.11
utility.example.com192.168.15.12
+
+

Note

+

Depending on your architecture and setup, IdM clients should either be pointing directly at the IdM servers for DNS (at least two of them) or pointing at the DNS server in the environment that is delegating that domain to the IdM domain controllers.

+

In our lab, our IdM servers are our only DNS servers, thus it makes sense that our clients should point to them. In that scenario, you would configure your DHCP server to use the IdM servers as the name servers and/or configure them in a static manner depending on your environment.

+
+
# If your client is not pointing at the IdM DNS and you
+# don't have another DNS server that's performing delegation,
+# change your name servers.
+% nmcli con mod eth0 ipv4.dns 192.168.15.2
+% nmcli con mod eth0 +ipv4.dns 192.168.15.3
+% nmcli con mod eth0 ipv4.dns-search example.com
+
+# Optionally, if your clients don't have DHCP 
+# reservations, set a static address.
+% nmcli con mod eth0 ipv4.address 192.168.15.10/24
+% nmcli con mod eth0 ipv4.gateway 192.168.15.1
+% nmcli con mod eth0 ipv4.method manual
+
+# It might be a good idea to set your hostname if you haven't already
+% hostnamectl set-hostname client.example.com
+% hostname client.example.com
+
+# Install the ipa-client packages
+% yum install ipa-client -y
+% ipa-client-install --realm EXAMPLE.COM --domain example.com
+. . .
+% id admin
+uid=686600000(admin) gid=686600000(admins) groups=686600000(admins)
+
+

Configure Kerberized services

+

One of the things that you may end up doing, whether by hand or in an automated fashion, is creating kerberized services. In a previous section, we addressed creating an NFS service for both a server and a client for the purpose of automating home directory mounts on a client when a user logs in. So you already have the idea of what this entails.

+
# Create kerberos service
+% ipa service-add HTTP/http.example.com
+
+

Not only that, it's probably a good idea to actually get the keytab.

+
% kinit admin
+% ipa-getkeytab -s idm1.example.com -p HTTP/http.example.com -k /etc/krb5.keytab
+
+

For an example of automating keytab creation and retrieval, see the CentOS/FreeIPA page on this site.

+

IdM HA Configuration

+

Configure and manage a certificate authority

+

By default FreeIPA stands up its own CA. And because of this, this allows you or your workplace to be able to issue certificates, that can be used in a wide variety of services, the most common or obvious one would be for Apache httpd.

+

There's a couple of ways you can get a certificate signed by FreeIPA. One method is to generate your own CSR and request it to be signed by FreeIPA. Another way is you can do it all from one command, ipa-getcert, and optionally, either have the certificate in PEM format or an NSS database. We'll address these examples.

+
# Creating an SSL certificate in the PEM format
+% ipa service-add HTTP/http.example.com
+% ipa-getcert request -f /etc/pki/tls/certs/http.pem -k /etc/pki/tls/private/http.key -K HTTP/http.example.com -D http.example.com
+New signing request "20190902000318" added.
+# Verify
+% ipa-getcert list
+Number of certificates and requests being tracked: 1.
+Request ID '20190902000318':
+        status: MONITORING
+        stuck: no
+        key pair storage: type=FILE,location='/etc/pki/tls/private/http.key'
+        certificate: type=FILE,location='/etc/pki/tls/certs/http.pem'
+        CA: IPA
+        issuer: CN=Certificate Authority,O=EXAMPLE.COM
+        subject: CN=http.example.com,O=EXAMPLE.COM
+        expires: 2021-09-02 00:03:19 UTC
+        dns: http.example.com
+        principal name: HTTP/http.example.com@EXAMPLE.COM
+        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
+        eku: id-kp-serverAuth,id-kp-clientAuth
+        pre-save command:
+        post-save command:
+        track: yes
+        auto-renew: yes
+
+# Create an SSL certificate in the NSS format
+% ipa-getcert request -d /etc/pki/tls/certs/nss -n 'Test' -K HTTP/http.example.com -D http.example.com
+New signing request "20190902000756" added.
+# Verify
+% ipa-getcert list
+. . .
+Request ID '20190902000756':
+        status: MONITORING
+        stuck: no
+        key pair storage: type=NSSDB,location='/etc/pki/tls/certs/nss',nickname='Test',token='NSS Certificate DB'
+        certificate: type=NSSDB,location='/etc/pki/tls/certs/nss',nickname='Test',token='NSS Certificate DB'
+        CA: IPA
+        issuer: CN=Certificate Authority,O=EXAMPLE.COM
+        subject: CN=http.example.com,O=EXAMPLE.COM
+        expires: 2021-09-02 00:07:57 UTC
+        dns: http.example.com
+        principal name: HTTP/http.example.com@EXAMPLE.COM
+        key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
+        eku: id-kp-serverAuth,id-kp-clientAuth
+        pre-save command:
+        post-save command:
+        track: yes
+        auto-renew: yes
+
+

By default, when a certificate request is performed (and succeeds to be signed by the IPA CA), it is typically tracked and auto-renewed by default. This is done by the certmonger service, which eliminates the need to have to renew anything by hand.

+

Create Secret Vaults

+

When a domain supports the KRA role, it can hold password vaults or anything that's considered "secret". You can add the KRA role by simply running on each relevant domain controller:

+
% ipa-kra-install
+
+

(more to come)

+

IdM Users and Policies Management

+

In FreeIPA, there are two sets of policies:

+
    +
  • Role Based Access Control (RBAC) which are the permissions, delegated or otherwise, that allow (or deny) access to various pieces of FreeIPA. This can be users that have the ability to reset passwords, modify groups, or perhaps they can issue keytabs. This was partially covered in a previous section.
    • +
  • Host Based Access Control (HBAC) which are the permissions granted to a user or users to access systems on various (PAM) services, such as ssh or logging into a desktop system (eg, GDM).
    • +
+

Configure Policies and User Access

+

HBAC, or Host Based Access Controls, are permissions that grant user or users access to systems via any number of services. The services are PAM services. No doubt you have looked in /etc/pam.d before and have seen quite a few files or even modified them by hand at some point.

+
% ls -l /etc/pam.d/
+total 80
+-rw-r--r--. 1 root root 272 May 11  2019 atd
+-rw-r--r--. 1 root root 232 Apr 15 15:28 config-util
+-rw-r--r--. 1 root root 328 Nov  8  2019 crond
+lrwxrwxrwx. 1 root root  32 Jan 14  2020 fingerprint-auth -> /etc/authselect/fingerprint-auth
+-rw-r--r--. 1 root root  70 Apr 24 06:35 ksu
+-rw-r--r--. 1 root root 715 Apr 24 05:38 login
+-rw-r--r--. 1 root root 154 Apr 15 15:28 other
+-rw-r--r--. 1 root root 168 Apr  6 20:08 passwd
+lrwxrwxrwx. 1 root root  29 Jan 14  2020 password-auth -> /etc/authselect/password-auth
+-rw-r--r--. 1 root root 155 Apr  8 22:00 polkit-1
+lrwxrwxrwx. 1 root root  25 Jan 14  2020 postlogin -> /etc/authselect/postlogin
+-rw-r--r--. 1 root root 640 Apr 24 05:38 remote
+-rw-r--r--. 1 root root 143 Apr 24 05:38 runuser
+-rw-r--r--. 1 root root 138 Apr 24 05:38 runuser-l
+lrwxrwxrwx. 1 root root  30 Jan 14  2020 smartcard-auth -> /etc/authselect/smartcard-auth
+lrwxrwxrwx. 1 root root  25 Jun 15 10:18 smtp -> /etc/alternatives/mta-pam
+-rw-r--r--. 1 root root  76 Apr  6 20:11 smtp.postfix
+-rw-r--r--. 1 root root 727 Feb  4  2020 sshd
+-rw-r--r--. 1 root root 214 Apr 23 20:48 sssd-shadowutils
+-rw-r--r--. 1 root root 566 Apr 24 05:38 su
+-rw-r--r--. 1 root root 154 Apr 23 19:40 sudo
+-rw-r--r--. 1 root root 178 Apr 23 19:40 sudo-i
+-rw-r--r--. 1 root root 137 Apr 24 05:38 su-l
+lrwxrwxrwx. 1 root root  27 Jan 14  2020 system-auth -> /etc/authselect/system-auth
+-rw-r--r--. 1 root root 248 Jul 21 07:57 systemd-user
+-rw-r--r--. 1 root root  84 May 11  2019 vlock
+
+

On a typical Red Hat system, the most common ones (such as su, sshd, sudo) imports the system-auth file, so the login request is processed through those means. When defining HBAC rules, you either must allow "all" services or be selective. For example, if an HBAC rule allows "sshd", a user is allowed to ssh into a system, but wouldn't allow them to login locally, as that goes through login. If you want the user to be able to run the su and sudo commands, you would also need to allow those services. Otherwise, the user is denied, despite sudo policies being available.

+
[label@mgt ~]$ sudo -i
+[sudo] password for label:
+sudo: PAM account management error: Permission denied
+
+

In FreeIPA, there is typically a rule already predefined that allows everyone to access all systems and all services. This can be removed or disabled and this removes host access to everything immediately. This is typically recommended in most environments where there are security standards and procedures in place.

+
# To disable
+% ipa hbacrule-disable allow_all
+# To delete instead
+% ipa hbacrule-del allow_all
+
+

When performing a FreeIPA installation, it is possible to add --no-hbac-allow that will disable the allow_all rule.

+

Below are some examples of adding access.

+
# Allow all admins to access all systems
+% ipa hbacrule-add --hostcat=all --servicecat=all --desc='Allow all admins to access all systems' All_Admins
+% ipa hbacrule-add-user --groups=admins All_Admins
+
+# And then test...
+% ipa hbactest --rules=All_Admins --user=jsmith --host=client.example.com --service=login
+
+
# Allow the corp users to access the client system only using the sshd pam services
+% ipa hbacrule-add --desc='Allow corp users to access client on ssh' corp_access
+% ipa hbacrule-add-user --groups=corp corp_access
+% ipa hbacrule-add-host --hosts=client.example.com corp_access
+% ipa hbacrule-add-service --hbacsvcs=sshd corp_access
+
+# And then test...
+% ipa hbactest --rules=corp_access --user=brufus --host=client.example.com --service=sshd
+
+

Configure roaming/automounted home directories

+

You will need to configure your NFS server to serve up roaming home directories for users and then your client should have automouting enabled.

+
+

Note

+

Client Kerberos Service

+

It may not be required to create an nfs kerberos service for the client. The ipa-client-automount command may already handle this but it does not hurt to create one. In fact, the host keytab is used on the client side anyway. Creating an NFS client keytab may have been required back in the EL6 days.

+
+
# IDM Steps
+% kinit admin
+% ipa service-add nfs/nfs.example.com
+% ipa service-add nfs/client.example.com
+
+# Setup the automounting locations
+% ipa automountmap-add default auto.home
+% ipa automountkey-add default --key "/home" --info auto.home auto.master
+% ipa automountkey-add default --key "*" --info "-fstype=nfs4,rw,sec=krb5,soft nfs.example.com:/exports/home/&" auto.home
+
+# NFS Server Steps
+% yum install nfs-utils -y
+% mkdir /exports/home
+% vi /etc/exports
+/exports/home *(rw,sec=sys:krb5:krb5i:krb5p)
+
+# Make the home directories for all users and move them to /export/home
+% mkhomedir_helper jsmith
+% mv /home/jsmith /export/home/
+
+# Create the necessary keytabs
+% kinit admin
+% ipa-getkeytab -s idm1.example.com -p nfs/nfs.example.com -k /etc/krb5.keytab
+
+# Verify keytab
+% klist -ket /etc/krb5.keytab
+
+# Enable and start nfs
+% systemctl enable nfs-server --now
+
+# Open the necessary firewall ports
+% firewall-cmd --add-service=nfs --permanent
+% firewall-cmd --complete-reload
+
+# Client steps
+% kinit admin
+% ipa-getkeytab -s idm1.example.com -p nfs/client.example.com -k /etc/krb5.keytab
+% ipa-client-automount --location=default
+
+# Verify keytab
+% klist -ket /etc/krb5.keytab
+
+

To test, login to the system via ssh or console and verify the home directory has mounted. /var/log/messages and secure will display errors in case of failure.

+

Configure IdM as an LDAP backend for external services

+

Most services and applications that authenticate users do typically have LDAP support. IdM can be used as an LDAP backend. You typically need only a few things to authenticate users from IdM to an application.

+
    +
  • Base DN, this always ends up being the top level of your domain: dc=example,dc=com - All accounts share this common base.
    • +
  • Bind DN, this is a system account that binds to the directory to assist with searches and authentication
    • +
  • Attribute mappings
    • +
  • Groups, depending on the application
    • +
+

Below is a table of common DN's you may specify in an application:

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
DN'sPathFilter (if applicable)
Base DNdc=example,dc=com
User DNcn=users,cn=accounts,dc=example,dc=comuid=...
Group DNcn=groups,cn=accounts,dc=example,dc=com(objectClass=groupOfNames)
Bind DNuid=account,cn=sysaccounts,cn=etc,dc=example,dc=com
+
% ipa user-show admin --all | grep '^dn'
+  dn: uid=admin,cn=users,cn=accounts,dc=example,dc=com
+
+

Below is a table of common attributes that may be used to map user information in the application.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
TypeAttribute
Login Nameuid
First NamegivenName
Surnamesn
Emailmail
GroupsmemberOf
Full Namecn
+

Below are two ways to create a bind account (bind DN). The first way is the LDAP way. The second way is the ipa-ldap-updater.

+
% kinit admin
+% ldapadd -Y GSSAPI
+. . .
+dn: uid=binder,cn=sysaccounts,cn=etc,dc=example,dc=com
+objectclass: account
+objectclass: simplesecurityobject
+uid: binder
+userPassword: password123
+passwordExpirationTime: 20380119031407Z
+nsIdleTimeout: 0
+# Press CTRL+d
+adding new entry "uid=binder,cn=sysaccounts,cn=etc,dc=example,dc=com"
+
+
% kinit admin
+% cat << EOF > binder.update
+dn: uid=binder,cn=sysaccounts,cn=etc,dc=example,dc=com
+add:objectclass:account
+add:objectclass:simplesecurityobject
+add:uid:binder
+add:userPassword:password123
+add:passwordExpirationTime:20380119031407Z
+add:nsIdleTimeout:0
+EOF
+% ipa-ldap-updater binder.update
+
+

When this account is created, you can then specify the full DN for that object into a bind DN field, along with it's password into an accompanying bind password field.

+

If you'd like an example of setting up Ansible Tower (or AWX, the open source version of tower) against IdM, you can click here.

+
+

Note

+

Kerberos

+

On some applications, it is possible to use kerberos authentication rather than a straight bind account. The general idea is the same when picking out the base dn, attributes, and the like. However, instead you would create an account with an accompanying LDAP/... service principal to do the authentication.

+
+

Creating Trust with AD Domain

+

Create trust relationships with Active Directory

+
+

Note

+

AD Setup

+

We do not cover setting up an AD forest here. This is out of scope for this series. If you are using Server 2016 or higher and you are using "core", look up the commands:

+

Install-WindowsFeature AD-domain-services +Import-Module ADDSDeployment +Install-ADDSForest

+
+ + + + + + + + + + + + + +
Server NameIP Address
ad.example.net192.168.15.15
+

For our trust, the AD server will need to be configured to be the example.net domain with the hostname of ad.example.net. This way, we are not colliding in DNS and both AD and IdM should be able to communicate with each other as two separate forests. It is recommended to use Windows Server 2016 (with the same domain functional level) for this setup, as experience with that product is a recommended prerequisite for the exam.

+
% yum install ipa-server-trust-ad -y
+% firewall-cmd --add-service=freeipa-trust --permanent
+success
+% firewall-cmd --reload
+success
+% ipa-adtrust-install
+. . .
+# This is the admin@REALM IPA account
+admin password:
+
+WARNING: The smb.conf already exists. Running ipa-adtrust-install will break your existing samba configuration.
+
+# Type 'yes' here
+Do you wish to continue? [no]: yes
+
+Do you want to enable support for trusted domains in Schema Compatibility plugin?
+This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.
+
+# You can press enter here to accept the default. If you have BSD, Solaris, Omnios, HP-UX, AIX, or RHEL 5 and older clients
+# you may want to enable this. Some apps may benefit from this also.
+Enable trusted domains support in slapi-nis? [no]:
+
+Enter the NetBIOS name for the IPA domain.
+Only up to 15 uppercase ASCII letters, digits and dashes are allowed.
+Example: EXAMPLE.
+
+# You can accept the default or put your own.
+NetBIOS domain name [IPA]: IPA0
+
+WARNING: 4 existing users or groups do not have a SID identifier assigned.
+Installer can run a task to have ipa-sidgen Directory Server plugin generate
+the SID identifier for all these users. Please note, in case of a high
+number of users and groups, the operation might lead to high replication
+traffic and performance degradation. Refer to ipa-adtrust-install(1) man page
+for details.
+
+# You should always say yes.
+Do you want to run the ipa-sidgen task? [no]: yes
+
+. . .
+
+# This will complete and list ports to open and such. We did this earlier.
+
+

Now that the AD trust components are prepped, depending on the setup, we'll need to do some DNS zone forwards. It is likely you have IPA and AD running their own DNS. Note: This may not be the case in a real world scenario.

+
# We need to create a forward zone here for the example.net zone
+% ipa dnsforwardzone-add example.net --forwarder=192.168.15.15 --forward-policy=only
+Server will check DNS forwarder(s).
+This may take some time, please wait ...
+  Zone name: example.net.
+  Active zone: TRUE
+  Zone forwarders: 192.168.15.15
+  Forward policy: only
+
+# We should probably create a few dns records...
+# Assuming the AD netbios name is EXAMPLEAD, use the syntax hostname.NETBIOS here
+% ipa dnsrecord-add example.com ad.EXAMPLEAD --a-ip-address=192.168.15.15
+# Same idea here, but we're only doing the netbios name and saying the name server record is the AD server
+% ipa dnsrecord-add example.com EXAMPLEAD --ns-hostname=ad.EXAMPLEAD
+
+# We need to allow the zones to be transferable to the AD domain
+% ipa dnszone-mod example.com --allow-transfer=192.168.15.15
+
+

On the AD side, we need to create the IPA zone. It's absolutely required.

+

C:\Windows\System32>dnscmd 127.0.0.1 /ZoneAdd example.com /Secondary 192.168.15.2
+
+You should probably double check that the DNS records are returning on the IDM servers.

+
% dig _ldap._tcp.example.com SRV
+; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> SRV _ldap._tcp.example.com
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14793
+;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 4096
+;; QUESTION SECTION:
+;_ldap._tcp.example.com.      IN      SRV
+
+;; ANSWER SECTION:
+_ldap._tcp.example.com. 86400 IN      SRV     0 100 389 idm1.example.com.
+_ldap._tcp.example.com. 86400 IN      SRV     0 100 389 idm2.example.com.
+
+;; AUTHORITY SECTION:
+example.com.          86400   IN      NS      idm1.example.com.
+example.com.          86400   IN      NS      idm2.example.com.
+
+;; ADDITIONAL SECTION:
+idm1.example.com.      1200    IN      A       192.168.15.2
+idm2.example.com.      1200    IN      A       192.168.15.3
+
+# Same with the AD records
+% dig _ldap._tcp.example.net SRV
+; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> SRV _ldap._tcp.example.net
+;; global options: +cmd
+;; Got answer:
+;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12195
+;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 9
+
+;; OPT PSEUDOSECTION:
+; EDNS: version: 0, flags:; udp: 4096
+;; QUESTION SECTION:
+;_ldap._tcp.example.net.       IN      SRV
+
+;; ANSWER SECTION:
+_ldap._tcp.example.net. 600    IN      SRV     0 100 389 ad.example.net.
+
+. . .
+
+

Now that they are returning, intiate the trust.

+
% ipa trust-add --type=ad example.net --admin Administrator --password
+Active Directiron domain administrator's password: (type password here)
+-----------------------------------------------------
+Added Active Directory trust for realm "example.net"
+-----------------------------------------------------
+  Realm name: example.net
+  Domain NetBIOS name: EXAMPLEAD
+  Domain Security Identifier: S-1-5-21-XXXXXXXXXX-YYYYYYYYY-ZZZZZZZZZZ
+  Trust direction: Trusting forest
+  Trust type: Active Directory domain
+  Trust status: Established and verified
+
+# Check that an AD user is resolvable. You can do this with DOMAIN\name or name@DOMAIN
+% id EXAMPLEAD\\administrator
+% id administrator@example.net
+
+

Authenticate users with an Active Directory domain

+

As we disabled the allow_all rule, let's create a set of groups first and then the HBAC rule.

+
# Create the starting AD group
+% ipa group-add adusers
+# Create an external group. This is required for AD users.
+% ipa group-add --external adgroup_external
+# Add an AD user into the external group
+% ipa group-add-member --users=administrator@example.net adgroup_external
+# Make the external group a member of ad users
+% ipa group-add-member --groups=adgroup_external adusers
+
+

As we've made an HBAC rule before, this should be simple.

+
% ipa hbacrule-add --hostcat=all --servicecat=all --desc='ad users all access' adusers_access
+% ipa hbacrule-add-user --groups=adusers adusers_access
+% ipa hbactest --rules=adusers_access --user=administrator@example.net --host=client.example.com --service=sshd
+
+

The test should pass without any issues.

+
+

Note

+

Group Types

+

While this may not be required information while working on the exam, it's important to understand that there are different group types in AD and the behavior changes based on the group type.

+

Groups in Active Directory have three types. These three types can actually change the behavior of how SSSD on the IPA domain controllers resolve them or if they'll even be resolvable at all. The three types are 'Domain Local', 'Global', and 'Universal'. If at all possible, avoid groups being 'Global'. Domain Local or Universal is recommended.

+
+

IdM maintenance

+

Back up an IdM infrastructure

+

There are multiple ways you can backup IPA.

+
    +
  • Full backup: Default, shuts down IPA before performing a backup. This backs up with raw files. As such, it must be done offline.
    • +
  • Data backup: Backs up a copy of the ldap data and the changelog (the IPA-REALM instance, DogTag, IPA backend). This can be done online.
    • +
+
# Turns off IPA completely and perform a backup
+% ipa-backup
+# Backs up and gpg encrypts
+% ipa-backup --gpg --gpg-keyring=/root/keys
+
+

To restore a backup, the ipa-restore command is available.

+
% ipa-restore /var/lib/ipa/backup/
+
+

Perform a backup without interruption of services

+

The backup command allows you to pass an online flag to ensure a backup taken doesn't down the IPA services. Note that not everything can be backed up online.

+
# Backs up data only and doesn't take down IPA
+% ipa-backup --data --online
+# Backs up data only and gpg encrypts
+% ipa-backup --gpg --gpg-keyring=/root/keys --data --online
+
+

Value Add

+

Use the REST api to query IdM

+

When you invoke the ipa command, you are actually communicating with the API that runs on the IdM replicas. Operations done are sent via a POST with JSON data. The return data is also in JSON and translated to be readable in the terminal. Because it's JSON, custom scripts can be made with say perl or python that communicates with the API to send the calls, perhaps for specific tasks, jobs, or other operations that could be automated. You can also use curl to do this also if you so choose.

+

The question becomes, "well, how do I know the right data to send?" You can issue the -vv switch to see the request being sent.

+
% ipa -vv ping
+ipa: INFO: trying https://idm1.example.com/ipa/json
+ipa: INFO: [try 1]: Forwarding 'schema' to json server 'https://idm1.example.com/ipa/json'
+ipa: INFO: trying https://idm1.example.com/ipa/session/json
+ipa: INFO: [try 1]: Forwarding 'ping/1' to json server 'https://idm1.example.com/ipa/session/json'
+ipa: INFO: Request: {
+    "id": 0, 
+    "method": "ping/1", 
+    "params": [
+        [], 
+        {
+            "version": "2.251"
+        }
+    ]
+}
+ipa: INFO: Response: {
+    "error": null, 
+    "id": 0, 
+    "principal": "admin@EXAMPLE.COM", 
+    "result": {
+        "summary": "IPA server version 4.10.2. API version 2.251"
+    }, 
+    "version": "4.10.2"
+}
+--------------------------------------------
+IPA server version 4.10.2. API version 2.251
+--------------------------------------------
+
+

If you look at the 'request' section, you can see the data that is sent. Each request has a method and params, where method is a command to be excuted and params is simply an array that contains positional arguments and a dictionary of options. If you take a look at say, group-show, you would see a different request.

+
% ipa -vv group-show admins
+ipa: INFO: trying https://idm1.example.com/ipa/session/json
+ipa: INFO: [try 1]: Forwarding 'group_show/1' to json server 'https://idm1.example.com/ipa/session/json'
+ipa: INFO: Request: {
+    "id": 0, 
+    "method": "group_show/1", 
+    "params": [
+        [
+            "admins"
+        ], 
+        {
+            "version": "2.230"
+        }
+    ]
+}
+### Lots of output ###
+
+

Let's say I wanted to perform that in a simple bash script that uses curl. I would perform a kinit and then run the script below to have it login for me via kerberos and do the work.

+
#!/bin/bash
+ipaReplica=idm1.example.com
+cookieJar=my.cookie.jar
+
+# Login with Kerberos
+curl -v \
+  -H referer:https://$ipaReplica/ipa \
+  -c $cookieJar -b $cookieJar \
+  --cacert /etc/ipa/ca.crt \
+  --negotiate -u : \
+  -X POST \
+  https://$ipaReplica/ipa/session/login_kerberos
+
+# Send user_find method request
+curl -v \
+  -H referer:https://$ipaReplica/ipa \
+  -H "Content-Type:application/json" \
+  -H "Accept:applicaton/json"\
+  -c $cookieJar -b $cookieJar \
+  --cacert /etc/ipa/ca.crt \
+  -d  '{"method":"group_show/1","params":[["admins"],{}],"id":0}' \
+  -X POST \
+  https://$ipaReplica/ipa/session/json
+
+

Any of the commands ran via ipa can be reviewed with the -vv switch so you can see what kind of call it's making and how it's making it. Thus, making it easier to tie into your own scripts. On the Web UI, you can go to IPA Server -> API Browser to find more information on the specific API calls.

+

Implement an IdP

+

While not strictly a certification objective at this present time, there may be a chance it could be. FreeIPA 4.10+ have the ability to implement authentication to external identity providers. FreeIPA allows you to use RADIUS proxy authentication for example, but using this same method, an OAuth 2.0 authorization server could be used as well. When it comes to an IdP, you can instead configure IdP clients using ipa idp-add and use software like Keycloak or otherwise that supports OAuth 2.0 workflows. We recommend checking out the FreeIPA Workshop Unit 12 for more details.

+
+
+ +
+
+

Copyright 2024, remyabel, nazunalika

+

Documentation built with MkDocs.

+
+ + + + + + + + + +