From ff497acb51ff154088080fb22847eddd97c543a2 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Thu, 18 Aug 2022 09:49:26 +0300 Subject: [PATCH 01/23] Update requirements & Install Restructure requirements and install according to reqs --- _docs/runtime/installation.md | 74 ++++--- _docs/runtime/requirements.md | 388 +++++----------------------------- 2 files changed, 96 insertions(+), 366 deletions(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index bc151e28a..6363b903f 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -28,20 +28,39 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr ### Installing the hybrid runtime +**Before you begin** +* Make sure you meet the minimum requirements for runtime installation +* Make sure your ingress controller is configured correctly: + * [NGINX Enterprise configuration]({{site.baseurl}}/docs/runtime/requirements/#nginx-enterprise) + + +**How to** 1. Do one of the following: * If this is your first hybrid runtime installation, in the Welcome page, select **+ Install Runtime**. - * If you have provisioned a hybrid runtime, to provision additional runtimes, in the Codefresh UI, go to [**Runtimes**](https://g.codefresh.io/2.0/account-settings/runtimes){:target="\_blank"}, and select **+ Add Runtimes**. -1. Run: + * If you have provisioned a hybrid runtime, to provision additional runtimes, in the Codefresh UI, go to [**Runtimes**](https://g.codefresh.io/2.0/account-settings/runtimes){:target="\_blank"}. +1. Click **+ Add Runtimes**, and then select **Hybrid Runtimes**. +1. Do one of the following: * CLI wizard: Run `cf runtime install`, and follow the prompts to enter the required values. * Silent install: Pass the required flags in the install command: `cf runtime install --repo --git-token --silent` - For the list of flags, see _Hybrid runtime flags_. + For the list of flags, see [Hybrid runtime installation flags](#hybrid-runtime-installation-flags). +1. Complete the configuration for ingress controllers: + * [NGINX Enterprise: Post-installation configuration] > Note: > Hybrid runtime installation starts by checking network connectivity and the K8s cluster server version. To skip these tests, pass the `--skip-cluster-checks` flag. -#### Hybrid runtime flags +### Hybrid runtime installation flags +This section describes the required and optional flags to install a hybrid runtime. +The flags are grouped into: +* Runtime flags, relating to the runtime, cluster and namespace requirements +* Ingress controller flags, relating to ingress controller requirements +* Git repository flags, relating to Git provider requirements + + + +#### Runtime flags **Runtime name** Required. @@ -51,7 +70,7 @@ The runtime name must start with a lower-case character, and can include up to 6 **Namespace resource labels** Optional. -The label of the namespace resource to which you are installing the hybrid runtime. You can add more than one label. Labels are required to identity the networks that need access during installation, as is the case when using services meshes such as Istio for example. +The label of the namespace resource to which you are installing the hybrid runtime. Labels are required to identity the networks that need access during installation, as is the case when using services meshes such as Istio for example. * CLI wizard and Silent install: Add the `--namespace-labels` flag, and define the labels in `key=value` format. Separate multiple labels with `commas`. @@ -62,9 +81,19 @@ The cluster defined as the default for `kubectl`. If you have more than one Kube * CLI wizard: Select the Kube context from the list displayed. * Silent install: Explicitly specify the Kube context with the `--context` flag. +**Shared configuration repository** +The Git repository per runtime account with shared configuration manifests. +* CLI wizard and Silent install: Add the `--shared-config-repo` flag and define the path to the shared repo. + +#### Ingress controller flags + +**Skip ingress** +Optional. +If you are not using one of the supported ingress controllers, bypass installing ingress resources with the `--skip-ingress` flag. +In this case, after completing the installation, manually configure the cluster's routing service, and create and register Git integrations. See _Cluster routing service_ in [Post-installation configuration](#post-installation-configuration). + **Ingress class** -Required. -If you have more than one ingress class configured on your cluster: +Required if you have more than one ingress class configured on your cluster. * CLI wizard: Select the ingress class for runtime installation from the list displayed. * Silent install: Explicitly specify the ingress class through the `--ingress-class` flag. Otherwise, runtime installation fails. @@ -77,10 +106,11 @@ The IP address or host name of the ingress controller component. * Silent install: Add the `--ingress-host` flag. If a value is not provided, takes the host from the ingress controller associated with the **Ingress class**. > Important: For AWS ALB, the ingress host is created post-installation. However, when prompted, add the domain name you will create in `Route 53` as the ingress host. +**Insecure ingress hosts** SSL certificates for the ingress host: If the ingress host does not have a valid SSL certificate, you can continue with the installation in insecure mode, which disables certificate validation. -* CLI wizard: Automatically detects and prompts you to confirm continuing with the installation in insecure mode. +* CLI wizard: Automatically detects and prompts you to confirm continuing the installation in insecure mode. * Silent install: To continue with the installation in insecure mode, add the `--insecure-ingress-host` flag. **Internal ingress host** @@ -92,17 +122,8 @@ For both CLI wizard and Silent install: * For existing installations, commit changes to the installation repository by modifying the `app-proxy ingress` and `.yaml` See _Internal ingress host configuration (optional for existing runtimes only)_ in [Post-installation configuration](#post-installation-configuration). -**Ingress resources** -Optional. -If you have a different routing service (not NGINX), bypass installing ingress resources with the `--skip-ingress` flag. -In this case, after completing the installation, manually configure the cluster's routing service, and create and register Git integrations. See _Cluster routing service_ in [Post-installation configuration](#post-installation-configuration). -**Shared configuration repository** -The Git repository per runtime account with shared configuration manifests. -* CLI wizard and Silent install: Add the `--shared-config-repo` flag and define the path to the shared repo. - -**Insecure flag** -For _on-premises installations_, if the Ingress controller does not have a valid SSL certificate, to continue with the installation, add the `--insecure` flag to the installation command. +#### Git repository flags **Repository URLs** The GitHub repository to house the installation definitions. @@ -121,6 +142,9 @@ Install demo pipelines to use as a starting point to create your own pipelines. * Silent install: Add the `--demo-resources` flag. By default, set to `true`. +**Insecure flag** +For _on-premises installations_, if the Ingress controller does not have a valid SSL certificate, to continue with the installation, add the `--insecure` flag to the installation command. + ### Hybrid runtime components **Git repositories** @@ -155,21 +179,7 @@ After provisioning a hybrid runtime, configure additional settings for the follo * (Existing hybrid runtimes) Internal and external ingress host specifications * Register Git integrations -#### NGINX Enterprise post-install configuration - -You must patch the certificate secret in `spec.tls` of the `ingress-master` resource. - -Configure the `ingress-master` with the certificate secret. The secret must be in the same namespace as the runtime. - -1. Go to the runtime namespace with the NGINX ingress controller. -1. In `ingress-master`, add to `spec.tls`: - ```yaml - tls: - - hosts: - - - secretName: - ``` #### AWS ALB post-install configuration diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 01883380a..76106a8a3 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -12,74 +12,56 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri >In the documentation, Kubernetes and K8s are used interchangeably. +### Minimum requirements -### Kubernetes cluster requirements -This section lists cluster requirements. - -#### Cluster version -Kubernetes cluster, server version 1.18 and higher, without Argo Project components. -> Tip: -> To check the server version, run `kubectl version --short`. - - -#### Ingress controller -Configure your Kubernetes cluster with an ingress controller component that is exposed from the cluster. - -**Supported ingress controllers** - - {: .table .table-bordered .table-hover} -| Supported Ingress Controller | Reference| -| -------------- | -------------- | -| Ambassador | [Ambassador ingress controller documentation](https://www.getambassador.io/docs/edge-stack/latest/topics/running/ingress-controller/){:target="\_blank"} | -| ALB (AWS Application Load Balancer) | [AWS ALB ingress controller documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/){:target="\_blank"} | -| NGINX Enterprise (`nginx.org/ingress-controller`) | [NGINX Ingress Controller documentation](https://docs.nginx.com/nginx-ingress-controller/){:target="\_blank"} | -| NGINX Community (`k8s.io/ingress-nginx`) | [Provider-specific configuration](#nginx-community-version-provider-specific-ingress-configuration) in this article| -| Istio | [Istio Kubernetes ingress documentation](https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress/){:target="\_blank"} | -| Traefik |[Traefik Kubernetes ingress documentation](https://doc.traefik.io/traefik/providers/kubernetes-ingress/){:target="\_blank"}| - - -**Ingress controller requirements** - -* Valid external IP address - Run `kubectl get svc -A` to get a list of services and verify that the EXTERNAL-IP column for your ingress controller shows a valid hostname. - -* Valid SSL certificate - For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). +{: .table .table-bordered .table-hover} +| Item | Requirement | +| -------------- | -------------- | +|Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. Tip: To check the server version, run `kubectl version --short`.| +| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}
  • Ambassador
  • ALB (AWS Application Load Balancer)
  • NGINX Enterprise (nginx.org/ingress-controller)
  • NGINX Community (k8s.io/ingress-nginx)
  • Istio
    • Trafik

See XREF {:/}| +|Node requirements| {::nomarkdown}
  • Memory: 5000 MB
  • CPU: 2
{:/}| +|Runtime namespace | resource permissions| +| | `ServiceAccount`: Create, Delete | +| | `ConfigMap`: Create, Update, Delete | +| | `Service`: Create, Update, Delete | +| | `Role`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | +| |`RoleBinding`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | +| | `persistentvolumeclaims`: Create, Update, Delete | +| | `pods`: Create, Update, Delete | +| Git providers | {::nomarkdown}
  • Hosted: GitHub
  • Hybrid:
    • GitHub
    • GitLab
      • Bitbucket Server
    • GitHub Enterprise
| +| Git access tokens | {::nomarkdown}
  • Runtime Git token:
    • Valid expiration date
    • Scopes: `repo` and `admin-repo.hook`
  • Runtime Git token:
    • Valid expiration date
    • Scopes: `repo` and `admin-repo.hook`
| + +### NGINX Enterprise configuration +For general information see [NGINX ingress controller](https://docs.nginx.com/nginx-ingress-controller){:target="\_blank}. -* TCP support - Make sure your ingress controller is configured to handle TCP requests. For exact configuraton requirements, refer to the offiical documentation of the ingress controller you are using. - - Here's an example of TCP configuration for NGINX on AWS. - Verify that the ingress-nginx-controller service manifest has either of the following annotations: +{: .table .table-bordered .table-hover} +| When to configure | What to configure | +| -------------- | -------------- | +| Before install | [Verify valid external IP address](#verify-valid-external-ip-address) | +| | [Valid SSL certificate](#valid-ssl-certificate) | +| | [TCP support](#tcp-support) | +| | [Report status](#report-status) | +| After install | [Patch certificate secret](#verify-valid-external-ip-address) | - `service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "tcp"` - OR - `service.beta.kubernetes.io/aws-load-balancer-type: nlb` -* AWS ALB - In the ingress resource file, verify that `spec.controller` is configured as `ingress.k8s.aws/alb`. -```yaml -apiVersion: networking.k8s.io/v1 -kind: IngressClass -metadata: - name: alb -spec: - controller: ingress.k8s.aws/alb -``` +#### Valid external IP address +Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. + +#### Valid SSL certificate +For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). -* Report status - The ingress controller must be configured to report its status. Otherwise, Argo's health check reports the health status as "progressing" resulting in a timeout error during installation. - - By default, NGINX Enterprise and Traefik ingress are not configured to report status. For details on configuration settings, see the following sections in this article: - [NGINX Enterprise ingress configuration](#nginx-enterprise-version-ingress-configuration) - [Traefik ingress configuration](#traefik-ingress-configuration) +#### TCP support +Configure to handle TCP requests. +Here's an example of TCP configuration for NGINX on AWS. +Verify that the ingress-nginx-controller service manifest has either of the following annotations: -#### NGINX Enterprise version ingress configuration -The Enterprise version of NGINX (`nginx.org/ingress-controller`), both with and without the Ingress Operator, must be configured to report the status of the ingress controller. +`service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "tcp"` +OR +`service.beta.kubernetes.io/aws-load-balancer-type: nlb` -**Installation with NGINX Ingress** +#### NGINX Ingress: Enable reporting status * Pass the `- -report-ingress-status` to `deployment`. ```yaml @@ -89,7 +71,7 @@ The Enterprise version of NGINX (`nginx.org/ingress-controller`), both with and - -report-ingress-status ``` -**Installation with NGINX Ingress Operator** +#### NGINX Ingress Operator: Enable reporting status 1. Add this to the `Nginxingresscontrollers` resource file: @@ -104,287 +86,25 @@ The Enterprise version of NGINX (`nginx.org/ingress-controller`), both with and 1. Make sure you have a certificate secret in the same namespace as the runtime. Copy an existing secret if you don't have one. You will need to add this to the `ingress-master` when you have completed runtime installation. -#### NGINX Community version provider-specific ingress configuration -Codefresh has been tested and is supported in major providers. For your convenience, here are provider-specific configuration instructions, both for supported and untested providers. - -> The instructions are valid for `k8s.io/ingress-nginx`, the community version of NGINX. - -
-AWS -
    -
  1. Apply:
    - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/aws/deploy.yaml -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-For additional configuration options, see ingress-nginx documentation for AWS. -
-
-Azure (AKS) -
    -
  1. Apply:
    - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-For additional configuration options, see ingress-nginx documentation for AKS. - -
- -
-Bare Metal Clusters -
    -
  1. Apply:
    - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/baremetal/deploy.yaml -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-Bare-metal clusters often have additional considerations. See Bare-metal ingress-nginx considerations. - -
- -
-Digital Ocean -
    -
  1. Apply:
    - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/do/deploy.yaml -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-For additional configuration options, see ingress-nginx documentation for Digital Ocean. - -
- -
-Docker Desktop -
    -
  1. Apply:
    - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-For additional configuration options, see ingress-nginx documentation for Docker Desktop.
-Note: By default, Docker Desktop services will provision with localhost as their external address. Triggers in delivery pipelines cannot reach this instance unless they originate from the same machine where Docker Desktop is being used. - -
- -
-Exoscale -
    -
  1. Apply:
    - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/exoscale/deploy.yaml -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-For additional configuration options, see ingress-nginx documentation for Exoscale. - -
- - -
-Google (GKE) -
-Add firewall rules -
-GKE by default limits outbound requests from nodes. For the runtime to communicate with the control-plane in Codefresh, add a firewall-specific rule. - -
    -
  1. Find your cluster's network:
    - gcloud container clusters describe [CLUSTER_NAME] --format=get"(network)" -
    2. -
  2. Get the Cluster IPV4 CIDR:
    - gcloud container clusters describe [CLUSTER_NAME] --format=get"(clusterIpv4Cidr)" -
    3. -
  3. Replace the `[CLUSTER_NAME]`, `[NETWORK]`, and `[CLUSTER_IPV4_CIDR]`, with the relevant values:
    - gcloud compute firewall-rules create "[CLUSTER_NAME]-to-all-vms-on-network"
    - - --network="[NETWORK]" \ -
    - - --source-ranges="[CLUSTER_IPV4_CIDR]" \ -
    - - --allow=tcp,udp,icmp,esp,ah,sctp -
    -
    4. -
-
-Use ingress-nginx
-
    -
  1. Create a `cluster-admin` role binding:
    - - kubectl create clusterrolebinding cluster-admin-binding \ -
    - - --clusterrole cluster-admin \ -
    - - --user $(gcloud config get-value account) -
    -
    2. -
  2. Apply:
    - - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml - -
    3. -
  3. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    4. - -
-We recommend reviewing the provider-specific documentation for GKE. +#### Patch certificate secret +> This configuration must be completed _after_ installation. -
+Patch the certificate secret in `spec.tls` of the `ingress-master` resource. +The secret must be in the same namespace as the runtime. +1. Go to the runtime namespace with the NGINX ingress controller. +1. In `ingress-master`, add to `spec.tls`: -
-MicroK8s -
    -
  1. Install using Microk8s addon system:
    - microk8s enable ingress -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-MicroK8s has not been tested with Codefresh, and may require additional configuration. For details, see Ingress addon documentation. - -
- - -
-MiniKube -
    -
  1. Install using MiniKube addon system:
    - minikube addons enable ingress -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-MiniKube has not been tested with Codefresh, and may require additional configuration. For details, see Ingress addon documentation. - -
- - - -
-Oracle Cloud Infrastructure -
    -
  1. Apply:
    - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-For additional configuration options, see ingress-nginx documentation for Oracle Cloud. - -
- -
-Scaleway -
    -
  1. Apply:
    - kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/scw/deploy.yaml -
    2. -
  2. Verify a valid external address exists:
    - kubectl get svc ingress-nginx-controller -n ingress-nginx -
    3. -
-For additional configuration options, see ingress-nginx documentation for Scaleway. - -
-
- -#### Traefik ingress configuration -To enable the the Traefik ingress controller to report the status, add `publishedService` to `providers.kubernetesIngress.ingressEndpoint`. - -The value must be in the format `"/"`, where: - `` is the Traefik service from which to copy the status - - ```yaml - ... - providers: - kubernetesIngress: - ingressEndpoint: - publishedService: "/" # Example, "codefresh/traefik-default" ... - ... - ``` - -#### Node requirements -* Memory: 5000 MB -* CPU: 2 - -#### Runtime namespace permissions for resources - -{: .table .table-bordered .table-hover} -| Resource | Permissions Required| -| -------------- | -------------- | -| `ServiceAccount` | Create, Delete | -| `ConfigMap` | Create, Update, Delete | -| `Service` | Create, Update, Delete | -| `Role` | In group `rbac.authorization.k8s.io`: Create, Update, Delete | -| `RoleBinding` | In group `rbac.authorization.k8s.io`: Create, Update, Delete | -| `persistentvolumeclaims` | Create, Update, Delete | -| `pods` | Creat, Update, Delete | - -### Git repository requirements -This section lists the requirements for Git installation repositories. - -#### Git installation repo -If you are using an existing repo, make sure it is empty. - -#### Git access tokens -Codefresh requires two access tokens, one for runtime installation, and the second, a personal token for each user to authenticate Git-based actions in Codefresh. - -##### Git runtime token -The Git runtime token is mandatory for runtime installation. + ```yaml + tls: + - hosts: + - + secretName: + ``` -The token must have valid: - * Expiration date: Default is `30 days` - * Scopes: `repo` and `admin-repo.hook` - - {% include - image.html - lightbox="true" - file="/images/getting-started/quick-start/quick-start-git-event-permissions.png" - url="/images/getting-started/quick-start/quick-start-git-event-permissions.png" - alt="Scopes for Git runtime token" - caption="Scopes for Git runtime token" - max-width="30%" - %} -##### Git user token for Git-based actions -The Git user token is the user's personal token and is unique to every user. It is used to authenticate every Git-based action of the user in Codefresh. You can add the Git user token at any time from the UI. - The token must have valid: - * Expiration date: Default is `30 days` - * Scope: `repo` - {% include - image.html - lightbox="true" - file="/images/runtime/git-token-scope-resource-repos.png" - url="/images/runtime/git-token-scope-resource-repos.png" - alt="Scope for Git personal user token" - caption="Scope for Git personal user token" - max-width="30%" - %} - -For detailed information on GitHub tokens, see [Creating a personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token). ### What to read next From c85b6536a75b587889937b33a6c6d4b05852d7fc Mon Sep 17 00:00:00 2001 From: NimRegev Date: Thu, 18 Aug 2022 10:19:16 +0300 Subject: [PATCH 02/23] Update requirements and installation --- _docs/deployment/sync-application.md | 68 +++++ _docs/runtime/installation.md | 15 +- _docs/runtime/installation_original.md | 338 ++++++++++++++++++++++ _docs/runtime/requirements.md | 36 ++- _docs/runtime/requirements_orig.md | 384 +++++++++++++++++++++++++ 5 files changed, 813 insertions(+), 28 deletions(-) create mode 100644 _docs/deployment/sync-application.md create mode 100644 _docs/runtime/installation_original.md create mode 100644 _docs/runtime/requirements_orig.md diff --git a/_docs/deployment/sync-application.md b/_docs/deployment/sync-application.md new file mode 100644 index 000000000..beec44f8c --- /dev/null +++ b/_docs/deployment/sync-application.md @@ -0,0 +1,68 @@ +--- +title: "Sync applications" +description: "" +group: deployment +toc: true +--- + +Sync applications directly from the Codefresh UI + +The Synchonuze option si + + +The set of options for application synchronization identical to that of Argo CD. In Codefresh, they are grouped into sets: Revision and Additional Options. + + +### Synchronize application + + +Codefresh groups Synchronization options By + +### Revision settings for application sync +revision - The branch to be checked out when a deployment happens + +Prune: When selected, removes legacy resources that do not exist currently in Git. If pruning is not enforced and Argo CD identifies resources that require pruning, it displays them in the +Read more in [No Prune Resources](https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#no-prune-resources){:target="\_blank"}. + +Apply only: When selected, applies Kubernetes sever-side apply with field-management controls for patches and updates. Modifications to fields foChanges to a field of which you are not the manager results by If a new field is created, the new ownCompared to the last-applied annotation managed by kubectl, Server Side Apply uses a more declarative approach, which tracks a user's field management, rather than a user's last applied state. This means that as a side effect of using Server Side Apply, information about which field manager manages each field in an object also becomes available. + +For a user to manage a field, in the Server Side Apply sense, means that the user relies on and expects the value of the field not to change. The user who last made an assertion about the value of a field will be recorded as the current field manager. This can be done either by changing the value with POST, PUT, or non-apply PATCH, or by including the field in a config sent to the Server Side Apply endpoint. When using Server-Side Apply, trying to change a field which is managed by someone else will result in a rejected request (if not forced, see Conflicts). +Read more in instead of the client-side apply. when syncinng the application. We have a use case I don't see discussed much. We leverage mutating webhooks to provide lots of valuable default configuration for our Kubernetes users. An issue with this is that when running kubectl apply, the mutation will not take place if there is no difference between the desired and live states (I believe kubectl doesn't try to apply the patch in this case). However, when running kubectl apply --server-side, the mutations are always applied. + +SSA controls modification right by clarifying field ownership, which can effectively prevent wrong modification. Understanding SSA merge policy and under what circumstances users can modify fields is necessary. + +Whether it is an update or a patch, there will be three circumstances. + +The current manager is the manager of all fields. Then the operation can proceed normally. +The current manager is not the manager of some fields. The current operation can continue if those fields are not modified, and the current manager will be added to the fieldManager of the field as co-manager(sharedmanager). +Modify non-manager fields, and conflicts occur. You can override value by becoming a shared manager or force the modification using--force-conflict. + +Our users primarily interact with Kubernetes through ArgoCD. Without Argo CD supporting server-side apply, there is no way apply these mutations unless the resource actually has some new desired state. + +Dry run: When selected, skips dry run for resources that are not known to the cluster. This option is useful when CRDs for custom resources are not created as part of the sync mechanism, but creatd by other mechanisms. In such cases, Argo CD's default behavior is to automatically fail the sync with the server could not find requested resource error. +Read more in [Skip Dry Run for new custom resource types](https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#skip-dry-run-for-new-custom-resources-types){:target="\_blank"}. + +Force +When selected, orphans (deletes??) the dependents of a deleted resource during the sync operation. This option is useful to prevent + +### Additional Options for application sync + +Sync options are described in ???? +Respect ignore differences +When selected, ignore differences between all resources in the applicaion that could not be synced or resolved. +Read more in [Argo CD Diffing Customization](https://argo-cd.readthedocs.io/en/stable/user-guide/diffing/){:target="\_blank"}. + +#### Prune propagation policy +{::nomarkdown}Defines how resources are pruned, applying Kubernetes cascading deletion prune policies. +Read more at Kubernetes - Cascading deletion.
  • Foreground: The default prune propagation policy used by Argo CD. With this policy, Kubernetes changes the state of the owner resource to `deletion in progress`, until the controller deletes the dependent resources and finally the owner resource itself.
  • Background: When selected, Kubernetes deletes the owner resource immediately, and then deletes the dependent resources in the background.
  • Orphan: When selected, Kubernetes deletes the dependent resources that remain orphaned after the owner resource is deleted.

{:/} +All Prune propagation policies can be used with: + + +**Replace**: When selected, Argo CD executes `kubectl replace` or `kubectl create`, instead of the default `kubectl apply` to enforce the changes in Git. This action will potentially recreate resources and should be used with care. See [Replace Resource Instead Of Applying Change](https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#replace-resource-instead-of-applying-changes){:target="_blank"}. + + +**Retry**: When selected, retries a failed sync operation, based on the retry settings configured: +* Maximum number of sync retries (**Limit**) +* Duration of each retry attempt in seconds, minutes, or hours (**Duration**) +* Maximum duration permitted for each retry (**Max Duration**) +* Factor by which to multiply the Duration in the event of a failed retry (**Factor**). A factor of 2 for example, attempts the second retry in 2 X 2 seconds, where 2 seconds is the Duration. \ No newline at end of file diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 6363b903f..e2b876707 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -31,7 +31,7 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr **Before you begin** * Make sure you meet the minimum requirements for runtime installation * Make sure your ingress controller is configured correctly: - * [NGINX Enterprise configuration]({{site.baseurl}}/docs/runtime/requirements/#nginx-enterprise) + * [NGINX Enterprise configuration]({{site.baseurl}}/docs/runtime/requirements/#nginx-enterprise-configuration) **How to** @@ -45,7 +45,7 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr `cf runtime install --repo --git-token --silent` For the list of flags, see [Hybrid runtime installation flags](#hybrid-runtime-installation-flags). 1. Complete the configuration for ingress controllers: - * [NGINX Enterprise: Post-installation configuration] + * [NGINX Ingress Operator: Patch certificate secret]({{site.baseurl}}/docs/runtime/requirements/#nginx-ingress-operator-patch-certificate-secret) > Note: > Hybrid runtime installation starts by checking network connectivity and the K8s cluster server version. @@ -53,13 +53,12 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr ### Hybrid runtime installation flags This section describes the required and optional flags to install a hybrid runtime. -The flags are grouped into: -* Runtime flags, relating to the runtime, cluster and namespace requirements +For documentation purposes, the flags are grouped into: +* Runtime flags, relating to runtime, cluster, and namespace requirements * Ingress controller flags, relating to ingress controller requirements * Git repository flags, relating to Git provider requirements - #### Runtime flags **Runtime name** @@ -88,8 +87,8 @@ The Git repository per runtime account with shared configuration manifests. #### Ingress controller flags **Skip ingress** -Optional. -If you are not using one of the supported ingress controllers, bypass installing ingress resources with the `--skip-ingress` flag. +Required, if you are using an unsupported ingress controller. +For unsupported ingress controllers, bypass installing ingress resources with the `--skip-ingress` flag. In this case, after completing the installation, manually configure the cluster's routing service, and create and register Git integrations. See _Cluster routing service_ in [Post-installation configuration](#post-installation-configuration). **Ingress class** @@ -106,7 +105,7 @@ The IP address or host name of the ingress controller component. * Silent install: Add the `--ingress-host` flag. If a value is not provided, takes the host from the ingress controller associated with the **Ingress class**. > Important: For AWS ALB, the ingress host is created post-installation. However, when prompted, add the domain name you will create in `Route 53` as the ingress host. -**Insecure ingress hosts** +**Insecure ingress hosts** SSL certificates for the ingress host: If the ingress host does not have a valid SSL certificate, you can continue with the installation in insecure mode, which disables certificate validation. diff --git a/_docs/runtime/installation_original.md b/_docs/runtime/installation_original.md new file mode 100644 index 000000000..e0a2eb48a --- /dev/null +++ b/_docs/runtime/installation_original.md @@ -0,0 +1,338 @@ +--- +title: "Install hybrid runtimes" +description: "" +group: runtime +toc: true +--- + +If you have a hybrid environment, you can provision one or more hybrid runtimes in your Codefresh account. The hybrid runtime comprises Argo CD components and Codefresh-specific components. The Argo CD components are derived from a fork of the Argo ecosystem, and do not correspond to the open-source versions available. + +> If you have Hosted GitOps, to provision a hosted runtime, see [Provision a hosted runtime]({{site.baseurl}}/docs/runtime/hosted-runtime/#1-provision-hosted-runtime) in [Set up a hosted (Hosted GitOps) environment]({{site.baseurl}}/docs/runtime/hosted-runtime/). + +There are two parts to installing a hybrid runtime: + +1. Installing the Codefresh CLI +2. Installing the hybrid runtime from the CLI, either through the CLI wizard or via silent installation. + The hybrid runtime is installed in a specific namespace on your cluster. You can install more runtimes on different clusters in your deployment. + Every hybrid runtime installation makes commits to two Git repos: + + * Runtime install repo: The installation repo that manages the hybrid runtime itself with Argo CD. If the repo URL does not exist, runtime creates it automatically. + * Git Source repo: Created automatically during runtime installation. The repo where you store manifests to run CodefreshCodefresh pipelines. + +See also [Codefresh architecture]({{site.baseurl}}/docs/getting-started/architecture). + +### Installing the Codefresh CLI + +Install the Codefresh CLI using the option that best suits you: `curl`, `brew`, or standard download. +If you are not sure which OS to select for `curl`, simply select one, and Codefresh automatically identifies and selects the right OS for CLI installation. + +### Installing the hybrid runtime + +1. Do one of the following: + * If this is your first hybrid runtime installation, in the Welcome page, select **+ Install Runtime**. + * If you have provisioned a hybrid runtime, to provision additional runtimes, in the Codefresh UI, go to [**Runtimes**](https://g.codefresh.io/2.0/account-settings/runtimes){:target="\_blank"}, and select **+ Add Runtimes**. +1. Run: + * CLI wizard: Run `cf runtime install`, and follow the prompts to enter the required values. + * Silent install: Pass the required flags in the install command: + `cf runtime install --repo --git-token --silent` + For the list of flags, see _Hybrid runtime flags_. + +> Note: +> Hybrid runtime installation starts by checking network connectivity and the K8s cluster server version. + To skip these tests, pass the `--skip-cluster-checks` flag. + +#### Hybrid runtime flags + +**Runtime name** +Required. +The runtime name must start with a lower-case character, and can include up to 62 lower-case characters and numbers. +* CLI wizard: Add when prompted. +* Silent install: Required. + +**Namespace resource labels** +Optional. +The label of the namespace resource to which you are installing the hybrid runtime. You can add more than one label. Labels are required to identity the networks that need access during installation, as is the case when using services meshes such as Istio for example. + +* CLI wizard and Silent install: Add the `--namespace-labels` flag, and define the labels in `key=value` format. Separate multiple labels with `commas`. + +**Kube context** +Required. +The cluster defined as the default for `kubectl`. If you have more than one Kube context, the current context is selected by default. + +* CLI wizard: Select the Kube context from the list displayed. +* Silent install: Explicitly specify the Kube context with the `--context` flag. + +**Ingress class** +Required. +If you have more than one ingress class configured on your cluster: + +* CLI wizard: Select the ingress class for runtime installation from the list displayed. +* Silent install: Explicitly specify the ingress class through the `--ingress-class` flag. Otherwise, runtime installation fails. + +**Ingress host** +Required. +The IP address or host name of the ingress controller component. + +* CLI wizard: Automatically selects and displays the host, either from the cluster or the ingress controller associated with the **Ingress class**. +* Silent install: Add the `--ingress-host` flag. If a value is not provided, takes the host from the ingress controller associated with the **Ingress class**. + > Important: For AWS ALB, the ingress host is created post-installation. However, when prompted, add the domain name you will create in `Route 53` as the ingress host. + +SSL certificates for the ingress host: +If the ingress host does not have a valid SSL certificate, you can continue with the installation in insecure mode, which disables certificate validation. + +* CLI wizard: Automatically detects and prompts you to confirm continuing with the installation in insecure mode. +* Silent install: To continue with the installation in insecure mode, add the `--insecure-ingress-host` flag. + +**Internal ingress host** +Optional. +Enforce separation between internal (app-proxy) and external (webhook) communication by adding an internal ingress host for the app-proxy service in the internal network. +For both CLI wizard and Silent install: + +* For new runtime installations, add the `--internal-ingress-host` flag pointing to the ingress host for `app-proxy`. +* For existing installations, commit changes to the installation repository by modifying the `app-proxy ingress` and `.yaml` + See _Internal ingress host configuration (optional for existing runtimes only)_ in [Post-installation configuration](#post-installation-configuration). + +**Ingress resources** +Optional. +If you have a different routing service (not NGINX), bypass installing ingress resources with the `--skip-ingress` flag. +In this case, after completing the installation, manually configure the cluster's routing service, and create and register Git integrations. See _Cluster routing service_ in [Post-installation configuration](#post-installation-configuration). + +**Shared configuration repository** +The Git repository per runtime account with shared configuration manifests. +* CLI wizard and Silent install: Add the `--shared-config-repo` flag and define the path to the shared repo. + +**Insecure flag** +For _on-premises installations_, if the Ingress controller does not have a valid SSL certificate, to continue with the installation, add the `--insecure` flag to the installation command. + +**Repository URLs** +The GitHub repository to house the installation definitions. + +* CLI wizard: If the repo doesn't exist, Codefresh creates it during runtime installation. +* Silent install: Required. Add the `--repo` flag. + +**Git runtime token** +Required. +The Git token authenticating access to the GitHub installation repository. +* Silent install: Add the `--git-token` flag. + +**Codefresh demo resources** +Optional. +Install demo pipelines to use as a starting point to create your own pipelines. We recommend installing the demo resources as these are used in our quick start tutorials. + +* Silent install: Add the `--demo-resources` flag. By default, set to `true`. + +### Hybrid runtime components + +**Git repositories** + +* Runtime install repo: The installation repo contains three folders: apps, bootstrap and projects, to manage the runtime itself with Argo CD. +* Git source repository: Created with the name `[repo_name]_git-source`. This repo stores manifests for pipelines with sources, events, workflow templates. + +**Argo CD components** + +* Project, comprising an Argo CD AppProject and an ApplicationSet +* Installations of the following applications in the project: + * Argo CD + * Argo Workflows + * Argo Events + * Argo Rollouts + +**Codefresh-specific components** + +* Codefresh Applications in the Argo CD AppProject: + * App-proxy facilitating behind-firewall access to Git + * Git Source entity that references the`[repo_name]_git-source` + +Once the hybrid runtime is successfully installed, it is provisioned on the Kubernetes cluster, and displayed in the **Runtimes** page. + +### Hybrid runtime post-installation configuration + +After provisioning a hybrid runtime, configure additional settings for the following: + +* NGINX Enterprise installations (with and without NGINX Ingress Operator) +* AWS ALB installations +* Cluster routing service if you bypassed installing ingress resources +* (Existing hybrid runtimes) Internal and external ingress host specifications +* Register Git integrations + + + +#### AWS ALB post-install configuration + +For AWS ALB installations, do the following: + +* Create an `Alias` record in Amazon Route 53 +* Manually register Git integrations - see _Git integration registration_. + +Create an `Alias` record in Amazon Route 53, and map your zone apex (example.com) DNS name to your Amazon CloudFront distribution. +For more information, see [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html){:target="\_blank"}. + +{% include image.html + lightbox="true" + file="/images/runtime/post-install-alb-ingress.png" + url="/images/runtime/post-install-alb-ingress.png" + alt="Route 53 record settings for AWS ALB" + caption="Route 53 record settings for AWS ALB" + max-width="30%" +%} + +#### Configure cluster routing service + +If you bypassed installing ingress resources with the `--skip-ingress` flag, configure the `host` for the Ingress, or the VirtualService for Istio if used, to route traffic to the `app-proxy` and `webhook` services, as in the examples below. + +**Ingress resource example for `app-proxy`:** + +```yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: codefresh-cap-app-proxy + namespace: codefresh +spec: + ingressClassName: alb + rules: + - host: my.support.cf-cd.com # replace with your host name + http: + paths: + - backend: + service: + name: cap-app-proxy + port: + number: 3017 + path: /app-proxy/ + pathType: Prefix +``` + +**`VirtualService` examples for `app-proxy` and `webhook`:** + +```yaml +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + namespace: test-runtime3 # replace with your runtime name + name: cap-app-proxy +spec: + hosts: + - my.support.cf-cd.com # replace with your host name + gateways: + - my-gateway + http: + - match: + - uri: + prefix: /app-proxy + route: + - destination: + host: cap-app-proxy + port: + number: 3017 +``` + +```yaml +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + namespace: test-runtime3 # replace with your runtime name + name: csdp-default-git-source +spec: + hosts: + - my.support.cf-cd.com # replace with your host name + gateways: + - my-gateway + http: + - match: + - uri: + prefix: /webhooks/test-runtime3/push-github # replace `test-runtime3` with your runtime name + route: + - destination: + host: push-github-eventsource-svc + port: + number: 80 +``` +Continue with [Git integration registration](#git-integration-registration) in this article. + +#### Internal ingress host configuration (optional for existing hybrid runtimes only) + +If you already have provisioned hybrid runtimes, to use an internal ingress host for app-proxy communication and an external ingress host to handle webhooks, change the specs for the `Ingress` and `Runtime` resources in the runtime installation repository. Use the examples as guidelines. + +`/apps/app-proxy/overlays//ingress.yaml`: change `host` + +```yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: codefresh-cap-app-proxy + namespace: codefresh #replace with your runtime name +spec: + ingressClassName: nginx + rules: + - host: my-internal-ingress-host # replace with the internal ingress host for app-proxy + http: + paths: + - backend: + service: + name: cap-app-proxy + port: + number: 3017 + path: /app-proxy/ + pathType: Prefix +``` + +`..//bootstrap/.yaml`: add `internalIngressHost` + +```yaml +apiVersion: v1 +data: + base-url: https://g.codefresh.io + runtime: | + apiVersion: codefresh.io/v1alpha1 + kind: Runtime + metadata: + creationTimestamp: null + name: codefresh #replace with your runtime name + namespace: codefresh #replace with your runtime name + spec: + bootstrapSpecifier: github.com/codefresh-io/cli-v2/manifests/argo-cd + cluster: https://7DD8390300DCEFDAF87DC5C587EC388C.gr7.us-east-1.eks.amazonaws.com + components: + - isInternal: false + name: events + type: kustomize + url: github.com/codefresh-io/cli-v2/manifests/argo-events + wait: true + - isInternal: false + name: rollouts + type: kustomize + url: github.com/codefresh-io/cli-v2/manifests/argo-rollouts + wait: false + - isInternal: false + name: workflows + type: kustomize + url: github.com/codefresh-io/cli-v2/manifests/argo-workflows + wait: false + - isInternal: false + name: app-proxy + type: kustomize + url: github.com/codefresh-io/cli-v2/manifests/app-proxy + wait: false + defVersion: 1.0.1 + ingressClassName: nginx + ingressController: k8s.io/ingress-nginx + ingressHost: https://support.cf.com/ + internalIngressHost: https://my-internal-ingress-host # add this line and replace my-internal-ingress-host with your internal ingress host + repo: https://github.com/NimRegev/my-codefresh.git + version: 99.99.99 +``` + +#### Git integration registration + +If you bypassed installing ingress resources with the `--skip-ingress` flag, or if AWS ALB is your ingress controller, create and register Git integrations using these commands: + `cf integration git add default --runtime --api-url ` + + `cf integration git register default --runtime --token ` + +### Related articles +[Add external clusters to runtimes]({{site.baseurl}}/docs/runtime/managed-cluster/) +[Add Git Sources to runtimes]({{site.baseurl}}/docs/runtime/git-sources/) +[Manage provisioned runtimes]({{site.baseurl}}/docs/runtime/monitor-manage-runtimes/) +[(Hybrid) Monitor provisioned runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) +[Troubleshoot runtime installation]({{site.baseurl}}/docs/troubleshooting/runtime-issues/) diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 76106a8a3..d2dcd5cf3 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -18,9 +18,9 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | Item | Requirement | | -------------- | -------------- | |Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. Tip: To check the server version, run `kubectl version --short`.| -| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}
  • Ambassador
  • ALB (AWS Application Load Balancer)
  • NGINX Enterprise (nginx.org/ingress-controller)
  • NGINX Community (k8s.io/ingress-nginx)
  • Istio
    • Trafik

See XREF {:/}| -|Node requirements| {::nomarkdown}
  • Memory: 5000 MB
  • CPU: 2
{:/}| -|Runtime namespace | resource permissions| +| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}
  • Ambassador
  • ALB (AWS Application Load Balancer)
  • NGINX Enterprise (nginx.org/ingress-controller)
  • NGINX Community (k8s.io/ingress-nginx)
  • Istio
  • Trafik
{:/}. | +|Node requirements| {::nomarkdown}
  • Memory: 5000 MB
  • CPU: 2
{:/}| +|Runtime namespace | Resource permissions: | | | `ServiceAccount`: Create, Delete | | | `ConfigMap`: Create, Update, Delete | | | `Service`: Create, Update, Delete | @@ -28,20 +28,20 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | |`RoleBinding`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | | | `persistentvolumeclaims`: Create, Update, Delete | | | `pods`: Create, Update, Delete | -| Git providers | {::nomarkdown}
  • Hosted: GitHub
  • Hybrid:
    • GitHub
    • GitLab
      • Bitbucket Server
    • GitHub Enterprise
| -| Git access tokens | {::nomarkdown}
  • Runtime Git token:
    • Valid expiration date
    • Scopes: `repo` and `admin-repo.hook`
  • Runtime Git token:
    • Valid expiration date
    • Scopes: `repo` and `admin-repo.hook`
| +| Git providers |{::nomarkdown}Hosted:
  • GitHub
Hybrid:
  • GitHub
  • GitLab
    • Bitbucket Server
  • GitHub Enterprise
{:/}| +| Git access tokens | {::nomarkdown}Runtime Git token:
  • Valid expiration date
  • Scopes: `repo` and `admin-repo.hook`
Personal access Git token:
  • Valid expiration date
  • Scopes: `repo` and `admin-repo.hook`
{:/}| ### NGINX Enterprise configuration -For general information see [NGINX ingress controller](https://docs.nginx.com/nginx-ingress-controller){:target="\_blank}. +For general information, see [NGINX ingress controller documentation](https://docs.nginx.com/nginx-ingress-controller){:target="\_blank}. {: .table .table-bordered .table-hover} -| When to configure | What to configure | +| What to configure | When to configure | | -------------- | -------------- | -| Before install | [Verify valid external IP address](#verify-valid-external-ip-address) | -| | [Valid SSL certificate](#valid-ssl-certificate) | -| | [TCP support](#tcp-support) | -| | [Report status](#report-status) | -| After install | [Patch certificate secret](#verify-valid-external-ip-address) | +| [Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | +|[Valid SSL certificate](#valid-ssl-certificate) | | +|[TCP support](#tcp-support) | | +|[Report status](#report-status) | | +|[Patch certificate secret](#verify-valid-external-ip-address) | _After_ installing hybrid runtime @@ -61,7 +61,7 @@ Verify that the ingress-nginx-controller service manifest has either of the foll OR `service.beta.kubernetes.io/aws-load-balancer-type: nlb` -#### NGINX Ingress: Enable reporting status +#### NGINX Ingress: Enable report status to cluster * Pass the `- -report-ingress-status` to `deployment`. ```yaml @@ -71,7 +71,7 @@ OR - -report-ingress-status ``` -#### NGINX Ingress Operator: Enable reporting status +#### NGINX Ingress Operator: Enable report status to cluster 1. Add this to the `Nginxingresscontrollers` resource file: @@ -86,8 +86,8 @@ OR 1. Make sure you have a certificate secret in the same namespace as the runtime. Copy an existing secret if you don't have one. You will need to add this to the `ingress-master` when you have completed runtime installation. -#### Patch certificate secret -> This configuration must be completed _after_ installation. +#### NGINX Ingress Operator: Patch certificate secret +> This configuration must be completed _after_ installing the hybrid runtime. Patch the certificate secret in `spec.tls` of the `ingress-master` resource. The secret must be in the same namespace as the runtime. @@ -103,9 +103,5 @@ The secret must be in the same namespace as the runtime. ``` - - - - ### What to read next [Installing hybrid runtimes]({{site.baseurl}}/docs/runtime/installation/) diff --git a/_docs/runtime/requirements_orig.md b/_docs/runtime/requirements_orig.md new file mode 100644 index 000000000..29fad0ee7 --- /dev/null +++ b/_docs/runtime/requirements_orig.md @@ -0,0 +1,384 @@ +--- +title: "Hybrid runtime requirements" +description: "" +group: runtime +toc: true +--- + + +The requirements listed are the **_minimum_** requirements to provision **_hybrid runtimes_** in the Codefresh platform. + +> Hosted runtimes are managed by Codefresh. To provision a hosted runtime as part of Hosted GitOps setup, see [Provision a hosted runtime]({{site.baseurl}}/docs/runtime/hosted-runtime/#1-provision-hosted-runtime) in [Set up a hosted (Hosted GitOps) environment]({{site.baseurl}}/docs/runtime/hosted-runtime/). + +>In the documentation, Kubernetes and K8s are used interchangeably. + +### Requirements + +{: .table .table-bordered .table-hover} +| Item | Requirement | +| -------------- | -------------- | +|Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. Tip: To check the server version, run `kubectl version --short`.| +| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}

See XREF {:/}| +|Node requirements| {::nomarkdown}
  • Memory: 5000 MB
  • CPU: 2
{:/}| +|Runtime namespace | resource permissions| +| | `ServiceAccount`: Create, Delete | +| | `ConfigMap`: Create, Update, Delete | +| | `Service`: Create, Update, Delete | +| | `Role`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | +| |`RoleBinding`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | +| | `persistentvolumeclaims`: Create, Update, Delete | +| | `pods`: Create, Update, Delete | +| Git providers | {::nomarkdown}
  • Hosted: GitHub
  • Hybrid:
    • GitHub
    • GitLab
      • Bitbucket Server
    • GitHub Enterprise
| +| Git access tokens | {::nomarkdown}
  • Runtime Git token:
    • Valid expiration date
    • Scopes: `repo` and `admin-repo.hook`
  • Runtime Git token:
    • Valid expiration date
    • Scopes: `repo` and `admin-repo.hook`
| + +### NGINX EN + +#### Valid external IP address +Run `kubectl get svc -A` to get a list of services and verify that the EXTERNAL-IP column for your ingress controller shows a valid hostname. + +#### Valid SSL certificate +For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). + +#### TCP support +Configure to handle TCP requests. + +Here's an example of TCP configuration for NGINX on AWS. +Verify that the ingress-nginx-controller service manifest has either of the following annotations: + +`service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "tcp"` +OR +`service.beta.kubernetes.io/aws-load-balancer-type: nlb` + + + +* AWS ALB + In the ingress resource file, verify that `spec.controller` is configured as `ingress.k8s.aws/alb`. + +```yaml +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + name: alb +spec: + controller: ingress.k8s.aws/alb +``` + +* Report status + The ingress controller must be configured to report its status. Otherwise, Argo's health check reports the health status as "progressing" resulting in a timeout error during installation. + + By default, NGINX Enterprise and Traefik ingress are not configured to report status. For details on configuration settings, see the following sections in this article: + [NGINX Enterprise ingress configuration](#nginx-enterprise-version-ingress-configuration) + [Traefik ingress configuration](#traefik-ingress-configuration) + + +#### NGINX Enterprise version ingress configuration +The Enterprise version of NGINX (`nginx.org/ingress-controller`), both with and without the Ingress Operator, must be configured to report the status of the ingress controller. + +**Installation with NGINX Ingress** +* Pass the `- -report-ingress-status` to `deployment`. + + ```yaml + spec: + containers: + - args: + - -report-ingress-status + ``` + +**Installation with NGINX Ingress Operator** + +1. Add this to the `Nginxingresscontrollers` resource file: + + ```yaml + ... + spec: + reportIngressStatus: + enable: true + ... + ``` + +1. Make sure you have a certificate secret in the same namespace as the runtime. Copy an existing secret if you don't have one. +You will need to add this to the `ingress-master` when you have completed runtime installation. + +#### NGINX Community version provider-specific ingress configuration +Codefresh has been tested and is supported in major providers. For your convenience, here are provider-specific configuration instructions, both for supported and untested providers. + +> The instructions are valid for `k8s.io/ingress-nginx`, the community version of NGINX. + +
+AWS +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/aws/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for AWS. +
+
+Azure (AKS) +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for AKS. + +
+ +
+Bare Metal Clusters +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/baremetal/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+Bare-metal clusters often have additional considerations. See Bare-metal ingress-nginx considerations. + +
+ +
+Digital Ocean +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/do/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Digital Ocean. + +
+ +
+Docker Desktop +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Docker Desktop.
+Note: By default, Docker Desktop services will provision with localhost as their external address. Triggers in delivery pipelines cannot reach this instance unless they originate from the same machine where Docker Desktop is being used. + +
+ +
+Exoscale +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/exoscale/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Exoscale. + +
+ + +
+Google (GKE) +
+Add firewall rules +
+GKE by default limits outbound requests from nodes. For the runtime to communicate with the control-plane in Codefresh, add a firewall-specific rule. + +
    +
  1. Find your cluster's network:
    + gcloud container clusters describe [CLUSTER_NAME] --format=get"(network)" +
    2. +
  2. Get the Cluster IPV4 CIDR:
    + gcloud container clusters describe [CLUSTER_NAME] --format=get"(clusterIpv4Cidr)" +
    3. +
  3. Replace the `[CLUSTER_NAME]`, `[NETWORK]`, and `[CLUSTER_IPV4_CIDR]`, with the relevant values:
    + gcloud compute firewall-rules create "[CLUSTER_NAME]-to-all-vms-on-network"
    + + --network="[NETWORK]" \ +
    + + --source-ranges="[CLUSTER_IPV4_CIDR]" \ +
    + + --allow=tcp,udp,icmp,esp,ah,sctp +
    +
    4. +
+
+Use ingress-nginx
+
    +
  1. Create a `cluster-admin` role binding:
    + + kubectl create clusterrolebinding cluster-admin-binding \ +
    + + --clusterrole cluster-admin \ +
    + + --user $(gcloud config get-value account) +
    +
    2. +
  2. Apply:
    + + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml + +
    3. +
  3. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    4. + +
+We recommend reviewing the provider-specific documentation for GKE. + +
+ + +
+MicroK8s +
    +
  1. Install using Microk8s addon system:
    + microk8s enable ingress +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+MicroK8s has not been tested with Codefresh, and may require additional configuration. For details, see Ingress addon documentation. + +
+ + +
+MiniKube +
    +
  1. Install using MiniKube addon system:
    + minikube addons enable ingress +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+MiniKube has not been tested with Codefresh, and may require additional configuration. For details, see Ingress addon documentation. + +
+ + + +
+Oracle Cloud Infrastructure +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Oracle Cloud. + +
+ +
+Scaleway +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/scw/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Scaleway. + +
+
+ +#### Traefik ingress configuration +To enable the the Traefik ingress controller to report the status, add `publishedService` to `providers.kubernetesIngress.ingressEndpoint`. + +The value must be in the format `"/"`, where: + `` is the Traefik service from which to copy the status + + ```yaml + ... + providers: + kubernetesIngress: + ingressEndpoint: + publishedService: "/" # Example, "codefresh/traefik-default" ... + ... + ``` + +#### + +#### Runtime namespace permissions for resources + +{: .table .table-bordered .table-hover} +| Resource | Permissions Required| +| -------------- | -------------- | +| `ServiceAccount` | Create, Delete | +| `ConfigMap` | Create, Update, Delete | +| `Service` | Create, Update, Delete | +| `Role` | In group `rbac.authorization.k8s.io`: Create, Update, Delete | +| `RoleBinding` | In group `rbac.authorization.k8s.io`: Create, Update, Delete | +| `persistentvolumeclaims` | Create, Update, Delete | +| `pods` | Creat, Update, Delete | + +### Git repository requirements +This section lists the requirements for Git installation repositories. + +#### Git installation repo +If you are using an existing repo, make sure it is empty. + +#### Git access tokens +Codefresh requires two access tokens, one for runtime installation, and the second, a personal token for each user to authenticate Git-based actions in Codefresh. + +##### Git runtime token +The Git runtime token is mandatory for runtime installation. + +The token must have valid: + * Expiration date: Default is `30 days` + * Scopes: `repo` and `admin-repo.hook` + + {% include + image.html + lightbox="true" + file="/images/getting-started/quick-start/quick-start-git-event-permissions.png" + url="/images/getting-started/quick-start/quick-start-git-event-permissions.png" + alt="Scopes for Git runtime token" + caption="Scopes for Git runtime token" + max-width="30%" + %} + +##### Git user token for Git-based actions +The Git user token is the user's personal token and is unique to every user. It is used to authenticate every Git-based action of the user in Codefresh. You can add the Git user token at any time from the UI. + + The token must have valid: + * Expiration date: Default is `30 days` + * Scope: `repo` + + {% include + image.html + lightbox="true" + file="/images/runtime/git-token-scope-resource-repos.png" + url="/images/runtime/git-token-scope-resource-repos.png" + alt="Scope for Git personal user token" + caption="Scope for Git personal user token" + max-width="30%" + %} + +For detailed information on GitHub tokens, see [Creating a personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token). + + +### What to read next +[Installing hybrid runtimes]({{site.baseurl}}/docs/runtime/installation/) From 03ed29eb89acbae08dadc03f406a5793bde7e82e Mon Sep 17 00:00:00 2001 From: NimRegev Date: Thu, 18 Aug 2022 14:14:58 +0300 Subject: [PATCH 03/23] Update requirements.md --- _docs/runtime/requirements.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index d2dcd5cf3..43db5da58 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -17,8 +17,8 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri {: .table .table-bordered .table-hover} | Item | Requirement | | -------------- | -------------- | -|Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. Tip: To check the server version, run `kubectl version --short`.| -| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}
  • Ambassador
  • ALB (AWS Application Load Balancer)
  • NGINX Enterprise (nginx.org/ingress-controller)
  • NGINX Community (k8s.io/ingress-nginx)
  • Istio
  • Trafik
{:/}. | +|Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. {::nomarkdown}
Tip: To check the server version, run `kubectl version --short`.{:/}| +| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}{:/}. | |Node requirements| {::nomarkdown}
  • Memory: 5000 MB
  • CPU: 2
{:/}| |Runtime namespace | Resource permissions: | | | `ServiceAccount`: Create, Delete | @@ -28,7 +28,7 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | |`RoleBinding`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | | | `persistentvolumeclaims`: Create, Update, Delete | | | `pods`: Create, Update, Delete | -| Git providers |{::nomarkdown}Hosted:
  • GitHub
Hybrid:
  • GitHub
  • GitLab
    • Bitbucket Server
  • GitHub Enterprise
{:/}| +| Git providers |{::nomarkdown}Hosted:
  • GitHub
Hybrid:
  • GitHub
  • GitLab
  • Bitbucket Server
  • GitHub Enterprise
{:/}| | Git access tokens | {::nomarkdown}Runtime Git token:
  • Valid expiration date
  • Scopes: `repo` and `admin-repo.hook`
Personal access Git token:
  • Valid expiration date
  • Scopes: `repo` and `admin-repo.hook`
{:/}| ### NGINX Enterprise configuration From 94ef89aa61d55b02d1cc3a3cbda1a453f9cc875e Mon Sep 17 00:00:00 2001 From: NimRegev Date: Sun, 21 Aug 2022 10:34:42 +0300 Subject: [PATCH 04/23] Update installation.md --- _docs/runtime/installation.md | 72 ++++++++++++++++++----------------- 1 file changed, 38 insertions(+), 34 deletions(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index e2b876707..373b8ecd9 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -12,7 +12,7 @@ If you have a hybrid environment, you can provision one or more hybrid runtimes There are two parts to installing a hybrid runtime: 1. Installing the Codefresh CLI -2. Installing the hybrid runtime from the CLI, either through the CLI wizard or via silent installation. +2. Installing the hybrid runtime from the CLI, either through the CLI wizard or via silent installation through the installation flags. The hybrid runtime is installed in a specific namespace on your cluster. You can install more runtimes on different clusters in your deployment. Every hybrid runtime installation makes commits to two Git repos: @@ -21,36 +21,6 @@ There are two parts to installing a hybrid runtime: See also [Codefresh architecture]({{site.baseurl}}/docs/getting-started/architecture). -### Installing the Codefresh CLI - -Install the Codefresh CLI using the option that best suits you: `curl`, `brew`, or standard download. -If you are not sure which OS to select for `curl`, simply select one, and Codefresh automatically identifies and selects the right OS for CLI installation. - -### Installing the hybrid runtime - -**Before you begin** -* Make sure you meet the minimum requirements for runtime installation -* Make sure your ingress controller is configured correctly: - * [NGINX Enterprise configuration]({{site.baseurl}}/docs/runtime/requirements/#nginx-enterprise-configuration) - - -**How to** -1. Do one of the following: - * If this is your first hybrid runtime installation, in the Welcome page, select **+ Install Runtime**. - * If you have provisioned a hybrid runtime, to provision additional runtimes, in the Codefresh UI, go to [**Runtimes**](https://g.codefresh.io/2.0/account-settings/runtimes){:target="\_blank"}. -1. Click **+ Add Runtimes**, and then select **Hybrid Runtimes**. -1. Do one of the following: - * CLI wizard: Run `cf runtime install`, and follow the prompts to enter the required values. - * Silent install: Pass the required flags in the install command: - `cf runtime install --repo --git-token --silent` - For the list of flags, see [Hybrid runtime installation flags](#hybrid-runtime-installation-flags). -1. Complete the configuration for ingress controllers: - * [NGINX Ingress Operator: Patch certificate secret]({{site.baseurl}}/docs/runtime/requirements/#nginx-ingress-operator-patch-certificate-secret) - -> Note: -> Hybrid runtime installation starts by checking network connectivity and the K8s cluster server version. - To skip these tests, pass the `--skip-cluster-checks` flag. - ### Hybrid runtime installation flags This section describes the required and optional flags to install a hybrid runtime. For documentation purposes, the flags are grouped into: @@ -144,12 +114,47 @@ Install demo pipelines to use as a starting point to create your own pipelines. **Insecure flag** For _on-premises installations_, if the Ingress controller does not have a valid SSL certificate, to continue with the installation, add the `--insecure` flag to the installation command. +### Install the Codefresh CLI + +Install the Codefresh CLI using the option that best suits you: `curl`, `brew`, or standard download. +If you are not sure which OS to select for `curl`, simply select one, and Codefresh automatically identifies and selects the right OS for CLI installation. + +### Install the hybrid runtime + +**Before you begin** +* Make sure you meet the minimum requirements for runtime installation +* Review [Hybrid runtime installation flags](#hybrid-runtime-installation-flags) +* Make sure your ingress controller is configured correctly: + * [NGINX Enterprise configuration]({{site.baseurl}}/docs/runtime/requirements/#nginx-enterprise-configuration) + + +**How to** +1. Do one of the following: + * If this is your first hybrid runtime installation, in the Welcome page, select **+ Install Runtime**. + * If you have provisioned a hybrid runtime, to provision additional runtimes, in the Codefresh UI, go to [**Runtimes**](https://g.codefresh.io/2.0/account-settings/runtimes){:target="\_blank"}. +1. Click **+ Add Runtimes**, and then select **Hybrid Runtimes**. +1. Do one of the following: + * CLI wizard: Run `cf runtime install`, and follow the prompts to enter the required values. + * Silent install: Pass the required flags in the install command: + `cf runtime install --repo --git-token --silent` + For the list of flags, see [Hybrid runtime installation flags](#hybrid-runtime-installation-flags). +1. Complete the configuration for ingress controllers: + * [NGINX Ingress Operator: Patch certificate secret]({{site.baseurl}}/docs/runtime/requirements/#nginx-ingress-operator-patch-certificate-secret) + +> Note: +> Hybrid runtime installation starts by checking network connectivity and the K8s cluster server version. + To skip these tests, pass the `--skip-cluster-checks` flag. + + + ### Hybrid runtime components **Git repositories** -* Runtime install repo: The installation repo contains three folders: apps, bootstrap and projects, to manage the runtime itself with Argo CD. -* Git source repository: Created with the name `[repo_name]_git-source`. This repo stores manifests for pipelines with sources, events, workflow templates. +* Runtime install repository: The installation repo contains three folders: apps, bootstrap and projects, to manage the runtime itself with Argo CD. +* Git source repository: Created with the name `[repo_name]_git-source`. This repo stores manifests for pipelines with sources, events, workflow templates. See [Add Git Sources to runtimes]({{site.baseurl}}/docs/runtime/git-sources/). + +* Shared configuration repository: Stores configuration and resource manifests that can be shared across runtimes, such as integration resources. See [Shared configuration repository]({{site.baseurl}}/docs/reference/shared-configuration/) **Argo CD components** @@ -355,7 +360,6 @@ If you bypassed installing ingress resources with the `--skip-ingress` flag, or ### Related articles [Add external clusters to runtimes]({{site.baseurl}}/docs/runtime/managed-cluster/) -[Add Git Sources to runtimes]({{site.baseurl}}/docs/runtime/git-sources/) [Manage provisioned runtimes]({{site.baseurl}}/docs/runtime/monitor-manage-runtimes/) [(Hybrid) Monitor provisioned runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) [Troubleshoot runtime installation]({{site.baseurl}}/docs/troubleshooting/runtime-issues/) From 327dc524a9e09d1ecc77ba8cfac7a1a2839b8da9 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Mon, 22 Aug 2022 14:16:30 +0300 Subject: [PATCH 05/23] Update requirements.md --- _docs/runtime/requirements.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 43db5da58..16ca22b57 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -17,7 +17,7 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri {: .table .table-bordered .table-hover} | Item | Requirement | | -------------- | -------------- | -|Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. {::nomarkdown}
Tip: To check the server version, run `kubectl version --short`.{:/}| +|Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. {::nomarkdown}
Tip: To check the server version, run:
kubectl version --short.{:/}| | Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}{:/}. | |Node requirements| {::nomarkdown}
  • Memory: 5000 MB
  • CPU: 2
{:/}| |Runtime namespace | Resource permissions: | @@ -28,8 +28,8 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | |`RoleBinding`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | | | `persistentvolumeclaims`: Create, Update, Delete | | | `pods`: Create, Update, Delete | -| Git providers |{::nomarkdown}Hosted:
  • GitHub
Hybrid:
  • GitHub
  • GitLab
  • Bitbucket Server
  • GitHub Enterprise
{:/}| -| Git access tokens | {::nomarkdown}Runtime Git token:
  • Valid expiration date
  • Scopes: `repo` and `admin-repo.hook`
Personal access Git token:
  • Valid expiration date
  • Scopes: `repo` and `admin-repo.hook`
{:/}| +| Git providers |{::nomarkdown}
  • GitHub
  • GitLab
  • Bitbucket Server
  • GitHub Enterprise
{:/}| +| Git access tokens | {::nomarkdown}Runtime Git token:
  • Valid expiration date
  • Scopes: repo and admin-repo.hook
Personal access Git token:
  • Valid expiration date
  • Scopes: repo
{:/}| ### NGINX Enterprise configuration For general information, see [NGINX ingress controller documentation](https://docs.nginx.com/nginx-ingress-controller){:target="\_blank}. @@ -37,7 +37,7 @@ For general information, see [NGINX ingress controller documentation](https://do {: .table .table-bordered .table-hover} | What to configure | When to configure | | -------------- | -------------- | -| [Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | +|[Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | |[Valid SSL certificate](#valid-ssl-certificate) | | |[TCP support](#tcp-support) | | |[Report status](#report-status) | | @@ -62,13 +62,13 @@ OR `service.beta.kubernetes.io/aws-load-balancer-type: nlb` #### NGINX Ingress: Enable report status to cluster -* Pass the `- -report-ingress-status` to `deployment`. +* Pass `--report-ingress-status` to `deployment`. ```yaml spec: containers: - args: - - -report-ingress-status + - -report-ingress-status ``` #### NGINX Ingress Operator: Enable report status to cluster @@ -87,7 +87,7 @@ OR You will need to add this to the `ingress-master` when you have completed runtime installation. #### NGINX Ingress Operator: Patch certificate secret -> This configuration must be completed _after_ installing the hybrid runtime. +> The certifcate secret must be configured _after_ installing the hybrid runtime. Patch the certificate secret in `spec.tls` of the `ingress-master` resource. The secret must be in the same namespace as the runtime. From a7da82fc69af712d1f766aa0138f6d9b28d0af81 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Mon, 22 Aug 2022 17:46:44 +0300 Subject: [PATCH 06/23] Update requirements.md Added configuration per ingress controller --- _docs/runtime/requirements.md | 430 +++++++++++++++++++++++++++++++++- 1 file changed, 422 insertions(+), 8 deletions(-) diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 16ca22b57..1b72df124 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -31,6 +31,78 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | Git providers |{::nomarkdown}
  • GitHub
  • GitLab
  • Bitbucket Server
  • GitHub Enterprise
{:/}| | Git access tokens | {::nomarkdown}Runtime Git token:
  • Valid expiration date
  • Scopes: repo and admin-repo.hook
Personal access Git token:
  • Valid expiration date
  • Scopes: repo
{:/}| +### Ambassador ingress configuration + +{: .table .table-bordered .table-hover} +| What to configure | When to configure | +| -------------- | -------------- | +|[Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | +|[Valid SSL certificate](#valid-ssl-certificate) | | +|[TCP support](#tcp-support) | | + +#### Valid external IP address +Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. + +#### Valid SSL certificate +For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). + +#### TCP support +Configure to handle TCP requests. + +### ALB AWS configuration + +{: .table .table-bordered .table-hover} +| What to configure | When to configure | +| -------------- | -------------- | +|[Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | +|[Valid SSL certificate](#valid-ssl-certificate) | | +|[TCP support](#tcp-support) | | +|[spec.controller](#spec-controller) | | + +#### Valid external IP address +Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. + +#### Valid SSL certificate +For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). + +#### TCP support +Configure to handle TCP requests. + +#### spec.controller +In the ingress resource file, verify that `spec.controller` is configured as `ingress.k8s.aws/alb`. + +```yaml +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + name: alb +spec: + controller: ingress.k8s.aws/alb +``` +#### Alias DNS record in route53 to load balancer + +Make sure you have a DNS record available in the correct hosted zone. +After the hybrid runtime completes installation, a load balancer is created. You should now create an `Alias` record in Amazon Route 53, and map your zone apex (`example.com`) DNS name to your Amazon CloudFront distribution. +For more information, see [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html){:target="\_blank"}. + +{% include image.html + lightbox="true" + file="/images/runtime/post-install-alb-ingress.png" + url="/images/runtime/post-install-alb-ingress.png" + alt="Route 53 record settings for AWS ALB" + caption="Route 53 record settings for AWS ALB" + max-width="60%" +%} + +#### Git integration registration +If the installation failed, as could happen if the DNS record was created, manually create and register Git integrations using these commands: + + `cf integration git add default --runtime --api-url ` + + `cf integration git register default --runtime --token ` + where: + + ### NGINX Enterprise configuration For general information, see [NGINX ingress controller documentation](https://docs.nginx.com/nginx-ingress-controller){:target="\_blank}. @@ -43,8 +115,6 @@ For general information, see [NGINX ingress controller documentation](https://do |[Report status](#report-status) | | |[Patch certificate secret](#verify-valid-external-ip-address) | _After_ installing hybrid runtime - - #### Valid external IP address Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. @@ -54,14 +124,11 @@ For secure runtime installation, the ingress controller must have a valid SSL ce #### TCP support Configure to handle TCP requests. -Here's an example of TCP configuration for NGINX on AWS. -Verify that the ingress-nginx-controller service manifest has either of the following annotations: - -`service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "tcp"` -OR -`service.beta.kubernetes.io/aws-load-balancer-type: nlb` #### NGINX Ingress: Enable report status to cluster + +If the ingress controller is not configured to report its status to the cluster, Argo’s health check reports the health status as “progressing” resulting in a timeout error during installation. + * Pass `--report-ingress-status` to `deployment`. ```yaml @@ -73,6 +140,8 @@ OR #### NGINX Ingress Operator: Enable report status to cluster +If the ingress controller is not configured to report its status to the cluster, Argo’s health check reports the health status as “progressing” resulting in a timeout error during installation. + 1. Add this to the `Nginxingresscontrollers` resource file: ```yaml @@ -103,5 +172,350 @@ The secret must be in the same namespace as the runtime. ``` + + +### NGINX Community version configuration + +Codefresh is supported with and has been tested with major providers. For your convenience, we have provided configuration instructions, both for supported and untested providers in [Provider-specific configuration](#provider-specific-configuration). + + +In addition, make sure your NGINX community ingress controller is must be configured as + +{: .table .table-bordered .table-hover} +| What to configure | When to configure | +| -------------- | -------------- | +|[Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | +|[Valid SSL certificate](#valid-ssl-certificate) | | +|[TCP support](#tcp-support) | | +|[Report status](#report-status) | | + + +#### Valid external IP address +Run `kubectl get svc -A` to get a list of services, and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. + +#### Valid SSL certificate +For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). + +#### TCP support +Configure to handle TCP requests. + +Here's an example of TCP configuration for NGINX Community on AWS. +Verify that the `ingress-nginx-controller` service manifest has either of the following annotations: + +`service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "tcp"` +OR +`service.beta.kubernetes.io/aws-load-balancer-type: nlb` + +#### Provider-specific configuration + +> The instructions are valid for `k8s.io/ingress-nginx`, the community version of NGINX. + +
+AWS +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/aws/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for AWS. +
+
+Azure (AKS) +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for AKS. + +
+ +
+Bare Metal Clusters +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/baremetal/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+Bare-metal clusters often have additional considerations. See Bare-metal ingress-nginx considerations. + +
+ +
+Digital Ocean +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/do/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Digital Ocean. + +
+ +
+Docker Desktop +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Docker Desktop.
+Note: By default, Docker Desktop services will provision with localhost as their external address. Triggers in delivery pipelines cannot reach this instance unless they originate from the same machine where Docker Desktop is being used. + +
+ +
+Exoscale +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/exoscale/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Exoscale. + +
+ + +
+Google (GKE) +
+Add firewall rules +
+GKE by default limits outbound requests from nodes. For the runtime to communicate with the control-plane in Codefresh, add a firewall-specific rule. + +
    +
  1. Find your cluster's network:
    + gcloud container clusters describe [CLUSTER_NAME] --format=get"(network)" +
    2. +
  2. Get the Cluster IPV4 CIDR:
    + gcloud container clusters describe [CLUSTER_NAME] --format=get"(clusterIpv4Cidr)" +
    3. +
  3. Replace the `[CLUSTER_NAME]`, `[NETWORK]`, and `[CLUSTER_IPV4_CIDR]`, with the relevant values:
    + gcloud compute firewall-rules create "[CLUSTER_NAME]-to-all-vms-on-network"
    + + --network="[NETWORK]" \ +
    + + --source-ranges="[CLUSTER_IPV4_CIDR]" \ +
    + + --allow=tcp,udp,icmp,esp,ah,sctp +
    +
    4. +
+
+Use ingress-nginx
+
    +
  1. Create a `cluster-admin` role binding:
    + + kubectl create clusterrolebinding cluster-admin-binding \ +
    + + --clusterrole cluster-admin \ +
    + + --user $(gcloud config get-value account) +
    +
    2. +
  2. Apply:
    + + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml + +
    3. +
  3. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    4. + +
+We recommend reviewing the provider-specific documentation for GKE. + +
+ + +
+MicroK8s +
    +
  1. Install using Microk8s addon system:
    + microk8s enable ingress +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+MicroK8s has not been tested with Codefresh, and may require additional configuration. For details, see Ingress addon documentation. + +
+ + +
+MiniKube +
    +
  1. Install using MiniKube addon system:
    + minikube addons enable ingress +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+MiniKube has not been tested with Codefresh, and may require additional configuration. For details, see Ingress addon documentation. + +
+ + + +
+Oracle Cloud Infrastructure +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Oracle Cloud. + +
+ +
+Scaleway +
    +
  1. Apply:
    + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/scw/deploy.yaml +
    2. +
  2. Verify a valid external address exists:
    + kubectl get svc ingress-nginx-controller -n ingress-nginx +
    3. +
+For additional configuration options, see ingress-nginx documentation for Scaleway. + +
+ +### Istio ingress controller configuration +For general information, see [NGINX ingress controller documentation](https://docs.nginx.com/nginx-ingress-controller){:target="\_blank}. + +{: .table .table-bordered .table-hover} +| What to configure | When to configure | +| -------------- | -------------- | +|[Valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | +|[Valid SSL certificate](#valid-ssl-certificate) | | +|[TCP support](#tcp-support) | | +|[Cluster routing service](#cluster-routing-service) | _After_ installing hybrid runtime | + +#### Valid external IP address +Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. + +#### Valid SSL certificate +For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). + +#### TCP support +Configure to handle TCP requests. + +#### Cluster routing service +Configure the `VirtualService` to route traffic to the `app-proxy` and `webhook` services, as in the examples below. + +**`VirtualService` example for `app-proxy`:** + +```yaml +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + namespace: test-runtime3 # replace with your runtime name + name: cap-app-proxy +spec: + hosts: + - my.support.cf-cd.com # replace with your host name + gateways: + - my-gateway + http: + - match: + - uri: + prefix: /app-proxy + route: + - destination: + host: cap-app-proxy + port: + number: 3017 +``` +**`VirtualService` example for `webhook`:** + +```yaml +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + namespace: test-runtime3 # replace with your runtime name + name: csdp-default-git-source +spec: + hosts: + - my.support.cf-cd.com # replace with your host name + gateways: + - my-gateway + http: + - match: + - uri: + prefix: /webhooks/test-runtime3/push-github # replace `test-runtime3` with your runtime name + route: + - destination: + host: push-github-eventsource-svc + port: + number: 80 +``` + +### Traefik ingress controller configuration +For general information, see [NGINX ingress controller documentation](https://docs.nginx.com/nginx-ingress-controller){:target="\_blank}. + +{: .table .table-bordered .table-hover} +| What to configure | When to configure | +| -------------- | -------------- | +|[Valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | +|[Valid SSL certificate](#valid-ssl-certificate) | | +|[TCP support](#tcp-support) | | +|[Enable report status](#tcp-support) | | +|[Cluster routing service](#cluster-routing-service) | _After_ installing hybrid runtime | + +#### Valid external IP address +Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. + +#### Valid SSL certificate +For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). + +#### TCP support +Configure to handle TCP requests. + +#### Report status to cluster +By default, the Traefik ingress controller is not configured to report its status to the cluster. If not configured, Argo’s health check reports the health status as “progressing”, resulting in a timeout error during installation. + +To enable reporting its status, add `publishedService` to `providers.kubernetesIngress.ingressEndpoint`. + +The value must be in the format `"/"`, where: + `` is the Traefik service from which to copy the status + +```yaml +... +providers: + kubernetesIngress: + ingressEndpoint: + publishedService: "/" # Example, "codefresh/traefik-default" +... +``` + ### What to read next [Installing hybrid runtimes]({{site.baseurl}}/docs/runtime/installation/) From b66053bacaed6b9711449ec222c2045e7b85a6e0 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Tue, 23 Aug 2022 09:59:58 +0300 Subject: [PATCH 07/23] Update requirements and installation --- _docs/runtime/installation.md | 71 ------------------- _docs/runtime/requirements.md | 124 +++++++++++++++++++--------------- 2 files changed, 70 insertions(+), 125 deletions(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 373b8ecd9..59a4376e8 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -204,78 +204,7 @@ For more information, see [Creating records by using the Amazon Route 53 console max-width="30%" %} -#### Configure cluster routing service -If you bypassed installing ingress resources with the `--skip-ingress` flag, configure the `host` for the Ingress, or the VirtualService for Istio if used, to route traffic to the `app-proxy` and `webhook` services, as in the examples below. - -**Ingress resource example for `app-proxy`:** - -```yaml -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: codefresh-cap-app-proxy - namespace: codefresh -spec: - ingressClassName: alb - rules: - - host: my.support.cf-cd.com # replace with your host name - http: - paths: - - backend: - service: - name: cap-app-proxy - port: - number: 3017 - path: /app-proxy/ - pathType: Prefix -``` - -**`VirtualService` examples for `app-proxy` and `webhook`:** - -```yaml -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - namespace: test-runtime3 # replace with your runtime name - name: cap-app-proxy -spec: - hosts: - - my.support.cf-cd.com # replace with your host name - gateways: - - my-gateway - http: - - match: - - uri: - prefix: /app-proxy - route: - - destination: - host: cap-app-proxy - port: - number: 3017 -``` - -```yaml -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - namespace: test-runtime3 # replace with your runtime name - name: csdp-default-git-source -spec: - hosts: - - my.support.cf-cd.com # replace with your host name - gateways: - - my-gateway - http: - - match: - - uri: - prefix: /webhooks/test-runtime3/push-github # replace `test-runtime3` with your runtime name - route: - - destination: - host: push-github-eventsource-svc - port: - number: 80 -``` Continue with [Git integration registration](#git-integration-registration) in this article. #### Internal ingress host configuration (optional for existing hybrid runtimes only) diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 1b72df124..0c0659c93 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -18,7 +18,7 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | Item | Requirement | | -------------- | -------------- | |Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. {::nomarkdown}
Tip: To check the server version, run:
kubectl version --short.{:/}| -| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}{:/}. | +| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. Supported and tested ingress controllers include: {::nomarkdown}{:/}. | |Node requirements| {::nomarkdown}
  • Memory: 5000 MB
  • CPU: 2
{:/}| |Runtime namespace | Resource permissions: | | | `ServiceAccount`: Create, Delete | @@ -28,17 +28,20 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | |`RoleBinding`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | | | `persistentvolumeclaims`: Create, Update, Delete | | | `pods`: Create, Update, Delete | -| Git providers |{::nomarkdown}
  • GitHub
  • GitLab
  • Bitbucket Server
  • GitHub Enterprise
{:/}| -| Git access tokens | {::nomarkdown}Runtime Git token:
  • Valid expiration date
  • Scopes: repo and admin-repo.hook
Personal access Git token:
  • Valid expiration date
  • Scopes: repo
{:/}| +|Git providers |{::nomarkdown}
  • GitHub
  • GitLab
  • Bitbucket Server
  • GitHub Enterprise
{:/}| +|Git access tokens | {::nomarkdown}Runtime Git token:
  • Valid expiration date
  • Scopes: repo and admin-repo.hook
Personal access Git token:
  • Valid expiration date
  • Scopes: repo
{:/}| ### Ambassador ingress configuration +For detailed configuration information, see the [Ambassador ingress controller documentation](https://www.getambassador.io/docs/edge-stack/latest/topics/running/ingress-controller){:target="\_blank"}. + +The table below lists the specific configuration requirements for Codefresh. {: .table .table-bordered .table-hover} | What to configure | When to configure | | -------------- | -------------- | -|[Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | -|[Valid SSL certificate](#valid-ssl-certificate) | | -|[TCP support](#tcp-support) | | +|Valid external IP address | _Before_ installing hybrid runtime | +|Valid SSL certificate | | +|TCP support| | #### Valid external IP address Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. @@ -49,15 +52,22 @@ For secure runtime installation, the ingress controller must have a valid SSL ce #### TCP support Configure to handle TCP requests. -### ALB AWS configuration +### ALB AWS ingress configuration + +For detailed configuration information, see the [ALB AWS ingress controller documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4){:target="\_blank"}. + +The table below lists the specific configuration requirements for Codefresh. {: .table .table-bordered .table-hover} | What to configure | When to configure | | -------------- | -------------- | -|[Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | -|[Valid SSL certificate](#valid-ssl-certificate) | | -|[TCP support](#tcp-support) | | -|[spec.controller](#spec-controller) | | +|Valid external IP address | _Before_ installing hybrid runtime | +|Valid SSL certificate | | +|TCP support| | +|Controller configuration] | | +|Alias DNS record in route53 to load balancer | _After_ installing hybrid runtime | +|(Optional) Git integration registration | | + #### Valid external IP address Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. @@ -68,7 +78,7 @@ For secure runtime installation, the ingress controller must have a valid SSL ce #### TCP support Configure to handle TCP requests. -#### spec.controller +#### Controller configuration In the ingress resource file, verify that `spec.controller` is configured as `ingress.k8s.aws/alb`. ```yaml @@ -82,7 +92,7 @@ spec: #### Alias DNS record in route53 to load balancer Make sure you have a DNS record available in the correct hosted zone. -After the hybrid runtime completes installation, a load balancer is created. You should now create an `Alias` record in Amazon Route 53, and map your zone apex (`example.com`) DNS name to your Amazon CloudFront distribution. +The hybrid runtime installation automatically creates a load balancer. You should now create an `Alias` record in Amazon Route 53, and map your zone apex (`example.com`) DNS name to your Amazon CloudFront distribution. For more information, see [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html){:target="\_blank"}. {% include image.html @@ -94,26 +104,31 @@ For more information, see [Creating records by using the Amazon Route 53 console max-width="60%" %} -#### Git integration registration -If the installation failed, as could happen if the DNS record was created, manually create and register Git integrations using these commands: +#### (Optional) Git integration registration +If the installation failed, as it cam happen if the DNS record was not created within the timeframe, manually create and register Git integrations using these commands: `cf integration git add default --runtime --api-url ` `cf integration git register default --runtime --token ` where: + * `` is the name of the runtime you -### NGINX Enterprise configuration -For general information, see [NGINX ingress controller documentation](https://docs.nginx.com/nginx-ingress-controller){:target="\_blank}. +### NGINX Enterprise ingress configuration + +For detailed configuration information, see [NGINX ingress controller documentation](https://docs.nginx.com/nginx-ingress-controller){:target="\_blank}. + +The table below lists the specific configuration requirements for Codefresh. {: .table .table-bordered .table-hover} | What to configure | When to configure | | -------------- | -------------- | -|[Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | -|[Valid SSL certificate](#valid-ssl-certificate) | | -|[TCP support](#tcp-support) | | -|[Report status](#report-status) | | -|[Patch certificate secret](#verify-valid-external-ip-address) | _After_ installing hybrid runtime +|Verify valid external IP address |_Before_ installing hybrid runtime | +|Valid SSL certificate | | +|TCP support| | +|NGINX Ingress: Enable report status to cluster | | +|NGINX Ingress Operator: Enable report status to cluster| | +|Patch certificate secret |_After_ installing hybrid runtime #### Valid external IP address Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. @@ -131,12 +146,12 @@ If the ingress controller is not configured to report its status to the cluster, * Pass `--report-ingress-status` to `deployment`. - ```yaml - spec: - containers: - - args: - - -report-ingress-status - ``` +```yaml +spec: + containers: + - args: + - --report-ingress-status +``` #### NGINX Ingress Operator: Enable report status to cluster @@ -155,7 +170,7 @@ If the ingress controller is not configured to report its status to the cluster, 1. Make sure you have a certificate secret in the same namespace as the runtime. Copy an existing secret if you don't have one. You will need to add this to the `ingress-master` when you have completed runtime installation. -#### NGINX Ingress Operator: Patch certificate secret +#### Patch certificate secret > The certifcate secret must be configured _after_ installing the hybrid runtime. Patch the certificate secret in `spec.tls` of the `ingress-master` resource. @@ -172,22 +187,19 @@ The secret must be in the same namespace as the runtime. ``` +### NGINX Community version ingress configuration +Codefresh has been tested with and supports implementations of the major providers. For your convenience, we have provided configuration instructions, both for supported and untested providers in [Provider-specific configuration](#provider-specific-configuration). -### NGINX Community version configuration - -Codefresh is supported with and has been tested with major providers. For your convenience, we have provided configuration instructions, both for supported and untested providers in [Provider-specific configuration](#provider-specific-configuration). - -In addition, make sure your NGINX community ingress controller is must be configured as +The table below lists the specific configuration requirements for Codefresh. {: .table .table-bordered .table-hover} | What to configure | When to configure | | -------------- | -------------- | -|[Verify valid external IP address](#verify-valid-external-ip-address) | _Before_ installing hybrid runtime | -|[Valid SSL certificate](#valid-ssl-certificate) | | -|[TCP support](#tcp-support) | | -|[Report status](#report-status) | | +|Verify valid external IP address | _Before_ installing hybrid runtime | +|Valid SSL certificate | | +|TCP support | | #### Valid external IP address @@ -409,16 +421,18 @@ For additional configuration options, see kubectl version --short.{:/}| -| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. Supported and tested ingress controllers include: {::nomarkdown}{:/}. | +| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown} Supported and tested ingress controllers include: {:/}. | |Node requirements| {::nomarkdown}
  • Memory: 5000 MB
  • CPU: 2
{:/}| |Runtime namespace | Resource permissions: | | | `ServiceAccount`: Create, Delete | From d3fe3ea0d50795cd985afa93c098fa574ea8b95a Mon Sep 17 00:00:00 2001 From: NimRegev Date: Tue, 23 Aug 2022 13:32:11 +0300 Subject: [PATCH 09/23] Updated installation and requirements Added x-refs to pre and post install config topics --- _docs/runtime/installation.md | 60 +++++--------- _docs/runtime/requirements.md | 146 ++++++++++++++++++---------------- 2 files changed, 96 insertions(+), 110 deletions(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 59a4376e8..50d40d38b 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -89,7 +89,7 @@ For both CLI wizard and Silent install: * For new runtime installations, add the `--internal-ingress-host` flag pointing to the ingress host for `app-proxy`. * For existing installations, commit changes to the installation repository by modifying the `app-proxy ingress` and `.yaml` - See _Internal ingress host configuration (optional for existing runtimes only)_ in [Post-installation configuration](#post-installation-configuration). + See [Internal ingress host configuration (optional for existing runtimes only)](#internal-ingress-host-configuration-optional-for-existing-hybrid-runtimes-only). #### Git repository flags @@ -125,10 +125,20 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr * Make sure you meet the minimum requirements for runtime installation * Review [Hybrid runtime installation flags](#hybrid-runtime-installation-flags) * Make sure your ingress controller is configured correctly: - * [NGINX Enterprise configuration]({{site.baseurl}}/docs/runtime/requirements/#nginx-enterprise-configuration) + * [Ambasador ingress configuration]({{site.baseurl}}/docs/runtime/requirements/#ambassador-ingress-configuration) + * [AWS ALB ingress configuration]({{site.baseurl}}/docs/runtime/requirements/#alb-aws-ingress-configuration) + * [Istio ingress configuration]({{site.baseurl}}/docs/runtime/requirements/#istio-ingress-configuration) + * [NGINX Enterprise ingress configuration]({{site.baseurl}}/docs/runtime/requirements/#nginx-enterprise-ingress-configuration) + * [NGINX Community ingress configuration]({{site.baseurl}}/docs/runtime/requirements/#nginx-community-version-ingress-configuration) + * [Traefik ingress configuration]({{site.baseurl}}/docs/runtime/requirements/#traefik-ingress-configuration) -**How to** +**How to** + +> Note: +> Hybrid runtime installation starts by checking network connectivity and the K8s cluster server version. + To skip these tests, pass the `--skip-cluster-checks` flag. + 1. Do one of the following: * If this is your first hybrid runtime installation, in the Welcome page, select **+ Install Runtime**. * If you have provisioned a hybrid runtime, to provision additional runtimes, in the Codefresh UI, go to [**Runtimes**](https://g.codefresh.io/2.0/account-settings/runtimes){:target="\_blank"}. @@ -139,11 +149,14 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr `cf runtime install --repo --git-token --silent` For the list of flags, see [Hybrid runtime installation flags](#hybrid-runtime-installation-flags). 1. Complete the configuration for ingress controllers: - * [NGINX Ingress Operator: Patch certificate secret]({{site.baseurl}}/docs/runtime/requirements/#nginx-ingress-operator-patch-certificate-secret) + * [ALB AWS: Alias DNS record in route53 to load balancer]({{site.baseurl}}/docs/runtime/requirements/#alias-dns-record-in-route53-to-load-balancer) + * [Istio: Configure cluster routing service]({{site.baseurl}}/docs/runtime/requirements/#cluster-routing-service) + * [NGINX Enterprise ingress controller: Patch certificate secret]({{site.baseurl}}/docs/runtime/requirements/#patch-certificate-secret) +1. If you bypassed installing ingress resources with the `--skip-ingress` flag, create and register Git integrations using these commands: + `cf integration git add default --runtime --api-url ` + + `cf integration git register default --runtime --token ` -> Note: -> Hybrid runtime installation starts by checking network connectivity and the K8s cluster server version. - To skip these tests, pass the `--skip-cluster-checks` flag. @@ -173,39 +186,6 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr Once the hybrid runtime is successfully installed, it is provisioned on the Kubernetes cluster, and displayed in the **Runtimes** page. -### Hybrid runtime post-installation configuration - -After provisioning a hybrid runtime, configure additional settings for the following: - -* NGINX Enterprise installations (with and without NGINX Ingress Operator) -* AWS ALB installations -* Cluster routing service if you bypassed installing ingress resources -* (Existing hybrid runtimes) Internal and external ingress host specifications -* Register Git integrations - - - -#### AWS ALB post-install configuration - -For AWS ALB installations, do the following: - -* Create an `Alias` record in Amazon Route 53 -* Manually register Git integrations - see _Git integration registration_. - -Create an `Alias` record in Amazon Route 53, and map your zone apex (example.com) DNS name to your Amazon CloudFront distribution. -For more information, see [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html){:target="\_blank"}. - -{% include image.html - lightbox="true" - file="/images/runtime/post-install-alb-ingress.png" - url="/images/runtime/post-install-alb-ingress.png" - alt="Route 53 record settings for AWS ALB" - caption="Route 53 record settings for AWS ALB" - max-width="30%" -%} - - -Continue with [Git integration registration](#git-integration-registration) in this article. #### Internal ingress host configuration (optional for existing hybrid runtimes only) diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 51d55758e..242d1e006 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -91,6 +91,9 @@ spec: ``` #### Alias DNS record in route53 to load balancer +> The alias DNS record must be configured _after_ installing the hybrid runtime. + + Make sure you have a DNS record available in the correct hosted zone. The hybrid runtime installation automatically creates a load balancer. You should now create an `Alias` record in Amazon Route 53, and map your zone apex (`example.com`) DNS name to your Amazon CloudFront distribution. For more information, see [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html){:target="\_blank"}. @@ -113,6 +116,79 @@ If the installation failed, as it cam happen if the DNS record was not created w where: * `` is the name of the runtime you +### Istio ingress configuration +For detailed configuration information, see [Istio ingress controller documentation](https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress){:target="\_blank}. + +The table below lists the specific configuration requirements for Codefresh. + +{: .table .table-bordered .table-hover} +| What to configure | When to configure | +| -------------- | -------------- | +|Valid external IP address |_Before_ installing hybrid runtime | +|Valid SSL certificate| | +|TCP support | | +|Cluster routing service | _After_ installing hybrid runtime | + +#### Valid external IP address +Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. + +#### Valid SSL certificate +For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). + +#### TCP support +Configure to handle TCP requests. + +#### Cluster routing service +> The cluster routing service must be configured _after_ installing the hybrid runtime. + +Configure the `VirtualService` to route traffic to the `app-proxy` and `webhook` services, as in the examples below. + +**`VirtualService` example for `app-proxy`:** + +```yaml +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + namespace: test-runtime3 # replace with your runtime name + name: cap-app-proxy +spec: + hosts: + - my.support.cf-cd.com # replace with your host name + gateways: + - my-gateway + http: + - match: + - uri: + prefix: /app-proxy + route: + - destination: + host: cap-app-proxy + port: + number: 3017 +``` +**`VirtualService` example for `webhook`:** + +```yaml +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + namespace: test-runtime3 # replace with your runtime name + name: csdp-default-git-source +spec: + hosts: + - my.support.cf-cd.com # replace with your host name + gateways: + - my-gateway + http: + - match: + - uri: + prefix: /webhooks/test-runtime3/push-github # replace `test-runtime3` with your runtime name + route: + - destination: + host: push-github-eventsource-svc + port: + number: 80 +``` ### NGINX Enterprise ingress configuration @@ -421,77 +497,7 @@ For additional configuration options, see kubectl version --short.{:/}| -| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown} Supported and tested ingress controllers include: {:/}. | +| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}
Supported and tested ingress controllers include:
  • Ambassador
    • {:/}(see [Ambassador ingress configuration](#ambassador-ingress-configuration)){::nomarkdown}
  • AWS ALB (Application Load Balancer)
    • {:/} (see [AWS ALB ingress configuration](#aws-alb-ingress-configuration)){::nomarkdown}
  • NGINX Enterprise (nginx.org/ingress-controller)
    • {:/} (see [NGINX Enterprise ingress configuration](#nginx-enterprise-ingress-configuration)){::nomarkdown}
  • NGINX Community (k8s.io/ingress-nginx)
    • {:/} (see [NGINX Community ingress configuration](#nginx-community-version-ingress-configuration)){::nomarkdown}
  • Istio
    • {:/} (see [Istio ingress configuration](#istio-ingress-configuration)){::nomarkdown}
  • Trafik
    • {:/}(see [Traefik ingress configuration](#traefik-ingress-configuration))| |Node requirements| {::nomarkdown}
    • Memory: 5000 MB
    • CPU: 2
    {:/}| -|Runtime namespace | Resource permissions: | -| | `ServiceAccount`: Create, Delete | -| | `ConfigMap`: Create, Update, Delete | -| | `Service`: Create, Update, Delete | -| | `Role`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | -| |`RoleBinding`: In group `rbac.authorization.k8s.io`: Create, Update, Delete | -| | `persistentvolumeclaims`: Create, Update, Delete | -| | `pods`: Create, Update, Delete | +|Cluster permissions | Cluster admin permissions | |Git providers |{::nomarkdown}
    • GitHub
    • GitLab
    • Bitbucket Server
    • GitHub Enterprise
    {:/}| |Git access tokens | {::nomarkdown}Runtime Git token:
    • Valid expiration date
    • Scopes: repo and admin-repo.hook
    Personal access Git token:
    • Valid expiration date
    • Scopes: repo
{:/}| @@ -52,7 +45,7 @@ For secure runtime installation, the ingress controller must have a valid SSL ce #### TCP support Configure to handle TCP requests. -### ALB AWS ingress configuration +### AWS ALB ingress configuration For detailed configuration information, see the [ALB AWS ingress controller documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4){:target="\_blank"}. @@ -89,13 +82,18 @@ metadata: spec: controller: ingress.k8s.aws/alb ``` -#### Alias DNS record in route53 to load balancer +#### Create an alias in route53 to load balancer -> The alias DNS record must be configured _after_ installing the hybrid runtime. +> The alias must be configured _after_ installing the hybrid runtime. - -Make sure you have a DNS record available in the correct hosted zone. -The hybrid runtime installation automatically creates a load balancer. You should now create an `Alias` record in Amazon Route 53, and map your zone apex (`example.com`) DNS name to your Amazon CloudFront distribution. +1. Make sure a DNS record is available in the correct hosted zone. +1. _After_ hybrid runtime installation, in Amazon Route 53, create an alias to route traffic to the load balancer that is automatically created during the installation: + * **Record name**: Enter the same record name used in the installation. + * Toggle **Alias** to ON. + * From the **Route traffic to** list, select **Alais to Application and Classic Load Balancer**. + * From the list of Regions, select the region. For example, **US East**. + * From the list of load balancers, select the load balancer that was created during installation. + For more information, see [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html){:target="\_blank"}. {% include image.html diff --git a/images/runtime/post-install-alb-ingress.png b/images/runtime/post-install-alb-ingress.png index 56b911a1f300af52a1d5578696262962c48db435..ad689a14c0dd9f306ca5f6d483ca7664fc089ff3 100644 GIT binary patch delta 142006 zcmcG#cT`i`_690Qla3(0qkz&u=^X@A#Dda$kRn}r30rFDK~Z`UP*9QHYv=*#ptL|B zgkA%ohrr|9bI-ZucgK5wy)kyim>DbCtIajn_kDA%`~mV$o#bWS1U#~@j2_rMethN5 zl`B`st`I;RuMk~Y1eYJy%g>c7gh?d?>_lT5uDg|Yh{zlO_{Ud)u6{cNghbb9xm9PiFpKqF}%?qN0*v=6#e%W#iWMhoOZx^uRoGSz5VNH)evZXy6ZMLfoLo&F$pmH zj0fNkKqAWW?R&$}jj-&m&g-E`!ZVU)A83r&ny@pRVcrZIN~=R~H67SpxiJ75!31`5 zOu~_`MV8Ye_F%9zGYR*V)bP!FO-B__Jqo^=Y0c2?&hjt;AQ~#xzNteyS;kH=L3*{g8dh%*!i6&>fYKO;F^x zbtqZbE+~U45)a=3qbAnn=h73WcS6x8xjW=t@qDfRr^Nlu!1h5apgJ&AZ)B(supKh(G(%L4FYB z8Qcg?>mT5g^#1z0b8jKx)Oi~qg}!ZMBXE1hf9{Bzl6)rl-8<@C3-*fn+8n>?cC>TxzOX>mXeEuNV)iUVh<2{Y4(fpxXDnKZHJ;kl@p36#!xk1>lf6N@WuDo6A%A{lyCW7Fa@oi-&dBJ>!&2Bqn0cem!06a$F^3inD-$vR zOI6eo@LT!(m_Bpt|w{uFxh@L2rC=l6SIt^2nK0bXvxKOZO=0r`+# z)M%4Lc};=rteu*(fR=W9KJwK?K-nm6t#p7HbgO!+X6t$Wz|Y4Ox5;ow{c&fJNng&< zoF7iwt4evQD5leGo93+|$J*;r<3x)Z<*XFXaKG#26`~Iqa2v6s#Wy(J0)9WSngwP} zU1yK8Xi(>-Kos^P{g|RxGn>DwTHT3E3R^Kba^uO+c!0%_?$4@@+Jl zi(RW_qr8&Woc5i>q{vj%?>u)7wBTJOcJj zQ9K2*0A&*{C+M_3@aI~wWs~2#z@GwYMm`#6p4R@da;*2|h+i{OUUkYgq1rifmfAMYbralcxT`bR$m6%nG`&Ryp*&hruqUR zqe}@e67aR@fA0S%1#dTKl##*2D)cK1V9mTC-BB$2g@^cT7P>mM#zjX<@YfRpQGJVA zOyU+?Grm|=&&moN4yqCCK&EGaMrfxfUzUci3Wr1d6;1;H<=_De*S@mI8e0U}yKELN zm!yj8&NA#uBC~jDPEL=2mio95zk$b5HPn6^a|+MwVUU%eTk4DUOTd=^K`>kQ&#`Bn zzrN|1l9ylDN9~^V%bH$MW4}RKOC#N#&o0qVf3fl@vtG7)%E{$W+YilBp~8mTdmWCu zSbO^MmR06C!V_*Hc^Dr}j!isv6T5fZ!j3p!OOyY+RerW;qyY8A_f5&;xDvCG*a4lC z=-tx@+KZEK9$KaN8bB!ChdBF?@N-VQ`)U8Apec#{_|hpgjx~}XS%e^m&)o-qpj-SU zKeN&!;dT`JCkK^)>e*$D{gs>DMz{AuOt{mZRqHg-px@x?sAuLWV+$rS(Ai<-L&|!@ z{+d=zUb3#zH?bJM$R4O|E@=wRtj@1ZX%THj>4z(pamF`P1KY&VxVW0Dq}21)*RWID zu(LfUntXfNQ|yqk)5b(8)_o@zzR0{;Nn8J$b|O=A=ds^Tj#`}xylc!fh)6x0RS= zi5$X=5yHDfnxWXno#vf2xa#m2-%!~p(T7@U>w^RDgK@Ha)f$@%T6>eRu z81XQL9%`GvfUcmrA+8az9QUZgaAk3FbH+AebdI8~CidS@5bxXVYM0daArgy#^`Umu z+|bW?HRTrsH2xWQ#ylV1?mQ{4b27!j{m!vi{V?Tux_#VtRJ}!dj$Ie+PMrFE%$FOl zx^SDjq~A@Q2^9ClY$)Xfs)RHqkK3zcaXHD$h=yJk&X|j~^4Bu7y6|&YR*n-+BE)=Z z^Tw^Qb9m>J6rm019%i zT5Kyv`S!a+BnfphpV+Y1elPDkJd!ctIxR!Fi)KNNVQ;a$9Zy3Xqj{~t*Ot*7>$`3Rl~GoC~r8D<-2wHk}8|==UxCf>Opk1@s!W? z69A&TdtAjFXm4GT@`dCbNfu@iT62E^ENjRv!`bm&Uw=%PkvADsoWUc{GCKHRQ1-m( z%eSso#}##+2dIrF*Uk@nITE`CY+E}#O@-(T#>7<#be@2v)z?`Jp13J@2}Rt5Ia;l6 zuhmR9$g4;<|Hd-)YfJ;eOiPNvWnSD5KNU9*Lcz6lX>u#`aOPslGTQ>rN3^*>P2lL2u6@NPqWyg2W)Ac7 z8$5a3B`10Td*sbD&2!Y;&gYB0Nx>E~5KchP!M8DDWzZ#)TO5#*nr%L@osHbx&zx;; zY9j1TBHLtL)*zMjy~1*smr40*NKG(UauB+d*A_C7fYU$roB_xc_iP_~Afui79Kyc} zlG(AROr&%$_C&t=B#}o!M;jgefafaF9<;lD*G#+NLz~SpQ@G+Slw`l^eP05Urg>R| zXr!S17bQlXM`-}FMkjgt_@e-%C%ug`Uwc+M1_x;Qjo2FTRsRdOza=|6BN8-_E1wA< zJC48z!a{?QfI1nDQJ25A?)HFy0m7%(+1Ii1$q9UI5kb_Dst%??FKuA9#z`` zL;uJsNK1{(b4I3PB5;J%R#4u)^hx`q=OAD=#Hn<#v@4gd)JF?BBP<2af1=*AZHb$= zB~!p<&eFDJZEoc6q!AKilR=mS8bPT_xEwP-N0_bzo*+ z{kYs7y`JvCtXii`{LPfWRi8Fyn23@zDj`8l_MF+2y7aEbrhm}#OL6N^2popno|}Il zcJyF#k4`Umq4U8H*e2YD=Y)%inrgKz@oIKs3aNSuZ@Lzwkaj(X5=3~R2Sf-2FZZ*Y z2Z|>lg5S}NdG-*-U!%0QS4NA+h0wQpkX`LMMKQej_PQ)2npL5*>*tA$Mvbj>sCX_E2Xb)_E#ZE2BMVmW06|vFFDg&P>cH$XcXbst9 zjubJYv4AVgd8lnmhTrNh+LeG2;ez=hA39)>2^(cfwr=)R*U)O`IsWLk;zG zs+%$GmM+^>X%*V~2+=0;8p(3)`b4GgPJ+&A7t+a_bGDxNN z8OXw$t?9xbc4eh`Qwbh3{_bpnTg{uugH{UNcSF&LQ3)0fjb<5M6>?+pv%KgC{1v`jmkL8s$#dRgc;xo9&2{-61u3Q4mwk8_z6`Kdu( zi2xH7B`Gz#mxtaHnRx2mp4eRM-Pbp{Gw0&3%St!nG?@>&SXo>N!246dpd?|cgS!89(ccV7Usa-I&89LFa)W!0?Pp}j4KeHp?>~v#AM_2gN-Ik!hUKDpX~Ng( zCB!c7wbMjk-Ev3ew|#I@0&&;(C_ufktFJWCcP<2{bJorbCF*r0jFMmpq0$^JOgOOy`( z==`x*z_3#syrEt$^(IXc%tb>mfFz+hCTYw%5?3m&f3Cto_V_!ze5p_1vtPDaN)r0; z635;bSM+L66{pvbOLFfAlwJ-<)3s;g#5=Q>^ddueIO#V(w$i%OSs&h$EgkqmMSCbx zLnvG!9;|YMXChz?@OM*OB0>0EP^qF~)^pOvAEl~Nh>CI;cV`Sz>geDAJ=msnx=z8uB|T*WyDS$5Ai)mea7!TxyXritw?=g=6tce z1FY;cas@o-N#XP=@ED1GQ*jpbd$#Gsa|_`HtAt88DfR(sXwtreX(2I0`+bU__wwXk zl8V7+;cmcr{fc|MMYrtHQtHWtKJ!ay1ttrz7E!mUy<3APg1kbRee>lS3reGmR#EMF z_hW<9o0I~NPK|(U89r7ARgbIP=67ffM8#bLqMon%3YuLj3gW2Ul^MEm@G)?X!l>R_ z9U4#8JRJr+tYJ)kJV-9jIQ~@RZ!O}|fRYd#ZW%mzSo^C}u&7n>K0`B_N73H;y-iC+ z{CTP+pK}nMCXP97ZLp(3oeW!xvCG}X^i;aR4V&<#MHI97%EZ?DnP*$T+*8{W?&Kuy zsKR#afcK>%8sF9wW1qS7SJWYG3l^XdFJu@UCQFQHvcuFJCqQVaiDV-VoTT8#!;f0p zUD%tD3}~!`nk0P4FmL8Ap>BrS+2`TTrf zNum=9eF+Jv!<7^FoCkuWR4itb@PUY7t}yrGh$zLnP|r`kIVj9|gY2dh6+jZo*l)G7 zE$gpUXkeqha+8_Zk289ei;2%9gt~O3BHTK2Z(w_n)Nh$myCf_n*+!Hu z^gYvtwJ4bEw`=&YU7fF%NqPzz&YqJymwDq{5xLV$Z!rOaLvfUw_p0x0Ukkok%7VUW z2ZGx*&Xvj02e=uD`$lIr)F0MGC;A6qGf2>)=VBHQuUmqRu8iPj&_XP z6x)PUrh<@E-}n#Xt%bx=?V^rwXCXu3qoaltvxZHnpEA~wfh{>%mEXtEy5+qTea72z zSI?FE<$+_&Gp4Eix22}Fz!mQgnU~CKA`28^n|^5o;;DqTAv73$sJ~C#im)6ym{yRmqH^Y0f)@LmCU5KTwr6o0C{6Dq zT7%AA9f(ARgT$TMw6C9i%sLU2w0U=Fq(YPDZ}0?7;NCO=(|n{Kl{FH4Yyw5@{ObLB z#SrzIFS9v`@xgzr1{D>8!)6wqUWv6!Yy?ftlO|tyPt7WtS;yS=Vfa4Tk51BFv$wdp zGl-)sJN*VrTi;VZ+m#bZr8#;Uf|U(FN=~AD@$&G)17QsP12YPDk>-iq;#}`c`&b}p z(!-aPfiS-N%qW->@-F9+jBr8UE}mOg31jVB%sQ~B>+BG)MRJ;{#tO4M;}~t&(Lwph z*sh-uy!^;3a!hIE3cfBnP0Bt%1e5it0QfaApUuu|Oh4CXLx2n4ow}4X>uH8F-JytVGvtr6 zjJbXOF`w&`Pi7kXy>gW`q{99%52Q6oc>JRD&UNYH4*`e8iD&78|T~v1$RyeL@d7xnTH!D|dv%U9mBV zuyVdy6riF~uq1Er)FKTaX4x?P3tRq)Fs(X?CToK;I~&`VwS%I0zH%=L?ys(ym)k@P zeQ5DUP;(s(PA%M?uY2lOpUQEjV8ldTOl_R(*HLG~rn}>ap~23dx2cEpRH@BB)cHk4 zzTBqS)?k&xHrE5mUD3c&1e4Bb5P#i~vE|BKkG}=zz$=Jwkn!6fJdVxA`TY!BVcQuaW$31p+{wI7;xcTUlXoPnSF&9)EB<1>uj){j}x;sb54k( zpC{d@Ge`=_gtK5{F3e32jJ3=KYitB#GK#=U^AqzsRtLlTx$OI;|7sHO2McX=;Njjq z=PSKSd?P{;F1upQ?-^W2Y1r>?gXjA<6!w>t?tA&`U?y3JtS2)v13a2>5upca?d~9t!`f@bAiLaxUN6 zVPC=*^S8?Mx6v9!rqcu^OS%3p1?pdAe|GZ!rH{b>51o8RbCF1M5d{W=$7jbtU{u9R z#h}ywJ6ehXL?!uv4j7F0;kZzu?)yr+L-+0-BL|1eJ32aO$GvAP|DuI|@xx#n!VjBt z@92D*4HxhNT1sb|eDfaA=$HzfD8K)R=>Hr#cl@b$EE%*+`RqtmIED{kFM0p--$tL8 zoAMu{E&ly-N}=mXhB1;Pzlkn6=|K`SMpEhZ<$UFz?rkjo--d9KUY0>SUOxXHjnukF z5PkG4NhMm6BtQLf;=U&NUYgGyt1f_FB$Zy8U->Vm`g_t!v?TC?K8pRfeQ6TY-+ue2 z5uzQ}+S=;9v9nW)L|R<51mjQn4BB&QWl<;;BMZw~PE?dT1qB7ppJG2TL3H;#QFTN7 zZ+H2pApxr?DjGr%-g|U-pk5^awDx7LqEJv* zM=saiub|7^302$P_#6Tn2F>On&hOOPb$9!!jdy55$wd}$85F5@s;s{; zFK=(-Cr_Y|&z;@fCP6_>ISBEj;5b&m=&43~b8+#k2?Ak0k8Ch~@#4cRp3k>J)S1FW zU8(Mu78O@soLQb{xXd*lj}V~F;k1q_eL-`N znP{B91QZZ7E6(a}nkaot{jD(S3#I&P}m{YN$qKdBpe0P*_ z>l^Vt*OEX@_+_@kK?Rta!^6y!`xpO;cYno%e*~cptHEasE?XRjYbhC<2oXda@A>#G zKE45qplwIf#(*!kZt<%J&1Hs``hWfQtvq3nIz!$&hGsz4VE3*VpI|iah%_Rj_K%LHWafgM0Q^Rv zfyJ|JN57fYPwrTjHL?G4)1*%jBH;ez>SF%%e6LNLk)q{luKnHCM`F!Z z5GZ?f7%7c0SJG?(9{`X(YiO&P&%n9&xX<^1USP5!$!KOFu$>R~iF$KK+JAI(#t%CZ zs1(?JS4czz0&k?sVFbw9#k-YQvJcb73Z{Scb}3^~v##UPeqBSEa%l8m(f98noKiZY zV=ZeLZhvGQlarFDK&q)*ll2t22NKC?X^vdLS@cVddEiN!WEZ?=;@7V!Lx{}O;g*81 zkWgP9>g7cMT4sD^#)eJ$2i)&aqlTDJ`Pz<(u%KYs=SAB_KU7|ptpDg97W+<_oQB8V z?kw0k&GD^KlSA$Z?d6(U|FyP5znb!&+hQx|KKIR5(k3^Rw>%YR875(#-X}ni`S2BA zlhp;Mkg=VI#`QF%S&1@(qhl;`4* z;qCeuMn=7|6YTONvolTix4GL0r-_p3!W=MaL5?o(VkyP4qCGmohYWd8GN^YnBNdk& z+QNz4UH^Wk@y$|i zQ#X$aR+g7f{Z3yN88na;T7UZbwFeo5zgP6FxEzMx3gc4rQ`AmY@k?~OFhZ{NS6Tcg z1f74ztEy%WK1g>#w)72V!&c>aZc7lP+hh)8Nc92y>TvhHP1Qsxa2du|LnF)uQ4epR zV>z1{+Xy;#H8Ps-Ercj7zOtV_OwenLv~EXPqmq-9y0g;zg+44Do$ML4?S_KZ0{#9N zB6zR95V|6&36s;vAL~?t8v(;t%Usyl9!iPjLQZs{71gwGA=2m5i#!}6IuY4 z$iZY)KvPT8rlr_ja}mf6(ZKv@KHZ~`c01IaAc^b$;`tt@sh%_ZZDMw80}J+6Yr@vj z5O<$VgPXzI&YzibOd=QXqhFrmY|#9V-irF~PEkqos0?*%;>3p-Ig%33vfWpV zod<8rMjz2V&o9eXa%xby(zIr;)<2YX59I#7AutxD8QzOMa0cjO`KL*_f*b-5HxDvW z^Ax$HV4e#N{+=r)?A_x~H62BPM6}T{w(Nt;T+1x{Gj`ct@NDT(%GT-#I+^U*VA-jc zu1N~91n`c(%qn+@A}=RtRbp`olgmd2IF^ss7%=UrNrL|itSK53t?m@8uTM-AwSuPY<+y?SIclXns_ zIB)wS^68VZHGKgMr<+sn&;rF(KSphGQ+zg&_DZR$3RLti`tZz-qVKnljU%U|3UOvO zafcsCgKdv8I&oxv#5|m6@!K=$z)K;k$EmWU zoaODIb9IjNgWUbi>wU>0U3JI3%2Q^#x<4STn(Y+^FJ3r!t_+ro!A_?w0XjI#rUKpg zbv8E8yJvJVbn|k19Q)6hnVwuFw6BIu)X#nhIsexof`332KU=c8eLF5Lo3zp*&WsEf zDenH#4==5*Z;&{(+s@o_Cl9Xl7vlA5oGJG^U$~`7;%lnhz7h5`AYhRNeD+($bo01Z zKZ;NfGx5~W05GrS4WBc7VbJzyZh52R_c-sIogc20dowr%w)C9~m(%>z29Lq0RKKaG z`3<(^R^lgq=LdsQbg?WIKFQcL;NMQLM`b@UG5L-^oq$#OGzkRD^VjyZYF=u_SX0yT zAh}?BBWd-SmHxEL-J@eV!f@o3?PtUfV<~W4V6a6tpmgx-4q(pSv1Z?&x@~|#oXC)@6wwK4l4^nk$uU~mO~bFRd@ zzKXImr6fW_;vf>8wSa%VcB9ejgj{_o-}$Vrd{|)Me0`n8?}oI}K~VmUe2C2ameK9r z2Q@pb)=u3U#j*U1lUE{lCFj1c7mY{fws_rq&BAhtir?+-{n`#$DYcF|$#nvn6F@e+b|_n^uS*u5=FWIR7Udk7|I~Ku;r)@vXabo2uEo*i z5tjOUap>K(XDio#fLMd;;vm0;+32+~xoCM6(jZ*Xmg4#ny(dG=>??XD;(DbfCNVeUYNom9Oy=kfwN`jBA~TPZw)YgvW0Sqt*yBOMdD z{>L)jnt_3&{8Qa#=Co(CO0%wH^NQxTd!wb_-u*=vH}k3m&%FNVo!-ilzu(NamtXHG zRv4Zxw7A}kKEkz2?`8SrBjt0=xqpPs2)_64m}?N{=sGK=7=zEFSO?pyI&PqZH*`j6 zR*oM6|3!H(>1G{_t{j`0n2>!q-9VxcVQ46W{yi~P__(d8PzqcpY$?^e{q19o%@i+J zEhi@@3L6w*O)Wz18!XraLW5kiwi$B3%D|alI2ux~fx(p1E6Zoozw%5FjRCX>paX+7 zR2v2eGu=4&Nr$Xr3V>dyj>~MNxq<4z4s-sO+gyHyG84!z$&P2`RK(oDp)HY~G>Tba zU0o50SN8dD*x(*_1|&c9<``Jmcw<$TTnAq5z9-NkVJ{nB&shUT6N+muZW@`RIc9<;n5a7F?ME&c*xkLD7F9^M7J> zptYF{)4Xm8GB~=atA%H1{#DDO9$2bam-P_(2D)Q^G)LxKD3krYANFnNxJ`>ZFd@+1 z0c?BIt^m?g2+0Ob)ek_%7u-ZCV^>oBMRno6&HBAkcXKL#N{OtDFI@jw3;#MGt2v2% z#o{-EGZW=|IDZqVpQ9o=VLu21lqZS-_R=QMXI1&Q>qi+w;Oy=w-=r0AXHQkwe?qs* z4g8eoD^!E`gp>X$AJ0ltOne7v?v5Fu$JQJ0(r{V4=NJKr~BW0P0h zoZrF9nt`D{_>B0>npJd)BmME^%YfwrrW-f>K?Y|dsu~O6yJoMl^8XrM;7@;O1!=t9 zG0sr}rT>Bd&NqMy8Q|y?q<@@K_vx9=yB(A)HmFDrG_rAa0*xs($|MfxJLhRwd`7ht(z5k zyaZ;<=N{5`0`CN z5tlylZ&m(7k^E~-{(sfE`qCrJ{bz|~El}rL!vWCD5U2jpf-_mdD&~^z6-&%{Qc%;m zX6#>+`_H*;zSe_P?ulv#3k5%_o5K}6Bd0r-AUck7>4FRanT-FrEJ9FpiGEy*n$X6} zf)I$d>d;IFsF?5HJF0k2#2~HWN44YuoVnR$wW04{{s`^e{KABed5fq7!-!wD;9T5s!|3k-4;2Y%IS=000yY|X7Pt`f&)WV}y*M8c?lsLVRUAY>eyoR7 zH^YEd5|UF=wk`44sHj$fvs~kOQWBCMwY3vau5EZi8Af~fbm-0D{=SisU)_D}`%1Js zn&OHk!3m8sWzge-o{;%F$_vCVcQvg((34FojxRYMl~~er^@dM3MdcI@XaIrjXb3uk zbEoy{;G=^w#rYp?XLVu7Bd)*<%3`|THF%@+Y0E#{SBvx#P*_{o$1I#G|Z+8Ks!j~_qQa`U`7oql{Q>xR8fPv1e;|U6JdFpXBa_&Pgg510V1Nzy7-l?t)IQk+hWP&TuzT| zE-%VD;GRSO+HW$(0D4#RP;i|xror+~y)*8JtLnodLx!T`=wptr++cS_PJy13ja4=4 zA?}4_5b>IS<|k)0i?+El>ZK8`b*r)@iDOhSpKS#f5;`f>au-#5>J?R-Nj|A z#(u}*BJjMaUMoy}n4fs-<&c=SNg2)*BQ>|+_XDQ3z1dy<413JYM4v+=J+^N11_t8d z49;iDK`v7jUy?IF*jfV3BQ1!gDROcFqwD7---@f(*Na5I!l8ZDA3iV)H8(eNAl9v3 z?RdV+i8)Z}DQak#PB%3X5m6ebs01oS7?EM)>G6aDYNpwt1v3iM9zl#iui;D+f zjSUSmIIeYf3@vR(PvMs@UBvD}Eoo2e3<{POZ38X5y$@Q%lmw@yK*FSO^!dPm2g z@LZ3FH4hYhtIkGpy6M*e*&|LbUpioi6U1#qNL|RNP|igSjg3#&#oe$rpb({RfUsKQCvIl|qrfV%WLwbsP zbQZ_9=)823GBUz+Lj8^sYd`5aH>M@K*zr@+KO1=_!-B%M9vwq~rN+@=>mAPGn!2xK zxUQLUX&xoyBxIFKIPm7?uPi0}VOJU}&c4d!TluqN&FNo1h-B9VEC0ydvtP zQFu#Vf1TB=yRQU%*hO-!A~`;8BaEb;Av z{jlS+M?zv^zPWm8=Z6S4-kiI*`3~r2|5T+bC9vwSLq>JA)%|UEH_3)3WNpemr(DJ& zaG>P3S)~~4Y+BT;Zk01FnqFYqEg1hOL%}y82lO-n6;#QmPf?27T{p-`oVKqtegETI z(NNy7vE$ZuWlc$N-{bgd!TmSX2GvIN^73x+kIL7kqB+%p9~D#UhycaMYFbUVx-=W! zash+oAGQ9BsM|z>>W(w7Op`-=98UMwq#d7^e>7{bz0`?AJZjshx#ZSeELf&*i0T*U z)}&YjwKZdNfOF!eCDI`LnLpO~VEtn^=19b}#xzj7@ynMlQ|b4LTn5&E`^?YtAW$wA zY?Mfhs#qq}Xa76L+uAHGtU=YQy9t1PoF~fn{{0B>S+Bi=?~$?0^ta0s3bY26aUl5Q zkEzPUojdG>9e-TN0yTDjtrU9o%E1uPr1aSupGLKDDe>QPWw;=7*&oS=|DYj>>`f9t zWVkiCR@x6$xob|w+vZv~e9NCm$eVo_4hO%oX5Av;WVM7!LtPNzak5o&c7XOB(;r3l zt;vjECfPMVT7S&?@w#SuoU>0ax_aS<-ySWnNCUQ=pU%IHR+GM646A8RR8$+ z@2Sh`wmPGee8@sG(X(ssR6-MUd4n&|!10lRsXioOfR3j8l00z4%FG3IB#W9aph;@C zCapN;LyO*r=4@)R$r}9$F@$W$?l5GOV5ZIBFQqXD?I3g+} zmKG&t6+Z9&ws-Zz<>5{2s*y{Cnso{rC1ZciO7|63>Ot!!6mTuBdgT~CVF~>o(for!SYeXQ|PoOWz{ z>+@ElX2E&}Xm-6?Lm!$!vIPrVsTJ)x`ZO>_Wj*AMt6UjG2#LWKIB`00D+L}IxjXyw zVx|oYBXTm%71-$fm;$odJUb~i$C`aI;;AoKjUd>3>d!xRdlze#_LFuVJ9rWQ+s<@ z=gZ50n>{1>$yrj}4~LagEJUlBEd8k8T`8|wL+k{xA*8eCbP&=p?!nBgK*RUn=Vhfc z)NS)-R96qK=%FH_S(3?~;0hj58H~(W!&IWb%HMUpHiD}8_8FOQ&v%Nl%KoCxp$Y#6 zDa)3`0H8UK8_oD#{^V24_y0(Tx|b`A+@6Byktxwo5@aga*EAn=voS_v>LLrYHtzS# z8j~%%hA&I>mr^DNN1l7w)O$Nk_{mymXz+D{iVR&X#Dhf0 za( z5HZX1si~=@m0rc*{?RFfTeVBGw1Q06_>C`!92!GomY+D9M|)*0h=g{HU6`;KfVl=f z$8HPNkfE<$)Gp}aHr_o%1m%t=GZvWecMm|Tk`6#We}Ml0$MX*aXeD*I%EPvacf7-P z6kx|6%OB@4uRJZrGKtlhEV-A){3O?Oxo14msczc*I%0`WJ)Xpdy5pznB)+NM6V;VN zzT;bD-tyx0D+kMffCiWTRAEzq5PfLoe97cbhSYHK*O2>{*JUn^lh z)6+w(%|J?K=lyA(t~!OgpQtr{*9~>H6Uqq2u}F2t#Kg`RJqES;&bgF7N)bhT=}Rdl zKpjx7LAAarB3vW!*cmzJtzf2r35Aht!w$6aErH&1^ao+wb&ak&+=GB+Z(q%CTI|Yv z*2Mukb52tJ)-2yk=^O8CFVG8$2(K3EoPZ2D=`Km`MG4pio>2q$ClgV${)eZi(bFf* z6g6A51%>Z(U`SwW95fWr1NVJ9FWc86);gVj@;-{PLZbFxX~LyD@TU^nS##E5rK$O3 zc9oms0S$S(fHt!tWu`8qbY*vI^#=wpzzha6Xe%q^@F{Gc&+#%V2uBR zz&P|}tizRMHhCil*u2aU&EC8WQ{b}uV_ z=z}unpd-}&^UHJ@opso5YQLz!?P*rp=R+Qt`>XT)K;NU9EzI*@-nE#F z6F)M8lEe$Z?8`oD?N6^HKnjnPv+yfYEG^gB=wokd(u$-$_N(BeYsS`-;`jX3wJJFHn zq@=7Yq*tPn%^IA)U|M&=CUdB16cz5>riGaS*K?!jFflpWWC|kZnS$`yv$I_cvV0xA(7QUFiz$oDXh60uUrT@ET7D!<<-i9TN8<2M9it-U|i{i{Yf4_kpsT169nBSiYaBd2iB*3p z31@zUU*DVSYHMkl5NZM**48{ti26f_%K0_aUZV^CbePQ`FE7vK2C`1F+##>lpWV_T zVRto79$ogGlMKAvRkN$ugtF(!n~IbSjk8fAwcdzZCD#b-+CA9+>KWRk*N70-j;OD=eoxZByR-y&gdgVm7|jgw5=WNSfkd`%4LM4{HTi>B$^&+*6r! zbnla81+Zj(bT$h%&gY%=J|~j=J5%w!fv-1Q?u4K4$K~T-m+4Wsf&c?%bN+`#eY^7M zB0VkzIB5=CWU`4jvQe^II3tJ*?N3bD6vK}mf)afPt@i4Zji-$ zDmOaBH*4eAml6tP@zvm9kMZ{jZFko4k!)X=+N!L)SHn>{*&C4xQ0GQvMrTjx!~*}& zYAzT1d}z80r*h_vU~-GG?s`LMkn4w-n1>lL*Vd(7Psh*u0GxnZ2Xn)qw3{5VyZwRL z#eSiRDSPCLfixuq<0t&5vh($gQi+tGOpIX@gAyFgGYS%v@h&fi`6VjiL7V>UHKqFr zp2{pWhCf!q8k9NOgVohq%3aO?w~Mp6t!hJyZridx=WZ{`llB?W2T>n{MAKKdc=5Q) z+u*9MXusLn0LsT1*W3b0rqND^DZUqWT)}72+H_6ltkcqQuoVgIin1H( zo=Yz2vEEgt$ZoaNN{)Q%^t@Tv30n@cb4FxT<(Cu3!}HzOh#13sJHB;bQwICSB|tB4 zN9DbwVDX=$k@T3G5(RRe2!8+N2D*D)JUheYL+)agj!J(-X|iMI=H{lVEg$=~Yx2HM zxA|Pfe(t*^b<%b}TRL z!_I7%n)Yrj*MI*eFdTb%BqQ@{0{U{Vo0ys+pz$sB6GU#rqfm2V1ix_IK|(r(EyD;W+r*Cqb1+8tjKBkQk!7NI2eJt zhuT%MbqInJC>EK6FM$>9N<7yNZuSm=pC02(qFuU;1v9ZK(iMQ1pO4)bmkz@s^)MIwt=?>pE85@4ffLkVwI1#Fy z&Vk1X)i0v_E@O=1G|~29oYM3y!!=DSFFLCX_+g9-xyF=Z>#N2#asQgY{p_&~3&>N? z7Mpm_qG6|wfz@&cGH}7Sw#6cLnL)vOuIQbgZH8SVR|X!eOxAdn4`>9o)x-jU8Soks z`r1Ql&NQQ{`_2?6J`8S7JbqIJ?u5oIJ_#;-eL8fU@scjHH5_iwP9_DqagB5MaYWI@ zktMLxy;AKoew>6XV+1_TzZ=%LXduLDTo&6STyQkg%I;{V`PU_ZVY)4L5N*J@_U^u3u7z*zAY|Q9@qv53O0#$%taE zh6MkaViDH#L)W!b8U#CQ29!g=bqBzNKu{OkwXpKbjN$1ifa~DGo zNNpLo`m=x9b^NF2h#8`Kel>7xdh|Fv`Lvi=;vh@1giLx8T;-S}i797@dcGqd+xYGk zUy1Lwo{z#Je)~?(Sp==q9?Vp<%a;AhBCH+oFD%+BTo+K0>{x_!Q zK->1Fmfj3g`tFbt)ZukQAMWqqr`4(bRvr!(xs|eEF%_h$mU+ zf6)!Obrw`l;$6=r4=tAe1wf_HXkAd5k~r!ZXm{l=dE6;_V*MV-G!e0+R4C>bRgnwyhNu$=g>X301E5;pW zmgR}LIdt0=z-B2hl^qqVhqe?!mb~A*%=QH2+X8>q*fAuLMBv$wxzC$!>_mKJ3JP)s z%bpTXOUd8vuQ&QL6MbUWjtOj6FtN}e#9bj!n<9wn9xVvqtTLg)6yItRYhoJb6T;mc z-w8l;3FId3l8Q8GuKb&sIb1kfu%O`&1i4moGBr78apkH6oP3^L&r;A&SvNdEWCBCD z2cJ?Bp#)iUPrE}9bSSv$^?dwVPv<@DN$*2*wb=b>v+N*s;A~$@K4JIf14|BS}^AugeP4!?+0c5DRZ%N1e0{t0Ff>?w6<} zCvBdv8jp5u$EkuaL6&!imA*ASRo(1Y_yqU-rol{E@M6QuPGC)+E1crLbtb> zVa#Z@Y^DgL46VY!LC|T{aCBti3Qw`xf3L3FU2*_UMr|jw_Qn0=9(}3Z5{PbCZ%C$^ zt!hFJOzX=E+OfI9;8{+iPJ69V)tXIZc`vTtt2sQ>kMF_OsD9c)OI*2-;o*c2k-rpg z$DE%!J698=@x5Ic8KY{HD6URCr^Qk@2(S@aCF|u*75EAnbFolQxc1@RQT^w4DYCj( zi=7>J>~BRDb9Z`sWmHtufSUgPezO{jbcH`cLb-PjB}%(3Xa&(-P86S}yz>d72XCqk zJ>MBP8>P`z;lrukwnrFrI<{l&^?%cv4V{x$%M|>FB(bduamLqJLukv&%9@aV6HC`F zEyIF;0ZPY5d_J0`0@(<>!ca3o&l7tU6&2sKh%RW248(fai5x~Qfdd?rKt4d5vWyeEuI;J}MlcD==(|B~{Al~=*uE>c_uL`DIdX@l* zZ{l2|G11rCfyHx46%rr9-n6$6S+rVxI!I;EH#d#tpa9`jRYX51zh8=dpIl{>hhfUz z|KX>Yd26kghba$VG#GN>^sLtJdtOlJETZs81+nEOI{I+t@bV7 zwm9(_9qmtxZGbOCl+3B~taS$p#ogsIH8K)!1kX8^^*rQ=dX!V)%?G_qxw^u8$HsOx zVI$pxrlO>Dsx}6)@zgBO6p4}!=|6w5gFlOY^J1;X2T2J9sO+~uO&A3sYssJgT_HU( z7DtF#9eP8tR(s%j+7T!G%_a#T5c<(|=3%_WQ?{t5FGkx>8^)5aJ1LXB$4w`r96h)B zP=V%A{6=qm`;+DrNsMsY0@X0t{Ne)QI1W&7`C!3p4f+#Ln}- z?Ra{O;4}sH{NuySDv=DzoQ3MuT}ZCo+1VNB1oRyzCp#Z;R3S%2NqOwLZ>gfJ+<-*S zL2?St8fzIE)e_B4H{)SDcJ}u5zkk24!f`#r?x3ijTRvIQbY9;C@V(=%K?sMhUmGW8#EUQbDVF&IXzRk9gOop4DheH{+HzowAUSr4WaEyc8r|c){fHymGu(xZLQD z4Ww{=4D(!tO9m+r5dy?l3)Q;#m^ zjL*Q9-p$q2vRx6C_>JiHA+>z|&JsPH(u?_rEe^~o2~U$^!R}+M>!js4aj$@Kx{(?M z6@A_Ut>PeHG-8(@KxArFgqB-MD|Dyhr#K*zsVrg+?fAbhS zK0L#9EEK3MES#x;5pL}LFcqgtq)H~5*1gA<`ua~W zO?dhyxOX6z&<~Q%x6}bgx`_ppH#T~#MPw5`p1iuCxK+Q7fS`|lHUf+s=mM@2BTBo@ z&sDUM^j_m&59-{ZFN$oW#=O|rv`y%icF0cqfTYtu$Z|1?avZhS-TOcIrvzTSOxkHV z#ZuSMh$!XQ7z7VI=r!WWG1WIT`N}H1xV*gFTNWs!4!i2bfh_#^mGt0Et$*?uK>1oE z(K9pk+fA*XkzccVKW9Y-#OHL7K_lvIf1?Ly4G?A z&K59pxO^UNKm%yGAfI|J!)8;YC!GH~&bN)J3?$PV<3*_n2;p3dN2>=yV&cO~Suo#; zyI5U2V&;?@1GS^6X^68o4S^iUq`Bj3pgF#SxB-3=!+`~39TUwky((@XihGvuDA2gW zV;mAO7zs4k&0RZDKDV04FoQ@U%IWx=?!De+2u*5p6m?S+ea zt>>j$B8|1KkX=KcC`Y_;r<_UGDdBmpWB`0&n~&nR!EL*}nvjM>+ZUz8VemS5%x$de zxp#u}*RL6pFhht2>vXl_wt%_OXe+~OVe~{T9H5)`j|XhU4!LaSIcVmNKT(#Vkz+-P zAFw0x+STJaS*U|_-du@t-9?d(w!ajUOi7|Ev9-59A1+Tzv+441`596@^(u)Dl3b4L z_uSuu%=7B%p3jk8zWXy7Wj7V(U?jvk8_kdHa!uGZB0!S;kJ>z_HTIIK>h+=WER?Xh z6hJ!RJxE}lq&uH(`}bphqk0hF(#lLty_Y%qc>lP$CI-y5I2=1T3hi`|QblhSs@b5) zuFm0J;?A#bw7<|y#bEb}Z`cwW$*{CG7<4`Nsa7SCF?6g~Y))wxoI6|jb`_|eF6Rut zqrJI+w^{(kzMTAl+)k^{$5M|6E6ncN0kQ~ux(0ZpPjq~A1DId~ncYRpbr$tK%2Mnp z-V`n%j8d>_jHt63ug|a(@Ys2uUc4?W)wc5@6`bGzCyMcb+g4x7t{{^130 z2%pkgWscZQ2i4ZnZ1Rozep_y)ZS&4l=|ctJ`b~}DIZip&etua^Wqvtnbh#sd`f_|n zvx(4`c<6*(e-5v=Vtym;3@VG#g zi7A;_rZc`qw9YdYNrb8xFhdd z$&yX$BL;`2uQ~o%U7UUuG#M*C=NOVtjYdDqmo#0fc@E^z!#qYmPUh7S zOF_gtuF`EHlQdguz{c?ko%zKJa5cFWUd^5}>hB+TYVG+c`14V>)7rIxPigi=wWhXe z3L)~N6jXQ|jHecu)rrTl5hdFnvD$@!OW(w;<~gJ`9hU0o;CShLEAwgnZc0x);2zD+ z6P9)yh4v_R4wtuI#vNJoEVe24}UV z&9CL}U_2dpJypQl<#-w(-3Sx97Gc2)IX}n#k0fVuf4GT8)N^4V`nBe>hK|Ul}jk~}8Ia==W$xHiP z9SOs>4cS|^X(AW)&}#bpFlkwGBt_Ygu~P;zD}1256 z2lrTLOx~|mZ@RH*crpD-jRosL+5=!Z8Tlq=o(kG0XfXp?qZF=YpCb?#Ae+(>lT={x zgO7W99E{mU_lUdV4doMt$mGh#z1J+Qo!I35{c3&0H%j)KSNx8~ux$2aJ>3)4HsmTu z#(bgnHMe$5U577X;q@{`meZHl;o_%{nC)8^+`z*ni`+A6j~+#r&VUvDcmkmCS=7*; z98i^?10@Q%bMD|!d@yp|uk|e{b8$MqFVlo*UA(}7d_&A>%Yjb)7Cf^A-J|F-{o7!j zOGkafX#q&#Sz(hX_1t!MPl$Hd!y9vNN87!&5318rQapbe55u6ja1VQ?iA(C7SDZ-q zsa0CFp6cK08DMcHInIrMY(N++^5iB6wt^_|kD@Jg!B7ee-gDq5I&61GRxf7gw|(>( zc(Te&2|1i_u-9OvU)dbM$)-8PlrWJ7zC+uHkH=lI-o@IGO!<}A&WpP3VV>KZVv08+ z{IoqbUu_6jNz_5dYKx;&LvuoomwGCQ931NLqkRv4eSTCuZ`pLW26B!xPFq!9fL5D^ z;&LzULW2Vcb7-*dS13F_7#P4lP#v1O6*jN6*pYjE3IrE%$np2|%EMhAb?l*WMvr1v zR#uzoJ`*YI`fgk8!>TG$^kWfhR_i(KFShVtTbd5NO5xlT|IE!$u=W#7@%`6SkyKDC zTFKk0_xw4nO(yJZ}NhX!94p~TSLrS&3zb71S1$B_5Ja>u0wsJ8ETWBs!ImE`C7PCBKh z7+O@vrfDAT;cvxq_p48| znAwe5=S3w+fEx03?>E6h)=*avnuMqvQt~JpVH#cqy&lynouCgTVA$84PqZxcz!Ryy zyP~V-D}@xyNYZT#sA$fvtTKFo1{o8lWYScO6HL8yD$O%(wkDHFV8eEu3W|}92sT!Z z!lA@j;Moi~BJq#LduTfSLP|!Kr#jQoC*5<(A>w5LfL&u0P(0Gg7}g^=FBB5)SloPC zxMa^pC7?Y!t`CZ`NH0jJgWf1(4Hk>5?B?F9MXRlAT z{`UyzaG_b^k1G2fo!ZVchUfJn$Id6e>5MicQWr_T!f)6B_g>j7U%OBs{HAj^(!KCn z@MV9cau{KMNVT}YBvXA8cx@26^|G0uAR-sRf$LMw^oE_&s5OSj&@+TuUXSH~A|+Ra zw|(@2=%b%&+W1j=o#8c|xJPfLam7{pP5C*%Twq3E>Z>fv80Nj7o88r`#Cleqvbf)8Z2f_=D9XXPdI#3FV_ zQjX+DHmST$HM$4y_2^T`?&EHM4|M*7U3c~~>Cfn&j!Kc2(tQLrloWf)hNzt+$>dzd zK!1bymOE;p!~J#0Tzr6;v9htotTeyZk5rv&=fF3HT0VSiabB^kWMrnz5L*h}xE9l$ z%Nx{HyOSajx-mTudoqgzQGVevWS3rPBez&CZMG>j z`|eMREjBx1j~^Aqdh1?L4Si6A@iMXM0#9TXR0G!wbx^`%_W|@bxb2GFK@Y66`^7qy zUbG~o_KIE(Z+3C8v9mDd;H$V~Io7n5#PZCz=y&+k&Klsa`cZsemgHqMSDVj%zVmF} zD@qD?knxx8;6MdO4Qe~L=YL5MUSh$vp!~YYVB;m}>`2jQ`$ejdXo=1zD4tq)6M$Hl zndQ@nc+KPDlkAJZX6%!qSX$qR2i8t04IIi?a6){EcH{GP#qk+bt?_R9`-|4RJZvxa z2J0raW(d?B+gG=Hd`n&;rsWOE6@IF|86E;J!(Q&kvH+`3VlTo3WBd8JIZPVIhOV@Z zULXW>0m|jZZrz?YBogn~nQ+NR02>{zdnAtFBRbeZs-7jZ;c!fiiLe(VZ*Xs*=!LVz zP#Z}=dj1`hISy~N)JTq5f1je~e>*kV=bQV2k~79?Ly$7ni?)q^dSRljgEk)e zHqOIoeL?60`^>0OXjJTGD_Syxyq5--%rE-ep}Z-GyuAN2QVY@Yg!%$OGv5~?Gh1eA zRq~e746BjY;Wt-TmxUobz#uM$CBf6fX*Fpck=1|~xaDw7N1x0GnVvDI z*}4yr$orL5EVI%ev$B6)3a&#nJilEvL_1!b?P0opw|UoN@-DB@67`&;o5w@g(>iJx z?FH#6zr#Z7xWwHN4osCd#LZ1}{w7D#iMIV%Ai!uZ$ifQ-y#DLU4vG!Y&rwBfH(B^q znpTjPjd3<%on$N$Wgos<+c)NMh?-*|0r2zQ1P{Iz=D~uTF?YdG2YRh9N2@w(H6-tr z!*2fWYpuYQxv1e^N;4sXVI=6!#f>it!cQ7Bh4^8@3aOe2aq@S`qJnd{I(F;+qAzNU zVxdViF05lfY{7v-pDWq^WZ7oE;2>4D zp#8bN1!fqJSOu)pc5Ye(8ri@Q67% zOblOQE6cvTy!|CqCFt{RA|FZlvIIHfUW1N_N8#3>8cl%2w(A}GAl1v#g(#n(;2#e( zKKE+@hic>?I%zo`?1-1|tA6;9+5Y6S*<-R+AWoRupDF!-@Rzg`C!U_?_MZL%Qs9nv zbKBMfKq>k0{lm?p3)XQ3zCY4)oW!RY)`znym&G}N<(}@g$KHM)Pzr_^s+Sbp6t#Tl`L;-cjW+DnPJYQo!n8qyU4Rzr_h+>;b zl~fqsN8qu(-}Z;>apy3_x*A@`@ZE+ephiKzg@sMrn2*SVuupG_gJK5jv`W>z-R1zK z^3`aV&#)8Yrbf-mSKrWZJ3OKalo1_o1eBapT064;5Qy-HH8m4Nu=`kpXnJlxV|o!F-G`6LlBZ^sb4{F>mFO; zTAwv#BI0G$IcBNm{B!UqACN|xc!0!R`KviAtekAns@M1(J*!z{;ZU}}CFRFWZmV4X z@C<#5$OP61$UOV>=lStiHhDt6}@@?^>?whV!W>mq;@XD@-E`ovP$5|J{}l)KY_ud9 zSN%EK!nw$I{kYk~P)?HNZYk{qUtiIk!cUxh?#dF$(aIY6oYiSY3{#c=}#T4}`_5M;4R)uQ3ubaRpCVw+VkT{|7DUXUdHQ~~=qtLt5X>cT-dv_2M ze=x~liUtsSESFl0^Lfgb%!gye5=hS5#EG~1J-v`KkToj!!1S;ikp|CKy?bRVLfKKT zbK?@&?8@0XD0l2V?cF=RA)dYwR??^N?O#e?Yb4+bi$acoq z>+H4fS#he|yv7|a1&G1(fF)3l#Hf>xvz}=TUmBq86^(rMY-{r4wOZJ1a15AuAeKR& z`WD)LNxWzz8GKx=pthlT1KH;JY`eg{Fz_1uM^yLNjiC{=-<`SnJ>I=xMVRXajJlj{qFsoDP z7XjT!sgg$f1#`Np6umOXegen*^i8Ymjt~toG<;Ar__pFt5n-kH<0GOg)5Yk_|Jz`L zCMT=LwHhBw&(Y}Dl_IdknDI_~$;)H&*kJDQ2j2w<<1v9}r2cNdvX}Lh$kqUel0meR zGfOnhqR@TdC1vmRp^2oEumh3>;-z;6xPN{#)mQW8*M=v$$6@Pw1- zw?k@o+o3Z}TFRNV&a2jkEy;&o3!FToqM8w+(-3k8aI9-j_z4Fu;?3%^{9~jp@U;Sq zAA`riF=vChLLEVG8mmB|cKs(ACVDog|Hf8kzYwWkdB`X9Fg24GLotj?BkzsPeYl7D zuW_$AuB@qM@K1@9y5Gb~1j{NpC|KmaTGcaxH6vUA%gT!9N|*R1@U7OJF5FgHVmovl z)?3*vk&k4?P0EuZPOH>qQw<4#lpWn;)l*w=jrfV99)6Tm=g)?R+^5v1@f^*pAecX* zZI-)a6`&(vd;kEr$;%4Cd9a$iZiaJMf`y*K(~-$;e@0Ddi?Ix5_J=F{WFO{$vfYuW zs659mBr<#F`SkeY@{G)Ctr>rkY|hwtEb~tNWdGWI3lYCnUYI%)Kmed|Qkyyjk|JV# znfZIMNf?BKxy#AuOPL2Fr2Ox$Xij`;-46wy{H3ln^VhJ^uxA>qYzBFxhkiS31fvJg z`8eIwnEay zhe9kk6J9;>-O}7kJ^@t#Oq(Vq^A2S;t(A668-_U`C13Ilj?NEVY756E6+O+;JJQ+HTsKFTiaYD4@mz`%U`*22_`zr( zlOQm2x#^zMh$?QxQd(Q2_vu8`sj2NX#Xtkw^Z+5|d4P*OCvX_~6nU_nqq(-u>{V7Y zR)K+kh&G4IFUcYjl<2rAI)PrNM6Se{fkyZ1`$e3}EE~<1V=4|Rxd|&z>z?WKL>MVp zFW{$wQtyy_dbDCGro42%(3$a!dpM5 z(Bm^HLs2lvu9Hsxkptm-w()1_k~S+XHS0r2Gwk$f&aRVyxwLLq;yO>KGMIa)rj65N zLf(SxXv8b?)u4Fy>p}o|bYe4r$Vx-^ggg_9GfWJFn z0p=uoizBo<{ zdqyc(Pltxc#{*Fg2~^FLw%sdG%_!EZ*eJCKo5zfi2B8O`wd|vU9A(&|wR7!W`fH}R z6hqQotkB4)foL~4L$?#Hum9m}h2yGM6~7Uht1LXuD%p?Ut6w^e*D~q>@wC#_C^_S# z(HdlB;v7(%Y0wFmA?R-rQ-MlQ_NE#K49uFnsDR`4(10d<<&P%oWvDYUC`rdE2Axhd z-iD77>Log>b^nf~)1Kf77!{gpv68Ciu^afjV`p*){GRw$)9KVQQo1bpH1jm8wx0X& zujCJ03>EH~^@&#cRX+`HP&dBAyC5;dsAq;9Mrhg{PN=so zMFQp^&}6&CGL)M3O71QIIa73iB~xF;Pe8|7vh?sDE?f8G5xIY=jlZ_#o5gH}TA~gq zCwTIAT>EyhJz3Px+1T1l_bGy2qr3{vWp zh_I11pP1)!hudWwe2B;kXvh20K;R%b=c2?9SZuDcf{(`t^dcQY%Gu~M;>FIZpBk^l z<0}1+Mu)Z!yS%0t@6O_ZgB}W`C5UDGFskiYZ`c)*tJaTYJ$lS>qTeG@o>csN?o_c@ zx=S{NU_I&--4NprilFBstK7g;d4)lSe*MTuudv>y&qCc3ayFJLxdtgTxj%o!)QJtG zF?IJ+uAk-$&YglKzDF#ynS|^|KRy`2b#g`4z3pl67}mQ8ol#YPKHnU(~)qU(PS;yI@-Xz znmlqt#vZGD{u(z|Q=s!nOu-J2xrw-^R^aZAQ=ju<_OzEgqt6y=pKUDMXeSg%=b(aW7&)a>qPr?nAL-rRIE6omecigslaP=ZDr4u zma!GI8G*|>0VWKz;4s`7iS>f`^gA}&)$6Iv-rx}tE>7lb#-p@s;U%sG2+3a9BIm0TPj=X+6qvfNIb5S8hPW?H80e9Y# z9|f$)sb@-z(}lpb#NYl>x5~mqYbG2}O+pb(yLC0*svE^c0nO{y=E<)sgi;v|3+4J} zJ!DV>%Wi1Eq~mDyH(1iI(ajsEabl zJLOw>98#{psiEH>!$4^Ay2kRJOH;3R$9oB6!&QLkx&~CpmYf3M!4GnvG7C4YXso>- zBU)}D%bTDAx&tfRa=oM$UdzF%wFbA|F#$13{KK@Cn-QC!G?1=B>kWZa8~Tk5)8N)d zfKJIYW{mnFBFaB_7FTQOV%g#9g|8r}M)HMmKwr*+;=j+yK-5k3jI|0Z~%<+W>6*Z;D z2qFilc;&-|@?Q5Fnf3(Vs86RqpBjI)wp(FvT%2lrRzt`guV_<%g%Fs&-ebz1$$}8v z{^(A(OM^u792%E26%Czf94hG@sM&p;w#z^Uw~IEhfJJ2`TY{HrVoie7o)m$wxix`q z{3W_I(bO{GX5M(%I(#!j_5S&0n5lce`zvD4VNx)w(ykcROXOZ`mXbFkkgUKBNux3m zL*G}#bIP|;qpE&rXqjEt1AMf5__g9dk64!#5||wblhU;$JPZ_UF*eV@V~`UaZ&*;y z9V;CKegl{=N;5zTp?%*d_15Ks^TtTzONDX)grkiYGV#+o;e%3d#A|{9gmOlcP0Ug7 z&8hw1mGiQOFi;d4g_6T9X;2ne6IRw9Pa^`v6?MUDIw_(aV&BI}r4Aq!i$YJ`fsYNd zm^JeVU2fBFXG}&2VI78x>ttfO;4^|z6gc4N9I+0k`U7*yKG8Z;8A?7fPEQBfRxpfR z`w+v6l)+nwmqcSQOouars4{Zjq#7pn7qH!3tD$}b{?Z%Mne=$-nq>kt6B!LN|dFe+Qq~YY<}%=CEk!AjB54%25xBDsCM|bWX)BH zZ4PfS+RX*6S-_d^=5;i$Hr=8xUnvOpC@gv|hKb4TIR@-r=3`qxcf3+v-?tuljynZ7 z&OUeP2mTo}zrK6aCpbhjF-oo$3}|UQ4G>2P?z4n?t3nmk$$u=%y$T*ao{N{%cjc6^ za3c(fBrZS6tA7^r9BdpQMd?Ny$PDf(N+GZr3**VAD|KtW3ijQd)7A^e^dCE(Nsox816V=!FVufmb@^w(Nx0PrhbaE)uT zby#MVkb+)HsxSU3r`x@pM*51oYk)a-_-c&nBfT>ZTC4lX@ub=dncsuowjQ!ZJmcK= zsn=U}jyN1cTWT1uNud-0*)}HuoHHX@rHjW%CVQNn=P8ffR4fT7+a|GPWMj~M@xt~| zHdY}nQ2jrh7aaK_A(IRh(9TXq%P|Elqnz!LD*+u7!u43o{Y6xYyJ6kf$D$zVG#%Hi zZ(WR50ivFb&8D%LG=s4Tv6(phiZ;Yv3T%+}op2OjQJGgo{xH_6varwyRGst?kxPXc zi3g%uzNTM@D9ZCUTlUpA@K@EPj`8dnV30H+6uK7pJQwkUz%UQ6G;dFM8;XgvYXVCe z-P5Oopd6i6m^2i0ph-+w3M!Dq7|yt;{$)vt0=cT`ic~doWihV%C9Ol6wc(aErVCRw zA;?DVV7KHYpUmu+=)rCZ>$ggTpx=p()M(e@237vuPXAO(J+qp|d9WvFi$vPpW#n55!~J5(;XM zI{>v7TQ=oJU$h|OZwP4_U8QJrQBuqXAHcE^B$x)nWTxkg$#gGT9gNL15*>7Z*-jr@ zF0lCT2+e98?^jTLsok^VYK?hW!_4Xw3MT1&uMVPFL-LjshlJw5sDo9@A0~xV#RCJ9 z*@v%c$le#X?6!^w{Pb1`pEL^}?=&-N2Fwi&`D!LV&h-Mnt1vWPnu<5suO8@|%>u!P zVwQqs{@i(-{qf*u`9mMD2r)?_O}`0;P=SM_D)s6n&fd%jG=9{^B@i-in#8lDKm4&q zPY0AUTTNu`%)U;`f)^#cH%iqj!xG7Dj;j?+@C-#a3_;jb2$S~^ZoK6r97|pgj`0pR zfm!cARzMKw%ygS$0$Jc>*gaW|HK41A3F-=>3OhsY0%%At@BC@_jc=d;v?e8uF}sj_sEVA=k!McXJ9->V8#S9 zlaPdmF7z`dxe! zz&oxkajG#X{wmJ%0FFHCvBPh|hV4?-!$Is|l1_#Qjhq>#u_m0-IYTEW?q4eAQ0FbI zKox_l#eMGmfzBzv;1Oml{D_81E^YdAI~yG1uV^lrbUh*beE)SGF#gAL4IDe;*$L-h zT?{z6m^178KHaim;`+F4Cz%cY1-Z!4`Zx5wN&@=)CZKaai++m5+m`*;_|fe`ZrvSY zF1dT{;grT771+Y%xxc!@PGf5IAEc>C(NO^WUvWSyZBgybt%i5Yaml?`*CV0nF{k`$ z)j#%H1YxfC4J>^EAdP(Kn<(ap!eh4M+X?1wqZyp=tmI>MJRn5*a?T4C4DSCMM}F`m zn|{>j3PF#%x&9>a55keOVtfTX^3amp*H2#j!;xzgVX+|O?EmLD^IWz?+Y*sh=fuH`@^04M(QM__^{;I#Wp_Z&1fHPuI^quUh+c z-`g7HW3#WBMBe1}70yRpIAg;aOXT~_i!JMVMov% z7Oy8rAYrit_RWvtsgHFO+iEmP8tUc%!F7IjI&vhJ$Id3Irr{1#0&p|76 z-ex`^{}Z|spnjb4WhJSYcj5BJujYq8`yC&!bCa{1(rMk4WFT>;dj(x~z3H6M5L9Tf ztX&#?RBbtG{bk%K7I*gNgtZ|#?o7NP@lLqO-cj^sk)F#)qjpKnVZfK3I}7tAZ|jEr zC7HvaIqT8Dxg>rGq$~-RW>V{Zro?8Fu0nICn$6Idx)_U)GHoX4F26h*>U1>mw+RED zP%Ju!@b|2*_MF|l(vJAv>wbFdC7`J6NUO^B^ER26E7&+h4f3;- z_}gwL5ahR|><_HgeA@j8>zf)ZzEv8kDyi~whwl`3o_Cly-sCs(P#^CezB@+^GDHh* zhcXhaJr9yvSCOZGKw6AkshZ(Jxr^e_{YpHpAx zokyAIpSUza2I*7LvCt$EuSb7Vgdxv2^&)T{+T5^xtB>{H-*s}M-8u<(RbN%rh4ZP8 z&n@It&TaH}j9s?!@>HfW2tFeNWZ)A0m#_6-OV_uyPF!0oh3j%ep`$i2qh^a}c&WRF z(aJK>+;V)ARuv&=P9%Ku5k;F;ey7XZhgzrTza?DvkqKnwKE2?WuJ}^%YTG}ut=bs! zv|Mbh(Ani!AsJ;E`L95i-dTmQdxn%{?^UHclj6!p^1lYIH5StV=r!ur#n>{Lc>K+S z#@vm?Z^u8%gGK*aZ%17;`lElO$%5{^Uhl?ze1>sF^BM5OhVL{3r*|nThCapq{&fb8 z#w&jR0}IX35^b{KP6evIJ5v#(FeXmWTtl!PZu7~#fg?lwT>#v%yf}L5#ec5sJjxJ= z?`5;<)M6?AbdQCfK)}kFYa$r;KL`JF*Fhqv%b28tPOGtzfnaL4OYEo+n$!a#1*A-sFhh4c=vay<{AGjLvC&b3x}E70 zG+ezT#OaJ_mft_B^aWYh6aHVVi!2hDDFOC)vzv1!Z{@irf6gR|EJr5=+Icp3MO@rt z_ek&X-kw|`^i9-uGxhE^L({S`$_)8J}oc_McE!)Xy=)xA`T*)u3W2{ zTYD4dZep^AUbW(@e>{VmdAxT`Tv*X5;JtcPcmGK|Y$M<)NVc^wyTb!ipz*!)@!-qYzD`JklAK^g#Y+o17TH{q#C_ z3=Wmo{xrcfk4W92a9rlG04CRTj|E;cp!75_g(DxoFyDtl*IFS@Y-ZTQ6zjps#GO^$o$L zX792sVQZ_p^FdRVTsDCI6U9G z4t$zXq|>$j%n!Eon~S;96@G0K(Q^T^+tP=)nbPB=hQp4E8?e<<swQmWS_t&9Ri>3`yD=(fzBmcqlPhE;;rr=9Mg> z+sA6Qw7Gfsy-Ji(qyoUaHuK>7twjO*zaz(gJD@yrsKR&uC(rLASKtYAXvl86(v>x; zSm|`D`K+U}FiXSHxI2T(I9h7IT5gredj8KHC{aNJ>W&>8NL!FxPdL=;!DyPDR@`Gu zMDA~?dd`HVYN?$FDUpIc)@UzPhS-_$wDwkz;Q5@w=Eay-! zvI1#%x?&JY{GGKbRc~0Tu^4iwU3ARi9q|#cQcaA{7IO3j9eLIYDOynfvc9Gj`&;4y zIMw@O;OUN@ba>1iH!ZxudO7>nN#jt0YDUu<>6%eLLd@bNK1{|;+}q`S=z;b8Pgc>@ z&j&3^^4^G=OLy%L9~=!Dk0%ixnWa!P$k!Y*q(hcx5C%MFmH(fWs#7hJ7rgXa;ILdS z6jy8C7P%5+A)KvXtc(e10ja0kzh(p@v*Z?Yj;zfQ{BtfAL)TuV>KS`qeh60*|5^o3 zt1(Y7spd4Rc*t$b4g8HVN(B}-(c$;=i35WZUP;m)5u4cVk!#e!61X z;n9k)$3XP-l)uG(?=ER@@2VED$u=_5E@*fb|050d0*i6NExX1Xi!=&5`gr>npvBl? zkkvmyiU$r8MdnO;LO4-^s3F+`GYYeRZC00#AL1ph1ki`z`iELRPp3%&jbATCl7D%K zvBc0>FEy-bR~a~oFTRV0LT0F~^yR%8|oMzfJ60{rYw5> zJ7`i9Z2uG~dqAh|zw4E4! zB_4{cL+*z|7u9}YQ~5bLxe<(@C5)|8k3W_yBbKfp{*4IZY#YJH@EHD$EVbwF>T9pp}?R>zlwo1=&3>lZ{czxkE3PFve3R)3)~Wku}yH z>HMp$t89)%$q4%xG_4`|Q-2NR1a28Jf^wtSP-9c|+@si#2>do@9J6kQWA7`XyGWoG zlb)cO{^IM;iiQu1chaj57jcsR4deb#D53KW1+k&)*BZQseY5!)&usXgEL`Ht&o2e+ z)6Z*!xn@II2zpSq>*};JbZsL><>a_kPJYaG)YZ+bG1w;mNxl6yp%jhtL4HY8yQoUB z|KZCW+noLkCsy4$8!_uVP&3Q6Jm*+*Sn)!Y)Lhk3qlY&Kj+jF!w zvdadOp|nUZx684C48_hwdtzY>ml6%rk)R4lLh9 zv z$|#l2Xg(^&u*T~C5s0_7Nx1UNDd+H5N~u^{LCaOApTZPnQKP78@hDsUf<-83P@#mN zp^Oec(8f4Qa>TM>(a4~0iWD_8O&sfH7-;55$dEhmJUOTnAzVX;?+RnV{st7XVxHMH zJP)Gfx5i+4y%ENNa>(a-rCK)KF7bUgpkP^aQoqoDh=h*e8KBLa#Hx1TKX_kF%l5rk zM%G{UDIo2{H(a6{b-9|PMRt}2vwYSTx28adGd0>aR%<)OrPS{KA?vLJqUyixVSzzF z8l*cEk#3Og21TVyx>It1LpKbifRsv!lys*^H_{z~Fmwzt#Cy2E`@Qddp8MCp#F?3M z=6ufHYpuQ33E^#~a8O%gH-q$;*_i<&9D|*lwC^fUy)%4>2$fp{!GlZ|uqgF8NDS?x157sAIZFe=!D@0Ki#| zU-WXCpNM9~{EqER)s_G9)QDbP==2c>_Y}&7y(~Y^i2|mS&LX4R>GtjJCy0?0!h2P4 zbbi8mU4Cb*T}RnK(~iu?m~9%uKW$^rqbVu*0ty+#!g*wLGH~5N&WovBlH6TeUq4#Y zp1x|L3)+a$b+=!WlbEw7aRc4{{T=dheD3Tabn6)VC_Hy1L}<|3wjU!rZ`h<1-fEZM(iw-WHH*a=Ow+FVMJC(40d>}7R(J|RBTzM4_`{(Kq)IJm`m2l2b z_B`bw(Hf-|;ef#S=+{X(swkMyoO9&EQ#3vswWcw_7ZgNPuV%Pen87PYuY-QT65|9$ zp8PLB(K}BqGOHxA+O#0fR-FBziK$vQTy7L^Aht;sLYf1|OSf4^iwh@GuSsrXh6Jvh zwb6?v%x-S0J83UgTEmEStG}dO@CinW%RPGSFj!-6_kE#|_Qdk~FOOcgbxx&?&5_X( zbIy6)64XThB=%BV-|&z@*r+AGu;NujD2yNY_()?T6c=THoX;ZudQa4I_SvQXI$vD6 zAkHNGJ5Fcd?}wl4ryewG_H$7&;&`3v3^yN5_o&gWKDzlKc=3_x}%EsTcn&D*f9tuR~MuqpIcFs$WKs>%izSL3^x#T}j3YrWI4;bmpr?li_J& zNAscw8kk9lUL88JP{9TbdZl+GM3Sa3#H=3SJGIT?8aiEr>pj<0dU_^O#(MNTj~<8H zxH7LSF>^OqjY3W+M;EI1`ri418Okae0KNNGLOq_AW-yn_`D08M>tm$HBP7hj?m&z~ zP1m#-@X4zfdakXQbc|88nXro zXzkoI%cuXY7qWpF98*9c^ZKil@xBfxu}yu?5iv{FEEQ*TTQ>_I#KztqJo2DfD2wX|K7X$HP{lb<%x zblI{)WGGph41}z!FQT&i5A;vq;!t3 zYkw5I4EA-)SYt3-nn!e~3}kFjR)!&yR#Q4T@Ea2(uznpwl)6O%JCD$oED z9Eo^M(^|_1a&)ig5fBjz_S3{En#v*a?T{MjQEru1#QIx2I9mT?-ygH@YR4Vq$sVYv z$37)4U6esI(T5n2*)oiNC#Qi`t6jDvb`tNRE3*y9_6YspO4~m{_%v7HK_x&je}<1b3vF81ADomVT*Gas`i_vbeUx%w0h=ImA^$YynT+OnKP)})M7 zya9c(@a+??)Vz&H6@V$KoTOB;FKBjbMOz~y$ zQNy{u^7>J+XIy$R1XL6MpPftusTcayNLu_dMM0;ZtUT|4t;pTd0iojC7zD>T4#9cV z`xIxp>U9#kS?BvPKBWFzC@eR6_qzLw6U{L-uE<9>ymHc`4 z%8!;kXHg@Z8lU?scE1nDt+z@jkBKNNjAx_ZeXOgMA?6zylksN{VdqmbW<4tyWY8-!x>esVoR!k)z!V}LezYR26NL(6hx^J$ud-rzX2K@$l0m(wi z*}cN%5qqHztKue$LF+s0WItm?rSF)punPn$=go7Nr$hKR-*9@-C2C&o)~H)fAb)N0 zp<4UpzZq`Bx$cXVI456rpXQtBmil#zA7Y;&A`z(I)Nw)k@5ZVc6XHX+Hoi%O|J`!S zQrMJ{BqXi?;1zojXX-`pE$@b!{ljHS|K{e2__^->`NE4!*cMezU4Zo2wFgEF&L8hq z-pga^gpPun*Gq0MWNv@KUY&Jb`uL2ra!Z;_S*yO>=}g(a>uf&dSgwC~r5VO~lwBSd z^xPrymR~r&qj}eSo9`gRvdSIf{Iyd~!*Z3qkHIX39)6Bwxv_S|NXha`_@6RI&t!%> zVnPxSAPb1orbtTC9Po~7ggK>F7@(36I+=p-hRM%gRE-~xDDj>*K1vP(0loTt!d|(< z#{CEiv{cu3DCCcfz-KKt+SBpj-#-r2OA}yLT~b+mF-!Xy(vBTna9g};y93&hU=3}K zm3;OVn%pqs{r5FpJrKO6XP6S2Kay2^uy&ieE#fL$?s<~>*cCY4%&{Eg{`Xn_j`03X zJh#nO{E|`mcQg;tAaU^|ROdf)%EA z)|a9m{@b|t^JjYVr+c5K*qH2;fBH7$?W(|eB9@kn;oIA;?uVV7gQP1+Ov2&LPCzEz ze*j|W&X%I>^K89wyaI>t%3cd64tYy#y}Lb$+$)!KsG*4v9UMM0la!p1v}nm2{nVp9 zi#B0bTG6W2Gi;!0P}tH0ufK`#@-%=SaUwg$qXZ2sRiZgtSlag&8r)lHO-&39chkH) zJ?Fq2$WkSrIQ6)6kI|R?{r$~q0E&6kzX1{mY8?)EU?YC~CSX_Mg48uN%`0=|)q;LF zCJAM1%GDW>TxSt7DXghR5eKQs^!pitj4dbrrmf^r@EvyM&#dISe6`T+c|B9 zL}{Ojs%j}1DA0GkRRiR^Uo;DHd8qxs%`1N61O-I-y|fFCxSU1IfHUdhnqA2!$V+OF zYi=m%y>;n>Aj!NmD;n0nm#AzW>r2~9PT0c{S(R-8UNG^d+aDRjcUApF8P8r{sm9@7 zF9CP5(Ct4uV1~su;_q~u6|Onu?nP8G0(1r$olBWnhe_Ij9(Pq)q6WLG5pAp746~Ejd);2NOQs1hT1qb)zX{zp{I@Q%{;%G#tYC5;mbbjaj_PWYOF0t() zX0u~Wd@8DMokBaY z74uEYn?C;kOw`8>filyf^kwLsKbRHy?d==wnQI^StVoady$kwXMUCH8=HR@93lc1^ zZMMd&a$6+bH)8?&YE7l4t3kezSzE$-PyvWV_VBT42CzA(2N(9AixLZM{rc4}@bhcB zwHqN&k?*+LiH?W>E|A)sNd*kwO;}^|^|n;M%)J{-knJ^i`?dyxXX$y^E)4=xfgF0( zGugg7qP40rfw)wHjStrB@qtO?Y>R!J06)L*Wv*nm7ocq(j;U>HtV^9BT&qC2nwl?= z&1W4ieq0lgc1H#meLL;k>y3@pvLBdAFDMtyqPw9ohSNwIZxUBdG z((<`vE+7qOn7G{Kj1G0qKemDu{Sak&J4ZDSo83e!blC1nq#f0WI4LkrJa+^U*`*e! z<5lc-ndNe$N5;^^ZKwWS^DR9+#g`Eh{q?0C6)#I+7t^*<>g5r74o~%02MB^&oQUMir-@@L~9$d>f>D*>pSzZh8?h&&_&FNW{xQe~rR~fuMmEtaU{(|mPYAodmT|&#g z^V4E(>upp0e{Z~Iw~ zU_qhtgvI4a4VT||O-NjQMSTk91&++Wt2z#R@igE_M(8n)FB=GVP};NYrtu#|%;g7Z z$5jaAj|Y=cSzIyti5%F;rg%}qtI_rzX{2%$wEzX5cr)}(R++_3<_S)Bj?FS&=~x{& zz-vQTL`iB|b=<<%{5X7U@|3L?^{Wvu zi7NrJM_@|G3_3>>vyEPhZ(P=IeNqyV`Qq}{r`Yk2sQ9d6u`@73Y7>aUsF` zOHOrwx8VBu5*%_C$UmKs4+aDY+a4r^U;fbn?5X6ttkiNgIRfZk|3x4?sU!oMuLqWE zHPWTH3~C35HkN@qwCN>t+PDUB>At6G!ohgFX*`hL5L z8g_!dd!13b2#m*PZCCuH*(x#K+``u=uHuN$oQEokI%ZZc#5KX1R?J|uTL@{m@?}X* z9kd|6@_;MbbZ9)@r0ij9NaS%tz&=iV9#$$T?1$Ugz{vvFM`7(giphCL>qh7`#Ss~s zYCs0$Sq32FTub?jH0?=HZ&AD_)~m;-PA0|JDx;0bqwVK?Ur~#rC5EcNTp9RVmeqdS zU(a>_v>rv^)y$@a`x0Ie3hI?T#s|(AGG16l8)$kn9kCGn>wJbd+1!`Z-N(`&=?e~8 zk=fIB4xj9n1CEu25__oq_kqk=1jl96d9UW>LBItQ;hDeo(^BgkC5ER%2|Q}mm$9Dj zx5wu*zva^SD|L~c_*KuQEo!FV`xWtTC#=e1;5Qw(SD+TCr;8~+y*e?hQuoKVs@;Em z`H9SzzRDSZE1$nERPSY&^Y+`&{2S(TgOhFzOZ{wm^fe3-vW(33Zv+BDVC5A>W3+PgQe|$>B)N4;<%Byh$*bf*YtGbVA zz%gZW`P;OZyqk%j50Fy&0l1<}Zyb4bSYI1og}}GRn|Ws2#uEGHhd6q&`&3pT%ug?O zfcXtUxbHWlHGYh&*Yjh)rcf+##u3lNsscrG=Ytg0P$kbAzs0k=uTd?54cFS~Lv*6P zgXq$jCWj%*b7HcgtqRB|EH>HtKY!mQPZk@|2P4t;u~_~DyaLxBv%2MqLA>5a8ytGF zeiy5Xh{fg0cz+}NPg8qeL!$mIJOR6aMJ5+QO1DKAQkB9qOsyUCL^qyxBDTOW!y}Yn zqw`QAqugV(9Z^)0HD>3#qP5N8@!2QFlC>X+k+QHk;@S1w`>}L3Nh}vTZJe$FFg<&w z{rCc8ZRYD;&Bbjf@@8u)hO_t}jV2;&arR&A=RyC>g^?RQ+ol}kWVsO%CIZcm6k2?V zy)SMC3Htr$O5pd6xpZ+!^NFu)!UNYWS64``D&ZNit9AQrLr(96pkbBKx}xqY*5!+& zBr_@w;#)VpNAI)u`3Jiql196L>F4@L$7BV4MIG3l_?RWhFLc4O#;%>mpPjU2KX9bK zF)xr#z^wjl z<_ixMt5d3cpJkSTn5TPW5OJ~9mCOUK?um&BM>>^x4Y45LjO(_6{l$yD?ZUf`t?2w; zIoEx3cCaOL$?H|kg*Efd5-Tj-O?tD#X^6>P4^Gn!zOlJN~m^_4CS&o*s!W}G9G?t3f zQ&+j2t;pX8GhJB3&6=3B1!v5de48h+5jGopdxe>!M=cLz%FGq>N?9-$al}C<`0MyA z(Y-7$ZL3IT_ao4hJ0u-{<5Dub`(z0_)7u$H-lSeWBmQLI>|BG?v{vMf=rS8#d_pwq zQ81t|^=u}y+gJDY+9t`X&*3(uJJLWZY!GqsG>$0_%Tj9!lu545X!SJ_SbS^>$W#!cF-eRK`lS&?Tp(=jnBhN31$ubIYcehq!r5p!wF z=xV#1GC<_g-RM%DyK*wuTVF2LN);Tlf|W(g2Fwk>EkU+UPe)b9xWv@UJYzuGG-Jh| zXOJ2HV0t9zrKN9FeS*$7_3M#CICo&r?2$&G_+6QZO!L@~8RX?Fz;AE(dWY({6 zE&h+X}$6HLXui4W!WtT)74c}ho zWv2E5FY;Qtjy92)__`6EnL0(ss_!!uyS}6^`_}&qsI<%R=*??U(7*Ua{N1ryZR;d) z)6YLyaTZJ94`LC0y+odHZ+YG)7NZTWBpI}&4)OmpoQpVkeC5A9=GpZ6_G~@BNYUG6 z#U`Sq$udX0$*$>oA!fHiUR}`MA#S8FXL(`>kdk>RP0%3XZf#IgLg|v&9vwoCI`ENm zLhKJMLz@RJUA?puZo-*WgQ!|MuQJrJax(s-Xb?oXUM`kWq`&oQG=z4K&hfg@1HPL8 zLBkB7^>Yam7=Yw>#Q)!}`u~+UKLQdsz7_!To4qZ(P!@ojO78TihqfktXy_4vpfYob zg7nHx7PqXO^-%LNX}@8Een;=9TDf+pPb7l+^4G~lok*3ns;ZGWevEe<%>=!>H!%a< zp2YV0?^`SRi~|WT4U{cAql_VPEjv5A>Sg5Z`Ssf?mK>iJk-=Evq(D)fLN`?u*R_tQ)iYvG4MfOfBW}?R&92yO~z$*Ais?O6KFM zFEc5ij3Kc_dMAL^oIkCIkT&74^|xVWLd6||?SSvywHAG58A4uVBa%Z5EqrXfSLPs$ zvYPhXzO1}@;+RX)qqb-BFH+<(F|`j8P{}x|(+9BJXv%LE#+D^GLlYMzTc)1N&rJ88 z(>NlMu%eT=w2Z#;>bc~Xab9WYWplJO+g9JChd#La_V=7ceg(=qc1jeL+J>ALji0;v z$>ONj;s+m)zb47tKa85FtttJvQ$s4LD=|--F4;G9TQ$wz=J`^$PAlq z_5s{a^MWaiGY`%en-NnF9t-*6AdA1&%Y|K-FsyEqg#u2`DIv5MF zv^PA;CgNicN8Yh~al}CW4xkirv;q*FSIJph{%3WmfsawBfD*~?&wa(}aW6HFkIuGO zuKIW+tm7^HhMFunN4(T_7?#N35rTI$lotcPQ7BY^f<|BohE91M$D0Kx6CRk%j$5(u zMt&{-J!R3<5AR=BAtxKz?~DfD%T-4rHGtGLhw#l>5m&d-V(jg%zFvv}H>Ew&Z*pZPljR zacIT*^(JSD@7M6DlCU&$tHZIx=%G)p_232D#;e5UpXMEB1uj2{VCCPFe z-TxzjLk-Hn2YK|L%>|c{Z(EyHJ)loKI43tJsoRzax|79IS2v0=(fS{w1(LO%B##L` z#;KvpNG9)tylVV^(*n6Q4!S|Rcj?~Hv&?5us(JIB$e1FGVDUjeZ$6q+c z+)&7An?-4u+=Nz@TMu&mqp)6?lDbDWD~5RnKs+)OLG<9)>VGhj|G_6OwC>SZE|S~7 zV)t*0RnHGzU%294r6i*WlVU?!-++ZVP;{ucmAooM3bf}FV&3C*{D`#|DX)ErPMB_T zMyJ}j{mg*sv*bN|;rUo3=*nw9{2_Us3$dao#RtEBjsbH%FG!t0Dx@%zmX zt_4U#+yvXz8?iW1r7bZ2^=fciE;mdGrKTj-(9(ZNy+>APc8fNSjPbrs;9qa`4C%-2VsQu`@An>zJj}t7{H-JZDBkp zr70{eY#zMj=|vu*K-p?jXgPWos^|<7j;l^82R1fMuy@H{dp3UJ83pmXoFn7UJ%Xbj z>&m?(@Fm(AntD`$0$k^wnDMEwdgI2hRj$PDuBMSvAbwWdGL->%0J|M2GWN_GxXHXC zw=+mJ2>7chu&9=>avb3iFpoRyS%v+ zzH?4GX*!qh+09z+@xDucVOjZB`>mdib?OHoB}G?W{?bz1j%$eZY<6+cackIvYMqVa z16-!fg`TEu>cG_V?jxyXpeyz*o+iiWjA*Djd`Y|b zdl?9h7U(Lw9!X^lWTE+IibJPBRWMVmYN=sT&xnC&KmP8(R~fwo!`bWs8kRlY@F@UP z7nUsb!04QF72}R8EUtD*9;TlJHI}?f-1O(cCf%X_?c;XXj*`VX_)!8walpMCYRAqm^=WSSG^^_s!Ito457w z#awa(1O#3bsh&-UqH8U)a<#B@&M*bvj42j76k=Y3IQ34~@pN0j(nrpgq3nz9bq%N2 zG;^w~qFgm$4_5BwdPaJ-;1)oHSP%-lh~wd6d>QZt}hQ ztx`4rRGy4)?V4{$2iG~w+8wmq1###%_u47K5SL?u^_86PDStcXmXr9srK)L_8cwf; zfTlPyLjSESFURq`D8?HPZ85hE>uzpg2?@(7iPbfc8)Q&3zQjeZaloIqP3KF{-NbT0 zJo7tVv-PxW{qgllTLqJ1{OnJBNej?ViQ-x6ochV6-Fdm!!=8@o4*!H5?q%@)S(PC; z7z>IRm1T3to5Dd+?b)8Fb^FtVxP{Vrr-OE`_SqsoKQ6n&1OzqCPS%2@|6&Ix?#y}%8cgND0Ke3CsPDvvx-vwOrC*)?)wupLOr|-U)^{Gyu*X~!n0f#^S_qy3W z$9`b47G}b;PpW6lfw!Ogmg-$|rGIF8dConvRV`G@HbeiF zvnM+JUZiHE-X?WD;paMwW+XLj1)q`8lCimY?xyj9<+F^<*($-3iTt5Gen)sdUusrt`in& znH;r^UjJd1JQEPU>u7kHx{jI$NX8x_v}kqXXvOpTE z9sHFxk|F3+D_$umr8~OlK5XoFWI5kr54%}9@E@_V*{%M-n&VoxvS5>n|2hNlDq?9O z&3o%Z_X?0ap7UO8NU~}v{U*CR4OGSZ3`X=7-h4dfbHphVy8IV8SVoJoU$x|oG(w(X zmtTm#Z#?*Fxj(65S=uBQJ;FkJ_etQ-v-Gmo^Nidua6zb#caVylFEeV&qBoWBdt+hc zY+tN2^*4aVu0Zw`T``GXxEvt$UE;$>&-H>K&%+gI+fT)geM!Fr{pa}8E$e0@=*lVu zTZA;Sp7S;hKGn!vp}G$39S=XFlJA|;vsC@?q3=2%y?P=4(cF)Kn}@cyUeC%GNI7*) z`K$#84BPsZpEH@3>@ntm)4;vWE#tm&(RjUTm#5o!>G`Qw)Oa@RJ^43)g!f@W#ueAc zaG&l|TVrcjb)WU)_HuQr^$#Q@ln0DdqE4AvUgIAboMO#0j}_vnpUALO*(HKZlaOdf z2K$h^`w5Py&v6O_GsB_ns_dhnf1<|BRk$zmy|}l-8#*IO_n=T>^U|_bZOU^y!e8#5 z7l-dyzCtIhvVIsfdw)>}(u7}KI!fRV)}8moB7YZof?YuTdLO0KI0IDiiJV^ByAa3w zk^JWqp#oC`)XPsxx$=(kN*KwfL$Qc=vzrbo$0{9WYV1?Na1Og^Zn~7&>ptSb=9XQ@ zY9mrIwq^g3f{`?_>QwRWmLxN00oM*Qn(2jtkX&TXA7M!RRLziLcCtOZjh7Ex3$xi$puzn+=_%GWMz&aEY5Y@IwC*acG1~r`ARZ;;NA7 zq2KqGhfAOfxGNA7>A?Q?LC0fK43nFk5GR^r_?F3!bs`t(Q+(=gqc0pP9p~!|a)!e| z_wYHtp*Ee)gp@{pF35wDX~HZFfn0?-#}|?yy1fsNh!VHGYxVDJ=p9Miq~OatJ2-SV zMIy5HKcbecOf@>Um7}>kIb}OxlX1R(H<2w~$_WDUrohKxvVJDa$bUAS++vt6&gl3e z#f9EqF4m1xHll_775J7}rq`4%L25IbE|sm{lIg4MLZg2MvI0yFe$(Y&Ueg=vm#w5M z2t6R_^S>FY%j^<69ep&vPza+U;yYZbj&&N zzkKoMpGb3>jx7-!JmGoQU4Ai`&Y5moUVY%VHII0EhDKqYNr4Let?aP=TS4d~Jk3eV zWI{gr?|FWz327pi`#YKWRi;|y&aeaE&TEe&{q{~}?&_-1SJG2Sj*{ql&lzCLMc-4z zuM5f%zj1FmU_0-m+}i@~@PS&7c~82n+Zzl+XxxWRD?;DR#jm$If|MTqBwJ1lLNxUwsO-K|Z?%*ag}GBLmFBNh$% zdjuufh`$N*xx}SK+|qed`1uE&0C@06um_)o0mpnSx1hGy&5;+-x9sLI3XUlRZt+{S zyVy?oW{^bCFD?jk5e18 zSjDvVm^VtEewjE>?IAgKzs_v^jaYHwPq@F3nz@vVQBDu!gR?;j3wTo%tnnr^t zW8l%c=!AfW(O{0sy2Xf6D);VaN0a%@?Ed?; zyP#n?$jMUO_-FTMh=saP%#qybynGvisN8ROxt2wyc*y^?_rL&jSpQQ2bd=@Y7<|zH zr6h)ym^{qQ@?B;rgR5jpG0~gUZEk9TP@a$i$s3XKN*hX^xH94~{c4w>j2XIVg@9L~ znCha;7)fKJqoyE-tgr2msDFh!n*Bc45Ek;Tw^# zri+;|Q-}}085aFGtFv#!>4vB!1RkI&ErM2i(`fuX%gDt->LxH&eU9sPJC&k&(#zE~ zanXHb5wTbp(1TE(zb;W*Ick%<8hhSCSLN&v$2z-7@T**YyzM_SRG;pya?w;Jr7Og?o|>#|9?Xj42Ph=S5{U1tbsn(**BmBycc;^UxqUTR zPLElT^$qXB3=}=^M|&(hkAtcYF9?9y4w1H-M#;dr;4Q;F%(4_LoQuBNZ=7P z+NkpVHc`eC4#^8f3q7V)+^q-p3A6G~brO7`$5AXPz#s<$XxM03hbNWRPWy=-J5}=b zr(^+g?p6tEpiMj8Sw5XfuyVbEu`CqIJ9xq(iEId^&hngI^lD^7gT{-Cd+b<{ z1p@vatVa~I6U|Q>x#_()kHr6X*(tTsPq<=?$Zq-=)lT;VCSkni)O`5q5i4VAWHGxj zza;VBtNy0?BKwCvbOnFZ=XN!x%TopYazCj4jC)AHxcqeJwDZ!vR1Sh6vvw!<>Dy22 zy^~J@_KqKVu|K(0C(F&!iUt6g;?M3bwgS%Vkz99Y&f*t~LOB=VLtxMk+Qd6gnH1k% zy`WwpIb5tM5!J7HR`r}w8}wd zeI8?p7MWARBq`{XdmV)NLh6}|({ELj(Vy$nY5wFkFq?s3yzaRFL%X>B@1cm~~ZSmZ#2lrQNh;3$-ggls^QJYyB?A!X=)Z@ZF&d$q{t+G-KHkHa51<9;F<~BNX}= zn=!%y(~bv%Wy+~JK7gm06LSd`_l+_n-~p9q;16k+3g0u8It!arA4yJ3CdEnJ4~!?0 z^=koGe8$x#puuYL%iys^4k7?#J)qi@W>fnWJ+1run3!Rs+2)QfODfDs+QWF_n4k`R z+S6!I{5o7i2syTWR6%wPt!S-uaH#kkanm9rswz$|R~aQPaE437SuN@WCVKsT!CyZD zEkY=NDZz3h{(Em3iO#rgAyDbLSm^YtLgN6VW*TcJLKU6#VTpeo1byG?bCA_A%sf0H z*fi3pURFtJYC-I0DQgn}3kX44o4+^!Ls@w5co$9aVnuiZ z8s$(}7{#Bi@2j@@RrtAWHBAu#CtgDNq$t4)?x<46a;kiJdJYY0o0DPaVdI>h4e8=f zmu(maEN=0lp1k9XrQ@bl#5`29mEeJP$5JiZL+}WUB8h{#FuNaipQw;fXfTzG9y{x z+xK&><7K$FPwib$$*SUz_cq-EA;BSL0}&QEIT{%Xu)Q!Me#bDGreV%{xDri5`|_Yr z68b{6W5m6JK7j(@yQ>eBitZpyQUeD4+XoAQY}-)XC*0lOl&5gF%_YNS>?Hi+YgS#> zyw^-I@3i9QBV^mTzX2OidZK+9KxW4Q>Rqhdw+1WlC9aj8?v~Fh@}ej*T}$5L-*pe& zm?Vl^KzThB=^+|nNlsGUKG*a|=$MQ>pI(qQJg_NUcrF8v{-YS>w@sKJP2wEW=i5);+-+-hY1~!0R!FoMPhdOXo8aU^|MKerbO`^; zNb<5@=ST)j;#T+M*&)IPyEzi$Xb$dNFVOc0OTai~lLn4Y^3xer|5J z{C1~YJdKPQm#8E6CwF0l@MER*t&wKZ2K!WPDq^SV4g$;I@>2b?D0=~hRZP^#>LIo# z)q@1qetpY&4dX*=a5y|~(XcqqS%MZ5m@z+w({QP`vLuS5_GG=v(2VY)=MH=zV;XQ2 zV=`AJ-jqMab!=*PIQa1+X=2aYvdQf4pM9YD4GYtaCK5;G7v`%|y^>8Dx6_z(qfTb1 zZSGrTIIO?1A`56FukiCk{v3H1%Hu>ugLU2)6HLm(!if4@4)jzv+njVhi6tgW05>pQ zl7)}iw;*_Kb^aPL&$c*jTDJ+s1cU@iv0?-Vd0O(uYD2;)so$ zcw4b4LNMq=y8(52?c}fc++m{~zS#o*mob4QF8d{2+{16eUx$#Ngl$hZ9c$G<56inh zTsbwsIdIp;D{iu@fAwm7O?H<7n1t|@lnmPh5X$V%%$gZgBXm&?FWO->`&)8(Q5KqO zG}A#lJ3F!H@@+NfCxLQ017`1%)LM8%fmfV(kPs@SRYJ&zXE%nBiLiwF2Lz^b<};XN zPh+VLU@g$qUpf|Lngk8Ff>jNA61x+pgJ&U>I!!$SU`k;|6WyU9ROyxx!%gp^Pcs`) z$og5?IzVhhqC?t6;s;YZeFf1}i4og*3~p*42g~IKMQiq1WMeKQ^!#*G+`HFOgn%3%{>*eM;_W#)2AWy}gLGQh zGW5Vr{x#hJ{AX1|M{#+o(kYG8PJk9HV7|($Tr&AOF@g?JAv5l|n{wB{UzcF)hv0z^ z59a6j`{Aty3lh_Yx_sqH9f3?vuiPE?dr#puFvLfjr zp8|o5FtksmYWcQa{VB?2MOoi&Gr$=vlM+1LnE6zWv!nf2Z_ct9=YfRoqDLtT@83td zkH1gW1kQ+FQftZiLfDWNA5Grs{XwD<1K_~rCP5gDJqGIIuceB;JZ~+iQ2GbTZ>Of| zUhmJ>6cUgVWIDBEbB~U4cVo6skKWC6_>7N-NRo+9VFS*72UJv4SzRGm!AxIIh+pEn z!3eBiN_^VXT{M3Qg8=yf+|3wLj%t=1KbZ~xaPvlWZBzn>Df@z{$kxq~j4kPv!&GZJ zQ@4>NCM|JS3|?qy&-$a4X~?#M%_}y;8Q8$Vu-u{K`}!etZOnwHF)mfNyXFvSOb!Bx z*f(vv4K1C~?l$`ivz!j^;#V49@-Pt)t%^#jI5E11Vgx@$1^IgV8P1r8-HHT#L|I-J zaN<#?HdNBe!ktj2X_oB2+^*x0HY?r#aXtBetK&PxKq%)vu`BTB7HW0!-b-&NfEkhh z0#r?L9z2Hw|I76u-?m_hzXBR|Y*ux+>?oq^c%_fOlscLylG&J*syufv%rX zE>L%zj761__`pVf5vLWnCU6VI9_gJ1d<(yZ5I=UR@LS=b&_qpZyVAUyl}LGd3tjeC z>6qAeH55@WiH&F|==m~+5t`mg!6bvTM1c=e_zBSB@_8pJQpvx-Qs0DMxFDO~!l7}C>nxJ8Z4mzzuZkB zT_o=rxqGMJY6iE0OS^u;VQzsKls-MJDNuP`s!DAErMvT!=~O&8EzJ24Q#_5%{b?kf zP$&YaZw>#Nx|js7Mn7a#KWC4c-bM*xAMNj z7n_eek2*^5TTYSJ)JY^t!ZG1D*QG!=#79#!75{4%^!WR4Ovk-#)A*A_w3iM$5TP*@*)bR2dx0 zX36*reFR@JRrE|mvU_zA-C;^nS6clN3bYmwGe<$)a6h%9qjXKyCS%IiFSK~zMb*N{nf<&C*=(T%EnG}j(j_IcIkfV^2a9?AFjv)V-`firo3{(=akrVR522%aVQ7C}Z zzMdNk#RzeuHxAmK@UAD=AeAfnx2Vc`cSL>(8%d|^Lh-hI;OixAP>(rjC0&h+5#BZL z!(Y@BVy|l!L=b0ZdgaDq3ZFlJZZ{F)eP}y87&9`+I&`U!t)t)OjsFj{s=kKs@1(es zeUB}im8%NCIS#OQ2EvQe{RLmC$+3#UYKa^APto*-#WJ`*+&QGHDc?RN5=?XV$QjOp z*Mc2n`Q&4TjX3TqhG*{5{XO@mJu%Ua?~42k?ZU1>71O6i__U7|ym zW;alzoqH%dBd;ab?&rF?Y0$aL+bUh-aP6yfI>}9@g#X+ea7HfWU+pGt_qDOHKlLj>@#xz$qLTsr1p|2f^XH0iB@iZNAmnP87_3d&LyN zkJb&cQX=qI(1fuhqV#K3>oifGp#!ph1xGx(sjaa2N_9(N4~;*41abxt*4 z9{WABn<3_tbe?5^)$wz4$Y8g+o5#HSJ=MhM3bRDh!qGa*Zq4*E!4l2AT3^uo>J-Hd zPod3c^$A!blaRI=w5;sakE?*;ZtQ^%aL|Ge z>}Gvn+dJx^s|mll%V{~s8$O;J7Z>WMXMiLrF)9W2ii9X@2(P}6-80YeMtW*4@9%6E zi7xU9yybiCVZUGc=~Mcr(bs&7C*ULQ@guICgxuZa+#*|}e(lat zV$#OSez%4VUs!DPz-BFCRS2l6tW0^j*vpIdfKeS|OXboJGwb(Jh5$DnwJ>>njxeDD z4i%|FEIDnGg~wA)I`&~vul*$6RR?l0@0T-8&VX*Eg)KR^sg(EnRyox+8<8sj+}+^E zUbGzdt0q;%{Gq$?+S7N`t@6y;dHpyWib&_S?6=Sbr&kVNUYt%m`SRms=&MS@kH@I_ zQksOS7IL0g??%j+A2*nvNef28kIZ|1f?hnaHs{+DNUOz}_23%`1_qwr(FHk-&-Z!Q_1C@;5Sr-C1NqIu-YYMAi9SA4VH|kjBkeLUz}ERKF}L#@AyeEl zz9M=>cwkB5wW-=7qgZZzSJb33F|pe-x~KGIr3Z?RJvSMb&uQJhw14sUJ>Ma@pKh>J znVasH!8-kuTKwBYQ03KYXXcyq!Y$R=F-f&-e%6v(JN0J`hGx-Ut<;lto&&VhD2nZb zE|CA+1ks@ffoY1NXc4e*yCZ_Bwj-2-nOk1DIC6g+kC^Vs{!{eNtIWmKG9 zvUP9^ZXtLB!5Rq(?oJ?B5-hlf;1INd2X}XOg1fuB26uONm#^Qs^L}?`?)>V-T0nQ7 z^HiN(`|MqHykFHSz}qMpPYugqai~gVp}Gx}FKW{m^(QR_4D%3n8! z38q(VZ-L_LdD(Nb0QKjrV5l?62kKDrg9;B4i=Y#~uSpB}&UM*)*;13D3fZKCtpL$b zC|@8dCs(r-v}nhJ6@I(7w?`=(k4J!kUJrV3H7I6bVnRm;U837u2(o;UaR&D9*#6~i96F|@U zJ;4~zZ1P^C6SN5C60M24L5^2ep*<;nbtfk{MQIHa0M6S) z(Ck<@*$mjZUzNZ}I0C~4(7Y*hwvl%E+I6n;!aZ%UxJ8*1ei#MPCwIO41hu^=fHBqd z)0}^{d<4FAcC6E+`9K{#ef$DyCEH#@4MUb1qvc~-4KCbGcNa5afoQT4MZ>ChXNdk% zy0QM$CD*j_sgVo!5#f2bB-}%?dbLE627i1hM1?4;2?JUDHQssSO0P6aI$)1_=_sjm=yG#*W*xnqVt8h``*;_VhL)_uSsOL&|}zW?DGm1M_c z{?{CrI?&Ct?C&!7BF_(GXrp{j-)5U3VKp?-zEEM$M-40!?Q*@GcixNz>eXt`03(Y( z*yNc9YsR8+D;-Zqc#bJ}&y~z)&5+E< zLmTF0^A%A_fgX+wCG5uvPnZ4P_^4RAim(3o=`hqf92g1yiWeQH6fYt^=gO2W)K(B$ zAmv_!Oeki`vKKgxY}$nE~%BVh$hrC|aLhvJ~1c zPdOv#T*iYWl`}6xWGyBoCeQ-aT8c-%(gVP6m%7Xr@4xCS%R2 zcGvVc9<=?wodZUI4wH^J2g8^sJJ+EcGP&SIwTjFI8|wb|i&ZOS8(VeUbbZ)RJV77} zpjA`Z!D@pO85z}as_UbB?rr_O(s=%M*di{>kdpJzOFty`>?|?aj~l6G11t^rWU7+#_OlAJv8Xf(OB5CvOvi2 z_B|kmG%I`^wtwhhYD3k#M7Exm-oXB`|4QpBbi7JwWEk?ZGwDhh|NMT-XRX4;Hni=; z?L|4B+qS_;jzkH97m!Tb*X@?q^fqwn-IUVQwyV3%W>XXP7jMO8jc54-t5&Zsu+cG^ z=;AhO#zC(PQaWL|4UV70$-NUMasfZxPTzu~NHdVkw1Mx#b7)HAq-9M~rn}dj(T{cF z-<7XHzbpriwEsSy|9Mz@JiLZ+#L>{7^v{?d;8}icq_U|w@Wf|+l)_;m@`esm1LNR& zj009~d7)=(VM(dC6QAq`6T?eio)f9m8kNgnxo80tQ4i9(0McCef+L8bSJp2`M{CTn zjSl75TzwqvAHUAO@Eebq)f>vQ<18*N8bAiQPcdXzn3rNItZZjB1+itM&fcYvw7Txd zEto!S;>!0iEE*h76f<^F=xU=_?5o<$iORWet{;aUT(^56b&^G#NzlLU2{C6w`;eW= z^_uT|)eCZM1w_bRtJx}OMii|j^U0H``fR{mdHSEvv&mKNa2sY>>BtB-jZg`Yt|T4z!=i2`>>1<=Kb;xJCZ_%N^75k5n{Y26NE za~M-vR5X4OfAv^zoHqUZl3XUN4!8WW>g66M9@)pcj0JDC_NoJMs$C#5WQBoxS`8fg zvh!Dv6@?Dc{%tz{{{gp(yx5A|Ms-S(!e`yoWX-6Ups#qLX(au4?V2)oPt}T~3=ccr~KgD57#yYm~;0)D<(pkj$_?&|-;EyI~;i zre7ZdoBVowG}Ra*ek1#Aa`I#4wjMgPVUkFC(Ny6~yj_Zm^Yv%6N~6(9w}@|*hqh&; zu_jtH_UpGOm8dsI3pc-m*a6y^EO6epd1q1r!Yu#yyiP5BTgh{kcCS*e%NJm*hj|pA zlNZ%P2k)0u{5}O&d-yhC>0+dAe1vH9l>T^u4ztG{uE0>VWU-nTpe8VVsu+!1pmgvH zCE*y-`%)EGar8h(8MqZW>dk684JLi%u!!L+DsbIexsqbMR2_!6z5*z>eSqn1GbAnQ zeRdh4P9Iii`lhVxcgeiBJrzzFbjNU{=qJ>AdLBfn-bE~qe5IKiwc>CxPh}Z!tXrV5 z%pHyel6NC%>Sa74bK1o2R<}fjolk&6qm_%-k&a;5+#iia#-p$+z@2v1>g9y$c3EY~ z@UfgXbB}IAJ^P@!5%{;{cuGOxj$M`pKKj~CIACBl_-EcFu;@5BW2(gCNH}j6lOikX z1_PdGo%8GQYI5F4hDq`zhRH^?CJWe6PRvecmU-|rHz;nI?|sTmrtPXm2D0WR2&cYb z0|$^Q6;`jvt~AMzIQV$EW)rnNX>)CBn+FHPYJzXW`L88y(@B*#GDOjiuB_@hZFd)T z23yNSX9<`e6VyD3-fVX6UD3hKW{s@Dowd^~iK9@K@U9Q{Vyr1atUa1uJe zGSI^oCgLTZsCCuzeEyyO4aM{!V=fqLqwI?r{%93g$v3&J55rb4lL z@4@>Kl0>-`&U&q{O@M8L$x$lN*&vhK9YQ?-H*TkCaTCGI8~bBibcAAoWE`=481HVo z%R!2b7TWhj1fuuFQ=>`0R6|rwi`-Y~ttS$8sK#>nG;qGB2WfraBi-#0w(Rmy{Yv1` zV0B8GO*CgUgCq%_?IT7=CDQ%o(h`Mv#x;a~V~b2phWLwvl>*pY?wI#D+SHga`DmsTzBj6)8d9o*^34EWWy?y9)X0Mj5 zJ0m-^HNmF}_?=zX9TFi)VAbt1ctw#6OEa1jYclUdSgRhX`~YP5DhFE-^rWWN5Av={ z>N*dRB7>$kj@GP4`XJnaTxbVp0w;(P9K3pkG(6y%#z2H6oB3^+BYy9<((jb3%$!J^_psZAV>U z$NjxKiIFoz_s8Cu`r`AGUzl^Z;STD)#|zjEU*&3}DI5avV+hH2{z&f3H*U4R84ZqS z%R3SvN*ihA{TIOd5BS^m6wuau>iOS4>fuUXmntq8XXmQsOqyl zq;@v&ytVfRZwhO>fgwJR3{O4EuYqwlf;JM6G zYd`Xvwf8^pSKa#Ye0qv=e$sq=-h)UTE0X>@#q&QuwNSy5NNciKT<0(6U9lq2p4^Pj zJJ;T2LIO^#p??rZkpqi|jv>@`)8z2VKh@`-p9{~_6|}nf^dL5KVgLU*qksGNJg;CJ zk}Q$B7>=@}#vr{YE0+c3s^FKE{|M%P#Pq74nETU-_jY=r7R=LE3@BVRS$dkj7Ch>) z%-wfeh@;GbE(Fw#(>FFR|9IpSakE2?oZp%f4*kXUqc(XB(+Roir<%V@n|~>EFiBtu zY0d=9qkB|xso^G(b0G~ zEeHX%oNsEHddI}tm8g#$E)%^iu_`;sdm%(FDn#FB-V3xsm}mtAPF#MK`e9f)kBH&v28gY#U=G;*Zbq&z@7RbUrtc4CI+f@VOQa~rW+(9)9FE>rT-Lj6{mjcRM1O+Z zV9cqh3D(&W-N|XwVGzp5hyqT8n^%W-DF%7CzO;dX9ap}-3S%sz`%<{T)bxzs*PT&6 z9!;d{y}}0jM*TrbLMIXdCx(w7*?l`a;6#m_?@1?aMgJo&{6(!EtNgW$3WFa9zq{-Y z%~>6G^^eJB-=Ec2cE(3^Zn32qOrIYwH6}Fj9ba}04)nVMRgodaQC zF#?qI@847J+iDu5zOuH&N$5>=feT_kzGY%w&o(DjAgHoS`{+EzI)nK5csk0F1#urLgjpSTBjogDvp3jgcNYU5wYpb<11Np^D>6elfW zsATu%eGw~OUj>G>U(?y%H2cJLlQuIwdXCDVh`G6DpVWz-SR+3+MG`xxqIV<}JqDC1 zdT}9|wwN4Vz<&uD|1JFNBw&5fQwY+N=sT6iw(4 zd*H2j9a}VGs3Ztk^DMeWuUR2A6b;0K(GeFyQ7AReUh@*k63(tSmc3z3mnWy%*!f1= z^onAF1S@`pWfa-I(hbNud_{g*M}6bg$3EcBY?301_0ABqwzxwfyf5Y2=B%^Q(vkJK z0v~Pk_ZT<3k}-Z)H2J0yV;J1Nzuvo275Rk@p+|#iyR>8tQ_Dj4|Ebph4d#TlIf(tW z#PFv^Hfr9yL9azf3JvnR*%s8M59rF|0a7$(15S4K?xFz)o4lUH;6g5CJt-PxD~$S} z+I10w^4pukKU9}fS{D~_ENVoCF-k^v7C37pZ0W7oCcZ)(djU>f4bRJ7&#w8J6#&;Cw$xSw0svz=h+8$_e2IM+|Hn5IR=GD5b@1pGO& z-xfN0YApNVZzh3ht!`9!G}dGW2SqWDlulAo%pYbBa=Pf^iu&NxSaw(BWAA=mQ0#&- zgW23)QTBd?`K-WpInuAJ$%3{qui#Qot)bY`$1Am`X#Xu=VC?yzqJefGhP?EZ6#D=Q z_*}L;TWiMxsyDMm5U?BZ@fWm=o0 zdh;^g95S&s{;rx^Qo)-xycXguD8j66iPZ{1Xu{C=cO zw_A0Iqr7VOf!Aj*jj4Wn9wNgJ)3HDSJCc98DY~p$Rk?MZx>TIB6>vpDBU&%z^i%rh zF2KYnXmO5pF4jMo`b$$p9@}QKy7>@v)J3DsC~4gfH}lfMZ@U$ms_T@F+^$I$=fdh= zKUT=|g)H5`{Rb7H(|WUe4rvhA)$h-&TgmQ-Q>9_!Hxn5^xC0(`pFbh2IIoh`dZXPvWbXtl#Qt( zW!&6n;+g6oC&OM5%Ig-`$5)|4+-rl5(v9{C2lY>@hfD)9z(kJx(IANn>qZ0H*$^c77L0_l z#t~CX(Z(KVy6}VmH(Pfoa?KQdtbAlnm6B6G=UkVkOkhG zx;4?ssBeP)0H0$xq7TfKT$E?Jup{zR_;1I6NZdHr)76PFRZFgn+4RtG+W`p^8&SjS z2vCNlg*8q9|q$>NQJHLrykGvSl|IqQS znatvuly)X_~=0ywP zR#L?u;f;#@bT(i|)+|Wg`Jn+S*e;u1Ly0lkVsqE|qQCL2!g^`Q02Mo}y&i!(nJ)%b zs!QlcoV~KCGyB%$qp%p$jdV9RJZf!DzRBU2$b?e-%Jz6~91(TIjkS3O;7`FSDS%+IsrqXIYcrdJ-#XEE$NZ{(S8NLnOGBNg3$Fp5U4yTc41Vw`5l zvB%hz&z$uK!TP{f0Pg&$2nm{OLs77qqn~ay)Gf_fg&qa}3)q2{6>`h1RPJZ}lu4R~ z38`$>8oRWaZdwmRg<{c^GjnqlKOK%i4)+_nH!X0wN4`uI@U%XX&5KRn<=GsNTd-JrA3&zw~$@v)mqJrtHW2ST}S!9y?-o*TEa>nEkyS znqTav7LT1uol~!UsHkF(gXVeK+%B2t*~Ua6x7MYSFdndL(uO|kcCl#A?;WDj?!{r^ z0F7-$)Nsi}|Lb%&CuK6R)P~4ZxKoN_{_NmghWc>7sDrtvP)}F{k@`4!4Vbrp20aT} z%$IkU(Png1d5o6$Ix;Zvw!ScRB8&M+|4CE*1r>ST!Z_&;Uf%K}fD3XeqSs53DKp`@ z?$3GnIB)ytgLSrGMYv2Ni~**aXD>uLImopzuLKJPYLYH zsyle6K!6)RPmiZg+>34RCV^&)?+IBInT#e}co;#fSGweNM}yN-ZfNR@Rl~5%u=1qs z#5fqbJuyi;hci8FLzd?qHt2WT0+3PtGyRggx>(8F`6wjvXtc#FvvW!c;;r*!NZq7+M|q+WC$K@#nEAaJK3 zU`UB(mnA0)+Nr5+7Dv?7bE@s4S{jBFP+bL(wh=P6Y9Y;+Z@C|#Os2VPycfne?QW14 z^8HcTvUK|LAJrL*WV$GJUW}i)3bJzH7+r}q3kncQ!p!&A@3lgg!TGeVIS$ zC=Ul%zZ>(TIOv&P$TP)Mv)ma0h4l?AL-*4m>+2I`M~m$LcA(omx!4_THzRu;?xTQv5pFGg-J=-8~6?#@5cY(TK>XSd?e7!+8Spc>e6^ZBg<=TNqc%EcE0fUvGwoJ z%N^@>J1&IxGbi@0(6QSG`Iq(op+FR%#0D;u0(p7oy`D-qGwJtX%9+KvppyV82(bIV ztqOXq<)yZ9?i<Ow(hM@lV0SiGjeE{yOZ=T`50qkvv|yL z8Yubn^puSdzrE!ul303C6G+4I2l5hIqwgdX`<88z=hD?Sy>Qh*^8fpy zw`o$X#zKwD`wQYte{8HeYO7}@_voJ%pc9z;Ew@%a-PMwR2)uFa8*|Hl?!vC~5dtQW zESK)wdc<6wpO>(2nUSlejQdA-{+xIg=kMRY$H0d;AIWfV zaYK2Adn}39W8MqNJzaGxg5P&i+Wk>!z_~?At*pD)RmNyzILC+|?CuwRV4X0J;vK6gP&W&ZYLt zeu!7~AhMG*67bH>-V9GnEHKSHHN!xk=M`frjp54EfYOg#NS5-F6Gk6_A?jSUB%uYy+kAG`+VM~9reYZH>z5S zjgn{dxr%I_C_6f08#Hg@u$d>R1_Tw))t7wG?!=yeu7S`4hwPAh8k0}BF{2*_N@n~7 zj9nRNrcV-+h`d(wpXtibD`Po=LgcHBJMB6JauDR#6%ip_ZA`yke=2hpH}A6DT;tpl zzlrcN-jr33qBW1tJ0qVW4}OcsA}!POKuB9Y*jzK5Tza<$r;QqZO9b`7?iwlDMIgDpaAv zgi{H*MAozm7tzb@YGjD;(S!13s?XhV--{ej`61iBLqkKQOt(-IR7Z|XocW)Wq$GW` z!A1t52vzTs1waUGC`I=^*o0CAFf8K=fn_Tb5`@&yxm?ffeE&t@4b>A!EC+OUxQ#Bm zu3-YVSrG*zAPY1CK4LA+Tj|}E)-CNVXBe&Z z?y9t7mC{S(%m;1F3sV49Mo|4-@Y@ckbdF%z@xtz_h61LQF81^F!igThgIU^iUdbwS z#ZMtVeDZRtJX>WVBPD-=L$LqMSlVP(*Ha4-7dLc#NO9=gn=tMOVgVyV8|u7YRFCo_ z$N6wziI1V>_2C-5^?533EkAb~C_cd^7e{z{2(xU(l}qN*JzH^n zsy?0Fxac@uf^8nWfn*-@Fr(tUV%JXWgH z{od)lX{of+B&XRz4b|h|i5vO#@e;93g)Q{+2#}`&&-LL+QMdxn2G+N`8}cG2%grM8 z_Vz+fuud$5^!KM(VVyo`-D`8ksi?SO`+L1dYXOHbF;h^b39y0*?c9yQ(t4SB^|G;# z3w>YtwL*4N(M04u+fe~rE!V4<@R?HWI%bgwjL@nEd0g&kzCo6s!T(D()!Ny*P)l91DE z9?v50@Gsd@)7>^P2cpB_BL4GT+6&F$d^7Fl)|FDC&l>ca&AX_m=yaqps6(;?ora1U z(&dl67Q(58xzQUEksPDDbdRpQKR|BY%W8<7j|9uB-zNl!;fOMGGY7jg6T;Ov^bVH??hARLcb&aQ(RK;2gJShd+V(! zQENHtbdYxvyR!EioM7?TCJNZ^Qwui@4bJL6W~Qdzs+}y>%W&CVo85|KBX+la0I5Nr z&G+M9G{2gAQ*m>5rwU7ihXHK#NI`6^<$dh^HZzNQ<|PFs*mDiK-qfJ;VGw@b`0V5l zWxDZ7Ar|^(9A%)oXa7d~<>7@vquE(0(4ACws$gm@Cr*ns$jDBqIwmSLm5hyTy!AJU z5MrM#)C#hg;T7>adow-<2aT$0Ju#K`moyfo9OoAjHQIJWn-F3%yaGA9l@TScd=?*`Lw`rlEkOx|>T2|nb18T$0bL5xc&y#s1cMCJ%vAiMuIZJ!D(ZzT8E)|9Qi_non6IvgByC|l zUpR}}(HkUPP2^Ai8uLMdSWT%o>rQ38XFF9@JN~;6+_!0{R%`q@jerdDOKY~qRZ_Ly zS$20KS3dr|{=K<@*R}R@ci`z+ZcwL?8n!lJzc;*aQ4~%TFiAKtl*ns3O{F`QE}Q{T zzF`#;g9>H%iqslM?nkwsrnJ99%xBBqgVmp%;-PYR)+e^jO#{D|GvM|_*2H@UMa(u- z3Oes;N6fu47+F4vXQ~fm=R?P=n3Q8Dhi1Dy#8zlklxF%GS^i#FLPAA1!sw0XRUp2$ z_o$e+C9*BhGk`#Erhq}Q()v`nGJh40_l8l$)zI5K%m2(6bW(N0viw-Ds~(rb~aUjF01Vn$@rlMr9%*=t8BF`-5B1#4cE4?UHeuIjk}>wM>Ty zmAl6v)bkCcy<|_hKKY{iVw>|BUD9U; zmW*Nb8XqS08dde76yBNB(18l;9B#|3`|V6jK~$)UwxV2eDFJN*&YCFblJTC(25QC( z7G0kheY4^S{`RwkvBmKZAE*C}nm%SJ0=&q#T86lEQy6?&-Mm(sA>ttxY>Y1b79F#7 zbn%sd;rEH)E6h^zLD7|nR%Jl_M_ftVqAAQ9+HxnKy2mBT6V=3bgHaqcci;DZI2f$K zZPST{Q+-Jd=d_9BjQ?ZwCyv+*S}&`qPN_j~Ij660;t2iOoBo%mU8MQzo(w0iF`!3p zKT>MpyBc2kZn;%QM^GU*S{4-R&3U2?Qa~tb&6Y|KKKSp;5IANm`sNfnFd(nlnpivO;{AJFs0~Ts6<6;h_cR`+lGF`^& zT>;xI^|mt>YW|qB9cc9fgN#SKXeAdrBZa|PHR)-5CY}Tr{KfOpm>y6&alD}QdUk!6 z9#K)8NJdg$&uTkD1_h9g4Np*~dSG3htL0suCFuth^)3%ZLBL}r{->6>7`zTAH3)iP z$4epLP@)e2&$j^)*(Hh&Z)^QtRWh*4&GAwxf@umi8NvM>9FnS=8JrHxLthb*O)(k0 zr%iX?QvcUnvj|SZ^G#MoyCixx)E+QvZC>zK=aI~}GH3Y{xl=}7aMQAQFyMwW3ocrl zpl*lSzCXW*)nD&?V`9ih3i?Darnc1RBZA#T(#=Z;oPSXyg191}t<%kdo_PYX`W$TA zc${xfvDN9~qGRVlzwWE@CF1uu)i)V1C^JLUxHfELTup+;8FM7s&JNv4CVW-(A`rNL z%OzwY*c4Bd=jBOx(`m*&_h;nJW0)R7oigAR=ztravyI*ae0Gp9crl+*%=09g+-Hy` z$4C=6p^Ch%OnVxVVhZ|ks^>A1$@g^=Cpq_Xf|*#L5BElv+|jg>!CQF@e>DAUk%6$n ziv9JUOEOOuU8fl}>5@kN?C>vn>-d9)WI?V!e z5Y@UL6}_?otd3G{>)I5Y#neyTU^dh{ zVB2p=^T2vD9PIYqpgK1MHp+fzl&z_!RD6_;|;6iM`51r|o z;Ih6giutQhep|@AMuX*wKxa+;o<#fyhtPX1X1(RtuGy2fTS=CQo|eV)Y#c`V=A`25 zWE=kVLFf5t^)ep3MR5-~Uckv$ZZ(5)fI_q85zUt0_sz}jGF6S^ z1PH~nJ+@fgJmP~wSCIGsVttO@dwBqC6meYIJ+&dH$kM2)FT z^_wVJn(KW&kW_Mpy@-_@1PZE)(oadb>ib-ed&53BKVNOS<@wOU1Sk6CAH-}Y};JrT^H4`nTdTfOrcGH)L(kvtH?t%}(n_fQ5%1sstOW93ytQ8lM z_1>cP9~zB(|9o$wk}NtVdHp8%^GVE*ILMcKe*cw|Hl@nXX!LMY*0#((4&;F>jJ{a< z`u2l(0^o*@w#H&X_xM2+5i_z$b7^Sz3(u!^8bGPlu-B z6hmzDEb`Om%SKZjyl{)cAfLC{mFH{C=AV**biL$hF~MZ2t3|1ewj$ zjY3f}pVL6iyL6HSE?v*XURqVbH{pU5(2hCcjsWln)QK^;OtmlH>4#qVk&f~7d;0=x zPOk#fZlU6H-@S_GuM%Rbx~So> zz~V+ZwI26!QNsrT6deTS@J4WiJvac1!T*3B`xi3NGKK1)O8+|MoX0OUS8Cbdcnzpn zO>`Uc)Gv5kA{wn-DBH6hxg-QJ(%o^R=ZD;AGXcU7~`Ay(R>W47udHiGxIY((235F#+49PH3v_S!F zi}=hUDgpB)m#q9Pmx%T?=;$You!?4QL)<4=1Q3}JZCL7fO-{2f`^6LUFx3{Qho}Ip z`e3Otj=o<3RKbsY0(*~&`X!nX0%XUF){6^fkN(l3GamT_(-#Yh9;H){J+OT1N@R$t z%A(cO6&*E{Pq(J9ojk$Ux!4uYLQjw4BkBhqt?6iFK3}J%ZkhUxoWxW;LP08PQ;d>F z!C<8ZvUh@e1d|$!J5sZ1DI0lz$2yFbfBsHL?JD6^1Uj(Rm-tMudG}YII#AYzH=|t; zvUlNid1IXQtjs!c23mhjfX8!Lo$uD;Z>u9ATG!?SbeC%ou(|kNP)k`^lVZFP5)YGGzy=p+=tG37e9!HAXL>yZFQq2 z5FZ~6lVG}|qy2l`Op@m-6>|*#&XkMQcF`KvWWg5{-aeBAfWSmG!x|t_=IS9xm-zAx z2^nLWmLMkjy{rM;AQ~AGR{dN@b|XP>noB`v<2Qj=fS`m9L-mIzKN$>|8KtThgI-K^ zQ@>f5(&HR9(uHA59%tJ%4mz^4!HPxtw#-w~3AiD1!GxZ*fr0DRV| z4&`g^tS2rkAk-XLCrCq6{L=cpaTu##vv6{mZv-K8d;+zMN&{03rRAh8w4JuEJRvsOy-~t^;s=b8 zRQie!udRY;OZDh2tqjHUVg3|hAIJQ(y(c>_`rbS*1w2)b3Q!#^vQ8DYFaB(Qth*<3 zC5#jyQthF@x*Tq?8T6~04OnCfa=>Gl0&O||T9pW`#vG*Z8|3G)45jzC8usOqP2^Lo z<9xH1E{jq{yNuxYTZpcpprH6EG>DaQbn_E#aj}d{Y2slxd6}5vdFx~8OHzpZzCZh$ z4j(@hasW?G6@k#SQ7FX!;-eZ9kum$*LOMYTDpz)9%3{?D+4^Y_SH+G$l5bS5H7;Pq z;#a~=!3kKn(8sfueI6nYbQK6_nP1+Wvvj;X1CL(SJ3i}ZHJTYwQl#E7<-Xm{jd(n& z+_^zjthB=0GnR`wPXsw+Pl0E$t;q~qqQ((yz&$9|%*t6aA%ftp?X98IN6a^6OfQN% zN`=b#X(|cE^78b{_Wk?K-(B6G77u;=hTe|~r<&M`R2pQqE-dDng7kfzM5sf~e23_4 zDOTxl6uzX#XN_hF4fOBnw(bQv-e1P~#94Rr7IlEqnzztJ8p&rC{cOCf{X{~!GfKfz zK-84Bf|0V+Tzg$SyY25`s-X{%n>XGf-AH^;+kwW5}%5r`3!E_ML#4YC^jP+;cC zVU(dTY6eZ2Dwv+>&-z7Gy{xE&KQ2?Yzt`t25PqGBezT91un?w+wY>)OW!;v*^K4d4 z7_MpmKD%iLw6*Gwl5i5#8m*F;I_#VAOy{MBtL@lO1myEqx@!Qh7V6&K{7!K!m8zX`uLuXdWwFk5)Tj7XXCIuuzNzf1w?j#CA1Hvt27VTjM11RGEa_0qr8soN$fg_p^nGaEv&Cq*;j|osR=vfg z{z%?WtTO!R@M5%>#ky=6>dY#CcE@=&I0faY#7M|%TY%H8ftZ@G1aZd~H>dCJVedsg z*lxe(H48=HRJMvnBUBOy`f;7JA%e+#saDja`U7(yNU!S@dwT#~%~kRVUmg`t7OL=z z7kv4|I~&SGC==^q6szVB3)!Po#M083i$Gz6$q=wV^o~H1A{@W~yJ?%W3ZTM8tJQf_ zE^RQbxdTB0kPAhrWukbo+?08kX*p3Mu`jl*2<;A%@$%aQ{2A|V zbBqhtZ=&2MD?7VOYKluOE220fLos$7UE-R}5V*_6)XNu3c(33cD|&r;?2-O>m-a-w zK<26b9@3)tO8BBg*n{H0<<^1{Y%k|=t>F#`C5x&)3z*QHm}9on-sw~C zW6nf31}a7SGC@X%zMB?ojX`Ws(x62PY^C8@4^_^5e5c}8KY$_O{rUrDPCh2a%o`(Z zK4Y!2D<9j}W-Wueda0j=JWTRajw}%joR8-1)-IsFv!+klj9?Nyd?C_@m}n6?cFK)P z@mX${@N%DX7;&}G%}Bb$B>e&X9(CVsqb8y{HUb6jqA88%X?5UZ4w)?*>fA0=<`&() z@R9k{s0}yh4u#XPXtj#oPuHfVJvR+pe*b)3+gig!NyqvIqLfHzm3uPPn0s&P>s0if z^TWx713Y(o*t37_cjWqMxgn&XtUlCtdzx$_zumIhvY9el^AUajm(JpI|A(+yLSMHh zGsXw*!GkgwEI^S9K&zpTI*Q%jQHZ)l6xAWaMGaWY{xgN8%vJnFGO=z(XR6T^BZicy zD8`nL+K=67gEk-M`o?01)rY@#z+!fUZ9PPS$y7g*N8mdzFU}dM8Lx%DKE&HujBsf?(F$D22dQ zl&@X6#$?f07Hzq6NINb(FkJM~Xu5XeS{*x!tmu#!%5{FWyBzMmukWbXY5W6bSCz6_ z;-mBQP1?9XOZ_ljVLaLrkD6_G#~dgOt2!`0uVYfDF?%BS~a zbaDntDZqFSKq*o1_4glNwF$!LgrzqTJO;Ug#QnL^zJdcCF@?BhN*8_v*)@!=QTh4E zTgr?Q!PQM-60vm=bgn*Z;)eMEH*tUknrt);SY*Z3L9sBEFp78i3)-Izyu*pyfnkP$ zSonD^iO0-M=N0a3h3uAG@G;$&*|5M4--@;bH*Z4#Er|SRP*@Y;r!5}1$#Au}_L(~9 zXhb1AjRn&;@^q@8w1_;@%HvxZ#dD1R5R2Q{?`qPmKdmpP54A(%p)t6e_V=)821UuL z4fMonia)GrzU9CCIjMkTtF8ELULM35i#3RC_+o^Odo<|Nba%&8fuFO4h((?6Zw@TA z&<{3&b2QyGg=!16gqrx?YUk%iT7#SKPA|?oXnJhvrXUgr> zWTObtaOmg{A`TI+ug}MCPMdVhbR#6*8Mug;KM;P&#Li>sLi8l~I@`?~oRuEY*rYMU zeR&iOt`26x)46Q_5yq?j!D?c3>KbML^Fp@*;@-JGQLv|jKG0!-FB8BcX3Z7#y9IPx4?&e*%W`MAA$w^1IP<<$iUVC66$1k14|R(F zkFB?kitF35wu1zBch}(V?h*(PEI1VI?i}3R36>xMg1fuB1$TD{?(o&`cK7Yu<9q)E zPEn)IsD1WcYt8vgnrRv@(C)qc`<=aFNv+*kOO^eFA7y7#Ul2AzLgze0q)&W&wS<6l zU$$W02c@yb8%M~q@OsaIzeirq-H3OY!eee3>Z)YZnt#0v0mh%fyKRuiDANZ#CPmUC zr~`6Ro`r2>cbT{|238fYGFU2?5ZYe^Sy75TPJw4DTNhRNPy2t0_9s!VcMAhU-t$H% zfU?_Cu8t!CFz%z_a)cX8(CDwR5t1>NIZ-}i-J|TszL7t3(K|efeglE+3EK;uoL7^n zY{}LyLO@6wJf{jhFXsBHbH}M)$9pZHw&U zRKk4YYGzV6$@G|b1$I2gbp0|XuOAkeZ_1}Yh{Cm2DUsrWhMO6J#3@Cb|HPQ71y{{% zm~E7M9cvZ zt6e-pqLmA7_|RM>*}|F;;{bkt;_e6;a5ZW_9i`~eNt1bJ4aF25-$9*16Gqvnos z8JbKoyw;6!wjeh5u*7C$!$+)ah8cz(oD!xQn|C%_;<;@8AH`dLi@>Ud5E1Y;o=Usx zc2k^SH8^25ZoY-w-48iBkFYuei@h7>OVM-sD3cJ(z;{001CbIBSI;I_dK})nrQ?3 zRD((`3?XCz+OME8n#PLwpO=^e^pzCa!y;S^H1pqduN{4bfx@@P;qCq_Nso=YdI`Vo zklD9JyEQuv$8a(#IEtW;m{)_mgHge~^A7bJ9lkO{EJKZFpXf9qrB=HzaIM3q9;$cB zDxFARK)U|vPRMEJJw0MP&-9T{gqrh%i>T{1U{JpVX@|#=v4;%o=FijgvW^?z)7Ss8 z?01y{*Kb#y;q)bB>mHCu#Hx7va`3?iuzM0T_#1?C1GzpmiyiqxhAVJ6^mG)w%H7FS z5yK5d1Sj+eRN++e>1#Q-CidhPuiqywV~~QZK%jf zNDNgw;{c7D5>;VC+9NGT+=1F8cm5ElzE5icWyEv$T~JPO0uNv)4n8>%mshfO8Xp`M zYI4@9O)u!?aGHj2g!~PK71+voOBs5Qt0%9xGlWer+Ym{$Y;dkhfk<;|GdNrs+?kjh5hnlh-F7FaPKQynlpQOJXysB<8L5D<`@pYU~} zzg)%6WOd;c=_iNPm^7|#TOtmi`@(;O(GiTt7vyEwt$Rz|L=J#O>C3TY_5CAk*iYgu zs9H8@r7tGe$7{kYB|SkdSJjE0NLU8^aTDCJ5B;|?c2i86>{5iz#{k=~+ph9)hE(m% zuu&h&*I-ZjQ9RrcS6N9O0sk9soxY*W<++RL)_|V|j&%IR-LWAe^chX_B0PMH*z7*exSYS8ZQrco~Vz}^q`MS%9P+!$TZ3K_Lo zISPn|NYm}_s~*r{XZp4*hd4d{l2MY-56dy7c3`PNj%9NUf{YB9z15t*(%|48M=GlP z5UQzZ$t2{CV%-h^+Z;$5tz}(QYjAYsKWOiAx~z;cCPMxUxbf$jce(4JKz&ewc|alI z)QYmw_LM|g6#wA3=TH#%;!_)&Z?m;oM2EZ%OH=`C)RPAfF%%zlObK=`Z_L1GZJOj# z34Do@=&#~TKt%*_!c*qd_g%Z?mQE*sDdKcBfozBRmq?C$`D^f*i%K zVYUo|5jX?c54{fA#@Dr~dP}sRCQG5^JbCxl_%-b~0)m}Fgrd>sZu`m%3JYRhbFN5* zf*eZAkyL^9VHPI{W^aW%nkG#+63k{~NlgszrH*+1^Fk~2Afp37nt%rN@b;kXKZ!CQ z#}V0%BgTJjv%e~o3>=$cv822^*#2EnVYlP)=97K@!*6i4d)*rgWmo3i`~-3&x8>;@ z;q#5rYJ386Td{y+hP4Ii6T7KXD9jF4qw6wBWo|VAU=#FXlAMEtJ>I>n;wB#`%KcvH zDPFW%YMb}OYCkxj8nBz@s!J8a&bvp1p_EP5O($bP*@lQ@U=&>w>l1-^WTwnc73~*y zkNDvKv8YCQW>sQk$MZu#u>aLB$YjV}30=^(L^Iv?7bUUfbn8p`z&}9{l8J7=Dmj$z zE^^HgxEM#HBfz?qmUzQ3^FX0nv1+kwUcq=z^nOgO zua>JnzjQkX3O)7}+NLOKXHX7> zbqxCqY36bb6}pqEscn7O-&!$aAzLE(Zd6Xa!0VC#C}69+f|k5(9Y!(@DJ zQo+YybPFu48*Pv=Nxp3}d)jP+VZYnQWne6QnnuK#Yd2ST^60*oQ-4X7{hO;OerOpT z8`(wHt*D5f_)hLy+&!F0OdAZ{q$E9!g~4*zwJ5IwL>vq_Em%MXASv&(ts^u+=ff|0 z886Cp93t6U+F;oFY!C}vY+Tx&Zv3}#gG3SfFUhVwjdW!?TiL9TWEAO zb?1N$axq$_WD~#W4f3SB#BGXEeG~sa_VD`6FeFCKrCfQ5n;B9U9QJzx2iG>nKq$xI z`M`qm5WQsDFEvwLiT)o$MKgS~7;6_zj0U%7;C|rf2tr{4cic(LW_l6*VT+#a?kS0-V8uDB(XrsFU#t7X{rd z-R>~(k|~*4fr_4erqjeML2H^`%l=YMFaBhtIDe*v^%+gHGPTe;uWHkx3%;=YZPAWP zWlxwbs}hd`4t}qWzhTb>)I2EZh4ICKd7;)3xAB z+tlpznq}PD{rspq9Mm!+!#frm!n!Acl@I~7tJQP`L~LV_3O2!p-moRhhDPwyq<$K( z|0?Z69G}}Emz}_u%7ehHoulq&YujE?E%Y4Uf`?Om*R!p>A!>K`ffA}I2~{3bcQgM@ zvPJ2S@+1KCH-LW z7Y03a`WL#W1H;h%G!K;(H5^Bi9Z0@!%SxtFz)dk`&9x$Soo9siONZaEH1o)lzyEI=fpzV|5U|Kv36%C8EhpCSuDIvoq=*Mw(!H+MxjS zRqV2$#=@en?oGGy582SgEzjr$t#_MNq3%F-OUvH5sx99=wlaDa4e9J-e9n#j0sNXk zd{-#k5fdHw$LS)+aaxfoGLjAWO^IdMUv$2~ERHu?q@Zx^EjeX^?JHuUggC!GA@M(? zfQcoS{#W}E(CW^zGBIy(>?46-KBo$P!9g!aMREYri;%+92F&?vm`5nmOYCk0C~9k} z*iUZ5Bq!3S-*?6z(UVm;p8lAY?q$&p!to$pVmEfVU5`&)NrrhZ*_rJ{Z zT~Ki!);sYMTjaaBWdSy6n*YvVHebV!-w44cTG?(KD_l53>%% zrJ&)wF&6jz*=}a_GtpHvzmqq6-xc|OwrOYP)p8W(uqZt=j@4=HLA`R50?!EK&`;e; z>kAPa4jk9=**?|vCy|b_hbA6tBLlm)mXyCJ8{5~>aX7gm_mqtJ&(jwIg+N4(l%q}> z_B$a(t?i22)^$L0MlIR^)Motx&iBITjo@OR4w=WRc1j5!{L9A%b$uV=?Hy^)x|C3l z`$Xmuh7pkwjuz6_*c_S1!S~p>>(8c1%))-j%3t+wp6x2!M~d3b&(@0C8gka;VrBOm zW~3(bZd9@k{cZ%jNPw7aN#H)OX*I4xW^%cu0k_h%qo6(WW%<+2yihVy+Kb?hnc4^*K1rpo6mHGDKGH<5*ddAC6odbLWyAuzU=1a%r zr*;0x2cK}#cY(+i4Pn3kM)7TSgZ-!8unjA{W}X+Kha{0@6u?Qec3Huhadjv)f&!0S z9Ah2Hem~BGBo2r%EgqRsw`nwRwl{iQf=#q7@&Aha-NEBr%8UDR89$kam!Fgl_i&p^ z!>|iq?s&YLh#{&Xbmi@V?au!Z(EktMKxWfOf~*1k+^DpEVFB!m0RDd$bfJ6rgXPtJ znlb(Q1NM!%mlZYlvj6w3|L3PJVl;=wM*)A#_n|{?LfGm4!OM&P`P=`oe~2JKdUZ~s zs!jQ-Mkd|2+Q6-c=oY%qTz$%e3oDIUr4}U_|CjlMlJo`iA?H3;nv=Pc(6KVrr1PZ_o;YDJdj$LiGMQ^~9q>D8={pe9F3;U4 zdAYb^>{t~@!S8QX%etVDkpc7AZL$rh+)ob9)@Xfi%3Sp?J6A^Ic-_6+iVoc6?`?DY zM~U8rMp!y3rrYWCUur#?bvE9AnXC9+F3g)=G74`14+od`JJ%K$-pSm;dM+&TnD2}& z_hkC{UTX@zd7R}Z-YlMVN++HF>4* zPw+rKd}PP_hS93>ffIedPfosNZa{@t7U&Evwi}ww@#))=Xoo{bIqPqfeTw6ZJ{qN_ zeww3q89gNcs|`>6z9H0EtJMP>-02yFQB-dx|7#!`h->!FM5w`P`lG19n!fx!D zRUSvpe!hGCMv$Y|>_lC*QN>nJP!O8I@hgNx$g2*&vYcIx#YmCdm{Y+uR$S-u;!dA& zMaK%~*z5S_sLJ*^_KQ<<-!7E<&{#11PES*{NpHP%z0rM+5Ljvp^|PUY8HxBC9tq$H zGAk}AL0M@ytMW>Op%8TH`wIqd*2UASs_E%r#*zr&ppXg^T?J1=*E^amRLq;-ovo0% zoh_I9X`sWP5TTh(WTC^{T-YN7uC=;{oe8*wKD9it+AL0ianQR{wdNJKVQNM3uHInv zK^8joE*_7YV)2*E`2DT`iQ~BJ9-!&cq+A4K>WT`6^44?K*Vq5nR6S%08GX3i5r2nx z?R|7U=ml#qdopUJ?)V4((L;i(F0d1*Ip#six1z00@Kh5Yj2N!<=!1RUj>7GAGxCsq z#m^J6+6`xQ9Z8;2Fip6-+8Z@mI2ZcuZHg!4q zl7=4QgR*?OZ+|E2uDG98`OqlmU|Chp!QY?#Y-(B@5L0tj!~6OL?bqi_E8ll;?6O9Y z!bqb%SY>ziL+s=Hue#v`N*T^Olra5vZ-R!UDF=$paG-PnQ$}j$IC|2_vtG(HSOPYU- zH}}zhiQTU2n5>--XtM1;DSl3Nr}fM;Ptcu?hW=(djNSkIjo%2sBRyAtd#IbfpEs4f ze?9(R<_~e0f6{$y?~Ic%M1R;vpd3z9Wty)Q)zZjuy=3+*>R0gt9kM1)4)~ms;P>|8 zDRl%w+n)Y;#&Pt@+!xV`eY`1Xi=YZ50Qcchq@&p^mAVyg% zx1lNZ?#?2LL`Yf6Z1eTvbAgHcUrSwj|dJElhVi6N0Pk-P(` zBeSjLo1k8P%T<{gZCSrhRR7L5T1XwLtKu+evk1~$8VbZe`(CfErXGk%4<5<5!&rOW zDGt}#Cm&n=N~=~_V<#zlNbvI-Y@?TNtUI&8_mJEGn$jOSO~m^XaU{{K^H; zfeVghCxnSAV&ExLAMvd6U5)UF>$cY8hFkFXSDvO5~X^ zqy|}|uCHOoe!kIZ5bP<->v;v@WtKvlUz90O3>PmOw>x}1`g`tu5eCM;${9Iwz1;D1 zvd@G$nFJ+sX7bo`HCO7l6QIaWLkt5FmmxDd#KYs*NGiiOnz^(;cpo-<<0RMbmukUa zNpcaeDBFAF<4K`{2x1f#EIup>o}oTnimDf@-(UHF=r{r{b|jpm&QEzU(FX;|hrb-< zGKxYLPAZu=_ZGp9A36L6Ze6+#G_$dE60%$ED<6niaO(L~@@G0c@PmV%f*)W7fn1PJ z=7dYZ{si9&#j~iyVE#@ppqId$EiOmPAd*}f*Ou5A&q{wPXeg8NxUqbPy#s!lcl#Nf z=tyNxK3=MRvyCZr z`NFr?Cwxy@C9FIr@-v!BpyI}R0Pg-vV$Q6foWS(@4RIUs7r*{6JmJQ;mHAt+G5Ckz z0Of)Oqs*1Vo_?@VGLW3}oSM0v0Q=KbSY`FlvrTX{YJ^7bt5S04$!AY`1|_$SByRnV z`6J8P`A6xqq1T5eY12R+a|~=Z8LF=`J(IsEBPE-?rMy+)5}!zze5K*6kjTfuLYX`(fs(mDG5D*Z+u;yMyySl3V$hijlT;ZSki#zBLkELHS*cdB- zA%Sf}yq_+UBAue9<`FJM-`0)@eUoGT{szFg2f~e>F4c-RfFzG*3{r0na0Sg%?PUdQ zRZ6*o>1vRT=gVZiy7@hbBakJtg`tqb3xL`urtjdw$u%|#bD0o}{uITLiWrSREWdy~ zdMLH#<5<$!F?0dF)0Bha9YZu!oeEw++TSqn;MDpumQ_(7@`f;c>3UM6XhR~VFYuz; zgtmu|J`|?ZzOCi2`If(+n6OTRuC4PMH#-I;K81o)5h;&dv=P{I$8W9qY7Xr-ak^v{ zb52$IPJfFY&Z-ZoZiU!WSEANSS3m1W&wHqVz9g4KVRW9w2ksR6cSTNc2yX)QCI=N& zZfjl%H!~kf27il)l0dPv-vl<)>!OeXEm|Y>)<&sxJRKZT*272Xr zS&gzcwIapX`ud?y`dr90ygXb3Lq_=x$XE!aMpot{JMPi`t_W&0pOJQUV?+thR{&PV z#KhB=kZX$4ISqGE$XG6RstsUbsL0;%rDYR6$O&~aDF3_3mu0qJ#R}h_L?w@hf~o^@ z;ngR2$sGQ`Li%r_iXvnI>blMbnSH4;+Ik_$>XGS@EMuKvv{7?tR#OM3`xMD z%co0fIn0zuVTdhpGvUI$>1OAL`FuDbwE7e`5rXv5p*T3-2N6tX%<3=!4)FXIqCdUe zt(=B?T`8yL4ir0b`W>*`3BOeKW|x__(A@*wS8WWbgVQ_;NF{o`=n(T{##FQGmelGU3hF!*Fy}UwhBoQcY4sYZf+UqIB*<@}cFf8w* z*Z=$vj>`{|f0&B_9yJyw)32=?ou-H+HOzB8Zb0l17Gke!4HCEI*30#RLG8ySQonnR zq4;{sw$&&(ch!Qxj~M5_z%F7oT-PiAA7b3qRyCWnC{$)Gx-R51*7Ifc{oC*f!)XRS zY{@BUAu*ZUnXWB2@+CM!&OMcWmxz?@QNj(#*!OX1pLOu_&53?&5-xXLZ=Cwk#vq+~Y68q`w#tXEoHkTZ9B`@;h zgyCIpT^mFz;`?#aY;m?nh2O;y?}HMXGXZ*JEl}s>^+K;KlP>@3QN3uEzm4Fu zG1^$NT>TS&Lcs((wwLK88tZ z`1j{lGR|K*N3cio56nW@g^Tr)NOo4%?}keC)^ZNW_c0FTkO(J{UwUK;*SS8r_fa-% zsMSSG-N_$CQq4w;;~WaHaOo*5esxW66Z3ei-jYWJA;N^HQ}k-xD$C>C`IxA{yc3SF z=t&aiEs*WO%cs7*KI1E)(JdqO0KwZ~Jt{<^ztmLg!t@_+j#I3I;U-a%q0q#VskK!- z#CFKkR6a0ZAwN1rnMFa^?XrD@bCu`nk@gwkcX}vBHz_+T@q($&;WcV2YbP`QAf75zrWd!2S_$RyaphFaFZ>v#D9TZQrqi3 zJ6z7<{^YRNxV~dA_3vE}rD1Lz`Hu)b9a(H@+T71&xzkA{YDM2GfS=c4lHohS$Po3Dc+ zZ|g*yU<;{AcDTwQpr;8cLbu*k{*rNdSzc9WqQn?Y}!FMm^f(v!kY-;Jb7UYdd^)-6k{i>x$@W^V0)mDWWX< zb3mH^5uNMT<Op?D$UEz1{GpgyeatrVzB>h`@5Nxo1 z9b5K)i^k(y?NFF?P;!-Y1ghjvga*6*Wq|};%fr;25+=F42l`0duU|ejin3V zd@A*YR;|IzfdqFX8y1!UMr$9oyKqQ!SI{+oo-%+}MhaY&$lfwVwV57(bf7!Me0({6 zIDVHJZS9-Wk~+_^UO3VaUY$>+fscIIlhN)RDo{I_f1cQ(XognBzngiMJK9e8HCt zTL4sZux{?3r`I$Czoij_M!O)L8k-XQnj5BpPYMv=j3j%>6blzkQ%odM?mpY~EOV6T zwbtu$1M(m=A2`f}NhW#si<$b`%!*<@6?fTNOR4+t@AK2Z=S*(LaV+|w{I7sfYgy_2ZHGUxUYRp{GVic3DSNPL9hZL=f6R#Of%_uir5rq+9Se?sa2mX z&r8>|`F_YA345QHm7j#V$Xu0nvofwt8&BDmd$#g!2-IoIEgw#*ECswD(=qkkK85AIRChVnN$6gZrXjmd$ zSXAN~7<4YPBgiLn6lzqTKdY_pGwV#Ao)w}ycs2Y#06<5zYtcw>YNO+fS2x_hlSYPU zlwg0&yMMH``ZthY^qH;b{0syipJQ~}!!~r-?Cn({1Mm%@ zra!e}(?u?xvAIP-uyl44w5As6bY_-G<%3>YlsI2ud34Cf)J5ajI4oyNVqE(8S z?0lH%fK8u-^z1C{*oyNP6(u7>1HjJ{K}={!Pe8uP7*EVjwvtA@Iy;&VPP!)A#su;= zZ2tGJ%Jy0^xfhEZlIWV^sJQ~Gwk<1}?!UK50o+)`j#~$cXfDqCMBzrdV z9{FaGRMq|r0^LoUSp+ebC*G)nsQZN_OvTX_yJC??TZV>$$Z8tCyFN<}vE67PDtOUP zi*X|fP^iYT<(7AQ}^##_lCjLvFcO9vWA}spna0nE* znL_O}#S!MCKk?q&G(lma9p;g%@g3{x1=*b1+~b)--myl5GogZf;%*U0;=+p#QQ@A5 zg-bKIo2#lyc-*#79H0R@8eh-&b5kZZ1!~rch@qO{)l3TfkpBJ#;5?I##fjT)b#3I} zQENor>lC8!vbI&AAUTK{0VIHiEloq||Ep4RD;b8-39Ybi9$U=965Y3k8;42Xc!{7c zp+RDP`qHb1@Kq{qN-yuhw=RQRGR%+qSTQ+HF$N5Zr~AIX?gAr3HTxki>-Xsg2Pgv~ zbxGkcD@x&!K0Y*WV9NbacqhmgmuyTDIpTD{(q@W=(raMeBsY5ARVTw;g~InG)fQzi z)Gr>$+ljVMjmpAA@61Ul`MR?|;*xRxRBQ_Z%Pc>bbe2*SB-KykaG$I5^C<~|6q5A` zjHKMUX3$qyXh;tfHCk=n9~yo-+st^#_gU@^Z8ebRZan4y-a`|tJS<5PqPyT?H1$58{0a@=976ybz0I zc7qdZ6^i(r$-cZ1>p7X0jY)qVBi z4s$?V`gDlzHU8wy4@)e0@fcmkJ109XW4`nQJ#oF>8aHWsBKuSC;Xh8%<>}EZoZ16P zZyAu4AiG9w4f`J5*z6nDw+XT^O;y#vah_98Llgjc*x$t86jAadLv8YRCw?5SnBAI9 z{u8R!JUj|*jsy+&Yp>_L%o4SYaRl>r`YAo_1s)$nhQYLB-ph@M?OC4Qm8ckj*bFTj2=In9G2C@S$``|BxpZ;%WRo22tjph5z5@2tb)Q zKy*EqqCiq9g1aUIg9V8s8o!p=b1*%0^)Q4yTufThIZjojad>Lb;&`Ld04qb|4=X%9BpFLGMVICN1|Zuey?D7!d7r;Qm~YjV2CCOwc=sbz{nN-*c$D-E)#acl3BVS%e#n~`y zmYQ}nVO~^xf4;m?s3Q8M6bo6~*>XeeTTp>mbc9l3Mo+~JZ=7@t0d)=6RFzg9GStV6 zGt154J1DESZp#hs8V85uO+`bQXWU&23Dk6h2Yg}WW&Bc58Y>PyZI+BVM#7JLBKj-|P3j_PYn=0Ez}bmtN{Psex5B~f zr!pg955zCI&2u6|jXGT8VIOhn56(!utjuy!xkYTlLIpV-`;OrN>p;H5chw>a&rJ5o=u!%Iyz7A;r7w(xDF`B;h>g4_875#@kplx?x!r&>2^dCo(&2(^z=@R#Eknmxt-%+V2waPUK3RRYj zp=7o_r`NdORyRA6@>dyCsY0eR*7isJG}&qh5(tts^J)lELXGb`S1AmP{fURD)=ClU zhDeF$8J)Bn^Zg{6X+NtW*nxr1SbQ4U4dmI;1E7@8bs0mmztydo@_Jncah!Xg;UR3-{!GwXWmFXkNrR4`u&|Lc$N4=8=8C$M2Pl*OK`B zcvL=fo1|GTDUVo3!rPsN{6S2BtXgtDjY-cAge#FgL>0IW4~k!PwwUv_vptz6?}1%-S5$fC*2fFDj#m?hc(1fCL;pYAfwY-R;0zSC2<^Ez5|(xRfVjcogWSt78gkAQ;hVo%sDkNjLcUEzw)N;{HWh*G|V@gcJs8seU!4Ht5O?!eYPZTrs;Zs7|53}sV1&u@S zm%0?jW2(qR7J?FP$oLR9*IT_G_cy_yYkpg9ma&zFaX36@Sd$DmZbE+P42E$<<^fj8 z)lmsTaA>YEzG(b1IFq1Rp2^W@NA89YBYYO2C(JobsSX0iOe%^qDPa86g4z}e7KKoU zn>qhdZbi-=TxsRA%OsAI5Ac!|5)u(up>z$W&=E^@I&xo9tmJDs?|SiZMMch(zsA%n zh@gA8+(s|QL51^isyF>Kut9p%{6Vj@#tEby=`aDQ+(Rl=x)|xf%Se1{86`DH0_63v0&( zJh|T2%|juI8*|iY*j>7x92n0Who7r9ft|&6nb`f>oUkr!65>qK+0x>+k)9XSi~gUr zw$#6BZCV)CP-?)so1D~O@_TvRIf$c<9I_x(Vu;NA{RZrbv-V<}kkz63Em;>IlPS9s znuU=E6aI=JH6#3VXtL54e%tdRh-VomnOlop zE{6+0p`wkK18z#Xa@0Lyb$-lANwGxF%gTyn=5bHv4hAyqB@rcvGQue^`pHwU^5g0r zKO*9eLR1ZW&f;C?<~MHN1s+=g*1%P8Xm;yKkI2)5+KOQW`#>C_xn&35)SJIxv_@b3 zi&Jy>Fh#vl33@|TmW_ApMr>GHb@wb-_dn+Uelt6{Ch|7hsr4kn%cby{4GK?O%Jgh!UF@kND@q0o& zfRYxPz=T^xDvx?KcyD~4MLPc}0ZXVt?fd<6Evtog?MSFrt(mV$a0(m|{gvcra^IYx z09gEwHg>Y_hKuH=W|85RYCI`Pv-B&h4^JodtDOHhx(()0xRZ>7IBPIF(%B?Dh&f)g z6~KN@JfV&CWu%`4Bt%Gt@Q$>QD8D3+-p`Z)?lite2qK_u2xDP?BGXUvQZT?Gn^0HQz7JOZz#?BEcXWYT~zc?LiZl_58P$@E%OQ zFtTa;dSYI8)j#&U1byFQ+L9v}YrY1Lk8?*+vC$;F+Q03`xep7NU>(Q?=2b|VHHSeZ zX7w#%!WRO$kMKf77L3)KKLD*!rFJxznITIN1)}g(@%W|eT$=#r<3XvY)I~oOR#A$9 zF~q|ddsGx?m&lkqMg;46$#(}->r%(6DR*9;2UCQbo#=4``1xjSqLEax8A#UDg=ZS4$1(UbC;>9WR+P~ z?qE<^tq62%81c->$0(d{@6~=eL$`9K0-Nap1wqvOBF4K8qf=d$)uN_kEA|`DG3Y8c ze0N>LJxvA5hlJS1*Mx-CZ111bvf}l*N1t0e-(mUcFl^ViG!Y%nu||g*cz{Z&7;TbZ z#&|$|pqrDa*3kX_VmFvE+1V;R%ab=FHR4n}uRRDZD~XWW(o-dJs~b!-xyGmqaQG#H zSGg-{YK^qn)g92kPQ*)??`--DQ-*rdfD@I&ZQA56!H`3Ndl@tqFLb@$+UY1!fXOgA zIzCNM=?V856rGPbCN-vm$Ti6xmh^jFqXp;{45kb&%eHp<;zW8zPZyag?Rvf{Hxc19 z`kcX1V?56tqdYykA0c7 zIKskERC>C?Tvfe11S6$`&Lk(?RskIbX^U2fb$QZKf&(e#D}LDeVr4nekKh|an?$b| zBY7$$6EqB2ep>p`f>M)WV=akdURi2$O_OM`2}*_q*~bFGXnik){HP%$%Tv5`JT=LM zh)6MMk680?I7;g_3N}2gRheQSnht${vqrpt@4^7@qV2etS(Of)Jx%>A#7CC9YJGpy zV#{6VJQS-NZxqdsq=_=0g&9!viU!KUuJ-ju8j=^n%a^QXE$|E=HN9dCC9hFs$$&IO z;?_uA9*R98_4)gga^&gUew{rLjm3u^cGZF-!Sj5up+KJnwkZJ9=`ROh&nq1thGj@$ zavC3Zsj!wDB1nYx$w5+@LgSRWi_77FC{q-lFR5E$H_>$xsgA}9(XxD#Kmim#yqio! z6wfgblNQ4*;Y3f{BMJR=K+q{A&0zL%)QyD-s!WhRinU_hTI{HbmsF7E5c_Dc?qf9D zh!ArY<@c~Ri9AQhOU7H^auxfw_w3j@o+VYxVZ4!4kq%S41oiQ;|6>ld)v~OL%1zdt zV~ij5Z@EtK@0L)LPVEgr7A!mPzPrN95o0&Bz%>!ea7{BJivtd6LHmk+UO{^67$ulj9n>1U@CXfiyoF3M3ng1LCw}8 zeCM}Uj@SmdM_mH(OU8x;X?lK|q4XUZRWg*`52i88wx;vTI>MW{L2SWk_j56ryE;+3 z0aojc62d`c&Ou4Q3)@JmkTzfV`fApVwI5yrKY1__@11AbJ$8`~?4YOAA7tDX}y}2I(qMo?$o6xzrePS+t(ehQ1$|r9P z-WzaybZldKp)!3*zK6MbgR9F8ZX3i2p>X)~l?>?EuZPWU6#xCcMFNoS%`>*{w{xBR zT>wl*{~o;QtowR)AhBqkdIA$0YS(L1k=@ber6Rwx?;WDQ%pDv!oE^k}BQ^B?MS#^$M&^h(3HXYo? z_g)`Ge_joG^ZVmmyZ-$vVxyRWk58uiSYME!Ijc3{mgYa?SXrZGx-eR)oq zQ}>J+Z#7^4rexWyQYTB8Ja_j4*o3%{RCX(Z-x!O zoSLmq8HYmUf1m0h*=Y_-c`g7JNZdN@d-Kmdzk2%}pP(kCS&N7x=gMP}P-#-BjicZ6 zexhs!JT`hqUyb;bug7*ql(JD1XGgD#Pu@Dh+C?n!mAyn<-_y<8#^SDRZ14ZLO{C$k z|HrfT;Sn8f_x0c+h^!l+ge>^!cCo%De_7I|tV#vLVA&31W0RVaQJD6*6M_*v7YQPq ztCDsou~MCT#BiLZGVQ$+0tfj3IbhHL@1;$SWEUPTwF?3lqY@h2A|Wl!ug^$5V|mr$ z3Cm0~`U`=F@%Jk_oaJ>KJZuaeOMkU^Vevboe9!U7-4wp|&wyr-DXXGlU=KkIX z{{u`*Zsr|#w_5?pxJSt*rhm6!{=HHBGug@c2zjdAe^INct}Ya{ojb}7=2bk*&JAd`kx_%>al}4lfe_i^|1gV}JZOGfU zIN16By#K!@OaHxZ#iD`lCEsy0nf!k=jQ-EnRuW`oo|VWcMK0&h1eq(elY!|`Q0JWh;)XIIuE0NM&oMRnABoY2eUoo5CZWX;4Ph)XU?8gNG3zM%I0lIU1o zV&B0Ot*|_F;I$l%A#}44NCLj~*pTjn^TaXbUel}Y&v(R`KoE*B!yk#}e}CkM`yf%W zi^(dM%H*_G=5oI~<%0!7=~9=+xa?LJiG|$8d>c*DM$Z?!kqLOa<|+*~mSr<54LZ*!vKd@8 zZ_8G3fcf=;0;+`?Da656kz(tOj@R>tON_MaHI*xOR$AC}y;iSrYHHf%CP%Imhc45y@|G!rh^HwE`WFX;OIDUid2aM`f zY4t~|iMvrasLQLl#N@2y_S{1*f{+^&K00J!f|pVf*IWdKs4}bj%K38L#+b8|qRP9n z04^GTBFNm1z!IMPp~g@M6>9}-5Fvl)BO(*FuzJo4<=g` z+)tEK{4Amo@~;nAvn)bP%0S?p)UcQO zlPKS+!V>sg((1SqdPM$O_KB)-wpOk}ZinW01HoOpC5FVAbwIWBHs)YtM7~_frLx)O zN5)N1=QQn2%ZpWWjwPAktfKp&d8L5hq?S#Ebu_k17!)5~=Ma&m$i%>gdQAT{&=Xz_ zlU^6_X2fh$#uw<+zOGF!vLiACqi;xzt7%Z_ZPF9fFQf|#^%VVPj1-icJNVLG-_9|B z%c4ya&D^4ruU~Z^1dG~Yr`Os7uKTq~|J>>F;{JO-1~1DG|ICX}Nhl7RFY~QK3 z3GU?FKE{UYhh}oy)||}chw0RsWh2cMn%zjawfsiL9EbzJg>#N8A&;F)W9cWo-1YWz zg1>n0V12qfSQVg|iIN_GlyJ75pZVN-0UUVUo_gZ0fJLL<*1Yd_3B?Ah9sh0`HHsIU zI*0`jvU|jPzuqqBN@vbXe~Mo)*J zK$6(|>p5)RKuX_cL z@?`!}xfofnYa$nFZb86UO|+2Dh_#Gn6l-c>qV00~U^*KEAY^r1P{%PQ3Q;YDO`ibQ zSw`D^Dg8wpK_h`PBV;XQ;0%^sDYvOAgpsVlYKEM;H*&^mTn&u93wfw=TM<4m2a6%l z2R#JX!2MX*n1=vTg>e;}k?E)He9xmvFS}$KEYIIeWG9TvhFWy^J}j12wrr~= zrw4R1EMRHzRdcley}rYOLX$pG)Hdv9XI4$p!8DTCi-J|m)*u~aZ?B~@cRYYf;Cl4Ns%nQ8 z0#df`H)(lF%d7|ZPAYG`PS|EMngV+Yp1zD<{6yum6jpY+MO$%;`^Y=c9)4tMDJTLz2O%yHN zV(jGY>Xs%S-&DP(Hi>1xtcm92GyOj6LulH_tCEkCmw`@v_C9|^rd~j9K|%eZOw93= zcN0`Co%p&dFjC?g;ET;HrVKt}A>J+jRHuqxmo(5^HWYw`i2HbF84q{Cp^jHff9HzG zId}B%SSUO0cvuLF-hDKSdx36LZ4yB9UMwt&H#Ej=?+aU;BYb_3P1)_?{?esX5}$Gu zIyVQ&VHv&&i4;wyl)%NzO{m?>MQ9XVWh*}yhGwN_KQ|=}pF-_?bb$_iX@b>GBYlCC& zTS@E6#shKSg|=6imVO-dT1M_6r#2S#d}@PDIwv82Gw+JK9_P*=a?Qk@`)ZDVMNR0A zVq8DQ4%>i#^|S_DcKpK#o(#%J@>rf!n76AFALZHgv0Em;TQW9X8g^EkuLCae1%Cwf z*T;V#QaQ_Da=HBhkG1{Le1nU27t&Gz+x}EJy(6&P#mN`So|3`0#$!91kLh2-TI1to zirzCwLWEIGAnTJnuKtbpNDq_ z(%9m9#G@ycT^zxT0-I0Z~zPV~wd_^CdfYx&*UKM{rE7K?~D_Ia#b5m9YS z-lZzzz9rAKtZ#{{^Kizbganq5VS8vG@OI0aZ*zJ;TdH2vDvAmQihcoRj5QxQO@-#B z9;fDBv7gvK_(3}OtVpaDIgcHN*x&HlEFU7&7iO|K^Q{0IL}AgQ;T}iIt>Gb zZ|q95(24Hnj-SAS?z^ntDVXU$-4D6)G$ej`)S)xScsQ%MN-^YXP9CC(9lp2J`US!Gj> zi`8BYm}_WH(EPk&U_+Rb%5~=iaCmu&btJr}o{B{v+vX2APTiU~1yo02k7D7c4>hGIpiWl9k;Q zp7?AIX(=pIl^NP$JYEfvm6xqQe%O{SbA4%OH>PouvfBP+Y7{p|17-{XPB=ITi_rvk zXTk?wLFGukaiI!XGAwO+MMS=c5i%yHCv(CYjWrUxLc<3`Z?SW{?c14(IA!fU*G%4% z|3p@9kLWKGl}?LaQ>Pyw=lInv^51)Y_vn8oN=8>~*en%si@|8t1~vujhaVONaZ;+? z97^Z-lHC^6cR=JCyW4WZ8^*p5L9^t7&N3z2GsE`%!(>OE@SBuOBN+MK0@_S@O(=1& zv`;|;-Yql1ckLS2a^g?8CJ>|ihSvl%uhAGu*f^1I`P}L!S+tvnWTJPQ(RFdCrHQg| z3zs0Yqy%4WsfvE(6ViWkh*^_Jw5Xr2)r1LL8&M)?G+?SOam`s(%0WJ^a=Fc`Ki19| zB&@9?6>q_WikpXtg1xR=;6$WM1TcN9a1@YW;25~OI6l(%wQL^5Cl1o3P{n`9RZT)5 zb-Be??$kKAjZIEF#L>cf*%vwk-D?~k;}XP0LQ!S79tDeX{Vm*f>5~0aPDCwp5Y<>= z_=ns`Kmz>S=kAI_Jmmry@1^=4yX8!ruP0#}x5UOc>n5s=4C#BgyL8ZNaps^-A9{wV zIzBwpe^UfDp=sv%d}AL`QTUQA6elR9EK)JOp5e^3%VnS+1S?`j5pykuKKmdad6zd{ z^fi2-y7fJlV>kZG-cFRclhV+=pGM*e(_EaBfV@(cy>YzMoFgjc0hvHKq8 z{MiVP+|!Lyl(7gYW2UYq+V2j=aSD`JXP-p0_gEf5sj9;f1%Q;*7;zcAfIn>5sJk2p z+xNA+dv~cw;q(kN_SIbt_F+%r_?wFDs^8-@8!uucDvdD$LN_d!Z}hqMZ?P4!uM4k>ULvOXX!Jy!m z$6c8itSVb3^>*eqL9OpYLv!*vj-0c+;-XIVKYTFs5r-kkQ~lQ520IfMA#1IRiiS{4 z!tM3$2F`+Wb3ga{=y1}v5N_&zUJS529m}iG0(oEH{?+;tmz1>U$<&NP#qSAhevA8} zv#&}r%;GYY>}s=MnGrE07e}eejO;ggv{g-wvkm2VRG-TAl8OR)jL&1+b3@tv!lG_mRlke>F+R@t9^p1_(1 zdHIdrVUZ?%{n_J;@>)m~yX$nrQBnHPSEx&%$7zK3eDMo(!a@yL>JuDkd``U$0!PTF zFefNUjD0+$?4LUp9zgvu!FQ;>DjtI>etRZcp~gr;wN>?c+G3 z?kMX%@RceHeVJ38$X7NglSBlHMy#Fu&!h$TH)%<{L#4*tKzZjG zeY5bvH=ekI$WpRbdT3TwUY_7KO4T4Pu=ezTx1xouJ;SKv-V%~`FNqYh>np zzk*A?OL?bTjS7nJTdJ^Ml?)D)Z;!>*d2; zMS!}4iO~-B4cxO3|ByA{YEhdS6w5Zy<4(i>EqQt|_w&7EG)H(0Ms~6z4XzFSj~Z^a z(MYXO%A@X|f~+Wb)XY%r10@YKDK5)RqCGHC$&yLVXLKioPeKm1@-~9~Gp<;0C=ZW% z50l0yo&#;X)aLe=Tkh+b7?GrI!}hp8DZr*KWlK)kMXS+eCmP`T^mp{>t+{xx*LnHO zFkc_#k*!k7i4C;VZRIGDV`(;nKw>w{4}@h+rx1q~m{1nH6>gSCh+_J|I5I$JGn@zU z0{Pv>U@j*DCDPKAe%liJkwU?LT| z5foLpHj15!RDYn;PAs~1i!1T;8*~h<^~AuO*HrY7#VT<$YGhm^>|_BjpFLdW{l|}m zpv(kETkjUb@6ZpF44RTSCC`4(SA5a_)LqphAp-~$3)QrfHyZ*3Hklaq--bf3cUu#0dvQkbd1yt`!i zpr*D++*YwYO}$|dbljf~2tRYe5-dKMl!fw-SjD`I63Q^kf0&t4CD?8}O3Tw4?;gj= zaM^8J+ym9>v+hcahynM4*5AhRMTSRC1GFAaxzF7Y)sV+jE+h^7*cDn!Ch9zrR9W1r!e3 zIiLGqY{WR|YH67?4||^`wadF&XscIdEhY7G$VI37zqu{!(0V1t^Fm(e=Fy*TG@W-v zBeaJiR{vjC{PyNGuzVk79KAvlV!vSmbIXNZe^cv=psCbtn&(sq4-aQn+q`xRSncUb zt@GZJOLwaH@#Ns^GVS(jM6U%*{2pubPySQA&5Ds1x4MRf0qXD;vkwQ^jQ7wr4H|Yn zmZK^n;AGa+)O5}b)2o=BPAjcf7p97tVa2x-pOA3af?4z)ps#a4bmrMkm(6Xvdv6TS zB+ezK{F&lm%N zQ246@3pR_1GAqqI1{T=;b4j#0t@4!I#Up|y|II$$P~NkzYhV3u(i>Kizt0THfLx?a z@}eaTBM=Y$pM-skRI0m9m=@8b#Cb8Hsxpa}?Xg9~ozd=RB7cmMQrygiFNBO+5~l3r zREs+Jptk~*QIqOCaoq^Z3j8n zcI8b==^WsU4CTc8u2XH2Dk(`7 zc-XaEX=f1e)^@RW&gbFMn(JNMiA4X)1dPwoYs&YreUZR}DG*o=r`vl#Oml!L8GIOb z$zX4wQPu5>=&9~2P127-T${6-X_)Ifz1D;1jzIzYE!e97pIz|b9 zwnS=<62>K#Y9Nhpjwa$+q#c}l0lGuf`XzWBl=HHD#walo4A9U7xlQ+SeHZCt3bVFEH_d9T6)V~`9YX5u@tH!RG5SCzuFfBY8nQSP^1aI|kYvF0{gLgJQp%u0$PZT#g$BwqJq&jJQjGF0UkV9Ix++@3F zMI~5SXv)k4X8B7HSqd(BOI8hVE`gwK_LvEslpPVn+VpZtB#a2%W&CfFg%T*swEyJ_ z-r@IO*XYq%ucEeC9e;4pX;$c(4sze57obeL)@6HKgkEG+@!J~$5zT>!@bKS+kxqBP z_p{y4r9UhLVUnKg?cHUKWx(8|EVV6zlG>lrintq2Fzj>42mS-APLW(hrUYyXwI#yT zZ9BF>fyf(S#n*3%2V-fc^{PL{;fvP<#VSilPS7!$$*66U6pSX=j(F}wlL>qS$tJ$a zOJq1EG#Fyf4fK~&FC$Q)m0V(1t@Tt3YHN@CD@R;M)DcS=c@&I=H(Y$hgBgr_b~MKS zM_J^)3;re!7~h@HDN08k8UYq;7V7FQBy}d35lA1MiUy=EpF5h23DW-LC+R=yhm#kh zZUo2J>x;F3Xb~0HE2#!E_xM(i>zEH^&{}`gxnqUt*OvPFbT?$dUy$|-4ebV)FpmYB z$fvM1G|wVaY!E(E2&dh|I759CYlEQ7#^@lYiBV&+ch?-C&!J2(zzQv{*g?+!YuT6x zA4TW|h^)(flYBZ^?45n_VtaxiHVUTuel>dDJccE;oZH&^^N3gPO=OMR>DC9D)n%B+ zuN5Wr4mfD&F)xb%W?G{>M2Z}%-O*D4v`Mwf3NY$8R_>H|2quW}z;KKQKE@wsDnn<2L-t%gK{=RvG-n11 zos;qlLjt}t2oDOd@5W>^IAA1Z2DHCMmfq>KShzZ>Ukt+c!MvV;FvgM`Bi|qF_uV+?_i0A^em zljSn=IVIQEGsG<4&W2h1;@6iv=g89lu7F_*ZolENdN;Ovt#`jkj=e$a+xvm23p)OX zRH|vR1=7BV8+Gwj_VxNmJhm_wPO-UljpR0T92gyI3G9m95-WRRWnf?zq}t^Ru~!cW ziId;M9en=w>lhmF7!k#o{G6S)szw0lcxRJlFYkCjP}19fkp?EkJ>$Csji@0OF81V4 zl=M!V)is1Dp8DsawrO3RMCQyZs;*+PVWB@SqD|#ewNrVv59vtCAI+7FSp&bt?}puCoY^<&RXsJk{9Zcjrm+;@2r|TytwL%3)yONVJMSDXqyW#qj zl1Z+z7F{4K71{Hp{*|XZ+P8`gD{t27LnlT}gZGf1IA@kqF&c zxx|hAR~nO8;&@pJ1dwJ9?}S;$66PvuY2$k3T9(zp8U;$>)KaYJfU}WzG#J`7?O0vP z6|5@3x8KP0sYT`oG@af72LwR}rK=l(@sdoUxJwFge~+t{*CfS>*#8oh_n{g0M^?OZ zE!n404OV%n9UNrz4uov}aA$7d&8Tvs)stlLFF$)H^v_l_x$zhV&qbFEWL)_bU&#%w zW~7G*4v4!4*Ss7eMKZd<@H^0Kl?vs$ zdMsnrp)Z zrZ(#l$V+e&g>T1&huv6 zN?P>vL6(*Rx}5 z1K1qq6@I_IPseJ(-V8qDH#NsNuaM$rAa&II@WBLRQO(53mBf;>!+_C8j7^qY{S)Xh zWht=$zROVOBU*5=-Uyj5?i4G?Btgj}Dd#T9<5QB7Oven9Me%-XlkTI968nuUY1W%pby)PV$ceE z@72RKLYi+aly-{NDkoi0K@4lK?y=S@uN)<@19bhK8yu&QjgzWh)L^$p@U z>m!HzjU*g(tqh^5m`NKiL}i^IIfpw8e=}vJ9vIvc}W=`0+N{YZcxPv6Rvs0TgRb-&5pb=^8bw(b&3H9>oZr+3xwNXZxB~L zQYF%0AV+vQtj1_*D7A)JZbB~~lsnu!fS6M^$GxPkWgK^G5FH6rC?JT>9WAt$=;T<| zv?%AZ{3GERCRS%T0gGgrRtEl_76sEB6mhUGG}u|u#AffV7d5e4%#k$~VM;_YK@`0t zGh)KaUK5y|Qvu`AvNp75GT}6PV@U)W^-2jBy3>9&+9V=4FgisEPf7vYH<)tzMBxsO z;8j6CB%|U$&?xAEWC}YX~JvG!Q`=W(-q^Ihziyk#m3NIul24~I=^#<&Mij3-;K#~V$RN% zw?XtJ9w@m2>jH&JUVRIRnZ*;IY^Ka4MxuBlQ6Xv zP#eZi;4v7z`*itp zyR|F#Y3ZHtnCv#HbA8Hj;OvbB)!=(&tb_)6J;Vyc54^%c*gm!>`vtWcz5z;tsJ*-Dc6&NHay6b~80CzH}eX$ALmc z9qR{vC!%{iZ|DY-m4M3!I}}b+>-LBmXp)RToaqQhA17?rAQ=)DR^v58-W?{xqr@>j zcwM5LN~l%w{8sXW@@AJ=`z0TrLzzolUfgZ^A=ZFtR>2bAmtV*MOS&o!)kInbBiDq{ zH2XUTP=z>PcV4bir%QNu#oTBm`bwR zngwaD2hQ2(IPLTyHBKtQ;e!7LE|mB@!@LCd+nS(}(k4kXPX>y!T@-7*@5`tEOuIlJ ztRCVy(U`1p5h-j7qieN^-vf{z^8qxeZ78w#-$~_t zlw9m~g&dP^c8GTD^L^^1j8I<)nDDEC9f*IW0$Q`~w`MVd!)MT$m3A$>$L`H4Kr@^vyi`RI;F zb7*KhAzfjj0_+18q-^NVv@zNRb7$Zs z10O9z`lNfLT7?6}3$O}D1vT0XTx-=lU&{^CviG|vev-3cB;b7YYISFSm+g4?k7iOeZ_NbIK9|xZW&eqS(+B`!&#&(hZ@XMAX*cqn$~p zC*3jN6p;g5^x`JJ#kY}s3uDoL1igbcDb1Ov{JbSJj`7G%f;|&(oA_vQaX08K`c8A- zps#gt5ddX zG2)n$+}n&`MApe$7R{3So{-%fVZuMBe&`jnmIwH0=slg)lsJAOvB5C5)N}Z*hJL~vy5i=X_wY?lAY2&>E0pdaaFGb4z5wu!V)$eSAXMfm6pE-J~#CFP)-rjN(?Vc5bK&rWl$J`tKR20~nySG~0KMNNeY4J01=l^w@4E6A!oqi5Sn@yl^g! zg!)nQeBo@t+?O9jW?HQ$ySYbh33p;s3DIB~LX}?Z10^9|N6`5KLbRFOJBZ`P*1GPY z6VWKHAol!z)gMk(a+jHpOUiERa?z^JmPQkim)M? z@J^3N&E=+(Wv)0d(T2)`)-rCvgkyFJTUYGPaR-bG0YnlfPgPT=_fu;#l$xcuA0xj7 zxTQe8Q+KR_e81(f?Qf`Dr`-E4zD|8VJ4_APCGzo)!&X-jn35jY7LB1vCeuCVbb`F0 z80q^gm;Tp0M)9zz*oMR_K1p+!|FBtU`lHAUWauK}Q9Sz>rgh^Rubbu)6p!0Ojx{J7 znwH~oLm;O&+25!vhjKFyU(9r0b%X0WK&3|U@pkq~%GB!d!)+Pcwl**lb3V(X(jgS1 zz;Wi3b>I3o?oh>xF=X_D;{?1YFXAL}kb6bytw_<{Cz6lViQ&`*`JYS~2J;>GX#9{gB$UZBn0CS+vRvw4=}| zQhcmkqH26+|?PenjB ztBOa@;uc@et2xozlS*}8(t0Cr?;D|60MH}-g#UjM!T^G80~v6{ z7kTx@)+OVC{sfym>z}=XSRn!ld^F=6w6qN zuj0QOlhSvJOaV-{igep<>}<^zWChlpJzh3yoV5ayqthD1G4~gFC+DW;$EF((ve@%( z>Dj+0I%`}Grt4+`2mZL+-FpN(fghI!KhtNgQW&_pI9$;TpW2*l-5)%rrF4pn2I{|f zvR35Ca6lhu2Hp9oNTE!c&iIqh6`48C9l|TYrBt8`zaG z*G;XSlzJSgjP@>{46bH&iwxceRybsLh|~*t_GDepoD|EjS9rA7o0Dr8I4{Xd)ugXDF)`q_fTvgFjuP{B9e6=6Gp1L!;dr%%R( z8W(=gb@+t9q#F^icdAi(X66wIukFQbozZW-7T<^C^GyD&Mp%^la(cLm$};6<0xwb? zQ_N$-kNtWks6$s$a&q&>@=wjvz}_A!E9-HE%5CxM;`^@Nh~t(M*G5E)Yg5_KRR!?m z%gS9hhcf7Aa+-jR+u`YXi-P9o_N-?r#_4i@@;rt7p3LJ0+VSJZ+itMn{=Vk3ea(h2 zs|Gu18cpZ!sfpVcSo;D^q-Dq9;jb3TU(b=evsm4i#~vttxM{yjl`E~$2ikU1`#MJl zWt%P!W*XKzx00s}_V&Zyi8McYsj4jdqo6HqoiSB7DMcfU8ZB;B$sOJgl9Ij0avn{C z)+@`jw6x7A<5P&3*rxm*8eT(Dk(ok8tL{KwzOv&3PJQz_JXfbCdolhL40YjL-4I0ww*L#2MkMb)zS9p#Ut9mL6NpH;8@ zaNf+M5rM&%2@Y)K;M~@s-vzq~-}9HGI6Zo+uRlDE^Xj|ho?UQ}y*+TaOS>-_ywLXy zi#{c0CM`Z0;}#AiXeoe@^1q)8HPCSB7;)^dLmSoDhnjF@PB|F@u#-$qn8m_%e5O_V zL%VQR=?5RTp1;H>ll?+tpi8tZYMfE~p9xl`reEux6aQ9u!n{^BV9rv}R=KyNAY$MC z+gNnCbCg5&=pO6sw(#T1-cNZ^@9^)0i1$ttLfLEdAwi3ZPtdz}wOI;FC_;qW1~M`# zVx3S36Oa7Ix&{1~&ovbHW-8WAq1wxA&e*jhk|omM;a)=7IR6w8of587^`$N;E^a6IITI?Lr-w z4N7CF+7U5>4Ng0@ycVlSDamQBGekv^UZYxJfLr!P0xQWJd~jjA{SJYkh?4g7HQDmE z%=@%s53Kf@W8Ndo2~AL^ofd@6{rXIPLYEp!GcZ{Bk3eruV$zIoFKpH{@R(aGTm7?j zb3J?Z7y2@guj25p2Lgqku|*KCAO}!bC)Fv8w6aM(>HeqzL(lh7IL;*Q4V1OI1`ueT zF#v`Ut4imjG6ysqYzMx<|OHuk{L;uY-x1J>x=BLL<_>|`)y|AyFY2kYq^e^ z68p{Y0sVU)a>5kV1i>4ECcEt+wWdBj^Gh_X({|%NY`4ao-%+ILOu7??*K}6X$e^XS zOF3-(F2|cMa7cEiD^^w!0@e0Ec{ydijClQ<^$hJ`cv5NpLFuB$C9p;Y)q4FJZ)sDO zjYJp`50k!F%k2q!oDzv+J^$<4udeIegLSyFLO=mkEk{wIL-r)>fBJDSme-Qh*{J=~ zFm8d$Cm%z<@_Y0?a=PnadigKE-k+vQm-)ySW@h`+nKB0isQV8Mcd~1J`~iEfN%{ov(stJ$tuzg%H;~xoNwpbn zqzfZ*CsGBxuF4L|gnbaI?;_IPD;r^#{X|6bb-_ZDRSGG;b1|aFGu{f4N_k{H*>2kG zdSmZTiZGMa#oV$dH+wBIMo?dI0r#W2rC7#K3i;I6cLC?%Iw6A^T^QXai9(vJh(o=n zN3LqdHb4NK%U|$1J720s2$?(wbB!lcr6HG59iubEI&53n{66!;=>ns5Y8}dmbO@VR zVZUpdy=J%L>FM^g>N~H`gV%spsq~aKcD|UgQ9*O%lfkzB4V4nsTAj%F~x_B zf@h_aC*EtuH_IhFm=uJ(&8PL46#{Pfoj)GWfXSLgX_`p%g{d<~P2YmWsS=&O5lK)r z!?VyWPo3cMvX>DO@7dX3c_7Sf{&A;rprL~qJFO%F0*O`p%t7(xz%%Uz1KuR{TwCU3JiA_@7bB3Ds?+3w8lQB&&4O^xtF%z>rEOx1k(bIq5cfr3~kDiBAY;RPGsl`k3eG zIxVl$^o(s==u(qYL50qBg>4y-@di9?=NVlc8?npgLX9^Qs;>Fc3LT5B!sU3pze1d- z9q)TYM5)~ix4ca$gt^StF^8swt7x>be4(D$@)2_mFMEox^1u@K2xXz%WO$9s2=|6NyZ! z9~T0~Swpcl3-yDY8egtGF?mXGw$V4ZAi4iwh=+>@@eY5XMu6i5W$7-u5(wQkmlJQE z@c_vuzg4E*>#nnAtg(uf1AYqdPg*pnf&g&pqv0Bgw*TUg;ZO+B4L4wGnNj)?mc0 zp$SoP3e|B<1Jp1rM=}L=%w(^5?3N+YQaDyP#sOZI7?tty7D{t%<}vcPFD}mG@}w2} z7V7LuBO~gA_YkqFEQ8zQy@SVjF(R%lZYLal5(m>Z_){^QnDy4fP85$@)Dt%QmP>Sc z#@mJW?IpR>Q*+!yScd4+t%8Nl!YZB@-yEpNCa=e|Qg9!TG4)zD^3QBn?oS7~+I9DL z1RvVJTz)dmK6F782Do$wW7Roq9OOn@%~Uii3*UEvIrwC&Yid~JzxtjVXH-KQMO>qE zGhRWBD!#OGV1Em7fJhpv@Ryx_i_PJnYC0KC@pwR{MP^UQen55we7c~SCm{Wf#0|~& z%S;!hfZ`ZdcEv4CCW>~u!$z`dCH2|mPje22&@VL*yUC#xAvLu27LQ0cV37P;Q6BOKZ?uR;{#DKt?4}u1-WOj!x!Eiw+RzJr5Bq zHYX@ZLf#w=1=ACE!xb-vRIX}xyrtuETzgF)_m1R*r zn$Ht9b`;QeT%`TMrUXY0!YlsyQ%0U)K*5}H1;G8u7>*vGQ`$So%o!Oi#vJyc;v--? z7jLfO#mVbgTDdn`UCkMxP9fsD=*-6%Np0MrfSqPK`0*P`pf5FKrOC;Bra<0&qJdUE zh4GwHdy`SqlVjOAj-yUbo(tQOd2M!op{POiZejM@9Cd)l5zNI2!kw6aLf<8NxrV!k z4A_{of>mhR5&z2-;vvivr3lNeZ6I7=1RI8i4T4Yln(B#ab%Mvo5Lx8N5BDV47i`r^ z-`JPoASn^l-7@yzT5|jnv*nY@`?%48^2akjaO>H)JR+QT%XUhOU(<6$hNI`Y7RKdy z8O%wFa3L@CW&0jSQwUH!bbN`%rPY_o9c;%6p5>c@4X(kpp-GF`V^FT3m{c2>y{qXM9{@Z1Un z8@fcX46NuSF7hd8y@rs$a2o<0qPYT^p3@uhLTA5ex}J=rRM5|lV^y1;aoe5hiVV~8 zHNrzr(M(sp#VYqiz~b6+;^x?2SC1B(CUPJ7%C$anIPc<4$Zy9WoUkNgM|r|lln?J= zx$B?Te7Y~tn8z%!FTS0@0UkKWQbgB&mIFu9;O2V1r)>zug!@SKBOdYl$Qj|ZN;^yD z6@hmra;~a79U8%s8OegNLfju*Toc-Joe~wbhe!n`qbK&ygMv_w?B&p3lD9t35^@H1587!AmZckri3Wz zYRMaNqYM*^cAC-xn*~g_-9JVXyx@+VcOP#ak&4J2e{&d|`8bQ6oRX9dwGB_Y-Vq)C z3m83LCl-=6;7P7YIYp|Ey2x}DT_KI^c*COeO`J%(F?ix;y*Gkq`UczhSd!kMkSvAz zpyfy)-J{mBR$6q5mk<8q ztN+aD-XTM7?|^@%4(+LapZZqW`45)<_miaij{fZ8(CmwCgXbPGDVQ)(3NPdsxTf$U=zvLy9TBv8eHHZ5sT%PuX_x4+UlA9v)_xy;G%j zmcI|C?bt(*VPmwQ&*&nS1Gu)B2AKC%O~%Z*YYXyCgc1t0!NkH5Da>`W$YmbEh7)w~ zr{Q#7Jc+XgM7~!jy3_-$q%n6{_ZbZeUB{Y^IU_#YC|Hw!g4x^|LHt%LajH#SG=cHiIh)xm zp#Lm2HC4))lF;oK>~@}1p|DwHu+lE&+4(D1yz38a_#j#P{i}DIrvc76IX^#O6UNE) zXV5vS(RN`}!TgqfIwWjbo0z1id!s+w`Dxr?K}J8qRhG7v%6ARc|_oFwK&&uZZgc~y&X@?)y}DBF_!yvc&~sYBzE{7yFXyr-$(88fez}c zE%me<0re@2h8oMQ&F~hFNpe z^ynMJA*R3U$G@d}zDMU{GYpLDw_w8AN`*2*;?+?9WbcDc^a$&An1{-E`f@ zY%a~Qh9MU3m8IWqzp$dpCHngpHF8gf7e67+*VXUixq)Cp7HzXRtRXKx!fgvnrB6=n zY#Uo}!Q*)u1GvmDk1dDt->OA*Rx`~WX(A3i>*$8U%M}Ike04YN#*5a;)H(T^L8i5< zxSwrp3r{<}v)G`W#RBK?CX4kx>BHjM+Nu7nD@BQG;{P%3zA>fp%gkmVpOm@MZ*Azv z%6SS9_PfBm)mkzbhcmPIn3stZ>X9iilE5MRy^+-|LEL$>mz zolM*g4dZGqE|TA5vb=E!uz2m?Z7GW1l!ve&66KbqhoIt9d=;cfq?(v)yM-Opn-Q>0 zAtn{WKWW~gq#9VU{j(U7Ja4?USYxKJ1potU`#ivV>1 zaUURb5(eyNGLpg``}vr@P@Z?8RMoflS7{R{jxvd8x>Vxj5`23_Y)obdTei1iPe}nt zZ=b)zr$w@|giAXCY0UAbAG_Emc1#XusLb$-6~%O3ofS~0{|%@!*nKCO{HRbd`%8Y@ zkUwX~Ooh?>)=J*j#)FE$ZC9 zG|y0gb9@`S%{)HTNvTO$_*S>%ti}|Hjh9SJWX~8|=03<_V=<=_h2^f@c@J=mdu19O zY7$?7OiV-V-w`%sRE+1+n|d}d$fgbaWF-yx_`RCs(+@y4#I!~{gCg7Kv>@s^#Deb` zrBP-3T{Vd1D*pfD=_>=8`op#*q&sAEmo!RuBONN;AkqQ?Bad{;=mu#}N0-BiNSISAn139`^MxK!@Qd+J*#;V)GUDvjC*0wO+H>I8|LeeOfZapyqNsjfjX zfMvQ1oirj+U``Sh5n5PN`jw|X^s~#f*Rb?u9<+wn^ye^U#0;on#HCD`HT|V=?J!G7 zqzGurIF8|jkIWKot=>KooB!J zAT3!%*Y^a!SGi**0EX^kf%ZA`_;NxhAnWbjWHD&GBp;G~u6&J-$TqCe@j8=cw0Yfn zaQ|84WwZXr*L^=T{JsE_AP>dN zPh@IGwZ<6ArizlyVzl+Anpw3Zc}J38C9PIJ;9s)`$83ovPs3(QwqnA-oH_eccWCss z_{ug`Qj`1>fn$WY4~*yeK5+kKJpRr+j)>xC4g+3cz5_c0wR~OTegFIlsF_%qc>KH6efy*~l&#NwHaIku?DS^t z+C-m6NzTIJ_rA7ja-j2O>BCyERJw81XDQ5fFDdxen^-B4sv?*FPr5bZMxGma3^xf` zCLCg=>G%Mr+&#~|Z8~{OhTPDi^DKW>`6fGexV}v=09Do?oDV(&EPgybAGLXXHPK7i zX;_srf1%8~`+_%8B$9!&RQk1ESz&^T&UWR=!HL~XO={}$roo%*a+|oPR0-XwwiJnM z-{M~%WQtz@)k#r)i56)I>CIwH!({nJxPSL>9IYxT`vOzthce_L0spkkcTB=I_cWxT zqwPkdLEltbZ$?X50Wb&4^iopJ2O6FF$T*X6>TeweQ&Jpev#nG2&$9b`<*9A?G(*T4sC%=8j)^otr}k8Qgfa}>dJWqfMP?okzIvxy%C(KRh`nG zdD9djY$}kn{)B#QWFnXC3z=iXjnlmdM2jyMG2O%xHf4yAg2n8MK$E3N#^1o8N3SgU zdP3YjzK-M1=~OCel;u3bTlY4ox37;l1G8p@uvlev{*o7d6lK43oK(D(!eY#Hw_sX( zS!N+2dU)9YIM}^_lHhL3U_#-u_0F&8Nc~ z`1G~NIc>hxJDQT^EC!#Pe@g>G%6SjGblpjzkJdY5@FUIb zrq$Ai@4mEibQ=dx>Mz&hkIS10-Ehn3JE-{yWMVLV70<(lr@ZKr#1yo6B?-e~ZwT@O zg(zTw+Aj;xL%=oSfgwv9^{6}t_?Xads1wMl_wPMo^VO%lw063fuC!2)e+uV(jp1TV zzPT*Z1)ktPdpRvFV?WYP;amA%FRM$8XNU@b;uSg?xM7NW6CnDNjyr z@sC4`p}(}5VV@G>6a9v?X_Fqo92UO`!?85CU`Nf-WMEmDY{!6vin#B96p^5kPA|?2 zO)t+46@d+T_Leoc+@{@9!@*- zm|UU~Rjmv0hS5jxbEQ1s*s0UX=Ek<(%zhr| z_U~?rPWj@urCh9 z7iM>giSnX>?7qAN|37seodmYba!H$ z>zLg7yWXwJ=Om@)<8nTkXC&L!o*2O7TI7Xx1V`go=5tO1`US!9kg;0&Ba|0i%LRu_ zo?#rnbD%G}ee>nB^?*)XrKLtETel9`{abAlc_u1ID`;lWMj5_Wz|5^`M*eT`axwTO z!?nMihzcwi@ma?7o)XH!V85bejXz}B`3glFk+1#l##V&gRs{K2?kfqQ$^#$}POFuK zv>D@_)K7~uG6vrfiNm=)#|O;cI5!z+*k(?YN{a>NZ<0#^@Bbz9#OILay^^nRzt z&FA=;E*_+W)_TXOMdk2y&48^O2k{F?NfEs(=BVEj$VHyeoLf zRq=u42V+e!@hNdHo}+dn!VU14hU1zejehtQx8c#@Cdr==b z28XDD!GMp}&2cHrIK<>OkuUwzJu7wR!5n2g$NIUcgT%+bZ&+cj4$Y9^>wkUp9+wR-v0pV=pz|<>vBxkGRM^LpwQk`W?nnb$ z7ku%r`d>a}!)W|334L!V@ms`~hA21(ACKL6gbhB)b-p9+6T0dT^isW~&Kg*X8+|mSq0--*-Y243}0rqBwM#5v8Lf^sK9-x&Aw<1bee~ zt2?e?&qHR9n%zIOJ%*bI^R$lN`DfBjuk;1q(}&?eSdEs5L zHcB28#KR+(yJ*SbfkOZ-F#Tz%_R}(jf=SHPlZ?J@y9`u1S1SW`oi)sF>Y6T!j+A(l zMU{SzcFR>_{hP>Rw%3mDT?|qRn_uPO5m?G$2j{f!l9E9=ZA@cePEH>8DdaASPhCWw z2JD>>cwfC`kBC73sIBb`AhK(xc1CCjyNtVC$V|Zut#k*&hoB^Yw@@N4K)u6;^Y{85 zLezRh)^S_Z#)E?U@SZo<^74>#6YXM_kUX9jR1D({ch8aZZM|<~>|OvCf_rRG@!?Iw zqJ7>Sic!MNQ%EIzhEIrzv?4MtkCH_ z+sX&8dstlnqMlWX^9!vuwH)stcoD4Y=@6~%>~oBbmlcHGbX4!}^L#1jY#`~lltQ#O&kE~{gw^LI0k-pM)%9VMbO?DZ2+lzWTtktDDyMjct81yYOZS9k&m1d8_Z3(lZ zcnpXR$%V`U$hqPyOrLRVmqSlfrq6xQP-8}JBQlh|raiZQ!b&mLlNtZ?(U1MNBX{Uz zR3H$HdpZ|_$M9T6@`=PL22Z!p5s&8WoDFml&-;h^^|9Dm%M?Bh|J?OpL5Pl8$P0%& zZ4Ka>_SpqL66y~1v66)#3a;dhV@(ciw<-pke=*Pjr-5Pfg*H~0)&cT`)FBi6iT6m42Q0C4n5>0qba75}AQ>P+2lIv$h1*zR|V#uw16 z1k~}|77%bWDKU-*K#XSAHUt>?EfVfIn24)3S`N(WP*g+|e}&iW(>;Y=_kg;64rfh) z9#SV9-ST&)MLxWeyjzaCIf!rUrb$bPog~xZG|LZBaVqvo?Jne#m5z$czjfgUvSL17 zq7|0L^>a8~KVtLTNn-uFA}_%42<>Ggru-lSJ+F}~{T%#!*75AiT3N@OqbAtj;&o!& zgAI2$*8OII&~|I{#0V4Q;!BNF1R%tbq=#$tRBsgA6r=RjvO2+l66%@PLFUj>i>QZ6 zjjI_;V!3ah`Bk?n&%)!)>cu!TWg=9(c-FsKDrVGWk-PGED+NCENZ@Lhm8o{u~IKeVd9;A_>NW#7Qt5rfHwnn8Hq4l zGzz_EFx@h<+sAlFU;0W+`IFSQ^zrfTbSSZ-2lvm~01b-0=PB{pH+te8jJa`5Kj)N~ zt-eXpg?b&POpJ6`lpE`ncsF5CY&=;Hr+g-vss=_8D{>e=rW0V>5xU8b;Y0aLyieXu zOX?t${`<(DXHKd zfnW0}?K)l1>1Rrj+L`j}ohm{KO45W}*P+M91qYYgjO*+S-Ffs4mVqXV9>vtD-#^+y zf^THjkrg>L*L{Hivk!0j2>++!!7!e}AbCWm)>DyKawrNv$g}f7RFg1n zy#I+#W#@aD+A@+$Rq}_T3wL_v8grvas$uTrIbl0PfO z$YCwn3l-5`OjyoDhns@Xn*RFX@@#gZ1u@a@ z@ssJ2e811MSdq~AH5JzVy1yqpl>)#H24gv(e+fzfg!yV>fe1WCB=kJWwbFPq%;UO$ z+aX@yQ)FkOo(HRFh@f>7id!{4%2Rk#7zWurZ!YF@c$VuJ&M}4t@KQ+`cazE+jQ04R zi}uIU+%4oc^iv>+^fXJtNcEL7aplu!L-tM$x4l)q8}DUxt*}3`9Nh&~EEUX_)y-S7p)Bloa8aPc-wu0}ZiaI}Vk zXMbt(R4J8B`WXBanibv?8wRQ_y$*&n?k??OkU%SGJ#!>U*H-U{+_9fh;0F2d@Y(D; ztYP1un$z!0t*zY~L}1gwge%tK{dE%VFK6$#UdZuU(W2iI`&Z}ZFD>HDv*jw?PkgMK zAb>Un@PPC{CZ#?7gp7WYY*UXxeVOOqaKtl`#OIUZN<4XY()!q=;Rw3W-l%^3zXEz+CPO|w0vLBUX63O>sQ8%xA(C5PQm`~ z!@c&){;!F-9J)F~O*JfMrAaar`5j3!JQpaj8v$BTLRjW5>@Ua;3Cd){Emifo&_e>< z_A%HRAYLS|Z#YSqX&k0y@M$YFbB0DG3U}Mzh7jYU@9Se!SZA{hO7d*w<&+2Syg3vY z$mLaY?))Mn362upOA9e@U*pQl+G@9+VjtWT^9VevNulvR3y_s1;_=m?t#s9*iAMn! z-Kt5j=Zb3$!iMMpYvrM>C%@E>bjVhywwEhwscm$~%D`v?>waejzi_G20=$)x<3>wx z)t{>pinmM0b-8>=achpVZtkYBRm8)(OLwz{PXD8|u)NUmo_+rUe@o>czCSR;)a;72 z`rUTEX<^aoI6ixDJJP=Ty>Cq(l~vC9jYU`j;7_041~8U0;``|i{14MU!B@{vnx(Vwy!fpZ zvl0oZ-t$z`oz|H?-dcf}V9-U?)h4|5e);qzr4FdMJOyl5c`=Q@6lL`;t3Um*{dSHK zkXr5&fT7yLEW{xuk|)DR!*X?eHg4Guu%Uc^5p<0hxfFdZ7O-|z@8_gz`~w9*?Owu3 z=}9>4BAz3;PZOGpzytm}B=N#uXx7UreVV81pdE1eu=uOXMXo5H=8kKhxqznwdlp8x z^+Z(RF0v&d#UYBUbb*(YDEeS4~a@Br5cLxS!zvm_Ac))@8kY-q|ji&CJ!DGCPoH%l(>~s029NZ0EXg zjXl0i)!ivNfZ0@kn ziQAU58AH>C3n`-wUn{)>%&vTWQ_eqJ-1FZ6CO6+MQrS72a;wPQTr!ke(f@Z!qecpR z`=^|-pMoDP^|ul7D=Z-<1jOUg|0zx-nHPx^>njs#P^(wr43MoVmpPe-N#s8@BxCvQmN z{v>5vE|jur6y6k_F6El;y2HKO5p854M&VP4WcRtvy=8`8D?0GM_dBpNHdGpN!!fsV zg^TOCh2YZIev(@ z5MJ384zolY?ECifoQh$O@5!FkXdvlOXx1!O({rm%hN+VF$bl;!d)d0*y~>#O*{NNzN-3_G7d{wf*SIPSiocB zfgiMae;>)D#nUxiIG4uGXGNFXTXS1&b?TCB)RN zQ*mjW$t04?!_mgW6@7DmZ!JzsRJv+ez#JiBcPvRYKFe(C}r^=EzCM=fRQ#GFwJ%2X2QyLg*uD&cD=BQtbi za^bh(`~NEBe}!Qw4FlD?Bj^|~<$8HsA+-8Ok=^lT)vF4Z;_X@1hJTr*HZ8*C!?~&h z&XQ3naog!HsAZkk#BacAi80UB|4KNXjnlCOhF)geZpLZRI*aWO;`g54dPmHx8hJeTd+KBP?X>6V{H8qMy--&s7_g*I zj;WG0?6lh6GgE0|Yr~Kvq?!8(VG-YOMJc!tr72a*SD-jw(J<;#{V4f?G~KB0*vP=Rb#5|Grpi2e~ku>x(V)c{9X9i1Iy446O?yaq<>f zCZDSR-$X&5W6@;gM^oF;oZs4vigUy1Z_3S{;eT9CC4JZbraA#n_qc)q-NGCs?49O( zwxbf=J_pS2koAuj5q^AJX6vvE>buUcfS?J~M|?eMZI=NNC_=$hU8Y-Nc)HRyD$`Xf zl*)P6>v_DyjN?qYv)Oh;A_m+3U}9qBFjIcjJe^fa$RhVX)u`Myj^>Z^lh1!RZFc-T#nc^rb2#l!ZgV?SnYK9=57HoH6l3HuRhj}R zpaSCp8lmO4&_h*|#y_TW3@HA%P2>&3=o}yYb`&dNFgIGI%bqv&L~Nd7ju$@IIm}dkXs#4Q&=3w03DnV60v#%kuf|iQ9=`-yNm^Qmwq0Gf%v8D1 zUX`FPcY0K;#q)Ui;r+kO#ebcO14eKkEFp z^YAg7wcY8d@O_DgFjo;}Lfr?T@TX?(iUy5m^b5qzo#b2j_22)gro9<$ho}8E;h_4R ze0xU>_VQ60hP#|xTas_R1vh;TmqiRL?y)6#6)&C*Lkb!g7MA5SU-K{E>X)s=;2JA% z#u(3w;RBVp{H0g*$2Q=OLxIYAd2Iqgkvt`i9gKs^xF7)w&I7Efj=)OmO}Rd5f%387 zY1>Wq5P=Ch^tSCEFu(gTPu6J>J1e>o_H``R--xbIE2ei!1^+d3RCd+lP5aed@Y zz?=`_ocTBFy{Lue^yGULjmX2Cw~7lGy5DOa;@U)GN`;S?HQrK17D~YnX2*PJsW>;5 z+RD}ZVQE`GuiP`OFZXAws+Kt!mW)Eu_!C?${+xCqrPj6r`Ac|1-!9j?L;u)Ze55sk zZ19tpfUNG&{V@u915v`4q(i)(3-34JPY*Up8Rj=j?hRHQ?z7IcE+CRHeA-VaA=h0$LMy8)u7XCe}} z!&gkreWUdsG6bbe0;E0#sO`>f!7sF_-_dH`TZjUc{c*~L%&IAk>&Pf5Pf;Qf4*P-P zv=M$Cw=fR-RW3n`C1IDi0RM;LcaIXuneZ-K>vigKK2QGV%fnSY_c=jYl$hi?o?^w= zI^&Z9=Y6W-ySKQZ-fhXyA~lUTc2-&7h;+** z8FT^y@cG>}FUZ`!a7i@gkYum*3bgCK>PX&y8n~q)BFoABf(Z%HYNJDU*C6X2ER-RaUva*-xU=S9H(G_M?Y^U&NDE30;|XSOk|K9zD9;X_pl7eaLciv!VC9hWS$)Ejr_lUnvBf z-~1xCq|Q2@1aDS+%T-H8R{&GC7=n-DN#;wMPBL4vX6y4m{LYsu6ZPnhsy_yWlEtCSY5@=7CqU*ifE9P^`ugxO7wa6^jD$C6L^QZyCiG91u7R zPDZRow{2*xH3#Qp{R19aR^J_t%(uDk&P5QChOv6zR_8HTwPYPxiZ@>UF<5EfGX{$d z$l+Qr!h+zMQgUeBd-ObznLIf(U#Y$+BOOCa#8F$gJiUdBZhL@)CZw5ZfAcf@%y4R! zJ+4MG>P#(1d_Le7=s6X8hhW+#CW4b(t65+ch@zOSmLuu`UHrDq34+o!gT6()H*Y1J z(exSgLs%=3a=n?|D*=gqW?k4Vjo?5F3JS75D4)DtskSJ{7I&R|5Dde(=Y7Jg;j{1wi`)6t8hd*6`SWFyY{qtb``Aa zRE5Q0v;B3o$g>`(;b6L;4b}# zlPOIEB?Mr!egRfcto1nHv1&Ep)v{DGm$Y;)BmN|>v;;gGd+)h?Y?FlDStY=jbh%BaVvSPNk^L6y_)GU zEFiMsJNCQA&fk|jFLj$f+O*ZVIC8i%zWOhm$XrA z&hrO_$S-Xwl_yQSmdnJoUKOFL#G5pJ`7O)2`g;n7VQY;_heKX96AsV@q_KTsFlSo^ z_mXiL9<5NdT0?SZ2RHx7p`LlO-w+6Nm(okH`9M@is9Mt?XtE9+97GEJ{C$Gti~;A- zX7gcJlnQ4GY{~HblAQPY51juB#*^PBIVAB|_sB&xv}BSPjRqpoH-JUXDr;xbY*3fn zF5R}Rzii=6IOc- z(E;vco@I?&K)(my;DuHHYgFH>3;~8x zD<)erJrLjc^mJBD+}8Q8gw$FDZjCF+Hpw;yk~B^3OXT$yALW$jjE*@+(m~!=oTwlS z>;=_0-nsc|#^Zup&ts-&wIB_rkd1cl#F9Yq;S7PP0H*YT&27B^9+z{%Dk-<8E&KpS zuO-)(1Fb{A)K#|SwEd9#Mp!P39=RWO@8BZ5@3V2<=huX~OaBgd@OoaO|I1nQtyB7% zg5pp@?V)KmfHl8{;^T(JEGQ`957m(`HG!-qtxSAL8%U20ZXTJSZX&#=TYo@%nOBNtPjz=hZxg2B$&2|P@U{A{^Zci)4R%Yx_=m+^g|#@M@;}Wn^88vaKmk!9 z5_!i!O!&EB&Tso|dm*|SwGb4|^ZhB?WS{_{;O@&%#vUw3Y$+b}!>a8rJ`vVYb5rhz zl~Q%L8t`|zVc_V8Omvj=<1;AH8A~Wk(#gf}?O=$Xa^`+Z8_SVcWDK!p74;&>JG*(l z)f7}fg?vt`$5H}zm+v%0qdlZdPZ$}DLCye8z%4zw*xT^I{uCl^-ut7eu_N*kT~Ov3 zn$@>Q_)Yua?L@~7$LsL(Wlgk^5}R+G;Ip8Gq*C;qo<(avOL#_=Pc?V8WcOpwQo4^D zVH(>H-<>5ZD*-$+Fr1lIX!rHxC6YI9{?nsb&bbZB(wN^pt^zOb&D1U|&ii83y(jfR z7?~RQzIl1xN83Ue=rBx)Fl@~SRYwTk6-YfsHlU!T2LI%_I$$X1FIc@#iHj6k4Oj$f z_bx!(9XHD*60l7Lh0o>5gm{~@n|PZG*VaZjjCTCVBFBV5o(N>>0r0`wuV*7Cm4@>(=&~xS!8REdM=bp0A^XBUHg&i)V z<-?%-U@}~MTKPb&kFfh9*>5-f1y}pKxh<>|%&^tR!;UZA(OzdL+CAlafojPlXJ8_~8G zx$ylCQ41wZ_>K_mpLwq(dgg1f>%D^2uX3GLz!PPK(aPbVWR9|U=<_`f+}5l?-2i+Z z!J^;p7wUgGL3HD3@z%nG_oa;1tjf7D0+I2ZruzU97H?#0EqAarK%voWb;;#4IWW~q zGM~vN-of<&spSCgY10G_UuiyHFP_dV>!i>l^R!>qPzuvYa#n#aDjJp@27TOS-f7NI zxV3&GC~sKx)`Nz(t>m=4=8%YbVUWrZLSb{m&3;<9Zkt;L^9(&JfAp(Yb}`eN=A&Bk zM>*YxVab8ceAYe8*iH`vOdj?%f!9`@j(yK^R}wKOpkx5UAPgf$?^*HW>&Q8xu{?`- zi6eS5nr(G6a4T0dkKtB!_JVj2*ppFsH{90ufO;4uqJOAP`xikm-ZXy>Y#Iz7|5|NP z6}pn^&mC&I<-O>+cyaT*w~0X%WhrGOkI6XH>U}z|wjOquzJUv+cYx1gEVX(S+@aH`IF(y0B>s(D0?BnKFS%kO7>oJ&Ae6_D|fby_B z-YJO|$}d};(mr%-;yAt*7)8WhKlU-;L>n7qhiB(UP@!X@d(1zs0Rcl9A6`n|9@dw? zaN*MCufyF;!bn0O#Sg;kG_*<#4)S@`Gc-Mf$AGLUM0ksfV=646nXGD;pZwL{B4~v7 z6#*gY%H@#Ha);wQ7OfdbQ8Mun0$dj<4-lb=w~om_Y0+$^d*gI}XgY+z2EhGNXe0as z@|&AaPLRHIzTvBe)tp_Zbicl!k$DxnPT;lo-FEqw?!6(0PSY`+gYzP9USw;pdNWOy+ut zyf=(sXLwg|8B|>Nw^m}$<^!0UE$w-uratGSaYPxy+ByF9%ooIHiBj-=S`n7v4`b2& z2-W#`+qk?{l3voo6T!Y295#!!nYz9KJgi>X5XbaAMRhlNjZ!_V!k0U)R_SmYJ7(dy zzSh>gT0_QRdNfvO9hCC3oCvVTQ}5)r)ZM0(j#=wKz(wY+cvR>fhWOG^@Y$SIT=UI? z*`=75v^%Q%+Y9%n8w%^Q@`*X0zq`EGwsbxSG>5vk$Eaw~29qev0_O|JHJ%(`yxMw~ zcof;!QL#-gx2&JK5z-aI7k+-Y`dsz=@c~EeO7;1w<7o-tc}8$b4}A5j9fLnpE<~DGD}1BNbD4P(Zi4eg#MSIi-B6{fmqZu=wh#v(@oY1M(CmzR=AQOL;wz*AtlLAjYgizOy83x zRqvrquI-9?6q_6^gOk6)fvM#9bEe)mXG=G!@%j1r-2+&e3Cvsa^c{o5HQ)L1?FkeH z>FZ!g2jBB0k4S|4Etso?Q*-KX`c;GELPaL5QjZaG=oY<+BL#8nr zCW;;c`79qBviNV8iEN5oPC8$a(40_WV!Tl|ShRCkq^!G=gyZ79g zPMArKu5d5nUeXt(8Z|H=PRV~FUx9{Z_4IcDEGNKKPMD`~U-RRpS3*A(8g1*;un6F_ z>R+-Ml^5=+k_*LdS3;}nQNnAX4;MKvhcaF;9OFqYZeg-^Z$gx-iit9X16q}Ehk<7a za$c`SC2|zT3pT58J~{ZsP6tobiD)XuFpVGGdBpC}{NtN2yn718MuDihz&hGwi--}l z^hBM4mp6POzJt3IG2%`z#2tI9~iMqeU{MwQ3muV#YeBpsbSW zhx}|yiNFWQd4E0t;x?$6P9`V8Cm9c7fyI;%6a^7<8Pz`sVqxU8GLeig4aIhMMSmU0 z*s<6fGBF%wO~kLUoI&Ry`^_~Ng(1=wPwvGKo4zUzjVa|n zOu4@#*|vI*Rt)#2Wwh0jq?6Jis8E9L!t-I5<#u3XHbu6PuFJy%lkn0l^V_$^Z=@h* z^e}dEkwP`Oj6RI9s3ocH)MUH-ujJ>JpLgjjk7g}>3>U2tnY=`%Z_w~U7gCqrSo~u zCQQLhtiOQl1T}LsGzj^Z5`1$u#+aNZT;QG^wavn;<{4QLFGdMnJ}7zNq)923rTeU$0>050ued-nRvh zkOP4^xX62~Kh0}R8s;`oXpU(@@t0Ovu(ytj1R z1t1`_(oy=%xnct|?67F#Fe(3V z%$Wa;2;|*c? z(}aGPdof;R>VGBR{f%sJQK#T-u9%&)H>#3gD&rO8_=XgGHBQhNCkdb1ZZlaaCV%66eXVH68j|FXt8dSXu*0}v zAT(7m+WZ|RF75o&{aNSpUA4Mi0J2V z@n^?N)Vv;EU0trpqB@Z1o-P5GGE&}o-OE9@vVJ0Mh6iiNk5NagdQ*_}dwnxWtqH7L zKUm}!UrihPU>R>C`k!??ErnHN@0bfg-TNU;b<;hy2Dy0NpElnNLZ@)L^c#WCRi~x+ zn15?El8{yuTI0Yvn3$~Ae)Bb?8m5XdR2J?b)V`|Kb`+|DroP7>LUqF*dpj*dy{351 z2_~O0n^^BHml}U-$eI$11QG5+@+}F-asO}w`!%>C| zcxT36CCM=16uN-#w9IPwZ3Y4BQ(p*iKl)94*l+Z}pd)Ez{f^Pb-WPI<0X2^4iCj>S zb=INzP@36K2YDvxcDlx4Ik4tHc(ZKpX|`|Nf&Ny_q>`OxjP~WbdpBDJJZYj;Z`&N- zDe^a*ebU7qhoZh6%t0^4UJns{?g-zC{N#)zX9_tIaG1GsdwH$dS)dB!T1vo)272eZ z4x{4D;l8wB>j)*z2ps1bP?$0?X0^++WL&GoyO-ABASizrcfJCz&yvSY_IK*dOt*P* zS`-@8wAlU#&W#sFgMGoOl>D#y<04-9U-sc`oZIA}D8a<&$`KZ=75(Ws8NQzu9OHHI zSfe4cpU}Pe1Jbd}#3+GwKC?=~Kk^*7M0S0hP~(3e(1`E^zoNL~G#`z1)?j~mJ9q0; z->jHp01SD{U~(-G$1l97=p*cHg*KOUcJQKM2&iFO{hRL*@t(GK#J}FZ+)>9 zqnQtzA1wVvRWa$138-?yANLC4=I}e7C0I{S*mWfd=*5M>(OMf_v7-JgZlfYIYpcv- zIHpEP{Rq&cPcHmjINu8w`Zzf`OlvES!EV*NLh;E&7L6~kK-TkRuR7YmNdo66WHrD5 zOkl7XvmRPMu@xEgJpp%K(lsCIHO_KL8%GubX*JMQYfIsIp5~+B%U>cjZ8Z!Dho5+j zwHzf0_)LFhwQ{6UTw$wyP*9^&1HX%BHgUnkT%SMc4=o|868t~3ePvjbUE8&Q0@8?t zG(&eur*sHNcS%Wi$Eb8SNDN4cNOyyTFyzpkGIR_ubbjOg+)upE`~LlY%`r1qpL_3X zpKG6MEsP8I&U?^(=i_E2$YH6_y-f4h#wdf`@!@(KBFG;SDn0hxH|RQ5cX!ox(t7?;SqkRZ$Z04Ct8w(Pv;%P3VchyU6}R zsM^^>q)`H4jCBHjnu?@CKy33u`muW-xiW1|!0+d)F7Y2yd-iH$s3?umN__P8=ZC@> z@LMb(uU&uLC`H zGGC@w@}#sOKz57a?hoAsk9sxSfj3&P{V6nDPG#{O5frp@?_iu72=UCB|CYcp9h3@} z%XjPEe;sEa+Ir8BiX6pH3^seVywrEAdyP!S-G+4aE#TNpr zG%wNH1LwAK;8)Mp$*F$s8H5T*KH5VJ8WvvVcOZ<=dcD|qSNDMU6Zek$tE;)8&)2tT znUy5DBa2uYjLNL4xh&c*<*Fgkb+@P^#*){u_nTfhc6 zEdwf7+UxehprD<1sS>;o6|FY@S&ozB!!=Y`0l|FfFg0Wv6oe^CI>9^SH^5kgHQKgR z{#UtZu*KCYevhJA1iZi8aQ#wA|$9B6iB%LE?R(b`lmgd7LlU<9IV@T$KBA8wS-e>saI{CByhJ=Uj~h%Zyg ztnO0^yWf-KvFLfx=wtYXOt-s)Aq4;pCWZT=x)YSZW;BegH_R<}bC+rPlSZG0Ah=94 z;Y=lro9vR;M}Txxb!1IUmDA)nH^pdjS=rEZOLb%#y7!y1lp(CY@t+dl3?dm?Zc~nG zGLCwuW>fyi9BP_vmg~*%7fCNsN2VhU1~cE&nno629nq?-fU@}#{lR?aa@P5zr|H}3 z$nwa0GU;3z$WlPNaur70e2#=r;Wb~8{35!LJx!daLc9J8FO^Rzgp$CswKf@KrcG3$ zzC{)FuE>Doym5IY9pW&FHd#d5GBO0<-154?Z*t>G|A?!1nu6JjMlwb;rw*5ndB|}MCk=5j_|u5FI`3}S+SQ{uruf> z2GM2(C;Xe@-Hj#{UyDN0EsdmwXdE-0{WxLlsku3j&c6HI==~C`Hn@_N+9qvz$oMr> z{Aiuj*Ddy}O;DqGLR2Un3}TAO-d+KoiC4IDJa(KJWHKrNFwzMo>qOIcyZtpC2z&|j z$>mcMw+2Kw2cfA!+hV3^bw?!!M$&R7y$v{N4^7st@&Rpd)iDM7z{<64$Zyy>=WvPx(-|**Nt8&Dv6ImFm@a z%h@zD6=a)Z6x;^D{KD7YX9Ya5|KUWy56z-18Ez}~`F84FK`)e&yn3`@a9Vho#OW*8 z*Fv0>{`-rG^3W#eHUXg+EhVqy*DObA+W{SjhUIvhENE>NK5XBb`{lGv1m8~T!bRbo z$;6w5HH_yfHx_=tpd99k>rUKd#@{aoJ-pEVkkq%qi+$u# zV|LPmn3YjN1*n|MsUv4UYao)lrM8@D*vO%6D%y9NT&N$gPVr)5qU(C5Lfu*!ZQHOF z_TIB~j&G1=H9B?vj&#*hR<{d;HtCF9+op)g07zCBN(8r*9H(prCOAQGSWqiExO zQ{k>+!J{yT!^X@Yz{ z|BQSSh)4m-I&3qbAfVCPzB`Z1XPkEnXXWLB8XP1IA@YWBg=ZhI8_$GcDYI=A0nS0N z%`}jy+{1RmR`P0m=8$*uMq7P@J%=*f?R0bWap|t(&OX2?j$%7=by9=$M%8dZ%yje) zl0qO)@XuPaF?_ra`i6VxN#QXFb^{USPwdZ#87x_0UP0zR*bc;h*ba?{Qm6l5J3Rfv zc2JO(=lhH8KrYOI%zk(>;cD;xi_S)O{oAsGc3K& zBvT*cw<5&eBbLMnmXAtTfv2AbYzxA8q(8H~x3|aXBYr^d6hHLmQaKMJp2Xj=jnNji zdL6!BR#q;rO6`|zv`Czl(LoF=<5;4a4erIN4}+V2#sE(voa9deFDb4J@bDsS6nQNl zPa^5k&22{O(}*TJYu1-C{|u4IwIA?uP)xm(Tveaxo=9fR&y9+<^Me1}?^xzBcgBZyD?v zRdZ^1Z7vNes>cO#Zfneb1^&4ab_yz_i`T4Uv|Fk<;*P&$WhwHdW(9n82|PGB8c?RE zy{di;s)B^;!K*}udcM0`FCn~-~dD*pvcB<6Ja!I{2?r8faN;=|L^@AaqiH=6g5kN zR97Sd;CZwpM{&#UCT!N3&-r_%6_0gW%xpanaXA-@OmtZP0-FDs)s==xO3m^1Um9B9 z@(gJ?@|ISnzD~Fn6lO!7e_y-OQ(heqw&{n>Jw#*#*M5E)G$NpmPV!HB_rDINi;d)Z z_V&Ay=93>D&2Cq6lc_$8l{^9?4NabFUHUp75+SY|-VRCIvi(cwy&Eb2#NYHR zT_i+L*F`#G;`v9o$Puf4rZ@(P{C~azn=sIO!#w}``>$Gve}ZiY37;KwXq~HJfl0Gm z`&rI_C0o{rUYNX#@%o^;NigNC&gvPs;qzx?)+x+a!o#1+b}{p`i`^?PemuRt%{;=X ztIBGj6*$zVHsuX0GszmPZeGF;LIkEuL{dxQ-)H*Aw71FVDK(_N-qY*g%2mX~*aG|f zTt~~uA<*x#=4iRq*!2ZAL@WUMrQE1q?rFyggBrPWFe*;d?@bd9)$(t|LL(k~mh&}~ zX}b$5mVEZjwZ-KpbLK-J;najH9cQPFXE98&zXlEGr>8y3Y$la2esgP~ScC2vFi(T-8yu(D{(W_Sh2ewuQ_@Y_N`!%pPKAk$a(bZM?FFn+IPubH zS?Tbh*?aM@apkv(i#J`VhtS3{8O&sp!It{*T7Iv5JK%xuvat2?svBPTCM?#l!2lG4 z-V=sXjf8Sz7_LW9c4G4>&`8$^^~J)xy~bN>1An|+Y8pXsC! zL^IMDwZc_gLhM!1_I0**p+0{5r`f}YVyr6U3WPJHcVK|hQva+)LUx5;(x)Jd89{KXU zWAoC~{zmzDp8eIv$_nCz=lE5%HulTXCdNJ6wKIk*Hywd~(Z|Gt=TfM1e|jF zZQ$t90BoW@8k8h(^RtUZ1i{}p-WvZ3FFL>8g(pUUsska~UTybQ(4=$R}fj;k)Ds~foKhH z>|efuFsHOhuG~66f~-L;nY%e*J-2M$z?&3897?Nalaw#kQxyw3bZj@<#a)+pK+0^& z;hpjyY_wW}O;{%x{T-vwzN;Um6E`PuH z*A}GKLKH3$axaJA@dAGH1C@)PftPxn9f7_0vTx6w_b(_^54;bS9I<1uXSAXI2=bRh zcT<+b^xk=c-yu*~#P>9%`^Y|U`36xA+Uk5{JXp}kZc;OxR;g#pD0}C3d0^W(+BSa^ zbp@;m2t|m@&SRsXpq|x=z`oGCt!^$Le`BABD6;mysQw(a3;1SS_OP*C=5(Ef@mzx8 z;zuBgWffDVOE_UnuEmTt&AHNKlVd2KPDQQ5ua`qCF-yRx7K5WX%2LBC)**^{dszVq zhxu{uFP=oc#IKx|+U7_v9mbjs*?BGV306M?%;`TbGr@w^p|@;?LAA+SOY2IdrZ=Cb z%MI;>UdfpuR7hX2X7kKq^f9SnAw!#kK7lXs2RzfQP~+Y6SDXAn)13bEq!$kL-On2h z$Jtl;_h*2*yEukDHN@rStNg6l9+g)8yOc5bHfnl3QL|-1)BZZtm454W&Y7v_sjgq= z+>#p2myw5X$Zek`Q@v*0-IYUqI%sM2mPB*`V^AAt$&&QO0){&Mn6A@k1tODNK)ydu zU;y8qk4346|99BzrPiP&lfaJAc6F204!{x~qO53>V!8{}i@u1S-~3LGOvEeZ5J9_| zDO)x(Y&@*$X!l=4;O++zGe2<2=T>hn_bm_w?R5yZ0)6did=Zzmgz)uTarc?N-4%1` z@Rs!Z+SF2q^UQO84a$cXuaNm2SL_TMoYMO{rA9B})*K=BB%uj5i1baMXWyul?+C2{ z92}_klTQ}s!|IcLBfAWwg6y`%M5V-SKUNaHNuC}CgN+Kl!MDBnewHq&&^TU&6;#`~ZufMMBC zt^^jzXF&#N0(y{ubjG>mZsk@jDf&9AyeM*p8)5NupDjuF73I+J?eLF3+u~-OQ`$9; zD3`l#+sVGrGFYE8EH}FmVE6W@1YgT7i%ejgFRNn;3?EGg_Tj&Ik-go8sbi$gJ*3a}!wlPz?kWbu1?2 zDNjA7s3Z*0M$WVh55P#qRQN6mWq7|@b&6eTeB)nfT8#EE#UqAluvG{4Q5C6V&8AFp z_U!)pW5P{Zwt}$c$b741#YYMCQ|+|QJN6pZ8l%n!6xY`IL;ZBMrH!>P;0 zLaxUI=3#Gn`FsiJnz~&sU1>U!E}ac?r=;OJF{#bDA5qouAL1(uG^9MUA+$EN`c*4) zu$kvP*YtBw++P_V-CI8o3wcJbSmiEG|EN&vfz>I^D0ZgmjD9*1`#>0Ib_)!pB!k|w zek5*0{jX_{04cJua?1yI;qq`I=Y>YtNB`mHR^dN4VohnCZ*CE*o6X`I`)m92yGHU# zwb|5BUr#?YvdIu~U;-Th)lkd<=VRT1LB%7e_)N>?{^YEj4pw7QQiUr2$%R1F7#}^n zreYo_0cQDaS1cogwn7IG?W<{R)Kj%zpgD1vLXE>wD40otGl_N-rw&cCo(0Bl;yBci zoA@Md=Vwt>$0#^$RJQ{<0TVWA^wXFADKmiQNmPp{IpBlYL>ACTPs+ihZ69*JywbPk~ z-CSF&ovmnvk>O@eZ2Rcu+D*m5W2e!|tG+2Iqt(&;UdkP$&8=_YizeiDxeyh%^_|`I zN4&x7%nJka-hRr0HreSSC&g#%f=Ed|Yi1Ccz5D6}=;>K&qB*SnKK%xekN?$R6m zg4q{*GG-&&tKlqGxNM4W0pT3;=5JtSX0JC+Z9ObdOWPlJzArB;%SyE)z8y8dG|`z^ z4#OsUFT3!rTsPMw$W+JjvPtyf_JX1=YQ0Akd+OLgoHX8E#b?uwmApbePsMjkY)iF` zkYmNiEXx8aqtgrIN6RDh9idot)^P{FUH{!|Y%lhb66UD`1&zV8yEoih1@u(c4}B^< z3!KT*ONpxqn>omNhe#XBQv^(UJ1$bJ>~NxeoL|1>iD7!V{Jak6K3GwUv7tNvioZY_ zM|9JGGk2G(bxeDG1!a@#N-S)#7$GP|O+%Jeg zV(0zXwn{Dkce?#wk6+TC`e(&yGGmPQM8{5nn#1xMDE3SF;8n_Rj2Li|z6) zzoT8hwWsF-eut#Ve3@v`Ge5$btmYM(vu6nQtsd0m3g1F5@{Fq1YDl6{mWutP{;Y8% zbKMH0b#>pTlI6G<2b$4`$aiiu7&;{79IkYlnl2U{-wiJNmwmG?OWl11KRS1ek1~lA zg*uMfUQ6B&UM^`GyTE}KX&DdfLsAp64*L>*GXui=QzMb(6ZW*tVc5!bRwj86~V_; z2g18N02|&>+9$9LnQ$$Z2Fz8(p~Q==c;P!+QlI9nGv!@ImjS=8qB|N0=w_{tq;cmB zl8Ogv)0_;k*V^R}E+M97!#<+iuRjp9-IV9*o0oWfoelHkcc`iCbk=)_nszpId?wv@ z<#h86bjGd9G~7*U`4;SCoPQ3FXUc^MCff7|_6~d)@$ZV*<)Mr@+eB^-BrA7aB{KiE zyrt+8Ol~mfvI(>^bU!VW*!z?~!sekj{qN$)e+@-((NE4kRbBA<#mp&+bsx%%D2lNE zMk`?`1Ic%<`${l#j1?&p?=Q)Ue2*^lKGG@!A7^`IRMx(C9M&m2-}l+{ts^HJ?|L=5 zlW4_=P*BjsXy)XoJ6dkhXDqTB5e3E<(TdqJhl|ct=k$Y5n#=sXmo-y-J}(lO_*Sck zl-uaGeaN7P*wYI7W^_)_sD_+K`B=85F%-5omGXgGSML@#8tOgcWecD)jv9d)so*6{v?iw)6$L+NN&{7!V3x>cSf<>DR0=LzH zG8P`YEc1Gw6SX_~lSP+qD_ejm7gflKKBDK?JnxS6+Ox5wO(WY%hnKQp1{>KDx`E0a z8l^!L0%*RE!tdgE{uPwJCsX@apQg~hbZClo{}wV3-tOf(Cu5;th7=9m=A_fnBrAq( zPwx4ne$D_&*k+!tS+r6fs;+46YN3Re?k-b+9~c$KknYk29Fb{IQ)VWa-@wyN9Fd8r z)N&s|q6%MD+*Qpw6Yd5oZQSQilj^T6&}d=!{Ht5($&Sdhz=>weWTP*D`7$;M*-4wz ziJ^fYla6hx59>Mh4_e|GggEJR1-5?LY`JHr&C~wyBgKf7|{_9jduSvr2I@3lan;M z!R$x4e(18Sa%!#Zi;ricHyVgT8>XYvUDr#Y?j`<)FRF^%%Om|0>m2(^>f1yvuHg`@ zow;-L-9L~YF~&X-0vMQeoRs_ZmyilZ1@RwbfRp{zd2*frp+b`rKKg0UGQXqNe`mz# zPZypciM71NEuNKge3QHI3}O!;aGd$NyjA|uam`?^X+1OHM2ZF>wt{&Q;fz3q2!K$U zub`vovn6=Vn>6Oh+Hw0hMu?1aE@_m_#y#mqFUIB`kZVP{Uy;P6?%+?8FhpcfVJIb`;LlK?&Xlrz=k&ak(AAD18_4$#A!vR5Mcc0V8qW;@epB4{TToLuP8rn_`}ru zb3K3Knk)!#@16yT>eoNuq34dW)L?(Z#3+wH2gCfSEkzB!)kYSN!cONlLMB38h(e&q z4e9tU$S;$}1W++bLlECfp9Z}A8w(^vv>``XmWjVnQr$mP8r|ntO#JENhRDRvS^q$V zQCfwVe;o~2@d7ziw`2)N+kqopgwvV9A_Km9r}=O$H?fyGV$EJqH~Tv=LIITIXT?*q zt}r!}m?rEU(qh7VH+duQ`n4VcUd6z`DEnG)d z#CjsKzRjM83)B1e2elA=PnG)ntA2?ZL+hm_nS-otm%t$B6z&ZK>9N83P*}wEv@rG+ z??MgoJ<#&A;@`F9_edtjjk9+7zi|@r?H^zg}qZID8)pC}h9QBKY3S z?{iF@cwbhoUpwOj;?ty@al5Sg?YUYV816V*ijY`2>SBoT11He%d+fYpJW4Q)pyU)M zP|6LP+ApONY~%H*%bIXY^2ny8%R2TD;Kz%~U2;3(^wnUvc258baN<;`hpd*~O>lWn z;7|znT90O%BlIb1#G~-uX+ZjWexB1O)=FN!UWfyU9Qxu1=Hui9oIZcW9i~^ABZe^5 zWsc$zv_-i&ho5qJP*Yj)@A1kTtU3^krhwAcXG;h?r_)~&kGczbO(FRvX>RZJ=AH=^(zGj}ubZ=1p>fV9c&F<B{c5@5R`=(xkkOkFFu=z@3N?R}NOGJ`S(urt5vmJ&e(gv58|M2yFkFNzC~9a2 zFz|M;XZe@(sgSOLh8@BivpWCxZ@7%k^(@m};Oa_X5LIuJbM6X1Lh6OFL^~XJUu^%< zbGNMRNBm-9kG!bqV5e0d7HdjzlfS-qDIq>RRsgIc&}(b>)&4iGn>WFzQEOWc2>l$L z=F*A57KBvL{*3?1l>5S2iRyd*^F3Qe;AWt>&v62Q_LY;ib}A>;4g=)jc)cg!InsS? zOG{t-ML0d#5bogM;9U;FOjj>=rM+{Es89r9Vd;4|q0cj;k5H02-(OU_@~oHcwyN9< zGB|y4fm@Liz7S)D^$7I0S<%r>E4nVHW(uzT9Oc4^jv@FP%PvIFMn>*i#`JtD5R|HR zuep5Ax92~lIWMj4ZR6>oYb|5l2NjhUgbc<+41WFi`781Q%-J|Tf0HEHyh^nzSv~VJgX5i;fI1Vy41E7=jYA0W0WYZ z;Ge(SSlNVXnL~sd(2Ii(i?fUo%Kw2f$NKii?QWYtMkuz&&TJ>^`fIv(#!E~$PR}&S zk>r2kyFC5R4+Uy22XJes!!MS|gob)!+(qw$=PD{A=Ar0!+4HqBEd+F@`ed}Sh2@2X za|#a9fd%-25uUB+b`~4-v`MuX7%%C8c;a`RkKcl_x}AYR@ck;Yhc=fh@c8j|X8>s? zeUUD?!T5S2LKygZFp&dS{%o0E_7Hf}b(@zTU?muE6#-a!w3a!OVCrsvmv|`Vf01F? zncrrl4l9>isZK=adg|LBXKYt1u+-u^ME(rC#>zSyCgg6dd<6VSj$_F0%%gwT;3(45 z4BvJyK4e>j=L@AAjiTRL=DtC=-s!Qx0BnAmZq)NqJX=zVpu4y_*IDm<4id1WTzsU%8Z5}17T^%oRzsR+aP&}ZE_FfWHyd>1E|F>i#+ z)lJ}PHkF9iQA53XrH7Xn1J{c%a-hzQjJlFepti7_*JASfwG~^Goh;t(XE2~zx@JgIO7(wXM`Rcssa6667E#~VBaM!L-svm22l$S!?x243v*df~vSx5-w|Ig02Ua zUs6r+oJxOE(~%YRzCfTi^RioJ8Qd0ORT5O<4_9h(6^#z_4)>Hm;j5zTr>$1HE%*V) z70JTEA07hcLAg}v(llRa^IBUC-3`ewEYWsfpy5!yWCoi3ctTDa8ynl8o5pEqx6h}l zO2dju!k+!;@jv?QU%hzE{!j0{ot&fgq$DSK{o8;u-w2VgAj$*a)SC)3krlL)6{WyR zP0Lm$qp}|uAi&Rk7S`AgmrF<0MmEXnrH`!Xl_3n;xtz@GIHfWlBHajF8F-YdYc*uy zkZiF6g?p>y)5fSf)wBbUXn?r1(n`L9z%~5ZHBl#!Qr0<=U-J;8bonyc(5OK{Xpy!I z2H)oVau(Q}zflhuGYzO#>AkPJi2#OT$WCtD=o=dsWb7t@)KA16q-Vqx`QN3)N4zF^ zbNUK1sqIHTpjR7|qxG?OH!|D9lQug^ij4>})qXZ?9x$xXR~mw^;SKgJ0Ke{6ny>PO zqY9zRWk?rwu&0Kv)>pdPe+mlN}v$aNNn2`UI5u)R5yl5w$-=5nJkE}MJWMbc-32lzCyJpP6EVt^~HRnF;_cy&aN zEniHA!&m=fhz0(0#P#8O8b?}a` z=Y4B}i)4IzB$BuHzMk%pSSoMJpirnVDnGAL&8Fzra0=dhVevhT zsJ#vJ45K6(D066th>hnjLwe%esqMjYG=VZ^-mJtRrn}GAaOsK&VE*8>1v19E4LO*l*QY1! z9MHjH@Qnd)$w+ZFQB(7r0`SKa48JW=ZYMEUdJ6&qb~=vxWuqh*b8q!CM6qeUW4E`{ z(QCI(o&V(iks;v%S#hhR*F@8>_`R2-&d*qzF+@zr42-(66y1>~{ zV>xT!d1+^j!o}DHB(So&E9&uJ?Or;IW+x#ig6r7{fU)2Gmh|+Q@jDgDq~WJsxHd}a z=H^W4AM!sj3DAB+U$vdA?LnwAj#x(xzWI&)^8P8+=>=NJOHL6%LELTR>%)Rgho7Up ziB%v^OC$29!QIK?DhtjwZv2Oz&&lF{b+10&uQEg0*$%W?ex{pJ@G}kruOUEUMAnd2 zwP6l>=t-w3LM8ytzA>9i@J1(*-AZ_u3~vt@$bTouS`p#fqAenTdVvh3&Vw2gk7gDb z?J=-&2&m%g0p_7$(i>rvG7bH#EV$J&eyWrriOvU2-j_L>CB;l`hVK%<%9TGVYT8_K z2;&OYdLxtb-uya2fW{u&15=U5ax!0BeIOgVJXR?E9%8`JIDiM97t8mJ*Mj~>*|K;2 z17V+$6(0ykRx1HsW*#5e&-tqcJm6x+3jAR4c+ld~W;xEwQu-DpMxm>RK^OB)g z&F;#>>TbIF&6lFVL8pZSTL<6E%W;duo<^#6+VQ>~0|m{9V6sSE$}8$;8Xfr4KN_R!-;ngvNqaiX|w3r6yuj6c90H{$ZaL+pF^ zJ{6HWuTQ-+sXvyOs83~jL2os8K>+9Q6hFx~;wfl?C<&AD@rM4QJt4sWZd9Nb!%XCZ zey}fmD@<%q`ti8ukvQ)A9Oc!TnI3yH&}rpupeZSn%w;R^rgBgv*C~EsBfC3a-~1w5 zNT;o`pmb8aSdaptnYN{`KTjkp|E%lF+t3eU7NZ$rix?aCN8XR@Zzo%fbd^w;F@2kT zfAC9?bWB*FLw=B~D+sB&j2%CpLP{Y`rmw&JyR|!imYk5-xniJb+cAprR-YzEmdiOA z1D`~X-g0#Gpt_aQ7(;~_8CjFcAum#nr{#KshCFACBGxK&QZoCS*PpJ5fDvvl?dD1O z-O!3{=ANR1Sl|UKASC4G!BUzb(o%!Q648Y zAURRGjAlA;5XPas&R_VDpfiPnuy8G5G|ff!i$PjvP?Bh@(}EiPI(&H^-*2HKlpA%5 z5{xp~)oIT^K?SDg0eAVWo{Zu}L92DhnNa*f7`=#y(@7`=&96Yd zHg*)uck&BJftEHlWF=^DJvJf+I|@JT@Q?h^wT+l3-cv6Q`uWY}T!miZ8v-9bna3t0 zy%LLxnXf$$L6W_GMX>n<(%vsl4)`pky@`347!Vrz%uiy79R1~HsqT6!ju>ms36LqK z(X6XY285KA`nZ8Eh#dEkcI`hte(uw9Nj-i08rmwp+7s!XG57|h^1af9=FiLv`_7B|2b&t>KEe7X9wBX~P;GC2!-UWM?}(?BpF zP-=`O18Pgq9D28411y2QXGC{=jpC4J+&NmbaBX}K88-mYbT{I2mO*7fEV zjV*I{+s^6KZzeQCjQ{MilqxV>^V5gd+Y_8|A4P6*0-V8crogz^Iu(NTK-Eqy;M7F!O7ohUwncgkh)(qN0(D~XE zXK|VvW`whETQ}$dCbcG=Ch0c^Z5dQ+S9B-@9Wo; zUWW}Y(C}n_&4?HAo$(&G8CTP!#u5^^A=jZuw6h5J5Gh>VP^avS9*uqL=QFs0iYuXT zb~|>IxB3I9VB;ZkFE-oveSIuf`j+Iq^As_Zf>EwKM_;Y};mA--t|l>?O2QQYMWiB~ z_lv8U23_dF_hJay8gBMN(+x4^4txzUqTymbEOzx!V83l~${Qfhy?IqM)Y*Bvv zT5S<->Hj$Lj~A4#yxE*C9p(6wCsYfHGHt}yS+nwoFie4XHp0at&OBfm)VD?Vx> zaHFdY<$q=NE>D9j|LiT_@Ks`IH>OI|$BwFSGtr1PH(@WiM>R;a##7=yrm6p&rMf)L ziT#*-X|wS=H)sf*j&2WdoHXcv(%}5c2sZlfjsD&<=nP#{zxz&J!Z`OUqUWW53P*kk zy!g{54h?x5=l<9Bh~3P-(5%&53)HQtk6sQ@KD!JX_Alr`)D_PA6Wx&+qf*`ZORbHs zBKN@qAI0*Hdj7LdAOCe^`-)crOP9AXwMUN)IL_}dyb10a&fW0-hGW}Zf3?6lgsr` zB=d}{fb0lS+f zZPf0^j({5%o3*mTzl!cZ*~r{8sP80|i>G8?x;^)4HkrS(%oFKRzn2Oyk=r5(znFV- z>+cN<1J-Vb9G;VzFI~BI<#0Z-S#)gK9E6WnWSP5sl@M)*Rnz({r=x_o_gcW`)Cz)r z&PJ>k?|=RAgTctDgS;>1mBl{%Ogw+tczw|m{!OUZ;Q`W>*ia|pxmS0wb;#w~9kP9d z+47+?NGw~-UsdmX-!JQUct2L$-~YC|{K#pM7&uTMmw^(|?t6W@`L0w9ykdbXhcL$C zT$nq-Pz{&qaem&iVke|;O2iDQrhh9GytY}T^PQ8GJ8}w>oa-uurgrFNy=GYDD5TRjZWwo>{lpis< zA<%Hs#R(6*#RX@cYo4mayZM zTf^=)Uw0~eeg(n8%@%Z@nW>U)t3CHfs=|9WP0c1>c$!0|^&t+$4NqYd8{`YOSWIH_ z+M+0jam&kx^Tz-ZYr>Zy<%U4(r#TP$m|QJ|o}K0AAbwzACjMY&z^VQhLj%$ke`jS9 z`kL#S59f`x`}=3ps}f)9#cXHad?V+z=#LBB60UhbkhN{~8XPi4m;nQ7@xMq-h-p^a z?Y$#@y{D0&N zQ9Zq-jT*N5)-aK|GEt&41_j7CN-v)4v-sDY-ygv*EMX79w-@eaTqhy|cX+c$hRZZ6 z_`QnB36xO4|__jGri+#+(LE4A6DvB<;mcGAxBY`!}KfubS zAJjV&?o(3K&6k=^_WU&zR8*=Pn2;_Gmz_fz^YcXu?HvHc?TyZhx6h-(7JQ=e`T6?R%ls>3D_un1gS9Kl6iAqd5UBy4A+py58>uy&{H-QX6Ix{=b=O$Rh@ z$A(y2sXQkLk7 zKelHhZ3cr)5FzSBwy?0!b84k5?Q}F;W!r-~pI}?~#g!&8&>;P_kQ0zPS#dyd!M=P! zQ(y$2OD zT>$oSK_J43zQTDyCh8;mj=DTtmtT3k4`#+Kt^QIf#-N#wS@O4nc096MLhlVK*|P*P zlD|oNabGTG&Ki$kiU2_JQ_bKSHobMAiUt(S$yT892R&*~2 z7P<)A+S+o_m^I9F7)lx$&fq(me2~?adfcDU4O`0K-_}yR zo*DZWyaN0O%yMOd?{fO^qKRgbKqjS$*_qHbI6?)KNq8#L(u4#X$DB}K9sBU~eb0?2 z(L6%b-b@g<{&|_2?9F1GI-Psky{e(pTI5qIk)Up{l5t?LxIKY+3)TA*y)Pn-uiq?r z){bBcyx8v@38*ATw;^;DVVQ962a`hy--o^hQV{+;*BT;=1Iu+w)aJeiiHox^6{CVIjqFcHpyYzS&wFY)%bh4V}!&NAu;4RnLq^) zcd}Tmae9q>!EI`0#;~;^qa5I)^ETTxHF&HDS3Zf#aXp#(ph37}RyEuQA4!B)z=rGa9#V9~-Qs6hpUHR;A zB-#|z;dae9^6V!P*8|r0RWVgIFq1{jx~>6r{cBad=J%oaOFH<2@e&WUH_fD{aJXY< zjhZt$@dTN*{SqP{EiyN%;v;8FGBz*(6v?9(*L%DEluWT9CJdcO5(4xUI|6eFjB}Zh zhgW_OsE1RUICs)a|MDmiX1f5 ze?`Am7z*Z=J!_H0iTkX7y$AFz#2-T{GCET#KP}QCN;q&Te>VDj(G<{(XN)dzdy-u- zz2CynMaSn^cdPXb>=kf(NPA}64W_&jKMhuazxiu!x@ z-RcK*4a;8&&aa}4g0hiicvx9i`A(Ife3a2Z{glKdE5P@J!9OSs#=Me;|6WQ7V0kj; zK$0tBLi%h-=I0=v0Qhxb=8k7N7+YNe?5v`q!jw(V!zxN0Z>HoyP>jTHq4w$6PU|TZ zATuJQA>6i`Alr?wC7?`juB#1qp$RT>w|q5+@VW$T({WU>|b-JPdaWSZY;XgI`?0#+G| z=sp!{R|M)N-bKm*XqxImp%o^^<{0SN1ZC4K=h#~cV+9`sdtIBga0{Psp&gXZJ_s}W z2Fh8t96}5moib^k4J!~1;C<>({5AI-<(ruX~I z3@0@e7G_QUa>1}r!X-9OvgG^ssz8kEZ$PaVOfRYP2lfbJ=A~)tIU`hSFU`uKO9U!5 zoOzT&EH-bp=3LFg$dv>;BO*3pz#3Xqsj^uW&Ewr^`#2Nvw4v}ylV&0%rRW}j;;lX- zd%^_L?*<%QXuv|}<45BjG67&2Z!w`Np9UI(TF(1X{)@M*Kf=usXjs?s%`pz%B z!#X9_xJ_}22#3-aSE*A(1aIfan8?K+1G0n&1ss>CZQfRszqUENF>3Ho{GzRARtWNx zD*w5nR~?Wc``gtGG0s-sqg@yo&QZ!j&r7NPC+Oo0#6ya2>jYdSG~!3ix$!!A-!7f( zf1I+8R@mHBI{ne@o)DlQrv5&^Rwgnr-o~0PKS?2=c|dMKR0m2eUHI|4u*{2rdy>E) zoy1iR*-L7C-0*5J=^^zPc&C=GnGr*NDkJL=3m*f0v1GD1_N#l3DeFW;h}Y4Q18tIw zkV*>&u$5Zax7x^Ekor7~%|%-6OwiEF%y1QClBM=qO#!nPlO7qSPVS)Fn|$JI1mglI zJ>}L8vHxLtTwQ1(^B;L!a}_v>s8!s4$pm4}d$tbuX-06uF(cQd z@n-i`OA84flwQ@rPGhWPHn~j0?@CbY14)viyit>Jg$#xwJy9d$dwkXC2~_(~La4h& z>TY*;tz3bevU|=*3f17FNNQ5|-F4HA+|#Fq2l=aTn@dMV0r|Ce_skx-gFuJ$ge*pF z;5#|-2h zSgpaTigO;-nN5Cf(0{dTChzN=wEK~=zg9?>5|MWg=M&|k6DJ>eX@zv60489}CW}JF;oPcnbU)Wz)r> zEL|3}e#r+2Ojc%GvC%YZIVz-k6|#N&Z0(j*XS>Jaa&F82Kn6wnjpiQ~+?5djCFQEC z{M8^diuN$Ku`N>#v!FJ>jh~*G4>&kft-nMoHiqay1xsZa(!<)mhX#q*?R4bE<$|EI zQA6L&riP_2|DY`8kS-+by;t$G9e>>6Hl9c#Ic0+2fDA{@E8xOJh=w*ADF6bU{U%59 z_I*f`+g@NM(1aT-Akp$dGDQxF-=gNZ@vTq*WuVk<$xvq3KfWlY0* zTQ{E_679LiqL#PD%n-dSv)cs@swGmx8BBCRpb)6HLjr23kNY34{q793`hGWUn+#t` zxe#L*sp&CM2~h-1r67o>rH6}FFPIb#+2Hl_;01 zm!#Xr=|`>wZLO5F%ZMgrR>P`#BD*!050oI^^$bq-`#FnlJSyj|HBUcJ&)p<4le>EJ zL~k#Rc=`zTkW@T*L%hfvQ5Q+Kvq3Px?Ry{KHRFot-@I}xE51EWJ-U7}9M1RJL{U09 zFnDhh+jp3!4|j7WYbs&yTzS27;ZMT!Y8~vSTF{kBsz?^41N4x4@F+L5_At$qn@`m> zSTGoUdZ-}$9%!aOKhh7|tDYn^#5GqW;LBO@bdFfV##o|@L${lrHg@*99kK(%zAU`- z1RS5qM=7tZZjlfa+(DiEU)H;Sa;pN7mh(z+K>xb4@}mxC+YKGk9G zj#W3h%orZ&YJXkCbEcTnZ1zQop!oI_!`;ZdOF6*XTXls$C7PnDx2k)4Ed$ae1X1Ek zh3Lv|O2ym;>~M?RvTAbU`M+>9u?WNcR!;Ho_I432nzVK7aP@t^GT0kN+$u4F@lgq8 zNVv|fsFM~4k6hQv&k1F$JA~S984aaa5aptfd9%m*vE)ys>l;#y$I0}tbUqB4lh*o_ z21S-RR)q#imaTEooSNW8$%R~n{EX>${M9oe&aS%$QWuCx4<8(z3q5zP31Ym`Vy>KV z%Cib;a+BW(s`Sc9B@Ikmm$C~9&i`I(BaW&02xe4OlYD*Wk9X_XtYDE0O~n?j>=a^SMAdt{gD6 zTz{{FFy#lX+fG)PJYy%1fa!BJsx6`$;pZrbQH);{FOliBVm z!Ld4>$U1ya$X7uCJ{%h*#KcJoz*sH&*ix*BMwTAQ3UU{x8j6jBM__Q?)}G$(GvsT^ zpwZz^J`i<0l9k*UDbt?_=lD|JNAIe{%WHIrlus7rQq8ag%C-L0UhyQn_M526UrNt^K_@Bf6cvwHIjqP@(dQf^I)bun5Y za1;AeHnHqvvnS;oy}4oOq16!SiXX(|p%3t0moAlDq!(G}dk{|gU>NpjUpxf&buQs_ zuN`0p6#BGBGo)tNZyNhsUBW|yJ;>$`~_# zAR?wgZBOp<=ilNbm!iU*l>!U&kzX{OR}MEAqpx1NgfXT)yApN%-Wu<;#aFg@WMHv@ z1Wt<$dr+JeofOYqdvMU9343-`(00eaiT|pP&a{D>Uyd{@8fWe!H-7GIn1LRF0w2vQ z-Bwpu$3lHiQ6!6vO&(H?-Wke<+H2R<4ro32AW`|BjGL=WB@*8gkOGjmAyYr$v^9Bu z(Mu`r`;j!Nj%?Ifs~k;p+-wkHdx3r4!o$+1E$?0_`p{8RvDm{g^pMsNiyd}s&(`f5 z2R9{y>6QAno{t?2n1))Mr|x`IiVN1PG#zSRkeu$GDV2&t1T9zGP6k#!%PcyEEDE_` zUR35eyEvAg9K0uQ$zYh!ZKGe#c`3~wh>XuM<&HqqKJ@~9R^Lsm^$?iSoP=&bu`$>0 z;qmnuJLGVHmUH1FX79&*|Sc#D-UNf_J7XLL7k{O#b)A+0~~(ApMciAz#eR_A@&llt$Db zV4I=+z$>dOW3!)w*SE6+#*-V70@I zpYi4|zq!}D^K&z1wZXsOq|j%{X6$|!0h@S+I)2r?G4b6iRl2~R1!9dD7BbTS?FwMu zbKt~lI<3`<>m{lJC{)@2LDdBHJ>GLYX3g)Watj5%uN2F07s*Kl7IA2gZaesk0Q*(LBTX-QSNCeBlYZ zn(+PWx1S+5+~Hw;dPoT=MTI6{Eduq&i?N$d#79RtX8(38ZI`Tz;qgZcsU-O~{d^nR z9TmHV+q(Rm@Y-y|2rk7`)coc6|Dpd_)?A(76IM5zPBhw#{0-zy+%RnE+8wQN@h|xU zy8naVTPjd2x#IHe{F=YYqp_?ttMjS-;_&}@|2GRswGhO?#^~oPr;X@{_TJcWV!NKay+wYm-1J6OpfDb z&a3A0B}}T;zY*;O55FaA7cS7_xoNKbH~H0h9!(sO?a*^0B@46iT delta 142208 zcmce-bzD?k_XkQTU4nF@qSB!BFf^hFB1-p2Ni)O@b?6Qe38h2?R6x3p9v&VE z9s&L}JVIOvANP+JVUI`jM;Q=(7J@ms{_cY(2a~}S zovb}9xnNF?&QKW`i05|`YZ+Ym_ibSwu0NW1IDmKz9zWqyc5%1nk`NLR65)|2Rg4=g4jzEo~+{v?O*%e#8a4e}Za#>J3P zs!h2Xgav!2kMPN^8_f^l$NhWFi1wJKlA?)=V}(5IHYbC2C7kZHAeDdH=te-{>aw-| zY{5NAzepDrAE7hqJ8oB)g$q1nM4a zhS~qg*o?#Ud5D=_#$5{9#1uS;itXn6k?MWeTV2aHX)PB*1IS*J3J(2(o-2GZZ*V2eT4JFt78bZ&S|Xa_KfF}p)cyKq%GB3E`2?3-x{WS}q8Qord#EL_^=VN_QdDHx7&~R z_ulhF$9Tqf-?@{u8NmrSK2HM&4w17hJu$gAVWupdHB*Zp9tAxpX+CWq^}amHttvarspU;bnnk^v0ge`d2c8PWb~(E84u?g5PRWvRQY*~m*`ej|%T&B~j{ zcNoMqU*&4;=Mg8P#;~kw!ledXIpsdNHxLpnJ}k_%i^+U9{h01P)i~z1IJt&TOY`Ru zq#lYFX3MBzKT~U9Y@Fc?<*KI3<;Cc1Rs*1Ci|2b|HgOd{zEJ_FfV%Fbg^oKkgV^lE}+ z<1fCljpmKQQjW7sYRrX0*|DfOjVxp*%jM{KySGKE9AOIS{YKxjRjY8KW+H+&Vopf%#BH zZk1r>=Cg;I<<6I)XgK8rcHa8-tQ4D{vNmJ6Ub|nEDMVz9R zl%KD5SY&H$ZQ0D$+s~ZvDR8$MzAGuOdx>&sw2l&Sbqvo5<+yC?PAV?{GAVz2qzg{q zDK)Nkyz_zd>C^*ve6<85__D1>l)|bt_&74~_D*E456@|Z# zS#BB&sbhMQhd!g=1_PG@?t9sQU{7hy(xSmV6$#~$LM|C{jO9#F(@eIONlhwByr>K` zA))xuwo4uLrichdsIKjR4164_o{{AuG|y!QrTb7!H*?~xJ&M|#l{OEfIhKZh=6HyX zFWd2;7xldRBSmrTlGI8LEIz=XM5Er>x*ig@eOsMkx8qX!wyjXS+lCKNe~v!`3tvlZ zF*XZvy##Z7ttN^c27G5=kGh&fbu2lqUG^`kp;I9!u(WYPWn)SW|}!L`2N6h6*{1*`)k{WDHk^*FGT=}A_jj8=|Wr+oo#l*EOX)@a} z^MO%AnI6MnsHWlqo+@x!=D=Q!_W{f&+ST)l`X|9q>}SU=JVR!D!AW9AjDMy?vaCPr?7K*F&o_3c#syHURbh@mOzDJFJ4r#%fV=< zAEhC^E;|{`;Y^_Rp={v55LIf~7~x9|zJ;*J4*6ajRJ(M;2XJZgy`*S6mln#Jnaid5 zW+EmozHYmv*SzFF2j zZ;t_XU3|{(lmg6x3d#yMq?&g(e6s@Bh(Mqnib8D#_$sX)`U%?Nu?X3-`388bzM0Pu zXoJEVE9LF8Q|R!8_R1@Wu-s)su}N89dCPmMaK?Zy+~dS<#c-#(OXFIqy;{CGrfmNU zX&$ndf|TJbV!+0Pts^q4(Tfan#(dqiISliVBE5hF3=oj7;y;^OFEtqDUHe4H(Eq$N z<43R$!D!F$ClBfE2NHMXg-|;9;?L|hLT~tbI>#q3+~R+85zta)`nOgq5OG|?_b73i zucV0Ormg@hoCO$BQSV?L!oH){$7rgOL>V%3cGWR%`FvSs8Af~f2_Mk~@@Jg$h#+;TruZh$!RXPAg~eP^5pYDXSVds)2iJ{gLjjDW5XbX=-tXmf;<^(oLR zf<_}Sk9FBl$lY#5k^o_kj+q`kU(c5*=M-JBN~Pc1O7U3k`B;2gY+9bP;5xa7Z zM$gKbr6)NRyt=GerqkApDMJhN?3e%K`SG4S>#VH$K|{hq^n4e@!1LwHcb!TdfP0ZA zxeA~1q;xkkBD+SSh6S{4a{I;|zwb68uUX!wB%}}A`)SMjG0Sp) zZ%Mb|>4Tm0tNB?o9EF7?hmc|8MhlGJ$9{L6fqCLbd>@D=WhYG|-6>=dp}MiqoX9-x zKyp6&`C1<}`YopEX{OX*(S_va$v~Rnr9Y4@hfGu^nxmVeC8O?TZoqN|9MN{6Qhm%c zk-H0Ravxg4u2MB|@Q}^D+x*B^GI%;jyvEhGq@5|Vi0$-W-o}P{c^kntrn*Q8#KniF z)3ry}nY57;)BJbuTFOPWe6^JK2!s;9vgGXPesaJTI>$GEW+24E23xNM17Tpqc|i-W z_9#8pw6;1{EiyXTqRS2LFYOrQXmFK<_ZuyKVpU*H#Diq&hrrcJ&CeWk+`J%oWjgk>q3B40oyZD<@M)hL9nVm-oBc#J|l-#gbn( z)J#bz4jw*9oi&KP7g+c+hBaRXx{~5@P>v&Nf4a2{Ikh6k)Q-* z1KF*|J6lKIGspaLE7#?tOy%3UwX@{H_Vv#U1a4f;x8>kBGP$=v4|f!npQ;QmZ_z8A zCs}IFZa#y}*&?$R0cvY^gs_;E50&A2(ICuPpDjVSs4IaKmF0T_bd3x6hiYwVb~~P( zE0BX9e#TtfqH*YBp=sBu;^ky99D0v_<3;;zLJmHUtL-sC(F7l|VoyZs<@m}R92}q! z0t7a}3)7ew+_P*LEADe0;&*{$*DoR*?Rr}mr8hLO%B_xUWtohPQvV?0VEbL>o%N-? zcb#cx?G2yRf_ELKc6I!XB$0uC9stQ1J&}~<^zkbD#$%g^W(=~dih*knmbV!+{J zWloCEY{2mvNH5m5l}!OLXOM2R8Io?kOW49sPI)PbE4o0T(p)99#U`{c8~D7cvatUC zu|ktyzv&?VlEbo8`ne?2HCHmKVzd?~cINDGV9ZdwVO<H@11pyTEnz>KPy8e&t5_3I;2*>3rg{7PZwrkT`}QC(!-P$gbZypFYw)K(dN)j|frb|Pl-{ea@%n}LbenjSnySz5GkFrmN)vhql#P7 z*$LD!))(!VyAHu=&LM>18<~<^efrpflfF$|(NWp!%6#M)f3vhyt9>T&0Q{W!n`v*H zt||SH9UOaZgRa{YD-&m;9QU*(_qqEFc0S@R--yC9>h{L`qILmxazJ6rGWvoxl7js z#(QmwR0lo?T1Uz?(w11I|LVevex{YCFILdej*_l8EyxBe=V=&_9((e-H_H1msv$p(o1N?(U@&0iy-FZ*KXp=uMJ_Q;?`=D*~p=1l_51 z*s6xUu4RI)+*u0o&Qa$<0#T9j7WWj6pGQxbGO3$E!0kky=HRcXV3reDq%!SI8AN%W+8+WoA>_uCap_k|32kd)~KANDKYgYqnjo z_|COfhVq-R|BkSoghZ+)gDSVI-ReeL`?N=GjW9(~(~PYE{A zdIRY6vt~UPZB`jSvWh%#V;atk@C>6_a>4W~(P0v8(eWj)Q}Z$UZ|eRmZOhWfsLQ6Z z??TD~e2O&M5!m!qJ-cRuFOa*@OP=iIj0skzxmT*+3) zY!Y^JQvJeEM6kv?U5pmNFXFRHl(tx0O5tXbtu)(t2T;Z>a1ls}w@>n`?i@^7m zftFhyYL8V)i1Kx_W z)p3{^Mc1j2JTxncsN3UxR!^#wj+tS$w>OLDboUDnfa)EQ!9&j#m_!a6d)3gzH+OIe+)3{Hcn<1M0A@x)TPuwwU z^A)ye+fR_4&n|ask>bp+S=P4H)=+x>{72p+zgSu274Nn2MOw13uqzh;izL}4Swof+ z_N(bd7A*XyxL9DtuM(5Gsm4hGS;iE|*aiqzJf)cZBpz!bRW}$W2U_WiSj-*7IaVx! zHX*GzU`~$ZePd%g62tX@hsBlC{dHZHgPwArutKe`Y&H9i1|BPmg=dGufgaE0O`3E2 zT74nYyZiblq6yZ$sgr;b6FXB-izVLu+19ahcFt=@y3u^?gb8I^N3J`vENZ==?NgllyuSPU<4A5c$KekHjciKXl74G3pyC`pLRibu4|#5Wd*zX2f0!W{m+*A0Tjb`AQHB5YoA49Czul=ua}Ke1^3 zoQ{Y({vq0|X9wHeb4~Ldl~((DLgKzl0C5WY@YMd5uu&sk&{71dvpjKvL1?w zYo-Thuhb1D^`<8`A3t^xbK(m+?`Z5biKz5b2V@TyCGsf`D2pLxGDAo8phmVUO4p4=fO-5H@?(&BY%C%fG~2RgQY$z5w0V{dJ~hjB#QrAgRP?EZl=@e41~BJG+q#C= z3)|Z@=F|$-SGt_cXm?!JzB?VEkqP#7@z>wz+bDLOF#HRI{iDEiAOE13lW+TL>9LNv z70F!^X)=(HkN#Ja74bY50M#^%XoOb7$fShm&4g?s0*F_Yaz?m&uemVkJ1Vb$C@(BI zroaZbY2HeZn2<(&<8GCEbK8J%4Z6#EEVAbZ3ur~R9=hWHI;BJr7x+L)f0PNdHs!?S zls|oT^--kmR!lJT`zHk<19lSYd<(Ohr3g=hO@YsL5kHPN&(b-`fR}#GOR|-sM{xqp z2)83QXK;iC*k<0^_NwxuClcoE^B*)N$GE3m36)Ec>*y)TQb(~>)+4@aVOz~*aSZBa z3l^+vH!o_igkJ;J8wbB*5Bm0v{|!w1_Go6KZi#57fQGQgxmj$gOr7kh2AVxjVz(#Z z$Hz?6z-4T+aR&FeU-7tW&T>@51?Hl44$v*0uBHI1mD+z?4c=?@US^^XMyL7(;Zgp$ ziawl-u-|x=Vu7ALb++HAmLGRH^8UnjvAH!OdD&!cb~qW(?1a99O^?_GH{7eWX`i6H zJRSX6b3wMwYINAxTsNst-;zC{s1o3R2Am@pVhuG_#br~^7v7Q5l9nt`v0EA?;Jpo4(%%# z=XIf*|4_$2>LRoi=FTzVW3+(kztGWt6)c|N9!EXwQPlsao5j$*f&oW;o+|$l&HqiD z={oLlbTCh?{zu*a%N+mW>iS{JYSitr_?l*Q(8VPov?oz>>Hr%oiF6bFN?Bz1?2T^+`W8nKszA0Yf zUaxwj|J48hn&T+pGS_4*Q!?JXAYV!b#^=Iz1;lwx=lpMszft=qUsPrhH$|kREEpe^ zj2~@J9CQ^58(AsIQE?q>_1trOV|FJ*C%5nADyslUuzxm^lP*SX6EY_Tc)wQs{&=gO zCaLV2%?|sO^Z!g0a}gv61u2GhAMPJ2R`LNYy&20GOoFpLr*row$lRP2W$TW_pk!c3 zLMHbWNQc_CtIH?#bGrtNbhr(kUZFw<_?NZb@qbwb3jx|ekwaPY_4EOCY89pi=m$QJ zV!2J;+EPE)+wROwZQZ;ZH(+o&RTUMk7xM#IYx1$WD|Rk58yg%60F2buN3)!UmDN^s zXlVQpqgkmi6tMF2GrNpm$K3p!<3#yQ5(M++jCU3zV%Wpm+t|gWB;sR7SC^5WUqd#E z8W=ojRizQ!+9ZPF*R888?s~Cbz#tuu>2>(2a?L znw(iEYXu*$`Vm`O8b$9wvBKl^n~g5a%*+z@Pn%-A^Vyl0D!aOFp=w;3{f|d()yH;= z&IIgIp7y&0gblut5{|i`{o8cV;Q#q1{$&i+TQYKQPs+-yCkacSB#moWRnOKRsj0nd zJenG=cJ9CX=%HrlQPce^=DSafjU6&gGbQ{_?s2|z+gZ?Xc=@u@6}F~dVq`xJnpR8H z-t;!|`DQ&!cm29Oh-ND8@#E3a$(L?hp#}N*Z4gd};$o-K!9lx_hmuzXDCzEh%*#J^ zL(O6~5lqY-crdfQ4E5G}b8~Z-{{DWi^ApciMWPl3Fb`=sB`q`4a!pC|ao5F8s(0~+ z^0wiv+8{;DsQ8bh_!uUD=;P=1Tpr%p&sxePa5f@u==b@!{V9g4)Y70$3gv`Qnr745 zT^dPeiW8~b*jP>9l}<*?`al_QKHY3+t(s?A__?eCJ1`MMNW6}7>_<_<5OLdqQroN< zyLl)AmB_2^bePqsM{JoLb3XdjG^CsVn$y@I8!JUrX+Yy5&v{BQYVE20 zXL4WwUHYQiDtlor-KECpxpi_?Rh6N?a)@C*wM3EOXNMkgGSJf-JasQO{RZpS%963h?QwX(85Z$MTs)wrwC|pR zfMLUTJCgTyVE>aoZ_>Tg|9)LsAgWw9T8JB6z>(bLXOD|p>%RE`O+t2o^@1MTRc$NY zRSj(sV_H4w7Aq^UdyTvD-eNRUf-c2?2*I^Y-i5C8d#qW%RLPf&l6`xG4TP02cVOh? zd=tUPP$#x(;`yJODeL>IV{1v;VDIe=lA+6;USUJbf|4x7rjNINs_zD~nzkYuZxi;| zv&yv5XCy_~_$2^b9s;&-I=;yjaoeJXhN-7dpRVnXnR_N)v=Va~tt|FRRQW~w4nv_( zf4TEtBZVfR!y-?fJ$vEObn$LvbY#-}^5o)>LoSQAms9S$cYwgAmyOXs7K^RhwC~@4 zt@E0$UK@A93YoZPzIu~}_gJ)b37H82l5!wYa4)X!Z{-b+ydjWWCv?@A4-NC#)bOhR zk+XrpY*Ig3=zY9n(7GKAS@C`G+oR~}*46ox z+LslSUOw>a7b{ors=vv}>#$v?u1c$zu7gv-x;i??i61vf9GcfKI}}w3ZAHLt1|~D9 zlO5zWWi{)j9VVh3glHg}%bZ^vwpg4i+M-{hFke|;+3(&K6J0S8lUt+6EpaYxO*;_+ zn2t8u-L~eii;pXJ)85Bd^zABI%V%b0a;PCixBm;9z?twYO#%w|rUJT|P1*KQ4w#3R zM-;6m#p4bj+qhu^X8y-l(#^$CRrtKnm5c@X#6dofU;BFp$A0G1G@ECr2m(mJ`bATK zx5SSaZ9(PjfMfT!{!R83Hx*JFj@H!D-(+Jg56;tUW8yU)1Ry2vijl2eH@f8V&geM3 z{aME#weRf;HJ;0fG|es)+sE?mo~$BM7bfPYfIa@IjhSA;ein;rF)3 zn5=wH`rv)po}&QYe6gX2P?ofBYiB^fg-SXI`YpzJfhIUO_JnJ4#T4wdb1x(IKFu#u z3Fyf)ySN*&K67u9ll2V+_I?b2PKz1o>f7g+0H21>E~Y%r_r-v&+sLKCABC ztkIAVtWPs1il5Y0Yzj198~qriN7CA_v9Q4?#EH+(XkL@@iiTPk9^9V=B2OB5enjLs zRx)-%u{W|+?h;(}QrK)njl0QfUDp6Sog!ptMNGv}4jiXm#?zb=7}q!#Cp^ZkZKq4P zbTNn4>H8n=STiw#NBGiXqN4U`(jFL$Mn{u5%{0{g0fO@bb5bGxjBQ3%5Qu=--8lvV zIrXLxd9wLAdxhDegG1RGW3fT%|8{nQ)WZWGxg2bBryPI#wOuzMLEd)u5`ObmnRBI$ zW|t{h!R(lEHMdd?iamx=$W-lxYr-OLgFH!IfqK>u!aSgHL@Prk?)EGZKAGpu2 zbmVXS{C>mUdeerFDf^C7P|fAtwhix75o=mG>{Q-GO6Lm;j z`y@jrU@7*qv-R8tjA5hxV_x2*FmMcAZSkG6wQ{eg&{R20N1sjVeKiPb78hXU-hg6L z#*fKMy)e%`n3-23YzG`U=d-d?Z2@gi)ucHi!u15VH^s-`e9f?8Z7%N-$2IdOPb@0R zvdoTZX8fkjc@a@qJCWHJzPL?i`Q*Owxdqm-!5N4}BCnckyx|hVsvdW!I}N2sH(y8n zCh6Uve;8ig$ARC%;=d8u5m6m4ZcW{4czDuRM-Hoa9s*o%5$&#VFulW%Sj}6VeWKa8 z0xN(un|O@~nb$=>Ili4PWhu9(5!3w5hrulDu{H>8*SU;|gURYWbbq}LhIJTi`K*5E zz9JE6+0a+>ZRwq-+`{G2AXnu(dpt&>;`<78W&49FImr1Y3GLgbCZVkG za=xg*2tR}XSwrSXx&Kcjg9}aG>&8Q-kMEQeRfErtO%Gd!r439>>~Qe}?7^vLgKFX0 z%Q~m&x?Zgec}j%ko0#=GX|geN=EJ-IK@v(Z!`$jhn(779t%B2Cb8zL0(5`}lyz#pY zqcY6O(0Q(LBrx|_->+(F@;*OpcY1=x+TFF@e)Ob#=-}|HQi3FJoMum5x#SIBO%#sr zIOPSRo+)+LIY9W3i4_ob(4;BCpP^ynN?Kq#ZIj===RKm+6(|;T zFRLVTpo7h1uSeKW3OP4#RjOUR2+ZIA`T6r5`4~Agr}q7Ud)=QkNHVp{M)*@voiVBY zubt!J*(M_0jcbe|C_id5&;F=-@vUFKNE)oPaC{53JZl@Ay39o%2l!T6`YHQEa*dzE za$vi1eR-VRtd9i+OYu65ByL64>ndy2Ls zSwG*I^|}k{0X1b$U#eNiHf}$&zIg24MJ@4k96BYdyvoZfDh^VS2ko)-4minIGBnqT z2xLK)>O|Pl`&u`VgMI^dk(C+7F^_Je&2lB?X)KYc*0XM$u64n;gLGlq{uiMp+0vJ- z$5W+bK*LUaBEgEtLpeKnY8XrI%;T&>9o}K8f2bwT)-v6Dd8(*|Q%!}q(2U)?5>%X_ zO;FN~s@{EWZjOvH@`IeZZ^0f@3>+NxHRPHsc;U##`*QxTvYXV^X1%I;QI9_VS0MKX z7Ls+FfMtW6Ge_O;9*^HW`|R8A!8_fda~uH+n#q|YNr`XiZzbUD$TG+ie z7l4h9dI2|0p8?Mn`VF@c1e8&SWv3lJ|ce$ z?51cx{yH_I#-RR)T-j zcpd2;X zJ{}&PEmFX4W)X)Ct%lsTfw!HH(=uFq@~Mu1qtyeCnlzLG{9rqq=}$@joJs&m(EEN! zdb`(VSDYeJ=;xB^nbTy$ma7Z2eY-zWC`HuZ=+sg`?gOXycp32Btyz|^$_X5rdw>IZ z0h*vP72Kj9s-OO$E+=Qm$jE5$E%TO^ijq=8UVgrjl2x#3s47g$d-VxX+}@T@*YuB> z&kr+ZQmLg*m7z;ku9DNXg%R#AB*#< zo4{w8qz&4ifie$-r;meKTEPA@@CM67V7XFNEwrxHsuJv%oFIp*--cFUv9ATt=uTikK_qa+p0p214BIMOh z=XR(g_A7h}H?E1VudiFYs%iQQev!5X#*EA>l5`zt08z~bab$tcIEv- zy@{^4RRLb!c3HX*$K*1K!$|1mdq_*MB1Ef1t#mNm_4L|W`+m^ax%S=ZTDc{d8i zf8Nn`UQxKR5;DIHNGUd%s8f^qUZt&J=YN2lC$c8rAq&`*eS=W=6w<2IH5hRkXJaW} zYz1*OuEl|-mtA90a!)f?EF>DKA-`_;IOWi z1dTvX4_n)U#?u*M9EMf>B%P5RQdU-0{c^;OfB6|OfpISm3;K_l|;hT z)k6K=^_EuUnI)}EnNEV7nVA_&-^2A?G%o!v&O#q7amTJCSd7B9z4{F*!gnhoRZ=Qq z*7vCC@HG9{V~@hX$@u%HSD9=O(jl~D=^?MFwJzgiwN0V@dUai0cQuKVvAfB~)b#+w zkk=p527<~SDcrRq8q4A-FDXIWEh5>$GbzI6Hr*N;2P69FYbZhEqW7+^Z(_WiOfyG* znm`pnZc1PCK7NF4u(Pv|>rwOjHpiSjE80{wyMO=w=#NPo`xX0?%uJ`UEsn~nDr3n; z(($Cs*xFhHkKn$qru8;B@m@?%Pp{8hK8Xm400NoRrx;loEB1F(oU-+1&3q z+5ddMM&b?_{WRrpCC_#_lDC&iRod@$s0R{WjPd+sKqYbDJX*yq0X(?11D3cjr0J-zMV1F^ z9D9AP{7J%mxNzxjFsMqS&R~e;)q+?x5J9jG{SV z0=FTlLA*7-tt$>#bsFipUhRSoK$SVvROJr8&PsIF1gZoU;7lzrUoWw7S{62z5T-XL z--mJ!Ca~rPf-;))m|~}53EKm<(@x=lrM9zOWK$_FK4$zyzu?k*errdg;t+f^IFKca z?Ft--9~czDqae1!;jcm-X<7aU%)awgV{1O^o~Ls$CBWKT=cA3pw{r0EbKHkJHSpb~ z6X~mqOx=>QVxC*yvOn2ZXna1``|<8Y|MWRS*uX<$?dB?PY6It&MXEWe&`;k+-VF`G z9h9Q``?U6GPUfErjtDwT1NY2_W= z=;FN{z#7%)D;!%N=e4jb>ayE2^wssPgwvPCy*cuY%*(Y3Bt{Utyvo>@?cy+6Bo^N6 zGX1SxMn+aZP_Q2duR+8`zgIcEFo<*0QSh2}=ExqXj6q^d&GPF*QlC8o~SDp0Q&6q%lyutf|y-)x(2 z`XUnNMMxdzqL7ZLc6zGDHtAB4`@DE`TGp;N`l+MPhn~_Nt>-lcrp6`K1sz6idJQ*o z0jFFYWrBcv`il0y4gPHR?=({MYA>_R>aW%HpPzNTb{6i)QYa2=Z|r^NR8_x43tY|v zM~8a)#tHHLI@Dzal3DCAl4!s76hY%?Q50>pKUPcD%u{Mx6@d`ori+upjm)E$!!{Z1wCSRdZ{DM7tNyl@N&vfxhgFa9 zT5iQyad{oeXQ=RVgu!KJpBn>yLQl5PC@XzqqwmtU{oKvb$!S}3%6+5f`q_^)qN{*r zyAS79ieIg7swK=ly!-hNkEZ3EWU&45=E=&i?HbP{KGj5Ygxg^_<)jdaGfU;=hGess zViTj&00)V0I4WBfXf=Za$JY!*EaU4+S?qk~;werx@n`{%s;kCRB?Am4Wh9G3WQ ze%@9ydnxPm%a@m|srRY6993Q`rZpe@>P<<_woR7+oYWK8E7mdqH@)bCy0wRI8;{zc zkwlSI{b;{c)OhvwnHs8ECv>-c@JM{b>EQJIx);+`EDO^oVmC5j&4E%C*rcSnb7fD8 z*6H*em605`N0C%D{dtsL4S6V=9MCDElWrXs(2v)CWIAj?ZyMRx|H+_nocoN^uc;5K+d(9WcwV@5NGEyyl|rS0}a|$dKMhexRl0MJ=g%0QZO<=fqMgZ=IfgJlnOl(Y#TSQ}}C#3bBh;-j# zWbi@QUXzimutA2p&5`VU@<0+R)31yO*ZYhh$izOD7Z#$BN$|5*d4(=5za~$MZb){H zGUlPOHrmKwfruk5KdDXOpz`F4W$@XUw`G>dO9_Gnx1{$HhxPd7W!#4>=C1Bv3sq)_4At_ zs^1mcx#tucHvZV5%~2y1jj*)lS_{Bozgu(K5r_5tUrmH6+$)6}8$lAzCMkkpZoVAV z!^+4r><9l$0v8`c!?!@Nd#QF8Og7_9P+a<&>?v zWe_WUR~)OYYNx7mQGVGh%B5yCz*dVa?2-tPo4K!mXl=r1$=|8`rtizvI?km+z>vouG)Plu?&(8~d2I&?&Pm70)m7_$oZla=8= zbD?R(-{^I@@Lp|WPbA~y0EC(N5w40ptId-Q%!^U`kP&W{z~gW#hDqV0^iyK^Ryuh* zAIOiEj;M^TYv3AaH->hGiIEX&AFvFTdqyQAqKmj`AklQ{=5q&^+KMb~g=yNPCeb^^ zk$lEV9r1X$E@5w?s9<+~)zd_iXoF-QvYmeYa~r@cf}18{0$9{9F|+PX5mMY6u}>gd zU0K-|@n9*H9wSo~>-6f*m=Jm|z1Pdi@)HqaXM1GX7^l{cx?OGA+EyJFHDNPUF(83N zsaGr8%^$tgyEu5!s#W6;Wnuu+@2ILKO@DG_$?{?OEZtZ9zO-e)!j387{`ZOLZBq8s zMe_4}%dA9eHlVHRK~)$z_O$OrkrjsGR^Ly;Cp3%_mAC?#f7`|WcFlE~5i5iu|;TQQWlD>6wo zqB^&np=F{@thiQiW(ZqIV#XU8_eN-;5*sAv%)^RATOZ1Oece% zpTIPU96Lql9B!MbJ>cp*d?f6=B|pNK9S|Pnrj)epx&-%PQOYd9Yz}qGI6?}77r(1b z08+<;Ph(rNr6J+!9IjJ5w$q&JZO+W@YH;OqX%-f#84#H=*-=l1onPDgF6Gr(Yenf= zd4Bnx*F%`PXhR=r^UiSv*u85*#~MoNk?c1F|MWG$8F*h_Fb*gF{yba9#K3@L)9dT` z1vQ{jd&Yq(<=zWV{`AStI8O4bCLr`~&4~k%s&64DlRF?)^o3C=8(!wrfah`~9cfpc z6U&urfW&R3Uo2e+p3+MQS}s z>+jK0Gw{#%_xU>NHG5sQj%F9hO`j+}w98`u=U#>*Hgu7RCE8Z zx@Yn=ObuS~E6a;BVU~7|g~1Y0iB4<~cWI*)i1X+E3e780{K@uR~#3ZSg zusubeOL4P6^~6%huS%27#@3dYhZW;W{X#=MC@QilJ*IJ1q-3m-cU5b53r=o%;Amw74g@N-X3&$jkyY-S8B zR6wkuk(OfR{_KL{9zzGWDPUyuGIHgW>k_{wj4kEnojXI5txbg$y|!p;j^Fu1Dfw{4 zAN7e;CDI89{SloOXbPGN_V`HV+l#ZuAxcnaO!G{9$%y3}dBhcW3UKcLbL8$Vt-W(+ z#!U+7jS`VJ>slqRA(0T)u2Z-0VlS2F#it17ess3zqmOWa~$e zAEO_g%}$>Fhhp27A6r^eQws)`g!lL|A*dhy64dKgP(l|6 zxLB9+mh(D7PFk$YE@qrzXZ`lfsM6Nc7AS#XlUKYGZ|?(IjyN$VR1=|#&hdA?uG4z- z#U!fm^3WW>c40jo#!iw-zcK)%7hm+Nor1~&pG{OJk~3DXqa99L;!1)Fm1R}Kx3|7{ zL&RjNwMj){y$=rNfr~+vJ4$wai>PMLDgQDM5oAFMphVf-A($?zu+jwYEi9wbmz-% zE_1=Z7?=lZWcB*uB6>(OO)ZLH8Hwt6H!r71E@i~N?y8FN0(=p#n{gphn`d4vxHS&M0~%M6 z{{T-m_~rXRdUsRjh7vRsm2mr(5bV`3fdK@Y^iOkNLklGRH*dWp!X@aVcBqc-G+*iU z6S#w3j zWX7LLIYFGSSNdpgy~;BXLQkMgr{uzN0*b^1C2jwP@b(pCGS4L5jfwvk_YUj}!fIjj zB_QZJ+X}VrXO*T{xgMt8IP5~cU1@BJME9*)d{q877Ri_xAc>OZd~3<}UmTYS+lyU> ze`L$}C6Ba@6m}rkcfqHeM>*H&Kfmt1fX88f>(XS#S@y3{`%iapgZ7^dp=$P$RFCEV zgN!q{VCN=~R4_BFygK3cpwjL`tq69;I(t1M59EKvlrj^^zzb>V{ga?xK@I$wrh9Rt z7I{XxFuL3A?%}0RzGOHbdNy`chtZA(HjyvCocMbVQhEEPdh>f^?tZ48J|=@?c!s^S zvC^_TY=ag*ED=GyYZT}F_dJr3VPfMPc>m=K7e9E3g=w{~ljRWH`OCNEdk4)}{OgFQ zD&=N>Ma*a0F{J~mk|iM1sA+1}_I~hv5gsYSr889SI1Q6Fml5Y1lSP5t%E$rmFuV z7--LxGjTR)|M|(Tq^yjw3`Fn!;qysCvOI=(6%ov%qTo#>NwVUtUA%EYdr#yUbr*bIeqfATv9gWcooi44uJQoedy1{NV4j7*V$fy&8XrZRAVy3*a|Mf5| zi(mxluTsv~7VLK+H6D89VhTB5aS5NcT^RYTDOU8+!r~9fbo|Ec!9@Hs>tVJ)jz1{L zEG0{7z`sN%pD$W)52{o&mm)EG-LRVSBVVfeVYljvE)E)@4aCuoEU60)hQO6mRs3+Xr4KbxO z($Ld%!&cXxeDyS|9?j1OMju+F%%5H-ZtR23i=AtY!CCR~%(*0*u+!9)+nXCd=3s^+ z;ID!Lg?T*RuGD58giD`^f+0_}LlcHEU#V1Ou*^o(@0=gY4+& z0v_1VRHU%6iA@yiFC_1q*uCmGM?&t4n`DUFy(4lpApT$EpHJ|= z4M-G~@Pm#*ERjF6v)cs(1svZ~8@ZrS+2k6!?`$#oaHZ`;evY6>heWH__Kct(hTYkM zp7v@nKir@#)A#pZ(f|ifEdq;nO`fO z3%Ay#ZzaDaN<=k<@tgEnEO=sHq2_A(BxW$Tru-jwyr>s!5hl`(0Ik1KhfxQ(L*y?Lem>i;QlRvxk%_WwG)fjayyt)XUEtj58l&!MYjDD3cYa5|tv&ztlcq^QlW3Xi zoDimog}GWKdZtP+hAJn2Sd?5IF@*^eUkOZ^3~co*B0XecE<}<@R`m~v=mI^^Jqi)K0(q7gkRdxT*`0r zz|&t}|jt7ld0L-c>Rm zW@w(bT*j2eMBjG5cgA;6j+HQG5r7~K7w!&E|DlkLPfR$&{Y`|jo3Fv;jB7+zSu?`jms$=mt%Bx#d*(I#Xr(u^odk1 z*jE0x^*HB>W!>kXwl*{KzFz3O5_Ip`l9I|Uc*_agF27|XOUOB%_IPwu1khuZkZ4-C zWFU=wi$7IG+MxTKpWgAvzt~QxXL@2{Cnw{vwAAOqBDu$WUlxaGw^E6vjl_s=VtDWN z5M7-8^Ao3XswdfBVuMc7E%9k;zBhgiZ~hTv;jgE#EQ^0|oAbDp04^(Uo@>a>>qV^Z z>grl}6-dkbB#bkR#1q5T*9Y{|YP#Yk=jZRkAZZ^vvS0DK>*@XUD!foV6kAz^2}Rn^9T(k767in3W5tje_BSmKcKhnKVgw45 z3`0#ne)Kd#8(pH~a6_-$q~L)V!MtZN`Iu~ON6^mJq?ut)v$q3AHIpt_Mo-Ac^`eC% z^7ZT6wCRXxF5ze00DECpQ04a3Z>ILEF!&oy&D;!ezqwd?iP$SPQll=2zp;``NVGe3 zhz_c^X?5JHOdtW6iB- z%)Kh)P$e=8It5D=b;)_GmbnY3>uQ;g$IW`JNcoJ}m4gQ2wsJu)?%h9FX+QfOy1q`y zjSpv-cLSzKi$(hb;f!q;_D9r@Cb@5nYOT`QvkV3Dl>dqyh*^nmAR;CEnS_Ohv%E@? z1q8M_qDM3prIw3vU($p6i$YDPam;tYSIfCDjlNKbyE^tZllVPvE~A8YLAZ|#YU$?m zL=@pOi%}NtTP|Nzq+j!?X=+v}S@m=)T-8L$1N0#=BPrM3r5209B7yObDDE2?X4Kaf z8ovt@F^F=s-{}>rFv@!u(FHqKEB(G%oJ2zK$DtVE&8@3m35K;xC1xh=pUFDILxR~+ ztcuDDyJe8nxt8X?lxE4RXOsZ?S{GUCRo%4m^-Rm2D;6g59sd!;SX4yF3|fGuQ7~ix z%9o|40?|+Hk}@2q2Y>H$2)x5{X_#eL(L0)3X!oL=yDx4@)-jBN{uONBiM@gBHH>0) zHbaQ{jB9D@!uQa6bYiYUJWSi%V4kTF`H(W*s)xRvdkcqX2At&2$OuIan$%f_kyOF? zPi50{lfTxJf{@FYT4pVMXJ#+54&e(-%&G^FM)y5@V&s+iVsI!F*$z!{U@LpgJ}}@J zff*LhT-SVdHyn5f39i$o8%wy4ebJI@YirGh>*((5b5+k3|J|;ePG+d2ml5mf*WVHk z9q1s3smp$}QJ2gZJYlf=C>{z5D+%4s9=#cc){vhWX?S@zxWrU1ya|~0Mgf8Hr@xVD z#Y8tWmBb$Ba+g6K``8MZ&8J6bEy;%Esf?3BOzHP7LKNFcS!>**5Tt+I5nHbMVbrK2 zdsRhIJ|%>>u7cS#cq;I%J259r>%)T|j~_n?_YgY(_vXIavQWxz_}#KUY!l%f41*~? z3w+a3TQsG|Y{Wt$kQQj3mkm_zDOxVZeh!X#N6E=it)CS1AR`0IXMd{(t{|TtG7yu2 zejs!dQ^K9;#4?Z=_%Ie37yUWjGPfg}`Y}`A-Hn!V|{_ydmIl^()jFQLTICe4dg{6qgYDo6tfhMN! z`*#&z-ucrdK(s!5m{Z|x4S1{6y0=g>|BsxzawJW38bfD}?GN;suky{o#K7FTi$%pYgg-gQJI#Z^zdw_X4+wAYHuWfezqs-$?TV&s8L(-u-GH8G}3Om zGi-dsq@Dh2FuM!diyX^+krU*c(P z{*?o{nD%o@6iU`nM8sf}J)4#m)+&PuuLI5=X5rHO%zvA@N{XKMz6@z}u zoE;fWXm(liK^2PTn(uc$kSi%IU8;4Q599dy2``%}O<$l72ZR#){J_VMk|zbVw1ScH zT#eEw!s)<(>!0xS50f9}Cul|W=)_SHUi;Oql4b8m(&_v=n@5c6O>mvnHN7p&sfK$A zcN|Eg@pikDjauz7B#g&l7rQQpGHc9dO|BOYw-Y}(c@
I*4sU<#nc_)8YGRcO=x z6fyJ0z0g7_pWPJm`dDOe=l9~`q3toq4^tlOK4nD!I(!+p8enO)I2O?uoO7$|oo@~Q zwskV+;w{>CYZa9t?lG{faW<+`?lbx3SII9o-k0dyd+~5^mNpG|hIqxzfB#ynjFo4N z=3REeNmSvy4kbU??;Xx!rvU4(C;L&nl1_s8>fzoorBs z8!j<@<)>XG(m^*Bc|?ramj~FN-_;so?CjF(%+s7pkz*Uq&oNZ>QyZGFk2urmJJigs z)Mq=pvw{~BvqRj^WrYTxN|fI*<>(J^5yw0HZI38#oD*--^PB{#)CM~|kRr7O32~0U zzq}fW^#Em+WlR4?FNU6O0HBdXMWN3&;0d8!day4AM93$EVIB&8(R2`fKqHv-rNPa9 z_REj&NRvJy=U;OAw0m8vnLeLtq!WBgy%$s2ugIHuG&^F>_72GluEF24jiar@u>s;R z!#|V4-hX<1s1`Z)z4n#}84{Q2Y@zr>1XPC_Oh<}uB(?H()hkGKT@pGp^}jke>x+Ns3VK>ZcFSVzWo^5TlI)OibL`b z#rCn8SGGBno^a(U9^Pm4j-%mTIbFyPO^dn?GL@YdB`wX74H_24ubwT1#1gdN+izY- z1w70@x)g2-dytk$58(K{IE5>9y$UpnBzj3}>Vp(J#Fvn(uyLQQC@4gVGRE%MEW8*C zG+{7MTEiM#AV6Wil8PY`0{zJ;mgJ#KDj{Bv4isH0csPG{e=Dm(zI{(x)OS_b^K@$+ zubW+>n4-+3Jf$F?ZC=*>=LJ+;oX0>wK+qt)GQpQDL&rEd6IjVfJ3Ddp&Z7!zqon8Y zvF70N+<)l7VV!gMHuNkgL+(7`;L)S{WOgAGsOyz!VJAA3Xa|gOF0xcF|N)!-ru|D`rq?4ihDP|4Vm{&BVO=?20&g*8RS>W1^d* zznblJX*!LrsM zTmeG*;UBlq!6b*J=R8VZK@!MNyhMvj`c0dvgx5}w04e#aGx`HJoq)Gry04t))JG5$ zZz-^w)iV&{O}U(bcI@OJ!gyi ztVHK-fc0`iKBbQYia#RanaYzZ4O%d}J&a8?J-`KCa7~>VgN(c4`|5)sd60OBDZ)%T z@~|U-ww{+G*#sB`2Lv&m-6tN@xq7tzf}?{_wEx{#%bZx#i-xCNO{%=iJ?!DLUxzZ+ zI`3u<6Fm3yVvxhuiR`3=!C3PuG-S{J3Ni~EmB+xDT3Vtgc|(*PT~YKqVl)Rf2TV-^ zpE=JI(7INJ?bd!QBQR_s4uZirLitw$Q}1*DjLvL*0OKCSv!bj=or|!lf zz&@b`fw_GBdNf?ou%SQZ5yh<%(~?bGi+2%)2MQeRlC_bO5%&5N!f~L(UM0oBnYlY1 z*_nC9*fJQMZgQg^?Le`H95Ixsp8iOgEp)(ugL|5#Q;=-fvJKHlucTk8`JTed!Qsqc z0Ec20!c0j0TZ(ug3c8oxqf)~~w$Dd^I0s5XSqM2>PU*r{PQqK7T71G7!dj}K=QQ)} zhxuP*H|*0mqHPN!!?Raz+8az~^5gHtys-y1alk&uh0-t#6yc3u-=UQ|GPT zX!?e9d|vI}4bqVv`!%B2gePh&!ueEd(^_}yJ4=K@t_(k7YIcQCk``e9Z0XYwrBU(D zAUQ`M4-d5`&+%B{?xoOWLt!Crj@fR&<1bo&tnA@3);=u7TONg69NlRe9ejw^+k5VO zy$vhbbgKXsLoN1)&SI*v&ce~qgNjdhcW>-f6rUv~3od;ci_A{WFd}APCE0SY(YT0P zXC-_A-cTaOl`ye4tH4l&@vfP$o5MGII5@Zh3LJu?ngw*qpMz$Y+d^XTCE^|l^L7cg z6R}I&vme@Wz!9F`vdPP37b?#Aa3VnovPagc?c$2vbio?dGpv0>BViiW)=^8Ny+U+L)!i4zJ|KYmj!lfgo3w1%`ypAm?m+~TxSx64v*|rGH3c!`tFtIgww3Ib!l9DL^(}oaB-X(O z6D}zSu&~RqSR^M~N-f+;;m60+6OuoXSPBL>Arh=q{a-u%dOlkk;XYlR-5|rGo5I(O zijukvO>hvvUJfRfKGmJng%|5LJu!#DuBd!ya2k_%TnMFBa`M1=Wh-`Ati_MEaH3L-Co_2y9=6Gfg;zrKYRC6 zs&#yrcyJil)k^3dBty*Yfd|5?YD$nfhETIW)x#WwR#sBV^e`8@RE}27kv)!?Ha@#d zE%xTs7=5oXesFp12G=!}y%$~b1MJ?3R${c{+^?H9_Uj=OzdOB>_OX$a8p6l7pxXe} zS3Pn!?RyJI!X7h3O@EV%eSr9fb~+X^6cjpb(;H1~B(1&b{|208wrAr;^;kCE7{tns zS=&Y)f80cN$nH!h-|tvJ<6srE(iE0*v-1ft_locL^h+S>3iMs-o+AR zxhMjo$})$N4dtU^#+)sG74L!DgyP1$Jui=KVf)_%t!oJ&VS{HZ(zU)MVk?7Z)A`u+5a9>i`2C6pwyodzSSnFmdfq5F9V`oOHSwbjHadZIV9bYK`H(d2JlY*g@p2+Vv0t z4{zU#(J1OLY{?dwSZ@+ZRMWwFh+B@*Ee6j5Cj|(ztUgfewremEKXNyV9>0SxK^3Px zGHkywMn1x3QpOs(XEGw2!(#bru=43(rJ?KW`a{DBP5PhHLwYS%z((Itaca#aV(9pI z2)6(6`>%q=pLFXFYoF?CRTtAe=SO0Z4S`s(u$i#MP-sK@<%5S5vSeRmkLLgOw0LFF zBU<1M$eZ!!38{@wvj%$d3S=mChDzgXVAHQC#))-16!0}Uhc^1Q*sOx`x|KVNl*Lq$ zaOJ8IVsc83A(HqJO7)M~v`>@cP6S$VAq7sozhQhEy?DfI2`}OFfYhyhbv1p>tvsNI zB&T8aFCU|Wx?i*sM%0EiD&4iobu<%>=Q$K8c|Y|D<;uw2#+++!l=(0S;Pv@XIg z%TDsah1a+Y^$7gueUqW&_qN>qxl!vSeGz2E^$6ac`~ZElB~lfty<04VD~Y3EyeMD z!v-Hw@3*GYzZ+p5ME==ecE0JFPhVTlf)S$o-c2qfCcLuM;0lsJRR=`tBG~9fmDXYe z^MagU&#*WYH_IE3!SRXVWy!#gccoId`(AAsZia_`k-arCJnZV{YJzMXyMu2M;zwz4 z_PbwuBNNI;9|MENU?=I@!wDA3vN^A|D|)ERUv7jehU4q^Ws)5!(w5spLus`seLV*A zkn)}dq$9}#!z8_KtuV#WQrRUBT^2{2L;mv1?>8T^#tpK@Cj)#(+(te+wS5sl0Ef1*u75Gt+b#K=)vTz7ZIrIt zeSbmh?f55mV(clKkg|<$n>L8fcOxu^BM`)kzwYzDgFWu-dgPO(v1E{^}?HgCP>}v!^nL zrEnge37NXR0nPz~fY4dd{rlBDHOZ9djn)JJD(=5{ezW#+XLG%p5fn&(J40*I<7b`_ zqNo$d@>Gc=Y!dtL*Y0zYLQI)#-ca3hcV?@N7>{w_L_bi*w07#z@JqH$of>Za#y@5E z|CnCuv@riMeN?={c+SQrNk0`0FlbmoqAuXQzYuO3ewWVt)Klw2Y2h8b!1fgx#$vewd7 zHN1AUeM7&3QbP9iN~Ra|E5I~;-K?PrS@h~0#nw0;2+}4bqV3)dD0sN47nQh?HOs%> zxUUqu1)3%ll4cVRjCWj>7{RI1pj77h24XCVJC0S+ii&lq8^j5WDoda;bmy~0c7AT) zlKznUbY(4Ps3+Gj#LPV~A!~vfAiJqwz7L0qtrd>rz|v?!u<)LoFD{2(FjDditzSGh zwKs@n!NKkd45+n;-L!=rrb^o^HdHM4`7bp?#(C~~Z%X+C*V(M@Ztu5FlgfQ>k(Cd! zBIahair7*NyD8n<#|Y%Sg~&k@tNHX8fPLbtkOJW*yD+^AcgbjBL zCDNJ=`4B712bY)1tjQ)QL(}2u3F_dB5Zs>wi*eCMX%D$b_}1lfgC8upe9bR={p5ko z%&0%fLb&*XP5OBANah}JKMp51_6d5e0cIyhKq}$WH(dU2JR$wfX8e+d8Ck zsd)MA>pEMO>)opQt-fd=a7x)0 zH(O_*oy5Dtj*3n^lxMLaFlEZf^J`N#?{o;mxFGEqy9oqq$jfg^c)1}z6G!{_xmkH_ z<{CFem1Y}9#)epj!t}X!`Nj^o`meP}$?emgsn3~G4 zP$8zc_34extVs5*dXkM!M{W$PB*nAbkgkqW$J0Cc(n|nmmrv1NV>4&^l>4LS8VFRq88eXsrKLSn7^^Q|xTj4<1+YHt`4r&IbQZNaMnq$0koqa_ z!*XL(XeX%D_NNkk(B+{x%d}kejX@vtSac*bYoSI^$%47jqcT6h27J`tbvwU$_OkJ` zf|oI&?C$gW;9j`&bp@`uLA`UU6bnJ#!<$r$e!P6%{}gNNktt3?lBWviMCV4f8)mTSuRBn#5ue z*aes?r5Sd?FO(UqQ2vDZyq9NQ!^VEw0mws%*U>nqPr%18snd^?t>sJSbQ2Ho@7-4q zl;H@FmO>Ife7-O<_jJf)k!IV2=w}JNgxB1AU7&a9&qeI$L++RR?1C1GaHj{b&b2ep z$^&TX1tsJ2DF`x$00omCqW7g@4U%z^PqM))j3f_ekAZ&LuDB(5!s9GEm?;(G7};UO z6h=_-tlVr()b~x#-&QnL$&KwgF-n%Y#VEfjIt z3nY{pDjg7QEMH=*`f)3FQ>>-q4`43^y&@ulRPxkW+i6(s(|NeGUr+eINutnswg~Ct z^deWC{-Zt}O-F+FL`3x}APQ`?&pqCJnA;PIli*=wpgi|#hF^l6kDhc9|4Y{^(#nN= zf3^L-k=dWo=r2(beqe6arY^njyFW_xX+628zENSEdDGu4Qs^KROkDu(w{8<+|4qlX zkdvB5dk>?SOJ;n{Gj(l(rtf$xJ%_1FY)v=1q2J1IIxdk0tn`J!**Y@L`H|rnZon|$ z`%!w@=;P0H|buE5nmztP#`=4k0JdW56zwa=jvt6gQyZcS* zqVX81%TeF*wGQmf&vxiSk?1r_Xm?@3#|*Byri0)|0L%QVNV%Gg@b{ zg)M8GPe9{x!x@|tRIjo5_4^QXf&e7*UG#=kb?=*Oy56CNOft9Tv&_ja*LMqyFeQ`L z^+x`T7kfw}eDbV#{1+Wr^cS+Ib5xO!0f66DF|voyw!#*O&u534o(e#pu4S zn^M&uq*NJ`sK-~J659OQt%mts!c%*HGvK)GI!vk##`&U`W1~xeIIqSS`TWYeV#IjJ z?`{IP6l{BNpa4?+Aa?h%fXTbQRHm3T!i8|Tmr+yolvi}GE>cHW=+9My^Cl|xT&&N0 z@4ysXiufqh8uwatpkaxL1b903X61f9eNS5b z#&;N>lf?hxqEk2kZQPe$SV+I1PqHAJAF%}YZ6~cfz}#4Rll*oEnuS>=D#D~J94zU<$K3|SMY zDa!QM3T{df!6KAF@F+WhL*fX^ph?ncOVtHt?V${&)Tn2CGga1QH=9b*F4$pr$KI1G zbAu`MZ^v=W`OHic;=xD5V!YCh4M-mI$yiT1M1|A(!s6%eL^kM_TRQyq z(gG~}?nd5w8vm-Rv2L{v=Y3>U5P`blI-gldgO_~QVCK&5OXR)L(*a-lYtlw8<5~st zAw$u310*XMQsE}io}@-x@g7(fSu&o$)eY+EgwAxh#aM4|2Ed$+qm5N0UH572`u_dP zX+73%GlY3Zz_VUr_eG>Z=;)gETVK3hd9M3Ihz|N7xD!WPn{cCg4==rTCDg)dDZ3_& zZ*50yDB;0y3_?(uuZ^|3$LV>g(XLu=Y&lgkawKCX<^0yPS&y~1zn;{J6=cR(K3x$f zk0p=TQCHxiK9Zvv6dbBYQ2Y>lVNufL%@nsR9(YB) z(*a36724zZQf{^A(?g^IslLHvwF%F9IP2Jau1f0mobL8cz@!9e5Pl(&oI)kQQm~JlMm{-505H+MmBwG5&N`) z`Kp4kzL8;~H7kY%gKROmw06NakPU88(D}sM1YJ%&Cm}Znhmyv?jD6|r1sNIl`q|}P z+}{BBDb60jnxnXLdtXRThXthp-3j_}V6d^Kho3Tj2aXujQj_zT2s zY1J-lH1N>nehgnoh09u3^JsJKM<<&?uMW@@AxLFaPfuHOXDkfTE9@UeB8pAx60Df# z=s3W~YN1wZ_bA#WGl;?^muBlyHULqjHV5EdYYnsVB`=}LlHO5&b3km&Vz)XWr9EIc=9 zk1gmN{zqnRq9(v|hJBa0R82=kH7?t|(g@$KG|FI5WbnPrD-YEBz3ELKTbDz1q>o~8 zD4A_(gQF|qHwkv7O};KGL^;obG(S&is*X*O-HPygR)kra^{jx@3OY`|CE1grXK9$xE}kQ6fvGov#QkMxglV z#&8;H>RC!UIxmjDk*7*a(;e(WZ|T5;1-BU-D32v^^uJ$+w`M5e)g<$IxiIeCDVE)c6Yrr0$+F42&P-E7 zF?Qw?ybmOfqik)@iUnaox$2o5?I^;N8Q88ApPWqC3*4(G+VwuD7X?B&4yBCOt?*2# z!L_%`PlBRw+@$hd$RpF+YkoYl-1mY7get9Yf7M9cA%Wtq2;49)1A2TwW*dnJD~A~v z?-vP=v(d;O%?B3K8=X?6mMI5tVovnb@(10 zX5|YTKbQMfsypk(0tRUA6+divQXVb_4?BX!>&Zs=%E)mSN3F>12LF1Uo^^H7)ageq z8M!m6{8n};yj+}X8_?*N5ba#(mLItIt`OX>_;*zW42g3gLn*8EBeC19xc6VcT|@-t zJdehf4&VAMU3~9uONNVa|H%AZ%Ktw6mgEalJre}D9H}_YxMkYjl32G*gSbYEP|@a_ z{6*)0m*hhI5G}6P_#mFZc8%W>le1n=PX!}U>4I@a*mKQjU>{oQayeDkx}q=-&uA6j z)qXE7dabgQ)iI}zG}snwL4G``c%+qu4)m2qxWA3FNoW>I`eRk=f9h7tdjxsMt`GBn zZ{!1?qTO}-^rEdLPVmFdp2tz7zZro2c#)q zZmelue2{Kat!>#w+BX$txtF|gSWkvet>`?#Emgnp)AZ+<{%J3LkyYhqC5=p8gNlzJ zuPfrtbR!$LX!@^TSFfD056Pby_*(B>!k%aOG`~!Gbg7Cm;zNhK?%rRjO5k040_-IA zejRvpnz?=GUv%gi?Mat@I%srY|H(mlqbNw{*S6l@$YUWKfc);Dwp*OamR+R4rknl zmuVd8t3ew1+Q57N{fMFx1CuiMAzn`LOfK5|L(3H7+g{4;xJ6Mn{xxeejhT1<{ zVMA(c?SAW$g0~>-t`M2I+}RBhjgrKW%z%%|Cy`iDWfq<=%}hT?!&d|t0ffJYc|MoW zxv@98^eqyZIQ+9@vi3u@)_@Z#JdWs?%W3%@&3iHk6?rGRSpOF$sLyi+DO|7gSaoBH zgUNU@{%FZKszl-7G$59*FMZWdD*O87qmtfpYJT|YZ|in4et4WY@B?*$qHFtxPVy{F zd%w+|;q_elDs#XB4JN=H0Nz;_P6ydH&B8C%h8PC#(z(-sT~|br1XWUYcg0vE<$(HM zD99=dtxe|X*A<;kHpX!_n zu3uzsB(+-4|K`n-O1eomb}UC7C-iXqYcN?4SnlNe1h2b9Yu5rm5VWC2O zlG+SfwCGI?3M05Tq{j&C{yJR`XEKf}^zf|rk`%%`h zO_Y>;Nwa(NW{|ihX2r&_yQeleX$7y82Deg?pQmh(V6$s8RfXHAy&iO2by)TP4a zznp#&Y^yZ@GyGe$WPz`JtQ>PQ`>t<$32#$=(z<@(FZ$0v-+6Km4{CWql_q9cnP`#8 z;JWzMCgMKv5tt&oTC8`A|KsGxkGH;K-#NmLTMNJa8dJw28gQ|vDX|ww zK5A>t9pRwYL{XP|jZ_Z*>R3^F?DK%|jT_N?{Zn|RvoyX7%h9amn$3TE-MNLeJw`+J zdczPkNVP`%??}{lkVFJ{h|UD{x?}q8@k2*RP*5|%+m1#sfgk%ZfVqs9bw*m9O*vjw zA)N1vh=GfH7Ckpm%TTF#d~qMo;Gy=>1pgE-K!~eXe_im0=vmp1jKMSa^=Dvsgu;1K1}|pmu%oj$ zkLLI9H1E^MJunADYZt}g9&=PB?{sa8P=rVG^Afv%i!>RQixkz_Ie2-=OLt=iMR#?M zALpLWo_Ycb6DdcoFVRAjIO^lvZm~4OBA#M& z@Uj`Qn|5*~YcQK7d%^wOB`5XLf~$n=2}ZLQ6_Ir15^LF)GB9rRhECn`=xXGyl=>4< z!`SKcJNd6Wl3pWv^CNGlm{;Vo%CYwgr>9m6I!L#OK$5B zxFzz<#&lbuK|XjL*vzdvYsN@KW=`o}nxL&jXNoUVKOEM~Ry2)?I4wGw_i0^-Cw@&z zVMtsMja9va?7e5~7*0(R$%6ivGBci#wVMOlH%3w|2?YzRH@;1=i~4V~(YX#2{dJ4} zTE5~2%ns3fDZ392n-Ymx!5mc%jdSBI>uTiz-x=*)Y1Tpk6!;gl=#-V{AN|PFNsfmc z@4!Fo+n)2b6u4eko(j{KYZky~hNvfsORcV7nHMfYyqsGC1Lb%QPHUcRF4b^=WJ zUY2c@#@uWOeem+jKIOkq{o9PAPJFf!-@eGh9Y!5Kjg62|rV>U6KBYMoyB?$?zWCcL zG1iq~e#$wG*lRaKyqM4bkQ6wS-FOh-5bBT^;g?Y+U72Ml}8vOCct50$^jhy zjDT_`Rgl~By#HMq-*>Ifw9MPf-PG#a>Q`x@U|hd<0H)?FqkH6va7zie=fRPDN}v;@ z-Nf~p*}(~wwp1;npzz-t0RY6)_YG!;cwPQ9Q1koLb9@6j^_oyDrah0|R5e>f z0slef6t3*s*Dmpa6l<&(nDd0^Rc_o)SP$9%&(6U_QV;oO4f#{^q(kO@tNPri6g17? zh4*~Pi{kfIyEX>X4hvlGr_G{}@R}YLWBLqwmh*Z0HlgYoVc}Z)-*RPb+TVJ}$7kvy zv4+#Z!&-}#st%LKupI5~X4^Yi3AS-Vz4!Jne();+=!f^#CfSBJ_j_AvT?Rd;PkB-# z=99S6os?pQ=f^gzQh(RYy^deq`qX4JH)s??jSV?Eem>uJ5tq;tO0%XT)kV1z=s{aI z)6o@P;)3vRLf7gS>*cw%9DO6AtH$>b_S_k;6!9CND8v2zDS^a%@HB&`zdgOlwD%Ev zGB*t+kmqRT5My^)hgv8>mDK9M@iV2pVyh>^4VF8atwo2b#m4neOI7fx;(3!E7JHi& z>)~`;eXreW`li$KmnqPj=&edmjw3LMkS~i$Q0}*#yhw82X2AkA4}k$X(f&^>qw(hZ zo_w#TNaFymCpyUuRojNNu_~RHYWfaY8xpdBfs#`dr!A>h#QT4YB6o>=XAMI zQs=J&b2)n0VfS%~@PDyREsdG>=+Pc1M_xE4G38X{PVimuaB+NLYk3vo+mtZ#s?#*y z+4@fAi1dj}EG5PfBZ)%)8I{jnF3e92<5fS^_zK17UpX>WyqGPJ*h-0+B^FK9h$%;4 z#zJcD#fv1aDY^|^h;Ax@$V^)J{jxD9FToIXK&s2f&I6wb61(gWTINo`ez>3~OKW*jU zhkuI%3lpw_SzlE3$H?ftnMoVutJVC^ao=A(;Ei~Z zB0D27C-G_kHfY?^`C8q{3D!TOFkLNwJsP%8`8$WFn;tvzNz(`a{^35@)t^za+%2go zUpa+BU8`G7`-gyovi>{|#wu=1TLpa(i_$3w(Px5%ckfb-uE@P%vV zQYsCkQ_3l$dCI>XPR0_`><;UD&5UHkh&XIp^xcG9A~={;8bG8T9&4dU(;c!|1)287 zpvC%aPWCn(<8q#s7Rq#0Ik~MYzp0-U^phz}msQ&ZO#xPGNe*ut`ywJ3NVb%mon_e0 z7zyN^<$!wZdy4ZzzWjZCHTN_jy*?V|vMKL>-FR*u@E45?hqB{6FCPeKHH+sjZJZl4 zO)Q7Pjr3XR#D&8T1?-%@9N?W1otmP5lY1(gD@?>DWwmrPGR7Tj1YF8dP0VqQ^LBKn zhxzmssLrgF9>#<4=3n)bGL$oR_@|%F@!)^asRC>@*&Fh&vq88xbFijUp-*@Ht};PI znk?t71ws$Zu*yBV9kJXlEu84YJXPKHJxtr*?LoK2Z^3P_itASofzB^`ovcemsKn-q|i&OuV7TN+flySpTY zA%_^^+rH;L-#PE^`~_Sy7qjQtGtYD1Ypr{&i#2WELT%-l`Q;rQQ69Kf0DB0EshfBU ziV|HAN-y)>k#!iLAT7nI;FvPqYJk$?6_y|UzHPE%`Xw8?)Ds7|RD4^uAx5s9L;R<@ zp#_TNX#g+xY$!vlbqs@Am(1a!#HzbMLM#+TCN9K! zGViFF7pCY~d!9L4KPx|O8 z#c5s@tgU=GpJR5EPD>(reKabCi#$H&Dy)}uZO>M}{q74L4IoEpNfo^3Z0IIli_z1P z_i~*aV3_Ryn3}&;YLj9Y;Z?U8-`O|slneTnjoOk7I_<89vVWl8ez5=ffyJkAw$l(_ z=$M@F*K+0gm9FagS!R^q?EIZYB-Ttn@z-fTUVJQB{)kOfKj#&HxWG$_H&uo|%bc2} z0_E#!`*;Ckuavc1jWb;&mBnK?haj>WD2P@-&AcEs;56f($BcEXQ->D#P;Wa%wI>0A zS^uDPBp2g!(dm}a=CG*06|IbS{sJ`UX^MN0E95u-VZ~~YV4rAkW#4xH8u811<@Ff~ z>FTF~URX7sxN)7hUHB6WcBYy=t69GixU+-EPv}IEN=?$DX|OhK7fr?2f#iYfe4U@4 z9Eedl0c8XiGJ%(>;L$RKhs;QYH-PR}-C1?Wi-by4yTnsh!M>q!D=Oe0pRK@*hySX9 zZLtJVHc7=?k-g-<32Q#~nyZXhvy#kp7(Fdp+jdw;g1&ZlQdNB&e&P~OP}@LA#?!}1 z75)swF{A{DdtL^9x`+dKengMUntoP%PN5mjihcjF^wDRWt=FX^OzF>a$U}ZKE0}9> zyy0|^2#_KBvvqrM-Yr$r*IpR^=K(F!u-NExUSAP>Z2Y5S#VD#7b%30x6v=C+kOv>9 z*ytbnjRS{J$u)4iD{wjclusw02G2LN_M8cIzbwTLHQlbZPMb>~AWxwdcPzJ_AG_fO zI6pm-Ahye|Vq;-(W^;DDB%3)`KEoXEyCEktdzHxfFi03jUy8@A$Mw=8zTZU0IMlXd z1O1!h+e4-C!kGB|eWu(47;5;Jjjye%cT3mG9*)9Og(0k~3QuL(-Sz}lHb}9wb)#tc zvnhBsfTy_0cmnqbU{PpXyLwA48**Oaz`2oh(kgx{ml}`?Xhz%#FKEr~q_X6@1Y~uu z?L-V?YzGA77=H*vo^413L}IEbqwCcw2@Wn@v}|`$eV%*>!4=Y0e}#gB>lRdU=VE>x z6Z@Y#LSRR9xLDi;eK||wL*jJ`HKGCcabPreN{X_Nv2)a4k|&2YRorYoy1h1mzKSRm z=_=t`di7(laBGK+TS<)DH>9UOWVY|KEUx8z>hv$uBaCkImUrl|)WIJMQpU%PjtLQb zBBRzX#y$uZD@Z)RGF-u}MoY^QZ0;QTPMKl;lN~jZ?=cC`{jjPB`c&P1u&(4g%OX%j zV`O>rhfAm13R-P#eQdDI0=?j0ff(tYW?l*F>L1a+F(`{Es(K$563df}qr4e{hcZC^ z+C1jQp!q_#j^WS7>*zGTM^pRXAN>rNe3))G{h-DBBaIaK;h%~Y?~RJsG?AZAu1y@m z$797z8hne#PS)|oBod-WAl}}^JcHu^(?AeP?q|y2hx=wfe^Vy-$Zm6`xi|Dxqvoa& zr%I-e>{Czp&x=&vg}1hEn=$VWl3aw>_{b!%Jy6pCFbSqfM3Gq#iY4g|f^XywHOZ?z zcVCe|ey@jtRQnXOR$fn`c`C_oZxi zh#v}saYVR8i>TvGW_cCQN3=*sQ*B&8QK1C?g+VDo1!{`(D`=bqa_DLO1rOC?ug!7(!`XClV_rp4!o~H|EbIX5=JMa_aXqJ^HRH`uS zg~>QRiZq%4aA?mA-;H;Eguy1_AYn+S8wa_m8KXg(?LGFR0=$EO_XH$1vL+VNjab*( z%*LS%f2`fd`ZYgCxn=gGf35m-WP%ZQy8GgY&!jz-;}i=JB5-9!LER*OefUIy%qJtx zW^cVBcK<=)-8XrzBF|IE)UzX+=YQhfWvk=UqzbA`ke9IZ{78B*@@{9$=Q2j+%hM)1 z^(lNa=o06z+Z+|BqYFd$C@SDoTfT~831j$5D9&>lr;1h7qdv++w}*v7cX$~{l1PxL zjfT#0rpI9lC__pmBW@4mTcR{33hq-{B>s)n%uF*KjyMUqiA~@FCM5LO zHCq)bjLUArRy=YOZWf>#BrJa<-mPEI)={Ak3A@$I^C9#Z#zpX;qE$-Dia|h%@L$dI z|Lp7~(yKlv-YL&2W`FJ^auP9XlS+;AwpPw@aEgDUe-alR!SFh6yF`vIG595>27~_Q zRpdLQNTkJ?9UlE}GASNo&|>hBs9{6rt%tWJq_wxij!9a+8unf$`rOXljbb2EGuh<< zJrfsyc4j^Ql#1I1gn}|;*aUzNm}L?k2XZ$yjxlUFdY7J0axK}q5rg_gUcJ(hj_ z>^!BwuZ(PCa41ctV(VIQ%bNMwo_LI0a9P$xo>?*e3g-L}40rE~N*eHieJdV1PZzsM zishqnHM!i$ zvOh?)2p7`CKE0+ea;k;j0ICT)bL2OQn95aT1O2IpdUbMih zHpPwpNLimwY%Xxa4^~VERr6;_Xe;tO0pxsDV1;J81~TrxIr`--y&M~ZdSrY0iiFa( z$nA-l5dOq@Ww`nJCoy@ytCTj;VtpTGWX*i5{?gsX-m7TVx-2*5KW2@77!zD=g(C+E zn?7;fnK4^%#*>#&gM|-#twy#YdCuJ|e-qWF4Bir;L({mO$l1E?cHcGo(CX!%IHUw$_vJ`SNxDd4fXXi~ zKf}T2E5CblCptC0`ZTz1%!s?D;bHgjZs%qLmuh|cv-`OIf{Twl_mKXbrGxbO2`S(nB$hg4#Ekpo z7ZnYgecYfow z&PN-m{k|Qe1d_Ra{Tn0u?;op8(sYB{6$=HCftdfO>JmnIFmM-N{neN1XujQk`mgu$ zh|YQG??pBlG?9COSN+(yV<<@MvSsBJEA{D(BKqCgbDU{Xk$Y(4lXc^N;=l|#s$3 zqk+pu`pQn`@0C;kvR->A8PL-Koq=Ybl9g&fIefd_)@1q?+l&)+I{&;cyzlmGP2fa* z3>a(wef?7BcV;uMQJv2WZ+HKQI1QEU9IU3{3ob94Wwq`Iiw-$_q!kYgN7MVx#Mn*JZ<9jz>b@P_ zRfhP$=#eD^1ha=`4weS3vm*p&1Uek-m5n5<2X{IfWo;f&F$R_0+a3^4_)BE06TAkk z=7hFFfCo(&0xvJNIDU)$*nv=XfOiH!CLLSLw}>xIF!zR(?l z;c_+n%RUQl=LHWC3r;obxe~}fd9hhiad;|L zo)_7D030ELJf6yh#~eoGFLbEr}}fu&Sp`$SjV z4t7w7hpBf^vFuQ7#ZT=vaRrDJ&KCA3-nnj|wO_2+xyjDQ7*Z^CHea1^v{+Ry%tU|fxzg7W*UYl7Z zySfOtzCg^|Rp_ZW#U`aB&D~s`9+boinX+n?$GxllEyrsiC&vnHBbXj)blW-T2t+H# zhH|@qkAC{PJ2-1=CNTe5Zg-V>k@7;DAM&r~x#eK$A>hYB6!PM~=j96!$R^Km*||wg z+l|$)l8A&Nz*eu`u`cwKY!-Bju?KJ8ySrMOiGvMZ=s+}K8W2z3kW}kmwa5%IEh+*L&k+ij?yH+Oc&(pr%XU+Bungq>)_TY?DG+Bgj zXaM%$*mwdUaMNlEN*MmJ7X}hV|813C5p3eCeFP_^h`zDtRhvg-yl%g^Lwel&#%85e zcT^zdaAlaDe(q*RRMh_&$EHF-+Id7UO+ql1j}qo*1y~i?)v72oUk|<>nbRQx#f7)n zWDg(9WvqaF)BJF@I|IR24h~SN{bw@F>;By6KAKIhe)8@Jv`Fih8t0KZXAQ05+4p^^ zDj4np%LFb=ZnYNQk5|x-hv{Oa*RAhlHQ~u4C!%+RH zb;golQMaZdZOI>4EqB~y(}h&nZ4dv&EUsY8!aBCu!OHT2@x@SC=xa!jJcP56s%Y2( ze~qJ@kd`OAS|wlDGrBoAt@s;)#jYPFlGYE56i@i{eiT`d{(3~6*MdRP4~wxeJ2*FB zc34;=ZFb+&Ca^C06oGgZSaTGp#J0G zKW}P>doXxczrNC-6?pXp`!p);^+6!!VNIHk3>tyAuZ}fpOvSAIi=Q4OS|7t#{oS%A;TgG8(0=Fkt9@&X6q zmqH)^R3;pRvVaP6Q@ztZT^m@&f!C>vp!;^zV2#Q`;4P*-e7W^5rk)g~i@IUO(Q2fA z?o%}70d;iM)g^WYmtWHou+qxsbSK1I5%-&a*>_+X@NJo5nPR-o=)tNiFHj<>8MW&CmTM zEFv64=WXpQ#zl;zt_24QwQnz71z#%NjA`2BXqcI5MAWWIKTK;wH=_AiN8jJ9QopdK ziBUueyee+}^j$4ONAHlyud<&0Pm+Z+Us2)Y^75R6%y2EMtzX3^j&yL{A8!NVa{J}# zDGULEWuTq+aKTPVH*$O1lB_rXv%z?NjbpSfQik^SGj1rjQEdk$w-VQu8Z-|NTeIQf zMjlLQ86{xIG%BTXc7`fhuMuTR{kxh3{ufBUPx%+H(iIiTIEKL8gM75p?Rv-C3ZFB> zsK+_mZ}uu2BEx4h=W1HI2+VOn=R8}`)FR>i{XczEuFGGZov*l`9P*cq^UE2)9bNMIcD;*mgqYaXl!<=qR`x*5R@JkYBwbwv z*Vx)4t7;I-5gr*#Y@WAm>g+$P$2S&5-Z;M#*(W)Qqu z3}&?X`Aj;mRPpvi=tALHO!QjR9;|-&kOp{nQ_%lq<&`2zKbRU-Dqn@Mtw1+EKFvb^ zIcS+$Xf=qq_K=C^XvgAxphlPXP|epi!+j0LwSJv07VV9;W0_dKg^(s)qU-m32IY?l zfGhe8&|N;o1QUe}D7OO-O{2~e@npI}cpEZ%=DSm>&5G}d9DjTdmEYJ;3l z6};^pjp#gBlcj9OJ6=LDo!%_f`t&L6Pg%qAx)e3+k0e8V>Q3HJ_ksU+-&KWtxv)pH z!mfjU(8$M}4&7%q++#)u=?;4k&Kf+*Ejz>2z`?ewXyzqAC5w+f%zEQEUbKvC``pbu zTUaM3=*d9J+=V|}u-;|DlGeyivQ-!{C9?>>wi1O*2hR}AmMhJlVbXeav?1zx%(*$B zzR}TS*!#f+3S`X>0_bdwnmp@TpV6a8gh4b{VCH@^|8u)>)CZeOJ4MX3OmwgibJ|0CW(dt=Fr30;okx%;krp|2jIPTBfx!sMvt-1_3 z>>SWeQ`g(tv=>EbR0?AxxJ?Vo(t^q4tVyck+AmMdX(+rp+*fhKIH$ol`%>`Y!^}YNz|*hJzB_iCV`LDn+XQ^^N>@B~29D z@yxn6oc6-WB4CRfrF|zGqTj3(#}zIhb(!fqNpE0Xi(4Q}`wY)Je((Foauh+IZX6NWUG{? z9HZQ!qO{am^unqD=6^`m{t+g+ePAZlvinKb8U8*GE1$1PMRJLsw6?#$Ifow|o6wVn zOop@R@q1As&xZ$4WVjIE@QYWE*FWTm*(RltzP|Z}`A?(g3W10k*r&8hRpRu^~x6;EyNG3$&EI`+Ics{HNcKQ)z0s_Piex1M2~Kq`oA4wL5~Db$m0b0gpI z<5$!6Rf#E1F>KwG-P2%S3PsCg00WaMo!Ec{m;52+kx5^k$!>8yFjG3T!HgiOli>?Fmzshn!>5S!>UcR^Ji-E|8Ffw#up|zZW3$l&f z-Q9YE0te>oj`q8hdkIo%7~*W=e$}mOd_DI5lAuloUjNs<-|?8s=}sS8JNZoInaKaH zjDUYtu^s0Te^1fU407^&PK}CW(MvW~ttOSLnh}v5-OD6a%{Pt0?$?QSjr963hLzM* zvvvHm&{CqRHjR)}to7k~S0HnhBqyeNqdWFOCe#mEyi!%HUg!lS6jI!mBeWdcc}g(W ztEZ=zIeP5J6QbV}qoAik*d*X{Mh>K3E<-rxYaB#i zDpAN#ko4P{V})KzN?ka%hKm{XD!4I1WlssMgMN#rk9_>77ugGmb!KOs1Zu`L5c0&g zOXYu#8b-+NnjiCwK;ig|DiI?L@QN3z%ViTKrPUu>Fw4vinR2(Fu!HJYPueO11l4IO z3hpznZ=;tT+@kaWomQ=KRhX6|>09q_y%niYV|IXZR!_G#9tYoWMezr6&1MdTaYSaf zL=Lg^y-0=1DG2>aS!O+#034cLx3#Lt4ufCNaJrT`5-9PzO@bF~|Lo)gJHkP+9+EH_ z>za2S+x+V}=~)x>t@vj8=4qQo{K_$#BdCv8-)g^FXjk8Tulya}cB;I^KRbWEzm;(l zZ#NYI8qK$UtDLPnP14X{Fj!c6bRCF6cBZ2V4snQ0q5!C1 zGAbOLh#J|St+E8rY2J^N@XT})Z#GtnEvXAkYr;$kd8BiFD7D`TaF* z#iew}zjiyPt}nk;Uib2eI*UW5;tnR`Q1H1DjYZLiq`8I^dBC`^x7=>f1)Xr0%R6t)T0m46ne=*M=EWt2gbG*%)JBHS=Y)+L|BqhEgemB{U z*CatWLA`AHwH+)LQvs3anpD3DwcYnwhSU#9F0`poYB=85 zRHhRrW+$35D}fCV2>%(o8|!wOt?Z1E=L}fg0qe=iM($3ltbgN(|GT2;IR96NQc7zc z`EA$ei-2pz;4=2$Ln6PMDjA36#YP-LJ|(77dGS@-EKW(=oss5|j>vApLF3FSbWF;~L$1oTP7QMl3%v^C^TOILfAc`#!%GDdg&y%aA$pKFfw7 zW|DsVRx#RP3ryDY8e@P0>5@KHnsMhn!1l~sHTDy}29Kz$B*1&1kw)(u+~9lqqGbHprrZX%uF+C{pXeLEXPVU4k<`?*DQMwcf3x?= z1yMwd`X?`U1xgeM?~|TTU^2Wrbb^VPWW;1uY1EyRagZEqIX9UVjm*bv^OZ~~==wUH zqe9I4c=(YcX_J+kQTp{@?Gceo+9d%hL}p7mR)J|M#Kum#tDo z|8cR*5xODJwM}6pj7Yy+Cqo&Vs+r?3{mA$&wo_KspJww(u2Me@qZ62-%&zdMZ=gP* z|0tW-f$T^PNRgitIUO+X0kzrv7N?h))G7$_tt*jK)sUTK0^VZm7YAa;z@SWwej>Ng zRk&)d7%HmTb{x?DMRd}F{mEy`c8SiTZPwgd=%Vniw-BaGI%1>bmJ5F0&Oc9I-??5j zq$mswS<%dRG$zKHu>i$4A2TmTSkRLHn`8N(E_Ah965N(KD|U^4+g7#=xI=i|*=M%v zsAz3A2>XUD-dwT#3{dNOuo?>Y%}*dQCBc1%ikhOi6caMmMgCX3iv|9xj-ZyF=l_Cc z6X;CQao)WF@n4xs)UKnyPXIO4N8Yi*&J&Drw0?K*FgGnT;L&Z_TQ zSYf#t1EK3D0Ekq2gN!2hxOW5yF{HMi!G03%OI5{(b(m3%U&Zs6u3U%HOxzugv8w$O zB_1atFF?7rOT63b+R32D@NWOj(oV;48rfzR@dK(wQy~iy*Pl9GrxSv|{pb7WI1hO6 zd^7J|taANWoTsd>k&gsC*0QbWhH_1~7x_$+Xx;xkx+`A?UK2Juin#gzIVQ#EI8TUr zS+u+6XsE9k+rATh8bNAwk|zCK%15Yy9Qfce8BtA-ss9_U*Z7N#v&`nI{ry{$?x>5N zPz0_OB!Kz`~3m6q9B(4t9J3wfVJhoLlS8Ri5Hxa;cEd zb$sZypJ7&CWdHO8dHe^Nxo5Gjzq>Qpqq@*Eej-V&Vw-Zolgwju0?7I~-R}1scM@;a zAj4Z9{}aRgG51%0zf*}uM+@d9E5E_T!O85Ec&D8C=3mC{{r&Qwigefq0v^*ZSYNW$ zNhCF=OBqE_Jsanl^dOe&Cw|rqd8y{!=mGJ8I5=$>+9hERfFfT9Md?uYT2E~kz@;iF zCB*FF#kxv<7YDZfCjf z4A;h%mNwu=lVcQ+j7ovZ`vB0hb~fti>(U?JzO@f04F`%0X9-$mWo7;R@w=bN`=+!m z&-cFV)vGv+zA0GajmtQ@*&AozPh8dna;)@k=ElgF6Qyw)LDA4woSIT_+YE18l5W z9fu1u<`wN%$wRi*m4c4#Lx#8KcGIrgQNoDXJU+lq^Oy8*Rw9@1M-_=`{@3_65-(I= z0I|m#Jv#BSM7uS6`Au;Htx>z@{6hP8NO;|+Pd?1<#r{4;VtayH1s77}5UEPhYY-J9 z3IuMBWwNyIPEtk|z~N%Du?Jw=Q2 z%=$t_PNH!ae}S`siWb|8MYjgwlO!Naed_MQUO0qxMD(6j(Elc1_~u9wOzDogb1h!t zF)H&|@!4^v>ZP5^-v#z|lC=)znPg zc802^JXajf&tKoR{IDjx4l*{M8O}mv%&gQdI5tm#CX>cpwvji9sbm!gz>jg8+=Dx} zh>c>!dS$*?zS9MH@8WiF@aBK^a!{hohyLSU9;eZ;y@GP}%_3y))8Oap$L=p641N^g z#sTf#q;O-O?Mo>73sKd0F8j@3D+KrYfOvY=lXwB|_57*NwN)nc&osyuMl#H(OrN*aggJ6V z!5lLCIa9)e8W>EI&0#lc_qF}Uu_EL!zkxFBHT(S5o6V!iv!y3T-Ao_1*^qP?+q{LNJzu4G`;*91Cr&N(e~%1$9PV z6*v&#JG>O+mZu@2I5aQg;G<%;o~1<*tOCdbLh-ZfWG6sc`<%k40`*(z^q?gm632nh7&VhglT*BJ48; z#}$0>!+4X`$Nd3XFz{OGR!jDmkQL%p#RQXsYZ2-t?|{9pqIY9=^Wt;mbaS%I+O2TP zjnw>>Dzg&lKjxZj<3HRN_?W#W3cRxgJ!7&2CKynDY6|AJu@)#9m6O!hmrwIKqQl4l1i2`sad#cI?JH9<4}5Bc zT+A~=OWpBKiPDCk0!!;Ki-s|F9sQQmLkJ&a_!a1T;5R}#2(`lCR%hm#p?aBoBz4-6 zYn;~|2)y)*XV)I6(~Oix=q>2_EnTnzC;1T~ce(2fdd(hLfx^z$Iq5Y&G8r)Aw$&m<%?+U^vR5Wop+TsxXGfm&_dxs(T424YU z{%Fm$?3d<3qg_hYOk<_>7=vE!)rCCy7qzhM&<6qMZ_7_}zWbCe<(`@iAI!D+r_Lte zQwzPw#J#0T6SRt{y>sx#KLA5ymee|)EaFoMZSHquf}RWx1IcV|ChF=FC}cv$Y@A?5 z9qtwp`hVl-{|4>ALA@UhL1CE_>Mg1_E*$c%(wQQ8X`&o6>$1UrPdaD)a+Z|n@IsfK z@~p$2w!LXR>BS4Zyun_w$VBrwNQLa7)3Vou+~D6m8dLg(M})nnEo1wAXBc+Xe2_eP2%OZ?D8=sz; zp1iKgV;GNHb@D%@6kxNa_4$E!v$+eMZ#8PdoVFIdMFN!oXvTB(hJgC*!Mt7RjX%dqcYGkS?w(OKa#BcUuL4b1q?t1a{T1tG!c|4D&MTgx zV)7uCmJAruH}sE=j(ebQ0)1ESkeLU$bJD8Eea!o3{=K{{6)h)rWVNsKIamBI^Pq2z zp&}0Hb_rtu%j=jqVtt|83E-%X!4k#oD6#yl-|4#tZt}k$t0OEJMzA#Ep1TJ2Uw1Wl z)(RdQw3`I?n#J5W&b4&?1*#ojP40+82z)_`=#&pzhcLvR=s6a??Y^!45x2i@G(6C# z9g!}4wi-OmK7Ms^f20ya5<<;Np#PHa?HS$&y-EO%Gnev<61C`WM34X7U`-qT55pT> zcIt~2&x$qqKsxIh#M5L(TK}_n*nCY-+wta%AGG!6q@)e{ZKAflk9Rk%5Gi7KBv7eB zKr6z4>c1%GZ==(QnDl@cm1AOk!KW2CD1W$eJQ!)V-B@0XU>;m@&GbtJ} zpefe>oXB&?>#)(NS7W1gO3v$p;hmuJvZ!!M?|<^UKPb?DXz4u*UFnpRIj~rA`}(_? zE@su{!`GDtcHK8CX2F1g5|Upsiw^$lM?aydtXE#Rblu=uihShfZK`%x#Q+FbaG~gJ zV@|a-1y^)A(U@+VeR0Mtbo`zF`w%Q8K_<*E@3pk7Vnwbs>KcCUnFkqu`0y&%RJpoO zMo`48TM@EX?DW>f`IQt!J#m}hi4{hJQe=#N?XNF~6K}4EkV+4}U zvM_51tZqg+o9{3;kf}#$eIFDET@d!o!j~PlhoZ4h zg?~PnH)?kbzS#pPpGA3%Mv(oCvC8%v79p+bilV|pQa4mob1c>9ZXU2P-aSB%YXbca z%Q3BE+E1HR1Uwcz4l1Fy6C-Y3CGgx_iDu+s^TC43Z47l{{gqBy#|8kb=kfZ8+N@l5 zlk6esugu%&$C23?F0XeIk36jcD?#P$<*qiuFY4wh4WQNC+$QOP!5Wsicwjx!H#!YC z)G|jdJ6WDToZf6wpLmb#P5tFGX$E0Wu9`1CUiidy47mn&P%tom^Bx@-zqjTGMi4?r zPsQ=Y&%QyVMnE!u^Aq>j-62wRbU8UGtoA5_hZ+6N3Ub*K z@9U$}n=uuC7J8ZHCGQ#P!~TwJGnJ7{fh7!Mz^Egfp}GNioM_4=&42JF&gWRp z9FU8w5~)>!1sU23cYZ@JrN+nctX&$KuZ+Ine)KyxSRCaIZXuXBdG3JdR?5i7TQRj5 zcg{lz>E%~=-D=;*z)IQ~7oY!Y9V|riDteg#)6ZDJTH5%QF z-|es5lwr0bL6EB^6qn4)`0b!_xEg@~CEE$!d&!`wXJxP3)~xk=Sm-FwAD*O#Kk=(? zfF|*|M>-_)W!({BaOINI7&4P)QXl=%>xP6LDj!M1XZPG19SIM#at`6np&ycF|M7-qew)6r1x_4!w<* z(j%Z!+_}mFCg|8V%5v(jPuQ)gr4!0l zE}6ypO)U`-;(QhEna`0m>tPANHKUO6u=mxRxrGok;OV223K`1<7*% zwV7QfafE@-n@+MHs`03t5Q%`NICs?oJzmI6RtyYXw!d8hV2rivaBp!&yh zv~lC5ObR+Bob2W6smG`teD8|f9=JwmmZ;ybn-WV?P=U=)@P=zwV_cO-JVrRAA^frb zbR7c1}{P0uE!l6mpq3VjvRVCXU0yA3RqY~~?m%aK%< z4M=ncN-nMoLmYYMES=Y69`(G{jkPezRi036h(d^r%oIsp0zo8=Tr%TmD_Dxc+)K(# z?H+Uas{C%%6&VEEV>?7AfOI8`YZtId{O)tlaNin}VuhsbrSPAOO1bN#MnQ>oDN*TVrIi*#L-sMR~B@j6Zz??)Lt7H$qKf=|2g=OBovM9<<7iU@-$}~ai2IoKB z&9I`N*Tjx;xyW9M;nMY&6)`)1+h$E>KT^Jg_&#_}WPNi7_nVmp6!u#r+g31iBSG!K zTy7{X4D`zWf{k=KU`z|hBf6u#4+HkM?<#t!ZiLgC7zt5}Q04gPT7>-LE>Y3r&6KDk zeIL|nIzIX8-gT0v-FAj0OV_f~w8@auM0oDlN@9)ghA2MKX$K+I#t~r&n!U

uVi# zRmnG8+NjdmJnv-aY4-(_ zY0~R`x@W1VZ0!*0&URnV;`NgYoubNVEJNSc52VEHVyKuQ#@07P0rZJJT4P5tc1C7N zft;^qVmyidM|%D*Q125q%3;+HE2CQD>_osS%z!Hdb=Od*b=YxKy+Z16L*!uG81ui3 zPtl2Ml?vB{di>6XFJ@_P*DmxomKGQ7fvXf?tFwj9CJu{+`jde0ZY=?zBd z1HqX1eav@HfLDueudHTz?|?tuWMr6`=IJLaFHM$}aWeKS^k_Ng0qX21GaFbsg<6s|+B zq|*3=SQ__KM>xkdM3z_lQO}2M zo^~vH54cS&Oczr6z{_{FNB4rA$cAAq!K=qTr@ETkN_@=9p;L%%EU8*M^|`v!;IL6* zBwFX{b6GER@n`a)WSt-Bnb;qory|JteulnGc#brK8+si-N!urpa;zE35Y!Sms5u)v zXQa?7>EWFPgEoy)P}6IUv0&N@h5#i7?$PBCRcc@7}U zSTp%2Bbsx(M;evz?X>vy%`onjcTdxw#7?X~Ov|vvddENj)dH?yxmlq(uIh&L(UcqH zwmya!Gn-Eg^Xs#}Alx}=O?wd{H=WYI9orp}NaTF^>7E)tAbO@IxI%B8`kc`{Xq3&M zX;u`zyp;OdfJ{7tW1UBCdo@nCmjSR`cC#F+<`BIMP=boILe0gTN0Zmp7a0<~8Js0) zVtJvJD%0ieczcor%T7jD{V7XiRF62fKB1eC`i}^gJW=wit{@oMepqqZDwXTxrhWl3 zJ9-m$w|9ysGBp0PJved;tul8z{J+A)qm$lIGc;JQp#rfFV+r1D zFufHJS*qcs4H|7SiimTc-5-Qopw2>9zLOLmvI)N$+r1aHnE;7|1+JS&kMf zibx&oho5!04!T%Mw(32hlQnLWGQ{L(_GAbmv_`#iAi=i|;z}x90%^_0LXYp)PO6mF z{#9>{*&OxUOJW=3-cMbG+XIpmRxGL%V`KEgauZ4-w^Qc4OTi94-g(;obrl-oK~DE(tUZYLPe}u5=Xl?`#VvLKGZAs*QAa5O}fcH zSffwWD2I(dRDRzkA>rO`R?P#pi1^u*{X}Fp=~7;MDP)DMDQviKVe)Rn2amVzk3We> z0C${A^k%+Hq}?`D-8ShdduIck7W&F{E^teRrRpKCt4L~U>QI(Y_Eq_O1uMC|H+cJH z-FaG_JA(DS!LadP3}{FJ|@+JG$@FZ-0A^s6SPNa5?pSBy(VauRi=5 z)R8l%;yh5I%6DC?&rnPXow~ybgFU-{ z<&7OdWqv&}+#GxNRaqk8>aED42nTgA;ZBHXBMFgObWR}RTMvc$r#nAG+prTX=fzA& z9B<$ymr=KjK`pFQ!SN=K-Ik+_L;|45y_+DAO7n>lFv&PlB4>PK%qDyJUOihlPI1tn zBi|)Q=lS6SGZQ6FI~nUyHZrsjn!#8BlHaj>#|<1Q?x+z}`CMMW&k%vi=UC|Dv*aW_ zor#IR)KPA(yGOVXkG8C7^{b+Cgsy5OCy@uCNoJ{q&0Rs)d5<{eKi=^2adrb7MtBz& z8QoG3{SV^oyA_~Rj0JV(j|Q1N{VP>m-x$;`|9tf5rA#i~-p*dusgUV|d|!0iO#W4z zn5d*WY0e%BCi|9uN|nh$>~UvPdVP6c{;>UrlVFaQ&V7O@`)yw0*SWJI+x?NoVp@sZ z`&%{c&X+*9!g25ImaH-(qcDfZh`mCUHPmE4ozK6qlaHEHWQZ%L4s&tO-W3fHU zFTtMO*9G=ZMT)ozHs(CH@#a)sP7Q7CAhh}wEIJ5tfns$3uC7uE{F=^wi{oJ@Q9b|4 z(+xmUZ6%8#^&t~0OO3*w6sMr%AwFn4eZ z&!U&zZXDZ%w>Z}n$VS?L*IkjK-H-At~?aP)Q$yo=$NCJ`M@} z%m-IxTNz(=Xk+338anzF+0lz%#NXl;J^h!~q(lweCk`A1naAo|Gna^4R_V_iy%^Fh zLFxZRJ*KR1pkq&3y;=J{-?cekL7cDEX+Ty!7Qd>7S5h`t2z^|fTO$XPi49-`Z z2C;s7%Mgi=z!IXViSwKM8BTTios~=jwc~%MATpEDfw;|7kFf)pnQF zcH*|L@Ca*}QOkc4)QgK)XL~dk|HA?U{%%g6?9%*_Up&tRt)*a6<*v74$!;Uh6}LnU zo@;$+j|jor)L$qnFL&HOIC$JiSzvtqOjA{LmOoqHXs*htC&g!I=-CC^P_R=m4LnYk z!rfHyD}BCxv%q@Rwr}xWt6!afJSkCQHJRt=!h#(&byl{{caoNG&SI9*qE;i>K%J)W zLsi-`#n|+3rKOb&!ak-<`5_yiw##?d%cqD6y0Ea|XE@keTRYhOA*yPfh`T60z%J@P zXJ1wug2kGgT0g*3n&7P;t}4c0l>=(YiLCxbTaa#pZM^ZNJ_R2rHU-|4-B;Uf@4I~Z$I`@fV>Lor!;?Y z@xZC6srgc!n$jkpgE-3$uVHt0o!I%{C{nV4O(Wge#6MO8(`<;tX86KnvATWz{HNd3 zlasUH0F2bNd?}d7j8FB(8k}@tc|Fw=FZ`7*0*T-S1jKjVY{?eWY&?vOiNV+VVH~KG z&hyg!J`FC+kOcSrgs#-ftB6^3D#S;jy zc_LeO_zPh1Ss@PmUGd-Di$dVk`CD}bNVY#%OJb7zN}n8Ehjq}U6MqSOi5VV?@H~v# z0fr~N^k-gs%vm(s_P1%UFKpSx+WEqO?$>TH!vZ)jFcS$;LkOS7yV<((^DK>ibiBEl z?!l!kdoG73@oT=T2k8fI{xv^>-wLgpUWQ{vid0L}`dep7FIo*{TM#S)&~w-XvvB0X zU6x!~adBS~{?n(_2E}p99#~RTy#m^_zz68tlIwFVK?DnXeck>vm}|vezrn0L+Z)e# z5Yasf0(&wXF_6`>OMmw7YQ zKl_aVV1rxiy@!%zWpyHQZ?aGid4#35LR|P`yT$LMN9AUBBevDe6E-taOF>4) z{x&Po>M@%9H-gdR(<>s;pBwcbP3@PPMi2+fc6qPARA}VA*8fp5+PxLr<9&DiRFjpa zib3x2;*Sx7gI459J!;&zFy?<9l-R~cjGQ%w0Lu|j6v>r|N(^#80PKv-F8r|?($40C z{H5G2)D%^yEH*hbx1Nnc1ns}#;F1W!Ow@@x|_nL}*Ws@C*5F-5C!K-a5cx z*%7OgL_yhHkBt}SD2-oR@Wc5tYJS@qQY%*S&5yKk0`Z_PMFv6EB&othqBiET1Y2E? zx@#})@(&vT4wD`^9x~w?b+~b>{h#~@%^#cod0a`-+5XpQ*F&kAQ&VEfzC z6d!jkVJubuYQR;OtoCEVd)){Wap*rgc3)nc11KV>;JoR;m?q8!4^K1GO0}5l$s{G51|1grV zX8BzA(9uY1<~(F++6M45Gb2oA#1J&Q^xxZ zw{d+9_;9{>aqb)6tcHz2BE`!)<{COsVb)bz*zXV0gQ0#_q7l-j;drkoZ>t>3(%9U8 zJy)5hU>K(Ia(q$(8#VMWM~!pck(W7Q~MI+%~oq!J2#-sg!6c;UO7v6U~vA zvD88{p9w+x4H>Bzp)Hj@y4u>xY2yd38ub8bq&aV67ESs4yA0;?B7I($mChULb(?@N ztg272nQ0YOl~0G;ex}eiKOL9r8uCGYOkT9C*}-5mmZ73Zts{wm+1^Y2%c*P+A}rVRo}+ws>M;J|HJc_dG#Ok zQ*On8i(NIUofU)g%1jcW-_FU8X6i*wNwS2^GKA&K;*gKN>dex^OVO^>q^22M(3QD< zZekgAuJ3I|>|C$DCP+JE#)x2fR_vqW;iHv*YWg5DW4W}&kREs7$7tcyc2$SUZIVb1 zE2$)uYLR~aix@S}0zh-U}K~gXhW7oj)co;e(U9Ab~qWK8&##C#a16R zJwqrKV?x6Me6ild5hlhh$0qFhHND%B-*Pbbsm$j9S=(4Tu@|oM6NndnNV;VOaqRi) zr_=@Zb54K2bE8Jh4qLj#2VV^58SYVz-|@a|_9F}KpQ+n@0gRIN{(I6>&7VZ^%av}0 zs4m`UFigu8ZnB4m-~U2*qw;u{iEyzu+QiO4Hgp+y@bh?|f0w9EVJ9nG(3I&m^x(9K zr9pp43(g|m+oqzp?xw{)9SsR2&n$fcYH9DsJz?r3$7tW}iZxo}^Eh~Rqf)h@9N6P~ z9H$AnE@E>4K5wqJ1Tae@puRAN8+nQo(ZkxlL8-roOJS4$`2<^?>+~(e2vDyVv2Zqt9B((Gb#j-xRdQZ>-4yr zvz+JCEQ~GN*O2+dU-#L&*KTf65S-PlW$kY2(|HZPQ$Ohk^foEqi*N1=*izlNRw_^9 zl{~M$agd08>NiC((vm}gWSj>_wwC^2s}@Bh-BA{xl1~+iWsHroEAwQ;cUf++sWy1X zMun0bDrP&N#`=jp-qnEi3*+P@d~3Dr%IZ_g0B5wrh+t@A z^$RB^^Uox7PHxm1_|5>D=$W4<(rfCbRuqDWckqV1G^=mz|XMhN9 znqHcqYxh6tqBcP@2S)H$6Yyu=K`r%eTKWBnJ|CJ27Di@@TE{H(IQ&d6Yf3QcFsv{BNg=br)IVPmFt7OA^H~R8+AWNdoJZrV7OzcM4($&ht2yb`z-ojM2?K$41Cw36=0i2ird=Jnx`I0OkSxP4g#2 zhj(NAh9lt#{AZJZ;LwHfh1#DQ?a=~=ZI|kW4*B&3+?vViYMUky1tg;WKH?2BW3B+f zPAURtr@UD^wH5v$D1y=!KtSJVL>Qey?9JZuraoYbE;*$qp(Q65mcHS+wI>cJaRbwb z4Y$@EyQfRI{fK_{($E1&-6PdYVdY;!&Xz*I`&ZA9W6=x?sggo*GOgmiLzIs$N&chk zLirM!;dCUfKDT)NbXI33!toz57P#gSa&l&cN{e-#-h0&*>={yrYKT?@d7wvSqI6}) z4S@4A8c36fSF~0K!rP7>kP`YS}AtH{HzOkWsqp8(lQSe6JvPBs$7oRb0WPz&OI#R z5(*<%&l{oT?j%bFbCulRjfLZ#^7aErFi1v>oi`o%FCA!~u@#{4<*Z6eo=R(7E>%la zm4AvsgWOW0V#lb3MsYpl@=Df#5lw=h8LWEi>7imaamjv%>}LHi&(nrgG!ew0u5R}9 zS<=PrNgv(B{R5*xPAPhM>wVLjRXoROjL;)=L*al54fo?%%Z++GWp|2L@`wN58^)6d z;}}O=u~03G-DxSY&gal)N6GEO7!mYY9=wGX_5uc+i`DDbzeV+&hfmxia5x>uO?w6tRxCyP(AhybNz)S`6#iA6;vo}(WQ#9y>f{aUG4Fn^%y_)u*)AWHMKGW zx604zS>glib^{3ojz(+6Q;{GN4)sLcke?BK(SH)k&@TOo)h?FJ`kTdHA+NF$w< zOfB$d23FBPrtoHdKvkY+XC$*2^SCBFg{mO40 zLlCgIf!)Obx`EEaN2`w(6fsYnI9JmG%z@Q>f*A`y(wb!a1H19B;xRqr9dV>>e`?Py z|Di^hwA4jjVd=YWY6YANqq0P(kmIHP3dyoVli`X;91)|sKTS&?=iyP~4qeYpC;6iq zeryW0tXBicjG&?EY;Iz9>HYU?B^NC*PPdmQf^u}^L_V8^hnF!y?6UvO>;?YK@I983 zMq@Gs^cD)Ec;64s>Ezd5z0zA2k%RquTnCcvaSZ+j z)zJPSnn^zQj^eJhMs-ZlIuBYL8Jxt&uymfY<_ML_M^J}F> zWj9-qn?{i-^dTM!U!b4vCQoFXp!no?t?Tx}xuMH#cQFj)cMw(~fn17RCK>La2dR}S zQgzU|6BNRjWit!JH7Hgo+TKErL}aq%E-Ib@MSgP!BR_`E17NqPzW2@&qE-odfpkg2 zr0M9rnLJB!ib*X+$)Y-|lnvMO9S-!+GPYiN(6DmF+D$c#p#c zZU#9B@kPC5Vi;yk2PAI@3vez`Mi$nd%40g2e6`#Gq_gvVF)%Slq*_2Ix=i0mV;F`p z7P}J48{{so0k}_viWa@b#mvgs9?SAw;f#ezlxI*2_$19H`mmT~sI_P3AqRk;n49-~ z564oF#T>vsjmH;Nv=5)&cZWE&-POS#!b%8tp(a~Tb?@)C6e>mu z_k+K;A1Cg7GF@gb2Q(>k7ZR?|RK&TiZhH*^t}Cq2X76zRv%U%J$P7TU(-wDTi=i&n z?Yfv~k{pUQPOV3-;A*a<@qGe_8e6P5Z>n8scap&$bt~Sp@^sYWN3s%sRiPE^y@wfB zeUZI(e05u3dIjjqoMoK)=snMQa=7ToiN*q2s%G$M!9brST*{eWe8LeHQVF`rM+Mnb zcndtAF%so=WLBn&D|_6y%yx7D&Q&H93AT4rqVBFM?iXTflS>fc$Rq_8`1!;Jd&DjV z1vWP?%)kWrA{XCLlt9SkY$+}KhXsYxa{nP*q&Triw8DNQum_3LJ(4*PRi%=)=~h<)WMoos7>-zrd`T0qBYM7#z?p%;^^nuO$sbJ$ zD<;!uzf%sB#YNp@DH0(?u;i;a$}3I6eF7OaW7llaL|s{Du}EoFSDGo#1D#T1*a{vy zvv9XVzA;3|(z(cBW+1T!_jNv?>bJ>vq+mEB;gapDLGztU>GOd|V}YDK+upf~WZXP+ zfHmNNxq2HgVo=wVfO|TO2%_LHqOsUg7T@eAX)}`V#AP?peBQ}iKSeIm5nb0mq}o$J zNKbvSyQ~N~A{QvaFQT8W!Dbjpg)1+zxNj`z&_mxZj$7;BhTQc;rCtIQAq8818vfEWsz^5VD-%vpjs~7kU!Y$6*+yEt=HuFBw#msJbf6@CJ_=y{+=v=I4 z=<}~+zHYzOSjp>hP!ulN?YtHJ9CwJ zFRpwh*Tg6l89U>Coihsyn|jP(_wRG#zgKL0%; z<9Bc;9L8MR%Uehc+sjY$mj36}5&i4(KB7F<)0q~f;Qjvs-ceRrSmX=nffX&#N8vO< zy}unjyzwvJ=EwZ}3;%2Mkj{lvOC|m-5h-Pj{{4eR*Q`8+Tsi2-V zROJ&B{J)TO)bF4QNdo%U6n~L*#*R{XdPIu})-qdTITCQ|^tF^}VazvUN$q<mDdI7O6}W|H#Uj{cM(u#J{w54jW%87}F6iJ1 z+i`u(DqQ3YHH@$c_@KAqIWx7`*2{Y1q>6V~{`$P`b~xZrw4!I@?;M4U4;N!6J>6mL zw-y5ANmn229<9S03=1{T{F9k%Q!x&!!Or|{{K#1HJS98X#^_?8OMxj><0U#7S73*O zBARGQcBTz2pQwIbgZ_|_%<>581`3O17LB6v?nn=E#-$z%+4RH-5_1H}m>RHfItKnJ zbZzaPb(9hD)K5X#xM@TgI@|db4~xj>OqX8%mjN3SYN-tg|Bh1Rb`8YC8iZg(p(*&T ztK**aGoA+@sjfebv;FH5631^J0sMazYE(64q_fHp)u>D<6FY1I+B!dM0)1`wS}Q9n zy>`h~hq*XS&i#pHKKE6lJ|~&=Wk0Fq+*lB>04KP;r;}|;{q32Y<4!wy);#a}XQO&& z?M7w?@-dE`?|*&p_tOkSo2|6zWL049s<=0|b+EycsXU_X-jg5jeHQn38 zS&mF$Pir#{4$@!DBVE}aLgHBErvRA0tZO3dt<^m(qn7`v@}OE7^o79|_J^ri338qf z2}u*Km1S*xTaS~-W7FzKV7OXt^RQ=^uUQxM^X*Ghvoc=|tn` z@m5tz&heeiqDdVsT{}!4WL;-a(4wQ!>o!ajntu|BM@+{=TAs z=L?ipbFs)u-;#R;IF379X&!5ecrW!2P!>%sp~-WW=9qT0(wg3k3K&yw$x;YS$fU{eE=wR&)!t-^;EjkL+hntL@m;(smw<-ff7%5aR| z#6l1!q+2?Eh>YmxFNamE^uikCRxUrm{!AlVvboADA}5n|3=FKVyfZUDn!J6~{~>t_pl4@m zn^N0eeX%<;U6qXRH3BlV2O~|2?dq10m8){jSJCdE9_bym#+g<-q1f2d)i0+qbYmtb z8jSCFOBQPxr-}BL4!G?8I9ZlzK38&=@o(FS?L>!(oMvcc;uu-t!g=)OAI9dkrd zkx*8b=y-Y>i!C2pX2i4Qm$Ma=SzfM1Maz=<5Ag@~*Kx%vSELs#=*CYZJ8O;0Bd)q zS6UhsqhDr;#cRcQ3mjv&{ks!g%hM51oNKs8c9ujb05@jrpI3X#pU)NW#Z}liGu(j* zszBGQ!tl?h4m7(zXI*S+P3a1wym22&^7+csL>&$9 zUR<_K0U^#lwd|rQxxQGj%D(0R024`{ANRq2aPz6zh;AmwM#IwO5Lvqh@`@f_A%mH@ zL?`P1X7IC0DhTOmNyVr~ZK*Bw>HKHOWpo>q)=I994Bb>g8uwkfb^cngY@SAbW5bW; zrw5aL1D9sgxV&inudpAboWpk>H7m4hcmxo7WyC?GHlJHb?<}c(=*-t-7Rk7wVOF9o zA_NoeFY0=|SE;k;tezL$+T1M(N;(a0vE6c!rqviehiM-eJPXe*s5{b{np|AuBzj0( z6C?$WX;GNRJuP}mk|D*K8e=d~Uv<@#ISP@6xs%Kl#$Zuar6(pH>TKDGytjDUt4+iC zGM|J~IBcoFz=fd-d>aKhuV`Da^WWUW<;|8#(cF{wuAC-S<=+w;+v5=_IZS^$Eft!@4l5BjjRG{nk*$cR@ z8qRhj3>sw|WXHrIaup}{9X*_muFykh>m~DZxNMRjDU!a!&&cZN2f>VC~zSgKk`>N#Z+|j4zX{ zkWJjcKY2j8F^|}V6x)!vLugfQJ_vG(&qJr;RjPy7?*UTH$k53E%D^O>v!)5g&I_WB zo@Nv1ikceoK+IIk15TbM#;fWQY*4DMlTlSF<`L07qc_$`my+(5HfO@^M4;dGBD1Ka za=Y$F-~}U`XwsOm2CFJb?m+AXPb3CcC%CV9z=2i>{-mIfyG`X0spp-!-Z(=Gcw*q| zj~Ip4}MXQL0SpunKW@w zvpCO{X`E}0u6w??^Z?q#Yo60?2)e2mh0FfiG}A#5^k~6fCZGa%x!eOioSiX_nDCcV0bJlcmy^N_98}Rn3i#?i>O8$SB5wIg zXLm;5Xj={S+lwqes4g%8hjP`kRGH6)Pn9h;%&VuvxskRAOKVGG6Q>|qH1o*h)Ziuh z9NP0WyuA`ik;9)mnXYabB^xo>+0hb1O7H;&((9v9tx~bl60CI1&br*g7N1|`yV4;MF$82 z4UiWf42ovExb@oplvaU5Z!Qj*WDQ{D(H8LYpKEfNuj&-e8&bJ*af`ME?6G5MNX_2T ze*XNDQWjUF=PkADlbn#%Q@lpUE2G<05yL;#d}>VsM#Gan1N$Q~uHfR>k7I%==zm-~ zXyvJ4fFLuCCg;;Y0~o_xLx5WYb=bgKCsg4P=!(ADaf?y|;kO@WgSE8b649rfsoPYk zejh?cMWf>>b2H+SxKr!1)K?u4d=WEr*Q!S0oW;P#Eb$vlGd7tP>v0x3cw#;^h7VnQ z?5A4aASVqWK^qg4fDt+(+E4gq4m2i-TsXUs?p?Xue@^>_Efqol%_Gobm##_9(R1lQ zv%aF$+g|F1=4`n!ls0eb@s z=|+}mS%Tg{7nB-OxqjQ$3P}vJp`lf_p8H&$*AjIuXF3LT=E+>Y(*(^giRzD7o_-Tvnr9f3kf*7xuF5nu*BhPiB(Q|du$UCqcwUT&(EfP+jcH+LS=llJ*-_n> z>38`w0oIVkpj(N^2C4~Z?1UXp!IK(X?;PvY-dGcgv5i}l_8QTyXFcLN&iFZ+If=8t<`l;&d2HemtY#w-=&4MjS9RnH-lD|w+j80 zJGMZn-bomn@tnC54S*CcA)~sH@))`o5t2^x^{05l{;q)w$pd9YnLv!SFNQ0XRY)EG z{;)0DRL>-`hDN#Z-*J~Ulsk_zM73gX8L@2<~nweU{6 zFvR7Ho|os6CXeYN5u(?He@k(1>bomC=XpsSA&^FvlWj-wFUL65QS`sr`2 zfW*alrx;Z!_YOWaA1-K|L+V*>ZRQR;1xe`Ru-QO#$RC%rz8Bg3fj3g_Y@jwRimG=) z6?PON$kxNASlOUeZRW%fPg3e zRT_SD`ilba=dJ_q-0!fXZ$IoZzz$pH`Af@j#BPQl6c?8t@@vG1!2M<^CFjaYRi8sh z!ZC@r6K_AuuVZ9C%4eYKex^ADJHUxZiqj1Lxc_6e0~Qb^44KBoO+$bv0Z1d|S?=g& zY!E$ee$ErNd&<(iCU=GJbR2k@{fU|$;>_{%*Zl#x47kdEN>M@>YmxT6gXXCUE>2jn zo(l5n`|evFDTdoxyoHkr-d=a1=)V(LkR*EN={KvC41ZZ(js~F}RB_R9QEo5+mpIPRZ(p*ACuLkCnH$utc<7 z4sY2Mk8gVW(3Q49s-l=1r2b0?-Qs@!&TeoO0U6M;X`7erp+k0bO z`te+oasD?so>3y_*Sys27`e@GMIY;ribwuPbSi=W-$@6BAbf8nA`)r#LVSX3dG+m( zrXXRj;zt$gWe>I3Xo`#KgLlr2&oll%z#10FTLtP|4+VRTlC?~yr{LQ z>)kBqZ&w^$**L~^WDW>5mA59Fm>G;t>m4p{XS>jTS$Fx{EQ!?P2ij{~{LZX8L?xlv z`UbfV9UFWJ+?5dG^J0@AAprhrTd z{=8s!dz(rcyP0jzXZqJRR`n)77B$S{kg)GdB?K;Qh!!hrD?OQ1#}$tC)h1W~MeP6b z!9k5e6>x;#&H~!g(>l5)*7NgvDe>{5g$ESm-insgn|F`Dt;ymmQhl@9r4RAyS$v8{ zp@EUu`HJLOLl4d;B1Jo5-Dc-hd%GCjo@ME<&Of97-K__p%zOO)KJ^=EiNPl*NPq%x z#0YdwZ^x}@dpp$~y0O@_$hOCEv$*ZT-N?H$mJ(3h_hx+=kE+brRvZ<%%oKP2d&tvq zg_R@LvStWe_A!VmgT;?xrk)-J7riN z$!|4Y5m!Im{x*1%Zk6B1@D}Kc5nVjd=gL+hE{j5IAi)@d$!-xR_|FY5(uEi)UdRxz z;NChuX%Bb5A^twb3ON?tzYqx7gv$)))wfIJcK;iyS~bB$9Vkv_oLN%9N}c`kHnaC; z_}WYTD=Y`UharImMXki23))lZz&CZNYa7xLM;+VV#cP&7b5CvJ(-A6B&aUF$#G z-*NHtpHYYWY-#EAfY0ZhHZN4<$Z-n^AxTaO53a9$>^^=ZsvH|vj-5{_n55%}o0?;N zn4(R)BI4t(=3--0oPDx3Zyp^TZOp4C_FYX}_4w^SwbHmjb2!yYBipn;Ia3!!8E<#lcpQk+q==P*0z>b z!ehAi3u=dEdt1X})a3QR7TxX1Ww4RCnq?SIOZAg;78s6lm|B|3m^mtHN$^l#*HTNg ze3VF2>%?cAfKYYLp;Nx6N`S(64Ex#k*o-~&+nF5x@G7f*%lFOF@Mx7h7l9kh7x~Zr z>3sG`{X#MD@T-x1_0;8ih@hY_VxIDZna=9fE~X=gm6Bq)?w{AGRbbYxsZuM;(ONDCDZXqV(6VF_akt7ec|@ES7Gj zz>X3%C$K30$26zEm{9WiQj2>=3=FuqsKXX&VL}wX?(Xg$>)pyGpO6Q7oA^W2r6f_u zC{WuruyN(X=r=P7?Z;7*%=DP}=W=0#2f>7rQ@Pbs*B6I7o0-B~2kk30^Zv+Ys94cH z^E#rNGR6n@KKB|pId7#*p zxAJU_%UrC)%oLh{ASZ>qb4!iLxhx6DVFC1EB8B&%Q}n~98by$IxAEn`nI_#ut$^Lk zywu&0lf&eXw>s~^mg-V>`4U%~8-H1qD?T?ykh9YIQcpNwtOEw40AFywH_xOg$8UDHt z9$xKa*ZSYx7zFp9d!C)>8UV_7=&jbFG`(Gb=%> zLCfd}0AxTofap3ck$NH2exLj{Os4>_z=^>nIApU3bX#UZHOWIR&D^;aAtteiWxp*%YUmLC9|=l=X|$*~sHGYb%3`b+ZNVoQ-S_*21M?kB^29hMmv%W3&l zq5x%yG`|rm^~+;WJ!}{9kah045bRz1oxTA47S4a!`zo?wl6M6H#}s?7^MUYZ7NG=i z{{2t>zE5proYWxab;pSXTS?f04f1Fi(L-snz+^k-e|Nnchp}pV)pz&ry%u#ki4ivp zPaTb3*V~oqRmgZ${+gM}s83`YD&6*t<_gnO`!tqWI>Feu!7?N;!{={dRzivEX;*^t zlKEK_m$%HLnqNq`yZc4kco|S!>|V7}q-8DUwHw#Utr={-su5p;3KS5w5kV0+aTRrR z>ZF3d(1WZr2`H@mE#mD`w#v40Yp)I(pU0Qtt0|E%LK!s!x!#Vvbqr;cz&}5Y)T-M& zD==<=;|FQOtnRQu6^9_*`|cQg9TfpQ`%c;LGX zV+rGD&D;PEo;t7&gUglo)jnn>P4j|2D*1vbT%m4(-#eB?H~{3H?+6a2c8|UOleM~B zq*eIpi7mI>TmX~Hp4-kxr-BhJy|{tID#x*JB3(!AaASjNz$25}xN7S9e9xl#!$?bz z{rEk|?>3_KVzgOMNe30O#K#~*1RMVH<|0(39+kQ57WFrf%qKn?jr_6l|0zyJ8q1w23-|KN;~hHs0<-{&b3M4?d%6KA2U z;}aG3@icq^b%&Hij@j*z^bMW0_foUZh_cRuZ*O@z8E0QUf~iYh%}EjwZwthINzT)p z`%WX>2Hdc1Z>9bjO`UXH}k2)#qMv`!RRsepL@pEUm+zS^~0YsPT*A6b4 z-``%vcxtA^a*lYL{Bq*)-FUlL@6;YEu|EnJex(Z^0_U4dfZ~H+zBZ*H$@cHP?6t_z zcU!L9=v#IR_R4&P;A19aC|cChgYEHp$-l$C=CO*S1d-`>Tlpr|Tl{Qi8KxfQ#U<#r zXfw56f2sgg9(nnV>w>TxG$sd)Z`T0~KBn??CW-`A^+#3N2#MRgdlMw&fHO0t_p}Ij zRpcGoaJ$R^fB)^nSfU`}N`LR8r{x;vHoIILlSWpYkZXd_*NG1UhP_ao&F(WSkvP&& zEHAEq+4wHS_q{wOuyTelnehe#k zx64}f(o(4?Ipv9KPzMI3okSU8D(WBq18_ROHKIVgu@B=g2?r(auJGS@Z9X%MkZP0rv|vZDI7jY5>#q4YhfM0>$Q6lnoI@ zf30yJO5#nNE3S84s9(82V0VBjG9;ijlRxIVBS@Dbzs1p098Hlk{`MSH?;JSAt1m+m zE8m{P0tfji3a`8>rL8qqv^PmI3Q?XF@{yq;8+mGnGYXc^)d|A!E%H?cV<)Tj*KLNb)2!@bsRO*G0hMD-Q9B$GmX@l+s6u_u=Gz~> zFXYJR+zl`;68b>>x29*8R54VgLMS?8kZ4uk=W?R$1Y(EZJ>*IGHC&yK1D=&%|BI8~L7v_5wdnI*oGOJ;0QZ_X*f7;ee`h~pLG3RYJ$-NYV zzv35O$TvS#s@Bv}?5DvK=%wGvJ4h3-_?)biR;6*)ug@X4lw0N?iHuB&eJ1(l?$Rz> z^&_S;*OA_V+a79{r(I0h#{Ziba?zRrN5@`NFjQ zq2#P_KYcjcqW6o-o3CO5QO&1$Dl6PWspS<82K6^fT{NT54s+TROgTr&j37y~D%o;H z@Q)6}X)I$u`8Bx?mueSBe;w`>6U|8a`G~c#ugvB0yKR4pRd1=)%;)<-U+RTCPu}U7 z0k{{RU=bRl*HAi$Yt6kR3})LPEg(K)#`{6qncA2lLc7If#Wd!J9H~EJoZ!s=F7F+} z)g|EZPAMfd)!+gB&d(0tjTrC4^(-nL$$oj^;_>6kQUTFe%#5rL9|7q6q(f#Q-Iq%r-^cI6ZRKc1VTesRqsZ%a_g_Xu>UH z5$6imS4l-$G==iYaW!U!{}&|y;bEleZb*?uz~71JSys{;olo=~`8;`fG|{SPd-6kp zWF|!F2^`B103Y8ft3JXg0A&+j;JS_@vUuPH67*} zPrZE);=_0wd)b`joMWQ6*41L%Jw_#}x73zqx$RK?Zi)Cuc5UI^e?lPKmZbQcN26RR zdeT9}_^*w`GiEVpi#f`GS@36{0o!J|C zL{$5j5SD?;k0&$yAbTo8sS?p-t!BXEVUEj;8n>yxHaZk zi(4);YFYquuf{WJdlEc;#WtDF?3Na87GEbSy&@IQDKPk03G11uh9&i*Ee&i-*o(&B zcJ&lUb~c@Iy`7^Qxv(cGEt$((zB^@^`p-O(_h|FNsDK|%%sDoKmxp@qcW>rXBcvOw zP;-2}AxN_}KKu#b-1jFc7lSb&JA3D@AXpq!(M0?c6W=?WR32}hl3PFjI#t+vx2P@5 z+zQ%u*Cv3z)xW8nxG5<)aPzw(ArNt*m_28QPbumFMjUAX&qd5b3T5;HXYp1j*d;#O zt*M)YfpfX`ScgwkggHV7o8hfawa*PE6$IxDV%%dTqvL>cH?H)!XZ@s(8{D>(bpp~A zd%WzPKM9%B1jXEb{22&+ovfKJE=52ySKj8f#OSTEdWlYitD@W!7vLo52x+flHEA-A*bdZbMP{~3@ zq*;_%En>5zpzeV3A*=mc${-mbll+rhOY4KDPNPK3!kqrB-| z^GZ*vq4H;v_(K^l%5mLyak++9`jH|@2Iq3uG>4(C+ZAL1_8hWTU#hm4?%w9{=Dk6O zp&a$bk`srE*w@}|)69r>Ep>lIWq{S2b%i|#26@D*b^NcA>sG|`C52b&8FS)Z4@Ag* zitBH4LjHlWEntdMv1K^?hJJfFg5vdx7|Un;4w4OP6ExhQP_Pd9ckj3w_SeGO!&ZcXwxRVXX$xqwHj6Kb zAG^$b!WYLNWNyz3)&|p5p@rg9R#^OAc#D6Pr66IYAh9(A#jLum3a}#1deq;86|Z85 zAtLNJDuD!Nx3x-erw}W3=jqdvM{rq`S_SHGc+W)*uXvY$AjkuEb7T$IV8cVMea9Vj zZZ~6Gjrt&?u;&qt$#7Kw3sCXBL{nnM_GC&G-vS{G<>Y+btB~8Bqsz4q7B(mU5E#4o zLgzh~I2epFgUt&#D6A#j_f1u>b=64QjXk5 z`~Ca6J2!#vL%6-E_wNlfMj_p=pJszlkrJQ0QV07^$2!S-(DC0^^Z`r(JuHC;Fk2{2 zly8X;JM%kZX;)_!>&h5+a(wm@G)}Up4pfr*RW6Y?eG~Zps^Tty^DwOTIiJckU%V+9 z9ajj0bqxr+v+^mreSC3LxFpZ^0r7T)P&nz#Kc}5mDSlPp1ht=~&WAq?uScEr$g^)w zVoR#~#T=n=Ok}J?UH};%SKM#Btw;E)MUy}J|0M53IrLLsWc=gbvN5R_64s_yRJZ*l zSPpyW_6g?F`T*=}l2Aic?o`0X862c-t%x6?x1>Q;xAL7uti%i063%q-#Io&g-`Hz9 zKgtAIDsV47(fLT5>rhz3WyBICC7k{JXhhP+L?E@uj3ieu4G-W6Z9OxT39%FGwi%on z=xm)(#&%HoE^)%s!H*^Df;bRyYL{Sq)6efdXz2utjGW{V+r;M5NV?^HfIVz)B#N3p z{p`GE)`=ZTs`J~k*691|Ztu?}DPO9eM{6g6;^Nz$r^e}U&6gQAEBR@3PAERpy*E6= zkpBvev*Su5A|(Sv&+7{oAnHK(FG&rD^EE}#;seU+YGv_kw=%EIC?{BnHYB<7bB|9c znJ8GqI;Hks}AOV?1OL6XloXRpwmYf}{Y^}}B!&U;)ehs^ zSWy5mZ@s@`y5dcS z8OR{?-Fh4AR{x40WGiBPC>b49a@Js-Dh2NH8s7qGoNCv|*+$mR&pz8KX#-GVagKKt zx$MhL4q;iDuJ!KXGQuD%r>Awg--US+6TZ6{vmsxg30*%AMD)ph@xB)s;J2IMO3ma~ zdT07lov*LNxRsTqaDj@DgltW#@Xf^SKhPbPx~1U^0izXMzvb%3^*$~ByB4~3s+9Ei zsDSeSRvR9f{+%CcZB)<)fMuDZBJu9>w1W)r{3@MY(6fzcqC_Qc5Qo*VwSZUN(j&bk z*$&nL&4}8#04x$Ad#)2M&3W~ky~3zN=>1-{u#DM6mwCG1XD*$G%hO^vIT?u#%sF76XPMX$HU@VH$H4Lp(lbJiA>DS59s`=W3<+t}|3z0&= z_BVUg7Z7Fs7J7gU^56A~2)@XIAoSpb?C2GSDCMbo_X#>2Kbyz+;O47d2uhHlj(_Z; z_VL45)>ha^*$ zFf~cIz{hbQ`@WPY_X6R9PJEDFRoW+RN_NumYcO3wQGkv(Rw zcE+@B?%U}^r}RT?=fw%To`*Zc`!ZR++!_~O&k+tdUPG4!P<6%+XMu;2a=<286Wnq- zXji9tXp(bZ3+U4cus>=V%0;e^`TvqbWN9`n<$LoQX?RT3+vu{nGoG=(d$&3cxCv0O zM)|saqzUZWo9omtHa^O?4Jw)FpP8FuR^7v6gBV#|mb#=F z5(+8LoHgtU^an4Wh?_9U=j*p8ME`Gx&1! zH}2O%DZHu4mv()QD=pqx>X9_ru9VK(eevHm-hIB?ctDPoohvQ)9c73(7Wr?kg=x3X z9>O1ha^Se_YROHCLb3+i=~X{M(6r1O*^2aCicK7Dzw8;?G797r(pf9UP7;aJtUFs> z>s;!rqagbjF^g4XLzwjVT)kH~>?xnFz(+ewgM_cvV|H(N?$7z9o)Pm6izgLJ3Ts+? z^*hP%{yjrE`ttaSr@b1&`VxD4`_pMVdEA~AFqDE)Gx=|xvHCg8Rpc0>PgQ2Ca)fA- z@=5B3WOiXw8L)%iC6O!hMC3M#6o`Ll*|Kx&O%LR>Kv(GJ8`mX9$Qf6neX@+s5(;>#+sAWE*Q~4|2hy1B`eA zu>#v4w*Bs7=-DnOKqor-wyG}64QiP5opuC5Z;>w#;f#w)9(K(jP4*LLJhbM zr#^BGgKMgsO{M+`iSNPQOzI(wdd&3;%*l`kX1BE)Yu2Xh#5(c0zuNI7grPDMR!_i5 zRijo6c(~S1x7l~|*@LdHrh$R+U*$T@wINt^A)p~7uAX?s#}y{d^VYMSCacU)F}@1* zXHoYj8*F}K;@x=o&m3dfv7O&O+=1?YD!|5k*9LNvKIv;W2^4pQoH*wE-fFDo;%5Ip zOuc1P9nrRR8ze|@2@+g_ySuvv2<{HS-6`B%g9i`6-Q70s?(PuW;q9FJ-E-eRT4MuM ztrn~1nsbak(20@pA^RY)dnQAn*6RND@TaOQgS`_cU6gm4B2m7V*Wlo8K9r4vKb%O(^V30PcP4LoUTH^_i!?|0|#a!l(22%Z7t`$gpo}tr3%hxFFCl} zQ%~mHS(aWbR;3E%RB%U4seycQfO02Y>|iO2x#TmwMy^^5`JI+^K589{}W&>*9!;6>(~&7~eb*6(We$HC&CuLieVZ%%3f^U^F#657`< zUwe|#z3P?UE&b3?OmQgpoW8A%rm+^5r5~p#W0J>FH^kd>Ky;?L5kGm|oz7ulp9!i7 z`AY~5g%zVgBh_c4a?b9#GApM z{aS}~BukBP52ASvyVwCF(!??j;}bVJ-%dIm3&*caM{KT(=oNe&!eMDKNr4h5%tvAp z<4{+*FkTOGh|HgMM?28VXja!{@vOJ|0mUzzK0nV`a-{vm^t(^|tAo%Ju0Q?e70cO( z%KAbrh(oDr{%7xFb$@%@n~oDdS6-M53MgRP-$AHf<^5URF5d@GR%R|1XfyC%qhz1`v?+eR#seW$y7X=XdAV33cMTg*`gSuqAu9U(FVntBYGrdc@ zE}xYI8S2V{nkHCN&dVY#sU%f_U7|!Q^*IcV5u#%w8hfSVw<}R&CE-$ zl|V&&K?XeEU&ZfQH{QFigH~e*Shda;hsq!6+DMu-43@O~wVyVp(O2k5N3#J;>86C8 z^{CQ&`?JJXnNQSrpp=ngxbtLHa~(9{&fJPPg=1cu%R8I1K}BEw)^Y^#U`RZcnWY)djksxJzT7G z#l~H5c{3%M=KL!rppR@BoE2F#b`5E&u^#4 zo?QFhPBd=#sAt1fK6bc*7@O>u-;d|4)@YE?f}n*>stiQla1H?Xc>BdK6?aw(6}1V| z=o=LQMteWQ@HDoKkkHb(d;{)P$9w&v5Kz@Cwx;>57dK^JG5h^vX)laVVeKy4E}wEy zhy)#0_2wbmsd$V2F#bJm6MUagmZ1sb%>K|Did^ee2;FlXctw&Jb-_3{@Gp@Fkc{tc zK;u*SCT5=vB_lMJirC7)c-DGN6TC$Em|O8*-N(DB&!4%dd3j{d3_DyG!Wy*KOmu z3x4Zowef1psPHfMUzoRa&T<1W1Sd7Q_}dpBuCdRLaw37K3l+TWA1JP+xXqQhJlvdW+m{%?l``yVi!OKJ&!ivHy6`V>s_$OzVwJR_u-zpYPl z+LsrXE1{zh@@Yg28og_Gd3?kV8E%^s1x7-U@V4h2E}+s%I!;ahMB$H#6YRE$>x+fU zb@r(k*joZ6#tMSQk!UjO%;^|7JF}5j-(0PewE1khx$+ouy9^>>Sps3rgYhRf(A!A< zcKI*XA{E6h!A=+vm^b;QoaL372ItT+&r-UtCtdffizaBIBT@ ziZQjlM4SdA62V2hhCxtw_ zzF6^i>BqyqP(gWzA`<3_*O&2;!T{DJeoc;C%9hgM+Jj0B_J36pU@oAL7Xq0Kr-DB0 zj)>n9qKT~9SwhkMEm15Y`aPIyq>&B^4HiV`J9aW(I|)dvS;~=5qw`}7MYf%SvO>-X zBsQKSDul}I!nGoLM4Aeyud5U5bMm`~x(msvkjo+*GqjvVD?R=|pJeH^d%zlW&(mxq z3exN%BQh1;Cbq|a3lS%vWwn8V7q;{_g0zEJ$KSLq@r*g4CPyo4KJa>HR7*7qhF}3U z$Qr%xwy(^fFd^2}=Zcj`NuV?wh-4`rX0QTbQy(~@%=Q8uBYh_zg5w~kr+f>H1=&N% z19(?B>}drlzM_T7qTg?QL<#>Jd;11G0E%g48irs0?x!^7AHKsYR{hkWI2gSZk%zsQ0bh)h;xI5}?A|bi#BJ*nf@6Wn2cTZ93l5X|^Yh%YpBk0fLH+Jvry6q?mn$ZrkT6`~83hZs+q zq`sKi4|9`e@(2eg#Y{@LV{>)%;FuCTqGL~wWt&Lhyb@ku|AjzMFwMzp4s8GiuRlP- zL+r_ar1}U7Z36X$Ix6+$W(L$TFKj16m%u`Wk)O%wn`h%Q{mP-8t)gS4*dK2n+}IWJ zpb{z}b7Ttj(^bA7+4TiVa8}`reXJ+?-ex06DyZo zk_hG=osHtV)D~0s!8gjT;Xo)1T&U5U{2R`|Myp@Y5@}o4-J&Qw{u2J;IpP%i%*!dX zPTV#KYS!w%UI(M`POezhMcED-x~DSn-Jt!yDdDxS^*?+3)S>>ok3V()mCw4PV>|-ml!G1c={{Rad)UW2;??x0IY5D214fz%PR;M@om=} zDx`K_(DK`Kk#hS8#i1Y^n-DRkFqg^Gh2^|nvMMP5#&*~JGuY1(KT}>M5_|AxweT%@ z*1zUKL0iZ(jtGI((VZYE#>=}7>)tow6kfp{36*PWRW~kJ6Zfa82Y-r*X_vj~DoyhHr<@yy}3+~j-)K2dy`c%en2wXsV z8=Z)+2{z=0IY}xeoQEQXX24Ea!jm8_r$ag`o;#WI6N6^9s;`YrdqoNVb6g81R>@t@ zw&I46?cE15sHQ{|84R7x#5b`P=%V6LdSYSs9ArOhq#cMX$Qqh zgi1H4&I0+ci&rVfc$llB0~9HSD=UB?Y$CKtrv&UV@FJLN?7}UCa*`$GZ1Sg6x5FN2 z;-S=*>FU22IS#j;4So4}uvnBp1^x3IRpfy|NPnuk^ok0WgUSvhH$y|#u*}<`5~ayO z8qMJ~`u)S&r2XTE7R-GbStocWY=>o;l|@kYITocVsAn;cp^pCQudvy&Uk4y;@KP7d ze6;pa*C(|()G=I^a8&k&0MdifCi{=ou>ixMt`raKi_XBW~&sW}C&1>Y&%X@vCr zz&WJ`#eL$&f(($zC%fIiK>NxmW;T{y-*e#N#%fLy1>2?QdzGm@{2(tieBhP9xUs@o zkQ$$Dr@dFWK*DdEAgOH`=Ei!I(3bF$$d~v$bg}D^06bmXa4pbgI3HamdM8{ZY;ZcZ zs|l!kxz;}?EzH+i4aI|2)mnBn69mE&R~3CJCuS<8Gl5+_^wj5}`&~`#h0=bjEJjN^ z^3I0gCU2Cly~&SYhS%Oh>P|xn>uttQPRJzgO z3wqh7i+PWt)D<2*Wn0h8hK|N@R(_)G;&+AZhGfN6a4-9x0RO=d%oc7ZSUIz;ZEGZR zb`w_v!d(XF)uvsmHG0v53-KByv9#Q-jS#%i5m-`WK`>YhtESyYwgdYWIK)ar|2wAp zpXX^sYTp=tpK(vtN#T9Tgxcf)ZC|__Xhrp$L8cS_VUe7nP+cHg|9^G=|NU9}Mv}N? zIJd?*o?|>X=+r<=2sAA4FMRO>vl@Iwqx>6_}Luz8Bz;+TW%r16RxW-2-zr;7t zkry89RN-Lwe<;!#jj#~y8wYoo&Y?-@V9NtufE!899IvIv=c%Svf#fMNS{@x($TtmFbKcF8Ky3V@E`XJff{L?C$Gv(Io)>5 zFfZsCi39d2v-Ne(loL+%|9u2Ah0LB)a}9zOxvVvpVQ=;|#7Lsx|8XbU{{hU_!z6tF z-NGj!UT_#)dlp3W=|7?~7+HEJ0p?INa^_h+>PmUl<3I0p%3H+pRj8gv@8|FMlrkv0^NPc_%@rZVy zHBoW7yo@^;8)?f^FOpk57v*#QiPZsuB}SO z!=+k~qmxsm#;Sg)1y*r^VD1h5_E^8n23S~XSI}vMM*FdQ>^EF`dPez`b79sD?cWxc zlOjcR0N4|Gg8cd7p{L|9?C9tiD=<{JTl{$3nC>c~tg=pUb) zoIPA(WNSNA8l8|^Yr~pI3T&f0Iy%wi8%vy6Y&>6xDJ$Os(ZN}fwF1ZSQ_z!b-960k2;Os`-|=CQ!aR^jPeL$-@`ElPYg%I#Kt zbiu@Tf!S!UXwcl^VQ06W;xvkM=;$mXHLu71BRu7Hoo`CgQDyk7(=gdLHBYZ*I&24^ zGpc;~I1hhU)?;_jsUoO=uY+vSClilmUzaLd-PT1gYuC3EjKH36zUDj_BDeWJ1<=2LbdrD3*jROXHTLBK zUh@LFFKN1{+#c@TqVoV4^h$|mL$8p?7S8oj@u#98R^V+GyE9hcsw(k)*Tc~UQ>mmv z;N;QuDB(hk#3RL5eprsNSZUbbW~E`N0ZfBjZK~!ly(*v`CT1YdJN;{@U1L%L*1;|O z(+o2Pnxn@33qt;*YGr+&&7YE-Ws^uDR|OU-Yk|S0oep0BBT~^89dE_d@QpsJ6FtvW zR&dVmL+wP9DY)?M;<-J0j%MTIbvaJ*sos_y86U4+sx{MyCFEa@T2M=s)6&>11LSc8*T-`z>!bAn8|?<``sHOF zJOS^YYfiv~b!iE=xz&8xwPykhDWB)8R0g+Gh|A{^Znug7*Ryq-f7oo_9*czKCaYA2 zb#o58bt60u>+gc4HNt@~%co1V)|-A16~v284*BJ}jqArJ$2NUoTi|HZ@3ai(N3VwO zz9za>p~wWTc|rIX1F^L<_3)Mrwrdq{i`^7*_`t<$?yq01KCibFiYnULrJkl*cGNl) z3Yi8_FvwM8p|Oj@m1;}fqNZ;=1OFOx?ze;Bd}w{)mjnT~{ZZVNJQlDb>+CWN?Fk(a>DzB{?8L|8YHx0wj>8&-wZ2V zXMr@z%fOYM8lbj6uU8fg9R}VF^uc+R;lhw!;TA%C`q~dIS*kCg*nEfCkkXpr_~D30 zrhnJ==H_;e(r1&+3BcJk``R>w3p{9xEb)^3&MdMoH*D~lzc`R?k%s@WP#j%SF~(C5 z1=4O!*UlrjzN#6j8)Rln2Jo|x+blh0WB+h&lqp#MYmt2r0|iLou8(V)?vU!3`^T)T7qvu1mQm*xbiM?6Rc zvc{$8Dr%(3bOZ}+KexedLtuqW9Cd!tt3Xala+U{n#5_rBilt z5~8D#Vza^P+cVLkNWbuaFcfSHwoH8zVH8oDGVu;rZQ4LW`dTbr7k^omgucecKz;4^ z*K><FbOA42Yc7 z?$%DUPpJO!QA+rBK*WDtH=sG3PdS&W95yAc9f}!}j(tOXxi9r(bJ7%LC&Ci*;7i@k zB>mK|u>jU0mu|vPi^kdApYwA#^te;Q48m8Q%I-w5jk1q)Y8X~_w0x6^I#ag3t7lNA zK|0*n7~*wEh)Y7Sbn|d2++dYx0zwmRs`jOq!|#eNHqZR7X!#5NHao61R1i5#L+vpW zHd7dL$A{A1qa!B1B;KsvuVTjX!IfW2Z&OUn>}}~Oa~vf&Ca~!+4#{d-)?8=R9bMHc zC}z};b6QHC7cX#9W3<5&+-AmsQW+Wr!`}Z>cK)Xj+e`slOWO$y0aFqvlBGtVlTk-g zE}N#Zs=`t7fVZz85X(zrvwpgUtY&#H?8O;#=tFCBH4oEaHIJGL^z`kMTe97kkYjE1H>-R|QuxWQq@knP=Lp6rH zYPShJedpWrHCZ*F4W@I#=!?}7vu00Kn4#%la&}ihxu&B*E;(|=od%?|cE!^zSWrsn z{@0iOJLBStUFXSdai*tXwPrz-BS|7y#_1rEBZRC+SLfidR_j)&|9pF5JWFH*PF&_- z#Gu_lMZ-5S$ptpMgq0Xs%Pt;0JZz==mm{=Y3qi#9un~X(7$mF_LszO1^D#o3&J8TD zwGraOq}^n7+=bg<5o#eAhE)s^S(`}C;O8dP{x444_@mQ*yMop(M z#A}ohtqin)Db*sT*kR5G?rTSQK1ngYe_P<(B+*iuoenf|O~j5^gi>xObKF3zsOz!*Nr|8cbpNNx~!Qk#Xml{26OE2g?)Y6M*BD$K_;~DVe&1LU{&D&yr z?BXhSZLkt0rOalP)qyQ7+EUQ2+xUrfr`Him4S-cyi*|+nYeVQ?>XpMQ;W;^$x7)?K zRcIm3m%NV47bn4n@+;^^gDJ@$8D#2l@t8xXnhCtGLGU~Hfuw_^T$Z%L_HRtS0h)S0e&c&KN zKtHTN9jAb>^i9YEk?(p`WqICldfoFtmwI7*1>b}CW@hnCPLD=ol_)NC7%b}7^{Dw? zV{{A7LH_ZlTwLw)k7ZJSb2GI#az>qv!OyBMxvoWgzQu4Fuo)btHS%$skTy*oBOKaP zUzg(ZCB@VxJl5hrvj9>WHPQaeLyICuK!7CTFh3uPt7VL^<>1dehUQ}^_!2Udfj4Su zfuE6owMfR9sOf5IYIJeCx$^b%>4myqz34es_T4f}jB+!SwrYEG%v;u}lgUl#7=i>m?%_OgH2Gyl2tufXH|< zNl!t4kcwoLvv}nGhbP)I0ozfHN-`g!LTpn)e%DNfy=zz*k$s9|Hih*sQLt_FKSOaR z`uqE@oN@QK@aKGzByMmA*qkJZ#;U3KF41!pZxVYf9;yt_t3}f4aL@WS5R;PSZ%$`VEb+()NH(t z$fht_&4@K)C)(yneMBH%l|PusIbb;6g%A$3Hkvc(R>YSYm1{l}DM)3|-H+^VCruRe ze6lR%Q?b;qco{CA`CLp>CzNg8`SLiCb;IEODo?M2!bK81+ltp5#;pf=(b)+~VbI=Z z=x5}6&t!z72Hx`?LD=@-&_re_jFg(^i;T*C-54)eu(9Mc2+qo$bI!8&Df(Ylb|hcs zP4Jlo+A_AD``f$uMSFfNUxV`mB(#V>F?oOxBs_Tnh&vsTf@jk@XUFNub)$8^g8gJ2 zFt@$G0WcQInrn+%?e33uc6Ja4ei{UTxZ&l{aisz1cyTOYDaeWImC8>7BRzhM_&cuc zcZ0i`ck8M-Clq9}L^$RDs@NQWc||!ux}Jh1%E4Ddf_#9=a*U7FW*JkR zJde|E9a7z)xCe39D&irbCYq#!4QNKZhe~Kp<3?ht+3-D)U(gMq-Tjk`I8MlawHooc z6cEFS{qorVS3b_+X?av#%qX;(vExBmqk>ggn1o`J41l$;mx6*|& z_CW03l()PnaNKWr-DzWz-7*CCdc9RDE!Co-k}cfRN#)q=D;W}uVrH1!Re%PX2gM&L z%tqOT@$;XE?wMReLqo@b+C{u$KjsxVtpS|Mj?Qx56$5BraG_k0GaY+`4VvzQ-*N7k zjq(WN_kl0Mc@ax5iDd6t*lV&N4=_W<$Gs@%POL!DJWX1gD#ya5_@hs%sc|hYhWpZ~ z;vr3XjM`4at!Q6kVrGV;fJ*g**b}r9I_!WiRD{Pq{lznRro}~;Ow7b}6WY0iwtg}eLiIV`&J1tb&&^XSED|$m?aF{6~2rI2nPkeozsg_$cm6loW z@b^TlVI#ifzim0V?kh zp7f7NHmZ*TmIT+n{iyX~)le9lEPz4`4iC_GT=~>cDo8u4P_JY|_9u2+=Nrt3!jW8X z-UvP_DLxy1W_~mmss*0UKFYuoERpviy7>A!@Xom}M7rYlCInN1Aj7UeGV||cXxAn% zlZk2o>V6R?Vg(4e+$WE7v+S%oAafYa#?(^Ad{4}8OqS~`i>wY`4AHg$F2lfUdTC^K zCV##foq#>Ti}vRRZo9U!S#Ax>_oU}B&PZ`jMqHRTo{Kt+fT!+Iz!fi8Kd{LnHpszv zP(ux7B>v^WFveu4&z4(iaUr0Z*YJhw9=rxx8XUz$bR5tbUd-afUxs9It^dB2c0Ofs zTY#NK#XM;F*{y|e0xf{BHu2x6G_b?1NzV~~k5Sw98ta*0v#JYXN?(>5_ zx1Kuj3xXH`7tB8|Upimb-su8nMiC98e5v3<@L*U%if|pDp0o2Lmozo8+MB-`N%XnC zwFP70`r|(ahT$wMyMdhZKYtB!7e!=hkPiAvfNPBJ=!eFo89#M(bz(c7*?c}Np11g1 zkM-z>s}4Ntzfo$_%B5NDq7tWrdt7kdm3sWEqw0WO1Be%gJCMyEJYN|n3?~p24mwaPY;`-E?;ra%oB5l!;HfOn zOHBUcs1v+~nz161M72mhqk;v-${!#Aio#3_oGTmJMGB*DHa>r+qmD@Lb;UA~GoYZR zg+6gf+=9@^%5=yYdk9>+I`L66T!(GD(5ipjeu+fH5cZM2B0&fNGuYu67@yEsM8xh| zoFl^4${0KA8n$2jnnX;(ee+J@xLD-2>l(7)I192}h2X*mM3=*ltJQ^zV+cO8B#$|^ z)@8pFy{`!3m6&C@!J@5}lF}~(iSA|5oR||C7RaYG&?fAmz+u1kHSsV=_G+aPb11RNjDhsj8%iG0{ z9pE{CU7hb7Gz=9JW(=U$MpjA_4E;&v?;Fd7GvYn-l5$lDjW;R>>(eIww}A zNN7p~c4?$0@bnl28hKYl#_J-}?@ zBJ}>&P~cbH>;9|LXT_lj6(WaP5`W|i*06)rN<@TAftQU=pac>f>(S>iZLpUbsD8zr zL~{=IrGO&+S{Pg-Z>CYyja}QpmK7>hJGIyLh_I?kpV(!2EBF!$Fpkz)OHQ3VB7j1wJUey)=szy~kX5&DA(u)?NH7{JF6r6KG_~8>EqJdudJc66 zsSP@f#-^07I)!8TZJ*+g{nIwS_o#>^?ClzOA{vA5p-4v9^)r0;ciZsLMxM$|u@N1B zcjCL|8R4Y(1Ms>XS#MZ!HQRe`&pw=9GoE_+J<`S9KOf`0!NEa8Lqb9T{(fDo!o+d+ z#n7}NXuBadKa@YOjQk8VARhs7Q2g>_`XhaN6XJ67n9VPWc^Nm&PhuBmIW5ZE!A*=I z=EnqLD(lp2>&yC<&NhI#OQSG=eSu1ec+2mF5N(kNqgUWkJeE8TS8Z$q2E!+ILG^4nh@+s?g3TS_% z)5WT?(kMPSQmazUM#Ug}(b)Q`f>d+@lin(0(mkAO?k8UHzIdnr*&nPKMM{K9B6jXZ zatY|*&DigDkxLAb_`7w0qCGm^9MLEfPAsM* zzZ?$1C5{3C{%ecmvqPUV=2Q^QrXR6xy30_(X@UY$v$-*gJKU~U0|@EpWKC>YI?;5d z4SZ0-b)~bRiX$^=1QG8BA~lBnY*bFC_kkEM-wQIF;b0Oqi!z!{g+0=nN3Z=3xsx77 zmoeH-lA!cm+2{o52)`mVpDFTC6POrOR+~0Pp^45}TO%pNr&A(c@&C=lf(yas^Yv3P zn?Zaa)z^j&I1#JJ!^HY(6Uz=$t4WDvWKGFIJUF`>Y<>~9@a_94vk+8*r{v$PN&+nG zcSKyjEj(doaBt$|pu!yg)IfD1d4n^JAMyW0KTu&D2%QQ88@bO>D0jMkOc?CsHF(9< z!WmJAxZ1HkELsaTrt6a7H2LuYOX2D(b_aKrXeT!4e>`k z9S~8kwh?g(Q#@YFO^QdmT(@!bN}iTMpO+wHC9OMudS|j~p4GhWtb~kLOYh*K6~~i> zu7r5|9(bJtB)q+Ft@e%I9ow&Q3Bc)t`KJ0+QNc+^Q^PNQ4?EU<%mX!e15_i_lfvg@ zp0Y)-5AlyGRPB8baA=J5{HCVc&<24`S*>?Xk;A`oqq6z0t(#>;(IlkEcAUnR>qF2I zaZfgjf7?l+n8)0l6;(&EFZUp{lg(v1k^@ros3j z=e=Q5L%&|Oah8-gpfr<6Y>i~j0SRvrzlYzX^q2V|`^m)-zB6k30c*|ncQSUOEYm;< zDbGe*UHJ&F`#(te#)GkzmXeH4TBBLmX9V$ummrO?@$rQGDxqf;3+_OCJ!xrpj*Y4V ze{ME_94ZDPg&wusT!Fvx&5Umwx>;pP;g+bb3trcjG(d-iS(2k(_C}}tvI8Zl z@2FhUK52&!b(3*{haKZ5Bt%S%iu!K{$Od>I{o4e^rNT4OZA@6d>f!L=u$t*!#V{i^ zPa%k+21bSL>lNnNrsl>@&35W{Qn8f(HgpEzOalcJ7<)FAm>L|Oq+^7}S>FvvFSwvJ zwBf6@n;q+M&-lgOn4sf>S-6@)rKs*D`)+s_L||5JxDgg#kn{O@TLa@g$?Ox7VE{I1 zg=yri^3SGiTT&AjWiBIPgwnYt?VL)E%U1`n0x4v_G^neg=vA>q6TiO~Y7Iu!`b*(w z$ixqfPyEVCb&$afEBvq-!0LZnXGh&nNS1bh<$WD3K4$@WP?m}sP(L6 zxfib%<^RGT@m&;)l<%ezQ7w#kfDSMf0fmb#r(5`h)E%MWb|{G@J!`(pI`i_2XhL_+lyd_8;IOM`(zl0!>jqPU|ZEb_gI& zJrn;$#oxq^rX~hGGp#JoNRm{bUwf&Q3&ITg8FmX6_u4213i|$~oMCp2%=wLJoQY%t zBgApcBZp8h5yu?Hdq!!Rz6a2N&~9CH6$N%PhmBTIb%W>#)jzSCM1(PVLTuUOEUiDG zB)~9J@JO3|YMtKU`@;Ss2{bR%ORA3t^ND3;rYrF*boM21ro+Z$Ym=%wtt;k^5i}J- z$kh3l)jPY6Rc(mDkd8%xD|XyWno|Q-@ot#rXx}Kg|7X7;Y?|4sFavN;D;laFak$o6 z%uPa-Q@NZ!}no>chLhk85S3YR%YZ#Mv+L2zYLB!y% zOUuob9u6mP8n)cWR}y`&%k?XZ>&9MZYg8mhgCht^F0t#C8>`HMu`l54cwr z!ZzR_BlHtDQOCHVKFMh=QU~AU&thMIt1{)SCE+&yxO|Fnm0`&QK6SE6#6_wCH$n98 z9lkE+xn`#to9{#3lj^V2>en)P`~3J)T(MnYJoCc$j9~Dvu z${+|KAX4|rAc*jk(sv?MY3chD4pFQW!q*KD6V5f88Yk!bv%jYjm4iiXMPr!UYFP~= zSy2Nf$?|n+pqb;j6S}-!7t$-S(kI%lpLbHmdYEFEg~Evsc3o@2e8JG3R!PFQxqV0B`*%=e5NoO8?x7&v1}&4P!v3~ z_*yQ*2s%_bJ#gS`r$d7Q=0UhO{xr{#X+ki;Sa$#%ISicy%@k#}F+crDi-Ws8K^n<< zfm+UI;jYPG%;Mrk@R!ZX;(n|XmPk#cak#_Zx*jN>Rtuf5BX59Q&Un6CdCst~+HMkZ zf^B5YA&XQ)M+_TEbSdXAjz~v5zApvCbl;bK5F#f(V_|7MG5Q>bx8km&;xbM0!f->k z|9+_B{Y3{q4|WKA&WPVoRe*tGM6(NHLjGDK0?H%q0cqLhb)L-IRn_mjj1p77^LyP@ z<=_X6QVvb|35Wui;SDN+dk_>cDATSZc1f-4_*e8Erz#{wYkq)h3s*VkhqwC#9HPxXRj*SgfQ;~pY@oo0mxuN$cJ{6SK za)QoT9H<0@MVQ+^xK)XBYwN-dG&R%k35}6x=izFl$*q9ZZa8ku21tLwa-_xIv2uRp zTEkseAK>VAQm)$$Bc+OoMNmw(6i1xn)=4S*SoQmU7JlKHbPqZG!UB1CKqeWJ9vBG6 zbyBy~R%P()N@g%h5M@fbXnlxdT2aT;jMIziz=&dVI$c<5`a$@|^;JtN4ZVZmj`R&4 zdf3dTo=~UM(Mkv`Gu2YIME|i2h z3b|`2nTkNX(}ClXbR}QRX%~i@Ju-5p{8heQRuIkI`8IPo7AlOJO|>ak-x?8K_|C`H zDJXv0GeL30^M^^QR22jX)crY3s&y3v9?&xGRmybtewx4o%P>|=e9kWhkSlpsxyt`&gF4A zwrB|$Ps^m?oL;dgvmf74*I(%1EIQn@|4)7F|DTuT-|uK}yRX#U;Sf=VLx7e&Xi(j0 zpQfC53DG9(L&+8@3usC3ZANeSj;s1`=0Y~^^FCGR-lQ9 z-pGjE;()E#*y1RXQBI}QGT2XMl7U^V_cI5U>@5D!DJGBoh_t(z2BFsp3}UiP;mFx; z?5eG;r4vcYSQ&~Y;FZDa0qEKCf=OcJ#L&XG<76VHB$r?E`epY%Xq-^UryJlARO?-J zzMO5~37>CtZoIl|{TnOVREgn&r_YUS`iK^Q5TOL^ww73MWPVQccG;=g1G)M&e2;l>cTCJ5Op1f4nLN9R* zS7s6Iq7?Fs3YIxijUgS`ujf)nJ%n#GZicG@SIGolL$4w72@l|*ZByp^-zwi%-YsG7 zCvyX%eR`!*M(>5ym!oVivn=%SAOjS@5 z1_Z21-p%_}CBSA(KnW_X>@Yf6AQ3?&Cv6wIgGIzKI7wsP^|(s_p)c$+YFKDuTU&5g zOn#8vct5??)LM8eak*TqHnvvxytHVP>Ptkz*2G5G$^`f<6U2Q>vvZewLn-djWH^OTO3Z zyb@wl2a8aY2s;S^xpv>f#_X*723|Nt9Ys8s=q~Ku&oA~SW$HXa_368sRY)mUI(mGt z*v&jpYlPHrVQ1<`1J>3$lQC+f#!Czx_qR;67-|s0?~qCD6>Jj<_Qa_}V6PJj$7ClZ zdVsVygSG^ypp`> z@d{-$jGU5IZTloQC@e7wOxVnJ^z(cp_zHhKi=0C};3VNRc{%rf?FuYA)p2QknJbhv z=cXK{-!U)eAnd0eTYeM%oOKd}YB+6c{|IYRSj8Xni*$qB;`xi$G@#Ee@<75vh zG2|l!ria16m|&iHQmD>pQYjtLvh0U1HeeZcq54ik<-Z1Su=ReEPIfqqer*AUA!MXb z1}I7vaEiowm|#f!3!D;ay zhck;iXZ^-82|92O31g}mphXY#@AnBB4nsGTBcl~dzkUn8952m2CJhEpoMdVQ-aR+|)+V24dW87%&%P7JFnrJJqAiuKNKxP?C1krTt2PKLLBOFrN z+XU(l0|v&XCDErp-$DhwH^XW=p2ssJ(6@sb_x$i|C|D+57gJ_W_C9dhiy-^%BMrh` z#X-uML=jvu`<7(X#DzkMe2f7}^+mKpH^H1|8e>qAnX|Zu>(rd5`OgD#HYDYrb&SIi zS<*5S0-+oSnl5Xm%%m9h#D0eP4gZv^xVp;V0mjaQP5hE6P0t?XQq6)v8$52@o8_ncG)}PUN}~IcFnNd@v(Og&s>A- z+2VTV2WtxxF1xz~xJR-q^7gaUyqwo~Tubc9!rC||d^vOpCo7_9vs-)O7jYZTwMFH# z5DG10a2RKjl9$B=MHIa~`Ab{JA~h%}h{)MYtzFF85>(M4k{TwhF(y>vUuI91xlq zC?f2dA=chywK%+pIms2MqlL_QvK+HA3fjP`WHKcQd(een0^pB^Wd(LK9wWe6_!#P1 z)}$MYH&wCu1A+CIqm2gA9ugL+>b+l@OCmX@kvH^~;m!;4R48|%E_LaB@);jvghrYt zI^#ZaPtkXDc4cClI)NEb{8KgXHY_D4V(0PEU#Y#{FGq;PcG`77BmN9)-`|yqUi&o) z@a>BPkK9s@XHzg<^L&w)V-fYtnC@*F@OlIx{=JTYe}~rx1Y&#fP6{Z_o`I0c%e5PF z*gMe@mY0V&t6buk#^9WSsLtJX@W~ePjFRM{T09pHzy32Qr_$%l@Sr>{9cUWdkZi6W zsqnEo<9WGVWO-?R&vw(#X6zmL?6sbAeLw5VS!cwwvy>kD;{Xbu?E7tV(Fa87>AUxv ztwCU!t+M=82aWm+CneVF8#Z-E0ma4ifcELrgffgTb|xH=EXgqqV}sAEI3Cgc>dr8h zm%jBjD~_@LhPy`bHNo*tum*{G6N z9&Pp0$%RkKMYZGWw<6eU<l8L2pz!LerP@q+nd|4frCEOu;8t zAyu?Yb{MKE;rRZygNX4ybdOJCj5U^)*F`{1fpH?g;`!P4^i_JqefqiNxtMRq)Hl=o zq@}pRsblmn;eYp9@O{P#5nl)bM9}bWylBKo?2L>PGM6Q7ipu0Lw3hAG)+t%Z<*7q0 z5OkQGIFP7TdWv!2YzXV5?sR#*EjYMTk~0Vl#0fme*iNPgk3>EYMk+}g1Qrg2zdroG z{)w8T6)XLU{!_IrGUrEdTQyav4FVHwvxF3NdY=eG!Ik~sAo4*oGnM!Z0^I-nAeg9K zlH=y{mzPB_hYl!7hw=dA3YMCpHkRftQ2F;UQvFULu&7Z{-Lc@R%s+Qd=;`Xd(nSCa zBZ#}N)h*(9d2^)~+h5q=cw+^z^tOspl};frvHpTXne&fe)pBgUPADB2jy*fg;tD7I z`yLhw9NcU$`2JmT(Z~OLc?g@_BH+I7!Ee?8s(;su1N=ttui9^C_?|u8eDTA^cChG^ zqGw;qrAqdD^^?)aen+wHTko;&ms^2o7D5Vru8EE)6b`c&*`xm29{vXUj+jNKx{K6x ziH(ZCZ!cti=ge&{3lKSh$O7-LSmcQRU2)fb;47JE!hQ&E*62NzmJ%`9H9Qm_Ajks* zhOT30>RMlJvJi)!Zpj9FW*9mf5UXvrzqCHQ&-T7s=cI!9g|k;ZPH2!fXp8GJUQo9a zjJONSPx~u9O$E{3w!fmOrbGeyLt&v!O%i*+dTnO$2kMv)SWr^?$a%O~E5e_I_uoYU z@WMe~y&*ndd3rRjG#MrW@j=~zuq}0Ub%PXeI3DVix=wgEe1nrDfx17mj#2KE`~L1w zq7!etB&{XJZTw8+@#=qM7^R(7MrnocvvPiGxJod z!TKnj&1Tznt?g($r*pFlVrg1gyQxS%qh*Iup~=qe+?6|vr$rbFfNcU>Ahqx;ugkR? zSA!8u&qK14S9+E+l9G0{8h`A$-^03`Z2(WXS zBV%I$Dhkyn&G1t7$`-Jupk<}ewl$~^dO_J|7Mv#z%VBDYt@{{_cb`Q$rb@WL++rsq zu-oSP+G2%+eV_%@+ZNsxws5`bV#Ak}m9b?0F0HwW*~L(3A>wlnX}D&^Hc+il2e%Ss zr7dmyrW@1T&I8@o<8%y0yuj@%U8}jApFb_GbUIzvhFK0mK$Za&#RUb2o&l{zR^Vj6 z^B5D0>4Fk_8%rM;|650u!IoRR)uCx+PHPZqYW&nVQw#80U_Tp+UaRT*?bqA6dCu(i zA_1zI_QQd8FE{ypENXf=iRb42MVQyVPJWnFMtxWH3LREm;Ucx^_Mo7ki~5hF3*{>Y zSI7iB8n5Yy{~udt85L#t?rRYRlosisX6O#-?gjw`krIXwLAvXe9$<)}8$>## zy9DV@>F$(n&bZIs|Gmyy=i7Xlwcd&MeV*sOuj_Zm#ey8&7aHr4xu7!QsH7;?G^6yp zRL44wD)Ra07HD7PiPzT1lS&PnoO%tKjR2tVOd9%*#Gt`x=H`{4eT47({`i7lO}&?# zs2on$NFVsn?V_SM8BZ7E(Z#`BZtz)UVbr|ZFnztbYDxjX zvcS8;=P}SuqFge{pWf(JKCmlu`B4e|qk{MqxwljqvSzTCB=?JF&?(sGqM_py4*ZTk zQf=bw~1LK$QRAumOAQHS4>Dkq=F@a1yI;isai=o4<0CA&k>|X@n;{5B}E6 z&!_C|vClm?>6<>xcQ|uq4sUaGab8`!4=m|T3q!pu9~_LGeutBt`!!PuIrTUnO$}~r zIM<5h@73F}|IeNjKyFIEJ^6P}#GXG{8*1&7-ABe>SY|Xj?d)rsUO7&f72jAi33vqs z9M0DF!%q&uq{z_0I#2G!`py1&kMmGryX7dW)R8~V?B&7v<=f^(sWth*5EfiroNoD;xUkGtdV1m znue~N_~eeQ7CjVtCPD=RDKK(h~#!*WID)N@s| zd^!JEYw}wOLLc>jY|uH3J7Y_W{koE*(zq-b&s&%_8g>+R@v`bHbU!t>xvML;S?zow zcS93o22NUH{kV#p7_rwCNpV2mD$r{h$`;v51ISl7{_cwd8z<;XBbvCtPmx6$&iNW^ zHoWpWFj(`zX0gH2^mHS^$l-v8XMUAV8JR%Y82)V;p7_STiJU?3O1Mz|p4qRw)-Gd? zMR2zI>t1PoaoHA|oqQxw2-TG1!JI`yffjuujRPYc9i2~Ea~0t=F`MD;P@1TP>2X6B z&@MB1+IR`bhwNh{x~=eQudao4+VwI4UHwZ4AoxO`ln=X6-YZ^X|X zAsy&nqu=878<|9{YRdh4W7EY!xMg9d#(L3Yh!bNE*$16pfyfs}d@&A^&a;|kx7i%f z87Qbk_PurVHBE$ke{3JrE;@;Ntk01B#IEmC&yVdm2f;P?&krPDS*?Os^<6yCQT7hfrJooH%FlvJW zus_$jgp@hox?f{Y7wM>nw-y{;m9GWiJ|i$_3ppPWwr$klfIFqsTJzouvZd(-z%KTt zhnsKul-adze6^t0q3^-R#8|B>9YGCAWi6}GDYT7r$|no6&U=IP&rqm%JYrM0pvhL_ z4b=<%iTcgvB`YD2X^Id5L3sntWla?Aqe4QCyu=+k7w~s1t<_ND_8D zOa(jWP-wjEq1fVxH+Tc(1uI>$O1*Gz!)pOUj*EMSRAozH%QdRDYln+kUyfWgKHiFw z&XBYr9TaCIP!yWw`1NCB41-d5lw=m?fKcypY@o@d0b*rQ1tA7^0GsxpBZL@c4w=64 zXpB}W_5NOplJB9^Ku*!-ezgFsNw{SBk<_@FX4YDc%V|vTG4CaFWAc5>wmDhv1y75@ z75HqYCep;by9i%f*ET$E+R_VV-RjAZQ3v!!zleVJg3e=+QEV}%s9C0uCXAz1q~rW( zdb$K(XS5=8D(VDS4IoLKmB%89wqM9e1 z|80{*H6X?xeu?PqPbls2tr&XWr#SXuh(G~#D1P*ZT!@#8s{r-OOA5QRMkfRgeKJmZ zjE_AY>6uU%B=F%MI#m2GBH3w=-^S@c*tEgg_}k$aG4?J$o*-arMhcQiR8~)ONa3^5 z4r+5xnEdX~{cLq3s^F)O1bR;H6mf}6Y>SpS0^d#!`b|uhYHWO*&b7%q_YsEiW9!pR zTG#Ws2y)>ma9yM85to5fMt&G8YS(yR1?FMjMiHM&^n`1I%=&PupvCYi*6w&-tze*? z1E*MM;P6wyAFBWzO9TnlEwaAU*sEpeBp(TiBgm8(3K1>+I>$G)!~w%vdp8GZ4pKnw zOM1eo#MR3FmUI-lOV1W~Lxty5^~;5hZ!IuVi=V{?yr;wVaP2 z<(b9a7MIY)B0TI2iLvpwQ&&;4J6MnH8yrM*nAfFB0`DEfKrVahtPs7-k}kY840+Uu z*F8L2R|B9?sY{jjo{6q?K5r35sl2MZHl&vV<|JXrXNWx#OhH8K*E+P<=+&0m{B*+V z?v)c<=AI-bV2B`g89K8=q!J+!$`4;p9O(IM zF@tG3%&BgmV_-`6M#G>nTOR)Pr`do%)UWT@nM;R=IIhQD)7tw*x&Vp2UngacbmNfa zJhw%+75nEo?Hkr^EJvZ?nWmzXx=0n6XrL!xAms&ZjJ&2*J9m6bM2cV*U*=wHFtm8zLq$sdr_nOP6-&Wz#YBs9aYS|YW zXzw9;FV|WXa|ajX{=yj6Q2Hf3|LwgO!*OA0OOeNL!NN@hVxIJCl2u%wta*%GHmC*Y z?$OVrJkB&?DPrDWv@{*UJIgM2iaBEACKI`UyQex0@QO$Wy_lhTYq!2G{OzRux+S%b zwtXis=DB+tn#eUfedSXMOSK@aW=7A>C%BLQDdaB;%Kal<{s@vlgU$ARcwN(l9oF+T zWsBf%qRArcKV~wL$&rs*09e7-m@VZBf@5=W0xngUM2#8XPUOn1=cD&~$LZ`1Jx(P{s>cxV% zgUeGO;O9I3Saf{~K&Qq?o-GxRlj0+T0qE6BU9|+s+4t*2GxyPc_vmqi)DH7yMpV-! zRysTty{v82bPHb1aG+08F3SoMgj>7)CHdIzO2VzT4+-`afo=2jx90VYy}G!mO@osm zPpUif#o4_-7U#3}lTT3dt03NjM569nLKAVw`8rKS8Kj$mvoj`sddpZg`L>^n^*nvE z+tg!;G}0s|dTbCmcp`XH4hzA>lWcLjRX-t%tT9bMKUr>DReNAlBMFsi-W|puQEi^-hYmbZK4!FK{rDNjm4sQGTNhbsl+laG|`wu z>|=F;CUv}k)&j?1Vrk0`RE-+kfM?rB!kk7TY#vK4klA{!Ec=_nv1%FQ`$W4ST-XI< zhZ*-?qp(G$mFvp#ln-I6zz`7n*AKc*D2sgV9q%DMcPGOa`%%>%dX^Boe51 zOjDyYhct;Wa1Po=JN~rh?Z-UBf28l-IouaC&MpU(bYtiv!W80u${L-wQZx~KZT764 z9pWdhSNWW}%)ZpP|LVP(cJRfNTn~8w3`6K<&Ty-qc!uOiK9aJ!g$DX92XC9j5vKt@ z{)E+@I`&D4f7L$Zvs1vc^cg8mV7p+f`K%Z=yzi-~Oi`**xBq2e}Ps{4jKDcQTzULXBI8qzs;e^NYYFSQ;CkV4bfWcDk*eHmv6J=ixX{-!vgO^}R)XLO=R2SF9$16x zahg!Jm)EfZ^-jzVHY=IQV$eb}m$$e`n+`=X=ir=Nfuq#W^_=ch!HgiBL~J6}bs1C3cSbZKHju0FZlg`g;4SJKpWddARc_^G6xDH+5l1AO z?k!Y#>M8WiY34%eOFyWTPfrKye*+F!+=Ex_Y;2+%+I=g5sUZ$hCuv-U4(X$*$fGHD zN3qhqZ^ZIlh!u&&d4W8e-j{~65O{Sy0QKa$qxesGV++?;VlhKA<5Pe!NP+~1QYb%m zPAB~BP`YUMl$1$Ns>ln(Tjoj_i$>fUIC4@Y?s%>m8{O=9cSC1h5uhYr-GP))9lJWg7d%qM77{Cha zac}g-TogwS^IQP$lbJ1ZkkkX`G3VW|k$^4j(-YYwl1Lf!@v)B|-|c_v;gb8SxHA4R z;#t;#jB^d)>qLA^{A_QMcm}giCINH|Rtp8YZJ+7GL69_5NOdFDJ1pafI2N7$E4{Dy za#&J5c%xlip>8?5?%-0HG1&Y(W9!bt-6(?t3G16z57DUrrYW&LYoqCh`xRWk>G4ec zk<~&v$a8IQdO)C?dXOit-?b)ndCu0gH__(H&`a={OdAZX1~0cKs9jOJqA(@1vI| zKK(34%^4N2b1J~7Fee|+3+|RD)Clmpd`C5y%sUsS#9{Xe-#1|YRW+226JHHH*)4l` zL3mh;al2R6vU{T>#!VFUBKU>IALY;>Gp3VJjbX`}Cp)KAwrgF3IMH$wmm3MWdVPXw z=vl=AVK3jIt)X=j-9PrRaIge=MG8}+w))SGe?%%n4A^_4xQwf+G6WV9^*3MZd#D{W ziI1w1T7pP4=!Z}>dvsB4HRO8z9k+gB=-ytCP7z^Xeprq5&wNG00G=;^%0p1_jB(rDo)pDJJRO2B8D~D6~0^Jf{Y5k z565zVqI3RBgs=V8v4&@QtP?mIPdI{mXSf{|y@bNu;q~(JwwDK(6qtExb3_di1^>VOW7&Q2Badxp2-`;fCd1 zsr#t$?GN*q(2?^MndbiZ&lm2!b0 zqx%QfO)PVVRXzOozcukHxIXN* zU*dMUxBCT_YSKPro|zy63HcaWFM&nj2tl7p&@a^((xs5id8k?%b#&90NwR)UCU*83 z6~t2S3qJx(izy@%XFXK^{h|AMQg#UixiYwzKI4t`GTsmDSWLj<{3N(tyb>e283~ zpyOup+TU}2bLL96g|0aSMD}8#FO~3r@x{AWc>k!3^H*I0mYz)&l@$i9Vj8ryIq;WQ zuW{hguqT%%W9VUU={H<{G(|GuHepWE(J*cMW49~}qfpqAB!Xi~A%Y@?8Y()7#iWT9 z6O*!C*^`F_2EZ)EKbnhGD{U5GSyd!Q34|1;&}zd_2iLdjXwg(ljEg2Ed{1WAGQ%V>xAd8RcsXZ&$fgEIcKVx(a;UuC1gpzfB|@IH~kF9OO6TkN!6L+_#Hy7`emm zEJ@FDKPKtMOCnS_}Shi6IS^ehOdW+@F2#R7VI#;Z$+_c&uTWdC^icxp5V+Z4>I zGjlLW)sl(tnMFFQpiu{&nw+^}()4^dt|rh+Lzdmxa(OsML<)`Jk4K3bQ$s`b=&Acg zk`cv&mW3X|u&e$ol6P*h&!nA`;i-xoX5uS4+Sxj7t4L+_bZ(PH*(5x=P}*^%ZrRYU zIN6_W`Mn%PqpMf)8D(1MOoziO5O}+D@fWhv^7Psd>wbTqad$|-EbTf=RvG?AG79KH z`?l^7E@oo+q#;}kk5sNUCDbW`gm0d%e+CWzCIPtCx!g>#{m@CI+2QuA$Oe2^9A;6R zB@AaV6=yja6eeYv@L&6;AQpi-79z?dN30w{fy_eJ7^@FcXrArl9qU7$OTVtaT0PIh z6|cYwoi>-##S!QvV%OgfeRIgbREeHrfy<|C^(g^w3Wbs&>!#9~W7LXoj5cl7_MNL* z1+ij+4H1CdSSP#C}VWrCN`1Ye1QTkMJ3U%;Fl55 zT*Yxy{7-C>8hl-hvH_$l0ta@VaCsG#o*e~ z6_b5O9v!J=cGvkgxkG8P1+BCUq%JyXZrWwpCW0c@BYRCzSvk)o=xT=*(@xzQHmIAY zq)yIMT39%B7x!5WKi#bN#S+2(_qI!nh;*g!jZ%j~E_$63$&X+Ad9PA(P^Vm~Gu+P- z&r-{U>^=cu4gM6jaU;ZV$D5$rKON8I-0x&Sb8jwfQk;IL2nk zV+%P*GZ|ko_T`UQ#>1_QVeTw{U!`}&*cx=Q3!Iu&9$Ep--w}7rq}3#?QPl8*u5g0E z{0ly;AiR@G$lRUrx@W>BZ-2XCnWlGV_^ zz^n%CmnO|mG*)N0L+D^{nP5)J`rzsuJZuoN>k(aI#}m}_2G(Es7gDpZF@qL|nJg(h z-LXX5(7FnC!dJ>wucUe~O(M!4()LyKT$%kzuQ}JXl6i^$D!dt!Ddg$|qQMu%?{gNh z_xN?st_={MF_!tkw!(zZJ6;43pioL}0x0Ki@;T6bo%}zakI+cV^a*{e!gi=KG$oCG zF(WPCKDHiXJjk={jKtCKKY`maSVD(SaIkJ-@{|_9W_g)qGHs*ooU<*^U^adlS*niv zVuhF4L7r_7@i*n)L8_lZ{AqY9(|X&+FbxgjF2ro+w;8jTr7&rzMTw#n=+SNhfgxWy zkKld%E!&$!E_4KS)?kCv@8+$=ir(8avCb0nkS(rF~wdYYw}PiX%@P6N;VWuoQiM#kdI;=QR994r#lNV zWk(!}SNo2N_Rr!=Q(VND3bW{mG=}?k4wYy;*LbJnBzFl>XbKzmFv16jSfqFr#7b;( ze>wU?9$OtlXov)7ZkZaoTR@@BWnrcs=(~?Q(WnIq1af%#ZcrZs!#Ap~=B!bI}@sGLDSjoLl zB!H{3BPShN2uV?mmBGG2w#dz1EQ3DnXl58TtC%~*{2l&~DN;RTnk8{Yf*x-$4Z@+U za?JrBgb~Xtzi5jZWS_HQ|IOvQ_H}OR=^j-VrzzD!yWotT+EWmK8{40b`*{9%|2RKU z5VMf7>*+)QB0rV4M!Us~mv* zdgG9W%0_$gdC>~PYE$vz23N!i1MZO;RnLwMUGyOA}RSDPO z5X%V+(N7N;kYpfxIzOvZ_jlpnU*ku395zg`M}HaGRGgO%z>w;se^1gaL#GQ>Eo6FD zRjjgSZMKdJ;vCVW3UT@*5z}IjD-;rI{7x#K#+XD^rcJl?VQ0%oVZxKho-SE-mwr?b z>;;vNEZ=@k?qN)ezr*l6^_>@tMUIDQpvjS9Rn`-rd6up6im+SY7iS1Q30kvY%{hDUPg2sL{h!8P!}X!t(xFiq?`)U@KbV_WRWjo3ELP=IoyFcTgMDSX zW|_wT9$jUEsF=@$zPz0my=HBZj@Q7*{# z7h$wFq^L5riuU3;=ciF$Zo)rLmdx?9X)4kJAbDx+VAi>&;{5y%0lPnq<()9~?NvtP z#;kP1JPo1L+!y2p!)he<=`^cOs^pXvLuq2*oJ8v&MFIvAV?9_z?}!|G5BJeOS%c#H zfnT5I+SafUBln!j%u~Vm8gFe{rV_J4e0>-SEeQkq6&`k(_Xu!?s!JzBOVcL67X=Xe zRhl0Nu?3DUz8*t$aqo8bW$(0l@ypyye;|#2NwZP7Hwm@Z%A0-d~U1)qT&1xU8-eNZ@&sKxwNp^8GBAcZXT%sFNBzy0{= zr+8&*VGkXbm8>Y@8HCE2XBLbj;7u=hl4d_DU%>Wbbp$wbz+Totf90xerh`L)(^YaYS0#xxO_i&gBw)Ynard%N9FSz>%$V1z z()J9>$Ke}+&fu);C%k!Z(XAqre^!BlfdMT->VO<-h}7Lw?wXg(bN8 zX@mYiHSZ{ok@w8*cSFZJ4Cs2KXcS5s!(3o%5^mN&L~aea=n~5I>$POAeto&vH0RBI za(fm0ztRU0A3TJ-W3vSPtpOCiAGF~aT!U`r6ylzwQG-&qXO9qECk&GzR}CsNC>E8_ zL_Fbf(lwbpjsSkWoEj)rfW0@xZAJffd3iyaY__ZvWnYe1}^8z>tl>qKZ(q3 z=7En*b4MiC{8%+`f4$&&&&F8m!> zGKwEdHH)uUkp3mwU%J4UD(5V#TeG(nIC!Y&uOw)3A+Y>w${ey+-sblVom5ir@-)b= zr{8U7D&hdxe62YQ8>s<|CD6o^{2*zKmGmwqu;^$&HWog_(yM3VBbUU!#b(b2#0y9j z)7Z;eg&}{|9Kz_V;aqE(cCJO8FC_w&$1)xvQq{=bE1Ydg9XK0h2%_D~Us03 zN8Rb~xIRhMKF+)r8n}xPk?Rc}>Xy|Gd0Bal2UvDz*SvD4m5n~zF6{fFm#65#Zq+u! z8lHg;jiCpNMp0m3qS0|+{T2|!v7?mu#yQar+k*MLI_Ol$F7pW4uecS`SbAEL*G)~8 ztpI6^s^oJ#iK$q1+r$84$wIl$vG485G6ptU%mZusZ^16Wfy7ujUM-{02w#a)|N+iX}K=ex##qHS6v ztV*XtSx0R&Kle5}e? zZxeV{Fa;}NZ*Vloy9+tca4A3c<3Ah+hA)WnX`Ys6|Ig9yv zmGcnvA;$TaKo&OKtjmfcJZ^Ce|7W*-Ap2kgcXt=YO-BpP^XI|?Tuynr5hXNowZTmO z?Xa(^%~LC6SZBOyDP@~pIUXMz4J}6>56LpNX&s*m%_(0>T6VF+0a^a zPcMvscD-;b*Ll(}t#FI(>V!Q8)aeaTf}Eoy7H3A6oMcJ4oShO?}-Lc%B_!J%6_- z>W2T<>;<}771Uv5xo&s9zEV&Iv*v5<#d3Cgd2~+sf(nk>W<#~rRMKMkG`b_jc_-yt z*G-Dlviae=HZeT7qLar2CS?At;1}(Zk82MrR1duho;F(`eq;SNI3N6eYTdUvFye5# z{uw}EFW;Q)9(Zi-SUlzB0KP6ZO-_~Z1ec5dQ_QPsw9wD_z*=3KjRGlJAyovrn;=J4 zDEz^U=~a?|r^^v6Nv*w$nfjZ$ zv*AC`K-7QO2niX&e9t$$fE9%-A0N@cqpAZkVz1!0Y9U=XOKbu_I-`Fvol{Nmeij?m z9z-+JAJzMSb^p)AYk6v+J_lydSLruLk`KBKoyp$oG?jkd!ge4q12p}VmGCJ~D#JjC ze#dB#i^O2TZ^O@kceSg#x=@pqw3KFxbaN=ja#m|i>N3GU_Hz1H9bPx@mK3I6a zZeXbjGxd*GXe%PAMvFt^b?U2F)h{AlOw)C^s1f-j(+GbnB>c~#Su7k>wfdGiR7r>v zkQ4HJe(dOcMtmi~-it?F7&d>GE>baa^l5|QS$2gcu_>uw8!99tUnu2gc`hmGJ?Aq= z(^bKBX>*^aFIRg+YtTMyd`DfD$$fHZ{H&6c(yTl^?qZo0*&xPrlbqjX$tt)D_sKa; zJ){xp7IMP6Q?Ml`SCg3~L6rf|G?R&T0WV}zxI%ZtFStGth=XGUvfR?&+4V_L!cb?P zE^8T5mO!`aWn?!;y|YZ4V$6*1Gli&oUyz|Q4QjCpy~xFrxB)|cr1eTt`L?=xaSmrP zYzvV~rwbF`XTP>eByHVhoo*l6d&({O&<0|_{*VRvgeF%!Yysg*B>`0hJA81^0Ceu* z#31J?|A+7Fv+|GM=>BBpJxI93yTld%^%>4XG6p5$lQ`=VwpkBfY}RJPBj-P<=#6mA z{*n}qYD8`%WoLCmQQg6XO5U--T9K_uF*MxUG>%WiwG^Jcmr736&$F&z{Bsvp-YqgJ z2lY*Bv}ED-xHl7{PG)hgxLB3>0SuGI%quT_LvfZK8*$xyHY*kM;&L|PHu|@nwo^t8 zrySGk1ypj==jetLs_xsO9#Zko8x+m4&qr%z&O?I6aX`4Aen%5>ZnXiAIiFt;)+$i+{zYg$@Z^8++!y4{New0jd(DjtO4jKq6tI` zqqMMC+rs`zxeJU$rP(V9E4IpK)OCU6$nDNXmrNz2%B447HT>dTH&0(B-DFGsZ5sab zT_`tf8yQkXX^tbob3L@|8Q{?S@<+HA`Zr;>=$*iUp2(KUPISTc_a@1Zm)6OaVp3`? zJo%Bg>_x0y)XIPzWjPf}LpR{PO?QfwgbpVKd2A=&&lk>i-N9{E2Rhpq^f!(d+M+qm zqF;N*XeFsHC1^Edw>(ql%(b4y<`bZc!k)jc3q9C6cKvU2T;vhsc>Is4P{j*@i^Z6s zEw8);j}+A<121`zVR`DK$n7)+x+BIXL5v&^U2lIacVl$5opAt#fiOE&elo#t$JhR+ zO?68I!MB$?KCqX4fqsjv!8bqCP5m^)*NHolJ@PZG4Ec6f$hPjn9D4@BP@zNV)1o9B z6CKSLpo6h6e=7}d{QAER_Uspea0?7d^snb1+(?-s8}^tZJq4QXG-mDJQ3=ox%NO50 zq^>}8-L{VZI4tm&(u9?2p(9wxcV^je8uITDy4k zPd7;8c`G0(y%1f-BA0}-9Ta8&TMplc_l8|WU_=?m?uy2R*RA_3aPs@feiGFv*UeK1 zMShk`VPx!}FQp=@aNVZarVOiCYUJ-&zUyJils}Fdb8jwaS;}Ue|2U@=7x|RRChiE{ z2aEZV{;^}bICj=TKRKC!{&FLXb|M#i5Ak zl>deCW1{%VgOLY$2+d3Wf22QALR2Hlvsbdq*NbXLTfgaZU24)o`CgkiCQu!qkiCU{ z;{)ASb5%+#QfVz&=NY<);H=+s;bYeRf3Ly9|4A#+ud-rTrfAB`^bSoV>p!5jvh`&@ zuj45a`|teq^}l3+_scWXPu$D2?arsA7tY5khtc`~&zzIFpW$n39Y^gCb9=KRS^rsa z|CeYXhP9;$yT1NZ^6*^gVO$1zCFOQSTl?bfuE)m#kOV5ErGV#S_-y%eYc6D;@6l@a zU}Wl_6F~e@_TNY5sF?E``F89w zC2UhZc-z^Y6&wQYi~Z{xa5fg^tzffj52Tk?ga#NLSVelUU-%fI9f2Nn7pVZ3@Y}ol z@`F*xMN_Mfx~!l5!Kt(8Y5q;to;LTR*U_3C@MzO4~<+WtveBPb|XYB^3H zX+Vy)FsN61D85t=IF?$?25dDKkPvQQONqIoayFc714Ttg4P#n)`bhWNYCN~vDkc4J zb#?WSJT8*iw}Hc`ezoP^B@Y=<9ne3tyL@wbw56$~CsKu_KqS8N8vuEiSHF zU`CW^{E#dCzMcthh&=j|UQi)K{sxxr4!Ubfjh*{xEX_ixfB514eQArr>5n~tns9>x z$>SNYv>rCBZ~oIL(24i1`lpTb^;b(15*mwfDD*WovxFH97HVx3n&{TA6vQ9-R@;e18nd+1Ia%lI$q}8;(xm=LdDEN2Z4}F}QD5J1UTeq#svKSA+ ztzmgOpGTvcu06GP={~vAW}<3Fj^fTqi^?3MT!5Ir8RT5Fq08c@N$opRX$D5}zePo@ zWtH(xqz-G&JOBMGWU|#Jsmut z{q>LU-&=l_M01)D?`WPN4zqZtJ>fHpjs_PLKV-Uf7ycY9PD#IXUsEUwS|)I%5`H|x zT>{(>Pd55(TDv4;)=j6sd*=!}-@wmBp`3I%^(*%s3>``T&)tvzw3X~6Lh+)F)pOu5 zp*-+!5s=9nRI2-%S~!0 z_QdU?!|}s3BOc7OO^W{lpz)ebv<#DHA<1B7Gh|D`Z3Ow-bR(+;Z8CGmLzSuf*T``T{ir-4^jy!DQkv4mJL?m zU>PKTUF$r@SBq>R;}5^P+-2bqP9+4jfF3FJ(#08!@wyF~oPgfJ^!vEE24_7PeHjxw zg{Fram4rfv)@$=}7S?%=Xx1@sx2&2P!+%lxmxl%mhYOzbI!MU=_L9mDxkdfw49p{g z8x2l32TO)2CkR(GHSFcp!fY4ro-dIE^>TMHAW3`GH13(3zS9rCY=}ra{RG)s| zBD32U5IWfY2YqZSTqy8Hzm8$wWH|x}LpH~mzBUU%;Yci%;9vjOwSes-bwsa= zaz(Lz^~Z*mSp!X~#Tb7&8m>{*q`Rz@@odG4URAvx7W+o`1UuZrM^P$tblvl95BCPW z?gvb{O4wgd6z+zmvyw77^nI@qp=@w*<1#2J}H0CE3} zB>T0lZC>r0(PFt8g}M)*Vu^d{q_aW4=a>sO;VJsnH&%a+zmJ_J$Slt`R&EW|=O`!C zBg1eSg$W65&bBqk$a&_&Q~2rDOa$NK)E6otjH*$iMNR+UT_W9wh`;?GW^;XHa(Bja z8<5$|jaCjOnF-rYaXpW&yS81x_<)X)i>Swi-PTar^oI}YQ^f{*$nn4%HY!vr>^$jEHB7m4zM=wa+{{M#g;_1>a%GO!$= zA48yfx4TC)q?Z}6LkS$P>DjU~1oWCkG?>&*LsPBC4w?f4ZLUuU$x^Vb=P!3BJ8rs` zw)Ws92`9s;qI*OGM$5BBOAM;X%X~^yZJrfQ3&O5@UyQ!$-iwxR+_p9klxGO)=#ZA5 zi0vOW^!>e@avscBqvW6oYhCJJ5uf%cySF~rf|iNz>!yd4bXU=6!jIA}&2BGe6Y$Sb zUIUWr+esNG>+1RYOd=;m)JI+`(5uBFE-Wfy{)WG$Sf!qquiFc+Pk@Qad3jnm#$5P` zgN{%0{A7{Q@Q^Hi1>;lLhKEj2N%4y?8A(pgm+rQIej*TmnehkoYHjr5;^JhMU#Cs* zkaWs4!MyMVA8+=q<+zcES{8-}dE?_y8lbeGW46(`ceztf1$mAdZ3XIa)9c*YL`r3Q zxz;#`3|X&9`EX|g{wg)g?Ae6sr^b&iN+Dc&hL4Rq^efF(!$IIO$IF3CIwkq$Jhe0z zOqq`fn_ES9Oy*TcrG9cS{WNZl+QfB5Drql$dN4d@+^^$Cby$PQ0slV7#&neoK;Q*%E`pCWXHwga0?( z-Tjcrc~^E}!=u#R3+hSqbV97M8MZ*}8sCDy6O5%jUti)P=OK{-P6KO#WWCzsx%^M_ z^iP&Xgf%Q+%=bfy3_PZ{7ZeV5aWl=7{)4;z?!T^5VV{>;npMTUA4hCI;o87adYFa$ zw4V8;3 zKjhH5ND6Tqp~V*ITyA!5>~SPF^f7*Ll4W{6n96(oVt>XeBBbW)98)2c8Hx3R_OjU3 zcyR9A#CVNCLzhb6ZE1bh6mNp-6$-@Qb}f6?XX*BDKTnJP?v}`Xi^rglS;oF2GC9Su zBM7_Ner+!+0;!tSMT+0ggSZ3~krQiJl>>cFp{W&ub>c1&S*c2b#x|duxNs7K?ZL88 z4WZ({iBXwcH1$*i371zWbSMG|6xS#&0PssN?FiqnHFix$a*^fS4A2_I&M3X6O+(d1 z&ee#}EQ6e!Lx)Y?;!XbI6mzkD!yH%{P%N~RK!?F%b4T}%}&*Krn zPmDt+&SSsh=*}Sn_~WFL(u7>zj0I)9lz+P3kYCq>#f5<~>VuQ@on!?GtnfoC4H{kO zsk*FI7NulqBa76=Oj;cmWYR;}DFp0#W|t~;)TfP1pIURmX(V5~2#FuUK_fYnsmo*h zaz8omE@zz|bBm~b>-=i4(d8USmMucV-nT87?T%|ueRfq0Bcz4#xeN_DOUpjdtNl^{ z`|E}OOXU)oqFQRyD#rbJZ2>uFLthU;s$iL0ihq4HTT*l^z>0bkpA(5o!rAt_mvP?k zr}U_$AcIVmOHF7Y2r$dGhXVDYt?!Lv#d<8dW?H`UL;F$*z2$ zTG^JR>8245$3n`yl3|?EFj&hrnhYby>WK(0%*#2U;nt@ANs| z`559d(Z#_K`N(8nueZn~X6hapRaZp@>Mx4F5)?etWmA(TUQU!Y@AA;s#^f*w+W|wr z1jn0$rat^CpR854%{i;Bw<+_5l>uEXz<0NUW(+``?Qs*#Rq(2{S$18^6&=9h|@dWKoNA?$VmXp!}}I;%bmXO`yotVN4nt_XS>d3eAziU4UuBk18E}m zN;g0Uh`|(CoYy2z*x+#0DKm675O#GjD@-UCHy`+H#@)0TI!Vv{=|c;*f&&hP$e*0t zD!ZJ%J@7ng!0cQ8kc9>K!R%x;rqB3x4lj>dk4hD6K=iCH z@Ufw=xpskW()M{jf}f2b>j4(ei`Poi1YdX1X1D{BYu!pSHeZ4CO*^mrx$VThPoGgm ze7DZ|&J!$kj2y#brU9gCvlfvEIl*@5PP@~aZ{gb)8X3IN57bb5#gOBcuQ#ai+i%c4 zRNMhm^7YUvDnXAC&~l_(!o)i{tJ!hrTdb)M zJBr4K1kGu_0$HNJ!|7MHJBa{^4Q#G7j~M|iECb8Xp880 zcseM=96HaiyN{lS6Sj!A6$FEv1`@oe(#AZSx|khpF{{(W&~A}j)NGTR+VE(C>c+mA z$hWTq-gy)gmuPEc@AtGf@#Kg~SKhQZY=nmMwsa(Vjw+^FGHmqRxOA)S{2@#zMc)5Z zBTHtMFQ)Co1Cc<45>?+zt~IQziTROrx8z_zfB%$Bn)f*ZtAl1j2rPyCBZ3eZI zyx@9^92AvP{R0~=VGyGMM+uj-K)i*2@or(0j;r{GoO8XN&itMuS+?|Z6of`1uOkbi zxyxpfuH*9J+V2jhfZ}5>8TK`^nlN(>9P1{x4#YqExk>7$nnL|ZNcg%|_M|rD)DMOs zcmG~?sw|%pV?r_^`4NQ-n5kq?>YbLb&OKXq-kUCZ&;y$oEN~-46u=*>h3bCKs$_#8 zaHpmFTbx7`czF;jUMM;Ds`h8nr=~@Z-+bhj5kE@SX?NW};3Sm2Rt@O6rcK27AEUgy z)AxLSx@;+G)a||7v<{WNvt#R`r2t-dSG{kH`E_Vq^hPv5nw0dhJCy5sW~fAXiy)(F!4>C-5Uv0LM6yqR{?Q*8GpRtkZS?`VU=6mm?}2uy9*oho;kTc$Iy*->`|6vg1q)2F}qekZE)%fH9SZC!M6pIf!2n`VEGl=xHK*1pf zD))1{Sj6*hzLBW7f;||F9K>7$Lz)u}jToOWYmr%zW}jI3ROWhLbi3u@enzd>rg9{! zNKd-pF|>=~%y`R((C7Rz*^q;n&izQ=t{KU*%i&ByXFJakj9olQOvHE_e z?^<@T$5MBgGkcgMZ<`Y8CyGzf*i>nO7Qxs55~2UFJ;9`>R#anCmNi4P@#f^POm6M2 zIF$#PQBlK{I9?DVTsB-(J)a-fMci*N!q6oRc!sl?MplGU?psMdE@#ukJXQHjfP-Oo zkl(^QF4De8{Haw1dY(QTIB**Gyt9Hao*fVSQB5e^=Pmj=@d86u|DCG%YHuF){q1>m zGkC~I007d9?*oVRxvi!WaxqIjR#yl%tE}NwTsKQsWV(J@()VuFjWCMWh+=xpMxl8I z7($bLN{aI*=F>i@p>WI5tAfhT?(fO?Jyk92q$n2cCw}jwdDA6YT=c#8<<@1~t`Ao` zkxF194kjN$xgn5$wzd-gQ(_96%xFM;z>%Ea=1n*AP}9L&Yn)AqnPK3V1@3wpRLi?9e3-O2-~2dRqv%)6DWznKzIj} z^o2l~NNL>1-71>}p<0PkhX2FUS%*a#c3WRMrG=pxI;6X62mwhckrEIPkcJuR0qF+m zP6egA8|jkn?(U9n&U@bP{5f;YHSxqfd+&R#--^qc+>ZA6VK!Izx3_4x5(uegn#{0`r%v2; zamDR+F$<(@x;**F>hln0EcB#|1Ph20(1MOeiWOrxehzLc_^_fMd$la?nJTUHBICvd z<>lpB;`_O4X`cuJJVQkmjQXwrP*d4FQXj^%O6!L3@ zSM-Ndy2b*ze~k#7cSfAqs|7pYoD9kvb>hvg0wrm^kjJWL%Fiirgg^61`WhfG$U4|U zNPH4SUM2{eG`G)$Dg2x4yy6m|P{$1PjddhGNl(T;p#-sg75129j6#Y@%A@;_HY-P9c)Tt5Vp5mFNZXLXu4g;J~wmFE3F(g!Vsb+u1JEn_$oj38B%w$7LnhWV(3n zI3Y8;arNl^d=zPjz@#2=&k3s&VlKa-&Ba6C#5;3@8L>(XQ%sy5z8S)3&yK+F(Z&5Y zck0e&E$7l4+e$M3Y;4}}l==K?;?10GY6i+=4wKbr=8hnnT#VAp;5-oP=`1I4&m|z% zDa+S7YZ6eWcmIr$xDdlrzOkw4g4eDKy)qdDXBF&`w5cVHEF*dtdCLKg1Uz zsL0zW^DKKdJ2OdNHIiPF3*39X^W<&~Nj6z-N8h9@&3QKQcTeFCMmR{&HFlQWp#mZ$ zuQS^FkfdAXu5y>GIp>ipBcu~r{iF{xhIub*lB(^|JXvF?y;t2w#ZN96G&m;S{FKgO z{FrYvOYn0-*O?lhVMzaN+x|*h+51$!4he(G$#*>XziEKn;n{|W zJ#E7Apd`zjr*I_zPP}PABLRv(ejcDW_*n$AYX7Ux=lMUNRQ zCsE50F=OgaSw+sd0q)uA1-tVN;Y<8>sli{`m{E@6P_PbrF}45Fg+)OBauH-x-wr{zn@%omE%u1> zZ|c~mc~n`{qiCn$Qs=((AFUd+yue)&03LnvSaP3yXcxiPJ+Ws+kGA!kij1*Qe0^sZ z=ZF4TWtKNg&^)shDQA)6`}ea@F5Bi{yw}bDVsIl^L4Y_-H{m7*{U&i415^W0f6czB_5nSJrV|FS*4oN8u||b8^jq7dCMI^kzk33 zgry8V1-uBj&!Vp7eBY{MNi1<;a$Q>^g)m*^MrUaUAldmb#rbm&YoeFpBf<&p!BI!r zT6SbCwnEXpagiX>nHa{-+&R!GIIxniK?>;1e&yq>?M^ERk4r(JdY&-`v}Q;eDtylZ z{30C=OTMaMTbRj7bx^6y>YcRveQkPq_LMsZ7)2T&^84*xW4EVwT03nH?;??PLbn#dSTrN zrb{_L8BcycrwQ0yZ{dPCxZYO0pg7arJwHmml-TpV%O^~(L_>6W3bpDTY!P*gLtA%QT7IYib_>Ba6qH)2GY5S8P5HQ43KH5uV0wL_2S(5yuk z5?)~a_lF_$?%KQqf$Dt6) zQ~Wo5&W_5D^DEe{Rq4GBO`m66xmQCRGY_*GRR4@4dvR6#`=nF0RnDukKb)O$rRvV! zjL5{%*Z#PRWmlnf;cr`yF|}#s*3V@8CthZ*c=C<{KDUX(=9en0&46c#@v`P3i1=p1QDbzZH$ z2@6&n%sbaxJ%bwA*qovBOX#Ixg$4vnpp*v8)VO9_Pn1W>ue`{5n49{MSp4u#@ofq5Q)3l1XIWWG{V6JIC8jKkpf@K zTyvo1;TEUu*%fW_nanJmP{p|fioZBc!yM1W;2zPZ4eFOMxKcC8`03+Oa*~W8`<8IQ z=>kHS6KEUREluD`ds2=5NZM`CcQQOa;&vlHvazvJ00Ta%=8Xl34A{h^7NIEKDQ>0Ob5OS5 zoJV>|NwT;=1C*1?C<4W?+EbU`c;^mrv^w4BiXgPI|~=e`{}TJ{*Md(kcN z`(3*0Q$Z>>SbY+|Ui@9~j}CNZ>05ZbjH$#4aA7FDJ!aq~SzimijLE9AAm?laeaD*m|y{KQCzF%-p;6~T% zC!n}z6-uAJiLRlbvu=v}VnUf3D@!aK6&sZ?p%B4%=!Od{Dh*2KXESx%ve zA-DRKX90=-5W6twaq_;@GUuJm&k4RW&y!SK+UK`y5m2lgOh&En#|<;v~$4!MG)GVwGrXyHONBrG^OY7w z06fZi*4Wx;x!e&R>dBRKx)4Z`iOv}!0s1HR4u627YQ%B5ES5G(iU#jL zcd!)u4wbfnP@$tG`0Qq)Dw3LiS-N+9zGa%mk@jJip#K|y{58i`T43s2ULcf69=_}eR&uxYd&7fu_Y4JG0(|B2k7X(L=x>R zY1X=htH;>JfT4wM&ux&t2D#OcXK zNe?11q#zMnmuSD9ECajh-rHwh)siDv44?j{GtBo)q&X zQPd(5W1s#n-dqc^S$j!P8Meu&h<9R@VmuL6{vYv$1sIy(?bep=-m>yEpO%0I1}Li# zE9)$iQv=GI2~Q7GVU3U!i0@h$5f-}`Oe%5cnz%jNShV^pCd-E{PaGkM2c=boen!rJ z{aI}ind-wd5VX-^IZ+=yiHb*Gp8d3E55mRB*v>xU+CNhj%}2`$J` zI|o~@GaJh*Xw~=%#fzS#Aw3|=fI>5MbEDi(5%jj@=yyGM3YkQ*Fv7sQaLfnBb%eW9 z)GBMrlOYWdWe5e>mSR-+$zS+~gbdKbtn;fOes~I?@vmkHh*zW^(IUsD+51&6>F1?P zwk@$ugwCJl^cmUQm@tInDRE1vni?NBMs>T$E>)JBRcZ`gVOR}JFiqRfS|#j3R1zQGm(`%YtZNUL9MK7HNzTf zOKT3Wva+R5UcjOC0`f-KRd{wrZ-v3}ndqPa`s$1);-~?dUAy9Q3c`Nrr$Uk-A%VPy z)4T@S3sHW->G}wWVa0OB@H!WiKw5?m=zg0_RU*1^L2oYss(ijIsHzf>w%$a@Aqp0oMp5?EKr45 z;7Opj_ArIQf7dP=2W>j_OKO)-92j8QfR`MIRCDVw^*f*JIa5$z<)=+VVUDYIEN7W8 z6i7{;qK32Us@PqX0C^dfO=bfcV&A+Dk-S*k?;X-I(Awcfezz2d2JIpt3j^SvQ6P+a zCM7NJD98Po@Xu?_59r1g!yE@g!8$tib>z6jnKSsbvQV2dWSMN#0j;p{k$Hy*bY@-X zZVc{UjIDInB0O|A)F6s%?8I6#ckdFrc-rn%l|CFe9tsJQ@J^aTovLYoOIoxh*`0T!56g524i-0w=%l70>aXk5HV1}S{)aVuS9v)Ml zr~C^m(UR{?if4Po`&9y4`TB7jFn#rNb_ghJPZoFiBtLTtO+10buF3sH;smRjyXn@l zo0;ZYObGZZVd6)XbfJzs#$CFAJS{HfEdW1Qt(4JYy%3*#Zm?QvWD=7p) z%qJ$ac^_^g5d$ay{gBJ-CG{|j1Pil@;Oa~=l(a&$c~Tx{~BH(VEb0v^QKO%lwGr$tC@s{;JzbKE$hG zI=6}&oJP;nN<+~X=oKS*PXYBs@Fum$bo39VMndq!DSrltzt>0$jRA$oIg1lD%anPq z)&?!MD5qv{VJ{s9gC5u2g^6P4;dmDF7|kH#A(jZ;2acq1XtrD-y2-i88f>)eyazK)L^0-ZG893EdW>we@^ zzS<^3^A5gCcvkhEW66?;Hq^0qf&{%yFFMDu9wqW& z)92~XM7?L)h=xTzLr+?GDHQIlb>*J8EX{!CQtd2@*J3?*K7)6Ze~Lf2#2!o63L*Y) z+cnRK2st`y8t{S3O84xqeok&D`*htI_MVQM^iFx1=Laa(G>R!i#_xZ9DnvAI>>u4? z`Mvi^pAf1yK=b;ag3>|Kou9np3g=&Pl=5IAUo6*<4>__G48@5^ol*@h$nge!fGB2y zC$SPiH2;2faP&08sKpM|xU(@?XK1j$OMp(LDv?DN$+^1PwDd*FRqCc1h*8j_o`zaX zj>1Kyvsm~vQC-!^xN?tZ>nx*D3aYOhEe4eYgF}W=>!RE(sZ3D2nqaRq3=E)KDkPEJiPLc#D5ETIld$n;tehUZn=;|k!g3fV{ zZR^9wPmz=((jRx5_V`abK%E_%>3zz^sw2|J{kSqxuy^|J<}S6yNvQe~Ch204Fj`vo z)lA|B}~Rf#eD6&V)oh<=W#wbWD_ ziDQH@IDZhqjp3Z>kJC-%NJwzst}xH5qaRAYlo)a04A9pX4GM($vV*T;fNiJ!uB%I$ zmFkhn(93G_?r3a%Q6r(GpF-csL1!7HWcHQf`6uyl7mw|9ay4U60w`hF@<{2yx@+f0j;Jm1`l$)0memBzfZA zyQ!wU+AtYWDE&YsNecY`3zq^>YzmVy#lrv5hrUgly$rSOwRV`tW?g<$MC&8Rr(uPd zoABz9pD{O`#k=Sfk)rAzt-o!2x&V}CqGivDhl%RQ!JSqtLz~iD<(3`I2|?X&InCCo z)vDH{BqCYA-cJxMUs#lSr+5+|#w(3IJ_MR?lwNw6k&^8s|Jv}{sD8bqxkJ8k_4g$3 zjxS+`sZd^7jV!~7+_HHE|XtAa`qx$bK8oe3? zd3?6Amd2(Jl;lT*Kp1!bh>4sg&Pw^8N7yuDiFoMe%ZVS^%wNal2oMq0bKr;YpRj** zyIz0q#`jI*T#@KMuLRLJ=))5o4AtPLow!zDG(`N5rOL%^mQY*=-y5b<_{E}nRZVr4 zC=ql$@b3I7fnu{IP%mkhbjDD`^a?Xaxk(2-&Gal^ziXzx0|O_1M+| zXm$P}(L{QtQ0#J2t25w{F&emYN2Nd$LmP8Vc#qzjv=?q|bO!w2aYsg+AwiU0<}~x1 znVMP1kqyqzNO3)yo>Ed)8o^Hve-kdFtE+1Xm(e9USx%RvJY<9sgU~q=?blof3V#cK zgNsosqbLXA!3TL3RUlGKEyG)0nA8`ihUOXeh8O3bd@WJAsZ$#inwnjAmkF79`S9>? zz2P%pV>-v%^I)h@!5kG<_B)B6M0X@06WgdU1?QHSjLYidBq}tpzZ!pu)WFZMxA0Z|~2(vD;;j$anXzn|`?M zfAA@N|07+JldXl5J^ZGz(Oirg@7L;Fo&Cy1xmc->r^=C`(Q^NVDx8+7x`K7K_6bNm zc1|Ac6@A|&s^B4cvN$-qAx`PJcQtw;-gd&+K))pr?Cz1-JWg`Mu*G24eb?!xRK~Q$ zXvQV3dpokjr?y;Hi*z@UCw#{dWaj~FxF3s_3Lo$OGt>Dc99{v_a~4zM-CHh6d-H~0 ze1(66sTJ+NizT98`&Fn^%ndL&d)%9!-Ewi=lo;3P_Tqi>@#Xnxgk_n8jri)UFE;NQ zPU_0rn}^R;EuSF7WNdLYv_UaTxwf%{q3i33Y(UJw)}Zce1S03K*)!GpS{oo5@H2 zh|M1AUz{#ku)W&npOy|RKc~~7tXY>UPnHFBeb=T7Olgzga7==P`$Lz5Si+Uq&(OxaWvpVeeETA zXYO~T`DEYr&wAXLG;mFORtd^u=mEG$t@$2RCGQ}4wFky zCCeweJkv$v$15Gr>%$s3IKBVTOF^PMC(DEn;l+O{c+%iJ>I`lkvK!BTH=U<&sZk(hj!)HX&PBJJqm?^FOa`X{yJ<7{S zeEdl(?2m>E)SeOcgg(YMcpV7Zo{A|=j?gJYl!ty5jUd8Pp7-4N^?tdGH3+++V;`5g z=sgaVn0cLQ#%H+b%wY~6BusO)z`*uoRWMKGKR7J7#N41@P;(4>iWIaR-mek(I{Er~ zOcoao4DK443U;G8G5FS??`95+*aeJv$(4b%&bz%7i(>l~4Dr-9qo@cwz85nLjeZ17PK$IX3ZvwJ-LB?6u zZ{e|I^5Wm>P4j1x8XfFP%H>e+$((q%;%h^*yyu&Z8=8^ zH8wXWcZ$yUm(~jvc>_8nMkOwkcITU+(*^D)jJ;n?6K>hFIpJ6jie9hXawX55rJEA> zvdn!o+(y5HuN`^n$F~&!|E~@iQ5Qgiuek;ll$x}f#++)^AvE;n;plHa+``G~s@Uo} zV22pzc&X-}6wG7HZsV7R`Vc?=m>e3XbTQb#8&9=@hx*Le&Sv`+pEO?gOwapoZAUt> ziKUsD&9T8Q%+tS}hG9k&%=1uuaLd#ERh(Ci&f9Tcl}w;Z^iI8$5X+m96DTFr=CYYa zQ>}%^l-NS41Z@{hn6zisx`O9a3=P^$TeboeTwQDI<|?On)Fi+JqT^q@PjgzH=gDg= z4s>Gs$urDl_e1$+|2S{mM-aR|8~L6xu&H$H{l|%y3*Gavnw8ZWXWxp1c$)(ZzQ&F`wH1kFc)C{fv$Q<|F#oLsD8RDa9-7l({jQPg zmL~jw#Po8rB-({>0ymRU&KMLd=T?U|kHEc3_-8_Smz_1)#`*Q%9mjQfRIhJ}0Mmeu z@HVqv9HyRxH?qY#=TgTVSn0TwVpera9!2PLT=;*#?ac4RbIsN`C(XmsB8d@xQAAba zey4<3brfXHFYvek8fD8osT740t5p5z9{0cR4iwkkU#s55@*b_LH>HPqF8VMV~6lF#lS8(2${}q|$ zZ7Utt)F<>8#3r^Y3u3rF5?w{5ZGK>yB!NT4*zzXznszdqC?AeQ-R_}X*<9v*CI@U0 zN(?s#@Yz;S&`5?z)0!Fla9uB*NNoLM=In?1uYGso9=B7MeD1()Eer9JxISkqn|-{? z(j%F|jRrWEjqeY1YObh_q5p6WS58p>FeoSXjcM4eJoa?`S@;6S2G^Oph^%k?5WD#U zcs*3uH{^sjnsD7NIgg6MUe<8iEaTp6`T1Ek-Q#Fr4DlO^xO3lM!57F;X@sc7tPxQ! zRa^;Y@zCQ6XS;-7>?*pm(J9mucl-@67ll#z(E!sE7p3l|0{uALq_yba=jZ41m!iAo zQYsTyuGQFMOS|TTkzCZHx=!K5sAZh~IdkCs%PMc>Db6%VGzIXu+50JM8y=0&qcl&V zl_&p^<3^*-1!vnUHK?ab3>!Vla(hl zx5x>826ytYwmho_Xa*Rnuf?{`g{qSh6gMU>8o=-F% zviho00_5wQadRdabSJ?qEgm;6qb_Ph$`;7_D>Q+GTUcuN%cgz&E2B!+UrDh}6LVMH z6F!e30F=*>J;FIb03J}|vnnKHY z>CP4=?fxxrlgdq45>e7@JL>D^zxM?ibygYOtv49bMGK11Zprk~ zP%$rqgqC4D;x`~%4bd!dI4Hzs)mXb`LgLY()YI(@k5C%{7MTByWX~@@Q3Yowx3{8-E!8e!!Ky(Vd=rX zN8#DfE-fyMNor{mXEDRNy6d8TVJ;E0zZpsXCL63nmbnS`M+=QOa;OYHTb*9`<+0M^ zuy#a`%O4QghjlOcgiVT`7u+oM5$!d_>Jx>Uy*?~O{OK~zP1awKBKi-$N(#HQonS{mpkTG#w zF1X@hVCOoY_aTTm%=ft*Hu1%jcdqrS#J&;j`7eoaEqnub(27^eb(zV3;DemO;t}fq zJjMFQEO5Rmoc(rF>tI-PR(ZrgIv(37!D-ooL&E`Jk{1% zfA+oNdZ_@&s?6yM8hCa3C*q6Eq_Mn5lSy`Wa=Taeq9)r=NL2mHGwJ!*O1_8p;YBZW zOF18VGZra5gleAMAJa~%8;hQ-Sag70=0>d#xNctLdGSaQ#L^a<1=3uBps zYx1)=cv4M1nLpFEU9R$)k>$32TS65yBH-547w(>5L^ayJ3W%3o4DHF0#2xn%aoSX* z&f8QlMs?qYMC5?R^(s5Wq?*(%eWt30XAxm0C* z?#t3<4`Sw;mboQ$2ZdR6`I8Bn$V1TO3tKwVVEz*Iay;h?nqWHc4Nu+A0P=;fMQhh-QeteaY4iUz zD!O$4Qz8Aym*IM;Wet-PnRBx@5=?4H-Dt|zSPJ~ z4)x7(*}%^dv~TrvKK&u>;lmsaUr5_Y@)u<%(er{Xvv;LgH5^Vq%aEa$Je4XEfd?rJ z%p-1x?R{(xrb|gWNOC^h7i4*8njUFsM}O8GS1;9Qjd_jBvV5$nX)BC|8nC#&)!sDn z(JT?)VH6Bw?&lS6$JYdcbYo6GVxz%jw6$4JhiacX5DhxxxYc7gk)3~>E-=YeR7KEt z}~JfCFj^Ztmt4q+ot^(%1df70*VFl+=}V_*S-L^Dn+f~YHB^~7kS zUk_*(LDUtLMvO|iK4<^_Eo@CaxS`9=X=z~*NbaScuaU{^)yxsiWO@!w*Z1%xA>BaA zM;?#NHK0Qbt_BFKmEMkIMJ*Mtk+LA0n;kx6V)yxMzZVOGq?-OQ`=h4j02e`_5O>L#7RoeDnLHFvjvYOW??jnhBZ- zra_u2quKmPOJ*_0bMxGGx~}{Ux9X;5h^9EHdlbU z#4-$9k^$(<9CPdG0QPKuYz&>I}aNh+oMDx7#`W7 zfozvHDBtME8q8&%h+R&Bh(v69S@q^ldJ{dMC{2;fJcPT4!fz*IixBU^dg2!>Am$LV zgF{R7yqEN1ODOj$R9?Tt;qqoVYb(F%!_CH)1U=9hxVF6(O#P!m*10gkmSqhw?`IZ! zjU}I&sck2D1j6~l%0uaf!pm||Aw`e7Jt<#SA_C$@NBCE*T&iST`?#~vJDbG)jz*Vz z^b1^P%l&>ilU(296rbqGaUrj>z$EX*^diMBw9Sr?>mp;xjX~7G5h*Uu1#$`WKRz1F-%@8@BZbUAqJVfAbFYCE`0l|OJXDZ3VHAZ9epS|~B zZ}$THT4~e2gkdMGJRDC@-JSiQ<>~C5?w3!__#syC=pK0H z_MxpGwC-~rM?ELonaZ7XUC>z@I{IHdn_v4>0DR=4WBXchO@$>LYW%X)_9S?0aXZD^ z2H=DDb}{M0u$2tSrm^mr*%Q#TsAk*lPo5L9g6kiRHc`i2^~}SNMh`J!6`JdzqTmgv z;jDw*#;@UHSLuHp;X%Q;xl+t*F!3V1Rl{>D?^@dw&s+`Km*KW&8>VI`nq>UHSCtXE zIGnVQFuXaRr~53~Uowyz;F0>-Q`bu!SO;E$CF@Bxq7Lm!+cz{`9@<_MbW2Z9S6Koe z#3UpQPId1C(AOiFf*-QiN`B?aQ1(sjP@k*gwrTmc*w3bM5AxmbQ%?2Yodg9`G3 zT<>)T9;3)%d|47UUCs{f*n9_E`Tf?iKf63>eaKv5w;-iG9Um;K_d{CmIuEN`fz7o1 zDrU0GxI``i_hO-Uc-*wySa{7I9W~_r8OTGAajlRk)Nnibajr_vVOZO_@TRlMYfdS4 z*{HP8OsM?SgH<3R{ew6`Y8bJ^f-FOd(yhs?k9{+0z?wft`p&k_3t-|AvAb;DNok=lRJ&8cU_&$BM zT%rZyZBj-~Hrt!6Cyzco?q1*Ge?>i}ra`+^>vG2v{jpuqS!%=ID#47u_Y>+o2Ei!Q zyzLb_kdgRiwS++_sMa){z|UzTQt)1Ajfz@<)&`POK26nyeWru?d$?v+yxo71BZ1B4Y-3w;6jA1P&U&e@`amH^opRycFjVDN zF&X!dQphhOqJX__7RQBfdCNSSS$7>3JQ!&p84ZWB^ryb~58sBs*ZduYdda`YQO14t zI+7WyTmO75*bcSt?-K2MK*Q%7`WJE3>CeCvangAI(ev)7uDFubq7dwQDse~+r1E@d zDe0<`Tx5h7y8@WBdFF)n6c!erK7hwZB_2cr&juaNo`944N{pTjBRSJWQSZhl`ygi-VMudy*$l zjYs8qsBz=-^0CeNflq-;fmd?IyUYl6lq|AD*Bi$SK+V;ywVjg}Yu5h#DUrq$)blDB zpCpA_6Ho(5E@wg?7d}$)^hLU|sDg$-&Y-sErgseNd0nxrA!z`cz}vyHgeVPh1ZxT3uitF zY!IljFv0*=sapTU_fQhVn0mDd=W6<#My(RX^oB`fH| z<6-Ll%$hhk2~67VL`QzKSd(oAH>E)e89_Nq>QIt*zk5x1VB_?-aeuL1AA3JsY3SW| zMUhYm6MZE5>Y&eBne;iL?g!v{i-&woX+r7aK9!SZZqCvjm7%RV!o7&c_&O)pYAwgU zt{9SeRku_nq(pUBqIo)}ZW~MlbXvXZW%L3Cay_eaM&J*c$AA}8Vyv%8XW=v65?vSM z9^%u}82cJdBcXXxF${x1UtPE^A+3rCUW8|~GNz8{Z+?g74H4i(02RBQE8dz1*L9+# zrns*XVT+EvcAAyFm@`?8H?FN>KymOkRp+|Kq5caFak1mFaac}g`fkPG^;nMVV$rTr z)jfxK$neJT7y;TqmaubT9Hm$>RN|~$nqX(-VKx#KBD=`5#rSZM^)&g$rEd$3mWBDq zP`lUr4^{xh3D?>v0G$gNQQX%#F;A4(Hrfuuyiw$J14ntAi#5FXJ(Os{Qp|711l{tY zouzK)`>W7Gd$^GC3o>Ig_c5hS4(ZJg)EE{VlcJv}y&AsXgJb#L5}K&sknxR)--23b zn9^q~1bJLFkg;GD!R>W&5;T{fwJ*S_AEA|?gZO3nO@APOMFJD<)y@n~ElQuT9AVs$ zCgl-;Tag+s4SSHlR{>YNH>*dMoCu1%W(ke~Byra{oE5}rKXEA{NR1#QQZl$9)&Fkv ziX`0@L4tS`F zvh{X)(+SWz;rMr~OX#QC2FeNp(tL+3+EPqcI#hlm78dJ2wD*Y(%$g3xybS46_Z2nuFd$Z;Q7ekA2RaEnN96do2H}58ptYkp z3bp`!u9Du)pS0@m9;&Y9K3M7SigD8vz-LL<8MK>JE>@z{a9e|p9oTmV$ zAYhRd33aejV&Y5e=;O8^6)8N`J5DcAj*@#ihN;b1HW=4=u8@<;D@m&jp4QZUTJEs+ zSxrq=OTrlu|8?u8ocDJLS#oY4Qd|hzSOM0;U%zO{|Es#RgZ@)>;Sv4io4hGjd}YHk z`tO4-j(YCF;zTNIAJkj}n*?~Pw>y9xhK6aSfduQ(3el7fSuL6OCPzV5Ga|sWI^L3B zTa{}xfA3uBI2W?km0_Zu_%h?#M?IkAMBjrzL>*5iHVHSpU%9R`ms)@9)UX`RJQ`SU z_j_70=pq|5JpV*Nux8@Tc<@zYIrHhrxmCbtAl_RQ8KC3D%ioMuXa&{|+?64S9K|&6 z5`J=&j;9jZY`#*?a8sj5W>EM+ycHpGINvh(ni=UH_tZnyi^i(hEYQ5%d~MPDbyj9=*xn`$_>aGsNXTXvb}8l_b{sJ)-BA+70eh)-zYUP`RnfV=IY`l; z4Vj{wkfPXxc68a~iI^597hW8O0T2jKdyjCS1%3@t1Wd5ODrE3eUt-{8#}a@=@W~(z zPnxq10X+mu&rie2B>6|I>;PXrEdLa~#e8~dgDz|rT^ZF3EyC@S>iOb!`FlP0N080O z(i|I*j9%?`Zp`oB3mWC2T2$s#=PQO!6iCY7QJ#iA>D(i@vg=BIF0PFIF^<`)4P4KcJvr{@g?M|?KIo^Z{5ImvnUpUIQ547ED`+AH zQxBH{SuQ7yD4mPw>o&Wxfpqmw;8qr=N6NzD=liK<{!ivuvU0klufe~n!A7nQ$TKd@lga{$ zZ1PUAEq6WS-kiAefh`2dZP0nCf^*f6AGwC!IbB~DN2vL?sFg<) z;#F35(rMCE3{40YuDI>Z&n4|iBT@p}IQt#pa6;mkQNo)yI$(rIcc+eAvxz9Kyk2AGco)wVLc6w5kRQKsMIrbtolTKBryw6f_;nyvQRW-i zHK1qRkg*I-e`_57`*A9h7L(Zz4-j~g7WP-EOj$B#v12yk1gu^&DV<8O%m>uvt`cTq za0d^qR-DRSS+A5%zC$t+48b%fDkBDW2Dn!#3z=@lF{wE*#4EJtsOWz9YUvQ0b}7}d zzDlV^m~Yk~27yMMb{=Z(3L(FG+P|7vi9v&wHna09RSmsE8lV%ZY@h(I;H@<{?>vw} ziGX=jf}Z0QAZFpsJOepxu-ohD!+}G4QnyyNr6?Mn&i`m`eB`vc@yf$ z$}>J$fNOhX;Yf5}R_3gj(8AXp|Aa2{gG?s|sd2ScXj~F}ay;*1+Ph3(o7(duQg9hM z@tS>th?~oJZRt{3EZ`E5ISy?FiF?Gy#Rx*8R7M z6wpVOV2QNjwRR`s2>xmm3p@;@J#tO%zNBK{fAqx9p3q-htkyH0@ObmB{laU|4R7L3<1dy(c_jw)K)($*)#L3dDdD}mF9lxY=T?n9YN2kafuV8Nlg@Qyqv5hdl7GN zCvxK+=Ea5DhF#a?0&at6;9Oe*{wZbGG5mCTm%$ASTnOB;Shbhkl?rgT>gL@U((Fq8 z{Of`Gm}vf6vB02MS7)e$Nvt^No><4DlO;R{#l?_5sFTDIZaAED0}7DJw#benfb6J; zxt*M2q~A!A?F&ZJt)gHO{qFziLB1j0o>|ZcAsca(GRLLs6zbxmhoS3=yxuRsd~JJI z?Er)a;ORupXe>;pGy*BDug<g28Lb_VbiE1= zJX6;EG0@}8@t+MmpQp68Nc+Ithn}stX2k0j59?ll1Vfy*hJ^k3AcH9wxbl4bOh7vjCzN@~B zb5HYnyWr9@0RC>ck=|ySA*L3>k}D?xo6os_ycT_A$F}YB9cr>^Q7BQhVnUF5_O%-dr^TP+ z-fmpA?}Ar^EeBDkgHcc%aTSCb)Czu4?`D`|J{UrV*K4IC{NUh;klQymqUUF?A$(lP zVmx)ZEG@~ZgEYbc%Q_4cUa!^w)mvOf%#D12u_HMIC4qaC$Vi7oIg4?RaUuSAtIyUC z#a`m^ua`LLKsxuIY1_Y>W29R-lFSAhe~P8O_9z~&zYeMB(uBr2arEw(f@3(EwR@1d zffsWo zr%0OfNX8R~kC(ZA{u{oAwER+rgA3@UMa03No+GUJ7F>(X6@ln<_a zAVFtl!dzQ+)4$d9cpx7*Vz~erRQ=v>Arrx}kChf%y(A3Y#swl?Ub+zRwf(vFI1;yb z|I~{7HO}@x2C7G|5BsA1oRaB@F>^wa=lzdY#t*CV#O7gpgmUM$<*g^Q88>0d{N4ss zId{rDSDeOC9Y$8e{%|~FBwM(^mvV5K$ z(R`eP_&-1nS~*d6%o4^HgCes^CW|({OyO8m&8@(QAsvTC1wV-zdHImjc^OYI zO;<2SzH;-*E%g>D4L$O^RIb*NfPi(eT2ao2vgQKsbo&X?;VKFYzvo@~}XFA|l%JP|S2tv?8K709UY>-j&GxArszjeoZX&xp5A!D)xQI z8Xbli3%gl626<&fr#IlyeyV@A_cP9mgtNWvEO*fWnz_aD{B`=tgeYb=` zjaA`d@R=VB%^zipQ%$M=c&l{c+j%U(zmuuqiyw@@=G z{KPn+QC-c<;Ewn0=f05nl=}t^WTK2Hi)bSaDpW?40L=B$Rmi0bDbd|KpdNCH@~ATf zq^K^FS2awjU_m#=gmV3QHV40rfHQDPtUUOGRxI}fS-)5hnu{5}c?KngHJ@zjJZecx z=Qo)w6IBtveEWWq;rKw?;7bmzM4z-PUIKscggu^-NoM85XMmz2D9Vwb|=aFy^+fW0@)t9p-8sq~x%zxNH~S0>*c4bhK1 z1{~2H2k=hE7pLnps&Yq$ZP4s~%fr%my?S&!3A^CMkF}4lw?g>CJxr87ID+XM-^pl& zGw665PwD&=br#jh?-6F@{S$dMNP5@Ngn}D7k`o7iD)n_My-{fOuqP-x%&}vEii@b-Hy5l zQdr%8#wg#yw9|zqN%| zGr*_q?9EjHdszX;*(h_0a7tXwE1BJ-+lDY(@BsHDbW?6y0SY#t_RM|flI06b-8PIi zcHK_eT4ymvFdC>RO+gIup{L4~%3x&+XHrd>G=|d_#w2Z6=9Pr*WK%(vD<-kGb9|QV zzW<1!B2;x~tMyC-0=v_j1TS~<_vxH6mMkZ2s_M4!G*Fdm5btK4f6fT2HwhfhqqU); zyUi=Wi0x`}DtiZj3UgLSwt!3{nm8`eRem(6(&?6vy-My4dL!gOz}Ztme2@iO2SpIcfqxb$iDHQaXarm--Zy%KHsF!6lBu#AZ_{< zdJ}w}JOIyu4^XY#^v%K8_dLlt8XHmt6xozjAc{lus%_9nntyY}shnC9t`t3`>sxv5 z7im=pzG&oF8#uY{%FiuxL+noU(jNbm73{NVsF(t2`69-@qj$==sTl0g7X>Q2w!_I+sj;*xx`ECCD_7DD390Sc~4e`+-`&{T*kF^{6iq3fk z@9faxQg;&2#z`Ia-B+2)oeghRuU8dWn=7Kb##l!RDk!*9Pe1l~yV}p`r1oy(4;o%K z{`C);yIv*|9OZ5+DC9cNOs(uSP+8msg*l_x;J^8fX5h4W`9-B z%+6+B`OQZylY^dqH9or@E&}`%1L;5P4RXq}T1v`SV~L;o?=GC+L=SQ1DPkRYXMeYd*Uw(b!~Y>3Q3D!I zgHgEP2NZ8d(=gY~fJ_}XJydyGbkKwbA^}<&PPptJe`PV*_fNMDy#pjo*?$X?W;;QL zlUrV+wb3JeZ2|uMH3j_Z^)w^s=+2ApO0%)qeAWeHM|FN|yCh@&x)qykNw{VNtaWkE zeA5W_aa|eUjEu>|L>{#q+w_*=my4iOxc6_L9pGM@DdgYl!habPN0WrWg~u+o?judf zEX!_CsU3GR+vwRS=wI%^Qf3b+L*5_HX~jI6n}b~*ST_2d*f_?;vp=0fFSc$g_C@aa zmG@dyR1~Ye+eJBJ`_6!G!W-J+cj0xf(Ef6tPcTwH9f~jZ45^3kzH;6ES&VI3OTo3d zTEsu~V#6gGJ{O}J+*cyl6D-6FJ{^qt^cfxeKi9vCPf$)WClj2?_o;3jJ?A3QDIxIC7}IJ9|b$c7_(;4_H6BThU=!h{Wbd_?5`ur~g6nGOO;F;ZdI%VbN&de+L}ucA5u zr##g#7&E;J{;~q9MRn@_@>G@QjIRHjBfR6$>CmLZI|rU&84jZN&|FsCU8Vmg?yzB% z>_!O}smjtAv4?SyA&M3IR9lkXZ)Yv_9@yb`|6Qlp`l7@a_mf5g35eOqZS7QDjWzk^ zDo?6dj{_9W$&N~cw+8{X0UDxxP`z&q{Ff_q%PfK_U%|a{&?s@h_h?_prJo*p0(hH! zg(LEc;>?r(yay1qp9RiWocwdZf7NPF7TCh$FtndCw*Tu&i5|X_+sh&J^^ik57IJXW zP}dYHTL%w`bt{ef$3J0NC>x`e3S|1$YSHzt&AHX*gse=HHCm5R-=yuEyDw_Qj%=4f zY5H&7R}pey|JyLYKcj!gFY0IBBEEIAv82K_vT!uR-!L;JIaP0re5KTNR|S+Q)$NK+ zE?_pKUGgfhy!z!_ zwrwF@-wT08LB0^8X>;<@Zd#M(s&mYlZrs-N2e_raiCNfJui&QKEEI0_4 zSlq2>aqUwLos(vWIZN@4KK#lwyom_sxyCn14nRV`7afy4-Q`DN|?{^^IRw!J(i0( zm-npcio|BYnG+nyUI!y%E;Tv^j=i0Sye$dA&M^Q6Bp`;@NrV00u*kn|!)IlrGq>`k ziUE-f&NVDDezWc{t@$4a_oaDxJ+RAtdv`Qv5wEifO$wpUR@;B!#w$@5`!kAjQO6Ca z^WWjlB9Z|mp<`AhVJ#P}K9@Kf?5VgvW{a@Ns=CAC^!k9yBJF-~kVMLwZRcJ9xrsda%eb@N6QInIk9;o*1 zbCoSB{jG>Sl(OOFu&-sarU#r!zJ6yvyS#YL#v|h7wif1-JD}Td?{MfjR_H+~ZBN zG0v$nrCrrqPhB|{PslgRA%WXgC&;qtfD5IlJB z1Nv5R;>FFDYzh29AFKXt{@rr0nTga07Xin;6UY$s=!Xtm9$D!c4qcKK38Z|NS7Cnp zmoda{?BOLncUWm#nopL^F>+H86de+v$*YP=_+Q=Azz~&`aDTPQy_rnFZ@xFSsgu0n zl>Bg|xPUJ=yzs$(wP_^czV2ACR7Bg6OuDULMP#NowyjgE#K4wW8z`@YlL6lzJ(QH| zQ|RfMUX3&;dY@O^pub+&q#HU84mXZ-SUH+y;?-rxeN-i6hfCz}G@1TzTwC?nB~zC^ z5i~IDsF8Y8Ic-;;rKREhGu#@b_!jJ4Y@wbzm-2u(8~Gle$!^vg=Sg z+~KU^7o`xKg6g5NdcXPdO1Ey4o?+xBNK>o+OuE>xdK|(L-H}^uX{jaT97+(Qkwt{m z?|Mv{a4MO2$ToyQbSx!W?;111>htHo)4p!AvR;3Hb&cn68c^KF(!0+El?05vW+n&9 zEoBeMqj9Zb_3smTOC0{#F(+!bdO>(cn$F>=#M6+(`hXGAp-Yla(s<-t%!fNN$Vh`0 zmP$nLx+33d02Xf(#Lce+W*&8mS894ODOm#_^yKis_j;fI{FeN;uE@Wht}|{br%f;u zV7!}^G*=HoWfIIhzyo?F;qT`JLzBlmzq@q&4^ z2XI1BrAVvqB0QnU{^~?n%h137i7aAzU7(U(Inm^K_Cx%{(zwYlq|~5xHgurdm|n6Y zG$!4CYNr%(tv$G~`nu)#1?Ep2h#k;3`pGME%qHfxO&MZBf$xNw@O+WCV-cjEf9k|= z>hW6v+&CH;s#-a`?wq<*sqmc%8+T#Tlvi(MACG#BgavTQ_Wd0tHOv`ApLV=rO3z-O zsr8%R=xQX26*#Y$jbEeY@Q>TBW8)TV>Ekdzar-IuX(%$dg{Fv_lEadNR1BEBSSZrc z&zB?|I`GXuMI9==)uEOP?cA~q#>sh&z@Bzjp&KWjy4Eo6vZVbs@yB4K?23&vZ@?5J z%rh#Ze6F>-L}%^TtM-Jw%C4O1(+Y}0?1~lu%YzG#1$EtR4~&)Hb(A>%vV_GYWBh`2 zVgH33?I8@==dwXy6e$I5r9dqpu6@lx5!3<@Pj6=ZXQl8zt+Xy6O=$=k^>J%C_OhjN zZDA5yYGPJulYvvwJT;h<9`f*DQ`BH9u(egIA6ygBzNbPVoy$3cZ0eKeQl0h!G48M= z3id!c(8HVUD`va9aCahhA+9Rv<^j@xA>WS;n{gC(QFL=iv z7d$BGKz(^Jv{qG(ZVZLh`mVFHOx0#vszgNZ)W__&-VaNqI=89?k~rQ9-342Y77R$BT0ih>3om!(f5!tF%~9IcSO|M@tewdmGO+Z>d_GTkYK+j*!2MqnPs1wCp3baz`joYB zjn`C`@a?j>3Zozrx#Qhi?=sl+p#pP1%P%Z2uJQZb zg4-*`=E0*@O~A!me(>T#mWz&YT+2T5$WhB_at;VQ^g$HB$XF#AblMV^gbAGxGhtY1ocsRdz+i2Zzi;V_)5%}ePi9mKH92}$Su6K#CH*IA-bYtQ z3yvw0$i8oWZ_N0CV{MeZW)zsob7gas{l^n?x1KS2R_Oc!z+Q+!7+H9!U(ZWp>8KLVGx`J#I z7SJkiq0#dtl~@cOKtHWwC&$%B{%f%K0dV7(Xy3dv@8h%1zWQ4L=llBTw>o5=zBbn2 z8i8G&m}b_T_($>7npZdJ9itl4mfLA%O;Wc;E{qtQ;=ri=+1S{e+3&^^x}{-p^SOV9 z>{k2G{aEkq)g3RZR2c69?n7hhESEfN%XfdSIWMvD7>#+HPBnv$KX?Vqj2ddG1Du0R zd&JO_3;UQzqgWxZ{iyAY*a~Ffq>!y?|NYSNHS3VXq_o|kNWkcTz~S^rMCqh0O(V=5 zy=G#?WC$bO>`!+=B-jR8Z+Y7Pyj|M1*V9J$j+Ph!#z%)0v>R;p=1mYxO+Aqaj7>u@W$t7G)lK$ zqgcS0&(QG#?QqSK(95zUNkw8dV|!bbj5AqboL501SjBq(mO1_3KxEtl_lpS5Y=B-I zu3(OA16eu0X@S%ogv~@*+z8++k%>s@4J<5c?_)E@hF0`P$GU2&;4cH zt7O`&_1R!;BfBY;!v#8a-A|q9i>N9_JLPWSc&05l5#`dt|RrTrLZ5F@5zt;Mvt#!9zcS&{;Ipg8k7O+K*at7LxxwhfegvZ zPk;5$uUg3eq=Lc(X-cXLZ}(a}LPhPKAh>awqQsaN3;|V z-<_Z8Ilzny+boR>HQQs;;nOe~qb%|NHp@R_SqFEh*uit9wL)^!zog2Uu4dn0m?^Qz zyORWd>~e|m1GL>^QwP4tWM6f?M6KUI*3FB_OI23Y_cfk}6>qGN^*=Dkk6(i-KO<5J z#?MYMiElxT+N|OY6i-#B3ckaTnAV6iz;q)tDI=SDp`_%Ubhi~`a%dnxye)fZyhm93zEFaLnUqaIX6n31 zhiZS@wfgEc99G`A;_+h|W`K)V@TM^AHiUh$^;>DrZvF;N+{wNonam(5yZHkhOK2=e zVQ6cl8L4hOoIAULgLqC`GBf`bkp~Wm#C&NuCyX7EE@IbiGydH%=b!r?*P+g@-@clV zeWOczVAt%5ht5QOHx2I!(ON%R-PODP7@950`NMvWCJ*}`*rrSu4)PdRE0YjB0bTg$ z4O&kiPic+C^gq~;yx4l$6B5R~RHIh;Ut=5`AtFFJ-{TO@Fe0ga;cr7AR352RqZ{Or zUQb;YXlu3=S}f5E4GG6Q9POiNOWNSU13rBD;?cxD;X2lQUav$bOwzjZ8KQJPyTD)e zBjftImO7rbN-3`GlOak(^U%8~T13S&V0AIApJM z=(T-Af+NiI(F6VJ<{_Cr`fXRJ)thzVQA?r8r85!j} z_#;U5sT}fj+e1K(Pvul<9B}I|P~1})jp_-p0hK?MS>Y|=s|Xr2Y`VFt0=Ba*zphXZn~AXRt~85LgCMg=*+4|&1##Nz|SJ$;Px1OnrL z%5C9ietbgv@IhlwWvZu6K?OQ}D*t*C&S3&!!)pR0Q1Oj(T$VH{Z~Puyy*Y`8{2oR` z35>=Pw94&xY>9uhzKN5PI!K;oPD;R(%{7XwnQmmAzHr&do^5YyTZJ@cJYhs?&VT7l zy&5f|{Qi^R_3s8=UzA*LqCVY~^T0!DY0Tfw+Uir?b6-|iO3~X@$t(f#^1ud=#YH_q zpYz`{vopG3m&f*S=Rc24usjLBS;NKN0`x7N>-2sDTqi*@kJFX_t_IN3VsO-I4Z}jd zp#DuN&7mL$g}Z9nlJGdxRQphf`2BW2UYsd6W(PVf)>i#_99R7W{db~Q;91vNy1L#o zZ|urI9uYqO1N;I18*R_MMV!O*4zrutpwm>`q#LP=?{FQ1OE@20@UGUta|;%xRQ+Ww z+`nC+K$aVALBi1CYAtowWryZtE&VEs2u)4Rg(q!<<2GL_F2(S2i?G3MNS)swG~d5} zK+=mtM}-XSPxO6vgEvFcWSM)8A$x?nmV(kD?nmO z8ef<#)K{f98ZHU4STtjMbRB`m;{rw{;qa=k-1h$;gc+EXS#L6ZV>LRvDC;U(SGrVe z2kCLVt+(gS z*gU4waFf0o@gQV==de48bFaVOKft*1jEwI)HZnVZuEeJ%p@{T&u64PtHO z8y^8*t5u^J_g^=ds3Q^>Y0s!un5huVvcxfX%-oLnoIhrkxxH1rS6{i{KJcAZ-_I#( zR?j?9ILgcD8Ll1?!cN0A8)u=VdPytZ-tNv%iANttWJ`9NTkLza;Ct+O`g6C%w$+vl zA3%+p`-1Jg|AST5LKF>Yhll0YpYd`3*3hmBqdH_8bYwqAa~qb?sNUMxI||tjTqh(_ zg#Y`}hJK0({vpAGG)n8g1&WTS?FGlrDlZV`}aMEyscXom!1_o5aOJJudclWa+ z`X1yxe7shA-`<;tCQM((V%?KE?*95!RGuZ6Q~h%aW_g#wtQAZPNJlbQs-j&#O7`dH9{WFKW=VZmb*%#ud}umy#?cb25nUEZPhWGd)Io@*;TH!+iq81LSZoOSbGcxbp7Z3YwSN;!s6wG27ry zs5OmSq-pQ{n=W+%|LX;KdKE(qd@s4mYQd}}A6!#gD-6#k z7v{IEvaXA#P%Ae%wrKP z&NMaCyOtYWX|F`>u);h&?09wWMl*f8{wRX%jt~Z{LvW{3e24x{ zajt;G47?QEIX#i9Hh+|9)t?z?@*A_j@zU&L8h3Gb`{RbWE8E?sV}L^*Y_9zwrvHZQ z;(OVcuZ3~?Cn2`Gv#`_9tF^}*JMxKd&GrWU0jbnCQcF~=OLg{`qBrZZE|E$cyI)4s zY-=6Y9?o_}Pw{UEytN(pN0DJ)i5~yP0a(giDRR8AQGXO)hqS}?RlAfD&eaPnNB3?; zL(&%YZn63XQ(4oy%}mEU;l?gle7t;nz6({B2Uo(b0Y|IVW3!>HlQT0Z9dbl2cjEha ztgNLxBED#d#-vfY=l6pt#T(t&07aQWqnXFoEx1BW_ifrE3%@7z#TR$*Bj`&IB0lf} zhlmqQ_LmdaRF2%`05_ozI;ibnd-#r{&f)lNRF`N>=0F?404qB?_7s71>#uP8YE%c) zjpz^lwTrn2m7AL%XkCzTk6(We(!ge1T>2q*-$(H%KQWI*({gj;y>Y%@y^#yPlG;&E zQkRgmvihxd9uN!LWkAC57EnQ;{u2+V!iI+j-z5?+^a+h-3R7T_@_pvtb8M}hpk8Q} zQotq^`kVk>_(eC^DN68gUZ6T{tj_0pY4=UQ-X@&sl?qo{KOob4KR!D_u9CrLihD;e zXlUGIAupHq4L_gh)u>Q7{nf=qT1&tRY_LKKiO4MSIDVZ(hmaP2*WJOYvOtOy#-+jeib^mCEGh$5Jtf;W*!ieNbdwzLo z#dqW!e{8>Vl)h6{g@X86>^5zXg@eb)O~-M`qT-EmD^KTM}Y4(#{66!TskV2uCG7mF!(F0^qwC;F({Vg1#&N%<>~}mqUuP>e|&bftp9%VY>T3my{~ur zUA5Dv24`sgBo)l^vLT-3yYS?L2(Dkz>DXLTL80Sl-0U$F3SIlpdOoa zbq=ALaxsjo?71CM84PkBDks9;d*B~^Th0kBOsT&9YHy#(ZBxr1-zMLxsCc+Qq!LzD zaG{ow5543=1H@m{!hPn#HOzs&$A^pd$Qluihx;FBMsLR$%S>O4 zqEw%|&*lf&bJYAoYbNRkCKs(dJ^lXMFVs-JH{ofjT3m0eg_)4@Xla3rS7SfxUD(3C ztQg(OabY_SlxLx;)7ZC#29|2m_VnhbHfC#O5C+w#7r z^341fB8x%8x^t%>XU`+x{9g+gc=N2IQ@`8k7v%5?Ck|PeEi)p1J6EDn<69)%oE=8C zD>fTnDG3YjI8kR4P`myU^*V$a_faYZ%7BF5HO3dO8UA;+RA0(ZvqnjovOzkrjHV#} zKv3%Z=({Vm*H+9pjcC}gaf{nr?gbwTWwRMDtg3{soBu;Ez$jq8!nt)J(De&_{N+da zox&a?b^QV}k5a9U7^`s_ZU$-**pKYUZ74XH@gXRzfz1QL#nDiFiAgGbC6Mb-8N-x zg&)jmHTrD?KP9M#gc0^q1biI#fyv0j$%%aQ1!PHm+pc4@C!r$K-NJwriKZ(_M0wHC z%7y3n>jg>NpRP5yxd9VAqh$W4TcE0_;3t)DkC5y~wi4ayx2AnRSMS3>R0;@qfHBh3 zf`ZBf|GT7w^61q8fuiKXQ3Lf3vDWc2(L8#5P;jEBA&+mJOJRCRgFzj2g;do5W>{~G zNVuJ29>S9^)hD0})<9 z;2@z>2NM%dUYY#AS>4VDr5b1$l4DamUjMtD~Q5v6F@@>E` zs8lUjbZNi$9~6_z)l=Eair%wK&&?@rmhJu-OSi?fJd`xlP1c&w4@m7br~gi$c0cxb zCo0`#{xYJW*Pz~^^lb(^w*>l4JGI2O^dxidZKlKwngx2#blGHFLshw>-*5zUwf+tT5rzH_jz9_C0U=4Y1J= zc^rt16^fa7OGq#_c?EqQvKMfn`l#8s&v~Tgo1v~HA~^hAa4z!7-NSQX7r&spQnE)# zw7nyD?>8k;QXx*M)o`Qhj*e-I@%=%2$i5!P;}=(a)dvHO5*sMZ2B&c7+1E(iSkM*{ z3Z^P5nOI>0O<^kq=&u31v-=Ss(ccBdmQQv@jsEf?)EuEQ0Tai?lD6-)IBp8sQO>=Y zlrD4qm`J?`jKGqvv> z@y&j{zJvY=S8$8js!;K2Y;u;Lb?ySQ7EATu9{964MIubINH4Z$6@U!Oejo6PcT4Ix z6b@PR%ID|#pcDIcw||N-qQYUmLM8F>`zO~#S_mJq6VW?RSC<4omx7WER%IxB8Q1RH zhE`8?5mp1|<|(MC2;ac)$IUTNdDUPqpu15S#SNLc4}ZOe-|nib1$bHL@LyjI%fQUZ zrScRvoz>CK_ynoffL8z3e2flai3Fk9$mf<~*=IeY-q5!g*ctEcMq8?DV(}knj=zYY zp`k@j2YJIMbM;!R`yxp(5|=Y)nJ|+8f7d6&nLXuagH1?cX052|daW7yBw=ksv~~7q0}ViCC5h zIIhNbsl*HBNkga`caYotczl-?03il&Kf82M?R(KXsfcMX4fpa%N_M|i-f`vT^%g#q z=piQw4V{i_>n;@IN^{*Ol)+_&aZ&JxJT|VEb#Z7MEdccE@8R+<$@A;8uiK5VKoO3Br=9z^NpTRpFKe?($ zasE*1mV^cx$1pd^I#~+_4j*#UzGa=L^Jur*(OG$0GibufFz)22kJA^reU$m(Z^Hw< zJsvRw-bxv@R1#zJ8lwf6Yiop|q-yPjU5D~)t^V8p3L!#poFES&>k3?DkNSP1h zWO27dGc4@J!ViAax4R3Z%GiAapGkAa_Ss>vS8=xio!@G1?@Wc4WG8M^m!LP759$9i z6_v+!d>ilv+~tf`C*>Ag(}WM3_p0}HrwT;wy}ve#P*tebQ{4NyoiMfu!Vbq;;}!!> zBm;=uA<#vkQ)r)m%mEF|?wlVSr>+#+a*Zq;M7GZ#iIJt+?!1LOl*3>qvX~ldJ=SaL zw)S&P7Oq5dWj&R9sS1#1lK4~Hli&Mct?o`-@iFlkt)2`JKa7G9^bzphYKwQ!oR)u0 ztiKsV#fgy_4A3sbw;vn{Yf=9eH+Uwrh{Y73k$l38y+ig-;6^1Z2|s?V`o;Z;idDvT zr}`~r>o?MyV2x~256D(R>Fovx2tp*_w?oQk5hWpfJhzphq*5ac1Zk{B)%%aE`*{AJ zfd7Bu{CN2b9stxBc3W z)SSu(TIK{wOldM(tvcIhEzdgJ>5#}DSxto2uGU^1h(!MfQ-D|T&$ZgYY0lmEUvh1I zVhYw5p;>~L(GSPVC<4YabNnNt1#xQjc=p#uv|8otg0sKb@T52Q9M8jyw{8hdU-|dV z;{%1hS(tH4fu)OqE0y|VXLHcs-E@VK+!_Ld&#V=FrjgXwpaZ8!$r3wwo#|8#9H z^uI%+_rm*s1yzBLxPdPpfgfAxZ%!Y^KkQKuRisaV!4@<*YtuSw8tu!JanaGiw^yfO zzCJ7Mo}w7mMv~p#Ii;n-25oNq7}#;a1M2kc$-hm^-MS484ar1qEUbPPmt*VdCY?9b zl#Fd~QZBO@HQ@^g2wwP|M>}aAJFYZY#%VquVt0ABv%YS!cX)^=4tNnIo(s9t7#rs$ z$<{#|cwxS;Z#s!5{I+C%7nY*KP3y3~>!u}*Ze^tNI)*eg`3Qm{p*YD_WF`jchQ*h> zk~TI)P85?{+b~P$F8T^_>;d5>l!K#>uci-cajo5x-JpTdZb?w$5`1Jb1_Dyw8$&oR zCAF_I-*Le0Bv-G1dE8d={=jad%}Vd1f{3*Z+n%#2cc%**<%U&1;k;kJ7GOfHai2X^ zuRYcp%}1HiA6=dDSdZZf>jkaeyh@oI+l{wh*%lXY2t`R`;sg0m}39 z%f&XiG`8up;&A3zg4_9^io@U$o#)uFSf%I8zHWx-9kCkJ?L&}Er3Ym?(FCI z#DuAZZC7v}95%#z&8o+^DMFgcuKy;|{7<=C_lQ#_HTZmC+D*9S{!)f!+6JA?qP zz!wPY52$j(0ZTMxYBBhUSRo;tkGa_WQik@1Ppin^2F*N5*+wQ4J-Da}{y}n!3l&~} zbK{eepv#d^K4O(@5&K{sNvIIu53~DSZi{-_cBP`z;M8f}h5RzCrY7pk?(X(WP|NNs zQMucT{CuZfl{mXJhvQiCd#=227WhsAP2Pa~nLGJhnISq{1S;Et`eYD*nCbrm6S7y zUfE|ypy~n6$nUFwTgs%XOC@HLM{(N`Qmxf{8i)Te%b_LbWEhz`z9uvC|9O+Yc!C`T zVyU|vJ0OgP!#YH8yoR`l#~v*u#kRCLApynZ%S_~v5r*wt*-P)n#yadHSbXc zkMF7yd;n~>SP7rBFI&Wa9l@6+;!mHU4K8o-^U$fY)BTL=Edfgva zl9$2P*Vkh;%T5Q8K+Y9jzbDbqfaq=2IyG;50E~?N=y1btTvNqY365x)hAWXeahzX8 zO7=D@`d?X`c6Os&x_Z(67396cnOn_TjW0vptg%)vW!=K7rTM5VMVOc!Zm@<~{fQuw zOEtxQAu@JN3t`yM-vfw^{#aR!LhyNOH1;ZPcsv^*~7( zFJP{;7=!ptdcXDKO7mqvWNr>mR_^bZm>2cSusW1;vDRR zE@DJyX^~+eYxD@+7B5pqHa3nhgama`3aLTj+i2=KDe|Gg!7e!5iMdu+#{&)ea;34+ z#R=x$Jxlo6)v%C(^4Ci#Ha>8CWu;W^1fZkIxw&aHjdUXVF#Wn28Fq`;(9iU&F>JW< zwV^y4D$HA*z0NE|e0ZKyTgzHvRLg-+FoL#J z?~sD2D-%gf_=^9ByF6$MnS-Co`s<}$)a5jpD^lJ*wD6;kg)M6(dKgM9odz3T5Ng+`2fkGm>zzM{361+%OH!;yN=Dpw zHo>8^khCU&QvY`TZ%)$|5yP%MHAbgL^A0L$Dhq#>Pi>5@xY&>2_UWl1K8zO#x5ple zihRB&Exn4E{8cgjT@8(kB$AR>BY^zW!~p57q^qkd-_JuFW|Xf>1!<@k2&##vM79bU4a?JpbNZ))zNKTxFE&VyfJ~)K>EN z+CR<6(>>E;$Yb_J3jS?OP+e&0!h;=34EH(k|9)iJG@l+BB!~WUd|Wz*L4B!3N;7Zo zn;f0IC=%dIq?MBF0y9R2vd#f6lXeWxhz?c+u`gj(;no~4NpV;$oz`q4XUUxns29YP zOwaJ{Rcqnqqfot$3weRQ!w}x=P}jI2W0u+Q{S@?k<14iTgOm?)%&@o-l~(_>8bXGE zJAKVzXnU1QjPw;%B+d&tP9)620NY{*n7X=@fddfcB`;*R+QMY;3RlD%Qj_4&Z+(*i zsqnwm%2daJ`S?oO+h>lvv=-upNimjd%>}2sAd7{+oh#+$h?s7_?Ri;^mrhj`PZ-XB zoL0s=wC~)H`tUrV#v8g5YQIz$Ow9Rd-o^>bo*y2fml__HyiTYi*{KnWz)70ic!JY6 zfsm-2YRSSE)GpD!H-iM-uD^1>DT3H48z~nUs&v_-oj)iMiH@Ejy2>#I+eF|az~`}Q zkKIw@cdxM2z6R&M{zB^+j&Zu&C>Rg<5)^o99!VsLRuFOhGcvq_Dp9}e;^goUv-#?% z`n?m3_9Y6baHgS)M87yI z)BGt0clkB$AYA$|2-ZlfprByaUZpA+jJ}WQ%H{B<#ap4f!Or#@Yoag^5Ryzzl`*yY z2jRI|mbwx7j`lFYdl9SKj6E0&uF0iVX1Kt4MQf>KQ55k>pgCtsyc5s$nq6vQH##y@R`Z`@S+eK&=Dh-D%r7$I~d((Uc6@Vjwwjdfye zfsT5(=93BrP%DkUsW93F*EE(1OT8V^C*cj2;Li^?T1yT3>E;muBXdM@(_tdK|5)tz zHsu9vv$k!ZYu6=6j!lZNYb2oMw=Ga>I7j;}FE7t#%&__%oryhzpVMxkMHgyQDd$;0 zN`7=d5_webS)-qvecyS35zE*84Miotes%G;+@npi(RFk?x`Fw8g_y0_<3%E5>qDc! zVNuMB1>RR|uaqswSiUp+BK=XUEo-!Ox%@?2Fdx7?cQIzPu?{l>jzyiu!vVnC`}=)q z*S^=W9^MqEEV)O{vzw#&_ua+XxACVHWGE=mc}Ba&e6`2xjel*X{cCLv!#&Hm0+k@} zZj&zCNybv@Nlj6LrP|*}JsXntX%LrXBdZO=SJraF+FYWn%3_1WMGMHQU7|!vNYZXK z5zBThjnA7{JdXezg~+kFxofErJ(cv7gS{`0KHeTZ-22KPvSqXrxzGuhFSZO&@5M(7 zMy`v`Qo?4m%ir8kzw(nlo%%R6{JI~rr#z=^A~&x;GGUeDb>ki1i*O4q%~pGGO24hp z>uN@t#v!Q>R4M3$Y^aA8%oE2g%R&h!`!XJsL{j@yupud+<1IIDKUZGbo_l>irkZHK zqq4FxV>&Abvk+yRiGmwm0RoS?YT=oU1`-8zT6l0>$bJ`IMkM~PU<`5HaFf2xN~gPP z`2^4gTqTOM?>QK+YACHH;+rXnSKmyX77_Fwdv(E7g(&yGt7?=(YyrAk+Ki}KV_YHIFxPs$D5(-#!j-%jAcSu zN+S$0m{E2fge1zAY#|M1Y#9{BHnuE7_H}Gg$x=*Z$&z&}F_ERnGKJ`!=Y8JaAJ6f- z|GKX0K92j(>psu#_j8^nCiQM9{Yw7UEeReQ(qbQ@Smvuz0xMl;c$uBoA3W9n$^ygx zMbF@^R^S-VJ^~`c2Ccz*jm{*{%r5e=bv;vphV(oND#dkbbX~8poxhpHtex;kU(ELE zo-X@|z|Ogc-|Ey-C*1Gco;==IZF5Z$P=?q*t(YZ@gj|ccb%!InZw7vnO+@PNN_Skk zXm$V{F-;e_6+arSVQuqDJjdVM!6)6>YRpWk`2?i+nJgCS zs&voe7}w+E{Auj*F|H4+kv?91!v`B}{(WJ?)wj^^*G@r5j+H+Hy$I;-Pm5lTaw@3$ ztCqF#gYlE5M$>Y^$ur)6)sazJrnQWVcKVnJQ>%108N7Y)3H0w2YXXlmnseq2qs+h! z?zWw7eG&fsSCFn32eKp~5gKaqS%WcruOweyW!RqdhSJxl%5Q;&c2M0QKKamq6qu#1 zwKzDQhA=5`Hm9{Z3~Qs_6uT&r4K-OWs2+r&zsGm;1}!h^Sj7OlgXvTa$XDvtM8XAd zkyCwPCmw2HnpXSa9NyHwnj*%HdL_+4{m8F2plp{ZSciz?`eGS73fLa#F1yC{l;soq}MM9w7PQe;ScFhYY*#5Gwk zd-P=@I|rkGR1ZUo?FT=bX}O2KDNikZM^Mo(@rp%l*3M$OHxUP~z|U+9)h!^nAQDg3 z^m~c=D~u{V5j}e)Fen}it>lah-CB4w;M*PZ!;l7f;pf;yy=T+Z+%qm{gbEJM%;S_1 z>Uxw%h`^0LDsSiq-458eAio$ti~3$wsh<5frwMhx zuP~l1W?yr;2;jHO%%Wk?^p*nTt_H~HeS<6HuPqQ8;*g(Y#t0QiW(UkZQn-yzFiTK> zN)JHQ%mPVTnv7XuHZWTGu_Qa=?n^c;Vb=2I|!8Yd`JQn3bp zC#He9=lRNy9V_!eMNNN?!!K_E$ux9hAbXeR;LadrL3;Yqy*cyuZ>Mw**kR|YY-`AS z`B@jb*v<5Q6Z$~$@{O7H$@C8}4G%h_LL~s~f z%I+#fha55{S}ivbkPM|e7W-@9Cf89*Q<9FGCEp!WtrCuup?A&a3wvGWO)`n&=|C`6 zmJwrNZ5DzqY2JW>fIyAUvP2KBB8u$(Mn(dKzs*=EQjU)Th$j>A3eeP{ct!APN11Tj zi;DJ8A@}ApD=xg!_Xb0G31WN|uV*HFZALfcE7{OF3aTg3vMga0B|Fp<2rTaL5Z^nw z*6dv0GtR9GJOI+jOOb*_S2#z?F!m?@f(z4;APU@a4ps@Uio8^JPdh4&!UudVY%{bVhVpo841y%d#7IY{Z5%Svm}XupjDJF zkhjkN*?!#}sUP>a{B+lZ9XcR^2XHRK*kz?wyVM%rw_#c_hluy^Ev72A9AeGe zr75!FhJq8wD-D{PrMVeMOM%H}Nif=8d3*9y+19zS1>GUhaW=%=OrR9@b2I~t8|*S9 zZDMRLfZ{m3f&Opzkpd5kEfG?mX$O)c`3i#h9KwpqeS(M4j{c3tOZ)>XzE>9A7u#?7 zz%HPloD>69YjeZB6jGA81#WiIq-Z4`^+x-gCkNwRA5zBiyd^a2xkgMR$JlS0jmmif zD6`pW@a=GC--4$-q9ktJ=cBW(Sle3j_Q9B>h-V3E9*zaUmFkz z{e0^5yUWN^BSzd8p%0FKv#0gv>tMSiYHVyB&g&JpjQHW%Lbvz!_GH7$q|UHd`cD@S zq4~M@E4!C?q}VAY2xj*Edjyh?fU^Fg>7hevx3I8a6>iS*#grktrtfzuPvTqa{>lO9 z&#OeGMtLmsO)~W^>luQ10GZ$jv8gLBSGF|iP_$TFTN6!OQ?i54(>e*!MWv;^ZVRZ~ z)i~5ebw0qe08NV<5p^}S&0!JKjK=qK8@1zYJciqTzOX10F96>`upk(M&2zjf4{Q6v z#l>ZqFRhv)(CgkIXO?#XY%hJw;EF1#jMkz55nC%?cZ7HAr5&c}fc8md6rJZ%(Y_DT zyHD)*#4Ed-w$%v6WWDr@uq5O?Jc*R|SCop4Bb&deyRnkSpZs!;9mI}h)wJ{+VNQ9& z?|;ofW}Z3GS;tH?h*gnWc)X?g*}yn{J<{7lRNH!e@inUKxmS)&>*IHe6WFF7%t2tAtCEL{<6HrcnJH>@M( z-c(0WLe3DC9Ki0e5|I_n3Zu_|hp$`af~OEBj1J$Jf&-Dh+nPI9nr|hY`urvC-&$X5 zawputHa}*oWBCWhz;QZAAB%V62O6iZm}ucx$xHyGstLCe;R-3s`pHVE&^ym)Je0Xk z>UAeRqM7xsZ3xj|Oez)isck zF!kz{UL90d4aM`giHG`@p_B_Ot|jK(t_*Z{b9;|g9$+u^k1nXjf^AXWgc-ioXb)+t zQdP}iZSZ4jav2#BNG;OCl(XWQ`JXTVRpSS>+HJd;XB5JuR8kasqnUN@N$H}prGts{P`CVOVE`E_vYs@4)!DP*s*mMg)b=b!3oIQ8LB@ z*=|=8@XV_^PQe+7z**uVVXnN}`SY=eJZv+cpb10 zO-;C~X|%(bN-_=~bE7C*CO#HJYt!p5X_N=w^L`dY85eB`$qL-rJ43|h0p+nBbm`{{ zcE4z8PInYy*G1A>v}AA^j7cFTpxN5L*24d}=VF&;;!nZ`0zg!?+@Ih(S+*3IJ_l(Nmzgocr=3^{0UhYQ6wLD8GBXnQ>J|s+vZpP z3iWVR*>Ju7cZzq!zY-DBA>-$FNUpsTm^+lP`o!j9(DG2oaC;!)JooaOL%9|?I;-4u z>>BZy)FFYDjSnCtznR{WnBfmJc^pSR@$P7EeZY{)P`^vg?#|R?i7s7tU@~^qx=fT; z4h}$ii|@UoZm1nKneW#p?-m#oT|`W}vV;dtwpZy4HV*AM?e34lBPGB2FlsZ~T+SS= z3VzFGjT@Re_HZ(H5W5@(-$H5UL2PoXsy(Dukk3`P!>2E=zx1e0{y~&30E$Yp9dF1T ze2)E=+~h2@`xs3mFy3lUMB&nYP5=)>ygxFBo^I$fy;$*Flj~da!Pks&|cGv6B0YGMqDpogk#m<1zLD@?Qg3cbyB&9_%L>kzoF%8iP22H z-rCHc40$hb!XXrV93ET_rQZTS96~@v#bNRt;k)6;f2A-CaOg!O&NlbYz3LwC)+pBR zF>Eij+V`i0mtahMBP$Jo6|!`&Cn)}YdfCF3v-tmE)4czDBvK_Fr`D{}wt?^@E;s-L z*)OpH@-g&DbQrBYrFbo<45(K TZF<7}6O0FKV2Z5OyBYN#2gCGy From 27430644fe8df8d1c8a07b7ae32cfea4e1f3e5fd Mon Sep 17 00:00:00 2001 From: NimRegev Date: Wed, 24 Aug 2022 09:06:38 +0300 Subject: [PATCH 11/23] Update requirements and installation Minor content updates --- _docs/runtime/installation.md | 14 ++++---------- _docs/runtime/requirements.md | 13 ++++++++++--- 2 files changed, 14 insertions(+), 13 deletions(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 948f1a0d6..7a3634576 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -123,7 +123,7 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr **Before you begin** * Make sure you meet the minimum requirements for runtime installation -* [Download/upgrade the latest version of the CLI]({{site.baseurl}}/docs/clients/csdp-cli/#upgrade-codefresh-cli) +* [Download/upgrade to the latest version of the CLI]({{site.baseurl}}/docs/clients/csdp-cli/#upgrade-codefresh-cli) * Review [Hybrid runtime installation flags](#hybrid-runtime-installation-flags) * Make sure your ingress controller is configured correctly: * [Ambasador ingress configuration]({{site.baseurl}}/docs/runtime/requirements/#ambassador-ingress-configuration) @@ -149,7 +149,7 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr * Silent install: Pass the required flags in the install command: `cf runtime install --repo --git-token --silent` For the list of flags, see [Hybrid runtime installation flags](#hybrid-runtime-installation-flags). -1. Complete the configuration for ingress controllers: +1. If relevant, complete the configuration for these ingress controllers: * [ALB AWS: Alias DNS record in route53 to load balancer]({{site.baseurl}}/docs/runtime/requirements/#alias-dns-record-in-route53-to-load-balancer) * [Istio: Configure cluster routing service]({{site.baseurl}}/docs/runtime/requirements/#cluster-routing-service) * [NGINX Enterprise ingress controller: Patch certificate secret]({{site.baseurl}}/docs/runtime/requirements/#patch-certificate-secret) @@ -188,7 +188,7 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr Once the hybrid runtime is successfully installed, it is provisioned on the Kubernetes cluster, and displayed in the **Runtimes** page. -#### Internal ingress host configuration (optional for existing hybrid runtimes only) +#### (Optional) Internal ingress host configuration for existing hybrid runtimes If you already have provisioned hybrid runtimes, to use an internal ingress host for app-proxy communication and an external ingress host to handle webhooks, change the specs for the `Ingress` and `Runtime` resources in the runtime installation repository. Use the examples as guidelines. @@ -261,15 +261,9 @@ data: version: 99.99.99 ``` -#### Git integration registration - -If you bypassed installing ingress resources with the `--skip-ingress` flag, or if AWS ALB is your ingress controller, create and register Git integrations using these commands: - `cf integration git add default --runtime --api-url ` - - `cf integration git register default --runtime --token ` ### Related articles [Add external clusters to runtimes]({{site.baseurl}}/docs/runtime/managed-cluster/) [Manage provisioned runtimes]({{site.baseurl}}/docs/runtime/monitor-manage-runtimes/) [(Hybrid) Monitor provisioned runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) -[Troubleshoot runtime installation]({{site.baseurl}}/docs/troubleshooting/runtime-issues/) +[Troubleshoot hybrid runtime installation]({{site.baseurl}}/docs/troubleshooting/runtime-issues/) diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 6f49b21a5..f67c10512 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -40,7 +40,8 @@ The table below lists the specific configuration requirements for Codefresh. Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. #### Valid SSL certificate -For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). +For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). +> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. #### TCP support Configure to handle TCP requests. @@ -67,6 +68,7 @@ Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL #### Valid SSL certificate For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). +> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. #### TCP support Configure to handle TCP requests. @@ -93,7 +95,7 @@ spec: * From the **Route traffic to** list, select **Alais to Application and Classic Load Balancer**. * From the list of Regions, select the region. For example, **US East**. * From the list of load balancers, select the load balancer that was created during installation. - + For more information, see [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html){:target="\_blank"}. {% include image.html @@ -132,6 +134,7 @@ Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL #### Valid SSL certificate For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). +> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. #### TCP support Configure to handle TCP requests. @@ -209,6 +212,7 @@ Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL #### Valid SSL certificate For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). +> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. #### TCP support Configure to handle TCP requests. @@ -281,6 +285,7 @@ Run `kubectl get svc -A` to get a list of services, and verify that the `EXTERNA #### Valid SSL certificate For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). +> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. #### TCP support Configure to handle TCP requests. @@ -516,6 +521,7 @@ Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL #### Valid SSL certificate For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). +> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. #### TCP support Configure to handle TCP requests. @@ -538,4 +544,5 @@ providers: ``` ### What to read next -[Installing hybrid runtimes]({{site.baseurl}}/docs/runtime/installation/) +[Hybrid runtime installation flags]({{site.baseurl}}/docs/runtime/installation//#hybrid-runtime-installation-flags) +[Install hybrid runtimes]({{site.baseurl}}/docs/runtime/installation/) From b05b4ffd173fbea204c3d9e92a11081aceb5fa7c Mon Sep 17 00:00:00 2001 From: NimRegev Date: Wed, 24 Aug 2022 09:32:16 +0300 Subject: [PATCH 12/23] Update requirements.md Minor update --- _docs/runtime/requirements.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index f67c10512..3ae604128 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -18,10 +18,10 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | Item | Requirement | | -------------- | -------------- | |Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. {::nomarkdown}
Tip: To check the server version, run:
kubectl version --short.{:/}| -| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}
Supported and tested ingress controllers include:

  • Ambassador
    • {:/}(see [Ambassador ingress configuration](#ambassador-ingress-configuration)){::nomarkdown}
  • AWS ALB (Application Load Balancer)
    • {:/} (see [AWS ALB ingress configuration](#aws-alb-ingress-configuration)){::nomarkdown}
  • NGINX Enterprise (nginx.org/ingress-controller)
    • {:/} (see [NGINX Enterprise ingress configuration](#nginx-enterprise-ingress-configuration)){::nomarkdown}
  • NGINX Community (k8s.io/ingress-nginx)
    • {:/} (see [NGINX Community ingress configuration](#nginx-community-version-ingress-configuration)){::nomarkdown}
  • Istio
    • {:/} (see [Istio ingress configuration](#istio-ingress-configuration)){::nomarkdown}
  • Trafik
    • {:/}(see [Traefik ingress configuration](#traefik-ingress-configuration))| +| Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}
    Supported and tested ingress controllers include:
    • Ambassador
      • {:/}(see [Ambassador ingress configuration](#ambassador-ingress-configuration)){::nomarkdown}
    • AWS ALB (Application Load Balancer)
      • {:/} (see [AWS ALB ingress configuration](#aws-alb-ingress-configuration)){::nomarkdown}
    • Istio
      • {:/} (see [Istio ingress configuration](#istio-ingress-configuration)){::nomarkdown}
    • NGINX Enterprise (nginx.org/ingress-controller)
      • {:/} (see [NGINX Enterprise ingress configuration](#nginx-enterprise-ingress-configuration)){::nomarkdown}
    • NGINX Community (k8s.io/ingress-nginx)
      • {:/} (see [NGINX Community ingress configuration](#nginx-community-version-ingress-configuration)){::nomarkdown}
    • Trafik
      • {:/}(see [Traefik ingress configuration](#traefik-ingress-configuration))| |Node requirements| {::nomarkdown}
      • Memory: 5000 MB
      • CPU: 2
      {:/}| |Cluster permissions | Cluster admin permissions | -|Git providers |{::nomarkdown}
      • GitHub
      • GitLab
      • Bitbucket Server
      • GitHub Enterprise
      {:/}| +|Git providers |{::nomarkdown}
      • GitHub
      {:/}| |Git access tokens | {::nomarkdown}Runtime Git token:
      • Valid expiration date
      • Scopes: repo and admin-repo.hook
      Personal access Git token:
      • Valid expiration date
      • Scopes: repo
    {:/}| ### Ambassador ingress configuration From c8f01663baab6787e26e070c82d3ca73b2267b1a Mon Sep 17 00:00:00 2001 From: NimRegev Date: Wed, 24 Aug 2022 09:41:22 +0300 Subject: [PATCH 13/23] Update installation.md Added git provider, git user and extended rep url flag descriptions currently commented out pending approval by product --- _docs/runtime/installation.md | 37 ++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 7a3634576..f720da4b8 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -92,7 +92,7 @@ For both CLI wizard and Silent install: See [Internal ingress host configuration (optional for existing runtimes only)](#internal-ingress-host-configuration-optional-for-existing-hybrid-runtimes-only). -#### Git repository flags +#### Git repository flags **Repository URLs** The GitHub repository to house the installation definitions. @@ -105,6 +105,41 @@ Required. The Git token authenticating access to the GitHub installation repository. * Silent install: Add the `--git-token` flag. + + + +#### Codefresh resources flags **Codefresh demo resources** Optional. Install demo pipelines to use as a starting point to create your own pipelines. We recommend installing the demo resources as these are used in our quick start tutorials. From 469ce5ce4445b1b0ec6c704678448753579e03e8 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Wed, 24 Aug 2022 11:02:47 +0300 Subject: [PATCH 14/23] Update requirements and installation Changed SSL to TLS and removed note on skip connectivity and server version checks --- _docs/runtime/installation.md | 12 +++------ _docs/runtime/requirements.md | 48 +++++++++++++++++------------------ 2 files changed, 28 insertions(+), 32 deletions(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index f720da4b8..9acb1a57f 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -92,7 +92,7 @@ For both CLI wizard and Silent install: See [Internal ingress host configuration (optional for existing runtimes only)](#internal-ingress-host-configuration-optional-for-existing-hybrid-runtimes-only). -#### Git repository flags +#### Git repository flags **Repository URLs** The GitHub repository to house the installation definitions. @@ -157,8 +157,8 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr ### Install the hybrid runtime **Before you begin** -* Make sure you meet the minimum requirements for runtime installation -* [Download/upgrade to the latest version of the CLI]({{site.baseurl}}/docs/clients/csdp-cli/#upgrade-codefresh-cli) +* Make sure you meet the [minimum requirements]({{site.baseurl}}/docs/runtime/requirements/#minimum-requirements) for runtime installation +* [Download or upgrade to the latest version of the CLI]({{site.baseurl}}/docs/clients/csdp-cli/#upgrade-codefresh-cli) * Review [Hybrid runtime installation flags](#hybrid-runtime-installation-flags) * Make sure your ingress controller is configured correctly: * [Ambasador ingress configuration]({{site.baseurl}}/docs/runtime/requirements/#ambassador-ingress-configuration) @@ -171,10 +171,6 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr **How to** -> Note: -> Hybrid runtime installation starts by checking network connectivity and the K8s cluster server version. - To skip these tests, pass the `--skip-cluster-checks` flag. - 1. Do one of the following: * If this is your first hybrid runtime installation, in the Welcome page, select **+ Install Runtime**. * If you have provisioned a hybrid runtime, to provision additional runtimes, in the Codefresh UI, go to [**Runtimes**](https://g.codefresh.io/2.0/account-settings/runtimes){:target="\_blank"}. @@ -188,7 +184,7 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr * [ALB AWS: Alias DNS record in route53 to load balancer]({{site.baseurl}}/docs/runtime/requirements/#alias-dns-record-in-route53-to-load-balancer) * [Istio: Configure cluster routing service]({{site.baseurl}}/docs/runtime/requirements/#cluster-routing-service) * [NGINX Enterprise ingress controller: Patch certificate secret]({{site.baseurl}}/docs/runtime/requirements/#patch-certificate-secret) -1. If you bypassed installing ingress resources with the `--skip-ingress` flag, create and register Git integrations using these commands: +1. If you bypassed installing ingress resources with the `--skip-ingress` flag for ingress controllers not in the supported list, create and register Git integrations using these commands: `cf integration git add default --runtime --api-url ` `cf integration git register default --runtime --token ` diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 3ae604128..a0d40956b 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -39,12 +39,12 @@ The table below lists the specific configuration requirements for Codefresh. #### Valid external IP address Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. -#### Valid SSL certificate -For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). -> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. +#### Valid TLS certificate +For secure runtime installation, the ingress controller must have a valid TLS certificate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. #### TCP support -Configure to handle TCP requests. +Configure the ingress contoller to handle TCP requests. ### AWS ALB ingress configuration @@ -66,12 +66,12 @@ The table below lists the specific configuration requirements for Codefresh. #### Valid external IP address Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. -#### Valid SSL certificate -For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). -> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. +#### Valid TLS certificate +For secure runtime installation, the ingress controller must have a valid TLS certificate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. #### TCP support -Configure to handle TCP requests. +Configure the ingress contoller to handle TCP requests. #### Controller configuration In the ingress resource file, verify that `spec.controller` is configured as `ingress.k8s.aws/alb`. @@ -132,12 +132,12 @@ The table below lists the specific configuration requirements for Codefresh. #### Valid external IP address Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. -#### Valid SSL certificate -For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). -> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. +#### Valid TLS certificate +For secure runtime installation, the ingress controller must have a valid TLS certificate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. #### TCP support -Configure to handle TCP requests. +Configure the ingress contoller to handle TCP requests. #### Cluster routing service > The cluster routing service must be configured _after_ installing the hybrid runtime. @@ -210,12 +210,12 @@ The table below lists the specific configuration requirements for Codefresh. #### Valid external IP address Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. -#### Valid SSL certificate -For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). -> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. +#### Valid TLS certificate +For secure runtime installation, the ingress controller must have a valid TLS certificate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. #### TCP support -Configure to handle TCP requests. +Configure the ingress contoller to handle TCP requests. #### NGINX Ingress: Enable report status to cluster @@ -283,12 +283,12 @@ The table below lists the specific configuration requirements for Codefresh. #### Valid external IP address Run `kubectl get svc -A` to get a list of services, and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. -#### Valid SSL certificate -For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). -> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. +#### Valid TLS certificate +For secure runtime installation, the ingress controller must have a valid TLS certificate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. #### TCP support -Configure to handle TCP requests. +Configure the ingress contoller to handle TCP requests. Here's an example of TCP configuration for NGINX Community on AWS. Verify that the `ingress-nginx-controller` service manifest has either of the following annotations: @@ -519,12 +519,12 @@ The table below lists the specific configuration requirements for Codefresh. #### Valid external IP address Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL-IP` column for your ingress controller shows a valid hostname. -#### Valid SSL certificate -For secure runtime installation, the ingress controller must have a valid SSL certificate from an authorized CA (Certificate Authority). -> Use the FQDN (Fully Qualified Domain Name) of teh ingress controller for the SSL certifcate. +#### Valid TLS certificate +For secure runtime installation, the ingress controller must have a valid TLS certificate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. #### TCP support -Configure to handle TCP requests. +Configure the ingress contoller to handle TCP requests. #### Enable report status to cluster By default, the Traefik ingress controller is not configured to report its status to the cluster. If not configured, Argo’s health check reports the health status as “progressing”, resulting in a timeout error during installation. From bc07f25613fb6ee9d5abd2f25a2848478267d783 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Wed, 24 Aug 2022 11:17:20 +0300 Subject: [PATCH 15/23] Update cross-refs for installation and requirements --- _data/home-content.yml | 2 +- _data/nav.yml | 2 +- _docs/runtime/installation.md | 10 +++++----- _docs/runtime/installation_original.md | 2 +- _docs/runtime/managed-cluster.md | 2 +- _docs/runtime/monitor-manage-runtimes.md | 4 ++-- _docs/runtime/monitoring-troubleshooting.md | 2 +- 7 files changed, 12 insertions(+), 12 deletions(-) diff --git a/_data/home-content.yml b/_data/home-content.yml index dff15405c..68d86fa9c 100644 --- a/_data/home-content.yml +++ b/_data/home-content.yml @@ -39,7 +39,7 @@ localurl: /docs/runtime/installation - title: Manage provisioned runtimes localurl: /docs/runtime/monitor-manage-runtimes/ - - title: Monitor provisioned runtimes + - title: Monitor provisioned hybrid runtimes localurl: /docs/runtime/monitoring-troubleshooting/ - title: Add external clusters to runtimes localurl: /docs/runtime/managed-cluster/ diff --git a/_data/nav.yml b/_data/nav.yml index d2833506f..c96d5f2e2 100644 --- a/_data/nav.yml +++ b/_data/nav.yml @@ -55,7 +55,7 @@ url: "/installation" - title: Manage provisioned runtimes url: "/monitor-manage-runtimes" - - title: Monitor provisioned runtimes + - title: Monitor provisioned hybrid runtimes url: "/monitoring-troubleshooting" - title: Add external clusters to runtimes url: "/managed-cluster" diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 9acb1a57f..52bc1090c 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -59,7 +59,7 @@ The Git repository per runtime account with shared configuration manifests. **Skip ingress** Required, if you are using an unsupported ingress controller. For unsupported ingress controllers, bypass installing ingress resources with the `--skip-ingress` flag. -In this case, after completing the installation, manually configure the cluster's routing service, and create and register Git integrations. See _Cluster routing service_ in [Post-installation configuration](#post-installation-configuration). +In this case, after completing the installation, manually configure the cluster's routing service, and create and register Git integrations. See the last steo in [Install the hybrid runtime](#install-the-hybrid-runtime). **Ingress class** Required if you have more than one ingress class configured on your cluster. @@ -89,7 +89,7 @@ For both CLI wizard and Silent install: * For new runtime installations, add the `--internal-ingress-host` flag pointing to the ingress host for `app-proxy`. * For existing installations, commit changes to the installation repository by modifying the `app-proxy ingress` and `.yaml` - See [Internal ingress host configuration (optional for existing runtimes only)](#internal-ingress-host-configuration-optional-for-existing-hybrid-runtimes-only). + See [(Optional) Internal ingress host configuration for existing hybrid runtimes](#optional-internal-ingress-host-configuration-for-existing-hybrid-runtimes). #### Git repository flags @@ -139,7 +139,7 @@ The username for the Git account. * CLI wizard and Silent install: For Bitbucket Server, add the `--git-user` flag, and define the username. For example, `codefresh` ---> -#### Codefresh resources flags +#### Codefresh resource flags **Codefresh demo resources** Optional. Install demo pipelines to use as a starting point to create your own pipelines. We recommend installing the demo resources as these are used in our quick start tutorials. @@ -219,7 +219,7 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr Once the hybrid runtime is successfully installed, it is provisioned on the Kubernetes cluster, and displayed in the **Runtimes** page. -#### (Optional) Internal ingress host configuration for existing hybrid runtimes +### (Optional) Internal ingress host configuration for existing hybrid runtimes If you already have provisioned hybrid runtimes, to use an internal ingress host for app-proxy communication and an external ingress host to handle webhooks, change the specs for the `Ingress` and `Runtime` resources in the runtime installation repository. Use the examples as guidelines. @@ -296,5 +296,5 @@ data: ### Related articles [Add external clusters to runtimes]({{site.baseurl}}/docs/runtime/managed-cluster/) [Manage provisioned runtimes]({{site.baseurl}}/docs/runtime/monitor-manage-runtimes/) -[(Hybrid) Monitor provisioned runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) +[Monitor provisioned hybrid runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) [Troubleshoot hybrid runtime installation]({{site.baseurl}}/docs/troubleshooting/runtime-issues/) diff --git a/_docs/runtime/installation_original.md b/_docs/runtime/installation_original.md index e0a2eb48a..a9624bc7d 100644 --- a/_docs/runtime/installation_original.md +++ b/_docs/runtime/installation_original.md @@ -334,5 +334,5 @@ If you bypassed installing ingress resources with the `--skip-ingress` flag, or [Add external clusters to runtimes]({{site.baseurl}}/docs/runtime/managed-cluster/) [Add Git Sources to runtimes]({{site.baseurl}}/docs/runtime/git-sources/) [Manage provisioned runtimes]({{site.baseurl}}/docs/runtime/monitor-manage-runtimes/) -[(Hybrid) Monitor provisioned runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) +[Monitor provisioned hybrid runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) [Troubleshoot runtime installation]({{site.baseurl}}/docs/troubleshooting/runtime-issues/) diff --git a/_docs/runtime/managed-cluster.md b/_docs/runtime/managed-cluster.md index b591ab328..db3dd3300 100644 --- a/_docs/runtime/managed-cluster.md +++ b/_docs/runtime/managed-cluster.md @@ -280,5 +280,5 @@ Remove a cluster from the list managed by the runtime, through the CLI. ### Related articles [Add Git Sources to runtimes]({{site.baseurl}}/docs/runtime/git-sources/) -[Manage provisioned runtimes]({{site.baseurl}}/docs/runtime/monitor-manage-runtimes/) +[Manage provisioned hybrid runtimes]({{site.baseurl}}/docs/runtime/monitor-manage-runtimes/) [(Hybrid) Monitor provisioned runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) \ No newline at end of file diff --git a/_docs/runtime/monitor-manage-runtimes.md b/_docs/runtime/monitor-manage-runtimes.md index 1a87d6d17..5c2cebe66 100644 --- a/_docs/runtime/monitor-manage-runtimes.md +++ b/_docs/runtime/monitor-manage-runtimes.md @@ -13,7 +13,7 @@ The **Runtimes** page displays the provisioned runtimes in your account, both hy > Unless specified otherwise, management options are common to both hybrid and hosted runtimes. -To monitor provisioned runtimes, including recovering runtimes for failed clusters, see [Monitor provisioned runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/). +To monitor provisioned hybrid runtimes, including recovering runtimes for failed clusters, see [Monitor provisioned hybrid runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/). ### Runtime views @@ -228,7 +228,7 @@ Pass the mandatory flags in the uninstall command: ### Related articles -[(Hybrid) Monitor provisioned runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) +[Monitor provisioned hybrid runtimes]({{site.baseurl}}/docs/runtime/monitoring-troubleshooting/) [Add Git Sources to runtimes]({{site.baseurl}}/docs/runtime/git-sources/) [Add external clusters to runtimes]({{site.baseurl}}/docs/runtime/managed-cluster/) diff --git a/_docs/runtime/monitoring-troubleshooting.md b/_docs/runtime/monitoring-troubleshooting.md index af23d1263..c225c1b45 100644 --- a/_docs/runtime/monitoring-troubleshooting.md +++ b/_docs/runtime/monitoring-troubleshooting.md @@ -1,5 +1,5 @@ --- -title: "Monitor provisioned runtimes" +title: "(Hybrid) Monitor provisioned runtimes" description: "" group: runtime toc: true From a959dcb0f74d9db3bbed076bf2da7c639729dbed Mon Sep 17 00:00:00 2001 From: NimRegev Date: Wed, 24 Aug 2022 11:46:13 +0300 Subject: [PATCH 16/23] Updates Fixed typos and replaced SSL with TLS --- _docs/runtime/installation.md | 8 ++++---- _docs/runtime/requirements.md | 37 +++++++++++++++++------------------ 2 files changed, 22 insertions(+), 23 deletions(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 52bc1090c..38b5ba99d 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -39,7 +39,7 @@ The runtime name must start with a lower-case character, and can include up to 6 **Namespace resource labels** Optional. -The label of the namespace resource to which you are installing the hybrid runtime. Labels are required to identity the networks that need access during installation, as is the case when using services meshes such as Istio for example. +The label of the namespace resource to which you are installing the hybrid runtime. Labels are required to identify the networks that need access during installation, as is the case when using services meshes such as Istio for example. * CLI wizard and Silent install: Add the `--namespace-labels` flag, and define the labels in `key=value` format. Separate multiple labels with `commas`. @@ -59,7 +59,7 @@ The Git repository per runtime account with shared configuration manifests. **Skip ingress** Required, if you are using an unsupported ingress controller. For unsupported ingress controllers, bypass installing ingress resources with the `--skip-ingress` flag. -In this case, after completing the installation, manually configure the cluster's routing service, and create and register Git integrations. See the last steo in [Install the hybrid runtime](#install-the-hybrid-runtime). +In this case, after completing the installation, manually configure the cluster's routing service, and create and register Git integrations. See the last step in [Install the hybrid runtime](#install-the-hybrid-runtime). **Ingress class** Required if you have more than one ingress class configured on your cluster. @@ -76,8 +76,8 @@ The IP address or host name of the ingress controller component. > Important: For AWS ALB, the ingress host is created post-installation. However, when prompted, add the domain name you will create in `Route 53` as the ingress host. **Insecure ingress hosts** -SSL certificates for the ingress host: -If the ingress host does not have a valid SSL certificate, you can continue with the installation in insecure mode, which disables certificate validation. +TLS certificates for the ingress host: +If the ingress host does not have a valid TLS certificate, you can continue with the installation in insecure mode, which disables certificate validation. * CLI wizard: Automatically detects and prompts you to confirm continuing the installation in insecure mode. * Silent install: To continue with the installation in insecure mode, add the `--insecure-ingress-host` flag. diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index a0d40956b..4cc9ac9f5 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -41,10 +41,10 @@ Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL #### Valid TLS certificate For secure runtime installation, the ingress controller must have a valid TLS certificate. -> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certificate. #### TCP support -Configure the ingress contoller to handle TCP requests. +Configure the ingress controller to handle TCP requests. ### AWS ALB ingress configuration @@ -68,10 +68,10 @@ Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL #### Valid TLS certificate For secure runtime installation, the ingress controller must have a valid TLS certificate. -> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certificate. #### TCP support -Configure the ingress contoller to handle TCP requests. +Configure the ingress controller to handle TCP requests. #### Controller configuration In the ingress resource file, verify that `spec.controller` is configured as `ingress.k8s.aws/alb`. @@ -84,15 +84,15 @@ metadata: spec: controller: ingress.k8s.aws/alb ``` -#### Create an alias in route53 to load balancer +#### Create an alias to load balancer in route53 > The alias must be configured _after_ installing the hybrid runtime. 1. Make sure a DNS record is available in the correct hosted zone. 1. _After_ hybrid runtime installation, in Amazon Route 53, create an alias to route traffic to the load balancer that is automatically created during the installation: * **Record name**: Enter the same record name used in the installation. - * Toggle **Alias** to ON. - * From the **Route traffic to** list, select **Alais to Application and Classic Load Balancer**. + * Toggle **Alias** to **ON**. + * From the **Route traffic to** list, select **Alias to Application and Classic Load Balancer**. * From the list of Regions, select the region. For example, **US East**. * From the list of load balancers, select the load balancer that was created during installation. @@ -108,13 +108,12 @@ For more information, see [Creating records by using the Amazon Route 53 console %} #### (Optional) Git integration registration -If the installation failed, as it cam happen if the DNS record was not created within the timeframe, manually create and register Git integrations using these commands: +If the installation failed, as can happen if the DNS record was not created within the timeframe, manually create and register Git integrations using these commands: `cf integration git add default --runtime --api-url ` `cf integration git register default --runtime --token ` - where: - * `` is the name of the runtime you + ### Istio ingress configuration For detailed configuration information, see [Istio ingress controller documentation](https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress){:target="\_blank}. @@ -134,10 +133,10 @@ Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL #### Valid TLS certificate For secure runtime installation, the ingress controller must have a valid TLS certificate. -> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certificate. #### TCP support -Configure the ingress contoller to handle TCP requests. +Configure the ingress controller to handle TCP requests. #### Cluster routing service > The cluster routing service must be configured _after_ installing the hybrid runtime. @@ -212,10 +211,10 @@ Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL #### Valid TLS certificate For secure runtime installation, the ingress controller must have a valid TLS certificate. -> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certificate. #### TCP support -Configure the ingress contoller to handle TCP requests. +Configure the ingress controller to handle TCP requests. #### NGINX Ingress: Enable report status to cluster @@ -249,7 +248,7 @@ If the ingress controller is not configured to report its status to the cluster, You will need to add this to the `ingress-master` when you have completed runtime installation. #### Patch certificate secret -> The certifcate secret must be configured _after_ installing the hybrid runtime. +> The certificate secret must be configured _after_ installing the hybrid runtime. Patch the certificate secret in `spec.tls` of the `ingress-master` resource. The secret must be in the same namespace as the runtime. @@ -285,10 +284,10 @@ Run `kubectl get svc -A` to get a list of services, and verify that the `EXTERNA #### Valid TLS certificate For secure runtime installation, the ingress controller must have a valid TLS certificate. -> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certificate. #### TCP support -Configure the ingress contoller to handle TCP requests. +Configure the ingress controller to handle TCP requests. Here's an example of TCP configuration for NGINX Community on AWS. Verify that the `ingress-nginx-controller` service manifest has either of the following annotations: @@ -521,10 +520,10 @@ Run `kubectl get svc -A` to get a list of services and verify that the `EXTERNAL #### Valid TLS certificate For secure runtime installation, the ingress controller must have a valid TLS certificate. -> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certifcate. +> Use the FQDN (Fully Qualified Domain Name) of the ingress controller for the TLS certificate. #### TCP support -Configure the ingress contoller to handle TCP requests. +Configure the ingress controller to handle TCP requests. #### Enable report status to cluster By default, the Traefik ingress controller is not configured to report its status to the cluster. If not configured, Argo’s health check reports the health status as “progressing”, resulting in a timeout error during installation. From 19ed70368bdde19fd9f4211c9638a77047ef9d08 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Thu, 25 Aug 2022 13:34:48 +0300 Subject: [PATCH 17/23] Add flags and reqs for gateway-api Added allowedRoutes req and gateway flgs --- _docs/runtime/installation.md | 29 +++++++++++++++++++++++++++++ _docs/runtime/requirements.md | 1 + 2 files changed, 30 insertions(+) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 38b5ba99d..2f8981b4e 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -91,6 +91,35 @@ For both CLI wizard and Silent install: * For existing installations, commit changes to the installation repository by modifying the `app-proxy ingress` and `.yaml` See [(Optional) Internal ingress host configuration for existing hybrid runtimes](#optional-internal-ingress-host-configuration-for-existing-hybrid-runtimes). +#### Gateway API controller flags + + +**Gateway name** +Required. +The name of the gateway for runtime installation. + +* CLI wizard: Select the gateway name for runtime installation from the list displayed. +* Silent install: Explicitly specify the gateway name through the `--gateway-name` flag. Otherwise, runtime installation fails. + +**Gateway namespace** +Required. +The namespace with the **Gateway name**. +For both CLI wizard and Silent install, specify the namespace through the `--gateway-namespace` flag. + +**Ingress host** +Required. +The IP address or host name of the gateway controller component. + +* CLI wizard: Automatically selects and displays the host, either from the cluster or the ingress controller associated with the **Ingress class**. +* Silent install: Add the `--ingress-host` flag. If a value is not provided, takes the host from the gaeway controller associated with the **Ingress class**. + > Important: For AWS ALB, the ingress host is created post-installation. However, when prompted, add the domain name you will create in `Route 53` as the ingress host. + +**Insecure ingress hosts** +TLS certificates for the ingress host: If the ingress host does not have a valid TLS certificate, you can continue with the installation in insecure mode, which disables certificate validation. + +* CLI wizard: Automatically detects and prompts you to confirm continuing the installation in insecure mode. +* Silent install: To continue with the installation in insecure mode, add the `--insecure-ingress-host` flag. + #### Git repository flags diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 4cc9ac9f5..a6ff65c59 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -19,6 +19,7 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | -------------- | -------------- | |Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. {::nomarkdown}
    Tip: To check the server version, run:
    kubectl version --short.{:/}| | Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}
    Supported and tested ingress controllers include:
    • Ambassador
      • {:/}(see [Ambassador ingress configuration](#ambassador-ingress-configuration)){::nomarkdown}
    • AWS ALB (Application Load Balancer)
      • {:/} (see [AWS ALB ingress configuration](#aws-alb-ingress-configuration)){::nomarkdown}
    • Istio
      • {:/} (see [Istio ingress configuration](#istio-ingress-configuration)){::nomarkdown}
    • NGINX Enterprise (nginx.org/ingress-controller)
      • {:/} (see [NGINX Enterprise ingress configuration](#nginx-enterprise-ingress-configuration)){::nomarkdown}
    • NGINX Community (k8s.io/ingress-nginx)
      • {:/} (see [NGINX Community ingress configuration](#nginx-community-version-ingress-configuration)){::nomarkdown}
    • Trafik
      • {:/}(see [Traefik ingress configuration](#traefik-ingress-configuration))| + |Node requirements| {::nomarkdown}
      • Memory: 5000 MB
      • CPU: 2
      {:/}| |Cluster permissions | Cluster admin permissions | |Git providers |{::nomarkdown}
      • GitHub
      {:/}| From cf18796d27c7da61375d8455a15cb1561a12c815 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Thu, 25 Aug 2022 14:14:03 +0300 Subject: [PATCH 18/23] Update reqs and installation Content edits --- _docs/runtime/installation.md | 26 +++++++++----------------- _docs/runtime/requirements.md | 2 +- 2 files changed, 10 insertions(+), 18 deletions(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 2f8981b4e..f5a2b83f9 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -39,7 +39,7 @@ The runtime name must start with a lower-case character, and can include up to 6 **Namespace resource labels** Optional. -The label of the namespace resource to which you are installing the hybrid runtime. Labels are required to identify the networks that need access during installation, as is the case when using services meshes such as Istio for example. +The label of the namespace resource to which you are installing the hybrid runtime. Labels are required to identify the networks that need access during installation, as is the case when using services meshes such as Istio for example. For Gateway APIs, use the namespace label if defined to reference the runtine in the `allowedRoutes.namespaces`. * CLI wizard and Silent install: Add the `--namespace-labels` flag, and define the labels in `key=value` format. Separate multiple labels with `commas`. @@ -91,34 +91,26 @@ For both CLI wizard and Silent install: * For existing installations, commit changes to the installation repository by modifying the `app-proxy ingress` and `.yaml` See [(Optional) Internal ingress host configuration for existing hybrid runtimes](#optional-internal-ingress-host-configuration-for-existing-hybrid-runtimes). -#### Gateway API controller flags +#### Gateway API flags **Gateway name** Required. The name of the gateway for runtime installation. -* CLI wizard: Select the gateway name for runtime installation from the list displayed. -* Silent install: Explicitly specify the gateway name through the `--gateway-name` flag. Otherwise, runtime installation fails. +* CLI wizard and Silent install: Specify the gateway name through the `--gateway-name` flag. **Gateway namespace** Required. -The namespace with the **Gateway name**. -For both CLI wizard and Silent install, specify the namespace through the `--gateway-namespace` flag. +The namespace with the **Gateway name**. + +* CLI wizard and Silent install: Specify the namespace through the `--gateway-namespace` flag. **Ingress host** Required. -The IP address or host name of the gateway controller component. - -* CLI wizard: Automatically selects and displays the host, either from the cluster or the ingress controller associated with the **Ingress class**. -* Silent install: Add the `--ingress-host` flag. If a value is not provided, takes the host from the gaeway controller associated with the **Ingress class**. - > Important: For AWS ALB, the ingress host is created post-installation. However, when prompted, add the domain name you will create in `Route 53` as the ingress host. +The IP address or host name of the gateway. -**Insecure ingress hosts** -TLS certificates for the ingress host: If the ingress host does not have a valid TLS certificate, you can continue with the installation in insecure mode, which disables certificate validation. - -* CLI wizard: Automatically detects and prompts you to confirm continuing the installation in insecure mode. -* Silent install: To continue with the installation in insecure mode, add the `--insecure-ingress-host` flag. +* CLI wizard and Silent install: Specify the gateway host through the `--ingress-host` flag. #### Git repository flags @@ -136,7 +128,7 @@ The Git token authenticating access to the GitHub installation repository. +|Gateway API| Namespace with the Codefresh in `allowedRoutes.namespaces` | |Node requirements| {::nomarkdown}
      • Memory: 5000 MB
      • CPU: 2
      {:/}| |Cluster permissions | Cluster admin permissions | |Git providers |{::nomarkdown}
      • GitHub
      {:/}| From ffa2f71f3dcf06843f942c45f01a5dc5a6a602f9 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Sun, 28 Aug 2022 12:17:16 +0300 Subject: [PATCH 19/23] Update architecture.md Added section on gateway API to architecture --- _docs/getting-started/architecture.md | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/_docs/getting-started/architecture.md b/_docs/getting-started/architecture.md index 77db5411a..a6ccb034a 100644 --- a/_docs/getting-started/architecture.md +++ b/_docs/getting-started/architecture.md @@ -141,8 +141,21 @@ The customer environment that communicates with the Codefresh platform, generall {:/} #### Ingress Controller -In hybrid runtime environments, the ingress controller implements the ingress traffic rules for the Codefresh Runtime. It is configured on the same Kubernetes cluster as the Codefresh Runtime. -See [Ingress controller]({{site.baseurl}}/docs/runtime/requirements/#ingress-controller). +In hybrid runtime environments, the ingress controller can be used to implement the ingress traffic rules for the Codefresh Runtime. It is configured on the same Kubernetes cluster as the Codefresh Runtime. +Alternatively, if implemented and supported, you can use the Gateway API instead of an ingress controller. + +See [Hybrid runtime requirements]({{site.baseurl}}/docs/runtime/requirements) and [Ingress controller flags]({{site.baseurl}}/docs/runtime/installation/#ingress-controller-flags). + +#### Gateway API +In hybrid runtime environments, the Gateway API can be used to implement the ingress traffic rules for the Codefresh Runtime. It is configured on the same Kubernetes cluster as the Codefresh Runtime. + +The Gateway API is an open source project managed by the SIG-NETWORK community, currently in beta. The Gateway API aims to "evolve Kubernetes service networking through expressive, extensible, and role-oriented interfaces that are implemented by many vendors and have broad industry support". +Codefresh is fully compatible with the current version of the Gatway API, and is vendor-agnostic, supporting different implementations and integrations. +See [Hybrid runtime requirements]({{site.baseurl}}/docs/runtime/requirements) and [Gateway API flags]({{site.baseurl}}/docs/runtime/installation/#gateway-api-flags). + + +For detailed information on the Gateway API, see [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) and [Implementations](https://gateway-api.sigs.k8s.io/implementations/). + {::nomarkdown}
      From bd2932f5b2d10ff61b1c6e9a050ae952389b8085 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Sun, 28 Aug 2022 12:21:51 +0300 Subject: [PATCH 20/23] Update requirements.md --- _docs/runtime/requirements.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_docs/runtime/requirements.md b/_docs/runtime/requirements.md index 8eb615c8e..71b8e4513 100644 --- a/_docs/runtime/requirements.md +++ b/_docs/runtime/requirements.md @@ -19,10 +19,10 @@ The requirements listed are the **_minimum_** requirements to provision **_hybri | -------------- | -------------- | |Kubernetes cluster | Server version 1.18 and higher, without Argo Project components. {::nomarkdown}
      Tip: To check the server version, run:
      kubectl version --short.{:/}| | Ingress controller| Configured on Kubernetes cluster and exposed from the cluster. {::nomarkdown}
      Supported and tested ingress controllers include:
      • Ambassador
        • {:/}(see [Ambassador ingress configuration](#ambassador-ingress-configuration)){::nomarkdown}
      • AWS ALB (Application Load Balancer)
        • {:/} (see [AWS ALB ingress configuration](#aws-alb-ingress-configuration)){::nomarkdown}
      • Istio
        • {:/} (see [Istio ingress configuration](#istio-ingress-configuration)){::nomarkdown}
      • NGINX Enterprise (nginx.org/ingress-controller)
        • {:/} (see [NGINX Enterprise ingress configuration](#nginx-enterprise-ingress-configuration)){::nomarkdown}
      • NGINX Community (k8s.io/ingress-nginx)
        • {:/} (see [NGINX Community ingress configuration](#nginx-community-version-ingress-configuration)){::nomarkdown}
      • Trafik
        • {:/}(see [Traefik ingress configuration](#traefik-ingress-configuration))| -|Gateway API| Namespace with the Codefresh in `allowedRoutes.namespaces` | +|Gateway API| Namespace with the Codefresh runtime in `allowedRoutes.namespaces` | |Node requirements| {::nomarkdown}
        • Memory: 5000 MB
        • CPU: 2
        {:/}| |Cluster permissions | Cluster admin permissions | -|Git providers |{::nomarkdown}
        • GitHub
        {:/}| +|Git providers |{::nomarkdown}
        • GitHub
        {:/}| |Git access tokens | {::nomarkdown}Runtime Git token:
        • Valid expiration date
        • Scopes: repo and admin-repo.hook
        Personal access Git token:
        • Valid expiration date
        • Scopes: repo
      {:/}| ### Ambassador ingress configuration From 48a163e16ff6ecb00c3a5dd1116dcf0706372530 Mon Sep 17 00:00:00 2001 From: NimRegev Date: Sun, 28 Aug 2022 15:16:31 +0300 Subject: [PATCH 21/23] Update architecture and install Minor content updates --- _docs/getting-started/architecture.md | 4 ++-- _docs/runtime/installation.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/_docs/getting-started/architecture.md b/_docs/getting-started/architecture.md index a6ccb034a..90deca15a 100644 --- a/_docs/getting-started/architecture.md +++ b/_docs/getting-started/architecture.md @@ -141,13 +141,13 @@ The customer environment that communicates with the Codefresh platform, generall {:/} #### Ingress Controller -In hybrid runtime environments, the ingress controller can be used to implement the ingress traffic rules for the Codefresh Runtime. It is configured on the same Kubernetes cluster as the Codefresh Runtime. +In hybrid runtime environments, the ingress controller implements the ingress traffic rules for the Codefresh Runtime. It is configured on the same Kubernetes cluster as the Codefresh Runtime. Alternatively, if implemented and supported, you can use the Gateway API instead of an ingress controller. See [Hybrid runtime requirements]({{site.baseurl}}/docs/runtime/requirements) and [Ingress controller flags]({{site.baseurl}}/docs/runtime/installation/#ingress-controller-flags). #### Gateway API -In hybrid runtime environments, the Gateway API can be used to implement the ingress traffic rules for the Codefresh Runtime. It is configured on the same Kubernetes cluster as the Codefresh Runtime. +In hybrid runtime environments, the Gateway API implements rules to route traffic to the Codefresh Runtime. It is configured on the same Kubernetes cluster as the Codefresh Runtime. The Gateway API is an open source project managed by the SIG-NETWORK community, currently in beta. The Gateway API aims to "evolve Kubernetes service networking through expressive, extensible, and role-oriented interfaces that are implemented by many vendors and have broad industry support". Codefresh is fully compatible with the current version of the Gatway API, and is vendor-agnostic, supporting different implementations and integrations. diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index f5a2b83f9..309b2e379 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -98,13 +98,13 @@ For both CLI wizard and Silent install: Required. The name of the gateway for runtime installation. -* CLI wizard and Silent install: Specify the gateway name through the `--gateway-name` flag. +* Silent install: Specify the gateway name through the `--gateway-name` flag. **Gateway namespace** Required. The namespace with the **Gateway name**. -* CLI wizard and Silent install: Specify the namespace through the `--gateway-namespace` flag. +* Silent install: Specify the namespace through the `--gateway-namespace` flag. **Ingress host** Required. From 8132858da4e10e07f6284c81ddbcd61c3271c2bd Mon Sep 17 00:00:00 2001 From: NimRegev Date: Mon, 29 Aug 2022 14:51:25 +0300 Subject: [PATCH 22/23] Update installation.md --- _docs/runtime/installation.md | 1 - 1 file changed, 1 deletion(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index 309b2e379..1e2729095 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -207,7 +207,6 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr * [NGINX Enterprise ingress controller: Patch certificate secret]({{site.baseurl}}/docs/runtime/requirements/#patch-certificate-secret) 1. If you bypassed installing ingress resources with the `--skip-ingress` flag for ingress controllers not in the supported list, create and register Git integrations using these commands: `cf integration git add default --runtime --api-url ` - `cf integration git register default --runtime --token ` From 29f980cd69cc2d430858949c26a5c8a69d8bba4f Mon Sep 17 00:00:00 2001 From: NimRegev Date: Tue, 30 Aug 2022 09:56:41 +0300 Subject: [PATCH 23/23] Update installation.md Fixed line breaks --- _docs/runtime/installation.md | 68 ++++------------------------------- 1 file changed, 6 insertions(+), 62 deletions(-) diff --git a/_docs/runtime/installation.md b/_docs/runtime/installation.md index a225254c7..b07d70f84 100644 --- a/_docs/runtime/installation.md +++ b/_docs/runtime/installation.md @@ -21,11 +21,6 @@ There are two parts to installing a hybrid runtime: See also [Codefresh architecture]({{site.baseurl}}/docs/getting-started/architecture). - -{::nomarkdown} -
      -{:/} - ### Hybrid runtime installation flags This section describes the required and optional flags to install a hybrid runtime. For documentation purposes, the flags are grouped into: @@ -33,10 +28,6 @@ For documentation purposes, the flags are grouped into: * Ingress controller flags, relating to ingress controller requirements * Git repository flags, relating to Git provider requirements -{::nomarkdown} -
      -{:/} - #### Runtime flags @@ -48,10 +39,8 @@ The runtime name must start with a lower-case character, and can include up to 6 **Namespace resource labels** Optional. - The label of the namespace resource to which you are installing the hybrid runtime. Labels are required to identify the networks that need access during installation, as is the case when using services meshes such as Istio for example. For Gateway APIs, use the namespace label if defined to reference the runtine in the `allowedRoutes.namespaces`. - * CLI wizard and Silent install: Add the `--namespace-labels` flag, and define the labels in `key=value` format. Separate multiple labels with `commas`. **Kube context** @@ -65,12 +54,6 @@ The cluster defined as the default for `kubectl`. If you have more than one Kube The Git repository per runtime account with shared configuration manifests. * CLI wizard and Silent install: Add the `--shared-config-repo` flag and define the path to the shared repo. - -{::nomarkdown} -
      -{:/} - - #### Ingress controller flags **Skip ingress** @@ -79,7 +62,7 @@ For unsupported ingress controllers, bypass installing ingress resources with th In this case, after completing the installation, manually configure the cluster's routing service, and create and register Git integrations. See the last step in [Install the hybrid runtime](#install-the-hybrid-runtime). **Ingress class** -Required. +Required if you have more than one ingress class configured on your cluster. * CLI wizard: Select the ingress class for runtime installation from the list displayed. * Silent install: Explicitly specify the ingress class through the `--ingress-class` flag. Otherwise, runtime installation fails. @@ -108,7 +91,6 @@ For both CLI wizard and Silent install: * For existing installations, commit changes to the installation repository by modifying the `app-proxy ingress` and `.yaml` See [(Optional) Internal ingress host configuration for existing hybrid runtimes](#optional-internal-ingress-host-configuration-for-existing-hybrid-runtimes). - #### Gateway API flags @@ -118,24 +100,21 @@ The name of the gateway for runtime installation. * Silent install: Specify the gateway name through the `--gateway-name` flag. -**Gateway namespace** -Required. +**Gateway namespace** + +Required. + The namespace with the **Gateway name**. * Silent install: Specify the namespace through the `--gateway-namespace` flag. **Ingress host** -Required. +Required. The IP address or host name of the gateway. * CLI wizard and Silent install: Specify the gateway host through the `--ingress-host` flag. -{::nomarkdown} -
      -{:/} - - #### Git repository flags **Repository URLs** @@ -152,7 +131,6 @@ The Git token authenticating access to the GitHub installation repository. - -{::nomarkdown} -
      -{:/} - - #### Codefresh resource flags **Codefresh demo resources** Optional. @@ -200,25 +172,11 @@ Install demo pipelines to use as a starting point to create your own pipelines. **Insecure flag** For _on-premises installations_, if the Ingress controller does not have a valid SSL certificate, to continue with the installation, add the `--insecure` flag to the installation command. - -{::nomarkdown} -
      -{:/} -{::nomarkdown} -
      -{:/} - ### Install the Codefresh CLI Install the Codefresh CLI using the option that best suits you: `curl`, `brew`, or standard download. If you are not sure which OS to select for `curl`, simply select one, and Codefresh automatically identifies and selects the right OS for CLI installation. - -{::nomarkdown} -

      -{:/} - - ### Install the hybrid runtime **Before you begin** @@ -234,10 +192,6 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr * [Traefik ingress configuration]({{site.baseurl}}/docs/runtime/requirements/#traefik-ingress-configuration) -{::nomarkdown} -
      -{:/} - **How to** 1. Do one of the following: @@ -258,12 +212,6 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr `cf integration git register default --runtime --token ` - -{::nomarkdown} -
      -{:/} - - ### Hybrid runtime components **Git repositories** @@ -290,10 +238,6 @@ If you are not sure which OS to select for `curl`, simply select one, and Codefr Once the hybrid runtime is successfully installed, it is provisioned on the Kubernetes cluster, and displayed in the **Runtimes** page. -{::nomarkdown} -
      -{:/} - ### (Optional) Internal ingress host configuration for existing hybrid runtimes