From ff3b433f3a87dfaa08d126499a36408c6b514c96 Mon Sep 17 00:00:00 2001 From: "R.I.Pienaar" Date: Sat, 18 Sep 2010 15:14:13 +0100 Subject: [PATCH] Issue 131 - Add security overview documentation Various aspects of the mcollective security was documented --- website/_includes/overview_sidebar.html | 1 + website/changelog.textile | 1 + website/images/mcollective-aaa.png | Bin 0 -> 69828 bytes website/introduction/security.md | 151 ++++++++++++++++++++++++ 4 files changed, 153 insertions(+) create mode 100644 website/images/mcollective-aaa.png create mode 100644 website/introduction/security.md diff --git a/website/_includes/overview_sidebar.html b/website/_includes/overview_sidebar.html index ac8522f3..a0b16290 100644 --- a/website/_includes/overview_sidebar.html +++ b/website/_includes/overview_sidebar.html @@ -4,5 +4,6 @@

Introduction

  • Screencasts
  • EC2 Demo
  • Terminology
  • +
  • Security Overview
  • diff --git a/website/changelog.textile b/website/changelog.textile index 3e0ce634..55933675 100644 --- a/website/changelog.textile +++ b/website/changelog.textile @@ -7,6 +7,7 @@ h2. Changelog h3. Version 0.4.x |_. Date|_. Description|_. Ticket| +|2010/09/18|Write a overview document detailing security of the collective|131| |2010/09/18|Add MCollective.version, set it during packaging and include it in the rpcutil agent|134| |2010/09/13|mc-inventory now use SimpleRPC and the rpcutil agent and display server stats|133| |2010/09/13|Make the path to the rpc-help.erb configurable and set sane default|130| diff --git a/website/images/mcollective-aaa.png b/website/images/mcollective-aaa.png new file mode 100644 index 0000000000000000000000000000000000000000..35475abdf75dd418d90879f9574a30a3cf9bd0aa GIT binary patch literal 69828 zcmagFRa9I}v^5HZ1b267+}&LpmmtC2-JRg>?(QDk3GVJ5+(~eUOUQT5`QPqC4@URy zu3EeHT&w1ss|b~s6^Dbyh6Vuvfs+7=D1v~1PJw`c(LsKB{{(?n?HU9GL&Z#3SYAR{ zm{8u{#@Ni#2n56xbY9Iw32n6Yd^xs$nA6&R0*ho&MmFv<8|MM8s5FV7Ju*0|pu9Z1 zpgg#UyaG5HLoOjPArMjCuLtMa_1x>E^X~VHTiwF7=T~JdEoSA}b>&YWqfCq}EQo?| z0`j(o&56Ej8ynq7(Oz&2KKN7J#T?TBVx`fZ9`NVt!6qmWJf`e$g5yV>{#TPPk;SS3 z5Fjz1$DHpX{y_R&=ztK`^9uC>Kn1LOucuRn9ZvOvGruYBRJdobkcnU=93F|dkyo&X99oV7{60Q4&7aChRS6!{HkSPKEwd(Y@Q8Ee!Xm6b^c=hH& zNO%_RYdC->oh!0aBA|L1cn!5*MxZm%&YEZcH$Lv zgaKO-L4qAGtJBw{b27h-f_VDbA+71St zeIaOYZYEQ@#Cv-UUZ;;Bc=VowWdjB|cJb6PwvJu4bqro(Ip*$0u}j5DMN0|3TM9wt z7|LH#SS4Uf;uXUFp%6o*Mid{;O^{cofJ>kn`}*ba7ocMKAUZPm(cju#JUO7Rbm_5Y zt=Gimt@m?dSHa6`%NqiW&*qT*;3WYJNXT_qVAm%QMlq3464rHogdFSEY<2DTu~qbX_xfaZ#1}# z1fZ@0CrD`cFB$~LfBe1}`anm?qyL0*^+kNnGV%eF|C}a(fC=iL`w7|$hUR~4(e|BB$F<;V}FP*-;kbX6Y@Ol2< z2cFP}9xDOypJV7Lh$QnW>!kve}7=bA+4M;-N z0Q!)KGZDAMZUadR;Ae1;LaxPv0P(R{L&Sz~mt3_loB^Iu8Dew*7kNxnJm_fT;GH={ zC)7P(XkpU)T6v=qcO`CfkQ-c9e|6!rd^=O;dJ6T=G6JjlUQ>*Rvxmfvc&%_=1iVpM z!ryy!86q$RBZvnOcYH1eNpx!&Fc`*Dw8t=w(dz>H_0?+fzOhztCWS=yWep_hr`Ndr zn5=PFvO=~;rbEU;_Cgkq(~UzR5hYQTa0h0^j>VtGD#l;Nm&K&TyT=X0?#E~opAmaW za*4N!iwTnfi^PnD_vMl#RfL=~Px+QLYT@kd?eXo6?4|7aFL!oHcWHMKhD?TBC`>6u zC>$v=DDx;L6f|=W3tdHj`1Wpr+oo}dYm%JfR)M-8+`%`=NQhGkO5|J@NaxZNTNZnY zwFrqy_RAHD?g^pEDT~ZY-Xxf(rX{HRs0XJ3Go`g;y~5q&+{1&S#L@;b$U?}%_o>E( z(>|-yRDx9ESCXGetf;Se)YmxzxwN_PxDZ-dTBRKCj`j~3ul=sU-M>FdKU!P^t}S5e zVeMfXVSm8x!Mb1;VZ}y(MSu?o4B!r=N1#NsN#jbZOKVFXNiU{mF?yL88!Q;!>QCre z8{?a77CI<@D*qtCVeYq&5!r~>bCDA3-BoPv(M^;8CN175{lu(t3m95Jv%EHRO zlxQn!aS*%qoeUKM>dbk}MHTjdQaIy9kc;^G!S$E zM-GJxjv(|&ZyY#HF>LxXrDtiSdF`x)Q5Ptwt@FlYuA&8p4SZilX@9yD&|?&z*`?xk*fZsQ*1ZU=7k_azUzPc)C_ z_vjCFPe=EO50y_ikE##f5f~7fk!=x8F_v&ekay7?sZ-cE2we#Sm`T_SX_Q#59SdPx)x8hS$1u4c60dbA?n_L2a|=7rEIREUAyhM0(f(vE(-!|WmJx<%$S4R^cqX&@@Cnb`wRVR7uCw)3e!sNZS!pd{ASdVZ1BVn4Y8)jHl?Do;Vl2Q3zsH$VUOe|&qw1Yt*6bkx~@C@pZ2=Dofj_<{*V55 zLG?lBeDWT)Pq`z#8qo>(PO#LlP5epU*KS2#C00XvfKOlhi!<{_^0f@a2i&vFcuqX3 zo;=@^y#G)0^8HfZbZBz?MEop0uMS;1v}eOB*W=Ab`i{-C4RcXRaoEO>u5vf}=T0|u zy~l}&^RXR-1%iz+_c1!Ji2Hkk^Ih__;ykyihoH}?fve$<;rZE_e3P_+bZ4~LuR>Ra z`l6rNkBOMcWoXat(eTb_D@4$_geMUN@#0aw7IRHZxKiZnU(nl#+C)(OmjsV>N_;+^D2-P z_UwMNeNjEJEq%OPL(6r43$jrC%^t-*uJbfKHkaqxd$ZrNkjrM-<|ZzBpq^~lG;CGP z9m;!fu6YuG%B#z$4sA#l?)sUowNVvo?>LH%&4w8P3AD6VD|t%T4@Vwtt%5 zmUD#y5c6QnBAPZ7B3&C{$otb)3p2-Eh;=l&q!J`_E8*eL;qW z39)lYjtvp1V^OC@oYXB=4^*Fp1C{&rNo5K@?`fhLC7R9Gi5o_>D@uLEP|cn$nTDO6 znKqu&p23=`oC{xUVwPtyWLyKZvmdi}>c?4OTkRWL>*rchn)Vw;Hf;P*9a=aNuf%;;t5G9KN6?kc3*%?7@qOEj*u z)MTuzUGPYE3i;aTsZHBnxKqlcO1H>}o(7JLbeG+jS7C>*d`)hpx9Psnn~!m9sJbwl zy>&V_-bpIKQD!G-@V3~oU_XKUP18BQ&gzBZBwiD2yV!MSxw-ec;ZgmCZ!?=91JC{K z*G=z*IG|TJ+9TUBYR%Q%>3U}A#zc71MB7sC7uf}Up>}B(o4dnxpKjvrl?m&yye~CKfT= z^-+IBD~O`=Ipk?gEntzaFxWyw{0!5tiPT8lkORplG8CgF1J$#{vQz?PgEum|vtoyK zCvhRg1wn9P*OP>!zea?IS$yUn(&|PTDerj-qK_l!)gdONnxZwOx|gL8!Gt^r`x8#+f*8J9IsgC8SeQRH(|e0*3UIR@MS~zbUA8Cc~zVXldG1qisOb81NX{_b6awU z>$h|8x9zO$tuwQ2(w*^buV2gu+_00x{h$)Q_<{kt%ZOF-nuoGWgMVT}Zig;Qb`K30 z%YMNAptg(Nu_3J|+W?wNSj!x7dGk9x_X(}MQtr=Qnp8{%6`Gi64xbLYC-Hh%vmR)i zpFec8XFgZ@-SlMlBa`;cJlDQnHo%-F1}Sf0P?rUpcWQ69T7FgaG%E8wD6`pVD5_pW zOGD9cx5?9pd>ye$Km2ui-9A6nV6Sm3YbtlOPVYthvTRx^r?4vRpXEGL9JS_1wqOIGfA1SB_)DG z?d9C%{exX0Y=}r-@MT#LNgjR<{NVc)B#jWFwgnhci>)zxU>{*&EZvahuGX$<0>cQN za%h^6L*Du{FQ)aF+8Ecu=cfP>|AI)RjC%Zu$m8Mu;WkQXiXyw%go1=bB}FB#xum(@ zW?*KGW^&UCvx(DJvrSBg3=zzajG#q|#%}uWIZ;}^wX|N) ztx=qx@I?K|dV|*i@8WpN6Y$sdi3yl0v#kTxl%yQ`eXDE^2e0d69=4?PV^MLJ-;bz> z#m!#}dQK4v*N;-HsSORQp;C9+2PUg`y88q*zRRMtg&gN%*>G$B4bqqJFK9tV0s8qu zJD%~HvzB$RSIp?eG+!&nDmW__Ex$x-*UK~lR&cn6xS_f1xax2Xob{ag+n|sO*OYnu zc&a@rAA$E@?&lx7VEevEK&%Fd1n&oH!4QPFqP5^wBFAGr5orT**`Sg$;x2hvFZ=G| zC5jnM>}S=O&1(~Ciyf#Y$@hv;*-(EcJScgV<#je|)H#|pS~q$h9iOv~7;oV`R`OZJ z;^j6Gx5=$hcCBtUaT4-k-szgA+=SlEKK@9=ph8ij=kFkrZjinDUXr$xfuLroo~ABX z@xu#k1@(!neY|e;+25St%Hma^2MxmgCtSfVY=2fw2uYBGEo>orSEx=Q)EL5oPpaT? zxzHsz?w?*nY>6CyxsgFkhu-@Xh?Eie$IcH)pt6pDCx*KF6$x|a+86{d8hxWWRYQiA z;L4y(jt`Bwi6J0;lU4AY9kf!^&b2QzF3!p;ErcsTDfW>0o+KEnm-Qnh^yjsIOJIL^ zVy08Z8BZG)1m_@N0+tSi2kn*9g)$nan&CH@4*eS^D25;<5ppip)+%v-9+Lk4wmz~U zGEAJmqSH*Vk*87QUcnwG>JXYUT5>{B!l2T5xidjask3s2SiVr*H)^>yfnue*JZ=A1 z9or;kp%fAgXfM#Q!Hb_+;hjb;dvJhr4sd4L(Qz&u+ArP&uEufq z2>+ZNpdN3VKgcKW@A4Lq{*{7#L_j~58it%yplOI;T+V0?n94O3`{w?yj{X(+8@>|1nH4{!t`sg40JmV+bMWgDw z;$N>1ID9$?XEj6kxQ!7{B>2AQBY7xCxr%lutp{`|1Yr5(H2P^N5@h zlWvubi|%@$vX4MGp}ZAeGNwFtgNZ}1QF0CiL0Fm3^vufGC|^hUgq>8 zwoL8TyT4GqD*if>y>RPTg+AgxTu)wkL z@Fss$@myS7^>yLfggewai^lRfKY+F4Gj%KAem<6%`RY4eJgKi;6TO*Q@6mG4wLQMC z^r!8}EIt*duAV@6KWN_!y#j-o--W*8Th_y+_uiIyuli~0%Hzc1D2@tFdAdnsb0c=w zu;;f8}@Q^Sa;Uzq`2Q`AfL2zXvo` zjBOo*5<*)wKi{AK(iH{)vBU@A-@0Ea=j6DDTBMKt!ymKpbMuWFK9KPb_E!bBkS|WM z`26j!PZv7fT2Vt+C<9OLMmv-(P|X1Z1P0~r3lt zOz~CZ78X$~?)O9HZc959`|$Xs2aBEfPkq?u9;n2J~) zWYORycf@#2apW;m8mA+VIK<4(&MsCILuFO>~Mpt_j?cAnUXtjzvW1K89XJn}1B8!(>6 z3PTdc64t1Q592y%S*KG;wdGI?q#=vqlLWWIoOMGjuZ5A0$ifFWYc zkdwvbN@Q<({>f6QJx**?0RO^s6N}5z>|mSbu}OKk;I)&#VdOk+uov()(mG$>OH91F z(lfH=NGb$b^^SIg=8)V}zC{2xMN{%A5&VkakL1q@CDH|lw!_X%1y|=q4IZu` z_og~ynPQ*Rp?Pa@Xxvo`fSX6Lx!A959}4!Q{M0*iRF)wydo%3X@-IgRATdLQ^u-EN z)E*v`lPZ3NWe-K2jka?~HVaSSeoy^&ct-E7E$jVf``*r}+C=4qO)n*dXG$!~cp$p@ zOfyrU3GX(m?gIs8;XZKb*r91GAuMV0xt7XSYdtpKFdQbRP3a#V(AYh8n^?FaKU3H3 zvc^|LWg7IEJrq*ADISKgmMamw{kIlV^+*iFfkP3}SI#&TqA>eXDi;eTo9G)ZX*`ZP zs-LYCuxvklCoB&b;CHHO_daQ}1EpPWm#}|2MIG(Eto`{c+k_IT3D!`&Q}kbD zO@tH~rZzcv#ja}g%GukMFb~8ju*9nbUJTqjP=p`OmABkAN2?q2$q;OmD%3RxAu8`4C`+f~99p$AYRa;i9ptjlj1=!ZE zurdOQAH@$IfT!(8E`=X_R1sl-Zh#STPAtU?IX2k%VkM2+dh2NIjvQ1!wL)!WB$W!K zv%h4fg&c>>rA9sEQLOdV{x~%-PbFxjU|n7>Qve6rY;y1;c37dGz=SPzmKpM0D7!T4 z<=R5+kabaXuLDC$^F={P$B?GhLQ$ozZ-o+r4pQ&OeQ4t`iu>Ilv_(;4vGa1yA-4QBV0!j z5HN$cLJ5DdyqL^PWeW&A0s9mCr=iOUEu-9xrMM3JmR;TB*9jRKHgjb}S!|&Z8u^(3 z4wwW1jV5b67PCAec^0==dLzO!M@JorVF!z1&R>K%svkw;NkT&@XR0q$fq1VskF&HYTOJ6=n#w% zxar^t5heDI)Lp0+`(-wfAuFnB9Az55K2w+&$Y5R?5h|S&aJM-4Eg;4_Fg|fKQu(1A zs>C$=|Ca)&pd|9BeL=MjW<>1Iw!!z9tquL6Y<*I$J%T}EQEW=#W{Tv_SL8A*7a0PA zQ;GlmYJdpDS1<)pS1Hvo1j?7G%j_<&mWdtT7kOeR>5qbycdAg9?iR9Xy=e3LKc=Be z4K5Ac7w}7dX&RA0k$eVFVCIk=L(yjeokvQy#VE7FG8=*t??{c(SQsx`gks9Y3r8RR zuXuzB7%A3mB9azhkjiQp1`upXi%ZOrr~+iK@*h(LvJ$@DHHz^e+1l;>E1JI`m3(~^ zzL12jlgM}*G;QAJ63Kl<%s(nAFmnc|!(^WqN#z{92DE#AKyMBO3rbkAAEL29u#AaeAd*Iljy=VV6 zR#5PTN)3#mt2ik-i8P*A?PBRv54;bwnD#){%$$|e8y zzH4K$T&gLE`PS-KDxJZ>SlS#(8HZwO;GU+9@qvsoK_8-pt4V%-U?%J)S-wieH=><^ z$nqLd(o{!mVO;X5fj_7n@E;+N`23vozGXg|%Jt9iIB$Up*x&-{>E*_ofTL%BiuBo1 z`L~@?gURtd6hz>0v(aFuv6v|;&TH12DlGj@RoWH99EPe#;!~=Q`&f`fB!Nqw{S7*t0Fj2MX|UP%wRJpL6S<)g6 zB6?G)bT%I^>=~1#1u|s;DrvP+^5hI#ZC@W8UPC;+wOHCSTkYWZh?(>Ai3X?d0((zZ z=RZ7$2q-ATR;ag>2@OA99|6YG*%7QOHJZ?Gz4DHwYRjb)#8RAD(_#--L}3a|ADEU4 z_ROYB>*`O}MAOV32&F>sWw2y|g%%B3XuZhgg?nT^ZYm8CjMx3Tgm7HphSg#rKu;qi zWJ^#6Nl6>k>Xkqqa>m!Ur`o(Z>Jf5aZq33uX|5;2bi3X`a z5zr3p8~?0lhGm9rS8E&U;J!$wK}N9oNUg?Z*Pd`_GtOfzYhg^?&Bv?L>3L4M{BU|z zkc~`fwzs#ZjOk5g?-lz_``5&GqW)!tH8^1{sT4XykD$Hq!I38gNq~Mx@|NZh`8>D? z{yP(nVcl)9KgY%L=oi&1L8q)EQ_d?7kTUd_{(dc2Yrc@obYHyK2TXWWApcrg_36l3 zV%^?u_FoywnFfHE85t4%phViOg)CNLol#f8Y^0^6RPm6N47Md=14F+&PWmbIT!AAhEcVVGZT-CA(?n`3L;eNP%=Vs{*xy zi5YW;(Ql&7_kQ0v;~K`iU$K_k zbAewnxT#`F#y3}{SlrSzYTZP3IDN&YZQDLDBLfZ^VmCVzSxaT{HD>HSQUo&8`S->< z_=M~cWy^pNl!#Vwjl(SUvpBpGcWpjeN$qsOHm${r+y@oepY+HHKh``X8B0UAr|nZo#7k9O7#Zh zTTkn*m)ouD+(N13FFn3%@?KB3GNJFR6e|?Vjo8cks@o$?Y972}HlJX4>V+$~R_XpL zheFos8wurVDfWc|l*?ak&h-LW)34B|%96M%5k==KX6sV^Z&^Nrsw|zio>cjAtTtGX zUmZ*$c<`6LjU-YVZS@3#hAG9$I^Hjk$dmLH5_FOm?iu1CJY}>~8Dl$Kl_h}G&Dji- zqxc1k2Kz|lifvz9N(@wn#gWD*4F0E`hfu*=9gmR1M%oEI$hlAah)LMe>HAQ)XEdl1 zVlfQAl=c@)Rd-3!JmgVcHhD!Q7w+Xca62cKv9&T_sB@S!S}wV~$+O?KtxPdG<PE0gCP z$VLKmG)bo{#7X5x;;8n()2K*z@jeD+f&>k+U2U?_u?kg_Pk`=W z1PkPdoRS8sYy>$@O;>eZ$KJZU9_r+wjCsE8-8)R)j9Wy&(IyQ=x1k#i_Z&)QVu;9) zd>>Gfg_ri6fnj;)l6H^LILxf<$So;@z20RjCgBaw^Ur z)6adZeVl~4mi7fJBc`1lkGo~uR6Z43NbWFcm2}bst2x1FI z(aoU44R6ZIjQNDojow*s&ws)JD^yHqVfYwao&27s_5&oTp&-<{<=8!}JqD~*v}}^1 zw6t0wu-sfWO}>itx}An-gMb0+nUj#M+82f1y_)oJ!}wh(O9ks`jLY%e`$DS!M?p+I zM@`(Md05G84k&8$@wEQ~A*8PoqKr{L2Vh{iz{ zszxl1OqUX=>Cv)yE!8>;3S2x@n^aDz(9G-y)(HI(b-$rQp)l3uYNX@zA-Dv&#V#C| zMKD-Vq--XMM`aCb)UFZ^XI+LGmKv%n$Ryhh!o}I)xy1Tqwn=p2uWGP7IZ$Tw+ghWA z)e`(CJbvWeQYlIdEkm&orSQajgc^weiZjB(tlq1HXu`rrd1EP1}1k@iOnexSIRt;!<>Mt<8ht;Q$PSw z-C#WDkn!)>!@5GQF}T=9eX1Ck5h+BBEDr)%h{Z=Wl|>F1YS)?Zg*OmyanH)sJsGBJ zMC+G5sO58|{fYBlPf{0rPf{9*0vZ&)c|>vmv(aSxZ)(Si1mP#(=D_CvbZQM67%;aq z1tAi-P9h5!`Yt*mHOMZUW0l3DVvO9ytXGe|7V7rT5XOqZBo)pa?YHkME>#9s;4#Rn zABIX+Ci1kXefcM6h%Dmy&I|~Z-@O=YFDh%75A7KX0BNC7t0e*IiJT`*yi>v0uz<%{g;}8KZgp5!YvAn3}JHxlMo5Xz{8-rk-yZ6+6O%Q zIhO5)d=JU@jv?~yE9Q$Kk1I|^ER)E&5zYE_0KO7aIdodr?hpm_|u z;a9aDLkg#t$D1B1%^rt&EWML5La|FfNFp}K*$|{{7Qa9qBJq)*p%P@dar}Cg@bi$U z$c6Yt50M01Tmcqta}D_Dn^1ExwjUe1FPRTWz-LAwU7%eI=KIz)?`vx-E~tr!d2V%G zfMlO8c`b$(j=;DAM$)5K9I^l9f3y+gXNhhC@+nlG zLx~R)@7;WIJf5Qjx+CHsn|e{kI}@>?K4AH72XprgPF2#<)e>p6YhP18F35LhhpV9VG`i$()K=iYO=?D=8ED-UmQ+|l& z|1{H$L{`Ek6w4#(`uPXhL=nl6E?ccI*`b@(n`OHR198h`AmXUI!r2x+7I6ny)0*)8KMq%@jBZ%NhI!86-k^c?J!Y1~al+eSwa}BBs)1 zn-JugaO7fIrk-fqqI?qbxN@Z82L+_lo5Bo%6BsqQ|0=VP?$y4ayQ!el!D~Sy6C#nK zk&Xh6mkg(2JO9@FkBS~8Kn7s2-yO0wDS{hbD5A^ux=lT8Imo*F`3Yf;Og$g|1bn50 zpjvg}BN|#rLi+wy)fQ5bo5r$zsq*M~SFd+(=Xc#r8s}dlJmv?a2!we4t!W^pO5;nO z!d+19yDSqXI(zuf)>aDji6tpo&Y!7miS>ysLMnN&KAa8lBrr{kp5^^V{tUqvhIRn4 zQ&ll?;lwu-kKclf;S%jEh^?W%@ppKXz_y<4fD0|qg&-MUFQ7F}EIAoF)0@uqMKv;{ z^pR^PI9jO2tpqzm)!(ML!T!f-eEEm4n!byZY4O*~8ckSKP3Mbf7SD|kiw~o4?*>B= zt;ob+^kKmjZ)M(0VmK{3~iK z)NQypYW(NqIkB8bWODG(Ack0~@USpHZKfB8hsnsrkg`QkMH0SDcWKEIpEugLY_u z)rcNj1v=;JkGtJ9tl*K07n|g*!o^W%B!Mu#?<(#D?opb5ey%bd45?i1hCYq{gvZ%E znX%ZtvOq}Q`A%)Wc=CIA!XY~;|7I;vt$6+km@OS(hiA%?IEUxCC&{JN^l(D4Y z%k2_g;?lvU6=t^WK9*1vFwHj0R8P;7YQyEe3&p%HWs=DBskCKgqk-A0z0rfLxXejD zxyMXLbHeTR_V%SCNiyFwEcRS3jz_9BE}sL1_XN$chWutCNo739;;}bJO^@BZIb6>q zdFv6$!%-i}^L>QnVG%)PcnbYVD%zwop;%U@*dZr**hckD>hhd`#N+LNO6_g?2svOB z?e}O7eDDa`Y|%)>Yg=ghOT)9VDb`-6ooJHgyosN5Ykl+@TZw&Hu6f4(}}-`7MRR6lpDu8@PJrgVliS##xuDpx6Csn4t42RXQ-LLa#tRlh0tAu z*kCaoLN7T!9XiZQjUyz#s@S&~iX5XP3#H39HdZL?_DfG-=EdWHe^f8i&qOJax+sO(qr&SuqFL zc#U{Z1|!PstWOUnhF3wvShnXS0(lGQ73(ogE%UU+wM(5L6lfIg*zfg49suU3Jw1VP zDf}qF93U?KIKC@qxc%vS!lEpfhcb@5Le9`b_r2!2+ zatbNE2yu7I90qK!z8F4pZw4a^DYatTK>nfjHza8#4qZ$#zX{Y7w%bk<#-a57o_*g& z+b9r?gTC#RF}2(xI&8m_Xi<~3#S%%uT8C(b;PsDcY8#)9x=k7Y;d)ai%G+I5t#nqjin-X-iF1?VB`&0jR4IjT{uZ>! zBI)i#AM$ybWsk`1c}_#WD?f?mC1>UL^g)44F#Ohj>i&3o@RQt`FtzeoPq1x%N!wow zS~1EemK;1Rhy$yt5GC`XX`1P%F}+aapc47L**BCITZlqF6rf=ZE!^4|7GFl>rVEY`Xl4q#vvSgqlyq#XcTm_~kCC^1mP|FFn? z!yu>hQXBO&08`a(SH7OkcX()kxoy?bxV@gcw@UGu%Gej{PFh6r=~z0;y+XKy1!6S> zb-DM}uAuR4H_E<1*K64dF2wUGgi&}r8+~jjyAJWrU_><=PgaC6>O?9n&h0vXgsiPs zIvn0C8HE&8fqb%ng(oWh-!lZqem+haY?e~RE$-9Ash*?sCvlc)nt0IKrB_9D+TKLK zh6To1iS$0<*Q!Q5uwOcA8X5v%wAxLLX+39v)jMi}#_=4Xc>?NJxWxZa7nBTX0ukn9DUW~Th0nMQ@av-N(n~p zyXeExMgF(-X~md00>zSO>aPB`NP&W$)JKSX@;&Z}{aoFlbknXnNHFrF`Ze2;KEzor zkm=+>XJoa@Jy+=QHsA1yOf9Fkr6cND#WK1CZeAhCO0?kf=g)rU>uoMmydJj+=&gst zLk`!6(<*^tHrSyv=n=qPaoKm<O z1*B5&MV)#R)YaLpFWY5bJ=&`BUTR4j!WLOrLa@Vo7f~I6ct%4ccU?QlA3t+U;)|bI z_?6SmdU;%tkUQ&=8jFX<8%fep^kBx$ptpzQvWAHJvMGw&d+gCks|W&|MzdLdjpPIDmNwQ4MP59 zZU2PjY8`&Jn|al}L{;tBhpU6p_lHfMFBWMY!&LBbyNEQM@u)-3719h0=rJ=V2oU4Qh-kdW1GL6|Wn�yDB(-cw4U4JsU zcn-yRJ(W~9+-M9PPlekh0|d9ThQ-~Z;_RgNMv|I!^VSzE4%?hH$5|P>cePY}7~?)M z@zStu)Q64W`=I(PKOjc~m{wW$kfd&IJj6+L-9a!MsHikZIQ~<4eF{)(y=?4MR<76C zd~kpKD-wo~eA@F?fR6qfn<+Ket_`?Pz3ZcX7~WLbk)d6>0U$s;u^Gz@c1j3l<#!&L z@Ra@bT&(FZ&YDZpwCUZ3>oCShwDK+xaQ5{HJpXiy#F;7Sz1vJ0NL@b+_Up|6q-}6< zr#_@?b>ZOtnWpw}68$-CCn44+4&Q}{ z*xUx;SG|Zo;8xW)$l%Bm z%<#axuBXL)Il5jSEm|J-)Ax4c<)WPCx}Mg58^&6%V=)^`FXgKTTQc!c^$kP7kqNIY z)dk^_6fzf;8n$RFc}G+y$s{M*s0wFb!*Dw9RJBP7CRc%)aJvm%N}<`QgL*+O{&NbB zKZ8QTGBG2Mn^(Fx9}-6&&)qIY$JRygz!Z;a4C2u+pTb^K5gRv9h3pAxixu4PdOp2B z!4bPbJo3$_jl113=E(%J*`m+y|7F;DIYQlwOF?a$o(Bfwn7~8C&Jv8vVlk_-K)_pT zekl!7A6H>Xxscdo{|Cu8B{Cy_*K7|+*b?CPel80<9^%~-@m(R*EijtVnX??oP-P7d zxunMjh-Wi>8=;>=rd*N;>ZnLRaQgI;DyN0lgjon=Z97K?#3|x?NgS z0mSrQ71~-zEto_+x<6wKc|VZsgb7}8$_FsK!@fMu@0f+F|XGe zNp&E$h0{Dv3@gr6`6nETPbZOM66ES9azQn<+I&~@*o8DJ^{|e;oQ^4ut=~&GhjKi5 zKM0s{e*7WL6(PSJm}ROmAP~@zR!78EaFpA@{N|RxZ>7JeI5d=MbxzK(UJcX}8YRC# zMTTi{JW_lZxA6u<^WLUtx^4ybmH-HoZ54`|;hD>f0rtPQ_ zIyI*ko3|oMRN!vSK@PL_<@su|&||HPjWIjF4(HqUg~mOt87P*irp^~iX?RR+Ddx-+k2@(RaZo5RWs)sczFb6q zPgu2XlM#!+BtjvRj@jt&P%X)S1Hyv#62v!x^05ZwBhk0+t3Vx6QD)AZ0pZ@~NV1}%~44d5oB_L8Vdx7ml z9pnG;G#iC{CgLWbXSsOdv18y5cf(d1l1VpTI_tfkoQ5?zB<&^3IJc{Lg7qO4FrsO2 z>_c{M)?0cqFfz&9a)&W8OY#8UZ=oBw>xk++x+ghlVxcQE(Zk#&;bO7P-HZI zR@!U$a+m=;r! zlJK}yVmN@w*V7B#WRiLG9oKQs&jukC}JO$kZr8o2vjrb z`z`njMn{YAaLbV7KMO?>xMwW}X>+0L&k`syJdRY#{zw#rqAbMbdp&gx z!Q%h{GlC1q1Y5Dj+bzSQhk0^0#aDO0)JVXvjRP|?G@Da3|5xYb%$d1nuD#d#u07id z1WL!G1j+yo0YCV(pspWc^zcJ$^d-w(vUqdKet0hfR0ksFmrOb|vl--XDC{yg54l>j zjh3CFm(C5YMNV;qjQN?!_2oOog;ESpF9@BLrv$>1Vp|u`&jb&M1tr7@1xLQN&k}3p z{kr5dxC;BE`6f*%4J}P5g!K#+1^6!pI038cnAb79)r1iw!}VSW3-Z}Nlx(}M#kpS2 z8jW(?*|OJ8F(JH4Qls8VZ2n-l--~BAp|kZ?cWby?aW3*d#vE``zLXG2es_{Paz-hsp`TeKClA_d2PjIusO?BF>ato76jDE8LL%)5Ae8l() zDF#rm*ggL}AaNScc%36^hU>|WK;06`!wq|BxkmiEu>k+d`kc#PwUGm|xg{{7mpZrp z*c``{(wePnNTxUg4YJsfsCvNp(dZQ=D7Dot*7o_9JO);sxH06@)yiKXAN|B8YxLjWh~h zuelGdM!yX=F{NXS$dXQ%5dtc+CyBC0dE(?yp;6&^B}9_cuTiH18OG6nBkyEG&z%~W zUk6n*Ju@X;^=g`y*2dg=uSUQQX}U)GB=;=UFw~n4Q8Kyfd}3gI!x;*U2(fBGQbFBha$-*S+w_og5C&H3!+>x% z{XSP>U~Po0#6t3M)9W&2&90ZvTFf9p@p7~KTfpW3z?zfBvju34_+yhRgc|<&=-#Fw z??;rvj1DK%^{q$fxJYYw3kVz3Ba?~8ggYNcm866^>&}<`pKjPNY&8DM0cZfDToQA0OwTEG8kU>bqT8uPBztP?{-nbNxrPHlD(OWzxwpY& zVk`c2F%;AbI$wFE_cdZJC)H3CIJ?JH2E3hbCfjwm@)*8AA9oX_|0?{$^>RN=Kh@`c zrBs+u2v0p$(1#@cdjPmh>Arb14U}-G)%|R?I2R`qQPUw8LNkkGe!nFy^Wnq*!x-k{ zk?3Z0{!2L^t8~^LX8GlpaYRH`Mw41o2*^18)3_uQECSDVw5qWG4U?%IT}c9Q`md3_ zjbW(IDxug0vTwlMO#^HJy;Y!ESKz%C{o%@ZVz<5S40VDVPy~}KJX=>?Kc|Eh!0>wI zLp{s0W~rQ0gF{N0&7~1k9gnQACBdJCCm>!vZA0gNZgTwAeHj)z1d}X3toOsuW5?*Q z<}S+LQS z;JPNGaJJPN(EW4uREty&_u7k_5i-BzLcF7+@Gv4oiRvp)N-aIOL}t+NruV&!m-%hrLGV%Y-`_3|fm5^XO1kwW_eP6>z4(2+Y}ub}c6r>sE_V;#|6%Ro zmr@`CTm133YM3*?im1upX!ev`ZHbCE)BHoHy5ZA zWQZ4kHgJaJCOc2-`z7H z+n8T{PNr7bd)$pn`=-FFB+qlsmce0@ne8}E%^cATnfg9}3Zy0GGX*^&BJi~lfrf^v#aa%-~oNa&4sO`dvZD2(!?#7Ks)KM`%1@-}gX~3EoLzTcIe&xUH zy6rzwp(nb_j}`1DRkVUE7F`TjjzY}1E@TbX&iwsqR;EVp)@H5M-4F;Ry_pQ6cBZ=9 zgyRhgMy=y8vmq>G9dkM{LLNIi%q!pMIh33}OUre=%wf5^4htfKV@`5aMT>#5b6y0r z9GKFt=RkW3?)Cc+%m&(Kj~@=&s8nQ`3%tFHzvtPYr2{o> z)wMqSUN_^jvUV!N#yP>@)%i3ZtCYVZP_#fdB+o27+JmCzO@o+c}`oNhzu zX3_Ds$<5{4H7@V8BMH~?}wOTvX%?A!H zD@fFW(ZUhZ%=k;s{Cn^D{`7fonDy(`R-)R4I@iW4>qS~pEw8F^qlqrj%ZEwDS+`-} z>v>rt8ADn{a@Lw#ng&6t-+t3uE2-iZjD~jDyey|EMY5v&+%vCRn7LSuFz|$O!<+-3T8i_?5xo|)UOe$rE<77n) zpr=a}9Run2Ezh>EY9>3M60h7IN_R1kSM~dlT~A8iWj0m~#KKu<6GV*M$HxkupfK$i zHVqXi98jtIvIzaS0?{4eV4+S>4Q5CjbgK^Dv(`?G8{LR zv6f?_eJPLJskjoM?U3tup&aCVqS^AtcFJsbS3xtmw8dfQhA6;MlTCDL8!lTlxDapg zeIlr|xDUJeKOdXHz#RYLfcLC!0NjwRM>v zUS#Y2*G8nhEiI0QsK+8;9US~A9`7<+d~zF|vt_=E!#zVQ0ar#Ff*4G)5SV#Sq;RPI7*;-vkYowQor@mavJXdKKNTd#uG7zU_%68{7)~duFTSNvh%mW2j~1 zknvcnWQvp4HX!y&w|x+oFyD#<4g>~f)e z%~kozpPi!wZky!YNXufWu^yra{BK?vd`=VbcJkRo)<;mw2m*>i?WI@2+FY5(dM?2 zE`Y=bKu{?Mp*;#co?ts&uX0lz z6EWM6MH&X3g0j{!u-w)Q{uRtj@ zKl%+aXtMA&4}o3@>Uo&?B1N$4 zJ`5WhZa zaZ(iJB18O%CAEWt$s$8}9R_B|6u@M;E)>{-&6unMsC7VDfw9B3QRRZG$+;tH@!p>| zaAnn?7UI3+{qn=2lGe-OFqPkx%|tK*+joAKa1%J;Zcb}4uID2Vuzz?Ct|m?M0xu-R zN*YEMMh>_@RK90RZ2q_m&Rj~Up6r< zW;Pf}95OE@J{)VdUYf-(scYTOOAS7g&HnIXjjEV)^gK6M7S$?vMVN2qMH@+ktK-U1 zdsg_#aqAKU9%PeFNZ2f*|AjNKnSKdY&t1bD$9!^Hsmdkbb+-q9*}u;weEkdUxTtAH zo+Dl&UiB^DhU8WlL?qAs?fZo}H?E#HHx>paprJSwNtR=zvcZ^h+U5WRBvoeJU< zeuMq;Pasy13$n?K|D9>JNye(u`;1vjxk(pU)A66A#lv(~Vzmu_DVgiDP0Ejkp-NHp z4F;ZnR2BtfvfLau!p~ipdlGA{57py?mfQ92*M{wnJ5l>!8O9V5~ap&BAj}sVxZQbvH9=^CfrS@F#&{xutz?lJcN#ns17Or1&Uh(}`G3C*x(w{!kfY z;?JF>FdsYtyi4zR?-ZYkY;Hlbie!uunz%ZVqBfqyi#Ym;h0d+lCE3tKs&rIw6!2I# zPtbyQpKi3J>xZ?sinEN54PfcnY#}U$n>uoAILQ))0gm=4Mnj!UH~DL z?&JNTcmMt65_1zD*bFsQSt$w5|NUQpXM4WPSh@!gtTTQ%7_ungs%0mml(|H9ElZ}( zV&+Ukk+6Z;<`kRS#N!u*)ZXRXUn^8l=B~B}2Ka*TC{yJlJ%w|fBk`(oq{d;uqhMK5 zxD!L$`8l==(~)R?0bjGsh8yjy(B(SP07Eb{_Rl7LHiO7yI!?D^9DcHEPT89Y*mMqq zA`3DcUBMA5*?&O|3~krGzL#EG@M#)z0R$d<2`pas*6rslYk{JP5i`XM?rhC%O#-o+ z#-kXpY}n0)LvYxfwmMbSlu6=75lLu}>`a9@MJvam)}t76+*&)LJl}lhgbL_uG7iEt zQ!=@nOo?XnKc1JQ{M6J^Ty;0fq4lj0Jd88{lO^ex9a!gbt3ybuP-FN6xc$z8o6Tf@ ze80#jF`t`H^AxiEWnh!_oF8))uV{1EZeVJI=Sa>Eh2VgbU>GLoFp_6)F4M{2uIoH2 z)_+BBQSZJtjBA(dG|fes+{$q5xjrfQ*G%9=bGa2LWDhCSezmXy9%%qWF_d&eS31?H zX!YFS6gT$S;4=CT1iMA5*D*s^oHd*M!e^B^+mP=K8k}eC{t& z^b-GBSi|05HQM_Tzj>*=4iSrMwT77UyGBNfCw9AVuK5)t=aq=k166=zo{!@1G*Q^1u9y z;NM9K{MZaErTF%vek_)=g<=Kxl;2vJho!gza3s5qs7}f1*P`rlSZzz_czZ#vx3%Nh zoOXIdGnF+R(y?3z=@o%C-`q}^J#LJjPAY3#q~6C&EoVkX=V0az8V>y)bG`5X@-_I5 z?b!EJHVD(v*8J6~^}Gj!wJuKmB#fMnQGa;Ggma`HKjINYAssZdnHo7}cvDw6nglHo zRt#}GlrdL%Z0AuSn?l4Ulh9(HRn+?nh$Z`l@=Xm}w^A_-qy#jx`5*s&HgNvhJi*Wz zjG6#A5%8WLZx6^67d1GHkl9#bgk#WJ4deWul47=&cNTC1!~-f`!Rqh$h}yU>OZtBJ zqe)gtK(o-cDq8(e=j@v2`&>Sm!_&HXTM>sK3oe@D+zE!_SKG;c0qakMH+Dp)sJ2r! z+Hc}v`^~w4PusqkJiz;YhY4aM#!|@;FHFYtCgMy67G_fdK`_i%;W_DGzxEGOB~oSk z0A6M(Xt$e6T5$l~teaG#Zd9+;E0}yQJtnCG=0j-7Bs2}R*sO8r{;4SQ2tqMO_gGrV z_=0k#WTZ4L@O~Y~U79uyrBR$}5fxGsTjmh&aCk2oGC89i`l;&3QVQqXEqFMU5wfs*eiY9Z)s{xc^V6rArbi%f1Uoqil8 zw9T_36AP5kt0J50#Om54vxZUj8uzB5SbQEh(a3IYu`H{to^JcE4VBfXqvnw3OSO5~ z&R{7EkM!n*nZ@|hT6hz2k$m%{T&&RS`$19`0P;#?;4R`g-{djLL3+6tI9(THATtfl zfD4rDu$K~VViEC05hboS^tO^H-X7D_s;O0Ffs8q*phTC!fd#%Bz%VAhs

    V8cf(3X3R2`YRb044Z1TScNL@Yw(#T zDg+D3C^(Qwseue1JU9g&ao&fShlUiJ;*h*eJSfNk+a^e#;~W2%0bE2nCH;_9XjDQy z>JNc$UAYzX{G~yrf{xF(+QWPN@9Ek2%kjSvg2Y6*Ylf&zfzK3L?ps!z?05=H3>{6yjavGucv3f#7| z$d8!hA>ZHhxJUHovTS{@2*hkjg6h**v{og47$#jFkF(Iya=b+YLt_JSzOS zxQEj+Q$|zK77d0Mcw;LLrRo1nlr_#Y#lSLVv@bh)K6h$>MIYUDziK7aU(}`B;heDH zwxui2|FkEVXya^!j7B+Na(X99LZ%#!K4q|8biHg87gB+C0Q?|A6U@6T7;_sPnyj_J zT=lhD?pMHt9L<#~SbK)tOTUN<71p$f=PRL7Ed=q-UK9K<4nJT5|4RNqvOSsf_H2pm z7iz%ZNGGc@82FU)9`S5qa=iU%YMhKJ(4-+!IuBukB!GcHAU0y0rZQ#CqZ7-c0WUx^ zIs2YxOsI8(p%IBoCUR$ZGLbyf_LN`^8nXEdD=+KIs@#KtObf-z5cu!lMtW(EYbKt< zAS#Rf-`|4yvvClOMula0?bxC~>JfG=_x-Nc?~5=#pQm%YC>K{Kt7WI_xup=GnV&=p z#u4xd^F;Spc`q|tPk4>mGmw%geQ=wtj-r`618EL^XGKX4s%Lul{H_l;TUpH%1?`Y6 zE-sn?i*&ja1_xw^@Jd_qlLB2mqFL)Z7_@TflEiKk1${{}kq>`#9N2k4x)A(Nx{ywh ztyGmc7+v>^PWjMri26Rx?>H)uo1oii)o9rpy;4#`*+o z$`+1h(D7T0rSytsuQvB^wUE3Urad!aMuvF9YW_%%S}9y!kL;%Bs&I5#|6SHy7)Rw) zrHLBeO;bFsIvp|^gBJm@WiDzW)p%}Bh#clEK-$OOPV+D#SnVHUKBJJ!*|JI*d%>KO zYSprMwb*kbltL~PVcqX{tqOcR%>){EZ27({d>?wl53oedM`V~)yS~4;e%}Xzs6G^t z#Ck1;LS^C=3lz&xe7JAFIgoQh6O#sVK-R2^HYKYQI1($;qkl`&aLj1EOb>}PQ=iOG zDZ{G2WQuzjjSthyyrl#j<5l0z%yR@ojYfU`nI4amIe>zumQ%CTN$N(Ig{aGVA*ZP+ zCn`@z;v?DNxVa#@MxmGNFkhy$eIIGd9liQ9?}4^jdrWDLKgsSmHm%HJ z-#ps@rxixevIiX?yq->Vc3epH%_%Dz)eEp4$E|>z17`W4`%MRlW;y=Eo~w=VeqLS@ zaYx|&)8RW_BtH4*xNA$pUsL1E%G*1)qvD0$h0{TKJ$*6(Z567lit-P@`y$11%Z{u7n9C+O9-3g?D zR5OifWlVOA9ft3?{n}4!I=`Y^Noclhd$NuXaPxY_B_1i;lxA7fIedQ-Inc?q2cRH$ z_*lT)8Y2?yZMG<{k@zzt+%(f{wG^sEd{5IzRbw`jYhXOJYR&@u{~s~&f)k?+Rjdqt z-m92H+@{auIm?sEXvVYBHE0%CvGkNvbvcFW_`O}ch|nvk$S*7i*=g$hcvZe82IDnZ zq9kL@TYJ6Wt8-0lD2l#XYDRt372Cmha2Nw zB}au@{ZbR}E{HJr^t5bE#q;xcywGQpr=#A{d;E!?KN3TI+iXw~*^@US*&qoy~tDD&7F*YTNRX>ymhIOrp`I zzCVuXU&QfqtgY23E`9){xh6>Q8-rrMalQ3pzF9%MR^9EJf|)8u^aLcv9KtM%bLBvn zd8pHZb;&@JYzy>*V=L1d9T?sHlSXmHavyEHT4=P#QP9|Cf%+L` z>JdCnvpUSYzd+z%+0rhsNDYL*l{BY)LC_Q0o^xX%y)QZ0Iyxk^mcKuaUXK_EeTl+O zg!7Wrl<|D#821r%qaCtaTKj_TqsfOzV%Gd#w7EnXIVpIr^;EVlEx6MFmdCLP37b&2 zNl0FW+O5UaT4^Y!V7;cFMyj)r?&Q){BA?>Fm^Oj&&)o*XjDc^Db-Q?WHT2qD?)COK zs8EreKt(8--@3-F%-t!N89>(@e??hovN9To%Nt*<^^vxgK^G=_Crz`?CfxFs2=RP? zOnpr@!q>2lldVXTfV1?K(>QyIU-2Ak*1LM4NF%=gt@ya&Oe{i5a`oEmoKIAG*pF;w z2%X2_glTuu$5@=6My1dn^Rhk8m~$o$QC};!S+Zm^h{ae&!tu1aHPj5gTxGgqH0SfT z|KKDy>I9@eHk58nHl*LyzK`NInvGNObs*ni>NYV8Dqt5@Gtqf>PZwX*#@GgidMT4n z^+_im#&jqSpB9hMYqk7w%^)xJ{djTAOEsx|89zuyq@5H&;t~x-z$S6q^eFug9=nT; zF#FSn@+*X11#YqBa3+tCOcCkkR}F#kIbf@&*z`CQB_#6&GX?(~=1mmFKU;sP*R$b8=llL!DA=8o zXOtjK25U5xF1dayQharQ@rKJdu`62s8(EG$dxS=;u=Dz|^??M2zIRss<==uC%AH}m z*b!5O>rlw%C#0T1l1o|c?>N;Om(;Q!R;K;jl|O4xc*UDINs2zJA=}5*0?1stnro6o zvxm7}@--@B*Pm=e?2g9QNo*8AE|&*1Ha{wxm8KVFBmByfp8_uSc@@{@Kph`{B}tS9_#Mz9i;Prr@U;%PINu9V36W-wG%~G~j4Dou zsD%?w}EWW_vg4Sn+L9521j)1O3XSJ2X=)?cMCW>Mv?%k^Xyo4I(vK6dyy9AJYYasanMHPF(!S=j6D?3CH+y3R zyMOK7#*@PhVVa8#*+qJHYUe`)ZT^8kF$6(B^F3pcV&r}bZyL33?8$G`IA%yEy&RjI z2Hh`~dn=%N9aVYZ?cmehg0=eEKmX1nne*@U%3O+Bv|R6GMu*ZV7sZr`okd#}t0g43 zF`2rto;K;LEz)htK2*h%Aa4X4i|xU$8ajM*m%mp3O(ntcaMVJ%B@ydbbsn1~E#Ba< zlWvh#;0nKGFEb?1N7HrbJo^JG3Q1%-&X-F1N33+i3Rz9u{`J~4i0dSZu_s*0M_faV z&kVy@1B-SKC{d}^kFUMn{{0D$ph?lIp7}_(^O0G!T-K)@Ysq;kZpug@x48pV$HW@5 z&9%5T8)kw;tlUls6!U0rWTO1_(XXM5nT(7Hc|4~ zY{n9quwxZ6v&KzP5c%}aD}PKcSRzA99GPdN_?;de8KKVmZ35Yg{wmr0W68qg50w-& zx$9_RYT4MiUABC{Oy?KZS=|0Loz5)su24M5l|(tVG3D&5vo?Fxd|I4G@aA^z)_}ceQMVxG;FR@*ZN8ov=T!_-)k~a!NoWWcUeM;0u8ZgwP|tM z>wY=gM8D~`igQ`g-2Fp}&7-s-w+6Kj1x9s5Uy}(66$}!ImyAQ`Zum`#QuH3m1RF*K z0BqQu`+gpH2g(+T1p{D0&D8+Yur2L%qj&bd%K+jJbhrwL1uZ$P-I86rT|W@6^F3xY zCLx~+){eH}ia+1SKW%aAnV$Q#(Vea7V_ejM=+4*a)3?srqB;mEoZ?>PVW2(G1TsSt z08^>EEg2#Q>4fm(F|0- zx)G+wXp3iyi<8C%Nxt!yc?Uv(~ z=QhhfuMv~QaB0MCm`T8=2A2R^gf)r`rXv+5RT@PzY)WZ)g&CA~cR?yD#{k0&G%u@> zS{;}lVuY)p!kdXzs2Z4w<6IZj;ZRFO`sgT8S9FM0BRNls=Tig-yLSD`4m8TdjN|IT z;I8WQ_${c(X>O<4zSY;aUKYlk2GZPy5l z&Z)oUb(Ie^cv*s0j23V--Ok*McbY72j8c?AcQ2B0PhQf!xEOXUA6NPk6#8r8wD9`!bRG7K$F z^dElmRMuHkwCcne+ptafW1=rmBn-SI0M=4xHo&~~O~+dmj-UL_{WEH2``Y{ zu{kYf2&M{>oFI}ZJ`|P77?|%y;lrY145s`)`P%Z`UKquTa3mU=)NfwJi=pjrp#9Mc z*J1Xzi-Rf(%YHqcv$~+y6ZKxWQdDL?ISFme^FmDcuKW%S2d$#JkLw2Zn|y{(JGp!KIggF&PppkZv6ze3 zv8IcN)mEF@JacL*R3vGmWpwJqcRZdAZVD*#Ud`{{kt7sh=Ui0BpWny=c zzOtJ76$y{(hu%hRKebyfUhp`!TgZOg&Yp8)$2o?MPBMBsHBnY-!L%L6D1 z2b`qD__$og$o}yAJdeh3Zeqz#LT(M00Zkk5qR0H*H{;~+hom^2O&47J zozH0&kS}dE(#vF8OX8FPj=j36k;%@|;qeChRnieC1ghh_rY#p6#woVThhx&(cd$9> znUW^zx4xbrb%7lb#-$C^3JPG>%bY z&I=K>irl7>G+%FXFlkHZQ3|b@5A(mAk#b}L69UbQUzr#{WHY?CvRLIAEGE)e^}nEu7$rj)wVJeYVVuZ}9K43?E}b8f(DXFxPuG>v zRzNSu-BFgawI-dw8D){XC`K1|io$>fhlbtZcDX5q8I|_cMx;@)b(uMXaC?a58_%je zu}Ymt2b6je8?((a29E)P#H8{3db^WIx2C}uCL19Fz_&FlGnuXm?XacR8;yj{ zMG&O`!LY;a!1Hl@`Te%pt=T$L&Ln#!9_43tnz3A;O%KPr{j{+NyDn<_ls%1C$26qF zK*IE;ut3E>l12Xklb?H%V>nXA;BJh+FhqsL^4%{lvx!kGl{1)_MFt*@dr5k+#Nb|n zx|8l>7s+dfaasW-7ZJh)xyzBXE=)2E>%8g_Q8OL4SE()GYcDfB!nS>*J;n^UcDyPs zgkkTCrfMnymSYj<5Ny&iGyhYG@&o}^ID5GdGX_@_4jUX11dqc@mzxpX?0hCRG>B-k zZK=(V#Pw@4X`yYBb1{uf=&4_T9s8m~Ujc1L`E<=?{~WQy>{cBAq=>a6V$&xC*r03fPII}Sr6dFr$KW>{EFeNF?R}zy&C^DkQg6?oR ztTmQX14W;KMg@vQU?-e3P;{JMBs>+{{||z-eV}Egb~aoRzXlWXh|_M6KYH7GOW+^? zqjmJO;$8lj-55ia#DWm#Z2LO1DYR*k+?{s6wkaq3`ada_&sz)I2BoK}c}wk=NdUp6VAWCYN?91Sbia z9CB2r66tMmTWq;oR#Wm;W!~eLYwfH{O#OV8(Rz@{(sC%6?d%%LwNIsD@?`ggEW2?N*cQViiEquzEysDeYZVBpJvkFHgptK{~U9Aase$Q%KVr~>5NfC zxL{Y*&|n&knp7n@A;$nFBmdE6&!U$Zv@8)ZvLp5eo3~kE{hr05^(Nvm(H`9)7=K3j zy7|z9c{2TFNTpOBabTjh_uX^ZY@}fQtQCa#hrybi)fB+m_kk23f?FKR2&_Wt(X2*F z*z{FJ=vJ(=&VI|phW23ig_0g;^Qf-Zg zadq)rQF=Ni6p+qTyb`RHl_4S9PgyLSFEJMHj~V^+;_0G{luEZFP3|V98Q*d4+&W3) z=^+25MaR$jaRpF>8V;i!0sSIYDCQ4n^kasKWd_Iu7R;e5h8(#jr@*VioXn>=sluwp zV5WMIg<>!(=h^jl5t5d|G$w0Bx0~oN)#r{ClvI3aRG-DBEULihp|k&E0glDiP}$)O zTI~(jrNwt8KK~_{g6|zSpncy|P9484Jnq;)ErW$vRdBsGMdwaEf&_7}e{uV8gknh* z*lNdNu~06*Lxi7Y|Nn!#K5PdOC@7l^qlk8`!}>wA!YR4l#3LiLApD zo_2Il&j|TMYp!(J^HPK7`?!t1`gI0fw`7v;!y=Sh`{mD{zLYIy&X_nK8E%aFLQO8& z{jI@P3kZHVAf@CYl%M~rrOFay_Nx|4G0iwrbv>F~(RSx=88bK1XpEG@_Z)9KG*0H8W64q0Ucx02oin;q)kqp-NL75JWQ0Lhajq_m=%KuL0@STNlFu`?E zyz1+s__(h~povJQL0l=f)>^(?ev?>;lkJm@ZOTBX{c6co9O8BbX|L4Gj@tdmj5w#V z#|_%P0|3S@cX`BruPWOC)gAXGD8{g+3KGjOFNyEm;Tf=K)O5lZGIYF2$6xy z?lu}HPrVwU32kcd7_-Caio43*`d9N}CbwrCuA#>J-FTnr-D{1M$@xg}X+r-U4aO2M z^C}dHtl$r@d?lXotw;~-dZ()Fe+zpMSt$U4p&bogR?w5v1tXz1fLAqB0bd4?B1W-M zmm>cIMQTD9AS_ztykF3$8{GJdSP(ZhL?hwTvGel4AQTrq;(Kr-Qj~qXc`}Rx>saDd zJi7x-Py~xqGF!dGz%m|=Og|{nyG=vodA4NYn?qZ320k%|7U^u@Fdj5r z2oJ3sx4ov9pKtn+G9bEf{i1V;y8kotzahSh44`9RjItyvBw1)HEDtSi1(RSr|U2tu4 zpygKk2m(_k*21S`(dP4oG_fYjNa)VlavSPWCFpeJ`p*XUCyfYN0sR*n3W$^?Lz)u;JW?H;^LV=K_G_Ms^Q*7mHUK8;pa1fZ?|QmO zpPHtP7Z57!?|TkJ0N^p{*wkRzK(OB%CT6D65@f>ci0Qjeoot?tu_eP+Jb!mmXL;>a zMi?z9N+!A{qPnhi_(NG;q?;Z}a*)XZX~P^F)w9PiL*{)(N<66?ral z$%524;N#IEz%uhWDhLyP*&VDdsbF!1!Q3%~6;LL}M{vrfBB1LfuGyc6`X{@(AXHJr zI+$ZrE?YkYg;t`{k1WO;yWLp8-P!E#Of03!hTQMq4hfgo?3|uu7#m3}IGTjCtad>B z8)o3~dUqcvFp{?bR&D!_J4SK+Hr~)}37@F?qSjjd>JDLlGLPu_EYmW`w@)5iR2zxR zI=yD%$7*&7l)sIA8y`O)n}z%n*v09wq(DA%VZ$oHMtd>G3};lUB+tN13Ak1ihm>C` zKY@k1{samE*QytcCpPo#|Ygh*#+O+1LKN5%%>w+Fd#+#DAeq==)I1K0^XS zsf)(-l(LlTh*`*nyYE+lsQfw2`t3@y6{l|ThL%S7us22KlaoAep_5^3&J*x`*))Y8 z+rf3e!kvN3SuW@gAtBD0sHQfRMv$}<{L zd6_u$(V@z{+vHKAldz<2D!`OoM4?>oH*{J397-O6yZ5zyc`wu z@VX|$u0ZJUxR^*>dU5yobz_O$EFtVn6(D$*eYH>=fp#>Kn9|xR`{;MS30+e`v-R?k zpPwHPXb@v;X#q+ZN$k)v!Z_O9b1xmJ?wX=vGurs$a3JMkZ>Kmu=XS`WnBS>v10=f|E+tE7CHjr={(+R ze(h{tJ9-7k{-7jxW#r8V0!3&3Ph9}oU}?;(FkA=Fr0b3o^p=DBPmbM`z`peevxKZ;mX8|teoiLSY?bJKpW8D_DTOD`o5hPXwmd->IU zGbb*bUB?XXLfZD~p&<{-j=KF(OgRPW)# zxCM_tqZvQG>h0#%ZHvT88PzV`{5DO+2!^eqkvH?@h=+J)S)mEG@ zEi?l^C4H&99j{BpE%-0BqvyK}K`R!VEI)D{We3EMznfCdHe-PXZ7)O>c2 zD+>-4oL=Y|%>VFG&5}83-}P)HJ2Jg7%8WtNnx#-IA(m^JeSzub^FMH-RXeD6oM_ic zEUr7SGh-0YXll$=1nI>Mf;2^Mmo3R=n@aH9#40^{0zOqO3kse^0mpbIr$GX?>N&-%}iL6A5y?tD`vxI{__0cX#7^M)7}@oNAQ zgbC`@A~G)_L^bs^N0oEV+aOs9PK)W?Zx8}I?o)Zh!PBELX~tmNF8P*4@_^VC6UCvwUWL7HK%udCPwfEL*X8V};(v zlR)i|C7k{_w^e>Hpux%&{LB-?w9*hNA4(j~`1Hu?llQy8hhvZ~Z!IAuJ|bNR6IZ@n zbu~51OynW)>lX!D-g*xTqD0nacrJyEVs)SA?f;cUwrx++ULUP&=JkIu5c z#oKeI9W%XR^HxN(c0CaKRz^{)jo|n+m58{qi*yIIfz$X4oBcR1naa%JICl7O8*e^5;SyB^K9Q9b!Mk^&X?W7f#RXOyAWs1I^W}sdk1F21kR@gfm z?qP!k71yTK(<9T-A(La=I*PReSOrg5^|wlmHc$AUn5y|1U(vCvi^)!1<6s)i?w7V9 znJq9B=l?cSl-+)hjSm~!U2iyEU@REwBJDbZ4d|o%t<hD4)XsI_LpIK z_DmNjT-?1#ad&NThoUX+?(XjHuEn)b+#QO$6?b=cci1QG{d~v!?LYe`2f31*lSwjJ zvu1|-(TxdVX4y}fhOf(f$wG{twxip5HHd4@=%){4KJJDnr6>Bu=4?jDAZ>5AGhN5? zd>!S;FXPK7;@_XEmt)Xnbg&c2YpBE{OKcl{^KrrSfzlu`5GP^zoBsOxQ@)}AcC52P zi(Xkz#e3aZMH##_n&`%^S!&ZD#aC5+SI?elh5cZ-Dz_AZfSU*HOOjD8hXL#g{94}$ z>Euw6k8t60BMQCymyBwi+w_BL@$YcAysu}ZXB~sAaXJj%M*Och5oyY#pz5eq4RP*A zc=HW(u|Wc4L`L=f8mH&*(ohO-QH)SL%w#tQy z58{A^uK0n)?1GcjC~;k2tbk4zYwn^eud8}hc=Z-+JFd+#6hYfkHLP29I7YXwlQSdDh9t(zfoPLXSf$zl3RmkDk<-rxqL(l6 z&xEP-3!9zzS($y8Ld$T2q+q5cTq|}=U9sKdMgLvnR@h&?sWhD;Crf6I5hJ@@_eaX9 ztyPdj?##6}H#djkLyPOmMs0jt?T`63R@&Ky(VT+lnty5XF}A00-a2 zzW9BpB8Q4xUAJJS0-O4q%z5~d`<>@YcH$+ssMo5yCKQ!GLF+54sEoef;t1J*`b6H zK!ELXwzXm;P<_T|U|0V0EFMU6thhFgN{h%{gHnn%VgQakNH%>*X&cDiFAFUs&J#x$>Bwk%G1*g!UGo zlePnVkoO@#v`}{W-mdsAfZ!Jr8X7omJ>}(d!gZ5U(Jzh(B0`b^g|Ey$;k$O(Rh_;a zAym+3*DU_OLlXNS8$rLK;7e(X!y|q4qz;5O$+8JGCL#oP!RFVRw7l5tH6wnhtYq{h z1{WdqCE^J&5t1&Z)IvJ=!lP?dcILVQWNc9eFX?RzF=K!!?oPs0WOciSysFN z1JZ9qjHECjK8S;6u@VU6Aen6ue6NUN^TJc=F3qgRs^;bOHQ|YC9I}ZbuamzsG<)BM zJ|Y^7!0}^Cj@#yN$9GXUXu))IHR)CpprH5yVW3)N+g*OY9gk+U%KSMc!Weq7I>Ckb zMQwJXr*pV6tQP*bq6TBPQnDlJ_eWvu811_H&~}1gr8QNRoY^_o2%@sD1;7LEtW=WAkIf<;-=2 z$H3!$HG%NLTJ-OV$?M2d7JYp*)~y9UVhKCvyC!TTy%P6~`8rcBSrP2x6*P8{-gUu+ z%(CSEMC%T2i$9AMrP^9Gtn^MbYSxK+;!DjOh%ly4Gqpc#e(35Si~NXPb#BI>>pg1T zExS~2LNeFq$oSAR!CB*mpyn(9>G;KP=wr*{VaYu}DXtK@o@;-tlYn3^>>;~^`=)d6 zeMn9A5i|p4-|*zK>xs&DNY8JhDIcE9n+QqZGdU5|pqw{qPY^fZEI zbvaXr<*PH^*L!_`@;o-6xQiJsPiB6bQi>#b%c2B;~ zOs`e>OscebXLU#lXmUCD^oCX~Pg6{iARAtp#Ls*&b4AeII()iN!iutaRsOU{h19x0 zrHb)R1hv*Ky48G}egh?}QEZ-()Lu#x8*ElBY1U9o!P|C>GS$Q=7VD9~#S!5pj;h&I z4{ET8=Tx{a(Z7awKI6L|Gi?E(gDiIT_B=aDctni2&|+w(5Or^47jU8-zP3~CzLB-8 z0;f22CfwJkWk2G5my9IOKdA_DI50nGrgR->Mc-1lnh38u&=x>Iw3Y%bCHARrlP&tZxjQ?j4y=OK%FtsTwE%Bq4 z3W3eTj7Ix~6P4fGC`(x2*hBH5_bkiVt6?l&Q*R6l#4H;JyVfY5gs9nV*}0A6qK@*pQhKC118TZ|wtkMty_nT&;WcDsm!@4!Hh$#5eZ?K+7Wklp+ zG*=~XT2!@n*<@2XMkVC&3MqlKVKlL0R%?ZYG!xl^hTejIa%iF!%?h2EP+{`{ySJoZ z7P0%jgMax3oTZ=Dvg;2cHXaTulsYX{q06RJLj_eMNkYI_HMV^>mCdwA%qsD#HfHe+ zy1((0cK9tgg@`%VA&WJMK7oM1A$)1AM80ezkxB~@!9t$2ZuwoM4*G7_%La#oD>Z*+ zdS=-K0G>Q`8H&hZfW8nC%0JwIWrE}Bg1f1tbnTdc)2aD}P{n5O>K;f8%tX)7ILt!} zT~=e2v$AXWLLPdq9=~F0>x#ZJ(NEZqkntyFAGmxM*-#RwLn#cwOxO&_`vcJa(@=uh%Qt0)Hzc+dxsD*j-8GBFI`;$(!;aNS9uq^9oTxm)&6v-%Cw z{&Hds5s8dd4c-HaSFK3$2@RAajbB(8La9s*B2)V=#W=ImFiDfO+E?r#827y^jRdhE zper3v``tgCKfeYeHm_N`UMB{kA?*yhHY|Ta+BA37< z7&LN+J;_lR->Yx@wBuJ{>ZoX-g6kU4fYiG>Bx2AvEz`Ysd|=!4u?2<>rVt}TBQ zetBuKcHhSq6B`TC%}8JTS z*8ek>X|T7F2xwGU^o=S6(63i$n;I)YK~Oz?{n*URsPS^mcxi~Q5ta-*z=sc%MyXUr9z;o5xg>8Ak%0GjtRx*1lm`_V0ijvhS5ZkfR6S{_L(Ql*<<&C6sLRhgQx3WU8}|#_o1a z*>=}@wlQ5Kf7m>c^2HeOMdCYRF!;Nc3bBZh1CnTz0WWXdggr+!1xk8?GR$YBq`3a9 zCO*(I0Q9|efLfxO2GE;zlzRXTol)>v?n%qYK*%&!P6whP_-SRl4YpeVNs&Z#0JenV zJ1o|?lc+wuN6*l5?icL4V%487nI@yIe#Ak+MUn={grxa3?;4QFJ&}x>T5+l)!11m~ zbp*o2*FU-RkT~~8;_OlUO2?;q-)&SZbUVOTXG??UVFGOhsuykZBtPmi~^(&02x;jo=T--FTblW*_>m$_Be)k$hd*3MFYH>jO^-WTn z-9MjN0E5>BFp4`Rn_8;jyjLezSEEu>vES3F^#MtV7)HCq%b$e#!E3eeNh{yw8Tmmy zqh*v5?hpvBFWH@8f!F_~8*_;Yf+Ev|0IV7^C?LXgFpy6|4v6EV@45>74eiS>0BrL2 z|B}S>dwTM0Zf@EDV#xgBQ(R2V@(GCKUGpBb)hGoK=4Y5qjrV{90Sx;`f%RdA_8x%# z7Wqz2X#^4ik5Q513n^-7L<|fJ*u#2PLB)|ThqpqKz5N}87j->vNrl_{I+q}$#-;k^ z5lBRL!?d%pqY3WdGE?wF1p57CBLOLxI!I9r#YE%7bUvPEdInN+a3y7TQ%6AWR~AcA zMZC|sgAe3&dG}{9zMK+;diLI?nwpx;`MSVB0T*!jH!TYQXB^O%4GOBucC08e3d+xX zBJQN)EOuMLo+-F=c;ZVxqUOJI+W6)};kjNX7(dT#o-8gL;Q2p1MVw^P}Pk$^zF=sGmXr#HtaAJE* zv2jg7y|5d~Z_%&{}IP%}NHiV3Ho8KZ}uyetGJPGqXpMRaH9UiG)BsLUCu;y*9 zu>8OMl8?{M25o8MpDFYKv7$P_adW6)VnTV}EbT;_v-$h|L>Uqq1!PMI9>n8YSXf9u z0$}A|S(XlWHSk?&JhNY|Ay8!AEVje`e*Qe_`rtaiAe<`lpiNv{+y)VejEvMNQAoAn z(!InD@o|$Gi2B=b8(Bxz!oq@IMkeO)Zrhs2zmQKsIFV)=anCtQ!2qoCLm#4eenc1YSxznuU@!3s-Fqf5^u;dT;tT8V0lxE5Jtbs_@;#3<~t7U*khU(Oe2iQ1GDp@=__{<=N6VrTBS-tVzY7!5) zXXZb*>E7m}8$u4RjTFjol-|E89QRE1`fyf69t&nt~!R4*X$ud z|G?AYMU5MfFaaOA57rs_j9#(}`sNImAoU!fVi-^JxddTV@1R!)pF&go@BZ z|HWZhNFh0e`d?jXLR&X>u(!9T*b-{EHKq9x{jfk&?hXnjA`(skM}Bq%Oh1TVgEhL>sw71*#!Xpy5BE-abd;70|v(Lc$ zB5?{bCurlA4-33$GoMQhhvU;+TGc_HGKbC)nX)Z&o<+9kGEYb|E6Sf)rM%SqznoaM z61xTk++`5(hLCtK6exW)-Y{U={kDC-a8n}wa|9$)s40_N{8Tf_E#aii9h>@L-+h$9 z51GD}Sq@L0r=ixd)=2~WQxYw#@0Cb)Yb##MBCK~;m)?-%Z`yR)Uyq-Lb8Yix#=H~Y zLwu@D%q|Q{S#y&e161bk{oRmm*inX4Hs{mO{~cC zx`o`fXkL!Kg;q0f#swu_B|a{oQLo{LyP6uVxH%}CeHG+KCMK5$CNCNQu6uI(!pMhk z#wu1JRj+tTjA%>AH5Z~mN694_yIL!G3F2L^Jib>m6<^9_FQ6p)2^%)BffxMI}o0Y}^KnLwl6*p%rso z)g}n>h2BE*`tDVkz-0rSkuJ*Pk~ul&j})eNVR@zlZ+kTELt0~VQEefC6AVr?*{#E( zV-rY^iWSdL+EpK2AHJh}-VeRy^(C}#U84ulxOu8H*|pmyHR@2BlUS=_$!6w5=VGJn zd|XM;e7@TWSeVldu3_-yeBklh@10=pYEV0e=T1!uo~IGydN}7{zpM4okJBd_Pxzpo zXrYVG=cPfH?s>T_ZdiF9A@mzAif+o@b=67I(k1ht!N*NKkk;;5ALM0oT!46%33m~5 z4PE^$AYts8U~LMo|KnIy15$PZB%vvYAw6;21XXD|5q=!PDN;q4CpXX`Xw0W}Se=xG`#*9cUMg$iZ zRUH5N5qF(TlvyTGH!B_8u~BzZHds%oub>-q?FeT3QunqfBchNDlusqqk4E3PEmj>r zXg_YZ_j-La^yV|G&YnD8Du02}(NA2e=KB74+F`a;xEeiTd-aETuUGe}&CGF?K>CY? zDDVGpGT7UwggedqsjXq%uds*J_o_Kd@;%i_XI!H8U2xWWIj8_rCcc+&QToLhrkJK2P0^` z!8knL4Oib;Ju%|^xYp7*!oKhNQ(j;?%WUX-KTj22!k!t7vk;ZLU_~*|Fs_X!#F+ zhLe?7^!w+X`pVP0Z}IqnLw$DRq+||ob>hT3S#^BnDx#{nVP72`>`z2UtE8;Mf=CG! z(?*L-|0Xxr_oBjV%)uKq7&xL7Vg8-9!><2Ln55U4@dRImErGD1Cn#2>YG zoNI?~Kr7Vp%@$lE9;!jT$^-1Ff?wE{d~%M?*YQbpvcLv!)b}{$dnKI%kAhMJ}0N*+#FA%iNuqjfNUUc4}F`CJ(U z(F<@b)EYpN@{IH+6q42+Evc5G4!+M4QL`YCNz-?}X0S>#72iE0PfVv?=y<_=gPWs4 zgi+mjJ^E<|szhoi;{qo~(2AoBj@x~8a8S9Rez0Q9wyVOXqh-ZZT>R}qXP=c;BWtS3 zJ2TaTAg4tmOnTmlt_`kJ7s@=SjfzTl@OD&dru@+VfWE zPLs4ks%hd2XOuv-8>J$=eIG6!#;$QCh{-ihFL2f%zt>C&SQ% zEfib-81c!<;0ash97O-#S*)R6prPBCq!FF~xh{QQ3`{cQEo{-nzDm0!sQLL=M5y^b}t4&ahg zO|dZG0UUC-LbQD)3F0AE4e|7QdSlY3iWj`GkEFAe5Qn?T8ZyCk&T$@%#JZXdXt(lZ zl-~NyrU^X1zrhTbwm!_Wu7o-Bss*)33a>MkV8|px)Wm471ng!HNIf_wqV0fhDvboO!%lJW#MwDmX(zF1B=ULxv4^XGxAA+ zSB06k>de>rw41a%rvTw84!0sV+aswS8S}nw=aGUf2+9#!{_7~>T8}Y;;ECk7GOV6; zL)yq@gbn(dH>KFfu3M)^YdJ4oK(W^&f<$|9N)3PL)ET#QpZO1_PINVC3!lD6SP{|q{B1B5Jy z`gH88{M0%>9^Nvy>J@aKX0%b!FyiNYhgY7+^J`?|x4DReM#G%lc%Av7@pZN7uaDH< z#%#^)(xn!DrR!1T~^Z=Eu5jXhLbs#of-x|u=sTr7;XUC9910%ZW z+*jf;nv9|w^o0gN^XLwomqP*k`!O2+>^NS;l>!|bPt#dHH zMHvGO%>P_v~yPH3T zvmwaLg<0pU=@Zh4V_=(MSWfpI-0P`hoD*K2m{u!Da1l)@*Pg@W*0^8SZzXn9y`5Pl zE{k4>dA*FCi`6tc7w#+;0^ejISxlD3CvA@GtBazqow)wWoX9<*T_=mGo%qZinW;J1~WL)+%nR9XyCF z$adh~zf@7(QVJ@ zu6T39`tdah9VhdK^Jui-?J*;C>f^H0^RK9YwqX0Sxb=(6Zt(|22krVUDbH&JbTZ2O z-jj1N4b?=V#wM_1ns0OA*0%Io~iiZiHL(cZjplpS>ciMlq=r8 z!`_4JOmJI4opG4+ng;2yC4sStaq(`qnz2Y*HKmFghz^RJ3OAg8TWU)e|FNRl$r!fBIvj5)i&Om)V$ z-lU#=<9R$v4q6N#Hx+)TOXFYFAPuHjtiTh)_Dm9>%UB#Fr|^SS9Gdb2S?M8pc)&-E zhQ^c~RBlc^9xK-PJ@m=ux}&E%7#j~Sn&0&7zraJM!<6S-Ut`KHVMoXqBYfVY?YT_H zb}sc|4Kqcd=G$G}L)=qP<3LxI$~C%p^mkcKMRZ`MrHn35_4t#*@yWXwqCC?b=k$43 z@C#_WH4fgza3=COSw~43^Q7}R0s_Kezy0Ry%uLaYikZ3j1yE!uCqExjGzwR?U7Ghn z$T97qkEH*a9m@n-O~$`Gvp3(AZDK8eE6gicHFml20U4k2HwHt`ax@w*FM^o}7LPtT zJ0xA^Bi(@e(o%llLP@4z)s`G>zApop<5U_MOfSn4V^%<~1RwlXYiIy{hdfzIa*GX< z-Lh_JQJ|O>a+H$Q?k}Us(I^qqxI9#5-^Y(dgD$%{FqH&ejqx4nbOen@?XhV>{zkjw z-D*u(+Y9wRWSJ+r)&-HoR%j79aQgn7pT}OzOYLK;qO%F>exy2#Bw(_8IGKX&LI&%N z%9FVmUkXYfEp!y$)R~U)>e5?y3pjJL3gJJIgv&TW>#OtOxU}=atRHg8MAS5`v!zxVoJ1I zt*BmZWT!Z!7LluN~&+dz|pwR#U*&64rJ$G1s9dk`ULYrU>6uL z**Zlfz|tI-aT;0~GT7RN#MMtIN|Mq6!2P1QydGF=D-LLY=g7NokIH**a7^J8>c(l= zVtCBq#gdZ2vCnG(dj~_rx*seSa26you=RtuXycqd@xBRU#Yw9^i5geO!Yw8Dj#Uv^mG$ z$Rs298B3bZLorcM(n*?bq3qR#fKH zMWx406H0>|Rn1%VoM-Lpi_?&Kfer7@zQf2GNUMw^#VfBN+^_oE)0pcbiPvhvJyC8D zs|kHw1Ckzh9dd^35pAw>SEpwlzHrJcq+G=s6@CEd96#fgiHZ`Id{a5DU5{+tMrA+K zEbEC+GjQJ;jlhnS*De_2$MEj0*VXE-LnIs-E z-Pb+~qiFjJ!3t)xfxD>j)r&oRqA7O<|7}ins3~@tS0+Vg=J7{wk1l&z`v5k&GinpQR^=ASdT&{i?5=rf_nQ&5JM3y5I=-}0H~1~yX$bSV_m|KBsh2A4-7@T zpuo5?MGVPSUOWPOjYZfQ+hptSlYbZmPi3j{0bp;>*JqdoDXBI@b`o^cERc>TGP8FV_xl4(2v{00YE9$cIy^=PZKm*wD6^88Gycj5K%_>0JQ693NzM zE)dfRE-n&n0-zg9-|E7u@hTTLq{v$gX$)};=~t&8bn=?Iv=O*U>OWg%HV2<@3E&u? zrVbu3{(AM^@o*cM^Q)D)i-x?G;$bldpqrq+oIb%pC5mudE(A3=$}D4$odm`C$7#uC zpqB#LAIHJM@ePmto5j8HTWBbXAv@9USS8?oSvRg|(AO_)Y{Yu^gtkgYC%*s?AcmlI zzg_|GAu+=8aFpS6;iVWdh{K@8y>Y$q(W>kZxY~0Ut_4I-@5>1|2ws8dc=Si%-M<&2 z!`SCvzr&Du$?w{$Wv_Orb}V}0tMjSW2EI*e_M6)FJ21m+lI1k zd?zo>6F8E_wzahO>a+%mM6w2^=ldB6gC(d~7=RD^^@=L0u-w86b_X^Gyx3{g(>?yE z^X^^|XQuwJ0DPUupf4mHbnfp!?IH1&K-y!<2@cKE6eQAF&6Y9uTP6_GLrPArH&d+G z)+sW5;R8b{KP7lT=b?t>_(o~{&>uzP*BhIG@r^F=QN_BBU`O@!uNDP#aG>aH1whnN z^pDxRrpI`%MyaD{dp#JIs#JjjgoCR#X5u?21^yI5xXcR1!v>610Q+nA`1ATufCpE| zThNg-DC?8v-jCa37`h6P1RQn3CXZi^BU9xh+gdO*I=)^pnlMX(-(W5sV| zWTfqfVBYReo!z$m8%;`^k2twaXj|nkKF$b!|LJ%Ic79Ifg025o4FhwxoN-!%glV5MY&F~j@=;~&9s=h6H9nb~q$Mrax=4MPw@dIf^#nzW7+ zt)qKeYOA&GaXGXA5|@=wGh`Ct9VY zs-I@Us*y?m%{xPW?=_wAFF{`8G@NcetzOBK2qmrZ(-_7_UAaocy}tykg07M7zEXhR zB~U{0yRd;c8`JSdeE09lzrxfmftWinUB>&e*yD?~M$gp`tt7X(AkYuf3P~!$=zU}D zM6HT^ZmRUY!mG5R77!6&@~SR`S-SLPY(Q6Q-3t!UYJx!8P0Fsd;Q@dW0YRlE>ErG< z8IcXdH_k*w9%wkP>AFJR=;pZvd?yf{BlcP z+tva*)M&xsJPty~Ht=-uSUVi5~bx zW?XZA7)yq%d8P#I>0>M(b>F3^oMp(5W#P9HK4`5`f2PDqD&iHuf1E-= zD`LvU6Yz%e`22v@I&L9LUmhxpl@&wnuyIe||CpNioSQxI zRPe<!+M!&FS_V zNZc$h*gY61L1GI1xE)9j%Z;*R_801Co6F(@+-MAGx?-?6@lc_E*I)oY9}IjUL~&p| zguHrcfpnJA6U&oUr@Lxqn9MHl0(c*!M#R#&)D{bj&c41*|{&iuiUC47I zOIPN~vH}n0U~`Q(ICRR0kez*=B->HsqZc z`?phaUyu|r-!f^sYzyD&m}(b%s(X^dSGjSvi*1istoGIoC>va^{LPK~TEmj5!|xD@ zQ^g=4M7kkiVS>}!gU~bq?{@1IHc&VOc2z#n2b3@_pO4H*E7YfpY848OS5aIM_=)93YKK= z3R+F_1VnKu`bYRIeJ^iIM-@XUl+OZKYCcMPy|GICjQ0FWQqfney-V1Q4W@4BAJ(dUunUM9@>Ibw&y3DxTq&!- zL}o-vbH?jPN^r0I(^cbY(bd3uDiZ!eIrQrFBbP{2-rSOHZcE;DpXF{euI*EzTAAmj zk?OUw5?=n*Y|!4D+zE%`n-Xu>vM4uEXo%|+Z zla_Z~)z$A3&bPKFnyp-AXY6LoHNEGD=(->l0}qWP!WVoQ#Re2a@Kl(>Zf(DOq7Zqs@3Z376= z|4@U~M8=v+%BC8)AbZ&so7K6o71DKlQNm)j%=b+;$gTV}E*8nwRP_HxT!#Phm$+P0IxB&*Awk4{j2e< zL>(BK?YJyu*al?SPR%POCMJwgxEy-#T&Y~8wbT2#8oXDta5$@YyJ z_G38csNc$VoHfk>vP_0@ZeO;NElJb(h<^(vX=mm5ut*82ez2q^JImT_ zB1E^-v02W`RrjJksgQenrVhIv{wffXDJ3XF%a&cz=+vT|@lxD{1IF0AM)uFmE{2yn z`3cP%t}W6*qb4cTE z&);WA|6JI~S7mO5G^ATe(*uxu4oVzy*AR>4>+l?WdJrG!;Kc` zjOQL)Fg?4ZyxZjQl~s|-r*AkFq}#87kUib)i8&xG+cq=d9pqfp;#Fn1M~i62AL+W= z6U|9LtF9}#p0BW*));wZ%GWOsFMJ3eSbH+b=KcD1kk)y#7S-sk@)SL^IK#nc^~hEk z`{#6-&1}MDpG+-}2&`cwb^S|ah#+U`b2;9=5SOb;WQju+Sb=+$UBTkiqubqN z(AP}MbDowC{NrV*gTA23U@)E$gr}aCz$Y_S1#>S4sJ~sZ(so*J1iE|e&Jpw?>My&@ zKovv$m^zAdDHc13N7rJ%eei2{mg<%b+n&L(X(Steb932R?lLUSfgR(V8=T{Ud_ z?t`4(p#YKmEz(jwug|IVYM}gnMUKP03nfY$4m%t>Jbe{%f-T(u+hL?jkvU|4WzSaf z=)22l{gZ7@Np#c~W*3u>k~al((oxNGn}b#0W4&W`Te7vLOtX_8(nUmZaBmFf%{0aQ zbxXxUn)(1K)zl46$7ZY^OSWc8ur5uxBJ{uUv$W*?qnDOx9^T)S+hHAX)Yok*;3gxOiGt4`dXnNsQvEYi85?KKo zE+_xeJZv5?RMK7t_O(Fk>%3je4JcBz-A|9Psrdu2%WKtH%yh3MJ6HjdXuZT3ouDlv zsR%^0GPr3S()!Q7MU8f9q>;3oA^l|s2EKYyxCAW6>!NO9PriHD$I^8fL*bC ztSJ3+-j)iZLftRpXqkvkoU(i&=%F;$Yp(lCnt1EfA!DV)u#<%h6fb_lP@kE>F$tv@ zU7pd`Z143JN@SIGQxdiH^<(_F~qU%s)x2o^-v<-&}*&o5&lPb@MAlSK&W@sLH1Y zYp_vJ5c>@(y?EO4sL926DW$MopcBP{eNe)IXBJJyHao?LA9Qh@GXv~G-zf~jlr9gO zEMb`42w_`?=>YF0M{LnR0JP1{ccaONvXt)+9b~pJU4mS0@I+zZbZ^d_y11qK3sm^l zpzH(XENP7%r_f)Q14K5v1U$3)qY0oQ2ZXoEX|ZMqu2M~nheeZ)AbAx0mCF0_5^+#~ zkfl&Gia24+Frb!2$wKHgvv+G|LSb2;5phltxW6DHN8ICxhun2Der9z0Dt>((b506v zh8Eme)4jSfwY?2yNh?C+&4|G-xwZm_5ohbmEu1_4q?!0& z{8>Z?4(!3M{2R!EYi2kFzFABK(*`1TKbI*u?7PlpLBY@h3TG{@7qNaCjCZZjF+jtT z0pSskrx-WUxG}e~647@=Z*y~^04?OJtQZxR>`3z1bFY;#ZxrQcXxc_4%O)ZsGV{{l zVYAZS!uZQ21p(~m$M4x|p4psWW`}I}5C>WUfxVXSlF(~yn^q@z%1d8Ba&3ZAEj8C# zhQC13_vh_(>^SuNeZ&LiPUATEBV9JFiCdg=s~Ic+qKuRZC~Jgb9Ns-so4}8b8=Uhr zeaRKcJ*lqfyjWp@CZ~z-Hov%*5*4bY2(y#?_dpqi^0jggaZ9VjV8M`C-6Mc2sOA-a z?wg!6Xi5FXg#c;xc-x94NfOw_`+${eQd_=ZC>E6?Ab9ct>bUb6F3Oz$^R&Mv4FrphxX?| zce3iaAKYaC=cXnl93>ZB^$BT&N2KTlq->+DL7kboVsxz`(~MG~8LX3fJtrNCbfCij zKqUy`cgvedUv>(En6052%glHCjBUYHy`Y6V<+WTsoH~5F(RS;HNwv#m+Z_dshh{;i zX_${zHkU};zgd6?>vVtvKxS`zndEBqO(6x(_~sz-z~Z6>zz+X~AxoFu zvSV*Cap`D1EKe&Vsr46j0whWV{myR_15mvXH!j{W!Tvo!Sa1dP{Hg{wju>JXa<~0C zgM0w&6~8sEN4t3-srt|E5?mKV#zF?!i7+Rc4jd=$&*>K&$hB4dsLHL%-h?!*&R@p| zKyTS@+He#Ez#>{@B>uznfY)%kHRwy~&=^|{ZHO9f9lx1*e01yGLY5P4h=pghOtskI zt{R41TmD$Mi<#d4Sd(y)Ivun!^da@|b$Nw!5S9rh6NQ@ZHV3KucjsPaD^ch z@~9O5UXNb`JABl#f6LHDEOr?H5xK21bJvcDxxKN%@p#sCHkVaxqfeWE&HHy`00PvX zIQzGb8tsG1nL8YS|FWAE1j=Pi^*{dp|4kYm9rPWA3!L68YFM3X6`p!(IsVJ`2718? z10OB%K@|QFNAbVs>z-it-c9c)nFtKYzZnVYfFmP=;DIF23IhcEcdDi@1tBQsxdfTW zzu#biyoXHklYK||Yu5_utiMNSa?6Lx{@Ya|9{`>+ip-##(0}b+K#8-##uW7a>kfsV zAKU?4q59*0?IAM(#&^e;1g!tM`~Myu(t&5Z?ff!RMoXG>E$Mvo?@j(sy==6=6~f6X zVBA;>=D^Wqd2pzj=>L5eW?V-$3}tx!t1XBs_f5{??+y=5I5Obm@M;lO$ePnN_zx!) z)S*Pi`Uo=9HK?96oEM-FPGQ~tct|6?007A*m(kIp(fB6|cDRo%6fwtu0RasA51aTO zCsvhN`u}iZPv)6CW@dx3D;XvJFDX{Pj}im{9$umA$TITq1@4bT9OhqHgAneIcR*I7P48%(x4vV?|(1r4Wso2Q;p zN0HUGv!ng*WBodOUjddF#lEpQPN;lJ0?^hkp>#I5?yMF+@Fk(_mtQg(HB9gm_gRHQ2<4+$wT6 z#hme_ge9hunB<=067&yWTt!1++{`ANeUq6z>T8|J@MlLPj!F#z+pJ#CrZF_d0RQ#F z;Wjr4cOVthr?xtgeh$dIAiHc!nF~GiMNdbZ=4jJ+AiZ!cScTg9c=o0BPaIs`4wS6c zutTB8l0H*K)(#gC9^5iHo?u{IJzEwpmeM zXSG?Sv*?2p_@AZn(-|wCyPIDn5Qb1g<6W^02}D7skr7s>7pp=?8DpWIITw?8MID?u_z<+07A_$z{;@@ufhM_I`5dV}2OW4eRwsX))f zz)J47D(XaP?MiQqRx0;%^zX4r?H`F+FP3|y_nz-7D(FGRmO`_uUgPa%F!VBhZ%kG- z)K0XEp3#VE_jK)JCioOjv1WU-tm8eP2r)$Up%=Fk$odf*}&;yU~*RFMaW<}kY{OCo^_0aB~7WP7(t^}%Vm*FAi%{qYHy zNgjxp8oz3~D)&SG!R^pNu-e2G`?jl9-NwzbWrp8U^y2wlZoxE%@|J)_WLg33+}}`V zq;j2xGk~Kx6bJV|j%JXfXJOrp-rO!bIxitBNHfxGe7lGNS&!}$$SRcCT>%lR(--Q5 zX8?`=`#glg5Y+Y5cMwNMu%n^p3 zvi_%f^5mA}a8<1#ts8t&i$7hNnmAMvxQL!k?=;qLv7D8`LpV5?!R(J@rJCUZjo`;+ z`Oq&v*4X$mj!J^B=kj%(XN_v;DUsZ%n;X1o?yT635|YQlmm>Uc@>2?j*4d&kjwRL2 zFU95~jN!r<#n&kDb9SW;uDCv!!^&;J9DK2M5vl?hotv|#w=K&DTYW=3Dn<)E=swn# z%aLf*sU-I=PDX=?v=^5@dIPI@)S09+vVtR3pGNMddA{Dw+%l8O(7*;SHI_uYnk(ub zRhyveU;9N;THCJYHmnL}tkBw@fZXv&y>87~1xw{~iCFSJSX3Qx?(PFgFIKj5CwbM| z6r#4HksCvxW3X<9V}(s*zLad(ut)UuiEIIhxI~171FMWz{QE|a$`2o(PAeh~*}RQg z&QH`MlDyPKOy_XC4@U_yo-D5&`_dRrn0O!eNzkq3<>P^PS#f{xRJFkNL&Y}B6eTbw zaS=KAi2G&OFB0}uy1u;weX|*ueW#t_yH#~bK|hi&P|{K{@B8+j^ood> z)=X%m{=D6izlwqxe%VvH-)VDID>YcVQkW;H9{REN6O2U^gN#X6vf=Cj* z^^ID=l~U~U)<|vLq-~%s8D9!(v+i(Z%o`R-MQv9h<=_{+eGfa`4Bh$f2?S9zOe{;3 zmL})%QS!ZKFa1DrBHP6JdhCbLA66daoki6&JJ)jG|A19&?G}UjXWl@T7X3fey<>b` zPvEcHIB9GrjjhHu8mF<{*tTt_v2EKuHZE=v8q$aaLvdz?o3pfH)1U3F!UtO5Go<@i>qbydxB9xdW^PSJesX$Z`F@w zjy1-gS}wmTjEUdf>HbD7HUAD(>dBktwrn&ky}bGvAR=ti;R2tB@?yAqIc8K`q2EhB z94u$Dn>g97VZJZ1#;EmRd*FW5It?qxBA^qDtYcQ89Z4 z)f*I%=GL*M$mQXG{qy6ocI&HYL_5zx{Ur~oNBPx3`p*GC(xK7p{5%#cF;*HJG)v(M zw$W(bN8c?y^{~V>7uU(P3-3(PcX$$-tb$JsC3a{NAmi4{@z&MeiPs?ADQ3nYU-2Co z(n0I$d)zwut2i<-0`U+g~*+2G$1RZ(fOj39sr<5pP*!<*-N0 z?|&xh2kz|wUNHS^{M|Ex(oyEfet(-OUS;s0*qs&S24qzar8RR=gES1ulQDkGZq?La zCX5e;H+cBUg?K+TS=pT3?i6I#avUGD{eWUdt<(q? zq=7Q_B*mSNPz=U;P)o|1^^-VI+M!&-MPb7o9iHWiWO27Gf=pZ_+w_^&EKF)$q%v|m zKdNouWFUE7L3z+;qTi)Fj*=Ac#N!6Of!`J-|MI30@)M=n59{Q;lR2(BEhVD9wu05I zqX;9JfvAUTO^|~lZ5f~-r;fW(A;!^S-vgi#gSD z3Rphi1@OY6h{Oj;tp#JP*Ryi$s44M@JtY{>L(7?4Gicxal?wyUf;%w?3O3D3V=9%bdc^;1sDd zutCm2DT`^g%NGp}6G8jrh4$xPJbA12^9y!`=iW-=Rpo1IotB9=u1>bcSWcUbxWdg5 z&kYO0L^|op_6(zQKuP!4E(47M=IPtf-mO5&2(5T3Nek`;bkjB zQMt=>L>KO^;$jm%9G@M>FeX0GgvPXm_9z7X%wn)yCoMY2!`T3no)Hd}@yWw5IoIGv z)M@g7bdgO2VS}3PqN}(Mu%sIxw?~)_QSoz*g+=>=vLfeqA&GYlCmc(PyK~Gno#RrX5CN{r7 z@OXlGzFbLmGZC@&2j8!?rEs@-lX}`_jIobgPNvQAeaG|cbnIAhq8quuwxXN9aQ1%z zXNjWHer1@?56WpO0WvuAQ6n!xSf5l~d}FJ0+nl{BsK~&{7n5o9NeM!I`JM{f?=sBy z&e67aZnVdW7%?#=RvGsSJY5cbo&t~bVYACh(HZ)lS=S@25B@Lqh?@}dfxB1EkrvgY zQ2D(%KJJi(rsV99$ckbktWFccx(PkJW%SzL26wl^`9jJQy4S#?B*@(XJt++tSTKUG z6Eq$=mqq}Mg*!O7QU8Z$`nyx)(f9Q(b)}hybo&ULrygTZVvXtkR2Sd%SW!(L;gFg} zv4?M5ijuEr_~D!jWZA|mEQ{2bI)0+Ob#3zS>8`N2`(IALu*~^CMjp5#(nkd8JE~({ zMH^p-aDoN=G(8`*Uq|rwadEP1(V{h${+PT0fjw7O_&Ta>IF;_>#lm_=ezUT6_6W<+-|DS6X)8+=cQ(fb8{JPIHrM8*OXCJC$vLIg-wLp%7Ej5? zD@;8LvEEtddcopECT9}$$IB5+^pk183zz}&wTWzUX+F${5!Bp5UiA+>%G|-JP5Ng0 zai0~5P06yXq3IcIAqz8lfpq4fv|5BwJJXh%bsOn^P5+T7&c4`GSW8WQI`|cqX>Zz* zs9dBd^|HlVMEVjkk+nTWd+>94cgIw}u_E&$Dm!mCt5byg$km|?geG#RTXjAUiE=RJ zLsM68N5=0gmufX_U*GdYwkn=3yhM7bKG5+e1y>d@XPG!n2P7|5)M)^Qnnz=YE+>8* zP7}V^jAdtPUTB}$%vb*zrMFI}&NDZyKB5aDVb9Og%A!Q%UjX?e2C*@@M>zCn6@$?d z@TCcMga`;I0l35on}a}L_x|vj-i6{{V`?oK1d3qdXi80RqzPittwX!0oo1FlTCTow zr1<6!$NMC+t%^-p%2uFRND7Q&nMUST&3GvUqF}u#)KMTp;PMCS(ea-zJk;j(YE3yq za*F->+UZuyG3zBjGg<_M>HI?*?8g)c<3IxxqagWv{|my!ez!}riwBpvdZIp}$Hx&x zCMVK_jRCcmo)#5NAC>pEN>JY~BrY~(R^UM0v_VF&3<=&rURl2KPp`*S(_e9CjK=$Z zu`|ZJ0lAWQX1=D;c*wZ0aXT`ZE_3qQ|CpbKIP6#qJmLp}3{eY~A66I^#DbayLzVPOc4f>;$rQqP;uD%dtL~*n= zK%)*Y6J7wG-mYR*>(1v`?4`BHaQy{CbRstrrZhQ|Ry<&nZUgV5Z4K`ysZp zHm=X*3me`xyAMd8d$-($gsedmA}U(|J9oyf$07WxrzQWZke`#pvmDMxAflw z<3y)3(mYXd;^+n$Qm7vO7w5L-t19(iobj=zG#qCn+R{AX$o3IU7KcS;%}~X^-TK^E z3EVyY=K_f6@cn;f+ghkAZz7r!4j5<>^>peKuI0o=_c9vQiys=*d=o2g1W^CR7V!T} z=S%|lr+*dOVZ!46xXNls01!8&=>Q%P81^j|j;E2c@Udk>(`w*j$3xTq*ovL84mo*5ul=jCx0OnQty&c`s5;J{M z|BFuj`8vVk5syg~8#q*V7ptRdW`IWyRQX(TTpD;BW@v-vfJX&}Jyn=oO1-En)VSDr z5aj}t{s-(6(`NzB?(huYa(mZ60;Ylk8CDy{%mI(+s`AyV08XC)nk;kYgoEdT$w2$x z0lNae(0>6gVLS&6ri7n9rlEPXmULJ_+j}S1A2!v87*DZk*7huHT}bbze9xSwu`?FEB!rE;Ag;BC16F9 zz<#69GRLrc*UtU)ZKujTjEVYE~O9kyz8b@voFsnkcFfKe_{au@LL=dT#?TMdO6+t`5CeM zmV|KdAFf1!f?52MvyLL&SIrvV_eW3WgVcZlHIQx#%T6TzV~zt6Tz)h<@mR}g8m)im zf&-0ZWkrKZ&KiH0>|GSsw7{0)=Pe#6uPSe_LS2q#+HUaxId6q6E#IYSsE#%VT`z++ zz%~cAl&8lwS2J!D^Giip=pq$lorFY0$_9_0!t8|^KWv+@Ga9#kq9UYBJRn}MyLfs@ zyVzswd`Yw0ANMB$F!(LY5DenKfR_~n0NGQwXhS0YUBebYnw4%+Cj|fd7I%#SDEsY? zCJDXVzvV-c4M5?M&l7|B|88K-2%!A!nCG#J(SJ8sg#oQN2}40a zc*734J$Oc^Ih;`B4*C0u;)9e#0bUU1OAxay;|=ud+Aij8N`pMMt|Qj``?M`VeavXH zUd^a+W-Du8+V;876iK3SO0{+6I)C*rB*`6Vi2D9lZn3{@ra%>~&lpT8Kz#5NJx5GJ zXS(~|oZ)xd>@xxX2-I^G0tGhuHQN{OC7B9OlHuy3c)*I3c1!d3yyH^4m=R@3GN@C; zsnewk9nWo>FRxZauhyYIfKMRCE^i)!@ZFLX=A{e^gn#kRHsbZC(Utpp@p+TxylVt< z$y+7~C-?;)?!NaXO#K-rv1IbG`Cw-R>@iK8@AoLt*}?esVTFB~g)4lLt6LE63yqHt zBupzT)w?!OL4bdc4!yUqf=eDwt#@cJT$t?Fe+(T98N&$(mrZeW+hwZv){qi;o=LOSOI5m zZ{M|z(GSu$##j}iTijbveRg>4tFNa*tOOXixI~xMSp`!FNxkM;dNF^q0OK(+!$lr} zp09QO*wC78Q$f=w$;w5Y2z;YhRS>4FYO@g;~3^%Tr=sdBj)7g~%;@a8j5Y`yuq zL6=llZ(aoXZx*mfv{BU*D zP_-ec*T7A1*4a`+u^J9&ZpT(KBRd|cl}&E>yaLArd%6v-naTHS1S3s{$LFTHv<}6_ zE}V5JF}vjspHfc3j3XL&W&kD+buO!Y<+GU)qqyUz;ZY*FrR>(N-UfR2K(DS#m)sF{ z7lcuLI8$IOHX~;7QDq|Iyii&)>F=I&W2<5SSyg8n8ABP!kYT4-okwMNQJ?EU4qM|O z=%N0{#WOSB>$YYxkN)vxUBRkvh0`%JkfDu|hqYG{s;qV?yYp*vZU+_5&%JhAhdF(x zX}vM|JM}bw5RQxdGi#u2=U$|IFRKf!5=5AZ!Di^Y-6!gK7Dk$Zd*5s>adgkOUuwxQ zA@{yy2)KyAxePE8^Sn@YQ)qSgFS+{xa0{Ke`7qxome^#gX7sULIt``p@C%B~$zmPR zzijoNoNwEJkM4;Sz1z$>xAkC@d}oYsC+p66>R0i3AUWz36-* zT`tGFGU2Sjhg!yXLlA9XGPb0o*Za__pfu%(KhPa=Bt7kutE`Hc4JF_kno{Lt2WVoSR6WF?217FRU^IM6&7c*rbf^9$l|G4KNyoSJe%9B^=%!;< zA|#$>gp9=~s}KAX6jZ~_h-UMR^Xj`W^N(WbAYG1CZd;~=EdqHC)s)DfMttvnSERd( zDz5L=4x3%)#24Img5viC_BJh^GHs=!M$j7@XD?AhvrLS!UqDHbfRM6mpomQ^)e7xb z%vqe2m6Kk2;d$*@Sy)=U;u;s;dSYKz12Q|@Ca<>TJF`1D*X}A=o6n?pvEwgF?LL5= zo*pu1mjUs}Gs}%?IM_$MOnF|F04VVa6gCbe;)>T6Hc)`R==Q!b^cIB1k{ zdlhDuj>@~FrhDR8<>%)u8fRP#rL&sqin}Z}?0u~#WtL8MM`$#3jcxOq$_bU}g9oV) z$vGEBe2EvfkMHF_WLksQwkk@>ZH)TmKMFKz*3VcD2Hl=-m(e5|Tn1*!BVY@doP^Vt zG&A-nl$Vd~)yIU@()(Tkndh3#oH2uOsz()62R13Is`1vt$AFGnIWysbew|Tr(>3 zd8qru8;MOpfv6tGE%$LlL(8aLbA*tSiAC+o_dzc&_F1I0R*iGAc}=y2L(4K6hnw~l zIbnq}ynA-0@$nK|1=4j*T}#K*QZBC`PE+u3uO@!Ls?i9*3jv?ptap%xc4k4(PM2!W z0Rn6@@8c%O10Y9k$MdZCq7_=|0S;}@ibqC3$7#VU&i}3%{2`#Ar`ymz=VipHBfoxO zdOD|m;;l+2PE=f*pq=Ryg9(UvPhLjaDMZHm^qjEL+m%O0>RfHZ$hwg;iAO<7)dBDf z(Ke7uj-ZsJWc9!CwXUfukSe`c-|fy-XT>z#eFWE!*}kw^}Ab}sqs{ln(qYcS0;XtEuLneCeT*U>e{!k;{SCK_C_ zYe7v)83UDSwoVI=pk__)&6*z8j;t-CM+AOX9A|6iSPd(qCQU3{JF{!ZHFTbkK=moA zD#1Y$d>#`ScKuZ)Gj?Y#mzP|i)}ih7Y0KWNZS}%#(bN9F zhL*(cO}yMJ8^_WF-*%fUW*rNgL-8yZzZ9-WyFYddy$l!NELc`J zq^iGsIJk_(ivhd?Y#|+u0_$PNjS3Z>g-SoIuao`K$Z1Tx4Mzc#$-jyh<)82hM1YOzLSH>* z$C?%zchUVJZJ7}l!{8$odr{EmSZfQ=`fp_yDB~s`4aE(_fTYRI0YnURAj6vk>zblsDIOgC=W^n#j7Er~pr?0u{C>I*2J8!z zH>!1yR^;&t{l|;gg*)Nr@gu=SI_JO!_K^OcQB;UB+Jd?^GWlqaM z`XDV1FH+-mZl)SpL+KiS9_makIS?g*%xFrt4G+$<-L+5AAEZQe@{WgJw(v)+_^>3xF}N zGJDG0#BNvW=2*&G^0yFb9L&r*u1uQ2WuBxbNU3Rtm;8|Jk$A?;rV!rD_Uu2Ha9?>B zQ}l(T?8t`Xgxp-PxSOjEoqJ_1oPVZWt;LOJFYpa-ika>wggPmhWh^QM;ik%8RTwol zX=l_XSyoV>r`IJ~)-UT`SPCl&!*;lQ*vqgxL>-kJtYXqwI2VAYNItJx9w zyf0TuCFqita{^_#Woc=C#pP2Lz!^_|4$0i+A0GJQCCsSs1;w_;To2TOTo&q-&wC6_hhQiTJDvU}dup%8@j%)t zqTBUGoN)Cjn>EZ^nDSiH8)OiwW>r{HgD-svji=Om{6EaQvq|qS&5KrR1JtAi&1Vm} z2?|MJoVF{Pb@>M6xR5h*&(^1peq>&)GXkz`T9x6mr<}|~UqE0@W{$Nig*asRz=H&m zTzUr*MO{eg=)QNkAB%rKohY-MSSVolK0kTQg||52sn9uhN&vgXTc55_Z*JMEhho_y zjZd|>HFQ#BfPI;=nrN-ef)FdCSZ2%Ptq8fC_bk)yuH)BijRk~-w&GoGXZjRe5l=@KHKe}*`qs!|EThQ=M+>b}Sz*La?B z%UZyLT^f06zjAiDh*n)bN9>$bO%|X_#V1cI!H;y|upC0*^F2skyWJK2Qr-lKSzv$x zGPL%k@^QG?lK$lI)#*(}Huj#RkB%@HiuMUo^bKd)l1N$Mwq@}Sz-$jTB2^!+#xb=ByY=(iHGIyAYFV}Q4-1Gi^X#9d9{bAB% z!31-QJJkHU!Ijq41jvZA1z1L}Pd98%=Qx1S1?fzl2)jX3hC6GLz$@e+oTAjW5on1{ z?@hY$0YIw^z?FRg`KFVzsfaTLQn~OiT{g&*1hCQnq(i`JTnHGA%(C~No=7g9(c5pJ zH=gz`mcuqL!UmpDO9L77t*=Q+%sMAPd$m3IOD8Of(T7SsE9OsdR!j5#)A}%Qecl;G za!VPDP@sRl>-fm?@(*ld@^zjJuj^UO7TWwU{bc!8$*Oz!1nP;dIZ4IViM8$#29#tB zI|LBq3TRt4l#^CA8)hd`D7w)QaqT&Y`TydP3J@O~MA-&;C`{-=01W2laW0Qt5Oqnv z-Clh<%s>s4xDD;}=FJr9Vuyyg%~%b)#T|tn&|y1-sJB^g$MEy>I7!pU1WWFZTTxms zI##~(z;*tH{+H`~0c8T-A+p(-@jZFnc&L_J+Hfej@6{LkGOHX^T8ge3Pq5}MMZ2t2Y~_MEcXC?i7mk75tIr-y6V3KNkayBhcb)W{8XwY*j7i^fIvaM6@Vdy zZBwk|V;%x7OJJa>ljO8Y-qUWHEO?se5GPKa3JE>_(cX-%rqAT8zj6kE2e$!W7Z^I@ znqC#99=Cb@PHxY~R#QCMTBKa0gHjJ=MQfG z&ZC@D9MzomS)4B+X*g&2fI166ko<+YP#ON)Lj<94yEDu!iY)FwINinC$ zKQ=%fsz7{4C81TWD^L4B$SMioV&tq9Lh%y`Dm7WQEul{uU?h<^R8zZlX!3BB+6hU2 z=GXtO|04*krN9(m#p&`~uVxQw*-ElN74k!@DZe89Reu3Bi!~slc~d80p;*tOLyPI| z$o8KXE1*M&*hB!#5%VdS=D$~HK!EQtTmt3|_K z{O{St#RBMIUfbDMrL`2QSI{PRD2NdefM z^vDXWAD~eQa7cYh0V@Ky)`RAE{C&p%2Zs+Vwa}ryyX)-9;Z^SJ>#;bV7@Q88{ZCP~ zrh(Ex2T~*)u71a`)H#0ORs6LlBpZ}Va`g9vtcf5s?10+sk78M9BUQN|2GWL)#J{j- zd^HSpERSl2(U$l#R~zu9phtw%U<8_TOQB9dr_-A4lkb-f0x^0Y47Veb&U*M|0_yLt zy~}9#%8bQJ@vX*J_dgL z8;+;EWjBd<>u#Gj1-O^w&*LZw^t7g%QM2kp^{B0RPC^}e3?}%5cA5V$=Br_{rb@x~FRGImTG}>R~X{gI9Ry73{Lm z4(&Udj6>D`hGQC5%DZGx1CS`X81;mcL(Vbwl`>ZvMA$nlKMu)DEEk=CpU%KH<5&P-o+07VY1ZMQ_#BsSBa4~1^x zQFqi2EXB7Jx96A;99h7vtjz5QV3cf3I9pp=kZ{+6-yKQJHJ0R}R8l^Vmp6tN6ptpF z3`GP`w0iE^MuHQ&6lTsbF%8;$YqiPi%{^}j1h#Nh%e-i0gMx^3d|Ym*SNP8P4hb72 zWMDun;P)C6>$J#7t4;A10tVLCJz>R}B2rrak8th{pM%ygR`L@ST0Mr2pVUfS0wNQ0 zI68XXPBAy!4o(E6|2*kjVtUKe;CRuY?E>@(8FQ92YF@U!l!L;m)6EHMD}(4C$230R z?h20<3TJMuokz3lN4ZwruE!{^fXMmOhCKiayak@=jBT;qT96t1(wh>pJYTMYW7>6f zjII-^4gJfcZ!~pZU)hABXCFf`pfof+x8!VAh_*ZroI>J9tTHUyL`;Ta6@OH@Y)~tncTSB^QwTfkEzL2LD<(#%KF+B0w4G18sgk{+yvR!}1nEc4}uA3l^zsJ5TX73+pK{_ zce;FW;%MN*hCA|^5;_izp_uq^FAx%ClxT89uPD5(TbfbrckymH<4BAIiEqOq{EneY zmNq@onFos#aH81v7m}C3?iyYfF#*P&x8H??g^4&guq2eq2BT`GKizy}t+DpwMA1=4 zh@k9=(uMRQ^Dax(k6abr-#p$i5@!qvxpgB4M?(5cVFZ#e(f-AzJJDLkYg8}ZkCFx? zz(;f)*%1L}4otXw0wX}$xEu9p$_nro1PXq*&c=K^T+U#mXZ;YJ=`U!l_r33_!7^DQI$G?ujsgLTO zN~)adHnIV^B+%Gbf-mYHwK|#ah`o`W(egQpryY1saa&$7?5F&0u_6HL69M{h}V3`vlnK+AVajol_424^V04uBe4tUZ_UA7_JCOhn%?wyyiDhz0Niu;AnBV3N&KOVNqwzFCm6=a^6ZUzCZ#$BWPE9OjI}>bI;6t zms=#~mwIr(p~k|XHM@CLOpxV~X-_E$JF#`9s6m#VHL&Iy9OaI8uWomYvX?Msbra`m zIX6n*eubbv<#9wVK1J77J2w4LCh3(6Lpv5{#$xDTXDSrRxnQ~z>HLx%)?PrNhwpJK zi@(068g0F~z~Sn+;ZWCDbgT;swz+E7n>&`QGoaeNlI#wD^c{J&iZWQ zEy_~{OTXr3OvRN0B8RgbHdB0^DD92*R*jE-O!cdIUyGu0${y;L!6@{5s7~~Bp+6NP z6)Am%eA6i+rHwqWX(6o8dDz=*zfs=WeotB@cbI7B71!jQHe20RDx1eZ(%MBIzi+Qu zRvUH_x9q!VSPF}heDfQnF}ly<vmA%Q?%0p?75tR6QMU zh+!Vej0tz`zuICO3Fxs(hhM2KZlRM&&e?f?+rAA>{^2TxRt?q7|_#L*hkOeyQxGuPfyv-I(bT zuKbF(9$;vJ(yuTp<_s1<+Gxqwg}l-(jMzJvvruX9q>UJyX}N&!cCzS;4bm^3H&aQk z0w$<%9pn5}_Kb@cl6$1Rz|==}uzAbQx&ESw7UBhEJ3OlYSo)#x=@UlR?==G6Htt@q z;sYxBtWu{DdXYP;pQ<|2aw5v#hp2`8R=os4=gpUe@-@jNST=r2};?r?+4$wf7P z2?hfa-Aj!a_NJJC=kSc-Nv7k!Uan^&K40X&BTLBM?}A@qWR5L|8C>yUrh@{isfyUH zCg&_uN<}EFF!C^*up-WA4RlxCp3O@Z&(3Xm=Pky}fv^WJ5Q~A%9`w$e%}u>^l+H~| zHMiA@Yo0l#^Qwfy-X%S#zUTNtn@3I7(|PG+Gx2C+%7K#IOcUQp<)i=`#&bi~FyND5 z3R>}($$-(?_d>%<-U57)JM)S$6M}RhgZtTdQm?66)y&$k$Y4J=6>HM=n z-$ri2*6NDMgSnUrC?R1FLbVQNM>9?0GB<3cl3a+2&>AZ`qTPXBw=Y;S_P!!IsO~vO zMxrNX-Pa;$IE6PhykfdL8AEV(V%av6Ve<;X^ri5WY23QB7E~)o@~OgNJu8WZ3VCza zPCkwT=#o6~uf{XGbLn*z#lE!=WQSbtYWT|aZlt9`f~K37C;=soSj zq=*+nz$~}zHY^}Ql^%FHQ#~{qp}d`(=RPbAti=BPY*Zry`gDq<qHhcr$?H7zBl z9nK;!JReaLL{CvP&aY7uI}PyKgBSO3?IFP^n1Nsq&+{sD7cQ=?4C`>QpUtJ${hr~l zUHakd>v6ho+=d}ic~kR@seQ;`XQ~fmk^5P2##e+pGzsxqWT0@QSk`O93%-q!|3-S@ zB8!n9NCgRISEcfiom(D#=2r4#rXo|2UxvjKRB( zW+s_fzMAI^;Zh?Qg|;?7c4DFql!drj^_F@(@a{*$)JtA;r0p|h)adu9PVIV#y>On%ci@Id0if$wOUZ`~GDKWG(c# z!76UBp8#X#89O`wnl~_*`LK+tdxs%aH)l+m(jaExp14xx*%wyy9ITkU% z${?lcIKOd|qYdaOq*yExO86^k@SXiR1r`&?Xvpx78B^**>Uj*%M=Ed+$^D8CDDmkI z|3~5Oby__+)A25i7CkF<{MqP8bDb%SUbRX)4xjvGJLf3Rb|N8B9`@O@yzk|_O?r0KFQtQ$tm|F z7v5$|`vcRn9qv&xJAu0YJ?fq22TdD#c6N3$yB(>AMQ`xYZ5RzdKmT$8p{LCGByb5w zZvAAWqe}XFG8#^36~gyc25@x`Jl{Bw!xE&+-sv?*zKsrsXuH5iHItC z(9Q$Sj{HYA+m)H@bnGy7X3a6yGp5)w|6Ca#t1(V+5pMOdWG_ts2gB^W!evR z5KX`=D$mt=YYLWGwAN>cc8(muz%Y?=au*rBKkUfUhn$7FzPu0D{>a6yj7I|a1GdP& z2^g9*iRE#?#VO|Xg4AOvnLN=!*LD3^laR0L(O2H^F)gyB+5u0@cc<|?m!HSzstUYB zZs`mA1K?}TSox@>gH4{U7Ur=^|9bt;$W5u8aNi;JV7O<{ETIFvJ1*F>#vP1D!=Q%-{{u77t}gPh zYKPE6`*yorgv~07Z}S(zs_RMlGRHxk$xPidbSDF~j;8v@2iJU}qO&KI+|ioA zCjQ5Yy83?aqoj==O%9D6P4J#4!Mfzavc!FSCu!{FTytFhh`NP3`PAhYU;|~PRSGHG zu`^7CD*goumr0U;pjdRf44M#Nxrn)LZHK8aVrW8{6G|UNhh{wJB97Sw#dvSqjug^; zj=#-vz^1E^zj5A(Gl@TS^6@5DLIsyRnoP#BA$a0Sk)|Uk58i*3m_>)>dZ%c1@rVZx=-qLUMieS4K^7qKY?>@jn z>TeW=UCH(BjgKt?Or|{IxIYd|8Hzk<=j*Yoz(}>)g8|T<-{>{L|J>AwFV<3^@en

    Ac0bmM ziUW&jmj)z!j)3ghDMp@9cF#5vZ4bv2|9dAQNa< z{1wtqZk{y$Ul!TtBCKRBvAJd~wx_g!?_llGwka)2PyY}YKogn*tqAjm!^uOEK|Q%i zh%QmdBs=)~bO0L1XCG{UAZK`~7xep6|C>QoBSkAeg(sxV{#&x>n-pN;`u7b_%-_r2 z0sax50AN@u!{4}nmvaF3p9Rc|C%ZdK>i);PQ~*pX^8cRAVOULXjZ(0#wqiDRZaga2$s>SC)L{{z8@+)>+pYdZj% zNAL{>90M4bfrbl5`*9HF*VFcA?Tobln0m4pXho^FCtx|5ornuwDCJ5J>sHZS9mvl; zB}O;a3w}04iE)yDZzuvVt8bSB@}%?)C;7&0Jr$n*D({|dchZ8U4flVHNnleAsfiZY zl=}%0?tQG+ddaQAnff%OVwkQ6mqDVksY2m@3Pm}jMv`XJNBRdBZF8DFmfxu5px4`s z%z%Qj_OM}XR%t0T8nhJt2N+mTJ~S>a?qSX1yRQg|;2&Zr=?=W0!Kc~YZv1pdXEV$m z@68iz$onC~^*o5irKKLI9<=4K|33n8O?g)`BsjJT=-Avn}9 z?fmgcsym2z?(vp24!qu`8FX|Cy^5tB;Yl%K@ist=O)Y8*B20;3z?JMY2){dRZi#$Q zGs$fK^R>)&+!nK>*`VVpOkP4)8WQZKT|g~_gP~h=nS( zf)00-mBg~{gbjBu?NT2*rQA9k$nE$zi0ZTs7Xv5W5YMBIY1==sv5%uf)??h0GSY7@ zhes=_D+q5Co1I=&xcD-xJy$`jOz=O*``R2`J90gW%0>&)+0>wtZL2A0KM(K`_2g_v zo6+)bbGILoX4hsg?WD)mv7DIlJAOxUJTN2*X`|-7hJ3*1@de>TW~#JcaB-qJeP>Up z;xr_Ki{B%VzCqfFF60ueWR|aA40x_tQz=Wp+~of5dHQNBBszsCH5hB?ynD13oPS#& zkB2`aesGhUL?}*G3wk1-!Htc>EF3hfHok+Z$*It;2+c$iL%S&>X+a<`c)m zs>mqxGB|Zhm6xg?lbQ;?yW3kvH6xU9bPodC(UWmPdbT|0fYOT0g=hC$mHYMrLNRE_ z9rElXjTHHn%Rsy^-kz)N?GyF7eZ{Im1M;_4=;(B$1Ks4{wE|9oO~e36^>ftSs=gCx-D;0CO%FbZPf4W9X-I$9b*hrQgfr%H$Jut*na z)_Qlt)7)R)@;LStKnL@`T=0<`r!H@5)Irgq=Y8?jpg#%G%Q6jEX3mG%omX((eed<4YG?n9a5LwsT!ZTlY#xU6zQP>kDOyC;y1y3iGD^9HG z6#O*+!=2|IL~y}SoF$Vt&Nkk&Z`<{wc4{gh7eY&jd3fXC{Qfbrdp2-~I^yRD z8xEZP><6&hH>L%Tb4#3$iG{i#Uq$HWm*_w+Z0pCh_FxvcAGT#on86!?G%I+*Tu-Zp zR*sLK@6vd}aXf=B!6)w6k6WR<&^vH2=N*bl%6ohR6;ND9o64jXZ)Ty`h>{3toS^eb z^;SOAz`d+m(!Zw}tqa-=D7Dq=V4IeP(wEYsMxlT0Wijv{{F2L!#_XU7$(dH4Ml=Qqu@QPq(TR}LitamWX_VKO+SzbTY~#yx7bcQBtIB+|DFmi-Sj&Uvn!yIvT{&!3o&FWMcMI{1A}1T3CrR7Al0 z`;(6ddUucJdHKTp!tJgu1v5$c;k&fsSWita^UT=XhNGmZ`Iq9b>yEaKYVS>9EMOBB z1<&SjRs&FP+p4w?9E#vVG4HJNvVPakI)n&K`*??^!VmCgKJQy>X@TU_?Gp=I3zEaz7D8z8K!)O$K@=~`wVlwD1lzpu6+-q2N^=WJ+NQ(FSX1g;nx8J- ze5~hj22q_sL_)K&`uH4D+Xp?z%ryCiT4_{v+%hwF;DmFUMGA686euNUm8OUK-=V)` zW6+9b@9|_#c=dyOLc17=vm*ISic;b(4HXs^&`-(fu~ z)@Lew7Ct9!g=C)QpO~hd;vEyYMN^wNBxJZ^l?;fsd6$4e9Bb)!PbJVl>SN{SC9uwb zf8i{_BPpx+(6f{JLXBdOUTnBmiUkp^E^#-pZz&jRLa<^p)5VqG)Mj% zMM}E~<)ek3)BcddU4u2`l&fAMPF7xNVv1uNIQ| z5nq+@1TLSbui<9msz1cAHE7Xs5?SK8KZr~z@oubIUqu}|;XNvWPCqQ%TQE+$9OgPp z%B3tHH8xOgz}=XAzmz!fyfUd7iI1lFm4K{H}2=iTzQi{)Mal#CmEW z{625Gr0h4*^zRxI-b{fe-)S;ha|PXCMt`k&S}augtv0s+BO}B z>ZKi?Q>QAX#SZ^ohlY*90bkb$Azc50AoX1QO3M?LHvsZ_#{#aO(#WUH9tBoC7>6h= zU%SPS%3vnS-hqz3#Y}@SW0H1~$*e#4)1Dfp0Jpt6ELwL&Xs0%#G7>{IJrFWYQfzkZm>!o~rs<9X3 zq3hd@V1Zc6Wa^uK>iMEqRf7~lYNf4fHmQ;kk~YS0Sy-$+BVsE>0ZI z0*$|T@RU&^{$TL(e#emKxMFr~le`Rj4d1Ue5nf%H_P0%I2@bpf(0yQfY|g2*-U-X0 zVnvTT?2oR^#nRY_aoGdAe!3Stc3Yi3EiQw6m~=zJL(3u2D@?`A9FjoT@PBw4 zodwxswugZdMHlG3gvo1z{2l|{$|>GKpv+C$@A#_hG+@@oqUL`K|Cxl7_CgMRC3RH9 ziqW@C<++Po=z`!g+?mjm~H z&2S=-3Qh}B>&g*lRU5O~pSpdM^o#WxXuRsBdWhD?{fBRUzDwW3HkNMzK{U_MLc5CZ zCcB4xF0yao8M#aRsGPooe!q1KI{{33m&jzrCh>9}rpi{uAyGdf$mEUnn&6Lve0p0!ka^>gq8?ZJJ| z>adZYyH$y77T4Bc>(b02SX?F7Bg$T2$q^ZI=g_q0q!LfSW99$Ze8bQ8)<5{@{>a59 zf6;ICWxzRNhM023tIp3e?-t8%Sw)$AMe>*TomF1(s|m5(p-FJZLME$& z5gnGWzMq@#gI#Y9$!;|b3V^ImXgT2P1l&HQwlgpZbpHlWosSM^`_${Y4pWGxg2|xm zQ=WNKW@v)?egaIw-N4S^kzMjh&{N#+r~rF|`IDqo)4&thEeDP$0ark5eAgZUJ!j3F z6SRZtiCgDPh=~RpK|8qC{8qdM?fUvUJ^0VO^zDtbyp%I@7=Xaj)z4*}Q$iB}l6?o> literal 0 HcmV?d00001 diff --git a/website/introduction/security.md b/website/introduction/security.md new file mode 100644 index 00000000..c81b271a --- /dev/null +++ b/website/introduction/security.md @@ -0,0 +1,151 @@ +--- +layout: mcollective +title: Security Overview +disqus: true +--- +[broadcast paradigm]: /reference/basic/messageflow.html +[SimpleRPC]: /simplerpc/ +[Authorization]: /simplerpc/authorization.html +[Auditing]: /simplerpc/auditing.html +[SSL security plugin]: /reference/plugins/security_ssl.html +[ActiveMQ Security]: /reference/integration/activemq_security.html +[ActiveMQ TLS]: http://activemq.apache.org/how-do-i-use-ssl.html +[ActiveMQ STOMP]: http://activemq.apache.org/stomp.html +[MCollective STOMP Connector]: /reference/plugins/connector_stomp.html +[ActionPolicy]: http://code.google.com/p/mcollective-plugins/wiki/ActionPolicy +[CentralAudit]: http://code.google.com/p/mcollective-plugins/wiki/AuditCentralRPCLog + + +# Add{{page.title}} + +Due to the [broadcast paradigm] of mcollective security is a complex topic to +discuss. + +This discussion will focus on strong SSL base security, this is not the default +or only option but is currently the most secure. The [SSL security plugin] +provides strong caller identification, this is used by the [SimpleRPC] +framework for [Authorization] and [Auditing]. + +As every organisation has its own needs almost all aspects of the security +system is pluggable. This is an overview of the current state of SSL based +Authentication, Authorization and Auditing. + +

    + +The image above is a reference to use in the following pages, it shows a +MCollective Setup and indicates the areas of discussion. + +The focus here is on ActiveMQ, some of the details and capabilities will +differ between middleware systems. + + * TOC Placeholder + {:toc} + +## Client Connections and Credentials + +Every STOMP connection has a username and password, this is used to gain basic +access to the ActiveMQ system. We have a [ActiveMQ Security] sample setup +documented. + +ActiveMQ can use LDAP and other security providers, details of this is out of +scope here, you should use their documentation or the recently released book +for details of that. + +When using the [SSL security plugin] each user also gets a private and public +certificate, like with SSH you need to ensure that the private keys remain +private and not be shared between users. The public part needs to be +distributed to all nodes. + +The private key is used to cryptographically sign each request being made by a +client, later the public key will be used to validate the signature for +authenticity. + +The client embeds a _caller_ structure in each request, if SSL signature +validation pass the rest of the MCollective agents, auditing etc can securely +know who initiated a request. + +This caller is used later during Authorization and Auditing. + +## Connection to Middleware + +By default the connections between Middleware and Nodes are not encrypted, just +signed using the SSL keys above. [ActiveMQ supports TLS][ActiveMQ TLS] and the +[stomp connector][ActiveMQ STOMP] supports this. + +The [MCollective STOMP Connector] also supports TLS, at present we do not have a +complete sample of such a setup but this is provided by the Rubygem and should +work. + +Enabling TLS throughout will secure your connections from any kind of sniffing +and Man in The Middle attacks. Unfortunately the Rubygem we use do not provide +options for enforcing a specific CA etc. The authors are willing to extend it +to support these based on requests, file support tickets if you need our help +in working with them as we already have a good working relationship. + +## Middleware Authorization and Authentication + +As mentioned above ActiveMQ has it's own users and every node and client +authenticates using these. + +In addition to this you can on the middleware layer restrict access to topics, +you can for example run a development and production collective on the same +ActiveMQ infrastructure and allow your developers access to just the development +collective using these controls. They are not very fine grained but should be a +import step to configure for any real setup. + +We have a sample [ActiveMQ Security] setup documented that has this kind of +control. + +## Node connections and credentials + +As with the client the node needs a username and password to connect to the +middleware and can also use TLS. + +It's not a problem if all the nodes share a username and password for the +connection since generally nodes do not make new requests. You can enable +registration features that will see your nodes make connections, you should +restrict this as outlined in the previous section. + +All the nodes share a same SSL private and public key, all replies are signed +using this key. It would not be impossible to add a per node certificate setup +but I do not think this will add a significant level of security over what we +have today. + +## SimpleRPC Authorization + +The RPC framework has a pluggable [Authorization] system, you can create very +fine grain control over requests, for example using the [ActionPolicy] setup you +can create a policy like this: + +{% highlight text %} +policy default deny +allow cert=rip * * * +allow cert=john * customer=acme acme::devserver +allow cert=john enable disable status customer=acme * +{% endhighlight %} + +This applied to the service agent will allow different level of access to +actions to different people. The caller id is based directly on the SSL Private +Key in use and subject to validation on every node. + +As with other aspects of mcollective authorization is tied closely with meta +data like facts and classes so you can use these to structure your authorization +as can be seen above. + +You can provide your own authorization layers to fit your ogranizational needs, +they can be specific to an agent or apply to the entire collective. + +## SimpleRPC Auditing + +The RPC layer can keep detailed [Auditing] records of every request received, +the audit log shows the - SSL signature verified - caller, what agent, action +and any arguments that was sent for every request. + +The audit layer is a plugin based system, we provide one that logs to a file on +every node and there are [community plugins][CentralAudit] that keeps a centralized +log both in log files and in MongoDB NoSQL database. + +Which to use depends on your usecase, obviously a centralized auditing system +for thousands of nodes is very complex and will require a special plugin to be +developed the community centralized audit log is ok for roughly 100 nodes or +so.