From 8b0b25e7c13e0726e39b04d7c15d7579dd137bd6 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Fri, 9 Jun 2023 15:48:57 -0700 Subject: [PATCH 01/26] Update VSA for SLSA v1.1 Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 44 +++++++++++++++++++++++++-------- 1 file changed, 34 insertions(+), 10 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index bdbd16497..bb176b28d 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -34,11 +34,13 @@ Understanding of SLSA [Software Attestations](/attestation-model), A Verification Summary Attestation (VSA) is an attestation that some entity (`verifier`) verified one or more software artifacts (the `subject` of an -in-toto attestation [Statement]) by evaluating the artifact and a `bundle` -of attestations against some `policy`. Users who trust the `verifier` may -assume that the artifacts met the indicated SLSA level without themselves -needing to evaluate the artifact or to have access to the attestations the -`verifier` used to make its determination. +in-toto attestation [Statement]) by evaluating the artifact and an +attestation against some `policy`. Specifically, a VSA is a claim by +`verifier` that `subject` passed the policy for `resourceUri`. Users who trust +the `verifier` may assume that the artifacts identified by the +`(subject, resourceUri)` pair met the indicated SLSA level without +themselves needing to evaluate the artifact or to have access to the +attestations the `verifier` used to make its determination. The VSA also allows consumers to determine the verified levels of all of an artifact’s _transitive_ dependencies. The verifier does this by @@ -122,7 +124,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > can sign provenance for the "Google Cloud Deploy" verifier, but "GitHub" cannot > sign for the "Google Cloud Deploy" verifier. > -> The field is required, even if it is implicit from the signer, to aid readability and +> This field is required, even if it is implicit from the signer, to aid readability and > debugging. It is an object to allow additional fields in the future, in case one > URI is not sufficient. @@ -132,7 +134,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > URI indicating the verifier’s identity. -`timeVerified` _string ([Timestamp]), required_ +`timeVerified` _string ([Timestamp]), optional_ > Timestamp indicating what time the verification occurred. @@ -140,13 +142,17 @@ of the other top-level fields, such as `subject`, see [Statement]._ `resourceUri` _string ([ResourceURI]), required_ > URI that identifies the resource associated with the artifact being verified. +> +> This field is required to prevent confusion attacks. E.g., a VSA indicating +> that a package can be published as `foo` should not be useable to publish +> the package as `bar`. -`policy` _object ([ResourceDescriptor]), required_ +`policy` _object ([ResourceDescriptor]), optional_ > Describes the policy that the `subject` was verified against. > -> The entry MUST contain a `uri`. +> This field is RECOMMENDED. `inputAttestations` _array ([ResourceDescriptor]), optional_ @@ -167,7 +173,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > Either “PASSED” or “FAILED” to indicate if the artifact passed or failed the policy verification. -`verifiedLevels` _array ([SlsaResult]), required_ +`verifiedLevels` _array ([SlsaResult]), optional_ > Indicates the highest level of each track verified for the artifact (and not > its dependencies), or "FAILED" if policy verification failed. @@ -240,6 +246,24 @@ WARNING: This is just for demonstration purposes.
+## How to Verify + +Verification SHOULD include the following steps + +1. Verify the signature on the VSA envelope using the preconfigured roots of trust. +2. Verify the statemet's `subject` matches the digest of the artifact in question. +3. Verify that the `predicateType` is `https://slsa.dev/verification_summary/v1`. +4. Verify the `verifier` matches the public key (or equivalent) used to verify the signature in step 1. +5. Verify that the value for `resourceUri` in the VSA matches the expected value. + +Resulting threat mitigation: See +[Verifying artifacts](/spec/v1.0/verifying-artifacts) for details about which +threats are addressed by verifying each SLSA level. + +IMPORTANT: A VSA does not protect against compromise of the verifier, such as by +a malicious insider. Instead, VSA users SHOULD carefully consider which +verifiers they add to their roots of trust. + ## _SlsaResult (String)_
From 12338297674d3781a12eea7ce2f95263bfe12b9c Mon Sep 17 00:00:00 2001 From: kpk47 Date: Fri, 23 Jun 2023 10:44:28 -0400 Subject: [PATCH 02/26] Address review comments Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index bb176b28d..36f27e0ea 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -34,8 +34,8 @@ Understanding of SLSA [Software Attestations](/attestation-model), A Verification Summary Attestation (VSA) is an attestation that some entity (`verifier`) verified one or more software artifacts (the `subject` of an -in-toto attestation [Statement]) by evaluating the artifact and an -attestation against some `policy`. Specifically, a VSA is a claim by +in-toto attestation [Statement]) by evaluating the artifact and its associated +attestation(s) against some `policy`. Specifically, a VSA is a claim by `verifier` that `subject` passed the policy for `resourceUri`. Users who trust the `verifier` may assume that the artifacts identified by the `(subject, resourceUri)` pair met the indicated SLSA level without @@ -251,9 +251,9 @@ WARNING: This is just for demonstration purposes. Verification SHOULD include the following steps 1. Verify the signature on the VSA envelope using the preconfigured roots of trust. -2. Verify the statemet's `subject` matches the digest of the artifact in question. +2. Verify the statement's `subject` matches the digest of the artifact in question. 3. Verify that the `predicateType` is `https://slsa.dev/verification_summary/v1`. -4. Verify the `verifier` matches the public key (or equivalent) used to verify the signature in step 1. +4. Verify that the `verifier` matches the public key (or equivalent) used to verify the signature in step 1. 5. Verify that the value for `resourceUri` in the VSA matches the expected value. Resulting threat mitigation: See From 68adac3855ca8403947b5b9b5b1cac6a56f2aeff Mon Sep 17 00:00:00 2001 From: kpk47 Date: Mon, 26 Jun 2023 15:18:42 -0400 Subject: [PATCH 03/26] clarify that you can set verifiedLevels without setting policy Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index 36f27e0ea..f3bfdd673 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -182,6 +182,8 @@ of the other top-level fields, such as `subject`, see [Statement]._ > level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies > SLSA_BUILD_LEVEL_2 and SLSA_BUILD_LEVEL_1), so there is no need to > include more than one level per track. +> +> This field MAY be set even if the `policy` field is not set. `dependencyLevels` _object, optional_ From 956dc5aa7b997e03be3956e5f21ae7825a089c4e Mon Sep 17 00:00:00 2001 From: kpk47 Date: Wed, 28 Jun 2023 09:31:43 -0400 Subject: [PATCH 04/26] Clarify that verifiedLevels can contain custom values. Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index f3bfdd673..6fea86f31 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -183,6 +183,9 @@ of the other top-level fields, such as `subject`, see [Statement]._ > SLSA_BUILD_LEVEL_2 and SLSA_BUILD_LEVEL_1), so there is no need to > include more than one level per track. > +> Users MAY add additional, non-SLSA properties to this field provided the +> values do not conflict with the definition of [SlsaResult]. +> > This field MAY be set even if the `policy` field is not set. @@ -255,7 +258,7 @@ Verification SHOULD include the following steps 1. Verify the signature on the VSA envelope using the preconfigured roots of trust. 2. Verify the statement's `subject` matches the digest of the artifact in question. 3. Verify that the `predicateType` is `https://slsa.dev/verification_summary/v1`. -4. Verify that the `verifier` matches the public key (or equivalent) used to verify the signature in step 1. +4. Verify that the `verifier` matches the public key (or equivalent) used to verify the signature in step 1. 5. Verify that the value for `resourceUri` in the VSA matches the expected value. Resulting threat mitigation: See From b0a877b707a94c6ac27036deda2b531ecc482b59 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Wed, 28 Jun 2023 17:39:31 -0400 Subject: [PATCH 05/26] reworked How to Verify section Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 77 ++++++++++++++++++++++++++++----- 1 file changed, 67 insertions(+), 10 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index 6fea86f31..28681f89c 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -184,7 +184,11 @@ of the other top-level fields, such as `subject`, see [Statement]._ > include more than one level per track. > > Users MAY add additional, non-SLSA properties to this field provided the -> values do not conflict with the definition of [SlsaResult]. +> values do not conflict with the definition of [SlsaResult]. Users SHOULD +> negotiate the meaning of such properties with their intended verifier. +> +> This field MAY be absent if the verifier is not attesting to a specific SLSA +> level. > > This field MAY be set even if the `policy` field is not set. @@ -253,22 +257,75 @@ WARNING: This is just for demonstration purposes. ## How to Verify -Verification SHOULD include the following steps +Consumers use VSAs to accomplish goals based on delegated trust. We call the +process of establishing a VSA's authenticity and determining whether it meets +the consumer's goals 'verification'. Goals differ, as do levels of confidence +in VSA producers, so the verification procedure will changes to suit its +context. However, there are certain steps that most verification procedures +have in common. + +Verification SHOULD include the following steps: + +1. Verify the signature on the VSA envelope using the preconfigured roots of + trust. + +2. Verify the statement's `subject` matches the digest of the artifact in + question. + +3. Verify that the `predicateType` is + `https://slsa.dev/verification_summary/v1`. -1. Verify the signature on the VSA envelope using the preconfigured roots of trust. -2. Verify the statement's `subject` matches the digest of the artifact in question. -3. Verify that the `predicateType` is `https://slsa.dev/verification_summary/v1`. -4. Verify that the `verifier` matches the public key (or equivalent) used to verify the signature in step 1. -5. Verify that the value for `resourceUri` in the VSA matches the expected value. +4. Verify that the `verifier` matches the public key (or equivalent) used to + verify the signature in step 1. -Resulting threat mitigation: See -[Verifying artifacts](/spec/v1.0/verifying-artifacts) for details about which -threats are addressed by verifying each SLSA level. +5. Verify that the value for `resourceUri` in the VSA matches the expected + value. + +6. Verify that the value for `slsaResult` is `PASSED`. + +7. (Optional) Verify additional fields required to determine whether the VSA + meets your goal. + +Verification mitigates different threats depending on the VSA's contents and the +verification procudure. IMPORTANT: A VSA does not protect against compromise of the verifier, such as by a malicious insider. Instead, VSA users SHOULD carefully consider which verifiers they add to their roots of trust. +### Examples + +1. Suppose party X wants to delegate to party Y the decision for whether to + publish artifact A to resource R. Party X verifies that: + -The signature on the VSA envelope using Y's public signing key from their + preconfigured root of trust. + -`subject` is A. + -`predicateType` is `https://slsa.dev/verification_summary/v1`. + -`verifier.id` is Y. + -`resourceUri` is R. + -`slsaResult` is `PASSED`. + + Note: This example is analogous to traditional code signing. The verifier + does not need to check additional fields, as X fully delegates the decision + to Y. +2. Suppose party X wants to enforce the rule "Artifact A at resource R must + have a passing VSA from party Y showing it meets SLSA Build Level 2+ that + is at most Z old." Party X verifies that: + -The signature on the VSA envelope using Y's public signing key from their + preconfigured root of trust. + -`subject` is A. + -`predicateType` is `https://slsa.dev/verification_summary/v1`. + -`verifier.id` is Y. + -`resourceUri` is R. + -`slsaResult` is `PASSED`. + -'verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. + -`timeVerified` is no earlier than the current time - Z. + + Note: In this example, verifying the VSA mitigates the same threats as + verifying the artifact's SLSA provenance. See + [Verifying artifacts](/spec/v1.0/verifying-artifacts) for details about which + threats are addressed by verifying each SLSA level. + ## _SlsaResult (String)_ From 60396dbd378f90d67a3ffc717d52adc5f33aeff1 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Thu, 29 Jun 2023 11:23:29 -0400 Subject: [PATCH 06/26] fix formatting Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 57 +++++++++++++++++---------------- 1 file changed, 30 insertions(+), 27 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index 28681f89c..885ca8bb3 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -296,35 +296,38 @@ verifiers they add to their roots of trust. ### Examples 1. Suppose party X wants to delegate to party Y the decision for whether to - publish artifact A to resource R. Party X verifies that: - -The signature on the VSA envelope using Y's public signing key from their + publish artifact A to resource R. Party X verifies that: + + -The signature on the VSA envelope using Y's public signing key from their preconfigured root of trust. - -`subject` is A. - -`predicateType` is `https://slsa.dev/verification_summary/v1`. - -`verifier.id` is Y. - -`resourceUri` is R. - -`slsaResult` is `PASSED`. - - Note: This example is analogous to traditional code signing. The verifier - does not need to check additional fields, as X fully delegates the decision - to Y. + -`subject` is A. + -`predicateType` is `https://slsa.dev/verification_summary/v1`. + -`verifier.id` is Y. + -`resourceUri` is R. + -`slsaResult` is `PASSED`. + + Note: This example is analogous to traditional code signing. The verifier + does not need to check additional fields, as X fully delegates the decision + to Y. + 2. Suppose party X wants to enforce the rule "Artifact A at resource R must - have a passing VSA from party Y showing it meets SLSA Build Level 2+ that - is at most Z old." Party X verifies that: - -The signature on the VSA envelope using Y's public signing key from their - preconfigured root of trust. - -`subject` is A. - -`predicateType` is `https://slsa.dev/verification_summary/v1`. - -`verifier.id` is Y. - -`resourceUri` is R. - -`slsaResult` is `PASSED`. - -'verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. - -`timeVerified` is no earlier than the current time - Z. - - Note: In this example, verifying the VSA mitigates the same threats as - verifying the artifact's SLSA provenance. See - [Verifying artifacts](/spec/v1.0/verifying-artifacts) for details about which - threats are addressed by verifying each SLSA level. + have a passing VSA from party Y showing it meets SLSA Build Level 2+ that + is at most Z old." Party X verifies that: + -The signature on the VSA envelope using Y's public signing key from their + preconfigured root of trust. + + -`subject` is A. + -`predicateType` is `https://slsa.dev/verification_summary/v1`. + -`verifier.id` is Y. + -`resourceUri` is R. + -`slsaResult` is `PASSED`. + -'verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. + -`timeVerified` is no earlier than the current time - Z. + + Note: In this example, verifying the VSA mitigates the same threats as + verifying the artifact's SLSA provenance. See + [Verifying artifacts](/spec/v1.0/verifying-artifacts) for details about which + threats are addressed by verifying each SLSA level. ## _SlsaResult (String)_ From a71652a267b307d1813d381cedde339cd6b39f90 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Thu, 29 Jun 2023 11:26:39 -0400 Subject: [PATCH 07/26] fix formatting Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 46 +++++++++++++++++++++------------ 1 file changed, 29 insertions(+), 17 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index 885ca8bb3..392a26f64 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -298,13 +298,18 @@ verifiers they add to their roots of trust. 1. Suppose party X wants to delegate to party Y the decision for whether to publish artifact A to resource R. Party X verifies that: - -The signature on the VSA envelope using Y's public signing key from their - preconfigured root of trust. - -`subject` is A. - -`predicateType` is `https://slsa.dev/verification_summary/v1`. - -`verifier.id` is Y. - -`resourceUri` is R. - -`slsaResult` is `PASSED`. + - The signature on the VSA envelope using Y's public signing key from their + preconfigured root of trust. + + - `subject` is A. + + - `predicateType` is `https://slsa.dev/verification_summary/v1`. + + - `verifier.id` is Y. + + - `resourceUri` is R. + + - `slsaResult` is `PASSED`. Note: This example is analogous to traditional code signing. The verifier does not need to check additional fields, as X fully delegates the decision @@ -313,16 +318,23 @@ verifiers they add to their roots of trust. 2. Suppose party X wants to enforce the rule "Artifact A at resource R must have a passing VSA from party Y showing it meets SLSA Build Level 2+ that is at most Z old." Party X verifies that: - -The signature on the VSA envelope using Y's public signing key from their - preconfigured root of trust. - - -`subject` is A. - -`predicateType` is `https://slsa.dev/verification_summary/v1`. - -`verifier.id` is Y. - -`resourceUri` is R. - -`slsaResult` is `PASSED`. - -'verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. - -`timeVerified` is no earlier than the current time - Z. + + - The signature on the VSA envelope using Y's public signing key from their + preconfigured root of trust. + + - `subject` is A. + + - `predicateType` is `https://slsa.dev/verification_summary/v1`. + + - `verifier.id` is Y. + + - `resourceUri` is R. + + - `slsaResult` is `PASSED`. + + - 'verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. + + - `timeVerified` is no earlier than the current time - Z. Note: In this example, verifying the VSA mitigates the same threats as verifying the artifact's SLSA provenance. See From 0d386cf0f4a5353f7b91c9e3ae316dde2e6dd858 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Thu, 29 Jun 2023 16:43:26 -0400 Subject: [PATCH 08/26] review comments Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index 392a26f64..6776b7d81 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -189,8 +189,6 @@ of the other top-level fields, such as `subject`, see [Statement]._ > > This field MAY be absent if the verifier is not attesting to a specific SLSA > level. -> -> This field MAY be set even if the `policy` field is not set. `dependencyLevels` _object, optional_ @@ -296,7 +294,7 @@ verifiers they add to their roots of trust. ### Examples 1. Suppose party X wants to delegate to party Y the decision for whether to - publish artifact A to resource R. Party X verifies that: + accept artifact A as resource R. Party X verifies that: - The signature on the VSA envelope using Y's public signing key from their preconfigured root of trust. @@ -316,8 +314,8 @@ verifiers they add to their roots of trust. to Y. 2. Suppose party X wants to enforce the rule "Artifact A at resource R must - have a passing VSA from party Y showing it meets SLSA Build Level 2+ that - is at most Z old." Party X verifies that: + have a passing VSA from party Y showing it meets SLSA Build Level 2+." Party + X verifies that: - The signature on the VSA envelope using Y's public signing key from their preconfigured root of trust. @@ -332,9 +330,7 @@ verifiers they add to their roots of trust. - `slsaResult` is `PASSED`. - - 'verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. - - - `timeVerified` is no earlier than the current time - Z. + - `verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. Note: In this example, verifying the VSA mitigates the same threats as verifying the artifact's SLSA provenance. See From f841bcf1df34b76e531fa30c8606284795da58b1 Mon Sep 17 00:00:00 2001 From: kpk47 <1079282+kpk47@users.noreply.github.com> Date: Fri, 30 Jun 2023 10:47:33 -0400 Subject: [PATCH 09/26] Apply suggestions from code review Co-authored-by: Joshua Lock Signed-off-by: kpk47 <1079282+kpk47@users.noreply.github.com> --- docs/verification_summary/v1.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index 6776b7d81..c1913ade9 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -144,7 +144,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > URI that identifies the resource associated with the artifact being verified. > > This field is required to prevent confusion attacks. E.g., a VSA indicating -> that a package can be published as `foo` should not be useable to publish +> that a package can be published as `foo` should not be usable to publish > the package as `bar`. @@ -253,7 +253,7 @@ WARNING: This is just for demonstration purposes.
-## How to Verify +## How to verify Consumers use VSAs to accomplish goals based on delegated trust. We call the process of establishing a VSA's authenticity and determining whether it meets @@ -294,7 +294,7 @@ verifiers they add to their roots of trust. ### Examples 1. Suppose party X wants to delegate to party Y the decision for whether to - accept artifact A as resource R. Party X verifies that: + accept artifact A as resource R. Party X verifies that: - The signature on the VSA envelope using Y's public signing key from their preconfigured root of trust. From 46dcb8fd85b4e8c1aac6ac793082c63e7cc72355 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Fri, 30 Jun 2023 11:00:56 -0400 Subject: [PATCH 10/26] resolve issues with verifiedLevels Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index c1913ade9..23d7a1d4e 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -173,7 +173,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > Either “PASSED” or “FAILED” to indicate if the artifact passed or failed the policy verification. -`verifiedLevels` _array ([SlsaResult]), optional_ +`verifiedLevels` _array ([SlsaResult]), required_ > Indicates the highest level of each track verified for the artifact (and not > its dependencies), or "FAILED" if policy verification failed. @@ -281,7 +281,9 @@ Verification SHOULD include the following steps: 6. Verify that the value for `slsaResult` is `PASSED`. -7. (Optional) Verify additional fields required to determine whether the VSA +7. Verify that `verifiedLevels` contains the expected value. + +8. (Optional) Verify additional fields required to determine whether the VSA meets your goal. Verification mitigates different threats depending on the VSA's contents and the @@ -309,9 +311,12 @@ verifiers they add to their roots of trust. - `slsaResult` is `PASSED`. - Note: This example is analogous to traditional code signing. The verifier - does not need to check additional fields, as X fully delegates the decision - to Y. + - `verifiedLevels` contains `SLSA_BUILD_LEVEL_UNEVALUATED`. + + Note: This example is analogous to traditional code signing. The expected + value for `verifiedLevels` is arbitrary but agreed to by the producer and + the verifier. The verifier does not need to check additional fields, as X + fully delegates the decision to Y. 2. Suppose party X wants to enforce the rule "Artifact A at resource R must have a passing VSA from party Y showing it meets SLSA Build Level 2+." Party @@ -344,6 +349,7 @@ verifiers they add to their roots of trust. The result of evaluating an artifact (or set of artifacts) against SLSA. SHOULD be one of these values: +- SLSA_BUILD_LEVEL_UNEVALUATED - SLSA_BUILD_LEVEL_0 - SLSA_BUILD_LEVEL_1 - SLSA_BUILD_LEVEL_2 From abe634c228a919d8b27931ca887538c2cc4a1d50 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Wed, 5 Jul 2023 10:55:57 -0700 Subject: [PATCH 11/26] Clarify wording around roles; update introduction Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 121 +++++++++++++++++--------------- 1 file changed, 64 insertions(+), 57 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index 23d7a1d4e..5ade1deb0 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -4,22 +4,23 @@ description: SLSA v1.0 specification for a verification summary of artifacts by layout: standard --- -Verification summary attestations communicate that an artifact has been verified -at a specific SLSA level and details about that verification. +Verification summary attestations convey high-level information about an +artifact's verification, allowing consumers to delegate verification decisions +to trusted third parties. ## Purpose -Describe what SLSA level an artifact or set of artifacts was verified at -and other details about the verification process including what SLSA level -the dependencies were verified at. +Assert that the verifier has verified an artifact or set of artifacts. Optionally +include details about the verification process, such as the verified SLSA +level(s) and the verifier's expectations. -This allows software consumers to make a decision about the validity of an +VSAs allow software consumers to make a decision about the validity of an artifact without needing to have access to all of the attestations about the -artifact or all of its transitive dependencies. They can use it to delegate +artifact or all of its transitive dependencies. They can use it to delegate complex policy decisions to some trusted party and then simply trust that party's decision regarding the artifact. -It also allows software producers to keep the details of their build pipeline +They also allow software producers to keep the details of their build pipeline confidential while still communicating that some verification has taken place. This might be necessary for legal reasons (keeping a software supplier confidential) or for security reasons (not revealing that an embargoed patch has @@ -28,31 +29,27 @@ been included). ## Prerequisite Understanding of SLSA [Software Attestations](/attestation-model), -[SLSA Provenance], and the larger [in-toto attestation] framework. +[SLSA Provenance], [SLSA Terminology](/terminology), and the larger +[in-toto attestation] framework. ## Model A Verification Summary Attestation (VSA) is an attestation that some entity (`verifier`) verified one or more software artifacts (the `subject` of an in-toto attestation [Statement]) by evaluating the artifact and its associated -attestation(s) against some `policy`. Specifically, a VSA is a claim by -`verifier` that `subject` passed the policy for `resourceUri`. Users who trust +attestation(s) against the `policy` for `resourceUri`. Consumers who trust the `verifier` may assume that the artifacts identified by the `(subject, resourceUri)` pair met the indicated SLSA level without themselves needing to evaluate the artifact or to have access to the attestations the `verifier` used to make its determination. -The VSA also allows consumers to determine the verified levels of -all of an artifact’s _transitive_ dependencies. The verifier does this by -either a) verifying the provenance of each non-source dependency listed in -the [resolvedDependencies](/provenance/v1#resolvedDependencies) of the artifact -being verified (recursively) or b) matching the non-source dependency -listed in `resolvedDependencies` (`subject.digest` == -`resolvedDependencies.digest` and, ideally, `vsa.resourceUri` == -`resolvedDependencies.uri`) to a VSA _for that dependency_ and using -`vsa.verifiedLevels` and `vsa.dependencyLevels`. Policy verifiers wishing -to establish minimum requirements on dependencies SLSA levels may use -`vsa.dependencyLevels` to do so. +VSAs can also be chained together to meet higher level goals, such as tracking +the verified SLSA level(s) for the `subject`'s transitive dependencies. Rather +than verifying provenance for the artifact and each of its transitive +dependencies all at once, the verifier can verify each one independently and +produce VSAs. Finally, the verifier combines those VSAs, with the artifact acting +as the final VSA's `subject` and each transitive dependency being an entry in +`dependencyLevels`. ## Schema @@ -145,7 +142,9 @@ of the other top-level fields, such as `subject`, see [Statement]._ > > This field is required to prevent confusion attacks. E.g., a VSA indicating > that a package can be published as `foo` should not be usable to publish -> the package as `bar`. +> the package as `bar`; a VSA indicating that a package passed the policy for +> a `dev` environment should not be usable to deploy the package to a `prod` +> environment. `policy` _object ([ResourceDescriptor]), optional_ @@ -178,14 +177,14 @@ of the other top-level fields, such as `subject`, see [Statement]._ > Indicates the highest level of each track verified for the artifact (and not > its dependencies), or "FAILED" if policy verification failed. > -> Users MUST NOT include more than one level per SLSA track. Note that each SLSA -> level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies +> VSA producers MUST NOT include more than one level per SLSA track. Note that +> each SLSA level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies > SLSA_BUILD_LEVEL_2 and SLSA_BUILD_LEVEL_1), so there is no need to > include more than one level per track. > -> Users MAY add additional, non-SLSA properties to this field provided the -> values do not conflict with the definition of [SlsaResult]. Users SHOULD -> negotiate the meaning of such properties with their intended verifier. +> VSA producers MAY add additional, non-SLSA properties to this field provided +> the values do not conflict with the definition of [SlsaResult]. VSA Producers +> SHOULD negotiate the meaning of such properties with their intended verifier. > > This field MAY be absent if the verifier is not attesting to a specific SLSA > level. @@ -199,8 +198,8 @@ of the other top-level fields, such as `subject`, see [Statement]._ > that were verified at the indicated level. Absence of a given level of > [SlsaResult] MUST be interpreted as reporting _0_ dependencies at that level. > -> Users MUST count each dependency only once per SLSA track, at the highest -> level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, +> VSA producers MUST count each dependency only once per SLSA track, at the +> highest level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, > you include it with the count for SLSA_BUILD_LEVEL_2 but not the count for >SLSA_BUILD_LEVEL_1. @@ -258,54 +257,62 @@ WARNING: This is just for demonstration purposes. Consumers use VSAs to accomplish goals based on delegated trust. We call the process of establishing a VSA's authenticity and determining whether it meets the consumer's goals 'verification'. Goals differ, as do levels of confidence -in VSA producers, so the verification procedure will changes to suit its -context. However, there are certain steps that most verification procedures -have in common. +in VSA producers, so the verification procedure changes to suit its context. +However, there are certain steps that most verification procedures have in +common. -Verification SHOULD include the following steps: +Verification MUST include the following steps: 1. Verify the signature on the VSA envelope using the preconfigured roots of - trust. + trust. This step ensures that the VSA was produced by a trusted producer + and that it hasn't been tampered with. 2. Verify the statement's `subject` matches the digest of the artifact in - question. + question. This step ensures that the VSA pertains to the intended artifact. 3. Verify that the `predicateType` is - `https://slsa.dev/verification_summary/v1`. + `https://slsa.dev/verification_summary/v1`. This step ensures that the + in-toto predicate is using this version of the VSA format. 4. Verify that the `verifier` matches the public key (or equivalent) used to - verify the signature in step 1. + verify the signature in step 1. This step identifies the VSA producer in + cases where their identity is not implicitly revealed in step 1. 5. Verify that the value for `resourceUri` in the VSA matches the expected - value. + value. This step ensures that the consumer is using the VSA for the + producer's intended purpose. -6. Verify that the value for `slsaResult` is `PASSED`. +6. Verify that the value for `slsaResult` is `PASSED`. This step ensures the + artifact is suitable for the consumer's purposes. -7. Verify that `verifiedLevels` contains the expected value. +7. Verify that `verifiedLevels` contains the expected value. This step ensures + that the artifact is suitable for the consumer's purposes. -8. (Optional) Verify additional fields required to determine whether the VSA +Verification MAY additionally contain the following step: + +1. (Optional) Verify additional fields required to determine whether the VSA meets your goal. Verification mitigates different threats depending on the VSA's contents and the verification procudure. IMPORTANT: A VSA does not protect against compromise of the verifier, such as by -a malicious insider. Instead, VSA users SHOULD carefully consider which +a malicious insider. Instead, VSA consumers SHOULD carefully consider which verifiers they add to their roots of trust. ### Examples -1. Suppose party X wants to delegate to party Y the decision for whether to - accept artifact A as resource R. Party X verifies that: +1. Suppose consumer C wants to delegate to verifier V the decision for whether + to accept artifact A as resource R. Consumer C verifies that: - - The signature on the VSA envelope using Y's public signing key from their + - The signature on the VSA envelope using V's public signing key from their preconfigured root of trust. - `subject` is A. - `predicateType` is `https://slsa.dev/verification_summary/v1`. - - `verifier.id` is Y. + - `verifier.id` is V. - `resourceUri` is R. @@ -314,22 +321,22 @@ verifiers they add to their roots of trust. - `verifiedLevels` contains `SLSA_BUILD_LEVEL_UNEVALUATED`. Note: This example is analogous to traditional code signing. The expected - value for `verifiedLevels` is arbitrary but agreed to by the producer and - the verifier. The verifier does not need to check additional fields, as X - fully delegates the decision to Y. + value for `verifiedLevels` is arbitrary but prenegotiated by the producer and + the consumer. The consumer does not need to check additional fields, as C + fully delegates the decision to V. -2. Suppose party X wants to enforce the rule "Artifact A at resource R must - have a passing VSA from party Y showing it meets SLSA Build Level 2+." Party - X verifies that: +2. Suppose consumer C wants to enforce the rule "Artifact A at resource R must + have a passing VSA from verifier V showing it meets SLSA Build Level 2+." + Consumer C verifies that: - - The signature on the VSA envelope using Y's public signing key from their + - The signature on the VSA envelope using V's public signing key from their preconfigured root of trust. - `subject` is A. - `predicateType` is `https://slsa.dev/verification_summary/v1`. - - `verifier.id` is Y. + - `verifier.id` is V. - `resourceUri` is R. @@ -360,8 +367,8 @@ Note that each SLSA level implies the levels below it. For example, SLSA_BUILD_LEVEL_3 means (SLSA_BUILD_LEVEL_1 + SLSA_BUILD_LEVEL_2 + SLSA_BUILD_LEVEL_3). -Users MAY use custom values here but MUST NOT use custom values starting with -`SLSA_`. +VSA producers MAY use custom values here but MUST NOT use custom values starting +with `SLSA_`. ## Change history From 7800f4bae5df017472e90eefd5cdb6e6382a8b83 Mon Sep 17 00:00:00 2001 From: kpk47 <1079282+kpk47@users.noreply.github.com> Date: Tue, 11 Jul 2023 16:23:49 -0700 Subject: [PATCH 12/26] Apply suggestions from code review Co-authored-by: olivekl <83081275+olivekl@users.noreply.github.com> Signed-off-by: kpk47 <1079282+kpk47@users.noreply.github.com> --- docs/verification_summary/v1.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index 90280094b..abde666f0 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -16,11 +16,11 @@ level(s) and the verifier's expectations. VSAs allow software consumers to make a decision about the validity of an artifact without needing to have access to all of the attestations about the -artifact or all of its transitive dependencies. They can use it to delegate +artifact or all of its transitive dependencies. Consumers can use VSAs to delegate complex policy decisions to some trusted party and then simply trust that party's decision regarding the artifact. -They also allow software producers to keep the details of their build pipeline +VSAs also allow software producers to keep the details of their build pipeline confidential while still communicating that some verification has taken place. This might be necessary for legal reasons (keeping a software supplier confidential) or for security reasons (not revealing that an embargoed patch has From ee07742c7436f56a89a9da0998f1c27120442d0b Mon Sep 17 00:00:00 2001 From: Mark Lodato Date: Thu, 6 Jul 2023 12:19:27 -0400 Subject: [PATCH 13/26] impl: update README to explain how to use Netlify (#898) - Document that we use Netlify instead of GitHub Pages now. - Update the "developing and testing locally" instructions to use `netlify dev` instead of running Jekyll directly so that redirects are handled properly. - Document how deploy previews work. - Document our production Netlify and DNS configuration. - Start a short playbook for how to debug. It likely could be expanded, but this is a good first start. Issue: #266 Signed-off-by: Mark Lodato Co-authored-by: Joshua Lock --- docs/README.md | 122 +++++++++++++++--- .../netlify_permalinks_screenshot.png | Bin 0 -> 141415 bytes readme_images/netlify_rollback_screenshot.png | Bin 0 -> 53005 bytes 3 files changed, 101 insertions(+), 21 deletions(-) create mode 100644 readme_images/netlify_permalinks_screenshot.png create mode 100644 readme_images/netlify_rollback_screenshot.png diff --git a/docs/README.md b/docs/README.md index be590eec5..7786bbeac 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,33 +1,56 @@ # slsa.dev sources -This directory contains sources for https://slsa.dev, served -via GitHub pages and rendered with Jekyll. +This directory contains sources for https://slsa.dev, rendered with Jekyll and +served by [Netlify](https://netlify.com). -## Developing and testing locally +## Development -1. Install ruby, bundler, and the dev headers: +### Building and testing locally - ```bash - apt install ruby ruby-dev bundler - ``` - - Alternatively, you can use `rbenv` to use the exact version of Ruby used by - GitHub Pages, but Debian's versions are likely close enough. - -2. Clone this repo and change directory to `/docs`: +1. Clone this repo and change directory to `/docs`: ```bash git clone https://github.com/slsa-framework/slsa cd slsa/docs ``` -3. Install the dependencies locally: +2. Install system dependencies: + + - Ruby, bundler, and the dev headers: + + ```bash + apt install ruby ruby-dev bundler + ``` + + Alternatively, you can use `rbenv` to use the exact version of Ruby, + but Debian's versions are likely close enough. + + - Node and NPM: + + ```bash + curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.3/install.sh | bash + nvm install 18 + nvm use 18 + ``` + + See https://github.com/nvm-sh/nvm for more instructions. + + - [Netlify CLI](https://docs.netlify.com/cli/get-started/): + + ```bash + npm install -g netlify-cli + netlify login + ``` + +3. Install local dependencies: ```bash bundle config set --local path 'vendor/bundle' bundle install ``` + You will need to re-run `bundle install` whenever the Gemfile.lock changes. + 4. (optional) To enable `jekyll-github-metadata` to read metadata about the slsa repository from the GitHub API, create a GitHub [personal access token](https://github.com/settings/tokens/new) and add it @@ -39,18 +62,75 @@ via GitHub pages and rendered with Jekyll. password 123abc-your-token ``` -5. Run the project locally with `jekyll serve`: +5. Run the development server locally with + [Netlify CLI](https://github.com/netlify/cli/blob/main/docs/netlify-dev.md): + + ```bash + netlify dev + ``` + + If you would like livereload (autorefresh page after every change) and/or + incremental builds (faster builds but possibly missing some changes), use: ```bash - bundle exec jekyll serve --livereload --incremental + netlify dev -c 'bundle exec jekyll serve --livereload --incremental' ``` - The options can be omitted if preferred. `--livereload` causes the website - to autorefresh after every build. `--incremental` results in faster - incremental builds at the cost of possibly missing some changes. +6. Browse to http://localhost:8888 to view the site locally. + +### Deploy previews + +Netlify automatically builds and deploys previews of every pull request. Shortly +after creating a PR, Netlify will add a comment with a link to a preview. The +URL is of the form `https://deploy-preview-#--slsa.netlify.app` where `#` is the +pull request number. This preview is updated on every push. + +## Production + +### Netlify configuration + +Site configuration: https://app.netlify.com/sites/slsa \ +Team configuration: https://app.netlify.com/teams/slsa + +Prefer to configure the site using `netlify.toml` rather than the web UI, when +possible. + +To be added to ACL to allow you to configure the site, contact Mark Lodato or +Joshua Lock via email or Slack. In the event that no SLSA team member has +access, contact OpenSSF. + +### Production builds + +Netlify automatically builds and deploys the `main` branch to https://slsa.dev. + +### DNS + +OpenSSF (Linux Foundation) owns the DNS registration for slsa.dev and runs the +DNS server. To request changes, email operations@openssf.org. + +It is configured to point to Netlify: + +```none +slsa.dev ALIAS apex-loadbalancer.netlify.com +www.slsa.dev CNAME slsa.netlify.app +``` + +## Playbooks + +### Something is wrong with the site. How do I debug and/or roll back? + +Go to https://app.netlify.com/sites/slsa/deploys?filter=main to see recent +deployments. You need to be logged into Netlify to see the list of deployments, +and in the "slsa" team to perform mutations (e.g. Publish). + +View a previous version of the site by clicking on a deployment's date: + +![screenshot of permalinks](../readme_images/netlify_permalinks_screenshot.png) -6. Browse to http://localhost:4000 to view the site locally. +If you find that a previous version did not have the problem, you may roll back +to that version by clicking on the row (not the date) and then **Publish +deploy**. -## Deployment +![screenshot of rollback button](../readme_images/netlify_rollback_screenshot.png) -Pushing to `main` will trigger a deployment of GitHub Pages. +This will stay active until the next push to `main`. diff --git a/readme_images/netlify_permalinks_screenshot.png b/readme_images/netlify_permalinks_screenshot.png new file mode 100644 index 0000000000000000000000000000000000000000..748767ca7c459e1a0a41b594b2ee927c0ce489ee GIT binary patch literal 141415 zcmeFZWmKHo(lr_g5G1%maQEO6++BlPa0pK0PJ%QJ!96q(2<~n{gIjQSclYnfmh;}T z_kHj0`{Ns<$Dq6EURqVFYR?&Y`{D)Z3mI{d_wEJ<8L;k}lO#RMw$9veRHWmJkwKyH)t{WD-Q2k0 z!#c0YmyPf z!(TpnwaZfRALj8qEpvU@A^rDaam!|(&{nzM7Jkmmm{~i%AK+*?z7;5Uc_`= z2S)Ru6@AndxpiY{MhlRp5+2($h6Zl} zJ*d6EzHZVZtu*q^;o3p!le^>U>MFW$j9_(oBiCw$wky%Jo~GNv{k6}-f}<5|i_823 zj3p!x;UUGWvp%aa9Ukoe-w$CdiWTcz7&|Y|R8oaxQr{Q*1^1tEgg)XUvvnSck?mbf zaTCY)Cnb)i)$zx^H4>$iM`P*o>J(@7{TTJ%EddP+(;_I-crG=B>(<#(I6`2|@m<{9 z{JvuPm`J{~ae9IH&leRUiRyS7#)en zz=9&qU&dngUgX+eC~*P{$)U+f|M@_HqONK2e1yZGi69{jXD)##xsJG;Uu^|{ZMADq zv?++orB#=0+~mWLfzkhe>9m04cztcN=qa$EOr691r~x&wz^_ivVjz*@yBfVrtYpeR z*9hEB0W)ma93hUdMxpp-`JjQ!aRixEyumh{ySdrh;rz-rHvw(Z0rOw$10U#LhNj@p z<47w?C%LFs>*UewRhor%=`sM@+|sggs6e(yM^?B>{m%)KqtQb3lJBjqqM%0eBr;8N zS5I)`m+nt7LDe~)(umVZ-cpbi#{T7NHdam@|M5>w&CiPeS}#&%Xe%fNKROk!^UIpwh|^KfE|C6v7yMcS--h10tn3 zC)~f^C6D(HvX`DE}G_JY2y2_3`KM_Wa@W-qz0E zSRpsp=6ELdg~f{}WH>>hKlY>|Q8)q}f|dPD#23}!VJJHHo^EAzl?-TdZ6c z0uB_()dv4wjR@BgxT2pW`PGq?S+HFULdYf?4Oo1mk}RE#GW`9L?UDr{XA3x%|yZ@A< zJ39*e7$ptu{G-MDlEB;B6gE=&sBnK5L0KqIHkPqt(HR(7#{Hvx!Q~Od)_(DStRJlb zCb`1*36fW!cFE~MFL6|&e26aXe^mdVf*!B~JZTv8Cyu3(gddwl@)Kz(OhBhm+<={z z+)z-{|I7T)CJ|4qNlHdQWgkv}4GnlTnLia70iqV) z--!shKhQCZum-kD81N*%k?5m5?eC7EQ~%eFN$C;C-d2ONsWaV?N4qtKv*Z~U7AVYarZSO*1vR00|@ta{4< zF{yqwl*_2vblf0p!3 zB=?eVBmw8j>gf(nFuVESi?RfM4=4E)HrU;X{OBpjUYdRDkBz=K+wk>g|w3M%$cSfO}AI_sg7lDsbC}r}GrD{vx4VzGji^;wg)@nJZzjNF@GfNlrA+Q)u z7h9-zj3JjmG#!pd=!=s&XywapN86#}wp$QBoU3sJ4wi^FyciPUI0<;j4E2qF<{QE> zFdch~j9uht`tX4XXhfVJv2d96@QMXwgl<+|R@=^VDT_#EOEQoT1R`K6m+CcG3cO0^ zwkPh1B(%_*tG4l67j+&^=lz++ZC`DUGj1Uz%8}dEAq{p?W_dKh zSIiK6X>ZTs?seZjgzNwU)eY4n;WC3i!JbJq{rKtYartLxhkbxux_3G`b}sYkLN{lNqszvCIPRZC*54=*#30ce81usN*U-!2qLUg z#-Bcnh6Mk%n8Ip2H`~*V|FDS{XGI;?1TUZ*1Cp7US?_gSilCIJB=m^2?0a8=pw^f> zRiZn6oRTZO*y__XbbeDzEa3So%Ik7c^YHn>NDF73NG)H{7CO?xRxLDu zK7)*=yL$uHr3Nho^R>2}8SmU;SWP5zW#W32u+CEz59p9d_+77$7N@Ro4cwv1 zn$N;&LN`xVJAIkUpypH9Erx}+r+TAFxN$c@+r!%F`?FORrxQv-+RxBB;V<*ZnO?(pUguj1Z?EFEc@Kp=&M4P)(Z^J0b)6ZCnE%L!vsh{ULQT$J{!f{!8o*wTHkG)Tp{hod9 zlTcp__(Q#PI9?K{wwcAiXESYYdwxPH{c`#P7+}+5*3nOIhlawQ5Y>uYBd2f|^xs|$ zu7nAWeiJlVH2tCLB>QI?%?QQv{r%OUSP_@4O0KlgYa;%i)V5@FO80gsGWvWPFc9e9 z`wey9aZ6s3i{%BloLFZt@}r(AT{)g-w+HdI9e;4pr!Yt;NRVbJ_EVg3DUjAvi)NTu z*{r4~39+*+ zed-KBt!to;MlQ@iCg5=I>Q02X?u=&FdtMe!_BPI<<}*d1ZCW%l!!iVM>~B?Il`b~9 z^$xJK*%$;|?oZc&GWJh&7#|FZl(V7lF83`Ud~eD6_bW+k;;f1IGi~jE6`*@wA4S$! zPwVLJhH91QaGD4+GiVf-x4G?(!>Si)AWwD}h)3EZj48+XrY0?35^|qhezITPI*QWa zETYgJ&yB7xJrjA{tXpy$Adu*{T#(FDj9nGfiAJ^%7VU z4ZTlceSsY#otGioPIU%@vgnG&%VoBFZuV5i9NHi#X6 zRJC7ABe8DDb09)7-Fm`dL(3|QL&rm4=_NIU+-q7CiNyqLg>Nz6S^4{v-kN|PyL^85 zJd{>Pu6dMRpj;~-Q-l?QLegX3_G~2+{&Bj{$}vYtw_c|sB;sYQNpDoGC%fO1x9;Vd znEW&t2wn4?eNaP_nLs$5=|?4z6|8p-xY@~x9{keR5#rCl_NG3A&!rMHkjP{$8jng* z<##F$W zST0zV9E~TbSPP2eWQZ!mIkSqr@a&Fj;sZf!pe^|{rK;s>hss0w1(|T#AolHF&T)Ck zIj2F7TMxdavT8lap>0C++0o@J|C`7tLMLhd~JRir0L-YU{%&1)8gnL6g(_VvqGDAjizg}--oW1{)M_tBOP zg_th_adUuF>1aWuG1s8Um*{-U@AG|q^p=7kVjQDB5EVYGi*-z5G_LX;z0_NEBpw!e zy6IeitN+pw5{^pQMtXDN5KZBmU4F7^X3im4uSc~eE2AtLKW)AMHL{6|{EAQFV*#o(( zP%KznJzTf|LA(~tB?2v-V%!OLw9##)9ZF6|JmC7M={QwOK87@aiH{dY3{eG9s4;yU zEMnA4DS~B`4jTXXbDh^dR~b?hm-wzRbG$nNq&Un#=bz!OXcsDay8DZ$JOipOGh2>n zyQP`Bo2Dd;KNxy;wlzpJ-WF6Gn?B)WFr-|2zCE%YrzBW$mB?ba6d~~Xa}McXEJcX6 zH{H?>vNXzqbpptMz+0=%dP*2W*DPp64Df2qbg zX=q>;rINa-y>=FXXN6Xr7xj6+tnFY9s}F07zs`EP6bICQ70;|c_oOJMp@scBUU~!Z zGPP#E-1Z(No>t{`5E2{_p~vc)g!ld8Ga60lD+2DWo5K0Wf+QMu+aT;<1}ZoiJK8)6#qTQhdsIS!#J zLCr6;PWU1HuXIH@us*B&5gCO!D1?)0XF*%WH}Hn`gipXEa5-)ZVig3%bThXW-^}s3 zWWtM62mHi=T$tx{k2`{p@s58!vRe6neGADOb`0HobJlXbRMkMU9eh!c1I{CbOus>X z6NN+@Z30ax1%y!1AL9EI(W`FoC27Tv8`zy=AWaw|cBI>S!~0=M zZ)zJ}?JA}1oToN2+=h{3uspK*Bi~~Vn#&hPm9K2eh$BYLOcMD;*eOO1=}J{XSkTH`g32O+NRiDu zkOlzN4}>MaY{|!Ft&h!pRG7oFUt&7ngImh*%SR6zYP889T1?yq9jpu=o|lL! zIvttY)C0|s>bNUtxuiOYrwjcTo|*e>no%D zT_z$EKaEv@`B=*Vm)1+i_n~|8y+7mzxwv3Ms-wm&F|{DHjUx67^#Rx`Za4j3z**h!ZL{g@6PQ&0R2=YHs*od9U%YuUgr#_oxZJG53T(*(m zq)}ChHdIotEG+s|4eZ$)4Bv9UDDDGGM`B@_u#d)SCul(KhGW zG-|I*v1K=E`Y&k6-5d;R_91jYAIhQsrWY zBkGGg)s@FVfsC|#bYMDTD>P#gznj%pZG#=P<=pOXmw?s((69;TjYTVo-?pz8H*FMA zP$eL*CBz40y`*>5EKQg+ipHlSZ8IEL56>Yp>y1^fAG>9n2Vg`q?)s zM<&ayuLEcGxIT>J9I*K&{@#;KjxmUF`njj?iJ0orktXu4@8t1Km z=&^tW5_Ti(D^1|cQ6L*EZW_j+D;}BMi+RpR%cIR9HGNGx-_3Ova_&hiS0TyrqgcD@ z4nZYT?%Jp}_7GGnwXyUa77?p_zfnh=j*qUuDvwj(WJPbPS8$w7CbRmXQjoawR-g)| z>M&jHd?BV0Fy7Mi)>jMtRK;0Bz)6LM9G*l(l1a#IZ`>(F=y-F2zR==@8j3;1;dd?y ziv%3%rZ=0{LJpVx>bZ&;i1uxla9;#}z9$T$o~Kiy5Wn60L26mr4rI%{#SPvw4aO3< z2!gMN5hDUEEstY{e*?S$$#P%Swwbl=db5%_jMAwn9gV-um?)Ox-Tx|7(2ZZKeTmr{ z;!ci@bG(%-XDARJ3Il0G%PWBRuW?byE6OCP<4`wecSm=G&IftlZYJTx$!Mzggz(*a zs5+m%8BWpGC^N8~;{|w)OCxDr-q}?{XA-o>~WY9eA`<;`VtATGZBDgTnH-noOS$gy1C!|>fp%- z6J&RE1imJHIRo@tzA?S*c)7=!E0YFy+icTLtJpn^d_~G4r$E(bj z89@w;7ns|}if?N}w+Xo!<#5|zc6#<3Man>ei#{F#a8Bdt_%_xlF<5_FQruvZB;d-^J3^%^{#MSb~EM{ zQ3D=~+x^bxoBSzRV{AKGuV$r&jXct;mTBgD8?A=&++6}`K?TZh_>THU1n-OW=VeCm z@z^bhhxuq{ZdoFQ_(yiLCSEx~_F3aX&Oih~JkL?g5uO*c-n>c?n_Oahqj&^isT#mK-k%1_j#)LUV zpL+!bDN1?cT2`xzwQ{JLy6iIdn0|Z4-=zsrrS~!!!p}4P`sdq%r&tn9I#&58yCJOJ z2qrV9f}Lt4AUUDUtOa||@)}>XJ>JK1E7|E%Y5a$cJ5eGfUmh}MfmR6+evb<=?Ftma zlE;#bdiOof8=L}aun=I1TmZ$3#%V|{FVG$NPN_E*joT*9*8~R5ygv5AO-6G;mVghx zv$CQV(vjO$5Z!0ePq$KtLWy_-2h0=?8U3*`2XB)Uq@gA{X8ISbMGDQDDlFcXX2K!w z!mNV^MiGs-s~Y@p58w#N_p}n0!LRX!ll08f^WM=RJrB<)Q}4|-x)cS4j1kp1?~d1E zBRrGn!{A6js$k`|22&27jcoHw3tq0vH4srQ`lWH%e#F_{!62k3yTdYM^_&%e<IR*$6{YpJ$wVG2T^u%&?&XigL|UUOlRj} zCBb=bUHy-tAt9M*o1s5=+*?*P?DO9FG@+&XO%EE;iRWSM8-~62KF9#E92#}4Z~GUW zAAl#}uZutU_{9CIg&BRkU(^F1Z7h{W{XwO@;8Stgm5qe0vP`#@z4$r z{e@zPNB%Ewbb##oO%w^ylcQz8Q_9ApgnU`wGyJt z*bc|Vq{g3+ezN$=T%@j6r45q-of?*vT0ZzBR6*YOd#kt*ban8!fTl6W-D1{l8F^5brHxPGFZ(~6lBN_!Z*-k-<&Wc{I@=y(u3M09#x3MK zgLg34+dM=DvSjt`Ag$TENQ@%t!!OVKWKU9->a`0$JOV9pJm#cUvOfwyvwQc42G zm>o)xuyqv@h95b!PWtg`k(Q|6i+vvSwYrx_=Hh4UzT_kfyEeJ)CB9u2A|2+VCz)@pm3|;=!7~^l23CX^( zk@2r+^Phpl{${G!c8l!()mRYVq$aBhnn}OWs{iMMlnofPB(={Z(?1)lhyhqC#^&9< z%701?#HoQn|I96G{8wW*zvmgmt*`%2^-RFe--AxMP_O%EV_l-aJS$GV6%G7n8h`sl z%I^>p*Shzw#>nW+H_oV@n4Po-_7~IoAdu8&mm1jJNd2l%4hLKm)Rh zA4AB}@o&ih1pz7L|JXg+K0q$_H0qY3gbR0}zeV>v$ML2Vei@`FlFAd?W!V)eJ^5z_ z`TI0ihws88lXYtYPMh1R`ue5@GJx?y-+QX{7|{jat0ckM^D+AG zcp-d1fo2l8bJX&j?KL7;?{%EHtiKUIwb=QR#e5`qj!HGiH~2MS zXuzXqj(5YTf>zf1Wq@gP7#Tp4(SzA;0Bw)edoaW^=)z_2RZA=YY_)TW<@0S&IIis~ znZn*LC8`gb?+e@at+ZwTo3hBW$YGgsTqLv@E?iR_M3wFi=3`y8zg&Q@vN zZ96SAdtmCnb89bRX?u+teNv^${0PE_L&1;w@$wF0eCxDI?kyFa2FCV#3<@$F5rc>$ z*m5kjc;TAR$cvsDOQ=+cdhGkjvnc3R_hdA=v6{@i?*f>|_lt|QJ~Wb%M6XEfNq*zI zBZ6_n#Kevcr)v^6vyDVaWqKlY%tR^$!cU~fRI|O2gx8_Q$%*AWKeR}{Dz7@KjPdP6 z)U2GeI&Y=|tZZU;IBr_d>0FKV69#U@NOgp2F0cYj{TI&w=~wrYFyo4!<+5+2EUYiej9LI(@4v^e}2)aQ`ZYoVvEthT3!E@lm^ zMrt**?r=hG7%|d2Vm_}UZ+8!`)y})iPgEz+SI(2EZLH=C?#<^{X$2aa`XDRU%H(m| zi=#y^tyU*0Ev2kX0p)@fF;-cIrRimFi|c?y?XUu9k8?<$6ml$;oVnkp-$2<)2#H@u z3djOo$bf&NF9Ru(&nruk1u&03sk*vVysH%bLsa5_?O_p6m|;Vhnp)mB_*X%+e8=Tc49u~pE#y$=7ZpB zs|mr5h{Pd)N>4$08;!8T<#)NK-UQd%9?sGV4n*+5^#H(lz*-~YXq3nSd4TyCax!d^ zu@_K4yAn+a+02v+2hj>CrSY8|gDxJqln4Hk5I_h6@My$^iVdf!Z%Y$t!oq%ZN~T)g zcn&j~_9sJq4vrE&(qkbrXukRCKA3P$Rc$lXHT=%!?llhc9aPixK~P;Cu0en7%j4;S zs0jSbYwm`;leD%KU7Mu`mKWSu^zUB)tJQHM6UXWY^i`mgOT+@w{hkpy-_EJS`Jtd{)$TL* zqgjiwMhW(+sR&{rbO``q)wORv(i|z#tt+=YRhp@{Vz<+43jnASV)Z2tq##6`lQb}i zfahy=ixG(gx86$L1MxQi%DLirOvC2Xt0t6rRX&j;GgcL9g~WD3at0qMgiR5!>PZm4p(n>XUJI7GpW1hl1QJigw^}*;7CG| z>4xmjaLFI?Xx9U4bw>noG?N)D6ixfm@n4}3|1NKS%a>l0u#E=NMthwvek@QfW%P7C zUbEP2INS|&TPj*TKGv4CteRa9NHdnJ>pj`*GqXg;bEcAHOUoeL_gappgx1_Bi{hG4zodEuC$1Vg#!0-g4}h8V&_NT3E=c9rFVhJKF4raVcee!rE%%bmm0Pi9TsYC`{XJm z4T}q|+w0a?2D9bKrpDZ!xha97sq0+!xxZR0L*WT{(}v+P828p#Esq`X zdW^00uRj^ILHXRFcHE3nDAy~CyeswCucbD)zuGe@_E-q^6##Jk_w?;S>YVN<|@V_9v@PSCCe+U}*|HpAl+2)F9$A>xmb}(+!%XU3X7@loGi- z?07bsXw!8(-$KT0om?*Z1d%|zpOlK#FM4`apqbD0akAJ>L!ZUo9&@Sfp%!a-@V?)$ zxw4bzEg7HFhP3zj5ck%XCg)vMKZGz^9#j%Rn|yXUR}>mw0iY#sg*J#f{<|6szwCa zSLGOJ_g6q^fO<|oOK>r&M8Byv%bFS14nXxQoHk{v`uV0ed;pU8RqMl<9O&>H-d3AU z^aNK(WT2(9yFg*&e;j62hExMyrIF7GGLk%IzdcgB!M008=ezD%YfZF}y=CRhM-77yF#bG)46+!#(6px!0qehx2Y zY4%s5j<~GiVt%p;t;t|6#roj9{a`&w(0pU;8iCLHYs9QlWg>Cv8;f9u&GkkR@A=85 zCg?X`YrZ;|dI_tHH&OXGSHzN|OB2??L(TJX%F2J3Xnr+87F)qVWhOFR!Qn+Om+^pn;pW=)bc*AIc@y%V~}>QbLQT@;EztQ)=ELhBPF z`8kRu1m+&=S{e73+?KN!6wR8O`fZ@?!TUKF^T?0t@^6Uv-Qkg1^}(r}g{z-Et3P;Z zHNl~hgxb!#eHF>zlTP5H(kL+q=d^zAxnZS6hV?1%Y(3Dj&TjGKw;JJ{W{J+G8;b`@Hwi2~QqWD)ajP{X7E?`K6smEY*HpLzml&xnFih&~!S9n4g?+T$n5{E!Z3SoHOKesqf<5n9^I zwlq!Kq1OYl-U~pF)}sp~oh5b#=NWEGr*axycW0XeAzZd|GthGDJ&`4LwULPiwP~ki zfSTn8AXO|8%8`ne41k7}|D}3yW{&|`z15kh`Jd$GoxA0C7K z9G*HnoR8=5?S&lZ^3a%63%+VI6HO2M++XKt7uC8SFV-nI@E~aOG(2ofjGQiZ91k6S zfeuP6Ynv|Nwni)Y67^H-Y~P+5E5lSGo$-|v_(;eBjY-JPKC!6>S?C0_nBT7>m(Km^ zc6*SZ8^QYnD+DTtc3!PTLm*c^0YeS2#`*Cel6qp44Jg9ooBi|?US^Q4V>RV=F%5%*@#TYGrI)?R6J!9}L} z&#MhTtf@6=vbUvvW@$|i>Mv{g6s=n${wWY)uyCQp&G2CMo+R<1e3XaLumLfrC#tvZ zyw&r=P-8%_g6_(trlI8L#+pN&Lq1p5)%mCODQbQXApAX|Mi5G@;-fy>&4&4Y4qlr~ zV$defDVi?T8MJKm_89x_qf64=Kd&_RuX|z>OHlGtI+Emat3~y=DanIgJY%PR2iJx2c%C z_t>^2RI)+Z&tL^{`9588dka{6V}g&_kI=3fx@t|+?x<12G?KZC? zgfj-{8q?;P*5B=7435xpS%o?W(smnmhhaOOtcY+}j;inG!UL-{lZgzA zUi}A1jQrX5i2YikapF-U;4C$)_dxA5?+BD#QUHhaP`dl;dN)67?iQQ=y)eLc6dwcX zp}MvjyT!SM&|SX4dX>gUr-d=~I{W3;F!V?id&wG=zX3wh1q1-bnAz|&sR0#rZ@ITPw>0!UEy_(3yA^5_ni+J4 z&ZS^=t?T}QHG*>(h0e13Bj>%%_R%6Wv2Kk`FdwJ&&864G7SqmX9^qV#RVcw^AshoW zAe&=K;}%)eIlj*jbChuVMIA}7)(MAdf;fBJ`tntd=5?w2dO)&~HzhmaM9VmO^RvxD zpyHzESCgjNtuKRKnDJ;CY>w%n+##zQ-?LJrb6@1>a=|hznh@<@eKGXyte469u%yX8 zh@Ipz^|(UOeD#s4OJUI8?*-T`CeYQ-Z$NmE`Uhs?mH4HxBDbIDB?f@wO!aoAjjy z5U$(tVs|$Zu46!Hq1&Lkvz^HO@ZxBZ7cPj<4ew~KhOkpA@<*3r z&ZBW)gG=Og#=EW3p+|mRgICCep_=p>!o63miI=mWZEgOYaVjAlwmfanR<=v{H}?i( z*!SO62#MxuCDn1Q57rqWSTTU;xFz(1-Kyw7quSNcqV;L=!$E?kLB)-7m_}`^=oi0j zRHTw<=Ly$9GJTtdHX3~|t8B`BgBDMt_l9bJLt830`W(9ThiH&;nf1KBxZxn~ z3wF@`y(0F1u0e^DL9;4?rwUbujA!|Y>xmni8nof`b%OLT3t_0m{j?s~C8G(WSH<9R zY^;{Gg!7B_>z0f~o18yJ)7!TNd6IC|_H9O3sXf>dVd#+cM|`K~jp*H370aw&wsHvE z=~K%e{c40+m0n{vyI{CXXT#8@h7AZMgqJfH%R$$fy@+GACAvDQss8vPFA002(2(7S zf%GyPR7Y&NTpHO;$~O&BPtkiPw9?>~c=6n9gtJl{@848ul3j z;v6}2* zvq1QU?J;+el6-pmK0Njfhba#V5$~rXeZCa5yvZb)Z#=;}QyJ^s2T#R4&eyqwjQT-d z&ifIcZqM(T{0|=ONm6TVOze8A1D}pVx_>5eGAtE85D4BB&^fhUV0gOj+w_(#m!qo* zrUk!qJ6^f9$f^SNz7DwbNYk!q=xb-Id$xa!$K}MK`b|23$8o*A??+d?Vj~qh%H*sL zxOCci)r_qexMHMx#=L|%wb)?dRaLFprF82|koa_m>3XzaMxMDX^t=EnFlfru9$fZ4 zAKOq5&=yYtU>pdRZ?!QSe$06~>k??lmTs+iYg zuv}?|cgOje=zoSouDmKIZd~N+$mnHlz-8ZIn<%UDLBb`fe?>3xPT$=_ z0q1GBLat~J*U;N2Q7?1g&LayTEJxFn6#m0bgPng{6fJKQ$#!*dDT=1}vqI#T zCUV?_oR7!Hit9=t(NlzQMSSzaFj8P0w%kHariS5m-Bxdb5&NaZL4Z0{2A-mHo=L8pVN9mxQ z!QF`%3NNlIPcN_guSz3!J)7$&846(JgZ+U}oQ~<`!cSx`@3U=oRjK1!4KH3!l`Mme z#Nbx8A_)sr@&g)_#0SST2fT|p>rVcfo zw8wDWvTt}<>s|jIYAM<#7xQ4$!2a9e_^EN=w#v{KOcif7-#FG>tR$>R=ZwuO=D{Pm z)t@#^rkkn7;EIO9f&uHwk_cRvH9;%7{PMgs=5G4mmo1cYrP1ZnxR8Y&FXD{FDIRO` z;r=HE!2*mGb7@0*1e;(iE691?Sg-*4d#i=7wTc*h@2mblbqn z%C-hM2k<2#Ok5y5t1y|&If@Iru@q86b7mTS28%F>*mpINN=PstXH?OxZRlGx>jO0Z=d{8^YE`5y!^XsaMwW+4D+t2jjT+(7GMW5m~9`i(Hpx#0c8XNx`IzJlu`_^#!YTfnjDJG3_n-S(b^iOn1giMKgSwMqCllkJ~$0Kh!%NmCtdR47(jDQCV z$_=Ith>J!^d`YL>qg}(hmickD02)cb%X2VeV_qU@Y@LI={(umSm)3WqkVzPC&5TK; zLd)iXR`$dCl+QGlL6dnfnYFWWpKU9yv@v3qiiNoIe)hW>O+3AN|HxueN6MjbF~hp% ztgDW?_Ka`lfVIjXTNCqQhKE8F!&IMjC9Sr~d-uoh$p0yf%G{jx{e#iyAI9SI&ZR1rb8TE z9(}abMQ)=%VWK!#UK#VPHM0q9)5T8EAU^xtQ*<>-$$UA~IZ$FcMpVZ;86VY8z+qGD zfrY|0p~QmIPF#nM_W1ls_EQM~v&vO)Rx^XVF-LS=_`X}p=lURCjr1~{R)Xhv_kg8M z82HJ8x0_WXr|U{`gX&3;0DPzGVWCvuPC15B1uis`4!^<0ml+AS`= zazB#h_;m?~HkHQb;k34Pwqd^OLaDOWnOYDo+{Iz2v(=-$N*uWdTR3O~8tPu^diu(C z{;P426OZ2$zvXW3JEk}V)&P_e@bP5v=OhO8w@DvH=Id+$)u9GE`>7k!mW~q*V)O8# z=i0{iiK%>`v`ZmPz39u|T6*XUWUc+#Q4*k6azdk&*-?$pUJlwO1~It?@^-KLlXVV$ znk&-99r)G+nr41Yz=g=7$!I?h+h9ku9ud+WNGp_sw?4%rzt*`Sy0L4MFUmlR34iL= zWA9WpEEa+?%gPJd>H>URo>HSkXA+1)F@lQV@h|<`wg6Xz6W4FzaR^|j**^DI?yEt# z#RAUw-;kJsSoR@JOpA{A$9=gHSXoilc8_x4X{(C zVUvhhc!Md9;SovSqdM+mIi6;zfy92|5MvHQNkDcDnC)Ao*}iKs?<0G23>DH03nDkQ z`&wpRBq3+@hQJ_B8l{zS*Cp6`Y6Ph9by^suqKSJiQmV>525{De1H_6xWXv7UuR-gZ zHt;C7Xy}h3rzP(DrvzKK7!pMaT7EE2do;)Rnw9kMkvV6OHl4!D)%oLdMJQF~zRmZ} z4RPm*ty)%~TC~G?c={ZoO|55_CtBfswZMy+*-T=CWFlMDasmz98VOtA1bU+A3_>ZfoHRKHnI&)x9n!)`_8!zk?y8yIXJ^nA%6f}lby zXHbo%I_enkStk4@eXMau%YoPT7Qbq{^6fg41Q)Ne^ts21@e99vs)V+4kikTS9baGQ z4dcXmfLH8zP5{!2;sHk**Wz3(2qQq+RE#tzuX`$N+cyi&k6ft~R1)W-4ugK&@0i|i za!%x5FXkr&UB2@6jW4F9Z^oE}`&&B_044_rS6Z5q^b0EKWVFHb`&>~?4MmtZ>Pr_} z7pC;DAbTmrErA987;4*(RUBhABQ@oUiVjK{yw(*igZ2Hn(orW4i%&t*O-{Fnr3P(L z&Q=r2UK@w=nOuF_Fbi}Mhs_@A)WexVA@z=Ha~0_ijfy(FDS$3molBz9lzNJX_1j5y z(1;`U2B*)w`vCPogpa9cYM0CxJPIkiG5zzq8f)rG{kn-2@l;Ho?c?;AEM7O1zAuy_ z80OW;FlQ6M?VFc~IS6q=KW5pt8Czp9-4U<*)C9X3%HE4EXSUu~1Z#l5keCprD5T&B zB9iD3T8YSK@FgHPpXJgvIG!gS?#gCko)9lIy3FfIG?2#78j%yqnQnS6dng@&I4NR8 zS$7$2PE3~W_oqwOJE#!Xx};Oc8zPaXXXFs6YZFp}tZGbxEo+ze8vK^$MwV~=qJ{v# zV*WHDU^5wn?O7Zrx;MVbaMFAj$^oR!3*VFKl0tc-%)+>&U_ft9b*gWwY)w0^UezRw zbPs4gUcn;od6>TQ5K14c3Lx4B*R`{u3+?i{J@Pm2d8*!LUhvNU^h%_cs3g@6&dvJs zBFCRX9|(X}QHXcGbakMPDdw*4y;Tg{4c-y@E@w%ztTZ<sT%wgu$ zwr7;P*Z5_+Aiv%5bo<>c&#I+~f4W{G`S0Hc}hrfxW`ozRO3Y-9=* zx!Rxg0k{Qb>bYu`|BR8DF{VReGiCNIXtut^RPTCtN0Di{DVxL=ErR1IZnxC9$lo`fs~8F}IXCBuUJIAe z#P6a2;XlNCRyEqj>gSc+O#N&}wrm0|&W`U{GuOTI;Tw?gpd&2-QC@TL*pLYq4D7E5Q4kAYXoiF-8DdPX(UK+ceyKD{5L%_=W)10;ybX6;_g;=N2fX;}+d%vjAM$1(&7gU`>chF8h53hneW= zhkB;(Gczs0QjByaD+~Xm5{h9O``Uvo!b$@=|0Pc^r#>CF@#;x zc^j&B=Usnwyhi_%h`2j&E?`LJqT|o0lYBs~X*WM_dF*1H7b1&(OZ2>9CED-jOEWg- zN3+qCL~0irB7Se8n`5s6`7oZL^zP1^6r0wT%l$YTttv|Uwx;Kv!BFHwyEPX9kE8B7 ze4~t4W+*uJy+hL#E&_-KKGQy)mrcsmHj{>~pP&d{F1tLeAHHS_`Vl<6i>Z!p>VER3 zFb&-$Z6>)%K3TJj4;i^STzbv#(stYTp*OPCg?L9oHitnYc%D#QgbLJqk87 z@=@IQoQOuI1>lYJ9}S#^o9Ye1rpD9jy0Ik^+Q|CZ`^ZJVb0Vb@r}X;#!}}iuKyg?r z4VSiVfa4O?ecnIDztG_K zHNt+U$vAvAK4B|?Tb`!QevMBBef&+VyCWbW-pkn!RK@ zah{mX77GD)C=PXh_8Jk2P_BqIXyA=p-E8vQ=Jm5MBB1OXn94tkZbT93%g(O}zv-3T zQ;PclBmug!Ekx>Nw!CT%ao~j7tmNHr^m)k z!R{eZwyH0zfjfwrkYm2?60fxHUiHCBndtfaY9-i8*y@i7f<4<>9OYtYdtXRGT`%(w zrX=s{mcZ*nURa<}D)xO-lJsn1so96s{dg%xz~h)gZ;q(}%GYbAKMM390dA1JXWtdu z{2c#9r({jB?4u6IntBD|gZj6jC=t4=T585F-y(Ccx^$JLLKZ+`=6S5s>49w^pTXUs zzc?MZL%hM`M96Cg=?eu;FY(1`YGyUTB+5$Nb`+a=yRN$^+%wJXc@;7v65#xwp*-nc zdlQ;DTWMETN~6gimrv~i4V1uRZ(`l-k3nqN7>L6q^}4t{hVA+tU9s#T`PIEb<(p`S zv?u%GR+~eI^zf!+!a)g<#rSWxL8a_Z0?L=iYiE#wu$QMMSjK1Fm_~-q$dD-io`r;< z$0LIE_o~PIlSH(p(nt-&@Yy|rQ~-d-d9%6db5mec#e&WNYPRVb>D0{F2-%_n3@<$C zrDJ9Cf&d=Y@d^KxAuL7oXNQkenz+lRQW{!#)bMw1}2~MtkYhG5jfroxG2c$Nm}|AV}^CLoE-%Qp;(%;da`89LHw# z5K3pa>3}zFX*s@g=+t?!S}Z=*yY0-Yc9}F>CeOFp_(G@EfOWoejh$F&zL{(dbkvYS zFHfus(=Xt3U7D9g(@;pW;`artnvU3hHv8E;tZvL!x^XTqKXt^#ZNJ)>fK$2-@a|IW zYq7_iFFG-9i|5DG<+8&oZsn->W#D}&vGL{Z>{!4dU#(FXnA7hVG?;d22Z+h#M)$L; zIwi|2NDEwt!ytuqr?I(gZ(|64bw^k26e!0j0VBN_2GA71fQtk`-Gy}QOr*?QTg8o` zalubnUH2F7{L@zGpO^MNTNp9;shrkp@K~R+N|h#ZGK0?8^;Z$k-|q*M(!UU#v+ojkD{G)Yu<$yZ zuZ@Zro-Cd0sa*A8cmHiXTGx8h`Lx3_rmd*U`350fb&F;(_jf(C>XVyuS$D1~U zgXdO#8uO#|j@E_K=_&f<$t*TNB|uPr%;9swFr`tFY;m`+WVb5uLT{nJ5ffG8IG$e>PDu&+@H+Z0X{DT zAADC}CR?@r-o%y@w_Y3frAOdA$QB5@Ev4}VoWb0?o*Y_Ax&>Q>H84Y57v-WHj^@7S zWsch60j=uDfR|Np?kB9Gy2zd3UeEcj%Nmq*%0+-2 zYWR=fzpKW75VYRI0pqPYpl!d{@rE+&QeqPnQEq_{?UW?Uy}_IB!E3wNfQcn6@$Qnt zCeIZ8kk=D7kyidwWiu8DR{0rb-=JUKLzDYc%aO8(?GnE6yVm~A017EUR3dH3`LJp^V1!_*OIKykYGL0SBpoY}ApTYX%^9)Xdgc$< z2d$U1Y2jUHtbKdZS0!G?U7$-61-O)KWmrxJ%_-4NDRmveP6Bia?6SE+#{yrOEE;5c z=y_iqey!v6iWd^;ufdg|91j0;OTK^&ir759h{wD0e90|TW*qKs;v2FB{P`YQeQ~6u zdJT5GYeDz-2x{kU!Fz)hnM>xS{=%3NaF;d3k}Fm1E^!@J3;D72d4)V2!QVJFpC24Z zfqm5cYzV8UKN3f*R3WZKCakyG|92wb3nr%H_CK)G-ycNT;9;pjVKD@74tWoIQyFs& zVZ;7A%-UAsw)?>ex2AVS=`Z8r3V9#8^Nf+w%fl;cp)aSH>39)m(O4d|$~ipU(v07? zBK5u*3%m3mty$*7Pj{_2FEZN)+#KDAfFCMX8w?Ouje(sjCK7w3@GR^~;Szu@m2S-l zCh|n$=9n|nMcdpCcuM`BOW;ppk96O*tl~>zuYMj5rpWSJto0xbjU{*qf13uAJ;)h! z*!SItOe^-#YWka4{+!N0T*JvUBG7FFl^|@7A&mOsn$jqUm7JTaG`b@%cT52Nn@k>n zniw)wzxyhg$q?3UttvDx^)c4yMLTq=_uVFdG3IZlACI8hp#x(JJ($aAqNQvR*7~8& zKHZR*fQGz-`vv8{jMoCg$Uh4&NIFl9Ql;4Vb=%zlV}m5ps)r9MUg+F7K6LM3V#HJW*g@`QHc&!3i<=@zunpXWN^C4tcrE6wH!0XTv)BN>l&31sv zz1BtaTMrFKgnrwRWO_D}OO+@CV98$4kQVA^eAI5Tf-oaR6HSvo!NrMoKYFQjPCVpi zo$Q?@QA&nSJ3mhXy2s7mvbBY@GH9gcqsd}F)W84EBt%E8-v=ZH|LafSHzhJU^84`~ zN$nQfw^FF2z!m+YHZR>byr>KYH-=Gy)|W0ZBz$(1Re^fRjyBY-7w;QV@Mc71vqCPX z`}9{l;cC>sRI1@%rR)ze$L;U(Q=-s>d@u3tQHVl;tMK~DT~um4j~EOzSf(;0Rl=g8 zLaX(ipJ5@`c|#iaH;EX5F7E!TX{Gj{>Hdw5*7bvkj)adgZHb-pbYvj89nW4l&^Y#NGs zPRo_k;pCvw!pduR8Q6Jb0QfkWvNYJ~aZ8*PhB%&I;xBjfqZi_`7>cLmJ~8Q?wIFAW z3Gt~7AQ{ta4WSjjmZUQ%8%?E;Nv2nm%6w04ssk#z=S^6m{SUnaTG@MGSx)A*einWc zwo!sx3m{(mGTC(G{st{${w?mecz5SJU*abHMj7PKrmDs40J0Ox!JI>#5R-L=X${4I z^z{ARJtMa2-K<=b^HpZ^?D1MFE;E3XL~hGxiJF9JAS{>;Dz6{$8cFA5&XO#WCh>;4 z)!ReI6Q6xmPW%84c$Tr@**wAWe61uVw7jlP^tsu$g!)-Fg@GDFDBQ)Zz1fsjse8(l z_GjB!SVQ}0gqr2)-DOq0pd?3>R>|nee*J+08s~HJ(eDNhpa*19SyLj9ReNM=MQ!o1 zu-nfkedut_5)FeUJWh&quGeL=Mng{q? z5rXj}teJ)VuCqnR<&utWWz`_&%P7Bxa*l)kT?|jVOPXR9@BKtqcyQ)P?;9LnMP{`a{RAKJQK&k6I^=3FFQA_lu!k9r^fU}PFM)UtpIAhc z8`S>DTmS836!0K|M7Tiv(@%sr7b|F`>~g0<&(XsL&Qu;iq%F?A`uW^iqziferjv@! zeMRcvpk8%fX+GoDpypKBtF30QT5CFQzj9*&v-B`@HyveR=Lb+p$DUH{dm@sk#KU-) z71q}-&U>aswALG;X&Vh+X?>3$$PAXatbXOQIJc#b!_H3?4Jt&Rh@f+2|ka=<0T``(=F!!5~&qT6|i6Vx za!X}QcT`R!P=l;*>I?X3*^W4DL?29oSw$i4P%du@8`!uT1s8yv8DEp~o zF|zW(h2#T5A41Mzvl?uByVh2jY;0BfM@L8Z+g$%d+TDob>guYmu3G@OZEKwQjk%_Q z?x)4$&mld4AE|OwNW1e90ifaq%cfz_$XK!TF=Kr*LilEd=Ur~$$l~1;>qhmLMOLE?>D@P@?7mI`?3YS zFt)9BP|ctu$F;7&Re0Hmz7WBHHrMAE--R@sAt=eH?h#`%P1)?o0Za9=)cPHRQ^6fS^LV*NOf90mWdP^8U!Yhry z6rtSZ?HA{Ssvd37;f(zzG`j9d3hKQzE4u3ZrZe}YPb`oaGrO6187F&7zlwB4IP9`T z*{9R>xd;{%Hn#?lhjw zbi-pW&dZCE^lWsQ&wV+)ORHrz_n2eKkf3JkX^CmQc?^?P>lBTvJWAj<4W*kZ{dz=c z%5+W22W&l~_fg!QO9!Esk2$S3OTtEfg%&`~y}8*xN~hW;Q{8bmU-NgvyA$!- zLApL%bvSkmOlfO&-s~wEy#?=N(_Q68(3^gILJK@4W4oLAgTt9AXw7kXxYW%Q4k#{D z|1r`H&e)}s*-_R>gTn4JOVz=Ir@D2OZ1rvvxV1$~J}25szq>|wq0BvbjL$vE@I^3+ z)Wjq}Uq8x6)(+Z?=;z}KUt_nS>Y*~f(qW1#6`d0<_T)pZ$JWno%D`iLKfg(s9x2En zZ)|sWmsX$#86V9$njfY0isbVLK-D6%0h9i4B~HZWI>hR~B|D~BsT*X?X<@qG zrz&$tW(rN3aC#E_=j1E1Ok2F5QFzA65%7&Z)TuQdoLE&RGAh6iA~!)-i!I?R81g*Y zM({7&1`dPz{@A&3Lbw)QJ?$%@>XzR9rONpNL>yjrqt<6qm0#xLiT&55rldg(kA_!@ zElxy>_<3$e9{?6Zh!p9svtxqV%+Ow%J!Z)2y!`*O3D2z-a| zagairNKpmyYWLN5F0Wbi^Iv@|kwd3Mf??lY>r3_r^o{E|W}&R_(ol(i64I-c)U~G; zMxvPu;Poj5p8MA`G*~;BwK4@u!T!{}=^tCf;{{inn?{XcXzStmI1OIJGKU5aRB$uh z_lkOP6ylYd$3rlpbpU;^Z1obBLC80U@&QFE+3Y@=i*9_QZhji3V_DbEf&T%AmRBbu z2h^V{Au=1YgI)V5aV<^p!u3uCWzuFwwm za&HAk$7tvaIptu1*;%3IUH8smj?X2h(_)*fL|+^(u5?^p-w->d!ncllXX=YJJT|lB ze(!pl)fI3)3b9Zm1XEZHAmE)jhtymz0-7nN*Worgx4p_V>lwd;ovc-lgfK}=CFijM z)5SmQeLqczC8SlV-hpE;f$mH9p@*xACp+1!l!eiM$M4jva}-;y4a4*w{K4Tg#%8

%@%^;AcwejRS6vbw;8e4mPjoWA{?~T^D~R@y|%4 zX${~jWIbamVDKu2smR|UakKSp*5C_!m1la zzEL=D@j$hnDXG6)G8;;HPVA4mjpAM(=nbg2Th<>)f6ihd!xYH~6?;RX3(5%fSq%;7 z8YYlbKP!}sXYX|xxQ*Lpg!tS9-1_uNsaKq*nujy$vvtCM(xu^ftc8a|C561Y2lpdT z%9lpRJ%LNM!CR%wsW5_ynd$>wHPOvTsQ_pUzDTXWDbHn>c$ZACGgiJJR&Nds3`$LW zoR!;tx<76@CjM|9a9s)07FiUP3!ApC`*;l=`ZpJ#TqVD$p+8cfo4$XQ93J*PnwW&6 zhX?BM@v%y|Xu{@kAlb&tgx}&#r=TIMb^f1Kf8P)@4~y%=oD83xCF}_Ni3DcG8ttZy zvxko~8RPaR{xdhV)UD+@{g;QRq(T@N&o+U+V!tQxc-Y;-4?c&w`KLKZjgsXtf4qHR zA0;2oVx|}Y&&QF7NC6d(nLp4?;0j-c8l_dPujK8j7J8zWYuBUbF)=-x)Q6+s|AhN1 z9{`{>$;wD<7BiM#cFZmV*~?8{twV!x_?+wAyxB?e2ryJ<~Iv3yuS{O%k|Ujn#nbr1{s|3a+BzumSl` z7bNK`mBa?Bbti9Q|C0FwDhbX3!91^S6H}6Oum%d#gOKBC_!x4FeT_ZV% zH<3%+yOKul(j6?u;34L%8Qu!VSjPZ>IEj9%XMslT07Yj53cTGBYqB!U{d%U{DAT-~ zF00P34%POhp=|mfs(q`Y6?nH#8q$j&OAk}(KDoP}#Exb7gJweALIfL54(U@@z#)nz zZ+%}(iUvlPcGnhpP!ukwzUz4;v#McWkEEnF*d1|hd_A{Pj{HoK|DFy8iUETj8h(E1 zHx$l}(b|JGsqX42KB>qBo%Dj(?b=6nqX5`NZ^1UslhW_9J4yM%Dk86-0l?j7 zEbGKlu^D6`nRh4(h)U+rW;;Z)@$ALyz;S0ViJ&j6n&nthPC~VBAz%@2^gP7|gcF8*$jBj$NZ zl{-W_tsk&Iv?}N#m#+>EsZ+ciq zroF)T!Z;A2!V*{O4(IVMn*V~jq0B+qL-mJ5N~3|8fs2lrcgM*`uJVW0_$zc%nh}$5 zk2re^YQM|d;U=#G6mK856!qQI%3Tv`fFdNH%k`bE+j7F7%VRi6ZVUkxr`&uZ-f}l~ z73B0%p=%D1zYVc0S#OlU8a3|Y)K2h8bTi0$1Rj_y@1NLatV@O>C2laEJd70Dx zA-|x{y#h+3%ubE@aPYH)R2R7>Q=Q$c0*WBt*V4(%IJ4nI3Y}@H+lxm@NV>bTH6t8u z-&lQF8d?Ky6;zIi@@%_Xepyp-JWOt2!RvIR)vRQ^0|2I?&`k&Avyv|edF?jhz zv?jiJYOb>Vf!*}l7ioVP6F`;YgNbRM`IzBM+S^*lG)Az*Baej zKfUtjIt=75#E1u{AZ2OA7mX{3(GZnXor6k)vQoPE$vQ2(KhHi*t;6?r%wdB0we_7p z6I(uwd+TWB3I&7)!($9}^mE6D=`7Y-h|Ng3O?8i}o!YJB$3`a|HMe*bCYtJ~yEBCW zDxU84u*N2e-I0XxHX|n88hw;pDWq!%zEq9Lj3$!~gy7A?_4~~MhxSQd=972_S^OCY z9SpFyoEm}1deBr`+CG}x9PUTQs>dCz;3n`rgTq+K`B z_e&~&uJHw^JxI-_FB)57h4|r;km>7bxiTnfuB(8uUnoMZ7;*-{WRbh9xkW|t0+2C| zpuKMp%>GY2{=bYDS0rq*PR2cK=6__+!K)v~62H8`EFBY#Dn(XlGWLgHB^jR^BvHvy z$zcx%LJ>tSPaQci-(i?^kVX;j4(CWHwOgCWCexXqF;=qc%sDJYX1MH_?gvkaqj}-i zSAD2=V3dO{M9esD#;Kh;9(*pAO_KTHgrm6DY+1D~M*YiUQLcQsTIcwV#ml*E&5uj8>@H(tTnp^CTHRB!5$d^ynVO1Em zzGj@a7j0BxkpWUksAlrFZ~oMNJ>CEG!^YeX8K6v2;nsiBOnC#3!FO}Kc3a_X&cAB8 zbXK|A4yeb4)yveyJ{HvqV|LPZ@?tB1?S*h`rt4k%Ke5@@+0fz^E8OKY)lX%%_-^a+ zlNC%iyA873b+~4*Xw-aDT+9)+A+d5gV8MyAD)jWe`orpEB}Ie>O~6w-2I^@py{UA; z-+*WqZ*N9E(KLj{!Syv4_%GWi>`(1(QH`k%xqMwid_Lz|xq~t)xt{vMvisf_jDCb7 z&6pqBZLZt2=uYud zsj2LPb099D+NfY7yeKh?D6ElUGdx{;3fmJfrt^QMZzQ^8d-8wj?xo%$>x7Hog5U1@ z&e<=X@*GyjArcxx6nF3TDHD2j`KMM~NvFCEd^dd>@TB`*uJTYv5{14o+Xes!f?cw3 z#HnOTdnn*S+gx(exgE%t8a{o&8t#1a*0FnYdsB$*)7~rD4btf)xlJiBr{9hs~d6xdJJEZMk8<$-aCBQ?XLwm>j zk~rKI`c*0mNAXKvrZe)ESZqZHQ2hi-E9d4Hxe!8FI(;6LPItOBUe<)x*U^3+`#i|eu3v0@IKc>qPZ*ls-5tBkSe1lsyI}-6X+NxQz>~O~$3Q)b9@z8|DdM&xGCkpHpQ`hz+n;+-eocuT;>$3L= zMYJlV>g-OkC17^%y;qRSGxdj&S)0?nMO=I0C34GHTW8&X!{4ON-ZsCqIacCiK;B;N z=<=u$x(BI>Ds-LS`Iy!8JoXL)b-BwTQYIJFzm8{G*8K8plKq01m?vu*+C%;mdz`Po z(x5hTkvdYG-J=_ zCK`1taGj zZ^S{eFxG#H#is~NF?mSvrF}#Vqxyizd#-S zQV^CpCI?NSQso7 z167=$plLg2Y|yanKr9|z>hsSzO%h>8yP{>UfRp1L1!yWL8NP3?^wWoM&X6}MBw7`V zujalIa+i1Z=_iKoOe82WxeVx=PgAxG688VB;8i;4@N$%jGR=Y727=#+T&K>Xtshi8=Gz{{^V!(ubH) z5ozLxuLC8MeOR_kA1H`nqF>-!4MIPIm3L#6>o__0m-v`Jf$?dNV+aC(#rD-D&x!#vk z>ud~=>Mpx7)~29){&Z~F?7+EUHw6Bp7==Nx>kjB5_&qo6qX$2zBAGVaqC_VZ_a`q*$M74j@BxRG zT1PE6dP&GvCwWWy_0gGtt>vHIaumW%Mpa}upSBGCv`Cd54bNBx3)b4T++Z`_muWX^ zmK(CpEkzWC!A49Lft5p|5OSG6+TPiDp$=+(7uQj*+Qj=Upu+Mkedc3dlg`134Rfoj zY#z5qp!SoD;GbNjFL{3kqb=r588*j&1eCDjuovauX0o6v!zTfCFUn`C!n(FZ6<_($r3JbHP`(yGt4)p}*2@&DGo&5=?0$qlC8yQ*XYwLF-aE1)8OCwbaVp$X;*0 zM(t!5g58@nR%AgX=8t8^EHz#bb%?mItjP`Z^C8#am=RM$1LI1~>+4qk`KWwu5icA{ zUT1w0Y7uiVT99AQ9lvM|hfEwopuw0~u@x3el!W&FSVISo)rOm-rAzmObp>}a`$4TO zXh0#IA*0XheYM#g0bqiof6W@oa4H;{#fB7^`vwU=pHRr)a5R}AQVv@Il)Wa3`E@Lw z&&o%@r}#-YrJS2;c&=oC4(cjz@lE_7HAaL^;u`XxaQj1YDeE7X??_Qkay0UAy6#U4 zZOlZYY5fj?PHuCrmKa`}Xzt|b%Hv0g^-9T$lMcMrWe}{h{fLgozc5IHZeG!7C>#_F zVwdbJnHDc2*!s2?Di>nCxn~lNIjBCE9BG9cXXxl=jY;)9{89DmEKglS;}KW0y>43R z83~*Ekki-eQj9mQraosY%KCeIk+R}qFhJ;&U2Wp!Wwd7*)u+JY&;}(aGvrB~ zLQbAD<&Z#wNOc%Ol>NaS(?e62eJ^uxG&7t6g$`z)6*qs}Dq07cDqtJzYgR4O6)%txG|<=r z_nOqu0p=W)23L5ej9T^RRY7lZ^T-n_B_QtBPAWz}FJpwHlSq6@};Bb!Ssh|f`kXVU4o2fPOB0ypZ?%TWivk^<)I~Zv` z9L|pv5q|E~f=Ph8MQ^=P#2ZxaJM)x?P?c52X}@;w3uN6nkq;X${rYa^$CmiT*&b3^ zc-4(HsI-_be_IUcg>|VCeiP5Dr3B>qd>la#^1XeZ+kPKGoefI1zW~Z~DTk=?T2hRu z813~|B>PGwF%*#nBcd>EF!2s{CXx0CL&W+*gxdCc#1^Fvc$2H;HnR<3vq&|{oxHNb zmX(X5#l4q?Nxuz7Z6JniF!6%Fr7DhqR~98vW}yQX-CRl!C`nvhrDAP$#z1kJ8ZBwl zjK#?@^)Z!Ymmp(><9Zw3;@|I=*#xC`>Y@u^ROO9Iuia*V@m}c) zridtp>xTvyVaC0sQ3rqF?QJ#f`Hc^LeY8BXG@({mSMgv^{#h z_M=5b#J7`a?1d(C!goN}9Bkkfx|j3lLKiGNrc65*up$_9T_tUoyO9A_Z!(^GkV?EQ zdvi!~r15wUIVD?HYZz4rTF5e#v?50U5&gSPd(9nxi@;I-Tle2&ZT{o8E%D1dG7ZCD z(C5pe-5oDPJB-c?O;(pMC?C#e|d)S#ovx_-ueK4YI z&+RZLoBOS3ZA#2s)v@1w*47msrQE!Jo@hwu8?(a1wWoKz0OCmAD;yLmFUXLzhes7r zf3%ls*|hV~$+A?j1x%nL{=JVQcTNFxbJ%+;3qUGfOOp=bh!N%uU<(e!w{(>E$Ez|8a3m}!nGni~C92(Q+ zjB7YuV({FY>Y86W%8Cr#e1)2spxN0X4Z<Sqa=83uF$UnkZNj&!1PZvYANy7$s}tnBUd>!$g$wdgJ}u$B(`8bfuH= ztB`9(Z)~8$#9kM_F?gM6Dht{gtrxN0zQJrm3&XK9*nUO9#16ev3<#V|H@^n&FNMR@$o;}}TcD>pQ;Ryu&!a{8~Ow`7ANtY85dW#fAXC7O* z?@CPF%`qU(Pjh^j`<5AO|pA4z^HF8A@HVuaLG0MMvY$5+KirS+|C>}%bmvm9?wC*HXaoWI~SA6?J@0& zMEr9wyLh`vx@S3*T8?+G(mYoN!Xy370*9}Qj+Z4`Y(hEv4y@VdqPjns zgx|(Ehu<4e1dPQiVFdR@;=eiIu}=`OC(e!+(z9?{tf47fIkmO}+hWT)Sv4tnJ83K zEO{J8ibc|js?I6{+_a%{bGi5EUv1W5pe5qJtQ6T2vGErkb?HP%guR)dk(%TTT?*G` za;03@8Vs883sn9hy5?4^Y&AR6ehE~KilYOG{+1 zt;w&R0kv0^&esH49F~w8*kkX)IkIeuL1$ zHr+DRM@hx6{u7^6S^nDhur*i5k;^&An+;->yLt=7`yHWTtY|8}8qNcKQu z9aSL}L&0#Cc@0IX7{A+oxtUw(0cnbd#F-^b3G=c$g0kj-w=roJ-lUM$1t|0~J->AN(vKQ)8X0*l3EtSUXlLOQiKL5?+KCx6rJvkHu zI^H~SP{l)ONt~>!`{5F8F0n#tF9t)hi#Kmmb3?6cEFbBFQ4<|E&v3oxsY%}oa5duK ztnPdvr2lS;u-rriXKyZ#o5ruC^_QO?fg374ADg%yMnXKOoEvJ|{IQ1T4FBY{gvt*P z`yIZM34S4V*?d7%S?!_3+;LkpTw{Hw;|h==iZO37FqBlyqThzJCL}m^Kr;Np=SDbj zJl*NrqrbxMe(t0V{DDRjJ*j~+&VbysX?~I2aq5FS^EGL^J zaM`F&9wI#aUgT8BM*`teYxrw8@ z1;CpWBj|(jQ3Ijl%YFAIXsQEKHPJl)mRB4L9@A#0h9qx%7))1$nlo0rEi2&*R8TfM zo8eAdn2nn=O$XD@0O66uKOIt!o1@bx|CDH?)x%^shGSj_Fo5ktC6xA-KGL1QOC;@z@5SI_+{NzM>y#&KkUBoA#+4yxA4kOO!m^RMz|h0j>Pu_q0( ze*JQAuE8(5!D~K7gYBxD9gZs7w}hN!zUD-1qPUP^!xP>XuYVzs)K%k)g-Yp3)-|>Y zfbJ#kCT}oNR$Fh#K>XE}`Lg)t;`nn@#n~6t^fsvq z;+y!4%33P1BE|J7Tek-z8c2A8Ft1P63cP3K&JFg~?9IkYv|cAgPNn1yf8&dlNuVqm zs(PzZkytdwXb3DoyDP;;b?+uN39iA(D?Ys)g+$2wbjXUgz)rhCn>Qs8)Uny{iIFB{ z64nx(n8!IgIUnOBicYoIA(eOY=4+a$=&M~`%&**u3P*kR<1LEX5Q`ko(fHeQ{E;5O zi2d|(m=j-MwV6?qE@)Fy!6xde|IQvb9sMp>jK}yo;Z2u;&ImD86l>no#ikL!silAJ z@Ryk5c#v_YI~|?;rc;CfhHHVVWybK;P4yB@5P>SwC5z-OCfY|w$bM%r=zuvfB;l~v zOS=-ju=_6gf#Ba2rug3q6J{Xhxj!lmY_R@rNP7&A-Bb_Y5v5RV-PE=H+_$`oK7*uhe?$lu@uxueCXv0sffBU$lR*Y? z&p0pF;zoes_2J1`5v}LbPCXixF7w`pQQOMUO~Q}M?^HM7g|W3Q&bDiP1LR9W5Lkv$ z2BjOBbSX>+!s)lEJf}X4C^YP>%N72c3s7&Pk(S6x#GB&HFb}xq!zcPfKZ?pCrL%=- zPh%&SpgbBqP->28gA+)E{3Ergw6)I0v*y2$LX(~d&+?}`J3HwNZE1m!b#Sw(09Cqr zPlOQjD3QnuiHMkBgb8&-$w7V~_Ufd}*yey68pc50jAFDLFLPU;R)-BzYQ}p48}l~Y zVOZHcAYp0SZvjV^H-#%UD=m6=TV9r<7eX8DPy?%@t6ecDUjAs*nc$r?;Q7bmetMFN zM^|RE&+YxWK@UZ1GGzy8=Np5l2)OOkb7`3MsWQ_0>%CAQoz~AW-I$^U6;g5^=y|j*~j0-(Dlw#HlpCEojP~S(`Y1v`rX`1gW=->DYJE53)>bQb7V5- z1ncNWobz$R+lYRH9sg)N=e=%NaGmJc%_S@uf1#kxivZ985aQV~j$~;lHy`B#&G1HJ zg5YU|$NC_M98>RT;kwN`cxKam0W?e#ys5y?z2jhI!x%7GpPbR3VUnp+Oz)E{k($WC z5l?8dTKjeKY_o)Pb8vfU1oG0!g@AeISi$`Xqt=c;AO5}Q;X>(x_ra(pbijMyWc&_) znLHJZVIpkZk!^_@M_-GtVVz|JAHI-UcB|djGIqAx*}v1D()n(0ic%+TYaog;9q$1K zvcuQBgDsjX|P>#gXb$WIN!q~*aS2zH8iAW97EDDxEm_h2O2%^7$EOG+}#ka zsRXFT6y8D=i|5WM(7AycjROOt(xf}^<`m)2!@HYUQbt0PW|2DfuoC1BW$hEhs1;rR z01PV&P>Hkc!2??X{A#hCIrY;o_Nf*=-!V^!FFU=wV`@p9fdO*4MAC_JM&p3C_(N{0 zX~T7V{`cGq7QRI!d;7%4pZoGBh`M8*&~mS+zIOl59v&_cWC!f;8Ye>D(vIG|KM)9` zLG7-1oi{x{I3nff7sj&_ceJZ^@{;TnY+k`RfI0n)F~=UJfzq>-Tk#<5k$0Efai#OG zeZ&DV@VzXklQ}#ncIWy?08bFi^h1*&PWXTbi z^CUJa9vY|$jUwZH4i$%k=J6|#U(ERavKhViLFKTw*jj-DKKwe|TZ+JJzW%gx3*eb`|Vx4kODcpyK+2#@71{0TFolM&yIPOULByQpTBj&?s z8t5=@#j@i!Up@1`_dGGt2&>z5+hfUnxV5H;RsiXLH#Z4c!HeO5yqA?+TWKD%Pau8J zRXCSuY{R1OM65R(9c=JBn>KH|^r0RO>gap$w|(*Mw1eH-Y&%&ecXBZotSk}uy=y%1 zAy%QKKV6Wf1QILzl-}?Vdhoj){ohVC zfM%n@$bov{ERQ7r!V-UPR{!}zhW47ekOARee3}1#*@*m%G36MdC-AQu*?+zd_!NpC z9Dg}B|NS1|Z)lb8>Cln2n(8_KU(fpIlYz&*`QP62_k;fLFM2GSefpb(e*bBh0yY4z`Kv`Zugm^1+dCU!>uHP8Mv>&V^%lTm~0 zf18GX|G5Vnn2H++jqauYU$ZJ7q;CGN5BcvGGJRkw5>z_cSpNHW_^;mxc-*`H;~z(+ zkLLL{V8!p{RUA|#MC9>|d=WP0FqGet922@Xa$7_?m?g9-GcvflzeG`uR{b= z)DIX#SaIp~iHC=#`{xg98^kcdUl`!)LE|W;FBIJ*-;X|$Wf*|(8V&#R-5_9T)s2lWJ?*g2m8XZBjrH}jr^X^qEw)s8+ZDY=+M`U?fJU!L@qzVjiPP(G!lov^BJ)w4a3X%^CYhlH$QGOFjslQ3fXZp9AbtLO z*u?UyW{Tr$BLPUnt5qju*z9gXL=3>Cl@SPsAUJ`(Kp6Yl-=y3(`FO#A4w8WuQ}JrkzNmb@eg=2zXnCv zjQlIdw_U7}7}|Pa72xCR>tXGD4E{7rgbuiI&{NVetj=Or&Y>E%{4Vr zD;|N61?_4(as0!vH9iJZD8;jemVp z6}crou@o_x<-hg2%_$rV57gGw-vqo;|0W=WZlYLE=S zw5O3a(`~k8LH*!_6|!F_uGl>_y?&>E?WMVwQ-@Rx!CQRJ(y&$^S|HQGdph^-!Vh9L z%wTOZ5PcR-cq2gp7`?hHWb+w>@2z+Hg`Bpuv;?ItYF1?CyZ*r-_m*q(zCws0Y(%Hf ztpyq*(@FAb=h;t}M+c@e`QSyHytQ_f0`a@J4`>FB_Cg=r_nGV_Gx^`#UF<$E!0rK7 zOPQ`}F#nji33*Ws&FOB1H;tx$Q4stTh*@?+8UA2?o6A zhXvG(_#D??X;$e(9RWVl8lyPhw5sgCwV>ve=~le6Uug;ia_LQ%e$k5!h)pW6RviNu zUF1UPs8DVj%?J{EucO6UIAVe3z~Yqo(wKvg+Q+nZTuLhR3e5_JHbEhfYAHsC?HxjG z3WwLZ*+PdMBOiU9uph&h!9MylRwJ>&K#$(d1Ryp31Rh<2yF%~s)b--H< zY;pRn?!;4t(h|9X%>X2WE*S6(Q>IzblgVuZdFguX#Vec!LF22Pl)vTBTBdk*sHuT_oUIp}gPscyFp`{SSt$9pDI@KqmI+ zU|;A+flA6PwdojzeRq|FGdny}YWg(5Y&BaB?|;W%mCZo_`V8F($s^sFFbW6MqsDvr z&oWj)D=t%)$GoCAByslkCKOh4QNK$@wbo}GjH?M%MDo@s@Az3T$H22+|=SB^{E|-Q6W^(B0i# zQWDbL-Dml}-#O!azjQbTQctY4?(3R!7NI;l5jwTlOifB^7*YES9r2LL> z;BJ@jc_ET!oR&5Ne(w2EG_cs$24ZnT+SubiKL9(8k|$;Pzncx*d&1Xrf*j3G2L*k~ zsoXy>h1|wmtVY&;sXx8?7?j3mV=$3N#2dnZWafFdAOn4ZG%ITVHy4&B`Z4Cnu&&YF zUj`b4M)qR2K06>mqlNII=aNh(;Ms7R00KM;{xwa;jzjzB`639g{m?yk!UZD zCX5F{XJRiBz=g`JU(;0}QCF!=z>GB2TAY>k)<6&x4k7^b!C+(HgQ3|sPf@{z#xD|Q zo5NzXIqp{n;$T)PLH~`s)#O6v(?EQG(Mt_OxkUqDng4#Ht%UK0ua?y$vWK==@=)+%*Hf`K{+=EECRM?O4(N5zU^}We09IVq@=FY6JccXVwoPsNKvS4 zJVO8o0`?t6k_m-_%Q5VxMS6VI-UdYB%Rg@*r)bC~vUY>_{mFX&)1P&BcHZG1891rj zR&=AptbJbtaSXR2t!%H3yIMT%0=@y900E@JG|72?svhO>{!B5&mh@#Y1ZlNb3f!Vf zMH5r_INQTLyV*ATSU`^Mo|-RT>s9mJmECES zibm5Xi1lJaz^DE=gZ(}OUV`Z{{9pjaTiZTaLqtSOm3QhL$$0B|Pg9_n5qy2J8ZaGx zbLD7ZzPJA-^ZCWzZ~UYWtdDVpa#En9J46%LRV-e}D(1gCeWNQqx6&z9?sy|p^?4jO zfr&qrPat-TQKfM03Vh|%QoQM{wpd&yBa(4}XiC*Gv}tLpOWxFo-uWo3UGmdq!3vpz z#3yUL@SPF>%^jwYv2b#GK@!iTjtl@h*aUipLawI_?Fo7IOM?10z-TK}?r~?$toykl zxF=){b9=yu{%E|$imSY&0!=o|tVo07@6HYj{>Uq|&)JSUt8ZOTQ9*eCPHPV0wSPcO z>3m3PHj$T!sohC6z(I7Dezv}q<&gW~S3$+JZ3|d2An(oCVC4*iP0s|P?fp&CKONAS zt9K|3f9ghwOGqBI%~&zE!rB-`p5OXFMQrk8h6L~5vg!JY>iBQ_OODVcFPnKTFi2dP zzu4=GrhIvOerP^zK3O13Z=DTH8_^GIK@<~nG+a~iqd+abLJs(@NP3Iz!PcfQ=#Gio z;X>A`bt?at&;8kLLWh?b0>@q#GN*qEVOFQ?>k?}ySAB#WhEy=@xbn{19F7gJ_FBz` z{-VE7y_6-J?9P7)N{b;BTqa%MC<~}+1~57{(8&dZ-7ZK5l5a0B5(U{LMFi_c5}1M3NYWaN<7N24?=O+wMz!+J_{x@EkV=j!5vUpygE$ynrz-bxoK zkcxzcCj3m+bwcy`n1j=G zXr}07vAW)L!$!6Q>YTa`7u`Skvgo&{Dtsp9HVaN)fM5r;Dc^jma+45R$h9A~ZM;(|GTY|q zxpXEooJnoFngR}e2*P>S4 zWSnCnGa8W<#9v(!@XfwN!04=$Vmm+jLjrO5l(c-(mZOqn9gNSy|LXFH$>q%Sf`muH z=l*7_!c_$#x8hQ3wd~`MghL5t;=CBNV$?a41rZYW*L1!f2lHr-hx?4sDzShGu~#$2 ze`vxUec>nJe}TM>!R86lO@pe%i5OYV=4XvZ#yp z(S^+1yE+W1wN>v;8?5(@*Ex?m+Ja5or?>q4ITi$b4n=FBcucf*o0F!BJMU<&gxnu> zF3J6X6`PWp51_fW~3(+wa846$3I|G3n2QxSCX2#jV(DaGooE&BmzB)r~X zl`5DOy(j0}b0`Str11|?w}@y&i;eC`NI*|kzU{EkI!Dm_Tnd%KWW>SnZ|&#bpX;3V zY212uKQLj2K?GuH5E-YXLETD~^^`Ur)2ctWwiNsO$OEOb3>3ZzQQZ zxuQpv*v#gBR=Z%C^vA*vYgfe!cZflMoDneTz3&;d3&vtJma&|#YAf>o?li{~qjU2o9bUz+ZpAePQ$ zik>1z<4T^X=d+>xVyL7Zbe|R*>W#W(;=UAq`IX2SW4+WAAsIm;Ys*DHHGntB?zHbR zq+j;#a1Sh?-+XYyeLwfz4##1cCdcc^15LNl32#rXrbv^+ehM)qne=M+w*_3(?Zs}k zdMUZRj1i{tk?_AS24Xk*#mSuQNLp@dID@55r^O9#xlqB1OPrAaJGLG0N~x4P;G~mS zi!p0OM)jX9DxN)@a)EhS_&O{u^w&NR=F7DZ8e7`i7OhRAS%cfcPP4^dY8l# zu<3P##Cd&_*$6e8D+*b-I$oikvK~VOH9{Vdz3E{buS^j(B8}FkNB5ny(ea7jOZ6-R z35+cEcGrE%E|=R8L@IQBIc*Y#``00}jYr7HsXT5eY_CRiuURz%ec?~D{ba`i z7VN3_*0|m&jC^f!r>v3Sq#HeKKEA59SUnZJ8hb!MN2bg(<^!_13Z=<}x?F8_R1!fY zL^`h?o0%eGk~u=RFITt|lAM?4b6lWjM&B1WG1C3PQ^d?W3R5|ec6aJGnUN%FXOzez zLlC84%6g!osZA6^`=>zkh~URZcb@hr`YZ$t^7f6v0++*)j10TSdwq>c6Y=B_vp+S% zF?=?xmP<`&VfZXbP74e3gW2Qj{anKwIiRCrw+h8B?3d4VFeUgjm`Ic>rPx(&L~ras zBHTowRpS^l%x5tzX9m`afGUROe5J>EIFP{fO|5u$dn}v8#RaTd)NGl74^Zl8>0zTQ zm9-h1{Pf+~F4fm_XhL5x>ovUq#j*rvRjS+i&*{RY|8|n^xN&~@KX!9rKcjr#g)q&Ofhr*bwWKjM#wi)sC1=HsG0zqz8CDAoS_&G@4O*K0?e~JMdYwjqWZF zPEm!nXGM-44jYf4Qcm_x95~9r!ZRh5+lVV2HpitC6|e%~>U7a=vV`2&dA zs3=%G(li$)*$HVA%AzE*vWRKSZHFL^cPrC;+2QywS;OEZf6`>@V-y3z*e9M1F?TmnvSE zWZ?Nux#b*oO1f%In_eeN0ap>g}RTu_~{yhaG!te>4 z5s}YZnj2|ZBV{ZA#?5Z`oJdoATSdg}oRD#{!w!v@du-p&x{j6*e;lY$eNKLmuKjKI z>&hAEZ&N9@-(c!9YApV5YPEen zQethmVJT)|JoVk>?vTvw{4fj%6%9^0>TQGZWP{Bj<}duaYMeQZ>7Bmp(a}`;IcUef zQPx>-$`bSp-L#qqrDh8Dx6v9AghFbDws#i?EC-X_i8M9p&KQ7sj`J^s@V+|r*zw4B z)kibr4vmz`nkiy;hNm%`_>gMR-SrPmj$GpJGIIx2$0G0BFBXFWanbD3p1@wVz1TTu z;!D3w{&44tvefmv@aZ*W z(eIzCiOdc`QKVRdEO$ex8&7kZ#jR_gg*^Vd5d|w@XqkB zSC(ghKcI6O@pWjaKA=OdOYF4p)bg%r*JOqtc5tu$^9S|%!hOD}an zs)^6sNw2@ESowavL@!N%P+?L;p<@e4<3#@UeK#1+lBlRp_ZTPmlgNeObWP zfl<5F8V#TI6uzJIYUE_C=QW5?6LL9`ZVso>8<^4L09jl&s3*$1swT4HQ>nL#ik}P( zCb3ZzD5m)iB>Y-k)%OaKa2oHpFGm<5++{B)Tz> z;E!`mhDs%)+w-Rp!|m#jdckll@IvgAjEt%M>B7Rr&8@AsFl)P821?C`o3$3vT8+M7of2wzPbtL8YDgvq`lgQu`g43Hu-*uqsf;WXV6`O$p!JsRK+`2xByq_gv)O8{qMu?^dE&|a$|arH zGuGsbD^K$j4^4M){p123o0iNP>r4ll(?c}M3uSgVi8rk5jUl9hj)b|r@|eHqWfR$B z)PUl21M_vAJs(Y*@B;#}@|V5!H>3T}`-&jRJfJ$ z6Hec}%%JCBD~kMhAIG5l0;UvCuc%PYJ(>=o0B3k8T>l~kr|vVqX2f{&knskBB|LUj zRp^AYp;bEd6NVDHWgj^*MXpdt6=_mlvS@KjCNigtRhj?6sMzGSIb;sv2|&ifoLPvW zHvizk)U{~)lCzIzId0jfoD1S$;uj=E4@p2{v?#$IA5$ZKX#UUm4vXNq1=RrGaNHF= zrS6x#Y0)D+p>BR@kN6vL7ffK5v<)%J+u%0pLDgvZR9?3?@u615RHa4@TiNZDqbmGr zsl`FPsdOY$h{M8 z+a{JQE*Lj4s^qmLvZSp;$kET(GjCsB-2srr-|LgL?|(H!9r5T`Qw5EGo*zxlkW^dD zaFSpN2L?~LsFc4qMq+ZPvg#riYt`Vkx?&f@Az_EwE9B4HK2%9S8SgK4`7mV-fJHhF zztHYIm*F}?O1!FxkkCRmkF);k{@gZ>%7ZP;@d%RX{ukm@0}^Z7G2-p9Ey5nRfg!=@ zWc;W=MxFpOgGgdG7tPrR3n28*$8;hn=d1@or#K@oRD!qTL)M~Kf}RSuGP%DHZw~2t z@2JpG>CPVw!+p8WV@$67h_xw~b-NG1fw}I|ZBm%}RTxlsz)9 z(Ev2>i4ufl<4fuX@rN-g+Uo0^65lE=-xRzJ)A~ZPdX@THsk)*+pi%81kRh2(1PIR< zIqg?g_07h6khlsJxDf`Ti1Ab|kn6=#){5O!oGLgUEd`8vw*%$} zHUF3G*Jqul^L6GZ0F>*mkAepZ>hd&_b9KocNot3bFTbvjb@$!N$<>Qi%wuH2b=|wq;ZtYRT6yc4y_i0ZjENq&6$daV(|nsU|36I*Ta7QI7`z=7q1NF zRE~|wzFMe95yRY>$fT06Ki``XFUp$U&}I%X1LAS^k8SLb6=tm}OwLc&?e`uo(c-fF zI4l{0uEbzs*VX3ZL1UsCV%GJ6>SFjm!{lpHxS|jS*l=k;Sg74Mquxl{&oe#i8%{ge z0|{KN^%whdWGDo;GDV+O^u4;P%nPuor!^hcx*}ehni2p>i2Au!?hpx*aYL1Pxj`pC zEM4`7J)U`z+5}L0^m_nmVKiLS^p{;BLBVp91O9Oq&8^J(58<3vk_F3Un97m8wzQi* z0(Zb%oL<*?dUSVnz(fC`f~MnZpnF+NSKQh+b&CEkxq)coxj{)Of?lXtWWt7U8pMHX zIfYagCJo$YuTx#dZ#7%>bWdWrIdMiag;WHwQ?hGwa;d>l7UkUO-PIXZE(VhD9~CNM z(GZ5033qN+SUz01I(yyVC2UN(0>1A)8q<&G(=2J-JW1-ElJZ@{-fQ&y$7aP$UGpv@x6ndHzks75Pouqm-iS5Rfv>D1XO-~MSb&+WpI zVML)fwKM+KR;t}7iD;+6oHLln+N)#N?ZQ;@Y&bR5kO_l~KfK|B(DpDY9pYeEek5k6 zTvik8=}N^<=CC>3d(IdaeR#)BfjK@mSs-1H((oRvU}H~k+0>w%tv#VcC}4Kk0USmg zUrymD>)JJ;R@mc_)^%SuIPpibn8H*6*;=`DnJ}qgFE57i z$ij_Al?&4DbP0Sf@ z8IRP?YdK4GLeuOHPU0k8MQ|wX9_2ImiCMH$bv#)1g0(=Ka+tWSJ3lO473|tS|4@|S zTPfCdMxNUr%VxRUhj?!cst;Q5L#lCQ_i`j;%dGxbyHZ48p;?)1AN}{d=IHfDd1$@j zdjDOe#wIb3r8l`y1A^Q1ew>TKp>lYA9&NN_@K6dTY*l7ga2o13SFxc{^R?bZ4UIxr zu4zWY)dz_!B?NSmZw)VqTVauSyLeNyTqZ*d^)hA)Qi za++4;-U|*;wbS0sq75ZTs#D+n#N5cqz`k#FcUdfb_wW=!M2esrN5H1(>kX=<+-BbX zzct*R#&uoB+MZL$Lw`sC1CykEni4{x!bg7`qJE*B+abcG;k4T1knOw>oT1xBWyzRj zA3Rnd+_RisNeGryqWY}c(mh>a92WfEEW%&pYXKNhim4`lb{k2rH{_rcrGtmNM;1xiG26`Uwkmb;K@^EQ4w1$@k2Jr#&mH34Xxz#!V0xysJ;lj`{VtM za;<`uPOF`+f}wOIkz=#`nDo8ca^!A@3x z5Ro#uT|@KEHwlFn7RQ@hRqQ@Iss%H!WP_6fQG_I?e<-vrstW(e7`XnjDo=E*;^jQZ zn?yGHIk)<@MCQF<6M2$cCwZ0OLi0&egAv~VjYh)|ja%vYJ#MoXQ6(9)vZWWWkG9Zr z0MQ!n`60w#-|+409H&Vw*uO`@I141v_GB5!WcN%a@g>D5RakTeEdZ~`&>(}?-1k!e zPp13zc1)hbmRPSvUs;UUJONuWNmsS=E-(*r*^sL-pYY(QPQz#+R!36`*bJHt_rxAt znKcHJ_}laK)G|qL3_LNklwdVUtf^Np{PF1E?R;7Fq4KnIlfTX@qrq#0BuYrP^Jc zkSVG~!Do&kE?mfCr2ZOc0bT34$eWT)Vihv>%O8aBxn9DOboIa(PXM`~<;QBYG)UmGz(cSkWYiZN?=Nq%_LGQ{peMstyO1h5YM3bzG!5s766R> zIE*C02(euT%HsbdqTE7T1dYGS;QvCL&VXzGrdpEd6>@fbGa;u2r=FeR30x@33;3b8 zWI0UUb~1*T;}T(C$D5@T%VR5q6yQ1oygk4fCq1nC^Gr8Tap$pNzrg-b1Iu^Xju!o{ zRsDw7YUxGcJM5tV-;(fO>czNOUu3BUQqx^kJ) z3Okl^rki{wFAi9bahV!b_sj%iJ&f`2S>h`%)5>y~+|!_v&5owStKnX>Je0fcsmW!W z-{33Lt-&za$oZXYvF^319b&q3)3oV-aPSzMsxH*o;Q%ReH(2%>&JWGSj+ym&dx}v> zvmY)r8$C|v_Jk9poSbgIvF~KA4Zom0ESkL8KA|>GqmQ4lS%`;<72)-qzDcyJCG|5( z*!_N?jrQZpToWOTP!Le9S+uGpfPvxf^!Nu}tcFokQhroTPGhmgwxLcr|EXqE3RrZP zT;yDA^slu`WO%{1tVwU^s?(y*VAn>#dyks}kjJmRhMreJ0gJPW!oXcU=9Bp7}MM|RK% z--}?t>Z8WfOqZ90Doo4C87c=WM6gT1UM85_NLM62Q_6TSv9tJ3t%UPNJNuPU?$m4D zz#Z~G&F&bK15IYt`yf|k%!0mi9ieYuM-rRHFZk41&Q;!kCVN9-kcQwD zHilntEL@rD&{%e7x$&ObSx&oQ_kNnONqGOp&W^G0;;I;wZ}m{f4URIWD4|O@`JMU5 zKBSI7V=z814~XJ8Q(EsvxPNrWK!H3sz(+i&^YNmE%v$ARFQwLKK?7rVy*oMzSK;h!kr(C)h`3~2OIApuQq z)z2CBSfIDX!Qb#UWzpis!FiPYeOg=+BOTSd*nM_wF5OVwm$H>*!CWjsG!8MWc?c{`byYT8<{d zfyj;amxD08veB3Bvro?4Y#u8Axnppj|2qrY$dt-(=o>T0VY7ew+aitf8dS0K?9UQe zwio|s2h$wE05t0pII#+@NbheG^%E6G3c`=P zR?09Wv6M0{Nugxd)<#VUZ?yg>aSH+-|x;|wNYEp_*?I*K5y36z2ae5=NTNwDT?aLnd+qm#@XeAFeBh$JHSi>odO3MrzWA*7Oa%%lq+Pac4-4gn#wYCS&%Fv2$W{(Vw6^KO7(%u)o88B& z%pFwT|H$~${mvj|OG4LyI@*FYK_o7Jy%{mI`p2@HZth1S(J4pmYSq9ShZ>0-@oruq zf?5@Zbx(5+bJHUjb&w0zvBCSSz3qxoosw*9S}u!^#XNNk-O!|x3S}0vuu;Um(xVH? z?o&xI8JeFgRP6fPv1NXdL)%wj6B#wYT5P)?M=x|wME{J9RWeYUp5S?n>)nVIB?cg{ z$G`?ph}M19O#87x&xif%-#OvsIHUZFz=OCkI+?K z$i*|0rx-n(;DYf43IvT{uL8WAzcS|S{T@^gCJ+%e>|xKqC4Oi*KJ#nEg#0-&fU)0@ z(=0?~3ARttD`N3k3)&geB2`L=K@M}D7yd=#V1j;Wguwb0ru|t zc38X8(~zhZ)*<7uruGfJ(``ra-KNAt;4RHX2Z+e{1`Q$M(8PlD4;kVw!gk&$jxIrW?6XhkE! zAKDd0t}xwz{^zyH6wxd?C=PY!d&^;w$NZdI&CW>7l6rvX z?_u)7d43m50Ml-}dj>N!{M8jWp0q%K`AooFVD``4a(>ULxpWg>5i zJa;m0ezW(plxOW&&mHcLe4OzIzDj!_@D;4Xa411hYt#GS@8KHUTKlug3Qf8TN=7P5 z&IMTbmib9e{^aRaRkB@nv-4G^#zUR-1XYhyJ*M5tYNLa%R2cEFj){L>7`_-a&aZKV z!FJmf4txh;0k3SfuSu+aQtEv7@$|JRU$tW~wf$FC6ZYP^1~T?r#nnc)GQuJmXCEBc z1~%`mqOa$o=ehb4$Trp;1kjj+I-P4hF?wU+{kn21e#ss^^%P$@p9mA?+`$Lp7^F#m zP9oennD9RNG->J++dXf2Q`( zQn~P@lTVd7aPEniXsa}M&}#A|xb^%ro#s0k^zv@~oA^XA1b>%!%D^&0KNjI6zbFXz zdMSqlzQ-XDezeq15zt4ZV;R~B#*tcku3Mp5fZsIXYf@M1fuvN0_6Kon_(T@-dsMqR zJ~!oBHk&8KBCpzl9~3OYd7%ING+LJ z4wZX@_25?VO~{KHajawKX*WRwva>fDL1Q1^7mN+5=u(-N={t`=ebDDX)e^U9Y0dq_ z9j+fn!yTZ@3GE09Y3rEvU;3Y_#xXn=V&q3+k=py#i)L&?<5A4g(LteOczt>~d5%%I z=80|E0ym}P*LRyX`~bxFPxS)^9x$W~8=r9SRcv-kB78@@zr%V>l%IB(afNZb{-Dz2 z+o~n~QiRD!Cx`OQ>OACih%Qx^q#SMblV{8f-@l2F7v+l@#C(~=r$?F;48jjPU_;3J3X_Z&VA}o{4S3E>bX{}^Wg$5 zOv>D>KbD6H_+^fN_kYJ$#`{-{LnMIPE|3)?evNy+hAk8@_^j2Co+ek0w);IxYWg;l zC*pw?7)w1iBC_9%t~I)NJtaoV3f7@Dx;y(@&I@tIDBL`)xtF=$zLk4>lVIiTKHQ8& zZ>{6db8FL%j91XUCy#{;KL6A09$Wg`n;_NxzwOcmaw*Y_lTrE?-p~*;e{3!fqW^i@ z|Mw3t0ei<;M!pctP=Y72Sq`);N~1VegM9H5WXvMi1#b|tYku-EyvPcC_Df2q`IZmJ z+*z~DXmW|TOrT&;&`M17f$G+L`F+;=|5XDEeugL=_!vfyS$x8#e{NOMs2HSQBlbQk zBY%r~`ZTQLSA@rl7c{xyI6@w`;a$(-!v96q@??zP{J~jD!X7`C)VcfL{jh5j%;?ng zE9=*8)s7UA{leHw-H}1gc57=H;=WH$A#u-a47-Cm$0LGWZ`*=KB|^iE{Awu=otG&M za-i?SRE(glDTz?e#bwgMwOi`}-$PacvWMOO{?U~BKEpe$ zeS9p-;=z36FzgVKA#Jj=ZLV{#aTZ3!K4kpe$Ef`r|=^`lGyr>0z6S!%9Z$cRx3&iE}J{MuY;iAaLuBe{U8K5a?!X8*d`;^PnR ztZbqM{02kidmiQS+T(zyMx$@{ORZiMg$h}cnG5x;T5{hn2$ZO9mlI$f4*&Z%iHXUM zGx?C#h5h+zKjh|chH+xm#80>`j+45=G7CPa+ep5(va&Plfsfigl{@x3Q05To|9(&w zDWiG^CoO4y@szmGl@RRNS#h%(K#?OELG|K{MK6m}m~|UO6M9fulcZzcX2Tur{re?8 zk;B!+a72c}(5X6*L}qfW8ZWWtV8)(%sn;)6Sls?<-!ubOaO z*bUtT%I?z`6UVZWf)FNJ;;~Onx%xu zQk0vPwU|x+hPhugUoBKBE+S&7^D)4+kokZ(Bc*#yk#vmU9EOT-W~8)23$U$5gM)?LA73bD2}vz2Kvwqlf+kHzbD<|WZeoOl*YKtz z8J)SkiXfDXiecsQ_5Wr8)<+U>80BpXI-GXTA%Y%{F8~}sGNuFGaYgBsxa;1fuAs}g zbjNeFQk}U<%G3lrL3#!8ZXk6lP(9Hn-m}SS-bD&%^9u9cM5G}Hmz%ww#2rn%o}K}1EdHpz z3#AjY_IiH?3M`I>ch?!vA`~(p7>7i>yd2R?Qs{XyDfc3sJ*4-Z1@5?54=IwJ-&o`l zZT{2~5Kk8e40t8<77JXl+nu7GAI`xOO%^5~Jzhl$Nyop%I^BBM8u$y4hh+{&!r_F6 zG%_EcN#=J$C*jN*6*~Bil|2_RGs=a*GH=i>v_rJ-B3cCkBM;`&ls$@V7dsP}oO}tTaFzeS5 za7z7U0QX7SiCM1&8G~F<3`h~NnADha4{a7I$b{MSvt8G2>p&}>*Lo?k{jwRFork>+ zG3P%77{sC!u9bi7srz+EDxbMGP-7s`srvUQq|;%&-kHej$)#8P_#EYYXPgM&n10u~ zkNDEQwcABC>IZ(-F;QLC-xrzl*LUX)689M)rAn_B>XJc&HdZ z%I7z#R4#rK(>=imj}vw-HjK_#N=`&%c3LjG^~g9P(na;xFWfhwIP?m6cyHz#pD+`P zG$KGIu+Q^sd9gg-*vwc+K4bG7X2B>x-y8sJh_4%}s}WsU*PnLxbB?-YgbFbcF??K6l2$Gk z8wvUAp1g?F6jM$>X`h4nAr8|;1#+g3qfC*NMEG|-yoMz$2MAV|Swu30+|i}Bu(s#& zsqHuWUdhUei_rdsm=jl+^oPsf4H|TA9=KfIL-?!ADUmnYse3t0AF0j{z{NO`51)}j z6JL9{(4CCciAC+^$gJOteuqxl<1H){O=Cv|!R{~uxBo~q`GFQ++|@BLj|r9Gd>3Z^ z_?y&2=cZ&86DzBLQ6C>dA#3c_-l!m_;uhgTwQR9>l$a32ZP+%d6lG4}Oxna3yK*NR zAtYmIYjDDdb#N}+wXO2OYp;?u)8#_S*dv?Ds`+Uf|7gCF;*5aJZ!o&ua0){V6J*iD z;lq-sMSWcW+Dx`AX0P|_jXGrxH-75w&~j+ozH6A>#x2_U(ITFmQEyKYn<(IkQa0(g zbl4&+J__6I$}M=e4a~hA zgX*O*?4nGy8~PwdeCs0qbY#$#vh!S)Xm5yFuxMe*3PwS{<^`>s@H-V zsJGFV`N8I9%sMCG9ylhBPh10_NNc&*6cS?o+9?XSTD?HcO*tKZjkKEkshsMz=0uM* zRa`1^4GixM+YJ$Co&~L#X_VHuKBRn4;%RW@_sDDZsB&h3k15&*f_KyXce^UQb(c_A_S?xrID zTrVAPq+~Sa_G)cn-Wt5XWxK4-DuBil9?dyF1LYa6ip#S!Hu%y>jYfk?eFL9I4frh+nqA&wYrAo!LVUZ(p|3QETBV$s;2ZMdjJ(C=yCZ%2A}B`Z_joU`9vCz zw84IJ0iJTH9t7JV#?md+sft-52&>oqlXdP#Ettq|z7qusU@7grOtrE_jL1SSk@hkG zWxYG$*NjB)e0POJzep$*%(f4vapsRd140LDvmtS@jrami%tW#*=V$lbvMvv|EHVk# z;>%JaR@RBCyOa6yELK#PKm*gB=6poc6m+IVExX04^8$@}XEMLLe68?!b5R?-BeV`V z7KWCaJc8Ef6$Vm6@&2F(py0D32XPQQ0VKuWp}Di;i?g_sH+ogk4EXcLtdBZtz_!x~ zkk~65Yt)&2fVz?-TJ;z+30@VqMOLboa zy4*W5L`?cR*62t3zHUio0aN%o68f@;!y%RRQj1?iTJ1^{RX{Y4!z)#W!ZSfG)XTo| zIG59PBFh6yC3Y|2JQ$hN_Uvvoi3DpsIvLGPNfX0NU6fJ^35T2D?sSolTngvM{)!I( z8~_s-JIP zy2dFS2^})|tbUjdp`rEf5t2OPaIDkW!7i(=9(N9MR{@p37};=deh+5mj5boTIqo;3 zgMXw-xg3f{(tfBDt~Ps4;uCF6(1z~ZwO$;=~3@y1kQ88(oACM8NvR-Zu0{LsB zkFA-~m?Fa7ujMj%Q3y(P#1rL+B#=DMuR$l!&DSJi7X>T-OSi+RBhsj$**u`xOT^?S z2s-qjeplb}5))J_(v0#zK&Nz{W)8L{(?w)Tcq+-5Z||Wi(74D*mqK2-#m1$9s|3vP z*{TbheGyy2Tq)F~7cf9yd@dwFG*JkQ&Pa9_JuFJ^&1Ic82QXt&0q2A6U9>cgZ;H-0tauCH z-bE&2Q!jubinctB#US>^Ujg9Hb&v}iHpSZnP zoQv2CUbh3Y{OJ3+SD%&bgxpTK7Xr~F0cZpP$m@zYx6E|F(Y``Gnfd*AKvDFj+L_{R+Ro9N+sN!Ceo%* z&MHV-6Mm#ISO|Q|{rk#fxe(z!jpCa;fhyP4je`gz71IuEd{Ay9%M^44%8#b*&d#sk zU9D&cu5QAW{a`pGLVGlwI!B43K=D@>aTiXP_q0R0Wr*hQ3lnb!BUr3bRk!D=a}iHd z90*qa%~ZZbTZF@{%}1nNSANx;`lTyAP3dq|w*)EVDo|uQsJl9*Z20myD7~wD;>G4) z#V9x6aiY9AMyB8KknzckpV71&>djy^ydhyK4s9@dL zc02s%ukes)I7wH^z{{DRe{2!H-jE{FC&k2?;!e996P5HIZx%7e(EQk)w|KTY{gXAj zUT;Z{vj7#PIuc*L<2EI$4|6FS{nAjC>nnnT4>}nHOKb!V?%L>EZdjkDfHsNdWWf=V z#p89;SE3T;`*X&3VtV>b$BESgw)7(y13;_7WU$;$4KhA&A~W7bSaMtD!2;+acKxh! zYR5-sFf_SLyDACv>YR_BYw_6N7R*c;B&YS|;LDTjP|JWT-5+Rd{U9Q$q;Kg7eO4bP z5X$!rVVQ-4W1_1&Iu(X!lJ)3VHuQG62#x^qPI$CJhpb*m{-6xZ4&2{WR7$(X74 zoJ$V)rf}=p)9(OxN+I@J&r><>5`C%Q?{fEl>%MME#C&^;`US_h2-ew9R$1Bo+k%h7 zdQ}yR&cz{6sIJ)#Q`K`4-^Uv}% zdTQ$h7x2m}U>0*zAPcO|)hpipes1b|a!7=&99y@g$F^>(Gc5jXrOln_(n7?A@N{dC zI+O^HXLZ!GQ9wYZgdm|c#)z(MfIk(}M>#XjzzPq|qrn+JEN7?M^r;=O*KxVM(;mZ) zS+j`&pe$JZ=MBCKRG3mbUHH3j`NxD>f`Hz5t}Ma{T)9<=I0DrNnGE%SIxrvCwC_1w zYNlAx*%`NqW+=Dx0xq#nmBhk^RqI%emVe&!2Ci7Ij25Vvz*ws~A2{EDhErE= zvUW6H9kGAUV$~l$&-s`a6s4Ch;CvLKo(^Anx;0FlX~$Ak@wI+}ldY(@sN0XPqf@16 z4^*pP0NTZwzYO=5SSc$RmVkmKoF_Ui8>YjCP7r_aOkq?rH8Ib3KYL@DPz2k)|H`wcuN(({>o8*;sb=vmFzN{)z1Us8H@b9aawJ%} zu56$=N1ar#hRj`(H4gXar){C&vk<)WTl*$F!E1Ar6#J|H%g>F^Zs942BG?U{LZbGP zMV%xVZWd&LbpZmV^5U&>x%gGpSxoBaRW`rn;;Ca9u(Y`#Yv30zqH9Vkg9hW)1>wr5N72@5gdigX$Q$RIPYFer_XSA*N| zScwnB5(y+#;YSVnpa*yv$nuUNbvg z*elT@erX{rsZ{zcYlLC^Ojodd=qqW-=f}?6B}&#~f7^K4A%p3joAAmp)YjZp=eq@5 zWygl?)B_3a5AGobjIaOV@H_6YoYETj`Wrf)U>r;R!0rZGc_9ztS2G_*J<)Tjc!~&W zw$8H{UhZlJv>kQC(nF$vs;~J zdwi_S(Ka3oGfFjx+y=Z>nu*R9b@e>C1hG$-z%zDn8ux0?CvwEl@^B(MqOSu@yGC~8 zp)RJ=fDG_$4p#Z7|2?+8Ga6*_JLvhlNobs9DF=cCZ0GPF=Wd9^OZp8@vmSWK@EG^? z(KxA7=-hJfbqIt}Fi&0W~2vR=zYuQj0Ef-8m^0J;qz6rmF}{MNA%9|N(+Q?W{&WmAI^Gm7|diy=mq0a&o=u5z`!RAyDKa# zacS1`WzaXz#Z>I+e0gB9PYRovw0oxy_S$-(AHp5&CW0)KDR;(-OItKzD6xKHcio{o ziUB_Ucm)y5ty*%UEfFE{j_`u$6Zso8u;6b?tF>9-E@Nx*_zDfl%TX`dp0Pz!p&E!r z9W)#73Io+OZKS9#6he9(pVRoPU*pZAhAwQfBbOODu>E_{TfLw4T8Zcj<6@L^TohHpv>gK zB%I>l&GmS$T8SLv)c0EgauL^8^jlbjQ>{rZI-os=cc?>|y*sxo+7!!@$~zS#sgjJX zcp2spsJC9WiPLO;Z*oclJ74igSC@*+>R12*L-PgcliTQzX7GHlp8)%gjdhGP+T27V z2m&*cVuXPL^LrtRg_p&^N0h#vPHT{-{3-sA(zQRQqO=y!%Do}q6&dtm>FQL1sVN^U z)i)E`7W^N+-ZHGJcWe7rK&4^P-3S8GNQbcKMmhzgySr=A-6abVq`ONN-6;r2cX!7- z-S@utv;WU=JnuKYtcy9XImVUaJb$BUK^X1r3Br=GHg;ZgNh~@l0@@_!(o?3!jZ-h! zgih8Pc7NncCd&XKN|a89Q5ebHel*d7>p|}%t`)1(nWk2zF8OeFOqE!Zc1&GSzicN%p) z$v(;#2+6wG|D)Fxv-_vm06?|Yc=NWNOoCcYde^7ZYe1t~o~mdSl@Rl=`uCT4+SWR$ z`tVBist%OPc{Y&mjuISSg0IP+s)DDLB$!wSd3(-Li{oCK`W_9#?dr)Pb>K|@22z|VdfhM5}AuE<5L zuBtAlx{L$&{1#57>h3qZCNF33X5G}C;u|f=z8ZBg2Nt(mOqwLCEMcs{`%`Kob(zi) zxf~z8I^3h#-Dp7BC1III<;y5QH3+F$a62*#j>I0#?lAwgB-`ek27BR?L=im+Y)0be z$xLMM@JWBhLD&t1)go}P%JK#zkH&mn^W=f6sLWM6V)}oQwp_!Ul4|BWPckmK{R2rIQ|hWHEv`1q6l(_=snfn_pYR9{rPu~IE{n@!egt=Tve%_*Ka?)sou2|0{n z8Z(r97&b)7NkrZM-j{0_P&lU72~?cZgy(47e;DZ*hYn%iQst0_W^jIyXO*-Ljz0lNG%4;>3QVA*AZFD;{VevT9-bvo& zLyv@n0x1n4S`u?SIuLrRt0hG!jnymlVh}uv?a9?<(B8e_K;0uELLL4NG_wVdrdT`p zMJg3tJOU?&r+e=Q~C3;$EwSv%KbM3iLi^r79!fK2fS#8^}a^R_~3FK zNPMh>{D_sznfx$N@oVAyEo!0Pq1tSmo=7W1kqRJ|9wP@7h5BcKJh!PzNr--)t-klU zhFhoYoHB)-@aQNb^=x8L*PsgKwQ33c&`_k5Xj!{6%XK3`%3XU-6cwk@k8je4QA48~ zp@w4)N(R=;P1h|~`d1ZVvqD7|bYeCogyP#(>f$ZTZD5TOwfy4vQqny>U=!b+9I+v% zXpDn0mEgV?)Rxb|S7#MM6>?@gbfpKXw_2Ol0`2`LgFmo+Biq{FX53{f#o(CkR2tpp zi8UQFV484_3Y1QL8{PgwAN)X5T=v86P%()Ts>>v>e>k$h?MU`Ec~w@U94ej|YLq-7 z$_XqZTHZ)Qxje6Tn6~TK+9`ntqWwYFO9Ep84&y#|=u03h*$0M+gVFku zmfn8?T-+9xu_6SFCwWd&tnklA&2cE=rIXoT9SOQaR&B}bN!bynOj$&p1e%muOu0by z-F&T002~>p-GtFXFK(KnNQk$*jaufN_rd{QdcL)VURud&GNm37?@@r^k9nlvi_ppQ zZlxaTz8Kk63bL0USwPa*(u+0QdE^}*jU?ImY}R&^(C~)gNsffH&&qi*IH{!V0PH|e zH*rtabmv&^MBmb1+;ghHHgF2v&#~CaZSyAvw}cz5h>|BuH?MGh#rC} z0KL$3JkslM&=CzfJg`1FS;d~4o2O9jaxYS@ix~EqjbHy3$V+YS+*kerI9-E@(BV5< zF3aSm4#rvLA{T(en9V!Oddd<_tQ)yzJqxj*&cNE|8P<#9Rb8R_ zRQ0G%EBdDb^F|GXiREc3T$-KHwHBS)PMn)i(3AKJc0%RCO!>7mbg(V)Y@X9obg9aa z85(<3>i5*X@9905CX0+a!3HS3QVl`MM{E}|TO)~|&N$K=ZUntpT&nA{y`Zkq#eff6 z0ti$PMFlbuGH=svzC)WACzK$ZZ}MUM8D(M9P3_csfmP2x?~~TAjDx$>K(qQdym$MFp|oEX(BQnfkt`0FKp4W~y}LLj+d^{11HYUX@^ z??OqKBRz1UiTql-UotA4Lfu?Dt`1XPd&Xj7OMJ3liA{Snlgrj$4cJE?KLy#lxr%x> zNp1%ky+mUuu2pqA=D>8ZR2Q2W^xLB&D*00FE;B-;CW=Vn>3M^C&agjSTK>#G054{c zE+z$7gq&`4P0#mIk!CkvM^bRQLEOLBjxVZNaev-E^1;$36wWEHrmFgEONT;udGHIg z^s~ut)dNg8Iq-qoQi&LMFa@t5?AS0yrCorRIvE16)3E_)Na{lc?|G_}La`w_pvK~C zWizRh2BuY(yuQW(%2rC6gHi?AE``8BZ;3*~BNf)|ld5%l;w=hrxM;Zk*2xy~aX19g zAs=Ec1o&aZ=`I6jvNCB+t`<)0wQ-w2YPQyTqZjD4i(bg2+=#W>s(NyLECb~-lP*A@ zphZDAf=N&~h&uUE&AO`-(2hyn`Vd}53O>ggSk2z@VhkSx_J0v%0U zz;_3?kqLc^g_8KnJLx*5Wo#pp!}4@gRD(+TcyFzizlY=?jzdIXu}$ElZH_Yt`c^p+ zUYH?)@+6J)w~PbU2Ib`_;kInfZ{~-epBq7J&VcbuL!;Ys{Kl6QW-U2`_i}W5%ZS=HixS52>c1 zRz-CtH#dg_QGL$N3IEP4h0L^OYBgQSDDkK?w(-c`;FX6lIvQxqs0wR|($9+3cB0?k z*t$%*32>N`FwpjP&IByzbs8KPb;HnqX(WBq{p{<}<5=(wE5F|MogxoidKgi9#9;-r zwaAqL;Ry*&lmeqv@`7^2e=PT+;!HLbK31n?#bweND%lf*O?N|I5J#grRTX%o4@=G0 z0Xg3zGx_AKdG@hUl@Rz^?tOfuvq3-nT?wIg;9#!2QCW>};b)a)o8uMy>_)8W9FK&uGgc@u|Db*A5s zOdt(U#8U@B*ab`M^WdOimdCS`B1IK7wr^Zme;6PA9|8J3J#M;BdMB3rmsW z{lz}FO`=nOrBJB5Zuha2<1mchGU&EyLy*66!&kbEI@e;FOFKNl!kV-2>ug`8QUb zj|0RgA@pK8dXmurxfLB7WNbmRZ&v{$O>NRD-8>KbgYBQt_gE<-5j_Irarnuj zCtEVmU?l1bh{}!qQ80HdkKK;p{r;F^LaOw~4zID7i;XTQK3=XUGdkXvcW48&#!oaz zMZ22j;6Pq<8|@GAi(2ZRO=C>f@9IKstUMw^!AZuWK{Xg8d~ZGM1jf@PA5MmuJpJ#l z4oa_?mRenO93#>_IYwdPF(VU*FWQQ8;e_%%67P%zJRdHaR6mrf8j61`91t&R)jT$?QxHy-foaC^?%czy1ZLsrgSLHKs&hotanyGEI+a+Eb{vR;cJ zHc$~lACEGOVd4U`M6hNi!g+bn5NNQyY%^`V%&zt9AV2;x=`O5{S40G@<{8Zy=}3 zh}Ue?pcA>k}74zbC>uK2>R#CIg(AA1PjZ4ee9hiMz|L0J6KS)tg50 zf-lwwanggr@yo0S3ZeGLV_ZRFR7xI~yHa|3RI^gO{0RD`TE|bnjbp}&XNbRfzWpS^ z8~;?Sq_DRBPN}g!wM?7QLo6%m!m`@YxQ&nNOMIwn)yY_~OJ?`v80#B-ns%l;G2r+r zFKIa2*hR~;Q|hY+DoU&gB`@-O$s`}`M&|@Y9n2|S z{RQhtCYB^t&JaYYi0u;GeAkZ4nUT)*hQz=LpzpLyip8kb>by2LLZ6+mimhq~G z9Os(Y@nE(WMmPKg?+G?CJ`)5_es5@tFl9Cp`8vZT^V?^vwmV&G-Wn5ZV~p5aw&6@N z&S|w68KWC$p8XbYEKThNkz=$28t!l(vQzWk*p@pueVyCt2u{G`PPaXs*@XdE9tPq* z?@*fQ$MD_=d*5hoy+p!*ry!6}E1S$U(p=km6ugmbx~sxADVx1D;CgH|+%Z3XiouFe ztVmDkvl(@__a4cv5zc^Q3=--rq&a#IH2^NldY}Q(Ej9MBt%shWyH**zgS={!8x`A(9U(BrNwq2_;YDp@b*Jy{c4~ zr*6N2#^ClUyCqG?EDtAPDoW|#O<%&Q38(#JWzX@coEZ_T$3YaHgx}f*A(L*s3WRP9 z^E>oA^^azA;w{&yIcb%lMGYd`v^RrA#OjW-Oq;3AvII%-CtcjcHjwg|Nx zqWNWMFZKuEqn6IwKflVd;gjpK-$kO0|Mp~t9{;Vha3bRVl?yx;(-FD%hw5kvB2Y9) zFf{8mXy_L@V6T#V{#y$u%X{q4YP``#AP?dQ-iag zK>E3`&9%EfKT!iEuPl5WGQPzg6@L}k9f9|@oy9dvQ*@7$vPX%%{d{w1R@D4=y}#m1 zM;x>^Z5&7M9Jb5(!2I!btt=+jpAqdio}q_y%BDpug83OxaZ2ek;~V}DncZ0_@5tmu zS~tANeNOi_8Ie8$zHsPp9SDQUMAq;uTS8U#7_gLZVZjz0?a=LagrZ%>;lOwkFf>v;_nig++ zsFVL;ta*9bRq9wJW<+_ywnn}<_&hvsQZB(PP@s=Tzm;e0kaNU~Lj%sDyU@5ry+56r zajDfKjDW4wB&yDG!f*uJraVrm6{vFBl4au8dF11;hVP4!z=esG-nxk$G&u|qRo5iS z=iW7;=ZjD#&YSSXSd$;;uLcr>9}rGAbab)jH8X=cQf43T4vDqkYxS{oU|mMb5yE24 z9=h0LSn{G{&L@;hNiT;B3hXu;T6b@L6Q-=TqiO_afs48J>u z9-_;K613Aj++w#geOX@Wxc9#%7wUIE=`VQk{DLjcd?VW`^wmshY1zf9GKsJ!EkuxQ zo2aI$Y9{PYMtLkgOY4Saif#4+wFdf@!2a~h1i7u(r=%)hyJi(NJZ8Z?rfKU$qOv6$mp%=*Mc$n5q#&GP_b-`9#q_x=NVMLZP81WK>$yn& zERv=Cipfg;GCEj$gb=;tmO6^eTc`Ey=>sinU9k9K13)29Bn zc@IhT+?I9H1hjpwpX@l3aY2V|oNzVY;bZOc%u*e5*yogvQDyN97Qe@I9Xn!d2^ALz zn5R{G3MeLg4H#GQ3op`xvPgWT&KyOUa?QxsNNW!|ggQaIxUX@K;FC^iuIJ}e>c>dwm?C1lEg@zid<-H!pWqfT(^^GW{E?JqX8!xm6<4X@2({P9h^6Lo2QrYHX{ z@`g5>8H~$&TR5B8V0N#ejB?6l@cH>yeOPl$U|^RTNqb#KhKcSy9;}tnbCASYg28;Y zA*L@j&2DRWAM=bAhxfefn9c1eZAwypmxI*HsV{t~ziyvu85mhk}MNvU7nB^g7{!!aq%{yj|Lu;_8 z1uJ`M@Kc0lNZmD&1a*A(S-af?B`h&SqvDT$*!CCHqh*d^dR$;1O-^gq;j-x4?FL(; zTb@rTa`j81h8m(NX;Nk=+lcrTJ{7S&wojll9$eioeb0$N3>eZVHy(&kbH6(X+2~1m zr`6T3Qrb&Rg+P6LT%sT8ZVP}q6;p}FzpC}LOA_}V z6wXgA)m!Ma>|@XOy_?>FSmA01Q{>SYJWn^?GQtsQYYz(_zM;OA@KWenFC0^96!ERK zT%re@I)ooXJ)dSJRvIXw!?&$o$3n;(LsrhcTNQ%d9d7$GX}-%h9Mi$P?&%!gBp+5d zBs-4f_ue^Se$LAVN_1pFEGgyOXs7DyhUgLTZWv-yV|tDL3A7O*JXG(_+AWtd$pt-- z$&XX}a|C4}Bp&BWUyoD}AKDQiZw6=afqO;j`Mfd-5qGYmuuQ+{_`!OC>r}&3Z2*WI zAB;tklYekOp}1G#9ZAR8O4vJ%$A^}72ZIyW=DJvRQ!mcRq&iu^RBoQR%|Ek(j#4QZ z-}xB-(1PSU?o3=$V)H6GwPloekcjhkLs=IyRNbRm{Zk6Gbj3dL_OGHsfaC&UzAAv<=g z{l$_0=o2Ur+}*j`tXxQ)nO**oPyZ*PLY-zAW_oG!(zz-?Lm>AqBmeAU{=A&hsv5o*LMamC`m36uZ* z6yC;A?Qj46DS-NBWVrd?L%+zfKi7E#Opvma)b`BC*j&(Xs+Vd)K-8fdLB;mET-pCW zEqo62mk`b8=LFXV5l27msa4R~rdXPTMR$?ZXjJ8?LpsMI{i&eB$8$v~?-2g|_5LTI zUQi(Q5Zi&BtfS1$u80lKTGOeIaDJGAMeEkJlIT?B$^W0fy*UKMafp)t2}l+b(_Cu* z+DF~ri>IiA-V>B%f+_6l{UgrG%#4mVkLGJc@YB^N$(JXI)WFwM6cQ=+_{Z1t)d0ds zU+|Sx;oC}gR|5>#w!8F6?WMiIh^ms5c@~euXDcg48r5vjUCSum%&`F)5J!G>pihTt zKsx;AWq{ZKB6?0ilb<`NXJPh^?9Dg1Sh|ty)$9)~!RwYZswjPrXkV4}R1v{QKs-ld z!HW3u{`)&n>;VlpUo(Ko=ZA|v`4XP57!u>R$|ez=uJwv%H98m?8^bd)GHxP8^T8@S z&ociNitOXXng4tlR|L%@h;RzA=}%8*?))v^VKul}o#vlZ`U2gt_!w12eRx=d9HMGG zM`J?O#XiUZaX>^Bn}+-|oI3qtULes6=Bdl}c3CzDDSIv9KA~(A@k@WC3SIAwA=Md0 zETB`xrM(*qQ{WPzJkk3bmU@*x!v518{~j!G;5@PTU?BC#K7zI@`Q7G5%@#LAEE&Zj zsyty!glR9}DplxjRNkkRurU0e&iwmp1nU1()Kcr}t679ICi6k?la`b`{~gjkIB*?8 zaPbmgY`Un5Qq_*92PMJ3Bh-JM0n-98F8KB9*HrUy-z(?pCU^K*_MQ7i9OXCN@ty!B znXI2c-WxPh&^ zS`aQAi0UiEJQ(u_@qZrk-(5umCn}n|6xQ?gb!DTc%JUw@{*L>EDG%Ak56r;eNn)r# zp0Fd%bPLd9@Bj8#!%ayAOW}~-~%$M5E8lRm_T3S{% zLzpKF>-_Nn7*JpS9Z+AYUdsGqBtw2_4775j^G3GtZD-+&NAkz1&F-oCa`!~0HusO~ z-Qn=W#KhvFGYBe(V28h%um)e+T=?Iau+jk*Ir|tC=pTLld3R~F=v_N+Y|ZYaKb!2&G~fcGcfY6zXrfJK> znk)<%Mfx$sXhM#+rKP2+%Ft!+rJ|!}vcKW$6;-oW@ZV_=;D`HC5Gk7rC&lScRQqE) z_`R<6=L!}XFc#q1gvzU^q}KbW5hm>;M|qM<35+a$uiNe_|It8ExPMM?%puay%%>>6 z+pP-IM(wr|5K=Umo?B5HRi3hwP?7#S1W_>&kTMs`{~Zqmz=QzAU8S=v($Jx7^wNE? zso7%DoQk5TaZdzoj?z{T1J)fZRHRLc@c8*6+83sV+R=h_Nh z{_A_ry1qjr7h3Y9?cjvqN$g^&oiX9^;t-%4MgDf9h+5mHe|BT2f1J`WT_wTv3q1T7 z@58o`SFQ6r>-qsQ5;Us()T$n$el_9H<`PUqiN7y_`+vQ}69~>xVkf(#(%up=av}Bd z_zqYs=-0aRu3OXgpbV1p^YfnuC-?&|68l*LgAu{k;_p;n5T?kb|BuH2By(}&=V6Ac zE!S)N=m9^wsrWm^c96Zi^!Z0%cF+SE z7Hb_)AV%GJo!^fC@<+{@7O_UFOtO}usExHXlnE)ha^ow-ZpYch6Esna>)t>T=oCLv z$IFlZY)A-bsDU|UuQ4>$pgz!jdK#_$or;vg-?>5rYj9mlGmXAjuluLbgt_-SWzt*~ zlO$hD$%&%z^`Z~+#lpf^eypfM@(EUY!fWz15RT@t^7@XT$0rB;X(hm6| z*CpRS{_EN;_VIG@Kqbk-6k>d=$Iyzdl^YU_7AcyP|ASF)6cQt234J;SgXVz&hU`6` zNK_i4IWNIWmzJM{o%bdEMcSOm0plPDJNV)l@D(&W()E6N&|3b)?42W@{MN-%wN&XP z;O2{qqV`4qe2b;CUzuz&MqkkDt5abNmG^VB)!Mg#G=4jwzse|p)IF`)zubH`r8 zI8h8#%Fi<9<^&=5J!ygRC1U&m(L`(~ z^R(M=hTt3Ka@)z6r^h>}ocstyn0Xe_V*vnfMNhFQ0kAVxt90J6#a1+sk)DJXd5?XADI)aHdH zDjG1?rlWDHDv^?UwoCzqW$THs%TV$48Up~S62?H^+lb^eP78Jb=@$(sKdFHF4CQ(1 zyR{JfdFP!d6xn~5o32%blDl!+nZBrD5>U~ zOlcp(+rd7>%&}L4oy)#Nah%aRdBT(YgQtL|DSD^T)wN#Kow_+k*bm(dKO6SV_tBHy zpqvCMjv{DxJ&;&<;;|d_MLLmE85;aNui5T>E7N-PJvCX4^RzzfL!q~i&*>^`)<`RK ztT!B6r*gLZ_;40*lwRH5#vsm2qa>kt`SPXv^${sS6`4B!??OP`ydSAe3rI!=`J<>Z zVwDphzshvph-H(AD{p65yxGp>!hTbA<}nB;y&Dd4Pfc7=%IY z5}9ujxpn4?>|ZdHg0i{__v2Gb{nGx`$pkgf5(-ekmed*n=;^;&|7Kr-)9f&${$RHh znBNy8y}UPF9^!p_mZvrKcCN|^AK+KKv$3B4R)xvHtnO=dee|c%eV1M6?vBc*xwc59 zi5&n>elr*@QLjjO1stP>b%$fGPw!5xKot_-qCIKk^I<&%e@lt<1!xe!po2M>@-EtZ zS^0%w??KaCz0Vsy7xOTvI5MT_N$)_jn*kjB=@U#6Q1YOfjpo2^s>mq&1sBGf#ppCU zv7(8labFUy9LEA25^9&?q`>1a4Dw3*0rmradrZ6K)(|}={=e1nHrn-Z@(W#XqDEmY zO<{Wz+pUC$N1;jYJ`o@-dtD#HdTek8QyGIK(DoiNE8Y*Z!Nyl7nccSYDEqfUqcf{a zA78WLr|&~8H)YJ1Y8{d&WP3cJs6|hW%-~V~m`I?%*o9LqVa56ediazet;^#_mTTc%Sqlcd0odHfUu^Wp zueS_LWdrH+1oN7kp97fksCig233u!!L$I+imTt$P6hUG<7F`Mn^eL-{;PAAL&y;Xz zDi^h0z0t%$$eTm!SBDGBe^~Y|XRM~X^ZR1s0fY%tmhc#4@o26I8~zRN$|sQ*Kw^e> zG}t6V1Y!Ftd15=iOJWycR%1DOYXXsjy%~@%rb#r=XkzZJBG8d1ZAKy=fJbt_erjXN zaWYfLQ(ph>esYpWMvf&KdXOXJK?2~_`YzIIz(sLUnwr{FfOK~wErw*3d1l%DaK4Q= z=r!-k%>JyX0B<~fX5)lF@Jfd@+w7ZaY0{KY3rYY4 z&{@O>l76CuK(ErFdUQ-l8AZ6JZJubMV8 zj@?9NvDtSh4#}%yJPDAzoYS*Hpkfd_+ug7I{t07y!qtFPvDeggM*LwYkQgcf(DXc%6d10v|H}w-(?YW96X9NmIZNeXTE& zj<|2CaLoSV#sM(TMT;d9{@BJ>H(p@eov8@EvF9M&VMPGMV;_M*yz=v?TsLbaMMCgs zn&2BCn+&8#J} z3x^6kG5ZR07iz3K{?M={t$6Li29VRicu|@z-on7gT?;|?nWnLH)xdU%{qpn0?uP>vW z^8tp`Znm2B`fW{N&uu=Wh*`xy$D=%~!m3NuJ$%&!k}UrD^H-9z?pOV}ogz;NYx%jt zSaea(6>wGr8CEi20GSs7AS#ExnM$%4H2V*#6$d2h@t=o3eoY=6=^-2~FUQ*JjLgYv z0F1t#%~$ga9d0V~+|RGxTLLVHzf3=V8aXz4MAWuv=4c2WlPXvde7x99xx6YmmRR9m z`_3kVbFRUSyIi*^BBgAhv#(EbX~53U{aJr$;Ci+~L!Yt-g$Ufkt@w@NoWa}1YgSF zv4jF9tCXJ3q`TkpKG$v|;0))It1&*)8n=9&z-slle_i*a0blZ~vhUd>Q)#iyjhwXQsmgO67Kf0#^(55>o&XOBbCKUiHys1l1oh6ZuUua?B8o#kvT*u_YIg1AC~8S>r*cU zu}-VGAPI(3a7rgdVF@EW92Qc1 z9nZb9>{{L@<)Vd7&*-;%zvBb$iwD5V-=3~-suVh?1H1vUVoqzQ1Q@7U4hF95U}MYV zVp$~0E$Z@dU#gyv?zufC!Qn|LB{y{WcVvRz!S1JPRAQm1Py-8_o%ymiquIi-)><`2 zdr8t#fTt~_`8_}cmW1`n_nZh#{*k9T=gbblO*`KnqvNAJmQDRo2Ie?Bj?Vl53xI#4 z+-Ohfd^p)dufk|np2g#Rg9tD^&i_2_EsT)?Jvxo8_sf5GwgFH`xxA7_3#WhXaIZ1~ zcnk44oQbk=kxG5D%;Mkx`d!d_?Qak!5@sx{_7R3mkE)a%%U-L4bEaKv@}@>){Qt*VR!_O=JmT7O(~~ znhZW=|9$WVJt3si&W90nIP3S~m)#siVyjc3!p?X*pg8pj{63<+0{D6uas6)gpnfZ# z6G$tYI^Z)33tjW$dIpw5Sa}xbcz1S*kfoOA7ms%fC>A5hjQHQ>G9Ww->ryS;wu>}2 z))TFSx>;fQ;2)EoRC`-{ftG3|Qtq~?<$nrdyPbQ^3Ib8u{C6h{LTm_{5NU#(@R<_q zgQ5thhB|<|=@(+`PxRX0E~P{|+2ZrcrS|vwzldf^kUgdx-Tp|%^y(ugiN1<|>msw* z>Ol->_C*dep2Z5UY&M0qFsH2+QGs6iCA?7hETY@uKwAI7RVr7g%=>=v76tHadgXb2 zP)=7$r9u6pK+pw$yejgh7Dy%+GxwT`FtpxT;s=(>T>2SIufe zv?M&WRz)?Lh^6ti%%bQX9$xn==cyt;bA-9}rX@E!o=`u6n*yA77UdBH?!{Pm-iO#N zxAoNytZzcdVUg?WJkx~Cu*G@>)TbDTZ=-v{LZ+>>+;^;9J@W=6nlONFK(B~=2IM(2f$qO zloL%w52OSLqt$-MsGUNAOv4}*iX!EAjffe@V4$f0Oph_&pf9iPt(7WraDWGfhEUKI z6nI<@8Zj03UJJAt&c#tC7|eguLUH%<2zLtMBbl0fE1yR3!z}c1snUVk^WxyW&s@7p z4G(sjWv?n%d*W@Xac@i_tL`4H+qF0kp1jmvI(L``x+a&P6ukgA?;c%_3apUL$ zNdg1Pnw6Wac?Cgj?yFgtJPBV##h=FCH*)@{@;fHe^3O=+WMY%A_*2?+KJi`62@rS_ z1J~KFV)cCv9rmwCRZCQmNEaHC*^HR{DtzHjR#vI4^&4cC#^T1x1wHd+Hao`aaodt7 z3M$aWvT3_r9`|q|q(cf2^AS(9(~dp0iI%W(K8IML$BzjEYvO+D^ep--+!f1T)$SGg z6L_(EJ)&@8i?@TNMX4m4S_bdO3>t%luHaV$ra`aHHv3Xp0*cN$<_XqV5jTTEzU?Do zAZgkBfu=KGU!9u`kk*m!_=o2h#|i4FgA!VA6h2j~1E8qWhaMD*<>I>i@hThQ=?8-y zb#YIv`#FrH#c{Y-XS*S_?kDe=zKSzcM(2ShfVz5305Sw1`=SAJTR! zGEr`0bvj(~_p1HxX*iHi)w3iENGOG&5`78YGU+eJw41uY%Rr3i<8DkJ&bSNjVZQDnCXJhTt5$9lIHd&KFeVwTsGKhQ#Xoi;?a%l`y- zPY`Q-ceVggwK==PiSZNPD#Q_yhaP9JIlWz6 zlpL%9Xvp~4Va=5JaD<+6S+CKFqG)APy7)Yuff@!d)q~^KDC5#+3G3f;^T;uO-NVNz z#p1Z_$f)fu8!jS!eo4_dR2?sq=dAY)-Qx}CmMA(*LFgAW4q~BmZDuT<&c_i#ZC;VS z^Iw&XPX~V$tDz7FW-CNMB$TNv83=d+00*v60G1`SO0IpFmixm4oZcX9h351+lXFHZ znnAtPpSQ+z4;$Fhq$9^p7&`-g5yB*Mej)-!I3F^(ZC;cq=}P6Pjc|oQj&8h&&+wU; zXwvd>>0-&JG=%f7rA2*%{2LwC{neaCD52C6o-6$m`IPhhAGZ6GB?Vf$*XEOD=|7dX z=0KJjUBye~YF})Q7$`yL+fu{O53mg}Ckj9l=~Hj13qL-zZg&r8HhI4Pu0TL1`Vm`z ziKo`|&+AhCdQFB|M~4oddvrGAURLDapA9KJb?`@WqfvJ!r8ld_Av-fxvz4YjDs8i| znXlW@QS{j~83Q!q{;by7 zt}uh;@c95^`)}jB4WtAPV*M;(!59ECncz^WR`Xh$(*}C&oMAL?xAOVs_RZ(o7THF% zlP)T#H63>lP@dwiF0&=c(cm1ljW8fvrqrI*-Z<5Gnh5xMb|@dT3MNu@AkZEWU?k}9#)iFd5jwGHfsT8EnC3IJZ%NSnw0niR+T^@4aY)&Gx z{*YFWN%HDIbZy6mtJHMJ?o(g3pjo+cGuAd=$1baToV&3!k4KbYZxo?20IzQKyGDNn zh$9NiEPTEO(Tm+(%rzQj4{PZ!PqG{e5`}-s`@SiQzdk0T_D#wHkgu~XIh9^~q=s%F zQ7`JUec55H6xjoCjvplv+Qz%%R!5`cHhlgS=!2F03fX+SPE;OINNst;2IHc_V${&S z*jy1{?f3;+3BhP9oQEUa<|WHnr|a*scXaLqJdH1CV#60+1vzcBr$QW|Tceo<5c7k% zD*M&N->lN)W3oWZdq$C=sP7~!_FY=hGNo_C;*M9F4uKxZ<{IsfqT(f0siC1BrORUA z?U9@SKp(U>KzL4t&#WI9;$%i`9C~rLtO%fL0HAu`r1*LK2YJg|!4R@@W$7yef$LsL zVFStp93j*~+HllJh<=MNY38qTcI1%5`I?3ek8+(RIbVYY!%sgPb?A74TlDk414I#m zX15t!>Sl-Y6cRKT)kp2jw+iXVfJNTL-h_Ov*U5Wu(&|r|5N^9ay?ZXiaSUoQJQxm$ z@y=tczZL#?MqF3P?Ix^l>4%Dg3!s(TU=krux#Gjg8pS-fgBv7NC!#1}M%B1)Cjjr* z_}8Mx3Bf7@Z&|kxCl#OFD%EfX2YHUM1XQHm`)+Uy`>kR!s|ym_2bdIS;(PH^`M*YN zUvUJQsAT=_6)C3o;Kb*O%}I-Ed&OV4TM$$A_tE1^Wo^$oOXu$!&mI>g17n_|(}MQ8 zSTv9pEjB}09M<>75NVOPn1;kayEE|b@*L9=}&BxB&QUK4=`5*}SzJL>|w#<9bG=CoPyX6)(xNUj${4@Z7BcB(>G?r+`UX4XUPLSlX zk)DFg)@6SMR_A7L2va3O^g9%&<~6(I>Y8bypa6ED4Lp(_^XfA5kJlA|*AR2R-$Db{ ze9TLlqi&u;>FfZ}keWo;L6qU7+@Rs@G*qlFhP)48{g?=HSCl;Q>YcI z@>JTz3P|c@-x2xEwZB5aM;a(oZp#RUogqXLa+nQVYnj(duS*2({vF-FAZsNT&(P9Z z`1|+`2)j5tCgAYKU@NYD-Z|NNuXEWGA?2;pV8M84s;QTHm;oS3vg8fgy*(OV=OzG` zu{gBQXd*5gt6;n}OzmMGb8r&UqIhI7CI$uF3}7p8iR(zX(C+u_n?6oc1KFuvt1jB<`{~`3kf~qY6AN7lV5D%{?)<-Qc|GDHPxa4FDzP zPWb8FNhVR;bd(>$Am#csc#(K4pffoXxqH{<#X)R3Md(LZZ#Bf@V(6}}M7db*HzwIc zKP6N)DBQd`4(z-t@J&8b0&C#@iX7o>s|LM>`k8XN@ejtpS`1(#ixqfp1FppYh#rxb zB`J|FO7uF|GPrGmGq{RTmNpsHu#f2($5oU_g&nYb4&NB=_txFB(afxs66iDuq>Daz~skrva@oG`BaS>u`N9!f`EdG6{;$j+IX z6|2>iE^760Sm3KO>I^kb0nZx((q`ANbqX&e9n;K=2HQ8!{x7}^$9+7e1bpTq+`mQQ zyo-A6VkIjykYeL!ys=ZIS?%BbV72T`<~>~nvWm)j;N!JY;LSZlk0U0S88J?Y zhxDr7=z%&?Mn1j;dHs{JM1D}gpH{Jmd)>s zx&L5(=iYL?mXLl+HK)Fq^X>~m4iiWAX@6W(t$`GE9N)|@hTAcRDy5LfgzK3S9ZBRn zfEp}z28UX*HCfUxD!EuHg*7KZmNR6h+g8ljzp=qXKsw(bd74n*OGMRdJWJLXeGw-x z7O^=fgZ{#aq>f4|qwq2pbE5aXcD_U%gGyOyrd4`G@_4%qF{eclW1XPakvH$XQ(p>N z^#C^Pb#x}o@Z<#!L!1HNS4IV;skP0QFb*EF-(W@j)Na4a-t2r#YgoNGl+48kUnib< z1=zy!>W1=$@bpdTQt=JQFXsE{axODn8rqj+mIQ5W*car#a zSNh@NBg7!CDAehie<+4(D(6^6yuhoia zGL&??MKY0GqHg>g0RNdQ!ogT_D2;=N$!*Ddjg)rRNLiNmJ=IOK$9_sy)xfwe)@ZpN zpKQTW{UN`MPJ0OC>fn#0s12iP(O2Q8FMGAS1iXV{ThxMayHkGA#m3mKNAuBYCF%pa zq}Cixso~h?5?Tj|w*`RM8}#Q<=T4loO|A)f<#&lLhW1mrVUp<2z*kkKGsp*XO|pvM z?ctnvo@#xgdd^(pfoO`7=;YlO7E^3=jiZrN&@9b^goECdfPQE13W|;&SY$0#`yFQ43F->PsWqmA1xNpN^s^A1m%&)Gv ztvk-pcK?=ZuK7&xze>AXLwJQ}e1xY#OJHqNBpeX^4Ni4Hk@(?^BVs^5OG)ra`X$CKKt zo=GKo&SsiGmB|3Tt=TR7KQ558sCa3%{GJeAZUc_yc-IGGGjNYTSJmsbqa zbV1PU_y6&97Hn}f(U!&nA;I0HaSQGajk|?Fu;8u%f;++8 zohG=uTW|~R?(Xh$zB@Db2ha~)y-%I0z1Lc=R`2A6>l{~$$Ad>{iikX+XDE*NS?Jx- zhpn>|)DhJ4&Ml0wPeRDNij6FSObTyWdS|)SNCC zHmXl^&M2iwO4!kKj&yQb&0&4U{Q|Q*dTt3$kO2CfzXw_vwdzDjf%FNP2a=BHfrim6 zUSd|meyoA62v@3LqF?b};C?t>a2(ZyLz#MSs`3AxscNvUgILuT3T!67Ig8SWpUl{iAargkx zF_#7m6elaiG>HHxyQkfwlTFNLbCvF^F=|37j=h^;=U`A%9jagMS>)N>0y#4xpyF=%t;QjNA z3liQAaZt$ANs{vmi))tkM*%;RR=k+K@TGdH$LiruVP-@W6$7VZoe+r;u5D*X!a(^Knk>fr}A8*ZMV`bpP-||LonEzA z__5^+i8NMZ#?Bqz?jbAk#zmfmN^Xovb|v7I_*};%ij_>EIqL5UN)(N9{ti1S>b%wx zx1=T9<_}9LUN4}G^kJVTy6SKYXQ9et)U+T|SpKmDKOJ~fqEw<6l@u0IGQ9atC=);h zYB8k0*hb6orpejHJ0!ffHBq$+i?nzwQOpZ1&{|~N2htY@Q&{uhyjV|Z2D&iT!XoI2 zX4qw?jV!p*NH9Wtta@Oon!U;06m&3LJrKyf#b9Lch%+w)G$@|+nc1@?OclBj>UQTFWMLnMC2m4>o|l;+?PaRv!G92P+YWYiXn8juiI}ZI zXib*Kg({gu31vbOg{i$L7lodLRSQ@WgJ`2QN-u?hx50OmW8TI9e;9N;^Fg;torR(V ztp?Aamq@y^{;1n-8d9l5s`)al&z2I+-uO9~Rk62!d6#RYxPP9{A;Y#KY&WjYg+$aD zE#p{du0A2#U+u^gr;E~18RT_#mPN16mnS-ZFTKOPJi=YR9AWO1)ptExpq{f#*#4C% z-Y6qydgz^~^afq<{=0JFTI}6a0y+ z+TPiTy`ZV8?z_; zP?81C&ySBi^YhAf!8eCN$|Y?QjMF32)8<^=kz{0D`trfeXvn+Gp$&32lqUg}+)i;N zsASwAaYCEjgntIAHzE+E0j!KYjZoT4{aV}h9nh}i--d}YPW`NV5f~XJY8e7ncP-HH zM^mO{7m-%3@;{7QpzVX_kE!gY31iU(V=L-f!b%mX9@9F$TLW25PA6ma$(C7F!q9#z zF|d7=i6*7ZKi*KXO*(n()IWiy9~nro(uDf#9pqD!6J9ron%_5stZmf%pj&xcgKbtA~x<0;yzZQUd9kZzsAL1s={)Bs_r6#)8X5;zW1HF@f7(yfD5t;8&h0Lh-;gPjG z{=TX3`ggCY1wB*h3O!_`hBidiAUQx>4m?w4w0BxFqbSiIiu-I^Y(3`%49F&lQhnqe zgdD=@%ERdO(d~tBHSLLR6-#iaet5hYw-roX&)mTy8(K1C2xVk_U;uzjXc*lGkaLa%vvw(dHxZG&2)}N z`D;nv-P_lW@dylMd=J6e{TNkGz<%BQuX?G~mAN0ds^v*V6YR5c+O4g@#xk?%Qw3PW z6*<`2j}|@TxY57cAfuZI%HMNYTp7PykLzinW)LFPO#^>Agz>|oV=}{a;UX3zG0Az7 zK3b?OVZ2zucommfPi)!cwC^f<-1B{vXz070`+;IP^>q3K)9F zP1G6);0`C)CqIT-$x{(#*H#BbmJeUxy;{H%LbxId`6Ip&EazvL=*ceQ4Rg#`@tAN` z>x5M=gxF&WC#9t0Z$B^A7zehNhD(rB&})4XGf+koSP_g6_4<|VvmFeEF={!C$%(y5 zealS$IK+SbgO7)gOgD|AhPM_e&M9#`q0oNjA=dZO{b-+NNzC@BAe|@RT)F7-=7t61 zEq_FFYk#)0%frAYf!<=_4=77GdaKf6NO=Dx--^faDB}`NNQhl=G~N0z_W}bJEjtX9 zZQ}Dy4NDC1?R58;dloGv=~-ed%-&_n8v;m&pRgml2t!3Yy(kuCK3T|0tE*^k9|;Vl zghk=c*CIM(-#TPt%Ej{tRd`0Nb7Hp*5P%4>x#(?bKEB~_K(K=KsSJ4sVoo(*BO@aS zIA?_;CCx9`Sw@w3%qyP!86{)BNydRKF?xVaezYGEn(~ku0hL+qg@t}A?(@kO(Jw(Q@i1P%f66P&GB{3`&=!v4Z6S3=D@>IJ< zMsg(b9Yu*#ieMdEpo4+~L27&Q{cb0FN7P?UDYX((baizkJj}i6f{;+NE#T9+Z1{M| zxJjD6rSz&+b_$=Zx6-%*N*yvsToWgfnA*q;JIX%wh>4w~M@gnJ{Y0PJ$?buub$NXD zp&u=d0oxh*p3-A1iIlRj;yMd^tpK5Wc1+_chW^^Mfllbv@O!aW0nx639W&g5XGSPR z00V0jVs);ef74Y=)=qp%Ri|fkwe~~$Yb+;1$knj+`qje;q1{w1(Eaw05AfRAB;$?V z9I#&mZ*vzI8DNr-d>K{BESi-0=1GwKfx>HP-mJuIp=h0QVSThAPGI0xMe!gjG^YnO znp2)XD^YE^#r%-1Ot%vnTlfi$v*c^6It^vpObQ8~Cs@9k-Hh!IrwVRfzl@%ymxO57 zWcOSBII18V0d%Cu6j=_3zhv%@HR+9KauFKRjd;_pQSYu?rmkrZk%Bgn@;#AhAzxif zac#6ut|%zM{iKVCjOlP0OQ;X)uq*6PeGJfJPcR>ZVx$sMnUdt83hqC&C_sgIe~dVV z(&Xls4smF7!`*SRLVHZuGg6QdWoXv_xF*M|_<4+W=X^Ux`R zXbaWwzdT_tM&Z?8F%EbL?0VB)AVdI{v(3JQG$v(=ZFY$ zf+v&X%8{hV5ykCV6CEz>vSHc%8OHewBb!P^lTL8v2iRI0Or_p0c`?JyMeUC_?}e^K z(K)^6DC_yYUdLG9vc>QmQr{IBUUjJPnM-rL{o5Zdu3s;1Rxg_E^=O3oh>;BbY$j3R z$#x-f5jv2C5CMRjDHK=jhO*F~`w-%c5LzbHKQVlLypIm=C&1MgQJ4AN2WgA7Wn;ns z0tKE7hT=qSgTiomZ=z*fJVU*y`W254&w@ws^;2ePB#DRGN3le~@%)1=UPHLhmWE21 zd`!G@hp0!-gPL5nuBhBQUd+)cXQm@*5}0K>{DCbd|NYb$WCk45@`=MD3pmjTrZ=!1 zM@T2yuuV;{62s8Y-d$(HzGmKC`%J#w*T{}_Z0ov$pHpV=rBC72pWvjkF`Mp4tIXPS zHS;v_rBhp^Khd~+&_;pdVuZ;O%B{uU5G1A5CH^Kzh_{YtK1sUJj3ONmJs69?Q%&0R z3&!3F7Kh{mpE`U^r&*J$sj&SW+{PAs8QTb9co{)FJD-i@4h8Rv@M6RUGlDx6kmh)x7((Qcn0d%)515Rv6%CE zyf7T{VyNl@y_fk^Ts#fP_)TW_Vq3PP}^< zDWhfx!qk01421gTi8rYEccMhD(2qI@+Kk&^4Vp~z4Yypd>chd;9(%hn&aSa(dnI%p zj2_o;=$_<|xd}j8P0Vul9d^@t=Ce8bj6H(@lDR%UPc_0|406#jj=A7YUwf2>UtX)9 z5W6pYCbG}^J1$EdevA;|#k3yTZ8#o!$}H(O9+aX7UKWSd@TYPrNJ(ZEzOQUHEUdS| z8?HESZ>fY#Pv`s9hm|&@_XhR5OF@xjB}z7iy)$^n9k0ox3R2kTH#kW~Xd&Axe@1p! z)97*E*L1(d?|!Jj>XE5+vmBr+P#MX6$Qw*De;uu8k~a1%FmgmsD7UF~oUYO0MQ#vC z*vtrT`#WX)H`4{vo>^0L(jRcGjH-WtxKBS>GEqM@?*w(FvcGSwJURhV<|^2sh?IHFhI@!&%&Odha`r)d4I51y8inop&fq)ZQ+G|VwmuNWon`mG1FJ07TL5x z!CmUS*4=C(x(n9^=^ooJZ)Ec+U8IFkWu2Ys*Ks8j3iX@a=K-i%cmnC8V15ofm4f1q>kDTy+kMyMWyF?e;>mt>t$h+yuUdMo6 zj}evyik%x;VnoWOntpr!TBP9~vgUDx_7NF=iU8s})fm~6d17s%q-!#|PJufF$fMc_JRI)gXpM?%viG1TF3FKFv;P&kkGOOx@?MlLS9>dtt!una7<1*n9k5P1A@{@)s1ijheI z>_Ihy1w(XqKo=7^l`lsqy)mcJ}L1i(EZ~7C7GX z<;>%XbU?bcwiDL;*kXlZBM6R(@ONi1z99X*Hj(NfmH>B}BO|3T7(1?ac+qNrO~~OR)xI5?AinAj_#}povBXOz(o( zjDYOK9t}7lU3h~>{4R=eI6}x*&hHJ@5U=>-ZX0p%783)qiqGt=t!U0Ukx_zyCD@{7 zAR|6vBTZfGFujSf2?wtY@p!Mt+Yd~B+GJ_JQHcLOpLb?ofa~mt4FEC2%WU@5+s# zeUT3r3}F%;=wtlE7kjXEAxR6NCOK&_{+~Vc|2`cUpMc$i zR?UC(L9Qeh@mmsO@XF{nR^*fw!A}-qd4}*}9J{U?J>y_n2tE^M5o^}ycQOdz2*LTA zzCoZOk)W9Y`Is8Q*$E?A0rx@z9T^65Zwn>92V1W#?G(YQX+&VX zmrOK=v`~j+&I)yKKtW)gw$Jtrc%9boeeq@pLSUW=n<7n3v-qd~&*&7DK$z%uIy4;W zJ{T4OWvhQIy+(^i%9dWsOB%a|NB$Xq5Stv^19yKP^(-cWJBP& z+04)RqTscWI5t?TKVMwSi_>ElF#kCE7ZZb<*2Wv)`;G#;O5IN8Ul|`lPdXPFe9)%y zaqWPsYiSTlwlX~=P4Z5|!nSBt$DL^KDhhgegUr`>ap=P!Y3ir`pE$O9&`6eW;HR4! zyBn3U1iJW?`2O7i^U-8{tpW>@Ni6Qg@)NWnT8ACfOS05L`)qZXj>NIK=ys})De=lr z{+bU}Z7JI{yF|0#8>Up>mh}JkX3IgBriC-4gw*NT*v3JEu-VvbuWN$Igc;so9VMSc z0afp3e3(P|W%z`$D~KD-8#JE}(jWM$JHCyhA5Hgsq2}?1U5}V5b&>sCWoghWZMGM) zD_6=>vxC^{Ma|Sgkgw@`X@x1NE6Cqii4A(U&Rq!PL+tdSkJ@34{~^CLAxNjw9Zi%5 z`292TvwI4qjutARgxoMkMuy0~O$^-ou@a-rxxoFcX=fN`V6s$wNTr%-^PY9Y64k_O z8~fHqpY-$^D6w(5J+M%1M3eOap{H*VpVa%C-kiH?obsJA=42qTnQq$u?#-$KFx8S{ zf)}_kg4yKnyO{b0BaU6;s1Ggt6HZ|UJ@*pQ`ka_4D}BD2`A<-=n5#SpCwf+7MR|IE zsNGJ%>iIu&OHCs8eA5x^Pwad}BcvbtUEmbY+5dPJtD+XE(^!O<53=WI$-r)M&+?2P zd}hpoQkK&_Ga?h`A{!(HPEJj~;D6CDUrdX3^$}yK+O4)wfoI0Xn7)E!$HGnz=BggO z$YYjB$e9o*fW~NOL#Y?J+RM~Dv8OnCPXF86D*}dAtML$q;bRODiYy1ZmpDy=ZNvY5 zxw!uxtpm+Wzk+tZMOZ)a@4kiizKm{u%uCRb?obU42FkcklarM46%_o)vARm92ruW* z7B$ck!>|g^Q2*V&BB)z|i#PyKMkiIdl!!E&(J=zArc5=mydNIncV)`?TEXWSo8+9b zkZD419DFe_mfPs|%CXikcuCU)L2f2F_Ru4lzQs06CO~BZ$Id8@?o5w^Al@$&AL5nc ze?6_jsf4-lYPN8C&fZ@OGmOr*&%Bz|JRzJ94pQ6sd21 zQy3Yt7V7Z>=$-BJP><9-my8w>B(| z0%Mkx!0-6@JkIFC2Qykq!5c41E09wGk|BLk4DS5$(fZu>^|(-Qc&(Zk&g-y=Lll6{ zLwC0Hv6N2EWsVd9fzT+>>%npIOQM()$McndX$$qd{XPqf9Vtg<$f1crC}ic$+B6A_ zJXDI5$-}R+?qv*(+>^lxY0%dU|9piJBbb)mfR3(=tI=tPgxLGRB!%%<+HL;#9tTQ9 z6JE;PUQojg6P9syHvgy5li%tH4U(nY565~R%~>akh-XEk_1w+lcEe@Jefr?QA|hlb zr)q>KIXAccpqx;1M)5||SILtn59a_O;o*;|v!}{2 zW~s1Hfx=q587Tme3lM?$H1)9jNo#d-Yswpt_UB0fxz>pe1HHZq?`n_vReEw!e8iqyx z5f!}#zmE;(cQi>KfG`Dr`vPQ;)TEZ9e}W*O68Dw2x^5nxMX}|}5y+b{a-_fIc%>aFH`8I$+2br>=#DTT18 z$3DnbAQpgr+^nuNJ5ksy)v4ThB#Fnl19rY4zX9{gf>CEjdK6ReXMDH7Q3V6|Y%y0q#A!-rlL%**Gv(C-ZrG@h^Oo zIB8m!ej=(3w=o*VN!y7FROMIjVVxr;bW`VLf2`OpIkea2BjFnNha`~P>9GdZ;|Ir} zmJsCi9~nr7)?(NJ$^1_HU&yxH0zDaYbaVg@8<+8L3b~4L-k+FGM)Cp9)%tm;netcs zlCQ-f>J72Hp%kPAHD>qg&&t(e&6=t+7ih;Dn?_B*hY)2F?Y3qKeovxZfJgYfv5`yB z zW|O~|t&6^}*pUO~BBBqUcLK7rg)=fUV)oltm^m#P&lZB3uah^P@#8nnNM6OUvK!h* zYsIA^1JX-Bx452>{dGBq7Qa{=;8f1j-c1J0&DCx84o&0nTM$Sh5r?=s?RwI!lob!$ z;7@x~(?I+5XEZmt9dk*d9A@tn`u~ToeG`{bK8}AM%J5zcPk$O2%~SBP=^LKy%+)={ z`Ni$}<&Ru?)#l(msX&Cp$k)HEc1p&>39Q3y&-W*8j5=*Z6u~GlXm6{}NPizx#KBG5 z2u@pdi)2EN*BvxTXxw(|qSw^=d7hM^J5o*nQo@m0^B+-@_jS@oY%lkplBV%3v~ac$ zPV7y|L2$o8n*UA?maqHB;a-JeEW@wCTfG9`;Bmau!%I!@!6yHZ0lF*>01s%gtW9yu4 zoMdt(h@o-&WyG{~MsUy5ID5v!Iv!--Ho$eU<#iX{xkwUcBs9Q>ovUV?;$Q>rl+P2e*u=JXn61qcD-rA4l2Zb%Wxe-?^tv0XchLvrhUbaQO zHJXl5?%|q6pRK>7Z_8=s%_o=+H2C$cFU%P@k--$N{$mvz%uC&!0nxEl#~*7DJI$<@ zs|n?jDlxWFhreLMzy@4A3}Iq1sN$`2SbS89KKKe(ITiL_jn*eSH38xF<}*1Jv`(Yt zAK&<0q1DVrMJvxTFZIrJn5k$08Yb%W{!2(#4jI5rhDG)Aa=4x&=CJrinke+7JXds{ zCzZnEob>HSdptv-fYbh&Zk^REQC~RD+`0h+_40QKFhFk&hIzb(Xl(~q)rKz{GqVEx zt-cY5lU|tzBtpvcT0YkLIjjLs`FKop6Vfc9+xRwclA=L*O7vI3I4r_kYKQ~sSXMj2 z#rBH?Bvd}0dg`9xY#t)m&3VaoZGMM(?QnaL`3@1O$%>%gx`}IJrvqii4T_xOsIO1CMg{ zZ(Anv_}r>lT5s2t3k^=(@OOt%NQcvYy+2R>;153A+SXawRB>(GK9l+wo<1oQsgz@s zs6TyFjEYiG^av$Z_fB5` z-ZfW#Vzb*Z%1fPj>R`7VMn^yH@iPl~TA(9!(=1;J)$B_spI;8KaGz1G4qI>Gv#&cRgJR{2Kuf z%=(zFF9Iql)#neQVv!z(N%4@7gMi;1Am7VCe}DTRN0VNT|C~-dZb$kr4c@S9CWF4J zq;1jk*bE!luLv zic}CSnyBqkuGZMle8L`$W=v(5ST^UjUWx!@uER2>V+6CY+~ci-*Ju0-Z8nAGQWmDe z(@beEiA=A4)e1iEwW!_XxkWFNzYT}2-047kHW1V(V&Ty5fCP!UXi5qjtY+b!$@faC zn8C+HYThvUQn%MX_T7-+0SIjPBbN-1J)9hAO7QEXmo7uV4Zc{lP^>ua+~~3Eh}UBH0oa=rN)LYId#h(&6Phc#Esx+PZNwhi!p zE)*+>e%)st&}gyR1hU>n+jze`APSWz|1V#oqoK|eLKH}U+i-OKR~Sjb_71>vGQc$y0(i1vfYf9p zC0#GQ@f2w6nO%;*1#IP|?60oSsB&dr~MRfkS=W zr+~Q0Q5*T^0bXwJVfjf%Q!cG#j(J3%HzEe_H;p?2ZJ3i~A7vqRrVfh;K$vd0%WTz$ z<#W{(D@NpYy7G$Jk==-9du*K4)}ShqzU! z=(uLpg{EGqqvEOV7Srdz+R3BX4v!?!sCXJ-6q7=Vu6wr}>dOhf0WLy@7$bsUbmDw$ zH8=(Tb+9EUu|XA`_qGi5<)~xoiB2s4it|b^abPmxruZHkz4oUPy6m+Fk?!=}<-10E z!H#mQ*_%SWzF_IFGP^{(830U{G{LZ1Le&Vi&@HfG@%sJT#=EJpjysDWw?OZ?C5|%N zgsx`k^f)H%e2kNk92qzrrJu(X786ZKQT9qJa6f8rBRad+QrY233l#2O^FK=2|BA4M zy|*|DMl&eVc)bT^1)7|nQSOL&DA(hO7HfwDsTzp{y)k~|=1OOi3!)J5fhtJd);(}d zzXL2llsp6iLf=tE2Dl(pwglRT)&IwV^_F;#vqQd}syx+LiqX3Op5{UC#q zW>J2#+=6^@b0Lx+Jxs_7DeHXM*T2{$e6&Ps&Lu6x{#>|9@6VX-d+>(BN5r5bT~_p?h-`~386wZ#j!r~P@e zvA$D^bu7P2$Y#$qN5Q-M% zywp!G57UMKwT3{{PZUJfq2Ctr@qN`D8Jt&n6dG(aGI#p$*yxNm(Mq^B_KNZ^tCNh{ zXeyFjv@zlw)ZQ#us)^SNvG> ziUllllc2ufXkK)xL#>V{O#s@h#5KQ7qeO1>gmkdlo;Mjd@^fhVxBXGXIRI%=m>iD( z6QAOv(@uXhTTJD(Qtg3?^F@pNp{1p{pC_qcH!dWL@3j&QJI!KBATX`@U8B;!^2m#P zw_k%>80Hlr8hmLO6nTEK>hn?frB0da(Ncq9sBQUT!1Sfst@ME+-D>FPiJ5ja?NQnS&Ocd9@uOIiumj5Gqn?J5Gn=XR0uK)ccIejy;D{H#25AH~p zQp!l!FcdJ@95~HG9r@&d$zHR8#>-?o4Z#QIJwK*q7VTXe!DlPygPyI9rvxo7*1!LL zcvOk_cZS2H6{`0B_B&P_9?YvtZHv`~M;7{_ zm=e)^j2URdmpwO|8#Sp+pgMQQVdDu}qd6Ln(--&~QOk>mn?@>My&8hd?G`&eA9KG2 zRa3MDWhkVu5oeKPnJ?s^oTx2_M|b;nQ(T&~FFow|%WIm3Rp(<5i}2csUdg#+A< zs+EaF=D2s$$W9DHr^_wuh-@}upq|1}WwE07a4(LR)-Rv?J1L8l8?3c__o3=TtmbSI zU;{ke)-g|s$AqMJN;ON39T>+xz++4X{EiNjp$%L{zx zp6-i&bJ&l7r!dK=U4XfaG$l-m3^f)Gz_BktJLAIQ9B$dS-Z>o^{K_N1g z1v@%RKy>`edRPO$0HY3vAEmcZFe>_h_w~rieE^)`7af0q=vj8Y7rGb!TZuC81d;KvN(zROp zj;mS+}OpM3A}C_{vAf+850caNS!ScAGQLe+KRl9;`ES~< z)zLnY=x;g&HW2&m^Im~j5xud+GA`QP*<~X_Luzi-4Fx<8!eb+J(Qtyj*C>?Rq{(BC zn@o$P@%bInJm-suQg2_C9E%ijV-$Q)(y0Y6f;He`-J|vWD0mmqC}^2T7=Z(%Z6qA+FO5TF?n(|U#aSl z09h)gn0a$ED{9eIpcgvNZ=f4pcvnNrubf|LYhXfYnEn)5=R)!TBC4bo3zxST71r)u z{KG|49_&t%|6w) ztBV$#AV#MYBN?5}Sjh8ozX9DI!|=P?lY<)QI)73?c^phEooBT_puLn~_*z$$GOk)g z%xRs&8iFKaJpLw5`9#A_7Pq6`P#kE^5&{j|A3?;e6~YiuLd5F=qh{t!V^XDiG~+Tj zSbbsdiaD+09l?k`iDL78qsP(2SiUIJay_5BMEwN~xwDKS4J1jJ$zdAEs(>ORk#5(z zUHar)27-hqRYcVLtZ>k#)JC_ry5fM=>gPq&E45WP=6~Kqf6m?%!i*42<#ClJN@*w% zPscG_`|JJqh#)PCDwo?^oSOG&JK(|;=~wy7U49xhP2{@H!HjY<%!W}RkJ|Bzy^wCJ zHzq~!4SSlG?Tb_Rjm26($3*Y)Y#)B6$IZY1XX(&@;S-p2^2+68 z4nf~X1D9%@IZFI@G)RCgj$%y7;^_5W_?dNo;4y{Qt>a!lKhm*pB0=MCi>7qwQ!V zC>&479R}dYM*~;(;eKLteBHP-bxQ!sdv1v&2KWSZngD|a0+8pF)I-Y&PYIc6YcO9L z#M4M=n(oc=f?&h$FHd2Y0y%Ml5hOx`TMw*!r1N6&m4x7HZeG_n7}L==bj*RMjYt17 zGs{Ss{=}g-h>39cqM&fUQWlnqmOb8kF|~UZj9f<#9y-SbGWfDJa0g!1RyQuMSexMyZ)_sFX(`_(J^q_ zOM0d-{9E+{I>d+8=b-1Y#sLkZaJOZqS44zZ(Vj$E4SZU3ylG>v%>`eaIxw^2es17r#W zO5_CzOxu>Yo#Py}nH%h*MKPOM(@)E1tndsqVDNTaqM>*;!cKzU`MOWYn^y}(WU^Vp zKrt1Sj9E^1onBVXiX1Md_j>sz%_Zq$!nGuDn(v4vF^V{bzi!eF0Shu1Gqm~8EKYDj zde47;eT}&Q-hmQw;!SegR9M3%8EEMqN)ci(0nxY?Y0m?WD|N9$_ zHk|QwbsZQymbX`eI=!+8{|;w$v?oA4X}w<1jJE6cImzH;klavPf!!rdC7OU+<|6N_ z(`1cC4bHFXbAizxRUkEx``wBgTBDzr2cG8-3YzRo*eeY|y5uCpo9mrEN9ljs&LN6m z1q$)+f2pWJ+ATZJ=1T_*6n;A|5IQb}Tl@vTB{g^)gP+|FdB3&gXJ5VN2j&^X=VvA>)$f)HCP2j;IjesJ-To+&sFy5l}8jeiJFmwRSKG48U)av zK0(I6E`c4`^`Z(*-qJ1{n+}eIel$hktG%JI&{HSs+4}N%EldTSF1wT~7pNmvkA|1(0$VjR^h?|GEywU*2Z^zIFxV(Q5l@+^ zAlzdqTA1l?==3{8v(YY=LF%9R7lB@0Mne3FN!VQAKSVXFt3s}u#9=`bvy z<@SvS8ZR!B02c!_YlXw^sh)?yX)_g5Ma=tP(Bbk2A*(SIV2G#EW=ou&7O=FvZpZ{g zv=_4xC9-DrSlA(y4Y_r}AyYe11U!~uSG#Vwu+Mi9Dy8T^7}E+gl^hmkyeyw=IDTx>F6lv)SPo=jrYQL@Jb4&>J*fHMyOKrh-A^ zZE(Ko17+EJcf#-c8`YDlk?!?zR2agvgdbRqyzt^O;@A)O!?p0!u4aY}BU6teb zw1=&0+~yDqs;cv@AM%+woDi973oj2#PR_}CEHG_DMuHuxtew6RHn|46Zz{^b;rgq+ z9tZrL844JdvS|?tj^of~ChEw|Xf-1=G-Rrz+~eGj_G?+yx5AT{YJfwmR~>Fs1PvG6sbl>-oRCb=DHw(u_OGj9M;388xL|c)Hj+n#U){mR z6|T0eQ`=Lc18OZI$4>(A7SB+Mc7do8f%qdTZDVD{Gp=`wzX^B zvBL`#=Fn7RkgJWj`y)v}9VSPrrv>jc^*`$B3%^E#1Mpl9C-q?#VnX6pq6zr%U)^0o zF-(3DjAjdxIfwzR*KdzcoFq{)`U*+)H{;LG*UFPaLrO1)Cpb<)6 zjL-mb#F}pX1XI%L&7OM&MDACZ)QSMgFu&?174}aIPEx8ylI2;=_)AqP+kHP5Ti?Sm z1>@HBUJ>%%aO*D?Y2Gn0<*qZTB*)en&{V9BOg&Q5waQ0ukL-Ptsu%_xhu62vQA4$lNb!VB$f*cYEQOMsiK_T^`jd2m8Udff~D zLL>jDopBmqM^?`)btdpyFmlmp#SddQ;^m`PcPs<-=n?>xN3IDpg+U-qkZs zvbA`sACC7=svjt}@CO#lHL0F*7HNc$+vKc@BL2>#L1z<T-lmWBi0HAWKvC%8|@0n8|g&67Kg+=p$4rigb;JAOSn`EcD7Ul$0?PH!5hbCO+_3&#HaGpS1jC3 zw$-nr`SQ4GTcSh&8x-($wdf6;`&3r18a=c%E(JIM;$2;451-XHHG z#8z;OfU}D4n~G=Xf$(T#hXL!GW_ef&dV0&?F z$FVo$>ny5nY0f{CK0z$l=DSku0*Q{Bo}`eZ$)4TgMNBc+W$KHSp9$xm3kXyie!GDd zP51hZ|7gEO3Jp0Qd*V>dG+zGUW<**B@&cZa)4|(vq`H=B_)IBoEluR#*^`)!(&VO# znvP8QLt*#r03IS`3>vKFrJ|M=kS^|^+m<)?XgOpJ2blXE%P z5vNvAKxz}_k;;*C8cqvTAF2Sxzj|$LzIJ%N)0L?eyVeo^lrC@mE2L3Bir_z1*bJQE@mj}>vfd(nU?!X#FrYV|{u}0m0^f6-&VHSXuzIeyaeNHbx?hDi#LoP@>njHTQvPn+^cSfOx zRfq%P%wPOyXiVlCY69=JAFVYNrGD+U{Ngjndg!G?PJeu>sLOkyzVr~~h8q{g{cF-k zxgg|4^r7j(^@^hIRyi=?bq0`Abw@zPnIyo(C#Mo$j3h%Cwb*2Y?lAhoW#loPSv3~7 zc1yePaES;dvtP;BK9Z_+sR)_iz(}_2ax*h>ApQID&v2=nfHgmGfpn^AIl$%iz;Zfl;#?o#xhCc~Q5-x3pPsO{0%rm@u9dh+}*nNuVDtO!~|F{CY5n zIeCOeu_yY{per|No*vKKFe^-^?8${K6Itr>$!AOK%BlsCK8}D;C_}B_)!1vekeQML z4D-*vBXuvGP2VxYXOw)TxhFcf^>_LxvE`JT7C$iLNgFRr84fKyTe#Tt+{c?7XZ>>R zl%^{PWE1Q~6G1I5NP`ukaQA~t)5AxNrkyP;tk^Q8=C=Me52;CW>T6Yu*3T5@c}DOu zhZ3r_U##m{2$(2VMX&rHy52gh%58i97DO6h(cPUQ-Ql9UySuw21%yRQH%OOscehA~ zG$P&I@ILOn&-tDGy{^}PvoFNZ2%Ao4%tf5C!ONavyGM7haO>Mr z6N3LsJ8Cc7P0Z9uKD+ywkg;QwfxxGSmwQwaNN;~4to4oZVZ@oJ45T7Z+oFnnxfl&s;?x+KugsOJAj)IbtJoxBXKy!pyfNV~T z5xj7*B#}BL^zIcgV8B3?y+-*P#}-s?`EvGQ(@gY+j_>Ien0C zPH-kdeI=`B|LYgcutx}$-zX5L)f7wQqPGjMYchxOH=NZ#{HX&*Bj0&M5mB_i&Zy@w zr&o<3!I_omOT(hl`Fww4Hp^~vZ#Kp@=bqT-2=oJsFYYYR(L&AGgx_9JMHBI8$_8v+ zbcdDsJJmCEoDAN0&1HYN?VlyNc&N-fPTBV)avOw0-I_N&dITbQeu}{~_@^oZel{-# z;_IZ|Q6Hk|v>xx27#J(I-^iSV&bu;yO?m_RY~u~*k3xrwK9-D}j1qpj*;OE`>B7X` z)dlFcPA^-6;z+nW-!5-L2Y(o>x7k7~uXN%Slz{MR$ns~=U^E^^a6fC=NErCB8w?FA znQ5v-2%s|w;$%BW+O9RSy=3(-NKI3n+hyH2>m(c)TPIs7VC)mzpYQfRn(Nv{04bk% z`fBid6+%!H>Mk;3o!1gG3@l8pL1l$8n?t!Ge)h-9T2_iKm9l1}r1jIuP2*n-G>S$> zKzpSkB`GC)*NTw?TI%yF)Nr(T6@rsq9m`U3Jx>d=Ng z&Oh=VIwYvX51dysS(5GB-X=Sb1Xm&cdHTjw;BsAC@PH~GeVTxFJ--ipqZq|TotYMU zmni+bnC63$XBHhWw1PD`>#WoBok@n3M!()v8<~|H$k-aYRjrYOiy6=K>usO>MugYP zsdHa41!810D#FLL=f0)7^&C;AO|yr!dz?VoFSpT=Fc%6*#Se@c<3~|i=T@jwkit(S z*xqD46>H|$);y$~zY2{_9!;jR`_5JxD);wOf`z7xoiPttX-67tpfWso003>ryD)23 zI!5UXohiH8@gLN!B;-`un~0ZTcBnQDJ+5>UwuL+{gdJrZ_{(O+>+(imG~*{VNVbrY znJH*bQ(*`qW2o61((q`E527T&YdA3Nesi&zNJQ_JnbhUq$+X_t-%ouhWG+bg7d-6pJmGaO6eypS^OoBT5?0%|a z%Fl649mT|Z&jmC3wzf7(mST>4aVrU`C;fc)gzXl*r07o3Z1=FGNF|1I45 zN6E$w|Ak-rYj41-Cie%D!)F1@Z@a_m{qRgTtjjAaVm4MxB0yp|1^wBKFZ-52K4P%z zd3my!s9Nr`#TXoUm5~Qo+cyakQ<@)|2g)4KVV?u2bHhG=W7hcVG5jSE15~1j;=)$% zs!ve4ugfhCtt6l0nmCN>Ssj&pf{?0pvA#n(@@Aq7bp(i*8E7OvuzhpX0=hcURXtmg zlg4X(hH-SBX}c9xFvehE3?%`c|BCSb7Lfdk3K&6=uG!_TAUfo#WKY_dcjtz-X-w`C zqi?kIp;z2)nQ5UvD&Fijan%0(IyA2}4-4zj%>$+m7w8$EL1_sAW8}s#>>#;cP!qE@ z|4}0S5pQ{_fJlw1G0zy?9dIe>$ho3Cv*2!gXX=_H;CBF|! z9$BVEU98s_quWBi&TT`#mNx=UlHn6IFKmS$Cl@EV+|2jfJ5k^*$?rKMYmW2&JEi|e zLI)NN_(YP5I%D5~N{D@jYlHCkjf%LD=#7Gc0$Io$40Cu`Bz?AOoc?|E;#$+IqR)97 zO(!vymBBOiLF?{$u_Lpy#Zj}t?6I&0IAtKuH^9~SzB#=t`>&+qk5q5f9R^b>zhSD~ zmnXl)c@BPf6X5_&zlnc&dHEMs6D_r9sgFbn5f$0hLJjnfQ5w?OJa0fKKOTpaQyxN^ z@9dj*V(H_nws!3_`!o+v$q5Zec{qDoeEvtu14Ii#D0J|>^P;Uj)Syy%WV^3=+xufL z7H}H7Rpg%Tx2RkK3_P{%7HK}~huycj+cCk@4YQN_2qlwfIY$!ER<#g!Rk1nWM9%!v zoSBtr_%_ZzS7N7l5dN=co-Yf7$&--45JW&$A2xhAU7>P%=pRLuIXe31PJN+2qD6RD zUv2;LE%ajQtg6+GXM_P{HAR;HnJde8SywhVbzjUzLS>tOru}0r+64G=44-91`(M{F zj1HCfW9!a8bbaQS!i1o=W_zGsDxE45=`{|OYKH=rmWGvyRmH*1PG}^OM3)y(gT?)v z^q^Xo2jV#oZ?2e&rXID*C%D2U`x>^Z!@kh+?f^#q3$<>%Z!PMb~0B zA5Xb_K@&~cN_=UG=Dkiv`6qwY91t}=V*e8@{^)D}ENx0$X!=YfsjoKK+EsiVgPPaz z9WEf{k_H%NWsxBCZ^rR~s;89J7K!fcM=d8Ce-@tThg?;>q#NJAq6d0ny*oQA?1$tM z5CjTJ4tzE9k6`uhxCaDYMVQD>5!Vi%RINx!|59u&k=mp$##Azg2-MtXD;VWhzzr%45Sh{Y*H?VW zKvVn_A^A*5?H2en&_A$!*LWJ@-!6~dM4L0!+&AYji(Nou_Ksp)E@Gp`hurpwM9hnW zUxGNe4nJ@Lu|8^1iRe2m&luxMQbI6rgXpZ--3hq9`f!5#Pn$3EhDdFMq3S=r6QkM#va()+R!fTVR}aw7nuZCW>&XZRX%)lbn?YX2#vxz zr$2567faN&wq*e?yd4+%cx@ZSq7s(YjaprkZP4Boy;=J<+3c(p3_9{BKmxCyb&N14 zsrTi7qb^ibS9;j1`ds!Qa!)Z>=8wSqUjY$E;YTtp!KODA zqXQIISG7uA(T+~NwcD>jie*uj5^8;Gx9E~$fg1-%>6=R+<(vjIolMT{v5cjb*~*Zv zO&UK(=XZq1`O;<#*l;Y+!9TkOsIBh`55}nZ`E{dRRG~LcPvIx71y8l!@e3@YudKez zwp6Um{qOz^yr;G>s`Oaa#Cj5q!M(?B1N0<~1VI4`ow2UWl@yM#UItjKs!D#T`=1w= zWEp6>+{SJuzar47VRbWwkTEKNtSZkP>O;QNFsCzE81gw_DuaR`@ceo{$Qye#h|RO6 z?9~>z%tFmTsIqh>0Id-J>#5TrL!k?Zm;3r1!z?c*b6qntesI@Kt5KV3e&?v99Lp*u z`BU85feLOv)z?w$J@#9R7%&lvjt&gx5o%{;i&QC&wM4m9W6CD+GVH@K3Bl-v%@j_| zfybxN&`|K+?4GgmLf`yK7}lTV2{ZYBE?X5Q0gsU*I$8)NXgb`AWk@sA-E-!<&Qvoc z2cC+$A7%c`I_&KO#Z%f(M*|Ku_LM>m%kC-90aX^U5#SuwhpnaYXciQ-F+<8?OT3zt zD_Ywb8X?$8q1WO%0N)eFi`L>8CH!7g7-Q0u9k+$6re9;W|F}#yDVG9z0r;lPOGyjIAOn-O%`9b6aMq%MhR{t z|NipVFqn9GsD-UJ$yGvay$huh?dD{~#(D_4`MFcnZt=iEm%Zw7=UZ-uP8Jh%Ty165 zzR2=jgcd0e>7ARN#`PJV(M<+t+{x(iYJ6Vt58Zl#_fXKyYQv~VeJ@2%fc1*5)cq}#MoT>;QV`Vw)%j|5j3V-j_~TT#ZXPKVkSCHQkieR*@Qz^ zLpCt;B$IXwemv#%xHht=;?_MnN-|)8C6VY=al}%)!JZd$)(*E)L~)wOdwPB@9k<(E zi6o&HBi@Di=dJVkSHuQ#K0EjnSZ3$6IgDt6ZGr>8#bT~3_T41Lydfa17;`K66R*=B zZZ&9?2~j%N>90V`?l9z27Ff)u*zs5RH1id{;S`M!b+J-8(V9ksIYB zE!3Uvs3<+}%Q0d8r?$+?^nA4)Oga0!ilunqyU5cfAp7V4+P*AdegRNk>yXb%)gdYJ}rzYFHRiS z{Mpe)m0f+czXFhLuI-dl0xz{zd}~RmRVhvZkz0o&40FU_&)M%)%T4TCGcK6Kim*Cg zA&yn=doLS)%l8v0D(uZSJYsUZ6hcg)3Yg1lWFh>Ad(GZQ=eH1)3=8baEYKpiQ3P}Kz| zFEdD>bM#_`blZUc7FA)Ki#{L*c#M?k9eHmx#(UiMG`WeE2@i^wPxw&BN1heFyR5;; zof5q7cV&ww`*Wn|6`7R#_os7`eVuClQdO|0NbEk(g4_CH_^2I>Mf;kItI_m?YuGPE zpFSnF#GQR?4$DzT0I!4?PkAoI;2B6oGv!q%i;Cmpq0w*`W?>-G2S{GO-6oYvwd)5-sPM?Z1Bfr5R=aWE_GRPQp=b@8cb6S>Xtf;WK12&uEOWzlDBwWU_Y|^L-q9b=90>bCQ*31tCnkHB{FD; z16tfLUUDQHrU8Ix1;WM;2NW@1^;#QhKD9;L%zgW*S>>3M;>@V~jsy_4h&wM98^FP~ zy#1dYd{q`E!GWqi_qdm!*Kf^WAew)l_l?LbJ|e4(`*tagLXY{9H9sl}R2F~0So~ns z*~ObjUzC??f0*>H08f;W-iADoVr|K9%mT);Anbl5!KYJ#Kw)4iN+y|U5CWp0vTeBQ z=a<#(1Kd4=#&?w*-QDHuHd1e6Htlt zY6&Q%_U$ZAm%B=POUopkIOmyDTopF+4y1PYEC|M@^z(q+w+f)jWe8rd5DR>S(ZJC# zmCPpI8cptpqgtIeXRU;;@cVy726b{n*&XL!uXI~A*gCM%n7Aq;UoiCbLmULnT7Nq( z$e-KR?s()M>x_>OYu_x?l5aVhtQ*^9*%0a8mvCWz0w!3J8TCSPK7=Ab<;(d35M|S# zkGB&z0A>{n10n0H+u;I~UaPB=qjT}ViyPXcQl3wh<0Sb+wg2G)YcWuKvmFw8X+x|v z9~TGQZ&>a2F^Ag|2|4%rv6P1;pB=#*fQf;B9ez^A6!Pzler9~LlFGY ze87bZmH$RICUmTABZ;#d%|XUXm9C86>l|#VORu%7fIsi{XV~!i4CHk;dVi%!TP#UPFM;zqvhotSyilANfWcPvsEQhGw4FUn>iZa-kzD{{p3VdQ*P;@tzeaj z1=rcH@SYO0D^fGTJvDOJL}`xzZox)_*LJs?F>;>wmnC14cRZs$dM>G}E%uUN5;| z?k^Zs&dB#sKHWW}52-6Gj+I=`kw26fMp{>M#)i|W0~ za?7*(vogt* zhIQlI5%|8pw%9&4eIHMGi_PnHfB<-oB9pwA96>=s`VcCw2SO)AM>)Q~+W$Idk=-XV z+PXL1S>-&-0*{Imqn@RK&mxO^@Y?&KNeCT*$ss=ml zK`&Z=fTTTh|A^#e(G~D)`7Fm4aiR#j*y%3>m~(>o+z-JI?sk*;Qk&ePF?Q-T_5c_H zXj+kZ94})JMtlB9zrny})C~@J<^PIPGMy8p#q~IHT&NN&@36*h$z3*${|%SJDrT;Q zMKU6X^^9<3mOw0XrpRgmqoD0Aye%O2$}!5Rs;(9TRDVW&kPTYRD#LHilxM{%jU5RF zRfbTH><$%?u`RpgyGH`JWH~wHJ9Z0I`k11H^MDd@MO0Cc4!XQ0&=og)b*x+(4 zrWBZf^HEyXadr=ZW)-erB!C7_cO4G(@WZtEnA6k!m85AFU`?PaxzN$>ZF)WqsDPoM zK8a%5+1Y+sTqOp=W?;-XZIeV+mE#oZ`Sk$6vi;2??=0_^_3Km_TxUJI|A)xC%=hv4 z7h76>juOq1aQ<`wZ_aN9jp~vUES=Bc2pH7E2+8#EPqZq9n7khQkxAv+qpc$_sV9!T zi}fyiu*ihL?cO&CB6$gwbff z66b#Lq9vHURq}TDA@?)V7k~_)+vJH5k;M1`Ag?M_2|p*3`y(_@a5n&hX}zoA@$WAH z`r{I6_8A7N>BK8cCS}~W)CA!lld4YwpXBC%rgC+4%CgA^M zxYBZEj3-_Ivo#3y^pF#U1?Fm~ww!H2i6-Qs2itc)X6Fux>W{*7BwbI0d#>{0b` zmfq8=pV8u})`La6&XUR{Zp-1;m*{+F+##W$m~wxvJ=CzDm5|Gx5#L8kXyoy5x~Nh~ ztN)ppw`r}IU3!EkBf+f`3!JbhEq2en5lzBJUL-PNs)6!K4)9?h2~o=P4Te8Izr6g? zFC5qZ`?Y8moSoS_TK0dbZAAnxv+IAvA9ehowT7hWuvi7k0Vw&APPi%8kzmvjB zJ^kwTMh0hGW*>&@+soDn1ro2-RQ^JX83wa%69l0DYye6tXXcYJTH4Ct1GYEGv2y6v z_Q?FV#^++2C#~)W(SP1@kY25MVjC%dxP~%NM3=GqkO%+D0NujEf>FN?4fs6qZc(vI zeMiT=%hk5o?d;SliVW6aYesb6A|9@y=f`fk8)G zf!8au8pG!cn}mA;gNn5N^&Jw<=(1Y5E&?zJH1K&;!-%B!?Pnxx;r{cj%XFs7wOlv8 zFy}_gMa_Y3i>HU|tA%EZN`9B?Z(6_c!ukP3>O_YN*Y|9J54pMgxEs3F*7ayZjSj2i z`pZqCkI%_$p?>lF9}i(dqHx1t&M>};Hosq}br8~T^FhcyGYPcq8n6kS_rJfy)8%yo z5i)3e`%1z`v4w=q)D2j;^vP(pYpZ?F5Q{CtM&$&-k}4d39T{5;RZM3S z9Ne!zaQwZi)aHBf_Uu=`*qyUktdIfmlM5PwvAHK9uMZ4yp14dtw{MH95qU$W^R&v1 zI>3Fvghu?dMgn!zI^@v);ba8je*M*NV*IB?t)W+6B%Vq~fsxa<=R=x#OD-#S z(m~T(lBfWDaiOU3$pQ0ykHP^vS+G^v-Tl7p5P-1_YnOV6`2_n+Ks2b3#XlK8zYeh^ zTMWKAiO|b0d1<*mu)zkIsjscHdVm1^#$LOpMwALkvcWuXD8!L(kg&suxV`6)^Q9B{ZLO#jq(6 z)_}Q4$Nd>AuN>gP(j+lz1p{#Py)etW^DV^^WihY_rsu=$I>2&1|Ape>A<^t?=6JQQ zR%bV_5C7I+Uyi`d3X$^LvL}#0g`aJ@f|vpFLr0wh!h{5Pj4Bsk6!k8;`Hzx2%r~HD zH`smxa9X)mwdQduKN5br*=U$dSxyM6R;VgTQW>b~9pDmy+5tG={pH?k zq0Sp1-Nm4mC1jb@jZSBw8Mm3KB7;RGrez6D`mrwP3O|y_K(p7J$?FkoL0K4q{R2nW ze!1oIZ>e}#oe1Ig+!oKG+=K4uEEr)+1pvhTa=OjSdGkJsKoX55D?d%Y-A^y~TOxhJ z2Z`j$$${9sL1SPG9!g}RiKCPXF4L&ooY`X&yR=AA!E0e(2jz)xUZ%PfYgBR?^YJ1M1H-YTZQ@>} zdW-Dm1oj!rV3WQojJ9O~@eRNXdJPQ_GpcExWEwtU>qfyMP>5& z6BBURi40yJDHgg)#jlzRYCOp6DUtg7u{$gd?;m4Z`~W# zdta>A_g{Dkj+-hIWU0_24VZNEW0j6Nd1OM?^p0M*o*gzXA}zSs1A*nWcY3lkt_E4l zms%AKsnBl?5sylPFzs-D6{;~G3q-_Xkiq2OCSNSH5~3C13eSD~mo&(=h#Tdo79n7t-T@g3}3F5n@O1mXabh>OI|4(0Jqs=x${I^z_bQ%Ui zV@OzCwviKP^<}flgg=R*zp`HV+L6DTRw_mn#;D$wuNyRWI(XaC1QJ zymK)6Y--+9K9f^#u@Sd)J52^0fz1>R*jWvadK#h<&{C_TNuOoS!?kjpi_umqcZCG>0{n4j+$|dl0G_@H>^1`Oo(SZ&>W| zR%$&+LXZi_#>XTpD*W!)+GylLJ{P=caX*GwQZJ&ilDArqY0G9GzNVp>(+4weN(z+! z#S2x04;F&Puim_wb+?rOuhmKVPbbSgY^u$=lj~l#*11e}+!cO7h*I@KO&b6w&{YCe z66`<#d_V};$7p6;0IWicbca58)ZsY9C`g>=q&(>vy;f=D!Y2UjJ7>2j6&!nGM2F)q zv&3T56D-Qj=f3}qCO0i*95_;&MTP_lthBfdrqv&Sal<~cuo!f7Syom%uXOl6e3d&; z$7Q#K$7a%Jyy$QM*lo!T%xuE|Pca;LEQSDpncMds`PV=cgZnXXwC)N(9jr5Y>Wm}) z&O@hE!w!_6LgJ`o3`c%<%JR-}piAj`U++dEV6<=fv02FD^n5?F0Vi;pt@_+m0lu}a zyX%1!dMyyU*{?<>hijb%&}P~bQlLqAX>gQ*c^tvV&$^3^AAS(>n8vcIX;9?ipYeL0 zlHzmO)33(G0b4DNI0HC~-wUyAAQD88N!J+3Pb}ari{q=?EVlS?jK%m_kR)3 zYP$=DsclLHtEvc@&{rhwix|uP`Oo5_BAi><0h8Y^KavEBz@B$L7V_Dm!^#C$;LGKo zY*mdhWL7ZW%C}(qqD*(9?L;v@@Bv88ehcXL`7dcTJl#7i-!$uCS54Z1V~zRKz=!Uf zS(}%ExI33VvaaNZ*@JnAJ&_)H`Xa0E9HCTuCYuXA;HLy@u!ch&w%ae0TxGk#->!`> zgdAzEEaJ7Xto18@cd?cWpgw(eFL(R=6xp@fCN2dM;F?%ONi+PmBWe2ZUOjtQ z<<01|om;yRo>k%drTC(8%Kf{$3mPdkCiOZ<7A}E_88hhUU_S(vM5wFRm)6#{!&uO4 zQC130zty>;m3}%w(eM1;Xh`72#-gy0ml_So@)Xtr5Ok|nY$kQx!+|so zo3AoEKNi}(8^IP>EyE)WQ7NAwd0S2-rmzD^`;e3;G1ptI^9ihIdXv zXu~R69~6O7x2mo7>cM25MDY;qb5cs;+wdmtkMX zq#_@mPWz;7I0X187(kYST`5y-+@FtA)IhqYmC8M-gYD)&?-!Tmy^b`jQ}6tlcIg=& zw9;nv+WDC!8BOVq8nuB*g zgTA|IK}q{6f3#n$E|%P**QkVnIh2k{q`NqT-|T#auifg}x16eS)gvhAFBdBZj_6?4 z>kx%-OlLN;YHR6ibanUA>a!0 zU-Trk+v?*RT;3VIAxb-sXD&O3#ZAl~`3-PK(ZF$AdK=G<^T?13aePuA-EtBvz@SbW zgMcw$^79;PO$;m*$)Hw2UZCFo@j4(vhEGaFzfCi_e~=W#E(fSD?)HaUy08_bZhmb! z9*(EkIATM%yVyxiFpL3FV1b_ATY+lC>*O;Raknc}&St`Uq8e>f0QzT==;sK?4vqaX z_dr^l`6Sc;&WvP&|v9`$5vcMxpuFwWfp0Fmq&jfkCAxW`v2gtEC? z$CNgfdySyh@%SbXg5{KB(Cn;s+~_uHo-dy%J+PJoq?V*-Vivqm2-Q5G$=R|w!;M@q z-t*-(EGC^@Ylav?o^V(c0)&kpNlXO54WcKmJf+F4tu~xA{+`8(LKp9Uw3H8;ysI@Q z)vBS4lU^x1d4;ENW-OLZ^DVQS2yi?PB5HLv*}kL`bqtDtq*3OscyA1h5olI>=Ggkw zA8?5F-n->@BuS)(t4&t8AJ2GgoES2JE2UBU z>pN1>q4uzOxLxN77b=iJ=T?-ykYQ3R3>lAmZNs1}cs9D^)N+WC2GlHKr_L z%7T>QWaUmnJB?n*(6Q)!m^7;t+ngwiDZ>~Cs73ONLh3z^^cIH$&7)}Bg>^I1tnKp# zS1RxTU zm5g*Efy^jf`)FBQ|EPb%u@dKaB6qFGCAIUfBp{Y~+vSQSK0HbXThwYbwqkX*lgL-r z2l)*aV_BhZWRi@Z788G+{o2;-baH9B-lMBeeR*z$G8s_lJ4~Ja!mp*A>P_FzYL-}E zE`$!Un_Lu|;?Zoh(q$iC{0<;D4TpQ0bEifh-eVQIKMlNRmiq=7>9_ci@nLC>DNr}a zY66p7yWY0i6rNG90a~SS90-Tg`B7i6S9EKS9e^&1Y%m15JxbQ0V!oJ8yU`N%n&N4; z=I&(+&R|96pGf6L1YMVN%ha&kjP8CscJUoEo| z4f`Gol@TQvhgnw`KvBO*2CB*s%N+CcXUVAIYnbiAZToXL|>ot%=Ff`)kSI9_m!2ItB?txJZAa(<^+@*;#B!ulAbHsBY|H^n( zs1M}Q1-j1!6phPWJmN@5oR?Se2irrjM70)Uf${Mah?tDF*q|+QHs3j2cAF`*pEc&J zKP6PlKu??;^KAfyI%?p1Z@*I8&@pCS(PNT!%cPk-c(9yI%X$B$TM7xbeccmSi zo|FHYz5uu;<%M0wNw+U&{kwa?{ktY2^1E}Pce+^c!PbC1Ho8fs070KyObrGQP2x*Q;Iu#2}s znu#QY^*x^cgkM)|+M@yfj=)TtTsH-Dga^vvhnUd-JPU@p^ zk=HAffn2`#vW&V-iZDbpcekWYzraABBx@msh|gU(2==PldW#-(ym9g!ivf`VWQK>8 zm)Yh}Bu^yvDG4frPNm4VWO_ynY-Io#a|p9DZU0DR^5rvGSo$!{XR1dl_TK8|eN^IA zGKr9%aM_%lm?C5ajni&1U@(RlC{dMz1wUcDqSF0_ zpf=e4q<3FvskZ^2CfH$mm6xbc=Q(cl&??nX0^Mjvn?~Ez_orv65T!hE26F4F60xC~ z<&!7~I*z?FjY1~$0RvwD3^))R_RT~hfmTVBg}7Hx>bN%~0tZZy=p)4rqKtx^JA8+u zA^UB--91D(4cBD&2XH#9&T29c+1qfmwDozr8`^F)-OgN6{_aGUMe|M!l$@Vv)o1@2 z4wfu8VRc)8_G_KtGc^C*)M!F*opd7o?o=}dI<+h*OKdaPb^cfYm&2T}#cdygxHXy< z33;Lg6}-1EvKRP5FD5-xrlSKPS8?_@T4lIZf(fHcCrJ8poC5L)MuV_=;E;2Or_#q$ z_0lEc>G^T^k*#N?J`X9WLX)b5kTTL~vrpva2hr8u6lKaWF@;#p{2Vo}F%S1wxw7ph z*R%J4fnG=?-n7Z3Br09Y$-F=lVoVF&X!CW&-JdEAEjz#8_kuK9ijYoh>K!C zCm{AxC28zk?oh?6I-GiS3jP=gPtasCi$RX*x@<`|g*gV(+&ebf%~6->0IGqoBH0w5-pLiT%9$LZuVxr}$j zz;H>==>`QRC<+2jF!EuhX4dTR3?ar=A%N~Z)jsB(R!3>Kc=XVZ0Ed=9stJvy9LVkM zL#(xZj20Mnf7TXF1<@Az$|}8@t{A|pT`(+u-GJ$cR+iU_QzcXQ?D?wg@|)kzLQX1~*`si}Dum3H&r zzGE?H56mpLtKvw1+*Qnd1dJykN53K5P8prwnrR_MBp*7%oLzo3v0P13{BEo;g}U~X z-42~M!73T8^^`ofjguny__()VHSQ%HD#&KO5(zKg9qE7~^=$q}LHi}b7LUK&c`Ru} zj)2HRhM6@mWrWR_0asfOBw=(Q{l#8jn&ngIAUx3BKrWmA7E-Uq4$$C1tAhSgLQ4AS z4R3>(iTIi%yFwQf`7M7-Dtyy!*H(zDH5;YZX5n$(1xwTiZ5bR|jht0+x@|}9i5%+x zGN@L@qI1iWTg#L1xICB_0*=Ft{z88`k_S%X$CcB6w z4MAkXE|7u;k7xI@sV&V8YYyFqOVNr9p3C1$jugMV@XZ%pblbgfipEtC* zx-JYt$Qp2l*Ms0t`=f!MbC!HqQK|9!u8zWrP0;&ZbtGt4cm1jU75vMOhtoA&%8d(F zMNwV-j*n4|4r`>*wY3WoEj4wOocM!7%1uDaP0|Z9Na>pZhkJ#~w=`1FYZ3mz1s(-k zZkjg1!Jc)@*Qor-0LpSgzF@2W;q<1h6Pu3nZE)%hEcjb3IoO(+!cu$Eu`exa?Z7Gp z`plql9}S(#^pP*ch4z$nQTi;q^F=SF=MBp1sZn1uu8lt9u=khj)iE zdM?l)WS@69qj8jnJL!tu%)ITdg_^o#NrS(H+uanbzHf@yt1!Fgce=mmj?9vShJiAG zh9P?sf-C&KHvMZ9#X!%xx!0>CB7^LnAXebdpTxYHwjR$EiUDSbHhcO< zdB;g?a1KpK<f41SF(?}P?&z%S*S_l7=g`r8IO$0~aLPhLpzgDMlKgfRcsvPz- zC@uvT>}p2S(zUn-!l`UwNSO=#5}*#d^=}u{3NfdRyDL*t17B*42eiDfNCc!mgx;J` zjSOQV`K{-QN6?qn$Z9Fof9doIpLz99CrFqK4F*blG$k5utIxh~H|GH1$EHbXWYboM zdZb;UnK*cZydD!1dM&66AjubmaLOco&t-fxu;59N+MHO@cK$7-i1$|py_yrcwP{qLhp|d#yU;mR5{ON)L*KQ7D zX{hpf#`-6CL7t@eslcbm! z#q@~cxHTeFoYGua7N3XyOoWuU%ho*!(6Kz1se#1=sU4{P@6`v0uE&T00l>KW#Gwy& zLGgv~gl)T9uTkvd26^p$#Y;79@h1itQHcQXWmk8Qr{l{fhzn4Y%h8<7RaSUnAmj*# zga}&fBmcLO`%kAG^Ur?sIl?&77Udwb?2^KFa*D`-o&)E@(#Xhuaslac;Y5j%7&(lj z=$|T(_s#LA7yrxMNu{sCeoixw^LD1}3qW-gjHD<~`rkv1+)AN2Az>|f5 zWVI6~RQ4JAZez$*7b)Vjr9f+54Lrk`G9&eWUsN_|ZN6k+8m#MQ!7IiS-D%XDupM3) z)9(yNy18Nz*E0JXeinx_3*?;8-*JIKL^_};7n;H2{8*EwXp#V2|H6U1K<2-$Uor?N zl$$m?ksXS+?q)BY_*0#IooDCf<=I@w+}bM|-FrCq(URX2jsD&& zQnS@E4<9; z>6nN9&58KoPj9r|(Cbh&?v7W09WZ*$QmK~7-i68jyPXUn4=-4vy8|wVDu)*`O!_aV ztj3T0aW}PRJTBM#fKPS=HOj#sfC@F&!2>GsujBTI?&lRx+1eeZo*;>s$ub)WaK!bI z_U+{!n@^$a;F5=*b9BAiZM@Rv&HC-|G{o8}?0c%8p2_cQf#lBpj}EJC{bBJ%XMh32 z*)okx8ZI7NK2lB6_n#NX0-g|Hppx8wRktdPcqU9Fbhw*BB9>Xsni4`X{*Ap}B8H^b zw-2|@auE%f1bN;H8H)Kn&LJeXQiCuenl?=+3l5xIa}YL06eG>`t}yWRA@Cx zE3?pmloj|j@qpPkRIWs$c+&UOFSH_$q_|V8u9pi^UJfSxbrM<2JZ>e5utCp2b{rzNOKQiRA})`LKR5*ZuGc+!2L|v{+04Pe zzzBYLoZIU+e3=+VKp!qjr`l{#J`(pAb%=;3@u+%5|20u7tJ5LGF-j1Hh*dk+I&-NJ zAqkS^BJXK@W}yEtm1vW)%Z9bmQYTT0IqbKT{5ZWczR+X^v>sPupq^TKC%ZQYQm7TO zUx#Y4DixWl)snNu7yjr0rUKtJ`JWiJ`~PWd%=dLF<_qg5u;`3@J9r*?#Os9HY%7A7 zvY#*2syeumI4*ihI)5bKbdWgK<@rLX)MGf`T{yP1K{$xVQ}d)1y!UI1Aw|$e5c=^c zmeC6R7WhV%uRhToEGJSZpn8^JWidnsZobrl5QVsuoQiFCcubVv68w^jr480oe>> zaoudi!K(10XpDIr&;fb zs3NdL%J&nu{y)CnGAfR4TNjRy5G=TR;}9UYd*cp4g9LYnAdPF|8l2!7+@0XA!QI{6 zxs`p+KI827-tXfVV=$<$>Y8iLx#oH#+oE~rNWcY#W#`jx)5vyPd;2(P>!nr%2dqy$ zv(cR>RC0$T7U7EZI#2I2&9dF7b*dF|Kv}?1QHOUX*;uZ}SHOvj2n$PS<%ivJY&3%v zUL3s&fyK)l6o7kV%7#*|f19g%K>^?wkwn__WJc$P9}r=TN3@~8W^8_2bfKt!)zIq? znVM~Y5Z^nVgw@-n3aw#`p2bE{8o^haFH4lN7+k+eZF9tJX>=0&1cAW7!068xySm&j zVvF40OhoH=d4&-jAc>2^R-5NNq;dc4r+}*9AIdM_`sQKU_1oEc#pCBOZtkC9ONiw1 zjB?biYF_3g1+~3R$c~sMWNp|0tiKZwm0#W5^gd3Tf0;xq6bOJmBSOYg`P|lZ|JWXk zXkQ*q5CP+>I5b*MWB_67Tk*5=8~TV3)5Ws?%0ux75ip~61MTt=8shj@P5pr-@H!AJgp$&-6*p40x21^~wt zV(->^8H@;!j_>3b3nKv{ZG=h3{_>FJ-N_t_E&we9`?w383}asdW&!nf7x6i4CjD`! zxDzZ$3MQ#`$~?|%XdxH_L4L4+fGf%3X$S@bNgy-X7oHme!Rt>+Q6%j%7;Qi@^&6EX zOK=b-djL*C*RS$3wW+;`fI&hGvY_eBD(6pL4@w6m65V5xSpcI2XEKuZ_Rm&gYoDp_ zbfVf<*k)K|@ubpN3WGqK2?8#!Uis9RUGy1QpXLT%aFc-7buXaK4nro@#)6mdNpc-U zK&Lo&l`~Ah_G{fyS82<`c$*Ef$I}V0Q>}1*A&oL*ItR=!uw17fUG3q-ykt}8QO6^! zzOMIG#Jb$wV*+IWq>h7^pN!2}f6rHXQg^aU8d1dp=-c@m&M}jDG*%01igYM`h1C)# zUiK2acPz9!x~D%}tWitH6$EwNPo~aQ^*NwFz`(7CI>(E--Az!S^3=u-DVwUl=O6}B zV*3w^nTq3dq`m|y?1@~-;F#{v_h*6j#GH_4(DY*!(b-0iQ0dE-U`59}RF=G!Vw2J> zz<6%8vo}(h{Cx8{z2DKK^9CCIyHi|lwR=zvian#Ttjpa}ZE$d%CXq^w3LIXPIKTRw z7CXW;Liz^)-|~3_@_(y`4WX;`3~jN`LIQRZPrpo1=+DTC>_sD+L!L20nixvaL1QGN(p#P9Dm?_%k|$XH z4Y7gSna8KHLxV6ei<5(U*{>Cj-R3e$ySb6(C(BL57g!8_RD_5TE5>S%%ann5X~L^B zpx-vFyHv$VZ@#AU-?ul@Ddjc>{7AhRLsBE>^@@f2ZBMTV)v1_ZD+3oWRfxo6w`5M0xb8L>r zq62p^9LblG)zI_A}s&=&{<~87-R)*@QX92=<+?=%=`dNoV zqf9PNurph4dsh^-?T@ zfSh@ZL`X|oTF%{Hx1X|=X3^2oqwaz%rsJm>*2RXKSGW_om`eS!*)oOe1vrW$nAuK#q9qWH);Ys*LV|zDp>BCm{&`}vxS@OYJ6br=f>(TiZlq$9j;eCImA>k zTdHWj2A`w7v8T1`_c&_PO@KS{^!iW017*WKPa+wwOlVQH`0ncm`E5j86cij1aI1cU zQh|DFSXkNtNn>~oR6188UIv8kd?FBqA&$4d_zJfn<17Ir%8ZL}f=(5I-st3rY7mvh zyBwRpw%iib7sX$K)1@U(I9~(qLEP&ka3$E~S0cdQl1hkUYIVQDBWvmLi=J>aQ(35t+CGQ(|4Dy@~B5nYtSv@}A+JVQG>nPSZw z8z`p|rx8$Qy1nIo^3o9Ty7=dhrX!Tb_C%t+88FE($kIO8uG9(U+wuQMY+^!HZ91W_ zuc|(XhZavd{MQ50=n>fA#D1CDltj<=QS6Fk`vmxPVV!qKC?$WPQT!!_Iro@Qs`WO8 zz0~QKsj9CT&`ynIYXABcka7Dw(L^Ai!;33W0Y&S6v&3Ed1DR$#q z3s74nZ&tgJbGd%RT?~xCILAZ5p&lvFS>pB(@%G3Y0$kH(KF=FO{oFLYkfI8H*%`fO zRqEukxhtxv|9%u$91Os_NevpSsTGSqd_QDPhXO_Mm57)N9F_*szB^L-(OE2&FgQ)0 zr+uzp5iqzo3gpDTzuXP;e;+|@wdlSh!}n0NlX(IMK=Z{dO{mDjh~T`qLoP&FsE1uwrnumJ`XXMX36e7*(sEuFLrr&(4@g~? zow4{asLQY!?$NWe+KpPqT#vb35+_TYO&63}`yDq&l6i?{F1moeqzg(KEKKs*Vi^=w9FE7Y;2)Iu#`XS?OR_Kon=!(rQmyzNA978I zLgt@EG^kdBphPyXXd5$MZ|4X?@99lE2Si4ZA@qZ!K;!Ec7_VDEF~P1FV=5+kXWJ6q16)po6In7D-B#3%T` zoTVeBbStkkS-_G@6?YmQL}v47JelbE9Ml<0#Q{5SNyI`YdSmWp~vCx!<3Vg+g+?m$BA9yX>bqjxijd4 zj>inH)EX%#am)x2p{-@vQ(6%0m7ksxFmC9h@)Ex43NEY$4zDroyYX6QY;>}9<+Ya* z8+xx&>OR|Fy0{=Zq3d^DbzF5p%5MeiI$+iX^bqu9I(6faDdxPUtzj3uT&Ek|of&w6_qG3aHF=;>5L-2WB3fz#hFz@Z0no z7SVb}r-M!3Lyb0LOdS3cG4RFKVEB6{^AAY?;}SE_H9|C^SYxc1DOh{#Qn93T@^-FQ zHq~7dNeHAW--0f z(Ub~-=6s#+_+k(;@%lgw{<;KNU~{P$=N;1iL{%G(rIUq+w(fTG$vy!v%6t_AM-h?! zHs#w)TRc$=vYEr`NYoZE5mm;OY2)!E{h=F{beb^v=_An?>}07eAtyk=G6WBs|LC69 zlPcW7v9T-q!z6zcGIpqIz+-tNfG=E4s+=bi(fT$Je$8qnFW@l9;$?}NePlLT1Z8-D zcGB+b=OWMDks*291vu!!CEct*w<%B(WG<8F)fEVD70IqehDeQw#}Cg{Y5ap*k^dz1 zF0^~^Xg(i5>#KNzH}YtIItTK8As-=XGIV<=UNoeJO~e~MnDs*t;%>IQ=&f_7G2q7b z{ts37j}I_NPHvj-Z+5u2x5j}TP?q?LkLhyG>kuqjZ_HmW&tk>U9${M@B)9cXpXe#@ zZuh6?f`#3}h$4Z`Jk#!po6~MT42NB0=^mbI)ybuWl;|g#5HJl6RyGmg>z#d-(_xhU zT4cP~&I7~vekK9ymAjCnBLd(=>iKplnp02stk%Lxz_h^WWFru0b2D^~@Z4e~Yy_0) z`fF^KTM_C=iFU{5-T{*-G_q-{-4DUG6Sph12H2{lPuST($ni+!;=~-2r5Y*|3#@NL z3j@2{1k;ITt6nlt#-ongvFD7*%ax?qI%Qie&nGBbEt1g z9{V5?AgDLrl#;_dQBINcXOi}AJZr-T9IvP|9YX=dS4%hUWoz$SEN(zp7Ws= zY3j;p_Ts-6F?Q1&2`LxW) z*J|D&2ils7Qopf6Z8|$d9C4hPrzSXnP5rJHvNnNvnq~xF7D#*ppzKtkC>UhtL#7!Q zow>3IIr1r**C%Z=HZiPPA%t54NpGExm(Z!&TOi0?uDzD{N017)rM8UB?&7%Fh>Ed1 zBV|-Z=Et9(Lwz66XPS%9k*pGwz0^LyhzinaWYQaR!a4R_QWa4>Z&AptNOpPNlwob_pO@Ux38qd_e^=Gfk5GP8ko!F5>$p;$}c zn5D#V0O0!CQLiXMk!^BXt|loBn`zx?hSY;c*uQ2EpyXd(RJ##1sO2APF6x)Zi-9W9;36~AT^iN(Bq9W}P_22`( zhWtvfr1*alB#;rh?|eC|)YY;GwIMgyPV${jt9-7FoY;%^*BJ6dlHIx+;(KZ6^MS(6 zjyO)3BFgi+?hVMwU-zc;-E<}t%thH`Xx=WjoV=1$oSN{xt79i@%2to|70NQ3r{wOt zqC;g<9X2{5>gSz7GTI&Hk}0u?d5E%=Nu#9*bP0=hw4O$`AT~Du8HPad^ha-~SwBUl zaneVx0)|o+(33wmfD(t!#u_oot*lfr%0A!28eh)_er4@;I+A*mH6Nw?C45$oY{$^F zq{!kusc0p+?cT&7(0!VkSII27->v_^L0HT-<&4HTOEcQMKc6~C(nmjg?GD~o3U8$lvP1ZqoKW#tBHbeK>*Mj|sUXfXx)K+Q|kMQ|oGyN(h=X;Rc$LSwc40YyP@Jb(ld#zME!4?!P zRLCNbOU9@xm8jW!33$Es(}n~KNt2lYdd69zzdig%;Fm*3vd?rn*FHtOSu#}U^?nFl zfe1*xHlY_FRM32)8O7zdFFyRSXoHE$W|FVGLk-hPksTKDez_$Or{o+o5Oibj+m_8j z6h7~38jL>JdY=!69RLQ4yF|o3840!#&DI;i#(&bK$bB1Vm@@yW;Uz(&avL~vxe4cP zt9YWzeXIM$p)hv5$YVyqN`iKfIW(9;@z7-q@>@Z1W;B)#_IatEZPKpd6ZAV_l_cu| zAM2EsGWZf=MeT5HIzP#>{Rzbb-nfHYKKV;omGG6L_WK12IJ_L`6e(ZLz1Cd^@U=6W z5~^a}0N;fN1I#8J>XOf0Xnddq*bFA7T%}A45Q~XJVnHS3Hz#nKS7?)y?TRRo?j_)K zB(F3aAQ{JlcP*FCiBND?Az=IWnsML4TNIBFN+(M5Eiu}3s359VWlKZL|9r_N(Fd;fz~3B-R$*sHgIX;(XWNu9>>jXVEOFO}5+$~iG`YU# zJaCLRd$C)hb#P2UEKx=&EWT)ra_R5Bk_40)z;WYyfT1{o25R@>Z^1F2_9s8HVJ(3! z%3|;&!PH`T&Nd#pVxETLtX|~}j^r=^MM4|@HPdDxzv{%t+Y2(EG~Jz^dna>(bdYLp z-cG2k`EGAx5K4iBIlXItQdL#ep2l;dXJGMmXZB-(R%Y|z9MF;exO8-@t0_)`MJDov zP>QCqQkYC%GF#mZA8^=yj|e|%x&hd^Pp1Uz5}v)uYVaLq{&5b&m)dyRL-XU62Dd|R z-$O_|AM4ka@n|aX!TWb)>~E^KcF8M$p1`HJ65R)RDAzLmtg)X#z5GOE|rJ9cZ@{l;D3{tF`G$qNSI)dsWFdLacbb`I5KH5a%6D7YOzya^Upk9c=QytqrO% ziY5f&MqnsfO=OfB5E(DQ!(APTPY1PrI5n3j~ue&J;vjMWBEA0|r;BU#(;TJ2A^ zFaqYn3?k-wcBriusfh|VEb#QwYu&q2V! zrGz$SHguj-9rUSsHekCIs|04HXxtQKOiRkHqt4C zR1{3p*rkdT7L(6T(l0|1jLlJ+L(Due=+?mxjJ9Y4zT+(SrY8JxI0P5Q7O3!_ebGSxX;b<8^c-(t&@C6Sy5KCNE0KA-sZkmmdWF zl$1v_@2=n!QP`20zx@&1b7^)}*nn|4S80_$$z;)@eaFDemVDJnKCcO1!Jb}>eMxX| zA$u9N`D37sylg1vn?Jil;H6NPO*7?V07sclw%1A-TUI7;_je=nr}x0-WjSz!G#*uA z8*B@9d=ZjK)8l5F0a!?l)_E+_^GDc<1nYllmE|!Qi$Z5D*s>0tGztU(BcwP!mULdv zPc%b4H6?jaQ}t_@^a?T~;?4F*E@iii&HiAqtAlS>^Ijdi`C6k^JXcZkptSYM0Iigo z=i-MPwCtcJeEs=elps=z5RE@(=u2V~xk2GLZx42-cjpV!JX;p2PzgU{5H8f9bvtz4 z%i)pAtT+*`1uQmHX3HUIr%`n`+wTm}Xuh83Ri=S-I%cn*`bJtHUVTXidJH?VV!Yrq)D#z_vqvP=+z|CCe&a%85u(?p8%HsFTmyua#TV*)fF(002Z z1yu)~Tv^Phfkb}>iih96Ed~UX2x)}xyK~9s1JuVw zN0XtSk;*2c(jlMzIM57rdC{rnyed*D{V)x>mq`jfH!1Y76XoHFdy|SZ5nt z5Z#D;_^S*R>44IF;1$!4WN9*PR)QS{tw4YVhagtWk<&Li)DU`l_s68g+}gCTfnc=t zZIEzROmy4Wwx87Z;{Hvy5{240oy-1P*CZXe*L2gz>G|)a*|@ zAyDM;-5jS=1%JfbuY{NXkLZ3G9?H30*I=Cn-GFhleznfKf35k zl&dDK>o~IG)_r6a1$S0bmA6P<6=52lNDXUvrEo2tuK)^|A z7iEnsBzCFM0d~Rp&?hY%snPl9wA<{xOcE2UC5@oc=)BT3avGa6>6<-*y#*0sjq9r` z(V1myG^E`5?}j%&>GX3^Zc$+*U~Z8r7F!9vcYfVxyy6GAiw7JCauo*BJrn65Er17C zO1J=5k*Pj%rkpR@Tq;wje;%%XL`P`*sp9VPj0HHb4}i7z&5?fCa83fj7CQWy(~!HGNfg zNQb#dQk6JMd1q@TFnIYP_#=}nehbslzCxRF_}^Fnmcf9l!b8$DRy+Mg$f;nZtNOEI z+wqJ{J+a1&*SQS1CCelE)>Hn1;Ma^|FO_SNP~-s}kVjgQbh zxfz0=&T&Af+G@!P4->5hai1Gw5mf1O5JJL{rty#lH9e2Z$83i$j=AR`vMlnX?Nozi zoCX?tomMIHG}G13ZzOZaHQ8tp3iB$u?>WW3&g#az2Zc-1`sYceDa{~HgaKA$1Qny` zx;pTTxf0JRwth9%gK97IisX0;yrvRL#lbx-T!u4=Q2XNILCseE66&Ri+l|oCc=F;M z3S(f220sDa2)WnGb_oyKmo4!E{kaL@=?0%aknU+j09)h-sLzG*)yBqR+~7|q22`V# z^9^)|CWw|UsIvyX`9wDtXxvLA*={&*)L3m+ZgS#@NQx>Oy=XWPcK!N(d{WCZQKT~( zZHs)vGQGXQm?xfd#LgCg{eBh&54ST{->o)R4Zjme{9gNAcu1xYkPjXFqLy|mPqjzf zb5<$0J-(68tSuv1q*T~^se~Yxdp({_Rmsnw+d|n!YDWVoI2NfEXLzm5jRa+h4N;Qt z_s3A6=F7$X{taB;)dMXBU}@{!_=vbXY?lubY*Nrsx9aaaD^0d~<%ucmpW0IAY!7c~_Hbo>XwZW+iwv1kxg6x&#w%oB zWqTJ7PWzK1uDkj$#c^dWDR@PI0hOGBBYh+GukpK-S2`}L{3a>xM!xMYNT@Wq54o(TqB&C{h+o2jT)f`CqPQ2bl{W^Qd zof6=%`G;BPRE!;G9=y9|=+m-A-#pp1dN_QMRAO+o3O`KJf%S|b(u4AqovlwvGkxb; zarYFlzc|~VLPaMPBd`DX(NbI=pFA0D5n%|T*ix@_H<6`dNt-3K5x)mJyv(mQqjDWb3zkFwuqTiuDwLP^XgCcY2L3C4u zYYi$!SmzD)j#`1Z?u0ejpYg7b-jKREF1cUaA%&B=3aqqYFVZOVGU0m?*Ox*`nZ8-j zEeFl4y5o%enBgQY)V7$0jxS`?oMyJ1?4JO5*57p>Opml|w_pwzumVsp%un@40n4M6&cgvl#^i7>k&{s=^5K zV3`Z-{*2yzif>`A^~gtfU2Onp>yQdzcp~h6HsZl3QC+dk3-2`>xP}`JWHyO3PU<&- zE8RWi;O!H-wHiC5s+HMbnMHU0dVIy+_H=*GcpV9>1}`l2z`{`X;0A9`Ray)V0c&$o zD@%a`0_7gobc&pZ6o->^9|xDkpwa7W2cr?TR_8;7r@PWfQBApUqs%A-NTNx7pV=5)Y(Rg}l9YziZU66@phLoq6i* z0(yVqPjfxsLY`)J5T1FkrtL)iFMv@_vZykfBdT836w71l2ZcLlz(N%unpL<^;}T{j zRH{@3N~DO*Bq$I9C#!+pg)!dg!LP}pzwjH=a|J{q@?8pC@UKAVr+-IYB>5(*(2=Q) zSgz#!^f+;vI{6F!(sm;!b0yYo1rGt>ue;mQk5~u@yl3N1px=!r_#8H*CfAlR$@oOQfCPix`K1{K zZQ@JHw9J}aTe((jOEQhz4^k0L$s?5@08)MGfC>QBvP#q77J`>9vAq)7-Vixm`DDk& z=9E0sbchOs$hpk6ed^9sj;1i1WcZv5D7|l}w!KuLDu5?VpVc3rzXe5KJs&zfiAVgb zF)Lo#6qiRG6R?M$%J2fcVMV)3KP?T-!TNn7aXDGHOT|FxL=)f*2jlwz`>F)~m-54< z3Ev3|<_W?VtTm9BD4EDNQ1dmxv_4wf>GI$d=!FINn9I>r4mR_DAnS<%eSL-ydq-IP z%hIg2iC&B(+XVx90zyJP3+c0-72Wz>*l!8~Djy!1VK7jijK+T9)BV-H`!|08fM?Re zu&#l=tCSPYV2*Q){6XF_>g0D(sUp+w4#Ct52=&A~-fx9}jr3X+Jf->H#Fl^mH#F|= zcJUe6hD_{NbGgffl`^FlP_usCTjpCczI18U0Y`-`FEKlu=+ z5VDLKhYC$@qFR>s2e1#dU_M?a++g*OA17{@m?uM?msxVfu*Xppz^qxr1#U$D`Sh== zP``b-yx19ax!6WZ8kJFp7XShSHyWQTOo9VMsfx77 ze-bi))%gyP#-QF0d{=&DUe?>q=xoNj%OvU_in!3AU^mmKt*EZU3EF8L{PGH$=K&b& z-72XSMXSCm2c8@S<8S1K{3CJ|KDY}BhS~#KRai{0(>_ztM{btxO|G3~>cb>7b>vy> zH4`KQu@L*^U&2#%*>m55q0DRvzM^42i~e^ocn*Ff7tbHD<=!7@z2W!pm4$*JzX#J}DZ zOh(%j2L0Dv-eUcI@}mFyf~0>hDBupoVQ|%3d-yW)ATd`Mp(+5e5Bg{9Q@kmD zSEI%G{+Xs~Rb(Wqyu3W>1LezCvRn+ZEZb<28++*YvqYl&ol=KW24|YCI|yE}3DVTd zLxUYeFM%30RloN+Z^twTMuV^V|0A?WCP+yX$FL*yR4BMsUvQskSXK@0@=h7YU%meL zQE5R^c)+hi6zhSVq~~{|TPlCfU~r0cXtcWzY%#~k53ifZy|8S+xK_v)#@5jh15||J zK(;iYgltLqW=#yd(e?cc3oINxealQQJ3q?JBh^4nJ9`=BA0Dx z%1(6x2tHJ!?s^7R6dE7msvum>u`QXE!$q{%);(kCANxFB_2n)DB32 z0v4nN-uEy2xBl`C`la+R&EEop+iVWCPgx_l;ofMeD=B z+p`Tai0W=5q0A?_pIgD zH^1npWFvW`Fx-byk>hWyf1lrV+Kil)jKf71)rdE{oPD#gVWbHH*nqXtf=GwhWEs$1 z#-Fd8Apc15x_;iJ)kDMp-K+yZjgSl9A20E6E^@w08AkY4b)pNtyBt4k=d;>)y^>Xf z!eOm7J2xi@{zCY-*qZ&#Yjpp}Ya|n(j4Mb5SM$C3C&WK2#vmkF7deEw~ffg-pwTM^Bw!K|(hZU?A7b{E^S<#n+?eqeGt9g;*3oQ5bp zV}l+06r7{NVxVrW5yB;!Yys5t8jXm{%ls0_tZ>aORG`{eW&a2$zvm+i{d|3fZKm(; zat(TxhsmbvRijfPi!&)2IW*EzgPF{Fu^w%_^=0*S1OeYi@gQ}au`=ZK-pHGU^|?_i zltY6q!Lnm*RC>*7k_VI-{uwEkk~;ybKgt{br6cxtm+lqpT~@~U`1JOh5hl|0_4S&y zbhGCZ9)Pk5C@Dcgqm+W7BWwD7I%h_F+v?);%FC-O7@cad*Es9}pdWM{GaoleEo@yM zEx0^wBcV~qe1L_8t?IeHKH^zyc0!NG!jed0&YgYk3F6u@ZCh&q$X!AVdRA5x7p5-m zkGH5@e4kOE_b=C_Z;C^#LmA2yD*o!P13&2a6kjml-n~8iXxR-2upb|*Vqji)Sm^G! zHE69C6})t^oIq9}`-@2|79(6$GZ8gpV!))X!Z$3z2*Rk-j3L(nd^enH{NFIidn*}BDZ0R3(*3Os zu)zUjcR+^z>Fxh`oA zRi*#hcO{vK{Yi`5pUQX$r{HUT1pof`onvjwxk^mnYxMzQ0YF}c0ztesoWh~rV9qvO zsvYze7I~m*sze#T!C^=2!dSM#bx>8S!Ctgyw%82)sbjmP)@mV;#bk8tsL5F(mK(F^ zOKBKT?hdf~m2`DA1jn;Q6T)|QD-0@6fzycKWVRx*W3Q-5`|-$gyinleE8DR!rgHCb zm&xc}#&WhEH;t!OJk$4150fHfwU^#E}h!-!VBZf z2Owqvk7=B><2;UthR+T={Zu-bF=4U2ky&=J#`PXM5zl0 zCBur3UzgPn-?Me*_$yBDS?9FCKD)pZLKWNook^nl!#bp^<+aXDn|VTR*t`O#sMPKHATnc?CcLf&6o%Gcml2f zw+y<$3~AgMfFT0&_JZ@t8X#DGYwoy`)*7vm4j>A5YX%w!Yc^vsUj36l%31EksP9qr1Idoh z`MKHfn2^)ugU!>^89&LZ@hq|K!q{FwKKStt!4$|ZMEst`gWDk}LO=bYhZh^{_0F>1 z`AGcw{)7n#EVbK_=(L>2noJ+s&mSV}jEawL{ht5*14jHTw3(|P47$lgHF;M z0ht?~x7USC_a|?Grbb=END>cm*`rS8_hCGBVC4YpRZ#T4Qg>*GxQw*?)|DhVAUWoL zZS}R^xWh!d#+d&5@jTgRDvz3+tC;mFhxM{BpsQ9sW)i>Lsq)Ly0N|qI9W7MD$6cH2 z>Cu?s&I`%Rl&(Ml3Dk|fKPJG9)Pij-zWmCfD(3~bGofv{7g+|__|;}pZ)(iH{8{n) zh>`A!U@N_Eu#xGRHlN6CkcXl|4{|#l(<2QfI%cT6vnSix2E01Fg6|^;))+X?lY#@* z>;Nc2eSLV;2U|c_z}ICTi(VsS33Agp&&_?j*bp?wk_WV***s;y81}y!s%Kmn#NgfL z28Z9fq-|~07u9jfo(s56RS~Enm1T*Ty$-i&CK;=97XYV?vmz%YIV5AL#Tj{PKn)|M z#{35@4zCN!@lsomYRNowNu|mdDeU4Jtts2?k1?mqY1C{$$=4cip%Mkab#6pqDZ8yq z)OWudz`WabAkh34XpqipM7uqbMpZkM7k&`UtHJ!Y%NbMOQ5-cYs6sKKcj>Im`jaoW z+n>9UAp{8RQGK5s!u=D)CXL0}RId+6S)Qi=b_*nsT1#K#>>)t+6#b##`;r@{{U-H9 zj%4_ray~R|DN6+(NUKto&dwZatfrHklMZ2nDZn!qCpBhxzkKzQN#|E?G_+047IT9a z-<|ta#}M@v`bV$*vB53>?FvG}2P^j@1u(|n(xA}pTcF$&|A}3$tL9)v+6{#5`0ReS z+T_S2l|Wxcl{HnQDmt7zb%u#`dQB7>ip>a5>fr1k^kYDUe5uBxSB^O;$)?Teg7VCr z6WJjeE`i6HL1U4e<>~0K0&+vtFcXP3?pga5@Z+K-eXq^!EY|z+$nK@xgVkag4Oqb# zW&QUxznH8aVTN?e6-FG0*8P)f%t1nrx2DrsxzEewSsXS??^_IHDu#dZ@lb~0hbC6& z57Yx$p3J~9BWRuB-&laTEUrK97s5O9=cHfImvm@?I*^1zr@Vj=_N%COyJy7vXsbpM@*j3T)cuD9_ z%Lb&Iu81Xw0*M!Yj!ZP7TB%lN|DSxtd{tS;<1x7r$n)d7eGapTeHFR`uZ7;}kJya5 z!qo-i(Uh{Z4LAMDfEdTP!R4`8HdV2B1d-p;@AgC z0C;<;$q_s?@MCj@$8j&hSQanSu^+ASEUrw6kUoV?^bcjY|L!~Ip|my>Y4?O|owVe> zM5b&PkYv}v%rCNWDUk_t7bGeZwYl=ZrjO_oy?!T^1|0bAPv@Ajcx>RV5AlF-Y!%AZ zP!e;;)z{=tD@o}q7F`j9bSRRPN!ye>^L{jSJ{FQ}_A8mckfbo^eZO02zB>y$=lker z-&3CHS3c>?1&EFpLw5xXqzYmGyYKf&7y2Cql}qA91?s{NL6{@n5V?sw8tuGP&gEY! zC6qJ;K$9HjFdH*^a%E9*XF3zlpaKtsB}_2<@oWP^$wD<|idD~LVZoP*tXWIImZAqR zLR8EG+YP0$d}ZF5ciN@C_W!f$(-%z^6lb3c^whIxR58+#(b=m92XsR4c`agfwefK) zSi>pV?g3IUMg>z!G2XRiOYkj_D?~#-pp!>?xIPhYs5Gi@8`dn=Xi~M56ai^AS$hz0 z*@IJerLh@f&N)|%2FL5tOL!Lmq*VaSOp&(Qp?!!iyVV5D9Rd~_pb;sJjkvoaUv9pX zM+g)$A4ju4`rYS7)LPZ*&>hR=X2sO2z#vjozVDZx(I_QI>X{Q&GWCsu_hW{zsTE$e zJX~U)ml!cv&s7T@^3O-foEUBE19Q^=@C6Ug0nHaN4z~v}NN!OpX@mok~rQalJhXr=opjRpdE5hPZ zLZ0;z>)vLf*p&pd&*IGQp0L-$Ydk4|%C>Iod^FD%SEdekvI0xuv_CmpVTB+S&yY=( z1=tN>yb(u>Yx}0BeQ!H}F%v?<{${@0G? zYToI~FD1A%?&?@)@QH4j=Udx{5$$5_iZ7*Jd*_&r2jloEv})j{=`dBXcoQce>>4hx z%O{+f^wq_&L7Klj$tH_+Fk2wIlfjV7ig%Kf-JyWj4PDN`)S#N_QYH(tu|yfwH-qM0 zNwA%NN~qS$%WFI{N33$h6X;Ic$j3HPxY=KI9DwK96o7^Zlj2&Th4D z3C4ekb4-3NNchZ~5UrYbGLpy+cNV_y+rZFxvri}Ix35BLP`_iE+GeYWI-Xu3HEHwT zW6jlntu;VHT`&`*|Mlun&ks0DfX?cdF1k{nha{6SbOwTKp5Jf-a*Cwa6#c|3n>elp z$yVWbjcE8ss~q?JvH42AKR6XZ75UWHB9O==N5J_raLN1G)`>U*5c~?U>I-Ay?o8_c zK_>n^?EDg?1!DtBcR<_g;))P#P#wSV%|CL^fxpV6bEF;B`D7XMAqiI0Wxm>)5KO>I zLLzu5H1Bo&@ok0a**XdMvfVG}_LNkxrz{u;soeQD&{l5FX@me$K2$U`2F6--*4pDa zirF^bk0AA&$fCbg>ANY(&$5XSdK=uPr1}HNkK5B6_PcH{^pMm4;6U8u$z+w83t2-9_iQ%U}sFKmZe(>&A=#D5-Sc*(3@15Z|vs;7nja;nj zU5|?e*l|DStS_FT%2NcN<$E*uJ(XJ|mV82dkbHZl5uIwg^BS*W>DG3i>CYc3ae{k| z7+Ct%PRECP5-Hp@)R9S`ENljyuF7tNuFwK5GKtB8jAqki%QE zH_|CcNq6pxwbxqj^FI6kZTn5ekvp&ZywBq}f5#r^fFYFH3--y^UNAJ0Zcm}bBlYd- z6Ox@t%u6Z8@@p`T7i;JvCQ56yz|-+Q?I*Tfe@(bMIy=TiEA-(_49$@{^I)a`i)-OR zu23wUdpYGv-pvl_zVOmx!TFHQKM%9bfBY`~uzab}cl^?pw;)7OmlDhwv|+1Y&*qfx z0xuKOj@?z7oqN0IWT}P#U>u|U)!F8DYB#O<#e3f3_jp!V$Xu;ZD;|otizLe@{|_(D z4?Do{1>(sw-0vwPR5XX0xfb@7I07{ep<<886ia?P!>QwH=4aeD;F(QsFLcJOwCdf^ zM+=qdrk$JI{!ZGeS}{~zufHkLdWb_8i5Z99xk$?ILby3r*xkQ5w%>J!&gdJlRfY2; zY^p;xp3QWf*{MzqmlHgVUerxi|8)orj=+EN0ue&vOgei{=AQ48+7Vx{gpV1$SZX@k zY5S{NuTrL?A?SUp*ClZ^KQJMQsG*)B4$DKY_nLSbh6r)N_-j0H$}I`II^IPCHfrc~ z1E?x9MEngLGuW*W37^=wk_Fr5C!PdmhP;1NJX>$y)*kv%w2g7Wd;e2FT`-mo;PH{{bsCLI-BoAHZBYf)!Hr}E&+_VS2+gx8pN>a_MwR({>YjFUxe zy>xLG?{T3rIVLV-0$yZHwmpP3qCHkfX?p461?3099OwP%nAxdg_uQYG#dy5|!wS@A z>w{8YZ2R}#Vv9e^NfGtcM+%|N*|WVM8DalhFc&Ec4WvS-SLs*#SW~jSe=FoIf4LP- z^K5Nzo69Do3w=9hw;p%*GAcbsD;8R@S%5>;=(AQ*6Otnn!(C8`Lkp!`dhB(w@oJMP z(oMAoOsJ zEA@7!!CRS^Zzfm0XC*+UB)wY(Bobit;SXUR`;an?RikS-*KXT`cC;y-LJ~Jmra(=i z7p_`&oH-M#=avieergy@N_7jI?)IA0>b&)YEX{9JfV(&fRT25O~Y-Bi-LQ>&7h_ILa8<-wD*rr ztqGsa#0X?$X>j?g1QhWbo7m}(>-lx9%|wD`xI)xqN4SjFY>hpg8)9fj8!@pWj%T#t64WwmK)5vxiN)!7tYJcGj^}*2jl3c?`Lqco}VotrB8V@O=o0O8aSI zww;{V=c|HH-=u_$EK0x#e5eq`f!He9+A@iZ`5rfyGc$qqcD;!VFHedOkmx-)6jL+td9bMp3| z@04_w5VyD)g~x2rcExzEFJ-gtA-S0^8IxE-?FHOSiXsH0q8!Isl;xwsxBMh48CJ>P zs1*+Vs7hq2bXgYkRe#eI+Fisp)o710S&FJq1AId-H^<76|LUHn^Bt|r3)vhMM5$Ek zOi=oMdEULyS&$qVY&NF#q+T-p6!m;xY>T;un@_zpH?+#A?U9w%7mRmn{Ra|qZFdQH z2=f2P3b)!we!=jn5EoH@-Ae1Dbr$-+j~E0wCv78Tp>n$Msm?WbgmXp%W)5M$H*081 zCW?aN>6GPY7ZJfnG&0rhd%`tV({kUAB6rz(tx`_=E~R+f-J4InUq-t~Nf zem>z{+hdcG*7p{7{MS;GQBAeabQQ?#jWlB_*RMBF2B8osD29t`h^rsCTWWO50j9@< zYO!pUEk<%5vnm{%Kv^O{(?RKAs`M3ZM36AzzAB>0EVUOzz)X7o|4eB?B z6^2=-a?dx(*4Toi-6~l}s^O0CA|(|h6&mB;l(**H2{5xv z!nkG1vOaV;@4qIHJs5}=C@f;Ew;K}+iYxN@Y`=5O%Q~O7+1^!4_;S`wbd*|_)$Zpf zN^73dWwY?ZD#@dhv-}SnVO-t$VR%lrs?=Z*Gk;^Ox``fx#QWm;uTDUF82;qs4AKlQR%x=rdYRGMp%v23Dw!nGt#`Nv9w+#750JI5L$0nB-4A3lVFd4Zg|)d^@I(BRVt^p z>I=W;TGtrRUQwjrkXQPR^sy7E90gPk;8)6p)L3_0nlljDGf6b-)V^h!r!C6sgIl%z zkdzR#++H70#kcSv#2%R!sHeJj?WpxB@FH{97(Mbv*g#amB}WXl#`8Z5d-XY=?ac=E zC>Y-s93k$LJ}wusN+D})npCAY`LC5bWMa(%*ss6T`WX{TWb)SrBXQd=i2wc~yFpm~ zr%m$HT0N-hz($YO!+$NGXeA65Wlug+2h#(%ASvm-)nfjb(uq=KjY~EOq`<{N-3oNv zHcP15GNz9E?etnP5}LW~7RB@Ro|3%;FPSo|-9NYYy_#QjzAgIHMIN74A8m@sz;)I; z@i~RvJ_!|KT^rxENKqy=?qc(H1EMmiT}3`-`y2K5UD9E{_j5P5Hc+szd3TK)M#E35 zofEhj>wLY?{Qe4T@4FBhMR=d>nf~}~{ndSs+(I!u5-18I_~dR@`kK}~17rp>>8 zin`W=zz>_+;XD;zhz)!BSY8ZHw@#rZy36L27_=0JRs4$S3rwqZ(>rTXCYJp(D*>9l_nIt+4x z)WS$Oi&!?RUAK8q*GNB7l0Er=!^EC78v=8=tYM(nsG^ojV5BM@ugPY7Q-btVxXR_vpuTp0dcEC9yquSQij)x{ znAjbBZL;|1^3)+~I_f2ydU zSd8n~An)VxRaqwEE^;D|v;iI^+JT_cR!v?rvJa|gBd7IngBrMGGx%QfGs!xxu9poL zT4Jg^=I%;fP5;ZG+$B|roV$<5ltdsdBWd8CoWs80ghOlEwn76ZWx$3?hatWwPH+z< zev5d7CRRDb&>6ozWUOc>R}D=skvcZys2o4~x0oX;gUb5-b+wy*hOn>Bw@#PQ(LvLW z=(=C;3=ORdyW>6sf5FeQ?0KSd0Vx9O+#6)`F+S43Nh;MyTjL4I z3Q&643jj^a%%|q%w1aPHJr6>v_UUoTfNmYOJuZJYgM~G(K^?e$jY;p7U?8vb9F2C_ zk5@b--TC{$%*~nrBO0#y({jC3TYS!Q->>=0DJdYb5^x!uBGEWml88?ZAKtcH9^*A- zmTiCYxnM+O)Z`{zy~2B$tnpbh)GOMFZ*d5`#3`4c*_!*Tc1KD6)!~vXl7WoujWNv~ zL(I1r2}a+D!k>^lLMiWh*6ccrBbl3pqMJylBzPCKCGQF+hfMK{X{ zB)DY;)H*GPyUIK(&VAHBPDG8ULJQ}N=rIRT*~4OrSKoxu9~d@xMIA%UBZ#8eY?Jzb zCcJ3LOJfh0jgyM>OMfz^T*j z`D0-4?yqk1=@AZ>_FEse(y-634ok^8Vle{V_Pz~lFx2W7 z6_Nk-F+-NH--oXUE4^2i1IT}xYPr;WANt?bdr*9G_DbPjA?8Y5M}eD~T}C&=4)EOG zRxNjj6OA#il=Kt)A9>pyNvo0L-LaM3RD}w~Ya{N2oA(dtHA?cPEP&fxc+bUZ>~`ra zYjMFa3|@r`Z;`2eAIgxCnk6URb%p6fPW$rC%6QBQ~VP^GbN31v3V&u0@{Fp)=GUW3zbtM_UUSlFLSl*%>mGjcue{ zv6l>ZRHttTCvkL&K`E0X=1!qOD4CBE z>Z0*DG$~amZprSVd^w`L4P%dqZiRTB#hn4hCnXU5Hm!RG(tlC%{klwLXO!#YjN>OC zJ=ShEu6!I7i{PKLlf~!yA>zMm!hE0~5`f`GAH(uxcdykCeSA1|&+y|kk7&7GYt*VG z%Xa=ySg4VS^}}1buM+-Q!JRBPJkEbCtem0DcP*Ovad3;@lIVTgpKTfb{Ycwd?H#j@QP3}{a)r=Z zIF^|DEfM9X%px){3(4C}NV?+7OTPL&aoMv**V7?O8bxT4j;h%0XuM)1y>jrhd}bz$yM>${~@j+reE|A(4o+M#hY;W^^d>?=a6p&uY) zx!uw7jBarq{Kbxc0Rp|c{L5$lM=y-nq^rua8I}W8oAxQx+5s3cm?0^e<;Hha;J<$7$)R>nsLl*F0^q(FeK)#*{{V0 za7f6q^NLx_#Zaxg>@RPkbpC7V@_+s?sVB(k-2w$kQ{zas^m~k_Wi$)fjRNwQDbVY} z$MS7L*-(W4*1+ehYfFfc{zHvO5#MWiF685L$w)#p2Ue&?LDY$>Ow-|V_n3R;H8e@08}#1fmp#q;!JGQ++r5RBKwv6^!r=SQlyC2j)C%hF^+RCo3Eup) z2&^d2W$(V^Tnbyf`_^%av6A9Y@w0_1(WG>-fw+ z0%&(=#j4$RERU8$;0rBx4?w(_B*4|g&^SxQ^9>z8+L?C8I={rDk;j)nlJC1)C@IcOA=Jl8~(TH)%uf@nUUs^S*@VCPS@$N66l%`9;Z~5RJtRM36Fr+&E@o2tMFz^eaTplgX@cPkB*1uhB%gOClX_1oz5I3%I z-7>uRn_W@$s71j=QElK$5xs3r#s6l=$jXlW6hZ9T+ zsmoNG=mF7R44u|y(19%Y@We(V`6s0}Cy<1n+!H)P-+z?JWPEaYhL-x(Loww8Xp-gH zc5};Mv4D}23xSqQ@h2loK_E2a$K(PU_js-g^?$qo`T_`}TfsK$k=$;jrOhLPBEXRl ze#hVIjlgOE1OsGXOEqI|-PZH^a3z2twtDFr%i{1#A%z_WyvBa7Xme}*P0#A*N0$tN z8G`eHpV>%CB=<_1E&r^_%t>iORxOTr%*gr(A_ddw>L)r4XKXI+W;KapwNWlpo z0w*vqoxX|Qv6?Q0nD{$?3dLjWI$c|=q7(7EhEI~&59f)IsTZpY%g{~&0QfS97{5H- ziaxehyTfI${BE+7XYFydOEy}d6lOV;y}ED{YBgCzE|*9j^2X24V)lb^u)jyM($^OV z-MYUWfDyP4o&-~;yV1b$g3J~oJE#QU(>U)=#}Ae#&o2nVHULuP%>M*6 zYD#-5i>@mWsWgadzsSKP7ZU$-TGqLr&23xWkJJ6ox1+KxK`j|#YDNXsHfiMGq4h!c zN$2=8X!;|8$dQa6iy@va-m}iFowih`8UlFJ;;E`MSQEXB>U$ZAh5|Rz)T*%cgV0M} z{~ILdu#L#+Bd3!~bY4v2Pjn6r3+M8Tj2d&decb@pXcq1H^?9s2@7vL1))$DbAqR{c z4iK3Vwe~Su7A$u+A>%h-eGAwRd0@YoD*SATyF;bdI{}oR-yDa*b#9=Rn8KYSP4Q?sWMY( ziQWBkrZXCG^rtT>2yJD%MKHa7H^GWbO?)Wp8RBYGRtKHqPx!pj7!!YYf zkX4lj7-KkS<;iAR*OjKyBqqWX1dsx$x`Rs1dt<~{K?DGPZ_=w5PWE{24O*0kG4r zn=CZUWRfTIs6LQ$n#kR5@SAWFj~9m>Z;qMlexQ*_;za9Bd=+LUi(|UQUl{E5=jE3(m{I_@4<0w>#nb3v>hJ7A zqe@ek;q$cQxIJ!4$_KzC z602^SHAL?ah6px`x3KvQY)i4M#*Y#h4RA*gPbd`E1w|Y;=m9sG&eiwgXkDrow`a|O z81i?aHqeYzukoECbWHLY0cfFyxt`59Ke*!kk}V`LA%_>kB+Z>Cn~9BrK`xf}Gd7lG z$oj+d&Lf`EvN3w}GL-&$~Vn5ai3@Cd(k)tcuSw za$V>Xm^G2;l(G}O3*>W;V$z(W-GuxSOgh2?k`#%1nv~(l03~b z{Okr(cv&#Wg&A!Fobv&k@X`(sP-qU-%FFZb$2%fWtzhG`V|Zxarh{sJfmI`vZIv#^ zbXK!!&&Ewx#+$vBBwN@I_8|zZ!{F0RIv{`IzDiNPQ{<3@U62X6{N^oRY-V7n0*-Ep zN#>dtFKOg=M)R3WaENCJ(m^Us9CcU>$Z6nX$#XhrA@=)hjf3|pf#PNdC091Ek(LUP zCZy49^+F|7=wbk0E}gb^3LO{~BQllkJ}?DrP7jIgO6aNxSPtC=rf|B_N;L{RTV%z9 zaMwNIyDc2biYPm}?tF%pgv+8zuk~vG%fPCmB+PO^AD*O0V$v43w(sJKy{eN=9pU>1 zKB8X*Qz_MNMdP6Lj4+mOd%kxN-zInkLKT*QYf+rlzR^vzj#)cTX~+rAWYPr>U@>fk z8ee-54%ZjLT&+^1K9b{QOmT+X3z|W1=Zco!*@v7+e@utNAyh9EOK=aKT6n|t@#QuamSxhlgkwU<+ zZQ_d>4gkYn=Zw!WjQx2(B1n95u+p7KZ(IotuCQCvkf6hPcwC>;3F-KnianLo(*_iW$pZEG!{~BW?Q2 z8~6B=_td|X+C%zUEr)ueCLRI7w7X{dh}!k&bl%%z`%ZKHX(fBDCoo=80LyD9NcjL^ z047dp>hy1PWGH$n4@kj&Ff?~5$Jyq~rz4;33SkB0M*r2>+UC4?J7n+`^)tBrfWvMY zDNG~h(S_soBpI~=q2amI-Cu=iJyN#_Lm=LpiK8P?dyM&>N=d+tBuk6*1Dt3(e9f^U;_IXU7k79ViQ#z$9Hmit0KjT4NNNAV(h z6Bwg`cQm59H{)V&i;aKyhy-WkB)#sZ&hMj<;jeBt$Og^F5|jNz!?OhuJs&r|G@pS4 zCgVTlEh~BvqzvqXS*?_V5#;&;TfwQ|_k$vu%{K}2KEIpS$s|G|g5uVITOSrA4;k?v zn0r0+87u`sT#pLiMN)If&)-QM=E-&z4?5Ud-QWK;d@reVdfj&~s{efTJK_dwdH`+I zRu9iW3jB~{kL&Hz-GwH)#peachRr@t68n-R=VvCIZq{FZ_4df|-Ch^pI-k$y@PwzM z%+%Vvik`(O91J-xTRQXE2`c9G-4$dvANC#En`?;xjI@XW5YCr8xHDo(XZ*?6Fi$oS zTg~!(X*7}P)AGRH@YUHv?DJx+Z_kM*%gj~HMu45LAvwo!sWGZ??_f&hEn>~cC#C9% z!$M?^~jX!qN_;npuvNMg5|Ud~!Wo!Ko0U!e#EWkQ}_vS_99qSrak zx5kSY<0Crq-S5P(GneypYTa70;Bg7%2CZmrzTT8h2$=ZSuY@-SSH?^4zhR5z24spD zlK0eq#OABYTjOhr>e%M_(&=c4EA?|cs2CeS0sLy_Ec1RLHTzu1A@D~K(uqYm)#-&W z0^*4;WM(T4vkkgGZUK)o{wLKK9&nHa_KaEPO3dPefRqX>m8-T_8?)86lqxA0^Io~? zVTcv7OBJYG;N`~1>c;G65|F6E5E0E4-Y)Hx>l#4|QfQK~K9>o&nGReI5bg@T7UUl+ z&l3N3b-crv;&Xef{oLWLAWl~#*7L5&%pl-RHHq;R5rWKrH5XX#*M$?scfZh42TbIk zV+s2p$ov)P4FPSThkGM+>>d}rLvHuM!Zs1t&4=vor3WKMYKnjv$$c2eJ z0PQ!l#hyj>vm@co2S|A!gsPG2-dNJ&ea1HGjfi1*>jk{EKgtB$se7}8GoynDDL~E{ zHguQwQ$2n6;U`lwKz+j|io_A9gC&CZNam66{9LZiWBW_3&T5tqg)^U?*i49yTdB0A zX{b35&yPK0F=!E|NPo5RobonuZlT$iWLE-(O6s}(CH+_=%FGD_yB*zkroZ8ns1l$7 zcP<+dwW(%s9uZu~`Ev2dty=0;c%)*93R7%rw))*bF(~+1fnO>7@dwkqrPtkVWo8($ z$B@}ckS)fyN}Tf@lLIq@)GpZQXw^!lnNY*!j5P4jT&|~yHejtgeu!)8TlP|`?=Ny~ zx?|NOmN#<3(co>QZO1cWiN6B^l2qD@IV{;`ys^`GtlvW;yQC{R8o=V@!ChiVF!5PE zrZUtm`ZQW=wa*(%+Wsv>S4vRUPmNl+>uXDYkD_jUA1^%j*Vmq$L4VT~>vK!LaeJ~* znG&}#Dc4{^;G}uf9`X^F8L$yWt`>$eTZ3X3R!3@#g&-3qL3c9)>4a-sVq00CHOnb& z>1)^y^f3uHBIo$3a{T7gs!lhTR(p$(5>_$n=D^s zM)-mPC^3%4qPX&R*rF7+jxGwF6RrDRDOCs4WNCK^7s=9E&wI(=ue&=PPUydcS&fuJ zo)Y||TRZ|88z%izJytVCS^r|rgBEN6RkzY7>H6rEjJo$v*82^S{EoUjHXhOCkoD7( z{N9NM0a^&{RWI7i?*(>ksm|+x9Vu=Vi5j>swjXECcXnBiR+LY%-W@`A;TzNr%CDnh z8IZ}#l}tF&VG077RT&KoEMFSp9UEt$Y^W9rfXE)_r4Q=wTG`IK&|?316&=Sw#_LmhurD zF(ltZdXBf!+~D0&1<7yb5ylcL_QOj7_y&NuEeTF3;iF+nWu!daX73PVxs`bQ_2axz zn1Yj_g09tE1qNdx%V#DMHPH7&Kmdc12G;1j46h2?p!7cVIN%V{$rSl zJe13NhPlB3%o<841n4(dJO<+s5wFN*m##be4oi0jAD;8Bk zI_Kd;op`!+l1{j@6aCQFPNC%2X^pGsdL+?r?Hbn~4ITj6rp|0gJY?8BUKWp0=K6bb zRCSAifBN`eZ2D*deotO0_dr}riIvX9*bP`^IFv%niyEYh)4aK?R;ruc*!afE*n;uTHH z+sV~EZZ7;;N=fz7fc$3%=wiPhAR8_z@xUd9t~2fD3Zy}sV$N6$w6$yaEzn2{eM9Mk7Ojf$pc0FVE@Y|*i@0#sV zCap>+AX?W=H9V${2=4~jT9UtAx~N$gGM{c5iAF58fHov(z$Gt8@mwo9)-8d^hf41~ zKc^q;pFg@`$iD2;7jN2QQI5F_d=?}C<#$VH8k}Vv*NAlTS_u7U@;56VtH}KGq{&U! zOL3U>Yc;kR@p zrlj?EjulAaLbY$MT#~&WL|L(D?L=gHpQbCqa&;upPRJ_i>;QZdyED&}(zA+M zRir0PNik^_@O0Hx2cssox#i^Xy>hKskMva@WrPTCyEiZhdmh46B`?U&NeZ^HBNl{Q ztb;>Pc&ggFmA?BHQ6Wh3Y=%jC)ThMUZjNgqoa;>|#FQ%HYH_R0ZyjOduVYU^&&bh@ z0xk5m#kH1j(IC#x`K=a#24hltM{)HB)GaH>rZrCU@j2x2eDfAa27L7Eq1uB|*Y3AP zYM=RSG{*AHZ96_hW7jPhMU^m2%nfqi z0H&Z)vZj+*uauAz8(IF5FIXdry6*37Z7w^$Q^-ji_FnWSEU_56z-rX4G>wpEJrvWA zz-d1I0c2YmiH-^$67&Ev5L1Tug{p7kOK+-E@5F@vN}G1?qjz9kJ^PA2tG|I~a-U|Y z3hemqyUc3|^?RM62{i}?(+~L=hpSE}ty{WS^Kx9sbF^k!>>J5-0f=W(;}qJOD2LFm zzEbSPwHhl%u~9DzYOF1J(tBvar?R6}IsDn1j$uBhI&0cby}~?1H#yo~1<;Rss-FGT zZHr^vDtk^kEPbc{RFUf!E`;lr)@DjEo0m4`uf=uUCM=VC45e^LUvx1`KZf7DMD*`P z%~4?Wlg*;D*o|$;7g@{>(BeX)0^{`7yItn17OH3N_b<%o2P>Tc>7fJ&$?7;S){xOA zSG&+h7e_`Tqib=K#S`$ltxsxGFVz~q=H(EPTaV>ozaTJud zgg^p~!4|?>YKxGkog#9u)HISA0ZOMo1?`+VUfVK1QV!*Y(pKMpi(9b80Al>B-1LMK z3j<*_2_iI$OQz1ZHX2``C+Yg$r_wDm6Ewj|TzPYF_njH4;yP17y;ey{S9naySuF`Q zL&RJp`k4J@RNmMR*2}`#aqmxFiE>36x#2yHNX~HjZ5G$)2PD5ai|{NslUFT?`6R2S zK63Jki@(c-{MmzXI`-C|F6h?nh1+N_=J?s`>k_Y0@lNPrtHencXmH$6b3!jKPi&vN zkVpG8IOoW%y~B>Oq+W1>r+es0&>-doaqZqM(kKgWUNodZxNP;O2w`@C>l7-N^99U=*JDF13UvCcV4QhpyKG(= z@GmNCGcj=X_&{q#g}a%SJ)%2{bznFNLZ}KfQME|Q9pBo!u zx}haTMveQmOdaK4;ZsuIldVMFy41~%pYJ}eN6`fKyneu$q5LNPBLPNOkrH3zRz_*C z>F-Fc2!%d#SOlyG>{eBeZ0FB7fH=};jQSS-w{PRMEkDJ1XjxTBTduNz_cvvUppz61VT#1@U-UvA^(b^fOKQ0drp_HHo>D z%S**lI9HCKLl>@ol$F)q`;LS212wDH%I*|W6%8?T3R%%@(RB#*5;gW`d|b(}q^-=G z9c0s>&+#w;ZRNQ<6@9b53~fP;1Yw88{6df0sd)8S$GW$R!KuPWY(3t%CY_h$WfsJ| z+f;&c8L;c0`$jX}i2S~#O@4KjjLx)GgSzOA@p6p{k{FPpJ2YBm>90<2$UjUf=&?cH zOsAAMZa9gRc3F`kArr|XwE}C_!YnPriL;yhP%)VRm1>iO0Y_5_rXiXzSMo_|ZkN)B ztKk5dSZD*UEj=~&cVl>-YPvj3+rP@S^^zXNTB(SLQH4D>85UF453pI>p|^lmafX>IJx2nT5%CYC3Ipi&dblWH zNw2Q?GiGNxBUh&Zw^4JR>gd+0Ar!Z zv%=hnBAedt7B4422el(t472Biq&~l#b4lVsfg&N*FJtOpR~ydpqxC@=h>#Ro9JLZ0 znO41#6WXg&nx7(9TY}df2?t{p zSb?F9^1tg;Zuqg;^2F(RutE0*Hk~}w-R#R)Xfc$ep{_-zl+I96gVV}YT<91vbWLOO z)3PrOt$zd*e4?ngJJvWs@Q_oCqOPtYRw^IxP*3KxjW+ErZy{XWgmUG85-Q+NiqpnI ze&8ISc%)pqh_(lN+^*25C{saht~YV`K~%=m))3eH9kyO!z0w}@&mWrrhtE9>XVf-r@OS#3E4E%U?Kf$N|*4fj zh^tvlv1rn1>c)Ye+$|N68EV$4TwpB@a>FoRNdBUOQlAqoX2S>n8xRb9;(9Js}mF1b4?&G2D`V1*JGn}y6rryXwpmkKvds_kImg<{>Q^8huy|=uT45!!-!xR32YIE0 z-Ns4l(VsxXV@+J5QS$z9O-`P1zgbcqR^Mh`al=D~@~iY>Nyz(F zT<-TfzpJeHuPXa+H`xeU^nQG%d#rYyW;(a`E5;-yD(j9AZSm)N9T9!I1o)%t%+$Iu z=At_@-=mR>Rr9{jU!6%lh^bSr?y4b6)KVFzj}6XM`4o4w(u8gUfgN?SwvVp>;G}8- zEI07Z{3Q{3LH*w2nDiq`jA!!g9JHiP z(CQ~gRSJ_Ox3BI~)5qxyG2r3rO4g=YKBTT(prAw~B8M+Lc7e~LOJgEyDC{3=MIz~^ z!(|(phulKWMb8PsiUS26`-=i`J4%48yWWoj+cPUics${ z0evc>3BA=Py=Of|$hr7-IO02{2q^%1?ZxX0LkSHpqqa)evS?(xN|UOr!X|Q1; zM(R~PWbN*yR|?PT$vaysEnW@2znf$lzb=>RG^w!CL<9Xiti-MoC^?6R^XN_o-*f4d zf45A#>>7eY0$ znN&3`dR{hohxu)Z8pZ}$6Mzy;gH$15B&46!X8kevFVi^V42)h(z=@?`U)TiN#-4#= zC^bLBl^6BYR=-$qV1vB7U!Ck5T{vFsakU}+gcVUv!3<|-7QLofmDDi_WX&}NukGw7 zCe&No-E$zTE{5)Cc)sfiP4>&=9 zv9_|Ur0+Yz*8Ltiqc0`*r$$+Hj;-QmJ|{jP!cmzaAIJQJN?#paL?bQ`7JjlLRx*uU zL!@=trb(L{A`pQyGv{$Lk_5G! z!%1e|4dnVRZWdN`lux3IhUIlrOMdudm1=XyV$r$nOwk6?-i^XAcpxfX8d~*5#YKlS zqYuzgQDc4v)e&ml!SFJH5FX}0fAAN{E~w|N1}AWSP^8}^geu#gM0 z?S0!eAU03x&$5>`@@AWGWQ_`@S7XU@@^%^;!my~WKQXw<%Rt@E*Gpem9BA9Wc$bOF zdO*&8hLFU`$y@6BscvO&aG2(zsZ!B1G^C6G{vq5?D=6w})->e~*Ea{@MBao772GI+p^|4gE`Y+vBCCb_9+Zm zg_@e>lk+*!rbQ+ZZ6@`D+UU1rKii3Bu6g|YRz;4;o4cwDhahaKumi6n){g!RF8f_? z9=$Uc9@C)`Cs1UV>Wwf-j_-~ zRG)k?gO~T4jErA+J@1FJPoAOLD}$oV0#A3=_xfDS&Jfw+9DPzJl5jS;nNCe{v1MX< zn7V__v=fVD=4-M*7}?l6UG8V4LfA83UARB(0vg1H{7Bu>S@zJN5@x~73DL)~gqLQ$ zNvs(!uklH?SO{-PDkm=CAr{ZJ?0VfzOb^n2Kf5jP71kp0S>8C1dCT0RduUQYPmjd)^f5+3mj`u)0kik?j2yKCqvy*}4RswV-S z!SkVcE~j(B*gf)T)UjAn6m|GB?xI_rvL9sKB>3q7jN@w;Z zArV|D#pBEzu5^-zX3&_tFvWxAe!f3<#7JBo|Mdo@1U&FAYxTY|K%!{x^)ua^1+l?c zAl-0eZ&=Q;pD>z#jY15NQVo4ZaOsV|>Z^HOCiYn)l)F4{T0wy3&FudEbAMtE*Ve_* z_q2#EJMYQ0w0GF4&Vzd-IgM5Sbw}O`KN@#5Dzla$#uwp`n>2}=x)qtN6FHjO;#q$I zSeKr>#nu00Aq4kAjBA6+>OY|1|6!5Dx~D}F zONo~B{f{61Pr{)m_}qqEX^Z)vz6}_SRNzFQQ&CQs|MT{J7X+VkVbZxK{dZ^ouYVW> z0aVTqNX!=dKX0EA`8~BWG@f7ne;R53&yM^+1?b{-R2f&If8IV;Oz`-!*6Yi8gR1}Z?WX~(;^6GFK2p_}`seNImjJBpBS%%se{#?Q vk1ruOy;g(|i(lpb^Y;D!KmF%;&`S|CoFdwmK&<));E$}N60BU@=)?a59H!A@ literal 0 HcmV?d00001 diff --git a/readme_images/netlify_rollback_screenshot.png b/readme_images/netlify_rollback_screenshot.png new file mode 100644 index 0000000000000000000000000000000000000000..0b89d26e5f0dd374378c27c45ad97fb8639864ad GIT binary patch literal 53005 zcmeFZRa{)#(zgpC0YY$h8h3Ys)401su;774g1ZNIhXi*E?(Tu$?iyTz+c&e<+VB4M zde7B4x95i0zwVyWV^oc*QU9k1Q&NybLcm9Wf`USlmIA9lLBSvculL|#fxitK&}qN{ z+EGPP6sls3@D~&m2ud0(qULIFl=;R}c zb4iDlB){h^3oR|Jv_&+rKwJn4iS%Yq$fn?wkQV!EL};;2RF?la_?7ty$4Qx*2AYm% z$&-y>m zs3F$eaTnXwgdrRgHO&8OtTBN*X*+G&&i~^fgn8g`A@FdF4;B9yk{EF`mdzM(>eXP| z|4iAxP7Vz4MGLY2S#yg2&k6niZ}R_cxD?_19&S!Y+B|Ny0dE}2q;A+APLw4hC(9b^ z6Xmh~c&G@kUtjs3ITfZ7UvI()$;->j7RERyL@J-&{WUmY;_!Q)HB3?JXQg_%ig<}; zC7m1KNqJM&EAATb%gxTZQN-`52BJuk=`|~dazjw^g}Yu&*0{0jQ*UscgzLB542H!Q zwubc2M#j=5(g!(}M4Tu};rv)Sx1aT zi;ZJ9SKw@wNv5MT8%{`Sb-Uo-P|AKhtKOm>ZVZdxKA5p~uh|fT9T`OH$u}KBSM+vx z-}5fKGm?PYw6BDd&E@$OuhV{2vX+E|#PHhljGd`)hoDjP@kFlV#c9WjT`H?})XjXy z-EpPaPhami>}qfPr?(zZc=o<4c6d-Znce?(l|kXxS@e+Gt-|b)1WWeUyg_z7EW`2C z(FqL7dO0PU$-zhmvhn?qd3p_F%R{G zybkdF-W`H%-N9sSy&INS)JM>!ozR~<%%DO)BmCRtK`>~83B6rDp5k9HlaP-WWwKWV zC`)vlhf>)kVMS5zi$`PL5|x%+{LpQ%8_5=WQQ7_RqKuA#!HEym#i&{ku{|0q7L15b z!>G&gjv(qcdPw0+b`@LRZsbL2e&g?fznFK0J3ejOSo6gB9Fw0l! zdSyiPz|o#j94fXnTb?I>sF5~qe|+!EYkwAFv(m25WYC%yPUrLd$Yy-2gg0MViOHBY ziMw^m{b_ajF`%)LhZ6hEJM0+rzVOncp-f{{ zvGU;JQ)YZGLv zfMWTEB47{M-mBl`a+k5m{kX(lP^aC~4Q6w1N%LNUvEn!XHw_CntHf$#gi6TrS;I?xk-AI+|B~C9Ey{mCA^RR1!Z#*|h<8Ur$KfM2a zM5SJ;mc(v8KGY5qlBW`Mq0*+4SY>*HQ8*R@BuUa8s{(nS%kjsF{N=<64TxCv42T5f zBKa2cN0QAJBedDfS6?+b?0oUo_%4y)c^mGM@AkdG;Ox_CGbJ1faU4<0XWB+N?03Hu|33=?5q6f4lto57A1}0c)tfxccKFZ@C2EG>)U=#~x z%Ls`kOav}5Qf;C(*HqGv72e^H{{@`@gK@&ysugi($NQ4X5zi$_n!|UT{-XWaUHRS6XW;!>hcV1%G|q* zE>OQGmTHa!y~DY3QdXYH_gdmosh7ih%0y71*C_upI0vV=eME~5i3mF*ho`t(4=98Q znQAY*5S8knKrC7naEWFq71H6{6d_hAe3g8eZrnqO zxe3QxE@DyKy_TD!M0WGB!IefHuc`z_U5SI~3dTtM>Ey|LSvLVp;(i~U${xM!4p(JJ zAVUI^x{B3I87DB@6ZKSsp($Dio@BNQPbz+=FiDR+CS2iWj^9hS5`Xq z>4k(tnrh5?$dCsVGvJGb%6030ULm=`;_RMm52q0r?#W5wD&IWo`UQhln3c%at?qfw7*!FFh8NvveunS zZ&>5`-2G;u#iiqD$wycrTY$d7ZcSrPcp^tU-`#mU?TX0dXV*N*-;1RR$QK4-%eAkh z&f)AQnls-;d$CG!4u{<=_&{RrqFr^_Z^`8-ZfMH97~|a%iofrZ<4YGzU3Q5^1;g=D zeVmm#eFw`nH1$D)P(*y`T*b&)7fjyA$b%Z&2PW-Sn;;HLHA9^S8?>Zt@9BM3hueKt zJXV{k=~9BHWljA8D&((@kG;}&N8ufV2X%)|tVXYe31P2KOC>AQ_HlPbUK2ef4Du3bUU12|41JWH4>YdH)k#U zIJn$KKuy49oAis_yciPhceK=q3@e>&Ads&ba_tX&d1u(3RK8SyIER2u1IqUN-TwP% zRlYKa`X)Nto9YsqVLCk|?~L1!q;jye4=1IgOO?9BtUw%k=2we#_re!;uB)*aNO&B= zIXOAgu84cM5v!FQPYUG7T{>%mZ3$IOdbJcb5v-j(VLUdgHS*7F2k9ISm%D?Sl$s}c zHBNU3l-mQ*B+0#C#pw~wP=}}aX11?BhL($su@V?#neVeV+s{eZO@DJ|dzM{d7m3Iv zRcg^rnU85~?sph83V|vD;C?4x+v?K0!GG?6l-uuqxuZP#!I#GE^Nm5T6?`i6;z3Nd z_*KLUPtd7~!|EsKs|&-v>C#^YIoJ*Vb#cDgtB^sbMlW|>t*2K*gcow~8;@4EIpO!= zl&Z1GfvY-F=T4|t>STVteCe(Vl(wQu+@i3@HBk(su8WjYX4-)*b;%Q1t#I$g;uXOc z7-ZZ2SPf_J8U!D5CeqVU66e$FS82@Qb3Q|p%I6iViNJ0l?BnLOO>d?3+-MONk;$Sg zu*!iLqsQxb0AbO<4|c62UfHSBG*rfmV20SQKn$c2@y(U&39%p&?QD9(iSz{1FitHKBm$Ne>2r*oeaZl&dOVq`jZVK|R) zCpNP_)mk)BWh@rH*DIGjT6fAUcX`*nfaJ2nKYkElLPH@MBfjh-qTEOLmc>Ap^a-F*JK7|QSYab z=mbnSD`26EwUh9vRA$1*6-iP*aoUS=Ar3=re>oYSe$VN>x$V0X{e5qccvg?Kg9kMx zK|WJZ)zFG#7ABBOP>|GZs$KGn_yF?p_A$3Xa?!zzL7+>*)x@7n*KaSX^E$J|?4nlt z-qUuqHn#TDgdWm%crr76>U@oJ3t!It&2h1^&m1A7NVT+J*geLkC3wp2sF&8^XkHqR z)iZ|Ula}F2@B7Ecpl~|NJume}B@yRfGTwX%oBK+x z!C#&vC=n1j6d5X+d@kmnY#~Kbn`m@Z@~0 z39=G!=R!C+rY`J5{Qm3fFgjXbb70&TWA0WG3QLA8)ykybl(UV>#4}h(oo=N%zpLJWf%6H7| zI*L`wg^^DA)&}BbdKyDAw#SnVbMakoy8>rRCAlLFP=81(_Cnj8?HPJg;s!7YL9gil zD8j!un-EJpB^2@&C8nS%nY&)eZX?%!?~(w)pt3X#wWs1Hod`E0qW86^|G?@>sRYS6{bZ+>ua z#&1TdMMpUm71x1vUZa=T%$CnX^+fMEQ9^>bGcLN!WD+NN8{H1;lL(QyOE5n5LO)TU z71rMOxSJB$tv1V_k|3Jj54rC^w^-j8@Ip2NjN`(63;q6Fk7LN6Y#-H7MNap((2^e)r!>M0Vg`=^SO1r%Apl`9v+ILp4~FWtJwED>#|Fgx@$q%#M6mY*up+1i5dHd@0@*U_KjI~3tP5=wbO^M%^}*#{ zl_fj_w_o*JH%sFf{DOf)8J=77EMy}>B&Isv156m5G-6elp!4{>Jtzp;pxg=zh!drg z6}Hy;KXH?C+wmBeTuxL>A~OP_g>Hl5pb+&c#KjC1)V|rK&&q^;9825ctUY@~#^YDQ z@%Vau>>^Yoi6sqRZg*0MgewbM zms>}m7ByQkI?lAeY+(^c(s=(J?9P$frP;`=tvjNT92v8Ii_@g3>mbP_N$nm7$F*IX zpvtV>avm(j5lLl6d@A++{csHZyE1B z6ufb{MZyw#GTH}L!sG4QA4tngXuf~Bc^;{hv}{zbj*LpW@i}*_gw8bJ)oSeRDi52! z?^z7+6(h`;%hV&auOPr6MaMons%o5xC_JE<_G#u?_UezC>B_F%#v!BFqt z4eS9nvTfkmDiK4kK~ub=CD)UAxIjURdnoYP8UBV3=y_(9HfWEkU?uMzHe3Op%@0 zK}4#Ig~edOS&3pAn?7Ll<=jN?QXm^|gJ?G17oyV=jX0=)UC2F-={CfePBACmV8M=(B|Rgdm9Y=5RI zGdY88mFguuSrxcD6?)d*9n<})j3=5y(*BYqfu#oxMaKGaSvc;b`u^mN;L8tYA&sU< zpj_4MvF6%(L1O($S_kRX^8$|HP%R#NB2>*-*cqBz!2D(=sWe{qKtPLe(1lD%fH(=QN@g;Q zwOw)&OsM75(-Fu8O5D|tr?c7~f`-Mwi1*hg6%$aQFk@vRPacQw zgFc^hzu}y9LqQ^76SktH=K&$d7miKu_tA^NS^6b~!pG`+@CO#U&(OIWYzu?ci3L21 z#9dt+gnB*iQ|MhjU0uXOA$dixvd}dSve9v>Mq|9`Sxl7_Zqt5RaqskTh=_^0x;eED{7ag#T zRErow^T$NxJhMfGbNJ%QGbMQ2*OJEbGQ+)A;J%i3{oDAtMW z|1GDTfnpLU4kGm19qNGGK{<{>I;TWkIgFami;gdeMnjJL^`Hlr%_`kH9A*qcP0!g9 z@$ZQCpqE>vW3XU6a@;5k%%C-?v15dh?rfU#Nbfe z4!t@jo9PF`ChwbdWVhy;>Ug-cFMfK`gB=Ja!M=EXFJr^#tAS6%wwA%~Vo3n@^YM zLY+s$LH!f`oV{oG?hiGgs0`~L%~wW}gsV>rx))pBeS8LU&-dINll#(E>2)z{ohX!6 zmQo!*$KrnzmD#S=a0Vp_B!p>*vN;3}8vykJCC+285uuyYo-a5?R&*n;2*4b@5Fm%9B9)F1}FVk}CH5^SsGU`f0l&H)K7(%5z61 zQPht;aIAw5`-Y4n__fQRt(E#{cP70-k z-9r{Cj@S-`;n`f6Ya^Z?AT?Kzr|54QX!!y*8g3m+;Z!91E-5p#+1JKv!QbFkn80kP zf#gy_fD8fQBSCyWARe8v&RRw(DFvZz3j1>^qw+t`vt@nB$cY-5Djb)IKFQ42Y+zcf zR3b-y?%gN-eLn!~sHY3{SJkfP(&6U@gbx^MzSu0-VX)tu%hkLW6`@)D*K&*-ZpDbQ5}SJ3NKfiBvXBJjE@H+kvgW2LHO4~FpZ1)sVM?I5fgJ_ zJc7W4-MuMs4T|IgesK3B&yU3nx+h^gm~?7N-VY;+c^=&S6j{Nnigl+65q$q<0oci8 zaF;k72#aFQ`{r^d#R<_*){;FSH)>ImHSeVlm*>h9Te-@x8pQZ#s=cpg)9FwGGhoRM z?k;wLRFG!r@v0$LJqk=7mPz4pO-0&@97c88x8fo}=r8!`2nCQ}03CK6PtdN5OuNyv zNs#-!iw$+T4u|?3a#%a=z0@a~6hBr4OV?G}AL(2g+DNA!6vFL{<=Yl(rxki_3I*e7 zrIX~LVLp_k=<%f*6%>+DL_T!A(1|_Umh3yDsg9F*$}ovCM%F;C2+qG$gYk6lHEQDs zjZ{wMWUG!k){#x0Wo(^DFmIw@=Y)KyggUq}QETb7Fh$Dtylvlwe%u((9y#K58S!)hod5Y9OsfMN^-=R24sp2v(HkRcyIpQS4b#*Jn2(VXBSqo(arP)Og ze%q!*g=kgT$66iGHi(m#{7I17n)wh_a;Vrpj$J3gc^zKOnch})>BxlNU+1%TdVFXT`WHSjN`2=qREGHfk1^}i^p02h>A zgPqCnd9mByj(j448{10{jpPsAhbA^z1k_26>KV#;vUi&s)gLyDIX5kFkH&6yUC3Tj z4A#KGMoPVYkY>=U0qR<|7Y2Syf-Gvn_T|B~09ZbU9uq#d$NDND#Pl>pw^jPONl{E&m=}bzdTuKmbt0O6nM+&a#G}CKNM%?aMb(O ztI1?}Bh1rm9@VS@w{jb2y|}>0hSX7*x;(u{zoVe()u1{{FfX>h$m}6us9WddJL(0&OOH4R-hiCmfM#IM;UgT zOyd1@#w3(QY2;=cC|$gNxgX|kgl@dK`S$gc_QWgmUt>mxaxVVF0a=oJ8poQ zz>$xDRjxBrB1#M!9?4cyVd%Od8RaToicZl>ZQ;+57_(e45XH0JBv~(t^$H(W5Do5v znr3MTvdxa_kb8AFr7LBT&1+tvp_r3MqbwSXcvN{u9{8RVaWucQq_<)$hO=FflYS7# zaiG9fO(O@8ZozrRl7cYkRiBR+i;g}n--gl2cA1Q^f;Cy97Km;)^TWSzhMjQi-q?9R z&{Oh)!J-1Yc0Lc*B5cVTz0h%q#1YxBkPofTajftI z6~UjpZiJ+**I?J`WOzTY*bg0mtx}c>fc5H?(M^pLD#5|sDMeA3`YrWTGDdP+6XtsS{AX5T z##D;w-_WVKB|bT9lYv7)h!n2z;ZUg#4{*Z7w4CpxA@4)xO0>nSW{OB-7s#9|LZ|J; zzT-f%v39$f3@HATLE+doh)6vYsTrh(G*N9QD0N@W{?OIw=FBiDLQKSlfb`M<JIG%dyIotJ5=mTG|<1J3+7QB2`UVLxvM^g3a{tx!IVRMwSXI|y<~m@>|k>T2$} zA6^sHIPNjoaUhe4sk6abfO4YzNKW(sC*^@gr^QEOl){jr7Wjm8>0O+Kj>fxnEw4%~9kdGy^V7Dw9?-Icj`c<9PF_(qQRj8FwDH zApx+M$oQo*fzMgb?$Z_vEj}GLRjUI0iODqDsTw`EIi`&7;osZ3e>DLqkq4tpcoBDE zX=AIGW-!p#9rA2K(USUk9yNx^tom;#^uC@H`<<&%o+g9bNNnQV%YZ6@TeD46H2@V$ zO(rmXFDZdhhJYLkBl>y0ul*G`citu_u>3=0+L)Av1R_bnHe3zb80(RJCN{*Ep#W~H zP@HfdWs>iVba<2F=^2;RWwgOOI>dsraf$%)VGR4RQK~;8yU2m>CC_5bTC+q;Ir4Lk zWPG9AJ1N3Y!Jzk=QkY@Q)z=w>v~_jJ+WxKU$~AwJf1rbHKYjp1l5BQ4rm@xG(&T)7 z=eSK$rr#k=r@_G71A8?k6ZMV5R6)1?5WDBGGMSf)?1{lG=)v9$$rMjyj@nx3-A)5Al_ib@L&UxF9Th5aRVr=dJ2SSzA zm5#i|73V>tHf{hpSriW{CDcG-sfKkzpX%ZTB#|&j3`}`Ob8|W;NdoKH-xPZ?s#~R0 zf4W?3@M=zS*SD8y*x~xu%+&Wo=b8qbV$2y=5Iu#@7T)LA{!OChQVDNqb#h^^u$c1{ zFR>qs*chX3C{=$4W#Dk7lKTX$l=3RNM@fhCBa=qXiNRi=M`p>N~4}e6_ZtxBm_TyKfRup`@9hQl{pq?6R zH1KJDXT;5lFyMWj-#Oih%c<2WG)i<)krg0XsG4=Po9VF5&O_WUXKkBB2m{5;SltA$ z;)`T_`A50&d+I=;fi%UQ0lz7q4O+n;M+(BU0a<_6)Qv*Af(~n7opM0Te>u!E8SaKe zs{Uvp&wiu3nK+H}Q`scX+H;V{Xz^4br=h=(<@PGb$hh50w-MKom<$FLV~(XH_OR&+ z*FryVk%a#Y?5jnONeqJU>6&s;)>1IV`*bez@-LtSJzzXizt4KB`GNki~$!IOA9XM7)YRh-D+(eFV&%u zf&Ps}^TUG-scP)c&d`1^hDIwYMSBMU0GnBOL327gRcJDf^aBF%4vCTn-J zuV(0yli4W0hpN%$;y}UDB>JCG8S5GOuFL=CM1*lu@VPsOYaU?>u3Sn$*o;f_OVU`Y zBcU*s2n`ExE<=P;v(cx zf5cZ&Tj2~qElrLOQAseAq^%#m`HLQJPwN1VXq}bydaHIUbG0LY`fyb>c9S*hmw+M7 zz%Tc(a8_F#2iYNVzkr-nBngX9KH`JWB4Z zc03*jURY!1$iI=ze*w*)Hh@G1^5Z|!c^*Ks{OV&_8ThtPh(Gmho2Y~rjo7<{DONZ# zqyL}qb_^aWKq`lY!o(4j2u6CEHB!N~$UvnUebf3k4)iw_RKxX3JBml?v-N89JF_)G z#Rb(k5s#arim;yX=2)70@)lYWp^6!s;RGf|Tb+hUDq&Z%$w7$ga$VDtS) z0XW_XdA>Cgyl>uS#ywY%hDoVJ%ASy#{{{2ykR>ISc~YOr(|@ztgM9F&yqhu31+x-X z|DdW(313MNvLVa9kN*dVeKtwhsAD_fPfDs$yVK|oid%gSjp;I;-K(v!T zTiJg2_gjCH_rm?8A9_i*s%qK)`NNnQf%_XQ7T5Xx^Ao%f;9?OylVhg;c;wbv;Qp?b zg|o2#g!}(L{TS`ne!ab5X(_1~0J!|am`3qQMiBz6E>~DY#I(7>75s9Ck70#=3l)G=C+A8=AH0wvqoJXx)Z1tmE9VAdGU})S-3*kxj=KrV zO^&iz{BFNp1_S^5a;ASSH~8J$%ZCac)#wjQn!)ERQ~zm&ZX}5@9-tLzjC?WA>{8jx z@{D?d(Fq9X^JSBhB%_Hf*8p{o{tW_V%;Vi9eQFhaFMBFmOXzb3v)#mJZrL8$Z*%&CrA{$nhFPYpWtLc<(x}(gam+&%c)<xIj8E)e5OrIxRQ`362hc_By zQ^!7KveVAlLNYROfw!*G07g8JPA>VG)2hev#Qirt+eP6(bG7~0hqd!->ZVh4v~P|? zGKQa)TWQV5^<%n&5M+wuC@DRz3zNA!?|Hl*8;_P66vwiKD(?_c-$wZ4z-==LL*33% zg5Sph5$2721TgLO5_p6V;fvlIS)hP95KN}~MNvx0#$k654P9bmlzL47a#6e7=ArpV zHwZ$&hQB#0e12+yKpb{Qd51FJCj$(m3}7F3)0KF`ZyL?FwlKCg$WID0@bxbYdzP7F z25l&YsWC=A?0p`GI$09F>E7~SZr$4qXBqgmZo9_%S9{JNA-pNyru|W`G_Ut&9$3AU z4vRhk1&=bKSz6T`q2DY!YbDPraTq#UzR|}}AybeXpeN%9xIYyYHo8_DtJKL*(yEu3 zrZL|t@oh)AA@a4;*H)6znM!52@pfBjtP^$l z#&-_)=Ky26vwt4%aPs(u(-dKQgnDNrF%e+;rTt#riQ&cJcK{WUB*2ek%hP7ATwkj7 z+dajRiFoN;PL>lF>#Svhpw>2wGY;3kkvm*WThglJRZWMMPzAlilKD>3a&waG_6}QC zE>mZ++RK`AJzL|w$90(v&|w6EPG-`NOXs#b(D?&h4@WlEkLcQ?!QnW6U?j6EQOWZjetd$=Y|>+I{gQ-UTC*&K#$nh;mluGWjUgj%VMHd$clURa+f*Q;mpF$ z_$A0Z=Bw?vCmXiemv6mytx{$&;gn5Jj=XIE+#0}qDhyhf!opCT1QKZVWljqLDaPY8 z{J%+KtVlMIbvHq<1UL^A<#ByHcR5pm2590*x6+z!A0dDwt|mgKUWSVP%ZYmE$T0)$ z(s=LhwcC~J&t$TgKZ~Zee27IP{;3J5fH-UjxY}#aEDDD0J#Z*7X`Cf5+ggYX`X1Ln zMT>r?KQi4a^c=mz`5{WJLd&4}^9kU@>T*-_ilwS>C`3sBIxM4hWu-#ri?;6ZnC47i zwwvL0(8drWl#jMnFE493Rpa(^e<U7CNhbDo>7T2d!Vrd+oX#VK;JEgOO zQJEfpnxEph?TDMa4(su|GJtXdtQAz@49FDN&&MLA*AI4jx8>>1Da4JB+po2oB+F$9 z$|6npJv~SPG9`sid$xo(fKW4TQOU*5SkK8iIoaZI6?K5sE7LS^Ob@R!*~}IhER}>b z+^_c0&z3E-C<2++{X#eh`CXMxR$2$w`GY}pO~iCQ}q>h47W*z+$`cal}j_WNr%UWeZ)t$d!L06|N% z+BLquBpFSV42dt0{-r{hxC}IIJmTqbo>78U_=PmebV^M#>V9}RJ&X~#0U|IyXA$-B zVy#k~*iyY$GJ`?AXc|WebGdH)&xh0B3yuzmuauf{&=KY&B8ka8Zio_MD-mNQkPe^n zU;w@#Ce;yJ3aCcrc_c>}SnAPyFumqQHbcB7`m4FaZ`4mXi457bcR(?V35VGrPJw7q zM$U=R?e;9TY^h3`Wqqm6l6Hm9#no8xI^}Krj8aJFhm^uuY({;i@Z^ew`)XE|LX97o zhK%YZf%r0G@y9+{rvnNJZ4W3irP%U-vkpi|flUM5AHuQdOL~pFa`LTGTrB2vzF^am z?J?^m@LqbWk$(o}kkl=$!Dfl}`yNw_s`;3dT;?L%S3Bln4Nfz)0kjZcu1nB{n_$ph zA(mLO?+wP94CH^3%aoHO1R(;eO2Xk>W$Ew8edrf-Tl+jeA5y5tM)<(^5WmBjQcccg zvFUH%x6yETal>mMY%s&1pHyV6fNKm5pcTa1#4h9+2RYEi5AP=}L=KOF2}27+^tMj= zWDk>m{B9@3cRimpqwE6zYJpgr zWpo-WsDco%)a0Uxgh;ojW&7<<>by5ijyrLskH;5g z+Ew<&!w8EFmb6F&(^Ho_BRE?YUz3jjXmuA0t)AjcNdp26#4Ah47#oAlF%)wJWz zI|Jy_5JPgxL-kvX4o@z|EO88}r-gqtfiO53Bl3h9K8-(@#%B`shpZtd03(95a24C7 z+oO2&Iv}d&!fdnk&a!<&b-?O6Sc~V#;V!%uYaB!XDbj6-;`lT#Tz5y;Hk@q;pta;c zkvyZwJN!bSCE7>qe8G*& zu%R%#NT@JU#MzFBu?W|nzYfQZINHa;oe5XGE{0D!6gC{sde5BKu?`uJ9}puvS@Qt_ zXhjmR1Kz&{%H`$O5dsvRmx3VT=#Cp zb2;xL6VNN+1EacaR$;_($-Cy9O}^LUbY7#^?jU|5BqcYdNJHD_RdI+n;FU?=5B*sj z0Y@bww)y;JvoD--E&ZD~VJJdohrM)#en-XLmfp^A!tBE`-hSbDMtoqPE3MX7-(i@5 z$hjBq4~)W}o6OJd#k#vzI8P$A9kFSo_ZQl}@2&%*Dh4D-41HhROYF`Gbz8i10k6|e z{iD&`fK?HQB3#b@7KoQXU)5DVM zlkydiBV7>};Ez$z5xBYTzp%;?!?9877;lQD@|n~FIFLT25pX*NXDpLY0OuCJS^~qL zr6tj8YOsJ=zUVpjLK8Jdb$GfZ%Ei9l#3!Dw25yVyakYrV8QepOylwX3QBcjh zyD6*0h*|E5+@K62G~kIYCkF(IZ1Ikm-uTOm?r7Areop$4nexy|WhUV)Ogq8gjaZiz{suYPVk z_A}|;LbGk*a-*}X)VD%rvyr6O`f?qM7Zx2-Bt4gz#VfkQo~q#6Y6;R^U}L8w8h*rx zS&Tj@Hb`?r+$%;QU1K&*#aW`Ms>f2%B&2mC6~vOVb+V$miE7dMYz?E=PVip&9N_vp z6>|b`&-hD;mwiBWR^pbXc1uzE{=G%oQ~hblRhE|;3-u-qaa}cLGSYP=>UmyE8jAye z43yjSxjQI)^1BC4<(97pfj>;}iQ{g{9_3h2XsFZ=7{|bX!?_Y={ke+&*@S=?U$Y57 z=4;K;0n$}hhr^aZpxOD_U7vN`4N`A23lZI6loKP`?O|0z{ToW20 zB0Og&SC@eEZx&!NCkQUoUL=8)PP1|aG*hAx=g!LdM+lXF>>DgMtgQGgd#yrVDY7)4 zAvUc~Zrs23J9_-)MCj`crFvi^)2jEb+g4J!%!S9ze#zUhZFPGgG+rB}j*0|EeVqz} z4yG7I1RO*XHsQL*vTwDaFtLe=*0aNtW~I})#0096NE>1y(H5dYPax5LuO8R)d$AA3 zxw!#Rb3TImQvgy_o6_0o?e$wwwzT{&AhWba>V)761}J>F)j5QtgoHklV0JE)AQm^Y zCraM~Gn=nYRR+6h>^@T0^lo@&vc;UcFX-;Y{WmVJ*L_(8E|(M$4o4O4)e3Goct_BD zv{a)q9;hGk!SR4V%;^osO5M_9Dmvr7wf$B;+<)(j@Zn9hH+{Q0%-5i=cnlitr4Q!9 zlMGf`EQSVzk#gTjqh-yzJDaGv2SSIQe|J0N!sDyz;846?4oTbcopT=*c>66^5)cnnWY=?^C{K_;(M8``w$G!D$<(tJBEBV$k`!7 z#-*0B2N0BR!F-d*IUp&Deua#jmrW7F7Vmhfq+nUX&{f1Ez<|y0FL^A75oxt+8oi_B z5N$wydISs8)2WW8mr1r(ztN1|Y8+dwG&`r^B6X3aK^uYGg{QlA7+LHFqwzVd@=U1V z{D);xeN$3!BPAN;H$!^mj?zOT?qveIms)qQ!qS^1f_C~QNV+2 zx(3DB?zF{(iwPAx3Y=gip1S@yVi3=|^ID5tM=y9z*^)5-GwH8fAKc2rDJ-USPgJQ0 zs~oIlMKIOwQ=^to=*J)#LY6^o&9~=o*<3#u7ORuXREulyxE;vppNhd(_O_vuD zIcZZ>rlMF(koASD;h%o^eO=!=@3XiZE7nsWrYs2;o!VP<7P)_ia`<53BuZrZxw3em z6}|ME!hRM4H7;u+od#mFOLssom=p813%=*42(h0gMnLGcl@9Q~F|?txH2KSM5o6+( z8cqi<60JFKa5d#N@3vyOj(o2YL+dc9;9OHKoG!R2kj9UZ4wHBRTbh&fB ztch?B)@pVtwpnSOX=#8RKy~&73xilD?}R)!rb{&y$x&lo@A?h;FXj4`$ixI3%#@Z= z3=L&@hQSO76Y@}DZVJCPISL&5@_y@rQBy83$nBMR#HahfJ(9OrXe9i@gDr!~e!g+7 zBX_STC8s1?7h+UeXTdR|l*kb%NEGsV=yCng2D}E9 z$L*wbR1?Ycc8OCGaE2xV-djM!+G;<<#<&r#3YCiGCi1MF_bL)tb_R{UmeJnO1VInd z8hJM<76*e(%25|Yo_p}$CG(W6R7vMXNTEFuAp4n6D_CMO3ZR7uCw>oY6(*M2Jy|H9 zQk8CR(5(D>!!Q!`XSNlry$@$?ubLTkn>?kljtma}z)|eyy}SMlUycNut_0 zB6Csn2)o<%qFT-ssB86-&a056v3z_q<>Zp~48{#y1i?wQ6yeS^n7eT1=;wCeHiL;k zxUQzG!m+Kdt)z;J+JFBap3X9?%3%Ha3Me4mT^kVTmhNr@N$HSMy1TnJ-AH$X)TR+O zAxKL%o9@o{@tpI2xh_8Pfth(`?zv~J-`dPCV))XtHW(C5B^#j?ErF`ACFagZ<`7=3 zui$xeSbpy*i#hQopMCf0Od3Z{%vD0;L&9iZ3@-x1Apd@QT?Qn^_?<&KhfneT5aQKI zm4UOF{FRAmq0C$?!^FGU9iV%*`1AXPrXn0?IQ*x#sEVfrSPqmK{!37~I5wz095)tH zv}>V!l710iYl1@Cz@II_q_1cpy!PLtwahrSHjE0}q?00-!1*C4BmTY}T!Fv5DJR-o zk3v)6LU{eX6pt3ff3e(?g!8KEULH({l=kn=tOse_<1je*2UC+t+z-BuV)*2hL?aVN zp%p;@Gxfs`CvQc=6k2_vo|GV^q~+Wh)e6d}Z|X$eIQVF*87L3(1KI`KVP}cH;-vqX z+So)Jc85r5?6)^31(MNsoAYA9QLQ16I&dN5cM=u{q!Ln_7GOI2jUUFAIXo5=I}GDx zg<^cf#eHn&Z~oV`G(bhjL2>9tYIom@e9va`c$<=5xCMiRD40RJI~juJ8_nAlv)L6g zcs$NY5zTmL@YF-XvWv3yekI=Wiv2|~*`ULb=3 zunNTKU6=Liy^BV39tw!nX}&&a$~ew}>d*UbhpZ7&J`4zYT+{zpZY3$vaQYLQ7%V43 z>hPnIX|DKXcWT03LK#{iY7sm7HUjP52QsAsY?J*niNHHOgx@(H8v&L7ayy22R;$2o zH6ZApZpvz*(74>~egEq+?BE_bp3{|f>FL+-ExJwC86#^T{_1?}E~i7F_3Nykh|+WO zlvqFpG*mDd94K>xXnY~dZ6yKYYtH0YXPk0B@=-n*g! zmTf8I8?}yC{J(A1JtjJA260=3mU1t_yCnUA2o`?S{J0zbg=b+7iH-7j2^7)aS9csy z{>Go_0IDYt(8^@20sL19(z>;z!0f-i!=9OeMg;QS3I`cP&!t{X{`bjeO^5naFC3oO z?HXUyR-%_VvwGrmjjH*_78NV(XVn*=vDI!q*{GvdW1Ef3f#8S>=om{f(?T*xkIF%x z^b3ujJPjlW;R%#@>WRbQLu35rB-#@-x6cT-;-)`P>9RYonQr(;BigOh0^V&a zh6i3%t#Apm>u>V1q{5v(AUXUKAHWaH@MJGtJxG{VWndD0UnSsL zh80EH!}Hp4FLH*%YX$C~_DC85?g+2Wx9{uKR)T^k0=3uABy$b9zXN^ppM%kE0I77F z%YER)*o)l~WpiFfqs_7!vYuxIya&FIC)N77We=-CTcI==@HgND`Bt z=DpRCbSJ<>(dqK-NI+}8;K4!+$0Mv;4E;J9K_q=L;g6I<>$y1N(TOLoS6sz;K4ve%Y&UYZ%h=p-0_7DKqh3!H-ap|<(f77l z$5yW#j3_Yg>s%htlViE<7Wx@6rgwV|J>;+2Zy$ds= zmlfR^WMs_`n^(Cg`F4_3nw16xd_?iMtJovZ6rc~sIH*!AMygpkD{Nfqv|8jwfjEon z$eLqiq-21l#MAp(&6Qosk!xZSXw}UGe1?tD>P*XasB^!(pL1?yY5 z@etl0I54R=hZyp-ayqEoSdIW)1B^K-ECQpc{N3Ap>nu8DjZKt-YmP#p@9G-hc3LlAxa1|_xhD{+}x zqBL4re|kO@XF8Wl=;0FJrWR`$_)O>dh-cr2q9ii^t5yF%v)ma4ksTn`SvN0#*^}yNFT#>nVza+MY!yJ453a9xVUgb zLKvFtyg0tL|1thpyTgYu_{RFVKVY)n{X$NyxSk-QTDIT=yJ9^*tpy^+VL>5b1mS@2 zTiRBhOYjov4qO4Y+Q_PS3@@d}hBkJbfU70r-TBrhP~aAt#A6dyUlMQa*S{q{OxtJM zocK(I0T0^ockw%uaCj`LS(^SX`JzbR!GR=3QS@hN+pi`{+&pZ=gzB(z_Q47|LSh2PjzqJVH_9NF5*9~( zVY?eTinNJ*@{y#>c=TMnq(+kN95zxRjcU*-nmKGNXkrE~Rl1XBXo^<|04s@e4T$7; z3pNoVTTY*$2g1`B??r0pGLpl0xKHHkQoSpv{rZ{PZrLxo?AM5a|Ae#{hMO}N`U3^CmbQi07MHc!vge^bHE|nk?eSy1;}zG zGe5{hgp&605;_>+@Kx*7iu$$^W*6}XxBa1MX036L-B<+BdR^KG5Imyo^C*gB2; zqk<$Hy?Sj{l<2nhkY50*aeoS6$bUz`Qc4@BgAp&#_*jX!li9ykAfr<19U;UUzop;e zELS8(ShX&jOgYp5W1SX~`5=XQeK=)*J<7+7>o177(d`qnJ{(k}r*o|wJ{|0LOtE9W z#V9dtSGM9lfddS{T+?sAFoi-V9&Z;l*KoxG3d@{{>uv1Wh#b{U?p#cO_xGsxAI7 z)Ox9Rxb7em9+xS>kMN`csFljhWB_?+@rp>2>um(>LAdZg^FN^H-iuignm?d1joaBi zv3b=JPNwBBZh1p?%q+Y~$9#^t3prlO%jt6~e3q8il{Og2$9tHeMEm(6wNUlP02a_f({os6f>rnM7xH&e}wi9wUt**sW{L^zo zuP;%a{!`-u&5nsBCSLb#DVBy(MQ3e0%e^&Z1Oj1Cfai{u{W!o6;GT$ycqh(WL3rhw zO^)RxRA7XNby2^+itkJ_ypiMT4D=tWwwY>H*y{WEsu^qiFMM{PIxHIH4>r2tG(hpnh;A91k zLAH{6^;*8u4)lJb6^Mtf&JYnbRF#lKL=vYPqYt%@B2GkvkW><#5}QWL$@^C%UJ+2G z$)hj5b!6G^<{kq7aJHdLC-lRRB)!eLl5UI*wzL=JD7aB_CS%?^Al?iM7n3|$RZ$JX znkO0Bjz^y*1`|6!0G^NQl;)y1_j;;+TQ}1&IWyyt>+CiXjsproJ~|96GnF+A%_YP5 zk68dZX(wTUyC4a(L4pgmnNzgq)8SJhs>VLNhr>s+=yo(K3sNJ`rw1NjG~fn=hJ`Ro z!6l+_A0y@oSPZ6H``p7w8+P=_Re3kjoXPHoa?okSoycZ`EsjwRIQ_$;52%$x0RyMp zk?tpK{gR*f_-oImXeTQThH`k)0)to)yl&5sF^L~Sc<~QZi~V)$V{c}Yy586zc~)of z6?!(6-=msoiJB#RgAAs5{KRF@7QK+ScQqSH(WkD&bY7)-D0vx1K6*FyLp}YB?@=zO<_z|Zvi5z}CRHPrNT!_-eRXwez^M|3FA?`XfrG&ln%*pW z%Ue&1+Mmnqi*7y^mo1#u!Z~vusBsoSk51I+oqc_!Yqa4qe~#4GM7;44c+hoCqmxBH z1=v$=zL(;V+HA|q!GI6hWXobx3z`w0yP%^ft?Ry-^n88pBP$s!SxN(x+9YpLU`WnF z(Q4JnLSH_TDb(5+o0)8x8kzmfHaW{ESfzWNsTZso?ah3Zo>pp#-bnCfg0N6miI_(< zUHV7N6I>P1wIk(zH#zziV{H$~L0o;AU^ieC0ik*iyy)k^U-XYnIl;y>s9OxXd?%aj z44=rIVEO2hKxcy90S#4dR6;(KDSS%<^yM4B z^yR*}70@OI<5d7QUu;&s;84CVosLz~243CCz+wAt*gIr4;@g77hN+b zBFOJ49agdWqP*46ML_h-2wr`RBb80r zpoBciRhL`7arYl*cVk|>X@wRYW&<8B7nsh+C4Thh?Ke{Q9n|L-1=H)!r)y#-f-P4^ zfCf>9_(t-_)#0p~H5R|$sLu&}^GBZ-m#s;^?Bb8(WpY0!`EwrxU`U7_=RR+5 zZ*Xc&d>-pyL*Fe&+J1jM>Dt;sPP14DUnYg7qN}s7d6KvCb=GX zD7%oSDG7FWhkmU?0NmOi_O)z39b&oD&!#39k|6W7U`13tdSOwZO9F4hN(VP~x?^~Z zeAAw2b6Ud_i4)GN_!tD8dyz5w69%Gq6rn{2gkWRJoxs{W z=xz{^PYUCnL*Fj;cbNVzOn3l|-SARAwZqw0FP_w0uaA*;Vy~j3XL(q|75o+0Ab0H- zD-Xn1q?@^jTMurl4+}S*Ec^JDN9`_q&sTKYoi}Sc8#Z9(`VLl>w37Qn7cJ?5(Q z&7tvBx&t%GMriL#M3n;pzv)n-u2l4S(V^d2JvS6|2S@XQQx>p<<@3Y&I8ido;A56S z@!74{*i%O;BwWLjh@wUc{*oM7lJrs3_-PFs6B(%%5#L2cKJ3wY4A|?ggm2=s|JdF4 zcg6lGjHkS+qExGdr1Jg|%0aI7)TL}qIKWB39@{&~ySch7-We)f)r;B;+IDNPp~`jc zXP~Tp9S%P(0{jZzuZOGZUTj3l`;%;5V8>Eob6KRZli#EC$T9D4MlUwbDtyh*YJQ&5 z6?pFNc_CUuwXZerKuq|7{Tg->3wbLL#yJ|ae&j{!6v-LovW8Upvfz3XnRxP6x4l{x z$%ew>6WhjN_0epw+tD4`zkZiBe141i@-;@Cf&J6qZC-*xR8AocD_H zfH=_7&;0}TzTZj5jTwN8$l!V^Y<)|_uPTsEbsCK+%d9oBD!Lw0$$E?#4lj*8AXWPz zN1%C8h4zmJUrra|NXP~;;mQ(>5YM1*ZASyl@=Gc|vxE{oPkjF!tC1z2+6JWL_zpbV zn$?pud&3sqqO7V151c%uf)~BC=+&&3F$WwUbG)pGK935l-f%}w4U2hy+L__eExbke zBH)V^W^}QSdMax3ahf~N!{+9gp5C=kpvh&>&7l%2;9UwM(SB39sf_!SZhPLN5Vv59 z9}(lpVI%QD+>I;miB6j~nBawy<9=0gp9|~Gq*XS@ zTQ@d65IG(v+VcC0R~oc;NF;ms3d0$7L311{{XQM~d<1exm3)_i8(~FtK5QpR+&EKn zy0rEvNTSCcgL{W$`l7z2;zxZx@`4-jo%X!lFg#0`YU5YH%UhP}S#q+BmHub}-d2}l$--()jFtZx1;To>oIy{aDYpMIxCpSsXW`W!KL^ zWQdWF7rQo=4x3fh!JhUH*WdApE^15XY7&IIA^@&9L273AyfK zz-wsX;k(q&YW%ywPavPwPl3K0{m3z+9>^$IJUi#Cj2$+*HC^9}ptmpB^9^Tbf^&8- z9fBs311-n_dlEN!uQp^HO+-*lkh-^3CEow(rbbHm4g(y}g?abr7g3qE$4L+*C48#| zUh+sj4WvGK#2pJsJv6rKU#HDfB~c!r?hZ1#JKxS=iy6c1d)+H~o6|we26Bg20gc^U@_Gb|7NK}>xL%nxBQs&^xkrwF5 zuR4^YFxaW>e2gAjh`rJ8B?9{8MZs(Z1JrCAiOWKB9#B@fH~eAa&kGqC z4Mpl47q@Ixm*zMWI{XH7*4#1Fv0}5Lg6Yv*1nv9|!mEhn+Gk2&Y=*AugT82mZ?RBv zSSQQI+}{gcC4{CL8BmES@2Bi6q@NLBIQ*b|HQ>0UA1CH}6AI1n0J+&kIg>D)`_Tz? z*1=)6M6Srhz`fs2nar@Vgt~^!rw*pZ6}+U}madPE^Ym@{(6h6F$MvuIQ zmRp2`55lW-4g-42;SvLDmKH;BNUHk5g;wP(XGUv9p;+q%NRZnJc$@{;FVzZ7W&o|! zFP`sg83rXmOK^hw7@qV27O;KH3~v4sPP$5WK5i=M8GY$Z&fowI zzc|)oJa@nVR-UAE6@HnvM9c?S__wdo;ko7?-D7l7GYp+?%RXD3NP}~^35LFiZY}-> zB?GsG=c5WqVM`c$c`*ehy@6&${d(aKT@vZci}-Tb91$zw;>>;oTa|L%|7igpFSM`h zJ-?*Qy^FN*1m2M!2-CWcb z^v)eM_bD5C^TIOuGY)!UA@cl4o354mBTGC3=i3o)8FqhLA13(a%0>R$>bKn+d$z_TCXY)$g8!ZYMI&6yYM_}>>et~jX@vN3UZOcOzwf(B&7-m|1`8?l%R-cs3w(Nk9wWEY}@H!Ggys7iB`VG5G@8HbaRu^hm~z_YurP;xX`ZH$yf6aNHwMtlU}2 z9g+u~n>>w&_eF6V&MqqYzd{H=Wa3w$qw5xMJznBt?hF4UmH-ecT&53N%_vl{5Wf_%^X3z;Ct#0A!xS*e#Df&;~%TiF?h|hWGzlthdKTMQIR~rpEn47ba z+;38A_YX%+#);tt6iACa|KA{hi_~%+xsqBsw|fS$Jo`fh?qHeXE7T=Q4UQ@#}|C9KkS$S3=^8!d9H$ zHu&q)qS@73b@Y@adalXFT+FcD_n-ovy;XYyQI5tCk1AAJbhL%=NAu*IgbpsqFN&;> z5FZinOIrH1K9<{;LLbM7eWh=4X-fwA9#U_&7{1ekl^HkulXl0WaKk0S(5*Ctzn{3B z0(&i+N};*RxCMYeip_E*r8(!xEjwgU?ZYfiV%d7V@v0|aD}PF>6^)PJ<=#mJH{SAx zjm%9rL`|#E5e+eEL&Q(aL2RZ$ zs^y!A1FghZP%iV#RP8Ft_Pmf2I14^OkibYbIKdm5$}P44LVwBaXz-7H;GcSC9Kz51 zp8oF#ASUuoi^4D4s;?BcFCY0XGauS6E{iX4DUk{k_mARo0zZo!NX&ZzU2e{UesMCB z(Of^dCOcre(3EGV^;S3O@r%jdcblWa##psT+6YW=t&(fV>wgLg8J~SttiZ!fT!M&` z8+T!|xm%Xmy0#Bw57kI3p}$8Y4eqOfAA_>BP74sP!PfWpTYc zekbL~&s7C{sPQ82XiI6`wo^eAos^ULiBP)g2Z~ePwK~bdGy$B?_C)7!uODX=uY&bj z?8R_CH*K3R8IIKLXlq#Q+JIj8KZT3~*8C!1TI6|`4=yS{y1+uAl_F8!^!Iw7#2~W! zLRzH4hFm4~A0!{F8Pr=DziiWxe!xFv%`N-8#QV8%KYK~cjq-l9 z1InNZ=;F)uE>7>Ej&d%MK4R3PZQTJqt3}pQFW>=bTVWNh{&j?Q8Y*MELig2x=Hca= zNvv0ZefMAg+S*>K5_ls&yZ;R`{%Z^b$|OvE+HN8u5Efc%I;wyFBo5c=uejN{fzPxaF|tSBb+2!AvJo@Beda-zH>!(Xz zAd&lqNP0mAy@ZHg3yb$#j}BnBw$_9-8!pVfKXZ5t63WP4vfCdru+T%C4d)lXNtMX( zX*xY{TgYVA^afbi>A7lr)aC2bxPvyfDM|WXg4^F=Z)D$O^BwFsa=Nulx`l;*(*vCk z;>BT~4>sfSwW@4YP{%pCXL(8EGNIiVGckj`#mDz=-$tp78Jfv5p=w!_@B(9sr~gjlK`odJXg5NS6} z^V9hP@+wZNgPhsCGgz@gSma|wY&^Y1j90kc&)xt-;)9(-9MH_ZwPO<&x;#MJBDmXg z2W#p}39tNkI{I5DaiVxC#fv%6)3D&kuGt+d@wEl{A==&&IQbO_eV&q`DgzN*Cp717 zsWMW&T=HhW1+}0fUCOw~zfg1LkC(CbGShK(es8Xwc+mfNh$Q49*xM#7-=drd*LH+8 z-cgb+kqf|JZ{$WY@uQgTd!=r%eyh7#J;UcYzvnX)l1?`dG$B;ua}>Zh9i^I_u$1cr3u^!D^uzBsgoDyb@kyIbSTz4RaY;Gwr3%_TKK zfV#{Z1#Ckg>3f|Ht(|jWD29N}_IAF0%?%Ec%NT9^Q?Ja>z-_m(gvTSiH&@+`!J)us zQU{y$D6gX=g@iKjh0`=$9?Vu91dfc?U2+F74DN^bStuu!YTC37IoKnyvj;ogzXtOw zQLI`I$9AstTyfg*p+D!O!nM`xq?q{$p+CP1`zG>ca!Ts?2oGGOu5T{A`Z7M4a6yke zD(GR@#wy-U!OBtCR)Ko@cmYZTE<9lr?Z-UscVTgKs3a==C-{-hWaS3@PI-nY1g|`? z(33>yV4y`BQ&yWHHQucqpAB;ZOGGf62a`OjvOJ@-+j7N-CEF2!Q}TamT< zv@DC|V;j5+bf{b={66-$Q20mqTx;+m_sJk&FP<`FI&LPHM#%N zsnY))V)<{T_V?K2ckUXrPJHC4rXA0DHeoSZA2_`a>KGJX&QhR|QAr(OgEM>B*XMQ5 zA`=-Z*UHbz+HHdeG3Ujq4^$%T=61YnKi6yaSy8fKQYX6gWLPqgQi|66 zbkg^4I(?*W$-c%}}Y_^+|w81m; zjm1-47j2wie4#miW~HdgR?Dk#aikSeaqI6=vD|Ar{JlOgK_E8Pc^?G*by4k|m>m0n z{BEL?0U5tMH`L6}6%wz(pxIi%aEDn=lR6$AUB;}|8Vg&US3JPlT5s6xsKjj7*I>H!z{ckBZ)4Ns-MTR(73loWNY)}DaKr78 zBUWA>OOABCh=9AEM`_9VudpJbvF7V0lerWWA7v_L0<&p*e(!7kgJY4r^h1Tv&jbh@-rp6~H1syKQ_K@nqNmcx?k6GvD| zs+^%oO4k*um4LP0%Cfj5;O-bUv4VA(XfNn(LM?q zuO;aj=dcWfzDPa{J30yqw0Ca^-TYqU`!!=Bm-KQ<4IX;g=J(4+Z0-NP;RE&|ky0kd zE?e$);WJj0!yBN1sp~`pzA6S`=C6`f_uC+9Iv~T1J;c2*aa;=tb-8z!Mu(oNvi{Zb z!@WCd)_<6DsyujqjWVcbkvsRY@o9duG8q0w9`nBVcU+TM#J@9ncJs7q#ahFw#;AyOWMG zk3<4x54S4$GVS@-9dpgx7M7pAAcbwB%JRyfyH*KSq=(x+3@KZEOnO6^EjJWNYm1bz z{&u!a3=kqu>#R;&hJsP;Sle%B$%H<+tk6c|qc;VEwz1dZ20%hf0iL}qxeE#h#ek!s zILtJ*F905q%X>HpJ4Dr*cen&-VvKZ!LvB#OR5g+I7o2$pH#M!-j$1rZ1Aba|g1(0v z0*(}4pT)L@>A`<_3GkE7B`qBaKBhV^w;W?9jXhAj>*>sJ>RV}BMO+y}=XFO4n*xA^ zZ35i{aY1||D0FSunON^`s#_6kt`Lr?n&6`;WoR$|^<{;;<6j?I%Y*cz<)xR^!euj!(Z~F}BV%|m{%{wynuDJ)W zUJP5ac7qFTyv>Z+a6qeB8LJ_aCDszowFWjQX==d z@4SyRFRK%m`|Z8(kS#0k1thm8YJ|uK&!gvhus4+9&0_5Qoi1>F!4II6>|UZ&LV87m zW%8Rs*J4j*>Cu}A4*8RRWtzg)ZGlqI79sZAvw(0y4$&7bzxyH#rp?RO^Be6{C!xFS zA2-F#(r~(9+?e<{n|NSr zy|ipb9lC@#TJe}5DoneW0oRG6a4c!q{QKh~68G#HX;>Yq6@txxMNYIi6q^PN8zsh) zdPL3ZCcbM8;X`F-#`f&gGsX^K3U(z~@yt0*O=dla6-(g5q=PMa?w|3x!!A zTo^GM?ce1%kBtz%$-3AO+WXGBi(!oZ)?3*=Hd{K5@)0`bIIPKwTfE$8Q}>_R@(tl@ zYH~_)Oz~%=Op%Spv8B=x3O}UiI=FKtzcjS6op!1>kWg3*Vi3$-xWtzz6NYNc?ZX=p zSJ#-qPT8YeAzZUfB#UPFo_r~okm%&~c={?4xaa=1gGwO!U{BweSz7Qk`z5oL5F@Dd z_kz)Wt1C<|t8fa*Kg<5=(u^(ENqJ!7`;IMy;Ci>E<4D4?!dU=?TWYvsk7mA%t3K^Mu z&(wkOH5rxBO5E2~UTW|3i!lgcVr#~Q<%+_k%~&VV6cUa_m-1^PNx?3+96Olq?$jmh zap~0CFO#F;a#K(t=L81^^M^s|7f=lPPEg7DJhtDR%DDVgAK_US + +[Threats, Risks, and Mitigations in the Open Source Ecosystem]: https://github.com/Open-Source-Security-Coalition/Open-Source-Security-Coalition/blob/master/publications/threats-risks-mitigations/v1.1/Threats%2C%20Risks%2C%20and%20Mitigations%20in%20the%20Open%20Source%20Ecosystem%20-%20v1.1.pdf +[Binary Authorization for Borg]: https://cloud.google.com/docs/security/binary-authorization-for-borg From 79fdfe1a15d54cfd4b6d1626b69678ce52733aeb Mon Sep 17 00:00:00 2001 From: Joshua Lock Date: Mon, 10 Jul 2023 20:24:37 +0100 Subject: [PATCH 15/26] impl: update renovate config for conventional commits (#911) Update the renovate configuration so that patches and PRs from renovate follow the project's conventional commit guidelines. Fixes: #910 Signed-off-by: Joshua Lock --- renovate.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 93c541136..68d94b847 100644 --- a/renovate.json +++ b/renovate.json @@ -9,5 +9,6 @@ "matchManagers": ["github-actions"], "groupName": "github-actions" } - ] + ], + "commitMessagePrefix": "impl:" } From 2f22cf395bdfba1f633896133152ac36133f5d57 Mon Sep 17 00:00:00 2001 From: Mend Renovate Date: Tue, 11 Jul 2023 18:14:57 +0200 Subject: [PATCH 16/26] impl: Update github-actions (#909) This PR contains the following updates: actions/deploy-pages: `v2.0.2` -> `v2.0.3` actions/setup-node: `v3.6.0` -> `v3.7.0` actions/upload-pages-artifact: `v1.0.9` -> `v1.0.10 Signed-off-by: Mend Renovate --- .github/workflows/deploy_website.yml | 4 ++-- .github/workflows/lint.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy_website.yml b/.github/workflows/deploy_website.yml index 9caf30786..2ca2255d0 100644 --- a/.github/workflows/deploy_website.yml +++ b/.github/workflows/deploy_website.yml @@ -23,7 +23,7 @@ jobs: with: source: ./docs - name: Upload build artifacts for deploying - uses: actions/upload-pages-artifact@66b63f4a7de003f4f00cc8e9af4b83b8f2abdb96 # v1.0.9 + uses: actions/upload-pages-artifact@84bb4cd4b733d5c320c9c9cfbc354937524f4d64 # v1.0.10 deploy: permissions: @@ -37,4 +37,4 @@ jobs: steps: - name: Deploy Website id: deployment - uses: actions/deploy-pages@ee48c7b82e077d7b8ef30b50a719e6a792a50c9a # v2.0.2 + uses: actions/deploy-pages@12ab2b16cf43a7a061fe99da74b6f8f11fb77f5b # v2.0.3 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index d50a1a1f0..d4dbda9c4 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -8,7 +8,7 @@ jobs: - name: Checkout uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Setup Node - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0 + uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0 - run: npm ci --ignore-scripts - run: npm run lint --silent - run: ./lint.sh From 4cde2550366af5aa43a3fefb97843bfedda1ba66 Mon Sep 17 00:00:00 2001 From: Andrew McNamara Date: Tue, 11 Jul 2023 12:20:58 -0400 Subject: [PATCH 17/26] impl: Remove dashes from types in PR name lint (#903) Dashes are not supported by the GitHub Action PR linter we use: https://github.com/amannn/action-semantic-pull-request resolves: #902 Signed-off-by: arewm --- .github/workflows/enforce-tags.yml | 6 +++--- CONTRIBUTING.md | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/enforce-tags.yml b/.github/workflows/enforce-tags.yml index e9bf96ea3..bdc71d8f5 100644 --- a/.github/workflows/enforce-tags.yml +++ b/.github/workflows/enforce-tags.yml @@ -16,8 +16,8 @@ jobs: uses: amannn/action-semantic-pull-request@c3cd5d1ea3580753008872425915e343e351ab54 # v5.2.0 with: types: | - spec-content - spec-editorial - non-spec + content + editorial + nonspec style impl diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 10c5bebe1..f38efebc9 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -92,15 +92,15 @@ Review process: | Tag | Description | Waiting period | # Approvers | |---|---|---|---| -| `spec-content` | A change to the meaning of the specification | 72h | 3 | -| `spec-editorial` | A clarification to the specification that does not change its meaning | 24h | 2 | -| `non-spec` | A change to a non-specification page. | 24h | 2 | +| `content` | A change to the meaning of the specification | 72h | 3 | +| `editorial` | A clarification to the specification that does not change its meaning | 24h | 2 | +| `nonspec` | A change to a non-specification page. | 24h | 2 | | `style` | A user-visible style or layout change. No context changes. | 0h | 1 | | `impl` | A user-invisible change, such as editing a README or the repo configuration. | 0h | 1 | Note: PR authors with write access to the repo count as second or third approvers for their own PRs. For example, if the author of a PR with the -`spec-content` tag has write access to to the repo, then the PR only requires +`content` tag has write access to the repo, then the PR only requires two additional approvers before merging. However, a PR with the `impl` tag always requires one reviewer, even if the author has write access. From c0e01a120d8f3cf4be020c9cbc6490c60069ac2a Mon Sep 17 00:00:00 2001 From: Mark Lodato Date: Tue, 11 Jul 2023 15:59:35 -0400 Subject: [PATCH 18/26] nonspec: community meeting is no longer biweekly (#906) Update the list of meeting notes on slsa.dev/notes to no longer say "bi-weekly". Signed-off-by: Mark Lodato --- docs/notes/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/notes/index.md b/docs/notes/index.md index f45a5e53e..74efdc2c7 100644 --- a/docs/notes/index.md +++ b/docs/notes/index.md @@ -10,7 +10,7 @@ meeting link, etc. at the top. URL | Alias | Meeting ------------------------------ | ------------ | --------------------------- -[community](community) | | Bi-weekly community meeting +[community](community) | | General community meeting [positioning](positioning) | | Positioning SIG [specification](specification) | [spec](spec) | Specification SIG [tooling](tooling) | | Tooling SIG From d0ef5f44773fcfc967c2ecd52a9b03ad1348ff5a Mon Sep 17 00:00:00 2001 From: kpk47 Date: Tue, 11 Jul 2023 16:30:35 -0700 Subject: [PATCH 19/26] grammar/clarity edits Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index abde666f0..a59aab7ee 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -46,10 +46,10 @@ attestations the `verifier` used to make its determination. VSAs can also be chained together to meet higher level goals, such as tracking the verified SLSA level(s) for the `subject`'s transitive dependencies. Rather than verifying provenance for the artifact and each of its transitive -dependencies all at once, the verifier can verify each one independently and -produce VSAs. Finally, the verifier combines those VSAs, with the artifact acting -as the final VSA's `subject` and each transitive dependency being an entry in -`dependencyLevels`. +dependencies all at once, the verifier can verify each dependency independently +and produce VSAs. Finally, the verifier combines those VSAs; the artifact +is the final VSA's `subject` and each transitive dependency is an +entry in `dependencyLevels`. ## Schema From f2e1d11b8a716081140ccc41a12127b3f0531312 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Tue, 11 Jul 2023 16:45:18 -0700 Subject: [PATCH 20/26] Added changelog for this PR Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index a59aab7ee..f383e328a 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -372,7 +372,11 @@ with `SLSA_`. ## Change history -- 1: +- 1.1: + - Added Verification section with examples. + - Made `policy` optional. + - Made `timeVerified` optional. +- 1.0: - Replaced `materials` with `resolvedDependencies`. - Relaxed `SlsaResult` to allow other values. - Converted to lowerCamelCase for consistency with [SLSA Provenance]. From a219938f8848e5b308661b0e837f6be338220503 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Tue, 11 Jul 2023 16:48:01 -0700 Subject: [PATCH 21/26] lint Signed-off-by: kpk47 --- docs/verification_summary/v1.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/verification_summary/v1.md b/docs/verification_summary/v1.md index f383e328a..dc4d25cb0 100644 --- a/docs/verification_summary/v1.md +++ b/docs/verification_summary/v1.md @@ -374,8 +374,8 @@ with `SLSA_`. - 1.1: - Added Verification section with examples. - - Made `policy` optional. - - Made `timeVerified` optional. + - Made `policy` optional. + - Made `timeVerified` optional. - 1.0: - Replaced `materials` with `resolvedDependencies`. - Relaxed `SlsaResult` to allow other values. From 1febf58e812525542f33be6e4343aa89b3d695e3 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Tue, 5 Sep 2023 15:45:53 -0700 Subject: [PATCH 22/26] move changes to v1.1 directory Signed-off-by: kpk47 --- docs/spec/v1.0/verification_summary.md | 185 +++++------------------ docs/spec/v1.1/verification_summary.md | 201 +++++++++++++++++++------ 2 files changed, 193 insertions(+), 193 deletions(-) diff --git a/docs/spec/v1.0/verification_summary.md b/docs/spec/v1.0/verification_summary.md index e2efdbe9d..eff9e3302 100644 --- a/docs/spec/v1.0/verification_summary.md +++ b/docs/spec/v1.0/verification_summary.md @@ -4,9 +4,8 @@ description: SLSA v1.0 specification for a verification summary of artifacts by layout: standard --- -Verification summary attestations convey high-level information about an -artifact's verification, allowing consumers to delegate verification decisions -to trusted third parties. +Verification summary attestations communicate that an artifact has been verified +at a specific SLSA level and details about that verification. This document defines the following predicate type within the [in-toto attestation] framework: @@ -22,17 +21,17 @@ attestation] framework: ## Purpose -Assert that the verifier has verified an artifact or set of artifacts. Optionally -include details about the verification process, such as the verified SLSA -level(s) and the verifier's expectations. +Describe what SLSA level an artifact or set of artifacts was verified at +and other details about the verification process including what SLSA level +the dependencies were verified at. -VSAs allow software consumers to make a decision about the validity of an +This allows software consumers to make a decision about the validity of an artifact without needing to have access to all of the attestations about the -artifact or all of its transitive dependencies. Consumers can use VSAs to delegate +artifact or all of its transitive dependencies. They can use it to delegate complex policy decisions to some trusted party and then simply trust that party's decision regarding the artifact. -VSAs also allow software producers to keep the details of their build pipeline +It also allows software producers to keep the details of their build pipeline confidential while still communicating that some verification has taken place. This might be necessary for legal reasons (keeping a software supplier confidential) or for security reasons (not revealing that an embargoed patch has @@ -42,20 +41,23 @@ been included). A Verification Summary Attestation (VSA) is an attestation that some entity (`verifier`) verified one or more software artifacts (the `subject` of an -in-toto attestation [Statement]) by evaluating the artifact and its associated -attestation(s) against the `policy` for `resourceUri`. Consumers who trust -the `verifier` may assume that the artifacts identified by the -`(subject, resourceUri)` pair met the indicated SLSA level without -themselves needing to evaluate the artifact or to have access to the -attestations the `verifier` used to make its determination. - -VSAs can also be chained together to meet higher level goals, such as tracking -the verified SLSA level(s) for the `subject`'s transitive dependencies. Rather -than verifying provenance for the artifact and each of its transitive -dependencies all at once, the verifier can verify each dependency independently -and produce VSAs. Finally, the verifier combines those VSAs; the artifact -is the final VSA's `subject` and each transitive dependency is an -entry in `dependencyLevels`. +in-toto attestation [Statement]) by evaluating the artifact and a `bundle` +of attestations against some `policy`. Users who trust the `verifier` may +assume that the artifacts met the indicated SLSA level without themselves +needing to evaluate the artifact or to have access to the attestations the +`verifier` used to make its determination. + +The VSA also allows consumers to determine the verified levels of +all of an artifact’s _transitive_ dependencies. The verifier does this by +either a) verifying the provenance of each non-source dependency listed in +the [resolvedDependencies](/provenance/v1#resolvedDependencies) of the artifact +being verified (recursively) or b) matching the non-source dependency +listed in `resolvedDependencies` (`subject.digest` == +`resolvedDependencies.digest` and, ideally, `vsa.resourceUri` == +`resolvedDependencies.uri`) to a VSA _for that dependency_ and using +`vsa.verifiedLevels` and `vsa.dependencyLevels`. Policy verifiers wishing +to establish minimum requirements on dependencies SLSA levels may use +`vsa.dependencyLevels` to do so. ## Schema @@ -127,7 +129,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > can sign provenance for the "Google Cloud Deploy" verifier, but "GitHub" cannot > sign for the "Google Cloud Deploy" verifier. > -> This field is required, even if it is implicit from the signer, to aid readability and +> The field is required, even if it is implicit from the signer, to aid readability and > debugging. It is an object to allow additional fields in the future, in case one > URI is not sufficient. @@ -137,7 +139,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > URI indicating the verifier’s identity. -`timeVerified` _string ([Timestamp]), optional_ +`timeVerified` _string ([Timestamp]), required_ > Timestamp indicating what time the verification occurred. @@ -145,19 +147,13 @@ of the other top-level fields, such as `subject`, see [Statement]._ `resourceUri` _string ([ResourceURI]), required_ > URI that identifies the resource associated with the artifact being verified. -> -> This field is required to prevent confusion attacks. E.g., a VSA indicating -> that a package can be published as `foo` should not be usable to publish -> the package as `bar`; a VSA indicating that a package passed the policy for -> a `dev` environment should not be usable to deploy the package to a `prod` -> environment. -`policy` _object ([ResourceDescriptor]), optional_ +`policy` _object ([ResourceDescriptor]), required_ > Describes the policy that the `subject` was verified against. > -> This field is RECOMMENDED. +> The entry MUST contain a `uri`. `inputAttestations` _array ([ResourceDescriptor]), optional_ @@ -183,17 +179,10 @@ of the other top-level fields, such as `subject`, see [Statement]._ > Indicates the highest level of each track verified for the artifact (and not > its dependencies), or "FAILED" if policy verification failed. > -> VSA producers MUST NOT include more than one level per SLSA track. Note that -> each SLSA level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies +> Users MUST NOT include more than one level per SLSA track. Note that each SLSA +> level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies > SLSA_BUILD_LEVEL_2 and SLSA_BUILD_LEVEL_1), so there is no need to > include more than one level per track. -> -> VSA producers MAY add additional, non-SLSA properties to this field provided -> the values do not conflict with the definition of [SlsaResult]. VSA Producers -> SHOULD negotiate the meaning of such properties with their intended verifier. -> -> This field MAY be absent if the verifier is not attesting to a specific SLSA -> level. `dependencyLevels` _object, optional_ @@ -204,8 +193,8 @@ of the other top-level fields, such as `subject`, see [Statement]._ > that were verified at the indicated level. Absence of a given level of > [SlsaResult] MUST be interpreted as reporting _0_ dependencies at that level. > -> VSA producers MUST count each dependency only once per SLSA track, at the -> highest level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, +> Users MUST count each dependency only once per SLSA track, at the highest +> level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, > you include it with the count for SLSA_BUILD_LEVEL_2 but not the count for >SLSA_BUILD_LEVEL_1. @@ -258,103 +247,6 @@ WARNING: This is just for demonstration purposes.

-## How to verify - -Consumers use VSAs to accomplish goals based on delegated trust. We call the -process of establishing a VSA's authenticity and determining whether it meets -the consumer's goals 'verification'. Goals differ, as do levels of confidence -in VSA producers, so the verification procedure changes to suit its context. -However, there are certain steps that most verification procedures have in -common. - -Verification MUST include the following steps: - -1. Verify the signature on the VSA envelope using the preconfigured roots of - trust. This step ensures that the VSA was produced by a trusted producer - and that it hasn't been tampered with. - -2. Verify the statement's `subject` matches the digest of the artifact in - question. This step ensures that the VSA pertains to the intended artifact. - -3. Verify that the `predicateType` is - `https://slsa.dev/verification_summary/v1`. This step ensures that the - in-toto predicate is using this version of the VSA format. - -4. Verify that the `verifier` matches the public key (or equivalent) used to - verify the signature in step 1. This step identifies the VSA producer in - cases where their identity is not implicitly revealed in step 1. - -5. Verify that the value for `resourceUri` in the VSA matches the expected - value. This step ensures that the consumer is using the VSA for the - producer's intended purpose. - -6. Verify that the value for `slsaResult` is `PASSED`. This step ensures the - artifact is suitable for the consumer's purposes. - -7. Verify that `verifiedLevels` contains the expected value. This step ensures - that the artifact is suitable for the consumer's purposes. - -Verification MAY additionally contain the following step: - -1. (Optional) Verify additional fields required to determine whether the VSA - meets your goal. - -Verification mitigates different threats depending on the VSA's contents and the -verification procudure. - -IMPORTANT: A VSA does not protect against compromise of the verifier, such as by -a malicious insider. Instead, VSA consumers SHOULD carefully consider which -verifiers they add to their roots of trust. - -### Examples - -1. Suppose consumer C wants to delegate to verifier V the decision for whether - to accept artifact A as resource R. Consumer C verifies that: - - - The signature on the VSA envelope using V's public signing key from their - preconfigured root of trust. - - - `subject` is A. - - - `predicateType` is `https://slsa.dev/verification_summary/v1`. - - - `verifier.id` is V. - - - `resourceUri` is R. - - - `slsaResult` is `PASSED`. - - - `verifiedLevels` contains `SLSA_BUILD_LEVEL_UNEVALUATED`. - - Note: This example is analogous to traditional code signing. The expected - value for `verifiedLevels` is arbitrary but prenegotiated by the producer and - the consumer. The consumer does not need to check additional fields, as C - fully delegates the decision to V. - -2. Suppose consumer C wants to enforce the rule "Artifact A at resource R must - have a passing VSA from verifier V showing it meets SLSA Build Level 2+." - Consumer C verifies that: - - - The signature on the VSA envelope using V's public signing key from their - preconfigured root of trust. - - - `subject` is A. - - - `predicateType` is `https://slsa.dev/verification_summary/v1`. - - - `verifier.id` is V. - - - `resourceUri` is R. - - - `slsaResult` is `PASSED`. - - - `verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. - - Note: In this example, verifying the VSA mitigates the same threats as - verifying the artifact's SLSA provenance. See - [Verifying artifacts](/spec/v1.0/verifying-artifacts) for details about which - threats are addressed by verifying each SLSA level. - ## _SlsaResult (String)_
@@ -362,7 +254,6 @@ verifiers they add to their roots of trust. The result of evaluating an artifact (or set of artifacts) against SLSA. SHOULD be one of these values: -- SLSA_BUILD_LEVEL_UNEVALUATED - SLSA_BUILD_LEVEL_0 - SLSA_BUILD_LEVEL_1 - SLSA_BUILD_LEVEL_2 @@ -373,16 +264,12 @@ Note that each SLSA level implies the levels below it. For example, SLSA_BUILD_LEVEL_3 means (SLSA_BUILD_LEVEL_1 + SLSA_BUILD_LEVEL_2 + SLSA_BUILD_LEVEL_3). -VSA producers MAY use custom values here but MUST NOT use custom values starting -with `SLSA_`. +Users MAY use custom values here but MUST NOT use custom values starting with +`SLSA_`. ## Change history -- 1.1: - - Added Verification section with examples. - - Made `policy` optional. - - Made `timeVerified` optional. -- 1.0: +- 1: - Replaced `materials` with `resolvedDependencies`. - Relaxed `SlsaResult` to allow other values. - Converted to lowerCamelCase for consistency with [SLSA Provenance]. diff --git a/docs/spec/v1.1/verification_summary.md b/docs/spec/v1.1/verification_summary.md index b2724c7f8..e2efdbe9d 100644 --- a/docs/spec/v1.1/verification_summary.md +++ b/docs/spec/v1.1/verification_summary.md @@ -4,8 +4,9 @@ description: SLSA v1.0 specification for a verification summary of artifacts by layout: standard --- -Verification summary attestations communicate that an artifact has been verified -at a specific SLSA level and details about that verification. +Verification summary attestations convey high-level information about an +artifact's verification, allowing consumers to delegate verification decisions +to trusted third parties. This document defines the following predicate type within the [in-toto attestation] framework: @@ -21,17 +22,17 @@ attestation] framework: ## Purpose -Describe what SLSA level an artifact or set of artifacts was verified at -and other details about the verification process including what SLSA level -the dependencies were verified at. +Assert that the verifier has verified an artifact or set of artifacts. Optionally +include details about the verification process, such as the verified SLSA +level(s) and the verifier's expectations. -This allows software consumers to make a decision about the validity of an +VSAs allow software consumers to make a decision about the validity of an artifact without needing to have access to all of the attestations about the -artifact or all of its transitive dependencies. They can use it to delegate +artifact or all of its transitive dependencies. Consumers can use VSAs to delegate complex policy decisions to some trusted party and then simply trust that party's decision regarding the artifact. -It also allows software producers to keep the details of their build pipeline +VSAs also allow software producers to keep the details of their build pipeline confidential while still communicating that some verification has taken place. This might be necessary for legal reasons (keeping a software supplier confidential) or for security reasons (not revealing that an embargoed patch has @@ -41,23 +42,20 @@ been included). A Verification Summary Attestation (VSA) is an attestation that some entity (`verifier`) verified one or more software artifacts (the `subject` of an -in-toto attestation [Statement]) by evaluating the artifact and a `bundle` -of attestations against some `policy`. Users who trust the `verifier` may -assume that the artifacts met the indicated SLSA level without themselves -needing to evaluate the artifact or to have access to the attestations the -`verifier` used to make its determination. - -The VSA also allows consumers to determine the verified levels of -all of an artifact’s _transitive_ dependencies. The verifier does this by -either a) verifying the provenance of each non-source dependency listed in -the [resolvedDependencies](/provenance/v1#resolvedDependencies) of the artifact -being verified (recursively) or b) matching the non-source dependency -listed in `resolvedDependencies` (`subject.digest` == -`resolvedDependencies.digest` and, ideally, `vsa.resourceUri` == -`resolvedDependencies.uri`) to a VSA _for that dependency_ and using -`vsa.verifiedLevels` and `vsa.dependencyLevels`. Policy verifiers wishing -to establish minimum requirements on dependencies SLSA levels may use -`vsa.dependencyLevels` to do so. +in-toto attestation [Statement]) by evaluating the artifact and its associated +attestation(s) against the `policy` for `resourceUri`. Consumers who trust +the `verifier` may assume that the artifacts identified by the +`(subject, resourceUri)` pair met the indicated SLSA level without +themselves needing to evaluate the artifact or to have access to the +attestations the `verifier` used to make its determination. + +VSAs can also be chained together to meet higher level goals, such as tracking +the verified SLSA level(s) for the `subject`'s transitive dependencies. Rather +than verifying provenance for the artifact and each of its transitive +dependencies all at once, the verifier can verify each dependency independently +and produce VSAs. Finally, the verifier combines those VSAs; the artifact +is the final VSA's `subject` and each transitive dependency is an +entry in `dependencyLevels`. ## Schema @@ -129,7 +127,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > can sign provenance for the "Google Cloud Deploy" verifier, but "GitHub" cannot > sign for the "Google Cloud Deploy" verifier. > -> The field is required, even if it is implicit from the signer, to aid readability and +> This field is required, even if it is implicit from the signer, to aid readability and > debugging. It is an object to allow additional fields in the future, in case one > URI is not sufficient. @@ -139,7 +137,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > URI indicating the verifier’s identity. -`timeVerified` _string ([Timestamp]), required_ +`timeVerified` _string ([Timestamp]), optional_ > Timestamp indicating what time the verification occurred. @@ -147,13 +145,19 @@ of the other top-level fields, such as `subject`, see [Statement]._ `resourceUri` _string ([ResourceURI]), required_ > URI that identifies the resource associated with the artifact being verified. +> +> This field is required to prevent confusion attacks. E.g., a VSA indicating +> that a package can be published as `foo` should not be usable to publish +> the package as `bar`; a VSA indicating that a package passed the policy for +> a `dev` environment should not be usable to deploy the package to a `prod` +> environment. -`policy` _object ([ResourceDescriptor]), required_ +`policy` _object ([ResourceDescriptor]), optional_ > Describes the policy that the `subject` was verified against. > -> The entry MUST contain a `uri`. +> This field is RECOMMENDED. `inputAttestations` _array ([ResourceDescriptor]), optional_ @@ -179,10 +183,17 @@ of the other top-level fields, such as `subject`, see [Statement]._ > Indicates the highest level of each track verified for the artifact (and not > its dependencies), or "FAILED" if policy verification failed. > -> Users MUST NOT include more than one level per SLSA track. Note that each SLSA -> level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies +> VSA producers MUST NOT include more than one level per SLSA track. Note that +> each SLSA level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies > SLSA_BUILD_LEVEL_2 and SLSA_BUILD_LEVEL_1), so there is no need to > include more than one level per track. +> +> VSA producers MAY add additional, non-SLSA properties to this field provided +> the values do not conflict with the definition of [SlsaResult]. VSA Producers +> SHOULD negotiate the meaning of such properties with their intended verifier. +> +> This field MAY be absent if the verifier is not attesting to a specific SLSA +> level. `dependencyLevels` _object, optional_ @@ -193,8 +204,8 @@ of the other top-level fields, such as `subject`, see [Statement]._ > that were verified at the indicated level. Absence of a given level of > [SlsaResult] MUST be interpreted as reporting _0_ dependencies at that level. > -> Users MUST count each dependency only once per SLSA track, at the highest -> level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, +> VSA producers MUST count each dependency only once per SLSA track, at the +> highest level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, > you include it with the count for SLSA_BUILD_LEVEL_2 but not the count for >SLSA_BUILD_LEVEL_1. @@ -235,7 +246,7 @@ WARNING: This is just for demonstration purposes. } ], "verificationResult": "PASSED", - "verifiedLevels": ["SLSA_LEVEL_3"], + "verifiedLevels": ["SLSA_BUILD_LEVEL_3"], "dependencyLevels": { "SLSA_BUILD_LEVEL_3": 5, "SLSA_BUILD_LEVEL_2": 7, @@ -247,6 +258,103 @@ WARNING: This is just for demonstration purposes.
+## How to verify + +Consumers use VSAs to accomplish goals based on delegated trust. We call the +process of establishing a VSA's authenticity and determining whether it meets +the consumer's goals 'verification'. Goals differ, as do levels of confidence +in VSA producers, so the verification procedure changes to suit its context. +However, there are certain steps that most verification procedures have in +common. + +Verification MUST include the following steps: + +1. Verify the signature on the VSA envelope using the preconfigured roots of + trust. This step ensures that the VSA was produced by a trusted producer + and that it hasn't been tampered with. + +2. Verify the statement's `subject` matches the digest of the artifact in + question. This step ensures that the VSA pertains to the intended artifact. + +3. Verify that the `predicateType` is + `https://slsa.dev/verification_summary/v1`. This step ensures that the + in-toto predicate is using this version of the VSA format. + +4. Verify that the `verifier` matches the public key (or equivalent) used to + verify the signature in step 1. This step identifies the VSA producer in + cases where their identity is not implicitly revealed in step 1. + +5. Verify that the value for `resourceUri` in the VSA matches the expected + value. This step ensures that the consumer is using the VSA for the + producer's intended purpose. + +6. Verify that the value for `slsaResult` is `PASSED`. This step ensures the + artifact is suitable for the consumer's purposes. + +7. Verify that `verifiedLevels` contains the expected value. This step ensures + that the artifact is suitable for the consumer's purposes. + +Verification MAY additionally contain the following step: + +1. (Optional) Verify additional fields required to determine whether the VSA + meets your goal. + +Verification mitigates different threats depending on the VSA's contents and the +verification procudure. + +IMPORTANT: A VSA does not protect against compromise of the verifier, such as by +a malicious insider. Instead, VSA consumers SHOULD carefully consider which +verifiers they add to their roots of trust. + +### Examples + +1. Suppose consumer C wants to delegate to verifier V the decision for whether + to accept artifact A as resource R. Consumer C verifies that: + + - The signature on the VSA envelope using V's public signing key from their + preconfigured root of trust. + + - `subject` is A. + + - `predicateType` is `https://slsa.dev/verification_summary/v1`. + + - `verifier.id` is V. + + - `resourceUri` is R. + + - `slsaResult` is `PASSED`. + + - `verifiedLevels` contains `SLSA_BUILD_LEVEL_UNEVALUATED`. + + Note: This example is analogous to traditional code signing. The expected + value for `verifiedLevels` is arbitrary but prenegotiated by the producer and + the consumer. The consumer does not need to check additional fields, as C + fully delegates the decision to V. + +2. Suppose consumer C wants to enforce the rule "Artifact A at resource R must + have a passing VSA from verifier V showing it meets SLSA Build Level 2+." + Consumer C verifies that: + + - The signature on the VSA envelope using V's public signing key from their + preconfigured root of trust. + + - `subject` is A. + + - `predicateType` is `https://slsa.dev/verification_summary/v1`. + + - `verifier.id` is V. + + - `resourceUri` is R. + + - `slsaResult` is `PASSED`. + + - `verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. + + Note: In this example, verifying the VSA mitigates the same threats as + verifying the artifact's SLSA provenance. See + [Verifying artifacts](/spec/v1.0/verifying-artifacts) for details about which + threats are addressed by verifying each SLSA level. + ## _SlsaResult (String)_
@@ -254,6 +362,7 @@ WARNING: This is just for demonstration purposes. The result of evaluating an artifact (or set of artifacts) against SLSA. SHOULD be one of these values: +- SLSA_BUILD_LEVEL_UNEVALUATED - SLSA_BUILD_LEVEL_0 - SLSA_BUILD_LEVEL_1 - SLSA_BUILD_LEVEL_2 @@ -264,12 +373,16 @@ Note that each SLSA level implies the levels below it. For example, SLSA_BUILD_LEVEL_3 means (SLSA_BUILD_LEVEL_1 + SLSA_BUILD_LEVEL_2 + SLSA_BUILD_LEVEL_3). -Users MAY use custom values here but MUST NOT use custom values starting with -`SLSA_`. +VSA producers MAY use custom values here but MUST NOT use custom values starting +with `SLSA_`. ## Change history -- 1: +- 1.1: + - Added Verification section with examples. + - Made `policy` optional. + - Made `timeVerified` optional. +- 1.0: - Replaced `materials` with `resolvedDependencies`. - Relaxed `SlsaResult` to allow other values. - Converted to lowerCamelCase for consistency with [SLSA Provenance]. @@ -281,11 +394,11 @@ Users MAY use custom values here but MUST NOT use custom values starting with [SLSA Provenance]: /provenance [SlsaResult]: #slsaresult -[DigestSet]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/digest_set.md -[ResourceURI]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#resourceuri -[ResourceDescriptor]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/resource_descriptor.md -[Statement]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/statement.md -[Timestamp]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#timestamp -[TypeURI]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#TypeURI +[DigestSet]: https://github.com/in-toto/attestation/blob/main/spec/v1/digest_set.md +[ResourceURI]: https://github.com/in-toto/attestation/blob/main/spec/v1/field_types.md#ResourceURI +[ResourceDescriptor]: https://github.com/in-toto/attestation/blob/main/spec/v1/resource_descriptor.md +[Statement]: https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md +[Timestamp]: https://github.com/in-toto/attestation/blob/main/spec/v1/field_types.md#Timestamp +[TypeURI]: https://github.com/in-toto/attestation/blob/main/spec/v1/field_types.md#TypeURI [in-toto attestation]: https://github.com/in-toto/attestation -[parsing rules]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/README.md#parsing-rules +[parsing rules]: https://github.com/in-toto/attestation/blob/main/spec/v1/README.md#parsing-rules From 1fa3fa9befb3a20a24b736fb646301fcc1d51a1d Mon Sep 17 00:00:00 2001 From: kpk47 Date: Wed, 6 Sep 2023 15:26:11 -0700 Subject: [PATCH 23/26] backport editorial changes to v1.0 Signed-off-by: kpk47 --- docs/spec/v1.0/verification_summary.md | 70 ++++++++++++++------------ 1 file changed, 37 insertions(+), 33 deletions(-) diff --git a/docs/spec/v1.0/verification_summary.md b/docs/spec/v1.0/verification_summary.md index eff9e3302..40ee75917 100644 --- a/docs/spec/v1.0/verification_summary.md +++ b/docs/spec/v1.0/verification_summary.md @@ -4,8 +4,9 @@ description: SLSA v1.0 specification for a verification summary of artifacts by layout: standard --- -Verification summary attestations communicate that an artifact has been verified -at a specific SLSA level and details about that verification. +Verification summary attestations convey high-level information about an +artifact's verification, allowing consumers to delegate verification decisions +to trusted third parties. This document defines the following predicate type within the [in-toto attestation] framework: @@ -21,17 +22,17 @@ attestation] framework: ## Purpose -Describe what SLSA level an artifact or set of artifacts was verified at -and other details about the verification process including what SLSA level -the dependencies were verified at. +Assert that the VSA producer has verified an artifact or set of artifacts. +Optionally include details about the verification process, such as the verified +SLSA level(s) and the verifier's expectations. -This allows software consumers to make a decision about the validity of an +VSAs allow software consumers to make a decision about the validity of an artifact without needing to have access to all of the attestations about the -artifact or all of its transitive dependencies. They can use it to delegate -complex policy decisions to some trusted party and then simply trust that -party's decision regarding the artifact. +artifact or all of its transitive dependencies. The software consumer delegates +complex policy decisions to a trusted party and then acts on those decisions by +consuming the VSA. -It also allows software producers to keep the details of their build pipeline +VSAs also allow software producers to keep the details of their build pipeline confidential while still communicating that some verification has taken place. This might be necessary for legal reasons (keeping a software supplier confidential) or for security reasons (not revealing that an embargoed patch has @@ -41,23 +42,20 @@ been included). A Verification Summary Attestation (VSA) is an attestation that some entity (`verifier`) verified one or more software artifacts (the `subject` of an -in-toto attestation [Statement]) by evaluating the artifact and a `bundle` -of attestations against some `policy`. Users who trust the `verifier` may -assume that the artifacts met the indicated SLSA level without themselves -needing to evaluate the artifact or to have access to the attestations the -`verifier` used to make its determination. - -The VSA also allows consumers to determine the verified levels of -all of an artifact’s _transitive_ dependencies. The verifier does this by -either a) verifying the provenance of each non-source dependency listed in -the [resolvedDependencies](/provenance/v1#resolvedDependencies) of the artifact -being verified (recursively) or b) matching the non-source dependency -listed in `resolvedDependencies` (`subject.digest` == -`resolvedDependencies.digest` and, ideally, `vsa.resourceUri` == -`resolvedDependencies.uri`) to a VSA _for that dependency_ and using -`vsa.verifiedLevels` and `vsa.dependencyLevels`. Policy verifiers wishing -to establish minimum requirements on dependencies SLSA levels may use -`vsa.dependencyLevels` to do so. +in-toto attestation [Statement]) by evaluating the artifact and its associated +attestation(s) against the `policy` for `resourceUri`. Consumers who trust +the `verifier` may assume that the artifacts identified by the +`(subject, resourceUri)` pair met the indicated SLSA level without +themselves needing to evaluate the artifact or to have access to the +attestations the `verifier` used to make its determination. + +VSAs can also be chained together to meet higher level goals, such as tracking +the verified SLSA level(s) for the `subject`'s transitive dependencies. Rather +than verifying provenance for the artifact and each of its transitive +dependencies all at once, the verifier can verify each dependency independently +and produce VSAs. Finally, the verifier combines those VSAs; the artifact +is the final VSA's `subject` and each transitive dependency is an +entry in `dependencyLevels`. ## Schema @@ -129,7 +127,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > can sign provenance for the "Google Cloud Deploy" verifier, but "GitHub" cannot > sign for the "Google Cloud Deploy" verifier. > -> The field is required, even if it is implicit from the signer, to aid readability and +> This field is required, even if it is implicit from the signer, to aid readability and > debugging. It is an object to allow additional fields in the future, in case one > URI is not sufficient. @@ -147,6 +145,12 @@ of the other top-level fields, such as `subject`, see [Statement]._ `resourceUri` _string ([ResourceURI]), required_ > URI that identifies the resource associated with the artifact being verified. +> +> This field is required to prevent confusion attacks. E.g., a VSA indicating +> that a package can be published as `foo` should not be usable to publish +> the package as `bar`; a VSA indicating that a package passed the policy for +> a `dev` environment should not be usable to deploy the package to a `prod` +> environment. `policy` _object ([ResourceDescriptor]), required_ @@ -179,8 +183,8 @@ of the other top-level fields, such as `subject`, see [Statement]._ > Indicates the highest level of each track verified for the artifact (and not > its dependencies), or "FAILED" if policy verification failed. > -> Users MUST NOT include more than one level per SLSA track. Note that each SLSA -> level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies +> VSA producers MUST NOT include more than one level per SLSA track. Note that +> each SLSA level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies > SLSA_BUILD_LEVEL_2 and SLSA_BUILD_LEVEL_1), so there is no need to > include more than one level per track. @@ -193,8 +197,8 @@ of the other top-level fields, such as `subject`, see [Statement]._ > that were verified at the indicated level. Absence of a given level of > [SlsaResult] MUST be interpreted as reporting _0_ dependencies at that level. > -> Users MUST count each dependency only once per SLSA track, at the highest -> level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, +> VSA producers MUST count each dependency only once per SLSA track, at the +> highest level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, > you include it with the count for SLSA_BUILD_LEVEL_2 but not the count for >SLSA_BUILD_LEVEL_1. @@ -269,7 +273,7 @@ Users MAY use custom values here but MUST NOT use custom values starting with ## Change history -- 1: +- 1.0: - Replaced `materials` with `resolvedDependencies`. - Relaxed `SlsaResult` to allow other values. - Converted to lowerCamelCase for consistency with [SLSA Provenance]. From e214c2ae0c453397d1f8fd3545ab2d6c5fb136f8 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Wed, 6 Sep 2023 15:34:26 -0700 Subject: [PATCH 24/26] move ediorial changes to v1.1 directory Signed-off-by: kpk47 --- docs/spec/v1.0/verification_summary.md | 70 ++++++------- docs/spec/v1.1/verification_summary.md | 133 +++---------------------- 2 files changed, 45 insertions(+), 158 deletions(-) diff --git a/docs/spec/v1.0/verification_summary.md b/docs/spec/v1.0/verification_summary.md index 40ee75917..eff9e3302 100644 --- a/docs/spec/v1.0/verification_summary.md +++ b/docs/spec/v1.0/verification_summary.md @@ -4,9 +4,8 @@ description: SLSA v1.0 specification for a verification summary of artifacts by layout: standard --- -Verification summary attestations convey high-level information about an -artifact's verification, allowing consumers to delegate verification decisions -to trusted third parties. +Verification summary attestations communicate that an artifact has been verified +at a specific SLSA level and details about that verification. This document defines the following predicate type within the [in-toto attestation] framework: @@ -22,17 +21,17 @@ attestation] framework: ## Purpose -Assert that the VSA producer has verified an artifact or set of artifacts. -Optionally include details about the verification process, such as the verified -SLSA level(s) and the verifier's expectations. +Describe what SLSA level an artifact or set of artifacts was verified at +and other details about the verification process including what SLSA level +the dependencies were verified at. -VSAs allow software consumers to make a decision about the validity of an +This allows software consumers to make a decision about the validity of an artifact without needing to have access to all of the attestations about the -artifact or all of its transitive dependencies. The software consumer delegates -complex policy decisions to a trusted party and then acts on those decisions by -consuming the VSA. +artifact or all of its transitive dependencies. They can use it to delegate +complex policy decisions to some trusted party and then simply trust that +party's decision regarding the artifact. -VSAs also allow software producers to keep the details of their build pipeline +It also allows software producers to keep the details of their build pipeline confidential while still communicating that some verification has taken place. This might be necessary for legal reasons (keeping a software supplier confidential) or for security reasons (not revealing that an embargoed patch has @@ -42,20 +41,23 @@ been included). A Verification Summary Attestation (VSA) is an attestation that some entity (`verifier`) verified one or more software artifacts (the `subject` of an -in-toto attestation [Statement]) by evaluating the artifact and its associated -attestation(s) against the `policy` for `resourceUri`. Consumers who trust -the `verifier` may assume that the artifacts identified by the -`(subject, resourceUri)` pair met the indicated SLSA level without -themselves needing to evaluate the artifact or to have access to the -attestations the `verifier` used to make its determination. - -VSAs can also be chained together to meet higher level goals, such as tracking -the verified SLSA level(s) for the `subject`'s transitive dependencies. Rather -than verifying provenance for the artifact and each of its transitive -dependencies all at once, the verifier can verify each dependency independently -and produce VSAs. Finally, the verifier combines those VSAs; the artifact -is the final VSA's `subject` and each transitive dependency is an -entry in `dependencyLevels`. +in-toto attestation [Statement]) by evaluating the artifact and a `bundle` +of attestations against some `policy`. Users who trust the `verifier` may +assume that the artifacts met the indicated SLSA level without themselves +needing to evaluate the artifact or to have access to the attestations the +`verifier` used to make its determination. + +The VSA also allows consumers to determine the verified levels of +all of an artifact’s _transitive_ dependencies. The verifier does this by +either a) verifying the provenance of each non-source dependency listed in +the [resolvedDependencies](/provenance/v1#resolvedDependencies) of the artifact +being verified (recursively) or b) matching the non-source dependency +listed in `resolvedDependencies` (`subject.digest` == +`resolvedDependencies.digest` and, ideally, `vsa.resourceUri` == +`resolvedDependencies.uri`) to a VSA _for that dependency_ and using +`vsa.verifiedLevels` and `vsa.dependencyLevels`. Policy verifiers wishing +to establish minimum requirements on dependencies SLSA levels may use +`vsa.dependencyLevels` to do so. ## Schema @@ -127,7 +129,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > can sign provenance for the "Google Cloud Deploy" verifier, but "GitHub" cannot > sign for the "Google Cloud Deploy" verifier. > -> This field is required, even if it is implicit from the signer, to aid readability and +> The field is required, even if it is implicit from the signer, to aid readability and > debugging. It is an object to allow additional fields in the future, in case one > URI is not sufficient. @@ -145,12 +147,6 @@ of the other top-level fields, such as `subject`, see [Statement]._ `resourceUri` _string ([ResourceURI]), required_ > URI that identifies the resource associated with the artifact being verified. -> -> This field is required to prevent confusion attacks. E.g., a VSA indicating -> that a package can be published as `foo` should not be usable to publish -> the package as `bar`; a VSA indicating that a package passed the policy for -> a `dev` environment should not be usable to deploy the package to a `prod` -> environment. `policy` _object ([ResourceDescriptor]), required_ @@ -183,8 +179,8 @@ of the other top-level fields, such as `subject`, see [Statement]._ > Indicates the highest level of each track verified for the artifact (and not > its dependencies), or "FAILED" if policy verification failed. > -> VSA producers MUST NOT include more than one level per SLSA track. Note that -> each SLSA level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies +> Users MUST NOT include more than one level per SLSA track. Note that each SLSA +> level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies > SLSA_BUILD_LEVEL_2 and SLSA_BUILD_LEVEL_1), so there is no need to > include more than one level per track. @@ -197,8 +193,8 @@ of the other top-level fields, such as `subject`, see [Statement]._ > that were verified at the indicated level. Absence of a given level of > [SlsaResult] MUST be interpreted as reporting _0_ dependencies at that level. > -> VSA producers MUST count each dependency only once per SLSA track, at the -> highest level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, +> Users MUST count each dependency only once per SLSA track, at the highest +> level verified. For example, if a dependency meets SLSA_BUILD_LEVEL_2, > you include it with the count for SLSA_BUILD_LEVEL_2 but not the count for >SLSA_BUILD_LEVEL_1. @@ -273,7 +269,7 @@ Users MAY use custom values here but MUST NOT use custom values starting with ## Change history -- 1.0: +- 1: - Replaced `materials` with `resolvedDependencies`. - Relaxed `SlsaResult` to allow other values. - Converted to lowerCamelCase for consistency with [SLSA Provenance]. diff --git a/docs/spec/v1.1/verification_summary.md b/docs/spec/v1.1/verification_summary.md index e2efdbe9d..40ee75917 100644 --- a/docs/spec/v1.1/verification_summary.md +++ b/docs/spec/v1.1/verification_summary.md @@ -22,15 +22,15 @@ attestation] framework: ## Purpose -Assert that the verifier has verified an artifact or set of artifacts. Optionally -include details about the verification process, such as the verified SLSA -level(s) and the verifier's expectations. +Assert that the VSA producer has verified an artifact or set of artifacts. +Optionally include details about the verification process, such as the verified +SLSA level(s) and the verifier's expectations. VSAs allow software consumers to make a decision about the validity of an artifact without needing to have access to all of the attestations about the -artifact or all of its transitive dependencies. Consumers can use VSAs to delegate -complex policy decisions to some trusted party and then simply trust that -party's decision regarding the artifact. +artifact or all of its transitive dependencies. The software consumer delegates +complex policy decisions to a trusted party and then acts on those decisions by +consuming the VSA. VSAs also allow software producers to keep the details of their build pipeline confidential while still communicating that some verification has taken place. @@ -137,7 +137,7 @@ of the other top-level fields, such as `subject`, see [Statement]._ > URI indicating the verifier’s identity. -`timeVerified` _string ([Timestamp]), optional_ +`timeVerified` _string ([Timestamp]), required_ > Timestamp indicating what time the verification occurred. @@ -153,11 +153,11 @@ of the other top-level fields, such as `subject`, see [Statement]._ > environment. -`policy` _object ([ResourceDescriptor]), optional_ +`policy` _object ([ResourceDescriptor]), required_ > Describes the policy that the `subject` was verified against. > -> This field is RECOMMENDED. +> The entry MUST contain a `uri`. `inputAttestations` _array ([ResourceDescriptor]), optional_ @@ -184,16 +184,9 @@ of the other top-level fields, such as `subject`, see [Statement]._ > its dependencies), or "FAILED" if policy verification failed. > > VSA producers MUST NOT include more than one level per SLSA track. Note that -> each SLSA level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies +> each SLSA level implies all levels below it (e.g. SLSA_BUILD_LEVEL_3 implies > SLSA_BUILD_LEVEL_2 and SLSA_BUILD_LEVEL_1), so there is no need to > include more than one level per track. -> -> VSA producers MAY add additional, non-SLSA properties to this field provided -> the values do not conflict with the definition of [SlsaResult]. VSA Producers -> SHOULD negotiate the meaning of such properties with their intended verifier. -> -> This field MAY be absent if the verifier is not attesting to a specific SLSA -> level. `dependencyLevels` _object, optional_ @@ -258,103 +251,6 @@ WARNING: This is just for demonstration purposes.
-## How to verify - -Consumers use VSAs to accomplish goals based on delegated trust. We call the -process of establishing a VSA's authenticity and determining whether it meets -the consumer's goals 'verification'. Goals differ, as do levels of confidence -in VSA producers, so the verification procedure changes to suit its context. -However, there are certain steps that most verification procedures have in -common. - -Verification MUST include the following steps: - -1. Verify the signature on the VSA envelope using the preconfigured roots of - trust. This step ensures that the VSA was produced by a trusted producer - and that it hasn't been tampered with. - -2. Verify the statement's `subject` matches the digest of the artifact in - question. This step ensures that the VSA pertains to the intended artifact. - -3. Verify that the `predicateType` is - `https://slsa.dev/verification_summary/v1`. This step ensures that the - in-toto predicate is using this version of the VSA format. - -4. Verify that the `verifier` matches the public key (or equivalent) used to - verify the signature in step 1. This step identifies the VSA producer in - cases where their identity is not implicitly revealed in step 1. - -5. Verify that the value for `resourceUri` in the VSA matches the expected - value. This step ensures that the consumer is using the VSA for the - producer's intended purpose. - -6. Verify that the value for `slsaResult` is `PASSED`. This step ensures the - artifact is suitable for the consumer's purposes. - -7. Verify that `verifiedLevels` contains the expected value. This step ensures - that the artifact is suitable for the consumer's purposes. - -Verification MAY additionally contain the following step: - -1. (Optional) Verify additional fields required to determine whether the VSA - meets your goal. - -Verification mitigates different threats depending on the VSA's contents and the -verification procudure. - -IMPORTANT: A VSA does not protect against compromise of the verifier, such as by -a malicious insider. Instead, VSA consumers SHOULD carefully consider which -verifiers they add to their roots of trust. - -### Examples - -1. Suppose consumer C wants to delegate to verifier V the decision for whether - to accept artifact A as resource R. Consumer C verifies that: - - - The signature on the VSA envelope using V's public signing key from their - preconfigured root of trust. - - - `subject` is A. - - - `predicateType` is `https://slsa.dev/verification_summary/v1`. - - - `verifier.id` is V. - - - `resourceUri` is R. - - - `slsaResult` is `PASSED`. - - - `verifiedLevels` contains `SLSA_BUILD_LEVEL_UNEVALUATED`. - - Note: This example is analogous to traditional code signing. The expected - value for `verifiedLevels` is arbitrary but prenegotiated by the producer and - the consumer. The consumer does not need to check additional fields, as C - fully delegates the decision to V. - -2. Suppose consumer C wants to enforce the rule "Artifact A at resource R must - have a passing VSA from verifier V showing it meets SLSA Build Level 2+." - Consumer C verifies that: - - - The signature on the VSA envelope using V's public signing key from their - preconfigured root of trust. - - - `subject` is A. - - - `predicateType` is `https://slsa.dev/verification_summary/v1`. - - - `verifier.id` is V. - - - `resourceUri` is R. - - - `slsaResult` is `PASSED`. - - - `verifiedLevels` is `SLSA_BUILD_LEVEL_2` or `SLSA_BUILD_LEVEL_3`. - - Note: In this example, verifying the VSA mitigates the same threats as - verifying the artifact's SLSA provenance. See - [Verifying artifacts](/spec/v1.0/verifying-artifacts) for details about which - threats are addressed by verifying each SLSA level. - ## _SlsaResult (String)_
@@ -362,7 +258,6 @@ verifiers they add to their roots of trust. The result of evaluating an artifact (or set of artifacts) against SLSA. SHOULD be one of these values: -- SLSA_BUILD_LEVEL_UNEVALUATED - SLSA_BUILD_LEVEL_0 - SLSA_BUILD_LEVEL_1 - SLSA_BUILD_LEVEL_2 @@ -373,15 +268,11 @@ Note that each SLSA level implies the levels below it. For example, SLSA_BUILD_LEVEL_3 means (SLSA_BUILD_LEVEL_1 + SLSA_BUILD_LEVEL_2 + SLSA_BUILD_LEVEL_3). -VSA producers MAY use custom values here but MUST NOT use custom values starting -with `SLSA_`. +Users MAY use custom values here but MUST NOT use custom values starting with +`SLSA_`. ## Change history -- 1.1: - - Added Verification section with examples. - - Made `policy` optional. - - Made `timeVerified` optional. - 1.0: - Replaced `materials` with `resolvedDependencies`. - Relaxed `SlsaResult` to allow other values. From 03fe0500ba101431ffeb94f2d563cdd58ceedde0 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Wed, 6 Sep 2023 15:35:57 -0700 Subject: [PATCH 25/26] fix link refs Signed-off-by: kpk47 --- docs/spec/v1.1/verification_summary.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/spec/v1.1/verification_summary.md b/docs/spec/v1.1/verification_summary.md index 40ee75917..952c28b7b 100644 --- a/docs/spec/v1.1/verification_summary.md +++ b/docs/spec/v1.1/verification_summary.md @@ -285,11 +285,11 @@ Users MAY use custom values here but MUST NOT use custom values starting with [SLSA Provenance]: /provenance [SlsaResult]: #slsaresult -[DigestSet]: https://github.com/in-toto/attestation/blob/main/spec/v1/digest_set.md -[ResourceURI]: https://github.com/in-toto/attestation/blob/main/spec/v1/field_types.md#ResourceURI -[ResourceDescriptor]: https://github.com/in-toto/attestation/blob/main/spec/v1/resource_descriptor.md -[Statement]: https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md -[Timestamp]: https://github.com/in-toto/attestation/blob/main/spec/v1/field_types.md#Timestamp -[TypeURI]: https://github.com/in-toto/attestation/blob/main/spec/v1/field_types.md#TypeURI +[DigestSet]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/digest_set.md +[ResourceURI]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#ResourceURI +[ResourceDescriptor]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/resource_descriptor.md +[Statement]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/statement.md +[Timestamp]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#Timestamp +[TypeURI]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#TypeURI [in-toto attestation]: https://github.com/in-toto/attestation -[parsing rules]: https://github.com/in-toto/attestation/blob/main/spec/v1/README.md#parsing-rules +[parsing rules]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/README.md#parsing-rules From ead4e1c15a5d163b8996f2ec806509d2b0e341f3 Mon Sep 17 00:00:00 2001 From: kpk47 Date: Wed, 6 Sep 2023 15:36:57 -0700 Subject: [PATCH 26/26] fix link caps Signed-off-by: kpk47 --- docs/spec/v1.1/verification_summary.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/spec/v1.1/verification_summary.md b/docs/spec/v1.1/verification_summary.md index 952c28b7b..ee442ddab 100644 --- a/docs/spec/v1.1/verification_summary.md +++ b/docs/spec/v1.1/verification_summary.md @@ -286,10 +286,10 @@ Users MAY use custom values here but MUST NOT use custom values starting with [SLSA Provenance]: /provenance [SlsaResult]: #slsaresult [DigestSet]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/digest_set.md -[ResourceURI]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#ResourceURI +[ResourceURI]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#resourceuri [ResourceDescriptor]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/resource_descriptor.md [Statement]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/statement.md -[Timestamp]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#Timestamp +[Timestamp]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#timestamp [TypeURI]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/field_types.md#TypeURI [in-toto attestation]: https://github.com/in-toto/attestation [parsing rules]: https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/README.md#parsing-rules