From 1db7a79ba7fe0ef579fe2698740355a6f50f8880 Mon Sep 17 00:00:00 2001 From: Steve Lasker Date: Fri, 19 Jun 2020 17:39:46 -0700 Subject: [PATCH 1/7] Notary v2 prototye process Signed-off-by: Steve Lasker --- README.md | 114 ++++++++++++++++++++++++++++++++- experimental-environment.md | 57 +++++++++++++++++ media/notary-e2e-scenarios.png | Bin 0 -> 54561 bytes milestones.md | 78 ++++++++++++++++++++++ sketch.md | 90 ++++++++++++++++++++++++++ 5 files changed, 338 insertions(+), 1 deletion(-) create mode 100644 experimental-environment.md create mode 100644 media/notary-e2e-scenarios.png create mode 100644 milestones.md create mode 100644 sketch.md diff --git a/README.md b/README.md index 996158e49..50e14ae2f 100644 --- a/README.md +++ b/README.md @@ -1 +1,113 @@ -# nv2 \ No newline at end of file +# nv2 - Prototype + +nv2 is an incubation and prototype for designing the [Notary v2][notaryv2] efforts, securing artifacts stored in [OCI distribution-spec][oci-distribution] based registries. + +## Table of contents + +- [Prototyping components](#prototyping-components) +- [Prototyping approach](#prototyping-approach) +- [Sketch, prototype, experiment, iterate](#sketch-prototype-experiment-iterate) + - [Prototype Sketch](.sketch.md) + - [Milestones](./milestones.md) + - [Experimental Environment](./experimental-environment.md) + +## Prototyping components + +As the below _end to end_ (e2e) workflow visualizes, there are many components we must account for in this e2e experience. Not accounting for the e2e experience could leave the community with a new set of blocking issues found with the Docker Content Trust implementation of Notary v1. + +Components to consider: + +- Build environments +- Key management - including the ability to integrate with a vendors native key management solution +- Software Bill of Materials (SBoM) +- Source packaging +- Public and private registries, including air-gapped and [purdue network][purdue-network] isloated registries +- Vulnerability and security scanning products +- Policy Management - to leverage an SBoM and signatures to determine _if_ an artifact is trusted and should be deployed +- Container host environments, like kubernetes + +![Notary v2 e2e workflow](media/notary-e2e-scenarios.png) + +## Prototyping approach + +There are many approaches to building prototypes. Some approaches cater to simple projects, while others are better at supporting complex projects. + +Notary v2 is goaled at securing a complex e2e secure supply chain workflow. This will involve many subject matter experts (SMEs) and various projects to engage. Since no one person or group has a concrete blueprint for what and how we would build this e2e solution, we can be stalled with gaps of communication and differing views. + +### The value of books and movies + +We all have experiences and biases that guide us. These can be an asset to forming a diverse set of views, but can also be difficult to overcome when a shared interaction must be made between any two parts. To build out the Notary v2 experience we must incorporate interaction between various projects, with a shared understanding, and individuals within each project must have a shared understanding. However, the shared understanding is assumed to evolve as we all learn together and from each others differing views. + +- [“No two persons ever read the same book.”: Edmund Wilson](https://www.goodreads.com/quotes/23977-no-two-persons-ever-read-the-same-book). +- [“How two can see the same thing and interpret it differently”](https://jenalynalbia.wordpress.com/2017/01/11/explain-how-two-can-see-the-same-thing-and-interpret-it-differently/) +- [Mars probe lost due to simple math error](https://www.latimes.com/archives/la-xpm-1999-oct-01-mn-17288-story.html) + +### Building complex software + +Building a complex solution is not unique to Notary v2. We will bring SMEs from various areas, each with their own views, and we will continue to evolve the design until we're ready to execute. + +In software, there are many models, including waterfall and iterative. However, within the iterative, there are at least two additional approaches: + +1. Build and iterate with constant changes, churn and frustration to those dependent on the outcome + - Consumers of the effort can get lost with complaints of stability +1. Build a prototype, learn, toss, build the real thing, with a reasonable amount of iterations + - Consumers clearly see this as a prototype, monitor, provide feedback and await the outcome while the SMEs work out all the details + +### Prototyping complex buildings + +In construction, we must bring together various designers, architects and trades: + +- Designers that provide a sketch +- Architects that provide detailed blueprints +- Grading contractors - sculpting the ground by which the property will reside +- Foundation contractors - providing a solid foundation for the structure, including environmental impact and risk (earthquakes, floods, ...) +- Framing contractors - accounting for the various contractors that must fit all internals that make a house a home +- HVAC contractors - have large spaces to heat and cool, requiring the framers to account for the plenums and returns +- Plumbing contractors - that may provide detailed design for that fancy glassless shower and constant hot water +- Electrical contractors - needing to place the switches and outlet in all the right areas you blindly reach for +- ... + +Each trade may not know the details of the other trades, but they know they need to work together. The plumbers and electrician must work around the HVAC systems, the grading contractors must provide a solid footing, with water runoff for the foundation to be stable. + +While we can use auto-cad programs to visualize the design, we still need to start out with a sketch for what it will look like, and whether it will actually work. Can you really extend the patio that far out without it bouncing, or how long and how much water will it take to get hot water to the shower? As productive as auto-cad programs are, it's still complex and expensive to design a building from scratch. Which is why so many buildings are based on existing proven templates. To build something new, depending on the complexity of the problem, we may need to sketch or model a design before proceeding to detailed blueprints. + +### The work of Antoni Gaudí + +[Antoni Gaudí](https://en.wikipedia.org/wiki/Antoni_Gaud%C3%AD) is famously known for his amazingly creative works in Barcelona. The [Sagrada Famila](https://simple.wikipedia.org/wiki/Sagrada_Fam%C3%ADlia) was a departure from the massive piers and buttress designs. Gaudí wanted a more natural look, which had no existing templates to work from Gaudí sketched and modeled many times to work out the intricate details for the various trades to work together. To design natural arches and vaults, Gaudí created an inverted model using small bags of birdshot and string. It's through this sketch, model, design, execute approach that Gaudí was able to enlist the creative skills of various trades to _eventually_ complete the Sagrada Famila. + +![Antoni Gaudí](https://upload.wikimedia.org/wikipedia/commons/thumb/7/72/Antoni_Gaudi_1878.jpg/176px-Antoni_Gaudi_1878.jpg) +) + + +## Sketch, prototype, experiment, iterate + +The different views and interaction of the different trades is equivalent to the different views and interaction we need between the different SMEs and project owners for Notary v2. + +- Key management folks need to figure out where they should engage, providing input on how keys should be managed +- Key vault solutions must understand where they plug in their key vault provider for each registry +- Policy management folks need to understand what content they can pull from a registry, and how they should trust it to make policy decisions +- The update framework folks must understand where they can plug in their metadata to assure the content is secured and trusted +- The folks working on the secure software supply chain efforts must understand the registry workflows and what they must account for +- The registry vendors must understand the implications for the changes they must make to support Notary v2 +- Just as the public provides feedback on public works, customers need something to view for providing feedback + +To facilitate the e2e workflows, we'll: + +- [Sketch](./sketch.md) an e2e workflow, supporting the [Notary v2 scenarios][nv2-scenarios] +- Prototype various components of the e2e workflow including + - The nv2 client for signing artifacts + - A registry that implements any APIs required to store and serve signatures and verification objects + - A key vault solution for storing signing keys + - A SBoM document, used for making policy decisions + - A Policy Manager, used to make policy decisions + - A container hosting solution to deploy secured containers +- Create an [environment](./experimental-environment.md) to experiment with the e2e workflows +- Iterate, with a set of [milestones](./milestones.md) each team will work towards + +As we get to a point where we feel comfortable with the e2e design, that accounts for the [Notary v2 scenarios][nv2-scenarios], balancing the security and usability goals, we can move to a spec (blueprint) for building out the final versions of each component. + +[notaryv2]: http://github.com/notaryproject/ +[oci-distribution]: https://github.com/opencontainers/distribution-spec +[oci-image]: https://github.com/opencontainers/image-spec +[purdue-network]: https://en.wikipedia.org/wiki/Purdue_Enterprise_Reference_Architecture +[nv2-scenarios]: https://github.com/notaryproject/requirements/blob/master/scenarios.md diff --git a/experimental-environment.md b/experimental-environment.md new file mode 100644 index 000000000..42728178e --- /dev/null +++ b/experimental-environment.md @@ -0,0 +1,57 @@ +# Notary v2 Experimental Environment + +To enable various SMEs and project owners the ability to provide feedback for the [Notary v2 e2e scenarios][nv2-scenarios], we provide the following reference environment for what we intend to build. + +Based on the [Notary v2 sketch](sketch.md), a set of prototypes will be built and instanced in this experimental environment. Following a set of [milestones](milestones.md) the environment will be updated to reflect the goals of the milestone. + +A experimental reference environment will be provided for the maintainers of the Notary v2 efforts in [Azure](http://www.azure.com/). + +## Self instancing the reference environment + +For each milestone, we will provide instructions and scripts, to create the reference environment for users to experiment and iterate themselves. + +## Milestone 0 environment + +### Mock public content + +To represent a mock public registry, we'll need to build and host a mock docker hub environment. This includes the building and hosting of two base images: (linux and node) + +To represent ths public content, we'll create: + +- Public registry + - An instance of [notary/distribution][notary-distribution] that represents a public registry like: (registry.notaryv2.io) + - We may create a simple markdown page for the list of images, but we're not attempting to duplicate a public registry user interface. +- Public content build environment + - The Linux and Node base images will need to be signed and hosted for this experimental environment + - To optimize, we'll create one public-build environment for both the Linux and Node images. +- Public content key vault + - To build the public images, we'll need to store the private keys used to build this content. + - This key vault is not publicly accessible. It's the equivalent of the linux distros internal key vault store. And, the node communities key vault store. + - To optimize, we'll use one key vault solution to host both the linux and node images, but we will store separate keys. +- Public content git repository + - A git repo to build the linux image https://github.com/notaryproject/mock-linux + - A git repo to build the node image https://github.com/notaryproject/mock-node + +### ACME Rockets content + +To represent a customer environment, we'll build-out the ACME Rockets fictitious company. + +- Private registry + - An instance of [notary/distribution][notary-distribution] that represents a private registry: (registry.acmerockets.io) +- Corporate git repo + - https://github.com/acme-rockets/* +- Corporate standard artifacts build environment + - linux image + - https://github.com/acme-rockets/base-linux + - node image + - https://github.com/acme-rockets/base-node + - hello-world image + - https://github.com/acme-rockets/hello-world +- Key vault + - An instance of a [cncf][cncf-projects] key vault + +## Milestone 1 environment + +[cncf-projects]: https://www.cncf.io/projects/ +[notary-distribution]: https://github.com/notaryproject/distribution +[nv2-scenarios]: https://github.com/notaryproject/requirements/blob/master/scenarios.md diff --git a/media/notary-e2e-scenarios.png b/media/notary-e2e-scenarios.png new file mode 100644 index 0000000000000000000000000000000000000000..2669f3fd447a8bf92873dddc415f09484256f03d GIT binary patch literal 54561 zcmb5WWmJ^y_Xethgh)wBhXP7T4=oK+f)di*-HmjIQqoca(m6EJ%}7ZMT|>+;bjNw{ zec%82t@G`C0M@Wr&vWm+uU*&PHxciZWU!x*J$dlp0k)j1r0RnQk0~EKc*uf*2K+`T ziSPjU@z7aSM*KnfD8)AL0o7bgQS8BksyM7`!^gm9Ob6Ld&JP}t;NO2e9Ar2Weehti zUQSZ%qlX?m6Z6{(snlEaNwtSW(*#mKN}5W%NDUf@U8hlm)OFbblv86c}-sx1pMP?5J>a!Mm{UTe_t5yXJ)d_syzJT z5J{+;pa_G#CL6sGN}#&>Y_|J4zdTF9z`SOA-c)tEgsbam1;_k5yf&zCKo ztfU^gJs($HJTJ(ttwDPtD3~xx#5F!`qS{Cu{lh8D;@SVb#n5DZi_xgF$*Cuex@_)d zzj47`_hz|#mgj6B_+&*`y*vwQ9S0spv>CaAB9aDH_%!m>&0VKsg9h9*D~8j|>7yfd zWxe1s-}+;tOP}L#;fu>=S2=CWa2bN#wW}_7gxv*wltid?zI<|C+H%lCoTkH0XIvNU zqF6d|)$Eb?!r_LopcMzD)Xrh{>_@u< zG>QB@u3TlScs%jTP_+`AB|Z4QvOyFK;dZ<7n++G{_f2u5o$hr1^~KW(*ij4rHDUU> zFKh0atnRHoL#B3N2VU`-rz+BzNA_PhSs2&G@iyGN(P9e z!+K?2BJb!RSyC1+tUl%&NF4Y7zPDGOKuJ2Liz7)p?mS6Z&?M|l z5X!(A$NGY<{VciS#!|kVqS)ZI0dG>feu;2A{O#F^2uo{Y2j+Fd%V zZ*Pf*>lBY6g{<|3v`k+%O~UAq>FQ+?(e{BvSlD!Isb&3Ospg$= zoriR{O4GGdb&ujd^^k&hBpJ%kX?!6It_34(GWpz=WBpZaObL_h)|F3M>#nlYARr&_ zm_X+P-j?vUK}0W>__&G>ApgLtP#6(UY2ZBax^E??ivFOnWCpPy4MUvvzxVSW(F>WG z4vM#f*WVbA7+KEP6(0FR%;LO$qA~vxOMOlysulEKwDC%huti{6m|0x+oX@)>C1AG~ zo?*kv?l*26P_IFo58j#>;ka4@(R@*n+G5Gd(s7!|C|lpU?itA(d)>{Xno zzZo=f-yIyAYH0OhOBh`eN*koimBUU@jB8gIEcTY?R@Yr67O{zoUe_2rWj)Gn&}DZ= z3~m@hBCxg)g)T4ilo-ygZ${7JV+apj`mv`}@a-+F@I z+vq!>fRQdc*T zy<|_B?@V$7G7cxEU9aYaG{bk~aDHC~clyWlKHmdkefML%_;A>P z2u)xRM{zv$)xqPad*oQMJ8-Hme%|pAF%qsW<|#3G_Gwbi+9UlmQi08&HgUM8n0YX+7O|I>i6Sp z+)BWYTQyHG7>g4R*1mka{jh=q95Q$LVn?&pLhxDD;57)}Z)-{U*k&y6gut+yp7H{I z^FH>-6YA-BUedbt^Y@#NZOdWUrss3&K;{K*c?M$>;Ru^m_g2?W*sm& ziY9{uD1gA3tSbeJjPBa^8dJ$Nk05(^QAK^qXPTpv_z$wQOvb^cQ+D<^_BHa=0*)>g zJ}%su?TU&dFv7_KDN7S6ds2k&T-?s?W52M_~3MI9|kj(T@7|^UMgk8>L=Nx^!P4by&CF z(qnIytBky{A?eUwecFR1X(2zBxexl%1h13W*|m8ClDL$J4Z-YM9Eth~axi$Q0fANb6+XQ?*7_I5k6*}2sUT zF!ecN)k47E*9~;HZ^yiO_Wb!LE{bv=g$>*kxpi%hj>L#{aD2Uy$%usaUH}n4zmUI8 z6!DrQL*XI2Q$2H=^Ty9NLq~ZRnBAsmf`mQl@i_$_Sll zL^+PfFDSwMm<^RLQwj1#M00`Xif2%;axy>Ti*h66AxI2!8sTsdx{qY>e*y+Jel9F= zg00O)d{-n1aL=j9{BM*5Tiu#0IK4tz}QSnjGETx6TkiB69Se@45Th{$!- ztKW1h!$Oj)Y!cUlV?55yvFiq4V>v6ZhVa@x;>4ppS!Auy1@ufjoB+CV{#>#aFVQ|$ zs_)*W;#y(lPN_g<;{vBUG6>XKfx$wRSCL&X`&44N+c1;Ps|V^m@bZ$ERXg|)O$s1W zn7-ig+uwihhrN1GKk0J0U${$a9Up-d(1Ql&8vd|H2>S;^{bdf4n|NE$5w9wUT`pv8_sF!AuE5h!c zC8r3(i|Mz0s30pNKb(+KdLSM{NEeELtPOZ#t=T-x+1>2Jnm>Sz*l9p*v~i!cGh+yT zOGuLcavbLHEaCYpoeV>!_lbpoJ3T|1gNRXe1Yi1I&CbY?{ST_*7L(=jVK(bFicNCL z8ixAK9<;_1#S8_Vn@ae{J&M#V5hj8$_fYgGu^op5co2AxHDLhh_^gdGVeXAesz2JN zTf+gqGL>LF&Ugb;BL?A9nHgx(?3A-dG8_C<&wCV#03^ZjfALKFvTzu~&Kl=P%@3qi zSAFWy|W@Bq7jJT;sAYy@vlI-epBCBak#RSj;0P>_XeKQBudxaPi z)~w?9!G=u#rX>OOa-ntVYLDja>!`<_DMLlKS(KwUZ@9SK#Lbxe-58QYxpXYQ4K94e zTzaAFiM7*}N8fbl*kd){>CQNqRC`842{x5~b4qMIaHR6eIYB{7UiDU8h+Q?|wd|$0 zjA|p-eIbA{a?R!HjKsV0%$ZpmjFhe#Ityn@LO_Z}L_T!-6Et6A4V>MXT=`T@=b$)E z56|2*Jk+quw!0lJh)~Ter0T_eFyX6qg4NxHW3Jzq>1L{HjDzckI11ur%0e;< z3^fiyn=m&l#?qsM23LDO!HnZjsAd3xdz7m{s~1V?Q|~nJPW^VKn}C%d|7ciE@pYL~ zDb)0eSdlIm&nN(zf1n^!xS%uwUG+pax#gPawUSoE)sP9@-oAdxfa4~(N4%TwCMakR zW@b+U0Hpe`WME~#OS?dD!=}q|M7yj+{U?}g>FkalBhZKgV-IhH$oKAHMDrp$;i3i$ zvHQ5qeQMg)2u+Ejq#^j7K7#sD%~3$z666k6U>O2Bkt?&uBTq_w=5O}*Pj`nMZk@*l zO4cvFD}AO;hCpI|^om9hf#~UFaKa!Dg%kUDhg2nh=_W;^FhsC;Bg+Wf(1n}+3cXSQ@ET5s4Dy3xdZ??9I! z!-rL^E~=jd-Y5N`WJQ}2DUIKJX@1g&)Mgc*fzn5*|A*6= z*?8lUnQ9}%EG4e&_lx_Zvkcf3I<1hGISRT8H^&e~e~oiX#}iK;)xxLnoes-c7m_+Q z$3HDAB#9(@c=F4yNMj;3GxH|QsOmf|7wONne}lfP8JwU}pBZ?>;UbIHQ4vIQUJCQ% zi9^!dVVWg$exci?Y^pQ zl^kaEWP9l*FxM$b%cm%qy;+qL3u^e&E;Yy zUOfO15~UVu=R74q8_b;)B;~NLOBza+r=}$H`SQEYq`eB^lMu?Ntg}C=csiIeD-5nQ zbE7@dkI@Sp#nm(7+Wg}v3fHgv^1xpJ_0i^M_6LtQJ~DGVEpgVryPUROl~TKi@;I;A z!O9lx83lg_eR&xi--~}WE7mORN9WH?7aaeR<5i$Dvf<4nX_<>at_Ty!iFG&)M%JF^ zB1ZsH-&~!eQ)SDEj!lY*WK>30L-|%Qw)N$=G_PXykb4a;1gFZT5pkXezj3s6Ieao} ziKjl-VY!&yXJBbb7fIjuY&#k$ zG#IMm%0BNz>_aASOUO;V<-jWJ(hdUZ{M5d8hQ)msS+G`1CnqPtGPZkP5(r7W@cuoyIyO(9xPA@1`Ew26uAL4iHd#5^* zdLu(mPoXdbkEP1NskJypYTrzcT|M-AEF4eVh(oEujQm zgy&kX%h;Jeca5j>)+ASKn_GpQ%K%8!HZ^7DyzTCl@MFMG!L{UEV({+uDWxt+-n6}E z8sm84Xq3jd-o5__Q^mndnT;PxhK?fzqPDGk0MmU*EtQ?QBnZNJ;}GXQNV&`r2CO&Td*!mfDwE8VV914mz@9L~$Oc`96NGMn*;) z;F<(pWA71?8l7phSP9UW&Uc%9scZ>@3_HXx5RA-|_|ak4K)7#=1KW?*PG+!y3LZ$}KuwiJNaI7xfoksA7oUj~#n5fA5AKp88_k3;k< zz8A`3Y=4*&GVFP`^Faz6o_p#^Ye)@;CQi-t_MW6K{F$H!nzVFY+cdmZnV=w4VuD|r zKzK{Tx_B6gckE5${%{SYbj1xv3zP6fRNW4=qPQK}$NbR5o?NG}t2} z@2aO?C#sTS+oX4A2b;PNr18~lRvM(=SQMcoJFLy(dswh8CWj~oIfCv;GLjVXmo2v<_?sJXgN&6;Po zW+FXP(!gT7ccr_gOJ*@su~JL^VOh_%Rfo%_97NL01%U<}OCerSuO_>ZbtYdb#6@C~ z*0NJ&mKlA;rDo}miJh~Xp`NU<-E=QwXHoXe(A$r)73hcDt1i)5h1feLU`&S%K2w>@ zSddI@E5A%FI@JqujTH6DlK$HzU3P(YlSPJ7e(vzG=i^@Tv0E1c-pv*=B8~c0%Do zwkCjU6tuc*A*r|ax!ZB&y;MeV&;SbSvHZhB<8~%TTOwg)@@|<4oeLHAZmF19eumR3 zNT1!A`XSjEf{tPrH`iEd|M+)(#)be)XVUvm_hKl$sI@)~YFPKs#45i-T z<%AuvZy6)AUTM8%LNQHsa(qfrLK_{k%hz01D1-4FkB+xx)~yBFvG&#Atn%A;e1$s| zWff}KXT!OnX?>u_V*6-9kSg*e_15@dE1A;qL>Mq_CA0`j9im0p$3P^stM=kyw0Ma63U&r zhpTy(<=5q2tD50a^+^$7mHH(hEtA-wyOG#jv%o{RS{aCnc0pEI2g|G)mew*l>Q`qa zUi34q<#tzoNznZ~T~y%g3$Fjz#rWrj0aNZWqHV88fKQNOAT0Y<*(T=_hrzq9I>szD zf@Yd)LxIxQ$w6RjqtiZXD=aMD|Jh)6-}$8GlUs|%8>|qrPl*rOA769!@)-nI*k_;*CYRSW21ASd%~@R0gbTwb%$zM<|HtulnkNC z4f*cl%pyP~2Oi^^4ornhF;-X~W#fnvs^|ZUW(98VPAjTC+!fwZ zTgkFVrfZ~|9z3{vaa}VFel<`pui*HHV(_}E6@miQZOsL}pOna#IL|sxSN00b*p+0T z#9HrV{q)qkhQr}`k04j4$MkpUSqYxIycC5}5Q+2zHdG~n(wV4du=#hZl_fBTD0vBr z@zu{C2$@M8efsC$*}U~7e%%$nPLbO%7@9W*vdy#AtiZ;jR&?HQpW^abv7iO$$PH^s+KHNfyv+Nu2X~bT|_*)N+PWcWsB=vX>Gr)D45d9 z|3+04&aq)kX1zt%3XFQ=NBFjn0K+-jOd5*)4{8mXr_925-QQBinZ@ERy<>bMLRlCm zd5a4<^u7C|*HSk}oDu7g;g#hcm_@ctH_Y0oS&k)>#OfR%XjM->%PX7(Bj&c-rZfXt+vol(abbwCRMpq-8Y&UWSxsR2per z@99%ld=MiYHa(2s^;(|S^S(V=@J7}_c)XDp*T}sp=ums3^=XVo^C6>J>wr0Trjm@f zEMclFw{_>`(=m3*N^*}5`DPCGQZdT+DNUs0;P{0_-)Rj9q6X%C*9KXl3v)Ib%vm=2rjqV=8fbcDfB(PEVM_|?Sw4N8E-H{=3Uq0shb8PCwBFG z=jX?e*YLoE5BKL%F`*kP#oT4Ux9J6Uy*K|=rGh?Lz^0;Yj^*Y(Wmgfb>-WpFBIb0_ zx*b_Ix7K66mn`fM1)u(nD_d3#fLAwS^5j8eZW?pd*yFk>B61wG-v={w?sAXC9BkN^ zv}}X5OKIERH`rQP?eKefjVA1}ocar_GRAyo?K4#ZP2gvg}uJ%1#lm~G1#93BI?y@tPY~j{`bw}3z z^O)EcDTcB;FJznd&4h3HfYmcZ>$G!w942Crs6tRsu;r3$+L8F{Q(5L6*TTF>2>AsP$NBeJ z!EmVE0Poj3d8wOqm)bUELMa}7HC~FR-`A>`v(b@Px6l9F<(Qi;8tJ|!ral%zzWggO zSbf@?HhRFgV#l(3d&{f&>rf*aUKls|yjG0Ie49;>aaSWLYad8X*S^_}UkT9=;xL7~ zOrfX?KXPrABR_cqHj>~icXO=c83fc+kaVFhHsT_%%BsOs^95{I_vq+P*_L}iyxUm9 zbfEAGSHd6P(>d_oV6W6pZ0ng15Jbe&0lKw54l(X`)zW$xI@Kejt)N`R?1255Dbgw} znbUCLbzp1Jt2~tNI7L`Hgi*FI1Mu1WO~F}Rr(HUNaZIQT9B#b=qd5NZ)52guQj8j5W&3-tt~_{d4!-{N+;3@9hRpFR#(Fo3rg# zU)g?v8sT7dnJSG9L-H4n0%=0u2#uj`@jR<8sJ(Jw+=-?co@|Bmqdnd9*#mK)W}C@{ zM8m^LYxK|8nnaP;(hf6eYf_Y%y@pmhMu)3D!~C-ibC3JpW-R=vUmLHDn4PZ0UQO%J z!XIoFdCE#v8)I4MwUi$6R`@;Ij+Ct6CwSfGU7{s_oxDx5&koo!w$k)3+KAtbb>*uu zB)e+#!5jOcUM%J0`e$pW3VYarb@lncR%a{7U%p+QDt)V<@6sT#?r6|17nX&d~p`|p!~(<;ko#q=DIn9mJPGd8&1Je9gP-t*%dXEm)>FX^} zhsd&*U1Ili=O8>_dan*9svktsEy!ua}L$}B`Pc<*> zS0qWUq=)2lThHdsz79rNJu59OKC|Hv?kWHE)B_l`S`uI>XckH}u*G3Y40N1hUriD8 z8b&>I?YJ#UCol#dbSX}T@*069Wb$VaYRvlha|nx1m_+49U_T+P{dzd)FHC=j5{&Z$ zktjT+X~x-vh2huC?WbJnw|;PQV*0mCd}COQSRtL-m7JB?8L=Cxm`Z*6SuW#p%99f> zf?YV`h=geZ53D91JX(7bWA#c&W)j8pyIv7BEyAE``cd1inQQG$9{MUGiA&Z#QA!`{ z3egDD^F|y%keaE&7S_D2n-9IkF?tmBbUSNkIf^sgC8;X6rg$_z1(8fGU&QBih3Ucs zlI6YL=>|OCw}{6Zmo{Q3_3+*hrqfAzCCU8&Uj6Bd9n>B~kDyM-6}4alWN$0d&gHY& zYlgMiTf{8r&Ev{m!CR58G1nd@`Gpfnze5=db=b0l>c2vmd44jFdHwN@Cf%k36o9ec z;&F7&kcTC;6{N>L_y3u8;S9=0Bd>NZS6*@g#KJ1;AI;WJEW~5#!SQS`gD)IDF@a)D z9G~Aro<;@~fG7hvD*r0s)wDQ;=3~q9h!@PGy4*gjPuZyjX@JqA3WI+Yvzl}m?o}Og z8$OS*Ys`&LKYTw;Tc>YqV&}>5XPKb<#|p~I?fqmrRK;V#!61fG^hgIqy})Azqc}_A zqdfe#nU$hDnkkZQ-s`O3=GBBJ_TBaVZ|BS*FhPWq@Je5vutw|FwU;Q>_AA$yo6UJ0 zZIYu%Sz$<^G=D%DYswJV67PzV8k4;#bM-W4#yzj;L?_(NRbc!%8RWA7)kCV3;O3NJ zy0Cn4Klt>1ULOMkLp`<-@=(#YdJsQwVr<@s5>-q|ISFsPM!i}YMDuAxMaYGmwO@(#v#s}C5Iu$5v?-n#Wh-mDgNcdV zzcRlFRH!aj7#B&aSbg6usnNNzt{`&2uqLG_zN>i1Z7Y`m?ZL~ONhmN@)|8QvVgJhH z0}~-+;3Y}KVy)K)6ygtOom(&fcTvahXY}{ne4d=*6^y)Cw5VhcDElx~CwO8rp^8w~ zAtx`)Lz6i6ueN|jJ15<2yTCc}Z5Q+Iye;A>;vTrO8*)7CJvEQ2^g7_9(;+{XBt4Lo zX_H#IU|i~|MS9+8ye3xEK5K~v)BqxxI!WQPLR`kQSmu3 zu8PO$1p<@=x>%fJ&PvjE2%^3b-|g<=G!GSdh6+cm?)=kO-?POl$$5tI!Wp7(5981x zLQ?Z1m*1BPj*SbAszuAE7EM7lCbnGQ1nd6Kl{C*5-1Uw1m+%<4alH#JjR2~R;8c|P zsT3Y`rp`_9(nmimCiW+@ts9|_ISuyd%gt*8cN6HXBkWyWkVTOEF;`+Qb%anahsCxB zzTeZIkrPHEjtV|%B8i2w;zk*2|8YFM2$lJy8!tZi??xulmEj0hjr4=!r!i{5+gg{ifBjj$}i zonluav)_4QMzjbc2K#TpY7A*)^^9M>O{$^A_vbl&+n>9zi&FCY!p`zBzEYS&Qfomj z>qi*D`x@Ir=`K31)UveCbkwT>!HDZ5B0)wE4MrfhnfxrYa-t>{@jxD^p~ zRHcZb6jEt3CeBV9z1Bzv_xB`?T&|8lv zJbIEgS|(!_&5XJ^%Z(B*%(mN-)J=dzqaJbe^oq#_rQ4d{@Xp|L+UEyblGhiH{FqTm z@}FBCHk@rpe;2c(&EIliDHWQw3kjY4q=oeA_Lo^_Fd7W$V;4+X-N;XaF=2n$lFS4s zRj3n#F7d~4(mYv7;pTy?r?y9c3AkSQObd#Lo>j&9@z2|t9BL)TLX$Jm$^lJOd zimy{W>OV0ECl9euuf6M|dYJIWGTlKnl((9}Q7wUU`P(nG&JzZ!O;Ul`k_%CmN_*4s zV(7~450(fnf|J2~%4{=onrw^`r`H5}G=>U$%n2X7sT1vCFGoznDBaGReTIQH9Oo|G zOhNNtoOB*128r%cWKjiY5r3|9Wox5X0Y%u=&#D}gl~+;TJhH)s6V&IqsZP9hD2L#~M@JgEXkWOC z4N63X75yyEZlrRUfZF381R597f4Eran?&Os&RfIx*3vK%Hfa#ia#j}9zDxf0q_dz?+sS$Z zu(m)l2XFb(->NBacT%SW*w%^RZx0vOu8X%7Cp$C{O#5*addg))p8|L3c2vxuD(nrF z*+r?0>kT^vF~lKIpZeF18wVo{3Q+{H``t9zeR?w(Gh?G9=R$G%h`E3nmhJMDMktuJ zBw^I*D2s5k14K#NqRV;0IC_@DK`(!Dd}Dz0iqZHH#;UEg0?Ko_%(Yf}rsx87nv!dy}s(A}XI;>ZRy0Y4sBSS(r? z_l?ml*P4xaQ*ZmeysDUY%=l5T;`4KE*Gi772&+r9i_#h6?o`|FSHUorY{OYI(a#{+ zARgNnP(xjwMb|7fU;M*wKH=^NiB7lNE{;$jjxhq%(QC*N4l~gc?~#!a+dR1_y8RZX z^G+hy@lS}wgzC)LrtyP^OK1A!h0QP07EXiXW!^xlpo~vhV*r=CP>>n71N?2-O~{#* z<-~RdTX>?1oUsC{z}P8@i0|7x)nPC06hMmn3lW27j0n}#qKCH3g+cEb9g-q)Lc4BU zbIp`lm=g>z(>a-$jcr`?VJ{#`HE|DLQ0%${S7JLTeBm$r8BsD2ro4_xfI9smodw$x zG8pXIN9o=omHWHxDl|eKy=2_5%b!WS@jV<`NJ2BlMR|44kOBpRH&8H$+bZ{zKQ#8A zELWRl`0jZA1%sF4&vrQX`b3LLpDt-dwXMxJzTy0Dmy#dV%;5xbxYWe~#&ee86W2uE zdra-B^-1d6^p&<@b=PEt^uOv^V}RN4pn1WFg09>Qn+r%FzTP7g=GhnNx8uDSXK@a0lnTKVk&=udsnNHGBzr+Xzqotw<~CNw+F!6X$T}+HQ{fb4FHfvgHUm` zu6szpAvku2-GQ*2N`NZ~r%$HV~&F98mA0 z_^iBu=Scn$AJowM5$3Gr*s+(TykgSd!*&Nn&5=A75yH^4Ays{}Pys`I zbAN+>c*NH7ZXbVcS+8I-5aq_*UW;pbE&7a&^Npc)9y;*_Tlqd#2s@hCzTo_=O?wjm zYf#5BVS*4YTGkm#RdblKl9GsAlvaF1M1-v{g!vn^wCqko858mOvWu3fsYH{h1!$~k z=Vk%>dEyWo?zwSI@kXV~*ZMkgT!7&29V1WK=9-^`LXG5;{Y_dR&L4pjS9q*eL)T-tB>vM0d# z5%=fE5u*Qn)Z!~e9z@e%Oomh8#P8x2l1(?E#PHNGB-^pUkSD8+bhFPd$KeLp%OFg%3dmxRss&m~R2#P4;y%T~8=Yjoc5O3;cQ#LY_a5D>oPDoDxIM zS5BDjE59Y=oVYL&IDxCw=TP?p=KH*a@1%Ce2?jURu|P%zkmlM$VYjq zE9QL@;9gVL11eR*l{=@8q*_A%2}YNn$+CIxgdVpVT>c;Be1Ht7SD~z@EZX}1uMbM1 zQv-~UT2yAGQj`I6EYQCOAbJN~N-b(_`QS~$b|M;+On_`s3mK&3)AnxK$`#CCE~(zC zd~{Z0OBvxxF0ldG)b~!;Ecp%r_A&NZ@~=aBF0m3t;cD5A5r&i;Pd;SmyQtgZ62pt$ zTFLY%7;l%;-P?ZIM^EAF0O~X(^;iUNP=Kc=B6@0DHJCD>k@aEkE2QWA-v9cHiSiJ1 ztz*@H5nVBD?k-k=7VFSg9UdU4bhxP?fC@j=$fI5Gf*|MVN3*2YO~{KI8Ga zVfbI;(YU(cG`xz`YDs%zD6D|0?O0Ou1+0)p9le9O29xgVFGAS~yiws}{GX9p<$_fq zGcN_N_8M{Zl5ZaXxiw%%0I8Sb;8^_8tKTXtxgSI=QJ8_e8)GL_TBJa2wsy6`2wa{~ z#S?=g58X3FZXc#KonrJ#ouVH+C&4@IW=nZ#Ft|>vwi53VREtqhW`BJ z3+Wlgh_8Wb^mjyt;qj*vTXmnQZQ)2SVSr|`+0uHG(CU}oBL2_R0Sz(ot8FWx$d_~W;J zRL((bMhtB@4NImOX7_` z^g6shys9k^BOmHQ7Jtio@fi`Q=v9 z+6()|Pr;YzcgY1HDh}y69Rd~^8R{zPD6so`Kl8*JxWtL{1b zYU42BgrVkKVz}8bG;q|^ALp6D&ZkQ*!MTo0R>5SM-68-B((P~1Q z(@W%%9(ys^t6%myOM@kz|0>0(&OS5GLJ4mn<~hR) z!(QR-4>?RX2B@Va12D>Aw=fEU=?vtdxbVmY^jrN~eh}X}S6|E~7}B9$V_(PHXX(}` z$AJj-!W)R6@smw3G@}HyY3K!-LV8O`iZTr$a&C(o~#en&Xt&CBvPzKgvx^tw` z>e?YWBTZ}!_XN%lHjF|kUI(f)?)8{t;~?(t^fkJL(KuU_L7oc)uS4C1>WrF8Ge+OV zQ@S~f*s!(L^CEQG%zW5=j@<1XU}h-PKfiwEjPze3$x!ME$^U0q6Tb-X{aljmcpY{& zl9K5i_oJGJuEkORGghryk*{46mTJ`T`-$|_Hs`g+q11EWboENgWc|QMzxE&jfsRGa z*QTwE0&(|A%D-7qlP)x&h}C4>B6_lvm60*8R6@RLb!F!WBI~$l0TjaAyKP3HUY|S4 zmB6?2n@fqu`y?(RN?_{!k5^rvjcG?WTwIbKE^BgaNNT)Fn|jMMZIBYyG)o$m)%uQu zt-V+jl`*$9jvx1`p+C+CBwd^JLs-{Ta)`H2%7?I9CiBP0CJ!A2`XSyJngfNi0!4Pb z-S@(Om9YEFHSC}9>O(Is#?q^ZJ)(|S-b0_h0;8<8aKL4-jNm%ivwt@fqQkL~-eL4W z@S%6`dfunX2Mk3AK}eepIgO`*q5ySee)2JyNErD|wd&k~52P4FfM3F1kR^)yr$X71 zhk3HL_1LhyT7VTqu1HC%0X?JdJ=pk)Kt*M+pL~vqhufF-5Qn#0D$`{1kChME4nL(W zEI-DPrAhsyk;3JNPzuTf#gZG_pCS7>S}&WLIK%^&%!&?>nJr^M30r8xX&hCJ8U<@- z)pzxZL(Y;W8j6&7yIgZX%oXpo0P3u(8JTtpyXo|n$i2!gEXB9G1*|UKE+|d(34`_{ z`MtnpuD->DPa^fxz~W=3S2+W1zGDA!%Phg4AgSK0%UpGle#*b2Nst>|G-4OnKEKpa zOjqnTFrM8HZ~(1d_y8+bXnmS|g00_+*0AP2z8>++(m42}pr9Zmu-|f`88a;hD|Y;v zD=ZI$z{!J`T0Kw3>iaGl2X~02prUi9H{p&ZFLU(txQePB`O!vfyXx0UvnIye`e%RT zkP2rha<}SvZl1eowO;?AgkL_om!I3#z%HRaq+yGr67ib6o089KSlvia+re&xN-|ey z!VHfxHeY)?!unxCtHNvlAHuXiBT7Ut8Rv5zlMq$HZVU z5_30Q@+{mygPo{Vb<*ZN!(cCm0}BNghp-v=A`g$YJ7Vr$+CbIfTA}?L=nBQITOkRd zt51l%=IPDE`p4Iz{Y1c$+l~0jBM_CKqmqUEBz9jiA}o?4wo%X8yWh?qFgy7PMTE-E zh7>TRD_!R*0d_LGw|1mb@q*+L>k!4@CQmCF==@@ne3;6U2(^f=w>vxB*(a<DX;%xqRtd-Znh5OWWZ2=LwjtX&_HV+L6*^gK>Vt~4O*8cHcHrKNNxOf_pkm6e z@-e@EHcFKtpypWX!jYvo_n9RQ!~Xkq6Z z>WuA~3&v@tu}+AF>BRD`{c`5N`CJ@zQ%w}~NySps zxcWbQZ_cQ|vS-n^(LT71dmk&_{$99x-A)Cd-)Hk$-$9XENm}2lbkd8*$ zko)9qnT#3cqDbcDGXAWL0p-);9?o6mmiB!W91AVA%{x}pS zDt)TpAvd3pQT8SOnk;o9v7G%qr{d$v0sGT{Jo{HTvT!U|p>DZKLlY;4AFnRcQ%fGJ zN@yEV>~D1}SR)YYQF^~51$%jp7%)eA4%N<*FyG}i+}l2ko5XA?e`wZBon$Vy&1)ld z4QhD;q`U}$yI~QxOdE8I$=N5BI}@>dt`W)DtFhLD$QRa9=8;r*IU;f)_W&Rm=gt4% z)l7EP-hb-9_UECZ)@xyBR!RGX8iwy~4Ou@Ke(GRKU~C&M%L=KvMD?5I?PA{V4UMTL zTYx3d*IJIgmW%@Xb)SG5RETx|X6Yn%Vn`1`TK<}aur0q(t*5)YyFLJx8ObM^P83%k zjq+^6u*XP8`y2PVD?gdyr=lpI+u5TQ5^JK2V<)J@kDJ{(Ur_^!PY!O4CQG3fhfQx# z*hw}E*y4A~hCw*vHs(Nfr)9;dae9Ws_d(xT+jX+>Q-zSTk6@YJEl@Wtd*H8*;cSL* zhI6^rX;`Nv>Cu04}H1CW_}cd`5cWN^cSg)33p?DD|_>77~;M2Kd=KSVzAikDZELa2Fedux0cU zLO7=aJo8|l=-WBQ9JWg(N-|7x&@%xuHG>QrbPb@MxqkOCiA}l@UMxZ}O&-WeuHANii)mJxEK5Z6^ zXX@qUCHxdv2nWxF>UW9~u3SW-1U0%UXRq}{yrvCy;b&_e>C*xhP_JHH-lBWYZkwu8 z7@g#3FkL$Wi?AfZJdCCgZ#$qs!wy_7`gN4X{0fLq{-VI$Jh$<#se)-Jl`5lkF2FG0 zjY|+l^^kP@mX|qMK0ZDM@HCJ+xFZvB7vw|5ZdnBZ)_?C;hJ&B7_0W9ldB?*Qw#BoO zY+f^mKUzV9ajT|Ww!3{&AGXYm=(&H~*9RQO8buwVWGlc*dADluu^-2+C?93O&liqY zVZar<`$b@Jv@F2M3ca$xE1z-HbmS|hU3`Kyw3Azlf=S>sK>~$-Kmj6oC@qGuGRU0t$slh~$cL{{;P++_iR_UI2%&k~q#(qg7& zW%;F&UXo8PuPKgKp^EJvJ2hS#4xBNMP`_K{eFxk38Ik@gIL7k_K1=M!mt2o&Qz5}h zGQP#b60L8*+bQ*7zi(S7PXU>BXhLtE8_kH)H1Qhkv!~uykTp|Mhg57$zvf6TM*$Q0 zTM+-FM%ipmF0P~VUuW!nHRp8BfmsQT0^;d~g|NuBI~?JW^8E4BSm$l2)Kg^0y)K_g z6o0(r<<}f@igF4a2{-xg=aVbI10%i}iC55bxa%p9<2; zsr;l=Wu47BV{eOl@(v2@tXDA+M+qt`E8nG%0$01GTXop%+VX5WuY!45J2p zc7ZP5_3>8=v;uOq6=v2?CMG7(EiQ1QvVM;J_qdn)Eq8k<=1+jbX}%^t@PsieEom#) z?f&0`Obk*}Q{^H$vhWrx$oBzD=w48yr>9#FaJs(IkHn30O_Tml)_d-M$sT-0){&#} zI%%=AaL)Bu8!FKX@Q!$#4v9k>K~nlrq4R^^9wY0LAsA3Of%smwN^*(64fA)_R zns5PyVfx%nZ>SdA+a2&Iu`~JPM8Gm%01tx@!}|d7ascs63;>)F2*G0JFX z6OgQ_qvSu;u49|F{`cP^9^0u=r|px7D6M5z8mnX{``7a|o*CkG4-JdV#ghNPa%)Dubi~$Y zTiGiY%rC}{1vALdlXif6X1OP39p!#$9FL^Iz&Y@}OX@K?h#+g#yevoLSX}Xy+~Y?Q zFRvNwqQDqw2ga@nZh!3+WL6@kzja6gqUQNoAgilad~yi|b_a3Dge`_6$UKt^m__Z# zJyxz60F=Ib>-`Rc);3p@MJZL=ht_*>JStM4)gj8h@#Cd8z|KTuIdz?r^Im@#J1fj@ zfo>4=H7uRoSPMhEr+Z__vwzHz{aBi#s)n{dzn8k($jRxD!^oyj3I^@fIK~>2F*7%J zA1ifz1rgn?q7l$LCcz)H7}$~F|D*A~&1ZGQXkjpm4s@9txQ2W`rpjUZvM1>dLf7q_ ztAO#GJIyxFQW?nBiom@9NC0vP8y%lQij%Pt_D1;SQ(9nRbLXVm;G%9`Grq$A!_`~IMcH+2!z9(~K%hQ?GFA7oTeqR)>&M_&b4v{NS1(7-<;auPZEK*^!5$Q7)R+#0r6PvXYu&grNesExPddr>9dKV23%-fh_PElN8 z?E#-R_zj+qH3%}tV7Ub2>=4|XyRQaB6DSw?l97q2ktIpdkq`|L7~0vUx{7=&lojl^ zAAeg_a`Z1g<0~i3MMgMNNLWBn^>sCYYWSqtyB+7&J%1KM^Sp7|H;WJHCa+#b?P&f8 z;Zt!;jqmcNP;H)aU0Gd+o z>OMK2y+?JHnE}8}P>J&Lo>fZVWjx!Mrxqe8KPGz9dqr}eA0vyOc0Y9shd-xe-(vK) zNTXrw0#Q^QIAVAaBkBAduOfHyw+k?^HKM#3}r`k(j-jpCiY)n3I z4vpXB!)6Oz7kxKeCmc9tcU%KpTffrv0@>1`?GHXe{+tKeDugM?PxjOb0nPMfv?hE@ zQxf$frUafnu&ZO&l}1;2_mp#J1@Vr3hM^Nta(FMsdd7P%uj(J8qhclNo=8T7&%#A3 zMr1ALOR1qCG?m}V8l$fWgF&1G2}!RwZW+0_T@xKE^|C37Fm&`DsPm^sZ5rvg(Jcj2 z<(TB?jgSUt(qWAB!BbIynhjr?u^ykK7e88IPow1&goRKpVcElsiJ)aCRa3h4uOHrW>^&Y)u zgnb#I^Y(vhm9pofFa$_b?O$F$#{#@CCa1JiPwC15x0~XL%0DNEEB07lzZwGE$5@hY zcT!Ye=N7YgSl3fOI@i`uEYt;59k?O~Cll@2Q&Pg!aK9I>TZv?U@BJa*+U}W37xo;A zTVs_tsL`s_YTRSWS?{c+K+Nm&Kg{K-?7i&Jc^n(l zR|@C)d|&up<#p0lLcITdPoBt{?vU%@^LjErj4lJ!wuj|9GAF+{c+_0FY|R*>_%O{R z!xT8gpcDe=DvL#H_|WtF#7)s*gC$VDT#>hItGNh5N%_heZSp8;x5F@wym)+rFvRe^NScNl9)+)8 z4u>;Lfk{+Tt@x2(NB>njQdY44AdKo!rcX^r>3o6wZ|$d>YnBg{7Vcg@3LxB=X|dI? z<$x@OU)R0)dP{7Jii!eU@YJ4~oUO*#n=zY|5s8qMQt_4&4)W7KGWsX5YR|bQs2iSZ zK|W?*mpu{Mx@leY?|F)koa8{>xQ6`PV!T`KmfLK@?v=(kIgj201w{VWYk7-Dp zR;XUB3pbQdSNZbCI!u{C0@x?;(mE}y+Z?9McaO0;v_F3W9V!qUwfoufy{%fqy`Afw zD;03EJ&Ek{)+pT7y~BO+8?>azems&kYf-1NZ}1iQ&`fJINtJ%N6{GZhgX6((pXyaW zR=Sh%O|s=&BH;GGw@{D>@fsJa$yL-#i;iuXAu&^zoI z|9H>UVnAk0(ku^GgbNSt$fllGPM@29k7Y-9z;6?}w#cE1s~gie_N?P0CB-`wk==fx z7v!zzxEf+HmO~9`L&K`pIM3-qsQk^(*R7;5UM8?i*-(d|6p5ElLv7^>nWqr zxlI}-@cKCI_4}ns5DAR*O9tl_kLBk=d`WGHBkISY;_Xd)#X3-H;TP3WO$?(Q0{zds zLfr)^O*+=>o1kuP&zjC{=yxOd;$yD|^w$a7mR)*myMAtKJaV+_qbS+wFPnAUb&K^} z{M=)N&P1OPH6v&Lp|(|XaB^ba&EWL5Mfz>l=6+GTo%^zxlW-Dj!F8i zS1Rd|r<|~R`#hqex7o+y9c;&xO-=8Z+pryrewFclmv|mr-^Yo$j&LqW#9u^b%+}r} zS!BazxFJ@*)R%STTJ><^StZ(Kk=djX`%xx8|Mx<(xqD5}2bm8u`j`F+Ilbs_Y021n z){McCAfxvg(=>NG?Rhg}8G3C8cGpb*rx(Lw(JcO_pTCYmH{zesELogeJY?AKX^*T6 zw4AeER^(?H+t(`_QS2#tOSl|DC%~Jh`ZHfuZtW*e%zS7`X=Zd?+@LhMg1ktRjOK5} z38&a^71<84ZQ-v^`2m&ywv!Go>K`tEZOBh2d8~+4)XdSoHNqSfaur)7^f07>v}J4F z#x-PTxg}4q!rUrtyt$T}+FvH>&6(%p#vu>v%)dMgG1x$|uCz!y?TKoEq~N@>9M&HZ z9U=4($RErzUVqzCgbTi~dC)V=67N> zecHMX5YesBPlK7r(bYgaGyaDev#PMbp3fMZgOl^fy8O82`w62ZXdGmk zGE$#IlcpZdp794bzZ+e1OSRJcBVAhOOFTu%g=3@zCw#+=Ic`l?1-T~V+;PP7ow{36 zymT86t7&VrR0>+}A2wL#5Fw4{s!FTwTft;lyox6w_7IFp4B2E~vEV(wIFuu}SOo1} zF_l_2(iaELxk|hU zYmF9a6TNEDo-NYAJ|Ie{qjrZs>MzP=p~|Tm&2lfxQVg|0I0#~_Il0t}($bEzN68X? zgiMGp6Vq{qWa%eeQ!qz>r$QNkBk6ih#L)612%00+GrK%cyMG`jPDj1aN)48ePKcG z9P?covwbRs2dH(9mPz!eZ;Tx;Xtd$;#cAWqLCWbn=Fbhpg2Of`PB&fHi479Fujk=>$x=)6Yl^ei3MK0r}1td*Hb?xyv~zkpc>OJD>F^phvOA?#(tuR zhqcY@KvelMLt zmHF_kmU1!hvU|2eZ>z*t)w5m@L&t9w&}OD_@=-4mi}MrE4LDR~Fwc1&QGApS%>1-3 zml+vIa5OHI)=a-JV{LY_qRoTIId~;xzVl(MBIv)?FmrHlNdJDKimlbOqT>fK^t4)H zrWEQ3SROU4_V}P#8PG$`>`5&vwztMynr@y=OwrtafRrEI4f7JB&2;dl7@Mp$gcA}F z-2Q9BgFnO9HV6W$ieuz;8AuN~~iZJ87q6TUYpxbB)X9mRzs>Jwbb!*5SAHBtO};vAxTMj}K?*zoso z#Qi-SfRm!up>wCUIfvxlPIO2bJ@DWh;tihrkQ6dtr^z?Omo?&1fa#bfrrkySc`B^N zH=}1E7;;tSC7btK^o^GAY5~WC+H8rP>V(Nn@n`!&aksbEAGaV@*}ms)X#mmvPuyx&*b2UOg+@Dpc9(0Nge1Jjw@+7ast_8YLS*>Igd%Ut9uQ6 zH0^aS%$lyQ6k;CFm#VTkI+pM3Pc(vq8-oNzGz>yQLb&2)LW1g6OB`}MD)(VnOnXif zx&VfZct2l8NNiB|)5uptor=8)yd)L2iB6sN5nWHCkHg+O!TH{8IAvsJF36l;g@SUm zqUf`w2XBz|mm4az1d_>sm@e_xupo!`RoWNqiEIygQR?jO$z0f%-j@T zs>|IleeunM)OUAkTz{70Rbtv+C17qp_F1B42LKxTa3}#C4vw@yjk(x6*9Fo~s%#5O z8o~H5%jMIq6P)SFC7sgOfI7-9yV$hmTKn26qjZt1y?$}N`UQmj2=DlTiuK=*Y>#@E zx{-kay{yj)8-J*Q@>J`|Xup_Y15(MQMR~409&}h!Ea?MCI(=oB29c}L1IXW4cGOp^nDWvvA_exSxEdUwx0Cch6ixqXjrd)SX|r@nEG5awPtjB`r2Z=H@(rfIPk zLN<=)9F3zCTbSU~PtvbIi|AtNX}1}|mQT`)YUv^d#|Me4O&Ox+r&sX(gz8lEAh)=< zSoHL#s`;q9ev{g|(81GBqmnjCg40XNYAT{~YQqYR;3j*TYh)kAC@DN=$&)FJj)sFB zJRl8Gbjd}>NCT~d?P}P$TzI=9l3iLnJuB;uJ#ONX48!EfEPE@qt{9NHkx8=RQk);m zeavH>5xXJ^z6L%v3yDF8n)666T_|LRoUd*t|k2Par>ZHA`>I`SXsgxN(i?| zhIh1b?q)WV zyEeTr6>wdB+9KA=6UNzj!z{sMiKpgKE zy0tqqCg0VOGB!3WxK}ZYNz2;Tj!ql(N5B;KkYXnKS0NogOp;}ideTP&+>G$#p?UBz4n|@!_X=h#jz-LcqymssJj+?g(p^yG)6+{2w!BjtBon+Nao;sfUq;Ax zGQphg)?s`kHHSCJXt}%T-CYYH&$)b--GB9jk{a5|&cm}vJ#_Hm{P4a)rS2K)`H}uO z0>vx4$AvpDdU)F*S9xSe=uoX$Xg0MF7jz0}z4fw8!GW$V&}@4JdTO&yWXf; z@$tT@<}oXMV$W-RusDjIUa4kD32+IzOnMBTY<$G(u1*nt*8s2p*h`~yvTN) zdz;}l=>2(S)(&M6e3>!fvJ}U1zOM2qk9*3?p5m-T5r70opYI;(SIjHKNf8v3P{%&> z&+0H)8C|WCSk%M$5-SQr&p#j6kt5-gJ7wrB1Iz2MxRv^Bn6VK(63!G6-HDuWFneh9 zEc*alFjsOTa~!&smoH^!`&g$|SYhMvLTm!!b`sflo_h5XtD0f$G}q#B24j_BC5xIW znA;TRXAf;$OwFlO(brxF80Ne45u2}27;2dOW)u8z64s}D)BNFoRFAr8n}CMrrsU9ir#TzFUU z=m?^#j=Pw;&2CNjB0H2^24R={?BhXHq9;RpLJg&#_y)IrThR*HX70%R{5)U0mGZG4 zF@j9tl5xCW#%4qjbDLn#?kQ{wWTR*YE)&(EKSFaK>Sm}u z#eMCh-($xi-4&6hyd(D1#^vek>E*EbYiJI7=D_#WC@xOKqXw<~e)lneyDppv5jSA8 zUrMZFHDNR{f8No7rCl*$y!7TJ(FHez8M%v_<@!rU?Pvbi4+og-7`cZk6LhV&WGtlJ zkTCZ}G1enQxN5wJKhZ1_!7W`m4O~4N!~2oHE`awo$iCZ+2FES0BpdcpL%#JzH>TsT zyAWlZ<%X0$@p&qGSU34eHy01H^a&r2#PoY+*cKUA_qPirYL|F)y8$+8Jz8JQ4Z)t8 z+ch8<_u#Sjq))7cmRlVm8M+8ddiC;aU2LRya}kH9E0T z_xaY(%Uz4ZBhm2?^Cgz`6WuF)^55Og)o;G3%=~fB7iE`BA3`49l1=d(b|lx7qGu3< zSc&`+AO|W;NQu=LJOk^yv65_s`H%v?vGFosLB{vDe=T^H5&gR0fB^n_ium5%=1?JY zJgge}JouI>wv~5Op|%4Zzhc`l;Y)vse4brwyS1;SfPW&ooqVA)>2@A-qlyyJRqJmE zD|CSvpS+9=>Il4ybNNHEed5Pm<8!uXA}cB1uV9O@>NHDDXw?rOc!&U>b~4o=Wv?5w zW6v{rX8-!0HjRmf&o&Sx)f?iPpy_a9{J0Y3lg}gJ4_!1RB$)XP&c`NPVM=7R|LijD3{Lip?wwG$Z zHMPa@oT`*^yd7gpTICz+QyDTXjjt?*4J-+^wU9z4nTt}C6~m6axL>%%Eo_87(c~}{ zPSQn00yr9OgGF|F0Xsr`7I`U05xwRj5U={Gg;MH`FkXnA$bL9l)u-H#R0rJ(FOGvl zj*(d^n^Z)%*y8h{zCqnkzWI-MFs=X^0h~s9xyl2>ry0>6IgtmR9qdmYNqMCOouZGk z*U2*VO%0|CU~7K=BKeLqNIokqEdAcmKxJo|FE-S|IzwHmQHO-iLI7^bkmO%ZYTOg2 z665<0on)o^yta5=flD3XbSaWDc_}D-;Ip^3Nf~|h5i0O6XL3vea&zft#pN@_y!3#? zu#ekNvND>?vGZe5-?$(n*m)Ky&ev^wifFO6Du!7^ebypQXZ z)&GDizcJJ=2i$O69M;x&rv1ZiQh|6QKW<`s40wh?G>&bW@r6LJnI9L`CAU zgR{fk`!09(q)lZ>W5U5egYln`ynK^b5hwZdtYEh!WO<=Fs|4l0g~QN4+(;!+2bxDn z_WaThZ_%d78KYzwaR}j}GW-7|5L2A|1PXRDjx?3KswPJ8zjosEm8Dnh=kSYDl`CZM zPny8j-eygI9f*=}-HvH5?j*~v6qbQ4g+N+YbQ!0O62!{zR7-$*?p-60X7=s+VgB>` z#gG7L6rSu2uFU>>5tu`NEO2x8;6bP`pwPB8d&rlUJJGw8^k8B|ULG-1WztRPGlsDE z_O7J4!CMEQ9=Ox_*NAp;cZvyMRvRtACekEkr;$WIGv%j@q0?zGSV0bHJ$fb}9bei5k(;G;kp9_v_S~%^X=J zo-~%0!pI;KqZKDR{h_f&k@}1nTeI5dYKEJ8dwxGP$7ky_W$;vvYr8rMmc1YnKYCl} za~F-%|B-R@H>o$3H{6dH-yO$S0(I!BWhf4qC=Lpp#p9uOvXK|PZlmGM?9o7ZfhcwJ zHet&F@O#~IcCP=(tWZRPa5*({Gqa#j5#^%Zpj=d^S%(acWX4z#7dT_;q0VA!y`Ow3 z-V&?lKFo^x(`XC_0}kF=e1U?fXqon!YwJ=}GsgM}I<0?-#6Tu}@%#huIeFw;41*hz zkQ1C_^$huCDT+E-TP7#|gbVB|QMtFgz9GQOD7An0=dH1iz(#HuX}@;rgUXx$o8eL3+!Yk){r1Vg1P$|Tvv=) zu@rE}p^TOet@W%VItv%wOY&k1m)-mDc!p}P|H!ZAsC~VSTvh&RUNMB8 zcE9)HmQ!R5U$xm!dp{IKbzW%qbaQjV5H*l&&fZGV%_B4uy6VM}{1C>C7;Yf_JgL0Q zQ?WCxw%)kLK*3L{d{bI1F|1PsG4FDX#o}Z8X)N#Nv8TZ`)5OZnqe*&W?q+zhXV2_j ziS^2lepPSxzRk3IE+h}RD+_?v+du^A_Dx^RJ~9OpXT+T-qL;~56Gq-6NO^D7z{W{_ zuJJ^|X{W`Z7hu|y+lziU(~k@(wkCc@Z`@yTlSrV3f7V8Odr`DUO%jXI7?wB6D87Te zxBp!GMUcy6gmkDr!n!ax);D>_1&e7YuBnPGR`ye9`FqvqakW|KfEm26>6S?H0{ZJ& z_^Aq0xLA%vnUfC%;}4ko71`5xg$?$&%NB+M>c4{%#?75NFNQX%0&gRg0?T`Ay+%%G zMryqc-058A9MU;ueg9M~PI164vWRO`mo&N%<1y$TEK4Xk7X;K7 zA}7>;hiahWwmse6?IQMsD?301Y|mn&T~PZQpvFZQD+J;huSO|TJh7~bZ8{`+L?6Wa zLV7JXkeHi8$H^ir>d)IaS>d?OUKOqva9lY3_6MkQ%z?2gTm#Ps&Fyyw z2GUGaN@Br~332X>7WqKwIEgh`$l3%iXrZ5Ev0jNWG#g$#d}g7~AY^N4`THm>2~d;% zwF(@}Nc|$KRrOf`a++#l`6;SRw|BkXi0i{c)>V$2I?jaG2#>E06-feo17?i*>dK@7 z*;~?2&Lq=xB+NKmd+sL-RPEnGRevw-mx!0C9)zWp{0 z)^=$)%ZJMc6F?a6=JIiml3MLmK*m}+9q6&cg`_3aX7*+GztfD%!x=~qV)B1cq*GEM zJ^|rmh&hmngnvKrGX|mKDcJ$943O^Q_qVmxS4%zR+Ia7oxtoonqNe7rUVA1o?mS^l z#{fxp@j7FhU1?=PixV6lB%`dEP?du)1;*p9ePaW40-V`)nS@Zf>A5>=qpMc-KUYuQ zkF;qX|CmGK4*C~v`G@zKUPf?llmEES$*jx<3e(1#Sxw)?W~PmYqF2K!`8^G+ryd>m zs2GAyz6R&#A9SoFetH_;csM z6Q)!rq+#B}dzXga?t5cwrep6h!S<+wu=>=k;A&>vc}=T&7L9S}Efk`}KMCDh@P#?7 z!Gh5H5dO*gLrOpgdmn)9##UL!`V^Q>dQ0qDQ-Ye|IC5=m*X$B_dliLB&7@_aX()(d zAn*6;t?Pa%5OY7TP0`eo8B@s%t9lI|=-HLxD*CQh^#AEDzd(yRk&}(4FpQ&GGC-#? zihVejy-^#hQf^Stf{$VP`bg7;6Zv280gM zn`f;(z%ZR(e`>?nQEn+rx$<0^f-yzjUFFq1l%>{oj5!*E;i?L?%+LRLpv6GwX}~6q zZ;l z0&B6B$MEn!#8%t}N0vxS_`a9T7vRSTggJ^{PV!M45W@8AK?DJiRpR`mlq&!sv)M)` zk^plP3U;hKzulr&l5gY`6ucr?y0~CV8740*EOaI_=mydr&)?R`9PdY&*|Fl>MkA-TZh6wR`0SyK>Nh0n#IB^aq6ksHNm* zds)XuDWCcKQ?7n|mI3w-QxT=q)uA&HUi-pMU{!f}Yih6jlPRgZyK5{$L>@u6S{VNP zn`*p7PqKr& z3_%FFOb$%{IBByTtB!6yv|}uf7BIS5GEJ-}}z)-?5Ibq(xz& zLsbR2P3o8uEDOxq2ERn5l62vRg}r1f`l_El3pNFID8FkIRfl2b>gX8ynG}_BcvSb4 zUlwVY@oeO4GL`!c*fwaFhBA;WXlrNIERLAjMDFN-Ky#IxXsa{w&uS*8D1TfuBldI$)v__@i)D`=0!ME!Ovh=29QP@j8zjj9xNN>_Q@~rY?_{ZBVID4++vn1 z`}JgD#d9&@Y*M~aoh>E%<#qAE)!35-LGb>IHDT}^ew3&-=+dGw+|A32>21>C9;fLQ zO;;La$6q=q4I2^qG)35?oC^f*Ty3+=QxSUpPN2 zuxchtONe=!hWmWRVob$kb3G3CAO_u8%Lj$2O^lftxG(FbL8Doo9K`V(iQG7SMWQ@z z6KC&<_ssg~jSBbqU_|eQ-2VShg8bL$^)iCE>qxtwdeT+WV8sbb%O+V77hsn7fU;@S zq|Qg}tB~;a7x1;*kzBiYA6j1AjL38gL>mAG>=Mt6eao$xklrmuHA3-V_&b6dk%9Px zN@x@j=R3st62Co7&wIw^kBOc}hxzU)l-nJLuYD15#^V0g^N5(-8Hcel)9~QN{zpE^ zPMY3n^V7LqkN-(|IUPG zTH8r2Cm}@nb3)l6skL?Gnh89X@56z{BpZ1oYt)?LjKa)2AUzf2G^sOe`2O86*|0qu1Z<`TURU8F}oJ@s({&NAZ8E}|XTXy_!8ma?Qg)*)cI zixPo8<&kfsN7iNRX3yaO+U2i8qw}Q zF**58wp7jQBdU`(EPkA^CEhR<&wkdMkdOek;cdpz%6!pSHwdKV!*o6pv=!hO%RJKj z`fA}{&CM_EpL^mTIL+GseWKUBxqZf!ng@ShvPnSRoNC-sn4Nn5vdd0=}ddA!0V>Gl}Uxm?kpeVF$@pPB|4t zxSB_?_g(Ca+zvZ2gx7?hom=Ghe_3!KXgW9G`&dE*VF)wPio3o1v@0VQmi5f`{(8UP z%u?c~_v&IcXcBlL2B+N)K#qCm-w^t&4a~wkqvx$^rOM#dj_uizWlA#C{oEA1Libh0 zds^-~_wk}BT}4(&V^A`z3Wygw72^=O9rwD)k7#j1@#mf9=hoos$R7kK&@z^upR{p6 zd(D6Op=%d%mU?r1V|@4_>Q7(0a>?(=gP@s|II2%>Ef1IHHa$Apt?3o8D)ATCy3TI@ z=WrVvG;kIuFYlsyMRIYR1SGXTZL6p}K($kCT@@NRfFMoOO?O{GEeEpI&H_O) z|ErZGWG$Ih@As(iLF>0+wif$8b9R-PE!$tyB@O&<&z!XkT&L!*HnR`rE3;l>Og?Dz zOi?W0SDddWi#femrZ{y$r>cu^K%w~Cun^pmn9%P>V%ztYgZeI>bm3A8ho?OplKS?W z#Ko)e;a@G7h>H-G$HH44LF@wp6y5w9h&u~{i+AOW+l*k4fXtoEv@|k|PNe%NNM65e z**eJiD9ig#s`pk-$nVuxbGH{u)W6#`CKh=}gzTS43%d6+z=@N*K=ZBK0&Xe}V?vXv|DJ^;8) zLtRmriZW2+kiD}Bql{qdob_0X;vW^gTn^mPRK_{KS~&3Izld`5>DF;W6QbPAE#&?A zMbsq$a5J_oX0q`mL(!ry6o>=${>M-kSMu)$ML?Gzxq>6Z{Z91#ru}d}PTvsciqDgU zUC+hzI@^4BtpEJt@kSH(^_VjAyrl26fqU^|=+V6QLEB3CbcGqum$tJybh5fn|J%ZE z4&M-;VD)QOIz^glimYDxd{ZX>?#<`3gbdR;!tA8|56RFv`Y9FsL@Y;xZUH?jMnF`w zt@ljLK;9|?Dtp=5*IVWgiDt3zewcN1?OB}9w~kNFunBVQpG3_HfJt%6wKoPZ`1kq| z`AVFQ#eKCz!XG{R=yxRMJ{%y}U!r$Xo=porV@rR z*}E*mc^o4m>k_e>t*_=J@XOm_%~T>a0xB{jI4=mmiRu{%S&QET&VK?(DQ$j=i9g`> z;0P=-84QriTpEJ80V94k%5R+XPc(M}@g#I(Ha+DMl?pJ{G6MVVJ;b2PNPtGmCj_@b zEl9T^3)A*TMS3JJAPO@Dq&$IoR zi6X|PnPUx6MN9SF=}I-=njOgsvy?n+l)1B3n(#dO)+E_eUL+}s$9f%nYTmWMy9dcj z4~xB#8%EyRwm^z)6%hK*vVF+O0C_H@=a$r-2T^lvY9uR<{9vccPx#R;o392O^^_i6 z{PqMebEE(oj%gvmPh*Pzg=&WSj1B_g!F}H)@dAD3g-=f-Jbsz7+%Gf(_`gpSyY*hy zFuO#>0{T4knP26NizN=7zXBU|TXu|XBuiCZ{^V;;#oRYG*jLi|3m63iIB)s+>}qx; z#&e6HQ;eo8S8n{jFwAe(K($2J6Qx?h{v?M&F9PU!v=#wCH;9Hh-bP&aAaVAudSME$z2?HFgR#bP-5TgySa zp25fcwRXgx$1(dQ3BOz&%f;0H+OS21e4%j(goBduatikDHmFzt59ZI~#X5o0)7_xM zl|WZVo)H}JjP<$}b7Sv?ZScgn0H?Y*n0NumZiY0)D=Zk*&1& z8w@G^wg>X1XC~HAd!n4kweHu>8DPxFxf~#1>@(Wx6T>W048A&iKX;ze&=TBzr{UOPI8j&#D&++M>bF^2qV6dSz6=VmYW!E7`J798A_PKvE4mdJ&43wgTpf z098#OQOK{p)*M^Wap&cFuOXYhddU{lOp$0$&mTD^)>%MPNu7Ex<{Dpe zPGz!*Enl@&y07Z{uzAM+c#6G{zYiD?$_0k%>7poLJRGyuDQ$mHC?1yJ{__z4EE@Uh zoNZWbTCY9jWcR@vag{^l<|N7rA)S*JW0@v>vt5Mnjd9~njRC6FO2?V0_7+gY#x$8!fmzvfhCqiACP%x5e9U-WCD3vo6;VwP|xnc|x!)9sUbC zG9~sGO&jtTNEkAD*=)&^L_VEw*k9)2BTJ&Fdb+{Mr@t*PUrESY@pv2D(Hg|Yh|cnb z3ZbcltlzI-TUWLFt2T1*f%UyZdm;Ca=qXVsTu<1X3c&>=3h*{0!1slOwEfYT8|M=~ zxcSM{NSd%0E$Fm?IL}_V=nghj&H@90fCY7cJytG{M;t={_j`)XT9Zos4q#l^0ps*#1PC(RzQ8?3fp%O-gB*lMK=tBdBKT(r90R; zT*Wx%lDB{R?{xpqo28HXvZN1D=5$)n(>r?R&h(2%V{KdjaB^R3+qJ97bJD(I>kg5= zucWGS?QKEyapcg+ftvKgjYJ?VfQBh?sS6u`F{fMu3=J*i4byGP z06D}sre(YljcySjdd`(g8O z#xWJ`3D3-~a`;aN4>7YhKWZt+!APAbD_GyoBQN2}Ik>RE>a9v#-iC6-7)oS#%liQ)F z@hCBv;|D@d*&#KZGU)xg`q*f!7D-FN*yLF>7E7zl#5+C1=0qOOXPHH{n%U2-$x$Cl zg>awcYRjdLgp$%IOm?rqUwKy768Pd;2)V-EvWky z-@(}rq%2dEGhR+*5$x?VI>hpf50_AP9`*$DCZtf}7F^lm&eL1X@?t`itcSY=SbXhe zoy=S<>l0irTKeZrgG2VL-hML*3BzZ&!}VDf1M}^`o&T(Un$JZ@b3)z--JHwU0yUu* zU_~0Wt=^hhU=v8{zG}0Zm3bpS+=KLV@{h}M$q!EY|MBP!FIB!B-=i4!*FepqTYX1WEc+KAm zii6?d|1?;9Ioh!oqHZtuTFQ(rx%L~nU-1$x(cKQr^+nI@xz!=?rj)t%5~56!MR3vh z&QezNe>4y2U!<`x$d{0me;nG9ye4mok&Cifk}PB$1qtQ4ZrItXg~X|y8e*S6wgYS1 z?fxHY^O?p-lCVyPpwbo9KQ5$~i(v^pRsfce`&Fx&#A+Mq(n z{NeMwU#K$A?X;e!?J3A3%>FETA7oxUYQUoaG7_WCzdGedtr#%_p6pO%<-@Q?;i>`G zyOwl&C#ubr>!nbkAvXbzxCYO-y4$3*XygPW?U~oh&F+La{~RD+#1K=?ELW7*+Jja& z;5Q1qWOFl1 zQ+p>!S&wzBxVk4cDhpE<*Wu6Z(YhX%zbg@%?RP1d?q0+NFch-=VUD9@ zg_E`xoGA8`G4g@~FZt6q`Q^%$iw|z$;a25tZE=Zsu=}eO8v^k&AD_op_HA3Q&T%ec z#ECSN^qoW>3kfY!E5x*^bQL(wi;FK-?g^(2Wj;Sznlx6Un>d4@=FCW$Q{747&mGKg z)bZ>!>hV8{j`6L;lyZIk;eG{8nCz=mczj+Z_==T{b2hnymq|#(H7$M-K2;|$~tjd@SYm-2DrdNPF=$3L~q*)Jkpb_2WrQ7 z`D(aSh)K&6YMtr||2p2Td|h!{vpuh7(a{Y$Tq6Wo$qJ`Thd$h49q&$;R#byxlkwbH z`{R0Wq~m<5Rpo>iYoIFR2WUMCsZSA+`&;d=PF$xw#FG&IxoY9<*$Pp`J^0kB4fna;C7y%6t=b9(nue6;CWO=fKy3J5fwBIvH*T&h_VtB*{ zlEY>4d8M(PJuRzQ2c}>muMry4+Kt}`1q$8>qVbLLMj@-?s_NJwX=He8m{R_)+VvQ(wnv+WT&l$0_KL|&AA88qL z(Y-dap)eyr$kN{@7CK@4smX&_*HVVeK&E@`*2Q61UMPDk|CpM%h#TnZCZsn@h@nrXIDz4K`1$J3bS zyUBVEHZv>M?=~smtF1{lDMXJx(XQ_^=oWI5zn=PL&FLEF11>TRLK+)#tHKxo1wE%E z)W=8=qI7glay)Ou-~^i(1q}o^d%KZ;=%WF^E{|&llXCX>%IsmsKOG*yV{P#tF~A^R zyw&>+(^HP$>b|r^2l)NtIj&~&PF`7m#GIIhdX;$REz0(J8?>Wh4YO)sg#D-vHE~)c zT~tNxO8d(sMC_>n)3CXhB;%CTs;2EjBRXF)@Hgx3wPhJJaHu|>LwTmGiR!7f+kDmj zKLF8jtQ85u$ds}2)KhJoQW`|(iU1&?fePiK;iCYx?^i|Rd@bP)#5t7WfuVc>Ybz*G z#W*lI5(mi03@#QIis|KDCo?RaNfb~*=+8}*`_z^uu8^O&g0F2Xt?fIhV^V(TSY@8w z7kn{YJ_U&*SzQXvuu*UUX&LVZY0Pu9#&_($R_V}GvGGv4jkxA%ot;ezSN|&h=0MQyKy=d>hX+p-EiHv@-AWo%D6YS7FL$V)|!Tm8c5&ohpSEf}@kL^#dQW>x4BJUt%MJW@ z2r~4h2NZ97ea2WGeCmQSWjIMrx4Ww@%qWd>9Pkkg3$@t9n$`N@}md|?g{ZWZd~ zQjsQXUh(_!Bs&*Fo7>};vOy`s%jLf!bk0J350iJm^&vE@%4{R0HrnfI=i1^DK~k1^ zW(3>?H3${gMF>EsnD)n|$B%3??Pm7s2b4MfG!5gFess~1Q#vMZoOgg`t$Af-UW}|v z(x0^LDZF@c&T8Pp8r98?U_6yDDH`6qEk4SK1ka%U$&-fg&tZeO?XamOk1Dfd!+{N=7IZOU%&4NNsJPz8`YH`>3!ql&wbsd$v0b*rPjLlV!o zfV~OVwOgkRcV>S_07TwUO>-CcP2|&V+_>hs=m7L~y~c4LW|q1N=ms?e>9(zompKJF z%?E#f)c^fN3^b*Zb2sZ3uO=k^#$lR`Q8O{OJvcXpfwZRN(cJ=yf#nt`Ji&X@oE(S3 zo>xX9sMwPv%D}wEvi=!t<79aJQoz9Hs5b}g=nipEiD;F}UvM51HCY^H?`VyiimIh6 zdl%Wa6z05Db#hK}>+VJ|DTfNzh*9C1-KU9hPjYD<>IU_%=w@NU4)n(UdSnKH%I&I8 z1JzHyHlT8h(QqhdbnnW_6!N8~;~;G zE}!@F<&7R1Eg9OTn}&q0LeZkAI=g*`+>Z6?%7+X*QKenCfIcQ7irA(zGWJg&osYhz zJ3MNHKIVlr*w3!cS4MX=cS*3EiO4>wu$>fATc!}&Z=LeD>X*oL0b%{gI0)-eOS41g zlaKk$4OO4@{J@)97M{|ymIsB-Y)FwApgE+(cJ@91bQPSKHbr#u#@R6&5`~S$mr(z> zR%ef_JOB^Egrd&6Z6&14FV{v@?hB&jx{<6fPicIxDN&>LJ#5k-(6xHFqEQXjZa-TS z2I&rSVMbaBQ9RtnQmFI?KvR$g*!KO_)GzHvj0$GoTR0(Q`hU6GgX>76P&X9-FXZ}vK80XUy2S3K0=iOQc2|1;O>9nug-ae@lV z9|joZ^5vtp1bc%iE1{Fiu!n$!b7f_~d@Yc*QZ!EMlus)Ld;>vrl+cXpe5>b)AF2^E zd-r0Mc-N!u8D#*sSdL@}{hZRy6Cua(=%Uj6Tiw%_6Uj9ToSUpWcrr#rr{>rV4<;2* zPB#VRbb)vL*pvD`>e0a30I`_uuCq z9*5)1Tyw3pu5+F1Jb!WWi!(UL*9taAE%#Q!@CR#CO9X}_u*-eDaFdVaW>HL=C-1-; zZyVCb^{&Z8aC%fD`T0cb$kkk?^y7hcPw9(Nc*!hv(8dH%twGgGj*9ahU?iYL7Og`h z$!!9`*|M>_GVY$un554$%4G-p`V{HqMr0x${_+nY636VUy&f88e?)uf@jQSsJT8&P zCX?=l!OTZ=9pIDsv}c~^-gybx371joR4a2x;QOfET^+Q~$~K|u-5|LunJ&-H)?h!- z;hNKwiLZ*4p5RQ+nS#@FQsH21`hmqdI8xuk*}2=&;PFTxW3_gf-y963<1!DVO!OQt zsiQOxwL5@>6QB&{D9MVdVTE=HbtV3+DD^;VY_)#d;V6nBnUBf8TYtF1RJT=HV^-9_ zsV!`xie+Fl|L+#lGQHk;C&WN(hT3NIBmcmxkDa3bOl0zPHNG^-gT=leUMma#8H0(^ zxRw%m0d(iKbnvXK#rRx+(r?;oTE9+EIUN#_N>#!A*3_H+=8iWk@bU-5(0X5qz}Flb z;mxCzdDhYofbJg9KOX5Y6(bC~9MTJdIaqGf=u#xFIttHI|JbUJ9N7i^E)N7aIO%~{ zqk%jawMQN}@ssGMn(@d`IsPERyj*inj2xO?Khk~#FL6vrr|o;bJt~)iSvY0i=|f%ieeEg(lstVOEhjGX$MIkp0G+!N)+yHO1uF;t>Ui$ zRs2itV}9udZk2LSclL!1fz;Gvwsro*)$aSfgwZm3I0C3xp6D|5u9%?`+<5y8t$xX| z0md&WnJwQtetSlhk7+N+41_68q+K^l=^HX4na_W7S0-xqa$70Q0`)nGz&x9ojnTA> zx$mHJuvC@NuOr>i@x8q45N{+yf1(wD)}^x4cEORs&EWNl7@e7YJA{v?=t-?sxM1E!_b^gUot^mdUo*tP-WPiv;Xy!=l<`+lWerzR zGI*OqU3h`7vYospe~)iqLy0HFudHCeFRMM@ewr#II7ufLnil0k`Ze zcX~r1bdqA-%f;spWKZQqqT{x*?!3h%Y{E2oI+nQo+X5LLaJJK2(!@=b3c*YiSG8SX@A4HBJf zGjW$xIz1fHWgyoR?G5{Na9#tL5p=)%5`|c8msn!7x_&M`25{dpcihsPiadKRa6asi znxbPgEUH64Qqvp-lJ-4X$g!VIai~HHe>Mh(&!j8ym4uV5aRxJ%Ck1`jzn@4>IQ(?W z(VM-t<;O%jNK6a3=ZCOXU38bl@#W`A(tO0D(#piuAD$Co-5>+nDDZ9)T(Tknz4f`Y zM0;oYnnWw-9pOFGxL>D~3Qh11;!$=q5@=tF)+oTo6!1pncu(!nnQ-c?YsS9Deo(H-YZbf_Ya!x5 zbzJ7cK82t&k>+g89Q0PRxjvBgQ*m~hc8INQ#_er5ogpfmu_K|%S(3E@4q);kM9IW~ zW>V7&^?p>EO{9znFmPHI+ZgL>OcE)~vnIz@8dUYePlNTXVe;dvB9WzFE!yBGFaPK_ z&~AfZ{<1B?Pn`Yw>fGG%eC&}tCD3fd54?oBg0&doDv@F~a@4^dKq{IpTFeWCTmaa*S3YOzZ1X3aW>4 zrBG_hyTl|IO}AZ^yDr1_(d-zPrI0jibvAupdRV?ktAFO=nJEExD16yAeL2~70uUR_ z0VV87ojXX5?-3cOzTZh$EAP4gQV8HwBM#lLXL$CAxzF4KS(UxhB^lSDT*g@x z$bA=n*aSvwI(5PJk#Ddd4515>}9dPL#5IV^Sap)yC#2I58gr!~p4I*UtD)$u9;Ow`ld zB=mW4$J`D{p(CCg%ju#0*Nc6ufPVIpb^WTYEQi?g)G1PaIgDc+&d2~`!d&|6y;bR*3{h8_vf=Uo}_l`h!)uaGf^>3qcbQ({ADsgqFh3w`d{{`4Gv4oM^gLhGu z>xlK@nhI4dKo|m##6=XYu=ScCGl}vdsP+9b=%(XD?FQ#+LE^6@+Z{4LQB8$9nmKjQ zZ!{6$h)4O~b{oUyz*$6mHl=kk*8--s7I0XP;{!@?WhXR^yJ7Df(mi%Af?@K@&LAHH zMXwUNBzpj%UKudG3L!cT<0YZsez(7}V^A_SXjP^QW`62HR=RnDvF4;r;kVG047X=I zonbobVb+9Fe;-pV zJEZ~8KGEZepQqPPlC4`%89m-=(!-ZB{D#cDq>F5LB~F77&eLEPPX$y#SxOZ2NT}|* zap7==U*P339N`|)GMS^$4L#tJx~j0S-v!L%Cz;M18@ z4(|DKG6Z5%M5e4U@ky^ zGw@kRPvs}5z}_1IaKmdEyS%Ex9|eBJwvYY9dXa16%Ji^KhdiY49lU9s(5aIoy?V>! zS|#ECr|9z^FS>-DTXYBv97Y_6pesHqp6cDkvM)Ug;n5OHwXb?mEXs9@LrK*rgf8`p>YjI8%i zCar7MZyjILUZY}nW|0MbBp=D%mO8aWYL7+R$_$fCxy^+jJw6T1e?wc^Dj`KEv z&QCn9#|hdT-OaB%M(f|LlW?MWBUEPFzieMGAH7yEBz@Q9eO8(?<;IpX6_-}WCR!5) z=>93j%I8&KSBqN7-0__u#)CC{piKZOu2TtYqUQn*RU=phdm=4b;e5YU)O42fl?B#K zD-%t5t?(X(=G?)R?8x8f4G4b!Ls|edx_}x0^-iyT`grUx-X*KZ1+w-a2%FlMC1>zNeD?Np`?UxO760PEsSwS1N@3jzVkL7Lo_YHb zRh7CL>VABNsaRNQ|Fmp*%i|oJUJ7=GJ${j_BX+IO&9P&#)ouO)h6K=&Fs1qjp=X!_ zRF<;y3b|%lo4Ge>Ixv^;5fL}YhPt- zT-6~KL?~4^U&CDk$2@~^p&LKmm)r(H-Ygu)%(Z3;`j?a@qPgoem4RTOuD6VZlt)!A zYmP^>k{ojB1iE7uc^w7%UHBB}yJ+EnE|h-&pc*eh|3Oz~&YJz;vEM=_xpU5rE}jP` zrS1hQRf^}G5FnH0ek*}x*>ocVw@1iRi8Uyxj#?73X;ujhGYKl6C!FFe z6t@?sWd6(vjZZd9F!941s2J7FE6h9b8TP)zzI^DiA*oAVt53@MW&~vQ8pP6x+{rW=JE_ghvNrI*7C37tZ3Z>`NjG3Dy9$4iR!$;baV)XUld;C8k zHr*Vf+;@m7Mwr8vYuce>vTBSxz#^4nofw1e#ivD&(x-+OwdlIO4`6X!skn69%k?=q zI6=P`vT;@XT6b{}g@F^mZkKVSF((uBHy=sJiXQ(V(98KeRJ7t~ma}@2LGEl!g&~P@ zp7BRPnj|Gn+~HrNLUj1WKEUj`lVkD(dw#>butY$ycGuT-Q zhsScZ+yn!g3hR1>n6JB+MHqzY>*`p#X>S-jDNsI7S7i4EzF2OUI;=0FCbdd)sGDJ zq?Q!W4+j?SG~M2~?5Yqozv|`PWH3%r9DS2x|3kHjs+u_Y4Ht+s_h3W+1p_LZ!Ol@3 znNCj1Q#HT`u5jXei#p2SdTINwWhS%{Q^}3*awgZmeFJ!H2W1tLE z5;q1GJ;^^$logLNUTm8b1?Vggp3tF67lL`P5T1# z-VGP--dB*?fy3KpqeVq75{6vLKv<~s>gn5HIJ&99Kk=tq8lB*$pl_#&7QS!t?V?M>N*%# zVEhZ_KUyod0O7xlLcI5%)2dUCTMuC>=IDL?>a|YbqQyA=v5hEq zGsg%bnVy#DbI89~kpuP@sp-;*U|;(fAUCxNrZ`L%W}W5EOQKx4hr6U&I3zkQJyUKD z8vIUOL~(2N@<{*vVt#*AQq;@=S#$T&*e!YVqd(P)&{t%#u4%aq%osM6k7s)xO{ z?s=SK6iM%aEkqrNlx?;(?giVvGHC$ySVCjV-?cAlb-t#hGys#^t=u_~fON|$p56hm{cQQZyuvE5VF){$5 zIp>#OIp#Ax#2Vm%qlEOBVw;Q-6+#|`!aneJD~>Q$O$`+P>PK1q43OJqMD{bB7@-;P zZQHpLAz5cGpX=Gp?%r0=j9VoF0CaPL^kvNC#OU}pJb}4CS`JTO1T73b&`U$mfaTP~ zMz31l;Y18BslldYYm7=6MkihoYyJi2{=)*L)Z&iAdY|%fAQ4BzWho~aqCr)=k((E9 zo50ffGq;|Gn|L?6cXZRV;u)_M5iVTMWsef+59+(Y^yiSHRE`2g(L?>5 zQv9O9^tODg`Ey^O=x0D|Jci87J6`LMSGI*@&)Xxekhk6EGKtR}V@camNTs6pf5aN2 z69cOXKH%De$~~G0;hLRYs=BclR;uV;52(_>^SCuwO~~J`m+hTYfBx-cV1*Lu7XH{M z7R@`+0Zx%t%S(iP;3zRJb& zEgxY;oyNcS)#Goco<4nKwZ0_6AYu@gkT59`JnGgN1_E6S;G2bY;yKoVe486J<;Q;D zLu6{z-T9i&)?cRW2j%BERp%)zx?&i6t~b`~hs3Rn1SRb07b<#ixRC{tLMf2I8ukTi z807x~JOm|x-Sxk#iPQjd1s`&5L`Y@Ys$Z{DYo|~g%o4=uddK<_&CvVCi?mIO+?thP zFE4I*c}_SEfDd3bv0rx-c+^52B8WF5xHQ~mKA?KlyLY}&82La6y$s*9zXU^_gJQ)p zqmeF(3)(gu0s`B?3fX=0*~6$joB3tQpK4_$io|;d)5pPkA6L_cR?5}dONv!f46_0HCm4WV2rMO3N ztzyfi|9XM$@!Dk*=Cyjcc#C&7F=BI0#v9YHVjGn847zXs>r3JFSnJvp?K#+aN#tl0BS9%zWev z4)9r~9J%2&C#k?Cjq3R0_*cmnL=afYGml&Te8;EXGJ({3mI^u4skxK;m35((tyV4= zDVw}m=#=>!O2%QOV0IKZYPt&EkurhRO?0bc>tKBuX8JDyKZH!+ZqMLg8mO={9s`v5JR~rsU2sFcE1e) z4oS-u^BSRPyWn)-H7d#%QS06?43Px)sl&W_1)QYE>DE(G*LAEDit($0(%K3`YH_OW zn>n}=f+SrSKFs}gK=2o6NwVfl)qx|>t)UYSWd__0W6j?D5dfk;t0S&a=1jU&b#&g& zWB-adKnZF(lSas{5#YB!%GJJd2@XcaTKai=6`VY`J=+Bk*zr7)v2QV%^2ROzysuq`DOWuf49&D$e=XFYsioHHE0dcykI)T?H`4CbpC2MtI@$aR#iBdS_whA=t)|9N=Zs zUeWZxzR=2u`|YxzUcy|G1Sy&kN1~uJV4;kv9Be@YNa<=&SlcchZIG#(KiixLJ*R>q(y!=F6TUQMBwh?yU<2dW8gpUL|9#2_*uowyizz!`$KG_0)w?*UId` zRLC5bLF2C1+aZiBD$Dt{$vlPl`1lF<4$b$cASf%TQW?lz$j)8Ho)vhyaR6kG0dT0| zM4)Jp$3&bAvPr<4HYMU4MrEQK`H!+__G0v}S9D7cyedCzOD|2W)mPj-#wRZ9wN_2Q zOgchX@>Nvlbu5yo;XPXmM-%f3&=WLN1mus&cSUaB9Lq!GGM{up57bOp#4aioq^|P8 z|Nk5K4OAbM&qX+sZoeamQoA1m1lOp(+5jXgoo1@@dYBwV@I?yj(yt{Gh$l?o`csKz zQLQUi#w8_rMB>+UCd76vAN)rt^D{Wzh(!nTAD|j9=4-ds!5PWv8t{jL?7qVtkP%A; zOvgs0MvePc+}Ssr6hgni$vUHj6CD8UZ6}W!+o_z;J!RcCAzJV1iIG0$1bi;Wymd2%E!bEiy$H7`RJlJsO$3rWnRcsY#b)c_gIFzJVb(_JYiibr zyd=H_m`S0~l;*Fswl(#)U|ey}`6bfL)PY@*6rpapZ6JQwb@xVtpiht1eTTtrvF~=A z18ZVZd=1ZQo7SY{F(Mp!VG&uhdg)R%YVoCtPeL3iU93a}-9NsilslIoBnd)$F8JIh zKo&gXA#rbaEK&8yCwKdnUV_qiQDnJkzWq?P(fW~+Lge0d^+QpBxi<`#o}%OUSd>2I z@yNGPHcEtgM~ZLyd3=!)GOjEF{adlUD!142|$t4-VW zhY6%b{ofVcux}rN5sL@9UE`TbeEPrkJvljf`K2l=NUqF$CheRS&p@sM<^0d_6)J9M`dfjs~k6eR=}_tr&t z&{%QbkK!zptA<*%2nT}YAwbMv!h(274zaJ7;0TV!!eDq?g2O@lt8+B6lHgz9_NRB? z_NUCBHA)PQl_mUbi-yi}17p$HJzv@gbwFW);W7mtUnCY)H<>%zAi00>zTUOr`!expBHsy9>T_*IHa#uX=cC* z7X@A_2w(9p9F!JK-u7y60-ujV+~ZMrz|cv@Yel1G#}6{Ye1PfCj?RgOMDf!290^L- zvHIZL!qgr;wTva{wiGGvC*udexJXv%<#u=Tm5dETmp)T?m-ZV@MDU5;pZhvbbu#>1 z1cksJdvXg3u(V4Y^!S^QuMs<)bRM!}cm~*oO6U}qUm%jokaBl~g{URF)N^{E_6N}Y zpM04K<(GAVz6)#IOf&)EWEvbDp6$d~C-o6I4L>2hS$&~xJU}!aiAdsPyJKI_GNUKc z&gn~_3h}}7l894`C#yH&RJDY>Bp?`|9_9VV%~6|Xk;e9-p|Ov#)CzfC+d~lV(|Xe~ z7Lp$Kd2Cj8|05Kc(oK5&HYE3c(+2|;s>=Nj3Ri@Lv|{1Som^!(SMxxSG+dajq#I&T zq$4#mCfG{Ll;SIzHUB0lG_5v|7OUu5J?&z`UHQT&2A92yUKS=3P7XLIap>N8}3^NFf8a7Rr_)#YAYj$ zFA_X~n^%h`-<-=fT2;HZpW=UdJtjd)Oea_T(^Kk~qqe|?_f;hTxthCP8G*iy2s&>> z$0(5vJyPYeT>+Zd2cTBox%y=3aET=?0yhDT=tnl6*T*F>i`=I8m zr68!qh9bQ@8z&vcV^zUo=x>W0uR;dIEXx7ZfgT~WjP=)fkl{T$j+q@EIL3q)2wyaY z`NAFhq|M8s#x}XBn{2Ll=o(%R7+lgRbw7C@Ala1OjCmv-FshGoGR&$NQ^xO$RWw;( z!^=4q86Cig85EF>M-yx0>c7JrR;FF0+Sk6$xb1R7{p#~r3mf$ga+(`!7wn|veGK&t9kvkG&d~DT^K1ee&o2Mo`u+Z= zjJ3(FmL8#(t!6Qg2=&${&}$-}AptL!$pKUD3Xi_YxxMyWQCR$zGXk+%j;mq#quOuZ{=2Jk%}< z@MM}Ci`;wWjUGjM#z!9~MMR{N5$yn;8fyP$t&-`hz*mml18K0!Vw*ze4m}P>8F3qyZq-ZEsYnHrO1zadS;h~$y+{< zE3rk`W{mq_&Y}1}i5}7KLZbLjj553_4ar91XZqIM)+Mg~?7(lYdC;C4TO=T;m6I>9 z0rGhnA6N>=jID2pCY$hIkRI^>z1w)&OBEgxlKEWJif5L&gC+Zo=34@#4HSI*Cto5` zul(qpbT7jWF<@6tG0bFc+SLdYP%}VIi6p;dGOgde*#A8zqnt2qw|EVpb`fJRwRiQ* zHW@Dd?+detL;vGuzHX86B4_+6k{ep!^@>t^iovi{wlXS@u)xj;ubY1h)co@!gTp60 zg32+*`!^ZKnivv+(5G~zs@rhs)h8fuI~jgCaQiS=lhSztYY7H9v^fZ<)F-uAeNAJ_ z?T-0nz5Qgv`O)kqGwNCC>rH=d+Jiib(WwhKAh5Q}(kSX%uXo27#9^!iLMj7|vOxcB zS{j=#{OP#Yi^c2sR}B<_gIK2VSpY%^@;NRrtn>K0{$c4-%RmB>^3Ry)ze7;SC)U1s zGnUH3Fi5^3pCcuW&0}7Y?SmyY;&5_Elolt-eb)ABOK0w?Fr>UbJqauHD#@7xu_*%z zgh)1;9a;ErQ zY6{^u=6P~ZQUAprzNYp4csZ1H*2oEO=nu5X7=pTt=0~CXp5Jf=+Kdhjo05rkcgqKr zCOghNAzKTh#Rny7B>$R<+;n-7Kl;t%=d#+vKd5-0m-Ks!+bb$@pxj?kFSM15N5Xm6 z$qKd~mib8Uwi3d87PuNJh$J44+)m^z&Y#Mcu0xitfkUj^fa?Oq0BE~W{CzKLY+Hg7 zopSX9uL_$Ys^dF2D>(`m?4vF0^5gAF1^}K}ZX))6$0<(S+gpA>-BdfdBn4P)doJni z*Vr+vGsq}ZO-S_QVJj70zUwvnp1cB$bxYTbZI_@aq+oOz^{$N+cxv9o#N70dwDUY# z0sN<8T>+a{?+-@!i5^c9suASh+j?TkB6jfI8~v?A0(>8M_wAWXx>-B)5V=Et@d5gm zIUc6J1^RN34~*WN3jyA%&=IKKHqAH&mCN{s-%#&!BoFCI3OD)O05WB1Q`}kYMOv<> zLQ7%&JH4gnz+A&K??WVdxWb{Dd^Sy?0|e&lK@eVlYBW$Y3A9CFK*LQc7HIE^^Rkl4@YAI~%72!~g(c+@#*QoeS79@~8SS2<)h&&4-CW@iJM6Ie zsCpnH)>g^NJ-#v5@0}xd^9nVn&QOe$QX47?s_ZunBK?Yo|j z0Q%pTum^f>;41$XWXlRIjslVg8{h@o*Vd!KtNq#)hk2#KQ0nco=zf$`!N9k7bytz6JH>N z?ZvFaL2y9s@}|8#;ujoj`d?shRmqabS~?U3*c4D9Y4;Fj!y@E3zljfupbv=@=(qKg zyi9Qttu%yKKWmX$CixWG0tu{P&JYZ0+zk`tI9H1@IB=NRC#)BM`it!^_Oi^_E&2EW z0Ao7gZ(Xntv0(*$(8gx&t6E`A8WAb4$TPws<09lFR|}tE9s^nAQf4Z{@N8pbB=8E` z8s~v84#c^B)g@)mV+s zwmDunX#VrvS$Ayvzx+dRdg0}B{$97j-OChg4_SK~t)wsuTi#9^&lf3Gz)3rf_>?V8 z%@Ph}ngHi$5p%+AhVlNkUzIkCwl@wk|I>Gtu>kwRrjA3$s9q-^ z+T3t%=zX<}+}`b|sV@T>1KjHXwVjs*T2`&%=}9zv6F^(ZQoE-KBK^S>_$iKTsj?xKE;cE5~YoEWS7sq`B@c&aQu%Fl``8FvX)&E*jSGX%kDuAAY zl)(RsAI%Ln`P}2*{XvcbIrg~KIym>qEOIwb8&v9iWR=QvaT5mJid+j()3*8j{>UEm z*r+r5dm>3J-~}zFRlO{zN-2-H@7ZEY9~C*NOv_{O>Al-Fo*$$V*=ocq^{GUd!ct_P zcI_zdl$$U`OyGK64CwXqwV(spc39tg*?23UbU0%_O`VkyUT%xMhD0*QMKc zSo=ri;(m+KH@9{H&yQ9BH6 zfC`!hLx^Kce`w6tSkCdEf6q11qBg&p5V}$pRif?KYf?sm;9o!seDy{sdGI*D@U9QUWRki0&$mmrSzdciN*j~S zwh1x?>=;`Qcjymjhe|G@as0q&w>l}=3@+y36x_CE7wRnE3@r8_^<_tJU&U^2WQZG! z#bW(FH{mpnn5$VH(VY(5!`578w16ZEAIj$-+?s=ucc72s!qv5^k`@Nn_EE_L2qLJ) zk6%OGVp2EhJeWDmNpM&L=U#Q9S5l;EN1Nl${2=$jmUHa;UI-UPrRx}k(@hTn7_X;n z7ne1AW`-WCvPmSlGZix%@{uhjg8p;5ds$I~1a;?Yi-}3x$ssxl zYC3-eGkcUc-bji>e%gHoVvmUHcV!6AatClMAq#CqA_)rwdcfRBjb7<%M^r!Hvwdo3#=lP4NlL;t$ArDJW^dO-1ZwpiR_9uj%}rvk|#FCHJ4hTShNvO%Q% z?MOOtT>k2~w1gz&q_Vj@Azv))N#n+*`rv1FaMu6j@ZSZ~Tb;+d52R-)#_o+vM)A?_Z3w3*50v!7=PX z{^3!a(omFyvE@O*OCep>eEJn!o5G_7(3r_c5S#tQoXaY@`b~gpVaeL1HMeI0pv^*m z1I&Uchdpnk>R-=xhGnLj8X_U6m?Yf+888Qo^R=ohk!MeZ=xWDoS!$o|+8sC0=J@gAiByK?7p zTtK*hCjG~62FVI)kq!J}y)STsBoT$@T+0rMOX_|5TvohXbMHz?)6<2LPOR{E-rS%Gz{#jw!#7vE0$romh6AN)@rM7swD zFpC_8fA*BDrdu;9^x*t4s@|@})ER9z_+qH?UndcTzs3*^g*EINyt@b3WNlMFw1< zoy(iwu4c!}*q#xzV1(D%*BAgga-xKnPiF(`-KR`=Ae+bn(+DhmqgqF~FG~%9o>aTO zs8*bu37rM&!2QqUQebDv`FUD|^2pB#ZfzcJd5RrV-s}(15;<#I41(wIuk3Nk zhz!10f!hh_qE)m6!b})I-qIRqiZ+!2>*zuF+)uwwPckg`$pHE!@T+J3>+02Ag7A-E zi6CLd%Kx~73Sx=`$fqY!^NqoCi?r3=SiSV;kIOtrptgB!ttXGR))>;E6#2lojZ z8Z!g6q%IBs%$m%I`q$uFi1Kfn!}D9FY2YSAv0aV~cU7YW8T4x{poj!DHZ6}bS3{l* z0$nS>-zNZv;a*VQoa#>nOsZP5z)D%V3>C`5dd28+dBTp#7nYd75^&t!b^Z!9DO5gH z$07=x)}wB=FwW~;sFV04(ordN#Ok($nSpE$f%NJjfPH=}iCXO(yHzXy2HyrkCHOiV z?Tg{wR(Ens1kU``a4DvEq+*{>ZNZk}gE?S2Ve|y_-OA-TlbWpAIZklR7n$fvB4)!&Zj0uF(b(WI za~cAc6(8@IE}TG(Q>O4?;Czq+pAx643n(V=pgWTEJFY`P-eu2Ao31+pDF-K{?fa|2 zcDv88Z^N+1zIcPrMFHnDHQJ;)9Zq_Tw!5+rrPhz!}T zFIDrO$6=+v-r}Z0IQY)Zorh*ULLU6gTPlbY)=rG@-9y`fg?#$k7Z1!foA3{+l<|v1 z1i@5{JL-;;Vo8>np@oitD-YX^tIz{h*tS1ABW(CwOuAtCTTm&(OzMP>ix0;g$`&c2 zO+&3>twPO;H;rQbJ+yD}h@c6atVZ7*f6^_a&r<0hh@8Cg)9f+uTNgAHA;SbEBidQ zt17T?NMGxYF()r-zF=xVCsfdEM6cHP9=RmR3m;3P?9N6%Uzf(-8a<&_jA-hnBmfx(LW!7i=Jl#LJalBT9962i$7wM25P@<*5IK{ex zlYMkZ7q+jlI4>7)R?S`umZj(*z1F?NpZ;Q6_E1`%2q{LjN}lt21rKP<)JaGj&~tnQ zlF=vkrwj@}BOtc;ts6PqJ*(aM+J{xQi5eUkpI837`2^I`1@_W|gU@$~fPG(nzqN>` z@RI4>VnWB=piXBWXvQE60X7%UX+f8FIW56R-==EKfWWt2GKyYmY9Caw808d}M?bP7 zk(p%#cd?IE{1r;Z$9gChrCPG?o3`=1PZZ)rnS>DVh0!;4nZ8f7_%S0`crkuCF=;af z)64b*3+iwJQsdWYGd!tZ#SF;TI!)D%C7U0LHxai=&9%4R?p}S`Bvz{I@L^wiHFmB8 z3;J9t$A>Q$SNNWe2f6H4WHw=~X5u?5TK4;LrfIQ-S{nGeNwJ@7MI;`0kJKq=@9MDYZu_ z6>|Ie13H%08EPP`i?WHGm9?=-f|-c)=5{;DEtp#6SsPvCS@4sm%`{y-Zyg+tiz$_S z+Rk2MhlFR7lhgj(adg>$vCU4Qw0`yUC-t~#4 zJzqd#5urwDHxtn7=J~xnS(R%haw^Ald>t8;bJ^(Nc#>$RpmuETS}`_!z3s^SR2IIH z2W8`;7}7(1EM7V|lvP`95~9-HOof(pP3*Tt?ZMvd`M(>ezQjO%UWhlIsu+08)49p6b8FXzcwHy1&!YB z#girdMpMNyvTYSuom=sGxS=jEw~xP&X&Mn4R+pTBSY~6iS?9(!CE(5KQEf)J(8Vh|xIF7AQCtqxOd5mWkfypX9RDo>N{#}BOU;KIFahXw%t z6_q3{ofp^iyNS(E@>)ZcD#Q{X8(xK!3ax~YzVRZu*~r4p!qsEWdr?b+$K|q2XYuK7M6_dyQIDU{ z%uPYx4u9{v(H7}o+?v+u)$tm-$=xB@RDZ+7{^Tb=XUg$$iCYWtPHoIvQGvZt>(dX_ zZVxCtJ}G((UwiinOkCfu^T#y0w6X3%h98-yQzFg5rH0T3ht3ZB+RM zhq>tcoVEhLw@F3jP}%$%5xs&tm#N2!BoSD?s;05@ahuZsE`s4?@2PV8VjaWvFJLlPmYtj z*%ebIHx1Q+x#7B>Xfmd3D2mCr*1x!v6!P`xk$HGD)WOFH|9jU6LZj~V^{2k3j7jA8 z*Vp(emn|I;<&NwmsaN6F45jMS)C=Hzre8lUQWk=#y-Gr?XzZb*xLSC>Ka<$B z*P_fU3VkSDCrGr~PNck+Jmk`O<5Eo%jneS|%D$nKAs&6oC_$uL5*RBJe2dJr6YF_e zJL?CII=+7pDd;qQKS$<+urzIMaj-m({Ax*_s`79x%fb@dR!wDZPp<#?r9+h1brfTu z`WHk(I+>K+Q=f>5^AO4<=aQzZPx#un`l?bvJ zH66HlY{CT5G(q_@)X`HSNfmXQ2>BKkmTnr@?Yo;hPp-R0S}ML>yESuj5j-0RS|3be z^DPMDcx{r{)OhUu{pLzQh35CvKBiX~zL|ykq#oH^^0Zf7>8ww#2R>&k-;C!IQ8OQ< z(@(sEFMg7CUevicZB7fk6SyU{2pfEG@-~RD@|}71?#q$z&4N8WO|kK-XV5*3pBVdv zyOFGIPe^KEer2(5rWr;z6 ziJm@+cOc`(Gy*}@@PndcpaR9FOok5$9&UXA8u3qU25U@$M=0!l_!q5qk!!kOl3E** z5z!I6LllhP4en#xYx|h-Bzh=+jwy@GcKU`$>V@q>e9Q`?k>W1Y^Xjxy`e&{(<4O?+ z^FO=U;CNF9(~!VW?RRNO67KB~oH#&?Zm&GX{)vswZUw0!d)8bV+(cORV)On0op8QUP`${fokF zb#yXuN1fb=FYM{@fD`#nm7pc|;OmAe2n)~p==mDyqyCN0j?o_K3um3s_k0^oS_@ZZ zHVycvVL$y@?d(?hCC!(F!atc;xlTfNMAi={kIlH6_{qfJYZ=?^WUC{FDxG+X+q-Pk z;d3CY^wUpibyd=Uwva-NoP>-l{usf21}ckVL3(c)QnZeDTeaoilKM=IRx@pGSEx4{ zBr#lPzklw)(_;u0V$fKU$?J$mUzFn+pj!dxcWIZ08O3!;$q+E9_G-CHIao`z@+|l zJQn+_5!B|?od0*gW{=3NbKs@dI|bjxI-5h^_kVn;Kx9RF)!7_Mg!r%$_cLNa&%O_m z=tT??dsOR*Y1%M?)ZCsbD!FIYZ*uG(TWwkC)iJM^im=1$A2v(6HC|3+_`W|mq~_Ui zaakq!IokE{tEFkY3n$ISUOZEzsUiEK9Iwdk8OecO6)gt61(6{--_Xi}pa<3R0F-Lu zcQ3jC7Q3`Pv!BWFy{==Ufm`8d zi#@Uj4TPV+SS#9%)lm#{WUMXvvRbKHXqT`xv5r~m4-aJ0mHE&3PMH~zBC2m_OM-U) z6fN$+sCQ;xEN{jZ*15FU?DvHfwe!L2Bl7yuK1okYV+39-G-AAZxz6pN!21C8HEHl7 zIx^T{Az8NusN6eYiy@mUD-fR7pF^%GS3Bk{Mh8)0Y{s5~%tq!eoN%|OY&Y+-GGtAqN*V=jrlZ+!PPD#qj1JrP7xu#oB41Uc z*dIllO9-s1|Cui;TGj-=U}#)(LU3Sb1HP{BQ#&>_40q}l{l0%B-CkE7&^YW|mq0wq`&m?DG{B*=U(Fv+WhKOsGA{`9~t4~Hcmk zN2sigzMHCMc9h6vZZ=Y~c%{3Y#|~vN)`*R|s>=4VzTscW;wyzmx}MCRJPpxSYtYpp z_Emc{-6b_WbZqpx&?@4FtFxE>cdS4USUF|FI&O*|^73_|#a7Q{uiNRW`(b2{q5S%y z-bcs1DCg?8rs9`#Fg-G}AG)oPP^zf3i6YDb($`zlzfFhuWP=`dT(yk`3e+R(r9xGT zqk#R#^(4*CZHV@4VrCX8R36-wlpV-=VBUWO_F^-WvP7rUUgSoGiV7nXUX#C1Tyv#z zpz<#d3((H}ok-1dP4nh7$uUtUQ^k%udLBoSCwuyZ?evxV>G=e^@|mlKd_N#|)5g&U*KR=dlsj;D*OJ*D*}QSAqe=SKe`&SAv^E44-s0_shJpZ%LON9eb1TUwKeD?>n(k=t)+hjSs zQmqdh|G5}xEPVc0N&lX6gl!yC@X)IbK8fNw zZug+mRVo3$3M_v%O1rc(r9l$xFi+D-M=gbJ`R`#a2B9^~`?^}0uWKm|B&QIG9Qs?Y zf=3q9!d=KMy5at)^wgzq^lgZt;mq0(M_awfBi$So_}m?4Z|Wzs+uBn#!_)?GiH%W|@2Vbu)3DakerAu=%LUTSbe`h@XZ*h%{W4>08n@p6XzFeS-sQPig~) zhUGozxkram6mC`@LqL}94~G9@IF0CqsRfR}F5_PO>xyT(vvDk#s} zaUbcjNNGt8V~rwJgl!=x5r6adwuZysxXFYtB8-uZ8po*y>ki0=%L%2E8vDk&Z1|Ik z@~V@VA=MI$fa;G1CjVLrU;J|9WkoLVU+suLd>G-cgpYqZsU_a{f@#o48Z9~vuQB0# z!l;D5BJu%YV$(L8NF+emO%cNZ^oV@r?(vSnUqOjOH!13Ze>Kv!FwYP==%=vWU(>&P z#gOyAUu=(rAw&DE5x8(>aCmp7uegc?iYYlo!fVu^TtK@+q3HDukIJ}vnZmFWW!zjw z9lSdn3A+?Ex;VQNTp9B~uKMbr%ZtpmJX#n_U^??97*STEzSv=$3s#YMbPFSa)B+$l zC(`E2J;FAx?qMwJqRIZ6PZ?YZeC4N*Oy)dX@J Date: Mon, 22 Jun 2020 09:47:32 -0700 Subject: [PATCH 2/7] Notary v2 prototye process Signed-off-by: Steve Lasker --- README.md | 28 ++++++++++++++-------------- sketch.md | 17 +++++++++++++++-- 2 files changed, 29 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index 50e14ae2f..c8bfa62c4 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ There are many approaches to building prototypes. Some approaches cater to simpl Notary v2 is goaled at securing a complex e2e secure supply chain workflow. This will involve many subject matter experts (SMEs) and various projects to engage. Since no one person or group has a concrete blueprint for what and how we would build this e2e solution, we can be stalled with gaps of communication and differing views. -### The value of books and movies +### The value of different perspectives We all have experiences and biases that guide us. These can be an asset to forming a diverse set of views, but can also be difficult to overcome when a shared interaction must be made between any two parts. To build out the Notary v2 experience we must incorporate interaction between various projects, with a shared understanding, and individuals within each project must have a shared understanding. However, the shared understanding is assumed to evolve as we all learn together and from each others differing views. @@ -49,31 +49,31 @@ Building a complex solution is not unique to Notary v2. We will bring SMEs from In software, there are many models, including waterfall and iterative. However, within the iterative, there are at least two additional approaches: 1. Build and iterate with constant changes, churn and frustration to those dependent on the outcome - - Consumers of the effort can get lost with complaints of stability + - Consumers of the effort can get lost with complaints of instability 1. Build a prototype, learn, toss, build the real thing, with a reasonable amount of iterations - Consumers clearly see this as a prototype, monitor, provide feedback and await the outcome while the SMEs work out all the details -### Prototyping complex buildings +### Prototyping complex projects In construction, we must bring together various designers, architects and trades: -- Designers that provide a sketch -- Architects that provide detailed blueprints -- Grading contractors - sculpting the ground by which the property will reside -- Foundation contractors - providing a solid foundation for the structure, including environmental impact and risk (earthquakes, floods, ...) -- Framing contractors - accounting for the various contractors that must fit all internals that make a house a home -- HVAC contractors - have large spaces to heat and cool, requiring the framers to account for the plenums and returns -- Plumbing contractors - that may provide detailed design for that fancy glassless shower and constant hot water -- Electrical contractors - needing to place the switches and outlet in all the right areas you blindly reach for -- ... +- Designers provide sketches to quickly iterate ideas, narrowing in a common goal +- Architects provide detailed blueprints, with layered designs from various trades, incorporating their expertise + - Grading contractors - sculpting the ground by which the property will reside + - Foundation contractors - providing a solid foundation for the structure, including environmental impact and risk (earthquakes, floods, ...) + - Framing contractors - accounting for the various contractors that must fit all internals that make a house a home + - HVAC contractors - have large spaces to heat and cool, requiring the framers to account for the plenums and returns + - Plumbing contractors - that may provide detailed design for that fancy glassless shower and constant hot water + - Electrical contractors - needing to place the switches and outlet in all the right areas you blindly reach for + - ... Each trade may not know the details of the other trades, but they know they need to work together. The plumbers and electrician must work around the HVAC systems, the grading contractors must provide a solid footing, with water runoff for the foundation to be stable. -While we can use auto-cad programs to visualize the design, we still need to start out with a sketch for what it will look like, and whether it will actually work. Can you really extend the patio that far out without it bouncing, or how long and how much water will it take to get hot water to the shower? As productive as auto-cad programs are, it's still complex and expensive to design a building from scratch. Which is why so many buildings are based on existing proven templates. To build something new, depending on the complexity of the problem, we may need to sketch or model a design before proceeding to detailed blueprints. +While auto-cad and 3D programs allow users to visualize the design, we still often start out with a sketch for where to start the detailed design. For complex designs, modeling is often used to see _how_ the design will actually work. Can you really extend the patio that far out without it bouncing? Or how long and how much water will it take to get hot water to the shower? As productive as auto-cad and 3D programs are, it's still complex and expensive to design a building from scratch. Which is why so many buildings are based on existing proven templates. To build something new, depending on the complexity of the problem, we may need to sketch and model a design before proceeding to detailed blueprints. ### The work of Antoni Gaudí -[Antoni Gaudí](https://en.wikipedia.org/wiki/Antoni_Gaud%C3%AD) is famously known for his amazingly creative works in Barcelona. The [Sagrada Famila](https://simple.wikipedia.org/wiki/Sagrada_Fam%C3%ADlia) was a departure from the massive piers and buttress designs. Gaudí wanted a more natural look, which had no existing templates to work from Gaudí sketched and modeled many times to work out the intricate details for the various trades to work together. To design natural arches and vaults, Gaudí created an inverted model using small bags of birdshot and string. It's through this sketch, model, design, execute approach that Gaudí was able to enlist the creative skills of various trades to _eventually_ complete the Sagrada Famila. +[Antoni Gaudí](https://en.wikipedia.org/wiki/Antoni_Gaud%C3%AD) is famously known for his amazingly creative works in Barcelona. The [Sagrada Famila](https://simple.wikipedia.org/wiki/Sagrada_Fam%C3%ADlia) was a departure from the massive piers and buttress designs. Gaudí wanted a more natural look, which had no existing templates to work from. Gaudí sketched and modeled many times to work out the intricate details for the various trades to work together. To design natural arches and vaults, Gaudí created an inverted model using small bags of birdshot and string. It's through this sketch, model, design, execute approach that Gaudí was able to enlist the creative skills of various trades to _eventually_ complete the Sagrada Famila. ![Antoni Gaudí](https://upload.wikimedia.org/wikipedia/commons/thumb/7/72/Antoni_Gaudi_1878.jpg/176px-Antoni_Gaudi_1878.jpg) ) diff --git a/sketch.md b/sketch.md index bf703b09b..c588435a4 100644 --- a/sketch.md +++ b/sketch.md @@ -8,6 +8,9 @@ Based on this sketch, various prototypes will be built and iterated upon, instan ![Notary v2 e2e workflow](media/notary-e2e-scenarios.png) +An outline of the e2e workflow ... +> TODO: Complete description, based on the [Notary v2 e2e scenarios][nv2-scenarios] + ## Base Artifacts To represent a set of public base artifacts, we will need to create a set of public content signed by their representative entities. @@ -53,7 +56,9 @@ Linux image: The build environment can be triggered by a git commit to the backing git repo. -## ACME Rockets Keys +## ACME Rockets flow + +### ACME Rockets keys The ACME Rockets organization provides a set of keys that will be used for signing their corporate standard artifacts and their custom applications. The following keys will be created: @@ -67,7 +72,7 @@ The ACME Rockets organization provides a set of keys that will be used for signi These keys will be stored in the companies key-vault solution. -## Build Environment +### ACME Rockets build environment In a build environment, the following occurs: @@ -84,6 +89,14 @@ In a build environment, the following occurs: - An OCI-index that groups the above elements together as a single tag - All 4 artifacts (image, SBoM, src, index) are signed +### ACME Rockets staging/validation + +### ACME Rockets production environment + +### ACME Rockets IoT environment + +An air-gapped environment that must account for secured and signed content. + [nv2-scenarios]: https://github.com/notaryproject/requirements/blob/master/scenarios.md [oci-artifacts]: https://github.com/opencontainers/artifacts/ [oci-image]: https://github.com/opencontainers/image-spec/ From f1ea87a9b76be9843ac7de1472442d1b1d20217d Mon Sep 17 00:00:00 2001 From: Steve Lasker Date: Wed, 24 Jun 2020 11:02:22 -0700 Subject: [PATCH 3/7] Notary v2 prototye process updates Signed-off-by: Steve Lasker --- README.md | 2 +- media/notary-e2e-scenarios.png | Bin 54561 -> 0 bytes media/notary-e2e-scenarios.svg | 1 + sketch.md | 48 +++++++++++++++++++++------------ 4 files changed, 33 insertions(+), 18 deletions(-) delete mode 100644 media/notary-e2e-scenarios.png create mode 100644 media/notary-e2e-scenarios.svg diff --git a/README.md b/README.md index c8bfa62c4..60b5e7315 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ Components to consider: - Policy Management - to leverage an SBoM and signatures to determine _if_ an artifact is trusted and should be deployed - Container host environments, like kubernetes -![Notary v2 e2e workflow](media/notary-e2e-scenarios.png) +![Notary v2 e2e workflow](media/notary-e2e-scenarios.svg) ## Prototyping approach diff --git a/media/notary-e2e-scenarios.png b/media/notary-e2e-scenarios.png deleted file mode 100644 index 2669f3fd447a8bf92873dddc415f09484256f03d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 54561 zcmb5WWmJ^y_Xethgh)wBhXP7T4=oK+f)di*-HmjIQqoca(m6EJ%}7ZMT|>+;bjNw{ zec%82t@G`C0M@Wr&vWm+uU*&PHxciZWU!x*J$dlp0k)j1r0RnQk0~EKc*uf*2K+`T ziSPjU@z7aSM*KnfD8)AL0o7bgQS8BksyM7`!^gm9Ob6Ld&JP}t;NO2e9Ar2Weehti zUQSZ%qlX?m6Z6{(snlEaNwtSW(*#mKN}5W%NDUf@U8hlm)OFbblv86c}-sx1pMP?5J>a!Mm{UTe_t5yXJ)d_syzJT z5J{+;pa_G#CL6sGN}#&>Y_|J4zdTF9z`SOA-c)tEgsbam1;_k5yf&zCKo ztfU^gJs($HJTJ(ttwDPtD3~xx#5F!`qS{Cu{lh8D;@SVb#n5DZi_xgF$*Cuex@_)d zzj47`_hz|#mgj6B_+&*`y*vwQ9S0spv>CaAB9aDH_%!m>&0VKsg9h9*D~8j|>7yfd zWxe1s-}+;tOP}L#;fu>=S2=CWa2bN#wW}_7gxv*wltid?zI<|C+H%lCoTkH0XIvNU zqF6d|)$Eb?!r_LopcMzD)Xrh{>_@u< zG>QB@u3TlScs%jTP_+`AB|Z4QvOyFK;dZ<7n++G{_f2u5o$hr1^~KW(*ij4rHDUU> zFKh0atnRHoL#B3N2VU`-rz+BzNA_PhSs2&G@iyGN(P9e z!+K?2BJb!RSyC1+tUl%&NF4Y7zPDGOKuJ2Liz7)p?mS6Z&?M|l z5X!(A$NGY<{VciS#!|kVqS)ZI0dG>feu;2A{O#F^2uo{Y2j+Fd%V zZ*Pf*>lBY6g{<|3v`k+%O~UAq>FQ+?(e{BvSlD!Isb&3Ospg$= zoriR{O4GGdb&ujd^^k&hBpJ%kX?!6It_34(GWpz=WBpZaObL_h)|F3M>#nlYARr&_ zm_X+P-j?vUK}0W>__&G>ApgLtP#6(UY2ZBax^E??ivFOnWCpPy4MUvvzxVSW(F>WG z4vM#f*WVbA7+KEP6(0FR%;LO$qA~vxOMOlysulEKwDC%huti{6m|0x+oX@)>C1AG~ zo?*kv?l*26P_IFo58j#>;ka4@(R@*n+G5Gd(s7!|C|lpU?itA(d)>{Xno zzZo=f-yIyAYH0OhOBh`eN*koimBUU@jB8gIEcTY?R@Yr67O{zoUe_2rWj)Gn&}DZ= z3~m@hBCxg)g)T4ilo-ygZ${7JV+apj`mv`}@a-+F@I z+vq!>fRQdc*T zy<|_B?@V$7G7cxEU9aYaG{bk~aDHC~clyWlKHmdkefML%_;A>P z2u)xRM{zv$)xqPad*oQMJ8-Hme%|pAF%qsW<|#3G_Gwbi+9UlmQi08&HgUM8n0YX+7O|I>i6Sp z+)BWYTQyHG7>g4R*1mka{jh=q95Q$LVn?&pLhxDD;57)}Z)-{U*k&y6gut+yp7H{I z^FH>-6YA-BUedbt^Y@#NZOdWUrss3&K;{K*c?M$>;Ru^m_g2?W*sm& ziY9{uD1gA3tSbeJjPBa^8dJ$Nk05(^QAK^qXPTpv_z$wQOvb^cQ+D<^_BHa=0*)>g zJ}%su?TU&dFv7_KDN7S6ds2k&T-?s?W52M_~3MI9|kj(T@7|^UMgk8>L=Nx^!P4by&CF z(qnIytBky{A?eUwecFR1X(2zBxexl%1h13W*|m8ClDL$J4Z-YM9Eth~axi$Q0fANb6+XQ?*7_I5k6*}2sUT zF!ecN)k47E*9~;HZ^yiO_Wb!LE{bv=g$>*kxpi%hj>L#{aD2Uy$%usaUH}n4zmUI8 z6!DrQL*XI2Q$2H=^Ty9NLq~ZRnBAsmf`mQl@i_$_Sll zL^+PfFDSwMm<^RLQwj1#M00`Xif2%;axy>Ti*h66AxI2!8sTsdx{qY>e*y+Jel9F= zg00O)d{-n1aL=j9{BM*5Tiu#0IK4tz}QSnjGETx6TkiB69Se@45Th{$!- ztKW1h!$Oj)Y!cUlV?55yvFiq4V>v6ZhVa@x;>4ppS!Auy1@ufjoB+CV{#>#aFVQ|$ zs_)*W;#y(lPN_g<;{vBUG6>XKfx$wRSCL&X`&44N+c1;Ps|V^m@bZ$ERXg|)O$s1W zn7-ig+uwihhrN1GKk0J0U${$a9Up-d(1Ql&8vd|H2>S;^{bdf4n|NE$5w9wUT`pv8_sF!AuE5h!c zC8r3(i|Mz0s30pNKb(+KdLSM{NEeELtPOZ#t=T-x+1>2Jnm>Sz*l9p*v~i!cGh+yT zOGuLcavbLHEaCYpoeV>!_lbpoJ3T|1gNRXe1Yi1I&CbY?{ST_*7L(=jVK(bFicNCL z8ixAK9<;_1#S8_Vn@ae{J&M#V5hj8$_fYgGu^op5co2AxHDLhh_^gdGVeXAesz2JN zTf+gqGL>LF&Ugb;BL?A9nHgx(?3A-dG8_C<&wCV#03^ZjfALKFvTzu~&Kl=P%@3qi zSAFWy|W@Bq7jJT;sAYy@vlI-epBCBak#RSj;0P>_XeKQBudxaPi z)~w?9!G=u#rX>OOa-ntVYLDja>!`<_DMLlKS(KwUZ@9SK#Lbxe-58QYxpXYQ4K94e zTzaAFiM7*}N8fbl*kd){>CQNqRC`842{x5~b4qMIaHR6eIYB{7UiDU8h+Q?|wd|$0 zjA|p-eIbA{a?R!HjKsV0%$ZpmjFhe#Ityn@LO_Z}L_T!-6Et6A4V>MXT=`T@=b$)E z56|2*Jk+quw!0lJh)~Ter0T_eFyX6qg4NxHW3Jzq>1L{HjDzckI11ur%0e;< z3^fiyn=m&l#?qsM23LDO!HnZjsAd3xdz7m{s~1V?Q|~nJPW^VKn}C%d|7ciE@pYL~ zDb)0eSdlIm&nN(zf1n^!xS%uwUG+pax#gPawUSoE)sP9@-oAdxfa4~(N4%TwCMakR zW@b+U0Hpe`WME~#OS?dD!=}q|M7yj+{U?}g>FkalBhZKgV-IhH$oKAHMDrp$;i3i$ zvHQ5qeQMg)2u+Ejq#^j7K7#sD%~3$z666k6U>O2Bkt?&uBTq_w=5O}*Pj`nMZk@*l zO4cvFD}AO;hCpI|^om9hf#~UFaKa!Dg%kUDhg2nh=_W;^FhsC;Bg+Wf(1n}+3cXSQ@ET5s4Dy3xdZ??9I! z!-rL^E~=jd-Y5N`WJQ}2DUIKJX@1g&)Mgc*fzn5*|A*6= z*?8lUnQ9}%EG4e&_lx_Zvkcf3I<1hGISRT8H^&e~e~oiX#}iK;)xxLnoes-c7m_+Q z$3HDAB#9(@c=F4yNMj;3GxH|QsOmf|7wONne}lfP8JwU}pBZ?>;UbIHQ4vIQUJCQ% zi9^!dVVWg$exci?Y^pQ zl^kaEWP9l*FxM$b%cm%qy;+qL3u^e&E;Yy zUOfO15~UVu=R74q8_b;)B;~NLOBza+r=}$H`SQEYq`eB^lMu?Ntg}C=csiIeD-5nQ zbE7@dkI@Sp#nm(7+Wg}v3fHgv^1xpJ_0i^M_6LtQJ~DGVEpgVryPUROl~TKi@;I;A z!O9lx83lg_eR&xi--~}WE7mORN9WH?7aaeR<5i$Dvf<4nX_<>at_Ty!iFG&)M%JF^ zB1ZsH-&~!eQ)SDEj!lY*WK>30L-|%Qw)N$=G_PXykb4a;1gFZT5pkXezj3s6Ieao} ziKjl-VY!&yXJBbb7fIjuY&#k$ zG#IMm%0BNz>_aASOUO;V<-jWJ(hdUZ{M5d8hQ)msS+G`1CnqPtGPZkP5(r7W@cuoyIyO(9xPA@1`Ew26uAL4iHd#5^* zdLu(mPoXdbkEP1NskJypYTrzcT|M-AEF4eVh(oEujQm zgy&kX%h;Jeca5j>)+ASKn_GpQ%K%8!HZ^7DyzTCl@MFMG!L{UEV({+uDWxt+-n6}E z8sm84Xq3jd-o5__Q^mndnT;PxhK?fzqPDGk0MmU*EtQ?QBnZNJ;}GXQNV&`r2CO&Td*!mfDwE8VV914mz@9L~$Oc`96NGMn*;) z;F<(pWA71?8l7phSP9UW&Uc%9scZ>@3_HXx5RA-|_|ak4K)7#=1KW?*PG+!y3LZ$}KuwiJNaI7xfoksA7oUj~#n5fA5AKp88_k3;k< zz8A`3Y=4*&GVFP`^Faz6o_p#^Ye)@;CQi-t_MW6K{F$H!nzVFY+cdmZnV=w4VuD|r zKzK{Tx_B6gckE5${%{SYbj1xv3zP6fRNW4=qPQK}$NbR5o?NG}t2} z@2aO?C#sTS+oX4A2b;PNr18~lRvM(=SQMcoJFLy(dswh8CWj~oIfCv;GLjVXmo2v<_?sJXgN&6;Po zW+FXP(!gT7ccr_gOJ*@su~JL^VOh_%Rfo%_97NL01%U<}OCerSuO_>ZbtYdb#6@C~ z*0NJ&mKlA;rDo}miJh~Xp`NU<-E=QwXHoXe(A$r)73hcDt1i)5h1feLU`&S%K2w>@ zSddI@E5A%FI@JqujTH6DlK$HzU3P(YlSPJ7e(vzG=i^@Tv0E1c-pv*=B8~c0%Do zwkCjU6tuc*A*r|ax!ZB&y;MeV&;SbSvHZhB<8~%TTOwg)@@|<4oeLHAZmF19eumR3 zNT1!A`XSjEf{tPrH`iEd|M+)(#)be)XVUvm_hKl$sI@)~YFPKs#45i-T z<%AuvZy6)AUTM8%LNQHsa(qfrLK_{k%hz01D1-4FkB+xx)~yBFvG&#Atn%A;e1$s| zWff}KXT!OnX?>u_V*6-9kSg*e_15@dE1A;qL>Mq_CA0`j9im0p$3P^stM=kyw0Ma63U&r zhpTy(<=5q2tD50a^+^$7mHH(hEtA-wyOG#jv%o{RS{aCnc0pEI2g|G)mew*l>Q`qa zUi34q<#tzoNznZ~T~y%g3$Fjz#rWrj0aNZWqHV88fKQNOAT0Y<*(T=_hrzq9I>szD zf@Yd)LxIxQ$w6RjqtiZXD=aMD|Jh)6-}$8GlUs|%8>|qrPl*rOA769!@)-nI*k_;*CYRSW21ASd%~@R0gbTwb%$zM<|HtulnkNC z4f*cl%pyP~2Oi^^4ornhF;-X~W#fnvs^|ZUW(98VPAjTC+!fwZ zTgkFVrfZ~|9z3{vaa}VFel<`pui*HHV(_}E6@miQZOsL}pOna#IL|sxSN00b*p+0T z#9HrV{q)qkhQr}`k04j4$MkpUSqYxIycC5}5Q+2zHdG~n(wV4du=#hZl_fBTD0vBr z@zu{C2$@M8efsC$*}U~7e%%$nPLbO%7@9W*vdy#AtiZ;jR&?HQpW^abv7iO$$PH^s+KHNfyv+Nu2X~bT|_*)N+PWcWsB=vX>Gr)D45d9 z|3+04&aq)kX1zt%3XFQ=NBFjn0K+-jOd5*)4{8mXr_925-QQBinZ@ERy<>bMLRlCm zd5a4<^u7C|*HSk}oDu7g;g#hcm_@ctH_Y0oS&k)>#OfR%XjM->%PX7(Bj&c-rZfXt+vol(abbwCRMpq-8Y&UWSxsR2per z@99%ld=MiYHa(2s^;(|S^S(V=@J7}_c)XDp*T}sp=ums3^=XVo^C6>J>wr0Trjm@f zEMclFw{_>`(=m3*N^*}5`DPCGQZdT+DNUs0;P{0_-)Rj9q6X%C*9KXl3v)Ib%vm=2rjqV=8fbcDfB(PEVM_|?Sw4N8E-H{=3Uq0shb8PCwBFG z=jX?e*YLoE5BKL%F`*kP#oT4Ux9J6Uy*K|=rGh?Lz^0;Yj^*Y(Wmgfb>-WpFBIb0_ zx*b_Ix7K66mn`fM1)u(nD_d3#fLAwS^5j8eZW?pd*yFk>B61wG-v={w?sAXC9BkN^ zv}}X5OKIERH`rQP?eKefjVA1}ocar_GRAyo?K4#ZP2gvg}uJ%1#lm~G1#93BI?y@tPY~j{`bw}3z z^O)EcDTcB;FJznd&4h3HfYmcZ>$G!w942Crs6tRsu;r3$+L8F{Q(5L6*TTF>2>AsP$NBeJ z!EmVE0Poj3d8wOqm)bUELMa}7HC~FR-`A>`v(b@Px6l9F<(Qi;8tJ|!ral%zzWggO zSbf@?HhRFgV#l(3d&{f&>rf*aUKls|yjG0Ie49;>aaSWLYad8X*S^_}UkT9=;xL7~ zOrfX?KXPrABR_cqHj>~icXO=c83fc+kaVFhHsT_%%BsOs^95{I_vq+P*_L}iyxUm9 zbfEAGSHd6P(>d_oV6W6pZ0ng15Jbe&0lKw54l(X`)zW$xI@Kejt)N`R?1255Dbgw} znbUCLbzp1Jt2~tNI7L`Hgi*FI1Mu1WO~F}Rr(HUNaZIQT9B#b=qd5NZ)52guQj8j5W&3-tt~_{d4!-{N+;3@9hRpFR#(Fo3rg# zU)g?v8sT7dnJSG9L-H4n0%=0u2#uj`@jR<8sJ(Jw+=-?co@|Bmqdnd9*#mK)W}C@{ zM8m^LYxK|8nnaP;(hf6eYf_Y%y@pmhMu)3D!~C-ibC3JpW-R=vUmLHDn4PZ0UQO%J z!XIoFdCE#v8)I4MwUi$6R`@;Ij+Ct6CwSfGU7{s_oxDx5&koo!w$k)3+KAtbb>*uu zB)e+#!5jOcUM%J0`e$pW3VYarb@lncR%a{7U%p+QDt)V<@6sT#?r6|17nX&d~p`|p!~(<;ko#q=DIn9mJPGd8&1Je9gP-t*%dXEm)>FX^} zhsd&*U1Ili=O8>_dan*9svktsEy!ua}L$}B`Pc<*> zS0qWUq=)2lThHdsz79rNJu59OKC|Hv?kWHE)B_l`S`uI>XckH}u*G3Y40N1hUriD8 z8b&>I?YJ#UCol#dbSX}T@*069Wb$VaYRvlha|nx1m_+49U_T+P{dzd)FHC=j5{&Z$ zktjT+X~x-vh2huC?WbJnw|;PQV*0mCd}COQSRtL-m7JB?8L=Cxm`Z*6SuW#p%99f> zf?YV`h=geZ53D91JX(7bWA#c&W)j8pyIv7BEyAE``cd1inQQG$9{MUGiA&Z#QA!`{ z3egDD^F|y%keaE&7S_D2n-9IkF?tmBbUSNkIf^sgC8;X6rg$_z1(8fGU&QBih3Ucs zlI6YL=>|OCw}{6Zmo{Q3_3+*hrqfAzCCU8&Uj6Bd9n>B~kDyM-6}4alWN$0d&gHY& zYlgMiTf{8r&Ev{m!CR58G1nd@`Gpfnze5=db=b0l>c2vmd44jFdHwN@Cf%k36o9ec z;&F7&kcTC;6{N>L_y3u8;S9=0Bd>NZS6*@g#KJ1;AI;WJEW~5#!SQS`gD)IDF@a)D z9G~Aro<;@~fG7hvD*r0s)wDQ;=3~q9h!@PGy4*gjPuZyjX@JqA3WI+Yvzl}m?o}Og z8$OS*Ys`&LKYTw;Tc>YqV&}>5XPKb<#|p~I?fqmrRK;V#!61fG^hgIqy})Azqc}_A zqdfe#nU$hDnkkZQ-s`O3=GBBJ_TBaVZ|BS*FhPWq@Je5vutw|FwU;Q>_AA$yo6UJ0 zZIYu%Sz$<^G=D%DYswJV67PzV8k4;#bM-W4#yzj;L?_(NRbc!%8RWA7)kCV3;O3NJ zy0Cn4Klt>1ULOMkLp`<-@=(#YdJsQwVr<@s5>-q|ISFsPM!i}YMDuAxMaYGmwO@(#v#s}C5Iu$5v?-n#Wh-mDgNcdV zzcRlFRH!aj7#B&aSbg6usnNNzt{`&2uqLG_zN>i1Z7Y`m?ZL~ONhmN@)|8QvVgJhH z0}~-+;3Y}KVy)K)6ygtOom(&fcTvahXY}{ne4d=*6^y)Cw5VhcDElx~CwO8rp^8w~ zAtx`)Lz6i6ueN|jJ15<2yTCc}Z5Q+Iye;A>;vTrO8*)7CJvEQ2^g7_9(;+{XBt4Lo zX_H#IU|i~|MS9+8ye3xEK5K~v)BqxxI!WQPLR`kQSmu3 zu8PO$1p<@=x>%fJ&PvjE2%^3b-|g<=G!GSdh6+cm?)=kO-?POl$$5tI!Wp7(5981x zLQ?Z1m*1BPj*SbAszuAE7EM7lCbnGQ1nd6Kl{C*5-1Uw1m+%<4alH#JjR2~R;8c|P zsT3Y`rp`_9(nmimCiW+@ts9|_ISuyd%gt*8cN6HXBkWyWkVTOEF;`+Qb%anahsCxB zzTeZIkrPHEjtV|%B8i2w;zk*2|8YFM2$lJy8!tZi??xulmEj0hjr4=!r!i{5+gg{ifBjj$}i zonluav)_4QMzjbc2K#TpY7A*)^^9M>O{$^A_vbl&+n>9zi&FCY!p`zBzEYS&Qfomj z>qi*D`x@Ir=`K31)UveCbkwT>!HDZ5B0)wE4MrfhnfxrYa-t>{@jxD^p~ zRHcZb6jEt3CeBV9z1Bzv_xB`?T&|8lv zJbIEgS|(!_&5XJ^%Z(B*%(mN-)J=dzqaJbe^oq#_rQ4d{@Xp|L+UEyblGhiH{FqTm z@}FBCHk@rpe;2c(&EIliDHWQw3kjY4q=oeA_Lo^_Fd7W$V;4+X-N;XaF=2n$lFS4s zRj3n#F7d~4(mYv7;pTy?r?y9c3AkSQObd#Lo>j&9@z2|t9BL)TLX$Jm$^lJOd zimy{W>OV0ECl9euuf6M|dYJIWGTlKnl((9}Q7wUU`P(nG&JzZ!O;Ul`k_%CmN_*4s zV(7~450(fnf|J2~%4{=onrw^`r`H5}G=>U$%n2X7sT1vCFGoznDBaGReTIQH9Oo|G zOhNNtoOB*128r%cWKjiY5r3|9Wox5X0Y%u=&#D}gl~+;TJhH)s6V&IqsZP9hD2L#~M@JgEXkWOC z4N63X75yyEZlrRUfZF381R597f4Eran?&Os&RfIx*3vK%Hfa#ia#j}9zDxf0q_dz?+sS$Z zu(m)l2XFb(->NBacT%SW*w%^RZx0vOu8X%7Cp$C{O#5*addg))p8|L3c2vxuD(nrF z*+r?0>kT^vF~lKIpZeF18wVo{3Q+{H``t9zeR?w(Gh?G9=R$G%h`E3nmhJMDMktuJ zBw^I*D2s5k14K#NqRV;0IC_@DK`(!Dd}Dz0iqZHH#;UEg0?Ko_%(Yf}rsx87nv!dy}s(A}XI;>ZRy0Y4sBSS(r? z_l?ml*P4xaQ*ZmeysDUY%=l5T;`4KE*Gi772&+r9i_#h6?o`|FSHUorY{OYI(a#{+ zARgNnP(xjwMb|7fU;M*wKH=^NiB7lNE{;$jjxhq%(QC*N4l~gc?~#!a+dR1_y8RZX z^G+hy@lS}wgzC)LrtyP^OK1A!h0QP07EXiXW!^xlpo~vhV*r=CP>>n71N?2-O~{#* z<-~RdTX>?1oUsC{z}P8@i0|7x)nPC06hMmn3lW27j0n}#qKCH3g+cEb9g-q)Lc4BU zbIp`lm=g>z(>a-$jcr`?VJ{#`HE|DLQ0%${S7JLTeBm$r8BsD2ro4_xfI9smodw$x zG8pXIN9o=omHWHxDl|eKy=2_5%b!WS@jV<`NJ2BlMR|44kOBpRH&8H$+bZ{zKQ#8A zELWRl`0jZA1%sF4&vrQX`b3LLpDt-dwXMxJzTy0Dmy#dV%;5xbxYWe~#&ee86W2uE zdra-B^-1d6^p&<@b=PEt^uOv^V}RN4pn1WFg09>Qn+r%FzTP7g=GhnNx8uDSXK@a0lnTKVk&=udsnNHGBzr+Xzqotw<~CNw+F!6X$T}+HQ{fb4FHfvgHUm` zu6szpAvku2-GQ*2N`NZ~r%$HV~&F98mA0 z_^iBu=Scn$AJowM5$3Gr*s+(TykgSd!*&Nn&5=A75yH^4Ays{}Pys`I zbAN+>c*NH7ZXbVcS+8I-5aq_*UW;pbE&7a&^Npc)9y;*_Tlqd#2s@hCzTo_=O?wjm zYf#5BVS*4YTGkm#RdblKl9GsAlvaF1M1-v{g!vn^wCqko858mOvWu3fsYH{h1!$~k z=Vk%>dEyWo?zwSI@kXV~*ZMkgT!7&29V1WK=9-^`LXG5;{Y_dR&L4pjS9q*eL)T-tB>vM0d# z5%=fE5u*Qn)Z!~e9z@e%Oomh8#P8x2l1(?E#PHNGB-^pUkSD8+bhFPd$KeLp%OFg%3dmxRss&m~R2#P4;y%T~8=Yjoc5O3;cQ#LY_a5D>oPDoDxIM zS5BDjE59Y=oVYL&IDxCw=TP?p=KH*a@1%Ce2?jURu|P%zkmlM$VYjq zE9QL@;9gVL11eR*l{=@8q*_A%2}YNn$+CIxgdVpVT>c;Be1Ht7SD~z@EZX}1uMbM1 zQv-~UT2yAGQj`I6EYQCOAbJN~N-b(_`QS~$b|M;+On_`s3mK&3)AnxK$`#CCE~(zC zd~{Z0OBvxxF0ldG)b~!;Ecp%r_A&NZ@~=aBF0m3t;cD5A5r&i;Pd;SmyQtgZ62pt$ zTFLY%7;l%;-P?ZIM^EAF0O~X(^;iUNP=Kc=B6@0DHJCD>k@aEkE2QWA-v9cHiSiJ1 ztz*@H5nVBD?k-k=7VFSg9UdU4bhxP?fC@j=$fI5Gf*|MVN3*2YO~{KI8Ga zVfbI;(YU(cG`xz`YDs%zD6D|0?O0Ou1+0)p9le9O29xgVFGAS~yiws}{GX9p<$_fq zGcN_N_8M{Zl5ZaXxiw%%0I8Sb;8^_8tKTXtxgSI=QJ8_e8)GL_TBJa2wsy6`2wa{~ z#S?=g58X3FZXc#KonrJ#ouVH+C&4@IW=nZ#Ft|>vwi53VREtqhW`BJ z3+Wlgh_8Wb^mjyt;qj*vTXmnQZQ)2SVSr|`+0uHG(CU}oBL2_R0Sz(ot8FWx$d_~W;J zRL((bMhtB@4NImOX7_` z^g6shys9k^BOmHQ7Jtio@fi`Q=v9 z+6()|Pr;YzcgY1HDh}y69Rd~^8R{zPD6so`Kl8*JxWtL{1b zYU42BgrVkKVz}8bG;q|^ALp6D&ZkQ*!MTo0R>5SM-68-B((P~1Q z(@W%%9(ys^t6%myOM@kz|0>0(&OS5GLJ4mn<~hR) z!(QR-4>?RX2B@Va12D>Aw=fEU=?vtdxbVmY^jrN~eh}X}S6|E~7}B9$V_(PHXX(}` z$AJj-!W)R6@smw3G@}HyY3K!-LV8O`iZTr$a&C(o~#en&Xt&CBvPzKgvx^tw` z>e?YWBTZ}!_XN%lHjF|kUI(f)?)8{t;~?(t^fkJL(KuU_L7oc)uS4C1>WrF8Ge+OV zQ@S~f*s!(L^CEQG%zW5=j@<1XU}h-PKfiwEjPze3$x!ME$^U0q6Tb-X{aljmcpY{& zl9K5i_oJGJuEkORGghryk*{46mTJ`T`-$|_Hs`g+q11EWboENgWc|QMzxE&jfsRGa z*QTwE0&(|A%D-7qlP)x&h}C4>B6_lvm60*8R6@RLb!F!WBI~$l0TjaAyKP3HUY|S4 zmB6?2n@fqu`y?(RN?_{!k5^rvjcG?WTwIbKE^BgaNNT)Fn|jMMZIBYyG)o$m)%uQu zt-V+jl`*$9jvx1`p+C+CBwd^JLs-{Ta)`H2%7?I9CiBP0CJ!A2`XSyJngfNi0!4Pb z-S@(Om9YEFHSC}9>O(Is#?q^ZJ)(|S-b0_h0;8<8aKL4-jNm%ivwt@fqQkL~-eL4W z@S%6`dfunX2Mk3AK}eepIgO`*q5ySee)2JyNErD|wd&k~52P4FfM3F1kR^)yr$X71 zhk3HL_1LhyT7VTqu1HC%0X?JdJ=pk)Kt*M+pL~vqhufF-5Qn#0D$`{1kChME4nL(W zEI-DPrAhsyk;3JNPzuTf#gZG_pCS7>S}&WLIK%^&%!&?>nJr^M30r8xX&hCJ8U<@- z)pzxZL(Y;W8j6&7yIgZX%oXpo0P3u(8JTtpyXo|n$i2!gEXB9G1*|UKE+|d(34`_{ z`MtnpuD->DPa^fxz~W=3S2+W1zGDA!%Phg4AgSK0%UpGle#*b2Nst>|G-4OnKEKpa zOjqnTFrM8HZ~(1d_y8+bXnmS|g00_+*0AP2z8>++(m42}pr9Zmu-|f`88a;hD|Y;v zD=ZI$z{!J`T0Kw3>iaGl2X~02prUi9H{p&ZFLU(txQePB`O!vfyXx0UvnIye`e%RT zkP2rha<}SvZl1eowO;?AgkL_om!I3#z%HRaq+yGr67ib6o089KSlvia+re&xN-|ey z!VHfxHeY)?!unxCtHNvlAHuXiBT7Ut8Rv5zlMq$HZVU z5_30Q@+{mygPo{Vb<*ZN!(cCm0}BNghp-v=A`g$YJ7Vr$+CbIfTA}?L=nBQITOkRd zt51l%=IPDE`p4Iz{Y1c$+l~0jBM_CKqmqUEBz9jiA}o?4wo%X8yWh?qFgy7PMTE-E zh7>TRD_!R*0d_LGw|1mb@q*+L>k!4@CQmCF==@@ne3;6U2(^f=w>vxB*(a<DX;%xqRtd-Znh5OWWZ2=LwjtX&_HV+L6*^gK>Vt~4O*8cHcHrKNNxOf_pkm6e z@-e@EHcFKtpypWX!jYvo_n9RQ!~Xkq6Z z>WuA~3&v@tu}+AF>BRD`{c`5N`CJ@zQ%w}~NySps zxcWbQZ_cQ|vS-n^(LT71dmk&_{$99x-A)Cd-)Hk$-$9XENm}2lbkd8*$ zko)9qnT#3cqDbcDGXAWL0p-);9?o6mmiB!W91AVA%{x}pS zDt)TpAvd3pQT8SOnk;o9v7G%qr{d$v0sGT{Jo{HTvT!U|p>DZKLlY;4AFnRcQ%fGJ zN@yEV>~D1}SR)YYQF^~51$%jp7%)eA4%N<*FyG}i+}l2ko5XA?e`wZBon$Vy&1)ld z4QhD;q`U}$yI~QxOdE8I$=N5BI}@>dt`W)DtFhLD$QRa9=8;r*IU;f)_W&Rm=gt4% z)l7EP-hb-9_UECZ)@xyBR!RGX8iwy~4Ou@Ke(GRKU~C&M%L=KvMD?5I?PA{V4UMTL zTYx3d*IJIgmW%@Xb)SG5RETx|X6Yn%Vn`1`TK<}aur0q(t*5)YyFLJx8ObM^P83%k zjq+^6u*XP8`y2PVD?gdyr=lpI+u5TQ5^JK2V<)J@kDJ{(Ur_^!PY!O4CQG3fhfQx# z*hw}E*y4A~hCw*vHs(Nfr)9;dae9Ws_d(xT+jX+>Q-zSTk6@YJEl@Wtd*H8*;cSL* zhI6^rX;`Nv>Cu04}H1CW_}cd`5cWN^cSg)33p?DD|_>77~;M2Kd=KSVzAikDZELa2Fedux0cU zLO7=aJo8|l=-WBQ9JWg(N-|7x&@%xuHG>QrbPb@MxqkOCiA}l@UMxZ}O&-WeuHANii)mJxEK5Z6^ zXX@qUCHxdv2nWxF>UW9~u3SW-1U0%UXRq}{yrvCy;b&_e>C*xhP_JHH-lBWYZkwu8 z7@g#3FkL$Wi?AfZJdCCgZ#$qs!wy_7`gN4X{0fLq{-VI$Jh$<#se)-Jl`5lkF2FG0 zjY|+l^^kP@mX|qMK0ZDM@HCJ+xFZvB7vw|5ZdnBZ)_?C;hJ&B7_0W9ldB?*Qw#BoO zY+f^mKUzV9ajT|Ww!3{&AGXYm=(&H~*9RQO8buwVWGlc*dADluu^-2+C?93O&liqY zVZar<`$b@Jv@F2M3ca$xE1z-HbmS|hU3`Kyw3Azlf=S>sK>~$-Kmj6oC@qGuGRU0t$slh~$cL{{;P++_iR_UI2%&k~q#(qg7& zW%;F&UXo8PuPKgKp^EJvJ2hS#4xBNMP`_K{eFxk38Ik@gIL7k_K1=M!mt2o&Qz5}h zGQP#b60L8*+bQ*7zi(S7PXU>BXhLtE8_kH)H1Qhkv!~uykTp|Mhg57$zvf6TM*$Q0 zTM+-FM%ipmF0P~VUuW!nHRp8BfmsQT0^;d~g|NuBI~?JW^8E4BSm$l2)Kg^0y)K_g z6o0(r<<}f@igF4a2{-xg=aVbI10%i}iC55bxa%p9<2; zsr;l=Wu47BV{eOl@(v2@tXDA+M+qt`E8nG%0$01GTXop%+VX5WuY!45J2p zc7ZP5_3>8=v;uOq6=v2?CMG7(EiQ1QvVM;J_qdn)Eq8k<=1+jbX}%^t@PsieEom#) z?f&0`Obk*}Q{^H$vhWrx$oBzD=w48yr>9#FaJs(IkHn30O_Tml)_d-M$sT-0){&#} zI%%=AaL)Bu8!FKX@Q!$#4v9k>K~nlrq4R^^9wY0LAsA3Of%smwN^*(64fA)_R zns5PyVfx%nZ>SdA+a2&Iu`~JPM8Gm%01tx@!}|d7ascs63;>)F2*G0JFX z6OgQ_qvSu;u49|F{`cP^9^0u=r|px7D6M5z8mnX{``7a|o*CkG4-JdV#ghNPa%)Dubi~$Y zTiGiY%rC}{1vALdlXif6X1OP39p!#$9FL^Iz&Y@}OX@K?h#+g#yevoLSX}Xy+~Y?Q zFRvNwqQDqw2ga@nZh!3+WL6@kzja6gqUQNoAgilad~yi|b_a3Dge`_6$UKt^m__Z# zJyxz60F=Ib>-`Rc);3p@MJZL=ht_*>JStM4)gj8h@#Cd8z|KTuIdz?r^Im@#J1fj@ zfo>4=H7uRoSPMhEr+Z__vwzHz{aBi#s)n{dzn8k($jRxD!^oyj3I^@fIK~>2F*7%J zA1ifz1rgn?q7l$LCcz)H7}$~F|D*A~&1ZGQXkjpm4s@9txQ2W`rpjUZvM1>dLf7q_ ztAO#GJIyxFQW?nBiom@9NC0vP8y%lQij%Pt_D1;SQ(9nRbLXVm;G%9`Grq$A!_`~IMcH+2!z9(~K%hQ?GFA7oTeqR)>&M_&b4v{NS1(7-<;auPZEK*^!5$Q7)R+#0r6PvXYu&grNesExPddr>9dKV23%-fh_PElN8 z?E#-R_zj+qH3%}tV7Ub2>=4|XyRQaB6DSw?l97q2ktIpdkq`|L7~0vUx{7=&lojl^ zAAeg_a`Z1g<0~i3MMgMNNLWBn^>sCYYWSqtyB+7&J%1KM^Sp7|H;WJHCa+#b?P&f8 z;Zt!;jqmcNP;H)aU0Gd+o z>OMK2y+?JHnE}8}P>J&Lo>fZVWjx!Mrxqe8KPGz9dqr}eA0vyOc0Y9shd-xe-(vK) zNTXrw0#Q^QIAVAaBkBAduOfHyw+k?^HKM#3}r`k(j-jpCiY)n3I z4vpXB!)6Oz7kxKeCmc9tcU%KpTffrv0@>1`?GHXe{+tKeDugM?PxjOb0nPMfv?hE@ zQxf$frUafnu&ZO&l}1;2_mp#J1@Vr3hM^Nta(FMsdd7P%uj(J8qhclNo=8T7&%#A3 zMr1ALOR1qCG?m}V8l$fWgF&1G2}!RwZW+0_T@xKE^|C37Fm&`DsPm^sZ5rvg(Jcj2 z<(TB?jgSUt(qWAB!BbIynhjr?u^ykK7e88IPow1&goRKpVcElsiJ)aCRa3h4uOHrW>^&Y)u zgnb#I^Y(vhm9pofFa$_b?O$F$#{#@CCa1JiPwC15x0~XL%0DNEEB07lzZwGE$5@hY zcT!Ye=N7YgSl3fOI@i`uEYt;59k?O~Cll@2Q&Pg!aK9I>TZv?U@BJa*+U}W37xo;A zTVs_tsL`s_YTRSWS?{c+K+Nm&Kg{K-?7i&Jc^n(l zR|@C)d|&up<#p0lLcITdPoBt{?vU%@^LjErj4lJ!wuj|9GAF+{c+_0FY|R*>_%O{R z!xT8gpcDe=DvL#H_|WtF#7)s*gC$VDT#>hItGNh5N%_heZSp8;x5F@wym)+rFvRe^NScNl9)+)8 z4u>;Lfk{+Tt@x2(NB>njQdY44AdKo!rcX^r>3o6wZ|$d>YnBg{7Vcg@3LxB=X|dI? z<$x@OU)R0)dP{7Jii!eU@YJ4~oUO*#n=zY|5s8qMQt_4&4)W7KGWsX5YR|bQs2iSZ zK|W?*mpu{Mx@leY?|F)koa8{>xQ6`PV!T`KmfLK@?v=(kIgj201w{VWYk7-Dp zR;XUB3pbQdSNZbCI!u{C0@x?;(mE}y+Z?9McaO0;v_F3W9V!qUwfoufy{%fqy`Afw zD;03EJ&Ek{)+pT7y~BO+8?>azems&kYf-1NZ}1iQ&`fJINtJ%N6{GZhgX6((pXyaW zR=Sh%O|s=&BH;GGw@{D>@fsJa$yL-#i;iuXAu&^zoI z|9H>UVnAk0(ku^GgbNSt$fllGPM@29k7Y-9z;6?}w#cE1s~gie_N?P0CB-`wk==fx z7v!zzxEf+HmO~9`L&K`pIM3-qsQk^(*R7;5UM8?i*-(d|6p5ElLv7^>nWqr zxlI}-@cKCI_4}ns5DAR*O9tl_kLBk=d`WGHBkISY;_Xd)#X3-H;TP3WO$?(Q0{zds zLfr)^O*+=>o1kuP&zjC{=yxOd;$yD|^w$a7mR)*myMAtKJaV+_qbS+wFPnAUb&K^} z{M=)N&P1OPH6v&Lp|(|XaB^ba&EWL5Mfz>l=6+GTo%^zxlW-Dj!F8i zS1Rd|r<|~R`#hqex7o+y9c;&xO-=8Z+pryrewFclmv|mr-^Yo$j&LqW#9u^b%+}r} zS!BazxFJ@*)R%STTJ><^StZ(Kk=djX`%xx8|Mx<(xqD5}2bm8u`j`F+Ilbs_Y021n z){McCAfxvg(=>NG?Rhg}8G3C8cGpb*rx(Lw(JcO_pTCYmH{zesELogeJY?AKX^*T6 zw4AeER^(?H+t(`_QS2#tOSl|DC%~Jh`ZHfuZtW*e%zS7`X=Zd?+@LhMg1ktRjOK5} z38&a^71<84ZQ-v^`2m&ywv!Go>K`tEZOBh2d8~+4)XdSoHNqSfaur)7^f07>v}J4F z#x-PTxg}4q!rUrtyt$T}+FvH>&6(%p#vu>v%)dMgG1x$|uCz!y?TKoEq~N@>9M&HZ z9U=4($RErzUVqzCgbTi~dC)V=67N> zecHMX5YesBPlK7r(bYgaGyaDev#PMbp3fMZgOl^fy8O82`w62ZXdGmk zGE$#IlcpZdp794bzZ+e1OSRJcBVAhOOFTu%g=3@zCw#+=Ic`l?1-T~V+;PP7ow{36 zymT86t7&VrR0>+}A2wL#5Fw4{s!FTwTft;lyox6w_7IFp4B2E~vEV(wIFuu}SOo1} zF_l_2(iaELxk|hU zYmF9a6TNEDo-NYAJ|Ie{qjrZs>MzP=p~|Tm&2lfxQVg|0I0#~_Il0t}($bEzN68X? zgiMGp6Vq{qWa%eeQ!qz>r$QNkBk6ih#L)612%00+GrK%cyMG`jPDj1aN)48ePKcG z9P?covwbRs2dH(9mPz!eZ;Tx;Xtd$;#cAWqLCWbn=Fbhpg2Of`PB&fHi479Fujk=>$x=)6Yl^ei3MK0r}1td*Hb?xyv~zkpc>OJD>F^phvOA?#(tuR zhqcY@KvelMLt zmHF_kmU1!hvU|2eZ>z*t)w5m@L&t9w&}OD_@=-4mi}MrE4LDR~Fwc1&QGApS%>1-3 zml+vIa5OHI)=a-JV{LY_qRoTIId~;xzVl(MBIv)?FmrHlNdJDKimlbOqT>fK^t4)H zrWEQ3SROU4_V}P#8PG$`>`5&vwztMynr@y=OwrtafRrEI4f7JB&2;dl7@Mp$gcA}F z-2Q9BgFnO9HV6W$ieuz;8AuN~~iZJ87q6TUYpxbB)X9mRzs>Jwbb!*5SAHBtO};vAxTMj}K?*zoso z#Qi-SfRm!up>wCUIfvxlPIO2bJ@DWh;tihrkQ6dtr^z?Omo?&1fa#bfrrkySc`B^N zH=}1E7;;tSC7btK^o^GAY5~WC+H8rP>V(Nn@n`!&aksbEAGaV@*}ms)X#mmvPuyx&*b2UOg+@Dpc9(0Nge1Jjw@+7ast_8YLS*>Igd%Ut9uQ6 zH0^aS%$lyQ6k;CFm#VTkI+pM3Pc(vq8-oNzGz>yQLb&2)LW1g6OB`}MD)(VnOnXif zx&VfZct2l8NNiB|)5uptor=8)yd)L2iB6sN5nWHCkHg+O!TH{8IAvsJF36l;g@SUm zqUf`w2XBz|mm4az1d_>sm@e_xupo!`RoWNqiEIygQR?jO$z0f%-j@T zs>|IleeunM)OUAkTz{70Rbtv+C17qp_F1B42LKxTa3}#C4vw@yjk(x6*9Fo~s%#5O z8o~H5%jMIq6P)SFC7sgOfI7-9yV$hmTKn26qjZt1y?$}N`UQmj2=DlTiuK=*Y>#@E zx{-kay{yj)8-J*Q@>J`|Xup_Y15(MQMR~409&}h!Ea?MCI(=oB29c}L1IXW4cGOp^nDWvvA_exSxEdUwx0Cch6ixqXjrd)SX|r@nEG5awPtjB`r2Z=H@(rfIPk zLN<=)9F3zCTbSU~PtvbIi|AtNX}1}|mQT`)YUv^d#|Me4O&Ox+r&sX(gz8lEAh)=< zSoHL#s`;q9ev{g|(81GBqmnjCg40XNYAT{~YQqYR;3j*TYh)kAC@DN=$&)FJj)sFB zJRl8Gbjd}>NCT~d?P}P$TzI=9l3iLnJuB;uJ#ONX48!EfEPE@qt{9NHkx8=RQk);m zeavH>5xXJ^z6L%v3yDF8n)666T_|LRoUd*t|k2Par>ZHA`>I`SXsgxN(i?| zhIh1b?q)WV zyEeTr6>wdB+9KA=6UNzj!z{sMiKpgKE zy0tqqCg0VOGB!3WxK}ZYNz2;Tj!ql(N5B;KkYXnKS0NogOp;}ideTP&+>G$#p?UBz4n|@!_X=h#jz-LcqymssJj+?g(p^yG)6+{2w!BjtBon+Nao;sfUq;Ax zGQphg)?s`kHHSCJXt}%T-CYYH&$)b--GB9jk{a5|&cm}vJ#_Hm{P4a)rS2K)`H}uO z0>vx4$AvpDdU)F*S9xSe=uoX$Xg0MF7jz0}z4fw8!GW$V&}@4JdTO&yWXf; z@$tT@<}oXMV$W-RusDjIUa4kD32+IzOnMBTY<$G(u1*nt*8s2p*h`~yvTN) zdz;}l=>2(S)(&M6e3>!fvJ}U1zOM2qk9*3?p5m-T5r70opYI;(SIjHKNf8v3P{%&> z&+0H)8C|WCSk%M$5-SQr&p#j6kt5-gJ7wrB1Iz2MxRv^Bn6VK(63!G6-HDuWFneh9 zEc*alFjsOTa~!&smoH^!`&g$|SYhMvLTm!!b`sflo_h5XtD0f$G}q#B24j_BC5xIW znA;TRXAf;$OwFlO(brxF80Ne45u2}27;2dOW)u8z64s}D)BNFoRFAr8n}CMrrsU9ir#TzFUU z=m?^#j=Pw;&2CNjB0H2^24R={?BhXHq9;RpLJg&#_y)IrThR*HX70%R{5)U0mGZG4 zF@j9tl5xCW#%4qjbDLn#?kQ{wWTR*YE)&(EKSFaK>Sm}u z#eMCh-($xi-4&6hyd(D1#^vek>E*EbYiJI7=D_#WC@xOKqXw<~e)lneyDppv5jSA8 zUrMZFHDNR{f8No7rCl*$y!7TJ(FHez8M%v_<@!rU?Pvbi4+og-7`cZk6LhV&WGtlJ zkTCZ}G1enQxN5wJKhZ1_!7W`m4O~4N!~2oHE`awo$iCZ+2FES0BpdcpL%#JzH>TsT zyAWlZ<%X0$@p&qGSU34eHy01H^a&r2#PoY+*cKUA_qPirYL|F)y8$+8Jz8JQ4Z)t8 z+ch8<_u#Sjq))7cmRlVm8M+8ddiC;aU2LRya}kH9E0T z_xaY(%Uz4ZBhm2?^Cgz`6WuF)^55Og)o;G3%=~fB7iE`BA3`49l1=d(b|lx7qGu3< zSc&`+AO|W;NQu=LJOk^yv65_s`H%v?vGFosLB{vDe=T^H5&gR0fB^n_ium5%=1?JY zJgge}JouI>wv~5Op|%4Zzhc`l;Y)vse4brwyS1;SfPW&ooqVA)>2@A-qlyyJRqJmE zD|CSvpS+9=>Il4ybNNHEed5Pm<8!uXA}cB1uV9O@>NHDDXw?rOc!&U>b~4o=Wv?5w zW6v{rX8-!0HjRmf&o&Sx)f?iPpy_a9{J0Y3lg}gJ4_!1RB$)XP&c`NPVM=7R|LijD3{Lip?wwG$Z zHMPa@oT`*^yd7gpTICz+QyDTXjjt?*4J-+^wU9z4nTt}C6~m6axL>%%Eo_87(c~}{ zPSQn00yr9OgGF|F0Xsr`7I`U05xwRj5U={Gg;MH`FkXnA$bL9l)u-H#R0rJ(FOGvl zj*(d^n^Z)%*y8h{zCqnkzWI-MFs=X^0h~s9xyl2>ry0>6IgtmR9qdmYNqMCOouZGk z*U2*VO%0|CU~7K=BKeLqNIokqEdAcmKxJo|FE-S|IzwHmQHO-iLI7^bkmO%ZYTOg2 z665<0on)o^yta5=flD3XbSaWDc_}D-;Ip^3Nf~|h5i0O6XL3vea&zft#pN@_y!3#? zu#ekNvND>?vGZe5-?$(n*m)Ky&ev^wifFO6Du!7^ebypQXZ z)&GDizcJJ=2i$O69M;x&rv1ZiQh|6QKW<`s40wh?G>&bW@r6LJnI9L`CAU zgR{fk`!09(q)lZ>W5U5egYln`ynK^b5hwZdtYEh!WO<=Fs|4l0g~QN4+(;!+2bxDn z_WaThZ_%d78KYzwaR}j}GW-7|5L2A|1PXRDjx?3KswPJ8zjosEm8Dnh=kSYDl`CZM zPny8j-eygI9f*=}-HvH5?j*~v6qbQ4g+N+YbQ!0O62!{zR7-$*?p-60X7=s+VgB>` z#gG7L6rSu2uFU>>5tu`NEO2x8;6bP`pwPB8d&rlUJJGw8^k8B|ULG-1WztRPGlsDE z_O7J4!CMEQ9=Ox_*NAp;cZvyMRvRtACekEkr;$WIGv%j@q0?zGSV0bHJ$fb}9bei5k(;G;kp9_v_S~%^X=J zo-~%0!pI;KqZKDR{h_f&k@}1nTeI5dYKEJ8dwxGP$7ky_W$;vvYr8rMmc1YnKYCl} za~F-%|B-R@H>o$3H{6dH-yO$S0(I!BWhf4qC=Lpp#p9uOvXK|PZlmGM?9o7ZfhcwJ zHet&F@O#~IcCP=(tWZRPa5*({Gqa#j5#^%Zpj=d^S%(acWX4z#7dT_;q0VA!y`Ow3 z-V&?lKFo^x(`XC_0}kF=e1U?fXqon!YwJ=}GsgM}I<0?-#6Tu}@%#huIeFw;41*hz zkQ1C_^$huCDT+E-TP7#|gbVB|QMtFgz9GQOD7An0=dH1iz(#HuX}@;rgUXx$o8eL3+!Yk){r1Vg1P$|Tvv=) zu@rE}p^TOet@W%VItv%wOY&k1m)-mDc!p}P|H!ZAsC~VSTvh&RUNMB8 zcE9)HmQ!R5U$xm!dp{IKbzW%qbaQjV5H*l&&fZGV%_B4uy6VM}{1C>C7;Yf_JgL0Q zQ?WCxw%)kLK*3L{d{bI1F|1PsG4FDX#o}Z8X)N#Nv8TZ`)5OZnqe*&W?q+zhXV2_j ziS^2lepPSxzRk3IE+h}RD+_?v+du^A_Dx^RJ~9OpXT+T-qL;~56Gq-6NO^D7z{W{_ zuJJ^|X{W`Z7hu|y+lziU(~k@(wkCc@Z`@yTlSrV3f7V8Odr`DUO%jXI7?wB6D87Te zxBp!GMUcy6gmkDr!n!ax);D>_1&e7YuBnPGR`ye9`FqvqakW|KfEm26>6S?H0{ZJ& z_^Aq0xLA%vnUfC%;}4ko71`5xg$?$&%NB+M>c4{%#?75NFNQX%0&gRg0?T`Ay+%%G zMryqc-058A9MU;ueg9M~PI164vWRO`mo&N%<1y$TEK4Xk7X;K7 zA}7>;hiahWwmse6?IQMsD?301Y|mn&T~PZQpvFZQD+J;huSO|TJh7~bZ8{`+L?6Wa zLV7JXkeHi8$H^ir>d)IaS>d?OUKOqva9lY3_6MkQ%z?2gTm#Ps&Fyyw z2GUGaN@Br~332X>7WqKwIEgh`$l3%iXrZ5Ev0jNWG#g$#d}g7~AY^N4`THm>2~d;% zwF(@}Nc|$KRrOf`a++#l`6;SRw|BkXi0i{c)>V$2I?jaG2#>E06-feo17?i*>dK@7 z*;~?2&Lq=xB+NKmd+sL-RPEnGRevw-mx!0C9)zWp{0 z)^=$)%ZJMc6F?a6=JIiml3MLmK*m}+9q6&cg`_3aX7*+GztfD%!x=~qV)B1cq*GEM zJ^|rmh&hmngnvKrGX|mKDcJ$943O^Q_qVmxS4%zR+Ia7oxtoonqNe7rUVA1o?mS^l z#{fxp@j7FhU1?=PixV6lB%`dEP?du)1;*p9ePaW40-V`)nS@Zf>A5>=qpMc-KUYuQ zkF;qX|CmGK4*C~v`G@zKUPf?llmEES$*jx<3e(1#Sxw)?W~PmYqF2K!`8^G+ryd>m zs2GAyz6R&#A9SoFetH_;csM z6Q)!rq+#B}dzXga?t5cwrep6h!S<+wu=>=k;A&>vc}=T&7L9S}Efk`}KMCDh@P#?7 z!Gh5H5dO*gLrOpgdmn)9##UL!`V^Q>dQ0qDQ-Ye|IC5=m*X$B_dliLB&7@_aX()(d zAn*6;t?Pa%5OY7TP0`eo8B@s%t9lI|=-HLxD*CQh^#AEDzd(yRk&}(4FpQ&GGC-#? zihVejy-^#hQf^Stf{$VP`bg7;6Zv280gM zn`f;(z%ZR(e`>?nQEn+rx$<0^f-yzjUFFq1l%>{oj5!*E;i?L?%+LRLpv6GwX}~6q zZ;l z0&B6B$MEn!#8%t}N0vxS_`a9T7vRSTggJ^{PV!M45W@8AK?DJiRpR`mlq&!sv)M)` zk^plP3U;hKzulr&l5gY`6ucr?y0~CV8740*EOaI_=mydr&)?R`9PdY&*|Fl>MkA-TZh6wR`0SyK>Nh0n#IB^aq6ksHNm* zds)XuDWCcKQ?7n|mI3w-QxT=q)uA&HUi-pMU{!f}Yih6jlPRgZyK5{$L>@u6S{VNP zn`*p7PqKr& z3_%FFOb$%{IBByTtB!6yv|}uf7BIS5GEJ-}}z)-?5Ibq(xz& zLsbR2P3o8uEDOxq2ERn5l62vRg}r1f`l_El3pNFID8FkIRfl2b>gX8ynG}_BcvSb4 zUlwVY@oeO4GL`!c*fwaFhBA;WXlrNIERLAjMDFN-Ky#IxXsa{w&uS*8D1TfuBldI$)v__@i)D`=0!ME!Ovh=29QP@j8zjj9xNN>_Q@~rY?_{ZBVID4++vn1 z`}JgD#d9&@Y*M~aoh>E%<#qAE)!35-LGb>IHDT}^ew3&-=+dGw+|A32>21>C9;fLQ zO;;La$6q=q4I2^qG)35?oC^f*Ty3+=QxSUpPN2 zuxchtONe=!hWmWRVob$kb3G3CAO_u8%Lj$2O^lftxG(FbL8Doo9K`V(iQG7SMWQ@z z6KC&<_ssg~jSBbqU_|eQ-2VShg8bL$^)iCE>qxtwdeT+WV8sbb%O+V77hsn7fU;@S zq|Qg}tB~;a7x1;*kzBiYA6j1AjL38gL>mAG>=Mt6eao$xklrmuHA3-V_&b6dk%9Px zN@x@j=R3st62Co7&wIw^kBOc}hxzU)l-nJLuYD15#^V0g^N5(-8Hcel)9~QN{zpE^ zPMY3n^V7LqkN-(|IUPG zTH8r2Cm}@nb3)l6skL?Gnh89X@56z{BpZ1oYt)?LjKa)2AUzf2G^sOe`2O86*|0qu1Z<`TURU8F}oJ@s({&NAZ8E}|XTXy_!8ma?Qg)*)cI zixPo8<&kfsN7iNRX3yaO+U2i8qw}Q zF**58wp7jQBdU`(EPkA^CEhR<&wkdMkdOek;cdpz%6!pSHwdKV!*o6pv=!hO%RJKj z`fA}{&CM_EpL^mTIL+GseWKUBxqZf!ng@ShvPnSRoNC-sn4Nn5vdd0=}ddA!0V>Gl}Uxm?kpeVF$@pPB|4t zxSB_?_g(Ca+zvZ2gx7?hom=Ghe_3!KXgW9G`&dE*VF)wPio3o1v@0VQmi5f`{(8UP z%u?c~_v&IcXcBlL2B+N)K#qCm-w^t&4a~wkqvx$^rOM#dj_uizWlA#C{oEA1Libh0 zds^-~_wk}BT}4(&V^A`z3Wygw72^=O9rwD)k7#j1@#mf9=hoos$R7kK&@z^upR{p6 zd(D6Op=%d%mU?r1V|@4_>Q7(0a>?(=gP@s|II2%>Ef1IHHa$Apt?3o8D)ATCy3TI@ z=WrVvG;kIuFYlsyMRIYR1SGXTZL6p}K($kCT@@NRfFMoOO?O{GEeEpI&H_O) z|ErZGWG$Ih@As(iLF>0+wif$8b9R-PE!$tyB@O&<&z!XkT&L!*HnR`rE3;l>Og?Dz zOi?W0SDddWi#femrZ{y$r>cu^K%w~Cun^pmn9%P>V%ztYgZeI>bm3A8ho?OplKS?W z#Ko)e;a@G7h>H-G$HH44LF@wp6y5w9h&u~{i+AOW+l*k4fXtoEv@|k|PNe%NNM65e z**eJiD9ig#s`pk-$nVuxbGH{u)W6#`CKh=}gzTS43%d6+z=@N*K=ZBK0&Xe}V?vXv|DJ^;8) zLtRmriZW2+kiD}Bql{qdob_0X;vW^gTn^mPRK_{KS~&3Izld`5>DF;W6QbPAE#&?A zMbsq$a5J_oX0q`mL(!ry6o>=${>M-kSMu)$ML?Gzxq>6Z{Z91#ru}d}PTvsciqDgU zUC+hzI@^4BtpEJt@kSH(^_VjAyrl26fqU^|=+V6QLEB3CbcGqum$tJybh5fn|J%ZE z4&M-;VD)QOIz^glimYDxd{ZX>?#<`3gbdR;!tA8|56RFv`Y9FsL@Y;xZUH?jMnF`w zt@ljLK;9|?Dtp=5*IVWgiDt3zewcN1?OB}9w~kNFunBVQpG3_HfJt%6wKoPZ`1kq| z`AVFQ#eKCz!XG{R=yxRMJ{%y}U!r$Xo=porV@rR z*}E*mc^o4m>k_e>t*_=J@XOm_%~T>a0xB{jI4=mmiRu{%S&QET&VK?(DQ$j=i9g`> z;0P=-84QriTpEJ80V94k%5R+XPc(M}@g#I(Ha+DMl?pJ{G6MVVJ;b2PNPtGmCj_@b zEl9T^3)A*TMS3JJAPO@Dq&$IoR zi6X|PnPUx6MN9SF=}I-=njOgsvy?n+l)1B3n(#dO)+E_eUL+}s$9f%nYTmWMy9dcj z4~xB#8%EyRwm^z)6%hK*vVF+O0C_H@=a$r-2T^lvY9uR<{9vccPx#R;o392O^^_i6 z{PqMebEE(oj%gvmPh*Pzg=&WSj1B_g!F}H)@dAD3g-=f-Jbsz7+%Gf(_`gpSyY*hy zFuO#>0{T4knP26NizN=7zXBU|TXu|XBuiCZ{^V;;#oRYG*jLi|3m63iIB)s+>}qx; z#&e6HQ;eo8S8n{jFwAe(K($2J6Qx?h{v?M&F9PU!v=#wCH;9Hh-bP&aAaVAudSME$z2?HFgR#bP-5TgySa zp25fcwRXgx$1(dQ3BOz&%f;0H+OS21e4%j(goBduatikDHmFzt59ZI~#X5o0)7_xM zl|WZVo)H}JjP<$}b7Sv?ZScgn0H?Y*n0NumZiY0)D=Zk*&1& z8w@G^wg>X1XC~HAd!n4kweHu>8DPxFxf~#1>@(Wx6T>W048A&iKX;ze&=TBzr{UOPI8j&#D&++M>bF^2qV6dSz6=VmYW!E7`J798A_PKvE4mdJ&43wgTpf z098#OQOK{p)*M^Wap&cFuOXYhddU{lOp$0$&mTD^)>%MPNu7Ex<{Dpe zPGz!*Enl@&y07Z{uzAM+c#6G{zYiD?$_0k%>7poLJRGyuDQ$mHC?1yJ{__z4EE@Uh zoNZWbTCY9jWcR@vag{^l<|N7rA)S*JW0@v>vt5Mnjd9~njRC6FO2?V0_7+gY#x$8!fmzvfhCqiACP%x5e9U-WCD3vo6;VwP|xnc|x!)9sUbC zG9~sGO&jtTNEkAD*=)&^L_VEw*k9)2BTJ&Fdb+{Mr@t*PUrESY@pv2D(Hg|Yh|cnb z3ZbcltlzI-TUWLFt2T1*f%UyZdm;Ca=qXVsTu<1X3c&>=3h*{0!1slOwEfYT8|M=~ zxcSM{NSd%0E$Fm?IL}_V=nghj&H@90fCY7cJytG{M;t={_j`)XT9Zos4q#l^0ps*#1PC(RzQ8?3fp%O-gB*lMK=tBdBKT(r90R; zT*Wx%lDB{R?{xpqo28HXvZN1D=5$)n(>r?R&h(2%V{KdjaB^R3+qJ97bJD(I>kg5= zucWGS?QKEyapcg+ftvKgjYJ?VfQBh?sS6u`F{fMu3=J*i4byGP z06D}sre(YljcySjdd`(g8O z#xWJ`3D3-~a`;aN4>7YhKWZt+!APAbD_GyoBQN2}Ik>RE>a9v#-iC6-7)oS#%liQ)F z@hCBv;|D@d*&#KZGU)xg`q*f!7D-FN*yLF>7E7zl#5+C1=0qOOXPHH{n%U2-$x$Cl zg>awcYRjdLgp$%IOm?rqUwKy768Pd;2)V-EvWky z-@(}rq%2dEGhR+*5$x?VI>hpf50_AP9`*$DCZtf}7F^lm&eL1X@?t`itcSY=SbXhe zoy=S<>l0irTKeZrgG2VL-hML*3BzZ&!}VDf1M}^`o&T(Un$JZ@b3)z--JHwU0yUu* zU_~0Wt=^hhU=v8{zG}0Zm3bpS+=KLV@{h}M$q!EY|MBP!FIB!B-=i4!*FepqTYX1WEc+KAm zii6?d|1?;9Ioh!oqHZtuTFQ(rx%L~nU-1$x(cKQr^+nI@xz!=?rj)t%5~56!MR3vh z&QezNe>4y2U!<`x$d{0me;nG9ye4mok&Cifk}PB$1qtQ4ZrItXg~X|y8e*S6wgYS1 z?fxHY^O?p-lCVyPpwbo9KQ5$~i(v^pRsfce`&Fx&#A+Mq(n z{NeMwU#K$A?X;e!?J3A3%>FETA7oxUYQUoaG7_WCzdGedtr#%_p6pO%<-@Q?;i>`G zyOwl&C#ubr>!nbkAvXbzxCYO-y4$3*XygPW?U~oh&F+La{~RD+#1K=?ELW7*+Jja& z;5Q1qWOFl1 zQ+p>!S&wzBxVk4cDhpE<*Wu6Z(YhX%zbg@%?RP1d?q0+NFch-=VUD9@ zg_E`xoGA8`G4g@~FZt6q`Q^%$iw|z$;a25tZE=Zsu=}eO8v^k&AD_op_HA3Q&T%ec z#ECSN^qoW>3kfY!E5x*^bQL(wi;FK-?g^(2Wj;Sznlx6Un>d4@=FCW$Q{747&mGKg z)bZ>!>hV8{j`6L;lyZIk;eG{8nCz=mczj+Z_==T{b2hnymq|#(H7$M-K2;|$~tjd@SYm-2DrdNPF=$3L~q*)Jkpb_2WrQ7 z`D(aSh)K&6YMtr||2p2Td|h!{vpuh7(a{Y$Tq6Wo$qJ`Thd$h49q&$;R#byxlkwbH z`{R0Wq~m<5Rpo>iYoIFR2WUMCsZSA+`&;d=PF$xw#FG&IxoY9<*$Pp`J^0kB4fna;C7y%6t=b9(nue6;CWO=fKy3J5fwBIvH*T&h_VtB*{ zlEY>4d8M(PJuRzQ2c}>muMry4+Kt}`1q$8>qVbLLMj@-?s_NJwX=He8m{R_)+VvQ(wnv+WT&l$0_KL|&AA88qL z(Y-dap)eyr$kN{@7CK@4smX&_*HVVeK&E@`*2Q61UMPDk|CpM%h#TnZCZsn@h@nrXIDz4K`1$J3bS zyUBVEHZv>M?=~smtF1{lDMXJx(XQ_^=oWI5zn=PL&FLEF11>TRLK+)#tHKxo1wE%E z)W=8=qI7glay)Ou-~^i(1q}o^d%KZ;=%WF^E{|&llXCX>%IsmsKOG*yV{P#tF~A^R zyw&>+(^HP$>b|r^2l)NtIj&~&PF`7m#GIIhdX;$REz0(J8?>Wh4YO)sg#D-vHE~)c zT~tNxO8d(sMC_>n)3CXhB;%CTs;2EjBRXF)@Hgx3wPhJJaHu|>LwTmGiR!7f+kDmj zKLF8jtQ85u$ds}2)KhJoQW`|(iU1&?fePiK;iCYx?^i|Rd@bP)#5t7WfuVc>Ybz*G z#W*lI5(mi03@#QIis|KDCo?RaNfb~*=+8}*`_z^uu8^O&g0F2Xt?fIhV^V(TSY@8w z7kn{YJ_U&*SzQXvuu*UUX&LVZY0Pu9#&_($R_V}GvGGv4jkxA%ot;ezSN|&h=0MQyKy=d>hX+p-EiHv@-AWo%D6YS7FL$V)|!Tm8c5&ohpSEf}@kL^#dQW>x4BJUt%MJW@ z2r~4h2NZ97ea2WGeCmQSWjIMrx4Ww@%qWd>9Pkkg3$@t9n$`N@}md|?g{ZWZd~ zQjsQXUh(_!Bs&*Fo7>};vOy`s%jLf!bk0J350iJm^&vE@%4{R0HrnfI=i1^DK~k1^ zW(3>?H3${gMF>EsnD)n|$B%3??Pm7s2b4MfG!5gFess~1Q#vMZoOgg`t$Af-UW}|v z(x0^LDZF@c&T8Pp8r98?U_6yDDH`6qEk4SK1ka%U$&-fg&tZeO?XamOk1Dfd!+{N=7IZOU%&4NNsJPz8`YH`>3!ql&wbsd$v0b*rPjLlV!o zfV~OVwOgkRcV>S_07TwUO>-CcP2|&V+_>hs=m7L~y~c4LW|q1N=ms?e>9(zompKJF z%?E#f)c^fN3^b*Zb2sZ3uO=k^#$lR`Q8O{OJvcXpfwZRN(cJ=yf#nt`Ji&X@oE(S3 zo>xX9sMwPv%D}wEvi=!t<79aJQoz9Hs5b}g=nipEiD;F}UvM51HCY^H?`VyiimIh6 zdl%Wa6z05Db#hK}>+VJ|DTfNzh*9C1-KU9hPjYD<>IU_%=w@NU4)n(UdSnKH%I&I8 z1JzHyHlT8h(QqhdbnnW_6!N8~;~;G zE}!@F<&7R1Eg9OTn}&q0LeZkAI=g*`+>Z6?%7+X*QKenCfIcQ7irA(zGWJg&osYhz zJ3MNHKIVlr*w3!cS4MX=cS*3EiO4>wu$>fATc!}&Z=LeD>X*oL0b%{gI0)-eOS41g zlaKk$4OO4@{J@)97M{|ymIsB-Y)FwApgE+(cJ@91bQPSKHbr#u#@R6&5`~S$mr(z> zR%ef_JOB^Egrd&6Z6&14FV{v@?hB&jx{<6fPicIxDN&>LJ#5k-(6xHFqEQXjZa-TS z2I&rSVMbaBQ9RtnQmFI?KvR$g*!KO_)GzHvj0$GoTR0(Q`hU6GgX>76P&X9-FXZ}vK80XUy2S3K0=iOQc2|1;O>9nug-ae@lV z9|joZ^5vtp1bc%iE1{Fiu!n$!b7f_~d@Yc*QZ!EMlus)Ld;>vrl+cXpe5>b)AF2^E zd-r0Mc-N!u8D#*sSdL@}{hZRy6Cua(=%Uj6Tiw%_6Uj9ToSUpWcrr#rr{>rV4<;2* zPB#VRbb)vL*pvD`>e0a30I`_uuCq z9*5)1Tyw3pu5+F1Jb!WWi!(UL*9taAE%#Q!@CR#CO9X}_u*-eDaFdVaW>HL=C-1-; zZyVCb^{&Z8aC%fD`T0cb$kkk?^y7hcPw9(Nc*!hv(8dH%twGgGj*9ahU?iYL7Og`h z$!!9`*|M>_GVY$un554$%4G-p`V{HqMr0x${_+nY636VUy&f88e?)uf@jQSsJT8&P zCX?=l!OTZ=9pIDsv}c~^-gybx371joR4a2x;QOfET^+Q~$~K|u-5|LunJ&-H)?h!- z;hNKwiLZ*4p5RQ+nS#@FQsH21`hmqdI8xuk*}2=&;PFTxW3_gf-y963<1!DVO!OQt zsiQOxwL5@>6QB&{D9MVdVTE=HbtV3+DD^;VY_)#d;V6nBnUBf8TYtF1RJT=HV^-9_ zsV!`xie+Fl|L+#lGQHk;C&WN(hT3NIBmcmxkDa3bOl0zPHNG^-gT=leUMma#8H0(^ zxRw%m0d(iKbnvXK#rRx+(r?;oTE9+EIUN#_N>#!A*3_H+=8iWk@bU-5(0X5qz}Flb z;mxCzdDhYofbJg9KOX5Y6(bC~9MTJdIaqGf=u#xFIttHI|JbUJ9N7i^E)N7aIO%~{ zqk%jawMQN}@ssGMn(@d`IsPERyj*inj2xO?Khk~#FL6vrr|o;bJt~)iSvY0i=|f%ieeEg(lstVOEhjGX$MIkp0G+!N)+yHO1uF;t>Ui$ zRs2itV}9udZk2LSclL!1fz;Gvwsro*)$aSfgwZm3I0C3xp6D|5u9%?`+<5y8t$xX| z0md&WnJwQtetSlhk7+N+41_68q+K^l=^HX4na_W7S0-xqa$70Q0`)nGz&x9ojnTA> zx$mHJuvC@NuOr>i@x8q45N{+yf1(wD)}^x4cEORs&EWNl7@e7YJA{v?=t-?sxM1E!_b^gUot^mdUo*tP-WPiv;Xy!=l<`+lWerzR zGI*OqU3h`7vYospe~)iqLy0HFudHCeFRMM@ewr#II7ufLnil0k`Ze zcX~r1bdqA-%f;spWKZQqqT{x*?!3h%Y{E2oI+nQo+X5LLaJJK2(!@=b3c*YiSG8SX@A4HBJf zGjW$xIz1fHWgyoR?G5{Na9#tL5p=)%5`|c8msn!7x_&M`25{dpcihsPiadKRa6asi znxbPgEUH64Qqvp-lJ-4X$g!VIai~HHe>Mh(&!j8ym4uV5aRxJ%Ck1`jzn@4>IQ(?W z(VM-t<;O%jNK6a3=ZCOXU38bl@#W`A(tO0D(#piuAD$Co-5>+nDDZ9)T(Tknz4f`Y zM0;oYnnWw-9pOFGxL>D~3Qh11;!$=q5@=tF)+oTo6!1pncu(!nnQ-c?YsS9Deo(H-YZbf_Ya!x5 zbzJ7cK82t&k>+g89Q0PRxjvBgQ*m~hc8INQ#_er5ogpfmu_K|%S(3E@4q);kM9IW~ zW>V7&^?p>EO{9znFmPHI+ZgL>OcE)~vnIz@8dUYePlNTXVe;dvB9WzFE!yBGFaPK_ z&~AfZ{<1B?Pn`Yw>fGG%eC&}tCD3fd54?oBg0&doDv@F~a@4^dKq{IpTFeWCTmaa*S3YOzZ1X3aW>4 zrBG_hyTl|IO}AZ^yDr1_(d-zPrI0jibvAupdRV?ktAFO=nJEExD16yAeL2~70uUR_ z0VV87ojXX5?-3cOzTZh$EAP4gQV8HwBM#lLXL$CAxzF4KS(UxhB^lSDT*g@x z$bA=n*aSvwI(5PJk#Ddd4515>}9dPL#5IV^Sap)yC#2I58gr!~p4I*UtD)$u9;Ow`ld zB=mW4$J`D{p(CCg%ju#0*Nc6ufPVIpb^WTYEQi?g)G1PaIgDc+&d2~`!d&|6y;bR*3{h8_vf=Uo}_l`h!)uaGf^>3qcbQ({ADsgqFh3w`d{{`4Gv4oM^gLhGu z>xlK@nhI4dKo|m##6=XYu=ScCGl}vdsP+9b=%(XD?FQ#+LE^6@+Z{4LQB8$9nmKjQ zZ!{6$h)4O~b{oUyz*$6mHl=kk*8--s7I0XP;{!@?WhXR^yJ7Df(mi%Af?@K@&LAHH zMXwUNBzpj%UKudG3L!cT<0YZsez(7}V^A_SXjP^QW`62HR=RnDvF4;r;kVG047X=I zonbobVb+9Fe;-pV zJEZ~8KGEZepQqPPlC4`%89m-=(!-ZB{D#cDq>F5LB~F77&eLEPPX$y#SxOZ2NT}|* zap7==U*P339N`|)GMS^$4L#tJx~j0S-v!L%Cz;M18@ z4(|DKG6Z5%M5e4U@ky^ zGw@kRPvs}5z}_1IaKmdEyS%Ex9|eBJwvYY9dXa16%Ji^KhdiY49lU9s(5aIoy?V>! zS|#ECr|9z^FS>-DTXYBv97Y_6pesHqp6cDkvM)Ug;n5OHwXb?mEXs9@LrK*rgf8`p>YjI8%i zCar7MZyjILUZY}nW|0MbBp=D%mO8aWYL7+R$_$fCxy^+jJw6T1e?wc^Dj`KEv z&QCn9#|hdT-OaB%M(f|LlW?MWBUEPFzieMGAH7yEBz@Q9eO8(?<;IpX6_-}WCR!5) z=>93j%I8&KSBqN7-0__u#)CC{piKZOu2TtYqUQn*RU=phdm=4b;e5YU)O42fl?B#K zD-%t5t?(X(=G?)R?8x8f4G4b!Ls|edx_}x0^-iyT`grUx-X*KZ1+w-a2%FlMC1>zNeD?Np`?UxO760PEsSwS1N@3jzVkL7Lo_YHb zRh7CL>VABNsaRNQ|Fmp*%i|oJUJ7=GJ${j_BX+IO&9P&#)ouO)h6K=&Fs1qjp=X!_ zRF<;y3b|%lo4Ge>Ixv^;5fL}YhPt- zT-6~KL?~4^U&CDk$2@~^p&LKmm)r(H-Ygu)%(Z3;`j?a@qPgoem4RTOuD6VZlt)!A zYmP^>k{ojB1iE7uc^w7%UHBB}yJ+EnE|h-&pc*eh|3Oz~&YJz;vEM=_xpU5rE}jP` zrS1hQRf^}G5FnH0ek*}x*>ocVw@1iRi8Uyxj#?73X;ujhGYKl6C!FFe z6t@?sWd6(vjZZd9F!941s2J7FE6h9b8TP)zzI^DiA*oAVt53@MW&~vQ8pP6x+{rW=JE_ghvNrI*7C37tZ3Z>`NjG3Dy9$4iR!$;baV)XUld;C8k zHr*Vf+;@m7Mwr8vYuce>vTBSxz#^4nofw1e#ivD&(x-+OwdlIO4`6X!skn69%k?=q zI6=P`vT;@XT6b{}g@F^mZkKVSF((uBHy=sJiXQ(V(98KeRJ7t~ma}@2LGEl!g&~P@ zp7BRPnj|Gn+~HrNLUj1WKEUj`lVkD(dw#>butY$ycGuT-Q zhsScZ+yn!g3hR1>n6JB+MHqzY>*`p#X>S-jDNsI7S7i4EzF2OUI;=0FCbdd)sGDJ zq?Q!W4+j?SG~M2~?5Yqozv|`PWH3%r9DS2x|3kHjs+u_Y4Ht+s_h3W+1p_LZ!Ol@3 znNCj1Q#HT`u5jXei#p2SdTINwWhS%{Q^}3*awgZmeFJ!H2W1tLE z5;q1GJ;^^$logLNUTm8b1?Vggp3tF67lL`P5T1# z-VGP--dB*?fy3KpqeVq75{6vLKv<~s>gn5HIJ&99Kk=tq8lB*$pl_#&7QS!t?V?M>N*%# zVEhZ_KUyod0O7xlLcI5%)2dUCTMuC>=IDL?>a|YbqQyA=v5hEq zGsg%bnVy#DbI89~kpuP@sp-;*U|;(fAUCxNrZ`L%W}W5EOQKx4hr6U&I3zkQJyUKD z8vIUOL~(2N@<{*vVt#*AQq;@=S#$T&*e!YVqd(P)&{t%#u4%aq%osM6k7s)xO{ z?s=SK6iM%aEkqrNlx?;(?giVvGHC$ySVCjV-?cAlb-t#hGys#^t=u_~fON|$p56hm{cQQZyuvE5VF){$5 zIp>#OIp#Ax#2Vm%qlEOBVw;Q-6+#|`!aneJD~>Q$O$`+P>PK1q43OJqMD{bB7@-;P zZQHpLAz5cGpX=Gp?%r0=j9VoF0CaPL^kvNC#OU}pJb}4CS`JTO1T73b&`U$mfaTP~ zMz31l;Y18BslldYYm7=6MkihoYyJi2{=)*L)Z&iAdY|%fAQ4BzWho~aqCr)=k((E9 zo50ffGq;|Gn|L?6cXZRV;u)_M5iVTMWsef+59+(Y^yiSHRE`2g(L?>5 zQv9O9^tODg`Ey^O=x0D|Jci87J6`LMSGI*@&)Xxekhk6EGKtR}V@camNTs6pf5aN2 z69cOXKH%De$~~G0;hLRYs=BclR;uV;52(_>^SCuwO~~J`m+hTYfBx-cV1*Lu7XH{M z7R@`+0Zx%t%S(iP;3zRJb& zEgxY;oyNcS)#Goco<4nKwZ0_6AYu@gkT59`JnGgN1_E6S;G2bY;yKoVe486J<;Q;D zLu6{z-T9i&)?cRW2j%BERp%)zx?&i6t~b`~hs3Rn1SRb07b<#ixRC{tLMf2I8ukTi z807x~JOm|x-Sxk#iPQjd1s`&5L`Y@Ys$Z{DYo|~g%o4=uddK<_&CvVCi?mIO+?thP zFE4I*c}_SEfDd3bv0rx-c+^52B8WF5xHQ~mKA?KlyLY}&82La6y$s*9zXU^_gJQ)p zqmeF(3)(gu0s`B?3fX=0*~6$joB3tQpK4_$io|;d)5pPkA6L_cR?5}dONv!f46_0HCm4WV2rMO3N ztzyfi|9XM$@!Dk*=Cyjcc#C&7F=BI0#v9YHVjGn847zXs>r3JFSnJvp?K#+aN#tl0BS9%zWev z4)9r~9J%2&C#k?Cjq3R0_*cmnL=afYGml&Te8;EXGJ({3mI^u4skxK;m35((tyV4= zDVw}m=#=>!O2%QOV0IKZYPt&EkurhRO?0bc>tKBuX8JDyKZH!+ZqMLg8mO={9s`v5JR~rsU2sFcE1e) z4oS-u^BSRPyWn)-H7d#%QS06?43Px)sl&W_1)QYE>DE(G*LAEDit($0(%K3`YH_OW zn>n}=f+SrSKFs}gK=2o6NwVfl)qx|>t)UYSWd__0W6j?D5dfk;t0S&a=1jU&b#&g& zWB-adKnZF(lSas{5#YB!%GJJd2@XcaTKai=6`VY`J=+Bk*zr7)v2QV%^2ROzysuq`DOWuf49&D$e=XFYsioHHE0dcykI)T?H`4CbpC2MtI@$aR#iBdS_whA=t)|9N=Zs zUeWZxzR=2u`|YxzUcy|G1Sy&kN1~uJV4;kv9Be@YNa<=&SlcchZIG#(KiixLJ*R>q(y!=F6TUQMBwh?yU<2dW8gpUL|9#2_*uowyizz!`$KG_0)w?*UId` zRLC5bLF2C1+aZiBD$Dt{$vlPl`1lF<4$b$cASf%TQW?lz$j)8Ho)vhyaR6kG0dT0| zM4)Jp$3&bAvPr<4HYMU4MrEQK`H!+__G0v}S9D7cyedCzOD|2W)mPj-#wRZ9wN_2Q zOgchX@>Nvlbu5yo;XPXmM-%f3&=WLN1mus&cSUaB9Lq!GGM{up57bOp#4aioq^|P8 z|Nk5K4OAbM&qX+sZoeamQoA1m1lOp(+5jXgoo1@@dYBwV@I?yj(yt{Gh$l?o`csKz zQLQUi#w8_rMB>+UCd76vAN)rt^D{Wzh(!nTAD|j9=4-ds!5PWv8t{jL?7qVtkP%A; zOvgs0MvePc+}Ssr6hgni$vUHj6CD8UZ6}W!+o_z;J!RcCAzJV1iIG0$1bi;Wymd2%E!bEiy$H7`RJlJsO$3rWnRcsY#b)c_gIFzJVb(_JYiibr zyd=H_m`S0~l;*Fswl(#)U|ey}`6bfL)PY@*6rpapZ6JQwb@xVtpiht1eTTtrvF~=A z18ZVZd=1ZQo7SY{F(Mp!VG&uhdg)R%YVoCtPeL3iU93a}-9NsilslIoBnd)$F8JIh zKo&gXA#rbaEK&8yCwKdnUV_qiQDnJkzWq?P(fW~+Lge0d^+QpBxi<`#o}%OUSd>2I z@yNGPHcEtgM~ZLyd3=!)GOjEF{adlUD!142|$t4-VW zhY6%b{ofVcux}rN5sL@9UE`TbeEPrkJvljf`K2l=NUqF$CheRS&p@sM<^0d_6)J9M`dfjs~k6eR=}_tr&t z&{%QbkK!zptA<*%2nT}YAwbMv!h(274zaJ7;0TV!!eDq?g2O@lt8+B6lHgz9_NRB? z_NUCBHA)PQl_mUbi-yi}17p$HJzv@gbwFW);W7mtUnCY)H<>%zAi00>zTUOr`!expBHsy9>T_*IHa#uX=cC* z7X@A_2w(9p9F!JK-u7y60-ujV+~ZMrz|cv@Yel1G#}6{Ye1PfCj?RgOMDf!290^L- zvHIZL!qgr;wTva{wiGGvC*udexJXv%<#u=Tm5dETmp)T?m-ZV@MDU5;pZhvbbu#>1 z1cksJdvXg3u(V4Y^!S^QuMs<)bRM!}cm~*oO6U}qUm%jokaBl~g{URF)N^{E_6N}Y zpM04K<(GAVz6)#IOf&)EWEvbDp6$d~C-o6I4L>2hS$&~xJU}!aiAdsPyJKI_GNUKc z&gn~_3h}}7l894`C#yH&RJDY>Bp?`|9_9VV%~6|Xk;e9-p|Ov#)CzfC+d~lV(|Xe~ z7Lp$Kd2Cj8|05Kc(oK5&HYE3c(+2|;s>=Nj3Ri@Lv|{1Som^!(SMxxSG+dajq#I&T zq$4#mCfG{Ll;SIzHUB0lG_5v|7OUu5J?&z`UHQT&2A92yUKS=3P7XLIap>N8}3^NFf8a7Rr_)#YAYj$ zFA_X~n^%h`-<-=fT2;HZpW=UdJtjd)Oea_T(^Kk~qqe|?_f;hTxthCP8G*iy2s&>> z$0(5vJyPYeT>+Zd2cTBox%y=3aET=?0yhDT=tnl6*T*F>i`=I8m zr68!qh9bQ@8z&vcV^zUo=x>W0uR;dIEXx7ZfgT~WjP=)fkl{T$j+q@EIL3q)2wyaY z`NAFhq|M8s#x}XBn{2Ll=o(%R7+lgRbw7C@Ala1OjCmv-FshGoGR&$NQ^xO$RWw;( z!^=4q86Cig85EF>M-yx0>c7JrR;FF0+Sk6$xb1R7{p#~r3mf$ga+(`!7wn|veGK&t9kvkG&d~DT^K1ee&o2Mo`u+Z= zjJ3(FmL8#(t!6Qg2=&${&}$-}AptL!$pKUD3Xi_YxxMyWQCR$zGXk+%j;mq#quOuZ{=2Jk%}< z@MM}Ci`;wWjUGjM#z!9~MMR{N5$yn;8fyP$t&-`hz*mml18K0!Vw*ze4m}P>8F3qyZq-ZEsYnHrO1zadS;h~$y+{< zE3rk`W{mq_&Y}1}i5}7KLZbLjj553_4ar91XZqIM)+Mg~?7(lYdC;C4TO=T;m6I>9 z0rGhnA6N>=jID2pCY$hIkRI^>z1w)&OBEgxlKEWJif5L&gC+Zo=34@#4HSI*Cto5` zul(qpbT7jWF<@6tG0bFc+SLdYP%}VIi6p;dGOgde*#A8zqnt2qw|EVpb`fJRwRiQ* zHW@Dd?+detL;vGuzHX86B4_+6k{ep!^@>t^iovi{wlXS@u)xj;ubY1h)co@!gTp60 zg32+*`!^ZKnivv+(5G~zs@rhs)h8fuI~jgCaQiS=lhSztYY7H9v^fZ<)F-uAeNAJ_ z?T-0nz5Qgv`O)kqGwNCC>rH=d+Jiib(WwhKAh5Q}(kSX%uXo27#9^!iLMj7|vOxcB zS{j=#{OP#Yi^c2sR}B<_gIK2VSpY%^@;NRrtn>K0{$c4-%RmB>^3Ry)ze7;SC)U1s zGnUH3Fi5^3pCcuW&0}7Y?SmyY;&5_Elolt-eb)ABOK0w?Fr>UbJqauHD#@7xu_*%z zgh)1;9a;ErQ zY6{^u=6P~ZQUAprzNYp4csZ1H*2oEO=nu5X7=pTt=0~CXp5Jf=+Kdhjo05rkcgqKr zCOghNAzKTh#Rny7B>$R<+;n-7Kl;t%=d#+vKd5-0m-Ks!+bb$@pxj?kFSM15N5Xm6 z$qKd~mib8Uwi3d87PuNJh$J44+)m^z&Y#Mcu0xitfkUj^fa?Oq0BE~W{CzKLY+Hg7 zopSX9uL_$Ys^dF2D>(`m?4vF0^5gAF1^}K}ZX))6$0<(S+gpA>-BdfdBn4P)doJni z*Vr+vGsq}ZO-S_QVJj70zUwvnp1cB$bxYTbZI_@aq+oOz^{$N+cxv9o#N70dwDUY# z0sN<8T>+a{?+-@!i5^c9suASh+j?TkB6jfI8~v?A0(>8M_wAWXx>-B)5V=Et@d5gm zIUc6J1^RN34~*WN3jyA%&=IKKHqAH&mCN{s-%#&!BoFCI3OD)O05WB1Q`}kYMOv<> zLQ7%&JH4gnz+A&K??WVdxWb{Dd^Sy?0|e&lK@eVlYBW$Y3A9CFK*LQc7HIE^^Rkl4@YAI~%72!~g(c+@#*QoeS79@~8SS2<)h&&4-CW@iJM6Ie zsCpnH)>g^NJ-#v5@0}xd^9nVn&QOe$QX47?s_ZunBK?Yo|j z0Q%pTum^f>;41$XWXlRIjslVg8{h@o*Vd!KtNq#)hk2#KQ0nco=zf$`!N9k7bytz6JH>N z?ZvFaL2y9s@}|8#;ujoj`d?shRmqabS~?U3*c4D9Y4;Fj!y@E3zljfupbv=@=(qKg zyi9Qttu%yKKWmX$CixWG0tu{P&JYZ0+zk`tI9H1@IB=NRC#)BM`it!^_Oi^_E&2EW z0Ao7gZ(Xntv0(*$(8gx&t6E`A8WAb4$TPws<09lFR|}tE9s^nAQf4Z{@N8pbB=8E` z8s~v84#c^B)g@)mV+s zwmDunX#VrvS$Ayvzx+dRdg0}B{$97j-OChg4_SK~t)wsuTi#9^&lf3Gz)3rf_>?V8 z%@Ph}ngHi$5p%+AhVlNkUzIkCwl@wk|I>Gtu>kwRrjA3$s9q-^ z+T3t%=zX<}+}`b|sV@T>1KjHXwVjs*T2`&%=}9zv6F^(ZQoE-KBK^S>_$iKTsj?xKE;cE5~YoEWS7sq`B@c&aQu%Fl``8FvX)&E*jSGX%kDuAAY zl)(RsAI%Ln`P}2*{XvcbIrg~KIym>qEOIwb8&v9iWR=QvaT5mJid+j()3*8j{>UEm z*r+r5dm>3J-~}zFRlO{zN-2-H@7ZEY9~C*NOv_{O>Al-Fo*$$V*=ocq^{GUd!ct_P zcI_zdl$$U`OyGK64CwXqwV(spc39tg*?23UbU0%_O`VkyUT%xMhD0*QMKc zSo=ri;(m+KH@9{H&yQ9BH6 zfC`!hLx^Kce`w6tSkCdEf6q11qBg&p5V}$pRif?KYf?sm;9o!seDy{sdGI*D@U9QUWRki0&$mmrSzdciN*j~S zwh1x?>=;`Qcjymjhe|G@as0q&w>l}=3@+y36x_CE7wRnE3@r8_^<_tJU&U^2WQZG! z#bW(FH{mpnn5$VH(VY(5!`578w16ZEAIj$-+?s=ucc72s!qv5^k`@Nn_EE_L2qLJ) zk6%OGVp2EhJeWDmNpM&L=U#Q9S5l;EN1Nl${2=$jmUHa;UI-UPrRx}k(@hTn7_X;n z7ne1AW`-WCvPmSlGZix%@{uhjg8p;5ds$I~1a;?Yi-}3x$ssxl zYC3-eGkcUc-bji>e%gHoVvmUHcV!6AatClMAq#CqA_)rwdcfRBjb7<%M^r!Hvwdo3#=lP4NlL;t$ArDJW^dO-1ZwpiR_9uj%}rvk|#FCHJ4hTShNvO%Q% z?MOOtT>k2~w1gz&q_Vj@Azv))N#n+*`rv1FaMu6j@ZSZ~Tb;+d52R-)#_o+vM)A?_Z3w3*50v!7=PX z{^3!a(omFyvE@O*OCep>eEJn!o5G_7(3r_c5S#tQoXaY@`b~gpVaeL1HMeI0pv^*m z1I&Uchdpnk>R-=xhGnLj8X_U6m?Yf+888Qo^R=ohk!MeZ=xWDoS!$o|+8sC0=J@gAiByK?7p zTtK*hCjG~62FVI)kq!J}y)STsBoT$@T+0rMOX_|5TvohXbMHz?)6<2LPOR{E-rS%Gz{#jw!#7vE0$romh6AN)@rM7swD zFpC_8fA*BDrdu;9^x*t4s@|@})ER9z_+qH?UndcTzs3*^g*EINyt@b3WNlMFw1< zoy(iwu4c!}*q#xzV1(D%*BAgga-xKnPiF(`-KR`=Ae+bn(+DhmqgqF~FG~%9o>aTO zs8*bu37rM&!2QqUQebDv`FUD|^2pB#ZfzcJd5RrV-s}(15;<#I41(wIuk3Nk zhz!10f!hh_qE)m6!b})I-qIRqiZ+!2>*zuF+)uwwPckg`$pHE!@T+J3>+02Ag7A-E zi6CLd%Kx~73Sx=`$fqY!^NqoCi?r3=SiSV;kIOtrptgB!ttXGR))>;E6#2lojZ z8Z!g6q%IBs%$m%I`q$uFi1Kfn!}D9FY2YSAv0aV~cU7YW8T4x{poj!DHZ6}bS3{l* z0$nS>-zNZv;a*VQoa#>nOsZP5z)D%V3>C`5dd28+dBTp#7nYd75^&t!b^Z!9DO5gH z$07=x)}wB=FwW~;sFV04(ordN#Ok($nSpE$f%NJjfPH=}iCXO(yHzXy2HyrkCHOiV z?Tg{wR(Ens1kU``a4DvEq+*{>ZNZk}gE?S2Ve|y_-OA-TlbWpAIZklR7n$fvB4)!&Zj0uF(b(WI za~cAc6(8@IE}TG(Q>O4?;Czq+pAx643n(V=pgWTEJFY`P-eu2Ao31+pDF-K{?fa|2 zcDv88Z^N+1zIcPrMFHnDHQJ;)9Zq_Tw!5+rrPhz!}T zFIDrO$6=+v-r}Z0IQY)Zorh*ULLU6gTPlbY)=rG@-9y`fg?#$k7Z1!foA3{+l<|v1 z1i@5{JL-;;Vo8>np@oitD-YX^tIz{h*tS1ABW(CwOuAtCTTm&(OzMP>ix0;g$`&c2 zO+&3>twPO;H;rQbJ+yD}h@c6atVZ7*f6^_a&r<0hh@8Cg)9f+uTNgAHA;SbEBidQ zt17T?NMGxYF()r-zF=xVCsfdEM6cHP9=RmR3m;3P?9N6%Uzf(-8a<&_jA-hnBmfx(LW!7i=Jl#LJalBT9962i$7wM25P@<*5IK{ex zlYMkZ7q+jlI4>7)R?S`umZj(*z1F?NpZ;Q6_E1`%2q{LjN}lt21rKP<)JaGj&~tnQ zlF=vkrwj@}BOtc;ts6PqJ*(aM+J{xQi5eUkpI837`2^I`1@_W|gU@$~fPG(nzqN>` z@RI4>VnWB=piXBWXvQE60X7%UX+f8FIW56R-==EKfWWt2GKyYmY9Caw808d}M?bP7 zk(p%#cd?IE{1r;Z$9gChrCPG?o3`=1PZZ)rnS>DVh0!;4nZ8f7_%S0`crkuCF=;af z)64b*3+iwJQsdWYGd!tZ#SF;TI!)D%C7U0LHxai=&9%4R?p}S`Bvz{I@L^wiHFmB8 z3;J9t$A>Q$SNNWe2f6H4WHw=~X5u?5TK4;LrfIQ-S{nGeNwJ@7MI;`0kJKq=@9MDYZu_ z6>|Ie13H%08EPP`i?WHGm9?=-f|-c)=5{;DEtp#6SsPvCS@4sm%`{y-Zyg+tiz$_S z+Rk2MhlFR7lhgj(adg>$vCU4Qw0`yUC-t~#4 zJzqd#5urwDHxtn7=J~xnS(R%haw^Ald>t8;bJ^(Nc#>$RpmuETS}`_!z3s^SR2IIH z2W8`;7}7(1EM7V|lvP`95~9-HOof(pP3*Tt?ZMvd`M(>ezQjO%UWhlIsu+08)49p6b8FXzcwHy1&!YB z#girdMpMNyvTYSuom=sGxS=jEw~xP&X&Mn4R+pTBSY~6iS?9(!CE(5KQEf)J(8Vh|xIF7AQCtqxOd5mWkfypX9RDo>N{#}BOU;KIFahXw%t z6_q3{ofp^iyNS(E@>)ZcD#Q{X8(xK!3ax~YzVRZu*~r4p!qsEWdr?b+$K|q2XYuK7M6_dyQIDU{ z%uPYx4u9{v(H7}o+?v+u)$tm-$=xB@RDZ+7{^Tb=XUg$$iCYWtPHoIvQGvZt>(dX_ zZVxCtJ}G((UwiinOkCfu^T#y0w6X3%h98-yQzFg5rH0T3ht3ZB+RM zhq>tcoVEhLw@F3jP}%$%5xs&tm#N2!BoSD?s;05@ahuZsE`s4?@2PV8VjaWvFJLlPmYtj z*%ebIHx1Q+x#7B>Xfmd3D2mCr*1x!v6!P`xk$HGD)WOFH|9jU6LZj~V^{2k3j7jA8 z*Vp(emn|I;<&NwmsaN6F45jMS)C=Hzre8lUQWk=#y-Gr?XzZb*xLSC>Ka<$B z*P_fU3VkSDCrGr~PNck+Jmk`O<5Eo%jneS|%D$nKAs&6oC_$uL5*RBJe2dJr6YF_e zJL?CII=+7pDd;qQKS$<+urzIMaj-m({Ax*_s`79x%fb@dR!wDZPp<#?r9+h1brfTu z`WHk(I+>K+Q=f>5^AO4<=aQzZPx#un`l?bvJ zH66HlY{CT5G(q_@)X`HSNfmXQ2>BKkmTnr@?Yo;hPp-R0S}ML>yESuj5j-0RS|3be z^DPMDcx{r{)OhUu{pLzQh35CvKBiX~zL|ykq#oH^^0Zf7>8ww#2R>&k-;C!IQ8OQ< z(@(sEFMg7CUevicZB7fk6SyU{2pfEG@-~RD@|}71?#q$z&4N8WO|kK-XV5*3pBVdv zyOFGIPe^KEer2(5rWr;z6 ziJm@+cOc`(Gy*}@@PndcpaR9FOok5$9&UXA8u3qU25U@$M=0!l_!q5qk!!kOl3E** z5z!I6LllhP4en#xYx|h-Bzh=+jwy@GcKU`$>V@q>e9Q`?k>W1Y^Xjxy`e&{(<4O?+ z^FO=U;CNF9(~!VW?RRNO67KB~oH#&?Zm&GX{)vswZUw0!d)8bV+(cORV)On0op8QUP`${fokF zb#yXuN1fb=FYM{@fD`#nm7pc|;OmAe2n)~p==mDyqyCN0j?o_K3um3s_k0^oS_@ZZ zHVycvVL$y@?d(?hCC!(F!atc;xlTfNMAi={kIlH6_{qfJYZ=?^WUC{FDxG+X+q-Pk z;d3CY^wUpibyd=Uwva-NoP>-l{usf21}ckVL3(c)QnZeDTeaoilKM=IRx@pGSEx4{ zBr#lPzklw)(_;u0V$fKU$?J$mUzFn+pj!dxcWIZ08O3!;$q+E9_G-CHIao`z@+|l zJQn+_5!B|?od0*gW{=3NbKs@dI|bjxI-5h^_kVn;Kx9RF)!7_Mg!r%$_cLNa&%O_m z=tT??dsOR*Y1%M?)ZCsbD!FIYZ*uG(TWwkC)iJM^im=1$A2v(6HC|3+_`W|mq~_Ui zaakq!IokE{tEFkY3n$ISUOZEzsUiEK9Iwdk8OecO6)gt61(6{--_Xi}pa<3R0F-Lu zcQ3jC7Q3`Pv!BWFy{==Ufm`8d zi#@Uj4TPV+SS#9%)lm#{WUMXvvRbKHXqT`xv5r~m4-aJ0mHE&3PMH~zBC2m_OM-U) z6fN$+sCQ;xEN{jZ*15FU?DvHfwe!L2Bl7yuK1okYV+39-G-AAZxz6pN!21C8HEHl7 zIx^T{Az8NusN6eYiy@mUD-fR7pF^%GS3Bk{Mh8)0Y{s5~%tq!eoN%|OY&Y+-GGtAqN*V=jrlZ+!PPD#qj1JrP7xu#oB41Uc z*dIllO9-s1|Cui;TGj-=U}#)(LU3Sb1HP{BQ#&>_40q}l{l0%B-CkE7&^YW|mq0wq`&m?DG{B*=U(Fv+WhKOsGA{`9~t4~Hcmk zN2sigzMHCMc9h6vZZ=Y~c%{3Y#|~vN)`*R|s>=4VzTscW;wyzmx}MCRJPpxSYtYpp z_Emc{-6b_WbZqpx&?@4FtFxE>cdS4USUF|FI&O*|^73_|#a7Q{uiNRW`(b2{q5S%y z-bcs1DCg?8rs9`#Fg-G}AG)oPP^zf3i6YDb($`zlzfFhuWP=`dT(yk`3e+R(r9xGT zqk#R#^(4*CZHV@4VrCX8R36-wlpV-=VBUWO_F^-WvP7rUUgSoGiV7nXUX#C1Tyv#z zpz<#d3((H}ok-1dP4nh7$uUtUQ^k%udLBoSCwuyZ?evxV>G=e^@|mlKd_N#|)5g&U*KR=dlsj;D*OJ*D*}QSAqe=SKe`&SAv^E44-s0_shJpZ%LON9eb1TUwKeD?>n(k=t)+hjSs zQmqdh|G5}xEPVc0N&lX6gl!yC@X)IbK8fNw zZug+mRVo3$3M_v%O1rc(r9l$xFi+D-M=gbJ`R`#a2B9^~`?^}0uWKm|B&QIG9Qs?Y zf=3q9!d=KMy5at)^wgzq^lgZt;mq0(M_awfBi$So_}m?4Z|Wzs+uBn#!_)?GiH%W|@2Vbu)3DakerAu=%LUTSbe`h@XZ*h%{W4>08n@p6XzFeS-sQPig~) zhUGozxkram6mC`@LqL}94~G9@IF0CqsRfR}F5_PO>xyT(vvDk#s} zaUbcjNNGt8V~rwJgl!=x5r6adwuZysxXFYtB8-uZ8po*y>ki0=%L%2E8vDk&Z1|Ik z@~V@VA=MI$fa;G1CjVLrU;J|9WkoLVU+suLd>G-cgpYqZsU_a{f@#o48Z9~vuQB0# z!l;D5BJu%YV$(L8NF+emO%cNZ^oV@r?(vSnUqOjOH!13Ze>Kv!FwYP==%=vWU(>&P z#gOyAUu=(rAw&DE5x8(>aCmp7uegc?iYYlo!fVu^TtK@+q3HDukIJ}vnZmFWW!zjw z9lSdn3A+?Ex;VQNTp9B~uKMbr%ZtpmJX#n_U^??97*STEzSv=$3s#YMbPFSa)B+$l zC(`E2J;FAx?qMwJqRIZ6PZ?YZeC4N*Oy)dX@JCloud-BACME RocketsCloud EnvironmentPublic Registryregistry.notaryv2.ioregistry.acme-rockets.ioFactory Floor registryregistry-factory.acme-rockets.ioPublic ContentBuild EnvironmentCloud-AACME RocketsOn-prem environmentair-gapped networkStagingProdKey VaultGitDeveloperweb:a1b2IndexBuildServerweb:a1b2IndexnodeIndexdebianIndexGitKey Vault/debian/node/base-artifacts/debian/base-artifacts/node/team-a/web:a1b2GitBuildServer/team-a/web:a1b2FunctionalTestingPolicyManagerPolicyManagerKey Vault \ No newline at end of file diff --git a/sketch.md b/sketch.md index c588435a4..7d0825427 100644 --- a/sketch.md +++ b/sketch.md @@ -2,21 +2,36 @@ To enable various SMEs, project owners and customers the ability to provide feedback for the [Notary v2 e2e scenarios][nv2-scenarios], we provide the following sketch for what we intend to build. +By developing a sketch, we enable a lightweight form of discussion of ideas, enabling collaboration across the different entities. + Based on this sketch, various prototypes will be built and iterated upon, instanced in an [experimental environment](.experimental-environment.md). ## e2e Top View -![Notary v2 e2e workflow](media/notary-e2e-scenarios.png) +![Notary v2 e2e workflow](media/notary-e2e-scenarios.svg) -An outline of the e2e workflow ... > TODO: Complete description, based on the [Notary v2 e2e scenarios][nv2-scenarios] +To illustrate an e2e workflow, we provide the following example: + +- A public registry with public content (debian & node images) +- A customer (ACME Rockets) with a cloud presence and an on-prem, IoT, air-gapped environment +- Artifacts are signed, when pushed to the public registry +- Public artifacts and their signatures are copied to the private registries of ACME Rockets +- ACME Rockets will additionally certify the public content, adding a signature for the standard/approved base-artifacts +- ACME Rockets builds many apps, including a `web` image that will be built from the `/base-artifact/node` image +- As the `web` image moves from dev through production, additional signatures are added, providing proof the image was verified +- Policy management in the staging environment requires a signature from development, and an SBoM of the content in the image. +- Policy management in the production environment requires an additional signature from the staging environment. +- The web image, along with its signatures are copied to the air-gapped environment for local verification and deployment +- An additional signature is required to run in the secured IoT environments + ## Base Artifacts -To represent a set of public base artifacts, we will need to create a set of public content signed by their representative entities. +To represent a set of public base artifacts, create a set of public artifacts signed by their representative entities. - Linux base image - - Signed by a fictitious penguin that mimics an entity that would own and sign a public linux image + - Signed by a fictitious penguin that mimics an entity that would own and sign a public linux image. We'll use debian as it's the base for the node image we'll use - Include a mock SBoM to represent the content in the image - Node base image - Signed by a fictitious entity that would represent the node community @@ -27,34 +42,33 @@ To represent these base artifacts, which would be signed, we'll need to create t The creation and management of the base artifacts will duplicate much of the validation workflow for the developers app workflows As a result, we'll optimize the creation and maintenance of these artifacts. -### Base artifact keys - -For the purpose of isolation, we will create an manage separate keys for the linux and node images. -For simplicity of managing multiple key vault instances, the keys can be stored in the same key vault instance. - ### Base artifact build environment A single build environment will be created to manage the building and signing of the linux and node images. -With a focus on signing, we can optimize by simply importing a selected linux and node image. + +- For the purpose of isolation, we will create separate keys for the debian and node images. +- For simplicity of managing multiple key vault instances, the node and debian keys will be stored in the same key vault instance. +- With a focus on signing, we can optimize by simply importing a selected linux and node image. + The imported content will be: -Node image: +**node image**: -- Built FROM node +- Built `FROM docker.io/node` - tagged `node:[version]-[os]-[version]` - Signed by the fictitious node community key - Include an SBoM `node:[version]-sbom` - Have an oci-index that includes the image and it's SBoM `node:[version]` -Linux image: +**debian image**: -- Build FROM debian +- Built `FROM docker.io/debian` - tagged `debian:[version] - - Signed by the fictitious linux distro key + - Signed by the fictitious penguin distro key - Include an SBoM `debian:[version]-sbom` - - Have an oci-index that includes the image an it's SBoM `debian:[version] + - Have an oci-index that includes the image an it's SBoM `debian:[version]` -The build environment can be triggered by a git commit to the backing git repo. +The build environment will be triggered by a git commit to the backing git repo to ease rebuilding. ## ACME Rockets flow From 531a10919c4862ffe22eaf8362923a5cef31ec3b Mon Sep 17 00:00:00 2001 From: Steve Lasker Date: Wed, 24 Jun 2020 21:24:15 -0700 Subject: [PATCH 4/7] Rev of sketch, w/oci-index v3-index.config Signed-off-by: Steve Lasker --- experimental-environment.md | 2 +- mock-sbom.json | 8 +++ mock-sbom.md | 18 +++++ oci-index-v2.json | 27 +++++++ oci-index-v3-verification.json | 16 +++++ oci-index-v3.json | 32 +++++++++ oci-index-v3.md | 78 ++++++++++++++++++++ sketch.md | 128 ++++++++++++++++++++------------- todo.md | 3 + 9 files changed, 263 insertions(+), 49 deletions(-) create mode 100644 mock-sbom.json create mode 100644 mock-sbom.md create mode 100644 oci-index-v2.json create mode 100644 oci-index-v3-verification.json create mode 100644 oci-index-v3.json create mode 100644 oci-index-v3.md create mode 100644 todo.md diff --git a/experimental-environment.md b/experimental-environment.md index 42728178e..c6271d28c 100644 --- a/experimental-environment.md +++ b/experimental-environment.md @@ -12,7 +12,7 @@ For each milestone, we will provide instructions and scripts, to create the refe ## Milestone 0 environment -### Mock public content +### Mock public artifacts To represent a mock public registry, we'll need to build and host a mock docker hub environment. This includes the building and hosting of two base images: (linux and node) diff --git a/mock-sbom.json b/mock-sbom.json new file mode 100644 index 000000000..2050e0352 --- /dev/null +++ b/mock-sbom.json @@ -0,0 +1,8 @@ +{ + "author": "john doe", + "createdDate": "6/24/2020 10:10:20", + "packages": [ + "foo.npm", + "bar.npm" + ] +} \ No newline at end of file diff --git a/mock-sbom.md b/mock-sbom.md new file mode 100644 index 000000000..110bb35d8 --- /dev/null +++ b/mock-sbom.md @@ -0,0 +1,18 @@ +# Mock SBoM Document + +To facilitate prototyping workflows, we will prototype an SBoM document. + +We realize there are several SBoM efforts underway. If there is a particular SBoM document that we can use, we're happy to move to something more realistic. + +For the time being, we'll use [mock-sbom.json](./mock-sbom.json) + +```json +{ + "author": "john doe", + "createdDate": "6/24/2020 10:10:20", + "packages": [ + "foo.npm", + "bar.npm" + ] +} +``` diff --git a/oci-index-v2.json b/oci-index-v2.json new file mode 100644 index 000000000..183fb59e1 --- /dev/null +++ b/oci-index-v2.json @@ -0,0 +1,27 @@ +{ + "schemaVersion": 2, + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "size": 7143, + "digest": "sha256:e692418e4cbaf90ca69d05a66403747baa33ee08806650b51fab815ad7fc331f", + "platform": { + "architecture": "ppc64le", + "os": "linux" + } + }, + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "size": 7682, + "digest": "sha256:5b0bcabd1ed22e9fb1310cf6c2dec7cdef19f0ad69efa1f392e94a4333501270", + "platform": { + "architecture": "amd64", + "os": "linux" + } + } + ], + "annotations": { + "com.example.key1": "value1", + "com.example.key2": "value2" + } +} \ No newline at end of file diff --git a/oci-index-v3-verification.json b/oci-index-v3-verification.json new file mode 100644 index 000000000..b153c9023 --- /dev/null +++ b/oci-index-v3-verification.json @@ -0,0 +1,16 @@ +{ + "schemaVersion": 3, + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "size": 7023, + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" + }, + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "config.mediaType": "application/vnd.oci.image.v1+json", + "size": 7143, + "digest": "sha256:e692418e4cbaf90ca69d05a66403747baa33ee08806650b51fab815ad7fc331f" + } + ] +} \ No newline at end of file diff --git a/oci-index-v3.json b/oci-index-v3.json new file mode 100644 index 000000000..5df57dd0f --- /dev/null +++ b/oci-index-v3.json @@ -0,0 +1,32 @@ +{ + "schemaVersion": 3, + "config": { + "mediaType": "application/vnd.oci.index.config.v1+json", + "size": 7023, + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" + }, + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "config.mediaType": "application/vnd.oci.image.v1+json", + "size": 7143, + "digest": "sha256:e692418e4cbaf90ca69d05a66403747baa33ee08806650b51fab815ad7fc331f", + "platform": { + "architecture": "ppc64le", + "os": "linux" + } + }, + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "config.mediaType": "application/vnd.oci.prototype.sbom.v1", + "size": 362, + "digest": "sha256:5b0bcabd1ed22e9fb1310cf6c2dec7cdef19f0ad69efa1f392e94a4333501270" + }, + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "config.mediaType": "application/vnd.oci.prototype.src.v1", + "size": 420, + "digest": "sha256:5b0bcabd1ed22e9fb1310cf6c2dec7cdef19f0ad69efa1f392e94a433aa23a3a" + } + ] +} \ No newline at end of file diff --git a/oci-index-v3.md b/oci-index-v3.md new file mode 100644 index 000000000..79e8a66ba --- /dev/null +++ b/oci-index-v3.md @@ -0,0 +1,78 @@ +# OCI Index v3 + +An updated of the OCI Index to support `index.config`, enabling an Index to be uniquely identified as a `vnd.cncf.notary.v2` mediaType. + +## Additions + +- `config` - provides a means to uniquely identify the type of content the Index contains. The config value is optional. + - `config.mediaType` - Used consistently with the [OCI Artifact usage of `manifest.config.mediaType`][oci-artifact-unique-artifact] + +- `manifests[].config.mediaType` - provides a means to identify the type of artifact in the collection. + +### Standard OCI Index example + +Represents a collection of manifests. The collection is just a typical OCI Index of various manifests. The major difference is the collection may include additional artifact types, such as an SBoM or a gpl style source artifact. + +Example: [oci-index-v2-verification.json](./oci-index-v3.json) + +```json +{ + "schemaVersion": 3, + "config": { + "mediaType": "application/vnd.oci.index.config.v1+json", + "size": 7023, + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" + }, + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "config.mediaType": "application/vnd.oci.image.v1+json", + "size": 7143, + "digest": "sha256:e692418e4cbaf90ca69d05a66403747baa33ee08806650b51fab815ad7fc331f", + "platform": { + "architecture": "ppc64le", + "os": "linux" + } + }, + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "config.mediaType": "application/vnd.oci.prototype.sbom.v1", + "size": 362, + "digest": "sha256:5b0bcabd1ed22e9fb1310cf6c2dec7cdef19f0ad69efa1f392e94a4333501270" + }, + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "config.mediaType": "application/vnd.oci.prototype.src.v1", + "size": 420, + "digest": "sha256:5b0bcabd1ed22e9fb1310cf6c2dec7cdef19f0ad69efa1f392e94a433aa23a3a" + } + ] +} +``` + +### Notary verification index example + +These are new index types that provide signatures to manifests or other indexes. By posting a new signature as an index, the referenced artifact doesn't need to change it's tag or it's digest. Deployment documents that reference an image by `image:tag123` need not change when an additional signature is added. Using this model, any number of signatures may be added. + +Note: the `config.mediaType` of `application/vnd.cncf.notary.config.v2+json` + +Example: [oci-index-v2-verification.json](./oci-index-v3-verification.json) +```json +{ + "schemaVersion": 3, + "config": { + "mediaType": "application/vnd.cncf.notary.config.v2+json", + "size": 7023, + "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7" + }, + "manifests": [ + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "config.mediaType": "application/vnd.oci.image.v1+json", + "size": 7143, + "digest": "sha256:e692418e4cbaf90ca69d05a66403747baa33ee08806650b51fab815ad7fc331f" + } + ] +} +``` +[oci-artifact-unique-artifact]: https://github.com/opencontainers/artifacts/blob/master/artifact-authors.md#defining-a-unique-artifact-type \ No newline at end of file diff --git a/sketch.md b/sketch.md index 7d0825427..41a2e1c6e 100644 --- a/sketch.md +++ b/sketch.md @@ -10,25 +10,22 @@ Based on this sketch, various prototypes will be built and iterated upon, instan ![Notary v2 e2e workflow](media/notary-e2e-scenarios.svg) -> TODO: Complete description, based on the [Notary v2 e2e scenarios][nv2-scenarios] - To illustrate an e2e workflow, we provide the following example: -- A public registry with public content (debian & node images) -- A customer (ACME Rockets) with a cloud presence and an on-prem, IoT, air-gapped environment -- Artifacts are signed, when pushed to the public registry +- A public registry with public content (`debian` & `node` images) +- A customer, _ACME Rockets_ with a cloud presence and an on-prem, IoT, air-gapped environment - Public artifacts and their signatures are copied to the private registries of ACME Rockets - ACME Rockets will additionally certify the public content, adding a signature for the standard/approved base-artifacts - ACME Rockets builds many apps, including a `web` image that will be built from the `/base-artifact/node` image - As the `web` image moves from dev through production, additional signatures are added, providing proof the image was verified - Policy management in the staging environment requires a signature from development, and an SBoM of the content in the image. - Policy management in the production environment requires an additional signature from the staging environment. -- The web image, along with its signatures are copied to the air-gapped environment for local verification and deployment +- The web image, along with its signatures are copied to the air-gapped IoT environment for local verification and deployment - An additional signature is required to run in the secured IoT environments -## Base Artifacts +## Public base artifacts -To represent a set of public base artifacts, create a set of public artifacts signed by their representative entities. +To represent a set of public base artifacts, that are signed, we will create a mock public registry. - Linux base image - Signed by a fictitious penguin that mimics an entity that would own and sign a public linux image. We'll use debian as it's the base for the node image we'll use @@ -38,13 +35,11 @@ To represent a set of public base artifacts, create a set of public artifacts si - Include a mock SBoM to represent the content in the image - We'll defer the inclusion of the source for all the npm packages. Although, this would be an interesting exercise to see how registries could de-dupe source references to specific npm packages, represented as [oci artifacts][oci-artifacts]. -To represent these base artifacts, which would be signed, we'll need to create this [fictitious environment](./experimental-environment.md#mock-public-content). - -The creation and management of the base artifacts will duplicate much of the validation workflow for the developers app workflows As a result, we'll optimize the creation and maintenance of these artifacts. +The creation and management of the base artifacts will duplicate much of the validation workflow for the developers app workflows. To minimize duplication of efforts and complexity, we'll optimize the creation and maintenance of these public artifacts. -### Base artifact build environment +### Public base artifact build environment -A single build environment will be created to manage the building and signing of the linux and node images. +A single [public artifact build environment](./experimental-environment.md#mock-public-artifacts) will be created to manage the building and signing of the linux and node images. - For the purpose of isolation, we will create separate keys for the debian and node images. - For simplicity of managing multiple key vault instances, the node and debian keys will be stored in the same key vault instance. @@ -57,61 +52,98 @@ The imported content will be: - Built `FROM docker.io/node` - tagged `node:[version]-[os]-[version]` - Signed by the fictitious node community key - - Include an SBoM `node:[version]-sbom` - - Have an oci-index that includes the image and it's SBoM `node:[version]` + - Include an [SBoM][sbom] `node:[version]-sbom` + - Have an [v2 oci-index][oci-index-v2] that includes the image and its SBoM `node:[version]` **debian image**: - Built `FROM docker.io/debian` - tagged `debian:[version] - Signed by the fictitious penguin distro key - - Include an SBoM `debian:[version]-sbom` - - Have an oci-index that includes the image an it's SBoM `debian:[version]` + - Include an [SBoM][sbom] `debian:[version]-sbom` + - Have an [v2 oci-index][oci-index-v2] that includes the image an its SBoM `debian:[version]` + +The build environment will be triggered by a git commit to the backing git repo. + +## ACME Rockets e2e flow -The build environment will be triggered by a git commit to the backing git repo to ease rebuilding. +ACME Rockets follows [best practices][registry-best-practices] for securing the content they depend upon (base images and other artifacts like helm charts). As part of this process, they copy their content from public registries to their private owned registries. -## ACME Rockets flow +With a set of in-house base images, the company builds many custom apps which they validate, sign and move across several private registries. + +For air-gapped, IoT environments, ACME Rockets will copy the signed artifacts to additional air-gapped registries. ### ACME Rockets keys The ACME Rockets organization provides a set of keys that will be used for signing their corporate standard artifacts and their custom applications. The following keys will be created: - Corporate base artifacts key `acme-rockets-base-artifact` - - The company will maintain a set of corporate standard artifacts, including a linux base image and various runtime images. (node) + - The company will maintain a set of corporate standard artifacts, including a debian and node base images - All corporate standard artifacts will be imported from the public registry (`registry.notaryv2.io`), tested and signed with the corporate key -- Development key `acme-rockets-ateam-dev` - - As artifacts are built in development, they are unit tested and scanned before being promoted to a staging environment. Only artifacts that pass unit tests and pass scanning are signed with the `acme-rockets-ateam-dev` key. Only artifacts that are signed by a set of known development teams will be permitted into the staging environment. -- Production validation `acme-rockets-ateam-prod` - - As artifacts are validated in the staging environment, they will be signed with an additional production key. Only artifacts signed with production keys will be permitted to be run in the production environments. - -These keys will be stored in the companies key-vault solution. +- Development key `acme-rockets-dev-team-a` + - As artifacts are built in development, they are unit tested and scanned before being promoted to a staging environment. Only artifacts that pass unit tests and pass scanning are signed with the `acme-rockets-dev-team-a` key. Only artifacts that are signed by a set of known development teams will be permitted into the staging environment. +- Staging environment key `acme-rockets-prod-team-a` + - As artifacts are validated in the staging environment, they will be signed with an additional production key. Only artifacts signed with production keys will be permitted to be run in the production environments. Each team is provided a production key, uniquely assigned to each team for traceability. +- IoT environment key `acme-rockets-prod-iot-team-a` + - As artifacts are moved to the IoT air-gapped environment, they will be signed with an additional IoT production key. Only artifacts signed with production keys will be permitted to be run in the IoT environments. -### ACME Rockets build environment +These keys will be stored in the ACME Rockets key-vault. -In a build environment, the following occurs: +### Base artifact maintenance -- An [oci-image][oci-image] is created, representing a runnable container image `hello-world:a1b2c3` - - A node.js, hello word web app, referencing a small set of npm packages. - - The app source is stored in a git repository - - **note:** this is the equivalent of a `docker build`, with the minor but important difference that an [oci-image manifest][oci-image-manifest] is what's generated. -- An SBoM is generated - - The SBoM contains: - - the list of npm packages and versions referenced - - the node version - - ... any other minimal information to enable policy management decisions -- The `./src` of the project is added as an additional OCI Artifact, supporting gpl type license requirements -- An OCI-index that groups the above elements together as a single tag -- All 4 artifacts (image, SBoM, src, index) are signed +ACME Rockets brings into their environment any artifacts they depend upon, validating them and assigning an `acme-rockets` signature. -### ACME Rockets staging/validation +- How these base-artifacts are maintained is outside the scope of the Notary v2 effort. Different vendors have differentiated offerings supporting a customers ability to maintain a buffered set of dependent artifacts. +- For the purposes of this exercise, a build server will handle importing public images, testing and signing them with an acme-rockets-base-artifacts key. -### ACME Rockets production environment +### Custom app flow -### ACME Rockets IoT environment +ACME Rockets maintains a set of custom apps they develop and deploy within their organization. -An air-gapped environment that must account for secured and signed content. +### ACME Rockets `web image` build environment -[nv2-scenarios]: https://github.com/notaryproject/requirements/blob/master/scenarios.md -[oci-artifacts]: https://github.com/opencontainers/artifacts/ -[oci-image]: https://github.com/opencontainers/image-spec/ -[oci-image-manifest]: https://github.com/opencontainers/image-spec/blob/master/manifest.md \ No newline at end of file +- An [oci-image][oci-image] is created, representing a runnable container image with a unique tag: `web:[build-id]` + - A node.js, hello word web app, referencing a small set of npm packages. + - The app source is stored in a git repository: [github.com/acme-rockets/web](https://github.com/acme-rockets/web) +- Base images that aren't signed with the `acme-rockets-base-artifacts` key fail the build +- An [SBoM][sbom] is generated, saved as an [OCI Artifact][oci-artifacts] with a `manifest.config.mediaType` = `application/vnd.oci.prototype.sbom.config.v01` +- The `./src` of the project is added as an additional [OCI Artifact][oci-artifacts], supporting gpl type license requirements. The `manifest.config.mediaType` = `application/vnd.oci.prototype.src.config.v01` +- An OCI-index, that includes: image, SBoM, src with a tag of `web:[build-id]-package` +- All 4 artifacts (image, SBoM, src, index) are signed with the `acme-rockets-dev-team-a` key +- All 4 artifacts are pushed to the acme-rockets private registry, using the `/team-a/` repository + +### ACME Rockets `web image` staging validation + +- Validation requires: + - an `acme-rockets-dev-team-a` signature + - an SBoM that meets ACME Rockets production compliance requirements + - a functional test that checks the background color of the home page + - if the `back-color = red`, the functional test fails +- If the image passes the functional testing, the image, sbom and src artifacts are signed with an additional `acme-rockets-prod-team-a` key + - The collection of artifacts are pushed to the `/prod/team-a/web` repository + - The additional signatures are uniquely added to the `/prod/team-a/web` repository + +### ACME Rockets `web image` deployment + +- A helm 3 chart is used to deploy the new image + - The `build-id` is used to pass into the helm chart for deployment +- The policy manager enforces policies that includes: + - The Helm chart is signed by the `acme-rockets-prod-team-a` key + - Images referenced, in the merged helm chart, are signed by the `acme-rockets-prod-team-a` key + - The SBoM is also signed by the `acme-rockets-prod-team-a` key and doesn't reference blocked packages in the SBoM content +- Images that pass policy management are deployed to the cloud production cluster + +### ACME Rockets IoT deployment + +- Images promoted to the prod repository are also copied to an on-prem/IoT environment (_note: the on-prem environment will be mocked in the cloud experimental environment_) + - The contents of the index, along with their signatures, are copied to the air-gapped environment for local verification and deployment +- Within the air-gapped environment, an additional `acme-rockets-prod-iot-team-a` signature, attesting to approved content is added +- Deployments are initiated to several mocked IoT devices. These mocked devices, (micro-vms with a containerd host), will validate the content is signed with the `acme-rockets-prod-team-a` and `acme-rockets-prod-iot-team-a` keys. Deployments that aren't properly signed fail the deployment, logging the notaryv2 failure in the host logs. + +[nv2-scenarios]: https://github.com/notaryproject/requirements/blob/master/scenarios.md +[oci-artifacts]: https://github.com/opencontainers/artifacts/ +[oci-image]: https://github.com/opencontainers/image-spec/ +[oci-image-manifest]: https://github.com/opencontainers/image-spec/blob/master/manifest.md +[registry-best-practices]: https://stevelasker.blog/2018/11/14/choosing-a-docker-container-registry/ +[sbom]: ./mock-sbom.md +[oci-index-v2]: ./oci-index-v2.md diff --git a/todo.md b/todo.md new file mode 100644 index 000000000..b264880be --- /dev/null +++ b/todo.md @@ -0,0 +1,3 @@ +# A lit of ToDos + +- [x] Add [OCI Index v2](./oci-index-v2.md) description and schema \ No newline at end of file From ae4664789b6364d663594cbec3b37368539ed3fa Mon Sep 17 00:00:00 2001 From: Steve Lasker Date: Tue, 7 Sep 2021 14:15:35 -0700 Subject: [PATCH 5/7] Add quick-getting started to root readme Signed-off-by: Steve Lasker --- README.md | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 67 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index dae949493..cb37157a4 100644 --- a/README.md +++ b/README.md @@ -4,12 +4,74 @@ Notation is a project to add signatures as standard items in the registry ecosys ## Table of Contents +- [Getting Started](#getting-started-option-a) - [Branch](#branch) - [Core Documents](#core-documents) - [Community](#community) - [Code of Conduct](#code-of-conduct) - [License](#license) +## Getting Started (Option A) + +- Install the Notation CLI from [Notation Releases][notation-releases] + ```bash + curl -Lo notation.tar.gz https://github.com/shizhMSFT/notation/releases/download/v0.5.2/notation_0.5.2_linux_amd64.tar.gz + tar xvzf notation.tar.gz -C ~/bin notation + ``` +- Run a local instance of the [CNCF Distribution Registry][cncf-distribution] + ```bash + docker run -d ghcr.io/oras-project/registry:latest + ``` +- Build, Push, Sign, Verify the `net-monitor` software + ```bash + export IMAGE=localhost:5000/net-monitor:v1 + docker build -t $IMAGE https://github.com/wabbit-networks/net-monitor.git#main + docker push $IMAGE + notation cert generate-test --default --trust "wabbit-networks.io" + notation sign $IMAGE + notation list $IMAGE + notation verify $IMAGE + ``` + +## Getting Started (Option B) + +- Set the image reference + ```bash + export IMAGE=localhost:5000/net-monitor:v1 + ``` +- Install the Notation CLI from [Notation Releases][notation-releases] + ```bash + #LINUX, including WSL + curl -Lo notation.tar.gz https://github.com/shizhMSFT/notation/releases/download/v0.5.2/notation_0.5.2_linux_amd64.tar.gz + tar xvzf notation.tar.gz -C ~/bin notation + ``` +- Run a local instance of the [CNCF Distribution Registry][cncf-distribution] + ```bash + docker run -d ghcr.io/oras-project/registry:latest + ``` +- Build and Push the `net-monitor` software + ```bash + docker build -t $IMAGE https://github.com/wabbit-networks/net-monitor.git#main + + docker push $IMAGE + ``` +- Generate a self-signed test certificate for signing artifacts under the `~/config/notation/` directory + ```bash + notation cert generate-test --default --trust "wabbit-networks.io" + ``` +- Sign the container image + ```bash + notation sign $IMAGE + ``` +- List the image, and any associated signatures + ```bash + notation list $IMAGE + ``` +- Attempt to verify the $IMAGE notation signature + ```bash + notation verify $IMAGE + ``` + ## Branch [Prototype 2][prototype-2] - signing and verifying OCI artifacts, using signatures persisted [ORAS Artifacts manifests][artifact-manifest] @@ -36,4 +98,8 @@ This project has adopted the [CNCF Code of Conduct](https://github.com/cncf/foun ## License -This project is covered under the Apache 2.0 license. You can read the license [here](LICENSE). \ No newline at end of file +This project is covered under the Apache 2.0 license. You can read the license [here](LICENSE). + +[notation-releases]: https://github.com/shizhMSFT/notation/releases/tag/v0.5.0 +[artifact-manifest]: https://github.com/oras-project/artifacts-spec/blob/main/artifact-manifest.md +[cncf-distribution]: https://github.com/oras-project/distribution \ No newline at end of file From e4c7de44e5bddce9b65375d0cb0f722a671e6b8d Mon Sep 17 00:00:00 2001 From: Steve Lasker Date: Tue, 7 Sep 2021 14:42:17 -0700 Subject: [PATCH 6/7] Add quick-getting started to root readme Signed-off-by: Steve Lasker --- README.md | 43 ++----------------------------------------- 1 file changed, 2 insertions(+), 41 deletions(-) diff --git a/README.md b/README.md index cb37157a4..2962ee7eb 100644 --- a/README.md +++ b/README.md @@ -4,14 +4,14 @@ Notation is a project to add signatures as standard items in the registry ecosys ## Table of Contents -- [Getting Started](#getting-started-option-a) +- [Notation Quick Start](#notation-quick-start) - [Branch](#branch) - [Core Documents](#core-documents) - [Community](#community) - [Code of Conduct](#code-of-conduct) - [License](#license) -## Getting Started (Option A) +## Notation Quick Start - Install the Notation CLI from [Notation Releases][notation-releases] ```bash @@ -33,45 +33,6 @@ Notation is a project to add signatures as standard items in the registry ecosys notation verify $IMAGE ``` -## Getting Started (Option B) - -- Set the image reference - ```bash - export IMAGE=localhost:5000/net-monitor:v1 - ``` -- Install the Notation CLI from [Notation Releases][notation-releases] - ```bash - #LINUX, including WSL - curl -Lo notation.tar.gz https://github.com/shizhMSFT/notation/releases/download/v0.5.2/notation_0.5.2_linux_amd64.tar.gz - tar xvzf notation.tar.gz -C ~/bin notation - ``` -- Run a local instance of the [CNCF Distribution Registry][cncf-distribution] - ```bash - docker run -d ghcr.io/oras-project/registry:latest - ``` -- Build and Push the `net-monitor` software - ```bash - docker build -t $IMAGE https://github.com/wabbit-networks/net-monitor.git#main - - docker push $IMAGE - ``` -- Generate a self-signed test certificate for signing artifacts under the `~/config/notation/` directory - ```bash - notation cert generate-test --default --trust "wabbit-networks.io" - ``` -- Sign the container image - ```bash - notation sign $IMAGE - ``` -- List the image, and any associated signatures - ```bash - notation list $IMAGE - ``` -- Attempt to verify the $IMAGE notation signature - ```bash - notation verify $IMAGE - ``` - ## Branch [Prototype 2][prototype-2] - signing and verifying OCI artifacts, using signatures persisted [ORAS Artifacts manifests][artifact-manifest] From dd51d476d9f6f234ff0f22247591ba6d7042d3ba Mon Sep 17 00:00:00 2001 From: Steve Lasker Date: Tue, 7 Sep 2021 16:46:18 -0700 Subject: [PATCH 7/7] Add quick-getting started to root readme Signed-off-by: Steve Lasker --- README.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/README.md b/README.md index 2962ee7eb..4fd9dceeb 100644 --- a/README.md +++ b/README.md @@ -18,16 +18,12 @@ Notation is a project to add signatures as standard items in the registry ecosys curl -Lo notation.tar.gz https://github.com/shizhMSFT/notation/releases/download/v0.5.2/notation_0.5.2_linux_amd64.tar.gz tar xvzf notation.tar.gz -C ~/bin notation ``` -- Run a local instance of the [CNCF Distribution Registry][cncf-distribution] - ```bash - docker run -d ghcr.io/oras-project/registry:latest - ``` - Build, Push, Sign, Verify the `net-monitor` software ```bash export IMAGE=localhost:5000/net-monitor:v1 docker build -t $IMAGE https://github.com/wabbit-networks/net-monitor.git#main docker push $IMAGE - notation cert generate-test --default --trust "wabbit-networks.io" + notation cert generate-test --default --trust "wabbit-networks-dev" notation sign $IMAGE notation list $IMAGE notation verify $IMAGE