From 5dbeb13170420b78460ee34e4b2e67a6feea6045 Mon Sep 17 00:00:00 2001 From: Nick Beenham <1985327+superbeeny@users.noreply.github.com> Date: Tue, 27 Aug 2024 16:47:37 -0400 Subject: [PATCH] Secrets as Env Variables Design doc (#62) Initial PR for design doc in support of https://github.com/radius-project/radius/pull/7744 addressing https://github.com/radius-project/radius/issues/5520 --------- Signed-off-by: Nick Beenham <1985327+superbeeny@users.noreply.github.com> --- .github/config/en-custom.txt | 5 +- resources/2024-06-support-secretstores-env.md | 428 ++++++++++++++++++ .../secretstores-env.png | Bin 0 -> 66914 bytes 3 files changed, 432 insertions(+), 1 deletion(-) create mode 100644 resources/2024-06-support-secretstores-env.md create mode 100644 resources/2024-06-support-secretstores-env/secretstores-env.png diff --git a/.github/config/en-custom.txt b/.github/config/en-custom.txt index 705aa6a..c04256c 100644 --- a/.github/config/en-custom.txt +++ b/.github/config/en-custom.txt @@ -753,4 +753,7 @@ SecretLoader ConfigStructure RecipeSecretIds RecipeSecrets -lakshmimsft \ No newline at end of file +lakshmimsft +superbeeny +Beenham +secretRef \ No newline at end of file diff --git a/resources/2024-06-support-secretstores-env.md b/resources/2024-06-support-secretstores-env.md new file mode 100644 index 0000000..e902c94 --- /dev/null +++ b/resources/2024-06-support-secretstores-env.md @@ -0,0 +1,428 @@ +# Support secret stores in environment variables + +* **Author**: Nick Beenham (@superbeeny) + +## Overview + +Currently the only way to provide kubernetes secrets to a container is to mount them through a secret volume. This is not ideal for many use cases, especially when the secret is only needed in the environment variables of the container. This proposal aims to add support for secret stores to the environment variables of a container. + +## Terms and Definitions +Kubernetes secret: A Kubernetes object that stores sensitive data, such as passwords, OAuth tokens, and ssh keys. Putting this information in a secret is safer and more flexible than putting it verbatim in a pod definition or in a docker image. See the documentation [here](https://kubernetes.io/docs/concepts/configuration/secret/). + +## Objectives + +> **Issue Reference:** [Issue #5520](https://github.com/radius-project/radius/issues/5520) + +### Goals + +- Allow users to provide Kubernetes secrets to a container through environment variables + +### Non-Goals +- (out-of-scope): Integration with other secret stores besides Kubernetes. This is tracked by other issues. +- (out-of-scope): Other users for secrets besides environment variables. This is tracked by other issues. + +### User scenarios (optional) + + + +#### User story 1 +As a radius user, I want to provide a secret to a container through an environment variable so that I can avoid mounting the secret as a volume. I want to be able to reference the secret within the application bicep file. + +```bicep +extension radius + +@description('The Radius Application ID. Injected automatically by the rad CLI.') +param application string + +resource demo 'Applications.Core/containers@2023-10-01-preview' = { + name: 'demo' + properties: { + application: application + container: { + image: 'ghcr.io/radius-project/samples/demo:latest' + ports: { + web: { + containerPort: 3000 + } + } + env: { + DB_USER: { value: 'DB_USER' } + DB_PASSWORD: { + valueFrom: { + secretRef: { + source: secret.id + key: 'DB_PASSWORD' + } + } + } + } + } + } +} + +resource secret 'Applications.Core/secretStores@2023-10-01-preview' = { + name: 'secret' + properties: { + application: application + data: { + DB_PASSWORD: { + value: 'password' + } + } + } +} + +``` + +To reference a secret directly: + +```bicep + env: { + DB_USER: { value: 'DB_USER' } + DB_PASSWORD: { + valueFrom: { + secretRef: { + source: 'myKubernetesSecret' + } + } + } + } +``` + + +## Design + +### High Level Design + +The design of this new feature will require updates to the versioned datamodel, the conversion functions, the containers typespec and the common typespec. +These will be breaking changes to the schema. Users will need to update the environment variables in their bicep files to use the new secret reference type. + +### Architecture Diagram +![Architecture Diagram](./2024-06-support-secretstores-env/secretstores-env.png) + +### Detailed Design + + +The design of this feature will require updates to the versioned datamodel, the conversion functions, the containers typespec and the common typespec to leverage the new secret reference type and provide support for secret stores in environment variables beyond the current support for environment variables with a string value. + +#### Advantages (of each option considered) + +Advantages of this approach are that it allows users to provide secrets to a container through environment variables. This is a common use case and will make it easier for users to provide secrets to their containers. In using much of the existing functionality of Radius, this approach is also relatively simple to implement. + +#### Disadvantages (of each option considered) + +Disadvantages are that it will break existing bicep files that use environment variables. Users will need to update their bicep files to use the new secret reference type. + +#### Proposed Option + + +We first convert the versioned datamodel to a base datamodel that can handle secrets. + +```diff +// toEnvDataModel: Converts from versioned datamodel to base datamodel +func toEnvDataModel(e map[string]*EnvironmentVariable) (map[string]datamodel.EnvironmentVariable, error) { + + m := map[string]datamodel.EnvironmentVariable{} + + for key, val := range e { + if val == nil { + return nil, v1.NewClientErrInvalidRequest(fmt.Sprintf("Environment variable %s is nil", key)) + } + if val.Value != nil && val.ValueFrom != nil { + return nil, v1.NewClientErrInvalidRequest(fmt.Sprintf("Environment variable %s has both value and secret value", key)) + } + + if val.Value != nil { + m[key] = datamodel.EnvironmentVariable{ + Value: val.Value, + } + } else { + m[key] = datamodel.EnvironmentVariable{ + ValueFrom: &datamodel.EnvironmentVariableReference{ + SecretRef: &datamodel.EnvironmentVariableSecretReference{ + Source: to.String(val.ValueFrom.SecretRef.Source), + Key: to.String(val.ValueFrom.SecretRef.Key), + }, + }, + } + + } + + } + return m, nil +} + +// fromEnvDataModel: Converts from base datamodel to versioned datamodel +func fromEnvDataModel(e map[string]datamodel.EnvironmentVariable) map[string]*EnvironmentVariable { + m := map[string]*EnvironmentVariable{} + + for key, val := range e { + if val.Value != nil { + m[key] = &EnvironmentVariable{ + Value: val.Value, + } + } else { + m[key] = &EnvironmentVariable{ + ValueFrom: &EnvironmentVariableReference{ + SecretRef: &EnvironmentVariableSecretReference{ + Source: to.Ptr(val.ValueFrom.SecretRef.Source), + Key: to.Ptr(val.ValueFrom.SecretRef.Key), + }, + }, + } + + } + } + + return m +} + +``` + + +### API design + + +Updates to the container typespec to allow for secret references in environment variables. This replaces the existing environment variable type of `map[string]string` to allow for a secret reference. + +**containers.tsp** +```diff +@doc("Definition of a container") +model Container { + @doc("The registry and image to download and run in your container") + image: string; + + @doc("The pull policy for the container image") + imagePullPolicy?: ImagePullPolicy; + + @doc("environment") + env?: Record; + + @doc("container ports") + ports?: Record; + + @doc("readiness probe properties") + readinessProbe?: HealthProbeProperties; + + @doc("liveness probe properties") + livenessProbe?: HealthProbeProperties; + + @doc("container volumes") + volumes?: Record; + + @doc("Entrypoint array. Overrides the container image's ENTRYPOINT") + command?: string[]; + + @doc("Arguments to the entrypoint. Overrides the container image's CMD") + args?: string[]; + + @doc("Working directory for the container") + workingDir?: string; +} + +@doc("Environment variables type") +model EnvironmentVariable { + + @doc("The value of the environment variable") + value?: string; + + @doc("The reference to the variable") + valueFrom?: EnvironmentVariableReference; +} + +@doc("The reference to the variable") +model EnvironmentVariableReference { + @doc("The secret reference") + secretRef: SecretReference; +} + +``` + +We also need to move the `SecretReference` type to the common typespec so that it can be used in multiple places. + +**common.tsp** +```diff +@doc("This specifies a reference to a secret. Secrets are encrypted, often have fine-grained access control, auditing and are recommended to be used to hold sensitive data.") +model SecretReference { + @doc("The ID of an Applications.Core/SecretStore resource containing sensitive data required for recipe execution.") + source: string; + + @doc("The key for the secret in the secret store.") + key: string; +} +``` + + + + +### Implementation Details + +The renderer will need to be updated in several areas to handle the new secrets implementation. + +The function `GetDependencyIDs` will need to be updated to handle the new secret reference type. This function will need to determine if the environment variable is a secret reference or a string. The function will also need to determine whether the secret is a radius resource or a Kubernetes secret. + +The function `convertEnvVar` will need to be created to facilitate the conversion of `map[string]EnvironmentVariable` to `map[string]corev1.EnvVar`. The function will need to handle resolving the secret coming from a Kubernetes secret or a Radius resource ID. + + +#### Core RP (if applicable) + +### Error Handling + +Error handling is covered within the functions and Radius errors are used where appropriate. + +## Test plan + + +### Unit Tests + +- The addition of tests for the conversion functions from and to the versioned datamodel to the base datamodel. +- The addition of tests for the conversion functions from the base datamodel to the versioned datamodel. +- Add tests to test for errors and negative test cases. + +### Functional Tests + +- Add tests to ensure that secrets can be referenced in environment variables. + +## Security + + +The handling of secrets will remain within Kubernetes and Radius is only providing a way to reference these secrets in the environment variables of a container. This is an improvement over the current method of mounting secrets as volumes as it allows for more flexibility and security. Also, the secrets are stored in the Kubernetes secret store and are never exposed to the user. + +## Compatibility (optional) + + +These will be breaking changes to the schema. Users will need to update the environment variables in their bicep files to use the new secret reference type. + +## Monitoring and Logging + + +No additional monitoring or logging is required for this feature. + +## Development plan + + +Work completed in a pair programming session with a second developer. The work will be broken down into the following tasks: +- Update the versioned datamodel to include the new secret reference type +- Update the conversion functions to handle the new secret reference type +- Update the containers typespec to include the new secret reference type +- Update the common typespec to include the new secret reference type +- Update the functional tests to cover the new functionality +- Update the documentation to include the new functionality + +## Open Questions + + + +## Alternatives considered + + +The terraform resource provider also implemented a similar feature to this. There was a difference in design that needed to be resolved to maintain a consistent user experience across the two resource providers. + +The two options were discussed and it was decided that this implementation would be adopted for the following reasons. +- This solution is more consistent with existing Kubernetes design patterns and is more user-friendly. +- Secrets and environment variables are closely related in Kubernetes and it makes sense to allow users to reference secrets in environment variables. This design also allows for other types of references in the future. + +## Design Review Notes + + \ No newline at end of file diff --git a/resources/2024-06-support-secretstores-env/secretstores-env.png b/resources/2024-06-support-secretstores-env/secretstores-env.png new file mode 100644 index 0000000000000000000000000000000000000000..04f5b41c208d81ada797457ade257f066150241e GIT binary patch literal 66914 zcmeEvXIPWj7Vd`)M-h$EL=c6sp@I<$p~Zq=1r!9ODvSm!AcS5LX0XuFu>cB!B1Jla z^nit;f)tS^LNrJ(5$S}GyLLbarkpwV{<=So&vTw(=8$~f-mAasT}v-54fRC}L>FKf zw&=iq)ngbopNwJij?AA2|K;$i09E)05BZq-9xSm;tONdK4r%w1-58bO9R*w0@vj1zf4b+?YAad)GpxuHXT9mjy8DPiL!%y0hSH&(@!4ZkUT zDvH{k71g_EiR}2L<6mFo$s5*-m}TMvelnJKJC^%(506R3i-nu_T=HC~@3?wQgyHVg zzF9x${lZ3ufXS9e+kTtR_)SRC{6XPxaa+6C8KvcZq%X_g68ha}pH79zsrPF(6F5yO zZL&+@1-XBou5SJQV+;<@JN5G}KTpE<|9nohlxON^Eh$s}sUO`%ad5cFKkq$*W>5VX zt~TaR(ACqcx*?_hE`Lmq^XAkR5x#jI&;Rxx6~&iEzqLGhR%b-V7gIS*j&i8HwIn-? z(@*`!&!8_-<}WEJ*;mo0;Nne~Xr_(_w1|9v7n*1I-ap=V*}uPUf!OztZkPPOyb9-` z<^bXyYFD{2HIYAWgyAzFOzji4u(nPK*{a0O(}b5SB7w(U4JHrf_eLWuE@KIh1!4UdgAb`Q37n&zAO({eRmdJ|M8 zMw%HEI)&9UP^C${tvw}^I$0?{LLO&=73$gC=s-WBmuR?w5=Hm;V3+*#>1_&!MGxrV z`D&Fn8Z|;IEiJvJ?VMU07U#qECfK`#WxFL_#gQ*qT1L^?y$*%!-r_E#-SFpAt(quV zhlH6EMZ|9u4-BLQdE9773NqWt5+~~nFF$>Jy#D?CDQyXVttLd);eFivL>gZ2BH?LP zfmri~j3B95agOmE7L{XVeU(3qH2KBu?493&BIvVQtO?#`#r}ds;k}0U&sbPI&K(rC z<}6&eP%+Tj>+}1^+DWAb;(P(c0jz{pcC!TML|ICYUBJoE(~sO78-M*;Q_T5%P2wG| zgllqtYM)^~t2f7{?4pZX9Rn#4F3j~wzdpmRAeUAkmP0G*lxx~>BDSfy z(`HX-Z?j!kTuqn-XWZ7s#9muDy7Piqqp=H%`6#U1Qnr7}1ioB&6nOG6zfke>-bVf> z8L|A9#n0)yi&qMysM#gw4Z4%huV2dB()>G4Sk`z`k>cD1)oa!;C}w#z@(%-x$NR%L zh9A{0V}1H%VMG&O>QFt&XmL!23T6DlpkdsJ2g>t0T1M5bFUfeS5+JSR8T5etR1d#9 zt~0&n&;^|;eKU{FVd3Ew%(r0^1JR6CZe2>D6q$iBrM-3%c$4vyG|g(}gR1lGgQ-gu z+>G@-ZfFpzq-7Qgl+)NwI@YS=uB;`ra(Df|Z=T*f=yEJB;Q`Y#ea>0>H-L_KA?=bR7aqDS90h;GptZk*^( za-sDQg~y!kpU$YIHJp!WWws0p*}JG%pAG1=&M6d2a#8n4bxNRqX631hjL zWOoe6yEt`MFi9CzMbmc6L#u)AUz(8y#a|M50)`$~^` z#YAMQsz!Uzt(U0C1osWrn&fXa%(1`N_H57+zh_;J_^!olrL$e*G$qT(hGqxF=KUFM zIq*X^EzF}gbY;$6A!emz;4KSI7U;2MQjYSD7z#xzKf^e}b4cW2Hr>&xff=DKpVDx? zduV*j$;6nHQJZC8UfGkvVs{VqTM12G%_`of-h@4NU$Y0FS=lA;jIvw7*fkJt>Q7lI zmn*ZN{TJe5PrdS_!FYkts2=+}-i<4Bwm;+AOSf|cRkl2}q02HrXpBvx^^OjRlG8X7 zaq}hb>$&7scBnYG_%*8Nv2$e`)AHKd%EL6lE!8iVG0r`qG+aYhZy&1jnCPB0`5IrM z?D6U`{Nw3iE#ZM4G`5&Xuf2O#STP^FOk$|teZ&&pA)IO_5h~*VCjfID*BZ|=yRShS zi=kMe*D%XaU+6JG8x$p9u5oH6=<%oyid3_fK0nNA?imuzQO>6{1zN_|{oKmjk=CS_ zQM_`1Bs_HkJ0Z^P5yPyAio4cTKW7@Z_Sm}<2F8LO&^=e#x{PZCX0-3%bQup@29}tI zt|Zmh^-P!y8(-02?q-$uv^d$jbZb=ZA?9Z!H`MRnL&U3h^M!r^()s@J0C?`(+Udu6lNuJw=<#|eihuPB z8~s)y>ky^K8{O>g)Ro)QZ>RW7Y|N>&(`k4aPG^`tA;!pyeHLyv)^*=%FuNg)X*n#c zA2v)Me@pKk8*h+MEQ`9-S{kfJp;o)u`4INxBZ2h_Y}V-?{^qhUAuLe0dO*b4ix4Y! zI2XKUAt`@wBDPH+5bs57Fe$N2N*NrknsDhDcI$Xl#f&$KZqrh>XPM>pI@EPdH!U1z z1(BbjapXwkM!m#GKEkrShtCs}jm5S68yMj>VgdnS9kvz$HBJUh#Uc}7(X`Gs{9ZeZ z=3MG|++K0l%2){d>|vA9EQkemxg44by;HeIVCUr;^V1nlA0%=X2%GA&n$uMBHOjN- zZS_5N4&F%Rp61;dqVFEe>R8h{|9H@nyvf8}eQ_SSCT@er3B_@YRqPipUX<~C5@9?Wi98hO zE&NWp^X z$3uVflOAXv$Z8)Fbzm9xw76O5DM#1R@`esQNK>)T|FggSXs0N$*sg|2swIg}o-5qJ z)E{T#elKe2_pFRBAjs^p*r%w+KN6gmQmrDZc{44fzo&W6zWzUFc|X1s`@hbbCSMr) z#{}|!UyWfiGV1?b$p0>cYc&5~n2fuq{)rR&Gb|goey{7EtP~O!F4_LeE1$_S@Z4Ja z58_IW$<1XKzSn)Lqd&_|JY?>z-Xb)q&02D_-n7|J5Up!nr8ilm#VkjD>B2Jd^^KDb z>b)=ezH~3btJ_mwtcEJPh61rK2PaFs?NU&&xnDHpw^_q2-Q4e@qV(AgJa5*dAKdj8 zdAL*ef;8n!e{@sTa9eNG%^p=u9pD@4Ay^T2? zl@aO|c6Lu)1u*x@CDZN6L&G@FHTX_oVAYEkd$O&Y)o>PKDz5Uh!5V{oA$U1CZB;Rx znd*CMW)scygucG?P;JqYumlmwiI}Lyd}@A>Y;T4)A<>w2H!3>1>dTj36fS+*rQkeZ zj&mzut8IJoUhQaif^vdd{HEt#6cy_QTtq=vaA@e}A;H;L_w5-jq9&X zhNaDLwh>v9S}~IT!NI`;UtZt*CSNzqMCJgvwca$~PHytvOc~su&2kV2J_dE;jS4`1)MD-J4(Ckg{-c z$_jZCUJ$HcNzV&iyLRonj~@+jP8c>i&V%Qy zJ8r`t8)MM} zC4ojf?tN>f+dy&qN199Rnd73d+1+p6zt?e|7rt_4W0(i~_H;^mJW~$k!`XTu+3YULzAc8{0NBin2&% zW>RlUOCNP~bTF8{0rLrx?T%kR?FOvVTyn^p?a}`e1@V#+wb;uA4K2i#N2s!~xB=u(V7Jd6DTd z`t6Lh(47@KEpKUK?ol(Go|)s09Xq^Jw|&fW%L&;d!*HO26t@wHCK^20-CZ+m?6arG zsI~pPK;74RcCT+278cqpz_c7@s19EfI3sitd;$G+Eu5t4!QN|JU=iLibcSl<9YM-6 zLwXAc^WnZhHMVY+l?{aV%U(LeAtZx_1^Y`7jSbJvmB!hqR^Uirah-=|yxQ}VkalTn zYg=5rm=H26A6>QeYr(L^Sd8q9+n(3lQ5D_s>A6Qop^tEjz{u0AtgLOy$~{Y!FfHvF zC&|qk92{gQ8yXsJihkCs5vCGq*_eIYp9iy(oS|a(?ga-Q&`UDjTpXSQ2NDW2@M3?! zcF|_Yqwg%(&^rh`RjsXO33H8^ea*#%`8o3yG54{V(qQW9>b@%|P<8HO>?6!|77o<+ zI+TcEgR5sewCTcy3y%PXf9OKN)h zowe)MRe@cB(mY!~Lm-v;U`!0mhpa!2Dtd$yJLj8 zO@@Y+XDF0BvDui~z8NB!D1G}j5{x*|Y>SAjaqfDVj3?RI`k+;6yJ!4fQ{k^eUS3`d zWslt~2ntnM?3BO^<7;oMPbF3LG-Q?VTa{>X}4GP-d z)zt;Q;8gw$c~%

H634{=_D>+w$^2Gwc~8NV`a3V9-WUlc+Xyf2Opqv#i?VF=inRy6hbL`Ft}4>0oI zO;duP=joT8o{p>|e1>)O`9SEmh1Ac6ud@v_Z=Wq3>e`G$H83vl^74yKs!U9nL55{y zoLlWCyJ^FvEE>1>2Jnv{+>dY#{tewLB{QQt6&zYvlUsjS0 zY0lf-CPv#@M79-!FRps?<{*0I=}DSR072uv5-JBu@aF#Hwz5d%Z2$UIhe5%>@!x^R zk;&wap`HeGuKCl?MQA-?VxkFcu1&?^Cs!&tYK4S?R~4K7N@8Rsr*A)t6Dhf39%r3~ zx`WGQF}|Rw8$4B-keDdc)poUVk%56hi`8t*`6js()giW@UtF=_yL$!{y@8s8ZP_&S zSa-a`msdAXs$$Cin9SLG;ZkE3IePpew#y36b(TabNpT(j`f_o{ho|Q|LLHhm@ShkT z%E&(wC}VVx$QdUSc#rhe7+Bq=!tH){*IQamuMl;|m-~TYL()GW)fUu@>M1126D$AJ zWgSW=8gXILYGcBs%JvVj=o}Rqd#IrUOi((y6?_`z@jX)$A)ESF0w9qre8issxyYOR zo+JJxWdX#AO!@tl6WLPVg6`iJB5yl9-e6>6A`6zX^KU=O*t+2wzc|W_P;0s6eN#(% zcRb@-X8fBBI>kWaq744ppcN*vZR*ya1*OV4r2)**y|2p5zwWc~BKB2rYp>gx?+?nv zj;wBqL(=Z-a_fJ)v!gD>Op!_cr%vpO{Ck~!&6GGN&PXxw4*7yhqnR#A#6rSmp&~@k z`>5uEw82WcX5A`v1R(rz;AR1G8b9r_cxq~Dq1%@)KC*f1o5JK3)uUHM7zrLxz10Va zieycUq)*MNN81HZ-Upqc1KifA!E7JtR?mhwmfxtpnZNPM{&MOB*;)eUQE;9>op8lZ z)RV%tcOJuANe}rHPgrB8wwSujw)q($Lily9D57I7_(bT*BpcLOgA&;ykH2X#&M57E zwP{A`h0D^pLBYWrqA!3SI-JjHWGbkM;;qgf#sv(w1e)|7j%)RKQ007x7;tj#&jgdR zXPlk&L8!9@x>jG8LI9O70bgvsXk)AA>@{E&io;ewOt{)7I`Q=y@sS7bV*A{L-j^nv zK@;X>9vXkbY4tMFc5_<60Y03a>u{q(OG1O>m}jc7E2}4?<(5erz2;(*?(z7(CKsli zl7|{GU_dGFhP2vLv!bZwk z8JBk*@yl}_oBC^XZQ?c^P5I$)dRM-sm;h`S7hx=$ zx^%DLB_+yurYE+?@QqoS{Lyd@cKu{CRAcSW$>E=bHUb$_9PelIDI z$9=c=punpe2m>q%2{PkqbYUj6fEUU`RZ6K`NxqCsDf7!~t{HU1drLb9XBd>?oZU)S zwbuC)P#HI=pW1)X&n4u6WtY-Wt$yuEcYGW(pQ940U?=T{M0D%oaRD6jjNMN+wXO&Q zC&QRa(RkdzAmxpJD+%o|aqZiOw<=hb(4SsDoE;Pa{q6e>NqxogPbL;&9)f=;isDUm z?rFDyn>=~4L-CXO_V_a-qkW})Wr|Dz-VKPFaC@WPJIL4_qMqKrEv1v9`cde4!DxS* zPng%>Z$qCR+BMa%{QGL;NVzht?a)ILyrC1YJmsJUsl$_+1AziO^4BO++N?hrK;@U9 z<|E)3*EMEZM~IcYgo_GN8U1oI)IDOs>b$YeI2(VxeTFH?$=ChG71QOYszTr&$Eux8 zN*gG2oZhC*n{ShIRa)n>Ra&2(ueEROvQ-PP79vIRVDr}f)!GTgVky4&05T~KcM`ia z%l-M23v0OO?jH^Tsn=V(_KFAJtRVh=Pg8!#bzd32I6^((9b`KYlkPxTV+&q>dQ9S) z!JVMl?zC5gR!@)5Wfyj7@AKUT*cFJ_<9iPJ#{=P=K0}6PK_;h)d9-G_3|k`HYkDaB zLmMG%iYYs9ONft0p;f|d;3#0->rv+NJ!|C}J*aS<&qp(E#DtKCez&Ts3c(jBRR0l7 zz;XbWJ|zqB$h4lYbElsFZt`Ibji{$jpZ>#%lv__28XgvwFnE(W~S1svt@G`)~Cmq%ZcB-L&Zzq&v7(%1+-NO;1#~ zeuI1Z0EGGl zzf$=wRFZG-F-ZVfpmH9`|L3V1EIrs=1EO@A%%&60&=?pe<;!th-l!V z6v(ZIAr~EB6fO*$Gs}JT_w?_F%opN|(;?Zi{rc%Sx5W5$4AtaqWuY6VC%4moUG_(Q z6%&SVHK2H*yz@u0{6p`r1T_nzoDm8IxcCwTm;kiu45$X+DbphQcR?*7k4y6ZUL2_l zkY33KEeUHie|b4xY>U#5?C5(4T;1w;Tx^pG6#2#BDvYhWpx~NbNBj{h;TNkxMJ7!z z=GusZ0v`W49*=GL zH)us=HQ08%iyY`LCkB$WpjneFZ0c{~GR8L+{ztP9)RG!5^El_|;<{gvDVGRs5SV8JF_Bcf01hS7krG4iiNwVP9 zSC!tLh`D%bWX5+EOHd6jsAljkz&Rb()bt^IfL>AELcBW3`s+Bi+Va&1*|1h7br!}K z_9IPQw6!&6M#{yD*{x}9zd)g=02p@5Y>Vjm^XC!#QWyqh*!TLP2wg^v3i0904c|M`TziHU6e5+p@ReixgTt+aC_b3+05Kk<$6RkJVApOs$^ib;$1$u_(w*!0(&J z7}L0+%FVq%0J|DJ3HHLgRqNKS_3l|!XO&{SQ&G_X?47lGsGpmsY?-&o!9sy|BvuP1|kN1IYfG01Q-IG$3368AnnQMOVmr9jNO=(;?4 zzY_D@hzX~QDwu!M_$p_V$Z6Y1G+4y_0aY3P#MFk0xcMdu>~Z6(@}FwrMkEs16MWAy zy_tKv)N{zYLXR$4%Ja+|^#6EL!xa!x48FwZZrOA1&!W1MoUh9VqEn4km2iOyqhno3 zCd(6za&*TJ8xBEcCTG8F_1v6}`oM19>&ji~jmLSb^#E1hu*DTDNKz6L`L#|DL+Ro(k>rn&9b)k!iKmOj z9(YTdHfMWpg49eQCck0JE0nA7MJUJ>b0+AVoRQFht=;x#{Y54^!X_R!m)nYt5$Xh) zhoV_^B^8>t`oJkM>P9 zqXkLw_On@sst70WhAbTUa_6dXD4Fq1n(OiHa^wL~Qnz|3t~|Ah9GN;2?@hqsB?cvB z%3FRH?hZtLB$ZT-@B|8Y-#Fupg@t06mf4-0ZJ{25FSo}ANx6>q6&J42%!5+P<{;^~ zPGw1Mqp5#Im)ShLI=g^$yp-n@J4VmC-e(e*6YFE55~D^FJEaQ7A6whA2h!X3K`k;z z+D;W-0&5-tmSfdp?dW$7bT>VXdfk1v6l)`+7eDKKE(9eBq(BL6)0sXJESo=WLmCq{ zaXnhP0>2*-vS{2)EUvBb{CEnuv55lGb_$jM4wjWld4KQ39Zl#*a0ro_HxfKj=53Mid|y{? z!mxOA0;$Z=sI;=&?5ecnTDHsIxlu-djP3F}+566xUze{o+>C!r zsNr0IcIF02yfXCHXvGO2#Tbp|luv;J}{+YM%n+T>maW5W~HV8>2DIZYr4+nLXuyxDN(Y z;WXPk8Ip4!k0F${2-pbUC`SlesGLT)VU4&vaYPi8d#u`&`SPvcdEhvo-*~2gSMIQQf zAL{DX!#y0CDyshO9!40)Hdelz5jf1ABg2)MA@EXp(OXN^7>E3@{QTG|z z8WW`XvrkV2ut@_YLGdWxzLYxaOX*nUgpUUY&Z`L;nx4>f$vXYECpqNeT&&20D-rWF z0GEYpbA7efi1Hl~V{A+8bNk8a&GdIe4$f?yU-_o%ie2gvxWE?Ai*cwI%++~|-=T3L z$TDCMD=@4XDF@f|v<~qfuCVP>-q3n#$&?+HC{#^%Sx3E7Z3$Y}G9ICp%eK|nV;c>?!Idbhc zW)1IJ)K>N|ow}NuV1RIbxZCP|s$CGq;@ODG0%V#h z)%QHum%THkXv#mYa7rKI<@~1k;d8$wBqX3xcFw#EE4s$Ld-qy4^Swho=79lQRNvz& zC)p5_F7f^EvzKiHKd?JxDu#6(2EgG*_`LfIG_$}d$s9RyBx~ReR#?9iMNlACc$=?f zEXTNcZ`Iz)7 zehHNj6gi*@a$1;xSVSSeN|hDhaM$FlF|6mm6`S>w+}x0}XV1O^HWNYteH>RiSf~Gf zZLvfYWTHYi_4thmNlAejv#?y`EvDJxKT1(l9R>g3b&|&N)(q8bK%7t=?{t18;E-c) zT$YeF;ouFE5SQt{u`It-`Hh9piMH1Dp3TcIK_b3BP^ZYxm|rb^Y2Y2N!LUv{Aeu!XuMWWT0OBG2HwS-n zG$g?kI^`f?C^CKMRMjQcHU0?gN_6%<^lGYGF5IUUa-|tsDurY^1ems2Slx<$)gX?R zzjksCMFn|G)m1p_Vo0g&XL&)iS>H%=*$Lq*Ce!sb#plrTf_`V9M&PW{uC6*fA)Stc%}#fs8@Pg2_J*%#p4bTrXi zYUFs_A3*2xZ*11tXu}yRq{!g7j=E}Yv-WJ8(4!9OiCdk2u_O$*09Jwdi?DXTK`Cck z;1(wU`K;A^J=M#h>W-(15o{ifj6-iufR`xw!n03Aa?a>t&S&EIx%(oqPNwYh&d%BM z)q#`)&=#TvjmBUYYmzIlP2bhAP;A>tS50q%$egKo;N6u}JglmHZG;|0Wo1ws`qHEL z5(O9U%8!@8?@u5#j$EUTTtny$!)61%_sM!}S0e=M$y)aubY#EBmc-iI$G!>Btz@)k z?XrZ=ZVHef%E$!I!YTx~KvH;Rf!H*!6%NA32u~;l$%c8ZS@NsE9#H}pgS-k7nkoNX zjne1glUYuM9{|5%CyAya44aKWpey9L!A;#D;hUswZo3=gG0l_I`-`h+jIAM+P{6Tx-nvBg8I+}xTyxtqlV&j``o3+f>?O3Y3N*l zR{nZ<>c$M#D*JaQ%6V-_@RUy5$xqx}JL}O%_XjoXmAWf)um6%4S1wMbB5$O%4SkcTw9xdVN*iP{5zGs z>sq+Y(^*UCtm_fn+W$SU0cMKx)gf1j0u9lw(OtcuTk9KTQjRT>dHP~ij}Vy)4YXYZ z&^YADPE&sO@q%HMsap3b+}uoAe_KlDO}Sa*%=IXI2Qv=E>v$YW*s?#=)L%Al)z_g+%o-b3x^*;evtgJ(I_Ky&--g0g0{=(RuhZbr1BOsTpFfM{|0=T&*0;8o*r4y zN37XcWjcatq%ilLRifnae9kb(JD-Dk=iKq$;EVH?9;;+BLI;YSDe^;K0_{G;M>R~w&-0ez|>Px z(k^2JVE%WV8^y(^} zH!aMz^Aul_;_;x0v!s5pssGta$-h}LSa0(`yA}-ZcC|8?G>g+&klvRI?LFQj;prK^ zV3WR-hrNp*L4kc(P$5ktsTII^XavXIC!HU!?8$p+nV}b`-XV}M&_9xtQ+hCIxW#7k zvrI3h%Ji#+RQi@ep;$_@Ri$V+OAdi0(~L{w=68CF|I`@?NZwQ?19IDJY* zgz&sCb>Ssab#($qMAS+vS8lu9`MXR4OG5H%T~Fz%o{Zzew1x>E7#r=#x=LBev1{m} z!O&vn8~{{Uf;R6b(=~96D3V2L;MJqWS6YkL*LhW3y!HyfcMAByDo+AZ?>^c^WriW@+oIBVX$rEFelq>K252% zreVx&+_Is|#cea5%8Jy-?yk)%U-c(5?}Wx{=TMFKLe^(HMN{OQEDFS&yqF#%P3iX+ ze<>Toy_9S{Rrg_dvCfT`maK)&Km81vlh*6gzJqULYx{6t&c&o*7n9HTtn!>%d>=!v z;6co6^G7569%5W@Cj8D+ps?6eii-_h8LFZFADR73ijJr=9f zjRqs#W9G3EL&ydh;+uN{mU9eR0I^C^;>aKAuq4v+ZpI8|6+SjA-v$gd4*mM7?!AD^B@_cPN z(=le2hbNw)^8lx)!?U-G|DINld=_Bx)+W}AnnqlnYCmM>IW$zlxMG+cn^% zyD)A3+E`W$C9kS0)-sN9>zq<=Qg&DkOPSnSTE-tA6usamgV1eHYsh5VF%Pktb(sgY zTXm5+FkhbAAEIx9ud{RkY2aX_w;0oW^VCu3&%E%h~C*8&lhyXY%JzaCa$Lr$4RN zvF>8@k?l-N>mp0V{U4$oK2#n%a-N!)Viv(xi47GGwZEg&ud8_5-o>)I>`_n?g_zUR z-O=V&-(&6I(rfqe*JgOtDW!HhJ58y3(y8Ge>@U)V8heP8f?(;mi;Z9sd_4`%8iy9z zelWoi`?*|>q}IlZtcZr5q=r0ZOP@o7f6{=nNuQ!8N9&#Q(7VpOt~6OJT(7T@cbb?` zt^4jvP(%Yqy2IAsY4gJ>PF=?U@sdK1xkbPheY@-c4aHxw_X+ltCp44=b@qLrMuiPW zHUOc5im$fjoo@YirdfZ@Mb56L%1so5?aJwP&D}Rr7A`CHAa)iP4wzK@wFoH)u%tBR^ByJq?8zU`c@Jy$g{9DG#u zXM0I=$*Ev~hQy96WBv4J zhlZ53a<`yN_ZsQCq@W1)P|bSNj9P^l^ljimGnaAW{q#$ijhWy5f$4L@6IW|42SqHH zZ(5i$ctI#aQjKApz6l+AfK`12K53v<e-d1yIS2PP3y{h*zLgo#ci}DFzIkoD^p;- zDpsjN({9(A%ij}_)!?QR`%E(NP{W2akzb%!zMxHW6pEon zz-UHa)x?Kv@mpe$M{%RfoLSrneo0qPY8BoU@(}Ttm!$_h!<2!E)kp4gHr012)pAou zX+dEaFbI;A$}IaGyqB9gcbTc_z(xS+YPX&pnib z`Mb|Z(b`n54bH;MAzMB@B_sT5Ae4zFJjScrJ(CksN!TkEp93{W560}D#B!`+TMB3CcO^aNT#DoU!l3Te+iSNAbsQ-zRCOxQ>k0=nc*i=;(aR!6 zbX)iMhXS#R{E$025##K*=6KYOB>^6AOolTC=30^R=(XfhN!c0DiZr2ek%%ViKw#Qf$t z#4$2f*8QkAN3xn-l;1YQYJ8gvPSbeux!fWbrR>wyUY>sr*Sd}b5F|f%YCRMMew+n& z9Y9-pBjf5hXT#qkl^38z3_cbK{b?V1s6l%D4$isKQI3tzZ#5d5@KJ{ysKamSm5~Bg zIlGA;S^WdBg!+ePmp>|iL8{>vjFBZ@fVdv99ZdL&X7p+q@o(9mR;wCTQiKBR8(TYU z8!RhTQ8Uu#(-%9^N5{sl^U6MINqF`Aq=*d+2X+P&<%Q?Bi!}Y>Szc+vt~R+Hw#ocH zA~WZYm*j6M%llsNozy;IvzH+Q9c&$R=B3j6ehl5WxTc7+rDSu+@_Gi%gLUx`^V$6WEkS`o} z9W2FhaS}h$m&6&&*8rS)bDr#?t2>u7$OB9cJ71P~vO)sb?8UwufXsAC_H%y7J_a^t$e)IzZ`T~Zknx}w zUu+CgEEs-N62E2sBtp3>QeW7Y$YXQ%4`Ts$4zA)NXfBuZurNycY`cKcz*1eE)33T1 zKDwbR{InaRR+{!#U7J+7JCtmz(dlK9Z1FW70I{V47{w9%sLl5AjRYMY|sJ!oKR zU63pKDmzh_zn?P>yQxCut^ksk9klN1NU#WkAla;8AGtFKCJX?=q-aVQ#;w$gwzrOq zGzXY?EmxSkI3aN5C{R>N9_I@U4`w^*+d0R-0aA-eNb9)WjiPXHHOww^@5$QcFGoaE znZg%!;>ur`-MRSR4{-&to#Dmq-I z56h9t1j^S*{$3~K=O&K}E>IB#LY@zMQeSEYf~0=)gDSL}53z=Y_UByT>%r~2u&TJ8 zz(}uix1TkMk!muH<%BoQ9Qk;hM-ZeYCiC}Jw3oCOP)k~Lg$PX86HT7II z*;nW2OKdD#daQ6MzF?d-XW2{GOGBL0)Pou&jh6HW_-?(A$3w**KgOSIlt00v6KnT; zWZ5cGO~5zYZdF6Z7nn5Z*qJ|iq>t3S%&RB2Zo=Ysc@OoF%|FW&FAbx6Dl(qPTI(*x z+-cr$b5rQbF>Nz{g@(SggB>LkSetti%mWGF`r6p4?I+F#hrfQCBwuEK+z8dfCL`}TYnI0K7bmr;BM{) znSCt~1N`xM_!kkfyi}2+b@HqjF#YtCL{Uuyn6Ej2Iuj)^rRC+qq|{ft4eeWC{zclD zg?g)vISy4Y>RMvJgV|3GVYpNID6l)Vk%iiP=ZQY?36 zA6|h$E5Se!uj^77cH_nc!35KL(q%Qcz+_+U@a=aM{*FTiMWlARf8qiqX!r~W!S*k_ zhFCGZiVyvOdbNq&p-KJl(^id8h1(Oo%n2Dbv?~e``^8v77GYnC!yKTxq$MXO1CMug z)}Lj2~K<&SM>ysz@R|U(g(^PV}A1) zayQNBsCIMkCOA9gE+Ms;Q_F5!X81|{p@?U_Qms_oKgBQgsC4$ai)L4#YxzwGGPCL5 z4cOOfJn*HrZUpX3r1!?y1}-h#5qF`W<#^u2SeM?_^R3Hu*m7iyDCL=^0~Ch$SN1SH+M&rQTHc_D z6y|mZ!C`{T^U*PYsSWo#RtFP4l#krl2yc9F(5Q3QBGeTb6fBAHT)_BUdgxG3669zM zdLc9^xJCn$&6$6rY_uXlS}$ zRym-Xnu%ELE3G_9wBBczZ{68c+h`@CT6**?z2m8>;Wwz$hXxFbe)SNnsE2s;4yJ0o zsS;UyoNp!*B?ILX^~8-6-L|YuejqkHBGtcB^K(J13ZWfDoFNmii#Tr z%-!pvZ0ZFu5tEd1f$#VHgnVxbFtE^@ec7BRXgnOqD;iVY zed?GgAKl2ulW~FaqcC~pBc5qOW!q(gah9#o>Mj*u`ThPj@qPfW?>9O+%5VcX%ZYFW zc%Ab3>X?YcRLiCNW7H&G-+OAt5Z8_+rkE>>~Pu<5mR(hlH51>Kmxz&YR-u7j6b?DbavB zgmYLQW4=u>!{QGD1W)Km`rB(~2uLCmb#-<7ky*opY9W0&Q8P^C2%6MF2^*S+7oF-4 z*;`iq(SV$#keYXIafwZMC@^+>N*))~%QND|(0n|1svJ?F(KPUn$#)O6)E}}%;cl8Z z7wKIVL&Xtv99sm6j0P3+DQsu-;06EsU@v&^a)Q|Va!o;7h`eYzeeLA1!$04bsDEb2 z8(>IRU0EpnX2X}WXl5418d$?j?r{6RUAHKAZ~|p@M|nq4XA%t|qq-Pzt|nK9h`uem zIIZosi&W##fBGapSlu>9>yx)La}UC(Jg{7RsEykt-A&lTDJZ>mhoLWKo1a*BbkNvER?1Hi~Z;}dJ(qf;EH`m7`0`_$0EYcCzM zRM}MWt37Z{g?XErze&rQKp`-C!i$}o z+$pi`?hmKJF1XW3%sgOrFPHN#5&|>8kGL|1 zMF&&)>_7U5!QK~F79w&JJhY~$NKFA&)Sw~@E~w7x-y}l=MxhLUS}~7<2%1;ewtf5U zsS$F-(}sOr|LiQBY4XVwnBju;CMPt0{Y(Hx?%jL$(8LUTl3)4Hwm#qtn%Lj?`tLUt z{0DQV8He0%hOz;UN(Uc>XdP&ZYI4KDfB2kTMq1h}APDNiOalz+9e`8=&5c0}=!S$Y z3suAa=)!w}+!Q{0r~$a{NPp4!CV7+pe7>|CNErwld8L+-+T=kTAAl4JK5%M%(trBg zNM0^?1f5k*T7nHtE*{{XAfB!Vz4Lf8q>1Hq*2b?2zPX`A_xzYS?eNq{WbtIaw0 z8R|;J3WhnXseKCntk>u^a-ShA5ttmGF;5%$+636jh{W=FdzW2% z{CESNcZz7q1B+9>O*;62^C^qlxnoeix~ltd!r(8F>j6NRt7k$h`ha#eZ?D<4x}OH& z*S;-Vn`_Vb}PelT;XE%du3-1}W0iS}F|o)Jts0&11kI}h9YCr)%l zJq&mO5{7car2I&oD3d=JC;f)TU6Z+@s2$@Ohu$&H~rIHc&P^RZuM# zrWO@>3d1<#ZK14lG$tCUBi%>J(v}k2pxCI_E(DWzuF};mwrDT(4?Ks((ru)EBn`?z z#SSAgvv0G;D$#T<;9_WZM{{vN^g7M^$R<}6r0;}A0}sY^6wAoFNT`@Sba#O4bz553 zJYXfPjc$LStyHPvmQhS;Jfq7vEZIZC>U;9Cp*yG&c5Y%wE>I^h+JbsNr;&3Hd5o4k ziU8dUrcuyUpha!~F_EjBI-|tAvp%FuY-jrXpTxCf5P79}%K7Nn!shq-(isvvMt(~A6sGi`CN#8ZI zw3LC|ITfkK>h$NRBZf_SD5PUBLZ4mnu&O8YH}8Xjnzjmii@HqxgO~uKbpWeH2BAA_ z>4M2i)u)F+;V^gtX4&tJp$^7m=Y-P6+Kx7yAfHx_#oP<24frv6ZGPuOSi8WjS(uA( z!>5@?EzI`;!T0QbVQHU}wm)(^C5CZ*H*98M!CxV83?}(bU&pHtI>)h^E{fQf;=Ru} zg#^EJkbSRL)}@ZhLxg<8suW~UDhdLZ zPjG%kD;Flcn<;<$1ugC{Z5SFkyZ_r2Y0J8vC!4C>Xh<&~6hh0>68{=p*^<8fNr4Z3 zGUY!-{E`dO*My+kQfJ<6-x_toI0P0XAd(unR~D}>SHOhHHn9?2w1aihxlb9z1BHft zsv>l^VI#tzFwov!mi_uz+R=Q`jyM>Vcp@S=)=IHn&q*U5olMO(>%+ z8>_BauR2o7lUCxyHiwxguDe>{cg{(mB$f;H7yFBEyu*{TdFR!OA|>HbT|!>|Zw#zx z$6c>t?$133CH{1m%gJd)OYj98X@8Gn2=XdR!&SwWB&U_F;7vh)&qAre+gi%kSh}O6 zP8C3}-Yow%ZE^RaadW{45BxzfS6{KDod8|D&~#0-qV}V zv*xSrU>Gb`E6jz~#bx2ih2*kBOUVUn6ZH225(W-&vB?h= zQjfKHqoc79T|-Ek){(d zD`29=l$Qg4xy&2QZCYMb2~&S1FarA-Yi4|pfm+Vt$Klhi%|3o=30}=ED_Q!KInf7E zM*`*IWQe+R`Fe(F2Bm#mPL-n3%FVxdb*jXMF$c0^8)D@nMFUuIz0re|@(@BQIV*UQ zO=Y`4!P(8^gG7e2W~`Gz7>nz}+uo0TAhNnsji^?v)f8&V1zv2PR1FVz&4|b{h-!tu zHNpUNa$cS>_afP=RG)Uin9o7aoix~EsinuM*|nUZ}{fzWnU$Ze_rgz-Z@rF zW!Eb5HoJ)Hzw}oKsXhhG*EzV*Jzf5Y=twDv7aD1UI5*wl8=<#J_gm7DDXnMvl8 z!IERj#;o#z{ybY3&Dgf4G5szP^83$dagB!Q=wfIf!dBt;x8U3nbyq2nIP?*(HCr!2 zk6yM;Lm=>2x2?hdVeieusa)Uw;ak~JNkk#bT$)V{=CQIGM3OWTb|n%*=An#9OCyqL zM^SA(Ku*}0+mi3<3T8O>td4BJ4ynnpEvg;ADK3$a2LcY1J`CP&f3e|q_LOT|kLpgt6A$;Ps2pxR&0M3!uWGXLw*%gvh1ixBA^5 zJv0_*;(@Q*$b~hn2xl0J>@>pnu^nk96UyA`tku=O{ugeVgY1UARf`=F)x94Bm7 zOA0W5G==*4&W`z=__8Z?*3V-iw-(EvsXDYt*K65jhabLt7+3g-b&!CVI!$PrLD>ef zrg{*l%M`w?S#3#pv45A^Fh~|E2WTHWc5Dx1FHjgYt<#na;5m&mTfv7XC^u%bo|E(3 zFJB1sDJm1`57j%UCqiQ>A%BRG4&9&o+IKQyhUrA1BNRP~lv_BF(i9?wf-BflmvaZi zppmxHwD68EfardpLWRsoWD|%8vUCeK72?IbZnm_xGCk&yReWu6O_|m!kmmt;Go~z% z_Qt={(vmXk+#k&dFJ>$a;7fo2I;F`6p(tYg%+$wW889^EAial}(x}c3`hE6Do(|YS zzx}Pbwe?!&ZRSUPg_4u3yqETrobmKWt!lA99^Jw#&i2}#nZ^U9tLZuCb4-NPStOHB zt(^nekb84ExD#1fP)RfTiaVk@!rrqpaQaHNM#7vJ5XtXO+K}bs`7=hNMequQJ5SD5P+mt zE|gh2qv&?HDi<=?;{=0r*HFD9*EvN4-1@DW&Jrv zO~wxCYTQw2D5G_J5JZ@6$e86Gg;|=)HO-u*J{v@@eB+pW83GgjB75vO5Sv+wIMeqT ze8`5}br6_A!qN)zGNXzMFdC~gFvIr50I*Sq2nES>R-0cJVgUZ^V}GvElUM+si63!rWPu#6Uj zp2jX50vMs(6Te_CR2o@2l2|o>ZCTwSW_(AQz^NAd^W4L`qi=ylQ9$}%kaDC?$so_z zyM68s2M8c^@C*t4UT6R%Uwwqeg1y_d>KDVPL!3uQ?wsQal)CsAXVBjfEQJ_mLyH+3 zckm?AHwM8FFukxhdQp&lwmugrDA1<+5&Yap2`-3JSNDjiQp=_9uLG&w;juZsysTtA z_R}c=_@zO#aswFl4TZ<$B)% zIu{$7GQ$`KtxgJ$!`4vNDzyP>^}*4(*ydS16AHgaYj^>o#N#>6&t&^+d1dAH>!9Cl zIcrc{B~ZozWha!G{3%`m#BmukrhmN6n4_EW?WK{vgbVLjw336)kGa^Qsik5K=sRG! zvtLBNg=9j}njhA1a$5UU`&_X2x><83NPyBFl0bt?62z&Mv+Nsm9#am3=EKL?&+AKk6Rf2{mZMXlBaK|688@ z2&m(srM#^ohy0h}^@XneCasmuwKE>O-5l;^!h2iW2Q5g%`( zA}H__W=l`E3ViHRNdI$A>(c5a61~AV6+;bR{+@n)=_1STQCPz>*VFH!DVBl z|5s|`5@p!81&54LD+UA$nza%MqKzZ=(7y^OswQrH)M1+60gVTNq)?<{LV7(K6@D z(14d4kxxT8p?C#QJ>%oqNE1SO);A?*!UQo{?*Q#P6;Xp9x#y76#?Mr&PjSD}11aw~!0*hH8+K-8|YVl}0qO-mU@7#V1DD2?R zDBn`d$jyxfOW1sUE#@2PcZTVlV5p1GN4^MCWoUgOAFMK*8lr??v|U|)?|z737TixD z6*l!WfMz^4+jN%z=m^z>ZDEpM5h~F^nu%40}0C7dv6>Aw2XrcrLa_4N!v6kqsOEi_0AGkMrMl~xu4c%sh`uBx^GLE0!_LoY zno>A=2=E9cYVxotzWt*uGg~BNV)_BLxh$?5?Q6I%pFzr^4oJ|qr(81TS2wK# zk$WhTmc*(bIePd9Dk;N8xAYJShrsC@Xy>Nl+Z$Eie1Ksfv?u66&1evX_ikLWf>#R~+48gH z!;3E$J;^_$+TpDnKAMe`x)3mI`%Q(-n=|PR9vifQx-k?g8vEeRi$k&-XvU(~{7A{H+Xag&Gv|hq z%{$P+2yvSfs%J8^(XM%|(e9ii;)Xg}9EOVopaKPlR3)DTS4(QB^1A0=2or297M0%+ zSba)34{F>l_vtN)#5FCzu08GGadb;F$aA+teXroQj^r?Owqn)xr?#Wq4rtYLYHeV( zo$%J95AQ`ue}YC6dVp~F$Lm4fc=k^FuZz~ClgT`H|INn#?`9)k{}uS<(7r%@y6If! zloT&&Yz9gU%&t=iJuvx;t)KJIrJOO{xeiWAye=~l1OMAN19fS~kxAdXT^wGz?pRh5 zA24t5*vY>Fj^pGm1h{DJU!%%#qEby>LTE)6Iv`J?EVt)ue`(v=6A+?|4|* z;bZ;aQRn#4Kd@~-`>ylM=*$i>hUhS(KVC$VWBvX2**#DKL;N3g< z!k(V94z%I!MxXI8#&67Opn0eq2xr@ZcgoN zJ|0RP@BsC}J_E*}K>?&@GNjF*ynbTrDB_eK-sm0c!y1RUNzih~uC6YApRppd5A$p8 zqgGT)K?TOcxxJzCMv3e|j$de}yRx9{z<@AbueYyIEP_1t)h2Bzkv@DRV~h9H?cwXk z2N1YcO~y-5TKTlF3Anq$%F&}po^AejD1cgjv_J3Sav4?CDJy72rn0hMDKABXyfum1 zBlo%^;}uO+-pMr@Us7(g7bL2(2KV~SWyzM{1}g#Sos0GLN{0XwIy4lpcg?usJ-HpA zaNz@KN%SWUdRrkoKl$CTDdyFGyyR>vW1^mMB)7-NJq4ckox;!h*$;_Jkxdb1-fQYy zo36Yq3Ygz-9~F)|H5~0xWW(t{cAwRD7Y9EiSi#tM$ zv(p@+KL~sK*bG-r``VG+-TQP5=s%Bk_XrL3)BRfqZy0E}O$;nbOY0pFcJc}GO3CT6 z?4ZBo$jKBkor_9q|d5dT1M80w7l%8 zl5KeqS87ksDb=QwK5B2xtoM3AY(LsJ`BTBN(rbBQhUJ5_y7Hc&}fy|2n?QMOd&Dzis%4EL84$GFKA zZaKi5bDQ|)UsNfv>&4A)(QR7OeovzD#{mi6h1Z+lYu-^&Q$HPd@$spp-M5L33oIFpsKfl_&f0N$zi4izAMGVSF8YAd- zS@*O06{jgf^XSsHes%T<^+StQl~uc%IB!(aWhw?Uv?D0{H9vcozh{oVr*e~n=;wgW zQ3FQ1rt>kAiXlb%_(koJ6F1{1;&cM3d@$15@9eAg9V-(|b9as^4|(YA33Is_=hpiq z?7_g8kdxS*)P#0rQGVmWx=d}N3*9?4K~2^#_Qw6z@e|%IlOrBn;TUx*KK30KU$prq zFS81E`y3g)yTht0-+13h^h?b=t&r=onASo|7|s3>5L-u$hYNQ0l|H0Hdj{d zeR6d?c^zxCa?003lsk%oE>+20`nu^aWvg?WT!E3*2i7}0qCLBoF1_fcUhUBbMRhBh1fB1?5a0LdGpCjIgzr;~w)P9nA$AWhub}}R>3WZ}SM_u; zCo^68*p>%AEe%inbSXnzS>5;JYM7%fO;l`gy&czpMk|UZ(kjQEK1@p(u`7wE4J+VV z1c%*(oL=oodmQ0b$FfttgDaLgRx<8RK))T2`uBs{Hxe@L&o5_<^5&)LlFr5WKRL}7 zHhomAU;i1{l0~5p+cie+xSrkT!;p)pr?`3Dt`Tw8$r{iYoF_cg%|ICJ59Ix=>>g#5 z2{?8MzS|>6&d+ zPhLFjGsWR^CYg3vxOr;4^l7_#U9Y%Y)$oXq9VPKJ<%iXaZ>SLmkaAxh<&KixHgae6 z*(fKG6Ozw!i4D13BM0wr(Udx9m4nfNMLt7SCdWEEX+qM8s^k&V^JSKcbYIreV>`V& zTIJZ~8j@GU+-Mu>4l=sEskW50K?Wo5NPqRHBCA_9=G1qSGiyDB8~UA{%3pd{7AdxS zZg6@?4k{ONtjtvIvgtk{X4INR%^j?3@eX^+y`HotM3;VuTwg;|r&|yVVn z-Bh4+gJ}=Yq-D1)iK*Y%vF(h~S}m`dAhhrMZXKwgsmu=?J2X@mVd#^aL)|kxVx5&reV%8N zFpwJ{D6xJ-BMw=ZR>x`@eaPnS#umY$QxnL>xV5|78KUSA3lEu@5Q{d|9Kg@6M2$1Ei)5!q_>4t#Jo4cr zligm@rH|on2X|+unfGtjBL(tGzwf-%Mwh1J-EaW9EnW3KkMqU{bRCb)r7V?U0M1v9 zC}!?Yt9GMCXoqEN`M~--3clipyNG+J%AtBnZfO62?Y{cB`xW6%9qJu0AvF!1&YV2D zt{NQbx#lwU1{6nL!o?-AtyHRqSkY?D0TVa9n2wq*&z!*e0DI~^ZxzPpP4r@F?EyLK zVqPv9I_}H3A*prYTseE6o~H8S^L>XhqsPOh(F5WNDDJKP z2?+=eMgMmAC*DI6882V;{~iGr{J**Qzj9xEP0z_WmKzR@Juf3dD-HqrMru<5G+czV zS>0~S0mSGhx(|+kA04HV5I++T`A5D1S@N5J2b3!Mod=-LV8jj42BNteP!C*z&Q^q4 zVfR0Qkb6x;E8y{q084YTp6@L{-{g_gcoJyXFF8=ZiSD*$o<>RY9^XU{Es z6DPhta=(P$df5J6?scUD>o;_d&B0oQoqwt}Y3jPPBaJMA$7n*za6$t2W-iJgj9lF0} z^tY`r*L;#Z7i&ZPTv#Xq9wB-BSDk#`;jj|OyMlcBStMI~!0azFk|k+wZdT~v#LIwQ zTw3lNEPeLBi#mV){D+EQ|KKK|OcVfzZ?9JXy|T0xc9M{@nrm-7bpdvD28ameqkVqT z-UnOR@e!_W5*@J1J`W^B`Byx~Ft?uwIQaZ)1fH{iQN7ExcpI*Je$vB3pqyYpJO|%k z;oM(1=vc3Z)$)T6z9mRMb)|K*#G0b z1sId++S-)QbFc@q$Ci!+HZ7o4$7tha*@v4GWuj$T(Kdok6n}_dSCwY1FGnj5YMI`D+5mSf`QXRY*G)ONQ3j>cnvRi;Sbp$l^X7>>uUUL8qc!z^YU z;RG+>7!`nEKp*H&?zegO1t82Ja2^+^VB&1Ep89nNiqQSRI0yk#K3{#s;{d4fEVW%6 z7!Rv^4q6vvhq}Lj#cpY72?6M~^`fpXb#*dGwPA7*^Ffw)hCNUvl?xyN2xQ5tmbWdl zhy#?f1vHd|_0DIhc}}i3UKL4j!O2kQ@byN3;fh}WdR0tZW7Z%|Ymq)K6wmwLEliJt zv^<<6)6u!uG+BXZ^7^cGUi0b@c${9R1Go}3o;Ti&X|12NWZBvFe+JlF-?9%`Dp)W) zd|n<5G6*Lb+hD$ev#xqDFO8h?K@}%@6+|^W4zY4&z}722HI%!k2H~*24~tF%38nAm!*U<%D5D(-a}*L#zf8yBCDeFZi8VO-Uy9Pan*6Q&9XI}F>GxHIc4DDHlR6bhnji~h3Jb%^D z-PNUDU_hk9Vb(c)Ln>E7 zM;b7~#x}>tk+9i%8JPpS;TvWjvT6Wgqx;KxKKI*_5`7_F;J2B;l220(nfG)8(SAQ6 z0Us952=IIUBb`sDEM_NaAP=w)E!&sw>@yU4kq;UtzJ!iyB>|76el7^fOI!$^>4Lcju4 zFZb!{Vy|6i8LqZv!<(Zvt=a;RWl1Sa2~g=X7Cj3@<@ixIpA7asVMdUHsxnh~@a|)hl=%Jjn{}r#aZypNyhly%Hu_8QJ^|+J{N)7fPa) zjldM!{)FgnlWvV{f+DhX-cF=&hvJ!k{~*tM`@UhA9t-%Wf4l<11R^~IQR@(^IlJ$z zaI-&Cs)s29q8g!ij8x3%ey0F zmLiw>R4Oa4bf#5Fr`~IybM_PHE!4 z1`)=^NGW+l$)w0(W!y7om!M2CR7PBe4SRA`yg8GM$AHA~Fr$5mBY!g`6_O)gXIL+o zLVR_S;P8f)y96=PiUN?udze83@oGv4^s0C@o-0RcKZJbGvlSog=%8#X=eX2p)L3y{KD-xJW$ejZN;%aQ}F$bw5O<u?G|%m5OK$w;Y9l;v%(d+z zR{qX@x_9IYS7!Z|?9Q&!xR;Fc2BWcQP@Ny6 zq9f$S^~vo^T~W7yW9Yd%Lv+zC6Or2*TolK-=VINQH4@W#MFyYb7QyB%ekzg=>^A1FRTjC|1Xd9F zlwg^%AEqDsIbm?T5j_Z6&>z_CHVRFYE*of!{cwA27{uelpw&Ox?X=KgyK8J6=qI#B zEWTC%LI;B+UJ23(k2KZ%r3j9)ayU%+qM_XYv^*`9B|B{k+qq11BUUC#Ntt3MU4!XP zH@kLI9mK3%0ZxQ0|Du_eALsZj*Xxy%OV7~^_S5gjTm-PUlQLVTQvF&j>rvYRSP>f5z4pt``DQMF%Nmw5D5TUoVf- z)AxezKM|~XG?3n3KzrL?SaVQmx|#IIw-QLMOQEUqFKz`;2nhjlqV@bw>2QBD6G)Iy zfUs9fc!p2#UcF@$waut7*4l-_a0ny7%*?u2L6f1OF9`hrrGO*msd{YojZ@h z#r2Wb=Kv&6^sYOz{1Z(aba;lw^bfh3{&3>zer)g2w#E947l!etnKqZvp!@cDS9oLx#E7yQ$+ z%nEql4=E^^Z62Kjh)OI#haO_ke>~|d%6r0Kz_H9jd^(^m!lwy>AkK_|%cADlC?yF& zL_G?pQ6T*9UoE)N!rU3(?QQMs1du1&2T2L*MVOq-jMEsbY|1bF5!!cNhA_=~5iS-r z427o5=&;N-@#X9FVuR=e`)bl@A9Sy-#EwVLTD?t2K)@0PFB0RobqF$V;eb@Mmz(vI z!4bHhmqEVjLHPIY0pxh8eC+j`$<@{K?M?fHE`(gha@~hg4R2q5B?Uf9ZK z>O%mF$uSvd%CV7365HF``*X;0`*7erZg2@^ruF0xDk+edyNm;6VVZO8uVmv*05n!W(!n`zfJSK9F(l&^v%(PEWlyWy^gLC6q9eHy4Ke z53c6IzV}W|5b%O4Z~u*9Z6|3~n~=_@17w`6=YK_{g8pQje$(9PP=D5N6Bf$jgH_@e zf!7PU2Tx`Uwg|I7IJx|@-k*hpA(D;OpRRxKB-g8-|WJP$?u&`D)3COu;w+NzMCb!k0>2M;%=6H%~&B>PxN z3N5Z*eBodRiFX<7lt(KC*N>M3NM(U$4~p^+{_^SF5NM*n7%q{Ao6F9)xMU(H6z*wQ zYpp2*IdcLl2}ltJIP%OGbaU@rr1}M*T(HVKlgZ@Q><~$)+*pcXwP(aKPC>#8p=PYC8D{9nJi* z<>&Ya`MiX8yc+nq*y+hAY33-(NB!fQAQD2&e=!~>dz~@|kQGCjd314oR+x`si$I)28=z_@ebHH4*bgOv zkW&IF)~e$TCXafe#BFh4fz9;W@X!UfTB_*^sazR#FUL{>qVyr z==w4S*E*i9b9e=M1a9up=q`uzwv$yTxenjrY{C5%{;w%J9fDWt{xCTBtRi*W>gZi7 zqxTh@HpY%WVQxde#7khYBmKaknl{{xOT0xP>C=4L1f@k%n&ko#?EMoQlu{O8dMq8K zs~}PRfX@*nL8ff7p{I_VJt|hM7D1L2N-fI>ubCywkvxs1*gKXN@r$ooZHl%R%4(y^ z(LtzKeO5RtaUXd{mP|PbbW=eQOAqAE!7=#NtH;qz8ruS0Ki)qudE12&_Kz(Kky9vu z{FK9(xB&C|5`;B?5e>Fd! z_Qkn3BS{o=@rFk%mAnnkj)k@LLzFW_g(0s$pdmfeL;KbD?tyHac2IItv%i!B$~2;* zB4e7}c5^MJ#kw34rLJ&(pClrsba(LAxw5TA+EhWm7tmf)3ALV}@F>2J49)Ozs$3qX}lXalMjqq@w{ zt#RS%Jy;tH=r2M(iikPf2QIdQQ zsf!~Z{_&UEtzDxOC^d*YV8;YQem8Gc{V3szrr6CX1SwEJk&e$L>KYW1H8ij6f)A=b zg(HAcs~pRs{c59VkjmGP4A*uf8~{sli!C1(@LZDE7pQ$D+(hjd!cKradg0Kd+XvRQ zV+n>Ou|%yn&Sa#lDgN`nTnHk<f=BX79?pGPFN|@r61igoM+sY3OdHCwQeO4oqw9|MZ*Y z4{^|Xs}YL$Pz~{Y@mo_T7y&yeoKKQzvgTppXMcB&q~1zITddRz^l#X|?tgsuR;7Yn zB92N`Q0xBfKICoM8)tD(R6k=5mdI*3@{1F{twzP*@xH}Lhv9x=`ELqjs~_P0#x`u6J|jpw_*dV$hdw!|Jpi>1)0}wWnX>^3 z4K}8P$hqR04HOO3ru7$l=Glp|H3vFi;hsHM(=rM@VT;IzD;}8Wg4WMFgV9$=>-HDM zg4b5aDdd(rtfXzn6=l%2j%d81Sl1@Jnk!^u2j>r{byh|76lr>ozxXD$j~Ko+au855 zCJ|l3(35Q`Fc*dgiV(OLT@pi8>O;;!H47sakEpI^bldrOG<4=<(g6d^#brGFicWpE zGAE(kO}OPTdrX+b6r-xjgzXdWL?G(<`l}^6GOSv#OFh~;;JMRV90PT6?Pq{Ey`})l z^f_NTD=X}nJy4>0BAI7S03@{47q5$I3{ttN1jH&-Xt!{79&+O!M`?1Mr`PP&HY`HNdBA&%ngczt)H zLfhsxM_PPjLc2#t*>)wYo#>fq`<N zO=f;(KEI>C$R7=I@k4EDK{mt~iKZ1Tu7;ruox-X2fdl98Xk@X!7l!qD4E^ouv@79*7xGTyMu{ z+bXb92fTn%JN_+dcyVPXskOAu=exX>*_&i}{OEd74LhL2jpA?`l*QDpW5Q0gZ{pJw z3vh2>%bBIie{ddhza_~2Jw1S!hLYG*c6R5=mSmTQgFQ;gbNzTM{ReUbtN-E_q;~&6 zeJEj)zB1SWh(`j{wTfBE8Crw<1@n*MItp&IE_69q#nKpIbB_KUH_1sK$*)}+_Fq-;=-WV$9 z?sApu>*t3IE+-3{OW{iYD>J}BC z`nga}4StPJ8=-k>e(2^H8mbIiH$FFv`jnPVHfC^V180qjc|Qjv7<`u4Dwva`pAyhXQTuvA zu))#!g=gzT^L;PQn0a0~W!6DE)B5Yz6)s|6v|ycTx^JEH|N+UqU>K0>2-&$ z6L>#uamY56xgpvkDQ3~-{D`&|nzivXvGuzg*DFKtM;6xLLoY+VXUCpu;{2J$WWNPL z<1qli3`P;a~C7`|+56t(GnODj82%p2ODjgaNiVN4sx zh9ydO)%(x1FJ1D55MIXx;d07#L?nUq7|e}`qp3qf&3EPm@MsOD+AR?2c>UMN7TPg< z3io~d;u=AiC*h}KKBjN^6pk|X``Ez4XrTmkl0ErR9r955vpJ8AlH##m3S^O@#d7v;eb@O z9vRJ1!;YyPc5_G~ga$mq$St^{gr z@-lTmA%;p{I6&>+lW9`OpVR3vcVRf_sooxr#{P@lX-|9 zK-KSK(rJIApe_M5c8SzB^$>iTcEoAwVWO4fD9rVT?|%}d&UTHAs)XH@KT|B<(X^w0 zIHt(B-}zEL)IGK;mM90vJqYn%Cin!vDqe9x~igNSfxA-Ft;E?z-)~! zW;AH>Gf}-uxtff1T}9}Hj8U;iCd(3AeZbv5Hs0w&Pb(rnF&A_TV+_|%)C}0Zx<8_p zCl`8DcT{zhLHA*pWn{2-GdJOU+I$3axW45y_&-5Fv?mpTHp2

0^Gg*e#(rF{*X z);(L9O^7}jaB~q@YrWjw5%DuM_g=&-E|adoKWhd=e{<()D5Q;djhZn!eKr6DuZXdj zcAP{exdQlVNCd+in6Jt6mf?5gxwkWvh2ZeCd}tXMaYea9?oZ!Xh=o{$N&S z@#m`+-k*FGmlXSQh!56jFvbTO0c*r02a!J_#QR8v9MY9`MovxZTl*6)1|*c$ z6F(2CqZBlPZ$N?`f{ToAW&==>>VV`Fw|=$81>7Rq%e}?gH%XTj3u3Zq1>9mj;|^nQ zH?3}IQyY2*va$P9ybNEY0$2X@-r~L@St7q3;COPc>DEAb8@52ebdEB9*@URS?Hm5g z0k*Gy(t`C-W*eoFJgMzTC@*mt_y$XTs1*qXn9KXBqXq&*nN_;O=3%jyn zdE7mLX55@b^|*8P(ZIP3YJX0qfJ}|>?ZJ%%xbdcr0FD4{lryNBrci=oj=DQ{a@4Es z%UfWP_cb+-}=@ zpvX>EK-w!Wt4`@|ZVKv9-suhn&|%7A?z9?| zU+O^+@#v^OFxM02nru@}%}sYuQBXTiFiO(D6_nmpDci!S^P?Ae#`u9Y7m)^q1~c7C zZCyc$;8F1SOAhaZBDgYz7QMxk3D_li`eb_#K8 zL)(t*EOW(O7v2lNJ|U((I9t#5tYFws6eas(->!(>0?jbmk3G{`bV4^H51> z1h#dvBY$`vNF^*@PSl(hTH)32?nkXbB5bH0V+xr9{zlK8Vs$#e@Od`eJaPl-y?Yn> zEGE_K)QoBMoDthY0O-}NxJ5eI>5#BR^6k`Jb)?oLlyP(@f?^Xw-a>La{z$a}ro4RE z@vlg~)t8iEa+D4-OAb~C7<*Ka&r^?7VW0(iY2Kx}&g3-JZNhP0!-x7{yJ#*}U;>KZ z&e#C^FSGxNp9R6(P8Kz-fF0uhUDAI^j8y)zn8({hO#I7*j`_zVBQziR z+7<+H>kkONYo?~K8gvteJBko;)n>Rd6G`@{hvB86n9V%7#4FDSE`0lm?o{>sA01cJ0mVfy23Wx{7G z-)y(jDz~G@Bhi+HfCO}>INFwxrLRrBE@JX^2GySzC++Jy#Hd1v_oRf|P%O|qqP!27 z0>gY-gh2Yy)h*(?P(6cVu`Tqf7i`|NF6Pbl6vDcWvI9Oq8aR(m&aE@6_e7M_FZw?g%OFEDKd0Oa^k&ykeE z=BpM!XPd0TtNe%gN-QL6i2?F+-Ph`@Wzk7o3g3I$*BrC zGU_P@MF~_<2wfydgtC|b0+zuQ5aa#_roi{hPmmQh@kD|kaEU@(CCmT_*IV2hXh3;1 zP>KnelQxrH=X)4^lId60C+QEZG1l47(>RCwz^IxlV5m`bT0dtFCN$&vh0fKi0vZ0P zVPgo@9W^8aaTwct90VewyMuS5sN}Dnq7`z7*goch3Q|8sSHCHaF&0-uywX72V;1*= z*SikeT!ZhMPgBip(y^a{STU zV8f;mfU%~kecW}>EX*Dnj}GX&eZ5tZe)mdbg2wV4UaII?5ZgL>D9|~NeccVxpMPvx zNE85uOLIN93ysN4%;NgyZ{23*g^@Q**JfH3>~FSw^&KFaFV)HQ&X2gw)Fhikep6+ zUpZdv#E>XJ9HPF|eZ=cinqS+W5i4i_=Yv_%Lp2&h4nULSfgchABrw%(s7WTLm-3(6 z#45Z#alFHi8!&YsJSBTV}OV+V^W8EO{e@TLr>)*@oU)oKpEBN%}EsC;GyC_D5LYWa1G>@W^KM=I@yuBOeWH?sLYgGxvh>uP&H{d83LwL0mcC{|Z=!Ss0;_h(>Z zpaN0`86AX22-;>W>1{!j3Z6|1L$G_!xWO6ApQ3HBW_EERe z<5Z&0uZ;Ho1KYvE7wv$??2~JA4eD?+R^$regvoE-Y%F@)@4XA+8v;YEy1F_UAWjhY zpa#@G*GL={f6)e;+zovTXfgl_+tYPQnq5tz&EB6I+rc6L{0}cQP`bBEDdPhoMr{7^ z19fL#V={@7>H1&3)Jly6=lNa3Q`b7E`yPx2$lW9wOMbH4IK7?zIn?0*qlb__U&`W* zJpve8BV0etoQ%a-K8p@BW7qs+U74IS1fGWm=?{Q(1~Y8$L;$=ef*2i~ERlVAxd+`= z1?)Viu>bK4r6tcpxvXf|&;xB%bgP3uk@ER|>r za7T|emu<+`XmII9^%Ef5ZTVmJQzZe_)}bmJsuCXurQT(zwB)U(igm;LmprcK5_C)AVdJ~{6G7b2z!Hy^$=tOS9Jrz zG%>Lo0GRvVra2G1kaerR<>jkB>qc-9LS)I&&fASZdI&~_^GuHF@$!L;y z4}?Adq@7~#{eDw4Fr!o8Pd!{I7zSLVWkyCu1(VanBH@Xj{@uDfLtU8A!5xD^4jk|tr7tZLm+k2--fdJ=s6- z_Y*pSfOy~mnC!MsCzUJf=siO`>}giu?`I{d3g0Yut;BqR_BF41%-;Tg`KaXEJDn`V z*Us_vW1-Tn|NiJsu?V4CI|3IYBtE#lX+OcmzyBI0uMm!X+P`^)J5|qj9Yny?b4f|& ziAv~hMF2a5ZreC{`$Bg}mSd9B22|F9lp~oBS1Nf*$Sk-9q(9TiB`}CpTjSymXydK# zw2zQF-?Q_qK^7hwM6#TbN?X84A`Zi4*q&ejdQmgApAW!%=L1-kd1XUSR@Sla0H&f0 zqWbX!@dyMYqy|<)LuoMd;}s4CYm}J9~?SKhiRI|t4jMaFDz(vJ9#f_ z`d4)6!)3=b*};XVoALkr0(t}7NCmgnnEE^Z3gSQiy> zOpx!lv)Fwbno%O*-Ic*)M6d-<95Di>0mc7%JR(9CJy^FxS7~J#__{NglD}BewaA3> z!&O(cB)=PyX$25=nKD_VKS>wTfC6W_P?wYg2jIUyz=)7xee8C`g|I-Nu5C3hXgqa&zc1U&N(UNkE>3`*yI>;TpdXVN^>DG)95Bz1?i%<>$YY&Nze zhaK-j^0k_bamS3|#SOtCh&lAh6@qWQ1u!dV-!j7xl^xN(4`1BmT07^p>oi~(<`G)P zpR_H&O~Y(TeI^`Pe6+=3kxkpt4tZ%Orc7d6b8Z{ZI-tq-OJIbtPFFsz?C%r^<<=G^ zCrQpvl5>N6N)cs|RK7S8(CdR*u}MVr0Mc{mG;i!iNg|JZbafP(kefk~rm5Ae6PIIN z2#~YGvCHmj{Glh9Lta{$S?d-OY1m_sR97fWu=wQk>^kT})*ICq66xJ`RV#H{!Ck*a z8!kszKKBj)-!oMd(6Ql+dx_HSSR_EoA^kEpDg$IE*|rBS4qU1e(yK1<5#FX8byVk3%R9opzVq%$+@b0tC3pytK529iVL{ME3VZ^`3}BH)s`tVJgGT)l=0m}f*706r8#G$S!TWb)x<^|N2by{<*jX+;<{ zSt#Z&JW)_G*`V)}+c6q+r`~jo42hs>8lR{gu{EjPW@t!Jq@n2qy_7MgdD&+uZNhkL zqvksYATV`^VvpZ@(b}dtZ|zLUpGgMN)=@5Q2*f9`+^|0(n&%L4>=HP<$t!0~a&lGQ zwhCT_;mgXTW_0?XUUeS_!h&8B`GWk8T#h~}ad9B4Kz**8^U-8!T@j;}NONgE)$X?( zY~x_2fMoc}!b?kIxXCyMA; z8|%&F#$xz*j4a+~5~X3Ey_0wJp1njsz?l=~4Wtu=76<3tkW61@bnr}r*8S?gxt7g8 znD|cT_+@^X#Pl8J*G>v9yv)Ds!bh!x`x4XB?Ijkj@n0hykPcYLWy>gGBi|gatFAIh zc%MT(T3^Z`da|U?opCz5CDyJ^s^vI@_VGj*>LEV4LDlXZHK#2J=BdTy(Jjpo#SoRR z>~uVqckp)83)-i!$hk_3S2DbRcoj4)YT6w9rpOF#Ap7j+`_=+M=;#~^Ze2JRRN?*1 z5=UY^y~ibK!Lq0q4KFI5Y$6XqUAE853c6G`B}V=!D31?sx>gYzC=H6}t=h#7k16X! zGtU`$=Zu2E`2^0R*ZYB$ErN^2Y}hd_0{Or$0JQn;)+&CJ%;%`(;}@d*-jdML-(7g8xrPo_+vll| zAO~RSw2r(difxdUO@ee9`G`P*oBD?|V@)6`(#C*$`;hG0WU3fwE10I8(37}h@a~U_ zzkgH!7}4*V597iT=(+cO36G;3M3iOq;+BLuK}mxNlY+7MN;3wPY<=%acAD~{-INmp z+JB=wRn{5Dm&0!!J$=h}=&29Dsk3@KeWK>deJq^l4bn`6i}xNJ_mRw)Q)Tjn4q=MK z=Ph2R+_K|#7qdOP(oexdlyutGc7q5GSLsnA&F~cYQCeMEo{ytnyn@r(k|x|L;uNf` zu?%vgKPdL7C*ZkR>N>zMA3rUUO9%P|^b~ zo?4^|*FYpRx!iAeEcAv2;qQ@6>vPg}=SjDW9`s%mw#-ovdYA&k*?l24x^HYmZ1pt& zT*zGT#F8u8_cJ!1+zNJJX0pm;m{lh_>g$=iC|^-*7fFiZv%O=!tK=k#n(2Q zZ-4s4IPJXJZIe6J`lmiWdPx|k*_-w?!M!p-D}Dd?1g+9)RRONM=FHvvI$Ax&>GYKr zc}2r*6fYXoUhC2hf`&%jdEeV&r)d1vIr;)zE>=P1A@SKI&9`jpFES%Yn_4 zBIa(r1W*wB`Pm*LGPPOGkKFU#MH-4QvUoJ4TUJBIl>eu_s}F}VZTojclpbs<>`rK{ z#FnpB45AOEJRxss%i1BHls?vXF(#DVD0Zk6O&IyeuAWkx-CAp?C!vIpt+x*IhqxDQ$i!81@W;=I`J%(rfMvZQ>hF#c z5Aab6dBOcscS12i+*eEKx1&oPE5{ZfOnlHWeh=`;q&qb0~;=wJLMc?@+x{t z6*{#tYFOfo8aHbv%iGT`9a>js6e!?)db0Ve#I@ zWvNxq=T}$wUkZD;H$H@SOuq3N<#$5ZsE}@p2UC&hC5-0FG4S=w1!&6_@AZy5Xof+k z+S08(2pV-MmGZan&THFEQ5ED~Z7pRmW1gwn|6{;4BynE%g;9 zIBARWA_h9l0wM727yhu!UKOSj`#kGP#;^T3%MOHV+UQMh``bLn0^hRh>L|#)XlHN0 zyy`Z|#;~mk#&*ROJ?($f~+9fy!p7>{MptwyrK!3)6kerHkT! zmlIX5 z!_j5QWB5fOHcU>roQjA8&v);&Z|C-u^QEZ&bm1pOl(z2eOg=S56&3R~E`zB&-s{Rv z#-6@#!+AZ;9yc-;11yYJq)p;}go`yr{!! zSj8qyXeQjvWCU`4gw4)JGz>-$Cp$Sswr;dM^Jy>4(K>gL7t^gg{*+mNIe!n*nDMN; zVb{K6EHm|Ap2q2`n>?#>*P;n_X^chv7^w(tQ9JxmfKdDJENAZXJtk(!Jq+aGCIx_3zWLn5g|zi0c|ip~sA zZXvq_;Ox?#h(Sq28@{*;l9rOP4jy{HFHw;QhpZ(Y#3)*KaySonXld(3GnF)~et7Ry zwO-u*FJ4`bRTa;QAc5>F zw1{RS^@^=i4V@_2G-QU1&d?^L5}1`=SeSxN`}PGf0F9g9`QpXz(A4x8<~$m_MT=M` zcseJOwX<=fJ8eO@5Wx^jjCCg}4J@tk7iMN=1|iLmUtH|oweKi-U*pN%Ip2qVSK7c5v%|CRFHd-pcpfAD}_`{`rWevz@=T>xIR2U&<`l?bIX zr~_ydA1z-c3{BxoC3<~g%BGr7Ms8y{47cMk88{1P8+Qpr8nXv;aR~>}+c%bjoR|H5 z-R&Ms+x&|ckCv8|)z#EE3*_E^X@b&`)~M#bbf#@LPDN;v9UwOave4L@_WzD!eDG~X z#);(QRZtf3EXruwd&oS?Id7$D8oi2D#5rM+>PVQ3L;qMNTQ5SSexUH%d59~eYS@Ik zLFTTFlR5N_G)J{G_8WQ#TnM9Sd! zc%iVahMA%FgvZ@Nn~1(1eWo(5#F*|s_2K5IBFqx z%2vwiLHg9x+WLibBDG&-)ME<){{qYnpU;ifhGL?3LHIzy%&#a9nPH896Yx>sG`sL( z5rWQbFJGQ-SbmTsCKH;(9e1HSS|+0?d}3~4VGosQBLG(7!9?A>5;B53)l-&I17gsS zXwpo+cGT(OkuO^bE{SCAA&}W#U61TGvA43LFZ}t^rKHoRPv@pzn>u?7-6q{4>1xcw z`erVBcR9Rz;r@U5tUSk!X=U|KNr1W_w0rLN@$osxt+JIUBl}^gq^PSg%qlzUX1GiN zcMcEoD_Zd~5YG9?K-Gs)kEe z4h_m<#_--rb1S77k@M^uH*WM`=V2>l?hFoI=&)u@7H&?+$Q?z7!OC!_FXSk)F=(uG zRt&_8)&eJouwlz6HmJ7tb+`I(IEAkNyRYUau!L;4$R(zl$WaEEzdU5^XfcUB#vcR_ z5j;FTkqv?EAE0%+%Q3RlkUzE|tyOOU}J`yEtN&a?KJFA#Bn}bOX|$KnhTqgz5V@-kz8^)bDE-(`0px{om=RNm_qw9B;;!W zY1ko1iSADev2z==g%DwVUb6CFuE08U2 zcM&922Zw}gJj*eGlA*&LVHZ!@gQiWuvm0kt3MIC>y1Hb+>d+R|5%1>;Q{RS)AD0r~ z04AZPq9dN7bVe)ZuD-<2Qyp_Y&T;R{=M?Zz7_cE{-Hk52uIJD1XilKuEgKMTnO>L6 zjDT{4ERPaRk^H^8eKzMMoLyo{N=r*^QSfH6KFm%I{@;P>j z7DVjgCsGWjcRAK1+VS*2p=;Te??2&%=tLMM&B{XvZIr4xb2;}9lMoncrGByKEXR1c zR1K?;1Xf{)ae%+wo1$F}s#T4}FoE?x>j}>QD3pR+{m`~Rm~D3=;NB~g5N%%=i`wS{ z@s{^rmG<_A@c4WuEF*0=vni?wp!6fZk=w+zgxj_0I)m9xP~~_$9&N)2Tx8gJvTsF1 z6u*gkQr;L}&9`yFCg_G@&4Pu!Q-n+_yp9i~RRG(euvE`rdv(g{scg9dD|6kpB|JF&^A7xjr zwq3fOrs6L}{RfJ{fxoKgeOSB?i$`hwXG=G2VGAi-6uZ-wc+8)`f>5A*`gxLB0`vi( zYV(jer)~P%KaMs|eCx9caZRaA5;>(m9stf6{{COE(`tGHHo|L8d5Pg_Ka<<8Ug2na JZkfmae*