From 59fc774f0837bf5293fa1866c81854a6e1836f9f Mon Sep 17 00:00:00 2001 From: zuevav Date: Tue, 15 Sep 2026 19:41:11 +0300 Subject: [PATCH] =?UTF-8?q?chore(deploy):=20=D0=BE=D0=B1=D0=BD=D0=BE=D0=B2?= =?UTF-8?q?=D0=BB=D0=B5=D0=BD=D0=B8=D0=B5=20=D0=98=D0=A8=20v107,=20keymedi?= =?UTF-8?q?a,=20=D1=8D=D0=BA=D1=81=D0=BF=D0=BE=D1=80=D1=82=D1=91=D1=80=20Q?= =?UTF-8?q?UIK,=20fail2ban=20=D0=B4=D0=BB=D1=8F=20bj?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5 (1M context) --- deploy/ish/configure-ish-v107.sql | 69 ++++++ deploy/ish/upgrade-ish-v107.sh | 181 ++++++++++++++++ deploy/ish/upgrade-ish.sh | 108 ++++++++++ deploy/ish/v107/obnovlenie107.pdf | Bin 0 -> 125064 bytes deploy/linux/fail2ban/filter.d/bj-admin.conf | 5 + deploy/linux/fail2ban/jail.d/bj.conf | 23 ++ deploy/linux/sbin/bj-keymedia-install | 208 +++++++++++++++++++ deploy/linux/sbin/bj-keymedia-worker | 22 ++ deploy/linux/sbin/bj-quikexport-admin | 121 +++++++++++ deploy/linux/sbin/bj-validata-rebuild-gdbm | 102 +++++++++ deploy/systemd/bj-keymedia.service | 9 + 11 files changed, 848 insertions(+) create mode 100644 deploy/ish/configure-ish-v107.sql create mode 100755 deploy/ish/upgrade-ish-v107.sh create mode 100755 deploy/ish/upgrade-ish.sh create mode 100644 deploy/ish/v107/obnovlenie107.pdf create mode 100644 deploy/linux/fail2ban/filter.d/bj-admin.conf create mode 100644 deploy/linux/fail2ban/jail.d/bj.conf create mode 100755 deploy/linux/sbin/bj-keymedia-install create mode 100755 deploy/linux/sbin/bj-keymedia-worker create mode 100755 deploy/linux/sbin/bj-quikexport-admin create mode 100755 deploy/linux/sbin/bj-validata-rebuild-gdbm create mode 100644 deploy/systemd/bj-keymedia.service diff --git a/deploy/ish/configure-ish-v107.sql b/deploy/ish/configure-ish-v107.sql new file mode 100644 index 0000000..a7f71bb --- /dev/null +++ b/deploy/ish/configure-ish-v107.sql @@ -0,0 +1,69 @@ +-- configure-ish-v107.sql — параметры канала WSL для ИШ версии 107 (TEST3 GOST). +-- Применять ПОСЛЕ обновления ИШ до 107 (миграция для TEST3 их НЕ переносит — +-- см. obnovlenie107.pdf, «Для тестового контура TEST3 миграция параметров канала +-- WSL не предусмотрена»). +-- +-- Что делает: +-- 1. wslEndpoint → КОРОТКИЙ базовый URL (v107 сам добавляет /api/v1/api-key/make; +-- старый v100-путь .../OnyxEdoWSService/OnyxEdo ломает JWT api-key). +-- 2. Новые TLS-параметры канала: отпечаток УЦ (TEST3 GOST!), DN, длина цепочки. +-- 3. Флаг M2M (ускорение переводов по Указанию ЦБ 7317-У). +-- 4. Очищает нерасшифровываемые v100-пароли Web API (при auth off + http). +-- +-- Использование: +-- sudo -u postgres psql -d igate -v chan_id=33 -f configure-ish-v107.sql +-- где chan_id — id строки канала в таблице channels (обычно 33; проверить: +-- sudo -u postgres psql -d igate -c "select id,code from channels"). +-- +-- ⚠️ Значения ниже — для контура TEST3 GOST. Для других контуров/крипты возьмите +-- URL и отпечаток из таблиц «Адреса контуров» и «Отпечатки сертификатов» +-- obnovlenie107.pdf. НЕ перепутать GOST и RSA (у нас канал GOST). + +\set chan :chan_id + +BEGIN; + +-- 1. Короткий базовый URL канала (v107). TEST3 GOST. +UPDATE parameters SET value = 'https://gost-t3.nsd.ru/onyx-ms' + WHERE name = 'wslEndpoint' AND chanel_id = :chan; + +-- 2. Новые TLS-параметры канала v107 (INSERT если нет, UPDATE если есть). +-- Отпечаток УЦ МБ — TEST3 GOST (НЕ RSA!): +-- EB:C2:D6:CA:73:AC:22:69:44:09:07:ED:6A:58:2C:4E:55:29:5D:00:F8:0F:1D:1E:70:A0:85:25:32:0D:DC:BF +INSERT INTO parameters(name, value, chanel_id) VALUES + ('wslTlsCACertFingerprint', + 'EB:C2:D6:CA:73:AC:22:69:44:09:07:ED:6A:58:2C:4E:55:29:5D:00:F8:0F:1D:1E:70:A0:85:25:32:0D:DC:BF', + :chan), + ('wslTlsCertDN', '*.nsd.ru', :chan), + ('wslTlsCertChainLen', '2', :chan), + ('isM2M', 'True', :chan) +ON CONFLICT (name, chanel_id) DO UPDATE SET value = EXCLUDED.value; + +-- 2b. Флаги ускорения M2M (Указание ЦБ 7317-У, соблюдение регламентных сроков): +-- интервал выгрузки сообщений 10 с (было 1 мин) и игнорирование вложенности +-- папок при обработке входящих. См. презентацию НРД «новые версии ИШ». +-- «Время ожидания перед отправкой» = monitoringThreshold (как долго ИШ ждёт +-- добавления файлов в папку перед отправкой, HH:MM:SS, мин 00:00:01) → +-- ставим минимум для быстрого M2M. «Интервал выгрузки сообщений» = +-- fetchInterval (обращение к ONYX) → 00:00:10. +-- Флаг «Автоотправка уведомлений о приёме транзитного сообщения» к нашему +-- каналу НЕ применяется (канал не транзитный, isTransitTerminalChannel=False). +UPDATE parameters SET value='00:00:10' WHERE name='fetchInterval' AND chanel_id=:chan; +UPDATE parameters SET value='00:00:01' WHERE name='monitoringThreshold' AND chanel_id=:chan; +UPDATE parameters SET value='True' WHERE name='ignorePackageDirectoryStructure' AND chanel_id=:chan; +UPDATE parameters SET value='ERRORS' WHERE name='errorDirName' AND chanel_id=:chan; + +-- 3. Очистка v100-зашифрованных паролей Web API, которые v107 не расшифровывает. +-- Безопасно при server.authentication.enable=False и server.scheme=Http +-- (проверьте эти значения перед применением). +UPDATE parameters SET value = '' + WHERE name IN ('server.authentication.password', 'server.certificate.file.password'); + +COMMIT; + +-- Контроль: показать итоговые значения. +\echo '--- итоговые параметры канала v107 ---' +SELECT name, value FROM parameters + WHERE (name LIKE 'wsl%' OR name IN ('isM2M','fetchInterval','ignorePackageDirectoryStructure')) + AND chanel_id = :chan + ORDER BY name; diff --git a/deploy/ish/upgrade-ish-v107.sh b/deploy/ish/upgrade-ish-v107.sh new file mode 100755 index 0000000..72c740f --- /dev/null +++ b/deploy/ish/upgrade-ish-v107.sh @@ -0,0 +1,181 @@ +#!/usr/bin/env bash +# upgrade-ish-v107.sh — полное автоматическое обновление ИШ до версии 107 на +# Astra Linux (amd64) в headless-режиме (сервер без графической сессии). +# +# ИШ 107 принёс изменения, из-за которых он «из коробки» не стартует как +# systemd-служба без графики. Этот скрипт решает ВСЕ слои (проверено 19.08.2026, +# см. память ish-v107-upgrade): +# 1. Установка .deb (dpkg). +# 2. gnome-keyring для секретов (v107 хранит пароли в OS SecretStore/libsecret). +# 3. Виртуальный дисплей Xvfb (v107 igate-svc тянет GTK/GVFS). +# 4. Параметры канала WSL для v107 (короткий URL, TLS-отпечаток GOST, DN, chain, +# M2M) — через configure-ish-v107.sql. +# 5. Самоочистка stale-состояния (ExecStartPre) — иначе рестарты флакуют. +# +# Конфигурация ИШ живёт в PostgreSQL и ПЕРЕЖИВАЕТ обновление. +# +# Использование: +# sudo ./upgrade-ish-v107.sh /путь/к/igate-107-0-930-amd64.zip +# Опционально переменные окружения: +# SVC_USER (по умолчанию igate) — пользователь службы ИШ +# IGATE_DB (по умолчанию igate) — имя БД PostgreSQL +# CHAN_ID (по умолчанию auto) — id канала в channels (auto = найти WSL) +# KEYRING_PASS_FILE (/var/lib/igate/.keyring-pass) — файл пароля keyring +# +set -euo pipefail + +ZIP="${1:?укажите путь к igate-107-*-amd64.zip}" +SVC_USER="${SVC_USER:-igate}" +IGATE_DB="${IGATE_DB:-igate}" +IGATE_DIR="/opt/nsd/igate" +WRAPPER="/usr/local/bin/igate-run.sh" # вне /opt — переживает переустановку .deb +DROPIN_DIR="/etc/systemd/system/igate.service.d" +SQL_DIR="$(cd "$(dirname "$0")" && pwd)" +STAMP="$(date +%Y%m%d-%H%M%S)" +WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT + +log(){ echo -e "\n=== $* ==="; } +[ "$(id -u)" = 0 ] || { echo "нужен root (sudo)"; exit 1; } + +SVC_UID="$(id -u "$SVC_USER")" +KEYRING_PASS_FILE="${KEYRING_PASS_FILE:-/var/lib/$SVC_USER/.keyring-pass}" +HOME_DIR="$(getent passwd "$SVC_USER" | cut -d: -f6)" + +log "0/9 Проверка зависимостей" +for bin in dpkg gnome-keyring-daemon dbus-run-session xvfb-run loginctl psql; do + command -v "$bin" >/dev/null || { echo "нет $bin — установите (gnome-keyring, dbus-x11, xvfb, libsecret-tools, postgresql-client)"; exit 1; } +done +echo "все зависимости на месте" + +log "1/9 Распаковка дистрибутива" +unzip -o -q "$ZIP" -d "$WORK" +DEB="$(ls "$WORK"/*.deb 2>/dev/null | head -1)" +[ -n "$DEB" ] || { echo "в архиве нет .deb"; exit 1; } +echo "пакет: $(basename "$DEB") версия: $(dpkg-deb -f "$DEB" Version)" + +log "2/9 Бэкап установки, конфига службы и БД" +mkdir -p "/var/backups/ish-pre107-$STAMP" +BK="/var/backups/ish-pre107-$STAMP" +[ -d "$IGATE_DIR" ] && tar czf "$BK/opt-nsd-igate.tar.gz" -C "$(dirname "$IGATE_DIR")" "$(basename "$IGATE_DIR")" 2>/dev/null || true +[ -d "$DROPIN_DIR" ] && cp -a "$DROPIN_DIR" "$BK/dropin" || true +( cd /tmp && sudo -u postgres pg_dump -d "$IGATE_DB" -Fc | cat > "$BK/igate-db.dump" ) 2>/dev/null || echo " (пропуск дампа БД)" +echo "$BK" > /var/backups/ish-last-backup.txt +echo "бэкап: $BK" + +log "3/9 Остановка службы и очистка stale-состояния" +systemctl stop igate 2>/dev/null || true +pkill -9 -u "$SVC_USER" -f igate-svc 2>/dev/null || true +pkill -9 -u "$SVC_USER" -f Xvfb 2>/dev/null || true +rm -f /tmp/CoreFxPipe_NSD.IGate.* 2>/dev/null || true + +log "4/9 Установка пакета (.deb)" +echo "igate igate/service boolean false" | debconf-set-selections +echo "igate igate/shortcut boolean false" | debconf-set-selections +DEBIAN_FRONTEND=noninteractive dpkg -i --force-confnew "$DEB" || apt-get -f install -y || true +echo "версия установлена: $(python3 -c "import json;print([k for k in json.load(open('$IGATE_DIR/igate/igate.deps.json'))['libraries'] if k.lower().startswith('igate/')][0])" 2>/dev/null)" + +log "5/9 Подготовка keyring (пароль + linger для XDG_RUNTIME_DIR)" +loginctl enable-linger "$SVC_USER" +if [ ! -f "$KEYRING_PASS_FILE" ]; then + umask 077 + # локальный пароль keyring (только для сервисного хранилища секретов ИШ) + head -c 18 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 20 > "$KEYRING_PASS_FILE" + chown "$SVC_USER":"$SVC_USER" "$KEYRING_PASS_FILE"; chmod 600 "$KEYRING_PASS_FILE" + echo "создан $KEYRING_PASS_FILE" +else + echo "используется существующий $KEYRING_PASS_FILE" +fi +# сбросить возможно несовместимый старый login.keyring — wrapper создаст заново +rm -f "$HOME_DIR/.local/share/keyrings/login.keyring" 2>/dev/null || true + +log "6/9 Установка wrapper $WRAPPER" +cat > "$WRAPPER" </dev/null)" +export GNOME_KEYRING_CONTROL SSH_AUTH_SOCK +cd "\$HOME" +exec xvfb-run -a $IGATE_DIR/igate-svc/igate-svc +EOF +chmod +x "$WRAPPER"; echo "wrapper установлен" + +log "7/9 Настройка systemd (drop-in с самоочисткой и авто-рестартом)" +mkdir -p "$DROPIN_DIR" +cat > "$DROPIN_DIR/override.conf" </dev/null; true' +ExecStart= +ExecStart=/usr/bin/dbus-run-session -- $WRAPPER +Restart=on-failure +RestartSec=8 +EOF +systemctl daemon-reload + +log "8/9 Параметры канала v107 (SQL) + миграция паролей" +CHAN_ID="${CHAN_ID:-auto}" +if [ "$CHAN_ID" = auto ]; then + CHAN_ID="$(cd /tmp && sudo -u postgres psql -d "$IGATE_DB" -tAc "select id from channels where type='WSL' order by id limit 1" 2>/dev/null | tr -d '[:space:]')" +fi +[ -n "$CHAN_ID" ] || { echo "не найден WSL-канал в channels — укажите CHAN_ID вручную"; exit 1; } +echo "канал id=$CHAN_ID" +if [ -f "$SQL_DIR/configure-ish-v107.sql" ]; then + ( cd /tmp && sudo -u postgres psql -d "$IGATE_DB" -v chan_id="$CHAN_ID" -f "$SQL_DIR/configure-ish-v107.sql" ) +else + echo " ⚠️ configure-ish-v107.sql не найден рядом со скриптом — параметры канала НЕ применены" +fi +# Утилита миграции v107 (флаг миграции); финальный Console.ReadKey в headless +# безвреден — миграция сохраняется до него. +if [ -x "$IGATE_DIR/igate-mig/igate-mig" ]; then + sudo -u "$SVC_USER" bash -c ' + export HOME='"$HOME_DIR"' XDG_DATA_HOME='"$HOME_DIR"'/.local/share XDG_RUNTIME_DIR=/run/user/'"$SVC_UID"' + dbus-run-session -- bash -c " + eval \$(printf %s\\\\n \"\$(cat '"$KEYRING_PASS_FILE"')\" | gnome-keyring-daemon --replace --unlock --components=secrets,pkcs11 2>/dev/null) + echo \"\" | timeout 30 '"$IGATE_DIR"'/igate-mig/igate-mig --data '"$HOME_DIR"' >/dev/null 2>&1 || true + "' 2>/dev/null || true + echo "igate-mig выполнен (флаг миграции)" +fi + +log "9/9 Запуск и проверка" +systemctl start igate +OK=0 +for i in $(seq 1 8); do + sleep 5 + if ss -tlnp 2>/dev/null | grep -q ':8090'; then OK=1; break; fi + systemctl is-active --quiet igate || break +done +VER="$(python3 -c "import json;print([k for k in json.load(open('$IGATE_DIR/igate/igate.deps.json'))['libraries'] if k.lower().startswith('igate/')][0])" 2>/dev/null || true)" +STATE="$(curl -s http://localhost:8090/api/admin/engine/state 2>/dev/null || true)" +echo "версия: $VER" +echo "engine/state: ${STATE:-нет ответа}" +echo "8090: $(ss -tlnp 2>/dev/null | grep -c ':8090') слушатель" +if [ "$OK" = 1 ] && [ "$STATE" = '"Running"' ]; then + echo -e "\n✅ ИШ 107 запущен и работает." +else + cat < $DROPIN_DIR/override.conf && + systemctl daemon-reload && systemctl start igate +MSG +fi diff --git a/deploy/ish/upgrade-ish.sh b/deploy/ish/upgrade-ish.sh new file mode 100755 index 0000000..683b4ea --- /dev/null +++ b/deploy/ish/upgrade-ish.sh @@ -0,0 +1,108 @@ +#!/usr/bin/env bash +# upgrade-ish.sh — автоматическое обновление ПО «Интеграционный шлюз НРД» (igate) +# на Astra Linux (amd64). Конфигурация ИШ живёт в PostgreSQL и ПЕРЕЖИВАЕТ +# обновление — пакет заменяет только бинарники в /opt/nsd/igate. +# +# Дистрибутив — .deb с сайта НРД (стабильный URL, без авторизации): +# https://www.nsd.ru/media/integratsionnyj-shlyuz//igate--amd64.zip +# (внутри igate__amd64.deb) + <...>-amd64sgn.zip (отделённая подпись). +# +# ⚠️ TEST3: миграция параметров канала WSL утилитой igate-mig НЕ предусмотрена +# (см. obnovlenie107.pdf). Параметры канала WSL для TEST3 обновляются вручную +# или нашим configure-ish.sql. Пароли БД у нас через trust — миграция паролей +# в защищённое хранилище ОС не обязательна. +# +# Использование: +# sudo ./upgrade-ish.sh /путь/к/igate-107-0-930-amd64.zip [/путь/к/...sgn.zip] +# +set -euo pipefail + +ZIP="${1:?укажите путь к igate-*-amd64.zip}" +SGN="${2:-}" +SVC_USER="igate" +IGATE_DIR="/opt/nsd/igate" +STAMP="$(date +%Y%m%d-%H%M%S)" +WORK="$(mktemp -d)" +trap 'rm -rf "$WORK"' EXIT + +log(){ echo -e "\n=== $* ==="; } + +[ "$(id -u)" = 0 ] || { echo "нужен root (sudo)"; exit 1; } + +log "1/8 Распаковка дистрибутива" +unzip -o -q "$ZIP" -d "$WORK" +DEB="$(ls "$WORK"/*.deb 2>/dev/null | head -1)" +[ -n "$DEB" ] || { echo "в архиве нет .deb"; exit 1; } +echo "пакет: $(basename "$DEB") версия: $(dpkg-deb -f "$DEB" Version)" + +if [ -n "$SGN" ]; then + log "2/8 Подпись дистрибутива приложена: $(basename "$SGN")" + echo "(проверку подписи выполняет средство НРД/Валидата — файл сохранён рядом)" +else + log "2/8 Файл подписи не передан — пропуск" +fi + +log "3/8 Бэкап текущей установки и конфига сервиса" +if [ -d "$IGATE_DIR" ]; then + tar czf "/var/backups/igate-$STAMP.tar.gz" -C "$(dirname "$IGATE_DIR")" "$(basename "$IGATE_DIR")" 2>/dev/null || true + echo "бэкап: /var/backups/igate-$STAMP.tar.gz" +fi +# Наш drop-in (WorkingDirectory=/var/lib/igate, User=igate) — сохраняем для восстановления. +DROPIN="/etc/systemd/system/igate.service.d" +[ -d "$DROPIN" ] && cp -a "$DROPIN" "$WORK/dropin-backup" && echo "drop-in сохранён" + +log "4/8 Остановка сервиса igate" +systemctl stop igate 2>/dev/null || true +# GUI и служба не должны работать одновременно с одной БД. +pkill -u "$SVC_USER" -f '/opt/nsd/igate/igate/igate' 2>/dev/null || true + +log "5/8 Preseed debconf (без интерактива) и установка пакета" +# postinst спрашивает igate/service (регистрация сервиса) и igate/shortcut. +echo "igate igate/service boolean true" | debconf-set-selections +echo "igate igate/shortcut boolean false" | debconf-set-selections +# postinst использует logname → в неинтерактиве может падать; задаём SUDO_USER. +export DEBIAN_FRONTEND=noninteractive +if ! dpkg -i "$DEB"; then + echo "dpkg сообщил об ошибке — пробуем довести зависимости" + apt-get -f install -y || true +fi + +log "6/8 Восстановление нашего drop-in и пользователя сервиса" +# Пакет мог перезаписать igate.service (User=, WD=/home). +mkdir -p "$DROPIN" +if [ -d "$WORK/dropin-backup" ]; then + cp -a "$WORK/dropin-backup/." "$DROPIN/" +else + cat > "$DROPIN/override.conf" </dev/null || true +systemctl daemon-reload + +log "7/8 Запуск сервиса и проверка" +systemctl start igate +sleep 6 +STATE="$(curl -s http://localhost:8090/api/admin/engine/state 2>/dev/null || true)" +VER="$(grep -oE '"igate/[0-9.]+"' "$IGATE_DIR/igate/igate.deps.json" 2>/dev/null | head -1)" +echo "engine/state: ${STATE:-нет ответа}" +echo "версия: ${VER:-неизвестно}" + +log "8/8 Готово" +cat <4DgP@<1N*KbU{YnSgm9p9x6Jtiba><^SmTNACaY z17d)@f5|idQx4S4{11i=Nc8{aGco@M^RN1Wy8qG3{7<|7kzxNAjvm-f`hR4Y*m$Ao z1Rad^oopQlD5PyY%&n~S=~!s#3A89w&25ZqT^$Kzln5B;Y3aELfDBe(c>^O<)Z~155tZFmqcQA$=!f0tz8cMtVk8 zdUkqN1}0$N*s190$$lAVg+o2kg=hykufx#l(CJelNkXMJsTr0FM*>I(0>GE*%^8A)sJ7L){^}^?ESqO-@-2a|M_SDN;kcuc=e;3D3WXhnCG;z*N zRse|w6Adsze)`;@1cQ=aHNRG80^!83SNOqS7#_sm`%)yHR2VhW zGx>XQwRW;u<5+vex*2xx*;=H2l*Us#b~R96iM8S2<%j>+ai}1hH$Ka=*fHz#e2blH zXV>7OU^__#c`T7@>ebju{%kV4(CqIkJljpi88}tqhmT#`P<;5BoUiv(gzXx_SegSU zToF6i-h2l*PncWP>Fr8GbF4^s;xB+97lPqRz1>tapN$~^MWj7=ykZ@JTXte z&V@}gaYVqgQ?seokKzj(n0(oce9tkZ8J;k7Hv}S5z}~kjk;sHZ8*aq`q9V}coq;}d z!f*&LwhS?Xp9O#xukD?7Bx_{2XB%b-|2s0g;BgVN$SaX1p3?8zfwhIV%|spEI0Rdt z9Q>nWdf&43tG?$fS;Nsc+4z3z5SaRotr`rA*!Iij+j_}fNAI%<+|c)f_C@HXNY*5_ zvlxn8#_WQQ`0{6O{X(cxew-v(4(6M73XzIE*ZgRgm|Kx5$2RO}vUq!?mRVRU_rP0` zNd{uqB)TG^WGvQ0HMuQb(WI+FaM_a$@EUB4OZb)MmRIvsqlaVpgUe@a4j%qCWtC&R`Lxts!f+h6;o ze4n=`x>vsHsi{rx{dc>I44e^{s|2M=LyrQdIed6JAb2Q<6o?`OjaOKZP>@?H*tp}a ze&3#*toCnJFJG=8CUzXj8jGIZRiD~q0@(N|jQREOk?8I53HYDYTGuRs*XwUH$IuoG zL1~j+vxCbjW!)-0iE%!ZTF^MT?-`oD>RmO(*FR$q*?J)T9@SMnJb2yuNTw3aoOt<{ z3?i8Jw5Hn@nNCHfQ{wGr?-i?W`wf%R%@(N%mw#e_WiZ>yn8hlyW$}o{tf9TuvY_1% zt=XuKk`oC{kN$9?lF$qNp^OTB_6sEkvOVpz2Q_x%{EBoqDZ%MY)m5Pe{R$Jpmx?b8 zLs>{BP-87BO&#?$%EaS_flw0LXNNVAiC^h8YcR8JrlJVbe7LEkgI=ZyY}in zMMc#ru+VxAEpR>nd8WxenDWA){2cOdVuwK>C2q=j>UaDdSQ*N%!H%hKkcXjvzb9gb zY-I@iK7^2b9|`}vfkGs>geZbZRD>SJt0$&XMcu7nMh5#U$&7wPQIjGV732VpZ-lCQ zfMLJZUY$poWvo>+%f|NC$)-eqDVy~;Rv}SkTd$#p77jAflUa|Uvgsp%$@A1%S|)BK zLERfSK@xs~ak~*(|1ZKOtfC+C{o|W^5j2j8h;a*kK88st;RWRU$$4BZ^bJe>d;4)k zN_e_kT0#2iK@MTR%&DXU3(rwT!Bs?M$2>A@&!{V?6vy(ol6XW=#|NM*GdC|_f792l zgD&g@V*HRu&|#J5@4SG?{8_sPFF6yikIEkUQvyWWsW6@LvawgB5NCc8w-F6|FHo)| zKcHoo+mf{v?wqjscIQ_>6K>e~YI%Mm`K75wFA~a|tN@cm%?s zuJxC-c`V95=b-5vL9`-7ehV&HUi{L6!4T&1Fb8@NBRLn>Dqv_XsmAIl_0*dN*siI@ zV`m)3_B4gNrcXU;E3{P4_F#&lZY8UQYP>|umMpee?_7}J>dMtjf^Hs6C%Gsk zG`t$?xY!~Hm6`H;ang1hfeDOx%XGlzWS(-K#(|WmKWaF18Kmn{S|R{!_9iWHJMx zSOrs_SU2dW#jJFWl|1XRAPA53^EW<|_-G2MkNu_3e3I!RJ-d$nbbk>q>U{%yBW(*M zgNW~~_igBVUKvM`#wwjDrKmS#(5?Xr$q<24{&{3LM{F}+q~wtw2}2HNvl}F?W7lNa zPp<`2vK@hwT09*Y&T}EEB4PjN>@8ZgI7N{zCC^;wmI19M8PkIGbqzvxN3u3KZVgwy z@nBDA7TCRpv#@hQL6HeM)lsyUzEjfjN@7sDNJ!G?{nZouvJ!g10k`}S4yIQkPa3pG zc68ZBx0*FoHQq&={@8PYz!5c+7)emPJYVwxBZIxWK=a2m7XG|U2fBw4kD@f9?Cgl? zK0}m@69ai?>A+ouCiaH89ozC2(;=f~MQLj%OItGA>dhZ=JSIc4i=yp-HIy-?;0=7! z76Z!(SllUz>^*1_rzQU1d6^(x8}%QbgEm%aw2cwceGKbW$?7pglv)%TQjv-zyH4NH zr>I*Nil7;8+%~aIW7tnEP(YWhyRy8hj|B3I1$pjfarA4Gf-n%@nKRe|qK>b;Z5(_I zY7#83JOIm7EK62m}wku?m>7au=Lb5rmAO+=60rX}b12O4*Mzse}87-B}F z2sxV&N<;hTR_wBVhF(ZiHO3iBdA8z<$awM!W~KPG>yCWdVsfBfpBSxr}X zu|YJSrY7LDbcqdrlm@Wm3x+$q}jC1J7FnazrN<$GuEYH8V3(N338@{PyZV$)l;sp5NA z-Oyj<0^i=5gDtj=+yX9bwua&lNEUPa|h&j@ozR~I_R?j_S{ z7Z;Ue|Hq!ebB;-vETg4TX{uYSQ!=@%k&*V>-UIVFbZrPd-B(=~SxD?*4BJ``erd%l zWB2fNkOiI^@~h5>PLJvN2v?(;fL~m+T$k{zU#6*}XCteLix?XY)}0Cc!9x??HFmms zpPq^HGMKyKl#K}YB}^uWJiZ7`l>vKD%vsH|v|5|8Hu;wr-j~m1?e!ip0Zwo7(^Ic* zZd-1LO_sNMFJQJ*rF4>}>3@F&oy54d=3?!%CmerSwK{=YL%oVSwH&`+UTbqued3IU z2K)cxVf>dX@L#?L1O0#e2tk2=oQ;3G98!V=^gt&<;$NxiKYVE^0%mABMF9dQ2WOyv z@xS>b4FApT{J)$MW_m`J|KXHqX~zC+wfEucF31IG5mt#8Mz2-VW6oFw4Fg$0k9(5B z#R)O$$2tCj7?f;q%iu13I~THqpc2T)IVDqPTN*aN@B}-!H)V)a_xV$3t=_?wF%2Q`1Pxt5W;qbQZ=SOY|pYEqe?_z*#=V8Uho+@H=e9SqKukTxb z0-eu$|6xBu%lmFOoyqPu7!D~u-}jHhZd#K%ql;UXO~>)ndz59rn7w*z+W=zt@S`7| z-IYrq?ES1L-?MeMXsO&_{}PE$Q;9x~N8tA27@|;uf_7K(z9Np2CTNv55fc0e5)z6@ z!8q}cip(jQB=qfNkb~|Fs^hbXUQ`LB%URMP13M$Nb6!Lu7!U0NAzzaf&h8}X83oeSA~m9lJnDumW>I}*F3!HUaRjgw>+&re}zObQrNW{;>* zUM_BjnJW&jY<<;kgN6KjLk`=oc;8=Nba`n^UOwMqb93nQ&@I2AH}g-->fv+f_?tgWBSfBNk)8g*mvgrC_I6FG9#sKWZpKQJ-3SR?<0vCG0NF*W3_n#sR zS)*-r0FhZ95qFiwzW}ljKUU{B)JvvWQQ0gmu_nr&1fnPht46{T1KghZY8~8^8)8L% z=RbK(>h16jR}VyAR)xs|-@V%9u*6KTl~R+o57`jF1zd>-_`8tL;y~Ap%+8_eq%z6E z5XVvH0Wj%Na5_|CVa9u`%FuOE4plCMseUt3NnspL%!bH%tWC^)=ihZ{U*(6ejg?BH zSjH&8F*TFqC+aKYMZyQGMX-v0xX_GIIM*eb9IlqDxmeoe2%3Vr^hMF7Y`_lL7-Nh# z43+@K^~ut+ghA4^?Y%At))Uu~n`r;6m+k(Ew5hZ(-3pqEsX@&nA1$Hg$!7g?T2?BR zS9)SX%ahO6zm(1g!=Bjloz%|j9cax{bR5-!!v>+8M)vwhA@hB^m-mO;?7Eu!kJ}en z465s)cp_?(m-pOpSMbVd*K>=X8W8!LP!I6z1Bh!sM>=oD%#b?QZPH>}!_^BP&^hq1 zhOiCkx1Fg11x3B`vcn%@#H)`qahf*?EjN+W;Z%oa*;$vGSmmzRBdB{?|F~Cc)SA)! z#N6(%!4`(Vd)6qV%Qbxzv9`S_Pxg8wwZ0D$LaL6kQ8|W#P{Q>9Y5F@|Beuk#Es4AI zO$_&i85nR+g31z?fu1pBY?lLTL8e`D*rNT0NI5 z+}r75M?{5nh=NW}i^e%~aNP-Dflq(T04F0anAy;5xe|dr zz5ZM~u;%qGli{7=oJD3($&P|BI733EB#lQ!bv-uv#D2}ZA#aY~S*hxyf0H%4Q${@f z&1QJ2(lqqYiiXpxf}fLBJ91g*>YK%v8=ZW9(OUcwujUzCGbb8@zS~84+!ebR?LWJ2hM>{yC>6wx3soi0 z8K%q;U#2J^JoGkW8a+P4hA`Y5A8SLPpba?_fzDGt1G*?o4}Pto#qjgr`GnIkF;*X#00W<46v& z*Um_}Ah6h=_0H>%5#m^4xgfJtr`U4Zkh~p-a~4U;r3JD7+TipQo0VurhN_uGbuPk{VW&X^H2mHXV= zkE~S*tFEK%Vq=S-;KR~r=|`$M(MX=u+_AtKSJX2E({t90jJoBP5ag0i9e$SpQH#D@K);bd|r)X>Q?ZS$!fRhR(@IK1o24iKtMTm6K8 za|9Sp$b$uAXI}^^53Mc+Ju`s z{uF}^=xJqHm7d-kOet6Ld*g@qCUxH7oLo{D^TOo%LcDFy<9rmP$vv8_pD+tg;E=gnEnC>Uk8aJp*g3f>T!LH@9xrJY-Cdl3q$g})g<9tu z5n)G(ro^C>;H^mI+J2YS!N}6plA2#Ktm$PoOHy``_W69^>#{OO_$le>7Hvhs(csrn zoNC;%sq&U>MlajfM`)8}vOi=we|L3@7dG0=`g_~{gDVeT6#+gtd-M{m_qL88^CZ*R&rr^A=c^HX}? ziS*O=W$D>N^U41S3x&e1d%y|)W4Mj zV5F1)n$<0lKHUtp}lfPw|5;`80lutpR5{~QJ6M_e2a3v{u_xZP%Z)7Y1PXA<2}sI?V!)R9vzZgbLrz)-Fd=DnqjPYR3{H{Q z?9c^^Q+TL*svxDzy}*l8V0&D6I8eEgBRPdgZWHRZFn zb#90?HMYEfiG5YEu#0RzlQSg}RL_ z;T8Fct7VU%t;JczEUGcZp$al9D;8U8&#FFE#>$F$C&IER(t#cZl-6hBE$U=ZR+yRb zUv4kjJaP=`oj3W5nsEa>GarlVZ?sk>bes4q{8_0tS-#SIn>j6i8r_U+9W|7m98-2D z2fFo>M!`=fG;NlgvO+Ig_hhfId1}+|yfDJ5eb7`~&P)HQdD*|C*R*zG7&PAy@i8Kh0{Bdp*FdhUl-?M7G>f$1i;O!i+eJg zfO5ul0jBv@9RNeTe1_PWv|+OeV&)^b=ojqhR?&a)X44@4;VsqwVz%*^MFC1@H$4ae z71ZlniFCydE#ZY2GI#gfWOuG+Dy+4Ap@0a7fLw2lAsyx8I#CRJQw+;f3=1fb4gl#u zTOqhbwmhgwvOI_)8CRQN7?m{e><33l*lE8q!LYYXvKeR0zBBHyJTCBJ5w5(?%}_4* zMj9Dy&^}3l-DGCt`_37Fbf}n7az1f_xiNM^g{xy&IxRZy|gU= zc_k`>{V-x)_5;{om^3e+g^<5)PGr zR@>)qv9SbET!?|4FGo_q9Mb|lw6vU&F_R6!mjwk(cg7~~= zo*lL&_)MzLp1-2sQYO7ponW$_vB%M?-}*W-tt&}}ZC}>T8PfEHKmf>2y-Zt5$*9hG zB_dx4&dev9O@rp9jN$&;l^A(gsm0@c zJbuHXo73WiR%JF6Vqws0`dFB+;1e#;}BVx6Pxo{ciFt(5+#&_s~JN$gdQp)^gLLucZv{T!TZ?6M4v&jA`||X z?-^$0Lk;dzAXm$u@iG~_1Y4^_nRm{#Y)j{%31T1eVTLeh9}Iaox#Agka9la8Ki`I? z;=yFd4_{=(aSh5fx%i%Ub3d=C8QO_MA@Dv%rq7)Ys-jb0;W{>l#yi4%J#36E=H?G4 zkD02=#1XO?SPnw87%bYQ_{i-${f!sdFqIe3j^$vvFP4-Y@1t%mQ+XHRz*`Ao$h8PE zg#EsEu%Z1V5NuubkvVQV=W*}*o&GpC`+tch{I{jc|0@8%O3%RdKLY^kF(j?_-ZeEN zrXXW*jBa4)Fiz7>HSYu<8gM(No+RV+9wcToU)@N(>xAko%5WFeMm^|DiS7wlQB-$M zBvi8F>R(rRfib$-b{Sb54Wk@CbGx-Z9qMppeHXrDQK!%EdIvt8IDYbd?%vjXIlZ6U zro!Y7c_gdEjQ#As761BpKQw@U*+$sLKinDS)9HH2iRJrz3WiV2<_g#+7NsKk+6RP6 zOAV(wFyPuA_T#MBaRen(Vwm2i;%%sIsP>3U>QD+L>dIpmrM~$ z;ET|RX_0YSy&T_>wlJQ$CHBvQ+h%G`oY1V!1d|LJT*IM^D+lq6BI3wN(_0GG>ILXc zu_uygg25R9ew0F@YuBP@k*hf{tc^|vn50$(hf$>?jDk7H8ymBvJGd;W!H0oHob+ zpc~s}$v_yUR<$~v`nB*Q&*xI@(b$-+eD$V{K9d`lLy^v_N`Qz%OO~1{g(}j_p4yM@HEQ55LNIEg51JXf$pM(IacEG&m+SfcP2)1KD=;t;(($ z{R;F3`o+Ha>Oo#p9YZB(r&%If_gM*-Ip9e?!fnhvwf2I*h)!ZHmU|G#S%izRCUs2WlaQ{G82Io5tkf5D5=p(`9LzIqnaZikA)l*L_g#5 z>-L!M9w6Ykuh@TRX8K`$@OprJ-Jk!M)D>FkI2gke*-v_N)7`r?z41 z2qHj>%>BiwfpcFW+tGZ?g5O`lJi%UQD9Sf{v?IxC*RFp5FQF=F;($~=nK;^CH%lp~ zWIjW9C>wemtE&goesehEkZV4)aK<=?^pC}OcN*kCj_f-tkIQsbzB03Yarn}65G9Fb z;sf!q@jD(2GN*jLD6YWiHLDe^^ww$zx|+@;lwc!K+H|EzJ`t3n{RO%tg3@`gv2gcC zt;q(vdi`l6^l#ON1C$!J`qo}$DDICjlr_e9vSYY`q2a$RcBJcR1hBYmu0# zloc#*v3L7UcBIo_S-x3|X-w=8wia?uTeEbSk7U_8nYzaaN&m^cz}CAK1GQ%=+)d7~ zc-xX(3=eT4+<_m%Q|W|sBxQm<7u{C2YIqj+2_?C0wUR3R6cMFm8Fq)0$8P*Wx-H2* zR7!Pb$b$1B)hBCgF`~OWB@!mCOcwZVWO&GMxVP+Cjg+Gk6IWaGQOk&Gpvq%Ml( zGGXf6-~e?fxK~XY($Jf!#!FVvCv1VAk(FnZmt{LH_I0WBZRp4GQg_c)HR49ak%;P9 zf37dz8da0CL)wD#<+B2UA@>$7vP2yrG~&Ub9D7r3Oxz_lV+UH(+g~(+n7u)GtLA`IaouTm;9Tb(ecTJ$ zdkVuxuQJ0=rePPU_W)+#nyWWDNYAA)^D0pvDpW`6B(se$z?e^YgP95JwyxhOq+ehBwdBf;A}Hk8$Ld+RyhwSJkc5W<7O6UjQGn+1He*)3B6=E_>34WV44bqx~Oe#4vorP=&*Xox+HLD_hMd)nW*CdY``Cz!3Z2zj7 zJ1K=)E{#)Xf^FB;`&OKltsGeX--n_UZ}!cRY$cZ4tluSR^kjnp_Ct$}4f(&Y7?bPa zN}ZdMtS8DA{J9Ypw|6J9TFIK3LnId!CR&%8HxvtYD$CMFXnX6sHfdlCTRG%nN>tFv z3qeq@%GqKI`0CE5Ri4Qt---Y~?8spDm`{i>h8x{k_`I$DR6s+Mc`9>b7PS8SO(VW& zRP}?A)z22xaO@S-npcVX1#@;)L#?+6R9@Z+K8N2&iT6)!>Y6LDzm$yeq6MIVi$giz z+C{u`L|SQHac*JQz_@{&%N~$LoeGMe)Vb|VQp~R;(elFRi8Pfs4<^~Qsa;6Ch$h8N z9}v*{LvBwy)eqTLDw-8r@wfP(7S6n(3ac=KXQn{hQNKfF=n-*c=8+_I?XENRAUb~K z3cBcTTXkrkV1sU%fVls}A34Q*3eb13rg4}5jYi8s?m17a1Xl3qxV;Q z*th}{k*C+Cfc&r2J?hC>M-^83*sjq1tC&>AFN6k5sVMgqr2#MN5MvsxKVNKautu}6=aGjW=)&%bfF8Y4OU{r~_@>r^v4DB8G)u?%$dN!0}O={Asd zc=T8+@=tKJzb^%MGM`&6QKdAQB$k3XVwWNl=N7PvQZb&>dkhu^E|y)(n&tle}iNZtJ$q~6NLs)}k3r(7MXLJ`#yR+LdeC31wWS@1K%}G!39W)r9n<0Yr zaHf(C4#P$m((O$Ez| z8jt(4D3j@7b3*8a?|sDWC+cMGrk%PY1qZ*G?1>_0t&HU7Jjo*!AUSS?(22A2od829 zTD8&C64q5l^0hjTV|W_7RGx9~NY%4Tgwho5=v;B7?id_6S!#+4seFeSApuY@wR+(t zu6cT7nST&}pBvjwAw^NXLCOH%JaJ^MmiAzY+@KSS@Xm{2VvFWSKgRnN}0_6zvbz~WdwJsSpxb$FV7wKkdr z`D6IIQ4nnH}+hy-OhldR!bviL4G3D-!Tv>!bO3mV)xNfAT3-WZ=QHNAu6| z=7a(8yt*AUj^h&M-o}`~sVzCci6LMygh=YIwVXyGKTGdvEMGfRz~T@#CY9NTfVpd= zUb36>6O;-iHoL}*#G!{6DixIvLUt;?t%T8GirU_XOK&``BpWp8SWQK-Ww4{8)d$T& zg5pU~K1-IwFzm(A0u+&3m?CM|Vq%G2Fadh5B`&*j0Oahh6679aF2So2#bM&QqX0a4 zz>28BoRWK*wxPj9e+ki%B@-BvCuTIu%tqj!xs5Po7TlPJWk8_w8eoO$RUly{QdidE zQ7!=a^fATi%B9jQ7Y3ScLY*o3a~}XE_7qwy zZ0c3*aKaXmQ+{9?r$`#IW7+$Q0aqY?PC*CK9|g9Y4^Br-hD>Kg)bNP8EX}~sLu#mm zg3Ou;vffiI#(2gn=y1*}Ja{oX25luEFj>P8()a_BDk`?VuUF`@4q)uw_xhY_5OiWM zlD1Z18MSr)fg(+VZOM^*9(2GJ?g(KM>>)0;qBd+}tscP4#d$H0 za!K0n5epM0y6F<#Y}olpU>_bA4z3Fi*$nh?#ynS!2&e@4s?2y~)S5=H_b4Twz;iq< zQCA}*pb~ifm;!tv$K`7O7*nilF`_!zVEvl&1gmE#;z63LPpyp|2ohh{0sOZ&hYYZ7 zF2FZOkux13I}R0Hl_!+vUk_5gF>sV~QY&M=90vV$Ns1W}aMBAGMheQdgkD5eM$Bq! zvIR~x&X9nrpMrzH>&MBUh=+2%y36Gleg8bd#Y2HJ3n^Hh>T1IKzBbYs7Ld&R?xk!H z@0LrUzbpRj`OV89AUr+j-D|{FgVQv(iv4m9X4aU{O{}miZ%rZjCZ}`sKpSFO#Mr_K zR)rMnQ>?7fD_L1$S_IR;2@dKZ`F#W(8j*#VZ_BO}8?+T$zCpE@r1hAu%R-hIiWhnF z>ARAltG6}f)y)^-PmuU0!xV9ZlwpA!r#-2d$M%&Y`pxSPM6I>Vh z%G496_Dc?vvt~Z-0+}DK0mcm05Um~th&F#3Vw;~f%U^qElsp{pA;5NJJJ_q`ruR%Z zh^XLnbttHZCy&$GYvKq{{XD|Zu9&eDts%w?WnG4e$`6%iyuTDwoQFX?{Hhe$>6I$C z!{(RYIghF!{-!nK8I0Z5l^{_J(QmuTYBK}e zd7_4(%`ST-%xwlTu;GVKsr-Aft#{8B-wBS-f@{c4Ruw2-8eF~s2X^k!mdGo!EXEx9 z3gDG_kZrDXu-55Y_UaSrucidvs+!+9Itd~X|@ ztp)oFof?@q82oUv@neBeO~Wt7-4fWtPB35((en&LfV3h79J(dTqK2o}UFnD=!&V30 zO!{n)bHI`73>>)+z>%BG(ha=E$xrta7jZ${;KAZW=_! z;qrwn@!1akn?5pzFw2MNE_jf0AbKLSh2l>8)nv)bd)~nR*`j&k4`lPy?xkEpilEgl(1SwCoAZFLmx;b^*{ipLoFsTbg2d$ANHtnu;~PFdI@~Jyk9&4UC{%0!>FWair}` zpe#?nu)h0zPfr`f`gMg>J|Kv8L`f(@gT-9Zca8Y<=d+i0?9K(ldYWyCZw z78h?#5b-Q;pVs~?BS!CCG+I5M44%xK*$xM5()CBW;;*wm`-Q*c&9&-vcXS}8tC!W~ z-IQR5-6@hF$2+Gy>0V!M3c?>vX*2k*XfyKXx0{qgA3ioNb|4&Sp6L*?VkN)n65MSj z?{w>s5*eqvY68$Wuzp;6_6&DS%h_WMy%|@NtMzS*8W@~UQ}fla;&}L;G^cKt4}W14 zX!V)=FM)iP|7;8VzXJIz42=Kt^CBM0SdwAu?PJyZ<8POS@ygWb1duJ77dapU->LEA zrf*)r42}Ei@4i5m5;u8R<{L`IBn)6~A8XHg_cAL_=OU7BztGk6UIs0EB3vyUC`WH! z+Q+wP#q8lEKYaaKO5)IeKv&4tdwso)`@WCgrUJ_vIbq!!Z2Y%7iHgJ$5 zCWyhpz%8}MhOt!a1g3I|m_$q&q!bfeS4Isg!Hn$af~dj5(_tZQ&?xxCE{x5siLzlK z#8@c`w;_&W2NQA^fZ)-Z==GXZKI5e`zHJ|^vB0rWI{TN?3fFFr*JWFDwXV$0ZBA}_6;49=7U6KdYjDCsvo9Ora zQYbzQQ2X@hvdb0{hOQ7h+dZX7}+Z) ztS?*y{(!0?R6e`9yamjQGEzq_?BEik4Ow9P+VJU2OTqhyI3M3|777MyWTGN*FsrC$ z_kg8p8LSi{43l!1gq|N>YgQ1=hpld`R8msA*B7)64v$q+TVgMqIUuDCbj2z%$mBR< zkR(niU5<3Ii)Dc`S)s-7y6V1s z|LoX=boKdBjjJD#`^G7SjabQPl3kI|8VHKXswTtNA9t<=~O0G->4wiS6oF_KKjb}(ej$CD#X=GHcd9gi*t(}ZBQkokKsra=iLSGn4Pxl$jf3%25ae9lBXx6+fFBL zk`C9x0G4JXB{3$X6;e2nS}s^tkQ(aNFm(z%DOQKwNW-V%#087L1#BujqZw30aX>O@ zF^X+3v(n4Co^qNlH!OSV9gm^M`-~=ILxdNkRM`}tU)DL^5YvOS}r>fWm^weYLBmbaJ88|5oKvF_AG7w8+{E2?_hn(9=}Kyj2S zE36h8WSnPKIk$(9&Wdo3BM_bzHd-A#_ovcN{!!|D3~fHfV`ucp@iyo6P(^)N9=eElX z8;j;<%o6ke%(joA6lP~TN=H^Oeck7Fdw+Pl9+=^_$~FdxMc%Q{DdAjS&eM4sT12bk zypi7Q?LU-su{x_$Cg^%?uzfbM!JBLl7z|H-pqaekC#Ep&nHYCyrfYglYGacKPil=( z+id?Pl5yW#iz3v)p>kV^3I;RcOi{_8h<0w}p@{7QJM-pTwi970X9k~HsUv}h z%Z5#DH^@ZcbcLlx;0gYr$rH${F`d_4^+8!^MWdW!oBLOJf;A_6cqJ2QhQO!kDzrn=Jk*w-`Cd=@PYG zufP>00`5aLbLp6@eR>@)GwlH|QSqTnwRRzdZ~9L5@H548G}QsLuk0S3Nf@ilhCR$} zgP%hvgY2&@Gh6JkQ-xSGEa#A3KaOSej@R{iWcE+r(k8<|_+Nz8vX}PeF~@JL5-2si zAN+U&_+|^Gs%fJLEUes9)03&{e~9cHe43hdlSaDn>7eTGEf)988f+9(4<5t~->>Mn zr3i@_#IF;LB7ymOyD%nNp`QrAwr?%hb-3vl-0ZbVc8g8}P#B<*$Wi;v)YMDDsf6;x z^yf%NpuT6y68)_6>tTwDH|2(R$R0%Ah1IRR_78FjFmRmAWNMwbeK$A3nxA5{nJgGm z#dbGofRuRx{Pep!q(f{;%_~x>Oy-q<)^4P&>DeLWv($8|v?%|fvi9gwD{#B*^Tt{J zpmzfkc}EqB3}$mJRY9T$3nLH|Qe9(^^iAE>07pJ+oX*TyKF(k*ayCn2DjP7Y$-M#N ziUk>0$*p=hketpVvQ?2+c|M@&p7Z3lM$9gd3m+q{VmE89QJYv|7;Ew21{PW%KiD~n zv)QGhQ5ZPb-PxR?`wDu^ zSLVwp!~b5jqds7<+rYei2su+)s22{2grn_gV>5yx%KrRa9fi2o8By-oPFxQDaC_&@}&-TvWtUn++V8V9+`d-ImyZX-Q zSn)V?CVLIAh%$1_!j6bWK9kE ztv?!M>%rtE3*e~LFOy4^zg^Je5HrJo?`TlpuqT<=et;E?)_W`wxC7aVZ&YZ9knI!! z4r)`J=hKJ0TZQKx1K-!`HZ{nSp9sgPC;%A@snKKv4(ilrRV5H+Dm<(_r1_ap2 zmRxJ`iV^0NnpS*1FA@vKgeLT&p>Y2ZV(R`1p|G-OEKQv5cw5hMjvRJ}L*@1_OOxu) zr|d03_h?FU&$x5S*5oq+&AI~s9eIOWFCqo1!!((r9^O`__m2IbT)ymZfm-xvpGHhu ziAC)wSK;s*8#t-R{&sA&=Q(UOb+MhrvXzWl@oj~RY>_{(3O@xj^7#cT89j0aCqlH= z9(k){&dzizePLAiuf8*bRM8%TS4|ZMrJF!gmAO)tdglGzgMxEsckp7r8AUzMhYd(< z@#Rv^rVevf6;PR+J_%Yo)~R;zP990Pmb!nj`}_Zx`wn=l-uM5eq9j}9QyGQgdF+Ua zgiu+T$H{lufk_?YYB&hKo>%9El ze|(hhA+T?l5TwyFFD^M9;cREV7$an#_n4RAOMkZQhXbA1RPj%G`>4W$h(Ditu$Nqm z-~mG(M|1x7@1pbpWIP&l(GjwQ`>gmlr7|Y1wf&?cZhXUY>y|3J_}WuRiuNgzVGHadx*fw?c6@|X4NpC;C9mSI^kz*}X^3{@6- zCu#1+OW!m%W9az2kR%Xsb=Ft$4Q@2z)eY(Q3wflOied~oqa`tWY})-g$i{aax^eJ~ zz{2$rtN7}hdX6tYV41&~(2}9(NVI$i}U+4#$Sy!dVDkdMcHrG?vt%^FH1vk!pWuj zc=d?Ah{Eht2MgtR8fE3urfTVHa+_vr6Kacop3kV0f1Q3Z?uK`f+?h56m$Km_>G~q_kBp>!1ct_L9QJ8Xyz4L?j{~@ zd?DG@K0XxoF^O6@m*UDE`eKsPW1}~Nygqu)xDo9x?TYwa&A8w>n`p=Qk<;Rcicx5X zHW{BHpE=7og%fsvOuF5Cyyv5jUC|~bm%iOv;5vBxzCT|}!w^ZOhrd%b=}}|G+%Y_J z)tfzw$8e>r7^Jbp^YPf48usbF30{6$b$7_2X|eFYXKYFQvUz)k5Tn<})L&1ZBR!bd zm6x7p4v*4n&Hlm5altsDI)5*Y0`2U9A!8q}1mUi?)|8b+w|a^~eoO3G;-XaljW7A6 zi?1tc<&639)U#^bdKG(z6da#iR!d>{WU~Kw4B_!fr6xbgYmM#`xDpLLnGyaksRg8X zgW_1u_e{7AH$2aoCb2!A#++5&*2rvJ*zx0<>~aE+xs~G46Ygx5MRp7n-#Y8CUIl;u zG8;4Qd!sq(M9!m3fBsj&D;-Tm(VqpmWqC72`QCV*c~(=RW8+dr!>RJ=5ZOe-={%mM z_p(j32-(5|$u_ErEL;sm7t^kc*1td36Z?STB?*hB@97cZjG*=kgYfgkmgX8)hU4gV z*SXy{EkB|^WII^b6vrMUCH?Ag^mCp$j^|zE5%;Q0=9F37q=#%B^sb~9Hc}ib8-UgH z9i9K#`G6(vF*Wutm`R*=(Tb}cC&68|l`1-tFYoCdefv42tiJnuf~oVNU}3341B#j+ z{QF*$voB>~nLfjspwr|b3XIR6?Rpv(b;T~O%-{5=F2CH$vl}HryCdtOVx7p&A7g3I zPQhz@AtYM?|3LAE#iDRBwY9I-BGxN9dG1>LjqK(Wm^SJzvtrWOvJlq7M34Z^AvIb#)$oq1Z4}M-#pkJ^(#2G>?6s>khtJ}6{UrnJrwdxF9 zRZ)8PLRQzv`|2BEx84>Zk0?Ky-}mTaOvc^0xALi%>i3VioW*%x=yQ0U zNQUJcn}uBBE&t%dR}cm@Jkd(~YE`7v=0>Y>2ISMeWu6>KkZso<#7UZ4ktb64Skms6 z5zJKiJy7AZmc}D)=C6Jyt_rn1-OFV*H2O&Xb5(&a{FPNPP2HqloN}y;eErwV6Q}&s zNttj`Ic<(1@hOtAQ~?4e!V^NhA+mo5jjQp>^{#jo$7 zJ58Px&rAG_u7x63!>0U2!O?nLsW?1hertmlrO!ly=M|0b7T?ttd8wxsW8a!~w)7$u zt3{)#%ey5GnK7&RPWk<(?-RhnCo;cX7JDZd8OL6!U5RkVVOmM@eHqByHy`#;#k|eU zzS!vK6}5d|u`+}!4+kCXckfgvX(vu$(g1{a!Ocx=_qlOz+@FG8%7KWR6d^O**To{{ zd8D5nOLsr5gCP3e;l&+v+^DT-{v{$tT6AW2%=NSzK~ud-ndZVSdgIlwrh~t$%mSv$ z3#d-@ptSMRG~gE3u}njT$VYOTkDd_k+HFl{ogZ$}1Tw=i&qJ1UonHzSQW;CRoaPyDl*3!9EYB znC4XS!czl8rteo&f0`Z156voUQZl^oo{oh}aZ9 z>XCHEI;nvE^8oiA&GbN=#BSCThO_(j^U~KQa|Y;rlq;pjKIntXCQ2^D`k21OJ)cb0 z(8u%k<*Yne(UuRmgOSosZy2yy4!x=xb$%z`pg_;#qpm=V&tOO9c{x0jijpczXa58r z&#}fZPXjMH`fG!X2QFS|lEmJXFfAlzz?>#cev3l6-ulG5dulPt^F*hrRZ0;aY?Mwhl*uf;oGC=x z#>)0)fAZ4=_YlkXX*?sJBU8oNlyjH`UbK6taKA;&1GW|Z1xwX+{@l^W`Q_j=4rPDjeu*;uZ4UiJ`Zuf6BV%T4>xI*@(*^Lwr2i7^}yDI zR5~Lor}K!x4Hx<<`mdLp2MO_Fw3l`8l>)^7kHJJw19l@6oRz$CcSof#T)4ul}hGNul%0Hu-je_X#*S zu=pGmGtOtQe%N!=b%>>&qLjgb;>pS@m{5J7ROYU}d73`lqwxj(?*cuX{BcJpgw(|- zj^GjJ-udD2xD9t#8U=yVZmDkOvO=q_K#vz?@lO785jXE+i>K2pe=ud(Ul)|y!o|MV z;~IHeSF4amV0yvTU&TfP9t~-tX~L3;ybs11=3W}pS_JZim!A>&Ag^4lHtyVfi;LY> zo1~J$KBv{i;5xN@hwzVhvS3+bktHMIIaw2?!|}E1-^96yZZ~&#W4+cdKF>cc@mAV) zSYldCE9{e4`jT*Wv%vSS+UdcCZgpJ*1Hm`O+%3+hD154O>I&XV#5BJ5?08OqcS75g z2R>zIYx;Z5l52N6Y#+3e4wgnsx;NK}kdj~8l}fj}fa16Cl!S1?VZ8qLtfBipS?j&X z_LcllTkF|8^XvtVudijwcRO#^!sNmqwq7F#n*5wK8-?sg#IiDor8I*m$({96x{BM6C8@-mlrGGcjza9f5C7QTEqYutA_cVNV-YqsvRFMQ%noB;JqMiOfURz$t^SJ>#)gF&OX`o3V@*E6~ym6ybAP?|&YrP=<4`qPEas_B6g6t>q*YfyZ zNCDYn0(29@KqS{@c^xxZAe5*O;gJZh$84#01*DaFeeCo5V#U%+hIdG-zM7uU`*@WVhRm^ zaEsE%UvbNI`akA&Rm|IJW3!cj`h|gvL#<>-VTWytumfj<$PHuM0j&fTcK|CvhMNDH zm9Xz9!mw=>Vb~$uVvI1GxJ5qxZ++q)Sjo;}3DotK*kPcqVW1Eo7K02u+u9zOEH;uI z+Q4uaGQ>%tLIn)y$i7-fa6q2GzN4aneT$+24m1~B^JV1q?daW{nURlQoxq^V4)z^| z7WS<|3nyeWOrZsc_r^v#tHG2VRdQT~AxVIegh{h#v3+eEs2*0kFRU|&DN|fWrW{mR z1*9C1M;JR&bx_6aD44Ks6-*!{74rIaibEp{%A67>j2*0DHkjnV6f)67#(`oMIw~Ae zU?Hz>M;kw3h9m)^MUI`>`4-U#0jYP`F-0RZaRFKcd4wUUfY!wvm@E`sQYa$@ zB(=^cB$IMrvMqG)gN_2!>_}43XxowDbD**^bW}*TLSEiZiJK(GfwXssN$tqoIX29F zT~Lr@g1o#PF(Sb1bt9$%)`Yb14Qe=dl-oEqtZAJZNYF%H-j140qCq|!V%nUT)Gn@W zu*weSM%lSe1|(Q=?#L9k8VnNVI58C`YcwI%3{VHLXh>M%+>zEfw-^i(N067dle4%e zQcNgA2D}!@g%k`)1=KURFsXlyyDbzCoi=gpC{A*2H5z2vfV{pV{*Zh~!H{I2@%NV& z#kGY+!65;OYey!v7Iax_RB zKwjS&e@KIeA<2O9$BC(m5{JfvRYL~{0xb*%Dgp-53!RpW>zZ2tZK{Evl9q<*T4uUN zI=~8ru9=2`7C%3vHbDl5zu*K_O|B9EY6=;H0Ea`$9Wo%-s_Ab#AQ%193&<4cpPPNqam<+upDxo*mf| z&xS2Q$bnQ{$Q!mJ2V5Ekwqe&c5;n#G*2j_5NI@gq|JnLDCv<%r_!{1htYj-AhPpTp zCL`WX3~azg?=Mc*k}$Zlq!0^N*m% z0l^kY2P7ha*R~r6T$6{hqJq)t7%1ZYW>p^WG(Zgh(H;bxbw^_q8Z#XF#TU#QFK`eYvME)pehX&ZUZCHj*>XTZz$pP6s~}O( z{0iQ?GfA$I`d5C0VIL6q&0~^-5I{>0^9M8R#?Enef-Vpfy`FG zJGL7T;?8Th6u=dcbU@u1d2PFKQ0}}DRo037D~0?6cZRP@bvqI_$!@E10Rfqt!IAKY z?FQU}XH<;%E1v&>J0s^D+mX15=dD~20V%cMa7;zUx;ulYwN19C1b`9X;6w<`tT9E} zEhLE|^{*uP58N4PxZ6n*-JQ{Dc_j|OV~}|aI3mpoI3fc(R0v22$#zdb*A-%`DxD3o zg8)a~vE6_W-v;3{$a&FbC=1XL1cT$Cw6liy0pi0Naet+qf8g5~aTc3ow^fi|^H-q6&o>2kguXz3!zKzKhH}QbPY4c)hax*PO~RlFS1l7J&JutVK>XMi0z1hKP`BiSG;!QdU+ z2@>MY8^9glv*oKrIHV#&UfXUQltMtv6fz{N5%*W7{SVxkZD(Z;1pfn(9kdEX-mycT zQ8D7Lc>V|OjKt1tMwDE^KbHd;tpa;#YF-<79u%4Y1 zJ^#R+F#-?K-5D()0$2k$=sds?Iei6=$iNO2!phG|frAo(^1U-K5gdXh+Av9W=pxw;@I-JV&<9uw09UcaA&09Zc8HCA{m+lmAC+( zM&>bqdE|;ca6|@nh!Bu#<=Z}B3wY~>R|EUA;I5cU;6an z90ZqbHeq0S77juV{u}!)9B@|1z6*S3z%)1rCE3IQJG7p|2$6HtvnC8YzTvcN(YWeK|u2`MmXIj zNp6*gIiSTVMtCN~^SDq`C7{p;L3I$%Ltgs}jjRDYSI7AKRh56@c{>9(!a*G3X3vAJ zXJSNLqC5}6Gl**ZODp^bo`(^0h;AL&$pJ0&F(L-H;2Bxk{w2@W4^h;dbV}Nv>Pf7#z@g7$dw9;)fv85}Ca=gB;-)@u4XF zfVfg{jK7~U{Tn}AjdDAX-Ig&7TDN1wVs63n-*3>YR+s;A*54W26TT(hlLK0xBk$Nw zh=1}7f;|6weuxo0y~z((YfsR$frc?ir2|K#2SPm$3B}xwadgky5(>%zt?n^mK_Q+8 z!cvi5vl$W!#|W84X=Dv73uM4G;{K`*`vz*-z==)e(a0>BaJk5E6v_(mQI zgS_#IAo^2yfC(mQ;R*E$862#W0H;SyJVC1g*2EysMeGc740NmlC$_5(M=nULIxjSk zVgw!kiJV^_XSIt93Us_t3L|!g21Y>9!0RJJ0u*?|b`ftgcpjtxvQ&mZ0#COa0`)Q% zVh!+$CNAjfc!-_hasP(_A^wEe8AufY1*xu!3;IGGc*l0kZUppo@__y~NIKAjwrV=t zje`~~*M~wE9b~Qr-m%?);LDYW4aBe#s5vQsI%L=cj$mR$fLK$gV_*cnuIYFUM~Y4; zWMYFr*8bZOiq84g143pE2&C)nU_i(Mz=nzS`(twpFe_%Vn(2979y22qs2 z@8DDu0dC4b{Tdk!wtYGvR3I>bc@8L|QIQB36L}80>b&L4saw7Ih`J;3`Vw8c zkR>|=Mhxa3Sqy|=LKVAOjBF=~O*Ek#3Y{isK*k7I-Siq50tCxJNm_NY9gu`7e$h#S zhF**~P!XVU9#q{35V!}WX=iy0?5?)iF`>~LBdqcdF(Hi^LJ|^w_xEC21OK6m2^#+~ zLI5FAaRUa30AYYo!Z0l)qnp&)Q0Rm~<3C2|7W#lFuSFXV*s?{S5L^fl`v?sOJ3|&C zpvc1Y1cQJk7>vlmKP(PO0<=;>?i}wxy{PFB8rM*eJ^~|@5ZrM?Krw{t+$pgE@(E1 zRsqgJ5o_Sh)zk&TH36c*)CKX>ouTd!P}JSJWk3P);2qnNhn&YFK#1b%v=IUJnfkjG zG{7tXxBZXy3K1AVa+{0^vR<>nGc*ZfY#j!!QK9j?gY_DY{~T!uK6+cVAOSUKR)Ye@ zA^rfyAuu+f+9biPA`|o#0|aKg56Wtg^*3lW$XN8>vzncO0TECz;D*&eYm%KI=f&wE#4wAjs$OGIDNe49VU_>ddne)0bln@|95f}_vm~Rmlx7rZ?Cx(rwRNNE} z(NY5N0v2d`z!UZ9BG%vKn&b=|DC*ag!E@DS8|1;p0EIH8Zh2=YUBCMeQx z{aI|#Dh_$ac69$ydVn3&AZY<3j%*W6TNU7J&;kzQy5^<7oFoNb#RVEZIw?5Enm5xG2{TbT-J;aTR0|M(pU<8+JQVxph z)sV8z0MzI)wtd@H5m+-fUrvC?$K&!Vg;}pSi0Yql5=3^xUXcz#|NLfIQerLco z#2R)CO|Hjfzm)~ExD1rYBAi5`E6lS6Fi0%&E9%7!Q))?aGnA5{LBfs9+2HL}hG zI0q+uP}VV(9_Zm>4d;bs*3jnbh`&U8AvTath@GIl{)t_$N@Kfxvx#R&9$&X>v~4Af z&^webLwVjo<FJ?kSa8(LR(=Xc7_^5Kw9E$q-|&`aqy1qj2sdh*T`EH zBvK_%?P6L6McMX-GJrl9$eJD)47uvCMe5%&WBmgw$B5%ZO{CVWd^P2R_6QJ*+*yRC zeB@o*iEv9C!@5ncLI6-ec~s^Aya*`~;G0`0$Gi+rdK?J(5j4fSpjIBkZ3Qzsaz;s<9G zFcj7wB_2?fFckO-#9qNrC=3v*1X}}ypoT%cH~`RxNkR?ttGxGXXoE0bMP?txwhglqaHIj0K=fsBuuv zhzpqw40N(4%ksI4M^ z57hHfDg+nbf#o(-6x~=jL_G(k!c9vkK*U0t?}jt2gYkfgCyE603Fvyl*tm`&1zcZP zn_UCn0-Y166;UPyWI51rp)nbXsTJ2X)V28I`$~|HZgH%ZzQAME41up-Zu$%p zz%w#7LqE>Mb$TtRL(T$kg2PbZ33?W|7nPZyXSq)U5d)O*#_3gTJK%VKo`$cU29*xI z8?kyCv^B_SVA}^UHBem8)2l?IvIpceFwp_D3u*~^dUcRLS0|v*XVjPPz^n`r{r}Y7 zY*n>V#>PNh0n~p;GXlyA`xv-(NBjgx?sk@mX!jkML9fZvgnLh8mp z@xOv<7HS5@tDlPjzE)}u1f*5<0iP9BGt(C}(l%aQs{orQuAKp|X=%cMkB9;t($_u{ zxJK`KO-mEP=8#)VG+_bH!)DN0jen(T?+%P^}*MRDku}H z0Sn~~;#x*J7I)ylcOZCJ0icDju7QP?8H`2P0QkHrfRjOXdIawQVm!y{Vm8d&!c0re z5XU-ltO(nhNVWiL@rhz#fo;-A(R+o0_q5DZ-)JTFq~1}49Te93n4L$c}|i`^=%gWIoOmN${iLih&$zw)5m8piP`RIGs z7GzqJvh0U=>+K%Bz&W_fZ5Ji0t$p_7fMv1oE}O#_Do$5idr^{c@14^98N2&E=e~AU z+nm%6J+g=FWAi;M$$XQGCU3mozuA44w)FMA+1JBE%Qw4DNAGHCyq~XU+rMbTdVJT> zL%ZsyKZQn~*BdgWD)o%s+qai3{)yd$C7x^%PD2L{dl9dOV!uq=v@Y=ll0At};2Mgt z_3@p!4{di9X-5|Jez7}yT6Fi)%7Ihle0D#Ah5H7lhc7(cpV4#AsK07zfTPWF*Tn9F zO}czmpKs^iV~73PHMnGBKE(32=F5ruhvVmlq67@PpX;~1#tSPxz)iL9usG}Jx$m(1 zzsQ3w9i6+lZ}0va;(Ocs8)bV-@4M|@(j@OmzrQQK@ICqMm3u2G4$o@b)^K0Vmq3>^E8@5Zbx3>Dx9yHf{E~6zaJYmw}>RdIH=c$DrFc7C$wJl8({G}hJdY_;I3*mu#w)_-r0*m&8Y z`%ja0nK*GsSvs9$A26XUbrC%30N)it=GsT*L z9O+-*@2t#{7EDpqY8or}#KJd?LU*QYSFlx;8KPS4gyd3)e6RuYymA=R*Ejj+ehfTh za7alTjb5UU9W8u6zSv?+H&SspDR}L@b9WPEwb>R+>M|V$R+#Rw+sAz{)OO zpso>~(mTfjXX0k)63sbO)g$`(z+K` zQh50H@90C{8I@i2GbSH~k?8n;)bVE_n|;5FUo(Xp|4_z0RZBb4a%;km>Hz@{!hh}2 zH{q2d`jvjHPJKls9WvNCUDa#i&K0jU)s=?cM#ntqDUUJH{hR%$gqWaQ`HAV(iXRMDX zz1(-L4;K*~c^~*vwLtjY>)gIM_ayg_(P(QnV|&3**fo{9mwhsyg<1WGF{kF=mo>EK z4h^FFPLDYpmk^G#=%K=?)VsOv8HG@GurX3y#Njv{Hm!-4DNp zsNv1R`Q7I5inm=N%J-9m{n+Lo-#-?nJD@cy5IkfcNOSQphXqfEi6MKo=^bjeiH62O z_B+qbb~n`!oh*q`EUrCuX2fjw;O!Sri(n+T-TUqm2&*|ijS3ge<8i;|&slzr&HgPS z%HWRO3$+7T1eOc9P?a`a|O zOoY0IPq}jGnR!*7{A#RstM&To+;{X>cYLLBNr-1kL5L@xHLpT@1u1C z!eXv+# zOllf%7jfH?@T!}gg@dVRBu-LVmSTUzEv=KDzVq`Fp{j@<^oxaB`isd`;?M0ft4eXaM?S*_6t2{ z%e&yZo*O|9%fANb3G#D1h0=6S1SCh~)yhiHW@dYOf4{SkXAak_gB;m!{8v}RR>uwV~@RbR=m~oNb#gzS+ zPeHU}`opqbSdbp2#0$8mjEmbPzdgsx_2gL2ofT>ja*qo0*hhiyagahApYWijdilFb z*MeyOYxso4^z`2u=np>hJQn0}tlr}oGd{t5$}O4C9c>A@MXHr@Bri!H7#5Y!mY-0{ zsP)qk*-s?p1WSt9%PsZf&WWi7!?Bv%2XENY**1<^>aaAWC6d%JEA4xysm9a2r(9ml zZSjQD4DqK={hzf?#-K`^_vlmo?aE?ViAB3}79QMWI773M^hxdv;r>jsT@GiH#u!el?1 zw2lV`h+Ndu>-x3uA<$X#Mc|W8nTJ9uFU$-Wk5ZHKP)@PUF3wN!QWZ3JECjd3FSK&T zztN*`r^qGACVYBVn-~7E$-sbN@aNCF>Ti^}vI(WFtvQ|Vnh{x2Df4DMjXE4(>@%v@ zUvMtclPSW&wL#USjHPmfDCM`=^5VgJ!}ejMwp?GYwtnzkxh&a1`{EtE-@PqPynjS0 z9v&oR)A!UeDYUvZ?nRBbm_oVWaHs42>!r>#66eGpTHq2i6kuhk)jzbvC6S+IPste8 zZNL2yuk^@efnEDw+}p)Sxp0rWw`HzExBaa3%#uk(!njLKM$ymF-@SrQit+9Zj0zmb z+rMz_V9fOu?DR1?uU`;l&4*STFRr9DKGgcSru~8t1?m?`PM z^WmFg%~8sP@oG5Pi}C80WNG8VxOy{PA~AA3ZvCv6dfc9J-|BHwBTE`DH}Pq)dPc(V zjTgShazT>PpKvCM%rj{Eh)?;QqP+~aeY%~_`LyzyoTwh@>815~Us6^V7USshE-cZ} z1J$H1IHYr#pmaGb2xS7cHowljPs+XO8 zgqO80<5~@o18-BQ4Dh3p9r#iHX(9AZsm0ROH(?8*VFvBeCVtCw@#>F?eG!?(xH=ks z#lC)}(}rPAHVdR-o>S8-CP$h+mXtC#06z?rV;ud=O`k6F43f<%D?fLXyu!OM#ElpF zExONMIo{EI-o0qop_yir-6X@&UoJ7X2`t$d6$z~nk!pA@W1lSxSzyTfkijAtw2V#i zg>i|Hxx95jj=7p+K~C9E-}2m}BFPo9n=uN&k1w`M8q8JW)Bf*VDW?5Rh>hL~#K)Q~ zom6&-0De6q_l>6STxZG(Ze!l%6^chsfgfo#VoQRHN0O)UO!peS7pU~T(<)FY0sJU6 zTMS*^E!R7@a3Jqk?kG(!N$1lNf0E9m6916AtBy3uCb`S}MpZP^b0!o&-t`DFEhm;d zSSc@Bu={m>`FV-=O0~m6VII}o==hf-e2FFAyc03YM}CwGF7W12;Ej&=;#mth9+-=f z=y4VxpDmJ4H7<+(nOMAkuJ6W@VW&UGLWlLPYu}9fFJ_M#_dC8#Gp-htPd2Wuu$Joa zx$-l3nMBH3(eaR>dl7l_H{-q=DersAHLT?v3H|$dmLyWjrWPWs_pp33entiSxP6B6 zn{lt`>*pm-2^lvW_c~VBFO2>=bnBgJ&3pHy!<@tE8dRLaj#XK|l9zAtJ@`0N^2Mg& zmOt0@$Dez;TU0Bs4BAvHysecSaaq*7i?Jyt{ED$z`c)hVZF zVBv87F8;Ih8ly|oLlaizBhCFv70Z4m3sb+I{9G_^7Zh6J`A$c_#ItyT7Wg63u#ol3 zvvwh?{R%Vi<66o>7Wakk3+JADK1+AeZa;Tp#?lj8njz{@B&*SM9Yd77Re54SjXxRZ zbe>S-%bLSH3yHsaFSg3=)d(T}`fm49{fVW8*!Zfdi9^{OL7gX6Iz8 zjItCpvos0zKhZemjQDbO-o5qXlb}gFeG!H7iV87SEgqXW(RW0YPS@petDn^^E2y64 z4|L8t`;}a}$Gx&wQ_O?%$JYTOrDygOVr8aMF!_itVp7VYzg(-6lKA^a1l6>z#*E%W zd@5lM;Y#5r!g(GRNF}E9M_t)a|juN%6?ic@HgnUi6`(q z&3q^)Bvrq-Sfy;h-9t;yTCab2=5!AHQ%MT0f#{eIcG6-2JfStAJy3B$KMenQ)%nhh zJAM20b@oM6R16m#!#$lt%NI$qaQug~j<|kIt1G+fgE^L~q7@_Q*r|t}Qv$~%iKKvF z4n97uqUot!9m=B-$DW5aHh$bEZRM9L@XN^KbDd_(#}ejtWs0<@cdV}+6~=f3bpwP7 zy&4mJW8=x)g5=xC#LtA=OUD1;xYeVuBG@SQCXx>!-f@ zzrEks_)4a-I!W+%sFslA{K>A#_ni114*^qP4hg$W$y#>G<+dT?J8r&k%Qv>%zF4tV z}OymZTUdJBwMeUp2iYRd4#cVkkdQP=9Z!0+dK2mU#d8oDZn_sENF`9hF$a5_tpn{ z%J8%8bU#|*9eEyHmK}~I9VXwCcH8TQ4sJ5sZDQs${RJhQ2j)L8upx>cxQdg_nbkbbHDCK>H*aOAkxYJDqO}sxmr<($scvZ?M%AYQ4 z@t?c6kYKscyU>~9PE}_8;cdygE=h^hi0eIRE8N^#2e9yy}pMW%9Ylq&K>Q`#HC6houhwltTl5W4$GZ1>I^pH36PPGGj%du-*!NpbUE zFW$vz*^LC^XP?=B=@<-&sXXB%o=&uZl+9egzjN#Tiu0tJsP=>_v~<0GnpS2d|4RqiCqYdBUrk$RPQW% zy5)BEBkUQ4Gq^`ImGC9>i5lNLoh!_4A07(*oEl+L+j?e9hhiEjll6Y;`A=VIR| z)6ig3+Vf0ibi|%BK3NsKul0sZ(%3>lnUi2=^~VH)V+jSOGv0ebrTEoYv(Jd9QFT0m zee@GZy_dRYUwYK_lE=pzGTfim<=h(h{BlO$2RFn4g zU3IG#!fVNnANDX|lifvxQ;JQP!_SDqE2^I#l%1zN_d;y{6ereW;?GwT0`WfwIb19( z39tCAbC=>$iJoxZ;@K?9`U%86Sbt%IY>9fe`U1is{5|kr54=QU*&u9OAtY5NG%JFK zLZ@HbR4G68bx7_c?xM<~-2?Kciisp=iOv#r6Lb?KSLsc3o;45s6_Avkl&%}78#p|h zVx!8qz{MFGSH&~ss7?+1({YJ3%&Os@c`YTPx&HC*#<_@&2E)NugF1~AjmBX;vBGBq zL+k1XbnaEXzB8g2=Zu)d)_RyI3 zSn`CVzI%CutY32Z9@j?i53!>#te#gzT=8qZ<@lI~+$j2~ZoWWrmGIQJmV$}u_9YdZN4 zse39J-^6~mIraQ?O^M3{)&c5L#vixX4_Vy~`Dq&OcPQsa!CAfsvYppu79HP3$^2gN zKlf1Z2+zQlKPpO&MAC5GfBJh+nb7gLyhrWT+7oI#8GJ0J9!6%Bu@OhRWU`W;@x{A; z2z*Fh5W4iOlw4b4Vc&AOLu0N9gG(>Tm}tD4v72kTtIBQsff9n+oA(VCynOF+e|hJ3 zhAJ^B=@f%nB97-p*)XLx{n5IIq}idb80s{IHE9u7^jm}^mU;L?XKDL6z8s<_BB%Ks zQb$YJ$3(4)PaZDT&#rE9x9V57tyHRE=LNraPiRR4&krzUURMfOKE6cgkl+YRMDmXa zTyj5o{Gy12v$U;ioT(7wo1&^X*}cgcA=J57f2q~FVhj3(bH8J=ecKDyz``S!D4Da& zERGtjN_RhYB$zfbepF`E5?k(}QjqgOJAHzCAB1|7J&&rgr=R?M<3$0U- zvUD;@jN(11zde8MwYk=Jk9uDcPUS*igNjUhtZ{o~YORvNJ~G(+j7)VJ0sF^inb(nid-P+|lUz zakOx(w7jMAbWn2|nTfikTHau={L*7=tptupw&xSGHZ?-R&B^EWmWNFTALm!FJhrJ$ z()c}_MiE3w7EQ)N#`UBB`ehMMiTt>}4_c(nepiAB8HBAF=RBhIPuJv@y9c^5);b?P zbo-^E(N)F$PK>T%SMA>=o}~7dayzIkeE8-N+~tz&aX;R%CMJr>;wd^7qwt54nb)S` z96u~SJD+rZ`8tzl09jJ8!(Ot)U8*&?mt3h5Xx}IlHoj5d&eBxpK2c9Xeci^d{S&ch zp~^!8ZKj&~Eap%JGVjt!%8Tsesq-DjMya~<$o*U19QAzxXM89YMcK{WN=2bANIRf; z)$YOmfUl$3OE;gZsw7g~UaUk6Uao5pojf$4Jf>YdbKwvh?Ml1#sUm9TuKiy~CQ~yi zyifRu2S2udF`^V8BP-zKc$whHvlI~mxk)7wVxphkoj)FqsQTQwLTAV{apwVfvz(OT zlVb5PxZm$@$94-NgOQ=l;3YJKgc4{qPyX&sQ9O=UMiR&+<>dk*$Aq z^H&=O(^-d@?(GaM9d(k8FN28lKE8TM@qTV1HJs=dPBAg!4WSMF?BMe{+MktWybUR(V)Ei1 zt(9j6v(EWFjgOCazbg>{7^8d~{JkVw_08{M(J##zrXHv?L{8%rb1YramZHCF#L$DY zUkf|^Q~c2<3D2@P3!_fmuV|nMOn!NXkHovBJ&VI5c=iZ|Y0ZlR0Z04p>apmz**kUQ z2W45;GCYSBdFCfoKIVU9ED=47%{mlU14~Z7`AhESL0SV>r6;sU+`rlcD2e;D#29)A zUvtw|<;gH)kgm@C;jeuO$A2pIU<`BL)BygiOq?UFeYbg-n@&D2)s-ble&?6>^sAqB z=yNs8-k1znAZti_fBa*5>h$BUe*WU(Y>L$*{PC`uS2=Q65b;=<;N>LUtxVU$8smH` z{yMW=E9X8kd^UMAb%1^<^?=@xOf;8=!wDtEp@~$JXU64*=0~3dHKYiAmrr?N6wY<# zQRXv?N(~R{lx!n>vE&bAj!*8w&huX*7Vq$gQ25kb9$wOm^IHfjfk+4bWZvP>y1{H90~IoT0tQ%pSn&G)HiM($fp zM&$tZ@P_?nWnRx42(oUDyb__C_j&Ww_-S@KPx)^g z58?67$FaL#Yfu{clQ>0Wf%~W%tM(%qnS)G$#7!4sQmg~si@qTdZGjQQF*Yn8mS7xh zJ~!p__~4}doA|6IzKTQ{mlrq+f)RVey7#ufaH>JP6iY8;S2ob-OuJOARNF%7?tOsO zTrjAKpEq-I&}+fl-CxmOxb^v?gamuUQj4W5TMgcK^OnvVmNzAM3yQzye=5>$3a9Lm zmZvroKhGp*W$-$2F0A@$jfB3gPjzvc6)xE^CK}TZF}KI1wUzm2J41A4gSy;cdD1;i z@5dPx@x{2wfXHF0DF38NT_MNYJHP3%Znn`gSLYYx(rgE)hi8WItO5fxYbCX<7pUVO zou4bU9b?b*N{v15e&Fah{PR+b(C&lAR<`@I8Xl`iIpXIRq zXmQr3bV3Gdf$#T&0NXbFR@QV+c>(7=l zU44hE$6RpHw+3(Q(BXgrO&t6mgkx-D4$0-BMq{{RgqfEq1j}7#3fuQ^y(IAFbbdMi zhHr0655kz0;??5ho5dQ`AAL>r-c?w7MMKXg z)8xZ9m~MS1Q7n#BgTdo)30K$e z%gGY&{KCrQvFKiST(#Q3&l^9Ljlg**vx;$hoYTF@&Pvy2ab-*1d-25jeW8fsSVxzo_oLLjhhk~OW>?Jle_eOR_T1g;DP9+W zuM{X=%wvF?OPfla-lfvZd`I*gansmb#+|_D-O46OfoF`3LxuGVu;#jKWiM3~CG)+E z(IeuMj^kDj>6VxEiK8-?Yi{j)H|)#usx#Lsvc7R;GKpojc)_qk> zHF2s`Ir&cF(Ya3&I}TpM>b4VH7)#dfnO!`YOzr3~Sr@V^-*<%!@trK})O}Vu?4!Jg zBDxqQvGF;u$pNc}jwllA+BiDR9 z@~D5bwfgIY=SvPeiXC#hm5pPw>j`dsdDN+0=$2)EMzru!gmb;RUSPp6A~uv<9yNN%~S_ouT?ixx3{ziLYsdtRoBR!4|_8b^{I>}CdRn@WP!xpQohjq zNHwwucn0xfAEz^MZ4x>%a>BlGPAx7nx2Te*5xfh&Pr6?_@ZMZ3l-9pwz&$+>_4q-B zQWlG83;T(MBZD{iaY)_iFP#l_F?}mpX+UD=%$85*?YENB}||4;*G;cAU;b5N0wf?f7=u6*2m&T_S%xEIDI zE_&LxpSkN+>wH^X;*2P#D$Kb-QTcw29$Y@5rO(%DChnbl!&@#j#8{Ep+ZZ3_U`GSR zuM(e~ZVxDY7ZdwVD)!1(bJDt|Hm-DQbchyH-BgB z*b41ZQwv4*_^-B`+1{#-gRRD4+J?R5`Oz0X@_sx)wwumf{GK7cV-S4VRK0;P)4@hc zo2Nzc4WXBWCbN$gki}1FXGvt|1Z6Ui)vHG|p1~P=Zon~06#FvQcYl$^;88*0+Prk_ zBDiK_)AMAiribK*l8!s!&qs9gU(cTp)L%AGyKC@P^24p1F1wr@59U@9I73{xz{AO< zuat!x4&%aA~qD za+UE&Rm2{~!XG!^{~nlV(myw)v9I#s@bBV*wqqx|M}(fJ_Zi&2>>2ckfhR%F6g&It zA?HT1(KCiiFHSyD_qncYEJwonSzfeWs+3$1 zu{lgZe+!t<1h>&7<@3GVLh?(PJ4 zx8UyX?(PJF1Pu_}-QjO??!D)G-Kx z_fh+|5TV=VSYHGW)@X(ow(FVrk!sjj0V;e;$n$M-7%}kHKR9(e;%TjO)tEhQK*9y5s zBcG}-YxyF6nn)kRxL9k}7F-EWmefm^xw%}K$=w_|*^Tidn9?~OPAk>kqcJY@Wb2^Am<}_%T8Y&i zJz1(#Ec#i{zWv1Lyg7Pe{qZ>qy)Gax#Ck=0yuGb6CDGD}W)cd+sxH6y-pPt1GZ4R> zfd**;MSMJ;I?l)*k)V<6YrKxQ+}WGA2h%o9l^81fkHV4~g5gs1%f2T1eXxzKh@e1@ zDOpWTImzW;zsyaWzCYDTpZ5xHQ!d}7vL4NJJl_jjPW}mEMcF>Q#23j#ncz9zNK{nj z8Yt9;QVH8IS8gv+W}VcOmLk|qk^G#V zOqQ(00z6-m*PjTyfH`MGOfZ)qsu$#Lh-~$v9DF7hH<@H@&uZvic4^e|&F1#^eKd=B zOyt|%KHSo=3S}iY*h(VK=O(MoiX>&TR90?}17l8Q-qH2_4+jsQJDl$L5BKg_(9Pi% zBU3AeBW0&?7)y1z)MDGxZ6R_Pq~!E}&C=^Rj7X@dxA?KAazA&eMJC4Zs}GDbo)_vJ zq8O=*Ph0FvNl_ttl@1MsFUJ}zJBikWCc+C@)u^Ql8Q)-xmXu(y1a5R@_l{mW>jrKa zai<9u_VD9Yzp3~#VhCbp%~!`hMK$DV z6-k-`JPDumvG*K_TYS1{*D>IzhxplTGxgz*mdwM%$~KvHf1qOv(

{#J$7AJaRwB zN=IbEyw|_1To9UwLQFv>bt)FoBO&cH$y?KBEKVeo{wnXg(@XV8_KB>&uc)n9b1j`> zm=23FS&5V`$toU06uRY0a0IDEv}Q7_n?mbo2jiX`2Pbzg4{#fys9`dgAeKF!6D!h% znXWy#0aq9&hG{n?GDs;;riluTIYr25W2yNI$UkgQE9(={X`UeiCh_Y3sxXGw~!E@HcB%1s+ElT z+laGF2_>DJvY=v%{-;1K6-yp0lSHCW8llrtBK0lKJl!7sWI6(45Af-(dQo1RzTenQf#X zxAoPLSjQh{T?L{D{+j5vG~tow42P=^rwFRpuy1!Z;deeHkUk+esCy4-39lMsYVUA7 z2<0$&oTX5!&%=R`{fYSpgZ4~i)Ey&3Eo*fyLY=J;rJ<2y_?I>Nk%j}9@B<_vtbjM1 zb0WE1>pKL#1wBoe3uFwE7QS0S=WQYR0f~h2i(y!~FB9bblLID&19+WE z^PD@V;ooK=UTm1PsJD~Oql}Y1^>Vm+cWFgaW7l0cM(gcJc&qAC7m`Bt@WT?2-BB*Y z#ZLBjIXQg2&})mkLy6ib_5v7cw*T$x|Cm#*c< z7SST@#&s8=yz_Gkyk1A(tSdkCz5LN;Eyt#ZUR0$@pjr$TAw$eoh#z zDDtIahB;cjH}vu~U5nrxBDtSWrgm~r^6qID>KHJ-G){6U)kMR@)@KrlHk%q9l5Ft* zWt2)%!yiDFs8}Ra3&RCTx|XlX@5}FKzN_4H)9e|AWtZkv6bi?Jy$S!!7dfYiz03wi zLO!C7%PFF7OSeg@VI0PU`!PB!o-S2cH09_sA_YEHLkn>{`rRMA*vyMXmi+dk_xknG z1OHOUNhB|?ci8pa_D?f-$gZ!g_tLbD^)XTPNyln}^M;p4Jv91Tln907RORAN$N7ls zh4{d0KLzg(=qZi*#e?jOjK!zRpbQMph1TJHklrWO)>`R5iVu&>bAJqVzLvCYsVsA# zzzqxye=crOZa6|sip{EStE3OB$K`~=CYWRGBr9t$zcI%8m3>4C)+6$s3!K5T*d$++ zvh2L>*4h?30v*9KCZ~xGvVMN^z>AaB6EuVT*=RsT^KC9YWuT&JplmjWdTfd2w^Y_- zNr6k6dNsjZrb!fm&T}ly<-J{;-M(22GrdlnLD_edX#LT(ZZgHyCFnUvD@UQ#FBe;a zh2c#K4|~Up1LBppI<%%w=M%h@q_pJ^qIUuLBN4Tgt@5Qr>)6(Bg?EGsr0;?VdjsSy zd*cNZ*LbMoJl{GRA|t*Z9m(tZApYxJW3Kj^m#3;}@{FpH_CSqcK!)DUhF1HCuj_{} zm{xKh%~`qp(1O^(8gcTESGWyOre&-BRI@&Re$xu+`^ET|@NImrue9`fE=F(UavKQW z$&_lXf7(-rDf7MjV9TUzS73Q)xkpf&!0vefQ~7eVg0B4-==wWll)1;`;o7!BMR!XR za{ILW0Uz{2cb)Q-#4Dh_47Ut%SndHyGbF7-AXawi6&oOknv)8)_9fg%yt+JtY;jrR zG#WcyP)~3^?zn-wsBIV=9IHFUrN(zN*-8nN|00gDaZsZuu=8>VVf+}yjP}mhV=eoE z7$FDh9$#7F+fb?`*;}Ia=zb~ucP>zfOh}({MCN^VRVTg3a)NRn=5veesq0@|4C=X-J@p~SY| z29hL^HS)OcFiEJxvlTK$WvWDt1ov=InDvQ|#6M5(rt}eyN}5wAUB!BS>mbAC9Bch# z5s%(`$4L+Z4x^FvP123yD0C+C8_$;zh$X>WLPi1yDTWI^7;$eUj*%T8NQ?LRGv1I zUU_a&Xm6i5Ic}tX*FN}3h2vat+Z+F~jEbhSdonwE z+=w{-gV6$Q9W26*y=a#7Q_48mFi|pTtthjqgwe2BZiYor>FO_tHG459y@7TtFG|G89w-?7K5 z8CID*TGgl@sp^)%_pK3uZoqbrQPze=Ff?dNy8o_|* zwQ+<&cz(Z*Y8`pq(_Mdu2lX42^*UKkFP2qduVMPl9x9;1kh*Yc%uQ^m{nD{F51gb` zDy@Dao!l-QaP%Mbrp}uA%k3rw9EPTQovHdv(`NST)eM#VGE1O!3Y*nq5wFoKIAM{O zj_mEfx%$_ILmeLZ55Eq^yc*w>{!$4#(h65Rl-X;8uTtlN4}x=|R&Y5=pAjhS-fkG{ z>N2V&ydaC;8ftWX!7O_jrsKXTJB%cT&t5nbqJTU+Wi!F-+2%6AUN);01DDD-{3=u8 z@NOJ73hUKtY+h#meqeKU;ZA_^&lBfM3>qJz`qW7#?4Lx3H4HBYT0b2rYk+CCW`{A!Fp0_qjLDx-?@cv#G)5TamJxYYzDy`!*d zYTc4QtkJVqN9{LqrVPzdp#>*NDspLIjk!173jRmWZ1B}HzNwv0hBHG7?I+kj?pG;< zuv#!ZIjQ=Z)ahw8$C*hN}Vbd6^}yI6%}WVs#}lXXLkzSx1M|Z>5l*HrB#sP%PW&w z#^54J8OPJ_z;RgNOWgUS`&D?Bre*hhpc-o&qjU;mls$5^Cj!-S!6)Js+U% zy?^VL;md#dKH17@$_=^=r@QaXN4@)X+c2L+j54wns)#o7J5LeCbS#v2(LR;iMq?AIlPHM^1>l_{$3fWlz)p z2xv9rGsjNx1XnLf-zBTE9U!3ZxuLp3-u!k%-Pv*f?MR5w-j+VvAys749TzgRd4_?# z?@+Ls+tczKr|ovEs`x&V&3|o^fp4ofY~zbp7laG6%oJ_rprLasv_jP29=r<|UQ`Ji zgj8iAg-E6+HHXGk4Bn8yKW{T|e>Cn4{c%j}XUV!j*tJxjW z&+Ct?Y;cDw5ZF=O+s|X-s$QM=q1D=lJm;3H-XAM({&96jmFJ(R+^vTvp(29wsa6V= zKah`v{w-Sfv-Q12MY^<6oUGrVr49dgF3M0cj!M?=p+f4n3tB3k=4J^c>#1EP?t?2er!o(EJG zJrg|z1&#mAf(I~+!sFagU34Ox1C!rcB(XP6c~jLClwv3mECnSk{bMy1KgAlbdvB=$|hmrrOWFf=Zu@{`E*;+Y4ldXnNeM2*7_)8vlnB{>s7q zKj^|j)>aMzhW7e)rZx`Nb^uQj*nZ{j63~79`$H{nXl!k$C`v1DXlbfvZD9cHVxenn zPXKT#zuM~q`W65Imz5m^uy9$x09z9{)oU3bZ3tp#1-}-_I~ZCj5rEl1Y|Q@@@ax)$ z7@8WJH~`WI^dMki5+(+KmKWdyOZFagwLT4qKt zkYxn~7XVH>JBa>OYXTtlvw@hH*x8r?=JBib0MpYD&@uam7yqB+&{qQM|JC+?j` z;K08;WoSA+U3?`jXA@!#}WIYVRMJD;5^0mWAXYdu3i9z@#Cz|hY0RW0Pd4+9G29c^qZ3}2;0 z2wqq0p;LaPbgP4zSwJlGuUNctfB}c?}0nt(C_fC&K;6C;S8i2+c_0E80M0ZKdw z5Rw1O`ek8Z0Rc)4fZhNzJtK&TnF&yB_@6ROfUQgb2wQ+b3`~I3iY5UdzpT#6zzPDy zVg4%DumHy}Gczy)9|3X!>db6xAXYHoLcj)AFe`|j4R8bjD^LX+3;SR4G(Et;WdyOX z0NVsC%*-HWCZ@l00sYbc}C!DfOPM7{z5W}pYLy+$ICXJ=#vF#+Na41l5s3yA6UME?N`D**6cI|x|V07zK> zp@`E1TR=AfOkgKqWd#Eeviz-w6##>c2|!2_&?Eu;!NSM@bgtK9SlAi=%QGx2K#uvf z^-Sz6Ao|x{1%L=N?XN@r3qMwN;6V1*6$+REAeaHc1Gc}2(*JG$D`@}ZSODYyMiT)G zupd2OJzzZ0jDH&US}7|l6QHiZ!VY)|%nJ0Ff6M-bo*4ihSf>MkgP93%!QYT$p$9rE z{VUr40?7i50)NK}AX1n>^vqyDqkx4CsF#HqP~Br=WCeklULC^50)X?^H2~}^06ah- zy+Tb-0K^FhzypAo1qgdUnT7=nKn38V4#}?KA^u>1HFeWP9P(_Q#J&`YT$xd&YahQ%^VljH~3zT;;?|`s-1l^JD9kvYZn3 zhRKJX#sO`zgdH{E&RdSvq|={tTlDF7ih{g7UAmXbPv^4rl~iW<7mq>Khv=3Hvb#QX zR3#mb7dOWP9I^V=<6T~uNjpozvtEX6yvB1R77UWSa2}bh8T>nyWp?`Elnz?+j+zwL zz20jfHisU2-p*gAHM8yYhft|iVK{um2$Md^lA#V}aZ`Ml%@P|r@{bju_?VBKZ4{bf z`(Y7=bT=c%-FKK#B9VmPoo*s*ZG4d`-WSMhzi94H{os$YS?MyCUrBc<1ag9d{q>6Z zK(r20a|L?)+Zik`V~>pZ?QjM^;K6*s0q-EW;ni@v*+iVw#h_oZW-Yznvc$pi^}TUl z&G>nd;+kS#-@p@VK~S!G1NL|Val51ookasETc7sW50 zCwIx(#w8`CrL6}yrP@ywCCT63OhFO68O)5vP`NpSqkEGF_hnNwcYlAfGV|pf!QC6% zgSy(nF%A!T7qYH^H`DfuclJb`zp+=}c=)|B-rK94U~@k#Ql5Mhdhm8<*jOT&8%DS9 zP0mzf8iW1n-qvFeQrBeSyM#$eYmSGWN*>c?2pUdImB;GEJs~4bOykc;8;CLKZbE{N7}U&R>UuqCvi0|$5kPZgWX=nnUCZhM9j6>*#~r^zkgP(+qg+J03A8Ypi@{Lc z>9pcD5Ntl{-XN*o5R9-m8?1?5i?Oa|Hb^8`A#d33E>Jm9ndW;Gm2r)+KGd}NqcZmc zUIJgAqOLcv{O=vV`F8izn6lA^5k;SdS?iBnm@R0udXUJUwtWko$#1+US5c z7SZ=Wdj^;b8?C`sB3#ePFR?$Eox!MEW%%;+D7EysNa5Y6X}uW?aK?s9cz*T_>9TgP z+c_b+Y2D^T1^OR*4YxZFC-=hfkixrQCHf_lI0Ixib#Ry_*;&I({o4&e6TQrV){!IV zRn^%n_O|dT7*|B!{r1W#;Pn||WQ{+zp5O?r5idLyR-+ZJTY%S67TP7tDm9mcRGuur z4NUZ<`ltZ&aDGPz+DM1YD3>=*{k{J?)Wcf!s$Sh>n=aF2n;L~ci)5KBl_Q&O%lclp zS&lcKQykx5IUKxka4EC??K64*Q7iEtv97}hpU|B59SvMg*J2bRbomp-mzXOS=pViJ zSh}d{+PP4qbMw1C!Sx9J!D~RU}2 z%eXNjW#{k|at9V6AXw(e*`RaFrRm=Zt7qzv45(!4pbn_v=YAYi!PjRtE03~ej;!Yy z!1$@!%78Yg-f9awpxP=Mb~a~)106?{ELap?hOb4aWygQG4=w(&(D zdE1t&w^+7;S8um44j?29_n6a6J-?Bq8MaHaPrKn4ZsHtxQdyVXFyPjfdFy=ivU-9r z-rzdGXM?FN_tqiXR$H0z1UR0-Esv);6OoOXj${;hUksS$Ee)@b`VQQdme>~X{m zX1rqRa-trsn7xZ zSs=m1tACE<-DEg8X+rP@vJYoXSI%|owg;|dgJcJ;T;IsccFxc(8Zrj`T&CUN5!NXW z*ty20g{%7A;IV-OEowvcK$Rxi96OoE{|BgT% zUN3r|5qBV6$ch`RHd4?P#x+vm6-5VG%@xHpO1~TG8e-BF1w7*H;y0%pRcxJ_pF}P7 zy4*wtw;aO3I4GvXip@P)8oD|a(L7JIPSs9uhRB7?aN2q3=shy>1 zPs$fpZSl_^r)f{g?^WT5&ks{=3C>Tdad<1fQ|mw_K3MGlE55=k$whPcvHPqCgox22 zJb)ThdY)eHqw^z-?t`x&x;8SDwufldlvB?1-Zi{&p>yJhz8)@vu4 zFWY+9?LD7!m?kdo!lW|SFVNG$E9g9y_glPlG~aQXObos{tPc6^A|(XlYlXNNj((5r z^XqvK3Fcyp(LSgbYv7^r_~2Vk69MHu*K#SAE4k1tbgfv?2!_fmgG*9U!rwyXf$XmD zF(xP)D#)zjIZ>fDPxy=wgYsfZK$l0E+|-b7EP6$3(8qfsGc4Pbj`Lw+vE_KC<4i0! z0>eBCCwbWYI@|SX@mzom0qw`52=NrP*4;Ct$MS7fn|J=%*QTQB?<#U~zl<#D-%0oD zB@CE*B9wCJzC+JE1))df87gnN^&si_H@iH%HGWKW2WURd&9~b4I~xNB-M%BNt6LkE zbAk0IO0YTzKh}<9HB8%ZV3oWs>CwHL62cl|`pvDJ29|~llPz?~T7Sw|I}Lby)-rk7 zQ=?m3B5hjE%{}m5f1paD+cfQuuSmWYO~thGYZmx|80DUNn= zHVPs=yMyt+_3g)Wh)ThtDoShl-dCw6v7rniI~zrhyUpq6d+hDkrrS26A!|pEJC*S^ z30~t}IKlj*9Oq@2wZ_mzr+9nkkN@-}d_^=Et#->0i38)S`UeBij*a~t6{Zl?IvM|v zOcP<8E}Jhb{}C^*bc`+{K^!5l)osA|o{QOz4Ju~tRB2dNc7udbL6021DMY}+W|Kw_ z(nsQu&38feVe*l#FET0^cMXw~WT-D>xG#jX?^A||5T$j(<^Iv}j5;n?Uph_>9-4E~ z;OzAGR$~cTkgc$o0vF%MFT@atgb+oU;#A=Q26MXV2mrOHE<%*Wo)Pz36Da~`RpSnmpAt6+rp3Hz99sa_hKHO@bSsGH3-$SM=L*Q;&tzc z`HQ;F>MDAcxG4fp5XwUpJ}U>5@+m%3Nhhdn6~&g^QYl1;OOcpL)0&Y-inxo?nn`2C zNDY`T-46L*cDYzCGFaI?nellgi;-`d9+!Z9Lrm98!0;$D88LBW^Nlg@-0sd#-4J~p zEH}62^ES@#_6inJ_Ge(+^QIw8*IV!?e-=PSN(bo^Z>;Eo#f>I2(m7A$A}fz)O36G` z#^W7aB{wOYY^AVc%#7-gjK{+%E&DLBXN3-vF9yJRQ4u3NIT1Kg=0US#CKklKCe%(m z{^TH*nC}g<9O_8E=GQL;1B<$vE6FK?$-w2Fiu-p212sGKvXu?% z^^E}){4>g?HwU>D(lt&nqApeMob^9}dOvJ)H&b693J;}$jZ2Mk0~U)4pKMa86kFO=PqckC+|0a^?7Hpz%KVlRjt}-{S^UvrgfnWU=iz8=S>ecOP3|5RSrQ-=N5KyNyv4#?fN8*p2S? zi-mwxAi2Mxj>4a7ls?fi+1Rp$$({eg!1x#Bm4~MRkeHO7ox2 z2EGj#7r+RC3lbKJzN3j!4;~eZ=dFJd)^{UG7P%U25DPnFZmTz4Yr3DM56qvIYjcm= zoc2g=U`+`u1mP5m!Wf!n(>RUA7dT{oy87|`+OBESjcT@%OOvgJ2MeySxrSL83?5I) zzpK$N5J;I`Y`Ujt?=l-GV5rFOS}b!866`gF4J+s|l_-)%-;t6p=6AH?*0J238{ZVE zZBV1cV5fpxGov^uST7vEhULdn+~YZ8RxZew?av4lNV&Z(2w|0cbToB=_xjLoc~Hea zl~u4erXo2L?$A9{Fd&t3JS@YEWg5vWT{IuJZW8a<0)Fbdy`QbIH?a6)I-$^MR|Q?> zG(xOTY^WBaq*tqiV#ucZL8_SDg9Wm+RNHltzg3-|*SH{pG{Urk226z&aZN4l&RJQf zik;}x?q5fqLG8+vFF`&%Jyb_K6EYND$3PlE8Z*0vos!gG`h5{YIYm!WUaCU+LSF7^ zMA?t7G?|A%Q-RY;&NGFsG&^%(4~b(rSA`FfPL7Ft8V6gjQqo%D!mwJ_VG5zdI>k$k z*brqJ0~^5e2t(D|(1D-r2ov}(sTNhJSuJZiFSyj}VJ~SSlVVG^Dq6m@{b-W;fww6F;$l_%N@ke?hoU5(FYe~tp1n{JJo zuwg|A?VVO(*XCK6am6{^jZvbGr!WzZi%aPjfeecTbJs=2lXG{2Rxyf2H~Sn+{^Z@K z>{X{spbMqw%M+P)ls&ZnFlix>vbM0Q$kt4oX3o)eEg0SNbuoU~OM@B|O`*n429wpm zqWr=TFq&(F}fE}S6xJ(&%w@p8ezSp z2DAgTnW)C9r0t0hqLy)?Po%D>D{<##CHd-6_ES+>doi(QGZ0I0GuM6hn)7V+jNaMf z65~e{)ExbiZ}jg`2f!B|6awznM@0$>0XNsBO>5DlA_VJHF3bc?GZbeqbeS?GOl$E} zkfoxuQpC(7W`@_FMu_9rgrtik-3O%$dYL#FJ;j7n6b5s8dt|v2%$bh0H76!&>nsh_ z^e)O&mjD-)hnGbK66Y4XnATpy!W7o)I;03qvsHIU_A(FD(j>Nxh>pVAcTfe;@bA2!0Ypz4GQOrCqQfV=yd6p?s zNi(Lo*VN8{cBG7#vtH;uI-_~ltQzG?l<-N&o6IV88k=mcQS~7(|ERa7_Xt;YGN{=i z1m>ddPxxS+h$07uF{@lk-a}t%y~>|v6}7O!{+KK59>wC|g2Hver;!=`4Tm`!!$te* zasLsi+dAfAvA8$oL9CMBMRxppr~8(=xnfeb2WXrf1*uElq!i#|HP*=#^iPi@txLGC zpyXokj0>nK$t6V;*i+(+*Rhc$ILW)FIi2W8PJ=3TU;si1XEu+eL5Ugp&q)MrfvZo#LS>OLr301VAw_bD z676x_J~y~v4VG#zIN_$42x7TX_t?^b`O2s_A4|7PXv_1+k=%UMmhTOSvbLWjs0mBSwg-`}v(w*O} z?5ED3pWVv`!Oz6UOGiP=R;FXxjUAv5(}-pTmx*4*QC@12M*!xe^V+`-P@beJ< z-;ER3!#91sRg8@^eQ>uoVbaUVDkJHlHz_*;g*Yg>aA0QoquIPT)6MGSQ-BJVoxb zG@w}u5duD$ppIK_iaL_a2E>0W## zR{$Fo=G`OKok1y{q?=EmdmAOz_urQ_=g~p`kL)uHqSD42Hmp)Kw6Gn&Ah>`)3*xpn zTBx}1kkz>oLTE)SidPx4h>C@;YKrhQhdVug^Bi|v>-SyUuxiucK>FryLoAExQRA?U z1c#+a>_bTg+6rtSAvuc~kP|E&g(?`&8x&7;#1&#@23v;>awmjX(pmF6UVVd}MvRKX zaEKtuHec@B+Kw|Ay4ohYc*~ejYYT4|*}PDf%=lD4)Wu7^W_ZG7#7$y8sh0dRdwfxU zh_M)ZU&nfTsf^pZfNs&$y7n3qbZ^!wk(W;7gnX~GA}{(db!KNhIC`Qc6_}h_LEbwC zIdu02=A5Ou51`8`KFnXPw2yn{K`(XZ4(!Sf$B7|M{GNvjrjWzEACkjGvkTOs4>YfJ zs!+`1NLeEnchuk`feUfr(rO~b3%WL32i^n>WaQZ0uau8~K0c41i*iBJTUc#XwnB4Vf0brQF_=lxUm358hbz0l4eN0)sHc+dN<#oH#SKq zl@?3USzV%yhoTMq=W~!W!-Q@jgf-i)+mgM%%PV^R$lQtTtYBPYY>f8Gqr2(hu-_q` zk!p`(JNAkec;+bA+(}tXs(<wwm(uPE$$gQlT zkO~6&Evb!gcoPVcc61e|k?9_4{n4)Wg*RBBwhdev+wV1Ul1lRel#UZ0Z=L&D*kBcf zY^!g~j8Q30Z0nH(5uEb|$BRXV_E1;!%ttKw9W{g*@D#RfE)|aP*s^?K_b2?qLx%EIhj^(dV=1CYU0jH8gjRhL^;}kD3-`W}DixqKg6qwqaoSx%tYAGw>?s zXHw4H(zz}858peD<5ge4uUa{WP8>Ed07`B7**?=Tx(lj;$QdJmd)gV-KPdrR6#MGw zRX>PfpWfzfHQ=#2<_}0gaZ5j@A@iKh?>qBR?Tf5vr;zw(bJ zvj~!EJnhpS&WEINv3~+78=pLGZTBwRBG^|5K8OcDUCdag(%Ve?>W_PeqaX4g>_r*O ztgt+4Re#32R7b#W?m5LMS%HU}a?osL&lh*%cy89sPA{j)TXDF+F%E+}a|yKP&-KfF zTs7&vOfJMJ&*!c$%=qQN_x0h;Gsju*NUPT4GMA2*?Jqtel=Cwb*1^ic$BFF-#BbpQ zCE?%vFAYTHx%P%b=er+HXk}5T3L8{gcMS^I)5pwmzDaIpT9=lMO$5CCyb59pu_nGm zj0@?ggy@oS071_(t#nH9OcY~-;Z1+L?EYy5h)05vB;9< z=W6I6tDA2E1l5Kua?~ItzGkzopL_4eBe9!6xQ#$KlGQ21h%;Fpp;)aB<&*CQn}U-N zto3VNN7_wVH_Hu@i606NaBG&ige|yjXj#i$`eLfD*QT@~yrYk`kkzw^f|1)yDd5p# z40>P$Ha{$mJ~Qqg5^5sQito9-{n}lF$|azlNYs}5C5B=;mJda>M1K3mr1rYZQPhz} znXx%0I==;vTVPQl&AT}Bwz%Sa$*_3hBx?Udyv>KYl5a|%X}+Y^NAW;d&Lv%9UM}0n zG~=@v{Om6dexb*ULdct;UOm-qV^q%FQ3*J=reM1Hs1VIYF^m=K7H=Cijt_O~$rnB! z2N48|hdRE65SxnU;(3;4c=P=MeDb1yQNDdF+^Fqc*eqw!Zha?s;P&bM{$QygERFs5 zx$9(OV*|d5Ta4(=Ps%xX-QuQ?Udt9mEK-bUe=stNzUG|5kC24=a`2GkP5?^!)IuXg z7Z2@e&Z?mod}Ppcqo7uE)e+E_iYyvMS`<}yv-l>g{1mYEPYt3z`w5UMRRbG&FZlmpxkpReAPDwMQjkno=qR~wc*2HGN*#R7Rf1rH#! zlhs9rgDO|mSYnt_{C>tM3YT#Yw@oe^9s@7&$Z6oezjf53HW*|4C>m)<8A3c=;}Y=a zPq4jes0*8|YUt*NRvk!<*f_o4c^GVz?riAMH15%0b6#Av#8EliJ&uB51EL>>IGa$U z8xT}EvfTTVUbl`%PRFy?J8Z?CysT0d?Ze?KCLFc;)#4g{@0Ru1ev_1ZVUCIDL4w}r z>ozQw8H&U?QfwC3PD}rZ@bM{yhCi!~TxK9Qec+vU>J`Hg&3J^|K>fPkU?4mUHo?*F z>fw#}tVEfcuVQXgm|8j)%@Uz_dfzU0e-~99DB5Q>_qU}zMusoDE^*^~oAF47cB(j5 zH;1%wUJ=#Ahm$$}Io8K#8`Lm9X1e*FDjd7TYB(UaFgjqC!7wmEC;p4{M+c48SFW7F zVevKyR7jEZU@bAIY!gHTT&#^6n7V*3>QHq7RbR%WB&)~o(_#fA98yDVMf1Cn#?}mJX0Mf9qojaABi_Lt7Z^M>QO%p4?R?ULqr(NZAl?%s9uW8 zGo7WXW(k|b)uU!!)Bq26~6W2-N7Cj}3zMOpl8P=W2trcUlJQ^03yrhWRUaLGH z)>@_DazxvJb%J-P;%y?W*$j3k!?Ee2iix8%Yt?hZ=jGmy87Scp+jaZT13kD6MLj;h>*+EsybL_ouNCc9B-c zuirBeigZfCcdNre{7NCFveR{;%$;jiUZ=zSd+x`qGa9xJt$GJ@g_&Rko28}sm4IKM~6`D$-8^5 zNDTof=P8_nelfu`&{T+^_1CqHuQlZ=6(CP-tRYV+-LRmd* zY&(+J6^FaxLgwf|`QqxC%&2}0%o>ny=XV6;^yD9YZvFmn(uX1Nyd~ftZK026@k`s0 zyUsn!)!dNEByM$;t6H9Owp+CG(ObQd_!t(QiWZX0T1zUN-ewWXQ}^(k9Nn2y9hLJx zj4^8IAiBBCAzvDrKKh+G_iA%~$C=3t2NCB&51a5}qRPoQW8m6;aP(YQ7SMc~KO_ph z@8C8odrbS84+8otA{jJ3JZ3iDs2t&2{~<0+`Y&pUSij+dM#U*-#VE7IfxjL1_Pn&Y zgqapQHD#W)uMw0969ka9Y=Ow`M$a|HF@!3KR+v}CmIf^!0|+fgfd=mm`?$@8j)j&4 zX8VP?8a-U@xZUg&yC;n8;saJ>~3#-FX7w=LA5x7x3f zzbD5pL4Z%O>6@}84otdAak(emoOqla_B8bV1hwK#M==J{)){IG3XW}}A(h=5#CUHx z=jC_zM6`@U7wMvuH=UOIXPv^8O$^HFt@LNs%rL>zw%%jR( zJGR)R@l2SR5mtWINa(&se_G2(+CV3{-GgLI?qVHc6-#J2R9tTOP`@r?WpvsJ@lNZI zMZlP2bQn8wBt;Q*UPx5UH-4e?q!dpORodsDl$Sfn>CpRWPG;wvjG#9rQy(31B#Rsk z*ie7^xZ$mX51Q+tv+w5WL5U~yZH&e8RH$-=0vdTzpN9RRpUA`II6nCGnv~Qqn@lAY z(HJ&}(o;t&-pArOL?X*xeIzX$h+eGMb+fbScm6{9$kPP#8Ul$|C4Hgoo@FCh{H!{~F3 z%eQRF)f=T3+i3|cyA4ZA$4$QRBpU)6RV6*mBZ<)-b+uf074XMjF& zg>a;DMB6fN6}`p9;1+r!ZNx{iKkXg^A`pg(3c;aP0b3`S0W}Kf&qjFjL$LVfj{HkM_)v2)%++Go33FoSPkXNAzVt?3l z`=NDLgQ7ZXU+N2uo{y&!d6(U`>Tfi>+nY+;&rI!aAPWq6`Xkz}r)QTkTOO)AeX@Qm zc1wTeJKeO?x8s(^G4mN2K1B&IepVI_g`wZ0ElvNK0qv~tIKD!XDB1QpMtDyDrvVPty-~Dn%N~O?lzv$03$+Ea3tQp>e*xSZ= z4kro5X*XeO7GApz)DzM;l5TDDQn3)q5lc=lEjw}!sFYyqPlPTq-`roy7K6z|f36;o zw+@ORBSDLZmt=jB!Q~SlL6U)>rBrPFDP-~1EL}#x0!(vWa~t5R->$m1F&_GXE&-%4 zHfDFqVL1|TFUn!(sNB%&(+32)Y;rBo&; zx_5U0)Lzdk$(r!S>UAXS^lGqg{)|*(OFT8Z-)+jcE5cblZKe$+^ zA^mOng70*cv8&(lZ}0y$6(uA9NI0Sgkuy1<$OXJ@69b$o@PXwfJ=!>h%$|pGI&Q{7 zPB^&`DUP-clyvw=^Z&=(T?fUrtPP`w;O_43?j9V11$TFMcXtU8+}+*XB{&3kcZc9` zCp%}Kectcfs_)kO*QKU+*TQ;A48ie(S2UGlwE8KZy6J39YA;C84 zj5*~1YU9RvUpZBG&XtV(39gll7u%DvzyljuRp+Sv?iuCujg60$O%vy%vR~-e-s2u%h0|`=*|}7jNY0+U!#s=lmLEbtjZ_ z&59j=6qg8+0D=V zCSV$r=m^LY5?J!`F@GU3{h3T`*myez))QG7@?gM_dQN_e$~-Jde=w>g)X_RpmtMw2 z=6XU9xS`dPK<@(X+NvDS@(OWv1n)1Vq+pU!ieSd_~{CX*mo(ftjmw3*p58VVH0 zwDY(Z84|d4W;+AU6pZcYQ+HpPqfx5m%_=nI$SL_8hVFC6Pom_{w+xm?e52wDI1r_g zeOg;1q}`0_o4+C=tll7+GcNMhQEg#Bf;L=okU3aM_Q@Mok?1`F59Sv zYw{8W2&@=~4TEa$Q|kEch!=(W=MltUT(J>E#2JQCS#|OTj6{{MU1%ZNv$6xelonpv$M5Nmh4V-OYRGg#uA_jjV;q%BntDlVds#DhUx8$CY=G1WcPRcx#y z6269wU#ttf;4T}D!+UNjL}a@}>?fCGujO{HAM?2)rrStwVfjibV3lo+u-S09 z9^5+Q`LO2mkxfyCU!T)|>1KPbn_##e<{v~K+^+=IPe_d#9~5c<*V@O%mAw_&9jKn0 zc74xZ;1=uTA3w-@2hq-s-A3y_4MQwVfh6kd7gs`*xs&&7jQ}Swn=TmHcH&Md&XDEL z@sR3(Vz}Ju^!Tis1r14v9geusi_(>-n?-#eB83YNbx|=W?HH&5cku)UMwZC`*DZ$Z zw$O?ujpZ8gTNvqgcX@3wY-Ai3eH|0i8MUOzCNQHs^>pT$3TeS9x=KZuw6@9OIy)6Y z6xe9ENh*V;82p^Eqg1x;*&$_yw`U(m$+7w7_4cz_XV>-T@j0FezQs+$i^sG2vKRWU zZG|1p*$%w}1|J{QH^b&Mf*7cswR7(m+>jA@JCfo>_ z)+p{~LQi)HUVI`Hh{BZq4JKzHJRdZ);9y$2t>*UbLF<@`(Swmn0nU;N`#sJgX3LBk zbEVV*6e{&p^`H@2!K1*Cx~qt+pWf`~I!MvVvZFXQ3_dpBwILH7raGx9rD!1T-VQ8k z@BLn4fcFD~<{TVt7$t7}s*W<+F=*0!wSduwUQ+@==8s~(TKsSzaNS4A$0c`%be%iYA0bO!QSH4L z6zH1pA=7kiC|hZ`K2-cI4?BiAPg>v9-6=bVRHl4vTdX_ABkg(w7rXG5N7o01*M^h8 z@L;xb4KJEd?1MgsD&+`MFFB4ev=&ZziviNM(0Hs9ms>?~mN9CADWgL;w7>K@cSIUS zZA?>f*6S=5t2dLJTB%Ybw1TCNi+h}(KB(AlY&vczI~|jw3^i0}X+RNw^= zT?hkv?1JZaOfQTrmy_)~i2>EofaQs5C};pdx_-+V$JIa`%R|X$mj=rmu8qLNh`etM zHlJg(#x9cSkL+mZlcE6>=||~I_07g0kjqfjs^o28h@WSOeMS!stgv`iL)EB?=g#GX zLlJ%1-PUPTeh93&-ZVAVvu*b^XRnwxb=Qt@KTUR@TU+VMK4-Hw|2h$PJyx9xd(nuT zpFJ^UUpKs1d;j)?&y@wcE;Y1iJOBcL|GwX{aEq|%;Q6e6B`qZ|)zE+u{J8FMwE#~t zT4A5PdTuG%x;`MMMMss_w;3O>d9a8PnHOkqoTJ8lHvau=C(bA-fH*e-5d#{n^{v4? zSq3q3#sp7K%nQSPCR#|z&`QGU7S|zEn76&LS1j`qQyUD6ms0GGazZ6O)V9NQS3Fk7 z(&pV^4*OP0;jY;gREz1*_Ik(kaC2~qskuo^n zXj|}VDun1$_Q3;_)X31#_h>R0XJ)=3C!U8G_XX&x_-seL($7zmhV)1VQA6DLj9Sy- zMOKZV-pxdMn%8eF@W{N4o8>F z$yxCmB!tgN;=KLL;47S z79U+beU8R&0h?hGa#=dA3nR%XT`&A;@XaAFVZ~A`jx?Ykm+0FJ=l4YNbhVM)TEz9~ z97Ppr^3)^!)%X?M!;s|SeN=)JhF;9Pn`SriXY&5(Ot7~_<= z?;}2nJFIoXQSq)z;`xbKrhxyH5up-BY~sMr2%{QN*35He?C9vZa-Pvqh4v4hmdRO5 zKC$+RKPD-WenqTVbvCvqoDR%e{&O?D&PD&ZTqZA4fygBvbv(ihi+o)nADzKPKJME}Hk>DX)DZrQPvs>wmo=jDOmeX(vSRAxEydQpe2&tg0yOt|)T zF3Hq=)lN*jC6WWu#w}T+H>#kV{+MU^YuCI;c^FJAl8zAWUI%LPs|aAjwUd?CHZu)6zH3k zCXgFkYKxamdU@252g3kF!lRziib8gH!U&dCmf3=iPbyH0ec%kvrx{Wvq2->5#)7pn z;iSE!L{Q%$QqwulW}0^L?AvYgNz|q><4c=Dy2+p}G_vxN%qZ!!P7M;caM@R$FD0@@ zSpHSpUsDmIkD2HX(>?NE>v#k%UYeCh>(n+m%3Fnes!G!iTdJ?Gl1=%9^aUPtXF zZ{uLrjH)7AnDsyXl+<94mw5n;cq;itT!+(c$*Rr~SDsz--WEnC=VN^1kQ4)#Kdk!m z@YCmn`*GThPZC?zP1KX-LRsXMTjP6TT4YNb4m?{?(%JjTxbM6dflRfJSSN0Wh+q|>3$d+B5^5I&k%fw}3kS4T zYe>d5R>fJyT55|=k%V>S3H)I8D1=g&QoV7~O^S)3{Nbe7faZFE@%4G! z2U&f}Q^nVKi8tQQOUVct#mZt$hFq*`y`_21_J_a}oXK6`q&O@9R~&lJO&LqY6nC{W zk7bHdmy%tH8|2Q6Y(LYlYbEs{URL+wLfOixHQun>KjRTAm*Y7nae5@0Umg)1LXm`C z)N%BisKqJ8BHiji_POvULk&#_%F;-qo@5kj=Twh#Ed&L2Q4SWU#}(wsWo}XiOwC4a z)4Z{+tzng4|ATzCisBA_H=*vX$;c!+HQYanM9>%=j+DZgU|l11Z?n~LUFM(+Emqri zF>^1e)QCLQXrum|^hU*GArc2O_`@i1$xYpOLstrVovg}`X*Cl!>ErumbIVv$ySJG6 zaQsPgW_JaqA#p0UUY=Cxg&lBvY3Ah)NCeKW?(Tp!CyG}4U?6VKV~T#hSyHj5POJ+m zmoR$eCVQL73D^tS6Gd_b7U?_p=FiLcO_M|RHY+PKn(Zv)&8r6nOgYt9@@qE5(F8;@ zVi5MqNtCoB{58VLw`mDYykSi1c#gdNnQbbS3A8d@GKpsaYx%ia+Qsu(XG0lLf`yWc z7rusIt@dE8=7SU3?yUXA<2a~f{z+?BB%S#1mZ9I`lb^h+cp^X z)i!GvX`k{#8ib2GLA=Q`r*9F<_~AlpwxmQTG7cV^3bHaVvl1a98Vd0PFw~dL#sOIC zeb`{?XiA^oU@QdCP*I&-7crLO+M!V;L!F|qLa>T1BJ^*zKFc1It60ICF3K|xzvF$a-4h>dT$rnS?0S$By- zKJYjuafQ;7E&AtoCk)G>0pSs?8A|Vv=0VBQ*QX30Pj}K$X@B3E@*4J=P)G}NDb8H_ z)WH0C3M7*Gr^9lWwI?ze%|V?kcqBBUf&_=+N9v@vrvI<;&)A2f?ns&ME`?c0OY0Aw z2ec;&I0U!wSSyj|OkoOOrw?RLr8HGp?C&?BA8O7!!7%u`!m_&8OZDlaWvj;+kW=C2 zixV9u?2bTKPdF!hc!>DB91)(mgnFEMj%WM1O9cZ-7|nz;?>9rhXhGhsRj%>D@K4bv zyNjE5VY~1TY4&qy_Lpp~8}1W;7~3+ z2$G<<$W{&hYu9k{qvS#X(QK|gCSxtGh=U*gw&m|1K?HuWcZR~^4aI}{U+c326xX=#ob_Ac-z(WIzyRb9Zm&`#5 zZ<&-7d$Q&aU3dmM_&=^~_&~h`yk+5-DB9PLYifxKEccenU2yJ)3ZwX&SI@NXTH)%> z#m{~IwbSC@?I$iSCyv+zhh+FJ?dw@kCnoo;31ZsYiD1;LM6265aNHl?vepF~TLbw< zz(PTYVPsZ)EHt(twr+Rhh2G(<+XDL!8u}+M5{;KHYFP3KIl@>$ZJWo~PXM0}o%Bet z7f`Ca?qQ%@XuayYjNT34=9s-D+m?pqUQ z4h7igu0XDy>?N-|?^-jl4QNYN^e^ z*ctnkoreCXn?Lpaa=M6z^E?6s9$i;eD?-twX4=yR(HwGP+ip2iwq4ks8&FPEEoI6! zr?1#vT%v4E0U8L9Sob>Ib9_&k`J7SZ3gZH-lra~H_pJ2|jdR-}JPyxKGejE4jhlc( z(VD&xaxyTlKwdst3MHGlGOk}U%3xEUcFT&W=~KC$ zS_Ko)mg&dRgyl2p$|xgtoH*BIlk-l$8Xs*^^ko0Z9(;`TM~1e@^lUtOXPcqw+jnSX z*37Pd)^aZYnsbbNKe27!D}w{dO|YA^9gvO%?$fefQ~y}^>fP7(k-iOK)<}?y`V8p# zbf?f-;{=O*ZBoums(dM@*{l0@t-N)sl`T%qtLI6X5#;UbIs{H&UD+!V2fuqwzZ~q^ zwos>H_T0UVWKvF9S(^Q)`mFY<6TAM?MnOklezdezI8-NoF~zNrA$-)JqM2-3!?A`B z7PU9uz&~f)mvIGMnr?bNXi0IaZl(+B%|&Ai!?x zkY3q9zW+K!1i&?7iER&c=-M{usE|uIr>wsJIB~4L@Q2RcgkOgPWj#{b4&}kmKcO#~ zPUUCttLh)!8LRr;qktb@TMDjxV?CWX*ap( z?Mh{nEwvax^r#%vCFdvb*OyRkt_VQ*6wWT!%0(C3t?6+9n|&v=ItbX@4Gj4_4O|T! z#CtUhK8P1P)1j2^nX3O4v>JmMMyCAFNi)+WoPG)4`@1*0DOrRCFP-P+3>Vk`?#yh} zRc?22tEcmKe#58NW%O)09(=*UkQS7$_U(VS@wZ+aI<6r82RGiV@rA<-{^IfyNCodI zU@-hgUhc26*O+g*N4NhzKuGUc&kl{Rp`mo~pfE!C*^>dkS_OZ0wvFXulqh9Gbm~;A zI$H|PAJV~+l#sl7qo4h&|9&uCB@GH?dR8A7Ik#JcP95GFH}RX2Tod^s>Y$=>Z!h{2 z3w+{dKs@!5_OrMJVu2-w1l=+?9c(+CwtW+T5%^sG)>1(E`g;V@Ww`4b-Z>2x4Svr_ z20M2QJh}&@G~0f|hjjA_e)ki|DbM=Ex5Yp&n2RyEY1+&GcZdUf^u7E3>_O-HB>l$*Qw!Eu?so+2(gkfBPyH*G4IV)3lClXHL9C6M=ZHAhiA!X(~F zH(QG!8BM*0f3=HgC?)h7!R5(un$Z71(E!ieekZA-BL=(s<+)xRGDyoBqweD)gyV`K+NW6S_% z>pz}l0Z>xE!L>iG)^D;0V0AJ6gPgH*vj5FwF#=W&V7OQTs{SONC=uMM)X1D5y;Ndqhm5bc;)S$_*&f7~-RfQ$9lq5ZXCE*1bs z_8Uyo2B>-f4GchPad7@7(bzZvP8gu_+ad$31;DOxv2rp0Zt8zrF#r|E%1qD12|(Ze z90up#B-&q#vC(t=_TYX$#li}Jx7dCM15juA+a>$+B36K^1#r#)z#A(-UHc2=0(fwo zzil!OK<8%tix>k)Y5*GyKzOlpu>b_L-yGb3#*B>>aKwL6ZXB$CEI$DD2C%>Y-rT=q z_)mNQCepu-?Vm{f2N(D60I>l)HWtpm=sGrlgr^CJ001Ea9PZzC+CS0yTP*}ciVG0I z-^dx@mGqpyRXPAYM*llT{{)c(@Cf5y!2z@kJ?CGB**{9zKQ&f>iN^T5g#oYqn{eX* z$ZCIScK^6`fF}7@tl9pi?*60we)DVqv<%RutN>FEV8;P=>EDqCwEEw@?VomF2Ow&U z07VVZ3)lg8+i#(dkOR=s0aV>zh#KpkC;-~>cXa=Vb8Ge zxMtl}n$&N<;v{q%S1+j9)aNceyG2spU{6`UCJqly`O}}WNs}TtX>?4BO^%^n4t&hH zuZb+&y==RLJ6*ilqZv~f|B93yBMV9QDm%RYJVpG1WC9&2Fj^dI;)cF#x8Bt4L{3nM ztW0Lg9Z~VbZnHVeG8(n2^PK9XwR66okJTmn+GR}&S3kr$$316^Ljj#H@Qw1jLRq{q zKujYWnfjP-6kXlse8U1En4(dqHdgvBu_)~hyb@?ZZkSpD-WhP1H0d4fGZ*?7G*PY>3T~`;asv}zEW_YBh#@)y zjR*8khLL_jLlgyvX`bN(=FskMu17f(aJ-~@VsjOiqn3FX4Wr*@NF?;@L}i&Vi0 zqZ0wmff?v^J*f&AF~=U9!tO`XpuXuzo9gCRu=aE8qN~azj;K_~mJNT2*yYRko2ZIh#qY ze;fpF{z)Xz97>SzM^%x(ULQFjB=nD*I!;7EJ7J@rEiwI^lLx4r`A0{v7h_?&ArWIO zkuZW{@>rzKAEhT3h{U&VF|oTWA0PLca+_ssFMJPcj+1=z+HjvflL0|QWnxxis*#ioUn`QqVe|58aI0>E@=$HR-CTdEL z$+rES#s8Jx&+sI*G7^I*i1M>h{dbl_hV(bYOl)v+S+G2i!*Q*ve9Jqi2arQuunKqM z$%=*4>;y0=pgQQD94<$bMi1?ieV|n6oW%?*dKng&FUM{Br>TD0vX`gCz{M_wl`Ua(r+-SihDpR|T*3=^>pFREY zwgf<1pb=|o`hgLw5`};PMjB(c7^bEk2nd?J)+fd(o}z$y2hAMAaqd{)PfNC^tU&uc zi>7!U8cgFU7d3o_gI6530#6vOp_5-Nx<8ND6uw?Wu56|rs-nkGK0jCVt5Sv-f3VTdaW0LEg}QzC;o z5ym(<4)>v3AXNw1>_}P@T5A(E8dcTzLp1lXnb1+}xHT#rOn0?j!{#a+M778`;&{R> z_lCZH*?jB9%Vc=q^-y@(^n**7kax@*Je^}%1f?c7s=``g;&z-MCitFeS+&X*OBj%9 z34D;28m7*P0>cDTY=BD52n)kRz+#VWvaLniMCr=jR|4SCgp`|K^~*(C%0+&yu?#cN zJ*yZ1g%Cz5GGegU(W4tMp&PI#5k`5?4z#Kn1y`!Yo7W5UaU$I^5$H?zXk~T}!S>7=wc|VB_4`k1VJwyS z!Au}9wUA?WHmaK2Rb8sY{)|7`F2M8GPQ+;r43Q29qrRC9F00_N*r||Tn$Zs6MtYFg zPCuIV6>w#vm9M@*)1Y~DaX>#Xe~plZ2& z6L8uVb)Vw9L_p2x{z*WoRx?6CnbJK?K*@P(<$F|7ubP$Ky~kT!y*2KxquYDd3MeYL zHl{1MtPl4N>3->c&Bjny$;JrJrgS7AoGjP7LVrM$Acu8)xpc5#8$DkeUM01i=yZa3 zIM&XMPisTTTmweb8uf+`_#ypRIzNbT8UHh_4PvCmw}@s>WbKQrGkT7{8cT8 zu6^yf)3CO#Xg=HOag5QnD!%VTsOQpB7D9^J4M=RY$yT7zj&90QP&Z@kHbPu*iU@iD z5zOeTb;DzYKtjFX$R`JM%z+UvhXr=_1vdgNn4k)2`0j6!>kfPb?bjakF8%k?6>lCy zE^j8{75C)yE_3AME)#(Jdolhddla12hGo@?NysTZ*|yYh?PhhVE*BP@mr)b)rp&JI zPS*72ijFHLH+v>GPs!}%-MZjHYzxbUKi8xV;<-kBtj-edwa#|$t*rV1TRQe2YVwK3 zY#&QGwf`?&nk zC8zDlqh)$dGTXKLz;^Mn+g1H=J^N1e!g2QDA<&#$IB49d?d?HhEX3%-kSa4N?UCri zr0OnB72f6{`aRD;wMDHpwjuu5Nd5*^U7k(dNuo}#evEc_j4+C}rq>|2(r~!Wwr-8i z4MjQ(l{>J>t5^<>b3J1b3*p<%ich1r#h8WXeA3Sl%Sa31#$FBG%664fG|OO(CiKQ# z8Y0z#I}vHq1#60w0>{%PmXw0_ zQwllr71T44v`qnn zdyRQ1BQZ2P)jN#rX^SB4+lIo2kM4FV^CYwFQ9{^GenCaId9R`J32;}) z`x*%4^P8=qYRAA!tfDP1I-5uM$HF{ zhRp{HXYCW;Iu^@D-xew^(hzRtX90Cyn*d4)$IMEw~5M|!SXW)oq zfv;hVd||{QM}nyNLHMu5G7FJD!C`1gIf*{Ols}GCkAgSuXcF@f-jI!tq`F0H@A3f( zp}`%@ohaAar?=^BAAii9JD?x(k_b7UK#qX##L@WtTF_Js2;Xo)zRC!Qqk+#%ee2PC z<^nf>e1n}Y$<5YBjLFZ|XS6sr#WV00yNu!L1#=H-V`>6QE{~ z?~MRs$M20`s<|yhTX>n;1niA)sE6f^akwM&OpmS!Pz6Oc2i?_VH+!Gd1UH|G&pRW! z0txidym7{^44>KQYx-bnL%O0Pr^Pmh9JGWs`=BcdZS~0(W}0iDlV>^XnHJ_at_`)s zHU})UWH$$}wFEyx*tG;V2gq9D-{CCn(cW+twk@7Hv?65g;3|gM?%=F?OrF8%`{j;K zTW}X=7wy5SimP|OG|Vm9qpciUE`{M7S+-zv%r4eIam+2+!P(?i8?e|ER_{=Us$ zn{1DBQNXZk`iSR^rCIa6D=1rY`+P}Ew~xUN!yC$Vi@pt}dtluO!zbADi2fCO^_cz@ zeDyf;k?x|9VMlgNTzBB|O8ohg(`$H_U!_V59N^32Tl8l+3|kLwas06YTSU*i7eoDb z?rVYK$G1x{;>V6H7_l>lb_7{DQ`@m_@%*7L*Qnm;2wMzy>aU~FA5oci>SsN&&#Js( z-Lu_0M7&ZT5uue=NW9|Nz4>nb{DH$)#NObsh8W)9a$96=C~`Z-fMOf14aK+D22k5o zer9#qaeijas_pCEfdkwRZXW4g;cn#l_TIXszk@Ms;XPw?gt;CoE(JdvDY`*j&J|xV z^XCB8ah5A*z`pvosA+6#F3AxLuRij4<6dq# zK4We)_C477@rOKIgL%UeY)L(1{@Nl0)OHBHQ3Mf|>#G>L()Jvc??{etg74J6&H< zlNL*$Qe+NC8pNt;noV-H|yte1J2$Kyl_^#f2?HOY*UZ$yu#7)i)0CR z)iXIbpqeT10?!e3*T#Mz(g02HtZc#tq+g z5kj$H<0?srN4Y|;0)~W8ROycFUmwG+k7m;PbaBRaPDl}_C;_}NXu}&QUW1d2lZ|!C zjp4NMMRm^c(fjpuZLTA-(|@dAgEu6(7Mpvc*Jt`;>B#ZV%s<-#(eo_?i(A+$VwVG; zcW50gC?t%1W;>d8WGmAlr71y3B4n}^#DhV?BnLYWd=|^WsYWUL`ncImuRv>&o{vnQ zZ+xBqrd9$6~wBhCS<3ke|w8YIwfdvk8MEl;Nk8V1LEB)Ro6ST?8mq zb+bA%@e(a9B{hVJ*%+{o-a4_GifGA-Nw|6Ic zHz{w$1I{hN-%8MB2Ncm#wYUl9w#|Qb?xr;nbCDLp)Mlv<9a)t=tBZubBz|oXJpAHZ z#me30T(n^-q)1xUg?jQuu8{i2{p)j)1Ze?FA-5v;7gH(cCMPFLx1y>T%ZL;xm2pbE z-L&y3m*>ei35nr23F-nvp#+`8PMN}(`B6{cwtR7p;kf$~6|QQZ7Whk*k;|j2)a73Y z{xKSza?++>l<^u>tiw(RUQ%Uwxvw+x`n{b{Olq4$a09{NSPn&TOeW`VPfVL|bC2Iy zMM<{rx9?HX8bm0OYq{4;1em(a%lArR7p5EvsDJ2->Xi$Z#V$yh1ksCQSd-mA4YcX) zh3qyl*YME%aBf~+2ft;Jle00KNu52qk|0%(ukws3uqx)EKg|MN#~agepH)4UJre4) zk#Z&GRh4TxSwh^<=rVjWUR9R14IgF6XVENXKen7!q<6DCsABEuO^esBI4w*+Njd)X0O=f?ke@P7=Q)%R5f|L9bH5#jK#)oqVD}2 z`Ui;v?L`wiL-H(@qmnjeaHr)(Q&P7&r^f2TBDaLU3%$8=~Bq-MyZCjq0U_x-5GRh!MDLB~1!`X4o89Vq_uosqRvy4fQ z_!vykwYs}{&kRn-_0jf^=}+BjN!~aXMJUCbiW+p}Wb0&8j3xwI1m&9G<&5)~vB=X0 z#}kvbOO;6ZF0IVfn!i`=zlisrPGDOXws91R;fE_FUY1bWW=#KNb|ts zjD&*iJoQL*a2EwRWiA5~*=A-WL77)r=RWjSzBkT2XMNwMS6P35vJv5+U1b{))JGzH zU6*-5fIK@-bifRE%Gqe%9)X2Er6E`z6E4Gz!mJ9NPHmmS!z7&Zm2`};2*6W?%P1#` z6CYr&)bNELqwOPk&p#I3d1KBAuf|0UD{#*l6rGI}J<75vsu(M_MKp_$pzRCJ3BL>6 zIJx@hREw@}r?rUsO07-)bd|PPkwt)?ITvQ0J1@005SBiOfT}(CPJ*u7-{?VTg2rl| z_YhvGn!jzD--bQ+^jw6OyP~8v@6;kG+RD#tQiWZlDHD)u~ySX)~~%D`duD~*^7Ae&=JYIFB#N##m# z4<997Fz?r1tXP7f?R%7TQB@=)f#dB~M%oFx#c(Zqv>3OLfh*)*%&Z=3()G*KE~45n z)(0_LWkMIKw?kBWd&28B5*6rrsas6i16EL{Tad@ARhfWp*(h!Cc|iYhKl-GY&1kf=K&j5*V;NtO&e>{C6R7`C_StQ{pvW3l|3ovS zu;~}^=@7>{4tTr@t>IAGw*#4_4nY$0jOm8xTFocn2XcR96>3vawFj0a6gB%_R=B-U z=hED=G8{@KY>A+OSgWm0UzpR=`=ic(IjvFCO!ldy?8}V3L{dj7BL6 za*8hlLVQ{n9$eadBSaI&OCL2Ir;^6GMZ87S96+yyV(-nGy4cdnh{T!F9@HMh+gf$Y z^iB8GEa4lnkCka)Tfw&0WFD4U?!Rc@Sg~!`H1k!-pnTWzTIa=u8V*_e#`B)deeo<9 z6Bz&G=B5y9SjMWHMm3R~B!Tf3JB)p7*s4>NT%BO++?Fwx>B^Puz@?S1z1W^*-??|9 zgLw35;d==S zD}DFDSF=A)8EM?@@clkHz<94)c-`FBD_#@K!kG2}q}iem$iqFwwEo`7>L>vC6{uVaaG{8Be@R{zl-JH>^bq!^}`u)VGDVg1gr8OOl!^ z9Ah0ZoCkcdwEb~U_89gixc()fyL}ygA&3jwrB{ zPWaEvVSjev&zy>X9_x1n<{>!X`D6>x!uI;4r!VZIP=}NRGImQG`Y7uv<3+KWBTFpXmfBeIrI7yx}e)14csf@r}$`n6bv=$6BI=6+`7aZ3z1CTi%c;V zB04kp%!l8tYbp0+jjOg6XAoEtX)Xaer?2I>_|psuS-?=k(MPsePv56uIrP_G;?BaR zm0YFFY#j(lQNp)V@9QD;252Zla#3=bP2rEp^W*JJ?qV+ytsq}cVI7s5kUVmse z>C1Rsni$GTaGT<@mh-XdB66f&7k>XS8i)AVotd)zo~lmVk6-jEyn;BwUB6I4Khdqe zoxF;y0d$86^wa=^T2fN|{&P8oj{muf%$ngr2Aj=msw0K*-kpG=L$a-MfUrPBP?{&Ru-GBLZVWo8 z3ODx`DQrvHtTh~lcdo>WXDMRi5GS?@ijIREOS+GNW>4BQTjO5UGr?+Rg0GuhuUbCq zco0)Cso6id{eh?u3@vbr;SuTG^hzT2D&OBXOR#Y9wnc zPZM+4r*F-v_x=Hs0N3p@A~o`X{$)My`xwUc`E#Yz1?@KPL$$XP!UN7OM`iKGntQkX zXvS!<498{yd)meJ#a44~DAy?I=@lm?7MPyeJl6ptoTshgXv z#5t&twiE+I=9r&C+Cz4H@>)2XBa6|7W0I(w;&!9`_Sc)7OV`U*{Pxi5_+65*5gC>^ zd7SP%)>I>=Zuj$$DH1ZNbclfw!X`ZW$-0_gSh~Kvs`!p=aj5JsOoTX(F22kJfmGYj z2$Tfx=dyw!Q42`>7Nx#hm-N+1>WDO=%2lEY$W?0Vs0q@_)-FqFlX6E03vi|QgM)*v zpv3za4J8>^Y-!>kf#noK>4aPNa;{cCEirm_Ba>WDvqQ$NPDh8{&j$^YlE*qVp^q+C zY8j|drW3T0=T0BmX?79LDwVgPuC2_brU$f|hs_u9%%JzalF3V!qv3~xY+kL9BWw+SI;o{VBXi1a(bjvv7sN(3z5s%r=$a_MDrPr_3 zS#CQ`y1X~VymjATNfJiTcdd5ucV!K^A0VDzs{(y}k0%1LxOnuUWR(u~4`(gCT} z%r*=5iV?=a`}(Sdk@l@?$m&QY)L0>-^rOEjL0O&AcA-Y0A@+M79$-{NSqFlz38k) zJ@V<5go|ehn{o3YPr>U#;s7$lPI#Mb8qkxrP=3GmoYf8ZYId|3i?h zFKf|6f%TTxiH`Sck(uKm5Lis{4@oKUV9QWaugqpG_G0=ccCO;h8aJIoORsi&!QCIr z`Q91%c}+xpeVoNEM|&?a{OMmF>_DEZONNX`6Z5&d)AS7o7Lu>ryLdxjJOZN%5NAYj zMnBDU>{TCXhOF)~ z(_lw`njfYG)7LROCi5C%l@cysQoDUYQKn#=2YF%X9Qz@y$RNLuVD`3b79M%+9+~nP z$x_2}Ccf^tSb)#;C^1*`JIWNE%kUJ%=G9$mqz_NoVrhaR;6pI}+ybkC@wPeoOn$o` z(Z1SV?^V5|To#GluFm$|`oiELV!Y1#dD)X#h}4WO```CRyXsCPs?!GiUUha&tNGu= z1=5u_AV3F!nn!0j&_;ny$vb*%zd+HtU5!V4Nvf$ZTdde7E89`$(oANTr-SMq<(zBT zOc|rwX7}#&TNSY)U+0+N^J3eCr|_Tvi87;BP2E?oh$9_rA|6+EfK5inz$>ZW1C=My zmx(kxM$uh&_dIlA&L|Nfz8?>mgh?s1I^V_{LT8TQTej+jTY}d>Hd1ov$w9>0BkSxe zXii9!EQmD>3oJ#KwB^C-i`y__)PD|;s30M+f+=jF(np$tOrRA(9$gYgLcTUCkbFL? z#baHG`sIxugVG2x1a3%Y?)`%bQVV~3WKS*wK4uPocNJm6q#7qRO~=&@e$%H#|0uOs zTK|%Zx4~m!>G}-hpsg&|b7@@*--~i+Xb-ZT&dgARNKUWd6-XaMM8B{{l1id%fYZHn zTG-2qNY~9e;-Q%;Vs5vCeqSDKG`5L#_gh%JZ#dtEd_q2-xXY|b&$wrpRXY6h% zqpn;b#QD?7Nd?`~#DT=Bf1ywV=saJgz^|M7tQE@+S&Oi%&}$ZYHP%(kCk55z{ zp;rZYvz(02Nn;D^j4K6m5^bS0dp9{meg}JcSD>)p+_Ow2{nj#|Th9E`#Z^|8Efrn5 z$2_%v6fQuCAcna}E@>Z|tX*^fsgn${cziAo=P>=L2#dvK>GL+&Cjgl5N=HZRn%rOi^q6IpyVuNCUi z3l-}wV*Qc{6xpl}CyR5OjwUNWHf^HcfkzRMyx~O;P;DH)$k&D-##-s3pwozojZ^l- zR790YsV#(Z(U0+7kxAPe6ye0aTlDdk7dq+?C8VTz(`fKCJGPw14(*NOu8r&q24K`0 z;WtcBJ%YJAe)&2$uP;{^dhPc5<7|N(c2{L^uDkc{^ z9jBQt*IS9}WN<3>jSZ=2)g_~s{UIA4{skPHCc_{XAdT5yX&Yl_vky#O!jC>mDt^|y_ zNYKI8FODQ%6}bp2^C8r!+W_O^Ojli*Fl(kV|u?C)Mkx`Nq# zerE)n1}ou;^!U0K3hfN*{bz>|{ej1$M9`Y!%<)^jatipdCWfqv{9L%~$%M;ReR2xy zV0J@b#GGKGRTWT<1;Ls|rRt7PfU$Yvy26K%4}WusCe>3_CQ^l>OsX-6q0AjcIWYB& zgr1{m-G_(kJrF@fMR}~y2zvQ`1}7n!LV&qwQzI;j!2DC__{m)@GlQ+{waJ)3=5bJ~?y%5Zv9}9fA{N;R|;N8l0fP7eRu%y9I~f5G0(H`@Z+{yzhCR zQ?={tFT0AWnd!c!`|5x9^ekrjca09gNG|cpSg)$^J&sFB3*_+uHYeerZ%3Jrh@{fW zRG$ndKal(Nla;=EVG({+Tz^Hf<^7esWc_G$phpbr#R!T@2{SNNK}ua~IY&=1XoKlH z4v~&Ze7ddk!q~5>5oLql%Hwfj7W&sA3U4#zEakUrNizpZnSnj6$dwXVpMX%Un*UchPI6{!2k!6>?!Lb+eo6POnIdt82C5#0L zyA98*d*({as=6hPWAgm&S8N=j&`%!nE#qzNz^;)1JU4&LYlKYtQ>ZK6>RDEMa;@w>^x!>)J8E@3(?GlQ zkK@##LA;{qp(VW;6p#uFcX@`-sv{}IrXG%pZseDavSRv;PVR2*DkomrYWVbMpR8eI zUuu2oB5C-+!C=cyp9jO;KE54xOBLUCk5}lU@2rDd4GX%1hVtF!&JT}{EoW|hx1Q~r z`(jzxs>rI@>p5I7mDNvUahx!}-ra4i@p8ccmY>To1YJC*nZ`+edX)adXf00J{PXO_@|0texlJ->}r!aJ$GH-rQ|+wC$N^yeuoUO*yTdsCulGL4t*Nn+KvyceL`h7Uy(GOCI z1RM3O1Ec=14YbQ=<|5mC1Uf~_`eypn`O!YK04=T0inPZ7AX|YhLLf5dcrGL703Rov zRG3usMg5oFuQ}ZLdvRxj2s74ApaI%pP%o)`vPV200z$P4`Le~wp{E4~Ot{@cV{e*_ zC~8A@%w4Y!L_nIdR)@?Ta(N_@`q-kE{nR7j1?h$180r(X`L{Y$AB-xee!68D@O0Q` zXnE|st@0z6+&r#VvJ^DTU6y08-yyrS_DGT)<>&qtH`a*bF~gPZSI@Lmg_xZvUs*Z( z)F7pMt&icstIlo@BV-zUJ$Qdn{{?(iWI2l=d+}$k^}&V@tS18CXRZJ9K8B)J;EDbLI_Atbwi@16C<&@s+s?hLiN^rz7hZJ`^6opi| zheL!(!@|s7_&y2g@;jLq2K_q>kKuBi-~gL=L5plb8z7rbh22cORaf(8YhuK3gb&ou zd={-VcV90rcVWMV?=3_z`x^Yha2GZZD5<&DF8jey8nt;a)fVW~Y0kWDp_R0Ksk9^w9)XT*-;Cx2LsQ{489^vcj9+bi88P009xzmj^73+Q9YJL7h z1Wi-D5CiSq4EchfCG-jRi&>6Fm^yNpP=2QI7n%;X(a+B3M>tgp^;PkKgYO27z3HpS zHzq5en8sJa;!IzHvIks?HBBF$w%%d;Td27+ewA>ky>Di!Z4E~rZs? zm#j(?uGSk@eP50?r%_(8KG{W)8z^BNzBw9gYStW-n+j;kuJ_Dn>-`xGD)gu9fxUD_ z=n;M@bd{iUK^eQ*-vneXbl(nf^A}k?6P&IOoy- zseC?Yt}$XJfgLiD@7?KktPWY4M6mA@0W-diGs#o)F?bk_95rDVjFt)1+|svrA(ydDGz`uLV&VX8 zW$$ppo00fueD})5Ia`t*esB}ybn<02C7s0G_8-&#Ip)3OWy;?=V+XIjUm`6b!h*q5AQ$MRXY7?m|jL7vqu19cPt?7QfiI{ABjo;^MM7fF-ZGE{a_z9puWPPowQsl zYu?#U#b?2ecbyT7N)J^pI=Lz04cIpmO>|Di9(Xbl<^4Re^x>t3-(3I=L*|LSuIDIm z4}N!4k-a4V3rgoZG={B!m>x{N91P2PuDKp{pDga`as6A|0SkYhgq8(0oz`nPS-|F@ z)Z{|XG}k(f$ncNe_y8q&4E&*HrcjFr2UKRg0^+4y^_Se83rA%^O%m19s%uU$id{pp z2^v2?__sbb(ersX*DF%mZ*uhcSfd(*%v9M^PPC*H{6PTLv%2M*PNo!N7Mf2+d9<6p zeH$O~ZcTg@Vamy;&?x$SF8JQB#mFd;ba=9v@tD84Ui-aTG zS8CH>tCO)_`r+iR`v&awZ==Q;@MHEQg{{3e<|a33w?frxvttL=9%=pN2XH5dcLtRH z>M2>nJ4O3VBe1O!quhH*j9UIa`e%R}!%iN%7*}EPSGlH=YM-KL+DZg;Yn!k4M?Pmb z;#(PUWFEEPV9(K)`%U+exGaVole}rD)y8DYcXzK^9g;)OMsoB65DFcBX}oR`32@4{ z1lNmkBlK9 z{UmWsaiG;gX!uk9ddc%Tzh$)?^d>Mr?M^SyxfKXACO+MQ3XsaF*pePHT4uGHGAg(h zap5+~5T6tH-75Kv@8=J8{#iCDeVGG+(sRbCGP5^k4q(`$`IbmS`VfY_tC{~^vhv^p z{nK-WJ9yn6w_!#sg?i--!$7}a)l%TJe)SX*&8}f}_Hk{*xplP{wev-eRWM-F_4!Hq z^sZK&ixlHSB5U`!^F*cPu}4Rrb1SJb2FWQv$tr*L;BT+jv2X|6-UPB)x438F4pS+V z1?NTeorlqWGb0$U+p{*~Z#`W;En>_j@t#(v5`31W42%^K-E#F5)HF<@{qh}ulPw18 zOgV>fMOqJc9KF-1<((%?1KGsSEv$c*+eC#IR&FX62wQR%PvQ+>2uP_#`qOsMoQ?f3 zW5S54m?V?6AKre7d}h76k>C%kl}INOZFwkq_wk+QG8x7+l`ttr)H=P8w16Q;S{uv1 zw63?yPF3rZrD8ebW@?}n96$IWLaP=rYsTbzjp{{|*>UguXvkIY>EPy9FxG?%s2q{D zqAC@oe0JI*mR*Q6Nh-rAnG~bEZ<{0dyZNyPysKbg03u@W-|y_iNgc@(10b4Ml?2ic zFpaVy8e&ljuelDFh57W(rme4a2{$ZT>GAbQFyyR0QrMHet`-JBRG}O-DqVABa)&7X zE}c?XQ!SlN9%QA5FC9fKsSYh2c1K3~{P+97XV?0t0Jg0hlXsH}Pf8G2oO%D+oy0Ji zpc02oPkZZRge}Y9&e6Mk7P-TgpQ3ZW2^@@c+&VN1t8Amg#I8BN3~7a+l>l99-%)B_ zaM`EFBskR-4*1BQ;zBTD32lau~1JUteFSV`hG+B7@Jg{T(m!Vo+mdSy*Cbf2iR~ zgXqe?BWGY<2yJ@=vae74U5PlHEMp0oVnJ0_jUoL&v7Pa358Jo1ktoQgi`2$5M65sA zDvxG41Qr<0^T;*)`22$5yiMAT9>y`PF# z0K*IQfCuNno%QD}>V*kfP9+nTc$>eqGW*3k+CO1VpU~s$wys}gVmf#}-6R_@lzTFt4s^Bl|9Z)M zu?eGNXLq6Nf_eLA4AY4dBKd(Zi6m8U;i2IIe<$7QWZL<{I{P-(v0fv>sA^_x&Yk`> zD}CD9WCx&mi&6rM3MsJ!gqBGzsJ2+W5n;rF%_y;uzVfQpqg*UMC=V--6$<6VHg!^x39N&K? z^<-R}J^$T$$ccaS`ENA$e^lXLfZzWGNH>JEg|N+>MwDEfln|1cm!Fr7QxHN${|#tE zSZcvPu(c88A3z%d-Lm~*cmE*D{M-->_%HO8mzxVh+e1L+KdBIy_8-2P8-jxi2>xNL zIVkyfAT;wIa-0%^46|`T&g1{P5D4WAVdo*~e4G$|7Gm%xQUD(>gc0V3;MWk+mV*rf z3PX_cf5E)`5D@uqben^clY@f?!bbnaBL4+yLm+An0bU3i&c_9TdO7(a%=sT*d3iV? zU^(wU*fs>v7T{sy`~yxKL8x2^cMd5<5Q6dYL%iT*gYe}4u;bhi(D-k@n+HOz|4saI z3kb4t@^L^&=6|2{R}~PSxp*K-L5T8yocP0QL+Ein2o26502yNt6(9ix{^8a6`5|@w z8H5lkK?v0?$P0m*x&IcI|6i)`^Fexpn~$ICzv#oq1%cBcC;nl%A?-8xSA7tVAPl*{ zA8TF+dCmJ*oe(uS1=;wxAYJ@lWDxildCmjj<{<(@Kx{rPem0)JsOEp~@$y2hls_Om zq-<_Tt^AOS2J&f7HUVDVf7BA-gtY3v==Mj!f71Td1w0UM{??a=m**e9{_QpY|LP1% z-hXKb@ft!~L;4)jm4ER0zf1h1vjAkA{M{4(_6?E>nIirn^!Xqo>JJJ3pV;a@gYJKa zt>)nWuRN=f#;9{R2Uh13OMoLLb_*vh2uuB~#LiTd!V@$cACtO8(k|)MJ)W>U^DR~h z(c~L$YaG1WTJLvB(;XBYkzpcewfCOn?Aab?dK7A$ zVH6K>F%@G9VH|ALUD?ehe(=Yi&iOfvdCpkS9kZ_|HExw1bST9pM|Wj-=ZU3uIip;6 z2DI#NkzP+hefO0OVxw~DmnTO&NNm^srTlu%d(Xg!7Q|Gl$<|m|S!tMb@|x!WzxsPB zur>dO8yk0N+=xwyPuvbVjRlb&dK0uh44#C84Ce$OcNwpk2Re+)s+6sjyJ3Z^(!4ON zZ$tg)hWtuRfkEV5d9)3d8Sv0IrOa-}zlrKU}5&npM2?%dX82ubX2z_rIQvwc2|&+r7?fJbt#_uW7V0qa#6i)}z?kR_E?d zpnEO^LWS_bN?44(e}8R|$V3b^CI`2Z=4Vq*U+~*o4cBUuP5s*+E8;yP`}R3YTl2atiXi~ zLW3{va`4v!Dx8)MpxV`-M%F(iq?e(;U9OwjD_ZyQmv7Wr;Nv$qhx*?^+QO|fGl2=z@uCRpCtMFQP_s&|Hgdm z`Re{NM`-SwUa(Dku+O_jHCTP6=9u(Mpu;F5bVyVrqpWGju$pox#-OYqx}9l)`#uU0 z{+Riy85_>5!zVoaw+v$u7@3ILj3J;T^kokC{kN!ZK4Khx#IOyQ=0K=crB>KZ#p01< zfcu2E4>rHF-QLU##IH_5T~2~6?tR3eOTNPY7I4{tj4$0xh^);RhV>DQf@;P#7V51F zm$#$F;u%BC9;&@%R^nw8n!k^O?}LBT?r1hw>d()-&iw8V4$|op4=lLZY(adbdQ!U8 z$@YHVv2Qf4Hm-J7v!c`N;t*V{xIlMeeX`<-dD3zmR3TjUl+yiPTt!@EQ_=gKzGv`b zPklj`Kfm>FhWjpGezh__jo`7SOdX3+i;RJI;0JgK@*-4f^hG61N!xJc!?5=kJOOdI zL*Zo-4Al`%Q|NWQtFFYuswmmd1qCj@U*elXkWIHVEq{OqLecJ?hB811df!6gUMwlo z#Uv-bI7s5ykq8jz5&c@1K)CiVF@v&nf+d12XA);D0c8F#B_1Lam~8ptuxzu0c@!px z&>a>q`ij|HCV^EOrEMEdQi%SRgTgrkArrnaG^&k*0$+mRO&DE0nsexndYJuQbzO|s z-m`jy^N+VXj?Fy&-gMQGy!9AC2qarM<%zNml#KOxE8+U znJ3h;T&*Eug6Wsg62Zk6glnkxy)PF~B1o9M^uE4~FK)hXQ#*xTE?-rHP#q(jEny-KlUCq?m?6MTVXdiH2WUSIc@-in6CW=6?N-4j77sbSmQETYD}r z*v>Wt;VVPf&sv@a$E@rwa1f$BAEst?gulxc>7(2oJfqbYr8Tf%CiM6#1AOGO7KsR4 zq6OwaExhSUp>ne6N`GRET{x=}2@i*pE6yx}3#XIo9>og&YsX9CS|*<^$pEX`DtiL? zr1gsFs>;x0{}E&%0&8~U)2MM7dVtQp*-BxqUHF&RF5bt@v*6ZOL6X@>a;p_p&p4_9 z@t;Cdzf_ogp2UmSUMJ9>%7U9QUJucqHX+-Y$OEi0bZtXU3R*+X#4V5YX#v=xU{ zDN?|TBXB~{B8zVb>>;b^yw1CbV(ek~q*6Kix-C-l+XDD{bz2)ZywD3xG z27W`__ijcNE_e&?XtYHYiN?K{m0QU{*HX8SaCs*Epa@2Q5E8#DOzBbsDF zgH6x{WZ@O)~trxXv})#(tzT$DE9~~36=v8RqvYSvW)6m zx1z`@oGox<>lxX!qWEO2oYZ`i2dQ8SrqGkyDxTf)<*@T9s7$c zt(mM(r}5q-d|G-IH!kuWdb;zDURKCT*$)R;gtA#(W6V=_@#Cy#ggN>hr=_JO>t&0` zzttVGwp?NsnyVRBjjY)n>~U3h4cE}-y~0+-Oro0!a6%=#^6*wo&zpoe6?t;745%e6 z6nQeX*jNVq^+wx?6@g)2-+b^|7rQ_U*x(+qU;YuQrkZ$*wWD|pCsb2imEeN&RR)z^ zmt?it3qNP8jzCqTtE;w|++f%li%YC^=|Y=gd_Z8N7L@+cZTtsDL~}yJ)a{Z!%x--; zYFwYOh;ouJT38&Zc`SZn;{p|`ocY_q12yEaTIMJ>q^9B$n1Uj=g=Cc2nhlwjR|z^r zO@;+3##+Wv%K8j1>cw9^S~N4dpU@oi9FFi%jI|g^v^exvR8Hi#TcVA1P03IkCs2-X z&+1X)-chM0B%^R58%#Um6^`iJxHK=WuGWP0RAMZmw>H~uf_Xj^`djDOp4qZz1qfLiJYP#Erv>}J{_cvtW8ReYr#%X0 zwf*_=1r{{4YYi?Re=1^?dY5h2R@=9c@hb0a5R!?)LAA z3o1E!t&>ouM&ezy8E-Y^E!+YpT_HKn1$bcgGIaqwh8iu=^4v+Nr9gr!Sa?=5NR)BK8MLO4c(hJKuvO3 zX_Ma%8Jw(k5TASz5A_XoM@of79ugym8xiY9RO5;-Y-q(twg14We825UA)m4B+18~i zaXFM`HQ@ZUYI@^z1hAJNR8PtEXlq!)E5gCiHR0Xw-mpPGM2a3Z#@VQ>Ds)l4>@KB=*O7f2to+wo&- zx`)}+&9q_%=&LIUj`JRhygW_@upO}qzlq5tm4djIc><_>0yBp5S=wo`-l+;Mn5hcU zBXiUwl<30IX_x2oBpcGyC*XHbdNlFq%Tr`&+r%nUFr&)b)zso-HfdiLH%O_#)Z(A1 zI%tKtmr#DUGOr~Ec43_)EiU5x7%28qgO)tvK(dc2RO%>VDkg%9c&92%Z*ByaWsz41 zkT&TX(2Sz8?a`AkkBy-lhEIDpB}C7MT$L>!)LiJkB&(Q(x5QdmY(+|4;cn;=Z&4&6 zTo#2GWM^XCVeVnId>Ih^M4@{J{qU*#WCdHJvTHdqMOjy=K~X+UaZ zI_v;B)O`zs;f~*dC|~3(#s71KGBzmMDCN|uQ$p~f97u4OY??PdvS`870i{*M{^S!e zh4P<9ZqhhAVt=ZF*nc#08lsF4oATu02`qPR~j%&Cy(!6k#RK0Yy zk#=}s99b|hi(yNp7;H?A&-J|@zeB)QyIJ=no3+J1RG!7pXumO6ogDMf!2#vO=QZX3y=UK<#1;Q?fxejg0wK ztyT(aBB;!!^c9)%^++4qD%)fF*!4&fGitF)ijxuQFa<<>+ILV69x07B>1%F+($6QZ z0J8|)O05vnJXJbi^e%D=ymF`lA*%$I4mrHd0_5W%gXIi-`tZT^6V|RD4>`|(TY;&^N|u8%1S(Ff&I#&5e*y_m+N0pt&rYhaV#o3luBy)) z{sZ>`_9T?9yDrCWu4;*r=(mhtKg$*(RO5CT*vX_+o5ds}B_l~86DP?@QNIA%7(u9j zUux6`bXWYq+>{|b;4>wtM`7;+Fc&mr2Mk~UX#fP7KsbP3+SIS~AQ#%JW~uJvArsoG zQmO8wAvfT&9(5q#mmzh5{GJNnmnL;^>JSC()d%3SGIdYd5CcGv9+XJuu1QTHzsC>w zrAkd9w-*TPWB}0s{B)>)%I!G;JLy0sihK1^8>vGi06|*NBHa}Wu#+AX4)D{Wu9Mrd z0(R1ZU;)eQpg;h!;+{0{G;N3+c$z-M2E0)yk);lk@>bY`2c9MkT?71-sV5coh=9-P z)GCU5OhCtsp%lQcHmMeQ%POh-q@i7apAvPV!X7rzF@2~HuuKbzqP;4VB2OBENTEV~ zuV7g$bq*R@2OK32P0}_PQ=ibfmrE@u>|p?_K|}Vy>eL}8fF2ddfUd!idX(0^Q7T=* z5-5c)U!p;cN;g9V@&mNVQ&R!g7(pboTsqWefGipiAFxT`V}@L;R5slVEl37v$PQWt zWYK{TfQAepf8d_s7M{s1S)}sXn{(pa&1yEbn3L&JyHPx zrqm%_pf4SlJ~cdGI72R9N=Ck)24o1_lcP1Db_T|+MaZi`dof(h>3@bUT!1NBfKpk9 z=DmRSiW2BshbEgNt50c%?O{<^7ZbS8!|z$2JA)*UF)qp1;M?@ihkVuoYp@`C=%_*d zQ)mYCXeidei8llGHCRH+v~RAYdCiVnHj1E~DVlTJn==k>r1j=%wu+r2Fpjkg%^18` z0%X>i_q*`03{}=)3e;Mm;1@MUx47+zR4>T9xGBHtJfCCrpg-j3!-zEF+Jhxn;aQsJ zdNTE+W4>avN9V}mxp^3!@p>3K@z$_)mkrDt&Ze&F?mFM_sxKZ))NWgM3#DX>Utecw z)>M@Z>V%hdltBpZPvNsu+L!Eym9-V_S_@-!Qs)Xy%`oG25{N9SvhY_rh3-0f?<=ZG z%9gY=cQG}t{nH+=0yU%Czwl>VM^%sv?1qMGuCkSuJ%__;9+>KGm*by~FfraoRls)* zw_I^Z-(x8L_=YPDbz2s<^$j;V1OZ73=?3Sk)RwtRLkem!DqIk)Yd&}rDVN4I9gNw9 z&rcu|Om`s~$_=NC^N;{$f?+_;rMzGb4W_w353NHEkltd4>!!Vc58Z|Py_Un1jan=Q zQ-Jdj2QEMgP}oX@`z^6`4;Li6)e0v@Vhg16RA^WOB6;H zsZ()_48{e=Hx^unOiF)2AIgtJN_`;|YJ%+>50-?f1NcUON8yaAT|>Y@Fi%JyKa5Ko z5_ZX%vWJSodE+ce7iLIcLWhEtVbdr3!{CYOzR38+6K3RJVrGoQIq{9M+z5-Q;#D@ zXG&vw#=DQ6Af5o`fMM#2oaw#HPy)ZD1WHgtbBDsgT*B=j^#h`*OsP$2O(_c*3TX=I z3XkRy5xy5>hs1;=hlGXXhQvWBhEPf16e3Z=Y*9=h3OoZ3VGVo4z(zBOUt=Gkd?YEh zg60svUOz(J^9P0qmt(rx+(Mrt28KLUiGc&_Acr^5=S`4ZNKQFqw?qt_H--4s1!A-b zIV6D?>QiiWLrUv8gk8&k6cZr^CR;@ODt-cMSO7V%7Spxh2zIRiVypo%E*1m7{HYUC za?dQ{*Ue+tH3o z1h%2B8dP_eqp-C)FUj+I$YBNK5Ryv;F*G9B3o1o*uR99M4ZfCyBxn)r8BfEvWk5{n zjFN;4QQe=sB%KS`h9V#-(nd+ERjBSCJSCl5*@n($;M*&QuePZ1Ck_0_Q#!__gTSw0T~ zNEW^m_x(pmG9*c~%xVAIoPTi6!k}p7(H8l%r)v%`*;-#VhI2|;_y@V!UeV8x%~a99M3iDFM&e{d_z$McAz2?<>>EHtE;$`iOIV^^iV&ELmaVUAr;yxetFCz6Nx z{+CA~ru~=!{kzRRo9Ijf&{S6XM(kZq1`2M061ov>o9tK6W6;|jcF)pSQRy}1`=dFg)A(%80q3Og|8>JuP3zc4b8=& z$i<-xxYz?++z2kF2$2njheZAo5rP#FLKk_&@byIT^#u5O!uZ~>UL09V(Bxg{BL1kpHx66VW?R!a z;9~v|*{BfNI@rV@coBbeUr#LG8|I5cysha`aB)V6EMkc4Q>g4yh%Cf97F^r~E*1qB zuY-$?z{SQ}YM2*tP~>NDGqUQCJs;l3UXd0U;IMLnofYlRLqY zufvM8llaa-^dP#h6}_;9G*)?QT7PSr3|!0$E}jp+GZM7jTtztRfbsQo!2WG4X1i?_ zj^FJ!^-U3xwbOE{Jr<#6RnT@lB3%27u<5u{vTB3Jc7Cc*%Z0S*7(HA&PuO<;PO@r( zsL6h{P|EG%|40Xgb}9Fa8Hz7$HIAg~HqOcgbU zb@Mz0Ce{agID=iuaZRz77h5YQ%mCcI!H za9uWia{gi0)%AsvFi=Uu%3S|V^4uynt^ zOzM700DL}<9LLbQ+w-0iHxIMXwNzFQ z@_NN=(}M4#-X++1ZE+zKcu!%ImxOlh_TJ|xIci`RkBCp2LWTxE@=ad?_EJ?rhP{yA zo1{sOB=)RSowlD;2Y(=_lrr*LB}E=xf>b=$zOS5KN%RYINi=c9QaJV*bTU)5l0r<+ zS?@a*YLjC7)L27Ane}?sn<4!hl-q|>GEBBAug3Ht5>Orq2HS84E+WzfOdRssVSJI*mJyb?Bt_2JJnpBMj4*$Wr zw5reIjn$-q6^zLlAue(e+%AL|eqUhx(;q#et$v`~SjnYwK1J5X4|$!*kgTu2a+aRF z2C>h7uLjPE&h->DL%};BDo@uyr`4q?!;pJabkspOE78$A@(gU!wI}Mm=`Q)R9z`y`S$Sd8^H7QJtwl5c8hvH=#nM zdBa3RCZ*kH{yed1yy%)VwiN7x%%7Kg@d}OQBYS?kcBewSaXd%ieT-jlgfh1p8|_^x zJa1ku!y{rH@+%v)CLJfb&VMgF=M~_OlV_L{Z&L`Ke_8RG$J5hTL8S=luKhj8^MsQP zm*OvVv2gT~GHoEgOqa#vN3;)2^R0FwddT09Gzr1A{mwdF6$RHx$V5_xN>ggmrk;3H zMlr92C38h^P+pi?g6fIYFUiLLb9k;+ReCX*)hErSu#bg#o;=2$+8 z-y%kX@0TE91%72QJfcj`gWtb278BX^b<`R>_dn+|&{vcFlv9wJ`&HU=jMC2_mN()@ z++lsXZqdBM8F@Bb8=+e-8NO7^YwxHOLB|&7{VP7Ha;jk;HL|c>pEq83RND+TCU1mg zS^0Dhh1G$>1PNO(U6{nYO3DCeg!=R?^YesE;xsw09`y8Tv;$Q~MZj%-!l_)-#Z!-zAAj* z3Dvl<6QcHi@GIJ!wcVkNyF1_6;mYLjpQa$l7$#dDqKq6S{cWb6c4ra)oJ%FQMovyu zBsf9J6|h2Z7GoVL3^30eE7_)qOs?cvNqk2f{%knJVTozi-#@a)X9&8~l+2yObJL1a zyLtxUwj}0?y;pnbCR4GVhlgE2?jY9rX>!bJ_-trE_fv4VvYMIM7QW^=oX6NLHPG&DAYak*$K>8?;+sHGejUArocyhP^IKk$C^`r!7B zHrh&yr53wOw-qr3pH6e8q5s^|`6Z@Qi$|9Evt)Yjwtc;kgRmWaFef zn`G@4kAFWh`G72JL6c|J8#X?%P%;^lgpXIKGBY#$N4hNnQe#Q{%&hC5iY@xh5;1{z zhZB|)t3jJ+n<5TMGyQII*t&jsHe(GhRnC4v#?D6{OL!W~IJoKQl+W@!O!A6(kRu+C z5PxR26gm=$Gr0He^Hg0`TQE1uY7vyk$xXIQjuf=F_gVnoPyCp1XTnQ6E)ebB+dsLQ z9j(1r&OMk$^RZ^YjcCAW5V4r8FHvxtq}%;iWF{zPuuZ5W(vxa zB>QfRh7QaOv}B9{rMRUY^6$xXOk1Q{*bq_3Qk>_jIkCUVKR!B7x6;%`XykJ$*JeMC zbJK}Gaj{sG*>@af8s_OD99$WPGv)DwGpv`IV;hJoD5JH*M#y+aCL{cUtbZogdTMB` zHP$v)i7T62%2lDyV&`z>FTeQK_@3zJv{;|ojx2!7>fmjbRt4w5TOAuN#kL_OXKtCA zm=jm{TiT?REtg^t#_%oj;L@CDt5=nw3tx8i(Q=EE1D?EK@gPQBzB75&!DK+z2?8}YdsNX2(B5@CGtWo& zQ`~CZT{~X5Ln2$y1@0tL1>!k~Q<#VA$SBNd)xKF7beonO_#ESMW`yM*RH5>1BW{>K zP3bJtbTpHcc_5lP)?|~Tbnh;l1;3}oOkwyq+-GcsW7KG=#d)T>LkbS1MSA5B)f3LV z7ka#CbD^>tWeuolM>!$xhT@b>U$LoLTA{hHBu;(&6s__0T#R%fv%f5UAS|-vHx{u5tm*Twx6Fts0PI48Qn+Pyj$APs;!R$+>(1oGm*_oGK7jm1%wNoih zm8|vVR@(=X(y!NxKDbppAcVUKn|-A!-Nv8kBf{1P13xqqV`&HJI~B~OWT^Cu(r*B> z&~vbyg%YAc;av3TT+Fyw8Z~W03hVuQULWd?86Q8RRkabCNBPGv$~>Yhh#5OiX84a7 z7%V>$9FxDcDHWD$Ei=HC*`VG41Nr&710NDff$+@{FQb=V*M(hU#3W=XF}0I?g;38{ zEQp+mYQs2I8b?2mwC-kfL}8NNI4A+}`erAI8uu2MwFtii&1>H(^Oi2;WhhF<4WFEe z?~4$1@m{sBn@7cb!E7xnKn2Cwx19&bv8_-o#&QdIbg5J3XQ$^g@Cn^b9c7UHQq|;+ zQy`R?MT|_uoUr$96{V;?sWo!*P&!{bQ4lV-DWBZ%zFzuJjzBTQUdhh!-ETGQwpFQx zN@L@u2-N3Uw&VnqFBOaB7M%s0Fcq9l?m2Yn_gQ@5{Nmj@kemiGQ@%=H+~&JP4^ZhD zXs3iGmUbX&TKX_hwdXD!W^9&D^1DpUj%C~Y?Wvy-F^6wLH20Po=^O>MT41iB!-Ij` zu8tiG&Xzf2Xo6_4p!YQ`8Fo1jr@!JT_sW&yAPnbJf{e3Ed{@okj~7s#syV;EsQQwi z_=j!ZJmaST%+fZBfp+S;4T?{1`H#_e#yBAIDiwtIW-9m-m{Q=P>Nm~SY0#-+=~PtA znIs`f>#(#Hb{D@RM=HoTVgD!vWD!Xk&#x_(ei0ee<;>^wKkQ2!HJsO)ul?TQ>0^MZ zSZ3)Hdv4>B+1~ovQfI!V6){(=TjdT#A1(%M|DZNEQj3Hca7JO>s-Z0m!#Zx8%G?>G z%9Jt6Y?oajgLIN{a_2Wh;r?Nbyf3FMlHUWiw|yNqxx%(a65mb!xSSMFle=_#t4NTq;V^YWRf@U4^7_EdwC!QJ=|8)wrr#PkrO; zIvPDXiHr*Kw*^;sOfK+wDr!OI{5KjC){DF)nLd$T{6sMYb?c{98k9AA3z~Q(lt7rV zdSgSE>A}IwUVHVThll=>uNUBh4?DZ&@8?H2ieCKFyrHbP<+Mp~NE`+eX!sY;F8#WS zhhI{Cc=F%ltdn0;smy@ZXxapq)4R;Q(=s;+)rXs4sStWqk*y29@7_iCsdttFqUZs_ z&_vn06)<~1dB$inb?V6jHjbQ(APO`Q;%bu4N zT&Rx=7`a7aQWjJQ4MT<_>O6lMCUqwftsX;H+4^Eb;)#M)YUiTmhyZwd_dJKqn`*-U!Xl89c>%+5C6SPXyx6hdUW+PJ3-S z87}w-LQwR1V$jUC*alMN>Wn{{)RE&*u%s;*TqNT3^(sE6YM>bmYtnG?4M>(@5+#rc zT}Mu*IPmzbBPjL%09HkeC-V?Jne)U)1wHzJs?VKo9!;o;G}T{C4sk#tH_Eg&rV{#j z#g>$?goH`j8jM8M*uhTj17IeZJ~8Ak9Qe+F?~1v^J(juoIXU@ZyHvc8a7vTkE5`Td z!Z^Z2YwaRYD6cVqGKo{sZL5O z?Hk=Mn<3oDB;I2xVuV#*{6i=^Kg*aWu%yHN%F@PKdUWZEgdXi@a8-cp=ezDUi&5>) zsi0YnYnhCV-^W+mX&Nla7NQ&9_6Bl@8`L)A=9{z9JGYiHZ-rO62Km+_-;TfUHn@M2 z-}*WsvGpaT=Yf~&XHE*G4l`bZQ?(Mk#Z75!Fz}~;D|&7jjVIg=72cYqQ{#6bn8^SX zIf;(DOkDpin2Se^Y9o+S1Nm}#!p!XQULudygza3kfo-o!?OygwjqKZ_qiXtJ#Ytr` zUKkMxI(2(HLuzpyJ8bL+Wg~ksiM-aD+3U`<_eS&^y z{mV=7D7U#n%PaQ zxD32l>rs~z0xcm1F=Ke|HW`JCdvGTdVkper|I^!*hhv?7eZOg$Nt71Rh+#ws&+}cL z&63CxDk6l^R0x&jp|YfP)L6?_Qj)SnWKd06r-Y;k+1G3-MTCU(o~QX;Gvj+d*L%Hx zz5a1s_jRx5KIe1Jxu5HNzWFRC&9DFY#4+$Ff4$1WDm~|wj7G5d%=UN>r*a)3%R1N7 zZwf?Ig&x=J(dl%kI-9Ru>AUVRC!#7~mBmG|&JeRB3gY^URa835$Qq^M-lVeal5$1) zcHxE0V7Ee7@8_o?dLCc@OjO3jwUTN~k4@dbrcUj1*wN7%b=Tgw`v=d#sOjl55nff- zt#Vh5HLyY&Gq5*3!z=en7MD3*YA8wWZ8872Dr?wdv4XIYwXe?&7L*;Cr@AlSQbn^f z)r_!k86LWGc+QL6lXDfy+sa&x^7K zfA4>Ldj)Q6*43@lgEfafan%)e8meszH#DhTGr2IefmULc`AMv1&HCv$+iS%KzK_;_ z)v@xz)@6Ff#m35`gbG$Sw=+M;egQYL=ZVtzx@%h-R3jHurKx|hNeoI-E!~z@m6moR z>)m<3WuYm-394uIC|SJCk+HbDyh5#9@a$&&H#hH$p7PH6qbAeKps@aaa0)9RKWIsB zH&;JV!Gq>c8<}FQ@IF6iS8CemBO;g2^g4G=)|&e%`A>5_+O6e>aMN`CovH6qoGmTO z^{t2x-{qOSd}sRdMt@!Ooop>H>!3}dt|_#%IJQ-z`_VSZ@_|A9A+H-3e@+?=+^F8H zT)C{PKtry$=;hIXEnIP0Thq|oxkAlvtg-}izhT~R`VVk)9LTaxX&+^l3`RN8Cz2hvGub&{DJJF+ea9(&hewSV z?Y1u7w`Ze<%;eIM0}sR8{KfU`Lq)7NXc;uv`G(zYBk9s552J*nmK|rXWot?&8txDkT zx9w_V*WAHCm&5%pF0tB0#4bM;waa-rw)Hpr#CJcPb+;7x80)_dyG*bIxBKN`D#BWA zN_5{4d;1D!NtN~_-_qJHP360Xr&5l8p!sI|Oy#Gj>0fM{{&?oS18YL1IA~%)OGWdS zD+N)spgRe9WQVNF*h$eOmpd}q+g{lo{^fbD)rBdGQQShNDDC=8nDu9)y8C?=CzHp< zWTP8@tj=3&H2+*s{dTeUi}i6=-w}+OJ-wKhSKU0Avh`V#hqj5vWWSm6J#+WY z@8^G2S|cp)e%|`C+_mb36JnMxu4=9@w#ikJ53&1DCS($X1$-07IN6C z!?cmxC*0cTU-l%@%V)aDbX$9xxYM36TuoIfm;f#^i-VR=r3+7l#OUv zYP53S-7rJNbZ(j6qhkNmoT00lczn^hPi|N4oL=XlxFR&|iuTs<0_C`f_XdOr*Mg>S z+h)bHs9SG}1OkqKJ=1QoOJHHh2}UAIzT1L97-dV_B>XO({Qd_hR9?}oh!Zkuj- zFe0gWyXJKI1r0*RB(p%Cwm^H)ZdTvep5w;8vIj#yD|lI0zWf#fiAE}j~RN%e!;B6ZZ#U&Ya%?9d4DR!wDdKN;FovUawf@=P!T=%L=FY1y} z@VN&6w>gFG$_#5sJ!bKxFxFDy@bAOXom1vt{c^bB_7ySgf>`ssIxnFNM`3lHbSskr~DA-){8E!XN6rig<-+vDGS~csK=n0+jrztW&cHEc<6A_bhxhJ+}%9*>Y zOZ}8+LdhS3PNUW%ZdWJV59Ski^=s8p7Ub9}FTpU>MSF`j(@DrIF z*^r1Y9x{qK?LJD0ZoAF51TPR&TCDK9*Vi?Z;d-?rM(W9q<638(ls0J9{50CR;qBn&;{(oVtx|8=y$VxOM^c{* zzFfLL@zA!oD!Zdo`z7uVEA}s`8h!M#i;=1KrTSvJ@U|Yqe$|za_AknusN=?3?zdlK zy#m`Em2X^~o>;7q`u%XH`Xytj&5;r%g&X379^QT2Id&6{ucFJ5U&?*%zK*u{lG=a;iaO$-G-m z^1r#PR*e@46}j}o?;DJY-Uaq>CHyCAXr}HqQ!$N+)6E{W^?nj-3hud-mL4AZ?QL(Z ziCM)@1{M!5+rHIkB7$n=L*HLf^V{}ObL^zW+6JrR0Rvh7oy)&07&vv*JLctH@!XEg zL$BrUpIvjmZ9%c~s<_tICYaJf?(?&u^VFA_>gYJ0?0)9n^5)r!lEp^Pom)RWQI}dR z9X6Rz6#U!42MhX&W%mB3QmfTNp46y4tQOUDecQB%S$1q~wW>EqD$IBFoB4{l2fQro zkJb@B+<{TU&pQoc)4bb6ZcU0! zWz1#By6)R%NMt9Cx|Ctr(_4gYnuKYI8g1Fau&w;{*>jgGuS?Fy*6no8P1x5^-4ZEt z>s8D4eAUp+dPQ1aPVS-^DJqW3^|{5E-gR*tuYCVH_4Jor%2(R*66R|*-N~pm$-y0i zEhCu;bw`Z9ADifV;-AWp$P&J=_{yI3=~i~5D|ef%m^t!`XyD+`$Fiifk(@2^Nkx|; zBI2KvUcnfzS4oYWyKfh7mvWo7)ZulnF8_@#5l-oDlr@^5?ev}vCYrqwLZ7--4QXV)`+mZRBT)^yZ$X%)}7aOkK+Lsy=L zgIsQbJhlV#>7e_D%4atD|Jxv{$ML80&$-2{&?w+$XD=|fLb->oq^ zY&U#AOyj+Yabz;fd3c_mC^lJHRpwTk6uEuJj+307z7@5bSu=au`_+eR?%Ka>Rbky* zSF_Hgw+ow24EbcG98#_e$RDIfWd6XR($)^?u0Z{D5CZ*q_|ExA*7NH%Bx#ZC7g z_~}&Fa|-2z=T)W!^e+4()L1dI;G|1x{8rn`b{dXeMt1wY?hPBMsd;tpdPLBY+t~*^ z^KS_$bn2<+otR@X`bGVcveXByo;R&w^xTf0mT5ip*SYvPxzs7jdaG5OWqw9Jm3gF{gvfog51PTkt2r){N? zry|aXxL)MkD9LH?ug$KbWhhwE3*U#TT(;o`UtIT`rFqEHdG+zpF$Y;QL5X0==#yr~ zHYKaxMq0_P@k@4-s`KqoZhhXu+EV0N(Pj3vl=i~C?AP&#N2L+3)QG{4o;fpGM=o4k ziI$fVP}==>F(~;U*KG@*q>gjf1wNS(l`T3=b_*mzFBYX<#5mvK0>Vub=uz={`rVK6ROKGHdHtZ(hR+JA8_8Q?Yi%P zgEa3Oy|5b{9XD@jTNM&2^099v-zxCw-~ZO7GvO=Pe^sbsbSTpPR)kNXJ>ZqA{=0q^ z<5gVq`9SgPg9GgWPc*Y=4-f(TU55MrPk8_Z^HBQ!-w$=eiFK`{;d{lr8|EF2fNz-p zeaQc9!s&Ts9V@SPo#mnPcmVz*PsQ3N3pcxO4Fg^K1(`j)tRfma%f?j3lx z>cMHx#4^D-FFp!%dQXzh8x4l%DEo&N5(`DG_iBmGx_ z|34=BzkN^}(bNBH{r5N1pwxeV)1-gdk2lxBQIIYTtPXY6GSVCRpRFHeh;yFVD|zV*^JADD=PkVZhq}CNR4VV*|s&>^A5? zazKLr9!tjoEU0VH3E)wo^rI6j3>}NJ;ltyz<^!$|jItM4gTW&Ynbi*?IKVnFyAAM? zpstH?=;)qt;H;pGWzZQ6>R6IZ@(5dIt&8J0Nga#h7!&OWv@yt70!UOS^N|=ZlTg}# zb_QL8fyflL!lNvq?2nDy8xHr2%trt%3w11k0e=T&KH#jO${r^O;1Hqq!-0!~(ng|k z#t9}colyG0H{{VZIDGcZCXuluFr856BXK4&ABYO=N3s!}BuSpP;{E+&ZzQUJILTro zcMiM^$b1Yski1am1BMc$jg8(VgU*AI*?VE&1Tr53V3;eUx*sP#G}T7@}8978}uVAe%w=!e%4)#sF#}>bguEl@*ZE zAp2tim>^?G^v;aTXulW%1E* z7Qts-P;#maSS%bl8;eOI=U{=SLC2zdX483WO0#u?#X)VAjiH#srgM<7Y~Yom&d0_P zeIXbaiHzm&TZ2UJh)uAOv$6SLEE~9;kiBqF%wcm7{3GZ47FP#K8@2s(lIGH63^4e}72szU@FjFqw%a7QF{ zFOXj#K8m2D`bR);fvf=m3{{`O4I*-ZAPw>7(1zeCXdfTBFbJxy5f}%#UjkzzxC@Al z;4T4&qv{m_j9-Xc!0{vN;uvCs1P)waR5?SsNws|fhqM&w$41YFvlz(!Ky|6QM)3Zq z^ARXM12Q4@23pTYE+hxh7l;#)`vsMx>NtcnNPI;w=%`Fd5I%L!Bt$hx8w9OL8!(t5 zZ6piX3-H3B{eX`S8OuU)0|@IF$axt!3mMA+b~);NOdLnf24OLB4hBih7wEj}K<<(O zTvo^$bj0t&YX#z`Azi?by)a28ayBM`U=sl@6u~AYOo;4-iR23elY`zH@ZTZxL70u~ zkHts!EF6g$AbRF8NY27of(4|3NE-u3YzFA?koy42J!C#0^h0FN=3`rI47GhWhMtYh zM-SM1^Z-PKU<8|qENU&V@W!W$R5TbISvVYlGJqp5)m9C>1Z5A(s{I`v-JfsQ$(iF4~Z>cB!X*@aw4`0 zsTzVM(8i(aABoWs41;JA!7viT5R4$<%@H{Vh9mewVg!007-|bZMv2@di7^n&A%W4A zsxQ!n_-+!%NMwIF9m(xU2vw+92W^PGfps8Q$8!~kOmQ?9BEcskdj_9O#XnxEi_VAo zX%dH^m8wG|8h4TeA2~xHhOWy&?-JZO6^G!dnaA)t3+o`o<};Rw*g5P4y*Gk`Bl8ge zM93O^^cgOMik)ynsQr>?+)nZ~jjVyj&(IISQ<6bP?TA4~@)5v_#4Ve$F2(c{=A8dl>2r5Q^iX$?GCoRNRKxBcu z0Wbh|se6Hp1j+N53=+{(CIcQbDCcFu^A*+hnE<=gHP{Sr0+g|ANI9uzV>21Zn*tl2 zxGA!N*Kt1Y?HEqQItVrpY=SlT<52h6c^t z+1KIQZw@pwH#hiMk!PyBALk5R9o?kC-FvT37CmR;(~H=dM5gU{{yjq BxdH$H literal 0 HcmV?d00001 diff --git a/deploy/linux/fail2ban/filter.d/bj-admin.conf b/deploy/linux/fail2ban/filter.d/bj-admin.conf new file mode 100644 index 0000000..d00c49d --- /dev/null +++ b/deploy/linux/fail2ban/filter.d/bj-admin.conf @@ -0,0 +1,5 @@ +# fail2ban: перебор паролей входа в bj (строки auth.go: «auth: отказ входа "логин" с IP: причина»). +# Дату в начале строки fail2ban вырезает сам; без якоря ^ — с ним строка не совпадает. +[Definition] +failregex = auth: отказ входа "[^"]*" с : +ignoreregex = diff --git a/deploy/linux/fail2ban/jail.d/bj.conf b/deploy/linux/fail2ban/jail.d/bj.conf new file mode 100644 index 0000000..a2ebc2b --- /dev/null +++ b/deploy/linux/fail2ban/jail.d/bj.conf @@ -0,0 +1,23 @@ +# Сервер bj: SSH и вход в веб-интерфейс bj (/etc/fail2ban/jail.d/bj.conf). +# bj пишет журнал в /var/log/bj/bj-server.err; сотрудники ошибаются с паролем AD, поэтому +# порог для bj мягче, чем для SSH. Если SSH пишет только в журнал systemd — backend = systemd +# вместо logpath. +[DEFAULT] +ignoreip = 127.0.0.1/8 ::1 +banaction = iptables-multiport + +[sshd] +enabled = true +maxretry = 5 +findtime = 600 +bantime = 3600 +logpath = /var/log/auth.log + +[bj-admin] +enabled = true +filter = bj-admin +logpath = /var/log/bj/bj-server.err +port = 8080,8099 +maxretry = 10 +findtime = 600 +bantime = 1800 diff --git a/deploy/linux/sbin/bj-keymedia-install b/deploy/linux/sbin/bj-keymedia-install new file mode 100755 index 0000000..f1dbf98 --- /dev/null +++ b/deploy/linux/sbin/bj-keymedia-install @@ -0,0 +1,208 @@ +#!/bin/bash +# bj-keymedia-install — установка ключа Валидаты на съёмный носитель. +# Сохраняет структуру архива НРД (key.reg + spr/ + vdkeys/) в профиль на +# носителе, ПЕРЕСОБИРАЕТ совместимый справочник сертификатов (архивный gdbm НРД +# несовместим — bj-validata-rebuild-gdbm чинит), и формирует профиль для ИШ. +# inspect +# install [profile_name] +# restart-ish +set -uo pipefail +DEFAULT_KEYMEDIA=/var/lib/igate/keymedia +BACKUP_DIR=/var/lib/bj/key-backups +IGATE_PROFILES=/var/lib/igate/profiles +IGATE_INI=/var/lib/igate/.Validata/zpki.ini +VDLIB=/opt/Validata/VDCSP/lib/amd64 +ZPKI=/opt/Validata/VDCSP/bin/amd64/zpki1utl +REBUILD=/usr/local/sbin/bj-validata-rebuild-gdbm +ACTION="${1:-}"; STAGING="${2:-}"; PROFILE="${3:-}" +TARGET_MNT="${BJ_TARGET_MNT:-}"; TARGET_DEV="${BJ_TARGET_DEV:-}" +err(){ echo "{\"ok\":false,\"error\":\"$1\"}"; exit 1; } + +if [ "$ACTION" = "restart-ish" ]; then + systemctl restart igate.service >/dev/null 2>&1 || systemctl restart igate-svc >/dev/null 2>&1 || true + echo '{"ok":true,"action":"restart-ish"}'; exit 0 +fi + +# ---- сертификаты НРД в справочнике активного профиля ИШ ---- +prof_dir(){ + PROFILE_NAME=$(su -s /bin/sh postgres -c "psql -d igate -tAc \"select value from parameters where name='cryptography.profile'\"" 2>/dev/null | tr -d '[:space:]') + [ -n "$PROFILE_NAME" ] || err "профиль ИШ не задан (cryptography.profile)" + PROFDIR="$IGATE_PROFILES/$PROFILE_NAME" + [ -f "$PROFDIR/local.gdbm" ] && [ -f "$PROFDIR/local.pse" ] || err "нет справочника в $PROFDIR" +} +certs_list_json(){ + python3 - "$PROFDIR/local.pse" "$PROFDIR/local.gdbm" <<'PY2' +import sys,subprocess,json,re +out=[]; seen=set() +for p in sys.argv[1:]: + store=p.rsplit('.',1)[-1] + try: d=open(p,'rb').read() + except Exception: continue + i=0 + while True: + i=d.find(b'\x30\x82',i) + if i<0: break + L=int.from_bytes(d[i+2:i+4],'big'); b=d[i:i+4+L] + if 100"$BK/rebuild.log") + echo "$OUT" | grep -q '"ok":true' || { restore; echo "$OUT"; exit 1; } + chown igate:igate "$PROFDIR"/local.*; chmod 644 "$PROFDIR"/local.* + # оракул: подписать файл этим профилем (без GUI). Провал → откат. + T=$(mktemp -d); echo test > "$T/f"; chown -R igate:igate "$T" + SIG=$(su -s /bin/sh igate -c "HOME=/var/lib/igate LD_LIBRARY_PATH=$VDLIB $ZPKI -sign -profile '$PROFILE_NAME' -registry -in '$T/f' -out '$T/s' -sendcert" 2>&1); RC=$? + SIGOK=0; [ $RC -eq 0 ] && [ -s "$T/s" ] && SIGOK=1; echo "$SIG" | grep -qiE 'ошибк|error' && SIGOK=0 + printf '%s\n' "$SIG" > "$BK/sign-check.log"; rm -rf "$T" + if [ $SIGOK -ne 1 ]; then restore; systemctl restart igate.service >/dev/null 2>&1; err "проверка подписи после пересборки не прошла — справочник откачен: $(echo "$SIG" | grep -iE 'ошибк|error|Результат' | head -1 | tr -d '"\\')"; fi + systemctl restart igate.service >/dev/null 2>&1 || systemctl restart igate-svc >/dev/null 2>&1 || true + sleep 5; ACT=$(systemctl is-active igate.service 2>/dev/null || echo unknown) + echo "{\"ok\":true,\"profile\":\"$PROFILE_NAME\",\"backup\":\"$BK\",\"igate\":\"$ACT\",\"rebuild\":$OUT,\"certs\":$(certs_list_json)}"; exit 0 +fi + +[ -n "$STAGING" ] && [ -d "$STAGING" ] || err "staging не найден" +case "$STAGING" in /var/lib/bj/media/iso/*) : ;; *) err "staging вне зоны" ;; esac +VDK=$(find "$STAGING" -iname '*.vdk' | head -1) +GDBM=$(find "$STAGING" -iname '*.gdbm' | head -1) +[ -n "$VDK" ] || err "в архиве нет .vdk" +VDK_NAME=$(basename "$VDK") +SPRDIR=""; [ -n "$GDBM" ] && SPRDIR=$(dirname "$GDBM") # .../spr1046 +SPRNAME=""; [ -n "$SPRDIR" ] && SPRNAME=$(basename "$SPRDIR") # spr1046 +USERNUM=$(echo "$SPRNAME" | grep -oE '[0-9]+' | head -1) # 1046 + +if [ "$ACTION" = "inspect" ]; then + printf '{"ok":true,"vdk":"%s","profile_dir":"%s","has_gdbm":%s,"has_crl":%s}\n' \ + "$VDK_NAME" "$SPRNAME" "$([ -n "$GDBM" ]&&echo true||echo false)" \ + "$([ -n "$(find "$STAGING" -iname '*.crl' | head -1)" ]&&echo true||echo false)" + exit 0 +fi +[ "$ACTION" = "install" ] || err "неизвестное действие" + +# ---- целевая точка монтирования (флешка) ---- +TMP_MNT=""; UMOUNT_AFTER=0 +[ -z "$TARGET_MNT" ] && [ -z "$TARGET_DEV" ] && TARGET_MNT="$DEFAULT_KEYMEDIA" +if [ -z "$TARGET_MNT" ] && [ -n "$TARGET_DEV" ]; then + TMP_MNT="/run/bj-keymedia-$$"; mkdir -p "$TMP_MNT" + mount "$TARGET_DEV" "$TMP_MNT" || err "не смонтировать $TARGET_DEV" + TARGET_MNT="$TMP_MNT"; UMOUNT_AFTER=1 +fi +[ -d "$TARGET_MNT" ] || err "целевой носитель недоступен" + +TS=$(date -u +%Y%m%d-%H%M%S); mkdir -p "$BACKUP_DIR" +BACKUP="$BACKUP_DIR/keymedia-$TS.tar.gz" +tar czf "$BACKUP" -C "$TARGET_MNT" . 2>/dev/null || err "бэкап не удался" + +REMOUNTED=0 +mount | grep -q " $TARGET_MNT .*[(,]ro[,)]" && { mount -o remount,rw "$TARGET_MNT" || err "remount rw не удался"; REMOUNTED=1; } +finish(){ sync; [ "$REMOUNTED" = 1 ] && mount -o remount,ro "$TARGET_MNT" 2>/dev/null; [ "$UMOUNT_AFTER" = 1 ] && { umount "$TMP_MNT" 2>/dev/null; rmdir "$TMP_MNT" 2>/dev/null; }; } +trap finish EXIT + +# имя профиля: задано пользователем, иначе PrUser +[ -n "$PROFILE" ] || PROFILE="PrUser${USERNUM:-_$TS}" +case "$PROFILE" in *[!A-Za-z0-9_-]*) err "недопустимое имя профиля" ;; esac +DEST="$TARGET_MNT/$PROFILE" +rm -rf "$DEST"; mkdir -p "$DEST" "$TARGET_MNT/vdkeys" +cp -rf "$STAGING"/. "$DEST"/ 2>/dev/null # key.reg + spr/ + vdkeys/ +cp -f "$VDK" "$TARGET_MNT/vdkeys/$VDK_NAME" +sync + +# ---- зарегистрировать ключевой носитель (vdmkdev читает ключ с флешки) ---- +systemctl restart vdmkdev.service >/dev/null 2>&1 || /etc/init.d/vdmkdev restart >/dev/null 2>&1 || true +sleep 2 + +# ---- ПЕРЕСОБРАТЬ совместимый справочник на флешке (архивный gdbm malformed) ---- +REBUILD_RES="skip"; FLASH_SPR="$DEST/$SPRNAME" +if [ -n "$SPRNAME" ] && [ -x "$REBUILD" ] && [ -f "$FLASH_SPR/local.pse" ]; then + RB=$("$REBUILD" "$FLASH_SPR" 2>&1) + if echo "$RB" | grep -q '"ok":true'; then REBUILD_RES="ok"; else REBUILD_RES="fail: $(echo "$RB"|tr -d '\n"'|head -c160)"; fi + sync +fi + +# ---- сформировать профиль для ИШ (стораны на диске, ключ остаётся на флешке) ---- +IGATE_RES="skip" +if [ "$REBUILD_RES" = "ok" ] && [ -d "$(dirname "$IGATE_PROFILES")" ]; then + IGP="$IGATE_PROFILES/$PROFILE" + rm -rf "$IGP"; mkdir -p "$IGP" + cp -f "$FLASH_SPR/local.pse" "$FLASH_SPR/local.gdbm" "$IGP"/ 2>/dev/null + # CRL-файлы рядом (если есть) — для офлайн-валидации + find "$DEST" -iname '*.crl' -exec cp -f {} "$IGP"/ \; 2>/dev/null + chown -R igate:igate "$IGP" 2>/dev/null + chmod 644 "$IGP"/local.* 2>/dev/null + # зарегистрировать профиль в zpki.ini ИШ (идемпотентно) + if [ -f "$IGATE_INI" ]; then + python3 - "$IGATE_INI" "$PROFILE" "$IGP" <<'PY' && IGATE_RES="ok" || IGATE_RES="ini-fail" +import sys +ini,name,igp=sys.argv[1],sys.argv[2],sys.argv[3] +L=open(ini).read().split("\n") +# убрать прежний блок профиля с тем же именем +out=[]; skip=False +i=0 +while i/dev/null 2>&1; then + IGATE_RES="connected" + fi + fi +fi + +finish; trap - EXIT +printf '{"ok":true,"profile":"%s","spr":"%s","vdk":"%s","backup":"%s","target":"%s","rebuild":"%s","igate":"%s","igate_profile_dir":"%s"}\n' \ + "$PROFILE" "$SPRNAME" "$VDK_NAME" "$BACKUP" "$TARGET_MNT" "$REBUILD_RES" "$IGATE_RES" "$IGATE_PROFILES/$PROFILE" diff --git a/deploy/linux/sbin/bj-keymedia-worker b/deploy/linux/sbin/bj-keymedia-worker new file mode 100755 index 0000000..003e9ee --- /dev/null +++ b/deploy/linux/sbin/bj-keymedia-worker @@ -0,0 +1,22 @@ +#!/bin/bash +# bj-keymedia-worker — демон обработки запросов установки ключа (host namespace). +REQDIR=/var/lib/bj/keymedia-requests +getf(){ python3 -c "import json;print(json.load(open('$1')).get('$2',''))" 2>/dev/null; } +process_one(){ + local req="$1" id res action staging profile tdev tmnt extra out + id=$(basename "$req" .req); res="$REQDIR/$id.res" + action=$(getf "$req" action); staging=$(getf "$req" staging); profile=$(getf "$req" profile) + tdev=$(getf "$req" target_dev); tmnt=$(getf "$req" target_mnt); extra=$(getf "$req" extra) + rm -f "$req" + case "$action" in + quikexport-*) out=$(BJ_EXTRA="$extra" /usr/local/sbin/bj-quikexport-admin "${action#quikexport-}" "$staging" 2>&1) ;; + *) out=$(BJ_TARGET_DEV="$tdev" BJ_TARGET_MNT="$tmnt" BJ_EXTRA="$extra" /usr/local/sbin/bj-keymedia-install "$action" "$staging" "$profile" 2>&1) ;; + esac + printf '%s' "$out" > "$res.tmp"; chown bj:bj "$res.tmp" 2>/dev/null + mv -f "$res.tmp" "$res" +} +shopt -s nullglob +while true; do + for req in "$REQDIR"/*.req; do process_one "$req"; done + sleep 1 +done diff --git a/deploy/linux/sbin/bj-quikexport-admin b/deploy/linux/sbin/bj-quikexport-admin new file mode 100755 index 0000000..7f82098 --- /dev/null +++ b/deploy/linux/sbin/bj-quikexport-admin @@ -0,0 +1,121 @@ +#!/bin/bash +# bj-quikexport-admin — привилегированные операции модуля «Экспорт биржевой +# информации» (ARQA quikexport). Вызывается root-воркером bj-keymedia-worker +# по запросам bj-server. Печатает JSON {"ok":true,...} или {"ok":false,"error":...}. +set -u +ACTION="${1:-}"; STAGING="${2:-}"; EXTRA="${BJ_EXTRA:-}" +Q=/opt/arqasrv/quik/utils/quikexport; SVC=quikexport; OWNER=arqasrv +json(){ python3 -c 'import json,sys;print(json.dumps(json.loads(sys.argv[1]),ensure_ascii=False))' "$1"; } +err(){ python3 -c 'import json,sys;print(json.dumps({"ok":False,"error":sys.argv[1]},ensure_ascii=False))' "$1"; exit 0; } +b64(){ base64 -w0 "$1" 2>/dev/null || true; } +case "$ACTION" in + dump) + [ -d "$Q" ] || err "каталог экспортёра $Q не найден" + python3 - "$Q" <<'PY' +import json,sys,base64,os +q=sys.argv[1]; out={"ok":True,"dir":q} +for n in ("export.ini","info.ini"): + p=os.path.join(q,n) + out[n]=base64.b64encode(open(p,'rb').read()).decode() if os.path.exists(p) else "" +out["keys"]=[n for n in ("pubring.txk","secring.txk") if os.path.exists(os.path.join(q,n))] +out["keyfiles"]={n:base64.b64encode(open(os.path.join(q,n),'rb').read()).decode() for n in out["keys"]} +print(json.dumps(out,ensure_ascii=False)) +PY + ;; + apply) + case "$STAGING" in /var/lib/bj/quik-export-apply/*) [ -d "$STAGING" ] || err "нет папки staging" ;; *) err "staging вне зоны" ;; esac + [ -d "$Q" ] || err "каталог экспортёра $Q не найден — сначала установите модуль" + TS=$(date +%Y%m%d-%H%M%S); BK="$Q/bj-backup-$TS"; mkdir -p "$BK" + for f in export.ini info.ini pubring.txk secring.txk; do [ -f "$Q/$f" ] && cp -p "$Q/$f" "$BK/"; done + applied=() + for f in export.ini info.ini pubring.txk secring.txk; do + if [ -f "$STAGING/$f" ]; then install -o $OWNER -g $OWNER -m 640 "$STAGING/$f" "$Q/$f" && applied+=("$f"); fi + done + if [ -f "$STAGING/odbc.ini" ]; then + python3 - "$STAGING/odbc.ini" <<'PY' +import sys,re +new=open(sys.argv[1]).read().strip()+"\n" +p="/etc/odbc.ini" +try: cur=open(p).read() +except FileNotFoundError: cur="" +# заменяем/добавляем секцию [quik_export] +parts=re.split(r'(?m)^(?=\[)',cur); keep=[s for s in parts if s.strip() and not s.startswith('[quik_export]')] +open(p,'w').write("".join(keep).rstrip()+("\n\n" if keep else "")+new) +PY + applied+=("odbc.ini") + fi + # ротация логов экспортёра (quikapi.log растёт ~1.8 ГБ/сутки) + cat > /etc/logrotate.d/quikexport </dev/null | tail -n +11 | xargs -r rm -rf + svc="none" + case "$EXTRA" in + restart) systemctl daemon-reload 2>/dev/null; systemctl restart $SVC >/dev/null 2>&1 && svc="restarted" || svc="restart-failed" ;; + stop) systemctl stop $SVC >/dev/null 2>&1 && svc="stopped" ;; + esac + python3 -c 'import json,sys;print(json.dumps({"ok":True,"applied":sys.argv[1].split(),"backup":sys.argv[2],"service":sys.argv[3]},ensure_ascii=False))' "${applied[*]:-}" "$BK" "$svc" + ;; + service) + case "$EXTRA" in + start|stop|restart) systemctl daemon-reload 2>/dev/null; out=$(systemctl "$EXTRA" $SVC 2>&1 | grep -v '^Warning:') ; systemctl is-active --quiet $SVC || [ "$EXTRA" = stop ] && json "{\"ok\":true,\"op\":\"$EXTRA\"}" || err "systemctl $EXTRA: $out" ;; + enable) systemctl enable $SVC >/dev/null 2>&1; json '{"ok":true,"op":"enable"}' ;; + *) err "неизвестная операция службы" ;; + esac + ;; + db-init) + case "$STAGING" in /var/lib/bj/quik-export-apply/*) [ -f "$STAGING/db.json" ] || err "нет db.json" ;; *) err "staging вне зоны" ;; esac + python3 - "$STAGING" <<'PY' +import json,sys,subprocess,os +st=sys.argv[1]; d=json.load(open(os.path.join(st,"db.json"))) +db,u,p,ru,rp=d["db"],d["user"],d["password"],d["ro_user"],d["ro_password"] +def psql(sql,dbname="postgres"): + r=subprocess.run(["sudo","-u","postgres","psql","-v","ON_ERROR_STOP=1","-Atq","-d",dbname,"-c",sql],capture_output=True,text=True) + if r.returncode: raise SystemExit(json.dumps({"ok":False,"error":r.stderr.strip()[-400:]},ensure_ascii=False)) + return r.stdout.strip() +q=lambda s: "'"+s.replace("'","''")+"'" +steps=[] +if psql(f"select 1 from pg_roles where rolname={q(u)}")!="1": psql(f"create role {u} login password {q(p)}"); steps.append("роль "+u) +else: psql(f"alter role {u} with password {q(p)}") +if psql(f"select 1 from pg_roles where rolname={q(ru)}")!="1": psql(f"create role {ru} login password {q(rp)}"); steps.append("роль "+ru) +else: psql(f"alter role {ru} with password {q(rp)}") +psql(f"alter role {u} set log_min_messages = fatal") +created=False +if psql(f"select 1 from pg_database where datname={q(db)}")!="1": + psql(f"create database {db} owner {u} encoding 'UTF8' template template0 lc_collate 'C.UTF-8' lc_ctype 'C.UTF-8'"); steps.append("база "+db); created=True +if created or psql("select count(*) from pg_tables where schemaname='public' and tablename='Portfolio'",db)!="1": + env=dict(os.environ,PGPASSWORD=p) + for f in ("exporter_pg.sql","npr_migration.sql"): + r=subprocess.run(["psql","-v","ON_ERROR_STOP=1","-q","-h","localhost","-U",u,"-d",db,"-f",os.path.join(st,f)],capture_output=True,text=True,env=env) + if r.returncode: raise SystemExit(json.dumps({"ok":False,"error":f+": "+r.stderr.strip()[-400:]},ensure_ascii=False)) + steps.append("схема "+f) +psql(f"grant connect on database {db} to {ru}",) +for s in ("public","npr"): + psql(f"grant usage on schema {s} to {ru}; grant select on all tables in schema {s} to {ru}; alter default privileges for role {u} in schema {s} grant select on tables to {ru}",db) +print(json.dumps({"ok":True,"steps":steps or ["база уже существует, права обновлены"]},ensure_ascii=False)) +PY + ;; + install) + case "$STAGING" in /var/lib/bj/quik-export-apply/*) : ;; *) err "staging вне зоны" ;; esac + [ -d "$Q" ] && err "экспортёр уже установлен в $Q" + RUN=$(ls "$STAGING"/install_quikexport-*.run 2>/dev/null | head -1); [ -n "$RUN" ] || err "в дистрибутиве нет install_quikexport-*.run" + chmod +x "$RUN"; out=$(cd "$STAGING" && "$RUN" -i 2>&1) || err "установщик: ${out: -300}" + apt-get install -y -q libjemalloc2 unixodbc odbc-postgresql libpq5 >/dev/null 2>&1 || true + mkdir -p /etc/systemd/system/$SVC.service.d + printf '[Unit]\nAfter=network-online.target postgresql.service\nWants=network-online.target\n[Service]\nRestart=on-failure\nRestartSec=15\nMemoryMax=3G\n[Install]\nWantedBy=multi-user.target\n' > /etc/systemd/system/$SVC.service.d/override.conf + systemctl daemon-reload; systemctl enable $SVC >/dev/null 2>&1 + json '{"ok":true,"installed":true}' + ;; + *) err "неизвестное действие $ACTION" ;; +esac diff --git a/deploy/linux/sbin/bj-validata-rebuild-gdbm b/deploy/linux/sbin/bj-validata-rebuild-gdbm new file mode 100755 index 0000000..603533b --- /dev/null +++ b/deploy/linux/sbin/bj-validata-rebuild-gdbm @@ -0,0 +1,102 @@ +#!/bin/bash +# bj-validata-rebuild-gdbm SPRDIR +# Пересобирает СОВМЕСТИМЫЙ справочник сертификатов (local.gdbm) из сертификатов, +# вшитых в архивные local.pse + local.gdbm НРД. Формат НРД-gdbm не читается +# gdbm-библиотекой («malformed»), но DER-сертификаты внутри — стандартный X.509. +# Порядок критичен: leaf-серты → CA → CRL (иначе E070003A «нет доверенного»). +# Справочник подписывается ключом с НОСИТЕЛЯ (нужен примонтированный ключевой +# носитель + vdmkdev). Сборка во временной папке — провал не портит оригинал. +set -uo pipefail +VDLIB=/opt/Validata/VDCSP/lib/amd64 +ZPKI=/opt/Validata/VDCSP/bin/amd64/zpki1utl +SPR="${1:?usage: bj-validata-rebuild-gdbm SPRDIR}" +PSE="$SPR/local.pse"; GDBM="$SPR/local.gdbm" +[ -f "$PSE" ] || { echo "{\"ok\":false,\"error\":\"нет $PSE\"}"; exit 1; } +WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT +cp "$PSE" "$WORK/local.pse" + +# 1) извлечь серты (leaf=subject!=issuer первыми, CA=self-signed потом) + CRL +EX=$(python3 - "$PSE" "$GDBM" "$WORK" <<'PY' +import sys,subprocess,hashlib +pse,gdbm,work=sys.argv[1],sys.argv[2],sys.argv[3] +leaves={}; cas={}; crls={} +for src in (pse,gdbm): + try: data=open(src,'rb').read() + except: continue + i=0 + while ibest[iss][0]: best[iss]=(t,h) +keep={h for _,h in best.values()} +for h in list(crls): + if h not in keep: print('dropped older CRL',file=sys.stderr); del crls[h] +n=0 +for h,b in crls.items(): open(f"{work}/3crl_{n}.der","wb").write(b); n+=1 +print(f"{len(leaves)} {len(cas)} {len(crls)}") +PY +) || { echo "{\"ok\":false,\"error\":\"извлечение сертов не удалось\"}"; exit 1; } + +CERTARGS=""; for c in "$WORK"/1leaf_*.der "$WORK"/2ca_*.der; do [ -f "$c" ] && CERTARGS="$CERTARGS -dercer $c"; done +CRLARGS=""; for c in "$WORK"/3crl_*.der; do [ -f "$c" ] && CRLARGS="$CRLARGS -dercrl $c"; done +[ -n "$CERTARGS" ] || { echo "{\"ok\":false,\"error\":\"сертификаты не извлечены ($EX)\"}"; exit 1; } + +# 2) пересобрать gdbm во временной папке (ключ подписи стора — с носителя) +OUT=$(LD_LIBRARY_PATH="$VDLIB" "$ZPKI" -minimal -tools -crestor \ + -uripse "pse://signed//$WORK/local.pse" -uriloc "file://$WORK/local.gdbm" \ + $CERTARGS $CRLARGS 2>&1) +if ! echo "$OUT" | grep -qi 'Результат: OK'; then + ERR=$(echo "$OUT" | grep -iE 'ошибк|Результат' | head -1 | tr -d '"') + echo "{\"ok\":false,\"error\":\"crestor: $ERR\"}"; exit 1 +fi +[ -f "$WORK/local.gdbm" ] || { echo "{\"ok\":false,\"error\":\"gdbm не создан\"}"; exit 1; } + +# 3) положить пересобранные на место (атомарно) +cp "$WORK/local.gdbm" "$GDBM.new" && mv "$GDBM.new" "$GDBM" +cp "$WORK/local.pse" "$PSE.new" && mv "$PSE.new" "$PSE" +echo "{\"ok\":true,\"leaf\":${EX% * *},\"crl\":${EX##* }}" diff --git a/deploy/systemd/bj-keymedia.service b/deploy/systemd/bj-keymedia.service new file mode 100644 index 0000000..9fe9755 --- /dev/null +++ b/deploy/systemd/bj-keymedia.service @@ -0,0 +1,9 @@ +[Unit] +Description=bj-server keymedia install worker (privileged daemon, host namespace) +[Service] +Type=simple +ExecStart=/usr/local/sbin/bj-keymedia-worker +Restart=always +RestartSec=2 +[Install] +WantedBy=multi-user.target