From cfbd6a240f46275d75c6ee4b7a6ee1c9b965c28f Mon Sep 17 00:00:00 2001 From: metal-stack Date: Wed, 11 Feb 2026 09:23:32 +0000 Subject: [PATCH 1/2] Bump releases to version v0.22.4 --- src/version.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/version.json b/src/version.json index 3e6006a..b642614 100644 --- a/src/version.json +++ b/src/version.json @@ -1 +1 @@ -{"version": "v0.22.3"} +{"version": "v0.22.4"} From d1869294f6da137175be135b28b5f7d78c6a48b7 Mon Sep 17 00:00:00 2001 From: auto-build Date: Wed, 11 Feb 2026 09:24:21 +0000 Subject: [PATCH 2/2] Auto generate --- docs/docs/07-Release Notes/v0.22/v0.22.4.md | 109 ++ .../Clients/metalctl/metalctl_vpn_key.md | 1 + .../Deployment/metal-images/metal-images.md | 6 +- .../08-References/Partition/go-hal/go-hal.md | 8 +- scripts/components.json | 10 +- .../MEP1/Distributed-API-Working.png | Bin 0 -> 53600 bytes .../01-Proposals/MEP1/Distributed-API.png | Bin 0 -> 49935 bytes .../MEP1/Distributed-Deployment.png | Bin 0 -> 34547 bytes .../01-Proposals/MEP1/Distributed.drawio | 1 + .../01-Proposals/MEP1/Distributed.png | Bin 0 -> 31547 bytes .../contributing/01-Proposals/MEP1/README.md | 141 ++ .../contributing/01-Proposals/MEP10/README.md | 197 +++ .../contributing/01-Proposals/MEP11/README.md | 78 ++ .../contributing/01-Proposals/MEP12/README.md | 34 + .../contributing/01-Proposals/MEP13/README.md | 111 ++ .../contributing/01-Proposals/MEP14/README.md | 36 + .../contributing/01-Proposals/MEP16/README.md | 332 +++++ .../MEP16/firewall-for-capms-overview.drawio | 4 + .../MEP16/firewall-for-capms-overview.svg | 1 + .../contributing/01-Proposals/MEP17/README.md | 61 + .../contributing/01-Proposals/MEP18/README.md | 147 +++ .../ha-initial-cluster.drawio | 535 ++++++++ .../ha-initial-cluster.svg | 1 + ...stack-autonomous-control-plane-full.drawio | 1133 ++++++++++++++++ ...al-stack-autonomous-control-plane-full.svg | 1 + .../metal-stack-chain.drawio | 404 ++++++ .../metal-stack-chain.svg | 1 + .../small-initial-cluster.drawio | 234 ++++ .../small-initial-cluster.svg | 1 + .../contributing/01-Proposals/MEP2/README.md | 7 + .../contributing/01-Proposals/MEP3/README.md | 67 + .../contributing/01-Proposals/MEP4/README.md | 211 +++ .../contributing/01-Proposals/MEP5/README.md | 54 + .../01-Proposals/MEP5/shared.drawio | 121 ++ .../contributing/01-Proposals/MEP5/shared.png | Bin 0 -> 49790 bytes .../01-Proposals/MEP5/shared_advanced.drawio | 187 +++ .../01-Proposals/MEP5/shared_advanced.png | Bin 0 -> 90372 bytes .../contributing/01-Proposals/MEP6/README.md | 123 ++ .../MEP6/dmz-internet_private.drawio | 178 +++ .../MEP6/dmz-internet_private.svg | 3 + .../MEP6/dmz-internet_public.drawio | 184 +++ .../01-Proposals/MEP6/dmz-internet_public.svg | 3 + .../contributing/01-Proposals/MEP8/README.md | 503 ++++++++ .../01-Proposals/MEP8/filesystems.drawio | 43 + .../01-Proposals/MEP8/filesystems.png | Bin 0 -> 24073 bytes .../contributing/01-Proposals/MEP9/README.md | 132 ++ .../01-Proposals/MEP9/architecture.drawio | 324 +++++ .../01-Proposals/MEP9/architecture.svg | 1 + .../contributing/01-Proposals/_category_.json | 4 + .../contributing/01-Proposals/index.md | 69 + .../contributing/02-planning-meetings.mdx | 120 ++ .../contributing/03-contribution-guideline.md | 145 +++ .../contributing/04-release-flow.md | 110 ++ .../contributing/05-oci-artifacts.md | 39 + .../contributing/06-community.md | 11 + .../version-v0.22.4/contributing/release.png | Bin 0 -> 87019 bytes .../contributing/release_flow.drawio | 721 +++++++++++ .../contributing/release_flow.svg | 1 + .../version-v0.22.4/docs/01-home.md | 15 + .../docs/02-General/01-quickstart.md | 16 + .../docs/02-General/02-why metal stack.md | 43 + .../docs/02-General/03-why bare metal.md | 30 + .../02-General/04-flavors-of-metalstack.md | 29 + .../docs/03-For Users/01-client_libraries.md | 14 + .../docs/04-For Operators/01-hardware.md | 95 ++ .../04-For Operators/02-operating-systems.md | 53 + .../04-For Operators/03-deployment-guide.mdx | 648 ++++++++++ .../docs/04-For Operators/04-maintenance.md | 39 + .../docs/04-For Operators/05-monitoring.md | 104 ++ .../docs/04-For Operators/06-troubleshoot.md | 296 +++++ .../04-For Operators/mgmt_net_layer3.drawio | 1 + .../docs/04-For Operators/mgmt_net_layer3.png | Bin 0 -> 298312 bytes .../04-For Operators/monitoring-stack.svg | 1 + .../docs/04-For Operators/starter.jpg | Bin 0 -> 109351 bytes .../docs/05-Concepts/01-architecture.mdx | 155 +++ .../docs/05-Concepts/02-user-management.md | 67 + .../docs/05-Concepts/03-Network/01-theory.md | 762 +++++++++++ .../05-Concepts/03-Network/02-firewalls.md | 10 + .../05-Concepts/03-Network/03-tailscale.md | 126 ++ .../03-Network/2-layer-leaf-spine.drawio | 40 + .../03-Network/2-layer-leaf-spine.svg | 1 + .../03-Network/3-layer-leaf-spine.drawio | 58 + .../03-Network/3-layer-leaf-spine.svg | 1 + .../05-Concepts/03-Network/evpn-vtep.drawio | 53 + .../docs/05-Concepts/03-Network/evpn-vtep.svg | 1 + .../03-Network/network-physical-wiring.drawio | 273 ++++ .../03-Network/network-physical-wiring.svg | 1 + .../03-Network/network-vrfs.drawio | 496 +++++++ .../05-Concepts/03-Network/network-vrfs.svg | 1 + .../03-Network/tailscale-authkeys.png | Bin 0 -> 62091 bytes .../03-Network/tailscale-devices.png | Bin 0 -> 64023 bytes .../05-Concepts/03-Network/vrf-simple.drawio | 44 + .../05-Concepts/03-Network/vrf-simple.svg | 1 + .../05-Concepts/04-Kubernetes/01-gardener.md | 130 ++ .../04-Kubernetes/02-cluster-api.md | 18 + .../03-cloud-controller-manager.md | 11 + .../04-firewall-controller-manager.md | 15 + .../04-Kubernetes/05-isolated-clusters.md | 383 ++++++ .../04-Kubernetes/06-gpu-workers.md | 64 + .../05-Concepts/04-Kubernetes/07-storage.md | 45 + .../04-Kubernetes/isolated-kubernetes.drawio | 284 ++++ .../04-Kubernetes/isolated-kubernetes.svg | 1 + .../05-Concepts/assets/2-layer-leaf-spine.svg | 1 + .../05-Concepts/assets/3-layer-leaf-spine.svg | 1 + .../docs/05-Concepts/assets/evpn-vtep.svg | 1 + .../assets/isolated-kubernetes.drawio | 284 ++++ .../assets/isolated-kubernetes.svg | 1 + .../assets/metal-stack-architecture.drawio | 1103 ++++++++++++++++ .../assets/metal-stack-architecture.svg | 1 + .../assets/metal-stack-control-plane.svg | 1 + .../assets/metal-stack-partition.svg | 1 + .../assets/network-physical-wiring.drawio | 510 ++++++++ .../assets/network-physical-wiring.svg | 1 + .../05-Concepts/assets/network-vrfs.drawio | 496 +++++++ .../docs/05-Concepts/assets/network-vrfs.svg | 1 + .../assets/provisioning_sequence.drawio | 1141 +++++++++++++++++ .../assets/provisioning_sequence.svg | 1 + .../docs/05-Concepts/assets/vrf-simple.svg | 1 + .../06-For CISOs/Security/01-principles.md | 76 ++ .../docs/06-For CISOs/Security/02-sbom.md | 76 ++ .../06-For CISOs/Security/03-cryptography.md | 31 + .../Security/04-communication-matrix.md | 196 +++ .../docs/06-For CISOs/artifacts-signing.md | 7 + .../docs/06-For CISOs/integration-checks.md | 6 + .../docs/06-For CISOs/network.md | 7 + .../version-v0.22.4/docs/06-For CISOs/rbac.md | 34 + .../docs/06-For CISOs/remote-access.md | 29 + .../06-For CISOs/security-vulnerability.md | 6 + .../docs/07-Release Notes/v0.18/v0.18.10.md | 35 + .../docs/07-Release Notes/v0.18/v0.18.11.md | 64 + .../docs/07-Release Notes/v0.18/v0.18.12.md | 58 + .../docs/07-Release Notes/v0.18/v0.18.13.md | 65 + .../docs/07-Release Notes/v0.18/v0.18.14.md | 50 + .../docs/07-Release Notes/v0.18/v0.18.15.md | 78 ++ .../docs/07-Release Notes/v0.18/v0.18.16.md | 29 + .../docs/07-Release Notes/v0.18/v0.18.17.md | 52 + .../docs/07-Release Notes/v0.18/v0.18.18.md | 56 + .../docs/07-Release Notes/v0.19/v0.19.0.md | 62 + .../docs/07-Release Notes/v0.19/v0.19.1.md | 38 + .../docs/07-Release Notes/v0.19/v0.19.2.md | 28 + .../docs/07-Release Notes/v0.19/v0.19.3.md | 67 + .../docs/07-Release Notes/v0.19/v0.19.4.md | 64 + .../docs/07-Release Notes/v0.19/v0.19.5.md | 35 + .../docs/07-Release Notes/v0.19/v0.19.6.md | 50 + .../docs/07-Release Notes/v0.19/v0.19.7.md | 51 + .../docs/07-Release Notes/v0.19/v0.19.8.md | 60 + .../docs/07-Release Notes/v0.20/v0.20.0.md | 108 ++ .../docs/07-Release Notes/v0.20/v0.20.1.md | 36 + .../docs/07-Release Notes/v0.20/v0.20.2.md | 36 + .../docs/07-Release Notes/v0.21/v0.21.0.md | 63 + .../docs/07-Release Notes/v0.21/v0.21.1.md | 76 ++ .../docs/07-Release Notes/v0.21/v0.21.10.md | 62 + .../docs/07-Release Notes/v0.21/v0.21.11.md | 82 ++ .../docs/07-Release Notes/v0.21/v0.21.2.md | 21 + .../docs/07-Release Notes/v0.21/v0.21.3.md | 52 + .../docs/07-Release Notes/v0.21/v0.21.4.md | 31 + .../docs/07-Release Notes/v0.21/v0.21.5.md | 151 +++ .../docs/07-Release Notes/v0.21/v0.21.6.md | 129 ++ .../docs/07-Release Notes/v0.21/v0.21.7.md | 25 + .../docs/07-Release Notes/v0.21/v0.21.8.md | 88 ++ .../docs/07-Release Notes/v0.21/v0.21.9.md | 188 +++ .../docs/07-Release Notes/v0.22/v0.22.0.md | 99 ++ .../docs/07-Release Notes/v0.22/v0.22.1.md | 105 ++ .../docs/07-Release Notes/v0.22/v0.22.2.md | 126 ++ .../docs/07-Release Notes/v0.22/v0.22.3.md | 76 ++ .../docs/07-Release Notes/v0.22/v0.22.4.md | 109 ++ .../docs/08-References/API/index.mdx | 32 + .../Clients/metalctl/metalctl.md | 64 + .../Clients/metalctl/metalctl_audit.md | 54 + .../metalctl/metalctl_audit_describe.md | 54 + .../Clients/metalctl/metalctl_audit_list.md | 69 + .../Clients/metalctl/metalctl_completion.md | 58 + .../metalctl/metalctl_completion_bash.md | 77 ++ .../metalctl/metalctl_completion_fish.md | 68 + .../metalctl_completion_powershell.md | 65 + .../metalctl/metalctl_completion_zsh.md | 79 ++ .../Clients/metalctl/metalctl_context.md | 79 ++ .../metalctl/metalctl_context_short.md | 52 + .../metalctl/metalctl_filesystemlayout.md | 61 + .../metalctl_filesystemlayout_apply.md | 67 + .../metalctl_filesystemlayout_create.md | 67 + .../metalctl_filesystemlayout_delete.md | 67 + .../metalctl_filesystemlayout_describe.md | 52 + .../metalctl_filesystemlayout_edit.md | 52 + .../metalctl_filesystemlayout_list.md | 53 + .../metalctl_filesystemlayout_match.md | 54 + .../metalctl/metalctl_filesystemlayout_try.md | 54 + .../metalctl_filesystemlayout_update.md | 67 + .../Clients/metalctl/metalctl_firewall.md | 56 + .../metalctl/metalctl_firewall_create.md | 140 ++ .../metalctl/metalctl_firewall_describe.md | 52 + .../metalctl/metalctl_firewall_list.md | 62 + .../Clients/metalctl/metalctl_firewall_ssh.md | 57 + .../Clients/metalctl/metalctl_firmware.md | 55 + .../metalctl/metalctl_firmware_delete.md | 60 + .../metalctl/metalctl_firmware_list.md | 60 + .../metalctl/metalctl_firmware_upload.md | 50 + .../metalctl/metalctl_firmware_upload_bios.md | 59 + .../metalctl/metalctl_firmware_upload_bmc.md | 59 + .../Clients/metalctl/metalctl_health.md | 52 + .../Clients/metalctl/metalctl_image.md | 59 + .../Clients/metalctl/metalctl_image_apply.md | 67 + .../Clients/metalctl/metalctl_image_create.md | 72 ++ .../Clients/metalctl/metalctl_image_delete.md | 67 + .../metalctl/metalctl_image_describe.md | 52 + .../Clients/metalctl/metalctl_image_edit.md | 52 + .../Clients/metalctl/metalctl_image_list.md | 60 + .../Clients/metalctl/metalctl_image_update.md | 67 + .../Clients/metalctl/metalctl_login.md | 57 + .../Clients/metalctl/metalctl_logout.md | 52 + .../Clients/metalctl/metalctl_machine.md | 70 + .../metalctl/metalctl_machine_apply.md | 67 + .../metalctl/metalctl_machine_console.md | 62 + .../metalctl_machine_consolepassword.md | 53 + .../metalctl/metalctl_machine_create.md | 132 ++ .../metalctl/metalctl_machine_delete.md | 72 ++ .../metalctl/metalctl_machine_describe.md | 52 + .../Clients/metalctl/metalctl_machine_edit.md | 52 + .../metalctl/metalctl_machine_identify.md | 50 + .../metalctl/metalctl_machine_identify_off.md | 57 + .../metalctl/metalctl_machine_identify_on.md | 57 + .../Clients/metalctl/metalctl_machine_ipmi.md | 92 ++ .../metalctl/metalctl_machine_ipmi_events.md | 55 + .../metalctl/metalctl_machine_issues.md | 95 ++ .../metalctl/metalctl_machine_issues_list.md | 53 + .../Clients/metalctl/metalctl_machine_list.md | 91 ++ .../Clients/metalctl/metalctl_machine_lock.md | 58 + .../Clients/metalctl/metalctl_machine_logs.md | 53 + .../metalctl/metalctl_machine_power.md | 55 + .../metalctl/metalctl_machine_power_bios.md | 56 + .../metalctl/metalctl_machine_power_cycle.md | 56 + .../metalctl/metalctl_machine_power_disk.md | 56 + .../metalctl/metalctl_machine_power_off.md | 58 + .../metalctl/metalctl_machine_power_on.md | 56 + .../metalctl/metalctl_machine_power_pxe.md | 56 + .../metalctl/metalctl_machine_power_reset.md | 56 + .../metalctl/metalctl_machine_reinstall.md | 59 + .../metalctl/metalctl_machine_reserve.md | 60 + .../metalctl_machine_update-firmware.md | 50 + .../metalctl_machine_update-firmware_bios.md | 58 + .../metalctl_machine_update-firmware_bmc.md | 58 + .../metalctl/metalctl_machine_update.md | 70 + .../Clients/metalctl/metalctl_markdown.md | 52 + .../Clients/metalctl/metalctl_network.md | 62 + .../metalctl/metalctl_network_allocate.md | 62 + .../metalctl/metalctl_network_apply.md | 67 + .../metalctl/metalctl_network_create.md | 83 ++ .../metalctl/metalctl_network_delete.md | 67 + .../metalctl/metalctl_network_describe.md | 52 + .../Clients/metalctl/metalctl_network_edit.md | 52 + .../Clients/metalctl/metalctl_network_free.md | 52 + .../Clients/metalctl/metalctl_network_ip.md | 60 + .../metalctl/metalctl_network_ip_apply.md | 67 + .../metalctl/metalctl_network_ip_create.md | 75 ++ .../metalctl/metalctl_network_ip_delete.md | 67 + .../metalctl/metalctl_network_ip_describe.md | 52 + .../metalctl/metalctl_network_ip_edit.md | 52 + .../metalctl/metalctl_network_ip_issues.md | 52 + .../metalctl/metalctl_network_ip_list.md | 62 + .../metalctl/metalctl_network_ip_update.md | 67 + .../Clients/metalctl/metalctl_network_list.md | 65 + .../metalctl/metalctl_network_update.md | 76 ++ .../Clients/metalctl/metalctl_partition.md | 60 + .../metalctl/metalctl_partition_apply.md | 67 + .../metalctl/metalctl_partition_capacity.md | 56 + .../metalctl/metalctl_partition_create.md | 76 ++ .../metalctl/metalctl_partition_delete.md | 67 + .../metalctl/metalctl_partition_describe.md | 52 + .../metalctl/metalctl_partition_edit.md | 52 + .../metalctl/metalctl_partition_list.md | 53 + .../metalctl/metalctl_partition_update.md | 67 + .../Clients/metalctl/metalctl_project.md | 59 + .../metalctl/metalctl_project_apply.md | 67 + .../metalctl/metalctl_project_create.md | 75 ++ .../metalctl/metalctl_project_delete.md | 67 + .../metalctl/metalctl_project_describe.md | 52 + .../Clients/metalctl/metalctl_project_edit.md | 52 + .../Clients/metalctl/metalctl_project_list.md | 56 + .../metalctl/metalctl_project_update.md | 67 + .../Clients/metalctl/metalctl_size.md | 62 + .../Clients/metalctl/metalctl_size_apply.md | 67 + .../Clients/metalctl/metalctl_size_create.md | 73 ++ .../Clients/metalctl/metalctl_size_delete.md | 67 + .../metalctl/metalctl_size_describe.md | 52 + .../Clients/metalctl/metalctl_size_edit.md | 52 + .../metalctl/metalctl_size_imageconstraint.md | 60 + .../metalctl_size_imageconstraint_apply.md | 67 + .../metalctl_size_imageconstraint_create.md | 67 + .../metalctl_size_imageconstraint_delete.md | 67 + .../metalctl_size_imageconstraint_describe.md | 52 + .../metalctl_size_imageconstraint_edit.md | 52 + .../metalctl_size_imageconstraint_list.md | 53 + .../metalctl_size_imageconstraint_try.md | 54 + .../metalctl_size_imageconstraint_update.md | 67 + .../Clients/metalctl/metalctl_size_list.md | 53 + .../metalctl/metalctl_size_reservation.md | 60 + .../metalctl_size_reservation_apply.md | 67 + .../metalctl_size_reservation_create.md | 74 ++ .../metalctl_size_reservation_delete.md | 67 + .../metalctl_size_reservation_describe.md | 52 + .../metalctl_size_reservation_edit.md | 52 + .../metalctl_size_reservation_list.md | 57 + .../metalctl_size_reservation_update.md | 71 + .../metalctl_size_reservation_usage.md | 56 + .../Clients/metalctl/metalctl_size_suggest.md | 56 + .../Clients/metalctl/metalctl_size_update.md | 67 + .../Clients/metalctl/metalctl_switch.md | 64 + .../metalctl_switch_connected-machines.md | 74 ++ .../metalctl/metalctl_switch_console.md | 56 + .../metalctl/metalctl_switch_delete.md | 68 + .../metalctl/metalctl_switch_describe.md | 52 + .../metalctl/metalctl_switch_detail.md | 58 + .../Clients/metalctl/metalctl_switch_edit.md | 52 + .../Clients/metalctl/metalctl_switch_list.md | 59 + .../metalctl/metalctl_switch_migrate.md | 52 + .../Clients/metalctl/metalctl_switch_port.md | 52 + .../metalctl/metalctl_switch_port_describe.md | 57 + .../metalctl/metalctl_switch_port_down.md | 57 + .../metalctl/metalctl_switch_port_up.md | 57 + .../metalctl/metalctl_switch_replace.md | 67 + .../Clients/metalctl/metalctl_switch_ssh.md | 56 + .../metalctl/metalctl_switch_update.md | 67 + .../Clients/metalctl/metalctl_tenant.md | 59 + .../Clients/metalctl/metalctl_tenant_apply.md | 67 + .../metalctl/metalctl_tenant_create.md | 75 ++ .../metalctl/metalctl_tenant_delete.md | 67 + .../metalctl/metalctl_tenant_describe.md | 52 + .../Clients/metalctl/metalctl_tenant_edit.md | 52 + .../Clients/metalctl/metalctl_tenant_list.md | 56 + .../metalctl/metalctl_tenant_update.md | 67 + .../Clients/metalctl/metalctl_update.md | 50 + .../Clients/metalctl/metalctl_update_check.md | 52 + .../Clients/metalctl/metalctl_update_do.md | 53 + .../Clients/metalctl/metalctl_version.md | 52 + .../Clients/metalctl/metalctl_vpn.md | 53 + .../Clients/metalctl/metalctl_vpn_key.md | 68 + .../Clients/metalctl/metalctl_whoami.md | 56 + .../assets/sequence.drawio.svg | 77 ++ .../backup-restore-sidecar.md | 101 ++ .../backup-restore-sidecar/manual_restore.md | 20 + .../Control Plane/go-ipam/go-ipam.md | 237 ++++ .../masterdata-api/masterdata-api.md | 119 ++ .../Control Plane/metal-api/metal-api.md | 17 + .../metal-console/metal-console.md | 27 + .../Deployment/helm-charts/helm-charts.md | 29 + .../Deployment/metal-images/ARCHITECTURE.md | 51 + .../Deployment/metal-images/IMAGE_STORE.md | 37 + .../Deployment/metal-images/metal-images.md | 127 ++ .../Deployment/mini-lab/assets/network.svg | 1 + .../mini-lab/assets/overview.drawio.svg | 55 + .../Deployment/mini-lab/assets/overview.png | Bin 0 -> 314999 bytes .../Deployment/mini-lab/mini-lab.md | 218 ++++ .../gardener-extension-audit.md | 36 + .../gardener-extension-csi-driver-lvm.md | 38 + .../migration.md | 45 + .../gardener-extension-ontap.md | 307 +++++ .../gardener-vpn-gateway.md | 24 + .../os-metal-extension/os-metal-extension.md | 11 + .../DEVELOPMENT.md | 297 +++++ .../cluster-api-provider-metal-stack.md | 145 +++ .../Kubernetes/droptailer/droptailer.md | 84 ++ .../firewall-controller-manager.md | 60 + .../assets/architecture.drawio.svg | 53 + .../firewall-controller.md | 252 ++++ .../Kubernetes/metal-ccm/metal-ccm.md | 39 + .../metal-metrics-exporter.md | 124 ++ .../nftables-exporter/nftables-exporter.md | 61 + .../rethinkdb-exporter/assets/grafana.png | Bin 0 -> 496820 bytes .../rethinkdb-exporter/rethinkdb-exporter.md | 77 ++ .../08-References/Partition/go-hal/go-hal.md | 38 + .../Partition/metal-bmc/metal-bmc.md | 35 + .../Partition/metal-core/metal-core.md | 21 + .../Partition/metal-hammer/metal-hammer.md | 60 + .../08-References/Partition/pixie/pixie.md | 32 + .../Storage/csi-driver-lvm/csi-driver-lvm.md | 105 ++ .../Storage/duros-controller/MULTITENANCY.md | 128 ++ .../assets/architecture.drawio.svg | 73 ++ .../assets/dataplane.drawio.svg | 41 + .../duros-controller/assets/nvme-over-tcp.jpg | Bin 0 -> 83916 bytes .../duros-controller/duros-controller.md | 106 ++ .../version-v0.22.4-sidebars.json | 14 + versions.json | 1 + 382 files changed, 31899 insertions(+), 12 deletions(-) create mode 100644 docs/docs/07-Release Notes/v0.22/v0.22.4.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed-API-Working.png create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed-API.png create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed-Deployment.png create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed.png create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP10/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP11/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP12/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP13/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP14/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/firewall-for-capms-overview.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/firewall-for-capms-overview.svg create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP17/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/ha-initial-cluster.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/ha-initial-cluster.svg create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-autonomous-control-plane-full.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-autonomous-control-plane-full.svg create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-chain.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-chain.svg create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/small-initial-cluster.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/small-initial-cluster.svg create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP2/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP3/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP4/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared.png create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared_advanced.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared_advanced.png create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_private.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_private.svg create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_public.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_public.svg create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/filesystems.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/filesystems.png create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/README.md create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/architecture.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/architecture.svg create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/_category_.json create mode 100644 versioned_docs/version-v0.22.4/contributing/01-Proposals/index.md create mode 100644 versioned_docs/version-v0.22.4/contributing/02-planning-meetings.mdx create mode 100644 versioned_docs/version-v0.22.4/contributing/03-contribution-guideline.md create mode 100644 versioned_docs/version-v0.22.4/contributing/04-release-flow.md create mode 100644 versioned_docs/version-v0.22.4/contributing/05-oci-artifacts.md create mode 100644 versioned_docs/version-v0.22.4/contributing/06-community.md create mode 100644 versioned_docs/version-v0.22.4/contributing/release.png create mode 100644 versioned_docs/version-v0.22.4/contributing/release_flow.drawio create mode 100644 versioned_docs/version-v0.22.4/contributing/release_flow.svg create mode 100644 versioned_docs/version-v0.22.4/docs/01-home.md create mode 100644 versioned_docs/version-v0.22.4/docs/02-General/01-quickstart.md create mode 100644 versioned_docs/version-v0.22.4/docs/02-General/02-why metal stack.md create mode 100644 versioned_docs/version-v0.22.4/docs/02-General/03-why bare metal.md create mode 100644 versioned_docs/version-v0.22.4/docs/02-General/04-flavors-of-metalstack.md create mode 100644 versioned_docs/version-v0.22.4/docs/03-For Users/01-client_libraries.md create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/01-hardware.md create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/02-operating-systems.md create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/03-deployment-guide.mdx create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/04-maintenance.md create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/05-monitoring.md create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/06-troubleshoot.md create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/mgmt_net_layer3.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/mgmt_net_layer3.png create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/monitoring-stack.svg create mode 100644 versioned_docs/version-v0.22.4/docs/04-For Operators/starter.jpg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/01-architecture.mdx create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/02-user-management.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/01-theory.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/02-firewalls.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/03-tailscale.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/2-layer-leaf-spine.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/2-layer-leaf-spine.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/3-layer-leaf-spine.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/3-layer-leaf-spine.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/evpn-vtep.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/evpn-vtep.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-physical-wiring.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-physical-wiring.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-vrfs.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-vrfs.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/tailscale-authkeys.png create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/tailscale-devices.png create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/vrf-simple.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/vrf-simple.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/01-gardener.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/02-cluster-api.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/03-cloud-controller-manager.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/04-firewall-controller-manager.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/05-isolated-clusters.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/06-gpu-workers.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/07-storage.md create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/isolated-kubernetes.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/isolated-kubernetes.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/2-layer-leaf-spine.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/3-layer-leaf-spine.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/evpn-vtep.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/isolated-kubernetes.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/isolated-kubernetes.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-architecture.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-architecture.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-control-plane.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-partition.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-physical-wiring.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-physical-wiring.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-vrfs.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-vrfs.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/provisioning_sequence.drawio create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/provisioning_sequence.svg create mode 100644 versioned_docs/version-v0.22.4/docs/05-Concepts/assets/vrf-simple.svg create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/01-principles.md create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/02-sbom.md create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/03-cryptography.md create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/04-communication-matrix.md create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/artifacts-signing.md create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/integration-checks.md create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/network.md create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/rbac.md create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/remote-access.md create mode 100644 versioned_docs/version-v0.22.4/docs/06-For CISOs/security-vulnerability.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.10.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.11.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.12.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.13.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.14.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.15.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.16.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.17.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.18.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.0.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.1.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.2.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.3.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.4.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.5.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.6.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.7.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.8.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.0.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.1.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.2.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.0.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.1.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.10.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.11.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.2.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.3.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.4.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.5.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.6.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.7.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.8.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.9.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.0.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.1.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.2.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.3.md create mode 100644 versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.4.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/API/index.mdx create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_bash.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_fish.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_powershell.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_zsh.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_context.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_context_short.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_match.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_try.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_ssh.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload_bios.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload_bmc.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_health.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_login.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_logout.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_console.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_consolepassword.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify_off.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify_on.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_ipmi.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_ipmi_events.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_issues.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_issues_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_lock.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_logs.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_bios.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_cycle.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_disk.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_off.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_on.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_pxe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_reset.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_reinstall.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_reserve.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware_bios.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware_bmc.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_markdown.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_allocate.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_free.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_issues.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_capacity.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_try.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_usage.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_suggest.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_connected-machines.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_console.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_detail.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_migrate.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_down.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_up.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_replace.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_ssh.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_apply.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_create.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_delete.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_describe.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_edit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_list.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update_check.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update_do.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_version.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_vpn.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_vpn_key.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_whoami.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/assets/sequence.drawio.svg create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/backup-restore-sidecar.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/manual_restore.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Control Plane/go-ipam/go-ipam.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Control Plane/masterdata-api/masterdata-api.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Control Plane/metal-api/metal-api.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Control Plane/metal-console/metal-console.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Deployment/helm-charts/helm-charts.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/ARCHITECTURE.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/IMAGE_STORE.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/metal-images.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/network.svg create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/overview.drawio.svg create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/overview.png create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/mini-lab.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-audit/gardener-extension-audit.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-csi-driver-lvm/gardener-extension-csi-driver-lvm.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-csi-driver-lvm/migration.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-ontap/gardener-extension-ontap.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-vpn-gateway/gardener-vpn-gateway.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Gardener/os-metal-extension/os-metal-extension.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/cluster-api-provider-metal-stack/DEVELOPMENT.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/cluster-api-provider-metal-stack/cluster-api-provider-metal-stack.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/droptailer/droptailer.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller-manager/firewall-controller-manager.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller/assets/architecture.drawio.svg create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller/firewall-controller.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/metal-ccm/metal-ccm.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Monitoring/metal-metrics-exporter/metal-metrics-exporter.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Monitoring/nftables-exporter/nftables-exporter.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Monitoring/rethinkdb-exporter/assets/grafana.png create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Monitoring/rethinkdb-exporter/rethinkdb-exporter.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Partition/go-hal/go-hal.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-bmc/metal-bmc.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-core/metal-core.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-hammer/metal-hammer.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Partition/pixie/pixie.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Storage/csi-driver-lvm/csi-driver-lvm.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/MULTITENANCY.md create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/architecture.drawio.svg create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/dataplane.drawio.svg create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/nvme-over-tcp.jpg create mode 100644 versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/duros-controller.md create mode 100644 versioned_sidebars/version-v0.22.4-sidebars.json diff --git a/docs/docs/07-Release Notes/v0.22/v0.22.4.md b/docs/docs/07-Release Notes/v0.22/v0.22.4.md new file mode 100644 index 0000000..6c9a49a --- /dev/null +++ b/docs/docs/07-Release Notes/v0.22/v0.22.4.md @@ -0,0 +1,109 @@ +--- +slug: /release-notes/v0.22.4 +title: v0.22.4 +sidebar_position: 1 +--- +# metal-stack v0.22.4 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.22.4](https://github.com/metal-stack/releases/releases/tag/v0.22.4) +## General +* [Gardener v1.123](https://github.com/gardener/gardener/releases/tag/v1.123.0) + * Please note that this release contains the gardener-apiserver built from the metal-stack fork in order to prevent the defaulting of worker machine images by Gardener. This will be resolved upstream with https://github.com/gardener/gardener/pull/13785. If you do not use short image versions in the `CloudProfile` you can also use the upstream version of the gardener-apiserver. +* Virtual Garden `v1.33.7` +## Noteworthy +* When using the `cluster-forwarding` audit backend in combination with `blocking-strict` policy, the controller now lowers the audit policy mode to `blocking` in order to prevent a scenario that produces a deadlock with a crashing kube-apiserver. Since `cluster-forwarding` is not intended for production use cases, this behavior is appropriate. Note that the policy mode is also lowered when using `cluster-forwarding` in combination with another backend. (metal-stack/gardener-extension-audit#71) +## Breaking Changes +* The `metal_stack_release_vector` module now uses `oci_registry_credentials` to provide registry credentials instead of `oci_registry_username` and `oci_registry_password`. This way, it is possible to pass credentials for multiple registries. (metal-stack/ansible-common#43) +* CSI-Plugin architecture changed from a split controller-daemonset to an only `DaemonSet` architecture. Each `DaemonSet` now also provides its own controller (figure 3 of the possible csi-plugin architectures [here](https://github.com/container-storage-interface/spec/blob/master/spec.md#architecture)). With this architecture it is not necessary anymore to spawn pods for volume provisioning and deletion. For users of the Helm chart and the gardener-extension-csi-driver-lvm this migration can be deployed seamlessly. Manually deployed csi-driver-lvm installations need to adapt to the new architecture and delete the existing controller stateful set. (metal-stack/csi-driver-lvm#128) +* There are some breaking changes in the `monitoring` roles in order to make them compatible with the mini-lab. If you deployed monitoring components using this role, please review the changes of introduced in metal-stack/metal-roles#502 and adapt your deployment parameters accordingly. (metal-stack/metal-roles#502) +* connect.OutBand now requires to specify a connection timeout for redfish calls, if nil is specified it defaults to 10secs. (metal-stack/go-hal#82) +## Actions Required +- In case you set the `NodeAgentAuthorizer` feature gate on the gardenlet, this now has to be removed. +## Component Releases +### oci-mirror v0.2.9 +* Update go modules and gh actions (metal-stack/oci-mirror#19) @majst01 +### metal-core v0.15.1 +* Fix waitgroup panics with negative counter (metal-stack/metal-core#179) @majst01 +### ansible-common v0.8.0 +* Allow login with cosign. (metal-stack/ansible-common#43) @Gerrit91 +* Add missing documentation on `helm_additional_params`. (metal-stack/ansible-common#45) @Gerrit91 +### metal-deployment-base v0.9.1 +* Bump metal stack release vector plugin. (metal-stack/metal-deployment-base#47) @Gerrit91 +### csi-driver-lvm v0.8.2 +* Install kustomize to local bin. (metal-stack/csi-driver-lvm#146) @Gerrit91 +* Fix eviction controller evicts volume on VPA eviction (metal-stack/csi-driver-lvm#145) @Gerrit91 +* Add warning admonition on working with local data. (metal-stack/csi-driver-lvm#143) @Gerrit91 +### metal-api v0.43.0 +* Provide splunk audit configuration. (metal-stack/metal-api#641) @Gerrit91 +* Provide reason field for retrieving VPN auth key. (metal-stack/metal-api#640) @Gerrit91 +* Use newer approach to use sync.WaitGroup which prevents leaking counters (metal-stack/metal-api#637) @majst01 +* Include consolepassword endpoint into auditing. (metal-stack/metal-api#638) @Gerrit91 +### helm-charts v0.5.4 +* Sync csi-driver-lvm chart to `v0.8.2` (metal-stack/helm-charts#146) @Gerrit91 +* Add splunk audit configuration for metal-api. (metal-stack/helm-charts#144) @Gerrit91 +### metalctl v0.18.4 +* Allow field to provide a reason for a VPN key. (metal-stack/metalctl#293) @Gerrit91 +* Update to go-1.25 (metal-stack/metalctl#291) @majst01 +* fix issue where binary name was missing in generated sbom (metal-stack/metalctl#290) @mac641 +### gardener-extension-audit v0.5.0 +* Move S3 secret key ref constants to public API package. (metal-stack/gardener-extension-audit#72) @Gerrit91 +* Prevent `blocking-strict` with cluster-forwarding backend. (metal-stack/gardener-extension-audit#71) @Gerrit91 +### gardener-extension-provider-metal v0.27.4 +* Revendor g/g v1.123. (metal-stack/gardener-extension-provider-metal#486) @Gerrit91 +### metal-roles v0.18.4 +* Adaptions for running monitoring in the mini-lab (metal-stack/metal-roles#502) @ostempel +* Configurable vali storage capacity (metal-stack/metal-roles#516) @simcod +* Add splunk audit configuration for metal-api. (metal-stack/metal-roles#514) @Gerrit91 +* Frr reload on all sonic switches (metal-stack/metal-roles#479) @iljarotar +* Fix wrong `metal_registry_url` name (metal-stack/metal-roles#515) @AnnaSchreiner +* Zitadel role: some leftovers from the last review. (metal-stack/metal-roles#505) @Gerrit91 +* Add configurable `metal_registry_url` (metal-stack/metal-roles#509) @AnnaSchreiner +* Make nsq tls requirement for client connections configurable (metal-stack/metal-roles#513) @AnnaSchreiner +* Modify nsq and postgres backup restore namespace creation (metal-stack/metal-roles#511) @AnnaSchreiner +* Monitoring promtail client configuration (metal-stack/metal-roles#518) @simcod +* Fix promtail config when no timeout is configured. (metal-stack/metal-roles#520) @Gerrit91 +* Allow setting `shootAdminKubeconfigMaxExpiration` in `Garden` resource. (metal-stack/metal-roles#519) @Gerrit91 +* Structured authentication for Garden kube-apiserver (metal-stack/metal-roles#517) @simcod +* feat: add envoy gateway to service clusters (for isolated clusters) (metal-stack/metal-roles#522) @mwennrich +### api v0.0.41 +* Boot Services (metal-stack/api#83) @majst01 +### gardener-extension-ontap v0.2.12 +* Set DNS policy to Default in mutator for the trident-node-linux daemonSet (metal-stack/gardener-extension-ontap#80) @mwennrich +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.22.3 (metal-stack/website#184) @metal-robot[bot] +* Updates regarding OCI artifacts. (metal-stack/website#146) @Gerrit91 +* Register handlers by serve path. (metal-stack/metal-robot#100) @Gerrit91 +* Slight refactor of comment command exec. (metal-stack/metal-robot#101) @Gerrit91 +* fix typo in release pipeline (metal-stack/metal-images#384) @mac641 +* Bump metal-api to version v0.43.0 (metal-stack/metal-python#161) @metal-robot[bot] +* Bump metal-api to version v0.43.0 (metal-stack/metal-go#222) @metal-robot[bot] +* Add section on pre-releases. (metal-stack/website#187) @Gerrit91 +* Bump axios from 1.13.2 to 1.13.3 (metal-stack/website#186) @dependabot[bot] +* Bump @scalar/api-reference-react from 0.8.27 to 0.8.34 (metal-stack/website#185) @dependabot[bot] +* Cancel redfish calls after timeout (metal-stack/go-hal#82) @majst01 +* fix container image retag in release pipeline (metal-stack/metal-images#385) @mac641 +* fix typo in release pipeline (metal-stack/metal-images#386) @mac641 +* Updates golang base image version to 1.25.6-bookworm (metal-stack/builder#88) @thheinel +* FOSDEM 2026 recap. (metal-stack/website#193) @Gerrit91 +* Bump axios from 1.13.3 to 1.13.4 (metal-stack/website#189) @dependabot[bot] +* Bump @carbon/icons-react from 11.73.0 to 11.74.0 (metal-stack/website#191) @dependabot[bot] +* fix: containerlab link in blog post (metal-stack/website#194) @vknabel +* Bump react from 19.2.3 to 19.2.4 (metal-stack/website#188) @dependabot[bot] +* Bump @scalar/api-reference-react from 0.8.36 to 0.8.46 (metal-stack/website#192) @dependabot[bot] +* Update gofish and adjust for changes (metal-stack/go-hal#84) @stmcginnis +* fix api version pinning and small ts errors (metal-stack/metal-ui#9) @ostempel +* Update dependencies (metal-stack/firewall-controller#208) @mwennrich +* docs: fix outdated links to metal-stack.io (metal-stack/metal-images#383) @vknabel +* Implement gcp auth and remove unused actions in release pipeline (metal-stack/metal-images#387) @mac641 +* Gov1.25.7 (metal-stack/builder#89) @thheinel +* size, admin not finished yet (metal-stack/cli#4) @majst01 +* Bump semver from 7.7.3 to 7.7.4 (metal-stack/website#195) @dependabot[bot] +* Bump @scalar/api-reference-react from 0.8.46 to 0.8.52 (metal-stack/website#196) @dependabot[bot] +* Bump axios from 1.13.4 to 1.13.5 (metal-stack/website#197) @dependabot[bot] +* Fix gcs authentication, gcs object paths and rework tests for release pipeline (metal-stack/metal-images#388) @mac641 +* Fix log output formatting and download url links in release pipeline (metal-stack/metal-images#389) @mac641 +* build(Dockerfile): Upgrade Go version to 1.26.0 (metal-stack/builder#90) @thheinel +* Next release (metal-stack/releases#265) @metal-robot[bot] \ No newline at end of file diff --git a/docs/docs/08-References/Clients/metalctl/metalctl_vpn_key.md b/docs/docs/08-References/Clients/metalctl/metalctl_vpn_key.md index 85e934a..6e28121 100644 --- a/docs/docs/08-References/Clients/metalctl/metalctl_vpn_key.md +++ b/docs/docs/08-References/Clients/metalctl/metalctl_vpn_key.md @@ -31,6 +31,7 @@ metalctl vpn key \ --ephemeral create an ephemeral key (default true) -h, --help help for key --project string project ID for which auth key should be created + --reason string a short description why access to the vpn is required ``` ### Options inherited from parent commands diff --git a/docs/docs/08-References/Deployment/metal-images/metal-images.md b/docs/docs/08-References/Deployment/metal-images/metal-images.md index 026f953..af70454 100644 --- a/docs/docs/08-References/Deployment/metal-images/metal-images.md +++ b/docs/docs/08-References/Deployment/metal-images/metal-images.md @@ -30,7 +30,7 @@ We also publish images that we need for special purposes but do not officially s ### GPU Support -With the nvidia image a worker has GPU support. Please check our official documentation on [docs.metal-stack.io](https://docs.metal-stack.io/stable/overview/gpu-support/) on how to get this running on Kubernetes. +With the nvidia image a worker has GPU support. Please check our official documentation on [docs.metal-stack.io](https://metal-stack.io/docs/gpu-workers) on how to get this running on Kubernetes. ## How new images become usable in a metal-stack partition @@ -52,7 +52,7 @@ These URLs can be used to define an image at the metal-api. ## Local development and integration testing -Please also refer to our documentation on docs.metal-stack.io on [Build Your Own Images](https://docs.metal-stack.io/stable/overview/os/#Building-Your-Own-Images) to check for the contract an OS image is expected to fulfill. +Please also refer to our documentation on docs.metal-stack.io on [Build Your Own Images](https://metal-stack.io/docs/operating-systems#building-your-own-images) to check for the contract an OS image is expected to fulfill. Before you can start developing changes for metal-images or even introduce new operating systems, you should install the following tools: @@ -124,4 +124,4 @@ vgchange -ay mount /dev/csi-lvm/varlib /var/lib/ ``` -Keep in mind that you are still running on the metal-hammer kernel, which is different from the kernel that will be run in the operating system after provisioning. For further information on the metal-stack machine provisioning sequence, check out documentation on [docs.metal-stack.io](https://docs.metal-stack.io/stable/overview/architecture/#Machine-Provisioning-Sequence). The kernel used by the metal-hammer is built on our own inside the [kernel repository](https://github.com/metal-stack/kernel). +Keep in mind that you are still running on the metal-hammer kernel, which is different from the kernel that will be run in the operating system after provisioning. For further information on the metal-stack machine provisioning sequence, check out documentation on [docs.metal-stack.io](https://metal-stack.io/docs/architecture/#Machine-Provisioning-Sequence). The kernel used by the metal-hammer is built on our own inside the [kernel repository](https://github.com/metal-stack/kernel). diff --git a/docs/docs/08-References/Partition/go-hal/go-hal.md b/docs/docs/08-References/Partition/go-hal/go-hal.md index 6db22f9..519cf8b 100644 --- a/docs/docs/08-References/Partition/go-hal/go-hal.md +++ b/docs/docs/08-References/Partition/go-hal/go-hal.md @@ -17,22 +17,22 @@ package main import ( "fmt" - "github.com/metal-stack/go-hal/detect" + "github.com/metal-stack/go-hal/connect" ) func main() { - smcInBand, err := detect.ConnectInBand() + ib, err := connect.InBand() if err != nil { panic(err) } - firmware, err := smcInBand.Firmware() + firmware, err := ib.Firmware() if err != nil { panic(err) } fmt.Println(firmware) // UEFI - err = smcInBand.PowerOff() + err = ib.PowerOff() } ``` diff --git a/scripts/components.json b/scripts/components.json index 6057a13..d870891 100644 --- a/scripts/components.json +++ b/scripts/components.json @@ -7,7 +7,7 @@ "releasePath": "binaries.metal-stack.metalctl.version", "repo": "metal-stack/metalctl", "branch": "main", - "tag": "v0.18.3", + "tag": "v0.18.4", "position": 1, "withDocs": true } @@ -48,7 +48,7 @@ "releasePath": "docker-images.metal-stack.control-plane.metal-api.tag", "repo": "metal-stack/metal-api", "branch": "main", - "tag": "v0.42.5", + "tag": "v0.43.0", "position": 4, "withDocs": false }, @@ -89,7 +89,7 @@ "releasePath": "docker-images.metal-stack.partition.metal-core.tag", "repo": "metal-stack/metal-core", "branch": "main", - "tag": "v0.15.0", + "tag": "v0.15.1", "position": 3, "withDocs": false }, @@ -235,7 +235,7 @@ "releasePath": "docker-images.metal-stack.gardener.gardener-extension-audit.tag", "repo": "metal-stack/gardener-extension-audit", "branch": "main", - "tag": "v0.4.2", + "tag": "v0.5.0", "position": 1, "withDocs": false }, @@ -253,7 +253,7 @@ "releasePath": "docker-images.metal-stack.gardener.gardener-extension-ontap.tag", "repo": "metal-stack/gardener-extension-ontap", "branch": "main", - "tag": "v0.2.11", + "tag": "v0.2.12", "position": 3, "withDocs": false }, diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed-API-Working.png b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed-API-Working.png new file mode 100644 index 0000000000000000000000000000000000000000..899e223d25919d8ec5a2c2cacd2099f8731ff1ee GIT binary patch literal 53600 zcmeFZ2T;>r_cw@$3U)z7RKP+JK_HYQfb^w6fB)Pfwd&)icobx&7hUsBY2lk%a z%f!TVKuc52fQgBP%EZJR$GRK5ljyUCWnyAGKvXv)y8Al1xH&NKOR8@F#V;Z5Oz4god=JIGE~!84SiRsRI7ealw;(!EawA+!`(=1pZR? z@Njc5b+ARd5TWss2vJEm^cA$Gk**HEgev&k%?0NGexV%fa0KWp-gp}i@JrR%i{S1; zatB{S$cT!IO3Fw{iy~zH`2>9BfB(LrjiZg1%YRu0qSMF0%iD#3-zF0#Au25j+a}0? zXydf~E*$Tu1=n>$Xc8UGWF)ZmUNQ*f?J-0@4~OkB_6|NSc3@2jeo1w}VS5)FCodcD zY~n6|If#SV!XzYga0G;fy|yVuP0G|75C;uMnE2?}d3sB!>xtU{l2s%O)iEw)A5A<) z2PS(~6eAV5gQAC6fUJ9oL=ukJb$GPg-z->|PaAlOUrXk$k-Vm>4 zgc0|l_<)(nc$6O)W-dWAG%}!&^$1e>WF*B`5~WJk#()ppu%^bQhAMVsJ3l`uGee@S zxtX)Gqcn!7qCtR5!%2oFp3=r@%BHFo9>%VQC>?WOG}^@pMxi(%O#Eb|%}q36o=&cg z>bhQj>R25#(NRVfCV{drl_X;|!1N~esu-9L#X{Lt+}*^^&c_`oC4qE=I~eI|`d9!i zYe+cY>@j#r54emj(aZ~@=4Y<&0Mtpv#X;B4#*ZK)>5Iqdqs^2tw)T*A7&+VONt4vv zwGAx1ZShz?6rSR01Bbh7>S$8%YFhTTdd4cgx}IuU-iEfGb`UFd@UE^7es)*{S=t

*#5l_~}a_O?}C}WCN6`r#iyi z)k#~@UE9Z9ljP-Uh&Hfr_8`MG$S5}tPYHxAPFL4a3W!mKs4U@ND5D{vrmZXmGt-r{ z)gpVtRbA1(Zl+kAyOe~E4#tIo5;w&-`xyCXs=BGmpxq47HV7$-o4b>-qpz~F5#AFc zr2}&^G50lcvc*ezxNAG0ytTAE{BRgoM?f>l#?Kbz?5U?>DsGIh#S@Hdq#ZmpoPAu> zZM4CbQGppzT(rH>Kr=Nw5t5Ehp3(>%BP|soT3JHez}?TxPR9i)spey+t}p3rYoH;m zE)FyHbthmj(nvjoorAaz+Dli{z{}jhMatgUS=GZ&UDwSQrcN-kGts7a<9w029(b^f z6alL$PQ+^?+*CbLs@`rcHa?PO%JxK4H@q4aVS{ra!)yphO>svlH)8`y@C74jUy7d& zO4`QF981C?ZC%|E6pEca%t74N1!-&~Nz~9HJDMY;Oug;QB_vHflvPyx%pIKVl^vZm zZSlHDIDw=}q1c-HN)wP8&RB}AgOshBF&ugp3oP2s+1TEggf-Fg^Kf-`aIp1}a6`as zHPw)gh8FrryrikK3Rx2&X^STMIGS1*%ec8pY1kWksLI&NxH*VJqVs~=K$`@uLexXM z*!qbh9gMJ8X;&9#bw4dUTG~!o%|_D!MZswpOG%1rxT)*to07=3WSFhAgpMjqQqtVr z-Q7gW*9NcegYqG(=mLE;LaAwxwY=cQj_SU4`noF4CVJv3wvJjbtTM$;TNUkOVr=53 zqOW6*uy=RDc%votwLJ;WNW7Oa8jbVyLBnC%p8C#`YF-v<<|HF8TQf9@geEB?br1*% zoR+GtgRweB)zs0*R@0Z{ts{eSur-8Bc^YV``MALhlnMIoHumN!KvOVSX%l^8Uu_)G z4G;%tC1~r2`$@w*JUldP!AnO|PkTR485svvPiZ@h2?p3h6$v*zU%Z1j+#KNzlZ5-| z7=ibkP(%w?Ef04iHwQAz9%g}a^^)-t$EkUeP(DuLMjkj_k}i%6H}I2CclE`nB6N+= zUM404TXB+yA4 z4AH17~pPo9xOUnhPYzTzrqavek@2>8m zqlt2X6Wx^kBuEaP+8Vwx<~U;*&J2tIN}y(-uB)yGW{2tN80krPpe$gv23~lgiVu#g zDXwi}s|%OGIO`)|>IgVd59vrUw~;V#L-=~T`x^K;!IeF{P~vvV5O2(!%wRZ4gqx8E zLJDn*cJq-o*EAukNlIe0d}So;b)~c&HH?rx7%6jc7r2|WGFjTqSK7oBZ|-M+a+lFm zCfLBe_4Q?pO^xlH+|)dgZW`vE9(qU_2R)<T2u;hA6wsc-q@xynu3RVN5CZ$^@jVnx4BO21Sz57B`T@n>azXS_7sbW8#GNu`tH^ z*yxhA9dt~c?Yxy$o#2|T7A|-@oSUArG0DZ(Km%^*=L!vneF-~lbC|g{3OdA93?Qa!gCAE1iWv-}hjDfwYB-5&7?~RxqV=5pfJdM~HYYeE z+-2;vC1o)7I-Y1LFF$XX0iFWBWeyjI;T`oPEwJ`Fz?o3-GSIQdYN4T%z)8a%Pa)&o zkr1Q2P4)FPe2_$E6$E&ttPdT?&_AG68vmTbTZb}u{nzu6RM!>16UD@IhDl3J*~r&w zDrsMZkLq`ZAm1&o{cKoS&9RV!&%5PbC>R_)r(!UcLOc`Ge>yD@n|?S|MfMySzi~#vuCHF{U58gGO`wOibHkJpyY*nAbNsO^DDEf5QHfg#u*BI37sZBI}ti^WEJw@k+u>FAGh? z?O3+g0<%|V4x*WuwmE+utaZ9DE~Tl>JV@rF-Cu4;upFj(eLbn5y2blBmcs|`iG`Xl z={eXPv@)R#`o;&5!eJ=dS*C$2mk@xSH6ciM6)5pzr zgGD9gbz=U?2nW8~!SzmIYpSDK@76K~x`Q5RHHkY<@O^yoQ{pcMz|-bPh6HX)Au421msUhS7oBX=+@^I~>!ZV8qHcp> z5;`YEw~5+h$sw%ePLHO%mpJzf^X0RozRI?!bJ)&c%$=Clw`IY%V=^HKx2`TA|M6L7 z^#17E_1h$b?gzsh9!p)l4GA`MgUxJU;Yv@F;tdBirKFfgPS0;{3*3xDDe-k9)6%v? zG`C3z*P+~2HWd69X-v#q>`IAW#9d0Z^?j8iziPbrZA$R&`nw^rLg$;**tV4*UmyhO zkhEiJn}kQ(Byc`i*ncAf^DokvSS0vDkg+x`9$Z@@pBKCq*h+9$WbBVSvV&xxksQXp ztqRw4nLNM9?(Dj=MZ&pl62v6NxpwO&+5bb@4pw_jCeMrilFBgl8j;xcATqM^p#A?- zNh>|u4b<&q^O%IxjtMtsdm^;?A@u?8S7(Cv|LS_az{97`;sXJHN+9Zcau_V@JH1{@@-2)!y#x%XZ4)8}kN5A}W@tzVY)7@w5X&{5zq{j(lI!#LGzOhe z{P|pXiOk63Gz@a*`d47BE)`U>&n)#24vAtc{eH#bi~D@MN0a^Wmr}Ct8nVBesa&>d z5~vj}lC6Jqc6;Lh;>6_vVdGrin75~Ycslg)^Y>wb$zw}>Wb5T>4s1z!yj6D+u|*4? znI7l0hnx7Yd}F@8FD+7G0$;gkf@r$@r(`ymvA+4H?OC+pKGBkAJx(csyS3|LI@&lApVa$DW6mH3cmd&b;5lORPQZ{Z+|RTkv+(?^|LkjP<2r+VriY?7XV( z%E4oK9)^oUc-lryUoeAiwGnkD0~c#-GH0jh zw)Xx|(2u2FZ!81((`Yc}=F1vR>)z?A^_dy)W|agl zr16&SJcxWpQ`&rl;_=K2oW}KyQ&VO{D;EsJFx;NiN30&MeRWb8f&-Oz8h&G)DElkM zu(y-8Nh1He#aYH#@nct2uI+kvXO&6$L0huXOstqFtJK+M`&^uDeATugKLivlz$-R~ zx;7%SV0XH1ceow&0rQdO^+#3nv3YGgm*SB8cX)h%>_9L!{`e2@F>wcP%*}ApR&H@p z`I^W0qF-6lCrqs_L@7y*4aZbx0%d!bVqmb&?bG$1K8_8Zr}L|gtF`S>Tv2Aw*q>8U z1Z9nhKSKAc17CFy zK6WA043~%J> zMn_SfPtPic(fRY|XD$)^>Lsl*MBk4B_0M2jp&`>-Q7CRwOz^PYtap@RC1bksFkO{* z?IGs}3iCsjvuu_W7X8^z-45}V70qp87~NybWs|Qat>211%3`n|O6sLd71UPfrE{2b z1VBDDt zIRb4KcoX?aYJvZE@ zEu1Umf4Wi?9eHv>-s=A@J!(g(3)el9o<@zGd*qb%06sq(+p-=@5xm8BuyV>l%)7^} zuwg1bYFV*^%At*WRhn_dt)ONjuT7WirOh1Q&!5idBev@Hag%$0@^ZGxWi2p!vFT7u zWBQf(ZL|iPuX;E93U4cT|X&_7~6YR7|~R9F=g6t6uRQX3-af&n1?)tt@WSQYlP^< zJWsCJJ&?W_Zn##YP#FMh6{9>@unpLM8AeyiD{|$eB{(UXf;YXz&W&@M?7Q^lA!o({ z>vNX#^z}2q3O-$Uy;wd|Rv(#5R?JKZTE)`ZsGF48)@LQl{r-gD4_Y*fm#wbsjXwQ; zqfQ$ZDWA;1iM!E-%d32=$d%;%S=jBR<0fmdJ3?2=w zIQ&Dh>i*^0`%x$FX~h?8Eq(_qPWEy+&X#aca^VDU&m;t{Rr+)kL?UB7-?tMhF-dJw z>ctW4&u+^;HT!TK?6AX+!B?(5<3CuNkyf3<0b+#an2^P87k8SF;##q4h^)&U@AzCj zRm(=v0w`o*MFEHCbiFOgwpHJ4g6%XoxRl;err*3BVB)sC!l#tBG-3-9LLBgxmDu3(;#j###G?rmX5gNkJe+SOmphG6LUkTz(-XY(VdkZf>&vt-ei4Ybp}-a0wcBFQ!%bHE zt1Jv~Qp$Z$;|NZCc^^a<2DIPB`1L?E`*`(lua!LPO(_rxPOB3o&28JBG|1IBF3+ zV`FUK;EstG+>MrRRSuA3%Byz+x9ZGkAW09AaPBZ&R6(Yo2XOCp?3gTS?GD;WB)UIh zBDI{Gig^0`e<}OLWo0LTxyK!nwEMIl;XU%Tn~u`Z=Q&$EmgAENAq@cXae$j~=icYcv1v_!T0(qr+-)e~e9vtnm3J zSlWx*wk-~Bkm&lLpfl;}Q}quSANR}O2BNsmmcMj7apSluwb9~cpT1$69*P5Pwsn+) zP-5@?H`PD8h%t{zwm`FUz*q~XXZzRN%>TR1bW|s#sQAZl@d;T{$A8EEYq}vtow7R} zx~Pp`K6`(?keT|J$aMTxU#>CdRPGX_)ih@o9=9R49hGkT zR?U7K(z17eW6V1*c_QK5{EkVF!QRAyu^n6&J}Qt*G?MK!v<}p~sPBR(D^mqAvRtWD z_)XnAT$KGlfp>9So4$lxy>uIsRP^6%CNnU$s8NY)DYH;w{jeSJPf%Fa%ncN` zuP)u3&rSAgvmFSwFFa<#5#HAkV8n?W^)7B{^#dfSf}6V_r4rpFVw(<>CKX!}m@B_HWnt8`JRVh6LKSjKANqeszbH614@6 zt;&ALI6u()Q)WBr0jA`x78vz!bqorPz#z@1OzYJzT5otmyov%E6RUG^o^(?eRaN@Y zdus%==HX~C>fZ_qOal#iD79lLOpCf_6tYWvfbAEb7!6OdCPV~y-x=K+0j+sP0E~i- zOTZyH&VXm1z=$@SvuU-t&GYep402(f;)uo^YJ^Op=51g?B{DyE9)WYOjvQ>-3U{G3 zm2|);yML$c+w_GfwXk#v3MBC)-hdu)KahmI!K1wMZnEwlv~DiuE6h^&gA%*WLQhQTU&u@PGJmf6vSR|M^&T zHm$J#Dev7lUMHABq$X3cpd3gqNGpxNzuR+=|1==Vl^Hy}p`Ujy)xu&k|7*@Wcj^(c z4`g`p52QO@_EKp-*Cz93;k_QJ#j7I;ho*v|oL%psA=67v5>rHwnez+!qT18RCYbo+ zZMUm1;calx!L{YLbewCRVuZ3?`%i0<>o(dABqW=eqy5UU>JTNaG8X?Ja_X7Wjwu4OE76T&caoQ+^oE(v|fzXE5A0DHq&v1 zKmxh;$o0)-+AJ1*KvqT?BwWk;$OC;zC_D*cx_^^@ z|42Fr}nCfOmhEUoLGT@zTdoeWtWEWAGxdG0AV_ zN%EtBRu^jN$kY0LK`ATMg1rFom#hE*DQO(*h8*M0W)l#EM2)3Dtkem74D;*33C6Dm* zejaSf+b}NOd9^jOBQ|dnm*uy#KEUYzW1Lji2=evgc2J@;;8I@6;Jq1M#>$;5*Ftv% zBwPP^+F9b=C{ufhwlTj+>^UemB|c8W9qjxGgXNL?Nbx2d!CI~|7O0B!oCQMu z``t5(dBK&2mm&BfuW3|~u{s0(D=i1=zmXW+H)%BrrRSF!n*)qLq)gd3#$e7SeXjDy zF0sdLGe!v?pGZ2bDZHj0=mUGk(|W*oG!3qqH64vr_`W;i z;NRnRkS<8gu*ee`J@6K2d;n`c)-5>YWfSLgLH}~q@@f-yTDS@%^VXZ}m%?18IKDHA z2Ct3W_@@@2n9)kVzSLYc(8`%MOX)1{h1H(^lOr#>PGczSurFe$CVm+$lsCur^b$3% znt9dn(+{NK%lHNAHou{GrwL_C-8eBa!0AdrTC{DzcjC5ncoRrMBI?Rgd;MoC>AF9J ztyi^|0e9+(dF@B!i(yR{U0>CYZ=a zWhBf(7|LdKtZkI$vjpD$Uo@8bejKD1pKSThm(r1`R0w-|55KiKO# z^dLEvg?W{4hca_Dl%)*f2#CdLO&LavBzj{~h6d;}WIU9%Uu_v!Fnh|PKu=(S_f;%g0}$lq&YDX*MmN`I zm*ISES`~#Qe0MJ@-qT{vR=CW6`~sF;F@|bdF?cLURjA;1F^!(ehuY152rT6Mz((H;te)G@4+TOdV7v`T8 zOfQEQaMUDZj(oqEoinI@IP9Y0%KJkVB?4zPrHi{=vsX_jETkSP1t?4Fs3mj4tNx9c zXVTwklRLf4c%G_qh=obA%l^7k&D&mqtQh7O^V2Y_+5CJyvZSy{p(nf~OQ=1YN44!_ zT194Z&D8?U3mv^?0DJAj2F-KOd=_e9pI>3_AE4wIc&o0)`UU~pSQ;5PW!FDzy*VFW z*a;ph4PMC}TKnl!fCwZp`qhrI^zLu60?HGTDXU)#dBUfyYa#s{*$)T$xv{OE7d*B7 z&rkC%?5Zcz)-7qpZOM^=&*=(}=+@=yiqm-vfZ&zR&3Q7?$+JAFdG_P9E(YB+@pU)j zEaulTS4v{7J6`r^1x9#ml~%se9glNUVPZJq=CLFFhZ~t$;^N0x*oXas175?TIT()kl)tEFi>9w0vr?M{|rr zt|1b#eF8_+1aptxs8)TD7wwz1&z;4{RJH(~gG`r^5IIzksu;<*WlA!#9Y6~07LUQ(_;=bNY{v^dJnb(^sLCr{419msLWVBaxDd! zh&*PS0@TBrb)x=2pups@y=zmG@)`r#=K^{1u^Y4HT0Px@uNm0_m|NY9@gQaYfqov- z<>TF)CR`7+{!TKFT( z8C`x%X48Ex$$%69J9aLA6S}4B^X8!?Fmsy%#z046Fe_u#k$4{epotTim;%kjmb%?Z zao^h43G$d19H+__UPh=TDQ_-v-i32ROrZ-Mv79&`s`UJZD7R-0VeWGn^%~rYuarOpQRFXNCD=H863uyXws{vh6%~Y=d$DS@Jt_ehvQe= zV8JKz8Bbl4$FCfh7r3}X^ZNafxJ^@7){HbK>3}ds>tXgsJ6mq;>edbYT&<~ZLyy?s z3RXR|)~QZg{@~M|R(&n^{5}0C{?ijQ(wf0wtf>1YNkT`uM+|e|b&p(XMr~j__IjCU zE`dGYxSS$o{s(pHBAYIKvcc$&zKqG~N>WC=>MyKd_i*;ji@79@yv>F>qsiEs#PJ@rgncjX66}UfHDeB{$~1#Wd$!u#!x2Us zQJJ-Rh2RBdV|h5Hee;m#MOxF!@MXMrYpUU13gQuuVykW{o}FJ~5ol}g_?)<9*?8MH zUtb6Ys6-?WswJJ{=tSD7Vr8GT8m2`qlf)K;t#Iy}sCD3t{&1go6NPsq?UVxwfqqW% z&OuW@1+BHF99+nwDP`ehi9>nF1@-}K!01jgkRWdqaDk@yKhS!!qInFp!Ss_do|73HRp>S#ks zZzduFzrvq92Ga;f4@M70t-M6rW>>4WzuK6hmt%}v3^NISZB7r7?cvIU4_R2-t1!31 z9#wzpA3v3}aKtoFwTpvVeI=4H4$I3F4LcRxAodOO<=bNuMRa*%b0c5g6v%SUwm-|aSAjxBrCJ^KecdmT>Sh5R1 z-}C3+DR?41FIFq)r<|Jgt(Dsd!_9RHIR@IiY!XcRGHW@-ks^d~v2ObW9S+i-7uzFXDRK0vB?T!w5)rEQ;fmDgJ&@{c2~ZB24@4`ewWmihFJW_!b%i=gjCos zcjQ@uT^Lu{_nFF=QtQMPEf!$hpNFxCCPnC3_brSI=ul5AyqEgisOG61xje={LNSeG z5lAxlcH+jSWhBcuF&wk@S&>boEUc~WrShQBET3`S%Z$M@M^rW^VYyie2Ln$C`>eho zv=KjM5rp43FW06T!VKq9rV13;grNcyx^9Kq3);pnvCX;5m13yb!EY`CbFF)>NAyk% z5LGk<{o(z-b_|5PKsu^tp`SOfH8sIiK5xK(G^W3Ye@>N71N9v%hVa*EWUa+;!<3C- zL3-GkN^kAOR)5|b8-*oAaJEz$$+3$cjl5}4b3Rq`T&PzbhbSdAv!5GYut{O$8ah%~ zbQW{VqF7TcTCaXHTRYQHo>Pro%sbicl9i0)|EVhdvUY_pWTGvW=UeMWGi@BE9VUKb zTPhCrWGX>SOF%VZJcO)eh6*ivtr{sN(%vder)XXCqjS3meP#m(*F=8b-t^j0C+Fo6^zMKy9oE1+e_iFf12 z9{OYUy$k2u+0My+e^D{9aL4Ps;sVZry=lShnVKZMMT3#INCyQ1%ZT6Xyr8<`ml>iD z_^2#GVHYZ`CtDx0e-shx+n78WUG@IaSjT#i!fGDs(xN++$1>LJ1^M&=c51a2b(2qg zZ1~B9k!^C&k-TMG;Mymn*~Df~M|l&Oxz53u^MMJ}Xj2NRi(K`Go53U8{>D{1NIUVQ zR1;su7z`aKEIcz$6Wk3{Vla0@OS5BKJnRPhQEBQP`g;Cl0S@ZIE9qRWtg}hUE$f{| z3G91}y(>wnS;+K6t)oVkS#PB~iRZMa$!kLoyCk1j{<5I+AH`HqXaN^^NrSq7EG}m^ zq8ebo(B}#}xGK@u$c80`MT*yXWmCIs9?ImWXV#MmC06E*r`!O9w0d|e+Sj*^n~*e* z92tWVe<=yJE~W{uRXC(L)3El8&i+m8GS`~z)n!(SVAja3DzmouO#1SzDTV-}s0zLu z3@U~L-U?2-BqT&+o*BzPKaatG&bDHwwxMXRVu#W>usB84|!Ia4( zV~T!;1QyCxb+nQei^2Eow$%;W6f=W#_DLg_iLbnORj!!`9Ko>5oN zk#}A_EM19jbWi(3c+$MU!!K6pjia1{M*T&1mVdIgJyHCbBWWN6a4hXQVl~q6J5g;v z?0c$Bikqv){(ms2(T(+pg+}&QOKk6|0!Pe%6`laFb5>JCGUM#KJt>w#@A@O;RTq348eC+4it?7i+2jg z%|G1&z!?A*?!B&J%Rocv zQCOK`Kj<&FWVTgz3wV5u!aQZ1;dC^6*Oc8OhpPZSf@(=m80|Y1eMq7F=EwgJAGcJF z1>Ws^e)%KsX1?5xBWw`1cat^Wv;e&uqUL+VJ19E=72kEqg#79TB)F!f*+nw(2KW>) zK{U)9+%ck0_R``5_#%bH%x>C?8G8Hed8NLd0)i`-XO@uin%r@w@^c}T-2NiuJ4}CG z%9Zl510v;_a|(Q9LZP>Njy#*0?m`sZN4CeDp&y~{$A#2%9#+VZQw{NJdt$^63br4f z+0kKE{$fjZ)2w>SK2r%68i}sj4>#``-j;qhh-2k#O*;GT@`TPsHc%(7`H%^hV`*@W zP|H*A!}1b5lkTPS7-@dZ;A)|dC$G&(-;5k@JbaCZBoNC2N_P1)L!>)Ig|?(E$J|!Q zy`B*Vl78$j6bEB$4&<+#{7_4DVik{+jn-xcRq^b6?@r?4k9PGG)V}84G0`6pXjp&O zP?xQR*YivMZnJ;`KkdpSSstU3wD>~-e9Fdt?LiTG?>0x7NQBy|Oo!^s43_aoq=VT` zk*eFjVSQZ8U(*_2L@5CQu(0KS>gM0ICxStAi;#?`(h$`8Hs?WG3HXz;gZS7|lc) z5Fx~E9Hu_~714j!FhlxUsqf?65uU6pe9f_bZLvt^jJQ+_K0OP1>~TW0!F6K}O2gWR zDlSFJs8&cBAr65Kx@*|rg(6f7wVuqsdRb>@Es}+qeVg1JhV^=v*e~R6YKIqV3BAu^ zs|1nsz$!l%f7KlW!c3BMYmcn6INd%vCX{PJeE2pK0#TAoxkSFm8H&{-frzO2N&WulTPi- z5t~YwOCu+d(P8lTnFb;!^$@~EOT36VTJj;YNBhL9OXRbNk<3}?@8pRvxgu474Kt<+pdrP zidXyJiPy5AQjE6YRs7{*_R7loz7?p^DEn2JYr)m-gS}pJ&T=MG%4d%MeH!7W`={c! zXZ&b#XuaAdti}bK^y%l9mo6L-3v0Jocx!${(IvIK z!M&jG#Ab7W)Q$ttD0ygTXa*pPGgG2l2xkLgV2XC))Y8PN6e!>=1}#(N!g&=fxwOqS zJb=bid|r+ZCi#R!AV3A5#`VlrsreAjX-HM)-VP&jk?G9~skya9$IY(opk+4SS>0## z`?^rtX78xNCjiG*HqTbRm^M=<1B+ zEX6cERm8^BOFUWwb=vc$qV(eLkB6F;%%lq#o9pF(inGxd=E>2NM#Vd7*Rb0*pv#nn zr|qm>`X+?9F9R^H)4k;9?HLfR)7Al8INbqS7K9q6-?UR=D!?908Bkq@cZhZKgS|cEUPrj# z>H0|hxMyC_Vs;gWmVw1v-AjMP1w}t6lrLQB23hh^h0VFhbwebSo#+D% zBojfKe^SbC9F!e1Pl(^c2I2iKP9kl+Z?<=?mRHgJ_^Zk#i{(sg;1^)gb$jA= zw{n;fzo|n&xlDQLgz71cS4*tG7)`5(@v~O*ZyUiu$AoWoM_w8P(^Vc~+9#!|mZCuN zcVHv_SvT)Q_$vsD1}GG-_wqn6O>T8Ky7DeR4A)2MT%3L*RsovBdgH4W_-T7KAi(0_ z<=;x=nq#IVP$vk~gEvo|I3zQCSh1txPvhjS9RHcp+F9ZCyr2}~MYLTCsl(jR)>hFx z_gqORdfXnBLcLwP29*-Oy0F9tCHITA4NqrZ_Oj z_YlM$q?-TTF`;x|V+0W-`8%$-qJ|)_Fx^=`K*tArxi0sSml>}Py#gJ8-Qj52xJz?m z0A?rU1=A<{j7=?n@$P9GzYvJ)2nLYCfH#zOURFjGICz&uo4w8@R1>qpvt>dz2{lOR z_C%+oBO;uUvYRb?n1%ix0zw_E3cA>5+VsVnXXIt6owCkiP&?RqWn$GrTNr=R?TP6f zi?VEiVSeN3@oUkB?1gVoF?U}CLtTd(oEd9~FvD5DCjX6O1M0@2bMjJ*YqlWM!o@HM zNejY$r&-5f=Pj)>CeS8qHoR-icQW=rrVlSHK07|ek?nc!d)AkV`z|R3XRj%P<4U71 z${JizU>nU-(^@BxlpJ+9odeTt765wZmJ)W;6X3fjoR1VrKzpUD@Dc67XdcEDkPW1> zW%Yl05#0JM(p+rF%CqJeT`_R-%7EAUOnKh=yFCix;vAIf-#~hQ7`4YDlxDBMFuJ$w zWWQ?0h1ZG)wH#*_`g{Bfb?&V?AOQ9tAB#NL0b7lQTUlnU3t^~E>)^`rpSMpX_8Yzs z6Z7|1GH(@QGCf9pqu8EoFc^*bg~P6b20@3n$aaomqD3}&F(vV-G%oHG7uTHN>)n;2 z*XhF^g&~219u+FZuO!4&d+aZ>nn9M{;oTP1f+>7TV=ZY{*2Fu{2dn^#czz|1aaNu~~U zvcG;+I&!iYREkK|AFoVNRvNfBu9jF;Fl=c!&3Wh7;J2VRW;c~i|26d*zo@vX`r@r?$d4OsUdB#lI(vbG`0o_T9k2-(OXhUIN0q?L=5#C_&!IE_6`q zJws5QP!t@4rM-N92v_N0K+Atls92be0y^+*inDS|eN*!-20QNimgl>nzx&0v{S=%S z&$y~(wJ@v@)@_ULyJ z*o7sxj$3@@rFW1fGO3gT9maaqa^yCn5?Di~Wofxyp#Ax;^u)* zAxf^0>%&z5on!4HQtSPhyfhwe?nP90>Ab+1)Q&;*^|)|UKi5Zp){XdWcjg)V4`1`* zT46W#HTJ8wg3iLzKwHGT=25@HV{4=OQzB;blW&l*ALnrO!?mJQQJ;#xq{a3{d7*Rq z1h*}2nYCx%{rvhxr_z)uiB5du&APPL|BM+2>8FHW)lt^en#|J?)>i~*=HFY&Q$mb+ za;KsKS&3oW&oE}-9(xoWKiTA^_}$^v*T@x?mnkdv3m)=7{xU{nm1L6mS~f`DO~_0j z*v#5R@$uFK2Kx?=v2S}&-_pA;3dOzZNLdVeoqZMk^whofi;*Ti=z6ia40TAo4xxjR zj#5P;tq)z<8&}8MVcLBjqrda;*tyVGIUg;<(!!-pRCFwJXh)Z#Er%^W1Ux>G20dfk zV>?^S9mw0emgaZL*-@OhoSTo!%z}lc1j|1c z-CPA1MA*iK$sA+ONobI;smt>oj9HwUv_Zd@SpB%B?O!eA%EW959CuQQuqUzLllI+A z++zHfpx3yo=*Rn_Yn)?I!sY2BPfA+PK>qg)ei|msQ0Vmk_3B2!Leqlf)kQb`#4l)M zU$*#uNv5+JkA>*p3Fv318X*4%6C;u82b7+Lvy{C)Nal|a?J#45kuo<8y0JcCIJQ5a z=Vn-h!~Y_S86v^qLzJ~sb*53o|ABcsazBC{yI81l1(@2xz41-aIW6rnPUQx{nczV_ z6nXDbv{y3md-Gb34^)(#xe%(nUM8U7)x!Y~YxnB&Z3GCqV?&}$VHiVeA+T1i|7V2k z#0AJo@%_Xa3yMTrx1+jsvF{*JQUz7^u@0+V8+w570q$a-~eVzQRb4lY3P(sUnpSo@;MZU8K>k_?s!MdGZePdtiG6mT3r*KaK z>PyNUd!Xsd;}i!&->EUnH0GWT%$P4z4Ot71Mwfj0*}e1ulkn|1f~Do0UianK_c=YYY^JXWfZ)_- zp4q23Yo~Dej&HD|EKz(9hkCz!8|90RG%RA(187CjUg|@P$)As3@Mm54zpAjtz#~P5 z)DvBinIh33Y!dg|QGTU8G`25f?8IJXE%wiz_+Mk*QFXPM7A!A8C}?rZP*X5_)yARt z;Tv|xvn<*PsJOXv80kc#xH=FyJ+27p%bj@l1+PThzbllFZ5UbXwIEYBJY;l&O;_R@+uQ^%uBK8V~@a{2RF!m2v+cJvnsKOov@&iry?ZnN(P?nb1ZdB_)fdekIB zLGVdHVwQTynrdQ}G4dAi^;2FGpM6@wHpf+-z45c>5*sx7sO9kFGMJ@qUsqq&!JMhx zYPEWYHKUXwyoFII(K-s4_H#<~vzYdai7K+@4TprwZ@q{W-*@&Ox&3_cT89VBGQ4XF zZ@kCEXXkUf3#@!vXKG7h)0(sdc&V;Oo^1k<;27p?QqIVo*glmO?Z>wcUvTF!{}hgF z_b@R3Un=&rv^0D`K*iDpNyo1ql1_~|eZkwAnD!Yg=!nb_D2VM7Z#%JzdHk;~l^qLl z`pEulQ$X;Of@hcZgronKIwhF%Wf`#j)kcYAhqyY#!AirC+<9k*V#B)gCs=ha(VIZ1TJ7B{obzM764U_u zjHU!vZAF3L5{t=X-$AzGg%)&qG)A`WQc;@$K1;V2G@APt)0cYIJ)vlrJp2eHTN(Tl z+#Wy%t@yXD_)i!0LAB{yz6)Yiy1h<_&18OY(wb3L4hoU`wkndrwF;%+wvdmJVhpJC zmJA|{vfQ`bUsB$+fU2ogN!Y8pL2KJE{$6lz$JDE;HCJjwCv%n#s-k3;xbjw8J>idgD`K=>M;ex z2onl`ZT_k1gI{yZ3wy(@H*Cq^tf6?it^SH9b6WYPLT6l`@*eJC(Xz2~%isc(t|V{- zZGMwYN-P8MMPC$JbR3FU#jd%73`x~2sB@K1M;3tuPzktu;M+cZsQR)OLj887flSbs z+=}@xGf*hP-2TKVc^q`rJI%Hl4YqyQCpNX^*FaUoLNOG=Hz+bTs*=`D|Ghh; zCT6hheB|Z95pWX@L$ep`g%POaI#>k_3gooLt7AmvKT&-cpcK9jG#H5gPBIJ^d3{$7 zTwBw3rGNgon2J_NIY^UK>Sf@H+D*K{LuEsEJ6r^Xk_X@yf|8`7bH{mbF@0u!iLWl_ zPGLqlgYPKK{5>xGlYS@;8cm(NE1maU@HO_nW%>O>p|1|#Ejmd3QVZ<8&`{Rh*Z_Cg z{`LOlGN^c(b-By#kl5vMqo`M)M!kIoSPdVLS=uD92U0r0yZCsPGJON{VDF%xOGO*7a{6O?ViO8&sZ*m8B{VL`{J}t zReAP(bDR0+}eOH{ChPW6o4m9m-EniuH87W5tdcQGnwG)rG0sK zO&*8I>$%F=KtlJ$u-Mx1{a3yxHHvK>4DJ1UvM$TM53bJal0J;HD#Y5SoGAC<;$^lx zdl<)!iH(H(l~2Y;gjbCb-0}q@f{Lqkg_;YBn;EU@(48*yq2PTY`5~Ndi61hd`ljqIKy`{?7dy2{Kx=T`sToDBe?=8 z?RhzAEDD)kJ0*pm9gg`lR(aZTwzeDat#2?~YzEw3;|-O2`vya|-;_bu#zgk;#t$|J zV~^ANL;0_`O7z#EDo%LB7tsDwb#|4v~$^sc}WM)EXpp@z;U&*ms zW0mKJ*waUz;zSweypxP5W2tv4oZn1jWv@jWpTd`=U8*E#M{4wMgF9c!wz>^Mb{_mK zX4Y8*N|gOzy40eDl9a&~v13cM{6F3FHh>OA@BDLEobNEsJ%Y<1LZNo}eHX}@ZVvvA z__s!7Z~gF<+pi2UvVr^sFZabm5tYwbr)s9qOx7)z@X5s~a7Ba|Mil+)ivmnXKGs6f zW(>BMWi#?$PFW#_c9$A|ud|YvMO|*0m$e(?oCU4+6GZ9hG*E&y+IrsCvSiD>5FNgM z;!Fq>)qqPT6e0zj>J$pB9u#16YTa$cMjTE=+&6&#b5I@_ed;jpW#aXnC?!(CAQr!( ziR+8+WobFTec&!gM50J+dco1rg(J4^G`u{R1wHeG?$r?dc#LZov&}!Jy{lPaTwT36 zFs$;W+b(M<%a6k>%pBVe^N%;M#Iumg`XzrO3gHg=E93rK1KV;P6h(WHceOE%DwR0u7~Uq-8+p~~*&e2Oqq*x9%@|Rn90I#f zV$x9nF$rZSF62Rh#O<5UvNU*qdd)39ai)A2nN^*aJ9!=*-l%KbqO`kygh9YCx2yd2#DSPyW2apLrNFgluX3r}XHT=X?UpM|YDn zd6l=``xJAY*~|0g#I9+Vz0lXX%m<8{^0T5CU0kHsi3tGjLQqqm+=Rc4W9_)f=qJN~6X7b3Hwp*?0Fb^d&ai zI!_v{pDVG8@7~^ihF7F_>PI43E(QCV>b;|tJod|izqY)%%fs+Dd|Mm2n?qO-e?0jG zq>#Q`Vxy;OqZJiNl(<3t>ma&bbAj8I3gmVhzqxWyb?pY(xZ;PeE=Yl|IO~U`{l$3A ziY3PR;uFT~PVK{m=? zDVi5>hEFd5u>4F+$|9_`cz0pTyPUZ7^bq(;qT%SR3)C;-|Kd&5OJn?*n>dp9nC&Rl z3N#2SX?0Z8^Sft%zi^!iop$i%0qvL-?k`CcxOeAORD*x+Bmz^%A!)AnJ~tj8>f;eT zyE{v|i8RM&~=guq~vP>xIR_0UQ+NL zJl`pkQ?f6m3s~;#8TkR^iGGveIP48u#S92S$3fVCy{JM^v2d?)w1p?T$%=_H)eQ|Sp#|+=R5kEsc zzzs&an2}40`wQRQe~Z%(0f1@d7gS#|qjA?G$`Oz@06pnH!-pwgzAS8E%bMM>*tiWvX{ch{bE=|{$OxLV#Cddp)@xNkT z+s75~)}Of2WWObjA9Ak*902!bm?io9wlkeQK-j|Non&-C&kwGcb|)oE^q6y>E=LmlvuH1lXtZTNe}@3_-tk4NFO zU?K6|czM(oaK05_E!hHd+o#41a~*G5&=e~NYpWf2Dt48fGC5_yAv1aC?mo^J4V4*w zwAU3*=Nm@vf3c}4$RV?bQa9LFok#f<8@R5s01xE#^vOL_H=mKp$|fuB${Z1lc)W*l z514_l3*|2!C_7QFx_{Utd`}YYy`S{1N5MK9y*L>Yjs>gcGel6(RL;y)1V!W(<55aA zxTOS*(N>*$fk8j--Spqkw*#N)Py7_adj3~;Z^nID?NaJ0TbCXIPli&ui_>{|Yuso4 zQk~lmdHsB*-s7%^BprWv%Ewp>4Be1=7*YYhD1yM0&ZfxHB(|b_i-_`SN&6FVscJ=9 zq%Z9(-+0!D#go?NUi;4!a`TkMB1`9~?>_&)o$4FPDYEB5`3uM%b;Q3P3vO<#abW2r0Srt0#M(CZn*q1Hv)Z+vD6i4XxfI(KmmDhdZiX|#{>REY%7q(C3fNhAg+6ci-8>AgTw|YZ3QJ4LSJ0+^#ge}-(4m%&&nNgyV0d^uH(zN z-5w^jXl`)msP6$D6&Q$Fg8DE>uIt5qTafth;^q}$u)33i|su3x$*bL9RkgRL1~ z5RG(%OM)L_09$ZYu7Sm@u6D3R*WBya*ryEtTPdkct$R;J@?C)7i@gB8IOf>hjf<`T z8UIwl!eO@oR8Hx9v1UiR87u`h*bq()5%PH&i?v7$w^;_y{T$s#XNyDc?u_oa`e)ks zFY+o;@rSOkYu|(7@I$Uo>Lk0fvZwhy$qbnnVb?3ii($qt{SNUd$t5WHoYDwJ+A+g} zD3!+!FNr)uXG$Gr2@b93()q*Yw+`)rL$lxzell@!XU>j4l}Vt6=Iq$N%o&eP2&&$z z$ss3y;9Zxnf}9h~*T{wSBooBk4?Ef=PEaW~b?)lMb;Sj_^b3@JIktDi2mvl-P?H)~ z!5vhvlHztdM+@b<&eclN_35R7neEAr!&uz2i_Str%E2I$|DxrW%5KiSA^c&)(QI2n}yoI6wOKCw%;x~9rZB> z!=adb3zm#yobN$53wz}LLsp6uGG;X6d)sl@; zU&4>ia(4{D+RS@?T#PdA5nkZtrs~E_c-BtC%cj+4J>ipFp1Q*k6rN9wI1DZ6QNZRn z#tcCOT{3|OuWE-p$&7M@Lq+D@+ec#gleez^mi zF$pQHRg_^nT7<_8<%-@qBEV{yEGgMGaqHnI6O2MF%x;Rozzz^&(qd9*jnLXw*VR zkuiR$cYSU%Srd&401tPhZ1>@$&qaM1?|Bk|umc$%P$QH}?4BEGQ4*>QH(2=m5k<%w z5RU8XUAJw3c@LrFQKdO^`@kM>=V3T&Tmv(slQ2cZI5^F|igkIi@I;@v;z z;{W{{(76eo=JgkoCUWn zR)wN>0Kn^$nO1mcngQTx&tlXDnMKu4voM;xT4HIb1lI3Um83^kB$HFm^4lNT58KWe z$bZx(>yo?Bw{kvH5k>%8l8~3vR^b>*?)ELt)TW%{tlKT8Ac!y4gpl1=9UEli#h5wp zG6aSLk8-Bq=cB-U4PA`;=)qn#!H{`EU)%mxYqM#{MHm?j+Vvux<4#+i0qxnkuo^H} zkAUGqvvxc|?Z?V&<7Kos2sFYCc#ROy5*kI4v9|z_ZbH^xEuLsO7>RWDC;{bvK={{?)GyK=f{{KAuB#EhCZ7FR2O|t?SNlGv? zywb4kG@YC;pUVz;KDA#&P31XyfVp;z_hJCP1{^E<9alDpI|;4osEW+R%fYf&a_CU` z`=G;h@qGJx)1sSgkHn;GjkvG9B<^24f;si;j1?(QpcsHoZpZ7N^38WnZo1QSiBLxM zd)WVdz(}8_f4|9r%Gc-0gpMPA&yiH(&S{{BSc|&%8vcF<@W z9C(b6X_Iq$mpr6$dhtJXpK@kGBe3`#pXl_{jH9clocudbZoCp`Mwv@;KrWJ5$lbzu zV4iOJFU0#$$Re1MS`O0`fm3fa0=#_|XyQs*ZYTi|rHH{qjj(8c*Q~r}YLI^00%cSd$&+D|Qck zx9FPo#U9bh1SD#ut33|*G+{w47CDG^BLX`|DCbuFY_WbmGW+$XuS+Q0-9UT%oOcC{ z0mj>`9qi0AD1I!)mX{2Khwcvo*7dOe2#ymEpv-|`_YQ?cNC;kT;;G7zw)F7CYCbA0 zQnp16UxeKL9H9rqM#^{k5T(TznI) zb4T-RNlc<+*9xRMMcq0E-=>I&kKDq|6u%r0}Jd|NKK;6AJl|#kQXUP9<*+#0IF0C2L_JWzO;*5aS9)RT1M1F^$O;> zwBP_2eR{EcoDR+DpkNNKUK^^{zDKeQtoLk_>|2$D0>XW|)<3F3I7NJF4}Noi9KzMc zG1<@4B3t#2TW_D^AExFgg;dyMO!F31rfY(#Ogw9A+-GweCKN5JxplPFPD4{|9o1h= zS}VZs>IUI~Qr0)jiYKLWr34nB-76EYUA(UVKS`Gx@L~Q~XO6d;tbfxcC%qT5Y;i{C=k8c6O zbN^OMf{Z6bEC;A>#{mx}0l#=^S(k5T3Sy1Snx`e!?JP5y1orkIADpITs9dV41pl^% zniSW?MBZv#n(ry7e|^DI`0iEyQK+$m^&pcQkXu{Y;yUI7@U9`poV=;&r;W!9JAejR zrvHql^=t@}<^6$%7K2=3F|W=xkn~!e>j5-qIT4zCh(`}-_xQP9s09Q1_D-)13~9YA z@HRxX_7n35A@g$7VIeY8GK-au4Zgnv(OW$WE4TxA%GSd~T*s2fyd};ksP7p6id&bq z^qSL4tf0*t!2OfAO_05>cewKaHC#VY&54gTSqFUvWPLU-PM=-%`LO3^tq#cMjJ=VD z5HuTXI`OUU!Mb;cuD*60E?Ux3sR}P46)tI=L`VCA_!gnS;aG1HtrJmjJImvua{TR2 zz>bCSfWcZv#zO*A-XMDR{h;ysnU4RD&g>9CVEux*fdpjHBKYE38H8zL=4bSgAl@C> z9%Dtn&`;{5J((=?B~4$p|Fyv(*;HOPjm$S5*EQmG6tadP3A-SPmz{E%kg}5RN-n?r zD$^O3M@`u0-(Sl&*5uBu9)kPS)oykPu+m<&CU5o)gRN9{i?J2q2E!l@q1+!{1zhU& z`6gp&AmkThrgtJtI9ae;{<(}~Rto_xG zTKv>^Fj)cU+dpnZV@KxPcQDYGOrNc>&*ObA_(J^??!^i})B{av&}4*2?%ea`a-f^H z={p1zBXru%0yOhB;G3?voKn^ljatdc+KJPQs>N?hL%TcnScK44y(mE+@r^&!reEoi zCm8i4*~~(0U5&((KznmSa&8MykT1wod2&>UFyK)IXtkbx6YB9gN3ZyFYR3sHu%sPF zLlRA8msw12lwxE9?*RJ!4&%M3K|p~s%}aLXjb_x$%*0b2W(Zfe)!M<;D>*~Hwsz~D zpFB+7c*WWLjDq(n3XhiM_=?jFoJ#h#B6|-zX8`g48_&n|h_ZK2DpsUy4Nd!rX-DBb zx8LO(B)>au7=+^QDbbM=;9@#*>I|S%Z*IMkHI@sUBLHl@BXb3mYs4!RcKN?2Q0`;@ z4z-I>V%^(=yX5AmS83u2oOc%&rg{^nxJxLKCRKFrJyKAgY--b0kJkp7!^M#^o$9EO zpgBhEwOAkC5BmK1=e&94XD`8)I&G8uP8qoPjm7k8KS?t%0O~(KAj&Y85?x?OyZMim zi%qRQ!%+6Q8Ga^zp1E!!Cmz{}e`s@y`&)CRc$B30_~4&wU=V$Ok+WSY^5E> zE@Fhufiz<>6LFBNM+dfwJY|)sQ?uDqu-QaD)%YV+k3VS>v{_O9I&;QSmM*7@-tX`< zXqmGdWjOQoCE#8H;>HMAxBjVW2O$APGTqTNa=Uj;bdpTZ{Vp^?FTn4{Rq0+!bncwt zk~$c^?fD)Z{=HE3LIvPIcN8_idgflqF0o3Ui>smRd6>`j5aWH_fxv|iusNoyI~a5dVMyO7F8nkwFc!TIShUAJ)mIq`5RlMKNOaq ze*$pm>n{SdKkH@#6Ft|(nEB1y%RK2i=A|lvG4od=+bo!Pv!_x+S!SUt`6p3(knzJy+* z6IU3^j`m=xf*tT%g*nAHc2@N?%OrPp({=#%P(LyQY6ByM2LgQLqe#x-o@^n7J415n ztl~kbI2OOEr-kB1cxbKPVUKWvxjhQJUY%Ipxeg9XOvPfqcW=&?#cVJzMgjmu6l|#; z+gERBaL;b=$aZ^h=*eSO#H0Yoz|AAGL2+ruQ1!gl1Km1mTIA4ARGzF#BU7CWz z`ni?ow}2`o>kbh=LdUOIV_bcH08|lezwkpomickH$&dC9-I$?>4y_NMS8VMuyf~m@ z(w99#doGJ)80PoJFmuu4#MDVpKr^o<>c1v*!2uf6^QTf~{~|GItp1pl!w_^tlxN?3 zf8`ffp3_9>siBt{V2FwCsUB!32QlDTHw~{-+%t!xM_ix^t~OGMVzN(H1rMbj;i<_R z);@Zs%u}i}#fdr=Gu5!o%Z;F3t&#lv`cmJfN2m71R2_xceQbOrGo;SUjJafTRcC9D zXM({};r@TKs9_C2LA34mm_|Q;Xg&g3)BU-NDm^N>ve$lEXIo70czu!w|j zH#M4W8q{dC=_bCu)I#WJC@Y;UJ}dX$6+UYZg$ho`xVBpXpR}RbJKLh4zcD-0LiKFP zVsnQCt=>Kxq1RB(@S`6-C~c)3Boo$NL|F-1;XCDCY+CPEoR`^bs62{3A(_inSBmt} zxA{hLDJe@z;<0_BqtdAb&qaA^aJ-4FMET~-dj42J4Wx5W6GO3}p<=YcUTay7-eJEZ zwTgwDWrluN@!2;{L~_CU{Aao8$Q5ZuAY%j43olS0h=;NHe8ZQ4~%m;;1Rp#y>c=wii3%C}-PY}JH_AW|K&eY>x z?_^Yb9d|P-c`a#NC&Dq~IUoa6|3v1`ul*Uf-JH$;Dhv4^=U63f+|KHHdamnu zj$^X^K8MMC#}SkthhG)S%V8fSV3_k2?CBl8-9bN_QnBO}BF)TYO728OqUK;A{rMUs z#Qp`@;8h~W`^mgf_-iMN(V4-~UI`%utit-Lf_EXLpmi51nBYI$Y#+I2C%ZiWCF+?U zY0iQb3gyW`)x*E$$(!lN4Cxv$M#-gi{QIVO0uDkMa-Qoq9^Zj7q%& zT6S15k~O@LbdTUs2O49@B4cy)a$clPK`evFd8niTYp`hHNZU?1#j?@Ek;A2l8OE{W) zV&alzVmgnP?1Eq6f9JU%@Jj;$8ql65?VO0`Md?Rvp%d`{<4N0?ovIzD9oWkd%lrty zrR>k$R9$iw2j4M=>HDP_?HC=+e+Q#eQ&St>*w|oDxHZ7{v*&SdM)N6`tC{Knw7YKG|R?8g=Y3-eCVg*b*BlhZpcTOYpPM2|i7 z^$%u;*wXG$+2A}|4*d^Dmpn@wN(GN>p8Hia z0o?JyRMgbV)fBP<5sZ49FGmfD0W0cQ6E`<#<0YT%YUn6*(Q%x2^Q z9oJ*t23cM3C4R}7%QN<&1{-iD%5+oyBQ0ZJsFxjX5$dF(mg+Pxm&P{=XxSz%f8X<- z`Y<0X0c}l~Wm*#sHli~ZDbJWX$bNdPT^khP>x3l-g zwKD>}z9)j06tdMtG?XNgJ_be8oNklN)?*3d3)WR>^z zsu#91QwA)lYx`XVZ-1DScuCozS3TsN%sI+{V`ikcZR1;@Cibfg$?4)=U&ak(VamT~ zXukVXdg!y9e6=c3mwo-+X4TuyT*Zf-Fj}gOVrp1^zbs_{rs87FTwPGj8pj}q;!({< zo+;obdE&#OoznYTvLz9*I=m4@jl8c1PTl%)R{J}&&7k7yQ zivLh;zXLA9TOp%zc| zZmjv*q?-mZrROjKYoSG16nO$W_6!N=3nK^2$(70lh{heBlV_~Or*ywzh2DM?txg?t zGuiNTgbH(QX6hvUpnMIzP$2V@aWvnJr>uABCz$ktgDGlQmHF+&s32nzl2KHq<`SzDhbi{>;vGb*KdkdBhr7s=A1 zA;Z6jRGhBIwoeS1riif-ne`Mq*mMZ^zSkUz3l6%P)|;I#&2KjT;sV68RA+=mK;kqr zpq}b=m=VjuC=ig>@-DCAV5y#Z5dpO~o&n8Mw_c>@-VHuZ)l&E1c=$Q-L<&;klXe*Q zbbZ_8M3PC)ii+%dt)-%r37p}2TE|!^oqcIDo zAeqygig!~F-b#zibY-4HjL;zqa4`*45sfRl z?W5|Ki`2`Qi`?%YYf=qydEN+d=V-sNqOI)9C62sID3hLe3troYx$|#?W<}=GJT_3EEwt-Jma4U`!iwx{a09cZN6n?ClGu} zwgL(x8K4YHG7nP^%0g{qK|7x=P~w{iM3agy_77H{u^8wHZ2@~DCm*pZy>0<4-36MJ z>1Q;qoTxM@XgO(~+1bgmO{~%eLuf2OW#9~G^Pufr(Usf@3QS`_73qM-C!Vl30AuGF z4#2h5krjb*7Hdmyhu!ziC?mt!s9>zG9HtPViFEB*}Lq4}) zT;C6`3sfMPZREG$WDO*=W-`nR{Awxpy_r^6@|^)JSaVSW>-c+`)_zy>xS*|<>yd|e zJlJ|QBV`JxW$1gZvOqfqFCFD1E@{+|9r<^djPog zL4cDZ2bBej)Uo*cwO7E8)qi3#oq9n*az7)S*LI@T_ZCZO^99$G$B!v!oYj>H^7b+z z=XtJizg@9*@^Nw$xl(>q>+)&pn@nKPZpLZ70MS9mvlqp{gKSrcNFBmn+}X;-Xig)i z4`yEXc`ST@@!Lj$WR+wItGLB}w#e3t*A9TYQh!vYAdgbg%xebY^f-)bp*^{t`&B@S zMAD;Cv5GTSxXDi1Bo`h+8SXMEKYQ?GsOE((HwPN$i^{$)lo@EgE6G#bZKDMfHGXhs z2P0F*bhw8akhU*}h0sm}<(&tLQC+<87EGI!8MmX@ghQS*P4c+PLASoXduwMM=+^c- zx8C62xwZJF({y{XgNsX>Pi*<9oY(x7O7Eq}1HtV;yZAb_k&#j7?5tzqT$z{6q|Iwd zmTm(i1*u4ETHay2$+xpH>K4#3CR5Ak_PXz@6FBKaXDb!FT(olX7!|`erMtJbG>Z`{ z2y^OXq&EG=hYrJ;D9`xpMI~uNhicd(h2b zqk|6s&h{sj&w+-;kH80}{UUV&X%VqwY?|;B>f8e)rabHTjD>OmqCGP` zV!4Qs8{GT!W$;1neEew4*9MK1$LZ3Hbiko~MMG15ioqr5VQ+zEm)Fo?QqjYGN*nz& z44_YP%n9&;(R!A;G+`iQ(4(fdU()gpzJgil`!q4LF?CRbDhN;(jjE$u@CeJDXL3A$vd6q z(jYQ+TRcg;!bBjYaFy@lDDdSEQ&PrLzg`gey6NdK5SjQfNNNQD?Z+u!g9*?FA9S=J z*mT$|a}Rfz_%V+zgJ|hdaIhxT*Y)^Y+ZE?rnzToi5`C8MBcD)w1**UT-~)R*^uf%> z!bXqm&s0Bj-H_zjb6L5TcXu`{6H3Q3z;wv}&zg?OPDoWN1NdjMpv?ka!b@C{2ug(m zH$U4eMvs8bR+01r9U78K?t3giL)lw#wMJX5Ykk&8;hK#x4}fn=nv=Ufe$&llvfX|T zypP^<-U|b2AbtnDLa!|fH}TwiPakM^F3+g9)KOw82#vX+xxmPa(QbeUKVNhW zlRH{j!@-co5LRQbP)`uZ!tPF?|q_@5q4^xVo_10>P0~=pn zkIZuIo-SPg8QO4@?y*)~L-NEXV7%%C+M~}7yL1DA=(OpR4<2!Xjuczg-(CW*2pLt5^0+O3N(3UT&e&Vck&1>1^;HB;_}^ShxSqF^R$$}RIX4R$H%Xwb^}_0=)8-ssOO09^r5YS zc&>E=5smf!eWXFNG9b4o3bjJ3GZiWFTXaYIC-U^LBa-;>;>fy!4!I{NV59?(_3jwy zu!33@^qez*DdTBoX~{wAA*Ip>-twE4!@Trb8c{eH4e9J<0$sh+3gc`YM-}t&pn_kV z14vEH0D&A++0h5gp^}j5T<0XHTbXkeq>r##Lm8(-&6#Evz0v-%Kp&%PiA-9ecfyTM zW~D`Hi1>Yt=!9?g!VlfghjbukoPY%7vQZDDGB=8zOzq<$jdIb2WuP~6&>CAgIKX#u z_G{L(5NRCS11jrPTa4?%;ParhmcL*2(cpqHGK3W`Yoj8G*t8HPJmmo0#>IZMqg8l_x3 zod|7qIC(#(ZuS)&MZ$y)cPzQ*40!@AKfG|;TN910JR4?l`LYYAp$3W_AMzbl{%P!?WkV#ELgouAHc1EeHO(Ysz>kt ztu9pl{Rk14rKaFmzFt7yEXX9Pe%SQpu3B(`YsOpLQ3uj?iZScP)7GR(Yq}s3P!@xi z_aeyzWMlvekOZs4pz*l0&1 z5@7BtKtN2VVhs&7$*4=zC!BQm-IlIdc@l_ftIHrCcL>z46)-Vi*G^dK;<*#)<9j+*i4G4)0zu`fB%LhzYb}_-JF8#SFq;@iLn8w; zAd{;GGLf8$ad@DL8MJZKie#ceqRS4GpWvxWG$6F0pf{~+GQ@fx%cal6!n@^&%XRQT zcSi+9GT|iWO8Dpiq>>UARW%XCH03n8^kK6Sy;W%=Q-YQishoc|NGz>6UzgnnO0nt& zjR|QFiBPZZ(-(r5k_16&>EbnaD))AkXC_lPQGJWoQYD0jddJNB2*P$aPqMNkl6N200KO@~6lgEW~H3|p}M9`Fi~@u^RZ}Ag&-wEMBS`gl)uF$=vgM4 z+X2_E27E5Ak%Y}Q46)7TTC6SJ*q%gVO~P5YlU~XuwG>!S+YI&?TPH`#W3Qx9J%Bo= zA0@}zA^Kh_~zgy7LS^6n#6pIN52XP zl!-O}yh12jn-rmF-}i&fdEg^ap;w49x{>w`8Z^qaI)6J> z1(0K9d}w-Y4ppwcmy(7$peS~lvDBEUHb`o7`FImJw`Fv4!Lc28@^9D59CEF4LU5a& zlHI4kM^X&HhfU#R{PJK5*L3p&TOkz{gGtKYeqs>hCl)Xv0EOcXU_G9&L=Yxn*k_N4<9ul@asQ?O72^X2h1r?mGppar%Tbqu|+!KlRjv^6%vGKQyf6%Y#YK zHw&O|&j0!*+qT~~o3QlZO7G(ZV}Tcm2;*e_g?}oCKqrq|LOVe zELT@;U>WRr)_qe8Z_fi?{18G40sZtpd~s$vActNnxjPA#iDh+Dz#Toe(Z9h6-0*)y z2RhKcP1y&%D{zoqM(7gjf~3BFw;xvn!~PEk`Oky@8Sy`+@>^K?XL0`7RsQVb|C$W? z&m2HSF*WYf?Zu^~H{Vki{zaRcoBO7xr{^A9faNizvb@X|5P@~L_dM=hve2oIf8KMJY&%yOziPzhh5)RCSKa#GzEJtQR^ft2)BtGUwEA%ioU zS_TKKx_o-9@;cRG%cL-C0pOr^<6D{nd9yaQYV2Ie?L@QfOKBbF^1e$xF<$5q3^eq0 z!nusfH@miE`4!w;D7l?xG5i2rkp24wqN%els}>l-z0ha1Ym5=qz178tJS+OZ41qlb z4poi?Ml)$G=85nF)9N4_*W)kgRN#4ha+VK>%&PzO+XZ2?u#O3rFy-Pc7Y8i#M2qQb zPHTQYB(&Llw8vroB^q3?k%0hn8C{UwLXG5@`sWRvHkKX*7YP1-fmW6uA6$<5^)OsB zdMVbrz*8j8I;T$s>CjT^bgWiY^>HKc?7huJt(YjgL)%@EZ zzuG4l{(iv=y)~^7FPcl0m^eO+5ZY?a$_#B(5T@7_bGPrDRf%!V>eb1-wz3eA9}q~J ztxhQEt9Ww9lQ~kc>&?C2E~tBevd5OHa1U&ko+DTh*39sonE5|fkYy84pu$Zr?0^BF2cmvK;iT`Ws)#=gHx2SvYRrF+C&t~Kq_d>f_L=S;=Pyde)!vL5sO#ITEal^~1 zgP9sW%AP=v;!et$(bs_m+0YaE7iDe1rVH9Cy%djF@2vQ5@sJ4`zl6n>{nd4hckYBm z9^B;$^ovfo{A68l<1#7hb-N>O*xRR|wQ3f4Ll>m`JD zB01sF-Y0jqgV~&oof%r-4sCo%fyf^hg0aMctG>$6<3-^*{WqZZ24mSKVw(oWGS5BR z6MFObv2U}UJ7X!kJC;P=@(242@dbh+)6Go61Na2Tz&Vfi(h z%|-LBz7zh~v)LQ^2FxN_YH5G~{h|}j&f18Pe@S&`N%t797);t>%mywTd?GO#`KGyXF4~MFy=&ezAlgLhM%A1(4)baKx$bQgPNbo*XD$m^Bg!MZx8RY4FG16l zmOg9I8fMiV&1+G-Bnj?2a|g}>4Sb1jUwh_Q&dxcpB@S&|kbRe4GfTT+`5UTVV{{h516*u>lf46KVXx}LzI-^Ns=1H

aHDI zU`V}O^e7;?N>C{W+nYMj`#(5ADpN$v(1Ps~b~3P!d#Xp!)xDM%>sSgNDs~zE2fKAx zg*CpSFCBt9s#l)C&!NsK%1;AX;PK9~nzcNa`?qTdQ>y?*;I5vMEKrAP4!fWPt&44= z@HY)4RNZVDu+lICTH_q|KToKztn^AZ&^gb`5wQH>vg3!2MBC)CX*|fs&gha?b-SQ! zY^#>ENXYhXKXW*%h2wD#IWr@9e149=&z_ zLq`(7^vN&xMVxhC4XW-SRE8jzk-o|~%jy1N1Jo-fECNKtOmB$KtHpW>RQ_(Pz7112 z1JyRqpvhb42#}QI89P$obGhYy$`J05^w3)qOuC2%sL{^Ig>hz0-W};w5hOaxX%U-( zh-$LfPba$okoI9UTuuH&^+tn;4ye-2>{L_4KD(To3Va%G##<7?OnDf#a2kOtAkp)E zy`>UoneXg)oE}T3w%uveQZKp&J3)L>wsimA3>vd}cTSc=L8W zio6lk1$qO;FZ%UWWQZx6;`B3sr#Ryzu_Z*5u; z|K3K%GgEFj`-iLJHiH|;K^@G+UYiA=_HmgttovvPYlcLJyaYr&s#Cy$)=l1Dd5$1T z3FqlENdzSM{B|Rp*mx~F0ImSK73o0Tc32Bd)B{Te_5STh-T-s&lG5_^_}Zxadj(zM zXJGh;>#`TTAB7sn4ApCtTA~&~x|7VlSBi`kAwORP^-7sUudAGb3fnWfx=rlvpGD8e zf)sRERQlwoF6n@qVn7ur)8nkUrhq;aqoltIQvDKvQxZrv#a=vX&g+~^0ecRv`-sS6{F!Jq>r~8%Q2u$0GdoMpm7YVBQ zy3*sVD#BScW{ND`P*sCHu-T5ZHS6;mi%T?!Lae5R9m968 z)+~pNYNOx*xai**>uG7A9%+R+iC#M^!Hdl67EnhAQa4ec!6i~*9^w}wS2V9q`wOa~% z2a}R}%FySt=>cLRFFlO~w*Knlqh<(Ohw-3}Jy}FA zRYcJY=#S+n3up;&=4hqfc#H?c%m}*xBV}2Vn(MM5R$@hCZZBtQ^JJlkDL+g*BAr2I_c zumRK|Dl}>-kBld(!Z>v%DL(^Taoz*yoxg$fidD2Y1t+7XA&Gh&s6H?(s${#RfY`G9 ztd=-s0IrW(oh&QF>LT1{fsR0pq+(Du4)Avrsyt)J_qO5Wb$Hzx&J#GiVh1z9@&GN) zwgKv+IO!@Fgf=9tU^yrOccyna`Fg*9b-=XYDW&N$4(rv|tcUQ9B%N~JAdLm-!Je#^ zN=wUhlDru@UFOcPFF@DjZy(H*nr4|HRO-Cyc724K*zhmvR%B@gCq~m&UQcZL;(alI zbRAQ1h>+ZUdH?M)#3W`lR_ReZ=2i=4D+ax97D8RY%i4$Cy^3HK47y7ImHdUHziTy4R#0BG|n-n?K0k;a=sN>=!iJ)mq++^0)%g})vIAXOPL9;_wex=^# z=vr~6g3AULCm+*7Pn2i(1u6{^0a~I#_^YIa8)XF&L24ZU&6BR5K(d4y%*o;gVe3mi zL}#2k=ZWd4-l?q>pdVP|d^T~%oG-%uY0ghZyQhXguAW#N3l=!=XV;*aZXGI{&Dr7X zJf0P5D2lOqwsK$u%hKrFsDKbS2Af7A5KnDyBs`A znk1NCZ1c*`#>PIPKo~tMh&GVe z;Pzti*?C6C!0B%1hgb1A?QokumE1=Kf(07Ux3*C-(eY^Ncw-kC`E<(R;bv3^VW)a=-hgEai~k7eNF+-zqpZF?JsG(Zq|D=EzXh4lZr z!0lg0`A@L+Cs_L}bM_~-_9sjG|NSiO@OyWAGjnqZFI^u2DnP$+@boO{o*cGhRVq81 z{a*ql3Oyk50ZsWX2c*CW=k<*pa6tAd9ajQ`)PM41X#vTB`}r%t3L`te z{?M_*I{pWp_RoX=8Sy`+@*9c$&*B8z&Hs}U|7TbEvycBdfc~`*<x%n3R~+4~t`w73jo z_Y!U?F|YUqcF*u@VpJ`-iH`aHBKwZ($*w%mX}^1x?;QNU{#T288NGT`eJ%&#D@_6Z OQ@^ZpDgWZNd;b?C)@Qc> literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed-API.png b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed-API.png new file mode 100644 index 0000000000000000000000000000000000000000..688c7c2e1bf9d75f570cddf3a92fe9d4b8ee0072 GIT binary patch literal 49935 zcmeFa2Q=K>_b-fy5Gl$Ngb*Q!sDsgaA7ylgB+86l2BVD8r4l20Nz_EN5F$-reLWsAHSoK;i<<-Zq2+*a^MtziVC}rX4>f0;r-zH5 z2k0gxBP=Q`E+YXKmXi7V8_?zd`MHUmqaDuWKTHGB>F59>S2(~oTa?uL#(G7(AVi68Vw7svhB*Gnhq2cO|Qd0$@(bTj;;I-BK zd{oS(@cyDMs_t$GLjw&fcQ1l2)?Hf_W3R7;fV+C=I;c3PyCOARePuk+I`(2%O;=S_ zReu!|BMV&@M=-ONrB{HNor9(w&?-#{INr_A6RRTXZ|`7%v(m>)E(^#^K-@` zKtC@}4PAn$3_{%l=dEEW?x1C9ZtU%ZMg+n=&GhZ9)KJb61Zf{*Cmk0l@qhs1Kp9Ov z6%zv;ZG@4Xs+TF=)zit;4UI9kx72XQXn^t12sf;!pQSUw9_J}x4@2M)-X>ah2#l10 zr>B=U#=ue1#m&rDUs6rgGC*I{O40%Et7?X~kjCigdTY4ZJ4hof9CXyAO;P$-3nbnO zrlw`-q5&jlqVE-G;%s1IVyKSx2JEm?LFs6_nBh#V#Qoh>?Q{cB(nfGG2bi&+nyM&4 zN?XU$LEjN>V5cdns$r>#burOL8hRKwd&BJ2-5k`td?1OLsvw*!;C9}cs_ri8nr?v@ zNgXG=F~LyV5DnBs)zQ-4QN~2a%|c(-)k4xUz|-7UU0UB4FQcRGs-tR#Hu4}4ER4LJ zB!C_}nmB<04bU#0R(`IcR$|@~UPfXnh6HUDaVH~h8Fg_tf)3gZV+tCXi)wD&GEu9TC z0}Tx%5k|i1`eM2cNMn@%7~IXt%1{dEv?|)jz{CrwZ-sXBbT-5~N@H<2Z+nCx%-qYt z5FTI$GnO*&c2#jvF>*Aug87@v=(xLxTIidaOFB6E_<4#06QU~V=HTS#X^#^#f*I*s zX<|?+7TPW@`Xl#d<(?d5{O~~FPT`;w)p|iQSlbuF@iiV!Cqmctb$61@8q8BLP?5uBW zu7j~exm&t>nWMziumnkQ11mjkFDY|`q_3#I3>d-{M0qPnExGxfzSyiNkI$*A-ql^*8513Rn~e zDZ4=Mt13!E+bmE_R8zy)O2PszuA`>v?J7eM^U#&{GBx$WU>(I=)!~q-GxM?tG(~s^ zXov?I*c&0?z^ZBnVx$SaT7ee+7-KIzaZe*lXhb9yDP!g=?J5@FW}szhf++y13$E`jIRSQH=1aDoH5$c!$Mq77v|_7~z)A}2H)SS+`xe?_NwACO zO0Ctj5jP6gB=JR3Bh>c`nDgw9=ZR_F7k^B5;l)MOo@yzvWW!4)e$!_8?e_kA1G_c* zqb_nkXMOsY<=x&4R4LWZ1eRHEmpDD$-V0uMmG!E=epP<^WFoKrgYgYzG77qIGD=Re zh;Yi=ckT@T`sLifF?F26gpq}n701oZof83lOHK_MX42G5 zbECCJ9OX2IPUSScN{5YeLMd1zuUh4igBCy+uFOQi!esd@oh?aLoKJ>E?Xc%{ z#s(JJdr7A*9IlhD;aLuqF5&t=J_$c1Le~ycB-;j z#72eftRbJIFR$(&ChGyA!=`$q{^)=qMdismLu1UB(<`49G5%Wy87f8$-Bz1l{9w_g zN%bk}WM(VFAzSDY$w(-@s+E(6;<=QhjD3G$edAV}qp)r86(% z$^Fo3PS5`cwDBU)w?yHPKU#B~C+@3Pi$dtb=l5yTWnuqTohBGtJfz1t>VuDZ*ehp# z{y&g?-@n^Q$;y6_iKk)YeG|pV=U*4L86(R$D|u)KIEZmD{>SI`U%EYXP6 zx<4wQNn?v*Iiu+P<&!1)+lga`oGy$5jKB3Lf#HurOOborZp!fKoSLuO#;)JP*KkWe z=rvFp_NZO$@10v;`|62j!@hY~y}!3z+Z;BLY%xUmnfX)ltGoDu8%a`rG7U47i65Cl z%1k7Am(@?CTp8j`ckj7eihQeHrF|t+LnjgY_tuTn278d}YSkYTf#S*Ocor}ouQjx@ z{BgnYflGc)g5Cp(R-u~T@8%!g;W&;Z4*P%gz>bEj`&n2M917Axh%ne_R`62mZT+b8 z9)9LrYUsbm;tPj4)>5>b|D#&@lbwp&vy(}m1Ncaj_nkQKzuz9KjuxqVBLnAg>~ToF z)}Qe*aExvASLvG{cPGCDEz}O|u7~a8G2yLYVL#^|FH?7$)SPzJwJTEr4xK$p=zcS8>_J9j60jb!pKovTIJe1$$fsa z#lERIizR68)xd*L;Wyu|PmYf6@2yue8pwCoP6&BM8D6lfB3e4xaXn`K+upncwyw7{ z?)ipr&2Lo)diqlb+R(_w8N27V+bAZ;5w_!9(ZUt|rh2~WgHYvo0=AhQ?<>}i;LH5P zqH>HQAgB6gR?rXyt>8BxBB}M+7ayw<4HOAiF?vXykj)P^*u91A(fv@&bciG1zCYlwwpvkyXC3)`AGSx>l)10 z#!o5j{GN~pfC5couv=ep21^m!@~Zhu;THHCd7~8ALYj;AGnp~yTP)Na&r>+ zJ~InADJ@M6cU@PperH02Em5ca;Ubb41@rHK4@eZec)ZJ8_xtGj9i^RzmDYNqGBj&b z24Pj3Hn6u;vFJ9JC*1d>A5~&YV7#PHB`-Rs9kU3Nla!x-M2pN@2TtWpv0`vr`g)?U zJacQpL@Oq;5-v)*n6MPfWtD4p;|04chpAXT~7u1hm0T z!2w%>i%=_IUS`hhD(^Xez>jfmx|z@mvD;B^x$|R!$Bono8O9v&zkrrFwto0MAuc_* zx?aB@QUx)Ckypv{iSljRY-_##!Bn`XURf{a4Ch zcN#g_w&^)==(#3l8+Sc1nJCE#rxMufPT3iWf-$OHY9)fHDaZRyTTy0CR?9rX*C-2> zt_9Ma1f)cif)l$cK|GM1jV$+Fq9pWD3MG12Wc=o5srt>1N$>i~pIOxerxX^uBN)9C z1-c@&FQd$n@loBYU?bF}!gw9yGjbABKN)Op{#4qR8DwERf+W7Y;#u1#R6YAV=HbQL zUy}eE2x#+Gr@GBaw-E=)jUoJKNQYc&=vHrbmD2v^$3z1_izn>4y*%NZsiIh^{Biz; zi;PTK=R;mz@#%oGeD!2uv$;t)F}E0azt>VA86gR$$wz9unux#Cx{s}z%AfDnI`6^JorF(l z{V?A&lz_j{D%afji2>u9V(I9z_vmp3Wn!NDX8=+C2fTF-MxgRP(WvU+c8h7F5*u75&`;F;cUP$Jv=K*W2BOL=#y=Y})n^!WlO zwLdwdd*(A4%bBc~kQ%?d2q|p-CqAXk)=7tzCF)!jnI*1Z7-9U@Hc&APM!ogJ=7evO z{Fh52ug|*?Tf;tJ?iN3N{h$KI80z;i7fCt5dCH5C4S4EbF-JQ3&CX=Px%x6^jc=qO53 zj~9xw*|+xGAzS^a79|OJjw{ePQ5OG%dXTIz;f5{5G<9yySjx5!zp6vWhpia-kh6h= zW#gbt+C&dUG_lpjE~$RJrJ0I+jYrbA{{hcxf!Wy~*MUdfbr1L*a@LbqUXY90P>_MK ziF7TsBlxrDG40yk_Yg01Ge765lggtYz_PSIk(xgMAuw6k-Z zF5)!#bmJWc4>Wzw9y&hH2095{fRCIvac#%ho$PLE+=0Ogpa+Zk$uUaH5c8Zd2l-sr zR+en~wZO%9-}54ZdWbvRyV2929hgk$^`U z=zQ&4CzX%45y^p!IF%xXWplRpUTneDsYNRQaM3oajgMb{_aOQ|ZuXno7-ztVzFYOyIGUM~+*29Mvq{PH} zHUouUs)UDt%fu^3#IB3k?KhBGzT^gb`CjT~zdKobDszABL8 z2qF}pY(#>uLN`L?ljKAg+&GDznk`(+mrDoIhDsW*`j)5RF^fgwY_e`030u8SPIyE2 zS7$9CcXpBGr-Ni^BIIO;Qf%0LN6Q!!$dJ<+NHM--O<7oPz43+xT0JXZf$QT-+;oy; z4!_isAU(h_ehZDiLe4g3;`G1T6+nLB+qal`SywMAXRcDVOw@uMQTy8)2B{|;?1)d= zMw*=NWNlqhmmm!o=WW>Ks-Tc06?D4)DuL@x8x)H*9))%{JCL=1O?!po5!*USvO~#{ zt<#F=NlYWcWoKyOJ_Lci5cquz4N>n3u8&3WkBG{j$&wy28bPve(GTC&z#erc8e|T3 zS-Pcs$~Je1qy;1@%K;MS0`7ZuP&EY8kR8g5e4g1l&G}OznO{F6XX-lG1*`9xn;_~x z0e{JaTjOlRGxAGne2<_TTU!0?2Z`TMyk_5J4Wh{ z_B@a~K`P5==<14NJA1ZBUbm-LCp@J5-;;1K7f^4R=DIX7XeSvS100m~)k`_b7H(g7 zmKsq0r;Rddxj;L23u-2hL7h{DFo&+|U? zB;@61HMO)7iA|hz&s1#>(H9gVRUR@xX*>;eZ$hUA1qRAsXY=`TyvvBNl)6)QIpR+$ zcQ5Imkq_+8;~V_N*-+E-@Q4v)8Y1<>R~03{@9gG!hn|egQKVq~d4_}v@neE>$7q~` ze{Yl1`q*}qw^ooc&BF4TICQU!7^g%nByt-laJ7-w1V5p9Z*xzN1mbMS= z-%>SjyPN2FoT9z>e;n&2>znXMc5>EcUcG%Lnu9J(0_9qrtkG|@WG6*543>Gw!l}V5 z^f^5|ke$5+W;t`0LHeS^sS`=_oH;9}Q*DVx51vwc`8eOw4Z*CKiqMlYX@?Wca-45M zr)bU*^8W2pUB{~_V`v$PUeTO6-qv=+Ge)w3*FT{e1Aiqk(*&jzoTZ=P1LT*{(?f>} zwF)4gQe!wIryLs+S*mwP{{2@;Las3y87DQ59?5k&%9U_kmZDw2FM*B@BL5OtSgx&E zA3tj`a6&I%IGD!F_-av47pk!cSLS_grNqb#*QOs%NWMZ&0=^(;+-@dD)D}Ybysixyghp=+45y!n?PumoLgiwwM;xenj%PxpLS;+jvQ zW``x~?s`OC*+8gLlcK?wG%MB*nqO z;SX-Xna%e_?XIUwd!v8O+_`;wsHH{w=S(FX1)RY)6QUJzsYT)B{Xx5CZ>=rsHPxMC z!%43gG40muYi%eD{kl%!?`WTy_@JG46WlvGG@>Gx&!oJBP98lV0P8Tsc>ksKjjc0W zs?n4ZowP()bn<6zrx=YP?#v$|9Z$997o(ZuD4$$xs3|lyPdJ$E3^bcY{FU6Hu^Ed< zY9WR$X%SJ9pgB4=1J2|f>wC9eqJjfJ$JWXWg$ZQKk8~^%$Dxyugo=R2ZD(Z!?NIP= z+aEcc?#L}>F%2LIvHG5^HfTEC-sk`iI$P_%G1zA#Gi4D&tP>nI^{VR5@!=#w1kACV zA!xj$JTmC9$xdG7D!_LaDH4>EDbtwE+H{PeLpPtRA+W6e63#6tD0ufc{X-2Pk)x!v zCY{;%7eFHM$i>vje(v>+CR%L@GX`60Q+@#iYySD7`iF}T<=n+seowUx(e z0FH}_Qo!}28Wno@_j-l`0Vo|nj>yrWXpg?^z{3x@5iFRa{mSz}xcNoeBx2l2x&!{7 z_{+NGFTnqn9i1701ODra{CK4jPO$p}jzbKg`rl?q+FhX8dyiV48qF`R3aHOB&Y>>6geKJl7427*LQ2MRn z>$T5AVYfo*aLH3gw;;j*B|^hFvDI@V)a zI(O*2AS=moYw&J3i3^)d7GtB8W3J#?zw2M|{We?G_Cmc<<&T2w(5kP2Gf&gK0dk1M zuMgv^@ik-Y*qUs<)6af}W0qOUiiLM<2oq=UBZQxo9g<&5Ol~%x^C4D)OZhN=L5A4; zYQ+#P`m24S{-Xhnr^`uMrKoSXs z5~R61wM#^LH^?rF_s1|{sGSATl+#GCNS~oun~+sAsa`$t%3I9VpA`UV5pyY4ekn3N zY;QB&QzL)X$Hk_{spm1G>;v~>7{F62Dnr(X2d)t&k~8BrSTN{1h0XEA7+#pttIp!I z_Fo53O%zZfUDK!6+F!Z4dz59gv0%z(rRpU*1&A=EIcKxY3SRT0_bM-4^X=A{FSglz z60|nxlvy*Xf?TSZ()YwMU-gQBu+<>|Ow2M_IbT?>T?qLo^rBsC{xc@luYP}bVVG8= z=G)#%fszai_Ba+GW<%`Wjr97}5b{?!*)IOkS68_5arM|exgh{*j&p>p7)gC~e^IG+ zN~SSnDKXpEWMp>YCoX2Zn#Ah%Cik9fTZimSNm=4<3wNw<{qCG+`r`S3ZxQ+RFFq<( z%gn8&kM5A>YL+|aqxiC%Lqm5Ko26uifjF^%A$|~kvJHT=`N^yxEWVW|^$osu=Gy#S zfl{vz!qx6R=vi8ujdv1Z!XfzYFo#;jwa*yr2cZgg5`!kdh0?cwFxN|)S$aNuOEs^s zKrl%Bcnv>1@p{maZGBRze(+l8<^+VsyCdBp;B)@IQ=cR7ipa; zL)}BcQnw|VGe;bCM_l;I+XB$M^8l#Are5>+2D4p#zkcKVPEPgKbn)<6r;P4j{C>|r zqod(lLRG&WAtle*>~9SWTRLU-U9F!ft*%m7`}{rzPExNov$*!kWjQ`J*k0^TIUng} z;tKc9#PZ&H{b**ukEnSePlE2k1m|SUH2XRBgWH9&C{W0^hEL`$<&$QUd*_mySQ1C2 zLid)lrEF}=0OB-1o@kIYy-vQ?wjWyc?u+$VjNY7BiTJZLsbiUE2iVO774{cn!z8HM z%ffbNNbPay@hoSucW0g0#x#ic@pa3Y^AKn$2XOY`4ynwy25Cr!rsOh7R0su0pe#c z#1$>LR3%Shvp}}RtY0clvwgGx5YL}kfz$jIAQ}bt-UpiG+-?F;GfW%mQ4vdy-2591 z##P7td6fLl@Av6STbz|O+rta~%+>*Rm>-C_bNC_en6qnnA|WnMq{7Ls|D6jkwgjMd zpN|RyA=_U^{Rgh$GZ}9f-0P3l9Np@#2sGG2EkD8A`X1f@RcM}#9BV3i{sP7N!U9=s zkus_Qkp~ZZ=?(x@@ADfC#~$#V$q&ADENCK(4b#5{%)#YU+gg>TDw$s$Z{}OjQ=9M4 z?{)2NG%I0|%&l6)5}@LhGH-nro0z3Y#NbBd1V&x-bW0Q`Op9tD7=*K2kX}(|xu`yZ zK-{$C7w24(U}7wb5->%(E4?u;T<2j$z@TJLCJi>E#WP-m(C)7wB$h6zv_1Io0i(0Y z9$X(r8h5&}2nBZ}9n;c;&9hzv&z zk)EwiK)@Ayy>F~ZjQynq&H#zqX}=bSd_KZAqg!PUf&xuUS0wVsvx4RaB^ZSs`;W(W)@1{k zcwW5IhxD1t$h;eG7{f&>n91h6O^LbE_+W8b0qw>$g{KvU(cU`9y{$>CD{5CyCkApmk z(Pb&#!~@5etaWjMEs+r^{ScPjcp|}nsXk#0Sm555@dj5gdhHFu@>G*a8S06>-e}G? zOvI9Q5sUtk_LDSifMBdSjt$gKo5xjie`8&kg!Dy_p(v47c&m#8kgX@fL)~hkmGtdP~nNtwB<NQxs}ZwvV->5w z){Y%JiDYl3;e&aOFLp%0UW1^cRP5EZT)*D!NEk0wXI`rH7l}mFghYIefF8$o(t1=Y z_g!>`UYe-gbJ%MTNkmGTd|}0)cYMEJD5x2~cI8oaS};y^`h(5hlD)Y0k25#QiebD1 z(MCMM&7t}2o;BXhptWn1CC_=8Ilcu!w%~DZB%x%rKxwyVdpUbwezP$xgKir-s^ljx zQDw6DC&U83z&`3!LRql-X_<#0;C0vEnAxqg(h=j{)>>Dd&0l}?iruX04|plVWa&ri7(xaWthReZHCQMSrAY-BBc+3MNz! zY_=p-PR4WsUNq7X_==ua33omR#2UA4e|!DKwU}3ukmR42Z0;(N{6J>*+4~0%;(G}R zvCe{|2lA={q$ex|#v;eg2YX>2v`#6>uwRn-5HvkbnJs^hzks$$J#nA0*Q{NO@Yo-0 z2>8XhQs6vlI>`+3-cJ9dGim^sD)fsVtuXVSUgBT+(4yW6GlF&Txj#gx-M$~$5Y3y5>aT|h{P@i%x z+S={utNg9vB;1yE-Tg#HrzNia^E=;;bp(BAe8z~;`SBNKmc-`ienNyWRh=Q3&`jGj zPS5=lgtxs9V_S$FbX$u}+c`HPVra<%3&MgX-o<5gfy;%Dva{IKg>p$1!HO2m>ZVzDrQ#)1zuQ?SbD3D3&aRacBr_tnccaSwVz@^ zJOgWN^c_1Ap$OoWkYC{^_3N`Fw#8-Fy>vaBs-(@pS43cqQeJaj8O&Ce^f9Vg+jZq{4#?CHfph|Dxa z=th4g0lL86F^#OnX+LH4Se=g|%2Vc-1T!{r4dLo=OrigHYQC`VKC@cg*Sq-c$AqJfap%Dr6&&dw~l8AS- z_a6b2>%NUk$OHtC`-YZ=uO1ji;PAS3UT}Tj?o!^qbeec`xsuMA^4AF+shgjwr z6Gd5yK2)P@OVZh+fhk37Ml-wsGJSfw8v>`OH2`G#7ov7Ir`*~jvgGOk%8065P2#}; z$n>Z>&y7b;JgNz|F9XQb3`chYGB(aYV!02^dSR@^@z<3va~(parndaX-Ka+XrBc5W zDqg}Zx+pDsR# z1Ni3!_uCLA7#9yvR?Us5+nQtQIcG_K9dv0orCBpD2N2}PHtgwNE*3#zv0CATGqFMn z&@5f*0Deql^+v0VNnf4nlRWI=um8H!8VCk?otBqT+2AfY#djLfvUlQnT9Cr90$1D3 zl*e7q8Tcf%D$0lW_b10cc2gph{ZGj6_!;0Yaz-2miW#11RY8j+Bafl{%zV&)Hu-O5 z2y!68Twk0amn3`Y)y+aNLYa1Dq|h1C9I!@1mGGd7<7cVgQIk)m(?1l?i-M)l1Q)%3 z&YAq=oVOca!%$Bt-Qu6rW^04+AgMFt5x$gZo>QnR=V&nPkERuHjw;jSvAP#T*(utE z+Wt;>W+I;-c9_z5>A+}Pm;5w)?H7#nQsA+mBGW~O>vTvsSVW&Tf(z1kPTQMg>sW5p z#C!niOPvujWuqjaUiFX=#H0MDECO$l`9!lq&43mrX@m#iEd%L22Ehs(W(pJniLklj z{L!&T5%)Q7nw%t`G>01}P#?5qxzJGiHL~k*(RH$A{aYvcs3KtIPhWa7U{vnDPqx0$ zF!bo}5T*nDw~=cp*6LRz$tSN2Zn?yAVDze0+kRkFjCrZQo2rFZn#Cktq&Q%hCbids zB$tHC6V8TUlM8CERBVZ60v;KSsJI_qc^1^76@`a<4Oh0Le1lKTWA0AT58pI@9r`7= z`7jL;6_-S#D&0qCi#6lsiGpMh9!^g&R2@UD|KKvU=%{Inp$8ocrcZ~B561KuD9#zc z*1w~qhX1hjAGZFZt^XK-e{AbNw)LMQ>mN_x9|!9n2kRfd_5b^IfYWCNL>9N@bYBn^qL@u?E~8y*+WmQggbKTzA832TRtKA)ul)_c)-^$( zx{Ki+YToegYLO56;VlQKe$H`<+34c9_>0FcG*}b9sFsVIGHGDJ*hxQ_x^*)AY!Tuw z3RjwEr;3tqH$ao7aW(9=Bn@4pB~PYA-Feq?9maG!_r7&nfa7CcBkDq)2HD5vtQ1fd zrR`m^b#4<}q9COygDv}UZdwwG<(^}p-H-e657aN@q>#8D?~x;4P0pxlre{%X@v z$Y#1Bm23`RN<);W>}`J0Z+Bq*vALDS_X8#`^4U=rayQ7{gyolBqG>rt?lu$mDma9e zRk-f4GblK18?W5X@a**|%MSw;&%XcAz3UI? z69nJwwxEftV@_+Xyjhl0h;ty5{n;ryViCV41x&Z$i>$qn&FH(^(IWg`0AN!NzFXyv z1_Wde0sEHsURe-ps=|33j6qL_yHe=n4~t;h^ra7)rPr0wqm9h6j>Pf@F}Z z6<@K{m7vPBp+kPT-Fnwh+B%KoL0KQV^M;jz?w3KhA2p^V>`eC&$}Re|ZdqSYY6ah( zfHIU0YKK8|7T3%XRFXIotOSZ=pRlpB`#}|%d^Wgl4dzOa$}&1vyFOAktcR6~ba{7^ z20Q4G>Ic$0(yxT=t`1M8dn&%Kb4*$|Ay@d4{OUp8q#+%!`=Mw88%B&cr0iKa!6dal z_f^0Lq7Q3Hm@8sssY`kaaa{4f+8J+|Mmy#8r_OlA4gFM{a-ws|I z#@paQB1=^n$cMp#imtWkyYCj?-Gud@W`uSiJR*t=3BbTJwWO7GIJ`=ENYKn_GBhXg_97GZzqS8i;T2~wu1wQe2Miush) zEZt4_>$j}^k@39ya~hP)1>bhs96cKnyp(Bl9=<1c)zvgPgA*WVfV@CIG16pqSZGDN z*oQYDV)rEzB&cCQ7LG5J)G-7yn!ZECk~XZ+Q9MJ&xnEBs$X=< z7Q?z4wL$IW>I47hr|UqW;IKvgR-fa?Z79bC6xY6k63^zL^4lvQfiAs(@1Ek;ulzEZ z$+TS9$1ISP<#=9UOsdExw9CNx(zhO zaQFM^FlTHV+ObtXBwFaT^S#^Ip<7e)HyM%6*v@p1*Y~&k%0l~w(v(24D_qKdlgWM9 zZ@>ddoU0fO?fA%yvL(ku2}`7ub0?X{rrQL{d>05GgNDG@Bl6ez3*L=?eNmnb#qY78 z@Y5L`H}*|zl8DS{{k+tXmf<+o8$-re#wJw?;P7|!w(Rd%Xf5-Xn0}; z+KSce7i0&n`oM!MHm_SEU0eB|z0I<)w&b#58TIYe?}&oIdh87ZsZw@kzuh>Et;g;O zjo1|@p(-rjnE}&%oI-Iu_b=}xSxq;L9#NREV}$f=ErP+`j@zdWjn}WeDuYXTZQdWs z$qrc?B#|w{NROYg*rJ15xl;w6zBKm1xj#d&RFkvN25rw(;6Z+1@NzE591EI{Q#<9o zziP7&FXdQ5{RFvneeS#)zI+XhGoAMYE|5it0uNG@^v;x_Ryjuw>@aP;!c?2kL80d@ zT=SUo+bACjJz{b7LfzM4ke!8vN^$Eham*5U9wb{>4}N7y+`JbJr5s8kB=1g_2oQ0E1Zv&GqdBKYi8Dy59I1DhS6n zow3jxU}u& z_EEev{%jxMXwCsgL!sNw@5K7E3J7f1t59hQ4s%OhYgE<>6{vXRgZ!5MI@dQ8AQ|mb z-Kp}hwc^w-GYzp6Pk}HpK-aDAbwyaeXIhPg52d_(7_aqVboAwc%hq3tc0L*Lo6^<# z&S$0V0o@M2Zw3*N(};wes$c1%r13?B3{@w0((YY{**?7*FTp7qaQtc>9KTm4yv_h) zQb=G&@6X!s!3QFgj#_~N4;kP=uIAd*!btSLLywA$fPM$z8oJ*H%bm0ldU;d%9L1|r zwb|^ieY#Kmy6#at1-tTaxn*Bi#;618f22YE0^Fz0f`ZwD#ZFrAzr3z2PXRyZH=rBi z*Of(K0j_3$=6iK8UsD8(DfT=RX9SKcc>~Lgjm8RDL@1@}RX}1zSrqF`j>6GW5I4ht zyWzA}y%mPY{cZO+M$f8fkvZD^iH(A>%-W;%1V!F~br8rik9uKE0TuaU z_OF)J)!p}2TH?_Fk27%|cn9{ya==G9X0gp+`(yLJd+T8BC0`!dP;UT+F7cS*<)(8E z-ag_1V@?+^{Cm$Ib*EitzpAn5$TSG{fl5=q!fa6B@bCP7TXr!41rkdSkn9t17oX-k z_MeX&3%k7nZupnM4S%aO;@`Xb{TE*JV2BqKKq(Kv4RS+qw*U4j5$@MgvciJV2HBs5 z0F5ZjKKIXZ|KaX`tuom2cmYHWDjdj-vYVCl{bZz73G&(%+}y3GoI?5^QF^052>wOR z64B@JDaZCmCSc720MPax*2F^F{Cqmgz6bIsp_&CB=)s$D8*T8O5UK)HHN3fTS}|Zr zq}c2RrwrKgY~+?Vz(YD-74MDoc!6Zv~wMLbV-Q^ zqzLGI2_&IyO0;OXBErp}DKE#um{Ocx)haBvi$h+N54fR3rvqPZ7!#{73C?Tlbtp9- zyzG>>xllRzp!mxU0>E-zDz;O3ss7-+FH6VVlNka>{jZUgd@1m{N>HcJt53%BASJt- z-hT4ZhK9lmvJ;+n$(B2kh7uDUY}`%o&u@oILX-0YfbgEfs=^%b|OUgvNP%pBGbp! zIVr_KYK7zDtjk7gP5!U=e5jo-G}K9FFtA|0qs&JWgXLZ~P|!*gNKl=ZdAbPhU^uIi zz*PhtMIbeFFDsK{C%KdlxV;yd4s=b{p5|)^F18t46tlN+2gxya!g-+;7lNY;f;35? zawHd+`18a|l&193;N6|!pNi|1zzexDx@C_45ygkIawn?pJSu&1l_noY(O%JZG)pCL zHrivxV2!RzIXuLh;GA%PD z{u&N)OWf|(E846zy(Zc<6dWjNAF=_J^Lr;cRyjxSdA#V5oCo*) zv0?P&Cx93Iy70Stbhi_#vk9ayW}vAr6rjH@sz+yAcR!9$g?KKK52c`-1Svb~Cg4fJ z^YykCr%#`*?(Xik-R(9)QK+e@VeRcNx)=2Rijj@H_hx|XlZr@i-_?vKr>ZE%m{&{3 z-<+bDqY)kbBEDRCeK+oOUa*Jp@UfyB!K~XvJ@yU5C-wSIWFz$%FoKeHANK}PgzIge z1d|nuNUb-^H|$KN5?wQX9BoYs_YZm5oQjaVeM=eCrBz%)v0okYI@#xTIm9@I@ox01 zP-D>YoZHr|whE>YQIe{e`o~aL{=zJlPu5vF*`{NKN1w_+Gu?X3swIPc_1$GaD=66Y z7LO>kFW8|oWF2D+ZvvIuK3_bTIP&?ghX)fsYHDE#7TU5UItV^0R~s-k)bXM^%?-7o zIn|&Dl`16U5)cqwbj z>Ot!#wlK--&uux!ioD_UrH&v1bL0K(J^a*wVeP@%AHG4&@IjI*&$lTIJ{ZhYV`a7= z<@$7#%G|_(D6P8Mj_5*zC5@T0WkG}%n4>6eC?5lap6Zepjwn9%n5YkNHiLL6nnM;E zj^Bz%d^_;yGzmrGVwLk1I+{o6^jq|x&9`u(ZyL0ImUy9n2VYjZIc&UCe$i2!1zYP! z!yUJCr4Ix3q3Kk;%li!=$zk;C4LAFt!E)}h{3&A&O8*yS%wAiR!F=+5hIk&MV}3I; z>6xDF8*9u}nQI%WKXt?CS`guzk{(;LcW~woJLMrWS+bF38lCioH!@aMiE~$u1#)Hi zUu3~V{MB}i4rDgpH1d$D3l90(q$9DuQNGmEQzl|F>R-OprVv_E^Kzv)vuthSrC%)fjYuQJY|M5p;`cw=eRgIS<^Xso$SSGWE^6m0^3mgQgfWvurRx3@AU zCHW*92^A@O`RVD=s&&v||6g_R6bgosD9lXfuY>AtPNHk|;>65XVe?0o&9TX;DWM?; zbXfdZ)?Dzb<^m0^AK}W>;2B5(a!80SE!_L3#@ai{kvP_LC zX}Q)nB1E6ekq#6jYVuG)RuAZ~{Ngkx5pUp!)G`t?9_%NaTjb$sT4j+#Gu>-w`;K~YGS;TWYVI92V4w+eH6 zwthbif;Pp+f7RjtdPRr-DMeog_uc=g6#e@O%?2`HI%i(z(W&YF0V%mr+23;_zH)Pm zw>nezIO7t@mOZ|#44$4SY1_bT_bd3(*+ge>8y=IHnmPNm;?#<|{H}=a$hVAi374LW zbBpF|HbO_uij@xx_*2=YP65b}Ms*bT@4cGIRj9L?xnASWU|ZMJ&0gyL=Jqrk`kJPx z$x7+KO2c)a+=*&{@`#a zWbvhnXon6L%C7c4{ODM9*&b{B1!5D68KpBYGme-8uiK~{oN#kLRt-{B8Z41j+; zgsNow<|k5Z`~gy*Cb!%!KKv+Jcsjp=e51oNbj%;T9gv?r=$PKY9=5ZH z9FhACo)7JZ-gCtQq!tG~AP}_F%9kFN_-4bg#Drge`H`fbXja|QDf#Yc=*3sGJM_3A zR5O16iDJH)7TS^B?~~Cy2$gv~w?hF@4h__;!7Juof32D+tFJ4{PBynH8eD0OdcQdB zaO0$;7XS~Vf(EKbCZLySNu25C*KTpIZ)Kr7dilposH(N{i77ey+&{7tgkchc09(^Hg=d<;^N0wk2`c4K;Q{SBw~}&A6K;UCx(RMx zUu84Nrc-f^6;Z#pLQXCO=~_}`)2oiq$dJX2FC^eQg%;|wKNBgfICW7RcDtX&%Im+)qTG-`{AS2XwfH5>gm3u}XVyuGq(G41rSrz8#7h5LA*J$nxz$ z^ukG?m}|WfeEte%4po^?GJ6s9j6;o>)W*TvoCM6hsHt+GPjHwWk-!wIB|a)kcf(#j zq=}Mo8B@Qz=3}6+ngkH*Io9PB=K77M@h!Ss*BV*b`8Q)jD#zHzp(il&{Tp)>!1XO% zi503VKB!(Jwk$w@(pYw8Y+z&3}3dJtv706%(ar3(<(pn|fRyfuO9OIz!+t(iy%^2Jn>^>+~3+~-d z%ydkq?gYz$W2-;FL~f1U9vNbEt;0Iy6-sbigm0g2ROpSN46PX%tO|{h2o1M}G?U*% zr1^L_q=WYUV0Rr19cH@RBg&Zk-F@r}WU-idxmfp&U9_SUQcS!?KAQ%yPipE{ErPTb zbS@Xm?BD{*Iq-N{WgI1{jyby1M@in%;OywRz#O<=r!4G>ZH8;k|R|rp10KT?9|?rB!3>_8R7C!T4Qbps7ihNIofj8r2*WGqqzta|^9# zKAy#5YGR-zH19P5zq>mGJM)aE1H9C)rBlURLRb6zIL61J_vBW5dK6z!4xz(0LBdHm zXV^L|C|)Ge;C@hfd&on>gKhX#qu~Tu8%|!Op$Bmp^i!eqmOg8dHRp#6MBi5lMucB< zv^k@uA$?L}{_V5eDdvp4UCb6Q4xChQG*FYDav29iTf3|#ZY3P-1&$xsP1}mWUciEs zn&&$L(kBp~nsEvO#b)KcJ>pY{(*5+yv~X1BPua?t0(07L%PoaypDCp&ThO_P4m}1Xi*hGt(`!^hS5dIPj{#h!* zjX5hA&%)o-29da3G5Z#qqDq^umw<^(g7?9oXeSUdxDruj<*plt`acqTEf9Y>B3fGY zycF_NKi*T_&iKsew0qrQ#!U)Q(gOI0F^gfg_(S+j4gq~aMYXTr4zBn*o>v>5`Eo8H zX3GQRt3$uU!Ec?JNIMxkrrC0&tt+plO+q9>LAutvhP6=?W$pqG;c^t9raPs+$6@q96SBpiNdZG zWiglspW+-HXTV))e>#*Fa@lKdlbtLd{&><=%<%N%T8m~M`rD#2G%Z$XGGAFhX)PMA zcB1>B;vO^kL+p^K zzH|dGuQ#AQ0#4NA5cgbcb#W3)s@RKvzAU;))OygN3nao4*R_}!Mb<2ns+SSUB11C? zF;~JCqjii=zGjAm8e$QmJOg)Kxl;-UjlIF=JUm!-ijQ~YxP~Z)(l*hw!H|7{kjrB` zPs;LOVsvqe+UnHTTHd&>Dc|ft+oD#TtmxZc0|lY zTCXLh`DC*G4`@_qV+&*0@>9W-_k+)043n%I&!Y2(+evn*h79qVWMr4JZjEf`{16Ft zDIw9aS)Eregs~nTdbkZ``e9|-NG=YKyA-{>nPd@J3|B52REjlLn0k-P5stU-3|YQV zvt#v9=L1)D*IS8~dr~`=Kuh6_*z1Z<*gAE!O(M;nZSbDqP4`zXMGjD&2Te}>G5=D+ zl@@&IJh3Zd72Aw+Ycd^ry_&g&{J zy9eg_NQ&yE-}>`!L(y+T(f>_D(a(BMBRzkXK08L9yq8*ot=afw^O5ew#f!kvOILia zq{x+iSb)L}fF1x|BfpdoqrJ=1uD2*o>(gR z-|n5??wx-v_l}i|OM6go@a%WrcNW`!)@;iuit7?~qGNN&B7g2E=X%C2YKjDEa5?hWBq}gsxsEn+s*iffczMZF)T??t zqB~mx6C~Pn@*EnCr^UH-YEltxR4)=?6mW^}-}Pcrxx&CGrTK_M*!FC4_+-Q0@TV+b z+!xohq`fWk_MU0Omu7DkJ`5!V4o1m8f!}!4%Qp_qmV^af%+O+bng$kK+-c*^i%M*H z+&We_N8?W$*Vb)9!}hP??F(!0Awc4Ffwb>Qu10zJ{4?Nafa&i zhjf;QGH1A{Diq@xz>Tf*@{%lPd8LLBhWz(JexJy1()xWz{!ef%#myrqwh}Lfv3uEf z=idxI<9;L^M#Iar`3=gY6R7O9 zaN;tCym#fkxIyczXQ`7}P(XeWZ|^~1rV)^KNPxS1lWRw1xsr9o4xI>K)hMwxWDoCs zu=$uCBw|r$XG-6H{Fav&l*SO z+J8+wu{Y-w;5E~x24j7|d`;zq7xX2Y_VIAw%RdzZ$-bdb2i<+L-DDDE#5vBKOm^cg)x}Bna+idlTQ?X(KoKRKB`)*>qAE~`tTBu3}U|nCN$-0h!P4?Z9 zSW(qIXqiT*a65QW$q#Z2B??NRRV;UWDuB6;Lg1)(GaZSihx3F%EN`QkXIY_lF z5sI`1bHQYD)Ile%Q5no+fC`&Tn9?q|0;q10H70xQv4qvj#8d@v(sBSfK_Ww(D+RcB z15x=z6mr&oG0x-093%{X1rW+MIaF~G94^+YH^Gi~u!i~o3J_JIoL4dqWxlN`2lP+e z5pG69@qI0smga!ay}QYDZ=t4^Aic{SoL_nA()d`g%;^3(u=}c?wgIPu6QDOqzLc?( zc^7!DS|d>va~zo22Jgh(7#Gk2T@|1D^P&EPB#qS6H-xQt{^+L8FxGA3bI zSn^XcR6fKU5eb{?SEQ#ra_0UQuSYUfclF96Ptw_4cz$=UP4&5p44V%gzeCqUfBeju z?INNMZ@IqE@mYK{uyHk={WxdRDcN=Hy@_pB?!=75q2gg#DtuFC-pDZLxKA<2ZamP!waPdJpfvbGClS2N*q*;nC z`&n_w0>@oG-P=qoPcrnVYvIf;CG!z=qaY{u&R=7=s}Z2?)xYP-M1X1 zD5&8(YL}RfLJHY6bz=jg#eyMyJr0Zr^O(=x7nC>u_^x>a(^Aji=4I;16Wyi_`Z=*= zbB|-?qF)Q3(ef*jUdz3U*i&v6$gZfU!nrDNW*K*gP6M3ve(GqzAsY{4(a-xW;QO+hgAMh^Du>)$lndW8zG z;#a?&@N{IrQo1}FPif6)Ht||&DBWaqL~^6c>f@pVFR$mCzT&534x}cQfB9ktFfqn^ z!@~97Kj*%A`}S^`Z|-?Yx-(47%*+_Td5*dkg~2?GQz_f}j(9Bz;p$`+QWglyF~c>V zF`ObLUTq^Iv_~;eF5}tE2~~3TK!eJa39;p-WvSidl*vq!1!XRV!X+VINn~?|kL0oQ zNz_**C@`0(T{`0+q3#)8S6kLS1q6}#lL0%nkyGL+i+>3Bw5q0XnemmcL?(xDV67=) zg2*TgD0*hCHd!2v9mF}@Zf6cWc?>n@LEV(#q9T>cHDPY*916=#lxW~Q=%;ZD{D z<$hFPlx-Lo1MN2Xd9#<0VE-mZ*8s-0Y;YqT89Aklz?aLOgo2*;66{RFM-ipew_<@- zT0&sU;ypKJ%#C!tfFr5G?M`W9i<@bH%%55Mkbc&W|^?v=yIsJ z3Wa5T*>1G&QFD%U5V^6oGN;?N3Q%@IJ1BzC2TA!i1Bye-qD2B56n+&5@#Rj^9m#r^ zeDPx}RLfHpP};5VB#yVfb3REs5caM-z^ib@x8mU$t3vCT3-2O*p(cdL7Ft^02m#$Y z0K_=lb@dIcxusr0UU%}AK+Y=IRdMX zv_PCR$2jycIjUPGV+ZA?`;ar#$GRc%aB$-b9D)T3Z^S_^R=1U={njQ zvgd2F=l!$h{d4>J`fT1ZtU-xsi9Wz+(Ac}aGlV|iy)zv0Z`-}b3RN()zt0tq$eCB) zV^9+#Z}(=Kw)NmQanUytW=O5Dp;#KVgtqTA}x*>i$z!PFO zUX9l9O~Bekx}7rD*eouWU9)>1Bi&~_;ifwewH<`d(N=PLkx|f-Cbd$GD;zX%_%TFt zwJfP6JBXvPaZP+=K^ixQI4yG^PN>{W?Q8I*=}LC0^8{r&xG&A4{Qb^e)qOh4nK@7i z!*;o>7b-aPK{0R)D&R_db{~pqXp&v435ic6d zzC*DU8)9ni{6PHj5nxSXlpWt2S=vGck_(B$j@;WQw4lsn5|MPzj(vfZOrVvx(d2!O zyQ%zRd^>O{n@`CO{ZV6a5Xsvj!jJV{f%)swCiXLp2^-`+Up&7wzi|Od7O06U2J{Ls zQe7k{3l4-B;`?-2AK_NmEF7{KLm-~Uwz9lj5f+wH(cbPHSS>sf(o4mtpg#+BBjlDL za62P7B#!Yl)J0C$2tcTr^g9;_UEeYft+rb(FS#@jG(J`6En{3*XHbC*a|jcnOQSTW zQzY|t+6XJ+-tA^+Uz^|G@s0`DM!Gp-8?M;X|KKXkck<o2xh+g9H5Fakm08cO+#LcG$>AZVj>lLf%~=ttS?gFf8}3h^pDJHSdwr@{dLzG-N0<9St{0@5Sd z^SLcoDY3~ti5uJRu!RDnLgRAN!$O3o`A82-3hizVa{Fg^X_x{(OkuX5r+M{@JEbP& z%U;bH=D?PZ0}HQ$chqotdF6Q(wn>5j#RdY@qZfqjlgZ~O5e}<;e^)` zE~ukQdcNU%&Ga<`PY00H@<4=xS=#mrjKzF|PqX1u9s||@GK!|3pN=#2?}3cMOE~}5 zK?}m;o{*7|yqER4}jt5wP0A;X#hD|F+WhozFu9k^^JTKCE zJYZzxFFl*|f_Un5zYw4L4zFB3cFKYEr_fk}(@nR(8=%NWK3*tu>Jx`gZ?gpAq71-A z6^r1djIPjgYdlAK)I|;++`AL!S-EA)mfKJrMeI9p(Usi&I&dCJ)IblyX(~p76uzXR zc~><(-3(`=>dZo*Q;bht-!ApTmX8KXkd%igm)yxadUk|CK<75MYUFL#>ETpUjELq>slPNSBu zP~+WR=}U9W{Zj$N{NI5GJ?)nsx8U7~<-pS!;RVuK8F*uz5-VY?h{v|5-Y-)Iwr2NJ z$X%>QLhklWwG&q1ycV^*ok)LI!#Jkz6zi?2kN4`Bh@A51CJniQHAF z-*kIndc+T;7w)Q(Z;9cj4XplI=XaN;Ar?^2B(D_+q zHU>zW5Si^pv?03hgB_=&d#G>rEJ$Lr9|zV&ufT4XkLaU~@ZYcTUWE&rKuX}5X_Y!^ zcN?+!=8YE@tJ)#c3BwcD;az_>Bd9d>nBWnq5lEcv$H3DZPeakOPG+%%`0eMp;BIlo zA1HSYOr;MeBS-38gVEwVn*|M{;PXwTrKH<`ro3|ur2YgR;x9udcf>8= z9*ln9r&#U_YTBWw=-yM``X$VOJACl_IgohHF9V5uT4klORE-p*o*r({DhoEEc9E;& zR%fT2$2}->#lQRU0PYEAHz@Kv`Uxo$if(#%}~wt|_TT!{C7n1{hEv>25w$>pfR?%kBF0bNg9H zSBf$bQE^YJKnrixk@z6sth>cm&85|YK=LIc_xMRDZgsy9%74uN-(k6vLrX`4Nt=_n z5jIElFiCNRXUa73CYgfuS)@8r99-uQ2R%R&dK)T&_AAe;jp>H9^15dEjU5)Py0jg1 zUb+wK+fF~a&pwE&>I5^AGL6?6>L~4T3d)Ppmm2KJY_D z7B0FVykMc@3XkLVs{l0e#o9@Hc@^z#;c;!Rkz;16Z^^lw%2 zb!H7q$t@(NNzzf%JtUbf9EgANBGvn%6A*VT;X>^s(32?eAAX@s}{~c!$VWxN7huAo$&=;bwaYraH9?(sSsDQ&X zVd2w%$`Jn{LrHDM?_y=$0-5}dZoVDL_|rJnWWFT9zS8xh$$)q*b?I8C4al^Hyzh@G zBKwDW&N+oAl1-zT9tADacV>(7`ad-qyg2B9TYS~L@(L&8lT+Y07OQJB@W8G6=!G$N z=Fv|X$6dsy>pb$bJu;?-XW8D3TrSahKd8jH8L2BrQn5)U&Ib8)(vKI#(iuz|iXAyF zYjdO*zw&7F#P)FB7Lk#Wv2kLn9udlSI8`#X3q;uP(^!4qg-!p#AHg_5H)!a!KUb znzR_<*4;!Lvyp{09Q<_+7esgjO-M_u92&Eef}h3y`sa(>r%f732Wk*CsyphW+Lo10 zc&?FK_oby?VD6(1F{chJK@|_PT~dRzMxAJ)vU2<2=cd2;IYP=+j>J=Kjnhn1+k}kE zGV#yk8~AmRBhH157ss@X{U!v_^p+QbB#Xlr=Qg(Q^stmyg`4#U?`v8r;unM9nR#vADK9* zbg(+ENO_McvNCKd9Ctd!W>sP`wyYU!9Ap6MFgApd5@0U0QOw)^XE=(4f2tdWKax=jas*G8I^kUGD=G0;_FpX(_8p6WZST&7Z+#qN~kq_!i^bDAFSS* zYm()J6@44L=>>FXtG&s7EZ>nwnBpw56mQE|&X|H;T7{h&3o`Ay#~#SMN86gj`kJK% z4k1gMZNBQ^{bKC_y`dprinUZkTLeyDneFa_-MO%$Ihmwj(u(+MGVwX26;a8H^6ay3 zk%DtHXR?W5Hzy6e9H4u}D&1XY#V(@lac+xSZGcx2VwxQ!N@{FuViR+c9a|jM=WcBL z%UW!$u(ty2zJB&Mb+pR|jJ zYZPYMH@w?u`HRoZLx1@vH^*6T?Co%0Sb@#iyf%y*IWL^vL~|7WhZ#XI!Zsl;<>KY0Mkx7vZN8GJln#}h^+kq% zcL=_v1>5Okm6D86iwIpxoD!Y=*ySTte3-k)!g)4wRJYP;dRbQH!nLVo*=S$v@PaG9 z_m0KAKNv1`=hn2oGZQ?U-;C$$D;g`#&H@h#!om1!$4Hgba`r*YGY0JV_EHdyQrWw< z>P)QAb3bDG@~ZjWW63Xv!B}w*XL$GnGEkhy^@|8^rB9-=oVnIPvji13qp~6U>+Mea zGC9_(<>Y;k18}p#+Ct+Sxw$T`CKmLn3*2hmd$*8Sz}df(vI=Rf`&EeoeMPQV6K4_p z^z_Ue|4KdDUH^$K!1rd0Ouk2D*<88(E>egFd@ybt5fbDY=~pMT zKUE6gPtjb36olO7tIG?0;IdC0j}C{zyw?>^fH~_LYv2l0ImV!Dn(2}E=2{^%kNt`J z)X7lBPZ^DBOqc%jv{PKWkuB_;?9CsGlgnM5;c(#570f<4J%^PVxWptMJc{}-DuNqZ zh45Ab+5i-IbqBessx-8#y;~h>*qBg3VVg7g5Y(%qu$h@kgV5mOPWN)Mk|tevIwbDa zJq5he8(PWRkU%(l@oXK+=-YSM{-)u4*N8k*u)^y6sArA2-tv<1jnCXruTlX6HO`N` z1Xn{PWb`#*%Y`DYe&C`}C|+o=&)lTKvG~ES(y7f@mv$Jtw$$tQEpxhi0_)rkMdi~t zxR#&;J>wDNq8l$;TeXhO-$Y8~N~F%o@otApW@P-P)zF?TQrNU7Z9I~p5UZ9SLn{kYGk4ak+aSqHHLn=m;qhNw;Is0h! zq2@|n=3_8lVp$F!ZuJ`(S&W=H)ChiLu%z~iy0NC_C)_puBIcc!d3b9mGHlV6W$j;G zfCRbP9+iC9rZME*gB-? pY~?&&u_;MAzF<}N;Y?@jhR-_v>C()i0c)r>7dSpDdQzerhDFE{MKo#A+E^03EMhlqWNd3}Bno}AdJ>m1%7`m{-W%;2!fGh2a4PyM2>O?dotFo7 zSua*I&F8OGajXQyH5)9I)%58upF6dDyzQeh2OEMaIKB5*IJHZmFW;sm%|?aMvsiT1 z-zNvMO`9!$5+u~HB3}eydLX4KSa#~|D9y}3N^L2SjLw^+d5ciUpE$4d!2cG$Za z$Nd=voEOp2t?isXalLQhm5DQ4pp`ivu-1O4JhQd2GpqZ`q@ThTRH~f6 zZ@$}v@EQ-!!OT%*o|@I0%lq_M1FQQQtsq@%>BH&Uo+uod4w=U=U`GQ~zsGEp8oFl)lsD>|GSH;^I=2%-8>lb~Mm{R_&r zW#62FbX;#5N456eG|Y~ z2Vq%F!M2QJaN(76NW@i2u$b^$mnd#F?#VM3%R0O@t)I7`pOY8cWc$5P6F(7pua};& zY{0gL%{imAT^{R-T~_xc%%dddi?{%SvVey4&;uu|zy;QaY~WOGNqN(spC!i}FcPw& zQ|Gb@-Zs{L`y+vIDoa2`tk}g*ad+ki{2cZ(PS@x;+?8l?!cSPH9byhp*zpqi*-Ht^ zas&3=fu8-&p(W!^S*izm)rkI?9}lb!zt>z9G%1#E|a3`*2HIZ z1ZAVPReFx*0bzBOm1p{K(U}eW_G!AE(}G-S-#a*r^+sR1#EU4yvWL;jEjI+Clme|5f@q9NGA*gzTfa0#=7Sn}}-? zL~9*^;zzDS@*QdNI($u^|^17p{?G9cP4V9I1-l zn6X%wc3>tq!u?4xl9(k!Mh69ZT5X5aOu*5cH0RZVt)4#N_M?ck0<=1{zt!q?{UMQN zD(I^Z4$N3nf(ZUvq;)L+eO%{ZXL%%HzVi4Sg{!I^(L7%t+ojj&99QXcr^xOZ3 zBELmM6w{3a{I~6Rq*&LMxeWcGv6V<0;-ZQ%dL&034oA`z1%GRwpilohYM<}dF^5-5 z?!lAh7aAJcInU_RE@(3?em*6yVUmt5sC%sJxfQ|th^iS@mtMM80?j`NRP z+!M*Xwj_o)Y-?DAzimrn(s<+LmYUYrM=*dbxSn^Jb#4UUyK@_H$(ZCW+?QVsHomdPG+AGBY^=iD%1$rosh66^=fR$ zz>g!z(;NFJmJAS}06`uW5PY38p8E@N!PSSZ^6S^H&m#pK5Yi1{U40;)^AKk^h4&hG zNSBAnbN3xgL`N~C_u6`{$d zuZhTiY#K)=OjQ>f_P@`A;+@sZm4NSCNZm_LPaA6Rd& z37SYM@+KKVpl4x{RUfI1$G&p2jF5Y^nrKi;x-UU8a$bt^0B&(_wLD51Tu~K3d69xY z*CYZ>ipXX7x&bZrN=S|dLB#34a=~mp&Z$KL<{kBF-~5f7atf9_l*>cEKDYs3Df2A- z0nrZ)yu6_a?T3@!bRcH*@;7}c^iM?&nC;lJ^DlOiHUPp(PjBPAuK^n!Cmy{%yAL}6 z@5ilbwBBF~G`Zq+`cxt4lUGz5D@mKasNz+j$H5SuMA~Xj2*Y(F^LB?83mLVy*9VV; zAW9+q{=MidIL%O#4c9e`7`|Yy8M-kBqkn!-Mq#hd9||H6IP6Q$^G_QvgY;jp@2u2$ z)(6jn&9|=I0YM+A!3JouJ3hP#2l2O^O}T*I29&Ej%(hjz+LDj7(U{2-vFwVRaiFxy z+a5%4Ttqei98`^bx!!;onsk%JKDYuni>}Bgz6jEfnF$3mtUN!DD#D)AAv%~L`%Nmp zN#!@GpbP$+tNc&7O8LB*otc^0bwEFcMB;yP|4Ckvb@=15Pz(c?8K(%~qg=2OUcB6h jL6cG3qOgFl%x&rq?(2)+O7bFuzmrO*k7ph=yY;^S=*%*^ literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed-Deployment.png b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed-Deployment.png new file mode 100644 index 0000000000000000000000000000000000000000..8bba51b8d0495141d02b68797ae1b51d466f45c6 GIT binary patch literal 34547 zcmeFZcT|*3voA_g1{4`Uzz7UMBl1DM1kw zP?7?IBvAy(Ih}r<@!i|^+uwKZzH6O()>(Ufe<(BabU$5PRb5^EtE#@Ct*JyoeukWY zfPg|pSzd>LfEYzUK%{^;3V!L_+d4)-Kx*ryVCd!SXJhYVO~583hyTPT$ZzNB>BS}_ z&n777>+8#Fin(g8YK~Jp2MY0z!KH;%q{)!V=&=ej#3A zF+nW8y}7Nm%kOt-xCYoeIhnHwDvI#(gI8TN6cAt&LW580_AcIj;IE&!sF|oR2lyoG z=H_ILv9?gN_k!9BiSY`FLS599^)%Gk1m(bICwoV0@JGqo($N*_;^|`U2L8y|dAK^; zdpm<}ViLUkyh0MfBD`V}e?0+R{_%HRa~pFH`#*+(=ILYY;c4&cf}f^6o0DeN& zUgoy=Uk&B-v{k&-y?C^Eyksr0Jp9&LX81N<{%+RzHdfX?_Lg8wK{g=;z+o$Ub6XE{ zKpVgPZw~q>+A5&s?KCY^MA7_)?!xY7fGKcu0RuNpOA$|B1#Nx-ZFh5dU$mXLg}Rve z)c|)rXG?$n00U*ToV%@#JzCMJZX+djZT)kwt4Qcg@q-A(1Hg@ibpAllPX z#X-y;Yh`1nA*?4P=BtEJa1ao2^wN}6)wOl) zFdoVZ;CBIaFHLP7AqQtGM{{)peM5CERShAF09QK~B_k(Ce_?AyVHGbyF991ZK^GfM zOMPEYKLITTXKNt|9gL;FnuVa9n1mjnLrhpt$=<>-z|u$8K+(@%!p}%uTSEwNThY|)%A1@@X?nO(QucS#kgo2xTx898hXp>J9}BH z+bMYXJ85aEK*QL`qHScIG@K1=RWSD6wz~4}2DTzb0u~zX&|?)h2SZ&8VI3Pe4|^X+ z3kL@WS$h#DZAEP%H8nk33juv20d-v;ZB=a{Ej0rTPis#X1wAcGBWodyfr6?##?#N$ zMMXhJR>w#|)gu5C!0)c0s^M*At)}2E=ZW_Ab<(i+yXr0~DywK{<1XvqCgQ9qYo{%$ zW2E8g=Vr;TtEHwa=;|n-Wv%Hh;ov6AuPN&%XeaCwAnay%_3Bk|1sexT6<<9KZ3Qh? zaWzkjSb&qVtgQrASVh1~Ts=Tl(?|ZQf~Bm5n6HtxypFiIjfAg*G^*+@yn z+)YE>*+$L?E8<`!U?r@1)!ac$TUpN9+z&`hQ9;hhP|H=w&rn+hsD!?PwT-*GqN1>q zrl+Q&tAVbgm8OIq*2CRES3ujt++5L0T-{m4OUc{b%TM3a$X(S>&cQ=j2Q8Mc-tvy3)$)^>szQ9y6DO|Xj$4jVw^>ttc3l=)jTw0UAt{_0k4_L{z4nyS8*wnm0%LpMJ`T_7EKtfh{JkiCJrk&d97pufD6ybH!c zSH%Ka=N_s)g0?yu;%){G5(eH{;1|$A11m1zrRC*d<>llr;N~VOfCfuM(MHTy)7s0; zP0mNd*2>W!z}v}J-wUIwDX$|CAY$+7uV^78E~erO`lDqv{jut5Xcr%}wF6e~s)whw zn~J}-zNV#>lCq(fzrBN^oq?XBo#$0~VRtbX2}?ICZ$DwIsF#HUr0M?V5(@S{mX;E# zVt%6f5^DB3;*Lhb+HQsd7*SP!TMrvw2?IG-B_BC=eqCi3O;t@rBQPjdS;X8<4>Fw^ z5&|MFq5)SOz-KRrrT#AJLK3#%gOG%)fs(hk7FJKf+QCXq32SJfhSs&U7e}L&fV~9P z!_C22%friBPfi!>q;C}9;9}!~RkX7A!RWes=?f|e>Dgex3>B>f)V&?eUFX~bQNsHR24l049(rJo+?*e{2i`}X)k0pw z#>Z95DnQB8N68H%Z?1vyuvGU4#!O4dOUN56eno8!44< zh>e<Ix?Hs^WEcSn69FMYhJXm^rjYaav78hevu>XH{YlQUOOf0C z`BJphC4EOc<-qg*Y`Tv`WWS+8RgwNjU+7ulO#)`t(+=lk|JF8~fEg$CpIxE1BvH%Y zSle$2!K41iBPui{M8$u6CsH9}LMKhWKK-{r!VnKh{~{P}8lFpnM5(w>9sjc{QU=#c z{Ku=1VKO>Iv5C30?nm)+{XGg3`upF$%P?_-cQQ{`^=T%{osf|C8F3c#pT47H)pKR@ zZfWp>*K zaw-r%e*CyYA^Ir?$+S5h+C1O1`^#g*xrXA@N3PNaX4@?Pyqo7Q8%S+W)7+QzuQ<*q zb*-fC+nM{p8=tKocn{v8l-kPKI{X=gLeJ%Pjs7{cQ}<*}QmuSc<9myBEY{C-ny(%* zt?1WLdwXSbl*RUecdAq6d(n!o5yv{G5~NKtT}DH87d&1Pl6IIK?qIeT4-Xb6g{?u8 zWVTd8w9glBjKtR0NbCBA=UgP3;%r7%cNC_}-!LRI9&Wu6?BcHM*la!w{_N4kGxOqS zN%GX~%bHE=#jYvOmLDfbVKc|PyuDM-#0dONX2=*op~q+Iw6}mwJhPdew;Q%5tr!buqtSrR05Af-Hi{=COx<7TIc?-#b1^FH@RgI3>rv{Hz500OuI7aMDeYQ_TE zRXS?jr>v?643dw~8Ont0|1|5uktlbDhqBgnWoFjcsKdRU!@DZU7iiHIZLw5%;xcG$0O}X9%($f80n(74!5L z-|+{W78f)#FLD)E>9{k0^OZfv*-^5%Yk>>Z9&gV3c1*-DO1)Q6E~Ct+89&&l*}X!x{X;91bI2?- z*qVykr4<{pJri$hsF=WT{xnP9-wv^8{8P2^y zbrg=;@~8e>xJ+bV39+hp-N|%2YrvYQPW;CT3rCP(`Ovi#TogP8jaSMOXFwz+l#2}9^eUk^*6$vhRYPnBWlbCdQs|R ze^S&zLQW;<(EpSJSlB!Hn$lmynwBXf*86p>*S>%F@nDMTZ%CIr~I?SagjsNd!qGGW(M38*aM7-#>SVn+fn!_Dc*e_Mmv=H|Fri^(!g}?IcUEAa}<8I>zwFImoGo5uOB%n zll&mzjEL&+lG>(531PWhPBF=)OP6vB3mtpcKD{AT5Y8do-Rj*EI75W|o*m}HSYu(w ziH=z1(9JWP8S`siattCKcaJgWmUOb;8w&JflL!_Jt0#(+gAzV0k zR9(pN?zPsj=GSS7BurmZ;dYbHy^m793-qMOBBVoxg<)XQW<|7q)_%1$A>5P8X(VY_ zI&n*(V5Nd;k=_U*YBMK?I_paE0vK`q(uxqS)%1MtYfF_S1P7>IQ=+j= zdU@qrjbi>QR-Z!;_h&v?CZwd9g&2Ly4n24})*y!Ix4I9uRAp6}`ewU@q@#=yl z*mi%_mqNySZ@pkZD6uoKUhsR1?>qBOI zg(WYZ?M>1*Ctm(lD|fIrE3KsV=2){GnE(~wY&78P6A@-f(+t zvk4>IlY%kjP&)5@chq~x#ABg)h;A`>Ya*sS6WT+$D>|4x_LkptwNgrRL;H78^TCb> zc&yduM=7}^gF;7BoQ+1fSF)0k5FvY!y`~LSK4-GWHkRF-Yr!!2rt~eQ%^wuczV+<6 zlCPp!-L(5pC$F3s$9ja z_45_+ds}a$Qv-k1DYg7)6Y7y<0h_Y4)%pO2kEH!uhN~&!cJtx>qDQyH?8*0aUwlU1 zrZw+be|9J=wyK*+O&)QnFGg~MohK9a0orLX9e{J(F$@8AD7^^rAB$0lw>FK*7fG;k zGJ(qTHW1-Ouq8cz2b_oY(A_yqGgk63l~dD3btx@7(?nx_ zcE}5H7fSXE!0Y7D)NL_qeDUJN^rLuQ&f8P1T%SU}31vghk4(sVq1juJp=&H+qi(HX z6eckU|FsWF)-_*zxF)BL01M0{O1RLj<|t+uG`6{X*0rI0tJPpDQm=Nb&96M+O-{!- z!0b>Gi-jI9&HuG*Fg9_FJ2FfhxMedBV;GY9G%pv|M$Nq!8_y(c z0j?AC1kuvoYL8YhpJX4EQ!9s3ZST#~LWZ1dZ?ni5ZHX}LZfUyI{G zYl=_cCfC^ZtZ&nUtuFi$!j8`rTQ4XOF#M*q#xhD;^@~@ZMmw2*5&f=%1Ql9AeF{Kfj9vGoT9`V`=E9;VV77(NuIHL|&H9XG4mBDXlv)`rI6rgoW% zB4WwMhg%?*P3AmF6+K_^m+Jxnqi@Fjrfy9-`nRrs^~~NKz0UD;+?EmZxCKdsJVg|4 zxVwr(pK`O~l2_hREMgMoZQfg%Ec9s=!$d85Q1(QUn3n^o(2v_tXYC_u`1YsSr8%V9 zv_h$=m7`)l%-*-nnrs>$!z_aN$9!pxT$~7Bs~*HU$^bv?$T8*%4Hq=hSy>csUOYHl zTG~S&A;N*l)fV?fS#@r~|&(f)whvffzIFbq0tpb&OEl7K{&1~ynvi0wWTY%HhJ-t}VY zB>;Pbt$gh2g~_ck|8N8)5f2+oAT~}Vg>JW&oCdO9R&XQb>4-O3x2JYL$=|2^!}>W_ zn=`sPTE9I;)C6|bY%0|4-I%GsH|;24L{(Xm5zgWdcuf^Nb#^>aSL=#CaJik&k^KUky+#HW$NZGgB64H-8s>z*+)GNr1t}NW@&d&2 zi8s$KZbdMLnzL5(8d+17cpZll48RvW(?kf+^)Jx&>UJkQ!JglM7G z&+(6)C(sO#gO!d3JLpY>y(&8uJM8MC0V{Z6?=kiDdX`_gmqehY^^!1KVG3o*-M zl!_o{)Jg$1Q`ScktRRn5oC#J$aXV@>1YWP?KaxORd5!|UFP+HQ0*KC7{G{6B z;{Bo4GBQdq$36^DaY1w#QNaTny<#zfzMjC#@kBZf3AOfPf%U&(MoAKyBf%786X@nLEO=kh!2En$!J`6+{pCxTu=5SjGZ`kxeHUV8b(a200a49@-?J21H4>pYV&(C&xLSFK z9HP?@KdGYHd!(Q>0f`shW|*8Whv-P8g$GWfl}v&p^EC`lR*njS5VQ^xg9X)X9MT3I zU2_)j+pUS}NLLU*1g5J!;PXcqS0~yz)4ROpFZzYF2Z#2M4!v?P#zlC#? z(9qYF;ohh7A{?Q{MtJS5a8gTxM9a?)6GrL^3+n%mfWc3g2IY zS&xQi_%I^)Z!Q9?q zbWB{7jbZM~T~#Vub)vCd1}f^x;dhXo%wfZ?Coyh~TO()RVVMEaKvNE`yqK z-9`0Dtk4C*#oz?Q4I}4okYIbM@mg~>^`9||_St*B1%t4`uc*C`E|Kv{-&61gurs`0 zxU9f^2={osPiJv3?H-9O8m5r5s(AB}f$|L$F*0YYO6fL9Rd8wb>TA&UztS1y5Xk2c zb@x;R1dZ}jfbA*2I{udLQ}&OK6>mWjr7%M z)#I`dSZa3{Q9c$^yx&(cgU~MZXee_bg(q0hYdaQ?MX^Q0SSb@)b&X&soVx7XJsmz$ z1t#1yEazObn%{rY5QgCRKzxl<^`*yk)y8ut!;wieums6@CK{j8>R2F{aSUMu%(?QE zZs#u&c7=1SduWrOl{J6Q9EYEIEHZ!q01wnxUV7({aFgcscga#AP!hk1qW-^)sO%?* zi8P<&(n!V2YfZ6dDbl`vq3+#i9OU(RWDpX#TDHNMVLLMW*wnd{fBXGSp!YpGI79mO zVQIDMbA)sHx9JBLm~s{Zi%pz34MM0;;PACV%8E99loI%RBbxKZr2n7XHxRl&u#8+j`LZ*xt(&>r506y z@CWEC8zRd8+x>jA=Io%A8_=;arPgtE?(+5<#!&9c?n{nrp~0m7C7X%KmPCj(Iaq0q zV}}BDPcgYKBn8y*Qob6Hml@f_)~B}=NjjUjOM`<`1#}qpZQeDh180z#TVi90X8Us( zj}|iaj$|z<4hVRLa8h?OfXzmI+5+&Xb-|O=Bru%Xx2!;y(^mq#1Y8F6F)10YO-9{U zHm^zSEw#=7$U6x_&ATrzN*V<%w_E2VCqjpFfQh78WPP^HHqn%rIZ4*@VQ;}TG}*c4 zi$T-=f@>Fauyk$Owplifbp$<_)X_ysjKNishkL6lYkgW>S|KYm-~@$<+m;IgYpzDaV_VqmN2zTNkc!mDF0GWCjf_DIk;}j_VzY9saR>R^q za-flF7UD1Qt9EL7W5hKL^h1NAZpCEkQ#b0Bou8#$(1|@kY6l<*K4bo~7W1W{`#%X4 zIy$*Zxh-Gc)>OtF>&*v0o2Lu%v(gI?WKFx@)&T~+o^kje0LFE6w}7el zz-2|JcZA_DV8v55NnyNh`cKx319|02m3RAjd1Y~T1UtzDt<=-zjbTTRVf%dALsM`f zodz%G!KolgAuN7*9K?D|w%^%Gu`mWLg@B9MF%XjMKkW{J8;)sX^yQ9zBtwQo!%aiO{=`=?qp~=svR6mJ0Y^7Cs8^Ph zmWU-&5H|#Y{Il7iOgRjjWz;blVoO_FO#!jdnsonYhPp!_nAQYkEjuxyODbJH8Ba?*YcaMaT{+gR? z)$@YFu@6L6%!qy&cy&8m+_|nB;2QU8vS%T9F2%V0tr!wAXWeH9UQ7f+_!xzH_dWyPJzN~u^BmHl1@0mLE|0y1l7I3!yI z09IeXJpI$`@CC^$np5iO!UcYLEH@9qiZzZ+{4slsU04=}8+qK)(8!K5zdaVy-@3{* z_4-ya04oijj|DhxzmYz;+O`V)9|DG?TitliHBEJJrE;%Ti1QVu?8f@D!m;v6O9n*0 zEIggLr#noZ|H>j3bGZ~F$S6}w%Ua0WJ((uFP?AE_4C03~e4$2}%I82d5(*ui%s)MG zavD++O<4$VJIT&9Ar}xznYTGcP1p9O%)B*@w6pbXD~Oq4Vk7kpjGl;ddAylw}@}dxm^qiZ_@;fzg1u}O23I9a5v!CdjmX7%Us+%SMa5BprEPZ2gs*hr& zZo8P!Z5A|VjR-M{pCbIlMxEik%9D^YQ?&8cl3_7kJb^RO+5uL(C$~fSL%rLJX;HF> zwUEntK#O{UaHJJOSVtZ*O6Qp5sHOF)iL;MdYBZxr`{|9H1WrqbG~h-GTI42=ahJ(7 zH`7ozJ>&}7%Jv=eKju#55=_2&`V&+-z*EEQjKEUC-G;z*uP+)rIvFodAf zcLHzDd4T^;Qoe{88Vg)BiOqA{p?2vb_m6Tt`ZEKARNkLSK%6cL^k*cxMC85Td1*1y z*qQ@<^o?Ly)aIiTBGRw5)WQP#s3hQByZdZw-s>xRw!$#qRE3xd1J|MYLm$mU$_Fci|p9OBo-NEZWD++&~nl-gZaYF@QtR zN#4I8=%ysN<&(QKGCueh27etX# zv`h{i(QvS)BmHG%uIAXpPbum`+1|~$Z>jk}oc(EFPC*9R#NDxZ_>S4|Oq$O?{Bb#i z9&65**(x8}*6+UeQq1I)=T-CW_q;IsXmx`g!G!L=(%Y}`u%xz{8TU`R$l%(Jru_&q z2u|m4`RD`r!=9H7q7(}XpJJ&1k5<&`X@^r$$cqXx^*#0rsuGw}#@jQj@>kErTo~M+ zM3SMb@n(Zl*xW>6AP)JPQ_lgXIN*6;I_p|Kb@DO)vn~%I=Tk)l(4}wQf*>kpg6C2G z&~RG;*H&VczFoA-rjhCw{t_I*H-l552^2q9-@a4mFna1p_ys(2QGWU#n-eh0e<3!= zh)5aFGiyMi<_2FQiEgpyd||KlDGxW?cHWUn+A1=S~JW#4o%2`amVioT=AHUS`uY4fgsgg{$Z^Q+@-zXC8 zcc62UMen__j239i=Am7y^xWw*Zy}n zlf!whO(Z7Xk?JhIJImC!)(8%WZ8-vsVo{KLQjqp@1$j*ao*{^$b@qvh{OTmLl}Ze- z9V57(w+Nj%kKX#x$ZoBT3XCk2WHq|)-X57dS2j;(G*_|@4viyv_m);c9-qc z|JBy7ajV{=qf9c5_6g_6Ajf+4)`YfJTjPwJBr(nR@81(kN_hEYnYi$vW0cRD zX+JrK011?BbNvjw97xB6NuDa5>Glhkp#k^}B@#vZq9gDsS8f|p9&v?$P+s|1K-f>+ zV{yvl$XEchgoJ^C?eGI5QELPsF3t0uutbaJA~S~!6E(0=guq5U{NrpXgR9CRt(B_I ziOnSlR|a?rX>1~S)W&~OLO}H~g5m2Zy+KaEO3J2S8`iV zz8s}b=;gvAaVf;+*Exv#AD`sCiRyI#yd{=bE*vSn<}sF0eNEI5gwN$rIbSHNeB^FK zl?M>@%k_|}A*vn#pb1QM;{^Ae>`fb8ZU8^sDa$v_%G_(iZA zgb(tnYO4!gB%Bkt$b1|hs3T-%%`iA8d3EvqCBLJF0DLM3y8v;q2>{7#uM_o0o&YFt z003fv{MY96h{iHfbO0#x1K;RH$Lfasm6a0d&vH3@u!M0T3UH3q%i}Q8az3^XnZsZ& zK6Qjh15cIk!+7fU?~O(@<}X2N1{3q}zKkPj|39jl#`j0^0s*dr@~7MY+6H3%BgFGl zw|LHn%Q0Po$6*b4n{oN!rj0YN5p#^pDxREGgs_ms+=q8Bs6zmAD z&?r2$jLwn5OEb9Ib@UyOrn?N;DI$ssurMhUKRoR%P;yN z2$Q*h*Ap72>L+Bg!@Yt6Bv=qXXbMNzJO514dKXxk+7n9!pjLgDl^Br|ulFel#rw#> zPey=66!OZS<3xM2NY9)#6h=pf0jC8-Uu`orr@pk-Ewix_B3RjB+E`t0tet2SGY??) z19LdalJiBZ$|rJrYCoLp<$Xx$Isx$L%7pGTs0!a0%P0$1COb`34E9FQteDimGs3Op zG=HC5P86^kXJZrTM8B+Y_`9|oSCxrF+MOd@XnI)fc#go9u=TT%EP|AX0?!fQoEy<+ z9&KJY=MZueq|r=*ypglm`Yoz&A}pD!&%{2XnT`VWI?BwdnDU@!qLJ*u6pJK)pk?Y^ z?G`Fz}NX)(O3WeKx7_A5Ao}(;sA1SOH`pK zyM+%pef%gz5vpK(J^YB($6OU%p>qNjxQ3NZuFQz4s&BbR!tcSh%jDfBkNfe#l4+{R z>?Ct2c;J3rU;4_8eXcY4OuVXSB+~9UtlvZT+8!L~l=@Y~gd+|=ijSn6=~uUwTiC@2 zYsz+h1eu@y_$|V}uPE!vuAjHhO`OaxJY!OQ?Y6kETd65a&W4i5KCW0KGmtRjT}CRo zE*H*?<#|=j7Gx|w1b9Qora2kc{Ky$3^a+}`kYpWMHom|d8Fm?uG@C?FkjDl$$hI@< zA;g(sqV?=jySp`i{Q6bGpM>K03*9Hj6fen2@A5v@mv#hEx67_~e+0VH-WO#kY}(X# za`^qb?RZM%oGlbz$wiL`KsYW|1h;dSi@l+9S=HHDpRw4i*u=pla@)~iG;(Gjb+bUL zPPL`*TxtKH!Fu^h;Y>W@L(-h(EClX43?S!pOEQ-@-*8n|>jzhbRQnXvQG6>caHmYg z7?0&k&2W+dbXmvPc;HQEX)18S)yS!I!tcIEF2;99s~(z8%oH>Cy|#o0eIV8e!}l*H zA4<)1{NspdoF0?4P}}aK%7+n%<<}->6Tk%b9Tor(Spg_5*fQJ&-8c#U^>F0OZD)O* zB@OnA)(flqzGZZl6u9S4S}w%w+$|*dYw}#p*rr${4~M++5gk#v2EI#YIb)Hoqt(lX z>y;pkubJV>S)cd%L0m#LBbYhSUo$V-bJ%7^SLFh4O8N8g<)-gWPnpmS?nAFF2YRs0 z*vrmM1@q}=d^x2CL!N5Yk-z*0cK(l@T*ec`4|vOS;dy*|{&y;R${SyNBx+{)__=#w zn+o*xA#0vakD9&##e}ra>DgK^{wo(3`C29Iws1)C&S#)N4ynv-FD?!qRKNeAS3kOi zopoGjE(m^hYb34|7EbA4cc-gs5NME@?vQrY>}OE%zF4(ZwY%|h^@?$HSH8SeCjdOF zEFXO~dR4yC)y{?ed0hOCcW|H8cBpC5YV}5Ty01g1K~Oc&J^4h(@AfRMWy=c5Okd9nANz16E*uI?ThZU(r&mqR<|C&rQf?0x(Jni-8m z*#~rfj2{TGp22jTq5AI*7n>-2#rj9PLvzJSq4h1WRO9Ss8#$Qs90c`Uf{MWmT|Zip zJ-{vx>??4Z#aj+w$yu;euEZm5n5f7jm{~Qni~`DsOThv#VgU<)dD!1IF18?DJq6GG3}GX5 z{%?NXF@lfPtjr`-NqPC)jfM*tgOKVXDil_SYN0_)p-oRCuk%)^chlg3MmqOHU9Kju zbm~8K6v4O!HB|&crB652v}l71tkOZSN(*9r#xj^Ko?XzLc|CN=%<=GoMrv;Xtr@IC zR`|fm4TLN%_Xmd>pTTZQiW!fid~B+o{N+UrDgpiE0*@)j2c^}a$rseV_rog0D=LTw zJ>+pr=#Oi6pU@ZXcLK3_r!wbOR_eZ}udlvoQ+8Iw;qKbnnjXXWhYu(d6O)uTLT=ZI z#^_DvcRuu#-`Gh9N&;(8!N*Pf*V3Yky*&ogeOuLYwt)C&MsY}<%!By`=d|sKUUTZqKXiT3Os_ z*F0|QEyYNm%F$;Dr2}LCY^d?xOYlr*bHPpOqH1*nHT8qp;5M|5hL) z{0rH$UXb+ToaZ|fW9VKvT(SU~E77xPOg~vzZE7HHH3Dgu>C|?-rXVlyjsl&LylKFX zC!8~9S56h~*a4M`KF+*Ck~KBBQIi+ib={JYPp&YNXLsvnLsf9MlxfM(4mNOX7M%$W zn$^XHPoeS&Cy*<+@?|juvF3B@#W~MCyu3OsPP`asgnu$SB4mmrjwE5r#_lxh3RzNN#9oia1 z2zXx~>A70b>-ACowpsh|02F_+8+5c8`5l`3=*yCC0ls$YuoQBL!^ z8&vH8@+moeLCs6~(TJzbOD)IZ`J(+m79*TeJBT$D+F#!Nz0)JsuQf@_xHtD8=0zoCXiP4u&5hT$-^`<$N|L4q^&uj;imb>*lEQI`%-0(9Z5 zbJbOpWXwv%ui4U|8Ls^ed-3*T5mP__sUSe00HR*0%mYmpmop!&)i6YSul<(pm^YSH z+fHYEG9Nb~%+b(dZ(-;vi(4Do?2Au4n2*+p41YbSpZ#hQ+Bhh_@vZNAx4)NS$WMAG zCDHKd&Eaf9-u%?MSD?x6wIVwz;06uq_q#0*Uyr273)x?kB|Wc)xaro3H0|Q8FUkx( z*lr&>7PATEpBH?HX{MIm_++^Pr7wdzoSH?FdN&U$(}|5|ZfXX#8ikuaMQ+A#K>?C+ z!(p*&aG~GReGqNqb=f7aaXa#ms!eI}&;?|i_XS;9zUKK}zkyLxLGlJN-m-_hIG2Ii z;XH}GpU4kZ`M#bBuVS#ig6VgpGfhd#>ld4L>4+YcBFGju0S~@_2pql=fWss^V&zXuHeltn9<11|hHSLz=o>oTAUQP|<8>1m_r8+0zg6AR z9vqMS(O5%GvMk{Ascf>(S+`kV zVWj6F*foWvX?~r2b#)Ty}qCztD|AH+c-Aftx)YAUu^n&(UGEiLZh~f;xISncTT}1^_NUxu|E3;vHIUYf=$3(zT>7N z1C`E1CuXR<5PeZ424^eXVy`N$xxUv~Ev4^BRQhcCiM zj_tc=P|5y$sjg2P5G_;2=JFecY+I@u|ZB>>UMSzq~Ok6 zS{oI$-1+Q%`GkacVaOn4VotYt(e!Q(#8xC=rVKVO?$o)oJYO|lNCqxrRiz|ZId5Eb zsI#ZK>znpM&boj%Mw`jihXFr^dtC62bVlx9@wB&6rYYANr;2vp4u>{+E!fsfI?iC! z&i%i8)UJIB%JY}{MY6qve|8o&`$OLI@ACmT0>J0J|AxCe{cg6h#5JA!uqPh!Y;{*P z7kc7Kfh%hE-*!bwh}JyQn<`c;^v!_t*!_Rh^A-8`f#n|$EFc#C;K2h>U0rM~9Qozx z)yKK{`S~kbw{M^LF*o;2GAo=IB+h=f7)l7atPs7M59qwt!P!l$*#baC?tSTxDFC;S{{?=001M&CH_>~|AUtho>g=BlpbFN1fGP^4 ze4y;OCk7M%|LFV+Zcze<$+Yy5>j&v)Hn00v&jbUsBI*ADtyo*6H67y=1n|f@G^qdM zQ7FN)h>KxP_cr%GjQDSGGCrhvs zks%uD{T_qEPi~yyD<{()2PG#xNir_` z^H+fJoN-W|9totm&=QuBipx_)lQb#xCUOF)LI5)3k0oXc{r{x)0@t%#gjt)*{fusuf5}3f3;viCe1~eNl zTXEDswFvy*qDw3f%?dA6tz;m1N|<`FM8n`P;mC858ZI&{8x||tOFeqhJ`A$KcgPp~ z&p>T|*3q>c4bMaNmH?z*cjba6sNV=7GT4ny8Q;0lJsJr$Hh6HSw^W}7yR8vRhe6u$ z5H0|pq?+#J4G`;lLT0#d)*wWUI8OLwU{h?Oa@2<8EvW7KwPO~MGP(%6Apl--_|t%b zI&Epf!r<0U*L`^jGLHA+H8vM1E`B87>NW^rF}FN}umY8Q0O&VrW%Wlu`7sa?W`!$( zJ!#3v!fxg7Ll74($j5Ubs#3#zz;PdYEUpcNAU~26ZBTGEKOs~&^A+qw%DL#ktk+Q6 zfRZESvN;?u$A<1U+@Jv!MA=~jP3AK-A&-PMp~kWLwybN812}^ann&%lAPNtYP<%we z0)*P_@qG9g#!RsU2}0-L6)j7s?UkX3PfWch@eEcSYXjwO{aUanjHRz?qE&^ui%+XU z9Eqz;8CU*v?X$( z<~$g|EC56yjOUoW%$=itU_YiV=*`M6huUU2$~qzK$YD{4u(?ix@ctb8^=enc?c(h3 z@2)_NEe1}L?PEnAri|n4+>eA0Qo|%T%HBBzM3Ii?gK&;AalIo|9@}z`a7;i;%vw?=)j2H@gO*W?*FJr7WE4X9m z?gf|x9!R;Mb-_$KyebT}9rEOfr6AHk!3@ru*2n}h-p4D?I?W7guJF`o`a_5#MdHTW zw{W-YnG!`{23u1kPXi+C5wNZocP?Hr)BGR4+@5||1fUQ*lxz*%5cK-yX_iI}zmF>H zZ$XwkJ9I%16gc?6QnqsT3e^RmeR;pmMm}5$xpS5~WDMv5P{#G`m(W`GW`OFWktXNQ zTCam*4G1x2Z;hr%mYB`dg{uDV1N7c{vh9YT|H|~_IE&Kln_0;zJm$XLLVjge!d&&=z1v#if}*|L&PwKh>P3?W#3&{fxkGW-XxUrh;lVo zv$eG$JMMyuItGWWV+@TvO<7be9Y$O#I;2O`0Xq6REp=cN^Rkrf;;WX@X$M6<#L^sVzw{s}Fo-qh< zZ0V>%b|k^c8C}%ODj>b04_USobbV&%#U9+jJEs48bLozjJGo$GU*g>mNBOt?$d23i z9w(T{Ko240S5KAUyx*m@avrX-`!TLDi1BFs*-EB9cAFV7iR=>I!BaY$VRnBTu4ES+*fSgXr@0JUVbBtWs)u3oB+m45mYP)I6cb5d4;wT+<*250 zD6z2G0kLkcFQM`}Hq7U|{ld+UFL_8Rm|k95GqEY$G29+7AjU_{pd7>gXQ=*s{TbHN zEJVZJxz$3d#5Kr{2!fxzzW3n>n=u6dW+-1ozQNq@HjFp2j&ram^^QjM0#s;5B0ptn?1v>#o zn(GwpXXYiUw?rQ90W68KBc}WEATSQ6iHceUt3Hlk;d}}HzvoMko1(OD!}II(e*>y! zFUo~^8%7%h7{gPfhN8A8G-qPP>B-;^pS53ck#th^mar6?NGw7riq?p-6J5Qku8#VQ z07Po}ha?BTC>aTu9bB{LL9uGial%3K)7T%*Fh|r*0q#X13S>HMVmB3R<&KmhFDl8@ z->&kRX|SXK_7C;)61N;zW3hfPhy#;Bao|4^A->W=$?`*Y21_!1i@=f)Br%M!wtG@j z{VV~XVCMgyn4S6G$|q3TXX+(^XXA+OZbJ}q5e4ygnl*~E^mWOVL6>MCWn8kNU0fSK4LT80xaAhw5X-C+0`G#z1lK%bj# z_pchhHts#mncxrGY)V$hEor!CBoC;fl_vb@-8P#PP~Z1w$D`PJs19x(M5{dpjcnh7 z^s$+DLOpjuT^t77RmcniuKCxz2lSzffRwjhwJwc;3K*;Djyr-bqvCZSW;g@xx=Wh} zpn3%et9F1O3j5{xvPf=lN5~4eH|V5v;udsC+X<)Rk6W;GE-pW3G-ZIWu@V?-9x zy#3ylZfY#xCyx;n)dVG796{0`q+ZdBK1NFdqQ#{xhh*%T$UDlT1r2;JYCj8}1zBY9 zf)99PWq_!P3|qf6>8a8fYz3pW>3Fo3m}diuyFr&IL073wi#2cG%Jl4(@BnpRUC>2& zQ2iHNILLqCXttXUT@U#Dlf|*^wR~wF5F*l=>6N2Qp*IVL&@}c2=+}r8 z21SZ>d#l-pclkho#RFVk*a7OM z1N_?_%6DQOrl|T9iSz^1A9JO=vZn2hUIsVc(XpdITr~@dq_+o7R9U`dOS=n7Kbt|= z^6nIu*|zHP7+@q1R4S+`9%1MYu4=Ld^8$5)P}md-dYEs5JBT`mkffO0eifm2hch4|ayGUMUZ*xMjF z2ttV}2H-Xx=4!X}3J}ffngw?<**7_J-Gm~<&<&0mocs}>Gv7pA68{Cnou!akg`Xhy z=VV?3);N7n3MgQ@05l^YtXtYk_Hg%>b~L*RyIB5v+;nR#qF7|lxmO6L#Y}r&Eyem z4JC~m*w4TcSU>-4!}V?b;8~&6*y;r-L>nu-1n-p#fGU1|p70lgsBE=KFDw+gzr@uX z*&c=XK%IWW#6;n|UHLe0G%FUKkI+%xjG2{eSulW{7AVQ1U2YyOk~@rv`Or!{FDv|R z-d72_z&SM`tj4=zmRdeGZ-feUMz!zrbk!%Qiq9V`xf#mPExF}$Dm12JbA2Q> zU`vH+MZ&*PFZp~a)Wt2;$&crc?O50h-Cv5N)NNVR&JFR8>0?X)nUXJ>3=W3jELjS+snV|7gcR-ZQYXuz%8PaN=HDh(bq{aNhte7 z0;sh$C7?x$a%a(4xkO?Lp3%A23*p-QFe_ny0(Jv&H8bkt4m zGf?ArGat%kKI%y`kk`VcT_Tm+y`z^9cL!+)?)w2cBEl626)GV5>wv-uu9-fqlpD~p^J{eI{B&NuA-%X;5uexK)luIs+9o0E0f@Qqe0J3cK@L0#>M=<7pE zA{jb!aDLdwgzrz>a`lWST&a*!VD7}$lRz`)m9LhWSwDsLd9CS}kDdDp%H-!(Qw{t> zQLKHOLbXjI1dvz2XXp$HcCv0X>siqw&v)Dehi!o@$r;0U;19Gb<|5b-d#2)iBUh*- zEgYcn?^t7zG@KejC*bM|jz;nPT&F#Lw26t9B?6E|UeC}n(s=>$L zZr7Lf?W0zZQw_)x_8`BmfMKLX;E~2IC1~w%>Bqp>LaxV7rf_^+T)x1zBo(gx4s0*9XbTrivo{59pG zX2uaYY&B0r_xXb}*AH+6%7z@Ms!^>sLY`DR8VC;9d8sr4liOBYI(7b8WwlXCqYw@P z-O%;nEX{d0{&vKIHR1jnYhrejp6XLPjTA&5oQ6Xu$eZQqcn#~NVQ4a zBYzgp1_Ea(aY*wvLcBw)RfaMEXJrLAZk-4{Zg&Oji@4nG`UB09=iI~?{Doe|O!?Tb zD7!p}+7EvhIvwXb+EfSCBcXNr6{Zl;5NZ2kS!IAOiofYrkl z*`0pH*AWG8idpK&&IRiS6Qf*xv|~pHh0jcy<}1Y5l7JlA24KeDr6+ma-)lpK1uhsZr7^!Txt{ZC z^HNh{U^l;}TK8$zFMsI9G5^A~8Y#sM+$Ox7!N*yfkz*lk4s2kV>UA<57fK)!f7{o7 z8|{qz>Z#twT!W!E)>P_nRaYY4J&<&JAIP< z8N=Bs2nJl>@Px*r@hDx``cFw>U4PbmX<2{-Jp} z_iMQaY{9EMuR!WI9uh;F>Jp!&GEcDPp(HaCHi#TRKHX>aOR+WADywHWF&j59fVsre zPL7QtPh!s_9d=vZMz8o*{Yf}F#cLyAvakni+i=RS9&ac7Zq?Z1~6Mv4TWJ!SJhNzB{``^F`f{bzx`c5p;>g&dxsuON_Z(4{B}RG+@zq z;6^cajW+>{>F)y@VJnzbl;-*b6#WxG$e+*u1E8pJ69_OaTC*1A2msLNUo=*|`xn%| z`1F;;mxeRlQ;ZqxYcN6u!uQ$%y>462V%qPbnKt2}gCMnOkWswjd0F>k729R;CUHQd zc7b7}b4Xy5s$?YD6z9|DGE$J6oUyI13c_Th5-eN^>9<-o@d@pRYq>ZI}6 z62RxDc)pr5?*BP3n2VIFPOHrvmsBQ4m;lp4z{+Ix!YhXZnZK>t^wWdh4FN?8V%Y)i zA{$!*c~q8(hf|1v&q38`Txu5Xis2no=|LhL`6r%KwSxz|^uA}NcQ@~SHp#7pdj%IJ zsP`2;CgYU>u`EQgYi!i3EB-D#*D^3CbMtE_Rp@jWFX@RYR$ja6B3y<9R^ID3A3FQu z@CT00lPF3#3hO8rS2AV$5(U$F0Hy@*g&vVRkwHIyM7?#KwJ=eJ-lk@!gRG$-Hx`U2 zVxhP^nk)vM1{)_O56Z6Hj0)UvF#fa$xH}m0Pk>t3VFt?J>=?dj)(wZbpRc{e)isUqE(rLA{cuGUJdZSbrp2=zOpZ^B` ziH_brL_>8q za?2BG&=@J#2k1v|-$k=Tet6Vk}0Hlt^l{gUXE#gl}I_**tg#&4@~iP z)+2BwgivC{TE0|{5oPHYPkKEi;pi9~j~})?xjUr(pB)HQ~%c@A5=TboZBh%AaXtNj4%S2{HMo=#z&@ATe4| z;5ahcnhGDoXpV$1YJVAj%r^G$hZyTBzcDDABV3<}<}>5R4ZpxsIK=t~ORLxo|#q zH9dWKa$Kb9-W?{&R&fyFB}afSFdfcVV32>DFcbh$Oy-ce$Nuv}rW^YK#lwIl*#scx zI>4fmJN1tKo^RR_GBY_Qm6*iY! zZSp(gvsWxWiu1W+_A%A7EBb4-mM`}^kH8q7?c3);W+x1Ujt=xvLDD!0U3OA;COJr1 zg>-M<&kx908pZ`h%7Qj#B-x|=bH|7tRk~eBKtUqs#E-$Pp(l1Gbt)FjST!^#!rqMn z$#1o-qysSp0EhiG-{!I}Yf|#nQc?&qBWyEcmh+TI5w6|2Yl&1z&xDjE-vkhZ@nXe0tD2CxZo z)TI+migE>tm<*HOo#Gx*8v}#mki6u5V)zV6Q5<64Z4YhEb`k`M`sIdjZ>$z+==F^q zpG{9mVh`^7CDQfTb)Qr5T$q_9bS2yl@2nkm?~; z#H8@9Y)A}_yRd@6>BQjlDsD97X}hFPwF#C#2E?8-Am@lPYDSP>%|xR@Ponxj63U|V ziks8b1*5`U5v-sq)-%$qkhWx{D!CK%AKAuZqEq5QL6ANeGOmttWMT53fD+l5Y0ZA4 zTry8rx?&>>!xU0nmmsw9>WiK!`7tl0Vu+*TR~hf{J*feQwh!o=HUnIxfRb)((0sVY z0qKywM+wJ}=IM<$5Fy!v0r&dq6wVhs2%=k-G2vvW7@nvS)5=0m5!WW8?s%Xqtf^h6zt$ z0>OO{<(dlKJ9Z&sw=$amqqCn;$DbUULm{_7;uWt7{`M5*M{5E~)b@oe0Fyq?cNjE* zoamk)n=XieeUAi3b)SGWBtP3&QMXKlzCJJCV%1&`V3+j%iUrSF6q-=)&W^oqY%(aC zK)SARf)L@Rc?@7hnO)~e1Ugg3q&ZIXCB;dfg)#LNW=FsiSW%7Zg1LuQf0(Ece=Zdy z9{|yxD9u((%Y!4WE;ruh&#dIP9-KxC1qW0Wh9Zl1qzO7eoO8%<+O$`MH*kdy03zNw zGmi3?(4Gz;?bw(&q6W>;k_P&Q7l06CFXqyvgG!^6;{;8h=VIi_^_`s8g!W!Qboazj z0*Ch7FMu^R)_6iR!?GpK!6I z-l!3jPuBxqHmkg!)^Ee;*#}Z9QAD;f!_gB-5WDJoy^^!c*d21J?7V;cS*oeZ%WVI0 zjf_(n0lm46tdm}cEX$+T&v=GF`5=^BscRT2MS@+X2wBQHIhs18Bvwoju{l!M zmICXU!C@0nq-DB=t*PG^BdL$C@-ZB~|H|v5QGOcc(9xWb0u!U@cZ6?KOuUJFg>E6N zI+~q7|5^}(3~ zYO0vH#yppU29L$1Iw6+D$?vR^JC7(62nDORlae-u4{f8rDBd6EviTf@>Y8Pm(CnpI zMg5(I(`7UQMZW$}Vh-LWHxW=LK_FFiJt9;mll}mUrU+7jUnNdL5}MsJo)gizUT%Ua zWkcKa34)Ac$(==?R!FS_{=#=Sl;M222wwq_q;aez^}Zqu21xXD-6gC(=U!?%Ob8&X zVcZsTyTIr>Tn{kxg|;C%?q~M_>-{{7h$oGMqpZ)T-Q3S)-lnLX*wD zScwzItLr1*GtQ|*%mT=4J=3c62k5l4zatm-y>WO|a2{e_?P-o~G^1wN2c*h6eB!8f zXCfA{&DHPGzVT4@(a^RSeaIy93FxBRL}3pBj;=XA2gb|fDE{3!6uqmfm7ZjEAEiXc zr?Dw9lc^}x>7ON>Sr;xjZ)UhM(*#{1I!Z-7Qu?OZ#bkpn)oypRn$8AtKmm~hVq6xa zRnglZb41omvyc1EA){mIfB;5kkKjRnlAvhlE{~`~uBj}2JQ2-v8 z+fnDA^9eCKxA-3c)hlsX+*k#dX@^zQ`5@5n6*uwE3cknk|1Cr0{ChtYBXe`}_rsuJ-qPA? zc}!yoD@e{g-Ju0oD#ov$P1?ADQhNfHRzCgO@F8qZ`P&e~XEKH}qL@?OBOS8_NcF+( zw0f#A9|QjL!ofKEPT=W3y!QT8(rIA6%#qbL=d~g)*><4+X_7PL z*ixk>LJ7#U%UeqhBgc}b{I7UR=ouP^Eefw=c{6>Bdt|?L;kUCLn$b!SWi9bO_s;IdclgMGUWw@66G6~adl`|`$ z6udK5sQ7Dx9Z-;gT}9?4f;_It?%0VMjlf<)u_YOP^R?3=CDF9^Sg8 zO%I-=U}L~;l6)2(T)VV#+(m~@-=FIW4GZE&ok-k_8rdO(bzxvD=S?mm`K=VQ3$a;p zr{Faaw!?#uqmvR=p0j`ohUBm!t4ri-bi&}*bgUCiV>@`EAbmE}l+Ens#n4$-B37vI zDsB@Z4E1L0y~~5F0b45u5d>x0y@PJan6)Mvk*% zT?l*}=?0ZguwhLJ$#RVohu8F((|)=BDlZxqY}(5`3z`R^DWETjb>e0)FB;ArSW^;c zJ7uA>!g#FEWyc%1(ZHKxP4O7D<%Hk-1h8h_$s~`W0i|NgOe*y)57a;?XAX?KTcJ4{ zfp{Yi`|*xiZXC4K9-AY>_LTkh@T4>^nxn!Syt(k8q6Ic)@fxWoP;XtZPWbacBWtUe z3!?KYQ3NUvp!P57E^ch?+Vzd7Lj{nU4C{p38a-&I(`l?J zmxp*wptH-cLbK~g#W*zZJXllgg4i3uvyfRkqq49B^? zo$%t9_1KSvX1!uCoYvSJwT$-I2*8u<*c{2o>K%j!<9V?$TYK_K7BqXv7W@1?01FGgGo=r`xiN(R+F6t8dyCvcRHAJuI7+O9Z zfsY=oM%1P4Qcn2XTWRSF|Ajd;TnwM4yR|a&cl4R7E!HtSU-b|@&U{awU67*haR&|0 zLP5{j1S!2=et`9`P>`ZUEkViWH6OO@u{ST8)eE`qzqZy}0G1BV$UxmMgf<2`^O9kCya8LH{?0rdCUb?!79ss%x;)lK$%` hhSds&cdLqqE(!2ns%UlTedi+hXQXGQTS#$=_zNJ|d2s*$ literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed.drawio new file mode 100644 index 0000000..f7c6fe7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed.drawio @@ -0,0 +1 @@ +7V3bcts2EP0aP8pDgPfH2ImbziRTt+m0zVMHpmCJMUUoFG1L/fqC4kUkAEoULwDkRC8WIBIkF2d3z+6C8JV5u9r+kqD18jOZ4+gKGvPtlfn+CtKPY9M/Wc8u7/FtM+9YJOE87wKHji/hf7joNIre53CON40DU0KiNFw3OwMSxzhIG30oSchr87BHEjWvukYLzHV8CVDE9/4dztNl3uvZxqH/Iw4Xy/LKwCh+eUDB0yIhz3FxvStoPu4/+c8rVI5VHL9Zojl5rXWZH67M24SQNP+22t7iKJNtKbb8vLuWX6v7TnCcdjkhWVoPJP5zF3/w/trOvG+vv70+z4rJe0HRMy4fw4noeDePhA5L5YmC/Afn+3N2pzcfcfSC0zBAh67s4dJd1DwuO3+22U/3O3oAgOtt/Qxnkf29R0kapiGJy6vS288vnP9eSK4aHFIhrrOvz6voLkEr+vXmdRmm+Ms6v89XClLat0xXEW0B+nU/QziTgUFb1SRkjYCswqD4HqEHHN1UU3pLIpLQn2ISZ9fYpAl5qvABise7Q6swymD/F07mKEZFd4FxkA2LonAR00ZAJwkn1RO94CTF29aJBBU8qNphssJpsqOHFCfMbLeAVKFywC0x+VpDcNm3rKHX9opOVGjNohr9gBz6pQDPGUACkEPSBif0OWkfHGEayyfzMqlWj2QaI4kUcCK1eJGajkikYASRrrboX/K79Qh+vYe77+Ef8RMBM4+TaECCp4SgYClDoJz0BDJuF6jFCNQ0O8oTGiPI055D4NsPc8+Yo0cAwMy0OJHhOfUDRZMk6ZIsSIyiD4dexnTUZDdHm+W+H3SwHNTE3YXZne5HwfH8Xea1souucZz3NH+v24+OZqZ1xrKHPDpfCY5QGr40naFI9PtT6a2jXe2ANQnjdFMb+T7rOMDAAoxaGdBvOqkzT6Bf8nsQn256LadXd7whz0mAi9MYQFVi6a+zrsCfDsTd4ZhPhKwL0H3DaborEICeU9LE5x50JcyCCG02mZ9rYBEcQ00upCOPWdAGOt4Cp0eOc8ZG4SCDypOdmkE1ADdTpVGlPGFNtTkTUuXQI/yYNTfUvobx4tO+9d50xrKeVhPHlsDBAyiwns5Uzsg5Krt2Dy9fdpUMVMgOuCh4QLZredg2fedhBji5MQT7bObckZJzBNt498OQ7HKm3Wm4jW0zXsbmEWaL6LdlTqWegLdesv1MC+Hp72T8SSgMxxkoN2yhquUYuZubjDP4nImgI6JohtahRmbVYsxqlcBR5pLKkPMtYb4U6uSgh23xmSTQlw9aRz3apJmNT5FGsIeedrA3j1ExzfMC0G6BnZS0gFieloCivcGYDXQN2oBeURu4mLCNtRXqozZwMWEbSy80kJ0ol6ModLv5GbqNgjIuza9B5OYp9zbjs1hJoRub7qVs4tqofWBzwKkp7UUEcmx6TD2hrQrkb0gDJqq/8PUSnk8r1IAKjXoHdWx2XQMVgAKuwerEoXLIhAd8dw3neBum/2R4vva8ovl137SL1vttgfZ9Y1dr3OMkpM+X+eWiNkmfNR8LOGW7NljWPIy2b+3qLXa8TurVllE/Hca4HVWw4fv5SS/7hmZc2KyxYzNoailNCkYymJHY2HhqNb/kDAS3MgFUpFBdDgL+IDkI2DUHAfXKQcCLyUFwpWMABSuZJHu3i8lCcMVjHaR3Mg8hbY3mzxLyVCVkv3Miwp0MZ9omIg4UtuSsX2vkVsxfB/goVXXnAxGRxeMuImHBEzZDoCxybXKZDdRPV/rj3pSUsuBKz9Jxb15GmoKiTD/g84mKywn9gK9f5GfysbRy0zJF5FcuwD8Z+Zn22GZo2PzwkbmmkV/1opk+oYt5PGzWKPCzWFOrgfD4qPln/fnC4z4AtAv7LNEKddYB/Zilh6PpmNOOrGsKU1H9AVg+g6neBQhQJR0lMXhLVIGIN4QCVhuXwr9TKqTvIm2fzKdYGr6f1vqiZKXxdkPhT6h7f822Or/VZnXU7IEqa9sN/Hjsy9tTKxmfHvoJlrPB4koCi8nSf8Pyr53Dx5WLHZ75o3V4nacX6ewFT9ch0chWM6badQSW2pVpqUvd11DXpGbj7dELwS3qw754LjspafPhnobJeMC9YK88Jeko8Uo1j+Oe5XL0UzGna0RTsu7JKwSA8WU+u8fKxLs4OKauxrd1lk/zEElvFtpmv7k7OdCe0Hjm4WNLtc8Onwiu7POMzn2WW9DGTHM1U19Q6QCmVDMtWgS0D9mv12WmcfZwiiHS50+bWjOCtNglU1WgVRMWFMXpk70U4vBxOi8spERYM2hoJy1tV64McMqSVqFwhQ/ZvNfhsww6FuNN/RahlHekcxKUyxSrz4G6auOFqtGtejEtKZS31o0tfPVlhTPTsBlEWdkrTwda6HQyX+fuZMc/QQHa9hvltrLzGmc0t7IbbQM6vjKSJd6Uswb2VU31rMG9JELP5l3U83lXSYJSiRmdPPdosablaKDb1VTyywfdPgH0uZaSf5rjhpJbBi3HTvLhaNNOqglF2bWxUs2keGNnTk7Vvs7ti9+02dfZZsEld19noUQhJ1EVlvSsFZ+MBTwZ0gqfu2AmdVIqPM4aaGQHTc7RV1tHXu45ENoMvxRuZjJZRNo+c5KWew4SHrcBgHLRqdkEY0TtFhSRhMf5KrUb8gost1bYY3WK1NnJNxdUNT181nuaEvi4hhf4ULn1UJvTOrcG3r++PYoy+BehDNLy4sO0wWTLtOq1QZMdPUdELOjKnZUittxtUpkVgr2sEKjZoNKSyTBDnSd1aEDUK43DRheGb9cBcvL4MhvZdrx7/PjBWZ+jIq9ZBmo4E7KlkqHgNUH+2tGpF1rVcw4otfwoliX//6mUqH/FJdzuZKI3cxlT/btycqX5EMGmlhdKNaESrtl5lod67l5GnjPC7P+QZIuaFjx+xkRmmw8ML8Jss2km9Ua73GjuMhIgvWz7iMor2q7uCEDHXzbB/vMJg90zcrzFWWIB6OHjVUwpHDqlw/SUf39Kx1QYYMtr6oN/qDoI7ctPFJm4zpnhiUycrdrECZLOGubZ9FO0Mu/3hnxD18SwWtdwZNe+KdatjVws8UTAtaQCF7414JYb2p0mNbZK5Ir23dMXuRy38UT/JmAk5NJmQrLtlw6uLUHr5Wcyx9kR/wM= \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed.png b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/Distributed.png new file mode 100644 index 0000000000000000000000000000000000000000..d96ca216b2fe23de6ecacca6544f5b0d0ef86778 GIT binary patch literal 31547 zcmeFa2UOGBwmu4oieN#JBHacSS_nx%>AfQ$y$PWO0--mlBB&IxBhpj^l#ZYjX;OlU zfYLz(2~FuC0s#WN^$YHEJZGOX?!E8bcmLym$9C+YkgUGunrqJa&2Q}+7j)J3F>*4} z(9rDDP**mfp`pjq(9jk#>;j(@we_#k(Cq%|qhjjg7T}1%I?$YiD{cRDQe4a#=k0S6 zu6$Bl+~40{#NNx+Uj%~#zk#pZaP}BSjD!95*WzO0V!~oDVHoTp41N->0G9-RiNQrs z;^OAp40RS_a$ps7=)FxW}BBKS!gS&)7R{}p{F|H2aA2kQGD-NpS?QZJ<{!w!F!nt95 z-9R;zl!%xJTuK5Vf|B~<8&Kt+KR2{>wDrRL)(tdI2OnFf?Kzq|iYwW=I_WwE*(>_$ z8V0&~;xxAB=I7w$jlsEZ7lVn5AVgr>U-$%iIBb7v@8E|)gFeMi!d1Wu+hc5k?qj@ymG zjXmtq2ydjy1u>YTyS}=H$pvLIg!ly?mkT}@b-i@p>V7DgrmCW%i;AD%Kx@altf&%Kk>PGe+QW~zRZYl_GEh%SR2|c)q zj~n~~`lPs`zN52)zqX=|i=%>*D?;g_fr)|ysN||DW$WZ&ucE7Ds%)Z$aWcb6Xt~sQ!@ocgp`2_T+B2;OT$w|(LMm_6(EJcs2G`I zv1WR%L0V8>pkZh803Q{1aVd;G+!TCdBo(0NYKzql0z#ySfhjBaIEiV%UExm3CiXh2 zDvkjtCvz|+gr-T5x}T%3qPM-hBw7=c)iP6ZRMB%Z(Q`Bx_w$!Pt3$#NsOad5L92PV zp_~zh4j45_arGeZvA=tehk_&0&f5f3L}&oXQq))S(DMmWk~>QCvi6;9ajVM3nt2LeoE&0>Tcd(R}?RJ zz!eldkU>gVe=mJCZv`i9e|x7O4YZ*a%)=F~V&HAAfW_#djFHM3rYfptzFrs2;R+2XKfEJjE9P{ zEdp-jpx|cWYhtMFYh)CN!}+N=1}W$nX@CRn>@TijfHd=xz^IrgAPsO%hOQW8Z(AcX z37iTTs6AFM&cp;wloh4w~lXW@hU4M&j!3=7AW0e+d;kgbo6%rlO;XgaVj}k``P; zMO6~(s9}N*K%-O?{ro&|N=_)Wx|^ASii)N=&?1U@V&{err(ma2=CnSs9| zRtg*$RY?VJWdzz6p`eFyanUtFJ4m7({0&@;%u%*xYCvld;J*1lc1#o33!e9nINVI*BuTvnXWd|u@(;z)%Wu%`e7VRtMY^Z34 z^2VTbO~jS718x00T~PME%1Ao{RS8{FaRUhnaXmdyMHg#mrvo?fKsv*4$Uxm7Pai+5 zpNp*o9PNp43{n#Jzi5gygQLBJOpqFIW6-U(x}7ps3JINECr>?$DbB?Nu5O|Z^90{{ zcn3)+2RN$e`0MB>J9ryQ1}Y%kOpSfDz1_@%)R3y$3c3>BfoM-~vnXD$ceHcV^a;|} zvzIWC1h<%~p=5xcDa^sn6s~S4W^dL;q`CCLWvdJ>74YL9_X_or z0l)vc$>Ay$i<+f0H2gFg$_f_)tY^ROxpz|K{sK{cIrGTQi`?{_H_wTMKP8-+x@L4H zW;gokbk0Z*wXU?l3m_j|AB4ZA>|AD`W}|@ZfchO>?%ELy3Y)| zRs5@iZi~*vC*NMNnGAN4{qeEZ5Q)UPjS{#0*Kg85-^&-&{oEjV9liPj{23(XNQG65 zKZs>1m;^ zeIU=T5RNL?qt1OL{8o6`(u7-$qC>qH=!Axjhy5|Ehe+=kNd1kW^x(I6S1#e3D*SqN zUxG-;;i{=`Sg5-Qb9(2v?mMRoSfKW3BIs#{$_4m68R!)0hI*3ARvGW_X@J^e@UaZX zn>MpFjvs}7qR052(hX558kr zcs*3riYh!O$py{wF&pUlm3_>#^8frI@>jt8eq<&_^Y{B3rB zp<2qK#^^$QT4SREb<+3uEUX!u)t3+E?2OJYb1kfXU12li(Xg)}gLmn4G;RRg*IF8a$2@-psKE!y{FsQ!fgms zJ#975sKyuKgk+IoH>6ME1ePLVc!^vA=ZS9-u^L!#;HVZ>5 zH7M!%z;-Rp820580{a!IGN2vaTlV1)e%x62*2^L5mCD{I_L_w#+w4?7M$y3cTJ`6L zh&LBfCZ(N*0_RKGWk;?bzsYbmuc-dx25BE^kXcu9vu>jdb^A3 zYFYKH+sL=b1N#d@W?hrHqRAG8ik(8b;y6vQ;ke+mgD7JF1i*qA2NS=q>)9B+lA7Zz9~_)F^fCE!os4IFix|5-dqlW zOb zAMG;7K69(xSZ?(s%93BUh%n7x9$tTRc}Q++wSDAy#!W^!%E*BRXw{20*QQbFX_6BU z(T|FaZ9eSt(YtI;s^<-3 zdJPT%LNAWTqmH&UER5X1$1A(^LJtw2Pj(K#T3UI$-DwNPu-C-O*NAlRBl)5!Www7N z-B3>kfh}%gYeh6RzeRtv)qC93M?|5C7-T3_*D`;T|LkcrJ?Ws_hRA>>=aT`Qu>X5EehSnImcuvpPg{zHLI zoitjQxF$4uhY+%cpeB<3^O+z*@21Z1iH|k35BDwNQ8h4Z&FVyJ*xJu*IUd=cPYy&u zdSgc`0r!~@-x$Si{rty=zU{l=A;YsOeN=_mm1CcjBJM4*C0|$>x{Nc$RWH?-q%Gx5 z>?!IiUt4Vt;|(Ro+FX6rYyD_y9~Dv-K5C2(tyGlY{TTR(9B0_C)alxyv+ISvpi(oR`n$8#HNDd@h-eOHRCE zICLE`e1I*ib1C9L@MDZe{+qeV5uhF%NXq8HAEl9>2(jyCPN}Q}8+;tPIr(az&-w3< zBkRpw^Sh-(dBbWbO!c}oyK*=i^LZ({M5bF7qs5M zxA`f!3WlsF*jxx3JI>e7(WocgDENw(cwJ3GFFs@;k`F5@du0CZsL9pFiJpy>VLofp zqh5*OCa(0pnA)!Ru%oh}ipPf%n{AB4mP^vzYE(}Q`8OvR;A`plYDI;H4m7VXNVb&# zb?348UJ$iHAPOQ01esMl7jBSJPo7A|?JpY&awQ>7m254J`@Add;2 z@de-0ZJSByaqo8fw|})iPQSLMTAjjwn^~Rx`zRQTl*|_Q4XQbGAi^32jhj#9gAi3W zfpL>nWkQy@Z^)ZP$QGdH(p!3%KU2S&*%|bOWAvcMI)T7Q{on)BPhxyfpvtjhw*)?w zE#Wu3&4;8IspGbxtH#EG#jB0E*H0bQGp3)j@j+`Jr4B_b(uJ5q11{t{b_`k(AEn2M z+XMFeW57GteyUbi@g6+rEchuKYWU5dw*=MP3ZoC|1%p`FJS+&O+NaK{Ej?}4&e+Ts7Tkv|X;qa>Hl$93 z`MJeoQC!z_8=c9#%B75WB;%mm<@ZPu)l~bQD?gvcG41;FA^Wz8cbZNDZ*Wg?7wr++ zp5(aW8Pxd!MJ|v2XpsI(y)iH?s9JH{8)1H^7QUn!xLxEzElqs!n)kcC+nqiH=JC0v zaCs@(9t$bgW7{U~t!X{dba+)h)R?^yhLy!+&h^?1M4Cuv^-@5??45)l?*Nx(mhLl^6p)1Fn8G2mb9 zyt%K?&pIhNJgf7 zjwSVocY5cMRRd7#lzVK6H`IpgxsU9OI1DsM%$*I`*n8RC68JGMd6^b7mpJ86iHl3k z&tO?NA>fe)u;IaV=hF(&5=JJjx`cM!yh@2KkQ*0H)EE&Z2r(bD~s;rNG^`=2{W zX~o}umk^z^`A`D?GhXF*(I;i8rrpQoX4Q!y!HM>gdYm>cgit*u$CFs6gQt9)pI7N1Mm84|i)yLG7jKZ`z(QEjp2Th%y zrVt`;r~5q%cttuBBC&cJ+Lo&KlH!bXr|I&_4xd~{zq=c<-#PC6czDo*k}i%L6zAtt z2^whaVN(e@CY^hR!D3+J4*#|%f8IFScvuDZg?6t8oX2nT?K9edVd8#p#j0LFa; zfNJQ#Z9;cj?$6I-*`?*$(u)G4?@lp1V<;LjxHpq1LbU$`F68|Q(sPCIC1U}tLEJsh*D(Y)9{qOX`^EwVWkDhtIebw- z7>JR_Ohpe*lcOqPuaPEPWo)L&O-y+n^1)1zOi{;iinsPg%3lEzL96kN+0|*9Om{Vv zw?4UWDL8-Bzmj98$bK7I<;bJXajdFk)~9-iOy2AVCR=-hYI=yV?4~2(WVT)GjA}zy z`H$=ZL8TrGx;u48d)j)4I~mT)Tt(STubMZ{`@k42xohaI?^622aW>Aq`a<3)`-BK@ z+jcMPqDA$zMB%+6hi_KxQ4rrtw+Dy_{fP*rywvDA5QA9jb!C4+Y| z?~4YJCyuW{PfVLdKUztrZ1*B+eJN@O!Ggo`6n7xY6?+c)L*SI`QK!3RdfuX$oqy&h z^H6a9q$^KtXVWPUPckDv=UxSLo>=9QV)0Fzhi?KTw|lXvs$<;USSD6}L2^-m{=FE( z2_Q3vZqe^A_IrI(RKD-W(W+JR_TF=$*|GZH2n($85*%0XrnWxQQFc7FV*W&rU%doG zu)l8-@|P;i{-HiFX~hZAiYW}^rh&sXVf)~oDFvtqmM7H z|K7vYbS~6(jxh487b4wRZsy_oZ;B)Dl9^95@ZaJGnnV7OWaB{pxf&YV>}w0#Tbe4O z8WG!ILi70&11CD_b3S{FFQtC4sUdK?7s5_sN&cFsw^8-CQAgFI6+l37=|T7jkL#~W ze1mE0bq|beZ|QlfI6C%gg)~p!GE3kYGc5i$3QoxX4~OhOuW=(+3&JU-EeC#6%Na0% zQB&+a5z$f*8Was)ZL!%8g+?Zq$lulEI3eHGqkfOz^>QBHF8vV@KdI;okYev1r;L5n znjYk=Hkb~6Xf}0@OqrD9gCb`8xOB&dT|Xu;Dmz5p`4vp73(7qnV%26i6{0c~qU54l z9;SPLYRJ>7U{b;Sg|Dpkd0!rnEotpLVK(N#(se+59*|R@qT>&F4DJxysvIxsyV$;a8ySj{gYoD&wSFa3l zA^R>xLeA>7rCuAkk1O??8}nguRUi`JhBtG#Z&dHu%)?HYTnGcc@zvg{354wzx3Yau z477Zy$09i_wzmmab>=L=Eb&WJ5bwoo;v0%x>jp6)Y;SS#QWmQEG!(kC$!eQ4KTw?H z`}4EfwcNs*bB$aPvt`4w+#pUlvQ!urQaS8rET z&c#0+@6JlA2;;S6H(&i>eR6p^#yQUDfnI(To7_P8_yY^1PI0!}#*Y!!!T=RgmTZk} zf?mEf;a~y-h)aqlqb!r%D>3CiJG2^r)6UB#Y~EG%d27m~ma|QAG;TsCG}vwi^5&=W z%dE*i^uh)t+J`6;DAZ)=lwta#GT8E%pq$i9#bla}5+T-xVkb%d7MYx&VeQ*(q;q_v zo=Ft@2wiMeG+(oh>{SMPeN5yNhgSaNeXy{XQt<+PAYjI|U-DbH2UzVW6o_Ezu#jsv zr)wRjq>(wh@~?sL`6v{F-D6_usZz4bE@QQ{Q`dEq+yq5dionjGT!jmg6nw)*<5AH- zl0T2khizTXKz^6ZXZ$pPD=kR$#Kh_EV7SM2DP2fd)?7MYI&%mI&Oq2u=_1_xmCu%t zaA8-_#AZ^^+~yffSd;{QAUP@RNyS0DV2OMANVH=p@y7$OMyG=bEa}dhD`>v;zJ>dR z!I_u`P0>cdK_@o{11D2QY!6&ECE+*nO4=S_I2yy=jNUw755*ft2~vV-0e0ozpT3(rKMG3)U$8B@-Uo##Ee5dp%u+5#OdHBITAae)(Kpeg`xHO>btDkFH z)*yfi9(fWB6FsY&@O_UfZ7N~N@8!2y#Kx5KDb7}+qnk?MRr-4v?y+2|zF*RIDo!fLY&9`EqVL4?cP@J!`eUJ(R5moQrk|JTEu`6XoQqCX^d| z@o{|FaeT!oo2MKo>V2g2Ey~1jIw@sR!e($QQ#9no>N`gY*#R5c6y5i8>#OZG9>)UF zv=R`0Lv8V<^Jc($ZY*L$4)!c@rz>(_%r2g@+i1?NvfHsNGasne+4TrST(@MMWg15z z{J~@DMK)5T{qhj$ksvI)R(A24MEAIT=L!(Pggxe~8hhJqk2BsX zJ2)b_FXA9DDvm!slJfMv;9R=Hofr4{l5(eqPMKT3SOO3P1@Yv5`kawnZNYV*MOVAb zonLU-V&$7q6rjO+AKXsgQ%A+=2)zPV|bA>F%8YNWSzb4h!LWY5y$CFa^4qM>o(yewgUK-eZm??O?}wp$d3*xXft>aJ_~PNM&6OPqotm}Aq0kZ8Ix0W(oSy!}o}!@-W|PVtA6Qn}rOeE{ z3XDVT3koi0I0t6-z*oR7R+gPvECh3|vHg574^>aj9I?O_tB|Vgh@Bu9tA@7s&5~Q4yT851K`To)HZ4&!;yF+ zg&d+yeE*2-`I_ALQTP08mjstxUcmlgm~kn+N~Bq@cV4rC@7iKwZPjYzVW2FmNctn> zFU91~@B1D zqMElRP_;(_26J)?&OBnD#bgQ>!s>$eOB{8O}7&sTiVAJyfRID z!PL7->}C8NggDVw@0AI@rnsxcQiu%`GJ(aKc)pR47$-+cYR7KcSyT3BlG!N)8^Yz! zvDRI|d%^$$)^I>hx-mf!U;ANY;hJ0(#c-^tl0ApX7wssa#U{0D-8wRD1*E=@ zoTa=E0BpAlN69!;?8z->Oqp?#d$Y=0O+GRHxH4hicQU|G4v(X1i1Cg*A79B5JUQjS z^-^w(w>$>6e%EhXZ|H)KTX*8zBenGACy=&}8}KC|vv#W^v3OGx@!J7B=3KUR0VNFt z{~Jx&ZG?H6MRdY^kav>lgoNXg8&g~I6Ll`a+0Oy}R6T6hFb(Dd{6*Csz+ zrF}VP#-kUSH%20KaI}zIL;NW3E>h^$^}`7M?mA%#o2Sr?wKI}17%WQea@8NX03Tjt zO*XPGlMj9XfM(mzbJ06jApfZ0%+tBB72|eaC)fAgcgt$*?*w)MtNHBRlXECl?}^Po z3Dj)Kb0;_3FT_Brq9s1Wx%guJaaHMd$f4l7oxeJLR|2ov-Fd#fGA(a(`n@08KKRY; zYp+cdh6Z9hrRg%5iiT9nT)ne^?My)$mn4jD240l*7CU>QgSi=q7?AGkV+`mbXN+h+LenS5>g z;1)?OwI?tE;dA!Ve|Z;wxuyRn-O|y~QClxBud(M$>>_((*+qF*DcjjEu*KCB$=dL; z_*+49D=`bk?IG_40;jbElGOGAFJ9b?5SkHJVsscceLd)PPN}$Ob+`8sqm5JlwHVh& z|D9vmR-p^O1;XNCN1E+2iay2YCmg;`DMdH@6{q?uIQc&ioUA9410JTN9Ok+Ec8ngt z-Sv%)R|mso_-+Kv`CWN2=|1W7soPV@_&*b)KAy3c`CIhuj_-GAmIkx2%l;x=m@w~_ zkCniqo3_?n^HAwB;(PgyJ8S22CzmI?KrR!){sqC+{&=2bpyir4T^C$MKa$4RT!}}NHj_0{CcbhXwu?{YeH9(D|ok>N~Y)x7YmwOABqh zE7#Sek8y`lh^f`GB6}lF)p7Yw(L{IwtIDe3juPEwAqYDHD+=;3~efJqK6Xr&LsF=%c~4kfF@XeE3^bD!boX zFS}Fps)sJ|ao&i(%gmt>zJxr)C3tj!pISj^4}BiUw>5JLCs!YW$}d~9O5A;65FYaU zL#gNI`yfr?j1G6=*VEL}sb|zh@R>C6utbbghdEtU5vjhw$RaLQK8I%gLeAmlqqjus zf?81a^z^1`gK{N|%tdUEVUDS^gcZ$jc0cRB%SNBHvovX!pPcE$tC*Ytv0@2NOTTPt zY5yGl3XVjO31XR*s^Pk4p}vjjjjy3^bFo{!0GD4!qi28WA*l4=iz{PxmW-b`yp#L{ z@=w+=ofn-kf7MjZ@QktOK&GZAH{B{&_+TYf`EcLH4R|gMtt(jbo+JFBh4cZolTpNh2Q;EHRYk7dY@^3+ovD+( zcc#gcVGMYbi~EkyQkO7~?ym*^Yr#`BwDt&@m!9GVd9c(ZX8>wAJ+!{i%zGKzhpXMF ze{zkNa~b4szVPUdi_}8AAShl2Dk6?o;Qnb}Q#^V*+CG99;sQMbKP74QECa%CwI}K z9q&s$^mXY2GUiTv)-GWIvaS0pBKEm<_5 z4rssv6wR~whliF5{G&jyYmji~+(DK^sI~{B&aP=VeQ>19L&1aSOhoEJ2!neXGZ*V8 z7IRqvzUwwszEHr>I6Nl}(vc7NgJkZHC-bWoKa50kxqGaZ_DRr*SiQJV(2z`n>#BB0 zSv3cWNNDMXRSC_?4R5CdiH~w0xfYs%VYT*;4xB$OwqAA~1R75Wm-}QXS1_y5Rq6ZR z!)CdN)CIxyXxT3mL)8QiB*w%((ke6t)n2_At$%akk81F8pBI`HY@(pr${ox^|4x8( zv%joEbe)05oz#%o6Ejii3UryV_j38N?jA7i###ZEEym2rc{Yo4r^|hEv@1AvL%rUz z&*}qdY!*%iZ=)_!tKVqI?6@-V^6%4zs?UI3fD*ucHon?vP3}xAFgnxQ=}$ZKd_|_= zW1$w<1rdix*BAQGE|f%T#dm*1^a_D|j8m7leRTt8iLi!0NGrpQNiaHw=Sqv6dF`mG;0;03WS-BIy|RvMmH{Rar9Fy12N+3~=a&b7dSH*_@Z4 zEK(p|#V)3RFE&-Ji34hN1^`6PPT&g-q)UmXp);o&T6Rj~V97awi#pzjgzpXQcp3*t zAD!THb{r|Q<6zO@OV#5)Mz7hV(KsCs4}TC|wvmK?c;RH=S?;4qPISjDsCWxQz?byu z*2FvivVBgp;{CCFkE?yoaT-eEfC2J}!@|9S{FUJ%9Ua4A=5L##2ad>57U`jpmeNYqsPqe)>J@aFjDmu<6TpmU{x3&13*dVGG4hSvsT6JGGwb9zo?^Lng zWaf&8Vbt+}d&7yAz?<%5ILrbXPT>6C&~T*(FTfq5T?;A%q}M(tus!;`V0-iYT)9UR ztI1VET`33hTcw*t%Pna%I{=BvX=l}}=+MNM{`%2+OWr8)F9cmXL9{t*h%|0APy@OMCi4u(Hg`AbbV@wMUV~gfO{{ zpPk9Mmp>S$9g-#9(7TH0wS-eZ>ia%i@F-WqeCW!XA|jsanrQF{lP#1~T4K{Tyi&6g z1>wabGbQcro9hq(MRxIa!c~Y@Ls{#s-H!`wv8adGBgO#mU3hXJsAfOl5g0>g=N;2T^)lc5!V!Yk8q(At^CZqXNNbJ%Nii8vJGHcML;*bHs)z6^kvos z45`Fzx%V~e(yoMq^ICN=j?lb8Iz-Z^EQ;g%8Th}c0GU$+GWSyLbPBv(8qOU!cH7p@ z?if`I0|+@7K&|k4LQ`zAYENdOH7BI17jjIhb5^g99aQ5!n6_|L@M`1%S;?95(VMNX zVF18FV7*u;pcdpD0OX00J6a-pT=R-msoH)TV51X#0mqA1Cz7x2I3O)n1t3M-Bdi|a zCN&g>F6B;OUIOH_a1~cPvJ9{gsYa;~faWqr7LY!iE!@jTuG{@6t1m0rozt2aV zFG-)#Y2~Xw?vX9HhD^L!A$E#s$WnL1G{|7cqJ0g)Qd=7UCf>U~TV_KZ=&k9YtXSZx zU#-p)-xpBXCE-ni4Fnb&;*AnOZpwPk8rB1HCKA)tyXiplvEBO>AUoP+_+^yvu4*P;T}8#BjURWXeQJLdXnyWVakyfppj+ zIlV9L^7@zIAqj?6DEs-@PSyVO%)%#Q0YeiO9S=+ygg{0^OYRMQN_p7kHITj#_zIe? zSZ&>@b???JpnhJWG)J(2a08K;TsZYg!qT=Vlh**v#ciS%qDA4-m}B`2Fqau99=F57V+GTM*yiU-#L?CT)do zu1;Rtv0suucq!M$O_nhbbco;!sRBf{NAr8X06NtpK%!uA5KQqd4l2czC3+9O9a#N6l0L<=ka!EVP0>58ApS-_r#6jANW47&P}3|3B$YD(uFR!d8e@y0N%y~xi971 z%Aj|0b`u1=XPL3J^Z29^(RYc%qlo78*YU+ZAmMVssK*h+fMe12+cjN;kAC&luuf%4NrW=|(%p?Qw9tSAQccL|itXb!!cc zHE$AZTK?)kynDmw19`X%5Mi?Ru+@gmOyw53Z=P|WNREvH;+oVJ__3`}(wNe6kJz%1 z&4u>NAyUXDr*R-xW@7XKv1JS72z;3+yoj&W4J5UqP&PmLxV+EL6e*DowkYkFvTvLI zxN+)aLO2sE9~gCA6;+t-0=526!nDeGrz&R@@J`haf@$dc3LO+I9*n zO(z?}ISG-5fl1W=CD?m9l63GL@ZiV4f9BBo4Co^&Hvk7l-n{M$AO^#pFfJNPy7dDR zNj^t2Fr@Bn*UFr_>dDLjQk#)619!X^l83=zs9Ga{ec-U7S~u9A=7FD*h8VN=aV3P8 zK^$CYAg|>vCl~rui}3;`ttrl}^nnap?OW(_?q&m4ntU47N;9>t{+KeG?=b+T7yuEB zX=pLq8>rdKGuP}Pg;yh4g;qku=;Z&+291UGFT{|7;+dKCaqi;$H zfanrJrx?l>fD)>vdiBrH6sl!DyAcVvEw%`cnd0W?jpZ+*(hGGvj?U?T3$-_r(|*RJ zfqvB=@RsUSe_6I|RLl0)5_pEyfI7*7jagiFKwasv_=9TuQ9}V4YlwS$>!$TJ-0T9u z^{}rnyu5uVnAF-DaW=oS12haQM@Nzt<2J9d^5nPKrFdY&Z~Q)V!Y1WqVzp2Tl!G#K zdEO{NjY?XLSlwxC>DjbEV6T--37klhz@K6R1AH7wH?+nDG<3`-$WDhrB=5%}V#6$G z*Zfz;)^ZileB`5k)nk3} zTfIvK8%edAFWPiz=q(vMwoqY@R&(!(JfOX+OcTM&_)EeYhZxna$3qt^t#8EY@?;Jjj5tj`qjE}H}Jr{v{-30Ri16(NhE&a=F&+p|2hxhM)+na5LmBY?V3%tNA;~g_5E~R_p03XgC z8Yw2u;XYG5?5OPa0fdx(ZiKiP9m7Z9k=i^nOh_+11+)qco%psE5ch3JoM(~(3F{2} z{KDUsqO1mP69EC*jJiDgz6lC{2!K{DZu@j=e+74-7syMe>hWo&H>Jm+*5YA5IKkAk z)?v_d29HmIJ;?$}Q{!I`8{)P-FySSSQ$6+nu=u~3Wy_trzpF#)O=Tp?Psb0;zWiN% zgkALL!Dy+xELV5MU)9ETgFs z_K(i_FBSIpVT&aId#O-*p@jq)9slgh|Ec)DnPuWh!OKt};+OuVS{b?4^7Qf`ifq2G z$mYdoNErBUZEw*7BN3po$lE86WnrzpVAlt5*2Ip3Vc*u3`4#(Mcn3u@Fmdm@_Sw{k z{%M{O4pf5z5&kF9QbKFLyG_+77}`S7nU0%KXhZ`4%oQkeq1k4tVEtqK%eb`laNF5&*7Fo75{g$)Y4rxmQ=)UZ$D&RRkxZ{hciHu`-<~Ytw9DP4D$TjTO^cg z2{bQpTZaokXJX$ypiwSCD&kmb5apT5kpn=oZUNZ=*4^C~Ts6Tqf1YOx^)h#*`Lk%@ zAKp4n-Omm>Yn#4I9;h`C3F-w$%xoZmDp3RQ88M(!_2F2X71g%+pWQu(4OrCJB6ng4G0 z`EtuML$XJ~!zTCPo(Hc(qdNDzyRc`vt;JZz>2A7TMLjjAC4UjkT2?yWvC`fW#heBH zFX!C*eQbeYcPMU%zr2|WoJ^h z37=AnST+$$4q)g@FRr4|Xb=Lk8zV`1hSKI%zWl(nggt2^P+%lu(IlKvi9L)Xz48(e zq0@&h!rjKy^OryEWYK;9{y&sFN8SvqV6N}#>blqMdy%g<$0Ls*^3^O~Hi9QL+&5IK z#1tZNVdguCdBOSM%sAM*J|tM+M7_HU@+o(bF5Cu+jSO4b-XuRf`Z@&cRr`(7IE&zqIXrM5U;I)-v13!J-bP_erc`^YS zZ?Hy-$W4cFSJvJ$fTMbKET6IYjELxrVieq-W18|HY5dM9s8O4NH$Ku(@0lU}iTRB; zrp>6z+V!klZuv}S2dl(NK+mc$Tx%{}>%2u%Nsd!)c~6@(>_HN3Zhdh~3)5xCwQ{4xj%B@dBIp&!4+>ztG4sS0dnd?N+o{64L_Qyy|CZZmGjv)A!D`LB%t<-<-Qi zEiS##`0!Sh(THi&c$C$1kLbPV)M4?GF_d*?YCgfNyTr&6*JeyQDMI%EQf(OO2q9{;gop%E&eM4D94QIq4Mk0IU%y)U?8e`A=j&E)? z#%+x%`~W^$oT~fKentd@@Rsfbz4i??EHs>wgo-D6%}hyBi!au(pcNOlcirzv{Somv z-_VwicZLJ*`@N2FGHN&Wtd_E9O)O_HrCwqAkRW+&30Wz4Cpb~(vRP4DVkDg#^g70M z_9F{A=}6HT?%eXKA}2O&!jGO+oht3(hCIMhwAuSIV+SN_uQVgeR?VeY*g*yWh%@eh zb_MdywWj((@oL={qtxObigQOzq2eEQ=*8`MZ?P>uQH)OS#HgDWI%+h~eLyb6KD4Xfr0}P4%BCcm>ysb8xJKj?Q9znwi**Y>P=0 zQM_q?2_#*xcQ^OjQ>AO)(1h!_wk7>j$PC+`N1bzuiRcR_P<-iJ=1pqx)6E4p(bVDx zqyb`pGm`uxsnqNjOcgLjYNlq?HNKnlCQ#^%eI4$zPxWioXj?)HW})iaf9h9H&LF}Q z-W}Ssp&B|@DSgGr$}H(ZyYZp}!5m1*pm=)b!$Ws{C@Zi&uXym^lx*29A$=>R*gh0wz%c6+B4+oV+A6O*t7n z^jb|lL>~M34C3!qtyItNQ{(ZyNN%y&JOl-$pG-dE6|)JQ13~(Qr1oF|2+erWki=K! z{P}4S0Cb^<^m9w5C25pvau9e8tfT?3QqmThdOWHDFlmn65zVETHnA#j z*)rouJQ3FonVA7iXI#H$%A~>9drKPO4cH~!1yAr{00xe8C>&5HJH_FR~jy^iX=wpfCxp zQ4g?Cqzq9RZ_l=r*z80k3!QMN!#zUhj^!u6k0)q715MlQ9v4SE!-y>^f|VkYiJ>Qp`txRq%pgm zumruFWs_x402U|<_PU<&>~kbO%jQ#p)Wk#l8D!Ib5MRc>c#sY~$TkCjj**Dnyv{uz ztuN1>9N^DLBTY#m@ipsT=cA#Qn{+gqUM)cZ63U!^Ez4G+B9rqNhvtz46+nL zaIOkUkL=OOn1Uq)YLoQq`T}Bb_|f>f+iJZ1!AW7kjAugQrsLpk3=qYRr2m0Rx!c;P z-C`eFZS#+Y-iT}6y4hMpp69|)E5BNc<{CKX{{UYT{h&LX_xLKzG4DE-^;WEPufP zd?eZZ`d9CEnN~y|pnHyh$Aq{~&p!}sng&l_B`0f{VlwY5bJ=&12B+Qc1>Ib|G5rIa z9Z$)nE<+Vf)w6O9B5h~pil#f({BfjiFMG>h?GzT%Yn9#C;^Jur{TG2g`7+EV@LELJ);In*yY>6@qcL zcnQtZ?%?<P$2^TjJ@bWEPuG)K}AJ!Fyq0;4!&|T1rdpRfrw8xEjJOr}U zDg44|E`2hGEx%H|@Z(E0-S)%;1INlN`;#CmP>gh}w3 zld_**b?Tmv0~ zw0X>zE^vO6JeoXVKrywakkORd$O7*l^Bh{MZ7?v`$HM{nAXjAs0FfW^1{brN<#feD zzP^%%P2{KPou4gTczYnU2qWDrcs?_}-++rmY1Hze(F4Zt-+sP2Kj2p0{a1!;zH`N6Hcq^aJDy?b) z*;|)`?+79BcBDz3`2aQQ^NHYTvAKzqzE3fHH>7_&yIT*D+k)>wdcvIq`$%py!NxTu z=;O0L5%hxXu(86gA4*#$?svR| zvDNAcZT=iTe~22jJU?bP+r7wxPMeaF9S{5#u^Z`%2;Kd7ETJb9KEs($*#AZ(KWqhQ zBdms3*?#Io87*Y=zHUbWFDL1 zAFQ=uLdYya;&8KIn@A0rFtODnSm%hsLr*G7Z1L9a77Bg42~e^DiF)Y0#EIBtw31K_ z8IS*{ug23IECCPgHKLpi*0OP;=w{8n{!$<%xaso*hP29|7^N~N3tC(l>035^F(DEIaT{KfCF#WL6|!+o^L5G%oo1dIDhOic$qCJwPtmZ#VW&! z(vtd$0%d}MFh8&D+bcWIBx=h{c9U)hru7A1lnQP1UDm78PY9DZx}pY`BUvRI4O$lJ zx3BzDnBq}y>jt1JY89TDOMgRMgR0($f)pK)FvRjm^p;|x=MW;+JM{Cq(hFu4ZedZDJk5mQ=|TF;3=^G zUegXT$Ea2*aOhgcMt{=M0UI}!12WY`XRXeq0cT>cqh_Y%@8OGA_tT9mmoYyWA6=II z*RD_EP~zX3{ckmPJ4u=UC12?=?19Y=uwxmpLu_Z!|A zr`!PJB`j<206^r$;g^ggjXeWx+l3xBcIK0k1Cs2nnE^MshQnTM_shjsF|PM_{geA` z>O&KgKc2hu^hZ zC8`zWoIT6(53b+B2Gtpbys)K8c&Ab851@T=e%C(ddD?$#>$z`j4p38Y<7Ng>Fzxq( zkeY&mEM4Z3udMwYD|4h$L0p#g_qZ%3&g=$DZwUx1tDNfv-b&Edj@9X@0ML@-?=5Me zwN0z2BZ}(m?H_rk_onL`_0cKg)#4b7fkgbnzn?yx$nfHGzGusi=(|K<_4CuB)r;0A+LkUXY$-E}x zCClkeX%}R5tN%s8HYIsQ5Hig+&E;F+3JmO({W2A*blKW`)Ue(BrTFMCcw?%QWF>M{ z3<3U3NzS#Cj3wt-_5*UKV{vQGV z-{4DufPV=B{@;P7{VUY){|K7)ufex}hZ#OdnfWcD=08qj07yDvJF!Ej4j}2Ar*<3% z34v5?y+qcCh4RAr`5}=7P`V*1c(vxwsNn-v2)^#6`7=-pQUKJb=;*VZAO%3{{C1Z4 z-2!m`mz45RGXSWm?*Bgf;{S?d4f0~hpXVub777X%(Eb^y1+%?L#ehLxSBPz*-*zg! zfYlBF!(-&A836y7Z~rTghpIQWb4*B30{Mp>wbF9b43Ph*_`gX>G5dd3vii215+eqkw)ZG-~#K8e(+4XDQG4=YXNA*hcS3=^vYw5 zH5wnD{>JoYL>Q=b8q18Cw173Yj3j6o7;qikuS0roPXH(8fy)bau>n^PT&e@j*>hw- z)|POFPQvc&XP{+%Q`v$2OVB0?g359Da?_I(?CWT7EQ|r33@HFw#L2*v1)52}>Hu2t zkp^7Cp?_)Raf~$@4^Mw@#qj5bHJ}W)i|qr(Iw0T@0E}fZ!2U`JFL3q1(!Ua*6##_R z^NcS4fv+e7l{?#if>$lkr!J+e{v2KYGrIf-yo7UTE&my9unhLqrLdz{q#!G8S(d=g zU%65+SN{0zUZ3Z}hgiQw0XsR<EXgV3qJHRtMMvH>c zq5!EVH~?G#0|Z$`MVs7%leHif(hp$?;I1d&y>I{2&h-cy2uR4w^WU+TJ|HXvtY(0V hmmM2l{(kv|4&bHO44$rjF6*2UngC#G9S8sb literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/README.md new file mode 100644 index 0000000..0fd4bb6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP1/README.md @@ -0,0 +1,141 @@ +--- +slug: /MEP-1-distributed-metal-control-plane +title: MEP-1 +sidebar_position: 1 +--- + +# Distributed Metal Control Plane + +This enhancement proposal was replaced by [MEP18](../MEP18/README.md). + +## Problem Statement + +We face the situation that we argue for running bare metal on-premises because this way the customers can control where and how their software and data are processed and stored. +On the other hand, we have currently decided that our metal-api control plane components run on a kubernetes cluster (in our case on a cluster provided by one of the available hyperscalers). + +Running the control plane on Kubernetes has the following benefits: + +- Ease of deployment +- Get most, if not all, of the required infrastructure services like (probably incomplete): + - IPs + - DNS + - L7-Loadbalancing + - Storage + - S3 Backup + - High Availability + +Using a kubernetes as a service offering from one of the hyperscalers, enables us to focus on using kubernetes instead of maintaining it as well. + +## Goal + +It would be much saner if metal-stack has no, or only minimal dependencies to external services. Imagine a metal-stack deployment in a plant, it would be optimal if we only have to deliver a single rack with servers and networking gear installed and wired, plug that rack to the power supply and a internet uplink and its ready to go. + +Have a second plant which you want to be part of all your plants? Just tell both that they are part of something bigger and metal-api knows of two partitions. + +## Possible Solutions + +We can think of two different solutions to this vision: + +1. Keep the central control plane approach and require some sort of kubernetes deployment accessible from the internet. This has the downside that the user must, provide a managed kubernetes deployment in his own datacenter or uses a hyperscaler. Still not optimal. +1. Install the metal-api and all its dependencies in every partition, replicate or shard the databases to every connected partition, make them know each other. Connect the partitions over the internet with some sort of vpn to make the services visible to each other. + +As we can see, the first approach does not really address the problem, therefore i will describe solution #2 in more details. + +## Central/Current setup + +### Stateful services + +Every distributed system suffer from handling state in a scalable, fast and correct way. To start how to cope with the state, we first must identify which state can be seen as partition local only and which state must be synchronous for read, and synchronous for writes across partitions. + +Affected states: + +- masterdata: e.g. tenant and project must be present in every partition, but these are entities which are read often but updates are rare. A write can therefore be visible with a decent delay in a distinct partition with no consequences. +- ipam: the prefixes and ip´s allocated from machines. These entities are also read often and rare updates. But we must differentiate between dirty reads for different types. A machine network is partition local, ips acquired from such a network must by synchronous in the same partition. Ips acquired from global networks such as internet must by synchronous for all partitions, as otherwise a internet ip could be acquired twice. +- vrf ids: they must only be unique in one partition +- image and size configurations: read often, written seldom, so no high requirements on the storage of these entities. +- images: os images are already replicated from a central s3 storage to a per partition s3 service. metal-hammer kernel and initrd are small and pull always from the central s3, can be done similar to os images. +- machine and machine allocation: must be only synchronous in the partition +- switch: must be only synchronous in the partition +- nsq messages: do not need to cross partition boundaries. No need to keep the messages persistent, even the opposite is true, we don't want to have the messages persist for a longer period. + +Now we can see that the most critical state to held and synchronize are the IPAM data, because these entities must be guaranteed to be synchronously updated, while being updated frequently. + +Datastores: + +We use three different types of datastores to persist the states of the metal application. + +- rethinkdb is the main datastore for almost all entities managed by metal-api +- postgresql is used for masterdata and ipam data. +- nsq uses disk and memory tho store the messages. + +### Stateless services + +These are the easy part, all of our services which are stateless can be scaled up and down without any impact on functionality. Even the stateful services like masterdata and metal-api rely fully on the underlying datastore and can therefore also be scaled up and down to meet scalability requirements. + +Albeit, most of these services need to be placed behind a loadbalancer which does the L4/L7 balancing across the started/available replicas of the service for the clients talking to it. This is actually provided by kubernetes with either service type loadbalancer or type clusterip. + +One exception is the `metal-console` service which must have the partition in it´s dns name now, because there is no direct network connectivity between the management networks of the partitions. See "Network Setup) + +## Distributed setup + +### State + +In order to replicate certain data which must be available across all partitions we can use on of the existing open source databases which enable such kind of setup. There are a few available out there, the following incomplete list will highlight the pro´s and cons of each. + +- RethinkDB + + We already store most of our data in RethinkDB and it gives already the ability to synchronize the data in a distributed manner with different guarantees for consistency and latency. This is described here: [Scaling, Sharding and replication](https://rethinkdb.com/docs/sharding-and-replication/). But because rethinkdb has a rough history and unsure future with the last release took more than a year, we in the team already thought that we eventually must move away from rethinkdb in the future. + +- Postgresql + + Postgres does not have a multi datacenter with replication in both directions, it just can make the remote instance store the same data. + +- CockroachDB + + Is a Postgresql compatible database engine on the wire. CockroachDB gives you both, ACID and geo replication with writes allowed from all connected members. It is even possible to configure [Follow the Workload](https://www.cockroachlabs.com/docs/stable/topology-follow-the-workload) and [Geo Partitioning and Replication](https://www.cockroachlabs.com/docs/v19.2/topology-geo-partitioned-replicas). + +If we migrate all metal-api entities to be stored the same way we store masterdata, we could use cockroachdb to store all metal entities in one ore more databases spread across all partitions and still ensure consistency and high availability. + +A simple setup how this would look like is shown here. + +![Simple CockroachDB setup](Distributed.png) + +go-ipam was modified in a example PR here: [PR 17](https://github.com/metal-stack/go-ipam/pull/17) + +### API Access + +In order to make the metal-api accessible for api users like `cloud-api` or `metalctl` as easy at it is today, some effort has to be taken. One possible approach would be to use a external loadbalancer which spread the requests evenly to all metal-api endpoints in all partitions. Because all data are accessible from all partitions, a api request going to partition A with a request to create a machine in partition B, will still work. If on the other hand partition B is not in a connected state because the interconnection between both partitions is broken, then of course the request will fail. + +**IMPORTANT** +The NSQ Message to inform `metal-core` must end in the correct partition + +To provide such a external loadbalancer we have several opportunities: + +- Cloudflare or comparable CDN service. +- BGP Anycast from every partition + +Another setup would place a small gateway behind the metal-api address, which forwards to the metal-api in the partition where the request must be executed. This gateway, `metal-api-router` must inspect the payload, extract the desired partition, and forward the request without any modifications to the metal-api endpoint in this partition. This can be done for all requests, or if we want to optimize, only for write accesses. + +## Network setup + +In order to have the impact to the overall security concept as minimal as possible i would not modify the current network setup. The only modifications which has to be made are: + +- Allow https ingress traffic to all metal-api instances. +- Allow ssh ingress traffic to all metal-console instances. +- Allow CockroachDB Replication between all partitions. +- No NSQ traffic from outside required anymore, except we cant solve the topic above. + +A simple setup how this would look like is shown here, this does not work though because of the forementioned NSQ issue. + +![API and Console Access](Distributed-API.png) + +Therefore we need the `metal-api-router`: + +![Working API and Console Access](Distributed-API-Working.png) + +## Deployment + +The deployment of our components will substantially differ in a partition compared to a the deployment we have actually. Deploying it in kubernetes in the partition would be very difficult to achieve because we have no sane way to deploy kubernetes on physical machines without a underlying API. +I would therefore suggest to deploy our components in the same way we do that for the services running on the management server. Use systemd to start docker containers. + +![Deployment](Distributed-Deployment.png) diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP10/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP10/README.md new file mode 100644 index 0000000..6811cdc --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP10/README.md @@ -0,0 +1,197 @@ +--- +slug: /MEP-10-sonic-support +title: MEP-10 +sidebar_position: 10 +--- + +# SONiC Support + +As writing this proposal, metal-stack only supports Cumulus on Broadcom ASICs. Unfortunately, after the acquisition of +Cumulus Networks by Nvidia, Broadcom decided to cut its relationship with Cumulus, and therefore Cumulus 4.2 is the last +version that supports Broadcom ASICs. Since trashing the existing hardware is not a solution, adding support for a +different network operating system is necessary. + +One of the remaining big players is [SONiC](https://sonic-net.github.io/SONiC/), which Microsoft created to scale the +network of Azure. It's an open-source project and is now part of the [Linux Foundation](https://www.linuxfoundation.org/press/press-release/software-for-open-networking-in-the-cloud-sonic-moves-to-the-linux-foundation). + +For a general introduction to SONiC, please follow the [Architecture](https://github.com/sonic-net/SONiC/wiki/Architecture) official +documentation. + +## ConfigDB + +On a cold start, the content of `/etc/sonic/config_db.json` will be loaded into the Redis database `CONFIG_DB`, and both +contain the switch's configuration except the BGP unnumbered configuration, which still has to be configured directly by +the frr configuration files. The SONiC community is working to remove this exception, but no release date is known. + +## BGP Configuration + +Frr runs inside a container, and a shell script configured it on the container startup. For BGP unnumbered, we must set +the configuration variable `docker_routing_config_mode` to `split` to prevent SONiC from overwriting our configuration +files created by `metal-core`. But by using the split mode, the integrated configuration mode of frr is deactivated, and +we have to write our BGP configuration to the daemon-specific files `bgp.conf`, `staticd.conf`, and `zebra.conf` instead +to `frr.conf`. + +```bash +elif [ "$CONFIG_TYPE" == "split" ]; then + echo "no service integrated-vtysh-config" > /etc/frr/vtysh.conf + rm -f /etc/frr/frr.conf +``` + +Reference: [docker-init](https://github.com/sonic-net/sonic-buildimage/blob/202205/dockers/docker-fpm-frr/docker_init.sh#L69) + +Adding support for the integrated configuration mode, we must at least adjust the startup shell script and the supervisor configuration: + +```bash +{% if DEVICE_METADATA.localhost.docker_routing_config_mode is defined and DEVICE_METADATA.localhost.docker_routing_config_mode == "unified" %} +[program:vtysh_b] +command=/usr/bin/vtysh -b +``` + +Reference: [supervisord.conf](https://github.com/sonic-net/sonic-buildimage/blob/202205/dockers/docker-fpm-frr/frr/supervisord/supervisord.conf.j2#L157) + +## Non-BGP Configuration + +For the Non-BGP configuration we have to write it into the Redis database directly or via one of the following interfaces: + +- `config replace ` +- the Mgmt Framework +- the SONiC restapi + +Directly writing into the Redis database isn't a stable interface, and we must determine the create, delete, and update +operations on our own. The last point is also valid for the Mgmt Framework and the SONiC restapi. Furthermore, the +Mgmt Framework doesn't start anymore for several months, and a [potential fix](https://github.com/sonic-net/sonic-buildimage/pull/10893) +is still not merged. And the SONiC restapi isn't enabled by default, and we must build and maintain our own SONiC images. + +Using `config replace` would reduce the complexity in the `metal-core` codebase because we don't have to determine the +actual changes between the running and the desired configuration. The approach's drawbacks are using a version of SONiC +that contains the PR [Yang support for VXLAN](https://github.com/sonic-net/sonic-buildimage/pull/7294), and we must provide +the whole new startup configuration to prevent unwanted deconfiguration. + +### Configure Loopback interface and activate VXLAN + +```json +{ + "LOOPBACK_INTERFACE": { + "Loopback0": {}, + "Loopback0|": {} + }, + "VXLAN_TUNNEL": { + "vtep": { + "src_ip": "" + } + } +} +``` + +#### Configure MTU + +```json +{ + "PORT": { + "Ethernet0": { + "mtu": "9000" + } + } +} +``` + +#### Configure PXE Vlan + +```json +{ + "VLAN": { + "Vlan4000": { + "vlanid": "4000" + } + }, + "VLAN_INTERFACE": { + "Vlan4000": {}, + "Vlan4000|": {} + }, + "VLAN_MEMBER": { + "Vlan4000|": { + "tagging_mode": "untagged" + } + }, + "VXLAN_TUNNEL_MAP": { + "vtep|map_104000_Vlan4000": { + "vlan": "Vlan4000", + "vni": "104000" + } + } +} +``` + +#### Configure VRF + +```json +{ + "INTERFACE": { + "Ethernet0": { + "vrf_name": "vrf104001" + } + }, + "VLAN": { + "Vlan4001": { + "vlanid": "4001" + } + }, + "VLAN_INTERFACE": { + "Vlan4001": { + "vrf_name": "vrf104001" + } + }, + "VRF": { + "vrf104001": { + "vni": "104001" + } + }, + "VXLAN_TUNNEL_MAP": { + "vtep|map_104001_Vlan4001": { + "vlan": "Vlan4001", + "vni": "104001" + } + } +} +``` + +## DHCP Relay + +The DHCP relay container only starts if `DEVICE_METADATA.localhost.type` is equal to `ToRRouter`. + +## LLDP + +SONiC always uses the local port subtype for LLDP and sets it to some freely configurable alias field of the interface. + +```python +# Get the port alias. If None or empty string, use port name instead +port_alias = port_table_dict.get("alias") +if not port_alias: + self.log_info("Unable to retrieve port alias for port '{}'. Using port name instead.".format(port_name)) + port_alias = port_name + +lldpcli_cmd = "lldpcli configure ports {0} lldp portidsubtype local {1}".format(port_name, port_alias) +``` + +Reference: [lldpmgr](https://github.com/sonic-net/sonic-buildimage/blob/202205/dockers/docker-lldp/lldpmgrd#L153) + +## Mgmt Interface + +The mgmt interface is `eth0`. To configure a static IP address and activate the Mgmt VRF, use: + +```json +{ + "MGMT_INTERFACE": { + "eth0|": { + "gwaddr": "" + } + }, + "MGMT_VRF_CONFIG": { + "vrf_global": { + "mgmtVrfEnabled": "true" + } + } +} +``` + +[IP forwarding is deactivated on `eth0`](https://github.com/sonic-net/sonic-buildimage/blob/202205/files/image_config/sysctl/sysctl-net.conf#L7), and no IP Masquerade is configured. diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP11/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP11/README.md new file mode 100644 index 0000000..87f48a1 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP11/README.md @@ -0,0 +1,78 @@ +--- +slug: /MEP-11-auditing-of-metal-stack-resources +title: MEP-11 +sidebar_position: 11 +--- + +# Auditing of metal-stack resources + +Currently no logs of the ownership of resources like machines, networks, ips and volumes are generated or kept. Though due to legal requirements data centers are required to keep track of this ownership over time to prevent liability issues when opening the platform for external users. + +In this proposal we want to introduce a flexible and low-maintenance approach for auditing on top of [Meilisearch](https://www.meilisearch.com/). + +## Overview + +In general our auditing logs will be collected by a request interceptor or middleware. Every request and response will be processed and eventually logged to Meilisearch. +Meilisearch will be configured to regularly create chunks of the auditing logs. These finished chunks will be backed up to a S3 compatible storage with a read-only option enabled. + +Of course sensitive data like session keys or passwords will be redacted before logging. We want to track relevant requests and responses. If auditing the request fails, the request itself will be aborted and will not be processed further. The requests and responses that will be audited will be annotated with a correlation id. + +Transferring the meilisearch auditing data chunks to the S3 compatible storage will be done by a sidecar cronjob that is executed periodically. +To avoid data manipulation the S3 compatible storage will be configured to be read-only. + +## Whitelisting + +To reduce the amount of unnecessary logs we want to introduce a whitelist of resources and operations on those that should be logged. +Other requests will be passed directly to the next middleware or web service without any further processing. + +As we are only interested in mutating endpoints, we ignore all `GET` requests. +The whitelist includes all `POST`, `PUT`, `PATCH` and `DELETE` endpoints of the HTTP middleware except for the following (non-manipulating) route suffixes: + +- `/find` +- `/notify` +- `/try` and `/match` +- `/capacity` +- `/from-hardware` + +Regarding GRPC audit trails, they are not so interesting because only internal clients are using this API. However, we can log the trails of the `Boot` service, which can be interesting to revise the machine lifecycle. + +## Chunking in Meilisearch + +We want our data to be chunked in Meilisearch. To accomplish this, we rotate the index identifier on a scheduled basis. The index identifiers will be derived from the current date and time. + +To keep things simple, we only support hourly, daily and monthly rotation. The eventually prefixed index names will only include relevant parts of date and time like `2021-01`, `2021-01-01` or `2021-01-01_13`. + +The metal-api will only write to the current index and switches to the new index on rotation. The metal-api will never read or update data in any indices. + +## Moving chunks to S3 compatible storage + +As Meilisearch will be filled with data over time, we want to move completed chunks to a S3 compatible storage. This will be done by a sidecar cronjob that is executed periodically. Note that the periods of the index rotation and the cronjob execution don't have to match. + +When the backup process gets started, it initiates a [Meilisearch dump](https://www.meilisearch.com/docs/learn/advanced/dumps) of the whole database across all indices. Once the returned task is finished, the dump must be copied from a Meilisearch volume to the S3 compatible storage. After a successful copy, the dump can be deleted. + +Now we want to remove all indices from Meilisearch, except the most recent one. For this, we [get all indices](https://www.meilisearch.com/docs/reference/api/indexes#list-all-indexes), sort them and [delete each index](https://www.meilisearch.com/docs/reference/api/indexes#delete-an-index) except the most recent one to avoid data loss. + +For the actual implementation, we can build upon [backup-restore-sidecar](https://github.com/metal-stack/backup-restore-sidecar). But due to the index rotation and the fact, that older indices need to be deleted, this probably does not fit into the mentioned sidecar. + +## S3 compatible storage + +The dumps of chunks should automatically deleted after a certain amount of time, once we are either no longer allowed or required to keep them. +The default retention time will be 6 months. Ideally already uploaded chunks should be read-only to prevent data manipulation. + +A candidate for the S3 compatible storage is Google Cloud Storage, which allows to configure automatic expiration of objects through a [lifecycle rule](https://cloud.google.com/storage/docs/managing-lifecycles?hl=en#storage-set-lifecycle-config-go). + +## Affected components + +- metal-api grpc server needs an auditing interceptor +- metal-api web server needs an auditing filter chain / middleware +- metal-api needs new command line arguments to configure the auditing +- mini-lab needs a Meilisearch instance +- mini-lab may need a local S3 compatible storage +- we need a sidecar to implement the backup to S3 compatible storage +- Consider auditing of volume allocations and freeings outside of metal-stack + +## Alternatives considered + +Instead of using Meilisearch we investigated using an immutable database like [immudb](https://immudb.io/). But immudb does not support chunking of data and due to its immutable nature, we will never be able to free up space of expired data. Even if we are legally allowed or required to delete data, we will not be able to do so with immudb. + +In another variant of the Meilisearch approach the metal-api would also be responsible for copying chunks to the S3 compatible storage and deleting old indices. But separating the concerns allows completely different implementations for every deployment stage. diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP12/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP12/README.md new file mode 100644 index 0000000..65532c5 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP12/README.md @@ -0,0 +1,34 @@ +--- +slug: /MEP-12-rack-spreading +title: MEP-12 +sidebar_position: 12 +--- + +# Rack Spreading + +Currently, when creating a machine through the metal-api, the machine is placed randomly inside a partition. This algorithm does not consider spreading machines across different racks and different chassis. This may lead to the situation that a group of machines (that for example form a cluster) can end up being placed in the same rack and the same chassis. + +Spreading a group of machines across racks can enhance availability for scenarios like a rack losing power or a chassis meltdown. + +So, instead of just randomly deciding the placement of a machine candidate, we want to propose a placement strategy that attempts to spread machine candidates across the racks inside a partition. + +Furthermore a followup improvement to guarantee that machines are really spread across multiple racks, even if multiple machines are ordered in parallel, was implemented with [PR490](https://github.com/metal-stack/metal-api/pull/490). + +## Placement Strategy + +Machines in the project are spread across all available racks evenly within a partition (best effort). For this, an additional request to the datastore has to be made in order to find allocated machines within the project in the partition. + +The algorithm will then figure out the least occupied racks and elect a machine candidate randomly from those racks. + +The user can optionally pass placement tags which will be considered for spreading the machines as well (this will for example allow spreading by a cluster id tag inside the same project). + +## API + +```golang +// service/v1/machine.go + +type MachineAllocation struct { + // existing fields are omitted for readability + PlacementTags []string `json:"placement_tags" description:"by default machines are spread across the racks inside a partition for every project. if placement tags are provided, the machine candidate has an additional anti-affinity to other machines having the same tags"` +} +``` diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP13/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP13/README.md new file mode 100644 index 0000000..2dde20f --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP13/README.md @@ -0,0 +1,111 @@ +--- +slug: /MEP-13-dual-stack-support +title: MEP-13 +sidebar_position: 13 +--- + +# Dual-stack Support + +dual-stack support is required to be able to create Kubernetes clusters with either IPv6 single-stack or dual-stack enabled. +With the inherent scarcity of IPv4 addresses, the need to be able to use IPv6 has increased. + +Full IPv6 dual-stack support was added to Kubernetes with v1.23 as stable. + +Gardeners have had full IPv6 dual-stack support since `v1.109`. + +metal-stack manages CIDRs and IP addresses with the [go-ipam](https://github.com/metal-stack/go-ipam) library, which already got full IPv6 support in 2021 (see [https://metal-stack.io/blog/2021/02/ipv6-part1](https://metal-stack.io/blog/2021/02/ipv6-part1)). +But this was only the foundation, more work needs to be done to get full IPv6 support for all aspects managed by metal-stack.io. + +## General Decisions + +For the general decision we do not look at the isolated clusters feature for now as this would make the solution even more complex and we want to introduce IPv6 in smaller steps to the users. + +### Networks + +Currently, metal-stack organizes CIDRs / prefixes into a `network' resource in the metal-api. A network can consist of multiple CIDRs from the same address family. For example, if an operator wants to provide Internet connectivity to provisioned machines, they can start with small network CIDRs. The number of managed network prefixes can then be expanded as needed over time. + +With dual-stack we have to choose between two options: Network per address family or networks with both address families. These options are described in the next section. + +#### Network per Address Family + +This means that we allow networks with CIDRs from one address family only, one for IPv4 and one for IPv6. + +The machine creation process will not change if the machine only needs to be either IPv4 or IPv6 addressable. +But if on the other side, the machine need to be able to connect to both address families, the machine creation needs to specify two networks, one for IPv4 and one for IPv6. +Also there will be 2 distinct VRF IDs for every network with a different address family. + +#### Network with both Address Families + +Make a network dual address family capable, meaning that you can add multiple cidrs from both address families to a network. +Then the machine creation will remain the same for single-stack and dual-stack cases, but the ip address allocation will need to specify the address family from which to allocate an ip address when the network is dual-stack. +This does not break the existing API, but allows existing extensions to easily add dual-stack support. +To avoid additional checking of which address families are available on this network during an ip allocation call, we could store the address families in the network. + +#### Decision + +The decision was made to go with the having both address families in a single network entity because we think this is the most flexible way to support dual-stack machines and Kubernetes clusters as well as single-stack with the least amount of modifications on the networking side. + +### Examples + +To illustrate the the usage we start by creating a tenant super network which has both address families: + +```yaml +--- +id: tenant-super-network-mini-lab +name: Project Super Network +description: Super network of all project networks +partitionid: mini-lab +prefixes: + - 10.0.0.0/16 + - 2001:db8:0:10::/64 +defaultchildprefixlength: + IPv4: 22 + IPv6: 96 +privatesuper: true +``` + +In order to create this network, we simple call: + +```bash +metalctl network create -f tenant-super.yaml +``` + +This is usually done during the initial setup of the environment. + +Next step is to allocate a tenant network where the machines of a project can be placed: + +```bash +metalctl network allocate --partition mini-lab --project 4b9b17c4-2d7c-4190-ae95-dda44e430fa6 --name my-node-network +``` + +This leads to the following network allocation: + +```yaml +id: 2d2c0350-3f66-4597-ae97-ef6797232212 +name: my-node-network +parentnetworkid: tenant-super-network-mini-lab +partitionid: mini-lab +prefixes: + - 10.0.0.0/22 + - 2001:db8:0:10::/96 +projectid: 4b9b17c4-2d7c-4190-ae95-dda44e430fa6 +vrf: 20 +consumption: + ipv4: + available_ips: 1024 + available_prefixes: 256 + used_ips: 2 + used_prefixes: 0 + ipv6: + available_ips: 2147483647 + available_prefixes: 1073741824 + used_ips: 1 + used_prefixes: 0 +privatesuper: false +``` + +Users can the create IP addresses from these child networks. By default, they retrieve an IPv4 address except a super network only consists of IPv6 prefixes. In the latter case the users acquire an IPv6 address. + +```bash +metalctl network ip create --network 2d2c0350-3f66-4597-ae97-ef6797232212 --project 4b9b17c4-2d7c-4190-ae95-dda44e430fa6 +``` diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP14/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP14/README.md new file mode 100644 index 0000000..47c0643 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP14/README.md @@ -0,0 +1,36 @@ +--- +slug: /MEP-14-independence-from-external-sources +title: MEP-14 +sidebar_position: 14 +--- + +# Independence from external sources + +In certain situations some customers may need to operate and create machines without making use of external services like DNS or NTP through the internet. To make this possible, all metal-stack components reaching external services need to be configurable with custom endpoints. + +So far, the following components have been identified as requiring changes: + +- pixiecore +- metal-hammer +- metal-images + +More components are likely to be added to the list during processing. +For DNS and NTP servers it should be possible to provide default values within a partition. They can either be inherited from machines and firewalls or overwritten with own ones. + +## pixiecore + +A NTP server endpoint need to be configured on the pixiecore. This can be achieved by providing it through environment variables on start up. + +## metal-hammer + +If using a self-deployed NTP server, also the metal-hammer need to be configured with it. For backward compatibility, default values from `pool.ntp.org` and `time.google.com` are used. + +## metal-images + +Configurations for the `metal-images` are different for machines and firewalls. + +## metalctl + +In order to pass DNS and NTP servers to partitions and machines while creating them, the flags `dnsservers` and `ntpservers` need to be added. + +The implementation of this MEP will make metal-stack possible to create and maintain machines without requiring an internet connection. diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/README.md new file mode 100644 index 0000000..dbfa59d --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/README.md @@ -0,0 +1,332 @@ +--- +slug: /MEP-16-metal-api-as-an-alternative-configuration-source-for-the-firewall-controller +title: MEP-16 +sidebar_position: 16 +--- + +# metal-api as an Alternative Configuration Source for the firewall-controller + +In the current situation, a firewall as provisioned by metal-stack is a fully immutable entity. Any modifications on the firewall like changing the firewall ruleset must be done _somehow_ by the user – the metal-api and hence metal-stack is not aware of its current state. + +As part of our [integration with the Gardener project](https://docs.metal-stack.io/stable/overview/kubernetes/#Gardener) we offer a solution called the [firewall-controller](https://github.com/metal-stack/firewall-controller), which is part of our [firewall OS images](https://github.com/metal-stack/metal-images/blob/6318a624861b18a559a9d37299bca5f760eef524/firewall/Dockerfile#L57-L58) and addresses shortcomings of the firewall resource's immutability, which would otherwise be completely impractible to work with. The firewall-controller crashes infinitely if it is not properly configured through the userdata when using the firewall image of metal-stack. + +The firewall-controller approach is tightly coupled to Gardener and it requires the administrator of the Gardener installation to pass a shoot and a seed kubeconfig through machine userdata when creating the firewall. How this userdata has to look like is not documented and is just part of another project called the [firewall-controller-manager](https://github.com/metal-stack/firewall-controller-manager) (FCM), which task is to orchestrate rolling updates of firewall machines in a way that network traffic interruption is minimal when updating a firewall or applying a change to an immutable firewall configuration. + +In general, a firewall entity in metal-stack has similarities to the machine entity but it has a fundamental difference: A user gains ownership over a machine after provisioning. They can access it through SSH, modify it at will and this is completely wanted. For firewalls, however, we do not want a user to access the provisioned firewall as the firewall is a privileged part of the infrastructure with access to the underlay network. The underlay can not be tampered with at any given point in time by a user as it can destroy the entire network traffic flow inside a metal-stack partition. + +For this reason, we have a gap in the metal-stack project in terms of a missing solution for people who do not rely on the Gardener integration. We are basically leaving a user with the option to implement an orchestrated recreation of every possible change on the firewall to minimize traffic interruption for the machines sitting behind the firewall or re-implement the firewall-controller to how they want to use it for their use-case. + +Also we do not have a clear distinction in the API between user and metal-stack operator for firewalls. If a user would allocate a firewall it is also possible for the user to inject his own SSH keys and access the firewall and tamper with the underlay network. + +Parts of these problems are probably going to decrease with the work on [MEP-4](../MEP4/README.md) where there will be dedicated APIs for users and administrators of metal-stack including fine-grained access tokens. + +With this MEP we want to describe a way to improve this current situation and allow other users that do not rely on the Gardener integration – for whatever motivation they have – to adequately manage firewalls. For this, we propose an alternative configuration for the firewall-controller that is native to metal-stack and more independent of Gardener. + +## Proposal + +The central idea of this proposal is allowing the firewall-controller to use the metal-api as a configuration source. This should serve as an alternative strategy to the currently used FCM `Firewall` resource based approach in the Gardener use-case. +Updates of the firewall rules should be possible through the metal-api. + +The firewall-controller itself should now be able to decide which of the two main strategies should be used for the base configuration: a kubeconfig or the metal-api. This should be possible through a dedicated _firewall-controller-config_. + +Using this config will now allow operators to fine-tune the data sources for all of its dynamic configuration tasks independently. +For example the data source of the core firewall rules could be set either from the `Firewall` resource located in the Gardener `Seed` or the metal-apiserver node network entity, while the CWNPs should be fetched and applied from a given kubeconfig (the `Shoot` Kubeconfig in the Gardener case). +This configuration file is intended to be injected during firewall creation through the userdata along with potential source connection credentials. + +```yaml +# the name of the firewall, defaulted to the hostname +name: best-firewall-ever + +sources: + seed: + kubeconfig: /path/to/seed.yaml # current gardener behavior + namespace: shoot--proj--name + shoot: + kubeconfig: /path/to/shoot.yaml # current gardener behavior + namespace: firewall + metal: + url: https://metal-api + hmac: some-hmac + type: Metal-View + projectID: abc + static: + # static should mirror all information provided by the metal or seed/shoot sources + firewall: # optional + controllerURL: https://... + cwnp: + egress: [] + ingress: [] + +# all sub-controllers running on the firewall +# each can be configured independently +controllers: + # this is the base controller + firewall: + source: seed # or: metal, static + + # these are optional: when not provided, they are disabled + selfUpdate: + enabled: true + droptailer: + enabled: true + + # these are optional: when not provided, they are disabled + service: + source: shoot # or: metal, static + cwnp: + source: shoot # or: metal, static + monitor: + source: shoot # currently only shoot is supported +``` + +The existing behavior of the firewall-controller writing into `/etc/nftables/firewall-controller.v4` is not changed. The different controller configuration sources are internally treated in the same way as before. The `static` source can be used to prevent the firewall-controller from crashing and consistently providing a static ruleset. This might be interesting for metal-stack native use cases or environments where the metal-api cannot be accessed. + +There must be one central nftables-rule-file-controller that is notified and triggered by all other controllers that contribute to the nftables configuration. + +For example, in order to maintain the existing Gardener integration, the configuration file for the firewall-controller will look like this: + +```yaml +name: shoot--abc--cluster-firewall-def +sources: + seed: + kubeconfig: /etc/firewall-controller/seed.yaml + namespace: shoot--abc--cluster + shoot: + kubeconfig: /etc/firewall-controller/shoot.yaml + namespace: firewall + +controllers: + firewall: + source: seed + + selfUpdate: + enabled: true + droptailer: + enabled: true + + service: + source: shoot + cwnp: + source: shoot + monitor: + source: shoot +``` + +Plain metal-stack users might use a configuration like this: + +```yaml +name: best-firewall-ever + +sources: + metal: + url: https://metal-api + hmac: some-hmac + type: Metal-View + projectID: abc + +controllers: + firewall: + source: metal + selfUpdate: + enabled: true + droptailer: + enabled: true + + cwnp: + # firewall rules stored in firewall entity + # potential improvement would be to attach the rules to the node network entity + # be aware that the firewall and private networks are immutable + # eventually we introduce a firewall ruleset entity + source: metal +``` + +In highly restricted environments that cannot access metal-api the static source could be used: + +```yaml +name: most-restricted-firewall-ever + +sources: + static: + firewall: + controllerURL: https://... + cwnp: + egress: [] + ingress: [] + +controllers: + firewall: + source: static + + cwnp: + source: static +``` + +### Non-Goals + +- Resolving the missing differentiation between users and administrators by letting users pass userdata and SSH keys to the firewall creation. + - This is even more related to [MEP-4](../MEP4/README.md) than this MEP. + +### Advantages + +- Offers a native metal-stack solution that improves managing firewalls for users by adding dynamic reconfiguration through the metal-api + - e.g., in the mini-lab, users can now allocate a machine, then an IP address and announce this IP from the machine without having to re-create the firewall but by adding a firewall rule to the metal-api. +- Improve consistency throughout the API (firewall rules would reflect what is persisted in metal-api). +- Other providers like Cluster API can leverage this approach, too. +- It can contribute to solving the shoot migration issue (in Cluster API case the `clusterctl move` for firewall objects) + - For Gardener takes the seed out of the equation (of which the kubeconfig changes during shoot migration) + - However: Things like egress rules, rate limiting, etc. are currently not part of the firewall or network entity in the metal-api. These would need to be added to one of them. +- Potentially resolve the issue that end-users can manipulate accounting data of the firewall through the `FirewallMonitor` + - for this we would need to be able to report traffic data to metal-api + +### Caveats + +- Metal-View access is too broad for firewalls. Mitigated by [MEP-4](../MEP4/README.md). +- Polling of the firewall-controller is bad for performance. Mitigated by [MEP-4](../MEP4/README.md). + +### Firewall Controller Manager + +Currently the firewall-controller-manager expects the creators of a `FirewallDeployment` to use the defaulting webhook that is tailored to the Gardener integration in order to generate `Firewall.spec.userdata` or to override it manually. Currently `Firewall.spec.userdata` will never be set explicitly. + +Instead we'd like to propose `Firewall.spec.userdataContents` which will replace the old `userdata`-string by a typed data structure. The FCM will do the heavy lifting while the `FirewallDeployment` creator decides what should be configured. + +```yaml +kind: FirewallDeployment +spec: + template: + spec: + userdataContents: + - path: /etc/firewall-controller/config.yaml + content: | + --- + sources: + static: {} + controllers: + firewall: + source: static + - path: /etc/firewall-controller/seed.yaml + contentFrom: + firewallControllerKubeconfigSecret: + name: seed-kubeconfig + key: kubeconfig + + - path: /etc/firewall-controller/shoot.yaml + contentFrom: + secretRef: + name: shoot-kubeconfig + key: kubeconfig +``` + +### Gardener Extension Provider Metal Stack + +The GEPM should be migrated to the new `Firewall.spec.userdataContents` field. + +### Cluster API Provider Metal Stack + +![architectural overview](firewall-for-capms-overview.svg) + +In Cluster API there are essentially two main clusters: the management cluster and the workload cluster while the CAPMS takes in the role of the GEPM. +Typically a local bootstrap cluster is created in KinD which acts as the management cluster. It creates the workload cluster. Thereafter the ownership of the workload cluster is typically moved (using `clusterctl move`) to a different cluster which will then become the management cluster. +The new management cluster might actually be the workload cluster itself. + +In contrast to Gardener, Cluster API aims to be less opinionated and minimal. It is common practice to not install any non-required components or CRDs into the workload cluster by default. Therefore we cannot expect custom resources like `ClusterwideNetworkPolicy` or `FirewallMonitor` to be installed in the workload cluster but strongly recommend our users to do it. Therefore it's the responsibility of the operator to tell [cluster-api-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack) the kubeconfig for the cluster where these CRDs are installed and defined in. + +A viable configuration for a `MetalStackCluster` that generates firewall rules based of `Service` type `LoadBalancer` and `ClusterwideNetworkPolicy` and expects them to be deployed in the workload cluster is shown below. The `FirewallMonitor` will be reported into the same cluster. + +```yaml +kind: MetalStackCluster +metadata: + name: ${CLUSTER_NAME} +spec: + firewallTemplate: + userdataContents: + - path: /etc/firewall-controller/config.yaml + contentFrom: + secretRef: + name: ${CLUSTER_NAME}-firewall-controller-config + key: controllerConfig + + - path: /etc/firewall-controller/workload.yaml + contentFrom: + # this is the kubeconfig generated by kubeadm + secretRef: + name: ${CLUSTER_NAME}-kubeconfig + key: value +--- +kind: Secret +metadata: + name: ${CLUSTER_NAME}-firewall-controller-config +stringData: + controllerConfig: | + --- + name: ${CLUSTER_NAME}-firewall + + sources: + metal: + url: ${METAL_API_URL} + hmac: ${METAL_API_HMAC} + type: ${METAL_API_HMAC_TYPE} + projectID: ${METAL_API_PROJECT_ID} + shoot: + kubeconfig: /etc/firewall-controller/workload.yaml + namespace: firewall + + controllers: + firewall: + source: metal + selfUpdate: + enabled: true + droptailer: + enabled: true + + service: + source: shoot + cwnp: + source: shoot + monitor: + source: shoot +``` + +Here the firewall-controller-config will be referenced by the `MetalStackCluster` as a `Secret`. Please note that the `Secret`s in `userdataContents` will not be fetched and will directly be passed to the `FirewallDeployment`. At first the reconciliation of it in the FCM will fail due to the missing Kubeconfig secret. After the `MetalStackCluster` has been marked as ready, CAPI will create this missing secret. Effectively the firewall and initial control plane node should be created at the same time. + +This approach allows maximum flexibility as intended by Cluster API and is still able to provide robust rolling updates of firewalls. + +An advanced use case of this flexibility would be a management cluster, that is in charge of multiple workload clusters. Where one workload cluster acts as a monitoring or tooling cluster, receives logs and the firewall monitor for the other workload clusters. The CWNPs could be defined here, all in a separate namespace. + +#### Cluster API Caveats + +When the cluster is pivoted and reconciles its own firewall, a malfunctioning firewall prevents the cluster from self-healing and requires manual intervention by creating a new firewall. This is an inherent problem of the cluster-api approach. It can be circumvented by using an extra cluster to manage workload clusters. + +In the current form of this approach firewalls and therefore the firewall egress and ingress rules are managed by the cluster operators that manage the cluster-api resources. +Hence it will not be possible to gain a fine-grained control over every cluster operator's choices from a central ruleset at the level of metal-stack firewalls. +In case this control surfaces as a requirement, it would need to be implemented in a firewall external to metal-stack. + +## Roadmap + +In general this proposal is not thought to be implemented in one batch. Instead an incremental approach is required. + +1. Enhance firewall-controller-manager + + - Add `FirewallDeployment.spec.template.spec.userdataContents` + +2. Enhance firewall-controller + + - Reduce coupling between controllers + - Introduce controller config + - Abstract module to write into distinct nftable rules for every controller + - Implement `sources.static`, but not `sources.metal` + - GEPM should set `FirewallDeployment.spec.template.spec.userdataContents` + +3. Allow Cluster API to use the FCM with static ruleset + + - Add `firewall.metal-stack.io/paused` annotation (managed by CAPMS during `clusterctl move`, theoretically useful for Gardener shoot migration as well to avoid shallow deletion). + - Reconcile multiple `FirewallDeployment` resources across multiple namespaces. For Gardener the old behavior of reconciling only one namespace should persist. + - Allow setting the `firewall.metal-stack.io/no-controller-connection` annotation through the `FirewallDeployment` (either through the template or inheritance). + - Add `MetalStackCluster.spec.firewallTemplate`. + - Make `MetalStackCluster.spec.nodeNetworkID` optional if `spec.firewallTemplate` given. + +4. Add `sources.metal` as configuration option. + + - Allow updates of firewall rules in the metal-apiserver. + - Depends on [MEP-4](../MEP4/README.md) metal-apiserver progress + +5. Potentially migrate the GEPM to use `sources.metal` diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/firewall-for-capms-overview.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/firewall-for-capms-overview.drawio new file mode 100644 index 0000000..faea3e3 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/firewall-for-capms-overview.drawio @@ -0,0 +1,4 @@ + + + +
handles traffic
Firewall
Firewall Controller
node-exporter
nftables-exporter
droptailer-client
Workload Cluster
droptailer
Configures
Bootstrap or Management Cluster
reconcile
configures
reconcile
Cluster API Provider metal-stack
Metal Stack Cluster CRD
Firewall Deployment CRD
Firewall CRD
Firewall Set CRD
rec
reconcile
reconcile
Firewall Controller Manager
Metal Stack Machine CRD
manages
Admin
Kubeconfig FirewallMonitor
FirewallMonitor CRD
main metal-api
Firewall entity
kubeconfig CWNP
Clusterwide Network Policy CRD
base config
controllerConfig
user-defined
network rules
reports firewall
state
send firewall log lines
controllerConfig
controllerConfig
 \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/firewall-for-capms-overview.svg b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/firewall-for-capms-overview.svg new file mode 100644 index 0000000..853f817 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP16/firewall-for-capms-overview.svg @@ -0,0 +1 @@ +
handles traffic
handles traffic
Firewall
Firewall
Firewall Controller
Firewall Controller
node-exporter
node-exporter
nftables-exporter
nftables-exporter
droptailer-client
droptailer-client
Workload Cluster
Workload Cluster
droptailer
droptailer
Configures
Configures
Bootstrap or Management Cluster
Bootstrap or Management Cluster
reconcile
reconcile
configures
configures
reconcile
reconcile
Cluster API Provider metal-stack
Cluster API Provider...
Metal Stack Cluster CRD
Metal Stack Cluster...
Firewall Deployment CRD
Firewall Deployment...
Firewall CRD
Firewall CRD
Firewall Set CRD
Firewall Set CRD
rec
rec
reconcile
reconcile
reconcile
reconcile
Firewall Controller Manager
Firewall Controller...
Metal Stack Machine CRD
Metal Stack Machine...
manages
manages
Admin
Admin
Kubeconfig FirewallMonitor
Kubeconfig FirewallMonitor
FirewallMonitor CRD
FirewallMonitor CRD
main metal-api
main metal-api
Firewall entity
Firewall entity
kubeconfig CWNP
kubeconfig CWNP
Clusterwide Network PolicyCRD
Clusterwide Network...
base config
base config
controllerConfig
controllerConfig
user-defined
network rules
user-defined...
reports firewall
state
reports firewall...
send firewall log lines
send firewall log lines
controllerConfig
controllerConfig
controllerConfig
controllerConfigText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP17/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP17/README.md new file mode 100644 index 0000000..35f4897 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP17/README.md @@ -0,0 +1,61 @@ +--- +slug: /MEP-17-global-network-view +title: MEP-17 +sidebar_position: 17 +--- + +# Global Network View + +> [!IMPORTANT] +> This MEP assumes the implementation of the metal-apiserver as described by [MEP-4](../MEP4/README.md) which is currently work in progress. + +Having a complete view of the network topology is useful when working with deployments or troubleshooting connectivity issues. +Currently, the API doesn't know of any other switches than the leaf switches. +Information about all other switches and their connections must be gathered from Ansible inventories or by accessing the switches via SSH. +Documentation of each partition's network must be kept in-sync with all changes made to the deployment or cabling. +We would like to expand the API's knowledge of the network to the entire underlay including inter-switch connections as well as BGP statistics and health status. + +## Switch Types + +Registering a switch at the API is done by the metal-core. +Apart from that, it also reconciles port and FRR configuration to adapt to the machine provisioning cycle. +This reconfiguration is only necessary on the leaf switches. +To allow deploying the metal-core on other switches than leaves we need a way of telling it what type of switch it is running on so it can act accordingly. +On any non-leaf switches it will only register the switch and report statistic but not change any configuration. +Supported switch types are + +- `leaf` +- `spine` +- `exit` +- `mgmtleaf` +- `mgmtspine` + +## Network Topology + +All switches should periodically report their LLDP neighbors and port configuration. +This information can be used to quickly identify common network issues, like MTU mismatch or the like. +Ideally, there would be some graphical representation of the network topology containing only the most important information for a quick overview. +It should contain all switches and machines as nodes and all connections as edges of a graph. +Ports, VRFs, and maybe also IPs should be associated with a connection. + +Apart from the topology graph, there should be a way to display more detailed information about both ports of a connection, like + +- MTU +- speed +- IP +- UP/DOWN status +- VRF +- VLAN +- whether it participates in a BGP session + +## BGP Announcements + +The metal-core should collect all routes it knows about and send them to the API along with a timestamp. +Reported routes should be stored to a redis database along with the switch that reported them and the timestamp of the last time they were reported. +An expiration threshold should be defined and all expired routes should be cleaned up periodically. +Whenever new routes are reported they get merged into the existing ones by the strategy: + +- when new, just add +- when existing, update `last_announced` timestamp + +By querying the BGP announcements we can find out whether an allocated IP is still in use. diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/README.md new file mode 100644 index 0000000..9c02c0b --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/README.md @@ -0,0 +1,147 @@ +--- +slug: /MEP-18-autonomous-control-plane +title: MEP-18 +sidebar_position: 18 +--- + +# Autonomous Control Plane + +As described in the [deployment chapter](../../../docs/04-For%20Operators/03-deployment-guide.mdx), we strongly recommend Kubernetes as the target platform for running the metal-stack control plane. + +Kubernetes clusters for this purpose are readily available from hyperscalers, metalstack.cloud, or other cloud providers. Simply using a managed Kubernetes cluster greatly simplifies a metal-stack installation. However, sometimes it might be desirable to host the metal-stack control plane autonomously, without the help of another cloud provider. Reasons for this might include corporate policies that prohibit the use of external data center products, or network constraints. + +The Kubernetes cluster hosting the metal-stack control plane must provide at least the following features: + +- Load balancing (for exposing the APIs) +- Persistent storage (for the databases and key-value stores) +- Access to object storage for automated backups of the stateful sets +- Access to a DNS provider supported by one of the used DNS extensions +- Externally accessible DNS records for obtaining officially signed certificates through DNS challenges + +This metal-stack control plane cluster must also be highly available to prevent a complete loss of control over the managed resources in the data center. +Regular Kubernetes updates to apply security fixes and feature updates must be possible in an automated manner. The Day-2 operational overhead of running this cluster in your own datacenter must be reasonable. + +In this chapter, we propose a solution for setting up a metal-stack environment with an autonomous control plane that is independent of another cloud provider. + +## Use Your Own Dogfood + +The most obvious solution is to just deploy a Kubernetes cluster manually in your own data center by utilizing existing tooling for the deployment: + +- k3s +- kubeadm +- vmware and rancher +- talos +- kubespray +- ... (not a complete list) + +However, all these solutions add another layer of complexity that needs to be maintained and operated by people who also need to learn and understand metal-stack. In general, metal-stack in combination with [Gardener](https://gardener.cloud) contains all the necessary tools to provide KaaS, so it makes sense to reuse what is already in place without introducing new dependencies on other products and vendors. + +The only problem here is that Gardener is not yet able to create an initial cluster, which may change with the implementation of [GEP-28](https://github.com/gardener/gardener/blob/master/docs/proposals/28-autonomous-shoot-clusters.md). In the meantime, we suggest using [k3s](https://k3s.io/), which manages the initial metal-stack partition to host the control plane, since the maintenance overhead is acceptable and it is easy to deploy. + +## The Matryoshka Principle + +Instead of directly using the K3s cluster for the production control plane, we propose using it as a minimal control plane cluster which only purpose is to host the production control plane cluster. This layer of indirection brings some reasonable advantages: + +- In the event of an interruption or loss of this minimal control plane cluster, the production control plane remains unaffected, and end users can continue to manage their clusters as normal. +- A dedicated operations team can take care of the Day-2 maintenance of this installation, which can be handy because the tools like k3s are a little different from the rest of the setup (it is likely that more manual maintenance is required than for any other cluster). This would also be true if the initial cluster problem would be solved by the Gardener itself and not using k3s. +- Since the number of shoot clusters to host is static, the resource requirements are minimal and will not change significantly over time. There are no huge resource requirements in terms of cpu, memory and storage. As such, the lack of scalability is not such a big issue. + +So, our proposal is to chain two metal-stack control planes. The initial control plane cluster would use k3s and on this cluster we can spin up a cluster for the production control plane with the use of Gardener. + +The following figure shows how the high-level architecture of this setup looks like. A even more simplified illustration of this setup can be looked up in the appendix[^1]. + +![Autonomous Control Plane Architecture](./autonomous-control-plane-images/metal-stack-autonomous-control-plane-full.svg) + +The k3s nodes can either be bare metal machines or virtual machines. When using VMs a single k3s node might be a viable solution, too. These nodes are supposed to be setup manually / partly automated with an operating system like Debian. + +To name the cluster that hosts the initial metal-stack control plane and Gardener we use the term _initial cluster_. The initial cluster creates worker nodes to host the _target cluster_. + +## Initial Cluster + +The initial cluster is kept very small. The physical bare metal machines can be any machines and switches which are supported by metal-stack, but can be smaller in terms of cpu, memory and network speed because these machines must only be capable of running the target cluster for the metal-stack control plane. A typical single socket server with 8-16 cores and 64GB of RAM and two NVMe drives of 1TB would be a good starting point. + +In a typical k3s setup, a stateful set would lose the data once the k3s cluster was terminated and started again. But there is a possibility to define parts of the local storage of the server to be provided to the k3s cluster for the PVCs. With that, k3s could be terminated and started again, for example to update and reboot the host os, or update k3s itself and the data will persist. + +Example k3s configuration for persistent storage on the hosts os: + +```yaml +k3s: Cluster +apiVersion: k3s.x-k8s.io/v1alpha4 +name: needle-control-plane +nodes: + - role: control-plane + # add a mount from /path/to/my/files on the host to /files on the node + extraMounts: + - hostPath: /path/to/my/files + containerPath: /files +``` + +Into this cluster metal-stack and Gardener will be deployed. This deployment can be done by a Gitlab runner which is running on this machine. +The mini-lab will be used as a base for this deployment. The current development of [gardener-in-minilab](https://github.com/metal-stack/mini-lab/pull/202) must be extended to host all required extensions to make this a working metal-stack control plane which can manage the machines in the attached bare metal setup. + +In addition to the metal-stack and Gardener deployment, some additional required services are deployed (non-complete list): + +- PowerDNS to serve as a DNS Server for all DNS entries used in the initial and the target cluster, like `api.initial.metal-stack.local`, `gardener-api.initial.metal-stack.local` and the DNS entries for the api servers of the created kubernetes clusters. +- NTP +- Monitoring for the initial cluster and partition +- Optional: OIDC Server for authenticating against the metal-api +- Optional: Container Registry to host all metal-stack and gardener containers +- Optional: Let's Encrypt [boulder](https://github.com/letsencrypt/boulder) as a certificate authority +- ... + +Physical view, minimal setup for a initial cluster with a single physical node: + +![Small Initial Cluster](autonomous-control-plane-images/small-initial-cluster.svg) + +Physical View, bigger ha setup which is spread across two data centers: + +![HA Initial Cluster](autonomous-control-plane-images/ha-initial-cluster.svg) + +### Control Plane High Availability + +Running the initial control plane on a single physical server is not as available as it should be in such a use case. It should be possible to survive a loss of this server, because the server could be lost by many events, such as hardware failure, disk corruption or even failure of the datacenter location where this server is deployed. + +Setting up a second server with the same software components is an option, but the problem of data redundancy must be solved, because neither the gardener control plane, nor the metal-stack control plane can be instantiated twice. + +Given that we provide part of the local storage of the server as backing storage for the stateful sets in the k3s cluster, the data stored on the server itself must be replicated to another server and backed up on a regular basis. + +The replication of ETCD can be achieved through [clustered configuration](https://docs.k3s.io/datastore/ha-embedded) of k3s. Components of metal-stack and Gardener can run standalone and already utilize backup-restore mechanism that must be configured accordingly. For two or more bare metal machine used for the initial cluster, a loadbalancing mechanism for the ingress is required. kube-vip could be a possible solution. + +For monitoring a backend like a Victoria Metrics Cluster would allow spearding the monitoring data across the initial cluster nodes. These metrics should also be backed up in object storage. + +### Partition + +The partition which is managed by the initial cluster can be a simple and small hardware setup but yet capable enough to host the target cluster. It would even be a good practice to create separate target clusters on the initial cluster, e.g. one for the metal-stack control plane and one for the Gardener (maybe one more for monitoring). + +It can follow the metal-stack minimal setup which provides about 8-16 small servers connected to a 1G/s or 10G/s network dataplane. Central storage is optional as the persistence of the services running in these clusters is always backed up to a central object storage. Operations would be much easier if a central storage is provided. + +## Target Cluster + +The target cluster is the metal-stack environment which serves for end-user production use, the control plane is running in a shoot hosted in the initial cluster. The seed(s) and shoot(s) for end-users are created on the machines provided by the target cluster. +These machines can be of a different type in terms of size, but more importantly, these machines are connected to another network dataplane. Also the management infrastructure is separated from the initial cluster management network. + +## Failure Scenarios + +Everything could fail, everything will fail at some point. But this must kept in mind and nothing bad should happen if only one component at a time fails. +If more than one fails, the restoration to a working state must be easily possible and well documented. + +To ensure all possible breakages are documented, we suggest writing a list which summarizes all failure scenarios that might occur including the remediation. + +Here is an example of how a scenario documentation could look like: + +**Scenario**: Initial cluster is gone, all machines have died +**Impact**: Management of the initial cluster infrastructure not possible anymore, the target cluster continues to run but cannot be managed because the API servers are gone. end-users are not affected by this incident. +**Remediation**: The initial cluster nodes must be provisioned from scratch and re-deployed through the CI mechanism. The backups of the stateful sets are automatically restored during this process. + +## Implementation + +As part of this proposal, we provide the following tools and integrations in order to setup an autonomous control plane: + +- Deployment roles for the services like PowerDNS and NTP for the initial cluster +- Stretch goal: Deployment role to setup k3s in clustered configuration for the initial cluster and update it +- Extend the Gardener on mini-lab integration to allow shoot creation in the mini-lab +- Steady integration of the setup (maybe something like [k3d](https://github.com/k3d-io/k3d) in the mini-lab) + +## Appendix + +[^1]: ![metal-stack-chain](autonomous-control-plane-images/metal-stack-chain.svg) diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/ha-initial-cluster.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/ha-initial-cluster.drawio new file mode 100644 index 0000000..eafcb51 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/ha-initial-cluster.drawio @@ -0,0 +1,535 @@ + + + + + + + + + + + + + + + + + + + 1 + + + + + 2 + + + + + 3 + + + + + 4 + + + + + 5 + + + + + 6 + + + + + 7 + + + + + 8 + + + + + 9 + + + + + 10 + + + + + 11 + + + + + 12 + + + + + + + + + + + + + +
+
+
+ internet-router-management +
+
+
+ + + internet-router-management + + + + + + + + + + + + + +
+
+
+ management-switch-and-server +
+
+
+ + + management-switch-and-server + + + + + + + + + + + + + +
+
+
+ spine01 +
+
+
+ + + spine01 + + + + + + + + + + + + + +
+
+
+ leaf01 +
+
+
+ + + leaf01 + + + + + + + + + + + + + +
+
+
+ leaf02 +
+
+
+ + + leaf02 + + + + + + + + + + + + + + + + + +
+
+
+ + mirocloud (initial cluster partition nodes) + +
+
+
+ + + mirocloud (initial cluster... + + + + + + + + + + + + + + + + + +
+
+
+ + Initial cluster node 01 + +
+
+
+ + + Initial cluster node 01 + + + + + + + + + + + + + + + + + 1 + + + + + 2 + + + + + 3 + + + + + 4 + + + + + 5 + + + + + 6 + + + + + 7 + + + + + 8 + + + + + 9 + + + + + 10 + + + + + 11 + + + + + 12 + + + + + + + + + + + + + +
+
+
+ internet-router-management +
+
+
+ + + internet-router-management + + + + + + + + + + + + + +
+
+
+ management-switch-and-server +
+
+
+ + + management-switch-and-server + + + + + + + + + + + + + +
+
+
+ spine02 +
+
+
+ + + spine02 + + + + + + + + + + + + + +
+
+
+ leaf03 +
+
+
+ + + leaf03 + + + + + + + + + + + + + +
+
+
+ leaf04 +
+
+
+ + + leaf04 + + + + + + + + + + + + + + + + + +
+
+
+ + Initial cluster node 02 + +
+
+
+ + + Initial cluster node 02 + + + + + + + + + + + + + + + + + +
+
+
+ + Initial cluster node 03 + +
+
+
+ + + Initial cluster node 03 + + + + + + + + + + + + + + + + + +
+
+
+ + mirocloud (initial cluster partition nodes) + +
+
+
+ + + mirocloud (initial cluster... + + + + + + + + + + Text is not SVG - cannot display + + + + diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/ha-initial-cluster.svg b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/ha-initial-cluster.svg new file mode 100644 index 0000000..99261ad --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/ha-initial-cluster.svg @@ -0,0 +1 @@ +123456789101112
internet-router-management
internet-router-management
management-switch-and-server
management-switch-and-server
spine01
spine01
leaf01
leaf01
leaf02
leaf02
mirocloud (initial cluster partition nodes)
mirocloud (initial cluster...
Initial cluster node 01
Initial cluster node 01123456789101112
internet-router-management
internet-router-management
management-switch-and-server
management-switch-and-server
spine02
spine02
leaf03
leaf03
leaf04
leaf04
Initial cluster node 02
Initial cluster node 02
Initial cluster node 03
Initial cluster node 03
mirocloud (initial cluster partition nodes)
mirocloud (initial cluster...Text is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-autonomous-control-plane-full.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-autonomous-control-plane-full.drawio new file mode 100644 index 0000000..aae8a12 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-autonomous-control-plane-full.drawio @@ -0,0 +1,1133 @@ + + + + + + + + + + + + + + + + + + + +
+
+
+ Initial Cluster +
+
+
+ + + Initial Cluster + + + + + + + + + + + + + + + + + + +
+
+
+ metal-roles +
+
+
+ + + metal-roles + + + + + + + + + + + +
+
+
+ CI +
+
+
+ + + CI + + + + + + + + + + + +
+
+
+ K3s Standalone + + + (on Debian) + + +
+
+
+ + + K3s Standalone (on Debian) + + + + + + + + + + + + + + + + + + + + + +
+
+
+ Initial Partition +
+
+
+ + + Initial Partition + + + + + + + + + + + + + + + + + +
+
+
+ Target Cluster for metal-stack +
+
+
+ + + Target Cluster for metal-stack + + + + + + + + + + + + + + + + + +
+
+
+ Metal Control Plane +
+
+
+ + + Metal Control Plane + + + + + + + + + + + + + + + +
+
+
+ provisions +
+
+
+ + + provisions + + + + + + + + + + + + + + + + + +
+
+
+ Target Cluster for Gardener +
+
+
+ + + Target Cluster for Gardener + + + + + + + + + + + + + + +
+
+
+ Gardener Control Plane +
+
+
+ + + Gardener Control Plane + + + + + + + + + + + + + + + + + + + + + +
+
+
+ Monitoring +
+
+
+ + + Monitoring + + + + + + + + + + + + + + + + + + + + +
+
+
+ Target Partition +
+
+
+ + + Target Partition + + + + + + + + + + + + + + +
+
+
+ Gardener Seeds and End-User Shoots +
+
+
+ + + Gardener Seeds and End-User Shoots + + + + + + + + + + + + + + + +
+
+
+ provisions +
+
+
+ + + provisions + + + + + + + + + + + + +
+
+
+ metal-roles +
+
+
+ + + metal-roles + + + + + + + + + + + +
+
+
+ CI +
+
+
+ + + CI + + + + + + + + + + + + +
+
+
+ metal-roles +
+
+
+ + + metal-roles + + + + + + + + + + + + + + +
+
+
+ ETCD can be clustered or standalone, backed up by sidecar +
+
+
+ + + ETCD can be clustere... + + + + + + + + + + + + + + +
+
+
+ This data will get lost in case local PV gets deleted +
+
+
+ + + This data will get l... + + + + + + + + + + + + + + +
+
+
+ We can work with local PVs here, too. +
+ backup-restore-sidecar for metal-stack databases, for big ones Postgres clustered. +
+
+
+ + + We can work with local PVs he... + + + + + + + + + + + +
+
+
+ ETCD will be deployed in HA configuration on local PVs. +
+
+ csi-driver-lvm needs to implement auto deletion of orphaned PVs. +
+
+ Seed metrics get lost, but they report to the monitoring in the Metal Control Plane Shoot. +
+
+
+ + + ETCD will be deployed in HA c... + + + + + + + + + + + + + + +
+
+
+ More sophisticated storage solutions can be in place. +
+
+ (Lightbits, NetApp, ...) +
+
+
+ + + More sophisticated storage so... + + + + + + + + + + + + + + +
+
+
+ TODO: Evaluate how to persist these metrics. +
+
+
+ + + TODO: Evaluate how to persist... + + + + + + + + + + + + + + +
+
+
+ + 1 VM or +
+ +
+ + + 3 Bare Metal Machines + + +
+
+
+
+ + + 1 VM or... + + + + + + + + + + + + + + + + + + +
+
+
+ metal-stack +
+
+
+ + + metal-stack + + + + + + + + + + + +
+
+
+ metal-api +
+
+
+ + + metal-api + + + + + + + + + + + +
+
+
+ metal-db +
+
+
+ + + metal-db + + + + + + + + + + + +
+
+
+ ipam-db +
+
+
+ + + ipam-db + + + + + + + + + + + +
+
+
+ masterdata-db +
+
+
+ + + masterdata-db + + + + + + + + + + + +
+
+
+ headscale-db +
+
+
+ + + headscale-db + + + + + + + + + + + +
+
+
+ auditing-db +
+
+
+ + + auditing-db + + + + + + + + + + + +
+
+
+ nsqd +
+
+
+ + + nsqd + + + + + + + + + + + + + + + +
+
+
+ Gardener +
+
+
+ + + Gardener + + + + + + + + + + + + + + +
+
+
+ Virtual Garden +
+
+
+ + + Virtual Garden + + + + + + + + + + + +
+
+
+ Gardener Control Plane +
+
+
+ + + Gardener Control Plane + + + + + + + + + + + +
+
+
+ gardenlet +
+
+
+ + + gardenlet + + + + + + + + + + + +
+
+
+ Garden etcd +
+
+
+ + + Garden etcd + + + + + + + + + + + +
+
+
+ Prometheus +
+
+
+ + + Prometheus + + + + + + + + + + + + + + + +
+
+
+ Monitoring +
+
+
+ + + Monitoring + + + + + + + + + + + + + + +
+
+
+ + Gitlab + +
+ + Runner + +
+
+
+
+ + + Gitlab... + + + + + + + + + + + + + + +
+
+
+ Services +
+
+
+ + + Services + + + + + + + + + + + +
+
+
+ PowerDNS +
+
+
+ + + PowerDNS + + + + + + + + + + + +
+
+
+ boulder +
+
+
+ + + boulder + + + + + + + + + + + +
+
+
+ NTP +
+
+
+ + + NTP + + + + + + + + + + + +
+
+
+ OIDC +
+
+
+ + + OIDC + + + + + + + + + + + +
+
+
+ ... +
+
+
+ + + ... + + + + + + + + + + Text is not SVG - cannot display + + + + diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-autonomous-control-plane-full.svg b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-autonomous-control-plane-full.svg new file mode 100644 index 0000000..e58e783 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-autonomous-control-plane-full.svg @@ -0,0 +1 @@ +
Initial Cluster
Initial Cluster
metal-roles
metal-roles
CI
CI
K3s Standalone(on Debian)
K3s Standalone (on Debian)
Initial Partition
Initial Partition
Target Cluster for metal-stack
Target Cluster for metal-stack
Metal Control Plane
Metal Control Plane
provisions
provisions
Target Cluster for Gardener
Target Cluster for Gardener
Gardener Control Plane
Gardener Control Plane
Monitoring
Monitoring
Target Partition
Target Partition
Gardener Seeds and End-User Shoots
Gardener Seeds and End-User Shoots
provisions
provisions
metal-roles
metal-roles
CI
CI
metal-roles
metal-roles
ETCD can be clustered or standalone, backed up by sidecar
ETCD can be clustere...
This data will get lost in case local PV gets deleted
This data will get l...
We can work with local PVs here, too.
backup-restore-sidecar for metal-stack databases, for big ones Postgres clustered.
We can work with local PVs he...
ETCD will be deployed in HA configuration on local PVs.

csi-driver-lvm needs to implement auto deletion of orphaned PVs.

Seed metrics get lost, but they report to the monitoring in the Metal Control Plane Shoot.
ETCD will be deployed in HA c...
More sophisticated storage solutions can be in place.

(Lightbits, NetApp, ...)
More sophisticated storage so...
TODO: Evaluate how to persist these metrics.
TODO: Evaluate how to persist...
1 VM or
3 Bare Metal Machines
1 VM or...
metal-stack
metal-stack
metal-api
metal-api
metal-db
metal-db
ipam-db
ipam-db
masterdata-db
masterdata-db
headscale-db
headscale-db
auditing-db
auditing-db
nsqd
nsqd
Gardener
Gardener
Virtual Garden
Virtual Garden
Gardener Control Plane
Gardener Control Plane
gardenlet
gardenlet
Garden etcd
Garden etcd
Prometheus
Prometheus
Monitoring
Monitoring
Gitlab
Runner
Gitlab...
Services
Services
PowerDNS
PowerDNS
boulder
boulder
NTP
NTP
OIDC
OIDC
...
...Text is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-chain.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-chain.drawio new file mode 100644 index 0000000..cd5cf00 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-chain.drawio @@ -0,0 +1,404 @@ + + + + + + + + + + +
+
+
+ Partition 1 +
+
+
+ + + Partition 1 + + + + + + + +
+
+
+ seeds +
+
+
+ + + seeds + + + + + + + +
+
+
+ shoots +
+
+
+ + + shoots + + + + + + + + + +
+
+
+ Partition 2 +
+
+
+ + + Partition 2 + + + + + + + +
+
+
+ seeds +
+
+
+ + + seeds + + + + + + + +
+
+
+ shoots +
+
+
+ + + shoots + + + + + + + + + +
+
+
+ Partition 3 +
+
+
+ + + Partition 3 + + + + + + + +
+
+
+ seeds +
+
+
+ + + seeds + + + + + + + +
+
+
+ shoots +
+
+
+ + + shoots + + + + + + + + + +
+
+
+ Production Control Plane +
+
+
+ + + Production Control Plane + + + + + + + +
+
+
+ metal-stack +
+ kubernetes cluster +
+
+
+ + + metal-stack... + + + + + + + +
+
+
+ gardener +
+ kubernetes cluster +
+
+
+ + + gardener... + + + + + + + +
+
+
+ + Manages + +
+
+
+ + + Manages + + + + + + + + + + + +
+
+
+ Control Plane Partition +
+
+
+ + + Control Plane Partition + + + + + + + + +
+
+
+ backup of stateful sets +
+
+
+ + + backup of stateful sets + + + + + + + + + +
+
+
+ bare metal machine +
+
+
+ + + bare metal machine + + + + + + + +
+
+
+ metal-stack +
+ and +
+ gardener +
+ kubernetes cluster +
+ running in kind +
+
+
+ + + metal-stack... + + + + + + + +
+
+
+ + Manages + +
+
+
+ + + Manages + + + + + + + + +
+
+
+ S3 +
+
+
+ + + S3 + + + + + + + +
+
+
+ Needle +
+
+
+ + + Needle + + + + + + +
+
+
+ + Nail + +
+
+
+ + + Nail + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-chain.svg b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-chain.svg new file mode 100644 index 0000000..8f88ba1 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/metal-stack-chain.svg @@ -0,0 +1 @@ +
Partition 1
Partition 1
seeds
seeds
shoots
shoots
Partition 2
Partition 2
seeds
seeds
shoots
shoots
Partition 3
Partition 3
seeds
seeds
shoots
shoots
Production Control Plane
Production Control Plane
metal-stack
kubernetes cluster
metal-stack...
gardener
kubernetes cluster
gardener...
Manages
Manages
Control Plane Partition
Control Plane Partition
backup of stateful sets
backup of stateful sets
bare metal machine
bare metal machine
metal-stack
and
gardener
kubernetes cluster
running in kind
metal-stack...
Manages
Manages
S3
S3
Needle
Needle 
Nail
NailText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/small-initial-cluster.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/small-initial-cluster.drawio new file mode 100644 index 0000000..a75ee34 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/small-initial-cluster.drawio @@ -0,0 +1,234 @@ + + + + + + + + + + + + + + + + + + + 1 + + + + + 2 + + + + + 3 + + + + + 4 + + + + + 5 + + + + + 6 + + + + + 7 + + + + + 8 + + + + + 9 + + + + + 10 + + + + + 11 + + + + + 12 + + + + + + + + + + + + + +
+
+
+ internet-router-management +
+
+
+ + + internet-router-management + + + + + + + + + + + + + +
+
+
+ management-switch-and-server +
+
+
+ + + management-switch-and-server + + + + + + + + + + + + + +
+
+
+ leaf01 +
+
+
+ + + leaf01 + + + + + + + + + + + + + +
+
+
+ leaf02 +
+
+
+ + + leaf02 + + + + + + + + + + + + + + + + + +
+
+
+ Initial cluster node +
+
+
+ + + Initial cluster node + + + + + + + + + + + + + + + + + +
+
+
+ mirocloud (initial cluster partition nodes) +
+
+
+ + + mirocloud (initial cluster... + + + + + + + + + + Text is not SVG - cannot display + + + + diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/small-initial-cluster.svg b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/small-initial-cluster.svg new file mode 100644 index 0000000..a9d29f0 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP18/autonomous-control-plane-images/small-initial-cluster.svg @@ -0,0 +1 @@ +123456789101112
internet-router-management
internet-router-management
management-switch-and-server
management-switch-and-server
leaf01
leaf01
leaf02
leaf02
Initial cluster node
Initial cluster node
mirocloud (initial cluster partition nodes)
mirocloud (initial cluster...Text is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP2/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP2/README.md new file mode 100644 index 0000000..c7f2360 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP2/README.md @@ -0,0 +1,7 @@ +--- +slug: /MEP-2-two-factor-authentication +title: MEP-2 +sidebar_position: 2 +--- + +# Two Factor Authentication diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP3/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP3/README.md new file mode 100644 index 0000000..5ce3672 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP3/README.md @@ -0,0 +1,67 @@ +--- +slug: /MEP-3-machine-re-installation +title: MEP-3 +sidebar_position: 3 +--- + +# Machine Re-Installation + +In the current metal-api only machine installations are possible, performing a machine upgrade is only possible by creating a new machine and delete the old one. +This has the drawback that in case a lot of data is stored on the local disks, a full restore of the original data must be performed. + +To prevent this, we will introduce a new metal-api endpoint to reinstall the machine with a new image, _without_ actually deleting the data stored on the additional hard disks. + +Storage is a difficult task to get right and reliable. A short analysis of our different storage requirements lead to 3 different scenarios. + +- Storage for the etcd pvs in the seed cluster of every partition. + This is the most important storage in our setup because these etcd pods serve as configuration backend for all customer kubernetes clusters. If they fail, the cluster is down. However gardener deploys a backup and restore sidecar into the etcd pod of every customer kubernetes control plane, and if this sidecar detects a corrupt or missing etcd database file(s) it starts automatic restore from the configured backup location. This will take some minutes. If for example a node dies, and gardener creates a new node instead, the csi-lvm created pv is not present on that node. Kubernetes will not schedule the missing etcd pod on this node because it has a local PV configured and is therefore tainted to run only on that node. To let kubernetes create that pod anyhow, someone has to either remove the taint, or delete the pod. If this is done, the pod starts and the restore of the etcd data can start as well. You can see this is a bit too complicated and will take the customer cluster down for a while (not measured yet but in the range of 5-10 minutes). +- Storage in customer clusters. + This was not promised in 2020. We have a intermediate solution with the provisioning of csi-lvm by default into all customer clusters. Albeit this is only local storage and will get deleted if a node dies. +- S3 Storage. + We have two possibilities to cope with storage: + - In place update of the OS with a daemonset + This will be fast and simple, but might fail because the packages being installed are broken right now, or a filesystem gets full, or any other failure you can think of during a os update. Another drawback is that metal-api does not reflect the updated os image. + - metal-api get a machine reinstall endpoint + With this approach we leverage from existing and already proven mechanisms. Reinstall must keep all data except the sata-dom. Gardener currently is not able to do an update with this approach because it can only do `rolling` updates. Therefore a additional `osupdatestrategy` has to be implemented for metal and other providers in gardener to be able to leverage the metal reinstall on the same machineID approach. + +If reinstall is implemented, we should focus on the same technology for all scenarios and put ceph via rook.io into the kubernetes clusters as additional StorageClass. It has to be checked whether to use the raw disk or a PV as the underlay block device where ceph stores its data. + +## API and behavior + +The API will get an new endpoint "reinstall" this endpoint takes two arguments: + +- machineID +- image + +No other aspects of the machine can be modified during the re-installation. All data stored in the existing allocation will be preserved, only the image will be modified. +Once this endpoint was called, the machine will get a `reboot` signal with the boot order set to PXE instead of HDD and the network interfaces on the leaf are set to PXE as well. Then the normal installation process starts: + +- unchanged: PXE boot with metal-hammer +- changed: metal-hammer first checks with the machineID in the metal-api (through metal-core) if there is already a allocation present +- changed: if a allocation is present and the allocation has set `reinstall: true`, wipe disk is only executed for the root disk, all other disks are untouched. +- unchanged: the specified image is downloaded and burned, `/install.sh` is executed +- unchanged: successful installation is reported back, network is set the the vrf, boot order is set to HDD. +- unchanged: distribution kernel is booted via kexec + +We can see that the `allocation` requires one additional parameter: `reinstall` and metal-hammer must check for already existing allocation at an earlier stage. + +Components which requires modifications (first guess): + +- metal-hammer: + - check for allocation present earlier + - evaluation of `reinstall` flag set + - wipe of disks depends on that flag + - Bonus: move configuration of disk layout and primary disk detection algorithm (PDDA) from metal-hammer into metal-api. + metal-api **MUST** reject reinstallation if the disk found by PDDA does not have the `/etc/metal` directory! +- metal-core: + - probably nothing +- metal-api: + - new endpoint `/machine/reinstall` + - add `Reinstall bool` to data model of `allocation` + - make sure to reset `Reinstall` after reinstallation to prevent endless reinstallation loop +- metalctl: + - implement `reinstall` +- metal-go: + - implement `reinstall` +- gardener (longterm): + - add the `OSUpgradeStrategy` `reinstall` diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP4/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP4/README.md new file mode 100644 index 0000000..389a02d --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP4/README.md @@ -0,0 +1,211 @@ +--- +slug: /MEP-4-multi-tenancy-for-the-metal-api +title: MEP-4 +sidebar_position: 4 +--- + +# Multi-Tenancy for the metal-api +:::info +This document is work in progress. +::: + +In the past we decided to treat the metal-api as a "low-level API", i.e. the API does not specifically deal with projects and tenants. A user with editor access can for example assign machines to every project he desires, he can see all the machines available and can control them. We tried to keep the metal-api code base as small as possible and we added resource scoping to a "higher-level APIs". From there, a user would be able to only see his own clusters and IP addresses. + +As time passed metal-stack has become an open-source project and people are willing to adopt. Adopters who want to put their own technologies on top of the metal-stack infrastructure don't have those "higher-level APIs" that we implemented closed-source for our user base. So, external adopters most likely need to implement resource scoping on their own. + +Introducing multi-tenancy to the metal-api is a serious chance of making our product better and more successful as it opens the door for: + +- Becoming a "fully-featured" API +- Narrowing down attack surfaces and possibility of unintended resource modification produced by bugs or human errors +- Discouraging people to implement their own scoping layers in front of the metal-stack +- Gaining performance through resource scopes +- Letting untrusted / third-parties work with the API + +## Requirements + +These are some general requirements / higher objectives that MEP-4 has to fulfill. + +- Should be able to run with mini-lab without requiring to setup complex auth backends (dex, LDAP, keycloak, ...) + - Simple to start with, more complex options for production setups +- Fine-grained access permissions (every endpoint maps to a permission) +- Tenant scoping (disallow resource access to resources of other tenants) +- Project scoping (disallow resource access to resources of other projects) +- Access tokens in self-service for technical user access + +## Implementation + +We gathered a lot of knowledge while implementing a multi-tenancy-capable backend for metalstack.cloud. The goal is now to use the same technology and adopt that to the metal-api, this includes: + +- gRPC in combination with connectrpc +- OPA for making auth decisions +- REST HTTP only for OIDC login flows + +### API Definitions + +The API definitions should be located on a separate Github repository separate from the server implementation. The proposed repository location is: https://github.com/metal-stack/api. + +This repository contains the `proto3` specification of the exposed metal-stack api. This includes the messages, simple validations, services and the access permission to these services. The input parameters for the authorization in the backend are generated from the `proto3` annotations. + +Client implementations for the most relevant languages (go, python) are generated automatically. + +This api is divided into end-user and admin access at the top level. The proposed APIs are: + +- `metalstack.api.v2`: For end-user facing services +- `metalstack.admin.v2`: For operators and controllers which need access to unscoped entities + +The methods of the API can have different role scopes (and can be narrowed down further with fine-grained method permissions): + +- `tenant`: Tenant-scoped methods, e.g. project creation (tenant needs to be provided in the request payload) + - Available roles: VIEWER, EDITOR, OWNER +- `project`: Project-scoped methods, e.g. machine creation (tenant needs to be provided in the request payload) + - Available roles: VIEWER, EDITOR, OWNER +- `admin` Admin-scoped methods, e.g. unscoped tenant list or switch register + - Available roles: VIEWER, EDITOR + +And has methods with different visibility scopes: + +- `self`: Methods that only the logged in user can access, e.g. show permissions with the presented token +- `public`: Methods that do not require any specific authorization + +### API + +The API server implements the services defined in the API and validates access to a method using OPA with the JWT tokens passed in the requests. The server is implemented using the connectrpc.com framework. + +The API server implements the login flow through OIDC. After successful authentication, the API server derives user permissions from the OIDC provider and issues a new JWT token which is passed on to the user. The tokens including the permissions are stored in a redis compatible backend. + +With these tokens, users can create Access Tokens for CI/CD or other use cases. + +JWT Tokens can be revoked by admins and the user itself. + +### API Server + +Is put into a new github repo which implements the services defined in the `api` repository. It opens a `https` endpoints where the grpc (via connectrpc.com) and oidc services are exposed. + +### Migration of the Consumers + +To allow consumers to migrate to the `v2` API gradually, both apis, the new and the old, are deployed in parallel. In the control-plane both apis are deployed side-by-side behind the ingress. `api.example.com` is forwarded to `metal-api` and `metal.example.com` is forwarded to the new `metal-apiserver`. + +The api-server will talk to the existing metal-api during the process of migration services away to the new grpc api. + +The migration process can be done in the following manner: + +for each resource in the metal-api: + +- create a new proto3 based definition in the `api` repo. +- implement the business logic per service in the new `metal-apiserver` without calling the metal-api. +- clients must be able to talk to `v1` and `v2` backend in parallel +- Deprecate the already migrated service in the swagger route to notify the client that this route should not be used anymore. +- identify all consumers of this resource and replace them to use the grpc instead of the rest api +- move the business logic incl. the backend calls to ipam, metal-db, masterdata-api, nsq for this resource from the metal-api to the `metal-apiserver` + +We will migrate the rethinkdb backend implementation to a generic approach during this effort. + +- Try to enhance the generic rethinkdb interface with `project` scoped methods. + +There are a lot of consumers of metal-api, which need to be migrated: + +- ansible +- firewall-controller +- firewall-controller-manager +- gardener-extension-auth +- gardener-extension-provider-metal + - Do not point the secret bindings to a the shared provider secret in the seed anymore. Instead, use individual provider-secret containing project-scoped API access tokens in the Gardener project namespaces. +- machine-controller-manager-provider-metal +- metal-ccm +- metal-console +- metal-bmc +- metal-core +- metal-hammer +- metal-image-cache-sync +- metal-images +- metal-metrics-exporter +- metal-networker +- metalctl +- pixie + +## User Scenarios + +This section gathers a collection of workflows from the perspective of a user that we want to provide with the implementation of this proposal. + +### Machine Creation + +A regular user wants to create a machine resource. + +Requirements: Project was created, permissions are present + +- The user can see networks that were provided by the admin. + + ``` + $ metalctl network ls + ID NAME PROJECT PARTITION NAT SHARED PREFIXES IPS + internet Internet Network true false 212.34.83.0/27  ● + tenant-super-network-fra-equ01 Project Super Network fra-equ01 false false 10.128.0.0/14  ● + underlay-fra-equ01 Underlay Network fra-equ01 false false 10.0.0.0/16  ● + ``` + +- The user has to set the project scope first or provide `--project` flags for all commands. + ``` + $ metalctl project set 793bb6cd-8b46-479d-9209-0fedca428fe1 + You are now acting on project 793bb6cd-8b46-479d-9209-0fedca428fe1. + ``` +- The user can create the child network required for machine allocation. + ``` + $ metalctl network allocate --partition fra-equ01 --name test + ``` +- Now, the user sees his own child network. + ``` + $ metalctl network ls + ID NAME PROJECT PARTITION NAT SHARED PREFIXES IPS + internet Internet Network true false 212.34.83.0/27  ● + tenant-super-network-fra-equ01 Project Super Network fra-equ01 false false 10.128.0.0/14  ● + └─╴08b9114b-ec47-4697-b402-a11421788dc6 test 793bb6cd-8b46-479d-9209-0fedca428fe1 fra-equ01 false false 10.128.64.0/22  ● + underlay-fra-equ01 Underlay Network fra-equ01 false false 10.0.0.0/16  ● + ``` +- The user does not see any machines yet. + ``` + $ metalctl machine ls + ``` +- The user can create a machine. + ``` + $ metalctl machine create --networks internet,08b9114b-ec47-4697-b402-a11421788dc6 --name test --hostname test --image ubuntu-20.04 --partition fra-equ01 --size c1-xlarge-x86` + ``` +- The machine will now be provisioned. + ``` + $ metalctl machine ls + ID LAST EVENT WHEN AGE HOSTNAME PROJECT SIZE IMAGE PARTITION + 00000000-0000-0000-0000-ac1f6b7befb2 Phoned Home 20s 50d 4h test 793bb6cd-8b46-479d-9209-0fedca428fe1 c1-xlarge-x86 Ubuntu 20.04 20210415 fra-equ01 + ``` + +:::warning +A user **cannot** list all allocated machines for all projects. The user **must** always switch project context first and can only view the machines inside this project. Only admins can see all machines at once. +::: +### Scopes for Resources + +The admins / operators of the metal-stack should be able to provide _global_ resources that users are able to use along with their own resources. In particular, users can view and use _global_ resources, but they are not allowed to create, modify or delete them. + +:::info +When a project ID field is empty on a resource, the resource is considered _global_. +::: + +Where possible, users should be capable of creating their own resource entities. + +| Resource | User | Global | +| :----------------- | :--- | :----- | +| File System Layout | yes | yes | +| Firewall | yes | | +| Firmware | | yes | +| OS Image | | yes | +| Machine | yes | | +| Network (Base) | | yes | +| Network (Children) | yes | | +| IP | yes | | +| Partition | | yes | +| Project | yes | | +| Project Token | yes | | +| Size | | yes | +| Switch | | | +| Tenant | | yes | + +:::info +Example: A user can make use of the file system layouts provided by the admins, but can also create own layouts. Same applies for images. As soon as a user creates own resources, the user takes over the responsibility for the machine provisioning to succeed. +::: diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/README.md new file mode 100644 index 0000000..3b7fc45 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/README.md @@ -0,0 +1,54 @@ +--- +slug: /MEP-5-shared-networks +title: MEP-5 +sidebar_position: 5 +--- + +# Shared Networks + +## Why are shared networks needed + +For special purpose machines that serve shared services with performance critical workloads to all machines of a partition (like persistent storage) it would be good to have kind of a "shared network" that is easily accessible. +They do not necessarily need another firewall. This would avoid having two firewalls in the datapath between a machine in a private network and the machines of a shared service. + +## Constraints that need to hold + +- a shared network is usable from all machines that have a firewall in front, that uses it +- a shared network is only usable within a single partition (currently we are constrained in bandwidth and have no routing of 10.0.0.0/8 addresses btw. partitions and failure domain should be the partition but this constraint might get lifted in the future) +- networks may be marked as shared after network allocation (but there should be no way back from shared to unshared) +- neither machines nor firewalls may have multiple private, unshared networks configured +- machines must have a single primary network configured + - this might be a shared network + - OR a plain, unshared private network +- firewalls may participate in multiple shared networks +- machines can be allocated with a primary network using auto IP allocation or with `noauto` and a specific IP + +## Should shared networks be private + +**Alternative 1:** If we implemented shared networks by extending functions around plain, private networks we would not have to manage another CIDR (mini point) and it would be possible to create a k8s cluster with a private network, mark the network as `shared` and produce shared services from this k8s cluster. + +**Alternative 2:** If shared networks are implemented as first class networks we could customize the VRF and also accomplish an other goal of our roadmap: being able to create machines directly in an external network. + +Together with @majst01 and @Gerrit91 we decided to continue to implement **Alternative 1**. + +## Firewalls accessing a shared network + +Firewalls that access shared networks need to: + +- hide the private network behind an ip address of the shared network if the shared network was configured with `nat=true`. +- import the prefixes of the shared VRF to the private VRF and import the prefixes of the private VRF to the shared VRF so that the communication between the two is working in both directions. As long as no `nat=true` was set on the shared VRF, the original machine ips are visible in both communication directions. + +## Setup with shared networks and single consumer + +![Simple Setup](./shared.png) + +## Setup with single shared network and multiple consumers + +![Advanced Setup](./shared_advanced.png) + +## Getting internet access + +Machines contained in a shared network can access the internet with different scenarios: + +- if they have an own firewall: this is internet accessibility, as common (check whether all traffic gets routed through it!) +- if they don't have an own firewall, an external HTTP proxy is needed that has an endpoint exposed as Service Type NodePort diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared.drawio new file mode 100644 index 0000000..aa7af04 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared.drawio @@ -0,0 +1,121 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared.png b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared.png new file mode 100644 index 0000000000000000000000000000000000000000..b0b47f0324545ec159effc46f153a9b5b0c2450b GIT binary patch literal 49790 zcmeEu1zc6x+V`OZ4ygiyBB6sIB@GAZ6lv*}?mBcygGj5CbV#RkNJt7wsURqVG@^t^ zNqy@e$3dOB@7#OmeZTwuzHi1k?!DGtYp?Y@&-y>PCqzL`5)XP73V}fIq^^nGfIv`T z5D1Di)(OzUv5?FQfpGOYimN+XyPB9=8AE8;MZaCqu(6ogIylm>i_x&L8M5)P>vM9j zF&T34a58b|bD1!~40#NgIC%_MdDyu)OpNr|!DC>IwXKo4iMg@Sw{dJNY%ENy;15ih zm6e8Fn4JauaB?!kSU5GmJ+E(SY;*JyPG%M`0i8PHNfB@*V{YT*3jTKG;nL&cxD2j@ z?d+_K)r<|K%^hjjBskf*nc2AzL!_@M%gWHOiGph@b4z3Jm!z?wr7dEJsI3vWmtbY) zWMO7S+?&B|tr0Ce?94389IPzt%&dnC7q>DtbcEa5fG!v_+u^fH`X>5t^J8y9Y|z+I z-}Kw&EG1oGcEYTR4h9aQcGpc+&3UZA3J}jY8^ayU!BmH|V`XRNV&+72u!{rg8ky^x z!u74eQ|3oRQqgl$V!Cc`p>Ja#%%2GIu|kp7m&)sgt>pvBS~2 zzm0UXwY73IxBIct(ALHVkn4vB_2F<^mmeQ9v9&tdbe6C%xa-5C1N%|9AipgF{Ksw{kk#o2H!62!jWB>;T*#`;e2^+Bt%wtpELeV8!3& z`|%y1`Ph5^9TpquJD44c1A^aw&exwLL0niuLL3H0AciaGJ31P}5%>cb%Yu*(#FCFm z2iM_0p#5)<4p!LzJ@Gg~w`1a=WCkSN2<%$*h6MNpZ2fn5@e`5%XO0^y+m8fgN8TSh zZ>&hf{<{wx(5DE39i!+k6g0Lm5=LM>5HA~B0BAn|6o5y#n>y%XVP@k5U5ED?hmv@7 zBZfc~1k@dNi6KA*ardW^=%^1jH3p{@VTT;?+t}y_HS#NP9itRdcN`}avJGx*rSE9& zd<4)(xcEnKb@T=WTk}ICL82y-F+T$%ata4qC%B>U(I`OH@7m?(iIDJlG!Z-U9y!rB z8vHWRA$oqt>%&DJHvI!Y<^KEl%l%LB*VxtE@ta&64g+@xsW_AaaQ(YbAa0N{@dFh8 zF|hrq*nFe?H?cX=BLBIP#D>(B|E?sladIfX%jXp@ZLJI!hFIPOj$Q3IKGYkf7 zY=qpigC7K}95Z`>?SW9i$84J)b=?uP97o`zCVeY&Q-p3a1OQ?T3?UJOC1VbZNa3Rn zYjYzbgmv|Y#?+7I)(;YfP?ASBF@V>907-w{bb=ik{%kBrz9JcL44^pvz;r?a3zAR& zis=OVQ;q|BOC#s(&TkH~W(1sW;yNMSxkNThx{u9T4w_-_&N2xpF&FTeW>KLOB>K=4ocUH>DL zWJjU}62AW@Dfz4Cr2sc~)^|iiSH9WSM<&}bO#ja(DJPPI|A3_bZMHS*ukOk(YVofc z*Z-95_3bTx5Cb@FBq2fQxRu0uBnAH=2KUe0<3Mr~i5Y*@;O0aE5K;_~_sEIhAoLFbhBt5uf;H z;PMcS4}%&=EItOZh(OryVU5E(1YN#Iz7&k%<{;3H@L>OO0PMJuKC&QwfZiiG{twa7 z?8uZ1QV5XYVWevPt2+7@>lb;hkrVxWIvOdb$8_}f@bR~k4I&x96#9P`ciH}eD*`)G zS%3G@Mxx3w?tG8(%NaYm*upJ=Pa=g(|NNd1LPnr~ijX)uILDlo|0)0l+~V&^wBu1I z(EdFS@OOry{ssVM{V9gQ#&x8!jsY+$$B_m-&ZfV^_eMl8z@Ou(gWo;I?|k|>X?LVI z5iCMR_y0K_eGgsy%p;_W{vXC8P8POr)d1gvg8#Ez`qi)hMNb+!!JWTnAdfkuhF1Cx z4(5me(y^%RpNj2&h(7vm`Xlub*OA4DR3rbgKKgm0KhZ}ZSEi3hrX$~Hhe#qhAjtN| zStWL)!aQ0q$B{z)J!AfD#^2LD|6B$LdCZQ%sf{gIpPaDruMqlci_+n9EaoO)h>boX zFXspcB@UpF0+i0MfU=8k=~o*hF#i_^p2ZRI?n4y#rehHh@(&T{po^J;r%Z~pj$!jD53Q>-%<->=M?veSt??&-a-~nk>|85W?Vh~7s_)jt9 zxarGwq|5$8a0O9abExl*jwu_@Q3?#nu)m5c9Ech=gw+4pM1O)SKx2Y3Fl0^5?`ZH3 zlD|k29y|KT1MXm_e|Ubs*CiqAU<|)i8zJgr;HCz206f7TM5W!atILQ+M81p#k)UBR z(YH3Y0=q$s0rTry+Z}eYvm+`|%#5v^jS=a(UwVF=M_7eSM-YSPK1wnor$6jA2lZNr zqD4eM%dw>$b~?iKZ5&L%qL9-gO1_TX4@^~~AK!j_xPiW*rRiY^o#`i{vmv4$M`Zu$ z`ghVBnLF570ZntbEOQ&H!&);WRjh0gQ2lMchy@|J3$6}pr_8PGY~haJCC6=Mgr@ig z-$2&B2?(<2>AytjA5%>KGs)aPg^|A=Ut&i>Ch{=;kp+$PaF4?^f;|YLAW#3l1lPYN z(Z5Z4OdlSD>m#E6fYpC!qJc5T;Q2UQBVhSYsrH`&v_G+go#k%=+FvI68-ezZqEX+D z(*FnAZ<^x&1MOinAHc?;R+{~*?*dd9U1gOPW1OdJyMX53DfuJLJpFAPGUF649$or#D*Vx4+Bxm&@5Gsh2n6R>| z?#E@VC#>2~0 zepGZb-i=Rf-fG+2O`M*MeQcV78EE8eI-6MQGR{BuEQvJg0`xX&_6;h_p~7Kiy~d;g zW&gV^=nPSumP3niSM+*+yL%foLud=yhShZEB_W0w3b)e4r#IEMV}(6~I$FfHPl|e3 z_qbFS`AP9dstO6vQSk4vx!$9viZUDwQE|K&WjHw!lRlz_;!EzqK)-n!BdNqkC}M4n zYSf)7>a_J>cerdWXuzgb37TGoVok@pVk3Uw#%9iHLR6hgcf0Y#QF0ilqNcuFzTJqA zH7%A}1vg#04CZfy#heU5MTK3`MFT%6+GG#LhzYyO>a*aYip>jPE*>vvMhWN}$SHa| z;)$5tR?b)~!>3cEH(NGQq1@y-Aw!zkK*sAz%QKUmk(9ID>h;b{5$CT4`S?H*RioYw zb%dWQ^VqbJN#uH-y_lgXMMawr?OspG0xPC{UKRFAiD-qV%WZ8I&t|+a90l#f&5=jO z(GTWsi^%2OcxX4#i~`ns-KO>$k=<>uQ2c0(vnMgg^Mxve^h=r2XzM+!Z@F?YX}_x3amZc5|RW?Ft6=^5ad4DytDc@lcZYo8#VUQBQ&&Z?LG| z6SnM37Y%07e}c~E^;KC%QbDu9wakykPrlJ}d*ah4Jdvk0_EXB|E=ooy+hiZ?EqklJ z*_sT!!eaHBE#G|FJ1M)|w4>G>#jvwo_!kkgW5iF;#>UROV0eQ6qvwucZ>CUEMrLM znJW@+E)aEvaGB3^Tv7%S8gP$Z^s_5Q1~J_E<7?mhmz4~j#j{>Z;weM*Wz=|-rc$7K zed}$lLjh?F(d8TH^5{i$i^C;q!)0$Dd#Gt#yL(CY&K+Wg3#x_cP+oPcGmdDhF6g&y z8@DAi6bdU>XX5k>0P(LSauvx&i9#%2m!?1ZD3iiR#-LV=i-K4z_6f=e|JeLfG}m)k zAKBrOzX>B_7ZJkWxz=nj@Se6#HC;%~@iN0EXC{z8lOz?gdpQh*MNzH6o{x;45>0!4 z8IY`TTQk9eq~n;c%|547$_{%FTxQrg8BBRgC2oP-ancwJhkRV`Q9LuHsr(@E;e7&Wy(DM;4D0M7H&^>S*jlNcW}eMG5gRq~Z5 zF$Y|5pIA*`Hx*jMLyIKy7cJ->$dn|WV37-^QmV92d6}z-Mk}9!UUKm! zOU;PpIf*W}t(EjUsrolLsIOnC62V7HBJ-4SA?$o2v@rWTacXOID!*yD=|JE{j$F~r z@G^d4dSwNa7q}cG(h-(kkSy*DpJISLg&2y>o=|X{ctq&WUpIRn{ka(R)V+%ZB1EM+ z0BGM--hGhaQ%?tI%FIq2atk^wCc;tMW(d%6^>tpHZ=yO%brAXKzEGW@OHqbr$Yw54 zWPn+NWh!uAWP%;Dt~%oUJs2!T3Xd1?of})ZZ(uVv3*(Gta(A{#2|xYHLu2DTpj56_ zbun*Lr0LMg!Q096;4ofu8rB?wPlelz)jhnSVrN;$53SB{@Zgtsi?BM`6;cR?C({Dm zG8IzJY{*rQ8Xc6xWj)%EiPu-Ek1C@Tnv(ox=xcOQC;1JT3bK)+S@igoN3mCQ>Xd2T zaeO$X$baE#V}J4KuCnS3xF9=FDu%NoF=cM~s9eJMN|*Zm?lEa`IgwJX39-teDN(Gv z?-Sj2-Aay&i@W}~S@dA5c@D+(*;pF~j*Q*Y-x7DpiUj$n)%$v%%S<<@2?_ahFSf~y zJyUFVK7mi3i$75Q4B8uzDEok;#UGR4<cxl$?vE#yEo`8e4`w;xnOFoYctJ~{O8dR+kgCQqQoS^TC zPFdZJ6x>&k5*|52fnH-Z!WNTu-#eC3BV(zxf&{z|-(KE?YmSqTa6nVgTB8&dR+amk zlbA0R20Gk`<~HiAQuC!Q>bK;4t_lxjC(sh?(nayvolo0gF*zEpqR4YguYY)@5|Nvy zl#`Dh=Xuk6bIgVQ{Us%~LiMr>JUOT32`){uIB+}2u-0?4$FfUZ687;iN+519?umuo zQ7zFeVsmF-rO_9=!aH3mD>5W6xR_7Ax6XP>pNC@w4t+K6 zxk1!bCQg%g5vcX9vxFGW@`Y-mTEF1H;L|=Su6JP>@rh5dU>H!MW}ug1B--x~D-BU- za>iTu+70H&Q(|zUV;K%Oa4$rO_TVv{uM6~FI2A8?r#73h+^;Wz9n;Z;6@`}CZ{fVz zUI^ASi!?9F9r5MR6q=+xS}Im-+A-}4mNMIPV(G2{_7p9Da?S7uoR%l*2Gq?y>APcV zwtX=OAh+DBFcyYRzs|V(@+5-nc(+kaRH(GO^hKV@3vB;J3ZMU)Zrp|iLyumY>%$bq zKW#VoH8T#V+aRAadvouF<>Huih`RbO7%}P30+nGu-%tH4RZtHl;$((Z*|hp>bR94h z2D4>D5qR->Zzw}NlrTyZ=M6SKW7yR$igPY~W_ULFz>`SXlMbC~E)is9VeL_=)J1uT>^9YOob(^n@!( zO3P%3h4kks(asbPQU@zsvpn4rWG^Z+|1_TR-40Mm3fSTcjhTTTTL}a!ES{e1vR?`o z)7-=b)RQLj+BNh?vYhykfLwHy$xlLwvr9Vq+nuf__c714U z1TflshtAYF=c^QuBqb-_Ov9uo7jU5;fC`@>nsOwaGc6kj;oX>kbZh!ynA zr}w6bW^yj}Q~;JwLx+0X-6;)9F|wjH0LAwEF>*f*MK+9%Nm0NBm58_kToy{}@foxjU$G2x4 zh#&c4+~-T+NWIp%QJYRT;fRrR0@hJ(^s&fq^~?LNcZtEcw>CyhEebr9rF)ZLuSmAL zE@6dR?V!S#kzGmlWz=0AL!Mae6?CgPFd`} zr8o*ELOnsEA7U#uw?KK&;jU*{l+Lb92+Sr-E;Lq5uPn=iG^58q>ud8=l-Yk8kXYCw z7E5#eKIFyK(%vGi>X$8^&&=DkH40x;+v>%vJ=M&1OnGL-==OP95%VkS$+;K?wNj@= zRj2D^GkdO|?UH$&UZUIzIZdl-y%J!MZ88z^jL$m3&;WWHSc>_KbE}i>N~)CEmaZEg zHEuuq$hQz5OFo-xa0fHOS4uXs{x%J59dYbVq7f8CIyBt zCsf=8H+L6b6=0?;Nyk%PV`1mMrmVJHQsnIOX}u^UESSFGVy7Tg3mCj zD+uG<)6q1!UL8PQCB*|AhC94c3B#uf3&$c8T1JMwb~f@}Bw}l#6V)ZfTli@VB{bYS z7%$cLzwXuI@rV-dEC*I}Lh@4n-p*zL5s|O2Z&%!vRMDYSp$Ji0DdUVxTdn)L1qO6`ZH}OKS#08_E^VFLt-W=%n1clX{iyG+1(Wl;5K{+Bad>%p z`bnMwEcbimhkQkm4tOqen+yvjn+gujGH-vv_P$}G8AJ$`7#OrKnP_1}7 zZ&ztE#*3jHhRrs+c42zuR>ds2;4N*9NODE6uJlJ0`Xq>TvE5_CSDX;U$T$xt4Q4a# zC66&r3@kpYX*Z8Qcu)O9vv4RD`@I*OVhU--0c20Zv3a>|-xc1yWi#>!!+U=_=g|We z=T5LT%UJRru91|=9k1<~IA~Q(YrbNp1bvFh_U9QWJeEl-yHIZT9=EM7q0RhVLqRg5 zXRZ{|UDSmGD&kb<_}wc+htmFllee9_^tGOSd`_AOc$Xh6Ncp*gX_|Ms-$2CfTB^X~ z?sk6tJuWEjYM2(4O> zi3{N2N9Me@3Pg6rs2b%akDURL1-AUj`-u zJ4{aBT#Cp}4~%~6vXnKK;X_B5n#YXxVEAYk)1c<5pR5B^bDUI zhMQ-)-b;05N`&+7gJ+(kFz1Hp5wV0KysZQ&vS7N2TBsNqd_LQNnI5v+htU^vLxLF^ zFAZ?S;dxG&1ks8ZMg}enyu%y5wetS`WcKH_nTv*8<%kJVbjT9vCdi;-*kFRso123B z6D?@=N^TwQ(TeU-;0X$j5jJJT<}9e#S$LbQ@gOmE>nRKlusoy7AZX)L&p>G2b&@-# zUjFeHJt8bb3`T<*>}z5PDh7pfaK8${B%mOIyP#wpfYzG`*Fl5qsGk%}IJ2b0ymtn} z3ZYrJlCxszsGv2)s3(KSVPE>3XqDVAL0>C@F&_DsH&21UkSQG@bys?#1@M1q5fKP` zC75AVmaJm4FW@_mf|dDoB0`J|ag;=A$+yY_8BK4MiR?7MVzr$uvJ4Rm$VBB5ji|}9 zQdZ6nLA|61-um0=%dLbMeCjBPRJ1HCQ8xManhy3ogb9YO2Qfok?;}XSImV{0*nA%v zfCHP%W}9i~NfYz61DXz7?Lr5i3{oHrGL{yjUnV>Y`14ZYYBbA;wz` zuydCb{srJ>K^1%z5PNzgB!<$b3YJ|yrzdd*8ZV4e5S3Y**I4g;a0`VU_eKX|Jtu+U zrk#B7lo&y1O=treST?)}`|i8jsJ%D9SdDJ!dIT}9V7&89GHAcEXFuH)9sMY=TlZ9t zml(<>BIdw9C+p4x<~q1chzdmGtl+I(m(8WI)7&wIrxcr8!Om7!FsNG3V92Biu}t4i z>_#uYEJ}#+5fN!S-+o^!1PF%`5mpd6*r>R-`LBF{!i~6N!Y!mY6`TDL+GERl)ooGu zLAOGtlrQzGIUb|O5=xshRRcNAZ-DW7(X=^-C3#j6M4`) z4|R^hl8h+M%-2-diQh5-b2|IR+Eyuxv8Q>o-OO2T0H%mt=aR3Tw+6U1(=T}Xc@;SO zmtIJT0*mnO%AnOW0G5y>n-n`0;1U(<)xsa<*W^88e}f8}O^`MXZ>xw}`_h*~%5KCM zLBZ!2cV)jNn9>VtS@oUSXjRBy-D}$RGWZU3_sTuPXK8`u#2wjaiBW7$-GmNfSrSSO zTRRx4%j$s$03I(}CWb0Emq~X%(LTdnGS=olPC;dx-r%e!n7%&zx_@+Lab>-ugw^{w zUwt*@C>{o!{8A;yZ%`f`6jRX%weY)J@4ra3g`NB|mc%Dc&tdt3jOop0X})aAvyjrM z6^yLw$;?ki$7-B02yWF!dIsJZ@%$9+@6n$jEH0y0NP4=`)t80C>fxVra0Jt0)QrPYI0zngtKd`A?mymMX|cVQ z^qWRN3f@;)lHQa6?|rurXPvJjg>=-$LYrK!SDdXpz2?a$+uZbYEE%R9&2-Ows@v$C z+lG$3HE|`@Yq}Nwa4iRWI)GML*?YXggq_3UeIR{h0s8odrBC%>>M}nHO*rr7Vps{u zt-$f+g9wuIn$0;{TG^}}HR)5On~9HI*JhcZL`*&>eQ(`f*JX6H7$VbfFlx_!l{j&R zhujTkw!I7GqW#880#^`|?5}Y$m)&EK+)AUI?Dk2tKxrZg!KTKo{jJUUfo$4$p?ehFD$K!X z_4qfJ7x?q7n{M5zaa?7Kwbsqwe|~G&MjZ#^4zZ8k_{kdA{R;*iw|(=S@-swB@bl$b z7z6vOEYCelZG`N|EsH1g^`L8|T#8HyOZ9FDFb~ZM+FH3oLz`cqTzm#Y%(s-tjDj`aSvm_fy4z^udZKr;p1xXbx)S*W+XDaByRhndIW1J65;D_jq%mI5T6 zztQilu#ac6;kl757kcVpQ=6VQzi{&xnh#&Ew>wPsGXEZ}&F#SJ3pvXvI+5WN`(2#tXrMiB2J&%3);j( zfdv#v?cXc&T!gnp9-!1!FZlYkLo=ijJ4j(SiEccU%43Ahe2(q>T+|aqFH6sn`&uE~ zX(aaH2T>(9Qzd3LT;;Fh28ZpS6o#-i!`0wQ^>HwCVH-j>(pSGIXt0j@wSd; zZs&APOoTKSa|h$zU4Ygd()&!t@s2#~{~L0io2EOhqb5=*u;mkVgN` z+-2D@9nM^}tIEZSdMG&33A>brqfaVpyf?W}CGgvVbZC|L>SCaoUc>vjng!HB1oL;4 z%?IhF@u}(hy$MyV`2z?hX@%mr@Dys)%>j(foClU{|0A)|(S|vq8(G&+Ke;<4n002~ z^$TPwoB2sl5rAM9Q{tIAMZJW}_bL56@lkn;_}MX#V|{bMTr zd$g_f5|=qP7f7t|9KN7(F-g$Rs!60)nx7(Y#@cgGia zzMePOaBU+)z1$LSFk9ZgDfQs|t`OyrDbHY*bY>wRdRUU10FE<(3ZweTDbsMtrH0y9 z{HVLAD=nCmbgmZ44;AfXp7+FEiRKm+Fg7nEx%c8lHKsuCK5Kqlu5bG}5^9alMlGx` z|2hJRY(}zyItR;F9lm3jWp*7RjG9d>=+n3#c?oHH;zXkF1`a$FSHp0sJo{3)>>3&` zLGy>?0>zC`IP{4?&ssv=aGT=2mA;<1`MF{F1y;im$LXhWl6w(RqORw-t@uca^aAeZ zDK(UH0cEpi?_}e#Y}Djv<3c{ZFUT1M*kg0p;5;JB@)t$ z)BPARm!-M39G40{d>Vgze$7-ypT^^9E>iCKc@0<&A6lPeCNtu$VHxm)=ltwh9PeU@`BjD)}nL6 z6JrhME$;UOzfjv(@aY&#vtZqFTnP4XvB_KQ)vMLn(+*CW>r16}i2az)WJ;_g8o^Be z+&V`-r6VduR53@<8Ur`hxASY$Y0r2YuzUa|~%GDh_RN2#HF-)&B`S^wPdL;3i*o&gGxGhnqxpn#4K&!j6JiN%zfQXTlq!FtSkFH^2?_h+d{I(~eA4i#=DmF{u5@r0=G_|E0h zTXP`_)N{*CshRNAq<9Wfnks8;Vsh7K0$%a+7aPv(Cb@^ubDnE<5xa@iwJ=;61JxC< zpN8Ctp^vmqRLzv?iGZqGyt2*EHsBw1Gd##EXz?<8Q^VU>cmwB(USspZa)kbqurxw! zU3TjySnH=`E#OTW?y_s7B>h;y4v(k_)6+KiyW0k5w{o`(#?Mw9_)&NX*QNaY#&E;{)<#&&xujmOlF26f(+LzKk z{q)`|(`v~`ik9^%>o-9lO-Oxf7erFaX%We;$#ISH6Z~c(_3uXeMs)p8;ISBY6R8n( zzed&q5PS63I+)&P)Ho%dDj>eUyKN7W%~^8Env5`z8_3m}hejFV@>P-JQ3o?Wz)g4* z;6uJtJXuV;WCJCIK~P@A(QgtmaeJ=p$R~xWml?EF=S2FQlTG&W7_(GW@~0pp6BZ)T}JhF&MI5& z@H1ETJ3a@p$DI4vvb-4sbWu;FpCS9A3UkKSTXVzbpxs~MDK_+%dy7`qam3cX>e1sU zjyeio>5pK}4oKoI8Bc>pcjpeIUD9;1c!(PA{n$;b{pHK`Vt)yybAeEpZ|0@RHBUEX zDmLF-%bwy~^~_W5_#aLhJ!KW@eVsn_a$}j=5R*YDfrU*0gUs~cw?ydM^ZeEo`Av2m z7i7qZZ|jU}L_STgzdnBAmeIkNCxHX`Dhw)uAlXaGY7lT1B#t-j z)@EhNVQ?{FIS||@BqU6e*#Tj|&IqvJ3m(&NODQ~V!v;b+=_FKY*=`khv`|mhUbUzGz z?Y1TP@PeUbW0x9f5$_k}tChS}g`xDEA2K(oyjh%s>NB@C`L9;p{2Fkwo1a)vSfo&s zSIuj9*!(qLn-%Gp%GWD3pOUo(%&9L-v-BsZro1=InOZMUBNc>0@`u+Ydf&P!mU{|( z`MfUql#SSaZbR15d<=51zeB*aysg_liTi2zB&$J3TemFc%eiP)*!emFp>^JHyVYF{ zjsi85`pAPYrbSiYM}H;xJfhSwvC_id{cskyujDdy@IBcxc!owbI1A%yB~ibbpL)5G z|8UZr&e1G3Ns@pf-8&A2{$?CWBs`|)N%am@SOV|ab85Cw6j74EJ}n1ihewseXRaH|E)17YA_@*T z%m;6R^foA5DMCfl6y5mr2GiTy8<(7i5Cq9powhxmhyz*kW8xt125IV25Q)HmJ%7O2 zdY4AHo-fS1$?iQWD2fOHDLNt`0m?&^Q%xW=w$;m-J{Bstxv`--jzP?z+E#Ab*AFT- zaL;k!f+UB6?TD4X0&OfgEhATvluHnKUG|+BsS?zX`pt925?}V7X3oEP7&uB3vlEJ% zt5AFCtBY;Xq}e-fL1y0S;u2?uflus~pUn#O9xHn-n||eCkdRNx@w*e=es(%Z(BnD= zhr{L>YRON zmf1-0)w&Jr>y*w5liO)yDv=ZyY~I$)a~mbWt(mk~_?5fT3&P8;I=YqNNuGHj5|J5r ze}g>Jhy27mX>w6zhG=h^uz#u9zy%Dl-JPK#t!O?sILNk97O0h|Dky<6oR1^rlEU~! ztO5c8D{E^?!-1GEkW+Z_y3FuZTwzJcm2A1>{5pr#N%1WCR0>e8qeK!Hgm*4ziyI}7 zrecxFJB3OZ)wt4abu#e7#hthd;!tDX>-XuR{fad!Emp@Ti{XQh9Jr==%wG={o<~Hc zGUMR|^N3KL9v3*=->`OlP!8T|J0}-mH;5Y$pWu4XQ3qX<4L!X=P z_&OhM+1)?&DDbV~^`Rs}7aKmn2_KJU^QjZ0l0MpK#TfIsW#&t8Mv1#i-+ojURR?dQPeGQ{Zh)LfG-3=TktGKvmU+-G$H}Vq2Tdicb&{@vj(&G_P zUcYUZ`uzfRez61B{LkI(<*%rNmu|G_5O>QY!`x0>JP{@~M6MA3U#VTdS;nAXZ;gPjX$YAOW>1yXfi>D zUi6_#WGCg5VxB}h;bVP@q89$3n*%|C*S;uTaI_k|OlK^HQ-bv>@gxfx<*obI)&pn0 zUKt*!)iC9A`>agWsUwg#C|`cLnU9GNa$D8WL}&V3*EL8}qIH@gS!BHiyhhw}%cr+1 z_9E@6-(-kT;b&hlK0Kw*rh=wK6}Ivz;xR3ALDAce$u4)=2#U7JS|t{*7ENV_WX$z* z)v9kAn)pj`blz~Z4Xn8+;}@jOb62j2wPas4eQ_nG5loBe= zex^WMrHHpmd0mZ3H#{>qBLBs`@W9~BhjNL$JZdBk_Dl~d)ms$BKAh}!g-mpg2&l$Y z7QTVvC2}j#Hwv%W?!iQ^a)54Z)=Tm+Q=VV3Q0PMd^UdGDZDIlU?jWX?T#pfT5k&F34W8d z-$t2-t37wuK#pZcn<6z;Fy<=W!thD0&1CG90g6xOGOw+&ne}JMuJn=Xl-!ERAmw(V zX7ftoZ@X^TSlnCmfq|Pu{<&#)aOU_@tB?NFtGv$1V(5(jf?RA;KUHuJt~>=lSwZ7A zz3ctPu@lrgIV1grI^`3otV==W#0^@UergU^Jj=Jw;ePypbC9>+{H8jdj7Qp-Jn|&_ ziMr|!zQIj`3QyU?AKI^9G8-Plr0Kzk7AO*}?0MO;+S6%O>~eD$#q;rkWmp2&iO2)j zuuHEJ4Hjn8UKnA(`F61{w7O)Y+N11dx6hPP_Hi)0A$|T}?QKG`Lrm3kR9G;5iOM+^AOdWZ^N)K*(L2qPldkkyF%+u=~EgozFy_4tl-rm)wvu zKE3?99_>yn{hd6+9D|*Xl4u?&gZp{v5*jY5HhL#T9#`SL$#Bl(&An0Z=qqe_xVL`q zYHU*Jhj0oGV6=Y~o2k1HM$D*6$a(H%GYDgW%v+2td?A>YzBw6pSJY*!39`#s^M3rH z88jXPPFld8=5g*Lk0-UO&DF~M;2Xvaffds{rMi>9JuTfyd`^1RSlBK#zU0oHLC|M5 z;{5#7(;d(=4B?u14<;ie3ErND8{xRkk6(^mqJJX1?MZC6HL2egzSCG&s##`X5ge0Z z^kQ@@Ub$4cc<^4{7)HAHV{~!vp zI8Y_BIKQ@Fmdg0UeR{zd3P~~P7gLgv(LCk`R#ditcxpiW8E zv`_|kkpoqhS|49OLc1p^-!d#&J+-~oRA%{x`K7tC*4V3h3q!~GR}}5niCdqAl-q5* z)Oe-=)1q14wOFN>(c!>o8u#`gsnnvn>FhHabn8<$=dSyjnlYIHe4z3Cj{ei^_G?ir zD5G3o6yH2gkQ$41r|Bk9W95srVcC#ngfSnC+{b^Q2Y^tCerMHs+D=#WI(=Ms_{`!am0S1A{IP7O?sUa9=iD3R z!nvnuW0UNLDz4TRbl{VPmXH)ZS>!HJ!IdpkU%u>ezvMvZ?PISqdsp$Ax69{No5B`Y z;h*U|V|SD=C;$|<5mb9CT(`s7y1joy~58H6Eb&ci_64ngBrB z$6y56H!uuYHgw`CsaYIs;18o8~kY3TF7I-wVh1f=IG%ElW#^#xPQop;^ql-QezwI zIPESCmi!PwV0Pf{taDn7x+sZ1{VYLgY;J#VXMU`n`}0gsFsR9x0;XF$pWCB5DvO|w z(vII_H)+$hKMe(xv!Z5OEWE8{N0cjr`nn6=`@1}L6A(~Q%CyKj$WFcy7(m{3n+*QO zoTHMan)5I}7e|m6GN%@F3Cbf1>dwcjL4m(ys(_b5zVc-ZbWqjT4$8$@ZQk;{EYYLX z)z#(k-shX`O)h}Ym=9*TZmm$GqM<2*qP_}?SJz+lrSM;s2qR4ovIq5DZyVfBOGc0@ zM!iTE#Y9I(&;3;N%~6%X4x~Fs+9Vh7todLHO2F+vwKaw|D1UGFK|x!YetH_0f=`{Q zlPpwvlnCPjNL_P*+OMx4KP?-HKL^9O;Imc#T4 zX--C<C(XS}B9AycTIy?Ms6BgB37znGY3`#WG^^w!ca7M))~H z>7WjK5)_5czbZI`Fx^kn%29!`Y#z7IzhT)MJdKw3qnr4O;O9QM6oEKO^$nrmBw_y( z`U4r_-R*5nwqtd~Pw&xo?ryJ@A?jE-XS!orQ}{iIru)xMO--Q*3JN;uxJJDI#cg5d zud3GG^Yrp!b)rA*j;6ThhA3oyH4CZ$^5s9ugX;eK?UxlZ#GsEXUgfuY_iW~970E0V zg2GqI8}dm`WaV^(;m`m~m?Oq3P}qFtimoz?s5HTp%lrwD3FgzRFiXGHXxu~cakNsp zy}h*mQ{~MT)VFm`IM#2f#EZ3SS?njp*01^zdH0G~Dk|R+0M(^34>+X8?%4}nR?1ek z7YaX%G1CjegN(3&8lUN*3?HON!T@sR3X;uDc(TE2CAyb|;<>LF-8tp*Qno6peyUI^ zm0uPl#pM(2$x7%5pChug<;`#pFs2ldEKhuR_fCe7Ingz&X3S>v7h%^x=CQu+Sn`%gwK1W|lB7_Gi<5xqiKDTYR zbi<`yS2|c6<%|k2^2KQ->S&;^g?;-OVUdvEDqHtvNPwV$VuuPao|&J25T@A7480~3 zp<{GE@vyK0;j`GVU)m$axKQHrvG`7dGyEZ9Ksp#;!(%>ZtVneS+699t5-Bi)%pA(5 z0wQZaE9HLqaLeFPPzV4r`Luq1Qci~(5kmog*%2U0OAJ%8;tt=BcoiL?Flf6#7q5(% z=jhRYZ#r!X_-@r!L-<5|R$V9^OV(HNI6Xb)3o&n;G94xawzY%UEMK_CMmsHEV9*@O z3zZT3txmtBFS^H@6dUG*;}{+w1`lB;R(F9zGsxf(DDzko9<4l*Xj|u-1vT%sVva7? z^h%W#wnM?p-JQ0NlDfb#iYt~lm zc#@SM^Q5b83c^^r<%JD7jZ!+Eh{9rS$O!pJu=AN*$N|!%uB}GgOb1~_(Z-l4di5O3 zXB78DDItUa%@ZXJ!zZ=kU~^#9aJ)09+Ieeb{=;*d>#X!F#_iPVp0G%im2*BqqL1%D zcu`2PCeVEnN0;BBl@bfNd>Yqoio_e{M~mtdu^)O*DMCAp^G3@^F?g|sK*$o3hu4H- zd){PVDF(e6<*2n<&>D5kwAUOMB;TYW6D}ORQ&a zy+r*3EY9Mp57Bby^e+{FD$+^4Px_)*(ik^yzZVf8?S;_gwvhT35c)LXI=S{eINN6R zl8P472RhnHoqB??l99IpQ|RKSbdWC+hDcXfzQc?nYZid$p_!qkF@j^&_<|zk7G`X9rx>{#~D?Z;I29-44_*t0m=_VjuQrHt(5RJ;>l@>u=4?CACA9B_AXSj-p zD?YzQg?aW^V@`1RsGYdU7QxqOqM`4>JH0~PyvU43rM;?e?AaXi^47R|{Qzzeev5zL z6^daLqyBwag|CDV>cAmd0Tzv|je{nIY+u_hONh)6#r3affvV>oe;H* zY2F!rbIt*3+6Jd<1*dkT7^tMtAiH5?dh}1U78`m;O~v#~1M&RXiZzObKYYn?-h;^& zl*VSg8V3?lYQ${sD-}naI==Q+C3#a3M=2F z5{T7{xB81HMg+zU74D?ea~B}D+}3a&G>gQYdNV97`e~EDg0kOQJoMz)HTU#~!NtD` zkPlll(e|Ir`V#!y9^!bh^t_>Y0Y4Qs*T*wBiyzX&T`--d(Bfjr1$MvOka1Xy!L|ji zWow;Cx+m;~pNK-XZZTmQpE>#lAbFo<&dpdnXQ|Q=;J}*QA%1nkHM!zS^X9UVVO6{35#x2 z@b2Zd_pJy&O+A@5ubZD$8&9fbsA0CAp6Ij67jSV3O}wOMV*%AHbI-?i0bNX!+$OL( zf9AcuPP#&4(zXI^;q36uSXHjNhczVTl@n**Yf@+RS3Y$mBH@20VH;+zs=}zr8Xot$AY~tYHfQ!tPm-AaqBaCb6?VTa_C=X_DKlxARGS3_GvDRI-}=Ku~yxU zi`quX66$PmH9!r}WDE12j77!wBd@b3ees0bP$Zlp)1YFSMfZK~2~1q{Do>9pF5E`r zHN3)uThc38;?c3^dn&s~>FWy2+V#s`-8Bq*qaTLT5{t5m*l<;$=o4Cu;8y5 z$D_>i=i+$%FTQd~6qmtI_fy4LN_&I>-->-+Ez|L$bVW7^r9J@KQ}iNMZ^9~cg;T^o z0ey7oWQRyUXO>ow>-ljx?3)#D32)RahNu#uVp2MX)u+D-Va7k9vGzQ6Rlre-2&EsT zS#s3L(`PkZS&pxXWQzOpB#@ zpX*r1owB`IOJdHcpT;v6W_d9qN;IBkqTj;&ty8Yc5Ed+~HvK9`p;L{pgBJyAa}%an zv3y6%0Q~Gb%^a1O_Rs83IG;Cr)HxItY23;tvyus=L(9IX1DLMKo1+UH1?BCB_Mjq` zYI;TgIVM^WQ-y-MKl!b6_TIoKp?)leOTm}Chi1+(j#sUVa6@#kJueR9ES@wYJ=cnf zr6VNCaqWFEVO@inBK2!KQz)fS1(v-Qth(ZKd`)GXPls#b=Lb8vL_VN^n^4s(F#W3k zl#vV`B}Ky(7a_8eDbf1`7lvl!*hO%Q&^*&hnd(HhNMzN}T^#H&aXO{BQ&{`suMUUR zo4rebySai7w#;DlnHs}2_=Upw-W`Uh^Nj|(5daRV8FBPeJ5Tl(nKL?Y(wS(JG5O%i zZB*-@AAC}+jiX@dd3Nl{Tc)mk2M^d-9s1|ep}HB<0IjzRwDV7MUY3_NZ zJ5!Y5(n4%7h$>$#wA07|KK}BCBCwv;HvX)RFLw2zP?`K4!nEk!={JqHn!SSr~;gHD& zN=%qwAGY3sZ&wm0JEDN@?ZRi^8l;Uc(kR6~d+q3B+WlB--*cBXpSU3CQB04%tB<|E z;>!-ksMDN#+It^z`S=p{~_xwfZ__4u+d$dV8Pv;;K41p zyK8{p5@ZQ(OK^85NFW6F;FjR7!JS0{1P=~*hunMr_x^gRQ>kKW&P-3AnV#OKj=&8!cM}Idwuxuk75li`!xAk8qJ3e_9%})Uk!304Ek0QlNN;|x( zoTopRs8PF$(HL#28`~9^oKJc_4bCw@QaIl%F$vh`zYD?5{)#OkfcV}Bg%VdDJ` z{BmwD$-VN|_leVc*KL~ly<4sim)e%26_iE<-`s5{CKBaxyhIwVIT1m@viCGj?aj>( zGgb{%>qt*pvISn5TN+`{*<7k(MEwxnzB#JBegJHx)rg6iBMe1AB`zn?E{^*YwcO-n zG1|aot69iQ!sifi@W%_pak|x~q)f?=A%{uP*ShKuOl<=|=BPm|6`d9OHE?PaZ@!1= zkk;OAFtq;-m_!yVlX*Up-Fo#$!`th0q(P(Jqr^b%4c1v#EpTep?X)0?idyQ^$6)~2 zI2%mg8ufe__VD3e*6Nd?*eq6VXH|Fbp&O8w=Bkl1Iug1|{usK^T5SsNyuLM*JOJPd z+k46?4`&Lz-y>4w?Y+*WCTUFT5aN@``anGCKqd9~arnX}ut2`5VF7?SIjy$_QTq#r zfvWQYMZ)LSbhsQxc~Yvir6g2s^OP(Og)V>joW4E;U{J>oKJXWMkO|q@XdtZRbu_Fe zCi!+MnY#3soXhq4%7jieNnZksP4Lsbd%qr9*N>CyK)Gm4wvCxsQaq?iIlsj?3=g?C z^?z6ZL9ah2UGks!c>9$pgSG86&Ce?Op7Dk3xm^*OJ4&CIp-vg1c9@M7i|D-(K|knU z6y}+l_QsKuhF_ES4+a&!d}XbyU2cRCZOzeN{7AYEPVE1gonPf?GHchXzm%_8t4?oa zzWK;X9p2UD{hOgIwIr^-X&hQ3qogWL_0^o7Lpg&S>OHet2;{y?jFShdr8|Jo&qPYE zQ%akH!rVV|JdcZdA?f1(1|+)tJ${dVuu9SO*MstGdte}6BRR2296RNKhBmEgy>d;z z$=NV=?Nj#l?3eHe!V`Gb9A50MwbmdBTE=&mlWPl)W7h5d7f6WFX&(bO$a;NFM1j!! zTrt{k{d1ja@OPPd*glr~;~wwuj!aW$Pa=zo5c>Wa$sz=%?a;73={lTLA28sGH}VM+ zxw9*bPJ!4HGlpyy-gUcQiep_vcYgc9An1Qk#Q>@PXLKT$Thbdoz`tY7lTl3R6Yqk) zBp_b9J`GwWnk^^4%5BGSq+YG@LDl8Ri%-qQgw9a|cnbFpVP2_S*2SsXaOWcG@atQT zzw9@+9zEkdE4{>jXcBNGFw#d2qHY20y`OJn(rsnpwwj6$KxxIM{tBra9{%n2cz`j> zVuCinLEZzP%QP6&46HWg)2YeB{t#CYOisE=)%ZO@MqlKFrY`H1t^ajyA| z*l(VY_t%P%Ul6=PIZ2CEXE*hZ$q|6-8^-I=i`F%t?bcZEx1SeIsP|YjbX=|>N1I37 zaS-v};<@{891B7k49q(&g-j8sUchgraU_(6K@K3hc4YW$YbC>Q8og!FLMyWun+^1wUKlAPZA%?6(`L11W zRWWp`(;-m1@~1l006Bp%-91sNI|&8sIi=(u9-}k&=}srw{Ia(N*uDhE9GCH}>1edb z`p^D(AtY6+{1ngie$x<9s-SY9>=puKY0f-@mqa$r7s5`Dy?#Q>0%{=>!1C zAnXRUSqo>O(_EO(?;F@nZwzr&*txPA$= zL?cyJz#|elTQW#%4gI#l(CEqMj!5CrZ;Yk ze5%`2Ew8}u=Q$DQ=dQBq0oZ945zCfzy1_Hq}p5lFDU`c=Etcd zt<&U`jC#lVySgs7dj^*D!B7CPhvH%Kvs54DF+6sll2i}>a`Ncy-pEJW+0UXB4<1+m znnSu)o1Bvh4&1%R+D%WosPWZa35@w3L9dZ`Fo7`y{O9YivXm$Ke zJ0>>#)3sJd5CGq1etnkb`uCW8wp^RYrs}D5t{59KSD_CDva#mCt-+v3Ld9k?ecBAi(xgHz-5z6>z)ce12T3*yykoXZJx;Z(Sc#k z6D!gW2&nk5hV!zDr}1+DbUEBQTRR}m<46MghH~g;=cq6roX6bB`4R%a?!q#o=cu;_ z76I2EPEaEuvDfzwW{3VuP`f1*h5jD`(XJqqf>Wv`TR->VR=TBPw>tAH)!wM54VRPb z%N7sEX>1#{$9z!K&Y#11`7{w`q&Sk23a+-!`xEhHzsz%s`^5LU+tzm;N8v|#)>8Ez zW9mYlnJ>XpX=!AwSqJ=;@jkKM=Yk)pZGKnr0?EZek>MW#*&&f137X#SFMSUE1?<&d zR+aw9KRSkQEAaNU@W~pCWJ}8#{I$!jC$oc*X2AE$1+)fi(Bp533XnPTGjLHf#emPbQqU()kdR%Evo^ z2Ihg>BK*3CBb}p+!@8e|$L^;_=C3}J9rkket;d*Qp`S+e=pu3WuL#7(uTYWhRK%Yo z`&@s0MSDSog2xK*Bs>gArMybPkQ-m^uNbnJbt~9|Vw+dV(ZX(cN`qd1jic>E+LM?_ z#nbOf-eV49ov(f?+c7MoZKSlP(xdj~33@j35xP8WBBM{TxlF$9=PS1G2Y+sFdLfDa zvR17A8Vq%wRm3ZX|tuu^)2bY+Cj6C z128cH_m8N5P78j1)d{C)_I@mT(OCM75!nLC@uvIEzNULji~i|f!%;JZDr#1@ z8y;?kkeL4qn0H(W0Q0Ckau!N-zmg35y+tbg8mlYZ0@%cm$U?Z>*2L7(A`sKS_3DI#dhplIj8Px@l#Ugvqwigk-Qbno>}VVyrGAl< zJ}(Pa{Gd1{eVIuC^iHx$cUh?e^>u`sWjE{2$Ik|Nx>>s9K4lyR{aYdrkDV{jcL+r- zhyh5P{$p+}O2dP8sRm^S@@+Kz0LFY?rAZv1VnUeTH%m;+`N>Fh|zyJ6ob9MUGj z-*!GR85Gl89W8wPg)7T+jc1}#o;EIXB;cz4wZPrs{=n*@#(kS*r8NNGSJfEP*OoGY2a6jJjd* zuglD~@k%vI@?l)T11xVGSNq*-fg~mCavh%C%xm(gHml(bW_=OgNFh?Wc;t6%4ha|A zEtFFYvaj(6l0{@7*&cdlEBVvjird-S>me=-YjkwKs;+UBo5jdT=gL!vRufv5~4I59eR|uBT-h1i{ z5V!+}zJ$=pMd^Pe6y}jikJ#R!XHJ&Rn`u{#$M9-!05*PJ{rG>04%N;MQ3?uG3dsf@ z=LwEI+h6(NtJ-s=zN*clZ{#RkiSm6_>wT{QNL0rjNBi2p9k{Cp2&OY8?0WMR)gg~x ztZ{7^P!vwEN}z{fKN;Y}V&ICQ9_*0<+#TKK3N6o!FP`_nRzmK@u0{vJAlIJ{SjS|| z6V>IOlLZ!nTxcJ#&7DzlswuX&22LpAz8*&BmrsCOfg2kUKtubxJPP5N5fDYvsHht zG&rQu?KPaB2Z6Se&GRAHqw3OEs~Qv(fXEFLQisw1e;HRlTx=A9{I$v?rTT+=oT2tz;TvT9;I943*~-ip_pzZKH2t zcpE*m5WTFwWp<(?gRP#4c6=8?qO}&-FLWI@X%v^cNU!e5hQhgED=T1ia5v(;TIPxd zo{KP|5IE!5qazJ78ZNg0WXc00rWiMl7XOQ?O$m)h610Ad=tbfkYa{1x*5c1yT)ZHyP!T=ne;LVsDT*Y7R4-;7@5HW2T}PsBZrZE_$y&XZQ0=G zI8x=aK(c^9WE31V{2$>*X>ImH)LA*8C$uF6Kvs*U{P~4pZ(x(((gJS0iO-f^2WSpB zfR7>|2YNsC5(0^hKf0+iw0 z|9vQf>~l9SNcr*#r~A#4k0H7lJd~1b8h+l+k{LPxYHe0cFJfePrq2jNy|NtK9O_@; z7F$I6G^*cc!0SF1?wXPo9-NUg?xU{IH;YhPGA`DMe zWAnQA=TzA&Ww+YWPvgUo>e;2Ny`f!G(9KH_8)rP|;YI$3=1PNVP9kxI-l}3QgC6FHn1I@?J@%>SI&z+i!A>1dXi-~OIVHhO_{DXil1xy;Q zZs}*i?7eMyYyg-s_)0t-f5JElKA!@L4~ zYl-xoD(NMcZz>FgY3n@hCoj*{1cwhgs=IjU1}{)0p+F3J=m{4yw~#iWKU})k^bd=1MrergY)~s1BqyRJ10Xu z4CtGH`7L-4tEl4-L(C* z^=ncSpapnli|9f3B7vQ<#XFU;@!4+M=?sGxw(Wwipl1Z|E(=53Fq?y(av$X)?7F%~_nUN|t95rL-0X&5Vg5nKna$z{IU)BxEFmjT>LEaPjD zhw02vqvp)x{5ES0S8G$6>Bco@3MQf{atmxbxq~P;?B_&3QlAJaq(t^~?GsT$G)t$d-&D~Dk1!vN?%ZbsnqSN)fr*8> zU4?aAk@SpR7}tUxzv>@$$rcPwHmRIkQX;xniUx0ahT~~;{{)Vp*P6?U09d-q!Bv77 zG=OI_!z8GEsftdIg0U$Y*TYuA(h%|32NL>Y40VNMyxtv_fvT5*{Y%RBxv?5P;8iaW z$u{`NUn~Lxr%fewVJU6d-D$?+m#ys!PCeY z_YuCs#9CDEWz_-H1u4P>!r-m4@F$*F3?DC_ROg0_FBZA%Au;O(FHWJNKQJeH%ny)q zm6i1pX%&6gzUts&GFr?pB=rqF<_!vwZtuIblNsc?W1a%uE*%}14 z`*THYjD9z~L3kCQ=3?;?cnzRR06Ja_yyjKM<#uIUBY{;)^P;&NPFZ!xaoL(F6U=!= zZ}E$$UW$-q)miz^%hVsn??pZ&yzGPJT{M8U?==95hF32Ho~d?7L->VZoC_I2At7Wy z^O^W&WSCfPJVs*l#nxtGWh|g$umA#(&37}bf!I1#W`MkS;Be2l-;kKsf#6aZsPL&o(ls{BJqUwhkl9YQNn{>qR0j8V-Ds zGDkIlKf#gcjf2RFFJI>0pJ|>mM=Cjy2g=xs!U6;G8$26KbL%nmXVc6Db>iEn0!*`~ zHnc6tso7%S%fvI>!|HjBO_&@_xQHe&^BM-~j$+z~d%=mhhXTswpnZnLh& zVwe*{Q)pTlF3UVk$^+nTa#>bpu*j4cp@?tToN7nROk@5!d9cgI2~7P*%bp;1kh4`r`9ryO8%zqufC+4ifPY(vEeOi@qR#ijRnY8tYYk=KklnnwGA!S!n=Esj|uPBlw zMo8HL$&4&O)x7f7;;pq^Iclp(QYiE&ubE5n{*jJ^dA}xwrOZPnPe)Xv{P6}0MFo!B z_*veGI3Znnk!}n(1!~5*Jni94NkL=4@GJY){%h_pG7uFBeUqCfe zFJPQ`_*m!L`gX*>K1+P$9ju+3& z_ge)1!Tqwx*!p*$p%AG-{P%QR#m3_z=3Z2S+(;cZWPyD(9w9CyOD4{aL11sLztlly z&@#}rlD6n&$XECcOidHdR;Cu!IQ!F|5~RZSidDnJ0JFxc8wQ)O@jh+-;GB}hC68LiDG3!J(isLNBnDkaR_U)8A}eHl-i-v{{PZ-;kI3kC@eK`= zLhhRNot!4CPZj<38F zzsCJz6DUZ~_}$Nxbrhzmq^}_rh$>hK_WS&pm?1L|Sp0kOGvIyOXQ4uF5PQVskf;^; z%t;y6!vL2E)}t9^fuFAvbWCaD+bTwcq6%zpFolpAI-^{Cn3#l!D}g8>AB2BJvf2?- zM@%AGVGS01xeP)Q`~b!-n+ER}NX*fo4Q|@?%66MkW>{OL%*m}L_1sTKNy>ljQ}oos z7C}J^$w>pThjL@2C0Hz~jezW1`%#WVh*mqk0t|ld4MmB(M75%W@AO8p`<`$hm#qjy zSJ52s{gQ_-O)&+qa`?xi>0$d8yY8}swS20N*A2tioGpAPBD0~o!mSr5d9nb5QB<(kt-M$t`wE6vH0t*gke6nB;a02WZN!z2tOd+T#y>4J}7CDWiLMB zMJ}1+x|iXKCdj6OV2323^uNy5i({(P@kC#Y$V5HjZ;(=UEyQA}-8a#A^00IhksT)` z{s*ec`#cKt39W<3;4tA)?AX)Z1tRVT-`K@8T5^vVvq%DB?c1W1&=v}liW4aMDS*T|4L@>s+3Q`a!UAxL2+&ky-ivzCHhh0 z^$l_UsPDNvTI(dSz}SWD0zU=a;E6HtG84$6pbA}Rw~9M=qz7tk;qr|YI8>qeyim`D zv`Jw$#ay^F#J?vh*N)7BTM7M6yGt)iXD<}y&g)4+KTY8>HLp1NDcZKp^~U83Zwi+7 zM+{F}*KEF~s*A}s$)#h4jyEfnJLSIxwrt{UCXaYOq+z)|t>qA7)YI}QcSBBK zJ19JajKa8#5RTr{#=la6d`98r%P$dd1^?WiB^S@ZO{pN{zr+_83!ILnIH-utDya!Q zuf>a`^Wb8*+87d@c9Ua$$WNpu`wKF{+*dumHK)pixlGEhkiVImda+|s1DL9i zSE4p)0sRS96pY&yGV?d6EGxq*pHRFJ$lxfOA}@@o2@JcQ*4Mnn<#hbaAC@t|T=_II zQ4u`&H%e$aMYbSBJ26`KBx_lvv;4Mm>` zj;2HLBw_V$OV4sMD(bNlAME#TwwnN5oAX-s?ds5Y)Ad@WxA=(>gjS*P$4f3IRs(q| zdN@2mrx=VtLczM8+8ixe1w7|_c)C?LyPRyWn!IXmvz^Zuj0f@SE_Q_9e2kK%ehI3MZxb3b-?sjx>9%yHx-}IT-YuHOJWEhOQH)zk=!gp`Pp+>Q zg{bCKSmH_0<&ynEMnf%I%hNPi zZl%|^z--Q@2Q^SVaRtZWxsr3YVd&mp=pcSmfs2!BcT{cEBb#OCw{$-=+70UNYeT^F z6Y}Ryy%x#F*iUtP=^;n@@=zK^e2eZpnYbf3mNRETwD3@bhg2vmf3WE2;Cpkrzbn3A zRk)TSspVg0K?H5-u=9uJk6{OQ%YcsqhT^!Rpru9}jS6lNGB^~)Sq`(5n*%OFFrnftD|7&u>LCuTJs-PDz zj0&q;t_y+xBm;>pnwWlrtw@7OztSfO$BdoN_^iQd8oAD$h{42Ebk^%MD4mL8Zb%4* zzMqu1E{noGuV~aE9fu%4j%p%#FFjqu+iP*lDZR(RGmN@Ag>z*~ox%s!Jq3l&m0pH) zrMe8(f~w-0~hGO~Soj`wDr~$*puEO4!Z`A)dw)Um;e>NsI&D)@dP) zNx}mP=axwXrkAGU)hw81Uju%$Txu+_znbaIrezEnc_a8yYJ5A%ZIDh)4)f=Sxnx>? zfMHspfgnD~tH28;>GL3SGx3@kvQm@U6-Ab5`K1VU>|S`--m3(69&41=ef|N$0VXNR zswhbc=Ae(%=bK7FFwfNf#HcfZT#}Q=D}#lt;3fZqk^a&xvv-*$xh@CBCWDi{lht$g zg4rOKZK$8y;BRsDkEB8gSVei!g#OoPdek>ci5IQX2?FWGBfTfB+1`pYa?&9eqpSu~ zsh4DodY7F?T{$ZB{>iEK=k;{rZ;Ar3Us^-ViW}ra6lsWLdLs!3zO7lXD^2WFup1bp zPPdpM5lcGC3gPAh``@4^7D(LwI_8PTa4qTT9zC5n-1D=Mj=%(2;mm#$MRwcBxc;M; zd|VRlNnSh+X{1bi5idRzK^}_GPA#6ejl>&>Cy2w6i0}i|=`udOh#Wjrn=pwG?TIir zA?#Ek14rkQ4U&l?rTxAx9aoW+z_vxNkxc)HGB|Cnz?5oL%le-duXCRZjXtWt2E~Z$ z^yCQn@A{R1Hl80UbyRg&v$;Vau3(+C&Q(qV{DZ!HcOJ^17)RX{#f8hmkiFw8RHF3f z8XC_S6KRFRhlvI2x{%ONZ)m}Sf1^h}K2AX#U!xMmKNsP9E@D(S(r;2X!WGShGU(J) z=T`0r@Fe}~y2}X)(AxJUQ|Y)PN7e!s1%XaNMxM5yxb%G+lJ{_@Y<3ACRNz_BdNy7g zSA>bQ<}3yVR<4C=fJKOr++YK7aAFNG?V1V8Q{_L`Wv&{CE!YLWU*!DhShmRv6_qGV z-0o3?sfQ;5gBpy3g7REZ#uTM=TuwNxjm{9}|C9o#W(9q+l4}EtM$UsTjeZ+aLLPmF zB9JaKf@Ak=DRHQRe5IhdWc&izcVkmIjE}9Zw;dg@gD-~*r`snb)BAygSt^((9ZfsQ zVSGJN-9y=hx+t+VlczeWEF+D*Lka`em*0{ZRjmX5t`6#DdzJ;3XpGILf3-1!E&j;Y z36)<=6zov+edKW#oDvr6Ao;$R1VX*Z?OyKDBeL#%@SYOT_9^&uBK&KIyzAFh4)vZA zJtRvf=CaNx$mn;tiUw!hpx~y!RVnJOSdatw#HaDYNJHu`R!GsN4#@Ge3i)|>m}$e& zKxm9~`0X#ID@`<#^@3>_S5JMf&7#Oon!k9mAs_iua_uB$4Bsb$Pz8XYq7FkCH4UDUiG#srG2a`EkZy404Qyj;LqS^vq3QsVMB0raheNslXFDq5O5t1pKu+r{|>(NGTaD2}{wY=%FLLDJu zerq~^rwJ>vP#wPj;owyNEuZkq1LXe;j0knu&3cJSL7yz4V5x!#ftso!jm_8=FKTYi zlL=COe>886&zb!t(KI>XxJmbsLcQzR1HEM@$7_-XKh$`9fAqZT2RP>szVLzNkU3_J5HX0FQ9BU_ z3|~4mC`~vGquCQ56C}&btVsf;k|2sOYfdLO#~C?BdI#uQfe#|t?L7*EOknsma%XrZ zu1$e{R(=o{nkoM zR^2Rv5?>#opeBe917D5_0=IiYJ1H|BS;&~kETHwVgWCpEwkc?J<6ww*_C4oP`zi@y zG+uAZ>pkp0c6ee>2ZbS%I+ytxUbVN;0={?Xn1B5dVhwqF2PLKyQ6ihZ>ON-OR1ECx zPxEVrcG2Ob2`X9tQ9eTvO}U_+tl~J_-Iq&~fMI7z6kpl*hCY^YqR3a{CAjPxt zRYcfLN_iAhIa19y&Kg22v09{H`abr9nT(8aWCC!9FG(o|&%`A^k#bRsrJL4vJszLc0_enE1$L(*9RO%i}q3)w0 zU}Qsjlt8YmSP>Y zPoH{9)<08p-toMcm@5r?{dGKFHCbrb&FxUvPm*GM6tzBqc3w)1Q1DlV7a6BT9ywrA zakXeyuK(NlS}4{)j_fE zzsVGEe@MaM+oDb~&QT&{r>@W-iW1Y2X2VFYNpBB)ICb?S6eU&*f5LLlp8HeE7)~>g zJvA-_*tO%Ar?Rm2=@KMWGU2G5Hzx`_rsJOk@mJRzV_jzmH#14hk440$cmt2`;GNqI zDa)HEnhTHj6MIhQ*H(!HR(8+)J4#==WP_sy1wC$v!s71Wc34uC%+5WQJx>R&-f%M6 z=TFFte=DDVrYo@=$sHpl^)e2p`HGqpl{3SrYH?LW>H2i!{b#_iQk7S`OhcnK_0heP z@*ZC7rX9KNO$K>6VfFXA#gUXfIY=Ppv2e*6)-Ya(9AzLL{YY9j*0xQ)_q{bs(GKH1 zY!-Zq3FQZqoq4I(!l5QWO>s|kVPwL7D73Qv;peHj3j2Sv-<$S3FE?#ml+*$r3OL#* z(VoTeSA|1f=@iTiiNbpoGn)B&yO5fa*@JMxRC=byn(4+%LR#8Gn`ZC&eOIArd;oAH z77n;l=VLt5wd@!B)Y(5uyX@cfg1deIMD()`TLprr^WgTMyYG44|HOOEFrogr`0r^z z$(1p0vk#<9!~lQQ$FncVTghd=+nmS$8*>9Y_CaTP+EWMza-6zCRXhO;aFqIv`kJ;y zw9%O=nk?S@MkCa>rj>&`I!pDZuirzZyv z*7qc|?K-}_Dir0?vF&dkTUuTIz_h)%3D*FmZS?L~cLDtU)Wc7Y{n;HU_w`hzJ&XPB zxAvW^`X!u5@evZoa_8R4uc%~H!^eM5odiGWH(Hh6d5BpID<9qY6F#lflBQJ=&_jM4 zHi#ca%-ODd#->Z*h3w0Zng|mz#^*`b*H~w?y0Dz@OoTTrcLblO4i{K|%CgmHqQApD zjF#QRz~<+|tS_GE_jF^R#}WLgC=yLj9bPyRZsM}FpwO=V3(@h$O_bfFJp}0|>AS5X zRHi3w*O+LE@XGAQt#U3?Z%3ZO=$u(P3Sab|c$O9T#BDjA1#Mu>HpKyk$A_Z_u{*z0 zf`FwuN{LMF&3k5x+KcPo3mw~fAC8xdB6HFYwWXIM#mt5Btbu%vn+RJT_Z zEQde3ZY^Mon3f9g{q-hEXMZc+aqzbXwpf1JtM!GG!AGFc(J#) zx1GxkQDugBw}!kcB^(~wJqvvvC&&XoyJa`kd>Ba*mX3oxrg*i6v{oG?Pf$52kTp6k ze7vpS?Gf@$@p&BHdG)e-q7mNc=c6dFpyy6rk2n*Znda_UOGa>C2nU z7hgj@!${6x4UVU*jmM(pZ`V7v`F9o#T6U`cBbHxlMQhboatoK+(8NN!ImYgIR@A~! z6Jf;L7C+PiwcQ^l$n53!zM62r+!po2d&6cFoBJr%?SNrq@%`@B_8QWLkoY=q4o;a^ z7_rG|O|z=OB=G1*wOl}7MxsTn=R5^^6iG^i#dNR5{JKex&el*ScOW;#tA~uTlL!CB zk2^OW`%QyqE^#6Ez};-v0G?N(N~A@kmNo1C z1i0x^aHZISa+s9eWmagDn#8&-GzS5 zohNKOd7joD{0h>Wd@i{|Sl~Y80w7P@m&=tt4l--DGacxZhM%PO7s#K{2)G_09B7vm zO2>Htw7rHA8p(zDgJ^pkOw}WOXoR?xRp;6;$My491QRAP)dMo#miaLD;z0%8A0JvI zNJ7isB6Cuk2=#^oekR~0+XJ;|{$P0%q-x@`H9LgsRXq@s!Vix z_nAfbnQ`c6MOXx*&058;h)*JVu7J6$IBzv>ccGp-U{RA9Z)78_wLQin5_FO+yG5!P zWHxOPY4tpaV)=WJN0xH;D~F#h&+jkzlfVi9B`c&4a}X*(HgW@X&Cw zWa2g|+qQAGEX{xbx#e>}GaU=`O4WA9et+o~uj5)XQX%6+4=(*vIu!)6GZf9I(o^HJ z3`PLjuLn0uQfr}%3ycFdW+6;RLHTJIE0^9C-D|>#hDe+m|0@;gv>c6`lM~p?-L3hQ z8wiik#euC6Z(1$b&F03}L4`%zkzH0f{hqyAr$r$V+^ZAJ+}sTB-H^-!<#I=?8xLfM zuyT=FxN3SZ&S?lp22&=Eal3DF-dZ}5)<%UbtCk3BZ#by_Z;s6NTr4*Koi85C715L6 zE!H{yXne)>dN{Ar+*W2y*#YOc&7qjD+^2 z71ssU9V8hyV{{GPZQmvafXH+r@jMK0jex75$f9zfw-%hOg9_2T+kLOoHv)H*r~?Zg zGKAeJo;hO?*Ez(qo0d!91qq*O+R1_Dq^lt5ZChx96$ zH8^jby4$H>Idi^jSF;ldo|8#s@?+*b-P_h8Ntg)YhTHDu%@R#JB`N~uf0`y9Bi4Wo z4sC3bXO(O9F$M^ujxF)&gxfZHm-AlzUilg_981dob2F=}VmYeJT&I@GN#e86PFYId zw^#GeQG?%`UEf)>>hNE+Gr*Aw-=nAZ{D2EpBqC*_mM67i*fha)VWnWDs;UQ~^;@J^ ziv~h`mw#aq!l*6Ze>!cl>}fs`Cwjp76E2=m{3@KHyX>}HJzqT_N6??(kI`(;-41C2 zy^{6O`b87Y8-+u%H-2RFBdOAzA8$Fu?BSMVJL8z=O1;|ksonhsZruoH70$m5uXpy( z)2Gr5%#Uq80#gw#;`s}!cBAjb05K(r^Y(CFB4eNv9uO_9FYw}TvUL5TB~^r@OAz}P zxlG%@zI@kWhCmH)ZA$UgsTZZDp)N}+(^83AD9{}6IRhwHDV2|5(?o&F?7zJ+`)_Z= zIdj8l7xGc_YGjD2i1?XKHL*$A3mSs`+v$K@PVUpx*Ius<^FAZh{F-50YO6; zuc)xQJ(`coj} z58U*RtYZ3wG3$EfHoGj3uAWUIXYS0D)vfLA?0DeLhVM?Bo0}5ArEBUQZUSU_$_!dY z*<+2>0FTS7dRFa3mW9*#u@?6HzYOG!$EC9*Wd-PxT<7lscAh} zoX!6@<>GD>BnIZh?Or|jf+KUM<0%JIMmR-=*0Iybg@lNcekNtE#vEQu)&(7aY_X`c z2`N-QY}V@{uc&l+H7i}0AKs_U!c)Op(t*D57;3fw}}B8BhhN zMx6in0<_kq)Nxsu7p6AH!}i??sD2SpB}QaK#J(eU=J}E%AMr++ZPwhdCHK!-!^+>n z9!Es>+?ir=k&$-qYV{p4!!0VutVx|~^;1?WbR9mf3V9sqi!w2lH2t)%B*eznn6~7O zZCG@y@<{ewpQ31q?|YZXmDIQCg6Aqg_UhfccLe&ZX>*w2+qe1o`PaZl8fJuVGjqLF1AG>?ATv<(CC5TnYebIK9U0?0i`J(*2-dDR zHs3O6@OvOX$PrGRxSKxRchG?x?1)U2*XDL<6GckE%Cqu^4rs9%kl*tyTL9zi z)scs9FK~I(wIM43c3w~Avx;eGXi`=I)ujLfR?DM)(Gj>BjK1Y+@DM1!WkACEmUQo1 zRxxwiCsE%T1B#YLl;1`Ln3$Da!e`nCLM&l8>~73w7qQ)=@2E>; z_)ba@Z58!22-(dH!~fV{rJ6PllnE>y9rc3+Q0{m|Y>j%Oc&8GM6!wowYt?0@w5Ez$ zWj5OVPTxkz6KVNzoFmHz7g6(HKreh2BwW+1Td5!TTv>*%>kJD4nQ zrGUjr7Qt91uE=QcVHZ!3M$9rGxn0BNwp#Gi%Kz9siY!ty0$2Rp&o~+d|LimZC5huf z)0iAQ?y%!#ysL?7y7(tTZraB#WOr?4&M1*~EsedERN2`04akcjltIZ+bH%EPMxGs? zKa)tYT@*;-Mb#&r7j#i6XwfJeCmSn)GK$g2_UKsb1X#MDUFuDi|w-NvddADoB)edh8bR1K4uLp2NZ9G9R54x zuyJs3vXmhZnu#RX_QLP03P2UKyehuTbaa+2vvvTd*YU>2h7MnLr6r(yrHrv%JL~!u z4b3SSlJ4$iGdMCGm~=(NU;xO7g)O0}ADC5SD1wonj_j5nfs^U`r3&wMH1&3#*%HP( zw2aL~4>w5Mk0S@AV;)j{h3A|?P#rSqLHJD&Mxo5G}f&i zqz+H2WGi^3QRci~D}|~MnV*=POA9uhHE~G7W`7IDW*zsTk)^{mNlNRxpp`8}+t3h& z(S;eD)V&)X8fqCBaeGhzU(nzA$Z%g{9DK3-Mh6}9yY+_n=}|!TJWlnT5x9)7*x*Ljr%Yp zmlgqQGcbJ*fclu)`g(h3e=pQ-7k>Z#J-x87P^LNRMu84OM>*ig7tLrBUTmjDjycet zk&zJzm^F@UWd_tp-k*SlT;{c5G%-6bcuxCl2nH3=$mwz^upij_%gm^+_GlVo(GKnH zt?r6vzM)Sv5L2=`i}w>#Tq}bu$rnkBtZrc>!7L3b4_K?>psII@EN3Z%AgY$iP*99~ zaqgZdpFW1CbX+%%1g+8<=HXhpd#gZVjAJBn*x{DUJKz8;86u|yAq)5Sq5C?(l$a}^ zY*Ld~h!YTI*5|I6CWXtS$WND{;6>sOpSSV0LJhO%@_1}?1J>j18i{J09x?#LT(|UYNogAkO1@+> zqNCK=Z40;~;HXoH813Nx`gUGRK1XTh3pvhE0v^uUQbc+{!*NW4L+^}HyAlY5CafSW zp`FabAL_H_xM=IxEa0;O4--TH2`&+I;Q}{Rc7*%9 zZh1)n87q$b+86(GT%l(`(uQbV){*-E{6Yx4*ADGx38SU*7N~nCjANY6iH(G^@y8lVZT>^R0WU-Z7?GqFr5%`}ZDBxZ{zaGXTEUfZB z_ZrB+FrL02r2st6XEDWr;4d+mdhA&569v|W)N%N>9-oB;5MRr8zXT*fH%H>zVn@gb z@7a|2SHlKA5Uo|$)Z+XftxY}aaaGch^8fsz_pHYs{fc(VR3zeoyPHK^R%^M>y@SgE zq=AwysI^^}vO~5W8y+3`{=EeS1G*sUMsWnTvi~C&^aQB(CYSjH$bbQp7I@4+fWDD9 z;j;5l03VqQH1TB%`X7y)q5?AInZZ>2#Ko_AunXLVkgvDc{;NVz7@=S?zg*=@;ZPvV z;qE!A>2We_q^~Nz;QfkmOJc@@RLLSOHqgcOU-im!zyWVCk`0LQerH`jH+YEXo@SfT z)r8$7e*d?Xii08!2m-d%ru{Gk_Fb1#zO`h&Ssey}Xn~yqY}S6he`?(TMhvP*Hpyo> zrzotIxg`w^_jxB!(ii{im}DZvh2PNBcqF zqzejyoyK4V;>JIk;nC0ZwngN;1@&`b4ZQh1tP4!L1n3)}#WO~STMeTV zoT?;CSS<+i|LN+=!=YT;IOQahEz+?}W1BHbj&4! zt#dGE$yFl1tBfYceplt`W_ zFqgTzhF!Ws9gEjcbIPD#cGhVWU561Tp| zpGzPlDl6iI5o9`-B)ylbe0BN>lhA_p+6W!;uz2v?$=@gIOL;t5XVYcWZVD1!c`&2$ z?PP}~u+K8xCHu%xK|u?R2&9}T6bRHJrBDBv5%?JhwZ9*dFakUNr!KYOrz2TC%vF~V z<~=#f_w>|x!Omd~lV$5BoHAhSgcLjJJC%~e*!}|QZ@nA;IEz_3jM7SSn_FtJFoxqS*tQ=&+!3=n;`G6E$UY_l#gqz(cey8S&7#+=7DrUSWH#Tx|=4(0i{cgZ71 zcCl-bXf$MTY32?8rSQX@WplBUG|zw4gPAXoJ@dgRFi;mk+A>6GB083327bE{Eoy4< z&urc8w!_w$S3Gl)YG5Op9=POqIZH9a-6c}nNa2^~Rgk2UN2)TPR(($Z(Uc3Am9ryX z&a=JPo_o`x!x;J|QJv7oW0GCzA-V1M50EzGAiKAnrW{)g`pKJPkAHtW8PPk0W|NoqmN zH6`r_tkhv&=W)ZvCX1GUurb`BIYG;=XNmT@_xWNFT2YZ-PvNFp**0i1G`fval8M!) zwYmIq)-fNN0JV-UIwyqwr09S6AVH|`xgMp;dpz2$IOaI8_s4GKrqXfif=ebS60!p+ zm&vU3r0y5&z@}>R!g|U#6B$$`-aLF|vap^A_e%RPzUM3R(dYbI@{jgQk9o?Eyw_H1 z?tTnb_xq()d?#;uRTkV?zOGKnmCd>6fmOe9d}3{Gg#2Q?lu@L|TE>hmj+pSt@S($9 zj~OmDyS&efOoBSVGrQh!+l*l2l_)Q-_uCEX_y9(Q5lC>6@vsSd!WN-8IN8xk?Rn)F z0^UTm#T%?{bc%$x)8Tfn)LDr&l~toP5+Qhc6))>2jv3rLDt;5(l3V^P7HdAsyMbuT zp%h)MzV460#wj3lf`heu1<$4wIfW-?I8_0*;W@*;o*#_6(rN_dcAgQ}#~Qs9CVKD@ zvD?)h^S;O7LkPx`Bg**twZFanf_nn^I%j`a=s#H8Boz9qdB2%jV!ZLUQeKci`8kQE zzaRnWyw8oA=EbZghI$^mW6Q8BK9DbZVZuK_)vcbqIqn<5@a}A-?j%1n8@$~zaLTX9 zF0=pXY1@}A+8L6vUI$1Ki#^1x0uaW^vJ}4d(y-_i!cOrLnl08TYnNWO0-?qQ;@LC% z8AgV3BBh?AF}bXuZ98y5|1ptyQPrpZtgf|;P%>YD0`-c;DV<+f?)xNw;8YVDMBT-8 zBvO%+;o~aCubWGj`_ezn4|T=afIB5D6;vwH-=2=Mu#EYL!4$$g4F*GJH5M+8rY!E+ z2q@2h88B%jcAkbvL5M+ZG(2I;G;jyiW_vn%Ud6_a(hRATO`sL-PhMl-j`a$-uzgzy z`k6jV)2rm#&7`b>tg@ipBiif5qZ?pZWD;Ab+@_29y>a9f`#MxiDuOA|vYaGSf|tT! zhg-3E8qtH!%N?k;BDPs@*KAo`V3#Nk=*5Y;ouOT$Fiun8{x{-7+f`Q}uRjwDvfJpg zUgoxZ7n8E7j`c~X_;~xNT#F-+bD+}wqr`^9>dU%%KJ)zSQUfR`u4ZQ-yWj4pO7t2M-asCS|wFpBn*<;FZP>#F)9OG!4IH^^a-gwYNeck+A~F$gKpM(uXX&{x=?aVTZ2JX literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared_advanced.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared_advanced.drawio new file mode 100644 index 0000000..6f96eca --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared_advanced.drawio @@ -0,0 +1,187 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared_advanced.png b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP5/shared_advanced.png new file mode 100644 index 0000000000000000000000000000000000000000..da9899157d390e82e60b50211bfff24637e8dfb2 GIT binary patch literal 90372 zcmeFZ1zc45`ae#mNR5b~fG9Xh$k1I5N~s_z zp@@`p`2P$uqZqq)@4epr?e~AL>&u;U&Ybu>@qXSLzkm2CqP@GhfJB@>b z55d8~lO!Pmd)OLOJaKSzJ3QodJsf?k?HsId*!WJMKe6%h*gCs=u<^;U@q#}hRw8D? zB3y#zfUsZGYbnrE||Hnpg9kZfUu>72>2Q}$I;o+&f3n(5_298FAo)V8ggvmKF|;+#*|XnA>P={l-u3&EXzw3UTSPN5g&W##5>2QIZOI~X6gAh!VO0G~XNuBDxs zjhmSxxRM=4NM}rZHMvf?o;7nam*Lg)^yaZrP(@$I$qYQ|_C?@8PF&#mF&A<4QFJqN zu~h|&a{yPe^ugW=wG`A-TKb~*2#ai=#LHvjhP~a69h!E2nCruU=uzj{c-mQ7xnr(| z-sR!!?BHSN^6gFwXD25huW!C+=H}+?{q5JRogFZX#N5>dtmB)LP&+g&%p88)t7B*B zVT)OX0Os*f-&V4+v$4hA8ODP-;%J8bGG>Rnt(m2>H~ReTUE9)kb9M%&%5Piw2`dMb z@UU`0pQrFUN54G3+ZTKN;}bB7@G^7o#H>x#%)-{r3D_P=(C!|-*fqO3dpcQedkpXn zS#MiA4=YUpRI?Z1K2|O1#nV_6V49KZrdy4vlOrrw&Vx<-GS}eTkSX^ z%xlgkCEXMiy~WiIIIiLwJ()B!H{Z7+}kUl4Wyc!NELy@<1m2k>RHFZTma zjK1Et_W-+h-1py6v89>2?Y23f^!@vK{mv5PWfTiD zk#|^!;PxM|{})&XOyvKadGP;W9-6km(k;QNwNER6e}P*69bJ4Uk(xaEOPSR{$K^-qzc; zM9hX93RO^0w|z(swMf(!`ZhnoDGxI@8!O^?Uu z2Qv>lFAP9qaPenwg}DRV*=`$2u&9Yu3`S93fDwBMcV|yG3oFc7K&)S)%l8+;!Y5Ya z*lp~E&@%YpLfh#11+TXsa(mYw0IJZh)34A!rC%!_I}fy7Y@Y_UP*$;R2jKHpqd;w7 zZQ>g!{5i1wuGyevk2V`j6#4sF5-&DZ{=1gMDRYM!N`t#IDWSjZ(@?iCfRlp8_;{OSC!U79c zPyY&a!enGSkQ}QK0CfLHHS!;%F}ytAs|vII4^)K>#Q%<}K+5}l)cucS3uacr))v69 zzx6aWUOqt!VJma%Ut{t@fN*ZF24nNQSbn%ekl6UPGbm#r@ZS<724{8{{nvcqI{^9? z2>!{u>o1X{0PI^yeqq{wg(QE>yx?wjUS=Ms@(P+;V<_7WO#l0fR8aUIi}XLnt+DFd zVVysO#Xn1~|0(W;zRORz^-hw61)-fR35KzPzX{>~UVC4l1&bMfmT(L4eQO51*dUC( z(61xhFiaTv1xg3_{3V^@0X0Qz3ib1Z3QM?AWdzh`JrvzWpY^+h`_CB)24w%nh9V^L zoqn+~2&>;eYbe6Jus`6_yx;S*UuZTzCgOm;q5cEX|3Av!e%HGGJf9YVVQ4Kjqrqxm zM@Yo_@=kJr{Tf#P{|cdo{g^v{34}Zt<^12J*1teG0>a-?=%4WwVT}HED(9C_=pWM^ z^on-SlRu8F02ER6iGKzzx6ydJsDZ`e9UzM;gncb*Y;U2A_DkgpZsleN3hk&2_Kyo- zJA*U^*1myW3>^PWVl*GNC4=?Qe-(Q9u(>k!LRi1X`tYvE%EQ~)%^u_=C$a6HuMHur=D?#X zU>s)$8vLUI6iAD|G|_fep}_txeSlwCiuwfr4CCQNx0=5coOrRB_6|M4_%SfOQ&GPn z`$lE`;P1}n!PlJei>AJB+hHOnN=exI{y(RsFU5=RwS-O5|7KbOy|?eQ1mnX{i@!um zKW6qnL`n-!H?J=}$Q@zR!okel-40bk+EKUtUBmsGL?nUla{e#Hc5EQ|v&q2s^_U+n z^g9s=bj!?qfnQ+n=Ynb@xueAP^S+XRz<1dT#)-f7%+Xi;+VJ`3dO%n=+Y#=ZoWb*{ z$!PruqCf7@-2NVqoi#Yc$qdz*^Kb)04q%i5OwaIu!3%T))(H#E|G?pSJW%(>Vl~D% z{}2KGyg$2Hf$qMU`Sz#stW)g5R>@FIKbD z*|9La6Oys~2WvL}O3uRjV;cE`v;Wk;-GME8{85|NQUQ#jVEFR(moeMej@}nqj43@} zdG%LHjH*Il8S(F8$WHRhi$Tf13$9>eCWaHi1Tal7tit{*t_Whu)bCyBcW?znOfU(C zovQhY27l20#for;>th|<-NkI%f4@v7VJBfM(DO#92^lvVb0`SZ;4f;}ZpWvisGX>e z84s#O!)0yeXy*V{gE|LX-^|fv`yd}EyMfSQ<=|z7YS{g7?7Ra8 zAW%1Oa&~h>&FAbq?2Va2LLKKvKj`+;Iar}4W4ORtE$p1YAm2~UNAW@~48))gW7>?^ z%WogH0~1@Qxkc1*o*j?2ebB?r%*ovvJQViwsG%>+!vV5t`R(0zo^EbtVQ;ftMCbZW z=)3{|L@;9i?($wR!=7d3(V1zX*B1CCV^?pJc_@I@GU5UhIU@4r275 z7{RcDf!dJ}u>WtPBd95f2nz9;{i1j4H1=+u`p$Lh5 zr(Y~`{;`F6q2hJe2%RKFX>|9pW-Pzbz@jJ^(*0b#4MJ3Qz=)}+O{<_<0W z5Dfo+*8T%;q3rkrm;j0lU}P`wecA5M@|W*3gC8#RJAvq*Zw7uBM+MP!#$VM8}Ne}w)F2!A@gJE41bfnNC2BzVlkcnU#?Mq7aaJ7 z!2H>cKWO;E2I}8I84ykX+14Odpx;=>|0>oyTZ{jzSffWFv1IMPyg<$WGv4-}Y7O%L zSPlGvx9tG$|C-j|cW5d2hiLg{$(`W$FN6N^Wq%S$|=ZkpJH(g!6Z8*h{4O2-+H&~ks?X@~@DJYl#6%S|f?+xie=lbJ z<=sq-#`&=0>sSi>XF*-yyTT+*ED8Z&?|0gmX^f=~E<`lOFE&n&?_>blsvGb3pvDB{%kO6(L9KWD_YJTU z>Dw>dVhYndUUp_XrXvAHq9gCuft?@E{u-sfI~%zE_h)1GfZP3d3|eCQy;uOiR=9Qm z0PJU#Fzh}oYX2*(3VuvY^(P2`a;tAfTd_v6?Qj3cf}EVWtb8zowA-&km^*_XrUXC8 z34XQE0`)_J?qK5&-<;t3?!5_M59mkwoxxl1zJ&|w2h70lA2|T?1r*_DU5p(Q3@$s~ zJH?!|<5g75Fz65M3|^iehy>>4l`jM6Uw$u=|GQs3`q>;8w(P#M#`%4R_+Qa1){6e8 z*==+9#hMl1!7yMf7sHBsr_=r-)dIu+`g5&dFVNe|Ai`X8lN&>Utg`iOLgBcMUHN4vqAtdO( z!mJl1{Fj*HnWfTRX;__^_s4tnz(&eLLe{Aonmt?5jh)^kVb<`N;Zu-mD)v38c{DIR+E2JW_Vfo2JRXu zI4Y$_LU96hsvHXosS=#v?R{TCTT-%i;de)=FCsgbw(t6H-@O5WFN4G!&y^iIKi(GIYwS;<7`MM}c`!I$z`kb)+*Pjcp`+_aBk9IMyVPV~ z$?;=n?m|e9(@uN7?;?E^&-`dG_;YNUgny>(^Gv8wIltG({>Z7`{4BXhniX(L+eEQ_ zZ*#oVR)k6L<{srl&bkwn5)dn9-}$#PV^6PK;xUu${2X^ctfR``+v8)uNapAMGIz!n z{6|eC>-$Hm1J`-1o4Mjnrs>7JIP(n4%-?HVu3Z0Ep^yZ(eA}MROu;BfKv+BZJWG`sJflF~DRuEVxyyl- zv-RZk!Y(XlyKb8`KK}HsbEW|P5|L?A6Qq>Pf5$Fm)TqSiz%A7jx|8sN+|BjnQE+4H z{n={QWvc^L3(j^QvusQ5ZWXb4mTKF5cMq@4vzUY<>d9pk4E!YiOCRchv1r`4Jh@-O zkN+8+A%gW;$K7F;Lo71XmgINep*?TqvUDn0)Z$d{A)|5+dJ(t7r*Em)?SAv>zSW5b z)@`ka)BQh+&}v>3bbK9gvQxCcZS0h0{Mc2KAei%(=FL-KWP6UWXk^NbhqTw96E})n z;bZENT764vu`l9o{QOvp#q{gq$4Rg(MFhe;+qlZF*&Jq8PrzwhDf}DqWs#lc`Nu=z zwxParO?%t+>j@J-b9~=*=Mn+oBPCdaIeBcUzAI@|DQk|`xmci=g52BV7`-UtxgLZ1 zAl0sm7E?pw#pg-X(j^bPD^M4@5ihw$V)gVg%$-T#ETnpMoKbxBZNhk4wf*W$&1d*S z2R$AlbATI4za5UGh8R3_kV)pZYsF2&?S^pYArOJH*RC4-J=s4i!lcd#@yN*(+e6s2 zGB-N6wLYUr193>mgL8V!+$SXDqUPk#zQ?o4i__OFJIrvIOJ=wwH?LZb#Sf1L^7;VE zcu@9}8lq0vWDzexG~mA1up%eZ7jKSb47X}Ylz-pXJ@(ERff&u0 zqIq-QHp6tkVkjPA%*DsQu|-F=4NVj^TRy&sYtx=qbqH#Js9$Y9qe?x?4gk#gg_Z&O z@iG)@vk?gGaIfjt*QBk9#QAn-7?!zRO6rq&MZ9}IPA<)^r`D|mxr7y7)4b*g*F6x5 zGk3LQiqCczc+VIYFi|e-+K9VLsUzb$HzH3vQ;T#ZqpR>a2BqIKb|yXq6eSi6Fn_y?s~fI*Vv+<--GWBUq6s4y+0 zI;nsQ$F>Y!mJnhNE#i=?knaa}SWF3ITK6|nmXt%+e z1cryp1(kKkH5WG`jiNuK8Ainh?vY8JZ-n~S3U#qo~;ph z9)XDq;lSR8?wyHIJSIbJVR@G-6X2q($FP7SI;`ZQ!U&ndX9qb%y;QG!*1QyWx~&p+ zhD+P=OnQhaq7X?h>H$qsN4(1QHR4#17Urs4EB0G_&t7Ka(C5b7a8vmzJV%==!7xtb z;EGVbr)nbSwXEUS7O{Erz%pk0oNKO4*;Z-zY;xvzS$Vl+%OmQKigc3;fE#5z97)bc z2TmbUVLAwxeo?8#{#I%fXvRO%xvO>5q3>ba=)`r&Bt9Fp4}B%=hnw9`L+R@4>kC|l z>uqz6>lWbj<{6#ixSBNY!uznI`x0_iP@{P7J+MlIrj~WCL%2cn5?g7xzP-NFR`>|ps zx!tzg)cW1WHx*ej=ZJ1=-TBSVzBLJ!BpE15$EANB#DZ%7_JW^XU`JsvlR0hp4h{o%}+YvxBM~o#ZBduM(>AV=G}MCm?Fv*nFArj zluZ05KLQ}PxUUz_B=K5&d1W*{1?Fxn=JkPRRKo8Qw0di8O3D6#&zyOu5bf)*@NmXx zB@ks|OV>7+2Q{)3DER2ui?g8Dgq+h>`GU6sI@PZ6T6NR}e^zqzn(V0SGIOiB-Tdy! zIMDj}-_odYr4h0f+kq9BODZjp5?m=@>6MMrRqpE|8}lsA9k;HFD!>*EKy8Dqy&?;Nd>e${-@4Lxos+O6s(0#8H0(n#J*`R#9>O8>v zLm=%$mwQglHZwZY&uxT;{a>560 zeB{DYnm0d2{mKoHS*3JZmhU2EQ~ZoGjb3O_6(MLwvdD}N%+y@)-{yd zyY7V)Db02`)s)S2-Jv~o85(+B%$vbgBi~r!5RT7E8q9)dlK09HbtZSyeC^!i!n2KX z@OvgT0}*@Z{5c`)5X${hO(eMoJ+4IELF!g`aq(KW(%(cP1#Y;GHX}Lc$aCo%!YPFk znJP-jqEHW?`FjuFgd!^0=|Q5h@Q%O;=M5t+i1;UF;JdQ$*6U)urHZe{I@P6O4?{k* z&#*y7y*}8=;d34MkOg2<0UpCF#ROz2>C|5uI^9=dvGn1Uf=VeFUEkO{Cpxln7S%Ly z5m|VuuxoupNPhL&vHGwayUtr6!f_ocLY5|~rU>pclO>OJ%rNb{qnWJ$D3$7v2p2zu zW4{m~;XVyZc^yN-uytWaSMU6=tH{#52R97~oMKeq(U9;md z-4&J-hS15L=aLM=$BzPx$IkH93Q=&+J-z0;wLa%`jD4FLck?KOgu94AQ`#4r4_6yy zGt!P8qrW=L4W<9^roik(2ckZx+~XZW)bqVuYilHOC?z;9Os3ak$~^r;_(x^PX$T=? zx5kyW6rmIx7c$Cc?Q{?b1=teGM6iAUcFf+9(gWc&GbC=Jn<}LvCEHAn3Yj5Mg0I9C z`_Z5yk0c%wY1B}Pmu;&Ow|Yk5vt+9eAT%|mW$0rlwGjYtnaZW#i(9DuLx1tXId-U_ zyMRxMNWN)tLaT^l3h6>x;F6xZgp-5v$NsXm;?maA=@wR*VddBFIWD5Ip85B7AJFQW zQ)NLCGyxf@)>ruNaV8-fk0T)`=hLgR&=ek@Nb^@iunJP0(IFT~0ugmTzBWe7GOD#l z5Qry3l7K5FoX-Pr&(6Wm1=;ZHyrsGVl8nNjO}~Ec!9d%t+tl19)edO~0G%@qn3MPT z@bbC1`*`cV1j{_lY&GGajZ)uRfacsjeUnT(&(Q9-hOx(&@WmUi9yb}V{N%;uyD%>B zzD*~AI?&~#(VSKxof$A%-Qn#@+k{VT!vXFShlAf zXuWV9-OC`qy+2j`jk1X3K^aiPF94-gWYNyw~Uxmt5Z!%P7^{6KEOi?r10>s$K=xUxi0T`UcQ3BBc0$-c00H*A{fnah@%ST5v(M18k%UMjS#|< zq=o>nY64k#tj}$o{Io){Sr_#jLdyO_igEmjI8iwI_|MX%;y-V#w{NrwtwSJ$+|&!yDz;pthuDMiuRy+3JJO2cBIQYZE>SwVkHt zF%2n{YcODeLULpF#GxRloGrD8=ljd=u8zJgbf)3t=g@rSK zzwEJFq@4u(1uu|LAZVMvgsvPOqLry5WfJuuX}Nm*5nv8&8I{tZc;mCzMLo~Dmj=JR zq!^Rap)R#~9t4eHK)DFRBDkO+7MT%{Hq|GnOGawv>dU)iO?83@aNr=+XT|0NzIo^oLV1}Z>DYVi1;Zee`{ zW4Ww$MIYNWC`(DH17iZpr!TF zN68|Uj+>7+UD|~<_wicte3Tczyb${t*sv8RF{(?1-)yF`CZ#;hSFje+0Rbc7j@FiV0aK(t~7!h%7%ModPk zFDI-zYfG{1D zMk1(nt0S^5A|px$IXw59qAbCoj^7Z?WNTP~B@F9;45v;Be!j!p{%#>FNC-Fr?s9G? zYE&aA=IetGplxpC>{(-wEexMYJ*$E)^fUs9CzwMh|CI+XlK>Ffd^Gwf-e&g|5dd(T zZwoCRRq_r3R+DAjmV9LM8uNrdsy>!+zdAXaL>TqRms8(IV(Md))U(O*w*bKo1{h+& z6EfS;aC=|0v(=P&!^YLg!E>m!q4GGjkDlofD##Nmv_kc@oh1(;HA+<6eFP;nT_ed z_~;Mo9BI#(I!Qh2jY^NIWf{^jq-BLNRF{;jT$F-YGGIB3eDB-$Z>8+-UW$;uhYFSq z84PGgpbEWsa7Y*axcjK(QUp5#0w_t=<+*?r=9yfSY73DUa}rLB+-1kZMfng8-N_RW zO#M#k;E)nrH&4x<+prY=Qhhwb3=}+kE`eq3HM@HhyDT?67#+mTlWhJ##=A%y98xkz ze9R##Ty@e$T{z&S*|v+RBm~?5-)oJ;Vhy*ALYg2zl|=!8$WsFV*uOB9U-Pv4NiWCE zExFoo@R$K421Zy_gwW1zuc1~)zhQ4EJxCoRa5*K8VI+1?t=2;3piVZ`;L+qDC6s#Z zjP+Qe%XV@s+9)nGJUr~-`Fb7T)1Ig^&M1?mqC(lX`89qe%)`!-<1ItLI_9H2U$Ds4 zW}_Y<%HTTo5u|BLv$xeUc0kN)7cLc32VeIPxQ949uo~Dg2`Khq)Q3P7Bu_0%F@C^* zYs0rpG;BkgIs}e#mQy*oW#|k&Liz)V90&C6dx%)UT`s&(6(ISGI_egCF_IsoiO>d0 zds0H4F(6l)jv`2%XKgt#{BCHFAQJ*f%;~&3(Vl*Maeo~Gudr2O z6%sibV6=Yg(NwtSurpA#^-aMtaj3lYN*%^VkE~=cZO#p?GNnN#)9u`+` zynEoxZX>)3%CzQ>&OzY2Z@7@xFhUI>InN802saL#X*ELBi|y}@`f`5~g2UiYh@oH& zLlHrk30F7~x?s0m4y$IP8bo9U75}zk{n_}i%Eb;9an;w4I!fhr?I|$aM>P^LX2X2qY08EYP#J0+%kI1#4~T;sOa-A}C{b8^oxe|i zkZFsk?Y&NY#M}e;UBjCs2qEVIx%%^@u5D*)? znd--jOgLQksE?A>?!~%_kvgG#AG^Twa!qIP^qPW4fdf-@j6zPPbswJ4K$h`trhkze zz@J75++bSBlG$~{L5B|d%8OiVuRY#}UDIqfUEk7#{w9X69dMsqz=Zp}qseB3qUKH5 z#S2SQ2+JqGWf=^b(Zi5pfBhzh-~+~*aJEM2SNpojEO6E96G zj5MB{^;=l7?YJRet-=%=nMHiiXf4L4(8G6QCOFu<_44YipeC9!jp|dX9u$mtQ8(+= zvl}iPuWrhp2&yxX=o@*_M6TpF7&yrw2(fCZL6mhq8m`C+cX`_pbUEk_8I$T2kYA^+ zj~(d>zInJ=<$63`m~!LhE!Qa-ITE+k(EAf_095Pg_~zRV}wnQY7QM$NvqgD5xlz3;=)qhT?+r!h2mp$GAU|R z8aEXrc9Bh;f5dCaPe(=;H#@vpVADhPzAC<)#eP-Msa zLNf8-Z(-&u25)B9Z<5nX*fDLD29OH0>}@Xc<+wEUY65<<%blK1lJ?H&Y?;pTJ%x75 zFvIc{Mty<1*5jq7W9$LmZ(01j&PJU{|0sXuwD0q3dy~r34pW${eNVBA@1EQ%FiKmaOb@xxeJbN*j?kfd;?)C2G>~fcye$ka4RI3yw(iLR!DSnI zqRwVavXX!tT9R^`#7XYWkBNMch=f1?4f@GLv{iRS<9y3SF6cw&RfvJ$y{4`*4wsdo zpvqVGB?W`#4!mq03^o#A4ZRs0|M2n33T^ZKp<~d==F4mbyNlj;bc&aFj*7OXiT3QD zH6rJN%&0Jgd0!2TI%z>P+IojpLAbPB{0i6Q1EaT&%MJvDsdQ_c^B>+?*F;(@m#`8L z8l|0@Xph=6Ra2|u?={jPWMbBGK|pu)i4&(DKe>(CX2bu3W=nFBG7yt-(rih!hD~FY?19 zUhz1(>GF)AQEehZ!loC+>4)5VK8*Vtz&on$7!L1$={swqlFmaD!+~6<8r+I!=pvWe zFLieJm{ht*m_pm@45O>nsPYSehsG&0Qpz6n>+D?GLFGsEW#&NInQ=O@pI*uW))Q24 zm=&60;Ws&~cu`oxT=S|c!*%qBd8z=k9OD9^yYD(o+xh_N(l^(3B+E4wWVqQ9FVnwt{d^GE61#M_kqqy(|B77%*RO`ci-w zIrh<6G{?X`9<1_TZhreDq0ODk;9(=6(6gYHXa-1mX~3%6jhVrqb;kumkHt4qHq7UU zD0oMoT{=XpmL_i3_$&k$pNfv|0$43AsPbM#Mnt#0HA@NQgbt)j;io(5#m~eaXv!9g zOWMarHxjlX-*L}T$K67!Lg;LUTe0ZmfU_|DRINes%HplX9GKMys?m|lBca5FmUSwJ zPbNe1d+cc&)Dvc1fXYfl^1c1?EgCN)2CxgR?VK*QcRLRoTcP_Y?aG`;`A z-F(5?=O;|ET&J%Vx-NU`R*h7N5rhRgeh{NoG=F515@Vnp;6r%|?z7Tz>k$UiYWETt z5;lQqTI>}hXm#n<1WE8(J`Q=;nQgH;KQ>PFtYic9ACJt!ArYwc82@YhnHRbJ)io?3Fq8yzMp(kRu<`BI#X>q*-;r+CJ>o-qVq^h?bDm& zE}J!$Ko4_DBrWyg(jbjGVKT#4H&7WCg{beJ@5)Yyj71`$n{InP9T4v^6i_a? zA=3FMLwTmor^=VuqHQSl^ofBqYfi6K_Z#($xnfzG@wm78EEFlnxkzLModwsVV3TBk5n%eNhMO3sUu#5yZXYLsR)$E&!W8HsvZyBWCxK#b zBDc|50y$7KDX{BgKLoY4LbZ&ED487Izfp!4IS(>rDa7&;Cxa5c`HLGTt+f>6ndEP& zT$>$@mts(st@2xB4OEBK(ijCUw=??;;abG5fMJ4GdXZ{S*n&E@%t|2ir@L){BNlB8eennQS~%&dLgIO)qV2hQZ~Z})6HYJVGOxnPgj{_91cCRYW4D$sR$^DGLgb=vpAx~_rmwKXw`;LmyDj*RZHK%l@O~6 z%_62`vAER=msT9oR5`C6R!=Ir;ezK`!~FyGukI`H|RPqAXZnUX(5$# zUT|IFw~wzdQi`v*9F}>G^gCLqTQ08eIT^{t*ki6V`0QonL}^)dck#-6nM8$TLj~Uv z^QWm}J~us#yL@xY%3d!nI5KwJk(c-&>OuD;VbJ-4_k6g8?VD2eybWJH1Zz_8JANTd z5*vZQnK?a8Im8~q*fUtTDf)2H=n?f(M_8YpzI|IBuF@{kN;Xbzdm;Q#cBtCsio}Z> zfvuJ~ThqM@)QFLhFcXbDm)#%MKjP7_jq~CI5*<-cXQ6T1_DRIerA7BqMGEO;kNAwB ztVG?pE%C0qgZ$aMT+}TNXh?evh{8Q)*9}ZJ z;~J>#`>OREFCR02-4Ck|Z@(G9FMvu;6jW1bVYg=D_7gnn_Er*pT4~r6pf;>|!^f`c z_PS_LjmJSA!mzy9?wX@ttY1c92p1>jQYl`D_b8u}EE^dfSddn&*xnSdmT8{}w{{i;3L3(`o^sEc|@ILWsS)9`Ey`L!^{$rKM+XsqDLQ2D`^)%1|J`0Ci3gV- z0{RzhBO=ZL&z8UxPBf_NjsQM3*^z;NDv>jiLnjXj>hmujIx@b$aL&`NY7^-Q}*J%_sjrl%+8nlVfuqM5Lm9cj)Pv)5%o0w5$oCz zT+sJwNDtnM+}d0RrQ#2}yK7H?@{IiL8JsqgZN1dakb-7(Q}o^}z|AMSbN2S+o5X`A zttl9R(5((A6S=&Q`#F)zfG1$Z1&o3bqdJf6^AqAPQ4@gm^RvF@$1n&y zEj_$A-M2S^U6t3;e0>$4Qrz?&_2-R+_~eJ`v?o1M4SYzMxptYL zKTPhlJ;`3&8%vumU0JB_G)jSj+lmQ(EP5P;#f5~E7)~MmTkSr#$MGIi&bKIh$?#b4 zT$NBxK77}18v{a-hp4WHjnIT>$p{&!Dxn@)91LL%;~th^#jpY=0?3IBu7jv8Irz`wBa@$L9O^ke)ZSdC8~T` z3q(q=f_HWWeM!u}ROz5_Jd#koMu(|Qqt}mf1Qd#g$Zrp$YjXs|p}U6-oCqJOR7yoZ zF>0Bt90|M^r{5*%dA{xVv8J(^OF=T5=8*y<=(FKRYR~CsUpRh2^n%#9)LhlHix^2P z!7N9J%hhlW99v2xWrzfhnt_z^E>nt-XFbb%aSXlgc<+%mE>TM7dgyk}EEhkQx(b-m_0^HhzI0?Du_<~ajYDK4bs$SEO-I*zr zh0reX?ZXKeov$*wLOfr?iMvp`c(AD!7bgs7gWNPvjtwYuG__HB- zh|Dxk9xG3UY+r{fhR3=QzzGlU|FV|EGikt z_GSTL6AO-1d85gVqW%;Id&PaqD*T>ypX_reK-DyT0omPDRSHJH5-f3Um5KW>?hLAPojn+wzn6E~mh zcx}E{pXX(>w|0Th)ZPVYcn6IPIUyIr7?;jb?Hv4&`mi~Ak0!qZ(iAwKh2OLRdwSC3 zECK9kEPnt45w%AMJmArVNF;~42u_VIv9;h3H`JCQiIOFKQDHz63@mwc2t=48xaCab zVX`{pgcgVC`(&nY@pHU!p(G)R2x8n++=8cW@~@o&C5URBa9-hdyood)If!%OUOsby zlY@CG(WrD#N%N3X#!#E~E~4xdh&*{2+>j>-p-r#vP9LF4PIm6efxXk3k0wWoGYRA? zM|38zF3E@|db>#%egoH~#}B{#M6ebDk=|Bd8156BlZ_Zj?PeN<`YcZMIc24gBB3Fv zi2|XaeGR$x#^L%p59amtjAx$a7@6R8)RXNuu{7eSppzDwVm}g>uJe?4+#=GGmUi^G zty!u08=@wg$@0dO8&FZ7MNUGB{NkJBwCPqENl17`OBalT=zQ<^i#^f3)33uuZTeux zUT4GV$AlouIPGk$WSYX+~wYmEL2>$0~Z=hRdohk*qhhdPPI1KAAiSMFFWW^?l#*)zjlYu zuD6|=Yhi0cTjP_QH|^S`iosE5DTXsWChGSI`8asjN4qojADLOVq2VRUo)#QGpk>?adMwA-eHv_s%z;_TiNtX8MSFQ^MLY_2a zn%Bzdf5M*#-PkiVG`(f0r58MNg-bZWQyv;d_SyMaN&x-Er@Nk1u7(q@Cgx31!G*DnXK8v$ld(NYx#>i=)(r&k_E2``t<*-r0m=bt4 zet-^=J}qUpdv#;0GhRwMotvxBthZ#`lxglmEMsl1!OB8=i_+?3758LRvN~wKwH^Gt zy75s2FKYr!cTGK>T}hbi37^q$x>}RBMJc~v*{GPZG(5qVJ*(aBbxH1-x8m+h--cuK z!fw3AcXiuHq9%im8~J-p)D6BGcJ^!lb!M|A^MMQd*I8w#{V$xAK@+{RcpEi>_!84P zrme4AhBTRe^F0@rgES=y)ZvG$2(apA0C)13@vd#f+p5C~f( zO3JU@?Q?T1Jo9|Xw2z^=JG`Q=&T6TvkeV)P@BN!{pvA@G{*>NfFqjP0{@N@rsdEPX z(kRH$4(FEyZ#i@!Y$lIm2swn3g$k!64Wm9DNH!fTj8;n92x`49xm)VGNLbK`M`n#7 zA78FKQ7rXbU?M|AJUI%sTH6t1bdgif&0|W8^XaCrzn?IB9MgG^ zcYK+saunzwsxV6JXXZ4pf&)< zl7-|mzAKlT!f`GbRuwHOP`O`ibHPGKhl71{MB;O$WI~u@$NW&xZ2Yknp8TaE6XzE+ zGEPUh=9;F&r%(60QH;L%3_I3FoL}CZbEccVyO4QF3l3?$LRZXK9SRU3`NZkitK>+t z1i{;Vw+VMMtMC3H;t$<=YzB)I?#P^>z6E&$B)&LAbTarc=5V+R9^N z!z@}mB%8U;J9gjIC2$m7RJg*hco@1r*W6SqN?B&^)Vs>b)gGut@omkU!U{1dkx#p) z>buA8$Tu9jt(Cj`Yk_ZPK^4Ks0o^XJV6sO*U1IyVy zwWV+O95rT$HSmZj!YLXloQ7#mWSLSk2!-DAQs)&v@~B801k{t2J_2kr6E-UNxqCh~8Nq#i<4SUbT|o3+IIYDa z9m1^#q3~$erwqwpsKJzxaxDE{HDmjGL*H)EU@4K}p{IgE}#1fT!>w_Lohdk0> zk9wED4L{FF1yuTp5H0)CGI|GxFVv*UPe;kS3^g)aI|FWJHPcp?NMR52{7AN6vXt5R z;XUX6IM5E>Gacly2Lh^aEXoh}+jeJU?|ar0JJmY#7;%NaR)Kr?(Ap>{hQb^^h^;L4 z>uEvfI3=ZA7>+XebdW?@FLGSV*W0S{YSUGH?fLGUU;aY+(>@sF`KEFClI6nC45Uef zP=5TL2#@0cnPt$iaGgXj?e(N=4r=0eb{~BQc5ecG>rO+bYv8DLJSO==8Jzz zkg;eacOZA)ai)d(bIRSxiyGBrCrq67GBuvQspcP!)Gc3fr=5IqLjU^HCRW0`TZ_GC zb}>j0`p%Clg65f7U6iWr0Ft*^)#Q9=m00HBMVHa7qK#3bQja;I7;LXt=F?Hz_8v-(h^p<0@7-0Le*$<=hN z$uZ9H0q07N4APZ+L1TWGQ`o?FiF}x?R-)32HeZ{(>X7{Y(!Z%q6T0j0`I| z3`@F}r&-c}47}*!Z$)n1iZ4$<`PrjJ-$i`S^EP+~SnZvq`U*Lb*kM_A7S@`}h8*-|GZYbG`O_)aBX`)5mOdO*b%+yIZvfp?ho-vNVIOp}2z*(fj5;lRUu#4#mrWvZj)dc^NK@A;xDHPPMI#Qyj-P z43E3!)SooTAUk#9!9%0A&#(&f}S8?W%Sj&sB2LP#N0y{6pug$YWcY;_};*hC1{#ADM1E#(n9%kr~-NG#n{4A+gb3 z1*bZ$b2o0_dWyxT8@`jzGa~2VjT3p%4b>J8)T`K_(4c)So#htCJw7%m_qgovF$E|%C%c*YlD8ltYrYDEF8rcBnqCyHcbzou5q?7O2-cM(4D1R0v zib_)Uh+U(^tALqh1LVz!uOX*`#~9^$$T0+eRWUns)dUH8Bzk zq(AFWyxz1Z^H{NyB-yD*9pC-v=-RSUV5p&Yc}WdRP%I(nltV6pqc0P_7Z34a_N(3 zCn8B&<>R++xI-eHum-K>c%#2L#6EkQjg{V^s9zH-2&3mNGzSw(vpHG(jC$ZScCxx(x@PUq#zRCS@quE{r-h_-}l6vnP=wA z%tITGcP8(84+UbJ=Tt|M(PZTxnCT$)imtaS`yzFm~{mCpSQ) z5qjdkmjI`Sb2}U~(A4x{=djPus8NfDixLB5WDKok{D|K<9<huhkHZ=Y4pERC!2{;v4z})TqhLa zq^C3Y-j%`rIvW%R|GNQkdbm2B##{k8_QeN%QkxU<4Chn|w;)p>l)8uu`8;ZjzsPt_ zUpl5*59xJ)Fo#T*Nt5_u-{KE4eE(f~N?xdCQ$(V;-dkNWY5gckBZ}24U)q!ZrFnNSQ zxN$_bEmfew*eeTm=l?8ZZx!^mF>+Z0h~Uo{xpyRUg>r=3XmPIu;snx;zzOCjwG?O+ zstHGdv=31w4~hnr!%ZO98_d(c+0@UkK#noC1zl(U#oUO{WEGhwe7K_60&G3o$-Vz> zgAq|vT@-Yo`)##ziIM4rZ>l$pV-KnzIS2Wzrh>jA<#~{=CX*4e5L%Pib6be2=_H{k zY`*R(s~;U49uH~4RY;^N0(I#rrdbIUkf06|c3XagC2rm5?F?K^Fez}W(9iDn-${vv z6ADsIu=L_+sRu8&H7{1Fw?2}Cq+`SD*C4exaqHEFO~>OQPlzCw9VfRPpDK7HTp-D= zhje?B22~WdkuMUU%^@A_#3TtZ5m}2;b|G$NFk4PUAz|G`h|1>|i)Mze5fE@uBxTO^ zpU<)lLDx72X7i3>Jw7_8O*5_-M)dT1L;TEei^(8oOE~$2zpjFsXnYlXh+DNZFU~5| zlMG_<(%2GTp$alJDAZD%Lu}28{tDq~8$<;YSc{0Zf<9V^D`)kA^D~Dn)Z}vSJNev%^+j!h1N(P-7!g0ef zwAgZ7o=aJ#S=RMMOO7qYi@w!O_S+P8(oW(fjFVn3pY#pTSu_MtQ#amkl%j&eC0Wgo z{j@wRH*{0t(b)QXsX@>vNBKhwoS`^A^Xxc&y#1Cg}8K(kN z?Ldc#u3^_b zfG<-vr-OwGM-5!-FxhmTQiT7Ld>)XYz^SFq)u=ou;32`X?8e>dZe=^}V+S$X>gSYJ z)TQrr;-A8=U3GK*)K!;%hYn8msv@7-I}$a%OyqVvRXGZ;8FT zCa*gT+!%Vck^e_%6}WIU%$GTDn8hmd*y+VH;&zQT^Pz7UK2`a+5A(0iYF>5@Ud{^58unG>P@+NwC|B zJ3A=g%y;jCK4a(37|%b4D8!`%NG70{3-#dwm4B>q}fsx__M{a*H7doMU` zlfb>^%cgJVM(DVy(S?wJ5RvE$-WHW{3T(f(PxF7<2W1a;6_S(?Y>I+r6h8(Rte=Ax z1yQeVj&7KI>G+ho{rS~2ouKK764ezLe4Il}W<0N*OFtr3 z!4M+&)IK1o-WbPP9Gy{LV9NmcCK15T7}?)+lQKplVNS9T~a*e?&4= zwYZR*Ywg#l!iICGgxm!+?8{EDRWSoJ>BXKzH{N4Ig1tIK)8Ugnrbye|qNJCsu@fW; zT97H6kA!Swy+PR@}Rhy-T z)*S~j_WHzH2dHe=K(e=P_DG{Cm|MPE-s{h7=X)XLn)0DuKBcV6UJK%6=dkQ2B^!`P zb4a$==Ho9-`F@WdJNE4V9OVG6)ETT=mN4a#7+wj$E!iN0$TiofJ-hWuFJP+U^8KIG z2$r0qO;VT3H4z-dXuV1CC$*5pv2VNG_g}fKSg?uJ9p8Ih;w^!ug5+chbu?U1xYWwJ zd)wOb^y|j5GAcmY(1R$U(ioFTHT>%dRONd8&jYOa%~tz&C&B~RQs0s^RT%V-s-I}f zCUH`Bz9L`bg!~k6iP&I5AhJw3s(nECG=9+(Z`#8|k^sa{dCb}wf^Y+RVNh@Lub~&L z)9%~k{bWTLBK&Ag16kAY>I7N%s|UR~amf74AZJO>*M=a*WY!Pvw@W`W2rKYia}XyP zSB2Ez7Qc_q${U>gXn`S7+2DncK;mu}WLpfOz>V_8uSUaPO`~;lOpwbs)?3s(V~o&Z z0kra@F)z*{t7*s)Q^w{FNBEH8T{8$-{fr4@kqlzG!g8k(^$x1gDsSq!Yi#a(!IsD4 zFfhyC2E)WOhPxQJ=KqpofQhlme4-T7{)}KThFd+h^IrCbvl#+$l+zixVnBQyyG2vl z|1J*>D{QeOmLnooP^Ro)OzxY!amTXRUdN(5xb&cZRLH*(g+gtkMjv`Mq3bB7?m!e+wIE5& z9v_>Pr8C8sZ}!O`HCHpfw~xKOrJ^{zGftwSs4#IAzgLcK%g1{~?t=sIgBGEcW{{)* z;R!x^5^=xxH*VkjA8y~q!8s1pQ{UdUCnfIgGxWN_#);;Gd^PjH1bUYHM#P3Re6qffsPD zsN~E^^C|X4icuUCTp7bX#|`*^U)5Rc$@)b`XzY!_(+mf%;&E#UHUzY?YRO*Mt%P1GGnB$q6enTquiO$4^n2Ctw z`|IyDh27wXei<7~X$l>Wjz76-IT{@@J((V#6&)*C`C+BJ*ol16d4s~vSsynWt5BLV z{#7Wz6BBC$$Ti`n`Zl^8CW9Mnc7u*10k?Df{-cslF-nSxRfEu%7=ZVF#^e)fnlc1H z9F`cvSdQ0+24QB3J1{h9R&g;S6+T%8m0vydwJgXW5SXlq4NMLXKN@%{Izvm+qLm22 zCl(Zyeb>01Iu>~qAH!%kxnDWbK}vGy)j^p3_E`dMPDGy{Rbyns2gzy*GR-fWc1>-k zgo_0ZCB?;cMdikeZEZp|(S{TqVqVOArW?ybh;LUL3$emf_+!l3tu$w4zPOEz&a`X| zrdsj^)C1*Vrb$hGzU|yZku^gptBsOg>Jpp(J`*?ocP50X7Zn?xadVNIAR~lW_~zMr zBiSk51mnGK-3h*OqbPJp|5X#H&4ZyS1hds2&;uolCs!$AN`{FqQXxaomU0QBpOtx z>^u>f`nVa`J@@_Jp7&}&1JF&iq2*yxpz>wyNkBH_JZw0UpJL5tujC-s;~=oI*$(k- zHa|e2qRp;OXoYZXYw*h^vgoAsDcZ$@l%!*A92a@W*uBYO%{;mO1k?JX30FCLr-0DT z)Yi$tE5vN<8s_SDwd@yVe|7?|J#<*lCsUO}#MEq+EeFC0$2yo0Fa5kOBIo&}1!{bE z$l9^{^vhDga_q{d=FS?USC$(1ov0{^n~5V=?T>|3F+E zJB}&G+RR`u6oiWzt^U~m-mu?p6Y2jxDa+QoY5~F(I>6o57Wo_PI8(#Io;-l1{#N>U z(&2VJ$(STM``}7UY$^E|b^@i}e{FsHb3^YbXe=Um+EzZr*9(`)mec8}q4yW=Y=~UTBI9Z``pU z^;X@!b?H{|kB3sZ^1rO_$P{YOAH8y&Dd4RR=t@iInv{10b*JC)hj~y83XxnJFvO$g5^Hs>j6>Vuwz}JnqrYAW0D%m5+^+Z`T9{w( z;9Sj5GIxd&$<9*H-cojCH%Onw@)AdY9=!I}C*S7lafZ_!4$pZ8&B~5VC0RwEvv|v* z;%1@=-Oswx?=wc;t;&2k_I;8NbK#1DaGkrzGEKuto>5(cFfC8cN{|SZqRXzrOZz?s)Ow>8p(1t_!Y_(O0Q+;`2Pd=RS(CvzaF)!8HQc z0!nnxB89HXTH<*Qyhs%Ncp*3A=N?l(zhz*^Wzw(|7F+0206#GBwq95y{P<+ z?VPUU{zL%-Wj1N7jysHjVy^XSprk&UJfT$tu1BRL-keMT#P*imEXPt_En6jT?Q<2a zUIUbfBo4*?bu{l{L+zkr^s80jVtH4SA4EmK~)InigG&p=a7BvBJz=fnQIY)*Sbj+?6h*)BIBN) zm}Jv3b#R8*eS)&HelEAZL1<5ldL1_7 zD*)xVq*!DdLFn2kqRVVi4E{UCB{!gSS<5G6`+O%Ux0uZaWC{63mB!?@t{V>4271;8 zP$>4jT1@IJjRt!$q=Sz}P zqG|FLu-vvA|9`}__?Y|hHP)+UWpx{k588f=^#rV?#g5mRD0R)JpC{vCiiE;38}kFy zCgy@Yo!mAj4hm7uOD-(=ZKX2#2G%j)0e%25$*n# z&|Pr0BL;41aek8QF@%24S{vG!dAX~?zr91qYWL&vZ2H!mXj>~tS85FonLZu>F;pvH z)l9++ltE?vMtC0KvLudJ9ZL{lFUf|2$5dIbHIECeT=uXuYF7SH=jeBcadvd9dxy%Y zTL`NKtB+1;bi~-(IgqgtG33`;Djs1{{DJ&X@_hS?pSUMG~ElR{^?RV73Kb< zH(5|dq-jiqOEZVE_FWME-h3b(tNSUNCMl-sf+c1!jk-SQ*KOIOaXf#b1plG2-mea< zIK;5xkwleo7f+qw=3o3i&J#4CV}NSA=BGNh0SVXnu|#Qf-!p=h>4_ENBPwCG@QePh zgTzsF0g7Z>SD|VY%qsm*V$`Sid``3X&aH4r9Qc#69++DH$h1CTi zC@43l=joBTlpdEJ-M`dBTViyNP;^M`U5hdluX=s98oQy3uWvkf3fX8h+!mv#`>3Q; zU1d#(XYAU3QS?^0hhZT>-ADt+Hss^$uV}@&;Fzn|1N5lv{OIFeM~dQ=2QtF#F3_q@ z4Bvpjd0H2aAX85VdP0~5&r8Y=`h_NlN#<(?A0~B0$4hEWl=evkJmXhMcJY!91K5>N zg*KW(MMisJPf(KA)KMyBkHz!uE8G737N-|q1dV+7%kFa2&R(n7xIK$kURk21X%q!> ztOH{fhhhY@(x|@Mx$Mq8&9#qRSA;CvqH?uvahNpx68T!KdvyBdJH4ng^sMcK@M~6W zti~P>!-THTxfZ>&J5fURrR2jef_-&z19e^tF$jE>)=-OjzxUFhm=^ks;2?<$fp8rH zmHH|!wCpMgzb4vM=-_;oME6X)VoE^OuW^je5K>oYLCd)57CXz!ZThc~T0|_xTw^)Sj=QkGvc*fi$$4jp!+I)y{7|FSWcXqb%J#JvHmnAZF zX@_hmsBa*6t7}ZPjotvEkK>^e#yIxr?r4+ft!?^`Vdtl+m1312**FN6LEGe!L;FxW z#W=p0QkMmx0KPAJmB+T?U7fdCZa&grrc#=y^$xRto^|oH%((3Z*V&_spKm-!4CMc! z3WJA8A1FT0)+}*)&apP#ltG0O|7s{%&uPQlU$_6Z9PtZzl{295^~(Th>yLFiM~5@w z`wSmnZs&A(lI(tdL?)Am5 z@V?4FE*d*=jcA|sadv~M#J|Dlc2ZSuDTF`8-x(jE;Lzph_|ZRjMgNH<6-||aa!Sj! z`X#N7SMx$Y8{xej4_wM<;ABrN#qLtc%{DRHRXhXj!e+#8JDNXn-RK29-cqHt`8X-f z1>vj$KOqauXQORSn+uJsCf@d#^2DAM&=GMkH^XtfIm}45XdU0~ali?2$2(l_icxW2 zRqcz;0bQ+rRE4jCevx>SB-lUC;Kblvsfsnr*+8S&10P)TA>--z@hcc$L=ptc_){hL9Y zLnN;2)(0bP^MPU(JnfJlMS@0tV(u8wXaS_gNd01e>WMm7FV6;aJfW)LAdsC#Z~?ProXz=CtD@FwaB@x_GMj{8kGL?-%02 z>y-wyA%3HeymN{_Q)Q^-eED+YL9Ew6fBn+SN;|~buD#W1hxf(}vaM^-Y~fRPC?@N` zOvLS**ei>xQ^urOg2uOO1#iErvayv)=hD7CG_NSN|4c(4t%!)I!# zp+%q+M9~LCM4Jp#6n5flD@btfVq8BriP|MZz-z&c_XrE>vPa36Cn=^tJ@U3y;$o$$ zyu2wFJ&_An9_-^5xaj(~xd{&(V38^B;Zwp^bhgM`z4|B&#$ZGM|Ds_b_BWqEY6PM!5jt>Bk3Ow^{*WmQN=%r|i`Uekx=>+DeayXzM> z$V_D4;5_r+zgsj1Fosl}m4=;&pGeX$4*4<#cGZ9;$?s{kDPBcCG)ZQ?qVlO|u^l!N|k{d!d9 zy*MfHG}1o<5eaVt{~dgd7~=oW+u2Im&W=`(L|=FDI0aEyJ)#Nkzs;dY>fv{ej}Bb^z4^L6G)y1JO2nbWCy6~mD&54b|W{^Xp> zx+Lz)+g_wi6w+(+jX0SPJ(r&!!!-czh^v=gaGR&sj2b+l<-k_cCHT2_ zzKlf3WFWse`=5o$VZg3pvJ`1_8ZqYQ+b^PCt6XqCQ%dJI756yc%+)e|r4{%=`|HV( zcOyhTI9&ECn&ECqG@y}wkUtu|HePmZ#?LwNUX_IH`{no3cMyO%WU=tbPxUF7W1#z3hP!#B@F4=Rql5_!b2j-obbqu^7p!IVeR_*80)C-c90w zi-nB%w(*}(9H~u8z6-3Ba?2x6(7W%bQy5Q%S)YBx5nZZSPCzeVlS3I99KEYXqS6~9 zxV^LAR}m7bYx~V+1Ksjq6V<9=v2)tl`aRxtD17gic=y)ZVI3#S0fxJghjDk;&|Mj7 zH*D9AN{|8I)EyWj)+;{Vl!&O1aLZDT@N-}OdpK2<(NU#VonKYoanAW*>|Wc{q1Ix` z1#XMdmK48z{N;LXaO@pisqv|R7sXfrf;(``a1b-`2lp0xO2D`I1!!H~b8 z>*7I(NXtgV52%e=FL~RT_wcNw$3%&V+S88>$alj?_C%|DgCwO-Gt-J=Z~9WsRS(`y z+Hm-zCI)~CiOZEIjkYP$deG`FfK+thSEZn5{`9FQto5wYvNI@?3?JvA%7+?G9*$KF zqOTG)k)(Ze6E5mH`i)Ow+V#HJ{`$;3k}8UKTfCCHf!3w9HokwZZxlyx)2zfRQFZy3 zevzKc7pu$gdJ9R1eK?%ogiP?8DSGfxx(c`Pti*8sln4A0yvxnCpeOHuE3NWj%lNT& zf&UKvA2BX=0%9xxPY6YeUzj(Jim)8q0N}c8Dw)IK1-$f^wqRbugTfaELWgEd3q4`6 z2G8@RgU4A-&R;Qn>Tn>L=NK26g`>Rl0FJ-oAdw7-7khwE&l;SWKK zdXvi=mTQDE1N|>>NgW0IqZdiHO*i6CWe)8gj0L^2*b1j(7oI40pu2upAkE>;kjwHe=sJ*?ygVY}^`rtv@s-UYz3dXAMjy zPxkY&?fo6Sq_u0XY+>^ut3YqNH%yWz7Ejs&p0~C%3}J@p@JVNW_%6q3*oG)SZ{WsU zg_|@u^rd{47xCLRhHhSs0?09*OgTTS3AA;z^kC& z++5Wux19@v<&AWrGa>uJb_2+gHLFg6bY+z4axoWd-%9Au-dmUcUf}D?6GnNcoWWwm z(+t^9#F%%NVV023cx_MXY*s!0m>@PPU`XpwT>W<3J$xpJRY@Mr#F41z{+p((x>jx_ z2YTiASchN!F+TBX=;(-Oj-5iGi|=0{*~|J+P6!?ZT<~F%vgIX4#o3-vqqS|X=|4kA zjr%8DWa09JE=6v_ zibPw1aYZi?uL5iPOc56UHijaR^Eb#4!QrNgt3}C%>{B+qO9yo}lVu)EG)1k$zFhoX2je zMLQtiT*!3RKivB~t#m%}ZmV6#EF$>)2Xp)0>OiK+{7AZB=cLjgvPArHcQ}AO_>@iv z2d)?D9ExT=F??+9wMGIypwE7$f~!;NVs%L zfsP$6xM85|7#r$jGfO4Le0ys@e%g1Rq)`5D#An|Z10G+zPI5UVgM6L2FEclP6<4V` zzAxe&!)w~Kjy~Xjw$x*TKZ(zh%mKfj;Gi^nBbi?84hOPOPIXf=+Vk^}RxnXWit2kU zYi$Ke61r1HExJ+V?RC4H9{pd9W+n*xlkq!FK;)dXi=Sntsb7j8w5@hoWc&vwp2R2w zN847ugbVC?s>QlLvo?4{)iEuhaBf2_GT^5F5EcA$_u}((?%4MBtCmr+(FV~cZO7Y< zsZn#YC-vjQR>~@GbJrMNpr*x}2iwg&1`p4l1!>p|kP|HYR6#gBP~A!2zsQKHSEoJt zel_|EZ?g5qXJ6y4Tlq(4k5X7s-Rif@yU%ss)oR<6jK|PgfrEr*BIeRFW8G1hIreR2 z!uyo-S0#Rc!Z_e5taEDP-OTi#r19MH-}e@-Oih$HY^s+`w*+1@6f{G#F7za>YfaUd z_cjk()d%$XjN`hRx|CR!3coNsHw}3~?SKewWmPE*#>Z?vsXg2xLJ#|ZW}G=!8)nAG z{inT-E;rbp>Q#l?mW-3oS-k?INg^8W@q5OdJ1ywIMg9^YM;`rW*OQVIkWmqrp}u@{ zG2Z7?0XwqLNHy&Qcmi&8LaFAE!GH^7 zgeR&yjMX8V*DZQEcw6J!%-2}_my+B8nZ^iMQYt?UD-~Og?FrKtVXE|H8^# z{*;re0m()yi()r!wCMO_<})FS8&6A63lfHACF-D$VBVxaq;Gg^s$>{@JtDaAJ71Dl ze)Yjf1Ip=Mk_Q+}uL9Jmic~r-`AqAP$=jkY1PRgkf9*UqS1PJxy60|{v1GmAT50hk zxlhijDk)-59#Yx#8uNSX4dQtofxLSi=g1$9{pw zyFaghAWUSvI}6*+LDjVbS;k2YJ3e>5s01wx8X8ogU+nw&#S zFCYHmrfO+47ISJv{NwB3d;tCj@VVxcp5ut(Q1gr{zfgtiQOE1>yo&4`{iC``*m{wD z$P)B$rjk9bs!nku7fgdIEiUNWqY3{anUOyaY4ZGjX!T3Bog=O$PwLHdBI)OXJ58Uqz{G*V~P1hEe_9e%xLg3u?Nc$TW%Z!|o&^z|P_ z1$1q(H$ZICY7E}d0`MT*>XlpjZ1CKN2UJ|tY5uZkUS3YKa4JOGOgCw8S6B>GfaFqlVnZ z-Nr$|6<`oMoFlxrO}R1#URsiC7kEjd3l%onE;1A0pAM*OaE7Xz_0+uciu>O{^{{QX zgg~y?INatw>Koo7F52>&r22x9Rid%QaUdszi>nF0^FD(}dfXm_59f$rQ4IY8B3Egl zw6K8#61$JjcN891cR@bljPvl7Lz3`P8G98W_zyd5JI2Ix9mHAg%2eT$ zKGyWPpnbm-`2nxvbIrc^gHwI{UWIj+ykj3LSj<|1v!iN9PZk_c+nb}WjmJX$LxvB8 z0n+x+&wKw@lKY75r>X#^CF8s`Pwxwyo)5V8k*ECP1)2U~k zrBx`LLMh*ds7fY-&oSJzAW~WDM75^+QqSe%cDL+_-*OAGZirdtPiGIet$Hq+k>j(ekmTLU-QHy^ zDZUPM;Hr#l+N`>5d8?msmEm8F6+TU*Oh+=K?aYH7cr&WGAJ5}JPNJcgrm5A5e2=FP z#!FmG0rkc?B4X1wU3I&(`O(MR)J{Y`#Kyp zwmDYuJNCcf4xf=Pcc3qrEs775%6EsU{V4dbB)7mE_W6ifE-~11Wk%b)Gx&m`uS@ay z$k}$mX0*bBAUgNr6aCtVrJ4ay7Jr%PnkPI%wY^VP118q&obahoj!3HQXLk14kJr+@ z6%Q_$e$b;8Ed>`YD0}kC?lq*Me3<7UPM)Dh3@OD}&!KoZt9al|@0m1|Js>F$!xSXeA5zss{WV|^>bOLRwo55@6E|@E;OxN zZB_%(>_e5=FkC5IbW3LWWqbvGXLdhc=MX%>hZQb{I8GO=VUQX3Nt#|$h#Stk`+okV zZu8DNt+!=N6Uyk(VGxu=gkP~KhxW5l7lcv+jl%Uq?R!;ankQGms;X+!A?y2HxU*iF z;R2t#uF~YfPm(8>gQ*^{l{mdCP0Nw?`92!bRQUmy*Q20!s@6)k%ExWzc}R_HyGZC7 zG$%LL=3`U6@iTjI+Sle$;8-RUZ7#I4Hu8@3eXXualRh{XDIQkPZ>Ws&v)I&q6l`%l zPn?RjS)k7SXHeU{I|K8J*LsLBLk5iXuft@reyX^x1aG~&O162GtW)PZGM!5!^ffB@ zEaF3kwhoy3$cW89MiwP(UyMZ#hzPS zyOJBC^E6RCf_>(BqmNn_6I`-u*iA0aY+g8`Jf`x^e}@@~=NvqEA`bUSF-bq4)CI93 zzKZKA!dJ{4*^CN5)@`^ZZf|>v)l4dns8k3vk@MMx6e*Vg{kBxbQ2*9AFn;<^!L2jUJapLML*Dg<-`&$piC{Ae2Vucu7d za}=_kiHIXJuO)xx$$nItO2cPkV>42~O|9B~4`vc`&GF2vOkd6l-&G!zE%}lU1YJ-| zTaKQ1{+Rl9))N|s`hfjQI${=&wTC5~=H_`ywVic;3|;FUNxyeFpDKD%<>6^$#g#K7 zry#h)4Y`mL&k@NpN8SyFkXMgcXiaHn^h0z=LR{xsZp@lDIDU|IZu)N zu-FXahpUk@^`+sd)mwiGPJ2Kse{ zdoi!&c7mzHZJQTemu%G@gSeet*6j6fSNAp;NRXNrGlOWpa_XGPA|nt(3&i*#3nkT@ znpu~^LphI~x#5w_v2o%oVsjeLP_uhRuauUSqp8LE1>nT}!;*gj7T7uPC}7cGWC5zA zScG-{E<)}={_d_o_xVwHQtstahgsUSiPqQ=(-Zd>dU+t7qSMY}+~h)&s!j1r$o}RV zo$L2YFR6S*DsG}AIIWe?(^Pyq;a#@uev|Tz3HY;Hb`=S}Bodo$b@Ptb4DoA}M?W?x z&D3HB=J4bS`3FBxKRICZF}U6-Yw^s7hB@CKwjtDD|GIQSNXJJ=?e!b+`n}argkD+Y zg+tLT5uH4^((nb1aiT^P7ZK|MaBu(aK@J2sK-Vrb2t^@vO72{_4V-}^uYYz23y;5n zzwGZv{RPLsR~JRqB>$_QMWlc4-%aq2@JX*LZ@Xd#9A8ODv+*hq8+iWd}67hw;4G=6=3Q=}v99`PRlm4hw?_eN{ZN8rm?w?JL5kOYUGyttf;=6tQ~ z;(tDGjhn#T3jkq>-5)?m?RG)ML_>fNFNeUoBsqWOUp$C)A*6nf;PT%Q^q6E?Sillx zZw}esPtO1J|DL4({UqPtC%wMyzB7g;uBIEiPI~SA4`qX+XRm`50BocP3x-t(-0aqK z+)eFvG+~J$(&UlH+*_=6!upcqZ&OoI zYmYB|GYN&YC)g|1KM6c||4_H}N=t5bOAqg9c@l<2L!gF1oNbE<$RYz3Lcel+4zOkK z%D-ZmxH+!^SdKgV_ddT4evw$fc?*}Aw|F!0X201g!@lAoF*@iC@26v@l-Z;E3YRaL zDe9FNYTE9g6-9A)tlvQU2L=v)d`Q=blu-Wi`qdymO^?wrSqI4oraxLT3-taka5eZJ^Pa?w6`Ke*hP<-7d}ICO}72x)Y~u<#`C z43h#p+g-e{Hw)Bhr9vYVi)84egap%H*6Vs<<)JUE%weQ?>8ckKug>@veFqY(Py!?u zF725Y^%_}1%-ua?3^ss%Y9yIZL3p+ak(1a(te-wu`jCrOYn53@4J<#J9Qey?kW%w1 z;Ky%_c$yyrf4zj_#j(qZ1Voye-8fA9jutT&N)48H9SDQEbx5!bSovKbg6s?R8lLt* zKd6q-AacNKoxL0`Pn6 z#ihvdqwwhdIKu2sT3&EBC`EPYGw!kdU15kYM!8^H!3c*Qzc;7FZj&t@6QUtN&dWqS zg|*+;iE^HzpipS5%i%aM>twqTA;U+ za&V9D#$?;wL!mK0o71ziWhRZcjGqOGcZZ(x9Z&Uyg-OZ0brg@+lTu2PGH*9@0B{R6B!!{* zM5DozJm|}QZk`4`d*mlIkJJz-ywt$UBt|Xbh8xcV2V~%VfT97Tb+XtOi6IRHt?jAk z>Ei%1`U>d8izHgZmVq==YU^lT&3|%EQ6oVYN774OPHNFi~S6lL`U+ z0@_WY&TqIx4c2RW&JybHfi~T?fb0RVHbtkV0aE$X^b!;?2Cz+FndfySF`Xg5`~=L^ z&)=Q$!u6-xy}xYltf)~91HuR08uP11zkXrcBbSZ=wu$hvGS1!4uM_VcZpC+NgGR}K z;k|#h)dNdSYz{a*CJGg36O@%+((t3fiNGbeluWsS>q&@G{Am$yM1hdmgP||EcIIir z66bHnu7o7fiFd~X=}@9n*DslFcA*0!CGhw6w;xGW?DC-#Fs1~gGSnf022V1L^-=*v zz(}{ApEc;WyDZ12QzS=IbmI6TlNgZ5qublt1Nt5zg?Gj7$Azj2Z-AD_@Z9j6nM$i3 zxfZwC7(j)1n+wh*l*Dvi9n{DhETui+S~QuxKK5|P!iF*imT zVEY|XM3`+4O{FiIJ?2&8zY8T}47sQw@B|ox1ty$gXq;etGyY#I-w?+uaSK{S=ZTifSTrFF$;Njo!2&-a9o4+o)=>SxAmoX6*&z7 z!xs`a$&-k4B*2jI9hd=kIXCU)w-Jt}v8YGn56XX9=?cD(3pwV+z3W-A+#`-FHCB>M9CXxIK zxUQ8GRUn{N@!DP0pz;76>{74Y^o!KMnXXfE3P`!sTDFQG|=3Z=x+awCtS=*x8Gq1?SLh@;0M z4gie2U=BIf&oj)sk8-E;p$(*kC_*%GiQbx2zo@PRk|uT`d9#}z`h)P<8?Y({T!)DkT=Z9Tb?kmuw=_riF*r5|W}brw1R zX~@(RCXhB#t}mQ&qmdU^26cJJfk7Hv%A0PkNT;=X>n^VY>lCfA+JPQx*w*X7NMU5y zo7J@y==NuHH_jAmY9 z!4@`UX`BuSVMv;Uf{Xy106nVxA_lz3H3nIwu%_&q*AJ_FZ&BeT>Slv18uX6ORR|KV zKT-=ycG|GPew9lOJ2pqxI$C1{Sxg~g77lpXMY4!2_Hl`NM##7iuaGV=Sz6n^y@(fV zL@-{(5kQ@YW5LnRBU~_77*fHd1j}x|CQB?mm)GJ_?#;Gr=Cont;^N}fW`W#DU>Vq$ zs=1#Vkl)3_TkgjS~iOAWpH(4D%(gDGwq$4Hkt%qe@Tl|3+R3<#ch{L>zU2F7*eE6ZUF@koL~S9B?8 zCEnu`H5#X$&J{nz+|&T_>?z&ivfIi*t9K%Da$3R_%%fC+B&MsdD#PmI%}vmEeh>s8 zN=8-8Sa#wCTke9i0qx8UJs4O6?t6yHPsOg4M>Gv&?3R9s`=nV6L)$+wauhi37%90n;WTVAErO5_WQYSE;+K zAQg1AVqjaH?DJSr3ef4LfW#@_=We-_ZvNMYLHg0%3xMR>Yw=?o6(_3kmbTaS13smt z@82n;i-iDRQJc?ty433EhYuzNx30O(hMPUK^5&#(nad>QMr&~ zkd5Qnle7G8H5d30Q7|jJrvNr)iZ}RhNIVc7ziwjV-9*BHG6RR?150MTac%MRRec^d ze_RG){P;mY!;~s$Cb6@tCA`a5LVqo&DU}!o%_C6}ek*412!H{pJF7&WM;{~tN|?Cp z70?BK5iBviT(A@%0FUen+*_W1c6a%mGc2Jmk`POAEakt&l+L4_0PsyhwtG62v{#qw1`Ab59d0<6wJ7HC^GMA9urtEN{t&W_yIA$K?tsDVGH3#RwBBs6;*v!F<|3^R z3P4kdl?{%=IO4Sj3I#|-lkifN#00u9J|Q8Y5kPDWFR3)H=Ky_EFNM0>*swRy?>mPC z1hi3xgGD3>FV6NofLS0AoQlGmPjt3^9c&O{L7j}>^^xcY4<1lLf`0zk-Nn_;9+}MK&sG?#uGos!{}T_exS_bE3Zbm&bC|ti~fIHeRWt=UG(lS zbl1?`gP?Ru4lOl=h=fuSqBMda-JK#x4k(BUh=O!CqI7qMNO#^n-|yb%x%d7j;GA=2 zpS@SS>wVXX)q}$shKdb%1`PS{q;{YOA#@*oimpYr!-}|d2?)cuQ_twF(K%#R(lrAF zUxj2f^u;%IuLq7=I<)-IWrykpPHIxFa!DH*^W_{tj0Va`12}LWu~r??Dg@ZtEcv=u zqW~Wn3IGw8I?DLxi;Q&Uk9WYJ)DlRO=IA%=2D@7r=)HgTYbt>Zoe>_4vfVA9nq!I*VIi05lAh*N68EIr0lkISNfj zhO53s<<)}C6bpjo=&LD*}GuGH~CU7g9xw(tFfhZ zur0jR(7q&kats~~{tZ#LUgIpW{6^PD>4A-S?Yy8R<;~T32R(FZGD?{2Xz1!bidNK~ z%x$HcZHysH+LPc>sTuiSLi^9KhRA@6BMmKW_MW`IIWn&)q*kMZ=|oqfo@_YWA=6gM zKgK^AVljt*y16{vjVV^zoo`aBd_KzlG2ALX0Xc9HDf9Y(m6H>zKSx#x%xX}X=EMPW z41&vccT@ILEziK*rhz&yXQ5RM^d3xAVT;Q1WUg|ar#7hiw1b{>_HwGiih%Z+KUfzU zsU3dU#Rb*EtJt@|Yq+VV>9m*P2I@)~{Yj^@{!k$%pdCh#*v@V>hmCe^qHK9d$bq7* z($Z2Z6EY3#hWcSE+g|DcdV*sj?3dXOa+gvh2ZF880nM{$xfb+b;qE&FJ|SS5M06!) zg=*lF)`v0QH+`mrqU6kr9JDG*gU6l$nBQc37R1^}oUkc6Nf*|s3KW+gIhPzlG55-V zzhdKkp{HKv2#NMn_9S**R@cbl?fIss{1Be~ycfr1^Ol#p3ZISjp2AZZkq{Z>USFx~%7LSm09j3M~6{A9yPBH?ac=nty zf(_gVT1(ToeJbAPaKSQrRxjYrPfK2sFr6ij58`Zr)GY~aF2RV}P=41p&el~}>w6+;l?H(nw#(HNH49$d8L&>2@I?2rD8Oy~c5 zpFH$^j;w4Q2H@4M++^}l;*aa^s9lFe;kRcG+q{G@3fKTCSXAlUQO)@OK@k)MCLk7N z9@0M*G4))QBQPp36>xvJ3K0d3B^%eLvYIHGUY;*HPsp zEx5bebW1(G%w3TR*F(IB(d2RZ`vYJHDdJUJ65tu#7?N(6P?Y5kwUpO?FCI5q_R0xg zq-N>-S+nwnnsb#`g8(4c#_3FG5${M-K@YKixUTEEU~Z;DgHW_n11?@aiy$WvA@uIf z!{{(}HnQ_4++?KSy8D5JMW*(jDgWgt@xa_Ip`FTsKQlhAUj}kgzl$q&pP}IzL9ENCtI2dxC%A! zw+=B<7CBf%AIO|Z!9-cuI1z(55g5bP0uDg?q6-KUa2n7N$J4Bhk|$uG?_H9jI-lb^ zz-@(#@kSVZ;WgL%S*rxzIE`AA3w+lq@UFRtD9$l z(qP>9cs+np+88OOL{IqvDXQh=$-ku!FYW*{+X;{b#o;8|zVx7h0i@w)Lk&Dc61z%! z!{qm8lsvjA>EMt*Pf^YT^J|u{oNC{3au;4~z?`FxK~AV}!O&%7x&B zuSf}cVpL;(V(s69(NVp0@KH=kV(=OW_!QMaq{07$&g)%`7q^yz0AdgrK43$YyF-9u z>?RoaCHw5|M%eW1tho(T9SUb4qo4=|MmOemi06_MM#X0Yo5b#Q0!6R(pk6QyvO_Zf zm}8gSIoW;L+Hg*8Zjc}1&3<`)2ttsi5wGnDA#xs&q1^}FV0pfiH8wU@d+)PDq0rE) z#7Ly-%FT6TKQp`(%#b8-KzZ}VAi_fP0hWNU_!Mw)2UuhF-~YOkfH`1P!`{Pip>Ae; z9bQ!Z$zJa#6U4DY#Yq}tJ-I!2?C~d(u1j0#+4Y?Fc<2pVUjOD?SlnqQl9)j}^4$U0 zCXw%U!3@2acb8zMP)so*fmyZ{z%VY?7oLfcpF&%QhV=39dl10?ENpDhN-2vT7lTnw zppYSOTX7P^X}dY}k=@kg>dci*XmI+2gW=%cf@p{5l=#@A)*$$>2``;4w~pw3fRv}^ zH)a*4xRbPhcu47{WKafwvi0Ku{F7X-ewNH@eH)b{J%HFMW=tpYp?6^%5jt5miM>|! zU*r|euYe$^=xR2x%?&AHRFjSSgk`a2tU0(7LHYA9PJMm7;2X)i2Epk&N*Va?^-#1WDHL|I_2`DD!{?6?EB;veEYSGmV0LgT}7yCj6 z>D6gZMMchWSJD{xRp5YH>MNh`RaG>9S&Yh_+zquF{rr$U6A{q+mJgQ#zc&(@RRPHy zdkVHJ1;_gxO3w2W6I)zPRpG@M^Ab!gbmU@pH3RXz112v5r*p@<9&yFiw~{ z=6Fn4q8*DOK_Q+dA!K2$3)Q_h2q&+Syo>YsP)SLnx^GE z)f6BvBO}93<323P^Zw3TzDM_xT=Qt*e-$#wk||Bx$y1O6V!%$22Y*cP1Z3@~)0j4~ zU+66Js&j)VkbLNz@*pOj!wP!Ah13MlZ?m>lxlYq>cSkLSBCI2Jm~>n^-!K}9?fi6x z-~ir?txWMFWw|WI)!njhvE1+950yTak1bRy98OwGHVy^3>~D|SKeC_`D)26%>4SBx z2+Q`6U*<6>5JHu#$Ri(&o_40qFpV|Elegl4U6Gy@!Y7*dFVXJjiO`J9pi{SnMR z|KH~@{`IJ>>rQNys5nL9!*iQ0H29$a`6piWit@E+2WA7n;{Pu;K6g)&-*4!Ffa-tQ zbr$5=Dcn>spq{gQfj@Wc>g>Tay0*aL*iZ$k7G5hed9eUZ>9!WM&zvBJ5Oi}e7R2Xs z1ztdW=sg9rf4D#9EY2%=_b_64|D2=noWJ|~IJ&Ih3$Wz+??m^=g8^7G&;SO9Z+vJ1 z0ixosw7a`K87#-Az@na0U~oO^`JWmIvyw7MgxOv#uad{>sp%P0M88&@)g0b2^M|y3 z7#@6RMeg)p6w=I!<&lu5vo5k!P|h|(z)UoZ#_-ghr!pi;{D)bGpmaInV* zgXK`*<+au`?=|jw_?xGQDMZGiymL?l1q!TyQ? z@|%c-K&=@oHd#STgP%adYSB8iVMRv>w7V>ZksP4&%AjDe z*WbeIz*bzgsI-We9;ioY&l;ujT!UYn&eOTZU8{Kyi-I2pd}u(xN_P^z%xKSENDsLn zpn!nb=Hxt&vRni1Mk`K~^1@F9;sxQ+`hHqC>%gGFZ{H$bQvSbTn>=4ApwhhG5`BHJ zk|OZ5aiv(NmW81-34a59Vs%`fo6|K6=+mK&v)?Eo@GEe?VMBJIsmSEshNc)!>e~la zu4Xmni`^N4{P^vraPQA4{9P#_R?sGp+E`9RESFa-ll2pdZA-fRE!56S;G|YeHZ~J} z$vET7ohJg_rzXhR`tU<&Av!(q33%!aZ1>o>0mKVwrn;O(#6lV<*e2p}>Ve*yC7jf! z=_FuT@Y%@(P>F@o**@n7&sMQ2|DemFdFa^3N9kHqNp#khBakYbFvt`qk+7MAy9J9A zx;fHrmBvXekb(aEK6_pza?h~H+jT87J+K8`nz6;(SSS&J2-6q7c6!K;By1LiP-Wmz zMyj$FaZ=BY>dfBsrlJ9(=)f^V3+{wN$2$RA=y!B%myQC9ECShZPG75ehz|5Qk;)V? z+{wm!ybbih%fHegkP^T)m9D9)%k{arlG62D>WaXJ$AXo$#Mu^ym_k~@9db+ot5rc0 z>XCfy0!U-!dt(Rwjam5V>=alykrg40O-vfWD8db8Nd01vzUtd$8>kSPBeHAl zN*5>+$Z_#9%@mL)6?Cz1fW-vJeZcX^J&87~6?Il4R9>-;L6MFu69q-9LH3HI4TeX@4(5;@h6xj3UD5)9ud(1E(%D2fFiF zgG`VfTkKj=Byc~`!s(p*RREPVL?rx2+jvpD+khKhLDC_%e{7bFh~G271m}{>^}raPr3YNiz)o+$Bz0|JfS;19ed*g=&y-CkfEXSOwQq) z%d!5f726AQ3&*&R;T56Wx4#^GtxT%5TeXJs)_UY^;uG;XBbx;fEe6>X?J3S+ccV*- z)2Kmh3w~Jb;-_7c)_r$`_>b-7vlkO}8|yl8h(_FA`(d7 zMjfUq9P9wB&}oo;)?x`&1uU7?ZX8h`ua$eSitv1=*LCmr>2P)(=Dc0j+4}nOTkK9pq+;V`^B!;1>6+tfVM9}a{l_CZS z8HQ}@+sjM7;3msf`0(G0mjo{!B&~uw`(fpTDk@(dzzu4S1Pacsr@gMO&MA5IZ>sR* zWMr;r&IeZa{_4ZMiNo%xsS0^|f+V0YwOq0=y;}+i&R&o@dh1_B3Suk+Cbi|vGM_I> zy*vL!FY-zU9=|O|k%3B|2%vZ_`ZcJnj?_B+5?LQ`$&B#@N_Me>nOvk5U-(LU?@>^b z;LCRT4Y^PEg`fS7)U>;2xvVcAoAWOih>;dI<_f$I5AMF75bGqF&#r#8NUx4Op!&n} zofXs=F@UP`R(P|_*AGI3=>muYF&B>SO|78PT&$tN;HB^yl*ZzBCxdgrAEDx<*dwci zB1O3{h|;az?JZFJa>1@76fgue{P{VQV3coRzoE;x(nT!1nmGKn_cz@5E2P(uH>A1J zw4p*O)}-iPHMbb#HG+1&9`K#2`D{jT7E zT|X9x>M##G32PHKhb{t4PBn^xD-v?uPc^K<)}PbQQsGmdkwLdx0qN3Y~+M9>MOHWFsQ56kKh^E;**e`vFe%e%B<-%d&#De>S=| zbqRR{5N%_``)jL?GPS3)zo*68f_n(VJdo4{w$^-FOyb1XJV%rUpX{X{9>983GE+Cz zb9rUI(myUow(pX!)>-i+>hu~V8V{h-D`vL|!#lBH2-f=Nqo2zXSmbv)>!f?!+tuL& z?|#Xbx=hv|5G58Q%LXy5?<{ssf;z%?mSQX%xED%&BY#`}?SsW#w*WQ$d?LhFMR5Q* zK@oX;cd8gA^Lzl2u9v`vUkbYp@rufsa z3?YmRO1%EGy9_KAJj;q!sKosRIHxEzK^T!CqD}M_YQTmV`x!h-RWhoQe0RP+qARq< z>ZP*Qv$c)KpB&9;5_aSe*3+u#B6FB&$NYO29gZW8db&28{#ST0W)h1{RwBYSI%V#t z1(ivBzk|4wo7QAw(Uf+p@WGSR`-R?6Y(naKFEFi^TV_( z-CXPO;%vQFx05?fOiI2aZA-*+pG*oqk6HU1UT8~B-nYE1xo(=Nd(q-H)8L6)Dq>z) zDj_G)Z4N&w4@a28BNw4nVc)(w2kBF3M#Z-MJf0rRFQ`oKtmx@t5y)vEqfpEsHMzgP zc#S*a@B|k-dW~kfWoU%=;{1nN|2LmS`c(d>&|}llaffiAnv>J5)0j1QLP2;TpdE4` zTs-G)hn6egV<-`ZX-BL{25icJl1O?`E|UlZ z`?}BwJZV(uaC`z%}*(P4uJs z^3gh*Fo~N6Po`lr;@c>RXIlS<3y?uU7{&?HWs&VTQn}50@$q|-^>~r{Q?nWu>=fA< zply397tjJWVj}lT`Z$)2P_u5tAQUj+o^@+teVq#Sa-PFas`z9V^gxXL&*S_%Fi6;palJ%E(C)nGRbi^iK_7_et_uUUataZPY00c{39Qj;r``J-dt(YZuIK@H5 zLBl?)1y_`cjt2i&djUx!nmR$r#fppCuo$Pin>pwz(_9%)mKPEtTd4a!%tUNUIiBDp zrfwZ?qt7)3-H;tDVEiZllf^KA^W;BDXr!NifDrUJQsC5nPjm?-WqW-Pd7J`j6$x_Y z1Jfvh-n7Dge-8to-LyRa{1Nz@mUG9ur9ttF;#8Lo4`rXh4`}*$m=gzg3OX84yNJQh z@x(wiPaNSd8;UfO3!p1)GXvSH?+5iHXhBhRUb0H);?86(u6to$OObAF`zid;<@S%? z(ar>J$y8-)p;%_9f>zchL5vACTARnKPZeT@W7Ypt7HIRxO(v^?t#9$Bi2-r+$E zc5}_aN@x4yQlQL>F}f~@i39#K9F@o5{f-BlI86re@=g@CU!NLXjKb^C4m}WqvD!i1 zC<#V?`A~?6#L~%ObnsD82&}}U@i+Hi+UYg=XkdMv4=Q}QwR|>bVbhzgvA`t%j7Yyw zJ!%nC&2p*2b)q5Qon*}C=N-?}rCo7!vZaD@FquMWCw{)*E6w~Xg_{ZWv&0cGHY|=W zZ{uNo{M|+`JO&VD&)Gj{p5jKs?nKMQUk8v!gH2*_^dU*oYmpya*17kut{}vmhu=(? zRAl`+ME-|u#M@`uq5gOsS;dDP*Oi$@Y6U*pf)%%T6;AvOfm)ll{ycDu%@#7bREhx;dFEc|5mF}iDLQE5!Iu7mn zEe*PG{=O?t&F9Pjl7Bk>)v<|u})eYPV^H23>01|Ra1JsbbiYQ}Y)+_tQb6+JPpRCW+ai7Jy* zNyxELP}`;#pi`MPqKF{_#HMbz_6k()+aVWC!w$>(QwL;P$)_peUaO~>R5Y~W@^ z@g099%7h$y&FcM5skL7+SnSU{gBz_lkNha*E#v|W9lC#Y(~Enhl-|b|RJF%jk*T}} zme+3bW_7MqA*v^oLc_<`J|v-@%W2iFf1g&om?w(x%4tsfce7_KN|-tB)b_OI0DP4m z&r}8zukWg-@$pHInf>Ig_+iONWO(zmwa|85r3%pG544S8_=O*nPhz}9Yci>NQn-{T z4mrKa51^iWBW+<3>*U|qAih8Ub;#t_SY6pmQ<^K$MW1NjUl=J#S-O-col_`_Zzz}W z?iT>KlxXx@e(usQCLieEoSw0tDGUB|o+IfOi)lZV_q)RCwasb@(D~o0%(OS9t75PN zI>InjM6u4)^OG!2YCG5zX$ryp17nAjEwPP`e*2%_9!(AOXuvnf+WE%s6{MudQuiIH zzKwp^!E^eH`fF^K@CS-$B{dR@rvuF1uld_nzq}i8OynT>Cv%S^>-y-NQvX(zVk@dh+PHzu?HkYk_V{tH|G9=3!nUyI~7mLYXad(r&$e0YCh(2tE| z%OHoJ!LV~CfI9z0vD=bS)n;k_HAVxD8Ys=Z{%leO{pmCjC1R($JTyu;;p-v*ehd<8 z{G!spH2q4oz{t~eb>w%qXT#koF_kiAzrCYL%I*8rxP0|v(c*@P{qsYfm3~tQrZ1_` zL_rq<#SPPCmTf`#MF_QeN=`}q4P@%7D$x9OF9}iZcS!Qp{3o@17II$hpR4(K+>9y{CH z!+$c9D6f6ZsPwT15jXzh)DkKno9IKJzG0*|S7UOOPq0OGc%Fy%CY2-iMDm=WZe#?< zDwC5xRs#*Hp4dB2>*cYc_MZNrIzL#UdHMxplM)Y|jj>x4X@vS6yd(9VxpaD_T2>U8r7j`rXcOnkVOD_Gv7mR|(Yixflz{Si$cME0deW6M&-e=nb9lx^CjV&#$;}Vz*d$VdsQY3I%uKzPXkO9MJS8Bo?uK zdW6a$Bj`nLPt;S!jPb)P=9_#4zT=~Il?t{GK9nHM@ERj$O}(sl+!Cx~ zVKVKR*`OE4T>BK39;4A_RU9a(;;ip8r zb+6N|BfsbUV`J3J%*;z4%K&2ya2s(pl)eM7n-vbn17PqvQP@w+l7hdhtgx+^?*(2l z;PsuaT=Rk2c^+tMefn{SiD^OZ7cpqCMQIR=u9Y7RbN>!~P2o<&aG$ouedPw!KrU4X zs7LMJaX$$QCZoHPWZzXcskVJK7WEa1rn%nL;(sV_XpjS>$wC&GPP2_s z);tLoA5W#RcJP|tl|B7t^;>v*qJl=?X#*Ku^e-M~<$KaqPSeKiH)lN@Sq)^2H8>%m zR=X{;wD+x`Q(jdn3m4h!l-7~0=u@(K=Up3e9fc=H7pvkZ1A6M9)KPh{3gbqz-)^tu zIK_0MA3Oc{_F~a3tHxJ#o5JShDC3u^Qq@N2x!{BY9?&P7{a^ZIF_V!OK@WqzB=Q6> z1ATIgGb<2Uj9fehOmzATekZ`x?GU6jC9CjBDpVvky3e?qUGAyhbM5NtitqL6RVS$V z0D>yllb?>`rE!46XbtjP`{6?3sh=-n03)PrdfK#Gp-?MhZ)=pVFH4FNAkK}{SLFYLc*X)oG%$b>)z3WS_z8qNw z5NpL99LwKcag<)pUJo|uzSK$=RBSh|cCnnP^V049Q|-De=(eI>A8^YI*e#YQ!3Cu+ zHYno;ORnJf?Jm&#%f(_^PjT?I0%@v%0S1YAR!6)Z$#pHtA!LnKs2jUtjP3Pz*wU^q z$#!d2m`J&Q1`F71A;74$2XBkt-Oi82DM2A=2rk%OdTLJhzj7Ma#_MP=URIbStSUDk zr#`_nu+>7u6pF*oy?8~x7so7Onj?q5Q|HL|@h@GTT;G4?G{rZjQ>{hI_OoxcT3F#q zE;;bXbBpvZcZmz|a}!>UaZ2}fEe?&Eo`xbSUv9r~CS{cJH`e+k+`g?y9c_gOJaex8SC$-Tk}usOp78iW?mCW(xinw$FZ?#y>W<{jpt3;`#WNaL*pq{568uT)rojz3nHC^rr4@S)tM%HwSNbt`IOa`TI5CF^ zDQpMOd|mez6xm?e(w?o+RD8+;Be(vmy;Nw96QIJNsemd*O4om%{Ytxb>)+kV->q^S z*Qs9+wI6`6$osbgdajWFl{cCov9`9BPfP*-gXA2-{HR#@fSTa_oMEvo-I2#e2%F#L z4+_?^D+eORLEUb}jO1r}O*$Mz091Rt!>pbpgPnzQL{`T=IKuY+&MM6}jQM~og&Udk zj#ft#my#z|6wxt{?nQRYS%+(rAr$Lm0O65qO!W%yGDzC!SkS2*tGocF5i@?ELObPL zJ#iiNosRk;ztFQQd3NhZ`47mCHdZ1P{lcSd%jT=OU%mD@OndeE0ropKYh=TFsyAc& z*CogS@$Yy4Wkx#~jD$B55{5NKF?^DxCcq5RwfIpV&K?9gf2EC=n%JHX09^7qO&1|r z5R1ez%hID+RRTvxr=S4Lu9?Pf{M`m${KW(-Rz9dJPgFVQ0-G!>DJ|VPI{I*i<{k2A zXO;nAgj52efEAQ}U&3kw&ET4;abMnAwMFDyodP@;7HncsiiIyWyB~V3Sw$X8>WD=j8rF8Wea?O6hK;4|WhOG2gBIeLz9= z%Ji8>`NOyE`H`H|zv4)tiHO?4 z`EIYpz9Z`S925|}&-PI1V}^h}-uGTi^D6d3Sfg&(lY`C6ig$9OYQrB!ni>H)tvdcY zm(VQB^<_>@j@1^d5-?Z+$&Gu=bz<7UjfmZ}g^r+2E(>rnSDlGUejsVv;LitesiWtW zrf8~JJl~IYmiu)fOLWAD?QeXdZV3WFnosI5w0W}Po^t>zTU^Mb0MkM^sRPul%7rXP z_h+XlB457ak!F4Sq!FaNUtd;!Z_25P6PqC`N78~Quc8lO$I^3OMXv}-=mr;& z=Bm_0?8y6_iB5SqhZOiGEcIsvM2DT}GRu%p*UUB@LrUrD1ty0kSC;*pmKERt4on;ig zT<^_b7&f!ZGs_@oiVZIuAB@A87PnkEvrOL+XNdbN5$9@S{Uzb2MJX5|8~;x>WZKIa zWR#ZG7rPH_erI79gvY8hm=NcWXcW1YnKVILB2o|g`E_6G4+y+LAl}v?IXm;W|I(B$ zuZ?B`CMveu+V7}}&0#isUoy9~o}h7o`MmO%9E|e;P+on`uG!4fP-TK z-`D?;uq04z%#=}%`IIWn1;5?{;>3F2OJ>k=s%3tay>!qMcycklQe9ju`=_cG%Y0EC zOiUv^4+VqT*%dDBhA@;{c;sww>f`Tn4(_$dY_wxB6ROcnPz17peX1IlP$(j9iqwXaJRTk8V3Y6Kl$ z#s%~m6sgQ)T+JB~S|2qsFP6SW-l1~fsEf?s^z^vP#Q*54x~nU@7jB)75P^!>v3Bl# zs>dRBO82Kp_Ku$>h~NFkzFZ&z|9QTH$eHmFB^&tZ=s5VNx~JeVoap>l526LJU$^dj z*!$axr*Oo3A^z%zG-Zpn!QgJ|_=u2y2Y}Lr4Mb>rNIy@y`o$n?v4mK+J=9@gz zoTzeQIhWNgGYH_H@~i^hrv2el!b|RSsY%T9L#oJw57|u~B!8~!Vv3O!_uQ?UaTxEv z#wv)2rzv{o9^M+*lnzh=SaiE_>dWRXq@DH;c_JWuG*?^P~~_Xi`I%~cJcRrew`)Y%NUW4D03OMItbab9; z$U6`5_+pzYKeZfA;_fi3=It#xSML`WODAmkbb;-|El0z4E=R%is>VsXlmd95^uSFr zd-f>o-;=on7BQP1*}iuup%t_HZ!+51rv<@M;0fN%0T7n3&;6s0pXNd7;$2LN_v052 zi*zT-?HFE|s__)4Ix9mN77;8o0o&97Da9G_W6vXgT&1l_HA?6 z&B#rdZgfx~CK5%dQ>c#1bvNZ_{UtQ8wCUcpMBydTtsxfzD;_{s%WJEvT%ErM2loR& z-AK;X*4ApKwYAkm;PH1(w;7OiS?2&sppX;zV{TtxpS17m*Rwl7_ZR;`BZb0I$O*8} zcVryLzQUK+(1b20aDiDFS=oYEQ>}fZ)}KFrUIW>g6c<1Li`bf)*Qu_D2M4t~3kw4s zeSKQ7nc&+e6crUcucr*6M{`cJ1Kng(Iq6%Z)vc6ImgcwuL2Yt%nH{KFA&+sMD#k49`}QIXwB^)VoY)dFQj4ETuy7dK)FEE6FhnvHbD*{r?u{>03~ z!{ei>9~u#{PD)BDzwqy0Lt9Tzv68p9_e*#8!xqr1zzzV>CQ~yrSC@dwDR6srKJ2!? z)FC=&mL6D4(G8EnjuO|vzFr)Tsr075y1Ht09Q_wK#SxkyPQ2Om@kXwFZ^5VZ)$1^o?rpUN6`w( z=Odr~<5_+}VkjyqcIU|6w}UT9)Vt29AS`Wd#qa$gJcj}zYtY`_9)97G=7TOygF;jS z@cK|i>CI#Az^@P}hM|$QYLiU@27g-PDWv)7P)s9cplPz;fTn{|<>kie2`|KX)0b1Y zLM?rZm8sXnCYfXwrKzJ{^lI)cXP7W7H4gcf90JcoOwV8M$Q8VqxDV2MX^{L|&5VRv zHG%DvQdG3AZD+Us6)aiM+}s@4;2Rt8&fmX&X~t$26f9$c_tylppd_F;J!}cu8si~<6IRV0d zMk234p%zGL@|Ds)%~8q++*APWxlo)0V0v$19jIF=c1?b6XYU(9*$)NK(7bc8TfeRH z;_x_P{I`)2-izsK6EuB`haUTc45b}wa^t#^F?yzXC@74e@xoMu*gch4MI`TU{v zn|Z&}S>sv{UbN^Ipjl{v>qLbE<(XrgRUUZbXV<6mLeEFwhF^`zK?*2-sQLCz*v<82 z<}Z-X(a2vPQ3Az{C6)@n#e}Td@sMvk{*Dm~G+lkqcsF!^on$Dc1{ zjr8(Ydm-c!eiuiIr#rK*8v|@0Uj!2vf3@XFu_tz5v1=g7#2O$@iY;fe(GZfU0giBy zL6HR_YEs*DZOXqWW9&fZQ5?twi3L$$5u~ERszb_&F)$25G0hD9RkF^Oi1Bzbr{BS< z(^0ZhNR~DRa%CY4+dkSPx?TQ$rbjTl>L-^wDe*2(@RFK^#rfp-`k@~U3rlW=vyhOG z?L4T1a!&T_fV z=fJ3$oHKx_1?63(Zpzv(Uc9IQA6CJ~$Cn4vmhByYF7W)D29k#-=Roa?3GR?r=!x>R z@mSl|STNz^|NPi;U;m^&uFtg66p4nXbmgx_YhV3~CY8S;>xiamJKJ9t@;!NBoqAYu z3$ji@`vKOYjX}%=*^~5)U;Pdf^S-+c8acRgEkGhv{^s0`0}j-fQ4Yg}84QO9mACsO zWda)Fts zV9E4I`s*FrL!Ptn(&Bj;`lhS?w72?_R|%Sjn2AgzM6B?>Mm;28`||hzX~=vnHg;1L z&_*ok>FL2@Z0B#z*K^&#zp)QjdPMHsxw91<8jAJ9d4GRD%R0P&oq>sps&a%2E(gw= zzYTE6Jtw~dWczZ})zxX~!I^n64>zHppeW52v<#k<2!E=grl#AMecvm)+`7xHNes-} zywMDlPw6X%zYN1Z{-gf_A;=LvM^qKtg^<7J3zbo3`-f1sK43t zP;kIEp6#8#*%&X&mAWUUxZh5xYq2qa;^r&{z#*+j`0h|(YGZ%@OmO?-+S@BAHUX`3 zJGf`x`|2FRd)3X}`T+j5!P0KG}|MBpsK1Sgu2bqKXhZ|-BA988v1Wq0t1mI4Z zmNbVGubo<2ir;>H7yN|CPH!Lv8%Jw z=z+Sr_Z{$Shxr$gLqTU}-v8}oO+aUNCP}Q$?z3*aiUJr;wv=USXt`W&*(>mucL(W4 zB_^OU#nayfUdc1y?+v7-r7wPOY-~v1K)GnC-}6DqmGf$;sI|xzV$!PEH|At#pFa-{ zUQ`AQ{SFWa#JS|*hMZFqanS>L9JAk%-r+R>=d6Km;!X$(K^dfQYqtXN!bXh>VCC<( z5(=dE!%fcoNPHBbe)0e$>WQ~Yf0%a;fM4(Z4w~Om8D6f7VKndS<8WEDUMQ$KhsnTl zn6b4fg7|sJHo^Glr56w)#?^6b2oaV`T*+FyOM2If9PGCDaOSCeY^3D>;Q~N6APa(! zMyX7j1{e(YkE`gF+El2Mk7zhXHEuH(g!ZPjy-mREZDtm3OYw;^#sN+sHY6R(Y(D&< znEGNhe?TIl1`?o1PDwc|1UBvV+1c66$zLc~BTQgy7Fn2>{FZ^0UAucZN3G5$o(Sftj$;4E1dxhLt!_ikLSo?wQCv`ejNUY2Ls|nvC8~+xdp! zUXBO_PWxiqr7_(<}28=U6<@ z{RKiy$wX&T`8jjfp-B0AXdr$AjDrCq7I!a$ijM`uW!(_@VNd=S!Bs#jcffrvorH;@ zA8&qBZd5Z)`;Dz1a!pr#`t+&j=HhP|m0iwjZfvtC@G}c2ug`gd-UtzXa`O^kOMdnT zuYMQs)^{s_bqJSYl6-w&V{K&ke7tm4g-0h#eX0sXFF!Y@t9E(UtAWz>1}tszKhrmF zu2ggTCFH;x`cYk7Jq|75VPmsIzIjtWDUsXnReaaM*9n0Lo~#1fxfNLNo|Atg#Rg2= zI$7z~r+3}_!?tuplA7C$jQ38t10EfCIVh9jM@P>2&(`CGQU$3~z$~$!#Qe|L4|Ph6 zw6nsl;E#2@{OJZ%r6K39`7Cpv+tAe*Y6DF0^+p$$fmUCB3#9fmOM zFGpd&@)9>JeR0dN?zu0EqDKU?c7Y+q-Q}iV7$`Bw$$}Vl17ADqjK54{&i^KO{p7p7 zBqErt^6K`jRsMa5(akWJF9ZIQra~}#ms5$87JBM1dpP893eImV+U5}dZX{8d5`IP) zRe$on2~$#@vb0PS{TK>q=)34&)mG#E_ahDk+#yWGoR44CW}!yc>+|GKEXiMnjy9xF zzsDKkzWfirz=HO8SQW`{d_Pb{g9`-WVW|ajHEotxj}j0XO%SfC_bBb-2DWn((f{|I zL%>X+m4)A^KV`trXAtuO@@8W~?b4^#P+sri{yW#dHO zjv8E$16qBZiAO99OChwaG z!6jX4!DVTmw9Ac?nDcJSx&qBOS~(JAg8xld6@Wl0UDj9p5BP`;jsNMa*Z$REe`Za; z+$FzBl~eZip>xwUb%NXl{N`+#)DYNN>#q2)CZ@jSnlaEA!3rFJ>eV#UJ}K{i%(6ZU zF#?Uvdy8#~Or5))|9V?FqLx8ug#ZQ1{q@{{dkvOK0WylNcaG0&$Y;D5G=`_;7S z-b2Mj{LpM=auJ|)8AvQ5%gftyYqC*yHOyDWANlgAA1@j-B422{+!1MA0o^ea-`;tc zoG#_~Ada$Q%G_%<%%t*p#`RMWJ#*{kFdqG&A;SDkgn<^bN!8mq!9-o}&*t zt8c(Y+3yqS2Lqp(gZtOpZf{QIvm{+xX|J-DiEc6vH$3wc88_&6W~F_OKE0m4J@_Sn zUeO!iCE*}3KiQpkp8ISdD7l=XD<_oOpPpo_l4up^UhPj(8snJX(l6vV#{cGg^&PEr z>TMS%2|+3_pX}V+omZJSQpCOZLDz$7 zEL@Z@u;B}YwgnoF^sj)t*M8y~N@^acmCy-+^~Nx~=uv1aXatnIy~vetb$(a?T6Tov zpK?@Qetfh9o>yXgd4ZWx+5-=)uJBSjc`(cfM8Op`G-X*cF$}^sk>nDfu1k6`8PlDM zoUH%`#Fnypgdiru+`LNH=7ilt7Cl$1TL-t0=7=$Z>?C)4ju1~-&U6L|WkYAap(E%Sc6 zBC1VFhju*MYtCWK?5rM-KTS}Lqo-pg8eHIlzqYWSpGesJfnoZKS0ed3SDW?=qE%1a9 ziTvO}yk64ep4gNJe^i?Fnon1;#c}__Nm0ma$Lz3%1AaD^n}fNg<-#cG(i|!w1-@LM zRWMGKi1e#%`!&ftl86!*}3 zhAe0Wy=mZZdk8q)=U{h$DzKRI!fy34iFM>K>qpDqi3|aXEfVLCp89!4UoLvXudu`1 ziJ#2NUSVSs&w+HRz_3_<;)h)VK7&cQmC6vC=$~^br9??9YwO>PjVfL^*qx{I0nRr) zuYrWBJx?(tS+1zuZ>MJcy|t8msDTX9SWqIw8nAfnrz(ocDeHOYSB}IbgCje|!f+3n z-GF@F!zo%MItwi;~+{Iarwvm*wEJxmg0?YX^_k@|FN3g=)U3wle%6NYxwZGY~%z%%;SvmwDRny zkDhhF6si~|&2AHHI+ZpS>3wu$6$plT>5koDN2CQHH_epjZ@(~L6g&z;1V4OxHkOTg zaAdW2SE|hy&TJpqcsypxjg#wKcTSxXE)n;fXQX@acRv{95SLoI*d%ZR!to#}2+)*@ zw=ROW%H6dLT$T7aHXt#JqGV;_!=>6P&%$$FGksN6)`iBsE`592QC2f&>f9j4`!(iC z2xu6_uuITnOG`1oa_GEfHgMT`IP_)F(B$B$7b_|DIx1+Yhp*JRPidwO;nKdUmHQ3oKkX zm?Rj|b9j^r+G@pJ(gTxTC?8{z25gQE`6oMB>f0Z!OCiWPIpWHxl3jvTuJ5ZgG+HJ& z@=Eqx!)zE|-Dd|ZATO-WNI5bwu59I(Z{;x|TDUGuOh*uZSEjD;2swGdH`Coit?N)p zg24SDN@%kqB(QvN72}Pyyj?Q9jUoN4|G9`+ktsaqS;C^}*gS?PbT4AQ=A1f#X-*AF z%d$}WHMy-8{unABmvWMeS`YT@?az z3q;HK>;@o%dkr!dA&_fa^SejypZ)RFSGI7akAz;q1Lb(e9^=j@ii#28>#$Fe;C9V zPRb;49&2KPw+l7vIU>%tk6)!Rr-K-reiu6a%X5g;_7i!W7jr+s1IDjr9TX*Y*`8@a zshcQ^KbVIsz>n$a>PCp9Q!bXm-X`beRikK8k3yM=)R2Nr!8md%QjFvMqT7$d~!}$-iIZN4$XTp8RA2}R3H_QiITxq_<=bP zxX;F9KC6qD!}{xZOj@gsP8CRwd-l7Jag%&u>zC5liu*)-YnU4t3l!t!T13Bb7al-< zZP%V}f46yN2XVwm{V_g|weYGi3FngkuM}~bv3Fm;zG7029BeU2_X{2_^!W=KlDa%G z^eKj57|mP6chG={wm;CFI~x)H-cHdKC3c}X#o>e_I79zO_X3|l2bI(>ad`CP12-H8 zDrqkZ`x6{J@x672z~a2*bcq8}&yB6%1bKt0p^KqL2{D^)(k`axz_u>(GATU_=99%e<}k`C}Bs^14@gL3^_j-AU-M=Q)G?TCkU7fDO5f7n8a#BiWq7{ ztNk_)ui*E9{*WpN)nCqdq=F+fL6PVBfWx(viaN?^+k=Gec@RdS1>Rlg03jrWc2g`r zNN$k+)QJ>(eoW*j(o*@|Yckl6$J(>~UtDUlJqZa2vcn)w6}SV|h_V)rQpy+4p1tNX z*=V@^;{&@YYw^_tGqT;Uv9bTI-d_sM!4tNUed7bCtzC`n6({1?-uLv;89oomQHiiC z&g;(i9eak}2I!qIgTHsTeAx4n%5emTNp7i8gYLN^KEWDhYNhjm!-sj>2D~Hc0or-O z1ue+ym-ZCI0c%KP;MGd)5JTx6+&{C1@W_f&KrQ27c!L_&SCfa^3Sx{2UTzA_2i)<* zkk7`7iq2Raa1~u2Z0rVhn349i&Job_jCK0wGE)+iNkfK4xSsSoRNp=)*jk5cOB6_+ zh*}OSqFpsQTV%&*d|UXm-HYgAl)DWA~lK%N`p$5 zbPt1ci6S92sDw&4NDir_poDY?C@n2@AN>0LU48HS?|aw1tXV7;GxMBt_St90XU92~ z7!j2LC&zd>Uk3+U4$DWILFL0_=OZ%Up}8Nqnqb!O$WNCu3?}0>_DQK85^QlZtR;*b zOB^_pzyolUoO~%yI8+hx-R{l=@(ipH`!Z=(*L;Q_icZBK5Oo=eT{3>{5YjURFcg0E zvNo8?h-pIdLMNhft#0+b=F>8l)L@G&9;3c+^%vPdI86nu#utMB)cYVOS>#xm4BSqa z^ma-MFKWBuGTu79FT;vqn0DF2NMV;RQCOt;mMGI$BR|7bS;P=2$2Dz~FsWmL_W0s3 z7a)v?IAGg;nuSF2>Cz0o!V`j<K4Icf8h75G$VF+wL)Nox+4FkYEUy}J{NFz?2)~X-nhny zQR6%4vt0Gxl;$6U!*}zYYp><1i6_^9Jtf3=Oh==FzG_Jue1DdGZIu4Zq0G7W-FvYF zw%r)qvtaN&(REZ7_icZ*+w6`};#2>f&-&WB;Yz_Bt_Ai69S`%W#vewdwA+>Ovuk#c zvnz~mznb2w^*F97#!EeYCS*Ff?PezZd62B|S@ykAK3ta>zoAK7hZK*u-aAu|sRtUS zh0pE>jBcg|^PulUN_eh~hYsUW$UU|v7R>4*pA#JG%5euhR`G1FPmK9=t zEe&$8bVL*DZ3AJdWZZ1UCr6#oyJnXeZHTff34hADLw$7gtPruHmwqfFK?Svm>K}Pv z3N5l6E;P=uYOyQI{&_f<_9T@5kkgCNKDph5#J+lg2=o@g6%n|IIgcu0fH9Khh@kFG!%I~sq5Kg*+0H#(Eg=Z02?^dHJaip2YO;=FJJY)#E zd)uHGfedM@OIXtleGXIg@Y>x;dk|*)bDgQ|Cd$Zj!kt)5n4gz`lmQKPue1Q0FXWW4 z%3dFSbE}J?SZu9NYL0YJDt02n#t5`h7jwqMQrkd4cTg!td(?WvHCA-rsrTh@5P=KU zuDYZ+o@FYa@#sgF1_ncLA+`9K;2mnPPm`q6XMTpX&G&qn$$eJcSbAzTQfKnvb<&I^ zviT7~p~qOP693(Dq=m&u2Z7qB{*8ql0HqvK9Xs1x>s^^G(7tsHczzm1iG zX00h`VK*z^7VF`6us`HrzKaun`e0W@C_N;FvWF588eW{mXm?2O8sfiF{@Ej~m|?Lt z&2YGVMpW=oOe2)6yK41)*sJPZGUX^C7JWz3|;^B2?&f zPQ;{sMWF6@&ED_uxQbyYE+$FT%1FNiLDyKuLP&lT)FE5Z%tyl5kXacYABy^N8~bt` zHn5c@vv{x)rQ6S$lj05OikEa!7k$=k825|FdtcJHrW42xW6?GK{W2)kQ-m2Dz}|M zEM1#&O^#PoSN27Y@TZy!`31{^eNekI71_a1WHSg(*+%!V%6cUC_JYQ_8ehycrW`Os z7QCa(rfDnYI9bGUVeGClOGixZ;0}$G4-*pP8v21lxGsR zz2_x-C2CJqL=B=6N0K7FSLZaP(1OOq2Jh(*=;dCzDe3~N1sP}in7aQX=VJ}ndl~k8OHL)EIgDSBHpxT|hW7t>j0h;q}e(df@5( z^ybIh9%2irJiACU_p~<<1NsV)Rjo*On5vHqwO%#KU_*gl@X2IAb_ePu*81Z%)u%x0 zOrYb;x@F+pd;|>=g*6+nYF1-|9gtEhZ5kFV<*Y7`DQ&Bdf3KMHl^}^S%_@ z$k%TBz`;C0l|zGu!K+i950y*InxRI1n{B-6=*!LT<*^*s=90}ta%m9Y36^MgZty#Z zF6n#xvMuUqlBWku_1duWcAA9*hN6tJeIhS zMQnrr8q#Y#xa1vz?`V!FGJ5H%7D*5ebINhUz+NLR%R@$aCg7c6&SecbszJ6nQ`V?k zT|?&U4fRVWN1`LAV*!@k+p8jgyzxqVLQz)ve}=X`U*U2BvUzzyRv3f!=W6np;&RpIb~ZexA!4fzf^N~frLCWnnf7YEiCLCX_S8qGvt+D?Hk8F|n!Yzi%*8&Z z6?wJpe6!H2BM^qKn5+Nt%kiy^)zD0(cqNJudgaZTCm~B8_wM*rT0c8rbZsA6H7xe+ z6Uw_?p;qfD(*?pL(_4Ltr;3;t_M@c>WJj!?b#GQXbick`;h$CBIQJEgq$DTxBUKDFI=xz45I~@oa9SwSA`V zTFrt1InxY+0zuc^Gkw-({JDgKZ7Xa&f5cEnAzp(@do5|1?Y}}P?gSwtdsBRL5$F2Ap6k!+XkruA zJbRvt=a;%%nouN@2?Cv)JmN=h4uywT6H1K;ryUHlc>9mX*Z7b(mIb@vGSTd2VP@@g z!uAn8bp}*cvS^XrDZ%t_Ji9P6E>ZG~;0!`fT9y+b9jeQ^1aG&cFq|)CsJA>{ z4zf7?1g4TbC_L>Ga^!cs{=#roUS>~Xa_x}mb5lzXTU&4p+a;$fmS3uHi&3}d zMi(>MS)aXmp`5O^B#$L*m@H?Tklnl7_M@tKxI~=kvx5aLD=eBR9N+1}rNuXc<#b=# z%GJ{kziXgg+0d7DC}&ZFfl$fGfD4uR2XtkV84*eCjc9LC`so49i@{ux2Wbi)rRfCd z%J7MW?bew0H(pX~d>7EW{%%v=dV-UHY+0gRcD=7H%2M58)Hib`4li(e=$%t*Y!P)! zou1D^`i6iN{e#|&AWypPHs+^y(isd6KQooD4-6goZH(@LvMuTUNK|l%%N9X*#)%G! zE%HR=aC$l`m_cNt?Xf(}oC^u|9(|Swl)5}OjB1=r}~{CZk;uE={*4o)y@FL zrB=?zA7Ph2`zL1*o;dYRTPJqjTY<uhQt;TyB9@2naj`fSz@ zg?v1|1!o4Fd<+kV)Q3%<@QQCb52_cRR+(xqsUFBWH4PkOCZirVo}6@fNl4WyPT|wj zzk})ilzEVcwH{v35ZuQcPl@4zlvb~i#Sblhy3^PgHoIi19wXA=&>`85&iwh4TkuW; z!{989DePUn{j)by7>yz=)o(Y3XG{3lnveH}M6v?5<>ud~64tzMH9svnM7{R$_N$u7 zy@#1~>+@^-k>7f_4tDBwo-J#b7Nse@LV@#Mq-_^nr4jJ@k*r$vpS}QAj$1?8oeo<{ zQm2#O_p)^NP98KoRk^-jhYOGVSylXzwd$4#hu&Iqe-3UjJ1jew79&$tTIT^3~2TR zMiM4o$llbQ!HvV1I*piJA;^13PJ^JO-7zOg&M-BZEv9|Ckgw(kyP3CMECr=VxxCP* z%vm%8<45g-AM3nbX(rp|?kK-MDqWdm75weDg_;>iA^8~t}w&prCZq%&8K z*guI3+02V3ER6ztvqH!^4>}JW)lDS|d}crC;6!L+N2|4!TbcMtdcJ0FBP050wJ~GU zTi^uN#BxPK-SR#KZ&BDQuFa)bJ?ifVwmCMwHshZPjM*z}i!~n3POrN#@jF^ZV=UH| z*JmQTz&_cjlGw@M3YU0+hC{G*C$4ERboQrR7e|hYK%Mkghw^RtaFLddtYP%p(qMsN z#`j(BN$)xTqmzzx2C*0H4HGpjM^m-SpnX;DZC4&xrxyy3j23$|0MjSr;d*?X4eoiv zqruM#i_@;MXmV9St-P>ML;2O5Xx53X(7HP8iGrSst5j}(jrG>meBz$N*_RcanT^1t ze;`{1mo4Ds3&Lah)y4gNL0p!ylTh`AjV}u>=`tB|RtN@}&J( z9f_ZBWbt{ zzhTVk<&x}pPaW~fs5<#!Rx3Mb){;WEWaMFRaS`hUC-kZ)7Q?XeV>2Fk0ob*w*N;_eQxw#h>8`cV}>+)Gc@mrP(4M zyL0QrWi5!$M__Owk-IBn!A$P!tvS!epbEve)(Re3$+)%sj9K0=8V+bro$=jvIjUY( zmm7QiZu6>ehW`lq`a;1*S)aSwrbQbMvUDdd@O#vmX`CjHA`dzIfI#HmU0@gi)BpNk zHU#^oZq(LnS#h0YzvrdTyH*g1-Ry;H`c(=HBTw0tfe)2|=Q(s7GxQ)>NF+&y>_W*)Q75(hmA}^>bJi+n=X-c_-pM3Y+yZSEq)y>4<`h!qI%B`ijky-~)3z_ovWAWwWVltllzQ-w^Q zFRxjX;J87`W%DuN3p^*VO>bf>6)r=MsG)Ru+K#y|Dp@e@_-4tkCV(vC`%v>d?<8th zZCtM)Q3P$m@Z-sAc(ww<#8bhyN3+lMITZ%8xFniKKbb6ww+ss0gqAJ0IC6uU1(Gzq zB^EuOoe+JsY4EafFW>feIg4#M7fdZb>@!NeGs{9`9w^C*%w}^WONmb=q~EuGCJH_7 zcKA|C1-edlKQ1yX%vXG%>3i?TZL)k!G1bBzcw&yD<{!EPaBzjfRMk+Qq|cz^GxWHd z_}-%|x`nFboUiv^aU|s6FJbS&w$mQ;5pr?`#$tN2Ix{-UZGRJ^GXQok4}Y=@lq{uF zdQ<@dL#|8#zO(mL84p~!m1jb#7tYde&QfIPC?99>D#zo;8TTiBa%B=LEtUdtbiqpH zsI#!;S>&>x`s@=_U-$$qdkYuEETtao-r+`GO06#B`-L2zgWge6Is=>Nh9=f(w^_L%5eUe|^F_vp8D%UB+PaO!BBzJhsz*wl?F}G{6`G1j1-bjkvQh zg72>(pR3G85{1W[(x6a8Kj(S={1$nwWsT3GSX5e>C`kg1B{EQ?t7`4_{+2Uo3u zy4P$;zs<9gMi3(?Nd6d06y?y*`7agAe|_T7E^$|K*|KyGLu`sa9dTqgZ{hM;!q7hi z!Dc1mC-u-J*-Mtz_}GNJ*ZDfX=++!5o#$`ZBFvG#+0~hs$#pFJ;AnCw`uE7cFm&l) zK(&75>&@L8=!fksh3|e7@D~|7y}%S9w&ZIlFZ3(^Kfgq!p@hM;RBHae|Hk7G*ayhS zFTVBAPK`vO=9;nnAy|FXjsw1ove`WVOolIdq=IVHi;$acK& zz8CTz?{h_=VIg71iP#N5L+{^BAtCmon0^SH;%!i%rvNQ{(7_+RQ(c%}z3m2;QCMfv z(hrMsJvsZLL(+fw;x?q8RY_r(33<_ai3QKukvD%;12Bddkxe`K%KK>6LiXEF-qp~` zs1_`FlQhKuy#z{qICda_z}bpvc#K(z77!ossw1ZfDyMvm-B8lT;PAM$|4H_u3=-sS zD$eZ#5XE-bWNfv8V@sCL1Kbzzh8aR7ispUZ2!xJHfQ#=+^{e2Qjlbdwx^4am7>Cg{=2ifM@I}ovoNlYp5z+moF z0#M1{3(9zOd+2b+2!r9I2iVcFE1QlKZQetAn@F_PaUJD1TEu5aof9ZCsL7~0wa(be z`Y-MQv)dVVKjA5v05L!v`7{Sm7Hp(1&#Z8ZN=X?IfFzVeOd^;O7r7wzTbe#OSSiRf zH`)$xt0bP)>7-Fr@fMKs7%gJey$mLvkpYQNYrN^zbL+PTRnKvOs>=(DRGxu6$@!1? zps8kSIxhgML7NoCifu-8;T8@EggB(UqT>j_BG9YA#j+_d@@x|1QMe_8v4En5AfNDs zzdTdfBt{1S3eXK|fcHtGS)A@$Y&E>e0tf~+YMD46)1L7a>hIkqC1L@DdwtGVrx^mm zo8E%x8Ma|{(8*E?YMLQ}`*0g*M83?T73^gR=%Ydi4qwwHI2FzfHlYbMUoAEvV=^Uu zZ^4rT|3-;GNU|Gn%n;GURpr@mKF&HDYC7RB#?m4dCidY)3juOp&0~UK_#rUnw(D2> z%QjwIP+#8ltH#F{YT@3z3^3v4;Z0v&zA$4|egP@GM10W8>q_`E!5G@~u5vw8KWlzw zNL&>*aOI2-B>v(9Tyj%N+(<`!;qKkq5xjHlyLHYwUxkp#$vwik z1GoE&;e))x?ssN)5a=LfI6TxtBq7Qq>AHEhk!BRj+5Yd|{flkwmC#>}*n$2p3wQ4Y z^Y9tYPE z5dZ3e-=gucHgWM4!H~8p zz-RQk=8UtzN_Ee};uYiO9h-2aYA}a%qgWJN_&J+@GA=>&;R@AqTeFMtl!&xk56@?i zgf3A`+XKdk*#ufctR2Cbl*JSNYX=?z5Q(Ul#b%8W@s%&dTVgI*A_zAG(R8;*iibl& ziS7}ek=8@wFVeDHLD#bx;J=Bu&?hrm6m~^z@_Z4k-6^V-6w(ws1@f)&*%=w(|9hZw zK?0ESlAeuZOA*2*KS1%-mPr&~h9?hCyae!mnP2w*CRapGAC!L%BwSGKU$Rs>O^Ma8 zc1Hp5h4{hE#L+Pl@v_<$Sld(wS%MA^*30#t|b3 zoY~N2K)--;kPBrK8z5FKcI8~|uYD-{Yaf28&?~>*SpA=QLn)SL8jlih8iw`*YVr2_ zZ>^QbFZVV=oMV=!HY;zQ?|QXR@hor z#M_?}>lnu0&|&IZ4`g^+I{J3DP%I;EqC}D8I{)YxM9xvxCD+Bf6M5V3!Fi|`Zvn|i z7jrNb7}w(QC!0z?Q4#^7?7csojt0Q>9NypD)x~<5%~d_yU7NsgQlQx#7(X9EHbkxJ z%u{Rp-I#1CzAWc-Ecwwkfw?=^k_Pq}lx{Ur+{uo}HWl@KrHb-0wo@aDRLaNPZ{3jq z4Hr5?gFa9M7R&!ZNu^kB@DlWQfMe+-Y)|_JsvFu*-joi3;WIb4LH9rSNM`II!E*U} zCNS%&369Yyw3Gyr&1JR9PVw5{ZM}At>n$k&OI*iT<>ojgaD3zuo>{^;K?I0`Iz?8W zzM`YiEXIUQtw@;!P>1v{U)I%j^j&u>d8hyuKRH4ut}U++vO zR2Y3Dv*2?&J*?|!i^nzz38AmcItbu)*O9yKB=v z;-&wmFq$`j`q@pkGDWSAZk!8M1j~M){mg(o`O4ACE?87V0_5W<&DGze1Vc~Ksko1L zIJ@c&A3#1IV6Y)uy9K-fk_n~>05LP0dxLm5;mkpAWB}kSjrQ3!8R_{61-76>kvbAA zQF|XGPgV<**Yf)=AfW|Y+QTuZCNMQD)U!@vJ?L^cW>y0rC3*9paSe*L2zJ_Igtzb9 z*l>2%Cgrfqqh;(bD`ikp_YE)!^Ho)L&(6e7yEEd{<{Gd&V$UE=@>W~&r-yC^*ZW=M zw=Z9(M7cFUr#0z4Lu)pr4{-4G%EBEP4&7~gahQ@*g4!<6nRs0Xb=JS)HHbxf+5)J6 zh?P0D*;Eh6DqChwLYT_LT2qRYs2)#+${Itah0#T;V;(*NQabcMu287jVqWl~{ejw1 z$@y)a{wB~2;Ytb|yh?r>wZWDmgj*W|bsm`w(@ve$7s68@Z{~}4pz=&(uhg(nXry~F z8zG#`V=#w9mn+q;Iv^6tG?oq#W`ET4qgu^}a>@OUWj)*oukDkB?}=-{(u%{s0WdIDevDZg_(Z9pn)c8-`iT z_C#YIMSKzaE^R$OD4dJ6#y9hYzgrbT9u0rXH0s?r&np9_ICEI&+>j{JUdMYn&@o!~ zY!2AHO96%$MUyOomS-EP3G3NNZDtk5?e^MCQBr%|bK@A!et((F!LchM9ah1!7^9^a zi>nMF8K93Y7F9#Py(G1qjb$*yr>xiS?)uo-aAuIKr2nA@9&-`*3%}y%k?i+l?vtE* z>!8yHOTuC~jw8sbYI;MtJ`z3XBqb#CXx|Z?4{cXhBZ=$+geijB1ysq0yXq)-6ZG!& zyFMA1cF|H;9P{a@&dJi6X*D7Ug&xDu9CF)8XN9ec=SSo)?+a-N!74O)hWjzjp^n$f zg(aI!Q5#2MUl^IL%qV54P{37^(`pd*2#R6DP03G@JdrYMkT#kSV*F@&O zrxf#B2r1GFb7f6Nk=4|XqQe?W`ST7%zSD=pc^qRKBR8*%ym z(uYoeNb%pk=KrXoL=(LV2A(#gX!V%T={ynb$}4>*L4zHgYnr%_nq-k=pBN_Jm&kL! z!;wj1t(m$~>zvh%;=uQ}do{l?X(d0Px0SH9tT?}GXoe?q`>F*kmsNK~%!0wiVfhhJ z%(Lv1jZW?hdwq7rHLR-$UWKw~Az7QU7IA?aBBQAh^Y)Jx*-WZk6#AMK=xF63xC=NR61qV#4IG^n1SD`&tUx4G*h3?N%7EEMlY z_FAR3mk?((Vx=a;4KkkjQ;$@c$I0{g@)pyGcfBsv#UI8s&?8`u%F2C^)Cvc;oeeLd zCXF$A%g5}w<>QJDG>KmKPszxAta>Z=4oT1vyN4^8F0Yq;KvK$RHb1;5e@QS~KsmlW zO!hMQQ_wE>_!mdLdWtqg6-z?Md?d2xuzb_%cHLW3EBAUNmq@#2%q+!1`9)eg0*l#I z&MC(ah>x@c#mwy2h>qC!N&~y5(={VPm>0n_x?KSIO9EUd5Z*Mk z65i{x{MKx~PV8ekLi5OPBnczW$`aJ}z>}2NGLxieJgsnHCBObMhBIB){T|Cjkd~Q$ z(~=KTrQE}7wS5i@2F%D!jinKrEEq9Q&VzYYKM^!y#r5#Wgu>?2y%f>rabogFVjp#+ z?TB}(x$4pLP}!KZL1MTE!J=V6BvEWq{>Sx4+BL&W-N#!}3#rA2;wrf0DHl>DibMIx zk_r$1uPat2H6QU*`nqHUp3i4pT?}T0gn>Ttf3b@PG@2YxgXh+Wrj>nrr2yA_<#nS_ zXz)a}v{X^Pc-}t~+Tiv#0_t$CBvFyA+CxOzFS!^zq5u!94Mo z(~6k-z`f0h0(wlAd9N8cF?h!S!JZVWB(M8AP&~!fq%&sdU_h@@37XE7XHHdL$RDEb z9P}Iav_u|bV;?GG%)x+4C1hVMLz)U7vI1>_YrX{hY#Z4i)2_?PW-m(hV%{sxf1_rO zbdv%bj89u#lIpN#zS~;08>Ds(%&@$)WNhw*SdWV6$z5R%jLcMe|D}2IG*#l;b8qUm zkWWx&5p;+B32{AV_qw&6fOvW=v&zeBcQ>aSbVJ?WtHk#b%0kJ{%+B|JvsXMIAnRUC zJoL_?=2j?|I8?YP5wl8YmP01`B4~_2$p#S3r#BDMZdjmB{?sF_YJZ>iq~|CE?>1Jr z=6MZ45q>p+D*;lAY0UQ^6O6??EYIJ*vK}IOgBno}5v#hD{N`>PL0|KaLP7IoHk9QFZaXz3EI5QyEoUB;6Li=sHo7^o@|^Bp#P1ByeEb@QMA}w0 z2xy`^z&N0yQB~w<(6xE>qLk_%|f>3*Jrz@i(wElsE28 zBL8n3@$9LTv7nIv;=r3VpPv7Q3xDC^rNrO~B965Gk!PFoC!9KSRS5$MA(l+d0*(Kx zkG~p)wH|pvzPmOR)u&(-0+tlNlJ#Fau375OW__ULM^mN$hFUDhLAF7;YlN`G_M85x zv_!xUsee)co$mE7YIi|w?UU$iWz_zh_bkz?TVTWKEt2+VhB!kZG2485Ty)j;kko zGgCU7G#8P)tA?^4DQA;EbZ-NDlg0~~Dr~QdgB5Z&CAJg|>VOtCigwdLR`Dt3Atyw` zsSDp-#gEiIOky3(PK}PR*8Y>1sEQxy&c4VGx9bQdGS+N*HwO#ZKfY2HmHW1A-TQ8P zE>3v6O?iKDU$J`oNtbZlDbffvkHc1JU^uPs$@~-C_#NV)KAUQ5rDIseaqUbLk6pa1 zzGJtKFRw&k8RL}w6lS+1JsO)gvCmfSNEICF&Kx|05{hMwxWDcn>VLTR;&#h-ue}%w zRJpZCtK2BOYWybK=Ql%5$J(|Q)>HA;s9Y+Oz-9673`r8FJ}=1>u<+v{qui%gJYY~S zwEl2+cK11LvCCHp7U_o!o>QjyWx0JSub&K?;Sx3twm#do#$_P3hrlem7%jrz=;tph z?h0p6IXu!)cMm5(V}j$NsKgoHdNY$Hq5bjT{l#|KX`)ClVVOgBQm&IWo#ZfZBJA4d zuDN%^x+jGIKp3ZSMfoO~qWP|DS+VoxVeTwubQ{rdY?!79yv|#l2VorO#V?*F}(aY+FS@DsE6GGP$ zGcbfCTrQ^nCqr2fzfwmXl^$9N9^WJW>9!n2K=HY`gFRnqP@Nep#rK@b46_mCn*;mR zO1b=iRr-}N$~K-bf-y6Tv8pMvPuQdcS2`z;d2yso+uxvR2oj7ZCpM6E z*vME$1J%#fpMOh54=V9HXh~DK-SZ_K%yG@kGpRbi(3>15P=pNPlU0l@9X4@#h#bFf z8BB`+uYG8e-&w<@4NtbwCK=m2!A%8tO8neqpxnOw-?9kkf5s&WU9vFWlIBXSv%%@K7b`TNx)O zhfec-ne1REcxZ@ju?mLMz~Z^kpRzI@Ho%GGge1UJxmQZpuK&616QCG{awTA|?!C#ubI%Hm|9yqSKva|(5x^HHzb46XPVCkf9l*z!NAnfB3?gZlhbXfd4i1# z0MjmuHZV?#eQT$@O}7FOZVrgUWyzr%ja+}=RZ}%Rt-5=fw$u(xh9E7_5&VN?9uvcSYG7?40Nq`YCQYzDOYMZK&|Uauge$}O zHsy85qThPe(3mb4GVOK9>Za$YxNvs_)bee*()#;Rz!o~PB-426l7i-UO9D*|R>Sl= zfAZHhY#cLd1duwt@C*tLRcLE{S$IFX(v?NIS&pRlfa9vN^7SSZ--4xJX-6T{`R$bV zd1$h=3RVX~TI?U3jwYHvi+4#|3AywA{g7{QuR{(8tg83=KtmU=&I76ATesOnrPyljT~ EUl$_QPyhe` literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/README.md new file mode 100644 index 0000000..edf52a6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/README.md @@ -0,0 +1,123 @@ +--- +slug: /MEP-6-dmz-networks +title: MEP-6 +sidebar_position: 6 +--- + +# DMZ Networks + +## Reasoning + +To fulfill higher levels of security measures the standard metal-stack approach with a single firewall in front of a set of machines might be insufficient. +There are cases where two physically distinct firewalls in front of application workload are mandatory. In traditional network terms this is known as DMZ approach. + +For Kubernetes workloads it makes sense to use the front cluster for ingress, WAF purposes and as outgoing proxy. The clusters may be used for application workload. + +## DMZ network + +- Use a separate DMZ network prefix for every tenant +- This is used as intermediate network btw. private networks of a tenant and the internet +- For every partition a distinct DMZ firewall/cluster is needed for a tenant +- For Gardener orchestrated Kubernetes clusters this network must be a publicly reachable internet prefix because shoot clusters need a vpn service that is used for instrumentation from the seed cluster - this will be a requirement as long as the inverse vpn tunnel feature Konnectivity is not available to us. + +## Approach 1: DMZ with publicly reachable internet prefix + +![DMZ Internet](dmz-internet_public.svg) + +A DMZ network with publicly reachable internet prefix will look like this in the metal-api: + +```yaml +--- +description: DMZ-Network +destinationprefixes: + - 0.0.0.0/0 +id: dmz +labels: + network.metal-stack.io/default-external: "" +name: DMZ-Network +parentnetworkid: null +partitionid: "" +prefixes: + - 212.90.30.128/25 +privatesuper: false +projectid: "" +vrf: 104007 +vrfshared: false +nat: true +shared: false +underlay: false +``` + +### DMZ firewall + +The firewall of the DMZ will intersect its private network for attached machines, the DMZ network and the public internet. + +- The private network of the project needs to import + - the default route from the internet network + - the DMZ network +- The internet network must import the DMZ network +- The DMZ network provides the default route for tenant's clusters in a partition. It imports the default route from the internet network + +### Application Firewall + +The firewall of application workloads intersects its private network for attached machines and the DMZ network. + +This is currently supported by the metal-networker and needs no further changes! + +## Approach 2: DMZ with private IPs + +![DMZ Internet](dmz-internet_private.svg) + +A DMZ network with private IPs will look like this in the metal-api: + +```yaml +--- +description: DMZ-Network +destinationprefixes: + - 0.0.0.0/0 +id: dmz +labels: + network.metal-stack.io/default-external: "" +name: DMZ-Network +parentnetworkid: tenant-super-network-fra-equ01 +partitionid: fra-equ01 +prefixes: + - 10.90.30.128/25 +privatesuper: false +projectid: "" +vrf: 4711 +vrfshared: false +nat: true +shared: true # it's usable from multiple projects +underlay: false +``` + +### DMZ firewall + +The firewall of the DMZ will intersect its private network for attached machines, the DMZ network and the public internet. + +- The private network of the project needs to import + - the default route from the internet network + - the DMZ network +- The internet network must import the DMZ network (only locally, no-export) +- The DMZ network provides the default route for tenant's clusters in a partition. It imports the default route from the internet network + +### Application Firewall + +The firewall of application workloads intersects its private network for attached machines and the DMZ network. + +## Code Changes / Implications + +- `metal-networker` and `metal-ccm` assume that there is only one network providing the default-route +- `metal-networker` needs to + - import the default route from the internet network to the dmz network (DMZ Firewall) + - import the DMZ network to the internet network and adjusting NAT rules (DMZ Firewall) + - import destination prefixes of the DMZ network to the private primary network (DMZ Firewall, Application Firewall) + - import DMZ-IPs of the private primary network to the DMZ network (DMZ Firewall, Application Firewall) +- `metal-api`: destination prefixes of private networks need to be configurable (`allocateNetwork`) +- `gardener-extension-provider-metal`: needs to be able to delete DMZ clusters (but skip the network deletion part) +- the application firewall is not publicly reachable - for debugging purposes a hop over the DMZ firewall is needed + +## Decision + +We decided to follow the second approach with private DMZ networks. diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_private.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_private.drawio new file mode 100644 index 0000000..7b83bbf --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_private.drawio @@ -0,0 +1,178 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_private.svg b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_private.svg new file mode 100644 index 0000000..f5e5820 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_private.svg @@ -0,0 +1,3 @@ +
Machine
Machine
Firewall DMZ
Firewall DMZ
DMZ VRF
DMZ VRF
Machine
Machine
Firewall A
Firewall A
Private VRF A
Private VRF A
10.0.0.2
10.90.30.129
/0 via Firewall A
10.0.0.2...
VRF A 10.0.0.1
VRF A 10.0.0.1
DMZ Network
10.90.30.128/25
DMZ Network...
Private Network
10.0.0.0/24
Private Network...
import /0
import /0
import 10.0.0.0/24
import 10.0.0.0/24 +
Machine
Machine
Firewall B
Firewall B
Private VRF B
Private VRF B
10.0.1.2
/0 via Firewall B
10.0.1.2...
VRF B 10.0.1.1
VRF B 10.0.1.1
Private Network
10.0.1.0/24
Private Network...
import /0
import /0
import 10.0.1.0/24
import 10.0.1.0/24 +
10.90.30.129 is reachable
/0 via Firewall DMZ
10.0.0.0/24 is reachable
10.0.1.0/24 is reachable
10.90.30.129 is reachable...
Internet
212.1.1.0/27
Internet...
SNAT to 212.1.1.1
SNAT to 212.1.1.1
Internet VRF
Internet VRF
import /0
import /0

import 10.0.0.0/24 no export
import 10.0.1.0/24 no export
import 10.90.30.128/25 no export
import 10.0.0.0/24 no exp...Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_public.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_public.drawio new file mode 100644 index 0000000..544939e --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_public.drawio @@ -0,0 +1,184 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_public.svg b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_public.svg new file mode 100644 index 0000000..5e82508 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP6/dmz-internet_public.svg @@ -0,0 +1,3 @@ +
Machine
Machine
Firewall DMZ
Firewall DMZ
DMZ VRF
DMZ VRF
Machine
Machine
Firewall A
Firewall A
Private VRF A
Private VRF A
10.0.0.2
212.1.2.3
/0 via Firewall A
10.0.0.2...
VRF A 10.0.0.1
VRF A 10.0.0.1
DMZ Network
212.1.2.0/27
DMZ Network...
Private Network
10.0.0.0/24
Private Network...
import /0
import /0
import 10.0.0.0/24
import 10.0.0.0/24 +
Machine
Machine
Firewall B
Firewall B
Private VRF B
Private VRF B
10.0.1.2
/0 via Firewall B
10.0.1.2...
VRF B 10.0.1.1
VRF B 10.0.1.1
Private Network
10.0.1.0/24
Private Network...
import /0
import /0
import 10.0.1.0/24
import 10.0.1.0/24 +
212.1.2.3 is reachable
/0 via Firewall DMZ
212.1.2.3 is reachable...
Internet
212.1.1.0/27 212.1.2.0/27
Internet...
SNAT to 212.1.1.1
SNAT to 212.1.1.1
Internet VRF
Internet VRF
import /0
import /0
import 212.1.2.0/27
import 10.0.0.0/24 no redistribute
import 10.0.1.0/24 no redistribute

import 212.1.2.0/27...
SNAT to
212.1.2.1
SNAT to...
SNAT to
212.1.2.2
SNAT to...Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/README.md new file mode 100644 index 0000000..14748fa --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/README.md @@ -0,0 +1,503 @@ +--- +slug: /MEP-7-configurable-filesystem-layout-for-machine-allocation +title: MEP-7 +sidebar_position: 7 +--- + +# Configurable Filesystem layout for Machine Allocation + +The current implementation uses a hard coded filesystem layout depending on the specified size and image. This is done in the metal-hammer. This worked well in the past because we had a small amount of sizes and images. But we reached a point where this is to restricted for all use cases we have to fulfill. It also forces us to modify the metal-hammer source code to support a new filesystem layout. + +This proposal tries to address this issue by introducing a filesystem layout struct in the metal-api which is then configurable per machine allocation. +The original behavior of automatic filesystem layout decision must still be present, because there must be no API change for existing API consumers. It should be a additional feature during machine allocation. + +## API and behavior + +The API will get a new endpoint `filesystemlayouts`to create/update/delete a set of available `filesystemlayouts`. + +### Constraints + +In order to keep the actual machine allocation api compatible, there must be no difference while allocating a machine. To achieve this every +`filesystemlayout` defines constraints which specifies for which combination of `sizes` and `images` this layout should be used by default. +The specified constraints over all `filesystemlayouts` therefore must be collision free, to be more specific, there must be exactly one layout outcome +for every possible combination of `sizes` and `images`. + +The `size` constraint must be a list of the exact size ids, the `image` constraint must be a map of os to semver compatible version constraint. For example: + +- `debian: ">= 10.20210101"` or `debian: "< 10.20210101"` + +The general form of a `image` constraint is a map from `os` to `versionconstraint` where: + +`os` must match the first part of the image without the version. +`versionconstraint` must be the comparator, a space and the version, or simply `*` to match all versions of this `os`. +The comparator must be one of: "=", "!=", ">", "<", ">=", "=>", "<=", "=<", "~", "~>", "^" + +It must also be possible to have a `filesystemlayout` in development or for other special purposes, which can be specified during the machine allocation. +To have such a layout, both constraints `sizes` and `images`must be empty list. + +### Reinstall + +The current reinstall implementation the metal-hammer detects during the installation on which disk the OS was installed and reports back to the metal-api the Report struct which has two properties `primarydisk` and `ospartition`. +Both fields are not required anymore because the logic is now shifted to the `filesystemlayout` definition. If `Disk.WipeOnReinstall` is set to true, this disk will be wiped, default is false and is preserved. + +### Handling of s2-xlarge machines + +These machines are a bit special compared to our `c1-*` machines because they have rotating hard disks for the mass storage purpose. +The downside is that the on board SATA-DOM has the same naming as the HDDs and can not be specified as the first /dev/sda disk because all HDDs are also /dev/sd\* disks. +Therefore we had a special SATA-DOM detection algorithm inside metal-hammer which simply checks for the smallest /dev/sd disk and took this to install the OS. + +This is not possible with the current approach, but we figured out that the SATA-DOM is always `/dev/sde`. So we can create a special `filesystemlayout` where the installations is made on this disk. + +### Possible Filesystemlayout hierarchies + +It is only possible to create a filesystem on top of a block device. The creation of a block device can be done on multiple ways, depending on the requirements regarding performance, space and redundancy of the filesystem. +It also depends on the disks available on the server. + +The current approach implements the following hierarchies: + +![filesystems](filesystems.png) + +### Implementation + +```go +// FilesystemLayout to be created on the given machine +type FilesystemLayout struct { + // ID unique layout identifier + ID string + // Description is human readable + Description string + // Filesystems to create on the server + Filesystems []Filesystem + // Disks to configure in the server with their partitions + Disks []Disk + // Raid if not empty, create raid arrays out of the individual disks, to place filesystems onto + Raid []Raid + // VolumeGroups to create + VolumeGroups []VolumeGroup + // LogicalVolumes to create on top of VolumeGroups + LogicalVolumes []LogicalVolume + // Constraints which must match to select this Layout + Constraints FilesystemLayoutConstraints +} + +type FilesystemLayoutConstraints struct { + // Sizes defines the list of sizes this layout applies to + Sizes []string + // Images defines a map from os to versionconstraint + // the combination of os and versionconstraint per size must be conflict free over all filesystemlayouts + Images map[string]string +} + +type RaidLevel string +type Format string +type GPTType string + +// Filesystem defines a single filesystem to be mounted +type Filesystem struct { + // Path defines the mountpoint, if nil, it will not be mounted + Path *string + // Device where the filesystem is created on, must be the full device path seen by the OS + Device string + // Format is the type of filesystem should be created + Format Format + // Label is optional enhances readability + Label *string + // MountOptions which might be required + MountOptions []string + // CreateOptions during filesystem creation + CreateOptions []string +} + +// Disk represents a single block device visible from the OS, required +type Disk struct { + // Device is the full device path + Device string + // Partitions to create on this device + Partitions []Partition + // WipeOnReinstall, if set to true the whole disk will be erased if reinstall happens + // during fresh install all disks are wiped + WipeOnReinstall bool +} + +// Raid is optional, if given the devices must match. +// TODO inherit GPTType from underlay device ? +type Raid struct { + // ArrayName of the raid device, most often this will be /dev/md0 and so forth + ArrayName string + // Devices the devices to form a raid device + Devices []Device + // Level the raidlevel to use, can be one of 0,1,5,10 + // TODO what should be support + Level RaidLevel + // CreateOptions required during raid creation, example: --metadata=1.0 for uefi boot partition + CreateOptions []string + // Spares defaults to 0 + Spares int +} + + +// VolumeGroup is optional, if given the devices must match. +type VolumeGroup struct { + // Name of the volumegroup without the /dev prefix + Name string + // Devices the devices to form a volumegroup device + Devices []string + // Tags to attach to the volumegroup + Tags []string +} + +// LogicalVolume is a block devices created with lvm on top of a volumegroup +type LogicalVolume struct { + // Name the name of the logical volume, without /dev prefix, will be accessible at /dev/vgname/lvname + Name string + // VolumeGroup the name of the volumegroup + VolumeGroup string + // Size of this LV in mebibytes (MiB) + Size uint64 + // LVMType can be either striped or raid1 + LVMType LVMType +} + +// Partition is a single partition on a device, only GPT partition types are supported +type Partition struct { + // Number of this partition, will be added to the device once partitioned + Number int + // Label to enhance readability + Label *string + // Size given in MebiBytes (MiB) + // if "0" is given the rest of the device will be used, this requires Number to be the highest in this partition + Size string + // GPTType defines the GPT partition type + GPTType *GPTType +} + +const ( + // VFAT is used for the UEFI boot partition + VFAT = Format("vfat") + // EXT3 is usually only used for /boot + EXT3 = Format("ext3") + // EXT4 is the default fs + EXT4 = Format("ext4") + // SWAP is for the swap partition + SWAP = Format("swap") + // None + NONE = Format("none") + + // GPTBoot EFI Boot Partition + GPTBoot = GPTType("ef00") + // GPTLinux Linux Partition + GPTLinux = GPTType("8300") + // GPTLinuxRaid Linux Raid Partition + GPTLinuxRaid = GPTType("fd00") + // GPTLinux Linux Partition + GPTLinuxLVM = GPTType("8e00") + + // LVMTypeLinear append across all physical volumes + LVMTypeLinear = LVMType("linear") + // LVMTypeStriped stripe across all physical volumes + LVMTypeStriped = LVMType("striped") + // LVMTypeStripe mirror with raid across all physical volumes + LVMTypeRaid1 = LVMType("raid1") +) +``` + +Example `metalctl` outputs: + +```bash +$ metalctl filesystemlayouts ls +ID DESCRIPTION SIZES IMAGES +default default fs layout c1-large-x86, c1-xlarge-x86 debian >=10, ubuntu >=20.04, centos >=7 +ceph fs layout for ceph s2-large-x86, s2-xlarge-x86 debian >=10, ubuntu >=20.04 +firewall firewall fs layout c1-large-x86, c1-xlarge-x86 firewall >=2 +storage storage fs layout s3-large-x86 centos >=7 +s3 storage fs layout s2-xlarge-x86 debian >=10, ubuntu >=20.04, >=firewall-2 +default-devel devel fs layout +``` + +The `default` layout reflects what is actually implemented in metal-hammer to guarantee backward compatibility. + +```yaml +--- +id: default +constraints: + sizes: + - c1-large-x86 + - c1-xlarge-x86 + images: + debian: ">=10" + ubuntu: ">=20.04" + centos: ">=7" +filesystems: + - path: "/boot/efi" + device: "/dev/sda1" + format: "vfat" + options: "-F 32" + label: "efi" # required to be compatible with old images + - path: "/" + device: "/dev/sda2" + format: "ext4" + label: "root" # required to be compatible with old images + - path: "/var/lib" + device: "/dev/sda3" + format: "ext4" + label: "varlib" # required to be compatible with old images + - path: "/tmp" + device: "tmpfs" + format: "tmpfs" + mountoptions: + [ + "defaults", + "noatime", + "nosuid", + "nodev", + "noexec", + "mode=1777", + "size=512M", + ] +disks: + - device: "/dev/sda" + wipe: true + partitions: + - number: 1 + label: "efi" + size: 500 + type: GPTBoot + - number: 2 + label: "root" + size: 5000 + type: GPTLinux + - number: 3 + label: "varlib" + size: 0 # to end of partition + type: GPTLinux +``` + +The `firewall` layout reuses the built in nvme disk to store the logs, which is way faster and larger than what the sata-dom ssd provides. + +```yaml +--- +id: firewall +constraints: + sizes: + - c1-large-x86 + - c1-xlarge-x86 + images: + firewall: ">=2" +filesystems: + - path: "/boot/efi" + device: "/dev/sda1" + format: "vfat" + options: "-F 32" + - path: "/" + device: "/dev/sda2" + format: "ext4" + - path: "/var" + device: "/dev/nvme0n1p1" + format: "ext4" +disks: + - device: "/dev/sda" + wipe: true + partitions: + - number: 1 + label: "efi" + size: 500 + type: GPTBoot + - number: 2 + label: "root" + size: 5000 + type: GPTLinux + - device: "/dev/nvme0n1" + wipe: true + partitions: + - number: 1 + label: "var" + size: 0 + type: GPTLinux +``` + +The `storage` layout will be used for the storage servers, which must have mirrored boot disks. + +```yaml +--- +id: storage +constraints: + sizes: + - s3-large-x86 + images: + centos: ">=7" +filesystems: + - path: "/boot/efi" + device: "/dev/md1" + format: "vfat" + options: "-F32" + - path: "/" + device: "/dev/md2" + format: "ext4" +disks: + - device: "/dev/sda" + wipe: true + partitions: + - number: 1 + label: "efi" + size: 500 + type: GPTLinuxRaid + - number: 2 + label: "root" + size: 5000 + type: GPTLinuxRaid + - device: "/dev/sdb" + wipe: true + partitions: + - number: 1 + label: "efi" + size: 500 + type: GPTLinuxRaid + - number: 2 + label: "root" + size: 5000 + type: GPTLinuxRaid +raid: + - name: "/dev/md1" + level: 1 + devices: + - "/dev/sda1" + - "/dev/sdb1" + options: "--metadata=1.0" + - name: "/dev/md2" + level: 1 + devices: + - "/dev/sda2" + - "/dev/sdb2" + options: "--metadata=1.0" +``` + +The `s3-storage` layout matches the special situation on the s2-xlarge machines. + +```yaml +--- +id: s3-storage +constraints: + sizes: + - c1-large-x86 + - s2-xlarge-x86 + images: + debian: ">=10" + ubuntu: ">=20.04" + centos: ">=7" +filesystems: + - path: "/boot/efi" + device: "/dev/sde1" + format: "vfat" + options: "-F 32" + - path: "/" + device: "/dev/sde2" + format: "ext4" + - path: "/var/lib" + device: "/dev/sde3" + format: "ext4" +disks: + - device: "/dev/sde" + wipe: true + partitions: + - number: 1 + label: "efi" + size: 500 + type: GPTBoot + - number: 2 + label: "root" + size: 5000 + type: GPTLinux + - number: 3 + label: "varlib" + size: 0 # to end of partition + type: GPTLinux +``` + +A sample `lvm` layout which puts `/var/lib` as stripe on the nvme device + +```yaml +--- +id: lvm +description: "lvm layout" +constraints: + size: + - s2-xlarge-x86 + images: + debian: ">=10" + ubuntu: ">=20.04" + centos: ">=7" +filesystems: + - path: "/boot/efi" + device: "/dev/sda1" + format: "vfat" + createoptions: + - "-F 32" + label: "efi" + - path: "/" + device: "/dev/sda2" + format: "ext4" + label: "root" + - path: "/var/lib" + device: "/dev/vg00/varlib" + format: "ext4" + label: "varlib" + - path: "/tmp" + device: "tmpfs" + format: "tmpfs" + mountoptions: + [ + "defaults", + "noatime", + "nosuid", + "nodev", + "noexec", + "mode=1777", + "size=512M", + ] +volumegroups: + - name: "vg00" + devices: + - "/dev/nvmne0n1" + - "/dev/nvmne0n2" +logicalvolumes: + - name: "varlib" + volumegroup: "vg00" + size: 200 + lvmtype: "striped" +disks: + - device: "/dev/sda" + wipeonreinstall: true + partitions: + - number: 1 + label: "efi" + size: 500 + gpttype: "ef00" + - number: 2 + label: "root" + size: 5000 + gpttype: "8300" + - device: "/dev/nvmne0n1" + wipeonreinstall: false + - device: "/dev/nvmne0n2" + wipeonreinstall: false +``` + +## Components which requires modifications + +- metal-hammer: + - change implementation from build in hard coded logic + - move logic to create fstab from install.sh to metal-hammer +- metal-api: + - new endpoint `filesystemlayouts` + - add optional spec of `filesystemlayout` during `allocation` with validation if given `filesystemlayout` is possible on given size. + - add `allocation.filesystemlayout` in the response, based on either the specified `filesystemlayout` or the calculated one. + - implement `filesystemlayouts` validation for: + - matching to disks in the size + - no overlapping with the sizes/imagefilter specified in `filesystemlayouts` + - all devices specified exists from top to bottom (fs -> disks -> device || fs -> raid -> devices) +- metalctl: + - implement `filesystemlayouts` +- metal-go: + - adopt api changes +- metal-images: + - install mdadm for raid support diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/filesystems.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/filesystems.drawio new file mode 100644 index 0000000..0f0c6ab --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/filesystems.drawio @@ -0,0 +1,43 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/filesystems.png b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP8/filesystems.png new file mode 100644 index 0000000000000000000000000000000000000000..6d903b7ec9c8c069383846912f136127e54a371a GIT binary patch literal 24073 zcmeFZby!u=x-L#hh|(!8>F#a`7bPK}z(SNxX;_4mQqoJ17DPZ05hO&qI|Uaa-67r5 z^&89BXP>?I+4ubJJ@@YO$9W!}^{hFWbIdWm`He5$@BLPoriRkh%hxWWp`l$>QHE-x zpqhg(zfK4W^8GqtXklJGhP0zdvc_=-^;s2LE>#nz*<)di?v#EFJBBukrU_PGA}T?k3cUyJjYK ze}7ib#vE?_`&xbx@n6e8U9N0lV`csO(P9F>C1r2&=i=WhakVxvcl7vm|IbrD<>un( z2<}w)`ATkC*r8pRS{w8`uE?B6dLL z@}@vuB37txU`%rhcktiNecgsBnAH*|CJ;K{*fd_{tG1edn^2v%4wSb z?H1sJTDaQ)?fH+zXm9@e@&7_46yp0mhd-w4ABc|s&$+)=!v6}ZQFmOY=3t0f3?7V+vC5|HBA#2xDDLK(czyhyKIf97y(GEL_pQF?>RQ_UvB?SN#8$KK@?*U&$6_`2M*_UClwr@*j%S z)!gh~F4Di#*MA_=Kd1i7x47W1<^PpP|6&^dmva4Qx(WpQuQ#3|e`7rVk+S|@GoC_! zC)xjuvVsWcpC~H`i~hy?|8E1Ie`H+$uPN*AeDQxrS^ueFbv3v6*DLE^l=HWz|3{Mj zFH%3z;>cSE%T~h! z@Q5)P0;sh3&{!hh4PANn)KpQfAUp}zl8lTLyN9ha2pwxd&=`^Aiou9YMDB`pkL+lu z+B$ce-kH;X(pQ-oSWY^Yh$O+^k!&nT(KL4h1ZzEb33-4mjR@D2w*% z5K0HZAb~79>9RA>VW9q^AA{rMO$>}*hjbXrMA1viAtkqoe?8p4hctSr!-tXx?ay37 zoRqoDMkIPfv%8A+U;P z`1yP~jAT}De8fYC_Gd-}=wS%BSRUE$2X;t-;~o!m^xxv}hvO>4vzqm@|2*(Jo-*9L z4j=c|^Z!Q#Kra7zEhwV$ufI4S<1QW0E^wHrLQo=A*GEfT@4i)Y?&htpIhhV59FL?H ze6TrLJMqcpt9FLx{)koe{`y$;g!>qG%+C4IBJEI>o9)5=m}50_0*t|h+R(2#gwVtH z_y@m6;zRf3Vj4lqNCU6s>?o7DwkXEL>?=SCGKr&?Lfh_mM93nsq>$SqRXr3*pVf^!TBV z7OEcWr9)Nmy7xO@J^r5TuruFjDXs6j_s!n)$$X5`xZBXf#k42qkE_pj`(!)}9BWH` zk6yd>ibp(@F=@i`I9|@F79NB(KXm;p?6COCgMiDim0S`# zweMipwD@C+g4{F>@ddK-IfP`DMw@AV$2J~d5Q%(lLYdQ| zleyypC?XP6E{9Ph32e(c!-qg8=N$t><%j@?`>tlw~`*;drc z(SUe#GA9mW`D|1!R@s-0wE1qgQaXTB@Wt0p>c(8Uxz&Y)YzKR!kLF_?-b9HApl=Tu zJ*j;2{HDa>p7&aD$gY7zKo^aqd%pBkcB0`5LV6$O@l{zf;gVEO)TS)J~@8)Qfs={=urUUTR__n=+bZWi!)TE-Wi}x2O!6UB;ch&Cp zO0pCjRwvSCGAP4So!h8cMBd(c?XXY-UVXvi-R}yeDGns)#B3<*v%Ln-!G$ttMrNBG zOn8)smB
xw+)D(Mjrp)Vmc+ZeAb<7x_eF6=MlG%YLYI4L!@ShPQCJLX3mr2J*i z4@rFQMiVY_d(wNeQh4aWSLyS^xec%YcgNbjg!nKto6%3X`s$})tHq|q8L$ec3|nMo zFpa1~s)756#lswpS8AX5*i5+T@0>@)e-EMc<8uyJq9cS7cD|;ih^9mGd+*x~6`9nRyZ-FdhKI`4MZ*{0oB=sC@Sc= zXt$eHVtCHKh9R-c-PfwyKWK)pb%Yi+UO;{4=81<%8(B=Ud-5|)Pv)&T`mHaV{zOx5|?hcUgA z$|r3NMXZ;N^`?bMvt45@`lpGM1I}ou+Vt1hJ0iXUyjVrM7wo zEVI-qf>yn7oa;_c@d#ETN-cgYAz3sFs#e}}s4DH9?t~#25n@fwXMHjkc6%x-=7_3t zARs^BMOWwMQOK{oTvy?LF2KOQv_=ycn)2j9qlyI^f#EZN8($8-MnnAD6waf-3^+!TKK z)bxAc_1so4TnPW|g4=+HG|z9;dHCCfvXKK9svVBjuQT73jb|i zglzm$2dwrluad~0gy=BQ)nTS77++Nr{+Ke1fi!V;O!+k2Dn~L9@10SuN2u%q$(Nnm zX=PuhDL$A*7zz1RNs6NHaqe9qe)j;pcoIn1o}oHHSjJ~~+lpSYgP%@a6WC13aHhdv zVR5EsB44TVj4Y~-bdD~A(2O1#1EU zs`yyvZHiHRq0_Iy-Aw*x@c)!pvKS;pCOyp#kV>?bAarVS5`Hw$0eL(hv(Y2i2X|W? zbStdge<`_?9yksnoa>>xAG>*6X??c*K}4nYsAKNhc-_UhclpZuyehA~m64Lz%}043 zz8~+e+sc^qv%dD3#U{M52AoEjLdB)Cn`)EJMl_W56|Xt<{0_!lpRW#nNHKW45TAE` z3T#=$L-&!^s2kFw-1VnB{?B6yFF^QngxIg&>EfiUyeO#Na6y^Gy(j%IRC$)mru@7; zP(g$H`Y5^1g8by0OaY#f6pmb@cxnmnR1nH_w;>;TOb92m&rKNHIgEa?SvvKUsXITm zMa5mZ6OvZF*N3uHNDr3YJg@ptKIs)Bbuj7ec(D28VhngEUMu~|9sD!RDtax9+%N)( zTZ_G~J_x8qhd|tuZbkB?Uu?J2ZsZl#xvb`wXndf6puCWQb1V4=gk#;&TXk!X$;UZk z_T>|o9p-`L#$UM&>TiGm<$jRCmreX$F@Jnc8y8u4gBzHa4wE%6_IFG|sV}d*R&xD= zcJ`)xG6U;t_XZ6THeWwEUv{Wmpb#}~Ks#uoajZZEQSb<|og2ZupRPE*%ktBCc4$fo z@zE4;XH0E=OBdrb?%ZB^w7WQVI-Sj1ci2?==v$XB2$FT?toL@9B$~=(kB1VWa7}dy z4#-l9W1aJB-+le~>_E8-Ac-=9_Qdaatf|vp`)kXm35c2IkZNK^#R{bxk6Xx`wb=_A zKbOD{6>$1c{;axof3*AF2?(9nZ}=UWkdmA}0P*X7dB&}fs>L+#UY6!E`>`qzQGWUS zQn=e~Z5a8=XQ#6b<=kEEM?dMW9l#Lh=O>QUh{9(QZYves<>UQzReCU!OWw}UK_DmU zwsKF@tnJEBwTB}roNa$5$m3Tmt(g|-5{9@Vb2fkq$qSxboVQ`GVx4UPKkhQ+d+@4Q zaxPMkqFC&6ifEtT#cTv`m5#1{s~=UgtG>i(X0!LFTLj`QT>cN9^JP1p9%oAtM*KiV5ik`#mqCB{7sYix3v9MBI8cC4o)`f zt8e-q55opPFm_^W?gOIml+Tx!^d%G#*O!5Z=OCqnxf1tBBIV``qLq!+#w=6p*UaFR z3kiZ4Fm$jlR7D>Ruu=X#69terw9=90X}bYtnOPmOQ4BSy%cG zx98Sh%1q zP_7GS$X&tMhys* zMIK9?td-~_5Y&rLI4*BpoCo0Z@a1((cud*zLSk9v=Yi&aaw)8sz3efdr9{1YRb;r~ zY^#}2hxhS-9zBnr*6TOXC&ZAG_43zwM)h^uCjHNFNTqZMMk5ypu`^1C49B3OUaKFh z0-mDx8{9B=^1V1am@13g_tMblC0R{le@i=gzM>#W^A4ibDYZkNtw@StVd)ja?l+ zO{sy_UNgaz;{liOACy>rwo82_=}~YNb)n?ca4Cg7;^s=%@;}>Qon1&t4msLi)QkcE={Zpo}RrC1JT0 zgsFN5SlAl%b2W|{Xw8qwEFvbJ06!28d!Jxfa>qf_xTqV5k=q;9n^oUGr;JS9@W*8lpZZ&fKCCZGLk`G9@tH(iJ627i&m z7etsah0Ej+ScNBR(W5UH#5WC(j}~9s(^>HuCdu%!nG72~< z@jJuA$36S(xNIERB#~r0_3+DK!X3C;su;2hWYbn_jIqT;=+T?vM-?1U_!hx-KGRLR z5vAGMH@L(r4b^>0BiC&6wOZ%K9P5R*{rR*w5VBxv#71Tpq2DiIcmAj~2+Q z%Jx8YvF+4t)Fx--1-{X_N=gv$dI1S~H7vKxi^7OWY2Qk+h>Aq)TY0@ z8ca6KHtO9-Ai$>2zhQWx056go9jg!WoUtv`MEZ9qS{HqKW)YAr#QQl-dQ7D1<58TS zTpg^f$cYYqN>M-nk*K&uC_Uh(e5HlyT)ht0o5bkD0P$U~?5x`>dJ7#w%J45C!v-xl zX^B*3`c=)>!b>q%xx%(X&%aYbJjR_v@a{X(Vq-j8AZpu9-{yY3Bulg_H*X{{FWr5R z3X=y~Ws&3&q<%Wz>fP+!Llr{RUNsX&knpM2%R4jhAk7{PHd-6xDeu(LujSLn6SkC& zq(0@t-?dnzVsy=j0fuB4;$koDK_+H# zyO&6}0qiZ+JJ>T*eGJaP@(2EWTTmQKK^nQ4&m>nZt%HozGXrh)bJ{o*su`J!g#5wAgndoJXjrJR4Y5{KeBg7LHnt!MZEm63_L0mClF z*r9LmZobLRmC|bWGO8NFDO^7Q#eqC)934wwh1g;TL;TqtUD zq33&;RqfZ!zp#EExe=5ki-IDi05 zbn!%Dyl8Hn`I6;9R-3u(qYrr#$goZJg<^&ynk}`CC2dDxnx2j|s9e_eF1GoL3+YT+ z^6sJ2cvfVKA&Q|k$&!OxS zGyRn3^7(~6Xr?BXO;$Dpt87N6b}I*tObfnSSo^>S+ic>PJ^pgormeBZSmKue;~4IC z2C!I4cB`sf-!dgXSKk)FRvkkXHE;0`3JwXPJ(!E9;_>yP2Obk{`)M5Hcj(BGTBmdI z`x;jrkcWTCQu2OyV;dc%GMFS&$TbPj>7qH_xqo~oi-a>CB*ke7sFcRw=fwt@Zyp?@ z(c~1%mPoa0Pxnf0+EH9hkc@-UT|o~c2t)9lF%OiIKr)<`XE8upM2>qqF-(@4Bzg(J z+xZ5MT$HcazZKN2?}G2WSW zBhY#sKQVXR%p3UDJcfhsdH6RjIdg7aqRh*kOzmr@CvcX`%zAg48TYECc41&DZ>Vo7 zXKS*9_}29&#DzE)v}ri~OchzLtn63yRCYNR{b))zf*=j6A1Q?d*M^e{eJ-{QHeq}l z_)gs$;uI0br}{NAFP73X#6uoVFx%Zj`WIsMDwA%#|3c=*(5Isj*T`)I$-K$Q5U@K} zIevBVy%JFQ5ZekY7Dv-(L{E8chd1%wu2h*Y&^VJ;hEKo7%s?a>FnpW!MyKU5M9a$> z&PsMf&7|blOgwQcdv>IJ!p(|ZKLRRe z{K-O$(-;{MmLC8(DndW|=~`K+Qr4{nqm;p_6sky`)9BAGkuFpXQ=S-$+uaY>Lbl~Q@xzkHD6~=ndHva zGxgg_f+0b8HVoUwA5Evkc1_JydZ8q7)te!+S&5@d>ZF^LzV`!s=|#*!4B zl0HDsC{s$Xje}e<-5M!}LvKuQm5NNCbg0sV(W2kk$+g!Uq$782A7E?bW2TiWj_1r} z6Y!?M30U+t8e6&R&I1{)Q9PS}q6g$uBcXYbZq@qAL6hv(_yx(2t6$mnnwUju_+xhk z==Pl+ex48TQ0?u#%VKyx%%b^%G&&3~TwtpuWU0ZP|KbiEBguORzXwu*Qb#BC)R+Ug zU0)Zi_+-i?1kzJI2lAvxvoFfz;nSZf38O2LSl(WqgajTBgc38VY3>-27&;Ks{K&q& zBk^+cVbqS{GYBTf*|E^EeTs5;|EEQVGTBQ|A-Ai9sydql(p=WyJAK z4almoA!OKC`)YW8r!WxJP6wN5-4EDnvsy%hTv8vE(@_;`Kdao6ngz;&<|v^8-(+(j zsliAyBxg8eoNB37g3lR8nv=&ZFq2A~b=-upf(Wf9PEB5H*#JdUOuH=bBjWi^b*wAz%g!#K(pF9SD&sx22Ups?1KV3?XqHZDn=ELl@{tQhn z^lSOf9{ceVH)JEFqy5N`)|xl<{#oJGp`34ycy!8K6al&T{=PgfrCL(b6BPzSmyn7-X4yM~msz7t{<_G2X|M;D87Ghh2NRyYY{ zO|M~e`sy>e7-8pl8WC-l#=Io+5zblPT;khFFp8wF1UC3@{uX8ytmj=K% zW(2=SO9NI+K#G)9h8we+sO|M%=FB&qtDyW)T{PIap`!p2A<|djXxdrn9WSvS;nT2_ ze!U*ciSDJ@!e-6l9I(#EFOVT%L!umkp0GfPt)J=h@k%3{&D_R&bhAvpxyfm4Zv2^)f2OIWB zv%ORimsejHzQ{I1roGU8k~1I=#R+uMd@XPHF($6zfzM-sBoI~+_CfZg*~(WVe0jS+ z+)$CZ^YSdA%6QK*)l&ZwC$>CgHz%zjSKytOLY<~%MW>?P`)dkNrMiw{ANVDOE=wuK z6%p0v=fyFLo#bKSYS2wOq+GJkIKWw|bVWrzlBnzD@?iiWuyAn^B<-slG1xwfit8Mu zCC#Grjg^a4iM}ccx9(~4seGIbA+aJ_UB z0(KPm&BL(ruo>QhY<)kIM29jDJM6Q+wD-Qy*Bfqg%+sDs`9+yqftTA!f}L)`=|(+O zXhiI+Rr#*hS`ba=-Opt7P|X>c!Y78nWPr9~%NNjBv92!Q67-CgGLxSe4kjE^-hVE1 z!rj-RL`3@%HncMM!S;ElrB}j(ng!E+w;q5$B)Fd?5ENVuzn;RYEkbO3v;+|_4^=SO zZ&Q4(wWr);!r+AyMzG&e>`dn0N7dENM>}*on3(N0oGig@!6>_t`#w$hA0RWYYl#}B zO^gYngq^o>bk|8~SbR&!uIsW6+wr;`hLBp%0GC^l*IS>$%b`ly2mXzLI4RjLzjB=x zG4-)?XRrMZ0uEH+|Jz`v$-{dxf4Bhu1APAf#e?sKAubn&+%WoGeSoH8;GX7Tq-i~e zC1X+WJg6uVcrDeKGnnWlR542#^?HNCUz=o$3zF@F9skf9K-Kfs2I?=75;cbkb2-%t z>2av?hf4i^A~!&*iM@FfmqH=A0%ZOJD5AhKiP%dj0Niew+-8y${5#`O@9>EP%eH~;XdXroZ6*Jfe%Q>&B z@Odie?rE7E26w?I0mp_3Bn6DlEy+A|?nrcXF4_rNsG`FczF12hWFsb>A1Fxk4iy^7c%TRtpo%;kge9YPcxu1&C1ZblAkTiROt(+J z#Ih0rk*oqp&`1RUa=i=GQ$!-pZgeBT%d#JmK3;lLpz%t=p_{uLu4ni-yI39#0^k~l zm4RG`wn*v%kIl&qpbMfRlAARpG-6KaV}R%|fr9Z+P*C+VFGnD_p9t$JK%y204IHJt z>i|h2*SNsskUTY)hYX!qIT&mcjwC??Wrj@5mse>-;C}%$q3y&<*G)(nW2btO1=sV= z!TlddATXsO0;#PAOp#7?;0#%oP~h%0wk5y9y#xaX@stV>I9|(@0}A&|0mn3aAx-*V z{A&wZ(=v)EfTC+~-yQea{p>K`5yOHYf`F2^%Vy0k!r)PE_IOF(O#_SNEnZb1_wy+; z{{{{hFqvxR#0ULBm;M&_v~3v!Xt;5v)!sKfQMpEGfD^=Sx2^b7&3oOP(IDf!DNE{n@^2UjE1M zFoa3-vt$dbj2Z54eC#DdfnhJn;PpeEH1?ljszHfn4gcot%YrsunV72q9!9Y&>T1@; zHgu@c0KrT{|5rdWag3Frz+DMp4m@MaqH`wxaROL2DQ;GqwFhMdt2GQe~`A&gb3ccVHSmabi*z;nWo?t0W6~fE?TIH z3Crj71@b~4sA9Rpgk5qrC{vZCHd<;Wa1lX_e71wDfgVSYK)8ZYq>TbV^l+CMAEr76 zq?VT*#&~a?=h}2K1D}}f8E@jN8XGnpZv$I0N|=y?;>BR$hJ7vqkhv46UpO=>H*ax@ z-F?UgNNSfs0Dh0psw{d~0f%%fBjm=)XsNB0D&zSA8jI1sfKyd)7~%{A?1w_{mE4^7 z8imG_i}P6BTriPgqb;CEFw9F6^#JW3yFuK7!(bUDJQzBV4p#CK+AhABYUV~G<5#2a zTjZyfEYMmD_zMvLSc^%Tp8}{is&&Bz0@j&N}#E^wKmGi2^~If-Z8R zh7Y?0@NEDn?lERp5=Fyj{PfHlltP4&o`9@D*&}qNK0xqWFsQxfqPTUJTrKg#6yU~D z#*B>Zmf`~4H=Y8%%19b|JwW`5VtyPC5HHjY&nDfYeeunO)B=ssn> z#lS>NVJQ@x*hudy7Y#JD^}J*6$++6rYs>BOI!E!7@6LYp4B|2H;d&^F0A7QI!)pDXFv&-eL zA~0WDz14)Tj`fvtS+wT4Nz0=beK|Gwpp2{~#`%ysP1YPqT-V{`afMo-g{9`Dk6{rq z<}Q^DZSqyUl%0x~j3p>&Q2)ga^XXeB^Mp<&wHHgcw>U3KORV}tW~6BCjYCp_6a*y! zb;DxZO+%GWHkIPqI-0T`_p7juJex>AdgYUh(eYwGHt=3~{%**Wz4^EuY1
s|)TRD0vGs2UKyg2w47<+D+~{>-Q++BdU4Bq^moVQKCMDk3 z=Ip~2VwdziRP2boRSCGBn+aVu&KMTF61S1oFNNM{QG$T>{nY2Q8~bv_k$46Pi%F*! zn-}MO3G{&obxID2B1Jk`F_+$txU5NH>TR210#U9q`{y<1$E)twQ?dtCc`93=J;2;s zsXC{A*)cGEKa_F2?Q~~tUSi|ng!~*OWKDFoQY^P^^4-PhqD&e4HJ;mlXmp+GU_LmM zAm%cp+>U7D9hx{SGMT+NsK2nUb4Y3#p^e)dhG%33nvI3x^#fLsBL!~0F^qC+sA=*> z0=NF`3=?UXFAc0gY`bNL)jM%GU9HKh?Yp^%2PhgIv*^C3CFGs21ogpTYmG_6CcGO* zC6p@cH$arO?R1Za1aj#BUH#>yH(if2K){!{>L9gO2b4@FMNt2kZb4FHJ&XYHq2$zm zih?AkQS8+`*rs;=rOl)eI{{0T7G4P=F*_ow+~6Qr@r1`PMB~a+qig%ghoq`PxJeJ% zn|Gx}S&NGbh`!=FH?wnU7;LA)L_8fxRJmYQMC!I5N_9`a2)=v+RZ^t6nf<7{KL+y? z%V+D_JExi3-EN{eRrfzxn;@n|Cg5K=68Db~>Hv$!OYtRC8-)=9ZlVcmV^b(W!rkGJ zMs31wcEE`&o*Mxy$dWVKRBe;aAYa+kw{m3Lj$P(QIaPOF`t*IiNuCfbHqmyIyXA^S z45iYx_~(*ux&|Zsjv~;zl-Y;Cj<>XHi*swFvmqO?1teG|InMA3<9#5-m3hNKuW=E0 zJA3z(cLu#{jcq5T&p*2a&(GDftYlH&3rV-){&B>oH)kAqHOTPZl+VF;v*^4JPM4p# z@`<1+s%RZ4uvd#rb)P7nIQ5K5Hl=P3e|qAGHHg2#j3IywB*r&^;U6+2mW4`L` z`C$PbOBoyTc|0|%@mk;|tZvLrbY$eVwZTL9y!S>JDeEZqAgbKNK=0~vz1<^}KqS7T zrsbSs@^K5^Bs_i=#MH#JstaVXOLQ(AwhiAz5enpxD^S3+++(mU6BfQ-8HVt23kAS2 zv8SU&5ib*{FpA~MU%$RH={{ypxr?WztnVCNRfI`9+o!yHxy z6c4Gwn^6=kr4>Hsj|JWQ;^(v_+%ju^?fs3GybqoTW+20yhdw6~t~MokNk2~nCCJ)j zyINUCPu5nhRbQRrI@PBFEYO`r&eTFWzvr@zr{QkFg*V3E3exXh*wxHY*X&L4#YgUB zYitP>5*($G6J`&Pu3k#nHEt8!4esFA*`%T~%B~Oz5$sI}jcvN4X+BJceKfiPBA((x z<(>l{9bFG7`7_9n;tXXO*TdI8S=paTQOxR+`?mq)l@-*?=7YV}Jh~1Ftz2($jXGg+ zd?mAbPuWViV(Bi!A{LTpXk!DPn5d27>hslMG_;+zE5lxbKI z9wIt4Lx}DlVk4zz4imY8&5!$t^Fo_y+Yz9JG2don_bB`?E|BS%9V>V$#JJoNPWM`{ z+OoPV3;Z#0bRS=bN)bgz*$%I7Jl72m4k~myZ=)0@Wwk9^dtv39(1I<#&$+eN7gJT~ zy7)5B%IDIS+jHv-sm+e-L(X=Dta7-J!B=>PiVR<_*-qPp6XYuzLXs*1)5xc=rE+8x zdjQ+jb~aFgzKG}n?o&M@-)|y4#kXiT4ux^UuS8s83zgF}P=Pb;Jz_T^ey0YENc@OH z{LVlI6z7DzNW_y=oRqqo&XCQ^y~3=M&Rn{ittEJiWFysitY=$PB;FZPJzjj9PrL*@ zN@Z}DvH`1?sb~9UP0UBhv|)z0MM{$E$tOGAyz20t*E02wNICiG#8{HvE^Q5=`;-01 zZ&7N@Af`E~nHSfa4OX(=UZZ>nkNFld7d$|SPn1BXUC>bkUB7BdG@uKnwex;OT;Vq# zA4Hg7g5G4IB@O(-BsprhQmsRxv5-Mr7G*?pF;{~dG}WRWEx z?GW%3FkZ(;If)rGh5HM4xZ-`@x!kR?1#Kuc4-O8*N&z&9DGhuqg=fLeM1kpLFP1t$ zuH+RV>i|T#LajoA%PbK(^|Te;S*~eE?h0W(F^r!GOAOzXVb1PmibArOzQA-I?P^G( zQ)%QJ?Y?g`s3y{xv0?cV5_NS*R<$L>KSsxp*wnV-1MZVbru7ogr0 zTFa{nZ$Su^UD4lQ;-hKG06}nBP)Hw5g8WEGYZ`aL5fQoAtm!fdveDTSkxtqWRjYg& z6*cK8rl5(6l=f+z<+<5bK5#*bh0QXlfpUk7?k20EK#g+}@PQB-yfTvY`I$rNfw1G` z_-QLqTokFc-Tpqw$*19@sHN$5l7mG3>2iT8bM+p#ngxZzgYlFK2YF(*#B*?c%fZvtt2!y~uIB=N#w#B&EACV-6pw^2k? zwev=ME_;Gbk?C~J^SQCZ#Ky7BES1=vsb0`=u=XR)2rdOu^#bpM4FV%Eu0kRC1z+c_w~kEJ;hf- zob+9GJU7DyXtIay4b~odHNGZ5>^Ti9F<26*@}%iK*ms+rCM2xzLpGM$DO=oP8!{!P zmtmk=jJVP5a%GULU>*5J$pXFm%h%g*^LNFnn%{m6AJrrfzVt4Rt;Fx=*yRHV?-AoJ zOHI>@>4ij1%plqZSH8_aZFdwMH|K+@*4HnYZ&Kg%d=DS*8qymkQ-H_W#*JLUrx?bT z?O9|JAu%mB)=TBk{W{C_9MMh(C_Y zP*AE=O#Vz+Sqi{}jL{qzQma?XGHg!(6I-Vlta#VwPz7LGX|hqcjEJ1nUk{ z+Cx15b{l5ZuiNxBW`-H+$Z#`53~Uhs2pUn1Oh&cEFQq63wK9BQ2b;%vPd*Ic@?0Q= z*Tt5qw>2E$f)G%hzt3={0fe6_cR!e!T4K$1~CRz6S)w*Kw2 zBAa-l{3YepqpsTP+nfg!{kvhZe4w1WhhPE^m`~4B5xk#B`V%9@je7xR%Dy~w{*hUN zNy2n<0ic46I?ouQuYqu4K-20Y9jc%_ELjIoLFM=i+$=?)X2Ju>T*|1b@jikVNi3;t z!G@6wc-qQW-B|E{ZTdOXroTrWF8c_@p1<{~Gl1#m@Q448hffbq&M)QQ{z)DuQl2(4 zWkh`?hssh2>3=cZEclq-iV(7T_VG_sRSU>Iz`E)te@vwUaVPKkzO_a;JlFBH1c! z8B{h_4ZYWeJ-*1{RDx~`u_6vskJHaKsU&_git6tu9wcCqxr1I0H_pNumtHADzaxv2 zldYL%vqo~u{?qf5&58GU1uHAx@~kXe{}+_qZ-whq_4Q+b4>PVIxgIB&V)W$f8^m+k zeQ#=@m-#zKJga`z)HPIsS=ftY)I3HfFM#3-~dXq_J%08EmjGhLj859ZHN zO%V_P6ATinfOIfx%&z>N1?l<1Dek{qG7@{?YiRe;;N1K{b+EjH8> z{S!4_-<)VU0jMG;lKB0>vMJCi7Z#%GrSy-moA*l}Eda(S%>iKC>gY=(*&%KoTZ=w9 z_i3l(kt)sCg4ka06|-WXRCF((mlJ5>~l77sLb|VZ@!EUUn_2}%DtOYMJ;GqF!7<3VJkA_<4Vew z1xf;w(q})u4z^2mL(Ztq38jBTqi|d`wFZPwk*U<-bfCLqcLMhWC|uZHDgLM_nidhH z-~^iU+%G^7y5UfFWSK`8wx3ZWy+6#z>a8zvdE-TuCKfbZ4HqDr?+id=&jgs_VuHS9 z@_V`CP)0;iSj;batsJHO(_qU6!knFEbpR7$yP?XmbJCNGD3Q^Q1Z$Xk#)qO_q(i6( zNqq>uX|Fc|g#!WUnXz0mR+)I$4HDmV!zX8Mwm21%``*4woCAFNjr>Zb$4BIo#WVtl4*=Rm%EI)(Kf15)QZv1d-!?r&wOdaME6?^mI z)HTG(czGF6R?9nIcSaubCks%=1hgo8*&Hi(bTn!L+{N;VJ81(DL@2^z%6AAA?4GyP zvrm;s@n^&yLX4Jxb;u}H87g?Fj_bJ$$l`+N%f88!O{GMt?SSG7@Sw`MPS)3OK1Olcq`gshGGLK@_K>W^3Q%Ch8N8v^iX?cmeQ zc%`d)7Q>b`KCe39#~up~7ClhOd=owS&KCI2t}t1^U+#2_;4Ulb#OMxu!pI(rNr8s# zo1j@iq1BkU4{B+asyseNjQ6Qdsh5heJ=urO(!^g{;MQ&E-wb^L`UcOXA?F{7sqNBQ zf~G(tZpyt8uC7Gh%)r72YMZS9e3DNROD0lrn!`T^bv2=wMiMmuK;=PkF4|TaCn@XF zYlHRz!(P*J-9d3s)!Udvngt$zc$_f1h|BP ziEXttNWiZQ2B3Zy020cR&xNbXVw#VQ%b37iB;eUij*EE*PWN;e_jav*W~0PYv^*8K z6L*SPF+n3Oy&P=~C=!0?>-Qk;=JG8j#3U{TjVA`BMxHa5yl+0KcA_;6TcFl(biNjP zCWd=u^r^cUd+wdrHwSqJa7@%*PogMWj{^AU9b0f`N$Gn(65=(=O__-E=)K5(^W{eF zDoVwIWw|mjZLwmpFnNt!)yV9!%wCPkC^O;?;~s-tf2{P%7q!&$s4N%;%&OhISC7y3 zL=F4Oq}%~!Y*;`iQwJFY+cOoQnq+sS0|KuGO>S$l2&palsp2Hiv)uVvSrG2TK1=&b zwH9oAbm^`%DGTX8sw%|tsiL8(3hF&uic}xvV#A&Gf{tkVTXs!(or{-@I`Rv1e9c9ck6B}6lq{34 z7c&8xQ(P)fB|x8VNh?wzDLCftJMnuf5+%UIcOc0YNBEqfh@Qa!MLiH*W4*_Xt6iGT zqac-8otT`AT3K&@DQ2{IUQ4SrDuy4+l7O)f#ae&Th|%Oi(bQ5xM%E>Se|p&>W>q2~ zxM&oRX5)&!6h*f5-_?AP&3K!0$q)o1+C*&LNUh6kf9e63YXJ>bQyW#POn(5f%z0}( z6qJzzpbWjG2@*)~i+n;fURZz^QQ{rjK43MK1hZAVLpN_<{(g}X+LJB!rA<}`FmSW{ zBtO~0PcQZ`E)JxcIev+E;M028as*FiTL2|>S-lGMxu%PtaLO&gr+Qkc&I=Ly)FNIv zluK7Pv&8W6!|OWr#0ZkN8p32}lJc#Vr$bpMg|?lamM}8}l0bRv!U54t>T}+$FD0hS z4Y%0$TD<&IoNH`$@>}MolQ;}@Rj$8kDHWeobS4WvQ1=U9Xr7h0p(Rf}uO#W2Krr4n zR}ntUdwTU|iw^xc9w~Egh0|?aL?+`0KO9jmGFYsWKO!5~h`OcEAJRBc!D2K<@|Xh0 zqvbxmQyNrhSX6TekP!xSF)|czVo3%HY>)Sqb0JhIN%YPT zXiXk)N38*q$23qym~E7GC@5+Y&l&@ij5~*(6fC7cX9%( zrFl?sz%r1jnOdJ18>()3>$7BM?HzkP~wvNYUFqI)~!>4bSJp za7V@7*#qFB#->Ua=$|c?JRqZS8ryGS&!k(whHhV>sf|t7Q~S6^PQMUdr(#E(@UUj5 zlE7pefT=H+=u)MMC2E3B;0gC@l=Ff`9EvlWjc~BEfx0+PR}Oz#X6`vyi^;HSN+o^s zJu`ymqXp%-rJ3|>9`OlB zxdz2iWrT&ik3giC#V@h_;Qr|k^_hrn!;28=PMovu(E*vhBrV)_KQx*~1uIE%1=)^S z3clcNv{p&{#DZ~?%4?cFUhZbc;x_BIa%Dm)H@`Ji2&pGPwY5!JF)Lmf#18P+BCLC- zZ)j4&K6s@CU9RJBg{AS?(i^O+_yAdFyA{_!n7EAsl07p6nOXDMVIf7~L>)c0s$Fb) z$Qa%FKsox%!0g0yKVW9|?Z55;%cIW#rubuHVoW}@Bqk<~chqWl=@s!j$;b#rPD^g67PThIlIzVvTR7LF%!={PF=Wp@E!F%vig^}t-Bsa%RhfT1i%%~ z0W?G~2<)w!EDA#YQq3%JnK}EHU;Tw-_-dh$3~|A@KR=rj3hn^}GN0Pzdh!1wID?E? zA|UhCF=izB$+%n$G;k+^@uU4-%^QuE3uIS?)uJmaGBXtyCpFRYmXx)%QIe&|xDB*!CdfJ;_j zhY>s&*aU=-?{NiMZxkt5Lp&u~TEis48r1I{fpDKm9aJ4>6eQONa%1tsAKixb0^&ll zm8LdG**;T~6TI8X?JAEyef7>tQNNn2+S+3uckyJP;`F$C9;Y4-G~0^ zYaVg>Edu^4p)0H0O3y{eTo-#wmuf(s^iKXR*mdd!!7YaL zpM2}sNm2Z#LwJ#o!l~%IIQ)xO zh6*>2e=M6JjrGszibI~tT47>e;lo$jQ_h^Iaw|E5fS%~AbtIkB7@)z~5?hXBDKY6{ z5jHN?eA#>;=y&Ql1llV}MIKhWyMe~e+v@Nv@~fpuY&Ec_M2{x1l@i_@Uf_|kfB;Q7 zf|KqtG2|$-hXGsPFYDrKVXPVnM5SM65|}R)B2evmuOzwPACUQyg#FvtTIk42qK%|| zyw4h@eeHm0Xk|2(l%5Ba=(fM`JfQA)j87GtDOK0K?I?p-m-X97o|yzjb-$EGyhnhzRm0*+gq zZhhDNGY>d8D!SYVc$$buBe2YxcjPY+p#3GUv(L%%C1@E~5%B0O&`53k6yQj0<~bhV5H94PE|4CeM120Qe7~VJTq~wF kXa6SPfTYKS1OJ)lrK(Ngo9!I|JmQ_f)78&qol`;+05laSKmY&$ literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/README.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/README.md new file mode 100644 index 0000000..a8cae83 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/README.md @@ -0,0 +1,132 @@ +--- +slug: /MEP-9-no-open-ports-to-the-data-center +title: MEP-9 +sidebar_position: 9 +--- + +# No Open Ports To the Data Center + +Our metal-stack partitions typically have open ports for metal-stack native services, these are: + +- SSH port on the firewalls +- bmc-reverse-proxy for serial console access through the metal-console + +These open ports are potential security risks. For example, while SSH access is possible only with private key it's still vulnerable to DoS attack. + +Therefore, we want to get rid off these open ports to reduce the attack surface to the data center. + +## Requirements + +- Access to firewall SSH only via VPN +- Easy to update VPN components + +As a next step, we can also consider joining the management servers to the VPN mesh, which would replace typical WireGuard setups for operators to enter resources inside the partition. + +## High Level Design + +[](./architecture.svg) + +> Simplified drawing showing old vs. new architecture. + +### Concerns + +There's few concerns when using WireGuard for implementing VPN: + +1. WireGuard doesn't implement dynamic cipher substitution. Which is important in case one of the crypto methods, used by WireGuard will be broken. The only possible solution for that will be to update WireGuard to a fixed version. +2. Coordination server(Headscale) is a single point of failure. In case it fails, it potentially can disconnect existing members of the network, as WireGuard can't manage dynamic IPs by itself. +3. Headscale is already falls behind Tailscale coordination server implementation. Which can complicate the upgrade to newer version of Tailscale client in case of emergency. + +### Solutions to concerns + +1. Tailscale node software is using userspace implementation of WireGuard -- `wireguard-go`. One of the options is to inject Tailscale client into `metalctl`. And make it available as `metalctl vpn` or similar command. It should be possible to do as `tailscale` node is already available as open sourced Go pkg. That would allow us to control, what version of Tailscale users are using and in case of any critical changes to enforce them to update `metalctl` to use VPN functionality. +2. Would it be a considerable risk? We could look into `wg-dynamic` project to cover this problem. +3. At the moment, repository looks well maintained and the metal-stack team already contributes to it. + +## Implementation Details + +### metal-roles + +`metal-roles` will be responsible for deployment of `headscale` server(via new `headscale` role). It also should provide sufficient config to `metal-api` so it establishes connection with `headscale` gRPC server. + +### New `metalctl` commands + +`metalctl` will be responsible for client-side implementation of this MEP. Specifically, it's by using `metalctl` user expected to connect to firewalls. + +- `metalctl vpn` -- section for VPN related commands: + - `metalctl vpn get key [vpn name] --namespace [namespace name]` -- returns auth key to be used with `tailscale` client for establishing connection. + +Extend `metalctl firewall`: + +- `metalctl firewall ssh [ID]` -- connect to firewall via SSH. + +Extend `metalctl machine`: + +- `metalctl machine ssh [ID]` -- connect to machine via SSH. + +`metalctl` will be able to connect to firewall and machines by running `tailscale` in container. + +### metal-api + +Updates to `metal-api` should be made, so that it's able to add firewalls to VPNs. There should be one Tailscale namespace per project. So if multiple firewalls are created in single project, they will join the same namespace. + +Two new flags should be introduced to connect `metal-api` to `headscale` gRPC server: + +- `headscale-addr` -- specifies address of Headscale grpc API. +- `headscale-api-key` -- specifies temporary API key to connect to Headscale. It should be replaced and then rotated by `metal-api`. + +If `metal-api` initialized with `headscale` connection it should automatically join all created firewalls to VPN. + +Add new endpoint, that will be used by `metalctl` to connect to VPN: + +- `/v1/vpn GET` -- requests auth key from `headscale` server. + +### metal-hammer + +`metal-hammer` acts as an intermediary for machine configuration between `metal-api` and machine's image. Specifically it writes to `/etc/metal/install.yaml` file, data from which later will be used by image's `install.sh` file. + +To implement VPN support we have to add authentication key and VPN server address to `install.yaml` file. This key will be used to join machine to a VPN. + +### metal-images + +Images `install.sh` script have to be updated to work with authentication key and VPN server address, provided in `install.yaml` file. If this key is present, machine should connect to VPN. + +### metal-networker + +`metal-networker` also have to know if VPN was configured. In that case we need to disable public access to SSH and allow all(?) traffic from WireGuard interface. + +### firewall-controller + +`firewall-controller` have to monitor changes in `Firewall` resource and keep `tailscaled` version up-to-date. + +### Resources + +Update `Firewall` resource to include desired/actual `tailscale` version: + +``` +Firewall: + Spec: + tailscale: + Version: Minimal version + ... + Status: + ... + VPN: + Status: Boolean field + tailscale: + Version: Actual version + ... +``` + +### bmc-reverse-proxy + +TODO + +## References + +1. [WireGuard: Next Generation Secure Network Tunnel](https://www.youtube.com/watch?v=88GyLoZbDNw) +2. [How Tailscale works](https://tailscale.com/blog/how-tailscale-works) +3. [Tailscale is officially SOC 2 compliant](https://tailscale.com/blog/soc2) +4. [Why not Wireguard](https://www.ipfire.org/blog/why-not-wireguard) +5. [Wireguard: Known Limitations](https://www.wireguard.com/known-limitations/) +6. [Wireguard: Things That Might Be Accomplished](https://www.wireguard.com/todo/) +7. [Headscale: Tailscale control protocol v2](https://github.com/juanfont/headscale/issues/526) diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/architecture.drawio b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/architecture.drawio new file mode 100644 index 0000000..adb0921 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/architecture.drawio @@ -0,0 +1,324 @@ + + + + + + + +
+
+
+ Metal Control Plane +
+
+
+ + + Metal Control Plane + + + + + + + +
+
+
+ metal-stack +
+ Partition +
+
+
+ + + metal-stack... + + + + + + + +
+
+
+ firewall +
+
+
+ + + firewall + + + + + + + + +
+
+
+ machine +
+
+
+ + + machine + + + + + + + +
+
+
+ ssh +
+
+
+ + + ssh + + + + + + + +
+
+
+ bmc-proxy +
+
+
+ + + bmc-proxy + + + + + + + + + + + + + +
+
+
+ Metal Control Plane +
+
+
+ + + Metal Control Plane + + + + + + + +
+
+
+ metal-stack +
+ Partition +
+
+
+ + + metal-stack... + + + + + + + +
+
+
+ firewall +
+
+
+ + + firewall + + + + + + + + +
+
+
+ machine +
+
+
+ + + machine + + + + + + + +
+
+
+ ssh +
+
+
+ + + ssh + + + + + + + + + +
+
+
+ bmc-proxy +
+
+
+ + + bmc-proxy + + + + + + + +
+
+
+ headscale +
+
+
+ + + headscale + + + + + + + + + + + + + +
+
+
+ tailscaled +
+
+
+ + + tailscaled + + + + + + + + + +
+
+
+ tailscaled +
+
+
+ + + tailscaled + + + + + + + +
+
+
+ Internet +
+
+
+ + + Internet + + + + + + + +
+
+
+ Internet +
+
+
+ + + Internet + + + + + + + + + Viewer does not support full SVG 1.1 + + + + diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/architecture.svg b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/architecture.svg new file mode 100644 index 0000000..fd268d2 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/MEP9/architecture.svg @@ -0,0 +1 @@ +
Metal Control Plane
Metal Control Plane
metal-stack
Partition
metal-stack...
firewall
firewall
machine
machine
ssh
ssh
bmc-proxy
bmc-proxy
Metal Control Plane
Metal Control Plane
metal-stack
Partition
metal-stack...
firewall
firewall
machine
machine
ssh
ssh
bmc-proxy
bmc-proxy
headscale
headscale
tailscaled
tailscaled
tailscaled
tailscaled
Internet
Internet
Internet
InternetText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/_category_.json b/versioned_docs/version-v0.22.4/contributing/01-Proposals/_category_.json new file mode 100644 index 0000000..2e7fa4b --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/_category_.json @@ -0,0 +1,4 @@ +{ + "position": 1, + "label": "Enhancement Proposals" +} \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/contributing/01-Proposals/index.md b/versioned_docs/version-v0.22.4/contributing/01-Proposals/index.md new file mode 100644 index 0000000..0f6eddc --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/01-Proposals/index.md @@ -0,0 +1,69 @@ +--- +slug: /enhancement-proposals +title: Enhancement Proposals +sidebar_position: 1 +--- + +# Metal Stack Enhancement Proposals (MEPs) + +This section contains proposals which address substantial modifications to metal-stack. + +Every proposal has a short name which starts with _MEP_ followed by an incremental, unique number. Proposals should be raised as pull requests in the [website](https://github.com/metal-stack/website) repository and can be discussed in Github issues. + +The list of proposals and their current state is listed in the table below. + +Possible states are: + +- `In Discussion` +- `Accepted` +- `Declined` +- `In Progress` +- `Completed` +- `Aborted` + +Once a proposal was accepted, an issue should be raised and the implementation should be done in a separate PR. + +| Name | Description | State | Progress | +| :------------------------------------------------------------- | :--------------------------------------------- | :-------------: | :----------------------------------------------------------------: | +| [MEP-1](MEP1/README.md) | Distributed Control Plane Deployment | `Declined` | | +| [MEP-2](MEP2/README.md) | Two Factor Authentication | `Aborted` | | +| [MEP-3](MEP3/README.md) | Machine Re-Installation to preserve local data | `Completed` | | +| [MEP-4](MEP4/README.md) | Multi-tenancy for the metal-api | `In Progress` | [releases#236](https://github.com/metal-stack/releases/issues/236) | +| [MEP-5](MEP5/README.md) | Shared Networks | `Completed` | | +| [MEP-6](MEP6/README.md) | DMZ Networks | `Completed` | | +| [MEP-7](https://github.com/metal-stack/docs-archive/pull/51) | Passing environment variables to machines | `Declined` | | +| [MEP-8](MEP8/README.md) | Configurable Filesystemlayout | `Completed` | | +| [MEP-9](MEP9/README.md) | No Open Ports To the Data Center | `Completed` | | +| [MEP-10](MEP10/README.md) | SONiC Support | `Completed` | | +| [MEP-11](MEP11/README.md) | Auditing of metal-stack resources | `Completed` | | +| [MEP-12](MEP12/README.md) | Rack Spreading | `Completed` | | +| [MEP-13](MEP13/README.md) | IPv6 | `Completed` | | +| [MEP-14](MEP14/README.md) | Independence from external sources | `Completed` | | +| [MEP-15](https://github.com/metal-stack/docs-archive/pull/232) | HAL Improvements | `In Discussion` | [releases#238](https://github.com/metal-stack/releases/issues/238) | +| [MEP-16](MEP16/README.md) | Firewall Support for Cluster API Provider | `Accepted` | [releases#237](https://github.com/metal-stack/releases/issues/237) | +| [MEP-17](MEP17/README.md) | Global Network View | `In Discussion` | | +| [MEP-18](MEP18/README.md) | Autonomous Control Plane | `In Discussion` | | + +## Proposal Process + +1. Before starting a new proposal, it is advised to have a quick chat with one of the maintainers. +2. Create a draft pull request in the [website](https://github.com/metal-stack/website) repository with your proposal. Your proposal doesn't have to be finished at this point. +3. Share the PR in the [metal-stack Slack](https://metal-stack.slack.com/) and invite maintainers to review it. +4. The review itself will probably take place in multiple iterations. Don't be discouraged if your proposal is not accepted right away. The goal is to reach consensus. +5. Once your proposal is accepted, create an umbrella issue in the relevant repository or when multiple repositories are involved in the [releases](https://github.com/metal-stack/releases). +6. Other issues should be created in different repositories and linked to the umbrella issue. +7. Unless stated otherwise, the proposer is responsible for the implementation of the proposal. + +## How to Write a Good MEP + +In the first section of your MEP, start with the current situation and the motivation for the change. Summarize your proposal briefly. + +Next follows the main part: describe your proposal in detail. Which parts of of metal-stack are affected? Are there API changes? If yes, describe them and provide examples here. +Try to think of side effects your proposal might have. Try to provide a view on how your proposal affects users of metal-stack. +Highlight breaking changes and think of a migration path for existing users. If your proposal affects multiple components, try to describe the interaction between them. + +After the main part of your proposal, feel free to add additional sections, e.g. about alternatives that were considered, non-goals or future possibilities. + +Depending on the complexity of your proposal, you might want to add a section about the implementation plan or roadmap. + +You can have a look at the existing MEPs for inspiration. As you will notice: not every MEP has the same structure. Feel free to structure your MEP in a way that makes sense for your proposal. diff --git a/versioned_docs/version-v0.22.4/contributing/02-planning-meetings.mdx b/versioned_docs/version-v0.22.4/contributing/02-planning-meetings.mdx new file mode 100644 index 0000000..df10177 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/02-planning-meetings.mdx @@ -0,0 +1,120 @@ +--- +slug: /planning-meetings +title: Planning Meetings +sidebar_position: 2 +--- + +# Planning Meetings + +Public planning meetings are held **biweekly** on **odd calendar weeks** from **14:00 to 14:30** (Berlin/Europe timezone) on Microsoft Teams. The purpose is to provide an overview of our current projects and priorities, as well as to discuss new topics and issues within the group. + +export function PlanningMeetingDatesTable() { + const today = new Date(); + const dayOfWeek = today.getDay(); + + let daysUntilMonday = 0; + switch (dayOfWeek) { + case 0: + daysUntilMonday = 1; + break; + case 1: + daysUntilMonday = 0; + break; + default: + daysUntilMonday = 8 - dayOfWeek; + } + + const nextMonday = new Date(); + nextMonday.setDate(nextMonday.getDate() + daysUntilMonday) + + let onejan = new Date(today.getFullYear(), 0, 1); + let week = Math.ceil((((nextMonday.getTime() - onejan.getTime()) / 86400000) + onejan.getDay() + 1) / 7); + + if (week % 2 === 0) { + nextMonday.setDate(nextMonday.getDate() + 7) + } + + const blacklist = [ + new Date('2025-12-29'), + ] + + const amount = 8 + const dates = []; + + for (let i = 0; i < amount; i++) { + const nextDate = new Date(nextMonday); + nextDate.setDate(nextDate.getDate() + (i * 14)) + + if (blacklist.find(item => {return item.toDateString() == nextDate.toDateString()}) !== undefined ) { + continue + } + + dates.push(nextDate.toDateString()) + } + + return ( + + + + + + + + + + {dates.map((date, index) => ( + + + + + + ))} + +
DateTimeLink
{date}14:00 – 14:30Join Link
+ ) +} + + + +Our [development planning board](https://github.com/orgs/metal-stack/projects/34) can be found on GitHub. + +[//]: <> (The C025PB1EUKC in the slack url references the #devs channel.) +If you want to get an invitation to the event, please drop us a line on our [Slack channel](https://metal-stack.slack.com/archives/C025PB1EUKC). + +Planning meetings are currently not recorded. The meetings are held either in English or German depending on the attendees. + +:::info +Note that anyone can contribute to metal-stack without participating in planning meetings. However, if you want to speed up the review process for your requirements, it might be helpful to attend the meetings. +::: + +## Agenda + +Here is the agenda that we generally want to follow in a planning meeting: + +- Possibility to bring up news that are interesting for every developer of the metal-stack org +- Check `Done` column and archive cards + - Attendees have the chance to briefly present achievements if they want +- Check the `In Progress` column and discuss whether these tasks are still worked on, there were significant blockers or they can be lower-prioritized +- Check new issues labelled with `triage` and prioritize them +- Allow attendees to bring up issues and prioritize them + - Attendees have the chance to briefly present these new issues + +## Idea Backlog + +The backlog contains ideas of what could become part of the roadmap in the future. The list is ordered alphabetically. Therefore, the order does not express the importance or weight of a backlog item. + +We incorporate community feedback into the roadmap. If you think that important points are missing in the backlog, please share your ideas with us. We have a Slack channel. Please check out [metal-stack.io](https://metal-stack.io) for contact information. + +:::danger +By no means this list is a promise of what is being worked on in the near future. It is just a summary of ideas that was agreed on to be "nice to have". It is up to the investors, maintainers and the community to choose topics from this list and to implement them or to remove them from the list. +::: + +- Add metal-stack to [Gardener conformance test grid](https://testgrid.k8s.io/gardener-all) +- Autoscaler for metal control plane components +- CI dashboard and public integration testing +- Improved release and deploy processes (GitOps, [Spinnaker](https://spinnaker.io/), [Flux](https://fluxcd.io/)) +- Machine internet without firewalls +- metal-stack dashboard (UI) +- Offer our metal-stack extensions as enterprise products (accounting, cluster-api, S3) (neither of them will ever be required for running metal-stack, they just add extra value for certain enterprises) +- Partition managed by Kubernetes (with Kubelets joining the control plane cluster) +- Public offering / demo playground diff --git a/versioned_docs/version-v0.22.4/contributing/03-contribution-guideline.md b/versioned_docs/version-v0.22.4/contributing/03-contribution-guideline.md new file mode 100644 index 0000000..2c0526e --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/03-contribution-guideline.md @@ -0,0 +1,145 @@ +--- +slug: /contribution-guideline +title: Contribution Guideline +sidebar_position: 3 +--- + +# Contribution Guideline + +This document describes the way we want to contribute code to the projects of metal-stack, which are hosted on [github.com/metal-stack](https://github.com/metal-stack). + +The document is meant to be understood as a general guideline for contributions, but not as burden to be placed on a developer. Use your best judgment when contributing code. Try to be as clean and precise as possible when writing code and try to make your code as maintainable and understandable as possible for other people. + +Even if it should go without saying, we live an open culture of discussion, in which everybody is welcome to participate. We treat every contribution with respect and objectiveness with the general aim to write software of quality. + +If you want, feel free to propose changes to this document in a pull request. + +## How Can I Contribute? + +Open a Github issue in the project you would like to contribute. Within the issue, your idea can be discussed. It is also possible to directly create a pull request when the set of changes is relatively small. + +When opening an issue please consider the following aspects: + +1. Create a meaningful issue describing the WHY? of your contribution. +1. Try to set appropriate labels to the issue. For example, attach the `triage` label to your issue if you want it to be discussed in the next [planning meeting](./02-planning-meetings.mdx). It might be useful to attend the meeting if you want to emphasize it being worked on. + +### Pull Requests + +The process described here has several goals: + +- Maintain quality +- Enable a sustainable system to review contributions +- Enable documented and reproducible addition of contributions + +1. Create a repository fork within the context of that issue. Members of the organization may work on the repository directly without a fork, which allows building development artifacts more easily. +1. Develop, document and test your contribution (try not to solve more than one issue in a single pull request). +1. Create a Draft Pull Request to the repository's main branch. +1. Create a meaningful description of the pull request or reference the related issue. The pull request template explains what the content should include, please read it. +1. Ask for merging your contribution by removing the draft marker. Repository maintainers (see [Code Ownership](#code-ownership)) are notified automatically, but you can also reach out to people directly on Slack if you want a review from a specific person. + +## General Objectives + +This section contains language-agnostic topics that all metal-stack projects are trying to follow. + +### Code Ownership + +The code base is owned by the entire team and every member is allowed to contribute changes to any of the projects. This is considered as collective code ownership[^1]. + +As a matter of fact, there are persons in a project, which already have experience with the sources. These are defined directly in the repository's [CODEOWNERS](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners) file. If you want to merge changes into the master branch, it is advisable to include code owners into the process of discussion and merging. + +### Microservices + +One major ambition of metal-stack is to follow the idea of [microservices](https://en.wikipedia.org/wiki/Microservices). This way, we want to achieve that we can + +- adapt to changes faster than with monolithic architectures, +- be free of restrictions due to certain choices of technology, +- leverage powerful traits of cloud infrastructures (e.g. high-scalability, high-availability, ...). + +### Programming Languages + +We are generally open to write code in any language that fits best to the function of the software. However, we encourage [golang](https://en.wikipedia.org/wiki/Go_(programming_language)) to be the main language of metal-stack as we think that it makes development faster when not establishing too many different languages in our architecture. Reason for this is that we are striving for consistent behavior of the microservices, similar to what has been described for the Twelve-Factor App (see [12 Factor](https://12factor.net/)). We help enforcing unified behavior by allowing a small layer of shared code for every programming language. We will refer to this shared code as "libraries" for the rest of this document. + +### Artifacts + +Artifacts are always produced by a CI process (i.e. Github Actions). + +Container images and [OCI artifacts](https://github.com/opencontainers/image-spec) are published on the Github Container Registry of the metal-stack organization. Please consider using Github Actions workflows utilizing similar actions as the other repositories (e.g. [build-push-action](https://github.com/docker/build-push-action), ...) + +For OCI images, we usually utilize [oras](https://github.com/oras-project/oras) for pushing the artifact to the registry. + +For signing artifacts we use [cosign](https://github.com/sigstore/cosign). The private key for signing artifacts is a CI secret called `COSIGN_PRIVATE_KEY`. + +Binary artifacts or OS images can be uploaded to `images.metal-stack.io` if necessary. + +### APIs + +The preferred way to implement an API is using [Connect RPC](https://connectrpc.com/), which is based on [grpc](https://grpc.io/). For working with the [Protobuf](https://protobuf.dev/) definitions, we utilize [buf](https://github.com/bufbuild/buf). + +The metal-api does still have a [Swagger-based](https://swagger.io/) API exposing traditional REST APIs for end-users. This API framework will become deprecated so it should not be used anymore for new projects. + +#### Versioning + +Artifacts are versioned by tagging the respective repository with a tag starting with the letter `v`. After the letter, there stands a valid [semantic version](https://semver.org/). + +### Documentation + +In order to make it easier for others to understand a project, we document general information and usage instructions in a `README.md` in any project. + +In addition to that, we document a microservice in the [docs](https://github.com/metal-stack/docs) repository. The documentation should contain the reasoning why this service exists and why it was being implemented the way it was being implemented. The aim of this procedure is to reduce the time for contributors to comprehend architectural decisions that were made during the process of writing the software and to clarify the general purpose of this service in the entire context of the software. + +## Guidelines + +This chapter describes general guidelines on how to develop and contribute code for a certain programming language. + +### Golang + +Development follows the official guide to: + +- Write clear, idiomatic Go code[^2] +- Learn from mistakes that must not be repeated[^3] +- Apply appropriate names to your artifacts: + - [https://go.dev/talks/2014/names.slide](https://go.dev/talks/2014/names.slide) + - [https://go.dev/blog/package-names](https://go.dev/blog/package-names) + - [https://go.dev/doc/effective_go#names](https://go.dev/doc/effective_go#names) +- Enable others to understand the reasoning of non-trivial code sequences by applying a meaningful documentation. + +#### Development Decisions + +- **Dependency Management** by using Go modules +- **Build and Test Automation** by using [GNU Make](https://man7.org/linux/man-pages/man1/make.1p.html). +- **APIs** should consider using [buf](https://github.com/bufbuild/buf) + +#### Libraries + +metal-stack maintains libraries that you can utilize in your project in order to unify common behavior. The main project that does this is called [metal-lib](https://github.com/metal-stack/metal-lib). + +#### Error Handling with Generated Swagger Clients + +From the server-side you should ensure that you are returning the common error json struct in case of an error as defined in the `metal-lib/httperrors`. Ensure you are using `go-restful >= v2.9.1` and `go-restful-openapi >= v0.13.1` (allows default responses with error codes other than 200). + +### Documentation + +We want to share knowledge and keep things simple. If things cannot kept simple we want to enable everybody to understand them by: + +- Document in short sentences[^4]. +- Do not explain the HOW (this is already documented by your code and documenting the obvious is considered a defect). +- Explain the WHY. Add a "to" in your documentation line to force yourself to explain the reasonning (e.g. "` to `"). + +### Python + +Development follows the official guide to: + +- Style Guide for Python Code (PEP 8)[^5] + - The use of an IDE like [PyCharm](https://www.jetbrains.com/pycharm/) helps to write compliant code easily +- Consider [setuptools](https://pythonhosted.org/an_example_pypi_project/setuptools.html) for packaging +- If you want to add a Python microservice to the mix, consider [pyinstaller](https://github.com/pyinstaller/pyinstaller) on Alpine to achieve small image sizes + +[^1]: [https://martinfowler.com/bliki/CodeOwnership.html](https://martinfowler.com/bliki/CodeOwnership.html) + +[^2]: [https://go.dev/doc/effective_go](https://go.dev/doc/effective_go) + +[^3]: [https://github.com/golang/go/wiki/CodeReviewComments](https://github.com/golang/go/wiki/CodeReviewComments) + +[^4]: [https://github.com/golang/go/wiki/CodeReviewComments#comment-sentences](https://github.com/golang/go/wiki/CodeReviewComments#comment-sentences) + +[^5]: [https://www.python.org/dev/peps/pep-0008/](https://www.python.org/dev/peps/pep-0008/) diff --git a/versioned_docs/version-v0.22.4/contributing/04-release-flow.md b/versioned_docs/version-v0.22.4/contributing/04-release-flow.md new file mode 100644 index 0000000..62021eb --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/04-release-flow.md @@ -0,0 +1,110 @@ +--- +slug: /release-flow +title: Release Flow +sidebar_position: 4 +--- + +# Releases + +The metal-stack contains of many microservices that depend on each other. The automated release flow is there to ensure that all components work together flawlessly for every metal-stack release. + +Releases and integration tests are published through our [release repository](https://github.com/metal-stack/releases). You can also find the [release notes](https://github.com/metal-stack/releases/releases) for this metal-stack version in there. The release notes contain information about new features, upgrade paths and bug fixes. + +If you want, you can sign up at our Slack channel where we are announcing every new release. Often, we provide additional information for metal-stack administrators and adopters at this place, too. + +This document is intended for developers, especially maintainers of metal-stack projects. + +## Release Flow + +The following diagram attempts to describe our current release flow: + +![](release_flow.svg) + +A release is created in the following way: + +- Individual repository maintainers within the metal-stack GitHub Organization can publish a release of their component. +- This release is automatically pushed to the `develop` branch of the release repository by the metal-robot. +- A push triggers a virtual release integration test using the mini-lab environment. This setup launches metal-stack with the `sonic` and `gardener` flavors to validate the different Ansible roles and execute basic operations across the metal-stack layer. +- To contribute components that are not directly part of the release vector, a pull request must be made against the `develop` branch of the release repository. Release maintainers may push directly to the `develop` branch. +- The release maintainers can `/freeze` the `develop` branch, effectively stopping the metal-robot from pushing component releases to this branch. +- The `develop` branch is tagged by a release maintainer with a `-rc.x` suffix to create a __release candidate__. +- The release candidate must pass a large integration test suite on a real environment, which is currently run by FI-TS. It tests the entire machine provisioning engine including the integration with Gardener, the deployment, metal-images and Kubernetes conformance tests. +- If the integration tests pass, the PR of the `develop` branch must be approved by at least two release maintainers. +- A release is created via GitHub releases, including all release notes, with a tag on the `main` branch. + +## FAQ + +**Question: I need PR #xyz to go into the release, why did you not include it?** + +Answer: It's not on purpose if we miss a PR to be included into a metal-stack release. Please use the pending pull request from `develop` into `master` as soon as it is open and comment which pull request you want to have included into the release. Also consider attending our planning meetings or contact us in our Slack channel if you have urgent requirements that need to be dealt with. + +**Question: Who is responsible for the releases? Who can freeze a release?** + +Answer: Every repository in metal-stack has a `CODEOWNERS` file pointing to a maintainer team. This is also true for the releases repository. Only release repository maintainers are allowed to `/freeze` a release (meaning the metal-robot does not automatically append new component releases to the release vector anymore). + +**Question: I can't push to the `develop` branch of this repository? How can I request changes to the release vector?** + +Answer: Most changes are automatically integrated by the metal-robot. For manually managed components, please raise a pull request against the `develop` branch. Only release maintainers are allowed to push to `develop` as otherwise it would be possible to mess up the release pipeline. + +**Question: What requirements need to be fulfilled to add a repository to the release vector?** + +Please see the section below named [Requirements for Release Vector Repositories](#requirements-for-release-vector-repositories). + +### Requirements for Release Vector Repositories + +Before adding a repository in the metal-stack org to the releases repository, it is advised for the maintainer to fulfill the following points: + +- The following files should be present at the repository root: + - [CODEOWNERS](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners) + - When a repository is created, the metal-robot automatically creates a -maintainers team in our GitHub org. + - The CODEOWNERS file should reference this team. + - The team should contain at least two maintainers. + - `LICENSE` + - This usually should be MIT with "metal-stack" as authors. + - `README.md` +- The `developers-core` team should be given repository access with `write` role, the codeowners team should have the `maintain` role +- Release artifacts should have an SPDX-formatted SBOM attached. + - For container images these are embedded using Buildx. +- The following branch protection rules should be set: + - The mainline should be protected. + - A pull request should be required before merging (required by at least one code owner). + - Status checks should be required to pass. + - Force push should not be allowed on this branch. +- One person from the releases maintainers has to add the repository to the metal-robot in order to pick up the releases, add them to the release vector and generate release notes. + +### How-To Release a Project + +[release-drafter](https://github.com/release-drafter/release-drafter) is preferred in order to generate release notes from merged PRs for your projects. It should be triggered for pushes on your main branch. + +The draft is then used to create a project release. The release has to be published through the GitHub UI as demonstrated in the screenshot below. + +**Tagging the repository is not enough as repository tagging does not associate your release notes to your release!** + +![](release.png) + +Some further remarks: + +- Use semver versions with `v` prefix for your tags +- Name your release after your release tag +- The metal-robot only picks up lines from your release notes that start with `-` or `*` (unordered list items) and appends them to the according section in the aggregated release draft +- A tag created through a GitHub UI release does not trigger a `push` event . This means, your pipeline will not start to run with the `push` trigger when publishing through the UI. + + Instead, use the `published` [release event trigger](https://docs.github.com/en/actions/reference/events-that-trigger-workflows#release) for your actions: + + ```yaml + on: + release: + types: + - published + ``` +- In case they are necessary, please do not forget to include `NOTEWORTHY`, `ACTIONS_REQUIRED` or `BREAKING_CHANGE` sections into releases. More information on those release draft sections can be read in a pull request template. + +### Pre-Releases + +Most metal-stack repositories are installed through the metal-stack release vector. Therefore, it is safe to release them and wait for the release integration suite to return results. + +However, there are certain repositories that have an external user base and can be used without a running metal-stack installation. Examples include [csi-driver-lvm](https://github.com/metal-stack/csi-driver-lvm) and [go-ipam](https://github.com/metal-stack/go-ipam). + +In the latter case, maintainers should create pre-releases using the GitHub feature "Set as a pre-release" if necessary. Additionally, maintainers should use an `-rc.x` tag to indicate that this component version is a pre-release. If the metal-stack integration tests do not add any substantial test coverage and if the component is thoroughly tested, a release candidate can be skipped. + +Once these components have been integration-tested, they can be released as the latest version with a valid tag on the same Git hash. In this case, the component in the release vector can be updated to the release version without running the integration suite again. If necessary, comment in the releases repository to execute this action (let a maintainer unfreeze the release pull request). diff --git a/versioned_docs/version-v0.22.4/contributing/05-oci-artifacts.md b/versioned_docs/version-v0.22.4/contributing/05-oci-artifacts.md new file mode 100644 index 0000000..f9e4679 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/05-oci-artifacts.md @@ -0,0 +1,39 @@ +--- +slug: /oci-artifacts +title: OCI Artifacts +sidebar_position: 5 +--- + +# OCI Artifacts + +Certain artifacts of metal-stack are not shipped as Docker containers but in a more generic registry container format following the [OCI](https://opencontainers.org/) specification. Examples for these artifacts are the metal-stack release vectors as defined by the [releases](https://github.com/metal-stack/releases) repository or ansible-roles that can be used for deploying metal-stack. + +The OCI artifacts have an expected format convention, which is described on this page. + +## Release Vector Artifacts + +This OCI artifact expects a layer with the artifact type `application/vnd.metal-stack.release-vector.v1` including one gzipped tar file called `release.tar.gz`, which should be marked with custom media type `application/vnd.metal-stack.release-vector.v1.tar+gzip`. + +Inside the tar file, there is a `release.yaml` file that contains a metal-stack release vector. + +The metal-stack release vector has a free format but by default expects an `ansible-roles` key at the root, mapping the role names to OCI artifacts and versions, like: + +``` +ansible-roles: + : + oci: + version: + # e.g.: + ansible-common: + oci: ghcr.io/metal-stack/ansible-common + repository: https://github.com/metal-stack/ansible-common + version: v0.7.2 +``` + +If this convention is not followed, it is not possible to install ansible-roles through the `metal_stack_release_vector` image as provided by the metal-deployment-base deployment base image. + +## Ansible Roles + +This OCI artifact expects a layer with the artifact type `application/vnd.metal-stack.release-vector.v1` including one gzipped tar file called `ansible-role.tar.gz`, which should be marked with custom media type `application/vnd.metal-stack.ansible-role.v1.tar+gzip`. + +Inside the tar file, there is **one folder** containing the ansible-role to install. Please do not include multiple folders as otherwise the `metal_stack_release_vector` module cannot alias role names, which is sometimes required for deployments. diff --git a/versioned_docs/version-v0.22.4/contributing/06-community.md b/versioned_docs/version-v0.22.4/contributing/06-community.md new file mode 100644 index 0000000..98a65b2 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/06-community.md @@ -0,0 +1,11 @@ +--- +slug: /community +title: Community +sidebar_position: 6 +draft: true +--- + +# Community + +(Slack channel, community events like FOSDEM, Kubernetes Community Days..., blog +articles) diff --git a/versioned_docs/version-v0.22.4/contributing/release.png b/versioned_docs/version-v0.22.4/contributing/release.png new file mode 100644 index 0000000000000000000000000000000000000000..598b118221b61d55a2de4b4c1841cc6416892b6e GIT binary patch literal 87019 zcmdqIg;yL)^Z1>R0Kr3W4<6iImY@NGyR*2vYX}xRxVr~;*TvnP#ogWE-7C5GKIi=Y zf$w|HEN9M8)6-L3RbAEd=^$BYF(i0g_*bu9A&GwxmVfmM3IzG7zJq~W38XvdeD&(% zD{;88uCkwW;aCVIm4cDEKIbCixj+Bav2LwExc^$4Ro;aAmZjhZs}a_(3Jw(Tz zm@b;i9M7IkH-kMp!L;cdgg18}UB;iKGe47(!b7Uw)UwY&mr&*K|J&$Kk&j}Xr$?XI z9P@RErAn}@R)_774{_C)S5$YAV6w6{Y;2vn76zDCVl?2X{~fSx_{}fagbhr7M}Y1m zjX0<#@8QbpLqa8LooSh(X;i%QAMt_at<-hs%D*i^;O!7F{S;x z)eHfIO>pu^lNAjOSz}xOHL_8Jw z`nq#L?cDgtwdMt8dHR1uI_ZBJcb1o>6VyoZs}9hRs|}{lD!@s(J-)M#gtrQ%M-aN% zIZD17LIP1m*4^IMAtZWE)`QDzQT5yN6_vD$R5$&v)DkJqIt#W0|9O=LGDxGRO;?YJ zvTFUoI#E*SR>w1l#Rn3j5v8Zbm%ajzr(bOP_qAyY;7iy=!8`7sc=#hPMZ&0OX?NPK zSmKl=gX{Z)bVi}f;)d@0q=iIRk9Ga66ZfZzRap;&B+^s|^H)B1o=z_INB;B7JE4y< z{%dJzdk$bsd!165I(hUKoQ}co4>517m&-Wq2IC zbZR(oA``p%)9!RW@l6TJPvHobjmgiZ8(g)PUfm0;scQP#2dI1fS}o7UovAt;e}ZT1K|f61C5=><46y}*!l^BqF^t7K zp)FldM0Bv6`4UE>BaQ$0i7Y=~s%W=F=~Vg1szEcx;v&z*^W$QUM!_6MF5(6h!(^>H z&ImzMf9ar^nWBCE7dK{idc%b2scq@#z7GNBY({6T`sns`z?Y9 z1_e8n^dfQ#mHd@d602F)Vp*GCYOFt3w`ga%nr3CyKeGovdS51^#q)$&4;SbrPy7>Y zOfiv4oW8qN<&z#v?yvf)OdkR*4zUc`Pmn3fAjhnN>Zs%K7vp6U;Wi6%Fpm9`;zA74l`B zbQ1p0LYj@Q#oRG!esPXxr(xx{AsLNCP#LjZDKM1887BD!f3{3M7j26$Idj9Y@~BE{ zUpZ2nFTy=RQ6J@i^Cd#rsJ7O~b9y9FcZA`fPv01O=ELVtAE~e;O1|ztrjRT$ zRFSww`zvC-M(rzu;zAD?)=@uNW3=eHyma2|`be}d)goFM%Lb657p*c?X^6JUP~syJ zd=95rSQ%zzUNSP~Z5#O{-m9ikpO%piB(R<+>s{Aej<|8KMdVHCD=Kp-&km%l3Dn9m zmGo`};Pe10xFwYBj9o2h+=wJMLc&Lyd2ZOLV4#IG?kXR?a1ycJ81_EPTIJ!o)C6E{ z4D6X!aV->Id*wv}H(22|`pT07wjGlyOjekn@UJ{rD^ZM(z(&2*n9T}p2zWOqy`vPV zgh%S~jgz$epQ8IBn7|I^r_A@E!eHx(*dv|eZmGm4R$5Y!5nI(E?eF>JCkpiWS8T5* zBy06XBgSKsN6(({;SgDV@*qCt0-*evxA_^L)n=d9o(x=54DjSkU?O7Z z9i2`hx+x~HIk>5Jy=OKukTH@;lsW*~Q>C4vRm~oPid-EvOO6yVgQ-)7!9W{39;ObM1#Mh0c9x7sZf@I~gY_A7; z7p{T?jvUh0saO+x!>=aC^PVu^CttR$n58;3ndWtVPp2Q-;2_f}yLXbXmoH0xvkV_| z%5cb|mjMC-I{};j)%rAeE!(!GLfPnI^<_>;65)6a}T9 zkUy1n+W*Y0%_Kibf%T7L-d`l#AN6A{B(`)Exzg@4@fd!6i)aY8 z!oB1P-^&L&oAYNd#wcRUf__gj=(2y@BU)4-Ove|uysjyWyFhyogCX1hQlK0rUu%KC z8oxthsq-*VhkT}DpUEjpOU|b5KMg*T z{mce(0zQ9H`}gGp-omGU^IPkj-Imw?EeHuHK21;`0&;2oO~k*wLsx$d2lB7o%U%Ch zl^_3*LixWd#q}XzV?7!Y`?F|%N0UDd)K&eDgfgwP0$uvIvHv-N9>agZjw}7gh9M`i zCJ-~mTF8qJ{wKkJr~@L!|Nko~J6^;C*8W|`y>FRgB$D0#wI4fW0aIX@e=cbTPZSa!0AO)?2*Ax_=;lInQFi(m-gjU)e6ZzS zPk!#EcHwr{b$-`Uico22)#^N8zI%5iSAjlwcdgnn~nT{6q++6X)H*jGg?S?q~>f+SC>ri2W*T>(DF5c^$(^7_V6n1tb7jB)=<;GP3F z2??pK{luz?wf4t2#*~*u9kYMDO7HiI({X&)`=r+S@SI~;1%FM%)9V)q+&T=(w!Cib z88e;o6X{w%+VRajca0^v;4KWY?J~DKwSTaVFmCuIUDhjjxBLCTQQZn0lx@H?x^w(U zYuM^s%ueb*#!1)hk&=GzV7rF8y6IDt+O3dI$^$D3h69aE!on66r+@Rc@?S?=6?3yd zH#1k^#jl(_skE2c;FojmEI&K#IHR&sbXj7X>W34~Ej+!c9<2;HyRrhFdFZ?~6^H98 zEIG9wy~q85jL^HVjApJy9oY{b?841kSx;OibV|P-kt=d7MtGe1>DK8}n#f~$|9olW za$d|6MBV2V0s*)mCR1!|z3x|3?&|L&Xx-G+ad)%NRj}Eell|%$f<9 z`p6fygWG7+k&8uNra8FE3*0d?5LWQlWd_E#Qkh@ox9@XIL}3Vxjzg_@dsoi#%;|C1 zQnCnoCf1eGEiQQoqTNv_7K-4bd#{LhmkiCC)gpH=V7=zAa2B%%DqPw%=0AnpHIc1w zi`}@cRO;X9c9v;%Wqwghu_SujmO(~YZ+T9>wK^dy9s+oV6QQ2p*aldJ=-(_|8)-=v zNpCL=qyLJ(FuLo4n`6fpjHs)e1RH5l4313RBX3`=U6`nXk2_Wl9ILHo(z$q4P`&gx zP`zqQuaagbbv9AOMsPVp<6(yKOmmAnuGHv1c-&Ju=~NlIG{tkh?BEP27D=n`D!EC$ zM3tDs^3Ar|-LERoEPd(>&aA0KckL(##vE|?t2n64T}P0UF1DQipf=qF7gJ8omQb{V zdYY;6E*;FLBgWH9aw-=u+(eR9-p*^h70y_FX8=Gv7=P;zS$k_2^dIO&$fdsE`?R&G zqS~ee8+&Ds&&sqL1USVQ89o5mjY&R@mhEa%>mIzU5Q8(MN!M26RomoHG+x9|q#v8u z5Ja%O>L<)8!bCNiP@Yx>5gRhG+Ok*nlP!|Qew5d*d{=v#v}0tbcK8SukmC?-rl(;?&}uErzXQ9&tMwlkfW6;uN_$k zDXMag!`;QV?+@NaQLN|}% zC3QVHP*xB?fiqW>)XZ=kL?;i~*ZbAz-vzVU2jbR6S{feIJ!P$Z!!t4%C#KwZJ(_Ku ztJ$A4)a^(FpB{z`h;=T~+Sx z{r&`V{Aa0(Tvq+cGOE{`HRsMCnUVJ8Uc6CnPYvK$AzYYrcZa-~umk*Yt9Cul!q2oA zfyxeC6iPfs?02nb{@$nzM%bX!vH6&)a3N!$Q2#pk(-k*&Lg%SOGaH;qNs3KHjX-qT z!0_r9TFWCU?MV|bEDRXpKz>qb6eli!}no(k3lGIVFz;^K7xKWa!*kp zE=kO; zq6-y0?OSp_Y_@xt?xi{$2%0kdiYJDt3-e zj}?;(YMRanr}l#8?wAoN1Cjw!>uFs{;@M*}$L;{cK&|`ma5NN!onf=vg`CQ*Ii>K! z#NGz2LC!oEUt32l6RRN_B96N3A0P|g{jk~l`k+_)XR%VxgJkF^?Q1p z4yWdBBbr~PrvNzh*C-PAO_SbVte@vwe=vYj3l*jVmlu&)Z0CDFmAwoU^qZS5H4uQW zarxC=_{(1LjOE$MKenbIKY<7`>i z!>rMKfg3G8TbhP6hD%F5fezsV;Y}TPrAzw@vv2BWnRH}d>;^YDLjs3tb8zxNY9MpT z#vr~r>KBs+_Lz51NwENmvEvpA{1tb~i6+ytegLEd593Owz3e@(j|h0{D;IF$H^ z3J~RDuJ?wuI@aix5kGFev%?V_ef}D%L#G^W))!7rWY5|ceq)Xfys6C&Rb@=(kmOI8 ziN-ubL29JS-PS0R>luu?YVtB#JeFzjJY_-7RWa5snleUtb6nq|VX?_L5I1a*O%RV@Xm)lj zB=?EPLnA9ZSGy%M#{0riyJWNXdK87pZ5+yMA#l>B3n+bz8wURd%^h*GMI6DlxjY^f zZ&dyzRi#1_d2P&9zeTj__PEc+KY=LWDVxq5RwZ8~u#nYk^1ap}fwbmKrL%~R8~cHe z{hdmoatSNt4dG_0&&FMOEdcF4%*U=w0ZhOTxaCOZ8157ykj}oIG@Yy=7q2TT-i#7t)!f)7wR?JIki(^`F%lAUGP?1&_KH`d`8u5f62_8wq}G8x-Vu=S z^%!1T^|IPTM_M5u8J|bQ?73mq8D0umDfQWk-mAQ1xTYmCz^w=hmh2fk`uuL98|I=- zn&$R?6>)*%U@#{3!ZkO6h6)Z&m4{pZYAio*uHap{bML%pKOnH~bPqsSOfb9qS+(Vq z=4j`!Gl&i(hkJ>5uoTZtY9!D1gt)AtwYs?-nWwY4Mx4p%;-YV!yW00F;%>5pcyb{w z%hH#hcCG;#MT*n$p?KrLQ=!sBDkU;XKsfk=H;Oy6AcKPSDt+rRhyQSN?|X%8JpCjk zK?1ut7*b?g11anM+JuocG)Y^fj#}udyXjJ=IMWY-aU-OS67JlJL%Qv~E79oLh7Z5M zh^7EPAPv8s@B=aJd`-Z5sdCp6r^sN?%IVQ|+Egh^(y~rz$0GQ<6bnV7M#;PJL+4$gyckgRN+)7doEi&oKj_Y_R&O9n?!cSFy5~8vuvD>gA97(utKRaSEmbBj+B8eiiS1Ze=hL+Lw#4b#Csn4bQqv@1i!14` zW(tXZ<%7)t3kHDI@vyrTMa53Ld`fYQ=ED^uT0~xzxluA~ChIv7c)va_z4iX>Mp(Id zekkdYcS`}LitnM z9+k73Bmt|Ky}o2Pu{l(QxNcvtNPJpXJYXfGgNI@HB_q;nhc--RTo{IWJnjar%06Hc=pTsjKT zm*LlFCU-{SQ-xH!v`2Fs-ng@mc#N5nQs{0-;yCb{1cV+Nc4xO(Z=X#^@8#G`$8^aw zP|7-%*)O7H)lXMgu^Z$0k||cLtVJ9wpa_pqJn^!_b7y!!b1p7)L|mdLCk%#1G)n?_|^F>|%IUf9x_JXl(} zC^jW~GM7UY1-OWUu6GFXbmr@m&yG`AqZ#(}{v~B^fTRKIOrFH|7qH@AseOBSwBLr! zOSiAD$*|Jo0OvTFH5dHst&_TZWJ2u&t}ZR6!z#>`(Ht!ZdeO^Rvh^LWt?pBh9%M4h zZF6>hf?3_OyF68omKh(9BDsVgFDO|6U{RCiB$fRs!}HZ`RRHTxd%GQ@IKujGZDlk` z39`%*vxXqQyqi(SyFlMiaC+x6G{IM$bb3Oj&~MTkUx6-D9b`@;=7CUe7ULOqLRN&% z&g_V{uh}Fxh`K_N4Iu*0BaSX$B+$xHvf#Ggw;{UC^c8God#tq9<2jn@M-L^?&4Y2d z=>Ya&5>lo@7>P+Xy+YfI^mXa3a0}tV-QF0jLdLV}j=EDz7}`g~{$*E|UK7(QNSk z->a(~L`Rc_hV@X)2pu;_Cbum&jSS#1%pN25vKN>t#E43Fd2OrYlB|Axm6~Pp?tkaT zj`zcQo;eSNK-9dY1U7y6L?#`p9jx zS3j=GhW|NG{)`o`B3?fkcCv8;(djrX;z`J}6FtECwnEQED^4cq$I*kYlzl)niItr7 zstbU@)c#B6rp1W0lDWQ65}w=v%BR-4hiS3larda zDkh_In6ZR+qEUoyaiZCk0c)aYn7ZC)A0-*wE6o%=Who~!I%L@ipF>AQjYn|8m$-a~ zcdBo>jcesZ-MB%bxVrDM<9qg%9=ud%|Lu$bS-9%FL3O0_Nf{# z5rPnU9c)SN?Lbh*tWD91aBvB77pMJ5y@(XP?{dcc+=F^lvnT38REezid`PQ0k0$j) z)bk=-)=jG5)}F*YQU0k`Ej~Ry32`A}+KCGqs}s-bkO00QKM$OMbVJh`F{$X?rhST= zPMflsWt=8A47pzZje>Qgyz0VGY16RS2?38e%OoeAuJMf!+r~xN9@7ujj_M;EVn&(b z;=TRjm{OuJKG{9;jf>a|ZTso-@9qtfrtrE3T8gOFExI}I;wqU~KT2XFKODd|(%vU; z;K3w{1_XMK#V>$Z!~(b27y zA+@|O6YComH>51Pm%?hd?vRARd=uXNS1Tv!{o7Rf<(B+@(q+p?peH9A8%v%2+B8r+ zCFX|3>qS5sh=IMP5-gA}mE{;1QLvxC?Q2SOc9SRb<(j^GPn7}l$~8#z1jT3?T!Zdd zNk)ImkQB~4aHH`cTh{RwnNTCBg$WT>n!H(J$J-yc(Ra!WNmS}P2057@t#%@~?zTwq z>2zm1xinABzsCOX)uf+@u`MY|S~s_ophiY^Qrp(+rOaJlHwjeEHkvL@%$eSW*C}bw z-ul$oVwsYs_mPSV36@7PiDQ3oeYuEgEu)i@h*znkS2=TSIZuDyn*p(mF<>n&)GF%E zXP|!h?tzntwsENc%2(>Mn?(BSW@ZD-VVWk!=0#nw*)#G=pj)Mj>=7-)03;<{Y4V|` zI>$W00iDKaPg(MY`HID@n-mI{&Hl_(&@;YT-4@ixE?xFSXv0r5hwn=tO%$9O)N-NQ zCTl{YKJWjgUVuhYFzo>&CPT{-hKO~-8h2b1k`)BEeS}POF}()uaXZ#`dc{moh}sar zSE!`Mn}G}?#jW$?k?3sJ;K)SK8|;zGD2I(8 zf==21p-6!~F-i%4x?M<&d&%~Y%|J0MZ6YoDjC>3#zg0Do4QTn7N%T~+>$Yq&*Ef2F(6;p*A z-;cy*);BWNA2Ww(ZwG^7mj~so`v_Z~^hl^LFU@D8uZie5!VtYLqk~iJ7ZdjvOVq3b zN;JFs@ANDE)*Q1T$i$SWg#0>*>7)}$5lV@!*@O01ow{H>LUv95NSuJ3>gybZRa5C= zyl?WE0?~27odakUxs$DUmHeL(8Z_gFL;92_5YKQgDY9|P4I}9-*yDx6Y^h4t* z-rEQ@iO6Y$AIW@hfpXCmUnIH)RuDWru%LE?dzTbA-X4Kqu5aZL?6T`s zrr3H`_U7#p!6)^20a(yk@;SCeCx}opZ@+WLCG+Je=pFb*uGP!r>B%`WN-OdGNaY~h z;(3w+&Yjx1r_i{evF9)xPsZzQAriO1t~S_EX>xwm)7xtz1uec)~eoi%y#&=4UxzXC#jjLE{@|MTK>wMv++bMe5xGkT2tA6wNN(WZ; zVb2Z5v-u}(_wjOnL9TT&SkZFD_f-g|7q@33KuF1>*5`M&8;S&%j{Auyxy;_1q7AS+WIL7B=$ zg`ufa@p+C#D+~v5T$8sVazX5D&3D^@lO9*guvrFJ>0Kv@G;1vQFH2(D(N098;Hj*I zAZdIW&!O}M-)t`jcAl2D7y22(f!rvrcSAH%**(VA37S(`EJJ~}CAE`#b2UiTakd5{ zVt5I4ws74wbtYhAa-jg{4r(U9tq1yY_hlE06AJbgiZJcvo^$2J+L*IyqlX1LR&1uk z*?QrfJuz&)96Is37htb-zlFv`I@&>8`BfI1r+V8!dT$$9#b(o2GZp_vnRg&!Z-V@z z`lrkN=`_7s@genl4EJmLu4U1Ff3zl3fFmH;xh!iz==F+f*}=-8{%W52SKOKKDjpTE zj?}srHki$4S|Q(NJdfnaEPk!;S}VqUI{w&^(1QmE4=UN2%-n%(mLCdEv}do<>$N-d z^~wQ-Mt{WtN7(~j+DAxdIX&!f(vk6p0CD8IvxW3K()gQEPesMpcWI_wC1D&`D zPvkrZ!XTZ5TdH#o)}{k{^D4d`vji|-X`IS`BYoho&erQCHfdYwqTBh!>QRE7-^M>e zSI40?chbRo`v7#Ypi^(24P^Iy7;BcJ!!P-GK0)O+#6NP%A2vqehgyFvc72ivdNO_N zVbp8_u&LK(&M%Uyad~4L|P)aI3Mml$7Z|aIo#9Th`D;}1qGBIRwk1k4l0-{ zMk+(EG2E&o2-RYZkbiro9WN3}u##HfEnVex!%)0X_j={W%5K{^J`dn1nlc{SW8E76 zj~MZB7J3LCWO?sf$FN)TDV5iTXbP+86-QQ{Ob2jRRepw6w8ZI^Bh)YWnlm${)G_g@ zj*d5$DKIZwq(73l;e6ehVn)(TWL|z~<$umO){40K&Q(Ag+f|}1d`?G4?M^dcE%LtH zZR9BusCCNqJ>R;sF$Q4JrMFmsg*l6yQ8oj!6U&YvDp3}&Tg_0YFYVOym->5{Be%s`gE9dx;ar&7A6 z^9wzx{@pryI0Tra-0VRb(Lw4S=}z6B9$32_TY}w4ecUPYQz#T~Kpcy!Ip0_;3DhB_Bk-f{z6=w0N$k^$0NgPXixy_R;1DQ)G% zm2bc(%C=zQn7sRt)p>h&>F6ODlV=8p_565%Ye*AMxxP&o98cqKJ9fHohv1j1an`27 z(ss^a)l;VH{cvSHMePoDDS>h>)e_O)2}&k`%S~n=yjIST+UX24p^l@|YutE=*BMRP z=4#XI@$GYvl(^?jV6fyh_AtO+Go>DYb;+9j#pQj+jxi9=UXp938NRjPFR2L^oGW}c zp~zU;Z82uIruQC$I)-%^E*J^nv*k|E=yKUm*v{8rxSgpxo@V*%g{Q6Q&}2_&Upi^eUa3pu059cAn|GWS`Re|EJqgT zpoDUs6nJvZ3+R=pv?!Hfs}>14^H)?sZX#P$hoV z@OaUq#FA5 zU{?)e117q$WMDD4OBSY(V+Zejw0pblu^MpV1kNfA3ly0TqKtbOmn?39>_ZlV^F^pJ zMe0FOtk|%(p-e>$TmjZh-MfW`)DHH`_q6a!I}29?WY) z$tYY5iN-M4))8g0UeU9~#G<)I*E98+3Dsxwpru`&jz?SmA6Z)iYoZ^J`MYIvd(q;pIHNPNh|oh>#y3rg!tYHrAkTeFfopU0l_aK`DpuQirY1w} z_?*&$?KjYoXvPrBQG#yo%>ovm);*Jo?K7gbt1qJwMlM9@gjnlt$TC$1>JFq+u+^W%v2J3-TvuQg^{ zwpA*&Pv?%oaqO-97zSiLAM~i}5Y!#1^JR3%xYcB~eqnstj=g)$O>&EAOdlZMtjSe8 z9pn=K$tRW~h{idpP<4T0);m+;^&g+U^95@2#SN<5U}|t4o+TYe01v59G=M}$$v03 z=r9m2?4>RC!W8=%(>P+?KXX)q;9o#!wE+%0U%V@ybA3DMPM3K8BNsU|#yBT`^U@@m z?w@$f(~5oMNva@_k+1jU4#F6&-?q^xOhjaDJ0^G- zbg;I4#Yj6z2H%UIY)17P-#YbxU?DNYK-`oR&+;nwa=*Qc7KvxBWc3mX=5yrkC%Uf( zEym7+SCMPRYU*@Nv47GEe?KhaBfLRDjh~25Nh(4(GI9Ye9m29*7;Z^iObmL|hmF&# zDSh*cF*BiglS@q$5M(&;O30cZ8umnm4+=F+xKaBW+i7tykKBszM z>!he>X!soH^T&Cy z5Y%|6Jlwy8&wHPI)V@DenU*)diT&Sy>=6GA3Pl*j*#G;ckit6*($4?0GizNxh-@7$ zgfe9@-^mvG{Zgd(9uGpZx-jN%R6;7$M3kT3(w-qt0(kL$w#NWMyl<& z|NH!x_hY8hIk`EjtJ-`T(hw>O$&F21t_^r{= zlQuow@bmq2^kSK9MU2;7&P`tPGwP?Zcp2@D`4`o*oYn*aNq>2Ne}95c$499xyeS|c zr@Q~pmj8LqlA_OBa5OzIEQ;T=bmfA`-JT6zybck%Y^r2c!6m-r)) zQ-;+S{XZ5d{C}&fcC3i`IeC#OQ31;NgJF#rN#@k(@Wpg=woY~exs@)NS2JccU0pp< zNpayF8L+;40Cb}`lBV81FPQ+g!7rHtx$O|3h|rACllrCdZx#f8CvMQKr7Vs~zLGn$$f`B~NFZ5kn=s+yW%ZI#8H zMEjicr5oSb+1aiGw}+>PY{G*$h0e4p{BL+w4cd+j5l_rdVUpR#&Q5@;O-)BNoh5vt zr<-!^;3(X-nlryHxz6|W?3z7{b|CHrI!j-#ysoCZUtILZg}1o`(qBeUNdtkeIeDqs zFKFCDupVMPooKXv-bj9x=op#7)xbNzFEJ7gNZOrKZRX{(zvQ+%$D-85#|aM&%~2gE zVK~mRBmdhN`V9Y|pq)FjPaT{+iL;{{4&!&|(=%su#|~^A$_K|QbMx{dOO-cvSAS;D zMn<=(`edx?O2mG8)?=Vn`Fmf3k0v@qX@^^DaUs*x&G8WEI0!czRI z633>O9j1y!{maS&AXaMeaVuXdjU2IPa&kPot7p5PV>LIA-xGU8wkSyEOBZMuBP1|y zLb$gJs2S1;(&GQJrJNqkn4)oRr}bygeU?5z_Ko0&#Rnd+OjD7P68KMipc(8P<(V<9 zQGGnvrb|`!70vG*7{J}qKPG0Of1StisoZ4=c~tRyiBC0qI%_hCiP>W8Z19Y)c;4%+ zBqd6*Lt$4Q)!vNtyDJ@&T`QZ-hH(RWaPPoU&l;ML~oh6G%ipAHL=biY)ga$JJ z^0jh-rH5Lj2`2bDPAyz2ytO;#46ULV?C<&p%wVI{UK|PZ4ZpId{Hgitb&JMS&xD|l zV4*;ATs!3?rEJBrOH!-+Wu&MKUI2(ROSO5OCE)r*e03e;?MQ-&I-cu%QdkU?Qp#NY zTX}i;z4;oUxPxQ07q~Xs+*`jng}4bl7M7lxft4GW88U`UACon!Ry~Pk} zM+gQ)R-A?ouV>zvS<*hidI-00G;6cy%*UBI-QYVx_0n8N2nyV>5e@ zaJppFm5brIhd~p;GTTg0*Onxl-7-F++Xpyu^9{~etoD?AG@Ehpzb;8i8u8v6aGbH6 zw^A>vSD6iup}*Tru3!KDV${?e;2dfcsRF<2_M4v(MWbM*x;z*6z*A z_;4X#+ec?f2Y2l~4Bkn=%8*#;2xV91d+h1G)oGK6QvcjwXZV$fI&`Pi^$8b_%B(pg zu6>s7LKGBJ|HUdmSPy6^wl_g8ODW9wYxLuSRBG>Htb|_XtliVTl02&fltgS-_Xxa} z882#~1hd}Bs&WqEh!a;`Ose17&W(Bu%irUK;)4$ll7Sed33#7qOcdQ{siyqdX!YA%Ycd#3O`b6}v7ARBI?)ZX` zm2tCk;?{YlKyAK&3a3eCLX4I)CxbckcM9@}yzZ}wMiZlQEoUs2g4@ba!uH!9=2T=f zPt}Yp9yhG8XDS`86_<*pIz~VDJ~Mb5?+=NaSf}cZ%n*GdSe1FApsRPYK-!sTb}5NL z@J`_p3zo#lyDsj{Bfl8GSI$nU!w8IcYR|AmtAAR2UF+c)CT*E4$Jg%DKoh}is;5Jk zCem_{-HMN3pKW!7`*_-IJcsF>D53NV)o%Yi)fV@MxjMokikq#!KH zAvEn(?a~ayGDx1ZzMJ=DeNU@Wbp$je^}anK+hxyD5(t6~D_c@(ViO+y_8I;^nW?=lYp+|6ls zJFv;eFOXIIwx?QmCWRS-eASwJ+C(<=WHDa!qZ861azwnSyNqeDs1)z#ta#)h75W}QUjY}zfbB|tqYW6 z>8r=+u1_$)rSOiic6w~zVvc%tZ553U{s6}i7?2k@Y@?ozu!sMec7_M25 zc<^T<*kZM24pMsC*bJNKb%M&BuLN@aQW3=7s~Ns02wutAc_f-^HefEjRwg6QT|G3B z?9HP~s5*Fc30n@mv@$>T_IRcuI~=HUc<#RiBC5;cP`rdXsrUF?hi2QsqlANh;1hZgu4*lBaUjo7RC90v~ZHdN8&z^%a>K7LA` z=Wd{}qBEMj4%4FmyT0L(Z9RccQhB;Ta^-Ghv+gS%MiC7NdoZ8gBO@oTFy6ATa$_@4 zK7n~DON4j89yy*c3oziW!|zU7CYo$DRB<|5^bg~Ym22Tv$XwJ^hv{OpRAG#4_!aS+ z1xODcmHSdTt(@ zqeIgLq-3$6&?;Kq4?{zlCFABFu$i9GFo)6ua-jqnJO-1}CvmhFedN*!Grrma6n@Se zRNpF>3Jt0dB-S3QU_KjT6AH)=6JHi6q_wrGgBC)bX$h8o8Mfzb`Cpk>?eTFl{3LszP%IsCFc%S3sLh;*V)_`&?OWWIqLqe zCbNgGxRJIFt~106-v=BA86Pb1zud*?^BPU=XmDL`!S#d@_Dd>Nf&CIvZ)o5^^Kwz1 ze`QGUQ39m_KwtJ$6m{oKkaids?qTou*I~DwHy%#C%EaZP54vMxg|7BSR`Zfn`Q9sJ zv5p3uZ1g|4Af9ijsiO%0QCm_7F}QOAZ1ZMalX( z7Q)<}7<%coQ?-?1suGWPSI3M`gAdEu{VdWCwa!xo$RP0Y6Eg+v*#nF^iu?1pI=3xQ z0@v!3y&0Wn4Y$MgLMJjvZO%XKUndInhuYtO%0DM}%rPk>yywJHiT&OdZf&IVlTu$D z-FQ6;jW&TDdjnlZN)#6+772$bz6v$qAzINs!IXM*g>trX`#TdN2ie|0ghRr^8y+mD zoX`2DDV)u(HFAAKvbnR1*n)^pFod$JyGJC%?Jkwnow2(|e4F-WYhz6f=1334)MdE( z;?qYt!d@BYP-K=@Qm$QE1snzKTu}M}v$L7r2m1SO?A)AK%U9;pLdqQJ%J@GEM}ZDh zNFw&Q3E92-E}|r@Z^_d8^lZkn`OrLso&5VX!GnCABc;6c^N5lmx$@V&jx8eoo$P2g zcIksoYq8q1hcH#-<0Xlb?W41EdWrOKB%GOSmS2@ME-l3zu(j5i(rpcwZVcZ>hMSnY z2bGtqAxTeTM4x#+7lxtCM$%TnN+ZvfXB8lyxs0QQOR`8r>n`#01G0E;=FRYtXl>%ai%;VoD5tUSm}>_vG=a+3{8( zmd;Y`kF2}6^sxt%<<-I6y@Cl`#cc41hc6byvv3)1wqhe`d@?CQhIv=Ty~ZK@f;h6i z10n>F&!DzR*ZAV%i>jid+A^V1|U$Twri;7?;cs$I)sgX@Zk zN|Kzjo-$Ak-llKdmmK)1E9t57p%_^|`5qtPMtyMe8Eu2pn_b{S+?xxn4CBwSPriY} zUm&QPRX;Pc<>A+<^IuE%5RDwupGO9bE&#|80Yw@341X@O{9Ji!_X*M1I?2zJjD;>z zBeNpUu;$njhwALn@fs>FTwAe3b%FJSnUp-PT=>)RfvCeSot^^gr_c@Ko)<;-7<%ou z8=qEVCF9?Ph*M;IRSSM_%@PXz+Rnw-qUEGM~XcrBjFR6_cVJv8Hpa zYu*k;#6y8=vP)`^oI#6DF|w;*Rc}>{Ze3nndrpu8ZrIB3NRjZ8M0L~5FnQ=QD11Ur z;X<7jLIJycXp)YW7Pg@F0w+afs$CY$R+3G_0jV>7N#^kJ!2dpAJMcW zVP(ZHwix$M2M(@KQ#iR}`AUP1G&sb+jIR^D{}xzf8yw)nQ)m6Nv^?LhjR%N&cAI!V z?n_6^{I;cqvh;c;hqCuWv{g`BAgP-pbscFGmE2TF*Dg;=gUy?^4_j1Q8}0s*98^lB z_(74xnk}{nc*Zi+%AW#LW1+?6Iy9Rxq+;WXfVrcq>j11jsQ5fV5szhp@q9`7=5 zv^PhQA795}<1k5LrKXf&Rik&fSm9sC6Om!G*SnH)Q%wQA#tA8=GBI+I|C)5R-$Aza zjy$u%*~8O3@T>iSS;+7&Zrr#mn10BMRBs_HnYmpJEk+S`jXQswt?0?UF4f|dQPre= zojZVb3MHy)|BIf>QyUJ%MMt}X^;cT3GDu5J8na}3UdGlE0T7I(+eH$Lu=D8#` zeP0QU<6kwOON;=rKM)6Jq~tgbQYQahdX|>Z(X5hS@RU%nhzr5afBb$|-O{L!TBBHHaO8)nfVgvOb)i52O?`90EW{Tm| zsYq?9bUr0L|7#)!=c+gw_atUqF;r`4=;Y4wSfvq|lYFXleEn7dga41Zw+yRl>)wZz zR8r{%>F(~3P5}Yw?(RmUySp2tyK_^U?(Xi8?suc-JjdV1|Ht>b{NiG+xz?U@tTFF# zkJ2Xwk%;UZz{44L9*#du2toU6B@|ZO?iYMFr?N@Wr#Lm`EXnR`Og+oxtPiQ-l0}l#bQ+^n35 zg|=7K*H^PFb4u#8SS7R|33uFjGv_$yD>7SBq*c(f$;LW9yN)L&Vx&X2bO6Ucs;Q|B z@ou1*yof{RMR}pnKg;R0+}K%*z1!I_%oUH5SSfxfB!&J%TewSu1%a|U#eS;PQe>Ji zbHZV?k=7HlplvEFf%uR%F%t=M^AZy_)javE$wRHxh?{Bi_WO_hw=Z5dt0F_AE=!Ai zj!*55?Uy#^O z;}gHOcGmD9+U=#kI?;>gh8-e%aK6cvP$`vwoW3fun;c^=gYTxL2L9>OIy(nfTbr4H zit#(uv`=MT=NS)-D_U1u^M{XeRc{8Ad8S3|Hd^pWLbg3UPRQUlkYzX@b~8{YRbyj} zXutea(UeJVkqMfBWC&@WseYL4puyfhD&<>02=bEXzkr6ISn5yjJ#o-mr^~QCuj9*; zK<#{FTCt#G<&G>KtwjNXO2`y@E)OTN_W%wX z3QZp-&IpG)*X&I^_oxg-jOz2$2+h{k@a*469+UKp-wZ!q`uscqZ}S+CA#RDc+Dj7B z#Y~ZY?$FHC7m;rs6TUSXjkay{4v^rrDs&JXSK;ay)<{N#IniPd)@Q7J>Q57Ew)7?i zBK=%8pjFeVNd9p$3xcPuBN~|!ik0FnqL0)MToCUW7_4A=&q{I8#Dz$QwpDfqN&yYwoa1pBR{*_NDtxQKu&~-We&)~wiewr1~KjV}*9GfM+CsNdx%`+i6!YLS0~V z0ee_6%4Ww*m`XFJ-Q$))D${O(Md=Tz%QT1)j=k|53S`kyqgX4il4qn2G${<3G)p0| zO>M{n^80Yj?ufhP2KyV1ykeGYT}x=RvZt8vQp)qia_q*v8zi*=#Tt|O4`hc8JPQhL zv(?TwBtNIE1oD;nSq=Fo>!xcVJkJ4&?%hBbL|-8= zwVGVoG^e>S;1p);r=Vv% z-W5RlDHQz+)PmCizpEQbbG_x(Kn?+pf>EBvqzP5EM5*L!Qa-6hHjw*WiAujF(T&U#fe8vs9JLyt=Kw2<&V4 z3GR%Sm7|vso?FePcN!n2?up?mluTV?Chv15x_dh*>$h4f>03mzKhw%XVX-l@98(Os zX@Gw^`vgNVYe>r}6+wEi%5mB?J)qcnFg9f7%4=h41U{EaA;Ekk9%rE{{D_Z*Fh*#J zC0hu;`h1LKitgzwVr;TS8k>>QN5z5g`*m#_*>w-kOh!beQklxm={Z32BAULGwW;BNi z;huvyGiMwmKZS)DxXB-GE_QT!NUNO(6S7o;l8WMh7aq{v~~5m$Q71vnhrwvy;SCuxW?lLVU6nrkwq zl}vM5n+>WTN!I6ztlJM^FopYrL)lmWs3(;7#L{cf;BXrw*K=GiW`~C$H#Y$ldg>S_ z$1Hf|Q2;SvdXIvqflzM;Ohy|-z>%waK%Z%C~SCjp$mV ztV`^6D2wL8(gN185p;YHaC-N*=k~Z;em<;$&zejaEQ9C?w-)2lu!eFC-w?ZGtaM*E zyg0890ZH(7{g(>Ztiu^Ub_wYGL(>L7XCS~`YxgPd2KKm2%L^2C1GsU%-HnkoA6j8C^J{<2ty$;(W)g-Lzf~@ z*dB4um`;+0C5>rRB?CjGBb&%U2$RS)irlqsLc|vMS;!T-`kWZ0QQX?LvQdOwv~+BQ zldfen)jKGKGZ);qdtJ>%z!HaZYRAk-get<=U&@zv$( zE1|Q}C5p@>Yq+>r^X^kQ63X7+;>vq46L}=i>l-_v4JC`#G-87{O&M%8K-ya<_=_Kw zF^pG}M9@9iB>bYIQi;lXKUUBA(Lew<1bC6ZLR6`|`v+-?n zMq>-MCI4xF{d9!8xgmn+6J|e#GlauPvLZ#Kw+}X2*2q`vX&_6(?6G*KVth#oPY@W5 zCuxG+5}vvKmd8vH5~H&hCVd-cvu(Yn)H%GOQt#{-%{z>n;IU;yQpD~f z)CYZSS~Xt`H-DX`G#;w_xNkh#wi^^|#W2}oQiAOslV=XgDZQgcB+r95}U zaLraoyx>~a*$D8GotEO1DkQ=N9BZw~;00A_YjU!G_f*Q^mKT ziKyuQr>T4c<$Yy376v`XYV{aAh7g-%!}>>O0_5WiD@NQJBJe#N&$GP|boguP_DW!~ z$N8W4&3(C0*Zc2TE-@zpC~`zL_6^_wc8PnF=ioZd4EOF1A~0?%iCe8iYg2+Op|+G zL?t|_#;7~R-qH%46L_h&6)YKgq;cZ_95|#u@=9|d3u{NBlU^&GENRFlaN2qw&aJR! zYUVGK)5R)j1N4&z($pb!YXBGuA;DPZG{1J9NaP8Rf;pQn)3yO9K2;Y zRMx$-iZE6fxpPSR+|kPS&2B!lWt@!ta*kiZ%&w;Q*^pe&=aKUoB*hwekGE;7fOB#u z)%d%Ut49lU`Xp|LW?R!^FjM<|Kv@z|;hYIZk_NSlvm-uNdcmisYVd~HLxE03rIHj> ze1DA<-*pP?GNu+ai_0$pmpJX|LCaM1o}%s;p7u$=fX%M6DrCxg7AjGxekOlfUa1TT z6Dcl0KK)TbG=hOVgVVTaHp&djLl#(E`{<9+%z3yZ_77@8#6GP%4DQ)vGw1DTE?jUo zSoQuUM9n&QxSz|#)e<=~u>eN+diF0(B^q_1ivp&$+f;%+rUrpti=c{!vC=nZC#o?a zZc5dUv3&b!r3~>jJ#z+GR;W&sBi5KHhmWo-(NouGd$pD1>UNXWN|tCP3qf67KgNu1 ziY6T2Kq~x9Y<7mH%)?zxppb<`gl)Q`CJ|-Tb4l<o{lI`EGCf=p{e3!)A{Eu zpBkE79NpO~0i&mw->O=)s#~^dtaSh z!VS)1$IAf~w2W_7QAI0iYBIHavWFI2-ts6p*Od(wek8)!V@d4P3o}4U!`NuOq+Kv^6in1+{lfr>JAm(n!%-C!(3S(2&!rS>tRA*5_t=xFwah(~{TE+uH0eE;km!{Sr}4 zB+jYBsqy%J1gEvyI8|<~`9osBOo@8fvJ`n9pyB)XF;2O?8xZ3YDQV~~Y<~|ZH}&7_ zs)(*qQg(@MB6MgU{VszYBBK)&=kh4~2?WG?>09icQMeBr@~yGB;-$|?tR~-DU!ya- zV9QaaFopDnW!lc_=sPMgS{+#rIAQeT7aJwDMDpyhD}!C-(kcc$vPP`H0{B#xw`>kIijrm6ak3s%I(pay3~UX~YEvji1g9bu%FQR>UI+Hj+~fC7jh~xN zuITNpVn(jASODu1P4D}82L+6>m=g{o_&ejTE8wj%VZGWT<1CZnUw-oB@ubc*X%iMv zIp%6(F_oC(ju+{v(CbmwF4P*XJZgkqodhF+e;lu5pPSE|G-Y7&(pY{3IZX%W|FEK3 z>I7f9Dk`P2Z^lUU2V$W%@W&718wof{@sX0UxLIKG3oC+T6~$43HX2@EGlmzt|ed0*>9DFAo-dR?(yj#8U8V zbeso14>%l(_K#m3wUp*76pK(NHb)BxHR)VrC9l^z`D^*3=OP>Txt(iCkt)o+G@ zhAx9Q%OxRQeStkp5dI;CCXVH16yI=reQ`_bwBy*Q67Fa@SU9FnH-Uo zgsuiAbEVw(J=G0sUc1y6b?KzahUk`jL0#3dZk}2^u=N>Da?EKYM4}N!dvbJ>BWHzL zv<%s^DQW8(RE9P}n<6n29N!!mk~@bt9R0l-vvZZFrKD0Te++SOJG;K%)v7v?I4#^F z)??NTVKG4!r;<<{;B=O$jpx=YL<@c#W)e0G=HT{qhbK>?A@M{_q&1B|ER3!bya!(7_`vXUHBJo-!H8V+KqStdy& zO&s0f+##vkKY)Vb@GKBF0Sp*T3CZ^O19PgLWwT|IkKYImWTRtT&y1XH4hAIEUO?fd zOzU3%(vZTPze-D6|7aIJ-Y$-3SjMGmdb4u;zMP zLoP~b#87eSit%m9yzz=0WwZ^Kty9fu?J?vWc~BtmixpMA zl9^OBI}?GD=QvBd!?@TRtJr0*<&^)%0`z*ex?-;CK`}{EKmVfg z)EhpV8fH5`k%J6dfujm(u)$u{`l&LU;_$)iQ<_MarcQWIG46HyrFi*dw)|m5ZIBk< z3w?xXEf%cg;EUIyV2+*C(aV$P+0Uf8M2w-*60H~3t>c}SgP%cR!a8_29-;+I+J^ZZ zx4hwB4#m%vUTU#eIAc}55xet{+20M={G*;V3B-NZ=|&?Pc${sYm_fojoc(;+XrH>uBK-@CMy4DUCN6)l#Mb>|g4CK7Xg zoG^LK^4!;#U5f7xivM{4VdN61+$Y%$X6*Cdi5X{21iFJrB{%po?3)J`-Ml zhsMgHMbbY4?QOIF4ve-%2L;hC8Oh!M@vr`2f6ss*e+FNYjLhHhx?(4x^s?81&Cu{+`6{4`K$X3 zDAO?{B@Uy8J&Er}IPajv`MYTIYAAoU-+E-lyD3w63i&zhM^ORI*Xhn^-tS#ODOQ>? zW6>0;r+twie2&l8>IF3thzx~5B7qa_>qh#B8W!UNDrgL`u3v+fTMW7_<4cD&{RiY6 z!P4=K_=$Zc&2O}STz6-UuQx$M_^)Xjg)}za?H&}U|8|&0=Y41R01X)swJ`jR6*_tw zPND#`nr)7+rnKyn7HAeszem+GGc7(wUQmS!hp^4?v;~3v}1h)LStpme94M$#^ zlnYRW^Lm8<_?}oE!xPxPjLAAPkE!)iKGo$s+SL{zX=Q&+8LZG*uaU~s1lUC)Tnw&jN zC(K=t@aK)8% zJ<$1;nhO;e6O)ouWeAOlTQc4UF)mYeXus950%V&C#*A=#uH#c#$z0P%Wo(jBx}(h5 ziAClS>x9TIo_%?W2oouv#p#@binv(2dN&>sX>+)p`1qPqJPk_qx}%!HHkV~ka)hqbirYl;-Y z7^t-T)*I-wmRe(hW(d0Rlyr8aa9txCPXV6l3$1cpXI@Q1xeOm~>mYNbHWt&pFk3+h z5)){*KXfo2>5j8*eyNq+Qw=#%w3F@94qNnU&&c1+Lp~U6C3?h0SC%{1Q~ec&+#YXj#j3u?#-E zN>33#q2Ib!878YM7V{V8l2w22C+w=Dn&>-lY&-L9asQ&r}Jbx~v5Uh&S#lTvWB z3klHqs`93wj5k}o=+x!vawo8Z4CnR<1ucC4wn$LCWEkZ$1n)*KEO?Kt(a!TU6E|F_ zrw5%56E^e!3RR#CYUjD0*BLQAScJRZEw8L23Jgub3%m651_^x#{O;}iVEzMa-*WF9 z|4CP#*s=C``KRsQVFhPSAU$qi@v2n$Cw>cA1!GX|AR*6d1cdh}8G!*(#;AN5@$29W zwb$kA8YJeu`M%`}xRfc1U~8HO6(J_A|q3iLccnLJG{su$#vK%IibFmU_n2yMaVs$`V-TFC2?Ht5&h_Cj2`f>%~n ze(ot0J3gRp?pmFD9JB^~e$f%2V?u|>+lGypkP<3Q#;U2nYH83uVYU6vYEuil-H>}{ z+RJM%)fex^k?ZBuRqMj$MgNW^LStr;uYDHDGZ9o2fmjC~2Xr!^u zoc8y?esWOK2ZOd48taasAv?#Mj*d<`^*vSE-zekO>2rWf`~=TW zUGMPIN~aIr!65)TSI|I-ATNbqP5uqv_$@_}??K=>JTzFOcrwNDTg;+lIosL`V_;2@ zJZZ{@jHS@L_E)+5^Dk2IRXQKq-*pX7V>0D27KL8q+P4XhxkG8>3>iIdof0Y~Av<^W- z$RYOMsOaL?$+p^<%wYhWJQU{JLiRuh9m)3p5Ea3vSLl^V%msM=jng*tKm0`O^@LF}KjZar{cBB8UGqrdcQS6!EX7L=Rq}#+78WS) z%2_eJ{~G$6$;VeC{fPVM8wBgf&|M50-y1N!uba5Xl_bIgwU$27``OWWS$%4CI@`1} zwEVr(5O%NKjiG&6a!6!CCwp_FJKBnDDP}mFXa7JLbmwh1j~^1Yo6*3tN_a^TE?=Wo z(;T_KtcvewMVlDTv%bjRAdr{*b?I^jiEGwDt%6ca)UMZ}Cj8Hg(2Hg&$ZC0v7z#B% z!8NHQE0_E4PNbnonT3H0aahr3c6=Am@fXCF+9c&ISz?DZW7?#xe4D0Z1e0r+|MJo> zTj0N*S%7|~=^oC|iuJvde{7O#NTmwbYBefXTF1Yr4~l2tHXsTEl>DeeJ`{`L1x3HI zczZ0W+8XXFwY)tv4Zvzz45 zv-(g8?(SWd1d(CHNk?ECk8?>K-~+DIb=5G&c;1ZY@J>OzI0R4Q_nTmfjUMrAB@`Wi*q7m`1Qfv2}FROqdvOuS5`S8-@`W_CI? z(3Rdl4-HYko?YRJos}{TsoK3ULU;QisJl0n15GDewrg+?GesGlG})|NahDuzlU_O& zz^gy^18|FAZnjVu|0g0Aq+wt6@5Ac{%2y}VHAmCFX|~sT!m(&{VxSqyY zt$zr0a+287Qe33Mm`fQaG1Fmmr8J=Lq&K}_a0|8C}f|{7UiQ6YvpaUchFOE z7QENUXj^e2^GpoN4h%wB#^}Wq>h1Uy$3=uF<4-eq!gO_mIlA4%x%N*_{!)4aTi#MQ zM?%$a0l*W}!Hbl>q}mtA^xCDQs@V(%4N4}vCFX4E*vq3u^p|Qkc8uttvgr#F=Ox?B z|GpDcX^Hf75O33fog& zb%n%A8~Kczt~3Af<8RKK(e@*C`Hk-GH>^VF<^`_azI=H1tG??Q9<%FF9AQNkRBF(a zUyH@Fj*1#>v}qoQmi9HuA-p3-#=IUymY8z8-WX>KR*v2gX%4p=WzM3wy9d}g4yqH{ zO=XK{D&K?3C?#6jpECWpOk(OgzC2*z4y)2zNp!ru9WtC7E0a>G@HzOVm!*x2cbqJI za^DJ!nK@BYn`Hc7>k|+LuXxo@5g>5ppd6q)sET4bmYk+sQ-U)S&DE#Gv|AF5y*OK8 zI?K9L(zOXV^Hf(L2fcr^VXOsLics@Tg^?>hZGqK5W|OccQKFhk_G6&D_oy=Ixgj2? zfC_&sbn5{M$>rTwf9m^~eW8U!Q@=1e19y*$y1dB>ikU<}aRR+{EFyycUIRUM9eR5D zCdLjIjOd}V!x#+p(69=t2N>i4%BDTP1lG<>#l9|F#7KIV(bOAr-Zp*C&Jaq(Dp!sOVYP~N2oMwaHy)N(Mc9XS3h*gVxce-J5d<+skL6l=;H zdPQZVi)|AF1!|DSYXmoQK;R#qI#}a3X;UTUO!>&h1>hYlr@wI+K5N#w)sBVcIYjBn z4AN~FRry)BFOqKWc(mM*OpThXz+KFg6+z4BId3(WKR8+;Gd)(6v&ZC&rH~J2u-F3Z z)-UB>j>cQ!bxJ%ukOG}hfs1|hpuqXB3)csdZ;fd9B9euEn)_i+REpSYW&CZ#iz&V; z`wV#|a~uQnNc?KAdC3&ZG#i#==G8%3e|eMytc9AvLjQDd$p#HM_e*t z2dHwUia5N^k#3`cHiK(2wJ;==tjd|;F!~SAlT(FXaIs;*MXyh~D3ncL^c|lIZ3a94 zJC@H%U(fL88W0>6dMPqM5;uaFK>i!`_`X7+@6o>NzSOuJf1Uo(?XO}hOA{kTnVO+W z8l`wo_w;|_GZSC`UY;!_SWe~_=Fo+*P5$?^`V^pc7vPhm21r0#8p&6K{Lj()c`XML zgcBr_xWCqx%MrZ@a+bcK**)njlKj&b)-?3uPQWOFxJ}VW4FBq_eJ~_D$E)(qAy^wlEy{ zmoS31J5ug#m{NcQYDkU;jQrdJ@g*~8J&ReezeX;_bI-peQfheWW3e{_9T!N$-fg>8U~AfPSeM+kY#! zR*dY7i6YT7MS;vrTZAd|A?E+QR-`&aH2-g+rnM7PAPv;lAjkPC_k+*d4g3*MlB66Z z-(x01scM*#RmV~nm|b;*+d%(rV)xj0vO;PN@lEq5??FttzMl-49TNl5%0$l2H>^d= zJQb`l0TJ%u9Fb<=MWj~_pMX~<9j>uxabZ&ds zw|(`0%AUhX_zx`&L5#BIbEt4Hgh2W9={eiSYD6$j{A_tpv&%8EkJvGWt?g>|aG;Kb z(G^UesNWr}xk-~fr>4~&vw1neCCqlvABx9C=c1~qjN*o!*0l;;)8QxIuhJ)r(^Dr1 zdxx;rxrwea&$YRp{&rL3aDej_|6HB`>mZ>m76|bK^+*-Rl&;| z2vwUrX4q|h5POdR2}O&iKAK6gJJ;rl)QbJJ;O6n`+6xL3wy3S)pgznQrvseR>9T0v z*GP^OXqh@RjHxf&2=Y4Rq3cmz?@SmCNNVk16f(59&xr`Ap>E9QozJPiQ-5R1?&j}^ z3E)PA>m!kdV$2I_E=^-4{lSHZm!*&x)5C-9IJ2X*sG4y8*Cx7wiPuXBVh?wZx21AA zg)7cq=w`hK&?ySU9n?BouRD!sH3>hvuYSBgqLrvWy8MMDv3_aels5*snk$u~gL7-a zQ@3L!0e|TVB4RNyYNU=o}UL z2@gGO*5Fo!h96^JtPSy|bHp1;wEIi#FGoJy*KASC{g4S8oGkg~gjHh}!MX;OGAdf_ zu}^;Ou5EO?6BXxd0i!!u($=EUpyMu6=huj-fu+de|ymJd!l zTCX>FyS3vn3R>#B0^zWYBaQad30!v*RZ5ytY~~#GnCm$+@H>NDVb-#=u;bO(^!|sx z49Ye%Z{iB3M=w)KH}t$P5zXI0F47Fjl+Ag(m`%A|>lwvg05|y_hylJZV^MwgEMM6)I8#Fq@ zv#c8$yh-Rw^&9!7MqT!(+z=$zP4lHWyu=WT0|4 z3LcA8D&4_L7wfb2i#Akxtg3&et7qyaBt5q2VWLSmTb~d#%Pg;N`-I#UlnoSe)+t)C z`E|KeC-M3g%>D$b*Px|&)f5b0!alN=XPAsMvz7@&_#LV&wS62tX57@)GrWJ8Q-R#v z8P?BHR^VL8m~AOoV2xaPn$aCcj8?*! zr7V-ek~Mbi)@C^{*kV~2qV|R@-nV+ivQCax-yGAo7=uH%EJhV=>tms?X%6xms}ReC zUrQZMCgNxq$`LuKUen=r@>+0^Iy`@r_T`KFS#LPp=8^iskD&yqo}(M{sbr-poSN2# z1^6?v@A5JkI5i)0W`4f|ZeQMYc4q2$se1n1qWU3wtY@N1#-M5Rei+3cJCvtuBoD9w zu%=O!UF|w~UkV)8K?{S)`*gcb@v}aB6|+n=fdace2H1(zDkJGD5zrd1YySb z>qmRDi9pMXItBK$>H3F}$f*CJC3j>nage$>9VC{qN(mXhDeX5v?>UR}+E~m9H<34l zyT}GqocpRT1BEqoOi{&eR`l;yxdj5+^vD(4uo@W)wmPpuaGEazvyhGCSdAn^Zp=d{ z)gT9UrHAjgsZ3bhSyw5_CJYy}0B5A?_%8z387!B36RBg+yX?-R(c3Yeh9axITSuHe z2aOZ9hi8=c)Q$Y@GjZ&9eH66mk3NQ)$d!#v;cEMGFcW35fmf9T=ZYVYO<(HE4k;B{G1Fp=*U3<|= zEUj`^yO2SF=}FanvbMJ^e9#DGTU)_4)LaGm7R&hTtyWC&eyU>y@}^i0SmK8WrIq9U zj8^BQXjUqcSSc^hO7^SW%`#B`tG*Sf{~L%rkd664^YqPd&`9_suaWbVA=um;csyTn zm`oH1<9-ZW=|xRxZ#?%FK?N>1-<)}2iX_7&^&h0ar@CnPZZuZZ=&*@3Dx`bfpA-UD zgfsp#$N7@bzXVfVx{urA^381Mi3$b5Ru6L7vg`L!1*~6NBmQwo(H%yfDvgF6D-&~X z!JW#r)?E_)A0aRF-g$+4HKfDQ&JZyXDX>~MlnHK%Gfx0JKvwZ zwM?qgE|SX(d*8z+sB^Gt*RHnYiX%9}eP>-4xIVI}{mW2x6oCFk9~e1cf5O!M(2zU& zqqgw}nJ3~qg?+JviQokb(JHT5q!Na+?o$LOJg7)o1tnWhZ-*uYVQ1?%Y*s4*dX|!9 z>Wwy)FJm52F+)vp;eQ>;MjyqhK%BpU{py*pCH^9RyC2#4$z*cOBKk#t9@ykP>#e`A z{@#CB{j7~2=^fzZ5rQ+RLG~m4+3g6+h(>#WT5l=}-7W5U%0`AQ1IJ&D0NW(Ii8V;i zzXlIxwpqL_MXOHd8FM-g&eG1ZS`-xd*Rl}j2lWMPh&!Km=2ldFm!5l{s zt&VgU768z=RZRIMj9=~p+Wv%~gfcTC-uJkrzPnZHfyRG9Hpd?!QY-cde>=ePnV{$$ zIhj<)kQ@1Zr_fj!R-9rJ$-kDRx0Ncv`&e<1)swHhR?p}h26b^XFW2H8)O-3VH@KOu z<{!7~tHo8qk2HrF&lp7443T^FBFJxZMzHg>So^jTY+= ztQ`bjd*hRD;=QM(``0S)rlWhE4`i&~84&P@NxfyVvWi9S&B12D0%Z^c&Bv;P8n^v1 z64r=by@EuYTh%d!^QQWWPYR?pY?eP78{hqjIR{BCDD0g0ga7u7skphcm=kZz z_oM={f&Ixb>7?K`r_)jUuZ{mB%{z8c#J~)YKy2l%??7#IAiq5`S`w3h6kPJ|v$j>n zXHL@P|FHzlY6S0(K&HMgHLzTkztM!qa5y=uTp4lMKTK=&jlt)C1tjjbmBaC${*aN~LW5Y=yZFaj>rbmn_|LmcdB^au_u3Aq>_`ZI>e3Ru!sEpRtoz46NlN9|7x%q@2vDJt+ayh zaDra#AU&Ak7dPC^DtcN!)w9oqaC9f&?YKKrUx^>-2IFNbekap}MS){@&@Zj=xR_BBQG8~N-mXRj85$&qi3H2>7~{E zw2an~4__hM#+&ANXU2w60?%~zkSPjY?j=xkvs{CI&$!@VM+Wq`)i0C@6;c8YuQl7s z(K34N=l6!82fy~c?~#p!(Xj;!99z$mYTw<&&Tz9g`t+Nl0(XDvtt9j9&-@}AGn=cn z{B#)ZS7BYorUc_`V}j^GR_cX|R;$WV+Z>ib7CK;nhOJP ztMBN#jS1HrzK*k-cN7?W+y}3?4XoRe`*%raAfnAdvD(PMxytH_K#x$D{A^Ik)UjHD zq}dBQ#|LUdEs0^ma@TXOf;WChuzv9s7`WFn5?y+i?DLC>ZFnEig2Q}}cTTtX!F94e zeJ-w<&Q`+bqSz&CBn+ht;#;hR((y2H&!JR{3=;*sQj(Ry=LX{Fa zvc_^BB&gKXapXVX;P}eugcpY>ES04Th+50hWAU(aHfvkx_zRSO;#Lh1#Pw@zWvWAy zAnXzh4E_?+HTB%gl~s8IqK@eR?_u9}jsr0rq##rlJ|d&}s+M<<7)YQrVeG)22$r$N z+%j015&{HmtnCR|DRE%cxCjM9pX4?U4g}Rjm_Fd3_-g8ShvdLVQSu;Al&rRpU1A9m zO|f(2^OsM40Dbd#enlRVb|e^=zW%Qwe~1jNthnv-ng+tKE3&v$au8|I@FMA?*-4~{Kx2+N}huc7mt)Ii{XYhCt-#7 zX_)|DA#>HeiUqAn(p)OrGc2%E|p@kX* zb#-|pG`yggR+dB3o1Qu;zMp8)k|9m-7*)nRkdt%tZpKDO#qe1kcSl256UZSYtJRJV zB-d6cBV^A<7o{F_vFCpXP4}EXnAFUlNGN@>UX)H~`ShKo z)&;g8&=sy)fc4lKcCN?(S60g_3^z^Hhr9L`D!KMyVtc8FBKrKzhi;C~l^SN4irn-x zn@~EYd*X@QZq5~^2fDR;r#GPspD*lH<41<(-Yz>^rp1}lTCYvon4*7n)SuM9%AkRHx+t8=-^!SecWcBQc*spwxNy;^h~NS zJsZ(}E+BTJqzZqsiP{fQwzfE?w=^`Bd`adQ@4i*Yxs$uL(CF%UqQY$4fIyYp-rPEE zpETT4q(tvO>#WZbD9`pB?j2gKLRB7S@{dRxorgsSDi;z&(cx!T$w)@L1@s@A`ZrR3 z52op>e))>wc?c>qhBf-$Q(J5hf2_M#o4%US&sqAG=qKCW=!^z-MfKEVk$}ZL?VJ?e zY(03BH^&OkU0V)a-OUZX!cE#mBYR)o@jY>e*>WsvRvUk%D^jmUR=YOu z0Sa~w3$@cf)~m$BQA_5D0B$W-IdO(`J{NGtUa3k2UkrYGVkTpHm|-|Rxi(h{xSpK( z!hT$QFVC~tJVmAvB3?s#*jYa5wUcPzkZ)h!UF#v4WIGZhF1>8LR~z}dW@glx1G{+ZGEKxPyMILr*G?O=C!0fgm3V&W z89sb4B0Sp^da9m8{-UOMOz#8EWwg0mMGN0+k^R{f^2&6|=)Qb$o~a5x%kN=ry71jc zSy?%+F@$Tnn_SgxL+aJGkSWI<^VFq))=Cl;#>-=R_h8PI=6T+7wzxwlqv?E9efyfu z7od>(q+zbc)4^qOW3+D4@;kRXIHrdw98GReL$}5CZ&c`5aeQB~+-&w{Ihf181Vm9e zt*x61tt}JP;Jt7)qa(hoRZX`w2*#Dc&eyvrEm>L|NkR>=cW-%1t1yfNsHW#w2d(~6 zhF&QU9DHx(=)YNB7~vw|gO>hS<%xNnuL?F+M2NvY7Ndr!H8E_&$P(O?^6YtcHi9wW zGF~P)Gy61d_QPaWk1?bGG1K#+4RjaBh>}Ej$)$m;l(;*#+nL)+v?BbOk=#u7Wve5Y zvK>j&oG~8vIolJcdAv!8n~1V2OPTng_~9LIHBr>t*`jGZ-Ul}6%rAEXaGI?ty8Fi* zE&T!8vQ?Gt`f8V*h~%^8a1S@shL+{MTc?Z(!Hwoc3OS!*X3a?oicuGL5DYqB=9&j@ z$;)WJ172#$-*;*RH%n$UK-ItL3~A=-p|JE`>!g8@j{KmmR@2aoCN1`TZ{cC_edJht z8-El@>eCFP?TOv#5|5jm;Z7k>3OeE!2^B(o^-TEym!r#zNXDR>R5$~s-)O-5RG|ZA zfOut-1Mp%^7MUlddzQ?_ToU;pJ(>sn8V$B^QKMm<<}lezC2rP^#?qKj#Y)vz>ros) z^kYQ+ZWr@tkzM)j<&!eP8ml|(VSatCYry=G+F=$k{buttnH8HXm@>SI-3GQ)=@fmF%qM9pbC8-sQ>qMM(X%B-oH*nn?5 zl{vN}d^6GpC)-nx3j`d}y)V58X=E{fxpCFsYS6Hy4WUb`0_Av|`?E8!L8;mJY9g3$7l21h*MQez&7BR3;q=17R zOj9RSp=oxU3fY!kb&$7fg+3|GyG-|yL>GD_fc1I=1-CP_I$CU?&I_tkYCRP8uD)W? z>JKy)&yAfT9yolym=7^LB$PAxYQ;_F8Os@x`>NyhB6WNE4bN{J|39X#Ix6aJYriNd zCEXz1HFPT}E#2MS9V61+-O}CNQj$Y=Bi-H1H@^4k{nna4SgbSg+h^C==h@HpiryZq zZTOtYiils(`r{{}4c&8+JVon=os;MSyA|N-NK%1Fh$miO;5HmWvyq6up%9DDqj&4= zzRWuPV|#`kEo7 z7!8FS*7xl0=^l2gtCq6B0Hb4;ZPb6iFPOoX&v<|jmeP2VSTJJ_&@>Zi@D@uYuFiBu z!OsGFggUUP8BTO<{FD`VQjIJW4;@~}AImRCPnV_A4dAP`d~w!Pt>`6NAM0zHuN|~v zfg{qvn`(w0=%VQL;2SLzKJC-ysgLd4PTtIz2o(0Ht$r#+?qqAD-{!pR5i>DyFRFrT zjiyHf3z~^qH2izE>vp5ohoSE!xijY|Fuf-krg$T7qpBLjICP#Fzr5eJL4%N;nY-Ey z^GhD%%Iv6kf-j+JIy-Z@J&~Z|l;|dJdW)bOS0&N%#HzlBl+UW>4+D?{8A1Dj6@1^x1t$VD6D~(b=rmiMyvR&4n#tJmmeY-gmYUcJj+?W z+!}lDYI)0yHx%cUx~_@WNYUHiyC~d!iH3_r<&2L7$`<(U*2Y<%-uTU1lCY*`5*_>T z+oA{`M%NNEMO%Bo6>U0ej;kEmH)f^W3w0FR>m1Xa$5G9uz=Wh7x6%DbQ)?Hyb&7{a zOQbHJgtV7=j17UP>h8AkR3W0^H!hMkR}omtRa5P*wC}KngXJp1vBYbhh6D2Mg?#s@yG4!fuyx8a$2F?ul$*|*an* zveS8*G)wzjy4F+lN`}CrN)%1gx-19J%aMJk#m&Bj+rIKO)6WG0r zzhY7Jp49-JQ7d>)xiVAt6l?bFIC>#EP+AjdF_(|gHLe#VeJ+`XdTVe~OUtckd##90 zL7vyjKKMFVsLY&_#)A>0RQ^IyY7+Wg>S>WMBoRqVHAtFUut2U14T+F7;Qnzi;^un5 z>OvcRp+jy1qJ{!tH|O84%Mv%QO7JJ^JWsjkd!^x&b5pg*EnSGDZbij|knu+BneF0& zGxLW6M2@Q|dQ&d&=ltlIC@l^&zX}}Td zp@C!&+*6&crc;^=zWn;@s)J%MtLgsdAdp^P^Ei>kgw2NojKx~#L-;V4>klvS|G-wX z^rjHs@Kk#cji9XkI^XRtPn}8^$ko_CRt+;+Zg0Wr!tB*j)$d8^q$pX5PlHkFw5Xyz zL{qVH>9xC}v*uvAn*^nbBH24s_ zLg7-cf*#QU7ll^fly7_hpr~89Bsp?AxmG|o{wYC5O^~(H`O~RQ*;r;*#(ctuNk~QE zgS6CjE@+|7OX!n=Wmpo!7^-AuC=&8kU&Dv6oiWVJqI9HZhy4%9b^>HRx9ymq?30td z-5?kT$TeWt?nvK-h{TXeKCT}ZNIxVy)>)E>RV?u0iA0T7mw}m?WKDlQ7ZHpMV?T$v51#aLc4k52MVVw^dI^4_nbzNx6YLl;wBK~Ux zISz?J`A5!gr+OyfO(oIIk3CyLv8;iJn?0zDz;hOPy|kg&uJ;dhg$lmTgo{n->GHj_ z8kK~Qc|4ngWH4V+Wixng`OK=;$X#}|6Bsfu8l?Ig>IQ416T@c^);m3Hoc9JWPXYc? zix>_ETa>jXpn-7eCe{Jz(C~t!73-~^x$6kwVZM$5I~YP@;+JNUfs57~6PxjvjH)Rq zH!jUS2ka8^dg6NtDN`m=aowMSS+50WSK+E%U(gBlX0f|qn;q>LjeM$DOM%pilnzn8 zp5hxuwhUUM(J!z@Okdvj=86mx?8!XZ%Ml6;6r|rd$fbSz27?$&H(B=RSeGhY6n#1P zkWL|=9H`iTm8X=>?Rt+36NafmjDzd`g#KyC*jO&{pE|*a^(ejE`{)OFplkHWliZga zQ5Z$O^o0&5u1~S}Qi+VxVbCZ^5?SX@xxJ!?k;A=7jOYl{#-#E=zt;N$s3QLhaq~mP zs{UqtzdcMLSf5+_0>(*M>OwAk6KU~!2xrqCS+75_Qq6nu6M(+J<`62Y0rRbzPi zd5!=5ulVfw2vEXn`_I`7&cyFPq?enkjYC>&CcUu-g1e7K(uL(M<}DU)HKK_6_UrJK zR$H_A>3II4AiMW4?oA>603<_qUdBd!PL0+}eGPD=m~;xUaWDYzOQe}z>|S41WXd#F zk$zBLHs!mQ@ZjfA&k8cVOBrg?NI`gx_5H^R=!CXKMb8q zObRz8lmPnvRU{E83{>6cCQ9)W1*42Y0n^h_FS#rkW@Md40a4WU@GsbzP zq{=^k7XA+(|9hx1oa%3h1|@inj|yZ^uX$e&&kgDeqzsu9p?iDQMJ4~%ya_P>6((`T zEwZNcPY0QgT6I*V6|cD7FDzg`zcZ2F88-#qt6-2Oq1DcG(f(9EteM$$ z)7j5RCx>#c0-pao$$Ioxta2oS7ADKTd`Vq-XD7WgPd7xbaj5!G;C3>lSb@x$2`#@*ZFd2FLaN4ey9lE z#C|5Y>bm&G9<46J^#?VxKf-e)wA)?7F%RnEs7eq?fx3n#cEG7p-xfEak^$@8o)c;7 zWtSK@dH>LC3d$Y&mN*WV>j##gt%I7Fxz*N7FcX21F^$sR{X~aXnVl(dL)yg$zmRS> z3VoQN^ETBWS!kF*2g6nFIAs!X-a#7e45D@Cv5H=T{mygP&MQx?+3haD{sq={Z{a}v ziVJQ2=!}E7D-xwdd9*1=*?gzhO8J02e)XvE`;+LD@yq-WU#P*f&{YrJX6lNOd~n~V*Q?F( z6P=-W;~kpx*+5g3QZ{dsfABC~uB@upxpE#b#Fg5f{z1pJ+g`GVh9XFQzN1j$X-OT@ zA=o@#N*=&M+%Ug7^B;bX-M5iSfH!})*CZ^|YRT}{n@N#HD@|>PrPyWs8IUhD4!+>} z`EmtSpX!|wh~X7SrZ7r?2p&6y4B4#Da)AQlt*#~Chg-YZpRhl_tpgNxlo<-`B!8+W z;Yf<9OXoIyj@5*Tv%iQD5}_WYVvuxb93?33bFn^hQm=M^b8T{) zu$`g9pQ8mqfg_a<*@FfO*w`BEv;eKBMW#LMK&#|M-2P*SUiYnp$Xyru%`J0@h47E6 zo*u&Eyw?uQ{&aLPrIlkEn_a2Uu3$kb246y?E6i9y8qvZ2?DSkl*#ye-@>P*+#m<2=s0plqUCyrd~^Zi8=6!{?ZF+|TU( zWh+~`d_Dr7l7ZQg#mPFEx$G^9QTzw2lcfeK9Ycv{HP2WYE6%xlBGTXyX?`D+FBQ5z zLDx2eC7A^3b=x$W!J_PTt4V|w==NmY=@ZbY3#~oLSpsbv9T#r3%>f(WCm8M3<#_&U z!VylQ5AqsZnsW>&g`b~Q8BNYEMz|?KqRCMel85<5>7X}?n9s41BdV99`=95D1wLml z_)QeKrE(00dy!Hda@xoqvM9T%4O@IVY+fXv8 z?GDoFixs}X)R`)FxR@z&ny z`oxHSys3iGZpHaLu+ncaUC)W;HeP)yLsL<^i&jsw0 zb>D$G zq!&G|(QiYiCmN)^v~{&}MeclymG+9fnoea-7Xn;GB&toe#hpW^ri;Azww5j3J+BCz zuq(DS64K~y(v@=csj^o2qR&YD+S{vx+if#x5_v)$*ASoPCOwL&g;Y!Bz$gvo6OQa6 z%W9@4mD|R2>V8p?j38@HrwJhPksFB!4l`{9Up=+7qnX^9ru3H|-WltgW3xq`X$@!M zxe=_Om`=x;?6tRp@%#`3m+NWwB+)W$jCe5Ub{n&5E#Ubg8!%|bC-kf86F##-k%{h3ZmNycr*QwD$uDB$e1E#kg_s7a1Q|Fx76*JYgDb}{G~&+v8Xyk;GHH{^rm zti{-~i`D1iP%@fxR&oJVwt9K#+sZ7lT}zvv=}eR(Ns!{LIbcbKXP~fUa>)J|^pGi? z0$lPd={RED-_ukks!c)1!??Jd^ssbJ9gO0bh6mb5c?w`xd(0}oK0XbY9e#{}Nmrsy z#&FtY_*F9LS9qh%@44qp>#=r-^<@VX}R z!_)7MVh$+!&q3=tRA|mGG~{Z8WMnic7V*J`WuXriz@rf6)m^tPkmHX|{t7lB!)sk~X^Dm(xM(tCnvCkz2FTk>b4AL74$AZi zNiF29xr~#MaQGhMY9=;K~*Ljr34IFE5Y4X!4_PO z9O?6;hLF;LcDP>5C!+ND8LDrVvca|Epzs(B-)mj(EK1_Hq3-r+g{y@%b8awR0&R8I zapZY$E)?NP6oI8~{YHK`E!#o`L0YIwk(c?poB8a;>tQ?uP4DaN(Ac7iQv`EZ&6+$} zZ@APsO6cP~o1G>Ps0)$Id;4v4-3e<9W}B1h9m*uO4eDqzq(qKXb#U8^v9tzUyS0lc zPb@J_m$xnmLq;59wAzbkhH`c=+}E->otSER>Tq(3tU4^OGj>K$qM5#w;*5=OEU(bt9nCsN5XS4Z})Udi9 zpF2GPh|H}UlaQvpXgkyHxH{`|d|~D$sV_MQ9a?iAwuJu?@;WxYywCmhN(z&S&y_P- zt&uRE78CO0LDF*vn^}$Vd;Xqd>kYv-tI+2NYpv`c@^+e(IlL+aa@qw$mVRJ}1|xs7 zCFWqJrGc9})xdY6eQklRIHX|AQ^^tG#u?|MzGe?y;|RM#r!rONtlEJ74y_5FHQ1@* zv*~&lX2eAoTK{#*MgCftM*6@h=p5wbSghra+rP6lT2oR`L4*V2lO;dDV7;<4S+7l{OhtR zZI&k;h5?FQ+)|mkP7f|K@L{_{-{N=dHj=WL6gFq7bdrZg)Z*uE5ekOub3oTH%EO5% z#AEnVj>EjQqJ(*?GaU?Bw}{cqrvLRA7? z0&;ZL*k|23W}#%zSYZqK!J6wbyXB{0Yq$#5uSZedwG`>KCz z{odmlYHkd#o3ko*^a}hodZ&}(U6-)GV0h|$*PDjcQNy`oJY(tn!HQ2_Nw!NrBN?+8 zxX&Uaz*H+Qz1gqfa@%}BnvNs29~o7w9a^(}Jcpdfp5sOrWT@79YXu(5e(n_-(qZm3 zdhD;8>(sz3#GL8pk$X?)LB+IMQhmNIoyhOjul3OPHo1zKyfY;#>F$k|S$gYY@fQ*c z>~<4c)Bthl$z}^K{$wW75*yqbx>=*fGu1d=3l@ohFEy4Nt|=njHIG-O;0x z$LoY5B;M(}BJCQSC2uRzU2+DS4~%7@b+npt?4Kl+XI}h(%B-zPvY#7<$24jdqdAnG z-e+`T``{;=$|Mg^xSohyz2jMEH0I~i-8HZrbX0ae8de4OJ6EasqhR2~vbDTr6Gtu5 z-czvm| zt?gb8bRZRD?LoUNO1w&msByO9ByyN^Q`9ZxAFW6h>LFTQ$pFhP*ea%ennnE&%T15^ z50gOq0~*L&<^nAR0Rc7sZV0p3=%Yk}+e!D_$x+R8vAgdTs^zV&Tz6Q{Ov!xeY`QAi z^PuKq1@K3lU?T0wT)dvdjhZg<^YJZOI||<7{^DMRadW}onY9K#5{D_j7bjWnviTdI zVDyC9$ajnJwDg~pf>8J7v7qiFEu|iJr_GfqU>;+F6Wopl=T4+GIE%3kr+h5-(sUlM z&o*@fALCWg_Sqt?4)EC~Drlf}bB)6cu&#^m=XmpspIElOAm#(Jg#DyCG!tp=-GXkQ2w& z;Kk4bY=C>hLD})XY;~^6I*Xjui{E6rDWw}a4|FloaL|08?O@-93;0 z7|JZ3t!5VNMD)-(wUP|dq38TTt&hPpT!q9o&z!aMxC$2_)G>ycJ$<~w5)YZU7FT#+ zY`H60o*;>&+Zb3bX~WazLQHIi&RSld)#xP0ns0MWcUZ$1jxfF$hw>m|A$S45jQw&s zr}uHx6vKA5jLqtW3Z1}CsmBJFkCR!XENIaOKkoY^g(Z&6*b6~&i~S3V0kc2eUW;F5 zTl=Cw9y2w@oQZk7p(qSk(xd4W`dB?^JAJ*~G^nv$A{8o}Hj^|gY?crGeKkHod{)q` zCBSo570}YXfYLy-W<}aETV&301Kr8?)WH!BDc(OZ2#K5`4KbSZN&zzXB_xBKi_0i_ z`@NX+#VZ4#S9zpPbjud&T+!3cB@(J0*^Zu@HVmtFAN;44Pq?!MtbB7F3tX+2PQ&x$ z#wsw5@T!?YRPvVFd5RX_%dNuNXw@tK+rBTi1aMk3)%!diaDoiD~mrhYu%Mnza`Fozzgq$rfVc^-b? z93_%1(RC_LJUgR=Be_&@H9UcC&)zjKgp&@1Ug4=vs=F9bWNc&f31&9?5rSfe-seWy z+f|h&`qBN9cq0R%0;qU*DWpHWDXvd3`~A%uwfP{1g=2X-xRi<6$c#+>k|cpgW`ZP8 zMPAv3R}8}ZJx;0%6WVmEx*;oTJLHTq=pMgyik&1dDxOU@RIJ&8ciP~qj4e3eTH?=h z2$M+Pwq57M7RpX{jSBkGSwRg&PyMB!6LObK3(42W$&|$KRm(nS5vESi&KHH!?}6;E zUde^Q?W4ywcZ-dV&(vie;26Oe8%V=gXVzC0>R#}GNB6&&N4V-~P)-hJGm0ax` z!Q+)vf7J@I<25`ww~R5SE)53Udp25v$j!%EC}TU0P(Y|K&9-0&X_s@~z~xw}q5**r zRso_}cp{Qr(dx?8{n%-Vcjzd|43cbr55ERi$ay<5ZIWPaZT5~*zB``jot1DWq+dIZ zF*gn=+3854`?g^8XfdJBMPj;K`5KYvv8h-*Fn0w0j;JRyqvBvI4K7Q!P=+4W^?qEu zEG$R$=JEdif!5~aSU0?p&AX++lZ5~*Bgb|3E=7cC3OGmFSOvN5iX2*U<>hdsqPhp= zvEw!eB9k9|X;>C^eUt-Uz3sz&&3Ko%y3bym9cQd1XsKmJm%#8`I3|@U+GcTld8PdN z++wzA|4bgvR$~O?*<_#h`k5JmCF^T8SwXD&Q4!sm&E&hbXE2Aafs4OQ1;CIYU?I%yW*xFPmb<-H?Y#=s= zMHLtDB_t^0C_4TYt8C8ujp$W(LCba&AnvdW84GW_($^W!mHMk8#JeP8t$rFp(G%<> z>#01_+j0_)*F+zYCRus${R@}x6mibew~=dG#W}~|dBykW5Ez)D6d7fgST7%pW#Rd>q_ng89PLSv zTvD4H-I^_rH^pxnRIJdf0?`WC_Dht@*!UXV^EeM2suYqP1k)ijK&IA3yqHI<+5F%* zq^>dD%*2@ufi~)izQU%x;izj?>__Mrq z7Dt-a4W&StAjWN5@$6m9XAj)?La#dWFO-i}9v|lh(`nX>=q!YzI#t+K1}gA7upd~8 z0tqyZT&bKc=eHF_LN6)r3kxcj6ci4<$)u)jOB*GAN*xc6}ra-DM)e7%H zoR9D6#~w9ccc>VGCIKq8Ea)S7i3j4JEL8g-GvS{f&j%>W4k~fUA99iEU1#^u79Hld zcf?Ig9!^v^x?VHC=1aX~-9Jfe{UdsO4%dm;tA1;t`+N|{T)ByoLo5D=xgyXk4_0HB`P-eFg zuP=D1hRz33$QI?HI}M=9nBwp6jJfBA?Qyu?Ij7%L4cW)y6KQmLkXv9Z)atAA>0%zs zj2X{EJW(k{uc;E|DTgJC@g%GxrOU?3IOTJzQuJLjCqHjpq@Xki&H0AEY@U%K>jAH! zl+$#$^u}1m7&NVA)@=4!yi;b#kg}JrSYRPtpcAoLjbQ&!HyzeU6}`so9aOAX>P$oK?7lKU0_P5!gTuTq)stR-jx=b?;bi@A$&BlE%Kjduk&!6! zqW^8Fnw#0KCD4{|y(b#Wa>KZ6bBUBh+&Wx8qHH7`5b8L)RPB1?iQWl8bWmA+?hpmC zFnmBiyC8xGdZ&iXE(5%@K9&Oz*hVB=KCrlHwazmID3ALzk-x$l{ zMITkgZBmk_<)ZpXC2BHiw7Mc6)E0_?kMWGCZFAJ7y_L;5<4&}84b0%pdJ6?+ij`Cz zpdgSxAtoxfBKgb}XhB4B$*p_4-;kB+0$0z^UT(zr&d&?pNXTr0d8YFZ)|z~8B`U(| zy3VK^qR=Varl#{f;G8`<>QtFb=SSBF+sr<=y+E_{pSjhm0Oe2OS~XG=F*d@&>=-HNRxgSa$obJ*C5viXJx=v8P|s~TzM(E3cmtO_XSksS#gJWpr) zr%nSDZ)QLti%SCGHHZ_cW36~v=IF(b4DzcuR4`dUmnsOCn8-A0M!qm>qQv8rnD}lg z+X~VZ@te75X$SK7b3)hJ3X9OGp7a$~991jDZ6YJ70@6!NPf*X_83#ww9tI5u;TsDFZ z{OD{{8RFxl{uX|iiM?U=9j5rBp#ETKXf5CwnVJK=72Z4I_st@3g<#*78^lCdRKn) zAvF?djc_H~+Tw;Qkd~YgXH9jJ#t0(=3h5BqF$sw|#_VRwZ@%XV$ z?}mkyWGVnH`b{1#hX-AYVZ|FwO9%jIU34yhitNX?P$|W)f!ki6jNiX)z1#4c#8cW= za!jxq-e{anovFj~;FZa9R2>;UCog3u4p`rXS&)F8u9D!&+7RxmlXzBc!dS&mGL4t8 zJKecYjY@Q+H$lf*_NX<9EQ&*#FIx@Sv6_c$U{m3Z`A$tz$oej;^Tnqr3YYK7k&pM| zS)cn|$wT?M;~6Tblo*34@dU-ENujK>gaX!|ciB8AUA2!@D1K_fM&}ZFc@>HP z#7QLxoAUaziGjf5l;#YD;5#P{HBv%U z;y#`&QWdR8gSs<@V->0-ndiVrYLYniPUL727nxK+ykH4xb6#r13ySWlzz41XwtJzy!{WH%wVd7%_{y@IxAE3w~8hTt@7 zNv0#qX|dhptt2DS^P!OjUZqAI$B~cEgvD$Iiu&iO)a9QkKLUSLx-9N;1fmOpg-NFk zf-3pN_n>+g0F@+N3~R;Z5YFh%n1dn=mL@yKxpCs&S|7E<^mpVZN^C|`@IP#ibGO^2 z@8wROlRXATt8~)r85Tkjwp*w2j+8m8^l~VAuV6XJHC}3dv1RAoyk`dF%St7ES7~l_ zA(fP7FDSl+R*UD#H(T}I7a`s_d_^R9!Rb_?Vy&&ovPGmE3nxdnnxQWm+5KfF2JodE<*9mi$cuPVwB?;@doC*Tm%0)D#>$KC0bEfq zLOPyMG0#y^biVN*DaB+7i^Q{J=8}!O#SF$ZSs3(q6#G6;(5=el#q}_0TI6ESZokMn zzbY%)K6Yl?HEEx_aV2 zECCMFrZJ0)A7{k{F0Qn?YbRe89B5N0?hx>3AE889)>*7Y^2=d* zO~%gf22LWF%Lc{E8K!BRxcn-$Ai?hW#E26EANzGqQ0lui`+IBy*4N~#e%=(pEgotn z{v7?aQFDYM-y6u0tS&X-!cag~cyUce-5i&fFIcU?9}G8ZEw0synWV--aC_RT{hXcc zWE~PlF{S^g1?;j*#=A~>>6u)+^>OpqbA9{?FJnp6$Sdm%ESr@Aii(RH8d*J6aUp0d zp_$ZQzj*Z-aAKgDbdTSzx@{8N#EPb}FDzTuM39b5o6lB-kAa<}jZpO2_gTy8&B2OQ zFEvH(PLYH7BP3qscgtt9&GijxzBBDd7+7dg3I+YIdZX)S-c?Ni)^-u{;p>b~spXUM z?;a>f>Qbw#_j&GI+_F*54PRSC-ET{tnw0okd^0-9_r8=nGQKmFmNh@eKsjFPH&O(6 z7;`y;_n_vIUf&@{d+$9H`S_$cI9Gc)ofe0{PaIZHYF1+8U5ZF%{kWC%)I%YAvknQC zkgnHI<9n(^O&R^Vb?ak6!Q|&0IUi?JoJ<@Y!?Bt1^@l!7)1$Zp_Xpyf?cxLFQLL+? z7t}XCph(8D(GJMX=?X1JAr7i!LKjM2+uQ>PWU0E^;m@f=HCm!%)a;Dse0g7RcZ|Mx zOn?UO;~v`Rzsm+(6D8DL#W^n#nHK`bXSY2MU$orY8y^arT$T?^(Q9+rNfVT3x^ynp0OC%V9$Nx62+99fc0z5yc1rVfyyN|+GygdiETrFX<>e;(g`n&?S?RYidCC;zuGdmE53m5b!_7`5S@*4lBS zh?TNf8A$# z+0Z{P@7^dV>`xU2#^_&j*?qeFrAG?SQ}B1;Ja+Xr0D@#t*X@UUVo=r6VRWOZ?5Ikq z{zCJC7ex%`Umx?2YBd1DTLwVyYX7=3JMy3S*RTCt#7y!vpx2E$=U^V^W~KzUNTz?L;mB>?*P{B* z@B0V|Eff$wUedRhi0=Y|^Zx59$8|o(Y#?T7%l(<*O{Q-HF+~F#0kR8kRj9-&=A}p5 zl*5^xX3sG*fn>tJ6vEw)Fcf%=uYz&#LWy5@BAxnuMP0U_gVs?En3VUGh%}=9atoYC zzWbco$F<~uejAKfT&W|H&WE$>e88gJ`n(ATxs&{(wObj#Pm0oG_89~!s!Jba_vDKA z#(MWzk(KtwRq+b~{{F&q%Kz?(&kzdO7KDWt$|UBnmNtL$uV7gJV=>i8 zKS9hnx4NN)9!@f{>4w_%_gC3p#vvyApVzr8{BO4kQE&|M9W9h8V_~i4_oZxREE)WP zJZhD8Ega}=f8^Lr{TqA>u^1r(;BfBir;jcN=u7P$EM_Bx6urf>TmO#(FAQQbKR9=%z;jY# zxW8rq@m4124o!9iCSN^!-mnub8Cfo(Z}T&={?-5YeofF6cu7!bZZHgX86&B0XCnz9 zqlr~5gLeMz#)mim(H4;mtS_1Tp^fHfqaIg=+^+oNjY|0cV@A4o^IJ__*x$YoG=6ksN;-2vF^{@kC9Gta+6%+ zi%ajq{w(?m-~KyJ8{7BMLfzztn!}>>&6IHsTx@SEFXyxV?}zC^9G1Ktoy4=|8*%cb z2s{M=kBH4nEJy|htoZz^{qMr{kl$XFoQTrk6$mxk>0?fxFsR*%1mP$GgHdV&|9ow? z8}sixOOfq)HTs7<)NdcC2{SvMiTnJ*s#bnY8$~zxmlz~u`}fIVByV=>9`^|_=5-CP zGk_FBgZ4Egp>OXLqC+@bfRHphFP(6P>%4 z{taxy6y-iK>OS5I3g*Di(R3{Ddr$aM;wkGMV<|}n2ry7)a zdn4!>0?r(ZFC7e4vY4s(tsmw^3F6_5I02C|#FFW|~hJ@iirUJCD8bUGWb^Ry+ z6cm@2mm%T}3;ClF|4!fd?JXf(uQw}q?Mm+4t;)1L`X7N$Q7hbc0?{xQe>~Q+#P7Vx z#N=M+cGIn?ZD|lrcA6?>WtEjl>vgq35C7ls4!{NQ)=oYokQ?F{%j6wqjIplk-x z=XQAGRJo$JRqlxL=c)a;=^)s2h`a2Ythv!hD`<5_usPLEar)J5zeQorp1s5G_=o=E zJ){HSw-lp&qu45D>g}REH{V3)>ZbVG;+ZW`BL5Z7J@4;5A#&q68ia3m_hZu0G?9OK z5$aicHHsqpeIWkxBC|i7kyI>r@Jkp%???_Aw&qMr z%4{#sY~oc9>kWbIx_@+OqYEK}-y<%A#|izCECKQfUGqH@c)rY3i~CLp=1#k!E+=$B zN=2+@pw|{T^1HYgBW+YDu*w- zqK6x+!E2YnpF+T34I>%7rn6U`qWe}>4WsoA^1H_{C%J3(`*o+Pn3(s+Cnt~*6`PMY zR*uTzeX(uCj_>{oP?k)?Xzkm32v6QehCQ~nffPSJ>}yoVsSdii zDt;8vZLfExN5JT#W@m_i%x!SiWE_{faK|S6He@|8G>KNB+FKX1Cv}}JRMO8E+Ze=Xa_*usGF4CHS$Y2Gdyu7DgVa(aV&>{H>m5-;YvU+hd|Ler zQzS|5j6V2$g~_?OqT>DBVlt^=S6_WoT3sm}xAN6ldFU?!Bt+XCJlVtv39BdjqlPqU zqN5}urM>sKj3}rI_g~%ls5lU`Gd%F{#f_B{rreTlH6O=~IX4MGXo;FHg=Y-QoqSYY z*3P{Bw4N)z>M~UEse8r+WhMq$KFNhvdy96iJCkUy)8Y9ok7+@H$gce)r~ z3_>NVxXu9#$E$Kx10nrGj)Ef%*aG5)hPCz6v{^=@4VWMWo-9hLkwM2u&C0Xt5cqoh zNJpK4KI1CxE@E;i8Cd@*xFlDNSH9iHMwQBf9J8bg^Lu=JanYH!UBZ#($Ses4*8WkR$!$*VUxAK9T9AJ> zV0sa=<020?T+e%)-!%KMq4M(3URhsfT+tO)ca8GcjrjvZX%BC1h=`^kA0n-%vHN|2 zwLc4vaenHk)5~hygM%wLFc5>-ir9NTBX4v}A?b+EbR~!%7}~!Lc^BmKAPCu=r>z_Q z`%4p=Si4xDVrt%eaS`Ok?B1vX-IeO~V zIX%5~V5DT(B>Fl}mZ3R2e&U%O0YRo?2Y8)l&qbzcH{)JTPO7U9@(f0Oj*R`<>s5x1 z&dQEq3s)QKyBQ0ti%ajH54~t_Gcc}v(8AVo2FK^H;dY+*JR@jWFK+qot5_{Kq?Xr5 z{eh`Yx_Z*s)LP3;d!PJ!x)DeCi^E=ZJuk=-iq%+YuQt+CwrGK`s2*sUO6rZsh)vq- z3Jc~g+&ukh=|(#|tgK?R%UxON;IzGVyrzrHL_r_EB6rDzwXd0!pimc|uFO5}C7wZm ztV2*6;fkMNk;yG0=?=(5UGF%gqseN7tz$yYfB#2}F z=yHS|G@`~*BoFS8`rP(6dlt<7x&s$!a?vfd_Hpm~b69LN{Ikl(-24I8egSD8W(T zv(1S&zAuaV$4c-ao_c?($lv{9V!aKOHa+S~u%v| zFVo>=M9B3To}nc7zvI6T!e_v<&&^%av}PUN3F-kPIsCRcWio0p<;_f^%Og`Sd%Xk47F9P&*OT~GHzx3f=BxBbqSDp2rQeqeO5r#g#qZE+o{4BP&fE#}Se-iENd zWoZGj!D-e9PmZed9wUnTQ;*$aufDH^JA&?dBPgUzAXYEP7(;e&^9%SPUwqfgQ?W}H zXKUF?h>mHLD(ZNBtRa}0M!lVVaf-rw&p{@LCP+4=_x#gp$Z3xouwJF?`%(>2@7zD5 zSg)&3=Sf&8fHp;b>F?22y>O={A>Q5QARDBUtE;Ezrk^Y`oVNjRYlgbrDxMq_*M4R% zm+2CL!QX4#AeH!(&R0SKO*P=zZ6{U*YZ!bT3ZE>6k%Y|mqa3{uGjjRphf4uEv)?BV zzh+W>4~nI)xm}n07x8zNUtZf=_SZ^Q`I;KOC2ro8;R)7xF)lN~#4%_|rX`Q$wsUXy z-C~Kpd`bL)x3$URf@0I^Mv)bX5_%7F~upPuFdba3nxYxLmra!># zeKR_!c$0xPOUB9G*( zZ9k>}@Dplzc}2j!wTu+Eh}X;$D~gm;lNEpKnJ3B9IQhOq{#brujJ#aXW@~S_CFR$q z82D9SvOlQ4T7A5X>-#`ow_XvOud>jnr+{VTJAZ}1NICz>9JQ_bz8pmFFs5GA6bwqL ztu3(#-c*2M&kUundCLFV-*J;x5586n7{t!J$ZTiWGNucb8xR65PL> zbAIRlo}2F~x!7y3J+o|Po@dQ)on>Ys4*58qK8zcJ99_UUSQt zo>2gvRc|@{P6|04+16NO0fIGIoU-t@W$Rikpw!J`+&`s}Mfa(NPfvyVG%LadL6TeA zCVHh~y7-uuQlOjXd%BjZEYAZW|LyJsB2vOALwlKmspb>**gpx2EN6)a?3{*|CZoEn zk(ApTu%Ae@ujM}BmNX#+69IvP%yrgtf&DQOcl!^NIG}`8HyID}i=+)chyC@I(+}Lt zASJzqEqjjY@AGv>ETPP*#P07oMIA^Gr8|001eqhEC_-+)0eac7E&g!stNZ}TqdCxZ{d2Gr! zOrqt)Cvi_wpMa+)PsuynzmiF+CehcwzyKTW}4;^^G(sXd- zVe$RU!MDML6J;#>Ad4QxQ%@{jjnyZVTHYg^2D`rDsoIGWWJmNnz*t?F9Bjs`_q^L8 zby^;!RZj0YKaaRQHVEW<*)^hNeGX0;li&bb0ER0V6LU@_x*zdxZ8BGvZUkAZk8gqg zQ~}ve-3Ol+!+}I9Cno*JMw4{_(Q-|cru$GuUl_8Q#dz0O293M5E%hbEIAD5{IFMr@pTnf-&mb zAesYZ*DR+HvJWX7&y2}4RL>*1yVzvhr;Xj2E3FY|3p{rKa<{ECaf2)Bd8}uD1fj%n ze4q&{LQA+iszh0wyWu2zlP-X;!VQbi3y;l`dMdh_6tE)`Ft>p9rY_wN;hxx26y#ZR z=RBpyG!858NA&O6~#D0afU6* z-DCPjNZ*rLu=%FmQ(*{t?Y_kl6Hemmdh=!cHlZ{=Xz?5>{0Qid>{wThny-eY_TN7 zj;g(^vzw`s2CVsRk-+B5tr`caU!xPJ8{MsQ;?s4;94J^6J0V*%Z`l+r=YNZT6)eA` zgyB-Pvu$uqw}a=deBNF{3qKqqb&;QKHTekDIuH4d|9+gp-`g%<%T9f82ZzP2o9r;6 zv^!vqzxU><_K+!>00#AEIc$cs2y@zAxl@O(OWux}*I_~jY}j_4+EHqDvcc#5Ri4Ky zYr*r-KI^e!&4&liay{-o65GSj-kh)4AXDzT(%MrNyV6;|RE5a=Hx3 z1c%P<9Bi42h?)twjUA49`=iy{dO2@z8r8L)dc$0t1#0~%{g7kxZE0%wnneD+Hh&`7 zPzT_0K3?v`O&(`w+pRYn;I!Xdo^*}Zxh7bSf#(FdWffkcnxaxPB+#QEY0Nhe82(BC zo9T!i+{rHZR1&$kH+mLW= za^FS{-D5gwItN6ws4uQNh8p-l6QfKXm@Z(BUm9ULwK%F6DNE(;jTAa*1 z{vmWn%Z}b0_KHUtFOjAQk3ukmQ9Tu#P&^=iM^ESWim@Bzk}2l+%CTs3szQ8CZ(+Z) z$gQ8ZBnS;+8XQoK%`($@KBFfwHl~1u!B}WJ>DE$_~lj~G=KM}^VhbR z^Cn*{c^%Jw$UXUdP4oIuGqX_r!3&*nY6=}QYUg4h0TsfVbXtM11l!|^Me-anz*F0oVSnP~y;Ud2c$ z0=L-8`xB!h{G$YC7&!RpqlLqyr)#pY9LMAe?Kk3GOV5<9*K?o;(`b_M>2fr95enHq z2$-jE)QQM>;}7Feqr;VR^QvN1HWa&#i!4#AEZrnCA_0XAU+tskSC*X-opjT<% ziA^OAxSUVoq_j36l+E3XGxcccqraS46(N8;t_Bs1_wKp6NkzA+2gxOkZkP_Zv80b!=r@A?$#Q~WnC&-?=7f_D4FQqVppf5 z=7=PoTgTrfB{?(V^)R@XgF)r}myYRGiirmsN@I2Sq}FN!Du>u0jBGFKxA)vWUT29{ znWKLIBUx>p2MyQ1J~J1|jq3U*+;&wq<*VoC6OrJI?cWe?%|VFYJ$vTlu4L!ghC4!e zl~Wi7X6j#%mgg^Mk30GHeSJd1i(5Dt-FW}x8{!(VUGxp}F9G_MdzR}L>)mLof(M{| z+v%$!-*N4OT+PUqNAoG2z3KpL9cg-;x7qWHtn~ECI-i^$t<+3Rh(s7uCJdE|Tsk7^ z$|`6e$M`4L?Wiv_M#c_LL^q9S`6Zi3@fRIt(u=ujIk65;87em|&`)T$u8l#TMJ3Z8 zmMFTBSGByyPjkffT2`f7A3vdx%~R9&PEZLNi(KGRABqd5d~zgb1jLJQvxPPz^J^T7 zOFw)!Qq0ohyekzbit|EGo*9b16`-Kx&0a{@#}?y7pu~8*U*f_m`^36z!s z-H9lhW`QqT^&J%FGqi9f{Sh$77B}kvn2*9zLRW{5@=oIbghu&YND=J3!Enx5g zn*tG^8&e~U!?F&-kqqU+sbtIYH?@TTXOIv3hXjQ{_uvELHfGwP=sHK88uft#1_wkL zs(3s+VnV{92L(d41Dr2E<50vMmwHwYadxu=I)BG?>~0<+G_Si8#%;_c>!=U+I$e^2 zBK-G&{d8=W(%rJF8txW-QWqzSR{M%7)FOPyDis-Zj_c;B3s)lR5Pi7od!b-M8x8-}{lEWMq) zk5hep^D!kU4_GMQ{(F_lBJd`CN+$v)`FO97A7P2pedPFY+~T@@P=jZ;Qj_?sawQeM zTM}%&ySr4gMor*nvM#;Ko z*Yn_ca*s^5a*ZG5&xw0s$KS84C*|Dz@zRD_{G~2re1Z1^@RU%oqLAoWvlP9h_k7al z=;wVO4zA%*MYt`ec;CVTC^}j{Fz~S^1D3`~7ZMN;n7wwAvbo+8m-BQ);byp!gs@Ok zQ%8jVCCViBk=6Nw`0bRKKC~mST~Qo*mvDHy_DtQ_@Ydu7ezFt)>4JQQPj`R7m~3JGYZpN{uhI`k#Eh1bkz zar@sdP7haO_ZZwO6;@D(ZWuRu@Vn`S(*BnVAo0iFwDI9eWToIuI?D40;2!4wm!ycT zoDHKN_szvkrRm~1?e*dIG8c!!R!H_XKFOF9cq<*IckXZfPceUSi3kA&U5Zs$7(&;y z`Gn(@Rbuni4T5R|gO3I%hkR_Qj1QI7Oha?Klod4)3TWs#M495JYSc?izh3O={h8XB z#G0G`CXh6IPTxL(X@0(DU!9}GV6(*6ZFulydj*uv*FdT4!iPt%V(Kh``#Rf%zUub9 zPKsP~Q~E*cBVeYJjcS{lbdvU1X4TO6;nF#PjKJRR6XCw?>B<7cZ^R_Pd)i~?D4iHSVHA4NuQ9<3e zFq7Lm)e~(_P*Iyvo^1)gvMr8u3-b8s_wkV4^Az^G+d>8O)DuP{$(%RS_Ha)QZY{F> z%Uaaf2y1Gw#6oTpkuH5Vk&)dwWjY|2-Vz>RDqU@RLm_4aPavE|AFtH59FV;2B~>J6 zXZXO^vMO|;Khf|@+QIM!b7hX)%65HJD{QNjA!oBdY6j})g6P3>Wj1v0+RTGhD0@7f z5+h73v~7Ove?!p%6NS3%f5$rM?L^7I<_4n`g+BS2d-|G@4Y-$=aVSwg_GPo^abW%N zr|}&ETjlYaqKFOJy6kVNRtXxuuYCwk9x}}?-u>mpX(_N(;dnTkk2Btiw|iH&m(1X( zWf-iW6yE!?Urg+zr9-D90P=ETo>_m)V1tk*y6s1ESqjt|Y039ir&)^7SPQwWxOOGw zgf(w|3=S9kn_bv?#cHq1lUp)4YOVAUN5zdEaHN04V;ixy{Q=Smuuvi%8$GZJeXo*u z@Hk4lJU?H1eC#26(;knacMzeXqkJ(x##p}t~kMf4eD zWa*x%!ff2Qz|JCV*>@FUX@WbHQdTRmL@v%tUbI1i5vJ*sl%HQX0Z860jKFc=4T^U# z65yz4rjW(o|?da!z*)Wi)N|S!uXIU z;_MFzW3n+-XhEu@>2R8iPEtakD93w``Yf8m79#Rw+0)pGTY84zuC`&O=m$Q(z7|r< z$x1Io%oF9E{V=24ME}<_1Z^r0u@C{T@BCve;{9t7*Gj=297LU$b<#q7Pwb;&bMTga ze;mb^t^n3igSLPMrQ_P;PxQukp%)iNcPAY87w6cZgG?z3w@JpeKmF7iIU@H{VERdOhq+^FPK zZ!d6*T+Jf-a`j0X@a0=TY)1~eiv_LW z<*H3}-SUP?B6b-?$!x|u{MLj~fg%A4GP_6QJG5${dQYz=Q&uL4 zog$e6XA>@xnw|T$cg3)V4$U3!CE3=Hk~vL%#=Kn*6JCTp46kH7P>;?datB@kCuPep zhNFr{pBNxpdwVRDz%fYXa2S*Aep{CcGm1lp{MOT_xyVkyZZusih(SgvHx_(10@8_6 zB#O$s_4fH#CK=8Tu^*1aHZK$1-6Q4neE3+#_8wbYD;l#*MFyB%Y#iTC}sO(=~TPO_o+~UH*X>cAGjjIy5SQ@Z?v$d&+RPW=|Up z{4K!|F-NEmAx-*5F>1jr)aDa{kKG&j-peb5$QOM$lC;|$kY&}lTfM@fEfd%GP_I>^ zk|q7QW4*U6r$5Q~#+YXXdIgn$r*{_fBG`(+0}!Dl^S!|`7N(ZQc8>xw?b{Q!YLE$g zC;Z5LwOZ$no1Z|8M;erRh(!6M)49`FU%nYPr}iaaD!90dw5^hCrxjrp19>%hj%Rov zHZi|jVwCUv`kF;=tVj1t`&3|D+-GAd&DoC}8Obiazlp)u1=^*O6?0#Ix{xGWXRcXF^A2PaSgyIcIDV6RFDF3NN z*zh=XFMYLuET=5<2xd()lKi67n86G zj-W$sLcI6O;WIMuLQ?8M2lMb$Cm*BeW+Ws!wSQbq8o!I;lGFYJD#WQQ{WxsQje{c? zc3#MVp3I6Y1S!{V{jq~-RJV`b3R>~N@^_!%Pwj`FzkV*IwVB;I`d%(?;VZ_eVW zIPS~)!$%)W5#3c$JFaQRL<14l{B=mYezWgy)*~)@H`#Ee1H04A;61l|k;6;u$LM>& zwSO+QAGx6WR}d2(%M9>W$R!Eil4q&7c5ExJToAT0N_ z)ZmGEBVFemH~ky@Vz+pho12TxkEOEu`~2AIsyHXt>x7f64elxYkuEJH!RNbwM^CUz z3WZ(Y4}iqe-o*&a35l#3*kWmcB{dwBq}7gbKw z+R6lsQlG;ZdH6q{Q5NAP;S+Bfy=qY3dB;hs?V&SdjK5&{7Nx<+zh|lbxPCX|QtDrF z{70PMoB_;+#9{!ZpxjR{Hqo*fnsZ1R4>tw&3j~%{9~H8p6dYTK+FvDw_PfQbbSBmyd7raP);`Zh_dUH`Tkr89s8~)DpXx)36`sW6%4S5EPoGB;o5k1UaO0`8nn^_m;A_Kdii5S)NTbg9?%T*O{r;;Z z`%iOL4>vu}y?Bf3K(M%j0UyJE1%R9UF+cDaG^6I~lYWO$7}d;L(Zw<0_2m1ttW}1a zl#NxE?=Z!YeCj;x1z(>YOuNV5JRz4umgim-|BCwW2mPRR`h^;;_ocQ> zzVH0SM*sPVg!X4PW`&+)nP#+c+$W$Ik5#VS#OUG7<`&@Yl=Y1EA1M+(;bZ?a`TH(+ zeo>Fj;9U?(3sZMK7Yo+^zUjB%YsSzrFBAjb{Ro@tH0H+zqn|1J8QlNBPuZ`*t8ngJ zLyT7%%KGiBOaA-eA5drQ5Y*5YPM$k_*TpZ;%k@#2H9vI#Q_tFA%Ks?k1F8nqzk0-W zh-q?jV4JOkcpIM{sB&lk^NvY+WQG2{m;5WbA&W4V@Z){YT&-RuR{;TQV5(6l4$b%V z*0NDg>&pM>)a+lK?yh%`wXfJ!5`r-)T-!tz3WxUombHfc^B8>IqXsY$_VBeBEJZAx zI_0Y6*~J&zO`N#q&zDS<%xRbNY5dSE{sweZZ*WA;QjYq&e(031RyJwFqg}zb=crqO z43GrP71>>$6wNT%FGBLk@r5do%f^aWyqGK1%f9`Bgg*#HuHZnJAd4pgAxbv9Br(nU z!n(nL{48A17h%j6N$ZWd*kfHl*162$M?2gb{0_n!HmJevj*~$01ye)8XC5=W?b=)2 zttiQ@BDF`>ts=(jVhLf);@T&-2&H_bEmJR${%YOu{NlFZul5yk0V!d+=nxF$Nh{ux z@%lru4f2kc*!_JFATkvUd>HH7Hfc{?ycG8(1bn!E)b~$%7EGhLLUBp&(HmYB#0VhslRG;*esH2=uM=5sr7&I>fiRg@&c4= z_Uj#{u~D$&KTPvJkHjeu?x4jHh5)RE&3BA0_x!h7tXgPu7`^(pG@P{$Z(mwO5dFoU zqg;LxrRHZPK-ry*bcFF;62kqvDqEH41P>p{^h6AwWn%H0s_a@b;d%M}n3s1+@WA_v zkzOyGciR=BP3dkT06HSi3Ku$b&L>_?XRTmuseb=dQ)bZ3L`;=G z#0N@L`ST$Y-uxoRbZ@{sgzSNTqUI&tl%2znDaVvqY~Y#gEVbXF39K-50eb{1;NKZ` z|K+h5_hKUiJJSsqZVI|@ksU|wB&>SWfESwt8#GJ}J|#XLlRbDuPh7Owwd(VCuxoKC}y>PK5#=4D#2~ZyS$+hRKq`ot4S>yeoU{aJRp3kmer}hXC zN)})=w_}9L1g$HD4QUkKvOMD4Fq@y8R)%B!VxKTCpJ5bvjs;j7+3?CoC-!!Xqn{4fvqAJo|M^B-YQilODSQ?W!=i;T z!wiPFw}S$RW`23?uciSOm_vS`^(jV()7^-A=)ddlc9ha5_*VMy0cB@W0te-5NfkPmJ-K{Lw`%-vcvcXu?WxIa!cnOU6;DSbCF0 zDpe6IC-QBliB?6cvqcz(0~bmPrdj_vX8w}A{rJtf{#cI-O4Y;WUShoqUZ@5dX@5Lw-r0&g6DCU9s=SFcVB( zhe_qPAyThK9DR&xmRJm=s!f2DuiWrj&i4O|7x+)EG%ogx6&F`+sTM=E+Ot*!5nFnT zCL`LeoEF{dxljzNv!jTMhLvi+3&^*_ARgU+ET2jx1QX0Zab17Z#=k`n5zNq{8zyt- zs%Z`<{w9AtCW)1A*oe6T&e>_bX}7V=;gS8Pr48Hbny*2I61O&%`E=tK|6$r~XG+dt3ofx@6n(>tyFj`Ccb!O}2J1XN7h7 ztIltp2|}DWN_Obi2UcXNQ(Ac_(`Nsp-xO3cv;D6(@{z{olCQn=K}eC2lf3o_>FL^7 zfy)U!{`3_n+eYUBBy&=4}tIcB*nO;i+nIRVohe-m3Z{uu?@ zfZuc<8q6w3Rp9`Ma$*Vkec1_F*&74dx9{Ko{oVaKS+8=J=|U~zf4*2nz@S%wm>*2Ti0ZQf6o?L%yr|Itfj=cVNspb{Ib#T4wUEdyf5erz7V~A5)ae z9&u3-mmb+ysw!lx{ZI4^K5aKMsK0*a**eo}5@r8g$dw6l?49X($_Ug=%u*#632$&? z&Ws^7T}eiU1&y1dh9Q_z)yOek`fTG=9xtBOuBxwp`9~37$R{FJlGkE&*ecvv-{f0d zTFs*Eo92k344iK*B-m=rrmAs1?$YQle2&~=UM8*u{Aa8KY$HEOYht?dNfgzewzwe~i_Lh51BOq(n z47>w20+b6w2w>5gzJ9IG$)B5+1aEI23~KfITlH64eJ8Ei$fGL;!id69Wo2I6NHowVI_O*>DH*I4eg^&tjbD2YOF519>IO^!*Dw#;z(_gYmVTdLy zI>ldXWLrZ1OU^zTI^+C=W61bH4gZuFjG;(2=5@_YoGoK?2A@>gwnwCI~GruZk6 z{z<*qbYTY=SV70*FojW+Ev5>A*qERYyd`=Pq^CayR10mQSPClxhigsaZ+wOiIk-4| z>E-06@R5q|c8yq`u0QlVtoaN{%pcbMvD#A0rsN~4Qc$B(P8ka?9#J>7-k5wypn+7K zX+bNR=z30%U59S|E{4dsKXq26*L&6alqs|~&LzoI&c%G9TH>fpDJ(MVhvoUa742rsu9++Z=<|=_?ABIV(s2^fl;x9-ck>Qt}#HK-9jMQi8GUSIm5;}sT`=-nG>9wDfYhxvL&wLul&t5t3O z4XnFIDQZpgOT0l)F+4HLRCE|9V-*3<8%w1%67O%dO4Ixdnw`ZZMQE*<)8Z1`@4L2I znF1FPuw)SokO$F}oH?*vX~jD#Gu++XX+xCJ1M4?;T|Yh_Xz)c_Ft3ZXmz+rLq6)XR zPTcWz4z>KjwYnIT&A2UdD&e{HCjHvv5PQC4QqTNUvS6(biD*|_sxDpQ{EMb39Zk>d zaN5V|d@AsM^x~ps$pHFcTctO?W-xZx;d8+a6NDR38lLnDVw)+ zWOA?-+LJv2k66<(NPRR}wBu5c_J&c^&F8Cl$88x=GUEp4Q_@W6|J@fW)BLwcXauT8Npb^2^@7=b-7_O z5dhxOyia5CBxwZ@j=pNCmxapxn%kne4a7AiX%p^m717Y;_eIa%1@D>21XaZyll?33 z*%^YWZOJAQ z-Otf_=+vm)Y;PjWda5&y{BR)cJzq+UEkP~oL|pT0!(FlmG^K-z=mQ^H#y3=<42t0l zh1T4Gh);`kUMPqIiqx~UalO1Pa%4+ki|4dQbyfj69fT|V4qG*;{WHA1ozqKWIbaJTu5$ddTrKbV}gh;!?ep+mZlpr=U7(Q3-ZzhfqGgs=uiJ~_jnwQmYRk5;&a;K8moqUDW=PLN-O{L?G{plpX55eep-#KQIm z8iOj^zIai8-02FexQ*%Xv?0{lclOed50nj#YvV!e(SM|EUJIP` zGO-LE3#sMeTKwaJz|FY)D@MOZde*xKVtvQjl(aoIl#5Kz!OhomEo#LQiq0VHm;4R*TIK zNIMMCy=$()2X{G>MXCmwA;e@{UNeI#QHG}G$6W|T(wH(vLT$Ztq1+-8Z{MEp-L@Od zc0f7r*OnsB#J!`8Vg;>LCqNbcr#ruD3Q(PQImE6ENbaqhPRC`eDulZOvHXh_!uB7p z!0rx57a|^Yj$a*k1U)UM?8g7j6$Hd(C<(`LaN408rVB^-T%h=h@UG5)8Jl@r#-3aj zM+@nTHy8fmd)tcnOi1je5en4qk*4@1OBeISEVlUx-&~VQFG%03ar!bnX%Up)1&xzu z)Ovt1;XNUUF3*AEUi8M6vjllCuD^rx^yxAD(iR9B@2BCI@zuk<(NFCKquv z;83mdS19YhI-k~As$&3^0t%*xRJd8qQI(e6dOi1FHFUlJPTd- zMFG$~p*9}H%S--(MRJ+)E1kBawGqVgVMb!W#13@+^KJwCA+g%{*@?J>b65e{9RyEI zka(0iZuN`twY4)@_AJ^t{f#F{%?LlI>GVvma_r7tn&*+%@1>3%kJ+o`YD);5Eah$~ zTNRt;jL8k0PaTc&iAcCFON0B@t}HZoiEppwF>#LW6@A|_GqtU+cL!5siGI3)XMZ@HvRXC{}sO%NTLdAP51vG}{_jR(XyiD^QqG3Uw z8@bOl#ihTrOC61VY~{fupzU|QaKZb_){6py3hdynQ<)Dl_bNwj9RgJAD!^kA6&vSA z>`lSqUWlf+MwZgfJnKUEIcLX!I%73!zi%DUyw!COekb;RbOS=$0WxG&vr?64s z>5|di`49fYY)Hgf=Gd*ATy#uCu`z2Z5y3#{H?%>A$5(z1Z&i!r>L9{_6cs^&O%DwF zFF#dgXYA9GV4RGA0&F%1-3LBlR|C)5KPY%bRmStP(1X$R=(jm?kF$(O-a@i(<4m;8 zL_QnR8L>AP$$4&Ei(t9EVk!9WUoHSD9e9(k2>4U^aYQs7`vrMOF41Y>({daoykPb* z47L_SOw1iuIYgt4YVRngMZ--li;^7XSkM|eT2a=ZGYOROkJ@kVOSQd~;r?L|B+ znKRwFp^11zB*X(ABNp3$of#2d$&Vd=b!i)95Td8WF|xHgR!7Hg+;>Y9b8J;|L9_u! z5^#cas!&%wlese7#$(ka{XHF~_Uq&)!#93}?Y^c-Y$t(g3Q=Ukms9hSqkTiSYVbys zF+|g-l{fBD3WHLAybAtr7smp{XPcCESlyi>wb|>n5)HZK^8GTL{zOfwtGyqGgylnTB3(lFCUT?Xj1Eq zjmM2!wXO1Pz~gB!@XSS)>@;Kh&&xvG-KG<^sRK7Qblg3GLCj;^^%VoiUwZ(>=qYwx z_{WO(`bgHooW*Ro)#LGkR<>w9dDL(YoV9>Q%p11*cPcuEC`9YKfw_Fhtxv#O;$PJ` zZbqoRS^|Sc_*2zJc1T4J-s(ag-_R7N2q*BJU`Lf%K^tO_PkoQWxaG-i6D=JUgSQEj zdeOjkp1RBRX4R;UM=0Z7Uo~$kbjsXBz}t;vCRwn@eZT*U%gg!4XYH)+{uvwJHK||$ zMiw4Ut4jgC4*s~%HfbkYZpQ}SnrNP$n9GhfUWV)E(PQ!S2$IP^LWNw`L9}1(QT3-F zX?vKib9`(}_G#XC&OAZL+n&a+uIUt*{IW!#-AKwgL%Hrw-$TTo*LWhzPsq>>v;Q_3 z_`*6EFE|n{DlHb#u$aGzL$RNZf;~@1d?Y;#8x{bQugWOt-6e8fbQOR?^!eNm}olL z@U5J&UaVHM;vVVX5_AS>sJjW-8j5nRfheUE`idRqsw+u3Ul_HWVm}!{;rMoTp0R7W zIxKIDE);YPj9Ae{-uWofRr0qnjn@rVs(40Dzb1mff#Glc%g2m2Nq$j#JQS9N0*<f@)lY9-)|(S4E1`xn(BWc%rA{hvDCr5plSjWUjZud_<(& zkMR!Q*=e2C$a<)^tu~D;9HltPda@+*;n>=!TX8tBmNAj=>66Xu*S&S+7V=q=QNggc z{#U~L%0QgRV4`f9?%5I(PO>gEyd9=+Fr=wc)F<(1!0~1egS9Fz>aAO%1 z@ z`yH&Xet~{FQDp3Y9`;hVUOdKku($YrOgOUmjU`m&^eO$98v4jU4DER%QZM)XMx!(P zS1ovK@V4|15{hOe59>oM39ggCr2A1glPLMhHMxLZV`Zqcp(uTpkYCE-A42B=d;Xb+ z=N1Kw4sG+>^LSGh?dD8UA&>mC9xVOYDGW*$Z_g;^sMEscXd^4jA%Po`Mf_i~&|NQ^6*v`rc3<=MeJ5mAtpk9TPdQLuLI72eJ;zOw8*KAD8r7i1Q3B zAFwvbNGb2K?EzU#H>sOENWV-jbFDFA_NrLc`;cN^F-v|&?_rX&7gSGK1+POCHaRQ| zs@Cc-&BpH8w@W2@1`Rvi&Cz}_7dVAfD5Cj9{$iYg9y;-_=^|aMfhni|T8cYVqM0UY zCH@XKzV(B=YZpA~Q@?TF+l)1mW&SJ>J+W zE1(eZJG&yoy*N<1g7Y*8G+8qPYMx_OSMv!R+pfeU>7|?=%NCaM9L8uoT=y%MhJL}7 zASlF9qKzJxE|OZxh~o=gMz0NOo^JcbI{&=!5`VZ3XQMa3Z=hH+O<;J%6Pyb6wso|4 z@+4-%bIJb%H5+(mkS+k3DdC0Us$@Gd1;z`95xZEF^X)(Iy7wp^OlWfg1+G zrg%!6+20w6rmO2Rp*{*DX!%<6y2QVU**CFGd=>`p&V5t)RBwv1eB82aw?VN|H1=&{ zlXpF^M8Xf&_X2%V>6qS`2OV5=iVkZv5#siQ1!Ei5MlXN<+{$J5>b|2C{Y+s)2|{0S z?#^7iPbT#U&(LVE$8Qdvuh3q#ooX^iRGlMl*g-m}+pJJt9#E*q%JjW+tH%(kS~Em&V0Q&99g z$Ul@A<1O<$hW8{5WaHh{IjDtQ)`{|1&yn!QL_S92nJu?kX$*u(`ncDgePJ70sblzR zNe!7K*5$SDgz5`dNc3vmE4!bqOJ2-ZB$d8lz=Y7)zo_~m98H$`m2E#{nfWXOBPXY8 zmGnrEG|OL+Ew!MW}a7o%`cK$ih}3ewHeq*#%g1@p6({S;6e3)|HEW1 z!$q(0HRVLn=S1o9G|{Z*9g`BUmL_pS`o*2!h4K-vEn*V`>O1?0&s7pE7!5CqI2EJ| znwp;%8|+ci-)LskSxL>@zh0~efd_DM{aiTlhlj`4P^{OALe%W>0dv(}%$Iv9b;7{! zSfN5n(5qP{b);*uv0q9T$l<)dURK+KW(4UaKn=NGR`!|m)b0@B&nxpW1{Wh)%9s!Z z%d;(Yq*-g(um+{6Z0?wG3%2hg^WsB|pFr2-C3+)h#e#8b12C(Z^2ZT(w#TL7*jmx2 zSIQL(_RICZ8ghzjCHkK)c`(T)K9m4Il7D$n7H*lonQ3rC+iRBe@%VFdZVfNb_Gy4m z$v~Z+Ow%2**fm7PZNKc15Bx!BGSn>2cb5Noq(PfIPQA+7)=qF>2yl;$ds5-+LX}nz zKkU8^S(|4SIRtW>gBN_BIo3afwSdCT#g&jLU@@;NH>^@)N? zu{*qBR2BIy6&!Z@g#?4eAZ7l+eC|7k<6PP-D}^2{B4|S+z^5}*tNR<7wjxJ)864?HiOG12)Fkw*#h;$ChX`i;0v;Ba6D`FOQH(Dwig8;`*tx(KQRaL9^ z;R_!snOugfdH?uN`kb_FH|O*lok+?fKh%_+YsrVpg^oGGZ8qA+*2 z*M>1Ze5`TNF>E8hE zOdjfIG@O1)<=g8JEj^mwdxEpzHcgOfYh6moHJTV(zNrz5dC@0!>N>BimvMfXt7?zj zPsR~2^hSMH_0lRpn_IS6NQ$`feVK98-}r^6*YGrC&%e<*(P2+5@bO2yq)`(7md#qw zw7~yiQe^?1_&MBm_$zORc8+MiHx}5hAkXDVE>6z?_?Xfuy{?+nvRDZMZ+F<|FM3ou z7%d|2dajP=wvwrwZN9jj@>_%c11xsVN#+ikd~=tmfWw2yTcal;zO8%Bb;*Z6j$C7H zX6Wnq-QZ+6<_04mK2wEIx`)z|8gTeaTXQ`zuU&5WTO)N*maO>yaOD0bAe~^MoF@DF zSHRidncTi~Eicn6^CD1zqd2kd_I*jRHXoz=nBC-L>JLcJSc4Ypxz_ae-O1GSDhdB( z*)hp%MyezZ4iELLd|>WLKCZNJ)|7_hp-TGfO%#4q}5e_Da@p9=eF*1;lg21vC9v? zua0Z{?uo|@@f&g4qFIOZ(7lb zW)}IjUnvm~s!zpV-H)^~FLcza7_$F^FDG=;VgFp=G(xD$@Qe^*#8Fa2k1eq}nVRCo z3Aohx2NA90L|AINLqgH-8a|JhNk{rN{lhl;X>KpJFR;NHPlK3PJB}i#v$JdjXkGD- z%4HD;A2pD>0-jT67`&=R6#tzHB!$%p8O2oC37ZENGB6UYy{`N}B4P(bkCGkD zw+9MOnp=RGRyapWakV}oFin+v!_0WN6KYiCdO5At=qi5}|3Bm!P7wI|gc`mEuC2W& z!P75O>(?COK~>FYSUOQd*ZPfC*(s;V-25~2>(@E8Z7&VrUAeHFa57& zBwc{Y&riN?NRix74hQ?`Dx&!B;Q4x#8O-)}^EFFROZK8_CZlgbaQ0AD+-uH?ZU>Le z9mube+wyY#J%a63>ZpIgT6H8C^^bmoLt`@Knp=B^vBhD+#5zp^S(r9=58KtkgG0=p zDl~DlN8%n4XiOY!JlYJKJS;RZ-NW$2DG}jWoZ#C*ureW-AS054AY;dH>{dIl zBM9v0!9kB0x-)j`gJzN+H8I*!d0dfP)&r2u8p6U|Ga2jPfa{~&m0u{0x-cObwZ zY7D94IPQ1}CEGvP(=1}P!{dqLYtv))gjZ`tYMJ-%M5~5kT_|_U-fuanMBt!U?vld0 zx20X?+dj0TJBMpv1cxxi7ZpNm#n~U6?1Z+oXxm%yg6B*@#2lDuz-|#a+2Ggki)hnW z&(^JZiu&sKF0(L^-qTc{%e=^f3M5;}3%(#4(V!O)dMoajc`j76db zMmx;?6M)enawvQ^ck_a1{S3H`3<#EB=!?#Z@)T{*rN+0K7@1A-+m5jZviv7 z+QZvxG^~0J8@Z`=Fuqo4Bx0BEx7gat(Hhb(Hhs;!xKubsZxV@MP>;gcQrdP%7TPhC zh>(u$7>&kBtad6i1CFaC8IBP!k(P_6!}f_Mg|U$JW$f!SA-Raj(T-HT3QEagZ55IC zhv`se;$d91zZW91rRYz*&I@5uk7A(rj!N9oAb|syz0hUGJP9|I8gMMlIV0@7*ip$0 zCe;t)r+qHkZ^6r{7!qO{8(|}DcXWW4dZ95d=*gPIKiVtni2$?qHrs%47fPvy;aO#* zT;Ug+gHM|&R1R^8%bqA{^PE+}4a(TQWCr%i=1e`zu2#9375(J@4#Xl>4O3Gp`+Y$g{sld2yvOrw)fvqVh-| z=bO}p;va>&awh+7!uDl)>+>YPa-5;GVLta=Xglf)gB9aI6~$Kdb(0PwRp^oK33uYN zDlS{E7716wchV9lc_gI3s(mE;a#un)y>64_+Y8mcp$Fc9#Q1<{iZQH-*E?vRNAfMmJ^h7v7Z0A6sj z1mT|mp#QwF6&!!xEB^7d?QZ>`VB?}6aC4Zt-E^(`?=C>@3y%use^Ww9?2T4>@mZ}R zWbn?AkL6YT+amBj&!Ph~Bo-i8to6lY_&Nu6qU%I{gg$8fcjrq$j!E1|MTHj)?%wRJ zG=fFIRZ(tD@|ODFeY*iN7rPwxozmrIx<_v)FkQ0T$MXI@3GzrvH6LvJAK#(h};j zjLVHEHmxWy3m4ui0f~*XN>E`t*_isJ~nm-62iSU87K6|r|CT3 z7^jPBzB#+xIZchEo*bWc_NA|g!-cRfKX#l#S-x3sLVvutYt{2W>_^*c9dler-a6wM z+cVFdm_+y|)8spp&v+21K~sI)&sSX4D zlMMTlBT|?bJ%;%?8|g4wsJmh9)r-ku7E;-)zV>WY6dLVo{{%jc^C3!0di(CP5b7#~;Aqc<#7pdQvw zdp+6RmDuPGoG@cQ`^$oyk{7xzj{~>vGI9%b(_jJzeSTh}?Z#6A==@^4 zuL~y3*xZi02*yK6URz5N{!uiB5|`|K*M!JZRbS5DD{7tVX5H3SEG5kv`s91ObXO3V z8g<e0y1R zI1U0nt~~L?-P(*=Kf)U!mJUOaJgIb&s89qdxq|NAh1F+M<@wp8n?eRHp2MJqs58dPs0PLsu_VD-u%=2+#>qGjADZy*KD^6cYY~ZCxROfs3ASQ}(+W z70h*Ce5Gy<-Qn_3^Jvmv*LowcBP6cAIq|-?s2hBi_SLgx&ib6_G<>`8l2YB7EE+xf zGc3~Usm#hktizkxjg=Y$oKyn0SkEKAW}ti8L|OYS*V?ut?3m==-X}^BE*?gBy1!S* z76}9&SzBC~>MUj+hrCR#A0j9^v>n~n;2bsBDEYIkE*@3P=VIAfyg_eGNlcHjMxTR= zhtJl0Ba!$Q+PrD|)kaKyA$4TeR|*%@0`7iAxV|YqHMFc>lgYdZh96M1_dIxijCEFBU*(OQ$pQNwC zkdtM?#Q_^z{n1<2TJ=Y^^#UHZ3N6kj9Y~<$vc}f8xm@OB$%V}uyOR01Z#9oBZKimf zs|t?KoxGSg4-s{Dtd2%Q=&94CgH+ZM%!lC?I{dYX3P-K%rApVT*dH7HT*^L1Xtwz4 zG|Y`Vck9(#>j$?S@|4u$12vDv?CQL$mVd;q(0Q*LeGek>YX5qjjL2h5J@A@{rWe>V z&)iBk(@pC`;LM0KG71I4zMld(6WnafAKS>xyZVM+C5Q6_m;b{BP^$Z^W^!i^+Sq?S z*5-+gFDaPxy1*DE)C;|_^qpEWZ&lT7(m%9rYCGEi3J?-tT*@ z~baDfw{}<>C|uKO|TYBbL3g+Xty1&gmM4+(`?ES;~XaUmS`L*%x3r=eA~>h>?NR z_H}d6O-X@fJg)D^(spxXuhhVcrN4J2o;Ol^qQTJ;6X~?`m_YsF+KwaHI3R!@ICp&G zsm&4WDf1`!q!{rET<+kookh}@9~MC#9Q573V3E(8a9bs8n}J1-6z*ojkC@mWKAvyg z-jvX%^JP30KjSYj-x<4l5!wa9fmbUBpP3dl*#%21f2&Ux@Ts2JYl4!pY*}>60B88U z&3K<;hdV_&oiku!oKxm-F+vo@?F~6d^rBoPO{7fXT=`96S*Y4iYsI9}eNVBR{$Oky zbfLrBiXKUl#5q%fme{~DMCJ0uonOJXEiaA(uOWv`B%eR)GV~T*wPnP(za6-JTWNA} z&XnTL9R}3K0+`ccy|X$#Uf}XUo}(%?7CzUnAV(=saWEV(ap0m6U$OXBIC%uqSAQpg zMKlBqMmiVp4hgNnym;8pGiq%8{$&YbzRd&YV{uPER+$w+Wp&KrhSSqQa@3!!nz^IH zb`IU=LJaY)C_zY!xFTah0UQ2!{p0!GUJkRzpMee!^YvDkbLip=Rj%7Z)j@NnK^dbA zz%wRO9F9UN{+5w(*zg}M_FSrtd>sfNSqnAFZXm)*iHYIMY}>u$LZwA7so=nFlIs)s z2txmYX|{d?(|nz$U`M}EkLj2LXT(W&0=SFV0|8%${74XVoYDbgFpgepaB_k}!HX4d&D%7G4(nd7VQ_sTUuzSmLl5YRe$g{7O5de#hOx@|A?S=`)=D5?bue&D zt1i!s(FH8n8G4!ay4_~~@`ea@Ubt6{wO~In@&A_ef3Mz z365@1rATzEm|~=_ff3*MX7~L*{jvFCF$2Y=kyHa$yOYenohk!Sgc@YK+WN)Qli#B5 zaYqZpq}K>&HnXy#CnO{^8clxy5e3fou)>}(vi-P}&AXc;np)bEIbzQeczT<&nn#{3 zdtcJf5wQKjp;7)nf)M8NU~|fD@yLX>o?6gv^#xk7&|95%#_PqHxX4v@st67Br|`Q* zm$MOg3_9qiJO7e{PuvUtzCMH@U*&|m&x75;`d1>O>By*;#W1I*c8BQOF&M;x(||cQsaj65)a`22jD~GJQUKIpT~fOGizexQivy+JwV`jqx**gdIA)3{i}{(7wv2 ze+E4Q`q{7h*Kta1(76Y0W6V!t9ah&??WC1zs8r6t#~Z+ld(I|MagiHf2+-XI&d!4C1Q{R}Hy~iIyC<|HV|xhip836?bPLRnw#lF_^%Mt{2^+5pp2(?Spht6I!`3y1xe^xp^s3*~UzKfQ> z;oqi78nw}A^9(e&l*2&94+u}=liGQDNekY~malSf=vAWV*r%|~HDdaYx$5hJ@mU!# zj~)}0{?p8`k9(^AmhwJdD{&Gn@Q zP|$a(Lnz0pYI&GY$dBnUqVu5cCg$y!G4oM{8S7~|!XWwH(x2P^x?))p?uzVkx{B3l|wdI%d73)xaF5%@i z6(4^U9JioKWjH+OXHwE`bFy)*8o2H~4jhFErYft8P-}CuE!`0o=w%EZYj6fD?2)Pr z7zfW%FuAe5dQ}QuAK@Rjc5F`JI}fy&;I14s5aq{ph!epX-#?vag;ezJbraAg&~}E3 zKGCRUAL4abwM8?QznN18YB^>9tZ9AT@p2vF_`MF+4bgx1F8g2F-l;*7BXS8N8=a|c zHI10YU+v!7HE0ZQ*gY`~`#w@`zj8!nbojPOa$2a;2C`Cqx5fe%?xOT{JGw7og&OyR z=DI5t`@2L|bNhA1@aw10hoHk>%DRvqh@#$;Iv+ zPh&p@@6DxjyucAGHsn}+V!Em-_-OStL;f#)&kLSl^^qJ2|9qWB_vBWJK}BADlN`~P z1+RT_SX#W|xxygcYfiMiSE<0DGBce#?%~XlsqQB1jw6J+BQ9|?C(KI^H1{Lkk2qHf zEh37i`htO~^{Cue5njP#$fhdF?MlY2I(ksybOq5lmDRmWU9q^mt=#VW%-&;Y)F-;3 z{3-Y;%r>L~U=b5mlDHR`DCF`fg*+_`Rvt~X7y6jCV0l!_afLF8Z~O#huAWz{RE%rA zv%T@Ss)K;MX~&HOq&dRixDo}}LG-~_)_dG7;JnA}yE;1b%~@mp(KXKqped(?d$Mo_ z`}?A3xQ+Rd55)A%0zSuVz8k@sznc_#({ex|6T9 z(9L8zy#?}bT*s2$2Ccc_7GwkbQ|B!cmRp>C<2%-R2gvX^=)9zK_TQfhsBgNQkjBD! zq|TQ3?O4_{zH4B-kU97jIfPX?8soo+5q@#~iXnokqSJyVan)?h?eR?A@C+JA>7d>T z-|gORb-eSgRb%W~XCqT^>$B?Q)lS<#i!cNsS{cQr4^gMsztanP(|TydfP#|g(c+6bd~OJ0T=4}r}flx zPSdkp!*3z=d_G4?$RAw-`Y_Mqd;(Uu*tnXI#&KoYcX-ZE^om$5pyN zm5Xgyz>sahh^S_)9joq>jN|bhXPlZZUOf}=bq;g+YGo+p7rm!$!3XFBu{A!BpCdFc zdMIE|6sx^Fo;|!I+VK24%Jfq+mAF7eL`r+=1hB(!@`t9=$sBwMw@^O4z;L6W^#PkX zPEBxqo_bc16VY@QLNk?&o{xX5ZZWIHDsSKQQAC~bX4-}m$~%PAx|D1$KGdso{_yC) zsSZVx-D6n5c``?ct5cGA|JJ@11sO;!!&D^NM8h2Q4d(UOm+9&bnq|GD`I*@U`Qgwd zN6Oo@Pww7#0~lQCwtz~@ZtE|5Eox%Z*fURvh{NHDDG=-(ot8l%CZ64(!0P&}6NGda zd3H;oLrRo^mjrlN#!)$%PL|}u+|<~>^VS!FKfCq%RTye;6szsIT6;Mp-0Z!ok!f1- z>FAJRzRgpR5JO9ewFI%o^!0P{yR{m-N27MU@o4>guxGyC#%NZI#e9`gB5J>D7DGt6 z`qZ=$8zQA~8y)DuWpF)Qhj20#Tj0WU8BoeCAkfuxpI%#>p2aYP8B_7eG|Yn{i65I3 z;@}4K$;63fs4%Y`;iVqsjxkesPc_a!6My8%?7c0k!O;7lhF_q0@nD?A8ir&fo3D3h zrqGP96iM>Zecw{W-dUOb&1k^cCEl9a%`@Qjrx>o8eUM%+$3A zPn@8eDwJW(=Ew?O_PvP*-So&2@e)7U{1f+{@6M`?&buF?pxOrFNvbMPqRUzL_dpS+ zb0}|)9z4Ji=^;P&{5R)B-;6Yey=bFM)o2)Kj`obWFp`ez^aDTor{D9(T#Q9$ie&%HP-RROJ0~9#1YD6wCJ!Zcpr7K@EE_;apFX}Am+@48 zD1S-H-A6Ag*wn@DQ*tG-lkV#O{Q*kt`4(l8G7VAXQ;TDExIz>UIQs)p#8)wp5mKL++*QcIN`@LE>lSbW* zd9ESyYkLF&_DJ9OppBobthUPvxb+tO%O_kv77K9TfWEP0{Zl>)OhGbwUB>`x9M((q zzQ{9Qsi%alElyVV&)O2hS_9jk*4puP-_rUuJVsIlWu<*d;(SH-*m6Axyyx#o5uU2| zUFq8_Obypr_4Dt{Z!hQPJJ(X0*kVZZXV{a!IPJ4RnBs9L_eJC`b)p0aHTSinC5KE| zG+mOXK9F?)wqwjag`BbLzn~dNv_*9pnzDLt{}omK1{==GP#80kk}r`%<>w- z9M3aV4~kBgDB8^WA$py7WqKgs09QP&eaz$S%WciCe#URwH-GvJPNINx)W2>Wf=KfKN_q#(MIZuUn-F?c<;egM@xaTx5@@=&vF=f=6dNdW-6_=ntf`$RW$L_+NudcWsGrLbF*eAK*DSZKiyymD=O z&f9tb(G3gYcZV<)BRlWmhkMmc+c%AUvVbomOomMP`EYrLn;p)9uh(+FKc0k2_^^q@~8-lpQ(>J2a7( z#kfzqSMI0}-W&J$IKGp9K>wn!^ zc-Ye5y~c|yDNE%Lk^z2Bv(Z=;9KP7cXCK5I36q9)XJ>fXcuq)6`mYBf*W8yKD@axg zK0lJm@piZ|*-9)$#v({o-#?x+fC&bXWOJGGHrRA)C>5&ngG3;z?4+on4_**Brn)mX zmb(aXn2;j^Q{Q_aqOM)$r5zCtmtM!r+Cz{YrDQIYg&G&wdWx0CnJvS;a)DvJKU(B(@k-C~LcErf!1h*T<2OG3+<#*2;A7zo28E6JzZ|>iMEtywYOrTk2jf- z0W`XXdv81YEBaGTc}*jy(|7*l`U)rlTn2=CE*$msB52?2~F$K`Tu8_&@O=H-eaAtnfuXqR& zAs>APCv?+7ekoIH19u40xp1EkN!29aO4`D|7%QXE%k8<}F6R*;~>^MO_YaK~VeB~@|lho-981z{@N#ToD!}sm)7Yo1k$>_@g z^KU*hf6Kg&$TL69n6om21NrDuvV`Su9L3Ll8EYoH!{MrY51%iSExhBdA;G_%&_VIC zsPc2Jr-wC^giM{q#?xhb5g9sisq+WP2@byr=E+h6P{Y@1_Xwv>F@iuSD^(U3)%l6O z>sI`sHHS)+@>OaHv#!bE6uV0;aDR!INr0*%duXnVCY_B1zc*;bpy&C$=TsF(i~8_( z_-ZK9c!~+Q8>fDzoFUaH+4@)-(mAt@<|uS=7`jMRH01~vhSPtX*eBXKYd@y zalsW0&|ba%D+8@1DXrTMru&Yed*VrY)LKs@(_zM5Nv!f>oInEc88tkYxwQ*D2t3Z} z&~$P(+FiXGNVMCIhEJzkPG>6_Zpu^_E1hQxHPzI0Bx~ky>0^ z6DN4-mu(_@wpx`YL-x3{<)6o`^&zao75Jpd!|#N0?dx*Vc`Kuftve{9wGCq2P=fmF znEF~ru*@~`xEscZKsmw$xQSBqh^~s1ERRwmXCO<%zxP~*c zKzzj^ov%8}0Fm!!Q(M*w(u@k@cGs*dp82>rWL`YsPmfcdUY+u(Vl`M#FD8ehCMey* z?cD}6?`g*5tRX6-P1Pz6)k})mvD86w6CzkyIMANvcAD^+yCx2whrmeM?CxRcOQZMV z4^p+eh3C%5Q>Jb^GtTy+Ojn<@dTFqEx7+MH`)$z9>`0>6YXW|!OqU5%xt0i|zk;v>6w3O6IgNk0P9^%e)MUU2^FolqTKV2Xjfu>qtR5V4dDDRZwu7Y9 zRR14maAz=G3?-=2oTqGkugbNNmjb%KaIXi4gL_Fk?JXS{Z2;|!nEpif*Y?Kcp)b8I z|Azg#nK`jkNq3h-JU44TYiL)^K2IYWO17e_@lCfDu={8D-hiP{1TJ4It4U|AyRw}b z($U6yfSSMTL!)ww090rqQThxc_Y%si`)jdhFIJKIz6@0sM^ESbhW&PAFw0m*&xl&bT+i|-7<32D8SnDii z9nn9=^c|Aj)p#^y#*$7{EHD^gd=|0z9Fr7V@X0qol43oD2JLnhlOG-)G|=12P9PK0 zK@_V+q1nosGKPY7fzYwOXLNljf<+KCF^LjM0{zyhP)d+KaC~4vm=}SKeB?R z-an@X#k>#uF`C6gk{_Ogm>VAki;JI)yA4;lEoq#Z!6u4RObDs>%$z)>l{GHrXMb;3 zP{2HO=6%X(pqS5;hGY+&eeKNG={{8RW~9=Ydw~nk;sSw}Cq0f%MhF5DXm$ch*9y|T zuI#}(gf&Bmd%1O37n+KX8TZ4rk4R}3s=O&(Lei~9do3F(Dt6};_wW`zDt<(G3suzy z31pze`u1*6OZe81H?|XOK>wkARYTv;$UQfH?j=oBER3%B?_ZB~mq(;~4{GhjEEBmG z&BiHukbw=IU5~2kY%>T#_7#0p{`h|R&dE`osGn8edQ=Ed@b~47T4U)oS+f;sV6QzQy8EE$ zHtp@?T9F`LUP5L{ex>t}C0RfLNC4a|DSeA(uZz7SH#-707HMk6{$-R^A@^?c$`GC$AEY{BFZ~vIDr?@T-&mrEP?C z_LGC*bwgb1gOdOK^f#+zC+Lr8FZkl#3<^v!sTE}+_?M#c4kd<}{_YR41$@ydNe8|i zkih+*@qcdjJpj-I^S^!qK`k)+PjoUa-Ty}_5BxPb!jQlp&FkNSuM=>ev0u%C^?3hC z*#G_-pmF-gI{?1$jaFM<3)}#6wYae(`g(j42G#ZH(7!(RfBpR2aFBIfn{|-%pzv60 z2-Dc?UCY(v^hY8b?5~jeU6o#QeE@Ajb_+uB?$mI2J?f&)nRb0A>+R6earF)9*5f7h zO%-qQ@mnwT&Z#~)a5E3PZH2l?h^^=HB+1~~nXGAT)yAkf`uM~uE^%Cm5&;IvS1OTP z*ufYR>Fx=5v_y}`{ymQnU&x*$zRMjwwS9Q2Xm}ZWylB5e8{+Z_$-8-?ZaVQ;yNmU7Uh^gjRUE_# zH6GL)e0#r|mA6?@y-!qaJ{SNf!<;@e%ClWK5P(xDhU|~>JxIoIxw~@(G$s5yDxTQC zxjhl~kEUe_%+F)X+tmN?S$v}``Q5a{TKrG~O>_pH%+yoK7F&7*>Erfwbp$x%yfPVgR>wWN@v- zKaMQo5!hTA>?D}|$>q*eyz3kp5yGF+XYzfcAb7-}bq@5n32~ z&NrC)+_vLMQ?JkZn6TVVwyP$rUN;neD@+lBAlp(0oTB@WLG5{gx8ZWNmTNUfhU{`Mn!5#CSQj*+X};$BOtXOxW>SF1|Nf4SdvELwX$+jggbg?H{^4OGk%tWv^GgSR?pV20 z#h>1NmH6#Lyc+>FB7>Eny02YMs@s^}QAnk4mMzTMqgdp@#hC=vd3&#)UbLrPbm>r0 zQi9X8T4s{`%ZORuLjRn?{2ZJ&Q~W%g#I4=dbgWW;NB1>i+`e?mf_^3y>>LqlZ0T4F z^88DkEl~y%1}46j?h0mH%RJ|w`7Lbm0X(-}L6a7V-d3Wm86+HwbbFrR-vvp1w=!la zgEn$mVau`tHiQh>5~U!ap<-3LD?Q8q{uS%M-_*O&AiZw8OBfaKzcQnL*mIvNAZXBn z-V`Vm5Bg_&mhzlq10W>nJV-Z5SLyo|3hie#F6jkvVWeSl&`8JMz9_3mAv#-7jG=A5 z&dh5SmQDO5(<*pT-}_SJzxDydWC>n?DI51csK@8O7O7FjgFZW{AaFX@hYszxZBYX5 z3A&72{+{ulgMU9*`KL^d!Ys6Bas#*fRCkB4>or=^%PU?3knAm87XS+DW81F*!jR-2 zQCVX;KP;#;vB)})7&z5!JUdx&BW=A2A?{t4_MYo}bmDK{&_}ck^jlL>wGXXQmwzp} z%AM|_K@Ey@cP@Jg90?vpE0{7oS(i)J^PBKN@Yy9S1;#XFU68Z_8T8$Eh(22er z;m|}ae<=XD1Xgs{2MoAxd8wPEhUGuHDf^lW&Z?Z;eM)Df z2w%K^l%sLhd;>vPCH#~Pkt~_XRCem%~;(PCl}ad&65R0fk!!m%-_Ke-Am0 zD^1UV`F2ObihJGD)0bU8em)dpTV>0g>b%2-Rxtx)HdEBlFwFM5Z{&936~IhVGox48 z-^?*vD}@qGwjxjd#$MJz(A7-AR#jUoa|^@4f&ddYL&vkhw@{Es@Mm8YB=%*;2-02@ z$Z0ss>`^G3uB;zGLRgtdaW|&2zq=c-LW1vIZ6^;OOvt8 z+EHF4N)JBWA+Pr9nla7!@}XN4N1P~&=s?q(dLdy$jMmDY4f1lOs@GHNT)UWtk!5#K zvpM-KQ=a`IV4uUaC~NBE90DOJ<-V%#FNmxa(1ajeG&mj1W}>0Wucatk$L)0+6-c*? zwjT~o2p#>!DT>zA_7g}7+HR;A4iT|fV6Ay#xzLmix}`mq$CxBlWe>w_8G7N*;|C)f zvuBrj%~5(%zRyif;E-nhj~QQl1K1*#3A-xL+BuWyN>i5O&q*`P6Tn(-WLOsiRBqs6 zxcUg0A}gDk`d<79un~t3h|#KgjoJqnK6de`ZMzf1{zBGNR-KwyJ*EOw8?Sa~Q(XGQ z`j{?^x*bCiSxM_Y=cYlUI^r9b9KTKohYrj3iq^K-BoOzd97^boOzz)5exZ>4Tgcs4 z1r_W)ZftX;1~L+`j8&RAGL8M}rnt9yqHb18>B^8so5#iUYZIkON@9?|@(S0S@gxyC zIUCqGw}UgX9r((0|G0U^1UmPVa7?LffzL|J>T5fynMXdy#^A1O6}GOzZa zgbswFOB)7^&z`yF`dq{zLy209QtiHanyfU1C7UwjqyOsO3-;~{iF-GbZ+~)0p6S8P z7Q6xV3XSQdmAdP(Yrrcy7lsDga`&DO5)?Q)h#9XiM0AuI0$%Vvow_ zm-W>)9>v2DvdPgoH|P)*#PsxC1T=H zBBOb_LK8*O5}t6aRV=~U8P1jG^8Q-uu^b7o62QrB_KeYC^MFXD%0GfvXY%^^P3CYu zU=~eXnK7A7@paF9)fUP_ZOqe+E_hW)eCnO$LWegcZlLdK*^xr=9uvF6U4hA*CjN3A zs&<{9w5jJWjY9m>dfHn?>|Z#0ln9oZVVsC*%+52;)zn0a4Is#mHjft>f|RI1YoXGA z`!0}uooHh6yU#rlw7q(qxTM`AjcK5&GxR0ago9+|&j^*qs+YPEp=3Bz7ORb zP?A=;g+0!`usc@~)01?0el)dI&nG(U?W){2TJxk)q>OcCA%nfJU+(ypxU$4~kv3*n zZ=)x-%|O&Q@|`Ag-1r_&}pT!h=;{op}%Y&{_cV? z6m+JThTYda*3x))$2AuLFE!{IHxrjDpA@d2WOA~76Tis5?~*mtcCMG~qT}N&tQX^+o8{yk{a*DgY0Q^()PS+%BP1N)Mmg!06uwTnr)9qyqM- z3|&j`wG?fg zZ(shP?65H^Q}_9cYhY9R+`wQcrFe4;*DItDjAp835Z}EObMOYm7r^~0QTO>5@KC@Z z0Y8tZS!;^O zQ?+rPJ`pREeb15_CFvWV$W|8a0(yDyE?=4@cAUrDU1>3C4^qk&E}3h;V-2<3lV6W1 zLD!2)&DAN*a|Av*r8Oi$d1+7B3`)`N4tBn5(e1Y|2FTVtA=?=fc_ppoHzzV>%JxrI zhOm_#aTsk^pKRMpmtt@x8g;xL8g`WMJvi(d-_jErF;-wN)$#Bwj^)RC{FN2C+FOo6 zrf?`ysQg5iWWD;mpe=~N@yT(q3B_OxpFA zzm54gIs|6dBK#E08fsH}mHDezTbhUHH3H6UDTeP9vP6UcJ9a6P35>5xgtCF|^qArc zS(4-1$%X+MhAAmCH_&WX_Xy9m7LQ2}sSA=48!1=tjwwC&cnum0cJ$$Lqw6;5zJz&v zHP=06m%B&O_AfY?YaOyv&xmI0iP3T`l2?&;!cqD!DMPU+Dr0LXcY7Whk1D+eXF&)T z4=81e8QBzvQ(kMXq=*APzF(vgzTj(e_=heLF_-F_^5e5Fb9;oOSdLYjzsN@%YGh4< zWrB+eVtb{N){ksQ9s>>S>L(}b?dc#APpwv3A^9+lb+{wSL;V3`D+4M4y0*4A{J;?`Bc%G+K?I zE*30VO61|&ZC0msC}UL#gd_9Y?(H|&;kJj9mOX^bO*Fdgs=JIN|F7Nn)tp1Vz;An2 zY!mJI{_V$%1x)I8S!f!qFTvfY!mr-=mFNmZGE+C3U>Id8%P%5XYX(>TY}nIs(<2G- z8PSZ2JRahsLc9@bClYP=80XbhTQ>U~w}Q>z6YH?DcrCb*?dEiVIt-HHo<#U$n{^lz zQm(4x)b|M9u%UFq+zTezildkFbWZp_P7&c7T}DncVkRONi10nDlxT>K?pry2%F)qV zc)QV3C&E{rb@pmK)hDCxs$CO6GsvAA1thzi#?|$^Hoq`#1=}NLKWOU0De_q=I>L6J zdce40$3LUOD&r~d=HW@4>fh{)hr;tmPi!XA5!Dr|bIu`1LarE&w=aeSngdYLHZTL!6bXA-oLmx!V&Odt8Z|nN2F7Y zk)t6&5f(x53xEeAT$5xk)EneCe7=9wf5ChYS5ds z*WXYoIH(5EHvtwzqd*zU$u0P-mMfOh6I>C~O86ODE;Ig^;_pa|15NO0*A5PR+%?_4 zTi}8P4a_Amr+d;ZDF3}SCrf_E7tjjTQOw@L--J@ngx58VRN z4{9mhb_xo}U?8&Kd0;2v&zYDg;CJnMIuFM=?62;Ovh{cLU(pP^Rx6SWvXw;hr0kBd zwS;`^TztkDzC0y|M@Li9(!$9jRegB^QZW1$x&MvPOrv~GWNtlNRx`=a59*f4;4Mq4 zd2RYWD~!>gBxAwMd~p|(%Z%@Rg;~$z7`8|R3GtgW>D<@1+iNKt@cAFWVBHW6d>ec` zBFQZ4Ep8(3_koF0CLzjC<*a@zUElel=*>A(5ah~3)k`%{JUv~vJw6^CFW6T$NEUfI zn%7L*Xle0x=v7d$vrk(AQZYE&h{gZJ@c2e6gU_v%p{%U5aTt4?HCL;OBAb~2X3Do- z6rw$a=P5lpyUBTFN<)<9Wb5F9BTJv1w;Y+x3quhGcChvSIu)KWmV zb_zbr80{aJ>Rtm13=6#h%C}os7!ueA^I}PYI8ASFvS}^ zXy;usJ1gbCv1z{SzX2CnL`gU<3GnprA3XSTMxRU*2G6(->iEyL8bmridUWwIDH}*O z*STGPM*Zy5e<76C;Os}3WN^G1()c#=AMhpm%YOi(6D(s?U*GkO*h~*vuRp&Q+1KYc zrbtxfMGP}Ad=A5^Fe&q==9?6lA?!o(CRk1fPAf$HU)m&?IVlV&`1SW>cXkeiWSXt? zx{zR+`i;O%z2={_o&4B7y?gwohkunLYilX$zHkY<)rj59WB1wb?Jic@qD| qJYztVk^g0_{P(;6UqyZ2-o5yhbfkH+uKor7`ywtURxa|@@BaZn09=Ov literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/contributing/release_flow.drawio b/versioned_docs/version-v0.22.4/contributing/release_flow.drawio new file mode 100644 index 0000000..6ca6b34 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/release_flow.drawio @@ -0,0 +1,721 @@ + + + + + + + + + + + +
+
+
+ Review release notes +
+
+
+ + + Review release notes + + + + + + + + + + + +
+
+
+ projects +
+
+
+ + + projects + + + + + + + + + + + +
+
+
+ projects +
+
+
+ + + projects + + + + + + + + + + + + +
+
+
+ Organization Webhook +
+
+
+ + + Organization Webhook + + + + + + + + + + + +
+
+
+ projects +
+
+
+ + + projects + + + + + + + + + + + + +
+
+
+ + Publish release + +
+
+
+ + + Publish release + + + + + + + + + + + + +
+
+
+ Maintainer +
+
+
+ + + Maint... + + + + + + + + + + + + + + + + + + + +
+
+
+ metal-robot release handler +
+
+
+ + + metal-robot release han... + + + + + + + + + + + + +
+
+
+ + no + +
+
+
+ + + no + + + + + + + + + + + + +
+
+
+ + yes + +
+
+
+ + + yes + + + + + + + + + + + +
+
+
+ version in event newer than release vector version +
+
+
+ + + version in event newer than... + + + + + + + + + + + +
+
+
+ + do nothing + +
+
+
+ + + do nothing + + + + + + + + + + + + + + + + +
+
+
+ Github Action +
+
+
+ + + Github Action + + + + + + + + + + + +
+
+
+ Bump version in release vector and push to + + develop + +
+
+
+ + + Bump version in release vector... + + + + + + + + + + + + + + + +
+
+
+ Open pull request from + + develop + + to + + master + +
+
+
+ + + Open pull request from develop... + + + + + + + + + + + +
+
+
+ Update aggregated release draft in + + metal-stack/releases + +
+
+
+ + + Update aggregated release draf... + + + + + + + + + + + + + + + + + + + +
+
+
+ Integration Testing +
+
+
+ + + Integration Testing + + + + + + + + + + + + + + + +
+
+
+ Merge to + + master + +
+
+
+ + + Merge to master + + + + + + + + + + + + + + + + +
+
+
+ Review +
+
+
+ + + Review + + + + + + + + + + + + + + + + + + + +
+
+
+ Tests suceeded and PR changes reviewed +
+
+
+ + + Tests suceeded and PR chang... + + + + + + + + + + + +
+
+
+ + publish results to #integration + +
+
+
+ + + publish results to #integr... + + + + + + + + + + + + + + + + + + + +
+
+
+ Release metal-stack +
+
+
+ + + Release metal-stack + + + + + + + + + + + + + + + +
+
+
+ + publish to #announcements + +
+
+
+ + + publish to #announcements + + + + + + + + + + + +
+
+
+ + + metal-stack/docs + + pull request + +
+
+
+ + + metal-stack/docs pull requ... + + + + + + + + + + + + + + + + +
+
+
+ Freeze +
+
+
+ + + Freeze + + + + + + + + + + + + + + + + + + + +
+
+
+ Freeze + + develop + + and create a release candidate +
+
+
+ + + Freeze develop and create a rel... + + + + + + + + + + + +
+
+
+ Large integration suites +
+ + (currently owned by FI-TS, not public) + +
+
+
+
+ + + Large integration suites... + + + + + + + + + + + + +
+
+
+ Run +
+
+
+ + + Run + + + + + + + + + + + + + + Text is not SVG - cannot display + + + + diff --git a/versioned_docs/version-v0.22.4/contributing/release_flow.svg b/versioned_docs/version-v0.22.4/contributing/release_flow.svg new file mode 100644 index 0000000..55cdd49 --- /dev/null +++ b/versioned_docs/version-v0.22.4/contributing/release_flow.svg @@ -0,0 +1 @@ +
Review release notes
Review release notes
projects
projects
projects
projects
Organization Webhook
Organization Webhook
projects
projects
Publish release
Publish release
Maintainer
Maint...
metal-robot release handler
metal-robot release han...
no
no
yes
yes
version in event newer than release vector version
version in event newer than...
do nothing
do nothing
Github Action
Github Action
Bump version in release vector and push todevelop
Bump version in release vector...
Open pull request fromdeveloptomaster
Open pull request from develop...
Update aggregated release draft inmetal-stack/releases
Update aggregated release draf...
Integration Testing
Integration Testing
Merge tomaster
Merge to master
Review
Review
Tests suceeded and PR changes reviewed
Tests suceeded and PR chang...
publish results to #integration
publish results to #integr...
Release metal-stack
Release metal-stack
publish to #announcements
publish to #announcements
metal-stack/docspull request
metal-stack/docs pull requ...
Freeze
Freeze
Freezedevelopand create a release candidate
Freeze develop and create a rel...
Large integration suites
(currently owned by FI-TS, not public)
Large integration suites...
Run
RunText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/01-home.md b/versioned_docs/version-v0.22.4/docs/01-home.md new file mode 100644 index 0000000..d75f722c6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/01-home.md @@ -0,0 +1,15 @@ +--- +slug: /home +title: Home +sidebar_position: 1 +--- + +# Welcome to the metal-stack docs! + +metal-stack is an open source software that provides an API for provisioning and managing physical servers in the data center. To categorize this product, we use the terms _Metal-as-a-Service (MaaS)_ or _bare metal cloud_. + +From the perspective of a user, the metal-stack does not feel any different from working with a conventional cloud provider. Users manage their resources (machines, networks and ip addresses, etc.) by themselves, which effectively turns your data center into an elastic cloud infrastructure. + +The major difference to other cloud providers is that compute power and data reside in your own data center. + + diff --git a/versioned_docs/version-v0.22.4/docs/02-General/01-quickstart.md b/versioned_docs/version-v0.22.4/docs/02-General/01-quickstart.md new file mode 100644 index 0000000..b9abd27 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/02-General/01-quickstart.md @@ -0,0 +1,16 @@ +--- +slug: /getting-started +title: Getting Started +sidebar_position: 1 +--- + +# Getting Started + +Before starting to buy any hardware, you should try out the metal-stack on your notebook and familiarize with the software. + +For this, we made the [mini-lab](https://github.com/metal-stack/mini-lab). + +The mini-lab is a fully virtual setup of metal-stack and is supposed to be run locally on a single machine. For this reason, the setup was slightly simplified in comparison to full-blown setups on real hardware. However, the lab should help to understand all ideas behind the metal-stack. + + +Get your hands dirty and follow the guide on how to get on with the mini-lab [here](https://github.com/metal-stack/mini-lab). diff --git a/versioned_docs/version-v0.22.4/docs/02-General/02-why metal stack.md b/versioned_docs/version-v0.22.4/docs/02-General/02-why metal stack.md new file mode 100644 index 0000000..b7c5b68 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/02-General/02-why metal stack.md @@ -0,0 +1,43 @@ +--- +slug: /why-metal-stack +title: Why metal-stack? +sidebar_position: 2 +--- + +# Why metal-stack? + +Before we started with our mission to implement the metal-stack, we decided on a couple of key characteristics and constraints that we think are unique in the domain (otherwise we would definitely have chosen an existing solution). + +We hope that the following properties appeal to you as well. + +## On-Premise + +Running on-premises gives you data sovereignty and usually a better price / performance ratio than with hyperscalers — especially the larger you grow your environment. Another benefit of running on-premises is an easier connectivity to existing company networks. + +## Fast Provisioning + +Provisioning bare metal machines should not feel much different from virtual machines. metal-stack is capable of provisioning servers in less than a minute. The underlying network topology is based on BGP and allows announcing new routes to your host machines in a matter of seconds. + +## No-Ops + +Part of the metal-stack runs on dedicated switches in your data center. This way, it is possible to automate server inventorization, permanently reconcile network configuration and automatically manage machine lifecycles. Manual configuration is neither required nor wanted. + +## Security + +Our networking approach was designed for highest standards on security. Also, we enforce firewalling on dedicated tenant firewalls before users can establish connections to other networks than their private tenant network. API authentication and authorization is done with the help of OIDC. + +## API driven + +The development of metal-stack is strictly API driven and offers self-service to end-users. This approach delivers the highest possible degree of automation, maintainability and performance. + +## Ready for Kubernetes + +Not only does the metal-stack run smoothly on [Kubernetes](https://kubernetes.io/) (K8s). The major intent of metal-stack has always been to build a scalable machine infrastructure for _Kubernetes as a Service (KaaS)_. In partnership with the open-source project [Gardener](https://gardener.cloud/), we can provision Kubernetes clusters on metal-stack at scale. + +From the perspective of the Gardener, the metal-stack is just another cloud provider. The time savings compared to providing machines and Kubernetes by hand are significant. We actually want to be able to compete with offers of public cloud providers, especially regarding speed and usability. + +Of course, you can use metal-stack only for machine provisioning as well and just put something else on top of your metal infrastructure. + +## Open Source + +The metal-stack is open source and free of constraints regarding vendors and third-party products. The stack is completely built on open source products. We have a community actively working on the metal-stack, which can assist you delivering all reasonable features you are gonna need. \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/02-General/03-why bare metal.md b/versioned_docs/version-v0.22.4/docs/02-General/03-why bare metal.md new file mode 100644 index 0000000..5a8f651 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/02-General/03-why bare metal.md @@ -0,0 +1,30 @@ +--- +slug: /why-bare-metal +title: Why Bare Metal? +sidebar_position: 1 +--- + +# Why Bare Metal? + +Bare metal has several advantages over virtual environments and overcomes several drawbacks of virtual machines. We also listed drawbacks of the bare metal approach. Bare in mind though that it is still possible to virtualize on bare metal environments when you have your stack up and running. + +## Virtual Environment Drawbacks + +- [Spectre and Meltdown](https://meltdownattack.com/) can only be mitigated with a "cluster per tenant" approach +- Missing isolation of multi-tenant change impacts +- Licensing restrictions +- Noisy-neighbors + +## Bare Metal Advantages + +- Guaranteed and fastest possible performance (especially disk i/o) +- Reduced stack depth (Host / VM / Application vs. Host / Container) + - Reduced attack surface + - Lower costs, higher performance + - No VM live-migrations +- Bigger hardware configurations possible (hypervisors have restrictions, e.g. it is not possible to assign all CPUs to a single VM) + +## Bare Metal Drawbacks + +- Hardware defects have direct impact (should be considered by design) and can not be mitigated by live-migration as in virtual environments +- Capacity planning is more difficult (no resource overbooking possible) diff --git a/versioned_docs/version-v0.22.4/docs/02-General/04-flavors-of-metalstack.md b/versioned_docs/version-v0.22.4/docs/02-General/04-flavors-of-metalstack.md new file mode 100644 index 0000000..7da427f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/02-General/04-flavors-of-metalstack.md @@ -0,0 +1,29 @@ +--- +slug: /flavors-of-metal-stack +title: Flavors of metal-stack +sidebar_position: 4 +--- + +# Flavors of metal-stack + +While metal-stack itself provides access to manage resources like machines, networks and ip addresses, it does not provide any higher abstractions on top when used on its own. + +As modern infrastructure and cloud native applications are designed with Kubernetes in mind, we provide two different layers on top of metal-stack to provide provisioning of clusters. + +## Plain + +Regardless which flavor of metal-stack you use, it is always possible to manually provision machines, networks and ip addresses. This is the most basic way of using metal-stack and is very similar to how traditional bare metal infrastructures are managed. + +Using plain metal-stack without additional layer was not a focus in the past. Therefore firewall and role management might be premature. These will be addressed by [MEP-4](../../contributing/01-Proposals/MEP4/README.md) and [MEP-16](../../contributing/01-Proposals/MEP16/README.md) in the future. + +## Gardener + +We recommend using metal-stack with our [Gardener integration](../05-Concepts/04-Kubernetes/01-gardener.md), which allows to manage Kubernetes clusters at scale. This integration is battle proof, well documented, used by many organizations in production and build on top of the open-source project [Gardener](https://gardener.cloud/). + +When compared to our Cluster API integration, this is more and provides a lot more features and stability. Clusters can more easily be created and managed. + +## Cluster API + +Our [Cluster API integration](https://github.com/metal-stack/cluster-api-provider-metal-stack) is a more experimental approach to provide Kubernetes clusters with metal-stack. It is based on the [Cluster API](https://cluster-api.sigs.k8s.io/) project. + +Resulting clusters are as minimal as possible and need to be configured manually after creation. With this approach there is no concept of service clusters. Each cluster is manually created and managed. diff --git a/versioned_docs/version-v0.22.4/docs/03-For Users/01-client_libraries.md b/versioned_docs/version-v0.22.4/docs/03-For Users/01-client_libraries.md new file mode 100644 index 0000000..c426bc4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/03-For Users/01-client_libraries.md @@ -0,0 +1,14 @@ +--- +slug: /client-libraries +title: Client Libraries +sidebar_position: 1 +--- + +# Client Libraries + +Our public-facing APIs are built on [swagger](https://swagger.io/), which allows you generating API clients in all sorts of programming languages. + +For the [metal-api](https://github.com/metal-stack/metal-api) we officially support the following client libraries: + +- [metal-go](https://github.com/metal-stack/metal-go) +- [metal-python](https://github.com/metal-stack/metal-python) diff --git a/versioned_docs/version-v0.22.4/docs/04-For Operators/01-hardware.md b/versioned_docs/version-v0.22.4/docs/04-For Operators/01-hardware.md new file mode 100644 index 0000000..82213ac --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/04-For Operators/01-hardware.md @@ -0,0 +1,95 @@ +--- +slug: /hardware +title: Hardware Support +sidebar_position: 1 +--- + +# Hardware Support + +In order to keep the automation and maintenance overhead small, we strongly advise against building highly heterogeneous environments with metal-stack. Having a lot of different vendors and server models in your partitions will heavily increase the time and effort for introducing metal-stack in your infrastructure. From experience we can tell that the interfaces for automating hardware provisioning are usually inconsistent between vendors and even between server models of the same vendor. Therefore, we encourage adopters to start off with only a small amount of machine types. If you want to be on the safe side, you should consider buying the hardware that we officially support. + +We came up with a repository called [go-hal](https://github.com/metal-stack/go-hal), which includes the interface required for metal-stack to support a machine vendor. If you plan to implement support for new vendors, please check out this repository and contribute back your efforts in order to make the community benefit from extended vendor support as well. + +## Servers + +The following server types are officially supported and verified by the metal-stack project: + +| Vendor | Series | Model | Board Type | Status | +| ---------- | ------------------ | ---------------- | :------------- | :----- | +| Supermicro | Big-Twin | SYS-2029BT-HNR | X11DPT-B | stable | +| Supermicro | Big-Twin | SYS-220BT-HNTR | X12DPT-B6 | stable | +| Supermicro | SuperServer | SSG-5019D8-TR12P | X11SDV-8C-TP8F | stable | +| Supermicro | SuperServer | 2029UZ-TN20R25M | X11DPU | stable | +| Supermicro | SuperServer | SYS-621C-TN12R | X13DDW-A | stable | +| Supermicro | Microcloud | 5039MD8-H8TNR | X11SDD-8C-F | stable | +| Supermicro | Microcloud | SYS-531MC-H8TNR | X13SCD-F | stable | +| Supermicro | Microcloud | 3015MR-H8TNR | H13SRD-F | stable | +| Supermicro | Workstation | AS-2115HV-TNRT | H13SRH | stable | +| Lenovo | ThinkSystem | SD530 | | alpha | +| Gigabyte | OCP Open Rack line | | | alpha | + +Other server series and models might work but were not reported to us. + +## GPUs + +The following GPU types are officially supported and verified by the metal-stack project: + +| Vendor | Model | Status | +|--------|----------|:-------| +| NVIDIA | RTX 6000 | stable | +| NVIDIA | H100 | stable | + +Other GPU models might work but were not reported to us. For a detailed description howto use GPU support in a kubernetes cluster please check this [documentation](../05-Concepts/04-Kubernetes/06-gpu-workers.md). + +## Network Cards + +The following network cards are officially supported and verified by the metal-stack project for usage in servers: + +| Vendor | Series | Model | Status | +|----------|------------|------------------------------|:-------| +| Intel | XXV710 | DA2 DualPort 2x25G SFP28 | stable | +| Intel | E810 | DA2 DualPort 2x25G SFP28 | stable | +| Intel | E810 | CQDA2 DualPort 2x100G QSFP28 | stable | +| Mellanox | ConnectX-5 | MCX512A-ACAT 2x25G SFP28 | stable | + +## Switches + +The following switch types are officially supported and verified by the metal-stack project: + +| Vendor | Series | Model | OS | Status | +|:----------|:--------------|:------------|:---------------|:-------| +| Edge-Core | AS4600 Series | AS4625-54T | Edgecore SONiC | stable | +| Edge-Core | AS4600 Series | AS4630-54TE | Edgecore SONiC | stable | +| Edge-Core | AS7700 Series | AS7712-32X | Cumulus 3.7.13 | stable | +| Edge-Core | AS7700 Series | AS7726-32X | Cumulus 3.7.13 | stable | +| Edge-Core | AS7700 Series | AS7712-32X | Edgecore SONiC | stable | +| Edge-Core | AS7700 Series | AS7726-32X | Edgecore SONiC | stable | + +Other switch series and models might work but were not reported to us. + +:::warning + +On our switches we run [SONiC](https://sonicfoundation.dev). The metal-core writes network configuration specifically implemented for this operating system. Please also consider running SONiC on your switches if you do not want to run into any issues with networking. + +Our previous support for [Cumulus Linux](https://www.nvidia.com/en-us/networking/ethernet-switching/cumulus-linux/) will come to an end. + +Of course, contributions for supporting other switch vendors and operating systems are highly appreciated. +::: +## Portable metal-stack Setup + +A minimal physical hardware setup may contain at least the following components: + +:::warning +This setup dedicated to testing environments, getting to know the metal-stack software and discussing BOMs for production setups. +::: + +| # | Vendor | Series | Model | Function | +|:---|:-----------|:--------------|:--------------------|:-------------------------------------------------------------------------| +| 1x | EdgeCore | AS5500 Series | AS4630-54x (1G) | Management Switch and Management Server | +| 2x | EdgeCore | AS5500 Series | AS4625-54x (1G) | Leaf switches | +| 1x | Supermicro | Microcloud | 3015MR-H8TNR | Usable machines | +| 1x | Teltonika | Router | RUTXR1 | Front router for internet and out-of-band access to servers and switches | + +This setup will yield in 8 usable machines, one of them can be configured to provide persistent CSI storage. + +![Portable metal-stack Setup](starter.jpg) diff --git a/versioned_docs/version-v0.22.4/docs/04-For Operators/02-operating-systems.md b/versioned_docs/version-v0.22.4/docs/04-For Operators/02-operating-systems.md new file mode 100644 index 0000000..677873a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/04-For Operators/02-operating-systems.md @@ -0,0 +1,53 @@ +--- +slug: /operating-systems +title: Operating Systems +sidebar_position: 2 +--- + +# Operating Systems + +Our operating system images are built on regular basis from the [metal-images](https://github.com/metal-stack/metal-images) repository. + +All images are hosted on GKE at [images.metal-stack.io](https://images.metal-stack.io). Feel free to use this as a mirror for your metal-stack partitions if you want. The metal-stack developers continuously have an eye on the supported images. They are updated regularly and scanned for vulnerabilities. + +## Supported OS Images + +The operating system images that we build are trimmed down to their bare essentials for serving as Kubernetes worker nodes. Small image sizes make machine provisioning blazingly fast. + +The supported images for worker nodes currently are: + +| Platform | Distribution | Version | +| :------- | :----------- | :------ | +| Linux | Debian | 12 | +| Linux | Debian | 13 | +| Linux | Ubuntu | 24.04 | + +The supported images for firewalls are: + +| Platform | Distribution | Version | Based On | +| :------- | :----------- | :------ | -------- | +| Linux | Ubuntu | 3 | 24.04 | + +## Building Your Own Images + +It is fully possible to build your own operating system images and provide them through the metal-stack. + +There are some conventions though that you need to follow in order to make your image installable through the metal-hammer. You should understand the [machine provisioning sequence](../05-Concepts/01-architecture.mdx#machine-provisioning-sequence) before starting to write your own images. + +1. Images need to be compressed to a tarball using the [lz4](https://de.wikipedia.org/wiki/LZ4) compression algorithm. +1. An `md5` checksum file with the same name as the image archive needs to be provided in the download path along with the actual os image. +1. A `packages.txt` containing the packages contained in the OS image should be provided in the download path (not strictly required). +1. Consider semantic image versioning, which we use in our algorithms to select latest images (e.g. `os-major.minor.patch` ➡️ `ubuntu-19.10.20191018`) +1. Consider installing packages used by the metal-stack infrastructure: + - [FRR](https://frrouting.org/) to enable routing-to-the-host in our network topology + - [go-lldpd](https://github.com/metal-stack/go-lldpd) to enable checking if the machine is still alive after user allocation + - [ignition](https://github.com/coreos/ignition) for enabling users to run user-specific initialization instructions before bootup. It's pretty small in size, which is why we use it. However, you are free to use other cloud instance initialization tools if you want to. +1. You have to provide an `install.sh` script, which applies user-specific configuration in the installed image + - This script should consume parameters from the `install.yaml` file that the metal-hammer writes to `/etc/metal/install.yaml` + - Please check this contract between image and the metal-hammer [here](https://github.com/metal-stack/metal-hammer/blob/v0.5.3/cmd/install.go#L27-L46) +1. For the time being, your image must be able to support [kexec](https://en.wikipedia.org/wiki/Kexec) into the new operating system kernel, the `kexec` command is issued by the metal-hammer after running the `install.sh`. We do this because `kexec` is _much_ faster than rebooting a machine. +1. We recommend building images from Dockerfiles as it is done in [metal-images](https://github.com/metal-stack/metal-images) repository. + +:::info +Building own operating system images is an advanced topic. When you have just started with metal-stack, we recommend using the public operating system images first. +::: diff --git a/versioned_docs/version-v0.22.4/docs/04-For Operators/03-deployment-guide.mdx b/versioned_docs/version-v0.22.4/docs/04-For Operators/03-deployment-guide.mdx new file mode 100644 index 0000000..fc575ad --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/04-For Operators/03-deployment-guide.mdx @@ -0,0 +1,648 @@ +--- +slug: /deployment-guide +title: Deployment Guide +sidebar_position: 3 +--- + +# Deployment Guide + +We are bootstrapping the [metal control plane](../05-Concepts/01-architecture.mdx#metal-control-plane) as well as our [partitions](../05-Concepts/01-architecture.mdx#partitions) with [Ansible](https://www.ansible.com/) through CI. + +In order to build up your deployment, we recommend to make use of the same Ansible roles that we are using by ourselves in order to deploy the metal-stack. You can find them in the repository called [metal-roles](https://github.com/metal-stack/metal-roles). + +In order to wrap up deployment dependencies there is a special [deployment base image](https://github.com/metal-stack/metal-deployment-base/pkgs/container/metal-deployment-base) hosted on GitHub that you can use for running the deployment. Using this Docker image eliminates a lot of moving parts in the deployment and should keep the footprints on your system fairly small and maintainable. + +This document will from now on assume that you want to use our Ansible deployment roles for setting up metal-stack. We will also use the deployment base image, so you should also have [Docker](https://docs.docker.com/get-started/get-docker/) installed. It is in the nature of software deployments to differ from site to site, company to company, user to user. Therefore, we can only describe you the way of how the deployment works for us. It is up to you to tweak the deployment described in this document to your requirements. + +:::warning +Probably you need to learn writing Ansible playbooks if you want to be able to deploy the metal-stack as presented in this documentation. However, even when starting without any knowledge about Ansible it should be possible to follow these docs. In case you need further explanations regarding Ansible please refer to [docs.ansible.com](https://docs.ansible.com/). +::: + +:::info +If you do not want to use Ansible for deployment, you need to come up with a deployment mechanism by yourself. However, you will probably be able to re-use some of our contents from our [metal-roles](https://github.com/metal-stack/metal-roles) repository, e.g. the Helm chart for deploying the metal control plane. +::: + +:::tip +You can use the [mini-lab](https://github.com/metal-stack/mini-lab) as a template project for your own deployment. It uses the same approach as described in this document. +::: + +## Metal Control Plane Deployment + +The metal control plane is typically deployed in a Kubernetes cluster. Therefore, this document will assume that you have a Kubernetes cluster ready for getting deployed. Even though it is theoretically possible to deploy metal-stack without Kubernetes, we strongly advise you to use the described method because we believe that Kubernetes gives you a lot of benefits regarding the stability and maintainability of the application deployment. + +:::tip +For metal-stack it does not matter where your control plane Kubernetes cluster is located. You can of course use a cluster managed by a hyperscaler. This has the advantage of not having to setup Kubernetes by yourself and could even become beneficial in terms of fail-safe operation. However, we also describe a solution of how to setup metal-stack with a self-hosted, [Autonomous Control Plane](../../contributing/01-Proposals/MEP18/README.md) cluster. The only requirement from metal-stack is that your partitions can establish network connections to the metal control plane. If you are interested, you can find a reasoning behind this deployment decision [here](../05-Concepts/01-architecture.mdx#target-deployment-platforms). +::: + +Let's start off with a fresh folder for your deployment: + +```bash +mkdir -p metal-stack-deployment +cd metal-stack-deployment +``` + +At the end of this section we are gonna end up with the following files and folder structures: + +``` +. +├── ansible.cfg +├── deploy_metal_control_plane.yaml +├── files +│   └── certs +│      ├── ca-config.json +│      ├── ca-csr.json +│      ├── metal-api-grpc +│      │   ├── client.json +│      │   ├── server.json +│      ├── masterdata-api +│      │   ├── client.json +│      │   ├── server.json +│      └── roll_certs.sh +├── inventories +│   ├── control-plane.yaml +│   └── group_vars +│      ├── all +│      │   └── release_vector.yaml +│      └── control-plane +│        ├── common.yaml +│         └── metal.yml +├── generate_role_requirements.yaml +└── roles + └── ingress-controller + └── tasks + └── main.yaml +``` + +### Releases and Ansible Role Dependencies + +As metal-stack consists of many microservices all having individual versions, we have come up with a [releases](https://github.com/metal-stack/releases) repository. It contains a YAML file (we often call it release vector) describing the fitting versions of all components for every release of metal-stack. Ansible role dependencies are also part of a metal-stack release. Both the metal-stack release vector and the metal-stack ansible-roles are shipped as OCI artifacts following a specific format that's described [here](../../contributing/05-oci-artifacts.md). These artifacts are signed with the CI token of the metal-stack Github organization and can be verified using [cosign](https://github.com/sigstore/cosign). + +In order to download the release vector and the referenced ansible-roles prior to a deployment, we provide a small helper module called `metal_stack_release_vector` as part of the [metal-deployment-base](https://github.com/metal-stack/metal-deployment-base) deployment image. Its main tasks are: + +- Downloading the release vector OCI artifact. +- Downloading the ansible-role OCI artifacts referenced in the release vector. +- Validating the release vector and the ansible-role signatures. +- Make information from the release vector available as ansible variables that can be used during the deployment. + +The module picks up a magic variable called `metal_stack_release_vectors`, which can be defined in `inventories/group_vars/all/release_vector.yaml` like this: + +import CodeBlock from '@theme/CodeBlock'; +import latestRelease from '@site/src/version.json' +export function ImageReleaseConfig() { +return <> +---{"\n"} +metal_stack_release_vectors:{"\n"} +{" "}- url: oci://ghcr.io/metal-stack/releases:{latestRelease.version}{"\n"} +{" "} variable_mapping_path: metal_stack_release.mapping{"\n"} +{" "} include_role_defaults: metal-roles/common/roles/defaults{"\n"} +{" "} oci_cosign_verify_key: |{"\n"} +{" "} -----BEGIN PUBLIC KEY-----{"\n"} +{" "} MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEdeAXd2namgVNDT0APmogKGwaV+Q4{"\n"} +{" "} rfe4uVgmsyBbb6TrhX5Py6x1PsonDahTvdVpbSGC7QGEjxIHdi8HnJ4Okg=={"\n"} +{" "} -----END PUBLIC KEY-----{"\n"} + +} + + + +The public key for the validation is attached to each metal-stack release. + +Optional further parametrization for this module can be found in its [module documentation](https://github.com/metal-stack/ansible-common/blob/a5977fc618cd34a6cebda262602b8cbc0632500d/library/metal_stack_release_vector.py). + +### Inventory + +Then, there will be an inventory for the control plane deployment in `inventories/control-plane.yaml` that adds `localhost` to the `control-plane` host group: + +```yaml +--- +control-plane: + hosts: + localhost: + ansible_python_interpreter: "{{ ansible_playbook_python }}" +``` + +We do this since we are deploying to Kubernetes and do not need to SSH-connect to any hosts for the deployment (which is what Ansible typically does). This inventory is also necessary to pick up the variables inside `inventories/group_vars/control-plane` during the deployment. + +Most of the properties in there are up to taste, but make sure you enable the [Jinja2 native environment](https://jinja.palletsprojects.com/en/2.11.x/nativetypes/) as this is needed for some of our roles in certain cases. + +### Control Plane Playbook + +Next, we will define the actual deployment playbook in a file called `deploy_metal_control_plane.yaml`. You can start with the following lines: + +```yaml +--- +- name: Deploy Control Plane + hosts: control-plane + connection: local + gather_facts: no + roles: + - name: ansible-common + tags: always + - name: ingress-controller + - name: metal-roles/control-plane/roles/prepare + - name: metal-roles/control-plane/roles/nsq + - name: metal-roles/control-plane/roles/metal-db + - name: metal-roles/control-plane/roles/ipam-db + - name: metal-roles/control-plane/roles/masterdata-db + - name: metal-roles/control-plane/roles/metal +``` + +Basically, this playbook does the following: + +- Include all the modules, filter plugins, etc. of [ansible-common](https://github.com/metal-stack/ansible-common) into the play +- Deploys an ingress-controller into your cluster +- Deploys the metal-stack by + - Running preparation tasks + - Deploying NSQ + - Deploying the rethinkdb database for the metal-api (wrapped in a backup-restore-sidecar), + - Deploying the postgres database for go-ipam (wrapped in a backup-restore-sidecar) + - Deploying the postgres database for the masterdata-api (wrapped in a backup-restore-sidecar) + - Applying the metal control plane helm chart + +### Setup an ingress-controller + +As a next step we write the `ingress-controller` role for deploying an ingress-controller into the cluster. [nginx-ingress](https://kubernetes.github.io/ingress-nginx/) is what we use. If you want to use another ingress-controller, you need to parametrize the metal roles carefully. When you just use ingress-nginx, make sure to also deploy it to the default namespace ingress-nginx. + +This is how your `roles/ingress-controller/tasks/main.yaml` could look like: + +```yaml +- name: Deploy ingress-controller + include_role: + name: ansible-common/roles/helm-chart + vars: + helm_repo: "https://helm.nginx.com/stable" + helm_chart: nginx-ingress + helm_release_name: nginx-ingress + helm_target_namespace: ingress-nginx +``` + +:::tip +The [ansible-common](https://github.com/metal-stack/ansible-common) repository contains very general roles and modules that you can also use when extending your deployment further. +::: + +### Deployment Parametrization + +Now you can parametrize the referenced roles to fit your environment. The role parametrization can be looked up in the role documentation on [metal-roles/control-plane](https://github.com/metal-stack/metal-roles/tree/master/control-plane). You should not need to define a lot of variables for the beginning as most values are reasonably defaulted. You can start with the following content for `group_vars/control-plane/common.yaml`: + +```yaml +--- +metal_control_plane_ingress_dns: # if you do not have a DNS entry, you could also start with .nip.io +``` + +### Providing Certificates + +We have several components in our stack that communicate over encrypted gRPC just like Kubernetes components do. + +For the very basic setup you will need to create self-signed certificates for the communication between the following components (see [architecture](../05-Concepts/01-architecture.mdx) document): + +- [metal-api](https://github.com/metal-stack/metal-api) and [masterdata-api](https://github.com/metal-stack/masterdata-api) (in-cluster traffic communication) +- [metal-api](https://github.com/metal-stack/metal-api) and [metal-hammer](https://github.com/metal-stack/metal-hammer) (partition to control plane communication) + +Here is a snippet for `files/roll_certs.sh` that you can use for generating your certificates (requires [cfssl](https://github.com/cloudflare/cfssl)): + +```bash +#!/usr/bin/env bash +set -eo pipefail + +for i in "$@" +do +case $i in + -t=*|--target=*) + TARGET="${i#*=}" + shift + ;; + *) + echo "unknown parameter passed: $1" + exit 1 + ;; +esac +done + +if [ -z "$TARGET" ]; then + echo "generating ca cert" + cfssl genkey -initca ca-csr.json | cfssljson -bare ca + rm *.csr +fi + +if [ -z "$TARGET" ] || [ $TARGET == "grpc" ]; then + pushd metal-api-grpc + echo "generating grpc certs" + cfssl gencert -ca=../ca.pem -ca-key=../ca-key.pem -config=../ca-config.json -profile=server server.json | cfssljson -bare server + cfssl gencert -ca=../ca.pem -ca-key=../ca-key.pem -config=../ca-config.json -profile=client client.json | cfssljson -bare client + rm *.csr + popd +fi + +if [ -z "$TARGET" ] || [ $TARGET == "masterdata-api" ]; then + pushd masterdata-api + echo "generating masterdata-api certs" + rm -f *.pem + cfssl gencert -ca=../ca.pem -ca-key=../ca-key.pem -config=../ca-config.json -profile=client-server server.json | cfssljson -bare server + cfssl gencert -ca=../ca.pem -ca-key=../ca-key.pem -config=../ca-config.json -profile=client client.json | cfssljson -bare client + rm *.csr + popd +fi +``` + +Also define the following configurations for `cfssl`: + +- `files/certs/ca-config.json` + ```json + { + "signing": { + "default": { + "expiry": "43800h" + }, + "profiles": { + "server": { + "expiry": "43800h", + "usages": ["signing", "key encipherment", "server auth"] + }, + "client": { + "expiry": "43800h", + "usages": ["signing", "key encipherment", "client auth"] + }, + "client-server": { + "expiry": "43800h", + "usages": [ + "signing", + "key encipherment", + "client auth", + "server auth" + ] + } + } + } + } + ``` +- `files/certs/ca-csr.json` + ```json + { + "CN": "metal-control-plane", + "hosts": [], + "key": { + "algo": "rsa", + "size": 4096 + }, + "names": [ + { + "C": "DE", + "L": "Munich", + "O": "Metal-Stack", + "OU": "DevOps", + "ST": "Bavaria" + } + ] + } + ``` +- `files/certs/masterdata-api/client.json` + ```json + { + "CN": "masterdata-client", + "hosts": [""], + "key": { + "algo": "ecdsa", + "size": 256 + }, + "names": [ + { + "C": "DE", + "L": "Munich", + "O": "Metal-Stack", + "OU": "DevOps", + "ST": "Bavaria" + } + ] + } + ``` +- `files/certs/masterdata-api/server.json` + ```json + { + "CN": "masterdata-api", + "hosts": [ + "localhost", + "masterdata-api", + "masterdata-api.metal-control-plane.svc", + "masterdata-api.metal-control-plane.svc.cluster.local" + ], + "key": { + "algo": "ecdsa", + "size": 256 + }, + "names": [ + { + "C": "DE", + "L": "Munich", + "O": "Metal-Stack", + "OU": "DevOps", + "ST": "Bavaria" + } + ] + } + ``` +- `files/certs/metal-api-grpc/client.json` + ```json + { + "CN": "grpc-client", + "hosts": [""], + "key": { + "algo": "rsa", + "size": 4096 + }, + "names": [ + { + "C": "DE", + "L": "Munich", + "O": "Metal-Stack", + "OU": "DevOps", + "ST": "Bavaria" + } + ] + } + ``` +- `files/certs/metal-api-grpc/server.json` (**Fill in your control plane ingress DNS here**) + ```json + { + "CN": "metal-api", + "hosts": [""], + "key": { + "algo": "rsa", + "size": 4096 + }, + "names": [ + { + "C": "DE", + "L": "Munich", + "O": "Metal-Stack", + "OU": "DevOps", + "ST": "Bavaria" + } + ] + } + ``` + +Running the `roll_certs.sh` bash script without any arguments should generate you the required certificates. + +Now Provide the paths to these certificates in `group_vars/control-plane/metal.yaml`: + +```yaml +--- +metal_masterdata_api_tls_ca: "{{ lookup('file', 'certs/ca.pem') }}" +metal_masterdata_api_tls_cert: "{{ lookup('file', 'certs/masterdata-api/server.pem') }}" +metal_masterdata_api_tls_cert_key: "{{ lookup('file', 'certs/masterdata-api/server-key.pem') }}" +metal_masterdata_api_tls_client_cert: "{{ lookup('file', 'certs/masterdata-api/client.pem') }}" +metal_masterdata_api_tls_client_key: "{{ lookup('file', 'certs/masterdata-api/client-key.pem') }}" + +metal_api_grpc_certs_server_key: "{{ lookup('file', 'certs/metal-api-grpc/server-key.pem') }}" +metal_api_grpc_certs_server_cert: "{{ lookup('file', 'certs/metal-api-grpc/server.pem') }}" +metal_api_grpc_certs_client_key: "{{ lookup('file', 'certs/metal-api-grpc/client-key.pem') }}" +metal_api_grpc_certs_client_cert: "{{ lookup('file', 'certs/metal-api-grpc/client.pem') }}" +metal_api_grpc_certs_ca_cert: "{{ lookup('file', 'certs/ca.pem') }}" +``` + +:::tip +For the actual communication between the metal-api and the user clients (REST API, runs over the ingress-controller you deployed before), you can simply deploy a tool like [cert-manager](https://github.com/cert-manager/cert-manager) into your Kubernetes cluster, which will automatically provide your ingress domains with Let's Encrypt certificates. +::: + +### Running the Deployment + +Finally, it should be possible to run the deployment through a Docker container. Make sure to have the [Kubeconfig file](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) of your cluster and set the path in the following command accordingly: + +export function VariableConfig() { +return <> +export KUBECONFIG={"\<"}path-to-your-cluster-kubeconfig{"\>"}{"\n"} +export METAL_VERSION={latestRelease.version} + +} + + + +Then you can spin up the deployment with docker: + +```bash +# ideally, validate the signature of the deployment image with cosign before running it: +cosign verify ghcr.io/metal-stack/metal-deployment-base:${METAL_VERSION} --certificate-oidc-issuer https://accounts.google.com --certificate-identity keyless@metal-stack.iam.gserviceaccount.com +# then run the deployment: +docker run --rm -it \ + -v $(pwd):/workdir \ + --workdir /workdir \ + -e KUBECONFIG="${KUBECONFIG}" \ + -e K8S_AUTH_KUBECONFIG="${KUBECONFIG}" \ + -e ANSIBLE_INVENTORY=inventories/control-plane.yaml \ + ghcr.io/metal-stack/metal-deployment-base:${METAL_VERSION} \ + /bin/bash -ce \ + "ansible -m metalstack.base.metal_stack_release_vector localhost + ansible-playbook deploy_metal_control_plane.yaml" +``` + +:::tip +If you are having issues regarding the deployment take a look at the [troubleshoot document](./06-troubleshoot.md). Please give feedback such that we can make the deployment of the metal-stack easier for you and for others! +::: + +### Providing Images + +After the deployment has finished (hopefully without any issues!), you should consider deploying some masterdata entities into your metal-api. For example, you can add your first machine sizes and operating system images. You can do this by further parametrizing the [metal role](https://github.com/metal-stack/metal-roles/tree/master/control-plane/roles/metal). We will just add an operating system for demonstration purposes. Add the following variable to your `inventories/group_vars/control-plane/common.yaml`: + +``` +metal_api_images: +- id: firewall-ubuntu-2.0.20201004 + name: Firewall 2 Ubuntu 20201004 + description: Firewall 2 Ubuntu 20201004 + url: http://images.metal-stack.io/metal-os/master/firewall/2.0-ubuntu/20201004/img.tar.lz4 + features: + - firewall +- id: ubuntu-20.04.20201004 + name: Ubuntu 20.04 20201004 + description: Ubuntu 20.04 20201004 + url: http://images.metal-stack.io/metal-os/master/ubuntu/20.04/20201004/img.tar.lz4 + features: + - machine +``` + +Then, re-run the deployment to apply your changes. Our playbooks are idempotent. + +:::info +Image versions should be regularly checked for updates. +::: + +### Setting up metalctl + +You can now verify the existence of the operating system images in the metal-api using our CLI client called [metalctl](https://github.com/metal-stack/metalctl). The configuration for `metalctl` should look like this: + +```yaml +# ~/.metalctl/config.yaml +--- +current: test +contexts: + test: + # the metal-api endpoint depends on your dns name specified before + # you can look up the url to the metal-api via the kubernetes ingress + # resource with: + # $ kubectl get ingress -n metal-control-plane + url: + # in the future you have to change the HMAC to a strong, random string + # in order to protect against unauthorized api access + # the default hmac is "change-me" + hmac: change-me +``` + +Issue the following command: + +```bash +$ metalctl image ls +ID NAME DESCRIPTION FEATURES EXPIRATION STATUS +ubuntu-19.10.20200331 Ubuntu 19.10 20200331 Ubuntu 19.10 20200331 machine 89d 23h preview +``` + +The basic principles of how the metal control plane can be deployed should now be clear. It is now up to you to move the deployment execution into your CI and add things like certificates for the ingress-controller and NSQ. + +### Setting Up the backup-restore-sidecar + +The backup-restore-sidecar can come in very handy when you want to add another layer of security to the metal-stack databases in your Kubernetes cluster. The sidecar takes backups of the metal databases in small time intervals and stores them in a blobstore of a cloud provider. For each database that will be backed up, a lifecycle rule is established. The backup mechanism is deactivated by default and must be activated by the operator. This way your metal-stack setup can even survive the deletion of your Kubernetes control plane cluster (including all volumes getting lost). After re-deploying metal-stack to another Kubernetes clusters, the databases come up with the latest backup data in a matter of seconds. + +Encryption can be enabled for the backups by providing an AES-256 encryption key. + +Checkout the [role documentation](https://github.com/metal-stack/metal-roles/tree/master/control-plane) of the individual databases to find out how to configure the sidecar properly. You can also try out the mechanism from the [backup-restore-sidecar](https://github.com/metal-stack/backup-restore-sidecar) repository. + +### Auth + +metal-stack currently supports two authentication methods: + +- user authentication through [OpenID Connect](https://openid.net/developers/how-connect-works/) (OIDC) +- [HMAC](https://en.wikipedia.org/wiki/HMAC) auth, typically used for access by technical users (because we do not have service account tokens at the time being) + +If you decided to use OIDC, you can parametrize the [metal role](https://github.com/metal-stack/metal-roles/tree/master/control-plane/roles/metal) for this by defining the variable `metal_masterdata_api_tenants` with the following configuration: + +```yaml +--- +metal_masterdata_api_tenants: + - meta: + id: + kind: Tenant + apiversion: v1 + version: 0 + name: + iam_config: + issuer_config: + client_id: + url: + idm_config: + idm_type: # "AD" | "UX" + group_config: + namespace_max_length: 20 + description: +``` + +## Bootstrapping a Partition + +### Out-Of-Band-Network + +To be able to deploy and maintain a metal-stack partition, you need to bootstrap the Out-Of-Band-Network first. +Some considerations must be made to fulfill the requirements of our infrastructure, a partition is designed to be: + +- secure +- fully routable (BGP) +- scalable +- resilient +- deployable via CI/CD jobs +- accessible from the internet from specific IPs + +In order to accomplish this task remotely and in a nearly automatic manner, you have to bootstrap the components in this order: + +1. management firewalls +2. management servers +3. management spines +4. management leaves +5. leaves, spines and exits + +This document assumes that all cabling is done. Here is a quick overview of the architecture: + +![Out-of-Band-Network](mgmt_net_layer3.png) + +### Management Firewalls + +As you can see, the management firewalls are the first bastion hosts in a partition to provide access to our infrastructure. There are two of them in each partition to guarantee high availability and load balancing. The very first configuration of these routers has to be done manually to solve the chicken and egg problem that you need the management firewalls in place to deploy the partition. Manually means that we generate a configuration template with ansible that we deploy with copy/paste, and the load, through the machine console. Once the management server has been deployed, we are able to deploy this configuration via CI runner and ansible. For this you need the user and the ssh-key, which is deployed with the configuration file mentioned above. +The Edgerouters has to fulfill some requirements including: + +- provide and restrict access to the Out-Of-Band-Network from the internet with a firewall ruleset +- provide destination NAT to the management server and its IPMI interface +- provide Onie Boot and ztp via DHCP options for the management spine +- provide DHCP management addresses for management spine, management server and ipmi interface of the management server +- Hairpin-NAT for the management server to access itself via its public IP, needed by the CI runner to delegate CI Jobs. +- propagate a default gateway via BGP + +### Management Servers + +The second bastion hosts are the management servers. They are the main bootstrapping components of the Out-Of-Band-Network. They also act as jump hosts for all components in a partition. Once they are installed and deployed, we are able to bootstrap all the other components. To bootstrap the management servers, we generate an ISO image which will automatically install an OS and an ansible user with ssh keys. It is preconfigured with a preseed file to allow an unattended OS installation for our needs. This is why we need remote access to the IPMI interface of the management servers: The generated ISO is attached via the virtual media function of the BMC. After that, all we have to do is boot from that virtual CD-ROM and wait for the installation to finish. Deployment jobs (Gitlab-CI) in a partition are delegated to the appropriate management servers, therefore we need a CI runner active on each management server. + +After the CI runner has been installed, you can trigger your Playbooks from the the CI. The Ansible-Playbooks have to make sure that these functionalities are present on the management servers: + +- Prometheus and exporters +- CI runner +- metal-bmc +- image-cache +- simple webserver to provide images +- [Onie Boot](https://opencomputeproject.github.io/onie/) and ZTP +- DHCP addresses for ipmi interfaces of the workers +- DHCP addresses for switches + +### Management Spines + +:::tip +If you are using SONiC switches, you should make use of Zero Touch Provisioning and Onie Boot +::: + +The purpose of these switches is to connect the management interfaces of all switches to the management servers. The management spine's own management interface is connected to the management firewall for the bootstrapping of the management spine itself. The management firewall will provide a DHCP address and DHCP options to start SONiC's [Zero Touch Provisioning](https://github.com/sonic-net/SONiC/blob/master/doc/ztp/ztp.md); the images for all switches are downloaded from the management server (nginx container). +Each management leaf is connected to both management spines to provide redundant connectivity to both management servers. BGP is used as a routing protocol such that, when a link goes down, an alternate path is used. +In the picture above you can see that there are also switch management interfaces connected to the management spine. This has to be done so that we can bootstrap these switches; the management spine relays the DHCP requests from these switches to the management servers so that they are able to Onie Boot and get their ZTP scripts. + +### Management Leaves + +All workers have to be connected with their IPMI/BMC interface to the management leaves to get DHCP addresses from the management server. The management leaves are relaying those DHCP requests to the management server which will answer the requests and provide IPs from a given range. The management interfaces of the management leaves also have to be reachable from the management server, and need to get their IP address via DHCP for the bootstrapping process. + +In the example setup, these interfaces are connected to an end-of-row-switch which aggregates them and connects them to the management spines with a fiber-optics connection. If you can reach the management spines from the management leaves with copper cables, you do not need the end of row switch. After the initial bootstrapping, the management interfaces of the management leaves continue to be used for access to the switches' command line, and for subsequent OS updates. (update=reset+bootrap+deployment) + +## Partition Deployment + +## Gardener with metal-stack + +If you want to deploy metal-stack as a cloud provider for [Gardener](https://gardener.cloud/), you should follow the regular Gardener installation instructions and setup a Gardener cluster first. It's perfectly fine to setup the Gardener cluster in the same cluster that you use for hosting metal-stack. + +You can find installation instructions for Gardener on the Gardener website beneath [docs](https://gardener.cloud/docs/). metal-stack is an out-of-tree provider and therefore you will not find example files for metal-stack resources in the Gardener repositories. The following list describes the resources and components that you need to deploy into the Gardener cluster in order to make Gardener work with metal-stack: + +:::warning +The following list assumes you have Gardener installed in a Kubernetes cluster and that you have a basic understanding of how Gardener works. If you need further help with the following steps, you can also come and ask in our Slack channel. +::: + +1. Deploy the [validator](https://github.com/metal-stack/gardener-extension-provider-metal/tree/v0.9.1/charts/validator-metal) from the [gardener-extension-provider-metal](https://github.com/metal-stack/gardener-extension-provider-metal) repository to your cluster via Helm +1. Add a [cloud profile](https://github.com/gardener/gardener/blob/v1.3.3/example/30-cloudprofile.yaml) called `metal` containing all your machine images, machine types and regions (region names can be chosen freely, the zone names need to match your partition names) together with our metal-stack-specific provider config as defined [here](https://github.com/metal-stack/gardener-extension-provider-metal/blob/v0.9.1/pkg/apis/metal/v1alpha1/types_cloudprofile.go) +1. Register the [gardener-extension-provider-metal](https://github.com/metal-stack/gardener-extension-provider-metal) controller by deploying the [controller-registration](https://github.com/metal-stack/gardener-extension-provider-metal/blob/v0.9.1/example/controller-registration.yaml) into your Gardener cluster, parametrize the embedded chart in the controller registration's values section if necessary ([this](https://github.com/metal-stack/gardener-extension-provider-metal/tree/v0.9.1/charts/provider-metal) is the corresponding values file) +1. metal-stack does not provide an own backup storage infrastructure for now. If you want to enable ETCD backups (which you should do because metal-stack also does not have persistent storage out of the box, which makes these backups even more valuable), you should deploy an extension-provider of another cloud provider and configure it to only reconcile the backup buckets (you can reference this backup infrastructure used for the metal shoot in the shoot spec) +1. Register the [os-extension-provider-metal](https://github.com/metal-stack/os-metal-extension) controller by deploying the [controller-registration](https://github.com/metal-stack/os-metal-extension/blob/v0.4.1/example/controller-registration.yaml) into your Gardener cluster, this controller can transform the operating system configuration from Gardener into Ignition user data +1. You need to use the Gardener's [networking-calico](https://github.com/gardener/gardener-extension-networking-calico) controller for setting up shoot CNI, you will have to put specific provider configuration into the shoot spec to make it work with metal-stack: + ```yaml + networking: + type: calico + # we can peer with the frr within 10.244.0.0/16, which we do with the metallb + # the networks for the shoot need to be disjunct with the networks of the seed, otherwise the VPN connection will not work properly + # the seeds are typically deployed with podCIDR 10.244.128.0/18 and serviceCIDR 10.244.192.0/18 + # the shoots are typically deployed with podCIDR 10.244.0.0/18 and serviceCIDR 10.244.64.0/18 + pods: 10.244.0.0/18 + services: 10.244.64.0/18 + providerConfig: + apiVersion: calico.networking.extensions.gardener.cloud/v1alpha1 + kind: NetworkConfig + backend: vxlan + ipv4: + pool: vxlan + mode: Always + autoDetectionMethod: interface=lo + typha: + enabled: false + ``` +1. For your seed cluster you will need to provide the provider secret for metal-stack containing the key `metalAPIHMac`, which is the API HMAC to grant editor access to the metal-api +1. Checkout our current provider configuration for [infrastructure](https://github.com/metal-stack/gardener-extension-provider-metal/blob/master/pkg/apis/metal/v1alpha1/types_infrastructure.go) and [control-plane](https://github.com/metal-stack/gardener-extension-provider-metal/blob/master/pkg/apis/metal/v1alpha1/types_controlplane.go) before deploying your shoot + +:::tip +We are officially supported by [Gardener dashboard](https://github.com/gardener/dashboard). The dashboard can also help you setting up some of the resources mentioned above. +::: diff --git a/versioned_docs/version-v0.22.4/docs/04-For Operators/04-maintenance.md b/versioned_docs/version-v0.22.4/docs/04-For Operators/04-maintenance.md new file mode 100644 index 0000000..10563ab --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/04-For Operators/04-maintenance.md @@ -0,0 +1,39 @@ +--- +slug: /maintenance +title: Maintenance +sidebar_position: 4 +--- + +## Update Policy + +For new features and breaking changes we create a new minor release of metal-stack. +For every minor release we present excerpts of the changes in a corresponding blog article published on metal-stack.io. + +It is not strictly necessary to cycle through the patch releases if you depend on the pure metal-stack components. +However, it is important to go through all the patch releases and apply all required actions from the release notes. +Therefore, we recommend to just install every patch release one by one in order to minimize possible problems during the update process. + +In case you depend on the Gardener integration, especially when using metal-stack roles for deploying Gardener, we strongly recommend installing every patch release version. +We increment our Gardener dependency version by version following the Gardener update policy. Jumping versions may lead to severe problems with the installation and should only be done if you really know what you are doing. + +:::info +If you use the Gardener integration of metal-stack do not skip any patch releases. You may skip patch releases if you depend on metal-stack only, but we recommend to just deploy every patch release one by one for the best possible upgrade experience. +::: + +## Releases + +Before upgrading your metal-stack installation, review the release notes carefully - they contain important information on required pre-upgrade actions and notable changes. These notes are currently shared via a dedicated Slack channel and are also available in the release on GitHub. Once you are prepared, you can deploy a new metal-stack version by updating the `metal_stack_release_version` variable in your Ansible configuration and trigger the corresponding deployment jobs in your CI. + +metal-stack offers prebuilt system images for firewalls and worker machines, which can be downloaded from `images.metal-stack.io`. In offline or air-gapped setups, these images must either be synced into the partition-local [image-cache](https://github.com/metal-stack/metal-image-cache-sync) after they were added to the metal-api or be manually downloaded in advance and uploaded to your local S3-compatible storage. Ensure that the image paths and metadata are correctly maintained so the system can retrieve them during provisioning. +If you are using metal-stack in combination with Gardener and you do not run pre-production stages, we advise running some basic functional tests after upgrading metal-stack to ensure the installation is in a fully functional state (e.g. reconciling a bunch of shoot clusters with evaluation purpose, creating and deleting a shoot cluster). + +metal-images for firewalls and worker nodes follow independent release cycles, typically driven by the need for security patches or system updates. When new images are made available, the machines must be re-provisioned to apply the updates. When using metal-stack in a Kubernetes context, this results in a rolling update of the cluster worker groups. +In a Gardener setup, image updates can be triggered by referencing the new image in the shoot spec. + +Because all outbound traffic passes through the firewall node, this results in a short downtime of around 30 seconds. This interruption only occurs if the firewall image has actually changed. The process works as follows: a new firewall node is provisioned and configured in parallel with the existing one. Once setup is complete, traffic is switched over to the new node, and the old firewall is then decommissioned. This minimizes disruption while ensuring a seamless transition. + +The worker nodes are rolled out one after the other and, if possible, the containers are redistributed to the machines that are still available. However, for unclustered stateful workloads like databases, temporary disruptions may occur during node restarts. + +## Rollback + +metal-stack employs forward-only database migrations (e.g., for RethinkDB), and each release undergoes thorough integration testing. However, rollback procedures are not included in test coverage. To maintain data integrity and system reliability, rolling back a full release is not supported and strongly discouraged. In the event of issues after an upgrade, it is possible to downgrade specific components rather than reverting the entire system. diff --git a/versioned_docs/version-v0.22.4/docs/04-For Operators/05-monitoring.md b/versioned_docs/version-v0.22.4/docs/04-For Operators/05-monitoring.md new file mode 100644 index 0000000..ca456ec --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/04-For Operators/05-monitoring.md @@ -0,0 +1,104 @@ +--- +slug: /monitoring +title: Monitoring +sidebar_position: 5 +--- + +# Monitoring the metal-stack + +## Overview + +![Monitoring Stack](monitoring-stack.svg) + +## Logging + +Logs are being collected by +[Promtail](https://grafana.com/docs/loki/latest/send-data/promtail/) and pushed +to a [Loki](https://grafana.com/docs/loki/latest/) instance running in the +control plane. Loki is deployed in +[monolithic mode](https://grafana.com/docs/loki/latest/setup/install/helm/install-monolithic/) +and with storage type `'filesystem'`. You can find all logging related +configuration parameters for the control plane in the control plane's +[logging](https://github.com/metal-stack/metal-roles/blob/master/control-plane/roles/logging/README.md) +role. + +In the partitions, Promtail is deployed inside a systemd-managed Docker +container. Configuration parameters can be found in the partition's +[promtail](https://github.com/metal-stack/metal-roles/blob/master/partition/roles/promtail/README.md) +role. Which hosts Promtail collects from can be configured via the +`prometheus_promtail_targets` variable. + +## Monitoring + +For monitoring we deploy the +[kube-prometheus-stack](https://github.com/prometheus-operator/kube-prometheus) +and a [Thanos](https://thanos.io/tip/thanos/getting-started.md/) instance in the +control plane. Metrics for the control plane are supplied by + +- `metal-metrics-exporter` +- `rethindb-exporter` +- `event-exporter` +- `gardener-metrics-exporter` + +To query and visualize logs, metrics and alerts we deploy several grafana +dashboards to the control plane: + +- `grafana-dashboard-alertmanager` +- `grafana-dashboard-machine-capacity` +- `grafana-dashboard-metal-api` +- `grafana-dashboard-rethinkdb` +- `grafana-dashboard-sonic-exporter` + +and also some gardener related dashboards: + +- `grafana-dashboard-gardener-overview` +- `grafana-dashboard-shoot-cluster` +- `grafana-dashboard-shoot-customizations` +- `grafana-dashboard-shoot-details` +- `grafana-dashboard-shoot-states` + +The following `ServiceMonitors` are also deployed: + +- `gardener-metrics-exporter` +- `ipam-db` +- `masterdata-api` +- `masterdata-db` +- `metal-api` +- `metal-db` +- `rethinkdb-exporter` +- `metal-metrics-exporter` + +All monitoring related configuration parameters for the control plane can be +found in the control plane's +[monitoring](https://github.com/metal-stack/metal-roles/blob/master/control-plane/roles/monitoring/README.md) +role. + +Partition metrics are supplied by + +- `node-exporter` +- `blackbox-exporter` +- `ipmi-exporter` +- `sonic-exporter` +- `metal-core` +- `frr-exporter` + +and scraped by Prometheus. For each of these exporters, the target hosts can be +defined by + +- `prometheus_node_exporter_targets` +- `prometheus_blackbox_exporter_targets` +- `prometheus_frr_exporter_targets` +- `prometheus_sonic_exporter_targets` +- `prometheus_metal_core_targets` +- `prometheus_frr_exporter_targets` + +## Alerting + +In addition to Grafana, alerts can optionally be sent to a +[Slack](https://slack.com/) channel. For this to work, at least a valid +`monitoring_slack_api_url` and a `monitoring_slack_notification_channel` must be +specified. For further configuration parameters refer to the +[monitoring](https://github.com/metal-stack/metal-roles/tree/master/control-plane/roles/monitoring) +role. Alerting rules are defined in the +[rules](https://github.com/metal-stack/metal-roles/tree/master/partition/roles/monitoring/prometheus/files/rules) +directory of the partition's prometheus role. diff --git a/versioned_docs/version-v0.22.4/docs/04-For Operators/06-troubleshoot.md b/versioned_docs/version-v0.22.4/docs/04-For Operators/06-troubleshoot.md new file mode 100644 index 0000000..a2ad473 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/04-For Operators/06-troubleshoot.md @@ -0,0 +1,296 @@ +--- +slug: /troubleshooting +title: Troubleshooting +sidebar_position: 6 +--- +# Troubleshooting + +This document summarizes help when something goes wrong and provides advice on debugging the metal-stack in certain situations. + +Of course, it is also advisable to check out the issues on the Github projects for help. + +If you still can't find a solution to your problem, please reach out to us and our community. We have a public Slack Channel to discuss problems, but you can also reach us via mail. Check out [metal-stack.io](https://metal-stack.io) for contact information. + +## Deployment + +### Ansible fails when the metal control plane helm chart gets applied + +There can be many reasons for this. Since you are deploying the metal control plane into a Kubernetes cluster, the first step should be to install [kubectl](https://kubernetes.io/docs/tasks/tools/) and check the pods in your cluster. Depending on the metal-stack version and Kubernetes cluster, your control-plane should look something like this after the deployment (this is in a Kind cluster): + +```bash +kubectl get pod -A +NAMESPACE NAME READY STATUS RESTARTS AGE +ingress-nginx nginx-ingress-controller-56966f7dc7-khfp9 1/1 Running 0 2m34s +kube-system coredns-66bff467f8-grn7q 1/1 Running 0 2m34s +kube-system coredns-66bff467f8-n7n77 1/1 Running 0 2m34s +kube-system etcd-kind-control-plane 1/1 Running 0 2m42s +kube-system kindnet-4dv7m 1/1 Running 0 2m34s +kube-system kube-apiserver-kind-control-plane 1/1 Running 0 2m42s +kube-system kube-controller-manager-kind-control-plane 1/1 Running 0 2m42s +kube-system kube-proxy-jz7kp 1/1 Running 0 2m34s +kube-system kube-scheduler-kind-control-plane 1/1 Running 0 2m42s +local-path-storage local-path-provisioner-bd4bb6b75-cwfb7 1/1 Running 0 2m34s +metal-control-plane ipam-db-0 2/2 Running 0 2m31s +metal-control-plane masterdata-api-6dd4b54db5-rwk45 1/1 Running 0 33s +metal-control-plane masterdata-db-0 2/2 Running 0 2m29s +metal-control-plane metal-api-998cb46c4-jj2tt 1/1 Running 0 33s +metal-control-plane metal-api-initdb-r9sc6 0/1 Completed 0 2m24s +metal-control-plane metal-api-liveliness-1590479940-brhc7 0/1 Completed 0 6s +metal-control-plane metal-console-7955cbb7d7-p6hxp 1/1 Running 0 33s +metal-control-plane metal-db-0 2/2 Running 0 2m34s +metal-control-plane nsq-lookupd-5b4ccbfb64-n6prg 1/1 Running 0 2m34s +metal-control-plane nsqd-6cd87f69c4-vtn9k 2/2 Running 0 2m33s +``` + +If there are any failing pods, investigate those and look into container logs. This information should point you to the place where the deployment goes wrong. + +:::info +Sometimes, you see a helm errors like "no deployed releases" or something like this. When a helm chart fails after the first deployment it could be that you have a chart installation still pending. Also, the control plane helm chart uses pre- and post-hooks, which creates [jobs](https://kubernetes.io/docs/concepts/workloads/controllers/job/) that helm expects to be completed before attempting another deployment. Delete the helm chart (use Helm 3) with `helm delete -n metal-control-plane metal-control-plane` and delete the jobs in the `metal-control-plane` namespace before retrying the deployment. +::: + +### In the mini-lab the control-plane deployment fails because my system can't resolve api.172.17.0.1.nip.io + +The control-plane deployment returns an error like this: + +```bash +deploy-control-plane | fatal: [localhost]: FAILED! => changed=false +deploy-control-plane | attempts: 60 +deploy-control-plane | content: '' +deploy-control-plane | elapsed: 0 +deploy-control-plane | msg: 'Status code was -1 and not [200]: Request failed: ' +deploy-control-plane | redirected: false +deploy-control-plane | status: -1 +deploy-control-plane | url: http://api.172.17.0.1.nip.io:8080/metal/v1/health +deploy-control-plane | +deploy-control-plane | PLAY RECAP ********************************************************************* +deploy-control-plane | localhost : ok=29 changed=4 unreachable=0 failed=1 skipped=7 rescued=0 ignored=0 +deploy-control-plane | +deploy-control-plane exited with code 2 +``` + +Some home routers have a security feature that prevents DNS Servers to resolve anything in the router's local IP range (DNS-Rebind-Protection). + +You need to add an exception for `nip.io` in your router configuration or add `127.0.0.1 api.172.17.0.1.nip.io` to your `/etc/hosts`. + +#### FritzBox + +`Home Network -> Network -> Network Settings -> Additional Settings -> DNS Rebind Protection -> Host name exceptions -> nip.io` + +## Operations + +### Fixing Machine Issues + +The `metalctl machine issues` command gives you an overview over machines in your metal-stack environment that are in an unusual state. + +:::tip +Machines that are known not to function properly, should be locked through `metalctl machine lock` and annotated with a description of the problem. This way, you can mark machine for replacement without being in danger of having a user allocating the faulty machine. +::: + +In the following sections, you can look up the machine issues that are returned by `metalctl` and find out how to deal with them properly. + +#### no-event-container + +Every machine in the metal-stack database usually has a corresponding event container where provisioning events are stored. This database entity gets created lazily as soon as a machine is registered by the metal-hammer or a provisioning event for the machine arrives at the metal-api. + +When there is no event container, this means that the machine has never registered nor received a provisioning event. As an operator you should evaluate why this machine is not booting into the metal-hammer. + +This issue is special in a way that it prevents other issues from being evaluated for this machine because the issue calculation usually requires information from the machine event container. + +#### no-partition + +When a machine has no partition, the [metal-hammer](https://github.com/metal-stack/metal-hammer) has not yet registered the machine at the [metal-api](https://github.com/metal-stack/metal-api). Instead, the machine was created through metal-stack's event machinery, which does not have a lot of information about a machine (e.g. a PXE boot event was reported from the pixiecore), or just by the [metal-bmc](https://github.com/metal-stack/metal-bmc) which discovered the machine through DHCP. + +This can usually happen on the very first boot of a machine and the machine's [hardware is not supported](./01-hardware.md) by metal-stack, leading to the [metal-bmc](https://github.com/metal-stack/metal-bmc) being unable to report BMC details to the metal-api (a metal-bmc report sets the partition id of a machine) and the metal-hammer not finishing the machine registration phase. + +To resolve this issue, you need to identify the machine in your metal-stack partition that emits PXE boot events and find the reason why it is not properly booting into the metal-hammer. The console logs of this machine should enable you to find out the root cause. + +#### liveliness-dead + +For machines without an allocation, the metal-hammer consistently reports whether a machine is still being responsive or not. When the liveliness is `Dead`, there were no events received from this machine for longer than ~5 minutes. + +Reasons for this can be: + +- The network connection between the partition and metal-stack control plane is interrupted +- The machine was removed from your data center +- The machine has changed its UUID [metal-hammer#52](https://github.com/metal-stack/metal-hammer/issues/52) +- The machine is turned off +- The machine hangs / freezes +- The machine booted to BIOS or UEFI shell and does not try to PXE boot again +- The issue only appears temporarily + - The machine takes longer than 5 minutes for the reboot + - The machine is performing a firmware upgrade, which usually takes longer than 5 minutes to succeed + +:::info +In order to minimize maintenance overhead, a machine which is dead for longer than an hour will be rebooted through the metal-api. + +In case you want to prevent this action from happening for a machine, you can lock the machine through `metalctl machine lock`. +::: + +If the machine is dead for a long time and you are sure that it will never come back, you can clean up the machine through `metalctl machine rm --remove-from-database`. + +#### liveliness-unknown + +For machines that are allocated by a user, the ownership has gone over to this user and as an operator you cannot access the machine anymore. This makes it harder to detect whether a machine is in a healthy state or not. Typically, all official metal-stack OS images deploy an LLDP daemon, that consistently emits alive messages. These messages are caught by the [metal-core](https://github.com/metal-stack/metal-core) and turned into a `Phoned Home` event. Internally, the metal-api uses these events as an indicator to decide whether the machine is still responsive or not. + +When the LLDP daemon stopped sending packages, the reasons are identical to those of [dead machines](#liveliness-dead). However, it's not possible anymore to decide whether the user is responsible for reaching this state or not. + +In most of the cases, there is not much that can be done from the operator's perspective. You will need to wait for the user to report an issue with the machine. When you do support, you can use this issue type to quickly identify this machine. + +#### liveliness-not-available + +This is more of a theoretical issue. When the machine liveliness is not available check that the Kubernetes `CronJob` in the metal-stack control plane for evaluating the machine liveliness is running regularly and not containing error logs. Make the machine boot into the metal-hammer and this issue should not appear. + +#### failed-machine-reclaim + +If a machine remains in the `Phoned Home` state without having an allocation, this indicates that the [metal-bmc](https://github.com/metal-stack/metal-bmc) was not able to put the machine back into PXE boot mode after `metalctl machine rm`. The machine is still running the operating system and it does not return back into the allocatable machine pool. Effectively, you lost a machine in your environment and no-one pays for it. Therefore, you should resolve this issue as soon as possible. + +In bad scenarios, when the machine was a firewall, the machine can still reach the internet through the PXE boot network and also attract traffic, which it cannot route anymore inside the tenant VRF. This can cause traffic loss inside a tenant network. + +In most of the cases, it should be sufficient to run another `metalctl machine rm` on this machine in order to retry booting into PXE mode. If this still does not succeed, you can boot the machine into the BIOS and manually and change the boot order to PXE boot. This should force booting the metal-hammer again and add the machine back into your pool of allocatable machines. + +For further reference, see [metal-api#145](https://github.com/metal-stack/metal-api/issues/145). + +#### crashloop + +Under bad circumstances, a machine diverges from its typical machine lifecycle. When this happens, the internal state-machine of the metal-api detects that the machine reboots unexpectedly during the provisioning phase. It is likely that the machine has entered a crash loop where it PXE boots again and again without the machine ever becoming usable. + +Reasons for this can be: + +- The machine's [hardware is not supported](./01-hardware.md) and the metal-hammer crashes during the machine discovery +- The machine registration fails through the metal-hammer because an orphaned / dead machine is still present in the metal-api's data base. The machine is connected to the same switch ports that were used by the orphaned machine. In this case, you should clean up the orphaned machine through `metalctl machine rm --remove-from-database`. + +Please also consider console logs of the machine for investigating the issue. + +The incomplete cycle count is reset as soon as the machine reaches `Phoned Home` state or there is a `Planned Reboot` of the machine (planned reboot is also done by the metal-hammer once a day in order to reboot with the latest version). + +#### last-event-error + +The machine had an error during the provisioning lifecycle recently or events are arriving out of order at the metal-api. This can be an interesting hint for the operator that something during machine provisioning went wrong. You can look at the error through `metalctl machine describe` or `metalctl machine logs`. + +This error will disappear after a certain time period from `machine issues`. You can still look up the error as described above. + +#### asn-not-unique + +This issue was introduced by a bug in earlier versions of metal-stack and was fixed in [PR105](https://github.com/metal-stack/metal-api/pull/105.) + +To resolve the issue, you need to recreate the firewalls that use the same ASN. + +#### bmc-without-mac + +The [metal-bmc](https://github.com/metal-stack/metal-bmc) is responsible to report connection data for the machine's [BMC](https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface#Baseboard_management_controller). + +If it's uncapable of discovering this information, your [hardware might not be supported](./01-hardware.md). Please investigate the logs of the metal-bmc to find out what's going wrong with this machine. + +#### bmc-without-ip + +The [metal-bmc](https://github.com/metal-stack/metal-bmc) is responsible to report connection data for the machine's [BMC](https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface#Baseboard_management_controller). + +If it's uncapable of discovering this information, your [hardware might not be supported](./01-hardware.md). Please investigate the logs of the metal-bmc to find out what's going wrong with this machine. + +#### bmc-no-distinct-ip + +The [metal-bmc](https://github.com/metal-stack/metal-bmc) is responsible to report connection data for the machine's [BMC](https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface#Baseboard_management_controller). + +When there is no distinct IP address for the BMC, it can be that an orphaned machine used this IP in the past. In this case, you need to clean up the orphaned machine through `metalctl machine rm --remove-from-database`. + +#### bmc-info-outdated + +The [metal-bmc](https://github.com/metal-stack/metal-bmc) is responsible to report bmc details for the machine's [BMC](https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface#Baseboard_management_controller). + +When the metal-bmc was not able to fetch the bmc info for longer than 20 minutes, something is wrong with the BMC configuration of the machine. This can be caused by one of the following reasons: + +- Wrong password for the root user is configured in the BMC +- ip address of the BMC is either wrong or not present +- the device on the given ip address is not a machine, maybe a switch or a management component which is not managed by the metal-api + +In either case, please check the logs for the given machine UUID on the metal-bmc for further details. Also check that the metal-bmc is configured to only consider BMC IPs in the range they are configured from the DHCP server in the partition. This prevents grabbing unrelated BMCs. + +### A machine has registered with a different UUID after reboot + +metal-stack heavily relies on steady machine UUIDs as the UUID is the primary key of the machine entity in the metal-api. + +For further reference also see [metal-stack/metal-hammer#52](https://github.com/metal-stack/metal-hammer/issues/52). + +#### Reasons + +There are some scenarios (can be vendor-specific), which can cause a machine UUID to change over time, e.g.: + +- When the UUID partly contains of a network card's mac address, it can happen when: + - Exchanging network cards + - Disabling network cards through BIOS +- Changing the UUID through vendor-specific CLI tool + +#### Solution + +1. After five minutes, the orphaned machine UUID will be marked dead (💀) because machine events will be sent only to the most recent UUID +1. Identify the dead machine through `metalctl machine ls` +1. Remove the dead machine forcefully with `metalctl machine rm --remove-from-database --yes-i-really-mean-it ` + +### Fixing Switch Issues + +#### switch-sync-failing + +For your network infrastructure it is key to adapt to new configuration. In case this sync process fails for more than 10 minutes, it is likely to require manual investigation. + +Depending on your switch operating system, the error sources might differ a lot. +Try to connect to your switch using the console or ssh and investigate the logs. Check if the hard drive is full. + +### Switch Replacement and Migration + +There are two mechanisms to replace an existing switch with a new one, both of which will transfer existing VRF configuration and machine connections from one switch to another. +Due to the redundance of the CLOS topology, a switch replacement can be performed without downtime. + +#### Replacing a Switch + +If the new switch should have the same ID as the old one you should perform a switch replacement. +To find detailed information about the procedure of a switch replacement use `metalctl switch replace --help`. +Basically, what you need to do is mark the switch for replacement via `metalctl switch replace`, then physically replace the switch with the new one and configure it. +The last step is to deploy metal-core on the switch. +Once metal-core registers the new switch at the metal-api, the old switches configuration and machine connections will be transferred to the new one. +Note that the replacement only works if the new switch has the same ID as the old one. +Otherwise metal-core will simply register a new switch and leave the old one untouched. + +#### Migrating from one Switch to another + +If the new switch should not or cannot have the same ID as the old one, then the `switch migrate` command can be used to achieve the same result as a switch replacement. +Perform the following steps: + +1. Leave the old switch in place. +1. Install the new switch in the rack without connecting it to any machines yet. +1. Adjust the metal-stack deployment in the same way as for a switch replacement. +1. Deploy metal-core on the new switch and wait for it to register at the metal-api. Once the switch is registered it will be listed when you run `metalctl switch ls`. +1. Run `metalctl switch migrate `. +1. Disconnect all machines from the old switch and connect them to the new one. + +In between steps 5 and 6 there is a mismatch between the switch-machine-connections known to the metal-api and the real connections. +Since the metal-api learns about the connections from what a machine reports during registration, a machine registration that occurs in between steps 5 and 6 will result in a condition that looks somewhat broken. +The metal-api will think that a machine is connected to three switches. +This, however, should not cause any problems. +Just move on to step 6 and delete the old switch from the metal-api afterwards. +If the case just described really occurs, then `metalctl switch delete ` will throw an error, because deleting a switch with existing machine connections might be dangerous. +If, apart from that, the migration was successful, then the old switch can be safely deleted with `metalctl switch delete --force`. + +#### Preconditions for Migration and Replacement + +An invariant that must be satisfied throughout is that the switch ports a machine is connected to must match, i.e. a machine connected to `Ethernet0` on switch 1 must be connected to `Ethernet0` on switch 2 etc. +Furthermore, the breakout configurations of both switches must match and the new switch must contain at least all of the old switch's interfaces. + +#### Migrating from Cumulus to Edgecore SONiC + +Both migration and replacement can be used to move from Cumulus to Edgecore SONiC (or vice versa). +Migrating to or from Broadcom SONiC or mixing Broadcom SONiC with Cumulus or Edgecore SONiC is not supported. + +### Connect a Machine to Another Switch Pair + +As soon as a machine was connected to the management network and a pair of leaf switches, and the metal-hammer successfully registered the machine at the metal-api after PXE boot, the `switch` entity in metal-stack contains the machine ID in a data structure called _machine connections_. + +In case you would like to wire this machine to another pair of switches inside this partition, the metal-api would prevent the machine registration because it finds that the machine is already connected to other switches in this partition. + +To resolve this state, the approach for recabling a machine works as follows: + +1. Free the machine if it still has an allocation. +1. Reconnect the machine to the new switch pair. +1. Leave the machine turned off or turn it off and wait until the machine reaches the dead state (💀) in the metal-api. +1. Delete the machine through `metalctl machine delete --remove-from-database --yes-i-really-mean-it`. This cleans up the existing machine connections, too. +1. The machine will soon show up again because the [metal-bmc](https://github.com/metal-stack/metal-bmc) discovers it through the DHCP address obtained by the machine BMC. +1. Power on the machine again and let the metal-hammer register the machine. diff --git a/versioned_docs/version-v0.22.4/docs/04-For Operators/mgmt_net_layer3.drawio b/versioned_docs/version-v0.22.4/docs/04-For Operators/mgmt_net_layer3.drawio new file mode 100644 index 0000000..2edade7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/04-For Operators/mgmt_net_layer3.drawio @@ -0,0 +1 @@ +7V1rk+K41f41VOX9AGXJli8ft2fSu5t6N9nsVio7+ZJyg2k8A5gB99Czvz42WMbWBQusiwH1VLLdBoStc85z7kcj98Pq/cdtvFn8ks2S5Qg6s/eR+3EEIQw9WPynvPL9eCUC1YXXbTo7XgKnC7+nfybVRae6+pbOkl3rjXmWLfN00744zdbrZJq3rsXbbbZvv22eLdvfuolfE+rC79N4SV/9dzrLF9VV4EenF35K0tcF/mofecdXVjF+d/Uou0U8y/aNS+5fR+6HbZblx99W7x+SZbl7eGOOn3vmvFrf2TZZ5yIfCD1vMU7/Od9/+HmTw6+/fZ6tPo1d97jMt3j5Vj1ydbf5d7wH2+xtPUvKVZyR+7RfpHny+yaelq/uC6oX1xb5aln8BYpf5+ly+SFbZtvDZ905Kv8V13f5NvuSNF7xDz/lJ7J13rh+/Cmu089XPfK3ZJsn741L1fP+mGSrJN9+L96CX4UuOn6mYj+EKmLsT8SETnVt0aCjV+1LXPHPa732aYeLX6pNvmDDMTfc54aPIWaoasN95E6Q4S0H0WNtuQP0bTj4ulp8Hjtflz/88eT//K/8p/TH3Rgo3u9wmkynrP1+CZGHHEnY4TutbY0E2RhgCZe+rZDa1t+yt7zYROj84y0fZ/PxU7yejf+e5Pts+2VU653TrhePnlP7ts7WCbHJ1aUmCQoGrrQz9PDf1cLl6+W+poXa/GGZvq6La6t0NitffIqrC9OCEkmx9tPrMt7tKrpPs1U6rX5vc0StLB1aepzDjyQqo4Aia+ixhEUVVVUrYC3CUm/ZYITFo7Z19brKx/N0m+zj5RJjJC0cja2keJfL5dtkl/4ZvxyWKrd0k6Xr/PBI6GmEPpZrveXZ7ihAhDwBWp4k8LUXtQniUwQBLDZXRg/UQQ+a6++KHiEcGD18xbAzT3w27MyC6EUaehM62oWC5r063AkY++ovS0aepd+KX1/LXw+sv0u2xZOWQHR8vfi6xlsYn8KXdpt43aKU//WtdCIPTDveV4/5Q/GWdbZdxcvTG8iVXrbkleImjstTl3XdW7xbH9/gwaOib+2Q4ZvbvzrHNwBnAiYQwUlxc8+FRdR3Q4Wxb5nM85tCPlpGXRr6XIaMBqpENLwH6CMtrgFAH8vNbsiig1n4JFYHZqaErImOUEDIhRc+K6XSVlcBgfBCODF7/yRKAlkoqZbo94vBImDBxOBIFVbgNIAqEJ6hJJx5LBAO4Yt7iMlJ0W2gta/Ih6ZBGLDiCRwDdJOukyvsz4vgU5XpWn6Ai5dl9qi+s+Y7O/CGfjI1N8y6tsxamOlNQPczXPBohknEurbbp/l0sfuWth7cnZShi+fSXz7DbvI35H7Rn0YpBvoHWtGfjs7dIPqH3vDQnw6znUd/Eft6QOiPkZ4j2Y68b2IBVq1eBKDZMAZX2sTMPrGu1WoNdu/dMLe0r1orM01Wrcl0agj4RRGj1ECzYlMcVk9AodoClmKL/MCNfca2S9hpLwom7TqaQDjaBJRtdUeknSfqRw49SKa3eafFfOuAUj8uk3gu5Btd+z1NHOi7hsLbUxDNgj0C+uYfh/LTCof72e0ToDP+SMdYa1tjkTG7W3yuS7QzKDXzc0nKK2MHj6N4GeoA0FU0INSrDhRndYaieaOQTp+xNa8TqNpqWYmehqoFQqr23hI9LICqXdx4VXLk+mVX/qfWnV3uE/3IZ4OMHqm8xNbkYKA2v6utsdpbVT8ercF6hYJvUamVpcEylZrshxi2V3+Jiy7+GFcbCjdY9uZFLqG9PEFDQV0VteIGjKEYCgAiusaQaSmEqgyF+jHORqMbVgC8sWQk7dq6w0E2Stejno6qDrfTFXM7H7mYAzlOt6ADpDPsiSFUWT4vTsI5s6TOn4bJy1wZhnpuJIihoaqtFa7nSLJriomHhZ/ugGp96YIMxzm7a6bhlOME+CXuQ98iqjiissRebyIJClRIFMukm125o7tFvCkvTpfZ20wAXdX1040hsZesWhPIAlBlO8kqibiBnQQwbOc3PdM76V6s5bNtvshes3W8/P8s21R79jnJ8++VOJeCTu9oU9aT2WuCZf203F9PV5+S9eyHctLDqO5bLa48p+WzHVtJSZuhptIuj7c58dnDtcanuZTcZW/baXKO8SqrrFjwNcnPvbGS9fJRz3LGNlnGefotad2HfIFh5bBlJjyvXyLJF0FDPb1coG3VBu66Vnl/f580/teliyVsspyscucOCxsF2yNAKbQKpBgCbTuApbwAA3LVNYeLmAGdCNkblEWA8noYFiZkJ+TiSRjdkIsGBbnMKTy9wOvyVJkuVKagcDh+hQyrzfEGhyG0Pt/v9xfsu4a8g4ydd3HxHS5KoDeeFRRTlmhw+QVqLw3RkWNgiLj3KuyBYzbs2pUPMQo5GwARL/Qu6Qv4kalz2dVOIROdxSMKgiyHta3/eT6rCplEYUskIaALdCOGTLqqZDJAJsyn5D3N/yg/PkHVX58ar3x8xxZU+cf32pwqnrfxofLPT83XTh87/IU/dzOmWihoqgXusEw1Vp0ZgepyAKfQDciiumJU5++wRXUeqrtu28Q1j+qRdYr5u4MdC3kAWn3019LKbwRPiEEvKCDqSo5QX33qRHJqIY8Mw8AQ52XxUseHppYq9jr+3nhb5YcI3zJ2zE7MeFzxxJr1dvWYTMcqQJIW+OsH3YXO8SQrF069nGSdI1FzlTnTSLBm0qqFhlroHpiqVSvgQnlDtn7D0j/Z/Wxb/2Y0SaBHk/geqUmI6hpRTRLQmkSJHiFvWI8e0RlfEinIs55Ivy8YhivSmagblNIhJdy40jHiitx4sKgzBhRKT9excTzy2/WfVC0NR19Ig3R+cInXonYUV0VpPf8cNKtrXH8c0AcBZ30bf+JjfoQPFRpK/Ak30NisgnEPJRLVKL5sjdLvtILLW6o5wC/N4teUe9DQ1PkIiuTMTJUrmn9v2amQ3RwQRGS2g+620qptEGRgBUGxOzrOCiHTx1n5dHVeqVTv/QgZoYPFfAYh1J1ZQrdy1DOM75wS7dI29ql6rD56dbSgqwoPQkFj0V2RAriBR8ATXWaoVSgCfzjOR+1vXOR81BGsG3c+cMFpp/PhSs+j9OMgfkL6gQzoHvazDFfolLJZZ0DOI/1ltphu/q/DjWtH9h47sFQfBolN/YjGdr2FTfy+kMeRTH5puzbJvHaJdLNKKSm04sarI8TJM2NxXPrEXI2mFP79nipGAk0VI4g84kKw9lBW4i7g12I8DlC3Tt25MaRO8kVxh44Fay5YCxx1BVhhOWVoHdn6PtloHepBa7q+L5iA5o9e7OYXXTwOdp+ZD2Wx+/ar5AROqtIL3iH/oCpJJfzlQPgG65rm0UNU5yyP2gJPZrEPJJxE0zGZkD8eSRLnHu5w6KBbhjYs6J4FXbJwwDTnRp5Rg9mWqZ0oIZopiqBsi7wfBylpXSx0o3tOJcpAusex5AF/BLktKeZhNSB6Fz1sMBszkOtvs2gtB6153HQ9igNcd9QN48NK+Ef8cxnuH8YPFnZHf/eDW64RES4wj4bYDnroGB3gN+FKDnTwXE7yQr/n2e03ZcObLU+50khBLu1QahZLOhby9OOvI0ibLsaLQFk0WsYvyfIpnn55PdC0eVRT8NEJAklkC9tNpR4jDqB1MGVkk9XuU0v731jCgwROG3PjWS7mIbJ2EixGnqOb325wMI6RgNHIYN3v0ZDc70jU+65FUPn4iIjwmwJiCc74iM6FEAlPiksiALiZppJhcHFTBv2WEE4i1CGHh79+TbZpQbUS5HseOwMAFJULKL0JnlOdSeRwfV+MnenJkGHHQornswCHX5Avbs8dDDnapAOaLLqb8nnJskOf0W7naTUM8ClYQ4DG84bB0KCxjYtdsNgDAT3RY2AA1quqEdAlKh4joFmhO6yDhGQ4otCiFgO1SIUXQsOo5d3MiKKHRS2HPeROBMY8pAS1IKF8ASAPKVIOW/wy0X6wxclUPjZsQSJ6Zh62/JspWRsGbPWAH19TkAQQPhxwtdtC/ArenkF5CyrdWcsCVBiza/TCisPPgDXm0R1OyWMPqhtS5F4CjQrpb+cozYffzx6zZAMt0lkgdIYWaHH4MzGtyyqf/rTtZxym8eQ/a/0pt/6ApkBY5DkTGKIAeNX/t21BoNsWxN9nHUwTzXwDcDAHlOi8c4jxIz0QAxwIJqgsBQKB7wUOitoYo93fxPMMrL+pxd90SEvWOMjgjLwKZwZZa5bBBOQRkgGIjFuzQEYKjscF1qdlcIEfBRM0OD6AtmheQIAJz8BnTIHXG5GCRjOowx0OqKKvUvqR75xyMq89y/v6ujTS5NBdlwbpcKnFFFoddIc4NWOKmdMCBz/CTgWmVBIiUBWraQpeEBA2KslnouhDhe51o48rI4hm/ZuLzKOwRfIIH3ZtrixWRpDDejeXeTfdPFA7QJq4wIZT5Sg05cqHPDc5Ik7PElY+RHlH4HiY5SQfsk5+E75lpYes1xkqa1mfSx4T51OFjmnL2qMbdSzZqDJ1gIZGNlvvqc0hqrZaoLpcUzjm2iaZzoUC3MytyyHyZJStW4eoR8IHQEQf06q5esnI+QTDwKU6bD1xArcVZioc17PDDIo/JPZCe5o6nCMCcYQLmWjDHHStJMmcpm4ZVrUwiu1pGcX3Nk5wUZwgJLKgbHDUHCpgHHlvLXSqI8sl6vKBaQsd0VUMlmxUnSPwh0Y2m2nS5VghTWfemW+kQ/w2Kuvm6HFzPHyWtLkK6tAEsgwDJRpuTth2c5BzHuUk+zlIU84aOBBeBzq0o+P4HStJcnToe/aqaRhqPR2ksIXRejpi9Z5MfNRreeG+emswnyvaRwTdgPFUBO6ItqkI9amIShN0pyIGP6Sic6XAgRMvOv2EQjpPmlLybdRFwH2PCNPEPBoFNIEsGqlBI9yuJ4BGhjoafVcWODn4ZkxlSgPIMJIJRm+zMcvibLBs05YtGGKOyn8slvIPPzQLHX8kmTWQtGsc6DAakCBrJD05a00imNDFMVsHLJN4jiuJh6QHMMYBCQQZQ0AwPKKLJlmHcipEdjqgjolBi8JdEQO4vpB06KXHmaOmWiOgiCORmIeQl+eEnDvPiDVcqj6krPTxnxkdIg/m1I/dtrZjnV2uN+IZ8YeAa+YQx3IIg0N8jPGmOKQ+TWYIvaLwFtJtn99WG7w78XaKrzQ+aWAgb4QEHQGo6yAFz2kHE6KAKLVXnfGL+IWN3dB3Mb4dGsueGcL0aABH1rOiwPQUA+j2r27sFnppJQc3AYJ9oEpTJIJsGwKO62lGIP5USHkIxFixAUreiDgi8LLRsPd9Ah+AgHLqjM9cqeMrDa4p52fRKZ5b0izS/XGHPD3RtKsFGYcnlnSju0wt3VoOkPHZrRAHrwjK0UN0LOWalPMHQDnaxrdYSVOuPYABoQEoObq1woJlF+F8Rmm2ZrLRVbQWKTvJ5psm25mprpqjwNBGgUeMKDA+O8gch/QJlknlkFAVh9yYb1rHL2sHBxjX2oBfJqyZSyLLJUwu8YFpJIG0M2WGR3xlGcdb5xHfN44kjMHC1v6nO6hgi3CsAiDNZLP2fzfZGE3sdVuPMcp5A8+B3d7Q6DrLD0aasvzQFW0+gK6mJFtIZPmBS5aCcpJsl3bGBURvQlhVq3Jb9siuCC/Q0EhXU4jdSFebOvjabhOvW0J50bEqtMFU3PRxScLK2l7/Jecsr3KB61c+WGpydgIil7MFkr6gnDfD2eJn2HztuCXKEqzdpbODsj0RgoQqDD06GMYqmnXVacL+zXJWExrXhIGoJsT8pv6ABrLcxEeTxumBYjNrLx40S5xSB/B5wdwZuOQHkKNFL54dv2H14s3qxcDqRSl6ETi4mcOcYuw/0FZtmeTNdXaeCsFPuvBTSxXKV4yiZ4dAXM6hvA4T+6K1xgF9daHsSs1616x6ujP1FFr1JEc9uZ5Ys6M69YRhRPrRtHY+keB8It/w/Lb626SzALQsIMYCkXEW4Jcy9WMB17IAQxEENAsA4yzAzB2DcUlEFQlkjel+2alI5JGK3I88RvK/HhqkydNkppEtBYUoGOFhjQbpR7tLln48+pHz7PHpg+bIx5qL/suHkef8O9t+SbZ//FH8+ls8/cKYsBPvNsm0vMF5+l7u7dOmMRi2+O50s0sas2LPTn9pbj1kUDcv40PUyCPfK8fxFzy0iGeH2E1JxVm8W9SkTldxGdHA//2Yrl6LfVqmhVZ/nr6t3pZvu+K3bfGA/30pSPvf4l7j5WT37XV0bmib7z8XP7LUantomw8ZhT0hzRJ4iHUflgg9bzFO/znff/h5k8Ovv32erT6NIc0QdtIeWUcXtMv6IZ5Tr2HQHpNogPaG2GIMrRhrEeMwZBxVolOMGX0ebI6gi8EsR8jhCJf0lwCr+0crU9Dib2wcZ52nuZGkjT9qFTREXRUNh7+EZ+Urz7yA9qnLfkCoIvGDvtoLBafZd/KHb7KZmDZZncnhX7EcY4LViUumy3i3S6fnHJAD9X2/5ynHHWYAvtZ3vipuFautELGTCLoXisSYQxpF6Y6zB6WoQ5wucT1JqZV005Q2P6wbQQ7sJsYomHcj6O4NrfYBFK/quLaeQq9hwWWSzuoNj1G8cU7QlB8V6nuEOVtXz16KTRExP1c7NNEhy5K1GJ6QcWySO0Taha19R4gOP/o64QaySm34yr6SxfOavhLEoWt6bH5jUgRwgvsgr1D1nWsplijcWmsJ6UM4iZo/cmjasaxi8rp0dPFRyVvKFpJP3vPLqiYvq46CIO/tHmZx6nfFEQvPFT7LwuXzSy/NhzXxIx5l4YYC5Ah12iEuHVG6IwEA0G2Hd3yHNa1PmQAw3RufLvs42OB038FdcT9wAxFaaLXCXda8pzvmfsbkDM28zyiZ2aTr5P4PzkFhJyn0Av/jOqBAxG0UtmeBa9wHZfYEPCgtfehNAlm0ZC2mmJbM4v5HpWXgyiIkuZI8Kv75/NPX2T/+9q/v3/78z/I/v/80H//9fcw6b0qiXfEST8OZyyJ2ofI9NKuJTWkoBv3F3ceQOTJNmQXB3FnaYtvjqp6hWxA6iKHKhmDSgjXl5+a4nD7xE3haT/xkbq3QiNET5195sMkNywOAXiRCNq0CAWjc3+03QtA0/F7anuSK2hoZOIyKwFptN6kFIlXUomNfSb4QCUIOuHNDBq1cN6LqNyGrYQqHz1vk8lWRi9kudUK/A/Q5eMtP3Y2VpHBnAzDH66o9IOrGhHcMiVn+QcRovmLKrjKk5SvIaq7DtN6bE+Hd5+dDeI3ihZ/X46d4PRMdhTDQymFeYVA9kIxbr3th0U+1jXhnCP9RiLV6+opjQJrDXiBYjCuwlkOsJGlMGf1FlcyI31n7A6O+Y8rYskWHk45zyR9cL44BIkcah4hlc2pVi5AVa7BIeDtIiLnLmTgorNRa30gamW4o7Ldrq6mppZyAQlpJ+Mi47TpHKH5/1GfaKHlaAd9WNp/vkgvDgGWHVVYKzuntBTotfslmSfmO/wE= \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/04-For Operators/mgmt_net_layer3.png b/versioned_docs/version-v0.22.4/docs/04-For Operators/mgmt_net_layer3.png new file mode 100644 index 0000000000000000000000000000000000000000..e2e455f99e5d1f09f0125dfab43994c45d4a7fc2 GIT binary patch literal 298312 zcmeFYcXSii);3NENhnDm1_Ff8F#b(bzXzfWAb!DV8nZb%UEwI&A=90GUW9 z41mZGxbWYVpb#{G^!s$=dW$|_|KM$jMVdo;>%SIg3u*`omn+EYKbq^Ls_6nm`tOBB z%z>aCNac4K{pa0@heNo}{I9bnbHr{06Coy(*g&=>yWSemyTL8?e~Zthfl!!W@x)_H z`Di}h<`hN^{}P)=4_5H|&{815{$TcrL1-!{;7lgM0y1PFLn?`e!Q^Q8E<4>4B3k5O zN{A|Ec!Dasmj-Uq@o_8BNoP{5FoVI0N8)6nT4YeeSU6~pav_yaXo9`+kdaP_)0{>J zgD&+0F&Isu2cLlvxHwBeB_DENJq9zim>pSwo{^USAsq7&ml zrf5hf2H$)ihLWh3m@`792EgA6wSns8;v#Cq0xO&Wa+r=Hj16Z zr6w*VmJ_9eF9VlLW6&((AVcj5hJz+oB&ZProrL`|KP@6o3@Ks|Il2fHa>)Z>fruoq zFnB?tf)uyJLfjanp|BWXp@FBON9;lfp-U3mrop4&B|1?kXqJW}5~al*2@7e$5W}tU zNjU-wxM=lBDVz|UZh*)HM$DrD>JL+W9B_qi3ewGLhSBe%kz%;az_)ma2_*aJdq*p=5gH-Ay*GaqI9kXG7IBGsT)iMm2jkd@B=;`Fk4s&4txsm6^=QP zn8j;R=n$WaW-$rvNZctG@gyXoE2PI2yqFahhNZHQ%_Ijlg8K9fic#st!bS^Fc+^RD zlfiHnazvF-IH}P|B3cYWs#s5>#E21%gWwVSNhX6%VrLV>LWhd4MBu1TN3_|%?cm8U zYNuEdyKjVqCWRZJM+hbrWK>htaka%`S3)t98`dl3JU`@ts2aMOq9JIA`hbb=V`#z# z9?|Ebnh-fT2K*7sN7*`9CevYLx=SeVd;KmitdDWj=3tP+!=u1C5Caed)((687K09^ zM_e(hLvKdC29^d5L(wn^*V7mxFdZ_*04u|KwLyrIJT`)frNE_xpeh~^8W}`clx?Rl zJs90ChXXXCS0Q6rcvhP=XmH|YKT~23!A1*YA+RJ|CRM@?*nAL$91z=dF&$gT5Mpiy zA`{v$0*#@uDT0VrMPleg5ne)qDnmkxUBG}~vm0S(47`vhfU&({X&`1YLZqOOj0&j) zB3%(c{Tg}z>cI z@Xjz(E9Kf$3_aN>A~6!?4=I4j!%T%$A>y%l3a{T_#>v1~$p(Qp#=wbkGbyIP2@0W~ z5JEg6H%3sh)ONB0VseSD7=j^GHHSjPVp>yN#Pb9d-lzyyITac?o9X0*BT`r=(5Z=G ztCwekEiAjqL*qkiInL(uLrOVVye1k|GqIo>cAEV`rVxu_xQ~a#5V^t;SF@PLsLeuR z^Cb#zD8$qQ&kD;B0ud2$5R@Iaa;Pkwi4R${o|pyp;Q>X+5@n(|7*WecFgIWKa;v65NHLzwb$egmXw{ zSp=67?NTx%N2HiEBuMxyu8v5nv)%$LlhdDOhoi3304h@z>+(F@1^i0AZ(*bM=VBlvSSfC zfeH)_Hfdp>hGOJLP$Q0*sSHn8FA>8eM5`wGaF!m{1lbHx;z1;=_MjMz6l4TF7{@|) zYN;_OVBqlFVqyqfw;5eTn@7nBxG5BYQbpHFxK2w<6vAMyAmqgaHVs$qkWj5Lluppv zJPL|K50O1ep+*(7@fe6oDYT)AP(-exs+q7VOmoEiVFiz241*AXCLCNyLW>v^Udu0w zN3}YsichiYN&Ki14q03#gO;Wy`8{O1+AD=vR*l8$;sxYnu}k34=#V%XOavja9EC`9 zk)BLMIn*dkL=GR{cs!NNDPX82Mu$>M3NT@^ zmhR#a11iWy76)Ad3RfzFR9rRHBLEZB5v3kp3?>PT1}B><=UB9Cg2Ws2#LOO^EUt69 zP0}b);i5TlM5-~$VHm+6l|cZ-rB1a%gTf*yD-pa*Op}I6uqt&9kC+G%;)uX#IpK8?1TyVeBp$ynF9{8i^_0HDSA0qX(E!;t{6oT40$9pz1->0Aqu_9#C0>` z|O+RPDxTrMOFIA)KZf{DX^;K-mrB4)tg0SCngz6A^+N{DE6h)YK?l1->X zD+oEwOr_hZk|S(3(W7O`Nlq9J%l-N&StG(kRJMUf67YgdibWX}vg15O(1AMREGkcC z6tg@6oswjuT1^(0Ujgis9fQdlgwC?L5}*hci4mvRYcbFOpaE~!nxYT|jyY)w@FuiN zAY6%Y=yU;YcMHW_E8QAVYHWTxk8WYIx!j1#WJO}cxHcpYTC_G9F19l5ny}48uvwx! zNa_jt!zRqGrP>KbC5$>HdME;3LMO%4s6xO8!IOtMnHnlvD{^aODqJmRD)=@jt_kbG zZBWARSaj{vJoL=a}eo@s6Xa8wAU zVn&Qwoy#9Uym4ko<6^R@HVy?wO-8jh9%9%4=7zm=71v@4d0hc+Na>))6me73NJAq$ zW=INkDQY*fd1AAYjVN6*+!l!hlyC*SVQbh#Cb-l>UyLd-I;k?M&@J#t z+)gzj_Mu84V$fhx1+4Nz2Bys-;25Mtj!y%o40Z};xWQ`CAmnvASyFz4%~1M87^G0! z-FCTEtaZwzN})LjlNnxz1l-O?1(+^Qlv!N#D1w@uB8W{A2vmqXV2k!ihlcS9$f002PD79y%EoL}X@y7f42Kj*uyO)SwAV$z(5+4&c4_ z_cCn83S>|%?x-iVqiB}k|wE8VB_BN14bc#9RH$jAgS zH-Txab{<6pNnQ4^!J;N<{W`?Rg<+14rf1Ot2AQ7|#dK;m@aR0MBuEhQ7+h2>brDS} zJfJei87x`YW)||<6)0X7$!J0L_gObmTGK-5LFOhSs?^db7dMI z6AqJMZdArM>hw0XAPQ^}me3(CjT19cxFjW;O4pkZC>AA#UG%V67#BzhWIJ%`FlMnc zk+9do5Q;=9iC-0jY;KHBNZ>-Zoajy@AK()(N~C(Hfy71Zag~jL+LZ~QVh^gIh*k#n z2u=6_S&YvYTZn#&SmbAzcp+j?>GTQ$21kr)wZ-Vcn3l^og8M`&vqPX&fu|x=v%sl@ z6*0_echIa@03j+}25Vw4p;GIJN|gbXm}IcxJ|`(ABMDGPROb~!Rz6pQp=vdotW!J9 z#E6qlRC`TS0^c8|MT2gy)a^iN5sFM^mRcE*hvF3LXhIr8-~f<@8X#Cb7M_%96DX}N zFb9bYq{VR5;CGuX7|=qG&`UEgoscKUj5<98jZDN3%cU}kkR8?VY^cqE7Ag$h|hV-Olq8abYAzKm}@>QAje|%}TNpcS|ehlyc~C4kA%diFizp6VL$HVKO(q1!O!7Y^lf=@`}t7rxxfi%qEhZR*^}{H!C7yBx2SWXbO`jstbk`0f$WP zWCv+3egJiPsi;&+B2%Ldxz8Jk@mx%`LuZJ|X?(ifZ?b5tbb>)fQ=!}#!RlnniAFwA zN%e5;OtF`%jOvJLc>)146bazyFstb-7EGWUjAp)GXx7>RWRVMDpv9&*Z=c`g-PQ5K^P+XR++%)3GNnZ6Z96!vTMB}Zj5P=q4X$^rQljQQnyGD z5mR|60>GGz1f;=KS#%n?gB16;_+ko8_6^ zG(o56V2JLEM1}GoLnkCjl&B}+9bIwUjo2*$k4&UyXw4+O&4DZRDnBM7h=oF(*~thY zE)E1?LKnpsV2MmdBCf&0s04N!Tm*?zZgv>N1S&|}X@Nrq;WU=trb2@X zde9pQm||9M#16AKGFYuf0Q`Y<7}G4}nTcVWG6v~{E{+Bv#0*rPJ**AD&cq#Fqg6pC z1Vb*76Q^-mZYPyar_gyZl05{WIx)d4O<+H%El5>}RVo&j?}J?&mP2ObN?9Ra81YC& zUOvMk#dJO#3bJ5262QDNf++@`Vrb<$fdgZJ!?=n-LX?t-kH=Gn9Abllt&fm&5|Fh7 zgF*&FWw3(fx{L$`*-mBZMLwJ#mC$ySRvW4#1Ylr&W--^tk16D4 zlR)WAOwb{;3d3fCT+0s|WC8(`uM?v@L>91_90XX52$cl0ofZrt{HVg@5V%BojHj0= z5SZ#FLps!LMs&I`(I8@DMhF-ntfg_3mV`dp)Mf{nM|TIUdKo}qEG|LIWUJ*;AFgr* z*g*~(gfE@M&CjdmkOw+W;41W-^I%}RZctP(;zwb}*ZQvw%=s4z?s2|yr% zX+k~3HAjNR06`WfC!`0X(YP&cS7R}&k?fX;#B`;Np?2a4Z*NuE3}(y_iO@r#fR&_m zlawUfMOQizCdug_XgPGH*aWkDGzDVU0h>krfq1}?cqLoNp@nTUBA+ga%hghagiSTE znGS!l_(Aj2fR`nmm5S72+AR^P{k)YgP<^A(8iSz0g{n9HU}nc;ykjg$bJ!N;lCda^OsgF$kNLPNJL^axlX@l2;z}y9};S7?){esM#yv z$O3*X7N&5*Vvi;oG7;RGfSFDA^BpR+9q}6+J~BnXb{W*bR#9g}qE^vd%#b-^5h6;8 zB+8btC>|CrV_*tb#1@dEaT-D)dQhQ@rP788ArDMc(RfyjuaemSG076C6pDa9BmtU$ z>LRWHOG^k?orqFN1d@Q2BnA_MfQ;NyzL%t6(p7HAMW*ZdTCxwLS?Oc}MMOgQ2o7`Y z5ScC^(GY4-ZGg047y|htgT;>;5eZjf)MzbKR*2{j@)Ir~5|qMfmWQOU`6ybyOF-Ak zjC6_B0IZ7SH1Q)kR8J-(!e!W(0FQcxo}y!DWFD&BO`tm65uXmy|lr^T#|J1ubnLC%+WaAnk?j(P=31;UEPykdfvL3H79 zhFOX^C=8E-5VeS%T6!YGMTr^&mnL`ujX9A$>G+9c2z=}b_$pPC%u+upQnNiIH&L$F z09qMblQT%-ut%X5MGaD}iK^CX#2f?a@g<@@ArzzH0ywM*>bZVC%8j_p5;D#p>tU`G z32+QfuRjj>7Oz}K43ixKyVU{)q={5S1{w(y6wGh}M>t{(HH{D=kqoGT5wSCWzenjq zh!MJ)5er86v`{2K6~{4gD4|?JkRSL>8X^JFT0~YK4fA>?QiDJublWuyrHJl>XowdfxCs~%LJVA#gL-3-UC7ZI ztz^Gb?%^O(s#I(>Vlp$L)>5%(j2))R>98tdmZ|`fi~$=)wGt7TsvwCRa#>X`g_)L;`+-XfHQh;U&G87I+M8xFcAy64nkyt*p8b|H?7)lVve5!A-c<}5mG27v)jrDkex<49^{E(qg6%?$Pf+Ux0~2T7E^#25=AwXjJQL3 zPn-v9gMIssvAgCLtzgOH6ag@x|+CyU4Z!?60W+j6Zml8#|%niUVLnaD{`4HX1 z;8JiT>ZHi2%mif;BdM5Ht-~PT#HGLok`a0!$kNy_btHhfqjFp?a_JQaJLEQM7!E=} z80D)_IhW@$s}%Hv#koBJT7qx~9|>e30eTEgARrz1b^Ys4y&}Px{r*A2T9b*YlnEnt zzK+TP(F3Kig)TGE?#8(Uky|cRxKJk+=M!B*gO(8p`ziWph~IJ z!C+2>l+5ukj4~-Dq!l=1R)*0+Rl$^qF^EK&RJPKt155#%ha?g@69k^%MP*_WgCb0X zLZ662bOOGIAX5t>A$~x`^znRplO!6zWkx$@w8ADLjpyZS0y39^!FPkyUBZo;wIL&5 zv~ZCr>{5hnBr8JZ0tG_dzA%j=MHPBcKHnS6e|+w0>~ zS(wU}2x%fWl@_;g1S9}^QOK>(2|O+XGX!#B3N7M{I$$eN%~83u{J7Z@hCwOE5_Gxb zk?`+&LIUzf|5I)Mz4Q+L{&!~siM=qdemZD;Xv9O9idg!?mCXufov(YpIBPN=A#Xe` z&y*qN<~dExefrAR96g83@3t;0#n>mM1B>5HF6+)(x@P9mq;I72-;Q3@&@iknIx&FH~tBtare{;hhBYfZE`}T(?{cq!SZAET84P&wd2mk(^{~mH0Hss^~^(H2GYg_W} zHlP15>*xw5NBaNa557>~UQ_6JGVh<$c2sZ=CS%^^soU6}B!D-tHLp=F#5uqG#{ly(tge zIc^6pKX85{c4!&R+c`XQ^q5DKG4=O0l(%2j(OYm@wN1D1p^sueQ*v$0lLN^1!SCNb z?^N_4H~-}Q3)`G0mQi*ImlBglc<2M0A~UC#uN5t)Qpdh}+9dz%PP3rn;K6?QMN1`IC|*ip}l&ehX)Q{bMA*v zTJ(!PzEZlVQ*MhhvYCVGt_0l;^|h*X+&pX+-X^Kn zJ;v*sS;OljWj11p_7 zzG+u9XVs1$lmELX-J8Cej!DvLv%dI-e0OU^fY{D&UU&fLkblDRVG|0KTU7nGj#Ct_ zUp#vJ<-BfbGq5Dy^tP#A_okXpuDI-1(F>oS99*6^dih)V266b>sG|4p^53j1F5i}Z zpuXQkLf)xE2ah?oOcvB)FHdv2Tu!UIaw|$3dw8QPhtKFnF1*)a;gN-l%LS`@0{xQ| zJ!o2+VegM_Y7i{yx1$nR)y&*=dF_+u>>B)};OzN{R>j6u-`t<{fpZ;R-|hSM3&;QZ z!=gXj?!;+bf1A@jXZFMEMb~TYoalIQ!$%)~x?pWzw_Xv&+=Q@^CORTPI%vN zaX|h&b{y%vtFLnNii606x{~${`o~xHt9DsVkaBr_`lZ9Krxq-~IiqdGi!Mad zv=b{BXUD&N#;IPK1vITXXWd&y&F)OEe22bB-GG_2?;xgdRXGp!?lCig-&jm>yB2B^hIW%Y{S?3Hx?&3;b~ zv`tm*t7fjKdsJCnaHdUMmd*ZVbQR}$-m!s2S4QJeXIBO;@O=BS6q!=cefio)<06&{08u1hi^a4FM2aQm^7v5=f}zx z^?z`Go_eLVG!uI_erQ&upsKg!{@S6Woxl%POm5ct=76-&-MLj|3y+Cc4Sh6zLxFA8 z_$PJt)+T^%mP3f0YzWg!P=QwXcul;ZGqfZ`Z^YZM^ZXSNTE5|SFD_m94 zW3}k!PY>5G_XO(hGmd;DzeE-$(nKyYK1Xu1?A5A#i$Gz^@+9S_Bc-2Dn!=={j z%q@bOlZTA!*{G+*UAZSue`v~K_oB~6jJ&+lJVUuX{c7a#m8IV;I2Uyj+x3xlef*?y zk30Coq~f`UY0bD`MpXClV{hB8t*I{eR_^si>#q2Zbjm%s?s$|m>UbV+;J{7aJ?B3@ zIPYob`nbBwXL1Cs4=8Q|wFqtv-8=JmnRGe^+(58=vC!D}+3AZ}Q?~%m>4!(Z72nOS zI<|P#JSV^V^6Va$vr^%969ef5P58PYG0S#-4HgCxdTv^y!p#QWjEGeJ7eQwIZC&euWlJP;w*3yi73l`5Pxc}mKLqpy5 zTsl6Cx1vT^J`*{Zh^-C$8?BOs_OYQ=b>H5rOIk4`RlC!)g1&~jWmwB$Z+~iSsp?d< zd;|a5(D+Hyk=dPswfKbc1-<9A9$1UZJsY0gInC!Z|Kr*yL-DTm4=j(~Ln^DHT@~N|jtS(WNFDv=AIHN_rUvQk{xLK0v?{_|Z z9F05j(4P&6)T}G|4Ee)Ve$;f`wBZ56IRGARP)&IUQ@3|pTGBS-_Sq=~LU>Zm`J-*h z1Q$~|bFGCPZ#JK?;i+X}tUgv%AHP~s-hnc%K9mo_#MPYU2YQu%mDwZP-eY9vmPAQY zX?~mH@)o^&&1s$Sx<=UXeG*~FbI#2AmzCa8O9qy=sh3>S@s>_r0kFn^$4QxZ(gs=T zwbzGI_fJKyjm)l|k*mDK%AAm0+JaX+tM@tH?z>m^2d`W|+t;cHJW@;>o>BR{w&HAB zjjpCHNcOdr#aA0?_04$?Ndqtnn|~u6?n~n@i5 zwr8betwzY@w?%hS?@%4*j^-WQb#6MAq^!Msj?`5^8Y$@3N4d!M>j*DMqJhJ)|B*Wp5Rd41Qf+J6|g8Z|lD3qWZ3NB_mybGtV#G-M5< zS<13XZ|`5bLa_7I>+gP@)zJ#T*x6@~W1v zMT^FOXmWMRKH>74^%F9OR(w|{yr!-pKNDUXkaTv)la3Qg`qU~7E3Mg!<+82OhnMut zTi#h(55UNbA8YuYhrrKusov53;DFVqrk3Tu0D*e{nw}&3kK9Mdy(G=Vk~+U|4Xrua z!&)_izjaQ{wJoEI3g7I?_Fk7R05i_kN`u>aU)(YfeuLIVy{&}CPT?aOGPx(wfv!?a}|I0bWU-W(WV}UMv+)HhAf5n4Labew<^v?AwhZ)W- zqc}(Q8C>3`@zdP=$NZhViY0YljHcPo^jy$eM8L0(tGl|#f9uy>70J(r-|D~mQ0v8y z0Zyi$F0K2tYWV!7-4@iXfN$YI&nVt&L#ms8rrIN4_TV^K$uP&Q}}I@;65 z+qf`u!~Mmjt;L=Fg}tct5Ai#hSV~p5av=O?4-|cb_*j4+a_&4|J!pQ?+BRjf)sVSt zd#`!rv?i;Dq}C3(H~97sEe80yHHfo^+$(;K>p!l==Y3LB@OnB{ldTYMe)aX}ne#8M zD;RFBnSLg%5PqTktmmv=ukZUe*LRkb3`{MTPvQb(-*y3|5k9VR}u9^-i|IpKU;sSP51IH3odn^2*393 z#sSY$o*#;%DO;(->u&pNX36p8{Bd(lqt#1%rEZp>4L>blgwt% zL_hF><&0`b`o=t~BW-r;@5XLlymx89RhqT-NadA_<(ZjS^Sa(Qx)-K=b{eEgkH)VY zd9u%wbo}F#trZhL{_M*3tV-U^sjkD*+YV^5yhdGm`=jKR12boXpkN(oD_mF7r@ZpW z-fe}3IosP;rM`?6&wMh@F*T6(FNxnsMNc$xO`a3wvs-0 z5x%;c^V~+iY6&;(Y+*Ld4xSs>yn3T_DY2@9eA^0Np z&gwMy0!XLFqt4qmWQAj2@4J4_iWeT;{d%C}%cboK%k!n3Q_H&C!WB8lOxfMNAhX-I zCb#HaeUk&@Z}yPWhg3B@>o@*npIV9}dx(Ge`FGQ?!p^L|gI5>m(pQci|2n6&cu24N zM>b+>Z&tMFmtLASv}^;(bhK4;Y0VRmii|xQyqU4~?E5kL`=L>~s+sev%PaDnt=+la z+-?~o7TmpoH!p3$S^qTL+*rNT8~b&4(pueK&!cRs7G|uyb9`xV%F}ObC;Mz4nDl)c z{+Z{E7N{4sdwfbglYgR`74F#^{h}lFI2f>c+1mGYaMQkv7u8*^nY=!cdS#vi`B32c z$Ms`VMrQY$Tiu@mL%^ z>1p7G&G_=olcK$iKWSca{?-HY>ZiJ6iw6!nG={IgI`q|VA4d;R@3a+*mX{N+*B`hd zN_} zo&CdlU(7D~C6zY2;^ztP$44_KcgT!OhCD+?4(Q*kSIv|&miJGJ-apP=aCF043~&*% zQU_@Y=8v(BJ+$SX4qsM!>p00>aV)>A^_OW+XiuK3Znc&?K8evbU3MpPZcS+3XS1z^ zKWwg9dT&t1;upe;W3EjoWUQ4Xt$*@p@AW+(89%%*WnkL%kwzdQH?sdJ~a&kVifMfdSpiN3Vi*nk@)i%i~zJP%(ygp%oPx2p(&7d?(0+^tna-Av$yYHk5ukA1%xsvy+ zazUF{IfBK@;3)|V?q6&^w&(=lcWz8(WOi$QqT%gG zqG??~&a-^jAs_l>|LZHTYbR>@D7v)lJS2wVz(qTTb&20eo2W8wCf0UZQ$DNyZteNj zO=^Q6r(HR9p0x(vtl4q1gIgXGF068H8h5SnS8EkT*~|C1D}P?!XXJ)}zimIwsqH&% zbpNlVfH2w|gi%cgdwsJ%yw#a$-vdv)IbM5SUEZ|3-LP+075h>K&fMPqw@M@vN&5ch z(7gb9EV=kf=&Z=4xTjHs>{&_uY*Q;)?^+ zCBRVD&Hk2gvtV_>6+yF61D~NkD1kRT`6>uhy)^IioBSrtGTI)W+ilVtviaG&OAD6VK9Qw^_*KFsgoB;&+w*oU+e*Fnd~NxRcGqM#bDIz*2n}0?dUsAP z>C^D;1nv6F7W1kXcDTMP72w6RLrK=InP)Tz(tqDwe%*%k|WP zwL`ZQE~=>RFNOFwzFpX*{Q3RqT>@uTK{vnoP`t=sAYNM+ef?+u74MSoiws%Rxp~Y7 zINe6lrgO4slb0pmu$}smNuBU+Y~_J5dn;{=k6=0cg~I(~Z$k^_rhF#d>$&Ozw8F`? zo4E735171?`e0n}N$CE$(oetqw!M1t5W{V(n>Q8DyA48M)wpMH^ZRf^x_epLm_038 z_K~luI*>zcJ7DCit-UtQsi~iLcis47sW6j}~3%04@~Z5l#3czfYU>p4|3S`zErm-xG*0)Ds4ZBFh0_A}sxZfuJ^ z?UTQf?cYj%=a}T3P2Aq!@!YxnfF((P&N8aUMEUAuK#tl0KS9atYuHZg8Tqt3y6M`S zq4h`chucQ%J&9ko%}hSZZ*+dim>a)k(KbaMRg~U{PN?I|JVP&iAWolL&a37BKe#Kxa&m9B;(fI_XvS)6{qNuOpIAa}O6UjJp6p)Qbh<~^$1TL~Di z-*Qt&?Adx1lw4H%1LoB9g4pM>nYjacpzMpWGadh4lC8cUeze&Ny1#fz%Pt;3?C)7Q z1V7`rnCk{iM)-&MB^$CXfw(04;lfVyG1raaj72H(Uio#`#%vqkP_N1zxj(DT;kuaT&r-1VOWKRF&4|&l4c$q(f#F|CF0HHqwY*GZz{yF@>0)j#F z_~@z>isuS_Iq>Rv&Wk4ph3}gf!8@PF4=7r-2XW??SAN>x8Xp+C>z$@A9$YL346cba z^~*f)JGtQfh`pXXz-?5%dUk7Ns|#S*xqBxzZ|MDf`>J87xs(55!GFvzLH3mlnfPU= zK}+Cj(F*$MnyO>%RGpVo-8-)x7*h$by{NHv<)H9ePdTV08HyTSE>GaCMcr7R=KuCX zi+-Hh-##AJ&kabzocKg2m;?_cDqq+ zrhMIVR8{GM-rL5#dAVoo>%fF=JFx%s0(7MNeguVq6Fp@oRt~=Sc;Brrw@6q2urNjb zYoet1`g!$UP|_NBu<@KugDt}vUMwhm!0)V1+Oepg)^L8aau<-|2v9Ku2z=zd-1qnP zGePMS57|2Y;~sZvb!mrjYTJS7SHAAAGwr<+5Dcp z#)bW~X8=}hoYSN!sI#9R6nSV%6hT2ApaXTc8*Sz^GPIe~B)|W;f6Gnx&TgpO4eGVy`#*dSjQtt; zFDmrsDI2E!QaJ97t1K&pYCZYwo43!)w~c*WqgpTQ(EGci?`s}loP9lT?h4}F0qN2tg%6n^?A>$e;)lW#?+Jj9ndT)$n=*3 zK0EEjDOLm&m$b9Kp*#dH{%qtoNwG(H7hS*3>;QDRhTM;`a|S$f`om{yYyY}a9~65V zP3+n1XzTmHo9|povi@8kaaZh4#0h5qX-xouX-R|-z;k`NW6{x+Z=k+`U#BnnN3BU+Bzw7V=}e~;&PPB<@)49;qsBI|jlOIe$PRfd0v zZ1hRPK?(6{`itA83%a$oGzMJ;b5bTKKmY7=<06*iteRSR)KpWd0=#ZBiyw?j)lK9=;7%l@*+FnQi0dZ(*OIq@z z!FbKO^PqPCR0JJ>%GuI-mCOJdD#*=rV1IXIv}iY|T^Z;Nxp@El7Aq)SN_g1FfAYZ) zJp9c$_2_YVqE$mzev92R9S3a=tTELqqb|Tb-CM`LVgJ;i_{P_T@ZI+Y%57r?J#(fs<#J)WzMNuRac14@E}yKQw|%-u9_=HNeQ$Nw48yRK>0XCQX10DlB9 zz*kr2*qj9~pXIF@$n3l53#f0~wbxg(KC8YDYX1me&PMm;bMr?40h$hssY{@cWleSh z9P(<^tG|!)pZ~)eyHEWEz?+9Rrgot=%*g4|xc0%tz2JmyK`+r6$=c#mNhKTGz!N}K zV?`?paF2_NQVuK$@Y9|jC#mur%Ia+k6U^s&o=Y~QYChRlCD9#p#b z9$!kT1P=KTxVjUd9)^GO@QIBFy!{bw32Mw2Jo%5Ppqs}Tzc=8~KRM1Wjkl<_?F7rd z1So+U^TkcSWduqd9dcf8m@gQ>>%FbHgw$%S?3Ypdm$g~u1$la+1t;gXlcz?;Yi{$L z*9#ByA6<9_r0Ou=-@);K%z8^;K;A&RmwYBPp4$dH449qk`ur1wZLQKE4a| zGnC#AC(lXE)bMwL7Ane?QTcl)u1lv9MVe(|ti?aXt)7D4s#i^j%>D$Jw&101K+`WK zf)0$!paPI+@>;!#(COk2?W?MP0~P;6iEgh1G#}yFf4DrqIJgwq1#p9AEjnw(o6&#> zYy8qN$bWNk>paWxC3>(aI}@E!6?@#vA8RLDn`~_Rw_7{>ZnHLkZ(1)|^|*Vw{zmdo z(I@HcCO!nMHsK0*Yez%YD#>tAQWtf(4Zy=Iobw|6B}fx4-95e5eROU&)eZxD4B(Tt z*-o!HU8#?M`nQm*YvZONP#>;>0rp}BAHlxj$%9Y3*Zx~ zj-1~S=7CPKtss0~*dXa5AKL$)6tkH1-TQY9CpW>HES`NgraUEgPv0h5M&2P9cz`VK z`rvv|Q5t9@iv0G=N5@tU-n(+>xQd1Yz^Cu|?qK7^gV6QkUIRp233@Lcf(960k-Xh99{CD*awgE;=uYdY$NAIPnUB=r4iwArmXt=jSR?=q}S_O)tc?p*US{UB$ z8}xF(<)6b_!VfQ=sOgY@+{L~fgm)tXOZGQ{H zT1{$FvDfPjbYBASO6y3mJt_P4wpyS?THxyYgW|@3ibXGPRx!ze+uTIM(~0G@^4tS2 zbsZ^=tV9bAK)Pm-+--lOg%`ej;{Ewvufbzq{RF~o$@T|Cb6K03+++5&poIDoG!2ZP z-*1UeZP-fab$BB{^Nfpy0B&6Zru2AZ1Au3@nzTu7lYeu1YCizTAG0>M{Or!KiJ<3a z|G>Eb%8vl{+fXzw^`9K=iKczFO<(a@`h$%kJ1qR?eTXINeMy-UBQDD1e`=8%ieg5O|A0RwQ^yAj0U&H~%yRx_#XlRf99d~#7 zdmBbtOOMj=Zli)HC@)J|OD>IyUTwSR-EPnon%509&h@f>l}XON)U)?jdC!3^?*{qA zpgG+$?#ed~&QvCyIrlQbCh`~dHLn~Tefj3+pF%I+tLsa9uhLBYveU!tF^~N}e7ALk za2gihmxG)H{ccs`9B0?h0-06+3rB`-Y*6pq58UjfUnYJ$N!K#tAM)klXPN-SYAm}N z0_M0yzF~HYNzqF8-VE2Ok?{Pw>`ZcW~t=w)em zn>OYp{i_Y5i^eDDkKSl$vzt>odY-=d**B~mzx6qgIkj8kJF|`#0WN83K2N`8*!{zO zHf@yga|+7xBxR{zk8NDGBe|~h->`Jj=x&t1LdOr{?(q3dfbF?Kp=&2l&2o@)S>89) zjpj~!1R4o5xf{eQ1N&Dc`f9ITKHiI`hf z+Vgqc&vQeBrTjKTtU-FeYi-)s{Wl-p_$S0$a`V-cyz)Taxpv1uls{DQW#6eE%;>L& z!ER5}$3A0kk>yP1b)ENP>%OVjn#l3XIR2h;m|NKFEhy!^ykwkn87S5h_<9P`ZK(+7iwmeJK6a^{ZvN1wcCIB4|l zKjGc~Vec)YvRt>eVL_BokWvr@L1`30O6id9k_JJgJ0%4L0Rcf$TDrR%5tNkf66sc2 z@|_pDo^S8mA>C$MbLR`(EB$*BSGi^O(nRoQLd|-|D*_Ntt2dzvr-sLqHt2 zy(#baHwl&X`e66005PZ(vXziq^s(HZ5$anFAO!4yeAxEf{2#z5a&`>b-JWc94v!5Vm+w(=q6 zPZM_}ME%Ee_6+JV9xXKI1Fo`sh9>>OB(~;dd{l%C?nhk;gv6k}2r_zKdge@Ep{M3s z0v0BI$<*joP)nx21d1-HK73Y%eu>N!@GHBQg#YtzlcRgUau@-6m(b~NyI1$mXxadW zJ#C>@tmeLPV>%4dFcd+i`$Up_XiI~677{^&$>Jefy|n88JS60;m{QT~9n`XMrf|3i zY{ZG^@6MD!3d#a8Nam?MxmV6x5@tAolm}9!uW0~^iG^qBn17l(RuGeM+BP#*%mhDH z7W$t+RNTP&!(W?P+KCWb>ZwWbp=JLXTBj{r7PnRVeB}8~4vWGdkp;Ai=)&|BJlB=} ztccZ#no+7|VB~o$Q2!V{YnN2@Y6}My1wWm6`_mc8Z}xwcm}HbfFTbJ!XZ7uZAb z&UipEpbp3`lHQekZ}LNz!!Lsp{~bTS-;sotj*n+*j|hfmO#Sy-SN|rr<^n~E)ASWM zJacKx$7i~ZC^4D%W>Gx&P4UWS!!@L2&K7)kC7?^H0_4Sc=AEc1)XDF9X52?%5i3C} z3^Laz?9ecC|0u`*7>$I@_$d^T_Byt(32~3mR98e#h@c=ig9vtDyWD$xuu) z1-5;QwgaS88UP=BdigDYVX?3%X+|U&PfB( z;bWlbhJo;5GBkOd1!m?ztlNqYBl)S@lBks??1P7AP*Tc_26JP14u5>Y>l#_G_>Sc3 z2nYae-i7sS*-J^lIjXa@eh&GkIRVX+&;GhM+9AEFU`Lo#C9^=YD}`i09V9Qn+jlC} z{d7KJ*%;VUj4|UNZdgh5V=M#`{SeFw0`Hbk2)!5_wSz(rI#wG|y;X{WyL&cI6|VKsaVQN%Xd z(MSH>Ptz`m)A?s|UP$m>0l-E!j2NM}E_Wrosv=^3lZJ_UOd!^B*mt5(0SJg#C)%mf z2FT0^k>0*nnj>XCRm63)cz!ZNkp@vN0H8~~bg(@7F`Xc(uL5@BC}?NQHfCC6hA`8_ zp9hx>z(eZ;G*-&(xS_hcHjZE})R%73ePGdV&xeRMTr#L_VjZ2WT~i6cqHV2aS9`a} zlfLO~A5qiPC+{3+`MPOE&?%+{Iq-lwXiaGp_L%W9&6%7SzM*gZtC-%C>BktrpxBXasV=v zFZ2DHA>eS3t2UB0#Y=jA^Y==r!MzW~ACikQ&cqEg0o^*uIgjqPG>rQ=igc%Kkm9m| zqlkF2LSqQvOHHJ#u1KZ+VhLTIDq?7pm&5czKMN7`BUmaF5Ni)(E!82zHbYqI z#EQ+=E2eJN~@O;LaUohp;{{r6Nk^a{2*?qgUl zTLeB=n3uk2Rb?;QXqioyn%TeD=2}fqFIib*H(T{s>R%l{cKyT~bhqZg*nS|Xflw8% zMb28DMObuMe%?TCksV8_+B=h6Oy>hb{sy$_rdqVLXp7omuPJAsPK-BcRoWJS*rWUh zl5N^=dI)-9sllGsdakWS1Ehi7;wk&B1$hT22{NT98bceIU-u-TD-cGnY#lNTNCN=J zOs6m@e>z+nUX5b(>%FFX;iLyyeA7$@~QI(-6L+_P3;b=4Ip0ld#t(I&!O5?hV?T zefN)KAFsqA(-Q^I_HxKXnSwBuca2W>#2Jf%ynGC-gscu0>BDCmPkX3GfH1VeK1cb` z=oX{f`&tOkqew~xLDU9a#g;@yXr# z4VWRP2R(ih?OdAvq}i}u=S7!Kwd3U<@5RRt(?`^_XfO74Z+zY)4vb0Ty{G<$`0~~1 zhYS?Bw^1Q6WL{M%gYF_GrK%;y0&c+0QAxxLgaY*`{monawk!R5p&a=ThM6lU$nIO# zFZE?iH+&nnA2nMGRi>2^3?}15s-qC<4mRVy{MXpmIH~r(eSBpP^s)O1nU+%xUyH;- ztbFeS#B4(or~H~b$@Y8OsyZM?nzXM03LkDF(z(7yEzbuBFeU0ca*^3Q z$1*Kf#|g@&^z*S*Lo335tD6N+vIQ4=T6#FQCtrmBjIjx>Va#C!rry%eIZNkfEBC8v zEp@BD7ml&-`aOG8`c(WtuVHj&JwwrconX~;F;hAGj^vetqXqfK^kS0tPg{RpIpFk2 zZE+K%wxA)^6qoYviTMEd$l4=E{+6?jQ18jaD6ENh*x43pP95MT39{xZojpx&Tk!V) zlpn9ULjh+<^!8#ejXZNJmrsIoiOAY;Q5wk8nsb=#(iNwSYd#UbqZet~Kimp@@?~Ye za(lHtLFiGA=7WRT9~2t9pRQCLrCu|eSdeew)zJ)cf|huO!IxNEpDU;%Is+d+Lst19 z@0sv=gM!Gnz6`}3fD$T;IS+Q%IZ~G8J&Snvv8d9+w5J9zK1@>e;5%k~q zYz|zNHKhWX$4L9o?3-u97L&xop0k;XZ2(Ew5*Wp5KRTv4T8#UQY?rL?A!-UuFqsmVstftRJ-q)t-I0GH*q&C2%pbGos zaiNxzxc$M?M$6Hf7j<@S+iV(J9US)i#cCZ`mrcb6=S`tgtUCNUVD%kmiJ4L$Q7n1r z{M**A3`XA>j$+FCTep{2OTBND;7CWSp1dVB{rs{sXMKTrr*~~UoIw=FWc(Y-@?rC* zT(uToc@^a>^Dig+ZT4SJ+A(F=G|CE^7*s~e6sfr=awRsy*$YJ-mf4@Dn=r)5C;YnY z=HuvXRSHNDB!fevlr&~)OI>m(o%Ew2(5Hwd$lct8cDM#tT^W|00w-xB+< z52cpo^INeuBlx}ka3Z0Agh*bAQZ=<^_oQLc0pns?Rp{D zXar=uifb)P$0jFj?W)=WfY66)3Np{5PT3c{mi6j2TfzOgN-eMLmW@whxQ$dEW$25- z+u+>Q(U1HTgwCZIA0{{GM||1%dmp;TmLz|74k5dYb0^aCM8Hnc(5*pA;}*<^j((S& zwAa@S*@f>Z?zyf`!VCNgXES+JH4`kUNysY9++8i|txtGPT83sQ5=~FSKUlIZxR{RP z6}v~ZYHz}GTEcntsduL(e=nw?qamG9g$$E(YLLr*Y<2k-Zd;XDMJlD#FPVv>8b(6b z&9t{f+Rs0R-_==bpglca@x+V^UVKUFFl%y{RQq*JV%SwVbI9FldbP`)M zqU@Q;z))~lR<>Ev>z#cT+0lX6s+E1G?K{1W^J;0{(VX)79|v_trzTJGceNKSw%4=u z>FA1dywgmFk}qYCexrEAq{Hi6>d2C%l~Sm6y_0LF=x&5YAjf2JN%V_+0}a-)R*s00 zlVdK|*Tns<3rx;-hoj+lEwrm-rurl%ACulNH@+Ort9Q-quzTO`P)EVct2Ik$hdTPf z(|j%MicGCAnn2ghj|ZjJN9U_nr$kp8vei~Ts+XAlu<0CWrc=xoIzeG~?OL{PN8sh@N#A4-S-r!11=Oj@0unB|=ks+Aj=V z2CVk?l1#cr969V4$3`hI$Qa66&r@ zzBsX4x2b7U$x)xh5nr-I643FeN8VIW@+_xc)-Be_6Qg>go+!i&{0{St#}(f%qB2v6 zEWX+Rgy#X#gV^LAYFxl~u%wfPo73gXN4?{C*#ybU(Sp@ioXJGvR6-smc&tn1bA~aD z&UoZ;{!ANtbxEy4VQ}>O&*|*W^zOB~ol881XE`0Lu_GM1cQwjJ4$f*9IQ3_$OSFZ4 zP)?N5qVb^$V_EW$iCs-=qhns@_R9-9e#>K<>_O|2N?q@O>BtOsxcbiXmWk-i zf>o`piq(^C6^#3mILV+snYV_X?pUYLVNXp{?L(T_x51){P&-IhFhRXFDl6p7AMtm;qV|@Iv<4SqIYv!vv8Z{$Myxjw&IG+YD&cTC5IoAy=(2Ao*V zsp*B*J^M_QRJt-`l;gbp=9;^Cj=EaO#%w#NgeD$s_ylKY8S4mA%NwrFb$k^PpOA3< z;?I1i_(rB(*#)(7hpG8TDZ-M9v;vMYM{soSY}F60Zsw^BO-;J7%q9mn_Z7PF5LHsr zF)uapoeXsZkQHannim9m*DXf%uICgC*z94@EQyb8USy^(j^~+dItD;?Oh2023#z__ z>XOS}`Dr?yVwI)gqT^@ke~mFxOqCMw$6B?N|4r~oW=0V{kjs5q(_73t7-d=Sj$-Bg zFib~nozIbt&Y)0mjB@sBSU9}n=~TtWuW>!^S}JyKtsO0FBCE-Ji~S-YnydNEIiR^H z{TNcXho%?nUY$g^D6~8b390D0x4^2YlB-v*19=Mv{XSu?%)=UDnpp)q3%U}()Nk++GJV;8<76%n$i=r z;>#ZG4m#{+!gQ>*hGn-U1;#LEdga!RlmctGjIXEtJkPHGHZl8HoZ(nA$+%s_1>yU( zvKA&k^)5MAe>}_ha4O{PZb?~cr=?>eS=EVK^hv)8<4ioT*c))P6>Cz%?x^+DzW-5b z;=M+?wf0aYuwl#bHSy((Ex;9eTf8#;!7)*Qt{=YJ;^XOaMH$-d3YPH5Z?#6xp zhJa(5wV^m3sx)0dONwYyMVAqbq^2PrBf6`-Vr^7nK0e|_(TI8r7qV^ZyW(D9XI?@p zdqYXl=e(;AGZ61MF_LHXbaYp=$#_2JF}c!RPBO1uYuCy23j%3jYo4cd+ zYqI0LxmR8Vka47La9laiMU^c%#l>-Z(cZ_G7H;wKbvQU`XARBhYMe|5vgbP7b z(xnhpBH?30xv~pcca>+6_QuW`zi9v=$w_g=+M13($Cs)_qLZkmZhp0?2rgYc9_H04 zXm|_W2bnxc-0NBGk@to#1eTSGIP@1Y+^t%A#+smqd zbour2Ikk6==s6y;Zd3l>1d^$$w*LQC@WRa9S!!;3Y#=ZCvP|x-pP{RAv#D*s8+y#bPU}m z6U}AwgWX9*nfHR(*61gS?rshRcKw-?lIBnylwIGP9U|f_`TUe;~hbV(I3-+k5ZpoIcE(@ zGS2tG7ppKYrlYW4}6TFcN*+ zcKbv|XaEk$jw8LuocCL`Ve|_3Q-rN~&>AG%o7_}?Dmrq~xWC6AI`i=^liL{SIP5Wz z-MyZwdI&h!{x=+;vq?vjZ`4bT;6`TqTZ=m&j?n#;64`Sh0b(f;vy zd)@HcJ1$w_J72n!c3Ow59wj~&&^Vr``pSjzik}kiaY6hKL$Hb&LimQgbznRsK#5If zCM|^OL+A0)Q|IwvIoA;$t#W2)4Ww^CzUgtlxE%#YHUOg^0Xj~s{RbsJgcW^o=>nri`sJj#&iM5W{5z^Y z>Rhg??%$M462V3oQj0oB2H=8fR53(^JuAI*GN5{(dw^5Lr17Y#rafRFZ(7k_*@uSa z9pAkzavoftx*;9lyCIxL^THaSAF@R40bWxPq6$ezjh6lJvmHRY)qtXmzxo+^ZJOz4 zy-vGufHU9eHVM4JXWq$skiA&{6&Ru`(9X8q9k=|1y%q^`yhJjge8?YODpsZEa&3-+qlZ&964JP{>%f1KMRTH0#uhzM``aQ3WwX#XK(OIeI z0O=wsJp&~k`xVvQqe}3)07iT{-IRlZV_=9=VB>lSyZRR6Fwi-Ww!;pzDk=}1oa{db z-dLBR`odv`kBGnAe$5h<=>wYEDYYJrloE(WhhyAU@#O;2geK**wVYgzy!WgScyglv z18Erom|cc28#*gxqva8#uZ|ClSF`|HUkhr0uEu)9G;o%CT3K>m zW%-VZokbU8QxA=xF>Af+{P~bIRQA4|FbRSKBOGgw13EU}w0p-k#9UkcN-`Wq2(o!ofN`Ub-Lf_&H*hym-sU}{WM zFEOrISMjs4ke0RDlCKcSGC|*H|R0|E?mV-Qw*GyWEs41jRfGX0ttvtD$sk8o)&1B#{o(Ztd zWH2@nX1-OlH0SLExdUK$SglL=N;)|h7KzbBP}xGuW@LtE7E>8N$<|U}9Y5!&q-6#U zFgc#7J_27f+@zaUeTFQ6<+|gjFsc_f=cw8JNCgI$IT=NQm<p0>H>V-QIPpkHkvcpyim5?w1-Onv~|!QiS;#8(DS5aO-pMZ%7Y7f>dlV7e7si`bzM1iFBA zPo>clONgmftDzC0)IIpmzDI*Tkhw2kSBMLEv>}(1W^}jf&t6gm0A5pmg3iwDxwi9a zNv=PvK+c5QwRG>Ys5d5jZI86Jjq%9W)AkT6nyTryTrsLty{H0$(d=$m-7S-dgVDNtC!w3jL>6F%xdgT|zFCSbn2|VF7GhIg zdET3K3K}W~S{n;@(AH_65m<&=e74^Ns5`TePK#DvM+)%htInSH9VU?Fo~j0`s4jtv zM|FAL@7X_WnHxg4Qk0NzI1q~y-H?%>eQ0vH-~Smg92&p% zQF5KQMq>t>I&Ty>m-hozI~66Og`M&i_+RBM78l{%p>0fPEJ9q*X0L~qMOrNIncdF_ z*k}%B=G&h4{TB6ao&uf`{7QcEg7Amc91^AC?yK%$(jIzVAy%(H#o}-u7u?`^A}-q# z2kKKLuzwm`yc4^%BlR-OEzd<(Tuq`W9jVPRg*HNaTAs(Mt2CoxN{w9a!?ZEOrRVdp z7Ivh*n+_-57-RW2RH9OGnq7iIAe2@G2w`d?mKezm&z899J92vuTY*pB*5$zc?`?Ww+qu zc)#VA%I+dl;!@~P%5@K?PFnP^2?l`L9keTdUZOK3&3kp#_|*i1lZtPE;Pw%){k~?k zvtYV989etUi;Sn{kT~QChjrexvC!*))PqyEaJTjPVE0VP9MKO7==nbS(L_k^&>mv%3q#*WT>F0P5_68KkXsvG|^HO0e;d9MKZTM7}hwRK@lo|2m{0J> zDBZ*jdpyv6pVX!vDj^gTNz+`R0HCSbd0z>=!AZd^u`V?m2TkaEoS$;t88*-|Jl{mUEA3AfHz3D=MjkW(yF86ezSWN! z70f9>1ZH_oQ{g3JT`FG*}(;k&P~155vAF>4oDnOS}`D$)LBAoDda{T;g@wN{5{KS9TjA zr<`NV%+v_f4`_Zr8y3N2(RqzuNFmih6ZpAf4mI3nv*OFnVidRF`W31F5%8ky@huVBV z0GP_A7T*HvG&#+QOI|t(ZkJ-iRopJkioN^NkEC_%qE!AF*xESwvrO+qt2Wf2L}KXI z)Z6gz%a^$YWBK^M#2!)7rg&E85vIy&%RnOPQzbol z1cP}g!IP5IGH5VYN^k(U8tdFfJc^8hq`^TddDSLigHSc4u5|(=YO{WoG>BHcIQ@VW z@)5qNJ|b}>A2BL6gvC}L!{HR?@g6UU^=Z`g<;Fx7(sQ^0<6+JML3yzxeJ;qv@j?E2oqH z*h3jgL`Tt@jaCMk_ua1(b0g%add0139PG4!3O25vzAkRuv zIM+=8Ji?6DYuqaOW~hJB+~3TBdTB){Eyh&e@B-*As< zADJuKwQ!Di+%KL&x@!N9(^gEu8v_U`Pp}wXAT`KY6ns6xH!@`M`*F&=$$OKtkYgeu zB@j&5t)KDL+_)E(pWNlJ!MPzdr5Ls=UJ*u#zj&0e>(h{F5}UmpQ|oZKQ1;nUY)a`x zGVUQv5ikq1H`~pTL?@b=rCL{+40@HRXd*bvuQa4gswam-R};S#*X=Bk-71R#dfglyMKE!x&UJDI_)tV}FDP%{VfP zzwf5ATUVboQMkFcM~%|9S=dvzQLONu%d1tg8S3w)iDBR_v&4Q-8OKi#br7Oi-`0*W zDpJrJf_i9%{g{%>s8@kzf4WS1aJjKcW#{}-)*BMLUqM@x> zfD*N_-J~u|E>CuQTF%0Q`&jqt5N$o+2MOgG+VS9E!kb0!ddVp+AAdo|X^|=-B10)d zVeMe!v~Csqv0K}=ZDYNThsn0TwsrFrEvK*xLg7X5e#%g=Mz#5RumjD_eAt#>T|1p8 z#MQZ$gWRn#=vOjFQg_6XgMSTB-5qSa8FZcdc~=d`mW--@o2k*do*7bp=%4VN-eDA9V^59-Kg2%!M#l2|<7SHFyC<1Ckal%PNU zj?=pM8ft;K`vZ$Df9G~z`H3z%`Aq6Ld_^+XEqS6%bppK?(gZfKOFc$RvABva2MpQG zQ0d;~G|U@@G;`Sjcg)a4;>+35OfU*jNA?-H};HZ(l3Vb-a>85`8#OvAP zX>3T_tQ>3!0KXldmRv`@1vn8PFxa4y2#00UwSl8=#thi29E5V?R+D6=2b^XpOy^sX z78Xsb?Hkp!Lfa_t(*ga>tRUKL5IZ!bJ$ipG_ORdgo8e_$!bgcB9lm$jD}E9 z>m$zixyGSmP|CPB@yep3;nTnd%uhQD>CW`p0yX^k$}bTU=R|;Z33$piVDQ~RnX68i zC2b$k)Arx+V$hYKFrGOFq;Kko$I1!MC~Ijo0|e=48((@}^&Vo@arIb-D|F<~O?V-HW@zs*;;gRHd^%!7qs2#nK@CV61{-*6D+0IFp-Pwf^X z6U+iUjybIRVzl?0ufrXfOoaR;ZdGo)h2$y^k!TowoZ&Gwy67CvKUj z2i-^h1P|$ddyRJ4v(sP3;U5@cGR`uoEpX6UO-GgGBZ|$u)Ac#rME{j@^ z0p2?QIj{<##4h~DU$3c8e9Q)69EL4`x=(>-QiPDcwB3F^g9E|>*I4}E<}5Z9#VQEH zm}fsKyuFRQlsg~1)Paz%iC)+lzav#r$Nkky@LI=m5{D#v=itYaqR(vhE|BRs5fQ^g z{rCC7x~b(=c8%3Ah|Wa^SkZT&HW$dgvn`wlv`SxD5ayMEj7k+G1qwRE4v>d2i^B{_ z;c&(7gus&I6R=W~!bf6A{-=M$AQPzIoGh+>rFKnEiD@wk@f=?P0IdX};DJGeIY?{D zZVJCat9W$sCLW|VaFl$lJy_#H`hN$ugKK1x{KO%nZP7f=D6YD^B#GB_uHNua({6F z8vesM*q7gdq`(yXuYe4H?^MluN4?KcMw~X-(iSn$cov~`s;<6px4H}QngB0^;@&jb zQAA1r6lwdJW<0LvKR&F2HXXc(jW!xa%B_-44R^G`zkI@13+Sdr0JQw-rf2j3#z4?L zm^;PKepyfaV3`h)SU5$)C$|+pGaUE-NBi%xR3+VQ4b)!50AfN4iqQf95V<@SLBk{S zZ#cm)fTd3ms1X=;>L80nOb+aUw>AnZ&J3vTwiJ6{XXn%gtXV9LkF!X3N&$kZTWh41 z=n7JGaXpciRg{4k*Bbe20_8uPUCC36cs);eIpV8^m67zw>v{!5!zVCD=Slv9IE|b1 zQaqv%p~p62z#3z|*JaD1jMOq%*EpKslW-4gRw&58tX~?Uylvp!nhXB0wSRka;Hsmx zI|{XNy)U5}7WIH}J{rv)2s&!yPkzrVXL3fllmJ zy+S#n=HmYWq3sgy6JsAu`0ZN`D~68nN&ZED=Kt`?%-x@D3S7V?FM|i9xCJZvX?g}N zDiSa21(I6e6BiDqzW;PVpoDjz-{E&3!+~ShA4WbXAvF;L${9XX^Z;sa7@YBXx&JgO zomXYQQG5o)8vIvrk+mxHI_k~MAox*?>#R}N@1eFkoE7>{PJLvnUwb_4(uIoFyb1%> zjKqzr#`JIakpZ*pGPG{SV4B3f$o9Vj_B&1bzdc|-PKLM$@}o0%F7fF+9mo!y!@rDI zD-uR{ISO4kMcjzo3uNJm`10~My;yr<41)_46cPn(SPerd!cMj|CQBwy90NCN*Bv{p zzrxiB&RT;GzD0u*CgYt&bu|O~IrD1%4o7mIIs~bg$uP#KbSW$1Y1>0!Lt7>0>g@b=+RJ<%NVH)|O|z!*32VXbHafjKMVANo-6O z`U-w>{zJE+HGDF$EriX-=hpX@9p!Uccj?`l&0F<*eejTQu(abpZjV-*Sacx)XQD-? ziD;q@0`h+N!XNK(VLWpmH!V6Q{G>oq_Y8bez3ffm=60A)YKH1Bn`EZrG%xD@GXowH zHgqIa{dfT?hjp?>M+tnO*qiFau;ft%c>YwsGNq3aP!H1uGC6d$vpFAJD#CCYN zC(kv4MjS6PTD$c%@XWL#JR~G{_axn!E%Y7JHjTiUCVAP>LYr0AT?vGR_e9)V+&;@~ zez;BvKZzb762cGle&)$U`-aSXFIY#2 z4{lCW8^)cgL-hpQ|HhW51?Rh@^z%&eu40bE7CgRBR?jp+2}O)bYwX2!8T9D~a@1VwBHS zZs}9=Fjw8w^?R%%J1Gus@S6KSli1-fR73T5WNG7ym4)<}Myu0#Gtm(>nG?QXhS_I% z9fdwi4nO(8kToiX8TEe`)c-E1|ECs|0vZ$mU@*&81Zt*HXncoc61>0*ISS2}r;|mZ z7lBZ3M<@g>X-o|Ps=sgS_@73gTFZHHa(rqq1cL8F5nkzp~0z*thl=QE~RD zydg)$9B}$d?%(d5Ti1yXrmxLcQccpU}YJ!UXU&F?D}+xSK?TYl8P+h2;Qf8HiBd ze#(pJrpRnQU)RA7_c7{IX{X_!l##;!33-7PP$du0f85u#T$Iw?m{COj+*O601^WbW&d>j_Es>KCuyhrxD}Dx|T?M6KF?9D;fn%8sM3!sYwlIqJ^(g2= zAZ1xzQ%(>(2jt>|v(jz69z9Y!MU(34r{_!c@|SCW2GU3V_wj?v#d`#xz^N`79C!M` zeCF{T_2PWQt>?%ANFZ1|(BBmXj`;nER9TyLP+N`k%JP{Z;1Av{ks;{u)yRJ;_LaBk zX8C&m6GBHAv_uXeM{zhhY}?-wU)IyuNc0-I&x(yoLEV)iNpy|-d49Cqb(bF>?LT32 zyho!HW9m&sXx zNXiK@cUyt;zXY0|-AA9F@-^ZJ^cKoMw_=(40}2H-9B!TW|9+5s+*7iteTBo>oHA7f zeWGz`xWmU7tV>G}nF|;sj*Ezl??kfR_@v<|Fu&~cD^?;+wDikz6A>i?GRpiTE8*Nna8-Vh@yNyhf2 zk2>K2TizXLN|j3o;3pRQG9S06hsbcY#5vAgjbMHP0;U2)v*Ifc1FIo0%^KgQFJ@*~ zy*;3DL?VqOP8N{v1iW3uOA<7d)Go%o=A9})o{VVBzf)iEZ3O|VAqa^W6#TKM2{K2a z$+6s<7KnZIUZb$;IjZ{>#z0&E6O7H5FANHAD0qKROMuJYE@QED`2^uZMq@zyw;<#3 z*oD)$j~4I;*M?}i5pe_I%TywC*S>&N<@6Fea^aZErZghZ?9Wo^JQ{`mrWthfBM>EO zD3)ckS?Ny`*3&sb5+csjzs-qirELb+S!19{mwX{}&X!{UcDrbqWKMc>It0WjL)y!} zkAOQ9GHy4hb#7k76)YTbb2nZy6iS@jxJ*cWKw*awbr}o5wgjfL0T^^haCq(Uw>%N! zb6RVnRSQ+b5M5f#_nx0k;XwCzK#@VqEHQt{VWI1z@&m9t7>`th?s_ekx2mv#c&yw0 zqCND}Mw0@0mj)l7?j`Bdy#!S8f7we^xXFv7rbQhq2u%r0i>ite5ot!xvJrfV2zho+rUmKr)<*XaAO- z;>M@0``mh)4;WEZG%z>@V{eRsdmm9ZCG%2{5KaMvxvEKo2>I2YUfdt6(AY3!M$I60 z_J4SA>JLho5_t{{m^4Gc7hOMg2E4x1a!PO%H~`t^der1OlON4XHeG?$0_R$|9jq2L4isz* zW@NQ|{`+e2A&qwf0}>e@#J?pQtS|?PjTEo3o4#*LPe`mtVyBWwj{=vRXaj13t5hf^ zaB4u@s2jebVLJ8CkBrOj-+)dYLP_z)17AjXQu)0gLRph2ylqKLpqP_(qT={s%~kKKgYq-;glghdiKcYz%LROJA&-Ul|0 zDW3z>f0Lwz+*^3p{`G+x3HjFlI`{ux0wSmyLVD{fm%jke%o$jhKTt3zh2bF--j~zL z0v}@UD%szT-M^|nXep4h!J^2pO1g6Dm_RNvbrx6b4HPiROjh!7`212oS-Af^IEZ@x zz0iX)(-{7o!nDYpQ-=HRnI?pqMO^oLA~%)$`|k$N|7oWG?XCHJFm3}~8ZlZxTx-r= z;_fN|;7-4E)VyjK!fi;81+*aP`#wo=pK6XF(Ha38h#c^C*#Y(T2xL!B5KB4;#A#cj zpflD;zp?0aKI90u2A7q}7D{06uavB`4}olR=>PYr#r2o%W#jWV)1r>+Mtn4i^aH?% ztA)o2Jbw_+q=Rp-E@i9aY117ccj*ZRvHZNqm!$xupgaE_Fgm;@MT&7j$N!QaOb1rO zRJ02alS-5Y_+Lhd^BHpJDjeN8F36ZjD|agBgk19#sZBex{g036qp(}Ep@#_ZHhvhK zzn*3sUzzk)T36KM;d#~KhA-1fmk>yd^U z=u-1RLNa1jHm>h5;Rrd!h|yZB(hI*AQpms5K4bxBh^3nqWZ-0h@D0S|J#D+U)f{rchtAqzQ>Fn@ZvLEvxiVl?VB#E3;~wB z3MhCf=*uhH;90MA{wTT)M<*b9(I77=Ulm%0^`e0Lp35PZ)P6|U9{S@WU{ZOZUuwH- z?@O9f{P(3Mz9-;tKaeDPDIzWp(o!!sne8%LJ{U&2>%jYb3%@fF8G{q?@{FDY-D9e9 z!oTJ8A*5`0!3}k+f9^3EHb3jJ#ZH^%w8o3;* z2f*R#z!5M5JyJ1nj0V}kB=aQ+%;iZlGM6=b2DWh4LUL*W&G5K!NN)e@;dt|C(B8lW zT3!zP9}IyC{of-GE+4P7U7VU`jcupE^g0;KIYq>+BlZiCB40U|vtLU7<9JbG9s*&F zQMCAB402Jb4Cf-{Zkj}9T@xQ?{{f-O-Q%l(G*DNECLdA6p&#%QmO~9 z_CS^pP<6Y1vJm!7+wXl-j_jLJ-eMfsH^Kan083THhF)+2k4TwjM_{;SLq`;z0TfHf zW*UJTD8H+}TXKDqMRb7hCDnmnmJMv7(}W_3Lddky2X6J;askC>%`I9big6)OX;BoX`pH|daHp6f24MIDkwy^EBXkg?i!Tw;Oc z>G~PM3uOIAc^#1~Uv?&6yx^J*RW!}YDJ}FSb81#NlBTtzF1Z(e-L^}BZZfTWp2mog z5wV%Zy$a#<9WxcF2mdj?oQ$E@H>buJy~#U zfeOMOom z&o}XE-~IvUf^D2E0#S_3yzf*t>OlTBkT@`R+Ta1$3i!3Fk>|kxH|FVwdKgvc+9EpLa5NL(Wh1S2g02L3vA=G&QUB)1BLWd^5 zFe6)R>8bP28MNyVm97Kx2L9|lLH?J$P$WGC`LJcDq`uV&u!4(0!83rE@$}9tgXX6c z{1GRm>uGVtXgrh-mHp0c^bRS2yh)?_xfN%0YYjzEFERq{=tyLG%}@V#h*z=VoE>=( zs|R9zbJZY57qNYrZhzXC4urE2Bw>bxqzs`%Kqg}H>O6KKz>Jhfnv8!;84_J-SPWkq+k+%7tt4mcI%>t~AUgdXL`oqT41_`eVxcm~O4aY_^}*%ZCV92{ zOCn`DwJsH4{>l^i#TpyU6euK67)Vz^Z5eVU3H-NBV3g`Wz|amC?5(XOoYaDf14&op z{@m^JGz?zj(a%jwq-yG>_<^X%gdL=-IsO&=EW0xEqzybdO~=Zu7^NqHP)og+1B*pO?gJNkE_Wx1CKwVP)qurn z3wOB5hNpXC1h~iPgO{C$SxNsR#I95W(6RBcg?5(C+aEr(mt7P;-6=YXnJ)|}V zgTY2zPX>x2CU`5!`G>=-|=%EDx)Gu2I3Z%+N8TG z7&f^i#ro_1IXHk%7X-^`R)dS{0XbWRRp!kPAox%zGtBEy7{OHr{i{Z~r7jAs>mUH+ z764J-RE9Ne23MKNSO#~2IhcV%PVO&&Nz4Eu=YP%r4$XEg#N`>N^iH)R&pgV3coZv3 zhn+kpfKZYUAo8V7RcuhMUeU&#_!Vai7_HN{`G z>k+3JMlL%+?#S`G{R`R%F~r+|DRT-)qV~N!cL9rB3tZgnp|qLdWpxT-LtXr#^2-q_ zOs#mr;WS|s%yj3qiZnzI@CYtW%ifMa7b0&*fhCg3L`xISCWji5oER7Rc`}$4j(~ys*e_m^Yt^7gK1Bnd zVvb4Y_u%K}$CE>DP$l>P{>|$yhIutR)^6J{awFhiIac>2ZBg+E=A;ud^^H%DTABm_ zDTWFJG?#=2q4%WxZ}3fg#9mg0n>t%g z5WqJR0eq#0=0QuU5Ucg#Xxm&cFV+>gc!r?5nD~R&in``Z@Y<5c2y%&Ne_377?^^uo!|Wq zL}UCMmK9`_VY3B{~{jntqX0H&L5osJBOrBJVr9FHnk1rVZT~=6)hV^bwB%+$KUp!>p31v#Dh-`&bv)ssl znYnK+_vd6Cz6o!7XM>vvc~egeG^0*dykNQHdk$-w5ypbQTI%+f7&yB5W`cw?8EwN5 z@g+;r8~mhD8NvDW#tFp?T0*vz;>*H!u0OtsmW=~>c2p_I-#9&Ts!435b=|y-ozj!1!&kMK8odJF)8FTy z-_ggvPRVVU6xNd|Pfm_15XJlJEgIeBXP!Yr$&PZk9eD*QpCjLtD)wnv>4iR&^^O0? z^J0IICgkpN44v?v{9o@%3GXVs&wUD4J;Z>vk8bB1!ya=v=^)mGo*8YwpAtD>pu>h- z95nhMGn6LEhloamt|u9U4?EBUs}gch)^^=irZI#7=BMR~_cPYi_7>?e7%4t0GyFiB zHbQpr zXfv$FbO=e6EaYj@(Q}EaFv#k~hEqLx;*AOq>m&fsHrx9#g(y#})+(3JTtX4$cT4>h zd?+h#^YMXvD@g*j^PBwM$m$VK2cY(G@j(kfK?Ez-AobTESf?(|=>h&`?M8Ew^jCNU z1cN?$%MtprXFM?Q0K>W)gPXExg_y5nszR#I35oIqyW~ktIXb;?#_wRWsvD-&c z9rb+ib{x3;szV#>=EJwSPhTMmyf)8=FBUzah$gg1C&Vp9Bmw@C?y(5>hqO23jST{Bz@0q?pfpU|Y&i{c3eY(-_tgtsV?dEO z&RlRY!|3}Z|E8hmGe2k^p%&#Qj|QNiP(0q?U(-zTz*Btq#%U6Of(HcO00g%&3x(7u z%+HpL)llx^uVje=8V_-Kd5N&nHpVJK1`)fpv0*S$)<;fbh{3%nIgctQkozWtHU3(6 zu(N96?$%b7wq6V5B>yY1eHw`bK$PDR;Qvc@;Xj`PNbT8MHrYSUQh)x99tI>S6=#1B z=3hU8eAf)AYkGUZocOP`4U`gQQN-zEEB>9i4mY+?HKV`TsJD9Eq;+Zq4Q zkK@5j@dF??4VZhW7YHR-)=8SfChW{{R93j3NEM#q;R?oS%8QiV3~1ESQBMrq)> zDp68@U5;`MfQSaV)5&-of`?$4C6IGvs^pnN%1vuK3C%1GFlS!@qv&ElIX@!TzrgwE z_^wmC%sdt`3$TZ7;V|OF4;@3(cZ0d0m#%bJHwU?A@)5|Y20(1Ak_UIT=(6Rx|UzfV9k-R(!Ekakvarpy+$_%{XIzHzARwhsvl zQDLcPk45dT)Nhk;8~STgq=}GpidDSkH^S_LUMVIjBrZ}$S=O$2XdAlRskuaKFI1t` z{w{hDsWrH!{aLO*=twFZF=nU&yJm@)DsH$u%-nnv0ILzm0}TLVEhDvR#M>kPv$mI! zwQY_{a=Oq-&=6aQD%d)!?q_i<@dOI=LXT?)wVj87&pdZb<1q)YD97p#Sh3UWs6W8H z8Q~F_p_AGMA)P*;+Ry4W(T*#2_BKlDDF9w)2AYK(7+(z_6q~l)DYLC3wQi<3*O>`2 z8nc@1fi=!Mv-`$f@fZZ82>hS9NF=&AC>sc)ZtqXHBbOGccsH<{`GWLe^|L^Y!v6GmAoZQUNse(m zjv`PHQZ8buL11st0Js6cM+r!_w}p-s2ju{!VOAI9D$1A+SpSF;#aM-aQJ1n_(!vh$ z!VO8?_AOSosPJ*id;Jiem;sgs>(>GphxY(K8TBqJuLvH@hBKzJLLFjFb?IDn&$k&8 zTSs?yZ@4;CS-+;W6rtEf;o)6{R0JbX3SszOmwH7A6Xl@pPbYZQsP+2HY=^y6knp@B zRt?X997Te~(IpYk1@{B;i*+rFBrSmyu~Mb`q}TNKSs^gU<&Lh8gGA+haTew2ljH7E zAb*-83izJTJiX{xwkm)y94&iy25a64ya5M5+mxYf7P=YzwGR}8Vi1vF_VuDhcWJv* zPmC{HHrir>t8?I;WY4FLIQlZNDcoxB;& zioP_Mnts?r^>{ncCg2*zQ`$>@`9hnh$}v)O&T=~ILpZ7hYjvSmGxP-qS2m9}sNZ4) z%tnw+8e;KZ>!-!_L$4{AqHSmYA%<@oInDB(zrh?qb>ulYjh~>e4?Fuf89(^)EL zc#49iABcV0LL)^>3JMG~hXqYBDP7QpyH&+Nv@U#7_2zGiDTXFexOEqpXvy+>KV^j4 zH3?(;`xO%=izzjo3!hsaNpt6GQ<6CT$J#4g1-{dhwB{mo=#A{%JChMgpDOTXNn7V2 zzQ@Hh{;AFUci4WXV==;JxUIt+0ajF*K?!ad*6&{szd(2(h>V$S+EM}yA8NVaY}dh- z!49bX_S`87?EJ&@mzP2m%sSy;IzZA_m2jGm-^4aT*$rCtl_LI_xbN>cj~el^8;4ZZ zSkIe+wvB6W$b$L|U3W^Nf&uN;Id=Poi+ENDRK`vc%EvpDt?qIObYU{TZ__KDWIA@a zH*jXSF7Wmsa>7GyUK*Wb`1X(1k_ZZPLGBXy9ELj~%kp%3s1~Dp_Gu8L2vUbe+OiU* z^2Q*_n(Y0qVwd>vuaTV6z%r*}>l|`P3m(*7dY!VlJXDa~Qmn5cAK&0f^@$@x#YiWD zB0bC8E-c5eOdyZ`63gU|g6CC=&CF(wl1L#t#W-ONI!n&09Z0QUl*`k?Of{wABlJFh zq#VAUdQh-pgsRL>Bf^_z_rjGGg)YmDDCrgeez8!<5e0EYVQex7yyK$}DEi0zHXf6r z)x(@pf-~H~4b)1ilzI8hEd9PiqTx!^0eZXBbo-)X)v}FTba7fVBwgUr6<1^&EZi$~ z#faBhINQq_`xESV1hala(p8yQM%BO}i&|T=l6=eplrD)cU3e#d=O`*B3bK6HtIlvk`ZcQ^(`j|VL%|6CA;QphM37(x0E>>;n!XJ)2(zzB8Y|4-SQv| z3Xaz%j?`Y`6wg;lxVx0AGZK*!g%@8vTYA{~N3dXZIks4v?MO~$^9d^Aco8e@tWy}u zEaltj7ou--?UfrlYt8D9gc}MLXlUEFsWsnL0J5^jwfXxq3uW+EZ25iktnml zk+aztiYQFn#eA2YwKz2Rue|zeT>^r56c_yai4!iH(m0Zx`E1fHw;>pdm()JFJ&duc z;~~?;d$tR7K|1z6@qBoe8d$WZyS3E@(oJ4QWdr*3^ry1`v3r9sNi(+mIW*^Fp*V|QB{KgRw@vORrCXCM;) zEP0CdJ58F$kx7o>S73-hfB87`y1-l6Ht^ae<_(=M9*2a6(U8yBK#OC^ioG51NP60f z3$v@<#~uN)$0{r(Iwrn@7>jkCox;+IKm#kZ$_8~X%tXao$*s(Q_CUmOQ%hxi4jP)f;@n%W$lnb&bYgx zM!h|l7%(SZ%(=4(c|w0hD*iWr4v(kt*uBXoL82!)hgp(U%7iHNipj1G?NEP+o4=w0wW%rI(DKh*uG9kj{fmGuMt<1wcfz;(ijv2`&+pN9r+g zq?d%vqUlZ^k(fTyp>Wz4D_6133@#5$(%!e_(xU0aY2=pSq9}K>qLi~ZPOP~8d)Yl* z_*4!@yxOF6Zv}%IUCE|a?c-jGv|w!IvBbXA#g_oadlFrt(CS*)p3bxRV#_ck%KOX( z&5Ks2ORgIo$hFZE`yEeP_9Iz{Q0v}{G6&KHEJNzN^B&y;JUU5 z%3%ZR>Ht_P0wuJn@hor@6*pC~T6B36z(=b-NsCRND%R1GaN*>dIEmm~RT)r0$$K{W zJ{HAt#cO#a?ur&xR2hv4ZYMCWBb8U6;d=$(w*z7t_?PXqesp92`kk7kA1VdbcQ5Qp z__jnv>#ijAe zNWtGZ13x^^FI{cYbiH|(?RT`i@zacXSKvsL1(fBY`Gz00}Mzg z)45V|ZSDiPlYM3ReSbLv0**!mXZ0&ge3GXM5U|D=NxNw>?G>xzIgTj}?&1<6)skRA zH>=hfnUYWC*m_&t|E{*&3*`^u5T6@W_C0@kdpJm7;c9kDOrZzJhYI|RZ-U+X5O+_$ z=1QcdFyXjHg4Ny7iO|LDWZuiAj^TcGyOy8El0Jn_V#$^ahlxm0jJ&qMU7%|AnCnh2 z_SC#GIZN+lhM`g&4Y7KD?>hP!gU&ETeqG`yMdQ?BZ_iS;6qg$4D)goYQc}kZmn*cY z%Xg%E&+7%{Q<=s@Dz|xHn6p<^gKtnhnD1^aHy;!whS^^t^bpP}QuDgLYC=r}K-S#i zt)_XBcXq$3K~LBa3+`$8b9G9L4A)!b>$0H{9H)7g6H~(cQ;M8u>R%Maxa^N^uv&9SmCX-GGG{6Ft8?H#DSJZu#RuL+l0}2z9(ABa7bQ z4j24UFg$wntvAnyXV2F=0n&%vqtfOdZ((`;sun(>YMjwdbaJ4oOw}ZN@gs*a7)4Ta z|8dnePlRs97j@Zve=1J9*JTnq9j1?;``PGG+|jdXryrr$mpEw5i}lwMW(=L9m0Z zVc%vv6QP_=wRt*y501kpWdVvyl^@nqF7V7etGmmxV7%H|p#>ljC;2CA-#Hnw`0-}g zi1PGO)mPdI+wdq0KwTC?SpVJaU)2M^76YUwcVdE21K#3j1q;Wr+fZm0p!mzg`7Nfn z?EzFSj!HROu=4f#?;g=Rn>%%o>z6;g^{2*yWPPB0A)WBY=2w||FWj-cbm`W~vMltZ zuUemy>!yTC6aR8#_I!x-UCKJaNn|_tF!J2?My-22frv#o`zO$$rBT_Bs&>F}SCqA2 z;|cr-wP5)!0mglPDWtES`#UHk?vb9gFeL!&Tu6TjD7=rYmU>I?O{UHKCuWg`=zHS& z$3#Mfm&KeI)oh@QR|MU*`!8>Z9Dq_4{E)@}^B(p(6USj_oT#RwqJ1z>{T z_jTKaG(6ZdC+}iA(MRq5HjZWaPl>$lQ2^<lFRC;_^UoLW(%y#~9nBzcw)ngc= zUGs%>wqHpfe_v-(vgf&+sAeQ-*DHc-($y2i&rv`6ag5>@7sUz*?c5Qkd#}0gKH99< zLqMsC6W^v!xvo0&EMS1XR$O!8r-sj;b4VB}3z5ln=Lic$i;u`O(HyzM5=1B^J)E*P z-qlllp!0hrm}MSJ-V%CbuXle-EaCVar}$?4FpS^Fi^|P}bV{-@PU7!*XoUH~+^6a$ z)VO4`NdsIX&zaT|djapmc57`ueex*%MHWNi+Un<#`~s5a#nCJn))L_L|KnMp_@aUY zZ5%+7t_Y+GVsm7S4*A(ql5YBAO3Q!sk5l~he%qD|?a#0ydj|u@d)mvmO;-b7eU9?3 z(D{1-9fAnNoW~KxYI{ke@v>LA^+C8T&IdHlL~sB4roH?im^GZA$karuk&gZu(+Q%r z@+AIUG!5%tRTL)-H&!^Nt0}&CL<+i3{;4}gvce)b#F>Zq;DG6)B%R`T0p58?m2V2% z?*8AJP*-@zK2YHXww6ZJ+$eynVrw7|iJa3YEr?7{4wTMu%me}12AG20DUM{9(IcMG>ygJ1Zn2qnR_T{2vh=Lbw zgA%am%zM3nf&5%C?RLkLajI*M{FSBY7CY=Py&gpW*jWGFuRVEe9=i7YQo|G1EO*0( zq{e-V3Gim?c01nVQZTDG{yD31nknL6TIwWuJqKkU5$2JF4~Cs$rn0dYmAMs&g@qdN zlf>r~Zl>|Fvivn{KpG-T-Hw3~z9av~dZ!ZN^DIrf^ykAMRg-E|J%pw+>Jo4_E2XM} z#zl!X(T|0vXh2U6{bRk{=&a8g*Tv)a8t9Em?`d<{$l7b@URJd3v&U4 zTndqTA0+U0a0Kas^`3n9HdJ#FRH6s|js>WYR3LLog!xa)e*&}@r18n6@zfGTb4n3R z6Y5|CHE4we&Qhys>Y_DVmyvc=eysiQBZm&q1w8#jk~4pR%hvaYiInHR&*^<3XhVmM@DcFtzU$YSnw z@rR6%XV(YbCpwfpliKg#C#yvEsyr6kFL|0Aos{GMJbmvy3%KzzDR?n$++*MFg!pB_ z>5Ip6P8>kz4-J_&giUVHzV3q-)=N;0aqGlh`U-jyGcb6;@*hx+v`z9^DX@6v(GaAH ztSk{e1xj*P#-1gfTmy`Td%19+5TD4}!tG$Ye=K#Mxb$4;t0K7(9K>;X8M zMd*`5q0Zlngu3%2b?;aE&C7yotM3n}7dgmmx8)sk4cjdHZ4p|)|Kf7NsRv0`JL@ew z=Wo2*U!-zz@YTNfX*)0G@}f;Sv(E3CUy5$d9O3I6^|c5s-B4dG7@JFoV7rkc2Z;XD zd5BF=aS`om+JElD=iH_YQ)83=+s&g$1lmoHe4vi3aaa2oP(OSYo6nQn>8?R-D<~PW z>9|BUL6Tw#YTznwhwfcMc6k{ph9F-uAXC31)mBq~)p@$$J!-1L9wu2B$us!NM|=IPP`siZQ2 zqa`JBV^Z4f{A(wO5~AVsOQ7LCPtJnC)uK;kYNteFHSy=? z07mb5Vy0hBw544umyNs97i$XM(yQ~7w;b`ZwK*^2TCiDFmlZSg`{s=%`<0rNyv;s7 zd+b|{HbN4KH>T3IxZjhQa9(2} zprEByZ9j?*Z(gc$D1Jlx>V_MDY^o%XUYw%zfag>$iMvs;Wke#hOjlr=mfwMsZq=w5 znc5zda)oY3F~X(f;IhpS5{5dn8hkU|=`L&GD@UOXUIw6}UKQ>{b0j3$V)L~y{YA!| zjzs`?UA>i*vhX4Qw@Hd!ss(x$u1{ zU3By7(cIOMmDxGaI2Mf#;Er*kJzvIO_CouYT3r@RVu&>_HC&@NTyUQ#Q8blID3P}9 zMpOHx$lm?u!G~W-D~kWSM~9daqGolZHa)MBk&`+Z#?ZDPa0Y7S$ZY$u_M9sKEx@Yn zJPN(RAFP&46I0Y(?c-(B`rOYLRs}+v^?^L~G{EsxCmGX6kOTVVT!SvevzfjRj5}eUc<8#$WDivf3XP?|?igsMJhgc{1*4r>`4u!u4q!21S(O!pA={kuKaTn{<}L&lAS_L>w1;3YXYX!;tiu4 zCNuTr#>qaqt>T5Mq3QGkH^06ws(B@&``d~(C%R1PXisC9=9;32i?Z$N7 zPIX!$XKxU#-EJB;QvB!PI&VgEeS7?C?4N`6H|pt|^mRBB0wwipbqAz`2YuO6g~KH0 zm_G~~3|7gG?EUt`mupwCWH$>uwiHm{yJU;mjn?)+APHD@6uFIX?B&W5vl3-A#=w;o zL&Xp`b{vh~{GX$zOii&+{j=36Na0}rPELr~UNw?!jTP?n+>c-qUH7@}@Q@)!_jSJ{ z2k{jn@*q}ArCw5a56gchBTB|0P5&uwgm~F3nN2}MUMG_6ZVMOi1DqbC+eY%A6M~&n zxiY4L9n&BfGs?0YhuE{$^nd{&_S8l(H~faSeJp+ATZ_foPaXp*Frck}4k&dn3bL$} z&xyYY(WC4I7*pW8BgI7MvPwhAV7L2f_EW&~#{`FPs$-Ra&KbXD)wEu{k(=|0~#}8BpYc71(Fec;O8BZ;9DXuiew+4Pt;&rVc=_@&pI)Qx?~3-)?AM{W>o%d=+jB#uPQNfO z43e$CkllBL=kbWJbfV`aJZP{Zf+Lez;opZwmdZTR^uHfk0dZcE%bUZ`M0{p7B6Of5wAnMA(Yq39a$>@7uAVCn*2lp74Tsr1n2Op?E6aAkMmU zcFvWgJ4VoO(D(J?do2aUY^-VG^I-!D9{e8Z;Qv)QM_P*PKmT+Pv6=gJMON1Jypp|{ zf$V$-g>n=Y9py;L0$j120a=#XVN{UjA0oi9|4#EWxlLE@y=sZ_F4sW-I9N2{r%{@( z;&_6vexj9G+`3JAQc{3cB*IJ|5H92i~`}aV zhE5mozy3f8rHu=RB$U#{8cLckDep@be7VHD`e!pQ2(`K1Td?vwYzlbzpx0PbQ5*ku?%j&BDP)IdgQR2>7u z667gS3i$>S-k4taC@5Iy46>F*O!nn(0Ujsd1&V#sU~R|0&?3ASvz(J-p9F%fjZkWoP_ufJ} zjYwht$c1lv=qUk*HZh0v7LfJI>>Vo0&w%bt5V48`NQ5Jk>o0^XMy2~B;^Qn#0O@Management Servers
Promtail
Promtail
Prometheus
Prometheus
node_exporter
node_exporter
ipmi_exporter
ipmi_exporter
blackbox_exporter
blackbox_exporter
Exporters
Exporters
Switches
Switches
Promtail
Promtail
Exporters
Exporters
node_exporter
node_exporter
sonic_exporter
sonic_exporter
blackbox_exporter
blackbox_exporter
Machines
Machines
BMC
BMC
Metal Partition
Metal Partition
GCS
GCS
shoot-states
shoot-states
shoot-details
shoot-details
shoot-customizations
shoot-customizations
shoot-cluster
shoot-cluster
gardener-overview
gardener-overview
alertmanager
alertmanager
sonic-exporter
sonic-exporter
rethinkdb
rethinkdb
metal-api
metal-api
machine-capacity
machine-capacity
Gardener Dashboards
Gardener Dashboards
Grafana Dashboards
Grafana Dashboards
Metal Control Plane
Metal Control Plane
Promtail
Promtail
filesystem
filesystem
Loki
Loki
Exporters
Exporters
gardener-metrics-exporter
gardener-metrics-exporter
metal-metrics-exporter
metal-metrics-exporter
event-exporter
event-exporter
rethinkdb-exporter
rethinkdb-exporter
ServiceMonitors
ServiceMonitors
gardener-metrics-exporter
gardener-metrics-exporter
ipam-db
ipam-db
masterdata-api
masterdata-api
masterdata-db
masterdata-db
metal-db
metal-db
rethinkdb-exporter
rethinkdb-exporter
metal-metrics-exporter
metal-metrics-exporter
metal-api
metal-api
prometheus-operator
prometheus-operator
kube-prometheus
kube-prometheus
node_exporter
node_exporter
blackbox_exporter
blackbox_exporter
prometheus-adapter
prometheus-adapter
Grafana
Grafana
kube-state-metrics
kube-state-metrics
Prometheus
Prometheus
alertmanager
alertmanager
Thanos
ThanosText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/04-For Operators/starter.jpg b/versioned_docs/version-v0.22.4/docs/04-For Operators/starter.jpg new file mode 100644 index 0000000000000000000000000000000000000000..36808c9cba68b6c40740c48f9709f39118e40a33 GIT binary patch literal 109351 zcmeFZ2Rzl^|2Y1#N-7~#M3P;&lWXsly;sr2#kDRM8HJ)ENhEuf>{(_Sl#-Rb3QOMrR(*)=Q++f&+|Ob^E}UUwDEf59Yl9hSxp%tBO`;p zfFEe%J%xpmH{KS4)YJqZY6yaMLHo$aAu0g*f)5>lcY*f>@L?dMfXKj`^kE^R+I)us zm~|Vz31Gf$8gc-`0qVSfEmF%8+`D=l$*Sd0Ze-IwY5w^{Td2Nf})y8h}5i2 z{ExSanx+m1LI@5MLW%%MFa%m0CL#{UaKKUG2$VPq2Jt`%f!pl?6(?`QHv!BU@~h3f z+i*RQ58H-G?L>rZwTDy=MeKwqNq7VjP7$%y<^(`QxeXTrm=3@@0Zk2n>9^rV05fdE z9RMb~Nwe99J^+*7+-ln}fGM`iCjm^k4SxkN)i%vCfOp>9YBOmJsJCGNLc6wMIsnsb z)00zxx^DmKBW>DNT{NJ4-!{wuV7jy|8URAj-JP3lBf(_b@aDLtZ_$uQ$hToqImK_~ zl<8aYSpYNDb~!(w+3_0<^>6U5-(Z^GU<8mu(laNJgGwid_5)acvvFHve;a(~03RCg z*&1=AI6{O2ju3~5iNle9EjtbaSQrEyhr$1Nt5y;qS^0g?7c_G79jdY=n0{OSH=uKp zLK47-RNsX%WeSqP|9F%1P5OKR9}@mCpeMZ#Z-4*sR#xIbpaex>&dwal2q6rIiY94( z@%Gw#c({rS3%j@rVQmOjI3a6-v#>YTRTwS=6NV&Zyj`)@jyMkvE1VtPMT&FgQ8gzA z-bRYk7_AA@bXCCF<5hi$IDKC&18ZMLYcU&68EFnlZ*gyDS7)3Dmc!fG$;DmVTZ(g2 zxHy1G#loB%nI#!&Nw1gkcjmXbjNvk;9cz8 zH<^F5(Z>2GpQ|U)X;aBI*1|X^oHOVOi5C8|5>m}dCO_$|@vc}Q2Up>r4f-LIo(T)>Z^5h=qyT3ZiT=I6({?d_~}3qBv_D%F4q2#k#&3J1puiXp9#f@o`75i|mW6A?jSfADJ)@nHU7oqlfzOjHD; zAcj&@P=LWuA~1v)T0}`nK@_8;ETSNWP)2fcfFTuE#JhVCh$I6BvxJDVCP8veL>$(} zN6yvN36BGl(SYcQ+oIOMdVukDQm`iyoUtBwYdI?%kqChQMQ)r6u$%w%6x*@^cDprd zF17?IPB>^bQUn1$!f==uC@M{-R zTjCKY7{GFf!Zu$B5-G>#?=3-VB~qLS^tRGS zUHKEK2$mtd(?7KICyBl@f#6~9f^!FR;+HaAJcw9#k8S-Ue(0D;aFuhhBaQcOCGrFh z4+2mqe7hBZNPz$x2@#8TF(4RYiNJaNMy`Rg{Y}GwSdXOFKiCaO?s1z%5ob#T1C3K5 z;&3i<&IC`FU)+D-z<{gbr8q_Y#s_d3U?!vffz$CMx;o+hMd%iCTdL?^Ik(0Bm^q3# zd#o?e%};w(@^&S-dlGTmYJ`FCc}qvYhVlRG%w`9H#GgIiEcnaJQ^mR~0JQ-RhIMiW z4v{pIL7D#cLifW@ZWb%*DcRsXGzm7p#Qrqp?TP=hwV-Y}8wXE!57G)E=jMt1*^)mn z@=m|C@ej;qga6K?iM0bl|3#uU5eo+R?~Gfc@OK=T0)I!C;+&iaUO#afz@uwoT|B|M z^mCQ@$Dor)wtd+TN2R17qNJcG2SZ`dN=hhsF=Yf?P7Ean7BVFzxcrYf_Xp#TB~0HM zOPV8a*!FP$Mx^9|wc5mOjoWV+W#C6$fK!#?B<;mG`1A=bJ{-R-Qnp*+EI)@Jhn}3V zkdw9Re~3_XS8}$(+1QZu@|$t|R*BYT1zXPgKWh-)uHrug1KaWh21gPE<{Z}3$;16W zXtozBFjxPh`<~7qC;(x_znB+raR0>rVPt>7|7mJ}A^4}k{e|QoX7?A0e;D6iD1JA= zzo7qVh(9{I<#RXJuWb|2J_{lkybW+u1jips{vU&=gC&Bo^C04_6|qD|;H$S8f0h55 z*#8w$9|TjtgNkmi8Nb*yNN)IVa<|v7ZN?u<#4pCJRqAh?TbOOeA2UV=M|5{31$bw1 za+|=f*8ak%5{P(T0`M4M?fTKtUsyeY2M7QGM(96r|1`eesxx#2;puNn&2K0p9Ed%^ zto>VUAod3p{bx<4f0PsOE*_g}K2U@p*i~*mCpiAU0B%in9fG?DY2Eo@o&WHlzBL9faY)`JsijV>vyn7s zV4pv&8x#>;aV|fi!yi*~yI9G_4yTEAcl_NyZKL$CHh529;m3i6Zw=oj;?L-DbHW=C zTmZj3)`{f!e^pHKK3k}t?&|l^|Bdx0{#VEUCI-|GV&s33v4#AL00W$}E7(DTT@7d( z8qC$L&KTglw~Bsz-&ET1ZC?r6jZ^R>p4~L%EhTHkhwEdtSb)8(PW5McAV)$ISE*mQm< z3KT=uSUQ(8-YT=F&MZg=7iv8D?~&PqVTORAmt~5MvI7$nuHV; zL&K3sQ2>jHVNfVh5fprr11So_AVoxwBqETO0ED8bZBa0om?#2H;y|D=Vj>8{pBntt z5U}-!38B##3<@m*6C-gW&>|R7F&JnSfDte>5{X13NL3)vqGE6q3m>?}Pf=K>kZRP@C;QBS3pm=pO?EIty|> zo9#dVZvirDB-O%DXfaV38t9xfFr>^75(V2N0y!Tf255vtBnC%g0L_-BwhT>-G-6^f zFna(ENPv;HYX4!T=>HAORAFno{ip5xw#0)$0J+3%XZfpKRA}2N7~!qJv?KZdpNsat zgb&8{cn{pq)j|R6LJ7`WirK{czE`!e7AMVPQl19y4EB}64z4&mPL8cStvG3qLUIit zl>2S-w0#!9$wA7}ip%M!fvgE>1>5|p=VF{3KhwA3iXcE$0O?B)(q4>ocp?Y`DOVALABQJf=OdeW zQ}Hc26371D}Ab|dn8nJmMw5yYHv8=kearW6hu+Yc3Z9`6Yj?Lo&aqM<33J1~+IFSF_D)q9*fl%;A_mOY|I9wb7 z17}BOoWlPm!3IYJTZ5k>T(|Z;Agq+)v?jQm1%W!whQk&lemS;A-&@cf?34wuL@y2x z!gd+SB2I9)V}Tq}p$pE7!wD=cqy+K5SG-C7qvh82q?`m8JCM2G>I?oax$*zC-1-*3 zJHgh&3robwkuo7a5~iD*E+PSR1|x*v;M2rfgNOs15Agq}^*=QTPF+RB5y%aC!1)Ozknj#0^<{bKK z`$Yudm`!6uio?+VFSH+KgFs=etWkn65i6V^${Ga|#GbLM!XQPJ5K7xR{rBDR z&rQWYb`6LV9B`2n93Y_JK!Obf93i^>3xrx=KY=9eEJ#QM3Q+xTv&ZW+OB(>^1Na0HG!VeAN##~s@Fx;%w+WN(MM8{313d-MH`4804!hrA ztKVP{Njn1?6rka zhy${MJRv;f1bIM$;OzoR+#x-Hm;V=jmQ8*gz-0xv@Q^j&P=pAOGlbpbhe%@pXu$JJ zx9(s&xmiTEM;=^c9o*QM;|3RRqabK4Vq;_F&c?=C8o2m606|Y(e(@7-Ll9;Glt=t3 z<4Oe=Z7)Gk`HNp=RcwvyX|Yt~=0AZRbR?!3PZTp~5!(i^~$ z@X*~}2r>Y=(rAXDcyMc)#}3Fo^)LM<-PQi7xBrr6TYnqVkgd*-D}WqGAsB>_SJR}V zB-IS59VRn_C|J2w4wH*Q)TFEl42cjqOfLQV7a3?b908JwU;_&77aRuWK@L$KCYSu9 z7~1HE6i64$|Mel?!jS**Q2hCjglr1{!GX8vNo?0QD zNkW88D*R;m{*###s>zkZ!{`)W_tRDxhUz&+rG{6}Yrd%Uj+W0{x4QSO^t{G>ZgY(Z zi-NwTV#=+q@AWAX5_T%eaZIq-fM~A@^o{JMPI7Pi@N7+p`mI~!*yNja(LA5%iJJL5 z9wYpnNYVXF`<p{Jw$7%^`&C~Wmx#5_W=D#@xX!fsFdTF=7KF<@^)DhD8I-tj zsm|41L(LxC^ zj&uML9;^E=EK)yWA9|NOm}oQUeIn+kvC^`D zzm=vJ!|;ww7J^hy-12zIJ@nD)Y%2y&Wprp?ii9@SJ0+=gpHu#e3|_&~=gr)a{-x(T zp0O;O*z_LkK~;UTlP*f^@=JQMw`G3jh($i>4nYPDJq z49Q5$vmR(!;JY=2E4T=1gUD%bUUT?5^W^&zVUs~=Lcs;E@2pnh($2G=2b26*(}U4{ zgk85fTI@TzIj0qCHLksveDwJVu{Wh6wwGC$QB*A>d*E1vxz)2eRs_&$l$@=qfSF0u7t% zUt61LnL?inYFYeVp>=ql)2hnIyl+5ou2y&T6Sv7GPU~sfIJMAS3Hbv?RwbPpA2SDy zj(5yGGVl4i%-T9Nf9{9@NpW#dS~y*uK%k9tbjkzi?t*9if+=15_O8GG`u1q7|HSOM zC+XjdKJm`>tOy?SdN~%GXPReDet|~3d$^kLw8lqgxpoS>wtAY+!?Vqt zPlP4Rr#}^)GmH_fOY3K_)@u@pmYnZBzhW!ebg5eI!xACj@JHssrxLlUpb7jJp!YR& zOd;Z$uL{Pq3+BxtWxuGelzf{jU578+koNEYs%;f;Du>?kE^dgpfsOvMAA6~DRl1*9cx4z zl{sY=6}(Nk#_)yg?gdI9IqkyTr#apuTHz zHJ89%>%Xz9GnA^~2EKVlN=!_pYi_PZ>WQ0Yl`QBJe>(WZ5^~_Mrzn#$&h zBPV@pi_9+o;hB6i6tbad2M#@ctdo1pNpgJhtKZ?)j?#>K;vetb`xM=3$f!%nr~_vY zSKqA|R)Bnz=X6!{jiX0GML6%&`+6U7NxCPcAC;Xiv)0ly@8)}&-(V4)=lCsb*>SJB z)9&6L>C-~fj5(GD5506iZFE$0x`Fhi3Liv`ule4Sg3lTk1yv9y1{vcgdp$n(2E;V- zrBU;d6`u1(brXl8%BV{?vF*38<)<}s2Qk(qt+(nd#l{BD54!am*_txDTbSAyH40Yp z#7k;q2rW3}@tb~n>3g?hte-tVyYQSxHmDIiZO5`Ny(9=TM<=xw}O^7!2OkrY6f^6mpqg;1T<+;_8l=uh7 zBnHaV)b)%?F7T>p4DZL}m!G!I%o2*9uRN=g+&Q_vk{t+LAXQ0eNEfFO9%*ghH+Q~Z zM&tOY+qRD!gC8y@K;##wQ8f=AJTT5{nI{OV4R;qH3)N2-4~R2=J~942J~QdM+GrwY zBV61+rk7b(@qIeiE2f(vZ>}iNmmTdyHg&xRf2}1)iZqUm*LscQ2#EE~ zNU`0J?@$!M&f>rfhwz!p4^|a=*~_krpS1QaY38!2Ij6j;r|%X- zRYYxic>w~%#(U8lkg;&G@$;xDKi^K4s}uRe#aKge*5}k5kh?Tgq=kw*cm7t1j1CtKJHV09zGO>8ks-eTpd4=B~wsx ze#TS}-~vN9_H;xpwJe=4eep8e_>hXz`*y+BcDJ)P+`k32w`L(G9>>M=WEUI{F(~bh z%h~ztt0^k%N_`dU^NLh2AHS3|PZyGuz2Mg|_Y~s1<#;kgNiX3#_h0J-WeO zlsp}LWP-Rd4ys^$3jSE5OZ@Pmsj|w7)c5m@z$h3YSvp-vcl_SO$2^8f zi<1u>-qekKG#fE2BTgKks}eBsYnol#)8l;9_nXATm)Cd|YGnmvXQHRCe}L}yHR-Fp zossdN3Ys&(j?Zf7l_i+H>?*0!c#aov$N?cd6)Cdbx!VCBVEMAV=~SoG=oH3MXaf>^ z_-aJ6%jj!foP|kQ>UqhOZ|7R29aH1i2Jqgw{D-L5T*n93h34iY9zC+Sy)AzS`p|og zkBFXfuiIByCczkka_}dUQCIpNE6n)Y`tzE2SG5$)OIl17-I;4>7;n+_!M(K_GtOv; z#TH5x8nYaiFU@N!Vb+x(OO^9_|7bO3Ms)>vV^ZJ&kzH0ciRN@y&A2>T(wA;3OOg#9 z@7OH1bJYor#Qwdb<6|v1B#tIa=FA1iMI3M~qPI9O`Zjv9K%nhGToy8Ce>#EwY~A>Q zgFS4w22lspQ_nTZl}Z|rgQq?6AC{XWfKu>KT(L-Uo?dqs);~7q z_enTF#?oAd!F$aqSJ0g%65Z}e?oO|de zG`Y34gE#`IVb3OFZoW)v$as+KhuL_T5bx520d~fYpO#Qe4nLdR*|B}*tb;kPqj8QjE zJ;Pw?ICqYUNx9@*U&SHurNYNUDWXx@$^4xy>miTJxQh<$&5P@+?7oYRYnt$@bC@q@ zv1Mu{xKBm)xPA8f4tM4@8DukE<~h3~p$SwDVjek4GD;TI=x(35I`rd#tMbaJ7Rh10qn2TMSMNsU^J`qDdB?qbqhc>6e*7qGVd@-T zmY1M7dS9Z)vHjqX?bvJYzNO>u#he>R&gYf~WE{JS;p?;^Bu&glx62*H;4X58;RU z+H*WKpE$L*olm%=En%7XOzX3=bLSyX=QjJHH!Uw;61Dsg2`$IMlN^0Uvy<#hs`B42 zv)aGjuTgz+>`=dRj}+p%M3gx>h(FA_0-+$~hGMKHv%oMbc648dzj5FXws%YCix)kIxV*q{Gl7QQR&SQgOQhel4$MB3rdSC z+@4oC3?vw}T6pQLRtve=C3Vc_`16&1HGBOzQbw7==eZ!AkxfUR?&&F$>Dos%&Y8=S zgKSFyGIbzs9eQQadtQIW;_~{w$wEdQh`b32ooNrEQKB}}J!riEema@;^5FE|7fY>e z8Io9dX|L8!)*ZdB&Z>Ai?S6zjg7?&`$wSGlNnTx}{b>98YN|d=73$f{q0_e4=en1Y z$emBvjrZ%a8F+a}gug29^b{GZ9Q!)-dUXl40qJf)EX(e5mIc1aUxp@f1253<4c8$R z4^k*IHZq#k)X*C$)to5i&#a|K9$ZLcRjr#oc<0iKclVyYVkx=)!tB*hjTS>rmGSQQ z?hQxZH`%>e3oB;)-2@rchqtXYonvGG|tQV>bp}q)tNg$m62<^THA`xdGu) zyx*5P)||e{%um&YVsyx&VOcxm()RGzTxTB5!5StT@t13&`V3j&%t{*aefLDe{JU!l z4r*vUiP_Cu>kyK!WBMfz?rO=ftA?BYyx3G$YiZW0b(Wb#Bh$>aYlIG~cC^hT?^wyr z>dW&*Ei{XgGKdW*V*|SJS*}VLQ%2|nFbxV_~kDNV)45jG#~OY z8l{yboUpPUK6aE*!R(&6Fui9ME{;*RCX@`~ zFnC5|wTJ)Kos*2Y6_*d1XZA2(GkIaESl46C$*I2&PUS0ySC!(VIylmDY>(N&E{zkK z$yVvbf^MUhlSS{xh2Hv=tn03~-TXN5VTusZSE)1+)lA&2tYn&0kdb$8yfjH8iIb2p zn5ZpSOf%scYcl)%GNT_Qh#Z2H_Z$@2lXEYVqb6SUws}npGd(;aG{5G>^A`$zoTzl= z$bI&KadrCPbfZ^yFK<9kzs}5WK(lNWBO6e_R5fq~i_Rj;j(4IoiE3e?k2m6n=vEq zhlCv!G&%lKlvZy!p!QqPv`kC#^w-pfpKjb*%X1Yk_MLDyuh;9ON1`nh2RfE?@+G}9 z9E-Tm8nYXa4cA9IM94y9VC_M2Jlhe%(Y|BPL4E$3c#RAJ9A{U_vB~=(WhIA0MvHp= z_rJO^9x#%e_^l{&$?~O4y0}+juDf97alCjDXK!?wS&Gr|ePkz>PM>_2kMX9F}ysXllRq)*e-%B8gfuj+!09wV2WQdDS+K~yje#CHUwX+`Nks0D%K@J_NF zJ3zh`bPVK)DXDhsq-WSqO~=S|6ebI2KET0=Kpi~Bjg-^jLMteq0U2CsKubnNz5#u+ zMyTy?&YM~K{3+N*;^>=wTsOFGpe~Dds1JXjYz)6M>-IQQ!}ExZgz)lSwrlN7X6ZRM z-2@OaN2y*sP(vV=S8f#*Tq|MKj}kl|jw>F_k2>>d(d-yk@dbN4_e8lA*FHwto3f7? zPt)mAEbrr5EDXE8x2n@7^?G$%*GO)_3mFDFVS5)Ys_DHiE2xrjHr=5HZ{9z#|DJ8#}S!_4X!Y}INP#cyRsqvf%q%u zELv;YrqvT)VZu0nWrinlUWT*ri>{>+!QSY&&#}8|scLjCx`sigxS<2oJrUZw4I>H{ z{oI{|NBwNjF03@<^}f^Y_uFL?h4IC*(K&63mCrs!m0tdw^g@(kZw=u(+%~HC>RQoI@tV~JRDO3> zqDTQf%Gy%}V3z^+$wf6S1edU*dOv6hiI(Xd%v3lah0d;Yx+)MjGEiX^K$o+v> zj^lgpnG4UZU9yU=+m&bj;6(Zvlf!yAWMsWo@P3KehP3+B=d;pQmD5IJ2}eKNe;AC= z#(6kR3iz+iHr1Q^eCCQ|uytOJ)9LTPooL@D!8?3>1KORy;D%V`#fm#7GGUSiy+kVT zr!`;t&U84Oz`PO6uWzyT%%;_8IBD0_F8GMcnzkkXfe*dOxvTy=oUced=#$`jnaZo+ zQlp>K6&+aC*KO?o#YeN_YJKmCy5R|54+k%eIxi{(LxIu5?%E>ZK{L$<=n~3p%dRrI znI#aZ!V%Hky~+-UU9F3cB5%QUoZCttq&{kvl1O^j#lodEfBQ;en`VG*|7RCRmK4vg znbx)iABh%sqwMLfCYtStIbX@!V|NR+m#czxiB&>cJI-y=M_hI-e58W<+Xt(x(;wm~ zd!LP_X!&15*?-7?gddo0c5z#x37D=X_nD6ydUYAOTJNlOuHCErpx!B(W#*MAv{!N3 z2ef|fw+$%fGlC}l;l`BQ82wuAY1U3Of$Hx~P2{MVQ~oGDLw_j+a#yYP18y+eHzC-7SK zh#0@s@WRW1c3p`bj7ggAZBE3pX3nq2bfX`2><|Aeq?W^awS|ApU1*p1w;dkkbc7GH zH?h5yNjCAr`TU2>Mc0n_+fA^}n+SiFnp{3`l$hLeMV^1OB`D-!z0uolwSssux1%Dd zZw7i|_PiP}jX83kney7JCj;M+x9t<}-%zvqnm(R4ll!e9HTc@he8)-S$UCJuf`_UI zCS|k?$ZxNat}<*wC)_)F^Zh$|59MhdzBN{5j(zJHXA$#OtI`wg7%8ZZ)9aiPF#aAn z5+7wr&!bGkmEGn&8_d&ZumQ!^Vz`cvsjlCsM$U&bEypggFPz19boSZKlngXPN-o}1 z;*Rd!zXn4^44KMCWknezdt?|pF2oe}7;iwr>=Y>T~PTktUc!Q8; zt8rxegBJef!-kinN3xdvSF1ZP#tR3Qjyy|y)#Y$z9OGqZ?i}+jB#fHr%j7UR?2c{U z^PQ7r0b!L9iG7+*XVbVfYgf2Gw{g4dsgl#fRF1!TME~&BV}^z7gXlqHZXvwcSHsb3 z>3OU*`!o_t=GA)d$}bFD*R`43b?r{HCFhm)$~`#!xl=VXqRgrht)H8y7H+0atbhPi z^}S`$26U&6q3@*nNg2};b~Tw78_@NO3%mIU{?9R;ge28gO&2M}@69iowTM+!fgTUb zi}UO6#wHY4UDKvXgKn;!V68(jEi4~QNO&E{p51PG9FOqePmthEY2ZtKe@%PzgT`(@ zNz1IEIK}ijPPHRb8_;0uvvTwK9w`RiBZ@)$B&U?0SCv>^E|Ho4)Y=*D`jH0Zdo7MW zDZ9hiINHDLf$nj1OU?EDnrAf9#+*VYVu;E4K1(fet0Uw3Qw9UFN1aUFz9L4 zdXdchhiIRB@dCnOb84FMt0Q-8+^zUkI7M$fZPHKW@p}GJH(tCWYWDsSJc7lK+g!wW zZmgt2%k7E-(roz^&0!b3KV@org!KmWBzEz&sCZw1u=>e8rmOjm!7`#?bEr{1sUAIFcz557phT5NjLHa5Ob#T<7uc+aS!_Y>8r zbECyKml`wRTpgirI>ySB;1lR?@u961G2xvor~GW3wa&>Vq@ZhG_rADS)5vcmbMe@` zPNnR6gesXsI$ufA#4Vvp+*p8+O!;wV-adhdx+p2hzDik44`)LI0n%o9d z?aVIu&FHaE=bk>dyKOaJ-6e*Nd4wp9IywVv2gO;nS@@E=#P+=PdOuSBH7Rn|*acO? zvRv|cke}~vwrA1X4X9-JMBYMD-f3Eu6Ih(lQ>7C-2knFv3dKVX;^`;XwJ%-MTPWPu z?&UeYYxRypY112H@hlOplZpA2=dHL@qb$P_60GBbb+xl;GTqhW+WsdNEkmIvd)akbjxSZ%hK^mzYJDo#eA_R7S&YBYg#(^0LUX5-7VC zW@e~MD~Pg?h||q3bLJQGN2r_)xbV%bRr5vBcfAcLyV#S5x_)h)f8|^r^}J8EWO7D+ zy#6%fq>>%R#*Uixd~HNez4J2l2Gm&ha17b;!N0HSBg?9!y{^r~%&8-6HY>rC%Xs-1 zXSu|qYA@}1axnJOVn+lMRj=#3aE)8!u@nry9r6jGUz-;iJTHcU^;Hm6NG&+l>_3jm=%tI24MX^U$X#o4+3yiEjGPR7u@zRBE~J z^D>WmA?i~Dm&277|JvCV%yS{My6Q1wk$QCz2jOUCS2V+MN=x};Y%5{X%IWXyr>zDi zC0luG$0whEIl?-BpusiwYthL=^By9!YFA_DH21w-qm1cV)`%#MzTRwq!0yGHD~DR# zxUbmB205)QMmA~~mz`*=;l6f2eblYz;MGHc9J1A6&og0M!A{>#j%lc_O3Z!l2q0IP z|NO+5f3|(O$O_e(G-Zym71;gY$i+5uyqk>fyH^Hv5d*h&;Z~!oUq^7r2Cqh3qc!O6 zbqnu#A@}YPnlXkJmFgC}lb!zj%&jM?tzVi(j~=7 zyNmCeuP3t6+{(RC&AY6Z(zR+Mj?-mxNIvcQG>qVDc_}tx_|{COMXv8LZpNX-;}Pvj z!fxcdXo2CU-s(Cvl>1RLV?EQ)cIE9%##?ey>iB}yhnGu{SD_>=l-%hlC zbK{=mrslZf>-D9ah2r-0GqWmnu} zxLeEN4tBTc!*`rZl7V`d562mbTcd3b6g*p`OU_>1^;wXjR*i};vZg0Y%UXNU$V`)*-m)7}Fo24U+9j6LMx?X%2M}!B`@;xF7>WSCJkJL%{ma?+tzU@-;Q)xC}F>4p^z8F z_WA|&Gd_lkCm8Co6?yUayi0@H7ur(mS@>%d=EnH>ERzn$gf|=BGbxC_m((!3`1ZL& z>gCMCIhL0zKZtAQ47lxRx%_(ITElm|K}vh%m2-ZPUB`+Mria9XEN?^x>K+-8>5NW} zWamD7Eyh7q3%2MVINSBCDy^WjDCaVKf5=%0+In1Id_~$7p0B80%BKD%`tcKWHImZI zvM!AGH6>KE=3k#v_k7XP80ItHmuwrP)rm+M#*7Ec%q*=ktInS7C@*fC`F1k=sXc~Z zXz;L5cH~sTgw&nBuPsDo37ynC;UUO%2hHP0hu*-&pCl?8XQhHFSBHn-R4V1{nU{EmZn)pj_TsTS6oYcmb#!`css zUC29aV_qqH&lM-3nc7+twYajv@Ma<2dpW?}-C7|w@zvowWSr1tymBttN$Ttj*sQ%8naO>pd3ea8ucasq z=d(CJN&kF;iD&NS0`INx{{1X%^;dZqU)t5Kve!oEacA9+7dki4s>V{d0foOc^x`Re z8dSam?403o?L2drtag8vY%?efj{Hs`;IjeYJDqI5OYFQS=h=QkjiOUWChJRs$LkwA zj9=EF?kJt9rgAS6DM&c$(1i_kdCvG`hrms_5URIA6l%l=tA@s>bh19+Z}umwq}P2I z7m%n@9S%EKu^3f#Pa^U3`r~(cACFTQ(XI0|DjwjmT3z!Y=AKcjA>y>BRoM4X@v*VNFj4d3G~t1l^g>m4!?QQ<8{Ql3pnZDE&Rx{1H}t0b5Vy6(2~YEDou!?i92&1L6AJbWU4-`LTi2RGG(zr7h3n7hBI-KDMJ+ZADTz)t<;aw75a zOP|RXbtO%PpP`a5sDryu<4#f+tDEv;RMA5b4*yLq=$$B^OkRWhSIkN(7wDQR^@ zJBC1qzIJYvx^sfa*Dg%C&6?}db=LJh`;LxC21k6|kw)`ne*=x9_48?sgcL+u1yanC zCXFK3Te5H{jzKiV&D(nCb|)wrc`%AtJ>QcVUK814m^wl$OR|qp1q#6?%-##f zjxF(behacxR2NF|dr>*f-Z!H6@xhEb@xf!qgdCT>;SP67>>ShRFrR6(W+J~;PztSO zPCGHV-@^R&ADuI9f&WyOvs24w9AkDe^n@jR7N`G8 z9p7J6b>`KfII}QSvrAW2!G8MwO?w)7jnuG{`=0CW{E&_52obIijIm*SfBErYZ}BB7 z@K?c6=TKi2mjem|e4aG22lV-RxFw7h%JlBfnk->$j)~?XGTmtUaLYO4tK);oqm`bI zhF7Vp7L%jl#>S@-%c&a-^)QcABSQ^42K0NBY4tRQ^_7lJAwOyZMhMXR;iD)Qjhf&_dcGRa(dIn5Bd6%dlaM- zfsHdWCnk#uIA78zJ3%3#3X44bm>Aukj40sE^$k-Bl70#gKWb@eOs6v&-m2)+vhS6= z_`|-3F}u#(64S~XJMowXMd(u9=D(L2oVNFNW>6S?FlV;d zVF@OlBZVh}76O&ruF~z1q3d97h~T>9M}DA9VMOX|OuSDYf0~7eH8)S$co9<5C^pZB zJnf3)nwo~^n;X(hhtwHU_iBqTET5K`72wb7)=sQ`A})OhCm)QCZ{5vBk5!!p=P|=y7|zdB)hWF24zCWW3E>O8xtF4I$7_8#XR2c6r$jy?-&vUN zu7goV%3NJ>{`q33Y?v53q}YQ)ICm{mo;cfoH9k5c?)U?C^egV!(~YC+)1P%dNE-Xk zcCAR5HC#nrjL*2A{?az*Iq{)7v4;D~Nc@$-Pe;$hFnm!TQAiBe=Pz1@e_A>9(SLn? zNa4lBbQZGP&(fczv&f};2g!=mB+}UPN0ci>)=MyoF-p*d$(&MV&)sKq@azLI>U#dm zT;AlAXKo=2_lqo=g=Sf1_IIH^!`1wSIeFKZq7PAG=Vy-tQb9)}C5J^59%#r@Q zI~_aublUaoV*!Q`Um6b0gCYIdC+`Y6nJDwkK6vu7J8p#gKtsO``Y`E7_G*g5f5w*Kta*(T^Z$cAMRv2s&f;oqd&w6i(43Z z_x`oUtK=}d(OD<$5BV%t=ov$}136;q1I_dTIWM6U87`cr<7A_~$i;Qh-%jC9+xQ_0 zRTLPHXQhm7`f_e<*m{0iB{Pb2{NXgeu4Vkxm1K2oyN>}m@PpiG9IDjVlhmPdf`Lv9 zWOU;m;%wv~3LO_GHEwpt1$!DN{@eCDF7j|Pp1Prz<<7>>`EdQCWFaO!%3QV+OW%d1 z?}&(bCbEm-g?Hf5ws8;Yi*%e+8;}YB#o0OfIWo`DoT-U}W6kvLPPmD5b)&}6@?d`tK8q;(pHD9fe}(D@*;H^u$_Cz7O)e*vuw0gt>Dx_iymAaCj*zkcTw!x zLAjH3=m2h(Q&2J-g;UY(m($$=&KqR0ZaW!a@)slT-2ZY+?>*B2q>k0I_KsPU0WmPG zn2THSCbNS6nW$Txn}-qL=t72U1A4s_j0%Y5rgrM=)!-B<8AhnQ@-0g1lL_bdo6V>Zf(nW{x{lc~_U2pHV#r zcgk-2!3~Jm2O?uPbLAB25eJmplHlEQYxM^Bp)baXwUz`XzsE-HkNq81v=&MUM-uu( zL#qY_R0b`&sNRbP@*rG4p%Z!ZPua>pG?U$R>my^&l@Jqmfj4jUbM@z)y=-QRh*@a` z9+RQhy`N77-n~2Z{aKOen=k7j`jp8C{j+ue(r&(Pw_O$v4sQdl@xwarib9 zMPT+=XQqSXnRec%0+Jc+hJAgv2x5f{)YdKRGqq-tX+-%3)1GrmnIHNuIwpKkSvLMC z94Rxz`Z?fhQHwEW^^=MLaIw-dDMdNp+>yoV@5UdGMFy|u2lQ>0`YUfh=Qbeq4Ji5u z-}!K_HOpno)!gTqD8JIqIhCj~h5=em-t#U>iS5==MX&=DH@TmuBV>BH)za+lJy126 zc!+IiX1EX*MdpZo>1p|r+maf?5PSwhrFoj){1!Hb{rFc={talsNoLJBU^zG8$Sun2(dw)!esPbEtShfn34{lCI!D^) z;oQVdmz)kq3VW2_YmX`)~NRmUK+jLz*frZB}-BZ(We)^)>$OWC@E*W0HAT0)hX5jpXn zxD9g~orQfx`b-YH%J(X@HnS8=p-l(&$(^1tKG){Jp4`ncK$qW9{_0S{-IFsN#FhaY!DDdTnv zvUNP}X^oxHEP3-mI8@}MHvZv$r_%>v1=k;;R@$9P(%=R;GMG=?c*lNvFENeu$*!g_ z)j+An%ZYZj3CZp}-h#(Y-^wptLRk|5!n? z#crFmwsQ1Ns$ze={d@;7s7LP-t=SH1VQlv2zy0{G;I$ryo8h%d$nw$ac!xQ)oCDD* z_e%Ac%s9`{Mmcpp54|rN`B>oIJMV~sTY}^fZb!looj1B3r4-J&ci@4;ZegwU95elC zdyfZ~aco-eQabRgL2M1>rda0i%Ath2@)U@l5K0IeI!*w8;!wdk_T^jNt7U;?qn*KL5}h*pv-a#GPqwF(2`sP7 zj5pLAyKI&?sm~b~ea1THjagmDv3rN3%U?MbzhAzrS@vn9@>Bdubtn#>IDOP?NV(%> zN8`j!f2>KrJMFZBe!-%$5#!-m@7s3t6PDe_H6(C$bu&~}o>Nt16m8JR{No};^w zU%0|P_~U!Lu7CGBZZDWNc7yVJ<+PcE=viKU$5&ZzW^DBH%Y+AMG7@q;F65vtc64I| zPF3E?oHm^IjPDn?Ww9uha{r-~+#u|2$YA{4f}(Us_!XugO~d>1g0?22GY-XOpL!1wu?Wsid*2W%*&15+0DusJ$UUAUHb9$+k7R8qjes68@s zU9ipUBOGvlRC^k2?ml?gOJ_&Rz>lwf1x(Fd6wyvG<4?I`!SYoxtG*3xLy z7&XMoUA|AqeLMM{zTH^koJ8y%ou-00Wzo#jOglrFCid)O=US-HOsqC9pqp4Y`J%yD+2GRGVy`{~*IwLt5t38gb zK2g@Ty3tU5g)-`7g3RjoNCP|yqok_Wv)b&=w0Xz;JE~61vgyP_a2J?;T+bI72x%*8 zE!3#yR28(`gGj!eU4;^Fy`I@^Ly2j*-E2n z&~w46X|?2UgT6Nj*6ymcS@zVfJ9=d|(;$Y<9m{Rdxfgwl>{@5{DZb$0kp2ZR;I{=# zfYySAM&Td?D_|xT-zh%@w=e{m-i>MZt*mZaQUcmMpy#Q76^`{9t#ps+XAGe}LB&!S z_KbqI@`FTj#)W+k0E%ucdmYyWu8YIEMg)6Sk@9V(=-PkfRLyz^)-W#r0E@VHO5}$j zv_6ZpdCr~!(@?|+`!*jBTg2tTQ51zRC`H}TlGsv^Zj2}6pTByv=uIDM+3gxe%K>%H zZ%6K!BJ+P_$W^pu8rH8myx>bVZUd_3;}hW~A~QokT0l4LPJGgJ99r1AdZ!4)Z{ysw zj*8M2iqx3FN%Y!jkmpFLNVBYIz{c>x32bB51{J2yr5kCr`Kv$`sSA}aV%mTa1+m~k z_$oR&)cw6SS?vt-i!15PYKEuU4cNW+L7WJ|(0irYR?DQUwS^ly+WIznfzEw5GT|fi zV7PRqJy{(PcZJCMRcKkCM@YK;v|ZXe?>6t*mgNk)ghyCAGbfo+lZlq5(|b-K8fJ1= zKxR3j1>a((;wo%_!W3>-6f2=!0S1Hu!5vt0EpOmn)7C9D$v#v* z*;R&{jaO7-y+^dTn4RF{;IucDZcf@XR^LgVH?2%#P6@n!Vly8t>y^B}wP~wSW{3{5 z+4u||?(#=hz!l{5yZ->m5TrW(rl{i-Nv`)$*}~OToh=(n_crT0u`UKGjFFfvZgDJsYR2Zm{VpVxted z9w6>3P5CI(_B|#jXr}qa3Y}NT7k|h6Mr)JaM|6FfEgF8N-Twe_xG;E}-S7&_WwY3< z?XuYzDbrwp(SRDU)#K?ms-_%DZq(JERu%3F`Gt7zQh2OU;-E$|NfnxmktwP>3704IJpdl2O7`Zwxzh~32=P1)(y413&UPT;hKpJQpL z%44F#3)XP&RC_C&8YH1nr3WzYK!cZMwB+STK3N@I>N-%VSnU-@*|5975~ygMAy|=4 znZUuAA2mZjTdQNyY!Wd%JONftPSv!q)OA4EBxN}m?o>1d7g5?h=5fj+1^EiV%LklY zCD%dBt7VHt+32$C7~Y$BWh3CNHq8-1)QvZ@0%q)Cf#Kerr?hh|J62wByBH1g-w5)O ziz+?zsgfPUfx0`>c|~ZaMA4?k!Ja$Jr|F#_@CD#5K%&(=_Pa5=qK)J}dI2 zxVGS^K<bX$rH4zx`MPN|$5~WH2;&`TtRa$O{Dv%(->_=T((EiefDgt-| z-l;|0Jr!7RftnZ@C>Mf_Le|K|HlvA!wG#yb4qEM4waU!~;9RnC?8 z#X&0R;;L2+e#$tZ#QCzXeBjyGBk_V&hY=a86FYBZ3_ei*GzSRy-BcGlC88S3(U?p+H;Jc)C1O zTITeQ^-fP>I=3dW8+F*NmJk-mg|f#S6Idlv9UnySLZkX^cqjErq+~R38tpBXpA^Ot zz<_kgM3aoDS8+mADCS_LN}cMhIeyl74~lgsF|F?kmtw0>hi0~}0B>G#jnWp?oA5w_ zFxPdyjo6qg%^KHUYn9rAbgR*rgdEbJ)GCJUb-JZeb$N$i0Ql;Fh8)RL!AV{^<5Tx| zg=u{UwT92brHRklsb$!-xpQpqEmZ9f*-K}4v01CyDoN`!7?kRcWg$|q%~_rgSJOSD zW8SaT2N1TyFRzLf0){(*PXiW?3W+2%9m8E!hDa4ERGo9L4gA`Z9?+Tu2vqPLi%f#+ zE55g_884cC5Uz$c>kd;r>d{uv`xtAWk%{(Y`<9L+)SBbGdS^27*^xWZVcrv|uyt0* zyDU^4_^NF!bRBj2s+B9RzunIsg3w`r_omipWR*gz9x&`7X^-sAj_;b$qUI+&6=*N$ zWeU>hq}#kzh0b$ZJUa{paBfDI1=JVZnDFs=x~pUm$aAGMIOK&lZ(9^a*GCR*tEdNh zbbtb~L7D7YLW!?Puq!L+G4VK}Z*^6-M%CB~m$2R3v}+AIEMwg+10Kjk;8R-G2yUxU zBAm5SFLOb6JOLOhr&Um1_&LE*tQm%Z`p=- zs|`(?oqGtydBbYbhZ#Ay=2dG*6$-Od6%ZJ6p=~NeUi1}Uz*Nr^!fwZ5s3ax{%^u_* z7!({2W2w|DOW{qYy;wxF%BxNHWrGl{7FU*+Mn2V}Z#Cte$QW7XjCv@93rLpYjYxbU z>iZLWl|HXxfS$)R0yn9~3SrMwsq7Ex;N?V;GR4qv<#_z~Z*R0ZhpwGMi10ah>87 zI(GypTh{bDlq>?g74@}l^?iuFi=cNQQMiVto$2puSgA0UridMp<9fXaJqK_wi@TRV z??tCQa-@1E2@s!6j&uZQ!}=vW-E16H_U!;(xccCPDOfAb3jY8ETvVb_a>VAKlD2ZL zun^Qh8LOn6N@#Rlgc`9OkckP%M)k^`R%y;n=?ZMB#v41x=|P*P+nC?@tp}!^ZLVq5 z-XwT^Lcv60(yyObO6VTsSmBPTK$29b=edn`Xj3dQ+*R1Z6$fX zRV?n!uziR66khw+cP}bdX4T~AtnRZN9`Qdg7b0zSDn7{Ly|8_N{{RhGYZx3A^OJE5s)x8mCqeK{z8ljrP$pA@iRh|xk?c~m-9w}5GfTzlZ0OaD?jKwH zhaU-4t9ivSQqJL0o3RcAK?}-Wn5617^feQC^Lg>Ra33|uEge&#Rl}o9e0Te~zB=X( z3i2pene*z$>)Qc#xVSsv%qj3UQta7%|OX zIRyv^)_AOUAixu!7-o1T#@<8=4LU6TVZ( z6!H4aZJBx*(kko7;IKQ8YoP%+E2n-67(3LR*dgD{D7#ah#`TqZZ5uruv+_^n=7FbB zQmp4P@rf8*j>u7DqeLb)?z|R7cXQ=Rm3Z&Pba&vco!F-sAnI#mUR9bN z*mgLkvkr)b8<1M1Mc;Ivh94EmBTE4ztaI0a$6PE`O2(Y@W)Ra9 zWHsXH@8iK!wlc3!gY8Dp*5GsQ#Xitm5Zu!$myDrF=1!?nq^r=mLuh3!5niLS40L-$ zEisL(x!Z#BA){(Cm9tAcVN&fe{#hse$R5u;=unGPdM)~@lW>)5(wZX2XQXtkRySxc zzZm-!p54jIYp&UAu=h3Oe27#iQKCqtmyG;MCTlmDD3OwtJT(nO6{Kv&)j`w_PF9~L zv@KOj>Qs{K%sFyvLRq;#qM4&?y;kGmP9+Y}DpaZF!YxIr4>TQk9F?KWr$O(kVW3Go z0L^KhRoe8{m8+y`IvbTX?rR5B4`zMqle$i&T`@=(xIu159B{!{n{tq0%m5euXw+Q_ z@|o8N1sdGI<*;sO4a2v}m3c@-5U!{^{{ShvSm=&MTPrgM)NaYXH4Wc@GMdL+GQ5)L zmuX&C3h%|XVYNTxi@)nFKE-AR2|LumlwPG`qE*!#$WWka1NAKGg&NAoHRZyik0)%j z2d!um>|_41PNN}t2+@@GHtisDea3qw$K(5zpAQ8$mDyK!pcUR^ez1*xTIm<)D=WvV zU*^ZE)L%}{$KPv%uV4>Jzv3IGa`GDS`4-eaZNDS;GBtTe(T7R$ zQqfIM#Gq08bGB0RsU90}BcQ2L=TM z0{{R400I#M1QH=J1wl~;5ECLYVR3NKzDqcx_jjuQzJG-KzUga4PVaSAvkF zf9w`objWk+YEOYz1Yu#ZIxiUWHNvvdvp8{@4_Dnb$)oPcrTjm1ELu6VjY^cG_de>| zXRxx$A3~VNUD5GRiOabZP8jb(!zBs<$9RPc353kkTnLbfgNmp%jcV;*ci^tS-S{iD zJoXUD<5>IcBYla_ezInb#eXDrT*#h){C4yljE&Rz0>2Z z7m(|>9oU)1Fy=T7-2!{e=0 z({?JFMm3}p0wti76`#t4-p7Ns39=m8#JZF&6(o6+caoT2s-A=v6Ii?76 z>5O{a-;$yDS-U$`7TRpqVD>ynBBdxJ{pry;{!{qre>(ok_iz4J`04)uI{wQyY(Mm){{YEP`PP!$?v>H3s_SC_;BbB; z3}aO5*(-)*N6+lIb}RSZ8@HdIRtMsk*14SHACjp2o6qVX!Bt!iNE{Kwr??X#3``)` z5jRh3eyf9bxO-dmPGg!mBzAnK(84q3#_$qhJ(nY$Hta!JuoUW!BI=#yII-dFz=fi; z)q+OTYoNCY&)Vf<2U7n4iT4|jr=n$sA13T8c)6orVD@K~q-c<2Q(NI&9bYFRNMCW=HeKV&UQtK@)i31Yz zh7x&P=dm|U>GKn5IsV=Qi~C&Xu~O37Sa)(c-oX}&OFjq(jgE=CbngDQPY=7ggtz4h3zJ%cb6Fvd-M|k;=hVWGX z09F-7To=o_zUb7Wt;4l&w7uclxOzVD?M<}V^}J+z&^CW$pW;6yG__vrc|q&~A=v)I zzKFTE?_78L9rQ)*Cy?X&hv={DVeD7lGGXretIsDEp6{w6uBIR1{$vGrWlZ*ukt&Tp z%xS0~;qleek{p5KT7S(9y+G!%7zD~MaV2n141gszo3bjiTn*)Uy4nv=QqOU{h`F#s zS{pk(AyA`vw4Ur&0`MhpFF7s^!vcmB#HX^I;#dYL^KfIO z4NP_)lDx_U0f0}hdao0bJ5_>>N7|}7w3g!^>XRK%t>PUV`{&b)Oe$22n8s7F7f3@0 zfs!qkUyMR^;?#C)R<0LMd!?FZol?r3A8HacucZ_K0z|gTUdF^Ss(ch#OoDo z;ot9_U+eyeSPk2kJ5TlTlKmR#iZ#=s2tUwmDTiB`3i_@jp5@zqNPct>>v!jYTq}@j%4qjPR>wTIiS|S z?NzCUJ;R)*Q{(Wh{orRDVN;|o!gC7_3bV_xCk=_zSng8+o@L~=aCt4+$qUKs?c}s} zHA6tm4#h3^mHJ>};ogl)GjT8RH0*r_Z7HvpC8dO*-^(9x4*~qD$M)!8+iiOHU_m;k*fi?5QuXeSp3JR z9MzPNXEj*3fT{6MTC-H7>X!k_xJtL5%y1avp55t3)3cU3Rfq;uhU_Y*DaUD3F2y#p zFL42Z(mu)c8CH{=-B6^LVvTBH#8jym<;~cQY8h~!{{Se~pmF1N9!?k|Ql0Kgvl^Yv zhuJpkoOp!dHer_4k$2^E@^jRtt{gxy+pivO^?J}w0i&$*P7(cKQsD@IS}{Kp&c8JB zUfh3Y?~lnA*7v&`_V82a)O!m_agiBE%j~LX%CEjJ6L>~rvo3Sn%$s6+HlN=6j|XbA zFba&0Zp7IGC3&rIy@ILw=eT4~%hV2P&s&0Yj}n|&PzD2%G+<_|v}#!@I;bSx1a%WC z)ce@;?;Yw|A4yiT8(S$l;MepSp07;KSXw*^wXoP#pj{`WI0m@CYHdbIBq~GuyXR|B z6v5|Q5u5+VhDj)1K^w)7vDsGQR(I0#Lu1|? zR<**Uaa(vy7V08(&oX|O(UfZoHA<}xD@^WQhLI+{fLy9}WbeN?R_g_`M%rCtw^KB# zw>G#zPP5l$FJT==c-gDA&f8gU<+;V7+OGf!9YBuNN|j3WTSkby_m}`{Cm@{HF~yI- zj1Qj9Sm{P@679v4?)sOE}gl=8#kt2kdR179+Ipfd}E z!A`W*##@(1h)%6r5d#kxV2yh~oIuBCexz$xB=P?E^y>)MoE=wYzTdDywHFilg~L`e zwsKdgVS}^S?Yy6|ZNkn$aO&BXJ5VPk(*FRrKBU)Hjw?XR+Br$)?oZ(jE3PdPBMCaN zj~xivtu7?U7<<2PsoAU3fbw-@-rcItNzLH);p3?>?lk)qaZ%9V=!w<$8xYIX3LDZPC`+c0VE_*2-6SQC9fC%ix=}2edF4 z;L!>C4@K0`RrIx~)rCjZtOJ

MSh9tgGzEgOIb}c2NYtX4$)lQLZnYEuyuJ&XeNIJ+7zS9l`P_K3OspiyP z=Yk$}&a`Op@18$i1K_W|Ahd-bG>x(HRa)TbJ5_u4+*w$5XPJJITxDb75dTJsLowgiP*JpxU}Jy%Jv$67+ivf48dl2c8=F2# z-GB8SIghi|+N~ziYq;AlaFdPcndh8WmRdthz0hEsbGymx)T|q+(-s!hG#(F>8_vGQ zyoaA{w}HC+c};?>ntIV?u?rAm9df9w#}UV4@R&1`u89O3leb@CE@@?jw4%_yI;*`TUebZ?hD z-m=#`B`bu7QhURTgQr#?wOVw(kEGi*O17&lPbId~szsidr}<9692m>)Y;myS;fd8l zL0hygk+VM4Yo_XUi)|9dGNWI@fZ}*#bepj-FG1rTb@+){wu@aF`ZQh9=J=%1?9>lD zFn%U#7h+8EOL7=_l9f2H&7}W4VSz0k4PvEBgB*&DO10Z%hNI>I0f zMlz^gAXJQr_?S)oUt+KI_#x^JP1n+jJg+dV&u)`TZerfuA)>05IA%SU4UQVZ&>xIj zn9>>~+cd3DC9g6tQr`r|NmW)|vy9WAz-)@{sE;9LIyRrtTDxeoPiw_5a-srK7- zLsqRrE_1Ug>vkhervuQ70n1vrXAORpxi_UaGU04-rCcLgyM(*Ae?%KQehT3lyU=gE z2YR~LkCMp!)z+XIILh;OqgtGCiZ!W>ClqZBi2->@iG^fvG+^dQ_>_N8+2&QU?f80& zlXFKjc}c8u@Ceg%!Yy{sR-|!fN(PsczV|9{=s@6&Mz=I;QyHgPST*)4mY~O7iC$1| zU4$(a3$E%^>eY0K)UMWZVhZ3Y7QxS@8#zYI()+}rNs|aurq<=-tx&)Ylkq6JXo0dm z3bDdDkEpo~alCm-n8NtXDHA%>&N~yh*3UgROWiaAHgeNhr5{)NBtgt)uIZajETGw0> zVNiLgNEe7cGUi&7VB)m^qhiH$tTRFvH;HbXJ~CBt>^`F9wQ5I{sSy`WwE`i(A0HJFnC|*YhLZ!h{F7Mj z6kuZ+?1fYS@&}^3b+R@67CabQpe;~}b^=1H$ls@lVt**91WZI2Swt)jwD`P%yElRr z8+^O(@RhC)eT^F{-{U^hKPI!|m zR4^dYKdLjg$9gfe_~=k4C5a0Xp#V+_6b(qXV#8W+C^*5Vs}uY%xIp%vWAar`8x4o! z>Mm5+07jEZjF*#77#&N2eq$9Hj{W18qc9j82F1d@A;Ym=8&-KEf_kr%Y&+1Yn0Qqg zLJ7w4J4{DxDcYh@7$KhbLWPE(Az`usEY{re#9JYKKOoDmPJ0d)+tFolT>SheitS!`u~D2Qo(8`dqM| zP`S4V*D3(s$9tQ41WE|3klvh8R9kuQb`@Tk$+#!etHOXIw`u6+^%{!6PYT)bg0vg# z!Bf2k_l(sR@v+#gfDC#4Mo7tUj>zJ;eW7yQb*aF#!QQ3IPR#kb_pi0NmBX}UiZzVn zm_wQ!w|+OQ{{XD&RWZdo3XpaWpQzNySsvC9;)@(vA*Dspin7~jn&y!lnVIl2)UD3E z@<4&=fWeTQ;^QZJfCjEAvsl-0H^@-BQ9;;ZxK_*zP%^1U2Ht_ami7vl>u}lhS0WE` zxYx9Y2~EonP^hTXx^YzNyV)y+d%(PJ}V^aOf^MREkK zONDz}Ag&$+5T5(T4^n3=D>a?fi44P9t4Oq6sfrbulH*^OWT|qI&woAWL@HQPZ0rg{ zxj6I*O`}-*G17jCqUgGgJMx(Ed!Q%QZQeGtUr&d05$yc^M(yPgB&L8uCS8JiuNn0= z7<8=|`F;GbR;G%aoM!}V`~_g<2x-9ll{y?it2O{eWT89392Yw1LeENMG$DrcZ)Cam zhG&?46>$R&bU-!3qaVMh$qQPOty~V{H4sOs)8&O><5fKh(}S=@?1-t7v(#jZrCQ*` zZA8i5JKE9S*Mh}KSglA&$#71Xb_vwtk%a79P_sEbs;uy0RDN$~$JDNgytr;TWzu3X z9w)gq?0+Q6xC5Yg%?9mPHX;c13Uhoy(bX93+ z8q?>49VHM!$9@zjS>~{v=qNP?YzQ>YI4sTMk2R4^)`ab?iyiNbO!qu9qb_9W^}VdZ2Id2Dp5l{il`rDCp>DTQ%x zZq%+h3U5~*8Lk7~81v)(5nzZos&;0F@mtb<>bv;K&YH4$zJ91w;({Ts7izRPcCG=x z;JmZEb{~`|w6m1Z{&t*u57eP(rcKgd>~;sgdL;(PltCNk1t=`DLwp!AnCDzKy1Euj z!vxm8_2?6~U(H@^(|8b9v)8``1}mXmS5?#o^nkB`uRP?7z}CE_zQcQQ@z)9UoJ`M; z8wxcxWP_fvq9F}$L{OYw8n;IiH&tR ziMnSw+dZH<3D%(#Nw7Bf!@U}gCm$aV{E>8YbNG(rZB23fxu}0*?{g%rA@<()xn9DaeB;lAChaY4^yvZ;ONt|Hz&_%&*D2% zx%Q8W{5G^Xnr+k@lbJn+K5KRsX0Td0oCxg*or+4&61oa_4{h3lM`&J5!HpLdbYeRU z_d@>i%)oy}2eAE6v{H8w*d30;`mE7c8jB945t<%piNOkwZbeh&Dox{0jYu_JP_PJ; zLx7UFY7HD?Db|8{0tb&7r#zlfpB^<7;s-GC<5J<8{{R!d zKz0@6^fRe75A7N5$aX8oA%b9TZx_1IZZi?z@>oJ73|xA=2~Kfg4~z+eJo$I}o{XT~ zDM9)qy6efkNdDNu@9zvcVOFzMv%Ju?G0l5$I2^~pejMnE%&SvNS8c|Tb-d$h-KD*k zpG~J1p5V3bO6gLiPQ+o@I7sbW13$tgof&om9G;C)o8G1d*S1)c|}k-usnF$olv`!e0b(ph{rD;HZB-E z{#?BCW&Y!bdbwTMkxX`;{5y&?s0>}l{{U7$ZosdTf{8)6ZwXU%I;T=-o=PdPT8AX?aHJJ-FsG)-P0Xq@?8~6f*VYC0Ihb1 z+G?7WOqA$H&l4yVVZt4VTm?Vy$!A7ghYrR4;kzHvf$zh;aLpJyih1zgIm9Nm_DHqE zQs!20cw9Dp7X zs#-DTS4exOSE)*sc%f8;D@aa!qIbwpeBib37$O{v2740TjJq;dYd2&2kJG(y&B^l9 z&w?1>n}CG(@viMus=AjMm?zb9j~LI78kQp*ym;1w+IceL&GSD}gDR1!gS7oVC{m-F zxaan<`*$nHER+(i$_)xOtW=0a;4U%C1;LMN6+~iKw>&BSnx{d+Z%!QGPsv#9jTEU> zXj{I}RCGR-;cVg?Xcwbnq|A2uiNk!I;8o-tuX(Ve%;#7s*}W=f0=OX4H2A*`#m8=V z^nDR{I3VGW$Dsz)=5KnrL~{83KTNxo^B62#njSJyI)LavZwSdshbS7*jY>C~Zn!yU zYexa5to5P|;5qRkdzOzAWNhmCuf?h$*({ag5a*8IeMI^j$Tb>%C^=x^ z1!{qUmugpJpdke(Qj&8-p(Q}ftg_yP3l%FhqM+#-MCyA!Ay{4g+CONo#aI6T$}G)4 z^$-2Nh85KwY4Z=8k_#0uudB*bYu+k745r;MBo36@F>t&HDfEj3kW)c-7y}&md{Bd~ zAsEzUWs=0^pzp%EuB)o*&^BjO()1%M&7a*etR`p zjp+0ml;DHm3Wz(+yRkv@nlCsvYO`pKDQv4ySZTS}3>ekctLU9OW@YO1Ol>W_3Gb-s zzw}K2F!QKUDizY91qwDJydqYOtSt3~VVG2RVN#7e8xg8P)7ndb91E+jzObuAa6Dd@`!EVRVyaoXdV@u^!Z zSF}}To1nqZD9;sac&TZ7#zf8uyq(|`)pbHU#HrqxO{!ax;mjg&#Y&$(RQfse5TGln z;<~Pth*D5`zJwK$g{fUvR^jw>bcX2YHT;@qgg?2D#t?ASw|}G#j@;EoHP>Hg{Gt2O zUHl-boL3g?RE6bq4g1KIJMxM1*rj2698z1Dp7JS-<2xxM9Q2HK75}`9<3YFuN8TI7*!vn zZ7kbNcQ`9GKssuVdu5rojW-Zu933Ap6X`ma5!sCTb*Cv(6z@-- zJyiO{kX#LhW!|e<+wWNKaXdB9Y?m_df&!PA!A`h9ER`!7C6t$XtEX;2sS;^{XX;a3>#_T#tPjG*cT$jz=5k@pek zdf#>|CpbUrsvquQEw?>NB~}UPt`#3Ovf!db#SjSvvn}IdJ2DV3FU9&q{rKu91gR~6 zJ4hdXKNgSG82nm4RAZ_=gBQ2ijL86l$ctMXy~7$0vmCz61fH=M3DV>aX4vJ0gs+7` zZIvYIJcau4FEXqHP{6scx|HT5R;!X#5|ke6YGlj$N1LPpYjqh{x-4vgqwSD{x?VdMoumJFpd0#uk6MD0A?{i zlaY&l%;A2k+In&RIK=fPNA_b)vWe?Vf%c4PwopB4aDPi5rN&_l!ZqIol+@vDmDs3p{&0AbQ(2i zE^CW@me3+f7kWEe=MYPX2^Jma3@KWuwAntAoqk}osj{me6lE7W4Q+>3!%1+c6s@(W zr!qmZliP+9l?YJGwF_R&WH%S?!jRK`EgB13DF@AmvZqI!&PV+iZrLJn zsaac9#nf(W3P;7ev`an(QH*NfR$TWf5TEhQ=) z=}@s6VJ)Ew2u+LlX zu!(1Oh3HQOu>Q^L_R!a5?Gj#(0Ui))mc=ECgw_l37?$%TPgy`~k)K{ae{9$N{%8LH zZ;#*mHU9v9ng0OW;mNaVyFT1jau=4<^4?kyrGym*_es64%J^+;?R7QeI)LgF#U8Zs zN=ORw8_?=54!CiN9|$yt9%)4mG`cNtEeagcpj*fMBT&E970>?wiyHhR(SOvnv;P2> zkN8KUf2iwU`Z50i2^6386>I+hMnB;ilm4Ns{{ZR77s4el{{YxEpX|ggiMBNPD3xWj zflQYbPO=ldQjqhhUQ?G|Bw<-LoFOLm@x(62&WOVoPSV9fvjU|lx8J|g@>8kr#UEzs z^EQTUYN7(f>Q?2LO^0N3c8F>86&$x2>~tF96q!ytDY_+D=3+l1jqZwNsu@99?9mGJ z;uFo^H-sv#o?7RCMkD@Zzvz6yzwg_N1nazbI=guR%jCWRu)0p3%t%Xo1!xu{u}3fl z*h*hs_0fFGuov|VEn0A-oq1{BhXi^Zeq(K|Xc8hqjHX=)Sx)hww^F>O+7gj`SnTH1 zgWce!lzoYF2#W1KuTERpgmqPE%7(-4q-NY9?M8AgLVIuzcn9VL_X2UgRCl8j{0rzU zx{Z3P9sZ0ZJI5Q{xE$cNx?0KypMR#u6||^p;Hs*$?9TRd;y%EM{{S25Pznlm8cIk65UH(#2sj=LXJ?vZM-8M+rzPhS{gfLvLVAOTOZFTe zlbyb&MR27DmQA$_xG+7(JBIIYjqZRnn-HeA&VwbWoD^&Snog}8IR+1CE zfY#v!CfR|q305mT7h$2eVQi%yuLJh7ap_fg>OhrF;cs2Yb5Nc=4aO+UJF<~{4=-kX zD^Zvr$x5SD3RdTXQnKDu*doVyW2n=!66GD8c7(WvkdXRC+}~y#D#(MTT}PkeG96)s z$YrN@FD5jGc?^jU;XWNK&{xW*Ku?{1CVXx>9m^Fj>$A7Fi z^Qh=Md3RyYsE_F@;(zmN`!MZdku5QcjJFeZ!)&ejVm&tYl3yh`Q1Sz476cNjoJp7< zRi3U%Oa#WNZd!CAkkjA2WyEVT1L`9)$wCKS`GvHIisEH9$eT?u1c;3^my|=9-V1CD zs_R{%NeQLKytv@Hz`>u%{v|vT~v32%4tvx zlT{N6_j{mIyUUXIJo(#MEDuY~kG~vK;V0`#WPSK_s;f;;${-VY(X<^stDd$F^J^#( z?vC2EH7f+_ml9lanC#Nne}C|!8fN*GwgigK&5gpAEFWj0w2n0PX1McV-S5IAYM$@` zl5JX;;!)1|6AiZc-?sP`+PXVw8Vg9wIo`s<8I`p()ttF_6#B)v9u%h;e`F1i5)d~~ zs%jP-t-EU<;kS=x4JxvK@^StXmb-Gb9;f!Hv5bw&sB83TGSWSF0~`ygyY*?#f4oK) z&?uWrJ9Ta5;tYNec@<}PVvFE?qp47OA#OaHJc#cLy0`a@uX`0`qrM3(S$EL(V(QPk zTH+-qHwLw9=$rl6r;j}U0QNOvH|84ths+R=qMP|b*B;z1RL2&ktb`$?B{}on$1g5; zcBw5-L5ki`{D})|c7ju6ft6=nc>#qcomNcZ+Hw+7R&o|%iIu|sv`_#Nb~M6IDyVk~qQP=bxpTx_T-o^G~> z6WD%R?h0*siL;|~PfIO5BBakrdTp93R@KT;WFe_ z9ZvaerP&t=VGBx%y1ed1jvR{C&R5@UJ5e5hm(xyQ4ujFRvTCZzrPyamkdvwonu2tr zMR#O2h6@!L)$~i2KL%Jkw@I!!4K z%!5v;muI#Lp{iVMGO?evD!EO@DXEtsnBh|CO)Gq@-ItrBs^wmcM0L89C8d!wc%;Z| zgzqCM2+gl)#AE)B&-G*G4f=lkLQ6_gLvKjl^^tJfVSGLQY&h$ZBL$fYpBT+adN@Uh z2$nC^`dE3{2#?`Ot-n!rbXLnuH<1YmOKHnx<3=TnB~G2n8S< zr9^MJUjYIP&Ds-S5*TpX(1#8gdFa)a*46UbnNm`9>|aMpl5sJ|A<-SrLN=^GMt~Rj@$qy_{sYob7uBgnl(%D;FH{o?op~8F6IpbiXO4+Kc zt)~5lZ7hmz&^0mU>98R;E}_yJemZnny1b#~r(Rgv%X|{ZmC(Kr;KG`xYL)%mn!MLs z=-Wb2%ylKa+s4X6S&7~!@-MXceg>)Uh+B0@r%N)NsX5aoR4>u1?5fhc=+);!%5yKrwXO8t8>nk-u;@DrvGp`lc6yUgk5iul zESKvDc1lqEM;ug?748Erlr#sBo?2$FCM^fx`GW74Ga_s$Z_1XCEGe};>Kg8h4t4F(?8)GXdFrxwM@Ucs1#;J zLxzVXJIR*J$^h)LNzh*oHzRE8t9i;L4k;$A-IG$LP3be<7h8tX5&|{U>zfsb6wRcm zLNz*~ssf-VsmYPpS{wNUV;!+!m@hTWvXBNPW!i12sOEX88JT{fTsaU^xXzTDH{K6+ z8J!BP0W3O&1jmyx24_c76qzkO8N}z`Il@v;al=S{WA0kDz?{3(reZ>J#U(*GPzG*S z!$LA+-@r>#*zo#7W%`|z9Sa*K~WzF^;{@5Ckj2@3b88M1|rlJa%b3#!S` z<7sJ+C_E!mI#VkNu}gAVb)w3x+@xG%;MjDzXl_ioNS51D9zq{!GS}kVNH#pQz9~y( zDoQ#FX>U2Yw^;#5SIq4h?c0U)air=9bvGESCQOIl+{T2FzFA$4x6tc+HuWj` zte51`CD-G$ICsmTm?FE-A)|pLV|lOY(`UC2ehpweC4ut?N0rxWas#En%q;ibwHO~ubt@Pn$B>d1BE$IZB6_tjoV8e&yd5z#CPd}bEP)KPS~AtQxi_CBmP zRAq(73Q=uMEm`udAQNS2etq9CZ`1eTZmY*9d!kl=pwd=1WP#@Aj*f(7F_xxX;2=1= z+`E50@m6uX>X}rA@m}zPLvh(CLrJ!QDbIgN#>ljVQ@6W4CS<9R`gW!%-Gw*`P@j!i%p6hk1d9JudQpS5f1JRejSFGvRAy;)gyB+oM0xoP@o~Gacs9t8yE= ze0B@4`q-+9r^6$gx4sUkRJwv;wJpuv9S93`KoA zJJFk!lV}=V&ckj*`TM|1SGypL>IaJ2<7I?uuG!U6ot)b=QIt~BS0b8Qc-Hs%(2G0R z)$DJV&xVX`klOl#1K`$dhC8nrBa0QDjqpuYs1|l_VUu$sM}K6=ZU#K4r!IwM#t7>bm@<`nbbq7uX(dBrNPx1l1{z7 zTvUWlgT0JpZN%8Mx6&5{Vn~`0!|l73dWbrN_XPG}HYwW&5;yF^bVnXS5T*DRpqUZs zg-BAoV%7s{bCvYOaaE{n!V9zs+vv2|s!G#eMNvKrWwKMkg58usRgH?fX5*8i?HrjBTcx)gu`-6LV)qao+$jKMe59P+ z`f|1wOGsp zo?{0!E-+Ho0FOs)w!)OI+=nl}68dBr@iRC>d&Wbq1{BItyoNblfj7d{;ddgZeI$+T zG37iNnChH%Fi`_eE*&q3F(dvaI|*g0iyVk<$@uO~faXpaqPlqog|wXUq(IH^4*e3K@x zu@voS|^5wNsPVx#fG7x8?ABun**GC@?Bsowl93&g`&Sz4WG8y1 zS3QHm38$q{QB5r{8%~KVpd^l7S3E>bI-Ju&oXn=7^mfV& zR%!|gmWJ{pM7W>|h7i;lx)w{%(|m~lg=I*-isgmMYr@D6 zZ6pnpK#Ipxo;iXs*Y~az@6K#8(4Q?ZYZk9l2zDya{NU10&zB<(mWkXYD3ZbBn2tG@>_7X@~8UBzjlf9 zVfxfcB=>2|4DLwWkQ9#9G}^e92Wdb!ZVd9er4Ke!5o-BFF@A8IS7-d0)6s~vYHNkq za?zQ!DGEY`j#Z&(S0WCF2X`Tr*j(jx3b4(R=EuKJiP#Br8EmlBml@YGSbb`3r#)o~ z9;`bd^@f;XwYu|)>bBcy%(bh~FozIAkm6FbC~{I%E|NcR-bF%N$tkA@Z6IrOG%N?0 z0gAz9oe`(lg%qW1rS!Qu?uHi7le}3^GvtKg6&9x*OjP!XxX3WUv(Xl-I_j9MpoGyt9MtLkwbupX`Dr|`^wEfcldCGG&td#;mwwQK(N?XgU%W6vvN_CVrv@Szj zYC>5`QF|u(cVlQ@l=2o-<#z45S$Jf3#w#*4#U=6ZS25S7 zY_(3aQ8L>^ZQj*KD@8gQN}`~l3oM@yvzE@Jo?7gauy#I_#X?l*pR>sF+m(jc)>74YGt;Q-T&e}_Y2trgz)gTdZt=?j%@Wq{ld>zN8$yGi(tGy|? z`Bz;*j-!|_R(pLs@j-I2wYx}{{{UgN_UWPmWDg2aoueVzl~v-Tn@GqKw1peywuci5 zkGB=32Eou&;BLWB?DKV03U*CVXSbYAa^cO1MUR86q?;)lXR|H6A@#~beieS1coj5d zHpt6FAxXD0%eM&;ehizUp>ci?S`{f%b30CQAT3KNL!#%VIm~^y3a5M((rM{cN25F* z-HpUM+|_KB(W$uu4X&)-&FsmGwRGlkE;?RRy`EDpCHW}2T(iWaa!V+kId^wrO<{^m zI!{Ue0E{tUtsyGseQ~uE_iKu-p?fDfrM^`u%3zB2MKrde=R!A(C=gpZ zoi$OuDfD=4(u`&)^kuseQ|n@@Ihlyc{HkeL4V1BNB_hYe8Y~z((xTDh1CuVD28*PZK6BfMoaY(uvk8zMZ(Xv!i;?85Pv~^a#6Q`5= z53E3}A_ivdv@>(`If=;gX;En}XteSzCc|AeJ|#Gd>MEmc9df$DgsDs4qOdn9r_1q~ou0fkkmky_|YQ+G(asOSvbwGSy$ZrW~a zlZEg0oGorCD_%(VT9(>E5VEBe+<*WC;al3}P5pBzEups3PHX=F7M|U3b30d%NFiC~ zJe=8k4p#@+i7zH5P{fkOq%6Kw;==QB-@hAGO6W}V%Darzpi~<}Niky6VTJx}Khi&dRon^o zVcJ@tLyt#|Eotb*0z;AuE*8Svl%NVvXx-Z0d_7l%7FUB9w@ZD-T;0Pzl5?#m^$B!ne*LYFn;un|G6D{6_i=Rg)5nF{u>Ij;uE> zY{+iIRV~%U2sET`QZtq1xyWt8JMmDDQYFo#L4>-DhZGcKz;Yr@A;`7~vjM&UkTh6V zZ{R6uK+L;lP_@-=SHVhdgY>fI?bl2pE-O2ULPFPKoXP`LSmB(AL15o{qP`^Xk}R8R zt-Eow(o+qkZ(+)rF|?o~rnsJE;+|xrWxsYdgKk@vVya%zN~g62oD>T^(8F?3+ zHq`m>?c66s>P`HygbV)w3vXr8a8wQLn0hRnJ+CFm8hMVG;9>Q3`i(7I&^v}F2~0e} zT(IIp$WvuNvXO8Vji;!fp%J!bo0eX4$01cll!PIX`8K}1`3xaI^_hm)9p5QDy|_xq zKj6ta_G^@3KU966Fh{5F!@r(h2c%(tQ9sf@fT7+9_hLhJSRo7Pj!I=R8{Wm1-v0o2 zl_c_7PiVrMs>Dq;OlCt%rNoK6jW87D`65y>fO|siY)Yt6X+8*q^0PMxySz$QZVMUTgEk zIjS91ieno+vGh8U&5)BPfskHhNtkr6b%tLQQoj#S)P?+%6IMC8uZBDB_z&ZnLLjM5a zBmV$WJ~9XdD?$j+`f<|J9g!48T2cn8;Wu5df+B=iYrJ`++h0yIy(R-m z$!jU)DOb;%u{b%ZxsQ}1MO(yae*9VaRTYaTnj4Ig4=r6CxZX%xX;!QGRZ)~KFCe5_-i3>OdoyJn)%s)?`!jDQW19 zQaVF`A!RwYnUI}*IBn+Yu1I1^+ze$cw&-Lwm3*UgNJE!ZiZ7-GMHJ|%s!pNJT$y&UQM(yurd?(&DPG3QCpHX19^Fp(DwgnD7zb$o6+(xjR!YrMsfM z9SurEbf2Q^jm*BIQ^& z*=p1KX1ctGgrw8zWEy%T0>i18@5#3v8ukcQs(@z&A)($);@xx$PbJ%N=FSN^K5|u$<{Oa2GGwtuJB^W|lY# zYBgK<%&+)52wQ$bXM39}xs`W!_YjJFblC3vWnJf$e7oZ2?jlcT4qsoJ8JU3%D^Bo$ z)hc|hEV+3uTD&mg7i8_ia+x7D3^*^|FwJ z3*0(FLbC?bYi3Qw{dk#Aeq^^Y$1bMjS#&4^cf4BkIs3aYPiu&7wq~rHt07AnR^Zft zFYLuBlq-!2qX!d|ixsp~H8}qOvzPs1Fg*k23H1H=ck{}^eK=R<$MlXfDA;2tI^{~e zDOVyfY{K>?$IZ_g5%W*dPu-2LKmOMv>^RxA4BLUSvG<&504u@cCl52{*A6KTZvqjz zUh10LfOXv6i4&9%Y*lgwm-OMsV=+~B#EgxuJ3L6sr|oJTBdgoz!|wPn=Z@h*#K{#0 zgGxt@v)kRmQh2Xp*@tAMifk>ymdmH3v=GXe(P&m~l1KpcxnfMk)Rf9&$eA70HI)i& zP~P1*P|QYKx<-eu%MH$vDr3qjS{6dxaX_MBh+NGf#R4-6k(6nO6-33lml>G_ULgr- zYKzhmM(wajxXMD5dGp0NY#3tmV1?dFoqZ#xvK7}_j#7myFt#aAv(dULoLU#rVS{CK zcZHJUNaD@GrOzwj=bcmi7DNYkJLR&_0KCyq8}*AO;OKk#VzB{Xl{GQc?h2l9?-b;H z(n2~a7n zX^K0i+->I7ymC{?S^|)Gx>;y@G{i?pL2+9%IafkcRx=->i2iyE47c5JBZNy z%k+ocjj<>H0A@+{Mg0~inLh)19>r=y(U{N0@$P@t%_{lk%xe z9x2XdP-+@2&x=!URt$GbYhe`kaw&1jmYvjVqa*G)VPo_YiF?UTIEF-bkkDH;Z9-x) zt1B&opzmG|{ny+Eb7&j&%2I8SNI7~=RQCBk+(Juv4bd{;8-;2ekI$orwe=H)-ryy; zM~gZ%CEk10$L{SIl%ZmLB{N$gO4ZE#!)_kl#ScyqbsnWO*r|5>YiC5M+j|?tJhuKH zs1w+Le}PZlak8~em%D>brN6ZuH`|$7QRrX+daDO&GrG+Cc(xIxmwZ_-9w@Tgci%Six z-65Wi0VxOah7@usDQ{jC5twD=hL@eh???bCAz4bh@esKw!dhkhuw{`{{WjL{{TT)rFphdpZ=SG84jX~E?A0AfyL z<_U3}+rgW!3O`$=ILQ5U-xV`-gW)-ub!8`w44w}Z^1o9Ko+}EZ{{Z7ke|)W7uC$+O zPA_z4=n}#G@1H=V{{R%HKb|op@z}zP)-PM}s5cwOGXAT0PF>z_39mcpL9tTd;cb)Jeq zLbF_R1C}1y>g;eNKTj2^1x>UF>Iy@7ayZjmCnj-!HSk(kJP|S;?8%svpO~l9_u=2p ztL(t^;Qnv@>^b#s?8R-*i?vvh(UiEEaUZX&W3mog+P^-1*Ns-$lelTmo^2`2t6uCZ-w zkJmVL%%c7gnzWA-ydb=;sNFojVfEuMOP1(z&AfhFD>AREsBig-!|81Z)+|&z_^W}u zN^j!Yzw0}O!CI~12KxK^aNT$LLzcFm#rp9LsEs`O%QDp4F&ZmzMK3ZILLju0$oc&^ zo~_!K(OZmUZ*r2#Kv_A2vgyB@Uq&i>M28toGA&|M1t)s)Bs%W@0C&REc@u4WPpca| zTyR>Xx>0oQn@2}&QkiXJIh2#4kCZ(adX-9bQ(#Ac;XB*Rv%%9k052?wshUT2zByA+T?#de;yqQ*rQdvI7O4qf!Afa*$z zB=gEW7}X6cLTrb4jk(w?54Qn(m-47-!MyW-2Ye@alIS-;bY)UW8FUN4dSkk=xp(nS zxRh_!rdnFvNXm^uwNb-a-BZQ#v=tDLY?Nn3@&G#(+1v4Y$K8#pEsLk3$q#n;u8!~D zY*JzF{!Z-z6D3(l%!gry)s;s~NNZ;6B0K#Zz|=~UOv-6_TwH?MUa_&d&ZQ?#%vEV~ zTX~7G15u?iH@Ta2wMt5d?SAMHrN<%XJn=LyABG&29;5qW=Z)VZYomKR=JWKS7Ff!Rvn+2w8s^R zZEo{Fok~?n#`Ho~+B>=XF-zJ`oE(=`i!F}_h9iQ@ViU_QDd3ejb!>eRuRKI;y!oX^ zf?wV`w=a5(blJ2id_BC8?8OPH1wFWN8(lq8GBgsG#HfgV{EtMzj(l@$EUve z5GrAiBdx)fR_Uf!WGl3w_j)m0TgI)osn zB*@89tOjG?rKzk&Up; zZYVO6k=}PMD%gnLbOrv!lVp-Fe+Os=9ftGHWL#=w)v~?lQxYXkl7|rL9n>#&Y_9MI zHsQzEZRE8UgyKTQ(wDpqb*|r~+l{MsWCo_mlTD{LPP6`%T31n++#BvyodWS2zFX^U?h(+oYh~$)Xp+m5o9WNAN^+GUb5`iT z=-{FKtK1_|xui5B06FFP5J>l9JI~cBD?VG#sW;cW99k7NGESpA*KvMhd}U0YjFJVz zDM~r6-0@IyL+(7k2q)@4*FM;N#C;hQMG2!Rge*7;tTRy&=qXPtTyLP{?0kycNh&^@nkEac+-t7`oV{T&F zj3*+3c+ypIn=%37P8ZYYbn1ewqGUv2WS=sWFNY^mB1n$v+9RSSbj3mh^C^bn%Rydn zoMs}~jqTm1?oI%pRL=CQcBb)Mwk0cAUVX_k3E6e}BIdR6c~%6CTX~6jZX^E;LBQ6&tF`f`%23 z+Z~~*)R%1KIn=Oy3wMk8*ddC0l6mn=khcfwD>gE))JU4xZkoQFyu5hXuh?7^rOb&v zomTCOsHsI)H&G<}@#bEq(XH`jBglM_{1Z+rbNrEx3VNAMg_R{}YTf#C_h1@@VxJdH zS!rA6dG~4dVc5`w`P=79%2|)OPGXRr6823r#?x%_;QX#nhil25yh&c?!F?SuR+Nr+ zJ@&RJ@v^v;LzNx1?;2Bjidy=rJ#R?I{hHVNX!(f3^W{rDZQ)h8`CAtXx^y7iD);Qb zRje|RW1_TH51827U2&(!%lA69RcO_yuBhefI_Bj_WgfK~VjSp^AR*YWlL2K2aa;K4 zbhgmrI&ocTlS>)vKDUIpJ4X(Xrdx+l3t7PM@NkaG@S6@-BaZX~%W9@?3452jum=*u6_=DbZET$BueS-lW_g=HOY1H`)Yd)ozG5)riMEe5oO95t z$^#F{Lc?})BW=94l&JB;s2(+GPhjVYilxYId^pn#c4jvPahol5g7X~+?9&6Lxo4Lk zvbN)}`$cpc=@ii6x_rYIZmCQ7q1gktp;&&c~~V{;&ExjI+WBVpp+;m1qmu8B#%hM zq#zQdM|mko)RJ2u0fgEvPZpHsc}PXH`aJ#EyxP1N#O3iRJI8o+(Ilk*05=*nSE-&> zLrRF*{U^6S(!l7H3UqGgW;xOx2hN0~{{UNn9H=HbeuN0DvOO1ndVPl%lDQKv&!tIu z^nWC?m)J3tmKtbxHri4>--Mxi5)L+=O6Pc=*zIZZ5=yu1nCeN6q@G%-CjM+}%WKg} zb3R_+idxfeejM{tqW=K4{KR3^4HTzax$m*Vs9J!^mQss=LPp>#4z&_)@i6*VPi;sW z#}@hvsU!Zgch?4-;yo+ zwf_LWw+IPwY?Qc_-5E{t`6o6ks}bCx_Z&(U&6J}*k>ZvgToyOZBly7j09E^L4ho@F z_L6|vApsGqawWk9S_Jq$vA<^CY`E~WI>iQKG7=e_{LPVq)n&-Ntg$klwwoEdRk`$o zhEmA|Ex1u+`8gUQ-yLO*>e&x4`+L^^02tn87Bi#HF-_Tc6y$GW)~YkrRF;;K9c6Of zRCgL`KOS`;NX0HG%*^Kq4y8f0D*bPi);qpE%yB3GK$nvr9`3C4Diq2`#z1%%q6uIh*S8Rk1PWVp7;{GGRuL zw9j=)w)nnFOzyecy+h_B4CtRja2@ZOmf(!IO1&gMnGN0Q+%3&K4q0-GJBLRF~}cw9eji| zgoV1YG)hIYIJF;ExZX6Rtp}2jprny&f(ZDkKT+T6SBUrP?R*H+bm|fP(3=I znBTh_kfo=M4-kuQa-iKoAziq0cI=X+oT^mJt-0d(5;9poW)_5H-6bvujmCj(T?Ib8 zQtAE?szdNSa;qtXy3BV7nY_-VJZ_VfN>>J$qq89=hMvxMRCvqTID&`G2qNH%5PLz! zR>o1?@m3_kj%3Mgw+b3axi@V=O1Eu>xRFW=FU5ew+@RUbj zKV~*~GRsUSz?A1!P=uoEaw1)I#apzJNjS=vcdFAyLY?=c8LU%#@UKOCF+BeOrpiC~ z>iinPANvkR`%75arUZ6YnJjTUw)4EeY4D&LbIHtk;m0E_=A3S-6c*Cdg`o67s9G@q zt!i;wgaWmwt!lQHQkALsfWp^no0R&nH;ka7>EgE)@2J9@j=4~jzIj%1-5L)TyNo#X zHHuA6MeKT5=*}x!@i>I55d?&x5;7-z+iJ{&ETf4jR+k>HnYfnR1hj0cSoW0tppRAx zmQ$2-JzQT~bH6Zsn9zgh#Qy-O{{ZzX!w!bf98wi^AG+2$BK<1b~ejq;-cN+`r|r-Er2ehr!%YS>YeJX+vdc>-zrDF)A$DX zue8L5mg971P*9Z&!CfhA`gKwY&X)Gi_|ChMthTq1gbb zw1lLr-5`Q_XfWpexR35i60(H2%1eM|B_Vmcd10|olGGHH2HV~(1tmks8@r!q#_}x4 zvLkM^ODam%7ua(pUv?+-c?~|MTYa~;P9@UYqB64~%)F17;y2Vk(m#an)L-;*LnNeH zk4@q>8VG6TaG^T61q)9$TXaZ&`55_??!&Fpp-rCdRR-L2CM_n{Iej>+ z7UZ+zYR%*YVI@UT5Rd>qkC>*$!zuJ%1?9Q|LQ0f7Id!$eC!YB!H|+G^916XXLADf> zsY(S!Tt??!%lyopO@-_^`msnQE;I7iK}pM+$z{MfX^OW@Zc8a)3zXuNg(mDJy;jP{ zTg+36dZk5fTsgGK47nl5&di?t2P3a^`X;GIiKUU89Zre_Vm(pEo>bl9IFFQ{HM=n6 zmK$v)aikXuNlG&v!iuwH#DA)Le=PnNn+(H#r#;w_+CvP+RHus#w1JfkrK{S&ei_Ew zR83&0X$CQ(5Q^sVv~S_Tl$8E!;+@sV6FQbAF;$JpO-} zrAg}8rANC83sF*9VHZlZ&f@QtL}4gfR^k^@da2^&g*?KN5Uw1y%c^wK1P>9B7J6cXw!JSBQ|>2xZi$ zZpNufO{_U#xe!>VO^k8iY&z5r91!yNO+2<;EvD+~fIz*mwG_$OZBL0Q#00h) z=2YE^Q|82Pss8c(%()^%EFg1Jt|bH7tQ4kFr#d`{NG^hVx2K2Sg55fp+-~P466=;D zL%L0ezYyQ5*5omIympvjpc{f(%2>yEbIoTkF^_^?<{04c8$n6iY#$1X%|4!oxFytG`4WF(tg0s2)&9Of70#C^8_^n~)nkcFv9%FkHb-s(K? zz2HY%gD=tZ{9605p$GSKVSPDrznb`^>KSlMcK%le<-nf7iA^QorxPVv(mywr=M$Zh z5h(#(B@H|{QnrWEK5=|R-nAX39dVf{OAU}vm7(VMZY@{8i$EjHakuZQBMpAW>B%av zLNjz+#GEq99&K*4-;Hf51!&^(llXd^9+gmzg%9A;u(v-^8sMe`H{`3aZrPUonxA$E zW2P_s^#9hME6T=Tt3d?A#C+`M(g15DOt zQ9sC_VyARu$lV}%a~BWH`do!S5~$k&mZnEnkb+c(+-X`7a&YvTGp;-kQ{$=9T!A@O z;_5b`n%&^0ydw~PQEX*+dXR7x zM6XlkFSU*GTa<&`wj8p-^o)OV_F!Zkx~(hJeu&3f{+x35e(gsL@PRq9&agSX<9q@fz9|Co_V&CJ6uvyJ@_Fq47HCY zGINjRI=CsP!)<}sNBNBY_$aMuP#=oX#MnO_bd#N`bggIH$2y zcB@fIlFN&gGEA46jKp>4UQnV_t+I?mqjbVviB5W3jlQ5(%4J9mwu6*+BTM3YXjoo% zX=x|wq1$}Xwe}m|)G@fI!Hq4lt7Uzpub*)^-qB<|NO+QR8_0|NnvMPV=}4y{s2Mq% zn@L)ml-<0blx1*wvABy}mh)_!rkS*DDr!@1ZSR+7)B5KKPS$MXs7mtZ(U;*EzgbLh zygf-)2Z45ipDo_ls(3Ro2k5yO?5+dq$M$QE{{S{K*=_UTSD53mL(QS~9BZeiPu!o2 zQe_UtaEz!KflgIi5WaWOCjI#N4A)VVWeI%e0Cx-BBh-vJIqjECX(GyYbbO0>Eu?Bt zmG3!NXcE}NPOM0$Om!wBeJO-Cf>&XerAN+=!Pa-xhtx_=SQRv#-H1)w1qdZRVSX)f z8}muQGG?&dyqw^y`VyQG3OmwO^q1nB_v`M#4Ji=Ndl^mF`s>DdG9G-N;~Y}H+;YZ= z$5i91j;=V82df$<-GE`zq_~6pCgDLIoWx)+XlrcK7+4D}XD>d!8v(l~pJyy(ixO_o z$wr4g_c^~PBKG|tFw1o6JZd~ZMY1%MD=qcn?e#AUeq)&y>uE%?(8^uNbS^plx5FL; zksS`kkcG`{w@~ulN*YsbA=7;=n)-auk0@%NP80S1{8Xw`h7l&Fgf`R`oxbf-q`D)q zp52+0FNxHd&QoF4Vxr?L1e7R*--7DYcN|XH&x8o@t75Fn??QS+MjLuOv@1KUwCg}9 zTyob-VQ%c@N%~v7(;8RG;(bu97Com1M2a_r8)u0X8akBf(QhnnZ1PX&;5Sa%DQ_~# z%4wTIg;W|&Q>p{5S@izC5Z2dh)R?1^>NG|4_}^V|m6g%z3c&Ct(9`5S+Y!e^X{bHR ziz6z>vmbcJ_Ta5YARWD$=moG8k`@TK?6}7eDfIsUZ|(|jGJrPK3Q`rJzcic+-%AZ} zq)enob&6lpYx``z7CsKWQ<&Lg8xEC1e`?1U2fD()PuY4pyraq*o z*gE11O@6ZRz1mvzSXQ!?5-*K^FKz9p{ak+3QQfadNwQ=EZH5FJRapZF}|x#etGLTb$E|HWh^DHYks^IrdH{lEumosoBM51xbku_m>~Mb z3mXfuZ>c(jRd$8Uh#k%*6CZl;v$Y#zDl}IO{2NEhPmB}v4&urq(yT#CQf4U)I)%EV z%5@8J!>Z$`IjnnZaT)k)n9~i5NQUg!CPt7AwH+%mkVdx3tTicxW^L5p&XeUOUUBm| zv}M`3Euo3A(aV1o(UnU_)mR|m+H9yxL^R5VL&Y2(E=p9BygD1=i#dmswYSP$Q%z8<|PJ(U8rR@50>K>bltaF)AtE zqw1zhd|uR?7itt`xR%Y)P^b9Zmh#g4el+^Pz(pf!Wk`(I{{W`f)8RPQ9!Po59G~Sd zhPK0Hwj+yk zb=`iAlWb8{wDlHhGMw5?rI#3{T3l3GWU(AmV1`IVw`obt8%YDS+~8?}!-2z&SP4UU zlz9Y;lZ2)%HP+H>cal6x0#B94ue$}!q1qUYmaJTl55^JR7PQ|ltPCV<_RboFgz%M3;_)43K+wP8QcZphg)r2ZTQWXs%-5Mjwihj26B%bUOMDVYJ%WV+V zO~xLQhppqhYXERxt9@{Sv6VMYm_+*JT(M0N_hOuxD2P<|J^OAnH>y3Ed0`tnPBmGS z+O&e0ug*g#=&y#Z5T2^mlVikF-OuK5w!3ECTw2WxEEiiDilZ-597mL!^B6=et!elb zNW}&6+-DqOQ;eIX#+1-J&ysK|4L0L6$W3lwrO}mZ1mtn5scu|{7kG@bpDULcj{DtdNCnlk!?hJN(pJwlMNlT^)N zIl^t_CQBNOB{Y4hmh5D5rq@4hA`m=~w~qBbrQt1Ymdm`@!&X~v7TqkVc^dzeR zG+m>BEBi(@ zN&9}!j>!NIHlGwJm09tiFsI}oE<=GC)EmB5)6GZBopBN!F0C%Qq}6LxSyQA$dMjad zLeB0p9VJC;2n|~?1I#ck1_DsoT8|)+a(zPxTQtSTVPfI=ejyotkP6~H%x|`qx|MGF z@!;hlCz(sGi-dleP7(VV*`{Qj5}B`rx(df>kn+&hzmWR97|N`axP++XLNWw{^pyG= zPpn0E>tQk~lAWBUxXPAuwBLV^m3GoR?IElwxizQ{PH0=9(l1)6lk^t&Bq#LT!kE}? zj|`-elvOr?W=n(e(*>J0KUmhQZQFsDQ|9dS-vBJ;wxI*G<8@CfWUEUsGro2D zLtG|9P-KJ`5ZkjVD^iq_v3&U);~;wR2D?6Vs)b@Njcq(EL}Ai`of{ge*X=&9nYi1C z4z#qCtt4C&kzxqL(&(yTlr2Sl5=u@~DC$E_Cy?`DmS)6cQ-a4xR9Pc>w09#+Hv*Rn zqB4*P0BW^%sm1o3Y7gLdRH8sz)M++U0}_7S_vLWLqsRxq7TTzeE@OYJWw{A&s-yR}*a) zQrYLaTYh&JPkSqa^h&Ul(KeC;l9g+~lIKF6liaA1vaj8XjYoL+w>y>P$(wz{mi@z9 z`?2e`xW8r)lr*x1p=#fSCn5+JNFx6Lb~aTANm`9oTC${EpOV`_>%w|HIc+vY%d&h* zLVlH%ue%%Fp|6MBZ}IVI;Ux_yYmv!4ME?NNDHtPX=!SjNGEI`(B?ws2Dd}o0F@Hpd zJs3zXI|d?>b0nZN(EOEe(u7;NXoT<9z>!mZ+Ka90btzI3*MG_;T?rm`P|g;ab*gty zXk{@eSFP2}zk^%pD$D3`%qlj*?1oF+H&m~$q%42RA`=#Dde(4NwR>4O##X)!itj{( zl%F6*jg=nIarmUX=AbQLEk^qDBL|~|rpYO`P%Jy~ZQ`wd(~Iv0yoWVh_xE5S2wK#1 zvO!Y3-ClSFZ3xZt%^;A!M(dxu0V=zy?@$3Z^8v5C;kH?f^O?<&c8hHr^5Rv7KV;io zE_0~qFR&=IX4~lxbR=eQxi!ud{{Ve(%u05~OQt2ow%Y112-6=3TCKf()snjoX4nW| zq_V1HStuyBMJ4wf%As#C`Kh?aEM>Ns<%6a)7s27S55>>$2s(q??8d>t$IS;UD z?!hr0OUdkI+aUT9d0=$9 z!))!I$~l)ns-Dfg(vjy{>C!T|Jqc2<5l7lcJuHv#e8uz%f=_XYFDkv5SVOrpa&fy~ z)qEuz#VaVwb!&TRt~W(1Dsy?ql;lVW<(m{okpZc$=b9Q*?Y5@lkQ>!bJmYCbZdWAw z4l;i7imTnW&=Sx|)Q30dZJT#E)HlAi5cN_^lbvqe^GjfAq0(k%Y!A$|$rx9JD-@=u zG@QL2BGp{3C=Vd1C2Aj4$1R1%*iDjgz|mcWOz^kv9+_CaBC z9VGUx-A}IgOZB-C=uy?pyNOeZPcgc0g+8_Vu-lyj!qX9B(yEq!h<2hs;>YUaXP#lS zw#wRZkPre8gB@1_$@41;ay;hY(}iR*@(ir6Ok9-~-(|SA;t59?RrJC_btzJjaob~T ze%Lx4RX&>vn#s#$hN8IUK)(GHHTl;pa>2F^nB|UNg=GLi>>}X$jtMOEcMtH9{9m;l zUv@JQ5^;w#d|K3SA#@!jVd=J5YeIf#9m+@+vV~2>$>y zb!*Pe`DjS|=hnYg1bS2$kXRqV#bvgE^Q$L6U&e`u7j}~= z61@AB4b$Ik{aD%xl*P=3?FN}qdY=MX9f+mPT7$dt!#YE#kM zchGa&U!CZ2%LfNcX^yYp^T#pm$6R|x3LP!2Cz@B4Nj{^3ppg;7<;PlE9=6VyDuXgS zw0{<*23`Jl3HIYOn2$wy7s(;K?6?*5n|Z&q92riwWW1$jQl%+xD*kn>-wCEQvotwK zZSv#q$>}Cz>*L{D%FUH2&BBxc%g%7?jU_DwD3;qV$aS_5PHoFu#FLbE4$NxvK&!mD z+uOpNYdMknE}y#%&ynEjqiE_ymeYl|FWR6lm($O>*rmsTM5WNTS(|nGdyj9XT{-+> zAF>9$x}UQa3<(a4alhl$e(;_{(gqXY+GFZu>CzUSj}!~rSqrjHsFQ@bv^8svYK2T5 z<;!?|jr#DBN~T0%#EW!=BYi0PWIJ_xG0z8z-z z=#1#h?5e1UCyGL7N)<#jsDIAF9&qxUjdQ7t(fMw`2&&tGg_E1_sQTc_5z;$mP#^ch88Mzx6YbF;UmE?zfi*<`W= zyUd)Uj*6M+(2e?Eow4NzI6(rBN=o$*bjyYKxB*g4l!QRht|#*{Vj}E#+Yv zOp)}?Lv}+c*&)+DZ5{unB~ts4xUJxo?B(M_iKAQ9dA?puSdSSD5=BOBF@c$(a{$;^6;LZ)Jpf2G@gqg~3eZr4>*#EIA1 zgqql#G=MhIppt7am;|SfG$G?eBy&fQsL%{@|5a~_xEw}3OIf^K$NGLCUtf>@1LO`| zzO=~`MiAWUFu;EEuf{8)Lu~1==627vMn|_*EpM*J%bshE(p1S{)LPyCrE0msjhyB5 zL8Ni`!q>y7aTxpGezp(le8Niw5(lidi`Cp5?*h$F4FqvJ@#L0t(_##Sa{MNZ;Mfa$ zr9>Fc$=S^+h+DLjbK~P-PUoIYI5|%DIW+=5DsgS^J`9WV^KSA*S@1T{Fr|oRd__Raiz}+a20R-zQe+bGQ zrN~B*kz>XF=|;g>fh@_dDju_M3c23hS+eCVp1k0e-%Ja^jW}!wM3k_doDfAMagr9U z!wEvb4~7IiCoS%+zhnMSyTjWPrWluZ$BFeXssHJ#kFAau?F#BzJ***#S^OF7)ZwF$ z0)GAA>SWZj+s>O`Px=~k?s!w!IDeIB}{W=Vykw@{v1o z#)|jQ6A|b(cFG6LX0G6@Zs5k$$V|b!z+5rG4XQ!8a*V0?9Ca?%{sDr*Em$l`!uY?n+|iiKz@{8Wm2zLiiC;r>mV6-@ zIhkn*rD`nJFTpoHLfR!nE#ApKzLGQPAs81^epkEv26~sy`t@fvK@WyY5A1hPwl{XN zDs4gg|+yGo$Q1>xV9XxXWNuE_yFIZB=a%~5W#pz23i>7ru?oN9y|U7 zf%GbW9ukWZ?26ow^ALit0|>QiPHp}!mQxD{Zy9$Q4NV7Wp83ODu`_tfxTvm{NY;%< z=0O9f55Zgw1dCr&+5JjMvlGV$;abYA?i%~vw}<@B>eS*FeR0NdZ!ILc@u%Y85b?TG zS;!?=&yA15gwkpt?S#6x=^935@L#%a%ega#uTs+Il%Pq6cx2&LpBs1wk}s?ku}(9R z?S-KjgaeSIK5O(|uo7+C>2lYYdx+PWB{L2@50~dVhn$Na{&N3BnBK=@k$})nU`DjJ$W(|fP%9OP8Sf@h?O~R^l1>Wz=_&XU-_1m+j;U20QM|*dlP(8 z9pJttXdN}AnxwAsKIp}ZvVm!gVTAmku(~_zD9bf)96mW)c+{&Z*b% z;@Z#^>bT}h8&wPljd%n8%Z{HtBoE1=4VxL?DDX|Gy1}e1wQQ4z7XgJa)xbeQA>W2u z#z%(Htj$v`w7#qy(1qCrz8)>ZthMk+-frA`7bcvgIn0LFO1_}$Y6O7z%L35>qg=rX zA(V;G04t7Dx{5cCzm8lx#xe{~^eE49lkX9zU~K)^=Em~-JB64&N*aWCvo@{0IIKkl zH}%Xp%uY1C0sAAbtJ$pE+Wafha2Fnt?Qqfu*!$Ag59Pl*ALz`x=48E#V68~4rB0xk zn)ml?n%e>*2EPCb2Z41C1d%JLFN+9GCwhvZ1)mQt!L-m)Ed5aC<@f;6Imt1@a5k7b z?-0=xLLe04a{A3eJ!O0l2oSX44q3c_c>jxj2rtShq&4UdQI|X@+{)Uu;d$rI0r54i z$lSo~dz8fkG1zK@udCQKJ`5kMvNG)z3wzKhuSHYDgi{{@bPPpDw>C)%ap$4aAV z%Q~DjEKz#aa#`RLG{h1f`%-#~M=UeXJaGs?&%M9?%dLT>K~`8s zK|z`f?=Nr6b7f*x38EG!Pbcjo3sCNr*R8{kOWrNm@3Hs!VA_1%I0Zow^f|wo&jZZLA;7)F}}I z!Asn*gJ@Ih=_Wep1gqc+7jPnfemKeiX)an(^~v>BRO|w5NkkR%`C^h?cvj9}XjGID zp*{SY@^}9M0H2IwX;)bDkmEgy7kZtJN!*1w#;G3{cVh$G^LRam7{9PbljP z14Q{UDyLKdt=5>}Jn)hUD&;k3_=h-9p_2uvR1?>{9ng}LeJ~k$3FO=FaM*TegzzP? z>NcOW|37Hu#kh(kWN&|x^r6DAn za`W<_l1w4QW&S`BRViJv@>>JExI*G_uUy4~94o3!LmKY&nJUbFw#{XV_kE!|p5`}V zONp#X6;X#c^TeLnJOAeT+E`$Zo1qJmp(4&$OsG~|f2Es&v4!6Z-r z4-bo->E^dpEWs7=PnALcJFE<}gH#Mp+ZeFoT-S)$4ZOYLG}J}Nxp)-3h8UZ!FluG6 zHA7aqM4Xji`3XAtjGR=_TsnEq2j}Ye??0ohK(`)gqKJj`FyR&WVL!bxX$m-kTXl+H z;Z>R{(ncue>v?%5bO@(9b&|z8fs1anBCYl)sEm{aH` zhq_^jzL#+8VPT;mEKOBS-)iH2*r7a2)P+JYIHl0_{n**4jOhjGH(KbKiaTi-MUruu z%}&$jWu8GtX%mBALRz-zg4JnaFiw=jc`Q;IME)Ww5}g=EA2K@}>k=vlX6Jf;7FW}^ z9puAY4YFj{Fs#xWEA}QEe`v0PT@451Yfgs0?!Dt8Dk`!%)QK;VQg;OBfRX~JmSaOQ z{o5at4_P<+0}M5GSFWfwSsqu_sqobXo9XGaa=HVXOquD^vuOG&T|qwk_$`anFUS!{fd0D&s= z2;y!dv5cyn<{tq3#t%1mf2xo`tm23D{ZTjdqbfiGzIYLu4Djoy8HMR2_NWGKBPGo- z8zEIvBU&?D*@Vo$s$z18@o~w7P)3SQ?7$vLY|iVKk$Sa{D}Hqf2Tbmo?zwrW0pspf zWC1#oQ_0PrCyp&Ma6>PdmT7Pax5Fv4k%MT0ajozI)itT_@Tl)&yycX89qOV~CNqk* zvDE|E?)C6fnTU8;h$d#?9C@ZS^G1Xnf7JJ$1L(5-5dq;VnpNbL6mVS_3JN&f!GI=v z2`efVnJ6sM3~I^`ZNpzpR36Q!U|m%5%#bPKbOGrLMExH8az+F?CuurJodQwCI51Lh zl$^Nh2JYRV>7*M{KwVYE?VfXi8~q*KZ&rtDGtOyjcG+I7wKq5+bp&2qO>MlO;}Qi%B$WYYu0|t8`@%aKjnkqT_d4sDpk6 z6zP$bqR_ZT?uPf!sRpL}TiQ|ydl&1~E=uG`ngzp@(Ay-sN>2B1 zrxQ+mj*UhaQ55Cx-)V(P)jCuWGb-rB%}7{l`Ym5}Sg}}0E!J{X|3)?T@k=!`m3rH} zj&lFu*+lq9IQGXIR9CzF^BB|_*X2l|?36M(C?EtL7d&1ZOhD8D4r~a3yPer6CLonG z*1KSSh(dZ=39V9oatPL?%rt;i99$Yp6CYlX7P@{{LBMok-6*mPPZB%p{(3F8%L9GPad+Z^yx-x6 zxd^`2sRjiDC0<<{__M1e+t|Wu9U&z~Xe<&OZNqF}c?)cAgnfkr&QO$Vme*A|8d_J4 zWd``&;+#uUUwmCp1F(5Sui?8SIMsM57>y%n-DdmQ_5gf}Hg#W#ZE7zWpf}JgBQ%ko zc*jJNeAC%P^1d36^M28t^6UJ? z2P0}~&0((%iHQ)B0|~zkUxB&F?EFOPN_`bN;DR#UDr$@l^OE*kRFUE&z~vzIG0B_VTe5?+UnBalfRBY7EzDH< zo>8lYr?{6Cb3FpFHoNY2h3ReOglseMm4d;5);4 z@m6Rg?3^PET3{goyU!s{wXK{sk9xSsve()=aw{hRl@`EgU9IUx$5M^dgXg9rf8NE6 zH%Wz641!3x%kb!s-TJm;K0`t@MkuJL#lfCsBLRii%HPIC<$x=q*_LQMr@ECum+8id zbH^9uYis_}w;s6^Z<@8@ZZx7b zDF*V7ZR+1}`9PF@Ghk?pLd$F@m`bHIjBbXKi7YMAPPPtM_5GMDo(`6koYSRbz&42qEHV-PGVmV zSr;J7!(SeP4>!R_s~}(34#gMm=#r#8P`yk_F05|GhQptl$O0>x)t9bNnm+@9_(8%IF@!@g$;wjzL`hg;ZrAA-B&olo zs+6$;d7i4k@{9S!vzX5BTIT09SdE`r@jI7t!DT!ldL^%@ne1jjl1?TMx8ypoz#&L; zPw{>e`GUgZQ-R30I6d6pK2^;ch;dgzs9(rOAsE4s_h4?rivta`&}v3@eOhsf+gwTM z&7(bfUSjLcUPDb{EeAGuN;$@!@S*$~;}{a35EK0Y-4cq!ZKE1Q6h`u9pg^UDBRu6s zoA{_cBIXl{+wlweUx6C#fZG;gi%ua7+ByKN`USB|UXg7m(q~}qy^)QM?yU zR+QT2I<|&qxHX=I!I0H$+qDB_1A40%6=F2+k})1vR(npJJYjdJL@eWg zhV~`qF?w!ZBh=p3amIT19H22Z8xS2=~^{@%`txK^O5#aIac|F!U-DTVw4Jy{emw ztR}<4H8nh8jq*9p2@UK1QcuuQtvEYbYLtw1p`&_YivyI4WA<4p9@MyANLzMolVzWq zIP7krfnwEA0j4X@xtYg>f2GIa8MI4go4nP}zD*)lzRX9I{BT?IM0}K?N}K`m<8O%H z86R;+ty|rKQZr0ih478pps|=oK1{j_wO7;QFE! zSmKyxcfRma9t3jhw`Y}1-F&I0Vc3)86!bW5f?)BM(-48Byb; zkvy}<${Yz5$ioCxec&0<#@$$pba6A)2pZ01!LAu+@Kt~V*of>CEZ$J-f1&xw&F~^Z z&;Y6isW^XTRXBgwroeD{07~og9%d8xC`k=yg9)I<>C(7mG-9$YM@Fw%OVpvzl`UsY z_GnT^#x*E`dXqb_8bHe*79EqTimozo$T!RxeHlTxEww+4if>C#3(XPvP?ItYx{Pgj zxB+2&6(}m9RxFDH_Y2cy1?(~LGrKygN~*?X1>N=`rQS}%S*JR^Ntn6ovF5{7w$nQ0 zJGA4J1(Youq8wp66fF_9{-ooCMx()%^J$_CwiPApZqF&Pz44)OM?aK*&if|jc$(R{ z`4kT%VcTIv9+?ENWLeNC$UY7=^QX2G1|3q+tfE4efIUel!ri z7Wlby#EqW%4qbDW@wJ&rUOY%L_Pdcfuq0s9C@1EY9)cXvKNkUZF~SLEz8C5@sh2R+ zB~wzX4F?o|XH$*Rfxg6rZ+hIizqRx)g#JA;qPqJzDmncc7y2F&8115-`8Ks>d5!fA zaqtp3-Wa2L<_I$cnM$wPDus`=0zOs7-#H$9vysMJ92!RVl`cY4%>&c4YWVgV`)}b1) zV#w)WDzp(?eK|f<)hh22;aYpGFQwt2ERtOlOoa5y|E|0wjsgRk`* z^z{Dy2e82W%L7$$0rHc!xU#Hf@&Gtm-Y}K(yc05*z&IpLX?i|J#vGNwHILBz``d`? zr3-i&??0H43XI`$aQ#1=B`6dyie19T-2m48s%rN+BXE*N+AiuOEa78RDZb!n>x9zu zca-}@6V;!BgqB@1VF8pVf_!xAGuYnocVFF7`eiKZ6cW+hNlMy^=(Fz1(5 z^I3=WSsi8jZT>dHllao;L?Kt*0TtX8>(mq28I)XB>ih?Q`t7$Nwo}EU&F~bb*BRd& zez4`xs%-I+V$7enmKnI#!^b}+Th_7z4pjZ1ryIsW$moiH&3;lXA`A-iPp_zWzfFc2 z2|XBGDD4^sQ&_vn+bAmtZ2WEtlu)2Nio(1+9labH^kGaoX@Z$-t+gI;iXMADx79#wIB{`@v(@kisL-1^Ng~>v@J-a99KLWNp~P907bv(@PcOSAmw!RNGR@=l*v&PjkRKtT3%**iSwLYE~-~NxS?% z%W@%Wz-DT%S>zi*KFJi*x-i+S=!tj<@><2WtgRyn;*0!jt7;s{S zjt&G~Ee>wN{6r!R)7{o+`Sqhd4)WzXJ_!CN<2E(qs4_i(aLV4~>C3hZzJ{?KM!G|~yAB##p2wwKC0-Ry(mm9ANK_tzAG~7) zG^huRD}1M;moNT^U-!ZG^_4NButM*>@DqU&v=rBxtT_!A*dP#S>}y400WJ`>wil!A z(%%#hy{YxnDYjNuYF z5sS&XN0-svlSl26@pg{yckCnPB>nM-| z$mh_s(eiLUHLRn?V3r(rSv26H!ZN`< z#~aBgl41PW6Q2BSp zXDGcGv}*@NYJL{u91vpWIT;wY%OuK!g^9Gg{*Az%wXkzyp#skWSL##mMq@_E7`+40 zJmC$OLRr+&nF&0$)+!7EBGak)^?UZjs2zlFZ0*P791lRq_ZKkdGid0JF)26^Qf&I2v%owA3$FV zf+y&54A!tvHiESiWA+IG)w@`EHf1@~;(YJ?2P44|FD5vi+&K(?*;bYc4!QofuSr?E z)+W$eKa06piFv4b8RKeC5PtTMS2*<}z@;(zp;YzF@j09P^OiTPdmI35)RIh3n**FV!-@wvBZJPxPC9TctF~ymor)AFb=rHRnf$6T1l*ykd(!c0#S$}rt=<#xS?1NTyK2~$n?aYA5(GDMIMQRqw%T7 z{v_Xnpt&Aou-Z4qk}oY|xb38ERZ=9y%sgWpoToG=4bW^!gTzPc(Rf&xKA?t1L`GMm z3!cW-(8XFrcJ2au#7+~9+!_5Z7i43aSHIC>N~Bg!*3BUOwU0~gG<+SqXP)0C^GPE< zB9m;;=n>Vx>uF{il%}ygERo)c6>H|y6e#q+8o?lNmeTYrujsi8rhe8mvCkayqLW z==(p#4q}2;uE8T#NI^D$FDEMWGkekeJ~zH%Rm+`vGNdP(J=i32cEytlCyMKKgHJF9pN{|T%;M>^@w;4r@b zNGqnhIeeU z$@GDPr<0mvwjVSpP{_pDqQciZHd4*NRWbKh7x&}&#KzJwxDj}gLWJ!bsQmtWvZZ4{ z^;YU#%0=0{dGGTJR4C=O$IdacLrw)PsHDdHs=_t)1nf+51vY_~{Vw1s9jhK&#yaqD zlq4Ds2F~0kqlP!^f!I^AQXuT2`xE>DMI&BKDx2jf0H&hZ2u2YEI$-Oxat{{2fXxxQ z9=N&3N>d7XjU@(_1Zo(6T@JT5KGfs+pRBpB|BWt=isu1A?p{N9I~hi`==iLvNa z{qvJ$))!kIx_o&x*_)J=fT1~pH-=Xr_KoC=mmljBxg1Kjho#m>x&u!(`zL~IB~hiJ5>ZM0dYiNW!_CA&$<2ilo!hTGXp5)92D`^O0UT*6 z{7RpqdIjvg^TDQIv;^jKZ=qBBaIwdW@22s?H86N;ax?W@al44b^VghJZ#um?#f9td zlyi%!E09nfY4X|9%=oK%qD)8l2~y;FxzY2C?8$XfWXUX#MJ?oYXKZOw6Y?=AP9vbo z1{E3g-(8zZCidu725B5!XO9l$vejJ-;W12}gujG>Z^18}AwQrTT2gI#lSdj5@tCX*e^MO5yk|As6G`mPTu48YDPXLmx3Qk&>p2 z=>&KHxV@A?Kj*JJx%d++r4s0Kj227_(_I3Epxz8@!b_2lYAn>l6@5k<@W8rLs8Kk_ zRW~YJBmXI!A2zo#);cP{kq=PpM~kAXwmX8rf#j}uFZ9~CV`3*T99e{k6Qo zBZq8_j$0wLE69LF-ZF+;*6;aXEBTI4YCx2$2{#R&ir(^mnLG`9r)E5sxLREr2iw1x z0Ud?cw)#gVl_Cvo35PdrqhB}eeMXwDN#bwzC+)s1GHHzL*(onUP$C7525v9v;pjPp zaM^hdESUT$m0u!J?5-B|n{(T(@L3tF{Ucg}YiJkz_}7yZ631l8v7o_;LLGVk#6VtT zlehJ=#k*niIFrFvy`T_x(MY!zp^dIwye44AR<8xcLd(yCe^&;h$}E1S(WD2{*eFWm z-6ErC+wUOkB0qP&=|r?V?&+0;koB+Q-^rEYJa})h`s-JNc*SFy=6mH;#3@1FSvHQc z0-%r)7;_N43kuQApN%?+N18-Mi@}2x8Zr3?v?!9sgzYk9l&~dsWT~r-0fZopk9Z@9 znEKbHbyZw_8dQ(`f4A|GXZ3ZuVYciq;T!U0ZzpW+nhHc> zD>|^kl%HKB4Fo`F6ec(C_>Ob=!yXHXS7g<+{cQ}|+l+na{9XQAdQ#YE-^1e+OKRyV z83+DkOs_e*F^aK^&tq!HYO3M(AHW3O&_apsjPj>EU|5~^P_UOWsdt&o zZxOI4Ux?h_yQe<;V9bDrpQ`AL?`h`Wb<}vzB(FEmb0afHxx(2=xkz669k4bXel*%O z#dKWM19?B$wRSr`1kJSl7MIyy`>YfKAC#DL<*wx4(O#wFTM}><^}0~4a~_~8&e!(> z^ep*c?N@rxz{wB!1UaRd+Wt_`_5v07iibWG(OgergETv{wSurGVJ)07@(-Br8$|PwgE~AQ6sC5Xs; zmsw5uio_QGT6PMPqpNz~0}TFQrB8d;LbgtxQRi zD9q#a#U}(x7ax7#XKc(=5cc%ig0+etD38b)egCkMb*3Smj7FtKe`uqvx~494=f$Es zn7%)!w)$}0qr2K;Lru)NQhXx^w^+|syBEoKCqooGQHgTa4Zr1|PYAL#6|)xl-bUh> zKKx6AT7pw!&7`fyT*oazGcREe<%W!`Of{xgdBfM=ztr2GnIWI&bR7mn zGs`|YqFRK`{{RgWm?*c`G|tLpB)(`Qx5?X|>1(i&Y*M>HX={h))_drD7rVc~uKQE1 zhxwE1bmL5aCS&s^lgO3C^s5Mu1gK~a!Bn9-FT+t2t2g>Pl|mSs$LP+T9%K~`+R(Iv zM|$F-7Kj#AJo0k5&X1>GE$y3r3l=bRUKLNoS~^`J4Kc`z6 z!L)qRp#L`Em_2o5Cfe{AbqK>XMkj&4>X0$WXUml(oi7lp}W~!a*WY`wucqPB5(Hj8&O|V)$;xkDVLdv1y z1Pm9u5T>VY6Tb}5=~~0)A%?Qn7_>>$f(smY*P3k@*JWBOvb9RZrwZKo`~x_*5kLD- z!Ha)A#1Ve(wfxFACa2}hx<#_Rixa$%JlGt-hGa0)8&jLbcmS?Zk|ciGzYt3ZM2qkZ zNy1bik;x~`;XP%sJY_j@7;!klb_UqR8u?jvO|R)}KepQ(zb~=)der=qXnjL5BS<~bDnKm8D0OB96}G5w7eegDD0<)$f=_$`(nC<;-nMYiH!j# zzMm)CnMgameiVqSq?@Ibj%JQcAdnpJh<;cuT{C@l|BYPLnsLd}T(tJ+lA8APA)D?? z3+}pI8%QJNs{VM%Bv_Gi3@vO+I@E-F>@mserh2_5RGtEa9J=ts0>haVO z_Tjs4(oER0Z+l#U^SM$t?Y9Ck(3hVp24%|+UCIxER#H02A=h>uo7`=30eY zK2gLvQe2$y2?B~h(9&1y?4u8@da-l_8iiCsD6Zkf1Fv%P;G594>t#JzcaAuV3oYQ@%Dx+S-yjnDQ@JEl0GsW8bFChgva^>>rAc^!a;a$S_pwmGU#Tfr!kx}+^jL}9C>t3u!B zfOjr=dvIXC%#Ymizv7Wd1nKi7{Sk}&tdW>4WNkgOFz=8l&7I3cAF=U5ZBs^o_!wqfnvH5z(Mif0B}&;Hwpki z;ST`BgPQ-(1|~%U0KkHZTYyQS&A4w{^rIdQ0Kk%KEnJRNeW5J>{6_{) zF7?|1pa~_5%I~K-aeWNW=u zH<%Rq2&OqeiUefW5cQ}8@~F(8|FOplcQtp%2TGCP2}9T{|DI|8l3D?gAwW)6S@|8b zAKyCl3ukG(A+Os1ffNM*ApjP=CRz|+Kfp<*`41hctfd^Jg+LbofG`jTiV%S?f-M>? zeB0HP{ULn-5)d7gEbJVX1OSiP1M5K5LCEKz?GG|J0I>cI(*R^UT(=b|2?^zRl_?#N z2><}7&>PT65+D)4k$`~ac6=&e2b4$v0B|h4{iid!f_v7-91y$<0)Y5~ppyU! zFksmC>BfiaN0GY!E(gH5mwge{oXAOV7CXYvfKme;M`JxWQ(+R%% zUuS+mRIK-v+oFWa5QP5G{Cs(lHvsVhP+)+-6V{W96Dh!k^~+>uWi-bJhzt=g3}qPT z&VCyb5Bnms9ZMH&BB}tQlc4>Okpku!u-`wz$8{PfQJN{92ate+K+|ztw7k}dGDg(^ zU`2@W4*h2SpxFR23u&GPK^@Hb9qV?6kss^LQ)VDEW>9*QG0DIx{ZDh&uAQv5dIJlV8U36 zuw+-wJH*|29iB-aGNUD8MWFtmAm$~)KqM+q+xiYlb-jr7hlC@7p}|1-Q3FHY@lPs|C;9CIvg+ZJE6d*~W5DBwGLgpAC2*8>sR3ZYBfc#&2 z3+n&UTfiXyOK$=ExBcJrmVku(8 z_AZ!zoMtVQxKZ*`@{>_1X}UUBjf38k?B21b?PeKboZR|PGO7%sXmq&q?{%%)f}Yzj zjG%FAhfM!?pUJN_^*$nrc;5tVBKs{UGdS+Q1;_{WJ_5ARqk4BL=YerJ=zrsWE_eo) zzs6E8X-;P7Yi_bQ)R@tR-vxkHQCzEtW0?3(Nb6}FmdK@4hHdE06syB9W~(JrE+ej# zigw3wpwpEiEyn!)oT6q1RMs~wv4e09{x{ud$dmg*5~C%6b;wR}iqchqxvay*vw7EYoR@3N|MoOqJ_k_sZbEDBp_Oo=vUy|HFT zl@Tw~$!F~uQmeb7Hp_do>H5y^sT=~^so=XZbGM#j>V*jUnCyXu0B+4LqXO%#`>k83 zi7zP9;Nk#{EGh%MpjOD^DF$q63YOJRPiHQSUg$>%?E5JN7|gH5Hmn6VDhnfMO6S+W zzxcG+?ca)t?aMfg$ao};Axqj=1F*h3*UdoGQ?Gcxnc?*t{iKkF4yG9oQ5Bzu4j)!E z%<3GB2Rew?S=wIH6Gj17<4AxQK>OKWXLmohnx4FjU z8||t;m^!Ay?<=IY`Rvy2(2|Eo1(;;3b_h+iaq@LD&P@5_$mxum3woJr8hR6$GOXt zgg(L(T-^QAGBTQ^KX-e0il8agytNaQE_aETmO5KlG^|$r^4>|d$Nt^*8@1Ez(e$m` zl)55la{2Q_+YtcGBBD{f#|<6_onDiRf=@?1!hPO4a7f}BneX1&xolf+0?0cYI9aT? zJ-ad`FZpftU`^L$%xxY^KD;xct83gf$OE*P;oUT67umH~-7fUhdwWa+=Y?*=&^=4g zr}Y$XR*iPrVZvP8?;^l1X|ZL>57PWQ(v+(FeNaBuW3Of>yn6FwwiPxlHcX@GXy&rB zVjKVJ?<1zB&z3#cUVbu1clTSV1ov_Q!QPi=ACjnNCu6i4?_of{`W4gC{1?1LwjhBwuI#X;s%-NSB!P4TG>bUCr)?6$2ty8 z!!Oad)e}vX7%N-O6OF1hW__27x;e}p*E)u2E(9ybxP_4wfA1Oc&2Gryr=kt`&-mm- zW0?fgtjNMsDr|V$-RC35obG*gf@eExZ2sPhKW-fsP_OJw1Kqj{u~y9_W}KI=pE9vO z5b;BAUd!r{WSCz>*5UkW#mddr9Mv;Rrg?@mTqLwhdWjY8{CXjH1TADY`(7ewu%W<*6C9{-4l8cV`dUv7CH z*bi<=o89s`k~oF3N~x8vJNZkra(rAv5?FNu=Vks=1k<#a;bDuehqu2DZDQin+I5Ma zT_WXF#_TNT-N*@r#%2R5Pa2V@A~@LISRrc9Fy&r4@uoHqP_VZ z;);LIOset^kLEIW%clBZzEvWP(RqZ&s2|CVpDUbZ9Q}=>GAaJ_NU5HCux91~#(v%} zgJl8!S?_(a1CUh}{RNb`8{kbUtU5kPb4&l)i=@VXOdGmDOH%Roh&hO|?#F z9PPEz{+Rq*H}dAvTOVGpd$QpN@#p0q076t~Gp$lI{&kXO34`owL=y|IVQ$>jaqr-*Jgpp zKKICPP<%{ckM+f;@nc|^yIv0OU=v-QZ@(ztPdnrQ%7(u>UI z+f7=hqUKoB^|kW`Z_Ol-!Sis?))0Dvz2e&zS)ffGud%F?v9SetxORX4HBshJ0Vmmd z{GtX$d`8K|^DzCx;*eAP42Wr*H7$6DBt)veJzG%jUmNFXIi@|Hej9t96WeVC{~$iYzqlQn zH|E!XCL#GG+=m{offqmh0ESQmT-z1ZuLdm!3*`m(My5gVq}n$2eC{v#t6gZ!(md$Mz-v1*_DAVics z_Walvd~UVT4rXiZq7*?2TC?y?vMN-x?sre2sX_)Wc9S{0$a5 z4tY#UN2TENGTOen^`b(rhq9O~YN=vvIEUFMb zA>|SCN=_G5eBWucT8?|9lG_@jwOZukqUT76J#X{=I1WLxn^EkqA|z6a(PW+!Nj|*2 z_QN)7|IIan?`m&f#W>o{RWEAizppBY3SH#`Mq|I@QH3GQ#T>n+F1CJi?cqK@j7%{M zp*7Wc#UItD#tj0q{OIAjW}%a)^Obv!vQZ|cZ3jULEZ+G?t}j2c{GF%0ol{{){{N_Y z%b>R2xLZ58ySo*NySvlk?oNZdLy_PP72Mqk?(XhZ+`SOop@;wTyfg1PlTSO7*~#9M zJ@?#et>3jcI$phL^b|C<)MM`7KT~M9IQe2Vt6$3e`KGrmWvXRXTiVY06w&LW2<-ck z(GK)LE{3Z_fdXJ6KY>!DH5EU7iE3<#R5QF! zdXmx4#|9YHiZR9Rw^3<(GJl#z@Np0dIp-7w%?ao>`KnL5h(iPpIz?w&}!#^*~a1xln9?} z3Jc9o5wWc+%35~{ow+bI7$gKbp?bIUt598BD{R|Sm>cC__N~af1?A_Od?57sM>*Wd z_)gBvftr!JkdE94{GJtu*%2d@cltbQ*{DKWwbmeyQo>;z>8)9)WYoe6y+j^ollxEf z(;eC~E~}j@=6jn)kV7@`os5cm)5smMda_!EqW*5C4_N=q@vVpOo5#@6@Y8-itMTIR+S@cJ zU^}nv07|El{O8_N=DUZXd{n|)k#5yCln&B=0N3Gr8wZc_Wde#Q-?}8WFOFq5A#pR> z3-S!LM?$R`!l<-Dcw;`8*^HUVRD*Z#+q{PD>8g3Y4a*^O036SkaT~GFq}yF*I_n&p zuaXWF1C>4Iyf{{ro|RY8%^A~*9JWMW(-G6B)cxEI(WWl3qSq<*eTncHq#8$v2G)O? z$`&r2KA~#SZ`4gj*OM;$$;8eRGynbqR@kT)86j{*2}17BlKB+lqnpvFZ?wteno0nq z&MWY+m`UFLjw2O6a~}zm#-s=8+C?IaovWjk(hu%fghpD&rGM~@LO+4%mC!Ym6@PA2 z03Gz#zJDJ?BQdp~7ZLJ|%?~V&2t4tAE~{6$AQ@Cx!E5|E7Ov|ZQVgLpZJND%vk@t0)o#N+81Ffz~s89O%G?r6ylFZ!aoLPAB0=B#FVfs zvTqEM+?^&Y4{-q4*XtztB>lCn)6n{*L&nGr<2%8C(>#5O?C^BX4qpV_PQj(t%Vxva z@5ylzrTVvYdlW2*T)iXgucPZWClHHEuys^fg|FS3h(P!0XHT;Cxb{E5!e4d=u_K=^ zy~gt^KeG(h&LPk#_wNNGc86|E-e)&*XHh>jjyffd9Y32SROW-5h`I+{nIh zCzWg*O1GP}B?9H<=gUykk(|V_Jmb0BbeN=WN6M=cC48BYdNdRkjknw5x}Wm<2f!K~HxQIoO0g6MI%Bv1eZ^5+wgj%$7{yLo z>cCqJ!E%A!MU(XmE^{Unb!W%FdS}=NTtgk&tL#j;9ul^zOyBX-{%9^$a>wh=TLh&7v?xog%2YcQOQ@&4*H4Ji!#`gp z$kB}goy+Gvc_qh;^iGf%-xGymfMQFI4l6s(2&#v|?57;we81n7XfRF6gShx#{b87y zw6{8?(&4xbq?C-g96AL;9Nmx^H9|$BNuqdCy9ihZm#6ugmC_+^?{p11(+yl9cjU@I z%OZ(3VvDph5(1FUudH36+Lw2{bF^$=3ft+o4O1$+orjcYsvvf^GAU@#Cdq8)eaJ2C z(eQgUN^8OzHJveBd+2Br| z1Dgyu4|`n%Hpy|tHIki7y$tIo4uvJDE-EB;#8omf)_VRTc`|v|taZ@Q7l;JYN$J_A zp(7h-dN-YEN2x1ReUoMt6xOdkEHZqE+cmi#_K}aRscSPOMZue&!nrdPKjlmxy&O zrc!i*6s0nC!7KTx;P8WCA~PW_aJb36@U1JEN%wd*D*pbgA?V!`K2MN9KWjj5jls`RB!L>wjTTHh?+sFBi3aSOSAw#|d* z3Ch0ee9gQI3G9cGiLKQ1$N9^ei>0%7Yj?)^3W!LnmF!jDz(R1+N@T{xl=j>FE_ z>hcHPz!GY*x4cKS^`vR1DGEtg-k~k34^gWA8~#?l92Rad-1)_>E5pS--DJg^~OF!IKsM6?rW{Y`NnTv;M0%9FV=VY3ng@AKkJk`xD1ejI1X47)>-Z_ZVd5|z0}$qY6?f<}+dL2)4^_qra*!_0 zP4yV$q!6YQvKz)8E$So*`_1Al1eTwE5af)5kiXY|S@aQd)50u5Mbp{agyu1L2}DcR zCNOy@Y`2>oJu40Rt=}-_G9A5eW-9xxyj*;%4DXt~>?d!2iQwMd3)%Q4k9!TF^gd(FkPASF)Ov<0DEptKkGISWFLr26ZHde z&S)l)%yMvk+}2IG_4`!e?OWhC>>-uUsgJ%<&ai zqEn?5l0YLCZPNZ0LCs|;b1?n~z#f1UCrG`d8p2m!22RbJ8Vve%d#@&t7_a%$S~;x- zm^A2#U%syo{-C>oO!$^R!t4RRPyGY*BOw=Gu!!azAeYSsaQ;kZZAcYmTKc?lm2g7m zS$7*F%l^1Guc|p3Kv8|c675fwOCh&V{XLOTYwL5_b0jeWUBKLpTLo&_a$tcRs;|`P z+|YL6{Dkeuu%ZP66HpnxR`J2#JS@rO^<`XxPu1?~rV`N#Z{kaoyO`iZtc09jSI#|l zErkD?E9Tr89_qVQw`eQj5S|gn<`yD`)RxoF90&1MF{uZB+wT-vJqa5V@~rhv-CvHO zT=9-fN;}$mU|#QUuTzkZqVK-jm0bRC)E_BBCX^&H%$+=&Bf5`{WOmAQ1Y=|8R(-W% zwb2?*V^d!wNJ;l*zj9K0&Y;w;=1erby-MSQvnV`bpHac5P|q<)P6D3#rrpQk_Lpw0 zsoKOCWPP>Ok$sQTHieP~G8-N>$2#a?*u34VD`Wrc2~=C zOWxrhfjNe)3jj~q@AkDy)l$#ZOkGzE2wi9Wu1VFyArBW)`HvP`{!{5>&EvVAVH=#S+xQbYZ%t znU{aU@;J@h9Nf_omV`XOc;O8coG1`P;$6{JbNfA&W(gV#_%$<(Wze&%+EKW|R4PHY zG%%ts46PfE{2}1vfAw+SD!)HV+f1p919Aq?|k?b0)CJUP}>tjD1dg zu3J6W8$HjlhVe#M{D_y3ZusXPPDqc;dH3f@4W>VUP!Wnned`*3bygoWG)C<{-AA>v z*{I2&Z*}(IwT2Tv)4pMc=N_`aLxvB;1)la88xwMPNWK-CxZNNu?LL=yu_Z_YrPSQK z>#77w&QXuc7|MP)W++{Ry>tHfBo%^XwRnKqSKP?u*~3arkQzOJ!+Qxr#dP`BVWO)y z%WSh@_Y!VwymI~z@YPZq%;d9|a?~+Gk>JF~8G_S$eGoU{!Uuclu~pK*q`*>DHxkTk zI;>}v=`Lys$8nBqj=+a6@NA-eeftjPpr+ohWh&+rro^x?yv$ViQ>)A=YK_6Rx7d>0 z7NsODL~CVtYy4|qY8xqN6sG*(N_`f@K3qq5>816ylm{%8G*Ock}HKoQ&){Ta`NVq!Ij)QljLS(OtS9dS&`k|pSvlI&n zjbSANNeK?c=@oL~T_J>CzGfLr7!2R$#Oqn({gX*-ppkKV!N3t|Oob=}VcsXLYqs9? z>Z=77akyworXopnC^1)Lk)cB`3vcqqCZ&*v7?zEBn7x8bKrwA`s=!6<{SP)D{q)X3 zmrcqzlnb%#J&mte2FYgJcj^A9>qCgNi}Op_8Ob5>Fz6s+reP5?g<4_ol#g#)0^aL) zU~3o;^skO_{G0;i!(F{(%17m|{w}O0dJdYBMs{qgxEIEV#B3Gf4YvSou|mV8KL|+4 z(aS|JQYf^VghU!}0#aO@aQJIxdOj{Gl~9E<)oVAnoIQjwf2I-}C*XqC`%`gzl1!9p zQJg0#L24$GO{gh}snpmb3@-gR!PJi57Me;^OcbJ?u}R?E27D-gTNxvK(P1KQg3s6r zWrf#g^7QSfi{-WWfVev9P8oz{W1>gmoT8M9niDA>@TtdsIGg%*XO3>SQpp0ld`y)i zttFa=(EBNVJ@YBrlT@bB7PI_&u|7{qC9K;7+56qFHWFCzkJE4WF$5LCL?H6AM6=Q7 z;M31h)m2ys{{XaXF2n;itvc1YUrkMHHF(}H# zHHGJLUHAjQVviv(&4rJgm6%trg%R$dc+$_5Z0H>U!XMr%5=DQ^PjU-^2C6WoE@ctn ziIj7mq)ZHKyTbL8+v15cf?Qk$#e8M@KLADO z|8tXjov^DVn?N9m z_*vkjM=1#eela4|dL@*ShXEVPAZ3`*bH0R#LmIrRrwm1}e}EOWk0Zm`mop9rF@K9J zRQ|gwQvf|xi+VEaT!VP6re&36@RAYf>?WVj zJ8FF?Z{WUGpd4R}tq!rwT(o6f>f22edC_YC<&5K~txL=ym~wsHPZKeYnwR>UoT6<_ zW03BsJrVT62KB5xS=nT;84M^HfhA-n88^;^4tfP~qjay>c3&6Dx?{lF<=2&KM(ZFl zx1@1!{8(#*LB$ce*QxQJ{;wchYbHl|WC<-``;KG{OI&-OD>HeTGE7C%l2p^8+$MbEIgCz+6B#_cJy`h?;F0|Swn!&{gYPi1uF&myKIVeo$DAHWSKjvhC!upb$~CBtX?bC#S$4g8Y!TT-%;XDX{}K---f>ziT{LsdY=lJPVVER6IO+*9 zE(~W`b?pSnRI3DD5hPXn>@$Hc-7xCyQEOY`iEE-sxf|2h1*2U~o*zL9UQW^JV!61# zp;9z0rhgBDaJ=1oPP$&@7iKGp+PKm|wVGWl<1;57tj=)xZFmahzI`Bt@`Q53NvFJ5 zSwU#s647q!nY~9pQ-W{YTe?VH9sqW628oY6Tnaw6+Q(i(HtvkQlDk9i=mbV0X1bCG zF6o?ohlFd#n;~umnCGv}2E4p#Xu;L9*M6s@XFS&LYo~22K&l%oLY|keaqM9VX}0jO zW`fbBx9=?K(1nAMiN;O-koNhfwk*Y0J4glEb|Vj-EG*0!8RMdUI2Ukd87DFQO13?7 z;PUvP9@+#iVLMj~EZ>N5=!q$um!?&(kltw9Az9=M`GpFES79Qgkt8H2De-n=`V7Ap zVsA(oL3&&~x9B>H8@4)yUlCeR`#lYMC2S+uj*Km$0s53Yaj|JFV39m;Wz~JJx==h` z>KVO~aE<=vA7E*>NBx{buj8!Pp9_UgFTF0T?I?ir0T3^_phQd_nZmJ2mc?_RW|}&&Tz4&NM66abwZ^o|LeJi6@H_n-%{;cCm6pO-;*;9iOz5qcL%x zei7Qi9$;nh#rD7nJM@}iW?++|b`n0K>)>U-)we0R9`N2VYaBf(e3=Y!I((I5j zRWin>s9b!TMBgR!q6e^9vea1e=IOG)Lu8s^bf0DK=+d=QDr`ZoILr{58IF|VFx-yhiZG5$-2@~T49YbQZ>>Hw8fC~%O z9ySemi>0&WV+(c$yeG_D5QozcBfg9(s^G*@61UPMN2sZ=A`7Y_n^?S=MDw`ECVU`+ z)@ccjvrf95rtuR6YY9d}&y7yBUo{rF!C}&*<@K^Wq|5;zgga>r8)D|bV^dMrU#((t zj4E6}9x@av%AW;2>Rb1)$LwUl)|}^k)n#$^RknUqCpTV+&Xj@Dqi?x7A8j&qkz!Kw zyQq~9MuR48!)l2yegfk{H|oe;p?qR7lV|Rurw$R7dIFyZ{nnQmmH_i`$#%jL>I&hF zEZY(mH%EoJO9b#u7j>es>^T{Unr2+9#`05!;y$dn|JU1SRnW1T1EU+M# zeja(%NHy$$7Rb!UW4k}sYa0t&bLiS-$3tiv>blcXmhz*)%O*stIdY~6#=x3mbL43) zmPP6Caxt~hyqd=)s2mo>pb;!t*2$?afz|u1nlYC!|IR#-j7|;Lo%NFT4`N~kG>Y(y zhvtTB6Q0q*;JG0gvdc1fHxC$SqeTKOQtFp*%dMC&XcuHm(HgVw8!cd@>N?Ot-$Cc` z5Kfs}fGTs~y0bFb*U9)EArF&CcN0#{z4v6~T{6*f_}Tx!u1!r|+^J}h z%#Elo-iNW{>WW^g=5lgKv&>k&8qiL51mj&ccD^{O%vuMry=aS(l_5I(+W|RH%{^J%J0nY zW#EAb3$=i@!O%%@GsJAHK@*tzLS6Aq)-B|w4aiGSYX$UH;1KJvD&Qb$ki$`)KWb{U zDb1(7Dyx}kn>Z${=ovTAN!68Zi`I7)_TLX_tpi<}b~rg*4W zx#4Tc@-eh_1=#)W&sG4XIBI@dra=Yww?>30P}5^ZO>3${p`BWJyti$J{w zXqh&OCm{R8Kcy)6eClmQ?uN670%74ptp=8nf1^gR^iX7?zs*PRH|bgV4PlP*@`p%Iai6lOGj}aAcoXGmo=v>Qv6QDPs zAAm59nV(Rav_m1wo>zi4qRZW~TG-=5r-R`MrJ~vlvJ}-?We$q7USiOy=+W?0I|2BH z$6~1OkIG?N+8X@La1*dyr;0v7CnPRFZBfNCJCsGky%D6d4GVP_uQ3Oy=TR1i5(Tz= zjYDpzZI}2-;c2^PPfjnMH6I!#xU>z&TC!fGemLCfYi0H zMXwfm+(Zjb$!_drM(YcHF-ha7aa2JnZSl;$_{tGtvoRU7J6fFYs)pk$Wwdz)U!aEWEJ>g8C(n!$^gNz@E@%hlJTrMqiM}6 zk2Sz}Slok_-zAGUFS=7UZ9vyzSenqf!f9pejvbqGA?*k&Zpi1VuSx+3x7-{XkM(j1 ztB&A^@ekrU#~2=0q^9;F8ob9WF{buVOWAa)=Y(N_XMJ?A#^0(oCuyhO3X=~Qgh}ej zlg)e$A1WT5hX5>+BW%1BIwG+a5qt|SdTzNRB1e%qmbL1loKQUyP%9l(yEO!tEN-19 zs09W}T)k|A*;_}wQk553o>`X|N{_o1+L}=-5*H5~gw`WV3kHa`?|O!xRk}CasO;=& z%;XYmHseJfZzYhv-$hZC+&oO^w&K>*RY|?c2bkJxO|I#|%wVwZ7sH9C%n05B4F0P*8BtB9{D zKCQI4NkOSL*6Q8YSTlu)ZY+GtfiOn|2smtbX%$W)ZQ@NulD15YtTUWNv2gT??^mvW zQR#v#+Z9Nd2I(aK-sy-E#6Lsu%OIC);2QY21h#9{)xQ`WNR{|`V_Ie<=&s)``fH#( zW}5b)i}8H~pQa;9G7*{P_tPn6_J~fEqS||&0{1NWKM6ePpKQ?$NFrm?v+0MKHR{Qy zMX!3Qb1d_`upZes+2WOW{W(@jX2E_c@d?{6$M=NODBUgWn?`e9CYbb{r~rg@l;~fT zpL?wmqP#Ojm~2vZlW}TF5F;~rzM3Sbxlt;f2O!)(EAXZ8)CVv_k%o3L#ISu|D!ybm z8}~zStgAxyWg|CTsVc0&n;pHutkM4Mem=yoRgLvc5<=9R-Eq`mRwTSU+1-fafRJ`= zh>z|)exrpwxj#I95QzsA>_U*LWS8!yXdC~ck6`}lSs!mPJ$w0(WaR!t74l3_V7W7cq2dFkbO(*J#DYv3H{T^Tp=h9-K&T)ssMdKu`9M2m<_S+PFgkPD=KzV zJE!vjBc*dlxf{bwuH}siE+1D!{_)9f(h)J6s(H_n0EP7r3%@nP9gGG{ae+zWm#+O` zzG)Vx;;!qM#if_Kz|pD`zrdfR-Q``?kS{2{9f2V*5j_6@?Jv^%Ru8%Er%y6kvqRMb z-3qpST(Xm1O|vqW165TkZ(UNLmzULrr9Cs^|r56(+8icrO zI#j92f?)7g3_BCP)?>LNH;Zj}oT3?e@YiOJk1NCSgK=x*3jbEx#v@HK(eedG2mADL z`CCyIMvhKlzfj}Zyw`rOz;f|7el zRiK>n+b*}C%BmVd$I)NEx&v;*v{0gFAoQjY&K<{{bk{e5<^T{c=m~7i6fu-n#m{)4F;^;gz=;xgE9qiC z_li+>38OaBFxD>+6Y8f-Hr$-o@xTUC?fY9X$uI<>XCF(u`y{^7v%$6N^LS){HsC%kScv*fjWhjx zC)HTaI}&Q#DdB}3xj*B@XDkDMcFPB%w(>oPLJp0hExq*bOU-DyiKl_$QJAiD}?sjI31|J2Nac0Vg-Y5D=eO8kCCvxo-c#8rXqrm z{ZIxDJY9t~LimsFpvb@6uRZAe<@oh8ZTBr-#Ox>rqLULpD}+c_uO@QFdG&7prga+w;_*`22?$`sE6tC{;M67Kw zBx6nQA4(x`jnE*E7tVaP?dgTD-dmMDNDM!`>@TaCC5+xN^_Zb4=yz(?Np%-EPF{`> zex2pLT)|K4Fa{bX}>Sg;0bJa6AcF3Cm)FObOZQu2rpJt(FMUwc$s@?0ZWgU{{UNu z?DfDU!GLf-%8f3$YyT1IvBy#qP<;^Fe85~%!&M}$6G+&tB9y=;fbva9$-a0xufmR^ z!?0gU6g#$~HDKvG7SZT_;L)a9RoTnNLzp#&@auYOBM8O99u}5m!7EBa`Lp`x(t-)6 zK?*h`pn($JJnH*`C0S0ytuF2RDGvJ3Ya(J?MSuqNqE^QBKLG!vv(^Jte}=qz`J&5F6eM>%7eo4VQ3#0 zDXKTBNiZ(0Wi!ltAIC>|nSTqCk$o|3mIAD~;5d&+3r0Fi>|64z*VqCjxl{?{wrOh> z7&n>&JZ;W)&}GD%R<}9Z443NP$WVfmX^hczP{(E(x5hBDf`*d*(zZ3%Lm%MNYQ6Hq@E3^_{0;-LP_B*sYn zwWQ`6!poR?9G*=cwJ|C8B4ObPM+Sp@D+N!VKs6XM=8bwSR6>GQO@(nku*;w2S?1Ct zY0RT2!ySN4GQ!V*))urF&*ohuT=3L3>U$7r&niPcfMvoOj)8G(?ekWYfVIW*lKOo}P4g}PapPOv?|90j{Qb1c`T%FAO_hk}FEFWsc#3QR z){8QwPz$dCRD3Dn{>|r@g_@q(Fx`KZWNc z%-S-RYq-k`EXe!B%2)SD;fk{R*X65dg-o9PL|X7DCY z9m?TO)Yk4qvbgT70cTGy^-MxxyY?*(Hxn%buFRx z9N(hb>Z`l^>{g|e8QU(u@zyN8m#}Yzg9ROH>*k(X`aUdvdfv=rGs8IB)l9XKQu zQ8WqG1|dvl=-ReT%g0dx_iO{A!CoNOpR$Obja3*%DjptE!*7_E7Y8PsqJ~v+tB`EK zIff=3k_r49R?|2crj}4D&`*_`jPOJH2>kb_Ph)t<>?X#dW^6^Bsq!13fGpA6jA&#V zDC-sujUPr5bR4XwQH^SZr8~%-0gi|=Nn>i@rkw)97#ZpE^9kg|3LoZCM^G4cTc9fbE&#Q$(eg{E0MJA z6uo&0dg#Ywd5W#o#EVoagW;S_q=nn3;SSA;K93OKph8@Y8;f3W#Q|RRQgvR!sS(G@ z^cn17eb#dvWQ-xv7}kBdrW9MXLU51Q$R%U>i{r-iH09n-#=>wW@n?2=pB-x&*aHv| zP`Q#5Z6Z2tI2r#Z=IlIK zcFsaQ+7E{bH`_00Myf_`Iv!_eOh}=VTHo1q2b;>YGJLDG&+63TTqVGKv(GDq;M7#3Vw=SN~~znN4x z(3WWUn0}4j-@sE)fJ#*Wt$ZTajg8+zKev6SOYEUTMwJvwPFNX9{h?$WYJg!tnUZWw zT~&3SS)(ng4TnY3!{vs)OzD>F!Pr!R>R7|6>J?RyZ&am=TxtkWA8L{w^5b3@NE{Lz zbn@*j3DdsS#6+b@KjFOQOU)B(f$pLO&-M>Nd2Ym4HE_B|kXd{Q&Fp*Dwo7&}=o*_o zk-`Ed+sQwYMqo2p;DbB?YCte$^4~&A7W#>5VC?>!c9+U!WhJ_EZw>(e6+LQYWNc## zN3iBL^X(QKyS*NQGYE1DOWMUvM0Ej}3&VMv>o*1nMbEzM!F5{tJn!Xf>7{Pwl zWUC@{g7#Drcq#io5TIl+9=10O1`Fr#QFy@t^^IaOtslOVAs|126dRFzVDwOo2a5?!q?T#Zq{W*O+d z0vWo&)DIe;&u^Y`ex!-D(d*#1HnzD5qiMtl2>K|4&d;qpFufZVmNye;> z2mGCd%9pdyL4Xks{fxo_EOIVQzti5cW(73_>rB4*20xOh?k~;|<*xp1lzn8zbCub% zpso5rD&mD{J2`1iq;Ml-e1iKD@nm*w&%t|65a{fBX(+0IsJeJ9odxdP0idt!^@$e! zs%$?C}Bt167?V(GXpm{@UzQAE5HT zy($%j5hb?wg+*$3dXF*h-@e_akN<`D=Oezn0p5xp--q9VpKs@noU^HM?MmN@V;H~f z>+wkZx(?Ie8kT&;F*+%Qnr_Uk2#1e!SxPuAH?&JAfnqUF1qSEe0Def2GMJAZJ8D2=BX+_8|ytqDpQ5R_<&5a;2O6|2aBe$vUIl)C%hqk9w0 z{||a!k9JMtL`Wu3Q)+Km6d(Y{G6*USD^c+FgNfQ!M;#06$&Vl`X^Z zEkDgAfa(BFCcV5&!&wU;qUhsZ%@k6*KosZVEfRPa)MOIgY4{?}tutN0x=S`(Ow{YD z04Dly(a}zj@RbTjT6{yT zI3mGKOsB)i&quOxP46xu2-JQLn_7Y zmpJWX%g3*?ZWaL_(x2VY86f^}4>E8F2_)`rI&M|5Vkr;Om@q zKh}pOm%r1(aKWAMIlbk@$mMfG*sy?~P*BH{VWbU+8pFo4mJg|SQsXXkEZ=goY@5G= zZh{o^vcGgBia#2hW_@AuP?7KMP|Ff01nKzbP0`4vEyj2d2s~3JZ^w)y@Z2_TEgVh| z1v^#0^1joZVe#c0N<0J3*+*G2rM~eHqD0cbX9R0;E}YgIbZ2w)`|O&t*2y?97~xiv z#lW3plclgHN>mMneb`UWEV3;$S2$E-T5gDif{D1 zN|xkb)LaO@wUd@Yl5SFw#Wl^wbPXz_LX$4@KPyaL%NPyFw&f{iB3%s_duMzp!1KbT z-cS^X3EXFjGV2OFU2$HqhpB(U>mIA;>VHq-f)y9cvhVt0O#K!N*ZpO-@~$PDp;jxe zfZLnt#I^iytK;NT1ctXAEA_1`N{7rO$H{*=rK)1Xmg<)dg+qq1k4JQh|6_b1Kj9H_ z*U=lwTFx}U_YtS=)634y?1Sp1N{G zvg_VP2}%cc7i-hJtVTH+h1W{~d1^kU-s2f$B{(1ia2L?*IxQ5@%|WMi8r zm2C&|1m1-|fuQKQn73~IuwUK{?T%aO?5CIVM~21jsr9Ohm9Re8%kdw106h#s9M_mL zVN)%Ebi=~j<&UlY|F+Qn52xd!hW7tUQ9)q={kZuirv&)5k0H2ROkx-vhW~D2EN&S;^_zN1BVM^- z+oM`};LKKOP5k?kb}YL8vJVs*%DA6?9ike2i6yaGF~wD(6l487@{$0_+35EByL|MX zMlSX8G;-?Zw|!4WxB<}eX23Ech()X}luZKE?)QnKALZ`CN+X_SdeLBFso~GpAH}{W zy}ZGH6zp2PTZr8dseE1^^ASDN82#^?yVQ0lE=z{98_%+^{4_B4+3-+Hpq@ml4v*W= zAIGNn*h&Qa%fx+mt+FdxJl@X8O(17EA3Ewh$-t*WI7yUBL?heMB-iuA~Q0a^* zG#z60AO?QB5!sVysNp1NRq?ZnmcOb4RMI~NM&v5;Ix_`~H*P=9;4oo=iCn>~YMGd- zZW|DKLbHZOBaXU163AakV+~@%;YEV{8d2GJ|_{ z1hmYm<)goy>`}}1ma?syQ4d%P9h%EEr`Ff*Qv{)S zJ9vRF`)!<5=cV-D(F}#J+7+R(3ND9~g?h5KXP22dgBH>mpcc9wt3K*K_%(UOcx*f-7HFb9}M&ei7BvYc0(fryd2LGVctn|H! z!9}v+KU8$#P&$Zn`c+f1Ce6CZ+Di&Uo8C+Qh>Bx31I_i_WHDGVxkkw2ZM}fiETBA5 zp5|=GKJfSEG|yZ=2xLa(iD!}U<#3nyhSOP;Bl?dz{YB%}6l@79h z7Cyv>Wi(M%2G=wfVBNznDJ`k`d3Gk&Eeg)=t1EE|B9T5+#& z@`c?V69A?2L4P&})-G{MZK1}|rzlz;^q_vLhkddNjYvwjxZTE29)#ys`9N3WD=oYt z{KzU!$v^i?F@idX5?A}^)3!t40(K?yRe}hAi<1=!xUPvjvx&?Q@A3SL4d1NR;ewmT zX~@mH$?|I$qq=>ZWR73>u{+`!Eqj*rh!zb|Q783$cJA*swNPqX#VB^}W@u&^fDVz_ z%ujW-73pXG!p{Ips0MoMFh!Rt7zGorOgAoZ2JO2-^ffMJ>1mt@$S)U|y1>l&eQ(IJ z$u`-18fn(OubYnBbS#SDa)8GkAP^jXY!UwpPP@j(m?O`{QYVJGSO|~)D9&aBoLk%R zsc(Y$pb%D4stp63ef{%~)*61qwDdMqshD9dNTehlrS?@QuoGkCwr+X1Ls^GxrHn6{LLLP=FFL~245i4=v-+J@Jc-lT>Md$I5Yh5Bh* zLNTTv9&5KUfxgM6g%ooEp%}!{0x6SqK*%OoCS3a2)f~?uQ_feVt%QOyMC8naqou5Q zu-x^=eH?HoI9OZx#lvRaSLJ^N{VeG@c^v#Gt2sC2SJO2^=qliV-cC*PA;m?Py z;VHnN-zjOPVMJ^;I}F(A2qzJz-|ri!s@0p5cj~RKj+S>t#!l}ma`?K3`XxzEpDApj z(0Tnfy)J&wUER>MEr3CGIDvh9qP)PV+!q#Uyf%l=|ObPn0B z@4x_Gd;FbySSIa0CL}wPV*^i+i+K3d|M~|={67GWKyknDQMIL~PgKS8Yu`c_DFIpo zfIPKjf}m9CLB{4aWKOLDwn*;fXxJ#CO^^Z{z2(?R_)(~{XMwj8Vbi}N1$9?tRl(BC z(m-k;8{!iHHZ@x+{-EWNAX1=f$^f|X;8%~gI?n*z8p;!d$hF4w7iq|u4v!z(fO2>L z0KZqU;rQoMAW0;R<<w~^bQw_9{B*lUJtu>@sL(SXdpc<0YoN9(h)eB zx+pdd)F6PJ3&7(&BC;bfplLO#a|2|cWOiaodHJ#x<^efFHD0;^i{B3NNpoUBi)PVr z)%T|k_U~ruz@8G^MRIz{<9HA@&`#-iS({AIiIpj<$rz^L5-GK!CEN1lW`rH3en4pL z<-}tTE?wN~-3>Q`87nwbaTo0aEdkmu1eYyAvQq?vwJgHuqp8C*q{4LzkRwd0OfQRW zQKE#xG_F<4(d>X>qj1~bxuT$9=F~9E0|J`^Pp7B)MJI8f-9B(yO_Fu3?`9l%Cq4RW z{7BV@Bwje#=NL%NkRSr2ohm83O@Cw>fFd$!U6>;q$X({U5UDg^VCqDYT@oUOxFQx$ z%h|UloLF8yKVvr+pXW9a<#aphmlJw%=hwYpx6*I0=`bp5e)o>>HSfJT_;MEa{&2T{ zE%%>IoBe0Aa_YD?06IOd<1`<*q8ks`_aPXydr)}@N~Kk>E)%LEj;cAWM&AT6SK(QZ zB#TIg46ts58HS!$&9UM^=+46fE2bK(PL9J4m}czI$t%b7)d*T29uAyjz|$uuBIuYD zlH{`Q6&KUvD3Wpq8!)6_Cl)av5-m--WHd_z6F3Hw{Ws_3>kl0-JbdA!TjFkT&li{c z1$3}N^5?}nP{2mNL8IdXCVE00NGO~WDda5XG{%m}3nVtzGA#6j2nKFBQgcMIYwFuq z0ljPQ#++A=JbyW9yo%lV@?u`!bCcUAGgYtrf5-d${{V=Lm)vk!B~vtIH7fn;k#2qmki3&I*N50tuC%C z8}ts$N9Ng_+!2=OjD*lY5KWkiVwRUuWWZV7pKK0*Xf8+|5}8v8Q}GhO3oj1=^buuw zgkY219Tiu=fSfA_E)-)@DUE2Yn-pO(CW0G|VgBGPXjF^>m=y4Z5cd$UyRQU@i)Y=E zP|G=h!BBC6`hxPJTesW9EtZ3YOvcWE>4M&g#2HDzWX3`7PB?AE#OTo3uO^7l z=KSTy9g9;{7~?fX^2M#*5`Zp(T&IsE?sh^+kh#P#dtzddB)(_r;768L1k`_=_`L#fuayjJH^UApFH0)4l>@Zi0j zyRXsX?eo4d4y>`C^nit_MHZ+lqG~eQG(f==OS#-x4UECT62X&likVtI5m8D{N2pqz zxkh6%i#BS9B>?pd&ND1xVlFoYAou1rr-=Qaahj*hx=F+)h&P zz|M9O_RT;}GHFyX`QiL*WMH`zMp^)VD?v~$$uzyn9Gf4|Th zUH+eJO*f8Lu;*9-!q0!xIr^X9Zt)&TO}-hHVM*Ddl*;jupk2jgkqy2t*Rej;~J5C z455aO0R@RTnxDB@6O0Q*mdFCcgA@#WsqhHfL+-nF13o z?}D+A@!(h)E>$D3Ketv6Vl=PobI?X1&4W>|sCM|9X2P$Eg|vz^#BQV~O;CCC;HW?b z4=N}HgcgeoN=;yRYC>IOXId#?VD{B_H05W4WI7R+WAHKDy(tp-ARHHJ#^y*Ipmc7{DTX5Y z$u-N+Hj1#}-Kcy1iqKk!DAau3Nv1Zqqc>L!P5SOf6tU)6%FGy4nhI&akAJLdUE@g1 zK`QcJGIIEjlc@L!a0(*`I3p{d=?@a*Pm}~~Y1vGuQXT_4d5XRP;X;5G$rQ>?$MbLf-0Jv-v&#Fl=Y4rKzc`Jw3kJM_e3wVN)4) zYn?pgn#r@MfrGi+hdM}L<#f*5In09hrAV~FNALFYFbMem?;1m8sk1lMWsG{XrW0b9 z4X}4{5HhfIROm#(-0osMM1O!YtSjAAtlL-(JON#ES?(ZOg(hep8?lonTvm7xuo{{Xba>cp&Bgunr@osGC2 zUPAfDqK?yGu=m2l2pHdxBw4mBaz` z#QKChhT8?e7c)tTY7Y8n)hCFEA5LyJrnX|=rl--)NH=?y9FL`o2L`l>Y4}D|z;3ZIkshV;)F|a%nZaC)d zI#Aa6-8`i<5KMDf=tPiqdVVue@%n%EdHMDGV7hkgCDw{eFFf9<_c3a|zHj8m6PSN} zxYkW6JufT(9dEkx(}$aHig4OoHd^f0rQRN4uMNCh;Qs)5)7K38%9{d>< zJb@m*i$sQv2ZT|k$Jhck2Xz*JL8U@Aez0JH-Ddls4p?xy?@)Z`8!}j^L5dw8iFd2C#J%3hO9b)r-Cej1@vmN1SW+(d^GTP7(=MW2`^y(J1tQG*Alw#G0Y7 z8ePv%tO8HAiBp7}{g z)I!LCLSTLD4K*}Ml9E&~vS-C)aiR(C*$w1f>aTwfHI?1RGcM6-8(&L1Li$jFqk+dZ1)@FpNAYWrxB^MnlG1KK~( zdGo)2@V|4=&PaE&edhxisC%tv(1!VM;&MPV68k;<^KjPseO=*#`G0#l@qK*y=LUFi zQQYqPVtXC^joe!}IFQ1upw6g75!@lEN9N~iy~1tKQ-vpZ2V^lNC4++-wKAxxs^G@BOsL9qUR!nj)fwJToS0zCC?zA=qBG z`r=vh8*gaf2Qi}SquT--rNVo6btQnG~Us9o0hiM}7N;WDm59!7c(>=x;5}6rO8z zg{lOEd_*XFtmPooE1Pivs!A~d0KoV_Nr(i1Ak@HP@OnT977zxAqOF7gkU9Jm5Y$X) z1;}Y3>iYInJkn%bRVqzL7!qV&`FsGB7LE`IrV@*13RDo`P8Y5XGefdef!j0FrgZ*$fM5Ww`|-Xw#Z_j;qim?*=d0=g5vP~PKgC!Nz(z&SP>9p zQiv5FSOAjf%SFI(ra3}u@ndRvxa@>BTvkp`G+nE1Wrqq$#i)h^_Ck*=&rS#!B>`7w zSQ>;x(q-z0dtS@07-4uX$Nijt)8{(te{y2=!KQl7euBVTRIE4xsY9X$`ePy5{{R7F zNlqh;^WrVc9&tKaptaX{6Xm^9N}ECL8w_>)VMqgM85&NoZfS&8!3nd@g2OHz3oIfC zr%fBC(UTfcE6neMKf->OJf)lFPh9-r$?ku3ok}eb-u&sqZ%FO+JQ?5o<%aR*N3Szm z=RXel@U>s4eJj0-qv&#VUmu)AYr_53V`PWEK%BM7j%xuq)w@q@8cGjt1pvPws0ehp zgAWO`BVoKo6kgt%)iDjE9iFQ_udf9iY0FGKWQcHr^eWsiu$A5^7@lo14SNmo&M+kc zLt!Yq+BApB;@2UObD)72B(}NiCr|hxfOr&rD2VV-@@3@60+4BuYOnBVQX{6Pre%%O z`^^+Bv90wO#H$)mx5Lh-J(z`I@>ur@8%#lCpzk7k!urIH$0Q(Ex=()}?8xg^qjKB| z>)un3d^x1&M}BobTuIcsH+A$-x*G;6NVWLefTZ0|g0Ug_b6t6GB*{Gc{>17EeP&!7`Jw1959Ku3f0T2W|-;^$qr12yT7uAz+k;ZW9 zeQYbyCOH8pLf$A;SJ*l(q(~<4UcdoPk3}A zyX{zauQMl&n5ZD7cgVExLkYGBjmmCNPeU2eVXF%}pT6-3r2&!<(WY^R)2?MPCX-WF z6Cxq)fKkA9?8$|r<$Aqrn0PJ-uAwE=Zr<1Q=MLUcanYSt6qzP&nxWvxyK*R z%Z|5tZ#;Tr3A-`tr*0ZG;%|+Kl-Z)$@OA-1NJVXgB93cD73J%%i_scG7Zn^%XFMjQ zAw_9T!5msJfn|6Xtl$rY2`x>a3LvE39FtqdhwG1qET^1I6O05ZsFavS!d~+kvU&;> z7Q*J;*mc(dL?#(TX*4Yndaf)ltE`uP3tn`uyop^e}W5kBVNsKgm^%1^0 zWEh&D(V`Xr1{Zx!?{g&#iqm0O`R++HDKXLvJXi3sdDko@rcJD>YTyxWUVt&AOq8un zG(w%{_Z~me0lwV*o-z&&r^hLrVhK9W`SF8q^Yj4I1BTZLs3Lr;5Wg8~tPZ z<0K?iMKaS{SYTJAARvLVX8~i=R_~E*%imlmOs_p7&Fdo@_)1pbZ5NCLu@&b*%t?Ty zr6`1`Prob1;d7fR@*aB5yakf{KZ`l5ApOn2@sxSsCDw|q5 zG(O}QltvMVeRk8}P)Pv?D+7fVims_rHz-wKy(HK^Gf!X(=uDs9bK9TxQK7E=cf7v` zdOPvX6N{txXNCLy*i~iLuNu~~N*^ClMZ=mVQTMG#q~0nhsRZ?NBT40^Q%8Jg84ml< z5nChbyQ{{RwU`tJt+0Dk#?+~57f zTHEU8`r38D#~IM^-uKDgUfK$JUYYHPyESPF3ltD}mZ_M#0OmXgBeE%Y;Ub7C(m+Cp z1h^FfVa|~d7@qw+@7ErY-x00r zzl>vPrisc9*Su(W%KAevdLpGD-;Lqq*0iHKgV@#rjsg^!qPN3xZy@&>NRY82Tqwru zbwx6GXJ8@NXpzcOGxAV~Wy6@{TEOBTCbC}&i)op8&?*uX0OU5DkXvY+#CL%@O7FRc&(Ahwj=p>c zrhWDK@9FE~=(XRb!;W${<=M{|3esU9fFud-7gQ^QV@a|hJlJXs08=1& z2fUg%0Qa>f-95D0;~7GA0$k(@eC@>l0L6>33d86C=bmZFfucIbh3qv3aw!t)Gw=`7 z{9)>QDTr$CgL?GVE2CfaW&^N({{VmV8s3k%6F8pJC?tR&MSU_+9C9r@+>&n);A4xN z7}q$XREH4iYG*HPaj%SB69=9(*(;|hcq*qTC1$(oXYF zJoR)4w9_Y+TUbJ}Al2Rw=BY@v>Q?JY~Z_z`6`ATRsR1SEaap2owQBos>N$Gf+^%2=iBKJXB1dIFyyEpa0#0>Sm_rVWX&r=~h0X`D`hS!C zxxT$Q!$?B}R^uoO_s26kSLKV6x&4ZpL=qNIX@Qk1ync zi>An%E0+oHCuOsAcmAhapWmDsqvv1q4gh)cEH$Z#7w_XY!@8DSz#=!Zjjy^IYQ4rN^(#%a;~#zQI76>{)! zUS|FK#=yL#){zgsTbG{{)u3Iv_s50_K&e9lL=%L&K(~=xkO1!)qe=O79u0~|ScDFy zEvbyxiVgt0peQ+E-b>=*%$iHi$C9;adwIc1o%Ae#!Q1eYIkoe|-kL}LHfT7VdV0U;)q}!5 z_*W%3N*o+B2D|9b*$`GN4vQ?Ua-BzHqhJIv*w)d)aT%g*vbJqhG+Fk-&r~gb`p$pD z&m4bm*6w%D9ep_P1K#x@lMS2qM3qhNCpMI?zZ>h!%Ei->vd{%DesT6bfZGMLNN5&< z!ID!mK+)vK*Az?p&4WyyOBiB+dQVFNgdJi*>8mLNi&lXRJ{v-lrn$)B*EGY&jeWCo z*`EXV#7?gw1P)Rt*~y53nkB6XIRbIbA(n+|Ma<-U$%Sj2disvh+}@d{%O7MTsgh#E zi5B(y8Bj}HAe-OqCPy_5?XW!)oB#mD^sm&oR9o2fp!K|Ar-!a%Zsu(W@-?LM_6(@_ z9H)`zScfpRbZmAFeLZpn4R1p8D{=?mhtrVT>35e+IE|AQ)@~{RBtUHlU_PS| zSz84~+E@?|1pfdjo#ZOTyQBXAf6(gev)oC%8opGp!};ZHJnx9_4`o2o$SCN0XEY(5$xv+UwUZw6cm9tZ6njllZ>XuAwgR*B3st= zp@u=y@B~TNV6?*FHk+cp^5ms#Mt84gI8F)$+PZLxZb#9tM-5MOHgI~52MiX&(Y!!` zvMI+BTR&_aq!%RueR`%SN|LWdC)7vM;bOqwUN9n#`R6wVwMjxI0_bogO;vS4mw(si zBrcZ3g43TE>8N`bdnO2Ll^1X~Tzh+E{6nS1o$|6S{{R@GCH`!i z&bPUJuDddVAo}mg)c$eheC+S)6_^r#ddlGKJB;+eElLDcX%R$Bopuyzug<9H;bD#`)_ z`e0}@s&wv+_Qg}Z{k@Otn}I=Rjhdg%Qmzi0HM*Y@6o4M~i6^R=PY6xMlVNN?I>Qg6 zxO$i&2jeZ$%PE!!70b%M=|8)k`R)Endj0srgdQQjPZYJw-Jm)-z{ED<#cEi$k_{a& zaJsIv;}oXoGgyk7S)jTyxC;zA{GHx;`YhX*+wbv+o8jkIUm0Dz9UAKuL3MpR-mpv5 z{_l7?U9-;`HM1+XTxjBJd8;GNjjuA}9iOiL*eQK~^Di*wyneq!?+sQ=yLTN^r|4+< zx@blBK<0-NNmgiR?2du8&@K|3O9NA~B28}!8mk4HsIi?m;w(ETipbdUFk0I1NHA4h zo$T)}@f)q{ohRvW*p1s4W42Gd#EEpp=Z7!bEhg$}&JB`(7{1QLy`8?<7REO<83VuH zD}FLpRo0Y_8H*?8A=Fb^f@`iE3Ti`}+5m7H4lXmVug^gF?+);MP1NaeP?`<(!g6WH z-5b?w9msw%g&a138@KM_@=kVYQAAg69Cy--@kq=+V8bjSaRkf&phtKM8gAK}6KT2esZQ@*c0c?i}kNI6)wyx@kc5 z^NQ=4H~MSnzDjx&9_r;iiKM)6eX(|mUdja51}n#1`PAbs?>_enML6F3t<}psnwoiY z)du;$d=%qPpFQQ&*EaW`-v0jp;ldh7wr^gTv$?Z>Im!I4SymwPup$k#{(wq1JtQe{ zs;04Q(dzQIJ@z)e;#ow&|5>6 zc*c4*732}Pjt8ABopAfOHF*t)i12v+_`njpB-(&$-fIGBY%%p=0OfM918p#p)_{*( zelOn2ED)$oQxKg`9rSvnKR8+0#cPAGJY>OL_Vcq{{{R@_N(hp??G*dv*Bnt}7M}W< z1CD%{pismXy36INmU%c~K`|NcxO1I6hu%-I(j*y z;j;jvVX#a!qG23-M?5$QOtb&jEOOoXY0EzrWM^<^J!VKTG-k)BMY(c{%F^;yftzCJNxFUd+A2C}>lHCNWWU zaG>PLT#0Vv(q$)N)-6IvXa$R4ZGx={t1%-I*kC2ij+Cmcaq2Hn(gcA*S3}gwMvZ9Z z&3k<2@V{>L#{U3(n^#`rI6L;ZNGrCLQ*7De-yC_}wsh0<$c6<12@pLeoC%RQk+_IH zAR07Q>`K+W?xqNe8k3lV;|wiM9XocqUC&&U`yVtpFPsWUn^2Csvj}#`@T;nPoKl}-nUFBTEd;Ad@ojpul&mp8G?!oPQ^1*n_`(qoFU0zg=Vf{-5vu{jpQ60q;A{ zz{o8Fk|h?tG5-Jy_}i=xp#zOj+Q;io7_7e>3k#(ONh(&1qmp?Xt_`?h*W4(wb&8o1ZKO>0ujXa$8ZaW19F~TzL=6EbZdA4zs@r? zlV}txO(uNE0Hfg#uaBoc>GF@d^z*Ey#`3ua!&@gY;|NjsS$aWM_F1e_`57XZ5UdZO zO&7>eiFQNKD1(ynu7`43sgMpDsoAS^Ssh}cHdhrEMM7MXc%{|OIAK*nGyY>~2^Eds zM!sa$hrSO`cBl4l$xy-ZC#c1aYDnXy;p!gOd>YYsP{r)s7VdCH0&lWUW)|aQ;;aePApiW zG*rr^$_OGAh@ikCA+gRGMcsq|GByjEWe4&PU~ROkryT_HgE$@Zv;7q`FZrPFh z^Q>P`#qIpfcMMk>56?bxVNBi$00)v`;B~vgvzK6=a-8s7D*`CSdYjl{N$GvUq%Bmpp3L|&+S;B52l1q5gb z5;U3ho}Tq>>VuKt<|Z7QoQA+{hkP=rDp4qE3tTu(?EtVRGO z7E1@DRnVZiojcQgNN+DUbvRS&=$~u|RYD*;JA>(mpM*uEm0w2^P%QJYT0H;*4vx&E zc$W`%Iu$ET%tWK0B26KWTo9`p)5nb9Ew*X`a?`7pJwVmF6aMAET9+-*4)-;IyPWiZ zBcZDpD>^VhtCj!?80OZeMuQ`;2cXBGP9P#t4l28ELwHbQNwN^$04z4(Kf}075w#+1 za73ab!fbwj(?gbGUcT6_gXeg+bK4bpSKsOV^N98GBK^;-RJB2B61+m;;O1cvh&r9& zAife_w0k!%zBnYxaZ|)wY9I_~z(TP}!-%9?MZLE*Xl7`~-FQtYqOin33=WkrnJEy9 zfu}qZkPU6O4fEZPbja?jcUB!SNJw%hqIYm~QH=yizf6v2Uj|Dw00mINyGBtr8tC~m zSWkQ2@PV(=U_dAj2#EV9&_X=R`R4%lJwNYwI3yk~1;iUOn2R*0{^KL6aTpyb9!&~G zL?O0dOW#i|;EkU?!BO+24UtX2^>CPwM7H6up&M-@y572_uLdnqRlU{CAs5uIz;}ow zVvvYm6B*DLM!TLc>a7qHN2|sf^~F4gD%0(OoyP#9-`f}mflBBJziEuBsVkHOJC)-I z^Qfp!07$CZ@Nlt{MtlO3WMG6K3}upG zOk7+9eDX0%X%Zl#2CqYFyclsDtmgro0g5vEO$>xwt4kolOedzK9d>TvKgRLv{z?V@ z`(jQv{qu|KU!1Q!-}#GG^NBruv2Pmn?*O%_{pTs!vC&{7hXGD zj6Df45cxqng6+`qag@pnMAKP{wH#LmE`7uleWb0LTrnyn5=dPTIL(0vf^Sn}UYy|+ zmaZ?C<%Us`cvo`$!+Dz3!SU1Q@vNq|d;Kz0hFj_J zR^bS@F1IXp5g;L39x=vM0>vC0nCGrCniy@>-N|1#gNHBhHGBr}gS1T{ctMnvBG&L8*mlJgstC;$yhddb6`zBkgc>bV zc`C1O!EFsm{U&1Y5FukmH`t-I0@F@>2tHF>>|9i<7d9McFIPZm^%{=UV2=k}d=iYQ z(pf*`(n`9-^?5Y41@7n0C4E6oqr!#&NRl+0UBMD^t|F{p1@n|k$W?br@Zey$1T>Dg zS(`9&j>1%s`6Vx|7smauXC}MfSDc1U{QhM6ti+zPoLhM7;xxrp_xgK%67KtD`eM0R z?ZMV0<8RJP))RdJ>fn#!De;q0ZuUfuLZ=#(l{cIqsahe&8%|aC^2fOP!C06JZo%x^ z1WYy&?=%$^MP{~4F;Pne;68IgUUfWZb*z{$C|?6h3OWeGa0ME4;(osXF*tf_!-Qx< zY7}G%!Vg>pA!=P+8NJAcWBJKf3?J9Lxf^Uk5T-N&pG0PTR|(K&5K@c32>$>R9j{mJ530}!`e383 z#}w&e6dB2m(d>}dk=55}hYEw&q8J>Rg|V^^7iyISOQxC=VDXsF^1A$`r!s>{;+Dj{24YNqpwG>zk1CH36@^W}Bht6#%dfrg4BrR0mECA%&XYH;Njx zAcJ)y36%4{=cg3+J+*@}`|%Gk{+({{R@D4o9c==O?ex zGs@>%A@|Q`pC{iDQitU++}jT|#qHtnYrSH0rxJQPZV=J>3CD*Tw$`u`h>;TxecSyC zMwHG2HG#;4kc8fxlxGdz5->5TO{J=yWWvBuTB!6UC@O9RM@?Amac5T7YrRR825hLN zgLkdv+bXcTE}MgtMv=wX`Y~v2cBu}bH-c3VQUP~0=HPTOz)-2XaC?9VD2aE7UoIq| zMv$uL!36ipclbp%ZrBKT>4!y*xFXedrtn-zT&s44gKZcyu2`z-=mZYxn00 z)8E?R6GRwM3akujFgQS_Sl^cf1RW)^cw%BcPk1d!LB zwj#SJ3qNyUw;Jbq63#%F66Ffq8nppUYW~Izg{31U2pgn@5t=g|5g2AgMv|_f9DL~B zdKQL&2WtwgkPf3Dz(%&FRv&eG7YG2W?ik^dDQ{o^FGjW;MkxbE=PXVj9purr3$#K3 zt?q7DGKVYB#A9Z0ct`-moD5nVZ@f3043!cGese^egM(Z!jY%C+?gw?iQ7&W>Rxov0 zOfRq6S+LRM4YXi3ufb+uWJiRb>KUhg&+m)Bd{BSA`e!(xlbRXF=XiyRYfJj z+r|{hPPgpmJg{c_;K>oW?Bv&2L@pymB;kZcii1;p8q2Z`Xa}w17*GX7)8APX8z2R| zjhN>%^px2ieRA2QB5>oM@3t^QJ1f2w_Q0sX9#A%ACP!JQ4Cu5mjd%g%^9-pv3DRn5 zuh$+Vf^tDG0Njbl1S8ZM&o>OLHpy((E^3^=2Bi?7(Rq=(xMt%6P+o!JAkLl?Y-+mI6Kj<3eKwdQrO7(RLNQ zICy@B#6ZHduC!svGfX2uIjdkh&G5^mJgrTLaT%i}NINe}IKA@X*)(pnR+kR?h6<|y z(*^m#pPP4tWJIwIrUYxzjJ9&G5Q>csTgM}AK&m#7Ol>p>T^HYBk*RP~hYfenp|96H zPH^A+-}t2CzPt7M#bG@A_lpPn#_?D5#;SCFxmDck@jK3H4}QDI+b8S&xPT2m4r>!l z`_2iDpd?e2aVWk;4T0EWO*hHD90(Cjg*f;1!J#*Zcy8QuYlz*wOhjbtAUx7#Qj{^5 z3`eYSCMqJ0cALaYOHSze`hQ%ph*SlyJN@!I#96>^N1P%71$7l!+VSsz@SP<#)F{tv zoD+K?*(2&bU?8N~UVRdNxncP7yd@KR6E>%T&f}DoZTgtIrAbhAqWN!I$Eu2<5G^I8 zyAzxin_8zpqD`SemTc6z2>b+tM6PB*$x<~y*KAF`*rG>ZSsvEC2)C?6Cib_!7!W0DpUFT{YcFcpuJH^ME0mfF z9_I6v_8Kit6{7u*pg_6>944C!@p1^5{sa&&N$x#kA{@oI^N6${fW_9uej|yaM(1?N zVz5N_HQ4Q~$+XKDJp5s^(dWi4_?WgEnAmA|xsZUis!?@@0C15^P94vjVP*BaO-ZC6 z{A6{V3>YVTs2}Af4Q>5=uEu`|*xPtz8A>_wkX=XnwvF7q-;Dd$*-UqIoz*#Y*LJrW&#j*oMA!^aj;ma}`m*Eu49NQ2Tjc6i7iuYQEXOK3*IBD_{IPjSJt$J3I8FhVv1lvql6H`939@F7Td zwoRbMY2G5RuGhWWkL%PKzzxNAz+L_?nfbac|+*=_{y?0 zX&b~wEJ%*<#;_VQ;<+~fGf_N3OIfY1s_}doa_^KoqKe+7*7^`iPC6vMw7&e(%$h;E~g$1)q5?JQ4 z7Uc-)sAPiGxe|Z~Ku)kgfUS*HN9WEkAXM?i=H4@EtU+BbONxUCf|F+rPk!=DOC7Mb zE+T5x8?57lBZvdG_;rX317kx*^YPh?torf5<*4;QNfiruC>OE3;+IRCa%{1E*!e!+ zJz@xQF!sStHHVS*{xA>m&b~6I49Iu;{&Fwpm$b3oxZiku z&Yo^E_)Dqx!$oIH#>c*J8$m~}TfBClgnw;i+NN?nD3j*r8j8v?a_i?5q2c79hX<}U zumi}!D`ssod+4NtBZUV>hc8?;IYqE&?9=U%!Bj>9d+P#`bwRsJ&mOr=1E4iA9cN;& zD+^j^Rx5MsVYE7^d<+Aj$v~HDE3TCNGn%MWmP+jsd6@{flxRkPC3yJrf!u?md#M$2 z14Pm2O4yS`sYBg%7E&pMW}Q)3I5EoSM7C4eq-|~-i0T4DC(*&G;R8kC3r@cnfRch$ zavx!?F~Lk5QFw9jw;mT7>qsn4e3_w7#^OgSLJm(Nkw1Eua>EAlu3dL_8*Jk}QWdo_? z4lv_wHOv4ezZrz<>Q;ipn75Yv!J`=$fHDQ6*}U1>fiv|N)b-4r+A7H zq`gmEBHua*UTQvfaGE$BXrj$tuuue7fo#t?GASN8=GHmz%vB3)D^x>D?*{8Tch&UG8RcODnPuvbJ2voyG%7lXQx@nF7^g%bkOV0El28Z8*M>9 zM-~X?aHo*L`(>c7v;-s(5}S^boOnB}B|8-HCXZae_Ji4h2uKF#-aGv<=p5a} zyq|nzRGl17fn>c$o!6Bs* z9rEi4vJTn%xX=x@Pg~Y-G(6-zl>Y$S9?gHvU@-pxonfZ_IQ-yMKXQHl0Le(+DsSw+ zQ?GB+3*$%pbCCZ4-(v%8 z>V*9;Bd4Ac{jj~Sn2vkyA6z!*-=~e>@(1ISlH6sb8)3M0hN5jZJvnkpleoNK5Cqty zy8Us!gpYvp{c%IYaHha}%5q?+Bcn`tba#syynsaHa;N z?fK0BvtW10#`B4}@6&m|K!7vj9{v9S8q4R~#{Pb{`_`E6E~&r2wpnkVO=}ubYvg_0 zT>w z6!VI=MzksJpWl2863PdF6S0+$hX$er6w<7s6_InuF*VuxUpaignpIH?MQe=C<$%0| z9SlA271|j+Z(HYh=Zq%7eMcbm&l6}~&mJ-I*GTC{!=IPq4gd}W1ndr`0UqAX-=;== zjd7>9Bgk*FTf3h)e4&8U<~%8b(rDn17kTZTw?xF&tPgPaaCz4y;`4@1ctUlp8p&&o z&L`Z?E+Og9#vX;){{Wf#Vf#O(EpuVweL-(M8{{>+_se%1x7hf`{B`_h&rZC2Kj686 z>g#vZ`fPE0Y3Cg=>t8`f&t3jLh+F+nTvgD&XMOC+dcXUK@%hURf4@28J)inyc5&v%JdU*vPpIp?2%&j5A9^MX+4oICsg``Rkv2yW$4{+s170vUq_L1mlgGbw>bk`rp$zYsYS_mtRw&x@?{C{+Ewl zz4`AQcd4#;Nul~EP1joIj9a(p?@@Spo#?qu>udJ&^nQLbR@!kG>i_@{00{szOhM-n z=4uu1oJl{AxqzRWKaA;q{{Y3#LiG92_TU_Su5I!+u01j5&wA%~&TM<^mq$Csx2KcW z#v(@S?nhmj#{s&Zu;7goel-qpMw|Hk@MPpHPexN8AiYFw^~YSoz@P~7c5|OF@e)3< zdehDYu&25or$D5mW--nY#Vw|iJlF+{f&oA$v~Y=n6bfew-Ufm5<{8$G5&ba^rRAG_aP|KHVqxNS zx4rj-$9G74?)!Iz!L;HhzVJP!{=_B(_)U16VXieepL`oS)jJv=TJztW4kWeL>VKWa z16;KpP2c>^cl7H1@89Wq%PyDWMATesd*#&ktj@2~*VC>2uwC&rJ9q1ekW#&caY>CgUTk`1q~J`7PP zM1TS9oQm@BymV(hk6X90;-3e%wrodpT6*Kt68BNjzqQ9fTPBV1c+OazkRH0281dRc zTH0*k$Uz8>;%L@u8Uku8GzX?315(Qf^jHa|#oi%I28qPS^HN@l$uA&U9npvs{|* zIrsV`WZ_2|()#>E=>eyS@td13qd#0tOa10!{q~yrrRUShkBmO|j`D9j)_)ff7z=$k z#O_%K-1fwd{9k<-)b#%IjW3^E*{?l^4o~0vtbMP8`{|VsGfC@>Vo}zUtu4u(zH_%5 z@!o5|JN$FrOR%HsJH$b$ zd*hySWUB{*&H=s~+0pHST;4VN?-NRP9Qmm*4t;%nlHqOWKjt3O$NqnTChxzBXqm3# J;_W^&|JkJZ*IfVr literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/01-architecture.mdx b/versioned_docs/version-v0.22.4/docs/05-Concepts/01-architecture.mdx new file mode 100644 index 0000000..709960e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/01-architecture.mdx @@ -0,0 +1,155 @@ +--- +slug: /architecture +title: Architecture +sidebar_position: 1 +--- + +# Architecture + +The metal-stack is a compound of microservices predominantly written in [Golang](https://go.dev/). + +This page gives you an overview over which microservices exist, how they communicate with each other and where they are deployed. + +## Target Deployment Platforms + +For our environments, we chose to deploy the metal-stack into a Kubernetes cluster. This means that also our entire installation was developed for metal-stack being run on Kubernetes. Running applications on Kubernetes gives you a lot of benefits regarding ease-of-deployment, scalability, reliability and so on. + +However, very early we decided that we do not want to depend on technical Kubernetes functionality with our software (i.e. we did not implement the stack "kube-native" by using controllers and Kubernetes CRDs and things like that). With the following paragraph we want to point out the reasoning behind this "philosophical" decision that may sound conservative at first glance. But not relying on Kubernetes technology: + +- Makes deployments of the stack without Kubernetes theoretically possible. + - We believe that cloud providers should be able to act beneath Kubernetes + - This way it is possible to use metal-stack for providing your own Kubernetes offering without relying on Kubernetes yourself (breaks the chicken-egg problem) +- Follows an important claim in microservice development: "Be agnostic to your choice of technology" + - For applications that are purely made for being run on Kubernetes, it does not matter to rely on this technology (we even do the same a lot with our applications that integrate the metal-stack with Gardener) but as soon as you start using things like the underlying reconciliation abilities (which admittedly are fanstatic) you are locking your code into a certain technology + - We don't know what comes after Kubernetes but we believe that a cloud offering should have the potential to survive a choice of technology + - By this decision we ensured that we can migrate the stack to another future technology and survive the change + +One more word towards determining the location for your metal control plane: It is not strictly required to run the control plane inside the same data center as your servers. It even makes sense not to do so because this way you can place your control plane and your servers into a different failure domains, which makes your installation more robust to data center meltdown. Externally hosting the control plane brings you up and running quickly plus having the advantage of higher security through geo-distribution. + +## Metal Control Plane + +The foundation of the metal-stack is what we call the _metal control plane_. + +The control plane contains a couple of essential microservices for the metal-stack including: + +- **[metal-api](https://github.com/metal-stack/metal-api)** + The API to manage control plane resources like machines, switches, operating system images, machine sizes, networks, IP addresses and more. The exposed API is an old-fashioned REST API with different authentication methods. The metal-api stores the state of these entities in a [RethinkDB](https://rethinkdb.com/) database. The metal-api also has its own IP address management ([go-ipam](https://github.com/metal-stack/go-ipam)), which writes IP address and network allocations into a PostgreSQL backend. +- **[masterdata-api](https://github.com/metal-stack/masterdata-api)** + Manages tenant and project entities, which can be described as entities used for company-specific resource separation and grouping. Having these "higher level entities" managed by a separate microservice was a design choice that allows to re-use the information by other microservices without having them to know the metal-api at all. The masterdata gets persisted in a dedicated PostgreSQL database. +- **[metal-console](https://github.com/metal-stack/metal-console)** + Provides access for users to a machine's serial console via SSH. It can be seen as an optional component. +- **[nsq](https://nsq.io/)** + A message queuing system (not developed by the metal-stack) used for decoupling microservices and distributing tasks. + +The following figure shows the relationships between these microservices: + +![Metal Control Plane](./assets/metal-stack-control-plane.svg) + +> Figure 1: The metal control plane deployed in a Kubernetes environment with an ingress-controller exposing additional services via [service exposal](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/). + +Some notes on this picture: + +- Users can access the metal-api with the CLI client called [metalctl](https://github.com/metal-stack/metalctl). +- You can programmatically access the metal-api with [client libraries](../03-For%20Users/01-client_libraries.md) (e.g. [metal-go](https://github.com/metal-stack/metal-go)). +- Our databases are wrapped in a specially built [backup-restore-sidecar](https://github.com/metal-stack/backup-restore-sidecar), which is consistently backing up the databases in external blob storage. +- The metal-api can be scaled out using replicas when being deployed in Kubernetes. + +## Partitions + +A _partition_ is our term for describing hardware in the data center controlled by the metal-stack with all the hardware participating in the same network topology. Being in the same network topology causes the hardware inside a partition to build a failure domain. Even though the network topology for running the metal-stack is required to be redundant by design, you should consider setting up multiple partitions. With multiple partitions it is possible for users to maintain availability of their applications by spreading them across the partitions. Installing partitions in multiple data centers would be even better in regards of fail-safe application performance, which would even tolerate the meltdown of a data center. + +:::tip +In our setups, we encode the name of a region and a zone name into our partition names. However, we do not have dedicated entities for regions and zones in our APIs. + +A **region** is a geographic area in which data centers are located. + +**Zones** are geographic locations in a region usually in different fire compartments. Regions can consist of several zones. + +A zone can consist of several **partitions**. Usually, a partition spans a rack or a group of racks. +::: + +We strongly advise to group your hardware into racks that are specifically assembled for running metal-stack. When using modular rack design, the amount of compute resources of a partition can easily be extended by adding more racks to your partition. + +:::info +The hardware that we currently support to be placed inside a partition is described in the [hardware](../04-For%20Operators/01-hardware.md) document. +::: + +:::info +How large you can grow your partitions and how the network topology inside a partition looks like is described in the [networking](../05-Concepts/03-Network/01-theory.md) document. +::: + +The metal-stack has microservices running on the leaf switches in a partition. For this reason, your leaf switches are required to run a Linux distribution that you have full access to. Additionally, there are a servers not added to the pool of user-allocatable machines, which are instead required for running metal-stack and we call them _management servers_. We also call the entirety of switches inside a partition the _switch plane_. + +The microservices running inside a partition are: + +- **[metal-hammer](https://github.com/metal-stack/metal-hammer)** (runs on a server when not allocated by user, often referred to as _discovery image_) An initrd, which is booted up in PXE mode, preparing and registering a machine. When a user allocates a machine, the metal-hammer will install the target operating system on this machine and kexec into the new operating system kernel. +- **[metal-core](https://github.com/metal-stack/metal-core)** (runs on leaf switches) Dynamically configures the leaf switch from information provided by the metal-api. It also proxies requests from the metal-hammer to the metal-api including publishment of machine lifecycle events and machine registration requests. +- **[pixiecore](https://github.com/danderson/netboot/tree/master/pixiecore)** (preferably runs on management servers, forked by metal-stack) Provides the capability of PXE booting servers in the PXE boot network. +- **[metal-bmc](https://github.com/metal-stack/metal-bmc)** (runs on management servers) Reports the ip addresses that are leased to ipmi devices together with their machine uuids to the metal-api. This provides machine discovery in the partition machines and keeps all IPMI interface access data up-to-date. Also forwards metal-console requests to the actual machine, allowing user access to the machine's serial console. Furthermore it processes firmware updates and power on/off, led on/off, boot order changes. + +![Partition](./assets/metal-stack-partition.svg) + +> Figure 2: Simplified illustration of services running inside a partition. + +Some notes on this picture: + +- This figure is slightly simplified. The switch plane consists of spine switches, exit routers, management firewalls and a bastion router with more software components deployed on these entities. Please refer to the [networking](../05-Concepts/03-Network/01-theory.md) document to see the full overview over the switch plane. +- The image-cache is an optional component consisting of multiple services to allow caching images from the public image store inside a partition. This brings increased download performance on machine allocation and increases independence of a partition on the internet connection. + +## Complete View + +The following figure shows several partitions connected to a single metal control plane. Of course, it is also possible to have multiple metal control planes, which can be useful for staging. + +![metal-stack](./assets/metal-stack-architecture.svg) + +> Figure 3: Reduced view on the communication between the metal control plane and multiple partitions. + +Some notes on this picture: + +- By design, a partition only has very few ports open for incoming-connections from the internet. This contributes to a smaller attack surface and higher security of your infrastructure. +- With the help of NSQ, it is not required to have connections from the metal control plane to the metal-core. The metal-core instances register at the message bus and can then consume partition-specific topics, e.g. when a machine deletion gets issued by a user. + +## Machine Provisioning Sequence + +The following sequence diagram illustrates some of the main principles of the machine provisioning lifecycle. + +![provisioning sequence](./assets/provisioning_sequence.svg) + +> Figure 4: Sequence diagram of the machine provisioning sequence. + +Here is a video showing a screen capture of a machine's serial console while running the metal-hammer in "wait mode". Then, a user allocates the machine and the metal-hammer installs the target operating system and the machine boots into the new operating system kernel via the kexec system call. + +export function MachineAllocationYT(){ + return

+ +
+} + + + +## Offline Resilience + +It is possible to use metal-stack without any external network dependencies by integrating your own DNS and NTP configuration into the stack. This feature is great for workloads requiring strong independence and reliability. Even in case of an internet connection failure, your infrastructure remains operational. Existing machines do not encounter any downtime as well as new machines can be provisioned. All you need to have in place is a DNS and NTP server configured and accessible for metal-stack. + +NTP servers need to be configured on the pixiecore and the metal-hammer microservices. This can be achieved by providing a list of NTP servers with the following Ansible variable through metal-roles: + +```yaml +pixiecore_metal_hammer_ntp_servers: [] +``` + +In the background, the pixiecore is taking the NTP servers and passing it via the `MetalConfig` to the metal-hammer. When booting bare-metal servers, the metal-hammer needs to configure NTP servers. It recognises the ones from the `MetalConfig` and configures itself accordingly. +If no NTP servers are passed along, the following standard servers are used: + +- 0.de.pool.ntp.org +- 1.de.pool.ntp.org +- 2.de.pool.ntp.org + +Moreover, machine and firewall images need to be configured with your custom DNS and NTP servers. The customisation can be made via the fields `ntp_servers` an `dns_servers` and specifying a list of servers in the creation request for the machine or firewall. + +Within a partition default values for DNS and NTP servers can be configured. They are applied to all machines and firewalls within this partition, but can be replaced by specifying different ones inside the machine allocation request. + +Thus, for creating a partition as well as a machine or a firewall, the flags `dnsservers` and `ntpservers` can be provided within the `metalctl` command. + +In order to be fully offline resilient, make sure to check out `metal-image-cache-sync`. This component provides copies of `metal-images`, `metal-kernel` and `metal-hammer`. + +This feature is related to [MEP14](../../contributing/01-Proposals/MEP14/README.md). diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/02-user-management.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/02-user-management.md new file mode 100644 index 0000000..f1ee277 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/02-user-management.md @@ -0,0 +1,67 @@ +--- +slug: /user-management +title: User Management +sidebar_position: 2 +--- + +# User Management + +At the moment, metal-stack can more or less be seen as a low-level API that does not scope access based on projects and tenants. +Fine-grained access control with full multi-tenancy support is actively worked on in [MEP4](../../contributing/01-Proposals/MEP4/README.md). + +Until then projects and tenants can be created, but have no effect on access control. + +## Default Users + +The current system provides three default users with their corresponding roles: + +- **Metal-Admin** is an **Admin** can perform all actions. +- **Metal-Edit** has the **Edit** role and may create, edit and delete most resources. +- **Metal-Viewer** is a **Viewer** and may only view resources and may access machines. + +Each of these users have a corresponding [HMAC](https://en.wikipedia.org/wiki/HMAC) token, which can be used to authenticate against the API. The tokens do not expire and can be used as long as the service is running. Be cautious with who you share the tokens with. + +## OIDC + +Currently the only way to act as a different user than the default ones, is by using OIDC authentication. Here the OIDC provider decides which role the user has. + +## Role Mapping + +The following table shows which role is required to access the endpoints of the various services at a high level. +Only the minimum role required to access the group of endpoints is shown. For the more in-depth documentation of all endpoints, head over to the [API documentation](../08-References/Control%20Plane/metal-api/metal-api.md). + +| **Service** | **Group of Endpoints** | **Minimum Role** | +| ------------------------------- | ------------------------------- | ---------------- | +| **audit-service** | Reading audit traces | Viewer | +| **filesystem-service** | Reading filesystem layouts | Viewer | +| | Managing filesystem layouts | Admin | +| **firewall-service** | Reading firewalls | Viewer | +| | Allocating firewalls | Editor | +| **firmware-service** | All endpoints | Admin | +| **image-service** | Reading images | Viewer | +| | Managing images | Admin | +| **ip-service** | Reading IPs | Viewer | +| | Managing IPs | Editor | +| **machine-service** | Reading machines and issues | Viewer | +| | Managing machines and issues | Editor | +| | IPMI operations | Editor | +| | Updating, deleting machines | Admin | +| | Updating firmware | Admin | +| **network-service** | Reading networks | Viewer | +| | Allocating and freeing networks | Editor | +| | Managing networks | Admin | +| **partition-service** | Reading partitions | Viewer | +| | Managing partitions | Admin | +| **project-service** | Reading projects | Viewer | +| | Managing projects | Admin | +| **size-service** | Reading sizes | Viewer | +| | Managing reservations | Editor | +| | Managing sizes | Admin | +| **sizeimageconstraint-service** | Reading size image constraints | Viewer | +| | Managing size image constraints | Admin | +| **switch-service** | Reading switches | Viewer | +| | Managing switches | Admin | +| **tenant-service** | Reading tenants | Viewer | +| | Managing tenants | Admin | +| **user-service** | Getting user information | Viewer | +| **vpn-service** | Getting VPN auth key | Admin | diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/01-theory.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/01-theory.md new file mode 100644 index 0000000..658a3f4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/01-theory.md @@ -0,0 +1,762 @@ +--- +slug: /networking +title: Networking +sidebar_position: 1 +--- + +# Networking + +We spent a lot of time on trying to provide state-of-the-art networking in the data center. This document describes the requirements, ideas and implementation details of the network topology that hosts the metal-stack. + +The document is separated into three main sections describing the constraints, theoretical ideas and implementation details. + +## Requirements + +Finding the requirements for this greenfield project was kicked off with a handful of design parameters that included: + +- Investigation of the idea of a **layer-3 based infrastructure** to overcome the drawbacks of traditional layer-2 architectures. +- Application of a routing technology that involves a single stand-alone protocol **BGP** for operational simplicity. +- Utilization of the overlay virtual network technology **EVPN** to support cost-effective scaling, efficient network information exchange and a manageable amount of administration effort. +- Applying the routing topology on top of a completely new physical infrastructure that is designed as a CLOS network topology. + +Evaluation of those parameters led to more specific requirements: + +- Physical Wiring: + - The data center is made of a leaf-spine CLOS topology containing: + - leaf switches + - spine switches + - exit switches + - management server + - management switch + - tenant servers + - tenant firewalls. + - Bare metal servers are dual-attached to leaf switches. The bare metal servers either become tenant servers or firewalls for a group of tenant servers. + - All network switches are connected to a management switch. A management server provides access to this management network. +- Network Operation Characteristics: + - IPv4 based network. + - No IPv6 deployment. + - Utilization of external BGP. + - Numbered BGP only for peerings at exit switches with third parties (Internet Service Provider). + - Overall BGP unnumbered. + - 4-byte private ASN instead of default 2-byte ASN for BGP. + - Network operation relies on SONiC Linux. + - Bleeding edge Routing-to-the-Host/EVPN-to-the-Host with ordinary Linux distributions. + - Layer-3 routing using BGP and VXLAN/EVPN. + - Every VTEP acts as a layer-3 gateway and does routing. Routing is done on both the ingress and the egress VTEP (aka distributed symmetric routing). + - Tenant isolation is realized with VRF. + - Internet Access is implemented with route leak on the firewall servers and during the PXE-Process with route leak on the exit switches. + - MTU 9216 is used for VXLAN-facing interfaces, otherwise MTU 9000 is used. + +Furthermore, requirements such as *operational simplicity* and *network stability* that *a small group of people can effectively support* have been identified being a primary focus for building metal-stack. + +## Concept + +The theoretical concept targets the aforementioned requirements. New technologies have been evaluated to apply the best solutions. The process was heavily inspired by the work of Dinesh G. Dutt regarding BGP ([bgp-ebook](https://www.nvidia.com/en-us/networking/border-gateway-protocol/)), EVPN ([evpn-ebook](https://www.nvidia.com/en-us/networking/evpn-ebook/)) and the his 2019 work "[Cloud Native Data Center Networking](https://www.oreilly.com/library/view/cloud-native-data/9781492045595/)" (O'Reilly), which teaches some interesting basics. + +External BGP together with network overlay concepts as EVPN can address the essential demands. These revolutionary concepts are part of the next evolutionary step in data center design. It overcomes common issues of traditional layer 2 architectures (e.g. VLAN limitations, network visibility for operations, firewall requirements) by introducing a layer 3 based network topology. + +### CLOS + +A CLOS topology is named after the pioneer Charles Clos (short: **CLOS**) who first formalized this approach. CLOS defines a multistage network topology that is used today to improve performance and resilience while enabling a cost effective scalability. A CLOS topology comprises network switches aggregated into spine and leaf layers. Each leaf switch (short: **leaf**) is connected to all spine switches (short: **spine**) but there is no direct leaf-to-leaf or spine-to-spine connection (See: picture 1). + +![2 Layer CLOS Topology](2-layer-leaf-spine.svg) + +> Picture 1: Fragment of CLOS to show leaf-spine layer. + +This data center network architecture, based on a leaf-spine architecture, is also know as "two-tier" CLOS topology. + +![3 Layer CLOS Topology](3-layer-leaf-spine.svg) + +> Picture 2: Fragment to show a 3-stage, 2-layer CLOS topology. + +Tenant servers are dual-attached to the leaf layer in order to have redundancy and load balancing capability (Picture 2). The set of leaves, spine switches and tenant servers define stages. From top down each server is reachable with 3 hops (spine -> leaf -> server). This is why that CLOS design is called a 3-stage CLOS. Consistent latency throughout the data center are an outcome of this design. + +It is not only important to have a scalable and resilient infrastructure but also to support planning and operation teams. Visibility within the network is of significant meaning for them. Consequently layer-3 routing in favor of layer-2 bridging provides this kind of tooling. + +### BGP + +For routing the **Border Gateway Protocol (BGP)**, more specific: External BGP was selected. Extensive testing and operational experiences have shown that External BGP is well suited as a stand-alone routing protocol (see: [RFC7938](https://datatracker.ietf.org/doc/html/rfc7938)). + +Not all tenant servers are connected to the same leaf. Instead they can be distributed among any of the leaves of the data center. To not let this detail restrict the intra-tenant communication it is required to interconnect those layer-2 domains. In the context of BGP there is a concept of overlay networking with VXLAN/ EVPN that was evaluated to satisfy the needs of the metal-stack. + +#### BGP Unnumbered + +In BGP traditionally each BGP peer-facing interface requires a separate IPv4 address. This consumes a lot of IP addresses. [RFC 5549](https://datatracker.ietf.org/doc/html/rfc5549) defines the BGP unnumbered standard. It allows to use interface's IPv6 link local address (LLA) to set up a BGP session with a peer. With BGP unnumbered the IPv6 LLA of the remote is automatically discovered via Router Advertisement (RA) protocol. Important: This does not (!) mean that IPv6 must be deployed in the network. BGP uses [RFC 5549](https://datatracker.ietf.org/doc/html/rfc5549) to encode IPv4 routes as reachable over IPv6 next-hop using the LLA. Having unnumbered interfaces does not mean no IPv4 address may be in place. It is a good practice to configure an IP address to the never failing and always present local loopback interface (lo). This lo address is reachable over BGP from other peers because the [RFC 5549](https://datatracker.ietf.org/doc/html/rfc5549) standard provides an encoding scheme to allow a router to advertise IPv4 routes with an IPv6 next-hop. BGP unnumbered also has an advantage from security perspective. It removes IPv4 and global IPv6 addresses from router interfaces, thus reducing the attack vector. + +To sum it up: + +- BGP unnumbered uses IPv6 next-hops to announce IPv4 routes. +- There is no IPv6 deployment in the network required. +- IPv6 just has to be enabled on the BGP peers to provide LLA and RA. + +*In External BGP, ASN is how BGP peers know each other.* + +#### ASN Numbering + +Within the data center each BGP router is identified by a private autonomous system number (ASN). This ASN is used for internal communication. The default is to have 2-byte ASN. To avoid having to find workarounds in case the ASN address space is exhausted, a 4-byte ASN (see [RFC 6793](https://datatracker.ietf.org/doc/html/rfc6793)) that supports up to 95 million private ASNs (4200000000–4294967294, see [RFC 6996](https://www.rfc-editor.org/rfc/rfc6996.html)) is used from the beginning. + +ASN numbering in a CLOS topology should follow a model to avoid routing problems (path hunting) due to it's redundant nature. Within a a two-tier CLOS topology the following ASN numbering model is suggested to solve path hunting problems: + +- Leaves have unique ASN +- Spines share an ASN +- Exit switches share an ASN + +A illustrated example of the background of this architecture decision can be inspected in the chapter "BGP’s ASN Numbering Scheme" ("BGP’S PATH HUNTING PROBLEM") of the previously mentioned "Cloud Native Data Center Networking" book. + +To summarize that, one can say: Since all nodes receive or know the physical connection status of all other nodes in the network, the nodes potentially have routing information that they do not know whether they still have up to date, since it takes some time before they are fully distributed in the network. +Routes to nodes may actually no longer exist (because not a single link to the node, but the node itself has failed) or the path may have changed. To determine how and whether a particular node can be reached, a path search must therefore be carried out at all its communication partners or BGP routers. +Essentially, the sharing of ASNs reduces the transmission of incorrect or outdated path information (this reduces path transmissions and calculations and thus saves resources). + +#### Address-Families + +As stated, BGP is a multi-protocol routing protocol. Since it is planned to use IPv4 and overlay networks using EVPN/VXLAN several address-families have to be activated for the BGP sessions to use: + +- IPv4 unicast address-family +- L2 EVPN address-family + +### EVPN + +Ethernet VPN (EVPN, see [RFC 7432](https://www.rfc-editor.org/rfc/rfc7432.html)) is an overlay virtual network that connects layer-2 segments over layer-3 infrastructure. EVPN is an answer to common problems of entire layer-2 data centers. + +#### The necessity of EVPN + +Challenges such as large failure domains, spanning tree complexities, difficult troubleshooting and scaling issues are addressed by EVPN: + +- **administration**: less routers are involved in configuration (with VLAN every switch on routing-paths needs VLAN awareness). The configuration is less error prone due to the nature of EVPN and the good support in FRR. +- **scaling**: EVPN overcomes scaling issues with traditional VLANs (max. 4094 VLANs). +- **cost-effectiveness**: EVPN is an overlay virtual network. Not every switch on the routing path needs EVPN awareness. This enables the use of standard routers (in contrast to traditional VLAN); e.g.: spine switches act only as EVPN information replicator and do not need to have knowledge of specific virtual networks. +- **efficiency**: EVPN information is exclusively exchanged via BGP (Multiprotocol BGP, see [RFC 4760](https://datatracker.ietf.org/doc/html/rfc4760)). Only a single eBGP session is needed to advertise layer-2 reachability. No other protocols beneath BGP are involved and flood traffic is reduced to a minimum (no "flood-and-learn", no BUM traffic). + +Virtual routing permits multiple network paths without the need of multiple switches. Hence the servers are logically isolated by assigning their networks to dedicated virtual routers using virtual routing and forwarding (short, **VRF**, see [Linux Virtual Routing and Forwarding](https://docs.kernel.org/networking/vrf.html) and [SONiC VRF support](https://github.com/sonic-net/SONiC/blob/master/doc/vrf/sonic-vrf-hld.md)). + +#### The operation of EVPN + +EVPN (technology) is based on BGP as control plane protocol (underlay) and VXLAN as data plane protocol (overlay). + +As EVPN is an overlay network, only the VXLAN Tunnel End Points (VTEPs) must be configured. In the case of two-tier CLOS networks leaf switches are tunnel endpoints. + +As described earlier, a dedicated VRF is used for each new tenant. VRF enables true multi-tenancy/isolation for routing tables. This is why the same ip-addresses or -networks can be used for tenants with different meanings without collisions or conflicts. + +In EVPN routing is assumed to occur in the context of a VRF. VRF enables true multitenancy/isolatation for routing tables. Therewith, VRF is the first step for EVPN configuration and there is a 1:1 relationship between tenant and VRF. + +To enable layer-2 connectivity, we need a special interface to route between layer-2 networks. This interface is called Switched VLAN Interface (SVI). The SVI is realized with a VLAN. It is part of a VRF (layer-3). + +The VTEP configuration requires the setup of a VXLAN interface. A VLAN aware bridge interconnects the VXLAN interface and the SVI. + +Required resources to establish the EVPN control plane: + +- VRF: because routing happens in the context of this interface. +- SVI: because remote host routes for symmetric routing are installed over this interface. +- VLAN-aware bridge: because router MAC addresses of remote VTEPs are installed over this interface. +- VXLAN Interface / VXLAN Tunnel Endpoint: because the VRF to layer-3 VNI mapping has to be consistent across all VTEPs) + +![EVPN VTEP](evpn-vtep.svg) + +> Picture 3: Required interfaces on the switch to wire up the vrf to swp 1 connectivity with a given vxlan + +Integrated routing and bridging (IRB) is the most complex part of EVPN. You could choose between centralized or distributed routing, and between asymmetrical (routing on ingress) or symmetrical (routing on ingress and egress) routing. We expect a lot of traffic within the data center itself which implies the need to avoid zigzag routing. This is why we go with distributed routing model. Further it is recommended to use the symmetric model since it makes the cut in most cases and has advantages in scalability (see "EVPN in the Data Center", Dinesh G. Dutt). + +### MTU + +In a layer-3 network it is important to associate each interface with a proper Maximum Transmission Unit (MTU) to avoid fragmentation of IP packets. Typical modern networks do not fragment IP packets and the introduction of VXLAN adds another additional header to the packets that must not exceed the MTU. If the MTU is exceeded, VXLAN might just fail without error. This already represents a difficult-to-diagnose connectivity issue that has to be avoided. + +It is common practice to set the MTU for VXLAN facing interfaces (e.g. inter-switch links) to a value of `9216` to compensate the additional VXLAN overhead and an MTU of `9000` as a default to other interfaces (e.g. server facing ports). The common MTU of `1500` is not sufficient for traffic inside a data center! + +### VRF + +Routing is needed for communication between VXLAN tunnels or between a VXLAN tunnel and an external networks. VXLAN routing supports layer-3 multi-tenancy. All routing occurs in the context of a VRF. There is a 1:1 relation of a VRF to a tenant. Picture 3 illustrates this. Servers A and B belong to the same vrf VRF1. Server C is enslaved into VRF2. There is no communication possible between members of VRF1 and those of VRF2. + +![Two routing tables](vrf-simple.svg) + +> Picture 4: Illustration of two distinct routing tables of VRF1 (enslaved: servers A and B) and VRF2 (enslaved: server C) + +To leaverage the potential and power of BGP, VRF, EVPN/VXLAN without a vendor lock-in the implementation relies on hardware that is supported by open network operating system: SONiC. + +## Implementation + +Implementation of the network operation requires the data center infrastructure to be in place. To implement a functional meaning for the parts of the CLOS network, all members must be wired accordingly. + +### Physical Wiring + +Reference: See the [CLOS overview picture](./01-theory.md#clos) + +| Name | Wiring | +| :-------------------------- | :-------------------------------------------------------------------------------------------- | +| Tenant server (aka Machine) | Bare metal server that is associated to a tenant. Dual-connected to leafs. | +| Tenant firewall | Bare metal server that is associated to a tenant. Dual-connected to leafs. | +| Leaf | Network Switch that interconnects tenant servers and firewalls. Connected to spines. | +| Spine | Network switch that interconnects leafs and exit switches. | +| Exit | Network switch that connects to spines and interconnects to external networks. | +| Management Server | Jump-host to access all network switches within the CLOS topology for administrative purpose. | +| Management Switch | Connected to the management port of each of the network switches. | + +![Physical Wiring](network-physical-wiring.svg) + +> Picture 5: This illustration shows an example of a suitable physical wiring inside a metal-stack partition. + +Tenant servers are organized into a layer called projects. In case those tenant servers require access to or from external networks, a new tenant server to function as a firewall is created. Leaf and spine switches form the fundament of the CLOS network to facilitate redundancy, resilience and scalability. Exit switches establish connectivity to or from external networks. Management Switch and Management Server are mandatory parts that build a management network to access the network switches for administration. + +To operate the CLOS topology, software defined configuration to enable BGP, VRF, EVPN and VXLAN must be set up. + +![Network VRFs across the different switch layers](network-vrfs.svg) + +> Picture 6: This illustration shows the VRF tenant separation and VRF termination happening on the firewall for the tenant VRF and external network VRFs. + +### Network Operating Systems + +SONiC as the network operating system will be installed on all network switches (leaves, spines, exit switches) within the CLOS topology. SONiC cannot be installed on bare metal servers that require BGP/EVPN but does not have a switching silicon. + +Components without a switching silicon are: + +- tenant servers +- tenant firewalls +- management server + +There exist two paradigms to use BGP and/or VXLAN/EVPN on non switching bare metal servers: **BGP-to-the-host** and **EVPN-to-the-host**. Both describe a setup of Free Range Routing Framework (see [frrouting.org](https://frrouting.org/)) and its configuration. FRR seamlessly integrates with the native Linux IP networking stacks. + +Starting with an explanation of the tenant server's BGP-to-the-Host helps to get an insight into the setup of the CLOS network from a bottom-up perspective. + +#### Tenant Servers: BGP-to-the-Host + +Tenant servers are dual-connected to leaf switches. To communicate with other servers or reach out to external networks they must join a BGP session with each of the leaf switches. Thus, it is required to bring BGP to those hosts (aka BGP-to-the-Host). Each tenant server becomes a BGP router (aka BGP speaker). + +BGP-to-the-Host is established by installing and configuring FRR. The required FRR configuration for tenant servers is limited to a basic setup to peer with BGP next-hops: + +```bash +# /etc/network/interfaces + +auto lo +iface lo inet static + address 10.0.0.1/32 + +auto lan0 +iface lan0 inet6 auto + mtu 9000 + +auto lan1 +iface lan1 inet6 auto + mtu 9000 +``` + +> Listing 1: Network interfaces of a tenant server. + +Listing 1 shows the local interfaces configuration. lan0 and lan1 connect to the leaves. As described, there is no IPv4 address assigned to them (BGP unnumbered). The local loopback has an IPv4 address assigned that is announced by BGP. + +The required BGP configuration: + +```bash +# /etc/frr/frr.conf + +frr version 7.0 +frr defaults datacenter +log syslog debugging +service integrated-vtysh-config +! +interface lan0 + ipv6 nd ra-interval 6 + no ipv6 nd suppress-ra +! +interface lan1 + ipv6 nd ra-interval 6 + no ipv6 nd suppress-ra +! +router bgp 4200000001 + bgp router-id 10.0.0.1 + bgp bestpath as-path multipath-relax + neighbor TOR peer-group + neighbor TOR remote-as external + neighbor TOR timers 1 3 + neighbor lan0 interface peer-group TOR + neighbor lan1 interface peer-group TOR + neighbor LOCAL peer-group + neighbor LOCAL remote-as internal + neighbor LOCAL timers 1 3 + neighbor LOCAL route-map local-in in + bgp listen range 10.244.0.0/16 peer-group LOCAL + address-family ipv4 unicast + redistribute connected + neighbor TOR route-map only-self-out out + exit-address-family +! +bgp as-path access-list SELF permit ^$ +! +route-map local-in permit 10 + set weight 32768 +! +route-map only-self-out permit 10 + match as-path SELF +! +route-map only-self-out deny 99 +! +``` + +> Listing 2: FRR configuration of a tenant server. + +The frr configuration in Listing 2 starts with `frr defaults datacenter`. This is a marker that enables compile-time provided settings that e.g. set specific values for BGP session timers. This is followed by a directive to state that instead of several configuration files for different purposes a single *frr.conf* file is used: `service integrated-vtysh-config`. The two interface specific blocks starting with `interface ...` enable the RA mechanism that is required for BGP unnumbered peer discovery. There is a global BGP instance configuration `router bgp 4200000001` that sets the private ASN. The BGP router configuration contains a setup that identifies the BGP speaker `bgp router-id 10.0.0.1`. This router id should be unique. It is a good practice to assign the local loopback IPv4 as router-id. To apply the same configuration to several interfaces a peer group named `TOR` is defined via `neighbor TOR peer-group`. `remote-as external` activates external BGP for this peer group. To have a fast convergence, limits of default timers are reduced by `timer 1 3` section. The two BGP-peer-facing interfaces are enslaved into the peer-group to inherit the peer-group's setup. Activation of IPv4 unicast protocol is completed with `address-family ipv4 unicast`. To prevent a tenant server from announcing other paths than `lo` interface a route-map `only-self-out` is defined. This route map is activated within the ipv4 address family: `neighbor TOR route-map only-self-out out`. + +Application of the route map `only-self-out` enables to announce only local ip(s). This is to avoid that a tenant server announces paths to other servers (prevents unwanted traffic). To achieve this: + +- the route-map named `only-self-out` permits only matches against an access list named `SELF` +- access list `SELF` permits only empty path announcements +- the path of the tenant server itself has no ASN. It is always empty (see line `*> 10.0.0.2/32 0.0.0.0 0 32768 ?`): + + ```bash + root@machine:~# vtysh -c 'show bgp ipv4 unicast' + BGP table version is 7, local router ID is 10.0.0.2, vrf id 0 + Default local pref 100, local AS 4200000002 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + *= 0.0.0.0/0 lan1 0 4200000012 4200000040 i + *> lan0 0 4200000011 4200000040 i + *= 10.0.0.1/32 lan1 0 4200000012 4200000001 ? + *> lan0 0 4200000011 4200000001 ? + *> 10.0.0.2/32 0.0.0.0 0 32768 ? + *= 10.0.0.78/32 lan1 0 4200000012 4200000001 ? + *> lan0 0 4200000011 4200000001 ? + + Displayed 4 routes and 7 total paths + ``` + + That is why only the self ip (loopback ip) is announced. + +To allow for peering between FRR and other routing daemons on a tenant server a `listen range` is specified to accept iBGP sessions on the network `10.244.0.0/16`. Therewith it gets possible that pods / containers like metal-lb with IPs of this range may peer with FRR. + +This is the only place where we use iBGP in our topology. For local peering this has the advantage, that we don't need an additional ASN that has to be handled / pruned in the AS-path of routes. Routes coming from other routing daemons look as if they are configured on the tenant server's lo interface from the viewpoint of the leaves. iBGP routes are differently handled than eBGP routes in BGPs best path algorithm. Generally BGP has the rule to prefer eBGP routes over iBGP routes (see ['eBGP over iBGP'](https://medium.com/netdevops/how-bgp-best-path-selection-works-80e6e7b2da2b) ). BGP adds automatically an weight based on the route type. To overcome this issue, we set the weight of iBGP routes to the same weight that eBGP routes have, namely 32768 (`set weight 32768`). Without this configuration we will only get a single route to the IPs announced via iBGP. So this setting is essential for HA/failover! + +Statistics of the established BGP session can be viewed locally from the tenant server via: `sudo vtysh -c 'show bgp ipv4 unicast'` + +To establish this BGP session a BGP setup is required on the leaves as well. + +#### Leaf Setup + +Every leaf switch is connected to every spine switch. Tenant servers can be distributed within the data center and thus be connected to different leaves. Routing for tenant servers is isolated in unique VRFs. These constraints imply several configuration requirements for the leaf and spine switches: + +- leaves define tenant VRFs +- leaves terminate VXLAN tunnels (aka "VXLAN tunnel endpoint" = VTEP) + +The leaf setup requires the definition of a tenant VRF that enslaves the tenant server facing interfaces: + +```bash +# /etc/network/interfaces + +# [...] + +iface vrf3981 + vrf-table auto + +iface swp1 + mtu 9000 + post-up sysctl -w net.ipv6.conf.swp1.disable_ipv6=0 + vrf vrf3981 + +# [...] +``` + +> Listing 3: Fragment that shows swp1 being member of vrf vrf3981. + +There is a VRF definition `iface vrf3981` to create a distinct routing table and a section `vrf vrf3981` that enslaves swp1 (connects the tenant server) into the VRF. Those host facing ports are also called `edge ports`. + +Additional to the VRF definition the leaf must be configured to provide and connect a VXLAN interface to establish a VXLAN tunnel. This network virtualization begins at the leaves. Therefore, the leaves are also called Network Virtualization Edges (NVEs). The leaves encapsulate and decapsulate VXLAN packets. + +```bash +# /etc/network/interfaces + +# [...] + +iface bridge + bridge-ports vni3981 + bridge-vids 1001 + bridge-vlan-aware yes + +iface vlan1001 + mtu 9000 + vlan-id 1001 + vlan-raw-device bridge + vrf vrf3981 + +iface vni3981 + mtu 9000 + bridge-access 1001 + bridge-arp-nd-suppress on + bridge-learning off + mstpctl-bpduguard yes + mstpctl-portbpdufilter yes + vxlan-id 3981 + vxlan-local-tunnelip 10.0.0.11 + +# [...] +``` + +> Listing 4: Fragment that shows VXLAN setup for vrf vrf3981. + +All routing happens in the context of the tenant VRF. To send and receive packets of a VRF, several interface are in place. + +A bridge is used to attach VXLAN interface `bridge-ports vni3981` and map its local VLAN to a VNI. Router MAC addresses of remote VTEPs are installed over this interface. + +The Routed VLAN Interface or Switched Virtual Interface (SVI) `iface vlan1001` is configured corresponding to the per-tenant VXLAN interface. It is attached to the tenant VRF. Remote host routes are installed over this SVI. The `vlan-raw-device bridge` is used to associate the SVI with the VLAN aware bridge. For a packet received from a locally attached host the SVI interface corresponding to the VLAN determines the VRF `vrf vrf3981`. + +The VXLAN interface `iface vni3981` defines a tunnel address that is used for the VXLAN tunnel header `vlxan-local-tunnelip 10.0.0.11`. This VTEP IP address is typically the loopback device address of the switch. When EVPN is provisioned, data plane MAC learning for VXLAN interfaces must be disabled because the purpose of EVPN is to exchange MACs between VTEPs in the control plane: `bridge-learning off`. EVPN is responsible for installing remote MACs. `bridge-arp-nd-suppress` suppresses ARP flooding over VXLAN tunnels. Instead, a local proxy handles ARP requests received from locally attached hosts for remote hosts. ARP suppression is the implementation for IPv4; ND suppression is the implementation for IPv6. It is recommended to enable ARP suppression on all VXLAN interfaces. Bridge Protocol Data Unit (BPDU) are not transmitted over VXLAN interfaces. So as a good practice bpduguard and pbdufilter are enabled with `mstpctl-bpduguard yes` and `mstpctl-portbpdufilter yes`. These settings filter BPDU and guard the spanning tree topology from unauthorized switches affecting the forwarding path. `vxlan-id 3981` specifies the VXLAN Network Identifier (VNI). The type of VNI can either be layer-2 (L2) or layer-3 (L3). This is an implicit thing. A VNI is a L3 VNI (L3VNI) when a mapping exists that maps the VNI to a VRF (configured in `/etc/frr/frr.conf`) otherwise it is a L2 VNI (L2VNI). + +```bash +# /etc/frr/frr.conf +# [...] +vrf vrf3981 + vni 3981 + exit-vrf +#[...] +router bgp 4200000011 +# [...] + address-family ipv4 unicast + redistribute connected route-map LOOPBACKS + # [...] + address-family l2vpn evpn + neighbor FABRIC activate + advertise-all-vni + exit-address-family +# [...] +router bgp 4200000011 vrf vrf3981 + # [...] + address-family ipv4 unicast + redistribute connected + neighbor MACHINE maximum-prefix 100 + exit-address-family + ! + address-family l2vpn evpn + advertise ipv4 unicast + exit-address-family + +# [...] +route-map LOOPBACKS permit 10 + match interface lo +# [...] +``` + +> Listing 5: Leaf FRR configuration. + +Listing 5 shows the required FRR configuration of the BGP control plane. Only content not discussed so far is explained. The section `vrf vrf3981` contains the mapping from layer-3 VNI to VRF. This is required to be able to install EVPN IP prefix routes (type-5 routes) into the routing table. Further the file contains a global BGP instance `router bgp 4200000011` definition. A new setting `redistribute connected route-map LOOPBACKS` is in place to filter the redistribution of routes that are not matching the local loopback interface. The route-map is defined with `route-map LOOPBACKS permit 10`. With the configuration line `address-family l2vpn evpn`, the EVPN address family is enabled between BGP neighbours. `advertise-all-vni` makes the switch a VTEP configures it in such a way, that all locally configured VNIs should be advertised by the BGP control plane. + +The second BGP instance configuration is specific to the tenant VRF `router bgp 4200000011 vrf vrf3981`. This VRF BGP instance configures the l2vpn evpn address family with `advertise ipv4 unicast` to announce IP prefixes in BGP's routing information base (RIB). This is required to apply learned routes to the routing tables of connected hosts. The Maximum-Prefix feature is useful to avoid that a router receives more routes than the router memory can take. The maximum number of prefixes a tenant server is allowed to announce is limited to `100` with: `neighbor MACHINE maximum-prefix 100`. + +#### Spine setup + +On the spine switches the setup is quite simple. `/etc/network/interfaces` contains the loopback interface definition to support BGP unnumbered and listings for connected switch ports to provide proper MTUs (Listing 6). I.e. swp1 is configured with an MTU of 9216 as it is a VXLAN-facing interface. + +```bash +# /etc/network/interfaces +# [...] +iface swp1 + mtu 9216 +``` + +> Listing 6: Fragment of spine interface configuration. + +The spines are important to forward EVPN routes and transport VXLAN packets between the VTEPs. They are not configured as VTEPs. The FRR configuration only contains the already known global BGP instance configuration `router bgp 4200000020` plus the activation of the l2vpn evpn address family `address-family l2vpn evpn` to enable EVPN type-5 route forwarding (Listing 7). + +```bash +hostname spine01 +username admin nopassword +! +# [...] +interface swp1 + ipv6 nd ra-interval 6 + no ipv6 nd suppress-ra +! +# [...] +! +router bgp 4200000020 + # [...] +! + address-family l2vpn evpn + neighbor FABRIC activate + exit-address-family +! +# [...] +``` + +> Listing 7: Fragment of spine FRR configuration to show the activated L2VPN EVPN address-family. + +#### Tenant Firewalls: EVPN-to-the-Host + +In case a tenant server needs to reach out to external networks as the Internet, a tenant firewall is provisioned. The firewall is a bare metal server without a switching silicon. Thus, there is no installation of SONiC. [FRR](https://frrouting.org) provides the BGP / EVPN functionality known as `EVPN-to-the-host`. The firewall is configured as a VTEP and applies `dynamic route-leaking` to install routes of an foreign VRF. The set of routes that are leaked are restricted with route-maps. + +As Listing 8 shows, the firewall is configured with VXLAN interfaces as known from the leaf setup. Additionally, a VXLAN setup for VRF `vrfInternet` is added to provide Internet access. vrfInternet contains a route to the Internet that will be leaked into the tenant VRF. + +Traffic that originates from the tenant network `10.0.0.0/22` will be masqueraded before leaving the interface `vlanInternet` towards the internet. + +```bash +# /etc/network/interfaces +# [...] +iface bridge +# [...] +iface vlan1001 +# [...] +iface vni3981 +# [...] +iface vrf3981 +# [...] +iface vlanInternet + mtu 9000 + vlan-id 4009 + vlan-raw-device bridge + vrf vrfInternet + address 185.1.2.3 + post-up iptables -t nat -A POSTROUTING -s 10.0.0.0/22 -o vlanInternet -j MASQUERADE + pre-down iptables -t nat -D POSTROUTING -s 10.0.0.0/22 -o vlanInternet -j MASQUERADE + +iface vniInternet + mtu 9000 + bridge-access 4009 + mstpctl-bpduguard yes + mstpctl-portbpdufilter yes + vxlan-id 104009 + vxlan-local-tunnelip 10.0.0.40 + +iface vrfInternet + mtu 9000 + vrf-table auto +``` + +> Listing 8: Interfaces configuration of firewall to show the VTEP interface configuration. + +To install a default route into the routing table of tenant VRF vrf3981 a dynamic route leak is established for it (`import vrf vrfInternet`). With the help of a route-map `import vrf route-map vrf3981-import-map` only the default route will be leaked: + +```bash +root@firewall01:~# vtysh -c 'show ip route vrf vrf3981' +# [...] +VRF vrf3981: +S>* 0.0.0.0/0 [1/0] is directly connected, vrfInternet(vrf vrfInternet), 03:19:26 +B>* 10.0.0.1/32 [20/0] via 10.0.0.12, vlan1001 onlink, 02:34:48 + * via 10.0.0.11, vlan1001 onlink, 02:34:48 +B>* 10.0.0.2/32 [20/0] via 10.0.0.12, vlan1001 onlink, 02:34:49 + * via 10.0.0.11, vlan1001 onlink, 02:34:49 +``` + +To receive responses from vrfInternet in vrf3981 a route is leaked into vrfInternet as well (`import vrf vrf3981`) restricted with the route-map `vrfInternet-import-map` that allows leaking of the tenant routes as well as internet prefixes used on worker nodes of the tenant. To limit the prefixes that are announced from the firewall within the global BGP instance a route-map `only-self-out` is defined and applied within the ipv4 and l2vpn evpn address family. Together with the definition of an as path access list `bgp as-path access-list` it avoids the announcement of prefixes to non VRF BGP peers. + +```bash +# /etc/frr/frr.conf +! +vrf vrf3981 + vni 3981 +! +vrf vrfInternet + vni 104009 +! +# [...] +! +router bgp 4200000040 + # [...] + ! + address-family ipv4 unicast + # [...] + neighbor FABRIC route-map only-self-out out + exit-address-family + ! +! +router bgp 4200000040 vrf vrf3981 + # [...] + address-family ipv4 unicast + redistribute connected + import vrf vrfInternet + import vrf route-map vrf3981-import-map + # [...] + address-family l2vpn evpn + advertise ipv4 unicast + # [...] +router bgp 4200000040 vrf vrfInternet + # [...] + address-family ipv4 unicast + redistribute connected + import vrf vrf3981 + import vrf route-map vrfInternet-import-map + # [...] + address-family l2vpn evpn + advertise ipv4 unicast + # [...] + bgp as-path access-list SELF permit ^$ +! +route-map only-self-out permit 10 + match as-path SELF +! +route-map only-self-out deny 99 +! +route-map LOOPBACKS permit 10 + match interface lo +! +ip prefix-list vrf3981-import-prefixes seq 100 permit 0.0.0.0/0 +! +route-map vrf3981-import-map permit 10 + match ip address prefix-list vrf3981-import-prefixes +! +route-map vrf3981-import-map deny 99 +! +ip prefix-list vrfInternet-import-prefixes seq 100 permit 10.0.0.0/22 le 32 +ip prefix-list vrfInternet-import-prefixes seq 101 permit 185.1.2.0/24 le 32 +ip prefix-list vrfInternet-import-prefixes seq 102 permit 185.27.0.0/27 le 32 +! +route-map vrfInternet-import-map permit 10 + match ip address prefix-list vrfInternet-import-prefixes +! +route-map vrfInternet-import-map deny 99 +! +line vty +! +``` + +> Listing 9: FRR configuration of a tenant firewall to show route leak and prefix announcement filtering. + +#### Exit Switch + +Traffic to external networks is routed via the firewalls to the exit switch. The exit switch, as an exception, connects to the Internet Service Provider using numbered BGP. Numbered BGP implies to assign IPv4 addresses to network interfaces (See Listing 10, swp1). Interface swp1 is enslaved into `vrf vrfInternet` to include the port that is connected to the ISP within the VRF that is expected to contain a way into the Internet. The exit switch is configured to be a VTEP to terminate traffic coming from the firewall VRF `vrfInternet`. + +```bash +# /etc/network/interfaces +# [...] +iface swp1 + mtu 9000 + vrf vrfInternet + address 172.100.0.2/30 +# [...] +iface vlan4000 + mtu 9000 + address 10.0.0.71/24 + vlan-id 4000 + vlan-raw-device bridge +# [...] +iface vlanInternet +# [...] +iface vniInternet +# [...] +iface vrfInternet +# [...] +``` + +> Listing 10: Fragment of interfaces configuration of exit switch. + +The configuration of FRR is equivalent to the previously discussed ones. It contains a global BGP instance configuration that enables IPv4 unicast and l2vpn evpn address families. The vrfInternet BGP instance defines `neighbor 172.100.0.1 peer-group INTERNET` to use "old style BGP" transit network. + +```bash +# [..] +vrf vrfInternet + vni 104009 +! +# [...] +router bgp 4200000031 + bgp router-id 10.0.0.31 + neighbor FABRIC peer-group + neighbor FABRIC remote-as external + neighbor FABRIC timers 1 3 + # [...] + ! + address-family ipv4 unicast + neighbor FABRIC activate + redistribute connected route-map LOOPBACKS + exit-address-family + ! + address-family l2vpn evpn + neighbor FABRIC activate + advertise-all-vni + exit-address-family +! +router bgp 4200000031 vrf vrfInternet + bgp router-id 10.0.0.31 + bgp bestpath as-path multipath-relax + neighbor INTERNET peer-group + neighbor INTERNET remote-as external + neighbor INTERNET timers 1 3 + neighbor 172.100.0.1 peer-group INTERNET + ! + address-family ipv4 unicast + neighbor INTERNET route-map PREPEND-PATH-TO-DISFAVOR-IN in + neighbor INTERNET route-map PREPEND-PATH-TO-DISFAVOR-OUT out + exit-address-family + + ! + address-family l2vpn evpn + advertise ipv4 unicast + exit-address-family +! +route-map LOOPBACKS permit 10 + match interface lo +! +route-map PREPEND-PATH-TO-DISFAVOR-IN permit 10 + set as-path prepend last-as 2 +! +route-map PREPEND-PATH-TO-DISFAVOR-OUT permit 10 + set as-path prepend last-as 2 +! +vrf mgmt + ip route 10.0.0.0/24 10.0.0.71 nexthop-vrf default + exit-vrf +! +ip route 0.0.0.0/0 192.168.0.254 nexthop-vrf mgmt +! +line vty +! +``` + +> Listing 11: Fragment of FRR configuration on exit switch to give an example for numbered BGP and route leak. + +In addition to the standard BGP setup the exit switches have configured `static route leak` to support internet access during PXE. There is one route leak from `default` VRF into the `mgmt` VRF defined with: `ip route 0.0.0.0/0 192.168.0.254 nexthop-vrf mgmt` and another one from `mgmt` VRF into the `default` VRF: `ip route 10.0.0.0/24 10.0.0.71 nexthop-vrf default`. The first one adds a default route into the `default` VRF and the second one routes traffic destined to the PXE network back from `mgmt` VRF into the `default` VRF. + +To reach out into external networks each of the exit nodes joins a BGP session with a distinct external router. There is a different latency to each of these routers. To favor routes of exit nodes connected with lower latency over exit nodes with higher latency two route maps `PREPEND-PATH-TO-DISFAVOR-IN` and `PREPEND-PATH-TO-DISFAVOR-OUT` are added to high latency exit nodes. These route maps apply actions to prolong the path of the incoming and outgoing routes. Because of this path extension BGP will calculate a lower weight for these paths and favors paths via other exit nodes. It is important to know that within an address family only one route map (the last) will be applied. To apply more than one actions within a route-map the required entries can be applied to a single route-map. + +### PXE Boot Mode + +Before a bare metal server can act as tenant server or tenant firewall, it has to be provisioned. Within the Metal domain, this provisioning mode is called "PXE Mode" since it is based on Preboot eXecution Environment (PXE). PXE uses protocols like DHCP. This requires all bare metal servers that need provisioning to be located in a layer-2 domain where DHCP is available. This domain is a VLAN `vlan4000`. A DHCP server for PXE Mode is installed on the exit switches to work in this specific VLAN. + +```bash +# /etc/default/isc-dhcp-server +INTERFACES="vlan4000" +``` + +> Listing 13: DHCP server configuration of exit switches. + +As shown in listing 13, the PXE DHCP server is located on the exit switches and enforced to bind to interface `vlan4000`. This represents a layer-2 separation that allows only DHCP clients in the same VLAN to request IP addresses. Only unprovisionned bare metal servers are configured to be member of this VLAN. Thus unwanted or accidental provisionning is impossible. + +To provide `vlan4000` on the leaves (that face the bare metal servers) the exit and leaf switches are configured as VTEPs and share an interface configuration that contains the required interfaces (Listing 13). Since no EVPN routing is in place `vni104000` is configured as an L2 VNI (there is no mapping for this VNI in `/etc/frr/frr.conf`). + +```bash +# /etc/network/interfaces +# [...] +iface bridge + bridge-ports vni104000 [...] + bridge-vids 4000 [...] + bridge-vlan-aware yes + +iface vlan4000 +# [...] + +iface vni104000 +# [...] +``` + +> Listing 13: Interfaces configuration on exit and leaf switches to show DHCP/PXE related fragments. + +On the leaf switches the bare metal server facing ports are configured as VLAN access ports to carry the traffic for only the PXE VLAN `vlan4000` (listing 14)to separate unprovisioned from other bare metal servers. + +```bash +# /etc/network/interfaces +# [...] +auto swp1 +iface swp1 + mtu 9000 + bridge-access 4000 +# [...] +``` + +> Listing 14: VLAN access setup for bare metal server facing ports on leaves. + +Once a bare metal server is provisioned it is deconfigured from PXE VLAN `vlan4000` to avoid accidental or unwanted provisioning. + +During provisioning bare metal servers get internet access via the management network of the exit switches. This is because the exit switches are announced as DHCP gateway to the DHCP clients. + +### Management Network + +To manage network switches beside the out-of-band system console access a further management access is required. For this purpose the concept of **Management VRF** is applied. The Management VRF is a subset of VRF. It provides a separation between out-of-band management network and the in-band data plane network by introducing another routing table **mgmt**. SONiC supports eth0 to be used as the management interface. + +To enable and use the Management VRF all switches have to be connected via their eth0 interface to a management-switch. The management switch is connected to a management server. All access is established from within the management server. Logins to the switch are set into the Management VRF context once the Management VRF is enabled. diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/02-firewalls.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/02-firewalls.md new file mode 100644 index 0000000..e07cbd1 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/02-firewalls.md @@ -0,0 +1,10 @@ +--- +slug: /firewalls +title: Firewalls +sidebar_position: 1 +draft: true +--- + +# Firewalls + +(fire-walling in metal-stack, firewall-controller and headscale integration) diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/03-tailscale.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/03-tailscale.md new file mode 100644 index 0000000..2d5c312 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/03-tailscale.md @@ -0,0 +1,126 @@ +--- +slug: /tailscale-service-exposal +title: Tailscale +sidebar_position: 3 +--- +# Expose Services with Tailscale +This guide is a recommendation on how to access services from anywhere if you are evaluating the metalstack on-prem starter without a public IP-address. + +These steps will guide you through the process quickly. For a deeper dive, or if you want to use alternative setups, the Tailscale articles are also linked. + +## What are Tailscale and Tailnets? +Tailscale is a Canadian company that offers a virtual private network solution based on WireGuard. + +Instead of relying on centralised VPN servers to route all traffic, Tailscale creates a mesh VPN called Tailnet. It creates encrypted peer-to-peer connections between network subscribers. This approach is claimed to improve throughput and stability while reducing latency. + +Tailscale's solution is composed of components that are mostly open source. Find more information on their [open source sstatement](https://tailscale.com/opensource) and their [GitHub repository](https://github.com/tailscale). + +## Setup an Account and Clients +Please begin by [following these steps](https://login.tailscale.com/start) to use an authentication provider to create the first user account for your network. + +The first step is to install Tailscale clients on the devices from which you wish to access the Kubernetes services. + +Should you require to extend an invitation to additional users, this can be facilitated by navigating to the "Users" tab on the Admin Console. + +## Setup the Operator +### Labels +First, we will establish tags to categorise our services. Please open the 'Access controls' tab, where you will find a text editor containing all the Access Control settings in JSON format. + +Uncomment the `tagOwners` section and add the following tags: +```json +"tagOwners": { + "tag:k8s-operator": [], + "tag:k8s": ["tag:k8s-operator"], +} +``` +The operator will use the `k8s-operator`-tag. Devices with this tag are now configured as owner for devices with the `k8s`-tag, which will be used for our services. +### Create OAuth-Client Credentials +In the "Settings" tab at "OAuth clients", generate a new OAuth client. Set write permissions for "Devices - Core" and "Keys - Auth Keys". Select the `k8s-operator` tag for both. + +![Tailscale Devices Configuration](tailscale-devices.png) +![Tailscale AuthKey Configuration](tailscale-authkeys.png) + +Therefore, a device that has been assigned the label `k8s-operator` will have the capability to register additional devices with the `k8s` tag. + +When you click "create", you get a client-id and client-secret, that you will need to setup the operator. +### Setup Operator with helm +The most common and practical way is to use a Helm chart to setup the operator. Therefore, we first have to add and update the helm-repository of tailscale: +``` +helm repo add tailscale https://pkgs.tailscale.com/helmcharts +helm repo update +``` + +Now, we can install the helm-chart in a dedicated namespace using the credentials of the OAuth client + +```bash +helm upgrade \ + --install \ + tailscale-operator \ + tailscale/tailscale-operator \ + --namespace=tailscale \ + --create-namespace \ + --set-string oauth.clientId="" \ + --set-string oauth.clientSecret="" \ + --wait +``` +Check on the administration console, if your operator appears on the Machines list. + +Alternative ways & troubleshooting: +- Take the [operator.yaml manifest](https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/manifests/operator.yaml) from the GitHub repository and make your adjustments to use [Static manifests with kubectl](https://tailscale.com/kb/1236/kubernetes-operator#static-manifests-with-kubectl) +- If the operator does not show op in the Machines list, use the guide for [Troubleshooting the Kubernetes operator](https://tailscale.com/kb/1446/kubernetes-operator-troubleshooting) +## Expose Services on the Tailnet +There are three ways to allow traffic to your pods from the tailnet. We can setup a dedicated Service or annotate an existing one. For more routing options, use an Ingress object. For detailed configuration options, review the article about [Expose a Kubernetes cluster workload to your tailnet (cluster ingress)](https://tailscale.com/kb/1439/kubernetes-operator-cluster-ingress) +### Add a Load Balancer Service +The installed operator is looking for Service objects with the `spec.type`of `LoadBalancer`and the `spec.loadBalancerClass` of `tailscale`. +```yaml +--- +apiVersion: v1 +kind: Service +metadata: + name: nginx +spec: + ports: + - name: https + port: 443 + targetPort: 443 + type: LoadBalancer + loadBalancerClass: tailscale +``` +### Annotate an existing Service +Edit the Service and add the annotation `tailscale.com/expose` with the value "true": +```yaml +--- +apiVersion: v1 +kind: Service +metadata: + annotations: + tailscale.com/expose: "true" + name: nginx +spec: + ... +``` +Note that "true" is quoted because annotation values are strings, and an unquoted true will be incorrectly interpreted as a boolean. +### Use an Ingress +To enable path-based routing, use an Ingress resource. +Ingress routes only use TLS over HTTPS. To make this work, you have to enable the `MagicDNS` and `HTTPS` options in the [DNS-Tab on your Administration Console](https://login.tailscale.com/admin/dns). This enables helpful features: +- Magic DNS automatically register your services with subdomains in your tailnet +- HTTPS enables the provisioning of certificates for devices + +To set the Ingress up, just refer to `tailscale` as the `ingressClassName`: +```yaml +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: nginx +spec: + ingressClassName: tailscale + rules: + - http: + paths: + - path: / + pathType: Prefix + backend: + ... +``` +Please consider, that currently only paths with `pathType: prefix` are supported currently diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/2-layer-leaf-spine.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/2-layer-leaf-spine.drawio new file mode 100644 index 0000000..ef42668 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/2-layer-leaf-spine.drawio @@ -0,0 +1,40 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/2-layer-leaf-spine.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/2-layer-leaf-spine.svg new file mode 100644 index 0000000..bde9dca --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/2-layer-leaf-spine.svg @@ -0,0 +1 @@ +
Spine 1
Spine 1
Spine 2
Spine 2
Leaf 2
Leaf 2
Leaf 1
Leaf 1Text is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/3-layer-leaf-spine.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/3-layer-leaf-spine.drawio new file mode 100644 index 0000000..dccc5bf --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/3-layer-leaf-spine.drawio @@ -0,0 +1,58 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/3-layer-leaf-spine.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/3-layer-leaf-spine.svg new file mode 100644 index 0000000..b943534 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/3-layer-leaf-spine.svg @@ -0,0 +1 @@ +
Spine 1
Spine 1
Spine 2
Spine 2
Leaf 2
Leaf 2
Leaf 1
Leaf 1
Machine 2
Machine 2
Machine 1
Machine 1Text is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/evpn-vtep.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/evpn-vtep.drawio new file mode 100644 index 0000000..7fa5012 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/evpn-vtep.drawio @@ -0,0 +1,53 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/evpn-vtep.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/evpn-vtep.svg new file mode 100644 index 0000000..34bf306 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/evpn-vtep.svg @@ -0,0 +1 @@ +
leaf 1
leaf 1
«VLAN aware»
Bridge
«VLAN aware»...
lo: 10.0.0.41
lo: 10.0.0.41
vrf 104001
vrf 104001
«SVI»
vlan4001
«SVI»...
swp1
swp1
vni104001

VXLAN-Interface
VTEP-Endpoint: 10.0.0.41
vni104001...
Device 1
Device 1Text is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-physical-wiring.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-physical-wiring.drawio new file mode 100644 index 0000000..f8e694a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-physical-wiring.drawio @@ -0,0 +1,273 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-physical-wiring.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-physical-wiring.svg new file mode 100644 index 0000000..60a2859 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-physical-wiring.svg @@ -0,0 +1 @@ +
Leaf Layer
Leaf La...
Spine Layer
Spine L...
Server Layer
Server...
Leaf 1
Leaf 1
Firewalls
and
Machines
Firewalls...
Leaf 2
Leaf 2
Spine 1
Spine 1
Exit 1
Exit 1
Leaf 3
Leaf 3
Firewalls
and
Machines
Firewalls...
Leaf 4
Leaf 4
Spine 2
Spine 2
Exit 1
Exit 1
External
Networks
External...
Exit Layer
Exit La...
Management Leaf 1
Management Le...
Management Leaf 2
Management Le...
Management Spine 1
Management Sp...
Management Spine 2
Management Sp...
Management Firewall 1
Management Fi...
Management Firewall 2
Management Fi...
metal-stack
Control Plane
metal-stack...
Management Server 1
Management Se...
Management Server 2
Management Se...
Server BMCs
Server BMCs
Switch
Administration
Switch...Text is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-vrfs.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-vrfs.drawio new file mode 100644 index 0000000..a274bb0 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-vrfs.drawio @@ -0,0 +1,496 @@ + + + + + + + + + + + + +
+
+
+ Leaf Layer +
+
+
+ + + Leaf La... + + + + + + + +
+
+
+ Spine Layer +
+
+
+ + + Spine L... + + + + + + + +
+
+
+ Exit Layer +
+
+
+ + + Exit La... + + + + + + + +
+
+
+ Server Layer +
+
+
+ + + Server... + + + + + + + + + +
+
+
+ Internet Pod +
+
+
+ + + Internet Pod + + + + + + + +
+
+
+ Data Center Pod +
+
+
+ + + Data Center Pod + + + + + + + +
+
+
+ Internet VRF +
+
+
+ + + Internet VRF + + + + + + + +
+
+
+ DC VRF +
+
+
+ + + DC VRF + + + + + + + +
+
+
+ + Firewall Tenant 1 + +
+
+
+ + + Firewall Tenant 1 + + + + + + + +
+
+
+ Internet VRF +
+
+
+ + + Internet VRF + + + + + + + +
+
+
+ Tenant 1 VRF +
+
+
+ + + Tenant 1 VRF + + + + + + + + +
+
+
+ Machine +
+ Tenant 1 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 1 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 1 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 2 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 2 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 2 +
+
+
+ + + Machine... + + + + + + + +
+
+
+ + VXLAN + +
+
+
+ + + VXLAN + + + + + + + +
+
+
+ Tenant 1 VRF +
+
+
+ + + Tenant 1 VRF + + + + + + + +
+
+
+ VXLAN +
+
+
+ + + VXLAN + + + + + + + +
+
+
+ Tenant 2 VRF +
+
+
+ + + Tenant 2 VRF + + + + + + + + + + + + + +
+
+
+ Firewall Tenant 2 +
+
+
+ + + Firewall Tenant 2 + + + + + + + +
+
+
+ Tenant 2 VRF +
+
+
+ + + Tenant 2 VRF + + + + + + + +
+
+
+ DC VRF +
+
+
+ + + DC VRF + + + + + + + + + + + + + +
+
+
+ VXLAN +
+
+
+ + + VXLAN + + + + + + + +
+
+
+ VXLAN +
+
+
+ + + VXLAN + + + + + + + + + Text is not SVG - cannot display + + + + diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-vrfs.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-vrfs.svg new file mode 100644 index 0000000..d72378c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/network-vrfs.svg @@ -0,0 +1 @@ +
Leaf Layer
Leaf La...
Spine Layer
Spine L...
Exit Layer
Exit La...
Server Layer
Server...
Internet Pod
Internet Pod
Data Center Pod
Data Center Pod
Internet VRF
Internet VRF
DC VRF
DC VRF
Firewall Tenant 1
Firewall Tenant 1
Internet VRF
Internet VRF
Tenant 1 VRF
Tenant 1 VRF
Machine
Tenant 1
Machine...
Machine
Tenant 1
Machine...
Machine
Tenant 1
Machine...
Machine
Tenant 2
Machine...
Machine
Tenant 2
Machine...
Machine
Tenant 2
Machine...
VXLAN
VXLAN
Tenant 1 VRF
Tenant 1 VRF
VXLAN
VXLAN
Tenant 2 VRF
Tenant 2 VRF
Firewall Tenant 2
Firewall Tenant 2
Tenant 2 VRF
Tenant 2 VRF
DC VRF
DC VRF
VXLAN
VXLAN
VXLAN
VXLANText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/tailscale-authkeys.png b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/tailscale-authkeys.png new file mode 100644 index 0000000000000000000000000000000000000000..6822a74ecb851430d154245b90ee5cc8dc523dc0 GIT binary patch literal 62091 zcmeFZWmFx_)-6l~CrEI23GOZl4#C~sJ-8Fxf?IHh1b3I<4#C~s0|d8QJny+O?yvWZ z@4Np_#vozu-Ceu8YSmhE%{e=vax!A?;Bep|ARyjJhzlz~K)gBuKks3nz&ku*?5q$F zaD(njYK{u}E<|?rwkGCQ#zc;8cE&`;uI45X5UvZQ-!)@t_-q1JEzxyepOPiMd2JNn zvbKFMB;i#sc9Y5Rd0gQqJsAucbKGOv^X=*V17+?Wj|J^Y8-_Km)ibC>@`dK z>aD{;+Nu20{X^W)?w`jer}bSP8nH*+_CoKm)AlieVo$`u4W&o6-`AcIu$-gE7aorY zN?i9mIhp>%mIYVk@b+y;o}`I?UGkov?tkVpTOKRl+IS{vNEY4l#T~i}kosTTyL$TM zdSucjSV?$$>$+lgocDXXC0(RnJ&_6Qw2gyC_Uakj8zG6g*{AF zie?zkjGGp(FpHtfA*=10C62pgVqY)chMKkzKYsXqvAZSv(`RIErd;8<>$ZO4+#~Cp zMy#Eh!#i?tb+`1{_lPohcGlt4?bK`ms-Hl2_{oUY$9Ab3C47%Izx8zRZ1+dsz5YV- zH|(8jugM*{0ecw^%#}0z@)WT;-dh`W2cI!IdIs;?IKI_u?E&WxrSYDUo4#F*7nF$) z$w{FG8(rNr_$THFGdKLQo)11P&zm2wHS(y$G!{K!eH$d>$uU09Z^kuK3D(I@lN>!z z_B>xJue^1^NKl`-xT_S;)99=vjTZ+*_pPY9ILx>;JYO#&YQF&0cJhhC2$> z&JGt z&#J@Ws=CgWeZLAh4G&{Hum0J!_%Ne>gj;%dz$-mQ>PkxIZY|8Rbl+Uk@|rtN96j3> zyI1i-{z{r(cxPjS);l(`l@)2#T8XCcv$}Q*9&dD8Uf(>4{^ z{F4v-jgT-*fA`Mk>?{R8XmZ45ON)Ls;1(51)gz~rI;|~Ez%_I{Ock3cb(h3D<|;`l zb8<{;%}Y?POOH+7X{aes$fMX_h|E;D929cr1P14Jq4$HkQw1L%HbPh8_JhIQlj7 zPFz^!-PPjv%U#M)M{~pjIn&|1n&Aud%dKYDZ;Zk&9Xh6H1sS55Eshc>uklgs=I{#_ z?9G0APQdkdkf?fm-p3wavxh_(6il$>PVMg`0Mc zD0c6X{FKq!4@V0n99P{beDw|fl2^AO?^#GGJyn%W0;b7TG$XU-|Dpuj;9pS4`7?X^|40Eb!fr zbMIFX$Xn%Jg0gmW^)FZ*%YyuL8BZ#R_Ln+BBob+IwLfR%^@Oa8pH84n1WAMRFXhBn zGT&&Yu712B$ZJ^DPad8As#qwsa4?7W)dV526pC!f%6Qj*@l4~Vi|>$MmiVK?5__ww z|NAms1uQEiQw+6t3sfaP{`i($PVDp#dzb7fH?!JhcnI;Z3G|6O73dFH*2qa)!+K|p zPn9Ic2-$!9@g|fr+fOzJi z0nRm}VXMDY>Yb>uTIZB#EUq)bow~eJD*dk**=`z1-&<{l`0Oy{40T8A%GPKW7h`-= z95Pvr^|M;~ne>^V++~>~ZFJ-LA7O&2(`K)P(GNVzx*XmPRo|9LP=yEUzG2E=zWQ@FV}iy4h&Ib{EuAXOb!JMAVZS4?sak&{<3XQW){71Sq4 zA31Dr%0`Vgu#FOQv7W6x{51IKRjEq1ioJ=XoRJe5K2#zNQ950aacD|86fFraXfIsG^GYcfnl}Eg-Rf~TQJ5YR& zLuY8mrXb{s@#&ROdU{QiW1Rp(5>F}80Il&S6-JwDbgSQ=Fw>32HG9JJ$Z#a-!fhlY z-AU%&Fua<#@Y$1*I`pHS8%^UG%-;CX6>m<913?E*DzaHljq`)pHfz89r=^D-wP@}J z>Z^QtHY~Cxw6iX52(t7oejQ$$-dOe&hzWh@Pm?*KFlruIg3)QLKcGe(n>+<4vg(xF zF($s!*|Dg#o)8&M|DjZ?AX0S2X2HI1yzl=u|7QPahS)uCp*7u79(;GAEkyrQj^fkM*TrfLt+)5Dp^aI@x% zzaS!Pbo>j~k^a}-AWCwl&&pKvwEQde5|vthj^<7^W7{Bs0TM6ufCguUP{x5scPHmf zcN1$z$T|~)e-8d0Me=aXf>EHA!-Z>fhc}b_@2L{~_rB(YM||l^Od?hxl@fMXDa(U_ z(|&q!o1T@}X1o@g=DedUzj=AS=zDlw%2*LR@mi^s+4~y&dabz75RVA!e8T(J>Nia8 z-Z`%N?Cw)(KRL%?O`p5wiq+@=5;l9@dMRLb#h33^ew{_A-(3^y}}$v6f`kkf@1JkoxG-2xD12_JrV!jPmQ6Ebpr3o-67;B2Oc zsIfB*UhI9tOlo4-$Nob$7setaR(r`7f_5p%}Th^=ADF zh|KduB!(7XU%?y(I0XcKeUpAbsbnv3`ZZ7+;*TjyaAQa%@sXH0I@)nFFu1t5(7UkE z+uEBlFmZ8lF)%VSFf-GEBj_C5Y#jAn>1-TGUxxUvF@%jB4DHSB9L;TQh+f9jH?Vbb z0o&Ign@~kk>Q`iUtV#`nY$WWsR^4~8{0U5G5JWi zI642XPu2gAPuW;G|G5?--ha+kb}+UVvb6>$JHA}uzpn9<)xTc-*Ckt-zg!r%mA;KB zABiiSk+F%sla(V0zoMbNG5A(9TSs1oms_zi|JNA*y!xMm@cwhv-2c}%{nr`)$7H))Dzf9v4?MAv_& z>))Dzf9v4?MA!ds(*^gxVV|)Lz#NSBnoeNva+b8 zD~a@8DQWCQM_0|a@oZoBnasX@9ftYtEMx5AD9*@vXE>Q9?l$9^@6;_SJ~PSGE?zt~ zU~<2E^Gpv*%&Xxe5i-o%XBIrmk@%=j>2F{Af;S$dVb(EV!0%bFhyyfV4)B8tK(=}L z2nGjPumSSrD6^0Mt%JTFG{64ma4K;hJAoMai*jL@dT{odxNyKmR7jwbp-%^)NbHt4 z{2}#&&Y+BhV61eE3j5#oT=!>(f4<=zE-6AREE!8M=JvsH(B0ybpFjZFfSCmZ0)8CZ zD+zXoo5-ku>|l9+WugHpip4LaE3sschBGtBvgP1=eqm94p(L8Ok3pvt7lT=3a&#Q= zN0|%VSsW&GxhKGuczv@QA}CEJA^Pq4KY z9Tv_*2B&z|cRZ{a(X8%l<>#yiIqawGyZ-)R>y0J(1Q|7 zxVuq4SE{PIdSGCHn36L1=*UVzLE(wra+DDvHZD$FTKX|u?0{4T#uc>Mqe>-nIt^ z=>HH;bR_%0y>jRA><<-`9rybOB!(t06kII%n@y?!+^&!EXyDE&H0Zwil1ZqQV&Je1 zl5x~CQN;aBB%1PMdx)9sCY+a+65s*8QCCxshHqj)3jo{7-eC!WvZ1M~C zCK05{Hve5nlyT$;-H{cQSMqwePT2ABdXbB|sxiW$@oK@cV&2LuC5UziTrd<8!SIjq zTrQ8L1~nesAYa-cDXvpqZVa@wi(5G~a*CVrQ$7MDkEue<}I+%^6M}dJA+Xf2j=K(A`X*j6T9l$;kp~SSWuVNwjxeAIsN8<&_g0C}lSq zcXhM0o1MXCCtX2SPlSE@`Wp^cET)d9@6+S`=9w#FvJ|+k9I7SvL%No`gJP-gjM<45 z@NfOv;cufp;AdIl?BC*>E7(!MCXX<&UiNRUi~V9m7#yORYjnVDb~!C*aOLUgS*)D5 z$}1?yIusqwnPhF%&~s!xmQ$_N$J%QmK+RrV6q~&~i1IBk_bGZ33s$0=6PptX`%CDj zpI!}}XE*&_>dw(_1L=T@0#yw4Gtm$;ynseXk3s&Wgf&c{;9gTC3x7tLc2kA*5XO1R z*5nU)QYB>(W#x&93A5!UHbT!EV)`U_X+?1NO3KP8aDjH*>7EZ~eF*r>0q=0x*RG-a z2L`fL%XM7&2p*n3N>wb|a40J)2MFm?Q&a!B_3X=co%M*w=}d`@9cEM29RX{DEwGL^ z%K7+L=q)?WS2&@m17l;PAf6F}Niocn z3Gt3Z7!hCs94U}w3|-5~>Q0d=jik{Li-%DRdJsR&IvqLlSk9J_;vr79YO4Bm5ET_o zaPp)k(rGepj$o5fP$Os#GawMuS6vdHefvwGKPz z6A^Lf+}J=sP0!}_ z(LSD^pU+)|g@qaNTY>61$%ufD@TTjx#fQ&QHK{H=s+FnQ0$zgsr=qcu)^zAXoHlL&*BO?Q03G?<1SgY|L@+KvCaRb6& z^+H2oZ#=zOrAc|3Q4oV4Lr|uCAmvRzs)j`}NK1s9cUIIWHH- zKT78mY-RO&8+X^<~R)%IMOQdn={5%4O6uW!j&s zO-8U;+*xJ$ZaE_ya4(Jzrolwo<8l<3ZBcD(Y|OQ|u_PoUfLz6H^N>6-q2Q^*u=#vy zWipZxF}c4L&d`>nT&&Xa+yM>t0B%&DgBDmiu>>)~^GPT~VHLEU5f9uRqm6h)_sMK+ zp0>L?%QP9v4!!7$u}r~wn`O8Ce9YUsLtDnw5hEibyG84IP-i-8%%9g2HEk$Byn2@h zH=ne`oz9f3XLy`MsFxSvm<+~$NMp0XgGR*DTki}U)~$d@9dQ<~5S+SWOO{qrQn7z@ znzi4Q=8)gE|I&l5dOmsgj*OBrw+Ll+IO~%?7F$)w@UWEg@yZC8l`+apPeE@T0*+OC zmY@QMQ?F}96`h~~BN8+?hw(tniB>Teli}|jFGmhgW)6duGzW>sf^(Q-wan!1?|#Gb ziAGHPYhQ?HGFCPzduPj72N{FYu^|}OK{+W5RyJYLYWnG%*5Gsy7My$GYKwiGB{UyC z#N6DtBH~dAfz&lQS*bQ`wWuORgxt-DpjGC2esK{ZE0vYg@;XkUWAjW-!~LrsV@TQI z+XwHesw&1*(#45MMKED#n6`bp7q6nffB$G>L!TXe|6QkRJ=*vWq@&Csp6s*CSqtkk zgr*DhmpS7HUm=m^63HH$gy(o6A$hb1UkDnNlC7L@dNMAqP*4;mbH$Lt!ozR3lXP#c z7H#+EtC5SR;XaOK1eR#jQj_#{F!sagdN+n?+BUx{o(?Lr1gUsdJ5V2s_ij$93dfk~ zq~wd1_q?%qtnkIo$n7=0%b%mkF}vl{JP-gjXxDlRwH<#SD_Yf zpsl2&^t)YG;H2r$MvESER@Vm~BrI~S53t&^XSbeOc2Bp%t{2i_q7fu~r2dtLeasFs zwDc`&uj|k;Criu~MWb-V%60h8?jNy&KDoQ&sA_wm`$Hk=-(MZS2@Z;rOG~sM1t)=C>VfBy{VZzxR{9-q6~! z60)+n>eU6T=CQKXCej0ggPq4$aw-`6@jU5YTzPd^={BBf7mowF^aZn#5t~~VCihHt zN40+xg^iey^7FSXcwkoYl1p^%f6FZzlqN#{WyNmDp8BPk@5ZyO{ZU&F3yRLcddbe2 zG{r>or=w*WPafiUo%pok&eIZCi3*Kw+1>l#u1~2m))i{Be`#rrdIlN(+?>7p7M)I~+FyR}Bx{5x{^etu;9HJZ+|FQ7*x@ch8So|+IEN5SMiJg3G8 zT_q?e_!^XieCx%lmWK^^q5-rB+Axt1GY_WGTm7daDQufD!GxVBb`|zL_B*5LVhXip z(63)<)Z2{E)h`W4Zdm{2%IDB-a?Cd!(>Yqw8K$dW5mZsZU}!(54$}W!t}8%`0Z$MW ztkdcq6aBrr^Oo@Za(2~jrr`_g;NZ^LV>p;xUk`y zHb3?C+YPKpqAi#j#{4 zgoI)*F)%blE+7y^A$`u2I#QdH!NS5~zEA@T3i{TT5h^AoW^oRg1Qi9jNuDr0$N9x6 z9{;3MNcE8CxitH5?H>uNuvI3=rMMYte z_&gIJnSq3&)@TnI3JdFbIXw$@Z?m(t`D7EDNp&cLYH6oUl&iFpa)e0S?B(bbE1e0S zSgjrw3!x`k5{v$MuY3Y;RH1uF}PTJI0pA} z;c)VHC)L)jw~xj03XeiILn`jU6VxLZDF0f&X*90$`+&2}O7+sWo;r6|hke+lX&s$` z@DkF}`7JGJ{H-2_4&7(lNyRXMLVr)Z;PRmn|BP^~GFl9)xnp3Q4{XTVB_xg4pZ+v5 zHLbSRWb%hj4}LO_Gd}S+pN={h0Jan!ZTj&k@u$_5UL5`d3j_dD#dmQ@Nb=n zXfOs{9^dw}S}2E*e!!KTmvJr?sLOeW@~O1QUQu5D73iK{dWW+!8EP7BrZ>NiuM|{N zRE8wO+fos_h{(y4|NeE9{QMb|XHZu`h&47w7!o@-ncx|0OT71K-ZsTrtLSfOZh0@^ z=OFW$oMw9X>XDeh^I|TmIb=G#opYM9yp|Tc>VW_yYc(kUPXHTz zxqK?+SdSDnlY0TS9~y`P=@Z)w-d0qYs?J{7sQO?Rf;%E zo?FetLe&OwK#J_x8i@PN8c};VBk#Tj0rpjVVq%rmt-X8ZM7SK)@cH)8m*(Z~QZcly z!5*?R8M+L_sN-+msMVi%NSUy}!k!JMb41llO@;L6%6$ZF+^zkzYM*k`lsoFl9$HwN z*L`eSTG-g3es>6pob@);BR_(2zU^w;OBkDuWvKB=jNE>UB_mFi(!)y;=0BkSDdE`i zu=aRBau>zyup_18cB%aS{d+9V3W35a++QOc%iXoJI>Gu_uB|%JWEiw+{kSY9(TO-; zPF0muMBR7kG0$WuPg|e)U)E(*n>%-(`^y<@3zH#~$Mp$0Ie8#Hk27PA85y6)Ri4=O ziR0l+f^Xrwt&U*AUgd3rlO;DY0yJ|5A)cE;Cci*%>20A3EANxu&MZO!`UbF$%8h<7_9}N-MHyTypzhk6*c# z`1|1cns-G}d<*eaF%4f6bUi!31aw7r2sNBO-NPvFUNUOZmZ(+w4a89rOS}gw5FT1Y zCNce5Cw0#mRt_y$yV)f!Ve&hZVQ+=W2#!j*&It6W&o75DJ~0Ia=3>=y3L2Vl07}yE z7wfAHwtjFAl`>~X&jSA4tb9JShGp}y0 z(_Iu*sxm7#dztKwP;|u2mN$mFKDD8Nv+Z_A zv(D-+;py>?$-)RFrKn1;qw@gf0y$SSa;x$uXr5m$d7ZYVdG9dl+>ae%LDksK>X5mk zz(D+tAw$)uc>5O_x^ODqi2OWei(5FCdnkoK5I&Jef+AAo7n^kP<)~b|c$T_xK1i9u z0ATQEMy2z(=+|ltj95#7#^&to>}b9kGpa9qz$mAr1h0G+tQ`C8ts7WZW!dK`h}^U*wpuNzxHmA8kC$R9O1j5WQsOs$^J-Q)_N#6eDxg$&?P;z`U=0u6w{B2dJ8p< z(5vxhSDXS~C-jSH$(OJS*P&x;oct znNGyAO;is~gO+kF$*)}4Hmx%1<GDo)$(>ESVlO%FDs9PX{_4VaS~o`P_{bGQ&( zFL_~}wmq^lwErbJoGIPh0MJkTLD5T*K|AC}?Q(%ME+{eY|K5M+aUn=$x9(iGBa(Pe zpA_Dc={eZ0QD@K}P26&IcUW>~fsU!=h=Q5s!+(2w3ow+ug9FS>i&|-&TE!yR>Cxz@ z^~>(?AaQQr?&^k+3ve}@NmESfdnm})H;-Tp_~2shuJsZ6Y>od^bX)5PZg{*}RI4_5 zN9gmwl*w=#-}VUoXFZs(!tBf-h26X}AT;g=Era2Hl`&PApolT~Y3nurtd0*K02L)q zSDJ0lPaXioCD3D*YSeCQgfp1@`QUADcO+y9q<@ULA*d&{=hn?y^es9_Ce@J2%CNy* zwXv*^(`Y^y%%SS|KAJ`Wdu*!pL&Rd@Y9(hk#aD6$ev1< zIM;i4X?KThO7!{t$^ncAxRLX18qV6&pP;V>aamNfVaKUf=gCzFT9ESD;1QGDs;XFc zhL(_$5?TbIJ}dUki`&M7gJQS8m3{rAg9fWlUPlYHxFYhA%|9C?6%01g#XO<`S4f*U zr#3SFUK&BbVu}h5-lNKXTe3hlGjiFc&xlz>#rBn>w&5CJ6)7mHtmc`)?!$fUO(>np zR+yFb=2d$pu1!m_4xh*R^?fp*DWdPkug5&jzfbbm9gn6$ovjzoL6iA+Z#>;(B&FJ} zgy(tK1z@3mu6>Qwc43dfGqnA})b;f3TK| zypZBWF=W_u4M^G-Vzj$I0;DB=%ou~bm&#gpp}|wLcR7CS~y)h9=|CZ9F*iG zUc z1PVG`5p3ci8i{nAUiaA;C@8##g@rv@tdFu&Bd247EOqC1V*Q*vZ9!fwPq8ld9jpk5 zEtBeGfB_x2hN`sEefv4dev>wpq|IBEDYx$lWl>2A+eyO_L?!7limNFPj1H2pu_aVh zF@wtYoAq6Amv2!~d{WY6ir>7;spC;tc4s~@aePG7f8rh_Kj3UaNJqQW3k#ZrI`@{Bs z%x>`iT?&pu7Fco#*1Rn)J9bJy@fssE$GSA*!bnjsZn=AJ10fxi_aWX0`<9VDbI(O9SHff!O%v{G7V3HI!Paqvv}}Y!2CC1unDA(sR3VC-;4#%MBZbp=MU{dO7W3)yuw zc$e0ofe&oLf9)_)@qHq%ymJJxQ5M7<-A25=TDZibRU75@O*v)wN0mw_eM5RWS=;ML zablTO+v0OiTiwkCgfQ>z-${rPt;#gY4A1juH{WqXsW89B-t(`5HIRO!DDUv@a=mSd z7sMh^*y!U)cif^@UgdI&OaGabE62Egemx%23&@OxI_n|dH_$gv_osj`?9=`QdO>8E zNWN#P@OvNMALwm{eTd$VPN)=dej_HRIdm^_n?NA)NxSdfd+%}d{z&8B|D5qukKFml zp^p{R?@IA<%yY`7VFdF(qTE{_7~-XWq&rrk06X{>74P>~ zB$?HjiAxEcY5}34L-$iF?V);{3Z15XXDDTCW~Qu; z4uMQz90+?s;>(Idqi2r2CK*sJ?dFaFSu@qx(0?Yy8fXEI0tM=5sWFa#uZhL=H<7nS zJ3)xnCIDa!pg;V=y$MR*@#=&`=u9aXi=ri#Y&=^CnpL`M^9--9H5a}f^d?|gK7*Di zr2zKqMYPK>Y%MWuy(4qd-i_q3*^S^RxajXfy4XUM{qy8;dJcXj$OPJF6jH_mH*@LN zQiQd8g74dQT#Ab9S6i={^*dduX=o17V*Q7TE#EEs*AserP9}W7=9-`!GifNWZ!>%FI8yxws9(J2d*Bg?6%g=WhqiMn#E=p_>jH9ONN??) zJkdk|@i}FI3JTk0k%VLG8Az+3s@v434h{~^xvbkY%q(oPVb)x`wip>3e*pju5C=dY z6So%z%UW1Mt6-w8j=gRn&%eYMlK5`Tz7Z6dIz9~!a0x@(VaL0d?uM47vn8pkr%|=D zV9Wk-ZBbHD*(kFSd(pea@h~aGw(?Iqb}uTuAKgz{4(T=OtR%uQ=1Fp3CN!@NxJSaE-T)tg_-VQy;K6}J(7;f9+c$qYExpDWhcsu-7(X__zR$8X?a~Lw*W-f@~0D? z74-8!13{hc@P}q`*hy{Sv!&-)^>i5K$)bV-{X#}ypj74)w{7bsMjWLK88QqB4IF=a zW}BDn_C`282@7c)mxGCe;P_AR(m`0H!~Q#r8yV*z<+R{r2nda@~&eJNG3Mx6270u3}W(Ve9ph ze}TE$FosRzwu#AzdmKkW`{>tKZwzwiUs7fuNSQy#(GY{>yY#`FtAwKijWkdY0P}*@ zJ2)?yIx`T6+>*vtWd=_PpuB4Z;jZh_Hyp%}oRm)#DC^ximG z{!eFD$5sn1$vigg5h|2vA*;J$iQdhg|ERBNt{b7lDO_Jfz$#UcUNi#ODD-7sTq?Hrk)t{_OZAIjGOQga~Ubn9w_`Xu%#l4(D_X;C%j7^ zXy72!H+v)UuRpZT>nivS{MCFUm)Mw2(ly!W4lTK}M;EYN0vT1Hd)_otMBR-GpW9Jy zu0p@k3pg2;o16{zqKS_fKIj9XpucLkHv)IA+7yW*E>w@In>A?jv~`4vLCF_NN0>1P~lEc6Bjzy8*3fHd{xx zn<)?o#K%K5Ew>(YAS}tLsPqaU35bJ1X;fdRFTdF*mIy!-0-`B!QHuzf73+Ylh}U8r zEb4e2K+2Po;^N|KD;_8M%h#*b&db~DCUkv-sj~vFnOiFW984VPEBjAI2K6s!hgB zK$B_paBB)t!j4NC9_D&f`4i-^qN1hRlkC33Pt&Yzn$6qj z5tC*=_@QLA0_AIY+f$gwX=4&5$fBkhZiz2x1K_f&qj@2q)tHaxaB-|Sk^;>{NDR2|P0m()vPIcv_%*zBI1fqd?I%*p*`@jV>6 zr5l~_3}h?&d5VRRKZ<(WPaFK>r_g|VzE3P{zITFbM0Pga|y?;xXB^S_EeAS%t|c#?8==l1;wQ9jm}IHDQN z*l)dr1%O*o(cG~!7%<#``E0cLG&UyYla>}3Di_wdrJz2)vHxKDiY; zE>N$I7FtuuKPUbMNq|+moDGSejtxC^1Xxw_3iD&WfA8NJNmZ|QrppzL*eGpu0PBxD z@L}LZe>K(8lB&twya$V4;PdDzolOCITL##Vurq|IPbzw5R85z3Z*zx%mfB z5Ma=_pBlP%Yv)ojD9?qcF;>rY2Y(T(UN9|`G0yj|eZ_0nFK4%q}138}2_C!nO zcrglqrH&{8&oLm*%(r?V0fM;4s1pVAAAx4LKkE{fvch&%2L!1I5wc$A^CO|IXJssC znyyJlrQ}=Ln~UGg#OS>DJak5FP$~5x*y7F;AZ{U}dw9OOQnfijvz|Xju6B;F z%rhj!1nj@h{P$@u$Vi@4Y$998Bg6g9e2s%fRUQqXWi02NWDv?9^~)9K+6;lgO_`U; ziCX&nq5~po(SO;76bk{RDDrdvfcdwgpjRI-ssV11Q*L!${w8$jVuzb71?Qa^1-R%a zMEnJo#|UhYgfVqIj@bZJ0CVG+=F{{k#7N&4N!@nLBb74KJvJu?g%i(t zXDl-c@S)^6Zs!A(Zdb{s;u6xvPr-!t^Z7}3CvJ+-+u}sIUF#u^RRM>fXyO%4HHT(X zNjj;}v6%n->3O$bSfbVTZPBJV0np4D#TjorLBkZAl=QhT5?{T}>VwOw114ZXfr})C z)mqTmnUve-mYnzlc6CoDfVjYXFwJ|{-{p8T7n7ET2LyYWjSW;1!zJkHuHB2X zrRuRSXCjzP-Vd%IVZg zK*D4E`O}3oS!$^YEPf!0?!~2~jAoAJ%~E=YldBsx&S|iK1!lB?v#jlo8V(*Fv}GuV z%0=4Vj%AJk;?UVZofZklaF`t70G1;4CP(ZqU%oKGb7`E$PAC|OWGfdZ<`ot&yG@W$ zNT&q!ZFcN`+gzM3HlN6YP15!LfW5!389q;3;7Z(pXagJzwk=HQV8a2GW30x!{QRW(R9Nd0 zShQx!j6nrn^15CInnkSjVi;4h6v$wI_6x%sFK0CS`-jN{1PD#F@OYe0x;HQFc9Kp1 zJY0syfCdpX{+KpVeg2>edXPW%^IFReHk&EI&J~N=nUodS3@a`(0EmwE?gl7d zr`nRAC0*A8F)J32mpoP9~n z{>bp&QQv8~#9-ikrv02mmn#&E*z$K`2un1t1h{7w@nNyz$Y23IF@}ka7;*ySyks6* z`gyL1+w&piqt$i+@PAdHaJYdD3dSQZm(3gHu22bMH|x7{vQdVhCV)K-B`amCdTN|x`D^#!1J=pje-DO#>Lj~og#;43S4 zX)6cXU;!4`{`n13l|hdrLFOG+wp@rr9K~dfgd)ENXQnI$Lyq;LGnig4pmq(Luz>bV zgph%Rr;v$oG?Vc2eUs@J0fF0=JcTTO5_zU~XG^1PrTd5r@ACuvT#2(rtyNDnu@In8 zYPneeF=W?5yuG`PUn?sYOO__HtB)Fu_s+SQZ%3n)D~Xesn3&z^12RnX_vnw4CL?yr zDpjQoSYXf0Tip~x<^xk#gBE?A&9bD01@*cemh_~-MWbe|g~+c{Q;e0Ufx?kUzQzCztZT{kAegU9O&Df)AD}+=_(>`fR82-3*NhVe41+j z{}zDM+ug%8U*!f*P)?a>s5Qwd*g*t{@h+SCiy?+~y*f2;D?ph93b{!&cIFr+>i(XS z@S*G4uUBwza5t{&uSFxUhnk!YLy8fliY5Lo0COI&V1U-k`_m-r#^xqq1U{0%O558r zzi_roji^8Z8cGH=w5T99ZW2p-k`t6Zz(N7GqnKsWjYMCpSkjWm!bd^fNvSD)qEAujlWLr3s15FT-l|pstr0%ZOP2G$KR~zKNo~HF7Loa z5DPFwy)iaET4}|tp2xe8Q7fHM^M-gSYbto3M*=oKHssn2r1*Z4KMPt_0E{orke*4c zhVN=`KbthETDr`nLFE)2M7UbIC~a!Wv_*uvQZT$|tZ}j)Re;JdPQ4l}lW+JFuL6-G z>yWBabdLNY8)Wtl|M(-Iz=s7{lcg#hrXTpZjcGK1p*J|5kWVJY_^$=A?Q9u-{fa#c z@Ix?qKfHYj3eul|#if19F|SP99Cr|DM+)xRYYOTy5ShJHThpy68%K=$fFtK3$34+h zCvs|DQ?gf!8}x}2uh)nfr2Y~isO|-7EV!72WQo4WbXSmDUDtas-2mhVa^7sy>iU7! zt8r6u_fh{b8c?nJ!hF)~#B_(->st$82!U;Iby~TA_IZb$e~BwfY3FqM`nv3A+2L*L z;g4di8@jn-6Kv>bg2(;qd-KVHcVhzAw2O7tn=^|xrl%{d?ah1QHS}yeNYJy-c1~P3 z_W~0H?bpjOgQ{qOfboAiJ*sXz>%|3xQZVnsAJWQ@r(Cy4VYw8r2s00x0h)hiQPU%L zoSQ+?eC`h*9jEdlVon$}K^$QK z-+JC+%5reBtJL%#>bK*p`z$`8awR}BmJGOL0$g91;kAZdMuZlfQ}CR`CB@Qs5SV}P zrt7XNiuDgu)!VZvK%lH>tD14N8@NB1M9RLN6Lx0&s-~zBG8r<~l1~bB&>iKUy2Dh4l zWbX7L@=wm=(PXedD17^R?)d8acLI1IJA~!n)ky(augnrCf+Z@Jtzj-6%M;H!zLHHPo0q(E`Xo- zuq(53kw0`}{^)MSzPL()G0y(tHv*ky$Tvj*zRF?6j&4WnmtX9B!yZm%i%Yg0UAvrp>RJMw7>fxjFgAw+iA(@k~*(64aOTc&W!mFao^mh z+)r)mM;l`+D-R4>bpMDE$s?o8HP;VwTp@vY`B{Q zauK8W?5Os4Ui0@awQdpr@S{kSzzvRN#Z=pR1d zFugAC6AJcwT_EH2O^nbj0Es_MR??o?>h=#Qq@@SCKlRtj^0M^J{OYT@&V6*cHnKr=!6D>EF3%%;yoB{}DP%waM^Rau{ zs(SvPXCXv^nG$5VA`7}C?-61M5vFVlYW8Au?ODSNe>tiE@RhB3PTG`caKPL!U!hN` zs_pPD1!GEtjD|+)UVC6?xovUGJW76+MRX6Z|_6pd9tIo?_&Jp%9~~< zNb}-kI%(R~QHYHTjf$c~hCxOQ2EM<_t8W_3MMVZ!P{3HV&&^(3t8zPT$(lUUKRt^D z7YJc+2?hhbks57qylMS>(c-!WFzSOiMd=cg1Ky*TE;_VvZ1)XG=TCDS#Ngb~UFlfx zB!XV)A(tyv=jLV3lwIHA@s)wy|y(BMLB{u%M>+U!KnZ$dHaPlkWCq+sXG+rHG z;5yE6?L)--^5t75V+Nqen0=mJ1NGzs9bG;ML@l3XC#^5H+ki*K%3K`-`=&yp1ayZo zoZ0ArqGrL=ePB>fAZ7TQYSR>x>GPBv8w=b^?;EyaKR4_g6l1YlVFhJh0BMBKz|As6 z)L!8|Kz+b$npy2}Z38^)CV$pGHSiIPCNpMGxZQd_cOj8=_pwx&y%mCb2Y^ba;);$K^qpWN`Q}e+e z8p))qHv)iz7e6xaO@qe_a!^R+rWs$fO}%IDlKUqQkc0eXaQj2_yY?sYS(@~LhHE25 zLB4Y$;I$_=%6oyJk?Bfu|5e1J_?QqDL0^y+xAzR#l8uH#k_7|(zx1RfQGDW(Qp z$2T1HZb0Q2Zg4yHBWu){jqZ$S{&q_L_RUc=3TL2TB$W#=`rOWYUwbUpJ1@pST$sQvU{_&8&YS$?M7PrR<||Of z?CsyDb31PhDHkLDYzJ!14IcbRiA1YNH&&1@Fz(aSM{))Orz_mo9s}Z){ca=Xm$Zt( zaQ7YP=2hNZ?tqy}=6`g8Lcsb3lpnM497qSiSuV{nfi@s22StSU>_(|K0{`lU|4%1P` zk9f!U=`t8LvlLG37vgBbPd(|1j(!u=d0%-ue=l5{}x+yio{cmrs7fdU#ce`%?2*w!6kt`hS znYPm<7BoczK1z6vesSL&^4e7T+WrI|6QN+E3c<>UD&zj= zdx!SwS5DwuK_3We_RH<}k@SGc09OH;)AbYs$qe2yz)!pBs2#2Mekux_=#}y^wO#(j z2o}LOn~^3m=460M2Lpw-oc?H*r_zvajn|;&V<${b&^&8sAjoxo%40#&A@=*O`e0;B z^%-No&#f<8aeXl^OaAI#rhx6wYGjMd1QuOh4%_eSfDI0N!HtzMr&1ETa!qD4R08zV zVL0u%e*!J6UlKEOPS0Okihf6`IuZ}bQ&sC;Nb!8V{To|e0UtcXfh53#8 z*~$P@`4bkN2O1jVZlvI~6!PGH$Yh;1eQ7Z1X8O#eYgFv;FH^<)ZNY^vu6eStyYv3N zS@0!@pU<4RP125#@FkCm8p?0uDHr%PxzFD$J+=K_dAo}p!9rQ&@RTQi?5~dM-8LK1 zbpcnCj4J+zwli8#z0Nx>)FIGhRC0f$*TEQKDYNL8#-}Wpo}zj4-{x zgFXFw`4)JdyrhxEE>EfKe$*OYcg9-IRwMhI{E=2OP3N&00O1%ym2NX#RyeRDGf6qx zaYW4Zz10sDgf{DEMe^CYHd^xBpW`DUFXKT9*s{7$bj)p}4Yb+2bTCP#i(8ayYl8Uwu8iUD}pJcYD={R!(0?52< z85aX?L_&=Bw<|LEw+eVaei{HOA7nc#({p>d&F}BP7#T3&mC5BV{D{|FJL*>bE8u^egkaM&+DWei*OKjmo85R2EPCL|WAYxs$Xw~yi@D57goY$rU=V!a z2t{nl#28Q=gy?~5l>d!Qd1Lzg*T#Ym1tz>1P7-7jX`R`785FYe-$pvDov1k;{e zru$4uzLWiaI|klNdv|XW zU?V41t4R3Wm+!tMjl<3mSXiLY5xT1`etXNDhLG2y$j3im$iHofFppmNdgIXh%sDMh zcQe~(LzVVRoNy=bYRM-C4gJ;-e#{NgU6T zVqWS!sN{NhUyd60NRZSzDI$V^>Ahx2v0gE5#lP)Pb;h1`_x#E2XV0H)fZ~0{?pBg~ z&vKWn=hF2B@xd}GsK{~_u}Do$-js8C{Z9)38+(hvr$vpdp`pP{QNMKfqSWmNcy#=( zr|iy+nIt@)4(D309!ATUyw3+M$>rrC8+YTL=s-{J>dA$ZVAkaq2Xd4avO1mTFwtys za>_kZqTC)x;=BM)YiA%_@ST54u3y+6-d_pfd5bNHmd89FAEC>bWKuILr=alaM{V(` zpC~4oa9{t6qJ~7TdyRTAQj`*TD#qL!krB$QDXY$n-QrwDlg}!C`u&Oc7Q|-d!)3K~iY=q#m40ou(ckUr5W!iWw{^;pvGalV3GPz$Q(R zvg-Ops*q`Z^4Pn@MBQmWWZ8QpH;pmAnfnl&X)g+44cQkF7_G9Ks>i-q$Cpyg5j z)GiR=xTnqEb$sTl5`m$)?~c}C9Qc{qq&np3;P4*&;b?LMxJRiJ|oA$j$G6mf}v40$;n+83|!Nn!bIsLaCFkUkx-I4;m z(60z2F<6{RtOf)4Z*C#?_^tg?{Tf9o3uM2gui>j~&lM+LhuHzBL@JB~{Q62&{$jx% zuoY6jmSpX%g|w9J)&bLr zxFk|Zn5waN>3c{^$ADG{Ig{V% zPO-W?kmzyPDw={>G2a{bzeW*v$x_M0saH`(60vO{G@xe@1fG7ul5HyEkD_H<1xe9^ zo29S=m)z^L%J?5EeT}&Ys;sQ+471@8%p%MfR)f56urZL zl6=jIj3DeWu9*uD3llF^37gimx--9r8m=zy--^?;FjBDB+O^|Ol{641_k@x%=uSfT zB^Y*0Uco|yMhPJ;W_pQktA@Tem=fF`(jU{c`$T{t9JH>vYQ>d8kD(A6@uoTPKbE7J zDDh+bOoVMhtW{tdk#-DRhE*CPU@iDE!g3p98gP z-TiJ{Lc(1+tyW)T*;vx2MU!CiK*PXzN}1P3>Y6huYideO#A;x=Qt*skgE5__F?KV@ zCkD!}<8r4oFjw$=cAD2y-M;TFlBD)Rz;_KzdsaaGQzGL?5pQ)Xavh%~FPi6R+zfN~Utv897Lz`y|7);MTs~ zUW$pwy}e!Y>uLttr&>YM2PE7}U}!bIJau@cRQ9%aM}jtq!)DsnRgeXPh}mdAR{|jo zfvMTJ4r!ONx3{;-e?jL%QIX4@$cYM=wBEnZ=Xd|3B_1eW{^2Z<2_HlbNN*h*|C+?9 zRAT6|rqtMjZs|)2iAauL@~>Z(;Nd&nzgl+PnLw_e>lw*v`l#9>NGjwiUaUS=s*R_^ z?GUm+))1SWloj2z459%cTmph;tFJdF1<#7>aN)ct=U+JQ_AcHkU4Xl!_v!Y-T1t z+u5Y^*@Q^uEiI#xQ?sx{YuIQ;5;m*}9yf}RVUh|;4JNbn4G(vyV}Dl%)D`xn&OKDD zh~(P06MM!OKe3j-Xw`kv2#bhVxeUg5%wL)F(qLD%<%?T5T5PW0g)H&a7QM-A2q?>NR`fH0oVfC?Ar*{lDay=OC;HX2^tN)x8NW&@Wd(kcdmP zcps+ZZfhxZ=~I=^i^+?;In^C7dH3jw*rXS+p-nh($82G;>P z1Ecrz6MJQF(z3Jaf9cL{@o4~-Jzl=R(@(St?54Li4{p7@J3yp9hWKp?OqW?Yer74!z7U?kP_5%xgVd;pNXlIBf=E3e3ZuZ?W5`&;HciKGXlW} z25j8pGxV(|o`#y2M{pbcgRC`5ICeqU#9_nhcX6~K=Fm*Gf2Ys1^mL1^T(2K@VYHJV z>bdUcIA{y%0c9|%ySVZdv%mzzEvX$xO-Hj(n;0iY4VQqKaF7L$6AFE_3>ED) zcDdy2CE5);TE7-77I?Y<(#oCOx+AI2 zNU-+?!=kp6xN)qtY2V+m(Rm#->3WUM(u(iyEV&AfTXJ{z_8M~&8gY}rqXxoP7=Al` z+QHOPy+8DQ-8r({A!SfnT^%0>2M35GklA$iIR)zls?)aYW=ZAUbeb#X)&K!o^Y)&= zR&dSg(iz%^H*>2L^G4!@nyaC(YtcrYnP$H?cCH`T-n{ zZJelLG<0T_VffRMZJVPi34c&Lv<{R&G_@qOC!msgH z(4eTMCMOF#FVn2CyKw*gt@!yAqXzVQj^S?~25~w!E@Te&Ve{SYaQif6J!B4Cm_VGg zLcT;^gS>U28lqRHqoc##r%f=fnT?Y#d|$|*)f+U$a72;HO2n#ni~fK;EcXu==QVb( zUNhP4pdOY>7IAn>6%}y<15xL*DMjPkd<~D<<^rCdG^ylN65}i#dq)a?qF~ev7(b7g zlqgm)s?y;A+;QDG-hOs=)+8!Ori>LQiBz$owAA+CzQIG~{gXg`^n1`-$c@2vet+IY z%!9Qu4UZR9LbF9CKMz<^kVVCBm|*9qM<^CEPrNMCjD+|Ln2$3>d}3C6mBWbtA+|~E z^5D5-fwEe`!2zmrPzSkY1ev4^uETOlYi<@6bp0b~qd@3yOjHo=DJLGFT4UVdD zozZp-O9DE^*JlQp41RdPqHENnopz$~V~p9>_iNJhQ?u&#UF_*)qIV3Z#xCUAuB za+LoSy9*C|kF|8gWZuj+^ysjyaTJ~8?C4hNUTTV~C{oz`UcA@w;;)5ci5Cl$g@(iZ z3b&*iVwfu^JG&wqW{>YL_O9a%@mo(y#NXDwRA#alS0tfq zFx*ow;ib;KX+aydgUh+Eyb@sG^mOZC|62Tr z>o=WQ-_h-V!L97I0s_U2>`NFC@~-iNI5auAvXIX73u zpUYc6Z**I7gCVc`@nzu^?>!+STuEWVbQw|tw!gcvgUI2ps5{2?W7@LC5| zsj#U%#_VNL{ps;;;){l`Uya>0fk6{a-}>LV&*QiTr%g$Fej(hpf#lKlxdrQw)3$l%lRW2`fn#Z zCZ^MtmuT58Fb0fUMIZ;@%Q~nyZ2-MHGzCR!h4L#@A~R2y0!f+V3*Swb>5SLey!;J+ zbei3ykeT4K+Zc+N5pnNbU7Qqwz%4-Ai^#C89^WP@3_TQsG|gHwA+18hnZZ-W|E79+Jo>Ne!IuG@$(|Vnr!Ohf_EycBBq9n4LNlwf%g1fE@1DP?v(|9pdimoE ztJ0xO|NHIeLu(P(k$!=e5u z!li;H*Wbh5|7X4`;rn;3-In^iQ=R1Y@10z6ckb*?wa@hi4rNf7{@l4fyA7NPG4bFMrx&C5{dc6C_2>Y!hsA zWefv$VaiDie;uyj;m=Cr_ZcsZT$fKIbvq(OR2HW=1hdL*zC1Gn$88hln3$ojzGAMj z<5i%?0t?OW{!zY(lg3uWO@|5hHm*2j3}|p}y$B2s3c7Q^@SWpT?*x4r2WyIguYw34 zACb+nUb2}0;09l#&N4sSkr%w&6Rovg2q9$I+l1_*r3BTSu@)b`q2P*4fh^Wf8fEgs zBs|}%z3`OXz0@+X&>j;ZHI30A;kQhgKZqK9`0ypbMvaMS3?nsCloX4W-8%fEcSZ@< z&t4ZUR4%s+rSl{_f5Zm@pEApZ4=jNCJrNWPfd!+=ph20_M}Yn}S_W2bFF*!pSXe}h zWkf&vhlg2Ac7z^d>ao7WX|0*H4W!eosgc)j>p)|5sGkEK5QcG30ue?^Uj{h(6!v3u ztR%`&gUS+hW8RcjOsp-Au*dUpMEp*rfYd=A@3=W*c5bpsA-BizrSGaZq}Kq8j+@mj4b`r zXXOLk%zQwA0z@DM0wzP7uzcVNvl(6sOUK`*p2Y0pi+ZZp`s=grs%7EN9QmbZ3G|98 zw>+8_%qFdEButSs`>+h8DBdYBB_D)iG4Eu@j9i=u{5`9%CAKHIgr6`;$cW zP%;j|>I2u~i)^2AHn0p(Gcra%;>0+ll>GVEE~zZ9Wd3*U8M97p+>C+G1M$p)mHo5J z_j9bQtRW1G&p&8Se!$1a$Hu|wD9V?qGVM3{pp+*0rfClz^BkQzYX}1|#3mr1`C#BC zpx=D($XaJ-Ldh0gavu<_HSD2>N*B@lA?{sdaJI%|TE z7NJByT){~MJ5jB}4L$UAuMXY^H(#IIP(J;n&KQCf5DO_$p&p@_X0z3WQ6xMOP?isD zr%dV$YA)eVWOa0?M9(~_U0QF*(iCC-HCk#9WY%KOIXm102ahtuK3UCuez4cV2ZZF% zH>($03q^c{kpwxTy*3pOjNrY7vbaK_JS&1_ep|Xwjl;ChD4A8i(<6Z{K2aT~smtJZ zCUgvsmFTLRoP1$2VAlQe7EA2%)*Fe~Ve?l@LVIKRJ|3l-84ao>YK@$Re#bP>1g`|8 z$Wcd;UI-L3FmT&VB=$rS!t5VDy4ho1Gg)n>Ksc1so7w2{3n)E^)@u^kKYM*$5#c*t zstrLfMO8*Wg+(uyo*qGiGV>EedQe>QK@oAZGa0H;@-njX@Q~xxsmVM)%7e#p08toJ z5S2{H16~LOd(EX;UkzDE{;PCRx4 z?~xDh9_}2#E%-H8gcX^>Y&_txsM==Gf;*tQ&;Ec|IJHdo^H@N;4XgnWZJk{$No0Hd z(;i4+QwB((Qm0I=;C5iSI=$y+R(-KyTPyvg^>k@}tRaL;5z_d}( z`WKz_NBt%wewofzn<<{za~^Nc&x8m zZwzTlL)knDymmj3zP|YQFlf#Xpo0CgE7%%$+17aA0b8)A6J^at5FO;nEU!-YPd=*V zqvZHra#+`q6sr$h>|wFFlwoAx)eGfv_r~53Lg0k1Lu=1wj$g>!jzpmvf%eSk(JzYR zmSpBnFDuAk_>7j(|IHuivk#pDKmcsFp!X$cF^KKjZ8u`yKj@{>{$k2eV=-LN@An+8 zHt<_8yq+z+IVpZogz2*3I|>-MW7ERQx%K21H=NnYB4vmF1bffcBb`>Y8jM71%ts19 z<^`^WHD@o1=d1E#N2~EvV_UB9e;74OJ@vKyik3bz+83)wOqu7y=Kae}5SZzqe|B?L zpdEqR2k!|2ZlI8sTQ7F;JU&DA1m@1%WUj>BkxYT7_V(>0b8R=`d4+#u^T*j;`;0(_ zesQw1d36#Bi5xd-ELgX+m)B&ZrK=!{@O}up`|b~EPtS*wAC&UeuUKZkm@#?3$u=8I zo~YgOLtyieRD-aNg2DuphTUI#_93yzq-Jj1nrA3ATd7b!30zN9_Xu!Pg)A_^=1jwk zkuo?8<>>(O75;+4ap}O5n9uz&Tk}380WK~;Qm(u6;m`2soN2bv+pf$kOE}~%9tZ`bE5p?qoa%jEQsl^o(JCI6SH{&D*uLJ+9-l#kiHQXlupUD1l zIlR$eUZ}R&WQ`#e8Td6SS_mO6nL;TYvs@POa)pmYyc35M(i#?65ygw|r{|kR|2bKp z4HD>{uYjY9sBGzA(Z34=0Dw`koBMJPuV#yW)qcUnazi^TRi{65{RZw&6a-oXF<)r{ zufQ^YH%T4>N1CHGOK?Oml|`nK2#0kYX_!jFXaZJFoj}O>^$ry(=4DLpYR{JIJDpf-RI!wPr~mS2xW{Tu+BjOui(zE@Jfr|I5utaO@`5p=a3g_WS+JxA#o z`lHsaYq=|Qw#9=DHkaE98mx4*v>|7QM7dK|R%5xhH8UQx7>wq}eqP-)^f%s~wnMmK z>TG}m2PHYqqeoAHZkI~QEg5@$`t5}>MM6K|sSh=6+JA!|;^cL(ebv5PlkBhWc_NQ^ zOX(o$2J|ZLQd70Mf8&o#Z+|Q9I$0c*DAUXvx4ab=7WRaXFD3aztQ{`*xOE+n$n>=a zuwBT&AWu)vt_qo68^c)&Ql9*}pY035GRSOD8wap#CM!|&p3RUfl_2aXZ9IPq0)jMMJC02Hj#<r zO|Fv_BjB>hVcdxXQ=fZNmQq&EQi($=j(*vl0yPHr4AL^q!Ama}0he>;7Vi_-KG>bR z(SSvOIkXq34|a=xwkVj7<-k9$4FMmBI>2Qy3{&Og&Q=kWm7y%5lw=kil|p#}vViw^ zy)on#69vzN|7rD7T6l4$MFCkOOXeSj7)YCB=W0N11P)J!wkzHTyH>CJwZws>C-*z0 zsAxWCoU|B1GMfIQZ9ChXc0s~t4nib)0(9P;pIwJ+&96uI5W3u<489boQV6#~7!J99 zO|v5HE6|KLpPGnqlkhk>RWWNdyawBk%h7kITk4EFBHl+!a|d{*_5=6`mC{Gm9JtX0 z;MvrAN3Z%f8AEF+&2;>Ilv)P?*Hf< zJNH!G6`#v|#1w*dT3}-vA0HRK9P275Dta|E z3bg~JVkQzK0PsnEoqm7ynBVbrtV|3wC*>XBezZ~pC7zYrkl}NC_q)MY!uVW%x8WL;Lg%g7jvBIY{tno&yUa{wx^1~?Lc;33%= zvf&^p)M?pd>5r;sfh_+d5wm)kro#T4O=KA=%oMQQ_4eUVY1LWNv|Nayw)e%8yBOVw zW^awZ$?FPPb{6a(94>^f4kICl-}!z2pLGeJ?S8PE&-3rv%%@J5=^p;vUzU=U&4)$p zeVad1X~fKw-Sn3VOgl=C#X4%YCK2mkuHJzTv|0K>9%H3eT<*K`!Bgf;6l@TC#_QA0 zHQDH5F;9b0K2mXm2rxVR9mV@IS~O5E_*db=TiVQseF~%c*&J3Cm>O zOqqAta=iMi^-$OodwiUO+iK!1leRW=&*r1qh(^n)>2CJJM#ZnYD>i;3dO&ma_wk3y z7fQ0GBxGfEH8>fLl~^cm3}tn_qfr2s3msv-KTOVbE7LqQO<{%P?0EN`A4v?6L$r8c zb#(o;PhZihPS5=(2)6EdI zk)Q^kReCs@I-WoK#qAMq28ehDqtdw2guOUbRaJpCfTe0(m)_ELJ@Bn~vZ2jP0o*Eh zQD5&^Pk$V_Aop!=_B!Ms{2lTJA`ttiun=BmXxQ(Xn3z~j6jK1@lj zzvl}Twf*RpKQq`H^Cf4#lLUX&Lk?$ZrvoRLt||j={1JTzdGZbYuDb%p-`B4vrnZj( z7zXVuaJNuW6_JrI{~nHl3CYNVpWknT8zoD$QZ8Z#eZd}Ud|dUi)Y`EKT3v1T3P1?JzP(vymcUv#)Kkv;$iiHJ)CO*7x{5F`FAC#(?p$V`_gZzXj zY=SlaGA2t1)MJ0H&GX9Kz0J8P9oFG z7@&K0tsJooa&jzkcESxRx?o$x!+WZzCk*zf0x%6_3cE$zMa5L9GLZ&{d5LD3$&!#m zzDi#t(%rMG>-NU#{%-gP029ho%(z^3-vhm&Y~;ppD&*(1!GFU3r`=$QgC%x^9j_XH zd9--*er7A88J~!h6u2U(k||tL0-7&8%2~qwJ&`GL&z>#AtATnTh-Av8JAf!Q9U^4!*{epTJ+D&S8IS6M6 zy8;x$6GQ*XtcMs))5d9;CZT`dOIS);_C>yo8^{mOY`@XpH#P>a=m_O5u;t>cDf#1; zr^oe+fO41wKzk?!(U2H36%u-FL1qL)s3djiP?Ra+#U+E$LE2DVp$Ct4C_DfWn+u&z zl2(Dzz}2Oxhb(Ts>WRpCC~Wz}yCpk1gSQ5rDt}Po?C(3mO^cU%!pd4M_pN$yPZszX zml@Xo@)Gw+p)~-Zlw`3w4&I|TAXfsAGKyFzxwiHz$m!pJ-#0>56-XwF?@fDzRvtIk zcj@sXZbe_^YL-|gPKUuP9G{S(0Fw2Wkhprbm?ZrDGYjssCA5z1!z8V3-li;cf&s{6 zuyTr7cNPG276JWJc7{hsgL|6G!N1?lPvDSKO?xT1H(bqhJg(!-m~|auMcV84LvNnR1^;V=rkIeY}V$|EZ37Z-!Ov$25kVdUTtc*ev?|U8V!Ws>-Afwow?a&FFcP$KRzof zs{-mGB&1OF2sXJu1!`Phi6%iX=QY~EcY#Jd)^{(M;*+wTE4p&q z>C{83ldD1>$FycyC&;KFPb112L*lW}vp$#xSlc6bY=4UQ2*66UBezum`8QDWCLrhl zb{+A2%oJs>6cI2XItcJi7|%`=N=Zp2IzC{+kD!!b?VKXZ8AbIMBZ(#nmqG*yL;isJ zN0q>DiTF_12dh?lRZG-8(HB1ZhZ`O-_MsXU^*o-hla-s6d%Xm}oL=Go@2$di5aD zPo!W>gE4a)Lo;>CTDlCg!4=3lxk$ocurcRDNBw7^Ddk0xQl45#Br|Vd^2;-%Cu6PH z%v9gV=K&H5RVsRQn9Kr6y1`r)qx+^QbYMUbf$^|34&`N;G0gI5HJcxG>PX}Z)iM<* z`pRKZ05$Bi(tQs~HDWskIga_x4<6ga&(Rz?u`(8Ds}L60x$aDnpuaGNc1ivRlSP0v z@CK*sxA^S)BZ9Zy8|#ArMSfB*59(SLC&Sm+KJc{k+-nI=HhAWd2dl;4VI3Jc5gbE+ ze&AH4-c~{aA(Lhc=f}Tle~91sUYlGsl7y`tC;tg>LfUAHt1x?+(CvxdLUJbn?Qn^W zmCaWancUf{%CZX_(UZFOBwaAJ70O5PSqUT(n?dRlSiAqo!PZadi{P5dIBLiM_jDlciWk4+dc}k^GL=~OtU=2B`p5JpN@PyE&l*V#1XJXNc3PtU;1JAt5tBJ3( zfFS&FmkocOFuM1Y;^mWgBwk;}B$Aq0=IKXh%q}p;0|EW=F2%a^x}w#qAo1&17#ga< zKV%Sa#WT>8vN|-&l_}&y=(UWZ!}@Z`F|nYycU7WT{asp`S6B79QoCJE19C}$OVNn! zkIHNuDluB-q1S-IlxcFod_v~EFY#}05kNeuq1@hO$FSRU02f3ck>9&5ekU*z<8^iQ zKP2}F#*s|H{?%9ylcCgc#cO-cGTpk3rM#zsa#}UP_9EFGxqM5`0^` z%L;~N`0)I0=iF`A{~j?Wp=T+D0xFypco(SqZ=bXipg`__e?^+cZ&hu1#(<9wntY|4 zpDj?B)*;0clwG@RZ8XNqIH!S!0hzLt@$BA5mhOLkNT+syMUqlf6cd_i&61XZq3e=Y zc=H+o^HN^R!h7THI}J_#BI(>VN?(C*;!Hbrp67p;@J`D7-2Qn;MH+X~-w zVn8v6QtAT_Yz*+toNW4(G&H$GEQBSV?zZd?Bcx(bMvFU)a^;g45o;za3@s5I8R#*K ze}DGiOTbW_Ru5vCkt{*P4%K?S@u0M?)L;dy$s>lSYI?sOK^ zXTsSrw9RPRgnJpoUm@D^)bkrX(8ZvM0RhK*O;p~<#P^Yrj6EgW^|ewIW@YP3qkjHk zxW!Vntq%(OFzN@RL6ZV?0TFi_97&j`#z@TNe!nZEWe|P^jc^8=N|{mv1P#hoDB}#PzDYm*&Vey3|64fOzdkewwHs8g z(U8OlnHMN0-0dI=cZJbq5L#Fg`b2qXww03@HTKW^^alF~Ok)Sv5d(6Ohr{2)zn=Sf zp@8dy2!_n-)EM7cKq)0Mp-5?>TKW)|d&;^F;N17`-2a{p_HeGLrQSA_w~7I$%s%Wf3MC z9vv*wnX(4Kv#zTu;pitSB(x+H3d&g{c6Q&>i^rnAsbH4EB_td{P@6F0o_emyy?e*# ze6rwC<2FbudbxiWI$@MIf#m*|@ri5r*($pN3Q^H)NQ62ZnR6iWmXvSud9+`OSaJ|bOUcOj4mx`rGO`gkrUl3Zd`PT8q?>j; zMF9jBS`7?f4yDFY!I#pm)h=@KQ(@|phV)A(C!#8t#Lob4dauU7kue0Z0FkyoYs2CG z;Sv$aLfg>j)d-wH#I8QTIGQD9AgPZc7YhVI6(>+EpbV0PokUJq`9D73yU(6+jrP{h z9V<+7(as>`$nR}8x7seNGvMYQE_l3peinR1PP*Hif% zSOKegXy|)@4B@8i5QDtZpfIqs&+c8QrAeTFT+~(vhbd85P>Cm$G_FL>YW`ckcbF)$u<)ki~p_ znT1%+N?F<1d*p4yUVBbhTq^~^#S>QKo9x&6c)cdso$UUgc(_ss$LYSP|SShV|;lUkX%Cv3Wdq4%5wS6beaAj z6R=$nzbODn5a>~YI&0HA3_^o~f+RiSBI*|#tN!}m30DPp2a(L53WvHN;_u)9jcV^> zYg>0AfGVDbV!@dXwurNU5Z`5JFvV;4Y!gfp#!~}1TJ`P^V3;z7fLQ1@%T3J=CKRqd z0{;Y4HkF7U$&G&FJF3vw#P}z&U(-O8*=BTm(f5kr5wHE)HH0!wU0=Zm<7U)&eH{s5 z8j_Nf;4)i*r?xPgjR_we@!;v{3BzmUg9Cs)4ZTvwPTCWa#v?s~vXtm(6Nt-{20>xl z*Vkt>`>w}Ut1YG|+dtg{1#<-eO=-@id*#QYGO-(7v7$hb7#ba{NCSTt3$()F5Z5Ro z5gz(u#WyGqw5m-x)Y9>!-0!(_eIh3R}MH=*^b!v2MjROm zdIX$AD48e~i|b6uhuwIw0RP1Gmw(OuZu^;X9eGc>lAR}G7<5yhg$KEb>3AnH&04Tz z9t`aVkhBA&4X4dasrkYW9x2&gcF#T)c;En_HG@1I->YH1X0gi_N{dUi;>39J0Lj9E zq}k7Qj}%gvY5DkKsX{Tq9@7Z)LcVN((%w(M@0I?fkwh$}dlhYvvtkO!3^^PEkrY`c zWcsTq_>62G78w%nR%q;4nXU(DPl>r5pKy$i!{b@rr=eLht7lS{q4|miVW4|$b9t+_C;{U3yrC&fjckE{qV)u&ks4Id(Y+^ z6jS-D`iSdCH>LB(E4>a0;eCoVnh4<=KnTDDRQK$i*#xLD5T1D-AWDd}35Wu;X3Ptm*XT)&%K+oy z6HZQSVy1bIqybZE^^Z?zUja9|vhLl%@)0}~I%PCJz-;lJNloQ1V^TzAB|EwzZ7CrJ z&hm1B<|nDZ@xED?P0)uz{RKCMw)QMYDQ+dHJ&Pq9#l<0}(3!*xeFNp+nnlAv&)!h6jz^h=0OtC$bC{wRPd8R1LSgf>NNh;s19Z1u80BFy?f!O=y-xq z=hmDB06+sXpUe4?)nm-i@4#XA=FTMOG;+RVHKgU@LI|41d9;tnK7vI0IZV|+`2x}y z7w;5v>6_mt1XDNwiaAqEHwv3{P1S%_9yF~8KjN>S!Fxm`JDtR|GCya_>qPd}r<1Cy;h+w_K3&BEM~q+=CTtXN z@7*4N$_ZZ{*;=E$?w2D!Tn0!gfboDpul%(eQF8~}&~Abl1xl$`s0`KsH}`I{Z2bx!Yl=Q>J-D59L2Ic>6h6R$K*p1V93$PH&j)ygul%H9-R~##@~- z!ZRI5F`}JV)RaMe(<_}JbGWnPorFR0L4z1>D0I|7IfAqrJ|HM6>*w@8G=rhW@|!i{ zzD%yK{h7UgdHq@vty|CYnVe$#-r>8fEUJIn?EJ8Bp+m|CbuRSi*rcQ^pY6cj6B9uR z#+=M~JywI}Fv)W9JoPXqvYt7Dwb-Q&&`JXy&B?_T&XD*B)Bz)>4sA4L2Y$i61R-6^ z%w}am@@`uIN3E=wjBh_ccp#b<41Rz4ti?Q&Bn{b3(1U?SQq?sR9r>@xwAB*hr!>eL zG#cWYDDfZ%KOdNOp|_7qPnQQ47zQW+?pIKr<&WzfX5Gmdr5nK$%}MqB2w|pu1)MRD zMIt~>Qey+EXy9B@26L@Ig$8rn+qZ9R27Zf0>gI7pe)DL;=X;W!kesBWbZSuf_3eVc zV`3h*FD0`)MNj_2I8C(W=6dcyCA3|fR=nLlw7T#yVgOIxP&)~rvDorh)1KUtQxni0ORP zQJXlp4jZ{szRHh{=lr_(NC;vD+;Rsf?uQ`JTn5b+Z1>>SwJ2{CBK!ejz4sahnRG#3 z6sLPeKahEY9Cx4%-f2 z$Fe$Fq!wgedeH;D7SAV{?8-e}(tWt}nHU%bXvU9cek&gw>*}2nu^Il*VKpF6WMK>P zsy%H^{5sjQwZ<}ktKXEf%05q@A}>Dfkp!9we$e`W^~(k|fZ!0^Js?=i84hh`lV76~ z*$e|gMvw`m@BlJ2VIzn{`h+~0TkD2|gxij9Z~fLivce{i%|VKgAqm|n!O%CeXUnWg z3*bBAuAihbd!l|IJpPuwT}3{@I9CNfy0bXCgk{&?clvYrm?)uY00?8){tC! z&2;*b!9K6t23Z4tv87|`k42%j;OW)r;K!5E&or01r_q&YcJ4x5i$1ZTWZq$bIWz@zvNkZ&7M8^K)-Gw|6JILBBDuX<0<`qfuiR6+OHU z=YTvdQC)TSffNYToG224FmX0@OFp4qv;Nv8w+Hi;%wMwgFzjE3J;ahK^69Rgc|SS4 zZ*$;=>s#uW&)t&7vA}%o7I6^(4!}FHbJ0`g;E}tc@kWy{gx=kRb-DdGTxgGMIqTMP zdQ#lUg}LE0I>lQdoKB9&4x=YSM(w+f;Neg$nWAaN2_UksW5#Xf?rA}~!MEpo{xsqO z^Uab0hCAwwHky6SQoYR^k8TS5;7TUe!8`XT-ri`So%}-fsL0j3W+1x}G98cB8Hd-P zd+ty-a(Q!sd&VN^7!=xuo`<=7d7Pv7@g@>`1pg^F`tl-*L?aU2r!%?(kG}VFElLi2 z&mCwaBQ6M+G`ZGx%=d3--dYlLwh?&Taag?P*N}8tAGP_pt@p~Iw~o@Q;&`FV`ocYv zZowW2^}}TXJ=6OWbBf0;^Y>g%JpOJjMz`hf71Gqh=L;aAz`V?WXulqx&W<>_J10Fm z?iVaJC7v79MUxB$B8>~DMM&A;f;I3=K30ZPAnI?-yfJ*^Gct7DF;Cj=Nmk}S@V&=y zQ>_Q?b$Bbl+fg!9<~3(AS}!OrZ=~g%Zk}V0v`|rY!iq4CuhEj=e+f7HT-Y**lrl3v9!I8bawja%Y-y{wp-gd>6f!=Vk5(d~mE_=fu6@NaD8iK3h@+EC+xJ!|Q{;%xVrGk{-<6yRAOS{v9t1P zQoUxedt6v{F>%gf`t{3{AJ%T$K7{7vJLHH8Pt}#Aa(}G7k$)@_HSgg22T z_!u)0n1~!KpwRvO{g+~Dd*1*xT&Q;Y_Dl`jfW1HGzM}V0?gG8z=g_vu7IKM7R(|VE z$CGRypf5QJi@TPkiY6m=2244@A&`2H;dF`_RDFynkQby@+`aCc2R|2)em1zTRL-h? zN<_#R54|cHje>cDOO424WqrkFtm`6(ecxVVXph1s?l=XO{;OsoSNhG-HpE$i(0<5K z2ksq4%c#rKU>4O#1?;#t$@x&YnLGNxkR2@fA_697X6E}1>9jSa)g68Rr>edLGGi#C z?X`Sy@%yPrq%}?ffZN`5s8HibN=O8H-n?ioiY8A|Lq1hFVi6X84C*RC9T93uueIgS zG(o#`%f{q|9DLQ=a43o7PqYFnjbimenH=;hqVi!h;#?%OwBm@vh&aY?JMNLQ=}XoI zUH~J(nZm`Y`R4H!n9pfnJQ>Vdj2(USutb~=j*@+zU8}_$C~Ky*O6dIf=SAORa&1v{3f(JRK%`bW!)M&8hlaEKHF zas^q7TQ z{_Vx-RUmh%c}-)OtW;_Mz`*9iOm+s>Dfwwn8@L>G@#~jH)EJZCTvJR?nZR&QIPYPI z2l28)wN_h~n_>=Q5GOv8)7B25gwJGTP{55>CqE3LKE>6qR$wtqzG=ub6T5s3^9f`Z zL84G)z@q>8@pkCUp2hN)r#NN*(*gvY!AYz-Ll_Hi9%=T@88gQ?N2ZWR%mL6PFpvNa z3MqDoLzck}8~PLbYY_4w2SMt`mu+N*0ap*;;Do+Dxsa9%);jB%m4S6807a4ju*#o7 zb3Y(OQ#CzYeNj7ef zpj5v;86ciKuzl*30dm^(t-522wNQ=WRj;Ytef~{LC8Y6Pa-B%RV9$|@#Am{@N@?LEigdlC>JeuW%D^z z$AuRedEi1C(3HErVDO%Ifg+EY!RN4XwwYsLmU!TnKDjynkl&sRE^4Ty2w)4KCgBZu4NGn|kLd3BO){#SC(pP3#1=4oa> z3-+8UcMgP5!FiX_g`?fc(8L02Fff1pUbTuAydv;pdt=k(=I#mb8@&k4%GL1<%YnK^ zQq%621OpKtT=d{HQ9r>N(e&psGJ;^GGW(%=Ucs=j@r1oC_jQItb3Dp}-!C*bUJaB~ z{DpHm;oNt`(Pxkb)y(1cNdx8IxGdR5(_R~#F)~&(3J1l}TwBdKH0|(0st&j7a|@7z zG@o2wzz7Kf3dofH5819YC_;D#%G;Jv&h;0t+D1noIW%{`85b~_@|mwhVT_371m4XNpK*|K=bu z@bHYt5P%xK4{%^4F)=X^;&C<=Eg=%hn5GNohNsKDu0p2zr3>(ddBg?%X zJ`|FDW^GzdF@#MF&Ofa59wvd@aIbx_8{?yos`zkTE8=x47B%jZ9Z^?lMTtKV2ZWwj z%pS5p?N?JCJo5aNhuR3|R9KBS3!p|umelUV%sIpoiE%*UlCBbHMM3l;z^pP{TU1c{ z7P@m4&5eAp*};GOEfg zY8zHjLT>?_l-SEwQp7H$ne!k;< z$2j8*k7u(t`@Yv&_ngF{vz{x#9#JH8}?wHft*4EN4(v- za!x*59JA;KI4eB2KYVw!Fj;G6kGvVfT937FoT7$3d)H&&uxU_i0ma4ZOF zFjF8K+yJnKxn@ULJd(^$2)k*%bbr+-au>2lvgptO9fFf9WsO}>f3D#Y?4#cSvV9jN z@oYKe;$oNtX$y66dY_2P2~E%EkdyFu^ZpA6BM2p6enJwgto*uV;5_J$oFv5EkBWA; zpA_Y(RBz9oC$g`o6xVLOeuH&)#bx^?1dNn3A*WZ4XBPGOXwO1wc`C{)sv(*&iPMVU z379oo{)`}Q^$*4+=CE(4}~&l=+n!$WN$avx<@Q3CdMmmg}~#$0G4{) z>F88X^5MfZ3ybj$my3pHHuak>Sfo5nu(|s7Oy-bV&im}tEKo=wOhG8Em2*tzLDN8H z>&b4Asst()9ccA zKnZXJ|8qrcWnsvM%1!rR0L23ep{^5Xf4B(WfvjWr^0&$dQA+-UKR)?evBxvr669~& zk{}0B2>bK(J1a%ba4=d0?s$hoLPdmuBn*Xf`cK{g#_qUGY{qK$=fyNLcUo;~7%j#7 z%31Fqct~VfkU-T5?q$!s+R$o_H~PLL9DK2=w7IBr(V70S)J?=^Oc$${3h7=7`fVTP zB{mzE3$=zh(mgEEY#aBnsK0!*8|Q*?+Yjca#P|H_rl(If0aBb}&>AS4 zenAO|0T2ZMvV%S-ug$>*T0STgj*(B6BnrTJf9*li-cAkFf)41@9OE{za>Y*#h-YD zgyb%8yj$Dzcxw&chB-4(eEu9&fw$RD;Qm>SGQEbp`T+`s=(IGsb+w{y#^6pc-^Z94 zIQbjP3#J+1vvCT8nTeflkGgxh9CC}<6Xg3lA`diw0LMNONT$f-7X*$0T#;Ypvfygj z-rgRU&!2RJaN~Ew#rf6K10fj8{Aa61FyXWu=`uJ!dJN%V9LQr0hW>?JTHtMDlTpmJ z607j5udjK@;isAPBkn&=JY`dFzFABWY(_Q2XwfFb7rp)iky~JFrVU|S803P;SfCo0 zwU(y$3a^WeYG>rZ^IawZC{A@rATEdiQ9k$+7L+s??q;>aW`Y2$pnNiiv}tXyBYKG} zX&Ut@)Q`!VhFBW(`^+-R!5b#0KT+P}HD3$@#eP>-TDEQd5VYFxOVN;GWz(UXeEGtp z_ah8^;~=DILc1ynX4S@;Io7pY<~4mI>c<`Ha&VSk%d?l4BlQDtgcz+3P{6LkF4_17 zCzQ+fY%c&0(!j#&?D_Tir5~=H&na~|fU03mB>f z+$Suv)tio9wdw09eKb~s!!3Bn=G%%<3MpJC}GVYQak94WRQ9G3H zyxyAOV{@ScSr>0q32|>RpD>ad`SjXuNyrT|i20Bx=4pfbJ=Ng)QnqFVk&rhjEytT* zP$+;FN$&K)lPerW)!vZ35$DHZ@zEy1`cEKnO1D#8?`^yL+q0-uIb(qL)oy$&{H69T zMf0C>jB!>OQQ%E3t-5J_;5&k(k?J{PC{6eyq+M=K!zm3{3TDDEv8!L)T@3mV;ljGv zooLEpxyqzd9CnN}4JK*Btc00b*9!e+VUOc2IoJ?pY3>B%eW_AUuz3oN^PpRHt{*x} zQo3?)FArRP7GPKrofanssQiRxQtEis!wjF@J8;pd;Jkom%%8wVw!-oFTh%Kz5Of;j zt*&En2kWuN2B;xBeNXovXtlCuJVhn)sG~XYxjx4r?@yP5y78t4@TA>?1@8sTL=>-$ z?sIQ)$yjF#9p=I2R6@(s0PUe; z90F$TCUz=`_~V4GFYJszg6Zj&uNO^hdL4>)ji6b<$_+g`{HMf78w4tRell*BMxG>d zSrhO=gjl6NUoXeB=WIsusiBAG1RgCR?*uQN4ZU%9e2esZYme&M8EJNHo2iWNGprce zHVNM!mu9)aH!Zm0UTTaDY0L;|oB^L|plyKMe__UTZV9q3W74B-Fmnn#u524lO~1^r z7|JC5DY5Ix?kXU$S4&U&=~D=q#4xWP%yDMqbKYthwVr}}52KCMK{!rH%l;xH)!vTO zZr8-R&bbG9Zr5fcl29?S$3o}}rkE1ggDm}N_JbVw@I2cFDOpt|yd+rnIN_q;tWC zCQv}9d$}*A1009JwUdG%v^_hpU>p_E z{cKS3wyG*UBV+5z@o>4S%&hmyV}7y+pj_oDngYRvAoQsCy>BX~K>oo9a(oW+0Wef0 zTmTy}8aJfU4!JBzgY90W2qPvh1!;?P^roqQ4RN#1$Ts`dY{Y|7*X>z31m0iR(g@NB{mKqK+9cv6 zqPBIu{zO4P`^ApOW!K3!lgG5#-!1svNnl+U7}jaKQ@$xQXBTXn3yO1SM?X0lf2)ohXc!u#A8#F zQHexb9*ReJ1zHsoH-W+ADipeqz~cCKte2J)YtfC#%Z&qG*cu`i#rk?7CWag z)cl-o*z=P9u5+FVeLA&!pq&KfZPi{EBhW_~tjG^DR|DVA%#O+*CZyDylPo`-I3C z;@gW zg#sh^v2%$>->l~%fbfTlb~};BfU`=^6UH7tR6=bx8RS z$htk#FSpr|UJ~$_X9e994o+<0%Z0y$54IWgyc!ZA<@6!O&*O;3%f9Cao1SdY<}RkW z&VhHOrr%?!cw~BOcBHAwt57eL;9LYhX&g7~Lv1M>)wdC7si7?-yG#TY~S zwTc4fG91~+lvqMqg&a`TgFo}bLYfm5(tRW;rXof*@x1!dyYaBvfCyI4AE#<$>Same zE-Fj?3FXy`DERujko2iUTls@pS1_ZWPYq%QGNYCv$oSq6Ep|jM!r1{v-=_UniQk2a zZa!&FX#z>$pi|m&2u}obaPR7TII+f+0np^;O_vI<35Tt^eda(6Vx-S<*_1U{-1hSe z8QcO#dnVmF{|?CUgJjeMWF~+>t?T}f42$E0Ndjf}kU{$G+TOkunRsCFfN$XiHh42Y zcUFBF@qF+VekC~W*t0nbrO5Q_=CYkHMix15hO9us0YojOKjuu9AbaZ%pt7CKw&2MH zr0yzy**^CYgh&POE3Uh6;Lq|tNMt*CYXX(3Y46#G>iy+;ms)qoJahLrv0LuF#1K;& z2S;ioU=gg#qLNc5E$z@{(BXYHk?U4JD@}G2h+l0|u|&^Zn1Jxe3-f?Gk%C8bt$_l) z@2t*n(NQ()jPKc0KGKYbE}4I~?S-^VHxaA;4Z(~I^<3FzQj?B zIg{hur%4nO$MR_2j%z2+% z$BiYi+Edc!<;f=Pk;uvOM?Wx=r6moctlLN=H4asyv^FtgOL5{oGTi+`c8qJIJUu`U1rKuTW@4trshFk+Cf{GszphiY!Uum#BW*>Y%V^itimty6g^EHKi z1s+pMuU|_8-Ua!kZH8>nyF)qfF)mI?O$`~U2?1PxzYx+6my5}qrMjkn7oY_ikH_J< z%4_A8c(4zNUvl#$Lb=s^;iZ8%D0{Zh8 zs;U6)B(!0A`8DtO>F{WV`4NNW9w z_@7;hUjO}_-wu1Ja1pFRAea zXAHeOKZ1k^Sv6A{=ly*oX%N)BPpAY08qx~*O_q@F)}sQQYvI+d1ObyqlToCQJRD;# zwKL_`-SI_|%5|7$2V1>6^9qiW7G{dduN_`_g1h5*t!v4M5UAKhiU32fp6dhaPKfgg zI<#je5RO5Ra9WD;;2Am^PylCn^v|&NzM!%m8&$pzGi{BH#!6_1%C9PIn*#C_dqS9m ziK?h_y_wda4+h{ie~*tjp?j|lsbEd$ZilBa^A z087o$Gdmuf<{UbXH*U9TY>?-Z%(rXv>+dmWYp9ry(%w-r!gLF%mC5?$-};cT6Uc2` zF^CEfGlTAsEzE5yFaIppI#QHU4I*K>e#)gpHN7^?Ke2h1@Tcc+TM}VN{W`Bo-i9d9 zxtB_SFn8F3+Vz>yv)diqKDnmCoY*#wPF60u?7u!|SydZ8R^9(%Wy;Q88ABJMyi|ri zHq`Tkhdpb!=ap&21l0PAM^mh`ssD`m6vFMV>3X4Zlo55pa=$D8A=Z(>beseW&; zs+joDZaC^u*K1lKct1c`Hkl_H=(cPpc@!sJCfW|2)YDFj;o2^z_+Zu)2K+^k= zfC5ZR!pJy77Gey6kLA^N#P^%b@f~)s_#ne{e>9FsB8!8gUfJoh;_=yK&WPXYSeqF% zrr59BZ!quk-cTdYb9_h8e&aCJvYpfuu z*^KN#p%I_nIUgQU)Kb*qWzL@d-kS}lQ$;7IdgYfwxm((K5|WL-`gRS#X+@3m%TT+g2N7%^^91e`?DQBx+9q;s z5`~U2w1nbX>*%etvR6TP@j4uRTEf`j?UG+xoZr&nn#zStlBHUIY+*9hUNf=_()Ck3%jJA8f4 zFUOqP_Hog!yxW97{g;i#`Mpr%4FUmb{|{gE!BXXM zPa!3u+mML@-q|;y)41e+xd28%njva2pN-x~jl6m^53YRB_#mY6e}qHq3#58JYGq}` zKv7i<7NzW%Ol9EBX@NlCkSw_J?+l1Uvz0jHD#V}v7yWkOL)rZda<1)o0HuUFh(oSG z4Y$jPVLAo@!+S;5I7miZo4bR2?a8&cs;bow;Ke~~6+}21S*uY;O!$@?5W(0LqZOh} zUo$&UOd?;(qxR}|7W|}CLH_*?*(z$O7Mn`-DNbalFE$!HJX~t)U&}E>=Gn=_yxJVa zLSD-!HyA8lIS@HUSWr2U#wvs!lqUmWAl~LNN%6?q}s$pME`yK?IvY zCerOCQr8yi<#<(9%*rV-=oX+Jgc|V8kHsyQ$mj6Qae}ci0_d2TbH07U(;2hp*?5O- zhr9~KA7x_@@RWw)13H}O*fi^rGc{Fwxv|La!M<}Zg+Xi!`p=icG_)`uAOB{-KJ~-4 z5`FsqE&u&i)|CURv$?4Yxith5m#}vzkum+8wM9`YDx&+uS@-d4VCn`q4IJ)Xl<3y)oO+EiO|9$?7O1npU)ha6$)tog3Kkvz z=8hXq!gVq81s%B`$nwfstYZ>Vy1^{sX)`ZgD=X4<#4M5w>ArG165_7mz%u@vtCFi$ zRJHo?emMO&5E9^M!xIB*Kwjn_Wkk*T10jq4`GoH!^NS2{sPTKT-%3Fh^4{8wS~?^Qd0l#hxt^`EnZ-J0n!CA zI9L!`)v;(#K61x~2-PJeJngv)7?u17;|Rn0xO)0~T+s?n6TUPz-1;}Chhq$}1rQB1 zW3$rL%_1_);c>X}zI*L2gt`;iISawsf;og=dpq!D7;0U&DYz@K)b*V4;rbzo1J5!d z4wIB2{xpiftI*iXqyi;HV_><`bKzefwlNru<6pbj!0Qn7e<`@PUY zo!WTd^f(H)2EI8lK{=jvB?loEc*wI`{;o)M|49rfN+6N1I#2h6EI!tRdfM?N z!AbVadeRB}i{wC=2^SV(mRDxaw-&c*x3cVGX+(uz>iTSQGFKlc^SNyNS{=-`uhscg z-U2{eB9A>J!#OWh?=ETrL{Wc!Fu!Kd>UJ5<4S~F3jB_Cn^P*X*e-kCciPddD-zrcL z{*8+15d(OtrpyBg;dm1`b^v+p>A^VKnxVy6hbNH_KBvo1Ya)FWJb>%pzxX6wnMdzk z(r|?egI#a{n%_L0r4njnhF$rv{~`gIca_`PX(8bGFj%zeEZ>``X&^U<-F4Or?9>8# zO-06>m1AP_^hyM!s}(=!1N9OL;H>W7y|jP?nxI-s zO_c?#s2c9I`_Y7w)7o^>5)8+$K4Yc6?W<08?3+mSxjN-%vwOnWa323frg34R;jNU6 z%wm8PuIAZNg46b_pIN$lAZRA+yXbQjp=o_te+&AU>MC2k<=zaRL^L?jK?Q?cG7{vT z9|3CvGe&ISJ}3!Z8TW06{0Ppm5Y18od^(WA_xJ5v&5fbS0;rRHc!3-c0mg+9dJ%+!|--Cdjc%SpfjB3S{ z*l3`20}@>z=3{Y)QsLb%tU&ggpnn2piejbB>0~9To|esQ)}5^+c6tT|NQSY8AbZHJ z^dj>(F~B0F%XxeL1H)_K-i_(>+YKjP_h6jK49~aucrBZ3yY7-goyPRMlE&t0U`(`0 zu|Rp{wtac5S!KuOQX38y#e2X1G{eN&Ub@l-$rMrnYJUs@nYpBCmM#U#XrPc>eY5CE zVh;k0bLYbUKhR%>c}>Q9#*0HISAKI6cv3i_d9aC~FNPE*Zus2+8G=jQ1*8zjE7a+l zFiY!XRMDlz!P-Z>HNP9v)7p3(>Z5_2H>S87TDijfU3^1nuyF5xk z5{y-_Ac-qfQUf>;~YrL*l)heu2Ht&IqS9m^j7neF)X4c_Wm#ckhZFi z$+&E$e`U3YvN@py4L8H(mz0uwslo~A%>dMj9?5J7m1g+ge$eMo>7i*s4D|@y;-vl{ zCMn1Z0wY+v8f_=OYFuz)0FWq(UPU*2s@TH3MjU{Fn&SPP)(68Sb8&^*Wg$LG z3Svb&@$!ezJ>eoD0{C05! zN&CvN_9+L)<)pc+01`v1}E^7kJ<;z5Lm{5O6#StYz_ z8$y6SzEQT?HY}+j%_B~B`^!vw6#xf)4P?LZ2BV1OjSQYcR27$~MQM$Ql z@=%+0C%kQiK?b7VL)Jcc2Qk?=OX3+ADG3z98+X@1-4wTwbh=ha((G8s%CxeYD zdq|`jERs>bcn_(u)`no=2MC+PlIrD+RbZs$<w>NP8KbZER4}YdgS(o<{L?p13H$GssTzqo~~o}m_=^d zPZhtr>^q&b$Y1D&ORZnCUpj&a9egJZA+A~pBG~bukc1XqQaM~_^C6tVjiTZBHjY+N zb1Ptp84JhXE8@>EI|DZ0jHinuxNpIeOamN6U^oKtmwIxR4(L#rnk?qX!9EvE+-(whK-Gy8+)2-~;UXSE+L@P|+5(X1>TLaUqmFR1 z7XOu`)A_r|(D#ad-UOt5H7M2-kpxk;#h<&&zw=g;rC}{)cyj^jB4%lco=iY!BNYQR z5ja36zw}H04A4HX43SpKXNR>U5S;b|8xkyV6Oogjz`i?#+D%lE{2}@IVdU4OC3Snx z_LseXLcdUb_OHMl*we(%oQQx-S*2rRrFRH!R#iunR-M0oeR572H8wSaG$H8HGJMX0 zVc$m(0!wv5DLYZnnolK1*5K@54LONTt999%{bs@ORWIZ7$KTlmH`yu^1rBzom^4b? z0bp`N@boV(Y;wqO)>Ml)n|9XeSaJfV(_fR$>tz#o*jg>f1NZ|;%HD4$E$Ak|3jrQS z9S<9G*ZETJbHltVDoUf&{2|;6-wQ7o&b4vRF&S+)yoE(o269@pLha!EpYRH{nquSt z1;B6W7=)6xG7`pO#egc)bSYmIaLnCaZoNgPYWNF-`IZ2$S})$DBx2a-&j70joP8cJ zPeAiK{sG%vbC~8=NXs~z5iB4wvdBkr!-e&WHO0_hXjVH=r*PS1X;$RGreZfA&~MPI z#<3N?HKyx`S<-mL2VBn2pFWZG3mo%9$RZUzeQ?WDEl}i}aPVhRSgcvp9Zjy+!AS;% zI~2ZiB^u3u7)F~UebHm4eku?Sfa-p8*n^X^f)bE#KlVJ{GMSllhSnJncjUWxolTgD zQYy*wm)%1;xq*BKQf0|=TVL)r`*|H-9xvU}cBgqGeqsy7R7;C+H#L-huq6RpECmwA zw9WCufVt@yb;T$JU)uNI*GDtyBnUmAdOp$nisj)tehLJs%i&@CJg>*Y+sD^Sf3l$u zd-uK9>Uc{45Ja-dDOIs$4rCU3fG~udcQ2LS8f93-bAjVWs%F zjoD_6v+Udbr%=|++X0vFL2?cfNj5ahI)u@K^e&AD;H2=y7`2j_7!kCznq$z`jC$Mu z7Y`}$kLi11AqM0GW1##e_JP@1gGPB`f?iU~r)EDX1qF#11T<4c=g%tAUryJje*Ad* z1tk44t9$8?E-*Vn?%~pcB^C*ot0}62pA}(bzJk=t7z7~xPeJ+20?#uzvVf-t4;TrZ za@ITb`G?zc-D_~Q%CiP4JYCgFG>z_{gdmt8(LN)KZ!JwK+&NC9jt%2a$B5PH(5dke z9zMY39vYJ>t*l_}5^tB}8S+3t9e7Y35orf&!zsW^c+!m?poM;VFx+p)lQwS6B?HaI zqokyyQ8E)?E4j%3hzo09-2HP%qoJ$q=yESAHC4OwM|RQ5zZ%`O^LKH^CJIUqp#=;J zlZ7!}kyT2EJ3kqGqr%0WeyIHioM&o^!G)VjV5Yny3>DJ4#gw4HFL0_mb=~I+`q44S zw;a877B`32`NTRc{JsHdq8AnXs9Xw}WP|c5?fk zO5tSM5y6rI&>uD(e6+DJKlsxZylh6=89;xTZjK#++7hy;6A3nt&dW`_-}{DmaS{;3Me2%oQ62;Zll) zCII5%Z;pIJPCzeGz_gj`&G;`Ub70K*aC7p3MD^e2msmHx$d;5p59IF#e#!v&ZiLvkQ+Fq{|C8I3d=%;aAbJ=>(hzCNDvF8|1(YYNb$q4Y11lPm=}&#Y0!Jnyc4$Bi6#6;{-z$ zs)#4{;Xj}5vM@(J^JyS( zpfm)Ao+92IO~GY0N95~H2%$P0H2=MKL!Emt(2{c6v=vTv!?MIgSVpj$6ZQW^uRSY? zcy)iCD{ovM`6Jk9SQ00n|8HTy$qr1z2ghYE5Ov6kB3a}+j!ks##kjsH8jc?ge9G4= z_{h=!cB!Of(~?6L-AGHJ&z(R6>~L{FCe+sWDE=Uq$6MZIbPFO>fCiwVz6FJ5u;%eK zBaW`^t&l88sHSI_)Y_CDhd}H1f4C#^?4Z~2@F0Pi9n|cAM+`b&Y9t?&v@sbafH9D+ zF7s67HueG%M;`fTL^EAe41T?EN-X|qHiT=UilVx69ci!%B+=OTcxg2?8fc?&{)3%I zqKvX)a-P6c1;C7_g9M~92t2XO!k(b1O|T_H+XfH}`;|yUFr<2bkhFEp2^&kIt*4kI z(}Eps!-y93L?KdEnX&b$uc)jfve$b5Wk}D?Qso{nycz8=Y zeR=r||Yb=D+>E<*inp8}%SXUFP;)cyDPG1A_@wDK!^XWNz1=PUZMgc3p$$!(8 z_x8=PD~3F%32QXEar{6z+Z536hoS9Aovo30r0IBRCU{J|s=nEGo`hLjWxl)nT+d2RF}~6m`^EEay|X|$%Eu) zX^lf<5|iS`jpE5EW<{d$X@kVENdo2fbsr4u#;iz6=J^%F`)43J zmsmPQ&NJU!Wp?#5db@m1c(Vj=wo88LhTFc}W_nC&({b(bc7Hbitf&jUtTghcj_uNc zmXMh88+{_5LLIEKm!Scjwr?Nm6ekM{OEcFHoTmLaVYGhx*OP6NXQ=RIXyfNx62jD4jJ-RI-q)pE(F5O! zX1{q&rU~KHKEER})>U%caW*+GN#ud?lzlGUfb`u!Cr@9~U{w`3Dgpql0 zVSc`O^3M&h-zk@2G3f{M@erKIKyH{mz@GjP*Z+%gGH<=c*;^_GuvP%79Uf74|9tUe zC*im(sMP=-9C0YO_Rp4Ih}n_qul@>&<&*2rn(yR}(j0imNfK7e+AT&!U-2-UZ%)*v zVwQ(Lk0>w%K~EGY&9op9j{0uS^kZOVc6-Ycsns&HvJd2~0}S<52q|&(?A=A9mkTVK z6$ZY}1B5fp;E85eA zO&A(r4j{UGgV(dN4;hcGOc$pblhn*GKhL;R4SpxuB|fG&`Z_4xV!6stLlQ2OVLsq- zRQ`sFU^hB-;=|Thy`JEod%ibcp9&O|*_~Dt*T^9>e-5aorsFxJ9KS59Et;qu8S9F? zHkysC0;xWY6tCO|v5V`0p{6;Ja2y-CVcJ^>7XG!RvRZ!;Dst~p8a5R-uh(D|E#)(hGL754BgG<{^3jm<2mQ!aI^;h92-$uY?T79EL=w`T0OV zMIyZ*N}!>lf_%Q~Ajfae-SChu_dVbKGdgASrLeFE$4oO`NflpYjF{^U5nx(0f*E>< zDqi_0M3R0d7S`6q`bC2lxd-Lc_-#=3%xNx z>YIDS?|Qc=cysT)W|B1=y=Tn58ffSkcVFHso;>u#j&>|ZEnD~VsO9_OcAe(keom*S z!j?tL#$(&)lH)p32ve?ax}PnX{0&{Bbs8U8R9mw;VagRHHd1(#*@_FqRHQ^D>Spx# z%Jbk34IG}_KQGY{y7E-czBw($`=T!!c z3}Pxsq8(fEc=+ktC>x}YDLaviun={|eDYE^zP~D^WVRvwP*46(?Sn0&&W{av->Us_ z`3`6ajx;GV5+~ll>W_|!c|rR=fQEY*s?%7@!nl$|4voYfw$Rqwz&0|OOY`FLr$tbc-f3v4A9 zVJc6>!jh1cRS!C)tU;m&S1UpoL<8ii!xMEDRE+9Hlmwv=$%%$4qV3*p!hf+t1xYK= z;3TmvqQJ{TE>coxNWx=4GMmVjeJ`jr)p=AC0$`FtnYU!RaXhwP}QF$BJ zhMIr%x6PfCvl#RkBKejzb4oRFHQe!+OW?Vn16NrRuCN5B)2A|F^PcwO>bw zGofU*4pnEEclYCS3%5Pz+cK{6QpLSL$j$bKeWTTCrOSnX>&dptkHwBcbl>*R6X~>Su~>WGpj@Uu#-erp3GF;|j9BO-J}V+MVA7kLkTwX_wAe%9}7PKlb<$Cf>h zg+H|oRTfiZ+uW7k@L(k3+dRWCYvpFC@acZWr^6MUW+jxZTgy29-J7{PXXfRli#qa} zi;8@KJ&tF6<%?fIc3TI<*jS35a2C5-t}pYj+AlbuyRMJLtXVkBS9qWn4u-M61-4P;-~CV<|A>?C{Y$^QDpg;ix=X5J zg2=oRVXk|})%UJyxDY9FUQfC)Ugihd@Owbe1k4>-pn&xtbK{1xQ|q66Z}s7VF$<_2dx-Rord^Os!5^T)1sr})=nvq=(~O1hrsd22myzBw)AYpS4h6%L zTb6so4~_PMNrLoka#((PRd>5R&ZY_cn@p!q$~v3qABM%l`gQ!tuW8J01G1Pi1N&~v znfbHl5^0X+sE+Lz9IyLd7mmnfuh$$Yw^*wyqOs=+jc7M+)sRF zg06S9r#@b4Po-Nj({M2C%PRLODB&pZDIz-!gMVe8$m5m(@t4vIW#bX4{n_JzR6$v) z;H+w5r>zmv@jWdy=Jeh@J=u22_OFQ!v>ps0teE`om8Y*L)mW0cy8_g)G0EmP@>~s8 z?d#nA=t#Meo|atss69>Yt?kzpxu&@O*;G-2Ah0z3Z8DeX*2Xbf=SIbto+^GBp-#+y zH2H@4cO3h>`z3FETge+bLvnK}90r;EqYW=cA~jmF4unRMM0%eKEj8s_(@bl2OeyHe z?Wen<;e{JEl}hCbHW=uyN;$~%ng0Fz{8WD}t?)HRXt>W6S9N=~{b?vuhfmMHQ*(_; z4rRAn)U@L!2PSiJjQ#CwQ%N4^m5qrvTbXlA^r#2Zscvgo!PmWhnTVQ`x44J-Cu^N> z$ig|d)e zQky??L}ocgk1ufFbk-`Em3^$6Ly_}=k?AGvU9QHqJw5qsht7l>!F4hFtWGkeN%e*? zvJAu&1aD}_Y^caAk$;FoQ$Ad7Ez~>X{Ml0zne|XbN|diuH1KT@yD5FnIv+2uw`pH$ zdl!E9sofa!zkmO}PL!n;6sPurZ7Z8xtR}nJ;BPm7U~PW{XC_r=&Ly+7_TI`_X&zG3 zv!!9XnrSdH^?RkR9xMIDu2z8myWKq7qKUuVAtvSxCs$X;KTS8gy1J^a-`@>xH*^yq z;|TH#Y{je+&^+^k^lZ#?hVD>Oi{Rh zOG-(q-Q(-rDT&C>-Y+hjl*+-ZejPoXe3(-9pIcXH;u^2e#Tni+n%#)GJ-8+Abw@;r zQ-Ld?*7kD0O~g7;Jf^0%5xHR7m!3ZP-H@@QASV%HtUc@Nw8|gG?SmGwY_M8Y4fZIK z-3=pEm+hqE7muVRdYj@@B%h78Y7+K{D3NaDd*Nt0$4K9vIGn|mt(#YO+edx4DHvAB zbA$EZc8lZ}$0h^35vi)hC*3~0m{Mx;7GAlwH(Guxy&??x*EF`x#P`T`pvvlw+;`hW zyA?`$k`6xoXq{*ie^c6u(B-b?fmma_#Tcg85Q(BxmuD@Rz^eKnK2fnn{8RVzN&57& zmdDN*#6AMatr8FZ>D|_neYI!wq`=KxOsG?N*k$V1ae-_UM`J zT~uk_DrfotH~}uQO3Ga?9e=wc6=KAoOG zA)nY~f$c0l{G>gDo06;-NpO=?SjWq#pDs@^@W)N4~ zY4f>Eg?7F-hnYKCOdAlcV*t3E+dft!2A30GBhWMZJY zH}~#MO=tJZqXgo^YFlO29WUX{b2_?59mOL;3PHDv&eavDiQKkSQ=OZ`tGrNd*j1tU zKmQknN1gIWftu=T@_n6hwZrnP_n+Tkzmjc;Eg!5Hn7%37`dSm+;E&ysM&I{(tX}-m zu72YHyA=xl>Mv*p3kL*$?tNrE{LyIK8dGkWH!pBSNtqTD^;B9znOFc`EP6O=1``yl_HbVh`K9xa=4*|*Zc zzlk6G5nt};-Abq=4{4QC=q4jAz9EU8KP=(e9rQ7*j&x-HCITng1tBI9&uJ_sMkHn2 zYrPb~9qE-ElA!`yA8)a{88`CveH`>M69Rx zvZ^5cY?H;&Zi<}eNAYZVT7I?t*_ozET)migc?c6@eE$IHn&X-l^;Q53Fdw zb3yTvWAS%Ii%}1ZFs?4|R@u+;{|tZJ4gQKrjx(g*r`@#Gr^_i5Fb(eTW>;Sx2ZwqY z-4jlonHdO#@GsJ;oM7BkU>E*m&g@(C-H9wO%dPDdoYo&uA6b;l$=VD~ynCV0-pTSj z5?REcq$6w>8GbS?^CaqnNZTEwfeZ91iH)qt*C9!HgE?w&U zfY9gE{Z(&xdI$wJ55N0r9vUnni&dWb(+>xijQ&!ebEBPQR zK?^%qm?9bG3AjR(2CGtDry{G|tG9fuJ$H{;B-9?mkpwHWtFIwMU_D(-!GCbtn^g{R zCkoHs;9i$3RX}veqTSuX;CF@kB&aQ{*l4m;?-AV_TGzLNtaLk;HiIlaONu^c!+hKu zCo+|ZS-0Oq2>V*$>eGH+;)OF@t%;pnTkQLs6Z^duYx#b_xCD8qVNV6I_GOiljEiVpMTq8nLL+ zeahVo&RPjWb*`LuP&!n2E^vPK)jSxP&vfY(mZ3|OpZ{7+`p>mNeCCJHLCx`PN%T&0 zLX`gc>U-sIhq)l{>wd1s-LTkg_JQk>@ac+6`zRC~YO zD#`Qm@b|`e--c#I6e1XgzR&)pIwI}&i;9Y10`34FXb&Sh?07gJz9z8nEBw@$hP0j3 zLd|+{E2~_XlS;zkL*YLzT8t~xFWy}Rh%srF`|AnpW5A^C&m40db}JsBqX3t!t^NB8 zDvti*Un~9BB)spnodiI&^LMnwJMMhDHu5niC;!JKa>8us6%yZ$0LFV}MaD*kBmU7gOO9v-z*p|nGvgL<~ z(C5r$Oyy3x%e#8UablfnRN=S*+@sQpiG0=VD+9WX(VN|b18`xJyA^cTcoW4#UNK2_ zUwsctyx^>>_LKbSNyl%6{sk-mrTqs;btnIg&L8|;uvPk9@Y#qen%RTA-?8||?$dX*cL=Ruzm$*c(OCoKpMH`oYxRC|r!K;r=@1i^Cr;4Nk zS;KX?c>0(Z+OA^}!~(>b=4~d4InC!RGhLGjHuIMWHU^uvHd$vyL2KM6!WSsw1FveK zFTzIePZnkx7yVZIej$3e`cHBOrEFSGeE~f&C$8-kHswrEaKLLK=T2^7=g!LDBaWew zsx)sD+JTu@BE#vGZ~%zH7C%7`{6w1_R=q%m-hW0K{+)5+?4QwwyARtb%2WL7D0@d@ z_gybOk{`^BU$HEGg zJnn{Teg^ZrI z_e&|sJVKV=Zkt%+Y+1fg5GUrlLN#orflBOGetchZuATdRp6mNU&GVg$`Xk+5J3-eH zRx=)Z-9L>&j3TMnPn|u`?W!E@;UACtQ6_QGu`BE*>70W_b64o{wz?S(lXj?uRVM!d z{SXX^FICJMp#{JHx&7y+(tZL`0f}>1rvn?6 zI9c#N{?*-`TV5WsWZTeO*|`5$klO?uj0+X%K4j5>;9!G6?ZxW=G85pROndG3B13G? z$=%*LZb#!{)U!FrR z@L5?(*1%!-X(j8t?>!C<4%W4W&I*v{E6vv#oaCnG6x;nsol{aZ%{k*^%#_^+L{gvZ z5M}!8X!oQ>ht8kZ{ENb;#ZnLqS??rZ1F67|WrCj`#C8s{V>IA?{#VMb7D+Pll(0O
    -04loFRULj`6vm7H-gYw zLmbZ7i%!^^QYE#rzia1k7Kn7Tb6zenWJdpC#iM7u!qdul{=9i__uFv!-nbkg`E4kU z(YZGbMi#>zzE&Fde@K_4NH--KaP1+mn2Z@g(-__{{P(`DKg|pArb%fYQR(|TL1S9| zjdwz~DALa~|DaWtd!oQFwRk{UMdlv%O4Mg8EjieaZUHtQo933b$9d2Fs$DaJxTRD% z9|l+6^Et0(E$5n;2i{YRQ`o%LNNTZt&_K!UjY_-D4q^J0y&`$?Waqc~X=`hpK@lO1 zE|hpnjbzcc_a`tEe9U}YI8frY#W6<4bNOGAs1&cfv=1;hIyY_cR)5B!!zU>yBGAc6 z3tLv*^e#<;FLgO{&rtTQ zZX4h10wX{S7uGg&7Hn6LiCx_8p26v5y!wUCJ=ppQmV(lJ45*=zj6=>+shaWrY9CGZ zhmZ&jHhh#mt2kiFL5UI8aWdZY!ySvdST-*9k5Qzrk<%}4S#TF1JvD$N3iO2^Z`(Gv zT0CixENXy@7CtxGZsd@9#v#3JUTwg~d`La>LTvIugamNv(D&Ru?`UPE5aGo;n~a^W zHVzhc4w5~O*f4}Z}APcTLRBFaaR-Ki>zO`m<5SNnXR7OlL zE+M6wiF;3b_by3T${W(<&34P<%lDR?>ht!FZbt8+>?-|}2Jrss=)^s?&F=0%JW_U~ zZPzYHVcM)7`-C8xm^5I8!VqV-=fyYuN9o{u^WtT(d*m*kIGjB0l3nH;6c>uII_QS});UB31sS%TvE z9d7$!AEi}wm08>n9!;#@y37POaqR7`wHw)MvNd+qtpXUgLZvBo+6VtiK)w8(*-L; z>$qH#nUdh?Y@ zeyQo|=Pzoe2lmi!VNXJKeQeCL4I`D(hoTSWS)@gJRZBx!X!w9I{PK6DLZDc&^tZzd ziQ5RZ1Ry^M1z!*BMNp-3CY5d2517ImQmgj|Cr8uoIN^z{J_qiT-8RT3&(Xu#p8-mL92PO;l+}Z&39EH`~_#y^xTrrD`cAHvG#!o+d z<@?CFmFNQ;8W3mIbQNz*0d5!h>D$foj_ddJ&*cF^58=7erx0I|=i6ZN&ClI67)``q z$OvGqY*XcUXC_wrDyZ0_98z(=Y4|BwZ)(DBv>kYlaA8 zJQ3T^aU1t1;Jt^0_hF?bGhYxvq>}n7DIGadT3_tFbcK~g$R|tg0VFs1S%M)H&ka=W z00_0ibnAz8hiSBo5u`WFrEcAj>>Z4|!ozbzO1|KApKGD!2+-%=qfvs>nRJK!3aTKs zCCUNv0f4TEaC3h{5@x_b$8in!flB4!n}Q1)4C@t#ACsJA zp}9k5l)k5L7g;FNpLwS@?#$g|`09mYks$13)S#`XN?z+$-@*3VmNxhckTK9W$_!qR zi{WzWt19hHMDgn9eMKE-Y5d9};tY@ZD6PX^X=T&BT&<%#0Vmq8%yN;mk}K5r1G~tJ zKwZQakaOEVNH;$#h)ES}TJ_MpCaq)OtPcwasDsoY?^h@pF6HPccM-JI)uRawEu#Fn zirFvuE?(BVuzm}8o;B3Rf=BJU?9Ljq&8L5{nMk^l;8RgvUVg*V%d2{SWn%oGRr;FT zaLv_GqfiWogBVxjw&t}fjg5`iW+swik|6-Kc|DEcY$^tjeLKWUl(DH}8=QlYnHkp6 zp@N$EmJE^Jbbbiw-#E{?d#9kLfGR}v+6=*PJV9G=_T@r6H|G}@miS7+xX|dlfM>Fi zP@NzUdc}9~y0*phX<%&7akmZi+$;C}UYX^qCx1KOxl!ciCG;2q7-_v8g9 zRt;~h=o6!%AjQQNdbpn9N{ScuCHh_UyaRVDR(XUdEjHM|w|`tvrD=oxsC8ejpRg8b zGcOUUUFBP=7dNGY`t2D%Oxbv@Cx39?c-Rs zLJp-5<$Z59e5-S1z>f#){mQKh%H1CE)b!b7EYJQ!)=`U-HOoLXk7&;KLE)5nrD%CR z1@!zFXC)H32%4(0+=*UNNM9gnY+_-=I=v#7d#}fv@r>EH?ISi0jzO0CT}AuRk&{^h zT7Sk+;3NWzXe3bcgrMCQT;rA!Y`J5GORHt~Cy3n=<*pv-T+p=(a=PN2N~qKLkf#?e z3@D^l-bmx5X{=q9HNgKfC? zly<=y(#oovUU1~lMz5np24!FwY1e@gVYFCJ8sAK<`}9#@Si7iKlj#19FW2GtEWEVC zut`|U6=C5oKF9M*OWU0q&Ce#E%ddh=E!cDDEXypnu9n;HC|QYeFupzgVTSvG_CVi5 z%&MvMWyE!NRbMim{aenv)Uz1KNO3btOXdW zM$mN3Jz@{%2^2uJ@KaaN!p>6g(CC2Yb#N%Y;1^p57tK4%m)LAli=1Sog^S)i&4Hey zVQ^+>DgITfsm7&(*}E{%G|zQuax1#jD9Qrzqk5&(A<5H-!a60~dzNkecT)1*=U&tG zJ!8mf&&ZFEEXcTx;8DOU*K19X4{#lx3fV#E-yw7zKX&tznDk z5%(U&^UFqNH>NHBNIkjnj_Y3RTj%}UmBXfcEq)JevQhUTJg4UNCdeu>VOHDWb~^Vq z*Vij&@ejfF*e@8Zf z_rmsdUIOw|K~`=rO!_*Y(5C7`lDF#5TV1R#EFANZRM4B6S}rKry_w@2p?fo~I3;Wp z<5JaJGshY}v~@%`#JO6tHKj1Kmnw5ay4;rE4`)Tb;;hJ*K~EP`uBg&9bJFVJJ>S z6p!N#4Q0W1r@mvmSJum}Ho@0FX!f2ChT7C@vav?4AMW3tsIgj*n@#Cyt$lOcrPOGT zRX#x+@ib z#e+0bi}Z_X2lYaB9~4Y4ANCJ%?`EYe3l@C?#;-LXBmmAuFqRJBDB3eJ^sVUjeqb9L z&IZX8?9?5ay#m0_1qgh-=$PH#q@D$UAd?Tk+)|5WlT&;e$%45n#0*?Wd#T)G?X6%KQlkd#5lzRLJ!r> z2ceHxa90C_&zMlhw!~WM^zHG90cLy2&V7zcPWmqd0W#tj={S;M-F0)LA2Hck%J+_P zHvGh-vHioj+gLifEP*Ev>9blKzJyi+!&zGV3GIXa)%Z0+xNPs1JV*L|{lVJ$8f!>j zu<8`7ckRgk_yGJB;;^J`brW7UjXM`;6@2aDHyr75&*1KERUmoM)Nla5s7{}myt)ee zZPfhH_!FH%I^Cs|`Mp>U+frK0tCzFiM)4p$1dBr3iF**&a3Nsv`g!p_1zIf#VdzCJ3lFnR$fealjKJwad%W#5_07fEv9V8T%XZ zvKgP49vOi6eTs1t1m^*%dFeB)yeF=%uK^?(=kFOtsm9+lUg!UM3j{A10r#Em-iiUg zM~%6C%~9YXyi6CZ9*lI8$kD@y+DBIry^c5RV+IDTsWr58+CV0y8M3LnSq-SAC^n*T znts5tbF@5B%0?ctBWkY(y==HV&B!60l58%*N z%V$#;w=qa7dxF3Su!^m-E=~h!bkUdHn~Qpw+P((!GjBNHVy%aZpC_w;G2Q$=4KVFd zF~7je5y{gaFHb=suo%~xvEPzz-O;a9zgJSfNibxxK)#FPW^tnU6MtR}5Q_V1d9->U zEyc?&#v#{hX*i>(Xdab2?ltBJ`U2~E1;MY4$7U8FYhk+ z=h`16auE-9wkGq`_tNgn_^l_gCalHf&3eT0A6F#uTWf_u&N$|K-&INzf{8&~ z38{R5xsQ@a=cG4oSEq!HedqpGXgQP%1GLMG(?bYwn}oDd8$d3&xOOdYp8*bKkZjma zeH|t<3V$AS?UBEjHx~_a)<-!{K>S%#3n!Q+T0xE*yn3tKdi5Hwa*H#>-ovH~ub}$_*0)ff$58*tzJAj!}9>r+n3eGp#k*K!iq-pF~X?bg<*mFj-eipD9*i|JioNX}Ism#ODW&;m|z~`GO zrX|I|)26B9SiBH@?trEz4=8oJb2wG>&q)~Td;KEPtP5xq6|txh@R8;mwK(ki>U`tQ zZfF{qJZN#)_I1MO^A8nDRXeRsGO4T0giiwd#!<%;ISdy@h#aDwJ3*&55FhAU3!Fgk z^w-r7JxzZj^;*TabR(oT=+{2-4SNo{eFfs}k`LWmvIA-p{l)3ztiXMR33>#1{dFSd zgEsC!NTDAoAB0>V?VUHAI7}&eeO|LqOJRuJOX1HILM55rS#(e2n1z*PS?oS}-vcnG z_Pt=#QUNcSgg!*wyLS)1Cu(Y4zgloh!U%3a9vZ68G3Dac=$b(;7DeL<5XqVZdxic9 zxmrW_H;S>_3#fF7`q@UO5F@W}g52up+nmymEQII&=;f{0aFbI)K%Zs5Oyka&b{_ur zeFc`<70wH_aE5 zMTGF(K-A0cd;<$~4?1Eo3&*T-?o+AW8d))jM;qq>6{G;@6%Wklcw!P<6*HOgd2#v{ zOZ#JyRO7nwrM*v1d=wEDmBM7X+)a8?_5Y9+WykD$BmYAOU*eTN;W<{a#^B{LgQ(4gqla0@}zoMMb zWG|d+8z**avsaky+n4(lqPpyAIKg@=r zEq&eh%i_h>+;3j~yv$jHgW4d6qY#DabZQKkTA9!I9QSzo46NjL(HHovgQ!~+pC;ty zOTU+5!=jm`Q?4YYP1C;xdv$TCb2Egrp0FFC=?9O&lMoVcNPanu`I1onb0Aqh4A$Y) zsQCs|B_iU#!|*P#6xr+3qU!3LhJvQ1CPok;{_&$5$`TKbt8#+sBF1C@0YwXy8$NZn zAa56WavK-L%u&^CJx3y-SuI^a3>KIX7}kAClw8gNP3}-^6=*D7M#T*eBxG2wQW9roamOq$5v6Uooei zqd1PMo;I;c>V*6NJ^^|jD>eQj_oT+-=<0tLd(u5)z1u*dpq+v4lAri1x}=!$p9tHUcnvxU|%5fR%5TyNo7>g@+TyCJwME;-qA%A#UkC@*P&(RjPjC0`9qYEwOXsyqzo(LGB zNwfu(fkCB|8gHQmV?47RCk=^cI^5Dx)+q6%jp+aTwP;OXFa3c8{k2jWWM}(9Yo5a? zqphiF-h2NbFtBDeB6#FJJv}`*#nHu}#j_t@vffr`58&P;2Zvjp&;w?D5L}v|snZ5q zxETvRI~Z_)00Xx!`x2K9(B>=$!IVSO`L%HC%zG#Ncz05sAgTp)eYuq@1fS4H(!GtQ z6U_Czym|E7JGBA>OL+6W&^C~7D`FvcFX>otY5KlZ1yH(b0240=-H>)ZW=lB~4B3l; ziF(0lt`unWwf!N90MU*2(tpOZrhl#L1597+`W4Zy!$YbAmfQxppJv`H*v=1?a?Xq% zl5Q8Cg%=k3ck4ozkG0CXmqpcS7a@Z@jg%sxcSXx3td@lCr6};C`3!8g7e}9Nqkhd?M zT>@n9OW!!n&dy(!8#xlF>ElzC=C{C0*x51ML{506iaU=x0H)Z^W`aDvgI9yxaCUZX z@9y5UknK9LIFclCcz$3&4Zm5?iO^r{^k7-+v>mwO4tz!ZyIcb-XVL@E?otzO4@8BY zg?H2HHX@|3ir#q6kxnnH%dP3NXW7_bK%lnxG{g)PS)5`xJ3%L1)7g^RS~<%3kE12%&^LI3|x< z9lc^|8p?6X)YIF0OhC_WG?I`LibOGKu5YYUWE-t7+m>_6I;UJd_x8Hpx}4wbIWjut z{(X5h=TdK?t%D7)B-bino%7gPIm-Ag)G~>pNxc(E|lkQ2?M)x$!%4u8Hvq9 zib|~TtWi)~&Z?^Ms}T8dU=~HB%6MRRV5RvuqW*RTy{)-<6H#9YnEb9Qs7$q%>01ts z^^T2N0U6^%bRctdba&9imgg@NVd`iWLVDc|Fu(ZT17bkaKN_7M;+rG0D+)FJKh!ru zOZcNdB7XJ^A91?mj_m*X1J95gYY9kW=sE$yRR072;*YP+^F4D<^w^U+IXS+oS4#}D z0iNzzjx4M!>PaaUO;Z9jfvsp2P&#_+5Aetx>`v!}3>ifVk2aaV?Clo}*E+!ds`lW) z!Y6(ROaW^y)S}r)ElfA`X*U}H+885jMo*0i{dS}QdI%rV=~{h;;>;KH^7KwOK}SVa z$v=@c1O!;4JeInd->K`ZuWKc1wg50auD_}NCF$|hMfj0eR%zkqDBH!e-+_`QEw^4u zpU0%@NFb1?gUB{*;1aYGbVM3H-LxQk)c}(_Xo&fM@lQ-CMeKUbnp4r#%woX@Ah*K5 z;9u-`VhN8<%uCDzg*v1L^{}G#Fp)LiEu=+!9PCk;G0;DE2m%8}8SELucEo28Uw5JO zX={y?Q6K9RNQp=YdKF!|ycU<(tjd+}PYstpZ^Bu@V114*yWen;b=a12DCct#okSqZ z(B21mEZHwV3k_e`e5)_|;=0&%OX?9LGjXrmlq3pY#kXK2o*m>he?X2VeTd_>=A_39 zF&9mW{2p2xS1)L?V)a`$JVw0pX*r!-!_N9n|ENsD{Z_uc&zm`dh7uNL=HzV?E6km; zZ-c;2ByH!vjNR)U(qlQ!+GY*Xlt4t({Q_#&*3x1SMA$+*Cc#{x&op6Vdp#NnycPE8 z9}6>vXb&nNUa&k*jaZ9V+LPW_WqCirZgRX~gip><71EaGAyE*q?)|&X2Hw5DfuTcp z&2%oCk{T`9<~Rm{)LhIV!1Nva-$3Jw5#pl2YvBC{rDQ$*lb8JOVr>7EJAkZ4A=&L= zi#+Py2UcrczkW#WVZJL$N-aJHFz>`rPwyS@Z5u*D_{Ix{8m(0^W73azs7hkg)YSBu zxVnH`ZGwxEx&Y7%ov$BV9CvNfAR!k(<#|!-Hsfi0463c^mz5M2ath0_;(A^~AYIq? zu2m$Z^HsuBs2U!C?7ITM#&p!mJ{r-@`+Vm6C|!4#%bh27uRw6kk8Bs(Npm1!FD%Q@ z1sX0y$!vhNjMA;4(>3Z(FTD$6{XzXw`Tw~IU!}U^Rg_7sUJM|+Pelh zUgU52l+*7cu0rRrz_shjKmj`UkzvLb)18d%HU^*#+j66hOE(UEIIzo@c!TbR_gD)9^s^gBa*=IoY+hQCxj%RI)I z%4#Ls#B_Sf8KUCu?Jc2OqH|d7Rr=ZoxL!c&gFQw~-|aXFJYb2n5R3iyZOdE@Bafs` zTH7HO62R%l)a5Cv6NFPEmsK91Vo=>lB=bb5O){`Ydn~EX0RNUde4@wcD@eKZ%>;Ve z!I3Z4$Q~g;$WxL#h@+Aqt^=OGb(-FT9%N2sg^lOyfIJMX?M}f@nq1DnH`-e7k+8Z z!R5k!Ge<}5#rr_dj2Zl%9aXE5yYO5M_)o))fhPel#x^_Wlqj}eAVo2NobBf00I$@+ z#=j0zp@RV3fNY)6l6hn`GviG0J2hSdXt@4;bED97AuY_oJ&;&r^r3*4Gbl$B6Pg0D zYwm-DP!OZqW-=!W>?h|JjY5H8)BqxIqzfd^i-SN0-e$?|>(3Q7Lx3#-BE=8#mqGa3 zzzlc0*0+xH^d7$&kgTjOm)BTyrzBZlxbe;@-+7QWCm9pEbDo5uK_=$UMY0jt52G%) z-lC|fI~8ib!tOdbnReNI$D@549i`lk%fN#cE7^`_|E;v4YPfx4waF&eox1>2!&P3x_lk9R2pSb@%V zd^_meD-(O<7Oxy(j|KLz46ErQkGGRXdO$D?#WiH)^a8ga&1J$x8@8njfFcA4BV%7N z$^f7MaPQ579aXxd?la6hJf!_sc^z(t!6|Fit?k%0&#e$Q%zK-7eILmSLI(D$pE0fK zaN(%-V~|~yoC_#l>4HQUOsc;_>L|LXtIai*$+Z+O-QZ#%tUjb`u z*6>$lN;eIB7y90gG*s@!8lE2>`3HI5R!ZZCXgx|j+C(k~LoN^`jUq}0uaVaa04{!C zp8eW!G3qz&%ZLc<47agUz~RmKS_*^`Z(HU3Y2^r2qLsP1CXbhP{+eUP!< z2=wO_Fk4P&sgdLHC6@R%jb|3|LYJL&?0bu&><_gRDPtf6EZ<}6;re_3_y8K3#GIRL zc;vu#j?Jpen(iHF2oWyy{~Zz0$K)-L2rND!#oGET4HS}0j%w0)Sq#S)fKc&IlZ1gN ztNdaMO3t*wVV^7z!em7dehE|l?CMLj*wnz!42XAskZPC28-CRfMU~KXRya zFU$h&C4Mjzpupau0*r{WSK#}tNu9}`y?k|tCxQ%D0gm6%y3!;<<#r)nqwJJ|E(}Iq z>ima0lMYwQkd+Jy^qq14RexCak=b*nS2VDYb_1w=dc0GE_?9f(<4+uGIuHgpQO1uPGd1f4>F z?kZzWQ@Pu@IoxhDwSNNke+H6gZFdVOYn%Kk2Y*%q;k(&@hK#tP9S0m z_D~W-U8zrBTt3cA-Z&0gMvg^q954XCMcQp`7e^O*=n61_P~N{?kB=ChHoGx-8_cfY zmArCu4_H(EEi!?72>zRrk|Po)G4$59m2 z?ukJ@q#a}t4+LUbu0MAKR({XD_j|w}qup+Zk>1V|p(jKQ%TYaEc@Uuna+c#kvH^?| z?@`(a3LVl@P~&S{Muh2rAeR@K!BSQy)H=O~_@((DJYqHTT3iB?e;8r&@M zN2~5?X#p7OOKD;UqJs-~%=*DW_*SRYX1Z+?;$mN^DHN^+49mc=f_S_XauWE6K^`8W zT2A*|);VlVA#hs)b@@9Bz!fMRYCBQ)Zy{|)N;Fs4xIF>Cam2?PCL7rfP z5ljY~nXzJKX&NtEi0S(p3FQQE*G0|S6-%Sqj#ci}z~X6FV*eRdz6-vd0=#l8$o^T@ z{oD6Lxg%-H9htjd^4L?_oMHc-1z>;eN)#3ths&(=Ol=^Kk5TEKXXhH~W9fvL zN^&Zznx_A@s!yAJx#*RqhhILxF0h}0!Wd}tlhFe+&O`i-!xFERPn8-9r2%s%Q)YB~ zm@xK?ty+Xk67r1NM~; zUEm*3iP(`Mf@e#s`%G{+SPAnKb3dQm5O8zFmCBF9?7Vmbj@8CPAz?LaByIQn5hv=& zUxD)D#-L2*JGFM5q$Tqt(se+*sCO4HUqzKD{f zGxwS^EnZ5F?_sV}HVXl&Nse<_)7X|_e8}+X{`L!CKZsB5O9O#L;sFjJ6lN%!2_$&X z#pN|?1)9}^`~*dN=U&XG;TMD&u$K)upPuEiFt1KgkpWR#xuD@o9J+kGzl&f7 zJb093h>l%`;7x#-!8YFeUB)Z%1M#cVdsfj`Y-i7X0M1av^=(5z(&Hjq3lb^t0pT1w=RFb#;2fs`U2`lrd}0`)Vj8g2|)Fp6y&d#IRZu1n3oQ**qq zUjw(UvrK|!7!>?|^f4DO$Yc6|%T#l`0JsFN0(T+h9LW)#1yRObk@s6k9{HtJIPm#C zz<{n03{v~5*6y|=dDwPD{$O0^l|0n=ogg^cAoSgE7d@Z>2b+KHTZuxT=zF~L&&7L< z`URk-k}Mn{#?qx(n*M>l586x%27z|FssAYB`I+KO2^ct@H7Pqv-I2!!*ZKL9pO#}` zP9Vq#F<8OEtnBU{3y#oulWz84F(cKI&jJA0kqzfRS8;Hu zGu~YdmU|^9Q@5~uktGxYHo2Fim&@b-_|}7SUQm)`9*W2cXVzTmrc^PQdQ5I6X9Wl~ z195A?dyZ8>cY$3(%il4PNm&&{_XwpYQ}=_~Ify?_~dc#S&?;)4LdcfGB_j+eDbq=W_zfo zH`GlTK&~*nC|4fCVN*Fu)x~YK<}f4_P01n#-eZv3^^a?uoANzVQL!M<7Rof~0+^da z;C+UhGGAa2@>ZNV4$f(f97+PVUH=N@gZkSQ91=l!SgC?lMZSP-c1#s$TeB;?uW4yp zTD*SgrxX|D9wr-rgH)n={uy@zetJvr z&)=foHzfaoLbC$lrgSF}xP&bKX(I&RqWO7_rSJ0P3W3}PdUeK;OnK&i0oUrM7bvoCdFjt(` zUxu&FXF1Hz3na$KH@08>>uE^56!DVo`(IMyW+m^rcAmhTym2SZhK=a?u|v1$x63Af zy*i!RkWkf$y?(0}dhP*L^?em}c|ugmF%U-< zM6@Pf=E?f&M;L_(vk5-vYV&|Ty>kh0XNP2@!k6i2g`&g#HlevU5;EW4R4S&|wyykj zTfsT@9=QHWw>&jJ*z)1U-|0;kp%mj zQOvVXCw=oxaot|c_i5M%?PT|MLmu>|t9Eb_v5rq+K2zR)8wEq!QjEDw+=n&w<>Myx z`*g%a8U>i_1nsiVH(kGt*NKpo)B^Uy1%G1R*uzNpU+?VkxZQZx&~|y6mwPj-er*0# zhJxbRuGmMRgThb|mBxX8ZJI7ee$1(OJ@WryK%OuZw)~y+zH=|Z^c7|J8rRorbzX-& zg!kS{_rmpoyJd!1u81AI!H-(j-rmT#Eq5?vIutABwV8m%IHN0XJ(sD^Q73oaVhUL1 zA#O7Z)g3UTe`!W7$+xEu1?{&vhAAAJ!|f9$Mk8lIKamjK+?jUFN>EHp5r@MqEG$(1 z7p9BV+Sr8_x%fxnyNou$@0&GRw@I_p)zkP49&qzvsId*|(d`HddAvf4(kw&;0s( ze-SN}7k&5!bNZ}59-`izw7ardO(Xu@!Vy-kSM6HjYt~x}%LTow-Q(~Q0y4Sf;x|3OmJy_uO^5XY{H1~(6px;b` zilal(xg>@4S3O?h|BCG>TLt5XSGGlkFVQTHie;QuyfQ}5!}N*2!-tJ^DJ>0s^^~IJ z6Mmjc8c?vyS~DEJuV0&ISUAV9tgU+!=5(+Yx*YiDeNiQ`r0mS?fL*cea9>jNmDkf# zg9VsN*kr1HVv#VA=lU6Gs#cw^B?qkWpM zB5_6QHSS-(YL;?d4D8!GPK@!V$EWul?yMzx?%=!^-6x1?2Rko+qi2%KGeukMpswZ+ zap@0jK3nI=lS~=rJ6ruHpgXf$2=1VVi$||$2QG=Bz`)TzF6NL_p!`uFDUo-B@FVmB zL=5*1Y-ey&G5s*Neg`da)h1t~_t37GGPL)Ps|XZQEH=tQ3O?z9YX%5ex5_z+WJpFZ zTC?{J&(`F`zKWPvaX4l_)t>+os20I(6BpS!x|J3I`UYKT?@}`;aAfhAn#c%W)DqXF^5Vyjy`#)_ArY7x8HpH#shzF z(|`S#Yh3?T)A83o3NM4_N}CdC`CqPgEI(`GfBT09K(YS+@bbh|;HOUe>?M=~+J)_g#;jvV|}9KNaz5a%v^mK;q#79a2auqB!ry z^~{w894KJ8G47UlRQi)cIeFg@&D#OrGhFEuj|;=?AGobNF{B_eegZJv8RJ+Q_!ub$kFZgbowsYiGe`t3~n zeV^J13hJUyj7ENE-xZ1CFWE!8~ph)a}Y;-WvWQZmZ zJUemV=uS=kb98G%z*J4|nv`|TOp<9cqXwL-B6QSaP)1kyM!?$8y-z*)2Jke3Qr>@!&Frzh=)ve>h8Ry7e zy<=R1(O?|iQ(P#agF6zf~ zw}%@?$e0;39jUSH9rmm!evb(>R8@i}y1;Gd)bg;q-VD^tpx!A>S?yy>gcP9)Lq!vWh2|_zAr8GV{Z3ekU88?(4HL1t`pk7k2=MP zG(k>{B5JPG+*V(e+6ywPJw%hUR+LjUFor@4m#0_zCew1Cbr$!D%?tRgM0S*+6|6>N zS)HxWtAP;1vu%+5{sBMB^isjD>Idw_2F1H6iRFbWMpVt5>2Sm483Qpl#oP0Kxr94KxvU00)bdaLJ=Y$kdTll zp$CZ65K_27J@cJecdfhD{o~&6{x1KdkhQb3-}=1!dH2@&UBl4(d5EjSTo_v?YP0_* zLHz#lWWM6!3G!aaQ|c|{q#B+~1wRrn@x#4jPmq|vo8PZOd+IOg<(oGx1$A;i7}cY& zH?%(0lk1mW>+7^M+6fpr{Pz9-SbN>J!-s8*(B00o&b}xSFMSh3TjB;z?1)=O`O(iN z0543iUK@O~{GP$43sR|@-1XaJl`%GI=NDcoJJ`j+xJkH8_^oBII)TSU#75DMp>9i@ zF0Eb4_)PB_^n;Y*_v$Xc*49e;#JCTuTq5Fr$f}?#_ zW`|{#Q+mPG4Ee#J#RG_|SALmaxEZ;HrYU_|Hl~_Qg>#WyUR0xCpq)D~FaUTvu>7WR zIBX;xg_f5_&C0rajENvS03R^Z&Zz6-g}QFm>^Q6IPfiJ(Vr!IH%=6JvpsF3*T8S%* zUbcg-4bl=%vXROw7n403T-Pmv(n1wuYL9n$5#zUpuMs@uq;A)xo(jkfmuuf(oin=b zWPngz8GW&Mj9@DGKuujr-vL0K%}oIu-|RX83EGa49tIW{#Aq_N)07UUm{Q>RbwKmI z2imo)6kp}p(`!j)V#GEgc2BV^}Kz~xM5m~ zZ)r27hPd^!B4cI1EVcE+xPHYNFX`%en@EC1&NGUpw>V<*PN+qlT%;{ylf($ZPAd-* zLJX0nqd!lEeQX7a&+P?uUIoPm;teo%>n4kz=89EXo)wTD#E1MOABU$A3=CrwB7CHb zuU^9+=pi}*nBt$qV;^oVD*!1fU0NyTRDywRjDU8n(l{P{U=6K=+_v}5$B*(wV;~6F zCZC#0`8MfExp@oEqj@k`Zbhbk3`5Dh&;rt!>`!Rmedp~ndPDxX#>WH z4YGK&Z`q_S59=A=g^K!w6^L_L(^x8Woe8IXG$Dn&mnZSA+9@a?SL7S5l#(`+5Lfo} zR7S*HEK2PyS((_>V-uZtU4)Rs!ZYM}ggYB)feurs+`9s3FPbemTK3HWQkVM9(b)qG zolP@gP3z`}hf~Rhjw=_!PFJZrd_=j`!1r;^hE|h*k@@P)EsjMXIedQ6l|z=-QU#=} zft;RyNO-NGdpv~~jQhQb!n+cZ*3kkV0VkU$%!crhwGPNa<>a510fA$}WC3kuun*H! z22*kV*d#vWU&cz8%I4&HVzRmEOAwLrp(s$&spV?pPqfO(5kHIZ+7UCsD!ff1&syu~ z(0uO{V?fFCAEo?J_?+q{Pc2M2S2_>N^r}@#H>2NNDyzT!!Ru3x%?sL>I*e-}c}gnJBlCM18T-nP=)G zI9E+&uU88)mKL{K7}gNmAlxDDhn&@hMP?;lJKrEQ08i95XfL>5NXHIQO9Rg>H_A>9 zX0lH)4#QHe#a_fR>mk~mG6?Kv1wH-06m%&tMGk`(^0owzdRGj$5e%mkP2(Dj$F6!x z$86J%&k!rQ9fut)R(WU9O1@cfK>N50OWCI#Mm|xQfg@I!Yh7MleP!B+93IPT??L%P zajC73ifbuV2+2*NMgpu=<*!}zfDq#Ko{^*-943?lxYaz)O5#2@)5y|*SB58RGVQ=ox3#us+7;Ob zXAZEFUdWT~LGY)_oya93U)7PHSLby!32)K0cu1r}pml^|)b=n*%gOZ=t=p^Kv+1ci}zu1cB)NS<# zUzqGotFGB`4e6@t8IeV+bIqS~YY!FMod}?KxBe-KWFH?+RsC`+$G`Gg7d>kW93I)c zdbZvn95CD*({#BGQ22moKN4RZteAn_JJTF5d@xp45!j`*RG4f`uSvi|Sura?&9mX! zsMUm?hy4?PAS^W|-s6IasupqZb2+@3E_E`yY1jpqDX^ z-akbe+=-_fcMhMy73isFr1$!Yex4vSqmUD8YcA~C3g}6ud?raLVlx6^KS82<#fc0Z z%$9oNpY~px%$sOGnGfo^^=4b1d|Tv|^IIiaX|lf6l&>k_{74gO93Ivw`M5d6U1(ed zxsPt`Y8I*P*DkNgX0l3#(f7-tDXw9Q@-e$!)%3s#W;oD*A6oBKgr7@;PyJhCa`-N& zgi84J!n>b4-(c<)IpvJ~40aR;@lU{}1a;sCc88NTFu&p{u^@wNRA!HMRWB^DMF03H zSRVdBth>Rgdee=pv4{HUT(#?p5=U2%{ngRE>8>O{4FoUhIm^s^Bh#nrdt|5;LJ6dk zo=XPPp2evXgMKM{-^^O6r;nq_dPY9STnJXZ3bOe-VANJHVgKZlno3iPgLJc&P-ht( zVC)W93XrI>l0$8pCa+M#VEll$jc#2}fHc)jGg$O!{j<%E&8$Y`1i3T6`0Cgd;Jnc#OU=;5O^j%(9+2UOSu@(mz?SYQnPhA;?ZJF5bbhY{wTdqsb zqqbc2=hvcjsD`Fb(Uj_pFFq+t-WRX+T3q{`hs??-AaTh+A34z}A>3?VVmMce9*XFz zK_1DmrdTbP^9B}@02zb(J#fX<8Bne5Chv`Rc_Xf!f5wW}Kolbv z3kBNCw0(`%jj-ERmCK!PKo5%!Nsss}_NdewuUa34dmrAw3@`(M#mCTUZdzWIJ5ZeD zSX3Xsi|xn<)iK7nZII2Wx;6)Vr!@rBW29xL=T05UhuTrIp! zC!^Sm0`C|VYKjy1A6gsk=~@pD3%1@&rWFGaFh+EW=GK#*agOqy)THRpiNr`DyRG`H z@H)A*)o)IPP1G^U5@~l>&_ELk1YjyBNHCxTCGn-jdx(>v2FBqIo6s_DyY9evbzt)5 zd!p{vSaCs{d5TP6ZX1{O2h6J4`AU~ zG1Nw03KEX8Lynt{emnag< z{0pZJ1wULcX8LwSUB-Kko--6ptAME)dmtZP9syHTbTU-p1m|!YjgRWzo4LxD-&5X| zRv#9Lbpv14R$fjYq@)~O8xwo{U_pQx*95L~iUQLz9Fe_5#u5*KFsiImq?fF=8z<2H zv9hZk&1ZtQR;--CJ60)GtoS}rW!D~~%K&eNe4x##3#u+W)w<9a$a#2sMvWT7Cx0jSS zjUm=vu)M#c!DGtZ#B6$2RnT@Hnl(xp=t zfz_FO+$V)PoZwgYLx2Xa?o&&}iD8{Hn=*}-2bBgGb(~fSL2jZ4g_H2hKXb?=! zi9caHdJxX+vi!9-RaLvQBt88|qMw(DzPlkEJ2v^z+dL~v{W`jG+(nEn@gH|@_>Fo>oz0_?NWHZ4T&wEZoEGH z{x^2*KLyxRPnFqP_IrJ!647(U(}S&B>t=aEPW5KQyBi}Laa+0F$DDrkA(sdb!S4f0 z-KVlo-%2zlDa5VNpd-}pbTM=uge&49CPvW;Fv47CJl3*ny~hRIw5t%$+Qh!#V8|O? z-{G;}Aees&Iw~rb*XHdcf!TTN1|;G*I;^myEfrmRHQ}vAdG$Zu1+CNL1nz1HeZFD5 zLpW#OnaZeA$HXe3%XSy8N7#R%<*ihm!@MDMoWJiPCf*|4!v6-N^NvNze2IXJoaluJ zfmT+p-rNRQlRtfYGx-QW6aMpvZ^n1Ss-AUBJwv1S0T%_i;Z((cIq^Ry^jF@<&O zkzK`Yqqh?b&WC7msoed-YTv|6mUH$`#ipBa&_$x7&gzpewn4jE{ti5@swh1EHJnSV z9Mm3VRkc0x)!8oA)x3uu#Pog>?P0#Xxs%NaAA}4iQ?^h*du=mIEO&ZV_OwsCSB+v6 zWI)zqAJI)}CGTv~e4bonH)XQ2eNm=e>_;%36dHji4zyiN-f}RqTdbVnfngc97%U8{`)Xq5Z3=P3&=q6I3x>qS^QeC@Hf75hssx^2T z0iMXlt%wyI10hwCJZ@@)&pZ4XuomF=Do6mUy_?0$Kl~7vjJ&Fkw?H5He zyYLjz8zRLj29Efb&qu7x1oj}%9nvtn8EXsNqtI*f6;SFY=Tb+qGyS&b7e zljJ7nKF*Wep4NK^-6`^ZH7s(5NtWW&W%xReF&^t(8_AI5VVt@=Z=Du!$LCbKSPGp% z&^#Q~v%W~i6#`QYi($qxagk`{_JfGEgWkYiP=~>Qylcw2*_>mIIeod15hkDiZDJ@s zV8}}ueK}c;^L+01X%GK5)c8UraJwzJsk}Y}W01{3L0;SOOJv0sfDDfIpkSZEv{_^u z`5Q0H5hrmte)Yzv<;utfyjGRIp~Yf1wcg7Ezm*TvidDJtIiI}rMR4<8U3A$n!V!gt zh6|xA?9iY`q&p$D=5Q4I%?iJ4yBx7kfUO954m7(Qs$6V1Zrs9zwm-uwjH?-5io1}* zL^+6h|N9P9r}AW&t^!Kv;oB?Pt1*~N-5+Wt>qL`2{1$v zCV^?hR9W*9ZuK*s6SSWj3paH1Ror*bE&}vIC=Fh)Ly_KK`Y&y+`+(N~baGo55Meza zu=HLH71x!gq>&Jnp-LL|DJIH%I!CuG8bJ-n56dyC9)nETRE`S!e$Fc{CDLoCY%I2G zu&`E6kC||S1TZq0xtK$oJtex2fbamh41CH)-tCh31`}spD zL+1~?({U?1p1F>dawjzT#+VaywYz7(;|e`tGi2q%1)yOUAVcKs{T==Y(&^aiqz{^3`QoqiwG^| zB1<0YuM{z_BkdDOdpXzqx+$Lj;AGtpuP2-Z2hcGJVU+;+*#r2KNks)+yU4ZaEzs;C zspUc)62$XR>t*h^nXj(z!%_Za0c*VwI%q&UAew(9m+U5vx{g5Zx;)QJxrp4UP02Yy zi?n^jPny1w$&xqaeRi?zbz&xVeQX6IidmmGH}g%oaT))6zoVtYHm^Ir)nk}S=r6HQ zEy%CA-#_wJxQZzaqaUOx>i=XZI0#I_^eRh=dL~zzBu>(^q({X`QqOzeenN#EGZBEM z;sPt@+6HGw%D7l;=duxxts3Vfb7k$U)_( zTUM(2Ombi$RW*+8P|tK@L)N)zUB`k?=r&)%kC-F7yoN^r8Q5$YH7Cyk9S7FdzQT*M z*-r8OjcF z8amrRw5B<$PTpzcX317y6brcz2p|?h^;A~piM?9F7r6y;F!SlRts5hhG7gW|i=Zb= zr1QwWE^v_f(8hSBp&`< zT-UKmAL%j{|LmyOCjhR$N>^}~KAEMek(%IP-Hv{5(Qli7u$IRkKrxFqmvSoBMvZ^sL3oJI6Gn85$12TGN^Bl@OWYSR0_X zq(pM0sfqQmaw==fFwbx|Gf(`Afw^==wq-O+8-d8##@x$BC z%vTBJQ)A#WnfI@a^j~Tv6}Z1%NuK=q6Y=Y3zrK6)>1UGWU!VEomLyvL^-A*OxBKAF z#MQsv`(A?L{(2#K^2@K8pLwQ#y?6SO?%#=;-~PWji9c^{Z*%w_U;8aPi~S$$!p^@Y z_rGz%R;n*{Bi9Ap?Yvhu)l}Ou?lGe-AFRl5JEp(wzbAOrG z|F;NVuKuDcujv{S=%)cE6m>c-Zs+7o&e(W-z2ix9cCYvLZ&}JwPCsHUDz3^|EPjIn2h4mFw$EjW~X+?<_h4DGzgHQZzHjPyw zT`zQXkK+Qj`w)AQre)gRRYE8kx9=hP!jmklmLsn-N+x6mEn+QJp3aR`21bXCoB%V6 z9<7gypd%3xnX`cb7xsD|Et6vY%xv8lTRG3o0izLZ7prBab$K~slO^y0gqQExzP(?_ zGE*s{4Pnq|O)NpjBxy4%$hYCVp_|@XA0e|P%*-#!-fq6FoxGy1^dr57cHA@XE!-r> z7nP(_d%w`*{+nYPXesgv&B_-u^Tj$vsU*1 z4uE@wNAC1;t|&(ZCM!yqJ}%zzYj*WrSxyCPTje;4cgY!h8++smBs?psF2P*p>C@{E zv7RR}d9>>{7|G%2bWI)C9N}o*g>Yn)Ai7uP{_{5P&*J>^S9cj)Ws|LquBTFvCoxE? zY_^_G>IngBF)X#dz}yfhB7MkDpu)7Hw!u?p*Gs$V`87e{}z-OY!7BC<WH)F=@v*;7=Eyy(rpe(qG?$A|e8c)~Cs9Sam|GF2>2)-AU^ z64!f?dQ{V_SPuRxVm%Z|@5t=Mv=~7b(kr@0`q}~cXzOLNlx#Z#wseTlvGi;!{Bl+$ z$z173pQj}+45mombk_wWe{zFTxga}k$FrfZRg*f0M)pV=xl2Pj${V7SRd&xp$={&g zYotLg%!Xgo0LT^nUQt;oS$K5e; zuvjpH`WP;6LmO3HX+Nia>R62Ztb2c)s_l$)^Z~!L5m;hoBFIV?9I`$JF9%Oa>&ACK zi`Q{Q6>qXs74mu0bSyDrpOQjlah^<(e{n{Y$VbZJ=TvHfFFuC+9J>DP*mRWr1ylx{ z?0}R`T9UQq`V>s)MLd`mN4HZ?9$Otn@0(t`riy{@ci6s=C8#;+N}nXxdx*o~bEbd7 zLeb{S3fLbqU+s_bCS-9y1+vB19goFaKxo*St3mS}p)2iS9J}9$l}Q7Y?;&K;Y`l(t z@rC+6nS(*bw%Du#i4QOG>5imY92)-ip*@^3>$gf2npjsu|@45fvv z^khv{*$dnaSWXbLr583$@Eu|!ubg1WM|_7xW$Yx&42I<>K}0n=8{*c*v7hxEB|AEi zv=g39-IOnqfAPb^%?z#4kYiCGfi>fIT@$^JJ@Js=FZL~S$ax-aRo4#&-s~0mOsW_1 zva)d)GBCX4(MEai!K23{1{K_I+(GBBK%3>9uJ3 zDLei+r)sf~oU$kZ&7dmHWd%MADk!FO-PvrWc#S+1N^b6!{Jr=CtS^tWZ?mkNy1xCC zcUFzOaDLa>eV5Ptk;mBiB};kjw{Ur?Mtgmp>(VXhtCs>}55~{lp1PjP)zp3N zW*Ff+`o&7GKBoC0+?!99P6t?Pz1=rm*$3v0H0U;us+zXg)df(}ZTQHD%ZX~Ik_*gz z^9}O6KW$L^p=_YKWttWW!D2;$7~(WL_S>>;E6gTsX~gq2yL0nKmSRGLc`@VDt{l|} zU-+GUI>ey&FBc!_Zg6TuOUVZQ0n7Qy@GA0gUEvS}G8>L29WnX=^{e`UUV9#b5)KNm zE$bru{6$~SE*SCFX@xL2J)#{l82lbsHi_%+?2s9(IT@lo*d>?p>IwA2M_H1A)Q;IH z%Y3S^^7dr5S42kC=3+L&V|1$a%P{^IdT+``t7a-yh$n!6FDDJXU{qByhVKOHYT!JtEqAphO?At8#I(&mwxpbMeRt#+PN9)S1RbVCo#D)41CjBCDWM21b{uV6k1R#~KYh&?cMQs<3^YrI?;{DGjG%a?7 zD2gXCJ&MwmlT;K1bzV43z$r2at)eomWt63&{N93NmrH8dxARkC7bAWRXWh`buykXc zJ2})hfViC$sFcwVN9w9pIfa-}bJD%LfoOoX==V_q$;E<568z3aigTOTw6?{9fNkgyb0~PZ#S98+CU6U)9$Ou@fHhpHB3pdx5aX^ z#gCZ0IH;(ffK+np*{i949PqeA^TzZ62rAkqmU)_knXCtrIxu;}vu5J6;-44q$UX8x z_p#&lh0AF;98(wr@jMNG{4%xewOEG!YR03()#SQBpW?p#&`o3yMPr<=^Fyj(Ve)NL$q@kr1N%kh7PM$Pt5IX2=&_#NABe4mgBt^lO6J; z?6|>O4yCnLG24Ru%paI9SETuDefvSdU?9FTjIWjE^2 zQmI96xEYu%o5uX+t(%yf+$?s`{mBE}f%Q_I!6yb5MG4d6ulMk+KCkUR7A_SenJ%o; zCvlEmq*G=R>k)7jfZn|7_zh$f`_6tzo=a;TKPH>6m=M6&ew{VJnuZupn>q(86iVy3|wkEK*lC4ayCFcm8*SV3+m>t^)-Hp4F5>?76%2x2d7HD zeCXM;HbxFuGRo7ZCujNvXFJ8)oSH92^~bbFfzkFtwNBa7rH+}PY8RpL&!R-OYM)1Z8L8bbo5G(i@)kc!PF>pHJ0y6@>({xk{3SEEn$Yr; z;Vfa*03+P@d1AwJLMH-n&V$nqR{8A?p7WsC#5UpIEgo2i)(K{6_V&$A`!cSKIJ3S; zBj@T&?N;y#Lj#BKgFN8huLL z-|9nG>;H!rjJ^o+f3Och><#8T;gOCwnwJ#TDL;z&s~2eZmsys{A=<{SRU6-!8-dQ= zhD@q>+@u}Zkvqbhi1he@8Pef?M&WPOF@0}I4(J>rUdOkxDR0>6oeGxNmh!<99F$D? z;B!G7yHXu=Bn}i8os50r^7H`y`p3t#Wu-Rz(Z3y%`8id8oZAA_vns-0NLF{d>8c!6 ziB~`Ye?Di$)IX;jFPzwl_8kWu4l|llkv+%)wv{)2mBi z*JgFVl9V<1+gac-j|rL)Q{~v0So9{eA|No;tcE`X{K17!KgcPLxmYvKd!5Yc z2qcYqfS9)ROyAq=0yC8?Ytl@<$>xK7?13Ex#iUy7jf@28(Iw^+Ix$YFLvuM{N(IMn zcVwMV_+ozlnRmWq-d&p=W0`p#g4?rVc^&_yD&NEv#8&*~;-lirwXVKvg{3e2ua{HB zQ-zZSQK`x-F7u47mxL3hRc4PxOnwoP$8F@Ipm*w!# zBNK+(Hbu$(8!McpYM5cIp^3J(`BeL$NxSn}wshp*yz#sHXROK`YG~!oqXh~%>i7rE z)hl!Sde$;9V`6xIiY{Z3G~V!{ryjcQ>+ysx8$sS9dk|TMG&ObT_=H)BUH-SBapD8jQG)M*{T zNfvK&D)|Y`Rx~NwUiU!bBK+}A*0nuI)FCVq2}MmPsP0vf&lg1nB-&jRaLLPpslwcc zj+q3spmDCD8%z*wlt$HMUjNS46|pe}G602+9DQ4; zGVKwC(AtF8n)>Nw=!m1Qgc3vtalyP{vR}uyi)}8U@6WM>evI3?6+`ok&U9Tz{Ncu^ zrMyANo3O}QTW0*v10q3I=-*6OejhQY50UK-Y2O3hvEZfOmJ(g7sc*Gy%pQSMUf4%s zCLKt>NyjktzaO%ikluMzq+=aIi{i?y=B<7ktl{dG9vdiJ`M9IT^E8EsMXqoA$3sFTq*VP7x90h{B#BoI zD+@bEoXvrJ{BERb!{x2li&cY`-=jSu-cWD6iC$1v3b>qA&&x`GqOK?pe}@4O+`sugu2Z8 z(ArTW2lH!*cM>BJ#%yQK{vKr@j6z7A0q-4DyJ(1U1#WSDFGV9 zI21tVo;bQcRQbQBCQoSUoheGr@ed|SyJZE9YVz$WnpES8n}!Hai@CNK4Q5GUzt2?K zl=j(XXFe@rrrPs`a3Mvhk(qJ^5Hz8Y7^l&%#VK6rd-kK&?Cto}p@qS?w3t%+HJL%^ zo6h<`76ROSa02qC-w>`MTHG?;*is=DXswkI;`tTEYrSrhjl$5H`ZuYAamC3G#vaOs zXYB*^8nF8|;xf_U?*PHg>ERu)A44#VGov(P52jdBY4sUH=E}T(Z=awW-aRqjxCI&u zV+R&SXU+_2Cx(kUf`C!i-}=_4)U=Hrgud5JB9W9_FOhP|0!QKT2>2| z!A9vU4~vSaFqhwv1Lc`NS%MIXM>9s}8)WMg{(D{Zm4l^+#`vfDe&>vaMScr8fRPKk zDY5@qP}d*ax}sv`2oIUk6i9!nEP2{GLRrHNfOG$LT368D&VHLC*6|gd;Mj&*tTW|C z<8r+PBf#Y!B}#6f>bmXWy*hgYvS#Vfn71_v-vXECt_EIB+SsP1ek>l%N|go4SVz=H z)@?VKg7CnzsY&n4SGr!uY&jL}y!5EQ;K^%wsgCNppQ4=}7^!zR@3A>1KLYt{<;0H> zm3@qvx2?Rm6v)VWg)QfA?hEne*4m|d#u=29a_8}I7&P%MrtEyvdqG_B;XT`EWvsb4 zJXuI%-0jmr3p_3tZ-p|V#7_0xL%I70^XA|{a*s74eV?zuxOZl{eaJsWI1YkzIbq33 z{JOJDRJ#KWh{R7}R?r#FvP>NuB-t&YZ}9ie?=Cq$nSL7-^XEtOG0Bpj4r>G_^F3(ibT0la5h*wr zXyvt>YyJ5A-}X}f{Kx;_cVoY5>HiRb{(lD>ry2r5LwJwfT_^t9?CgxJ<`#{}$!?b*E#)sr z>yL_Hv2b-u0vw|({p`F@uEUHYUzX9Ho*n7f-xwnQID0C$PkoPh zxnIxJ`l-3~Gpapn(O(QI|B{;iS*j0vIP>7T-B%>~M^#ndZhy~z`=S3Yu?y_3y)2g^ z&gu3<_kEzAT0fwaq>KSo_%hjn5GFmm^Kn_Y2o><+`$WFwKV>fjeq6|!1GG#pCZ2CqA zo5!@F41XhH`Zp7e%*mh|f#8tAv*WQ7KW!^U`Z6Nle4sj6Nq-iNd$@!~MFt%)^1g9n zeSSpE6RX*??RBvlSxuG^4GVjE>cezl+#9=#v#EMJU%$n$O$>jr7(9NN|B_wqL>+vhCfB})BATlwy~xDSLKB}-b}ld%^HPHMux+rghnO&a=B z?&0M?U-MH;agBNDQ~Pzmr?>;@g#*`o2vT1Hq-JxTO z>drL!Vg@ggPfx79HTLH%KNu~@rNnDl`IzhHd&x%+-G#EFa!%B?2M>l-8vD;F<8d`27>w>A`?yT8Pn5kx5JBe()Q0~P zqO)u1|CgyxaEMr#Fj!$P5GJ?aiD#nCB-9>)E#zf+9Py>Enxwxnle4{Jx@_mT;nEWz zVFvCmjhKCEGCgPv`JlFPen|1g{DmG-HmMTAUfg5d)k>8}Zn|i$(RL`mi{KStDs%H*rKUU1)W zBQh?<)Ss>4zSWvg&RJGYQ(0S^YYfj18UYVZPo*>}qmdma#EgJn6!EmG!N|mEf0xbv z6qyv?=Sq`r+wXO?EM?E6Ns(*___NGj*8NK*AoNY>)+;mO_I@-gYin+rK#Y-{I7*?s zy{FZ5HEB`KqP-<^D!2=8k^>P^lP0S;5<-PEsBp88e7sWmP>RvAywb3`;u?6M$!4YZ z%@~nr1WFJ_EAy0)Xh0F#0(J6vPdmoSw|()x(d`XFt3F zUuA7TMn>nOG*LJ`05YF^Wuih_(r#}o9t?*L{YvjDn2)s?^(R^HAc0Z@<7HpDxPWim$tU91sk*$^DTsx(1|@l;3{9+!%d! zmt8$|=lj`9XQyJTo(X-DCuRULHM1zAc^Rcuo6<)sgBmN?vpAGxRCvbs^wtITdw{y3 zrZyTMqS!umkMG@sH_@FhPGeU@)n$;gN1g?1*LfNwBTag!A|&wSCKWF*!gw{C6c%8T zs)jgGLh9Cl&Au+fkl6G*HNH7zjdu_Q=hkH(srnd#b~A=yKN-|q|1})?9VQTgwIjkb z2<_$-i;1C&I48i~NRHkN$#}Matbs{-1(Tep`HQ_I%$n>H;$A2U!lSvK*%7I`UB*Rs zd+r4X#GUm&_V^{UGH?r!wK=g*4?^RQv z@uMJC83pSwG-G*(O;Atp^!|K4MBRK?JvnqdiF9gytxvh~sehU~1TLBsD(F--`1Wia zcO(1bmL53zm3uZV99EG0I`7z}57gLK4R+X!;Z#`cB9^!?SntyKNRZH$;`!BQQ;-_> zLUS~0_u3k!i)WYfYgo6)c6oy_IaDsAZ?fsGRNjK}9&M3x5ev5Fu9|<}PC60aJQ-NI zTw+I($?i;bJISdh%4=9x2h4NK)MuK5q?N{~$%8RAXhCznr1wAkzI48tt)~^IPNA!g zECpx%FjvC0b1^dHDGt}?lMJNC%#J0kj^uX*CxspMiIU{Z*+I19Dacvkf&5L>_1CAt z{T(@S%SSkxRPCO&Xm?1V@w$<^HF53V+VMzuD5vH}Nzjn|$-{>>T>CodC6X3xU;E>p z3pWoz!3AEX^Y2?HBRp6Qzm+NWPDn?6?isImda%W>~M!spK=_eZwuH zEIprlAH23k<=z4k)uh*sHNS{9sXsDVBrZ(O(Fh(qdyHURl=$lSgOaAYQ@GaaBQqwa zAlBZnSjE-b&5fnc-h(3zrH^{@db7s@x9SH2i<^GbDyGaPw1}p^h4vzG-#i}2ZyNNm z%Av+do3pyS!aw@LhH0#Sd2i%hZ*R)rq8|wrsOyDt-L(|oO47G!u|085^IQOjBsQA2 z%bL7uGHTIQQ)D1P%WnLQI{z}v&R=8w5?Q@J?3Cd+wc-E~Rd9PVW4 zVzGdYzbWXF#MLAF&`B`yW$=6?l9u$q&$e$!x@@s*7P1}|*R=%k6}l3HMj->YF8*G* zHE_x!s+v9dtkWmT=6S<+kjY6#;(_!WOhUlNHM0*jkg~Y&8(?w{`wqY-@;l6W!VeP> zSjN_qvQa4yt*?M2$>N_Dv7A@Ahw?v2& znj`MABjCbeo6+fa7gTqmZ6T;9l~d>>+Lm0*^6`~MKc7^?Pk6apK{;h;Ze(YUYL-+V zXFPo;)GU{{dD8+*{2gX%rs;B5Vd#9`!i~djhL-$ym$DC{^#bO zm<(@NPaD09GKPBnMe$=ZzENM2?Vz93@CB&);?EE|2tC}VbiqTpw!jes9sF{x8V`NW zuue(;r@kHwS@g^{oj7C0eGpQ9ePev=XBcl*Z+J`okfY8It?iNYCe~xvfN51@6TRHO z#+cXNs+X^B2ihT6r8YjiNC|_LOux_b|7-}zT|@Yz)cuTS^IPnUgWzYt>EjI1WxfSjQxb=tw6bKBYQ>0xddmJy7mD!tWfID4V$dQ zxqf>@EMKXd=<2N->6e9{9*o!E__}UVqY8zXTLUQ;%K$-Uygt@fkBxAeC42BhMs6Rj zG>r2g*xI3Ad$x*=P_e;~-4j!S$4G0quEn?U;sRFJ1)N`i&AL0RvFXr~TW_|*bR&2b z*7!p>ZL4(}H8#^iU&4yCe4jai%9X zY3^s>w^uzRrNH5Y*}PWq&MH*G1C(7w(P9X5?ZILkf%hR|ay)RA_`u&;EIlTkdD0zL zk=Fq!WWYPDh4FBPjJ@H!7IfTz637t=jUaYyyUoL>$ z2zj4`bJK98U&m6<8CBilDQ8CAn^1{(y5Et^+5ungnRs{3^?H7X1BWYD7~N+COx-H= zQ|K)662CQCMty{ByXF1+i#~tvVQ7+VI*?Mcvqp`bh@SWG{UEvR@OPS-6e+<71!qj! zjb$=Dkk2ae4AmuT0wjJ=*vaj)e`=Cjt)hVLb1uiVjq;rtBfeoJkaL^X9jiTmI-*-O z9S9bLjwpWduvlmHxg?1Cku7A;JguH+Q>RZa9@0IFZptvSno!Z1$uS&kh-nX{H76~F z4Gx~|m7`c9a^KwN_gyW0`GUcQAY~a6(kpD} zXR8veUcq2TX}H1C;W)zqBSS9@*FJ*^q8CLL8T>iK|C!i#()#x?9Ljzys}5&nkZ{v_ z0F@GDl6f1v1%`EF6733)6gqFL#~i8f3(Vrk`LxZ-H@g+ix?fwY-cigC(Ymr3Bn(WB zZE38tD826CwlvzI3Bat6OD>?*xjY^X_a3cq#iT5)#x=LRr~41;9q!!e$x4PyyFgwA zJnu_BA(8lJgj#2x)x*!S-_H5N<8@i*Wn}xkgBcp+PT9s8%cdY~V(5zmG*$2nM2^8u z$f{CUW{G~P`A=hl^Zs=ft$?P8H3Qrv0V1F86jSO`E!{Z!UIJCt+bo;hKLtmL@x6C{ zdycIj-BNVwy!!m*R#i!dWZyzC5YNxSIr$EqbM;A*9NRW_VRGuD5y>ac=NLK6s~KD+ z6VRVwg0r%D`1Dx+K@H26yAWp4LQ7ccHrQbk4!66;AgU8h;_!;-w_2#|ylT>TVd#-| zWz*C55O}?1`~uZ|E86w?<666fw<7%Z#-+*zeWS5bzmNOG{I%~x2mc9SZAX8smS)i; z?8aOSn{#sXb0y+W-K6QVZ>0emR@F5xDw&#aMH`=4fNg=lC8W<#=iQHy;Qf*uNk+~r zI6xeDSVQLbk;k4Lo6T=oBd$IX`E762B^w{RCiKTN4Xz9QJ@1lNZD6QR*ub?89{%@ZCCxQ#JhA>{r*w#8iRuVX|nZpfzG~ZH4(h;ZX2-KlmH=t>az+dt@0RaW+ zO0Pi(5J(7d#;qt-={2B8lO|nibc9et=q*5$5CVkI0trbVIZp_-*|X30p0m&Qz3=b) zz4?R8#AL1Yta9JiecffXFjPF#eZzp{*yOICv5_G(h*n2_&$04$S39)1bUW5~doFRN z;`OFycPJq%AeXguWhKT8yV!)wv?YKwkN5k;-y`Yd!ko@1YWr= z%~Eu~h0huRSL}*+9RT!~o=kM=>Q*#5;#aun3H=N|kBJ{y^TD(nT%3~ochuoAt-ahD zWb?I(Ey{%8U_W(()$TcbDm|ut?Y;qJvQhU}8S7h%tRm^q>I%oV*4D44u+OX_ZTW=Q z$&!j%ohTDXNlp3e10j-ibSOs$k@7xqhs?8C{O8XBQ2#iUfL~4X8~5<4jYu@<|0o|ohP+@kmYBbFAOB!r3CQ$K@0nvf(*8@%>)ZaMYw(6Rc$)jqt(#&{eiSr5H`Iig|7IB$PgQg_+$ z?Vew1@h?>&+-S$yecTxRrTWvds`D>T1d||7*wHOXlr~pmP-uAEdcuU*P&Sa(*tY zggJCaZ&|MUJiDAI$FT(5SY9$Oqx{bXX0mUZ+21NUJY8=aGrgd?1h;ZHcvMBgLe~dH zjKd@?9pRR_aco^k@#4~_1nQy&7plvQIAF=a`Jh7lCt=lN#2S!U1#AE{>np`g3|&9w zBLoqyrJ+w&8jfAw&^jfnlkYoY;Md7LZW062^pU~f<^9%vTf{P)xRda_`Lwyl4wT=x z3*1uH*bp%(5A&|@^KR^jCB8lkeMq;0Ryjyncx3t};WCbik~2!-mMa1(&rEVBUM(!yOf$lL(uzA25~Sgo%Nx;W!naR_ z4dokFkm3R}6_ml8ftfApBlH9}fMa>d27GegK^=vfrHs-`6N zYYLqANDJC<0LHH9j8QX&FiN*r;JUm8&&)OgXg~{cz8S z-AcECQ?)GB>Ao$SmZElU@3|TTNyhwSFVaZ)ymNDM52xywhwj4%5Ck66n1Qd|Bx7K4-ta zu(zX>s!7NAnhs?o>=6N}Q1Suop#wHf9OZGWf=ZiuO~X*TT= z?&uQJPkR4Q3AQYlX=s>(V6STjX0U@PsNjW6X}OogRlnbjGvk%64jdxHo)MThHT(x5x+Kl zAU|g!18UUO!0KN4bGCud~I+mUX6g_e^u*w^M!Fpy^ zqHUBQdiZTtXTGHYqxna$j{m?`nfq*`=ozS*QoruTXrOxrbYeJC8*ChMHDvLb>U(Hx zTQ|T;L+7AH_;OvVf|)BncS3*V6~THy<6 zD{g$;2CnC?we9o*$Emhh%yLZKS^xAiAx*M%(pLG>zKXs*Zt}HO9#!B}w42r1#9qMP z|NdFg$vdV|+QC5l(#ab&hy?J-@Pj&1bgPtt7pFsHYf;LI;E;Uj8exA(20q`sUyV=k z;UcI>&-E*`lf^0V4y?u$5FD&%Qy4gtWo-35=w4h(hhy1JJ%BdM@DO^`RGYN=YHss3 zbL3e-IzJK2v#lpGR*Y#U3|}2!{>@&2K2wA|ifFjO_PjBcXM^#m%{Ytz5_)x~=hB0j z0gGxtEw@mn^?VHw2sOYSTp<8H-W4ByqV)_HZfAs*<6aoAp+3d}$i&d%2Z6YP1pF_d z@s~Hn+Ya}gW7!1+Zarf>Q+v3!wgz13T9^^};zo>fj_Ugd-<5mOH9`yT6DCLemU0$g z7G~#`Ef76EJK1s*0^>Kj#iWgliyfO!yUBOin*lszb#RPfkFGdHi~hT+=gp+bLQ=h@ zm}STi7;oK3uTw4a-~a_0S}0CGlkRruEIHPMl+<+nzBTpC?4q=pWE_zhqh?9c*ljP-Q zufo)pG})+N4HXAdD@~=v6xDf#(=_%W`aR`$c0%`tbDPHCFI@53Pie>AZig+6tQdw;hi5G7Y%t7j$kLf%&nN%JEaU9<# z*EZ*69PJ=%RsDCFL``&LZ1ko5D8lbUY2S%yLfsB%J$F21{bHJ)67OBt7y=P*OV25b zxODV;t9eS`+9|izOx(6y9yay3jCJ*+VHtFc+5qP`E}CU0^S!<~F-v7iP);ti@$0gY zD~Z6KYdV6|4Ohdf$01fW5X(~UHkva_hO!mRuu4e7k;(E-Y(Wi&SLs% z2DVxGy_35zqkPQEe?kd}W8BE?*q{7l)@(`yeq)Oe4_XsBI&?vQ&3fy71+S7%#qxH1 zpcGpZ{ur=juiN4TkNR7Jw1c&QMO#TDO};QqRx3Y8ntpL3ot!dz8X2ra(Zz{B@`B@)Zn%fD=cJq=N+9%BkvqQTvU2UZfd*2CzNw2IMKp0+ z6VZ)lF)rKt6G|K4!pMG3d0=c}&W*_3baLP5uF~KiFH0#~R8CouDKlkH~2&HfQvPFv~FDDB+|#l@b@xuW8R zI2osVOT6;HAkK#8a3VMTw!;eIc=9~~Fno0xz zIEzSf{0@HPZGST^DG_@m55t_&{FB-Pgq|G~TND#rS){h#`dlu)#bbn{&Z?LZI=g@@^Ur$ogBbWsJ{IPQV@`qXxx{JIHd7bgPUn6jFkJKQu z&RW-WfPy4xWO|J`tb6~_jrJc~+_7AIWWimfUuL<_`t4^wIf)S#&G z3Eg}jZY3}%z;FAFylCrbdV%khnb{fxW-7J>TG>5P~NU-F}oX*B6v`4WR3 z(_buQbb6_30O~|aIq4f~{*WJ=d68GA%=>0Wf4=$EkeO-K%e#5>7ju9F6YHCDF|QVy zgWsWOj9;QB9j0Tb++$#O}r&f9dc0g69 zhZBN3&%9-;$-IIag}!@j3-)-wPAkdrQsyVD-+cg-FsU{-`(DPtAm;|#Tf1|*4`LE2 zg)xqbJIKP^-DbB<5tfBP4)roUT01$I`~dA+%o=QxkRA&jE>&7?w2nt3Wy`L6j8pdY zY3Ur<8Nl7WFaGz7lg&u|eoWfe@7u{k(UbKQdQ_o#ek-uqKAf3yr?$DlLZ?Pr&t~zy zg>e4#zdOM@jDsr6l{*JAsf{uAC*bQIDV!nx<=OqTcJl3&=FPbcs1 zf5Ws7bMfCZ@t-pjFRvy9al#f=X5vnSYn^>49WQXI>LzJuy{-}CSeB8Lr z_xtA>0dj3TSEZGzl5sSAee4GdAFH@Y3sd&o5TjjnSpbTWNj?%97?s%hvT98?;75a zmeZU_6X5P$O;zBA3y?PJ0;SaRcO9Y$S@ipDmdJN*b~MlK3pmy;*i-zN?nwCk1E2wy zi)$Tr%1Zs-WlWm?aM33J1{w*+fF}dtn8CsUM<7+3uXlHJSOB0zr$XHRwHoUpvKJS} zK+i%tzU8ImeqdM-8hd0B=l7PXEB9#M`8leKb!@kWBKbo-y4-3IZA+mHuSF3DSC6=xl*hD&TD1`Ni82aUrIiTHC(J%9hlH=h8<7hr}b5PNg< zV{I?>MhQk&z6!^9c{us@WT?q|4KI3^`k6*qm>kKuw7n{}qoENr{yVR?KLD5WdPS)i z+o)lH4PpM6WX)=>TI&>X+6rDa8kGAJ6t&YaVA}xN-CB0vR~z&A7W?GfTRajuVg561kzcBY zzoUToJ^&Vf`0t(f|43c6==1%sH=SM-6xtQHdp1T;J{8&g+Y;+`UQcl@( zQ z(_yg+M=!VTXj@(RS^~4;rH^TUV%hT892}`KTN5e67?rDcCBCQ*O1^n6uXVr5p+^J8 zMVi~QrL`Z%%5UqUQ{IW_7T59)b)PfZp{F=>z*gOyg^Ds8dn5$M>45G((GC(PR;8KA}jcP+#pr)2_lZ>9$ zCQw$5mi%fNLumaqJx|wj_d#~vE}HjBr#APfSS9TyWp_9zftXPiu~B*_>*#h>}2P+B`{jZfZ6@Jm^`RrXxq6?HqXs3Zs6 zBbXJ;%;oA9H@SHCu{HX{IYJCki1(J?Ps(?`8L#n42W%1mf>MD^3cH%FthIww3w!}< zMOdn=(Z7)mc%}YVKt9$X$fww{~=tcJTl=pakCl;Ocy^ED)ED*4pyU+Io*5Q>nU42{5YI(Y(&Na69 z>*|pvID;o@z`wE10u~1qUyCz3EMeRY$erE8@})ev?LlyJ!=??n?{7Vta|z3gHT#$N z_ga)*`FXvr5hY$>g036#*3~tSPSs`!Y9z%*R|*J!N357?m6VaeT3>@xiYtw;W}%k4 zw_%zahKr_zHMA%}ehR^u{3Ip+2=M5LpsB`?)gem<7f5uZqhf&?*EHf!=ZbgaBl^xC zYjtPViv#nM?RPYXDs)D4OLsjC-se~aT%~51QAd1!qOPmZ4?b)O%Jq9kVqpG~>1h$Q zm+)ZEH$0(12)&iRD@p!fAN+9YCMcrsrhSO-vwspbyLQVxO^w#mj3a%T4X$-`aHytI z-NJh2s5Ie;WOQ|XU{s2RiZ%{*tUL^@>a_V%)deRDSocD0P<0nxWc$ZgcAt5a-t_%V z2EOvNy6+L4xy-;^*rJ#XBkDYIIWhPw#k$1?@@#`8q@N|mJqvTTEA01Sw_u8X?uJ1! zDxZBW9WEZuJ`tVK<{Nf)N^1F-Mizu$en)lXA1CC!%Wi4_E&|4cm`j~0rS&_@$>RbO z5c@^bG|Deq=fLoFjQ^!K8KCea*ln5GcFIK%Fs6ag>g7*i>_dVMATKyXBz9xXCM%WWwtH5Sq{ld;_NRqrzoJt6|6XP0$JKkO8H9S?%9<0aS(9m(SY z@WPum^sA-J&gL=VUC>(5s&3&_R8;-agfO0achQbB(R8T&u3T0+MISrT@26=SKjtympS?~#7vx9t?tXT6ug4!!f-e1c6CdU)`#*Uuw7;+R@=3n8&kl7;M?;|YZ#4=}6dBobx_ks-M58*21EfC(*HO3GIB9_6+u|1?`5(5* z=HKaEBRGxI8jP#b_9)=Uv zmo2>cC--7y?x%J{an$5Y)MbXo>HGuDYGqB93CAloj%f{Om(4tRZ*nBDVg!Oe;}oA3 zSn<9_mtUabuB+jP!nrG_G@rorHB)ON`r^EM5z+m`!KN07dLV`k;>VOIr*3G>}^m zzzp6LJdUe9d$1%t3H)t!01dndWGdVuCYEVcdzjbJ*KhkwE%$nl zEwxV2@cY(0O{I#;%9yTtc1TOTGyOVYN&P--s z_I&V0Ft7^lp7vTO-r4|DvzHuvJ#w*cP}r>yXzgSp$eLI+1Jx@kEG*2rWt9+X1T1P# ziahSH?K3i0vh+v z7Ce|1Beb(5g^Ao-(6^#PKkT$|uxFLGPK9bcWuh-_V4-$e?F$Pb$3Zftk2IlWsn+%7IWa`msSQJow2Vmki!6efIx(qbF*=FM0!wTlTPUb@Uh zpIHl-te>Y5j*};vt6TLx|H(zeJi%xIpV~dpo^d6j|A;O(GZLwA_VNSUL?C59CEv9q zX^JhH0dC#(9`8;?S1#}?4~lnrSoqA4{#sj~ZlU)UHDspsx$ES?fri~ZvD=YMva6!@ z^Nj(-M!)w$i>96A5!adfe(`b2KK-QypAY6M8Ox%6#oCH?{X)A2dTtiDs9)dX!tn)i zZtj{sa7E<>9NED^rx;n_ZN`21+TSX~qbFm`gV5~cVyj7rQ>@~=ozLnD7w8r@IoKhZ zKXHBV0!*M@_W1f0Jrp!pHmu;h?3))wrPk7K`YB_OrmLw6=iiJMKoMzyHiuuyexK_Q>?D>8Gr7BuSo@@wC>kw4|ZgXl4=`Ij_1v)8uH}qHSHdb zOLu3;bYX3z0THkUWqhl9i#_%3VIVn2c%t_UnXo%1cfA~I#he?gG{qd5eQAA3rGnIC z!h$_8Q#K)_M01sVS;)fdksbMF?qxTiu2kY>y(r~B;NQX1T-WbGGKNnEtqpN)Vw@@&Cq&%P*&d9VJc8sX5;w7%vP z!zI-VO(?4>L7%oVhb-SEb#1=B^SKhV=^gI)O_DtWYzLxJ=R?@kT=)%}&6mJL3r5U0o6u#@Nij=s!n04R@RQ2m34g5n^+?w$1BZBEdEOBR zqG|$-Mf^=!vr8FTD{Go&*W<^9gGj#qbNQm!Sh|J=TI$71P1PsaJ1Zg(#M2)R)^RTfyB>6fDCS75@RNg8iCroYicTk0s zPdSig$a`UvKGSvrwSd>&!fu$YB8o zx3wU8d9{(Q=P_JvI9$m0sD0(0XPuZ=$3uwJ@oKs40GmW@1M|9TI&w0JItE>dW+B>K z7VGx*WtVtX_}58YorVAsGiK98q=?hZq~}jJdi#C86pQVmMkR*HvQ~%<*%11e{J)ZR zD}I_i#_7uEO1vy&^`b%fOHBcDy@e-aBqn2ehJXlPFRkE^=HNGzy5)|qk3wDFiJQ3o zf*t@>6(|h@svr$46ey|pGC)0G?lGN;cbjj^@J(vj4v;4m70O84(be?NvGD>19;cG zvfsd}FfY&*3#%=-IPiD}s(vB5cyfmakSi&(&%yLXzyit1Xvz=cT8lTA2aKTdOpp@h zdD4N`w5z`Qio1U0=S$b^_Sit43YI)_*SnWTe86kb-4i_e!AkhjOaTOA^nfDP{YvdU z*$x48m6Zi*^QPX`YRA?2MvtK7hT9g1GUe(4{n^I1vK?<*Yoa$gj7B=sD01B8%%kQ$ z`0=U|pY)D+iR1qgHD4z8WP%`=?(P(;#x+63C;oKI7OA>XehK@mUlrIt9SzGh-FbFc zccY&{Cly6hcC?{61i;RGf%<3I*;CKZvy$|lO!C?XP6PW`b}kl{%{;XUONTPl)DYr? z6uB+NhSfNJuZ3r&nT3aqInRDt7*xyDfOhVeYrOVRpZrma9;B4i+KZc@;v~%#FZEY- zj={GRRY13YZ+TWRZ3E!^PoO&k+g?CvM&-~6Dga#rVhaa&%fdW!LSZE{L-GQ0foFCP zpV3E?^_obv&1?!W=n6wHb{49G$UD!su6u1i0`#;V*9NzDuYXlzW)y*D@*@4;!F*j> za*vasQ^)vRP4?JFt6nivCJ1-;a&rofi#ASWj*9uON=nSGu>*HOcGcfLg6urd`ubv@ zZ`LC6-BUGsMwatT<;h)k$okt4!h|nezWT3=p#MJ<_W$MPf;;S&F08hBylz7P&^;>} zv~av{x4_;F!&t|SIG=?0FbigeZXN~q%d#U-Q{mGqo75krce^qpfEl9p$}+uiD;ck_ zj!E|)LC-$d&x(hvhBV~XjC!uBy9_DkjtyF_Z92uuscI=H``%FIZ_nMftbYU`)cW>M zK~@do#3fdcv1q8#g9CzbMSC-ogtF2ShhWR;K>c^>u_Cwnk|$TgW|Gxt-Iw+o6F4_e zvNc~eC5v?*#KR&{9$A)a?JE)y24fVUmO}Xztoqm;{Ie?6$?@DRjQjG{tZRb&u(I7T zND1?Pn9V+!+g6zRsu!Pv4Gyyv&o>$`wLWqzUq89nA}w&UdtMO6UIuw@W-_;Z(CzQu z)?W2-*}YPT-%j>@uN!Hz7RQ+9tGz~=*9UxVu+AHie%fxVy3RQ-V`)HQZc!-V8v=<& z3u4D^%1X%rmc9lR4=v`ABykUhlMlX{?l~|q({W%P3VU#@8iq$bp~%j~M``MW3xvHo zFYEj|S1_n0FI8*x{uZs=G(=6SlIo_?C1IfR8ySgkG~SvwY<*w|0Ne&1_Qj#JKpy=w zfFV=2qXE*a^NlkH07FKTyG8q`$o`;lUKY2FF{aWpfeOe+bCO*CnP@6-u`0wGSmpW{ z@wAM#a^TX0q+H|5C#&e6ESlolDOjpzNCah3vCf}vk0fEQrul4Z3_)-P94nuWVFPVTW= z;ND^^tSTz;X{S3ee2wpy#G{XHTg6tApnBS>r5kdd8L0+)`~f%GHHDm z5JmucxaW$G8un=re#L$OT>5ezxcR8t4&5PP!bQX^Y^*=Sx@#Qjj3zI}t&S|EnjgQ} z_j3F#I+-9^56emGd&jFKc~HS``uWwgnFm^FNdS3OA21&`WVsyYmL+2TQHlM*ZWC)G z7P~6CYpNLhOA5(V@r5qPy1zb!<|of7V`3ju6rP8jG)oJM--nTK!Wf+|vDKQ?F(30r zjiV+9)G8Hdna^H6jP~yxy9ZgFXXn|Nrn=EgitVL8Hxs^+$#hj*&{~U?PfaVG->Aa^ z=ek}kfV~l4PhQ)!)Ajfc=j_@LT@jMS?Vi$#Ftef_ny+LobPOU%r)7lMy+Y-nmuP3NvOY;8($!Pe}_XefE8 zIC)#HL7kupzBLbt#j2p8)i8zA25WYYQ0~o4u(ed)_7S)8R|J?mZ1WjL{lf!@QZl#dL7$2J?1d2 zR;W3#GQ9b^H$SrFL+j3IeVes{IsV((IsUJwc;*${b$R5wuZC5OZO!gRZB_Qrig3cHf*qgUdtxOoHV zw%}G5VV3cBx%=gNbXN(wQBz{M99+H|h&OxngB91S2+K@aMv@Sb1r zxfkX7-~p29dE<3S{ug_%R$nlJNJWMwj8}U(u;yznAQJNYpN836UqB`#N#(AEayB;J zvcfyXHw5-eCnqKYd`l*ss$qd?rO8~mOnI7%|9F%XKb-kwS-T3>g5BC;rBlSWiU=-MqLvE>CxtnYi=y<9iwztLbm8d zq;fHlq)Kp>srP6w)xs+|NaWZY_?{kRu-r*KXd$KCsrsk>s*i;I7t&*gy|*!+>P)De z;&J?)W9dJF9mS0^Y_FdrPeKXU?o?2uX;;N(MALr|F^hZYNzIpYp$foBkxP`aa{;ZD zJtfZ+du2(>$TZ1%1zky2N}GkdwN{RMiWrP7Kelv0l>BRZWZ0g4m}fxc8E0AmVkn_f zg&8fGs^H>j>XA`PKqXy?Pb&Sjq^>t=_-8;^4*2bWc||2Yw&$5-U%C1x4_{|t)Tz-ABYnir&!x`%_!;p36qYlrko*Miy{#^uLrJehL>n|Qo zc`WIh?3y`jP-gJ-CAem;PqGlMC8uMNz&~B?NgpY3qjyVN^eIcTktT=cjV@o(%&&Vu zcixpVXJh5C9IbejCAJUP=AFpE?hnDAe(1Q);A*%LRv1@r=325u`vK~IOadQ}7N-xc z|3N|^><8Gc!I7r&X<(^OOh+=)odlRa(RpW6L zmNp@fp~t5L*W!K2n}$nW|47^DXRO#oP(MuwkP4Ut==`HjTsa-|yLRD#-f}fYTMnqY zv_Qq3>^*TNb))58U7()n1^65%3YAe@V_)WNyDJnnPYB)dcyJI++mqk5?+AXEs*v{3 z%W>SgC&+v!l#0$OHr1{)9)58puSu!-d^gSA9+9KyRq3g2!M~F1tI!OsAj=0+!2^!@ z4Os|@LZSFJ{bL`S`ae?XQa<)Hl<$?3*64yMH5!XHK*pXLBPOIrjDPP9*DGzvHc?pH z64u^)|Lmsxy9f=?op=e*bHco!^tW0PbMnd7E#D)t zlEISlb^ZMxk91vH|L9yQL33C<=hD(-1BqHokfpwx`rrb4dYRq7ibi0fZ8k-&+-Ao8 znfDub9`>+}uL}^W+gjk_;emCZY!0{)2J5wEQlM<|GkCrYf3GLG>-+d8$4YOM zUbVYk(Ylg{p3R{&ACUF(0BGhnZL6HBn}sIb?X*LLMCMVmm1X*eyiEUQTiCpOa-|e)P>i=#@D9>&?+cpa&58W0QkX|`m zW!M)*Pc?^7YoUe|-LyVW$Y>(E<7rWBcL?BT{u)2XKO;Bot<6Bz)W2}!pSB^?xvY*; zOjZdfVxhm#hoD?d9Y1#FraBOOnPi-)?y@+V{0Suf3Bm{j0qCM}V|Z{EVc2Ir=7FH^ zfGfGiLYA8tJASj0M~ZmYDm|+R*Q!wYC>&tMnw+1Z3^^_L%PI43d)kvrL!X_OZ3-%?Hf%Ul-TFV0jPs2} z04P~R%1yTC@5?{4mLCL;*hv5o4v1JW9Qpg-#4Oa{hucg#TOJuQdfZ7+-E{dJ_j-@p ziaAP8j@AhJl=;ri65(!ZV$Dy=wqE(0-mxc+y*Mn^^-xDURkE7m93G~Tr;qA>Tn5C_ zI8jt~_uMyCQ2??O{&5o{%$_GJ%)A-^1%#T~@0F^yk}RqMF4+bg2Z0M2J((J$`^W9i z|Lf42jbR(PcnOn^PlGK(uepj}O}Tm9B6Pn4+|#c6>61_9V!YrP+3r-!nC{WE=t}mf zZP2^BJ_8#iZT@eWWcS??^S4Z!niHB})g6QAZO&z-UE;R4N-?MWgaCQ^E!}qAuCH_H z)ejC6URlC^V{dhzIxfC6^f%+~seq#U$s2f;eZtHQTb&m!&4?fPySi&cmc5)%?S&z6 z@Jlim_#b}G1rL-U>Fh<%LO5NHIW+f-Z+Ksf1cF!i-*s1LI<%B-G~V6r1SMpw>heFn zn{?@;UFWRl5E4M2gWl??N9dXIRabUy@4p{t;rVaza&PtXos{Q!K_{%x@h#@N11GH$ zlCy)*zT^i)KxzKtiQ4i@!?io64%c}){dp+0mpYJRh%Zj4?@m)t7O-VBg>qx$Q%%R8 zF|sNCm$HVW(&dJC=p@^%Yx1@i+q@w&D*n@)^gJ7UVqCpd>e}?4Iu2Z?T?Chug+NWS zRYSu=Uzn#4ItRJNAQjMc)4$p3cyg%ju%WIgO)cP(Y&T(3=bVhEBceDFoz1Mh6@8;u zJM1CX8-|0%7zOt#M)b;N_USut{-SmPFD9i&(9^23{JqUhf z+03fGT=_O%J$G%rjNE}Q?SY0d8Qt771PQk7tt)aNd#Km_;x;Y`v?) zLFh5gx5`!Wa_;tYI&K!H5+-MP5MDTX>zkA5l4D*q)}Hi5hIIugG^Vz$35lHO}1o04v7Ysn{I#A zvufR#l%@sz%BniHvUSxzE4tFPL0}wwJ6bDDIg3XPn)lbck{kzBAq!K6;fFE-ky>Gv zo>*ak??3dHq)R-~v<|qZYUTI+A4$`H^8US?f>B)7W_Y%$|E~A1tTFYQ!{Wyhj}mx3 zKTDUMG9Xsa+9mPELPL9!C1`x24r1VtZLj$)Kv%pfQgTEQnkNby@#@ zcXI-CZ;j565~v_oV>KAgdjJw$1&1!~n=L4AlP8nWwG=aMQq^JY^EuTTGu>igAUGpf z4oA>A4aC5^VXji*?3zKDu|JB?spAV4I*r8}H0AUKY_w zrVfjy>r8R|T}OOtAB%27R$Ux=hKpjl-oE9eu*F2|xFL9C7-MmKqi%x!u8|wjPvfpU z6Yi~)mD_R&Ub=t~E2~*bEvdyTHI#B;ORpHrRvn!#Q&5L}NJE#25h2i(>;Roi(%CMl za@bmTt0WrZU8&_z5+^x1AqwMaKu^m$h5`tIq{70URg6x?ZK(ERWKz$n#gubHC`Sis zJVFNJ8gEKd)KVag$BK2`aD*Be^8pbzKrX{MTeW>5V3zfmXL9pAo-#QBABit)c{Xvv z-`SXhNmX0TwyT&QFUrNvnAW}D^VVTjxQyiaehd;bqM#H>TnugNA}`_W&WLvE7`DBU zZ8AXGEY=MCwT*bcx&_h*C1j>rlq8p`6#)!@QF>=}ep23sL5aC}+AXUpADi^?@fu(| z8~khCAFwo`26F2u&dQcdtW-fPXaIpcvA9T%Y$&zkhTyx)l{nZa$YgL?A@ZX&2l zr$1$CZAwBoZOTX7^(Q~jL>x7p$ns4a_dDbNCb&GA9%W8waMFV|R>ZnNgxi%#;^3|@_th9*(R zu@&s&Di@R&(=Kx%MT0#j6Dcur&9VJKZ4Ukp;)BJ>&Ed;t-umXAhsM%%gmiRfDa&re z1TpQD!s>Ka9H)s=Ykl1bbPkT~3S+WD^qtA5j{OX~^oF)0B!PZvq?$+BhCFD60^^;5N<$l^xf)Zv4X4(&TgZV4P|ey^$(%J>sMotUYMWi;S&5wdywUmMe<1d zD1q>}?YPI!%bDikTiVFYjgYZQ&50ml@ql>hN*UVq*W(=`>|jjN@=bT1O?V-)x{IUX zLXGNh0Eay@8>J80!rPW1T}=3Oj7UDIx=j=}i9Cs7vg6ziz%R%p&lc6#9FTrp1EU1PHXQ%$5P~{$5@u0_Bl2C1yuI5h7UqS`Mza6gHdK-^gOg-a0`B}p|thWKWtzo^`W$O5e&;Gsd)fae1WKIt&1pb-cmyG{*|=N(9Rw?mx* zOV)F2LQrP0Raz4W@srC|YG8$hkpi`ZkyWt5XBx64V@Nq6&b|gysW;LB?axp~V)p~C zVm4_{cbzc<~sXmLSwq4@kZ21GdyEmxIU1g8Aws8g9n+~UbI_qP0n*vTu;!d z)aS($oxly0*fEm|9|>|pU2G3c76<&23~m((x<52tY6i25Z8hy_48H7x;q_C4u| zY4g=PrJA0EMM$r1U1fo^ajes!UzX{hwNb5Fxzz`W_H9dOZB8w1Has~bBjN^JqH_m)aZ?TE%d}aD9M42>L}xG z{_GmSv5nbgA)QOsnrI@m9e!@hsi?rRnJL1A9eU{Wn3s2+bJ^FFOrpSYW)O~h%JPui zdLpq4!(E^-r>FMKJkL79PHQcklxbUPwqLN{_F4)pD3}a`FTrzUg^=%m7p}X)RL&ds zemSD1)(8#n4xWjvd&)uOkI;%P?Q_Z6Httl~KN-wu91dC>UyLOH@70#3~)weShjDD~Y&6SV^LSBEl)e8cPYKI^SO z`Mad2L4*v=Tb0i1zW&(X<)RypctSPL5Y%rqHEOW(Yy;VGD7WNAv=d`ci=DjX`6l^_ z{jxb8nL34 zFs0j7xmCe{aailGo^KD2QSUOR63c?_3D*u_a_?KEGL3Uv+RQ5fgSVjURw_Y`nxO1zWAd9;Tk=39En7HxAL@ZOA4RAO{<;R0xhLEHH2tiJ9dhb772~0$$L2U4b(`w+bxt#7m$@bkVXV2{I)J z4fCWB3B$;diApzg?O$0dpkx$EzHnADPJ z==(#g0}mkkCI$+L3<;I7eetpAE1+rpx!v@4^t|0hp#^Qm~_U@hE@ZxvO#G~m_y zW;QwLxj~CQYTHtT9wpL&gLN0~#V~J+mg0Zd7e;DtRoSbg44{R-24e4)Q8Q7?+G#?v z%?R0=R}8i|NdeuAeJL|r#EJPtLzk$fHsyX$w(OyE%L5;$t;8dn9j^87j6ctihAc}vn8XnpQ-a&rP}*Gf6+0Kra$ZuvAkW1f$xG?^&{7U{8V zV2`}o_HeQpp7Kt()}b6GsMcoFr$kt60v0R6Ekw+XY!3dJy=sN%Cq*|v#;jBjD;nI7 zu<+{yIpklYq5BYi$zd-j5EtS?-^8z@hDpJ(U*|?-OtA zsQV-`C_IlKo_lQ&oJjP|Os?w>Xvy0sQc-)R*{rx{K|gZD>GgfJk|X_(&Y;r|%fW9w zN#`hYuQU3IQXxStzj!YFbfbxbQ0Bn2W!eyb>F1Q^zWIiAk^#%O`gv0NIrQeeE`{1MlQOg9G^Yy;xLM)}QQ9*rW^ z=$fvD#FxI(Zt)8mIc(7OCNdWHd)W*s)k7{ zhe@ADRIpl}FqghbM!t?j9sQ^={>nRf(~la!9lb)n*6u7P&PI?232#D<&0Y0DTKyDm zMNLwhogV1V?@AZ+n^zMXeP|IjG|Or5c`|O5LnA*eJ6 z;>Q1E@6E%SI@kU0_PASjw^J<&B2yI+k*Ulw*IGasMFeD4hA@)?5{3ZLQbie6CLur+ z1Y`^l<^ZuOgegR(KnM^ega8SN5Fmtvwj-7 z{vSn~!xi?6#hO_M*4e|?xWx^w3RyHZ5-CG4zOG#kyK%F%s$DaZnLj-4=ki&;nm#HY zIUu%Gl@n^nB z=j_^+c|4yTJ_0KkUnTJ@=pJ!$!NzQv#g4JV#9+48h(JWbw|^OeAM#+r3l%ZBkH=l} z_xB?U;fv8R8($N>%7TZ{ta&HYwtW2x1WN1Q2e~{>w3#2z5u7gWs0xm-SA^PZ8!863 zftyGHa6YXGF|ZUE@(9;7C6}15_dV%$VOCj4tCF#5qSxLQF#nHQ)N6p!5z5OlXaxF~ z9j73CLg=D_r{xt+O5uBa%9b-5OAWJ*3U$<` z#rmeQT_8AyEuQ-Pq1y<}xM`4pW@M+LBL?&&z`4O3U2QDKO;ypRMQ7YK2JBww29Hy1 zSIdbHMpxa&yG1jWiP6kun^L^Biw_;odQ@02-czPcQb+U0ujtlB<_t)0!(G+adNWz9 zzGSZv|3t%Ko`(K>xS_u9x=nDl+hL*k#$=1t*(n~Tb*(T*1KloVZ&%I8GH!0iOvSyI zCWem3g)y#p;KYnbaw2A~PcCAjp7(UUCMsrq>c|_;4m%zBuQKbpGYs15h8`MJR^2>E zGalC{Kvy}!n2`65m`5{iAm25lYVSMwKE!y>r%9+LJ9}pm`qpTP!l*Tk!Mso^FFcQpOn@-+)3}%o=7)(YfPn%QM z=@(qkmj>JUql^YZgMsesUCV{0k7OB_?6kzp3%)Rz^3i98f`~d7f2mn)bfIp=&tPoq)Gtp(CsvVuD zZ){FxRI2}|F``mQXfm(VZY(LOms%xS^{L9D%?ZSnWbt1v3r$M5$uRM`Ny(4*r0Pwl z6}kPv9MQ&m4K7-Z)y^eW%M~UcN)8$ZUXA}D$a01h)!Y}(L|-E0Z}^2=p#SD7xLW7b zn{rfaen8O-6ol(0cC=4_Nh+ngq*L#+C1RSjo$mwE>=Zt;$}ViI)>nfqqVG-Kia`4m zbGp4JIQw^28e_(!B4S`{sW-T5tS+-TFDt+t_FH6?3|P<#xNC9^sz*S?${ymcBTQmZ z`-g=}_82N;fPA*<36AGLSmqH2bNM|uU14R;G2~K*^CW@bU6R+NP-vvV#GH{wM27Ej zj4s^vPPn{RqFa`oHAar22+#UwBytKG~})Z9y0Xf>&5| z8QE^F*hpB}c)&x4L`9%445x=@2XS)c#!MUUQj}a@UuLoa{cC5~_K* z0Rk4cT`PEAe`Wj4zxDf2O8}y`ERNSV7RlPnUcE9HDYd#n&&x`-r3{oqRi*T9p9l0n z=D`kq=YxgY0r|C>|GVkJj2$KZpNVQfrM|nj*!%haM|+Mtpa38=-L*%9UPt_21-rccX*T~Yk0d0(wIgrteDl?08=FHU`Iyrll| zx8yK@-r?f*A;svs`yszUU{xkpS$YXO*?_E8?%wSe{lC{FmVxn+s~@#!b6dW?$4qwL z-;wS7sJ^u%i5fT3or5uz|0cIj1y}naa(?y8u9hDF^u=P`0(EuQXZ_hl^m4t416)fR z8EL4BX<3e3A3qHkhBUU$DxzO_)$JvIasOw!?XW8$GoL711$u!7(%3joU7aQcxgxDn zArnXiHOOk?>~`q(MA614VH%UKtbh!Ce3@^j`lk!2l^iJ0m#=nKo~B#;KPdoJ-NFZs zz#i{|W{c8G=ZHLJFBvOGXKo^hb=dRK>uE^ZQ`~6yI z_?t^~Z-kJMJ66g^>sA4x{<*4*jsDWsqNs9WO= zZVI`E>~#Y!oJHl+O?^!3tenyf2YbZLmNVBKT@)fvrE^{TnYgz&j$+(?UfW%&$13O?Pe>!q z_kic#ZtGYz4I6uKY_9(8fTM8&?>A1?`E>PH6;B+ z4v5=PY*s4`@1DPX(-_eFL* zlG;!04u|y4dB|jmz?}J!hgvk7CF}eHL^r_`rxNbRYoM(KR%v=4e8oN5NltFljDfGZUq{KqZCu`7`w&Fsj=N`+@-l5`i#Mya6 zpn)Dz1Vtm@E@C@#M?(WZ58FDsQ^PTb9#BJ9`-S&}vhCAkCVE)iO?AgxIv|iFD*I_1 z-E%?yn{G?1oPg(L%qB^%AmR_~k zT6{vqj~q+eKzb+p!X9_nU`jM=a9<{X2ZkhYy^P7o)mQBY8YOZB638hD)@u`mlR9tcfzN4;Rd;FbY$4A_1DrLxV=;CcvxrXG+xoU?L%q1HDYez9 zcha!AMkZbG;i2wAGFz)C3m2u8QJOVh8PVHD4Gm_+wwYNi6>=>?qA((r-rX-O5l%|Y zf0bR`WJi>9N6Szy+bv)t-lDcR6ssH^Mpz=gtE~IrO(gJ_x z{dH|7BDw0Z&>RzHl;gzpPV%trN`?s|0UTY}@yO8vMNq81zNg<)e2HbR z!XvKGYMd}l=ZPIpwXOyz7u=B=ZeNjoCm(fsaVqmie&i!3P&2e^GWsOb?w}; zof#HDYA=OsziAI1v_Y)O<54D@D)&4qX(2z>%1(JGB_(#YJmX%Gc#VJNF zsWy-6lvj83S}!`BXSEFJl}Gb(4b))?Ghwyy&8s%+8AN&?7iL_txLIBQ4(VsB0rIu3 z`|GFkspqUP%c%iIgiHw3@T zKq=Lhs@XY&mc)?0cM@V6hoJ58alvF1yZFFiYoxBte3K%+SHVNSM05N5Bi1z@(?5e~ zW8cW&@B!Tt5z)_YxaY6HqScY5fdq0zAcP1(HOT1baSRM)n+^H5mtsN+I?%xd$^_OU zCwxlZbQev@gR=T@Hr}|zf77e$?5Fd7g`M0)2+zPy=<5V>^i_?w=Ig{Se4L17%O?!` zriw=|5$IvyI;l^`eu1;A99|o`Jy?4OvOJj+-&Xy^aQts0BvDlpKe_`Lmn9(cwixRr6Rh-?O-|l`;47qB^G7vDQ z#)F%K1e;vl*k2a)SrG3|A!;9crW$q`E}YZ{Do&m&8|2+R*rNF+Z9>z=4eeX*pfE<- zNO6t4i17Aak@T^cfc(QqU>M)}av3s%1J1KqgRxc|4p4C|4+O2To3DaaM;|dl`>af= ztFC#33y`}lKMDt2vz!~9+s1S9KdFP1rtJ$pJAC=+R!*xY76=<9TbzJrez^*&G^L*m z3lCL6`&iCk-tOkte?--OY?NoEn97d%%x^}jFTb$_qHG&qn(_^8aF^RyF*gpsTq7S3 zKv6!Jd5;%4*xA{|+)yaN!svCjMnlhUsKC`u7Z+Ar;O^_s*GdDY2U)(I3qv3A2{BEr z?BA9F1=Jp`W_&PMWi$-K`mKq#QvIVh9v3|hQR61v$Yi0dFMt zF_XCdabNv=q+g;WWKQJ(VRvAr|FeW`#~}nee>!!~OGNoskf!sUTU;Wta3Ez;Ieg8g zW*`@PXyDad?EC;rs6@VSn=DyNzQ6908XIf5RBwA&ut;4e<;M<=wF;Il)rZ2j#_o-W zk63Z2sae|Q!v2~;oql}8lz8ism|4lVdDmIxo@t?Eh7(|zgCiBQUp*+gu?6P$+aX`z z0sx$*(q>+jlDs;6Qb*U$0%f!Oi}NBa?j~fxK>?#(=jx`apKrTG+#cU3S0%5EOs$Tl zjD~Pa_?tZ6xrw{%_!@H0bDq?rI7Q6q-4U_-b4Tgi@K>+I!a}nv8~3agT~rp*sZPH#o<0J!k}s6I^3sw zJ7;c6CS@QwoY0$AvV3?lys{yFEs?vek+rVe=ax?6ws{jYio+rS27jx@Ho8$00fb4f z3Gg0gIj%Wy!3M~g!%shWAqp7_SvKd+&_f2vGeHIGg5ot4iH_p_9JdZcA*h+IS`6X< z0F6uja(OWlFy>wSA>`-yU*>hf+^CL!lqLRnfbgGk!`qb~J&Vr!(*XDG&mx* z-t{L2Gs4f-JwJ^!*MqVim_fM9E>Di0LHUCCBF(fVmMa{Cv7dPcQ;{+H0X_T@VtUlqSb^uO#DXjPX2XU96 zpCYcSLhk`1YJ%(0f7e92PyD3D>U=D#Z;u&8ja>uM2ji>uhET&T>KyV=4^77zmHE7F zAcjrkbGup83c$rjLh0_dd-C}1p~@_V@}@rK6dApgmXd25WY<(h^kdL^-T&}e_tM~N zR>B=i2|$J_Y2ddatf{~A2~T*QMtlJV9EBFx{%l%;#zI2a^=oKybNHJTmlDY9PiBTP zkA`;g>sPpwAN1$!3MOBiMQMcdGg`Oz3o|@aekpQ%>840xMgDwvGO)OvpP))xO-$PQ zE@D92EM8WgiSciNL$Ae{hD!W9JM<`F( zY%(e0N~?YN>z5LMO43nU+RSRf?IAqlgt`pW}^nTeAvo20vXGjeZffZ~m@)LEgnO$t=U> z#ayk)j+`83s}=`#b<;wKXIxm|>G~q1qgfBp;XH(}a0qXMcXnCMpXP1!K{;tXB3W0< zAeaNI6p?0|L{a~Helt|hOsseeQ!u49`<#!; zOx@8e{qOJ35`!(A{VJ7hhD|#Kdm5%hreE=kD=paMNB%tNRx>y7C*w z0jC8()p?^nHClX01OyN!6?iPinWcwQ_7yqf$`_`e zD7YEr+WV#sA`&~@g|P=n%RT$*uPnDrMF<|YF34x$(Mtf@&G8DXCk*m@$e!pw8g{63 zrvKTj!|x~DDX1I(RsJdovwfU;?S2T;8`MRVNC3ft{3cSNsaQcPnGwt{kG_hiq*S4LhslgzAPga{4E{wPL8__$O+A`_93Fg zHk!OeI^JirT4M=&TqBI5fy|uWv9UGxscVzU?{p!6mdN+ZRu|pE-<4o`YmHqCypkoV zKtSzdX^fD`kG|_T6{nDHWL&qlwp{N#G*I^sFWu{ZTX)9?r>9s25cYUOjoz7)QWnIg z*0G)P&ixZoYx{{xwIE2=JHqiHS0|avW?>vYDYe507Uk_c z+~EkR#^(X#P02r6{lfZ~fnWl$TK3@p2s~l8gK(BkpUg6+)ZfB{tZY<9Ro-c8kg`YA^c+w9%o}}gY$$gGVvM(2!fL=TId=z+*Fq+?MUAGp|X;R9ozyKci1J1FF;ihtv^Bt>cTa#DUw&zIs+ zeR8ebF}dGhBtQ@*g~2P+ShnJk`Pt*rP=iRJf0RP6P}^(5uH0sw_k2cIf^!*UxN>s^ z{M)@mCVru}H-Nrwe$*@PDlqc@0Y%=tZweGZPYVnVNQV99bOD+=_^0Oo-)0UWcRw+Q z?H4)@&nQUDW$~#^&}4G}76Fapl)vsZG?vWNP?cn`u z(h~Q!Opy`|GB8%jkO)Zf()B+}g!(#wN-nkChDY+QcLfAHDi~VhUesl+yxt}0bOVS$ zmIi2zOB>pF`A?2;N+n(wi#-ai#xS0$&>gxrpo&j+k;EV_h_&buC+}OxO-Okv?0)}b zh7M6S?95oC`ekYANdQMa+C8!=+FSJx?BPzHks@;Dnnz5H8N}S;K7QPvpjiARJ&&zTI zqC|}{l`ZULe{iN{lu+iDXdlqO#|BV;ceK7E`YbZdxIJ>xP?+eddwa-{p&}uyMADL> zGLJIiS1oOwQYNRv7)*Kza||;-n3y#AI^ampEd;C3sW_49%Oc<9#KdbYJY%59S6V^O zB?@O8(GE?*zW1@A8FQ(;5Iid>%*x8DuHg|edZEDw<(66tQJVVd59%n1R#i)Zt^|h0YP5q%_Fg19l z`fc(ud*gEI+B(DyfOLE*+D0-Zjn}c_GzBtn9}n_km=HVCMfVW zZY%5GaMwpbNNu##xQ-#+z4ub&F^^y%F|TchGk_)wXZGgHXX18p1l~m+rYQZj;*%Eo8U{m(H`^gv1GtXB)rUvCH1^VywmtwDQ1@ znpqenU)QEh7YV=UZ19HkAeF|~Oz%YdAMW(@yMIV%)hQfX9{E6ohi%-$1iA`t+|r^m z0G8?R8Al3S_dS;RgWhDbL)D3LpUE#pQWi3u7HX2!jsF zb-7bF`W2{mfjpOYkL->-3OLx-WVY(F zNvCKa;UV(icFy5GszuD>avva76IS{s1XFHQ@&4ICcc8S!{BO%7YN|0%`sBv2u@Un7 z&#T!l-nFk^(8F?g-lfK|m*N`+bn-?)*o$Iw@2sAb)flt(g`Av_!>*CO*P=-G1app+ z+)vrY0BpV$VDTO-&K-SmduC-cmeU|*?(tX@9PNvQB<9BmhKLo@FATJ+@}I-Q=s*y! z?GWZE64B(+b{xKEa#zN758rx6gc`h|qeAWOZ!b3vEOPJVhu;#e zog=*dPK&d1?^_rgzpzH)^1!9~vGb~PgDh1S%B%&fwc05B5?Cr1X2r;tvf+hTPp=e{ zWN|!n)Iu$W)~IV3{=Svm_r-JfFExWVc1hQukzpBGow=#>i~E}Y{v^(;s}cX$*fGMM zHVc2#6{$+mH^~B93T|}{`L4IC&DQ4|u9XyZzMR~*?A@F+cSS#D(;yPX{|JpxD+;~i=A6@ z@h}fYCWKGLXElCWfFE~b<7Rlk%zL%p7~0<#5B{oY`HHS54-y@*d4xUU6U!s*K!d=| zjSstGtvg>~uxZ`AwmqD4jq${&L7rLR9nZc|Sm@rVTQPF?qL{ z7X6%ph>`smy7!-E)_M9T7%%wAWOW$7ddIiUQ_pi`YYZ-FEA5f@<$7@!eTTLs_@-J) za;Nj7i2G!IL5+cQV_5F~8tbgqxCOdN@D=U8i@rw&yL@FD-r@G|t&FBey!y?323o!; z!H$gp!ITw)MniO2ILK#S-{kIm$v5@QT)-Yh+M^dGE9$DTF+|fiRp~MSf2eKcqAqXtcU|7I)TEzobx%icj19Mw%7C`Wwn9)W za;5V{wvJJvyNwF#GBUIgQ{S(b3$Xps#VU*K^RK~KP4)!$N=^8>^-RSvKTw_$5DTD@ z$~e7CB4+bwdDlW-&d11Q-br{lsL=4U>B<+H9!R67;bo~n* z)IuFrmrJ-MQ5LdxNH_B1ejtm$XoEqVcMSh9${f)WIjF8yU{D?os9d10{EP9A!5b6a z1;eqf-DwrqrMcLrmR93yTT`H{pE@GK7dGhf5qRnfI_W!{g@`xnU%`5!qkq65UkCPi zF?oQsryAC0oT;(8z=|&{OI~^n^yeM85tv=uk38;()Qde02iI9Zm@Y2Y&&LFfX#{#Z zxJ$7w|EpF2NJl5la25vRatTsE*DY^CjvVQc7 z71h!SIc0d{WEoEs?weB(skls?AMvWJ!kDVlv((C8Y;_uNW8DI@r}Xv@G~Ws)3wsC! z8QU66P1z z5AK)~x`ulX>NB1gxQ=G~y((EpPHm4i08B#854Wf_B}gIV;M4+@zqF9SPF`8>;*NsI2avd&=5y7?%m!CS zXJZ!E5wY@H3R|KZPs9dD$cS@ zdCQ06E~OqiC!AAE?ex#1mIM%ib$+~F6tZfYN#~LbWi>!y!;tCVkx1V9HT_U;0j*`# zN(qoct?WplYD#?Y@!&4oX)h*-828?HxSHKYguwAHuz6b1UT^sI8@@03(_dYn3d82Us^+H3>}VXbTLlEc9Y^7@Cj zb{;RO15qnT@s(Ho3foPn-)WJ(zUVB-6=UO5zWj`RT)d^XFZaR{b87u<<~2<;2yUeB`{uBS`mBo?b#<2g*_pwiV9&C* z+)ZA8jihF{>U}?UdF`N^rLlD0`;`fFCCV>SqJj>nS>JX$y1l9?a8QElK$#%0vKsp(T- zk)JtkT#JvH)CqsHu(;SXEm$Wlcivi^?WxR}o!0jo%+`eh{uhq;HZ>T$)?AzA;?&IY z)%RVM)uHi`gHSE132J=PvUet_rW}ZXVhv=Lp2GhOqz#TAybi)(p8#+fgY(q)1H*@5 zrOO+r)L;-f^+WAmi+_j9=D|IFmf8%?jrvkRM8eHfGO=OiRbsk+#_?J-NmeQe#$iyn$<)Nux2;Z=D zfVAw1&|8D;Vcy+@p#156l2mPQ8(?-8azQAW>Zkad&%lhRK8W2XBfHq>=!0qbIEv(B zdjR!QY-wKjMjtqrS^zjw{~c9J1b*FJLBBlv`OUo*^{Z=t_X*y8=l@%C^u2HW_uj$( z8Apd`I$#}bXS|nl@Oi4?8xjDhv21tBA^h1Ye3zm6vFq=?-3jv(pNYOCo6pV_GFd=Q zqETgj?{s%xYJdLhlf3sffZ{a>@iTF+uGr29_X%G=$M&9jVE*u;(qD_tJ@ib!NA^g0 z8&dS^R~AJ#Z0qDq8E2C^9-0;q&s0R4bwXMc=sZa#2q`X)f2P(Q8!n)W2ha$10;PnNd-(PfzW>t5xi-UT!*e$28SEqu50?`i$M=W4L_v+T#Yc+hY4F zyR~a7hyQ3QCwj7+?-}3vGQQ)SDk4`=sq{QyH{trK{*+_7dFfi3pRx7>?aEkF&5$Wg zm)#4z>8}ahsCwy$jNxd*)qOliRh?B_`e=E-4F&udd~Znfh3EF}S=65UZEv(>$0y6C zICQXftxvwV`Au!SWb9&aC=C;XEp^&0GWp6z?(?0lJr>X~n^gDH;@@naDDU1B{`K`I z{*X?Q8JarrWERTG&t9{pA5!#!! z1LqM(Qzdk8**9i`AlIhC9C9Aq^6mao>>yr`Yb$B->14A#fnudeG3ynPV3dO0S<~$z zYQ0?KKX;LvM_)9*3-fI_`Tq0Ft)!4WuV1XS7<)56W-X-7z5o8u_n_{Ey5d=5or2@z z21W`JkIyY0;~`?MGa7DH`Z>EEqmIaTWAQVhIc_UgQ_lByueF@JFWKUr(!Q*^VveQE za_G$u?jP#&+HwSUO^X#AZ|*FVX<1Zg{+ZeBoI@6^3&&4{rIy;dYHFN?eY`$3%6ff5 zT~9{|`68Gx%4?Z`^=r3|7w87Nw#VUpLg$r{W?lUbQW+s6G1X~_ZIw2CViPm8_g&%8 zDTzECqx%J+KdwPA&AI>vZ?1%k@oBczWA&&LiB4$`rv#Y41 zk!HYPpo6cB=$8Tl4Gl+H1dG}LdG+6OUE`}%DEJF zr$L{NTALAeS%Bk@_D4*dXM0wHC;}fO zB@r|x*9JMCP7`XJ4y$WC1bMIxYYfP&K}9#fb=3tLYs4rT{mCY^jowu%p_R^I#c3Pa z+^^n%8y5HHl?>I}(fqXM7dJVzIkPB#WzXd_DX)ws>Pl37XZhlm=lVkE2b0hR(|&B3 zjq!Ks1{~+ux~aChu8nC=c-G8={r6#7kppK_y{6blXidurU^w^L%wjarQ+5_`$eu(}Q3^txM*aVrS`k z7~g}PyTW`XLU|C5wCXuIH#FU3m4(oRr!L5>P$k948+!*If z`8WM#aZ;>y_QhCT&b((xpDK$MfAcW?ik@Y%FC>RweD0hl-3;o6J!*GvGtq z#6oj{S7Q-)wp>wBifkv4LYy&!ys3^HG_`LGmaN6b*siYEUcfjCE*xHfxl7JO`lTp1 zsm71Tjd)u|G)LHOzcaF@-S{*!zpA%5u}4bX*lL*4)kE4H8zIN2f1QTgy5_^_Qg%F& zq>m7nvMMrROtl6dvx4ahBKzfucdk1bgtJG~^pd=$t=d3w(K1J5GS~3y1BqTwkcWyc zCh)^%-bT?^d@~xapAeHZ=AJEj={{$y({QFOXwoQ&2A#H)ti0>04T`Ie?SCBtTnJ$F4g>PjD$x*`?%4=2=v)2POyjELQ_)UU~QMhj~#AF?YcA93|+$)xmYhfm*fv+mn}e9Ma{F2jsc zgE2mu0PDLw;}uF9Ltxi}s@c(AmMJ!%LlUK&i9E*)!m`(N6R!A-DOM*VBdy!2*hf&_ z>I``>=9u)xuOpO~2^%Tf zc$nVV%o=fhR->bKO_EJ#(l@lLhoYRZfu)D&OXLHU&) zgB4Bf?#f7DKB((`S*J5~Qpl^n*uaXn<+B^!JW(?&=I9C^h_p34V42Mv6}BUlFl}9o zY54xP86KupglaIKl0VZrz8uXUhEjYIyJaBUOF?a6>I={5vo()>hAK$JP^+fk!~#f! zYXdf~x9L!ti!>goXbL+n(l6`a49mHoB#wI1PHY@#X;~rM>Rs^@n^x`Av!-VmOZy7h zzby>&c_(xi5Vjp|ajHxK-o@5oO5t!Tlh4?c7Av&?+kRm zH|{ROe%ZqXU zP?DlZ@#0zZ8Lu|%VF^*J*qfTP3>&Fq#VFfkHzI0CHEvoAYxd?4dfq*fB@C3%Fr7N; zD;*wh@Ob89H9iT;^Z zDniL3StnBjgQd)Kvw6DV7HhtISTB&$RZiEq=(N%6+JUq8Ru#oP}gv`xf zQH(nSRBqQp@?%5PIC92kI6j4t^Oy^ftrbb@d%K#Vr}jp&Cv`&dly|p|wVHW`P>0b< z#||jmDpy@?NlZCMx%KnL@zVtL#TUsxetx3uzH#T*&s&PU1I}Ik?*n#j#ea$W@X}o! zH>l&3e^TqbRa!{L++$0Bvyj4uVYA`E$P#uRo+cXZv3e=YW8S}PH90(|vf_sEZZj$+ zIZ-u=LMf%h;i6oiSL|)2Z(jK!kia;1{(N7yC}3GCQXD@NM!aS;ekR3X-{*dC;~M|z z4|}DbEHD+f8n%d%dwpZ~Mb!NNVh_mkh;+HQk4gfp;fkH$5J$2emr))y%@RqH!S%u~23&;+oqCnUxC)6yku5P`w zd)2ShRjS3PbW>DV#EZUR-V1Kjo0IQ$H_6lxlN_|T+ovXgK!Li`|Ge{`ouXD$%n0_X z+KQUkZpYZV8)-P+*o{@(BxdygBxe_6)=+V=;d-9)ccztJetxv{#WzSp11w(Sw0*5`%J(4#??okn`!s=FTVQk z13uk}{}=AVm_;d(dp6mn*tDegXibj66NTj-T!zEeF$a~0U;BG-*Pd=seOFe!#C{?tEG)?dVT505_i z!TFFA;fD)DF~t&--ObzPXE+ZKcX^Avw@gZkGhnp3+4TS z5SdVPDYWgXw4D)Dwh+d|oyeH^s@jP+0U@Op?wZGz3O5X&evpI)TH;P=#-Wa+J&$m^RDkc z7xz9SK5g#;vfude+}1G*jkiu}CZ7nMZVH{d;~Fkqoz`-SxljkGF{CbHu-0XVagA(; z2N1N(@wk{Eu|OTw)LCzP>PT64PO)_Q-5htR1ajpuSJG-j3yoh>7ck6U8XB3M!oy@> z%XPOjZ94s@-ic7QhBanK$(q)M%ITaClB!@7X2~R-XKXgZeDP)}CnpRKb7@mFN55vM zWJD}yVYn$eb6)3kX}s?F`-j?_HHO~_u}s$9s`rMXeFm}^L(I56>9AF zI#WVT(17ughrvxmZ5^D%&n~hXotqmAWMA41q`lFD?DOYUQXS|l$+((UBSAgxZ`{H2 zCqtrc^S7UQ(0=tR-!kd%dMEFZuFzUibOUWS{**dBY&pdP{15r*-9Ai z=E@g}I~r{Ml+p|SneU0sm{lc}EuVJ?7FT}4f;(lC@28ul4n#!iEj^fs1H>ZBXpW$u ziuK?E|6|51e?LmU>UfrE*}k;Y4zYaHAG_)uJ-HN9Toh$^lb#BGo2m4Oa5KvTD9)*6G?q1hT~3!sF;q4h|8thN5Kr2HXseW64;CNIt-ls6HDjnx%99-eop)w$shCdP z_G9o#d~M07-sIL9>%f|9cv<94=rh*6-mRImX0o*O5s#>#sa$-e9I4rw9{{h~i=*sz zP-EHGe*Kw6elwkJn)rKF@jnh#40Uc-aDSYz`M7e&%M)od{#Jx#la}k`p?U71LvZs$ zw-}-F*V8aZ*U%nQHJh{5BoN?L+{qpLnCR)p%)WKJGx@nqr?_3%@~j_fCcBkjU}|*C zcRSLv>4$L`B3AjpBds)R()AZZ4i9Q1svd*0Vc))ydD)^onO4W0N`0`OHvM2TWWjD_ zel!*xmAdYk92;JPEPUt^(!+!}T;WzJ<%(fa2B&o@Z|AhIX79U`y0u9!Mg~Kd-c|im zeXDp=AO#_AG89AK_9Rb3QuiIr)2t5${Yw!^zdOzYI6s0H^kN-mD84$6zyTjMP}Sm%v4# zUF_;fP_@a&36T|NNO(i{vOaB}w<1GQqB?{8X7z}B%6`RqKbIP@;Q5fBU9Uz+6!Id3$?;#n?S;(1|W3FDHy&#+AjL}T@s^aW6(tFzF6Twb(lfq=T zCcnZ1F=HP7#S5L!esorO&}4HvB)d?wYsfR%%`?$s9YW1lB>R6~ zZASfZ(%@plXw}n?O9?AIzC_Q6s&}UePT-Ckss)pcPs7JifAjxgdD4rM9&h9Oq1Nv^ ziJ-;^LSf+OD`p)|o1_w}7xtre*btx7JAPW2R9#GgRC{7mNi^1L2f@XIu$!lB8*CFi z5npv|-R)o;ZKO(SsH!Wkl}ks!vfyRT&E%NQ?@2bR6YowGR(CF+HN$EzOVB2%vWO%X zMc*NJo!oTd8Mi_?_u`57~ z)BE(Yse9DarPTXw!}!@jiOc#BwXcV+c@;ii9Il{S@N9l2B6`JzEhK z;yPTYr+&7kGcE`X@gGHcoD2k`p~E4fhd^dkbz{;)?BDDt?}8^yNVw*QjhI*^flh@| z(YkgWek0JV__muz=Sdx-wU|lgXLwLka=}R5I^7q!4Kes-a(iVfWojh1TrJF#zRk0ueY+M1rk)ZlBC9^m)E&w*n8oEppL>NSQ-0M`x>57gfEcsl`7ZrWF@O6%W69*aT2f;$b3-@2HRp#o{Q@PrI4IZC8?H$L3AVc;axLo!EZNY}ynqv_Aw zOr6P(WPr6u&NwFbeZJ7#s1^K*infotG&3Hfe?&1KpaqwXqY1@d1_y)M~D+ zwvS~>%q;Ul*?6ZtuntP642o=|y65oq-Fe=znYe+r{xa;S8n`PVM^YLpRq)kN#WFGK zJr|FHM5n|GnD@TM7T0f9Afak1tSe?W;CDlNF2J_; z`t{N8`+T<>hCRk6MRwb{Kl`V~GR;;Xs&gqoFU7%lXM!@$b_wBnyJtc}E}nPaEhc=Y zWCVzxsCjjBTE8Wx9tYuIH=@saCh>((Ot4$M9l#| zt&}N=)TyjlgATKB$V+?wchhO(QltE>2D$6e(b1ZIwfX46-7|fZ0fb)Ad09F5ff!M@ zEyG1lh2h>`oNp{&IT8F#*3A51*|puJ|5YbvV{`iDv67A5Fa6Q}K!xFd-S~mAMx|M^ z7d|bXwvh(738-Yd!3&NxAB?+j|ICP-VZG6(Ho5uDn4wCqfC=kYfP>Mx| zb)c&Y*K5xxE;hjO39Mf)EZ?!VeXH3=r<7f0DjTKZn7HdxMuXfgI%{}MM zGT|x@XV8E!41LglSa(C0`lMy0kT*+iJxxwf+booz4BKry95gQ5S4T9e12+%WU8G4B zJ0jgsyP4!Wi1H^*L)4Eb$|Q-Ex*zpy>=BGC(Y#G(T<}Yte|_Pr;FCN?v)ApJ+VI=@ z?T#-GD{~>ne&mUOH-|hcx6_i0oA7#HesQPd{?24ld(6c!#&r#Of&EOSE~MYo)-^Li z?6_HRHr=%Ojp_rs%93>dYh1Ir-nN# z#8e`#DBNDdu5^vAK3FYZVFs#t7wqK&?N~l{^qh?VzBL%AWJHgL8B@S3G>*Q^{Y*X7z?AxOptQ^cxsf{%udzeQr zQHy%}_C@nKbA6^*T)LAnFRkQyZ_N;AfNX{yE^>WEr<8%yFjA4RlCUWwmEK z9#Bng+rIeT$K&>H8=~~8q97$;lwP-60qI8R1Q3v3V(2a4)}vB`iWI3zq(~JA5NcFN zBHhq?G@%EGp@ou=_fb6e-ZSnw_nrG6Z@m8)?_>;3g!rws=9+8H`I~LEEcKw}up%F9Nl8R4MlM&nv(yi21@?GyXJn+p{bnq$hNvVz?E z=K%4RzP}vP*rA4Ixs{-w(pA+RHIW`e9Cp>tgJd zZ|0%JluWGW#N21XB*a#O+#LC7gQ4tyvKZFFzPn^{@OBg zbz{9Kf!tcZ!^sYHGu6a!@A3vfTywoNF<641)|h%IJFvvE{NpJ2Yl}$^Ra;G`X!0HS zx^c{P*+^-Iu*zaW3{{pSX>O3VqRzNu??*V}bl1nwEUC%0 z(}KPB{wn3cF)4%{`Fx31?^{11f3gEH;88MBMp*Ew(}ivr?9(;M8`rJ+X!pb zews0z2`um8M#o2dAuF_;?uU_4Dn_cJd=jf8=M>$lZchfeT8CeCxuHJ7CU4f{suJGK z4~=OeV;qk0k4}Bi((W!@bn4fc(@Z9;Mmv$?-^9}Q9m~moC)zM}Xqf{WUoCy1vsH}p=A#^bgLwv0(Pa#ueI6Ml zOGSTXjbp>NYUuq>O>pDv4GVSo8QM&er?^E+W3C4IL%exB`PXJLj3FO;CNv<1oGMbr zASvyH+vj3yX@PdfHOYf38ou@hYL zviz&+myD6#!4<4=|5{gu;yHZ7=H~`#Nx|X;-Qc0k6hg{4GG=_Bn>N$oPI2t}l1}dM z%=+AaWxB!K%#3QcA{kw+CM=-4SY?au?7vbGz)`PO+O+xJJ~26x>ds!^!cc2K07}LYoAlzJ&vZ1pX%j6XQPrsrR^dZ>EV^=fMT1FM@1-c zhL~CATE0`6y4d>gWD2p^p)qx5u`gAz@|wKYdi&7ZZGJdT(ne=pC0DE1ZG1LjK(pMz z{8rqgXLGV3Uenc<2k4+3a-v8#!2lNJR~Llb^@A0Dp_cH6Wnu2fMw#DiHJ89~w+4Fk zgyy&_B4e$yV{hYY$lvOO7LIEg&R#R8spbD2^ZnZOM*J>&{H5YE}T&> zLS4U zk)P1RDqYyw4?{U2Q!yVf!Rt%KB4#R4)%|+#PG?>1nvxrj0O8x zw|_o@zpafkLam8!x2P!DqCc$3#T+iFxz?QIOVwCuOLWZgH8OVhidf(;H_5Nv9)9f* zYZ=5iLm9hnJ(=8FM|>$s!mmQlfx&*(6&b6DZNxzN*^A}Gt?Yi6`SqmwuUG_=lgO;l{fWFC%@b)*Pv;OP(qq$C>zn4kfMdb4w9Q-ZG_w z(5T%MreYN*Ji1r`YoW&OOKv8yTs(F8m^^FuQVFBTlM>!O5J}yG| z1+SbaZ?~Stj)x zlykP{Yt-zugn1Y0b(s!j8csAPp9JR8g;C$n=d5PSLkaGqXF^>G?__jNXljfu^;VX* z2Eux;p6o#O<~1fnm6r76I9bJs_`-!Sx>E?lfiVZ{Y*@!uZTZSgJ8HWF3)QVTyz$NI z9Rk-yA01!rTwMx(x+6JC7y|cdhg84bFx+?!d^-G?J(*gNg7Tr8D4Ptr#=3VzUan1;0s=x$MCi z2(%*nC4zqYcrD`AaiJ{_!?tBP>|A?D%eznfB0k3_qtOhit@b_PNbR@B9+wp$YIRCmd4wWT zC3xo4#B-6}MifoMitw;+7XHpy18|0KyxTX@EQTxLW@XoNXs?yXMPs^x(^?l{&9dXD z?%W!@?O+C%T1ldr`E3v*x-@gST~yQGZZ&eL9ZD})XrDo`LpXG0rA^1cK<{vG(<^JZ z4MO(T4eZV#$KTi=!Rm7Y+caJ$)2$cfq5fO8J9l_cZw-o5w&k(Qd}}>eC$AA`T$$D9 z4LQ43>lNvAm8+htn+lDh{m{rn?uu;B%}G86#9RO*$X#PMsP#+U;oed9nKBu)qxJAc z@Xo*vy)VD@YlR#o{*TCb&#d%}$U-y1kgP@dh+-gVE2Wl9>HAiL8-7IU;&qZ}6n@lQ z2YO;+#A}ViW5+K6lfC%F9^obw`LPOo_d^w&bj*qoo`yeKn;>Tt2y_nGU=o~5>{Z@N- zq=Z+9FH;(!R#)^>-;cQ!d~07+;O*bT@0Q-{M6L{;Iyw}{C~>L^|5@BeMY>3#nds+1S?e<1OFqs7<$~r#ovAjqsthNoB&0zoZd9I8Al3*mHRCtHX zrLB;^g+nfmpu1tMrS;ygA~WY;1Y1`qXTnshRPCZBt0}=(blCzuGEJ}V?75b7Q7ikZ zY~07q9Q`XhJHZO}rqN^_>AdH~At3z|d3X=qev3*%uE4(d-%G(v_Dv+`rtb)81dVEK zLDerkY22|g|2LVK9)-FVBCtY{+6R`7l>tCt>K0G=fT&O0x$B}?YU8WhmeLGEh&;?T z_tO<`k2n+0i%Idqr_1jBoT;ER`$GER%Y`Ay0sTSy9Z19ScZ`1@8PWMC^BvqL>FXCy z^mLzP{^}9BE9Jid5is_jaXAVU1{)*y3zGt1?x9AMC(#pbVSQQnzKMFe!69?f8My}T z+Hfm$jAG^st8HYtPT+QJ4`{2S-uwD?3s3Dsm@m_&Boo#_M}%*8<}5J32Q&Mbv`WFbj^_iuaTvZ!AU{E68@qo0a8o7 zTw{{wo)6{2X_S|#y8lOFdAHpW-0cvnrPly7z--wDSlDZK`ZxycAyS0$hHy*1(8HDZR=(T+5$vs@N;7wYXTGMuFea*7>kT5SudtTV8l{bY=QyoL5) zpYPo8rRPWROWRp|O4uu4dufk}izjKB9I*;gt%XOYdMTranJ2Wgl5mVo$YFKPgoX^0 zsp5*IX(D(87brOW$RUvwtQw*Sqc=@6V|))M-qzDRMHnyo7~d@x?>Aj681dM_$oTH5x>l)(MqqZ9b!d{>&Is+{ zY>J_7VC$CDO9X#{ZG?_G(;=d~U`@5$Y~)gQru4t*bi~yhSr87RRehcNUS!uAFZI^z z`&ICH&=^;lVEV#)1hdfAdR{Vtk=5w5l)nU;9?a+-QgT`y+;o`}plTDsD`VE2DC<_Y zyyx@jUGliioQX+E804OTouq&x#LfN=@^+_Q(>x zm`Q$%4M-SUGM!O28(G>qanzJ_G|n5Vzux*5tl1PS=4npISS;mTiy#|q?HO6G2mDpe zTL6AtTHjDTV!*`JK-~awZ zYt=DMPq0K4ADHefENpJTizl=vnBO4suszKcTv^&{PPO5l;8gyrGdy>5Xn(3v$uv&L zzWs-ld{T98#3SZYsI2K9<%y$3QrOQrQkf%(bjv3G#HOO5E^eo( zkfQ|`-9d1>UF*X-vVLg0Z1XJHeY;dNQ4^se(zp_%%)kI{ha$T;XlD%u;e|HxxnC6k zg~i{De97tLxJqqZn1awl0(GnV6-PnK*`C%`72aCTGc$jdHi<>38ONB|N60TVFvpa4 zo*kmhf4k#*J!aHfsCN8a7rYQX?&&`UpU5_8wWHV6FU6@P&Sj7!+O^~r%@a!0?n!(Z z%qE0sO+UIa;}ultMham;_nlu6>jK56J*Vd(*l6J(C>jgHYN{5Ea+UFpuDLyjS=_!o zp7SY+jrXiI+qt5s>c8TasECaa6NxFsx;jk8kT?E+K+a)rmtk%pb|lnTnKcdcMvcM==%YP2)Q z@{8It3v%=o_K)2L#xy?**hA*M-Q>a#J?;xwN;K!@@7nNu7Nw_mJ-TF6v76f{4LzY8 zs5Mo*F>YO(@3eJ9jQk2sUmB;Ao^PJN34e;9!15P)gwx&{TqK6aBFGDoW1Ka%n}k`@ zT;+=U&TvvCOt%i-V_%vK7?g8jSHmN-D*+mZ4#T34x}5RjebdzCtX$vOu=WFX^mIr zF;LdjY_53g(v)N8eX0gOma|p4<*ZK^Rk^)DoS&%y&$UBQ50ac#SYbGx&fb9Cy16a9 zp4z>SMPM;9eav=JBDR&>T97XSEZP<*^ie&jdV=xOg7;MzRZ z3yPhQpKRko7@N>bv*YzUyqj86yt+?WJ0khck!MWU(@olpO7eWYPrNj{PtvM6CscZ8 zrOmb0yvV+kXU=|s(4b5sQF+;(UDWaVtawOm^B1XVwY(s&?0&N}7*YD<(0U5sfOD7U zW9!8kJ~eGV#LyD7pRtxEC`#D!G**8e-0HE`8FZ41{W*vwW=vCL9|6mzDN$mJ8_tvr zCX6R~%ewd6dqep8hpt^rcx{Q(!gx)Xd8GSk;Xo~L;K+OVVZw{l47tLN@g=e`{5NcE zK;HBy1BqQgyDYhy?rg5m@8^EF8~?6+1VWAn1CS|j43w7g@JBMJZ3k{Yx#B=^ z{OZiA%yD?+ww7)OZx!YsJbS}v>2ww1OGkU0YFDzlXx=u@9Xq+hOI{2|NPsmaLL%JO zt+_qEDileD$;hhHvVvhA%L3ZD~9-V{_29xQ$6@{p!Z-K&iZdyw7QAIqY}xD2G7U9jHHbw00%$ZF5s=_qRVVw9NK3=Vxa;XT#yFRRe>>YoN-)GG!*9x_w!EKV4vlP1d_KC617vx8 z+w|u5cQ2b=Zl4lc+)LYeke&Svu16Ymyixi~ue|C~M0mz_*&mzOcKfxIp?s%a=m(eS zR04U+vl9CzL6|GWegz6R7*1H@&4)=Xz1Z69h%e&A!jH@4WGN$*>cylW(GU&I?h#HW zauwTrGYoN}VOm{k@XE*npTxa@r1b6~5bsfaDm-W{^0j`v7iYtLGpIkKV2r_?R2@6s zz0c0sK8rc%k1<65q$$6En0e{gLCub(S@Syhs($t6L=i{qiDiwIFy;%4;}GVONkop3 z()_D_`(N-EfiCj8R|&^s1Z*#qW=Z-1dFdu&;E~A~DHy@q)m|gN%e2y? zG?2@=3_o^#NZO}~mW7%B{#fK=nuctDVLo8IYbEW)&{n0w6lGO59?XXIz7MAK{t5<_ zcujW1xs$?qV8?4!k!oMx@+qrQjpIcGTp6mGr2@;wajd{lo`;eNb0lPJP!GLPHi{rI zrOHb@M8{g>O{VvfkghbF-(Go_W2c#Ic34fM#@(I4OWjK6_08jvnM$3Jb>D>Ce_osC zTmRUSniZeETi^_yEyip&GMCkNp;F}z@lj6qwS0oGTm%p4g4V__Ck#*!`odT@3-@t` zKqqj-v}vtB78Erh`Rg`-1FcIhC#wbFn>d3q;Lz2uyq@lgg*D7l>aJ%ah1?61!sih@ ze-Gax3lkYYt?2;Na*@EV@x4WP1Fc5JjfISz6;Sly!d2$ul(L(+9BV-7iayO|-!LtDy9_8t=2NTf6$`S~v70M0yGq;#}A0E*zTzuTkE>hv^pGcTU-gukF{=_wb1}cPXFU zYJ9fac);?s;g2dKP}+}jlY?T6NwX4-z0#u(6<(`flo?-9l$d-1z9Uumj-~*oSn}F` zNKASE+g=ewdxMGN=UQDHoxlM0H~74`bK{<&y!ThqUikmnrC5lV?nV1O*t_?0p5pxq znX$bJnfrgQLT0*4`fZ6-rHhWcdm_`fy7aN+>cPFZ1_?i!6Xa@N{m*R~9yAnIN&HR6 zg4ci3)Z%|sT(KWJ__4VEBlR2q8Ui5i>(`;J@@hZ>1kb(#d6iFVFLbZu3fG48=!@#9 zk&?QkwX$tG5Um`q)XJV!yL6`U=jIwMw-4`~hZT?0!gYZOB4KQME;cM%+4=4O>$?63 z-ncO#mQ~|*#wa%Syo+&cIc!`oB{Rgc!7e#|pDACP{}+d%C&8j8d}V0uYok+sU^dPy zvf;uLSC*groY0X>ppiv&M6BD;*&INMY-|kw4F7icx|6@+y^s1ii^jSH_z^FDPk9hB zCzZb!-z3a{hMJERp53p$x#d(ikk#{YuTCT9lbg{%Y^g>a!H&%+asz_9(815?k-Uhb zPl!NF1v@UF>%|3L$4NL2ZJ$AXn@`ss1P#Q!ATnAYx_0)j@9+1G_&_$@c0j*yYr>Vn zzf53bL8B!CbFRGj!DccL7%c{Rrf4CXc9=u&rd|fKTM3k0aBt4smfDR$<4$t@jBNCy zu22~s9%<>}#Rkk`l)Y{oLQ;fHDoC~LQLUb>3n_*y>y7zMLg1MXx%T+~xA+30^dx;jWn76Ux9FKB{a*bU0$PZAU=a4!_~=TR5R{s;x` zpWG(Hm-|k@1G^E9+1G*lX~o2KLk8@>C{lIOQ$=7}VI=izQx)bMC-|IsoPwfT%G&<_ zeD5E6bqTxCG6btRMAz7#jS`EoCa9)6+pY|Y zkJLn`?hN?B?WZ309qVq1`ju0vxMxHHaJ9PL zD{6c1w)Zog;g_V-lMM}~Rpg!9S_Kopr(baJo9%M(|` zJ80z78mA9P3B3Bnf?`GP=B~IyvIR`xSE9iYZ>YsNZ{J>cCE#N4xHba93&j>l12ajd z$^?826RzqE6W$#g7&EszqzqN6%-DFBoHueO?KV&%ce@;buj;8)G@@)(S%;vTQFi~KHs!m$)kCAW=>kGrR?s}_!Cs2zB z;v@KdLeLBc(mOzZY$9lsum1f=A09!TUa3ylTItW!cVxHIqFLry?5e`Herh4)svj#y z783#4eX=4zf`<%Mk93CW9x1-68hEeR>Dt1V=yyOyRrzT0c_2A5`SE4z1%v~0`&od~ zLufSueOV`Mr={a~#2ilrF=o%YDj4lSri4Q1I76{_J&q5D>2_4et(YuRBf?-;I` zD?`$<;j>?7FE8VVHe2c|n);IAZ6A6a>uDk}l%3#!hV(Vrlcn~+Zp!UHUe&<%yB)xw zd&}4x*?WSz%SXx1W}YVf^}^hyYm+u~NC>33k}d*y5s;hxdo61ni%fD1Z%_)SA35k9 zWx3q2yj+kf1j?bn2D(FU7ZD7bQEr*>jtRAg-(8y9VmqRe z&NoHSa5#Y*00;+Ocfb9GSnwneKGe^^JqpSet~ck}!cTBAII@LsnJ1BvwqMjj*BAJK zZUyc_wYV6F;_@2|<+0a68F70x0T!*RC6i#TmchwZUwjX>eaFzAAuM@nhi^_cf-y3J zHNEa|0#-E2^JLk-mBhzh<2atsipwNFqjn`sv@+Hf)&?=FpFxheiWo0V zH>1-!sL+_0oNEw0d9N2BT`Tp#fmS%~y-AMScq!3|v{X)*?sV#*))1`nPsR|3FYODa zu|y69BnRbR_I#JTL{WaC1-)?N1kkd zikr<@FTcKw&{!Xm0jjaYeAFso$4#H@XRsD1{L`W?`h83Q$necf$_;99uOdEyE#9;_ zonCyz<0-&eKssEdWyq8ZePHp#+= zhlbVq$1>7+{72b7P}u*Y{{sjipeTzxIa=}@#BJX5-r?oTmn}+X#P4a`T1hKG-+q~t zq&~$CBnNzQTk)(P_8`)0sP_yWb9476Y^}vQ z;^X*%!5gNMZDd_Kr4p8xt^POWl75|(!0{w93simq(1O~Z+!P4xo4@VzJI9{x*ws$E zN^Wmv5rn;WK$Xi-|3aL$=y|Jb?soeHhuM~F>zzEw;MP+Aw@Mi&W35~lHx{b zFV=orybqioK!_g$MCpMz-91_dDw#n+D3!~!iJNpMTb>4JasHpB#jUZk$uP^8z%0;n z`sF?PMif+nW?Sg%>5|&%G_b>`mQ-cY=a z_V?x8|37*J{0n0OLh%2RL%<0sp2-n+%%@ICL}=^&asI8l$3^_jGRC~u7KTN?>=a;R z85%1lH5nD|iu=IsfwOf&ERUs0p}K94m|*=`kK6kaJiwSQz5%I=!?`Y=p(-)uv+7{C zjyJG~!8PG)v%X$f-2e}wsr%K|E+?1*&B5;sG2-=%V58T$braA|<@)L%xOCRe$g zdTkle$-|h#)twL|X9Og94fNNijqg4!5N)mU%1A_%Hm!EWnNCcFosWq{ zK?W+%7L_$PE(hR-Hd;oVzF*&sC~yENa+#vrLHfrY?$7!CWh!C91~4j^@A#O(168N~ zO7pV+snaU_#$LYo>}B8I{M90E4W!iU=a-+~?>l)8fEoKq=2xAVPs?zEWsyJ*OfyHdoP5-?=N|5!$LZ|wW%q$Y3b3_)8^T+?#24;Apv^xJh)OHl%c)>*mumFF ze}E;@4(LnnBA#VDbX0_4U8EwP zyIaPU{Oa<^pS=0=kE?^KrA2vM7a|>wcZc%k0ie16&XeRDZ<*c(9`7FU0C?&oTN;33>FK1nyi4HYvb-FsJ{mfT9PV^h+LB zgU1TqBl1cJCY`XW%M}JJ#l(#>Qqx~6s{A9^xJ`G7&;lwJPaE7huqU2fl!&XgfNp&G zNTfGzHoMudHV2fw>&wA+cZ({3`1cQBXNSIQ9Z*tfJj$n~$rAnbe_|`W;M9?h){w<$ zoU~y);`>5v;Zs(mmR4&Q=_y?D0V01gZ2%XJ$e*~Q6rZ5Eb&2{%TFrEtC;l(L&aoRL z42^aX-aj-Bv`W-njCplzUI6ay{_bg+Ud<>lC2_b78x_AS{OW~erCDXv9FS~N?5ep4 zL_62(&l(SvXb(Uf9&O;-tPZO6q^Q9+7y8PT#jzV-a}E=K$ju0zzYuRWoR-5XspM>K z(bJJu7KNQn<=UfB%N(RQ-OAF<1~rgC73pjpGjPT&F(6mJdj7Ov@oDg8<~Ja+2!#H3 zUoykh;|S`W=)JlTU7Y`ug5=)MA7mc}JV;rXDdNWa2D63x)BSMkvMgeyD-HAg;kZ)? zAFs&-BJ$;wPE~AkX_K5t!}h{Z)rG<5!DoFU7b>Hw0uy3OH$8<0u5M1)MaCPLj47H+ zhN=BRs)#y#V{d?;l23r@2|nq?d{ZX#N`)->X*{PX{DK{ z)E>d)~RP{t&3smWiW8Ieu(6MWS#CYVD>A(MlQ4t^ZlEv zO8*sE*yoFX(cxco*r&k%2RiV?{#}dPYX7mHN7rBs+%u@ryLo@e>Sw&nExpm9xtB$b zUs)W}1orj>hW?O+x}&##5PDPqOz-Scpno*oYP)6YgjRh1k|5V1Sfu;}$X=sPXjIOa zR=BmF)cFA#uOB0p7s*e<(p?%v8owc7;w@+r`Yt^`%3`F_mAAaMBOpVd50pNIjSkGY|pi~98I5%%!7iu%_sjW)9;((XL~ zu!tJx_1ag%h^1FQ7bZK(4~*D7T@Xp<2^XT2Zn#4O3?N+G<6O<%bxIR5KAfzR>guX_ z2fgeqNo%p4O2#@gEzag{VUd~A%S_FzjsR;jf|z4=(_@JG+>-Lzr}P{kxZu-BMq{?- ztRPF$~|alQcSZ3 z(ug>5_8ke2-3@XVn#}y8$-$IOh%|G;pxYR!(u#;E>P|i=Y5mDe4=mt0H%ffxeI-px zdZJ6=Ee}3Sv>WL*rks`s+TZD7+K6_MORHPuA<85qZmyz4+04QW^H!a3Vvcrs z0Y=&TkNI=!1wKXsN=U%B(=s;MtZFJzu50u@J2wwlY|Id~%tdNj%xkWYiQIUx9KM&hP%Uxww}8`Orb^pZ9uK{R`#YW)j zl}1&8DcJbM#$Ls_8T8h!S-99++54KjlDatDa!?-S`EXTtQH>6HKc&^ey)9qsU)%^83v zILdVcfaVrf@~{DU%`Cd!KFVV8zJNP5BU$Gckffm!UQSNR450?PS7fx;pT zJB)5e!E3$}npF)U>5yQFb)0#y>DcA@C^xllFO)-D4BRP&0t!A{f{KziXO=zt3j@$T z<5Cl0v_|yd!U-N5FHXPdj`&)?nYW-@8oOs9B024@jc!0?$pN>>9Bkykm_@9U&C(fKvk`d;SigY;9D8%0CW=5?ylIt6L^WtQ6Te`;2>*qD`P7loyTE zR9iT+eNx8I=87r-qJ~h*xu@Ttc+T5;xVMZDcJVL~v3-rc2IIlog?aOqIGHnNa$}DD zh(85!p~?rc>O8{@L33PT_P&15`#oRyR9E9Lp)DVY3YyXRZ00Q)!|na(^ZSUf?P@Gu z`j|~imln$@Zo^%?OkTbVGd&2#=%O}O=eEgB{IBe6@X<;MF}ge9RzjB6A&Ni*Z8mq4 z7(6P96V=Ul&T2d(htV`1uho_bUm;@HIJD^gYRvQjaSt0|t;l?5k-tVV>Fz=h7aOJM;VI%N#Ca!$ygQ1=K{o@PfLbSMA6=2Dc- z;m5?c&Z^lmA>CX}<*$QbJ&o|W5C#s7<~6|yN~=!eUp=Akkg$uxqfRVD15wQ zv-n{^TmxzXIZ$GQ1CB^a^>6*7j4&XsyU$P|$}R4@Xg+L}Uak|qZ_Heuz_y4Dhxdqqx0*=!+9Uo3$&*A1 z8sj|$HB}u`fa>gD5%F5}l8#uvbcF9X4jxRygITYL;N^*J$1xiNRQrRg z!wODI#}RW#e}FMgBV|xqlv90_iX4e^CQB_G_pR*+dGUuRrUJJ7+mAN7-v|^+kElJD z5;wOtglGis`c4E_y}cYtThStlEn1b93g_5%AX8|TlA=k+Ei}JpqYoCaiyN#EHFE-; zWGsDoXs|aq&ct!Gz4!c4#e^kRZ{D)MSDMDLsTBK;j?VooiVtmDjHpgQ-HveTK6(m4VL;p*Ts_srvpr0W2Y)n;75o zWZB>S4Cn=9Ww9IioI~TZ6JC=iA+AY7N2t;J-tB{6#3?yDVO?5%q>u(V7yZUG)~)A4 z&Sd2r-FoD9R+slx{&zg(tYHRzR#!9@>?DeW1Tj^SBj!JLw@&`%6X#mJfvP;C^oyRD zYs-npUp-k+e$~dj&|90=fmv8y@LCrioT9?tb@cV*8su12j@6zspcS3pOm;n9yHn0L zvJ!u3gt5T)s@i!?OJb>R7qS?%=^f8|0zKn|99B*42$kDm&A&|*u|=_wjgEmZh&9hE{f>;^S0H%V_a;?4LBUGYEdI&d09z-$Lm>_Sy#^s9I+v!$iFl+KxJnd zvl*$1F9IU)U14qxBXxyPO;5d!v@Ke2Ku=_%)_O#_6U`{cs)3gyE7W>S5wvKDj8B7c z8Ko=f0aoR3g>xVfG+~CwT3V^4^w?U)MsvuaoXzwa!aG;Cq|4jIDJd^e(u6!2C7F$1 ze%bfTlf30rjeH`G9R4w@y@C{N zkzkh^gx~{eINN^C$n*u^;Vu+%jUo0V3i{OE{hc}gwun+2BNwxNA~5=!m|T>Gfp`l} z*H)O@xzg7{N7`^^xt;q?O%#V_Y8GJqP{%@6Qk7s$jvj@X|IIQN+T8f}R;cr1g#;jL zsj*(Scfl}^6`Oix>EqDCf-YINkz`lJ=RNohPJ0~I5~s#U04@o5X8(<-)MAhHvU%r- z?(hFAXjl~ewZIO5$pgUQa~rKTYFO!dxo?I2mq0Li%{KFrjx^|obcn{13N?dI1>|k- z{TSXC&w+pLjjiP?flzeH9TFe<%VNz-tX*T@k^UVCJqP7wsnz&o@u$=o0O%5cU%yrd z9AMWy+&KkYIJfrjn@jv6aWk$r3^#*a zD&Bkhk7y2-m^us^6M^fnh$-&PQq^(IU80;8nTWgohBo?Z!*9J+_qEPX?>^a*$J!I( zvgkTf$B3aqJTvwR=etx3u8-U*G`Xp_FYir7ac=h-nPrk-E!7(|+PeNO26?U)sg^T2 z9_$SrLC3ILa`J$daX)XjFzVkL@jtF_d7$YnHjU+$E2R`2bjrM?%k3jbun#al?zUnT zhn@b^X3x2}s7*xcX7j!8W;i{5*;jff$E4m+e?IqUSRnGHX@F%h--?GS$3F%8_1V%*f4H>PtY-L@+hfVkmJWkiI9JE%8jjBCw{0h%F1)B+ z9!`dnJ5l84TJ}6gc%~z+lD}aX(QF-m4dv3!=1sU`9$RmQu;xnRT;yruMA2RxG*T}B zGTm+>PSs=vTpPQ(89R&V{Rp0n`dA*sh+;^L3Gv1UYwCLv&mRTq<9>k*q1{!pQ^Wl- zA|@K?%NYaZ&3`;fB(bh7eDO7BQnK2~%;%zSGxyZ)PnOul(`xG-rYYWh>9kNcMbWC| z``>-$0=kbL&4FBVkavHT-kHiw&&F>u8czFJFP=K$vL%YSj?UQZ#>~9v$9y`l^F4F_ zg@XQtg7$gpr{DfXiGNYzf8rx>;s%ACj7yZoDlCbDmAzZ@5AaJ9ggyxP=Tpl$2nA{p z!a%}&s_cGHc7lHeUzz-B| z^Bu8MJ|A)A^&Oeefbh5mMibxKCjzmU!3m$LBK-SUkT@M<_8Ce;<;j>u>#kS}9k$Aj zf`oT>(RHEP?m&p8y5y4TR1W4{!KE0V+AGGjTXU&a@3oJshbH`RWflK{)NRp3976^7 zjKk+2D``U@kg-slJAAFTGUqk*gK}v1kFS~;g9TK2v*OwHt3%2Q@6S+jv<#7(7v00` z>U9%jIdNqsagbwx`;Rv}w$<;vwHHw>^zA`7<^4z?NviG!yn)UvxRj0zof~ciOIWwm zY&4}pEUhjero|;hj?Z1fX|Cc zXw!>1XEhUQrSnmCJC}Xu3e0Om_J3IjeRR({s$l7Zs~SM74r`|Y0UqpN=f z9^_e0x!ib_>!p!0Pu9c5V%9a(bn?8p-GRH1Rn1h!>kw)#-C3E({d)Ew#jfQ=z2|o3 zPF_QL^>1sZ_7KHxJOPL$6s9|=?|uYKu?krkn`#+-ef^%=I_JN2uz9*dEU@2#v=xN| z=tTIgQ9JMzcXE{BRKH3X+$QM zycgHu!zai^xL5#yg$nw-zxMK_Ozex?9mz-Y7XgI!_rnJw;Z2t(f+GW{*7MoB@q>nR z0RG%8k9x+^}@Vu|~Ng`|#j9LgvBGSW-! zoUG>jyk)r|(5?-5Jt(|Q0v!HX0bx*;_ryY++hbka2^2D_dMZPnbN?FwPE%udn*BSr z9P!8KcZs%;m%=eG9HxFp_pg@C(cSfKP~+?0p2)3^H5!#bk>#B1O7~6LpUg+wdtG(( z&@pB`5QI`ZRMo@B2WWb`JE~MZ5awLRbex}u-zV`NGp1F%1&bS{y@8Dvpn=9=Ij!i+Dw0%7?yh? zy9L34P)ZEpV|M_S=Xtt zMCtzvUgZ9>{K-?|R)cAZ-pR$^erYwia!;Uwa!+a{(Qqd13Zr{y>iDO zMK;={(|UTkcf0Ur)0AgEpsJLWp9rltx-l8eP8*-mwSRhi#Fn3tQDMu~m2rw!G$5ei zWp!C0pc%g>ZVW$H(@jw{%7MJRK_7FcGi{YxU?Q2Pk0pw*o{+dxPP(O2?Mkh{-^eIR zA#d+6H#$xj$QHb<|crbRlWJf}{fP0=s+NbDTvDl8K}pDHAVK#k>|fZ_}ZOeC6-DPjNrn z>?lQqjRlZS>GC&{CD_|k<-5HPgIBs(lnz)7F!Q?xbUL7cuLJ|?O(rmUEkYuk2bi1k33<*JL9C3$ey z*0V26@FDz|%g9Kb;d(iQ$dO!z{cUxniO8l)r6TlBhDm=BeTZ5C%b-`Dqc?(-j2$lx z%SNmlGg%XYXs4B^_bHrD$%J*G+aUv_I&s&C~B@u{YA_4IK8v} z8X-8qo|`bCPuslST0SZ)z2r4`Sy5^`%&}~}u&CU%-Xg_p4LlJ;FlV%!P|^^%(-u;1 zvo6H_HUEF%`u9rX8%%g&9}D)cNVNTFR!Mi`~d9uH*y}H^?K#8xP1kn{(HGhPWWPI43&~24bha@%0q1 zMsW#PS?~r>D|B(Rmov_)@G}R_k(`WRtDX`yr5>Qb<=-;*GUwJuKb3pc1qy1GC8{8w zKL~FHih$!z9m$nG+?aQyFy4yI@IOGh2C=d0A0UJ$Rp61#6!6Y_D2d*)ys^Qz&QEdK z>Le6GRM`tm`n+2~>X~3OyCIM68uBD>b85|K6OF#!eZkN@ZtR~Ou{M@kU_Mg7K7x%a~$<^ql-HG(WDmE+Bl1>oQPQeA`Sg{IA@lx2uNZe(QOwyW<4P0F#*vq z#4atn?w!Tfdb2MJZJ^ur#+r8oXL|a1;GT!*aN~6r;|0#Wzn%+E)g;L6ukBA0d`5ie zyTK#rsbdREs@m19JI|NehH&)ZY#bSBFYOfHK(+Fb?XaZV>S;r?Nq04mbowEdNS&PMn% zIDMsIB?%?0jLDWP;pBJC95)D0qOH|KLn0V|%1(<_`}k>ND>_#~s1xg>7Ng-X26i`| zMB`?Q(qe}Un~321zfjq>`Wovg-7k!!&qey>(UXJ84V^m)Ra*Y%QYhw0&<>SdHBs`Y zOQ`-%bW>ICBTQ^lKWAf_;y$%2NS^J9{b)g(4_nDLwAOSu@}0WiIs7Ce ztH(eiAg|A0^mOAKv(}@wa*i4im*IR@HF{XPW4h7SJom8;EK-V*k3B&}uSiGAGHc%6 zDFx%h`9jn6-?05ol}Qm>%|Vf6+eZF-mVOq^Mopoi_F}092(Q(W$ux!^+D3FET@AeZ zQ3Au!3rPvH5XA9V!ILN*S9f_0@nc3oR!yNA#hG0*8$xe+)1~zvuZt%*iQg3g!4w=*@ktxPF z8>F7IHSP*2;YTs|p7%uZ^Es`BSW2cmm{7${z@LO-X5s^K!l-9W*6UsP1gw(UEKLz6 z!?ZUQ2zbsTxK2U@(Cujb(kR0(1Xn*P-le51nh@b^2y< zYT|U8aXVuxpWgMRVJ|mCUp+SHF98*=#ma_1-3{O%&EpMj=hHci=R%sKF{Kv@o=BKAfxJ83oov|u~mvUnt6u&^;5&_tsUL4+gl1O zZLCX>qcg-zx+ECQ=x%sA&p3Un(6Eukse!2tQy?SX>Pa(N$wfx!W8lZQ28q$KFkm5K zo5chvQ}u~`{_L78~CxQf{U zb4h>`c6AygBruT}Hudm$}>5zaLU_F{usup^-Y`gJeic)vsonRUvrx_Lh7P5Ci|pL@zyBb zB4(}%dI=buk7I9QYU4bc;!+9ikgon_*986~cqvL?M3v{~?^U!l$hUx6AM-@7^*Dp^ z&)oi&%^?$#RTecXHxPNzFlxIof)ohubAAePpUc()N2$(~`LsFTpo$x`-sD3Ysu*Xi z?UI63bRxwSo0jrpt&Kv<#cIa^b==>LB`gyYJ>0=_yWw@V+iSYgCfdUCIM?EXRadIP z+!!wqGZ7Cl|3w567u^69Y;Hdgjlh0gLPfYw?d_IxpMR!*tRO1`m9|;L8>VV&;P^lq zF&sR6B5>zZ1PR2oz@`-S7$Y;i$5r2AoEk<3+>y;tkHlxm_v)CD@lp^NgnC8YgeHZFLYsEY`UPCCNGlpzRhL=@`V# zHDPdkct^`LyIdbo35v^%y*~QQiP({KIJ%?#VxbLUQvQ(P{|x%cNzlqD=YP+6PUMVqCjbe`5zQQGgE&vpy= zriZO?TM47?`8jEgCb9iy72QW3s&CI0*-g2X%#t;f%+V1L7*FF}#l3(geX%pCe-H(* ztT>njm$QamIr;CM@0$bXyIsLg)CF9x`P!~!Wf1W)v30*V09Syo54BnAh8nl)?(b`F zCR|quA&f$}@%;aa#@BB@pGx<4vG{PRc3in>C6E2XdF4vJ8x!1R3-RD0yPQbC*#fZi z-W9b1#93aDV%uxBbUu04hLK`H(H9G!(bV&IvNr9hyVs;{@GlYc744{5HW|n~EG%aE zp0ju>83W2Kpc>2F)|TBN)*30~ZQY#Gy5etk`ng%AV)AfXYO_RwJV1>_i!~2#($K(J z2J2v5*3lg#{F6}G(7S~?FA@6|mKk@|>cBL$v^o?ljjM>5=K9SKaEmKC4GDNkiAqBd z)%E~sD{e;VYj9G^sQm3Gd8B!eF(TO9qJR{cUexgb(>DsHFGB+6KeEASfT{O-IU2Zt z8p6{P1N(s7GylwQvgtiiyHy0WOqLdrZr%ik1x4rB-Z^iU)}pjMPkV_&W~DmQlb_80 z${>oRUzsK;yT|TRzEs&P{##^hf0Uk<+oQQJsbI^Fxb}BRUtSVcd2<^qjFSbVhH49Y zBs`l!6^kq=Q>@-v`$NZXRz<*v&1gFwgvoaM-#}o;=#9uaU|u6+-jYfZsxka9Oh}d? zhnxC2Ljot1z0SV?iu>pN0G2Oa3N9~p;5yU)hwDVK|57GT1;>ey?N21f=Ico|yBYi3 z>w+b!JRp@Kg;>(S+g~4eFe2c=+(CL9)cJZE2eMc$5u2Wnkd0&|3*sVf>y4(-Jo|>2 z-=+(lSXu?b?7Nd`AGzg%^M9tjX4|Kfjnq=~l5}s0_r^Buk0$x&>wk$V35%AoTlRnL z?_zKV@Wqq~z!yhLkeRT~Sb+^x*$ z^CNB+A^^iP^{R1EZ>T$CJnBr`GzF7O!p(xNokmBSPkt=VG&qx#Y)LejRE##jvX?6=cQvGS_w=m)*gKv{9u)aO$2e{h731jBKyQh?>8B#)l%G) zQt{}^MBfa;0oq6DR=VW{g`mB4w`(BeZd?4jS1RN`5V${QCHO!{sp+vdrH^a0AvDFp z`A$Jnt>8#gym(S6NHI|y)UFR-%h@A13r(MHxdvY!*B9tuMNFl$VF1p&#`?JX_jORB zlfCW_F4Z4nsL>k<+6`VnnGM8urgY$^pL%4rHxwM+8g$RJ1f!?)8}Hg;W*V~ddpH_C z=X28k%+w$!_Y2fUHuOd>UX|IA6R~lxSud|+Q~M+7k*bfT)Hi?ZsNBnm4%tXVSv(BJ z!|7vAtCx395NUieE}`CA=1p!^pf~HMO{>=Vt?-cDN< zzVBKpTc9t^3EzvWAjDOr&i`3<_2BYzdP)1n;z=v^9)PowmAe}{n`j&0^w0?)K*!WJ zp8$Yj{tDZ$Nz@Qu9Y0@Cc6C$~>H<%`p2Jl9w8Cl57==zvp>zex3&(u{ zp{ziL9pho1EcPHbW%y)9RmY&pd{$}Kpam!qJsTCAqZZiCH|`SQ)V?t~2HD-dlI}nL zjGj9Z4qv2A2~yl#OMYm+%*H3SrL9e8TZeZU@q{Pi5p9}-$R<_|ZyB^)X~!^8aE7B@ z=rBw0y)C_(Cr1^KS<6HQgg_MbRmZ!cO5_;z0I5Gb`AX}0RK(U`m-}xi~m% z)pADXtp(f0IcN^?+r8Vujk*Vc1EM?N+wda+{HFv6PNfxKqpcTdgR#R^`!e?HU!K z)TprFLBkj>q6R~t(z!7zixLu;;c5`E_Ypa<~cj4drz zlbM=e;-4SAi;_`FGk>{XRF2Md`CA;q>X(_tmAMNt75CYH3Z;~faAhFR;o9HHC&u3)R^O$S|nQ|xsJ3gq< zX1zZad=ikyUF=0w$ibfWyAAeRk*1xGHCou>T<6|tdpxd@&C}E!G~DZL(crydq=orL zjuTYQ2uZ$SY1qX2^sX2ChEVZLx9b%m2Gkn6eQPRsl-D=H_?h|n#c+D^kN)HlIxz73 z3g~xYa1UUy7MXWobsz5#6HX%6G5uZ{9`)}TIb zfsnF>e7@E~oEP6eO-xJce*x_qDtquyX@@z%!?|7&R=!V27LH3wRzhmI<|D2BP_ti! zf(X?^`&EUzWfY8X)lX23P^zlY`YFN)=z{s)cLDx(zE$8#cRI?fbwJs`IEYdE_ zD32rcC;Du~g$>9lEtJY&_jxT*mVkK3P3pu4$r2Vyb|b)%C-1zyi^gS3u~&mxZ+9Hc zb9sj%>H~(f)VK!)iaN1C6unoYpNJ`0OShI%8n7BD+aM52oct!W-7Td(hf6A7fXP+M z=YE=o;(F&Y4ukYi{Ei8>!yx^g?39wFu#(tIC*IZ-JU(8dRi~;rgJFgfqcwYHz6w) z1>MtP6EdMWuDU?Z>G3BnHN*sT{5v+$u|_kEE?4X)({S83aGVf`5Y8pgnDMy8EVS@+ z^U7KJoE|;(grVLc{++flz(q)OWuF5jUgBY2+#xb}Am4_7!cP^{i1CyZ!5yHC7|KIn z_OvPpbz56u(8`_6>TEI>xpNYc5N>FW6+`n+OwYZ=z67^N)r?^Q@4{{rz(qg{-imVF zLT^<@S10+@pd^9|A%2s<;2ht6z%1>34`T5B%3el&acgvpG0P1RH7&2Z(atOg!nr?FC}1LZobO*~@=y2tPVW z*ov&JLz8Yu|MN4JUqB#?xt5U03H#t0C;RST(?5@(W|fNiwDLO zD6m*-5&Ah2Y;)x7zNAyHKY6!eFzH8s!({rn^S!^bZWQZweML1Tej@eI8SOpjuB?H= z5zQF))M>`8upd1_CX_nzMeho7!*8|c`A6u^WILY!X_|?Brz&=mhl5@s>bft+ab7cq zSzlmssVJZNE5YJTi~gD}DlbnklGbyj$tUn1tq*tiU_38*&emN?*p;OX48amq+awo0 z9oXT<2Q)sdw%Or=bJ+Prhq`A+zb&YRV78A;HfEA^sq>M8s=nz zaM?+iw%h&1RfxGgr7s*OIwHN`=*k&?BU!C?KoaZKco+)563z*`+0#a!Y-vcGEWY3# zX#1jejV^;J$QQuMpW(W_AQl}uMrb)rs0OCQ#OgeYGATNPNPtS*BHAqq)yz1N3Cwp7 z8rDW-!e)Y-`IR%=S_1ttCd39KKtca_8JDUQ10rhQR}oI{@ar($n(#~|#C$zr{rb7l zxVIpNKKI7?Zsk?L9XSJUMEI}Pm(Sv*)9}24F0l_^cy%cw0Oz7szR9dLI0K*7R7^-k zh=^GgTkzL&%khUWQFABS#5xX0;2$fGcCr@-Vp=DSXql#xgP1m|8Zb-17#td-CEARm z3#ytAQQ~=M4!-6JsWPehUtNC$!d976X%8F%(n70zMm&2i1iWHN-YB`GcaWFw38}uS zrqrgdmy7BN-HURTQ)>)aPV*kC^awCS)g;Y3b&TyJc*BA6tYKR)S3CIOq}`vufc5FD zt|!@tC8j9;dRNGXB0A~VTLY1C(MVhU3_scWtO}~b*%1U(wjkdwZOwK}&_+C!2Vr#* zKa89GHgOKJ%fIlR8-);!+ui02QFDCBW#@7hiW%tZ{cpE!!k{q$b)coQdcP11TD1_u zWM!tcGsAt|{v?m9PfnR^gJDmpvz0zT7wkGsDvU zmKBb>8lwe6()7i6IdoHnB)cJB1j;?PDVaQ=7cYgE(J8wpwIe41ga|u_NH~OC2iZFH z(mCBA{Zp=od&9SPeT7TU4OQ5Gq?7v#tqLEH2b0cFP9^M|bWJspfGX-lI8VTK?T1<- zPz)akG2xi|NR44)oW9PblKw>RVPxDdQ<2HCc^a2uL+>miKAa%`)klNzHsy$)$qTWY z(zp`YzQrLbMJu}saowXoUMsX^{8&qYi(QtU6)!Ddm(HI9XpVGro6hOwx@$9t-J9mD zi-{}#J1HorRx03H`DN^Nuiv!&P)q2uWF(>D10=+p!r>e}KM5C2rQZ#I%`kYjP+n`l zcTlskJ0(F5omzNBXmcVi5q#qb9pj!uAw#S31%D5#06uLHtQ;&*IEzs}-jMu)hCWM1 zAPNk^R(DVa?l^eQ`Zum+O0al0#--RDIC$B%6nA`Bjp4m2&_^i4+i*3p#cwHeLErKM9>I@^?OZn_sseD_D^&3SPxCx_1j^O9!cjyg z{J19AHE)8$`Yz-Ngk#Z3?#{;mlLeg==udh1lgRtvjQWO$5cR+rx%`TlM?1{g(>-MF zrI!IYR0Le_N&tQ>q8EtDvktaOsM5h!kpK?lwMTwVSxiei@ki{t!9Yyqd2kFPMjH=Y zsCe1m?UWOB^r=hI&e0*x8S66jz{bfs*f<*eP?t1jt0A)H=`tR-o+XUA zi7o;*>dI@N$W;w9R{X54Dd%_g)CECl8{xJtxPjVemk4&TP5c7TOV-}|_}j*vtxrN* zoi2qgJ#plmA>^}RTlHz#6C&yf*cT$jrzE<%H(%lcaps8_gPq=K${%fA*pse_&_TV> zy{sF;Cvk4#lo{*OjQsv;~NFCw6o5-B6#UuPzo z?b2lLhm5!d+Z*^+Q$e&(1O~qXfDi2`O}G18cJai?;GZxt9c>m3%D+oHZYLcZ)^>sr z^qP7?^1f3)Q*%U&5q}^(c-9HJi|x^I&OuSj4k)La>7Sl@-~B8JB&S~BUBtYcqvP83 zOGBxT@2@kC?<8hxE|v&2v5whbc_2gw!7hVzbOKyYEN`v(h-}(^!AtJFCg4N+R(P4x z{_!z^z%Zqy#)yYqIUeVq2m=|%g@gR5n{O~ID>`pRk@w7OYJOY5SqXz+FXtfVoPWLl z609!=WU~}u6l0cx5|WmYJ@P1i0T&SC?g&Fd2q)Zk}R^1W{xCgB5*mo=~_y?qHjB5+H-sdF6V5ef{i)~#Ga@K}=JO7?d83dYJ zDXLlhK^_fqbu-Sw-w7vKf& zC7pe;qaL@NzX2q{*9TlflR!9c^Y26lqpa(KT~%lFMZsyI+vA|Tv#SBN+sOzH{f`!k zeY`QQ;YH)!7PGv^?0l8|A<1f-;n}QT%!v++g9BD7jyL=iElcx#D^-Lt6CJoOu7AEr zqTL`syveP>Lhz93bla-O!1nEwjo4+z-I)1;gZuKtvHbrvo4T=op!Be()HmzXQrKTs zBrlV7QI|>eL}TmonBY>(X8813bY#dah5iuXAPbm|=c*qqsXdYcBuKkMO728qtT>Eu z$gjAc=z}9xSP&={#A%G6wRq-(EIsbJi&eh+Ps9{QLqw*YC~qk@0>3+0vR3FrZZ7hk ztp~qoqs9P@HKZp?Eno8^qCTPBu~2SOA*81CB--?WA9PEZ)Nn|#7?O4Gd791Xy#m=( zrom17+`hy@dJtAAYhH$;UI-R0LeJmj`u=XNKzr>7av7mya zpJ~xTHdq58Jic3DQWM@f?*;k2=Jb%{W|+dhWQlnTD4+%6XWqvS63(H-{+9RnF_%zh zv+AuH{+o03mr?qi)({JR@eq%x;NCE6?cnJtH>BhGSzJN5V{}}FxxU~-SMLL6isbq_ zEN;+@2_R4QON7Xc@a6MWX|Yn6U~-YYgws{S&2GtmRTev|a?qrHbGhQ`bdv%sRhoOn zH5#Qo$ygI}ir)BDlu;owYZ+OM&zm;Y(G;VY`@P`Xi_xSG0rPD%oG9wP;+i zRL}iuX?mq1n-y1z)j1P=e#n<5)Ecu#QJRXt9Rt@?OJI)S^3OGUrHN;Z0=<80*kgqY zU8|(eW+TeW6(oqn}ba3Hq@REs;Qpnum0f&?w0Az>vw%u6MXO(0;R+x zWJYR-9YC2k6~ugez{p5{E@ws2=7ekEF1egcTW-xbTe-z-wGArQtq~|Q5EqpUuW6mD3kwEE_l-0w%bK~g3SBd(W(L2{!n+Rnrk3*A4@%A-YH(g)O?J=klN6H{&4wmO# zwUZ#Sbd>2|c83RR`m7oLDHVq+26e~=$jK!Y7Uq)j=8C|NOdo8`P~r+rN{FlEw4MIC zjF+H+l%`yNK1{kyS4>6j2cR`l-4dv#4B!X6?qbOEwmqS*mclobN&U~zyowaIo-udX zO-07v&E~~1JY4NGL0v#!=Q3QE+9hO28k?`RH$U##FjaO9$(HM_E@$0x8z;0Zy_YAC z&4*4$VLrC(^f*`(Hos|m++H-?T#X~`cIP0@vsgL;`V#Z1$SPSrz`TGt zDSeEWZE2vouTj9S2C@<<|237In)2gXR@Zy3!KIfTWF5h9bgnkW6CN8(KwHR2|9 zr1@Hs%(S@7FKC|^u`dkHBy=)M*<&}0o>JjqFZ_?jw2j{U=bkJ5bI*Ukcz=;*L%SAJ zu6TBA|7LEPTUT;WHJ+%(iWsdsK3-VWepo{&c^u0M?k`jI8k2_w@Z_BvpQUF-Jft3E z$U9Y5;BGi;Vr)KLC@5w)cKL~SmU*+tW7Am^Bz8udclJgz7d5XC5B_kh+_Xx%p**g2l(m;EpK-%rifIN z6PpT8dL7q(@$_23>UiL;OAqaINBPfZkijhTQ zzL120X472vRP895qWhd#9Bh;J_Kx&S-%wDzc39V%%1TWRg>_F~b$_RYGjGt#&0ULe z%-cnUsjR(*k{XSCh_~z#Ci;Eb_VNgUdlI)SJ6hI>q4o1S)7k3fRJDInKoIo_+41u( zlQ$P7b0j)!b}I9V*^|b&YGmf9?M%}`>!lniB)T|oa`0eJ{qXU0w?Pl^keV-0JvtVD z7!$*I-~Ele1ZcPbop4Odkgo<+Bwlo+n)D9(KPt1ur-~27f}{`@spG?$w%bXaVXFf4 zIW?92o`$Oc(QM&>^AD~!;wG7_11-w%C>28=q=jf?j|b!)&KZHL77^%-Ra1e6;dFT8 zL^@+N0g#F+G;!R-^+-Mr6N|m!tl9$Y^0n&fem~pE&6ddhMf*xMcj1qo;jTxO&xG+- z35keUaFTSzL2y}Ob|%%;VkU*2LkXktsuY_tw3qTkNK-B&k~TOR?({U!?tDf7Gp98x zQY0}Tb#Glc{eF@V@3_qBVl%Io%t$?$6qvTXQ*TCs+XtJWttlx*p{jBmQubJOZWasQiwnNH#;}fs#6a`d>VlV$ef%V56FsZ#>Rj=s3rsJdbLrL0s+=7; zrpj3%V@Kp{Za>pYKW~`<6lY!ATu3;37x5ddl9$4mQawyH-I9m8R>Juys}IIgdN=`q zDhFmre=@{brH4@1^Rj1+m2IG?C2=e~)!&H^2StP=nDt6hlBz*EcHJ_9>*pz)MUr-V zI5}I@kQdCr>|RYNV*c%gv*--(!R!S6`yzX0VzF%o){l{$mkgK@@!_v|kj@Oq{V1=D z#MRfGJE`mgZoem`W31N46BuHuqM;=bj5Z%Lxw#rPJ2+4p#1`n9($E)q6bZ0OB>EH& zan(I^k3ozD;5Rr6()-H?8V}$lR zNgkDvDE~%{c<~ILL<^MziZN`osuy=vjE6d=lW8s?VULLRm~yw6PA5Sv9LAiYIlEpgq4(@xhixuS2( z#|kI~Wcbgz^R&}Fvl z&YGGPve!YdXTf{ON_adl`zxG%S$bxVcu&XR?TE4^$m7=r#O7URXs;16d!X{!tOacE z1rhTHE-+{7!$aq+|6Ipz=8BS~m0@FT`DZ&Bj}YwXOuallio~mBMhMFzx|+Bm7f8Ib zFL3CWDre^lZXGzL46FZaR*s6n$6Nc3`=4{O=ui%bDl6=_i5Fs_W`-g-AaH+KU5qr2 zW@(^sT5qm||NNPgptoWt(;&%BE&jpdENB*?o{Yz4E?X*k;~Auzrz%Z98~3EnKMFRes7;6>3O?* zG2BGbf@yZ+H|l&uvv%QXb-c3GWsin~GHQp5sx?rQ%9B~<2kAf#i;wH=YtI_0*5$b| zRS)|;@fU>YbIE6_vhU_b$4!M1V^la9%EK>{{$te_+)v;kYn9SO2WFAVgJ{;=0(}DM zzi}}!$BH8t8@)d|(FK-Hj9E*sFT6j3A|*UiHPh>2gf9vFgbD0QztUF_6Y>Biw;uy* zk8?MdH%RxG`vZb~<=V3ueJw!D?YaVE_R7Ab3h+gWNJv!|0XX7K%AXc$ak3dHtF|HV zOK5$muz-D27JDqWPjVZS$fLxvh3%DDP$PH5=vhDj7h^BV=VBPA8K7J5cht_XqI&=y zkflNHcEHLV&Xl{a0VLLURu0OrdRhP0y7LKSG(ltAf27cB0~t?ucacLtU+-39W^HF} z7N&~9krEeX-h=i00?4PCpMKO>wLp$;0~6=N>b1XOLn4Y$W%W@*toUml@yN%kE};2&0IB2zvc`6U)M-y2DhD!vdC5`F@YU0}4E{JDCce+lRGbLSVcn34tD;EfJA)F8j+*EuD~q7)7jX5oda0Iw&% z&Z)OFWV*fy0jbBvj=2u0tYxanyXJm$KhH$cYr0BJzXWvHq91mcHS`>xn6f2rZbPi^ zZr#^MxZD9sPru;Mt`3gK~`1Ln0Exx3(8 z;7km}**?m%w-TsvuJ1LD>sG13vc_gp(rdIeql!_7Td9mZUm%A*Ee8ZW zdO#2?+IQrle^>?DPUIe3@6T^k$amFC2IULx4d!NzdOSWzOA_klw_7NmD(tn*rjt&9 zKga6bOeSf$v)J-7*H3_JP6oiujx&;q17YyoK?&d>&-?|QBNRL=p3z(_P9aBJP4|=a z5@J4@EWTSje%-Y=b%$thjVqax=u8euIRDM{}braDGOol8R?V=_(};%)G|WQ=xI^bkrRc7@?350Aj7ye^Q|*k5xZp9p z7-8N({Yx)r@9`N;)LRw^c!4%%y}8q5@~*)MoPTfJL`7a0VAUHV_j;GO>Dr!@68aor z7US8p9(M*J^cDd;U61K2VQ z!=wOKWZvUVP~m&#CCEmq-g|??cAKz`}&r*>crA(?E2j*>I3 z8F;+FOaE&?!g%rF^VzaP`ofhWul93{yiiLRt7QH(?5U3UPo-20Y>B# zZ?^B13WXV2!?@!_fLhaYE!g_adjmOtG5tZWV8MsDde=dz`*z}X+JAmsseBf=v4WfE zvPhTC3ErzJTUa!3uLxKxx~8VKot~Wo(_GKfA>MZoE3(~u*bwm`Y;SV!A{Mr5`issI zPwi|6DB)SEq1w9Nw0x@|AC4Jlh}dzkp1s0IEJ#To9b(Myn&qhRpI*yxXbt^kpx+Io zO$;AUNZeG)va5PoJm~ zyoRpR1BX8MVVo3wYVsF^Qi|0uwBmO0%=j%VHMj=*=EXUea0C6QQVRzcctUbuyP=Z7 zqMpx=x5YQG zit|6SW8Fw}Ni~$->2I*rtmbvuX}hMRS8npgyhBFmLhU2fYvgARrr%8Jz3WXU^vu=+ z?la~?0q~`wanvjOm#!p3lFk030+LT$E8?xqD#tG`1%XOHO06k@LGD58O9WcQsR5Fr4ZWXz@K?aZlv3R6 zAX0Zdl2N}E?pxp6QA4v=^(^iB@{)+*GS>%H?l%V-^=Udu)^4%2_uin~lRW}4YBZsD#?Z3w`768_yc-B#DbTVHXXWQaB)O6-(h3BfnSev(2uX zch}h*)~pH&6F}$gZ>P{=n|&KB#l4skdFOHKLsv7~BjcPy`{uj#`zy!2aGtZoD`ETV z9rS#F|6MxI+0k~tCt7=BGkfog1Zh0gDm8V+WjiKM-N(TXdVeEUIZ|=Gb(cZEsaZWT z-gE;&fZRtDD*c(eVKtmuJROu$v_s_=6F{E_%b;vNv?u}cK`lF#(}nD(T3}Xvec{Nh z)o7x>URRna4GRs_OmgK}gb%o)Qt{qM{kc7dVju_e!Q~X9BBU{JFkD>yn?2Ee;oGH-y52w6z~<< zUcz`+_@Z~|AI03sk_t{?>-;hMTdp2U?OU^b=wE3uQy;b6D~wf^|L7zC**xMmdZHsC z4zy>izJzp%F7>KeLaj9y#?ag7rEVbM6m-_qxV;3%4cl>HVwUyt`PWuxUZlz%UC=#@ zs91z+B4Xe~f8LnZ@FdI#M?9RhQNFvWm&0^Lg?@B?@$=saQX`1epSeDKPTSKuVUv4$ zwf+cT`S$|5p4q#c)k5!vMg{i}c}c}Oxi@Rpnv&PTS(bkFM#dvTVNne9#t z+o~8GHZ$)uz+#6Yw1NZD;5lt-}=F6m^2Yh=g@%obgdSEC|nc;z<4{I3h8*-?H_djh9RIm8^Sh*R*fOe_41U~svu=1#`Kqj zpCNQ>dz_h%{FjE#pJ+@!Rx2e zpza128Hb(gU*3eiK9I>h>dU{U95SVIdZG=gZsBFGafM^6uH6lPbiJt$dmXddr z%ihSntrv1ss>fK1t8w^^$Z~=UhZwlxhRTIiF{I4cvG4f_3u~BN-&Nyhy{nCk&xFQV zrCM6J9u6qybj{i8XDA)st|!}o8sb&KkMRP7x7?f;kYJi3AZTY{!l zN$P+kY~l6)N*vs5=X=xt(PzBF{x3yRzju~r9d?#a|CcaS%zl*fgRGEr@$5TH%*{IAj0o2<}JZ8F!&CG_siv=Y3 zal9>(hrVZ%e~_(c2Wrm^y5;ZQUCdN)5CwphnbXmqa1Y_JVVo=&$N$q$DZ`n)eJsnx z@P)(L><>S5m&r2T3su489NvCVa(>(X0W)~#Xh8kPg1-6Wj{Qg0nsImQLbgx#s-n~P zrl(@MkD{(0D)AkFavsw1?TCooABQT8&DVGCgiIt49XUFbzDs~}SY((cG<`J<;1l5Ka45w1zF|v0zKHa z?^=@p)$l0pe^{8+Tb&_C6Mz4Cng4%BrsqhZfruL1XeSTl~?B-M#ZEnuPnEvR56_zRT|X z)mjW#mSbzk2l?;U`}owHBb#pW-N?(|{a-ATJnGrKeIU}*b0|XV|KF|TU4Zw|umrQi zVF>~MwLkQHu?+i1d-Oo)gL5SG@v-pJ`Z4#V&zEYU2>4KmX^|f>%_x{e9>-$V(2*CV zV_UBg?cBCSV(p!E-}&p>mrEw0vn3E6^bnYW9KaL!LJR$Mw1=t|34ZUzJT)` z`}3dE{=0{`7kcnhbzZGaDi>+37+qjQ1Agp(s<+ospm z1Kv9D@L-TyQ^NKV(~4ub#-oKjcwPl21OWdOp8zKO;b-J^Jsy1)h&_v+rdRCte7-@7 z2S$&(&Cs3A`<#ENw8jZV?ED1z8fBfRAusLR9!G7aU4rymy_8zL|699Svt;2rhb_aP zo6Zrhg8qjH_C0_U4BTVc?P>oasH2<4_E0i8iCK^s4ssDX35wAwK+<|!=3ig6PII`| zVnN+`=GVO4^=UVxm)N7*qC2=dl%fKOEvdTJq_@#exYG80urKhP?@4@@Whwsdqy7t} zSSe`zrx0V$N6W)NGQgp4Dmp5Tzo!|v&hMw%uW>@g249N~;CPCx;OU%i*Q-%?arxv! z8O?`5oZPsSA#QfQZ|Xs2)eDoz+)1=>)PO&|2c$3X3FFx53*$3%e0J8(%F$>H;=>hy z4Zp!~FGZ~L&ISz0&a`j7idfWRU=xX&aM=RB=F=P_Sg-R7#n7+HCYY-+_AX;V@nBMA z`c9(1rVoG0$;+7vZ+Ruqno0qv#lc;#8af;@35}VOKlKxw%XCO z0i>b)-hQNKH7qQ|dE5Qq%S+7iHH(cYM&@Jay)+(7%jbiDRpL)SrR${Ut-7`$C;KO4~5$yDXRMzWVqY;W0OYFx^pEF7ds?O)`q2+ z5eEbmHiecb5)h?cQW-7yVw&`X*D8f8{8>@g)75Nas$-XmiimnKzOfyH%Vl8sZNih( zc9t(FUO=5QVit&9sgLQkj+$)?JSUfri{((3ycsd* zUhGg!Ak2!Pr+9j0^pYyN?%|M(iU(B;(j!seD8A~DGaiA(+c}H}`UN?%-kH=zFFtSC zEvqPE$pUD34Ev8d&v)yp)cdLDu_?e=_USyO)o=IO)>dT_z$NK8@3dSiS`8p{1+Xd7 z3 zgTrco4%or{mhpm?UZo1<$xy4*h~=f z^o3OI^#>0c2rW)qBA*Y%N`|W!2grMGnmb$m;vJCZ?Cl^7_1vhqV3c zuKv;SuAlY7lRQNg!=4}R zPs_0b)c_YIU?|$mhdLi@mbUy92sghOK`02$`DX6=Q*H9s{KA+A)lLp5EA&M;HAg{q zPg0sQM-^(PacXDhyl{#@i7`z!Vdoe;nK!C5KT96=>69nViPsp{4K=~3*`$}mOLz4l zyfQW5>$4N`YOmEEQz{Sj``qUqvQzGn6AH0&j<~&ii+UEM%k1v1Y^Am`2ZZUJ=G>7$cw&y= z>-N@ycrgj47gHP%{}^naNgy@TQb*3PABcu^zti3rxAJfcjsM}*vO@-qBMMJ*B$ zD~|hR5_BB#_y#N|Q(jJi8X1wNTDFDc$NnK$03?WIYCPuN2*oVdA}LL*MoGN?x2v`7 z&<~$J5$=yUsXX`+qZ0I`o*ppSp7hKzsk2_WU3;d32Ggc~?IgvW)|E5X&q>Ug3f5VE z=Z7DSuCe#ZuU==`mP7pRvFxT0E;8|5Dp?$j63=IUUTj_42fapqbugZLXEQvWUHK_o zJjt!#n&gg1h@W%V>?#ti46O0d&x+*XIqG395*o|e_0qyU4;P%T{R&x=1js+)(o$*M{=JoW{0^oVE(4| zqHF8kq0)$~T&spLD%%HoxnQ5cq7Hka_GK7(BQ>#@P!!C(O`xTL@e_V|jE} z9hn+Af&-f2K<91hFxH3UAEC{78~ zZT^P72O@>z5W@D;cK}uc44yT-XzTYyJF)>r%4W~SPcR4DnZp~`Ex)gDrv+Cq{e8>oloKgu zxd)}pQkR~ASn9XKZyb%%0+#v7O3?wVy)TtR%CE50(?2Z|<-mH-zp1iaPonZy6k6vJ zJilQ8?G~5er{y#BDuJBD1W!GLFd&j|=c%n0HfZC`x2-o>&A=9T1BND1=Ct4haNF=n!HEBtY8tpw8@>*=O(by=T9FyubGy z{>k&x{ozGu`(ZzIQU9L#6e6wfZTU8h2TxH6) z{DPd2?1TGEQ2`;nTh>m&{!1flaf5_jc>BRG4koAe13hFT7W?XbuT~WK)J(68I24z1 zkmZ0D+n_v-_fbu6oe$a)wTPB~V{CQ8Fz!Fa|3f|f=I|96luG)4s2l!=@G1m-z*u3t z;P9#;&j5M^|2Oab_9t%sB;&nmg*|n6IM&2yPg=BKb?tH39fD+}@HBm_w@DAr?%8sBL*v%~^f1~RUU|52tI!tIK2mHoJX?Q(j@vur={Z2nd;W60lYVO>{81rYR0 zu36K7cT~cjJI&gji&LEeDPK8}T)UPIYZppbD9U0DwlS_hdB}D$iwf&Z0vbap+)Y2* zRlb;15ql6psm>2On`h$#G(=!G?Q1!#+$?3iFA2yGjymrvSDp<`riYpIt80V=t{**} zu8GV(O4-q&$Lg##Yb2A-POQO#RZeSd)Gr|IdHN%T^@zN>uEB#-YuHf|&Sky7|DGABNaOyr%OREFD3uoVrO zp{ktxxn5oTrb%k=BoRA<2HJiItw`gU1}z|rfD?TSVVM{i75PMtxOV6ZjQAl^g|its zEp+L)oKuMPBy7q7>&Q@pjHtSq>9So~2lQK+xlyw#yzm{qa-nAgdy*G!CSOei77Zr$ zbKtl8jUM_R(L;q8>~CTc#hM*e-q>23jFGgElM9JJcORixrF#2`8-ZV*(GXmZT9?wMAT|8rJ;dH501)t8N~2- zQ_gD>yYns?OBPpzB-yxkq}iqP;mZpz>z}Tlu%!OtO0#b!HxC{t@MA)%d|8QGuGoes z310Oif~5WBe!X)V%Ci+BKm{hcTk|Yep|^1rB%0UY5qu`HF-mkOt5;ZUC=@z0_1C6{qG-j}_ zO=P`GC>%4qcjC8ItoEIG%550d*xZ}kY_PtlVceP`Gi_xrSI)H?R0^FNn`4V=>=VVG zxR>xXtvSkPpx_>$TEV!SU|NAW>i`I${h%DO2!}ZZ-W>C^(%Q7UEz-fE0zI~r5zS(? zoqp0WLQ;~P;EI!v)aVcEH>;~C>6!}$>`R)220h~G+#x7;f(Kbl#h)-GZEdYkh2sPl0u7`lwg&SUehTQKBmc#dxK zTc-+Tx`%L=JD#a|Fqug=s{qr^F20phYTfu@(RL}?P6U)JaF$d*jhI|dVPrTDfDhCu zK3%0|-syg!awnYcp5|HiiV8~yEIn3^NB#{TI`-las``%JMNdmHSF zH5gHG;R?ET$z5i?MO(o_+v`e^+zrz;QiaME7YZfS$SdEi6apoiCWDR$^(uu;4RsJE z_PRK&DTLa*@e?g}W@j%xa0#3E$&xaJ?}a3dd<`}a1S)63zEDc0psW7YAA+nRqP-vn zc^Kto&j}*0(#0jtttn3&f5Z{Iyd8M%?&VvBDOh>f-cMLD+tef0lDe9TtuL^#Q1PtpB(fW5lL@QG2Jt;K9Aq0nR6&6Cjzd^ z>+8uB%q4XshUFQrQJ=upQ|??#I+L&`Kk87bbdz46&g@Gq#L_o6$g_u4-oFf@vWlmZ zj=PdyWP&$q#CV+4vtJGX??MiwTYnBY`qRb(CC5Wm>)^Htqp0IqCao*j6NL6S9Ox*< zoOfE}N|k48hxfo~K~A%_K0kP8{U=Y;2wrP_B)3S}ALIL~EZm2y4kIqj0ne05XpaCy zWlN24wiO5C(XV_8F>y!t&PIFQ>l4NPnj z(uaPbEKsb_T1XFfbJ6}d$A8cUWEB5sOXTve9WgB3lcbbr+i1M8N|IyoI@!>c^wMLE zE-hYctqZD&=?N~P6`7#>UDo{=p+^>Ic%NBp`B zhSQ%dWd+o)8S!K-$SWKxZ4Ovvxz7XYPRxHX#b*pD24UabbEITeRm8is-N$d@^fZ)^ zw<6PmSC8{TO$Z-P_i4^0Wt|h>V=c`K${9o9#_6%IU{iN5Sf#T(h%@kk6C&;MXmnzP zmmS$!kabA4@OD(#P|~3EuM>9n^RdcN!@`@(R4O%2sGHDP;?ccHG&GKqta|oL$`rsC zQJG~~<*n{8iQoUobNKGS)(u;S+YhU2(jxXjtt!1q70^F_C+l=K1(KRI+#HcGJK&cR zC1cuJ_|oFWHm1mVwF}ctSN0WAiog7|s4y{Nd$hn{U!g(5ASE;sVbe*(CHj5Y(YwHk zMf(%=ETr>THcvQ@vriotr}nRjUd}hu*|*bv8@gkZVHbn6l-Z**fV(Ypa?l;8m9yvoylY<$9cE;R43oIosWeXh5h1#A`v4)rqu zNhP40zh!!d!{wlbzW8S{rO!TP4zC8SpOJB^zVS_BEyS(bB3HxAainUkaiwFjAqd)+ zbHPh!_&|-3^RCob8MZ^50Vvo$)w`-WEWP1JwP3#gWD<%MnNr)JvvI~#d z4}B-)`X}%8 zx|KAAmh%q&M!xM{UtHBqExu7oA|tQKHQ1S!8y-9xD~2Qi9cO%bi;U7ID)k;pQrGXP z+o9b%z58^O@uteQPA(jJ8Aa^V?SJ@qY_;o(7Z9PbA*N(B7RR&M-{Nn-Un10IzxG^h zc*v#hMY0dhGb6e5Iw7RMuP1iFU-DRSt}U$LU9#rjrQe_GB2+ff5Yj#F+opb!3|Hdo zpP+SRM~3OLfksO^xrK0|&7;s>riTSbP5+VYZJrsUXRTTB)yTtj_hh;EQGB!^o`)<@_U{oy=i`~MC94;lct z{vmKv{W?>B35fId(G7!FrNN6V zn&)9bQd9B;4gbuXgHFlnqxPr#Z2Ip@geE>x_2@`Et~w> z@ACbR5J1@*y;Hz??gRAw*gd?N_f$5DHQ|B1`RXUYTR+kXvsF`cP@no#x{;M?dFHFa zk)Hyti75v95bm!SaswzaD$2Cwx9pU9?ql=OR!$7Vkxl@2va^B#0a~d_ z3Rg1#Us+yVUH#JR(RrDFiAw-^AFt{k4Sx+LyiN6=o=&vg*9zn;P5eZo@8=)ad6+}(iH8u77v`Fv$mYfnf(Y-Dac9L(OMY>fBk2C}oXX@(- zF8y@;S9CPh7*g#uq)mej>>{IGRHP2{5!yXG*S~Hq_bGBMFTT)QeJ7h?Ktd~U=|MSSkK6BgjVOWO%fZoXZ{3OGQTRcQrotK zEicvKyFqnmKi1k&1e<<57aEv|+gSy87?pV2tJjW{rp-cX27`4}X4trRReyxOdqqRY z1`)hXc5yUXs`j9a2KB|yqz?VjCKQgIb`TNG9xeieMXNoBSJhi`#O#|}W(lB`ZuBoBo;f~P*V-S~8N zwb0j|QHZJJB-8#W<;Dt@g|2qsmHjwBr)HO0Td_&ijDN&9t+l!Ai4#D@6u5)W zvQyb;bW`yiw^3P4BT+{7C>FvoyaH$KgTFq(?x$xnKon%vCiZGLouafXQ0PYoE1F+~ z5rP7Y(#obUG!{Gm{@WL+GKn2y)o#@Rsb%wK=&=N;7ZHqUw#OAUACcanKhhQq?-YfE z1at3e%z4EWqdMdDhYH)tueH7Aa4Df!d7Kgs_tK&M+ko`sZU(Q`1Fa6#<=uNSAF(b@UHuqsNEVK0fK=`H!LgMKM48YtQIVdwD+_OD`|4o_yRlA_|%LpRVHGYnw1) z>mveS1q=9Ne}Jioj!56dCIBvJoEQ55Q-tOxFdpAkg;4I?{ziPVk-)W{O z6JxP*k^d|#w-=-3x%#EomJ}POJ~N(?ecEKdeXR}vAQk7pYQ`r1R>aRkuF$N6da8bP z$rnDlWW96!NIg+K4IP(kHMyys`L4anIhY3B-ZjU z0dcBfS>kP>dg}L!5jGPcq=R0ik)z&Cwo&U##f+um{7-SQ-{wfR5p%>2jedqm`}q9- zC7tSB!34@l^OTeTu})(w}G$GDj@AgByiq9wh-|7b@R-W$c<-ooki$HE86 zS%V*73BnNIPELJ%bw1^ebsvQ4vjZ&5{`ojNv@ZS1^*&cLA5xDp=*L$D^u*aW`EZ{* z5+9Da3C3%!uS^tWK%9u5QV}0tx0(yE()@&`b(Lfv)}WpH8f5z<--378;1f#Hm3G02 zLX-zMvJ`U=_K)j8^Irjh%y0j|MenAgpC4wr)XRJ+#ZB1Su4p3oH}Q2@%Rx^2rSxR} zarOWHa-aPJA^%rk4UEtKmXPufjMC44r5u29{eN~87*7Ywsqapp;vTT|4iyq~53#2Z zj!t@>V~anpRS*qfllk$}RXu^-zbxh@|B+u%c2m3NOs((kOXfAICxl5$3AY7E9EQ3& z9+Qg9Idr+7d;yT>?J7TBs%dH)L{7?ZiF!dQjpvlWS5l0~PYR#A z=K=n99s9TAfmO)^C&@_*9nCqcS;V2jylhFUN|#`=EUm<>Y5oCNg;<<#Chz~-zJc9e z%1gPaeXU&+knPkLw`7{z;Y%)JL*3N?Z)d4#^?7sQ%Rkd&n;mH9av2>Yu# zg@2k3Ie~Jo-exWoJ0>OknqRGv$v521ydBU;99@gS_ABKUM!21t78sjJ!tJ6KhT+to z{V~cCh9u4yrjb%~dw1VPh||q4sXa(-p$-RO?f+tzgB830Y!* zjb!bW3Mj`@7)Ur3dlAlS#FIVt$2}=##fN(JAIU~GnG^rGkad8$p9c?x^u&b}kkF0K z^deRWpOgH>tXQ_qY8tc~9TFVi*sVmFNH#0tHZbeeG#PUh#zg)IX%r` zjyDEJ>LOMmU>)zzEPeC)(?3@6`JbbB6m9!EpvmwJr2N#w6LkxZR5rGx8MJL>{5Z+5{rv;Wj$sjJ z>JR&rQ|Co62hAKFVSOD9#Jm^3spgdG;q;Xa=0AQxFf%hu_&)L)_ZWZ@Zgmy<2N>LSyX^ z_T8KuWVX3lp594-yzYrjmk3Ts8dCcGy*y?dF)Z|4KB~fx6Do|#E4xv9LwQswE>j2Y z4N%xj205m)WMbLs#_I2X^qDwTwzIN+yhv6(fP69{IQz6~XA1q>vQ%5Xyq9Rx`pPW8Mh-P)Jessca8@|5KsFpP^2|jtl?d27TRRKWTGV z45+lY{m{nN*l}d&#n62fXh-6$N55k}WK35wwHW_R62YZetE;PPu)O2;+N8rk^{tWM zPvn!g#mCIW-2q#L#M+tr5fWCxHT2Bfv`$>~{}+0BE4L4B9Rf1+8S(D@*mmi&s{(z_DsyW#)e^X2gWo)V zish-@)XtX@hCb}JagU6?f##PF=z`O-$u08InD<6;c0f7ENGEJ)kB-sM?bn_STJO7> zC_iXWsjFWoC&#O(e|&}Bf5$XWy&C7UA~zBygc8&@hQX}mD* z&93`idP=s_u5woA>y@I10uv&>g4@XDzjmJ~&?>rP^&~eVK=DTPxf|8rD*6|X**z@# zWC+T1|4(qy{}#(=E$$r2ife5_9qHvaxb7Fv3$+7m*B;o)fa4W^;+7WYmjvpIYLr96 zVl@Ej2SJ(pS2R%=Wd=%2xvWtL_)Rg=%joE#!oH4_6YV4(hRY^RzLqboAPL4DYJQU z9`^2nT!+5%SRB`J?DaONy`51<5VlK>>sx#LM_p@f7O1;Ne>#HI^eDm3Y+#i|5&!n3^SehM3pCMTlEp$1Os zktW)YzaA++Q#1D22wOKhp_d~=@CFNzWn@3NW&1V*Kl25pWf*w%Fj+f9Lv%11PsHf<#8bLbM_?NKlk zcj?q1dG1c)*rNIm7>ajm+YR^!r}_VET+JbF6_H*VfJQ z0O4!5YJ?3Po5QUFB}#?shE_^V%I^-CXvXEmNP=+sw9LgRXsUf(wL?$%%;*;9ZZPV0 zpblXv8g*Dg&6JqmDka3DF~TwR9>=A2T#jW(H`tWvGx1_5`YA?_sUX2dJK#8Jbt`po zXQEAIZO*d57dDj1CQGQyJpIa45!3NgO=Cx$s2-@!mEkD^IuEq&jYfhzc+Hoi`0LRy zHaI`-t5p5Cn!525p-U5r`lxWHW-d%Sus?_@MDUmJ>DjU5QuAh!W;qh&jlRcqRvXP{ zrQzS?Ig&kupGzHh%vxUu#W(Ql{R%hbFzxkLRO+Ls1AeTwErvyQM*#|*^p(x9VTg|j zP5pF(J)DG~j9XhIq#h*c)vk?eWT7-78i3h0^FD}T2ljQ=+Ot$WH{$8vq(vjDQaz;f z(Z=Yc1ehgPPPWfaYN{~+BnTjcKqznI21!fe1m`ff)gi2LGlvd<3mpHbz;P2kfZ%}e zLSwm-DAa1My}ejn+Cc%*e@^68H~RogJ!N?k;m{$^Y~{YL_|rojjAPU3$XN^Dl( z=T1KAD!xPrPrBheLLM%L1Yffj7<&hdD1j66xxq2^3*}AF&fqN@A3)pZ)aY}cevS+E zdKjRgnAoJl-`=T=DOu*XRi9Uq>~o5yI6%^AQ^0 zEVW*N<~JXm%y1cZ;XiNQ3jr@{!q#1;(Ss9$IIA#y3DqI~+!C_q^MRI$jm&hUScP{B zw^Ll!MKbUtL5Kqq9*>W~UA*Zi(2bCIeYEF_-zSnh~ znqS8gX&?^UUQVR-eTEj~tqq>u0PF=`+9{?|oyGt)sieUlSK2=ZPn`_h=MtNZwxAoG zU;6`gdv1E*39DMr?U=x+CKZBFdPACx-9=e#jz zylbz9M-XWe1RC~IPmYEj?K!a{1|+FB>LRAhU5eH6db4?tU9^INUvuKL=X~qHAz;Vy zmVU{@#Y&AS#<2-`5=Mert+f(slvJUtL0LH zwWs^wMo{|nI4+@ zY6l(8yXFPMU{1)^9)XU_z3p(XWX304QgSk}!|wdt0GJTLV<+&E#U#hfGmqZ(LOlfP zri}PSerB!g(Qq#$k$rCsw*C@MZN=qDH7#h?O=yk!hyXn^QAYQ`DLUIvGjjy(-&Kti zR*zf1kYew^$|R0b2S~0;p}s+Zlfi-(*usS-;X2cW4uMP58EGydGt+MMOs3|}NVuE> zhTQCj1-jlP>0D6=-;NV=K)y>wPrd<_`!g9DAXDgk$^GWck z_ZeBF+7&CFw&HiXg(TO^OK;N>dG%dkJZX?b=AADGo$BV9} zo6;g(B~cPVmfYzdC^6A>t6RCV>*e83UZ?6QOGi%3yhJy463vL5Rux9U49%eVzObIXd>h-x!c zDM$ZNl?HwowLxVLBZwB;oSdEA8B6FR6*&(-xqlVjuyv{U)+C`HA3aAfZurBXad2}`UC^qTz50y+90T9GX^794kgwVDZ} zFb+z*7(m?n)9e|M-JLy~3h!{n;p(oTwbGN^r3~o!T#uQXm;<4dYJFvTQ z%E`#4HEG^`U7Jb%cir}WHMdrc=ar8zz@+1z)Q4 z9?{TH@GT~)166&?R0ppEiq7y45agF;Ng*^`#=Y3lAyCgU>5E!laZGZvzO++jsO?pe z+xt>wro@qhYgkf6amV{$cpOlP2YQqxZ7nBU$26$>W;Aw`HfTBi^hO1%d^XUcC(~)t zB3@fWHl(Hf^4P)np+1lcBii9X!U0nGaqPR)%+%H#?V5hn`8yV7sFwPc_GV)`p=bRG zU_UNDZ!xEmfI>d*wsFXHwV4(!+}W$z1y>I!w|=l6ZG+#;Pi&6G+je@tk~2jtMl8>6 zy`$a|cM2;1Ht+3g6>?XRt&g&FyiY1|i{>{6PRn}}k{D`?RouE|!HDi0sQ~0#rv z;bgY>3!+{JoR`!D`0s4ya4?3LT$U46q zVCLy?hiAj40rK`XYTNwmNeEF?@SY;}X&3q9Mj)pdLW=}}n!>oJ^XiwD?RN?Z2A24T zF&pvuY`&lF&#ddu+GgNJY!M~}AG21m{)PNhGS|VEyvhq-tcABqGG}dIi~W&!k12STTKn*%;#!aRsCWE8bM3l}( z)!!-KY!a>WdhA`wk|iWYeeG8>auW63oAqbN6qJ$EsnH(PXjKZabl2H+l#b3%cvVrU zw?@h$_|e^Sy`2juPu-|Z{_e{`6|$zS`LK&W4d|-!gkzX7%UgNSG&J$Dv1Ue$E>Zew z#6_l=UheBn5yPl8u7=o3HeJrn)O2&=)|5;iJv%2x&n}%AA)n{^Hx0h1iKxBSFdlKS z|22-P7lDcdiYb5f0p;rgxqDeDE5dRcG;x)gihAS{IH~z>fh3_sCX4)ye)hSO6^%_L zD-$X#Vk;u8W!rPoiqU`C?gf2LsC`jIs6DoOZ+oqxEMCe(C|M_+f2vl^qQ(hsO&60C z)qjtyCN8Dbd)>NbRF^LbN3f||V-LTeE_;uHa3E^%KdPDl{p009V16~4#U&Y(;B1UL058M$cE4SZEBB;Y0A;V z3XRBO(d^}8AaJPH{^sg+blAYwunP@wNPy(=VnrM~`rsKl@~#!u`?nY!#?VVWg6eU+ zrkP(~6|e^0EZWDs`Zd1-ya4 z5^6;4)=>hkh zt@_{#AQ!K&MSVtF`aZ~OZ~%to*8+%O?Z+uP7=i&XJ*>hy9_6w@`+2SCa4Ce6(W&(htVq2bz#_`Vq^cTR05&6~)OHyf~@# z*tEU0F2|V>ZQVel%my7yP|WJzqO|zT;s6bsTy~Oceq~U#X^f56Iu3IEiLDWS%g*CU zDa|rD!D2$G!9ctPh~U1eL&tr^%)-yd@Ko+|OHdnh)OY(EW-7P5IQ=OtAVL|2D{D%% z>1M7rKVZ}u>Bm;G^r)-goWn*eI>;z5!hG_MZ=HR}rAk!a#v5%cpdI{hWDL`C2AzC% zwBrqfLENy#^3I6jJ4x9GItSkac$;jp=mVm*9D{yM5S)T+3<(kpq)>-Fa;N3e_B;}g zq-{@y%3QBw`pyVJB7sQh6?QT z4=(uJeccc%Y)zU|+N|q^A^q68cquit8fSPz3w2T7`IKhF^_ji+y zT_i+MTz1Z_g^jK01iYK+2cu>9{9rO857^OH@6MgIALqwl*?dmNnuKyJ%IW-h@(mft z{9e-$PZ>#Sd6D;H)-!#i9af{FNy|c;TM|wg3LRj+yI2rTTlaZhW0%Zsd1!79 zh?h%3_Ynkbl#;50Xlo;jIHx)us8E*l0|{FwElt?QJWKWh$d9bjvWQ* zi)G~LL$*EmL5Ux`Hhy;XDHj#hCrfB3Hu}qFqdoyu7FhqP*hkx0 z#!X+(C&i7CC4{ZYNyZ{Y)~$Hqy0$wOjsux&~%QPZ~@fZr)4nWv7HR(GA^z7Y{hCfTv?O zcUNrJijO3f7Hk&C1#c|c?*!PGA(v>G$9o}D7WYcFx`1gjEAG3yaBthLFjtSv_4Pyz zsAMQEpz{EY?oVd(y0KW&4d(i|4s^@!RQe6RGzO8g%H7)Bf>-J-51c*X-q1^Z|D^Z| zdK84OH|@LOe@Ibam(5vic9<10i$xt2d_!|gwsgG0>D5S*3LC!==w){)MiJ6hdw3r? zSFB%HTRP587TDFkpa`W0ei8IXTK9ly`51Zj_yaKLt$6uZx&7sa+(Kq!XJZ#G-01@X z>4RIg>va!1RqAdd-Pjz<`8tB3u-wn_2b*$*7o_T8Y3B9nUkbg@-M=wV*3fyo)V|aa z29GXcSwR@l(>efYeEyxh#;P3-}i zk#mC7oSx7p)ZIT{k z1W@aHil=Stl%&)Md`Rv$C!_q)TZ_8|1~Xo+4;u+ybvZ}%AW=DpclafTp2iNVF`g33 zlYyz9{ox7YP8kTHjMLo-I};Zs4bU>`4Q1y_nk{AddTWuo2lAfQ3Cd9i;&@2T9W18V z-v|#k=RJ7F+OwvHB9r2&{ur@1KCTH|8S_S%TH{ zW&0BC{dj%_3$+qg{CBptrheeYya*gv;bv1}d&zM+U*;Uqv^4iuZsBV%`4R$Y_ARqV zqFDC@Y3z{DXj~@1^~?|Jq&mKF1Run)vc`+sn!`D9d#Q0}jBNsHeO3qkk}~!AVX*5p z(I&&`k)a>Wd2#b>A=YD+`MECqR#bmg8=Vc*j=JZ!NWSSPJH%#mZJe$N}C`)1WIJ? zxY~BoiZ;0eAKD~%x#j^7!vR{Vha*+|$FfgeZ~mk0#_22QnuU(L974P4!<=Wn%T;X< z-=l=^vZ((m`ElSP(_U}vbe3ATOnEbnve$VXWyk`QX;>V?X&y(RYIPHzf2j{o#*Hfx zflviNGRW_59`Ch7JEh7FDAYv~Rb=kx>wjAzt*4?t9lk&bVG)%^vp7+ckvl4`QTECK z{5hwjMpJq10>cRo5?7H{bTg?5ICw*}6P6Zh2UC?MQ=@%GKs2v<47Kr*vdFL($cJXO)`T z-M4={S`h~*)hOoWvC7A*Jz%aFP<1>|aVEVWiJQel)+LSv%3w`8y&t$Bdf=-Rt(jF4 zwc$}YWW@zfUup1apB=En8-KWIlgT?>k66l)|)`MpCh)A7{0s7W>b{lpWQJlhL|&Uz5C;OiH!uXRqUEGK!50^1FF`Y zrznX-6>$RrNNEYh?H0GD8pv8u9sc+iXZL-fhz8DQI|eWwj;-suO%p7v7b9bOvDOG1 zn(h+XD_CFoE$}6-7xx6ZSKoM_r2T7A%7Od;Mt_a}tIByVeo+(7DEO4U{cO|n|A;Og z>5DJJa<&O1DjA4U7de=?Q<~p%91LSx`V&{^^>T)C=n(`;>!kPElVxe#4pj=aLT4ob zHDX;)fM5<&+RZ5Te*+@`zi_ihPi4J!h5DNB_zW)5 zx)$wkvBvI&5jDK_+I0Jg8aW}Y6C1$-r|H8B8)h5_+wvC8@}n)NFrP^V;b_Y7mp`tA ze(!`NNx^t=2l#o&sz*jE7EhU;N*eUAUDY^-R>TGZmEb4{ciWggJLL>&4*jjr^10i; zQDhllze{dVDeYg>CLJudORyg!K;1%j3!oem1@$Y<%BFX zOP=~jvWpWS=+Gc)uaR`T2N|W4$BW9SFX{*=)-GX)UBCLroa#;%yEu3ynzD5{ES`=b zX=G`_^>();Ua#-+Cv+UR%!&;Snocz8083a4IKKNOIDw5p5$m8np1CB4Nhd@q+Qr#x zeaH_2c}qviJ!RzcDM}7b`lzFMlbnU#GMW)dbi5SFSxIlMTt)c2Tz9MH56q3YVM)fP z23zk}sMYFg38MTYebfU)WU%MvEfF$ntvg{bs%q7cih6m<*vw1p158EK#pRq-;mjR~87EL}cI^;dO zb2ek8*+>#a;bZ+`Y_T`i&!2HTCr?IlN9!pi94KU46y?vKo_A(S`=I{J&*Kcvv{LhQ3$|y{WfN|l4#3hwa%f2;)o6JBdtqMj{?oZk~NRA&Qxz-h>C+n2FI44*WFBPn$ zj0?hqigT}@akVQ3Nq{*n{P2>~0z)Zl*H)biYYk_-{lxv=GCiG#8DC3Y9vjrnA~Aoe z-&|CLj4TO~pPWO`;yBebXDJ{ZFLV*GPM_Kfbtaid-w!EKU!9v#gc>iMUyobt6KcW2>9sStFM$?Vyl69tg`DU~WHi#g= zOU2~Agn+gtfi2`SU3vu@aov#VAdmuUq=R<-a*cF!^PqWw$Fx3{ZaH|zjA=SIThC zt2>38`(E8owGg-J72;QbVqD?oKt}Ym*S^A$ydse=oh5Kf1F}F*R8QS??p_seor`ZB z5W>wkg4*ku2jjZEPt96Stegul{w$D;qD})D!86Rkv3Btx2=^YL{Vkyj(cIidhRytZ z8JeIj(qWXEpX9;UlObnsvFleD7}27xPbk&%QMHd^;^>JNsq#An!`p&{1!=_TU2qsw z`-wquXR-1d{qV8zrvlrD`6_|5a!7x!PKRJkOE=l|$uBoC_3zgT zAqniY_{+)LL!vb{%sT4>BNaU5wlT-DI>Te`t(fiBEE0dbo;$2p&{h&e&CSS<^KjvR zLq>+$Uw>n7w@FSrQOEmbt8GcIpm#C@3Y7KW%WShd{F{Q4)Sscz(+BFcx^N+imN9LZ zI3HxgrCE>G$ODBo&nnpuu6)4M&f-J5&TWAtyw?~{HnKWT3L~S=<8qkLnvMDeM}SON z*u*J#%M4EburSd0oazm_JVwzaa#D7yo2@Ao(W!*y`zWL5RyNI{rKAn0nAh*BT?08n_Bw;Oi6VTqh{x{SW&nJF^Ro z{5m=OQz3J-QwEQ+*uorpRPIctLfOex5Mp(8G!e^q0{b2v0-4!|iaTY|SpPoiK+|q! zmna9Z=+wrx<+Tj{s9sh%<_7t#6~cm~1g@oG(&uCfXT4jG+P&-mJ_ri-^c`5;tlw!0X{IQa3Y4_)$AhSg)AO#yrX8R1w#zL!XYB@y4jr?9Z+svo>G`$IJaz`ummgB! z6X?<7&C9h%yt=!!@Lm|vXNw+LSFYcaUvvr6OsvoK1?JhG>kTiu~fgG z#!8~H#=miwrGwR^B|ykK8}@Lw=J&;?C`GRs*BSK-M7jAZokVbQ3(IWpX!U(<^r*3v zoj|NnV__gAg{z>gtnc;a(%<`$ZDrjZ@YJgPExk&(TU~l{-Bjg*;76u=sS(5J&O@KE zu!V62O}V_|dX(k+Zp-id-GeM8x48|euMrbYR;{mFJQZ@ zSMI~Dk~-__;*Ovw0BH>C-6J*7*GQD*OHGC`!Ss0DFaL|iRd&w+cMkdf9w*d6vc`Jb zC@6Pvs1#nE6Xm+Ub#W#$mt~sFmF3FKiIW{dF|@df|h7DyXo8eQ;2|> z#x<$U46#9sGc~emDlpn!)4_bla$DRo4+{(EfOj@J_-{gtF7dHC$`v4$^K0E;B{n*7 zW^8}r)LH%T&bGlbEV1B_{g$8%E;NegfJ?MkYO8A=o4MgrahSm%F-*2a4R*4=b?|8! zSEI$}?ilnZ=XY3-{i-+X`3K}Km@3s10W~!Hez2>3N4lTj6+Y->7P)fEdr3ONpp>}GJ)l!*($bx^P1uyxnVT(l+XV?WXqGT{s}v`FgW*6`Hm9(kIZlPBfoT&8qdx zTk|<)`z``w*2F9DSRe0=h%`%7uv_0IY~Ae^963er26vc}V>B!)%Aap>H_%GkNlLtZ z(AFq$S-V|xuFTnHa(V>X{zt;ibsVLCL0Yl}4mut!ICo-R0YyoOj=A0(kO8WpiUxVQ zG_|%Az`HwPbcf57CtY%_!up0=-&MeaO~~Jak!v7f>8ei6Y0-X!4- zWU#X`tfx*J+D|NlIo!DVC3^S$AJZQ#q(}ONaz^q~R(Pg4%{FdT&!^mA=Ig4H5v)Eh zBP+~4BiVlQKv0StrfV!<$K~qQ_E0FEooEWVIRj^U7<9A!kMNk#v%|KdoVk>SonKx% z?ab9@pDi!H@7QICYwCF_XynM4|4f;CXJ&UYQKzq|VM|MRe$Bf%lw&*M zI^NYCNkc~L$C3Q!@`^eBm?-{lom)Qipb^h9D29e5e}S1)+(DGz9vfeHTx%mbl`3k4 z0|?v?8>G@bkC&ED3ExE&fxv*eB7xa@6pM7sNh5kbD`U$~UIPK)uB5B`_3&T$wF2o)w{Ao{;9#-^p z97NN~*Q(G8dSs8VY2tI-b1T8CBNE~V;vwkqi+hTm@9lbpat}SY_Aa?4HSlr1kY-Z= zxs{ZQV7hxW(2?wrZ>uBTt*26FOY=M3ML66?;Py_rT*(D)O|8)m3!RFL4bA=$hYs4Q zkYaQdswjAcO*5^b4_)Nig>h3=?|&pkZoJwmHfmSRSK5kx{i4$E%XXWEHPBRc>rr$O zDU?*m2py_{Vm`;Ahw3`PzmVM6MF*bi=9A}d9MrtJGwsfL=O6zu;YHG@QQTY6F z(X@rOoPT7)ot3|ZxLmL`tC-LB^Wu(g%_iKsTjO$JKG-^`3sO8J6q_W06KTVss^{CA z;^Q+NRCHX8ZLZ*ZZgq~$+k3FJe4}rPw(giTuiI+-8A!2A3;a3tZ`W48(2Nzvg{w=O z5vSBC(Vpy~+=adl?74JDB_w>Ui!lij4RttkpLaU9p-`mFBEdNo7T)zTs^waY`$VGr z(GHxWeg06G1paHNQG2czPL~_nzT83?XIggZ|KR-g!VZr`(Ws6$7m@oRbmV`^qB2KKCf|#wMkS-HPf?ISy8aW|XZPf8D8hNBi zI@tJHNyY7QX?RQ9!=;WgisPnLQWiKzH-)G_uRkk zJ!_rIKdkkxx9sfw>}Qu}@BQn%_7lxJ@TQoXGor+aTp6AL{gvQ0IW^5vUfwMh6>Rj! z*D4-&GJUW%Snv8gKyrGA1FAJ#D2iEFP-l4NJAJAMbJyLSn848d8QaioD9MPAP0I$k z!{3LQPL6~2$Nce!;)pYJF15baR?0>@XvY(e16K`6I=G;>;Ax&UI?1QGMutyk8FxE0 zgD4Ya{`r^C8vJ3Z3Lsl5l-nCu`bPk))uHKrXE`C{Dzd4`zt4n1^<3 z1$y=|8Tvv;2rb=uY%EuFH{jE9+DLRHiu>FFo5bO?i&80@6Bd zQ)-Td7D?sOfULoGv)(p!Q+!V5Fg3jz_MSoo{S34Oiw-eW{JkZm*40Y&T|ScQ@Y zI$gUBP9Li1kW>>IZa28Qvm5ysp?v7%8q)1k6Rkx?ruxM^2+h;%WSBx?+5-vFG4hR&Yu__^LVe*NU{ri8Mc zJyXpLtpSejl5Abef+>_K$2B@ z+oe#E%hFHXVfP9ReeMj%Qvn8Rp1Zf^vrf+?66J0Zj0Zf_p;tQ&_r)1DDi)q6wses_ zAka+&ld%WP?NK}KA$Tn#O2_@z2kr+0pX8@~Sh{iFO)sL@c3?*)9EPY764UjEk-; ztQ~Cxk}F_yLQl>Q8#{)PE{OUVdBdRw_$L2DwUPNef4mM{Y7Oe@uDx`W7HKGZnFhpC zU}uBk_ioO_jde(c62=19YiEwLEO0%K`9Z_O;dp}jBS139m)c{y?`ZKh-zm4N%$6Wz zXS|vu;t8&ug@hS00!$+gR`x*mUtKGuhCa#wN(ZpWCX{h8_;c?*$|x!mdTFO1m{#!S zgf6B8t;jbGB}{PHecxw32Q3g-sYXon&)kpu?gAyefhb0s^SYdE60Rt$2_7#;lcH+J zYlKS0c%Q@=(+_^@qRcvLMd{xqyjSDIEKQUvPol1+r~c+t8S=E-p~^$#G+Zeu%8jF| zxb%1>>IQehSPwAQxzx04s$CzN_>Na(Lrg8qK{@NvbU0U(vHzTt(Fz>Xni?FedR>su zJm~1#@4jNf>yJ*3>?Up6 zk}R0?Pal{}9s5QKZRd303$fty0J$QCrCqP>gVDtWtcke5n;p4^j=567Ue30jN>RKf1)n2X_|$CeL`fw9bUQCeh!9~6 z=gDmmM}J?%hk3fZVUNbhN$QMwY8a<7CMRMqRtg?-x>=*&vbtlu3}dkDw~&z>8PNL@ zb6NVuDKl1xPHz}DXG%LQt;Wv*8k7dCvk4&IHp-%%GpBW!-HF={Hr#Ocbi(uUU%2fN zFhIpP-C*0`JktvW>Hr-e$d6M_(E022X-?|w*+d%y$umzhx=<$Y@m)YHsL*^1SUNQU zL+8v-dh@nL!zgV0R*NpqGc84%;`D%=E3Dw zX6`{xyt$`CNK5u6T+TGV`eQ?gwxper@(g8r2K2~Tfv3ys;P$@b_WhJ$E=EAZd(62p zhu}o4J019(5Ti{QldF~kWs?N1@j$HC;{t>4Ri1xsy$Opy9(CeN^qM{N z8<5YrbW4~EkfaYJI)@i<${uW%-Kp`2PO)~f{7D0&7&p;uHcM$Oi#452x=3CW7rtUi zgs64DRn+kO6oUN(QVwan5}}fkw^0Jal{rL@O(-yYJ>4BEG&0x^YWx^0*w9py0gD@L zYD04-E4f}I2U^#7nThq1ZvcPYD74^%pQ{DW(C<91AC8_8(V1i3VCxLtaeua?3U55z zChf+~awwYyfE(%98ggr$E6%O!SkGQ~dXnm}Z2w-K2%N**U>~IgJQ(n0OgzqLle&+f zsy~;XraoRSI5{y4L%-TTtSz;nRI!-IdkrB{M$uu-jLe8%W@0Eb#s{nB)b!v*L?>_% z;gvRxXh-yM;Hmw`XGPSYot|s3p0_a@uh5iL3MyGBY!={O=+*3Ttv~`{>{#K|7u&N) z&60(35v>)gwHm;ZRP|nrJZ+}#(schucqtuo&=a;^yMNO&jWF`!#iH~^7VrM3^o(R3 zG704f^^k`rdBqpy=Grx{vsU%Dse(q9Rk#y8>DLV|2f@=gOe4km!pyY{d9J*yubQLj zSy<59TkysnK4ko+{>E@PtJ~fozK#9dZc^`+eVrVJH{WV-QAq01@idTR`p0d?> zF4)afmBQW9$S5*IBh+YR3FKI;tA6*hBmcn8bhz=$)Np^cC9g>qa9?WT4k`69 zA!gIgRsLUQJX?CjhR=g(ap68=^E7Ze$@HZs{n4VH6CTSImXdKwE6`M^RSO@P#K!Zx zX&p!(Ms{gAU_QQ7<)!-4SAMwva_c?=7!44B<;~uM1a7`QgW5`3$BhAH0H+1 zy=jfH^{rX|us6&vW5{bI$tXpkXP0g{EwH*tCA-p!`poo3gu%u1Rgy`%{#Je~V*-G5 z*S|LKDM_7Pu9V#_!RVi;7|m6Guq;&rI|Al^a}fWg%XziqL2aHplzB*=7a9+Zt%m`LZBlr$Sv=iJ7mkU5tO(S&zRy zX`}x6k2K(3v{a(WjLTNA>KpyE62r;x)yH7Jl@wd@3RVX00z6)xbfU@((IVj8UE$wT zw7G2sW%NuajII+BHU;`H+8q!xlMXfut37T69L$V zu8k{%Wh%KrP`Y1|u{hFtC(H(YNL|$N8;3iL)N|RHF;!n0j|si{VT~0Sm3T2~MNEcL zoc;yA;NZ|Swf0PxZi~Vhah)ddOV<%$kz}_Ic$Y>fQ*1H-MOs2Rsp7kF&BeQ`Q^%Wo z1p+Iri@Ak+t6l0oA7&X5W8!nrsN(q#Zse7()D`vW|!@-8Eba`SE-Q zk=va@wsl&QkQ|Nc&2K^6&h4TIqie;y(mS*cowX(rbA7<>8oIfrmxlI)rVFj}UaiOe zy;Sh#obqtRX#2D;LU_8i(KRcM;n&f63+^z3ij}(aCeCl5FQvb@VZ!fo8|dz)nD$~$ zBV`kO(6$V2Dh9S6JM{oiH>≫@EFVou1^g#|f=j3^_|$G;Dv#`e?-gZyQ9c z;Rf=GY>0nV-yJ#fM|84}=IUM7o5i{YYHEdH#&wjFcD&`kfTc@O?{tWv_}a^-QWeLt zO-npcpJtppHAI{@gV8w znig9YfiD=f*GRe`xE7fz9F}4Qa4D3$6^vExLpGf;ev=3q-P*kRLb4>i;6<*mvh{WJ zx=v^5U=w3)XME*A_t$Fck_Y!r#f~S-SZFHoa3LokM-C#l^7=rZ3r} zd7D=}JzxGnXI1y@ubnMuF60LSFlBuwt$y(BBqW*?qhZ^5JFX|O4{puDV2S>io|LiD z*g_Ct>@9Y5;hoc_Q1q-I>jaKw4rI11fRX{d8&A@5^w=fuuK43e%LLf$Fh zo+DH?;;kiww~P;dXAaZLXTRFGWVhoc?H@HX(_ov;yYg*>X6;ZZgWzGKe7LwIyweWQ zWscz&3<^Dqj-HU#cCIlUhzY-An9m&|H^25$qXzU1h_I|ZJ>`4B+gt53cKL}>A?$Xi z>D}$;{p8epTNu(_eX%)JFC80m@zA9!??&e0At$7AS8)>%>!J(S|M&5^bH0UH8DC{L zYzQK~zCTM*kGq$1LMqJwu_r&0^j7FKZ|mT&j{;|7R6>m+e>v&)G2s?OLI}MhpZ118 zlImJ4czKVt%Ww?gZGnPvUYDc+djxUDKDGDqz1U9&C-#NkQR1}qINRXvZs8MBu|?5u zwBKBV?%%!Q2@qbvClqK~FTH(TKNdL4s}!0xb!p#Rms3CA=Gqoch^R~Edu|=LV-1cv zcn>xKbnLb+qlf?`RTa`bcf91R4r0P+T=fM%Jq@fMWZ1N{n~@y>re;Xl?eX)wcG! ztaNS|nTp7$(U%lBz+t9QY4R>wQRs;E)|$c}!zw(Nq^Z{^+w&l*X8b0|ZYsEV(m%sI zkf;S72$Z}Pd8}yE`;WM!6BckE$<2EmTDHG0PUOy6r;p|ghopevl#1>N3w5nF*HGL6 z$mtZ+L9bv))@1s8yY>qaTX*%J>%|Uz?%kB>Zwl;M&HnJv958T95-=Rni8~$Q#Ur? zp(<__?YUNjUm8qYIRPar!R@ZW1WiZ~!h8oSa{`DhBmb^W?LIvvqZSYbuhqNaKYA3H z%d-n0Hn~_4VX}AAg$l^1_Y&hYH0#Gu_F^=^0FU@z?*=m-<*0wz@o(&YzsX-lfe97? zJ7;y^%~KBDXoTVI`&f}NS{yoWP#%6Ql%p9BCi;WkzgO-uPV*>Mi3iX|=xp6)qNO^h z+Z43sYfHcqs1blVYF@qd(L!^oVLBdHzSe!o2sh_2+WNsCT0;Og@$np?q^;M$fBQKV zdAx1^^#$HRv0|mlz~+jMx)K)UnjIoye$rSgws}t(&=zrPSh`k{Ij5?hotjeh)TEer z$KkAuOs_9Rb}#lyZlu0xzL$ek3K;}|eo2#urz0uvprx+s*1X)`$5#debv6D{%D47D z#6W{hHA(a4!&R%tQ~INl1=P?NRE-#NPw>!CpAK~`?+O)GvQbSF^<&t9GotCjT)gjf z&&Gd7PRbnHUg5Vkj@1lB>mUm7cmmriP2*CkMDAQZ;o~LJfc}m>igO!}+~z^Bx{knU zyn^QGJ2X0gRvPK)exEd8Sqw8ZY`)ZAu0O!aS}SQBGWqqL#+H^sugwLSv}&f6OYmsL zenL-4?80n0oS0b0q8Ag-Md)p;wQjPOaOcIB1hw+dWR3>sjMGZZUtJ*TX)kAN2lmJ@ zu4rF02dBm?!0hZsRN^D9kKtEDAtA`X?oUKY+fv3DPit0ACT_ve_qcHvt!fnp)*SNc zDr_iAZ*nQLa_;zyA9t1Ts{cC>Gux@VEg?9|DXZtHxw}Nwxc(!XD_^dCQNs0&8A!L+ zVqLkRDaMl>4WR z*NoJxPG>C(&*tjo2AkU3Bmq)sOrg1FqI&NZy_IrhxN85qv(plBH`a8k>WiUoe_3F# z^H^o2d$LITokxaI`YR)?4usLlrh62*-~Rw(6Y4%IFmE>SQ_3 zY<)6+Qdtu!U_xs)yFS)#nX(F+i&|+DS$dE{)f#LSSM~ z>f7ZOY1Q8P!JW1ZMbka-)4KXLx=qow!}o8_#NwVX5DMT&%jc%q5qRf|b1C@4!-x*X zyF3xCz)x{jc*)bLr<@Ld=A9c`k;kKrt>O{NOhax<>vp+HSugN3zQ5N-ahlp85;gfF z(jgO1E-4#1T;(@0zTf2xe*e0)IZ$pa0Q)IYIV}xot(`6v(g|Msh;EQ#CGln>$WCd6 zN~FmRZB1C!G}KYH`)!kGQ`RX&09ao(;uXz_!wo@+DWwNRUw*NeNO5Z6>qqggn&UE(*0%(+ZMC}l)A2Oh>cm{+;5wOdv95{ zq=gXO)u-w)0c(u@Yu*Pu2*|wYl$qvmh=)fu1;`>s}TEy$w@jY-T4#LU?x_k;U! z&oCmN0@xjrbZr}4Pm7x=g60T!3>m*MwFbbmy{nvoOezTf*~GLxz+>Oz9M<5aTUOjg zu%Th4^mtJfLB}2PWOu&#G-V-)Rz`$tCs{{LD6~i37p#e#{?!Jink#|Oao^u9q(uHU zPSWF>y1&qN@TR35?Bx|JA;5!Lu3bh?;Tf!|5!?M}IIx}@UN{@pyt_-cl`+2(f)D_c z!cg~un`r6bEzpFLqI3AQHkaDD;9$c&I+DSBKj!LO7U?xjN1WN|dC)DD>Gqym^ z_{!^jWwY7MU$qSegb}t$4zSj1!Q)#A;Y=1BuB*;mcN9t!x8*t_>`uL^Kj{2*JwS?M zW2hM00#*aCY0q})Y`OBhj|zIm?FdO;@>i^;ZpK)f(`yG}+fCyGp9t5iH8+1$Y3`8q z6B?t;17VFjz^yqW;8+XIyKddh=V0ZfB-;ES%riN`%(~iN>P{a)*lQ5W5%4O?N=s8g z&B|!Iwz)*y#7}-FhySji`G%)PeM-uqOU$6i0h>4+!YW3t2pQmyDe1r++G%HwOJbuV z)M{emZz?YvT~(irPCrD43K*<`??^zdmhc)1%42*s5ai0}B|tfqo>4ryiRAPos8?1J zOVX$P@rwyu`nE_M)u8wJtuAmV2H5y{c3d2fajO@r@ahnW_T0X{S)IRs8RH(FFahOc zm-U+4;!mNBN(Q5{t9J~&>`iK$zz;g2(pv`gudnpgTyM0+`5@9lbVwIlXfxXRk-=h0 zhzvSbzteMETlK`wAZF0`{t@5llZpK{v#L|p;sS6s#5_Z*tzC5#2d4<+iA6xpkvvN#$^u#-+nc-tJ9Paqu-3YbLH|cRneI zyiJ-hUb;qX7KQF4fpB$d-H#U_^S~JRMD5Oe41*a?c^ud{*dazN(v%OC zDtSL?FdLTFTg+e3YPL8y%nP2j0zN7l4dGSKwla0p^=EUjkdBSt_VKEzqX-Ee2Lgo) z==p}IIs@~)En>G6pdf2z;=F!XrnY64iR7c>9+_!a2b49Fb%@5{(!7#`=(g}aU-Kds zq#A!X44EB~m)f~ME9zcnc`68T(#K~ctz+7 zB~>!YwJ>hs8e@EW%o|W7ou2W+wOHCQJKeM>_-u9hf?og7^CB}U&oSaf z7CpD20PB+J;a*7XlAPJ-saStP2v#a8EzGQHsVRlbFdY5regSwA`F)P zZ)Ad1*#e)MTRwJy?KKd4sqyp0Qa7mHirwUTvuUoV7ylu^Ho z_+hn*BzXEdH*zam?4}6FMj{S*@g$}Q1KPXBDPvv>_DrQLJL^1C z$OEi6g|m&;-#amkisXp|@9JB;=fO$zAcx}YQpEwf7ikOHknE-F80EtCt^OR_M>cw=d z#aV6MhI#8^?_V%H%GRsGZU1n-*-q~W+n#K(*F0Q)(;D#ly59x_`Kk zClXJQJo_JGa-C(%?fqVehNxfqyOHKZ|G>ZAIq*N>wc2I;$D_RO%UfRl@0qZs7XOXI z_fr0E0{_aupOg8Yuy0GH{~LAoR+i7dYcRh)l$`N@DiL?ed|r6SH^^%RjT^4an)TW? zlnYKq-nN8gJb0zpSsx2&$@e&y?;||c_ohiRXnf%Q9Iw#M2#cM%GiMB8)~u-XB|o}Ty==`*kJ~1q2)Du zRjae@pNzeawV;^U*{N%sP_9&@e}jd6NKa4(WGkYOgj$XAubDJ`Wf5gp zSEyJkG;SrPlboFVLOp1_Hn?*W^X+T9@gK-`y|-_VNGtmN$o+QhZA`g~RjFM{Z-%8= zjl}}z8(Y4y;fV52XsnsDNh1DJct zx8_PTzNgcvkGL8bG1JOHs(;-_G(~9}%g=>OAkxRy!><@-jtM`PEt7oCaoh~zP4^js z=_~!$y3x}3+q(Qkk7>oI|5vNCXG};P2ca>@Y5l>?<{8TZ(~{Zo6rq5<6e3wF8hb{d zQCu-CEV}M(^`x*)-kW6YYTIznYt~%{I{jL zYjMBOt81ieM+o$350+#Ah|x7O{K_-l;LIfwa9PG2Csenk-RyiXP$P~X=VV6PFQ3w+EXwj8dZR6xGV`Dw_5ZayO)D*ttH2oaY z%-T|EOWw(%8-R`89eqhF9a6Zb6f9hIQdB5cqQf*Izzysbj`~vShN#D!ayc-;>6z5b zVal7p5o;Jo;RB8bD6&qR7hC=Num4!@ePz>@bbH$w14lvw4wK9R9M~5^2h_-UqpHaV zB(`D@ztVQ%Bikv&Vs}G^?C^38oIH7u(EY3+p_@a1o*Pwc5HE$&N!>pje3Fq2c`~uY zCUws}NlQe`K@8X1R||D%(bp)?b&TQL>z1y;XG~1CUN7f0Cr)fkcnySb7r8yARWj3Y z0}or54|OvApUVdT!~t>MYfiZd|2n1Q(fhE1r$0FWab~JkzD-KNXvV?<+WWH$symVB znL;!(7RfEVq-^G&6MPXJL$xDvT1b$?Fp+$vK3P1*YL z^sc#ylCibHLQC4^tYkf`2GL9ppd#FYz)b*^k z?!GPPK*pRmyu`qKda*(s9p`$pAV<}!JGJk}4>^~;j6hc;_G;Y7SOGsF#r!N&e7$%N zAEfZi(%dF%7jNy41JnqI{;S&R>+xFbvIN?z6iBl`~4H)?VcbMggC zun{mr_B~8{YaQfj;dpeB^LZ86jvqVZ4^Kvy6di!3<){kd1hO>>Rrp8AB<$?@77~W( zTe4L$G;MY>e%%)I-WGNa0*J72kK_t4NGOxR%q7dxp8QVWA7jEe)k%T>+zuc5X7Xss zPTu|eynxKC{xKj#TSdBD#moM}lq87KB_)e(ejGff;z$sn$Qo%#*T;rFxaWJX_M?`5 zOK-nMB|aC7)TTo(tE)99YK@bAR#W@qCmN8pGoG?DQV~wgV;?5&PV>fMJ?>(r%|UJ8 zu()R|&zd@KROboP{}hR{kcHX7T(7{$p+Q^h)v2UYg^4-K6Sc}}gJDl1wbQf|Gy4KZ zAB;Ii?{pNpah^#6XAR%gk?ZUjcV9Wz$Q6r8+HXFnl9H6`k^;mJ~VZFZm@I#q(u_Bb~D{~1(E*9@_lrObpdri>9Anq6U9hM3H;he#B z63IgnU;e_M@)X|~wrDgKK-8t5#><7A(5Tp9PrhKJgg7eBI5Ipt4&z?^^FJBaUuxES z8O@7#dCnAgr0aj-4z^LZsynzpC?$#bz#GxfMDwS_MC(7FrlydAq{sj+0x-!G2+ z;R$G9kDJ`PvbuWEv)}{}D5!IGYngFk%x#cx>bXwfxc~gI&bU0@Mpt*~+SJ=zW4OyH z-HTK16!N&h=~S;%P*q&KaoJl*K@IX2t0cuOzS+y2HIiEE(5*NexwR+IBWo0HC$alg zPbqysKSz6h4P%%|vE)8gw;}L?tGbtwXfBH`eDtX?e;EAWg5RB}4+EQdd7=Fep`~HI z7hG364JcXh`0fQ3_8d^o(KxDo#cQ5+UD$Yd^9znRqD&w3zF!qR zkZQFGZh7a2q^g_ai@~%EEmjJkMup2_wQg1RQ?@Y$rZpWhyyqh2zUHbPie+bMr)bxN z2tiJFTzKjpdn+RQ`L`Y9m!i}(mht`t#SEBN$014N1yNNnUo%ZeGX6{_pOISV9`)gb zof(hHUpoKH_&M{cnUfwx?^&$5`ifqb#j1FwoZp&hq4uJdP$~tosk(9yfC&v2R~YwY zP@P=YYsW7$+=2g2J?3Na-}#9gi;HT;t+6-#bI+^G&1?95Fhp^rZA5cOIMlYqjNY%< z323g7H|e+Np52a?cX!q)9C&gjq4mO36Rt&;+?cgKGkH|iL_7AJD{n>JI{s&rlxMqF zMenBC&hbBjn;6D(2R_x-2WRpsK_we6{K>u}%8<%95d?SXd29Sf0%ab{QB%yQ&agpu z4<|IM&F}zif3f?29$Nk@11#|+o8?sCjpF%6kwkj(@ltMkfI^WdttpS5qTb(*3pM9l zj&I?JAs;l3$R{P|F%};0k_2EWL7}_m9Yyhj-qoZE#^>`?-yWTHtgNvo{f~**opC$Y zjHVJp?P9?GLF>L$m_Mn{`J;|1>@}?XbkWe=sEwYBC&u3N;n&8r^fg1y+Noc}u-9OW zZV%oZ^y*pjQ!OGqxImhql1$Iuy3W{_kFEQJ15;u~qNtjuFoe5^VL!dT+1kmccVVBk zuFYz*0SK#^L|k)^8a<&d6Q+&tm=@Il?(d?2*H2AP1~y(Je=3Vk-!Z5cc~UtF9BCb9 zeAvnDu~r+1CXC%#FH0Uq_2`vBx{(lsQ%uLaF%BCW=Dsyu0K}kQ+e(3vy^jdKU_iUO;G51=K{b>bx7T!Hm4TOf(~_bR*C$y|kWvo=fDMRcT!yk!F?C zPh9nL?9mx6HKoS!R0cy`JXA3((4x*yH%?V6ay_w}d?nLHcG!kik5??8gxC_(k}G7a zeh3{c8-9@6>D|d^U1q_I-X)UfOxX2Pq_w4%5^mViPBQ-;dz6UT`NK`h#NBL7+3Z6- z?v@CvuM5;w;ovP7?rmPuov6eWLPDO4IA%MK<`parDeA~oYTx^IXdw3w2Y8H~2kXjU zGL0fh9xynL(^knOn{yL0`LMEc@-xqPjO^UUKTlXYH@ny!C5y+aaT{a32JJ*oOsTi~ z9T?N5ZOJtLt?uLY;NU9OzT_eM~F2z;hQ7ei?70wP_D^=5E157y)yS}qLs!vC(;(HnJsMJip zIekZ4luQbeBX?-L+t3UQu$&g`VrH6IHMy+;+!1PjAX*vD227%7f|fY zet#FA6eZCR=9)_{P*bILiRC2zHR1ktxfa|18}dtEz)GV?WPg{se$8NZh-8%)?8+L} z4t*aJmwDeXoCovU>7JFN4bL857wy!pP4wsLwV%1+0$b9(U$&O+T@h*oOw;B`MjIAM zxjz!oQEbXZv-$6vm6` z#({5FwHc$HLES%DAg4Hv``+#mQ&Dv1u$~(&)czRydKLLmlQDS4zTU`WKWq-U;ogW_ zX+fph7{&I47C3_I-{iMwgp`CV4Gq_fPV6q(OLY&Fw*(h_2O4xis267sZ>WcYgN z5OhMJWp5=NX*T6Dh{i2aWoV6yTB%PI+qcp3yve~e%M)>X_b&&<-c&*)F7)-4F7$bn z`6G6KrlzFgF0xu`orMLMJlF zVUdwo6G@lvtBV<>?dy;7Rbr&fQ_~iR(;6+Fb(*EV-Q8%Z>O=z?Vt&I-guWH<+w7vz2^n-Tf^8;<%2F8_{Hrx z3r^%EQ1RJlXA}Jv_YG&OF))^pU7AFBfIt0Vvy=MIM2fUap5B^@miS^dfUWZ060G;*KHe37l6>m z)l}oxGGE^a>>r;s;G0tqa<%T6ccP?+pH3@TZ?Khku->_+vzOh|4u$bU`x<1MGh&3Fwa` zZ*;|)jz{n&jgyb=cN3VLfVF6Lh`MahlyR(Nl(Ua@io%}$p$oN zB14Pq`C{%6I*nTEYG`l{B~#VO#nZqEBW`;1=IS0z)STs^)|Q(n8aBg^uOj%C7=u2W z!tqru=5@jcQl0+em;0EhSE>YyA$x8t91qVT$)hGcsfng`;KLFeHja;<`VAS{ew$%o zn8|C@M#HhP#R@Z^S~Q8Dk=YS~&1Av>gP8{Pc@k=~ajxUs@Dkt%x6>x=3S`jamSt`U zKQPopZ5kVJa6nQy`81;$m0seo{up46`_eh(Pl~Z;tZ0BZD*;l>6#IG}2=FNS&phKp zU&}G)o-IZKg_UH)TopjmVIV`tJ)K?S<9I%o>D4}bdLq?!T^Q{LlY>>BIdKChZZ08e z^pka*DxsMD*!)osMq?P+Jb!o-Knd`8vwvl38Qoq4ZfR4 z-2&XH?N@69Lxa_!>k0Vh+2WpX<2u%1byjd+)x}L?3lwm^`zo}5kc@{2CiBlyK3v>f z$_rs38uDC7nFu)l?{|5o2>$0$uk+(M-rCaLE6>baAcFQxetP#TQGqd$NF;C7&Rm{~ z82D+d15AI|y7Iy{leysX^YZrjvI|yw3Y;s!nDFs(KS?HhPF&~$lzvEg-)fA8CvMu7 zq*2x4ex9=qlc({!(Vq(mRTu&3b<=(oqQLd!@On0k5wQPTj{+?4Q~6QQuMC8gWsvGX5;LAM4P-u5%+3 zU>!y$VoyOfdfGJVRX#lS2QEk2;*MKTHf_Dqr(xkxLxbjD?eV9gl)uMfLZspuaqf_A z1@+zi^Xl{aUw9=6#iXBxHDSgYve0u<3!pa&@Y!=jZu3Um;i2>S?7C~%BJW4R_J_i! z-D9AJnUR6_Zo2QnxfMFn1r3ot1tTThF^<<*Yp&%sEXC|gQC`&A_IW>&WLZ)|$KupC)zm*%`Zsb4TChwc zs_`*q8?5D~pmZJOX;gZt7T?pw8yE3KtqQ6ugFA_pKHLljwEmfmeCUfi4qD;`XtoXP z{motT9Qo|L&6v~}E!%;BHt*Wo@($|i#hiW_^|+h+PP^Om`6avzuf2KZ6ViOG^`UfG zY|lTF-<*Gn?3$Z4tHNgC&CDwE$PbNU#2v-QrBw8!&lEJQ)?R6_q>>FEBz2r6AR#_ zB%|m#|4;y?b*u`E zPM>Gag^nq=t))Ci;lN!dkkwa%8RH@^erVChRhp;s3k zvTdWdCGbhkUi@kcF!&ihsxf9}BeyYcGE1F>`;0Xd7x+o%yCZ+FcwL8IjreQ!Xf$~T zq~hHVg-K$u2gSSC1VG~P(S;e$CqLhi%r@DIip$EjEVCzqyG$H{kx{jdAIy`rU`*nB zpo6LoO(4h*m319GCiJTm30LV+W)Ef`PDRYlPnqQ zLG?odD0qJ`q4z=G+a_-xL+0&!QO&%7Hz{bnQ?Fh$&ad#T7hQgj?&0z==mV+v#gaO8 zl@Y@nyLwkezZM`~NhGzLu7dFk)EGUVN=@`P7Zz)oS`WoLWt%+LRB?Z;N<_+u}{~#aK^OgsR?YpFxKc zPY9$`ZmR0JKl34XCmjGK7>-$L5XP6iM#RFgvk-0}mRK@fv*8Pk)Y@-m{p9ttuw7`2yDE~izcjB z1=U<54qnDRWC+48du)4 zETZoxt!~PZBcCBR|ICDxejV5nKMF>2wS%rFj36i!qF0iWr%evZSY;r>(TRdB9L0b# zWx;QbDP@_R@3_scfni^$w5|awAc&6$HBildpe|$2|M`>R{H%e!(+jmP#xDHwLPz$F z?4{;32kjg6$xS815B)aD;h{VrmjYgPqCyFuFCHw321Gq@H=IvzrQ`#F1z>N}9reh4 z;*+ZuWmj)SBUxYMKua%wVN8)Vw)1Km4{agdCKI$Nsfr96G3O8+Mr@(OGu#*7zAewv;Ut@U2q7F*Zx!YIPM z&nM{P-v-_$#0+1UK7Qh3!^$Q&z&nopAa+(de_-~*>W|@XbYyXb^3FML@04>oiqVFD z)`jjhirU%T=2g|U#RoT1UxE5Q7m$YxxM%Px?q`CFkuCpZK~z>HMuR%90^n9U6;DGx zZrvt^h)`9gFPpkRWVY2zqxToNjPpRCrq^gnk z1Ic;WW97f$_8xi9I`(0w-d_IIshq>E>^`BxQQW6T-jayK2{MSsOVWuZhZn&0)};%s z=$?lp=Ai$6HCFFRPanqZEY$fhicKL?yt&ZRX%y8C)pb$E)eZyoNkqUi(AGuD@4p!} z`Uwg?QAv7%=y@jA^6D-7^5I5F6KEkyC)upWyVGV7tC*2lNup3&gsdIk>Z{_5MY zPybs<@@HeJsn8~v(xMy6>#&;FoXb>3b>zd|xp`;>6vFPgo8CFp>y-UdU;}wBqObSn zxjiq%=ms7`$=IdAz_C}8h2^C`;CP}#@I*Irym{(;%UUskkICzOi_7V~Q-KiE=>=f( zLqmWz=hi4r8T}V%L6;Vu6aYWJgOdNac)Vu;29__5qXH;@$uUS%qws2 z=L;(0r!LIUo2!905q%i$Jh#ZDOMAZm#Y)bnDqAWVyZXlXoBW=CEtq=y&$_c;Z)@mYiN5MWP!#5Ft{?Fqh87&mbqH2C4FrPqr7|6uPuz?xdSby3$+?1G>m zMZktg7wI*M6afJ#p%*3eB2q#xDk4Znnsg=f5JC?RU_L)MDB{rUr>(UlGs zFUcmE#SQ)ux8<6$Ph&-6eFwvWK5f$KWN(!g$U8__&6P>X%(xdo&})7U)TYg)ZM^1{ zgVLz>3iEW4QsIja-xF5`gdcXBc-^uEGQC17Xx=qak2f`<Pt6z=k>S|g$pI1k$08Q^kNF7`h$WhrF_r>A{L)DG=#+;U}aQ!?q3mXV(O*+nNV zxr>t?0rsxlHrMXxE2+onPQwSsQ05EN_)-O2*H%9WQ@IvewmMq}sUtQ<=pyJreGf^( zgbKy+w>CMbfaOk?rjRhxhI%jF?U@%k*-mx7#$R~#WGjnxbSnF1>PPEUdhZtD*vDW~ zOaT!(@U5|w4wZI=bcwZ)TRXi$Hhg-Ba~>(Xk$taa2o?qJK5twJSys}yDC%Sc>K(n0 z-{}8zLwoajF zP#PeiPZ7q2r|TJycZgxFLbS7W-e~ihs(B{rqwR6%)O@z|f`upOAij0X7TXLCK}=@A z4M7$4z3QL$mnopOvQfv!5#ymvO~(M!*BWJd-s=N-f$l)2l4RJr5l1n?GnCOqk_(el zHJV1+A{XU!H+#~%?7CUt5!p)gfYfJgTpNrEEg;PJ8ZYJ^)N82lpa`e~oI@kuT-L4O zX7{&o3aFBBEuv}f8v)sU}7hWdk|7wHReQXEihG&rawMmvjB`>{SIYLF&hdZEiEEFiYfm`03o~-tONtW%LJBTBd9D|T z$b=Xmwo#c#Q&%|fbgwob6g@*dUl>=Pla&<^`0^!Z-%=+?Iq-6xH(xnSalH0+ucF=E zhsqBV)?HG?8;3j{5^v1ycvjo#@7^QbVRnBP;5ha%=!B(Vr)jJ(ej5UTZ!#6X9_wxz z?;7U`ZOZseO&Bn~c~Sy}`~4{kHScCa0_4M{PY?=j#=htF)ZchOBG#f_lAym z$BhnoX%z8iZB)W|USzVTs3dLWn0GZsYa)oRK6x-jKsX{^5U{S^ztZbsI1u`w6>wg$glBs4cYCpeZ@h;*f&!g4~q zqacv~R?!uPAp$cG;HVnovmN+sp|7@a4PwxqvvF0o*dhrDNG_M*A+%r9tBVDDmTCzZ zbhC2Ze<|!tSRkm1vJ;5L38S=#6E-FFo|7-g+H8$>zWU$WGPO^_I0ePW#)P-b4G0^p zRV|P<#KH04H+FJvoqe6+1@ZKdBj7OsFe($XluDfUjR*HPm0V-qx~C5%f(iAVFPkJ+ z<2S&Ie2&C(yf9TAevU)6lVQkq zYoG!Z4I#M1eSV#N-2e*WzEf@NZpzR|>Dv+LHF@Pz`{fy&o(l6>R8{mt4+$c_t=`lQ zctSXCu?#69sTsRrXRrm7Esrq;LsZQ6Na@+?e_Ad+SqPUfr$D zj$ebJk4@!?E{l<4iSfoK9d{RodH1?AExv=qh(_`%JE@gu-?W{jzMO?xriG3l1CQ~z zL6@t#Hd-0YnP@W8j>)@0(}fm{0``E{c^+cS)@$yw*I}STU{gxciY#GX{RQ?8 zrZ(mnz%$4!?jv_nv>0HKG1OWOoQVz#WC#Os9vQykd%V^!2<(k+I>jd@_cFxOAt!bGGl@6Ie4b`=9iRuOsqbgYELqN#i-Hg>Bqt zb$a3jtdmzB!9KIVbz3wHkMfj!>cdt{86u=C*5O;Va(Rn2m|oaO3yk z7wzlFni^SD?gqaU@Mx+Po1FjF(2bGP->EYj3lYJM=NCbnvBF5wZUHI6ykQlVDJx@W z)UyT(;O4z-=s`@r)&W<$Op*|l42vls67iqEr^9#}1$-yzc&^`(g@i7tgzeRqrSF0# zC~4}kDU1cZ5|>0~t&GVnSvr6#r10-Vzde4GVgH3B0DicIQapdNBH>yJUC~Q;v}mr5 z_BTfK<4ZqiLotT`oL8agx4OM+r9QW|X~TQrdGa8KWaTESeM^2-9*x8i@{lyk?|E{D zaWf3DpdL^!Bi|KgiOsdDJZIa1+*h$Nk_g?BP&z)d`jweg(wg#yV7wq#P*+#is~e^c zh6fd&7s%ayl$`#C)`R~nB#foqL!3Tv|Inzx#6)+bY5x$iJ3}e7k)?IQ8p;PBOR(rP z=4}_fx~8Fo??n_X2|yZGst(g2ySg$|HGBE5s;uoMvb6TWE(&*a-3yigZrJp4QiADJ z!;eGNi+M=EX*1Iu+rFbKuoh)@4Ioq9y#mAXT<9yo>$+LabZ4t)etsKAqn@eUZhe2r zs=v^**rM~2Byk#6bvWiEB<%S|amCxbYZliUnH1yKUH2OQ{ZLKiRh49_Ggt4v$Hj2H z?2Os%Qzynp)HuI=8D1l#G79tX!Mrq^>pY!kZV6lrGzub5U#P^-ybRS9S-W%hm1kSzj1?CZ_<;ZyF&qEMP4S}`d6=j)*!tobcK>Zw+ zg0&2a$U?ynZzmz`Oe(6KD*g%?{SXTv!ix*Y}| zxgjwJtEh(?gpKY7R%z1i&Uh9dGQj8|_C`z7_T>dvZoBV!2-qL1np5!#Ox1^lr86y! zGrqJ12NP$KSYIi#s^3yw_8sY5d|cCM-s;S2+GA_KVD~Vrz>VYE@_rT8cjoKf+Z(Wd zETs(tTEHWFQX2CVQSFR-C2X&DH=dsj`J@4^lpxqyYMbDSN1zDw+Bg2X@A&^j{c|cC z3Tby$fim|N?V%~1uM3uU4LH=a*Z?xsY5nwMOeaczH=yW@;Kb_E8w_qBD|3gU|}-`fN3O1X<6)qh(}B z8vQKwE${O{jPQ>H=(m?p-I9ZHnJ?{^zL2pte#8SQRu{Dz-m2RL@$%`)c1Wy;k-JsW zBl;yZ1Lc>-ln#!sbi;Yhjcl5Ye9Jy~%%b!o+d4nMmWm-4dua@I4&Y)Da(XsA#v9fz zDTpE&B?vk3P8Knk#5J&|$eVm1#sF+@yKeow6hX~6cvVZCwUNOuP~UCaZYV9FtIHw= z*OTTr7}IRp+P6|XXuJUe;*!i2JPYMBslpa@{PN!nL4eVFP3O2pI${>b+acNIie?L?JkbrC*__=ksf%HQi>QU(+AYre>5BrtcnJZ>? zXU=_j-p$}v$CKORLxz->F_OZEL9tpGfCaQyGr+vD-i5@#6Gpsl+@4(E76wjr+vZu= zohYy$@2mRsdv1kQW>xWuj%^9nc(x~-*R&;S&pgpY=*qOlaE<#?NWTAD-HZ?7sR?e5 zWSz2ZjoCMcFVW3c)*U&f-392!p9aI9*bq#LFjEOSu9krY-K0yB-do*(?Flf^`16EK zsx7w1patu83$51HxEil5prJEBrqA8D8_>8@!bNkI!xhkCE9{NNP%jYj2}|7%o9WNZ zsO9Bl&dx_V0JZ#BMDW`1C*MPymXi6uSQ&fm{1?L`EWPtaO0Xsj0r{BE2WbkVv|qaw zTmQbQRIrsx3q6Itf+*>YU)r2XVMQ{eObO(>mRJ@U=a!8HE@8wLCk66N_I1qObN)r` ztPcZJ|J>1K;jM#(#GUrrwUYGMAzcAGZ6fai^Y8vACDHL6#Fx%ew*f(jH|Go;y!n&$utMx+ZICXiU zHVl#wK*u-MT4g3VycWcF*yw!b0v0g#i@kHZ1bMzmj}I3B`#}lbPW~duj_5H&`fzaR zgOBpqi4sprU-&W^dl3hqSKvRlM zs`PQPBi<5s>zL=AE0r4y3B+{b>uc>b7YnOYxpa}I)0?q96ox=}IIpH^7v1c)S4{%g zJnh6KS0Y?dsgOBOjDY=Q=MKz=bY|>j5b)W6@krM(yLDN&UaKVG*?5n!U3Ahp56m&S z;d3Yn;)D8lkEV275~bX#iud|7-&kO`b3k;9QP8K`%pHT@47L0;c>pXWt@TUpRUGu^ z5#~K?1iJG4WI6lcWOu#bxXv5y3*|me?+39K?P~>UcLUGa(bHz87t~BicygMU+J!bZ;8q6_nlnG)KFwagmx!U5!dfp(WK4?kT}boINuhtY;M1 zp=U?q!4$r|kPNWr$^IZBUp3GTz74R3Gj+4izeuOuKi$%A8w)|8nS7d8U!HgxU;fs&> zX$navqanv`8T${4Aw3(w;6#%TQHG=Dt+8+hJ*#}$_{Yp7Qa_iOeyKr z<&z|B6JGJp5cVXgpsi*wwU$2bh}+cg-@~z*T_XM!FGRMc)F$rVrM>`7W(jVA{tT)FY!g-*hEM~ACTD9TYLu!77_q<8pk6NRi6VS8o0AEiw*5e@ zjG4**oam1*DP}S0SCAbP;@)iPfHfr$SYfsVAgQm7v8gHCKso4vo565Y!!4~5#v`Q& zy&D5vZ9yW6@g)9VAl;v$JU|7_OhSEG+P55k@gV$(Q{n57(VNGfUaT*B(F`608%IjX z+_gyt^4Bohbj8j4Fj0M-8Ys&U0>EK{T03`eNpq~o^Fo13Vwp01Jagd#Ihy_lf zbUs2Wz2f|7J!nXl>w2{76=Zw|LpMwZwF;EUa|z>i1LxQz7#8d*P^ud-m*4FO{Fd+Y z{f>8JVS!Ell2nVDPQghXVH^^CQ;O4NGO7F zM`7+Id!wPXX@5%V1;$uI7uoYz(B?3#BY;DB@S-NW57%=FFYzBZ^xI=N;a6b1xIR#m zB~UZVa3>XF)0t_vBKF!Pmk|P~XU2rqs!*$S-uQ`9&%lt9yqL1p^o^=jvx2GLnim&< zl3ej$q=wuvuW1DZ?S9R?J-}JCr=vEr^o&2g0fk6714&60txN?jqvOV3d>5xs86&|A zq5XW$^L!T;&ZlUZwm^D-*g#f|m+|_FiwpkDPN+D?Lpm_ai|-!7Z;jSA`=0_p-)G7H zPo!p!CiY}Jd*q(dQ6K(@BYP`RZ;54&?d32jGTfjR8M&>x-2*>OnIV#zilRe z<%@oQuOB}QdH?uf@$bh!Qu}uPIOW%$|8-Bl`Suuc^>JerDVv5zz4~rHl_{e}LWZ=f^(3_U_FC+1XY?6R~T# z*mDWFm%3{j)9-;zUnyp z&X3R%%QGZkCt>JbH5?WU&bnvlPtMr;sm>okb-`LjS~}~|r=zx`HFfO2ZTt55GESR6 zIA=`Zd~xlg-DlVQ69q@aK6Jd}u4nqa^TiptXuc~bfvJQO@>5YDpIg=#qvDdOD@?(^mP*~jMJ`dII4ACG{y#&D4X zPM=%6nU^x_>x)DI8mYiJecIqj)|0ZWl6?`t%p~{tWl;8Bb@ctxUe`IlPVoae;85yE zrr=(~aY>(hU~eS}T12fn^KAdst+Ruk`DVJNGudv0)x9B6OUoxTO?GFV$pvP?L_7XE zw;MIH&-=fg1S43zExb|h*&7W1s6WmQ`F2{(Hup_YBPQH4whkdm6j=NhQdVA6jFc&p zED6DqMGC%@^M|)Xw$K0dZ~{|6U3u!4>Sl+Yl@K>^<7x#h6|g|CN#IplzV{LKrNtM#@r(?y&Ek{EPn(zITGnLnWk+3)4%4?I}7`qR_HQN_8gC-F@ zrRqK*234&U`$gXmIN$&A0qp%J@9n(h_*F9e{8N?j|Dn?_c0a?p--L{iG)}~Dc8#%| z;J52Nd&*X|@t1emZ|2SGkn8j}0^wmh3RmGCSP~6ZPB(0RL`+2ndj3*Uo?Kys$m|*Nf9|4Z1KSGQ~oh zBy6uCa@#@Av8FuSNqLiSu6Qy$nqA`>^0q%Y!+hg|JsC_%Ny)A+EH#K)%vU%-y6{&b z^bcZJOOSTHRDlbT{q_tKQy!l=<{B?=C;M-OnidvW%b%NJkfu-_md8H(BD@yR9NQu1 zf05Fa?rz+7>@$1y9G^_pzc_PiFqW5=E5G3KZ`&b^Uv_jWP%8gOf^-DPT_l+a_%JSdjay8sV@`|CJvn^^eJdQS)rtd!`%P$>|0PNbwNjsZ6VvQ6$Z*R;Hz%Il9V=sfgOcm8|F-@agcUH3k0 z_%S*nrS501?r9UB%T0UA^SdHG9WdnM(K1tYIImfEXB%&yt!+B2+Q5E8##yy`S*;5b zqH9L|CyV2#@=4j-85{p;;re6r4jg!T#=G%og^Y`S7(mNsrb@#YoiIq1>m)|bEG>K?EH)haV{qyeodr#^9yP3HA zO+WD8&piJx)%KgcN0I4Fkdf{ozo25*=1W|OAfw+?0JEL6A}@VQkSJV#fBn3oWo zB$h{#hi*O!nAI-Xe}#`mCx5Ar8&1X!Cq1K_)n?JCL?>m&@tIl9@SHnKCvX!Y#~)pn z6J7eWg~4j*JV~8F$mXtFKYb=7?`J{BFMPjh_4l5g>pAw>r{@ibPY(yj<@EJwD}~af z(dnH5zgD(}0@y-PT_pP2B}SdCn&;#p@@{SqLQ8f2!w$G64k9^ZAumHZVA}g zCZ1K(rJmK5v1FsXN~pKURB5Q3++Vz>Pt*PgmjUm3p*xyKr@l-w?>18=uVP=hmfYDK zaW}-%Vrki|$M%t=(%N_tpC>dtI%#Btk?vOyu@jH5`(5<-)c=NR^ft+r@>>>ln$9O@ zmb8gJpu=(Ll9b;GIg70|M$Ka%nfFz|p9w4FMB$voi{%KBQT;ojncJHubRBVdgnF4- zL(3rJ1d86f@V4xQ(@G4~EC|}{hmc-vKPFLhZUeaT-RNz4L$Tl$oVT+`4555#nWUv_xVLMa<^Bzl1H5`)UpT8r5!^8 zwnHL*B}K4fnh!245fNdUoBdY3!pV{mkGqw({Y7Jz!5wB z<xU0PS>s+^Y$n2VE&f=?DS=<#WzYS3{J^O97U*DLKhIF8dM<35H5^?Z@5 z$g))=_~>QZW*X8<+Ex!<_#O!Z8omLb)4iel*X_TqE9+-V|3}Xs*c&D`Kb%?^@1o_x zI~m<7lL#72${RM`c52Jvq?!aQi4jLitMC+-hUV)2?798DJ!|q~Mj=s!_Dv{Qs$^@> zEnWl?6SM1ZD?;@kzq7QuNUp9WM^@FF#`YypiG5vTR4l??bTa1;ZuW0?yKo0+ORUT& zyfIy>*k$Gf{dKb(V+ce*#4Oy*MoHs|C<2@P49uf6p^+NkWHP@+FUo&)V!}^kzzn-T z%lF&$4Q(p^GY$RoY7>r=vUMyIiZr}=VfgSS%QhyNV(F0#^hj`~9KMXxn@< zjL~br6>3>qwa%ZR2Nlu(#aFU_uR{gr8z)k&sp7aeIa3OrInw$xHgG-~p;w>w_NQR(?1TZ1zzf#YoZ5FNDgBBar#o+Lk_Sr9Ov>}W`x-7XbO~6PV z8>M~wcz?wlIBK@H`mB9M-i)*7vAbvh*0pI*$%v9#m)$^F54*yIR?@Lb9WZR6OCmxu zqFL2Q6?{Um$)|Jnf+WWug8kobc^FnZ{Qr^O-f#2;VL*C4be@^N)nP@|9}HefuK>i+BT(iTR;Eo3b+P;{ zamc{er?cZFG9tlaA-5;=$UCES97`SnkkxQGZnB2-asj!Jzp!tmJ^rI@dEyyd&B;z; zz1PM|*#7lEZ_O>TyrPBWcb$_uAzqvcxRm~^bO5eS4q*pkk%bjC8-?z&y3zYR`O)Rq zo($idUF+)h9mta1;6)^?7kEn=M|*(v4Hk1Q%8j`z;l=bLArR`V$rH0;3k(hZQD7%j zqb5-8?)&yfGt8u>Y;k2Fi)r@5o7m^*0{N!MTn8k5wsBfinOpSaRc)CJEJw*qfW~VZ zYH)Gjk9!>W7v#OUhUf|eANeeq+{TKE)+{(ZQ(xevd8-gQ;P|%eSUdcY*3ap*&FODn zJ{>P@cH%^D+Al~*0++1FdSOcQ{X_$ND=6#cWx7{Q^ahp z%{^!B|J#T(4iWm?TUbr?2n1{VkrU3z2=%uZ$hv0Pa0kjz)X45MBW@p2p*4`&H|Z3X}A=;O@jZZegBU0M4*FKBMyO zEIbPQqj0|R7+p~JOMvXpAW%T9MIJN$Ab59s(+Mb0$Z|EgWDi)yUE{MWxg)O5G z?B4njV*B?y@N9{CZlU4R2nKC0X87wUu-WR%^DiUHoIc&_7#h1T@cuxR)dYIb@{>MQU!Y7M~& z_1&VA?EBOCampVc&w))@J?E=zX;Mlhj@mMZtZzZ`> zuycMXGa-`Eh^IU8tNrwh6o@?k5pVf}6)sxqBOMlFuvLu<4}xggbs@h*rvCu89*6vd zYitktElwpBOW9wf#^x%rLLX{rHH6uISc$0P=fnJB6{A}p=yO+Gjp%>(ZkbL|*ni1f zzwP%a1h45XU3cCkLhp|ER4$hT4iKI8NPy|L~>` z2y5hj3u_#u=05*se$YkxuRSTZFNoTYWjQ?mTsrCLcyT6id5XuPeZO-Ka4(=G?EfV< z@>_TR7gGx&!L2g5D>wACwIw0PrmpV>2kCsQ63A!+K?cAkBNd~IiBQAx9ATu|-GsL6 z6X!4-Mm3LcRjaNuOU|Ghns20lD1(zWU@n*LEk;VpH}Cu|7kh1y|Bb19RGL-!JQx!` z)SGC>eI-eKcbg1Rjt+VR4qQmXFfM3J#{yO0yV;ffVeKd4M^MktFLCgX?b_=?qBAG& zZN}`ZO5@xEgWtpS71YK$g}p%Y)YZgIau)59yAfQ^E#4nog+glY`CVa|oi<`v-Hh_V z*R3v;i0g!nwi7`~xHvDpmF9X?CeoC(#6~2nZ{BL>{*jWZO%)|KSEE^+z1lbcjBh=dJ#Ez zam{BIH_Oa!@Yd#wvc-A@nXHX>R&ZtQBkb&hZKFXw@H^_eqQs_k;+JSPqNmu7&7=2Y zeT0p+DTeaFEjF=1cZQ?R+viqQdP?|x!?*6!y^$(%XTv9>lt0)N ze-*qwhf`?e z)FmXg4Wmy9WT=qdASHJUJ@nVpsQNcqLKdM3%S`>RsZZ2&sxXk$@{R+Q29}a?JlCwb z20dGJI)->3SdrWVg-c{wClMc1#8k4iO9rv|@?e9F2ibz@MLbVn?boV1k;%)BDA z#NPJV&A$_b-b&eR@d}#dFT0J34eUP0;exL!O7?%ROfR-eiEXRYvZnEQ6O9)XAt6VS z+I!MA?BY@En+CLDBqG5|i(4M;Qz@+&f-7J(7r|Clzla|yHcIiS=9_Plqd6Yl$A?#P zRqIUez{jQ&Rz{gaoR?w-tUl!DDKv0lTZU(3o+Ei>=E$NB%$T>klNK}$+}06Y?_@^t zv1eq!h!I9BH3@kTEzi~YhacV?=0#d*!|x;wR_PPa+wuu*yXCT%1%mQY9gTRpCnGhL zi2ZNJk$rNb%mHTwkU{4n#xGj$dBfN6`x^1U7nEvd z2Wh6clyq;SfMhu$2f_z{lOsgKoWV&SZU>^g(^QPCR~MY%=RIOAdv4bWhzM#H6hsPK zF-vy7Dxxuw=aZdUWM~hqhCe_50>ApOBU68M#PilcBct^3P(7$irYJ@?+h7-M>4j(# z+C?sw*_~xp)9f6kH+mqkA;%ygF!q}OJL}GF`w`uR)??2Ui?v8GrqC<9;o$I^Knag) zIel&jpDD^y=lQS!<=RSK-meXfp!ydZ=yPlt;KnP}R{HGH9T_aDDwt#qk*=QT8b`nWtr!35Jl`F@(yKW) zlX_=0-sKzt9S`oS)L5MN7cfzCs1(*4#GKR8=#bNB0CNd^6-(Eibaq_D>7{nC*iNpHS0D7>}MFSXB!>H{Ld^zca08 zt^8h4N!kF^a$uzs>@?^w83Z%e5%4lqe<>LzFny)+9Wy?t^iuCC<+*(xr=M$ z)9hz~u9(dI&b96OY(dZ*uc~xo%0w-7HQBfb$l1%!*tS6{PmSHe(+C}3yTV5BoZF6k)%QCBO z)fa))!l$3NYe7KKH3zS_OIa?K!oC5-E6dMXjhu0T2t~@aS`))+MGe7D@3+BiNm}S ztN5X19o?mTS<;eoTJH?XwMdNfezEgaW{B^39=&7x)54E=6c)m;3ny{QQ&Q_zVdTdrQRT?Kw6_3|Z#;hgou$+wl* z)Xn?t#gmcINBLazMAE#(3od1H}c#%`UnCU0o8A*PVd;nrLvn0T}fW6G+pgjDf*2~5u#!=1HCMmobstgy`olCnI-tXqBwM@Br>xD z5d5)8hoEzv3uM{3?MtQYZmPHal{;^QFVGHH;QV}8NB2P*k)^^&#pv$H-kLFXK*=B{Kx!p>88|ABIQNA3lA*vx`MX7Q{q z+w#!-uxZFui9TI~s5nwaQ(pIyN2z*}=dpn=SWj#7Y@^ksa|zM+rpZ^`XH(eCLI;7M z{Yb|U!a?3=7OxT`W^K7@BH^TB4Lx7oCy>H%C5hSXOq5e?8JpUWKv_G^{pd|-4@!^G zZ(cu3o==@wWTe;*qi*G+BDU&7(1Kq%6`C=N&CPwew*6WLjwswDthPV70-}a1v!lFbt$g=LiB-3ex`cC8WxeX%RbsH}mI4q}o5Tb0*DF`* zu^$8;!Q1+;1BJD{|3}nQ3+1+j-6#7#geKwfg*9&kYdu^F|-Au>t3hq^bA?GLUG|smW#%|A0wd!C?k-~ zAjbqeJ7azb(=v4pIdY1F{>%$e#{uv&bX@M7IeIW{lq%iflxR*Myq>K}Mse7T-21Nh z{Aw^$5-a_DQs-oQe4pOx@_bJsWt~71;r`N5WgM*sKw1`ojCc2aveNsMrde|ycC7gz z`bqF1S72?Js^DVApr-+BL#hcH63!v0X+;WK)w;u9Plj}b=Yj-VZ ztN&R!aV23#ft?OPX(tXd9Ik}pijXt&-ry*)&N9-*MK`emSqCu@$0ZdaUP@$GXj=pt zTD%~Ax^k^=aCKf>%cjlXjS)Gun(r;1ndZYQ&%a##0ts{GVW^lqZwHGJCXjS=x5tet z?kyOeVi=ZxMpkuvWlz{JEZc$b;ujisQ1lGwZh^!n!9I>pnD-D6`>&qL11iuh{1f*F z14W;q)m|l;N59b}aP9I50$zQ>2q)0>JXjLZIfqkjNc_|S;b}%=BfFq;p|N{So`C!W z)F_3?lH#OjO4^BD69sa=SLofwMV#GaE^_ts%|JNe%zD;PKQvy_xqQ7SD!uvq$(4#- zo}7GgP6nj8*+OB9LC%W1b|;I9H8xG|EMIf*o|#yaa+qgBy;tyrwA3eM z&$p_LoIyRz90T8^#%EA>3&HF7ApC1_KJ+LSYMo(lA;hlA-awnh&as`< zF^VHwN}(sNTl2TygP4swqVjidH>{LtA>v07H0w?p$WA@*r|6vo1<}P3BTtR-X27~@;6TwLfGNm z_)L6|l4jhek9PPH@9L?E)Ev~q)WRtttAPNL#pZ&#YN!kt*BOQhZbWymh^vcpJ@rSF=pjT!T9Gm>q2b^oFboq1BMLWS@{?S$7^T87CX^vjhAhZlK zdONwzhfvKlcdx`v3rw+f+sKPp-R8?Emb9&|r{0ig&(?ouodnC;-Cn#GlC+yZP7h|Z zP3~@6I;g>e(;^!0u!+#0?A*9@3OrY@$+fi*uHas;zdG9h_1>}5^~x$s-PKVSU=RW~ zP<>)ID5#h%olURlG>sP9wN~=lw4Rq-yoc}PTUkDX;=pMsmVEl`w&T2fSVkcCO}tC5 zRylxLAQQ7z+sNGtr1CS29Z`DR>|sQCSjcXGdM%MlW2*FU1x)`UbxlDby$c=|Lw%c? zw5sR62_F`<>-Dvr3zQ)Ew67KFtkYP1NQ-t~^|`y=8~Wjm>G)Z~$fBmcYh$wN=RF(r zNo$^W?9P<(tjh?rAzA zkjhUS)tg;8tsRc?YyxGtfT?c0z_7$d^HO2S$3Tfv+aj_`q7I?0?M$*poiS^%Y5#g4 zPlN+QebreI+7M06+SFS5lxq!8H!=W~W9-+WNRP1ZqHqznMWh%Tqq1wPv~Eyb_DE6? zvOr=CMAIvZp-fN3Zly>_+>1PChl|7G;U$EcjEc=6axQNHS%A1U;mPke5q(*X+)s45 zV)E3nR$1%mH0r<;*;!_jq!KuMtVz&<_&&)3Z&yU)$g5qWn-!6DAWxC-Zsj5=a^mzfnM3mtx&uzz+<>kg9+ z1@c++IRE{68-#?~of6&3U7m`ZvnbcX!{obnw)C+lD_7QDn+te#vqhIxBZ>@*j(0J0 z7*;;zGrJfL$RH6g*b$anmxKj>X_MumC8QBUT*88S3Z^`OY0!_ut`%{c(#J173Y(2? zMWAbTZeC_)dRa(u7u&JW)s_k2H(er6g7@{TzCz&P(=VX$yDPBx{DB;^*D37_;t-x& z98KbHB8qxv?$qkWI-qg_yT{}Y3YcKL&AB2~0C4H=v?&I76~jfF)Q31F_*MkCM!c1U zSnY&*cyi8In@`7$oGESux5|BXy_13l1f8Bf6r_iEl2ak*4Ngzza2DrjZx1nY5Kn6z z1sq5Ixl`h`G2bamZVETXJIY>>Ve}v^+k6=YGLwj{9gNOYG(3>N-ca0}Sn=pn)$)X+ z>77J6F6-|ZkCS&sz9a+$9G&WnLfMTz`0E%Z#gpm!7qAw(mxJ+ycE2>omK5}BfuBfe zkJ4Ko_uqqLXn7n6F^s@6t=3*CYrYU7kG2z$RyS+MzGK;A!kfo$?J8EFE9xqkf4XFU z?0rq)8v5U(6#Tf?fdhxQ4#PebR#dO7ycW!%^uCLq^vX>M)1EM-*1}a?V@q zJ_A(Sn$4%g&@I`ei>B1Wh=M=O^~wjxsoX(Z%8Q}1Z^#+lEjJhvoWz^i*K;D+Wffi| zXjwjd3O3QLR!a!I1NitbHC&~TqwFu+phAv^L5>%+CWC?^h=Ft@a=HT;OUG4c+$G= zHi#B+@1pn6J{|MP_*}oED0DXJDanw-Mbx{WR%C4?Rk=>k$hFDip55|Ca4(jkz94gnGd6_6Tg0)!$p zkU$VZ5+DS2oOi8v&02fy{r~X)NDdMXp6AJZ-S>H&zw^4~gO41PxIMu3dlrl)mKLlr zFQ2Z&yzX>w)~w`mbcf|to+?%iJT5UEZ~T51(h{9#&S~*)U%_1~r+;vjqyBJq2W>+; zS@WMpGL6$k4uu85lVyDVzh(*lw|D;iP$KOA)3R;qQuU<6HL^*!=Rp;@uo*P^k}^Ai zW+>$BxodLkPZsIa??1bV1_J+ir;h{(r{WP|ZKpjqs^?#4g^KfZ1f4 zkY*5wcwxfFb&)s^*Svp_@BjX&yTg6|7w!IkAM`#%vLWjKNhALIk9-hx`1>B(Pwfx> z&vO0mU-}98PyfSzz5G4?pZd!AwI5Ii+xdFm%}Yy@?XJl&^R;~>SoLkIgzda((SNTk z@buBixUWH2Pf{K>uVC|&ijbL2l|a6L=djo7r$pHoGF3^sx^^qsA1OZ>v)o%9Hy+PO z-2GU2Nnvnrrrg8bq3W6@rYUvGT+H~7Ip*R!X!ZWx%vf?@&{73bPc-UdXaRr078?l| z&;b;EexGwRVyQ{-o_%c`f%Q@|Ra{zfVM*t9eDq{`Fb~DhwDJVoFONnZkrk}(9E+eC z2TQGOHDHy)xJ^6ZU#IBa&(t-UxaZP;Xd$}_I?5cM&$vPZal(2urqU|Q)S;j=1*;g` zZHb;lmw{yu;{=ApmS5;wsF6*d1#m=qziD)6zf08$HAQkfzixhq`A^HqPcIBYO5JHf znt=MAU;974@#03{yxc!dd^5J!H775H(^lof!G!=gsCLl5I&sL9=90GXwu+VN!yF_KI z=PL{NReJWx>{4uTD@Db5D#Cs#QaVckfCX3iXcXt(h_$@!8^tY=HWaRO zXS)5P>EOymDfQQjXS3z*us;lwHaK?&7w_(s_wo#zFy*vpHC0&s{wA_M( z-pvF?dg=W^^fw^-bCY#QU^TrAjU>}{nV2+zE+1e|)|vQ7Vy{=UX5x~eXO|;M za8uAz^Z5q~Jk3-OCo?j@Ti+O149-+Z9#r}^dQDlRtlW6`y42&4jCtpM^IPE<-l zd2G6I^eaCxs>)dJLAn@TsOpzG9xu%TqFPIGJu<@kt*zBpI){L2-s$5AkV`P98(ofd z8SE@0INfkRz)fn*v<)k6njdf@wqE$3+{H6c)SZ-8te!mQT5)UK|7J_bz_%0+-aUb2M{0uhA_V_ z*02igQKAo8cgf7=-NG(Gef$3k^f=#L9jw@{m*yj$qlcC)g~w z#c^$;iMm8A9>=(N(IVNsguh~nE8hgdoiw7)_w9&4K%G;3zwA{Ilc9QE8_p2R!vRt0 z0EBOUgF|wB*z<(^{vo%40JfY3)T?k_nVDv>esQx?V8op`i<~nP0T~OqbC++e-fDgz zl&PxSJ0S%h;d67CFLf-(yY*5-R>tK2V54A;dK}QbSFRWpd(9#rvytKRWK7lNDHBkhkHyve5y%>SqbRp=BVX&=uSya@c@+Z1~5l5mpw zvr%PfC2}M^HIcir6d|HlMOA{}Dk@#Ol}*0(Duq!C%k%ab%OfWy$P1YbGq4MnCowdL zF&V{*0O92UU7`nZBX9HUsR%Yv>A5Ur)Ho%D95qE^CUw%On-e6|DzV01eWzr|ATOd1 zg2)5y@D?n=*}zCBJ81n+kAeVxa7M=FZ-CekM#PRD)9d zHI>h2E&+yKiBUcY6n2AOo9xT~CSsF2N3!lMM8A)#!ctc`lP%c)!V(S8{vchA22dAf z;3}!^z=<=OC3~q>Ki6gBNVDr!s&tvLia2}qjIM4I+=r~t>Fnjl>1{`)@m7NyWlym} z@e)Cf8v>Ju{R;BkxphN!Gpdo)hSp18Sja-8fx3I5~ry_ zm9R??_7{Cz*Ax`LLIgGPLh-19&xxml?o%9e1 zKwDO_(H5EQsrd372$j?PFH;39vsR5nfG6Hx;(E6#%k0~T(zI@%%$lVOgf|90Gvx?I zh}7n2?1>K&vTy38yR#(U^BpNtvoAUX0*&J?4r)ks3j~It1pO^ND-$W|d%9e>ml>sj zi&b*19S>x?TDbOFPTf+|C~NB%1Vpq0K5$12sl2ZuJ18yd+arU+wN^-(sbp23iCHMZ zW!OSyMV^tN8KCR4u2Lu7h6^A#bT&DZNn`#OpB%m4YahXr>od;*9-f%r2TkkuPwho-OoFbufe?f>#2Wi z-hcY~M$O|>ijJ*@grQCX>V}y}V@R(e2bjQnja}XNs7K|tPjJi#geyk*p|nQgcuvs} zd#}P^o#7k)1hy(wlN(E@W0SePd2N8%LA6Wjs#`|A1g|qdxDeKZRE@ID>h$tE>x(Ev z4i2|t9guExJ1i{nnQ=^2u|7PqONlw3t6wYG)rWMt4+GRPtcJs;-dX6lQaEIUP*rZq_1QNeZ8e7 z4#@F*p|4xp*8RmzYGBvrii%I&flfLQ`FXd#$=yIO*4Zx&*qs_fyYibiN6_ zM0=JQMACYZ=enipmR{CXxFZe0_OKdD<0raFxa#VQxb{-FvQ7Q%nM`XvY17)o{g7un zr_yh5!{%vdro7Rfqi_VRZM)3JY}3`sMpsXly}+Ri z%WWFjbxSXsY0)5Ddx=?L&;oXAZEwf7as$*XlKFk|=ZeJq1c#5Y z!b!ukR`1-H!1@`EZkn&Hwn|qHa;4+QW9E&7>6<~2bECKW;W6D;sVA~Cl&OIXfnxfI z2CJnkY9#OT@x$$yiN?Vbe0N-%j`}M0siiEhQR9&n6R*K>r-K*aIq-sX=fKPWGXRMa z!SWzp%@=?<%!Po&@SZ3pGoJbQ96tYpp_N(c^3|bl39$ena;5sYtDxACV>RcyXbc>ME{E0(@B>tDDWR8eD?7LcB`Rct|4lQ`e} z_%rChwx@bjv6TDs=cCe{%9#ENg6#=4APxl(UV9&7m3=yZx5YQQWJ)D8+@ydysIPN} z=PM`NzbeZf`E})_ze}E6j=ZmdqcBtzBI_2~C`f3g$VVYDNMhx5y`{I~6W{qVPb$Kl ziNiOkEYS!k&eFHB{e+V`=T=qxQ?whpSOGOV8y|{F0TU8Cw^R%>oWjYS;aW>xiTP$e z!6#XU$uCyM&ai5`BHQL*Jm&VLRW>@nFYzOn33j*xcbc}xO4zG60z;5y24B?uXz$62 zm1Bn#e@#$3pbbK3cUo0f3~h4rXt@3}^mD0CQt!gd-uK9KQ`J0_x2EWdzu|>)W#S7D znjGRP7(VuMXb`T0_f+xqum6^-AlujP$(!!)RZi`N&pv6m*v;E3*!Rm|u9D6JyA0Eb z?K`PQm*1@fctq@zdqu7rBh45np~GIYjUaGB_Q%QK{N0OsWqqXMM9B-^bH3O?_j;@r zza9SUHgE#AlI^W_NiJ#VXj>7Z&-fspT$55M)MzeNFVy>RnjcUTvsueCHKYGERppn2 zAiwDq*^lynYwtgQWjlHgx5p>%He&4U+FvvgGJoMU*k5_P^Txa167+Z!dkP_ysF{Rq z*CP$lC7eIwk45Oe0NHNfO~*g_+4GfL*uxJtWkop_(u*d-cP$5nQgKOdJ+Aef3uD`Y zpA$|gv@va}Iu5_sX_{i_1-tdHB&~lq5u)`9CFYTpl!Ed5vxxOkdxqv?ws%I8$7}J@ z38n870QsIv0yauICkn1sGE`b9V8yFNy~S#<*UBDK2{t+VQ>JP`k!h#ecV63yA*}!h z9_?o3{`vFvU{@)8q6YW);`Y0+TF3+bd43O#)w_e>{Oc}lt2tN|r&=n=qHnG7&iJ)e zZpg+i*9ye0P<53mr6lyd`!liiY@qHal zu`A`S;w+i0z25t-9WxBI7uI65Ht&OL<)07EhW?giN<64Wa5|O_3sXsg73( z?D2^OIPAFr7cJ8&2G8S0#Alj)+@jSjyt5`=+fZe72AMz20;bdPGz&+`}*lf1C1Q5SxQfg<)B?o3zeZ2n?s-C~t9kwKJ_CR~8^ITYZlk^n&f)N7ZT zeX`4R&O*L|%)d?wX01n)rUz2{^)gSpN$y}1lksBy%CJ`tS(uI%-PX;&vY);jdBdeR z8Xy?H$Sv(Zmt8C0C6YiMce5byG@FV+g0DF4`fHTJ|6!C<)~4S+#Dy|otirdwusFBPyt?D2XW!(Vvp_!+I1q0jTo%IkJE zUQA@8HdIznsQpqJc;r{AT)BICmD$+krF~sY^9T(~kq?tjJm5PZ{RXa12DV`izwT=o zK|ED-X=4E~8g?D8JtvEy@ta46!o0LANKIHox~kZK=^Tly6gK%a3&G{gOpCav65j0U-mArkMAGb8Pksb%M zz$arXADpR5>8w^M@>1efL)pBCgbBkZ;ZGULM&MJ;H?10Rc>B38D zIT1~D7a0{+vFA5u!McJ90xizc0obcP-#>I?CVQ8d=5aZkn?-!8&F*u#{T7k=COCO_ z%e{}7W2t>KzzWYJR(V{?IT=UXRh`#>jUi4JT{ijx3*H(11$F!yQ z2`9y$F6;z#R{rW7I|Q`8Wgd}_(6H;_^2)6Gt9<6`aw8f{R4PEF2xu11P|hw6x_`Tv z4!R)D^R_BK86}t)FbK+qghiKZ^Oj7`^?hT;Ry`gtdmJE+ zjR-*!R@Y(+<#OuAm-yRTO9A68s*xmrP&Q1{XyQ%Fub!NlJG9i#4y&IT01W#L1ROho zz&YEdho%brV=>VGQ6x~^J%BUQN?1V-EqngSId;Xm^XEKlO>1>%eN54bZLF4of>7|b z(G_>tbq6nd!?OyDhFAG3_jtWNKk1e)CcL#AcXl=p((ra1{?b!?IlIBwXfSN(OI=25 zVjy#b?QvAbwq6`n;CDDyVSiax6!>YG6Jwjl5%AN|FDk6jiF|6?Ck7*YTf!dB78Mn) zA7(9y))9+69s9!3M$izpIN^QEDgWha?>)t2j7jp6z&xI^)i?yV@o1JeJivE#@Zqz&NrI}i( z^+)Yd`ztDfFDO-JdPy{hd94V@D`I{jM}SQQs(^<7!UNY^ir?5W8ix1+fYRw_RjYkL zf{UNXFaUh&MVrC51|Bwge@bk$f@hQ7$xU(7Sf!ZxeJHNzCbq(?lh6dsl1jmJdf zQX#}Y^4&(yqiX_@_v0r3RQLKJ7dLzdJWhzeyiylk=`4h|sE+~^5xh(Wn;E34$bfuv zX83gFac)QJSu0cA14e^Y&q%(ycsDsWn(-JZ_Ed3~omH{AM6MXEEA+W@T%G|T{{R&- z_boM#zr@)VtUXQ_Wmt!<4u*XU7vUb;%2D|WW3a`Kknc)x)%EHpQ%F@g!Eu;zwDIh! zgaPefZ29rn+=xWxZn;%71@*q)1rRn{OezegO(bAvPHnRn+}6c~Z@dAgKfYJH-sRG=p@68cijs;|D+38scy~DHUapp<4 z>YM^_fs;`K-mi*6S?(hmJ#92>@=Is{VC*;bj!nz9(vbto-Ne zr<3ykKnR`ghSz_jYl1)w!FTz^7`b}q)hTQS!P`iwm;(8~}b7EoN=ma{#^Eg2O1+1?#oTkQH zfj9M;S61uU0)cCDNVWlr;6~{uhU$=al{AtTU?+I?#2DmVF}L(OoBMb2BQN-^MfQ$MxmiTC?cdqPX1f|(}S{c;^=!zh#a z_x->j8$RjkjfTRHhQ@KG`(ywhD(TWSdu}}&ZX-A0xdeZO`KOCQN{U?cT5rTDtu2@{ z0_h7^b!t#)9N%b4@NZ3H?@cf(>b-Q&-kQ@&GrU`=O6^-Ak=(*5P6D9FAFU@}6Tq@KuR+2l-*DoH`b(My? z{5euFV%t$wqR~>1u_a2P1De&GrcqDoTpjtg$%qy;?Gdwd|09@+Kx&>Sl`B7TZVP26L!%j^^vvaG6`Q z%OzDkp1@o$kJz)CeJ>zkEkEwvAs767zSaIS-J6dbN}@}FbBPzT2+ixhNo_`64%F>{ z9Vb?h4^PS8hrxouW2@6CJ~*_j)wix$z8?bRZgc^ZqJR77HqGvn?_k9SNLf^Z1)~bU2`|r{^DFx(62?OA2H4W zi(Nb0C89P#-wdu7wkoZxAIV&g3qVZ^$h4dDb8O-DbuKD$k_(snKC|o7$J7HllMFBiNw}h`I65aedndT;f_f_wzH@vSzRTRmKllvzjAjSy!cZ zErfEA3I4TqkrW2xP`!vJ&o0Y?Wxek{OS5)lBWFJRLXka@#d{y>;wiYjv*b?g>9xuW zToq=j>kMD5VSnP+AX&o(V6;f`or~=3WqnXrzUF0@z{S61QTQ|IP-oE+>j#a-N1Znh z9F=6ai_k`TmB{obH^sobV7hU5gT<{LM`^+Ayho@b-+T6Nx1+sf#7Z-Tj$```oCmHA zPUckn0=BKP=-ap&b>V7laOE6<%kEv-l*|xLS!5)Uw6A}lm$mx?F?o6MD(ksF`WBy0 z5hurvm+LpsyjS`bssZA;=uFGjOJt|6$QaP%)b~^JOr7EX+ktwro?S(!(bv)&RUO|U9AsBQdey((j7Cu^F2bX4 zZCL}FGxLSUb(KCPdCaya(duP8eQ&VKc;^pi{i$*`(Ilx=aypgS{|X_x+igk{mGKA$~z{-aQX?q!l;A7xMd@`SLPc6?)LqVIoFCH8}rD*5dp=s2QgZd9;h;Q(TUO1lUkllLe z87Z5$@RNuze5S_YokZ1v;H;k1pH({jgl97OU&iztbUgeTa4(0tkG&5bT4bVR7rp_@ z4V0Ex$CVQS9l`IRze*p^`*!cN-a`QVk`e_J_%hmEEN3@=NBa5h0@yj#iq8_+7i$$_ zSxy(+-4$TCwA-8>OcDjPP%9{zf)hwDWxKJmU*YymCZ{jMMw?4mc4*%%B_(3E_;mWj zlySY{ROII5S{tAcU5*HBHg*EZ;ar~F;VaGRtzQRTEef3o&U53DXXb^92OG~RGQH87&e=!7>*^o+Nb{10v0U)s z)4pxdT0R11u*iUl?K#YN97Q#lJ#5Ca9X~A34UH*_h#pEC?N?z8@*;S6HUWjAF}s~J zY%QOu+KApR!6?jaaT80Ud7jUQ&0~z+G#NHc1PpC6pmmzYOqsZ(cnCjUe_ooH^9RAY zfM{ZM9CorHa`g`gCe4kR#qV%0oNT1EWRXZ&YVwv??RfJq(yCl$_?5iYJ9*M}Z~M1d?;#w#VzkiwP*%I-@P?dE@#27% zoFa0f(Ar=tU(j|17bPY|KxlS*|E~loB=H$lVi4@h03ydlm$uKP!Jlsaxy8;m=+PY% z*0y#aXncI->`Io!zY>xE_L%%L)N*A;BJz7|c+ZA;(dRoNQ+tn&*EbCXJTuxlTaJv$ z77>%(-2*>>g2KL3JYdoAp~+g3G)235WAsf+vAMoqI>MFB0LNu&k1WO_D>J!o61k2F zA(ENo{>%5!M&uwNc_FPwC#xgc{s%s)B>&;VDC~pl==*B!-)f1EH+OW=sa}mUXvdj2 z+ZNo{uSQm8m)xpL6E**aNu+)r!75jj@I%7Xfvv|Mvp%M8MVCT#pU;^S)a>KkwE6$7 z(fWJDjHcCuR0Z)jhkj1!=w-(eJhb5pS3~ZxbNBtHqBWoTLZjZRw0-_X*UN23PWkJ0 zUHX5OfxT_b>6V3#gRPXyW`$jLP_sfKrwa_|oZ!R*LABk{?<&gcAvv921Jz{HU(^XHW9k0-DR%8?3#lT_r)0Pbl zBd<$4dl)$@h;QH@VfR?{4>yY_p0~1Md3D$lUUHUSMUTGuXe7w>6!BUb6XMbVZhezv ziaPPO?IPD~IpN$*&#}yUcrmICRfbh4^$O32NjNBeS^Lwo!gq&-TS?DY-8$((1@o5l zPmipIv=gT?fAl(?x!cAygSAT_lID~{qW8;W4wuzrcH4zD zc>3JpW0Xfl_6m5aHN5w=8@2|P|Dzq2M3imWwQU8~QFd2}9SOhrGvRYFzFQM9p&67; z1eDst)t`r*XW%cejY9cjA%%j@RIsHnJ`Qr9us=YCjNS6QlS9(MAHh;s7t~v5tkO^(J zY|5xX{JQ0YaFmg=(3Vd_^a;h)%`>f4%Qj1MscJcnPwd>1Fh0Z^#@VT1sM9JS=S45$ zaNkn;m1_7Aa%iNTZN2xi_SI3xI;No7SJio~nVC}u+*Z?r^Aoh=?5(qoaa<^i?8OV+ zw5Ux?4p`yA>b3EE@e%?^ZrSp=R|GQgGVg-MxrKMmmB8vjBM9wi3E+5eacN(V3s6tK zMC%Er+PfKn+VAz8n=RDBGCmLuehNPNUPu^P?9O=E^B1(}B$XfE1O7^tdhxHk*jp+O zk~M_^RP*u%*Xd|;&YBlMctf7B)1X$SmO6fgyHT;@r`o-PJc@juiio;)c~+aD#CB48 zj+aaluTjH7$o1Kg;0B>x`)eHKi&nRMCkM4B#sU}SQTUJY)bwnF9hLlB{u*3}IK=do z3k>mH@>_H#^-Q%}{xFs>74u&TaOSh8D15BhVshKAP(z*je>ge-q^~Lm-!?y6*%%ra z@PM~pH>!Uk`H^skK4AVOl!wC)*%!=3!RZnY&7jKB>9;K(s;CmBZ+*(^CH}vl?F3!6 zp|8;-ob#$mulfShmMf~x1|&;ZRD;5}1V-2`KvxrQs5+n@YZohiQ+&PMuXfdyv)xWQ zhaLXxrDgN(j{x$~hXijU9+9;ly5B8x9~uu^{`8Bqk4vpjEx8F*SyY<>B75A|*0RNe z6Xh-@=Nev4yJ))J(x{d$>){Hlyp;7PG#vcp?S@gz;@>nr0E|YVBUckH2#R}8J2!zB z;`Ox>;`BE5`7FLTJ~{I?3U{!rxSiI+bC0>$a9lFNaYf2Aa(!_G>yul|^QPOq&pZha z!cSJn`O|9y41q7Ft!|l(Y~QJncnF^@y44 zU+b*BG~QuzrYoA7->o6{_{3oU%qEVN{h1t2yX1@fe1Vm4qyQ_1*-sXQroKUCbX~G& z=$pAN_dZ+QvVA)+?FOe5ey@Bs>Fj1@otmN)^26R1%_IK8r?P=V4Tbek6Q4024{0hd zbr;%`yBo>-?7G*>5is7tOWs!qe53^5TWUANc~uPw+O4hrDXVle2JI{TJY6tkaM!ZA zL#TqMOw-5_Pq3-|i7w{h3+wz2Tq@$+Fb-H6JRROBI+&GJdW+v)=_0P9xTj6CI%~Ur zce8A)&#tsEEFna%)_2z+yysihg{cS5Vswl8l^c>v2G&YJD@dy#sG_L*3(( zvX_Tv5qucz zbzr!E{*vE&(C`C?@bxa0jCC<*YSlw{`0nx-kAoM_$d3pHGqU?b+`Gp%ePr@?Q<=Ob zd6I@-QR{qOiLr3vuyxX#dEtW8Vh0eodhzkhOecxi9;*D&y2~WYFsYqhoFXw(uEiDl zJ5IlguO*d`?El?g*D!E&3EoHAnC9gpe&&5*dbFd%S5V-W&441x8VCNE4{Wdi70U*G z8611kTtC*c8{y!U(nrQLJ=3j^E4UXGbhFbFH~g3<#HFLysX?G2$+M!slG-=h6^l zZ(dAU9_sT8O%3<_MS=8*T1F$(ZU3Tw%kNVupB)w$faMq8PqWnmg80aS+^hp7%_{Pb zTTqea>XDMuc2$5lV&hi{1EXiyAXuvGJ$_7%?=ABV(vqyQWZ|$Ni8ijiqH#k%M4A@0 z>XUACU;&D*o3Syf5+fIe+g2^Dbs_fcudi3TpD}EGGILp+!Z)+(rTOc}zb#6if@H=^ z6chVgr&WmJjUDCCgO2RE3s?RbYS63qbC&je=$GzzMxqrL(TwkhAvde_hji5la&Haj zNM+?*8oLLd-o;xc32w>wUA91LIgevf0>9<%9}Gxvo;g!nrjgh2Z3b22p8bd^e#YiT z)l*rMxWW1BJIj7Ttj<}Ch3osQ2)-3IM)ZRw`;SBed90`)-zw^Q(2M|2rBV4;`i9%s zdB;k~8-`cOjWfB8yCRbGb+;Ht*Dv|(5HONv6Iz0I6R$#r&kf_*x;>L{wq?@j#HM3V zDzBE>+An9y4nrEJWpv?;iGDCA2c;_8!^ zSl%b?H%ecz``lbTyVQXG-I0zCT)P*ly~aMkk+7uEKf+y$Ng7=!a8N%N;+Pkg3$C!< zk8drFh=NYmJQ7aeMMP;*CRnnOH_haXyirz|XSn8h~??1HFHdVnNY2X+v6!tcySTO@dG)qK2 z;eFY-SOlD6JB!)46oj*;Fl+K0Mv<^po0jQ!NWTCe01DIJz`lBW2}WuvvbZ z5HyzMn8v9bgKC@WyEZ{plEg^6 zgsh!?2R9=wvwfHu;x&}%A_Nnq1w(HwYb1B0ekHOHE6b0wh;taLc^~BmN^NtchK0Ij zgIWi>=7`jYH@$Wfvv~!Ry?eiL_3vL0rHtxTYOzNKLgl_>65GGnVQk>-hP=p4{TW@6 z*E2VzMr7L{qOkkiHbyu9$^#DMod{bij^TSD&9fv&Vcoa~Y>(}x!+XMwS0gn$JUcOw z;X2;PByz9>0PJkA)csX6qderu!M1rUr01lMnS-0-g7Xgrn9Q~X{jChZ-!nq0NcPvF zJ==Qjero}%LzLTJO5ivK=If(WgC5T|Q_KdC_@MO;7o=`UcAV><0x}cf5KOiUdaM7j|1)$u!UanIKpjW$h;!`LJ-_kMZ7E9qTZV`&MTe1m2tPm z|Az{eUTR$64&&1EF-TGkW1xauz(HeD#`)3ve)NB8A@;==3Rrp5b0OyQ#(YKM;#^~p zj%0}>+Bh_JiMDbY?;lvhws<@RO`IbjWy>+ELF2*Hw-8^i*(tjTzr{x)etZ9nGoc>c z3Yop0<0>i;FpvM zoId|+;r||H;`7I?e0rE}($FObew%txx)nM?UCHes$>N2GzJv3|#JlX(1c<3~T$Oih zs_njig6Ok@_4#D!lmCA~CVASYPR#up$WHId)!auFCek9ZpFK$(=ZeP zSlWZJE#4GUxOzFdw7RqGx~e~F6`Fv*u#T!v?T3KXdLwxnzedj@{I45K*ZRc*7CXxs zq|;g$PNF|YZ|P+tl^s_HU&_a1DW`0luc^6y?5WoINT)l7;-Ap@$Q!v{dus@-e2&T% zH6^&H-lAw^Htv-G;yd*b$W;Ry71`#LnR36X!UY+9mC^d{dAZPLKS-vn$mLsCAIG%Q zVF!_cX3q+|kSgjqe&YDWkZAQ}$$aYlz<{wh^YN-NdQkePpSK-!KQ#K;`%X{0TbXpJ z0>Aa2c=DBHS+^k~deMcT0kkn(BnHc*lcKZz)PnDM(M3I08tpkjvr{S=#|`WbP^IYX zbg4!atQbSt8kq!Gm7$Ne(%1jc|~Q4v%mcCQ-Nbs%e&L+4e!%N?U5$p72W3V)> z$i{9zrb!?(e&Vgw2}XLWp`7y>2h`UqpLb_i-02M-Y>i@D{DtegY!4S<7dGd3vIYxOJy#5~$zQH=?D#7`oZlH$I=CfcuEf_dI4X4Xeltloe=TW`>)0kyte}E3JMLeZ39S;pptz!(CyMS{!1ps z>Eb`Ma{|wjOR!*}0Wx9qgi=X|mGmPtf4;31=Du( zRNeyrK;dTZK^LM?JL=S5?9tI_=N={ld=(8-17Bnkvsu6NyehfLdO@F-;YX6rY53m} zV=%(h3Jk5PVBL_Mu<^>m+<5(W(Uf7^sx{Jw&nG=OiBtwaYvsk61HY|LvZH=u`ZzcOeJyREj@k~O zlD+LY_n!)Q%fkB)OR>5MV=67#8HG_R^Zf)9@VtFEw$KHn)JVrpP%>yOyY+2XA{Jp9obux{Vgj5W6=>z_q z=^z{Sn5=CNGsfWR`@VsOu-Bv@cj64z|5bxw)k+ISc*0MxaV;W^^VpF1v2t)f8Ux# ztvQ-(F^JB8_c+_mtIBWUy={G<1z$`nJVXoaIEL1E(JHre!Hpfa8p)1U_!0IKVpH&H zo@v9i`m(?C(f|jz%RSqR>(5Ef3TKaKqYO0Kn#&T5I78xmimTfxirRPb?coev*-?{vRl^C#y&cEF;;mLAZQp=~P!ok7 zuE%J5(E58?HxoIk=i9Ds4>de4H3jB`SCr$M4(Mu&M!fwk{wD#67~|6SSMc7!j8SJa zU*#^i`$3*b)BroRQPGt1yg$ub?6`dPBp;~&>`6*Anm@+? zBz4~cN0FaHBB?vdT@ws&7vLDg;6)Z^x9*18b1Al&sWv^r*JF__Gb-WL3a6v(kTkNU zEDr$Pcme;PQ87OFR^jjQ<5pz#zKR#tXJW6Q9i5oXo{ZM{G-^{c%qrd1)0T0HTgG;7 zFJgd3j8dw!w|B$KjJyE_i(|DZ=5WvE%D;n4&=*uz-6jhW@v$4@@doc{+Qg(ZA~=9O z%oD@zne4>zlWC!Fm0wmUPW4Jo?iR7W))fVucR&Vg1|jZ?9i%Q^BHE74652fG&I!a7 zv$g;euU#*Lj@li_hC(ai0dYBiV03=B!zt1$!a4HdQ0xK2i)>#|PHfr;5}qS3uoV@` zJjq_}VH;3-LRM9>H2!$UiP->V#9D3|km$&G3OjlszB{}Ds)bIBX~iIFrF;?9WzDl6 zZ*+N8>TLClS8a3nD@FHuhvhB$^OAv)&IEOouRMM|j<3Snq?o0ib~uwhK^zQLEDG>o z(bf%#uiP{U+HM%Nio$s4B+O-A(A*%2;eZbFgMyB8w+&jx*H!cx>FUUdEp4Rian0G; zjowWH(WB2DI#f;EE@i1druJprlP8i*$?8{x2_32Apvt?SqhUdV>VbNw`w|gL-k!9z z6P|&rP;aP`l?4=1A`Z>kF>p~L&)w(9X)s3~C9Tg*Ur=j!p7(T)IZK;O67NzAc-&Fy z$xP_)^7Qm>NG7U8RU{*2@s!_#AO9xcvEu57*?mVgAsx7K0MMQ%$n}-a$JeVd(!O## zaBvQ*uNiSdwKN+vSM7*I!;`rHxXP1~4THAB9_S2h_9mh_uW#XTwt5aP`O(f6eHPIC zRcF)wyDu7pzJpdXZeZ@^T|=MlKXj_9@Gm8vSy5CT>?m5K#X!%sb_{4;2Hy+ zt@AJ}8Ivuh0{siJ+cnPJ@+9jm(I}J=N>r}U zM>b69(Kd>wY4p~!U9GDp>2zyBg0k9q{}x5&ReY1bb-cVi^nL57 zpDsH_J)5llL34Z)d72dKfla~FniRZR&L%?@7t$#nNps)^i+K~>C1DlQ7-sv&%AqlU ziPa-4zEQNYokAXaknh$Ls8*0RbU{_{tRKAv=MDmqufMzuB#KeYQ1xWR$PNEerAdN% zz#qeG1vpTb1YD=p6dC2?U;AC96MVx_h^)m^PntwncWQ_LHQBsF2cET4` zBEm!qmwHmo$(Ez3Z^#SxsF#Tq)rn}kHVV79>zI8$oQXO9!p-lSIQCb5Y9lG|jE?s1 zhrHQ;g+|kPDr$*uf@Irz69jzgGt{WZ*2Y3Oix?s$rPxr9=HomYna=J>wEYD^8%;J1 zM%A?zfSoD!``u$^@po$MmkRP%4r=8z|1)vWU*p>Qja;~mQ4q=Ui?=6!1$01^Ml7~u z$0)rRz38oNVaq`Pn-gUi6^=)dwg;XG`SG)qYIZW|c{iva(Z?!~r`|+zLL$V{t6aOP zaLZB4m4zR3CHKUr0_X+M@j@4Ghb<`%vmpW1<=@T)45^mx+hTCk2clkG!aRWLpa8Is z1IXoK)VLQi3NF%(zIB6~n=WNAt;PVevMg8FXKEE0PTlZTc`a^*p|a|EA}pDzAmzHDP4;Bh%~PGLs?&fp z$jN^NX4~5^#ZBptqr}d2a2& zt(+o-fa2gIF7QQL{^L5~MlIT-HxJ1(b+tpjiT$P_?e3nqXcmJWYI}GFzqFvPcHVHe zWog|nW~D{V>4P(qh3!zgjH8EHX-;9gI*I%Q_f(9srB+|)ns$46p7vOf6|;hO9d~ZK zGI#Q5tH^Pis3bR-^|T?lUvrTS{FEoPFY-<{8cJ-kB#TxUX7IWGy`I)@#GI*3J%Q&( z23CQ*k3}|6WxJs(be6lvvEE2&Ef^{vxx_KOt2NKEw=I76Kf@GQR`*RRHwT|yPt%kK&7Rsc@Rp%90LYupVIT~)+`Y+d-anP++xCK8{m~3}9+gs%plDPZs`M!XF zEP;;Y4Yjp`g?^lpIPRGzt=)k(4^2%umJKv6Z!;28J0`V;McLV1tmoju!AX%?LuuPuu`_wcmVb8VTADd6IP zQ37*rW=FSA^Y8i#ELVw+=i3%N*TeN6mX``UCbJ)cKl;WUBv3^LJCozn% zQh<$dEpe%nwJ+-!vdvHDIxCavYnv|BcF&G+?z$Y}G&2EkF%K%z&w$_>ArAV&OlnowBqI{REUJ?9u-W~7BfR!zsK^w!w)CY38 zc0OWJZ}D6sw)5zv2c*jjV>^VdAY2EiwfDP_qG$hXOZx>JJh(^<=`os=3%|mY;ykjSA?*zs}2CHTI zJmv=23}&3)1X*JM`X-xW$Z8tF0W~R$;I0 zcWyKhEThTQ@b4kNLhNN6948xIWE*Cy4`~jRd-)hiqx>zH4C3fUj&Ey^m?@FiIxLVTXu`_tGx6p{R}+C@98dX|CVWGaGqxR2rMRu zHdCY8xBq-jUw8T~Z8PKy^1gu#AwTF>n3leX&D}3_i7Vy6UkJ)GlJ$~`nVFu>&iWNY zL_Z#nb#S>xdO_q%N4Iy8VhGB+`S@CO^-;lh

    kv>j&ZLS|BmcPNKYx8cnXFD`=;^ z6ULk6yMIft$6|5C>C3bpDeJXvJ~}&gB}7k<(7w>M9SG4DB@LUwAzDJR6A26rd%XI( z9*!!{KvGQk!tJcxE3EYnv|^Lq2oYfQh??T6g#|F<>F2$NS(~nqNZ!F{`v*yC&ngVys%T0`}Lz)#ny=Ip*r>NXq)cD^wm2{ zx7$qDpNlt~lfMG60(OO}{$$k;6GUXNXa6)+t$C>ls-FJ*VKAWaRadJWSUuR+49pBO^k6^}!-+3#VO(LGb% z@}i)k32b`!4mALql1|CUr;4MSyn6Za&Snbt9<++bpUjYAxgtj7SM zTi-vU;#VqMcrn-IJ=_|6)YpY7A~i7>2yIOwupqQ=iEIC~-M}VZxNb=)0!zIx+^Wld zZ7m%7m_{6u@N2rx6Z3&o^blfki=9sG*PAA7ybUSNCRxe>f7Z}5m(a};9H@GHs-*I$e2;ytm z54qZ2Bx|0fY~+;BQUpc}=4?!W=mAjKN*6~EcB?DiPZiuY9FAcOIb9VibFK6X3H~k< z9nLr+kCtFds3IBLYH6%@vkQCB=M`?@Ig1?Cb59Sz5OLR90_1aS0c(dx2@iYP(je@+ z%P?#Uv~L-X&%j$l(9z-MWd}wos^UY?cC#C&Qqm@Ooi3n>E z20Hz=O;yIzOoP(83>EgJm=&?$`?`s`PJyI0&ZZtfxI1hR+w|v%x1_X8bV}(P>PG@F zg7S{>aGrCdM~~57->bl?djg}W*gf@30*Mo!gZss&^Xql1rw1nOzEIfbVw~D=#eNVm zPJ;W@kf&j1fyBy}*H%Wt4IxSOKTot|xLDZ~#-jN!HiA?Ae}Ws@{fMX>7cno+Pena6 zuV*G%ycpJF6f+GapPv2ze$BR0_V$&$5@knlN7}mNH}>Flwl+YbaqKSQ@UCHUabR~j z&U#Ova-e)pLe@o-U^nEpzbR$~8T~W82U+G}CtIFE(m{yU~ zDTs*v*+9wvj~l7x)R?olim%ZZ6!GMh)#BwTYB429H#h8W{S)x)ZWQFBas7U|%K-X!7lYU)O3n zxf)a4#bOxFDgHORs#+TP$F71JfL>8+nwj0M$RJZK-ME(xr6%?b9$?YlCX^PJNlDmw z#I>H02MyScX233K!4lZkpH*pz!OFTiE;8u&g8GpV$cphNF!XyTLd*4*P6@+9d8}j< z%uI{~EODn(Ak3dnX-NF@0}tGB4ELiZDb{&ki4W+_HwlT{9fLi3Hh0yoi9+Hte##Fr zYQqwTfQ=OVaziA{T7+82$*Pu+B8;Po<2&puo<*^-I^G-INdP@y8Q~eE8~9G!eh7Fg zVfhIB7LSyfeN|W+aC{JtPq6$5G!7Iz0qnaQVUsg0>K( zqT#|E4J`R*+3nH=@PKH!{hj)O0X-KF{mXzBpXqdQnMRT^!a5wEM)Tlp$DqlzYXJIF z$8RAvg#kbkq3SnZ$GXCmCde!WJ-$2P7wF5KZPF~}z?gp;1o=GRdide|U{_AN?pEg9 z<>%K|=0C-6^?$YoUl3`z$&vRSkhE{L!#0h~AO4b(bGz;^lMq(E-0K}2#P!Q0c->2^ zYL&n@`B7?sgYdTq^Hd;xp-S$M@O8&P3s2*$!&vooCNvaA7`R;*xZT}a>bH(u`z?r> z5ad3m8x#}Cx0R%qD_MKK!sXLAew%$%@VGfjsJ8pwONR59Uti`48p9)sk%qi#E;-Bz ztlotrJ*$#Q*ojg7bMW5>StKI&|MMRI^#70J;7 z(ctrE=j&@kx021@1E@v8t;Db4)I9N7pIV_TO#Po6dbc)THYv*)87NQ8j+q?DMLf=T zr)k61Q2))4q7KzR6$=Z+zWn_8uhn}Dn8*ZSTQ6GO^l-5rDSuj8 z$Vn~-o~R?Ci~f(l1lZgsOc#a;_OWUtwes8A59BLNIo{BMdhCE-c>Qf?Xs^lj z?R-sSw!XLWM{G2rsrsx%Fv8JQYUQhhPL`|4>nVK#zH9bf9p0?Cv60)*?eN)H8z4xW zZ^uUDrJ5wS!tby%SE+r)n5M0VrK5LCD`LV9^OXn64+`P9D?Gf3#r`4U2z!2WjaVm)nm@kXqvaXbF~VM*MLC_|-#u+`@`7JBt8L_CFNa3e$k4t+NN_50IGneZd z_hedNT-P4%!TAkEt?TC2=-kbSkSOq$=slD(kFmoa*dO>nKg)RRwfOvt;OJm2{lFsH z#gp+0^!@KNA|GeUF3$g-eW?5d<8Bo{v8V%fzpnO!HCLHC&K!{E-6rlq^t=5@{_n0m zSx1#YotXRMXktSmG%O~aUhQ77X%n;4Sn?@~f~FMwYvuw#1OK-LY9anMX{}Z(l;9 zQ@~7XPhUR(R^FVvR}K539aCO}G2Al&Z6?JOL1n8!vThEuzfUv(roH%*vY>9vX!=85 zFJIzF07_IBXUq8FK1rZRD^WU^AH;qpn>aB~Y=m*-%Q?ck8iKun>WqeiIkVehgdq@U z%6g>VpULdMFlI@8(^Qe_LWk;}((KahL8ijqcDU)Whv2C%*cp;U8R}kQbFc#0BH!p_ zv#&lZWUAY5(ECq(-So*y;M zR1X=0cjJlV-YYCcV=d0(o->2t{QS)9WP)2QEyA*jz@;ZP5R8LR07_~5+V@8lgg(YD zMM04k4pF8{TF2DQ!HyWmu> ztnH?$``X&ZH#NdTz_M@>Ve;zy@gCqPq?RdF!yxY+n#+q;@XXsIqpF0^R6|mPw+D#0p;^t zdgS<$-gx!~b3JO?$``Sw!wuWYwj3{|79^SjvYmJW6`niVsvkF{XAGdPH)HA;V;*j{ zY#!e>Y`TRuMiqDP+H<#${*Lr&dA_2`*|>>(1nfl}hiBYM6uLs~C%Ou2Cwrbp)Tcn^d1Z3<`6z~vz$G$#xCqXt_e9IdlseLzj@<{Q zG`Chw_G#IMw4a z*K^5<4Rw%nW3~_pzq6|9DdEeA^onsOqoYw!nWBkAyjwBh{#Ok74?aAgKZs3vc_g+8 z!mDhsT;4b$wfVq&qIF;Y$9?zb1&k0n^lX#Vo7NEdRQMM)PV&5XlJ1qIr2m#p?-(LC zg8!)5BF%J~%QX4irjWq-kx8TfVgdnDhHnsHgY<=8!^#y`e5%`w8{ZCj`}$(c0ljv5 z(NS}&wfH_94=-VSwd0)rq7O-U7&W!5g=`RKxaRS}xh1SM|KMu(ZjbCSdpRQLp4pjr zzDnV@l^IA=PZ-={*ToBRN5_KY>x(jaxk2;;T)>-me1RCEG?st5c)d}6hxWO4UK%fb zo#VurNEzU~TJ$DtztNA9PuzI97~0YYHc;f3{cekl22omJ>mX9w<%?E4}8fB zKO5M}0~K(7Y`_KgJ%3U5T{XeqW}f*HYcCfxEz6bIU-!K;?A96?(1UM^5XMOo&Uo;;B%Xm`MeCQ6wLiVMC}@4$t;a_`UjkSt<{)hHb7bw@Hk zsG+M%SLX%_7GAH<)ymYt_pZ=`3f7=%f4*H6YDC|o&wD$f&IPzVQ#A1i_GbWRet~GH z$+47H4Bt5m2=<(L^#$&R1Z|6KiujS2)YW=Vpto7{lnj({>Ca~;bTn+t`hC?543YC! zs~7@#kP~XxQF}_W9x&5FV!nk@Wk3Ct!L-Pu2S)yQurU;=GpUWn9LQK~U1FD-fF9fY- z?RJG{Y|R{MX;S<7a@a?fzsa(or&lHQI>uR9C2AfWr zQwWC5zU+3w>YR(u*4ytb%;x228Yec~t*K z2zKhX#9Ql)@K&(}s#WA-txyA?ms|PbXMI#nfNK1nnB}^6wplVYqVO}Mp@%TQ%JSh0 zhf;jiN%|;`Lh@=nSlM=;LEz$-l-~~~7r#a4e^;YRS&<$kCh)qoxO#8gqn7I^(AdLH zxTn)s-h6Sv8B5VntJb9N6S^A&L8Nr*Eihp0$(SloISRs_l=UDBh z{aq0EL3@kpS!KgB)_!hpJk9R%jPJExf?K0yB!3!R)eryr^~vHjKvJ(%LZx>prD)r! z_uGlvvPTlh`;(pyiRB&zc-1rXe}L%*O*&r7&$``r>sCAGFx@tb!hVYG%CMP7@Y{~@ zx2)6~g1ykai%0uqw}VxUNCB`0J70XszFYWGd7KFZhqr7nnJ=Sx(eR9N$q&M{#+g3T z4)OqzcU-)E?=o>i>i$lk^jQn|DjJGivGSCB{|Vfhq^K)|;;aURNkrdT$Wiq-{3!lhLVsx5Or4{M#ZPi%x+sEk`dVcbsi?{tN9Hf z)ueaOYs7hta|PK^XRuq+{(V=Dg;#=>%`RiRL-S}Q>u>AcBZf}lqk7gAl3$DGNK9^!D2KRC2^4XWq9;5Y}58<~%TjXIPBM{TKe}D&l z8#V0TN!6AntsaQ<%{r1=v9}lk)CQ>(P4U|TRwnI=MN@|h+HMtmI!aC~MgYqIH67jx zUQZakWxSd?%?E=nC)Dc5)8g<%75bSIlq5;Y(Q4wqLr)uRh}Cz%#AP5G@2ihPQoU2B zQl<#L#81K3sYE|*t2oi1(Q|;0=|rRSvB4wt`})v`51E36n#q_T7Ca2C`x55rshu~> zmYiO~rEL>OP%+oZ*u1R9E9UvjB5dQfa8I zgmUAcmu3r6Jv5+ZeJyTaIM?0jESDvGN=FQ*TgEn-BW#b=*^_%|p#W zZ3{aW0~u4b@gYZ`YWG#)-m6<}6z^EbExPO4w>VL(ec(jg9uJGx?1B>#5MkgKd(uwv z;riB?psMx`(@rBqG*|mgYp&fzsaT$jS$Dn zrDzAvFesUx$0{c}1+@mQ*FEZBrv`4Ym zimPbYR;6w0xa19HSDeM3rv`a=O=|PIMd!Lt>#zK3itGIo=O4z$)*XtV^GEN40TV0H zJTIS)@urf>WFaSZV{FDr$7^tg>XPMct1Q2XBUg%f^j8)hpQ# zat~40BecEp)BVRfk+aX`olbQ)y5R`gNlRkOzY}{(S%Hr9i4;oP@rP0X5*XECDyk^F^{s#i~|1Lc1Q2nxXxiv|6U?o&f(X3&y7 zv6Rk0`|EbK{=BGOUvh|S#+n}}W8+LtuhZ>|NS+3kT<&og?jy4C$Z!WN(pTZ}N7?EBW0TAFiU-34Z+N6-6ydGVA~dUuQ%Xw#y}$8=xk@mx4GtZ{ZJjWBa-O zDqC}Dy}z^MqlSf-j|05GS6B<65m5U)oP43pNTrD0hsHhokS`keBc76R%%^qhZ+}HP zPG$^#i9dtXdV@>~p#XaDUxa?kZAy4}1?c^Kf!r${G7kWEW<(YD5BvSuL01h8{%u>> z@x$?o6?}b+oB`aH5Pysvi#=4TN69{4FKP+@J@~+nI+R>82DOCkQH)xAqOYn}{DH%S zhMhrogR`Q*Ii`UbxJTsL{xa8)8~r{2)@hvJ&uVp|80G27p%<7wg}jiFZCCSVd{vIz zK~t^4h9VP-LRBsPb##9iMoiu~%kO+fOn)C<5KfmL)ichq5u7Suy*G@-Y))0_@qQRz zu8Jv$eB+=AME8xqup&>|*BhsV)tVVGg8gYpCwxbbzGSr>oJSxXF(i35o&kz~YMjRp zk4Zh}@^%x+!Qw<|(&KwixCcjnw0kaQPABV<_(CRM@~jQ4R5)-7AXFP-4CA{fND`xX zjyZ;t3}s2RIb%)@h&nhGjkcwoGt~6MivrPcSWKaqjjw&K@fG?v%5@XiuYX_>sm>@> zL3dTHp&Fb|Ck%S#ZpX_q+7=F_3r+u_bQ@l*s#YuBCFF#w@$-JiJ4q=K+*PmUHX!T#A9h@ zoqg&<``UCec-Is^kH3<(R5BbBn+#3@#@p6gw4^eBH;_f>{of`clX02 zQ>oW*#nSPqQhwchh=T->R-v}0xTg_Jb93F~uRr4W$_k}(zv}%brQ~jqe|&TX?+yB8 zPB9Pd_^2u&X;Y?xmaPX|Elh}LNmavF_8P3lb57hNB{C-)zLz=s&kx>VA~|f=u=VT6 z=+iDOdp33`Ow=XhOr#|4J;Brb^}y~qp-^u%h3OyBi@SyKq_)?DqxJIjl!(Q`YOv2# z>9V+skMK1PorQX7K(lamutjuDFVx-+s-NJA;|GeOI`fIT|47s#s#@yOsnvG(Bs6RI zFlSOFs=KGk%42T)RU+ef3|S4MC~*m`=;U{s37Ip3XmS*xgCRFe8O9{OT&WW$EXy0l z$SKXd0JjNT3YvHmY_O0B@SE948jWh^=DDZmldPn&GbC%~PcFI4i(c3hfSG&#MvJs% z-qC{>c89J>wR7Jpe^}P8tx8j9>?-a%i+YZ$+gMtGPk}UhTz6cx-ShQ?7=}8K2n7ok z&Nj>Dg-!`z`T6Yxjlg~pvO~4UVL?O`sAi+9WJyR(CrI`dbNrdR(#@n{xduAVl`ebC zG!ct3KW1RG9jkoddFa)PMo5()H6|~x?~^xpy5+ouT0(*Qyl>gSL8^N>&sf<&g^>rN zc5*`|Wpg1z5iCxy@5UR@rr~Yn5b)d5I|$-gWysxNU0@22-4OS>se9q31X~vum^(U~ zwlUoXl_`>n6J4^OcEvnC@;ik4#aVXcTTf3)m_ln##4dw{)FyfifsG;I_k<^32!5C5 z%GET+>nmtlS1@pG-bMz;#LEA}%1XjVYODTyHLlaG+2^<@f+((=bS}LK2pdim9=bPQ zLHG`);2GapB{}Gy&6mu*mX3EB4XS!Z<(ugscI@CjK*jG0zFm&T<>@al?Rv4A7k9HB zmQ%{b2S=B#5NPqsUM47cnea(Iu_LpS7gmdaZ`OV1!z1{zTIB;M}wTQT*5V_+W$&vwU5&Nd-;;~=y3 z)}(p|G-zbp@a0LUkpoWWcsy363YsVBJ~IcaeWR#s_&}p77w!@QVG|xBn?=}@?RUnV zUQ~aQ^(^z9_Ti2mQ<>dyJ_!!zif zE1w=#h8$-@4|jkKMDh-Bk=GmT2qTTG?v}HkPro$t!b8rh=au#C&U-|Ba}k@l7pcoF zYPex^P7ER&X&8L_2Hu5C;+c6kdrE2D(p@FK<+}ssPeowX?gJ5Cy+l0xcZzp7mlTUz zXU9eCQtOxcTM?v6?q*aIofSC5>Y(X^MWsKIRk?ErC7Sw$xl^nOUgv~HD$rpF_lX*D z`tyCF@&~2(!tIkhf0tW2aasw${)Bu30S_K#X{;$k>GP$^*3Zv-(>UB%NL3zmsgg!h z>q;R+^7}v@j?}>f;B>Gd$TQvWjMn%^BAet~S)*w+vL@ppjy&D`R1rHZda8V0rD92; z*ij_4z!?ZFVBjw{e|%p^5+*vQ^9Ql*oqD}6Jg7UB`gd>ExQn&nQ)o0i_=f`bA#A7g zQHWd*xNu$L%>7lD?5jJ}uhxO3(q)O+6>N)UMYUE2tnh*1A3<3Zhzr%ceVBToNFzUl8@RLj|uP z^NXOXzQS*hr#Lj29VaNpW#|hjTT&Jkm+)ebS}t@(-ar`7dJa)SZW59Aa0278#L|*a z&CAArc3rQRdv(iyyYp~Jo{6dfMDFSyu>%|Tm&<0Z@9CongdBN?-w)m2M9J7e2o~8}n!7d%NiOG!j;|n%ahG-&Ee?)>8 z{*P2BEb#|DV)YZ!TnoPjvCW4-3Gj0>8-~Vi@g*Q)`~Xyc-i1=&8#q$x4!?W3iS*jW zgqJjpM5wB1vdD-Er~;%Vu3Px2riJn98Md9cvm<~0Pl> z;6aI6PeUAHXX?p|e(ltr`E~|a%krNVHPCM!MB8hAO4>W;K$;z+)PE9Pd#7;72~QE{ z+FqvBH2V-7)W3JERuqgg6cItG*?Qk|1pxdPXS?IVv^191Z=YezGX8 z9SMZeYR40$n*!WvavVa%=_C|(9UbbC-qmM{7O}*~+B@s>T>D6^clgeyNq(=TejOYh z*5H@hj_9gc?lHV1PM9^$(rv<#=ioIrkenAp@(Zt6ql=oyd7`<9|0L6l_^>+QvW64t z^cSeE9fv4N!G>EW@D+7keNuRk$e4!J{R*MdRvo7^hh$m4bxVsy^ccU}WOnu^aCxMa zMzG0rW$34%H!;s=VnHHJpSiAxcy)qrC9Xdb#cm>C@q2TkGdDrIflXr#dOS!?eJ>Ds z9KJBzXZMmBlLWw&iTRm8Se@P%Q z3R(HEI2SN^GT?UtkZ3m6&TCXx>=vX-s*nkN+**%s31GwunHAe zshRIK7C#^x+x_vxI&zAsV9n#<0Sq+I8#%VyLH`zliqs(m;6a{B?wd4-wG&e0(wr1F zanl;m9_vA4IgUL~ z!&$9Q;Ryuu=1-QOygKcn`d%})}7Vu9I^pt!wl0caY#4ESh6f)3cjByyUGe7f}|1_W=$WXhm{LK*MUe8)CXc7=w9l z?pxEUb{drwqogFlg&9oJwCNMO2tNq7sg`}k%Y2Q0ckE86Ok1b+K%Tnte@X=E-qwa2TO zDRRoR_DSx}BZQ6~jg^9K*Rt@y;sFu63#rWI{AwXYS;CeSXO-2=l~o8w_#)WyY%?lM zV5&(s$dCGswVZ?eq6xf>EEr$b^f0$L`t$L25loR!3&}qJ0;A0E|1q+^rMd-zs9u0* zLk_;L$`4M-Pq{whei36EZ#{h>3j8OW@3fib<;JV9vF9`-r+x?=Fta1Y%0woB--6ED z-2#6RaEE(>cXg1(G+$iC`MTi(syz3{OUU&09O84MX^+3#embQ&d!Kcm+18`~qZLaR znPm-GZ_oG59#2!`s096Whtk^)@_nL3cu~N9zFvYsWj{LbZa4=&mYWkOJ;BEouY+c!DrCI~3tG{+bA0O#P)ad|~m;*pBYvOf4>&NTw z+boKqH#}=CThD#O=**ijK8vBbQ@jbqd3KVMZ40OiDtayW!^z8>gQNLezMS!+Pp!e8+2xF*c>IDGfs(D+=>H{S*Z z-Y5H^&e3Sb+W@%sjGv3R$WAEG?yaBYPWt!pN*rSicSb$os*gDG__rYgp?HP`d|pW{ z^biMMZL1JF{hjae>_DaDzh!YRu7wk0n{#kYM3_Y*#0l7rW-%Ogq|BHw74cw*91TOr z4+k4JKOyW|7%)LfJL|z>;nk{w^oz^j=G3M6G`^H*SEmMaHbw-8|8k~zW=NA`F19yS zo9qrj7hyTHEUR}v3+6zqNyx&DH<>GSEM(X{R*q{75S?$aU|{$_RjC(XYpzu{i8()3 z=bX^n?X#lFtOsmyY$EeUtzZ9rr4L}ze!kh@BdDZ1aXBY2_NaNX#Tgej*Wy&l;weoe z7aSUEvQ!KOg-HS9&6C3N`(UO@2%(q;Jy|Qc)&|HZ5hEo>+?Nmtmog6J(U%^ya`R*{ zniAAphaeyPWPd;mH5gd&7B0~RZ-b88a z_OT1gck}7!o{!0j=>rp*wf%gdm7%h!OKxW3Zss8A*sJ(RLu^PxbfFr;mi@IS&oM2V z$NOviG{L-$o#_&5NA!W}y2TMICjTi~(ZVK2idwkLH0e5_q1|-&3W&-XgS#IPQo5$X7(?z+NC76cDRXEx7ny?2U^wcD?8j79OZa?t)RtvR+(_C;j`H^fz z-oCh_eJ@!^LK_j7G*{gIrf!9s2dl9i93`BV!`evh;@UvW=0itC>RshUsx}NxOZdP(!>nLvJB`#i? zfFvx#_3)i^zoh<|&MK7*#omQ9^yv_ZNpGxZmvkY;Py;Kt4_0Iz&hSp{g#7Mmhq{;# zT24-Gm>e3MXZ~1NDVF2j<&HlOuQ{44z1QnDrWH5>AlZdOQ*^ZB6VWm#lY(8z`9EN0 zV7M1uugV+@$N()2{BX|J6jt+_h%L^DSf`a2&a%hoBtIefJ6Ve!eyl>NOz1ht_d3=Ta;NB?60644yRVLsY&D^mH0 zyOFAt;LoRKy>y=YK}ve{uGuvt>`38<=c)fnX@`myK#6r_6G(aU^KbXzj*|V{Dhe{b zul$0&_RH4;j*^idva&_=BS7ZG;ykuCu5?^p`bR45@TZLq!vA2clSRs^>x;>yhdD-n z@JC*1(fDO`?{1%byqZ%u^t9X0pBp4nR899M-mWIto_vmXzHC5KHsSqL1ikiks#9V3 zx4N(vlguCdNk-Ga*S<4hZcNZ1iKujxX()~SLQC*(!lu*7nhf%*V>E@_Z)p_?Ue)-( z-1IK1a%GDK9(N9$c=@yWwPmz;)!9gb6jl@rPecmDjq3pW@8=@b!mH_IVBfJ&g7yAne0MjvHfwyU9_p)qZ)z!PlumU z-G`Pigr6*I90R&UEM3vL++MI1266e)-p{o*-(aOF**(%YBkb#NjxW`aIFaqf9Go*c z!6F6tqu=L!`)GM`q1vh>@!08dhWtT%FW{<_F21#3m0)ghdOc1EqZWfcb5EHHl21f% znO3e*#+;SBYR@`h$}V78-8xXKyNg}2WzghM{s7&Zj-m0Ye0M#vB`ak;A4YL+&{Veh z;sW+|Y=Wzb`2#PB&^>ZN3Y-P46eT}GwXfYg3}Z|$vY}rtO6~wQy%w_lNE}f>+pa!^ zQ7lof@#iV3uzm*-QrnA7bcm|(YQ`-_p1o$YiEu7M3bk2p*U!bO?iNseqIOT`$}cim zUath@q?GX+e#dDip`#8m*c&O*<6}KYy+^AX_FRPbPqkdSEy)GPo$4wAQ>wje7QMp@ zx9!sk+QCQ$H0Qhkq=D|`GuQR;$E(Zh9^4yqDurwG-l(QFm!@m!*Pb8EbJrU`+xWrp z=QuDHJmcSB)?4kxT}Q8w(kW?za77G=z`TIhRR>WpFJS0G;B2#nz!s9vsO&EenBglD zF?SyEDjzWijv`RFCOhVl|AurskXHrN{X4IbDiYoF*MHLf^dzs}d{J;Zq2CEduA@!) z$ES^z8%U-nqvyUd!@+aK>wp;$UC*tOOOB|3h81K&nVh?=&rLEZN(0@4Sv^M)3gFUw z8Z2G`_wa#!A2UJr9}xdyK3=Yq9t`yKnW*kaarLPa4a&&is{(USMA&4yf?+y@FvfbZ zIZZxy-o6LJsSYM2=cf z)Mu6*?iPWZNDN1n1f%bVyl~6mRYba$M!r{uuV>77#=f5WU0-Dg9Kkv_fOok}nKhu@ z3Qi*CQFJFh>snk>cGq&L`;_VPwjXEo$FpK>jWOu7J1iE}G$P_k)?!ipoY$3<-a zB&rDvZ`s$UI0Deh4~9Y4g`hr0(y^s)rSa%abeFP=tWIRt&~j@a)Ws|;=i>5hvw%~9 zZPbcf@LuC|L<8!trS`F)-8Mu(232_V$k@|`u3+y*I}6g*-IuTjyibZfNZY9Bz1y+; zz*k~?dRr(uxUpP)S|+^>7zd7eZ>V!4m$z?m8x2F>1sswcqTcqj2g>qTX$}oW6Pae3 zeq6D7VBU(orMv(5cn%~Auf3V>8vM|~QC+2uo zMg@6~yL!!*xHpSGE)ZGZ;h)v0VJSOqs%j6b5s&PER|cJc8z{(U|E!;fRbhqF9SHbH zi2Hpxn@(}Zvjjs+Yg%3Ayr~G);V{g!^;T)Ev*}nUHGhD6@o&*~58$-x{+YM4e^p;Y z$?mK_LlAo?WtwD&Syb^1F_#}+`KB$>iZgc%V_qnr`2-!|j2DGLPw8xZWMx8p=Hm8B z@ESiZz4P1lU0of|lk9%W`44AX(s~dmREB_#{W7|lOQSq&*6?6VW+yD;taDP_<_HdOVlEI=%}Kv+BgZueNPrS@9rSmj5@V zp@0dnE8qr}1rLcv37V+mgf(4ZdiM~(z0s^^x9Zd&_~m>i`Nr(8;#0sJdw1m~`t8j+ z-nMaR7Wsh;_bQWy69E;z>khK97VGjC474`mg|>Ce;ZBqq;KOqZPGbg92M3twH*Td`w_AV=`o0x;h>x4s-z$IUrr+Vr;i&V3!q?b$Z|>B8uS z_)_Qy9BRCs?taTadxElP^qP~8r6$wZ5(BDP1vi?(EiN?yvNSIV`?n{!%ZJxXxhI^@ zv=^-Gf>|r_I>-=8{g$drv*R5c8}Wvq8&{ZiuGilzC2QtCX5lF@YLG4 zIDLK99NRmY!nInQ!pp7YNXRpYW{0_Kz^XA`6xOOyLTgQWH~nN`&l~@8^x$O5ytmZ} z=@2#}j_vuYaycv*u#^Z^MSV4N82clq%62(Ru=u^(@dN*B0X$P^i*S1fT$a0C9PY;I zu%<^ycqt3^Z-SX;&!niFAx5ZriU&-(^}ECEp?}v_!+$V}CUPRj`Eed87)Aq{8?A;f zbvXg%Wk#zv)>;uK)-X@VNbP~}1 z^HN%Lf??+SmZrczT~yl}If8=0+igR)AxzVG-QU8WzS1cglef*T!IabGiV}Ik@F}j% z-K_q4-IllNXzlnDFqtu~Byb5&&vqHT#C5dE9}{cLsWfE&9hjHv#MT#oOV>6BP#Tv* zQ;BQwhG9cz_{8N+HRk_bLm3EhJWKf#d-!(Zj^%y!6k(cdWXDk;qjX0tF{vWe)kdg? zIyTHyy-t=ajZ`uWf~d1l=K>Kwa)~2ZDX&ul&(uLuX7eD5L;eZ(i#spEZ!PFIUh28J zLcFx0vT69C(6ca;u2MYwTthJc-!fmuRSu(tW7m(d75is@uww0NhGd}HOb2v>_}IJM z%USwqpDVg#fXK<-G24z- zd97J$(@M zmzepd{);56#G!RS#r34LhF~TzUkB`)Im!RiHw)McQ+tb%u4uft=r9%ja#fmAZ{Y{; zP3it1`CQwP-avtAO%XevV^~MrnB=*iH8I(ABxOe`LspVAmDe``kCK`I#p~%nprHYl ztCO_FnQ$0^*?{<6ec$R{bZV~-4EHB*SqcFyMu0O7$FG0s82@OM7=TJHn!1^9OF~*7 zfjNvFTA5HEj;7ajp-l;n?HppGyO5WZp~ZgGy)&38mEX~?%yw@p*TY^J;?`Z3(yFT`tJ07@}VSpPH=$$L5Q6IX{ z-3Qj^IV_4c8Cp+r?Ab|_?g&xWfTuU-$DS(MTpbBh!!p0v40iC&XJ_IUE)I`P9lxa= z%z!K&B-^N0a7D0!r=n zySuw(rQMU}R{f7Uamjf8zM5iuq||&qnpgBuf&JSzk~4O~V(YO}E}^ne(x}6m$!`43OpA z+q$+!BJW)Pn8Zk%LH*;Fs7c}{E*ZSqhP}={PS&xzeDoc|Tn_{jVxA881+0A`y56rp-@7G<1&6{EX155=li8UZGjk35 zhk4^EX!|H+Ld9nY# zX+bO7lV@Gr8Itk22KKVCZ`-MEYyRfKe{E0BT)i0I!I5zNpjxzPsf=jJ|HmXC9H`{( zX?fb0zgpb>-ZLz{akbJO@(_}-OE646lv?omd!~*Mf|%V%CrXXENYivzERwWcpn&{ zTx@v7P0$B;&FGgW6;H4aLk*eL9@6zo0p%DyY2^9E7r^P62# zksXt)#)56P&e4tGTR546HS}5f^+0vR?u)J`VB?SNIil{RS5Yw)MT6yWtxz)M;n-*ZoX z4eE@1?YqP>zR$|(1|re+#A=%89^XF(JnT*-)d`=EIU|CsH)&my98SHUb?Ue6^EYAY zr_%I9m~+l9iEI4_<1DauEJqUUd>Jt{tcw=!LkfrqsM!hQ0oF-QAB}bA|0uu{x^|{^C-wK4|COLvG3`QNc~u_D;*} zs6`f3Gyo{WZlZo!f_Y#N-s;pX98f&3OV-=sm>UrjLt9=)6Qv$Mr?zi zPMX^76a+GEar8Mpo_NI_jMGV;#cF!#v9^D2_3c$$gUVu*XUmNSBwv&~vxS1% z{PuB_W@=v3690!Z%F4kX851bYJG3n_DjrM-oxPKVvWyl&HgN9`E}IkQRiSwy{R24f1Dk zaqw6N;nKr@>}ju~Yhr*hCU`tsNwh6;-GxVd2H+qWJ8dl1LRbS3U+`GrTARIzjG>+dC zJ<3>Qa(rI?_PLC<50My`uav33kqno_NdA@JCRDC$ca&pG_tDnNdcBkdvt~S)Id>29 zVbbgO=kqbx{ARBmTSElyVmDj9#dmn=4o!+}qGUo!{bdlqlmeYAfdb(=(UtLI^R=~+ zRPCJ);U9)6wUHzt_-y0*w=7gPeip$uNqdB!U=U`w1#IADX0KPW(g=nVX5N8tinS}? z(hKI@-vML$H>YK5r^b%ZpSfHC-h(}#2r|d?YmH%2xXShQpGN~9``jN^zJfmPxJuUPSbYt*6ok+^0_u&WksYKC?EQ@-1|v7WGBYy>T9un0x5dzbeFwsrc;4bfP19Q9js& zi}A%tK0cBPM2owq+RdjUC_eehLp$=Ue^FH4p6(c@#6r`1ACj=fN``vvLzCk@vY`@T zR$By}yK~*^aqr-4y%UMm_0}+l8}-OIp&Y=5x5<3_+B=)F5mLbAThESM{Qzmz9UXde z^T3L21RJc*KA}cd=7ST*^JY{HgfSDcX869yQ9_QGcx3;g%R4|(NTuiuZgzo&C_MNc zUEJiJrH3BO_n5N}Y|V=M6*o`=`MkVaE)ndz!>&m49Uk+@X;l(mj?f5*p$phU=8ab~ zJwJnY8Hat)URXuYSyJCvN$oV)NviM3(q*x|;QRKGPj#%t;AA4RciSBrvbrhJ(I4=p zv;S*_nE);xiWj;(E)BY zFbxV%weYP$fGFZ8M54ZAtp&I3)aNCcuTM83y2;08GRG?9W|4#x=2f%{sT1xCRK)>O@E*2`^C)8&H4JHHtvnh!`k#{ ztM&|Kj25PE2U_{OPa2ftgkSr&+a50&ZFi2@_?+HBDogRGGW4~OQrVfZUpEA~KbCG= zp9mNqfxHQQDJe_*Kk$w&hb`z30TUI=5M|8{?IBPc9M6IM0@@!x491o!p6T5xbK3&W z#J>$Vcz!Wcp~F*-f}6|b33pkyaG=*4q;-(iaE_4EpDXI?@WfRffSS!T(0_+xHG>VL zAQXh{FB^rUPFnf+NsBV`-i%Hq@U)g;L|B*%kL30MM)1XW_xSRib;@3_{Ye0IJxo~r z7})K;Xst=$#MhSH?7 z-q;>E7?9_v3J?#jX6-ZND+9Hhf zJftc^Lxu1B(%uA#lj3p!ad%92BoG_jf6M3*NpI_c%h!+Iz;v>=It(vAVbe|Zy4xDh zny>V!iu@i^#}dwA`|YLbJ?f-;EBF0L5RM{ zgVFE$p38$uM~^x5Xu+L?fq((8VI+Ox3kYo5khWe!42>o+T*7JLWUSNLCu z_r*gAi68*BRMI1dX{}g6!y|V4(Nz_o9%vt9I)+iPsbL@d=`e zQB}JLoED|i<`G0~ITQjz?~duJ^$fciV2}cBxy=4$9oCaql6vhr+^hNoL^h;(-JK-y z7zI5n&=YEsNvvP5AmM0sVq{_r8$26kM3ZxYF}eKfgwzz-+0qKC8rkF2iQIBJ={vm0 zmnFv#1+(4eRV&Tor{C95cZ|22QPuNLmz*W> zK)5&XBGz&BYLz+<2N9^}O@BvWp z5^LT);8X1WI3l0FPFYHV$7$CuwEL{EQc+C-=fWd{pEjjO$#}B*_Bz@>t`jK)j{AT| zJHFxZ)4W^NP4b&cN|P9LUNogQbK%>3Xfeg_k8MS>9P0I+Fu<6`_Yn#_d6U;ODLF<~ z=hrzk0CrDe++6~^liVzcphRJ!&z9YCa-ZIMV!<8S11=!wAYvEC_g3qou~n7kJEThO zFl-H8(x#G1hlJ47*7XadyDtmGDlg0Xa-@Yu)2DG}w!n3Ql9raJz;hJIIgwy98B^=6 zwJ+o{^B4S&?1v>qp#+mZI%q$hU;)G^nyCyP;$o8e99mym{MxzL6ODqpubZ;)YvkxB zN{#$?NBaa-B?=JBFC+8K@y|25!DrdTfW+~=*LiZux9J2F3y^hwNtKtgpClDtTN9!G zw&C-}Ef0BQy$SwQeiTOIrwpLYrMkh{)~fm07B?r970$5Ax(oKFr7hH3(NF2>%Qg;K z5*)oyIe_7$S#g92y*qVv87Vrt+`;NHyaA`msO40us>&|#PjL>!o*3T@o&r__b{UD` zrOOD-_wQKPxjyPT;$xXD>1gq+(rwtd{DQi`gD#ytToLzSs4feozRrgz;D&%*M&gs` zC%R8l*>W0>54-a7A`t(%c>rrxHJjN%ODc}1NIc;rreO$WXaJs#k%?8biVm#g+KBi^|2y73WLHhm~QvTQpT zMY7O}B&Fc;$%F&G=e7o1w&sn%kcU2eeRkrh)L-76vyxfO=~AjThTk` zI7_Au6i7YTP%-YP_jHTzy=SyiA)0LhqYq)e$bO}TBH3-JK@R(i_%rqpRAiAf@u~Pw z&mDgF)4m_7i}jTDLz@QV{6j-GdMVe)Elljuz!T@*m+1Rrj=N1o)}2!3s7-X7!C_%x z(>e&YK_LtzZVW4WzIGw3;&X(nua-no_oSXUA|ISea%@8Qh5hnaUh{%$BMmc5#G)uO zm~7}BGnyFcefDo`zPJclun^(6PU4p-8X&$$q-A!C5Yv^r`t=|4kOj?Z$V3eMyTya4 z-NyEg7H@y1g@cSnH~=`ixRK3HV_Yj=Avu2lKMWkJ`q>(%0p`VeE{332%6oT~^q%M$h|nJ4CKpO>`@t0LTbQ zk4xo%iB!7rRWezbM~tnMs#^>w>DERI_@8xN^KK+iGx&?p{L53_F3JkJ8%sohP4UX3uN0PzT}m^@X?0xqoceas z)7u2T%K=(n4&BT8Hli)%X3lMXd4|gQAdvZS1&PK9xU@={sIEF-6T8&4TN-L^m*6Wj z8_rgKAl}Js>PtVmRT$lXF$j8JffNz*xVV|L2!4HoZxXwRPE|v4E3#WKkTk*7hq1wi z2hQH>Q$6ylGhSnVVF|y*yJlnhPaOX%mg+==Lv~s@AmgKR0DLW{~F1LEAZ_t1oBEy{KY=+nyNe4z4rKtC&gbAe!8dGDoy1*DF+qY!t9pzwHDVbmpLP7RvV0e z4q9#-nKgzoWba=nU%#nz=nn>?U#vs#_kyIzg&Kv|`uVD;9MEPNZ~WCBaD#R!Il!AS zGBAq)nJ&lQml9EA`>>qu4)vBzTxP&w=!qHhea|Iud=;KceKn##jE7If^kMQhn6f>F zX|hsGW4Wt6u*TOUY*|p{6LmOi6S&i0-T4C*MXL;^9_Qc!%j2VrGML5I+E$d*mgKt& z#{%a5kg>$U?@5rA1e7}9dEVG?lZwufnUA|RaeXHWv7qNYToOrpN(^`YXpZReG;w=J zU2)uPt7vw1IsyqYKM?^HMI=*y<>!o<;SNiF)w&@7rQ{uyCS@C~d0ep9M{yf@Q)Klm zFs@b{+qe?RYf0BKqtl&2khWjfLu)`iv;3DBh-B981;YdVp{*-I2y^A@^iGVE|Jr1N zE0+_|Y=Bt^T!d6qL*h8^xs6@yM|!%={%UxFH<!moae^nC? zDr@CnMY0oFXV(KcG=`v`J8e$7l~smTJViH8^t@oYcJFVCi&bQh#r4;5aF095dD!T# zn-&0oO5S`}FCkIa;^*IO-vNI@3JMEjZ$yU&fWN?K5nEJT0;nxa(&g(ez{~Ue zH4Y-HtxSasr9tffGi*4YTfigeGnv!Z_Sh#G&pf6T6XK|)kmBA!VtsMyNOFGhcZG7; z9Cl%8E#iyl$vf-RT5S_& zl48V1FC3mnYem()nI1@<#BpNCLi_*5v-&%S@jHtWMa7=A1{v)_zJIyn?HIUzCOG%? z)mtBcGWBEH0>|pk`GQVSH(^D^GXOZxz!JTnHCQ2-2 z6h(JapkIvwj8pZc0%gAFEcHx1VvY||iW0g(es8{>s)@qT3rYtc{0XF|F+Pw3BRW!wy~7FihQD+7$0t=9rq<0T^sg ztsX(%R4#=8Wx{!vbSv}arjIvbp_o6EKKASI(*vz-ct?h*0iy_FTER@q^Z-87cc#bG zmT;isa3jlBw11-H&@{5(6;jL|$+IT5f4Ux#NFGTe1r&0}4W&b$OFaE038CZd?K3Lx zN%2|^Qx(?#3uM;(F~ePY@E%ucIjTcoF&mcAaJPr2CFIdFEeA`o9&L8n*44J;OmX8%Kwk&?0Y)eU z%y2%~4yn&HIc7EitGz_jf-{jbul>#587`D{D-bwR4*G849d%GzYe9buD^u>@g?k&Y zHZaI{svkzebwfz>%oywd8NJnso@sG=7P8VF>xjU|L2x)R7$NkYGBgzG-Jm8=!jAmv!CvkhEli1cmF#V zivCbU`(PLR6I8A=ErbRFyY(_O0-foGrwnw$SVq9qQ!v@t5Jb}4Wmi`BqZW4AOc!Gn zoeNg5|06QKo7kw3^w2l#6LT%BnFSrwmK~BJ_jJ2tx<@PoakK=aM%mlm$ef$4$Vf>` zTXA-44)ihHSH(W3yHNI-|71nK_uThWBHV()1@J7uU+#s8`-WGdS4StT1_e&xrja6O z#rs+kr`_ZFBRxboulXpjo$=q9-5{1X($_X5+SXyf!z7p);>=8 z^LwbJN~UhCIaQ+$lE%797P6@)##nDC zfq#`Gf9(NK#okJe3XXu{@At)&+fv6DiY#U7Yv8>wxyZjAA4cb)weh1C2qRp+} zj=P-A^}mIWoL2);Ile_+b3`{0c{ZoS`G447=5 zzJ|Ym1vEMUrlXgR6Nix3WSP)2zq)%4Pa0Yi7vO*ntm4ru@FoTY{o51liPe3XcG3JmUN7f~Cq!$I8{HEiK;;HuJbm_cq! z5hI;kr7m!^Ry&P(>n6vX?M#XmB2^ef9#lkFyMCWsk( zmp}xrp0Y2)_D2ULbwWoi_EwRWt^s+mxWOb+LTg}buGN}%xnxy%l*=&;46c$z^^4zJ za%l5aTPf01AZ7Fg4knndtf1^f#R627f*o^*|Aw8?#N!$L#!idD2R5Ppa0ny8VRkJ@ReLl{r8>BZ~Nzr%{#ki3- zFdySuCO@WF>&EtZe_7ThJ;7WZVF>JFHtQGvl*T*a;1^23+o}l!4D$fqD?sJ|E4uT1 z`Bp0t@^nHt^rM5tP?z}onec9Pmj@U`ZJVP=ocJrk=6)ow+?dg23$oCZy2mW=P6ri? zYt_3v~;~o zTMg|y`WsaeL$dQh&AvhKVw-zdgGIaWMDg#Rp>6Pzh`A_U4U{ol8e;Bk~e)F6m0DP_<>>)kTy>oh|dC9DTeF4uyLA>3YDNVG- z+Ya0XK3L=)UZYaXy*|Bl5|h0QW3E)kN?-!oZ;zYgCD?=_rKM&^w89;z&%PHOY}jLQ zrVVm(3YfWcoF_{3v)W!0jp7_zKU#&K8MDe(3~$)u10XNXG7DQ;Gv|y8Y;YMY6fp5F zs`r$cx+zzxyvD(@Tdy9p4tO{AzVX9u_3bEuw?M>$!wCVmyK{iQ4qe+?9wjZ`=YeSH z*fWFLVNa@?(Iy*E`ojUxbcN-p{eW6)2IbVn_6x1bVXo5}AZdOC5rZ(ZuR#1Edf4ft z>?atVn1QMw6ziKxwFZ-t?Sr#Qs(1u~M`8E!n^h5Ou7Y4Q^nA4;>|!Ec$lB)oIiGBo zi_mzW%ZktWp<;#PS5R$Jn13fBL?hH2i-#DE)cERL0sIxMTw5o)x)TA!*g+==9n5Ff z64wbTDR*TkTb;Cxiw-(m<>Das@f8+RO(FJg@!|{C*EWgz=$YSuJ+o#s9fUuiDd*&g zd8gjWYSz7n+fHq_*KR&IhXHG{y~%d&ru#cP3B_^y3%$Y2JiZlV1;6QTtJ251Pic08 zn0u^eY@S=6FqpuB*b4%zyK(<_7gYU)2G5u0Zdh0+j@5H-PMwazBxW&-mO{eYEt1yv zzq*@Ra9^0EXclS<9NfM+r;#dOM)hBu@!j97h1PS&E`Iz$<@zHF?w-9g(t#_=;OXY) zqcsu#Ip`u%ExYTSd1kSzHWz_@tjs{O9dncw6_DQQ%FZC<^3Fud=am_i*=H*)sDzp0 z_4&x~ZG*i7^FTAR+s#J-o4L3f2kPoDO~~(a3eW9?_O`3IEAw|Ol{3%`i`U%&-8PE7 zwWPvjJnnRi_93@DW3-M_-cSIo+`D9MOP5Dv+v}0sHd)Efb|gpgi6kA^3*)Gj zpKgJN^}A=$OF{0-c~U%UoM#%(9G-Xp8+O$hz_2pf*&ZhfPZO^C~;SHOq7RL%F z`t0Min@rd*_#_n`oW)@d#XkCO^E?I(q?p&3rwC$$?xsW1AOyW9J=9KR54@x)djj)O zCe88Q6}Vf4-6uKoXI;t97RCtSEl2#$PtZRpuf*{hh%AC%#56@2=5RZ09G#2B-vf%{ zts&#On+J<#+R-%G55Ghrlyuc(kZBD563U2B25K?YvwL1(WD1c z93ZwAI5vL#P}yHJo$I4IF+Uq8=&R5R+I+lIo!G81-{B1UOeByHYq>(zD@`Un4Zb}8j*tYtW`(sAZ$0k}aj*7r-`HSJ2 zJ`YhF9B_KMoV?NPWLdbp;Rv6PJ4fq~x5#w+tL`S1k#-_4G9z4d1=B3&gavtDKZ)Ga zO$iVGf=7GETG-toBJ^?Co6g?oMasn4o0iAOxIY$qG^Mptti+Lyd?17VE4iYW_>d%_ z)0_f#{Kl%D@Fu#ZpL=L!cK|^NKEdwQdGdsqy5rhDZq=>M8kG%@w=8^W zY!u+4kOCBeWPHu-z5<}9o^5Cya4;SLLxNH?mmf|$ulYR^B3MnFkZ@H8o{qmyD}$EM z{_$*e)55uFq^dA`M?&$@9b4qK5GXw}i_L6IEND(oFSo=3(NTI!M$yX1i*Ob+5iMx0 z$3if*2B~i<1=}g--bBR;p~OQXFNevtH=IcPGkC|3(sF* zF$=SE`mM=AKl%S9Rj4q8h4Ya|wU}PUgqgv8wyeH*!>!$PC0e~mZQZTazdiUcZcZ9`7mcF8+EF96gy}Mm2=cw6fK9;^s z*HXdr1Fx!DV!>k>(&?;Izy7oOjO`O&Pf)uqv7kW^Yz-@QZvq`bu>^W1?(dJDc*-YZ z1=Ze`b}hte1@}v^-P9^}pQTr$?LTUwXG%z(f6pBG8y`6MA3kvVQ1mYS14T4`=G3{= z*gJ=BoA&Ru`=rAnH~GGrQf3Ajnn$i8+6wRO^HDFYLx5b}vSg2Y67+fz_4M9K<`cKt zQmLLCfgTzp`?XlqH(%a0Ko{O0D{g@|UqJA-=_9VIMR=K+p8V;Gch5Z553H|J(P6^M zv2a_6)H2j_I9hFglY-VgUfF>(wA4_(1ztQ&Z=Xw>+de_qxV!cKoPoUfX;r;Ld>aTg zTeaWyl1KgTM4THzA>22IvI_H`0d@>ow!y+Z)g>$UmrClYf0^S+m*ECFiT9OZm%#cz zU`(6#_=493sl&WeDlQQj<5cF(W6n1JP?W&}Xkp&@o^hDVWjD&??7`VJ13Bm}HW3&t zh~*J#CWVvM^T9T~7D=I5R&S%N_4ibr1o_0OGWs70Rx(XZ(b=B5*ygKP#n%k~GE>KC z>?=axs2Ih*`T|FH#RdoMTmxN+8DQ?_&si~y;HTnmcJYbzSrzdx5BqV9>J~kX*1=)U zK@Op4a1Gb4h=J_7HvWoJ9+LB}HYuVN$q|aHp$$({t;x4)!N4;$OOpZ0+ry7*ZHETL z2fuIQApJm6E$6wkwDoCtIGWpbwwlM%zB9by2pZ`cd&h2ND(%IBu|3g0bd()zME2iI z5_d2ppH26EH@I3h#*zhb&?X~#Wa&fyb&7Dvjyy8F_PAnu`FC>TuX5{5DfR90^ikbNjWp{LAOtz0lPV#>` z1%DpVKMoN5=bqTV*c<-wum8XJP+s2U9i-yJtwDYiNISK`d%kCO33Z*6k$O8#g3R25 zdsg1#V`L%r0%B6c^+xL*_rjkZ^?_Zqx~TX|E`@e{n@Ku-1m~kgvNV4kzG{mV<*Np; z7M&t$x(yZ!WM=~IrxAHv=_%buraNSR?pIS~Ou854ZtxO-o&}fScjgQ1}9Nz!z5G&gE9BO@P^M@J;Xp0PK>wk zdo9cNG0g1~-Sr9Kt7JS^TiV{*Rv>Jig56e&+p+Q4;{nz)Xf@?^ujYOSrOum%Gn4G6 zhIh|4{qgxfqTx#abg27pryh60LLl9o3LEd?f;{G{)!3`wqurjXgG904Ajl;wHxv?| zL7k`kU{6x8YR?XbX9!{%#p}bY=aLa^Hw>j!F)mWhuessuvns}0WqgU?-w&DKgtfuU ztrHIWV2T(XhGC$p>!}O77l~w7w&kcu(nxFv&?#1L=QQILv^I=cwqe=G!Gg+8$12Y zv}0<3NqCrDP?Cf#gTfLyTp_1if6b{VGOCv^!!~5cTZ6Dv1P7-6vxl08D>7v(wzroZ z7eOD0R3&B&P&*zhNZJ-vdoM=@t5VB5U)n&1F$?-fg#rs5q4ME@;9YK2gANy^Hb>d{ zQvwvK7=tN%T{zVZ$9!S1F6bljze>58klX+0c3*(dJ6>EVeGvVy?hKcc^0|pC6lvRv zJuQZul)_9mV}3^}>}HBk81i&t=OV=}c3akMsK)bZF$i^fzQ^{oe6ko0?5`%E0ZTLt z7PiK#hUMPFceZ2aRgE5U@*u;-n`zaU!`{LyuU9ar^RyE!PM3$c^d*K3KtgmZhN#4@ zOcgysfVV!CVtjxppc20wcTujBrX2()iTVdBlu2sy1D9`j)n)oC><B`{yKHo8{TDk3^j*{; zr{$|ZMCIi4JG}Y90mQBYGDp&E!V%+7>ogUTu)92~AL$3HlUjK@@yV1NNgN#pyCi^N z5~hm2hY|Pi3sK;Ws6&#ysSiPEO|l^JFNehVet&ThDXv`~-6)B{T6o#(_vvM#(D(;| zfY-lZ6efVRpX#hXRj!La)X*q87J9G*kx^YLhOYhKKHZVaU*g1M^=wBW@heRO^QeUA z?Y@n{YBrRzwu~|wcMrTD(w+FjfOe*u+H6nQ5O%wR7Poe7Wq2i$Ub@EFE{a-;2t8R zqYu^-ISw*yOfaZbmT|i#&d}*5aTD7ai)HJ6Tscd)li!j)6b6mv3W5a{(pO~QHaKz0 zg!sYV{qGFdreZ|?O zt|)}i`Qu5Hm-H`}#E{ky9^LJ!==2*dWuu9b<}u0XXNEI1+%HBO{HVS{PhkSfzlTX^ z3SE6lC6G2re`-ZJ|M@{?-=w#52em3Nlf*y_?L-sFr#g3j*zLnk|4YgnieLIqe zp4vSa@JtYtyVNQn1EJ9YVvm*dPA7uHa6UB@pQ~5TQpi|m6&uNIhVog6|?(?yL$TtW%t`} zUvrXyXK`#LR=^1&E%>(!O^Dh(H)BBhT*BqtRP=Lq#8!gAhNL&iiS{Dp_!ET!`nRmg zMfCI=Lq`J46y|88Hx7fT@G_T+!Uy%~k+>kbBrL>O0Hp7r8xtIuHiv&zey1NtsE zQ_mj=0Li!&@Nt_wz`}g&S&`#*W9Ktyb$^1^n~+@-zS#*JXuf{S@`GH?){jqoBKzD6 zF#~z)l&xIg#TI52n{GT)G4B=3Sau#lY5mVSL${Hu_61N!xX%?I+8 zyHCT-w3;2$r!C(LtumX{)BT9!pQe!Y(nxnyq|fObQur}XwRC$|ZFXZA7)NpwB;j^& z`(>nGV{^J8^faYqqpN+p>FvSE#Vl8Aj#R$P0uLi;?YP4)Q!k_#?VCgYJOlBgQhKcA z>a@@MnKd$i=5}k&Nf7RPpr-k1l!FTcuQ#*?>EI55ZC$d(yBkD5D@pIZ z9u(cPdt=59dDj4KKr?0F98?-3_G-J}R-t!S8AGDVuu$f+NqnIw+O*MNygR$he$y8B z{ZHY%9`uN%rtp!v(Ubld1+F+L%|+tjT7!K{D*)_BY!AFv$#p1mss>>DJJ;ItD3$*% zx*fNGP~=!A7Jkvy;!@^tZ5BrTQ}L`f&HOmp#DtZt52pU{JC}ryM8ACW`FYu;>9lbx z&}YGG#&0_#cP4~$NNpvB)pX`cgb8k5F#2dZ-E>>$(6=v3GF*=|Ss+9oA_DC6v7fyd z8E3`R@Zw^A1npGX#2+dEWdd2T=Br_^&lg^lXlm;iJODQ=3bk%?ZN6iRW_xsxi+|vU zeaQb(F19KH$h^;qFj@Zu{45IP3`(0Ep0<$bS&Yo_#g+_*+Hm%nAYy`b|ncBd~ zkKpxpx>b^I3>(0;#tECN`UrxODuZufj(_$~@-qEH?u1U#vf8ItjERksmBqrKl1%vX z)ScSfEAh845%)A9>kW;pVK0g*fyd#06bQE-MbVhy_O^UeM+k?_20wBp;64ML_a108 zJNSdW46;K)o}ielnt_`pwU@UV5Hy4C_ByW~v5pmv*(Ywwvz<)58~i2R2#6hH9{g7N z%(~#fICfwn&@X`P`w@2eWL18A)t8uNjt#!O)TKscUP3kYVmsJ83R2F~cDmeH7bImL z*LUZ;Xn^=bq0*yA)6v~w7Scc;cOE~1j0RXOSOKK4i+U&^Qk5fi*h(Q$cES?+Td(cn z#i{z$SEDCtC~7(01Cb%>dBdeScau0tWz)h!T(=myG>8eYso_}G$?NC|2!|26y$Q9F zCA9HAiRG!jhlY>cvv?m9WJPXU~_85>9ethuO5tJ?JVWy;RLW~HcZZ|~CeHQyx< zl7?CQ&OySp-gCQVRurSdZl$fNR@xcdnwLwBRDe)oAe0;15B0y9x(oMzo4V!lzy2f+%-WOCSN^RVI`q515&@sK)qNoTGgsVP? zi0G4;46Ef8H3I@6suGSG1!j=d0aY`~ziG zpk#An+qI9X!1wf$(L~6&;_StluuW67t6s?YVos6$WA61brNPG4W7+6-YG7t_w(i0q zH!gUEJ+vm&)5r=F_+(xo`!32fM zH0{WZGWZ}U%n-{svxtOczBv>oM(N)Q?|2Cu^XyhZ{bjyf@qGNpScAa34-j8O{3wZi zMpH6O@<$7JOR8Gas4O9HfBcL-$7U|qCa_FQ#D#GZjcM~UiyZ`2i(-1So?$LCt2wrQ z`iN&t^g{pgi2b8tx$&Ea{LH=aGbQ7vFf#dsuQ!E$qh63f4Yc8XA=lhzBHBecb@f91 zHy^>{qa9_;JAW1ao0I(@=bA-p)ymqZV&7Obs`(AbNHN+m6q@XG+UdiXb)**uay`tz zdY`Zsf{cI`+h8U-{|q*Ts)G%`W5$cp3^;CdN5vvhIErip+G>O`y(QYYY~bQ-wwtVd zZxGyg0cMnsT`gaDNf90WzeAkqMq4IJg4rxnmwRLEo&uai{5G(vu;z$GFXg<5JG}zi z%}{GVcGEt;5a&4#CmVWez2&L)c$|!kB|rH$ehZxQ&Z-Xv(pL;g)8^qBVbT&}|4YXC z-H>J0Q^0$8%Qwq{ZE&sq{rekiEJYKqJa4>es@9E}1y43%D#Z(Ee8a(+87W$3(>UhvSO&Q^FXoo*mc=`kzG9fdz*MnEk^}$2Qs53ldlX3w62{UPb z38Mp$16A-y4rmW79Uu+?!Xq{%U_GZuMfX%>X;T{Y~j z?XH1FF!0t;PDosBkr7)ki^e#)TAkM$hR9!=UN)(gsL@zcL;EW`Qc+WDVoG{lri@OQBs?d$8cM>m zPX|TiAA)Q*SEh(>A?2P6_EOUSXJ_&C&K%#>$ZG=*FM+o1VScoQp8g2F;d3)`3~RjJ zysw}>WQ-&I0)TT|k3(FYqe+`5%@6yPB3kRr^!2IlkW3YW`gZ}3>emRNMt46@bndC0 z?9HwwN>Mix%>uh)HNFb)M2>YI^u854aI1S?p*YmHQ7LJ#T=xpZ1S9!v`e|>9pxoFY z4bGrhpQBOkZ!&U-o-|=ZY#zUDyaXt+_{;S_V0aSnV3GG^vUA45a+~*Af%^>j%N<%4 zs!TMywb9x|zB|WKWl`59YRU_d1h25bV_Arn^G#-1ZStm}zSNgu3~TgtsLJDVtmPLu-t39}fr5HQy?i%U7T~8^RCAQWQV!`-S%E=qI#bmAaT`G#7)P zKIL8oU8T|*p zad7<~3A<(`UKPR9fi_2tE%scx)on&sM=X%Fn7m#%zdrlUN^6^U8el`0w_>z_L9LgO zx~QfBnPIP2rElwd(DR1jv)&(TlK^bLf06Y)Yb`np*IIUs#iDSROd}}}q6O3Oyg!B% z*`4q?H6y_?t#X^daYGCHcbqvsav!F#`EZsMvEUn~pF%+} zjt@&4=TjJGTG?Lf?}b@H0HrQs_(bAZ4`gGuvF&cjLlL<<@GM^Z4CBeruBZIghVGY7fO_l5tY}YGCzdCQ1jM|Xiv`1zHR<4StWbdzIA&RfM;w>Y%`Zv!nn7VP3fQ%Nvv%`@HAd% zyVyWhE;w7NtJpKa&y^*ZK@mXenwZf|TrF5tjSfj~O!&y_vp#942VTQtQP#H_NC`b} z=RC0a+VQdPty3Ucqp4qAytk_GbjS$vuVw$WhETQ3(Xp`4pyxT3FZ^zF-eE%dJl}>g zye}yPzPo7rQ$La=?P&KAX~h{m{RX$cvEkAo75GFP%R9{q+S;>v1+XcilmLkH(@UWI z8*(MnOT$tZtp5~y4K9tmW{|W+q4WWDJXfT%y>jw{yLR|+3 z%lMyf?GWdGTMw-L=z`TIT3RG5Meavv8*Y_-|53>RL+(B@B1Fa;aj63irR7%5TC)-P zdG)w!qR1FLV#ifRCsejmOuy1lPl6LeZ<+$ZrOCT@=FsvagyvlRGVdvL==j%MM%3!i zTZR1IU3K1-_)LH}E{`FTHpD1imYdbhbo;v_Sv%tMA;yka`(w&Nr^F;6ehE;DA&QomtXV%tyegw~C)TfM=qp^C-#AG9(9q4yNgc+{du{h}_P zxL=B3dF8YNrcw&k$x$cb&o4|i<|000+7s3zA2z;(350p+t`F>ru6*A5b@Bb&E*1-s!F2**lhEM{-({?zzO-3H}izV=*NvMxflue(`CC$}npkRCg zEQV}?(&SYFZ6!s#wDa8i!OId;Xozan(S>3%7pp8aFMF)>>Jo_U$bqz8n+6vrJS)N) zl4SljorL4>ZDn0XA8auPBCvhIaxcSPa;mo2UR|HhSc{aF-;}|ZdS$zgMIOHf>SAVt z5p%T}0Y6VY!V6oGtopabOt67kew=|taeMyOAYPIHkS>Dm_`s%z_4U{SDpqR{*-b$^ zPt1%@g%zSPS5hZYJ_zwO9CO@^W2n}yfeFfZqpppDj?Erv>zA`4xaib|u0gy6L)ejK zvI53_B;ggsOB@fLL*JYGKJ!0!G)Wf!y+CDr-sY{s6~56?(#9e>Je-xbWey9{Qf{mA z<443R_}Vx4EDSC1?Mop>+N8y__G6O?110r@xjyp$+IXxYe58-_59E38y#9G#k`YK* z240V1wA48T+?Bt@m-$9^p^WN)S0_SrsA|4iMf$r%{Fn@Mf-7Vv;A=e=VyZCw%y|X_ z+XEe}O>UhYY%=`QkD2vW1GM&riMzcmWN5}Qz){c!Arf!DWqk-zCLl2u-U2L60Gzu! z%PqL+2%u$_2}Ec=L@{p|(E((SD=w6%l5^Uo#|LLulNK8VGtyTgw^>?(>-amaS_dv` z$S&m3O;+)3CrAEfBtD==u6dobcMPqeNp32m-ZO#SH>Qii>`WlHy||GJlM9MGpqQ$K za_N_ZbkFcT>M59{4j6YdiSyI|IgzFR!5lkx=;?kHJELc*^!C7)XzTl&5DG^Zbz{m^ z<)d>xE|qh+{0|a40!(6G3h9=?wo|Hb8`@LxB^eX;R-zp2f+sfARvqst5gjU4f;%7E zB`Eeo?O$vh6G}%>uNNP$nVRS?PFgVnb|Jaz4GCul3O2;YoWYy}vOCvs_lp;rFWvT+ z2OLe-#tbL_=V8(nXf_a_CNpJS@4UK0SHAU!x?2r-olyBYTR9RgKVPuT2qHE=azkIe z5E0dei|k;B0ICnBRz9(SpfQAdPxB{4)ZAX!QC!ne=aT9Mvi7l||Hem8eoG8XUbQi2 zXwvY)vgV7DsV&&!=)?2pRqoFp6Iy@E<*~e?rSL#b#d`ABBboEx9?2=mhBgYKG7k-e z9qd~TEw2UdzT-Fc|Ba)D+$&lGRkkE%2kDTpHda-S*$E-6<2Me(`az znXHq?V=s#dp9WzYJQ;r8eLbgy*5skuTV0!4kX#R6$dA_x53<;MyVNMjr`#=ml-BSz z)#w>@{4QU{csGpBetZoGg%rm$F&3OVoWqEf$}yi%XSJgctYd)`jak{^<)%zp(fihU zY`KpDEF0ea`16Qz78C5O;ThV|?Q{+%0vT8q2!_bEsUB!%%}f%S8xAMbrF_wgH?2fA z)wc{oS-vE;BR(c1tfn~K((aY3ckEf~)9|h^S>9Y*lktj6`t34)+wk4<0~-><(`S?J z*F+OQqnq2H!{=V01Q8(m-rviI$)!k7s9Vd_O)@y z^bR^~^A7z9k4tN~7Gc)}&6}*WPRGbDw)HuL&Q?KwhruhxvE)6-Q^^+(dr9 z{F>8iKr3N;r_a~Rd!JSAdOS7j=a$PpxINw>xHHB*{(LiB@IT6;O2P9iC#atT`U*K; z$1|$T@DCz&|1)x;%iJEd0{-qQq03QJ&)?8?t(A|L62E>hco1?eGcz+r^P1uCb5dco zdY11;KQ<(##ZbNRgdg_h-ou}ePqse4zeAsawujzzyTiH}kZI^1=Tu|$S>2K4>9x-6 zaYsV)D>`n0*DL=Nepg%i--q9gpOrUkyXc&JOHJFKRpCNK^v*epS@d^C^8|`sf7W`y zF4kWEI-j1y=3{eOD4gYp*HUBPMMx#(y+1-MpHwlI)cpEU(jbh!jWo6GYZWx4*Oxzt~F5dr&hLiGldZ=TWT9?~i| zDc$o9xIvc?PDx^0tOQQR88o-hLbIN?%sdad0a{8y%lCVgE%w{ zJlp7*7dsBq&G zvnsMo390%=_}xdBB1TFBWypG_kZuVf=Tpbjt@~7lUI8o)@*a~9+4dg)!QgNIbF>$G z<&x{SNV^MB-wEIpj4$)tyMNN*3Bp}y+PO(y@K{PRtQiL~S^}2vRa(D!nJ`J~ra#B8 z4xy*3>8MY(?yxhUs@xE-6kPTyxk~uM@XNGJPcj{z6}HPG(P*;iykHpNn7TX%XAU9nAFUf4egj`Gh5mm!|BIU z!9Cj)eW*XhRlA$c={Sf4_kj_5wwv~0g!!N+B97CFfoQs20)~nJlBc5s68a%H-6PU- zqeGG*n_r6>#JbY~$s;UBzxXZA*FT-$d6m48wh*-$f)`+R?62_O9E&9)Q_9PCn@gKD zYA!D9Y{q1-(Arwp3JKWsk~5$TJP<_QWS5duVh*AoudRCWGRYHRk1@Qqx$$e|>gqd1 zp-WT!-O+5G*&k*)87p$8{w$>PLMf34G(ezc6w=J?I(g&>t@d=n2x zYA>~2JGsW*Y6y*gZu2f2t`d3SMb+Y;7*oKdtpV2F9U$f~kLyc2`|8K`?e4<^mq=aW zc)uW^%!)NrK_Py(IGW>HSm;x3incep^&4cpVVLw*92(jGSU!(c`n8?)r^sg7-&rUP zsww1TXWx$wGL=lYe-PlLnwlAQm80Y}dDwJt#V62LwYe$ak=gw9q^&ml!G^z4mAUsB zCV!p~B@@DhJuca{nk_W30=^OxGgl4hNoS!nuCG4$Ap*lit6BS56JQ}tluZhn*n?N9 z_gW)=M#OTtj22un=UK$OIBhe}fhPY8KYTuD#wp(#`hm;@;^NP{N|*^*AHB{R+8OOe z>sH5rdCCDMzHc36WjS6HIf=}ZUC$oa0oqAR;oYMNv-^J_+tSMxK2r&{9lsBX5v^FV z>>XM3`17NZ?R>-7$mcT9RrBVpq?L&wy-Gd$YdLf5Ng~TzF}35h^6_b*?;ZixrfVp< zv@kD^AwnD;Gn7)VU&XYvwEWzhZ53UhaUOAiU*&|jEU&H^a$cpkPvRIeuO6Hkiff-dYklsk zEsv-v77gXGyRVmTGRwSRj{H~5#_9jmfC*vPnnF#A0a7h+i-~A zQR~IIXrImf7kQ~ZZ zsS(mXni2YYtXGOK`BV6X!P!7I!qC=N*l=vv=I6K|@+!%|A@| z;N=q>No9*Gu{HZ@KvB!SkSJVwiIY$IN~0z5cVtk|dtB-%W_rSD-F9<0uZynM)e%wF z{*JXBLxVA|Y0GP1_4`8d6gX@2dC5(P%pWex1-5)4s=sGNJ{N9A`pIr*gWA+kD6MDqu3lmr>t$DgXJ-`#uQz)0*m)1` ze+=r%?A-d9&7ygkFjTL7*MaR6pyM7xw6x3x+T@rCsy%t3SogcbEzX&zP9WbO^# z>c95<2kMs^y+W6 znTjF2*Vj$d8LChF{Pv!PQ5$?hU%zFDcyGelm}kzzNe(t^HC1Kr_p1?zQ%)@H!>jF2 zm7#ZDf4;o@z(a|-C?p8qg~?p3Ou*p6Y6pXE8Z&Kno{w6<1;r2PyRR6&1xuB@%cyAn zie32AV!hg&BHq-rcb>m{SaF#|ZTyvF5Hk3ctuy@S=arR@r5aY8HxF2AAN&(BTH~@8 ztWLynpP1BFRdt2OeJ|-yD?6igM6cG)5zEN&{DhvIiTI4l<+cL<8u`331-vc=Wk8Op zr`ht0$A_OKHL+QjV>#BAnfVkD&`W0)t34F8nUWsTIL|$})DUm>aUIg~Rw=Cu1xoH3^q5e0#lriRyRx z{_d~KxHRtS-3zWH6#4?M%I~UTK|J zu_-z~s2!-W;*=O@-qvUb-QyATOyA;0R`&HDfTOx@`%!)`?>)>G8aGl{R>relowK)h zgm~wID{A&KHjJcmbR0@qXnP&@^Y<@Kx18Ac>8}5N7wQsFq(E2r)AzgY)(1=gOyA#L z$myzREq$3~asKJY)%5Cr+Y*`|W&QZYs}wu2e^-RB{tr3*xci4r9OB=7;gdRGR<-K> zv&-sN&+i*oYO|?t|MvaE;|;?hPF_`HO!49;T7JG1w)3wjb43{4cm?_PhW{o&UmG{fI(hLBUY+>wt{2y#1Yi`SbR_GPXMZov%t;n~%zd zw$+M2+If*S!1ZuMDOhM|3B+eo6?Nb2IB2vxXa40J_4oh3H!;(0E!`I%&7FOhl$x4a zg7y!v-+!-M=J*8ziYR!-)dFrc`q2I4YL>H z9&Bp<)g zRnKkE!WFJ(?zMf(A=fdq1ZV3J1AxoKRX1v@;cmXmmSduA4cafeHbSpyEf6Y*<=npJr$tfcA@W4LhPq2l*} z#`ESYeWYR=i;-h%xaFYw?XIiW}_zDCr+An=?eDe3k??LPWJBX84fjf7nU}K_nN{NAs ziblVVnwh^Xtf<17|%7PME*yb%9 zv&p@YlX|&)8RwBgQC(Cd))>uP6sfNnddm;&Rve|jg?V_~wQ;N^>6en1+-g>sm+n<< zS}Uiand3<8!@DKB%ai4#%QDTs-CgJBk>XY|k{RMlGO0rwi6KejEr(T{_K-;nRrHYl z#eoc12P3r|X2&ZbjMREdmRCk~=Soe?a2Ca>;C4ibD>;rf$R+LU#rR1UHG3k*)I5D< zNvS_sOD$(YHVyeBF4dD0C$mp+lyN#TAq#IO3dp4*@~YM8cV99i>I?@oBU{H#k&(=k%@) zX_?*5$w{uD=O`+Mxve3oKZq?!bhtfe;;>?>b#1u?t7ZZhUH>p{&l<5Jj8E+;mX^J+u*9lF)LNUiYttqp?DitGps>`jW0 zJJLzJvI)4S3T{)Y07$~Dx>gtsOgfXK(Wt!?uNeO#!w5=tId4mkpbxRY-Ko(L?)IIt zql}+`XmE+LN}80#SOz;;siw(itw%sFRdTpH1L_O*>UsFx^Y_W)34n@47ZcRHiJlZVNr(K>uxm_y8bxDLez5tQpj3Q}0Rbt&6j3K5 z`Fb`K6EzD3uIPn91Bb?>)5mc+lA;U2ZEgzOj*i2HzIJlKN6)7>=Nh~7D~P_M5sRRB z5#h28+|kD~tE|oS4nGO@^qK8c20|$kP0-bettih&StTWbNqcJ8yg;O~x3Mt@|8hXuyUn@g%iB8BKe}G#Zgzl!d>DqUxr{3Xff>Tz)>SlQXc3m zBo~MFhEFvMs^hJ+{eHUeIKW7pu=L%5WPaTwf0;aw_{U!i)Z*shx1Xt7rpggdst%k} zY_ke6*jKpY#|9Jk#8pdG6BpD`f_KHcCluyUaTZ}J0b|`R2lh@WdagO*3nGDXkLH{8 z>Lm~j>Z6tow-j`;^}>BD{fTeZ=EV;>MEhDA3S7p+qov*ujesLxwhS&L^piT$1eG=AquHhoKz{9*{E(`V452va zz-^|qhJ^X{T(#ixe5{8#e6jkV~&( zIrn8H%FLHT>^2W4UFYp~w7we8Iw4vn$RJdA2}Rl}uk6|?w*F$1Rbyh61j2ro9lfzl zgePVF+0ZbKL-OT~w90v{`}yF1w=<&MVw;Cloo<#JV?Q8>LC@-2^C$W;#sh;uLaP)> zvXycmlu{@(Pco0%YPNZhra;i9Nq{e&Nk!esi`3GjmgC@b5EnGBAU$IfaTNYtV5{)*p%3PXulN-4zHZ zJh$p1t_~!Ndm(8b+J-3eY*4%-N`u%yA|i=JRt*Lizw!R6nIOC7C2UF8L3q=*EL+tP zP7v4Kj>GhcaG8Oj3(z~5lAwdx?_{5&zvbQ z6qzv-d3+iwzTyDOft{(bQDY%U6owsqgIjJt&`HcLvP10F1PLpQZi>3A^xYMCf7uWz zr>hJduUI_dK8p6&`I-QR=zYQ6Wxh8uRu&vzcDM!xgigmWD6A}I@p}eH?bJyD^6blV zX@wU<)cqAJ+!RWA%>B>IPEIs+-|;9!>>ygUSIejT=3Ei0T~Y9pfCzbUseM#FqE)5s zR>kd-gpCY2P$YoQ?^4w`?r@kFxZ$;))eakpoRt7oTS)s7eo)}&G^^ZkIDzx?J`DQM-MfvixB|iK1JfQg=%PNe&8J~bA5nI+m z{Xu+3Wi>$G+PcC`G%J{Fq#`tjxVeCyZM}~(Jf7S(-At(jZS9<59q|( z7i@l*QC_H1kBZ~>Is<3s>D+P5CoTgvI{iz^c$ySbRj*4T+BTTElJ_d?Qvf&Y{v?y zEAv*y!$D5=uBd7Cd}O!}CU<5fAvpB?1lEBIVN7L^Z`lco>t5i%Sq2fYL4^@3A68(v zXTph8S*+%-)$s>ir^}y~1mX!vJ#9{7j*Wy!xqu@I03WfWbOEAQv&V+YGnicB(+!Zkq8jQt){O>qUZ8AYr8ZKD5!`S=dPp;UYG4g~McZg-dQw3?&WpS zJ6neZC4}1r*iP|orSNV#*mWF%Jw$lTBLwk%O%=87n1ch4Js}NQDAefpzR>|_UY)Z* zLbU~ac*eMTFdSbYby~%NwM)Jh=e^B>P?NZ$2DDy--(w8j!PPKc$6QPYd44 z!)&@vcy;sWoI-H<>xNr(!G68eS-+SRS`lJ<3<&L8%?2J>`BJNS!H&LduSK@m0UWq# z?ZPoAB~+=KoyCM8Et)jH{4AI&@1eG!uI}Jq)ue)F%HS7nZ+JJCLk_>ZpJVe{vI22M zU9u?OaiWzP1&t!#HcE()U(gm8{L$r6 zCa2r`T#`hcWe#y+^>o+T_xK_=l6(mu?&^e@@ zt7iZptF^7 zVqa)q@#|Vuvl*$1E%3C9_AX&Yqjt#pA*Kyo?x9?yeFj;lbq<^tS768)B2rjcpvYjL zDfbTzfdU_Zk?0a!Qe0<{2NQ)th~feRN!97-mbC3sn|aIrm`7pR{p5~v9o)W3PhGlj z;@+Ohgs>)`U5JS1)D4LkD{Om?Wzz(SmfTIY?FQFX}Zb>J=)wAQBGW6ujAOR~;; zlXFzMHWl_DA*@;MKt>|IM0T5w7_`mgY!hlCceoY-oB-M=TyZs0QR!o=vZMk#T8Nty z=du8b5OadYWNVPwAcnW1}#fX!<$=TqJNQ|xcRKN~f>gYRTD4fCPuEF%K;rwTeXQMcc@Wp@M3It0VGQdZ z@5z|3&F8MxP;j0kSsD)orYzS5Ooxua5K?2N$j$QmNgbov*Ar7fNY2svbZs`e)qEc( z%gl}|lv-Lfx6_rN$T54J5+gbrr2UB2re;#7gsNlB+(Gc1&!2&7pHtdZiGvrrSt;|! z1cy6r5nDRhGa33?e>X7$&y5|Iqcb0D&5Roio9ne!ys5Suj|XrV6g4S@qn}fwn31K( zW$dgd=Tt|s6@~E@XxSU~*$wO+dgM5VhhQ4YGH>eQ6(!qF4;!Qiv$FO}Em5#A@-X!X zdq0BCR$xtuCC^Zv-;tha(}sD8Y-iDUEOtDj;*N90oxsVyeC*JCQ@@1s8MpOFQw7#s z>*$_z#8>Rxl$9dh}!@+nLnk|ql=k=k4k`s3gEnPOeJ8M$^onK7c zsTaM#@)mZ3S!~{rx!*)n_}{1uNFDCZ8(35&G~0xT)q}V|IX6W02}qXx(?eC)3cVvQ zGOiKoHEG+8VZV5}DBX_|lzHmaac`rB!DmJqI4TWNZMx&JIgPU*I+{;}M7V`+@>*;& zEn;4I){JAHwxhl(%Ck_Cw&xyr+j{!NgQmFy`*WvjMVxd_gPa7?1vH0WnlTMoI5JgM z@$sA^qZ{26>8r78??^SZjwRxpC6k$JdsBJ-ji zKV|T&aXBq6ie;)8Csw|^!CrF39B$kvO*x<#DjQbN(<`%Tb%xc@(y4KnI(~&l?+TL- z>PT&Wk*_mJtPEFN2v-ngKzerWJt>7Fjo5>YY`?mZ{ZwX}my?g?%J(=-P6FTa?%==k-eRj#@9%NGndbE~NXXRTvdOb|K|Fy^o^sZ^EdRIUn)U-J(nNkukef*YHp zc_L?5r^!c?!<456gkw2VLTeb&;KaTer$)B0{o*A|k_9{{be_gJ!0oj*s<_Fo_ec`@ zS#h52w5_3U(A3)qk~F#hM(S%q8ZtycwNp%T%&lQW9qo`OEqPK52 zIu_T?%(()1MF}KmkycH00Lx6fxBpNFZ#mp;QU3U>%HCo06)hS)qt{0rzFFu%l8lq@ zA`DC`;@GxtEGlfhlp-M2?|&sh8$jq3E&I*s_4o1xX2(&LK|i)e-i}L*P+P$7D{iGN z(PXO-Ya$A#DwIc_2M3bcl;#(2zgjqTO7v1kHr}bSMzTbN72#NU*K^~r$zy%nW1>^iJA0OMr>n6ub{|XfP$x)8g4g1LV4w%$cHrzO60x@qTsq!dCx+sTc*_ls=kB#+BTV{`!@+YS*C&pTVVwrUYRxN+c_ z(nWNYj-aTsX;rSg(3#IvFD5tp1l`1NxXPRL++1(H263<#hJFp0*|HpWoZ^|Uaur*2 ziudp>rQ@1A_323Nqoh-5=hU?dz<)CFYUP9to94UG!iTMh&n978f;=-|~)eciyNpE|v>I3j(|X-AJ^J2|bbGa{0mg zy4c+^xLq%#ixyclX)+wCpn46QmS>rlMS#7(vM`7#M3E!zL6t~13*jesx7$yqr=<@Z z`02G16i>HnJ@kE7Vp>9adrea#Tj=soRUdi`{J?Qk&vauW#!8i{b7|3+t*Jqdiz_jG zQAwrT4zh`}r$Lr^A(T6Di~ftE{dJDvB+2p!2|?+foN{(36R7N8!j~6E@Za_JF-2KZ zNPby@VBlKr63t8an|fK5c&!3wHmFJ5B>G_dQ9w;;2qw%;X7P1I;!N)JUM7~bov7#_ zaiW|M8fnbcqd$)Ne5W*JzSIKJ-!7I|J!Q_q0Kk2X1fr+2$_3RtCXXLWZH;~aPJIqT zH|0dKma=~4lh8~Q24l76f&-G-HA2FdaIYidvckvj&Jb*Sztk6uO|Az?Rjy04J28Ko zK5dxqaq$%j$oP+}VA&XFh1<51Ppjk9DWR;K-Mbi=0y~7;BsD&hnZ!hd>NmtpaYfyj zX)r>rB_|Q0k5#!m(}p4QN4|k1&q==P(y}3-F;b+C>@9QeCKb0uaggAsADESQ!^fq0BgiLuWbv8C`S%vHrJ8^YUP>?XcrhkK}4s_*x_^KkI8* zFz@Bly@D3ceG7mew(ibvCX53sQ4ElzHTqH;soNz^unGoZXh#Z-aVKGx+WpRJ>yW^3 z-*k8@7SHePY+hN!=KkJ{z9zKF#qg$MB6DvYv>sIrjEd15>F)%WT<^X!qlV)QaTnPc zx&kS|<3>WEyL`HV8@tv(*s{$6Sd=?47AbV-c+C|3!3o+E0g1a}18#KN?kAii(XTjP zITPkng|P-D#Rt*XBqc(@PC4J*uJ5RBy}#eQ9^?z>WNmZxse~*n=pw#7=Pnd<9raW zY!h}cvC4krrVh1A}*#zfse2&oT)bH8|4T{s`vs!^+tY{ixWN9hUf%XOx5xYJ;u za<|m_{(bkQ3_j})j!BY{mxwSk|3@`|T_mroiJ@QQi>Y zPZG`@OuDC>$f^oEa?;%PalCP9b^4thb+@R5E}7x3M-LM6#rWwU3moNSj0q&1P!EX` zs~7_WG;65lFy;ldk<{{=S2koAMm_vQPj1^0@t@1cd;Qp}ki^`^gf+Lv6s#oVp|g@dy1R=NVZ?FGP_z2(Ul7Bpu zOh@^@mG~}>e@Nop`kGJZH8#A@T)=&}!?~;;QxyL%D~w@#*UTAk)_XXXv=EWQ<7!A# z8}2%od+2hlb-U|u^{Io-Z0!`R%m%}pnCxYgvQ3P%6q8%OgOm*%Nk;_N$9$XU6@@7h znU6uS<$W~g722>4IXZDMZ3r2)kmTo6jIXO(QHMy(DrYEkqEnwCRdK2+S(XSjG&qi9 zO8y4Kf+z(qb!o{l4BlZ z;AYjqs3hES=VeA7br3<3FZ;yv(aBQth-1kkBl&;<-2;Imc_Z;MPDNGBSa; zzya`#`;#?mU9I_~GZfB+c_+g8NywXvm1hy>v{+8ho=PjJ48oUHC4MMM+L3x76bKmg z+FA$ZJmrkqr4(GSia68ZT9$g4J8ZIAoJ*ZqS(nE}n1jH>Pak>b5Wpb6$zLl`Fhqb^ zi#12Ppb?Wo0>_pk8G4dY1p5=`Q$2ArV%rL1GBn$SFK0sL3C4jGr@= z>c$VEf8yD0UVvDi1iTVHl$bsjMqDgY%tN8FaPqz@KF6#AFjLFAGmo!j(g5DYmFGN8 zqkfMwTP`;crw?idXimLVcB0e_|8%u0Wd0U==-xCrkoRs66}#?f>syJLIMQpHSwX&ZHV_;f3R8fa&L*I(a-Sr6 zlvr0^$WW4%ES8`b8I_awPvxneB4x#sndF&L+}~9g&6aZ&*eCm2djyV~*`Yp8e-7V8 z-}pToynBY9O!gja|75#A&+6?WzdyXLp8IoP@afq-=j``Sa6I38-YG)``lo%7Gr`q}4 zV}#cv(>rU9J{t?4Ce!*EhR^hw&T#=orPc2J9j+5i#jmm#%T!xy$_k_c7S&E2qOy># zKvpDVC{46UX4jGWC^z|1LrtgXh1dznRBYB9JQ8W=qoWSaUZ?%~6=?DkfcGnEtXrca zR*>9Go?6?`Q1!~Q-|fe)u0!-wq+$*A6!iz(oy}Sg1Flw)qnAd~Ml1xUCWflM+<11! z6*W6iw}Ms3T5IoCdJ+^S&_oZw7Z_GrD$^2_L$>wmhG-)t8q)DJ++IB~z%e)t(-%q1qI3Tiv9a-E*Uwas?^tc>-T`xymvG ztiHP1;nSsf@i)MHVo0rvN71?^GNc_hRB1ZU znbY9-imR;1@6fDJscVy0{ngK)%00x*)!{mf<+lrvskX<^PR{%m1$a8QnB6u8PZ!@Q ztX!UEK#p`uLpL6=Prk@cz0z(TiVfTr58qdM*H<-K%%Rynn3Fndl-;3i*(QOOa~j&m z9+R85Ge~@NKQZ2HL_A)Yy0fL%2XCE~i;ujh)pVv5r^(DNsF!>!R>OjYl^H*@q%lgM zZy$L~ri?Z9c3WT`?fUOxf)14XY3S36E{q!K`YOdDmSHb%o;E4htlsp@EDXq;wDghI7FGc%}pUh)2cZYXb3BNMCUd=nNX)(AUY(=pLZMJSMRJ0!Z>z|aymXFKCZYwiY_HD@xYv+Uof zia*m+J-*1Ukx|-44OWN}J!H?%4sdna-x~}RIl=awzAew|u^62hgC_#UO*Y-%5>yu( z{2R|kZ906)5`8sNc^lg}-1x$#>U{CwB?PskvR2Z8R`FJKe+-Tdrky6l!VYH%LJ~Im zRa0h4FDuH>*iXlzXXNdNf*iE8xX)E#L8*W zzQxOjDg^@fU3(!Lxn&?FGsg$kY6?ARQ*t@1$Yt=X6~n-Qf$b1A51rXxC-36EZgmZF z&-4Z|8?E(e9hS+>9)sojx0&dP2gylx;@}ZnzAl3FNvM$K1#Z8+l-#)7-fFf z$QEakN{wPo*thbE5B35^t}P(0om*JYq73v{`INT0`q_XmH^+7U3yM)@DW1jy1IvU0 z5TjUf5u0XF}9M`tQFnzJ+UA0MRajXa?{#c?thjeD5f-q~&9tqBTGte-r^w#U3U+Kyh$z=>cW$@tE-u_UWnJZ(TpVsa z+VXm#H0I){bi8hAxUBX~o7e%#o_b=!Y@fHidI&8F6s8w^I%`<&!Or$CL$$5GE1mao z2>KDcf}c>3mu+AdwcN3H8ro%CB&%Jdo~lqm-&o0Hl8Nm_hgvuhTs0KmH$%#s9&3}? z5aTEpM3X}4V&fck&3>4a7Sv_5(yQa^%};na)9 z&qq2`@p0vL!&ET_FzG0#>LtE#Dw)^D+yH@hITi=1OxRNOBX76n_1~#-#h6W;lXmpfYCc562 zB<>NXzr&U5H%we9|R8SR~3q?3{K?J9GtTZaJM$VTZFW`ms2n3n+kU zLE4DoDvOOheHnvkc#$}e)){i^r`WpC>wf9f1s-M3uq2n`aYdNyA2cR-xUt9p8_!B= zlZAh)E7E6APSZY?GO6v557lGnJ|C8L=Z?*>`RH9)$oKw*m=tCBJI72*FX@7;1!=_` zxn^o7(p1jF6q%8(YP-vFkeN$vG0IZ9Z}V*(xp?9P9I$!d70Z()_PV;dz3$4^wcdhW zBUMor;BbYgpT_Bv0MuL~;SdLpa*3XJY2zd4c46WrTYO1gdyt6N-XT|0xh6re-kVtE z-e0)2{0^g%Yz}XAEjo%H!89h8Mw`M^6$Zj#xcM0Tk%*s>h;#1_w{RvVS`N%#s#2tA zp0wDxbEO!SX6-+qUhW`%ToC4xHAL*@2^{;#GfI~L&EyGAPG=$_eX*(VRngdf&fM@0 zT8W|Ju&A4YK)pbUjdM>{`jw~Ne&i7a7Nu(JYkxpxqyd$A)ORf=OPdc6)0zCohg9OK z+T8e4$C~;uKW-)!UB3})uA?d0>WXJ&1bw8dwdkYi0pAOzw)jx_xB~6#jHN=CW0jfQ zWuk973X#P&n>Cozn~0biuhEuRUgo`vAr1Zud}}i_?4h~G3)d1?w8QUsiWy?~-F){B z8*j>!tJ?kLim)h)Jf?GBjUof| z8H=yGG9<1n0_-)z^SWoPqYq;$&m)>EXF4qBwI^YXSn9hOT_4C6=MqqVemgMeLg_r* zX{rOOX$Z20APEWBYccT8Pnvh}pM`+G4nPO@p!~7i639iq_Gx3UDxAO4c@ELe z3ez~RSA$?_ph8b}&T$^5FlmvkvRG4L&K$uXxb0w$o)#btZLnqKrK)DPso3+Vm*EMZ({wR2NyV%TpB2yYU?tputXRy}*{pp?Ft+&LLS446$= z;Qpaw(d@EyGO(dWrzG_H&tuggzr0c{324)D-td`xbz)_qFI1-!u=wSnLb|H^&e;3w zPEo z+*nyzWzgtmOWntrTljpt;3j$4&1cu8DqXUCY3J~bI|)H^<#3EMy||fmu^c{aUE`l2 zL=-~ua!T81cLr&^m{8D&8vKPOy(hbmasd3QwzzRJGsQ8-%Bn(WdZq0-sbwRP5Sbvj zjd?9{sO4E`72+z6z?+(_r06WxT-aY=!2}hhUPhz5-I>CGRWUwuy>?0!Si|-fFJKmp z0BhK9lgZ0R@K|?(*ilGgLU%%ShLzdMMZkQYw<1<*3yDZGpZs}d|5@KJn*=YlC-26* ze}DZ40)Ljpe)~(UfXh>1e&m>s#wuZ7MhOu1% zfK-EuYWL;`ap#+|p(L!PZn563J4z!7bCMRbTP}3x7GI4y>y=WBz032MQaQ8wx;YRd zojN$xybt^3y+0F2ca0?gW49I)LtI|UY|S*KAV7ifaVy3sey2tOp;X3X*KD$1ksj$@ zDz-nLEGWpO$-e0%tTfZ3@=KH%1%WVr81AMM3mAMyQk&`=o4H zNwiU;6Ja6JG)Jd*f64e6lJ}XU+Pe8)(WJvZD7`%SLV`<2mtKZFeON+J>lRvhrcv#x zGc~VneM*v;vPjg9Z_<2lJoMDW*|{G=g~P7*mR%O0#g$!gZe3exB;w*0e0RK27aokQ zUy%ZGk_ZB?N_}dxqF=sr=t~H2=(Z9OVG!1#Y*trT?-~WM;Pg zNiiF;AYm?ZeSffr{&7wla?D8s5%sBd=kyYM>si{?@($?M;xVWZ+AE=C;nmK$l}rXi zvp$y3e0+*+n*uoOeAVZPqHqZ$Fv;>BZ6NPEuuU8D@>xdGuZrK;$RaR%{yP z4s%7cNtDFa1Gxe(47TAQ>8Pph5E=U?ncLzpN0L&R#Te(SA z4LJ90;l|&B&P*hl5A>r|nR&25*j)Ewc#LZ`b-I6l5-FaE#&207OegbGg@nd4f#eK? zFh67|i-T1-B)**m^SAv_+u?f!R@~18AjR6PZa78@Z0Q?J+lYwJ>`&kEqt^T2Qf(?6g&;I^S9PeuPY~br*khm4N1mfl$?`Gc>T=I&ki@+F?zK@Yy z%E~U5xL}t9S%~D+=hk^f^}Hoz^SIe#Tn3c}HujV1#+fwN-toTGY%NKoMd4Z|6G~S$ z-Ze^;_p7$lh6KbVwBlM?;Kc?G)q}a=)PvY)OH}cz<9k7w;X zd>Fl$aCC}NSuzH$vHQpLlH_e%+05-DcB@JrRlYtYW<}=OYcmm@5BC>7+%RRbak6-V z(%Mpqh*_{ehEx#m@<7*~4lTt&p$xa$)+|xRclDK*g!({2&5V~knqpC$$&D9Ao(`=% ze~iD~HYA#o7zIlm=ei$yRehxo2$|~Y);)InKf0QZ9=Jeny;_UpZB9|=AqfQ%Gb}W1 z9vaX!9NtG`LMAhnB0eIEPsr3*6Kgj8mSA7Iva{#~gn6 zgh%P-+P8q^iPonV$Lf;6{F27a;@e(|Dl(e$89}PULK=s#lv0gT4wLVUgrD-pZGp4*wN**KLGPv0kwv4`l41|wRW?rVoNQQSS7HwJWzKAn}6 z?39rv#wqz&1l@0_>{hhF0`z!gXO8IC{Mmm4izv;T_EMIwPFZ=_0%3yb^GO`J{f{wb zu{9o9Dyz}6^f&jR7^o5ko#0yfYHq^vp2|Tq-g7eD9ISI@$ zVXeBz`DlEFCa8RHYwOcj8*dQB*D`H&0Nl6-7%xm*%LH)aZ%E0oH1}Bn%c084;iLZ` z;PnqkowZ2?!Z4$bWHiWW>wTTWYGZqdk$A{)X0YvgHx8>qS-j7}fZ-tJQikb9;&Q}} zHtMyfDQ|x->Y`s)5Zui4zL;upJKUn{0KhpBZ7QDLg>> zUsboJiCN@cen{ODn+Io!b#iO5Rb|3IKE(ArQNzBCh;hK@MCg92sJ@4e{_I2T11B%r z6lqC>n0|_=2aqvSl_X#4Q1xyy<1m_A!=C1NYsj87ae{kMO+s7fPQXnIZu7L3QK^}x z`t#QCQZspJt9`!L76^r{ga!9{c=dDVZYb~6LJiT1D`T>3acfJ4zr@7~3tbmxv_%7e z2|$&5a1y}bRVpn{~p0Hi`JUg-xLxbmbBMHhl zratj6@cL(3qqESgXjLCr(4@uUig-%4-@Z~1pDk4Jn0~z=6n#;xG&Z`*I&jG0*p8C!d2I;mu4RA;u4^-oi#rLR53pT;27>RBJtS?Vp4wyB9#BKXaj^;T{S z*kC7HW!~w9{A=fX95dIvnSyy65w~WLyI~Pq)9^!ySCiUYq4IRTX>LOwSE;Epx^9*# zm%Ev8m>5g+j)j-V@P*Q|m8Tz~;}9>hFC1=po_h#u;ldr=J|p_6V<2mxqvhERn?E9C(A`gf~H`~ zxi3@XmE8{f6|DbFagRj+3L2IYjX%?;iK;Vefjgt<_+K4J_XaWk*hP*^b$XHVR1-bH z)v4WA+{0sw@_`37z_~IDOuiF>s(#l1IRRu|PI0kQSB6<-W%%0%@9WnT%U$u4+H~SS z_=NwCbUQCAi{q|Q)CTard7AKuW{Lq*H%q4+2v9XofCgEo5y{yMQ%u z^XZVcdB27FLiO4D3)WcTBxV%FZ==E5rNGoin;#Y77&5$|b}$KxfK=)W@f3A)8uzjj?w6X1Wsml4N$ z#sBrAySnzuXm>6u$iw{Yk*;XR5cRG1TExV`#7uU$FfBg~_VFNekS(P3m%}g)3D$Xw z11V9>55_sP=KEwiSUZje8QacM2y^@foEkN*s%=0YXM@bv1+MNK-(C@1xo@Y0h>&BR zOk`1wP~gqmi`;6pJE!a$!mnkiyqK3{H}{`xjVGWrVSQ+iq?QFJt~|fx_6*0Qf{eD! zf@4g#YPbrOxqTd8({8i!@fADqfm{0n?JNHls@{zWwG@Fu?Wv_?lEdJoQ;(x${oL8h z9j;0loduS{>Jk%vH)4X zBF=oAxJ!S$HkP7eduZ8W<+_RDkIzYWmt9T5CVg^g5rZIO4wi&qF49o+)>H>`0|xC; z-VY`3DX6svEgS4EEvq;(%>+%>OygyTgQR-OUi?s^>WeXmvp9d|yfZ^u=-Lsy`*YJW zJ&M;)0^1v2x$TQC4(q}BN*$N>qt|ycI_zXRlkxM{hz%F4TQs?2<9yLI^5WUywzlYy zgyJj4PdcMoFYRz;g$+@Hj5W(%mH!;Q06-w`myq8Y;;mSaAjG|PjlEtDi- zPF054JSQI7ZC^X-WqY&HRQM(;QSo0J51q@2)MUIXV+zzeNpSnKlKx45?{W*zUn$D#KR!(A&;Z|3feuA(ZOk?2I+vZfIqV9^oBZDc63v!XOK*@UihxL`rA4CS6LTGg;gH670O?d z?Vn9-bce5T>3>o%_6O{5vLE(8@E`u^vu6J;iJv$x&{=1_cXnpCpseG%`w``jm4=_w zc9!Rofz*qK1inB*DBK`ympFJWJUQ?Qdj(hF7;55F4k08?R)7hd?+%MUQ}E=@XDT)l z#!!RyOFVqd3HBZf3Z6Hg;p)~PNKy0W;}0<}8BFa~6#xbstey41pV7+{TL7KXz6qOf z4E{KwMoj7SShL^fEchfoX9m5_PaKx(p|!R`gEqS-y9+k4X=+%^mINWL!tOXi9|m=< zj&KNeQoBk>l#Q{$#6_QQ5fo_j8b70`uUJxG=DCOeOSVWyS+>5xZst{ryzYa9cFGpa*gT9D~#L5k*D9?j@sRNByI71RA#oNfEXDq^iUwnulQ0~BAmlT zXm$Fm%{n4&nU2Q(BFfYS*n`H%gSZJUQkI-&_jCtzr7X{)|9nnPj@#lZ>{ljED%Laa zXKQUbJ(1C(*IVAE?%vbbNeecW)7~K=x=EhZfnoW#e@Ua@S^68;N%WKDG>o1uI{UfOs`vlQYZ zU7E?D%P8KR?=0E$QPA)kUA`DG{!n=vO-N`T9GlsdqFy4BV5$A3YtoneRX5ur>E znfgjg`@rpc`06b;seKi9y#r*{YcVgb%Y;iX!#d*t-VAmgA`=TS(vXf88g;Hp~HErc|>cUR#zY+!C96CT7m~$Jn6}4x4C1zxLrT9!mLC` zi{Kh%3xoac4*)3#uA?=EU1=aW0J|;>lz4PyDrwE&kVqiD`nTZxFH$q9ZjS#PBp>|g zLf|@K6rCP!ds5P&%$E{*l)CeyI5^DD)~=OvXgBe5*p90P{Ufk}N8@aR0p0(50Y%LY zxrZ1th;gLQ?bsNiaieri!I)BQ835~AAOX>-njsp)SS=u_B5TJlHl1NDbNzjT$NF%s zi>DP3dPFM7W4iPv`&|jB@ZIoswR^H%$0UIzvpV_7bR=N3r~J;RoW+VCqh3Fd_?x7I zU|NM`#Z>bykWv2pQgcyySwnxz-l>@_Q*5Q?GrKLRNeO}S_ zqewc68{_4&5x=zn*q>-@f@{C#X1&pG^cw4~^MI6A_A_t)r7ZeN*IUafSCfX#9=U;d9z*Ql-Jmp?G4lu~9MEe@PJf2IcE8^_7cGvP4;N z4Ue>nKrC;d*!{ zD2(xQDyv09OI-|B8A3|efDDz%MusaPS4}Psk7!yI4`>`Bgcz<%+6lw}4A67-hnP*c zX7fC10s2RrqW*87kKZ1$2-aINlzz5IO1rZPF@d%H;WFDCABa4#^=TLlCN8F!4KL{1 zNC0xRsx)xC(CzT%mxH?B&f5d#B)2InSPE>v;M@H+YpSIMg|xyy`0t6dZfvTk&&u5glr38!ZJdNf_XPl&edul4VB z|H&LaBfM=K%fTC%*PSK;B#&&osoOoc$<6F#l>E4KEfZ8bp^Y9_@5Na&n`t z#&C%NNl1WDB2=E$v|F3m$3EUo;5*)=3}d~^E?>l@VnJGlMmH^o8vu&>LZbkumg+`k z`5MXkYF`4dAM{Q@)AGl-l|&Pqj=!m%S&xO&p_a(T!>s{jal6))oXajUP{$)ZSnN5y znx++MZP4^d0*YM&px_9?@PRVj>=uCdB5 z(?&KoUR?_mjw*sFpLxNNUfDQ#_c&l~+QKJk1c49JI&2=D@%3ZyrITuI`>N5rpHOq| zw}hIv<;h9y{tFbPzRZ@KO+IJPNHiw}TjA81P>m5IJIM2C{hO2zkOBM$1{*Z;8-tyH z=S8Pz%>#gc6$hWxVFRx%ranQSLEa3s*W?Bii*-YXN<^7^4U#oetN7xjYuX%Br5%>W zf_GILs71b}6>C{j49)gW#^{vpk7ao>kfWE^y?5A4)e|2qLA!uy#=Q=gZ^UYQ{kzoN zB1bNn&n3R;%r-^@%6xia#q(rb+delnMy=nPenY~B>-rsAIIC?#s?mO}_2Wx6X8A>c zGym6l6>$#o?)v{W-xGEoharHi1n{WPuo9h<9dlt<)|dE9Rz|cSH%=DD^?*kdtz9VG zxJruv;feQnAbiqp^2t``_@;JnZ<%Vh z>PC;I_-5VP3tOv%mgIh3U66q;2JkY|McC|J zo}ep)S*}Wl)nnY)e$(jWoU8JLPyEB!DIp6>DxqF#B6Rvw9Wxe)<4m%BE&;N4zWFo< zdBwC<5+(8$7AAoTf31{D_=*sJ`A`<0g>jh3uytI1X;kjo&Y&&IfBDu*^XWlsiof^JVR z(trYNf1kVQ>iSo-j(>q&W(r_{T+Ph6oSdW~1N^tePrT%RQah~5C2cKmlv`Tw%&SlB z|CE6G+u~nBo#_E*RSiA*5=%S*By4)Yf_@5L7LojWmWd-*!P9F~C<(A5-AV*?#Zk{n z%LYF;;3-V3t@(t*mM=E3nDoC5%k|rL)|X)yWHqyk%b)F=T%4ko`cuuV$DBaA>fa|hK>(W_yG|QdG;AXD!Vf=6;3@< z2IC_RF}+(KcQ{wxbR_@%Lrx?dyp2ghqtpH;57`{DlmfT4sZ|{B1{qFbOf9}m65S}Nj zm9^$v?|k3!jxpxhkIf~1O!g6}KY*G4diMXns;A1kXO5w5FKVHsmfW1B3;O;gA=Q5d zD}e-{#XrCGn89?xp)b@}p)jHM^a|V+3WHw+RK7&CRJ05wlvJl8ER>^hRe#h-4pL=N ze)|&dW&c#7ZLyhs6N0C#*++nCjEUjsak^?-{U}?5nseH8xh7tqeR5Bz7R{khsM+Wz9QL8jLgq)zg z?jw#O8NdsDuVHmylc3n|mPTqvGF02pkomEu7JSr%$$Yh(Ib(lPeqeBLPFX7rmUQf* zW#WD4tUXtSH+$4w0&J7;$hy%a6Z@co*D3gd;!TW-)f1x4gMzEyF`QC@KSg~IMNFud zujex=k1Y`B$$=3n9WUxBDABmzwIJ}j!Gl2tfBjp#9KqT-M{5kh=d zaO#*hJsWb=N+$|Hb`!yt6Hv7qD+#aISA|N|b}j4aCzppAqsZOu&Ot@;e`5K3pG42q ztUSd8R@-%B3WvvfQ#0+*_J`Z;{(BK8cg}X~(Zz)-wnkUmcHzwJN>x5DhqYllMCn28 zOh$;c*S?Uds+YK^qBJAu6Vx3Lik2fZ4;J`PYoe!p(p(4;5vc-Sfel>-Ay z<7%}EXr6|J-w%&%Irii2$nMo0cTVmU946n3Kk1>^NHMe-&X4VH^w4`OKK_4#ZF=l- z#du%+#)Q+io+-+Ou;9Uu_T)zTj~)-_CnOk71_sJJcmg9ja*CuYd=)>MM?$37hdoFO zI$EmXXq6rdT0OA=FTNXF$O z>3F$f{QXxr%70t2SJf;uZM!=z8Fc8kmOCwWo(zy{rFnH~v9ie)F#Oj+o-fI?a)rjv z0U-KRc}Upb+=7y)cV}DFrxK5zt$$f5-~N%F`ftIljY3Hen;9BRXj@iiCDIzL?;4^k zA0L13w+ZlU3ZrA((Vq+uoz2OlJhENJVJuT%uU67&=rDUOkYcL0HdN-}?la*iISVd-rElCvDH z*NTZ>_7STP`$xQL!pmWN+kJ6Q7#Q6s4o(QbeFDlP833K3Fazo9^$DRHHRr!isn*i&0L{bGjlTK!MNz|@OWKnCx(O#X$%RGLym5VrH=})hHBXK{ zB=+m_Ft5JG8p4t+rw4f2e-NGiT@n%=kOLxt$~-ZRhw_BqX>QPTv8}c$G(6E3+dGzQ zJD#PX@+O_SIV*e`uGULd1_$o&jRBeB`f=uW14~~27 z$1=>TT2b?gv~Tr-e_o zK4W^0%Ss%XW+i^6ci~wkvGvmMX9U=3OqNmF}tj%0`F8i7heZG?(19w=hV_m4gqjhv?oN|rYV1rvyh(rUVYYKJfI!)xhAY6` zP5bb+*R;XMEK?M%5i?A@{xnt52liw*<2q4#R*z;54mU4XPUxh=U)gblnRLKbvDmjpyhh)<2`A~ zdz?t_J+tcATA79S?Xd4<{~vV=QeKRT6Z<{;PB98qF!lJMRQv`|pR6+0#{GcQV|R=r zd>gkQjW>-<_owUO%jL8mY~0cbb5EASvJgqn3^t=~V!}-8ww$tp!zNdRY`i;akIk*RKFmD5*#y9`iQm79bJVyHB zb7&XJk5I(_MR!5gXrf>_{2V}f!h2pdIWPCBoUeaXHe^ci++o|>^&CQ%|CZG_Jd@e3 z1fJl~8Z9k7`?G?J?0X2(2h52^`(zqVts5Ie;I1_I3_b#^&!!gsz*%a`?}79upA?mw zfxuH{pmjGMX_W`&%e|9~!0J?3$oWlO*nDVyt}gsevkL+D(~lA}QvZFJ1e9}tR5L-c z#gVj%9VnZKp(wp2_?^GP*M8vbRk`Fv_CVRE;KwDq=K3tOu~MzFO8^_?amW$fB>ZI% zkp0>HXs$dB<4D)iW|f^3Gd@H3p{5!c$$K&p_Q$Z9=_L3Md0v&JR1ybN>ct(Of8wds zI39iR!!tc}(vbzXYKFor68{kj98NQ>tUu>i;Z&0sA!tz3rwuYzK1^gL6n8K#YLK(_ zV}zIZ*I()yyf)d4pBbJjTLHOR+j{g@NLQfwSc2F_SM z5ic<+U^P5KiTYURPry_J?&?+e1t7~41jsa>Dtyy#hCuJ{9_a5gMpdX#jUR^)kd(kA zF)^y04q`UK|reoW_NN3_^j|poctbs ze#?_Q=jlM9rUN!4{Z^O|L_Apv`L}>MYE1IlB?#~{@(sLJQ1aFNoQHOCzr95Dtk!a) zS(G-Y27&GPNzLILs{@!qL5?5#dV{?uW8q2&Il!o>CEt!F72PdvzQ-%XeLP(?zRVT0 zZGj<&E;CO5IQO?-&pn~!VTv<>vnj4pp=s58BAbr#H^fZuuFrDK&qf1%ya2VZ;VMgl zKL}qcBNaK*CllQUW1%S)Aj8{&Rsw(75hiSDui?e%6k@gy;HCq@b$(SSuPc zE`4dMiYMYgSBO8Yru2Ue!zp;t`x+ME(8R4e?R#uly)~ZTvOJcsbx`;O+(sFp76=+2 zV~L-I-*GOdCT*co6W3ZXD2fw@&SoS&S&T-n9uHf_SL$%I?4KO;UchQ!Wtdf<4;oj~ z@x=K<2}Vs5A1cJ;$!PTb;TMqomvC+Mi_rc&*c8c4P=Z-RyFW1}ERFuyeq`jjhd)|}isTSG|lPD8wka3ydHATlaGoF6J}3%lIHw2Ru4mMQTj^1i%fN2 z0icH4ng9f2_d%wQ%8iS*6AlKF$B#+-tv9*~z7tt&rT;W(N*~yDw;c#6W7R7NJ4KHR z>lY`GAYE#K1@x&&^TFB+z|3_`b%v!gN)7@wOPFZc14dird zQ^B_Czrbt$Jm+54ecQ8u|?IpP*0wP?A_?qT&E)yHcz{FkJ6B0wO6Q0)+?wr?#RrS{0Kly`PFsd4; zO$2CehVjO?AulEPUt)yrNEQDdktP36ph&+&XgORdQ?0=RwX(UJ!+(+k9od&R<9Z>Dy(5jhJD%`Hj+=%gNIDn;xoUro-6X3? zHD_m6NPOhSqp1IBo$x&y)!*PUen2y5(Fl+pI7vuI$^grUUpO(uQ19x)|Ax+C<S%6AtI~d~%S7Fh&cQw@k~0mFP7(E)CfbS(=`Z&AJDUtv;wn4MIwa8EHkYIZGq=QH z6IcEZ(+_w4<}#%Hd50&?inJ$*Kg1uK^t{7Uq+b)f2so*1Z!i9b?!$l?hbgSkEvhQO zY`i?X>`8}Lhd$!}Rujbb2GFIySK0?q*)PrqcPMa{c-?5;OIoSXQ$e?A|2^IjomtI) zY))%v1e#D{fX==tt9viU>kaH3-20XKyAC0OsXyO)$Jb3w9|yjqlDyHa(+0d?%&InF z2nPK$)C3v*UNyooqAxT!jtgqmNTZ2NN^7&p0J!<1!Yk0lw#N+fqq+OxaU>4y;C--I z@i`cOcXczJ#0Eg|=8L9}FqohcTYzEQ<8S;OE_X1B@BW|zTcL$8nfBg6t)yGPK6a1v zHy~-s?3Ti6mtO-?7;`4-(I^hthRVJr)HW?`=<*WNhY=%idWkQS#OTSX`)0gcyT^X< zz7^M+*8k?NvsFo&D8M;mi0+WKva;$<6%{;(bw`VhIF0K0I=d*B#cqdvGdlW9y}=)o zyOX5>d_PZYf9NgnnDIUgAJtjh-+q#X;zfXqwaj_5~8Y{_dPE5pUq*qe101auFr_WS(PIh+c%b z>HAoH|M~n#v!vb9RZCi1=XiRh=g8({a{vtW#SkGfO;keKNfa9Mn!v}s1ROb%1PBhY zNeOI(pPkpx%#z=gGYzgAU6@>UxV=K>3z~5>DD0G}b}{ zeO%WpO$f`L^q(71s~$IoD7nd89vIYt4P5Y7~&+HgOx(w|(@-Ha$Bz=g7tVy@GgB z2rvp|Z{d^u3tPsp`bwQX>S*oO$iG3ot0Yv|hZ6qlkXd&0fn>h_m^}Oe>8o;GdL^r5kK3@Y8Exu^rb3 zIR6vO1-P~O_kEu+kM4V5PVsi$nC>u(i(AceY4 zF*G;$*0A=JEX*r`m(tI1qU{&bT*3X#p5{|Ni#}x?EW!P}jzfLOAcjfR@Q{dl<`GU! z4pxAwNYegvvJE9TO+LGE;u$Jx|8%MzX7e32e`It{76Gsv&Ygb}c~(wnhH47}K&D+( z%k=YL5*aO){o1Pdq$9qFB3p0T(Uoow-p!lB?6OPok>h3?_bT;|j+0ULGSX{YqAV|l zn+Xl7`eusG@#`1*?hM8WRkt&C>sGkkd37Dpzh26iSz{)YW?+YFsA#gT1GyrJ7!&3rf&dXDYf@JU$J^x?8FLhr5d652n zo&){#Wu=`xevyA!F>NY*NhSB19W1L|7;RH*uq|%O_mbz7P`hsXEj$MGb zl`NMlUJ=nD&fRh&yvxVUj%pyAu`~S?9D2s5WB2|3{fICEfoevf+R2$k6U6>Sn+Ai~ z%+`Z~xdPsj28yQ9>lV>$Tq+|Boh(K)%O?=0ZuW5rw4~|X8)7c|E2S&`BVnO65Br5f9;g~9h0(M>HDE}39$JKKR>`}@M|3yAhz=+ zD#ygd!KUh*0e`@-XB!jk1KCQ@#wja>ccMS}=l!~@6g0_%#KS6eX5>f4)Pd)4V ztv~fJn*LoqYfOHJkIhk|E9&USUHtxwB6^Qqwm`vgq(1nAwu8Z_5BvVRjt8lx-ofHN zRY^aLPJaBynC|%zN6d`;4cdc0YV%ZSMZ-&MTGl42^;Ld7s%@x%J7}W*`iJ}pZKFnZ z%1mTES_3e@{?YmPalH31b3an(aLy+VG6NkDAzrs_;1G3|GFdr0m>}$qMXY{!|fv^C9CDtuI;1RgSuwz z)xS(3TV*E_Ex_%XU#AY=#yh0J`lxmfkl>_4lx*PE11!1ux@Kz=#^;Mo&Nh+*)BD{A z+oQz)pZE#_Ll%>|W)nyPEbkIus@iD-$5ux`9KvW^wdwfPp(OZX4SP`hIV>*Bd`&02 z(1OZqh7DCjJt1Q?7!?@X1@7JTLcnNeY5F)7j~1Rh3xaYBGc->&-RGO+8{J4v5I!tE z81JJE*HegRXF8S?@-RF%`$fKEKqSrCh!^La%4_JYkGb8wv5t}K-|c%1FLe!r7XFbw z@jA1>+vSWZ!a+$uHkn3YK{YNaQe#D$EGtu}E5wl#ex!FY{~=K$ZMSoE%E9u6xOv}L zwbmf(J6!^7%ub*CRzP|ib)U{=RrL=S;QP;l!~H)HV`IemHxI^fP+vkjBb1Ec{T*ju zGtTrK(<$faY#FqgQU1Q+=;3p62<-hq`bKqV4%2wq;p|P+vZycVD8S2HRmZ6-*03%_ za1Cy}7upDA0QcD$n9=G8F}DcK!46P%ebS55lnyu=)U*bpKuMV_Za!1JB)KxOGo~{L z7p@lI40CNftT6;@kHSazBdnkZi&07PI|T>zUC-7jFNO}Zj!sl9H%>Axg4t28c z%EARPaW>swkH?az7+RXVZT0GleQXL=L4##gbood_olkml(#YN-n;0UU=(Vvof5|ue z51HSoK~O!z-wIGB3@Y8Nl)bV)A>-dw0aXpt_+k{KfRvp~pvY+9p;o_UnMB=Q6}Vx& zTxoZ0l;;XA6*-*BS((afz3lK98ZN?qw2!34qH%w;UIwQ@9rpQ3nBb#(MUjjVg`U3c zBhLB3-W16W%^vo-ho?*XDc|%*9nK{G?r?)AX&CDrZtlPL#CLf7GqT9>ll1Y-Y?x-R z2ulFfe$UEywoy#8BnQoD>yW$Xszz)t+=MU}+0X1d{=Tj+B3x3HqfL_T+(U2hGODPT zw#`P9xjl>JjNnduWe`mhIv6vZd%v3sBfTv)jTlPyrJCIsV4U&X2E>k|zHPn&lXRXN zdsSoL0zDL*%>mX4X{j=!bsHpcw2TjSKSjMpsEwbtG%3W7xkh+{XL*{5@FdXs+qFq( z29k4CA~Kb9Ic=wPW!55hEWgmI+hkOzvtylX*=RTQ;NGCE*LcgQu&gLvBfF31ybd_z zGEdvWF@~`3WJj{hs>TSs?|sHn--6LqPHN_x<=KZ88K`bh+r>4LM>8vjTNoQqY`D!Z zG&dvTO^2g>gRQjAdfAD*aE@gR4>o#HA9m&DXCx(w2Av{~J7>y#XK7F$z|p2hUJ8AF zJYkr=nbh}M8hhTqVVEe4H5{=7)t#~URX}d5z)H$aGBo65f-UID?pQJu!?(v)p{y)b z^qvWXQW=b?9C$bt|Izz{w-oVu>K*Lv=|{SkkGv(r_j?nak+v3R&P%)&y%r3~Z$A}D zqI}n~7lmBO+HLsnc0CJwJW+M+_(6R{2(KP)kSqOcW7*cbgy&#`k0{?31+xls20oj9 z@83cD6n$KCA33F~kr zPf5cD_q*QuaL^vOOML7z2*1llni=`&x6nhRbm;o{^{Os1e?-qk-9*zlGTrztBPS0J zuo1UgC&9AzwD9&Ww{6grpJcYP$u+fAicA&k3g=R$kwqsc72#Tx>4*x|82aKf`9p5v zykIhlnl>eKQ2*~>YO`{=2%7ms$h_JMSWt_&un4=aS7za&c5&qq_cE*c+vg|yJy>`& zd2G^pQ1y&^?k5KzLPB>~W?^fB?6^NDto$OF!i)^Y*NGcy6=Os`$SQg}N8{OJWu=CL z19+`xs&8J8?NN((P)kuxa^w}&Be8jJMZ|D{4*b5kxQ2^XPC73SPtb8bjI^U z0A)aHf4>Iqm`pHnHPe4CAORz!*!G0-mbWQP@kQ+Z4}%#BzUpx?!@Sa z57@WqZc$kfs%$|H`G?-@)V=NN+It)<`Ml&x6LjGi!hAv|Hy8d+K;*!)qpq+PE$iSw z#z>_b@ZkdXLOG+aeTPG>#rEAv8hwb$*%?Xe@Zy_oob-x|Ww^0(JDwc;v}O@01Zz>- zT-1TrcB;zjDBwhfU&JkMi^bZGkgqu3>= z{+Tw)3E=_X@F=wuhIS;Q`SK&B^T{vFFyeZ1LMcqo4?k~7(}zfvFCvJPd@bE)P2yU>==E{! zuz}t4&kv3%LZ`mqkMvMSNEjWr`i@u|LJFBD&F;m6nztZS{)>{#`<1zl8^Tz#4#p7} z9IZ}mKX#HVj2hx@LUTixkgd3*v8Su_hkJ_G6@{U&n^X3 zU>_8DOGBlm%b78t@!@q4rS|;i`}|x%WUwm^?_mxsP(N}z!;2);FUG(vAJ^x)L9g){ zHkX_@FIfnGpk@kIRM;A$?b4$^bD3^WPpm+!xs-ZwJ26HLB7hgzUUZNlftCb zS0sOTJ@Nh+$)PXl^2n(WHAk?F#=Ev_SNgo;mbF`#mD3EIgAI*lfWVbqj-L7oS^gcD z`b6?%*1Y1ui$JK;ySop{0uL{ns8Byo6MubctHN@sOz%K1zU$PW@!D(t+f7V$byxx!|lE^fb%(}iqa(+%HB!LOT%-K_+4g&S+%1QtHs?!YclpR!Z z@GBu;kp1F|IZmJIO1wo8H=dcjmK%cXr^pJTGm$WJr4X=X_02u7S5fSGGr-3%kd$8D z_4tI!6#6r+l{8swdVz@Dc=F8+aS;f8cia_!)vAGu*~7wT=41sN-QM zZ#WhzP>vwxsTPu0orLS4a2G>86{rD=ObC3{wyMV%m+v@Ok|w&Q0q4D1|*qtYp@ex#59zq(}dldjIbIdY)W|3vRJQ^ z#%vplzP`VGz@@SNd_H?CMXcD#HA?Z)Q>1nwZ}=rfMbN`zPbw3?M52qOPeaC;_r!Zjqm{PHpf@UeS=$zFx;iBYjy=1g8uaeE zVMvInqg>tN@vXYP`6=sNXR(?k^1AxQGVXXKvyHmFgCxA$j`R1V^@*{01j$x0Sf7J0 zbIUz87}Bbcr4Rr<)wTGq078ezUJJz~xAD%Pi@kbFU{y|RWN|wHn6+rrXC|vh)kvz< zRN+Ixxi$_VH+7Xqg$(pRy)q41jl%jL*g(v(GIZL5Nq{~EVdK%)g6-Po$V7LC@dIUu zs*QV&$|xSiY3+eM2v1OOG5m>F7rm}(Ma+at=SJi06IULg)bYSWx)HVaB-|w)SmGkC z@Vq{?JT`%ZiAVC2o$`%a90D5}gCj+);RQi?s7{v~c}(`=pbTrcg8OvA)p_)3VC=Rx zyG|+dTNV*FYJaA$IG1p7aXTrMuBj~~(<(N2bUmu?Nv5V}LHP+it z1nb{A_uU-J${CxN$P;b64xjsicKzA|VcFV+qZLmNY2CzL{Iy5dEx&V&;4 zIkPWF!S*8k(xYnh*~aq~uf3mhQSnu(al-6*TyU3u)%vnqsq=Q={duC*?3fS_2BA)= za`ut-F9DV$4@+-J=R!Q=ks%NCF15FbKL~Zj@CuhS>VaaVq90d$hLS#Yg^LvGMC;8s zm2?Z$By~0hW>k2+je8jItWZAd58^?%8F>s3B!GU;KxSXeI4b_1uD#yH@`AqRLhsKTW?$G+*-YpEJ(*^ z$(lqg;m03+u?)6-VK!#%iBVz0OOptb->(baP2Q|GzNMlCs+7T5RS~0+P>))fWsr-n zff1G73w9)UY{F1#pfxqgPe!yf(L5dN6nP`fpy_w*Ps`0nzl;4v6XNSfLci@)zQ)Ga z>zo6qzjcjl;AL%-ZldMp9=ZgQJlZ*L{v22&IK{91f;(>^qA1ZI?}F(yar{fb^DIAPB+ zr)+&u*?oKA8X*x;9r7wV2pm)sp<8k=#Px$K`g?k5L4kME*CLmFL;?lk{i3QK)mo;GgRDym!&jV>-z#RmzVN1#6Vb%XIj_;##`Sq;1RiYAr#iHmu zv3m6tZTop2jl^;DY16+6^EzuP=N}2eDhl;;>(I459{Y0t_kT~5u)1Q>`uWfl9#%+z zG#dC$Gk1R6B0ZKeD9EMgLjpNx&=rf!IlZ%!!^JCR*^06EI--~~09ONIR`vJ!8c71Q z8x6a&JWFg#Tyav#Ic584XE=sm_Mfpl^r)oeuy9bZ;4zywKWslJaZ@l1O9|P(*PFk3 zy^rqVoF@80<`SOl`;$kPu&}@#p^@Y*b7Gx*w6CO!hC@lETa}Wxm;L;9oi+-cDnfxp z&X14A|4b$2>Ej(!P8A0?sm#p8m9#qE7(^w`FtnZ1T5o6^eRFxFb&Nj!_+{Cnfm@+?qS(d4|TQQ!oGg5{ zRx^6~&JS(rtraoNj-$uO79K&yL5iSNE31iu18{zHG!fvU$-HmL900TnGXM}&0l{xG z64Rn~+*&ZQrHnC7ZgD4RD!Y8;N+;r_02kMTBW2I#h_rIDqqjy}a_=9~wzdk;nO2DG zmT;*R51WMg-jMX@7I14>C0{nWK3e1bD$?1_V7gH~_krFjW=H6zl?0PH=4M+at2H0` zfo6AVJu%0r389&ZI*dPu-AscD<$iGYreIQpQ+S%VekL)MdNU$rfw#uvdY0*>m~GfY zD~QbV4JW#9;l*1WTdve;>e4IS8DXs&_D-etBlB*$o#gy^0mPW_`-~)(#$m=gGp!&m zG-qgO3TyK+^B3I=c8WlhWba%)@w1TlYRHJQcMK0hQ=8;_JEj*-!M1^}_oiMr;NSj2 z;$lB~VMBE9DWF2sSFDZ__MHaG~b{y&xzC2>c1dkI0#;^EBih)7I zn_lmV*R9((SwXMQU@AhH5Usk0S(Ix|9_ry-=S9Dno{#v-&Az2Qu( zU0H9|8p=zISyuw+uKas^#l2}An&SX5LpGToY|Wjoaw0jODZ;N!c=Zn^l1t;61A7X{ z)HyAxmp=NCg(M!7HjZ4HpMNRh`t|LDY(<6DYRhzzl0NZ$D%ntSx`?%L1D{i`PCstx z$EW$~uXJ&}xI3bGHV6;~k4pSV_R-O|iyUwmWlN;La83$#nKZcS09#8dda)xY_C;c| zhNKNez2sFuHOL6f+KXiF0{iNkmjrjMwyEB@Q@pMQ1XMsCULqC%Pe)JoymM&pg7t`-cDFq6@%_?nN zlvtIhN$YtXMdSK8%N09;EaX`pTX6egO9t_u!#lR7W_vB-YLJl~q4(}hunbAe zJu&W-2Z}PDK+1}>ICdW2jpO!~wS&AwFR3EI4X-^KfU>8eoM|LzZAg#Yq6F@c{O_^b z?dh8UwoU`YZde0f^^8r)IY!bJMASnO5@dA*IdbfO)ZNpg;=@Ccs7H9%=4Le*OvZy7 z-SLW2(EbzRCEBRk-QE2bJNxy~5)(C$iLChXdWEUfg2yN4NRw>0`E(JJMJ-7qnplix z`6o@0kaE5A-c>u}`|VUR_$9OzJal^}baHTa1rjTWh4*elKF>#YLe@NpJ^T5@GoAno&;4N4P^v;K^jo zm$$X!OGt8Jn+Y0Y9=`iK?Cl!mQCRv-5;v%Agy_-BJX3Q5ntpji`;hG^&SYG- zYz$;;3XXb}Z#kPu*9iIg)@9Bq4`s@718s9X{uRRk8exWSqNWBP40fHb$n37(7^Uga zcZ0prfT9$kgtaunSQom^9w6|+M#j+%od&Cw%Vt4=QaPGaQBQbvaf=BQqu$e8mfj7)m}t?liHER zay5vZh|H+v=q$0MCi>WAEUeN8Cg&Bpvy;xZe|Ohk*6wdTX)LqUSmF+s-jppYSag*Y zU!`*YE!PNm07BBV3!V3muhOE6FT8ecG40a88Y*XX-peQX7|Sq*B~Tx{rxwTl51lgL5uk6dX^zjv5G;*Y^L?^h9$2zjozT( zlUMDF=Se@Y7QQ;q4+0U8us?j`b)N`X<-!#qYcs^$tcLH=6~pG&8OzayGbCOA3FE zLw(#xd_ufQT_G`6MieCQ9`6E>*)G+dLbr^@=Y{7dxR*10nie?Y!o6rYpvcy}cKhw+ z3GIt#Gu59mbIGBHtox4l=%R@$vdWhkBLroj`t$F)`Z7%`Xsm_r(AIZEsD!s3xt*5X znrEbmvkB(jt`x{SJ0PZ)z>)VMtk9%O$Z}t@WX}p!GGkkq{*5zK$REx>!8$vh&89dz z9TAHRf8Qu>Eudhy;G&$;f&;?k|E#^RHbc%`gJ-%(EZS71Q5?Cc%TnO??16q?{MU@J z*85|(Z8&9nhv9TE5#IReMK1eMs?bD0v1v~#*UH`Lb~JRsl%Djx?}@&lb~%tjZF6@y z+fY60@ubwew~sI{3s6|@773JUgZL`zI?MDjk&Eo>r5c2Nn~ovn4FE(SH?pkV_G-Q< zCs^bQ)ogTga=o>oi^5I|SM6sS*?6GjyW#~_vl)wkb2h7L zicn-sjxWi26B#FbuhL3Y)xTYN(WApT?pp+|=j<%-sTX6%qq783e?~mF!yDWj=+f_BaP3ZD35w9jk_WklmOrQns2Xw;e%KOqOOXxc7FFt@>%hJxhe(_-tylX zydn-N?&E0A1vW2ceVF$~3plc*8fv1^!}+i&?brM8^F0X+jLI$mj{PC72xg$K-{iTc zo+VFk*ud0f&SgNC{Xgg4Q8G6?siHD@e55USE}X&mSqsFK(T>8)8H|b zF5OSzrxSY^#-T%Va{12&C|(6gLBmX%A>-Cb%>;>yd?;f+k-iuhvfi7W9wSZ!HDb&gaJW0J2Bmw zFMPvkhMeDv!m~bq{K11tx(Tt;JoRm?kCNd0VgSl#mks<>HoKC*DS%yG9&_Z82?f&L;v}8g5 z_9RrL#d$gWMDdqPSak)kfpEF>;?p@v8-8wmNjzTH9By*N@(Z{|7Yf18uY!P(k>SyN z9KlS63h^rhh6n{a57^MLbV>AZrpmgwh*60*&DlW7_;n;5+(lqY9#NPX)}3Q=f@HzR zY3U;NI#l%G!Axu~P2X|-{8(sk$7P50a~n6Zwgg{!qTdQS^^)=eJmzw7Xv95<rgCy;I6r|?pdGsH_0t&B(<_#=9tdw=wJ!i$S=>tw zYSNILC3xlAOrm`nP5lSP-^`Yj+I zb5EDuq)!sx=47W@B+d_DzSZa~Kb@&FL|PEsQPgl_U?13t;+?WrNfR#l?cYw1_M$1h zS9h-I``uQeH{z4$Fs!|8JyLj$g@vU~BdMq_ByDJOwk0B(MQt9vF}dv&1Tp>GH#l;_ z|KY=jgQK;Q#r+9htCE*Z`!5%3WtH5V*f|9P%9ZJ*d}3#Ue7|n9mK?2a=bfZS$(;4A zH{F^M_lUY>$6{e-cq-xbAX)Y2A@zVyH`Ki8%Xltg-W}ZrXMK>BAQA`ikxKqtvMZpx zDT?JaTuIDN6SDYXrj|^AkRd)zOTuLB>dVP6xxl3MC;$w1Uu*IEob?IBNhxu`hP!}> z)BSSc`-jL&(#`uILfIav1O^qY#g;9^ZqZiNDThWXE58OL_Ds#NBtv$+%}9z@13@33P023q|4@p45VpRw9*WYdabr z$KLazB_+LLVUhhIW~3EBO#HaKefr;a4-b>Xa_Gpu`2BJ>h3D#y)$U-sSDA7Ijrcuf z?#hSqPDeEZ zo9p-iV5pts!=SU@eJ(r>yyFU&%kZ1?c!qN&?2N+xsF95ypzM>;P4)&}@~`BaDWc4D znV%z$m(gr=U$V9M>6>(l0}&?lcpq5+u2YHwmgdU+iM0b1qCew4)?t%nD6>QX{|KQ+ zn-?fh*7CgU*$I@IJ=V8wTdwL0M2h*IiS?!kGxT+l+KmH8y=~D;b=Xv`JW=rIyyp3< z>lT|P?-?fBkwCsyd@XrD-EH*#+U)t|nghsw|GbXI*?Wr>X73r&3Yevr@`{8FNq~D= zYtjoa{=~xlS2v1+!0G!i(Z`OY9@%)4Hlfe>$Tv>!%iJT3?qh_A7hl`z;@nL_RV4i! z)?<#(tGVhH{p{AGy$;`90-Q`vO2;6Y{xq*m;X1k`cb=Twp{JcAe33c)PDEh?ZEitG z;@R9jo|zCSg8%?7>nQm-qDaS_QtW!%tfIQ0>G$}+XNOrj?|zHEskPlM5kji@`To=H zG;wT(#>EJx5aCw|$Z>Nikq%ymL()7QvzisORh~==dO5?70#zh zDWwX?FkYsVK9H&{B30$(f~l?BT|5q$fGF9cTOb{%Ze9J%W99)lVb8W=Ej)3ePgSmKNlxm((J!8`h^iHz^OfxeQ-AN9ENjR>!x$S4s z^j|_*9~$#<56;;5jl5UJEYp z-hpkxYcWrceK#PBsHO;?Ce(D8PavOlA|I=uNDhZ(SVn^mOh?E8b|2npfa?2~dZ}OH z+%Joc6vemnCA8{R><|-%kjiMB_)iyPBh?B_`D4x0U(;RK*=jdXQRn;K6ixd1%&f?c z^0fX-Mg4IrFV-87&C!%EtinE0QBkR9E0TCjmCwaXs9^Hb&22t!U(39ZoFE6ZP1N7s zy&$ZDpN>IKI#guo{POhED+XQM7T>v{tg8C8R>Oi|+x|CF*_4k63cD|(lVmeZ!(dFoR3Kx_>WJAzO|nvd&tYbS}* zr(3>x_H~HOu+g31aA!Gw7LP_uwNgB9R`%@&7VJA&x}TllqZOx7&QJ}xdU-sbBsRk`8h#}y)VJL>#) z2YJMB8E9`(t8{xE?XGU~(Phh;p|f@qcOkSt&BSg{^elxZkZMCZN6Ljb7Ii=BhGd`YBre`Zn{)c`x$;g3BPR5tl|RunY{J z2bNAJeQg|1L5G=FEiEl#4pNfSyd`Oil`-3ddZ>RTf@+9sx^#;M1Yfe5PmIJbLSn zV606aUa8XtVPot>nT%Qx$}`O54J$1z!sOc z#UGbxxFg2f-P`6acSEx)GJL;9HwB#6T$MK^b&sRnI zFY%7}f$k6bF?BEg$lNDpQFw%xsIp6Z}iF8=h(b1@!}+J{fu*Vq;-n2HXAc%z-UXm6x8Un;OzjFZK= zxfmL7QQ~7c@?)t+gVowv#O=2k6(ZEuU~*8;%%is%p-g>|34D2Mo#KbslOOMuEges@ zrjqP{829WR!5&^wfw0`NY$qd6o?AR8V}KI&+7(~f#Vpw&0=P6s_d%PnNvsfONqTL6 zdY6y^av`l8&lQf&@&jY5CV@h|msTaC(Mx%n`9i^D>@VlrHwp{dhFqDO$tIa2G-gsk0KKmYP)Y19Tomf33iGSVJ>4STfxtn5w} zqPA2bC%q%;kUZ+Ez-J$g%YJ|Dx+HquN~1HPGEspe^q1E$$k;l;ZBLDems1 zP+W^U6n87`P71-@U6bPOH~Y*!XJ+oY_jd@%T3^;HkG=9fd~SKYIuSk+D0t#$s@8#c zR?if^bPg#X3z~1BICUqg~X7@s@= z7BmT-8;LT{cQrlwlgE-Nc)A*le)1Zg28_9ca2qb0y~l`p?~5}!{Bf(=Zu6~92YTDH zYLPb2kNc%o#rO}itt#GMmHY-By>RABR9Dp?O;o-_fos;t9&XO9X|2XniEAZ#&{t!} z@z7`!K`cKA7UG4GGMDmN9{K*}a9{L}%WmGg18tUZWWd}e^Vjhc4W%}8x-kx#O#=qe zDk%r?g)-?!|6`8#_`ax`oB!E-!_H$|c_ig3H#KD8o-sIt9Gma7J$QRLt+ZQTj~e)_ z;lp+S9`K0t3iEn*?;E(guNn^*0DW0J{ovN8#5p#pEMUGTH{e!niR`Q zRy-j|)Wvz#R=x~$(F}xikbjuq=X7iSw+#jKR^q6}61{oB(Y6>inteC%yvoz}X zOVJ){S%q;Lu`Ktgq%?JbnLnNE#rK1N$DeQp(UN!g@*>-l#bQ-a{yOWBFT_w+{uXfL zh-mdbHe6-E@AE;owSV(RiH|gRJvrgi$CJ2J;SOZ|S=+QxcRxw)__w`;4tyWTBNJ21 zo*X=s%TyfXpS$PtoC4J?NS=t2M-PGr3(2?ZNt+tGjd7lEn@uLd+*Lc&$wslQN*vs? z!hbfkZ)SUv>V4_F>e_ZM4LRU46L{pD(anFgBs&j4zq#JJ;9HM_t)mn@0DpJK)@Y2z zF`eGer53wpiuw)4Hppw_^JJ$4{_f~7G8w7(sG4Plf*$EQ9(Q~BeeIOq_nl8~zyCsn z8e%2v1E;uKemx}lK5FxPFF*yw;%96z4l887BsWZGH_ZA-%2fB0n$?Nfr+xeqCcmDv zQzt@xgEBsU5#$8POYj2RYc9A?TG2<8D>xSGkOYbItzzDfR;eq_wOB)QtmxAjPF^o} z{zP^hoH8jb0%q>%{>HD3-ToKX8hKy<#a3_A}LTWW{Nt~&v2{};_lioMnc1yVM zV~GvW)sZ#I1EYqUKu@;La-BMJLQ((r^z`RlF6zIlyu>z@r-#1Qj7Mkm)8_hCY=*VB zq1LuS`{q$#5CVjK!DwXyGiqbpq8H?Zdkkp)X*SR5+z4sw60b=$=l{bL^s6vHuC4d1 zE^`{N|9Q(jPRi3$iiqHssYoejGg^@S3tIoTe&9MyQ%iB=y;Os1O7D9!k2Bwb!i$@h56hA4M>n2RsbQd_zGsr8?LqN$fH`?nRBw3 zW2BS0GvY~P!sKLPaPc_j4hKsvn9vOINhr>c&a20We)LEtfG&WTfob{F8S&w zZ!zkt3bZA8Yj8HU^K7YucxwZ8wiPa|S8y(zRyEzMepY2^F+Wtsy?QfQ@>7=3Z4FY*7&qzi& zXN1$WLdW(w!JTlC?x*z)8ifBq0>2{mT`3S;dbNnipCO;l{`5$^_?0}aPD19(HFdxs zdLC)SOfC{sb+6zxGc7Qd)5@*CY*uC(Oi8^W{xncoFj~%{vL^Ni`A}C$=$k~jg&f!$ zGT#a%Rwk?@Db%>0u|Q4X%h8%BYe!(UON-b%=P66Zpr1a+bA?DpVuxB#F5!aL#|@&# z>B$OO#T||SS}^o;r_O)lkb~`^ZUC3Xa~}=GlD=J!A1?=Ay<+|oY^2U>|F{}GY0J|s zTdJZZI}Jy$LKU+Fa^dF~|HiK1Z34}!wL@&8D`InRG()@7x8;#+tF7O|y1t$G$y0Wk zyK#!1>DF{@Pa!N78m&5|&2YjHw$T0>$BhpG!1pIs#|RXQM!k+<@>YlY)e%efjCHaF ze4_Fb#(>B0bufA%R{WUa%{5}-&?I^Kl1*vkmEJOwJV1noEZ-MD!EP&WqVsj^h}~(D zG3ezd^Ei}kO)A#9biFna+B*0cSY3qvX*^pT^HzuZ_(RztzP`^`&&`zY3!i#NOW~O| z^NR_>oT62AlsJrm;V(Zawti^zmY;LAjAUa=sjgJiJKYfWGaZKYkW;hND{tX)x~JBr zoNvK4a}ck;vGU+oSDOWjYRy0Q!Ru6}+tjEk4$`%{&;KjPCfrKI)zROP(f?scrVyO? zMo`zyhRW|5*S%_P{d4@%v-)tK`bqrML;PtrTO;%CSf(*ptLt_B`&rnlqj+A2@ax) zq_yj?cmTH8{>(YlHLq%SKCxL9TIZ?g@vs!q<@?0+|45OgGVhZm^)4yeMS==Qz%@;= zb5Mtt)h~;8Zy~)`U?sswI**L~@P%99WW;D0Mx$Z)5%+Grch;%a4kSg5%wuRA#`p0B z=T<&CxZ}-NJdqSVVto@!I$4%ljIgCoR42sRko_qI4+JecIV=G62_n{hVJm z<-NKbT6upJafd{5vx+$Eo!6ilqIOU_;c`jYu71wUTO|~>g8QsmnNjGjh|7E)cHZ#S z+lW5Y6nZ76U=1;?@1$X^T`2&H@cT1MP1I;w+sXz6xbe6fDhX$QNGdd0<**A@y-pZT zinC({OVhZedmjkOMOW)aG22Y0WN6qnMy(r`9MU5DKU(A8j&B){upG_?eI7`}?K$xO z-PSv*glwbI0DmKsr+V<0jnbfCbxJ9zc-*@=~AX=Q!ypGz@7HWnU7P z=@PIqI1oggU371k?B1TGr<;q}B0OD%j=HE>UvTTMyGp(D`kwhYku^WLTKybJhNLAb zeO|AATcv86@NoC4bo;8(a2RI&2xyA1(BxpVFk06gXy-OqCywr5pjbcW_^OE?UyUM5 zz(hSO^E`<4C3_2%?NjKvb!3LP0kUT1X75;8$%TR{Uz!#l0kQuO549nIWW zR3gs)GAv!$i|MW=x&|T1P8tWtFSBuW6CVCP?b*4xWQIpZ!-_qTpC*={PhYs-=Lz?W zmIR-IeBO78l*seI#XyK^KDoqsSS|mixGsj|T_>MePx!H23WdlK3(u*}E0*A6OnL5; zp4jcr@^_)h3UQs&6ei9X40Kqudwgu4pG#U2lL!7aQ=eSWq>^^B&e0JU3%NdR%>@)fL*w>{0}5IROwH7 z>h?L>yoO9`q@8RjgGXwijt7=ezIDO5yN)*lBa1YXjavwhwPLmxj(=KIaorx?nCdDK z@FbiYOiOy@t9H69;NeH`WL$5{JSm<|9k)z=prxi#0qN^7gMNF~JIucViqAMjmnS@a zy;*=*Bs%HIuTFNVsPvO9L`)PE(~vCY$a-lLx`}&(5L9wx&BV2MD+_!?0^yT-YOo56 z+{V%|+SE0w#14a$=Ve-el9Ug<&QuK=`U`1zKEoP+zT-_s%wm3r%JKDycJ&cVHLpT3 zG{;>nUP*3-i8!{as@XW=7)h}XNfJ2)7_rN7eNDIUK}kL>L+;%n2(~uE3f3PKwi?Zp zqf4P%USYTVBAD3Kf&fX0@Jo_;kK2u`CI=jU;S@;xERB5j$A@I*Xpf@k(%FSkzH7Dq zml_(NUV{|}25S56yavR)6iX=}sS}bKk30ALxxw&JNqWZ$w_=U;&~uer$#?(r7X~pj zl)^g&9k|`F#!wbwY8?@tqbON@AMAKt+;9$mii?b1vHkT<$&=NDx^RaY=YAuwGLg-6 zodvgQ7IAw&T0S?04guC`fo_;G`~s`H9?p^0#6?7r#oAut|4^BvAykX=Qs&W{;TC`r zT6pWBiu(z;tj}-ntGu~Mu|V1AwLq@#R23)QIf#0pfqSeLtO5C%8T>-7lVKm4Xn~A;?#LIhwFz$c@wQ9hzghO&COwU$u zKTvDQ8cmv;*R)ROaV>JuuMpVvw~wYJ4>2d{+^~n=4pfwD$Ovsto<}vH^9>9iE%1z2 z{nK{!*V&ZZnd*3W?FU)X)<`{F2eYcIi5fV9oaGm0$iTaz($r!`WPeR-4%)Dp?amwR zUn|KudD|`5VwJIv*?gK60J57PR z97WEinr-yFEvn)=>!9Z=6`_~(Q|@Q1q`E^23T5r@kI_hgo)F)eP?%#RrkZc(IwX%! zXy)?NpIBaX<3=KDF4$Zu=p2`Vx#4INPJyti7-K9`JjHDS^US+wxVC8dtD8Jm>_@Un3g7s()V|bY$X6%%y0DK36>M*(h+GJ#oimEbr`5+A zeA!*^u`9C8U_Ft%>_xkrN`ghD@@5nL9at$c1Jj8!I=KiR;^Bg(J%}>g5^Bpc_DjBw$3CqQ2u7FB5h2SG^au$JMTYYzp<4ry zknfhBv{PR&EU9CEms`LdR7nVI3*(BoSIP;xxuDwj!rwn@41c=W(92o|c>Dpx42UE; zFw6N8MgqZ#+hxAhAq0{bH`wNH- z;rzY*@orV%62ck}f||>V3r~b%+MK1ZW1X}{PBJS6z14K_DeCPuf{-7yj2*jQTai!s z?kRPTu%v7#7jZ1zg$WIjlW9lrNsaelGpxt!IBaH3;DpVy)bRje)-$_2CqJc%j|s2t z-hDI~f8D-VisG%%)Got;FDOF#jmiPpcx!|QVDHE;B-r>VIOrlQlM93J$I+zZQ*cNfzebS9?^Wsr}*g<#sL7*Bt01=e6QuO|#Db zUak7%|Cbp4&~dm8bW_=ejkF`YC&O;>Gm!9KmL`#{{w$qCv4Sz}eJi zLVlG9P-GK{KDv^t?Pf@jOI#`!^Ih{9h6v?=Cq_NAV3mEI9KlBxJfB5BLU9>`Ew?YX zynEy(!v|08GJPg7m}uFLDhM$Q*~%$J3#qS+>PP7^ohIiQjX*~7C`AU#i2`Q@Rz>)J ziB7x9TNsPPyMjf1%Jqm87 z8h`14YjD4l!Cm^D8lQ}^ zAhMKmc%dbfudp?(mUHqQOMme38T;+H@_E?yRb+=pq31NFoso2@q6KTA8HeWjq<-(7 zj02@I>j?@bz?ZcVEKr~wGYxuf8t@eIay7+U^Y;5dD|_Z}#+wf@sbO7l!t|cu+*F(i zEbv7sINGAHciQiS?-f{Gc2029prHh&hcR;R?30zPXiN9JR#^%yY0q$z+dQg+Z!p3; zR?9nGtyI+rKXBJT@&N$Xfohc_ zoV++C-PgPVy3vTAX^vWzhyY7s?Efsy(UR<N#1A(D#n}ECOWLg zYFlyP7t^9^Dakx^|M7-A!<*yePi?B^uaC$=-91~t@uaB|= zWP`~K*IQ{%0xDw_eT$J`{O4e|<{3~mr)H?j)rACv^Bv$mT9o#KfgVPG3Np5G(Js?L zGO0StS0l2qIeuETa>p+(#I%W4Qz$s!lWD%{P$GHGf3X73R2!}!M}KNNN2+qJAFL!t zbX2tKC%uMg0On!A3^`DTsk82qV6F-9^t%)gnv(sSW&aOFR?)_G@gjUmRzg1Z#pf+7 z;Oy>IA5?QC`}~JYxIfJ-)27cN)snsT^~Io@M1F*X@je^jkh~pxu9BblgOr!@7rAC3 zb&9vY7_sR#(N8ApMo2O}{sa6KxeLHXo3w~HHVN0P54mno*=WB1CUO-(lW(3O$~-o6 z<+mGvhk?PcPSJ>*f)XjYP65O`nHfgn|4wo+I916R30Sox{;JuZ2 z5pUYQ6ys8rB4XMGN@tG7HAV1uCyvd;o{o3ed!hYJu}ZA*NktGth70`nha{#J@hHE4 z!VW-aSE+LqEASUY1?nEhiJPWhZ}6u8NL4SaFl_l^{gUDTB$^a!+O_uZkNw9ST$e9& z?~`lCN#Po%XjDE)uB8%)CXn67D)~@y;h~~~TTXKN60YD%D{*3)VL;ShzzH#EB~jX< z#@KKbQtp&R@Os=DZIcedS;=;wHz+GH6#-AUlTBDX>he(K&jFpQvk&gp8(KpoKV52^ zjcCD0246%99DaOY8H+Fgq@}ixXrflx6t#K1S-#@pZYG_Kl*+S+rAn=K_zTnH72lV( zyu6Q;qDo^s!Rg27((v_x>FTDcf3@3ha+v;m|2xkwICT0?Rt)%(<>8vTxq5ZKq=i~= zY(~xt-~%u#%>_r#ayb&|cI-wm-n}`aMeW7G$L>iqo+EYKC_4nf9rE%1PD2ZSHTg?x zW&`4g-%mHYDoydST;U5x6twH#1o}j;kR*|g1U!+>N}`H7E?Mw1Cp))MFf-_$dssdW z;j6(hiv$sZC$i)(&?d*@{n^&4`se*xI@_kIKm8`KoZ`YGjaS3Dp0D^E2{wjt)%%Zcxi!7N7KH7e4{U%yF{`$c* zjC1vVI3=}i4YW7%lO3Go5}~F6omhz~pqCg-16$5U(n)Qh&jLlrZ0v&eTW~6u^tpa8 zVH7&7#2fy!EoD2)raNLsFQq9NMpug=g;UIQYc)h|75>L^6>W5wc57yAcF$|7UKH*3 zgzpr|3#vVW59)xZN8*pZbvN4=B|AhdZ=6e&9@4F33}^CUHLqy9Hio*76MUF&Ks%yqXo|e;6C5FN9SAlV$WyLZ#7pocGnvM#NV}w>W=;MCJ2QeP zvA)lm#5=z6?+L7J1*i`b1sA5=ZkKO}ezLozCXUeKUWxM|z~0YvywFR?*J2x((ulj| zDm95jmP9*~9D*&^_?G&=9Hh2SmbB*A+ly|J_+<&2)5XZbpa+`bov*;RLZgf24u*y} zVHmsypU>vDYlLiZs5Ow*^{%Zuj4{* z{LkpfXQ9Df<%Qe)wyz|47$Op=64-@Hv+Zi^6GJ?03jU{{pDxWste!U#T+p%%JWDl9 zGSR=m%INAV&WDF04Jo(t36t%f8wI#ECqf zaKAFLBRTbIy9R106yfa_Q0=bv{qHK>9`Zy0Y!k-VUj|Y89#J@tCzt*&J(IE25bUbK zKGVc2pF+)XrEry5#?z?C-E*-!|5M0k4AIZ93PbJjm2aUi9CYlVVh~d9ZQ%3vX`|fi z{I3#N>)WOC(}}Y)Z!1w|}K+Eix>?PgC@9S5H9MZh>uh z+nQ9#G2rHB&oBa?oryez$5~Q-`rJBO=40 z;L}}veM+8CjA5wuUiTh|4%DrRYv8CvyYDI+#XtOrn>)4 znPJc%8XEuW0})!E_%IQ4HIc^tbkFN4m6evlUyy)*6BuVbfpr?I2_#Vr+J{k?O7oJP zY)SsW%mMEX{M1FWo;VJcwL?ZNv3fBITQ}U13l<@8MWuAnWmIz9paC^Yp=S zB86!=I{~v_jI7SU#B(yyfEAvvQ|zc$WJ%1uyFb{l{I@t(1eL@O{+2tOam!!&VVzGK za3y#O-0EGp8tBW4zbrxfXZknN0SHM|B|g0cF+Fah&Q{v!`yo&8b#5N#7uV>$Td(mGG*NRTVMssQ|krLPH=$XYfqQJpNn z!2{Ayl>MQ;qhH7bR{&L(Bc6SUI~yLobD=XEd*?{p&dHD{}iqrUht% zTDEZAJCu2ChntmA%d}e}rsSjELepq==rqq;41>U*GUA&wH-_;os+A`N#_JMTPqMx4 zw{q)uq8EiG{HQZoEBdn1FGf8rm!ugC*wM=1p0=;djefR%2p(k*LmfdYD4VOxbI5a> zEK^P|cIu4#*jCTeba{3yo{vwF=LMxd!oD}F!E;PT3IBp9{x$x1AAM}@1Pc)?jKqt3 z?)nZ(?&vm%>GkO8ndtp-{-x?+p=}GahsJyf)eLG!AwiW}@)$mSCy=alAsscQ##VS= z)V9w3rd=QZ40IBob4~KgnhSl6A!e_ycpD9Z_W8Zxx^888OJeMW>k!I(6VkPscZ`Fu zT3v0b(191gKs4;_ohLfDstZS@a{o=#g^d4j6LUjr+@z;X&EM5DyU0dQ;r;ID3@)%3 z^^0FI34oBQQHs9T{|+U5)_Wt%$xhYNd$WrO<~RpSmuHfqg6l)K5*R&s9ChD!_z?~W z=#N$Q5j}PcE0ZbOz4g6GzPce@3*6W^saYOG)efZ@u0%IkT{%0LZV-L6s2r3i6raUS zoiK}H6QYnZxr?2A3&`s-| z(9{zdp>QUQ2lP#QgsMNxMjHItTHN`H)MFDj?=poTj?PKUTj5^s^LDNFb01Pg)|4TU zM`vUtGKLB4#g4a)HS&KA7nRhL*gOUInva|Gsd#t7ZI~=9Qj^2k)(F_}qDxhjHc?WR zc(Nv9JG&qGZ{A8D6F!dC!N<|`+0P#t*3%5`LwN^H=I584BpG9QNJFdzPx84Kw+C+jxfP z$u~Y|t<2MQh3~GXrWsk*b5z$73wVVc;6Up|ND&rTa1D>M<+3Ax5q z9@Ngy@itd5|Lo@vI$hMa{aQ@;CfY?=maC_Of4m51=kRI;lTGH}lnsG+Y7ZSPA)GWe zPnb#W+qocr=4&7j${`iIeUuq)^z@<1D@ah(#Nku-y{_Vu)nAQhIf3T9w;Mtb)>97_ z|6}j#;O>sg=>jsJ@;xR4$2KIBvTLczu_GS?C%h61! znKw^+JFxd%Hl`WDXsdD_ncCQ%-d$4k6V*6AA^V-&8xXI2S))1j&8t*0ZfrZqpegv* zBJ}JymYqfkhlBabO=0Ue(ktgu{HniCo8Kx%hmC+JWyv{pV(&>Jbqf|iC)HcKA$*nk z%so7T!^SDe-K!h*;+@hz`@6-Ht$(eD>g-Q2{wyhGo8ZXf)~DYiPiZNUjdH>hLPP2<&Nx)nAS}7E9ynCicD&f}p%3YlZTi!HXg z56|EMeTlNJal*3?_#V%y>%~a{oLD# z-zyT2z34E`?*7hht+D&BOc1>{&wmz_ijMmxA=5#rHD@wPAsE>&=tyk$XyLPl12uds z#5US0B*(byX?%u?;pJ>=P<^7<>&jkI1mW&A!R!3!CpxsvE=u7^&Vl=)Qo#_p{m*Lh zfI(RH2rj!N$2G0yKzSe1&cq;btkbjop8opas%$sWm7ng}y(V!*m4lkd7#HJ>;kr54 z|Gaxc%ue}Q40q2)7(0x7JR}+%a=~iJ>xrrAGpOSYm9#1!FWA)W`H=|8*#8l5%JA@) z%EgruKWX?G$ymPpg&5(C?r3V?&SC=K@#Z9&L*sr9?HJ94_F^7i@WI@`RsGwz&>G>o` z(Uzg-d>+PkQzX{uEniAWA1}VJSo!R2T)C5--ZMj_ptuq}fvRgZ`#<%ASFt6~=ndbG z4{bAQ(Usy#?}PPfhXL3>ZpTF@I?2KF#(VvLF|U}`K1MU;)nA@(bl$fRFy=*luS7cf zcOaXhVwjbivZB!X&Zam6G&Qo5ayWuZ)^e2=Uea{o16(OaNmQ4E6BlfkP``yPIMcLn z)|(f;vnMrh9Q~89ru|IR4N=gq6ZxiziwY)%&!J3mK;lMVEv}1s#ngH~D~CovId1>f z$-0Wa9yjUV<*+&vYr4NLt5L#0;fc@g?{`S`a}RCi&^U3=z8+6a_Sp?eZ6v6Bkex5_ z+t(I0)_xXdIeR~51seY<4{31zB98+9y-o2zwP6(E1*(7b(>`@W;AVW9Y2y5M*Thzf zHm6Cdt-HoUn&ceXvJ9*EK8LO(AonvY1@BpYQ7mN;Mp1eGFSYdq+EB z6q^N(*-j-qCTus*6Xw`h;$Q9{Ce)p`HFo3|=z64%*nT_LDU1W5c~Nd0sMQvlQ8e!D zk#hzXZWXR3osIm2p&jO9U8vdynL?LHDk1PaSE*-iSt$QOjc)rQya(+}>&I&hth%{D z-X`B+C*nr2h%v(i#(Y(>o}u$WlB?9R5_K~4tPX08n#i7ph&zfLmHdK7S13H^fPR|@ ztB$Bn>RPfXMs=V)-;;RA8TY2*edsMA>1yF#?L?iFTw)-?ut#RTk9Yn3nikIOx9KPK`)Ns}3of$(aC| z<~zs3Q=Di1GAy;>0{^`hG>lw$xB7PtQgy@U*~j@>8q3%CK_}|5H`~oNmyRk-RYQ1& zE+KOoKsa+d{qQpx7o-`J@eLD!&z;E3mS13Vm-gege49;C8p1eG3E1^dUjd3rnzwHf zbFq-HFjw<~0vJ&G&1n4^3!V^gqi#7A#M+^kYr6$UPgm}v5;mXGK5*?NG~QbHk`(kR zKMDr9%olX%t{{%`>3jcfVrGwljX5E})A6IoWA9z3WlaDMnp6tO)e*91b+2{>=NFAO1K z#u>v?R*L}PIgtzY5f~3Hi*M}1VrRiPD(3^o2Ty^IW<=&Coe8gZk?B{_49urIpT{|o zQu>Tn5C7nuiOb3)ju!Y)#z1z~Fu}mUXvq?*(iD7V`WPdZF}#6>FT))XbESr_Vw!_f z#rH0>vT=95mASPi1#xLn`WG=And=}s1+T;nZUekpe`U!#{%T*=5^joQpMfXBmh94h zNq`FIVk9(7Dn%jR$+n#$?HCY(@NFuubGS={LkQC>;%A^4ZsmFH^|pKiYTsr* z=&YEN3ep9aSZ6CYNuwux`^KYnwzp(Mm=Gs+AEV_TC7xbA0hjgHR;ACt=Um9qe3Ml~ z2U4s9lbdpB#U=HuaAW%D3-fhO++4Gz0(UYD4+$n2vQ>F@AC)W6+GC?90o|>PX%`#Y zE*LOMHiiG4si(?}Wu{f^({FXKy^(lVJ^`j9HL$OQCWU>`T$uYKTs2x*{*OzFSt$&P zb4kXeE-_ezuM-L>bp!NuX%Ut6kp-@-H5rTD@d3Eb&n`(vycI|5+yKW@ zBu6l6{Uhoey+#EOCQAh+{p=TgDq{XkXC%xC?zOrtIPqZd7^cO%ay}`fRX+l}tM6hnK^~l=4Q;9bIovvtS^dM7uv3?LZ zCTwAxkZv0J@bmbTku>!C@_cF6;eUbhi5F=u;;4Sr2xT9#!Q<<8NiP3K!o?~N+BsIu z;swwYUO23n*y@xg-#ntb+lTy|iy|3NwChX#j2CD(F^oIxj>tSJ^QjvM!2Jt&$v z(h7Q_G}k4!f@Mb)00$|Xe7?#*r2LLbh10mJv?gC6@nMlM{qRSp5M}j(pN2IpZ)Vs( zu_&x8$H)gaK51b`55ns?D7+%lYLLC?N$;zUJXZwAkr8zUF#X|^D?wK=*+PKhU2g!# z(K@vcF#Vlf$o=oG;-fpUED|_Yi?h7@5kb{@$E;csTgCYV8lSah*W zsK^PlltOgT5}1WNPCYq^Ll!E;rZDSt67x#9jJCMYilo4FUMw?S#Hdh*&9h8~^JXno zNc64RgD6|F9WI5}6O*YAL^6L6umzD~V=N823^qP)VS$0w$b zqm{_d4>Fj0F*e0ad`-1}C+}7gV#efAKz9;%en@)*&840bIcNhLldYxpUIpjJ1_Xtw z^i1%Q%Rbxpb8&maV2hYqG&`{rZSoBel549K>U$qem9z-mHNl^Ae~O^-_{MqVHz5yF z_DPOwR9Ippv3jvEbq$E_rpL}DT3<*?J+JdMJs*B z5L=SyM}~aVSr6_3oBW37Zz;oV9$E1WiAmg=sj0zErI#U=6^5+@U{h?B<{r?5L6>n6ucwVYrig#}cdtK9j@Pa96TvEZnRkX9 zcj^gkJxbP&ELpG^IUTu<1v~>+9fK#`yhh-8LwA+9MFG7Uk%G_Rc4Ym6A1&~iPHnPF z#F4`~|EiW1&4(>K)0#~zPpcRr=p?NRXWy?0_1AsxR@!dh>RQ?KI4{O`NYD)E=(L1v zA|D&q)O7`|!w)7vWx>v;myL13@Y|0xeXDd+aS7<{ok<7t8tm?w#d`K#ojk-o(d6sA z16#=@UvQa#hHQZ(&{jE~`GVprq6!kCh^9dpR|xa~soHL!kxO;0Y6xv3BES9)DZnR7 zR@IuiDof+u`FD5~E$!C46cGt}Aq-h)Zu9HCo8SMrIhoIAz%GT~ZZC>!loVts<~E(J z$;M7kG(w<`PPa!T^*JbfpGYpyzVSMMm}d#rK14#m{yx$jmVT$6xd2$E;SFwpCo|@hjw> zvmrLG&w7gF=-0eSlSA!3_d~4?G!M!B(?nmPB%l-+_>0NrpG?5>*;H>)=j74*iAlQD z)W%ZWIF8=?3;WBIq3g~R%Ku;7sd+ELK7GpX;nZt6Zbh)(3+v`eCygN{8u>Ow!IByR zPl{JhGrNN}4z5TYz8Y;MV&rR`A!GRqxPcCw`JXwcoM$I%QC42a@XCh* z_mk5u5>Lx-nLPZHYPxY^^}@JFI^F;MNs8O4cQz;a{DynjeaoR;EwO1(_+o?$D)^u} zoG>}Q96uTIRR^Ax0?*gPW1_B(Z09{Mzf^own^*FhRZ5ZCeMw|K2brHBo*n0avZXKR zOQOoxEtGVd_SKTK$=KYkKP~o3C^t(>B+3K6P0uTC%6H!1D)k9i?raCY{|MROj~(>% zn$SB~UP54vy#ZbXBmneIz1mkw(24J7#14CRmGcdOuH~&^Vn{M; za;5S^<}m)3L+4<}-QQj-uv-yL%a zo$#aP_~E@>k03aEVpYjf6^-nweR^2Ml>5ovNLssFX!l12ja-E7r>PY|`-I6`Nerv- z2-Pz%!ja&~_HEYtQ~Oy=LpC0Xq^&~bQWHH?-!>-e)N`tJah9C_3X$6oCV{XqT3!t1 zNu;#_uvtY38=GdxJuo150#Gj8E1^g=Sr95Hm zkWU}K>f=-1EW|H)@O7y#+hi17Z83yton63qPQIi8LBKc?x%t(Ay9-M4M=D(JTrDek%VZ4QM5< z6OC28f7PMbCQ_nxPmJzcCvgL|q0yhXY|tv)wTxWrTl@Udm~=W4m*fc=Y}}#PXNgI( zDaP37eg)a2n1N9z!GgrKIqpCU-irL!F72w(6NN1#vH~r=wXXaC1O5n?2PK+ylov7a z@es@D=GU^xRg6azPLG!oHW&m#OHD+`N|_Qp`$m#|t!zIPvZmIr?irxw3&mGRhm#Eh1bsv%M<`SV;N4l}BpXd-%K_dKCN2mfSCD!MoKb@sRXX zIyh9Y{ih(ntz+~570XvK4ALlu0KAXG;Zn~SP_}1_gK%O@Ls(Ww@;31>PjaJ~8%DiX z?rYf=c!FwfK1YEDBK@XPjCw^?;!DYzp+jD%p+dgiEVGRHEA?}H%gw12Ya)ne&1&$P@e`4x#P1fR&hzgA_on<~+mYAKzy zaoCRDQ+?8o0L?e}YSu2ciX0r@V2S)OKtSL3A4tweFER7_qa_FNZ;k2WljyjV;I?@Y zlEq_WGT;h(+6fJjsNURv86Aw>PwX{jx?UAbryw^l>c5CKl-!Q^sB+I=IC6JmAGUQS zb$SGbBzh;*?}B{P5y(0WKW#VaKAuFXtO^@PJQ3yiH6xze&bTOE(5_jkloHBHn>E)q zo1d0Ofnu1h%2D=XbSYp{%8d=$oi4Xs?_6qBt8PnSb9v<14r|0b`dKQqlEPkX7_ceK zq)gMAixk3sqSSr6e7EDS7%I>at7omhczZ<_SHqEx5V_R+*npM{2j|DeDj8d&;)U2l ze%xvYGy^SS;V~SR?KF)M$l`pHCdc?et+}fx5r1c)?c9S5;5&@9@-zntZQ_>#S~G5C zNpg#crCQ5hrl9B76b_-!R1Hc3hx;oH3rr^WCAk=Yx=V|3V8?Qs?zMNog#qa55iVhO|IMYju+XE>E z$^9UK%u$yp=gL1{lO+!?FsAOCvj3IBXg(^e_VM|8=b+^AC_G!FZT{0S0>@n?fr{}7 zc6--()cHePmP@c7EjP+7Aq_GA)@_6byII}wLW=3|0zYt~Vu6M9(TU9eo`tyBUNG0W zqezvxBgDufQ^lL2(U=Jx!o2l2jjQlyPC~)*V(mlwmOB=VZoCJ*C2XPXST>-I&0Gl< z64BIXa=pOjsIC?3e)E7iZCD!BU#D_w0>7-|bs+RydJrI~K(euT@b=N_4pdM3Nd!~|Yot4bjbUPi-mfl^-{_OQj4~aoexH8q9XAo<=YX#Gd6J!{YU<@k=CP7r zE-Xavn%Kc=TGe``a2)ux2JYr4^~=rn`ioJ zW3jY8^j3S&aWgm*>4~6q3--|M3Z=};|G3EX)+ZC`kjNgh)c%8iUFl1K(cd9YZEH9S;`{`+Qxi=Cf;2*{ZMIp;E$*ZyV)dil;7z0^}Jr`A016e5xH z9F;Mpu60vHoxq4C)rY^`^aaE9U^nu3lxb^deYwWC*VR@bx3(_Mjc0gq@=fR?I(ym- zcv}E3P)1itN{z})2r;DbPV1GY!>-s0vp(9IDtQjU`^{eHrwaVl=0wI=C=_9D%Y9UA zqu1{CK}Lc*;r!~4GR56B+aOY1wrynI&!Ja$WbZ%g>6h3CpLP+>e1a)%!fD$e@p>Fo`&k6H+IZA6ZXcI?-ZDQCp%%m87(DEOP{Vv! zil~K2+)7k@lG2Yd<+QLZx)mOajXe3+5>~M5=J?((+nn(5ivcHnr06BNhptkREq}eB z;AIH}9j#`b1kuunftW%Y$DTqSZ)wQ%+VnddpOvj95#s=J`6xkX7sJ-l_TKMi+iiX)~| zZ&09a=8pwk{QN7j#VfK~=PR$oGk*o$Yt_{*nA9JC z7?|=XW^kHP8>X}KIEm0YeVXt3eHX7iU=F)oohff5Rm-Vdz!e@4X(Vms3C-XZX1SW; zNYL6o?c1NR3Hdw1^{u9oKS`Y$%%0a?c+Jn}6}4i2zP{Q8r-hC~gdRcInd%eYU@p?q z@LhIa9}ev7?0~2%0@-RFcl7w(v>CBv|6onsox#R%YpuoE>0(d{0(-3AIt(wosyEJg>5czzAD-Q8ArwLg| zpn*Ehoxy3KZPeM#et&Xdyz=~Q6^&>a5gzjGFcHZ*bg4_Wt=C;mg1N&qhrXOXHUc0~ z>}X#6?JjrknoCknOc65*O6zC1HXB3I(UCoQgb>a*6fsevbzZ15`#W45SfkuCqt!`Ai*lI3er+W>@%|VbxCFDrz(9Ks^sxnNiyJi`60ZdRho* zW4(k*Baa-RDAzw5g9aR#gw1ZGcOM%(y0O@dXAF(M4*>c!DJ)PsedE2mORz$1R7x`+ zbI)~(bf|f>VR*$4A5RX!BHGMq2vc z<0<P!Ac26OJ*S;30Wiwpjh2 z$UsrKbnOj_4*2+&aRJ4O?VuWUzB>5flKjR(&y3a=ugIJ?R$G^q5G<4XO^_hPiJB|? z(m#9~`m0Q%w;;qD9-udG@~EUm3;aC~UaK|lK5JL!Tsuz`=_N0BY5f<`y!`9F>^%Kv z()Wex2k0Hn-fw!Yn4Hm@O@+1J-Nd9}_J*vn(b_|doL?j#xrskTG?kh&(M$g^foadS z?Du%xHz0J^A4jywnV&K~Wbv*@6Eh3e3cs2HoA9YEtFQ{k2J<7*Ozhst3K`H!ki5m+ET9sOu!w% z*y|4Ve=!kd-Ssozfu+dvGg0QteTw1R0DGU(^5Qpnn2)AF#n71nrAyORUoHee z!ElObs`z_TasBI@BzXmVi{ePt9^=o2qrS1^0^HZSgZVVm2A^ z@D)>CrI>I+{zpw>ola=4yVl@-melpGln0>sb!WEY^{e!W7HHTMHL_Xp)IfulOW}J& zetj`hrCpVhgrp3hp{~(qX5(Rya@7x(C*7lj(jWJk#SK_M93`ZcfR_Jsc*NCiT;as2 zbw?7t7EiX$9Zgth*XE?F#0!_ki?B{wNpx*=lO-MxSdAS9kuMN-JLIkiDuw@*n5=uo zYyKo)kWiroS)tj;_@3e6#iIrj%I^a+OsmgryDLqM_lxzLi;igggwJG7^X(nE_f8Zu zrvMv(#e!@Wmj$h2WWeD4x#~0tbfCVSbi^o)_WXnO3K% zDmturD|B0@mrH2!qb3)bagY^EfOdx7W1DlQ#w-p#kvfD=hQUkuWTBzg6bodo4OS%W zi#?E8B5%DwEMWC%EmzckfqUN27nzs4;>XB2SB&!2yp$Hqp$N1g59Z!7wu z>j5heCk)0W?bM0hb@ze=A~3g99ytEsH=rw+66UF|Ih&nmfGv!<(=esQ)COe&?_R`5 zi~VeW#19=Zxm|WtM=moM)TbBF#t|DdLCX0)ZvGuA+|I^Yq z=iAjpTYFgZ+l+4*KSTcaEnHUIaC$t?I$G3^Ffnrei10D@65|n1V35qS!-;URaX086 z8tp~tuv^p{P<%9? zdSx7g8eo|&;4i}NO%eTdJ5XPw+d!npscadZW$#vx1q^h78;_(CrqX4=%qxLVXme>Q zFS1mK`^pIFV?%OEN42P-by)mDD|O95O%x~ISXGGSK2r2=7(`+0{;a8gzs`@}hvvh# zK<6uLt4~FQ(^UD{3*UF^{@(td$3Vn8n@?OtTH*Nof3;FrHr6s?iJHfv z;l>T*jdDZz`z8KyyhpkOyq?^KI1MvyxbfV>|K9Rdi+66oEQtm;uF&PnKUs%=JIfnQ z%*V<9$1VPGqA(5^F#G4T{QFq~)jz4hf4eg9Fi*LL@qd3b$c5oi|9GYUe8vw3%sv5ES*<%4?EYanQ4e8kR!clthgqWB(&BZZ%o=ee5$?_*d z>0c)@z8((`HQ&eFpW555>Uv7bi{eR9)8JD>Hl1*Hts2;v1I%|A)oYze`3{fr$mC^r z(5nTPFQ^$98*VbExGd=me!S?>7%j1Uf!zVss8(vSvk3`{P%XV%gNJ&z#>RMR5|eOZ zGA7X-DTDrwc#^d=c+Z-Jy9`Mq9O^#4+-yyoMC%QUkHzp0s7GjMtxPn~5ddiT@c8)n z<;$0E1Q>MMp~fRgLsgn-DRkG!uPdAj*FBR*Qq}HBRcY5O=z_?ms4(f$$FAe1zvhuq zF)M@@MeX9_o8!#UF(4d;=L%FV`*|pJr0clB3Y}KcCyl2$+7-(ftj|{>V^zv(_T*JZ z2frKyV=-7@cdFRzhksyl#*Slx$B!Lh{{!e}+krO*w3E~Ri_nrW8e9H8^!ltCwPX;?4&1Bsyug096Bz?~utOZNEmcYM!ROKi8RqQQM}4=xcPg6Hbq; z)#A|%i0vg*?#Ko3)fFi_KIO3oAuPepl;F;Lwon5CEOZW(^~CEP_gl8Wig3Wi0YScg z&tP-qeop(IIo?6(NW{XmMz`qN4ZU0MOiZ%jQqu53r^b_SbTK}C;T+y8pQw8q$@^X3 zHQ(a(iyMzK%N8;y*+052vO?pKUDQ+>t3@!-7SIrgc0OEdV+WGkDG_C5Wv?Bteieot z5oiCV=M!@iX5-OWwY}ive3m#EVt@Aj8|AQ=(j6JX=`?bk@U5Io{FFz7Pwduk_dFuC zPAsob3J*afnE1O2MPmlo2jBy!L)@e?s-Q$P556D0BOEb?>NXAtL8h4g5xAtpj&DA3|`t7_9uUamMN4WH0QVUi6 z_2x=5L_QquHsPYghzyU^ zzBO@E%$2Z{`D{{)u=5`AFg!EUq))*{N%0Ptx5&1DL!`GaC)3vSx$1mliG+0@!95Qf ztP$DOdgr!I{t*gq}gI9(DDAg79uu8H<&=)Lj2S zBNkK1>5iE4X*o^cA=4Lft>hq|6&Ndt)d?enCY$|BvA?eC`L@q}&8N<=MkoZ~9jJ}L z_}|9PtY1J(abBlXHr@=D3=179{0Ia*4j4Q8jjlyBA-^^2Vc4H-hwYnfkI*-C9K@cs zoz}e08>>^qcMP9ZkvYn$rF(kR*9_zcbZ&C zsJmWmK=g#_j;lXxJ0yH?aT>j`F4kKsCZ18%PF9+rn{*WWRq($II`n-C;UIkYP~Rf* zZ3lb6Y1^C?m=(j}tOtQq#hHG#wdyLQ;Uowk2Yi9GlX;*e)-3N53h{zsM^JT?+)3v@ zdb&c!5EPexqYeW+CF5M-U+4#%JqX5|-i05R`D3S)nqP80!C7vGqEf$ZJv@t#A~9a9 zP?V({eMjkGL3o%!k#0i}snR6V4u=9%V{hZt{FAh(73vyw2ueSA5^BsaR>#z){jP;w zmTtnAe$~^!u4}C?*dBTYvhDY2$VvDw)xC}5CNqH%SJL3xS>0q4P@eJIX_!{=jLoQ) z)ETQ1wi#Gwd1nyL?^^}Ykq>aA%`Ro*dNj$IQu2m;8cYp&j>q29kUQa+u*jNsu2*>& zg}$0@I52Z8v4^dx`5~zK8~O_6DNYYMMIZ3r9Dm&1?S+k4`1$$4z`$~pOBJsl10WGE zfvEG%89DxbT$^^k7{2GG!SH14B#Kkw|kB9?*m> zb^XFx)15PL?+44Px&|TQEb$;-7I`CGo`>L@tDQIs?hqb>Mkbechzgb8~Zul+BF3bc3JO-ecoDSDT4 zvml2{4p5)@BL*^sS=an6CO98;(=OhFRn<^%V*0NM+4Rp6?ypM@wDcrL8sLodV#Uxa zL2Ja*E|!O^X2C>~5qk@apRl~Ax2ad`!9VK~h5;dgEjTd6-7<8R3sQ+RJo;k{)sy)cb>&<%TWZQ6>bm+=0IQaj^@t)`0Ka0>OBs405 zLAaA~43>2b&u`J_kyUd%hbtn0v8g}}6$V{N(bE15JlmaY^~s94cYBtlr-cYYTF*b$ z3D=UYtM=?!K=&1hx#MXZ$sHc|l%C@3(vFT8REM}ncY=Qnq@>O6&C~z%L;@P zSx4}%)*y$wlh0LojEfBB7>ygMsI&!cTBMA*3M%Fu=VyJYukQVx0Z}jKpN)B^G}|~C zgLF-J#1MO>NGA+;h67wbaD8cEzyrrX))1*Q+tJItQz zvxZNAdyE6BI?tpUB||$p#!h@Ii@A!RTcF)$i>42*^^XHh;}w}ZI?4`u=!;UrrLlz# z#pnHeiM`cXAOdl?I6=?ASu*ScfJil1Bd_Sj+jc`OeX;=C0Rg#vbI4uo0F%7*YXQ!p zg8r%E(tTw(bmawnUCVCR@`YR>Mx*YgvS(d7ZO%S<9L&d{$veIOY~cFLN8&^oHEQ{n zIpy8Ao&PA$DA>Vgl#O(L+@bgI$bF!-Y0RV*pCnmzEflqql#dDA|DrU)0x6C9ss*Rw zv{_iR3zQ2oGKYLpv+M^s#Y`$&%+MBvPjom1Ck9A!jK@;u8nYbcP1e7-C#c=ZPjc?3 z;|tu^S=8AZA~RJFlIrJVqOydPB1tIwAsbVRhnpG7P0dBob5t!iv zmcpB2{C%~y;QN%av%^- zj2FU{mR`zDCyMZ(4L^ zuqt)UD1!N~15uO33ifg^?D-hI?`M>c&pAwUvzDJRq|btWgo^G0EoIB!@ta26j7G_s zr$pKq2OPfcOS_XFgT_wW2{6$m1Wja`=o+Cb^(%j>Rj zW6xx(Zgg*BNtp@zr=_G&0GPS_pfA|hw;RN)66mR}?AZA!@QFFO&X$E;9jQ*Y7TbpB z);sfX%|v{^l>EgcmKj5{trsTA4ZbKL$e3*#yNTrWp1l;}Mx#Xuw_D|u+qW~hYU2La z9IK5V-MJOhd~p5G8|OJ04_IJcll^~8Y9!aLycdW$@ULhEfxh3;+R(FS%mn#P?7U=T zZvj5_iRdV(abF54?+u+d5X?4QqHo8wr~D@*-KsV-G~X<*PUk+We8>}=UQbf~McOX& zCdzmu*KG9O0fS^aIm7F!#K#F_`?M%RYXY>cJaLQq2 zB2G-P#X#0JU<0y_VYrRP`n{3JoG|IfUmUlxb*u}2S@^Qvt!Ylc%dxepb{*KoLrGeF z_DpNV&p823yO^A);zBV!q?m9QQRo|4j*1pUz@;;~t;3)_O-F8#vH$029mbApX-{3! z0HMOIL-lX3im>VXVMbO&c?q9_gQlI+YfodD6jt~@aER8%@4{L3fnwR%kB;>rX@h}u z@s_83q8*G5TjH+EoQ>>5M*E7|82NkZ6zh1Px^_J+R?}CVKbY^=Xd=_r28^tynN|$- zb%X|__PRg^GzmY&5)&B4Bl;%nNZej<&{Y_v9vt_nNFev1HSFnY;=?=INtmxXV2J$; zD0Qqo3}ip~jEO+ln;SpBrV1P;shPaj6VL}Dgo5+VJM^wP94o^g&$wWC4x(~xUdXB< zG)~b*CrHhgqE-KneNrP0ggxCY<`a1BbXEZirW%Ie~YLb+nCs70HGZw zOLTOg9N;p#L!X#(DBvNWaFrZFMRCIcFKd$GLQslc;G(3B@M{%gDm`b*;U3OdiEdEr z4E1V~Z&t;O%qH)5W(}bg-42_wr^Sb-oR!(B=H!B~wH1;fbjuqp6L6wblqiNryeP1O zjmP|z1bLphT2(e!sLkHsLK}O{>K}JgL^ao1Dsq~TlC3o@&(7+KAj2A6fJSJ|`>p*} zv3=ITkS0t~tQ`myyx{&PRFF|oY!)jNAL6)0VlbqbL{=o6XZWp*Y>o&6j74QQe#>Ez zmPeiqYP2yl?Lv1NhS?k&`-M@VLXY!3~+*rJfWwqJuXEyomNI>}3 zn$7L{dy8G_{7k9>ao1zUWBa|vRmb)VWu5p-sig_a`A7(m6+mvG)fVLdl&`6u3O((o z0zzuIpz82HeM(4?5EfA8a6V;8@Bp$U+?&~lSN~u;gg_b!*fRL@XG6dDD>NJZilGZg zAP-`9Z6N|Cpxxtg

    iHnEHaxk&D8rY z6)wkC&l@@xUiG)M5SHvGR0f9;QXsNC(zzAaG)N3GX?twSp;~yj>HEBvEBP(hw$q5^ z*kUV=)Bn}%cneA_)_t;ZKK9q0nZtE<#_!*_^7R-?8g8zySmu4lL&6MsRCEFcM%d+| zUdq%6+8nK@&o5I|7mrY&5HCjC0L1G3=CqQqw(uE4?sbLMNq0{%cb`)py5f4mfAHH@ zT>i#yE4dpcd4b)C!41RCj<8~ZH0oT9@SuQ>+1H#9_F#OEqB~r52zK9jL@$Rv3>()G zGYH$OJ#Il1cBvu`<*o+Zx<4;va}wJ~9wz4F`mA@H4S4$-;SJN60hsVj0FtB-C}wtz zTU@>t;;qNcYhOP`|1}JUWj?t&Tl&F3A0Tsz>AY`}rd-{#b0FFHo1Vx5wdefh^RcS${msuH>hO-V; zH3NqomMd9k^VBQ;qlu-C6=Uw0JfX4#PYf@= z*$aPzYb~zW`_BN%pLynO?j`;lfc|9R%=zWB?m2}nO=!v#f*x5f1}{gvvVq&d-(esr z&8}@}DWmt!?LW6}iir8o-?+$+G8*-#xfj1$kqjQwmz)@qIBRA}S=Kh-SGXY@1-eHk zS9{I5>wsF29BA%od!6MrQ$7*$M53>VYxw}Ng)v`c4#*tN16upaZ1E7R^@`K0km)Y( ztiqU}#j3BZbUOBmkDY}^;i zoF=q7ZBA;>8(`!k_nIyQ!@QyxwC2w2_2_?R6xO*0bGYSb6G1wCCBak33(Rz?R*H#h zO3!7Q`ecQx;@dZ-S8eNQ|Kx5e6j?8Ek|%PIU{sI_?3>@#gf6c4zqRMm-S|t8Fu1%p zQ8qRS*tBIzncA$eSXUjg7D8o}mCYUSTpEu3RGec$K$yeLOLwmFUePQGbj|qVP?nY> zUTXd0Li0SiFg6p6&6#l^jw*}a%DouD0Zu@ThX~(dBk^%2IW~N#|IHfz$K1bprBWr ziw|OZ1QZ&`=}+9f{@y>&c?#C~dd09E&OR9H@)p1}4AC?BP{5U+aB*-kI+CYgkH^5B zOc;`TTxmeYq4ql?+dGR^4XLp#yFE$m`xo71puNlrFf1Mzk#0|#sCO+*qD^<27>!QO zJ6JhyFbH1@1};t~jO0*A^^sW(kSbX@Ue2**TJqpkd2nux27^P@xVrlGZeDyg51rbt zrPtlQcl%(>rboW=ef#@f2Jkrbtdv#sWUb9bQK-JobYi$8J!~NoDH{`hy8Z%rgWg>t zpC{)(FtcNL5kc);kc?=^VKs%}>Hc(=I4JUF-VG#8(=VY8p=ZmPmd44$( z0(AYxXCU7z7VEC#azwBBOULd=wjQ<|;*>}4?SFBwQZBf8|1vdQ@3}xW*mvtK?rsv3 zYi|?Hb_cS=;`d>>^Xq@=r*u3C(-VYc@doR6cIK+Dg0CW3L4+syt{x>1;YR)9CVsn= zdlc=;G<4oRH13|NfS}2Kt3r|!CX6PNRlA(|DKgpAz?>&j)=EKjZ_xZy(Kl6=Y2Z^bOcZ3C>X-NfUGB-<;x`rOJI6s_Blt>ZLmbqI524*tHApY9(*8jUTQj!&6`o5A zU?1EufH}*O(HZPsP}1DDN!Bmx5R9cx-8@qPjRw|`&%nHLKF~N5BsM1J1pR6k3UwNEf41J;&OciK$D|z1$}VSE)yXh$Cc67Z4IHJuJL*(~=|YMA zO9NzRfP>)sTc|j$(OJCww4CE`H@NkQ@Vl-^Mpk5+i4P9+CBkwTs^hfH@&G)Qjdsz7Pwo>EHY}^ zSE#=HFKk?5QR^UWDV@u|8F7@y+BCukKowoV2#`6gS`ccey-z+@4+)xEg z9fMvv^s4pCE2GtiHO^b;-X5tQ5#@0=LxYns;9Vl;kV!=iLvr0Kmr<+g-y1{3or1sG zLBYNe3aW|`4U9unyCAf+lOYjWwgzrj3>vsCk_ne*1zRVcZ(*8y%_y2as%-IV`{EUB}Z66$OeZ|6IjD6P{?*K*>@!nbE%BCv82{3 z3-Tnftvg2Fvb_MiFKkFIXK^2ID7f_j!l)zwLfQ-*vyEr^x{BX{H$5L zxBD`GXd}ox0~4^U64Y0?2Gw-l4fSCMMrMZHsnbMc{sgS3BQKH|zOl1jB%J9~537z^ zc24_j^9rBf1VmDRZZ7JpPuo-Uksqq-jv0O6_<;;6&Gq~Z>4A2~(~If;aPjwz9;XrV zdA+~rOpAG4kZ+?^80-MAfVFGfjM9|6!_$2&{R>D9JTZv%VnIS5q4L3w<^>4{-7j|E2HtTC6&sx&J>QvEmv zv&9xj1g&5K@xi^ts>4nCMPk49IKW@%bd%rcp%q7Oe#lz$%&LVSh^Z0VRz5|g zl!mQ1D~Dfd+VELjdOC@cHn)Tkhp)E$o0LBo*_>b1RynY0XVj? zTwu=q0HnX4>Mh=ybItRIFsqVPesMJCkmYd}I>07cMCyc#Fp>UNMJ5?TnMx_-6vIy^ zNeV?_%$>p))Ow_Q%I&7c1(A?NrlU10`t+#u$SlmF=pfv1AQBIYIqQ^sFEFZLInthl z##V5l{qt+YNl|H*&74vf$Qx@`C_R|eKJH{phQWaBaPP`{D&OX$%G42Xyd}d(F ziCr-r)NiK6m=a+<8{pH9_*I7gqhmgNbW8{Yypqm<++edH81$dGRbj!#hPDpOC)EAn zX0c?QYC8u9#hv-L+_0-7ixmPA=NW1n1#5-8+YlJILI5ICp;ZtX{24+USvbMNaWfu@ z-7pN$&sTHdB3LHHkQwz3eYkZ82FhA$fOGX=4V#xfJvamMxuaB)Ij1qh^S6SRj_MH`DHUx~?(<3Gqf zCxpf}J+mG7I2cibQ?z9j9`Fu?zDoi?_X$fHXPWei1bA~O?m}6)fP{UcYd6IA^kvvA zx#%yRZ(p7GV3A3!qw8%i7Gv0&jKv@6w|~zg!%qQAp4Un3SncW7VQX%_-_hJRttLj0 zz#Q8kNXLv=AafX_BMe{&p51p|o-D!j$AIrd=v|1T0;`QPYj;WeW65L>YTT}pP1vDK zl18p-TuVA9Qqr5hF3%MXcI-S(sivxlR zKFYgQj)$IBjGh_mZv6omOUUjxi9%6pGCXg~HQ#tocG*4zZ(z@!kJ?grL_x6T_G`Y} zup_QvI(D%a2xwK2S7-SZs>~nXUwfmS2V8gNovag4;Q*WuJQyS~vNKOKq_SqSWTdZp zF$Hfp9*+^aEZRV~# zwF}8}>m;0LThp?3F*VIf4M@e0Zy%T`W-nYAV9Fq$HdHedj_HI-Z32PZ&d#m&K)ubX zM={`sn`Y!TM@XqT%bi$>B=>l033W6mlJKa%wiSMEK@Bx=v$I*{RbMdk-8X|#BZmU@ zj>2h*Qxcse-Oul`dS*M87YXS(+^+m)55R)U>clhXh2z_q^f|KouKa`-@VqFcbxaJu zN?C#garoQt`)TaPc%qmMe$k`GphFe7)qrg{l#j7 z-Y={=j|bNi2alVqoqC4hGru2R)PBFez|9b>3=+S;=}epA5bYsnT^_vnL}a?N5cblh zp;PRghW{EDxqNhFnIBCHCFTV@oc02~~_c%In^%hHl6rAe$ZU(K`ZfX;c zUx@*i`$0j`5;x^DcsDwJy^hb-j?ayvJV~SaD$QA!s5MY1j=z$^c}qrw4R&Eim#i1j zQ6&$5Q`A0>$!dO)Kc#fLC`fWJjalXJ%5teS0mTi_?+B<~ootHYrcsj9w{X4JsN>;g z3vlrBSR}-W6p4cbwD%Ci7@NeGhbq<= z8OTQ^W((+ih0L~B6V<18xus4OFb=1KC9M)uNJhm@Laa$m3sDH7uCm;^*`1VdWYo%` z6EnHvMLaeap>-DhIxSIfXaPc`QKd%ORzcW&y6p^or+q_hj2=)H5ifP>#~UELVif{* zE~e@Qn@SWm|M;is(2)8i_y+{ zZr1?uB^+Ok(FBYqtVolrVf?cp92#5la-&i8s9=;qU(FA<% z?+p$+U!?OiOJb1_=b)@Ihvn0qM&$8TXMlQlKgc1w;{dv8=bcrRdC&4~1WJ+X6wKz9 zEu3-7_GmCAf;^9P>%GZuz<~Sw!F31{_y08z5HDyEMh=*A>^xeUZEbD! zTIf7>GxMRQv1Mgt_4=}SJswb->L{Hjr))D`ejTbGWM1zehs=}vLIh87HiM6^%-ww% zEynBKBc`rKklBSGa@ek5Ryr+pIJIundihlYK0{m>N3yS246-EKTgdTZP1-9{gJN^a219ft6MnRqH!Y!|drT;9k-S1t zCFj!w=2K1=I|%)xHQ806!8)r2ti;9E@zu6HXt%${lB2f{Ta>#i z`IeiMIN3tJJvM6)?+EfZCLp0+TJR$A70%fHSeXz{nE%BcaTuj}j`1#*H(8_Hp5A`s za_95J1X@D9?T9$sR5?7NeGf=Mo7e<)0CcLk-iTw+u({!Y{4giY4}FZ$P?usq+Kl#8 z?bOm5BzfO!lg^sx(poQjZmm?D=T}2pyF`X&lz_*>=jKjR-bRTNmdvo_4Bn*5chG}C zeX8*^6t`}G{_{TNbk;_{k`e)Z6u}&IY$7=x_m%~Q)IpSWDM|o=!384*x%w`%*34{4 zqZniJ6N@q@LDGhoMX#)$t{djnS6T>DjeCl@YG@1gvU-6Bg8o$U#*&#{_<1=XAZz~7 zMiw|Pn~+plQI#PiVv9Mp*vBC1Rf~o(9h;V3mi2B&41W?$azP0)(cuOwu{=haMVq6o z>wNfaPBI*gU%T95&XLt!ncYC1R!06QEhb~6lRetEiwR_R)?nHm!3;fmP#O4 zOO(`h8qXoCZlTF$5M|6@)s^ToOa7#bn<%p`&J(_JRr~dS^<9L_0TJgRD%Rt?`OW|( zHEGS?oyB**f^fy0&BBs#ZKYE#Rnj^VCkDuG9zI`p4&I;>y0?D?PUGvK0uDg}hc^KQ z#yZE~MzkyA1?eCi6YAWKf8=m$G7+cWy(l4+6XxSBGq@rLuVq#OJsWmH-pW&N=YFUvkrYy=Q=2P%qxHZq zW0J`<9BeoBFZ(x-<2I+I$$zkJ1@bN!uJ<%o#(-msUWg1o{KSmgWd(xh4s+g>#&B~y zxts|C+D!kvYUF@tQXS9;bSr|svpbeZC@_2Pmukf?mjULtr(vrn??mR>I3BtuIs%hV z{cFpHKr2o&qT7I_pv3fXVwo+!PJTMTq95;6-NC0wopuyG7uath&MJ#+2UjPArm-eR zetgs>h8!;%onw!L5Zx=99es=Nx%u)UEN~_(j+S5Erl);)*v=P&2_Z@y+ozmq6c2K@ zWke14>bDL#8L;ZSbpxur>YE7o?2p1*_&urr{PDe#Vq~8LPbwX(A9p7G=}>u1xh&Ja zkB^+Pp>(W&zz4-ⅇL3Ahnrh>1INtKufdtT7n0`be-ju4dJVHfbmpbb-OnPq`f=& zO*&#=v^Y9Ww8_CWCyrzn>AX9>x1Qe^wE3x&4&k3_4s~(%tbqtsuPEy?t}opsGcJ8O zgiQu7tu;s!s(!xa>D68*Jh!pYeiIOErTNS>l>~i$ZR3YucX1O#uA9N`p?(|$F3{Td<(?pmj5gxTG2g=e3}+A3K(wC>l-Y&G;-xp-_c#-u9G)Xg` ztOJ*lAQ4}vb}TD>H2Cvri#f1;BbQkBtFYmju3eqi&HT<|e2jeCyIcw>-iqz0#w7e4 z%<8}!JZ?~1UHUjY?IUL-R!pJAf|2MTj4Ku|;!NZ5aiklB!tyzW&m%-uolEuxPj8aL zN#)yqQe+#V>!-5lPXuBB{cr%Q!J-c&#mbM*Nmp281ry5Unv;b1E6#!J6F|4*S}P{` z*8Z=5=-iB#+{U8$2|mW5173eX-H_iA+mb>d> zZZq5nC>XsTK*Tz*h+s)fvB2?QIi<+Dp}FrjAA+($lT{Bfk8qj@bt03LqJii3PZwn9 z@awaDYU<;pg|$g-R3|5w`}!7M^2nm@?&+6pBEe|3+4Q*a%|^YBi?7W5SBGU&R(EH? z`6EbxvPZ53Cx+1qL8Hu|F~P*82EPH`$OX27B?n^}6el{|*DL8>DPH`B=)@8f|d zS9oos`SX){V*<10N={_sUF|VSOKoPE$r^E&)emK@NqM}ft@&1dTdFY>f>%{T1#wl6 z&0=JDd6qL8XKQ%`{nZe+6WPrnpqYZ+6R#xzFVMLv`m@WuQNXoFOe9<0pGBgoOlsY( z&%KJYY?olMS|MwiG5oUEOly$*)FT~Cyb(o2TMtporX$bvxfj>9 z+l8z4Z=GJr>=x}TJ1$QTOuAGzibqK)&-p2kL2Q8b`;yyj8sdfXzKXss^RQ$Cj)&Oy zKcE>qBfXZM*V~2V7gvAfWU=pf=|8-&IIK9?#+harg)qT0UIS{rchrJzI15{=``5ft zu~Wx#y&ZXAZ9L7w3y}l&8JMsi*~w70aGSQ}Uso4n@R+8*MZy1if(OiIvl%8~M-L8^ zVGhu11?dGLC}?u+wIKEcdc!O1-*ttCE&9r6A?)ZK(Y~Tx9x}4l)vZ+G<&&E+n3>qQd=@8`s|+G|HHEcJF_yK;cg*o{?#2Jk}r% zmS-0<|0t5J33p}&q&_&*#aBdOy4T&H89}WqMANFXmSMKnqW>5hUp;961ZHerc|v(o zqjh&YVhNYW3;;RF3MG?LyO&AFU*(uhIh*{{E>hL+w7{I9vK!!$%S`iJ?nf;|HJ1q$ z3)8H8XOEw-)+J9P(xZB@-$+ahTM`iVv7tt{mt4A__n6rsF-EL~aL|RKa-g~chjbKX z&ao@;4DGnLKW!6g=E?h=OhfGU5hvb=m-0S)fb}Lr^y%%9z1I#^UW|&%aj%x5M+D&( zJoZnV6qg=WmMQKH@)?+$v@?&mq%}>8CKKL7h3AUe60#8pd1lIQu48ZE2xm42Cnv$Q z=ZFULT;#2`I~C1k2cL+T+h%r#^!T}?)q8~uMZNwuI=x7ieqS%?)%ToT13sqGIorU> zvG5s#+`cKv3L>Kb!~TdI+pFzKUNFBipF(wS`-2CC;EuT-Gfy_=LZxC^i7H2}7JE|v zfPfm;D?@{CID?QWS9=KwXa+6LR(ln04N7Y<$8Qn@&K4wWr?R~>C{B~P7Gj=?D%zQN zd=U8<=L10pds78MU;JAe1pZkN`hUjh zWjy0ZqFWDvJk^0L4)!FGfIuNm+HwuX)pUUt4jI_HdbWqd0GI0{&@nQ=;yj>AhPPN$ zN2~S~B$^vn4a(I&FfXN`p`#Y*C!z#h;<_gj?f3Udl;rf$9+XyOI@O7QAG{#;DU?H+ z?I(14%B;pdTiAl>6^rW4)4{xK_e4!PKmD`9_AM@bN}cK6qMY^kwnAP#4)IAHClt8E z07FS5-<^k)Ff=vU);f9lr^Hjp5#u^?Am7XAI~(U(TX$6&>9pZPD85?55;v$3=D_Cl ziDJnL6%q(Mew?!>WzuQK#JZ!e5s4jh$M@5N`3a&&=QVSl>dMc0Nn(GF(FX3KP;27! zzP8oc#!)TR3pp?xrr&X78HS|+=Psw-K^0wM?>;oRckk@Whz6V}i#)V08Ba#`M+>Qd zN?LiPN0ydF)<0xmQij&OMb=td%%6`j2G3rl81K{Je`i3FTj7#L>xQT7{;@@muHekb z*6W_bFyK{>Y2=>xf)Cdz_Ga$M}z^GyxmxOCY`AAVao|!!=R3!~(R7KfzQzn0ms9RZp7cCPHd> zm|c%-nx&Ss%sRGp4fM^HRg8(h;*acobTYjJp6HwS*>Dj`e#YZ3Y=4${OI8k*gWcUvUjLf=6&Z z(I}`Fn*X{}kNn|Lp#L5&(`7V3UFQ-ZP5n z6Wj2TuknI``Qm+)^7#mhu-+(g7;|FFM#otD=Z;37l0L!#FBMjNn$W^8j6R4?HeCMhl$W;Q0XxHlj!(=8&%%4FwL`j zw+KVMDC$Rqo>TLIF`&)@F2o3Q_Q7tv4hafewS)l^PZ3rYrfHJlunm@IZ^1L7UZ}5^##dE4iUO zhPm?Od=4J%xvmyT;j{nr?43QcLeNRl!l#siT<5d9r7<$9Hm-q>Rr@I(v@Cx!v2SsJ zpL(0ZdSzBPnG*IgF*kM1UQ+8Npvr~NzkkCiDE&?bFKY9k0TL5dMW8HKiJ>u0l+yXw z_d+!Y=mn;R=I*K}9`YM>;Ej}yJ7@#T@n&=`v?p4}8h1Jc>qkMOjC{P;H^p5uxYU8| z`xpm?tr6Wv$-N7eivaEH|3lVWM#c3ldBX&PyE}vspmBE#p5X58?ykWdLU6a>?(Xiv zEzr1Iqm4iPzccT=bMJiX)$6S8wa+=bcGXX+XeT3@#j43=;>wb41_echkbv&c@#A3Q zqqDLj+sRbC)w^u3W9#snzJq*9-|eJ?2*AGAs#pH{o)yAesVZ)4*jD(W%4|^%slGnW z?uPvoT+i&LJh7hpBsX;!(GWJH=K8|U80*W5MV2Efo*Z%L2S1Ag@WJ@yuuj?sS)KL1 z-_AF0liKFWue25VF$4A#?>1g%Z9gnV6+1rE3aoVx><#;y{@mbV0X|4lX@Qh9)~BGH zu+mdXm9Gj2N(z|@@?>O|?hz!_HTmNAgQ5Qv@8X;#Em=CBJWy$OLk3mvnZ$GNO#J1x z|I5?b9+gf1$Y4=?wAKWv_g;RcrA4H(TS(h9=`>jyX9_2Nj}`C8u?8qaoD0#4e7(Cv!IM z$$~Z}$R$e33=4iz1q}!`yl@M9UqW6El^_7aPZF=21J3Jx_6xGacyeKJf8^cvyq;;# z$j=f{-(|>uwp?`}Z?=_Na1!37(T;q6cv$7#2)}h1Qm)xv$PJ(fXoxFynTP;lnj!Ui z=)mXSziuGB8Ds7gH94L{7flFB73uVtm;#I19kTKag?s!l%5&clMJOrKT)54I z;l>nTKo725-@2aA-(Kj+Gu+C9b*NvaM7Oy=R7m;kK5n)V2)U4xeLv-ld^Y=THVIU1 z%t?ig9cCQyB)1uSTfyD^j8gJj?2uP;Y2<@~imj2wLr&8>AZHZoO7A0_&*n%qt6v?U z0g9&pSYHJ0oRfPIGKNYyLV+#^F9<1_84HZDmIVYK05>!r*96)>kX<54 z=7x@6L@8&vN{eesxljH6ytUv!o8s=;`{)Ka;m;)+h6pZaD_H8RJ_vY@jnCW=$esv| zoUyNUpy|ZHzEN?GH$qR*RP`UhrSRPKpn=Wlb@qF!2To>`xYRl0=vsVeg}W^$EFAJH zyKvh!TS7ffa!?FLN0F&XqR;p!rJh+#cs)piaFJh)N>XT&-ArIKb6!52_pDM^aZ-{# zHa-51tz-~Ta?tsHxbG^2lC9~B8Lt#YS%h6@fA;akxz838#voMg>--BkXl@#B#-&VP z43hq0irvkn%s6*dc9GVvL-Cr4+fF^!jmFFHu7xkPhbP~tt6*>yFp<3qVZGwzrY@b( zbab<`pR+FJB!{YjJ8cKFEjpRLvRc_OiU@q~|xblL<_aG`RTHJ`{MijgR8aUxSCdmyju$ zMf=Pu>rRw*?o%jk?>jl`fr^i!*9P_Ge&V!NHUiCXb`bPzeNHS$!e=!7-u+`>-iKjn z?V$DC_ym}qpmK40U$1?H;VZQcoy(L$WW) zfcrl1D1Vmm87-vwCOby2W7)WJT<^@T)7xn2gmGoM}K!A~!TFPEnNdTGJ^z8K<87K!a48;gqW9e3RlH@s&3R z*+C2Q8t-~*F74!)J^Ji*bk3QzxuiPFCf~nJRBG|Zd<&+B_a9!!(fd>MF8)H0i$prc z^d|)${;{;USP&XAij>0(p8AA@=ktLCNK&o&D!X4;rc3u|p_GWO_C}hoQE9((&e8Ht z|4Sd1+Ue8xQ_pbH`?j?U#VUl}t54jW0`+hKf0LKG@Bulca{<+xr6&L!sFxyjsOl}( zYq9&vuSO8*f3xRj*M+q>(jIwHn{IG!1P$CAd+HA2I<5DNc4!3Y%Zj_P&mLU}nsxE7 z92^B_^dW3DxEaopbL_;O$iLSUEy%-Ii?>R=4j{g7+-p@!Dy`J%%YD;uOP(zWc#6nM{VXuvjv~$;$BTXKV|eeSM~cL!1>yS@137wJm_kdh{y|ZG%CzU@2|Y4 zVpJ^AbE5i88<@9ir;lj803iV1%8{cNy+MuY*+!#ZJ5=+!r>aSHYUx}(5AJa0tR76kQHY_m?Q_F_>aJc`?0EZI z?3Y~_3Vh=>7Oyolk3N-h+BC6g5dS61K71RVGopn9bmUq4mw+lG>d$D8$rszR_s5Tr zTc>jvamObo#$u9@EWqImN;0|o*nIt3NQ_Twuj}{4xs~J#nvRZzKbcU+uRE{*yf!Ii{mm7w{g!ef zPJ4Mcv9Z2&x7*Bmm9uE41+5mr0b#EYn*k-Kvy#^X0_vAWnCcfbxfAr zD4PU|3Iw2=pY5PDeemQ}v)i??!LD#{9x)>ywxTF0DB)PVFb2uFQYj+j}o7(z;$F<$3%F(3^)Jr!G$eHcc^=f9<{c z+S(%!#2L`JzN!N}F>G|+_uOL9gV6EYM}Rlz{k^fo{sxkRHDQX7pB~331^xYy0M%C# zlFYR@lK(;Il9xo~l^%w$#c45u6+Z;ynxfSW%+1KEx=$eotjQ(Tz9snq66{hUDQoot zZTPqS^D8Gym@mbQIp#upaw7@|6yyR?sSq}SO{?GQn~ST#3X-6#cjMq;*O}|ftP8%V zR9t`QkW}w;z5q}C$3jW@VQZ_sh62baHo4;8Il{jVv?@)Rz$(t>wCp9 z@xgzL@NybUcs{%HBhi|ilPl6a+SkMyT2*;ci3P%JN)MmYRI1|BM^2i~Ne3R7bQHM1 zHAK8P#lHozNsh%EQJy=31E`!9eutA5Jo$h0IaXOz5>R6EtsY_N@Udx}b3VK(2o=J5 zXG%>6a_l1NB!b`^l0NJQ$J4OQvE%O`;-Ip+gTA;rwG0kfHY+p(kD^mb=loIdLOF1D zR|2?l7Jlr;*jZxN!Q07szXTpo2P2mi zE_;Bh(qC$UCoH74#>vhcQNCE+AWCCVBgFOGC2s{_9pFanyubDO(A-E^$+iKhTa3l6 z(R>gPM%~4qx3Ji?GTFTDc1=-P0c$w|DrzW#fe2{TKT_LSVdjnq zPk%3m_ib#l6Eb*;GN?N!#kl66JY+m zIfCm1o55WXS#Vs*)Rg<%V=Jyc=JeG*e{TUlSSMv5_|+y45>+R{!;FiS?7p?JE&!Y~ z1+~}%CTy2SRi%|sGXIj)&1?)xar(sUl$3|Qas5a_&rIpv7%&#vb6T%jcV!?uptdXg z+WV2wtI1wtQnP=e^vyknu4`lmCxWmcJWt}$0_?*-6P&=~-2t$6&x|O`=Ilnn^iN~!@BubnIJ;~&RK z4(fx6*nG*=wjV`p-Wz3IU3NjzyI1Wu(w!H^JB8;M*@Y6f%^!X{uPxj&p*g55;o2YF zZ-}C(sjoyq$r`SMQ@#%&8fBjIfJX7$l9yE!)S1s zQQrLYh+?0n`#;|MNz?FJ6`0n(Em-=noYW1c0jo?8H;WLnoKWFEKYX_#Agt54^dMk# zZYQ6<@<5}U`+D&pNeDFB8y_?d(jU^*FIr({WBf<|Bz%cciGJi17y%F4=)S6d?6O(ex*Y!q3`mN{d`27#%7PgG<# zuX=u8UMl(gMs~vSa@0NDtr?%f8L;3jnNfygN;7K#YUqr~i38vC2dls48oAVF*|qpC zA;hdZk{#2HWMy}{B%dx7I~^?)!-Tzg>gzhWVm>t@eoeJ{;@{x8JB4yM<;dFXP_r0; zk_f*5x4QD}c)Y|^5^uH-^h8qX>%|UdiLi&<;Kd0uq-3`cXEb5*vkJ7Ar*}uT{x(qz zqkR_X$|u;fiHG+&+@3((xziT%!$~3i9@^i4`b6iTR}q@U@n@PWFi=kEWKpY}x1MF1w3vVQtH8SRmK6X)V^B@kMqW3JEf z38G%BrIDeJoeumq1%96U#TP|W zplhGI$CES4*faH~P|OXWY|P?fxa1y8eKss7;ns+Dn^G-C*8x2_q57{FU8Pg^E)SsJ^dYhXJG#dEuDB3(G<$Mbln20WY)6&#}U-I9Be>Bb#X28h_ULthBlao9^cVt3H^ z21bh7YK24w9~wDCg^sgY&|K;^G?Xo&VTW^s>a7uq+bt~?|G^S#oK*)xN` zu&o`{SI5Srl|?sSe!n&@O@NR$R@M3*)(#Gbe>1Puz%{h88m(BHN0v25_Ao1ymZtcs z69HtzqLPNqit>*hao@h=lVo@#ODnBYmyU@Irzp{xJ<^c)^p9I^C~TM2oae8!z#J_VZfFwR^9z{OX0}##{rV6u zLn-KwuUn$ub{Zu&!XOU-Uk5)xg8mxBYW7=WcsF=fyU{X%my(D)q8Y-n6$;HKy<&?Z zJodf_l6Pr0OIC2{T`fjw7QTNIgTN2#F@^znGOzr3m$w_Ev#7)WzZQ2h)O$*C0Ik)Z z13FyQUnC2UG+O5P>#B54|8*>Ue8LBMo~7&Y_C(+7c!HIB&b63ThANgtF4>bg!t9>S z%KMHJF#k(;xrAa2X-WBn)A~ZQjJ^*7K3jbpFLC-|MkYAhzQnyW0v|+NYgthZ99^fp zGV#zXhKQLEnv#0!nYEs74Sp{f@tqI*37F4F*e%)*Fa}#agYL@^`E>_oBL?V}DNrHO z=MdMV;Of1kR5-qG>^Mcat2LYX^o-CpsrJ3aVq?Z{jSYdEKGF)h@k(7qaU`7$b$uT` zu#v{#U&|Ir>ap?nxNudyD1{%+-&(Zux6!L{+hq#pv|c@!MnK1_Q&&CM0ALoVx1B@w|fTCt2B9>xQ=?vCEh7}4Fz8*!z-mYKTZ;Nvxo7|syTYbv9E zy$l#OTCd{uW&Xx3j>?MZmCpuEQ7`(s!FiC^)7VU*HK9Abtw5%HrG|;kmN>$v01VWg z^L~5G!7cY%=sea3;$FP8LCdhQ7jP9;#UkloeY^CG#&+&=ZPeBkG#o!|QyU&fl=nmB@_P<4huh)$ zX7Li+6S>Qs^&1c4r@gl{j*EjP!tz{7K4_Nmt$aD>yFgB^8kR#O)9qzljQVuWGQnPX zF(zOx=RCtHqX@`_O8!RS?RaBl+0**x`^H!NO{9WUKbmi@g+z~3Q zqYlbmA1<>r*hWOFzxP#tsTX6-?+YM1l{81aM_wZNN!jr-ZdEwZ!NnV!&S%nHNg%xd z@KstK`n8A~u!FxiZ8!%1vv)kKsE|H{=y_T!f@0T%$096dBWrD%e4u6 zpY8hjZJ)|!d+vbM+G=+U_GlPVeD<`r2 zIR7c~D>Q1PYnDFqb++j-z22y@*5rr6Ab^qes%i{sCHnUC+`-`GxPY;c`YT=_>A1vr=be|0)Z$Mf|-*xHH6@n!>0F=GU3{JlA$g&p1?}?xdPa@VYLSFrGDmf z20f*2k}N!*zE(FP*scZ;6BfO)9EUrw=29+t;>0Ekfy)^P?WIqOso;qerllX8lOvCX9JM$jAH&(Z-Qp|4>B zbPkFFUK4;EQ~qV$!WM=xK+oKdsRf+3bQYxUF)kz9IRG@?Za@zOk+22KCq@1?%1HIhoaYs2m!??UHiX+5$C_Br^ae9 z%f4EXes%}Mo3Z&W(&=o-Z*E}@;H`;;{dJitn3US?klz|Ul?MCnsD32$$&HeII^n;s z?$b<90sJMSm_=^2OEANs*-Mkzx5k1N z%Q~bn#d{|iH=rNBUswBr;bSxQCzDx5D6zO{($FC4R@l5X$Z}L2@x2o=;})bdyB9 zNQGd^ouJ!pF9Lz(zgsvFkI3HrRJ$lka%qL`B|2_Mu9o|u1;-YcT}lla3D8p`%tL!$ zxjTi3BPD>+#|>ZvPjZjlG#g=VCs`fs`jLzIIcn+p`A^*6VW5%dOg(yM_aSyzO`^mY zjiS>+v1NJ7^NhInOyWQp*dOpMZhvK${+E4dnSp`YEA*81Ad<$)gYBy3c1;sUVTDph zz)4)u65!o#`spq8dzzi}2e9F8BrJp;>5SEOp1SQ#JWaor;HC?6wMiEdX45F z2D`lt{Rp{dZpP8nC?EvEW9^VV2emKld|9#FN%;0Afonm6sP$%6Ds;$<7h>42fhh92 zeF)V@TSL3OYEUl?J5dat*LLJ@1$>FC^@nju;R>TWpvN#xSUmZ1ry`5S`kjt?Zh6?s zed9#@t}UfNQZ?hHg>t9hwp*(+lZ%Hu;(ma;8{lMte&E+2V)yfYJu=z; z2w1}_EzBPj`Z^rhkbF%z0~gzOZ*y1LgKFiB;wQx=SeVzFB^ zZzd{GyOH#w4XEMM?DBH^FLhoVr14vOgrY}7v45x4eUzHiS{>)npfdVYtoR@+4xCN+ zrrw%A@zsb)gz~uNa#Ole)wS1fDNgCXePxy9zLL5B%U5>A7X{cdA|gSEdX0#eLR~; zLmyB5`}W+O*B#)-V{IKuNF4xjF%`o5zur4=CBjp#=rZC$N@G{eQ`s%fIG6o5#~?yC zLs#F0z!^hcvkj}?nrc!N)qxP!=;L(NBVqt(b@yT;BE=Zc~H|S8rAp=|eRUiKEX{tfCeOWfU^71Mqo^hR42cMau z51%VO1fY$-3K0gr>zq0Me#EeEsQgN6p`q%=6f{y&SZBT@j&l4;*ghi=0l$PhTdYF! zhFDxNk13>v1lgw0ADRD#!5m^a#R)5$xqnkr4H9#@_kAe8?@*ZFTh`69jHsJ$&nKET z-hfQQI6V#A-h_Xa5Mp>TJ=8{ zw*~1ngncg6)A=XeJooVpYYKK z^9fBf;8rv=L`!L5B}r_tJegv$`Ytz?Mu~?%kGw#%dnmV9Kr$e*)IlQ%xbPQ%qrfrE ziBG^F!!~i5+#y<`E<-;h-#m9mTNA(+L4+&a@LsbWBpH6br}Dkh7B|#Ju4Ca2oY5lUCenTUbpab^Lb)u^KmztNnux0{d~w z7c}j+JLxCIM+hu|Tcp@lPEUvL6*E6;lqTqp&}|8XX+RSQaf1zTJz?+-8T$|Spz{D( z{C->=WUwmLs>*oP7bmUYN*6UYo$N6lv#CaQh`nwVz6nxSYuE!V-sugCc%jAHg`UJD zQ4uJ1pJ30F*57fnq>W+gEY%jU;XaRS(~&Fc{UuB06bmC|E@P$$LD2#-^5v_j==2tl zyd0V@wv4Zuo%zx<>^Bii+|!?~5#X|;wovR3|LHvVTi9`w?np{;DCdJB=!2ceaZ?~N z)|xw>gCrz%ZEm+Loq;MDvCW`Re=CU5hA=OM_Em8UU@JTM!|oOBNLvcblGyaxC=}Je z*6y{3QW^QC6Gcet$<&~9aXxx8CuoUI$TqX+!D2p>6Uxk4kp>}_8&GVtrdN;B9Uv2= zuZ@eG+-$ixvz1bsQpvAweySt>%hIM^Sa*R7SYS9MV(viwo85y#0_a6`Irop zO!csfiAslqG=d_?fFFvJc&lRn`R<`Yrt(wRnc9X!I+s@C+7BU>?iGp4qC@_SVyb|4 zfmm(gg9f_cY5y_7Vh??gq`kPYB;vwzXJ#dvY3bili<1XGSUP?jlbIGLwe=X4`Z;m` zSK3@wNG2}^WPiRd|&2Kics=cD%!YYYw=$-l>q~VG8{0JIX zXd#KW87?Q9-|YJTtFyNRA}xFHMz_S>Ig7YpwyO z--=g95-d5o5sJ&1#Z095?|cqlZ`U8*&RpUTn^W~mgz0eJMWh35dnlSd{y}Kv+0zg( z@V~uY7Y|3QUy7mK@75{4n(>F{6_?tV(Zr|qmr(`rw-)x^32OGJX_ssdCy;7iI{Thc z2WVtS^z9KkZhpEqheJ!hZoMH|?f5hL6%;ZXLxbdbn;AMw4P4E7{IMH(cFSQQV1#+* z*^g_g=~K|={Z-^9!9|OV^g}>5@ZD9QE$a403bc?UHRolW+u3rCoxcC@$4b|9#Gp(G zzg4EJ)A&`lnSMpo#=2b~)dqr+P(H$Yz|m1}ZAu%S>o|yFTIENVb@2NF8I|lkvyXDEo7V zL&JKekHO#loW+Rq4bkEn+B%q5-1pSnyskp*m=ws~;I|5H@V44%w12YDNF=03hd2*+ z|I>Lmx1P)ei|)nCs4gwI*^9}U9aSgbNvsjNIx>fW{lLt|pbPpgy!h%_sMqEE^@NvX zKl{|ouVst9$9fp~9!#lp#KSa=L^*Bv<#cT{F8zA#r?ZKrzAFtSOh6aQIc931^rt&?Dv0N}(a;P? zWsc4wgm$sl|DQ1tvM8g>z`C6y8G(R`XnKCy4_(1PT@$DRW@~~86>@)qP&97wY>r(}ob-Yvzj zEz&wDxM~(7>X}X)N^QGbZLsKf-+U)WHT^DVy8{jbM5>QZ3Ts=I5$H&Jj z2`@KTDEQvaO7$ByXY+eVUv`rE_Kc1Yp}q8JAk3WMzK`ffSAZK%p8E@~a$6&>a@TC) zdb}Z$y>%%HC#@#|J(RBh%zv)Sxh3DL4u_%-M^g>X6}sU-J%U==Q2{a8r;x-3-Ihn#_(Q%p0XP@BTSbp;WONQ|P7&L3cAcLag&4Jj-R@ zBU@b!FIMPAWXPgUljckyx?n>!WQI5n4)%U0Ueo>UBKT@x1{+iJ4X&AFr;C;ZljG3m zW1IHYNdh2i!T^iH}Kn|*IwZ15j?P_*(aT2@X z+c&hh3{{5-H~QM(436k}X1EbZw>_-x*L`ktM0`B;g=Y3(=BUv?Yo^NHR_}p*iaSFi z=l1F3X(KMVBuSKk2(^N74$kK_C5cyBXH6RL| z^I;75Jm(vCf2@3VhkNt=VwX25+#1uRgGLFmhBh`aX%Litb`6#qs{r?G@oIW}r=#>D z9m3WE4boatcVC_$MOOq+(Dgwta$NUF;etBZAYy~REJq{BX*jB6+|4A$yiYLkH1%`y zYm=Z5i6r(1rHftjQeZ2Ub#kMql?FP;DIbzvSJWpnAbQ&4h+1cX=dWi7Tx+%v-@i2eA%$w9_rx8#I_K9clVAXBsI?zbO@`Z_PRZ|@sZOErGZopV`AHI3#&{R~ z!lDxQNKD-fm#KB4v!A)n+IvJ9qD!i1YzJTJri@&?;pP8g#)+TSy(H^rSGk0`kQ%5m z>Y=Eu+&w!VS(GZpNX2wSyiy@`evELFq`+~ujlm<^0bTjdS9CLOemU=bkWoPN(k9el zGl|t&->Si6u@gLqtBi;CDRj)p?K$uuk`Rl@e#gy7@{Vbk4Nus~d*gjEa*(Y|itBNL zG2kduM4_TxEcF>^59AR!W)o3ttZ-1BW|4U}2kf%WMui-dCbt=WOp zie^5J$tBs9Hk8cf<91>>Da2x^vy&F>OUG6k`)X@zP-CKh?SnF!hzipyf>{a^!edm4Zm+keN8i1{pR#=-;t-=`k znF>LrnG4ik%>nUdG(+S0k}{iklTn<;q-I;X%(`L}DIQ%m+^UiB443y0Vnsn7m<_&M zaR@_-4RZOTcw#tgryY=4fzip=Yo~l`+X~b9U+97}Uzg zMhtqJV!2NiYyvZspWMlp$n238f$RiKJpn@#4uuo#TntqxBeHF*!t(AYoZ{@cR{k1F z`p`!F^mlGvnay0iymi%(W%3n@fhHN%sNfOb;WTmsM6m+;P zVzAsf8a?8t)<^=pZHUMZGKJNRjikx~d&!v{)vtAXhhyOWb6WSoFVf4>>#VuSt8uAo zhmSJ7=extDlkw}(hsP<7OfMg$G-i4)`|$~;PU#nOz32CMcAAo4tL`kCfhE?%M2~j` zf0BX)gCtRYctlRD-07t)bgQI(roVSy>luicY$Epp^2W%(P;CH-_lGsSKnb&J?ulbn zu-?tqkltl5ET*3Dp2@B8N2|NF+M@xVn_6%7h_D*>Yv$xan^3C@(huE>An)Kx<-E;%?D2$^3a}()&8P#cAo5SKm+Uu#rHu{Xhw0QKoYDI86Dws>nFdpaSW}QJ++vWQS)Q2xL7QIdW zjH(_ruq|^|Jau;f`*v_aw1?Jqby0#bIyLFYub9`7i~LIBcQ03XI_`wfBVP8UYfG}BSQzHh9KL%Rz!pE% zbqR2-(uS(bEHbZ4^RF7a8;)r27~>vOZVhbJv}RCZ!g4xrI_?BId;R!IMjKh!p&#Ayy_>)|-#FyWN|B^$tb~*-zio!GQ*1Ka?Zc#zQkc2U2SU+>az?)^+>Bu3DLNj_AOnt0BE#-Z3!B6F z>F{KRRt*lfGK-|x`JI#m#>^n%;TFGNyPnRQ5!XIY0m1-S?o02|k%@?CL7C-XO;$U+ zW>fc13$qC~(@x^KW8u;lYDxoz)rx3(XE)my!aA%D{cNSG=dCU~?~YssZl2!J=V4K>_N`YbeQiC%YrNF zWk?ShP1|GZ8n|{py^YXq45rk+E5I}k*;j#dJDDyQ4I3xMMjfld*A_RFCc04O-ZrBO zx%V4oa(85tTID#InK`!BuR6WC@p}A(5sgxlte$Zq%c!>YwP5U z?H+fmIYC2rNNy$PCC6SI2kT{lh4BW;mjhc$@aa>1JNS9p?U9NdUbxw-$6xIeVwZLy zW19AcWZUdUPbCKxyBbji=9}gDE+4E|GM2cY;@3O0-b&BnPB;ZaY}7XDSjdJzt~yba z=wJo?5zOvb7rBL7({mJm!6MI>o5r>k$~dFBS@&9r>>nwP^!?X^IhI)o)xpgsZI0H= z6Z4CT9qMYWb!kd<3&>yWa$>tux*a`yBZ+&?hmSSJy#vVAZGB*8mZmgOTmrL)1P2|m z0v*(IXC~)Y*MjP&)#y^Wl9f2wg;D~C1j)#IAUrm`uwH|lQ6}R*0%)d*=w#n7j?~Mw(3_xB2*c&KKdZlhjw=#+Jg6^UaDr%e8f=&T6n&MAM>T1Ktez;+Ewd zf|I~T3P~UVTO7hV&vIqtS|!Qiuj`Ycqg+GwK%+SxgG&uz+vzblI(>nZktYXI6i zzMFcx{#x8)$fSGc3L1kG7xV-ZPw(Y!Sn27-$J4{qy36n}@CEuN%T~RCftFQ4Z1WTQ z`lSk|Ni62w=XZgJZg9Dd8V=Y3yVzb0ZB6AtT>Wfc=LC#4knSXW@bdc0TWkKcOUd3h znV8(IX~Wb?h=ARPBec*?C~#Nt@Gj-&|5dB!^v{wzYm`-h57saTV$Eg&uggL2 z^t8OEpw--$;NZa|_Cj7hKBR^USa^8knWrne64~_6od>xy4>!$PT3RO!fR7;*>!e!WR9;k zV`#nO?l0Jrz!Mz}pQ(~iSaAA@*XZdDLVt1BwBu8UT%Q6_tyjW8mO{%U3E_Hg%|bAY zfAa1|LT})|h1r|M8|sf(tx#5Rwmdkq5G^;^Xn-Fd5o;cy8iu0riAjD^!;?pF*{-k{ zZ4tG&ovMpVN+Q(&xrkyU|KmByN(9d$P+TH!9ycU-h&9@tMWn)8Qkvsq%zvPN5FKbhpiZ>>(Vtd^YXjksMH{Ov1d1<*fSmuiaIdFWHkb>+ zdLQnz1TjLlj#Xg>Yi2~cD=~exwLcWO&;i(eb$gq%1O<;yChqCUlOyOuUBwy`AP*6r z5^>uzRAIswROzv+C|$L%DEB`-$!RJp_5 z&gc_yKy!WluO(=m7JI)#_5!CiK7!aT-)ssr$$4J|;{WpyuKf%8EdTA_5hwwYE5VJ({zpZw=BCtkX0jfPP_FUWDbIJVJ1r^_q+1A5Y8%)T5F?x zrgxtv{}6sedJI`Z+;@7Q$%VnE+f4OZJ}!J1JYT58#OQw-A+?BX0t_0V*qEdYSMqWp zL?#()P2QjEBdv3We(g9BbthNxil22ytA7xO7#M#hyy1A%kPjXpLRxm_G$M}a>Vto;`gZ%4%|9gi=*(Qz$+}a*dL_RaGi%^5JwMNf4f9rbt{@RzQ&-u; zZ*TvG1hj2utfJDUB`SFLfZ4uO#!A6caCFtTkc~^(q&&&uGkgJmU7$Dk2+Q^+G5Ci< z(>^87CVmQn6@4;8&H}3UkR(M$UiUdzumcrHeZ(D*(AsdfC8Cv#>2-aZG*BK z{HLI>&t;bXGwF_Nd+Yp=lO_t`Ts+}Yz z!yusHllAyO84W%CCdOK?1H+RH2!S5``ZQolqTc}(9nceTwz>wl_yUc&@Mxm>whBu@ z4J*@q`E~^CCexK}V7pVCxSQ8gBZMWb;4SmvsSHC)7Zaf&?BCmWJkb$ zMDs=3X0bE5eS6?n$?oq}xWYE0qw(}BW*Z7hu0t}34nj@tR=Dcw%Xmzq%MnA4fk#S= z8;=KZP9qyqto}dN3vgBnl~HiyEkEL4sl>^~vK!ftrk!kc$m4)$=J(Aw z{E{=Ik$i+FRus>Cd&QHkzCTvdfOYSl0@e7glG)yJpt@(|vuM6(nz`bGy|p4?zK(-| z*&;vCMzQ9ge*47IHCq1!YoigOfM5f>&bvUMjDk$QdGPQRXtdXW0i^o8Pe+8>_iGhq zcC-$P>o3Y5KksP@e~YrM1$m>tpT7Nt~a64liS_*t-Vzn>-}#&T}A}LHJ3h~c~@1G zD|I(4(}GN8Mfz)Pe4&mM2;Q{_brl(1yaeSB8ehx$ z%7CUZr3TOf76frqZHH<*xhr599`_OH{Uo2u^<0N5>UTfgX*}fB-DWB}4Z5(sG>H{A z>HREJ>sb8(;=J2rI|8l)c#FHu+Q(XIVDjO(BakK1(m?t6}2Ps`fofb z`}0yps|l+ACA+ucm!Bo+qkK`i00~W=EWyHv9vJej>o0xb_2zLU3tLJit6!n38bz)4 zy9%ul)Cb*=P?348{I}ahd!^8d-|V7Eszt#@EP*UK_c?ap^Wr(q;w;}Eoi!#Jq&%pa z54pnOCsd!VJ1d-T+`UX3(H%64|4t--DD#S%Wb-<`a_DcGzUR>*D3XEZMwjScd1PrC z>WB2#GWtM3ph+5)Ih!_TQ9$6(k4M4t1?xK@Qft5(=D6*-;E|2*VmF>G*=z9VRKRXv zqfklK|10dSqoP{dJ^-soNOud8N_Tf7-Q7qx2+}AmDcuc%!~oLWH6Td0GzbjRL&LYx zbKY}~=Y7}5U(8yp&CH%1&-3j2x__5J+2w^)!{tOl*(9Y3TV^}c6!las<@q(=n58`o znpm8ckyqx9Jk0>KP-?L4-|_U^f)J{)6O1M;c%)Nb;k|nD7+6hislzzP}nW3~gSVZ0|!c!J^MaMyuOqkGX) zE_0E)|A5Pi52onXvGkwe>7S#Hqk4Wm{Jk!UNPO=RY8tPmM=XA40EJ&g;;VhN#YfQO zR^FqP@Q|C+poQ7y6xViZ{)Xh;K|zP*24xG4^1S&OClC)2y;4RTbk;03_1Tqgw2IKM zI4aXS?W^#LfNOA64=@fWG`R>yfP8hKf0UMp-}G95+z&6>Voh;v^i$Z%@KW&b>Ez;I zC|@j$VF3pa{GLVjb#PUl?$794TMpG{ z+#u(!m^w&<(C_?bT#&g+Y?wfWRzS5|KFLq-G9=t~=e;2F(#UpXaY8BlRU(RB8IaYd zU>mJhP$?8s%g^24C+Vrl52b0Xh14*37arK`1^~fSTaR%@; zr<%P*Vd}HqWwrtc(43;u(G*b;kLK=hR>kcGbI4iJz=GQV+@Qe|p46L=MjsrNvNgGa zpw36aa1lOete24BNA;uYa>aC>Zl>}Fd#3Czt5x?Xq%wFUz8iWdi_nOs>mSK)UbIf9 z-DeDp6vq=w5-3i&UpQO$fa}l$66Pm@6HYQ?b3BE8Qzk&#SJaR#rqy=I$;|6uP+_K4 zQ2_L&zbqPMg6>pL*`R;Q@6$+pJaNb?!MUN&%vX;`6JUf)tw$KYkNJ`NMkq=IR~r!B zoIadJ7SK@>pR3F|*qaNt-p=YduLl3mwgvGX8nV}M%3SL&dFP&qbjJ28>4uNvJrCj) z%M-+y6Qaj)d9KiU1+~D1eH0Aed9#60dO>j|Tu}Gz7JCPpkvziWs4$;JxR(Uk6)1UuDoL+(>U#7 zn{P>c5wCsPZM@se@_h<~C;4SAlnBU}pToBfUhw;Z|?=VsE_l}-NYEZ z#~y0B_oH~wb{tQIb_D4T%gg+>|8aIp8wdxC9_2T4n=rs+o!#OQ6&iG#W0BJF7UX<5 z`LyFk_ImwAgpRj(ve|k^3>7|yGpj}x?vgq?Vs9>uz7p(Vs6pGqm3f6_WdcKFLuQzV zVAS9rV$9KYYZ~8U>%UwI)N2(X>O>;+yxGGJ)#XU>*?b|6@MfazEkbMCMN=TDIzYaF z`s@2fMK(E(&d8jHH{z9OrOV-DvUV3{r*0zN^wl2b^d2XidRH6?^Wq;B!=|?{6ONJk_Ur-G1&S;b=8oju0IxqN4L; z0>TN`rN;Z+;#G48(Z+x?0fBqZ)cYu7x3ekBNgq_N0+3}+^h_;Kt_1dT{MB?S_nPgx zC1a~hnz%(je$RpYqnpM{zU?`y&5obq97D*H#espxIjf~Lnj+jIRoY{Bg)P6TaMdkg z_D-7^aD)QAT|)#`kkQ^jpb)y8TtKN{{N&>X{?dRpLu9)DM`I}SAJE%lAZn|_3PEL8 z4x4OrL=IVbOb%j6Pr0vAoizJ3A#~vaIAkNDDH4CcKlL7S0=0P4*;8CYO{}X*{ zyxs&ME~JeYVL_umCHQL%war8G9VJ7xem|TLa!#Z1VO4kiCX{B6eGiVy-G>)uDo7IW z)y2BlR+U~AB4)HqU4TKRpOD=3U7zX$gmj+E*MI_%Xzf{N4#Y}H+1|yH(735zEdtae z3BDWE3mRRgcIH{~-nQ69575HA?G%M4vl&W_u_^#pQifF(o)i+o5ZY6%L9yCDYrV9@ zWRc8u? z%}8irY^MWqqsOL{Xty)OgQ`sJxV1*804h6QXfw+tUzRtrQhK6V8{(kTYZE8 z5-vzLmE$>J8348wLo(AXBc>g!eaImjfJQVdn5IK)zhJD$Nu^|m^W<{vNj zNl+vySOo$s3XrQ_;S=>)eEmK~;}KW_)X_3-G<7f{sA{{?p4epH?ZlzDf4gKF~ zbHx9q&0i#y5mDg2h!$G6XWZyk%Io;pjB~%X9)Bq2$Ik@fZba~zdz?MU{^@u-=dqpw ze0nh_PLj4xO{qG8w5(X8zWn(MzNyA3$%NJR(?A#{0*AL=S3sB2J7s)6D4(rNyasK- zVh2@b)TdQ!I40FufX6z@F1Z$QVF!5c9UATPd-I6ME&VxC=AX|lcjkTA(Kf^CiSY5R zf7}u^xST)uc}0+}sp9sHsn)r~gE_ZMMpwbMNO`i1(b`2N`e}X*^}pfdopZ>KrN)bM{P>cmEqZ;e;!Z=`(#wrKd}^P3aS>2g=c zm6~7r1+p_yy$-E8Bn)-9p(9_r^tFAzd9`evEk^@YYh-DhsOy9^t^nJod;QY+fo@<> z^^Q)K+JCo=D!_`h4K#jTw`nFJDYD!v$zL*!Er z3gYR-!E*~vn3`2S>3QKX4fZ}%$t_p_I%g04IB-}E)zr*mu~5=5c#4BNxLN>^b>;2l zVSG|evrWTy0=#IZ9*}K}Qtf;mIpJIasj42r0&K`#D;Hb@a>ooo+J_fs-2YL{S`{B0 zu!1E_|0A1M(?uA+Psa5S;lfj>uPx)rIzir7h)@TdzSWomzjFHlGuPgAL=6QkePk_3 zO5gqT9M?L>M~HRTG;asTRpExWeV!Mk@XUUa#U_Q(c?YKbAKaVS5r`zR)6zt0PreY- zl5y@WNJx#BDm8daUp6s_{vmA38{7uC_u<2WfR0A8LW3Oh_gv;ynz#&5T9=Px9Ke{z z1e;B<>1b5_Hf85@fXWB2H=jEtX)fy<{z4ZKaEq#7*1H;#-`BkwC$r>kR2z)$MpHOlQT3Y_Ov8SO7Lzu?gl_Gpc^KUJV`$6_ytqkY?>;AV4`*?a@Jqs# zE^7@UrC^0o-i5vc(ptVGe;Gqmwd=}f%ox4c{bK!ed~N^0YYR_=C6d63vG0>xxmqY@ftSd%K~-?#`AZ{#)B5+#mGWS7TX?lyi#N+dI%)OLWLD z&c1M`*(2dOR32A$R*@4sqHRUL%m{-;b28sIrr`U&yS1l^i6CB zL9}O6mU2*XJsUAr>?P! zXvz%Uo{Mh2oGJ2@2x30g3kh?_XnPo5OPE6NY6?E8cJ*yge9Mvr3UR6+;xY7FfW++P z_c;Z3zAe;VB)brq$VO?HdGVhlx=`_w&B`&66S(c4O*UC-rV>9tR=67f%Z>(GpR*_! zSo_f~@9rTEo>ZN?lvx|J`NKTn@^F+?pX@kssJ!_!K-Q1b=C7q}MX}?t=VMqQA zzVcS_8e1BQBuvTtxl4m}lO~CWol=V3_g`o=vGONcJqtF%R)@=F85!H&R;q2SVNskV z|F37yhXtvC(f+HPSOIs^`OmjV72#;jU~gnmJ6R{J9~$Q};+cL=3Tss>jr(v*bvSWM zVRprml?T$XhYv_uNK1Uf+fg?vPl_2^tfX0g9Qk%p4chF7(j4otQIU$TU!ouwlDgUuW{Om31+?(j@n-Ts#x*z2*$R=2Ay?-^I3O~|h! zSfB8!_aOnfkC{q>Sk{Pgn%f%j`S&E4>IoQUZWb9rT4J68~Ju8{lH8)@t>-*!>!ns`bS@ABjbH1v5(nA zz!=guCGdi${+nct2ue+k3j~>Sk2io_7VSiv1*=PYXphH)+85F8-5Ar%d^G6}NO4G` z_Mi8MKa0XB&w%IL_5_yQz0o^{8HIAiHSu(*+|RHWDwaadZ!Q41xsy(cTU$4mvy$ zAPE5y<4gT!v75yXILez8Wz&)~DEvjmM#rgO4gsocJ830?AG8FdFT^uC`uX6-AUzMA z_Fl&%W>IZe#{L_XymWSxpLNyeM!iWQk&;XpVJV7ksV=Zj3i=dxF95epLxdwNbupL} zKz-?!U1BU`0nC2EZ(4OGkAl18sZ= z0?r{gWH*T`TET3Bq!YT|i!$+A+}#yD&2p3K4)vC>2|e+fHO${9T@FTiBeIjWVaLs$ z`ucEUhPNiH?yOQUn_{pfQ-7lu_yr~#_$c0Y*sM(uRfz%JthTWsh8((KTzTkD%IAlA z1$A=8PGVcs!xhpz5eyiq(~IfTs!P5RpQ0m+G}D1)NfE{RSLq#%Ph2L<-+S8Jwmu}0 z5WFm^sJHbuJ*GCcl4CVU07awf^X1go@ZLJuKW4;vK(a7}(GXcm6p=()H^dx3dUl-x zYcE|MdFnQouo)KTk#l1O3`y;jwtHww(^~r0-&J^kZZ0S>{4Dv-PGh)}Z4&&iuXDbC z#Wau@k3p|tnJ+cov@J}v5jvWW@P0PO>b++Z&Nq5|U{@biA3qpjFSgrmahmb@2fIpX zai03L@M~+eM_W_Zfo;;|gN@e!WLObX&_d(U)FeJaSMW22z>qln_);w>ZUpcE1x7936@dJz)GK}VZbx3=h zaMPrQ+f%={_1O3_{tDw8=L+h82|_%)aGaQp-}0!!o{zH!ve+tPq3A%4+Lhuw&_lA~ zEs(`#C68%exm#f8h6PU~h^NDwd3;vBfCJ~NrDKI^5(k#?AacJ?OQWA991)qxW%UZ; zhEa7rSs%=KCw%0S|Cs}Jyxgd&mji=jj9v)9dw7CNGA{ASx!AOtuCViFxCtpC=Ds{a zS8tYv3yNFq1 z1oh_@$%*V-hn~e>n@CemE0s^fa>;rXc7v_yzm*d`jW|e06^_v+?FPiyWI{VYhO=S>K$ zxATPKavsEWz5RiY>gjxnZ5_(=t$Mjr@aD4a;oJunYg0#YjaH@MVU038!_4q!#xH~U z$8Y6&eaN_l0G!CMMFJ&4-FnT**Ag*6YX5z{_i5s%=M^0MS3?<}=RSQ-HU_3Ryj1^8 zUZjudjhTi^m<{H9NoX=1)rGeQqcvm~Sqn7C_4G$7PJ9G1XS%$QV}RFA7hTa9TQv}6>()o+V7st!}AVw-2kQl zN`b>fL5Z|Jjih@5!AOb^kdTn9BHtrwA;9*L8$NW>Zjb7Ec~z>8(+rcttJeO>)JN@e ze|t|ozEvcg_Le6OuG^$?o-rG{GEqpjaEbNC?6Ev$Uzp80PjDO_Nms567JIc<1k&>Y zdvKi_8RzVy1fBC-deE}1oI+CwxNb|Fd`yW@P=HtX=7cEMYu|ilcS!VMv~LyjT)Qo@ z=xybT2Q_-@>;9|~`O|uHEa|etZ+~XB@q&a$i77UNOn!t;c}CxX1-`jX6Hs=81nm?1>(SB3-aO@v42Q(3TTj6L=!C;81SMB9 zW2<^jc1BY0RS)YpL8zCMQeTFS1Uv6OSe)o=f!2WVceh#1p&s=Ar4VDFY<$ zzSxMykVFgBAZsu~J$KBF?x)qWr(u7`l=t~}+$pE;xWD&4V*GMd)MK>|J=I=Nlvq_R z>k5|Z0=YWEzrn6=h2O1{*=6qs5y`zi_7K!#-8dvSB(c{_6X_8eflThkb zOuRW0J=7TGV$JbTwW*1m!uKilF!(~4UBQ4z&75d1-F=a@fuNNlVQhU!ck_ z=Dkvn-V-$ovFaT->2k%_GCtZR-!Q(S#ZCHQAg*#dcivqBw{z){mu^R+=2jA-coix9 zhLmfjjX!9y63?+fiNRZ^4zBsyIy>K$px$#rY`!BysXQJw)&$ph`cq*iqwQ|3gsGIS zRsv&StQq1Obk@dwRfvR0tS{SRbbQ81G}TmWzA~K_q3&(3qZ72dZ&D^NSyuJ+Q`W~> zlP{=WV=BDY4-q=AM&;1S_9~0*H|#_qQBm;uprXjqtm{i z6odMEwBziuy~uTugeUFI_Ms#nH5@PWp_4N3ps%^%s*O7qQTy zanA?AD3)PIq?L>OP4{YSjaN2<4Q`gM3;0u6+HwdudY96yM-|8M zTz{gSL+^b}3fZ%a%qGNmWN@x+ODWs)!Ok?avk=^zEjO~dEj`1J zCPatT{g#m7;$lGp!lc|;N(VvA9<>lGLfELmdNQy5seEv}x>uHGdWRBIJ~XM8b?^(; z^sUy>@hk5YC^nx7CfT}gS)Vta*-lMRS~yYaGz~nT7gIGMH!@6WLV#9xJ}Uzk$h@i5 zdF-dC37X;Jz-UL@EvYwT_LwChb2E$1ORbdjx{cM1V#F;SHu*@GzI&c)y=_v|x!Rs2 zCL|VV(wwNgxmGAGw{h5u^bPFU9^MCbb5viKy4}*g;?zRxXNUuD7w-7HAI;M2ENPoE zn#-D#v>j;9j2LbVWUJ2F1+I45r(qQSo8HmSG?DZKFoRq!O3Y+oeo4s0a5yq+K8FT1LTEkY zBC@Ta42xYmQ!fq>u)LB?F6H@azF^ghTvZ~EFkAM9H!uPwWnyXaqzA| zgaWR;soM;4$%uRx3N#?u` zSEZn;jJgm7%o#TwY+mhC7&G|am6B~f!o=K1MbN+>tB&h!KmMw{(QGOR6uEX#OiT>Q zr}}ex`N#6gkumF@gJSbO`GEZXEO!O}%9Nz-Oh#ZK)lRn9bkuo%aXl}OH?kzdLL}12 zVBX6R;m59a0dNxbWY$gyy+QiuwGA~iS~HugvUumN8}rpcnw25k4fg!Kx9J=u;MN)< zr)zs(wQEZBjGNuuh>EF47uv=uTG~%!AC>ieMjH>nBilS8iZ7nW6nTiUlI%t-i?`ne z0|f=BinYd2!aTtkbmZ?sDQkM1E4Fsz?!yBY?q6seovC{_$TNMPSmiw?neMGbZ1B)K zP568gD3`Fokc^y-(CyTC8(HuO7nVL-NqSsQ3n$n=qp%>iqP`RxCnO*F*^M_nRJx?T zyGSc1&jNh0CXKC0;IOY_%k7JILFeP2&3IchXi;NQZ5Tp_K+1s_?xx>^yi$YTC#Cd%<#jR7_egCJWXRc+ucI;sd_x(&iRu70?FMj|hetKi*7_35Ki<*>VQRy@$Jv1dWiGH{>#EJ*_M|b1J?^Rrswdsr!mDtNy7Z0hdTs<+#b2m66n${l{D29& zsYU2&YoL9^?km@>6MqjTN05)(-?P0Yl+*Rw97HQ9H>quR!nV+r>bULq4Z|vzY~NN4 zrba5|VV4Jnbu4E2DL|zLQ@y*`ZLcK3NM?j#eN6dV5)c!!j+5DX!3Vsn1?e_sGR^V2 z_S{H<0b!l2Hc%SiN<&oA8`al117G2GXttY{r?6r(!|j`g{sscBN4Ub;pa+2m+gQ!Q z@2@Ic+I^L8;CdM&IyR;Yl$YmGVA#!5Qa1Lt9c%Vy|KOWvvuR_L3q;sB2& zAglv4UstMvD+ceQ$LBV`tVA?qHuld(FI;LVw2a-yaWxQb5V?+}!tG5Kl5>O_lJcC2 zT%+YN`z{jjI~6@A))ijNmF78d(HLTf>7(A8z17yuRS{X>u7HcXf=lB(p1%^8BI@?u z1J46V^jwSrH4;yuJohPOQ{d>hea$OX&>83^#SOm-{&T(SH3{P62^L6sD>~zl)t7=A zE$zKeuR5l=jUVE|pTTWL0iWNMi`et2GqC}YVfvbRPV%AZ(L~oZ1tQb9{iU9-Vn*RM zUe)Hvt5m^W>A4Npgsog`KTQ^}M%YZ-t$Om$61qQ@kSNiX#R|TKGQDrm*2Tm4$c)vS z_hbZ;aG-egj}eriMYG9O#Q-$(vTM2u8b=0pl0 zfuD>YZ-D~HEJ~g{SNdeE-!Kb&9d5?g94GDdHeZC2=`ms8>l%x}S6yt?#^eYEs<5wXveO7Q#UlaaneKr>^4)3-$e`u_Xsd#C4DBbFw2{?D)iWj60~BoK9@WE%dh%)+1k*QwK%wYE0mx zQfUVOd5%bT6Inr;V2i_-8#M=Q!VQtJ&OFcm#U}bg_U(XLguiyy&)-M|C))%z@NSq%D-Mx=XF>%NE6ynkKwa@^g|#(VgCKI g{QjobsoL*gvb;yLSmMgv9soZtB^1O#qDKDz2Xh%tcmMzZ literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/rethinkdb-exporter/rethinkdb-exporter.md b/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/rethinkdb-exporter/rethinkdb-exporter.md new file mode 100644 index 0000000..bb30c5f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/rethinkdb-exporter/rethinkdb-exporter.md @@ -0,0 +1,77 @@ +--- +slug: /references/rethinkdb-exporter +title: rethinkdb-exporter +sidebar_position: 3 +--- + +# RethinkDB Prometheus exporter + +[![GitHub tag](https://img.shields.io/github/tag/rethinkdb/prometheus-exporter.svg?style=flat)](https://github.com/rethinkdb/prometheus-exporter/releases) +[![GoDoc](https://godoc.org/github.com/rethinkdb/prometheus-exporter?status.svg)](https://godoc.org/github.com/rethinkdb/prometheus-exporter) +[![Build status](https://travis-ci.org/rethinkdb/prometheus-exporter.svg?branch=master)](https://travis-ci.org/rethinkdb/prometheus-exporter) + +[RethinkDB](http://www.rethinkdb.com/) statistics exporter for [Prometheus](https://prometheus.io/). + +Current version: v1.0.1 (RethinkDB v2.4) + +## Build and Run +Local build and run: +```shell script +git clone https://github.com/rethinkdb/prometheus-exporter.git +cd prometheus-exporter +go build -o rethinkdb-exporter +./rethinkdb-exporter +``` + +Docker build and run: +```shell script +git clone https://github.com/rethinkdb/prometheus-exporter.git +cd prometheus-exporter +docker build --tag rethinkdb-exporter . +docker run -d -p 9050:9050 rethinkdb-exporter +``` + +## Parameters +Exporter can get parameters from config file, CLI flags or Environment variables. + +| CLI flag | Env var name | Config key | Description | +| --- | --- | --- | --- | +| --config | - | - | Config file (default to prometheus-exporter.yaml) | +| --web.listen-address string | WEB_LISTEN_ADDRESS | web.listen_address | Address to listen on for web interface and telemetry (default "0.0.0.0:9055") | +| --web.telemetry-path string | WEB_TELEMETRY_PATH | web.telemetry_path | Path under which to expose metrics (default "/metrics") | +| --db.address | DB_ADDRESSES | db.rethinkdb_addresses | Address of one or more nodes of rethinkdb (default [localhost:28015]) | +| --db.enable-tls | DB_ENABLE_TLS | db.enable_tls | Enable to use tls connection | +| --db.ca | DB_CA | db.ca_file | Path to CA certificate file for tls connection | +| --db.cert | DB_CERT | db.certificate_file | Path to certificate file for tls connection | +| --db.key | DB_KEY | db.key_file | Path to key file for tls connection | +| --db.username | DB_USERNAME | db.username | Username of rethinkdb user | +| --db.password | DB_PASSWORD | db.password | Password of rethinkdb user | +| --db.pool-size | DB_POOL_SIZE | db.connection_pool_size | Size of connection pool to rethinkdb (default 5) | +| --log.debug | LOG_DEBUG | log.debug | Verbose debug logs | +| --log.json-output | LOG_JSON_OUTPUT | log.json_output | Use JSON output for logs | +| --stats.table-estimates | STATS_TABLE_ESTIMATES | stats.table_docs_estimates | Collect docs count estimates for each table | + +Config file can be yaml or json. Example: +```yaml +web: + listen_address: "0.0.0.0:9050" +db: + rethinkdb_addresses: + - "0.0.0.0:28015" + - "0.0.0.0:28016" +stats: + table_docs_estimates: true +``` + +## Metrics +Most of the [RethinkDB stats table](http://rethinkdb.com/docs/system-stats/) are exported. + +Optionally table rows count estimates can be exported from [Table info](https://rethinkdb.com/api/javascript/info). + +## Grafana dashboard +[Grafana](https://grafana.com/) can be found [here](grafana-dashboard.json). + +![image](./assets/grafana.png) + +## Contribution +Pull requests and issues are welcome. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Partition/go-hal/go-hal.md b/versioned_docs/version-v0.22.4/docs/08-References/Partition/go-hal/go-hal.md new file mode 100644 index 0000000..519cf8b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Partition/go-hal/go-hal.md @@ -0,0 +1,38 @@ +--- +slug: /references/go-hal +title: go-hal +sidebar_position: 1 +--- + +# go-hal a hardware abstraction layer for servers + +[![GoDoc](https://godoc.org/github.com/metal-stack/go-hal?status.svg)](https://pkg.go.dev/github.com/metal-stack/go-hal) + +go server hardware abstraction, tries to lower the burden of supporting different server vendors. + +Example usage: + +```golang +package main + +import ( + "fmt" + "github.com/metal-stack/go-hal/connect" +) + +func main() { + ib, err := connect.InBand() + if err != nil { + panic(err) + } + + firmware, err := ib.Firmware() + if err != nil { + panic(err) + } + fmt.Println(firmware) + // UEFI + + err = ib.PowerOff() +} +``` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-bmc/metal-bmc.md b/versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-bmc/metal-bmc.md new file mode 100644 index 0000000..26594b6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-bmc/metal-bmc.md @@ -0,0 +1,35 @@ +--- +slug: /references/metal-bmc +title: metal-bmc +sidebar_position: 2 +--- + +# metal-bmc + +`metal-bmc` is responsible to gather data from machines via the out of band interfaces and report them back to the metal-api. +It also passes commands to the machines like power on/off, led on/off, firmware update etc. +Access to the console of a machine is also terminated here in conjunction with the `metal-console` running in the control-plane. + +More details per package as follows: + +## Reporter + +Reporter reports the ip addresses that are leased to ipmi devices together with their machine uuids to the `metal-api`. +Therewith it is possible to have knowledge about new machines very early in the `metal-api` and also get knowledge about possibly changing ipmi ip addresses. +`metal-bmc` parses the DHCPD lease file and reports the mapping of machine uuids to ipmi ip address to the `metal-api`. + +## BMC + +The `bmc` package serves the following: + +### Commands + +Commands from the metal-api are passed via nsq and executed either through redfish or ipmi against the out-of-band interface of a machine. + +### Firmware + +Firmware updates the firmware of the BIOS and the BMC of a machine. + +### Console + +Console forwards the the serial console access terminated in `metal-console` to the machine. \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-core/metal-core.md b/versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-core/metal-core.md new file mode 100644 index 0000000..3f9cb5c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-core/metal-core.md @@ -0,0 +1,21 @@ +--- +slug: /references/metal-core +title: metal-core +sidebar_position: 3 +--- + +# metal-core + +metal-core dynamically reconfigures switches based on the state held in the metal-api. Therefore, it must run on every leaf switch and have control over the configuration files for network interfaces and the routing suite (`/etc/frr/frr.config`) of the switches. + +In the PXE-boot process of machines `metal-core` will act as a proxy between API-requests issued by `pixiecore` and the `metal-api`. The `metal-api` will answer with a mini OS (see [metal-hammer](https://github.com/metal-stack/metal-hammer) and [kernel](https://github.com/metal-stack/kernel)). + +Besides that, it ensures the proper boot order (IPMI) and monitors their liveliness with [LLDP](https://github.com/metal-stack/go-lldpd)). + +## Build + +Ensure you have `libpcap-dev` installed. + +```bash +make +``` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-hammer/metal-hammer.md b/versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-hammer/metal-hammer.md new file mode 100644 index 0000000..da0ce5d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Partition/metal-hammer/metal-hammer.md @@ -0,0 +1,60 @@ +--- +slug: /references/metal-hammer +title: metal-hammer +sidebar_position: 4 +--- + +# Metal Stack Hammer + +Hammer is used to boot a bare metal server via PXE together with the Metal Stack kernel. Hammer is a initrd which runs a small golang binary as init process. This does the following actions: + +- Ensures all interfaces are up +- Check if the server was booted in UEFI, if not modify the bios to uefi and reboots +- Wipes as existing disks by either: + - run secure erase if possible by using the mechanism in modern disks, this is true for most SSD´s and NVME disks. + - If not possible run mkfs.ext4 --discard on the disks. +- Gather HW information and report them back to metal-api: + - CPU Core count + - Memory count + - Disks with their size and device path + - Network adapters which have an active uplink with their interface name, own mac address and mac address of the switch chassis where this network card is connected to. 2 distinct switch chassis are required. + - IPMI interface with mac and ipaddress. + - create a metal user on IPMI with a strong password +- Set BIOS boot order to contain only PXE and Hard Disk as possible options. +- Wait until a `machine create` command was issued from metal-api + +## Local Testing + +```bash +make clean initrd vagrant-up +``` + +## Create a PXE boot initrd with u-root + +In order to be able to create an initrd image which is suitable to boot a bare metal server with the required tools to discover and install the target os, we use u-root. + +### Quickstart + +- download u-root: + +```bash +go get -u github.com/u-root/u-root +``` + +- build the initrd + +```bash +make initrd +``` + +### check content + +```bash +cpio -itv < metal-hammer-initrd.img +``` + +### start it + +```bash +make vagrant-up +``` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Partition/pixie/pixie.md b/versioned_docs/version-v0.22.4/docs/08-References/Partition/pixie/pixie.md new file mode 100644 index 0000000..922a860 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Partition/pixie/pixie.md @@ -0,0 +1,32 @@ +--- +slug: /references/pixie +title: pixie +sidebar_position: 5 +--- + +# Pixiecore + +This project is a permanent fork of: [Pixiecore](https://github.com/danderson/netboot/tree/master/pixiecore) + +Sample command to run `pixie` in grpc mode which talks to the metal-api and provides grpc client certificates and the metal-api-view-hmac to the metal-hammer. +With this metal-hammer will be able to talk to metal-api directly. + +```bash +docker run -it --rm -name pixiecore \ + --network host \ + --dns 10.1.253.13 \ + --dns 10.1.253.29 \ + --volume "/certs/grpc:/certs/grpc:ro" \ + ghcr.io/metal-stack/pixie grpc \ + --debug \ + --dhcp-no-bind \ + --pixie-api-url http://the-ip-of-this-service/certs \ + --grpc-address api.metal-stack.dev:50051 \ + --grpc-ca-cert /certs/grpc/ca.pem \ + --grpc-cert /certs/grpc/client.pem \ + --grpc-key /certs/grpc/client-key.pem \ + --metal-api-url https://api.metal-stack.io/metal \ + --metal-api-view-hmac a-view-hmac \ + --partition partition-1 + --ntp-servers 0.custom.ntp,1.custom.ntp +``` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Storage/csi-driver-lvm/csi-driver-lvm.md b/versioned_docs/version-v0.22.4/docs/08-References/Storage/csi-driver-lvm/csi-driver-lvm.md new file mode 100644 index 0000000..769e45e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Storage/csi-driver-lvm/csi-driver-lvm.md @@ -0,0 +1,105 @@ +--- +slug: /references/csi-driver-lvm +title: csi-driver-lvm +sidebar_position: 1 +--- + +# csi-driver-lvm # + +csi-driver-lvm utilizes local storage of Kubernetes nodes to provide persistent storage for pods. + +It automatically creates hostPath based persistent volumes on the nodes. + +Underneath it creates a LVM logical volume on the local disks. A comma-separated list of grok pattern, which disks to use must be specified. + +This CSI driver is derived from [csi-driver-host-path](https://github.com/kubernetes-csi/csi-driver-host-path) and [csi-lvm](https://github.com/metal-stack/csi-lvm) + +> [!WARNING] +> Note that there is always an inevitable risk of data loss when working with local volumes. For this reason, be sure to back up your data or implement proper data replication methods when using this CSI driver. + +## Currently it can create, delete, mount, unmount and resize block and filesystem volumes via lvm ## + +For the special case of block volumes, the filesystem-expansion has to be performed by the app using the block device + +## Automatic PVC Deletion on Pod Eviction + +The persistent volumes created by this CSI driver are strictly node-affine to the node on which the pod was scheduled. This is intentional and prevents pods from starting without the LV data, which resides only on the specific node in the Kubernetes cluster. + +Consequently, if a pod is evicted (potentially due to cluster autoscaling or updates to the worker node), the pod may become stuck. In certain scenarios, it's acceptable for the pod to start on another node, despite the potential for data loss. The csi-driver-lvm-controller can capture these events and automatically delete the PVC without requiring manual intervention by an operator. + +To use this functionality, the following is needed: + +- This only works on `StatefulSet`s with volumeClaimTemplates and volume references to the `csi-driver-lvm` storage class +- In addition to that, the `Pod` or `PersistentVolumeClaim` managed by the `StatefulSet` needs the annotation: `metal-stack.io/csi-driver-lvm.is-eviction-allowed: true` + +## Installation ## + +**For convenience, helm charts for installation are synced to a separate repository called [helm-charts](https://github.com/metal-stack/helm-charts). The source for this chart is located in the `charts` folder.** + +You have to set the `devicePattern` for your hardware to specify which disks should be used to create the volume group. + +```bash +helm install csi-driver-lvm ./charts/csi-driver-lvm --set lvm.devicePattern='/dev/nvme[0-9]n[0-9]' +# or alternatively after the a release: +# helm install --repo https://helm.metal-stack.io csi-driver-lvm csi-driver-lvm --set lvm.devicePattern='/dev/nvme[0-9]n[0-9]' +``` + +Now you can use one of following storageClasses: + +* `csi-driver-lvm-linear` +* `csi-driver-lvm-mirror` +* `csi-driver-lvm-striped` + +To get the previous old and now deprecated `csi-lvm-sc-linear`, ... storageclasses, set helm-chart value `compat03x=true`. + +## Migration ## + +If you want to migrate your existing PVC to / from csi-driver-lvm, you can use [korb](https://github.com/BeryJu/korb). + +### Todo ### + +* implement CreateSnapshot(), ListSnapshots(), DeleteSnapshot() + + +### Test ### + +```bash +kubectl apply -f examples/csi-pvc-raw.yaml +kubectl apply -f examples/csi-pod-raw.yaml + + +kubectl apply -f examples/csi-pvc.yaml +kubectl apply -f examples/csi-app.yaml + +kubectl delete -f examples/csi-pod-raw.yaml +kubectl delete -f examples/csi-pvc-raw.yaml + +kubectl delete -f examples/csi-app.yaml +kubectl delete -f examples/csi-pvc.yaml +``` + +### Development ### + +In order to run the integration tests locally, you need to create to loop devices on your host machine. Make sure the loop device mount paths are not used on your system (default path is `/dev/loop10{0,1}`). + +You can create these loop devices like this: + +```bash +for i in 100 101; do fallocate -l 1G loop${i}.img ; sudo losetup /dev/loop${i} loop${i}.img; done +sudo losetup -a +# https://github.com/util-linux/util-linux/issues/3197 +# use this for recreation or cleanup +# for i in 100 101; do sudo losetup -d /dev/loop${i}; rm -f loop${i}.img; done +``` + +You can then run the tests against a kind cluster, running: + +```bash +make test +``` + +To recreate or cleanup the kind cluster: + +```bash +make test-cleanup +``` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/MULTITENANCY.md b/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/MULTITENANCY.md new file mode 100644 index 0000000..8018d3a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/MULTITENANCY.md @@ -0,0 +1,128 @@ +--- +slug: /references/MULTITENANCY +title: MULTITENANCY +sidebar_position: 2 +--- + +# Multi tenancy with lightbits storage + +Multi tenancy is a crucial aspect when providing central storage. This divides into several aspects, impact to storage from one tenant to another tenant must be restricted so that neither data can be seen, destroyed or modified by another tenant, but also read and write actions at a high rate must not impact the performance of the storage of other tenants. + +Lightbits storage uses NVMEoTCP (NVME over TCP) as transport protocol as defined here: [NVMEoF](https://nvmexpress.org/developers/nvme-of-specification/). The storage traffic is routed over the same network as normal TCP/IP traffic. The basic setup of the components is shown here: + +![Diagram](./assets/nvme-over-tcp.jpg) + +The current implementation prevents malicious access to data, prevention of performance impacts are subject of later lightos releases. + +## Gardener and metal-stack + +Multi tenancy in metal-stack and gardener are based on projects. In metal-stack, projects additionally belong to a tenant entity that groups projects. A single kubernetes cluster is created in the scope of project, one project can have multiple kubernetes clusters. Every kubernetes cluster will get physically separated firewall and worker nodes in a dedicated routing domain called VRF. Every kubernetes cluster is totally separated from a physical an network perspective, nothing is shared. + +Lightbits storage has also the notion of a project, once a cluster is created, a new project is created in the lightos storage API, the project there matches the project from the gardener/metal-stack perspective. For every cluster an authentication token in the JWT format is created, this token is able to create/update/list/delete volumes in the lightos cluster in the given project, resp. lightos project. For every kubernetes cluster, even in the same project, an individual JWT token is created. The token is also set to have a 8 day validity, 1 day before the token will get invalid and the cluster still exists, a new token is issued. + +The duros-controller is responsible to create such tokens, it is deployed in the seed's shoot namespace (find details on gardener architecture [here](../../../05-Concepts/01-architecture.mdx)). This namespace is fully managed by the provider and invisible for the cluster user. Once the token has been created, the token is stored in a secret in the actual user cluster alongside with the deployment of the lightbits CSI driver and storage classes. This CSI driver will then be responsible to create/update/delete volumes based on the manifests deployed in the cluster. + +```bash +k get sc + +NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE +partition-gold csi.lightbitslabs.com Delete Immediate true 7d4h +partition-silver csi.lightbitslabs.com Delete Immediate true 7d4h +``` + +The storageclass partition-gold with 3 fold replication and the pointers to the secrets. + +```bash +k get sc partition-gold -o yaml + +allowVolumeExpansion: true +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + creationTimestamp: "2022-01-24T08:40:03Z" + name: partition-gold + resourceVersion: "234" + uid: 3b40edfa-ff72-4426-904c-4205b061e311 +parameters: + compression: enabled + csi.storage.k8s.io/controller-expand-secret-name: lb-csi-creds + csi.storage.k8s.io/controller-expand-secret-namespace: kube-system + csi.storage.k8s.io/controller-publish-secret-name: lb-csi-creds + csi.storage.k8s.io/controller-publish-secret-namespace: kube-system + csi.storage.k8s.io/node-publish-secret-name: lb-csi-creds + csi.storage.k8s.io/node-publish-secret-namespace: kube-system + csi.storage.k8s.io/node-stage-secret-name: lb-csi-creds + csi.storage.k8s.io/node-stage-secret-namespace: kube-system + csi.storage.k8s.io/provisioner-secret-name: lb-csi-creds + csi.storage.k8s.io/provisioner-secret-namespace: kube-system + mgmt-endpoint: 10.131.44.1:443,10.131.44.2:443,10.131.44.3:443 + mgmt-scheme: grpcs + project-name: 0f89286d-0429-4209-a8a9-8612befbff97 + replica-count: "3" +provisioner: csi.lightbitslabs.com +reclaimPolicy: Delete +volumeBindingMode: Immediate +``` + +This is the secret where the storageclass points to: + +```bash +k get secret lb-csi-creds -o yaml + +apiVersion: v1 +data: + jwt: ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNklqQm1PRGt5T0Raa0xUQTBNamt0TkRJd09TMWhPR0U1TFRnMk1USmlaV1ppWm1ZNU56cHliMjkwSWl3aWRIbHdJam9pU2xkVUluMC5leUpsZUhBaU9qRTJORFF6TURrMk1qa3NJbXAwYVNJNkltUmpNVGc0TWpVd0xUZGtORGt0TkRjMk1DMWlZVGs0TFdGbE1ESmpNR0l5WmpNeVpTSXNJbWxoZENJNk1UWTBNell4T0RReU9Td2lhWE56SWpvaVpIVnliM010WTI5dWRISnZiR3hsY2lJc0luTjFZaUk2SW5Ob2IyOTBMUzF3WkRjMmJYSXRMV2x1ZEhSbGMzUXdJaXdpY205c1pYTWlPbHNpTUdZNE9USTRObVF0TURReU9TMDBNakE1TFdFNFlUa3RPRFl4TW1KbFptSm1aamszT21Ga2JXbHVJbDE5LmIxaWo0aHV0R2lmUll1YlZMb1J5WlBKRHZ0ZWpodDZqdW1KdW1xbEMyOWpwRUxWa0JfdG4tZU9VbERPb09HUEZTN2FhRDBGOXRKSGVrOGVYQ0xqZ1R2RkdCMzI5aE5zTzlra0M5OXNQZWJvaWE1RmRLUmlUbjNBTC1KcXZZZ3pKZTNaZmZNWFdFVHhsZmxSXzFTNERpQlZFNERSc3hNczNpbWt2Nl83cU5BUEhXd2ZCdU5OUDVyMmxOdGRqdVl2VXlqN3hNWTZhODdSU1RkMUZINGlaMUx3OEZwLW9haTdyN1M1SlhnMkhBcUU2VTJ1UTMzMWhwMlREY3M2ZTJjcDdpbjJNSnhHWkRYUE5SSGFnRUJyWFdfYVVJdjJpYTU3emVGeWoyMFdhVVlUVS1rRFhxYXBUaDJfQXlPV19jQ1hhbTJWdVY0N1IwOWxqdVNocGRaXzJFZw== +kind: Secret +metadata: + creationTimestamp: "2022-01-24T08:40:02Z" + name: lb-csi-creds + namespace: kube-system + resourceVersion: "1837602" + uid: 406c3583-d4cd-4a0b-8615-3a6f2b9b7577 +``` + +## Lightbits and NVMEoTCP + +Once a volume is created and mounted, e.g. a PVC and PV, the csi driver will first create the volume on the lightos API with his token and set the hosts which are allowed to talk to this volume to the name of the worker nodes. + +```bash +k get pvc,pv,node +NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE +persistentvolumeclaim/data-sampla-app-0 Bound pvc-c4b7822b-b3c8-414a-a1fa-9350d30a4f5c 1Gi RWO partition-silver 25s + +NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE +persistentvolume/pvc-c4b7822b-b3c8-414a-a1fa-9350d30a4f5c 1Gi RWO Delete Bound sampla-app/data-sampla-app-0 partition-silver 25s + +NAME STATUS ROLES AGE VERSION +node/shoot--pd76mr--inttest0-group-0-845b8-49r7x Ready node 6d21h v1.21.9 +node/shoot--pd76mr--inttest0-group-0-845b8-ng7xh Ready node 7d1h v1.21.9 +``` + +The pod which mounts this volume is running on the node `shoot--pd76mr--inttest0-group-0-845b8-49r7x`. + +```bash +k get pod -o wide +NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES +sampla-app-0 1/1 Running 0 5m34s 10.244.15.152 shoot--pd76mr--inttest0-group-0-845b8-49r7x +``` + +Once the lightos cluster has set the ACL of this volume only a node which sets the hostnqn matching the given ACL is able to mount that volume. + +```bash +lbcli list volumes +Name UUID State Protection State NSID Size Replicas Compression ACL Rebuild Progress +pvc-c4b7822b-b3c8-414a-a1fa-9350d30a4f5c 7828aa17-2316-442d-883e-d000436d41f2 Available FullyProtected 631 1.0 GiB 2 true values:"nqn.2019-09.com.lightbitslabs:host:shoot--pd76mr--inttest0-group-0-845b8-49r7x.node" None +``` + +The NVMEoTCP module in the linux kernel on the worker node side and on the lightos side implements setting the host nqn to match these ACL expectations. + +This can be inspected on the worker node side by looking at the host nqn, e.g. the name of the nvme drive (NVMe qualified name). This nqn matches the ACL on the lightos server side. + +```bash +cat /sys/devices/virtual/nvme-fabrics/ctl/nvme1/hostnqn +nqn.2019-09.com.lightbitslabs:host:shoot--pd76mr--inttest0-group-0-845b8-49r7x.node +``` + +## Further improvements + +In the upcoming lightos release the performance aspects of multi tenancy are addressed. This is achieved that it will be possible to cap the maximum throughput possible per volume. This will ensure that no single tenant is able to saturate the whole lightos cluster and impact other tenants using this lightos cluster. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/architecture.drawio.svg b/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/architecture.drawio.svg new file mode 100644 index 0000000..2f488fb --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/architecture.drawio.svg @@ -0,0 +1,73 @@ +
    shoot namespace
     + shoot namespace +
    control-plane
     + control-plane +
    seed
     + seed +
    grpc
     + grpc +     + cloud-api + + - can volumes be deleted + + if mounted + + - can projects be deleted + + if volumes exists + + accounting-api +
    list/delete volumes
     + list/delete volumes +
    cloudctl
     + cloud... +
    lightbits-cluster
     + lightbits-clust... +     + duros-api +
    grpc
    create/delete projects
    admin scope
    (read volume usage)
     + grpc... +
    Deploy
     + Deploy +     + duros-controller + + create Project/Secret + + deploy StorageClass + + duros-api + + duros-api +
    dataplane NVME ACLs
     + dataplane NVME ACLs +
    shoot
     + shoot +
    create/update/delete volume
    project scoped
     + create/update/delete volume... +     + lightbits-csi + + <jwt-token> + + gepm + + ifDurosEnabled + + deploys + + Duros CRD + + in Shoot Namespace +
    report volume modify event
    which are not mounted anywhere
    ConnectedHosts == 0
     + report volume modify event... +     + nginx grpc proxy +
    grpc
    delete projects
    list/delete volumes
    admin scope
     + grpc... +     + + Text is not SVG - cannot display + +     \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/dataplane.drawio.svg b/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/dataplane.drawio.svg new file mode 100644 index 0000000..13f345a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/dataplane.drawio.svg @@ -0,0 +1,41 @@ +
    lightbits-cluster
     + lightbits-clust... +
    k8s cluster
     + k8s cluster +
    Storage Node 1
     + Storage Node 1 +
    Storage Node 2
     + Storage Node 2 +
    Storage Node 3
     + Storage Node 3 +
    Worker Node 1
     + Worker Node 1 +
    Worker Node 2
     + Worker Node 2 +
    Firewall
     + Firewall +
    Spine
     + Spine +
    Spine
     + Spine +
    Leaf
     + Leaf +
    Leaf
     + Leaf +
    Leaf
     + Leaf +
    Leaf
     + Leaf +
    EVPN
    100G
     + EVPN... +
    Storrage
    VRF
    100G
     + Storrage... +
    Tenant
    VRF
    25G
     + Tenant... +
    EVPN
    25G
     + EVPN... +     + + Text is not SVG - cannot display + +     \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/nvme-over-tcp.jpg b/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/assets/nvme-over-tcp.jpg new file mode 100644 index 0000000000000000000000000000000000000000..81afbc3c966c189c5e0fc4671d17913ee46b537d GIT binary patch literal 83916 zcmeFZbzD_V_b9%pLw5*Bm(tzct)xmww{%H}ARsNB5)y|l=~9p`l?G`gq!9r@K;Z6k zP#>T7eeS*A&+q=e_jCVv=dfq5S!>OjHEXY#Su^`^E2Pk0y+01y$703;Ay4_-(h4C4V=0LV`mWB~|% z!Y~@~PZ(B*903K+{|bb!|Af0hnBouqn}5jRMnD9pLHb+p;sIeI@V*6JwxK_D0~=ri zFEscED8K>mZh+*UcWDbJGfNr`8z*-sHybBs8XjH_Zkn5SZ5=I~9=b6DJX}0HB3#@e zJVG?wARr*ZFAVkwK*+x8)8!@D*X*ly@{mEwPnZMNDR_eX?mq-9|LU6$NdMKhKoI`3 zKM06d@*+Sy;!oHg^-7u&c!P=lb-(;@xdULq`(P}q4j^9c0yyvzU=aXgy_^Mt0W35$ zG;}m9baX6yObkqXVq7dNTw+o}LSjNfQhY3U`gyx5{A-SYjfshkgN=uSgGYpegF^(% zaEPv|;QvkEFUP` zNQ6GEP3jt7In1x?o>={M$I3G#xuCvh^7E0P;$7>9p(%w8y;Ez)_}~))wMB;OgbG37 zhpRx#O@It);6g`;!t*4K2&O^1*2o?&gV`t7z<610VskgXuZ$3w0;o*<9iyNUdDkrD zbp_llmwv18KiA;KUn*SA09Z)yHt_*T;F~U{-~G0n*_IPG{PU!sZw*_N=a4dA=91D| zvJ0JC;@dV@rVY21lP@+$JKlR5t8~A^o^{mapML4&tG`xPFI+v+;?zVwI;K$mavd(?@UjMSV*m_ii$;ivG2i)x)1L@NTv`d zMy8*<=)VNoiCD$8y}lu-`aVIt{ViVGn}Ix%W8sT4O}i}vo@wjou+BM?KkJV*e;*aA zBLC!bRi!f_Q}4r|$SB_X6-RYh=PiP~=S-J?Pn8#z&1_?1rbHUWR?FCY9V*q7p4C(s zGG%^irP$Uc|FcT~8gD>)3D|vjJhAa5Q(QRgVsVYG$Vcts?#cU$!`DBXQL>6Jf546# zF=)nz>)ZY!PW@h^p&&`JBW;V}lGnqr2d|5nFNZhUdMKwRo`tTD&sxn2I(Aob(B*!@ zdR^h*+qQ8D2-J&cH@Ih9`!L8-^*t%2z93>&B0=&^&8&9%;e$%2Dr-OQ!ZL%H@H6(w zx{lt{+>E#grNj6Az7;*+B$ZFvX7&Aq=H90TzinAON?xj&1R`<1sJG0WJ-7d6Ki_hg zm3OYQy#KU!g~}n`Ky2|aefg~In`GOMI&FH|i5V%kz8libXcsm1zQol>LkE+7OncKm z7K9{~wfc+n9zf zu@mEy!2GC@``Jw^UTqKb^=U4)1a>Z}TYTN>1&6(E^q^7?9Q(Fa$Hz^IR2-c?&9B)- z6w~Bkw|^X$pTb9|XZxaQvE>pV9T%CMc-S!R<~h_1e7&fCl%ehMK-ZQJV~4cQlc)cw?myNi4=xB0NU z0><*@IXp+s7M9}E$xy}H3qnHNXky(j?p~PXXl$m>ZaT2J(==l*#5K~Pz^k~erDdmvT zAj@!nPt6v|{;~D2&O5*3dyhF?Rh$q7&;^GIE2g7SM_#-?pP(~n(e@wR;XZuS#w{g= z(KT!Cuh{beN&3*Qe7;WUbxT{;OW!3V>x0KJBd#iT^KPkYl#>o~UUN!>CyUM5bD@o~ zlqU3K3N}yJwYA5vV0c>qGWq#k z9NCs=IyZc`HNG?zzV6st^~JfLV3bm?yv1KW?&K2aHxQ@C|3Jw}h`nduThLtQhA?B; zBhWz7N44lwbAqv?-1A-05_Uno&-;}Q&Jv){>ujm~U5h>R)J#Y#0z78CoFcuchE^`D zzY%xEYfDFMw#>eMH!Jdn`h?N7dG_8Dh6E0ml@|-H&y|^#8RAuJ7jGFL8HBAn?WTrY z0t|MGPP_hjmq5`|`_1&;qR%^Dve$YyST`7;x|5p?kY}?|DTKvb$St=SnQM*}7caW` zVpY-MP*=gwJhlHB(WpEY6C5H)mvr~L1h%!68R^^vg@h++8=Y@K{YTVhf(%DzX5L`6 zIQdbC3Z5wS(-dA#U+&;F{}np$a&Q4cGRo@6jPP{~51#*#!D%8e1Oh&o!RWBH8~`w# zU2PrRZ+o~qd$@x|SfB)GxVdYaIXT(GIg}mUEiD~A9AE?(47*%okw!|os!hLHml zU^0FR*Kl=mveLG6_i(;#W@iqfvEY@Q;38-MZNL(&>;X8#t6(_)<_61f?PcuU9e-+% zW#(aP?{4b|7YWkQ;oP$7da75J6NSk@WCydqtV8gJb#6Pm+d4VAf%I!IPFZJn$6p-= z4Pxf{yP#$5rvAGi>*^@`R{>m}eizit?A?ABZdto~{w~Nn*vtJcfHwb2w2b)!>z{^z zcMkxx6lG*VZIECpX<5+FSU7o@NjZIl72!$I)$!kOGWP$@C*x|NqwDCdK(A#F^Ml_> z#@>SFpYU34_U>@JhL^q6z2EE@o|fkBPOfsM?xwIFz?Ian)^PjfK`;33!KXSAO2%V~z<< z19vOGl4JmIdfrRB%qRzn75?;AM1p4rU1OS~spnHpZ2A!_aUIzQMVa08T3_ zkYW$!u!tX4=?asR_WU=72aeYV^Itsta16}ze`4S=zk_7}HnJ}NF(IwP$p1*X{6C?= zZGi@p{c9W|N`d1Nynfn^3I>4@Jec6T$P~u%U(Uw{}qA zG!RVyUa0VbvfLkSp<25-c{u+K1#xnN4LxCCp?-+GA>t9RJ6%WMJ-d)Gk z`fpq~=9XYROD}h2Hzgf)wOO25!x&rvNbtxP@O z6Dqo=rK|ftu;2NG{yRISnYFBwy_4%7#>KyqFQfRI09FBRIXS{?jqdK`3@+ksmVeGz z81~@Q_HS4$Gx${aZ+J}b5!?JLJA8!Qgf#@Nyr4Tv?!n=!kq3(;K!>}UnUG;;A6E_y zpOcVb`~Ye?n87Tb4PMM3_z`q(@Iv(mNWmk5{~RIw=Lq3HM+pBpLio=S!hens{&R%z zfBOjGY89siS7rdX3tq6-EdVYc4OoENYcnuJhV92~Kp3_+cY{OVb^v_I@xSJv0eAo| z@VeS)z$1vO$Q%{^<_2s9d^I2ow)S66h<_!d-w7t<4+*ftaKzul|0;0V0lpqU;6Tnp z0?$Q$z8>fTsKAf~6b4EMyL*)&s0b+F@jn^{`ehgR`UIqd49)oH6P0B?jBQ%OgGKg-eAKW5 z3Y_J}4e{)4fKt&V_V0BmGzkumzQ_1A9eJPm&E|YQSKdtB3BkEh)c1Ej4S6ejb?$m5 zOGD*bqa!!9ebfi`lCs9uJ5&GS8=)qrR)2AWP=?PS80%Xm>Z>n&g~R!Ye=)!yq~KP{ zg+r03SGCh>DeC2srcWPaJ!W{z-Km{yEamNeUcC0{?@c2t(S|f8P$lU2;vCc-lhZS8 zPiC%V#AO8hmWzs{Z}To~OPC@$K?gghSRmB4<~I!vAoLI=cUu3L+Gu{zVo-KAoB4VD zM@`i-cKCA0!hIJKB1M|N^Z%DhCYwD3yJ`O=)_-F{ilmS`_{d&LH5D!c+fm%?nE`%SZG+r=vKH5lc^Jna=;L^NVX4BkS3qlj&_{Qa+~R zYaPDouWpaN*X)j&KAo3OS^JduM2m{fS*o9TnStTwBaev(oNw~9@)zpu2r$JSk;{y5 z@_M=cl83{fR2YUn?m=l$6p|j~cu)SLo5>bh zxzy0fWo$?kUP+)|3D}Y_6DSCH7Np|SAD%7F@b+tRxW#WfwkyZE)doH1b+khd&*f3S zZMq_n%pH7Jms3x$_)3CKuvc(aJdN6I+HX&O_LP(*9@!^G8J%-9g(kn_!5HV1LH!XQ zOf5hBlaVdaqR7dGj)u2Wp8oSV#^Gn=(KU%f0TXe#kM2H=H(9~@*|_4nPy5q{!Wz%P zof;{pR<)S?=bzSs;F2AZopNdP)EPU#K86vXPIUN zN9sz;_8=yNScEX0=CkC5o-FAg87Iw?=$w{SDH{-_aSE_;A!8IRh}kfQk?ANf>#1}pcZcc8R*p9PqX;qpG56Qgv$8NokCtq zzHl%)C;U2xoLkVc33y~$L!;8oU-j|$!0RIQJ^J8B;~M}gAZa`r_M>r9gB1`00|hL{ zv0xw|rr1}@aqjdu`3;q&D#hbOT=6Jzpp*G+n)V#QIO^1e-gQ38cVYC0dVP<; z_Z}kp;A=DE%;40BbT_7qB>aT37grBXE zpHO|FW-)iZ@I=fHBFJad5 z^5S5B&iI472iPQ-?sl7iIf7*}GqvDTBUzk4K<1W0*-XL`k5^>kG$G48TD#k-d$thTrL>7-<-qPT;Kce$-wsf%tRlw}i)uw8UIWphaJvV)em<<5j~> zF#$jy`NxykvGBf3Jo7Md%U+BWW7pXaV|`pU>YI{0^D)DwSqrD=huhufS)YZR%GMt^ zXw``-dt(V&sgv>2DN0+VBet?4F|s(dZ}3AtJWJtX%QIBOC3A?+4dl;8V!}%0GU~}L z9@4an&l`C3-38X-hva@n+Eoj0O#8#cY@mKfx~Qw(JWG!W%+7IR(>uR3BNVp<$P;x zd&pw;ZYYOY^W^!rOJL+7?VEE!MFZ`(TSL;8NqQVSa;i!dxXd4%g(oX0<2FSh#9{?$1Xc+~D-2U}ICYah>KI-Ak?0KnT$cCT+aW&acjqnY}U$?zh zDOBU9TnqjpqJCn0J%On&A=3)STF)VgY@My6j8V}AS2Vij6~B#(OR(}J4^(mL)6)#VVNhU_<(`qJv#J3QY)BB)6Tgl> zycVuXMb8j?noP{`dnOpyPUhIM(vq3nE2inC2!cp)S-jyvFeZ*urG)g2P`OUfSww|h zqlI}f16(D9z(QIe0>4_y_SW(nRcuWL{+{sziWvMGJWiNiGXWqE78z*U`#P^J7V^

    X=}nY4eA2;u>Nc5pbd6}>@~)>qI(K6w|x#-LsR8)URyI$OdCbTl4FGx~VN z9>3>M`h#oJemKDm9#Lj)=Op{o5@!U_ZN@AayG&hJv4LW@`b^i@-K@Z|hK)eW&otg1 zYeJ%DhQBX^fG;8io_}g?a%suAlOqy2D)rZjF}$rD!oNua>C1@I+5(bNXcIaVKrUQO z7E~i{!?6|%qe2W8vsgi>PWw%Ig_Wn*nph=*xO5a_Uk+@40UKP*40g^WL?qF%3f>W< z0hb1-*$rQASHk@m7B0+}`B+Fce{c+UucAV4O)$;1!kJg4_6yo-X~WR^R9}c zBsm?|M|#z8gsFcH6k%YsxGaOO03y|aRR z5P*;X+7|#^Z>&C77|`kCF=_9kP(Sg)b8VrWIct-%XMPZox}PS7>ct;2zIVN5*rYw7 ztbQQski_&3LBgxh%wEE@;YUMcJ2XbhFWJahx zr#47O{O)?P?x}NN0oYO4e23QwjmNJ^Yo+h$`fS&a&`fKo06;RX2LM1VCID3lZjb-M z%v*NdZAwUu_aO^T7{iaHK$gw60E9t=&%)r%|3~+L1x!pr84@Ag7OJ3?NbGi1UFq? zL{xkHHnS`+{lZWt|9AA{jh{Oxk?oSah2`gZvVB0gny4Gx*pJUn&?Hvq{f1HstbAQt z%Lq9bFag0n2yPl?Um|=1fdpwhi8?LX2Ht=K9-LQnO~pRgJ}IU!^-ygCaH?lncwg11 zyiCko5&I%U@jd{=1E}6_hU13+VH#bMj+A{EPpI)gE#1xKkHviBqyh{yZsb>9gPw53Y+nNW-IsuL(bmrp z9+ZJVB}^^yLMxHG96*9d2Y!?A;;dHtsTmR^;AFck;vN{h(kx!n+aEc+!%dR!Inbu| zx5lpu+<&aZhmzcWDZ{qDf)^!ur6;JC)#uk-=B|CvscZVVP=QtO_oZxyo})i8j9Y%$ z{)!*c6`8_ZC=tTIB=u8xd$xp!puCkk1ui!)Eo6N@Sr|bgUp)0{IlEfiescc2nSp`o zd_z?+EKvRM*sghZKfK1RPTchz%{4=C%Kh8PU+my6&I*aLp~wgHh)W=GUI@_7o=f^ zj+Kf)_Lu3XT%{0T6|i6#JdwikKJI_s;hVV(xW)y*`F>^Kg8FZX`zk{GH~jw|5h(Rf zJV@ZlmLT}WRwN_@6f^(=p1HwxZpZ)<3IZa87!{9zkPn}TgocZkU+Nkyw}7AqDUY-> zeE=N;6L{){2A+n2CuEnvnBBapt;5lxoy+Ivc}_3C`92gl79H$+WM(I&c?SFL#)(wV!8c>?tK3b*-r< z{Ha(M-u4priY+gjsD+-3{M!}1k9-w39)&+!*>m%@Pj{}-=K7vM_E=5?lQz|?@CAbc zdZdyhE7|$24>iJU()MEl9W}geTmqIztnrlAktS=d6w!0;QI+g{OI8KdY4_4z1tMX0 z52h!*yvr{UJ)&Wm~!nOSFo+lK-(Vh@tjdTsKT z_o{I$)5WIl_c-@GGJ)*)bYc_gYg?#r)#ZEUn+dJ{s0i`iu|p#>S`tahP~q3 zA^xho$6hRa?1jXmybiPb22DSKqr<=$NPyftxDs9loLb0_Ht)r zY_oLZ`vy?A)@a$pbpopuhiAgd_s(Xi#UW1&L}nS&lb)Ig-j=)faNL*K!Z7}A$7V5G zRxYvOxT*^^K`$4@;g&}1!&TH!RK}zMxlaCAC3F_7af`gvjEt2uJ*fX0J+ZI#m z9wTKo^?ut2d!e)LN?5@uh`pvQ#X1VBz_{pT?@5I9&(A`*Z>3oQA7Pfzc*>Tq#X*Y?a6G~*hKh_t=F*(Mmz8sSWw`2<8T}C0Orj4> zUvwnfGg->E$g5z*N-gtfS6|`zkih^|%M#shl@aNV>q3{T9~O<8G=Q2itqyey2n^L@ zd$87scg6SFOR}IXT}zSFNwz!rI&7N$pd*j&O$hM5bR=fInoXgf z$K^*|2X^7O-%*I&$wtPzIsfaCJzdG`uSwt68_`L)1Nke?LCi+usJomw_Sx4$jP9b5 zW3^jAI9UVHlII*|B{{36TWW@49#zIhS2@Tu7}RR*8-^WQn6J4kuM}8*&X{)SS^93k zQG2G!SKqMY!Us)n{1Ig#b`#%C!2a_sE5t@NX#WTuiQL%181H+GcVC9u5~NA)orDfc zZ0fln_c@@wc|sths~KAETQt}l)$%V{_Q0&I1JRK%aaPVe9`XwLM zd!qxkT2Z?#ht|w-%Xx+S|CZTo>*+Wn^oO-u+i#~1?s)o6m4w!f(VD5?Qe|{}Xh}ln z#za6R@pdj5TZ@QkHIiXEP)qYU(Rvr1de->c`7QyGyEX)x@l)j?)8;LlPaC7COz$L? zvpWv5x?wH)#D+afv}(UsKbU59Rx+sD`dPpEOy6$s^}|euke!4EiC3nf*fEB~!Ex6D z&8=BPl$cGB(d-MoGV@UlGV;(9+L`K0b9UHzpKZy>7PLx%f9}0X z;qY1T(Q>_UrAUZpB^UJBD^`!S$ycXSFZ2(#jQk!9m3x1yl&HHx$qX8}5q+6e^qbV9 z-nbJXOP<)P(#zvDm#RL|oLu-B#nxDCb4po#i1t0{3+CQXa{hv$wFX(4o;Obq1FL7( z`q0iZMfGy}qMPMrE5598T)6&QM$6b=aBMa2@XmYH^r0cntNm(^*@{@6Ph?YB(yBt* zYXd^`GY11gv(M_3u6fyS{Y|@nP*}5I!LpR?xM6wm+AEGK^F`Jb`ZBF_lQ*U-l9U2= zZLo{t$S(Uv9?!k**f-I>6F)YmTEw@DjOrhhX&7~0oR&||Un3b!niycceXDUb?RvSu zEPLASm&Yc_3sV^SpHvN*A3SAu&aWV<>qu_Yn!=C~b?ZEFRa4b?jKuy0O7cMFp5{=J zF(a!!jpY{y1CNH8YOD$gjH(Z{8PlGlv$m_kXT8_|RR&xvDw{O&7o=liTa}TwmPJT@ ztilWU4&V&8Qa>>_tvkl7wn`fbj#q~CVG`SV{2WGqM=irg4F3#Y`-Bu71 zHB8pI1R6Hp_?Pg`FIekH%Z8d4V06Y%knRd8?cf_<@U_r{R-NCHeEp1*+!RAH@4%8v zV@!JTn6ohJ=2n{Xc7cM$4>v+Yq~YXsT?}$4j|ntq2&(~=!8Ku}njbYQjOm>nXA6eL zXMVCtu!97d8-BFs=kMF+mY<^xw6ogiV-I{_-D%t_G1tfL6H0&jXuUc4=!t6#BuBqc zdkth zrN|u+edn!()`XVEsyNf3eW_-?G}U-!)s5~d^1+5=Iq%E?BdA&sC3Rtg!jMlE?I3Ll zj%f@#=XINr1CArMw^b#PLTz@6|CJ(x4)5@@{ze>`g!o>?JH-5v{3u9Vj@Prr;VZs^_JawTFMmBe8Mw_{o1*X zn(0JNslSz({F5D5uc||TZkd}QJI1P!>FqP$Jd4V*S9~L(oizzz@?|TsZ5Cop(TX*3 zIP%s!*S2xpaZi;$r*7Z>mYSLBILFY$cpaUPV1~0~|MBB{7ZF;BRJP4aZr~YNs{&JB zQ)60k!ts7u`2!C>0SvDP0de-t%*yLt2F%GSgAHm5R;CKlU7h@_BR<@jc5%Vs$<^Bo zjVlyc^2GF%8RpeE>XRv`8@OL~eJl#*r!emj`;DA_vg@y|Xq9U~wl-u(xOu{$)Gxsb zBDs1o>u$NH&oHKZahaUSeJsbFL|MOeEVOLj&?QKF&ANQ$bL7u2RQr-2%YV`7?S?H<#Hdc4E3%!#VyP7dK2?$IY5lqItd-be{MKE=Cg=NjwKFCuaBB$p`$vg9m z;b@U!=tpPrtr!OJBMj`fhE%&oaAtb@zOsTJzDt+Dn)7|LEB~u`{meQ+FXp4b$bSa#_7Vw>%(uVIVwh9Kb*XS+~k~LlH*+|tf1q0Y&G^7 z0g*kMf_iaog|b38`(7DgusY&|J#qb<&Hbd_nV|~WHl==RCPZ!X$@`$;FS*Cg9i@y z=~A8a13%Q>Of6YK+6cM$$(X5msLLgH#`epTT#QDR3OXLdIs#=dj~sqRC+05oWh?+MblOc{G+Hrzyo#->j#k6NsD z$3MyPda$0{_h8RwRT=j8p9K3F?d$c%LXX&6{TW8T<6^YuCY||l)1!y+s54qx?|SDe z_=Xnh1G-(g6Q~8N0oFd01T)Nh6)*jM&14V~cw!&NUJ>%|o&+C^UcoV?E4P$(kdo z<+}Y`poJpV)7ah!XoApLxzZ@lT9)~>c-PAIzWrr-D!ei+kME9?mUNpGDRuX}@O4s*T*AotHQ{{=DMbbinhr0cF9X`GacO$`jYS{mQB-EXcRJ zz$xmn#vs+iJN4L|k>;lUCi4f6a&BYwRJcBiWeBvyWpL$pOH{s1Y?iTs=W3D_Ag0Xi zhaoo6AHLo}fz=L$JUL3f`^BlZmDB6@cp|;KFa8pfIP|Rr?)E54f{3;R)(6F}8I$+X z(fy3yGR~>{)+`J>-Lh)#M%tGAQd*^KUivYuJBJ$gm1|gp$jy%X&d!eJm}x9Vo!c3W z-}|PKpo!tUg6d<3Iz1gP^qCw;iuq&tr4D|Wq|bP#Y|DQ$E;+wzbDi0vlt zYnD>BxgGrnneJYKNzQ?bmbsX=^0M8}zoAggye1}9sh`nvNY)+r&gA07PW)`eGO{reQ0#RAL&d*GJNVt*JIX)$BB3EKl5ie7F|yb@ z#B{A_Ul)JcLu=yTQ6e@O$WxCWX=ieW%qmcXggu9ng*`WOSW)_^iRV08_puFqfqou) z@g?BoQC2;FXj|%3>M;5Ky6!uEzr?B**zKVdEI8uf5K-u@_eEFTx|Y$)ZxH_4l1)fM zr&<60QOPZJ>PJ!2gmmwo%bDVh99ej+no~EB0mtFG6;`s}+7~3&x2+(IV(()3Y&gRG zN6vMm_|2v%TygXh+vgFtO4GQO;)<8v4KJC~J3D|@PiADDAv`7o78{tBd~I&fA`@is@;Y8{Y0>`9O2?s<|d1d5O|$K7Y)&Yc5$ z8T`RrJM%_jI|s)b85@KjdlI7q<;@jedUu-RQnc!)oJrn0(ERSxH{MYk3Vj^1{)fW#fUTK%>KUU9x?hf=A1n z^R7Z4VC2m7)OXZb&XBlvD>$pROWFs3&8_HQiIgv&(vS- zn0@2bc2&4@V!dGEr!+xo%Sp^)%0^gBp3~L3HaR)ZeTR-tWOEqe)5eK zi8@}P!{SD#GTH7qnYTAqwF(uv1VnV|rsg{eSL*5h`gw<=b3oF?LRdJ4LV}NqpKQax zTA(e|fwQwd>7A<}JfLub!UBpruY@hWffN?AN$Ii4z15nd3(DGOLG_UIuU{e;uHCEp zlC+OMsp}wpyfcIA&G<0>t~aec%jT3-n*By{3(7M^DY^CR64|E?%J}i+BTv*6qIiQ9 zqEw%A-83a5na$~F-XSF#^QwM=5b<>5ESiM7W z1(0cpl~0;IWGuiPT%n_*|G0b+ZieODPGmInF5lKThrwbzcvmvIXW0agS8nzX0e{NW zt)eyX+{#62-60~jd8gkKfdS>xDMsYcea^)kHlpYp_9?tg9tG<&9nzbXPoS$kJ{44?veywJ3iTT7$G?77&cIkp;v{_dGX(Jlw2k zP9Dn|SgUT@uJC331IT-KUv~z|WWh^V6_#zXB3b6{X`DaolERM2Y=B8-R#h-t*Y}dD z;t8>?5@|D&d52l))eiFgs(Ro|Zvs!7gniBDPEi6*=VDD?D! zFI0|(TT36VwKeopjwlaaf3DQk)hnZTt|#<{vHe*BFM3?k`lI=lWs%v+{8}c3+u|Go zTxiaDmw=1E!_QHxdV)n;&Np8uBiG#tn{m!N#mBu6`a@_H>^JsL(>8d_Wayb1;vJ=A zbz5$bY$Wrb?e{qMpIOqyB&0&`C}|d6l*n(qjax5j{H`JKD#L^qKwOy=b)}~*a#LIJ zsLQDqbVx*Hvu)=mPx95)CgEqKWhFu83yPNwShkN{UESete@a0+Ox@V_^R%@-{o2i= zVLscZ_tFNY^VHZwY7edpoQ3$dgp<0FHhRj+qfOh~(~#xi!4gXSg4r=s7F<1&Nzi*6 zgZ`H0NT7Um9{BSKqh~zx1WXh>W8eE2g6$dXlcttCbVp>fhlJ7Sg9!0$-;E~EDzp>a z`aI*1d~Ao+bNhQPx7Yv6e_7n-*Cv+5f;}Qbz)v-J)$D?2BJ72Bw;5Oay2VS(T2mPGg(?bNPc%ABffNcB=1UFf*TV<`O$d%N>LG1lFA&9dG+Qf=Q-vP zWYkWd*af*f)O7w<8bq(8^M#h0HtM-szRP!|7Ua9A&9&lpA70fOsY_&0Y9)VCe2a0A znWazq<&wHbK0hKqbUTe$POC^ODZ_1I@snU7F8ap#*#dpu)5C)pso;X?P}`gLBx~{F zi=xdrW$1Zy@Q*@BCe7c{=i=j&EQh@{iKs-EocJUz+2-5j?%bN?VWq1>s37+$USE?o z-t3z>L-%HnQuuq@qRyy&Ouo{ky_8X^&EX5f$D5lkeBd?QS2gm8+N`DZhQ%*|Y+vx( z8(5bBxjes?xnZeuO9$gLu7{03hosA+$rtHx<89dDz1Pc~;kyKQQ7L?G!s}Cc-@i`OU1&R+;U-3kmlo(J>c1hF28Y9HqU#vR?m;`fdBv!jX02nngsmPDFT7;=Oov z$s)$_eXWF~1fm8b-wr3;?Y*p+#kDq5C`Bo`LPBECi#}WKH&mu?sLY7LpKyYE*C)JN zn(qX`6ZP-JX!B2Vy0c8w`RaA1nXF&z}k*y0no%^W|GpcmsX`U;qIBY0AlPpqKav`R2Pm3_9e7*LG9YVdi_xQ!) zRdW*fxvmJwTSbA{;T9_*S-MI1E>r`9v0u5qP3RRomZ2h=<28 zly%PBGe~aIVtLYnE0QJcjiSJlj$WTe@t39vB7@V*4h`s}Jam&xeBRtE z%;MPN*%EES{G?!5$nA&s7U=$i{$JaKD4n5$m8D;YR3d)YxzcitpveeMn^ZyoPm zibZHEqj$KG+1=En&;NIUh^Y6~I-xB(;~3>+uSE5ZUnfR{)%bS|fkC4<7&IawqavfC zB7^_TcNH{(Kk0|Bi9$d~OsgHwEv@4M#*7+TCL=_2^gO1n?RX3_&Sn9!aXC-m(IO%& zS_CKf);K(-hnIk|AEGT^NjP-q?eLutX(lqg{M?~S0BHh4VP}V9jReELOfqkeTT19m zn^V31@!56BZ7s*aCg1uv6H%5Q&5%yEA3}ceGIV&%NKAS(YBdB9Icqc|Cgs=>k}vB` zp{T1ADW=tup+6!_&-Y_|Jvqa_B4`!2h}_FHCIDu{+mk(FZ`#c6NF6D~_Vjin_t03UK z-rD`~uxb~_&wNVKD7}>1nI;`8-hL8&T0kw%Ddqw>fzFYaR_Vp=IA>+z@YbTlCD7|j z^>J-d-0j*D45|C`jWBA0Jl_sdS9YtU#cijG)y|Y!hM|jAqQtPe5~2%2MKx+`0dp(syz3`xo=MEA5#P^CmUp z?dvg{mQ9J|XAVAIv+J%)MbQ?xUh-J$E3&9+ujKIF&EuS(swdJ>Jh$o&@%d#Js*lUpA;OS7)5hfCb+wlxnNsgrMvIMG*Z=}<2Zgwiy>6ZU$#&6p<=*7KnLsNx{aRkWoh6s1G znB)iG>LkYxAYlrhm+#$x38TbTE2cu zT2i1FQDT`|QW(sy&q)1m!h2mpA^!I283;W6aSfs8h!#T^JOL%?E*8^Wl5vEiQE{fL zHyuE|6D|RcUv?jJb1aQ|{3Piyrn(ZN62E@FA%ei2eC!qKGyUAhTHtyA`6Uqji+MB( zDGzz9n8_C_w3=Aks_6}3vqF2E1Da?$2A|bPgkoKhkyi9@sEs%0{%_BxpQC6_7KY3S z=m{Yk+-d5=@2*~9rutBs_{y+@GJpBS@A0Q3%n{De&o@awgWr`GVChcwK|G(}xYUe# zhAGRy_64(7JKF$e*_eGDl6V&RC$x1UpI$Hf?qe^o7PFf$LH3)9~PEAakrQt_K8MU9Ffvpu6T}B zdG&~h476K~*byZdguyfss*Re;n!M~n>|$fk{>=rFIix!oi*a4VhM}Qad-2sZ~i5Qwn8&ksm4rMW5%W{BvbR&1`T-$Bc5UkxiqSno?oGoPm>a| zO1e#`(WD8VeZoD`$fvc^+LR&66UwCdJ!F_ofqqbLm-!$Sy(#jpK50QSmB7@Bm2RKO zSe-burreS+`T2qLDO~-CPeC>%fe{vg5vonX_Z*Bjn^GP;!RrnlZT>8+?fiNj{HjI< z|A!=Z1-2l&noiTMFl~g1bmkvu>2z-c5pQNHYq_f`_3-(INtT3iKb@#O;TSgktm{iy zlHQzL$I)-v;9+r8-fMs~fhs-+Rcd~@b-!O`S%E{qCKyLR$;7NBOi5QG&er_F^JO&h ziI_4xpax!{Y%U~EZ4B8PEDhe9pxYj(>Rz8HVOq+2-ax#FHYSR zwWk*%*cL={p=z*7)CN%jnHr+N)li=NWl1F`mZzP}j`;k4nRoal6?(1E_ zc5-*CZ}tiT*LeMGB2vd^?MrJOhJ4(>iB90bBX?N;VWwaf&XB5uN`XS5Z6(Ap^I9Q# z1=Fr?jD&5~mGq<7{ghN0JzURN%-SR$zbC{o z4K-v`$=N(B8ca0iyQL(Y2`ErBtJ5o4d05hH{8Y524oRJeeesZQk=GMVIOOHy*Ov%%`2Ox3fku@83u_r`(X! zyj^AYmbceI&HKAqq9(_FrXA8ggz-fLvL2r05u0-HN<hOL|j{3pXA z)CijD7WwO|gvvDzHg(72NA@IVSl-$Nh6ah#eXnb!_84>>%0vl!>vX$&YVR24;H7zt zUH9nzkymQmgVi50#Im1M&!sXp`{=ry^@?(wBlr`3jF?9GmBhsFKSZ!a{SWruDk`q8 z*%u|a2X_eWE=?mLNaHSzyITW|O9%vacL@m&jYC7@K^lhycY+f%NRWic;eWn!_TAqZ z`|QU%?!$dpYpykWjycxqSyi*@SGB6nD`(|~$g2%kJ&K}Ca-389Dm4+uiS;r4BCath zT$P>#&gZpXc~0s}7Hu62mVcO{Ai=3(^{bQUa!~PjJ&jOB<_+eJ{06a+3j5NawTp^Hs{`M#Aw}HrYb94wwwBBJz0JZ z=aYnQKD!2WJSI^1vm0%e3a^5e_A3GRHj#bJWWLc&C>T)>lf%Lour8o8?Zn{c}PcxI4PZKU~CbO=0 zf8J4BZa={foaP%J1!b~h71Q$@S(1~4NGOXxX~6-xdr8gYdWuSM#3My3yS1Kbz_%6Y zZET4cG0SX~@&uiRhx>W8KeT-vDrMmS)l3#k$wVJdwUJFI0cnw5gHCVA-Y#M|@A#!P5T$4y(nKZ^M0fhVnAP4dprh zAX_g{Qw_e%3P2B0J(flQXq28Z8j)4@Q!$d_R_JtwBrCbnX}zKesTZ6KvX`Kq4d7W# z_xW%z)Ex~~f;0^RI$2NPC}krUP|93k?#$BeZ2yHE`be_10@HEpx)>6=m4Z=!@1oWI zP!Zxu1LjnEgM8-#MOnQg0Y9I+&9&&{cFOC3CgCR3bg3!EQhUV<{qz@+)te}+2!aF4q)b|EoLHN zN9vzm%%{q>4=0?)Rf8s(rEs83+QF>dmsOj|keKmtdF2IavL&1wq`tqN#c`+ehn^vR zB;Zz=dSrN&y~A}8u8}~0;z5THvPzhFG9EwgJ25*Ds4=rQa^7=Gh!Ki75W^jX@Z_V0 z9A+>R1LO5JGVtx+bsxCSo9#@0>wf&bxm6L3%-eNEUqddYQW}1u+pf1s2Q`;*0>+^6 z9}SZV?R|I@XWWF(m2$T($~$sB^yM?yLX~B6Y>{%2l;^ zT3B3Z4H=+D!s%_L?_q@y30CG&YQi?+jn^jVej~JBS4D<|MCnz#O8oiSX$jRxD977T z{36V^EecV(=Dp{kdc3|#6A3MYqBNBYl!Dcm)QX^*-IO5>-dM3uCvVYAPtKMY==Q$- zMFGEbc?}mRJ>5|qq6eiN*51o@@W~7(ntjcrrO*p8M>u|#j!{cxA07_QiTNEk$d|As z`#zysduB}D_A}u|(ykQPm1Q21b|8h(>dMk6%DP7Yq-lk;43VJ`BxK{oRVE8D&}p$x z8d)&lr4JJ>?DPoR)!J)*be7X)RZgrqXcnj(i-x( zISvW4w8_ya%Ei0F*y{8{Jh{)+Zk4{2`Nw7Ih}k|8t)V_MnCNN)O{{Wz8fX}PkOnxT zo_AOb(ane!wLiYjSF3%z$|Lr=G6#!z5`#}PNdKZtFPT}R zB%l4dH2{sp^@2YmZ(=R*t$=?2AG`1!>zn7~f2SckZsaf3^rt-+bCG20D+m*N#_R&1 z)|g^H@Qhqg?XGY9X7o4i|KI$-_!nSg9(n#0^ReBbk6|@)z_;5y)B*$*D2p)XZ1tOA zeNSD{J^@^1$X`h2X~; zB)Ne_q2AN@fB*SEO)&W%Ggj&piD?9I@iVmixH9~U(qeTQ%KPhL`6Bt}%8T;Q0xxs- zR;Eot&309#zyfDKd%GBJZdf-Y1oP@pVXo17OL{Df=8j-*Dz-w`^X_iTl^5TpAf+bdh z%*()Bup*YihrchuIXv%r5k4@jE5J5Y9B6mJ`D!<8=k&#pr@cU9jZ0@0`HyhDl>~_L zaTLAfIHO`PCC|5)p@{vd7*C6(-2-=T73N}Dq&>nGjH|A0 z8R)Etb;o+%kzKzLBMh(ge7*O|{-o}3-+b>#j3tMp*z{8mKd;JBkbKg7>DqSh7N#ya zImkN)FGcSjwqfPxIz94nixpEgnW&iWhneD`u~*Lya}WwQOtnxu zh}8O3s3KHG*2xPaFR8fHCvs~xnVPip0K1S&1Aq;-hPMyDs*Ubck}Dd1LuPjnA%c-@;?%nM@nt3J*fc{&+_2D&#*(DQKhJv#UzDc=F7GH9&N z!jU*{|DvoUh`DEbKZ`L^ABJgoDNIR}0d4B^hT7#|?>Am_C`DtJ;t8-8S%NdTJMG(Q zR#bBHzf~Wa#n+rHJTzIl;Fz(eD3pHTBNt&V<>%UL)KBo?5)ej(r-}_8wkuCj;&rCT z9MGayA5MBU%_??sJ*V_G%g>D~@PwR2#_cuLzP+Cvw&a& zZY0`O*lRSYtME&Yj976?6ds98xUqPxz;JD}BaaMuMLD`qUj+4_&Dn_m-QMaH2{9|* zc;|sOzbnR*NbN>YE=VH%gE)wQ%etbg((=}guX+k^koSCvC5jm%UudBGQ#_^4!sOJ~ zyJcF`B*B?4V)jZtN!1B;x!!ju){|Mi6St~g4Odgfy3Nj;fKdnDJmW71Tp0Wo>C6@~ z&efvb`ps73Pbv|Rn^Kv^VF}`OqoRa6D4N5fvq5Z)E=7?mdQ%z%!e>fhF2d&p+l3 zyb&XLEh0kAm#PbZwRUSOCD|YuX5;-^Gfs9-@42+fQYJ$CP7m60J`{}++az}@IvJzk zaPFm!3%S$!deNbZ#4*s!#uurHR_+>;d;+GA%#Jm(>n$gw?e2vLu9|Yc^`O3{={#nw z*CD}X5k?--Sa>HydT>)(n3-n?G3ReIk{-gTIt2&!$c zgN1y|GP(v&$(n#yf{LVmc-bl6pmKjvo>U4#%C->2iaK?WINVgVJn5STY_iQHHE+L4 zT=K*nBK2Kx?*o2dMEa_Nu-7%_@XU^_lKK)Huf_GD=#JxJD#cakOg&ZC&Zy&=&p>Yr zA9>S!lY%0tGBWzl`2BMk%Y_bukN_I4n2oKM+;$%(3l42pE^kw+P%hc*lNwv;euMW2 zPRU2f`IC5kU2=2XbaxW&gf`+^3ZuTq*{^hCvr14fj|6MbhH=GRG&syO&=A^hAj})$qU3jW?z9Qth?K9!Yf1T4cT#9M;Sgc( z=^rVb;^6FS>eS4WEq5byI9iebxKFX@y> z`{BVg(~NT_eXwI3Tvr_^Eu{E)2*t|7PJ&$oqNifJ%dN=jfPw}BC)2nru_iOk84q*C zh1-Vj-~3TF9Mm6s3dSgn<=pLhH4C_@j)F@#!U{Tz)R~pp9KKfIP?iSzzweRG_;ZeS z^~K)O(Qb|zbELUrD>rHpE-Wo!rr3RPW!js(l^;zMQtWr?kq5d3910|k|LGbr#O3y#-iEEtRda1 zQ>hX`=^pi!NX3=I?>qln0tRHszE^hKom$ZQc$qU6Zm-ot&W&2$iWsMjS1s|%442tM z9d9MiB3sRoGJbvv3vK%#ze};noEg9qOSSer2=_Q#c*IIoT%*Hv`Aaq5wr(9ZQLW*0?N^ZH`d`8A~0^yIuEhyEdi>MZ%gbO22-cMCL>+ea)&u zpQKoQWBIFW9A?m+MRD%mEs{Fr!PFx#Q6e!mgY=Ya&o@b$)XsgKQ(--@?yf*rV7qeG zRKUb#&r`5M$oQd|lu3Xoc&V-RrrWAZ{M7nQ`kl)Fv}GnRFV<^Lx#0CW>r)hJvh%3> zWCo!s<5=RCdg`|E&v|#)VbRYZ8Ihy94oV8_OZW$288;7v4npgOZorXNDQ~V|L*xiS z@+yYQE|h8fmWbZSXx%qsYXM_D+Tf*Q)O80koDd{SnP?uihj=w?fv%E8aR?l$*$_lP6NPXeS@38!WfsZv0`+}V{l`I=% z$4;v*BMP-Dj7+L!jlkT1R!{V5ccH$YdvLZOA#sld7I1TNa@$51`cvtQ(1zQ3oY01X z=D2!OEObmW5dvF4tCjATXuzx zzYFg6dHYysyY%u4%}9j*LI|W?1Zty*j%flB1ZlOfZ8^HZ!Tz=LPes?PtoF-(nd(z^ zgGzLL-;vnRoP4$=G10u_PdZagE86VHqD4A?4^d?icbN0Xl2lr9jP_3|B!Rq>a}TXJ zk1U4-R6y=oQpfz-O`Huj{pMs*h_^uM&BRkD=B7iMr+kBJ zJy9o5V3CUtqHEm8iqC!ZQ{&4Y-gr4X8NcEewSJXk*bVlBUqL!YaCBJ-F)?OHG~b_c z%(xsbJ7+)?t8?ht0uPN@(?*(I6be;4DD4aw{+8yjt z<8hL+Ot|-N3@pCy8y!|Qm)P?_3hR}?e>OjpW9AZ`qt#O()+1t86LwkA^FA;?NgcKI z*va1tPh0rf|K7s22zZ2;(eNf?*2C2>R}%p5tySAp3_tV=-^%D;(koj79TWD0q-Xu= z!t=%~R&&X#XUy|+UAx90-BV6Dem;U}_L|d33E91vgtq4v7kUl+!rb^-8H$U{H*jlC zM($9z7#>rpiqFxj6sm5_?Ahz(I0oW}K*+gGd4eAKhZ5U!c<{9h&voH#mI+oOKRXFK+}MC)prcv@3My{7l6o@+NdiIrk@Z(|C*ckLvy2WF6?*am zxekWA?S$_sck3B>(U?-u(ou9s4hIh4n1=)J-#wJxxBNkh;EjHAvUW65&AL1)8s=?qCO#E zBc>l8!24On*Y!+Bm020n&cS|Wxq<~)VJ^jiXr;biBTZD6d2K4-1{9ZVr#e?`yUC68 z;T+HQ8mMp_?zb}ueR;IAaVA7CMvqx%BZj%h`OSde}djzI>?(4z_{0 z_SZ?WfrW4F-EY)p%-lsRgL$rcvA-z|Nj&wZoMQk;L4@h_8)2;WP*G^gTbF1_U=iNmh3 z$p`6@HEpKQUY2{UIu|jxWZG8Bpc){745^Z|&m)iD)<&=tQj#(G5z~>7YbGRWq|`mv zS!rJda_&Vi$8k-v>W!j*U~y?>JWNMPe?9=#(1Rz;yY8}6FJNdB9=Zz+Mi08Qcu7>s za@$?1>XVfULYhU6h{8Wm4zg+(Z4gS|M9lL&1MbDBFrwhZ6LX)*fvQT&IYkcaq$;e?`Kk`5E*8MB`FU~ zZKn=BDn<@8Z5iLzi1Tr%>E`%<3a>TVFYYDg;+cicgt%;0dQco|s>d?=v^=uq;m9#wkfWxKSWx0>Br{M`WjgaV zu>1S#cP4afSC)_XzDRk%OX^u=icBuBWo0c^zrfeQp!DbDOpG`;80~8-SSk$QUsytU zhqtLQhA@isBN|T{`YKmT*ZL9W&j?Z{Yu*ml3Sdsy|gtH3ISjjIcIT3miwVuXY;qT;TxHd?J z$h5shQHpXgz+myExv)|5`%~L~Ju6lX)9K9qEOP&40psG0gghgOpDWt)dQC-NXlsboG~R|RO+*m>#H6xea`Y9Nn~pA9YcQFb@#IoMN+9GVK+YS_;&0=d_Q z2qJk~zP8V6CSU_lsj%ZJhe6uVunzxnD^V5!$Csg>6yNc-KgOD+tp9wkEpyMf9LjU4 zQV^P9=ww!&0GIi~3IGo0;Gv?DoNn|0GfFw$G?5#rKX&){joIrD!lyik;j1P;MiFdP8gOH?w+7*vNO3>|Y~*__l4!jyX)s$SO}l?w|{b_UGo--EiOiJ*1#HAAIgW z_i3WVjZ$c)jeQQNnX$V^UwuxK=-V#6FqZLIGdH~T*;_)XdGD%|Qr3*GrL_$PeDMhv zTGvJ`@2>k#db94cpZq9iRXvSA8y#LAge`_}edGB9Th$J-y0x4LnfQxRd#Ar;^!s1K z3+*5IIp9N+l}NIB*_-BxOBzuo#}|>rx1`! zqo);CQf($P03#`B7V&J&i=g0!sMo$bMDGuH0bVQ-aj-%H_-uy-t>1rp^4+0&vR+6D zvHMZ_`b}Q_)^4#fq1;>l-9YefK(RV}Lx6K?MSzFIbOF&xM}M3`8?f9len|h_ZGHcS z@Tb`M<&W4<8rv)9u%wS^4J_IYx>NNTZ_g~caezz~14HpXZ6ui_`A1UZQ@{nRzbI|V zjKR6y=M@GTLKd4dx8j$hcNzH)pYFC_golB{(gGPCTyFKhP+7IXJ8q4x-GU{X!me`U zCY5i)9)&B-7e9aPFDm>x_lF4M{Zk(I(OX~%hZy4S=fV)X)r1nxwfQX#v0DjTd<-vX znAeocvCur}^IsI@PNPsXO%%YoZ8$;r`*7?tIpQaosuT9~iR{o4a1GlUv*w!3$Lz{T zte^b<(o`1nLsNKS8}Jrm)J%Ne3Gl!Ch(^Jl;Pb)4ScAmCDbtZ>f}!@7Ba4)jvmvHp`g| zbS)-|2#^Dl(Yrd0#H|XN?&EBWaaHm&Qd3Q!_kAv%?Kk0_=WDnPN*SvP6hhOJs;UB6hQ_S zU%PXM^bXcajPD9dVVS%LJL>KP4!itk;-F8z897)x{%AMZ@6iVKbazzl44w&^{WJP!!=j zNCPrF|Dtd#GQZZOJNFANKisjPNc=J0mn;AqaG(lptT|w^TK4bdb{OCM)%E5%M)}ac zMr)fa!WK#^&3Qh|hDnIee)z>m>)iVnCHcg)t1Q!_)vSI1IvP+{@~3K*Parzb_E$(4 zeBeKuDF2|0|5Nuk<+UR8{HEmvTmm}LA?|sqwArKJKmH?w;A z0dm2iZqrTM=WL|-LYo$nK|D&hK{pLj9l8{q5+K<0MZNFwem!6bxUV6!?X=T)@Zz!x z{l(R*%i9bYp*LMvY%&}E8$pP3#FYa{(7`}uv*pUNpKD2Id(qUGz3_mK3X+Q9x~HbK z+cclV)L~&^myiO?An3aA`p>=juJy~s>dTElRP#39(owdv#w7a@IlxQXv4%A;zZx?a zcf-D%#&B(~F|)pIf|FC28%nZd*Z%4R#CzK|KXcTws=PACGSsj}$Y9wf<%2m$XE`i@ z&bf3XZ@n=dC|O^Ymv7#Pr=}V?Ja^NyIq+h4emS)^IYWwSc1*;MqV}}}PMdk$!?rBq z*2A*P)BLy(($05ke$<)fee@JW&EG%9f{AEzi?CZ0xU6yyrW)(p!__ozi%=7&$w6+s zfBGCDM2HejAHS@nI(0B|BarRYGi83gUt)^eAQ?kijfMUzvY!KOmiTT-AHO`d>`>Fk zo#H4?{A8KndvH8KH|&}3b&dp$=oEkBJvm8s-ke#`j{6J4@Mb7A6igc;aA#lB>~g_< z<1O}__W4O7pyuwUQX;}`S*7t^Bfz}|u5!(8Cr5vp<#JD5z`bE_5fX#BA|7!tQR^I6 zRR{~EL*{VNcRb4_0DVRtNdj(N^KT>;Rem`|A7&f)JlEv_5>Pr*&C9$ndHnzjTNOZg z?Ha271Mo)hO&{sYV0Lf4Ap!p`-)px7N5y^4!=dgc!Vpbtcv2guFLVGgZ?n<^JXilA z7L^M)9=gF0K95E0ovOu;15HcKC}2E-$J1=;{l6&8 z%d+3n;Nwa68E~$uNT%Kr#=T7pve8bpXsTb#`I#fxpQZNs+-<%vxkT5mdMVZpvp(qHjWL zrPe@z&QWHUE*~a0oVrFPW@ylaLc-3Xp_^+{8tY_sh3>&h=?3C{*D%ks+YNCVOJZ~U zyd$Dx*|3*M2g!RLcan@GmWD{0nV`{~uwfBKIaK^OUy}Qu*`N-rODta7fOB0B zOq6!$*?MUIZqh;y9pXl#Zr?LD;bn17da}GZttMIWjSBX3Xpv7zD8v{w16iLUoidr4 z7STR&00-I*aqDGcPU&1FH+LoY`a|e^9Q`Qa?8~kKdP`~R7nKcS!|#QhdIVIihh~0p zjEk37r!YSYaJl~;!CW!&Lx!Uk-!@@iMX(!R7fo|wM$<~+V zMx2Z>{B-5UK|27|=W${0#e_QZQ#qDzN!uTpJ0t4n%p73}AKDY%-MiYDN}uxX5aOG` zSe?1Dqx`Br4u%zSoK*X}^6*kh zJ8_SdprC8B3aJg_-b)U9ZU!UY7ioR|?Y43J2a^qrE5D+p0>S%dc5v-y=h*>EH2d1o zEzKnITGxB0P>c94n_8$-s@}9;NVa$YT2d`1E7Kh`OZ2e|g$#@09s-OTmRj>*GNDCB ztIz?zu0d4S{bBYIwDIx1=@SjB4$1EL4(MviE{xc0r)z3538lp{+(6e_QFw_i_h+&R zor05p`E--3twt=#7fiH9_f&QUc@KSl0ZZ7sS6dANFOHCL2ZWA`hEJqVDY3mVN% zdxY}bceU$3jKplY6B3sS^+&Q_KUBZ4?|F7rb1SgF`Y`a6K9B!DIQO&79B#vt<=5q> z{iOMY{SG_nauB#Sh^Lms-#lAY2Amx6gq~%eRa}Ri^k(#F|JK)p_?X(#Z3s^NAJ#;q z>VcBq260Q-xxu#&Y(#rS5NOCY;WxrIZIzX5S|QB0-hdy&J!fV$gvv_L zeN}-NkA(RoskqQCwPRba53iBr^Xtfg){~VMMuJ8U%q`%6k3>XQBWMz~*WTa?hOW4J z#lQpg67~%uavgJ3qTiXtGtO;X>juZ(1srsa-vEI6QB!-nrtxiNj|Q~xTW~dtV(9(F z`GmieynF-;{`IT60DqjtO;~J=`^$naGGtsLvkHdm4Lxg;>(;%DaXIL1@6dlDSOpBZ z5*qebO=F#s^79U;1a&IaSca@!SEjR#`enV`D_r#sMI-Mn8ieC$OFE^sDI8%bnCK7t`+IKIw)w z5qx@#Ase)^$OzTN_EzVHv>sl&>VrlFVf^v#~=6JU6O}^xf^c5;LFAX5mDEY%@fm!p4iO5 zTY=YsA{!UPrS8aQqon46et-$v9qtFtzbKf#Z`222*){j>)(X7(cBO2qNiu4mDuQJn z&ncf$PORR@M#O)k^EFC(xmOQvM-PnLMA5VnFfB}s&uEM({_%?SQ*5LWv_moH)uSoh zam;}-DHiFd$#*jq4~lHf&lMRPkjZ%4-uMeMmu=IoPVY8?#Vbe(;2^651XAS&=-aX70)+pMjIu5A*$qqtQf$f#G(KP0*Utuq++Y)Q?uzN0QLU zfVhlbX;x8>K5r+%tFRGBAi7e6*oz8ZL8)YQw6A7nE_OTp$MW$~d}#Uk+x{=gt<1Q~ zYo4M1!XR_;JPPQy=YCERipU7ueMNkl&=u zAGsiH@cB%SP)$#5{&1vGFFs)VpdS|Oog+4bAC&CJGW~%lU|lAVBp|2AO!35c?Y`Ru z!98tHyAnmrAhy&xzS-CAadN32h9Bm_Rg&}<#pBrn)~(SGthe7{O7!OYsjN(wHa7ze z0i6XhM6a%56rN}9e$kVxX;$kkDSH9PRD4inp1ZMn824~lnx;R8=RaxyA=eyQ-ma$m zS=A6ySt@Cj()y^(I8TS5N<_XI%*v-LJ(y}}juLM3UX{x&`2zgvE;`h!G>gqlwUglas|k@%la=nT|FC7;wl?l%&6j+H z;Ix@oRtdqT2p6gjD&s?ZVqxEu4>VyPQp=A|~GE`9a zWL?z@K^$c%PC`-$fh7=5`xuT>RnEHLNT@GlO=1;~+A9|F16w4geROD)OU7ev4abG= zUBwQ}S)zrQpkQ|&;ExSDiZbE#kVT|dlflV=>p3b{##D=@3MD4KcUo6z6u;Q-I`2{Z z@uh4(SJJLex{grlh75Z3S+_d z8G@Gl4G@2TJpJr1FRsV=ZWxH2c7un}4D#iarIR=+obdq&=2@IE@ zh2h9_Iqjq_ew0CN{5~HZhQ(@{kAA0J%O| z+PR?1eV2om)&0J;to{`_q20YKZ93gn@;ISP<&Tq5qH`lhdT@ElC<3s@XX;l+r@lFI zx9{?#n6}Lw@za5A28l5ia7fy^z3A3`YoAk>Ff|UWWa?NJ^6jZ=1=lnH#@=zzKrVPC z3doh3G=#Tnv#CnE8&m2!YCVeXsed3w^QCu$*Fk6i0d z9yQ=+zo~w-6}%V}umAKabrg)&}|BG@Gnlbla6eBR&@n}wC@?*1c zllHdhmCB=NV@_MlDeB64TGfX68;R48K7i^cO#5QfazXqi=G39M{8GiEx5o46nITMU zCn{A&XmY77Dkd&PMFeB25Rh<5YrIqBHPYpG?Sg0CldX7o5BQ9l5d;3G$IYxx|6jnv zqMx!YJ5>Nrl@)su(ZUn%P@QPrQ##%KWN`ivC9q2Y4KZN8p;;miXnzl!f+@t{^4mm> zta%!HBJV#+WlPqseWLVB1>5xUpr#E-XKk$;^sZZl*p*J)m#J z;#RqGH$8lQLKi8YJG!rI%LBdC^R;5t5=+(RWAe_4!E0H;af*nwP9DL~8rjeB8bZ@5UpK%;vrhBeH@<4TjyXjmN!RdcZ_mfk+>_Po{6aP^Q8HPP^%B#)afr z1kbMu6bhhw2^jzqkaxgL9T$0qP-1!eI6vc4iU)%5H13@+=m!He#0CXz%lUF%lWaMN z-tN-=2_9B@=Vn6}#CT|9umN@k)~SVGT78i2`iz=RBZ6r>0a#AY%B-y%TbAO6jDPm` z9bImDRZEu?UTV!JICi7>w0Xa%2Ws3-PO|ZBt{qQ~H*gh_jg=J+{X$zUX*78RTC>Hcgf%{#x*w=zO6U288iVH)K&h`ccnyCo0b zLG=i$MAXCjXWFFXvGOp^ zrU8?nGI@a5fQ@YQIXT3Aevrp}?uyUb6#5zk&P(U~vFKBpk!=HCEt~ZoVZ!}@TY)88 zeT4copR%saM(K^cdbTbxQFqV3G4l2svT5e_(QK;4jupS}$~2-|PhKjknL_OulKx^q zNfBF^B;=KZnn!4hzP?R&K5g1l35aWcy^r0KKm6a&%n5{YUp|n4I)65@hrTn;xhqPA zExe5VP7*)@&ZBa9KWFx04@$G-&mdlOo8;ED=7n2NaW`xk)LrftJ*(<3>A_XB3qEhw z9~#iVCBcPeRmVHp98BbNTdS)+N0OXphxATod;8rTX(U4tqeV|K50IR7iZm(GUDY~z zwV0{y6TcB_n75O<1`T*rA6J}NB=nblwy7e{A|?Z3i+v`_Z52glj8LLG*0o$pue6!_ zQ;pC^N7X$>UF0)KB@79r6r0Wf@S)8W1hCv%%2qeYv-5V7Zo3HO<(yzQRn|G|4E z=Vo+aQ|1EGiR3jdkTj-n7zn0Ud*C7_uA>*4%dB)H6P&N+u^cXo+`U`S52fG zb$vM;nl3}jxj^N_*J1av$R1`}4!tH}dd5z7(bXp8)sZCDKftv#?{e;HjgOy^a@l~( zQOoyOQ{(c&bgJ+M0Nlrl33cm=%tGANcemp9w@o**DbBu6IvCh|Q@>1`w%S$xk=x;n z@ny*I;Guh0(MH|Y4TEE|KKzRjW`;hh;b?k15D}jaCiW5NWiVu*Nn2I3)?#e;MrsPB zJojb&)~g)c-6ojghQ`~nJ<(_uANPz>41c~L5$?PPjhWDQcGVqqi;$(6O4*qusq!yX z*>CwilKeff7-!aK(2|W%)~M^%T(*tO=Rh(4qf?Gkz>MT5}Q?qk}$E zCwO44b(~z5*UUrUwW$~pTmBRv{1wt2V5n^0GF!cuwm~cn>-4VO%MPv~rzA5#l8bZR zzRpr|$WkO%84qHP?^QMOW@An$O{nConKrPfF55Dwd;&51C#yy{>V38;7vN5>8(Ozq zAnD{xz|CeBTsrFsW{vfN{7B<7Be@S}#LcN9)Z5MW zV9nT#!ls*X)dOQ&$abHJL1FfbvlLm1dga`Qy+VlfX+uxlOqUWCgRtMGhFKBfj3uQ2 zmXapC#%>E{8*;7vx!gw+YL0?g%xs&`4SOAy6_)IoxKH3|_p7Y^-D?alJG!vmEFbqP z!(n%Q#4e=%swe6Xd7pS%*19n+EQYb5ZK$|4QvH<_{ITp!JJ#_F$L#B+Tz75A*6+0X zakGpLHse0JFIz?1zC%TfwTTwYfz`z38f58|PJS*e&P{r}lup52+KVddv2h1%n;R97 z){ow$JFynN@w-*3b5o_p>{F680}2{Muzv^xKDyIJ?rZj0>l0l^gZWLBis zF&aqAd6{k;C3Hya*3SgOeBN>YpEqx34-0II1j2HW*+36nlL5<2Omzb02An!5oERCL zZrEmPAZp(b3|v>ywUAEMfQ;FZxM6>D-etDM+l2Mlc0h@Ow|)f%AETaLj0d&g(-CPT zx8;4SJ|*rb|6iB$P=LqJs`4dzpz0O=~| zd68GMJnC!r8AxbwCOqK^quu4rce8BpnjKW(OoQvi%R4Riw^ zf(1c}1A1)*tcfAgh9{s$VWgbcNgXbl5@(!k_2n+yEnP}~ghTpObT~(x6b1E%j}F;e zfv&Ssi#~91@>rTq%fXY)?PL)}JL6TD{Y(BnNle4bRa3pk@D~%y=x>;n2J+Wt@pc5E!Vpaa1^`dzD zTqv;D;eNONN&diFBA*l$O9C>gx}mhAnlAaS&I#ucb7t>O+6}e#l^6y8uQMhLofEs( z394-QQ%!tLj)_qYqz3`6r-7>StLwgT?o(g?=$>88=@WZP77I-m5yGZ3+~w5f%nH4u zOlPM#V_hA;)Y2Qok!YdFY_tvu_Z30BGdv9HMJTJvrp4bV6~w$}c2AH?kvIOHfXcI7 z&rEf;Zb>$~NwZXeoJv@8bAZ@L)fS%IW3ui?A*+=4EbLs@P=&Kz+u79`e^4CA+P_`g zCk*k=v2}heRoWg$HT~v*YW!Z+e66X#VB)E6v|;M>Q(3W1vw!4GAEn%L>wISS3qGHD zq&kyP%gI>tw~8mO`JgB|ph_C>rVx;bst2+tHa1du$4#-xtElU5W7?kjY$CDiiQlw% zDhj!*3;)4rBCN2`(b6M2ZB_4;SuBUfcbupjq_jk-0bBQCl`YMlvPH{IyXqGqod zFgG;tDPh0B!ZkQncND7Z*VlFhoh;^&YOsc zCRk*xXoxW{1lq8gYxUZugA;c&e;-d!ee2U}AgpBpAW&P55WN;}dknDpjM;c&jZ@3o z0Y(yn7bZq#kuGZzzsUgOQhC_{Qvb{UUh{9j&R>+660p=&^rO1P+Mb3>_BEci_aF-z zt=?eB$Q6b;NqHi1bRw10}Uc zi!6YcACQ|yfD}uMi)y}I7nE#5Yz`U}*3TZ-efdC>V>}%$m1?v3Jb{E=@x1o4y7#-W zhDDRWW zccKiXbq1h;O~Byr3g1Q1<|*SQGejQ9FU6vV@!En zEL9v&x@SgkBfEw7v6LAaW|(pNFvsjmU^{FNw>|L5AyjPkAavp7 z7o_mZ?e?4I7Qs{SuuJRE#`Y6LY^bA!wxn~QY^ALa#y~q{b9ZHoksnc zIl@k3ediR8e`sLxoc0?@zLPL?nOtQN>?|WDQ?czK2f%$~ww*-S?#W)z%%Yx<4hWT} z!w3S~>&jL`*sBwT#0s~#*kx#_k;K_~K!=R?1yh50IJtek`cO}`*SJz3l6TZ3k=&eP zuf4ftPW)$ZBOu@OTccw}>~P(GtiJ_(h?^lUxxv;s< zN(~&^^zH3v4v^+4RQvYJ?e0*EtWQ*LsW14qDvHia-;4ZC4b8fTwM1bMfppO^#IX~s znO_c&)$1TMGD|fhcVe0&WK?>n&Suum)&9IWex6Bsar)!2Tt-8?yWDzH0&{{znQ23; zF^^p@XsSB07`fJicg6AX%b<2c{y&H>R(OpJ9}xY+F~P)G(zOO7i-Z-}+~-}BQI-_! zX&TF?X-d-tR2y=0#=w0%K;uOwiX$m1CPxO;l(`pwQFK4`ti?q#jGP+%=-fa`Gz8}} zU61}nQPbzkjHT}Ijkz4lFi)5yChjhtUGRV`=4`y7bD(Holy>kPx;`T$A%p zI2My}?eSW5yx0?(fU=r=LPfL58poI-#7BEa2nb2fnorGbqE>?s56u}l`{ak8MBJYz}ENIs{DZs;58t>Sow5W12m&k_)2iUW7EK9(w7Y@Myeq% zoOBh5tqUNu7>tWs?PMde%y~$o!ik^C5uyJGSC1jY#QDAX@Oi`uP^WpLv0|6_4e^76 zRZ;juXKSy#&i9xDd!-=E4Rj}-lWxD*IudiY|Fz`ht_~-mXC(*i`}+_INkY!jtvY?1 zpZ^^wwLQmE+zpK72D5)iPfB3a;`o%aLJ6I0o-tOGUH6_#{~#8%kV#Q z3E0=n`|Lui4HVbS`o7JDy%SO1BJ7ux>hl4?&$-jhrw};|St>NgDpyZ+hYQz@?6u6} z2v7bG_TDl&j%8UFY%w#V#TGNmvY45%#mr0=Tg=R|#mvkWGcz+-%nW|L_c>?oJNMr8 z=FJ-THCSrwGE#X!PG}*isDzdM4 z8eT|rCUYjMe*ofww3}~^BO$sLPEE@PhX-J?zhID-r_mZ#GQE2_`@_D%mw`lTP#+lQ zDfVf$nHN#Zpnc|n!1+GGSo*wjEjs+3e&t+6&xA#8E3zyR{wJlO{jc8ks%FB}w2V6S z&RqcYHe(+dO>@SEo7|uWsy+{W+ZBTS(_%Z z!|hmflH}ZYEnP%m1Icd<>0%=*QrYuBArU+8d#vQnoA=i`)w1ow%>-5K!yCbR zfu39ogXV`*mzm|Jv%oG{m1e>NC-^AZU*Ex+9mziE5!dJ%?FaX_;} zhG}-qzeZ4h?aN)|LS<3ab244iW?!u{f2y1zV)Z+eN(-R4qL6@-G32bt(*scMRjtd^XYxbtgZ#^N9N?m1zrR10|8?DNjC=*H-VXq&WZ zJ~nB*KGHNXe79&`#qSok$+js?(CI6H-AgWNdQ`8sM2_EN%pZGGD(;jI%F_wTh)jw^ zewlSdQ00_?B(f`z+wI%pJv64wvzSYe3cXUjQr>Iq0$KB|eEZm4(SF2$A(RX3ECI=x zhF_PEg|}O{E5h2iFO^)Bkg)459^!%L;hC@VJBCAf z<+Vi;m~ugmV{B$+ogk~s!_|(BJl@;N-X_-dQ#T6PcEof?X<4&Zt=d$(Nhh@*E*ivf zZF1ITYnZwcNa82uLGD+2!Q8F13DuhOrObh*8!gzcCU_}lCng}HlN4*MCTs1uj>c1X zCmN~Av$gsARL2(l6Jx$ooLM^0Rsf_-GH;D^1o}uFu0#J}BW7eIKdX_GqV7t1jd^)n zgV}N?F?pN3Bje@wSej-lVanm+h(yQx7E)R}>4g=vRs;7j&0j>}b|*k(vNNj>x-xX4 zCzbONR8wHe?U^V{grJbgQX;M%e-)*%r5#%{QaB+MUJ$T+j0>wnA&xJx>ifdRXJ0-m zh^k;i$iUeIMsCOC2~sg%X^}`ahRUN1P|9tUDI73Hj82-%ZMDf??b5@F~PLd@le#yqPo|?T1ZJYY}AH`DR!{ z{OV`IgSOL{4oUfrw@|sqO-E5dwzlK48$~fLGBTUD?|&%;VMha7ov_zA?e7znL=!pd z5tUSk``b&M$zm2Z(|o*H>cVl%?4694{>>Or9*Obo;_)n4SbQYF)pTe9^Oq4q+sr~m zg`+%U=+vcpl;gdLy{$rfvxBh~)-g1m_QF`izPyMVnX0M*j+KLE7bZwk@YXJXFiw@j5fdM97Li7ml_am7cUho|fw|sd`w9F~)>^039QfWsn;(~EiO_XZswY;uVqy~J_2rjk!F<}iFJFF1qODIO|<)?o&8jkpQ}etS?1X+M5)RD=&B=%h~cw6F!biXxlCp&_#2TZR46MF;nzQN^#{C8j+@TUZ3l0UXI*f z83)=fxASc1R-GtQ33hvi$2p+*XBUrX77d*0^2qD}PlG}BH@IcHdA8y3)m;>-s>*r8 z;Gl@dqtxlCPP99VNu^0nDLlbStUvf}i*T_ylAE+_9EV6a!MR`0(3pn;exm#n_WvJm zrT)R(9>&e3H~UKqSo5@+9E<1|=6BaRda-MbS~B0V0iyv0Xl>WU#JEYG84R4z=Gf^=P*qIxK-UHL->DsRj7W#NSF_Y(;lAIZb4te5GWzSYP9N4 zSf^(G0ko~<5-|>$}(^+*TzhmiLg1Db=^(dQlGAUlVBa|CzO9Uyox|Upxt0(-8;lx(xUnZ#6 z`kKdi%>fAsw%VIpG0n|;mFG{V-+X!h^G=3E%{WBhPW$5Mj4h^1-e82}Wc;x(m02#F zOG>-)t$rJU_wM>6|Ekf7RSb*akSrvOC0^AMvBy%<>14_*g=3UgNRGbgBp)~)7l16&n)OYb;;U}j)Q?#{m5`1Ey~rM61CV3CAZXek3c5yE zDNb5iuRaUraZUS;y5`2c|Hc2col_j;yHdMP-HHf!km=?WjEm6?PR=-Ud-m4jr2=rwozvvN#@_AqD<}=N& z5P^oIsX@PHz#ByM4GILP;VUfm#q*uLa$J}tqKvBJqsn6#&oJz&sD##&T)NGd@l6#F z4)1B#v-@Jm;mPQ%u40>KJGn|rrSevg>C+Dvjm4!%NMZQVLO~vbT z;iNC8M`6gDR06|u!1`R_xY60H^Y`Y>WSBRJH;r|L-%XLynl-z`<1)s>nsm}m{jXF zbKvM$%k4CoHhW&;!E%lSO}a#C4tHKcsZ?9c57niI<;xSEnWeC5uu`Z&!H(!ys}T{I zSXlghK7X0yGWf#(PN|ZQYxzE87I$j!`%L*rDx-9S$BG|=Z@&4gSm?Wx?rT&*qI=t@ z?ya42%`vf~TMmo`+z8t8&&2ss0*er^{B?}hu+FX+)h4F}UT zz_iIYMQ&4>s%N2SP|Wi}QQI&#jnO!jW?_QSyIF(nma=`)@iA+)b7EmafWZ*r%JSJ-doV7pMs-!X{Z#V=Jq6c>o-V^zdj>&sTjyHWQcCoia=_DC zckX5}xaKg>Aln-}mdb=^&7msVyYPQ^&YO>jv3+$cwq2rft>9^Z<6)9;acd^yD;=|Z zh_s?rabuv=;~wXNti+cKgK*w6Od{6}R^!kh*@&=l_G>Y*=!)o4I{(369T4=7Ixb;JJ2wQ*c zN|t=Cbv&vh;fqnyRe|blEk39ukIpp{?X#p^tevN%XI_?020dYm_#{=~)t0I+cto-i zgx`{9Qd1gds+0b&&8aC3lB2Ywwz?X`uv`B^7isImUkyAxfD~HX?EmJ~z^6{<-rMQG z&ov}`cXUiLI=t<5V1AAPK4Bqa#AG(L%3jwV!aU`8b&^ijR*7ahEQ=!X6E7_pBYdNc z71W84&IOxG$XeA;drg(}?EG3_!b^cN;}o8_{OR|ZUz>u57R z=fghuna4&k)&ox27EWtp9sQPdqNEe{Y2<6>Dsu{j;7|Dx6C7*kVCLQu13r8Waq9L!>BSJ>!SZ*E3R7<8- z3c;*l$#9xF(+6Ey(e4M2*}P?@M0oY+3FpY)_ZQMtO$hy+5mV0JGEjTmp;)h3ByugfRQnQ-j$^Dzz)%ZgPa0U6vD zmBQlF1Cm*kxd^EibbXExFkBxaEz!@_J}P?-1ExZ#8=I)#B1-QWz7hNZtb?#THW8ng z=uRu5{rz8OL`ARFKVucDoeGJ*lrL|69KBgDj~w7!S7=8~r*@5|Jw5&VTjbZV7A5T3 z_I7$k6XP~k8^%4C({ZS0lO)BLY~HDLCl8hVYP!IL0>M@|j2D|%>ZpD{_Ef-NbSOkr z(y*AsPk%HKNu||@ZasKswmZ3q80o9~jR2W>H-x4sXN5ssa}j|MF2T+aDja3p@ieGr z`1Vpder%YbND*l`*gKSmDK?%3MUt@$AHy3n8(i8(jJY((d?S_A8ouVb1 zb@RCx3FC%u8Dk7pPgGAaKx{2j$+Da{uIp?AH)WT@U{)g)qZ$3oZpz2m$sI4Q9l_DI zK()tlH6pTBr41BEOXj1;DmSB$&GMg{EwP|+ONV~E#U0AlP_u;$I(BId(nn9z5g{MJ7KR`oUEt76X zL!%i31{_tsP!bJTT^7jQ=y#MLD0w)wG20c1fJLmCHARze)b|Fp zsv1_6`o4cTt9ZBnpAlOB>XeBD?Kjz;kHxJaDdx+Asfz)!oMMOtW5P3*!7 z*d-+Bw-#tIkh}B9lOWd)xgCCtM>0YEJq$AC*7Fb7OK_;4hwM~&Y%y4IJ)AlBOwwp+ z{chpSmOSFgd_$!?aO*eq29C}scDEOrE-txqjYmxHH(E*$#Ds+@NlA4KavoO<#i6Wt2Y)T2Sfai8U#Bj;rcPIuogzm4&KI<9Ix# zRN1ZN29Gk74kHo-S~1Fa30og>;BnFPg-DiO#+vGoh^iAejWo%$t}}*Mk;CH04wA8k zr4=Aoyh8VdlGERBEaap^VR}YvClJ_m0dKb zC{h(?ij0dX3ze4J`rI1}X^?cbd|qo;7|!Zq*%7E6^;oFKN0b6=)YLF+tq;7CtN4N> zZMuT4#IX0v!aFGm8KpQ&>%rHQk@{l_@r`G=`#Cs5S@3}g!H-$c=_YbZ z*)H)-YtTb1Xn2fDn9}n@G@R!E(*-> zG{bm7%c34;R1oezEDL8UqWL}H4?ySm-`yw>TCF*_*0+Dj+jH2*MK?vt6JE_L{HEmm z98}#_v_@yUo?*_)JR_1;SrgKd!3w{Ll$)~9=e5+xC6FflT2{yY%2>0VwXWk?Z`uE5 zInDwhN-?xi^EV(iczHJ6PSm|S(=$~JsTt5j9hX8~sw>Y-u9R1l8#0GAJnbxkHQ*o} zSwT+xnWc2XFQsV$0ToEsRZ-nbb6|W1{Af9!VF2 zP>s+1I%N$vuK$I{`|K;cy1HS3o8(1|08t)=ok*(NLaCX@Zs~}gJTA$+M~t-R)Af27 z$VW4QM&|c3Gh$AEwQlqtDGgukU`H|vUw|}poEL{w80>}PX%E4Q;5g0fO5l2Z+B$N- z;AYK2Ujz#EsWNe+(}3|(7zSn%a#xWN1B>%;;P*t>A-bBY)Yg;vu!1Dib7~6=i`!y?Q+i6yq*%N5J>` z7YF|E)3xWms@tL#6l+>0mIQ#4u9pf(vld2yxt+WsqLzBKZ~U!srPFMEGF?+LC{UdZWv8A7^X$+Bfl zyJWPNP@?aCe*pfbi|gVeS+9M(j4q6!Y_9(m#L)P8orx>@4;_fGLX@Z!`-7Xm!9WJ^T_ay(~o?IZ_^w8zHxxIRlWTW1SlC zGxbCZk12LAD%!~;DXDD}*fS$gYMRMHpGu#U`nY^Ek%otC>mVjcb}&k)-5{9Z7xw;jtVPlDpzhS)M9Q^(2c^i1vM4;C7cB-+moTlua=ec zvY3^&w~b)hlwfgvwXnSSP2xzhTx-VK%#q1^M{N)S6ZC z@bbf7%0Y@o<2Ro}X`NGbMk>VT1K^{eLmk>)h>_=RThQWx4B0bH4KoS88WDHs5uNeEHJ1y|1Wa^y za0-+mfD!zS=nVW61C4;Xe1e&Sbc`Sd^15O~ju~pghsg7MLSewk<_xB9>q@>3;0wsRT-v1Y<`3jz$6I2QU|ZL!>9}LdU2$ zcf&5ctS6LU0?M7iN1Uk(aS&9JrR-WowO}lfC4y`6)b^Qcj3sJ1({p;)FB7& z5?snc4dKi#&#=ROY6Eb@%Q?NhWfWhi zUQaEWt*rB`H%RXy18(sQra95-a5`6!>Fnl=Rfq;;Z zaAQOdb+0-evrcmEHPjc2bpSN&h;4}A~#6g=hUHdPuPlg|17 z^NwFf*V%tZ|7VUAX9079DAh$*+PFV}#b9_$YQ%&&A!NjTgOjN zz&`-}X#)V1(3sZxM}6zNx%129(S7#BY47CTefHoV0Ep193SU@mSG_^B5J+Cl>dsVg z;rDMRkGzckO{truv!b`tpV{IJzDu3em-3Vb*S9lu$@qiOr9Y zi=aEE%PU*hNFs9VB%~Uq(XLQ;$=kBV&o^!~8lk0nhfQgZNPS5As2my)b{wMw-Bg~h z(gVFVVMtL~#Jjs_e-+EHmZ+Y&R zlivHC<85yckRC>&gYkJ}{L}LvfbWhK9YNslhEbh7+p*V|#Ur-TYgKG8|5+F^nHU}s zZ!Tr4cS_eN)@WHv+A{E^-1Cxf!zPR`qZBk@QZfdQoK?6Pb1s&Q;nfkUC9cg$xgQx| zPWAQ1AtY*ug*hz3tMn;XM-Oi0RYWQN&UXZk&_59m6Ei-RfaLL3>dSh{7zOHPNny12 zX65S2B~`<))E2a4o&;q5Ub=z>OVYL9T~)PN2p*qbMcdmn7VEW~piRBK+Ya2;EX%7L zr^zj`lk?h3q=(k(sOY2^8j6NLS)T|b>$Gcdq`F%#<}>fafuFOG94wn!-4`<2yN9%! zWgF#&r=C(uPrJ%nkuK}l$f>TK4P;UN{UBGrs`1N3TaPz?N@FpQHzUUJ8e{KR%&PX9 zOg!u|yL!R+YMIq3WC}!}+U?9TVVv3(&mG76p&sJU@6gnQTisEI*k>;iM5vfFd6PtG zhzPJ1Q~^6*xw+GE8vD88o~?_|ME(P1-GZG)hiV&fU^~is^ZRo0M3K7lvJ4G$Idqk2 zNKkD#cS<%48I|0NENO0G0GyzAkIN?gH|{RFR;&nWGc79WDw|4roz3G; zE&|+qct+mZo4dTpxveRkh|L?*0u5~xaTqY%DOa37cegs`EWt)OYKBYV5uVf7HLm`i zS7lC?d{Shn`%R?^QiM?csnSlA+5sudJz3q&xLRs;Bt=`mv) z!l0A_zEx&HLi1uh*d=1SSe>zO^T{OQX6B|tBH@x+v`mBgaR%oK3QWN)N=IfQTBt5U zdxI5v#;t2uFKFA;jcK)aL=8`1`7ZbmAzzu_%WCOjpPadkTa|63q4qYstBqR9SSP@E5 z;Tn;A4l|&Z`Chh4be4UN|uL%pEkr7EVnu2GK4ZZgH_RKZ<17upj%`X(Gp zFtz8wbGOy@N_<;}CpiwlP61fcpeNiUl)%7p3QcMY`gTW^o2T>XzJC;-UGa@q6FnSN zRDW99)rdX$E4k7Q-4hXi82&QoxTGZmtirjh#|W}qFLBGVc2)Ix=?pyBfK)rDc6gIt zS#Wo1^9$YVqGo=re+)FKM*-5*re1z_-9{gHt5bS>6kp!c4fWOv_?7DMZe~txosNPk z(CKXh+4044FL#jAaWOB-;3?RjigiLoso-J)AkiR_aD^T?Q!1B(#uiD14#7?YBjL`y zB6vqk3h6a>1BW04XPMhn=|1PZtl)`KVW#aqh?&?%vK2D#HeRK@?+vBQ)vWmKcU`Cd ztS^<<9;Kv24_7Wk{~pW+YV@aVpJU#ivGuTOS)~;SaB)oL>0Kfe}0LmxV{sr4N;hRnR?k@;3a z5{d-Hm-$%h2DcS1J&bg6itCJz@aDs5G>;}sgl&}P%x^%gA$AkM1t-93?njZX0J@3R z^ItKGn|s1p8&@q09}pZcbCcS9Q-32JxsD!e{|-=Q0Q!xdR<)g0wRCTDKnKhPFQ^;| z==0@B<;JVpRpGA$8_{EvP<*`-oH=-4lG=flM%BSpanrdmY3^bXI;IIQL%S3MZ$d_y zbw$8i-~74fx&(Ax(&g|mfPK0mPaQMPFBw*(A0Gn#0uR%&eyQl<<~OL!4qIBbycUQS zfsf0rNW6*<#>K?L<}9we$khnm;jQMJSh1vcMF{Y zricw>QM;7RPE@{+J8#{BC`5PW&L z;sP~=p|eT*&#B8ZPOivG&3jE6Na~IvNJg%)0!0j|NEVL_izMr6L9nn{@qO&%(rg+5 z6=p$xF+`Wx564@zPR{JlvyFMV%`0iMyJw5H|7ay zEPXfcflcv!p90kDa*^~_IqGdSWCbaWpP{~gGK|owGT@UNQW{BP{V+}Huf_&;=0R5m z`dPE$0@4gWCgV7+t+9zx;_l2;0J!GfhwQwCKHrx&))i2X(Q{h6QUXWst=283n#2J@ zukbE;aOnPwb^Hd9g_7$w{vA;D00dJxOUG?W*5HZG> zoEkHDM70bEEhx+-OACwEd#(&$#oOu|lqwH9Qb9&xl=^p%A#FD!`k6sKQC8hd(d3#O zzl-@?GKwwBBkQ`x3>C9c-%jsfjE@ zOF}==qPnM|cfEEP)(w%!JQ4DXM*h{#i%{WY*?R3hRD~iw?rG^+O&V|2Y12d>nVQB~ zp9dYM5K!_&BvJ~eN*QvqTa}L+zKN`f1796i@bivES~JLoiH^Q*43yBuHH;>RA{a^e zN+?O-gIj*GM5Q5~c1E6lwLV8Jv`mSpzQ!@JkkY=`ig>Ff4!a^lK^Ba6e}A3(emQe(o0MkkkxctuIV)=tGF$ z%W-%ZU!HXKWfNPY zDn-MM=yfZ2V0+NJYg*}J?A@M|id}N`8YO5P`$gjtI@;moOVCAURL3_I3b*SW+1=wW zcgP!!+e4p3gw?=0TgM8XRofrX4`zM`n5)QiXu!cT&!H6@5urCN6PO1{?1o7js8+pu z+UQ>OWMQ4qo`%{Sd}N2FBHxxDe=Xl zdaX3C4xWR4`s;~hvk(H#izirCDkbJ8;7j3Dg;IJE=7Pb|2kGmZkc?kxsx(AZ_z$=0 zfD!u;sE&!25)F22p|bV~t|#pXxi(yF zgCXVysOj^w5myNx9 z(g*>ViiR?&VdkEWkBaHp9srW!61?y&)C$NCyWmiDzm{SYhU#=NYsU+gRTzeZOIX67 zO&oW*el>=_rms1(MBXJg?p_Olv1Hc5Fm~rzUuEj@s9@&@dHitVV!XmK!sucu_iW{Rfcxllyl3 zM2qcb$GkOt)j~?_4>=LmzPYiL!l|Ncqjt?fVt~^Pa5)e_$cFqORFZ%N%U>1}gXb*X zzQy-E@akBKY$*x44OML9-90}U^C^swq2%nNMp5>ub*MGWH!Xv z4DFsFX8Otfhs6M<&Ej7LDaE*3KV&wwz9L|2wcM;GoYxHR~=NR z+rkg~jwc4xAKkzs;esUmv*(!?EwFs|7E2l~c38=D4+qI?J#NjO6d;5MP4p%EDAO&5 z;G(w;*oleiQz29oCQ}{*hlDhySe$UTd59-T1p_R|@1o=*eA zJ~Jo_chBSYqy{d^C1G4YReEZcbfk47e_IGfbBBTDze9~`1dwdX#)xjcnZ^#wpDvFL z)!h6`&=MLO3Y`Vk5MrVdnDUBSVTzJM|EPhQTDaQ^JPNuB;!=~5r2wgeP?V-=gan5^ zr_DJn6X*6F{p=}*;&{D(p-~?;jUTT(tq}hSx?1vyh0mT|J;H+HgiVp}9?n+^E7jo) z5LxM-UH%$c)<9Rxq9%IR3`?V3thMM1nr9f^K_Ruy?qHB!4oV#XX%%(_vocraN=FVx zVTpHv`QRJa3mx$n2AR@8JqmiTKrq?dnVe!S9Rb-;>I5i+F^n$$&)#10Pj}hZ$9#LU z?n4Eau~J*aiASVnDor`gyV8O=09UcF!7Hp*3tqWn-4e9#b;c#5{4Xr7PJci?t~27M zbN0Im?7to(`;sW`xVj4qF6;Jg?)SOw)A+^;7WL49shd&RT-Jv%jI7&~qsI)h%9J65$UZt>;=- zB845F8o84ja#d+l;EX;|dU21g#UL1=bedKbtEB0gaKWx-N+c!~u~$2*a6P?*LY3pY zESES&13Q0jm6g-0Z+-fURX;imcy3WVaLlsV=d;UcU*nCVM6*){QLBdu0^;7LI@hJ= z=10v!pwO6hOSEsuepC5o4|G@z*}PeIX@ovrW^D)q~?zBXdUec8o{<)+@C11DlH$#70-y9E$`2+ zJOw1!ktl);BtcC0(r{vL*^~VApCV_wHGz{YN(M0R6^lpfl>XLh`WNBk)Z`{!w4j`< zAnh6DMoL9P>(#M)gEyOvfC)II%SPEx_yBq55@Y2FLM?Z*quyL=K!!Rk!+`AV0bJm|;%>ycAjzq= zFv+7>n1Msf4o2Y-MGs3xj+UeB(I6)5$)}oDevP*;zENMx+KcD6iuFR5vdSnpBUpK` z7?4*)^p@qst+Os>j@DsOsIP9k=oVY_Ns%n(WQ?>Ccf-b^ww(2{g&}%I9Jwc5en1P{ zmfj1Mk<)8|Yg)~ICOyz z(VJEk6+QXB0Z)-;7(v%us!b5UUg~d0Gs0f$(ax#+qeffWfNwnM;+{{jV(js?@_IDD zlq|MN<5u%RSCi2=lSe>mSudgDn&6l@jAo|Wt9BS>d$U=!pE=Z>W*_NXg4Zx3x?$Dn zUxL)nbYZ)kgs$LsxTXl0ngQyR#yOOS^Q?UAY4fWe&g2lSH0KFxMYTPLq>QKH<(|Tl z?4mY$7I9`*QYn$Y>;v$B>QgTx8HzKJRM0cxidW;_Sv1no*Sr-OC(~najQ4#*Rw?Oy zrnAD9+q`Z#`_kf`t#8n6^}TA++8ge?M@eRS6w|Pt;n}GhCFM(P)Zpi|2OO|x>@-d& z!6@FV6I!|+k9rT&Dg$YTE_*xVQ^^LUH~=_Z=pOH7_u$VvBI6?^yL6RGFw>o0s$_c$ z$Z*VD1@xQi#zF4B%(sDa!G=W2t^i@1K19cLxd4k17hNaHx8hpD zOc>x<-HM=i25}6UwwUkXCWfX_mtTHa0T;ibFIu&as(Y>sOT>|MF``yxdAG(ezdGRY z8p>B)I|edCYdG7&PUL8##Hph!F&f_`XIR#ZyZj2)r>N!+4T4KOw-Dwz)?&(}&~(k0 zkfTFftP%G`-av?**y&c6r^DF#hZx4^wrHXU>Fb{LwCnB2qn~qS8B$8!Cno9H@7p*I zr?O2kgNqR-`L%h)>sNi=JBgc@Dl2@zXjY|+KdmTXy!1PosftCM2Hl$OtAaz7LeHk9t90!zD9lM~Vsf373=NIt%?Ag3gFj;s z8H6n9n>aWqS~u?BLGcyUD~u5@e%!Wwn>@bcEAIH8HqVH!TBMyz9BX~kfA-9UFIZU; zuFLih$3cYEhq=(mQiHIzpuFbIwfRGtP+-z~{}#ZQP= zlv}=NHyU@RvE*h6O=^^3ef&5O-;~Q4ZhCd(yeo zjRp4POqa@0dps%dNOMP20>M%=?VIobAx1_dHV5j)(H+Gx?xuth@A51B#oL$HUkZNf z8`IC(D@avs)@65vo$vjl3IC)e8h@KuK#OcaA}lKX0(Vu9=ZtF5A&reL2hq^A6#nTa zZSpb|)gOT0vxJ}EfZN)a1qrg;MHp%UVH^zj z3}tQC{f)HboOCD$e*opFvN^5TwRZNLRsKnC7bM^zizUK29#K8CZOz!T)*;m#U~>UD zinX_;DsJ@1=IX`;So4wH~ z(N8uOc|zYq9%nIjG+vj$lS`wBO=lecdQ6S#WZ0cE_!)AGwI||eOIYJgS?UU232))A^#Xb@2zl*7L%5oy~dk3yItP zobPdHKK!LkPLHdyd={K1M|Oc~J$D?_NHdVIzgNtcHTr;E1wrEJcRYHv+bsiL^RBhhz*$IbiY~(I3mebi~1exFWv}cS|p_ zm{jD>%yp|TbsVtJ-)gCp2w~Z!DA7OQ7!IH49?_(-(c$Oe*2tnxCivrme@{{{AAu3Z zj7n>re&d%Bht1(zp7jS9aF}h}W#3jK&y5TTaCpl1Oa;=yFQ{)#ir7I4!4D%ET10c> zN~(;AH9O~HZAdRg`=RmEVXvGwr^t4Xa0H4LJy9pzEC{!(PEtnpLE_n@v1iz7OeyC< z?;xSUo7mLgs0LA|KrsOH#54j#Arz|fg(IMj)g7U)T-P5unmFMcOd9L4ve_u zz=PAGk$7%&ed{kcv_f84($XxyH8McXnMAgC%~A#nVs_(;GVD~gN<_<)rVEFL2^yL_ zNaBj;2GQfw9;W!SJMN_!;MOV+>;G77!b&J0&|ZXbAgt!3u+UrbfH0CRy;>#ee&HZI zp_8_2X@)Y6$R`XL^&fmh%CjB$B*vO9TckphG-?XkD81AL6U1@>Q*$e+1_+2;hpp)Zr)=k-6J(9qdE zIi`Q^IzP6uorz=(tEI{tL35v7hC>>(^fJnyC}FaR-pOGt%igKM2kJc2ZUpypw8+mX zQY<2AW^@VW;~MnIBI?$d44%eUutWf;t8}m)NI=fWasZ0uRwFN)z9TBUI+b!=YzOag zVuo4wNIAO>uB9l+57Lp$MIRV;O?f3=Q>hPvz6qxS-Ho`sE{pWbC-5Z1TE_;zzcea? zeX!O@wiNJTZUx6p#_xkC)AL3hBGTlH>3t938OKN55~MBlr~Q|JMf}mhnQmik^R2m0u6Zj75O22rb{G}whbNebeI|^AA6L@^PXo61;*`~fPQUFeyO7K8}A|y_Ldle9GM507fSQy0KEGQdUk9z&T6@q#}IPt~Dt^ zU~RAcA@c4U%E(9J=eR?Ei~<%IXO>mucrcV^IM^GEMnAC5zO|%J;z;#dS=Q zU9W`7!`6gjQG3=E7Y)t4V!aQ2^%1B(F}KWH)vUm7v>Df;IwLSEGdN8#P%f1v&qMME zSCe4#a%HyWRjv?(PeYW^yCVwOTc95=SC-?NBu_< z2H$r>s5c=5kYB$Yk;K@Ogz?!(bY3WJr&&Ikh@Lki8a5F^YDPddDPv!8;-n#uj+(?W zNd+9?5_L|Ex!B<+1h%YNEfJiTl<5Nz^-IgGxP_=`8Z#V4Xxb>w>}T8=IG)D0tNA%q zpwY{(+4YQ>yq?n|?{Gh9@humiOypqwzVFr)EUNHUSy@phn+3rY|bW4>t+2Z zPhMUPWA8_PP=l9J*wMp~BQt4Q8i+}e4?wwwH_s@W=MQ;1j6f{v8O%Y&<93c3C zx$ig8x0SLAeVVX{n2O8crFtwD(LIq?O*QT98T_D#p_ zfvt#s9H4@UMhDms!Jx!Gm}EyLc|Ka-DYvjkBXLQY@njXzp=s5__f=9lVa@gMim)Y> zAADqdX4IOPr?1ZsldB0sxfMyo{Z-qz&olJN8rbIsegJ#HA12l}}G+CdB2jsIs-u`dSXG@G2K&_gduNw~mBCsG%+!d04u{7A! zCvXJz5__>3=rsrdFG~s4I$_6V_xQu@2&3PA!p z8!`Xx3A@5@6aQMa_z?Je%S|jRhmKr%@Wl!?@c20Ds~ycey~_@`$XRU` zp4GM9+EQ9NgKH0VRUrB=jCW{U!;rs{)gbuBYKO~rYpQ3w0R+vgd{mB43%c6FRp}rE zg==Xj#X9MLS6%5?K53o9elUjFn zpwB?XW91Yf^8dt~H>Zac;RR9VF-{N7CZ5Jk-1GT!`d;^3n5wP0%6s=eOECXtHwO5+s>cr873Ae3vc}o^K@cjpCazjX;avFR<{kVjgiD#WDw z&wrNlUy3I=$b-4>S(pRXP8?t%f74`4iBX#Ia$3Mcvq|UzS<`V=)XSm-A7j*PdT1d8 zww-<|NPNE48SW#tE~VR#>3KrguQoq)z8lVGfcOMu$@70mDw=}z-v}w}0gCclJH6eV zVB+-(MB6-lV&Dy@0OU)=>Du66xU0@Gc>?Fa7}VGC*VVn*YiqizQ$sBd%P*86{sRUh zL9hVY;S4hIlR`E9QhT81uFk~iUPo6Y&+#6^>FXtAb0)*o#ts8W@}A3TdVCx6>~bFQ ztLP$qBT$zQ7>%=y=!thIXD8PIT7!4ZFoKWqKEzff4Qrv8C*8GLi;gi@3K$QWC&+ky zj4>QmTF7`lgGzAPw9jhJtdw!qUgCMTXE^+LUDR26+%(Oq>d+a5@!13`3e|3bb6(Q$ zs0A)YZUovt+-u`4tbn?br-A<(=K*m~>|fF=@Da#D*CjX3yo(ysK}j%1mk3z`Ir$QTZuyMk>f5A=3&VCoWn2s>&9tRi1#!k`RHug;mC_xOm)tQV zmWrn({s(t&0an%1E{dr6>BsQJWjlkY?3y5?}i!>4vn@(vF1Ox#Ikx)9MTN)%3 zX-Sb(8vh&p#rJ*Z{O|qFbDwk1^W0%EGw(a^%)BuRW@b&0kFwmWE>!&TT`_{3fly7$ zmGExDey4Q?<?454TPcYf%@{SS*+v&%TE0 z@t2FaL@%O;#Sx)u0&=^O!{v;8u|EMdm_l2$MF4Se{ky^{Oir(k=hm?nFCcNTVKhkF zd~@Js%%KLD`iEx}n7T zn}wg}B|17|IXEY48_Jz+0y<34&u5AsWPMUB^78rudjG8z!p;z!G<)kgo_1Jzp1MY# zZbUkN!A-0u9Y-!P)%T$yv2wOwM=|b|$l?lrXzudRDJSq28;KaaVXcDO#=v0MqCL6E~JV& zrHXp!CYBQH(KHygkF(eHN8g50qB-9vCz8w=_hwr!4ZZzv-1lb*qW~S4$&Ayyr7J_ ziH>xQRK{EEM`FY&wR=Nis#hd5C};A6P<{Fg(8_;!`r|h*l!$I<`g`ffiGZN(kC>6m_K2-NQ4uD{Ze>EU17%&V( zif17~kl#gt;V23KrI}v=bKunB!11Jq70_bSSYw1wd2jc+O4hxd3!o7(7{lngG z5S0o*u^}NS2!wi=ktoe$F%zqz!vFvb2mW$U0FrFjMwDFh7K<6BPht=ZP=074KzlKgc%1i?%Uz`#fgViZ4ch#-=6O>Q+2B{c#7!+&cPmHj#!%9O;Y0M3nU zL)DJbA&MT9yle?p29Q{GfP!rj;+hgw4lx#r4&_h;zrx?176gd}pop)LAmMZrQkgkq z7>J^YK{e(?fH?$?@_#ujAQ_t(i4D63KtL|`_3Hqj8azts4QBvVHG(Az#KB|>2|=|4 zEC{hO1c{>gWvOJ8j3@#Xl%AbJ-~cKDg~O0&Z~$P;g9Au3F)+cgI!ZJUgc!jLRfZvz zQA}Q!j1mouDoq&{>;?g20Z3(LFbE*WevtSTj$#{SzVOSV5CjY*9cpt<2Gwf^2a}cfU&RBP#6H4IZ*|r{9h8G{uE+C0G#V) zfKm&}vd~{ts79D**ajW2gk!-_hPX}z0F(xj0oXMFVn%{c*#YwFBuFAkS1Q+Nlp_W) zS0Pz~6br5?;lEJ8HRT_16%;?r$#B?pEg(n;90G=;V%Jq)n@>)!xD675{i`As*mc5h z=}^VOe?c$^iU-vDn~Y$-E=L7|VwiXs$j)p+{z^xAV3liGh=1{nil8il5;^YA)IUQQ z0HDmrbjJ550ss=PReGKGmt#f(5G2;gZ{VMNl=hJFUoZ?+H5mC9_;&=n z2X`q=6bgo(e-9CbTB#u z4TKU1ILYPXrTrCZY8K1|Ev#TYdBO*S4l1V@wP|lUcHS=wc7$ zo90fvOF*S|rVn{pO_{DhNC^f|%N698*s<|*2E~yU+KA$du0-4pcp{#KCIR6fI^kZG zmYS@*UTg@5E^gMnTYb+=JL~3Y-H3VlZZO@$&s9xdTM|GN+#uUB*F=U>-oK)UqlZwPc<$IukHkKw5Bc${5K=CNbv8YQR)?hC|86N;|ObYf`ziO_+eTm zR_B`idtqXU2yQfm#&8J`dWG`b4&PlRPli-E_6TjfJSusCC>!X&e+Q^Ko1~(+dx(F* z9L40=0V@eiglK{IIx4fisl$NBepeO~oEPnPf|Ng352u)m80yihi0-9p24`@}nPE`# z1$UvTQLA!CS(6%M`P^%UF}~n~93Ms9w#>$8aiZKgA_>CpNqXZlh8FeW2N#9~SVd%&L=3=h%yp|Rx{*Rs#ok3U>NrMn1-KQ>ioHAj0$}(XF0tP9^e9M=ITGED= zQ=k!dEc1RSLQ*r*z-5VvJNYvzF@Lu(X zSHu5o5) z=ibF&MbJ~dWUoTU@DS=UtPMv}Pf~AUzZ~lfQns*YnUKH_3}LX~RCI*`SY>PXXp7`t zi|!?h)HiBdnm}O5UAU%;&bUU{y*}!$EPk8_5E+?=vU32VE-^a}p!e$X>5*6(?4wK2 zw?x^q5DwfEUYB*s9SK^?)`)8D8-yn@TzQhpQldyHQkf{H6}+^=qsO1rH-*ngp~B2R z0Z*<7-Z^|IUK*MK6NYe+YM{~<&^WS8q!5WCi*EE>?IW2A?uG2ERqNm%nk8C+5YIua zLMYqf5Owob6>f((h)NR--_U+nGUBD_anT2Y1=D?Do%fRtu^1z8D6kpe0R7l+hQg9@ zq%6jmX(3FQZPIqm^nB@ZpN;`Al{&f<)58e~4gWA6hA@`zr%1sdrHJYfUxVKzbKLWgoH9M7SEvlWQgMo#(WwbEtEmHv_^6408x}dP!QhbAxRhR^5UAl;v3Z&v!UmBXQk; z>1$*)km75bARA>IfJV|<;Edw9A`_(UfJ45$REh;3>x)yAyxgKB zX;djU0YMic1^Mp)!_a)T>j6DKx0Imog#T&Z0@b--utaq(lJ?x%ulp8npzz=^KG*#} z`WE0{eT!HPqD%Hg6NMkXtBTdZ9MpcuVK&R= zHMVcWMK^m=73#WZ#rNcg3?8?S3S?pLQOEv-l|a4ZIMOhJyPIf?-~11I*b|xLg=U?> z5Z$>C+oNtNMMbDN_QdVFHxf-GrT^0&zN91Bl)bo#)~PioaZ$J#qtS3$ee4I7#je4r z!TQ>Jrgbk<_=D9`x85;k2#w{vRE<_rSR0>W5f{MeeN-Pvo-tP;>y~&Tr^211o>>r` ze2=y-#!pGQ+SRFfwvlD{W@m3F3AmO>n&_k}C>y)mNXT$m&~d^=;=30SiLSb)T}6S> z-5#d*huRl%LvOrjj3W~wg(vk@&d6qN+>=et{m~GYqPoB==dno6uj3(%MX8Jc`YZkD9Vc$JkNql>)07{p!AciYC*~ z#2%U}rogibE=GQr$|gpo=7o9)?|BI&D)yUII+d9)I#arakAe)#<2x>G#9 zptx!YEA=@&n#tCKNrzkxe}Z?;%MS*(H)+n4$lq^rn70UT*__fbjpQB*M<%5dA71(Y z=Iy~iZoQ|PBv(8$N#kYG1Jf%RE6#?LS9j+uaY+pbT9QTzP)3XitPhC)#oRvWKma5& zjeeP-%~lrZuoihv_nRcz;+3^cbQ~^WW%s0;Go3WeXfM;<$3pU9ewC$HI5x)akG12w zZHSYL)4=azsDA=^sw6qe1NPndM9B$j6btI2bWp=o4z#mH_ z^H5e-MI#3>G}~9Ty-EI}U6&x~B;eSCK@TtPiM@@3fYMikoHtf|S0=xON_{ivsDFYH zL99vE<)c^fKG!Gf#c&6!2l=X8KmZffo0xGAkH4GRs#N9@fi~V-cQW>x=Zk^A<@ux4 zxP!~B)<3FGMLDG{$o3p#Sw=G~PJeyq{?#DqTD2JO|7fq_Bw@30FXe-xf{+|*sKb2gwOho=X~Gf2lrnh0zlf+a~dY3^DLRF8e; z75S|JGO}!lvgc1A_>P(PH-W)9PcHR=nJP7b6#M|DXPnNZf4u{3g+kO{(1WnlTdECH zljFIF3MSnmLbYDsxJbhPe5OQ3DR?mcL+#JEYW0T0UKF98xWGLu1-p9s>jrE5t4bdF z@WKUcB4#z=yc;*3#2LJc`5LSG3S)-@wc@`zM|n`XK*Y*DX|?*$5;aZr?>sE_Q{Qyt z?ODHdG|#|4BP)BFPbSe)P+H^5|7u^DgRNEH@N2Y6pYRevjX; z2k?Im-=Rrv!R=#vFWxNe!}#E+!(#qAD+aab{0EckLduU3)O|uEYYTY(QaO^{*}UHI zbKdJ>#sfa<6*8wAFUQMVC{qDS66Y>PtuRt;j~J03bnnjn_ZSMFYC0~}jJb85L{SO` z(-^a&`4Jy9K1iN@7H(15+8T;O6MDoy%IXto#w;R&XFeX^4{ki__pW}x^>Z7h|79h?u<+P+Zx+$C*~r>YV8{MJozl$4 z4T?DRS3>Q~c};d=PhR;sGBL>Gh(^^xQAbU zo4Y;xz$Y|h=k6zNpr@v``ERsIvTxeqeG03V}1YuZn_0kA(*;7bDh2=VinnT z3t}#CV{KoQl)3*t={bd1xi4d{!D{;fpj!YDW!vT2v-p9*Fd<_7&Ebtyso#-nly>Z_ z1_^3urvo||(-?b(PBVpsQ(sf2=HkFammme5yAPZs!l!dTJVIN9Pjl%x>9Wp#8QlI^ z*CX)-){jJRTupubIxgku4}Q~1GAyrN7%S=G+}q4 z9#SsIws_CW`C=?FF|j_Z^jkPlmr9xFGmc|}UY9$-J^V|z>9s}1019SBk}(^H*FGtP z$svj-&vvOA9@=RRtR-7%-R->dWnwM5MzvTyZzDC!_dxO|&}*ow{^6M}{P7Ze^*r~< zCd`Sy=X`f$Wa~k=HB64hq%z z*y2(M{FS8HcVlR6+Ew-&bNjcqn>kc3Vl=9!VxEoU2(2q=qz#|_1Zp53eQ?N=<-aa6 z7S0z7UJjI>($W=fVDz=bQBXN}zV#3B)OZ$*wFv2hO@r6mod zL^8YR#g`O4x(ToF-`-B@cIBlTd>|}J zEVII&+Q~LnJVf0cguB&59y+m(Bn924GcsOV)v91n4X;~4eL3Y^m_2G3re}57MXk<= zJ!pOIvHE;L=_fE~PS|VyDE08`<=f{0Ikk62s(uXk{s^4CEj{vyV}17A=GM84Q&EoH z&i^wcK`}%1N&K z<*f)phR{BXe~4gAMteRczHyAYT@GIHjlNmHuVAx3;a`YuMc}tF9&zlrREQIh&9mm@ z09ufWtLp#CxBZu@A#A3#m>uMcl+G8$RP37RsTDa=0lw1atwnF9%14Fs_RoTrK+b51Q>#Sql{_jGE!u7IJ>-}KU=dUVvx`8#`%nW)(h(r)Y1VRF12EsiLIY50{ED8%?rG9M>l9sJVwQu`y#ja`}cvMJRLkYN--Sl@A9%rOO1 z;;EWus~NA71vHZC2{twZ3u|Ho@9hK+truw}&wqyEy$4@+(p;lYLzmy zu+i99yjXq^cfz#$6S$GLz2Doc)Y6Q;kA7E>^25!X4Pg&_gP!+WUD(c4F@<}{^_&GW z4kXjQ%R107rx{p}t9+Z=1R*4cTd}XQfS-*r<5@A=a9=kN`X0i`w&3vS3qyO@jzY1! zw~pxR9j$4<@3)`3eqTEcT+d4y*#9oJL(16%*&v9--;dYAuV!~U==xliIg#WROZc`n%q;jzd*!mUPgfjRM#Q?8jdIl>L*6mn^gFP6&nw7WvaXv+Wn+ zs3{FW)Mb5a%}ZL#F1#3&w2<^iGTP4CorO=cIHBcUeY$&Go;iD0(Hmvds}?M;o`K$n zCgXP`*D`<9kBt|5LZc{BxI9pwSJ=jr=P1!bI;ruRhyh_wC8hv~y>=>p>%v>48y^gi zQ!+gfQkD!Ba(`_7x*XwN%n?lNXS-NHD&tls7S1EK)pF1Ct&8y|bm|x^BSb;uScv_q zp2Hh-9t^6|Sa(@Ud;GD`QuJycReaCsi;pB_8;!W5eL{HAayWGcoO3LPiu3K7IX9UM z)Y?9@Y4mWuc3hkhR#UytoJJALUkp7tgFJIEi)Y=xN$P{^;V}_~X^?mvg?v@r;KGU- z1%6?Xtu7_!KCbJTeosA3P)7B$P{)RF^hJaU*(90jmu|oNJb2Wp%rPk}3!LIZ(0bJe zZ8KOOv5;ZWWyUS)TNkY>)q5B>K92e|!oDmP66M7=?r|aQqabd>vU947j_k2mM{qEH zya9o$$5OJrFm;FcMhkypnc#BAHq=*t5_#hR@U~ zLe2heR8HdfhHb8QOr_wqV1X*|n(uQm6QcO(mVMk8Gg*nNJbwyk25RY5uP>9Pw7gpu zKjWS97k$7I|6v-*`!P#16Uc2^7lvj}N|To8Phpt_fvKe@1ff}kW-d>^`EhLS-QHS^ zn1kjGXNsL?Xv9Iv)*}V8_Qmn@U%kAO!pFF%Tt!_8?zWQei_-6+P~dfHXt{s7G7bNqdvI1iX& zG?(EJ1xkgvE{D}RBTu*DRwpf?nzyg?wRqkL>C~`?WE+IbzkvF(3YjP z<(8zzmK{$IFQceUyrx9BQrao!{`5)~Nl4P1;^FXHy_$)>2MSShr>)dy>tvc(W~yN; zkOq9qyfOTC{{3TuY#b&Pay~Kgl6{=F(FH44*VW=A#D}! zf)4OQs%9dQFCz7<@+4x=pkh4NJjdn69OclEQEk5cL?~5dC&J;I7^qfiB-S~1awp28 z>{d9@8`Wh+?)zkm);J0hv)j8qd6{f^IP;#?%G4>}GvjKN`JX zNA*Iq#kg+$aCl67<@h9H{8_S|w^Su&_U9|Nr1GlZ#hnUTflt{kLs#w{v~r6NC2i{o z(WW!MoIj7z^B?)#!BTUdN!LV9#Co!m)RDD`D|U6CLlGA_bwizFplttpTJY+C8$PHP zhCy{>doRARln|&609QWokzhmIrV>+%R>KFqdBT;#$BZkK1Q$~`A5DD$@!*X3*rhix znr;n&Pc41)$q~;DM$Z-NDkOMwbfxlUyMMY&8bth73+V7%6<$^sQca6tELSdlx(a3;w#;MYT z4Eveg7kc%J{LP%y0DkkDz#ch+co#lT(WqNjCa$A;NEPLW*3?d%+}TgKV_)k)3BC#R z9hK$gC7d`)nMxh%y>-~sTT!e=V=KhCh1BDeZc9fDPFl&M&a}j&>VSN7UdfyiP51d- zyx@OUbA7y6SS~LWfgO$MNTie0HlqIPvH%gl`k0V1gjZ-Y-hs!Mj@_Y~kv6E!X&~Zo zo*tuqofBGRs3=i%=QPgsILT zx`~G~0~Izb1tU~BJHTy>WNqr>j@cS-9(q?EU@7uWx(eTfdVW%sbJ!2+3vI1F{bm=X zsUYJIzGD|0_&oe`4sTii{qJ~niT=*#_oeMx0y`&o|7Zq2n7)^W&mSKP>~A^D=9Jp3I^A2$Ohj~A5{{6U}tD@6O044BhYub^_faT4_D5N(|n=wJa~jo9{wQECePZ zr7yAI+HyJ;yLWZsG9t$6-=MXv;UEkQpy1B4A znk47AyoA9#gyI1?Y&%vPI$8w@xB>+ddOc6>`<}8*5b-H1iVmf`>ANfp$kDgI5`UCq1xFN4se|%_-SD)i0LP zB;xSZMYRwLL|(Ap3f=G6w#B`#*hJ?_`}r-Q6+1i^y+Yb=2AmqB?z;SPVWg);I^2B5 z6a1RFSF4g*@~X0akoBv+UlEP%5p;v#{PT*Ah>#{Pp-HHI0e<#pj`5{8^V!jZ-+clp zb1#hcKL{oY;l=@;>`iiVb9wUCxTwu7ZmtJH$|M!$CnmQE?H}p^M2z>|LYp?j;08F4 zU2PjiASpOtb!skVnkO$VKsg`WF7@gEgU1|e;X*^K6ydskc-UGlGFG*?Zt{Je)`uM^ z#x~5Xm6u+pgy!r}KP zwWW-jZGhm>?LED_pFPRE+U!>8O)f&Wa}onQ4hYKw5#LApq#I5#r)6MgD-#6!X6?gs zAmUr>4F2>h1eSrc^*=hI%J4UIkxm|cg`?hkJvJnoMVu-9Ffjtq7q=+Pw-80aWB1#` zr@i#_$`4l(sODIZ)5@#|gIGMrip4zBwbWnCWJ*X)Jlq4dnZ<0pFy30<{Y06|yrFR; zain@-HM9dJ^B&%DzA;hmxUM0XM$d*~Wc~k#M^HaJ&vb-js^-%~ML_{Ta|fSsjHvJ? zZ4kl)+<}EdzisDT7b$^@jGwZT;lTAB-=ukTiJ)r06e)^cC&Za~W>aaFxm2Gyd+)Jb z`LHHo@VV6~Vtc!7vvVTnwu!8p{tKJrV$!~EmMNbuzAlODY>>URG7AsHJTKO8 zV*D63j`8_0zRa;PT2HF3PNw9l8J!Y*Dw_rtdh!#{nA7XByh{57UN2_8R%I}4lWM9(x#G5giLTOp|`W%IQ9@P{+& z5>@2*XwY2WanRW28QTfRs^teSg&Z1jPvXzF5}(JyczyCXkp%S&(Iau;ZSsd37$E33 zK||DvUQMm75!6gdaUmX*^T>|`-Ur=MQC?TS1dp(*!n517T*U3m!~U_-bBVh z*gP_5tLZ3s68WJl<$MOqo-((+-J?x1*n*-2`=WxqQdxM+sPu~1)TbL=PRlR-T6vF+ zbfiX(_!dv-Yhg`0Xx|Hohc;O{pf*D!6;45TGMK*TiehSE!y`f8h1PXXkn~(?{OoZI zq(Jh>?F_P2o=_KmLL<(Rj8A05$N8xqedX0#Em=B2T$l51+=-QR#fi5$Co>}*$?UQWoLREGVPf>r>Po4^?;G3HNXP;K^mr+p(7N+i6XC^J-~II3Jh5PD0K3>?Fi$O6AFLBZ#)lQgp|{Q8GAJQZ z;~frW?5MR70fVquQzcnxf;t9441998EtfntdRIQJY_rMGtN1KbES*cq$amGaLs?jF zv>26Q-ctiJvl&K5BlO;Upc+^LC z(IHFTmMiK#$%-|s=uh&d7`3a_Qv~~OS&E)T8JmzzX$bH1uTBJn257!lgh)wDVB?N(9F9(88?*)7`azIC zt0;D_31*$cA#2~|1?~tVjr+JCI*new)$UKP*BWx6e!3uaaq$!Qa9*+PJw-#0_Twku znm609!KB|leFdJUzwu+(pqPL6!+N39ltV#zrn-08KGO)bPy3Va7N0TN*dO*Fm>!DS zv9S4ndd>i_kGrnlN*XO$d8)pyUw@UYUN!JG;AMV7*jRF)bcW9#lV^L5y9b||<<-k= z+k8os^A$Q)$8XW&&RI<}-tAPhzkC4eC z@YrN3EPAXjhRp;^XneEzd)@uy@~&X^W-)?vg|*GOLLXXcV(N`K7tZnMosv>l5)kas zi}=G+^y4-fxzq;|bu{S8WTE0${P?@&ufhX|!2}qQGieN=C~Zl#7#pmN8}2o8>(+B6SD(zQx10Gewts_2{-`p{DS5p9 z@*^I$AA1)P6G18|9d=QRK<7r@Z7@Mcojb)KYr2;BW`If*eepa^HNKrjo@wepur-^TEH!f zi&rd{3)?3O2c2t29bw=R#M`{HlWvP96;Sb93lpcK`7LRhWGyGHw<#**7;$(Sd;$y| z{f`g7e8mWJBkiTL{{hUtRBkBQRXk5_pA?+kkMU!4m|73 z%|KIE3s17smO9Q?`TMk_Cnm+rk0lZ|o3Yd>^zSWf)}7DQ*|Vmk!h?zCHo%HXhxYd$ z{n&mS8tHx1Qo?;feTd-VA7lA33? ze-5hCNeAFe(vV|LHAcfzLKF}a;}%AS-?v@c{Mdu09js{=XNMmem|S! z_J%sryY`f>UfxS|A@nt^;Y-j*O8KDk8vIF=TnYfU?`SJBNY?nzew&-}bn&DFEt zHwIw%f5z`S7A_Jwa7;9MY#IoLaj0w1^D0~G&q>9>9n%l zl=66JPp#}&i8g2Rk829(j5+OnNX*`ur}P;T_ewp{nCjR#Ou@IJ|{M1{G#_vDT_CcdOK=YK+D|IGq6AQffCA{LtAWqlgZVVg(A)I~t?IG66#PJQ$ z4p&L+&tpuY;*h&7Ihj3^&nfJ|q+9hF4-S3;W^;MxfO}VMGwv1r%NBnb`n|BdmW0s1 z2ls*0nugYNbsTrh_yv$Lf=fi%uozjNG3p+j;fd!MJ$qYTY1$$CLa(qp*0DdC&D?xR zNigMKg&3Q-6F;;9u%el4is}jo_j+w1USBXBI}7f;=bUOxp_imIYmVsl*h?s!&2fFt+yh#y!st*kepdCm{p+|npW(2?&NrW}oAWPuJlVskyuT_K2_W%3 zaqsj@p2R~fJAqa?Y=e0<4*L!1yz&j#VOcK5d~v>l?#SW+l9@-&_%V;4)*O-_s}s){ zF)tdWGFCy^5!%2a0wg(q+oanERS~{$=gZIjqm(WKw|yN)~RNE zfcSni<)QVq;_b)7hEpRs{5yC%t9Sa`FGRC>)ujDx#*Zl9Wea{ES^3V9E%&N(h5N_R z{%N_#uCyInucWW#{?i}B^9H_;=scni={!tb-nZVK7MkBdLPr^pT6D!4`&Gv8Cn_#z z&7YRNBq=#p(*Y z8v8Q#U_EMyop{uEwSXaUl1r30m84h>7g1xoDO4!jluX#oMuaKwN@pGI^~?ATnx39@ zd6hlRxQ)A21gHjiuW4sxWzB~Cg{1_c)l&Tf=b~{Jia~tPSL*G^Rr(fwmHa@O`MO|8 zGI^5*hTRgqiP|9*53BBLSZ%g<@iqJ@&Is!^{hFy30eLk@%M~~Jk%thUEMx%xmc-e< zcUoEc3*WC^hYMUBBOIXR^&`)xV8Iz!*q_3i@(SDnYP^>jyom1BNv7{ z)HPPAjiI*YN)~E9kJSwxS_rDBdn_k_7(TSM@)_3C@-C*&EyOgVChur4$W(spy$*HC z!1K~|wls}|NYsYQ0cyE$Ak7#;Ekp9SLa;@@dxWIY`8-mAPvomsc1z8 zutMC-)!p|!b-S@StRJSeWyKn4%4Sn7dsrGv^}0+3?)RSSiu-=wx_I~CLHGJfiTg`O zqS8<0=W(>Nbq?az+|KbdcIY28Xu~qze86vz+c>cR1CMZwzSC4Vz42v_kYz`U5JYtm znO-W7L5l|&eZP`X6D&@)BaXkuG<@X4yII`Wyex*#v>}8V#nhdcWe4!Ao4G$b>^;3| zJO!7|pk3rUmdyC0e_U?}@j#zjy=e^$G*6#5Z_Q~xf4?*7Om|lieyY&uvo1!NS=sV7 z|DFEpmDl?l#TyHLJ2gtIutui`G#`D4KYEW zIQ%x~XAu{>5f+KTkGrMs3-zdP06|LmR5k*9`Zw?|+?*yS{`yO(aEsGB_LE3j=|hG- za_$I;o6jY(C1?lt>7iTMnrr-~l1&~u*u6>y7WjscaDu^l&{(Zm*TQyc6Wj@*Ni2gm zDU$n6$&}_^1Z`??{BxSSv7UUM$rKc`GRzl4yOg7!YF>zZTgvOremvh~_np3$ylamE zeJdWT+-gjA`^A}Epqbp6#$vUpuFkk4!w6k)we@S8kA~!aV1N{9t&ey|5w}d+Ws8;X znjtx*ET@;!*L-hi(zDNS--&1@se_qtldsx@I2h1!F&GA*h5nU@ zHjV{KbvX)?z;hFZ{mxk5{yyWP0Jbyh zUqXqo(?uFRO__=rek(;E8fCDU4_(^w7U*EltGtt(T2zqJFlLvo_91JJnu^e=tibSY zO|e3n`+kUIThtb{LWI1=YzJQgXJN(ap^sF0x5f|!>8&ib_lg*B-*5$*Kx9Qp#9`c6 zgE_yn^_GHj42BdNYRl2y%?1CZkO+`|o?OxJs}wz$zVc+AEpf?qTRc;wWGq?y7HH8)b}_%D@qV)Ylbgp0S-=?GsPifbL% zIkph}m?EkmVld{gD=0sb5XqyF(K<3fJ`B6jC0jqsau$g_AT7l(Bl{DO$2r5Sk(AOy z-zkrzhIdB$Fg!PF`V_s0d}3RhL*+|ZQm<6I}AN6=e0RD_m}hwD4HIFI!i9MG;I#0 z36_?FF88QlT!Z(qj`>%K#1A5UyOtwGd;A<+rR$NaqWiQ;qv7&>W6FxIg>|Mbpk;eg ze0i-gf&2}%lxq7~uBXo)9cq59wU0hY5IF7&mF!l2qEd(lo<$dU zKi=O8F-Vj(dGK|Ty^s;BO9FO8-~aCP&bZL`9?3bpn35Ml`g5*3j{`9GY{!I_w>87C zZMJipEx)>I8z*Tu31mtnUz~J`zvr(eGZX0rv4SIY?nJB$QeqHw%A1zbxxRtHL#?-N zel+ZE=QorQpebF669K9r5{V}cE9g<8+`0|~!?U?a0fwW5Y#I%`eRB=^0O&pF+&gN? zJ4Zn#(0Lotj+AAKDl&LSC6cb*%}1;i2%F`Bgfbs#KDWo)9T9!7KoOc@r?&a2^LB#& z#ul$!-Aa#x0`aXCz-Bh-XkX$6@neO0dc^?%@`?;X$10hcLn*JBftuY;USWr z^cD`j@s^+%Cu1PR--&1bCqT10EH>$W*_{Dl49n}l3h8?1Ui?H=f~#R=qMXgKI1`r+ z&Bcij?d6Ownv?Tdk~Xt=8By-5HoQjkuc5hC1B~l_J#bYW5SsxZlc2Vih3E(4GW!9; z*0|}8eOKFpLVP(@Txayoo570PTY=*3A)>jgMjJh0JqEG*aJ##uSait&yDAGWTE3Ch zaO({+d&U+Ltoe%9If~)+ev8^v;?Wzz;@dl|`quBR?TbfR#^<9BfQ_Pq6JMp-KQU3X z&S2s9G9>*P!P_DdgW&y$1hbIx?B&wQyJ=BXV~2^AhAKD!ojy(o&c4|FAU&PhNiNP~ zf(s`amJ(VBR^d%~M-BfR^(Bcn4Pw%mJHfZU`43*c$&s0_KRmkEl`Z)Y#Nm8U{sA_ul9G+!GS-KpZ`G2fFCD4tPT)N4UGYt^kd0D2I1oaa38BTakN zA$vErMw!i~81t`xeO-E4nUIrQlk)k~O9pDp9QOmxDs4O*Xf?mx`NNN~O_yDpgJ%$|x~WdIx*^e{{chHqu+X;9pd;&I zL;Lmo{uU0S%^W{Y_BPHVzOu`cN{#e_ZRn$tN4zj9C*}kZCp=Y7eihr^An=|tXkB|^ z8~MPr1K(PNO_4W2xo&v>CC1VZd(QK4lhkoxF95U)HF+i47~r# z`wckWJJrIy_3BwC%#gY4!;f(@HxjiN+Y{_N)!k||?2oV%efdXEtVJ%X>|a>F6*!J% zGpEFDpYlB4y=7i-PuPBuq^Td*Yz zakncRU8Jq|0YwiZEG>m1cYOvwENn3G6~#W9jcPqDd}it<~} z0wyHLtLCI;!@D*17*zIb2(;GXlfA`<$QNh>B{M2HjDh=-BthJx)~GG5vW0KGxDVf~ z!^3pG ztl&N-gBp>Y33u6Mc8|@$6%IRdOK%?!=gLXP8o(dTgOkDAI^pWN#RH!B5;`Bkc z$7I?m-k)(~t@apt>E7vFja zLP6G@&RtrGgT(;7*%g`>Uzv!dbA^W%aBfgDFvF?u197Pf{4zJ?{A@pEQXxw-fAWkK zM?D&Q0^Tig_>AL5qNHa-WBZT#PU4{sX0v-VAh;nWcBJ7+(S!`?ncZ@Z`o*2ioR|Q? z{o93s97iMF(iwjzDVMkMel?+{{`hsYf&jgEmUF@;%tGGTh&>+W^rHO}^GZTL0ij{6 zjbP=SIe|RxXvN83MWGoq7)Xm=*5Km<7Kx>bn-35aZ$g0BVAx_GH8=1!ky4#Z-o=aP zrXn+oYp`Tk25HqY2#r>$q(UfaSpOlyNN|>8LhO-dU{!2R+_&GOpZ$a%_pS%bHdkf~ zEB=CyHg1q*+S3!Y!>|v{aZc8ltF$YTf>T;Sfj~%W~=zRim?vcuZsoPJ(;J~+hb}@ zgxZuB(agDF?d`Xex8tiK+tcGCe2X4G#}0uVaWS7vxK9^Y|9{p)DD7}03Wts;VnDi>(5pabLZnGaD1rzQ>Fws8bLZSU zbMN=fe1F`3zIk_MXLp`?clVjuXP?>qJ-+dh3FhQe;qK`L8C!e<;4uAv2L%@ z^_;v>S=KW0J!a@bBl((eV5dXF-jQyysAo@V((!OqT+tbz(8#ASrMj>c7g@}d!kosk zPoIdt^My@`%m$PjtD#)Kx~A4P7IkTdp|6Zuo3E?<0$@n!%Mex%-;EF4yz!mCGTtgd z`J6!w z-HPnj@D8a^qpmDTo6%cz=d^E(fejY+s4;{l;(O!;pzOyV10hc4a#F#D`uI1y!+eW< zdFt`|cUjcT@c?29@*xs9ZF%<4KpXH)nxZ^dASkYEY@~}l_)dUK@2Njsw%(yMxVvX@ zK}xq}u*FAIvrR|)Ld+2{3M%XbCGN9;R=P#_3f&2 zr;JZ1;IB{B3_Q$GHTE?%Gq^r$_VrRLHkhe&Eapw0%WfbpU4zX<5rVJ6Oxzce*oPb% zIJUH<5T0dF^kz@mXd}HxbF)IpbeoG_OTluX=1U!Nh@;$3gEgQ?K@yIK-Mnjs^w%?* z3==$E)>>E<@JMpv18^|7)otr5x17aBS!g;2Rqj$I1QzvRSK(-rw~gQq!m}jG;7%PN zRx0U?@_xBi^FZvTCR|+*bPY{%9-TMSYUkcmU@1&*ZZUh^F^HajMCI-=!%tbA5Q#~nAtN&iDoG;-&OGdp@qC%|2nSou+N?)Qoq*;X+tGJke+T6p{GKKbd^yixzdadfT5 z!o*hA_wz#UjIf_44;)$-&lojTBZ}hSgfbab&l?g@tXOJ2<^I)}A^ycc7m%C@ApES1K=<(v$eDfz)wg(SrjVA0llPQ~yeV21jSWGbg0EH&hWzC_h zO{PN5c3HfN2=t~OYWc5vD{SGIg>>cxTQ}AspbuJas3h9_aRFjnuB{qIvh-MgPJh*@|nj(=e zlF{^Mzd7a-$u5#T`3sgREIjk~fs9J0NnzI57@tsx5ibDF+pQ;m6iJCxv)-_%Il5CI3fdvbn@;IW%woW-C z8$$8m=F2X&oV<7YH-B+61hi{^-GXqLHk~&uL?8UUSm!SRN}TH`fU`T@)vEK%^?AF_ zi|^|1FjCpw*)u$9R(u-&C2ShA2KG+ffHugy&(q%eoi>q9uvSaeFs4w|@C^u;>H4C$ym)@Q3hS zKE%iKKZh4PLcRu55wXx7l~JfMmQOE}J9~)Ot*@>mDxm6~Vyo(! z^8I{^!ITg=rF7E+oyM!Kr`5HAbk|HVvAbmYR z=xh_w)&8^k+_{c)*zruE9n1P==_yBLQbaq&qG@tXf8-E&WwiO|HbyWCoGGSfH(|Q+ zovIUIRY^!KY-d3NlUVh77dUyFluESA+=Z46cFx+&|JqhY!Z#c1h{j>8l-~MI8O8OY zC&7+}tUXMjdbMRb@-_pfIGX2k04clLj-3?e`)c5LC#6$cGE62Z*5yk;UhR;lB<;gQ za4z!%#PwSz4v^R^0n7o2S&nhW@S*!Dv?PI~_baQC79Q>gBT2x!Vo<9hH!7dk#C14b zFT!q80c!!zwLAZDLSU%&5(rU$`D0zWr8q(a)zZ6+Vl+q~={1iOx5#vdl%X(HA1ftjKUk zUCV}t(;v_~d)HNMtv)=#KY5WwQF?358rePde)zo_sRX6eqpn^c(&-jc$aeBx@&#@gBwaq5I&y_1c#AGO zcfDn9EG~H97~<6fdW@zeLoG$fyXft|*s!mM8@PZ0X6%+~05(6jRKX%hjOv!V*G(O) zD5Z%H(KQhy$Ppm`9eKK*zwb{t9~skNAGsBFW!$}ol`<0?Y#KHE6%S4vS$$|9-YcZy z&QC1qoK5tG_PDizQVob%rHP>N3AyrmXiMKgzN5IhT^;Pw1n84T&i6%lZ)%XPgCJFC zR~{_9-Se5^Fk`b)PAj3!tL@%&XmsX18`(E5{vegp zP5imjbxeBwX8E_hVW(Nu;iPUEP>+(G<@Rk0cJAl3yzPKpiHeS`Hq@dqw0?@-2kNTQ zNjD(?6-qFpAKxhW(T{}IvF}F~ZY_U%VAW}1)bV5s&cjflNQhSXoeQKdh0IYH$mP=& zs`tpe^0Q~&qsmZemlXN4KlK_7ueM%}M9U(LNF9)YGbIBDaKNltlhs-O!VJaJ@^q(zSfoNXFIa;1c z?PA6Jn?Zk9@!jg0(JG6r3fGQ4nV9v<%PEo-z<7nnt0MmNIrnkmkx|}Gof5WGH!f3u z3A^IHI5ZD<%zHv9DBt-RDzfnuR;&f*9Wh8@-EVL3Eq););;MG?Px)FOihST(G+k!|@pP+-@!z+Z;}iqyW$pEDO!!C6j3sM!0g z@s)6a81$as=9^&rO?QauDhwvT1*^N+So4`F9p)1KeoGbB;87(E9-YB?8}2hU(_vW# zJ%2B6UUBDfqJAr4z`>|QecmAzPI*Z==Qo9+JO*uOe1X75TRWw>LFJa5;yq{RyW9M+ zn+*R4_OWX=4Xx%zy0d0AX)iP0&UVu~ju-q9B4!E7pg-N;TuQkMYpKL;PR1P@2cDt( z4r-9B;>80y%qX$L!V^tha*nrjvBhD=p_vcDUBX1-nr-;oX$Obj*YsR6nc9>Yg2rDg z2IFbCXEr|)gRo66f(;d`R+;Bkq$BTb)uB}R@W*StKOe*!>MHxnCnJA-RA7Nr?mM%s zLSbg89^&2v!FIe=T%V7oVWnrMk)<`uZQD&ZK5oN{WK)^=#!w9k)xiiij{?}j;r}NY5qQ4#t}pI$%KEt92q&HcMAhoE(6dm@8xkYLc@{8) zsb@?t;wNRVG#1bKiF5VDoztL&-8J_eun~Kk`09VFwpNc-#sm{)Pc=Gsf_x6=lAS;I zhiW|ekCkQSX*!BbY`CZzrMaO^tZ>Wl{*QA1?8J#nb}2<^=v#*6$A;?XXWS4DR3{?( zNm*+mxc^3Tgwb|(%^$+IOPB;@@Fw)TsFCT{|EJ~rbDIAJky*0yf;YSXeA2v_{u_`O BGqL~x literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/duros-controller.md b/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/duros-controller.md new file mode 100644 index 0000000..676d2ba --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Storage/duros-controller/duros-controller.md @@ -0,0 +1,106 @@ +--- +slug: /references/duros-controller +title: duros-controller +sidebar_position: 2 +--- + +# duros-controller + +A Bridge between cloud-native and duros storage controller. This controller is responsible to create a project in the duros-api and an authentication token to access the duros storage. +After the authentication token is created, it creates a storage class deployment in the shoot which itself authenticates against the duros storage to create/delete PV and mount them. + +## Architecture + +![Architecture](./assets/architecture.drawio.svg) + +The Dataplane is built like this: + +![Dataplane](./assets/dataplane.drawio.svg) + +## Configuration + +The configuration is done through a CustomResource in the shoot namespace in the seed. The Duros CustomResource contains a Reference to the metal-api project the Endpoints and the name of StorageClasses which should be created. The JWT Token is stored as StorageClass Secret. +The Gardener Extension Provider Metal will create a Duros CustomResource on shoot creation. + +Example CR which will reconcile 2 StorageClasses, one with 2 replicas, and one with 3 replicas. + +```yaml +--- +apiVersion: storage.metal-stack.io/v1 +kind: Duros +metadata: + namespace: duros + name: sample +spec: + metalProjectID: 5820c4e7-fbd4-4e4b-a40b-2b83eb34bbe3 + storageClasses: + - name: partition-silver + replicas: 2 + compression: "true" + - name: partition-gold + replicas: 3 + compression: "true" +``` + +Ensure you also have a ClusterwideNetworkPolicy deployed to have access to the duros storage servers with the required ports + +```yaml +--- +apiVersion: metal-stack.io/v1 +kind: ClusterwideNetworkPolicy +metadata: + name: allow-to-storage + namespace: firewall +spec: + egress: + - ports: + - port: 443 + protocol: TCP + - port: 4420 + protocol: TCP + - port: 8009 + protocol: TCP + to: + - cidr: 10.128.0.0/14 +``` + +## Use Cases + +There are several use cases during the lifecycle of storage consumed by customers. + +### First usage from a tenants project + +There was no storage usage from a project before, e.g. because the customer created a new project and then a cluster is created. +Then `gepm` will create the `Duros` CR and deploys the `duros-controller` into the shoot namespace in the seed. +The `duros-controller` will check if there is already a project present in the `duros-api` with the metal-api project ID and create it if it does not exist. +A JWT Token with project permission is created and stored as secret in the shoot namespace. +With this Secret a `StorageClass` deployment in the shoot is created. + +Then the Cluster user is able to create PVs. + +### Second cluster in the same project + +If a second cluster in the same project in the same partition is created, the `duros-controller` will see there is already a project present in the duros-api. +A new secret for this cluster is created and stored StorageClass Secret. + +### Clusters are deleted + +If a cluster is deleted, even if it is the latest in the project, storage volumes are not deleted. This enables customers to keep their storage and consume it in new clusters. + +### Storage Volume and Project list/delete + +The cloud-api will add endpoints to list/delete duros volumes and list projects, this will be done through a grpc proxy as shown in the architecture. +A Duros project will be deleted if the metal-api project is deleted. A check if there are no volumes present is also implemented. + +## Accounting + +Accounting of volumes is done with the kube-counter running in every shoot in the seed. Accounting of volumes currently not in use in any of the clusters +are listed from the cloud-api and reported to the accounting-api. + +## Tenant separation + +How tenant separation works is described more detailed [here](./MULTITENANCY.md) + +## TODO + +- check if Gardener deletes PVC's after cluster deletion. diff --git a/versioned_sidebars/version-v0.22.4-sidebars.json b/versioned_sidebars/version-v0.22.4-sidebars.json new file mode 100644 index 0000000..aaf562b --- /dev/null +++ b/versioned_sidebars/version-v0.22.4-sidebars.json @@ -0,0 +1,14 @@ +{ + "docs": [ + { + "type": "autogenerated", + "dirName": "docs" + } + ], + "contributing": [ + { + "type": "autogenerated", + "dirName": "contributing" + } + ] +} diff --git a/versions.json b/versions.json index d85ffc3..bb8295f 100644 --- a/versions.json +++ b/versions.json @@ -1,4 +1,5 @@ [ + "v0.22.4", "v0.22.3", "v0.22.2", "v0.22.1",

T0I@olEeAHeh^#uUMme`N_XzqOi{eU;>uj-mgc39NbP77RUxCvPy5 zCf`Z%h^c6<97-x?uxH&fB;!F;&BM5>9;RT>coN|bN=MJ4v34arZF?8wdWuI* zLr+H7`OZ&KR40n+PTMnMLV@P=;c)wr6$hdA{iG5hCg1o1wQCj;54Yp;^|#8`Oasm3 zXWs`eP%v-;Q}1|%!#kG|D6Am2Xf*47cRQw@L`h#0NmfZEIw%@`38fV?I9#&~fB%u> z6`#$syM;htJu4+yCK(G+G<*umRsRL2w_l%AlmjTafx!Kz zx=|+gn`tQWNswik+}vE^@%Z1&>1LXV6ql6HP+!loWy_9v6{w;pG`BPpi9~2@Y^0{9 zhPCg%Pb3mX(;WQqkAGz8(xr5Db+LK#W}?w3m6dB~ZEL~f@v>pV27d9xF9?N#Y~Hk) zw)S=uHPbmsLN^RHZQ5kjZVSQY&6{}r^*1mLgQB7$Hf;ESXP+gvLTj*)2K|&%C>7=7!i>0zo*Aqv3j?mMxn^5as zdYWsFq~u(J1P+{tiWR z(OS2TSoaYEMWaw19`@Qu+#H)j_!9AfeX1A zs8buiu!2L?ehlmcmlc5bPbs@`YdO~2;R!6%V(GwxUod;<@^a0VHMgoPSkW~k} zE1zWFh8L{zGE=9q_H95AC>%vH+C$YF_tCQVJsh4~;-NO0_q>D4*PonzLy2_OvE{Y@ zpu2Ggnlp#S-OGuGTF5OLjW7-Nu78fYtxM6|emWbr(B7~a|9}x_t^kKWe1l!9pGY^A z>8+29j&RYxrdw(Uzh?J({2oABliL{Eh1I#NwC)=g)_7EB{)g~m;t z#@ct%HnAq0)o(pW*OBd(SPYXyq=T*_)ua+34)1&oSyAy17(p!5Le1Nc({^YBn#0S- z>O(IHnrh#sY0oMgp4<~62A}wQ`w#G$$Lw$Lph2hnq?aTKpU-znO+$Jkgg{Xgh71`@ zS6BD{n$NYGrbJ03;sgSLW0cpKP4mcz?vX9ole5x2!4MKs;Xj| zCgHHvxWF_`d_EtcPzbl%jmvecU?rn2x0~pB z^9Y4QJp0`97`o1+NfY_YUti|wMGJZC$3G!IKc7%2L?V&Mc3JcL{U2LV{?EiPO!D$_ ziN&HcH@Bi`>S;eFn_dV(GTwvg@TCQ0peMoz)3oxZ!U}Vz5+O9F4_UG5ZS|xTx|Adt zSx)C8-GOXJD$V65(|Xc066nbo4!0jkQqoAbhKt>*H7#0g61$uLGLj_R;fQ(-L2~rjPK3E zNLZc3Bw4{UbsR1~vT|I%1WCe3#w@$I0toYO+oiW?O9+!>tOw2M%?j^&?^ln95QywK zr{Y$_5FsqFo9fERP6UK$*~)5SVxTzOmij;KV6D=>Fp^}Qi{|v9s7D2@sdzA*lQ)qR zE!|t(+P9vFSRLikB0)=3cC2#z=wZu8@0)a^6IFAcpw70ACxX?T&+26^DOMoYNX0Pq z z4Qgillbvs7f0@7c-d+fib-=M$jPKob7q{JU2YdI_(%sd~+2@?ij_o`6{`bF6M`tIh zs?xhdTjm)0f`hajci+Z(OOtBlpvg>L6(q>!@g$`5L(KY&B*{ofy$gFR1+g$r_-ya( zO;gYApI+ONei1_|5u$ALY|j6};{;oF5$ZfdZeazA=Hi1teuH4^9u&=$UVR?jhXe>= ze56iSN;lLH!aQNyPcpu>PdOVF?|rVlcPpiP`?VtCVi>D$>_Tq#L^&{kwIHnd{nnOesB9CWau6-*@^x$u#oGw08X{GLxgD&$$!N z@0jCBtF@2bmq+b+jE&Rx-mznt*^;i~ug~AI$qDy*=J#~OLkMxwYx0rjoUY|R={A4I zbMQ0kxX%=X5X9qg#*Z7v#EBDex}4PRuI0VTN@DRiPKTpUJ3`xW_iaog*>@^a(zUq0 zf}xa-nu*g}K&0~!M|LeI5ot%!-0AS-KdD##=^o$avx7vo-@qr@+;-f3pG?2o{`dNHk8krC zK$5^T2zMOp^#-z2-NirFarb#u`I(3i0*}Xo*XvD(q^xkg?Eq~)Z3tnas18)EAEd*W zm?sYze;UWPu{j-_R>y6cW;SpAX?ykLnHoh%i;6J}^OH<0ZT?xL^KLyYyZcV4+{Wg! zLMBw+M;?l&#c^j|JsFQDaJih>*J;|EeiTK?zPdCc?y%`QWa^V`Y;69;^r2_rXAEr-uNKLca4@M$U!r{p2KAg`SnJ#XcqS%6E8yg#& zK2D!-+?mk0oNhU2^RK1%8_{fRY;0`$Hhscz_r}g|+t}FH*w}nDb~4k(#>U3R<_yAi z+%`5gHa0eA5VqsCv9YnSu{ndV9k-2*jg5`X8HDY)ZES38Y;4XTY{zY5V`F1ua|ZE0 X+MsCHjvZ>>00000NkvXXu0mjfhq5+b literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/tailscale-devices.png b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/tailscale-devices.png new file mode 100644 index 0000000000000000000000000000000000000000..c5e45a1d19281918f7c6a92e615928e92cfb1cdd GIT binary patch literal 64023 zcmeFYWl&t*7A*>a5Q4iq1a}KgAP^up1b25QxCH_Px8N2eK!UrwJA{zNU4y&BTm7AL z@4Iz>ysA@m@B4MAN>#dh_v*FRoNLW7#~3?INkIw~i3kY>1_o6|T0#W|2KEyC(?>)A z@3`j+i^9MlReF8UbX75Or*L$3Ft@Tbqj2?fG@~%{urh~%@t7-3(W#^Ixm?+sm)-Ba%PFee2aesC}nDS3A6t z+Y2cc&ECCHD9_PZ*4VxBpx^$Ox^ab`eZ<|sxa>dg5i`ELo-?>7PW1MsU*hOwAK5YU z{KEZC?knL#W8S#r!Dz1E)5Q24tY_5uwRfTaBWabX`sge4wnW82Dvm-6n$1feFNA}K z2LE>VDa|MXK)d7N1Rv9{-XLkHU`(znP@6 zvUPRjX_IU?Ms=_?2$d=-yAowsT4HW|A^LYe#*^BRaM}<=zdu&y){%dI3_U6Q^{_2* zN-ZVIs3EFx>g`j{Hqa*C-W=>b?h=YtO3~cLaW|;xwahmg`a&5|GTVLY_M_T8spg+G zeamIoo)mK4ew)jYqY+NeeD+XAahV3D2hU$wBQaXh%=3mB*wBcvEyQTSB@9kec zlTGFiG);Wg%aa=BYBM%}c0X6u>VA8*=*L2`6ti&Nq_uQ(UoTaJrNa!LI9sCP%_t}& zwKq7y6s-6rHFIfcd@iA_x~_`Em>_MQkOA#yyEZeCYGvzMlXvnDqeJZBAz_77o_bG{ za_=fJyQ<-|JOj>OJh-WZUJy#!D9!>so~24D*n-MXU+sM)>}4M9vcgG@Ddxp4JPmo4 z=&$I6F{YFIBbwI1*~GXoD4A7i#hAGKYtIREybF6st@T*;zQ%=S=GGIZ2mXji@)d{RZ8e#Y zb_h4_G_P$Yl_mYXzRliYg0j-`+wZ(jOy7}I=-sw61p!@Zz|Qka%T8dYyU1j z?gK_u`j8SIzqdT-%zonGGi@9qmpb@mW5QaS zUvsl$H!xRO`3Gf=*7>7Xx*GA{=jNY&o-}7^)sZ;Vansgo?W(_j?rc#Zn~DGFbs<&) z?wk9;rtN?x%Ye*1&8YLvlh4V65M9AUMv>U61s6I`PH_W5Cj-Y%*t$hAUUrxiUO9=hi;4Nsa*RF55%(}5 zw!S|IW?_`7_ZZv<9M92JT_N1Tvw!lrxy64}$28mGYNKbie|?vO6O@dyHK`>g{n4PJ zFDJq$!rU>UOO;Y;VtW4197A~K`*ak0$mE^Am{cm**i*HlS?j-6m_s>>_B;cd{=r)G%NI&o&P5I>cu-gTY=yFrB%<~lsj^K7(|Q1Npeu}B7A@MCK~09Vl?*l#}w=# zfiI*!Dy3IgGpuJGuxNNbljkrb#nT-yG>b5-yW!fI=KB!d<7>x-H+60zu>HTBQ*omu z4X)CJ+5QAp(x^3ssiOWyzNRM25I4weBZlda`-Ai_x3e`GZBGQ37Bin%vBtRr^9*a# z;E094dX0h%@3|_)q_Si<7yagMcXhol{zaDiYYffE_99=mKCoh)ldN`a28ut-r8KH% zb_*`I;=UkmQR<#L*onkg!k=tKRy3OCkD7S-nhLjuQt&8TkK9xirTL88|rmSS;SD5&6qU1s?IdX1lcfGr6~&m^ia3NMrQ<&DrX1e};wF z((72fP2>z|=H?qn<2>ZNU~P8Lih5hV-*GxUMn&nwiV~r5pG^sp&(~oS^~Vvb>^bX(Q!gkx^N>I-7oexGUHJ0yu=;=6A2YF>*O zsdOr>ZorJ0+0k;Y&C&atAMcljOVh(MGIP=|4Og44b0O@uQr2J2S_u?IUhr2d@EDPP zy^O2jW9wU*mAsb-Wv38d@E+?hp|NkkKafQE#?+ljN%xJ9_YECuNKQb#*A<~F1CHK} zGU{^Hq{E-Lm|k?U-A}|XbjE7}V6>!S^2`0|kXbk}9V5OaS+5{fir^173gk47On%p5LsP(lzGeL!z4tkq0UBo-n39;wt6t9JGDHTZyJt-youO3coG zdiI&y%RE@d#iGPtv_B8lU}Z_^lEu-iOB>g<`0@Z+HR&Dl)bSR1`@!Y!!7U4G0Tw^%fBCp308J;iDjiO_rMWO#Nq zB6qJbMMFsgP>2(r!L%2gt@?~$7ruMeQxyB{$dl8YuE>Ru)fOisa@9E2EH^xL%kp4e zPQ6n>>09`LR@cf>S5;yz%2}n zkf?{Fk%^6&D}}L{g_XT9)lqXh6@`_lFqH<6JiEN(TQf^5X)k9pRWF4PCSEos{H9c* zB1l3W0$>0;Ggl)D4?A0X7Xc4ps(;260RM-+%|=D>&n2!l!c>~_N)&G$oXse>S-Dx+ zStLEI+&HO3kSK(lP0a;VB;Ngd2=Gdn%F@-m`1jyYp#DEc zw|DvXB7o&!gMPxs!OG6|&*jip0!mgMX11CVR(59gE?`VyDh_sb?*Hv$t^eiY*X->7 zOol?}pRcRAm^r_7umj(Ag--F`lN7W4_p5)++13g=GXYy8dkbMI4;E81bEA*8u2dqb zCeCKyXDuCEh1j6?Vr%v9G5&e=KL!!{XW9b)+b{j=8~@8{Ko|L+?}1eYL1X)$QTx}J z(7FBJ{QKwT|8M>PbnO5B$bYoL|6Q*CF4upw0{_v)|IM!dF4upw0{_v)|IM!dW6Oo~ z|KdI~djR&_0ji@3*VzMz5Z*;x<^v-5^FcKI0s}(9+Xhx`&#E~jT5b~*PkIr;Co(3~a;@Cr|=x2EMDj($?CYbDJ z(K(ry`ysGVL_AbnTnW-Nf%BW<@n#G5ugPLUfBjNn#zW>!KluE+fI1FQMn-1AYna7$ zzAdvi0zdC3-2tH#xLXYCQF5};+}cg{^?u=@V0?qX@pUofT%JoM`kuCXpClHYJ{^bF z-an=D(sFVo91XJZ=jmztYHHtGS~B*^T9fX`eK4~7-(Hak(=#xH)#KbR`9c@8YtZ@E z&mXi2FSU{;YY=;T%?7F@#KoT-%(;KlyF=3zSW&TWesEJS)0Ghy7Z+;KIK+?PS=?(P zL+_~c^X6+Q*N>-h)$6yeJso|$Tw&ac#A`njFuWOc*VmGWcH7k|B81lJIbI zBgAX;Y}GMEiC)53{MqXz4{BlWa|#ZQPxlXZH?}7hKJ5M?RWwGNsmFH@G_PJcO^v>G zQZLV%vE_9;TB9qQWVmf-Vxx#(pPWdMb2*<|dR^|zI6HHinVBuH8^gzlp1_Cy zTysh^ai8J8y7$u+I94fZJ{0h~F{6vBuG;yNNB62%l3Aw?MN%0=%=KU{*ru!*EkKIQ z^XuiooReR>AIZS-aDt+6Fl6r)HFeN#d5he3*&@tw)1vF)T+}E3=18tFzRXZEzt2ka zIKIp08aoT$nRbZm>(k2?y&ZeiG){hF$8cGlp3#SQEr+6S|0vArGObk7)dca+8Ry?- z_n4q4Yxjd+emaJ8Yu1Bz2Zu+_pWk8dJRwFs{@n6!m2r3-W})|K^$R`#ja1-xfEqn# zPhg$Q^RxY;*F-U7mRY+YfY)yRqyr9p<X z8=sTH60K?kHML1@)Ox|W8giuI28$5_0r!Kx!_0Qa-p%BxMp^uKF(hH*d#ks^_NEix z#J+z0%6^%};d=Nh(Lvo;zTFRh;=9dj`}PCg1y+3bMd1)uy{2#UNbU=sFK8oz>B#&u z6biG&VzOFO1h@56RHk<3>&sI_*`ViNlK|#Sae^6P`|^vB=x(Eab`;jeYh&AJcs$nY zl&}O^r;2k5VqROrdlPKO#AK&SEsM#YX0l1lTH;2Xu+Hh+Io?-?4Z5tqrhe@#7NS=% zpY5*o!Uu`rsDbn1vpA)*i_5Ni=gp4x=O1jXJ^keVks$Xo3AqSf+mo;q~r@|*UCkyW3 z3$bOCtsrGAXWRZg@oa5|Gso>Nhy2^eW08a#AOH3+6lQdNy7%?D*{rfWtH(nvs`PuL zl~0S!_!_yqZF2EG?UN*Wnj z612E!K4h)?M%>(NXG?mL#%1~f*SXcH*eJ2k2WKTd45^b~tc1A{dyLMRFu5^44 zT{g2ggxl*%Bt3+X(DmpKswB_J?6&MowFSC)HDS=(yiL^Z4qIMo4byz&=WpLk|FAKS zc%CqbLz-!DLYQZqmRVp`^fOGj`Ks#gUioaTH@-q)g1_hkw@Kf^Xt=&_UFI8+A67wp&Qj^(sxh)fwnD<-S2=s9L@#DwWq@?(S zgl?B{k?wR*pTCJESK2QM@Y>CN9$huK7G^j3`lwxD7kIf|;*(s96ae864V943hkAUd1_nMrPfS5?A3A^q&=L91dQz z?>FVF_Bb(q7egeOEz+tyiuVZOvANQz@@q;3mU`*FoF1u)85;$`(|%22X=FI>sB!zG z^X{n9>dd^!^-#`!%G~zW3Jw{MRU!#D%kxre$zvV0tnpAlLAaKB5Aq~^cX_~<=Ys!C zgbkbatI~%L62`{Q3Tv!}huIX@tH(vCDJkPbe7*AMk&yA2zvbskjF>^Ik#%Bx#@F*5 z^2TmWZHV8)SfP^}nqM~lcPbtmCnpXN|IMhU$7HAV{%RWt>%NoGEp0#@?{sCvy;D_{SV($mwgM7>@% zT1Vc&u3&o7B!~HbLG{yvciqIyf@Y zwSDHa(g8a(JiKmYWHQf%0tb!&#l^oDUd1I(`Zqk;<1Zu%XFXf>OVpVf8yopD(U6cM z2FAyw;`6WXpwQ;RxLSK~bhLBT(HV>r9v(iy&GN{OrIW_X!;?5N^6vTp76}Py&B{!2 z`JeN69^l>b7Dw58LqU^|<-lX_%$iP@cDe>q8@nsWl1mLF#)7=RiX3y~ zITT+94n$Ky$GiA~xDUNtDdtPZKWD)IPj3voG>8$dLu+J?ut0=v&WVqtFf#E91DA>( zhV|N|04LJO(Cy1Yr`VPK$q1bNVl-Hk1Snatz8SF{_5=vwxhsx*6CX3dsuozC6yp4| z!jK z@3k+vWyIsBEg6W74`Q(;p}+E%jT$8$DL#z)#XJ2Qm8 z{B~34v_Co|g)dL5-X8cal4ek%%Ma_9cEZ#yQO2$v$E*rWX7}(ojA_@SijZXbO!XGa zLa&aJeBCsX$9p=n)u_6l^b}IU?Or?y2j)@gW zU?_aJb$}VnEXayXFIT(eRcl zjyKap&?N1phv;3Le@!g<+q1kG9m@16CJ}er&PfU{1MA;Klv-L^-1ZA8eNn{FvKxee z`dBgd&4?gBpC%zK%_~p}NrL)g!q{tL*%7J@(Jwi{9Fd42`rV4XM~hi7`d4DMVOrd~ zKGgkO1!9noeUXjnlX>s3UWOKz#3m)X6R8?_g+;Kn5tKtBn1=_d0IoD!>5xqo@&su~ zs0S(T!K|Mj?f3+zRcXv$n7#C}ec6C5ZFA4ZH8QgSw9j3u>~YectExDK$YL~2-(h^V zra_?&G*ys_H-2bscgtpHN6GAY$HJk5&8`$XLP*e$Im3a1BT4z{6=6g#3W0R|=U(Fi z<-CxM4b!}z)`#IyWV~hy+NZhcnGTKFA4_+rsTp-fgV1-2~yhXl?!&U8t zC40n1{fd=_(0Yb7@V*`!}CzOXC^3#c^F`i)3YmVG^t~+R$bp|HM!K& z?C_!W9L`8#=AP(6Rt?rYSJf8g;Razcff|SL$eu18(qOBdCOAqLaQS&^j zDcbx3Uc;xyXCKtwK|Z=J78PX>>e z8Lt>_eK1k>bX~+4;k;j+Emf&3Y3hbd3Bsw2#bTXUXGVLD60Gu9DvF1O}~BHt@I*-YP!FCsFY zjkiNgH!DHt*W0A-&Y;-@omwcdeN!0!+1AMl96Cweq4y^3-H@UtMx&Au-=tH1V zHYu5eD~tHMGp<3)SycBy)**CTNp<=5;yU8y_8z}`KT&&Nni>tsl?ZCerOz)cOh`|c zwYO&lSgWWCwVPc@EinX@YhZMg^7ZTFnwsApFfj-tGu}kM@?}{0`DahwxKthLP3usi zz&)eP++&q9F)TNA!~Lvz8id>|x#h8zQ?>_M^*<$AvV0^3IuKUSgaJ%EtEE+AJsn=Z z>p&HqyazaN1m>!A8*F}u~32mVUXdz9TrzCb>+%X2$ZF}rP>-ED**92uFw_wGQ~a}&2gx9oc5E7*ac{4|xV zyEUJ92%Q8%K4!k@P~^kv+dc!4EEdA-7aH=LqGWx;Hqck zs?FtPil0paqX0BN1=?xF&YF&?(;6QXCdwDL&W1#ekT(7*< z-Q09N_>~B#y8Kb6nWJVw2vfF}XHGXVT@Ajw6_lZ`YCdPlUX9R)IdE~YhV>=)C}x5o?JkE)A%QkrrVczgSA zMeLhS-i_cfu_=0oRX#Q0hjxF;r7zKMO>^WM$=}Z2{##tO_HZRifrAE`Xo#LW>2}ss za{h*?+tFNai|5hFG{gXWz@k%Uy5HV+dhqnv589Oe6b_S_8YgNfVS^VDj7j~@@zHbJ zsCs^;%9HD8BxSH*G`({E@mdr>4?j8?@rchdgVwU|*Dv>%TOtDr;U#(UB*jg+k90AA zpUqaUa&?Ir)YRz@caMSgMp|0>TSLQVX&P}aF9GxFFay6?(CU`zeodyE04e`cChRL2 zv!og>;GQHU0j1Ds`Mu|ej*AOBf#J6K{2T$aKcG7f9^ZzeU|@*L$RH7?bT9P_rH(T@ ze(rjkncC4UDeA4b0zbjT({P+LS`c!Z z(u>4I1O`4E6KH<@Hbj4{7NR%&y0{Hs_}`5QbckIX>?j!wTBh!N*{#GP-A9c1M#YEF zXz>&=S-V;<91$cG?+NVgT5(&(VjW$os^QkpzXhvRqd2qMv3`-Vmb+ z#{Qw1Vxp5H!WT1Df*qo)@`e5})?$myIlFxhL|uji2q5RmHGD@i-Iv6g>ke|SZpef+ zD~_>SM97!#kNi+AsgonKKA`^tdXsLLc~vcZYB+3ldq zy7o^hfifMOHvrw#d6Z#cVf%~C$$*TI2&ymWeKGhvNKE8z-vwX-0u)Z$8TJreKYpEh zTl0+~W!t5eV9K{4$LCXuXP}N$>`W;F;Ow!;s$FM0$TU@WcDwf^1^Vou7wEBLH>WtyK{o(e#R)F^P0JgROh7N*k@>gh||_7Hpn zPuL&)q&A3u+uI8O7#GQoc|-AqM$Fil3Q)fH_xIO6Rx-H zz zSg-9@70nf1N>2xOoG5U`yNycl(m{CSmXcN8;*4uudxTFds?uwPAdl?=8pW1OL`= zkOSr;DV+h2$&O>5+f#t}s&kl+UR*WYW@|s*NKov(TN~f?Mhh`IK5$=-%gRzHR%hW? zatyd{_1*;&ot>TCUudjW5RQ8p=xA%&JJQ)o43qk<)Z0*TtV^{jv{iK4UMbYF<749j zAZDInAi{&ZqNVJV(bDp4X6v@hPbvVL0F(_VqbKOLzXEtK8Un-$hh-7B{TXGB(8Vt?mDjae9}q%M3*q02 z)i|ci+dt90Kqu?T|0!J+IlfIzfCA7_bg%IbRj%s4riOr0i;u?wpr3Hpif`ZT*{3)6 zAAyv^jaohUnPwP(2qIqVFEldyv(?0fQ-ls_b9KIgzT?6%=QXap4oiVFOgOl>IrQ&^ zu$8;tp~kU8+3LOpU-$bk1+~21g!F{&Iy+Dk0zv2I9!{Gbhl~8;>JgEEPlZUe!VY)! z+iL;6;v|QGN^dFK=o-i#B?}8`{d`b?75p<;W;~ZfZ=yFqOae;>)4ZtQ*%3QS&IuQ9HeTW8|MXk_ukg~W7q1F z_40UwH{uAotoR5OZU+J%62bt6*&4}|)wZ^->7`(cF&|Akx%lbuS65(803UFlfB=ij z&K@5ZeHsCJ6X3vKm$zOD5E2ps@NQ+ru-Np`1R%Km`Q}h!hbF@E{vacQ8B#O=L4CBL ziby=oDmwg{VpU}VM*7w6)eU>B$KwsYW~1|~L54y2Aj+ZlvT?YRzKAPZnUiO`x|DH-MQH~J-4t_GIpV%NL>6w`~Ryu!OpVtJv zke&RP2>_sqDscsobO-C=XX zPFIA-eOUj?=Ru%J8niX<4abE>08rI?-GUa;jpbzE-BEM0>RgQx6!{E0Z+_q&J~iQG5CJt!b|IF-HS%1%eL}(FjunWY)r20+L(b8&C~w7 z6dnrOYntctq%Ho5b0e<|Q6sTz50?wc&uG0b3O)!{-M1B~c=|mJR;P6($ZW6EtAoP) z4T|MbeLb@PW6#Fo_s>~)HJe)&z$s11!4Y@0?4KQsEMmTvFC%om0$22NNZ6#G(|t^r zj94`KYJ1e=mWi#}?LgbU@uO+tZsf<{-!!l5)#uT{8t%HT{U{Q9`eWB)J;f#@n%a&^ z6p8urZ1m|dbea5{YM~HNpu$H_pZ^ap!1bm7vg5-AH4vGhy-%adcIZFlieh##*!ru_7*?J+_8u$u71W%fVwSH5+96u8ZqQC2PBe);BIJdSu7 zs%06^KzL)wYcjpfKOKJoej$Ld=t&p=SRMv!S0PD8lBV$#xq@q$)ftlOp-(c9j~~=J zO*yf{Bp9`s5)Jf5_picB_stcpI<4Re$+Y3OG=^oxl}oSnZc6SPY1)1r^tX2DM9$g* zZec}G5qWZjv{zn(L>?qVCMXUhoc26*{vi=xQ$EN`8 zOv#8G8V-pefU5N2DrS?Z%elP9TSoIG5ub$XGG~HCjC(G0KW-*+JN!X`gL1{)H)p8= z7q8yS%2v+W0)jxm)pGnTx`;%%zOa%U-jFQ%DcC|nR|^tQJhW6w%w^uvoyKF+ur;^G z_(=Z&aEFCiUX17>*D$SKmlEpo*FyGNquw!4Z3y%y7v|ICV%M_lDBN$QD(fX`H>rLo zPzW^LJ7Rq^k`R)(Z=Up-SE9L@iLWNFo2P~>S$iEo)QyWDZ{zBoq)K+wGie4tztt!C zQ93C6ppC^jXH@r!ywOuH9`R<_5#QeQ3f*Ca<%Td}_9Q(}0K;GUrxn5*+Yzx%h%x$y z>1Bh5t4hwuX!lt5)Zf>?duQG|RR)mV-5;GKBkfn(?KVXNS(u+cH3XHIN=8XjQ$kCN z5RgLEvm|Vm?aMK_^cx!+E3N_zjEtsFk8qmIN!O|+K#-Z@zW4L@5v{C=3C{)nSk$O} z;kR!AKugm0q{4<@-I%DMAV3-@Fz~M?Ly&o^%uM&#@i$C!RBwu^DCu*!`33dV1-te{ zR7p{LV}YOLvJ}~>Up^$drc7GCz1)geO6TgK{&x8J<;z&kRTAHL$m?BA_YbMyeu=AnJ`!8ARL zb^IqaX-;`}$D4RlQ<=_Knrl+ARuO*8Pp$T-o5g@GJ|XhlG}KjnQr>sRi}?Ot)K_j( zIc^&H7$U+1_+;gh-CND{B1t7tdt6xU_^)|evoV>ldBzx-j%&YfI>=mv6gj1e&7Q1{ zpDDiuOzkylk8gDuhD!sK3eF+J`~)SCG5%sgxy%3TjW_|)8IxU8^oNY==V+!{WiGPE zq~)58V&``s6tj!z-?zxwytPZzlJCE@_$XwCH7xp|(>qp3f%xqA$%sp*AqERp*fy66 z&hv=gKxWyU+pt0BjjOx$VTMOSt_hiVobg15TJ4h?AHaWr(5)RYFfkQtLS`Zt?VlEx zt9ggy;`51OF2?^_n&r~JPyE^oMwE&7Q@xRiho(st^SZ0R(^p6d5I1FI6yAH)@V+K! z7L!bFx%1Vox9(-In}b$YAnrH`WC9r;14(j?f7vFXY_G-!g4R6x&dO>xyX=x)1`B}j zg#}%3;Vi&yi_PxqUC6A4K)r;WJmPcRQ95is5&?~o=zYbO`}2)CdM>S`m+;R3OHeyh z`KU!&Dn}!e+tNZJKLsiXpy(C&H*ui1Q~Z*wc;<$T+Y)0mjmHEiS#%pm;uxQ?3wce< zPNMqkKb@T6^|8^{#KdWjgwnRwA^D=|m_pi0+PR@8b&=?_v;mWT-+a4%5g>g73&m=8 z+14N(S^uW9(^BI$r}@YtsI9=4l&t4Qm_R2_g@LG~tE;j}z~~>7$8+$gol5#6GP*`j zQW+8cS%!{N$n9cZwOfLiKu*tm^> zg77j}e8GRY^?rRT9R&5HH#&M#AbR>%O4nal12kMf3-&|(W3CZFf#}cr@$y6jD=ao6 zV+3H=#;c{ffq?;FcZmbE5vSQu1WJP|g*3)XDWIL6(2;@kS+tLNfe_RG7VzE1l>pZ} z@$H`wS#O%l=|NtGc1x9V^!~9!hku4Uj|_Ac5Qm*61qzI!s=DSydr{_;>jys?8E~_P zyy=r4fqJ3<;2v#47+`yPjXRAiL4yL4$+>ZDcp^lc5(^u9{k0p=Pdr*J;}F4Nlsr#r z&@TdPRe&dpmPyE_!wORZ6lTofqSk3I7ArCLm#<%OKvzu`^CEo|j}7?0#MudY?CZ(Z z5!%(w!N?b0>&t8eC_tZI-v$D_N%id7(QA|-;8w~|pc@ytB1xcCq{RyBsn^ohCPF<2 zPBSau@loR+OB?gG<#_{cn;r+i9SkG{8ENS+Y*#vZApNDkF-~$SfY&c}9ccn2&NEWw z7*`$h-@A97=t_P6ZWh^K1TX6IB+O+oN=q#){MezStsc^AON)U*cBy9!(c9$Y0m73U zEo=K45|EGV0l$sFffDqO-vzW98=_jn2|#04%tYPi01!W>KWJ*#bUaH~NWh+?+I%eE zY&gkwrsC7ch#Z;E3hbP_rDEr&X9exIj5d(6-c`qy6AvhO^Kaie%Ku(a>9Va*AeT9m zCG5TSdSJCX#A(*dA2d6hW`AWpeD(8*tOdY2op@L-w+ZLHTY9gqZc^v4Jm&v+M(%br z8^k;uN#e8t{6p+$l0SY0RJY6H56$T(tu{T(=;{^N6imB42V)) z%$g0csa)p9wc23M<>%*I2ez@OZUbMn=Kt;g&r0@|0VMOfhi_C@ybH zgMDD@1YW*&hxYYp4Fjlk5b&0cfTrZI`D1I}c0LlL({LusIhtg0|AmgCd3%$kg~pbP%lUj7I$*veKgI{O zZcx2&{;x65xFeq&4N3H$mQg%YEm|BTqv|=2hgywY(6S9Dv-GE~Yy@2`=jqhjgZ9>G zQWBrT{g8xaWlB->yYHP_%j2yL9|;=h3+oqo)3&p-N5=G;XPWGY(M8WGN)@ewmbayn z&~W8T&>H}g4s~Jx@KNQui|@KK69<^`bdb_O0$6PRXmWpjqU*6L=~M5;!>YkwMN-N_ z7y`K3d%Kl4WPaC_uJRTKb3BnP7wYGqQAA)Y;pkS4-9BJp+eRfx zZ=$kEJ_=I>@}6g-uLlMPa~3vp0WZswWMys52zWJQwuXS}aRKCVh%BIv8qW@!3BkyK zIE)bKNs}{H%A~jt{yj_NUGjqmc!q!*Fg7de9pK@x$-E_vZpKT@^fKI!I2cq8}Nyx<>P`~7t9wln`4Xm^6LPMPYlAj>D=qh0Z8Be9Q>SrT zbuG1ed)_W9a#;N`CG$L2{-9`ns{9rOXoXJTQMowTb(ld|>`D2<0TK6jxBU8g`E@bh zUP<-L@sy&_P0u<{((bWQcf--+9RNKZt@<$ck1$mwl zduD*m9*RZ^ruKq8b;Q)1*LXaubtF|Vl=$5O#(`9w=C#o%(Y**cU{#@L(}g8~Y8V^| zz~LtcbRMu9%g6gK?dIdy2L{Lbj;=uWTrq3wx-$VQspfg~a5XqE04&WFAMgJ0kJleA zrf}Hc0aa>aQ$rt=nO_w~Z!Zt$`{Q590*;wFtxSXPIx#6NeA-$v$qaZsyQbE)Bx|rGcf#WuP~1PMKv$?0i{gJ z&5bvn<^)v0%JYctK>tt>U5_Lh_w7d`1=8bM^?35}l}(x1=IJK0?)gh_+;lE@y2#kY zhSLlxafGQTw<)4P3dYHP&;`vONOTzmb{hH^CaG|wj9FJ2a-_o|A_UU^ zgc>E{CFltE;I_v2|d6m`mzIXZHn|b(J_p#QQ#tXcnC>HXnUK(Z0pvW zqm8$LsK6~>{2QW}c!qVi6rTI7=&zAklkKdt$lbjQ3EGP$H;)zd=^Y-%z$S|O3uqbI z#9Rdc@Owi~UxK1YZ)7SLG)hPQ$FOD2_#l~zLs02DQ{T|z^sG9@uE@Qa;ywhm2$b~% z!K0>hM;bW*B=g=yiL2q(9nE~|Ui~H+fyb;>1rOBisnvYRh%N9Ue@I?W83(utoxFuI zyykw4r0`<{|JeKiEgM_R+L|#CZNr&O9M9WE(ryKqo>=ibic+s)z`U}{{!PL)o zEInkPS1XF@jdTXRIPq$&Ihx2KtTs2Q)`qnNvC0V#{X}g?o+~y04up+}?~$Z}Nu5Cm zPIFd;r(F?j&w6x-jG+e3GNR!UPz9MEnFHq!fNg-o|4~ZlaU+3-?$zqm9ndSG%~-AW zY?B?+vj3AXP}tspqyQH7oNpEEBC28#R8ZjVE=i%jnHf8`A-zpN-2<}{-^2OT&FL^3 zzsE5}mi6|My?bm*N{WOqD9ITRK$DtxX>9e3F zIk**7N!2d>^L87tb;yFL9tV2Pt613VW7yGx<_dVVK|K|Dx_41$HRuCRkpy(F8vd14 z-35J7jAF_gU}MM>_-H&^#YXrv!v`V+Sgu^F>H|pW9vI!`35xaEclDHKKs0 zbjU67_98^IQwQULnq@Nd^+)6bM6;}Ui-^daJKz85@&0<<>-LH~0J0|;hig8PF&Il3 z#1E=z3cn36aK`3dP-$a>rgmjLMl|=^w^)4r6gdTZG@#MQ0XGW(ilK34sa9<5;^Wra zem7O$#iI~7*HP>_%*Q0T&I_mMO(B1q*j8 zC3TZ7caoHwRz?S&Wzzn8P6|}@m8-kFCsk!Q&(r0ntwpVB0!~vzht><;`emmVfXUyU zvnlH|Rk;Djc?z!`5pR0b%NWtlvvEbJ%(9c#Cq?c%(uXQaHH=hM;t1UE9G<@(5NdV+d7DM;gWJCb@@4WPjZyP z)KIrPuvmb4$OJm;-5RSY1mF}v2m(lDMQQGjri=f%AQ6zAfU?#-TEEZ*Y7PTEJ;ke6 z--i%SHQAf@4x2q!Zw5mX|B-yr^nDL_zrI_u$ue*^>nq zbkN4HPrWOy?g_BeUkHN7fGwBycM>RS&>cR}XKNtA<1G=*@4t}NH{*o0E z_2kTE)9RWS4pnhJHWVtg-Q4ThK8s6ezJCF%o1%N-Q-8)>qWSIv8u?Nlw*b+E6I7E1ufP3g`igfkXC<7bQdUB@V zdMyKBxu>nagQv5;CMQ>$^rHcJ4=`GmX?WxM5YYBL^AnwS-v_=K1~Nw*qzQ0hK|PwY zMVQT3`#BXA>}2%Dqd%o?nF9brMrRERsIL=vn#$7%9_;>GqwZC97H#hSRmUpdc{d?_ zMImYHw0HCb`C4aNAfk1)vw?%QefpTpqvl+oE@qF10xEigJ(2uPctphD@UY2b*K-sy zFHavhR#v@Zpg5uY3ohA3}p=7}+W z8T@}(`^%`R_NZ?dHVCCeKmnyoqy<4jKvcS=8)*SSQW^p21_6;$x{>aZ&P{hnH%K=; zbD!(F$NP?F+#esl9X!C^Yp*r`bN*_k4rD7amWX{#Dz^w;X$W=orA|24W%JA5cy2iZ zK|r0X^%tI_8+p%O)XnZZf#VyzJHMTeEdnGZ#3Vm{X#z z`MF=Kwic~VhPujx8y*C_nl029C9Aj=2nYxy<}&A&$=LVv$`48F)^kLoit5a?p1lh1 z%swk@?bTuOwYI%UQQ2v1#(P{Se%5BKusCulSwsR%p zY$xQHH-PlB?TzJMYhh8d8kZA->aof!q5l=8_56BG-Oy<^_pRe7FWbXo75BXKkDWyX zg{Xlj}lDJ1nQ6YO($4L9?`2fJ|4d2J1Usn$$%-k=D8h4{ly+8=%#Sb zk9P#qh2Oj7b%z`~gepI*FH6uLmz6%}ov;s4bQ9&3;jY`r+&dN=*&^SnYT|xwzOS19 z23Q6kcnO3uHDk7X<&z*UQZfxgYU2IvsPv2y$X-5)cleRsf25p1*%e9~m1HFUQ{&=VLEUF5mZ`eH(NnVJn>-9_w+nBa3A1YfOh13?LkK(v4 z_gSY8NBWU;3Fs#U8cJ1fmGvW)mmqr@ocmknyp!f!Zn3MFRQSPAlsA2B$CQ^0UV;#} zvYiu|GX?G|B_%lT=pvsc3i3yraz$GV?i{DkOV~ag4d5BC%7?k`mmGZ+gSs$oh~Y0x zlv_$6Jd~7_iG@rgIDl}n#r43j6~H-_@aU1~T0h{-|=izhaAG_UPrxW@J@AGiV|9e|LbWr^2j2hV# z;_qHkT#X>wOdF49KeHMxEn$(ee?8x>51lbiY6&5&my?tG@}6kQX#;X+IF}Cw`F6p* z0!@+;RD(ZXZeBVb^otS;m=ggsw&2St2pGJALkJmX0Cd*s&nJzDM4z{=9ot5pWq$ zGc}GJZYOi-+jSc(a57*Qj?vLuUeQ?Yugx*b)htmNL^jZ3z}eV#yoZR0Z{d_}g3SgG$48>+!sH z*#NZwkO>y%@BHWdyiD-Kk=TptQnV>k4Jzk5VV6QlPRI>M;^~WXb}+`D{Q3v z@RyulcP`TrIrkTefGMX*+-#Ks8F~3#0Yq&L1tTX0xaX=sbW*UD$BVY*B>e#Da7vlKF*t(v@p;(2ko zbNzSH@&&uofezz-_y5rXTn3Twz%$bjyEzy{#2Mgu;W98V@SSJh(5T1BTRifKJ{ys0 zjlp{n ze#z}GU)V9|xD*EPiH6+zTe*^6=sKzFGi8l=?Qm&#cC^+69jxQ$BND8LW`I+8oR4x7 zXO#ZuUE2&Z*neGpSfr%m;=$CVm=)1msNbeqsYeT%Aeij+*yF~F>=@mWLZLs-udlls zK~reEwgLuI{qjkk?@=w~vlf6tmerh1%vy1ixKyucgpdo$0GR_Y0h3NykT$=wT&bzj z`e=?Q4Hd_S`L}p@_`v(8>a_$sH}AUvuz91&B1miEUphueL@|Iw1{9`#$zm>=BzN!L zy&)EHlZS*301x;u!()=#Fb6Xhg8bq1$IamIfhm7(|NL}4XSn924ISL;27}8zNHsCQ zz*17(w6bc0{m8FMB9%NnLO=DbU%Ge1BT5#OhrjS1ib-eDobeN3>6NMilW=m|ZR?Jt zH~}ab=(xDh#2I)x2g&S%lO z51`_N@1Xq!js!rY$f($kyf?mcw%njRA2SCV$h<`Izb>+#yM~CjD#t~P*3V@?^$ez! zuDvD3?_93DR)vLtU(YWrKpX_nsK~Co=I9Z0qP%zg{lQ}DiQXDy)Z8xbm;8zXw~y+| zZnP!@zIvA`OsR{p&~Br8dt;IGC4o>Mh#TVbhTFC~dUH zM^FJS_LD6CHAl*RTKPAZN|Vu7Y%B|$lz6#?*0V>!x#vdA_=#k)(0GH51K7b3Qo)eP zg>;pI#2WAfLreozxL@L?$bTPNk!I;bzAs-I+H6+X%~$1sc>^WQviI5`*n3c)6+QzC zx{E+k`X-n;Liw*y3Tn?VV8UKkL+ zt9MahRbt*B&$mq?1a|GdKMOuh*U|X805zr(mNdUQ$%`GuTWLB z+8$dWG2zdEVV8;1ro-8K<$Ud(-G8?17Jl>5 zGcf4Qd7hH+*$4IOll_FF4dj(jAmO^J*L?<*-dqYxDO))$^LJR2Xb43B60l-V&3p=`h^;i z)v1JSs&HH{8PWXf4UFN$NLi=pU_QLeF>@R#I(+CDMWYQNNW;E1nI6Uq7noeiKE5Gn zVNXK$x_RMtjVdu>S{N1+g8;@Kh-XcfnCKB@c>=&;jBRXq5)y(NbpdoTJ+|RZ01Xrp z(V`J2Y)@gdBZaR7#-(h9&GjH*d4i+uX-PMsn<6Rq16y9x;624Bbt}|mKeQ|!&wZ+- z7G3&s)At_vvbhCI1kDG-L>(WdF7*I)rONC(o_>uKnhwFqCb9EFip6R5)Ls2I1S30a zg}zlkVwK}<*{nRjOZY7<1^H$3G@n<+*ysxrL3%x+B#RM|L$-1o@+jpnks=y zIt$JjT@jt(T*;#wvLCc8y_=Z|6NM@Wcuq!YQtgPaKlqs)?;hCrvd$^v)4tvlKV;7zB$3yN`mlWPt9!pd%t(QUxNcB z5XU?qS@-!PDAm_W!YMP75vkWz@9v{`fWBdN2NG>eJC6_)L|9bf1GHTS4mIu8DDX^; zn_nd{90v}2(FdsXq%I)dM$r73`1$`T|9s>h|;neqk<{nas<7LPs z%%AKo5CykhpM1$z_eJyakf+`@m_EbaoTz;q*s`Z1PiLAyLq|98Tj;ji>7fe1?GZGW zlgEUp;ZO*ykIY%fLRUQ54TaOSCP!d4j@KzSe?OSsbA5O>sxxi9aby2IS1cP5*63Gj zLX?{Y2vJ}Ak3hZrZ3-2DB6MA<3a`!mem<|lD*|D_a*@$7frPBf3!wrAK(I5Zvn8E^ z9AXZA2WkFC!+zv9x&ad=<(*r}^xAAES=Zq8Jy)AJlfN!dca3@U5>*JC#DhThXDjD* z_UpHmoNMPw$rE&4ysXdN7i7Im2y~=>D^Ej$qmZx3aQp0-no=N9jOJZ>{C>Urv+)~W zBM`&aaouzxv!BV=K70VCaO*0W9`6o{$xI34cUz%D{VnfGlm0!lfpBjfIIjKn_*Bo% zy6`$dXQpNS=1=F*IB{udTD*{N;n(l%K0R|}88wQ@Lok}`2)?Tmir{uxyd(YNIVA+i zyrTG7y#x8 zN;2FOoWd)gxWgWxiW2~3_alyn1Vg`g67Czo`#>fH>K>Sp`c2-3wBJeoGPqXLu&zLW zDjs1no&7-Y`T`U98aRmoXv4KL)Bx)>+HK%Q0L5w4r69qHQDdjCZKe=M`xDOguo$AF zI1z6^3}o`$)T@H23xsZP>LCyLIZ-lzX5D7NwS9-m;|m~qU;9l^8n*1sx==kS00S>Q z?*c=>)<}N+H%x7L0?=%6ni>7JSz$>`I3u~cy9+M?xOfoer1WPFXP7ekHoXUX3!Xo2 zxFM5~P3+#V@pGbJKUxG47TV3{r-o{fbE3~4%R-MZE&MjrlmbT#yl~g^gC(ew=o}oJ zhC7E&9+`SzEdk0T@aTmQh^%fICazqh;gq*|DRxeSRIlq>UfE|FJfR4hkCm^L38;SI zCezO!pTl(p+7MLl%f$EL4jo0OPctahPIv_$nBLDeuLwR$ma^ru@&$wWKb4Y)Ru;D1|tlMW`>Zv7Z*lo|)V8z4661yt+8e)jVazz{G?`oe8uPOS^4k z3yp>PYa@A#+DW0^-Cp0Nk*0aLDr^>0+@R5O!^2CteWf7F-%$rz^^OioIyxV~toPez z$}}3}|4LPn(LWC%ZRSom z*cpwncrhzg>vTxp&Pwru^xPvqeFdI)5F|jRquDL7@gzUAXTJhW6RE|nhT+=;U7;1YUgdI( zq)Bl2dVX-xlHefC+ffI$X!pq8X2`sVkgw%^BAf7M%N{acK1^la2VxZRWvq_1QvBXh zfpy@0q3Rv)CcqA!{d5Oh>2XzZzg!$cNclwA2wq3f z+`76U-5Yt>-miZHY7g}4CIc1EW?io@QTO0Py*NDOuw6dYw99w!Q@2C&0-Z<5v{92D z*KN2JKk<^l!vd4G>g8|@7Exc)w6lF=*!On8>BUxh6ChC|4HQ<86&0p|c5l8r)*L>^ zww!|Qd7!!ghNmIG*zL@X4I(|iAsRv=M1VRI$M5^T$!Ffax~t;Hn_sxlIo}`wF-nJS zgHib)h|G}iL*uJ3>b8*g&*Ca~W}LG$%2}L`wwv_I{+;NDM#!fiB|TriqL4YBP-ZLT zb#C)JXR7{snIaPM(=hO%pC=TjpIVb;KUxTJe8nXsl0nh~iC%+isc+7Y`VDXVR4Y!$ zBIgR)z{BVH9xF~kWYG8J=E3Sr!W-Xv3aWDL{GWr9Z89E%-3^2pnc>u{1C{vTMM6Qb zAa{BUI%FxfpA>h1%7u#?FuFpEd*{>Qzx#Xp`&o*GRQG~OB{elkz=h& z6DJpLol%l$I!QCO)u%=>iQMAa+KEO90iMu#rmr22DwNBRx(JZtR42q)uK(%Ls?seU z2W)q!KqYD8@e7z|!}gXG)+WnkOKKvYbnrMwe?4&k4}2(10EwU*2@l?!ls%VmZ+s&h zP|1!Q+jV9H-onBpye@ul(^|pYLiiFehg7H1>?xaLdN8e3+wY`14yFf@SUthOXp{@P zd3oMnE^8S=!q*D(J&|>nt`Bx?Fo4n>2J=?{`@v)ezCl7^c_Kce=K!O?;5r}VKj(9_ zMa-#(ViXt)^z>krwApt3F$`393r0l)ANH_@*){*0s)^GwCtztBJ6jo-f517k%odVlOWGG)8J*NSX@eiAnW$SU9z4SbT&; zC>j4)g%veiP?sVT$`5O6K*hkLwK`FYUaajFD@yK864~FrRX!^tBy@!uJ`0ae^H&t8 zh1yB1RU?lv0NvhrVXnJXW%rXF>oG4uaZ7VbD1QjJ%SinHEiQx(rigwnGoNe?eqq}{ zAujb}_m;4*@Ey+va2&MT`Hw>M9d!4hZ7I_l*bfz$CkK*54T$A&$BHe7Nk zGN}HkN)iDV6aYyo4JsRT*}`<>8bT8IV6wqsRB;swel*PEy8hgg=3S}jgQ8-DT!#He zcy|(oUBWbYTj=Cq=Iu{uV|x@ll&63W)0Di`Gsf%E02xxgy{+Y)lPh2HOwBC3axAiD zXPf1J1xh*;7`GmCxpfueC;bAg=H_fYxlPC37eL76n|$Ed)V^MM3^0J($*w57=@128 zh+MTjGw>Tnrb@d`Fwm6IZW4OsMl|edsAv%`SQs zwP>r>W-tJ!DC1K|-~sQH`^MKVG!WwSvK7TeL)x((al>Hf(Y658mPh9UMm)mDl2Hsw zV`chaAr1tf49;#OMhtR}r}zg-KlX2z4b3W5!eCn%mHSI2M;TiP7v#RoFQ$iL;YtN@ z_&}ut?X@^CleYF;$TOqnp+@<~6cq#+A@<9l;9z9i8i4mq=E?4^m14GH_$lT?z?GWY zTEgRE+KvS;UaiQGmXA99ksZ-HStO3h;5G2sM~IS5Q^``BcQK5%i%$x8|UQ{XE6viHr(Ri0MU|>Wwp` z-cKpW?sm+#Ko`iaY<^H>bHC@-%D4PS&uRUsjEcR%hzM|7VWAbl!-vroXTm{fK!D0A zbgm05iP0nr3&$kNT}0cZ(+8xlLZ5}^1zjx-Ef1;?!F?1t1Mh;-TsTH_xkN{;hFoXY z9~CimeY#Iru+A*+HJW^kSMufUVdd?cg0DOBJ#CyXTQHB#aw3bM=u!tz!L_8}r1c)w zDQGk=?5k3egyBh?29J(|qnKt@Zln|9k?4!8J%UWfiQZI~B%Bor<>KW%fd&J1ppi@V9!OXd(PP}weNOc6)J5Gn zAQ}3-x6wT>2!}RZihS`1 z3s(ap#+_s_At6f8kCe|i`oho9OWe5yZKb@TCNhQDI#G!&A+ z9n!CxIvD(-4^Hk75*`tu_mpT}zlKT)1#CWe{=&ThNoHRf0B9Ynwj_t^AxAGIC57er zDwh8QLg~oK5&n@+9QX6e*nAK_boZBq-9h_}ssT7di^}h?6 zKGtkqZ<`N_*do+W?SgRzvX)9H(g#?qy&4-v%|_&kjnJAb>l2!r-wq58I@%AsMY~5L zMo+K^j`IxrJoSU^Va&)5vB|PLShB?|pkpiO);nGdx5e4fmNcaKGHX1~u**@VRWAE- z!%%a1{mNJ^M7LP|6okzG9BP6{Iea>!7$d*glBVp`#)y)iKIY1af}#YcN|PnIh`Biv zl3V$V(2kj2(QYowfJ7%)0?Q^~tQtyH&R9&Bc*)?_eI8*VC`quA%{50hV(w2jlIe?%;w+)6vqRBn(ktwP-;0J#(%x!WpZ5FbjW-=QUdZ{Tz(NZ^ z$2XRbJwaYM8A2N0(_`2*l1CWD$@7#L9;2v()#f=QK8odICJ>wt&vrdR=Z_v_LRU<) zKvM$9Qu(Cg_2oSi2x%a9JGlwW5Xc!KcDP(M^nxc(U>L2iYsbAhYNwvE8>Lrv-K8z4 zJNle1li)dSPRF=`i%%!@H(Zq5aC{(549!2u?JBkdA;W`sr^xmQE1ugi0$lIwBUw%0 zDB#4@u)C?zZG=PCZP0s8{%IqO($-`aM?3;~^>p&Jff6woP2}&^sR#pajWyKq#iga) zt#o)w1|I?B+qE>G5-PY{rs2zG^#=utPYa^{LJIWr_ffDY-6mIFqY-$_f*wC}8bIwPy_EE(hRMnCh4%bE97u4x>Sa zlg4uJ{BYKo)+@4TLSs`@#GKeRRo(=>Tzr42TiB>F_-w?3@qBAtw%mW#1MJ zfEhBDoXX374c5fwwzf!IazuEFC=w`~sov3>Uo-}&OTFmF*qAB=LISWqwso}nlQm$% z&A~2MRVzhhhn!)YJOMJTlj-AmY(ylfZbKV_ESIS?&@~{dA(&4fo%(I`(=C1#0#t>L zA9id+1DYF+x?#|`&Ckz69#&dKg=(P7i$_6z5hroZ>`JG@9Y53&XkJ2HMd^umf97k& zScDE7;$ryv+wnfrV1gb(By#*M6_Q9TRfnjK#)VxIyPwG;F}G4_o&Yb!6KC_#o#LnA zL&c3^%}VR`@H+tGaaImhfietOkBM3RkR-y z{#{?zuwh*`TtdRO!G*SG&b=h|kUHICI?QZOnqU@m{k8X^OLY_GpC21)q^b{u=l(W& zsoQfV&4$v8M43S^rCOmYK<;|*ET>LY7*1wl2tyWhyC#JZf4B&Ndg~^T5zrM*=sFj6 z+d#W!`Ql?T$nb|UwG*_eKkJ0Cy;V|fl=FiEZyNb^z)+p(AqW~kfcC??+qA{xa*&A zar1OY?7g_Sh2>)tJCba1gexIdnd_{>ESr#<`Iai2-8a!BK;@~%%;}*n`y#tK z8<;oKo5-KjBBsh5jhWmjIjSPltHzA>$~6(DyajHQAdxq*KSdyKbb7^oQOvd|LxxPk z5j9tt5v~wm7m7JH%j=!ipRks%n4c9C)jAn6qm)7mBF0PtY^m?q7d?>21W_Ut)dY~Qjx68R`;*B z`x%gJ;C8Y0~i_*Qyzj)>&B>7hSA|cwyh%W(FhBRAX?ToUbWlum@e%z|obWC=5Uw62lq@wiC6E~Qvo@D(qYs(T6 z*QHt0bk33A!}0Zk$!V{vpx*TEN0!pTUqQLF_(5>oyIn02=8?gZp3i?p&AVUlH{hBY zK$gjc#`onA0R|u`R7f+P;pGI(8vgS?z7-mj&i@|^^nWE(cA+sf-HW|uy>NG)$qDWn zzILzr=(Zt8#u?s2E-a05ps|!Wd(M$~sMq0}PoOjs*zu0nqrWABKnpv5)+jA$!F?Rj z8?#$JAxa*3#d~2$Pz_Tb5!RIOTzl-H^ zJk7c-=SgZXV4Bbj_Q|AGf7djfu}kT1kF%^3n&kTU?;FVtn>r=CD~^~eDLdIjouiiZ zMTx1H2pUQZJz}0KDYg8?v;AxLEG}%{Cal^mE?&EJ)#abx8Mki#w__m|%%xb5xfJ8X zvU#Q?%Yy}R`>bnXlmiGi&!mWe;?BzcDbaod(MaC8&l*B@VJ)Mr*y&KE=3qclEFx8!W@r!#ckF1|(J2Sc zpMwyeM80@MKMb?fD`jB!L1lq4nStf&;d zwQ|Q~Z3e60*h1E2?fL*UJB?I@|~m!{Aa?dH)EVN*N2 z!f@H0t(m4nR6i>V;A>_kXu9)U3rhAtB#z9Khdu_Lo0yMY@T_TC#4O`rqj`a~6~)6{ z^5HOEMZ^Xs21e)NI~FFU)XWpj=`1xg_y!S=DGgX7sLs2IKmL`QRF3*(tA*+LlRxfk z-}-higR{0a8HhXJNrg5Q?jsCu$O$m4g8*}jat%Ih73QWbd!Q$I5@XpsV5%M65W;;c zO-VpN0EW_%6&r36q;Y+sbmKS3t&w^KyuWE@6mQYxz_6PsPYt=W>=3Z>3UWkK_1k2E zsx~an4%T`ORx;*}h0pCFmIs_MDWdmA+>4_hTUK}s4Gl%4I3r2}ooe!7T?j3ne;q!U zLJeWAiA>VL$j?3Zc2VvL#vK!VN+l?8oUM-9H*2jEBOQSlm z=ewfN8f)a(D9wO$CDk!78Yn{`>VCrxzVX zPD!hXKbVV8FVB}|o*pKygt}KcR*FSr1`7cnH$RVQ*nfIl0lAuIo*6Vx1}klhXB<~Z zfzImsa&=isC_zeMHk{p3y;IW^0oxJUX0Ji<_JfNXA{VOcw>mvf_f?A=?!&0lplFT5 z{g$}~ot&gAq9uvVedZ;MsQ5}VdIwnlK<>7CtfFJs=y{5i5-ApF2g5t;dD{kg`JSlz zCnqWQ)}|_LVyWeTLV3WT_!l{JLr`W)=*vz_j&xv8S<2%qw5r+NuU-mh6@f9P^*y~j zRyHGn&?`J)z#xe^O$iYEFCGBB58iZ(>8kF;OR^*uwQfw-ZjjacgMgKd$e??*|6qMQ zQpgJplzs1JTvx!bVeVIMAO{#07AfyHM;k#S5a}StIZyW5dncpQ>vC9$p{H+CMkkbpmd5VmCFW%I#qF9Jw>0d{!U`kOqZn`;X8u zz465{Y^-r)x-z)G&=%STjjVrr_YclUhBfeEO#2995`vFO40>;%AVDL9%A|JjA1>rc zM7oNLa;x!1lMjyJ?vudpf|e{Vras*!D?p#a^Rl2JNgxVwUw-iDvY2t>}4Byeo{sJIB1!S8*J-I~d&3ZxgqcQYW6Zf{(R(Aa}TY*d4 zyF0b#EO2lFf(6&3;&eH#0#^5!jFvHD624tpo6NXZ>F78$l-5;gAA3oLlrfNniaN`P zM|{7!cs>EPm#_&K2{XghByZH*bq6U08dbcCfqjdr72ZOz7XFo0y_<>hEvWUcC5 zGEq}61k5A^K2-(XH@@u4#$;hkwTe$S;nSog!ipNIMuK;0#YWwiC)CJ$8UUZ1?uwse z&P*8ctWuD{(OIWJ8|m8>?9N*I?^d{<6i|DheMjCMfr4typj>nRjOEjtRteAUBdozX zS3VMZzKxLrD29b5zG&dZ{z&bT3c|=`Vvk9JGTS z1U%f*fDnR^Izy-4&85uX8Gw+XZB3A?<9IUXJ6>eSm?4|Ayam`nV)YJkBB?mx1_ya) zwo*=!{niUbdL0kc{S`nwk#?~EtNOT9h+Xtzm% zhXnsX8_Z!oCa3Ls_+TsSkvu{8+i>umz!E6|;ELKIya7qgYS%h-C%p)*7*pjkpArLJ zQnly=ALxX;C|)Jz!x2vvGWyaajgf7^!2yHI#hkBVzM_9k%}bDYM?&aK(dSvWvX8T^ zFmEB1nHBsiO!#&K&t1koU0qG&knlMLU83V46Dt3$ri8w$x8M&5z(6*Pn9GRkgd&$$ zKofu}ux|4ZDl|CAAj5{B%5JN*K*Nm|T-=b(6%os!vkVenq@WO3;l0g8$PB!RbS#x> z2V#tu+8~cfEE2XaFJ@1k7+d%L+bGa*`0G(v0|D3SpT@@EE-r~|l4jfnX8=6`eLAP_G&X~>W~Dy9w00zw}Z)qAM6y}I}$ zQr1t_Z`5;2Q3ZBzbh{mEK_E@<@vJMN4mb)hE(1HwT)|HUXk*miz;|9dj3=^*2D5dS zQgKHl3$6TVj=U(Zn4U$S9q%ACEbG*c5}Xbn^yt1z`n7oy)6&?@1Wz~Qbv&09*yRQ@ zF9joGATdWehtYva-t78?vu0^H7Wk9f*+Ic&3}Ul*e&=W)XWma$WUThp@h7or_y9_E z`T44V8vM;GYOyq;lAta~`HVA3` z^RhhP#=q_2Lm(1LJECjB1HCl@(m~I6+#BxAx{Jnf<&78Wql3A49-?#R0j)*V9nMy2 zZhNB3eE09WyqdkGE)J^!4yjn)C}Iw65Z}Q$(6m0Rqp)coHRZfc9+3uN1;`~bFoskg z9Lma45MWu+oj<1*2}!M}0NREKGGT>|xA|3z?U`?!A8)O|^KH0pV+CP4W`OO-ZSj?H z*iAfNAI|G4`G9!l)J-&V{rAlcfwL28u6!NDA^7DWSeDG`pAel)VmHW=aZ$n_!~Lz2 zqavEOz26E!SW>|DpyQAkwC9!I$3j82XpLZ1SOh86(l(sQ*E6*TTZ1v;8c$#c)NQl_ zNV6$LE+#yw;D%bP9O$j%b{Ta%6W4WH(OeSCl+6qHou<3Z3`h!fn9=cso0@# zObu0HTGsEg2-GJbqFI)r)Ht%#(=f)3drcw*3Pv?V#2-9(aPzm()(hLK<;PH1+ME3& zt3sD@ zM|`BUd#%V2=nxMeBZ`60RWG-Y*4Dn-;r+U9eYtsczO6q5uHP;8o!)%}f`W&~^v2Tw zAP9^a|9I!l{`ROnKf0+~rn(9Ogko)fhQ-Bi1g$~DO^|wi!-JIXGn?76l)%|4HAo&P z{HcE7?I4DpBDDX>d{nJZRL)Z`0!tSOAWaLi7pRyg2D^F|#4o=)Z&$`$-A3Dk>+=g;n2)RNqUs5K`t=0){I4^3^kl&`m43N>SP&a+ToaA;!41}gUff_JB ztcZAVz+uNr9654Skoo(#`1mQc&7iY|M+ilTf|8O90^Q&_WfMa~{%K&Sf!skaE;_Lv zq(i!&JiRd?v0%z|lpdbYuJ7ord&B=NhkMVZkqK%Qz@lo{TzPxH6Tz@x#hrj$69~k~ zu<6n$vqs4c8t8W5pwE>11wqH(Av$|+C{lL*6ZeVHw3Bjyc27aQ1-Sc!6wrVq1$o&0 zaO#TxVZCb10L72=Kyv$Lme$ZbX7MW;ysM> z2IdWLv@FFeq|^c-s3QWo4h|OU1P};hGW7dCXw~9+BwSwKqAR`&qP2cq2+~1=1NjH% zN0BBp>~Na9?hT>TT+zIC8zNf4^torF^>Avp=sgq7^YcRgt)APy=jauPyOorqocB81 z5F{KcV}<&;s)e3p)5BLsJfI>mI13^~CjG_05mi-km%UaAwKcL z%1Zve;MKp|Fo!j)97o#GV`en{%0mQ1`28{v2k9bb{W!W(;F!3s}E-*V?B}(vOp3#F7&*B(TEUxNFh&Mo}ko&AG!zVN8pZ%1wG5&;!~hJ!5)T% zjzdBLYq7eGY>3k`p!o@+-JPU%FV5Xd5pK}AKK?Kb~(70G<3WuO{*(t}$<%EDrs=W_`Y1o1(PI)`j1xhQzGI62tc zyIB8rvDW|8slNjI+yJNy>dvpwL9s28GIxybtCgITr&$>RESh}fJ3~{&0vR{$E8$tv z$fu^7-?RgDet)8br+$9BS|mK|yBKl1!f0Q2mg%f6tpZ^ z_XF4fR{RjvA}oah?b^V4g=f#6TMT_KHLFKzSH)bw1Y%$&wV12CjfE0U$Wn@DJ=np@U%B=bYP=y9~#|%I{0)T(!WVc z!(u(`xSmdD7z5}@sGh7~d7;hz0kMzCXg(=8;q}*ylkimZ?1I74rwu`A(Dippveq@U zTE0N`bS`x^8$JQaCZvkd4`3AJn&hc0vE!3(R?-Y=(fc133q+Bdbns zq4@)u1s^`7*d;6XU~!p`5tXifEL+877G-9)la{Rw1(H4Z#mpicV8R5n$QU*Vu}jUf zii(~DeUPX@p7yXcw5eYnW}S-~$jc>7UEK?L$qRB01q_>|mnk|(%(a$76{z+0@YXl81jr?KD_>MQ$b_PUW`HdiB~Qcp?Z z7~JY3-+a$FK&9>fHd*3V37$eP4;~rO`Cr5HpH;0%cB{Csx&V+okl=N_RgLR0f(zO@ z_r~|;>O?8yGppSiL1V62i>ZbcNkM8_&Zszxs=Kg#NV6y;n*rPI4@Jy7x9oTF%px~S z&V3{&R`pm^#3MdAPXm*w0FOO8J{~7`p-AvLkeI9!Nxcf&0aW_WAHnnwbp+J@uO+P6 zOU*`T_|Bi(tn@NkF=DDuM~7!D^7NKUrUot1cd-Lk1&D>!N&9^`%7h^{kK20jj*iRj z13)w~;3I@hImn!8@B+Cv|Ep0H+&{l0!bStla0E@b%S?5#)k1mh>6w{1?M~u4D!77? z*2wznOU~@kOd(jW1MWXCTo4G4w94DX%Wbej?q8v5nB)W-FJ@Jybw|Gd62lBd-)w32=we}RS|AU~nU zZAYuhexnn>3@?Dog__X1b$;J~tJk*h3ywOl;RYa=R|Z+V0~4XL`z5E9l@)}`#Es;Q zUrc{SlJZ|>yR;yDZ4I+OL0&5UK#1AYXlTMxIhrtYd!p8tTPzwlX#}RzW@<@G~ z2wiD0^i~3DHAG;U>*CNc`tvnI?XZP#Lf82DBiJt34B#b*P);4THNlDikKa(XmM>JC z#wF`ZN;LvuA-oi`C>7h*xV55@?JtgNRX1zsP`gCzA|u#_`bt6Ev3El)WQnGIU|>J(_9 z4)b(qQYxk_0Iz|O`3!sA1|YLlbv+|GjWY9Jp9{28)6TKs_bVfozrM; zdKs^ylXjg!AHemhwWUR?>|SS45S-N+Np4j26iLoIwZ5SC1hfT6*~R5$>si<1cYp*# z1ft9^gVNem7JfnRkCwd$UH-wrfD-rTs&UZC#EU`MMz#wt$yjAFZr9Hip!P)-$O$?7 z4BYQunehq~)L5GZ;_{cSAEcggK+HWdkJzy-vsIuU^VczyERrTIPKIvs-3A;VSV(%RBWSci`!|F zsHLT)hS%)j8m#LGz{4KP)g;as6ok!`qTU%s8i=4K|)66 zH7-itY!uF4lz*qmu5*A=Aki|=6@Y#R>Nfl`#e7Zw+-|8Lk-;7HvcAeNu-vE^r-7R` zT{zIF=6uH7?P6CH4k%;fHd82CCubX+$ngr!I>D>md)w8=+JMve^qZur6lgPDZYqG# zzZcHF6TM-=3v%aUQZnI6u1_Z~ifg@}N4(Oz_3Q2(KYHO;{8T5T4LD=Ca!jJHgm-^> zQqVvA-RG>(;Hh_0XiXaRz)#{qnD#BokHxi!<2Iua6uhrCOwVeL?Hsel$Jh7}HCv84 zSTY}Zf zY>5j(iQnWzGecnSU+A{!p#KB8D)@T9X1#iVT%Ro%`f~5iB^uUG*&S`LB|!=;(zYR$ zq+Kf}EuIDs3anO1h_hISCF8GiMx!*O8M^xM5G7d(vB$lWL-|U9uuEmYZ0Ik%pu$He zr9T{I>s)Itd--ZO?U}sLujA0S>yu#9c#9Le^Gh-?;r{t+%;KVB>okq(sv|GKt5`M7 zoxrj_k|PQuO9HR`qW4^r9&I1!?h0$aGv=EJf#(7wu7r^56b}yXPf++_#RQ~-Mw(w< z32ILKyeW8ffDaL@OTnXUeUW$%N&k-)pvKV#t^+ZTHOfN`&0J&W59)ajGnyJnKTq{~ zxt@dM$HBbeMwM-?KPu)-u(plbGUzWsF=?3spM?vwP;?99kP{wp{~nCnDO+>dr$Z<=#xV(g6fOmyIlU~A{XmB5K4`4_E2(3y;m;NCKvH5_ev{qOx z5DU89LcYebNefVpv)L?5!AOU^@nCfq9~9}ip^iw~9eZ>TZ~+k)-K$kKuoc1wS=5jp zkVp&cz$bdA-T;iiOq~J&$jnxIzVV&uSN}Ku{JmCIa9kme=W}wGhLJqMf6xk9k0$W9 z_lDGcayc3|1`+^CmwfW6SA1tY&|odLAOCy3)&@bjF4Dr?nI zN4CtZKI)>z#g>;eLhRA0;M56AH9>C$ z_fetC>3Dq>d6}E6va)jQ)xESNcL;q5b^#+0xLU-gla6nQQqk`CmNf`nl-}l8`6r$P z6FXjH!g4f=h6voIvI3lba7*v?`(j#EPs0%dNn#DV3vD+mu07BpbeCPnt?(P9xYUj{ zg2%t#wAB1!-3%hN-azh$Z`Tq;XtP-j7}Q;zJqD3}>8J4W8(_;KNycLAIykT${dDA)%|GRNwgP~m>TRVIutpjZH9-9Ytc%Xk?=o0V>%oMBz| zILMIcPUJw(8FunGpZ~M5s|U#;JZ2+~ZsfMS%z!Wkx$Fx2U^^$mhc|cVpjz(650-JY zk)MMfV%hB&;7=GrZ1L3RSywDzs#p68?-9a4+i${Ib0t!uQVT&ke^B?!d^H zBv}_1m(7-+U?LJGcbAF*!xm`YVbfU3`xGCkcy4gcww>?PBF^kKUfl{D?=}u3wAr#7 z-RsCm+B;B?4UdWOZChZrA%k2p*dfzh`-`iSPSK-Pw!|R#mf31!vt6DWOLT zAP-nQbkbz`oO`!pCD5J;f@jT7kNC)(FRZkkJ`mJ8AHL2QEHXQ00XcU-hY7@o0ak^W zAcqegug0Fk{puE-RDAoBK!N#K38)td0G4O zm2*`?M52)k6heSv}Ifs6%+j^W5i9{UUK(^J&%QvIfSAoqsG9P-JagFkXWt>gHFOv%)O4G4DMzC4yd8IEC2nod`q!`2v<{MY`<%>nI2f*U< zJA{pljLc?B zHn3q^lVycYho(LP*Ds;fhK*>LlZ27}a@-_2lpt9kJa7fW2E-@9_FYideFKXSXw>!m zk*VA;Ppm(Ey0{`7iHZ7#a(yU2xW#k{nOySVLCf~d(y#LMZmurctbp#OLWf-#)6KCX z7&!d8kpGe9#&C|Lo7+vW9>5C)WLG8zKTo7Os-J8v=Ov1nx5JPNZ1J8hsj#` zV)@3Q1KcLYsG7kd_>buxfh7*o=+n}u#M$9*KLJ=wIqxxscNpiR0ke^2wLNPiHX?Y} zg@?q!tz(C*tiNI5APANq8y8td!3zU2Cnz#V?bfPi1dg|M0U=-!$~nQmGyDk#-T`oB==h9kr!+`+qkwcs z3kXOH2uOEG!%H_(3L@Rzv)^;qUF+VNHDB(m`E<^~;~Rf|vG=o|xbY{t%Dv%gf}8LV z?W-!<>fxDsk93gG2FSxvd^i<~b;&kkGb$hC{S*eUmJ~I+i3pw|Y9@*HfxF;q@47@L z>D#_PCxtG?z4N45Ua6VqiRucP97^SomJy=A+SYSh=HTHjXIEE1RAa@U+WIl zsPg;f8J1>tTep~6RUKRv%pad$8gKD};&1RP$}tGc;I0zuB(iB+a%|7%AIQ?xJJkGk zth>r!aVYR@o&NIlX}-dhb`-^n&RM0r-d?qYn8y89CK1BkKhnyObJWRKwGi#!d?=_891Ds*W9+T z%FNhKaM@V)=v_Y7QIY5*#zf82YeMlu6P9b0A$o`%__P%Nnezq@fWJDlg8!~dS@F*< z_u`9JPFVhuM#(sR<4f~Uc)_shfB25o8I&B~6FGtk@CHJuq)Oco@#^=N9G*5bH97UO z9Lxz%9F1DVSEV?RoNt%RFPAkqY`)vzka#-cXxF&>?}azr@;NbITGQn?FYi8o_IBCz zzbVzZQq#uK_^H&|#+O;L^Aq<@XI0Cs=%+<@Uu;k3uVmcYXwj2lu8^X90Bd^Cj1xJt z{Yf6r!H0XdNlA(YsP<*{eqfImdnDD?`)a~X{+qz4GZ!w6^GKW;34QF+{%M=r!`pvY zsczQU%4bi{{hl~_k#3MZ-Es$fPc0$SeOclSU7E065i*iqrS>+LPx-Lm>h<@{%hYK; zwZ`ox10NQ=Wx{m3^jF6W$Sk4;oi_^j6}c{=qN0|Xt@G1~_pKn_drS7sHFJgXxKCZ< zyoV2ilCElrFrp@a?y?Hh-}?H?Z35W*y-u2Rl15t`4NmXS05F zXM?Jbg8f_HvNRkhm6nwuoUQi}A{+lUSc=-UkA&AgEJawma>^sZ5t;axG3T7 zz$8Ao{f{FcDP>)kPnpTaRr=;9lRg$x$P9xJw6bWbl$yr9BpCyauM(63w%3<4Q<+js zH3-;&-l;w{GmAnKhme`I@Wz~fKw62DF&dmiv!8^CQ-TsKoqlMQQiny&k(Sf%!~6M2 z$Z=HpiFy;|3kw}>CgilkXalI3C2w0%fi4A+pds0ePCUdVn|UL(;K=z?KS<6s<4Q}e zL|u0{Dua^${(;wfvP$cv%lmlIpz7K9plwuTIJmxhdRekvppgdOh9%)%gD%jDzS&-i zd~Z_+BaX_y#_iz3eKSHb^XK~E!v5*t`eDgIzQuUq@UEoS6FWW~0?adY+UMW}1mQrN z&Yh(SC?)x3PXD;L3e+rVxiduRS+_Z1vYELreBJ$BqbwMbD^g@2&jzH4IOwrc@qCKG ze1gVssijakkulWHS?s7LAZPWhsXnQ9_VFQq+|X?#G$drutb%5w>&l%q&LzUjTUaO( zzd=+1MwWFbiBl;a`(7cIl`M=w%97CZt$RtK2} z;n25@z_j7)V5|M)?jy)$2~!C_S{X`tKR*D|1#?dgLny+_mV1q1(b^w$DSo1cQ04Bt z7~bA5T*)vHYWFQZ8}!=mn?UNjX)~iD@w}UV{9(mmy6cU!e!MTRbA!&o{xjD*JYlQp zfOZ3LtwB2G?u!KupOkj|P3XK1{RHg5(Yz6GxIn6mq^=LqAJNJqJ$g#q;?b}@eT$yYBKenOtY<;M zu_^;8HPR{#pb6kia$^U^@H#9bho=zp2ciIg3Wm3beBM^Hm)QP6;|U?*tgC+loJOeW z<2)K*XIKU>0c{ipy$jfTe~cAh!lKfpT9ksP)fp2o1mS705+kToPGc&I#0&Ht1=2ZGVe! zMplhT!`!VJj;En@r|()#sgQ&~=RE%e6E#5Kn3%c9^27YH;m^A566;yMC;}-Q7K6B= zxgtl+)+r9tVHg-dDnxH;nhy{^hGx8ub-wiUAw7#_)3_fu4dACxUH&VQP2z!@T?8mF zpE*460I7t%7JrbmT7Ny~0n_*gWP0Jykaqe)EMmiFHg9kRAvWG_^b*+b)knp0PXev_ z;-PDGtsIfA=c)vsbNvT+eWe0btA9=V+|VPKRzz)0*Wp8A$gH*Lbmb;&ml+oP>x~Nq z>&84r=sJ;ra&Pi6(k$GyL8zCO3h>lwHcKQd@K{9fv& zLmR$II)X`i>e=D?{%%GjlH)HS;S6YM8+3|No)s2IvKCZ;WhTm>LnJG`e*GUZ z0^oM&oW4G+fEl}Uk}y(^fc2sVJP56ViBqDGm1g3)pk0eU`=bK0a!oi%rkZ?&qnY;i z2ZSBim#G0{Uk0}6&TpSGxK4m~*8Hxx;nlVGrNJe|s0S-h>Eq+UlAPsl4`Z_3m2LDV1aIk(_-=y#3n=%at*74MMGj@BGdKWJph2^y}gByDNDab^Zusx8?TR( z5wQJ!))7f0113Af*!ydY#kSK{RlA21dLTh-n+6nelWQWDmqiqZg(a@Etteg`7%{iT zZ6=!sJdSSYvk`(h5D_wJ8UU=erK7(@Zj3TV}eg z3lF-(s%jR4zGTe{x=9#cBaLra8xI~9H*ga|)jLtd3|!ZiRcDFm&<0(Mdl<;i2TwMU z{}?PL=EQ+z_*vM;+ftHILh&=F8^-f_`+G2uH5_Fu{*)B$I|p`lwmW7`SHL{qIhx-7 zVZ2WZi$inH{T)!a8iQdtqEUvp8(Ut}$nPVh0M9qYWmYF=^fAWAATWNMXKk{bm_5eX zLHo?}mQv5FA_~qj)-$0Ka@M9jfVxiac#*E$YyPIlTDF->wmP-1n@YldTO(6+T)g1> z^-0Yqy|R(%aVZRCPPC} zCTqNi075pHtv#$4u)s}joN9wdjPfZdsRt~%Kq3VU5bOGqM=SuW99mD6s&w}%Kfsk} zG2-0294`dIb22RCcr`t*aG;$6vrd)Na|gw`DU+X3^*i}P#mT)*JkZXzBsr~5)|o1F zTiUZrNU)@OnXmyE%%W2potzxXgg_oMGp>eGP&Q6nFOoTKkB2+M)_r$8aKrM{`Cg{3 zd+;iU37h!>wPd7sxC~2;KQ#3~pLn&oVVO$AhnXTDh*)h~az@$NLu4WYyr0iHa)e~C zd39h0+$TaN=K&myuSYD}bak0{e#C#HH(59mi)h?oDNd~vwv=__5-sWhS#$4{!=MGH zXQSg&pugZRF=_aci>uT&7scB`uZxWKAmMZTosM=M{W-P`R<;5Vv%96Gzw4C61BG?} zup`{FMGa3T4HK!tiNtCKm?!_ zjii?F>jOX#FtA{+Ymh#VzAX44pSu)-rv?_}Zf{R)AI3a<%1{~;6(tJM26?b_W81&&t##65hd!AYq%SXT>y$@9^X~vpWlfxN{s&9JbHDbVT z?Fi!T;2R-{9!Nuw=}pg*AV8d5g(L$lDVLQ^R}_v^$uFPu@}oAnhw1@eK6#T3No!K?-mH7#E{UFEvn6@K`z#&ukT@R0Gak_yjMvW zu<^hN_G^0_Gr9!jjEf#C)D$Q_$T06{WhHa()1~j=Z>yN8o1vT=QGYtFZryOGicQAb z0-+oP$@Uyz=LPdR$PHl+ZP8MizvX#ci0NnhpN+g5F3IpQZ z(L%LIVBY{C@q<6)fE%=SggdT}hx-L$4>xGJz+&u!%OV6wFn{xu51^Qh_rBrD#C`ZRgMP)yy@h7PBR=)TD0o3AI!iv4Q0$SF(HQbBuu20%QB?yaQ%uH7 zuZmxq1!KU!>gq3&1IrUEBF^8Vc`;yt^m{{hUi_T&_N}3(d}EhKr=Bb2ng;d3bj+1 zYC)(I8|LksC3$2t(jd?R(gs+;0NM1<_jN%)groCMO84ap#`f0^*`COi_7w%c z8n_y{ph~9!J4K@FZAqZQl}&a9Ma#AGxw{LJI`Uat1SPR(HGxX)!#e1qK&rnl z_k8GL&qRB+NKh(*6yiGBwjk#2?-?e9k8lBD7P^X=>t?^teY8j$9VE>jYR?6*Wdj4G zD?wK_V1husR$_h02h2zl82-}TfB_T|3hOgj>;VUwCVdnb41E92M96K?2BY6kh{PP6 z{uK5%@x~V)M84B`OU#33BlwXhzJ1Ux;k?yYMaNwbF47!1Wl6!(kEbR7I9Pm;2vggA zHJe9=1uS%7;lpSTj(P-OA$wvMOdR}oS7GrR>0Y~lPmqUY5icnJ;kO^%iLKzMA z1@ZClkSS#4d^(n1KrZ>)PdW?5FVfN$EO20YQ*(JVJymH%1k`HiVpCN3m}cM2E$$BH zDv*U>+*@^A3>dV>zkjUiB49U{8D&0}&jrpK&NTqJrFu2c z$%DO?@Y`d^LIa8Pbc8r1OaZAi{x$!+1Vn?59lPT|kKyX#JR;LhpAisMk4;^E&ldZf9o5OfAWd9z(- zt^)TH^;*X#VDXzaFD0%xXl4X&BA*bN)0eb2cfM`NE}$+Y`F}cf|4Ge)*ZW|!{l?J zaZTi`*F;axxVGuUj{$O=in5l-e7_yxK$sTDHUnQx6R4R%Zn_23$>oZ z4XKk;DV9BCM$b^H+@$LTO=cLt=cC=q&N=Xb@B;mSzv z^GCE{xzi+79OlE~r546rqd4*2PY_^sw@99$@ zAoC(SeFEVKUKVOOIK zJLd-&!vY-wO4ajT-wq(Et1iz$O7zui@ZVy3^gj zLIBfX0c+Hma6y$r0i-rKGhi)BVUvNveCOb6uIo{vX^$ft?(Ouo0!Nx7@b7Im0DoM$ zdJY>>4%6P|r6b$l%}7d&e0UNUoWs2-=iK2$T>nNQ@xd4WZa|9wgo8l=3WKm-$lLA$ zAOM1YJ~QLd%BA)~=T`&SwNTke6`0A<2Hf}fuwZ}&a0Ebc&s_S6%QdlJUwt&=DxFwo zR$j2H)gBuD{Un<_MZOa{Yox@WVB&kaN8}bRE}mq;k&Ms$DsmqC4Dteu??nn8@qip# zVq3RiaJ3xlfJ5QvigUy~uV`bHe%OwUM#iN5viRJc-JtCr%>Q&f4j<#O>b`)3AW_JW z7LG&M5$#Kkz+KS*KPYf+Yqlu+W6uYp?@1=S#>*pqR0w4SrWgkD^BQrN8tpFEU+f`D zN*3XM1aojm$xyv{MIMd&_k6o)d9BiF>SRo4NT_IUR9RsUIQVvJf2B?OzeoTo3s@i0Mg97gSK|MDybpH(7`H<= zrg61o55ve#nCND5A}yX{JPg#4RNo5g!#B3qJQ) z1~ZdYCo8QVd5GmXHL;4Dc2PScNU1W!2?R|rZ=nfE4|r@NDcqo|M^173Ofq523=`2g zLVj-UVR0P)e1)E#-V2?&{wv*>j)JkT(ANTU6S}Fn=t>tx&@llPLY?s`MTZEU2+WW{ z)mS2elx25yeRa2I2N6W>*RMDJ8*qV}(!#DQ09NXSs`mEw22*vg9VZ*Dh=Ai_0=d9Q zwvPy#I_;-qIocP0b~I45qO;UrdLFYdl(W{LPUHHAC939gs~ z8u0@d8#nL@J{ovDgPI%I>CtI=NWO$&N-6mnyVCzU-ux1+JD;SkM4C2$KkW?c8YHy~ zM(JQUug`RM&0_v$X!}E%9~u4K*7Q&9;_;bAF>OmF#oYUnKsgGQprDd~m(Pge+PFG3 zg+wSzGN$+yb!R|5;I%pxzUco8TjjJGj!m|yxf3oa26*QK?)yZiT%->~bTZYz;@h8luzYD)b(6xl+u zii!_lYv1^POpI&I3S;>i!CN4x(pmIdmUr=I4U?2Ot{<(%BvYdshHHKRipjwUBidRe zQnesBn@z>fl82Zj=8o*$~X3{&daF7psQ_V`)p96Q^76 zB&Op(efk@cAUsi`w^BK9Ou+C<@8s~;7dLBi!i$B)0>DQVY%hhcJ}}8Zumv8=#V3t2 z(@aJ#<>{KD<5SCX&wjhr?F8M%jD6c8uhWL2>l&f!!gK8~Q+)rP^$g4nA8IZIaIvO% z`t)wNq~EMH9S)|!)7%iX6T@#R$3kh5Pz=e^QppECN|+`ou*bVC`Yq%t=(ENu-@s)e zt^~LZ`DL`pTezuAw~#SvRuqNGX)YeR51DZ;VP}GuI!^y)2KL6zJCEEXrYy(ltes`W zf~c`PGZZ@#_`@r3o77hewm9w))kcHFtLyL;7DjZ)F;WRa-++JkzWx~0%<})=54z?J zoS!>&uxj9KgXt)Gi=I@9yk>M(ldA&5Q5E_IL@L0_qn3_4Gr~ZAsDuo9`j8j&xS)%^ z9;;JMe?>G24Oixneu+AqR$xs4)4B~SX$Z%{xsokq${aF-xi3&-K-&JtwtDz652KZS z0`*-O&435`;%=L~wlV()9#lJ6uGfsqd2E}$i) zOraL8pcDARn%zO65f57nevXMM_MJ@KSn=ttI%;WP0KA$FpnwOaJp%(ezLcWj$9(_2 zX`WK04)Qs^SS3)IT6hC<6!;Hc@(UMneHcsP_%n##hHwP<<-Yho_yNNvHJcBobhLr; z4$7O-H%%{iNB_!aa|o(b68FK|_*5Xbf%y#>Uu#-9o(XEiM=@%=68U3^0WBnWZ=GCT zO@6t#CX)o8$o9b2Zj{zkgwKealQSh zrJ=;=HF+c*9IQQF{Q!&A3QTnCc-+|0Qsl4Iwlk26p{NH9J_|S=AO(Cma_`_*pjGK9 z11BZM*9Q&_*H&PB1l)PxwLrOR$hLwU1|f}rfyBNs*?22lb+jJ7kX^y>2OZ|TX-n=R z^Z5v<>dMxaXU&YT+%Jo>>x45fj;nroNh}w`PC&W!X>c`T*&3z*f4>Mw*Hx-fA=rg4 zb|9)o^otsxyqYTR)yWz3|AU9m3r!Ng^H$r}=U>Mx3%YXWD@Q-FK%czx0C+_=JDBk-%jw&O>Yh zW~#_$O;q$TCMw`NP1BW+C7|?-*RqJEzWZN3xu_y8QrGzLg%3gm7hRIS^itPIBckEp z%fLLvnSIvCDv(-0+{2xuJ%0PYDdd$_sxoqOtHfb$tbMAiuI2%dYYO6^KYkF6H->=6 z63s%eD?yFnXi_`dUbD{@zK7~(l$DEQmIJ{PAU!kAB=zo@^+T94q_`f>-eEd3qcH3U zqZOh62R;I=v|3MzbM2(sjYLGjwcgo2N91BvV=ijPUL}R}!vsi3EHmk2r#T)* z=gl0Zy7fUc1WUsDcZd8&bQRohu#1Z)9AF_~gkqSxu4enc_%koy0!vp#5k4~x^GDN( zqVQR3s8GmNFLgD+^JM*y{p)<@Xt7qLZwqv7Sl&R)YW*;>irm)mYJQRbncqD^zip7l zh&(YUiG#u1`=m)eB`7rXR*=()ecdd~FO$rbbL~$C-@=p(0b~+HvQ2%2QmHpw!eHqF zcqvaxze7Bqu|^IkWWnAADht^3AQyl@nb1)9SER5Sn0l>$f(m8gjo~|im(Aa$WuVs? zE}p<#ch|KZ`mavkJUG_>M?57QML??rTshU_=m}UFbOLAFa2;tk^Y!a{cne?fm}UZ1 z4?Rm|XQi8oN(~bNY?_e$GH~%T&XxD}{yOrl4yNCNE+&jbPXfMr(?w}odHEYAJRrm0 zqk=W%k{(>FYSp$~^FlfrDps(zYH}ngWrB&TSVS6+sGZ%e292r&bmp8h_9Jqfmab2` z$6|)o4~TheKcOD3+l|QSm_xV(G}qAZcUYhl)$YBjbzTkY18e$RXf6dq<3Oz6TosSHa)h|}cu|G>3*%bW0A|^NDTeyP_~Gksf^BtCV{NV76G(~`qbssFQ(8%1um>muB03E!i zsuIA_4z|F`xrpA2bn*cKj?XW7dSSZL##bX9?GGm0AbSk+-c*6Gf}a3$!&Y%z9ZpP; z3O8sCI3yNuMQ_m6d)vtam&K`PR_+9xfJo~jRjusvKn&j<{CuX}Em;*99jW#a%F%{| zY`{jt@Pm$r4s@lMx1lkFY1R8q)B~x4F(q~Nm(T>HI~Azn;`5(05%CY@PIv*~gmAQY z;1a${j*}z0PO@qt0kZEIB)q&ym@kv7G&kBCDbLutv zEvm!!&ONiC1q?X5kYp_Qc@1EAW=6rF><5ahAkuLOnv~uY4z$dlL7j_lA*%|qbFGlC zbG+6*Sv8jhb8S$?uz&UOk&Gnm3;sfUz$b{DGM09P0|*bkOrYL@gYz|g8zXC^!S6@6 zcoSn* z`q+we5giM$UaTofr^aOlg9mJ{*9b+gzUjsE<(`Cp$FSa;cc7I0$t zcC3qg;9VyiFUBiK3u!#&QXj=9< zhO2n@^a68bJ`F@f572K<0z`0M=ztBFo&b=Rx^_PV{QW1eEL-CHl2>dm4>3u&!}vW8 zzIItJPb~-7BAB0#GLdihFAdh+oc{A@b%u$*NhaW^cQI|VE_gLGO|N5 zqLMca2;VQMUjP8PdWdv#g7}Sp{V6iqU$8(yZFmcH5GKOFKj{N{hucYdATr6iYR;MH z9=>-M+yt!|H8s4_CyJ9_=@i%Y%ya85P zXlDoMAdf`SKfI@!((2p~nk}C#I@W;V1JDm(0inE<1xImEzNSZB@No-0{AtFyH$GY7 zxHcL5eBRYB6`bega~C7{t%1DFssXX>AQJ@@EB#jEIg54mA5>svbf>t?^<^jMzJlyk zH{hB8Np1mtPwDV!;b1b-Xj$Hm0e4p>MB5ZZi)NbJ#Y9I#-2!+%xa2;gKsv|6tt})( zdIwzLZc-y@ ze>ZXC^&d2#C!3Fcduv&L3U^cW`Bt47cqHoZyW~J@?1{`?uc_(8zldp@P-n-OOp?ub zrqeHUsMvqcut^9w&2Ye;-1GWU)%v2z2Xe_xEyln7eBXJNIkG-gdnmQFJrekltbQQ) z5#8tKHl*zm60mq+|3V)-WVk2cceHERd9vG?Mj&u9Z)7~SKz4nC2A&8eQ>Cms=a+Ea z*1BvuLRS6?!plMjHdBgL^r*3)`t1|S^qufdmLSd7*ENp?nXrB;coCxWzYh3TDFDuPn>+YQ{&-nO|%@K1XJ)*Pc z@xHhX;ZrbUn{oMPx8C<0ydA1aAiulua!Z)=n_eWKUqH{F(D7gf6MJf0OkgZYzmhfT z`&A)u44#iq*!{t!4p_?g&yxFqMHCLpXn^eZZYP=P`H_`>E5%mLvbAcVHp;_``g2o| zufZJ?9DYYFQXzAUePuN_k<;!bqDebIwE#JC1{0RY|MBiDf0ZZZrjd$+c><5)3XWJB znIxP75JpeQ#T7>riofVw2j?>;+11TxTxPEGOO*0oX4|JQG~3zsxlT?!J~V>R1laSp zB!W>d@7%-NS$mhMQF_9`=d#)Z=^CLWiycF&9r7@3)g^f58&33mcrU*I684tAd&4-Z zYPydDETv)E49Sr4Pd1^0h_`8KwXRY-`Fj83i#D|aNHPSR85DGI`Xcjt z_30t!qj`NlMzetr+?nfrZvrDK5^F^P+zgO3nE%nv&u>F9gLK+- zcWVGf!o;d0E1zZ4rt?+8K}4gG~wL4?fBMDQn4#Kk5Rxcwe@t|SU>o!|OJ z8(rpwsHH)H{*WcnyAsBH)U?z9TJrqx5e9f0Gs#gvsju04x|z5 z5_5rxl`{XQJY*~pHP|_ZHdKEuAH@ZQS(?ukFYqoq)T7O^9c#xp9xZ&!dlRR0UEIj? z<;jn7&CNS1RO^nl>g38ClaIj|9@sm;Z8G2_%uG}Hkusd765A!Ev(@{X_)_+fmTJ6l zxu#X(49ZeUQO-t_GGLEsLi`f8d|H2K!vPYLQDjiAXDsW_SAVSME(oVe z!B~%QQC($kd13Y~K=d*lE301fgxy}j3NX7{{}2@i8c&D{g~*QJH;tF)HhCkJH%m;g zllvqAL2#g4&iY)bg5xhNXB^^^t=cbl7SLsz_jm1OP8*2y$=WT1OhaU`sh-x_-;Ds%79!Tib4WBpnU# z7R=S7AA)y|GzHMyAjrvX&j_0@<*Im20$_tC?YR2@Aa)B9tAfQI8Sjtl8&LVe)e!C0 zO#^@z(CP~)k&sY^LoYJ{BU_nIQl*kd#r&2B5IdG`{Rh|ebbyIFCaQ$KFc`if{gRRSvv4!!#o9=~ zUutO=3l{?z2x1hO5dXnzRB;m7DYqs6OHPEU1Qy4Cq{2tR;#X@rNSv1C1z|X9_`iwO z##w8Z?%3ayKhp4#KpZ7(Jz(zgrC>uVxhfA4XaH%wmf3)H*))Iu^;1KoY^;s!Q%|8A zMm0*6#7K-0|8B*2H9M-~*gWNr0=n1b(A)qBnB7A>sFH!sg#17LKf${fRu4zNb(@Pv zCkao?Q#|p5Pqb6eB%u$NLRTsAxzx!%_`R!RNZ4(`?}nl26$uigg{n6u1~^X8lyegH z={0EKV@UvZ1YW1$K1LAPN#zT_xfe8Q=C|sAx8ukM*+{|g=sbnAS*ku)9xCLFSq!Zo zLJOVs<3|wSBoAhgFJ1x&FpYGENgp8;l>mwv_&l;|^dW`S2&kr~P`xgRv~)03{;>Gr zyvk^T&-#Mq&C^g_X!HSB=PV5XNv!&GE&7@d%b~=p_@(GIS2VB|g8lhm6!`{uubxbD z5n@3EOI7E-+IGn67eE;C7KX%)3e8~gmIVnJoZIOS^Bq6vY_jE!SwKOSAz1Y=ShY`T zaNQ}W2pgVtTue|>i`%0LCm}g{An# zRlCzJ$zDYpQJ=bWr7M2y_c_oVi6vH8@)S~ybMQ*f|EmZR`g+}M8x}fgaQ#4!>{Ncs zY9pZt^)m=+?EUIg3m#wI@P9>xyMu$F>bNcAFXsIM<$1{7@jCTx-JOYh^K9ww1K;Pa z_~=GH#D0iT{h`UGE}oD{4COwGp51|KY}YoCIL)e0<9G<1I6K<0RzWHZlwby?nwbqu z7PDVj-Mk4ZerMNJU_Gj&V!C)e$L(Z#UWyn_$bK0|%XE)&*lLo}ck+(b!&P zGT(!T&_iy<b-~csL?iDhdgLgeW;Qezob!b}1b|)etGI=R^*b&>?`{7Ve83?d z4VfLV8Go@I0q!;@AtY3Mc5_%B1Vq3HuaR0BVmr)}kdTPY7BP@Ur0H>AX)Xu%xHg@% zTVXOYKo~4-v2=8-<2>CN-=6LxiudAmRNK#na%zr!@FVaIUTQnE+{?wdsg7DYtuVAy z#@8Y|imyF%cRTzO+LTl~|72-rC ziN|zT#DvQ~xVv{3ts>4`Z`S4v=j+qoxs@XlgVpUL;Jt9U+Z3rJ>-#=ks%zaIPf&8k zq$=DdBZ4mB9~)Lms_B6K!9i6wGreSFKxDkBvIgO6Ug+p5EY&5Bb6ZwWlDzJH2Ez2up0Pn9A93Y)Bv~mRAal)hI)KE@A8*c$UA#Ih7Ocb8bZM=+eg{vM1+KJR&<9r2e02{Y-}vTR)KKs zJkbd!>Q&ok!5KkC>)-NwSbd!MB_zZqn|yqfG{z?;$hbSA;=MDr+;u#^m~p=1B$S&I zqsPt2$q4|DLpeFDq#Up9kGTKMR-}Z*7m4Cu(;xVqIhoZ!2gdlD?kS<^dAn#i zR-6Bvo&-;)1(RZlUVM0`fjaaW%bm#|4~x{~fmVEQQ67P2>}SnDJS>u}2)x^vf|8tX z!qW@dM$c$flbyPHB1SVMh=L{7EY-^Kq#bXFFlmR9VohyQ9`?~wCz^c=QB4ULu5cw( ztiT=_T^Kh!2#h3CyD_BySdvMW^NnA+1UAt;JC=6p8*ZOHQ#@fOy!dp(w zq*PqFpUP*pHfBrxoxNB}JEb+Fk5HK??lJ#*$)xR~P8Ofnxvf~y8Gh&f_4nNgEM|Dc z@VJ@D2itX9pO_*(O9|qYo=3FLzkAYsD&5mFXm>jNv~fWK=l9|ie#t@2{^`z?!#5Va z*1@M`(umD~qCE5r;-&#YOr47JaYJcii#5Uk(uxV~tW@k|i(~h_@|NMMF z_wAQP^BgxugI(~LUyL|mw!S=yN=*D2K9b9!FXF>(HP;(Wv;8QXROx*NeMUY5p#Kog zL-H-197ul3BT$p}OW9T^Cd(B2|KQE`I z^#ySZAY}%7jKy${!E&qqyATS#d~ZkMnd>ixW!|Wgwk@4GCq$E@!;&2Ex#Hl|S462V~&p0-L!=~W^`RItdf?);^8_`uxAp%p_Y|1zOIby61EbUR;_<;yn>$L zPv2d>%@GAR#iyi^JJL!&WJ#puGnc0(V&L$Ek>XNpouygFe|J32i;Nd#njoyjoEqvY3EyZ6E;lZRe!1mE0=4! zwr-f}9%9hw^)EG7M!xJ53~%8my1H8QIZ|V4ZA+VrXOWm#M3_lsl|*l*2`d-#dHE@9TyRCxlgiqM`|z>WWTOFh)NfJhsqnYrtDO1|PiH$RLom*(n2nEr zP2f;J5exk^VuzlBDl560qu6v!R9W~roD_@VrTwtjgHY5}z71MjwfEU&{ZgTv z=9W%~^$kRZ<0Vn7m1oSjj?~b*gOrsa$q<$_33$+N;tDf%!U~>F|M+CxYD1%46?iB^ z+Ojy1v;6IeQTdjHY+>eKM8daUmlBV%-%;F%&(7=;s!bL2`(Am;7DivEcI|hI2JuN} z?q6DgTx=tC9s0x;MQ*EpfHrr`!1XgM92|)niGKy{Z^nX0lcu7Zq3A?T7Y>5^0w{#C~g9iW|650XEXJ=N+ ztJCEYpLrpp)7Z&rUVW{}QvT*ED;c}< z(k^BK6D?l%u=0A+tmV{>IXRh6xMcC>H`q=}O;-fW7*w+Ll=MpCu9gK~c6ui~R9@f7 zG8%FlR5^I!f&Z)`;+GfE3da#k?c;fI*+M#+5$A4`@~!TxO|rLygkrRUGA7A$Z7p0z z73&JSvAi#%lVQgW7afbEez|5V#0Xhb{r)QLnaj{+uU6hvUBt^)6jZ%4Tpd(B2mdAJ z2Su}fztn?^K7N~RihB72!^Z?oQhWb+ThQBD^jW<5S68Jc?5i3|rF?e!=S{oW6*(s% zyw$gOKL^xB^CC&RE-n&j?d2Sow%H(M8Bs&~Ymc#knwUuuZARydM6(lm6=NQfaa&D0`>KdtGq&0dzo>uD@jmEt>^%1kqfF(6no57ihO0bx&U0Js+`4=G^9-ow7 zMwWStPNa`~o2?^d9u^tOGBuwyrcVFG?mJc|ievt5@rGb{MZvs{e5-r3iu_wkjM6=prHF9TxGvsTV6s`%Z$^pO(KsSB^fB3jxV;30Y3R*HSKI& zyDRx`z$g4yt>)HL=|}LC`UF6`K?%Wg+2oFto!UR2Tqr}5XCZKP?)@vEW+B(~`frQK4)U$g+X=!w+ zu3!GN20SzFc?`3R2v8GXww}zVQU;RULWoDt-Y#%aY%qOHBHt9dC%669jA8R!`{j?y zFxWW@cp)FC>z?YI6QaEmN_U=DEk}PDlI+|-SGu`BMWBiMgE=qyF{{2NY7S|-PVv3T z`i-ZuVup)oKKc{Cd@{x-sGi!+g|T+8yK|$xiXU=m+2*bGph4)?-ekIGLmsL4yur`B zZ7@?*(}hUlTZ)jz!wpD3dBG8boT-7%Hq#*b*alFDH6=+1e$Hw zkI3~26~CMO9j=@>wY=PzswU#MuDC}DWtvHHW0sM#eqYnpi_n0{D!02<9;uy2j~xan zvC0_;B>#MRr@?K*eqQN`-u$yv0gx=WEd8$^VSR?dekSG#j|^znF#AcJ8gIqJ7bl92>Iib z9gns9){FD3SGV6YrwO%wPR1X3H=5#kHvE`C^R}Xr`th6>?3?%GuUwV1hSIlbn37#+ z_!~WgRZ~KzPX17d`>FhO61+DuI$5)(@~ZJmsJ`gD!N?zTv@ho6Jen|z*40MVh^NQ)xax7q{*^9UQiQ!TFB-Y z_juptPnb-q(V&Dv=|8>e5$d}YOVnbi2O)q!!2(AL^Q&D6?%^?s#8Xq|_bek4IGlS4 zt`2gAAHjVzlFO=RGt(S^r5BTyrXV442h?Arm#Em{6He~OTjA;JOuD81zE zc^nJM0-rxYK}e(HXUHw!oEm8?6pR%>6c9!+t9o;wOhT#W=`uL8&jX4+-~BkPx(W78 zDh#}Dqj)MKf1w?*R#3| zl|Hhnbto%IuT-Z|(0yP2Y<}uUvewC#;d(LUs;u=0icPswO{0XH@gET}Aseqmaf}6? z@&-k}_>mK9d)WwAm&x=}V|r2$Pp41d*E}JfH#Hfo`%s@E z=vA4$qW06SkcrA0$$vLLyT@`14p3-UCA^*`y;!y4{c&l?chnRX#_cuPbSS3jMEDA- z$o!-4KNIFqad@iV-FZxtM*fOL^D(CJ{689TLI$`Wf3iC{e|LW}67)yrofvuUJ-EF& zSSp_jmb@e>pP1qxa41U)i8kJtKBM3|A79+dQC8f$n}Vj(J*hQs zIv;-@`FMJ`8$TivJ`8g9TPNC8)jJ;CWk-?K>15}cX=EDKI@X`9JEoMzNEIPXueEJ*M#@EBmlqEJFD&5V{JZMP%p1udlLu||Qpbz*LQC|T6sM&Wo zvN^|5j!bt|ib=*5jSc>oPfu*moSWiARPx%1eQ2;$B-ZHQ^Q-E{FTNjQz7?DVFe6fb zE=h;ltZ1UrH5e#Rw}lhf(OMTL1V3W^J>xKd0uiK(hq-Jm?R;a6tlaF~iw%4>xzM`pn!t`TzM{r6i}6A&1$Xz_%uxkVCPcq?G5x8(de(>f zma=cflfDbsKU_xYsy#LIHFghIa!*3=rMuU}`%<|$iJ8*3nrQ{DEWcBIzmMSjAxo92 z!2-9_lhX$J+6&%;m!Hl;m^oDwaK2A{r0?n8upAl05r6umgTQZL~8K$PN8f3$5y5%M}^;JaTN zjqK{PS5WhNR7>E@TN(Q8(&H#B%hIRw+)=wx)}H@99ZkV|#gRG5Pe%METYX>Us)jaZ z%L%%d+Jin?N?2&T|42WTOn4hb+L!62QvBVde1frjIZ`4t7OUx_(4sfumy3_oX@`$u&AU5ky(zM=iOaV=9yCbyeT4?% z#CmM4ex3=hN6_F_pVnUqL#Ia599eV41V3E9tVAD+*t zcR`Ht%Dm4Fh*tol@r_EhROE;V&NI0f5V@pR3p%ci27@DDra9rV>}R;pI^Xy@zt9Xz zN+Lv3oU#yf`(0#L&B_Xb5-LtyRWtS+_`05VAr{)h<*6?@yV1^*dYHP8PE07j;q>R; z{8eIcsHPq-0i21c5(l&iZ4VNdL^9^c{`nb5W&%Mjy=lVN{B`}0^a8-?`Co5}l$8#N z$MKeNUs6Rxw)ZQ;Db+wtsnh4%!?o-5!+Y+pOWyJROk%fJ+84bch(}$Fc**|j;BB{_ zsyEXjLrXr$ep;+)&*3lau<9pwCfVf=%E2GsY4ELkLe(DX-?hz+r>GQ^=OjL+ zX^#<5>To!}sL}RtY7_14$^&sl+F{!p%)gp@Cal{BGlHTodF;>2N|=UbG`>Kcg5|Q^R$=|NmaM9+ z_N|J2MQx!2vroMjjpAY|yHs|;R8D=}&x9rb-;+pEZ#i=2ue{@&%fi;h< z8OxmqV#-mt_gi!NZ|N_+t1_@q6koF4mY4aRC7&vD5o-p)ZDJt-rDj9?;7h^|Q5&>2 z4TpGTdafU`$-JAPiH2NL)1ST*-M#()VA5x@^ZVzFT_;HxnQ-b$9&s4r%LtzZbp)Uy z?GQR5NIFNs{FmD+iNql)Lg3h(ZV-<4XO3piKw}9G{^1Hgmm!+pKSYg+E6+%h(;yy4cM(91l-UeijJyxjg*88oTm$DEsfP2t~-6C0RyP zhA?)S>>~}$gR(UCDMA<;`_e*|GS-p35z0K4jAcZ4#55%9sIkjPlr1fmY@hdB-+$nH zewq8a?s?yHU-v!N`<(MS=k+=a*1$WJmSuHT&x(7Fikk!&S|e$;9TP7qXu-yQPgqpt zMt5F=?Ra=X(uK_ue|+$0>)+zUk}91eMvWrAi!$7D6=Q`#J9UeO zQRjgF^>I%1U>f{B5g9u>nCsP03&@V_vF4Fc-&Pj&XYXM33QufC`1t)@JbH{1-SJxFB9?3g*=O-r*JP-l*}pT1c&(V5)!_AUom zKa;>~AaJc8tF@Gb*N9?vaL7SsyFsSG>r(tDa}klsLo>8FtkuVOJ+-gL_h( z=-(Wzv|Uak;juQX%D3=~i@JXqN-A)0Z|b|G>x*H3%S=r^`njs*7sp~Q+myluaI60Bp2fG^q_{<&WMRgeT#lpqnUhG6d|-#o3vvHvKoCr^zN zo#cqOyS5A*2uVyN3(|Ud*0tA>q55p@TaIA&GQuS%{c+Pq@uE`}+IRn+Orjs!Fa@A= z^x6XmWDLn5Y7e($R)t1Q+_Gw43tWabe>wd;h!YKhl;LFpAQ zN-+z&y7ggd*=3J^B!L}4)?cks3yh?n)QkpR=3spPvG__l+VHI=rq96Ee_jP7_|ylL zVJA$*!Mp4)+R(~i&emP8>41emsB~tQUcnd9NVzsc5DXg=1+3ssm#62FjwrbfmTdI$WS8P_Y-(7>jo4#kp#8xT4rQqB%B2AEGyB1_EM&#cn-0*>R73 zXB)ssItvBCGSWE*edy3S-~m7xqD<|i*VhlZSBi1$(iBOc+{B~$2H|o?njijKrq+QM z$#}gvz2ndxa}l%~a-Fi$KxWq0*KZ9}Hx}rmbtb(tPJy|dl*nKb+py=ktlC+dIf<+a z9?lh8#qv)8!6e~gJF08;-+k^aGQ!9ERE~GFLD%Mveo5Dvt2UG1)A#ikmr!ev1`d-( zy58+KfvBc=T|{+)Fu=Ujqu9NgRobE(#D~Un;?Ijghr>qwo;D|F zr&(Q_i1BmYKAb3*tmxK~i#EKk*#h$QBmR+Bp6xEh)?)Yjc$*h3!TT2_U<620ouqh* ze2+9~v-0N0x2{8LlUzzCFNmWuDwMXfkf-7I^vgsP&M(Nd9OiwxWl@h{&tPH(v{Odg z@16yJpZqd>(BIda!5hCRV2V}Xp3A4*B^5{xzR+bK%=JHOve#`kuOt>G7=wOExh$?5ueUq`pxZWZ`Pj4LbH z18|z*F-~jX^Ri;=5}#O|Ho}FgA&*0c<7D1Hyxlwcdkr2mo(nItJ+MS1=YY&;tdSWW zX`PBKbABY;=JrTr7@Klca$}vkL~$37h>C7h7K=JeG}+lu3~7<&J`7|nz_6jycJEZv zpMC=4#%}vAwb`dT65-CXa-QH6vc-J?=)ItwM^CZE0%l&S-uxo4N?B?FkhYDWTAwnEST_X&g zAPAV<@%spwmd{*IRL@HDLhq|W!Gw`WS6ycg#E^4uZ1vE3whoV0CFI2`~@2)inIhgL~T zoWek!WL~niCVzkof5ST4?B8evnG5yLprw645dq% zN&{eE(FLSX4)btFTTxg*38|pm2hhGCmX=2*C(C6~RsAp|XdKIcz>p@4Kb_OXVSAwC zvfO!d)nH@PbL8X4prLp%?0y%|)>svMzLlB+*dCo106ybz$@uDJHa3nlOH(7eVGWsH zY>JZ1oYDpXkCCv{*5k(gMC~evsh@z3y>p=_NF$|VtsF{|ye_o()7P@I>%CUIv@hJ< zaVU5hwmkYqri3Q(O)o?*{y`09Dspq!p*6Fzk$o|Abua4IkdU9Vp%68n@c5oYgz%w` zn9n>OzxeyY%CuU9tFs<=9Q;_Pcc`m9c9{H`l^HGl=NYB4Ns8*(ONHeloAjIgf3j0E zJ3n~6X3X^%3z%N9wTX$b#7&@Xokw9cW4_#d9 z<0@34g!HJL{;nnO&Tq0`rND_1D;QsZld|1A_fA8p4>dOivL(onAQXAW&suj?{H`@Yt_ z$?lzJ4kAnV&Nmz2JhcfJl)Zf)P#Xja)Rv<6b6l5a!$mdgIhzU4qtA2DmHNB^P=Ia)Bpp8iFXr) zY3uxye*DGN&9vUo@Yb;yeAxO+Ps|LqhSsuQxU)~t-KyTizR~Kd?)~cGt4E=wuhp*3 zJ@wtw+1xeR;!hsYN#2842yn=yBhE+?VXn}u;9CXc^I_}l|*Ib+rah%WJW~` zi57w38fn7(5wJv1rF$K<@$OG-@X9WQ7P{4Lw7YXN4{jj49cxlsJkk@aC`rJ~{u#fU zWUqO6v>KPwd-t-xn^cUKGLKP4kKY8pQHImQw`4?Ep=o8;SP;rozzb1e0gnflg5Q^M z6X*Om@B4~(4^E!6fuwpIq+2QlI$GOlkgX-krj0*UcBXgLW&6HoG)kph>~LRo-Ri$H zZHtL|WSehl*9~(TVJB11ZgdSK-(LTsVQ-J$Zec2FC_d+zu)ZXmWbT>B?AaE###{j# zyg45qpJI_{=?F3Y91hL!@%Dyj$e*&eKbW9=iCggj&?Fn!RNwJj*Qr->8ttTZbj-G! zq-ewo^#nIGG%Pk-M?^@J`*`G)d&=&2L(Vb8%acl!fGQRC73o}f)L;iN;`|U(8TYCR z*FjcNov{MKLf!rS#`f~wdAQ-O=QbjOJ<-zme2_+eU;3VoQIwo!ttlIp6NzLlQ`}E3 zPopoJo1X!c=Pcm^wUj}ff-vP?V>-+O_2m5nE>x$x*K0EsaV}twbfACF79#Tgt*9V2 zHflNQ_RrEfVSS}bXo5&VmIvz_1Z2v!<)ebtGnwDKM=S1E4GL9SvY(9-CFdv3`#0kuA4H?f;!GFxE+CtpTfq z-=dbmLk0FiAk`x@kYzgYfx;~hSk`&=;q%c`QY^EU{eNGQdBDDPy5TmV?5ZytFiSIQ K(`sY4`~L%lwf=7a literal 0 HcmV?d00001 diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/vrf-simple.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/vrf-simple.drawio new file mode 100644 index 0000000..79c5a2f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/vrf-simple.drawio @@ -0,0 +1,44 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/vrf-simple.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/vrf-simple.svg new file mode 100644 index 0000000..ae66dcd --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/03-Network/vrf-simple.svg @@ -0,0 +1 @@ +
Machine 2
Machine 2
Machine 1
Machine 1
leaf
leaf
VRF 1
VRF 1
VRF 2
VRF 2
Machine 3
Machine 3Text is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/01-gardener.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/01-gardener.md new file mode 100644 index 0000000..45a3383 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/01-gardener.md @@ -0,0 +1,130 @@ +--- +slug: /gardener +title: Gardener +sidebar_position: 1 +--- + +# Gardener + +[Gardener](https://gardener.cloud/) is an open source project for orchestrated Kubernetes cluster provisioning. It supports many different cloud providers, metal-stack being one of them. Using the Gardener project, metal-stack can act as a machine provider for Kubernetes worker nodes. + +The idea behind the Gardener project is to start with a dedicated set of Kubernetes clusters (this can be a single cluster, too), which are used to host Kubernetes control planes for new Kubernetes clusters. The new Kubernetes control planes reside in dedicated namespaces of the initial clusters ("Kubernetes in Kubernetes" or "underlay / overlay Kubernetes"). Where initial clusters come from is the subject of a larger debate, with suggestions made in a later section of this document. + +Gardener's architecture is designed for multi-tenant environments, with a strong distinction between the operator and the end users. In Gardener, Kubernetes control planes for different tenants may reside in the same operator cluster. This approach makes it very suitable for being used with bare metal because it allows taking full advantage of the server resources. Another implication is that end users do not have access to their control plane components, such as the kube-apiserver or the ETCD. These are managed by the operator and in case of metal-stack even physically divided from the end user's workload. + +Gardener allocates machines from a cloud provider and automatically deploys a kubelet to those nodes, which then joins the appropriate control plane. Operators can also nest clusters so that newly provisioned clusters can be used to spin up more clusters, leading to nearly infinite scalability (also known as "kubeception" model). + +## Terminology + +We would like to explain the most important Gardener terms. The terminology used in the Gardener project has many similarities to the architecture of Kubernetes. Additional information can also be found in the [official glossary](https://github.com/gardener/documentation/blob/master/website/documentation/glossary/_index.md). + +### Garden Cluster + +The Garden Cluster is a Kubernetes cluster that runs the Gardener Control Plane. + +The control plane components introduce dedicated Kubernetes API resources for provisioning new Kubernetes clusters with the Gardener. It also takes care of the validation for many of those Gardener API resources and also reconciling some of them. The components are the following: + +- Gardener API Server +- Gardener Controller Manager +- Gardener Scheduler +- Gardener Admission Controller + +The control plane components can be deployed in the Garden Cluster through the Gardener Operator. + +The Garden cluster can also be used as [seed](#seeds-and-soils) cluster. + +### Virtual Garden + +A recommended way to deploy the Gardener is running a "virtual cluster" inside the Garden cluster. It is basically a Kubernetes control plane without any worker nodes, providing the Kubernetes API in an own ETCD. Its purpose is to store all Gardener resources (such that they reside inside a dedicated ETCD) and provide an individual update lifecycle from the Garden Cluster. End users can have access to own project namespaces in the virtual garden, too. + +The virtual garden consists of the following components: + +- garden kube-apiserver +- etcd +- kube-controller-manager + +More details about the virtual garden can be found in the description of [`gardener-operator`](https://github.com/gardener/gardener/blob/master/docs/concepts/operator.md). + +### Seeds and Soils + +A seed cluster is a cluster in which an agent component called the `Gardenlet` is running. The gardenlet is connected to the Gardener Control Plane and is responsible for orchestrating the provisioning of new clusters inside the seed cluster. The control plane components for the new clusters run as pods in the seed cluster. + +A seed cluster can also be called a soil if the Gardenlet has been manually deployed by the operator and not by the Gardener. Clusters created on the soil can be turned into seed clusters by the operator using a Gardener resource called `ManagedSeed`. This resource causes Gardener to automatically deploy the Gardenlet to the new cluster, such that the resulting cluster is not called a soil. + +### Shoot + +Every Kubernetes cluster that is fully provisioned and managed by Gardener is called a `Shoot` cluster. It consists of the shoot control plane running on the seed cluster and worker nodes running the actual workload. + +## Gardener Integration Components + +During the provisioning flow of a cluster, Gardener emits resources that are expected to be reconciled by controllers of a cloud provider. This section briefly describes the controllers implemented by metal-stack to allow the creation of a Kubernetes cluster on metal-stack infrastructure. + +If you want to learn how to deploy metal-stack with Gardener, please check out the corresponding [deployment-guide section](../../04-For%20Operators/03-deployment-guide.mdx#gardener-with-metal-stack). + +### gardener-extension-provider-metal + +The [gardener-extension-provider-metal](https://github.com/metal-stack/gardener-extension-provider-metal) contains of a set of webhooks and controllers for reconciling cloud provider specific resources of `type: Metal`, which created by Gardener during the cluster provisioning flow. + +Primarily, its purpose is to reconcile `Infrastructure`, `ControlPlane`, and `Worker` resources. + +The project also introduces an own API (`ProviderConfiguration` resources) and consists of an admission-controller to validate them. This admission controller should be deployed in the Gardener control plane cluster. + +### os-metal-extension + +Due to the reason metal-stack initially used ignition to provision operating system images (today, cloud-init is supported as well) there is an implementation of a controller that translates the generic `OperatingSystemConfig` format of Gardener into ignition userdata. It can be found on Github in the [os-metal-extension](https://github.com/metal-stack/os-metal-extension) repository. + +### machine-controller-manager-provider-metal + +Worker nodes are managed through Gardener's [machine-controller-manager](https://github.com/gardener/machine-controller-manager) (MCM). The MCM allows out-of-tree provider implementation via sidecar, which is what we implemented in the [machine-controller-manager-provider-metal](https://github.com/metal-stack/machine-controller-manager-provider-metal) repository. + +## Initial Cluster Setup + +Before creating the `garden cluster`, a base K8s cluster needs to be in place. +Some suggestions for the initial K8s cluster are: + +- GCP/GKE +- metalstack.cloud + +### Initial Cluster on GCP + +- A GCP account needs to be in place. +- The Ansible [gcp-auth role](https://github.com/metal-stack/ansible-common/tree/master/roles/gcp-auth) can be used for authenticating against GCP. +- The Ansible [gcp-create role](https://github.com/metal-stack/ansible-common/tree/master/roles/gcp-create) can be used for creating a GKE cluster. + +Suggestions for default values are: + +- `gcp_machine_type`: e2-standard-8 +- `gcp_autoscaling_min_nodes`: 1 +- `gcp_autoscaling_max_nodes`: 3 + +### Initial Cluster on metalstack.cloud + +- A Kubernetes cluster can be created on [metalstack.cloud](https://metalstack.cloud/de/documentation/UserManual#creating-a-cluster) via UI, CLI or Terraform. + +## metal-stack Setup + +> **Attention:** Bootstrapping a metal-stack partition is out of scope and need to be done before focusing on the relationship between metal-stack and Gardener. This guide assumes a metal-stack partition (servers, switches, network, ...) is already in place. + +Start by deploying: + +- `ingress-nginx-controller` +- `cert-manager` + +This guide assumes, that metal-stack gets deployed on the same initial cluster as Gardener. On the initial cluster, the metal-stack control plane need to be deployed. This can be done as described in the metal-stack [documentation](https://docs.metal-stack.io/stable/installation/deployment/#Metal-Control-Plane-Deployment). + +### Garden Cluster Setup + +After setting up the initial K8s cluster and metal-stack, Gardener can be deployed with the [Gardener Ansible role](https://github.com/metal-stack/metal-roles/tree/master/control-plane/roles/gardener). + +This deploys the following components: + +- virtual garden +- Gardener control plane components +- soil cluster +- managed seed cluster (into the metal-stack partition) + +In summary, this results in the following: + +- `Garden cluster` created in the initial cluster +- `soil cluster` created in the initial cluster. This will be the `initial seed` used for spinning up `shooted seeds` in the metal-stack partition +- `shooted seed` inside the metal-stack partition, where all `shoots` are derived from diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/02-cluster-api.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/02-cluster-api.md new file mode 100644 index 0000000..43840d6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/02-cluster-api.md @@ -0,0 +1,18 @@ +--- +slug: /cluster-api +title: Cluster API +sidebar_position: 2 +--- + +# Cluster API + +[Cluster API](https://cluster-api.sigs.k8s.io/) is a Kubernetes project that aims to simplify the management of Kubernetes clusters. It provides a declarative way to create, configure, and manage clusters using Kubernetes-style APIs. + +We provide the [Cluster API provider for metal-stack (CAPMS)](https://github.com/metal-stack/cluster-api-provider-metal-stack) infrastructure provider that allows the declaration of Kubernetes clusters. + +:::warning "Early Development Stage" +This project is currently under heavy development and is not advised to be used in production any time soon. +Please use our stack on top of [Gardener](./01-gardener.md) for production workloads. +::: + +See the [cluster-api-provider-metal-stack documentation](../../08-References/Kubernetes/cluster-api-provider-metal-stack/cluster-api-provider-metal-stack.md) for more in-depth information. diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/03-cloud-controller-manager.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/03-cloud-controller-manager.md new file mode 100644 index 0000000..ef82b96 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/03-cloud-controller-manager.md @@ -0,0 +1,11 @@ +--- +slug: /metal-cloud-controller-manager +title: Cloud Controller Manager +sidebar_position: 3 +--- + +# metal Cloud Controller Manager + +CCM stands for [cloud-controller-manager](https://kubernetes.io/docs/concepts/architecture/cloud-controller/) and is the bridge between Kubernetes and a cloud-provider. + +We implemented the [cloud provider interface](https://github.com/kubernetes/cloud-provider/blob/master/cloud.go) in the [metal-ccm](https://github.com/metal-stack/metal-ccm) repository. With the help of the cloud-controller-controller we provide metal-stack-specific properties for Kubernetes clusters, e.g. load balancer configuration through MetalLB or node properties. diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/04-firewall-controller-manager.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/04-firewall-controller-manager.md new file mode 100644 index 0000000..5c11ac5 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/04-firewall-controller-manager.md @@ -0,0 +1,15 @@ +--- +slug: /firewall-controller-manager +title: Firewall Controller Manager +sidebar_position: 4 +--- + +# Firewall Controller Manager + +To make the firewalls created with metal-stack easily configurable through Kubernetes resources, we add our [firewall-controller](https://github.com/metal-stack/firewall-controller) to the firewall image. The controller watches special CRDs, enabling users to manage: + +- nftables rules +- Intrusion-detection with [suricata](https://suricata.io/) +- network metric collection + +Please check out the [guide](../../08-References/Kubernetes/firewall-controller-manager/firewall-controller-manager.md) on how to use it. diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/05-isolated-clusters.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/05-isolated-clusters.md new file mode 100644 index 0000000..3d45c6c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/05-isolated-clusters.md @@ -0,0 +1,383 @@ +--- +slug: /isolated-kubernetes-clusters +title: Isolated Clusters +sidebar_position: 5 +--- + +# Isolated Kubernetes Clusters + +Some customers have the need to run their workloads in a very restricted environment. These restrictions are driven by regulatory requirements in some industries such as finance, healthcare, energy and more. Regulatory requirements often mandate that the workload must not be exposed to the public internet, nor is capable to reach the public internet in any case. + +For this purpose we implemented a possibility to start Kubernetes clusters in such a manner. This is referred to as cluster isolation. + +## Design Choices + +When talking about highly secure Kubernetes environments people often raise the term "Air Gapped Cluster". This would mean that no physical connection exists between the Kubernetes control plane and the Kubernetes worker nodes with the outside world. This requirement exists in extreme environments such as ships, moon bases or nuclear plants. The effort to produce this in a completely automated manner is extremely challenging. + +We decided to follow a different approach which is more practical, still very secure but much simpler to implement and operate. The solution we created is called "Isolated Cluster" which means that there are still physical connections between the Kubernetes cluster, but guarded to prohibit malicious traffic. It is also not possible to enable malicious traffic by accident, e.g. if a cluster user configures network policies or load balancers to untrusted environments. + +## Network Design + +In order to be able to restrict ingress and egress internet traffic, but still make it possible to create a working Kubernetes cluster we implemented the following network design. + +- All strictly required container images are mirrored to a registry which is only accessible from the Kubernetes clusters. +- DNS and NTP servers are produced alongside the registry. +- The `containerd` configuration on every worker node is configured to pull all of the strictly required container images from this private registry mirror. +- DNS and NTP configuration is also adopted to use the DNS and NTP servers on this private environment. +- A list of networks which are allowed to reach is managed, this list reflects the networks of the cloud provider and is not modifiable by the cluster user. This list usually contains the internet prefixes of the provider and one or more RFC address ranges. + +![Network Design](isolated-kubernetes.svg) + +Users are advised to attach an additional network to the Kubernetes cluster in order to be able to pull container images for the application workloads from private registries. + +### Strictly Required Container Images + +In general the creation of a Kubernetes cluster requires the ability to pull container images for several applications which are necessary to make a machine a Kubernetes worker node. To mention the most important: + +- Kubelet: the main controller on each worker node to manage the workload +- CNI (Container Network Interface): controller and daemon set to setup and run the container networking +- CSI (Container Storage Interface): controller and daemon set to setup and run the container storage +- CoreDNS: DNS for containers +- MetalLB: Service Type LoadBalancer Implementation +- node-exporter and metrics-server: Monitoring for the worker node +- Metal-Stack Addons: for firewall and auditing events + +## Flavors + +With the introduction of Isolated Kubernetes Clusters, cluster users must decide upon cluster creation which type of isolation he needs for his workload. +There are three different flavours available: + +- Internet access `baseline`: This is the default cluster creation mode, which does not change any aspects of network and registry access. +- Internet access `forbidden`: No internet access is possible, neither ingress nor egress. +- Internet access `restricted`: No internet access is possible, neither ingress nor egress, but can be enabled by the cluster user. + +Please see the detailed description of these flavors below. + +### Cluster Wide Network Policies CWNP + +To restrict which egress traffic is allowed, Custom Resources `ClusterWideNetworkPolicy` are deployed and can be deployed by the cluster user. +The set of deployed CWNPs differs between `baseline` and `forbidden`/`restricted`. + +`baseline` CWNPs: + +| Rule Name | Destination | Purpose | +|:-------------------|:-----------------------------------------------------|:---------------------------------------------------------------------------------------------| +| allow-to-http | 0.0.0.0/0 | egress via http | +| allow-to-https | 0.0.0.0/0 | egress via https | +| allow-to-apiserver | IP of the Kubernetes API Server on the control plane | API Server communication of kubelet and other controllers | +| allow-to-dns | IP of the Google DNS Servers | DNS resolution from the Kubernetes worker nodes and containers | +| allow-to-ntp | IP of the Cloudflare NTP Servers | Time synchronization | +| allow-to-storage | network of the container storage | persistent volumes with the cni driver | +| allow-to-vpn | IP of the vpn endpoint on the control plane | allow communication from the api server to the kubelet for container logs and container exec | + +`forbidden` and `restricted` CWNPs: + +| Rule Name | Destination | Purpose | +|:-------------------|:-----------------------------------------------------|:---------------------------------------------------------------------------------------------| +| allow-to-apiserver | IP of the Kubernetes API Server on the control plane | API Server communication of kubelet and other controllers | +| allow-to-dns | IP of the private DNS Server | DNS resolution from the Kubernetes worker nodes and containers | +| allow-to-ntp | IP of the private NTP Server | Time synchronization | +| allow-to-registry | IP of the private Registry Mirror | Pulling strictly required container images | +| allow-to-storage | network of the container storage | persistent volumes with the cni driver | +| allow-to-vpn | IP of the vpn endpoint on the control plane | allow communication from the api server to the kubelet for container logs and container exec | + +All of these CWNPs are managed by the [gardener-extension-provider-metal](https://github.com/metal-stack/gardener-extension-provider-metal), every manual modification will be reverted immediately. + +### Internet Access Baseline + +This is the default configuration of a Kubernetes cluster, egress traffic is controlled by multiple CWNPs (`ClusterWideNetworkPolicy`), ingress traffic is possible by deploying a Service Type LoadBalancer. The cluster user can add additional CWNPs without any restrictions and is responsible for them. + +Container images can be pulled from any reachable container registry. The `containerd` is not reconfigured to point to our private registry mirror. + +DNS and NTP are configured to internet DNS resolvers and NTP servers. + +### Internet Access Forbidden + +This configuration can only be achieved by creating a new Kubernetes cluster, it is not possible to modify a existing cluster (with internet access `baseline` or `restricted`) to this configuration. It is also required to specify the most recent version of Kubernetes, older versions of Kubernetes are not supported. + +Every network access modification triggered by a cluster user, either by adding or modifying CWNPs or adding a Service Type LoadBalancer, is validated against the list of allowed networks. + +`containerd` is configured so that all required images are pulled from the private registry mirror. This registry contains only the strictly required images, therefore no additional (workload) images can be pulled from public registries. + +#### Egress traffic + +Egress traffic is only allowed to the private registry mirror and the DNS and NTP servers. Additional CWNPs can be added to reach destinations in the internal networks if specified. +If a CWNP was created which points to a destination outside of the allowed networks, the CWNP will still be present but stays in the status `ignored`. + +```bash +> kubectl get clusterwidenetworkpolicies.metal-stack.io +NAME STATUS MESSAGE +allow-to-apiserver deployed +allow-to-dns deployed +allow-to-ntp deployed +allow-to-registry deployed +allow-to-storage deployed +allow-to-vpn deployed +allow-to-google ignored ingress/egress does not match allowed networks +``` + +Also an event is created which describes why the CWNP was ignored: + +```bash +> kubectl get events +5s Warning ForbiddenCIDR clusterwidenetworkpolicy/allow-to-google address:"8.8.8.8/32" is outside of the allowed network range:"10.0.0.0/8,100.64.0.0/10,212.34.83.0/27", ignoring +``` + +#### Ingress traffic + +Ingress traffic is only allowed from the internal networks if specified. To specify the address where the Service Type LoadBalancer is listening to, the cluster user must use one of his statically acquired ip addresses. Of course, this ip address is only considered if it is contained in the list of allowed networks. Then this ip address must be configured in the service: + +```yaml +apiVersion: v1 +kind: Service +spec: + type: LoadBalancer + loadBalancerIP: 10.1.1.1 # ip from the internal network +``` + +By default, no ip address will be automatically selected for such clusters and the ip of the service will stay in pending mode until the ip was specified as shown above. + +```bash +> kubectl get svc +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +example-service LoadBalancer 10.244.75.171 443:32179/TCP 4s + +> kubectl get events +8s Warning AllocationFailed service/example-service Failed to allocate IP for "default/example-service": no available IPs +3s Warning SyncLoadBalancerFailed service/example-service Error syncing load balancer: failed to ensure load balancer: no default network for ip acquisition specified, acquire an ip for your cluster's project and specify it directly in "spec.loadBalancerIP" +``` + +### Internet Access Restricted + +This configuration can only be achieved by creating a new Kubernetes cluster, it is not possible to modify a existing cluster (with internet access `baseline` or `forbidden`) to this configuration. It is also required to specify the most recent version of Kubernetes, older versions of Kubernetes are not supported. + +The same default CWNPs are deployed and the container images are pulled from the private registry. Also DNS and NTP are configured to use the private DNS and NTP servers. +The only difference to the `forbidden` mode is that CWNPs and Service Type LoadBalancers can be created without the restriction that only allowed networks are allowed. + +Pulling container images is theoretically possible if a cluster user creates a CWNP which allows network access to an external registry. But most container registries serve the container images from large CDN networks, which have a lot of ip addresses. Simply adding the ip address of docker.io is therefore not sufficient. + +## Application Container Images + +In order to deploy application containers into a cluster with Internet Access `forbidden` a private registry must be provided. This private registry must be located in the list of allowed networks. +The DNS name of the registry must resolve in the public DNS servers. The registry must be secured with a TLS certificate that is also valid with the CA certificates from the worker node, e.g. vanilla debian ca-certificates. + +## Implementation + +To achieve this functionality modifications have been implemented in various components in metal-stack, this includes: + +### Gardener Extension Provider Metal + +The ControlPlane API is adopted to enable a user to configure a shoot with the internet access type `forbidden` or `restricted`. The CloudProfile can now be extended to carry the list of allowed networks, the dns and ntp servers, the registry with the mirrored registries. + +ControlPlane: + +```go +// ControlPlaneConfig contains configuration settings for the control plane. +type ControlPlaneConfig struct { + metav1.TypeMeta + + // NetworkAccessType defines how the cluster can reach external networks. + // +optional + NetworkAccessType *NetworkAccessType +} +type ( + // NetworkAccessType defines how a cluster is capable of accessing external networks + NetworkAccessType string +) + +const ( + // NetworkAccessBaseline allows the cluster to access external networks in a baseline manner + NetworkAccessBaseline = NetworkAccessType("baseline") + // NetworkAccessRestricted access to external networks is by default restricted to registries, dns and ntp to partition only destinations. + // Therefore registries, dns and ntp destinations must be specified in the cloud-profile accordingly. + // If this is not the case, restricting the access must not be possible. + // Image overrides for all images which are required to create such a shoot, must be specified. No other images are provided in the given registry. + // customers can define own rules to access external networks as in the baseline. + // Service type LoadBalancers are also not restricted. + NetworkAccessRestricted = NetworkAccessType("restricted") + // NetworkAccessForbidden in this configuration a customer can no longer create rules to access external networks. + // which are outside of a given list of allowed networks. This is enforced by the firewall. + // Service type LoadBalancers are also not possible to open a service ip which is not in the list of allowed networks. + // This is also enforced by the firewall. + NetworkAccessForbidden = NetworkAccessType("forbidden") +) +``` + +A sample Shoot Spec: + +```yaml +--- +apiVersion: core.gardener.cloud/v1beta1 +kind: Shoot +metadata: + name: isolated + namespace: sample +spec: + provider: + type: metal + controlPlaneConfig: + networkAccessType: forbidden +... +``` + +CloudProfile: + +```go +type NetworkIsolation struct { + // AllowedNetworks is a list of networks which are allowed to connect in restricted or forbidden NetworkIsolated clusters. + AllowedNetworks AllowedNetworks + // DNSServers + DNSServers []string + // NTPServers + NTPServers []string + // The registry which serves the images required to create a shoot. + RegistryMirrors []RegistryMirror +} + +// AllowedNetworks is a list of networks which are allowed to connect in restricted or forbidden NetworkIsolated clusters. +type AllowedNetworks struct { + // Ingress defines a list of networks which are allowed for incoming traffic like service type LoadBalancer + // to allow all you must specify 0.0.0.0/0 or ::/0 + Ingress []string + // Egress defines a list of networks which are allowed for outgoing traffic + // to allow all you must specify 0.0.0.0/0 or ::/0 + Egress []string +} + +type RegistryMirror struct { + // Name describes this server + Name string + // Endpoint is typically the url of the registry in the form https://hostname + Endpoint string + // IP is the ipv4 or ipv6 address of this server + IP string + // Port at which port the service is reachable + Port int32 + // This Registry Mirror mirrors the following registries + MirrorOf []string +} +``` + +A sample configuration in the CloudProfile would look like: + +```yaml + network-isolation: + allowedNetworks: + egress: + - 1.2.3.0/24 # Internet CIDR of the Provider + - 100.64.0.0/10 + - 10.0.0.0/8 + ingress: + - 100.64.0.0/10 + dnsServers: + - "1.2.3.1" + - "1.2.3.2" + - "1.2.3.3" + ntpServers: + - "1.2.3.1" + - "1.2.3.2" + - "1.2.3.3" + registryMirrors: + - name: test registry + endpoint: https://some.private.registry + ip: "1.2.3.4" + port: 443 + mirrorOf: + - "docker.io" + - "quay.io" + - "eu.gcr.io" + - "ghcr.io" + - "registry.k8s.io" +``` + +The GEPM generates machine classes for the MCM that contain the NTP and DNS configuration for the machine. The machine-controller-manager-provider-metal implements machine creation containing these properties through the metal-api. + +### OS Metal Extension + +Based on the configuration of a cluster the configuration of the containerd must be changed to pull images from the private registry mirror. + +If a cluster is either configured with `restricted` or `forbidden` and for every registry mirror an additional `certs.d/$HOST/hosts.yaml` will be created. This is in line with [Gardener's containerd Registry Configuration](https://gardener.cloud/docs/gardener/advanced/containerd-registry-configuration/). + +```toml +# certs.d/docker.io/hosts.yaml + +server = "https://docker.io" +[host."https://some.private.registry"] + capabilities = ["pull", "resolve"] +``` + +### Firewall Controller Manager and Firewall Controller + +The Firewall Controller Manager has extended the FirewallSpec to configure the Firewall Controller which must enforce the restrictions regarding allowed networks. + +```go +// FirewallSpec defines parameters for the firewall creation along with configuration for the firewall-controller. +type FirewallSpec struct { + // AllowedNetworks defines which networks are allowed to connect to, and allow incoming traffic from. + // Is enforced with NetworkAccessForbidden. + // The node network is always allowed. + AllowedNetworks AllowedNetworks `json:"allowedNetworks,omitempty"` +} + +// AllowedNetworks is a list of networks which are allowed to connect when NetworkAccessType is NetworkAccessForbidden. +type AllowedNetworks struct { + // Ingress defines a list of cidrs which are allowed for incoming traffic like service type LoadBalancer + Ingress []string `json:"ingress,omitempty"` + // Egress defines a list of cidrs which are allowed for outgoing traffic + Egress []string `json:"egress,omitempty"` +} +``` + +Also the ClusterwideNetworkPolicy in the Firewall Controller was changed to show the deployment status of a CWNP. + +```go + +type ClusterwideNetworkPolicy struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec PolicySpec `json:"spec,omitempty"` + Status PolicyStatus `json:"status,omitempty"` +} + +// PolicyDeploymentState describes the state of a CWNP deployment +type PolicyDeploymentState string + +const ( + // PolicyDeploymentStateDeployed the CWNP was deployed to a native nftable rule + PolicyDeploymentStateDeployed = PolicyDeploymentState("deployed") + // PolicyDeploymentStateIgnored the CWNP was not deployed to a native nftable rule because it is outside of the allowed networks + PolicyDeploymentStateIgnored = PolicyDeploymentState("ignored") +) + +// PolicyStatus defines the observed state for CWNP resource +type PolicyStatus struct { + // FQDNState stores mapping from FQDN rules to nftables sets used for a firewall rule. + // Key is either MatchName or MatchPattern + // +optional + FQDNState FQDNState `json:"fqdn_state,omitempty"` + // State of the CWNP, can be either deployed or ignored + State PolicyDeploymentState `json:"state"` + // Message describe why the state changed + Message string `json:"message,omitempty"` +} +``` + +### Cloud Controller Manager + +This component was adopted to allow to be started without a default network specified. This was actually always the internet network and if no ip address was specified in the Service Type LoadBalancer, one ip was allocated from this default network. For isolated clusters this is not provided and a cluster user must always specify this ip to get a working load balancer. + +### OCI Mirror + +The [OCI Mirror](https://github.com/metal-stack/oci-mirror) is a new application which acts as a scheduled job that pulls a given list of container images and pushes them to a private registry (which will then serve as the private registry mirror). The detailed description can be read on the project website. + +## Related Pull Requests + +- [Gardener Extension Provider](https://github.com/metal-stack/gardener-extension-provider-metal/pull/361) +- [Firewall Controller Manager](https://github.com/metal-stack/firewall-controller-manager/pull/48) +- [Firewall Controller](https://github.com/metal-stack/firewall-controller/pull/172) +- [OS Metal Extension](https://github.com/metal-stack/os-metal-extension/pull/38) +- [Metal Cloud Controller Manager](https://github.com/metal-stack/metal-ccm/pull/87) +- [Metal Networker](https://github.com/metal-stack/metal-networker/pull/101) +- [Metal Images](https://github.com/metal-stack/metal-images/pull/214) +- [OCI Mirror](https://github.com/metal-stack/oci-mirror) diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/06-gpu-workers.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/06-gpu-workers.md new file mode 100644 index 0000000..c7ee345 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/06-gpu-workers.md @@ -0,0 +1,64 @@ +--- +slug: /gpu-workers +title: GPU Workers +sidebar_position: 6 +--- + +# GPU Workers + +For workloads which require the assistance of GPUs, support for GPUs in bare metal servers was added to metal-stack.io v0.18.0. + +## GPU Operator installation + +With the nvidia image a worker has basic GPU support. This means that the required kernel driver, the containerd shim and the required containerd configuration are already installed and configured. + +To enable `Pods` that require GPU support to be scheduled on a worker node with a GPU, a `gpu-operator' must be installed. +This has to be done by the cluster owner after the cluster is up and running. + +The simplest way to install this operator is as follows: + +```bash +helm repo add nvidia https://helm.ngc.nvidia.com/nvidia +helm repo update + +kubectl create ns gpu-operator +kubectl label --overwrite ns gpu-operator pod-security.kubernetes.io/enforce=privileged + +helm install --wait \ + --generate-name \ + --namespace gpu-operator \ + --create-namespace \ + nvidia/gpu-operator \ + --set driver.enabled=false \ + --set toolkit.enabled=true +``` + +After that `kubectl describe node` must show the gpu in the capacity like so: + +```plain +... +Capacity: + cpu: 64 + ephemeral-storage: 100205640Ki + hugepages-1Gi: 0 + hugepages-2Mi: 0 + memory: 263802860Ki + nvidia.com/gpu: 1 + pods: 510 +... +``` + +With this basic installation, the worker node is ready to process GPU workloads. + +:::warning +However, there is a caveat - only one 'Pod' can access the GPU. If this is all you need, no additional configuration is required. +On the other hand, if you are planning to deploy multiple applications that require GPU support, and there are not that many GPUs available, you will need to configure the `gpu-operator` to allow the GPU to be shared between multiple `Pods`. +::: + +There are several approaches to sharing GPUs, please consult the official Nvidia documentation for further reference. + +- [https://developer.nvidia.com/blog/improving-gpu-utilization-in-kubernetes](https://developer.nvidia.com/blog/improving-gpu-utilization-in-kubernetes) +- [https://docs.nvidia.com/datacenter/cloud-native/gpu-operator/latest/gpu-operator-mig.html](https://docs.nvidia.com/datacenter/cloud-native/gpu-operator/latest/gpu-operator-mig.html) +- [https://docs.nvidia.com/datacenter/cloud-native/gpu-operator/latest/gpu-sharing.html](https://docs.nvidia.com/datacenter/cloud-native/gpu-operator/latest/gpu-sharing.html) + +With this, happy AI processing. diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/07-storage.md b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/07-storage.md new file mode 100644 index 0000000..9573f00 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/07-storage.md @@ -0,0 +1,45 @@ +--- +slug: /storage +title: Storage +sidebar_position: 7 +--- + +# Storage + +When working with bare-metal servers, providing cloud storage is a challenge. With physical machines there is no opportunity that a hypervisor can mount storage devices into the servers and thus, we have to implement other mechanisms that are capable of dynamically mounting storage onto the machines. + +In the meantime, we have started to integrate third-party solutions into our metal-stack landscape. They help us to provide modern, well-integrated and scalable storage solutions to our end-users. + +## Lightbits Labs NVMe over TCP Storage Integration + +[Lightbits Labs](https://www.lightbitslabs.com/nvme-over-tcp/) offers a proprietary implementation of persistent storage using NVMe over TCP. The solution has some very superior traits that fit very well to metal-stack. The strongest advantages are: + +- High performance +- Built-in multi-tenant capabilities +- Configurable compression and replication factors + +We are maintaining an open source integration for running LightOS in our [Gardener](./01-gardener.md) cluster provisioning. You can enable it through the controller registration of the [gardener-extension-provider-metal](https://github.com/metal-stack/gardener-extension-provider-metal). + +With the integration in place, the extension-provider deploys a [duros-controller](https://github.com/metal-stack/duros-controller) along with a Duros Storage CRD into the seed's shoot namespace. The duros-controller takes care of creating projects and managing credentials at the Lightbits Duros API. It also provides storage classes as configured in the extension-provider's controller registration to the customer's shoot cluster such that users can start consuming the Lightbits storage immediately. + +## Simple Node Local Storage with csi-driver-lvm + +If you wish to quickly start off with cluster provisioning without caring so much about complex cloud storage solutions, we recommend using a small storage driver we wrote called [csi-driver-lvm](https://github.com/metal-stack/csi-driver-lvm). It provides a storage class that manages node-local storage through [LVM](). + +A definition of a PVC can look like this: + +```yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: csi-pvc +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 100Mi + storageClassName: csi-driver-lvm-linear +``` + +The solution does not provide cloud-storage or whatsoever, but it improves the user's accessibility of local storage on bare-metal machines through Kubernetes. Check out the driver's documentation [here](../../08-References/Storage/csi-driver-lvm/csi-driver-lvm.md). diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/isolated-kubernetes.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/isolated-kubernetes.drawio new file mode 100644 index 0000000..a34a14d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/isolated-kubernetes.drawio @@ -0,0 +1,284 @@ + + + + + + + + +
+
+
+ Isolated Cluster +
+
+
+ + + Isolated Cluster + + + + + + + +
+
+
+ Firewall +
+
+
+ + + Firewall + + + + + + + +
+
+
+ Service Type Loadbalancer +
+
+
+ + + Service Type Load... + + + + + + + + +
+
+
+ Pod +
+
+
+ + + Pod + + + + + + + +
+
+
+ Pod +
+
+
+ + + Pod + + + + + + + + + + +
+
+
+ CWNP +
+
+
+ + + CWNP + + + + + + + +
+
+
+ Infrastructure Cluster +
+
+
+ + + Infrastructure Cluster + + + + + + + +
+
+
+ NTP Server +
+
+
+ + + NTP Server + + + + + + + +
+
+
+ DNS Server +
+
+
+ + + DNS Server + + + + + + + +
+
+
+ Registry Mirror +
+
+
+ + + Registry Mirror + + + + + + + +
+
+
+ Firewall +
+
+
+ + + Firewall + + + + + + + + + + +
+
+
+ Ingress-Controller +
+
+
+ + + Ingress-Controller + + + + + + + +
+
+
+ + Internet + +
+
+
+ + + Internet + + + + + + + +
+
+
+ + Private Network + +
+
+
+ + + Private Network + + + + + + + + + + +
+
+
+ Private Registry +
+
+
+ + + Private Registry + + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/isolated-kubernetes.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/isolated-kubernetes.svg new file mode 100644 index 0000000..cbe9484 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/04-Kubernetes/isolated-kubernetes.svg @@ -0,0 +1 @@ +
Isolated Cluster
Isolated Cluster
Firewall
Firewall
Service Type Loadbalancer
Service Type Load...
Pod
Pod
Pod
Pod
CWNP
CWNP
Infrastructure Cluster
Infrastructure Cluster
NTP Server
NTP Server
DNS Server
DNS Server
Registry Mirror
Registry Mirror
Firewall
Firewall
Ingress-Controller
Ingress-Controller
Internet
Internet
Private Network
Private Network
Private Registry
Private RegistryText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/2-layer-leaf-spine.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/2-layer-leaf-spine.svg new file mode 100644 index 0000000..5f32cdb --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/2-layer-leaf-spine.svg @@ -0,0 +1 @@ +
Spine 1
Spine 1
Spine 2
Spine 2
Leaf 2
Leaf 2
Leaf 1
Leaf 1Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/3-layer-leaf-spine.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/3-layer-leaf-spine.svg new file mode 100644 index 0000000..c460698 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/3-layer-leaf-spine.svg @@ -0,0 +1 @@ +
Spine 1
Spine 1
Spine 2
Spine 2
Leaf 2
Leaf 2
Leaf 1
Leaf 1
Machine 2
Machine 2
Machine 1
Machine 1Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/evpn-vtep.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/evpn-vtep.svg new file mode 100644 index 0000000..27493d8 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/evpn-vtep.svg @@ -0,0 +1 @@ +
leaf 1
leaf 1
«VLAN aware»
Bridge
«VLAN aware»...
lo: 10.0.0.41
lo: 10.0.0.41
vrf 104001
vrf 104001
«SVI»
vlan4001
«SVI»...
swp1
swp1
vni104001

VXLAN-Interface
VTEP-Endpoint: 10.0.0.41
vni104001...
Device 1
Device 1Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/isolated-kubernetes.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/isolated-kubernetes.drawio new file mode 100644 index 0000000..a34a14d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/isolated-kubernetes.drawio @@ -0,0 +1,284 @@ + + + + + + + + +
+
+
+ Isolated Cluster +
+
+
+ + + Isolated Cluster + + + + + + + +
+
+
+ Firewall +
+
+
+ + + Firewall + + + + + + + +
+
+
+ Service Type Loadbalancer +
+
+
+ + + Service Type Load... + + + + + + + + +
+
+
+ Pod +
+
+
+ + + Pod + + + + + + + +
+
+
+ Pod +
+
+
+ + + Pod + + + + + + + + + + +
+
+
+ CWNP +
+
+
+ + + CWNP + + + + + + + +
+
+
+ Infrastructure Cluster +
+
+
+ + + Infrastructure Cluster + + + + + + + +
+
+
+ NTP Server +
+
+
+ + + NTP Server + + + + + + + +
+
+
+ DNS Server +
+
+
+ + + DNS Server + + + + + + + +
+
+
+ Registry Mirror +
+
+
+ + + Registry Mirror + + + + + + + +
+
+
+ Firewall +
+
+
+ + + Firewall + + + + + + + + + + +
+
+
+ Ingress-Controller +
+
+
+ + + Ingress-Controller + + + + + + + +
+
+
+ + Internet + +
+
+
+ + + Internet + + + + + + + +
+
+
+ + Private Network + +
+
+
+ + + Private Network + + + + + + + + + + +
+
+
+ Private Registry +
+
+
+ + + Private Registry + + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/isolated-kubernetes.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/isolated-kubernetes.svg new file mode 100644 index 0000000..cbe9484 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/isolated-kubernetes.svg @@ -0,0 +1 @@ +
Isolated Cluster
Isolated Cluster
Firewall
Firewall
Service Type Loadbalancer
Service Type Load...
Pod
Pod
Pod
Pod
CWNP
CWNP
Infrastructure Cluster
Infrastructure Cluster
NTP Server
NTP Server
DNS Server
DNS Server
Registry Mirror
Registry Mirror
Firewall
Firewall
Ingress-Controller
Ingress-Controller
Internet
Internet
Private Network
Private Network
Private Registry
Private RegistryText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-architecture.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-architecture.drawio new file mode 100644 index 0000000..5bfbec8 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-architecture.drawio @@ -0,0 +1,1103 @@ + + + + + + + + +
+
+
+ Clients +
+
+
+ + + Clients + + + + + + + +
+
+
+ metalctl +
+
+
+ + + metalctl + + + + + + + +
+
+
+ metal-go +
+
+
+ + + metal-go + + + + + + + +
+
+
+ metal-python +
+
+
+ + + metal-python + + + + + + +
+
+
+ CLI +
+
+
+ + + CLI + + + + + + +
+
+
+ Libraries +
+
+
+ + + Libraries + + + + + + + + + + + + + + + +
+
+
+ Console Access +
+
+
+ + + Console Access + + + + + + + +
+
+
+ ssh +
+
+
+ + + ssh + + + + + + + + +
+
+
+ Switch Plane +
+
+
+ + + Switch Plane + + + + + + + +
+
+
+ mgmtspine01 +
+
+
+ + + mgmtspine01 + + + + + + + +
+
+
+ mgmtspine02 +
+
+
+ + + mgmtspine02 + + + + + + + +
+
+
+ mgmtleaf01 +
+
+
+ + + mgmtleaf01 + + + + + + + +
+
+
+ mgmtleaf02 +
+
+
+ + + mgmtleaf02 + + + + + + + + + + + +
+
+
+ exit01 +
+
+
+ + + exit01 + + + + + + + +
+
+
+ exit02 +
+
+
+ + + exit02 + + + + + + + +
+
+
+ spine01 +
+
+
+ + + spine01 + + + + + + + +
+
+
+ spine02 +
+
+
+ + + spine02 + + + + + + + + + + + + + + + + +
+
+
+ leaf01 +
+
+
+ + + leaf01 + + + + + + +
+
+
+ leaf02 +
+
+
+ + + leaf02 + + + + + + + +
+
+
+ metal-core +
+
+
+ + + metal-core + + + + + + + +
+
+
+ metal-core +
+
+
+ + + metal-core + + + + + + + + + + + + + + + + + + + +
+
+
+ mgmtfirewall +
+
+
+ + + mgmtfirewall + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ Server +
+ Pool +
+
+
+ + + Server... + + + + + + + + +
+
+
+ + Management Server 01/02 + +
+
+
+ + + Management Server 01/02 + + + + + + + + +
+
+
+ metal-cache-image-sync +
+
+
+ + + metal-cache-image-sync + + + + + + + +
+
+
+ CoreDNS +
+
+
+ + + CoreDNS + + + + + + + + + +
+
+
+ HAProxy +
+
+
+ + + HAProxy + + + + + + +
+
+
+ Image Cache +
+
+
+ + + Image Cache + + + + + + + +
+
+
+ metal-bmc +
+
+
+ + + metal-bmc + + + + + + + + + +
+
+
+ metal-hammer +
+
+
+ + + metal-hammer + + + + + + + + + +
+
+
+ User OS +
+
+
+ + + User OS + + + + + + +
+
+
+ Metal Partition +
+
+
+ + + Metal Partition + + + + + + + + + + + + + + + + + + + + +
+
+
+ pixiecore +
+
+
+ + + pixiecore + + + + + + + + + + + +
+
+
+ Metal Control Plane +
+
+
+ + + Metal Control Plane + + + + + + + + + + + + + + + + + + + + + +
+
+
+ metal-api +
+
+
+ + + metal-api + + + + + + + + + +
+
+
+ masterdata-api +
+
+
+ + + masterdata-api + + + + + + + + + + +
+
+
+ postgres +
+
+
+ + + postgres + + + + + + + + + +
+
+
+ backup-restore-sidecar +
+
+
+ + + backup-restore-sidecar + + + + + + +
+
+
+ masterdata-db +
+
+
+ + + masterdata-db + + + + + + + + +
+
+
+ nsqd +
+
+
+ + + nsqd + + + + + + + + + +
+
+
+ metal-console +
+
+
+ + + metal-console + + + + + + + + + +
+
+
+ rethinkDB +
+
+
+ + + rethinkDB + + + + + + + +
+
+
+ backup-restore-sidecar +
+
+
+ + + backup-restore-sidecar + + + + + + +
+
+
+ metal-db +
+
+
+ + + metal-db + + + + + + + + + +
+
+
+ postgres +
+
+
+ + + postgres + + + + + + + +
+
+
+ backup-restore-sidecar +
+
+
+ + + backup-restore-sidecar + + + + + + +
+
+
+ ipam-db +
+
+
+ + + ipam-db + + + + + + + +
+
+
+ Ingress-Controller (NGINX) +
+
+
+ + + Ingress-Controller (NGINX) + + + + + + + + + +
+
+
+ + meilisearch + +
+
+
+ + + meilisear... + + + + + + + +
+
+
+ backup-restore-sidecar +
+
+
+ + + backup-restore-sidecar + + + + + + +
+
+
+ auditing +
+
+
+ + + auditing + + + + + + + + + + + + + + + +
+
+
+ ipam +
+
+
+ + + ipam + + + + + + + + + + + + + +
+
+
+ CI +
+
+
+ + + CI + + + + + + + + + + +
+
+
+ GCP Buckets +
+
+
+ + + GCP Buckets + + + + + + + + + + + + +
+
+
+ OS Images +
+
+
+ + + OS Images + + + + + + + +
+
+
+ + ISP + +
+
+
+ + + ISP + + + + + + + + + + Text is not SVG - cannot display + + + + diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-architecture.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-architecture.svg new file mode 100644 index 0000000..b49447f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-architecture.svg @@ -0,0 +1 @@ +
Clients
Clients
metalctl
metalctl
metal-go
metal-go
metal-python
metal-python
CLI
CLI
Libraries
Libraries
Console Access
Console Access
ssh
ssh
Switch Plane
Switch Plane
mgmtspine01
mgmtspine01
mgmtspine02
mgmtspine02
mgmtleaf01
mgmtleaf01
mgmtleaf02
mgmtleaf02
exit01
exit01
exit02
exit02
spine01
spine01
spine02
spine02
leaf01
leaf01
leaf02
leaf02
metal-core
metal-core
metal-core
metal-core
mgmtfirewall
mgmtfirewall
Server
Pool
Server...
Management Server 01/02
Management Server 01/02
metal-cache-image-sync
metal-cache-image-sync
CoreDNS
CoreDNS
HAProxy
HAProxy
Image Cache
Image Cache
metal-bmc
metal-bmc
metal-hammer
metal-hammer
User OS
User OS
Metal Partition
Metal Partition
pixiecore
pixiecore
Metal Control Plane
Metal Control Plane
metal-api
metal-api
masterdata-api
masterdata-api
postgres
postgres
backup-restore-sidecar
backup-restore-sidecar
masterdata-db
masterdata-db
nsqd
nsqd
metal-console
metal-console
rethinkDB
rethinkDB
backup-restore-sidecar
backup-restore-sidecar
metal-db
metal-db
postgres
postgres
backup-restore-sidecar
backup-restore-sidecar
ipam-db
ipam-db
Ingress-Controller (NGINX)
Ingress-Controller (NGINX)
meilisearch
meilisear...
backup-restore-sidecar
backup-restore-sidecar
auditing
auditing
ipam
ipam
CI
CI
GCP Buckets
GCP Buckets
OS Images
OS Images
ISP
ISPText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-control-plane.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-control-plane.svg new file mode 100644 index 0000000..782d382 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-control-plane.svg @@ -0,0 +1 @@ +
Metal Control Plane
Metal Control Plane
metal-api
metal-api
masterdata-api
masterdata-api
postgres
postgres
backup-restore-sidecar
backup-restore-sidecar
masterdata-db
masterdata-db
nsqd
nsqd
metal-console
metal-console
rethinkDB
rethinkDB
backup-restore-sidecar
backup-restore-sidecar
metal-db
metal-db
postgres
postgres
backup-restore-sidecar
backup-restore-sidecar
ipam-db
ipam-db
Ingress-Controller (NGINX)
Ingress-Controller (NGINX)
meilisearch
meilisear...
backup-restore-sidecar
backup-restore-sidecar
auditing
auditing
ipam
ipamText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-partition.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-partition.svg new file mode 100644 index 0000000..76bea47 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/metal-stack-partition.svg @@ -0,0 +1 @@ +
Switch Plane
Switch Plane
mgmtspine01
mgmtspine01
mgmtspine02
mgmtspine02
mgmtleaf01
mgmtleaf01
mgmtleaf02
mgmtleaf02
exit01
exit01
exit02
exit02
spine01
spine01
spine02
spine02
leaf01
leaf01
leaf02
leaf02
metal-core
metal-core
metal-core
metal-core
mgmtfirewall
mgmtfirewall
Server
Pool
Server...
Management Server 01/02
Management Server 01/02
metal-cache-image-sync
metal-cache-image-sync
CoreDNS
CoreDNS
HAProxy
HAProxy
Image Cache
Image Cache
metal-bmc
metal-bmc
metal-hammer
metal-hammer
User OS
User OS
Metal Partition
Metal Partition
pixiecore
pixiecoreText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-physical-wiring.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-physical-wiring.drawio new file mode 100644 index 0000000..de80b9b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-physical-wiring.drawio @@ -0,0 +1,510 @@ + + + + + + + + + + + + + +
+
+
+ Leaf Layer +
+
+
+ + + Leaf La... + + + + + + + +
+
+
+ Spine Layer +
+
+
+ + + Spine L... + + + + + + + + + +
+
+
+ Server Layer +
+
+
+ + + Server... + + + + + + + + + +
+
+
+ Leaf 1 +
+
+
+ + + Leaf 1 + + + + + + + +
+
+
+ Firewalls +
+ and +
+ Machines +
+
+
+ + + Firewalls... + + + + + + + + + +
+
+
+ Leaf 2 +
+
+
+ + + Leaf 2 + + + + + + + + + +
+
+
+ Spine 1 +
+
+
+ + + Spine 1 + + + + + + + + +
+
+
+ Exit 1 +
+
+
+ + + Exit 1 + + + + + + + + + + + +
+
+
+ Leaf 3 +
+
+
+ + + Leaf 3 + + + + + + + +
+
+
+ Firewalls +
+ and +
+ Machines +
+
+
+ + + Firewalls... + + + + + + + + + +
+
+
+ Leaf 4 +
+
+
+ + + Leaf 4 + + + + + + + + + +
+
+
+ Spine 2 +
+
+
+ + + Spine 2 + + + + + + + + +
+
+
+ Exit 1 +
+
+
+ + + Exit 1 + + + + + + + +
+
+
+ + External +
+ Networks + +
+
+
+ + + External... + + + + + + + +
+
+
+ Exit Layer +
+
+
+ + + Exit La... + + + + + + + + + +
+
+
+ Management Leaf 1 +
+
+
+ + + Management Le... + + + + + + + + +
+
+
+ Management Leaf 2 +
+
+
+ + + Management Le... + + + + + + + + +
+
+
+ Management Spine 1 +
+
+
+ + + Management Sp... + + + + + + + + + +
+
+
+ Management Spine 2 +
+
+
+ + + Management Sp... + + + + + + + + +
+
+
+ Management Firewall 1 +
+
+
+ + + Management Fi... + + + + + + + + +
+
+
+ Management Firewall 2 +
+
+
+ + + Management Fi... + + + + + + + +
+
+
+ + metal-stack +
+ Control Plane + +
+
+
+ + + metal-stack... + + + + + + + + + +
+
+
+ Management Server 1 +
+
+
+ + + Management Se... + + + + + + + + +
+
+
+ Management Server 2 +
+
+
+ + + Management Se... + + + + + + + +
+
+
+ Server BMCs +
+
+
+ + + Server BMCs + + + + + + + + + +
+
+
+ Switch +
+ Administration +
+
+
+ + + Switch... + + + + + + + + + Text is not SVG - cannot display + + + + diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-physical-wiring.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-physical-wiring.svg new file mode 100644 index 0000000..337b3a9 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-physical-wiring.svg @@ -0,0 +1 @@ +
Leaf Layer
Leaf La...
Spine Layer
Spine L...
Server Layer
Server...
Leaf 1
Leaf 1
Firewalls
and
Machines
Firewalls...
Leaf 2
Leaf 2
Spine 1
Spine 1
Exit 1
Exit 1
Leaf 3
Leaf 3
Firewalls
and
Machines
Firewalls...
Leaf 4
Leaf 4
Spine 2
Spine 2
Exit 1
Exit 1
External
Networks
External...
Exit Layer
Exit La...
Management Leaf 1
Management Le...
Management Leaf 2
Management Le...
Management Spine 1
Management Sp...
Management Spine 2
Management Sp...
Management Firewall 1
Management Fi...
Management Firewall 2
Management Fi...
metal-stack
Control Plane
metal-stack...
Management Server 1
Management Se...
Management Server 2
Management Se...
Server BMCs
Server BMCs
Switch
Administration
Switch...Text is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-vrfs.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-vrfs.drawio new file mode 100644 index 0000000..a274bb0 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-vrfs.drawio @@ -0,0 +1,496 @@ + + + + + + + + + + + + +
+
+
+ Leaf Layer +
+
+
+ + + Leaf La... + + + + + + + +
+
+
+ Spine Layer +
+
+
+ + + Spine L... + + + + + + + +
+
+
+ Exit Layer +
+
+
+ + + Exit La... + + + + + + + +
+
+
+ Server Layer +
+
+
+ + + Server... + + + + + + + + + +
+
+
+ Internet Pod +
+
+
+ + + Internet Pod + + + + + + + +
+
+
+ Data Center Pod +
+
+
+ + + Data Center Pod + + + + + + + +
+
+
+ Internet VRF +
+
+
+ + + Internet VRF + + + + + + + +
+
+
+ DC VRF +
+
+
+ + + DC VRF + + + + + + + +
+
+
+ + Firewall Tenant 1 + +
+
+
+ + + Firewall Tenant 1 + + + + + + + +
+
+
+ Internet VRF +
+
+
+ + + Internet VRF + + + + + + + +
+
+
+ Tenant 1 VRF +
+
+
+ + + Tenant 1 VRF + + + + + + + + +
+
+
+ Machine +
+ Tenant 1 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 1 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 1 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 2 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 2 +
+
+
+ + + Machine... + + + + + + + + +
+
+
+ Machine +
+ Tenant 2 +
+
+
+ + + Machine... + + + + + + + +
+
+
+ + VXLAN + +
+
+
+ + + VXLAN + + + + + + + +
+
+
+ Tenant 1 VRF +
+
+
+ + + Tenant 1 VRF + + + + + + + +
+
+
+ VXLAN +
+
+
+ + + VXLAN + + + + + + + +
+
+
+ Tenant 2 VRF +
+
+
+ + + Tenant 2 VRF + + + + + + + + + + + + + +
+
+
+ Firewall Tenant 2 +
+
+
+ + + Firewall Tenant 2 + + + + + + + +
+
+
+ Tenant 2 VRF +
+
+
+ + + Tenant 2 VRF + + + + + + + +
+
+
+ DC VRF +
+
+
+ + + DC VRF + + + + + + + + + + + + + +
+
+
+ VXLAN +
+
+
+ + + VXLAN + + + + + + + +
+
+
+ VXLAN +
+
+
+ + + VXLAN + + + + + + + + + Text is not SVG - cannot display + + + + diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-vrfs.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-vrfs.svg new file mode 100644 index 0000000..d72378c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/network-vrfs.svg @@ -0,0 +1 @@ +
Leaf Layer
Leaf La...
Spine Layer
Spine L...
Exit Layer
Exit La...
Server Layer
Server...
Internet Pod
Internet Pod
Data Center Pod
Data Center Pod
Internet VRF
Internet VRF
DC VRF
DC VRF
Firewall Tenant 1
Firewall Tenant 1
Internet VRF
Internet VRF
Tenant 1 VRF
Tenant 1 VRF
Machine
Tenant 1
Machine...
Machine
Tenant 1
Machine...
Machine
Tenant 1
Machine...
Machine
Tenant 2
Machine...
Machine
Tenant 2
Machine...
Machine
Tenant 2
Machine...
VXLAN
VXLAN
Tenant 1 VRF
Tenant 1 VRF
VXLAN
VXLAN
Tenant 2 VRF
Tenant 2 VRF
Firewall Tenant 2
Firewall Tenant 2
Tenant 2 VRF
Tenant 2 VRF
DC VRF
DC VRF
VXLAN
VXLAN
VXLAN
VXLANText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/provisioning_sequence.drawio b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/provisioning_sequence.drawio new file mode 100644 index 0000000..960760a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/provisioning_sequence.drawio @@ -0,0 +1,1141 @@ + + + + + + + + + + + + + + + + + + + +
+
+
+ install +
+
+
+ + + install + + + + + + + + + + + + + +
+
+
+ wait +
+
+
+ + + wait + + + + + + + + + + + + + + + + +
+
+
+ register +
+
+
+ + + register + + + + + + + + + + + + + +
+
+
+ done +
+
+
+ + + done + + + + + + + + + + + + + +
+
+
+ prepare +
+
+
+ + + prepare + + + + + + + + + + + + + +
+
+
+ pxe +
+
+
+ + + pxe + + + + + + + + + + + + +
+
+
+ switch +
+
+
+ + + switch + + + + + + + + + + + + +
+
+
+ metal-api +
+
+
+ + + metal-api + + + + + + + + + + + + + + + +
+
+
+ success +
+
+
+ + + success + + + + + + + + + + + + + + + + + + +
+
+
+ allocate +
+
+
+ + + allocate + + + + + + + + + + + + +
+
+
+ set allocatable flag +
+ to true +
+
+
+ + + set allocatable... + + + + + + + + + + + + +
+
+
+ select machine candidate +
+
+
+ + + select machine... + + + + + + + + + + + + +
+
+
+ pixiecore +
+
+
+ + + pixiecore + + + + + + + + + + + + + + + + + + +
+
+
+ metal-core +
+
+
+ + + metal-core + + + + + + + + + + + + + + + +
+
+
+ reconcile network +
+
+
+ + + reconcile network + + + + + + + + + + + + +
+
+
+ metal-hammer +
+
+
+ + + metal-hammer + + + + + + + + + + + + +
+
+
+ download and burn target os image +
+
+
+ + + download and bu... + + + + + + + + + + + + +
+
+
+ run image install.sh and ignition +
+
+
+ + + run image insta... + + + + + + + + + + + + +
+
+
+ report install success, finalize machine allocation +
+
+
+ + + report install... + + + + + + + + + + + + +
+
+
+ use +
+
+
+ + + use + + + + + + + + + + + + +
+
+
+ prepare metal-api +
+ + + connection over gRPC + + +
+
+
+
+ + + prepare metal-a... + + + + + + + + + + + + +
+
+
+ machine +
+
+
+ + + machine + + + + + + + + + + + + + + + +
+
+
+ + + booting + + +
+ + + metal-hammer + + +
+
+
+
+ + + booting... + + + + + + + + + + + + + + + +
+
+
+ machine pxe boot event +
+
+
+ + + machine pxe boo... + + + + + + + + + + + + +
+
+
+ discovery image url +
+
+
+ + + discovery image url + + + + + + + + + + + + +
+
+
+ request boot image +
+
+
+ + + request boot image + + + + + + + + + + + + +
+
+
+ pxe request +
+
+
+ + + pxe request + + + + + + + + + + + + +
+
+
+ pxe response +
+
+
+ + + pxe response + + + + + + + + + + + + +
+
+
+ machine prepare event +
+
+
+ + + machine prepare... + + + + + + + + + + + + + +
+
+
+ run init process +
+
+
+ + + run init process + + + + + + + + + + + + +
+
+
+ machine register event +
+
+
+ + + machine registe... + + + + + + + + + + + + +
+
+
+ machine register +
+
+
+ + + machine register + + + + + + + + + + + + +
+
+
+ success +
+
+
+ + + success + + + + + + + + + + + + +
+
+
+ machine wait event +
+
+
+ + + machine wait ev... + + + + + + + + + + + +
+
+
+ [ until allocated ] +
+
+
+ + + [ until allocat... + + + + + + + + + + + + +
+
+
+ machine wait for allocation +
+
+
+ + + machine wait for allocation + + + + + + + + + + + + +
+
+
+ allocation data +
+
+
+ + + allocation data + + + + + + + + + + + + +
+
+
+ machine install event +
+
+
+ + + machine install... + + + + + + + + + + + + +
+
+
+ ensure boot from HD +
+
+
+ + + ensure boot fro... + + + + + + + + + + + + +
+
+
+ kexec os kernel +
+
+
+ + + kexec os kernel + + + + + + + + + + + + +
+
+
+ machine boot os kernel event +
+
+
+ + + machine boot os... + + + + + + + + + + + + +
+
+
+ report machine phone home event +
+ [ if go-lldp running in target os ] +
+
+
+ + + report machine... + + + + + + + + + + + + + + + + + + +
+
+
+ start interfaces and +
+ find LLDP neighbors +
+
+
+ + + start interface... + + + + + + + + + + + + +
+
+
+ discover system +
+ hardware +
+
+
+ + + discover system... + + + + + + + + + + + + +
+
+
+ wipe disks +
+
+
+ + + wipe disks + + + + + + + + + + + + +
+
+
+ ensure UEFI boot +
+
+
+ + + ensure UEFI boot + + + + + + + + + + + + +
+
+
+ reconfigure switch +
+
+
+ + + reconfigure swi... + + + + + + + + + + + + +
+
+
+ run target os kernel +
+
+
+ + + run target os kernel + + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/provisioning_sequence.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/provisioning_sequence.svg new file mode 100644 index 0000000..3d381e3 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/provisioning_sequence.svg @@ -0,0 +1 @@ +
install
install
wait
wait
register
register
done
done
prepare
prepare
pxe
pxe
switch
switch
metal-api
metal-api
success
success
allocate
allocate
set allocatable flag
to true
set allocatable...
select machine candidate
select machine...
pixiecore
pixiecore
metal-core
metal-core
reconcile network
reconcile network
metal-hammer
metal-hammer
download and burn target os image
download and bu...
run image install.sh and ignition
run image insta...
report install success, finalize machine allocation
report install...
use
use
prepare metal-api
connection over gRPC
prepare metal-a...
machine
machine
booting
metal-hammer
booting...
machine pxe boot event
machine pxe boo...
discovery image url
discovery image url
request boot image
request boot image
pxe request
pxe request
pxe response
pxe response
machine prepare event
machine prepare...
run init process
run init process
machine register event
machine registe...
machine register
machine register
success
success
machine wait event
machine wait ev...
[ until allocated ]
[ until allocat...
machine wait for allocation
machine wait for allocation
allocation data
allocation data
machine install event
machine install...
ensure boot from HD
ensure boot fro...
kexec os kernel
kexec os kernel
machine boot os kernel event
machine boot os...
report machine phone home event
[ if go-lldp running in target os ]
report machine...
start interfaces and
find LLDP neighbors
start interface...
discover system
hardware
discover system...
wipe disks
wipe disks
ensure UEFI boot
ensure UEFI boot
reconfigure switch
reconfigure swi...
run target os kernel
run target os kernelText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/vrf-simple.svg b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/vrf-simple.svg new file mode 100644 index 0000000..cf818ce --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/05-Concepts/assets/vrf-simple.svg @@ -0,0 +1 @@ +
Machine 2
Machine 2
Machine 1
Machine 1
leaf
leaf
VRF 1
VRF 1
VRF 2
VRF 2
Machine 3
Machine 3Viewer does not support full SVG 1.1 \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/01-principles.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/01-principles.md new file mode 100644 index 0000000..8e7030f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/01-principles.md @@ -0,0 +1,76 @@ +--- +slug: /security-principles +title: Security Principles +sidebar_position: 1 +--- + +# Security Principles + +metal-stack adheres to several security principles to ensure the integrity, confidentiality and availability of its services and data. These principles guide the design and implementation of security measures across the metal-stack architecture. + +## Minimal Need to Know + +The minimal need to know principle is a security concept that restricts access to information and resources only to those who absolutely need it for their specific role or task. This principle is implemented throughout the metal-stack architecture and operational practices to enhance security and reduce the risk of unauthorized access or data breaches. + +### RBAC + +:::info +As of now metal-stack does not implement fine-grained Role-Based Access Control (RBAC) within the `metal-api` but this is worked on in [MEP-4](../../../contributing/01-Proposals/MEP4/README.md). +::: + +As described in our [User Management](../../05-Concepts/02-user-management.md) concept the [metal-api](https://github.com/metal-stack/metal-api) currently offers three different user roles for authorization: + +- `Admin` +- `Edit` +- `View` + +To ensure that internal components interact securely with the metal-api, metal-stack assigns specific roles to each service based on the principle of least privilege. + +| Component | Role | +| --------------------------------------------------------------------------------------------------------------------- | ----- | +| [metal-image-cache-sync](https://github.com/metal-stack/metal-image-cache-sync) | View | +| [machine-controller-manager-provider-metal](https://github.com/metal-stack/machine-controller-manager-provider-metal) | Edit | +| [gardener-extension-provider-metal](https://github.com/metal-stack/gardener-extension-provider-metal) | Edit | +| [metal-bmc](https://github.com/metal-stack/metal-bmc) | Edit | +| [metal-core](https://github.com/metal-stack/metal-core) | Edit | +| [metal-hammer](https://github.com/metal-stack/metal-hammer/) | View | +| [metal-metrics-exporter](https://github.com/metal-stack/metal-metrics-exporter) | View | +| [metal-ccm](https://github.com/metal-stack/metal-ccm) | Admin | +| [pixiecore](https://github.com/metal-stack/pixie) | View | +| [metal-console](https://github.com/metal-stack/metal-console) | Admin | +| [cluster-api-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack) | Edit | +| [firewall-controller-manager](https://github.com/metal-stack/firewall-controller-manager) | Edit | + +Users can interact with the metal-api using [metalctl](https://github.com/metal-stack/metalctl), the command-line interface provided by metal-stack. Depending on the required operations, users should authenticate with the appropriate role to match their level of access. + +## Defense in Depth + +Defense in depth is a security strategy that employs multiple layers of defense to protect systems and data. By implementing various security measures at different levels, metal-stack aims to mitigate risks and enhance overall security posture. + +## Redundancy + +Redundancy is a key principle in metal-stack's security architecture. It involves duplicating critical components and services to ensure that if one fails, others can take over, maintaining system availability and reliability. This is particularly important for data storage and processing, where redundancy helps prevent data loss and ensures continuous operation. + +## BMC User Management + +For bare metal provisioning with metal-stack, two dedicated users to interact with a machine BMC are created. +The `metal-hammer` first creates a BMC user called `root` or `superuser` with the administrator privilege. The password used, is configured with the Ansible variable [`metal_api_bmc_superuser_pwd`](https://github.com/metal-stack/metal-roles/blob/master/control-plane/roles/metal/README.md#metal-api). It is necessary e.g. for [`metal-bmc`](https://github.com/metal-stack/metal-roles/blob/master/partition/roles/metal-bmc/README.md), to perform its actions while deleting a machine and adding it to the pool of available machines again. Since metal-stack operates within a Kubernetes cluster, the `metal_api_bmc_superuser_pwd` is stored as a Kubernetes Secret in the metal-control-plane namespace, with the value represented in base64 encoding. + +:::info +Note: The superuser feature is optional. If no superuser password is configured, it is disabled. In this case, `metal-bmc` cannot report machine data for unallocated machines. +::: + +Afterwards a user called `metal` with administrator privileges is created by `metal-hammer`. When a machine registers with the `metal-api`, a password for the metal user is automatically generated and not set through an Ansible variable in `metal-roles`. This password is added to the machine’s IPMI details, which are then persisted in the `metal-db`. The register event triggers the `metal-api` to store all required machine information. Each time a machine is allocated, the password is reset and updated in the database, while the user account itself remains unchanged. The applied password constraints are as follows: + +- Password length: 10 characters +- Number of digits: 3 +- Number of special characters: 0 +- Uppercase allowed +- Repeated characters allowed + +:::info +Note: The `metal-db` is not encrypted. Access to the metal-control-plane namespace should therefore be carefully restricted to trusted administrators only. +::: + +The `metal` user is solely intended for SOL (Serial over LAN) out-of-band administrative access to the machine via [metalctl](/docs/references/metalctl). To establish this connection, the [`metal-console`](docs/references/metal-console) component is used, which transfers console output over SSH. This setup ensures secure, remote out-of-band management, allowing operators to troubleshoot and control machines even when the operating system is unavailable. +To maintain security, the BMC credentials should be treated as system-managed accounts. For security and compliance, administrators are strongly advised to avoid interactive logins with them. \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/02-sbom.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/02-sbom.md new file mode 100644 index 0000000..715848f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/02-sbom.md @@ -0,0 +1,76 @@ +--- +slug: /sbom +title: SBOM +sidebar_position: 2 +--- + +# SBOM + +Every container image and binary that's part of metal-stack contains an _SBOM_ (Software Bill of Materials). It provides +a detailed inventory of components within container images and binaries, enabling you to manage vulnerabilities and +compliance effectively. + +We decided to use [_SPDX_ (Software Package Data Exchange)](https://spdx.dev/), as it is among the most widely adopted +standards and is natively supported in Docker. Docker utilizes the +[in-toto SPDX format](https://github.com/in-toto/attestation/blob/main/spec/predicates/spdx.md), while binary-*SBOM*s +are created using [Syft](https://github.com/anchore/syft). + +*SBOM*s are created as part of each repository's _GitHub Actions_ workflow utilizing +[Anchore SBOM Action](https://github.com/marketplace/actions/anchore-sbom-action) for binaries and +[Build and push Docker images](https://github.com/marketplace/actions/build-and-push-docker-images) for container +images. + +## Download _SBOM_ of a container image + +```bash +docker buildx imagetools inspect ghcr.io/metal-stack/: --format "{{ json .SBOM.SPDX }}" > sbom.json +``` + +For further info, refer to the +[Docker docs](https://docs.docker.com/build/metadata/attestations/sbom/#inspecting-sboms). + +## Download _SBOM_ of a binary from the GitHub release + +```bash +wget https://github.com/metal-stack//releases/latest/download/sbom.json +``` + +Please note, if more than one binary is released, e.g. for different platforms / architectures, you are required to +include this info in the _SBOM_ file name as well. + +```bash +# This is an example using https://github.com/metal-stack/metalctl +wget https://github.com/metal-stack/metalctl/releases/latest/download/sbom-darwin-arm64.json +``` + +## Identify CVEs + +There are many tools that can help you to identify the CVEs with the help of an SBOM. Just to name one example, +[grype](https://github.com/anchore/grype) can be used to do this, which would look like this: + +```plain +$ grype sbom-darwin-arm64.json + ✔ Scanned for vulnerabilities [14 vulnerability matches] + ├── by severity: 0 critical, 5 high, 9 medium, 0 low, 0 negligible +NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK +stdlib go1.24.5 1.24.8, 1.25.2 go-module CVE-2025-61723 High < 0.1% (23rd) < 0.1 +stdlib go1.24.5 1.24.8, 1.25.2 go-module CVE-2025-61725 High < 0.1% (23rd) < 0.1 +stdlib go1.24.5 1.24.8, 1.25.2 go-module CVE-2025-58186 Medium < 0.1% (17th) < 0.1 +stdlib go1.24.5 1.24.8, 1.25.2 go-module CVE-2025-61724 Medium < 0.1% (17th) < 0.1 +stdlib go1.24.5 1.24.8, 1.25.2 go-module CVE-2025-47912 Medium < 0.1% (16th) < 0.1 +stdlib go1.24.5 1.24.8, 1.25.2 go-module CVE-2025-58188 High < 0.1% (8th) < 0.1 +stdlib go1.24.5 1.24.8, 1.25.2 go-module CVE-2025-58189 Medium < 0.1% (12th) < 0.1 +github.com/gorilla/csrf v1.7.3 go-module GHSA-82ff-hg59-8x73 Medium < 0.1% (8th) < 0.1 +stdlib go1.24.5 1.23.12, 1.24.6 go-module CVE-2025-47907 High < 0.1% (4th) < 0.1 +stdlib go1.24.5 1.23.12, 1.24.6 go-module CVE-2025-47906 Medium < 0.1% (5th) < 0.1 +stdlib go1.24.5 1.24.8, 1.25.2 go-module CVE-2025-58185 Medium < 0.1% (6th) < 0.1 +stdlib go1.24.5 1.24.9, 1.25.3 go-module CVE-2025-58187 High < 0.1% (2nd) < 0.1 +stdlib go1.24.5 1.24.8, 1.25.2 go-module CVE-2025-58183 Medium < 0.1% (2nd) < 0.1 +github.com/go-viper/mapstructure/v2 v2.3.0 2.4.0 go-module GHSA-2464-8j7c-4cjm Medium N/A N/A +``` + +Or even simpler by passing the output of `docker buildx imagetools inspect` into grype like so: + +```bash +docker buildx imagetools inspect ghcr.io/metal-stack/: --format "{{ json .SBOM.SPDX }}" | grype +``` diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/03-cryptography.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/03-cryptography.md new file mode 100644 index 0000000..ba8a925 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/03-cryptography.md @@ -0,0 +1,31 @@ +--- +slug: /cryptography +title: Cryptography +sidebar_position: 3 +--- + +# Cryptography + +metal-stack incorporates multiple layers of cryptographic protection and secure communication to ensure system integrity and confidentiality: + +### TLS Certificate Management + +TLS certificates used by metal-stack components - as outlined in the [architecture section](../../05-Concepts/01-architecture.mdx) - can be generated using either RSA 4096-bit or ECDSA 256-bit keys. We recommend RSA 4096. + +By default, in-cluster communication is not encrypted. If encryption is required within the cluster, it must be configured manually using a service mesh (e.g., Istio or Linkerd) or a similar mechanism. +For outbound traffic, we recommend integrating cert-manager in combination with Let's Encrypt to handle certificate issuance and enable automated certificate rotation for ingress domains. In offline environments where Let's Encrypt cannot be used, the certificates must be issued and managed manually or via an internal CA. + +### VPN & Network Encryption + +metal-stack employs WireGuard-based VPN technology, orchestrated via Headscale. WireGuard leverages Elliptic Curve Cryptography (ECC) for key exchange and relies on the Noise Protocol Framework to establish secure and lightweight cryptographic handshakes. + +### Authentication with JWT + +Access to the `metal-api` is protected using JWT (JSON Web Tokens). These tokens are generated and verified using the [`go-jose`](https://github.com/go-jose/go-jose) library, which implements JOSE standards. + +Supported signature algorithms include: + +- RSA (RS256, RS384, RS512) +- RSA-PSS (PS256, PS384, PS512) +- ECDSA (ES256, ES384, ES512) +- EdDSA diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/04-communication-matrix.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/04-communication-matrix.md new file mode 100644 index 0000000..07df260 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/Security/04-communication-matrix.md @@ -0,0 +1,196 @@ +--- +slug: /communication-matrix +title: Communication Matrix +--- + +# Communication Matrix + +This matrix describes the communication between components in the metal-stack and their respective security properties. Please note that depending on your setup and configuration, some components may not be present, may have different security properties and might communicate differently than described here. The communication processes described here correspond to the standard configuration and setup. + +**Legend**: + +- `C`: Confidentiality, cryptography, encryption. Marked with an `x` if the communication is encrypted. +- `I`: Integrity of data. Marked with an `x` if the communication ensures data integrity. +- `Auth`: Authentication, ensures the identity of the communicating parties. Marked with an `x` if authentication is required. +- `Trust`: Only trusted networks involved. Marked with an `x` if the communication is only between trusted networks. + +## Plain metal-stack + +While metal-stack can be used in different environments and setups, the following communication is required by metal-stack components in a standard setup. This includes all components running on the control plane, partition management and machines. + +:::info +Description The following table might not be displayed in completeness. Scroll to the right to see all entries. +::: + +| No. | Component | Source Zone | Protocol | Destination | Destination Zone | Port | C | I | Auth | Trust | Purpose | Notes | +| ---- | ---------------------- | -------------------- | :------: | ---------------------- | -------------------- | :---: | :-: | :-: | :--: | :---: | ------------------------------ | ------------------------------------------------ | +| 1.1 | metalctl | Internet | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | | API Requests | Used for management operations. | +| 1.2 | metalctl | Internet | HTTPS | OIDC Provider | unknown | 443 | x | x | x | | Authentication & Authorization | Optional. Needs to be configured. | +| 1.3 | metalctl | Internet | HTTPS | GitHub | Internet | 443 | x | x | | | Updater | Used for updates and version checks. | +| 2.1 | metal-api | Metal Control Plane | TCP | metal-db | Metal Control Plane | 28015 | | | x | x | RethinkDB | Database access. | +| 2.2 | metal-api | Metal Control Plane | TCP | masterdata-api | Metal Control Plane | 8443 | | | x | x | Postgres | Database access. | +| 2.3 | metal-api | Metal Control Plane | HTTP | ipam | Metal Control Plane | 9090 | | | | x | Address Management | Used to manage IP addresses. | +| 2.4 | metal-api | Metal Control Plane | TLS | nsq | Metal Control Plane | 4150 | x | x | x | x | Machine Operation | Used for machine operations and notifications. | +| 2.5 | metal-api | Metal Control Plane | HTTP | nsq lookupd | Metal Control Plane | 4161 | | | x | x | Machine Operation | Used for machine operations and notifications. | +| 2.6 | metal-api | Metal Control Plane | TCP | auditing timescaledb | Metal Control Plane | 5432 | | | x | x | Audit Logs | Logging of auditing events. Used for compliance. | +| 2.7 | metal-api | Metal Control Plane | HTTPS | headscale | Metal Control Plane | 50443 | x | x | x | x | Headscale API | Headscale is used for VPN networking. | +| 2.8 | metal-api | Metal Control Plane | HTTPS | S3-compatible Storage | unknown | 443 | ? | ? | ? | ? | Firmware | Optional. Needs to be configured. | +| 2.9 | metal-api | Metal Control Plane | HTTPS | OIDC Provider | unknown | 443 | ? | ? | ? | ? | Authentication & Authorization | Optional. Needs to be configured. | +| 3.1 | metal-apiserver | Metal Control Plane | TCP | valkey | Metal Control Plane | 6379 | | | x | x | Background Jobs | Used for background job processing and caching. | +| 3.2 | metal-apiserver | Metal Control Plane | TCP | metal-db | Metal Control Plane | 28015 | x | x | x | x | RethinkDB | Database access. | +| 3.3 | metal-apiserver | Metal Control Plane | TCP | masterdata-api | Metal Control Plane | 8080 | | | x | x | Postgres | Database access. | +| 3.4 | metal-apiserver | Metal Control Plane | HTTP | ipam | Metal Control Plane | 9090 | | | | x | Address Management | Used to manage IP addresses. | +| 3.5 | metal-apiserver | Metal Control Plane | TCP | auditing timescaledb | Metal Control Plane | 5432 | | | x | x | Audit Logs | Logging of auditing events. Used for compliance. | +| 3.6 | metal-apiserver | Metal Control Plane | HTTPS | headscale | Metal Control Plane | 50443 | x | x | x | x | Headscale API | Headscale is used for VPN networking. | +| 3.7 | metal-apiserver | Metal Control Plane | HTTPS | OIDC Provider | unknown | 443 | x | x | x | ? | Authentication & Authorization | Optional. Needs to be configured. | +| 4.1 | masterdata-api | Metal Control Plane | TCP | masterdata-db | Metal Control Plane | 5432 | | | x | x | Postgres database access | Database access. | +| 5.1 | ipam | Metal Control Plane | TCP | ipam-db | Metal Control Plane | 5432 | | | x | x | Postgres database access | Database access. | +| 6.1 | backup-restore-sidecar | Metal Control Plane | HTTPS | S3-compatible Storage | unknown | 443 | ? | ? | ? | ? | Backup & Restore | Optional. Needs to be configured. | +| 6.2 | backup-restore-sidecar | Metal Control Plane | HTTPS | Google API | Internet | 443 | x | x | x | | Backup & Restore | Optional. Needs to be configured. | +| 6.3 | backup-restore-sidecar | Metal Control Plane | TCP | Postgres | Metal Control Plane | 5432 | | | x | x | Backup & Restore | Optional. Needs to be configured. | +| 6.4 | backup-restore-sidecar | Metal Control Plane | TCP | RethinkDB | Metal Control Plane | 28015 | | | x | x | Backup & Restore | Optional. Needs to be configured. | +| 6.5 | backup-restore-sidecar | Metal Control Plane | TCP | ETCD | Metal Control Plane | 2380 | | | x | x | Backup & Restore | Optional. Needs to be configured. | +| 6.6 | backup-restore-sidecar | Metal Control Plane | TCP | Redis | Metal Control Plane | 6379 | | | x | x | Backup & Restore | Optional. Needs to be configured. | +| 6.7 | backup-restore-sidecar | Metal Control Plane | TCP | keydb | Metal Control Plane | 6379 | | | x | x | Backup & Restore | Optional. Needs to be configured. | +| 7.1 | metal-console | Partition Management | HTTP | metal-api | Metal Control Plane | 8080 | | | x | x | API Requests | Used for management operations. | +| 7.2 | metal-console | Partition Management | HTTPS | metal-bmc | Partition Management | 3333 | x | x | x | x | Machine Management | Used for management operations. | +| 8.1 | ssh | unknown | TCP | metal-console | Partition Management | 10001 | x | x | x | ? | Machine Access (SSH) | Used to access the metal-console via SSH. | +| 9.1 | pixiecore | Partition Management | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | x | API Requests | Used for management operations. | +| 10.1 | metal-bmc | Partition Management | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | x | API Requests | Used for management operations. | +| 10.2 | metal-bmc | Partition Management | TLS | nsq | Partition Management | 4150 | x | x | x | x | Machine Operation | Used for machine operations and notifications. | +| 10.2 | metal-bmc | Partition Management | IPMI | machine BMC | Machine | 623 | | | x | x | Machine Operation | Used for BMC management. | +| 11.1 | metal-cache-image-sync | Partition Management | HTTPS | S3-compatible Storage | unknown | 443 | ? | ? | ? | | Image Caching and Sync | Optional. Needs to be configured. | +| 11.2 | metal-cache-image-sync | Partition Management | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | | API Requests | Used for management operations. | +| 12.1 | metal-hammer | Machine | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | x | API Requests | Used for management operations. | +| 12.2 | metal-hammer | Machine | HTTPS | pixiecore | Partition Management | 443 | x | x | | x | Machine Management | Used for machine management. | +| 12.3 | metal-hammer | Machine | HTTPS | Prometheus | unknown | 443 | x | x | x | x | Monitoring | Actively pushes metrics to Prometheus. | +| 12.4 | metal-hammer | Machine | HTTP | HAProxy | Metal Control Plane | 9001 | | x | | x | Image Caching and Pulling | Used to pull images via HAProxy. | +| 12.5 | metal-hammer | Machine | HTTPS | Container Registry | internet | 443 | x | x | ? | | Image and Pulling | Used to pull images from the registry. | +| 13.1 | machine firmware | Machine | HTTPS | pixiecore | Partition Management | 443 | x | x | | x | Machine Management | Used to provision machines with iPXE. | +| 13.2 | machine firmware | Machine | TFTP | pixiecore | Partition Management | 69 | | | | x | Machine OS Provisioning | Used to provision machine firmware. | +| 14.1 | machine OS | Machine | DHCP | DHCP Server | Machine | 67/68 | | | | x | Machine OS Provisioning | Used to obtain an IP address. | +| 14.2 | machine OS | Machine | DNS | DNS Server | Machine | 53 | | | | x | Machine OS Resolution | Used to resolve hostnames. | +| 14.3 | machine OS | Machine | NTP | NTP Server | Machine | 123 | | | | x | Machine OS Time Sync | Used to synchronize time with the NTP server. | +| 15.1 | metal-metrics-exporter | Metal Control Plane | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | x | Monitoring | Scrapes metrics from metal-api. | +| 16.1 | prometheus | Metal Control Plane | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | x | Monitoring | Scrapes metrics from metal-api. | +| 16.2 | prometheus | Metal Control Plane | HTTPS | metal-metrics-exporter | Metal Control Plane | 9080 | | | | x | Monitoring | Scrapes metrics from metal-metrics-exporter. | +| 16.3 | prometheus | Metal Control Plane | HTTPS | metal-apiserver | Metal Control Plane | 443 | x | x | x | x | Monitoring | Scrapes metrics from metal-apiserver. | +| 16.4 | prometheus | Metal Control Plane | HTTPS | masterdata-api | Metal Control Plane | 2113 | x | x | x | x | Monitoring | Scrapes metrics from masterdata-api. | + +### Used Technologies + +| Technology | Parties | Notes | +| --------------------------------- | ---------- | -------------------------------------------------------------------------------- | +| DHCP | All | Used for obtaining IP addresses and boot configurations. | +| NTP | All | Used for synchronizing time across all components. | +| iPXE | Machines | Used for network-based bootstrapping of machines. | +| TFTP | Machines | Used for transferring boot files to machines. | +| HTTP | Multiple | Communication in trusted networks. | +| HTTPS | Multiple | Cross-network communication. | +| DNS | Multiple | Used for resolving hostnames to IP addresses. | +| Kubernetes | Cluster | Metal-stack components running in pods. Optional, but recommended. | +| Container Network Interface (CNI) | Kubernetes | Provides networking capabilities for pods in a cluster. Required for Kubernetes. | + +## With SONiC + +While metal-stack does not directly depend on SONiC, it is the only actively maintained implementation of our networking stack. Therefore, the following communication is required by metal-stack components to interact with SONiC. +Please note that every [networking setup](../../05-Concepts/03-Network/01-theory.md) has its own requirements and configurations, so the following table might not be complete for your setup. + +| No. | Component | Source Zone | Protocol | Destination | Destination Zone | Port | C | I | Auth | Trust | Purpose | Notes | +| ---- | ---------- | ----------------- | :------: | -------------------- | ------------------- | :---: | :-: | :-: | :--: | :---: | ------------- | --------------------------------------------- | +| S1.1 | metal-core | Leaf Switches | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | x | API Requests | Used for management operations. | +| S1.2 | metal-core | Leaf Switches | TCP | SONiC ConfigDB Redis | Switch | 6379 | | | | x | API Requests | Used for management operations. | +| S2.1 | DHCP Relay | Leaf Switches | TCP/UDP | DHCP Server | Management Server | 67/68 | | | | x | DHCP Requests | Used to forward DHCP requests. | +| S3.1 | ssh client | unknown | SSH | ssh daemon | Management Server | 22 | x | x | x | | SSH Access | Used to access the management server via SSH. | +| S3.2 | ssh client | Management Server | SSH | ssh daemon | Switch | 22 | x | x | x | x | SSH Access | Used to access the SONiC switch via SSH. | +| S4.1 | FRRouting | Firewall | BGP | FRRouting | Switches | 179 | | | | x | Routing | Used for dynamic routing. | +| S4.2 | FRRouting | Machine | BGP | FRRouting | Firewall | 179 | | | | x | Routing | Used for dynamic routing. | +| S4.3 | FRRouting | Switches | BGP | FRRouting | Switches | 179 | | | | x | Routing | Used for dynamic routing. | +| S5.1 | tailscale | Firewall | HTTPS | Headscale | Metal Control Plane | 443 | x | x | x | x | VPN Access | Used for Wireguard VPN access via Headscale. | + +### Used Technologies + +| Technology | Parties | Notes | +| ---------- | --------------------------- | ---------------------------------------------------------------------------------------------- | +| VRF | Switches, Firewalls | Isolation of network segments, e.g. for management and data traffic. | +| VLAN | Switches, Firewalls | Layer 2 traffic segmentation. | +| VXLAN | Switches, Firewalls | Encapsulate Layer 2 frames in Layer 3 packets for network virtualization. | +| EVPN | Switches, Firewalls | Overlay network technology for scalable and flexible network architectures. | +| VPN | Firewalls | Management access [without open SSH ports](../../../contributing/01-Proposals/MEP9/README.md). | +| BGP | Multiple | Routing protocol for dynamic routing and network management. | +| SSH | Management Server, Switches | Secure shell access for management and configuration. | +| LLDP | Switches, Machines | Link Layer Discovery Protocol for network device discovery. | +| ICMP | Multiple | Used for network diagnostics and reachability testing. | + +## With Gardener + +When using metal-stack in [conjunction with Gardener](../../05-Concepts/04-Kubernetes/01-gardener.md), the following communication is required by metal-stack components. + +:::info +The following table might not be displayed in completeness. Scroll to the right to see all entries. +::: + +| No. | Component | Source Zone | Protocol | Destination | Destination Zone | Port | C | I | Auth | Trust | Purpose | Notes | +| ---- | ----------------------------------------- | ------------ | :------: | -------------- | ------------------- | :--: | :-: | :-: | :--: | :---: | ------------ | ------------------------------------------- | +| G1.1 | metal-ccm | Seed Cluster | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | x | API Requests | Used for management operations. | +| G1.2 | metal-ccm | Seed Cluster | HTTPS | kube-apiserver | Shoot Cluster | 443 | x | x | x | x | API Requests | Used for management operations. | +| G2.1 | firewall-controller-manager | Seed Cluster | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | x | API Requests | Used for firewall management. | +| G2.2 | firewall-controller-manager | Seed Cluster | HTTPS | kube-apiserver | Seed Cluster | 443 | x | x | x | x | API Requests | Used for firewall management. | +| G2.3 | firewall-controller-manager | Seed Cluster | HTTPS | kube-apiserver | Shoot Cluster | 443 | x | x | x | x | API Requests | Used for firewall management. | +| G3.1 | firewall-controller | Firewall | HTTPS | kube-apiserver | Seed Cluster | 443 | x | x | x | x | API Requests | Used for firewall management. | +| G3.2 | firewall-controller | Firewall | HTTPS | kube-apiserver | Shoot Cluster | 443 | x | x | x | x | API Requests | Used for firewall management. | +| G3.3 | firewall-controller | Firewall | HTTPS | Controller URL | Internet | 443 | x | x | | | Self-Update | Controller URL and version provided by FCM. | +| G4.1 | machine-controller-manager-provider-metal | Seed Cluster | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | | API Requests | Used for management operations. | +| G5.1 | gardener-extension-provider-metal | Seed Cluster | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | | API Requests | Used for management operations. | +| G5.2 | gardener-extension-provider-metal | Seed Cluster | HTTPS | kube-apiserver | Garden Cluster | 443 | x | x | x | | API Requests | Used for management operations. | +| G5.3 | gardener-extension-provider-metal | Seed Cluster | HTTPS | kube-apiserver | Seed Cluster | 443 | x | x | x | | API Requests | Used for management operations. | +| G5.4 | gardener-extension-provider-metal | Seed Cluster | HTTPS | kube-apiserver | Shoot Cluster | 443 | x | x | x | | API Requests | Used for management operations. | + +### Used Technologies + +| Technology | Parties | Notes | +| ---------- | -------------------------------- | ---------------------------------------------- | +| Gardener | Contains of multiple components. | Cluster management system for many Kubernetes. | + +## With Cluster API + +By using the [Cluster API provider for metal-stack](../../05-Concepts/04-Kubernetes/02-cluster-api.md), the following communictations are required by metal-stack components. + +:::info +The following table might not be displayed in completeness. Scroll to the right to see all entries. +::: + +| No. | Component | Source Zone | Protocol | Destination | Destination Zone | Port | C | I | Auth | Trust | Purpose | Notes | +| ---- | -------------------------------- | ------------------ | :------: | -------------- | ------------------- | :--: | :-: | :-: | :--: | :---: | ------------ | ------------------------------- | +| C1.1 | metal-ccm | Workload Cluster | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | | API Requests | Used for management operations. | +| C1.2 | metal-ccm | Workload Cluster | HTTPS | kube-apiserver | Workload Cluster | 443 | x | x | x | x | API Requests | Used for management operations. | +| C2.1 | cluster-api-provider-metal-stack | Management Cluster | HTTPS | metal-api | Metal Control Plane | 443 | x | x | x | | API Requests | Used for management operations. | + +### Used Technologies + +| Technology | Parties | Notes | +| ----------- | --------------------------------------------------------- | --------------------------------------------------------- | +| Cluster API | Contains of multiple components and additional providers. | Cluster management system for single Kubernetes clusters. | + +## With Lightbits + +In order to use [Lightbits as a storage solution](../../05-Concepts/04-Kubernetes/07-storage.md), the following communications are required by metal-stack components. + +:::info +The following table might not be displayed in completeness. Scroll to the right to see all entries. +::: + +| No. | Component | Source Zone | Protocol | Destination | Destination Zone | Port | C | I | Auth | Trust | Purpose | Notes | +| ---- | ----------------- | ------------- | :------: | -------------- | ----------------- | :--: | :-: | :-: | :--: | :---: | ---------- | ------------------------------- | +| L1.1 | duros-controller | Seed Cluster | HTTPS | duros-api | Lightbits Cluster | 443 | x | x | x | x | Storage | Used for management operations. | +| L1.2 | duros-controller | Seed Cluster | HTTPS | kube-apiserver | Shoot Cluster | 443 | x | x | x | x | Kubernetes | Used for management operations. | +| L2.1 | lb-csi-controller | Shoot Cluster | HTTPS | duros-api | Lightbits Cluster | 443 | x | x | x | | Storage | Used for management operations. | +| L2.2 | lb-csi-controller | Shoot Cluster | HTTPS | kube-apiserver | Shoot Cluster | 443 | x | x | x | x | Kubernetes | Used for management operations. | +| L3.1 | lb-csi-node | Shoot Cluster | TCP | duros-api | Lightbits Cluster | 4420 | x | x | x | | Storage | Used for management operations. | +| L3.2 | lb-csi-node | Shoot Cluster | TCP | duros-api | Lightbits Cluster | 8009 | x | x | x | | Storage | Used for management operations. | + +### Used Technologies + +| Technology | Parties | Notes | +| ---------- | ------- | --------------------------- | +| Lightbits | Storage | Used for storage solutions. | diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/artifacts-signing.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/artifacts-signing.md new file mode 100644 index 0000000..93d18dc --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/artifacts-signing.md @@ -0,0 +1,7 @@ +--- +slug: /artifact-signing +title: Artifact Signing +draft: true +--- + +# Artifact Signing diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/integration-checks.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/integration-checks.md new file mode 100644 index 0000000..d648b70 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/integration-checks.md @@ -0,0 +1,6 @@ +--- +slug: /integration-checks +title: Integration Checks +draft: true +--- +# Integration Checks diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/network.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/network.md new file mode 100644 index 0000000..4bc2b1a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/network.md @@ -0,0 +1,7 @@ +--- +slug: /network-for-cisos +title: Network +draft: true +--- + +# Network diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/rbac.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/rbac.md new file mode 100644 index 0000000..9a87b89 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/rbac.md @@ -0,0 +1,34 @@ +--- +slug: /rbac +title: RBAC +draft: true +--- + +# RBAC + +The [metal-api](https://github.com/metal-stack/metal-api) offers three different user roles for authorization: + +- `Admin` +- `Edit` +- `View` + +To ensure that internal components interact securely with the metal-api, metal-stack assigns specific roles to each service based on the principle of least privilege. + +| Component | Role | +|-----------------------------------------------------------------------------------------------------------------------|-------| +| [metal-image-cache-sync](https://github.com/metal-stack/metal-image-cache-sync) | View | +| [machine-controller-manager-provider-metal](https://github.com/metal-stack/machine-controller-manager-provider-metal) | Edit | +| [gardener-extension-provider-metal](https://github.com/metal-stack/gardener-extension-provider-metal) | Edit | +| [metal-bmc](https://github.com/metal-stack/metal-bmc) | Edit | +| [metal-core](https://github.com/metal-stack/metal-core) | Edit | +| [metal-hammer](https://github.com/metal-stack/metal-hammer/) | View | +| [metal-metrics-exporter](https://github.com/metal-stack/metal-metrics-exporter) | View | +| [metal-ccm](https://github.com/metal-stack/metal-ccm) | Admin | +| [pixiecore](https://github.com/metal-stack/pixie) | View | +| [metal-console](https://github.com/metal-stack/metal-console) | Admin | +| [cluster-api-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack) | Edit | +| [firewall-controller-manager](https://github.com/metal-stack/firewall-controller-manager) | Edit | + +Users can interact with the metal-api using [metalctl](https://github.com/metal-stack/metalctl), the command-line interface provided by metal-stack. Depending on the required operations, users should authenticate with the appropriate role to match their level of access. + +As part of [MEP-4](../../contributing/01-Proposals/MEP4/README.md), significant work is underway to introduce more fine-grained access control mechanisms within metal-stack, enhancing the precision and flexibility of permission management. diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/remote-access.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/remote-access.md new file mode 100644 index 0000000..0b8dbb1 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/remote-access.md @@ -0,0 +1,29 @@ +--- +slug: /remote-access +title: Remote Access +--- +# Remote Access + +## Machines and Firewalls + +Remote access to machines and firewalls is essential for performing administrative tasks such as incident management, troubleshooting and sometimes for development. Standard SSH access is often insufficient for these purposes. In many cases, direct serial console access is required to fully manage the system. metal-stack follows a security-first approach by not offering direct SSH access to machines. This practice reduces the attack surface and prevents unauthorized access that could lead to system damage. Detailed information can be found in [MEP-9](../../contributing/01-Proposals/MEP9/README.md). Administrators can access machines in two primary ways. + +**Out-of-band management via SOL** + +```bash +metalctl machine console --ipmi +``` + +This method leverages the machine’s BMC. For detailed user configuration, see the [BMC User Management](Security/01-principles.md#bmc-user-management) section. + +**Via metal-console:** + +```bash +metalctl machine console +``` + +This approach uses the [`metal-console`](../08-References/Control%20Plane/metal-console/metal-console.md), which is required to establish console access. This component acts as a bridge between SSH and the console protocol of the concrete machine. + +Both methods ensure secure and controlled access to machines without exposing them unnecessarily to the network, maintaining the integrity and safety of the infrastructure. + +Connecting directly to a machine without a clear plan of action can have unintended consequences and negatively impact stability. For this reason, administrative privileges are required. This restriction ensures that only authorized personnel with the necessary expertise can perform actions that affect the underlying infrastructure. These principles will evolve with the introduction of [MEP-4](../../contributing/01-Proposals/MEP4/README.md). \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/06-For CISOs/security-vulnerability.md b/versioned_docs/version-v0.22.4/docs/06-For CISOs/security-vulnerability.md new file mode 100644 index 0000000..e32b225 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/06-For CISOs/security-vulnerability.md @@ -0,0 +1,6 @@ +--- +slug: /security-vulnerability +title: Security Vulnerability +draft: true +--- +# Security Vulnerability diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.10.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.10.md new file mode 100644 index 0000000..088e8d4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.10.md @@ -0,0 +1,35 @@ +--- +slug: /release-notes/v0.18.10 +title: v0.18.10 +sidebar_position: 30 +--- +# metal-stack v0.18.10 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.18.10](https://github.com/metal-stack/releases/releases/tag/v0.18.10) +## General +* [Gardener v1.88](https://github.com/gardener/gardener/releases/tag/v1.88.0) +## Required Actions +* The dns-external extension is not explicitly required anymore and hence not deployed anymore. The shoot-dns extension deploys its own version of this extension. Please remove remove the dns-external extension manually after or before the rollout. (metal-stack/metal-roles#306) +## Component Releases +### metal-api v0.32.4 +* Rewrite grpc wait server test to stabilize CI. (metal-stack/metal-api#557) @Gerrit91 +* Fix test container not terminated everywhere. (metal-stack/metal-api#556) @Gerrit91 +* Adapt healthcheck to new metal-lib. (metal-stack/metal-api#553) @Gerrit91 +* Remove hardcoded /32 bitmask for some switch entities (metal-stack/metal-api#555) @majst01 +### metal-hammer v0.13.4 +* Use code for allocation wait from metal-api. (metal-stack/metal-hammer#134) @Gerrit91 +### metal-roles v0.12.8 +* Gardener v1.88 (metal-stack/metal-roles#306) @Gerrit91 +* Cleanup deprecated metal admission webhook certs. (metal-stack/metal-roles#305) @Gerrit91 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.18.9 (metal-stack/docs#207) @metal-robot[bot] +* Bump metal-api to version v0.32.4 (metal-stack/metal-python#122) @metal-robot[bot] +* Bump metal-api to version v0.32.4 (metal-stack/metal-go#175) @metal-robot[bot] +* Detect client bufsize and truncate/compress the reply accordingly (metal-stack/firewall-controller#183) @mreiger +* Update deps, fix typos (metal-stack/firewall-controller#185) @majst01 +* feat(auditing): disables typo tolerance (metal-stack/metal-lib#148) @vknabel +* Update dependencies (metal-stack/metal-lib#150) @majst01 +* Next release (metal-stack/releases#189) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.11.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.11.md new file mode 100644 index 0000000..ce08949 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.11.md @@ -0,0 +1,64 @@ +--- +slug: /release-notes/v0.18.11 +title: v0.18.11 +sidebar_position: 29 +--- +# metal-stack v0.18.11 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.18.11](https://github.com/metal-stack/releases/releases/tag/v0.18.11) +## General +* [Gardener v1.89](https://github.com/gardener/gardener/releases/tag/v1.89.0) +## Required Actions +* Make sure that all Gardener clusters are running at least Kubernetes 1.25 prior to rolling out this release. +* It is required to override the Gardener Node Agent (GNA) container image with the an image built from our fork. It includes important backports without which the gardener-node-agent cannot run. The resulting image vector needs to include: + ```yaml + gardener_image_vector_overwrite: + - name: gardener-node-agent + sourceRepository: github.com/metal-stack/gardener + repository: r.metal-stack.io/gardener/node-agent + tag: 8b2d6473e + resourceId: + name: node-agent + ``` + Unfortunately, this will be necessary for every release until Gardener 1.94. Deactivating the GNA explicitly through deployment is untested and not recommended from our side. + +* Make sure to deploy the partition services for isolated clusters before reconciling shoots with the new Gardener version in case you utilize this feature. + +## Component Releases +### metal-roles v0.12.11 +* Add additional volume mounts for metal-bmc metal-core and pixiecore (metal-stack/metal-roles#307) @simcod +* SAG interfaces: Allow arp updates (metal-stack/metal-roles#309) @mreiger +* Add node-agent to oci-mirror. (metal-stack/metal-roles#308) @Gerrit91 +### os-metal-extension v0.8.1 +* Compatibility with g/g 1.89 GNA (metal-stack/os-metal-extension#46) @majst01 +* Move registry mirrors into `certs.d` directory. (metal-stack/os-metal-extension#49) @Gerrit91 +### metal-api v0.33.0 +* Compact BGPFilter to save switch memory (metal-stack/metal-api#559) @majst01 +* chore(mod): bump metal-lib (metal-stack/metal-api#558) @vknabel +### go-ipam v1.14.7 +* Update to go-1.23 and dependencies, also migrate to distroless (metal-stack/go-ipam#164) @majst01 +* Simplify logging (metal-stack/go-ipam#166) @majst01 +* Fix new linter warnings (metal-stack/go-ipam#165) @majst01 +### helm-charts v0.4.7 +* increase ipam resilience (metal-stack/helm-charts#98) @qrnvttrl +### metal-bmc v0.5.4 +* Avoid starvation of NSQ event processing (metal-stack/metal-bmc#66) @mwindower +### gardener-extension-provider-metal v0.24.5 +* Revendor g/g v1.89. (metal-stack/gardener-extension-provider-metal#412) @Gerrit91 +### duros-controller v0.10.0 +* Update lb-csi driver to 1.16.0 which fixes some mount issues (metal-stack/duros-controller#81) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.18.10 (metal-stack/docs#208) @metal-robot[bot] +* Update all deps and fix a docker CVE (metal-stack/oci-mirror#6) @majst01 +* Bump metal-api to version v0.33.0 (metal-stack/metal-python#123) @metal-robot[bot] +* Bump metal-api to version v0.33.0 (metal-stack/metal-go#176) @metal-robot[bot] +* fix(cache): retry period (metal-stack/security#50) @vknabel +* update to alpine 3.20 (metal-stack/chrony#3) @mwennrich +* Update to go 1.23.0 (metal-stack/builder#78) @majst01 +* Add lightos v3.10.1 support (metal-stack/duros-go#38) @majst01 +* Update go, dependencies and fix linter warnings (metal-stack/firewall-controller#188) @majst01 +* Update go, k8s, gh actions (metal-stack/metallb-health-sidecar#1) @majst01 +* Next release (metal-stack/releases#190) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.12.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.12.md new file mode 100644 index 0000000..e1d4cb6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.12.md @@ -0,0 +1,58 @@ +--- +slug: /release-notes/v0.18.12 +title: v0.18.12 +sidebar_position: 28 +--- +# metal-stack v0.18.12 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.18.12](https://github.com/metal-stack/releases/releases/tag/v0.18.12) +## General +* [Gardener v1.90](https://github.com/gardener/gardener/releases/tag/v1.90.0) +## Required Actions +* When deploying this version of metal-stack, operators should add `10.240.0.0/12` to existing tenant super networks into the new field `additionalAnnouncableCIDRs` to the deployment configuration. This may look like this: + + ```yaml + metal_api_networks: + - id: tenant-super-network-partition-a + name: "Project Super Network" + privatesuper: true + partitionid: "partition-a" + additionalAnnouncableCIDRs: + - 10.240.0.0/12 + ``` + This network was hard-coded by default and is now optional. The metal-api will prevent accidental removal of this network, so it is not possible to break existing route maps if this version gets deployed without adding the field to the deployment. (metal-stack/metalctl#260) +* Contrary to our statement from the last release, it is no longer necessary to use a fork build of the gardener-node-agent. The override can be removed again for this release. +## Component Releases +### gardener-extension-provider-metal v0.24.6 +* Remove CCD secret mutation. (metal-stack/gardener-extension-provider-metal#420) @Gerrit91 +* Remove old kubernetes defaultings (metal-stack/gardener-extension-provider-metal#419) @majst01 +* Update metallb to v0.14.8 (metal-stack/gardener-extension-provider-metal#418) @majst01 +### metal-ccm v0.9.0 +* Update cloud-provider interface, go and fix linter warnings (metal-stack/metal-ccm#98) @majst01 +### metal-hammer v0.13.5 +* Build with go-1.23 (metal-stack/metal-hammer#135) @majst01 +### metal-api v0.34.0 +* Make additional announcable cidrs configurable per tenant super network (metal-stack/metal-api#562) @majst01 +* Satisfy new linter warnings. (metal-stack/metal-api#564) @Gerrit91 +* Satisfy new govet errors (metal-stack/metal-api#561) @majst01 +### metalctl v0.16.7 +* Support Additional Announcable CIDRs (metal-stack/metalctl#260) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Review comments (metal-stack/gardener-extension-dns-powerdns#1) @robertvolkmann +* Bump releases to version v0.18.11 (metal-stack/docs#210) @metal-robot[bot] +* Bump metal-api to version v0.34.0 (metal-stack/metal-python#124) @metal-robot[bot] +* Bump metal-api to version v0.34.0 (metal-stack/metal-go#177) @metal-robot[bot] +* Update to go-1.23 and go modules (metal-stack/metal-networker#113) @majst01 +* Update to metal-networker which allows ipv6 rules on firewall creation (metal-stack/metal-images#252) @majst01 +* Bump github.com/gardener/gardener to 1.85.5 (metal-stack/gardener-extension-dns-powerdns#2) @simcod +* Bump github.com/gardener/gardener to 1.85.5 (metal-stack/gardener-extension-backup-s3#2) @robertvolkmann +* Fixed bug in meilisearch list function (metal-stack/metal-lib#153) @Honigeintopf +* Bump g/g to v1.86.4 (metal-stack/gardener-extension-dns-powerdns#3) @simcod +* Bump g/g to v1.86.4 (metal-stack/gardener-extension-backup-s3#4) @simcod +* Update to go-1.23 (metal-stack/oci-mirror#7) @majst01 +* Bump g/g to 1.87.4 (metal-stack/gardener-extension-backup-s3#5) @simcod +* Bump g/g to 1.87.4 (metal-stack/gardener-extension-dns-powerdns#4) @simcod +* Next release (metal-stack/releases#191) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.13.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.13.md new file mode 100644 index 0000000..6b4fc1d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.13.md @@ -0,0 +1,65 @@ +--- +slug: /release-notes/v0.18.13 +title: v0.18.13 +sidebar_position: 27 +--- +# metal-stack v0.18.13 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.18.13](https://github.com/metal-stack/releases/releases/tag/v0.18.13) +## General +* [Gardener v1.91](https://github.com/gardener/gardener/releases/tag/v1.91.0) +## Breaking Changes +* The Gardener backup config now uses `gardener_backup_infrastructure.provider` instead of `metal_control_plane_host_provider` to configure the backup provider type. This should be non-breaking for the deployments we are aware of but it is advised for operators to validate the value before deploying Gardener. (metal-stack/metal-roles#314) +* The static Cilium version image vector overwrite was removed. The extension now gets deployed by the image vector shipped with the networking extension. (metal-stack/metal-roles#318) +## Required Actions +* Operators need to define the new variable `gardener_cert_management_issuer_email` before deploying Gardener. (metal-stack/metal-roles#315) +## Component Releases +### pixie v0.3.3 +* Update to go-1.23, satisfy linter (metal-stack/pixie#25) @majst01 +### csi-lvm v0.9.0 +* Add necessary permission for leader election with Leases by @robertvolkmann in https://github.com/metal-stack/csi-lvm/pull/63 +* Update to go-1.23, also update csi dependency by @majst01 in https://github.com/metal-stack/csi-lvm/pull/64 +* @robertvolkmann made their first contribution in https://github.com/metal-stack/csi-lvm/pull/63 +**Full Changelog**: https://github.com/metal-stack/csi-lvm/compare/v0.8.0...v0.9.0 +### gardener-extension-provider-metal v0.24.7 +* Allow firewall-controller-manager to patch infrastructure egressCIDRs. (metal-stack/gardener-extension-provider-metal#421) @Gerrit91 +### firewall-controller-manager v0.4.3 +* Update gardener infrastructure egress cidrs for ACL extension. (metal-stack/firewall-controller-manager#61) @Gerrit91 +* Update go and dependencies (metal-stack/firewall-controller-manager#60) @majst01 +* Update metal-lib to v0.17.2. (metal-stack/firewall-controller-manager#59) @Gerrit91 +### metal-core v0.12.0 +* IPv6 Support (metal-stack/metal-core#127) @majst01 +* Update go modules, alpine, github actions (metal-stack/metal-core#130) @majst01 +* Make PXE VLAN configurable (metal-stack/metal-core#126) @simcod +* fix: nil pointer (metal-stack/metal-core#128) @vknabel +### backup-restore-sidecar v0.10.3 +* Update all dependencies (metal-stack/backup-restore-sidecar#94) @majst01 +* Don't create multiple backupers, which can interfere. (metal-stack/backup-restore-sidecar#96) @Gerrit91 +* Ensure a restore from a fresh disk always takes the latest backup (metal-stack/backup-restore-sidecar#92) @majst01 +* Factor out duplicate code in the backup-providers (metal-stack/backup-restore-sidecar#90) @majst01 +* Migrate to buf v2 and update database versions (metal-stack/backup-restore-sidecar#89) @majst01 +* Update dependencies all over the place (metal-stack/backup-restore-sidecar#88) @majst01 +* Update modules and fix typos (metal-stack/backup-restore-sidecar#86) @majst01 +* fix(meili): wait more patiently (metal-stack/backup-restore-sidecar#85) @vknabel +### metal-api v0.34.1 +* chore(deps): bump metal-lib (metal-stack/metal-api#569) @vknabel +* Satisfy linter (metal-stack/metal-api#567) @majst01 +### metal-roles v0.12.12 +* Allow to provide the imageVectorOverwrite for the cilium extension (metal-stack/metal-roles#318) @simcod +* Make basic_auth for prometheus and promtail optional (metal-stack/metal-roles#316) @simcod +* Allow s3 for virtual garden etcd (metal-stack/metal-roles#314) @simcod +* Allow to configure email and server of cert management issuer (metal-stack/metal-roles#315) @simcod +* Add toggles for Gardener extensions. (metal-stack/metal-roles#312) @Gerrit91 +* Added lightbox and lightos to prometheus (metal-stack/metal-roles#297) @simcod +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.18.12 (metal-stack/docs#211) @metal-robot[bot] +* Fixes some typos (metal-stack/docs#212) @simcod +* MEP-14 (metal-stack/docs#213) @simcod +* Update debian and ubuntu kernels (metal-stack/metal-images#254) @majst01 +* Bump metal-api to version v0.34.1 (metal-stack/metal-python#125) @metal-robot[bot] +* Bump metal-api to version v0.34.1 (metal-stack/metal-go#178) @metal-robot[bot] +* Update to go-1.23 and satisfy linter warnings (metal-stack/go-lldpd#27) @majst01 +* Next release (metal-stack/releases#192) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.14.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.14.md new file mode 100644 index 0000000..cf54e83 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.14.md @@ -0,0 +1,50 @@ +--- +slug: /release-notes/v0.18.14 +title: v0.18.14 +sidebar_position: 26 +--- +# metal-stack v0.18.14 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.18.14](https://github.com/metal-stack/releases/releases/tag/v0.18.14) +## General +* [Gardener v1.92](https://github.com/gardener/gardener/releases/tag/v1.92.0) +## Breaking Changes +* The partition capacity calculation was improved to include machine reservation counts. For example the free machine count is now reduced in case there is a size reservation with unused reservations for this machine size. Please adapt metrics and dashboards if necessary. (metal-stack/metal-api#538) +## Component Releases +### pixie v0.3.4 +* Provide ntp config flag (metal-stack/pixie#27) @simcod +### machine-controller-manager-provider-metal v0.1.21 +* Update to MCM v0.52.0 (metal-stack/machine-controller-manager-provider-metal#36) @mwennrich +### metal-hammer v0.13.6 +* Configure ntp servers (metal-stack/metal-hammer#138) @simcod +### metal-roles v0.12.13 +* Add variable for configuring ntp servers (metal-stack/metal-roles#313) @simcod +### metal-api v0.35.2 +* Take amount of reservations into account for free machine count. (metal-stack/metal-api#538) @Gerrit91 +* Exclude dead machines from free count. (metal-stack/metal-api#572) @Gerrit91 +* Add `Allocatable` and `RemainingReservations` to partition capacity. (metal-stack/metal-api#573) @Gerrit91 +### metalctl v0.16.8 +* Improved partition capacity. (metal-stack/metalctl#258) @Gerrit91 +### csi-driver-lvm v0.5.3 +* Update to go-1.23 (metal-stack/csi-driver-lvm#100) @majst01 +* Parse volume size with k8s resource quantities. (metal-stack/csi-driver-lvm#94) @Gerrit91 +* Run integration tests with pod security standards. (metal-stack/csi-driver-lvm#93) @Gerrit91 +* Bump google.golang.org/grpc from 1.52.0 to 1.53.0 (metal-stack/csi-driver-lvm#91) @dependabot +### helm-charts v0.4.9 +* Update csi-driver sidecars. (metal-stack/helm-charts#101) @Gerrit91 +* Next postgreslet release 0 14 0 (metal-stack/helm-charts#100) @eberlep +* Fix mount for node-driver-registrar (metal-stack/helm-charts#65) @timp87 +### metal-metrics-exporter v0.1.7 +* adapt to metal-api v0.35.2 (metal-stack/metal-metrics-exporter#16) @mwennrich +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.18.13 (metal-stack/docs#214) @metal-robot[bot] +* Bump metal-api to version v0.35.0 (metal-stack/metal-python#126) @metal-robot[bot] +* Bump metal-api to version v0.35.0 (metal-stack/metal-go#180) @metal-robot[bot] +* Bump metal-api to version v0.35.1 (metal-stack/metal-python#127) @metal-robot[bot] +* Bump metal-api to version v0.35.1 (metal-stack/metal-go#181) @metal-robot[bot] +* Bump metal-api to version v0.35.2 (metal-stack/metal-python#128) @metal-robot[bot] +* Bump metal-api to version v0.35.2 (metal-stack/metal-go#182) @metal-robot[bot] +* Next release (metal-stack/releases#193) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.15.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.15.md new file mode 100644 index 0000000..939ba3a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.15.md @@ -0,0 +1,78 @@ +--- +slug: /release-notes/v0.18.15 +title: v0.18.15 +sidebar_position: 25 +--- +# metal-stack v0.18.15 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.18.15](https://github.com/metal-stack/releases/releases/tag/v0.18.15) +## General +* [Gardener v1.93](https://github.com/gardener/gardener/releases/tag/v1.93.0) +## Breaking Changes +* Size reservations were moved into a dedicated table and are not directly part of the size entity anymore. In this context, the API has also been slightly changed. If you used size reservations in your deployment, please adopt to the new deployment scheme. Existing reservations are migrated into the new table and do not get lost. (metal-stack/metal-api#576) +* The headscale ip prefix was divided into two individual fields for IPv4 and IPv6. If you set these fields in your deployment, you need to rename them appropriately. (metal-stack/metal-roles#326) +## Component Releases +### helm-charts v0.4.13 +* Set readOnlyRootFilesystem: true for all containers (metal-stack/helm-charts#67) @timp87 +* Add missing mount of lvm archive directory. (metal-stack/helm-charts#104) @Gerrit91 +* Sidecars definition in csi-driver-lvm chart. (metal-stack/helm-charts#103) @Gerrit91 +* Adapt to latest size reservations API. (metal-stack/helm-charts#105) @Gerrit91 +### csi-driver-lvm v0.6.0 +* Add support for dm-integrity on lvm raids (metal-stack/csi-driver-lvm#106) @huettner94 +* Remove sidecars override. (metal-stack/csi-driver-lvm#108) @Gerrit91 +* Fix helm install docs. (metal-stack/csi-driver-lvm#107) @Gerrit91 +### metal-api v0.37.2 +* Move size reservations to a dedicated table. (metal-stack/metal-api#576) @Gerrit91 +* Add type for `map[string]*Nic` (metal-stack/metal-api#574) @iljarotar +* Update to headscale v0.23.0 (metal-stack/metal-api#577) @majst01 +* Allow Powersupply reporting (metal-stack/metal-api#578) @majst01 +* Update metal-stack/security dependency. (metal-stack/metal-api#581) @Gerrit91 +### metalctl v0.17.1 +* Size reservations CRUD (metal-stack/metalctl#263) @Gerrit91 +* Show powersupply and power state (metal-stack/metalctl#264) @majst01 +### metal-roles v0.13.0 +* Adapt to latest size reservations API. (metal-stack/metal-roles#322) @Gerrit91 +* Implement new SAG configuration for SONIC 202211 (metal-stack/metal-roles#321) @mreiger +* Headscale v0.23.0 (metal-stack/metal-roles#326) @Gerrit91 +### gardener-extension-provider-metal v0.24.8 +* Gardener v1.92 (metal-stack/gardener-extension-provider-metal#424) @robertvolkmann +* Change kubelet-config file permissions to 600. (metal-stack/gardener-extension-provider-metal#423) @Gerrit91 +### metal-bmc v0.5.5 +* Report powersupply status (metal-stack/metal-bmc#70) @majst01 +* Update deps, go, go-hal PR (metal-stack/metal-bmc#68) @majst01 +### gardener-extension-audit v0.1.7 +* Revendor g/g 1.92. (metal-stack/gardener-extension-audit#27) @Gerrit91 +* Delete PVCs when extension gets deleted or disabled (metal-stack/gardener-extension-audit#26) @qrnvttrl +### droptailer v0.2.17 +* Update go, buf (metal-stack/droptailer#40) @majst01 +### metal-console v0.7.1 +* Update go, replace alpine with distroless (metal-stack/metal-console#53) @majst01 +### duros-controller v0.11.0 +* Remove PodSecurityPolicies (metal-stack/duros-controller#83) @robertvolkmann +### metal-metrics-exporter v0.1.8 +* add hardware metrics (metal-stack/metal-metrics-exporter#17) @mwennrich +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.18.14 (metal-stack/docs#215) @metal-robot[bot] +* GenericCLI: Support for multiple positional arguments (metal-stack/metal-lib#155) @Gerrit91 +* Bump g/g to 1.91.4 (metal-stack/gardener-extension-dns-powerdns#6) @simcod +* Bump g/g to 1.91.4 (metal-stack/gardener-extension-backup-s3#7) @simcod +* Update deps and Go. (metal-stack/metal-lib#154) @Gerrit91 +* Update dependencies, get rid of crazy pty func (metal-stack/go-hal#65) @majst01 +* Bump metal-api to version v0.36.0 (metal-stack/metal-python#129) @metal-robot[bot] +* Bump metal-api to version v0.36.0 (metal-stack/metal-go#183) @metal-robot[bot] +* Bump metal-api to version v0.37.0 (metal-stack/metal-python#130) @metal-robot[bot] +* Bump metal-api to version v0.37.0 (metal-stack/metal-go#184) @metal-robot[bot] +* Report Powersupply state (metal-stack/go-hal#66) @majst01 +* Bump metal-api to version v0.37.1 (metal-stack/metal-go#185) @metal-robot[bot] +* Bump metal-api to version v0.37.1 (metal-stack/metal-python#131) @metal-robot[bot] +* Update to frr-10.0.2 to fix a CVE (metal-stack/metal-images#256) @majst01 +* Update to go-1.23.2 (metal-stack/builder#79) @majst01 +* Update debian kernel (metal-stack/metal-images#257) @majst01 +* go-1.23 and satisfy linter warnings (metal-stack/security#51) @majst01 +* Bump metal-api to version v0.37.2 (metal-stack/metal-python#132) @metal-robot[bot] +* Bump metal-api to version v0.37.2 (metal-stack/metal-go#186) @metal-robot[bot] +* Add ethtool to debian (metal-stack/metal-images#258) @majst01 +* Next release (metal-stack/releases#194) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.16.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.16.md new file mode 100644 index 0000000..cc41772 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.16.md @@ -0,0 +1,29 @@ +--- +slug: /release-notes/v0.18.16 +title: v0.18.16 +sidebar_position: 24 +--- +# metal-stack v0.18.16 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.18.16](https://github.com/metal-stack/releases/releases/tag/v0.18.16) +## General +* [Gardener v1.94](https://github.com/gardener/gardener/releases/tag/v1.94.0) +## Component Releases +### metal-roles v0.13.1 +* Remove obsolete MCM override. (metal-stack/metal-roles#332) @Gerrit91 +* Introduce gardener_shoot_dns_service_repo_ref (metal-stack/metal-roles#330) @robertvolkmann +* Use VPA CRD from gardener seed-crd folder. (metal-stack/metal-roles#329) @Gerrit91 +### machine-controller-manager-provider-metal v0.1.22 +* Revendor MCM v0.53.1. (metal-stack/machine-controller-manager-provider-metal#37) @Gerrit91 +### gardener-extension-provider-metal v0.24.9 +* Revendor g/g 1.94. (metal-stack/gardener-extension-provider-metal#430) @Gerrit91 +* Use kubelet path configuration constant. (metal-stack/gardener-extension-provider-metal#428) @Gerrit91 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.18.15 (metal-stack/docs#216) @metal-robot[bot] +* Update dependencies (metal-stack/metal-go#187) @majst01 +* Update crictl to v1.31.1 (metal-stack/metal-images#259) @majst01 +* Add noteworthy release section. (metal-stack/metal-robot#72) @Gerrit91 +* Next release (metal-stack/releases#195) @Gerrit91 \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.17.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.17.md new file mode 100644 index 0000000..35824d2 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.17.md @@ -0,0 +1,52 @@ +--- +slug: /release-notes/v0.18.17 +title: v0.18.17 +sidebar_position: 23 +--- +# metal-stack v0.18.17 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.18.17](https://github.com/metal-stack/releases/releases/tag/v0.18.17) +## General +* [Gardener v1.95](https://github.com/gardener/gardener/releases/tag/v1.95.0) +## Required Actions +* The deployment for the shoot-dns-service extension does not use the overwrite from our release vector for the dns-controller-manager subcomponent anymore. Operators who use a custom overwrite for this component now need to provide it through the new variables `gardener_shoot_dns_service_dns_controller_manager_image_name` and `gardener_shoot_dns_service_dns_controller_manager_image_tag`. (metal-stack/metal-roles#337) +## Breaking Changes +* metal-core does not write FEC configuration on ports anymore. If FEC is needed, it must be configured another way, e.g. by Ansible. (metal-stack/metal-core#132) +## Noteworthy +* All NVidia GPUs are detected now. (metal-stack/metal-hammer#143) +* Support for Kubernetes 1.30 was added (metal-stack/gardener-extension-provider-metal#431) +## Component Releases +### metal-hammer v0.13.7 +* Support all NVidia devices (metal-stack/metal-hammer#143) @majst01 +* Update dependencies (metal-stack/metal-hammer#140) @majst01 +### metal-core v0.12.1 +* Handle failing reloader on SONiC (metal-stack/metal-core#108) @robertvolkmann +* Remove fec config from sonic applier (metal-stack/metal-core#132) @iljarotar +### gardener-extension-provider-metal v0.25.0 +* Implement mutating webhook for Calico with eBPF configuration. (metal-stack/gardener-extension-provider-metal#427) @Gerrit91 +* Update to g/g 1.95 (metal-stack/gardener-extension-provider-metal#431) @majst01 +### metal-ccm v0.9.1 +* Update go dependencies (metal-stack/metal-ccm#101) @majst01 +* Use scheme from client-go and not from kubectl. (metal-stack/metal-ccm#100) @Gerrit91 +* Ensure addresspool is addressfamily agnostic (metal-stack/metal-ccm#99) @majst01 +### metal-roles v0.14.0 +* Remove dns-controller-manager subcomponent from release vector (metal-stack/metal-roles#337) @Gerrit91 +* Add possibility to allow shoot issuers (metal-stack/metal-roles#335) @robertvolkmann +* Allow configuration of DNS nameservers used for checking DNS propagation. (metal-stack/metal-roles#334) @robertvolkmann +* Use running configuration for sonic ports (metal-stack/metal-roles#324) @iljarotar +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.18.16 (metal-stack/docs#218) @metal-robot[bot] +* Allow prompt to have a default answer. (metal-stack/metal-lib#156) @Gerrit91 +* Remove ipv4 only address to cidr calculations (metal-stack/firewall-controller#189) @majst01 +* Update firewall controller, droptailer and tailscale (metal-stack/metal-images#261) @majst01 +* Document switch migrate (metal-stack/docs#219) @iljarotar +* Update supported hardware (metal-stack/docs#217) @mwindower +* Bump gardener-extension-shoot-cert-service to v1.44.2 (metal-stack/releases#197) @robertvolkmann +* Bump gardener-extension-networking-cilium to v1.35.0 (metal-stack/releases#198) @robertvolkmann +* Check typos on prs (metal-stack/docs#220) @majst01 +* Add documentation for the monitoring stack (metal-stack/docs#198) @iljarotar +* Strip HTML comments. (metal-stack/metal-robot#71) @Gerrit91 +* Next release (metal-stack/releases#196) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.18.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.18.md new file mode 100644 index 0000000..1c4cc75 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.18/v0.18.18.md @@ -0,0 +1,56 @@ +--- +slug: /release-notes/v0.18.18 +title: v0.18.18 +sidebar_position: 22 +--- +# metal-stack v0.18.18 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.18.18](https://github.com/metal-stack/releases/releases/tag/v0.18.18) +## General +* [Gardener v1.96](https://github.com/gardener/gardener/releases/tag/v1.96.0) +## Noteworthy +* The extension now deploys a `Service` and can be scraped by seed-prometheus. (metal-stack/gardener-extension-backup-s3#8) +## Component Releases +### gardener-extension-audit v0.1.9 +* Revendor g/g v1.97 (metal-stack/gardener-extension-audit#28) @ftl +* Add support to add custom data to audit messages through the fluentbit configuration (metal-stack/gardener-extension-audit#30) @ftl +* Allow '-' (minus) in customData (metal-stack/gardener-extension-audit#32) @ftl +### gardener-extension-provider-metal v0.25.2 +* Revendor Gardener 1.96 (metal-stack/gardener-extension-provider-metal#432) @majst01 +* Update Cilium extension to support Cilium 1.15 (metal-stack/gardener-extension-provider-metal#403) @iljarotar +### os-metal-extension v0.8.2 +* Revendor g/g 1.96. also migrate to vgopath (metal-stack/os-metal-extension#48) @Gerrit91 +### backup-restore-sidecar v0.11.0 +* Add aes-encryption for backups (metal-stack/backup-restore-sidecar#97) @ostempel +### metal-roles v0.14.2 +* Gardener v1.96. (metal-stack/metal-roles#339) @Gerrit91 +* Add config db to ZTP (metal-stack/metal-roles#333) @iljarotar +* Add role for partition management firewall setup (metal-stack/metal-roles#336) @Honigeintopf +* Provide configuration option to encrypt backup-restore-sidecar backups. (metal-stack/metal-roles#340) @Gerrit91 +### metal-ccm v0.9.3 +* Refactor loadbalancer config package. (metal-stack/metal-ccm#103) @Gerrit91 +* Add Cilium load balancer (metal-stack/metal-ccm#94) @iljarotar +* Remove leftovers from MetalLB CR migration path. (metal-stack/metal-ccm#102) @Gerrit91 +* Migrate housekeeper to informers (metal-stack/metal-ccm#106) @majst01 +* Fix regression that IPs are not placed in correct IP pool (metal-stack/metal-ccm#105) @majst01 +### masterdata-api v0.11.5 +* Return all project ids a tenant is member of within a given tenant (metal-stack/masterdata-api#99) @simcod +* Update to go-1.23 and fix new linter warnings (metal-stack/masterdata-api#105) @majst01 +### mini-lab v0.4.2 +* Remove fixed public IPv4 addresses assigned to machines (metal-stack/mini-lab#187) @robertvolkmann +* Simplify ssh config and use it everywhere (metal-stack/mini-lab#185) @robertvolkmann +* Correct flavors section in readme (metal-stack/mini-lab#194) @iljarotar +* Remove all containers from previous runs (metal-stack/mini-lab#188) @robertvolkmann +* Remove unused machine and align sonic and cumulus ports (metal-stack/mini-lab#193) @iljarotar +* Put SONiC VM image into a separate container image (metal-stack/mini-lab#189) @robertvolkmann +* Use a nginx container to test outgoing traffic (metal-stack/mini-lab#186) @robertvolkmann +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.18.17 (metal-stack/docs#221) @metal-robot[bot] +* Add Service in order to generate correct NetworkPolicies (metal-stack/gardener-extension-backup-s3#8) @maboehm +* Bump g/g to 1.95.6 (metal-stack/gardener-extension-backup-s3#9) @robertvolkmann +* Bump g/g to 1.95.6 (metal-stack/gardener-extension-dns-powerdns#7) @robertvolkmann +* Update deps, satisfy linter (metal-stack/oci-mirror#8) @majst01 +* Next release (metal-stack/releases#199) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.0.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.0.md new file mode 100644 index 0000000..d1a6a29 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.0.md @@ -0,0 +1,62 @@ +--- +slug: /release-notes/v0.19.0 +title: v0.19.0 +sidebar_position: 21 +--- +# metal-stack v0.19.0 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.19.0](https://github.com/metal-stack/releases/releases/tag/v0.19.0) +## General +* [Gardener v1.97](https://github.com/gardener/gardener/releases/tag/v1.97.0) +## Component Releases +### metal-console v0.7.2 +* Migrate to jwt-go v5 (metal-stack/metal-console#55) @majst01 +### metal-api v0.39.2 +* Add switch migrate endpoint (metal-stack/metal-api#566) @iljarotar +* Migrate to jwt-go v5 (metal-stack/metal-api#587) @majst01 +* Add a test for switch connection map handling (metal-stack/metal-api#584) @majst01 +* Configure DNS and NTP in machine allocation (metal-stack/metal-api#571) @simcod +* Allow updating partition NTP and DNS servers. (metal-stack/metal-api#589) @Gerrit91 +* Add request param to calculate partition capacity for specific project (metal-stack/metal-api#588) @Gerrit91 +* Update buf and all proto related deps (metal-stack/metal-api#593) @majst01 +* Fix linter issues. (metal-stack/metal-api#592) @Gerrit91 +### metalctl v0.17.4 +* Add switch migrate command (metal-stack/metalctl#262) @iljarotar +* Enable typos check (metal-stack/metalctl#265) @majst01 +* Add dns and ntp servers flag to machine and partition creation (metal-stack/metalctl#266) @simcod +* Update to metal-go v0.39.2. (metal-stack/metalctl#268) @Gerrit91 +### metal-hammer v0.13.8 +* Machine allocation with DNS and NTP (metal-stack/metal-hammer#139) @simcod +### metal-roles v0.14.3 +* Gardener logging stack (metal-stack/metal-roles#344) @simcod +* Support unnumbered VLAN interfaces (metal-stack/metal-roles#351) @mwindower +* Fix deployment of updated networking-cilium extension. (metal-stack/metal-roles#349) @Gerrit91 +* Reboot mgmtserver if interfaces were not renamed successfully (metal-stack/metal-roles#346) @iljarotar +* Add ssh options to mgmt_server role (metal-stack/metal-roles#347) @iljarotar +* Configure VRFs mentioned in sonic_ports_dict, sonic_vlans (metal-stack/metal-roles#345) @mwindower +* Migrate to shoot_admin_kubeconfig (metal-stack/metal-roles#342) @robertvolkmann +* No NSQ used in metal-core (metal-stack/metal-roles#341) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.18.18 (metal-stack/docs#225) @metal-robot[bot] +* Migrate to jwt-go v5 (metal-stack/security#52) @majst01 +* Migrate to jwt-go v5 (metal-stack/metal-lib#159) @majst01 +* Bump gardener-extension-networking-cilium to v1.36.0 (metal-stack/releases#200) @robertvolkmann +* Bump metal-api to version v0.38.0 (metal-stack/metal-python#133) @metal-robot[bot] +* Bump metal-api to version v0.38.0 (metal-stack/metal-go#189) @metal-robot[bot] +* Repair pipeline (metal-stack/cluster-api-provider-metal-stack#6) @Gerrit91 +* Bump metal-api to version v0.39.0 (metal-stack/metal-python#134) @metal-robot[bot] +* Bump metal-api to version v0.39.0 (metal-stack/metal-go#190) @metal-robot[bot] +* Bump metal-api to version v0.39.1 (metal-stack/metal-python#135) @metal-robot[bot] +* Bump metal-api to version v0.39.1 (metal-stack/metal-go#191) @metal-robot[bot] +* Initial build for edk2-stable202408.01 (metal-stack/mini-lab-ovmf#1) @robertvolkmann +* Since gardener node agent, docker is not required anymore (metal-stack/metal-images#262) @majst01 +* Machine allocation with dns and ntp (metal-stack/metal-images#255) @simcod +* Update to frr-10.1 (metal-stack/metal-images#251) @majst01 +* Bump metal-api to version v0.39.2 (metal-stack/metal-python#136) @metal-robot[bot] +* Bump metal-api to version v0.39.2 (metal-stack/metal-go#192) @metal-robot[bot] +* go-1.23.3 and golangci-lint 1.62.0 (metal-stack/builder#80) @majst01 +* Go 1.23 (metal-stack/nftables-exporter#26) @majst01 +* Next release (metal-stack/releases#202) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.1.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.1.md new file mode 100644 index 0000000..8ba49bd --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.1.md @@ -0,0 +1,38 @@ +--- +slug: /release-notes/v0.19.1 +title: v0.19.1 +sidebar_position: 20 +--- +# metal-stack v0.19.1 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.19.1](https://github.com/metal-stack/releases/releases/tag/v0.19.1) +## General +* [Gardener v1.98](https://github.com/gardener/gardener/releases/tag/v1.98.0) +## Required Actions +* By mistake this release does not contain the correct version of metal-roles. If you depend on the Gardener role, please override the version for this release through `metal_roles_version: v0.14.3`. +## Component Releases +### helm-charts v0.4.14 +* Postgreslet mutating webhook (metal-stack/helm-charts#102) @eberlep +### pixie v0.3.5 +* Pass partition to metal-hammer (metal-stack/pixie#28) @majst01 +### metal-api v0.39.4 +* Machine Registration must now contain Partition (metal-stack/metal-api#583) @majst01 +* Set PartitionID (metal-stack/metal-api#595) @majst01 +* Parse SSH public key with correct function. (metal-stack/metal-api#594) @Gerrit91 +### metal-hammer v0.13.9 +* Pass partition id during machine register (metal-stack/metal-hammer#142) @majst01 +### duros-controller v0.11.1 +* Update to lightos-v3.11.1 (metal-stack/duros-controller#84) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Add metalctl section to MEP14 (metal-stack/docs#223) @simcod +* Bump releases to version v0.19.0 (metal-stack/docs#226) @metal-robot[bot] +* Offline resilience (metal-stack/docs#222) @simcod +* Bump metal-api to version v0.39.3 (metal-stack/metal-go#193) @metal-robot[bot] +* Bump metal-api to version v0.39.3 (metal-stack/metal-python#137) @metal-robot[bot] +* Adopt to lightos 3.11.1 (metal-stack/duros-go#39) @majst01 +* Bump metal-api to version v0.39.4 (metal-stack/metal-python#138) @metal-robot[bot] +* Bump metal-api to version v0.39.4 (metal-stack/metal-go#194) @metal-robot[bot] +* Next release (metal-stack/releases#203) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.2.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.2.md new file mode 100644 index 0000000..47ffd13 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.2.md @@ -0,0 +1,28 @@ +--- +slug: /release-notes/v0.19.2 +title: v0.19.2 +sidebar_position: 19 +--- +# metal-stack v0.19.2 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.19.2](https://github.com/metal-stack/releases/releases/tag/v0.19.2) +## General +* [Gardener v1.99](https://github.com/gardener/gardener/releases/tag/v1.99.0) +## Component Releases +### metalctl v0.17.5 +* Support ECDSA Public ssh keys (metal-stack/metalctl#269) @majst01 +### metal-hammer v0.13.10 +* Support newer microclouds (metal-stack/metal-hammer#146) @majst01 +### metal-roles v0.14.4 +* Allow deploying gardener-extension-networking-calico v1.40.0 (metal-stack/metal-roles#354) @Gerrit91 +* Allow deploying gardener-extension-shoot-dns-service v1.50.0 (metal-stack/metal-roles#353) @robertvolkmann +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.19.1 (metal-stack/docs#227) @metal-robot[bot] +* docs(isolated): adopt new containerd configuration #224 (metal-stack/docs#228) @vknabel +* Bump gardener-extension-shoot-dns-service to v1.50.0 (metal-stack/releases#201) @robertvolkmann +* Skip bios modifications on newer microclouds (metal-stack/go-hal#69) @majst01 +* Update the "Update Policy" and release section a bit. (metal-stack/docs#229) @Gerrit91 +* Next release (metal-stack/releases#205) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.3.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.3.md new file mode 100644 index 0000000..4e4ef22 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.3.md @@ -0,0 +1,67 @@ +--- +slug: /release-notes/v0.19.3 +title: v0.19.3 +sidebar_position: 18 +--- +# metal-stack v0.19.3 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.19.3](https://github.com/metal-stack/releases/releases/tag/v0.19.3) +## General +* [Gardener v1.100](https://github.com/gardener/gardener/releases/tag/v1.100.0) +## Noteworthy +* It is now possible to provision SONiC switches with a static `config_db.json` provided through ZTP instead of rendering this configuration dynamically during deployment. This approach leads to more stable rollouts and might become our default for SONiC deployments. When using this new provisioning variant, follow the example in the `ztp` role documentation and set `sonic_render_config_db_template` in the `sonic` role to false. Also leave `sonic_ports`, `sonic_breakouts` and `sonic_portchannels` empty. Otherwise there might be conflicts between the provided `config_db.json` and the one rendered by the `sonic` role. (metal-stack/metal-roles#358) +* Deployment of csi-lvm can now be disabled for a shoot. We plan to replace this storage driver with its successor [csi-driver-lvm](https://github.com/metal-stack/csi-driver-lvm), for which a special Gardener extension called [gardener-extension-csi-driver-lvm](https://github.com/metal-stack/gardener-extension-csi-driver-lvm) can be used. (metal-stack/gardener-extension-provider-metal#438). A migration strategy for existing PVs will be provided. +## Component Releases +### gardener-extension-dns-powerdns v0.7.0 +* Revendor g/g v1.100. by @Gerrit91 in https://github.com/metal-stack/gardener-extension-dns-powerdns/pull/8 +### gardener-extension-backup-s3 v0.7.0 +* Revendor g/g v1.100. by @Gerrit91 in https://github.com/metal-stack/gardener-extension-backup-s3/pull/11 +### metal-roles v0.14.7 +* Add backup s3 and powerdns extensions (metal-stack/metal-roles#356) @Gerrit91 +* Fix typos (metal-stack/metal-roles#355) @robertvolkmann +* Changes required for running Gardener in the mini-lab. (metal-stack/metal-roles#365) @Gerrit91 +* Allow individual config_db per host via ztp.json (metal-stack/metal-roles#358) @iljarotar +* Allow shoot owners to bring their own DNS providers. (metal-stack/metal-roles#361) @Gerrit91 +* Allow a group to be member of the soil project (metal-stack/metal-roles#362) @robertvolkmann +* Install isc-dhcp-server after rendering configs (metal-stack/metal-roles#359) @iljarotar +* Add deployment for gardener-extension-csi-driver-lvm. (metal-stack/metal-roles#367) @Gerrit91 +* Monitoring documentation (metal-stack/metal-roles#319) @simcod +### gardener-extension-audit v0.1.10 +* fix apiVersion of PodDisruptionBudget (metal-stack/gardener-extension-audit#35) @ostempel +* fix gardener local deployment (metal-stack/gardener-extension-audit#34) @ostempel +* fix local setup (metal-stack/gardener-extension-audit#33) @ostempel +### helm-charts v0.4.15 +* More configurable PDBs for metal control plane. (metal-stack/helm-charts#108) @Gerrit91 +* Default PDB minAvailable to one and make it configurable (metal-stack/helm-charts#107) @simcod +### go-ipam v1.14.8 +* Update protobuf-go (metal-stack/go-ipam#170) @majst01 +* Update dependencies all over the place (metal-stack/go-ipam#168) @majst01 +### gardener-extension-provider-metal v0.25.3 +* add disableCsiLvm feature gate (metal-stack/gardener-extension-provider-metal#438) @ostempel +### metal-core v0.12.2 +* Add agentx for sonic (metal-stack/metal-core#107) @robertvolkmann +* Remove the additional route map cidr default value (metal-stack/metal-core#134) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.19.2 (metal-stack/docs#230) @metal-robot[bot] +* New Microclouds work now (metal-stack/docs#231) @majst01 +* Revendor g/g v1.100. (metal-stack/gardener-extension-dns-powerdns#8) @Gerrit91 +* Revendor g/g v1.100. (metal-stack/gardener-extension-backup-s3#11) @Gerrit91 +* Ignition service for bootstrapping kubeadm and kubelet. (metal-stack/cluster-api-provider-metal-stack#8) @Gerrit91 +* Update debian and ubuntu kernel (metal-stack/metal-images#264) @majst01 +* Use dynamic unprivileged user instead of root. (metal-stack/nftables-exporter#27) @hikhvar +* Add additional information/references (metal-stack/docs#209) @scoopex +* Bump virtual garden to v1.30.7 (metal-stack/releases#209) @robertvolkmann +* Validate nftables rule files in CI and fix IPv6 (metal-stack/metal-networker#114) @mwindower +* Firewall controller manager (metal-stack/cluster-api-provider-metal-stack#9) @vknabel +* Add a diagram which illustrates the network setup (metal-stack/docs#236) @scoopex +* draft csi driver lvm extension (metal-stack/gardener-extension-csi-driver-lvm#1) @ostempel +* Add generate cmd (metal-stack/sonic-configdb-utils#1) @iljarotar +* Update all go modules and fix new linter warnings (metal-stack/security#53) @majst01 +* Bump gardener-extension-shoot-dns-service to v1.51.0 (metal-stack/releases#207) @robertvolkmann +* Update dependencies (metal-stack/oci-mirror#9) @majst01 +* Update metal-networker with more ipv6 compatibility (metal-stack/firewall-controller#192) @majst01 +* Update to lightos 3.12.2 api (metal-stack/duros-go#41) @majst01 +* Next release (metal-stack/releases#206) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.4.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.4.md new file mode 100644 index 0000000..4625f8e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.4.md @@ -0,0 +1,64 @@ +--- +slug: /release-notes/v0.19.4 +title: v0.19.4 +sidebar_position: 17 +--- +# metal-stack v0.19.4 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.19.4](https://github.com/metal-stack/releases/releases/tag/v0.19.4) +## General +* [Gardener v1.101](https://github.com/gardener/gardener/releases/tag/v1.101.0) +## Required Actions +* For Prometheus, the ansible variables: `prometheus_remote_write_url`, `prometheus_remote_write_basic_auth_username` and `prometheus_remote_write_basic_auth_password` have been removed. Please use the new variable `prometheus_remote_write` instead for configuring the complete remote write target, e.g. with `basic_auth`. + For Promtail, the ansible variables: `promtail_loki_push_endpoint`, `promtail_loki_basic_auth_username` and `promtail_loki_basic_auth_password` have been removed. Please use the new variable `promtail_clients` instead. (metal-stack/metal-roles#369) +## Component Releases +### duros-controller v0.11.2 +* Update lb-csi to v1.17.0 and duros-go (metal-stack/duros-controller#85) @majst01 +### gardener-extension-dns-powerdns v0.7.1 +* Remove deployment anti affinity rule. (metal-stack/gardener-extension-dns-powerdns#9) @Gerrit91 +### gardener-extension-backup-s3 v0.7.1 +* Remove deployment anti affinity rule. (metal-stack/gardener-extension-backup-s3#12) @Gerrit91 +### mini-lab v0.4.3 +* Allow variable configuration for metalctl docker compose container. (metal-stack/mini-lab#213) @Gerrit91 +* Enhance flavor for Cluster API (metal-stack/mini-lab#212) @robertvolkmann +* Add flavor to run Gardener in the mini-lab (metal-stack/mini-lab#202) @Gerrit91 +* Refactor connectivity tests (metal-stack/mini-lab#209) @robertvolkmann +* Pull the SONiC image for all flavors except for the Cumulus flavor (metal-stack/mini-lab#207) @robertvolkmann +* Add flavor for CAPI. (metal-stack/mini-lab#203) @Gerrit91 +* Use latest version of containerlab again. (metal-stack/mini-lab#204) @Gerrit91 +* Use front panel names in the clab topology (metal-stack/mini-lab#206) @robertvolkmann +* Add downscript to fix free_machine targets (metal-stack/mini-lab#201) @robertvolkmann +* Migrate to QEMU 9.1 by switching to bookworm backports (metal-stack/mini-lab#197) @robertvolkmann +* Use custom OVMF firmware (metal-stack/mini-lab#196) @robertvolkmann +* Automatically remove metalctl container (metal-stack/mini-lab#198) @robertvolkmann +* Deactivate GRO to fix performance issues (metal-stack/mini-lab#200) @robertvolkmann +### metal-roles v0.14.8 +* Allow multiple prometheus and promtail targets (metal-stack/metal-roles#369) @simcod +* Add S3 configuration for the backup-restore-sidecar (metal-stack/metal-roles#271) @robertvolkmann +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.19.3 (metal-stack/docs#238) @metal-robot[bot] +* Update frr to fix a CVE (metal-stack/metal-images#265) @majst01 +* Add Spell Checking in CI (metal-stack/cluster-api-provider-metal-stack#12) @majst01 +* docs: basic readme, contributing and license #5 (metal-stack/cluster-api-provider-metal-stack#11) @vknabel +* Fix firewall ingress ipv6 (metal-stack/metal-networker#116) @majst01 +* Further suggestions for Gardener docs. (metal-stack/docs#237) @Gerrit91 +* Add more information regarding gardener and metal-stack (metal-stack/docs#233) @simcod +* Do not disable cgroupv2 (metal-stack/metal-images#266) @majst01 +* Containerd 1.7.25 is released now (metal-stack/metal-images#267) @majst01 +* Since frr-10 mgmtd requires write permissions to /var/lib/frr (metal-stack/metal-images#268) @majst01 +* If dualstack is configured, add own ips of both AFs to deny list (metal-stack/metal-networker#117) @majst01 +* Integrate fixes for dualstack (metal-stack/firewall-controller#193) @majst01 +* Update to frr 10.2 (metal-stack/metal-images#263) @majst01 +* Only add no bgp enforce-first-as for frr >= 10 (metal-stack/metal-networker#118) @majst01 +* Only add no bgp enforce-first-as on frr >= 10 (metal-stack/firewall-controller#194) @majst01 +* Update tailscale to 1.78.1 and nftables-exporter to 0.3.1 (metal-stack/metal-images#270) @majst01 +* Test gardener flavor (metal-stack/releases#211) @Gerrit91 +* Allow metal-stack resources to be provided externally. (metal-stack/cluster-api-provider-metal-stack#10) @Gerrit91 +* Additional tests (metal-stack/cluster-api-provider-metal-stack#14) @vknabel +* Move clusterctl command to lab deployment. (metal-stack/cluster-api-provider-metal-stack#13) @Gerrit91 +* kernel 6.1.0-30 (metal-stack/metal-images#271) @majst01 +* Bootstrap first worker node. (metal-stack/cluster-api-provider-metal-stack#15) @Gerrit91 +* Next release (metal-stack/releases#210) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.5.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.5.md new file mode 100644 index 0000000..a8b762e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.5.md @@ -0,0 +1,35 @@ +--- +slug: /release-notes/v0.19.5 +title: v0.19.5 +sidebar_position: 16 +--- +# metal-stack v0.19.5 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.19.5](https://github.com/metal-stack/releases/releases/tag/v0.19.5) +## General + +* [Gardener v1.102](https://github.com/gardener/gardener/releases/tag/v1.102.0) + +## Component Releases +### metal-metrics-exporter v0.2.0 +* Fetching metrics async. (metal-stack/metal-metrics-exporter#19) @Gerrit91 +* Fix stale values. (metal-stack/metal-metrics-exporter#20) @Gerrit91 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.19.4 (metal-stack/docs#239) @metal-robot[bot] +* Change the `PodCIDR` (metal-stack/cluster-api-provider-metal-stack#34) @simcod +* fix: race condition in readiness #28 (metal-stack/cluster-api-provider-metal-stack#31) @vknabel +* fix: do not delete provided resources (metal-stack/cluster-api-provider-metal-stack#32) @vknabel +* Attach release manifests for clusterctl (metal-stack/cluster-api-provider-metal-stack#30) @vknabel +* fix(ci): correctly reference resolved version in drafts (metal-stack/cluster-api-provider-metal-stack#36) @vknabel +* Use latest image again (metal-stack/cluster-api-provider-metal-stack#41) @robertvolkmann +* Ensure HMAC is not empty (metal-stack/cluster-api-provider-metal-stack#42) @robertvolkmann +* Replace deprecated linter exportloopref with copyloopvar (metal-stack/cluster-api-provider-metal-stack#44) @robertvolkmann +* Update Cluster API to v1.9.4 (metal-stack/cluster-api-provider-metal-stack#43) @robertvolkmann +* Remove firewall integration (metal-stack/cluster-api-provider-metal-stack#40) @robertvolkmann +* Pre-built OS images that include components required by kubeadm control plane provider (metal-stack/cluster-api-provider-metal-stack#37) @robertvolkmann +* Add custom columns for capms resources (metal-stack/cluster-api-provider-metal-stack#45) @simcod +* Remove useless stacktrace when returning an error during reconcile. (metal-stack/cluster-api-provider-metal-stack#46) @Gerrit91 +* Next release (metal-stack/releases#212) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.6.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.6.md new file mode 100644 index 0000000..1a9a88a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.6.md @@ -0,0 +1,50 @@ +--- +slug: /release-notes/v0.19.6 +title: v0.19.6 +sidebar_position: 15 +--- +# metal-stack v0.19.6 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.19.6](https://github.com/metal-stack/releases/releases/tag/v0.19.6) +## General +* [Gardener v1.103](https://github.com/gardener/gardener/releases/tag/v1.103.0) +## Component Releases +### metal-api v0.39.6 +* feat: add support for reporting of switch BGP states by metal-core (metal-stack/metal-api#598) @mwennrich +* Delete Switch status along with switch (metal-stack/metal-api#591) @iljarotar +* Update go dependencies migrate container image to distroless (metal-stack/metal-api#603) @majst01 +### helm-charts v0.4.17 +* Postgreslet: Backup exporter sidecar (metal-stack/helm-charts#106) @eberlep +* rollback spilo image (metal-stack/helm-charts#111) @ulrichSchreiner +### metal-core v0.12.3 +* feat: report bgp states of connected neighbors (metal-stack/metal-core#136) @mwennrich +### metalctl v0.17.6 +* feat: add support for printing bgp state of connected machines (metal-stack/metalctl#270) @mwennrich +### metal-roles v0.14.9 +* Create a bgp-neighbor stats and mount result to metal-core (metal-stack/metal-roles#352) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump metal-api to version v0.39.5 (metal-stack/metal-go#195) @metal-robot[bot] +* Bump metal-api to version v0.39.5 (metal-stack/metal-python#139) @metal-robot[bot] +* Bump releases to version v0.19.5 (metal-stack/docs#240) @metal-robot[bot] +* Refactor status handling and resource deletion (metal-stack/cluster-api-provider-metal-stack#38) @simcod +* Fix release action (metal-stack/metal-python#140) @majst01 +* Use cluster-template for our sample cluster (metal-stack/cluster-api-provider-metal-stack#47) @vknabel +* Bump metal-api to version v0.39.6 (metal-stack/metal-go#196) @metal-robot[bot] +* Bump metal-api to version v0.39.6 (metal-stack/metal-python#141) @metal-robot[bot] +* Update documentation on authentication with OIDC (metal-stack/docs#241) @simcod +* Use official clusterctl container (metal-stack/cluster-api-provider-metal-stack#50) @robertvolkmann +* Use mini lab ext for kind (metal-stack/cluster-api-provider-metal-stack#49) @robertvolkmann +* Set advertise address (metal-stack/cluster-api-provider-metal-stack#54) @robertvolkmann +* Remove finalizer if provider machine can not be found (metal-stack/cluster-api-provider-metal-stack#56) @simcod +* Make nodeNetworkID mandatory (metal-stack/cluster-api-provider-metal-stack#55) @vknabel +* Remove ControlPlaneEndpoint from cluster-template.yaml because it will be set automatically (metal-stack/cluster-api-provider-metal-stack#59) @robertvolkmann +* Integrate metal-ccm. (metal-stack/cluster-api-provider-metal-stack#48) @Gerrit91 +* Set MEP-14 state to `Completed` (metal-stack/docs#243) @simcod +* feat: labels to reflect machine location #57 #58 (metal-stack/cluster-api-provider-metal-stack#60) @vknabel +* Add v0.2.x support (metal-stack/cluster-api-provider-metal-stack#62) @vknabel +* fix: release drafter should use correct image tag (metal-stack/cluster-api-provider-metal-stack#63) @vknabel +* docs: fix environment variables for init metal-stack (metal-stack/cluster-api-provider-metal-stack#64) @vknabel +* Next release (metal-stack/releases#213) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.7.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.7.md new file mode 100644 index 0000000..1e8d1db --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.7.md @@ -0,0 +1,51 @@ +--- +slug: /release-notes/v0.19.7 +title: v0.19.7 +sidebar_position: 14 +--- +# metal-stack v0.19.7 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.19.7](https://github.com/metal-stack/releases/releases/tag/v0.19.7) +## General +* [Gardener v1.104](https://github.com/gardener/gardener/releases/tag/v1.104.0) +## Component Releases +### helm-charts v0.4.19 +* use fixed spilo image (metal-stack/helm-charts#113) @ulrichSchreiner +### metal-metrics-exporter v0.2.1 +* feat: add switch interface BGP established metric (metal-stack/metal-metrics-exporter#18) @mwennrich +### os-metal-extension v0.8.3 +* fix: set file permissions to 0644 for /etc/systemd/timesyncd.conf (metal-stack/os-metal-extension#51) @mwennrich +### metal-ccm v0.9.4 +* Run `metal-ccm` with `Metal-Edit` privileges (metal-stack/metal-ccm#108) @simcod +### metalctl v0.17.7 +* feat: add support for non-Admin HMACs (metal-stack/metalctl#273) @vknabel +### metal-deployment-base v0.7.6 +* Update gcloud and Helm (metal-stack/metal-deployment-base#36) @Gerrit91 +* Create a minimal image without gcloud and save one GB (metal-stack/metal-deployment-base#38) @robertvolkmann +### metal-api v0.39.7 +* If the grpc certificate changed, reboot metal-hammer (metal-stack/metal-api#605) @majst01 +### metal-hammer v0.13.11 +* If the grpc certificate changed, reboot metal-hammer (metal-stack/metal-hammer#151) @majst01 +* Support for H13SRD-F (metal-stack/metal-hammer#152) @robertvolkmann +### gardener-extension-provider-metal v0.25.4 +* Update to g/g 1.104. (metal-stack/gardener-extension-provider-metal#442) @Gerrit91 +* fix apiVersion of PodDisruptionBudget (metal-stack/gardener-extension-provider-metal#437) @ostempel +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.19.6 (metal-stack/docs#244) @metal-robot[bot] +* fix: cluster network column #66 (metal-stack/cluster-api-provider-metal-stack#68) @vknabel +* Update docs for latest version (metal-stack/cluster-api-provider-metal-stack#65) @vknabel +* Skip bios on H13SRD-F (metal-stack/go-hal#74) @robertvolkmann +* Use Metal-Edit user for HMAC (metal-stack/cluster-api-provider-metal-stack#69) @simcod +* Bump metal-api to version v0.39.7 (metal-stack/metal-go#197) @metal-robot[bot] +* Bump metal-api to version v0.39.7 (metal-stack/metal-python#142) @metal-robot[bot] +* downgrade to frr-10.0.x for firewalls to make them work again (metal-stack/metal-images#279) @majst01 +* add project field to user ctx (metal-stack/security#54) @ostempel +* Add project to auditing (metal-stack/metal-lib#161) @ostempel +* Allow to configure log level, don't try to parse output of `nft` exited with non-zero status (metal-stack/nftables-exporter#29) @auvred +* Add a helper to get a unique slice from a tagmap (metal-stack/metal-lib#165) @majst01 +* Update MEP-4 (metal-stack/docs#246) @majst01 +* Just code style, godocs, stuff... (metal-stack/metal-apiserver#1) @Gerrit91 +* Next release (metal-stack/releases#214) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.8.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.8.md new file mode 100644 index 0000000..147400a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.19/v0.19.8.md @@ -0,0 +1,60 @@ +--- +slug: /release-notes/v0.19.8 +title: v0.19.8 +sidebar_position: 13 +--- +# metal-stack v0.19.8 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.19.8](https://github.com/metal-stack/releases/releases/tag/v0.19.8) +## General +* [Gardener v1.105](https://github.com/gardener/gardener/releases/tag/v1.105.0) +## Required Actions +* As `eu.gcr.io` is shutting down we offer operators the possibility to point the virtual garden ETCD images to `ghcr.io/metal-stack`. This will be done automatically through the release vector and will be removed as soon as migrated to the Gardener Operator. (metal-stack/metal-roles#376) +## Noteworthy +* As with g/g v1.105 the `VPAForETCD` feature gate gets enabled unconditionally it is advised to use high-availability for shoots to prevent unavailability of the ETCD during scaling. For the shooted seeds this can be configured by setting the new field `gardener_shooted_seed.high_availability_control_plane` to either `node` or `zone`. (metal-stack/metal-roles#375) +* The ports used by the extension can now be specified via helm values. (metal-stack/gardener-extension-provider-metal#445) +## Component Releases +### firewall-controller-manager v0.5.1 +* Drop support for K8s versions < 1.24 (fix for GKE version). (metal-stack/firewall-controller-manager#68) @Gerrit91 +* Fix distroless image build. (metal-stack/firewall-controller-manager#69) @Gerrit91 +### metal-roles v0.14.11 +* Allow shooted seeds to be deployed with HA control plane. (metal-stack/metal-roles#375) @Gerrit91 +* Support gardener-extension-shoot-cert-service v1.45.0 (metal-stack/metal-roles#374) @robertvolkmann +* Use etcd-backup-restore images from ghcr.io. (metal-stack/metal-roles#376) @Gerrit91 +### metal-core v0.12.4 +* Update go dependencies and alpine image (metal-stack/metal-core#141) @majst01 +* Support authentication against Redis (metal-stack/metal-core#137) @robertvolkmann +### os-metal-extension v0.8.4 +* Revendor g/g v1.105. (metal-stack/os-metal-extension#52) @Gerrit91 +### duros-controller v0.11.4 +* Update to lightos v3.13 (metal-stack/duros-controller#88) @majst01 +* Add missing permission to snapshot controller. (metal-stack/duros-controller#89) @Gerrit91 +### metal-api v0.39.9 +* Allow less than three NTP servers (metal-stack/metal-api#607) @robertvolkmann +* Pass error callback function to auditing http filter. (metal-stack/metal-api#606) @Gerrit91 +### gardener-extension-provider-metal v0.25.6 +* Fix no default storage class when csi-lvm is disabled. (metal-stack/gardener-extension-provider-metal#443) @Gerrit91 +* Again allow setting no default storage class explicitly. (metal-stack/gardener-extension-provider-metal#444) @Gerrit91 +### go-ipam v1.14.9 +* Update go, modules and buf (metal-stack/go-ipam#172) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.19.7 (metal-stack/docs#247) @metal-robot[bot] +* Bump gardener-extension-shoot-cert-service to v1.45.0 (metal-stack/releases#216) @robertvolkmann +* feat: add support for groups when roles are missing (metal-stack/security#55) @vknabel +* Update firewall and ubuntu to kernel 6.12.12, debian to 6.1.0-31 (metal-stack/metal-images#280) @majst01 +* Bump gardener-extension-shoot-dns-service to v1.53.0 (metal-stack/releases#215) @robertvolkmann +* feat: use security memberships (metal-stack/metal-lib#166) @vknabel +* Implement audit backend for TimescaleDB. (metal-stack/metal-lib#151) @Gerrit91 +* Update to lightos v3.13 (metal-stack/duros-go#42) @majst01 +* Bump metal-api to version v0.39.8 (metal-stack/metal-python#143) @metal-robot[bot] +* Bump metal-api to version v0.39.8 (metal-stack/metal-go#198) @metal-robot[bot] +* Allow passing a callback function for error handling in auditing filter. (metal-stack/metal-lib#164) @Gerrit91 +* Update to go-1.24 (metal-stack/builder#81) @majst01 +* Make the repository generic (metal-stack/metal-apiserver#2) @majst01 +* Bump metal-api to version v0.39.9 (metal-stack/metal-python#144) @metal-robot[bot] +* Bump metal-api to version v0.39.9 (metal-stack/metal-go#199) @metal-robot[bot] +* Implement infrastructure pause. (metal-stack/cluster-api-provider-metal-stack#70) @Gerrit91 +* Next release (metal-stack/releases#217) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.0.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.0.md new file mode 100644 index 0000000..288ae2e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.0.md @@ -0,0 +1,108 @@ +--- +slug: /release-notes/v0.20.0 +title: v0.20.0 +sidebar_position: 12 +--- +# metal-stack v0.20.0 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.20.0](https://github.com/metal-stack/releases/releases/tag/v0.20.0) +## General +* General support for IPv6 in the metal-api +* [Gardener v1.106](https://github.com/gardener/gardener/releases/tag/v1.106.0) +## Required Actions +* The `ChildPrefixLength` property was removed from the `partition` entity and moved into the `network` entity. So, every tenant super network must now be configured with `DefaultChildPrefixLength` accordingly. + The existing values in the database are migrated automatically, but the deployment has to be adapted. + + It is required to add the new property to the tenant super network, like: + + ``` + defaultchildprefixlength: + IPv4: 22 + ``` + + Also ensure that all firewall-controllers are up-to-date in all firewalls before adding IPv6 prefixes to any of the existing networks. (metal-stack/metal-api#549) +* Another audit backend based on Postgres and TimescaleDB was added as an alternative to the existing Meilisearch backend. + + For this, the variables `metal_auditing_enabled`, `metal_auditing_index_prefix`, `metal_auditing_index_interval`, `metal_auditing_url` were renamed to `metal_auditing_meili_enabled`, `metal_auditing_meili_index_prefix`, `metal_auditing_meili_index_interval`, `metal_auditing_meili_url`. Please adapt your deployment accordingly. + + If you switch the backend, be aware that backup data of the Meilisearch backend remains and manual cleanup is required. (metal-stack/metal-roles#310) +* Kubernetes 1.31 for worker nodes require to run on the latest OS metal-images. (metal-stack/os-metal-extension#54) +* To prevent using incompatible metal-os images in combination with Kubernetes 1.31 worker nodes, use the new deployment parameter `gardener_os_compatibility_mapping` in order to add a Kubelet version constraint to your `CloudProfile` machine images: + + ```yaml + gardener_os_compatibility_mapping: + ubuntu: + when: + operator: "<" + version: "24.04.20250228" + except: + - "24.04" + kubelet: "<= 1.30" + debian: + when: + operator: "<" + version: "12.0.20250228" + except: + - "12.0" + kubelet: "<= 1.30" + ``` + (metal-stack/metal-roles#384) +## Component Releases +### node-init v0.1.6 +* Build with go-1.24 and update go modules (metal-stack/node-init#15) @majst01 +### metal-api v0.40.3 +* Dualstack Network Support (metal-stack/metal-api#549) @majst01 +* Allow additional auditing backend based on TimescaleDB (metal-stack/metal-api#565) @Gerrit91 +* Fix swagger spec regarding address family is required. (metal-stack/metal-api#608) @Gerrit91 +* Remove unnecessary parent network ID field from network allocation. (metal-stack/metal-api#609) @Gerrit91 +### helm-charts v0.4.20 +* Roll metal-api on cert changes. (metal-stack/helm-charts#115) @Gerrit91 +* Auditing for metal-api with timescaledb backend. (metal-stack/helm-charts#99) @Gerrit91 +### metal-roles v0.15.2 +* Role for auditing-timescaledb. (metal-stack/metal-roles#310) @Gerrit91 +* Roll nsqd and metal-api on certificate roll. (metal-stack/metal-roles#377) @Gerrit91 +* Allow setting the name and kubernetes version for worker groups (metal-stack/metal-roles#381) @robertvolkmann +* feat: allow configuring gardeners vali (metal-stack/metal-roles#380) @vknabel +* Add possibility to add kubelet constraints to cloud profile OS images. (metal-stack/metal-roles#384) @Gerrit91 +### metalctl v0.18.0 +* Only try to use token from kubeconfig for machine console. (metal-stack/metalctl#259) @Gerrit91 +* Dualstack support (metal-stack/metalctl#256) @majst01 +* fix: bug which required optional hmac type (metal-stack/metalctl#275) @vknabel +* docs: fix readme auth type (metal-stack/metalctl#274) @vknabel +### metal-console v0.7.3 +* Update to go-1.24 (metal-stack/metal-console#57) @majst01 +### os-metal-extension v0.8.5 +* Do not deploy containerd config for systemd cgroup driver. (metal-stack/os-metal-extension#54) @Gerrit91 +### gardener-extension-provider-metal v0.25.7 +* Revendor g/g v1.106. (metal-stack/gardener-extension-provider-metal#446) @Gerrit91 +* Make extension ports configurable via helm values (metal-stack/gardener-extension-provider-metal#445) @ScheererJ +### machine-controller-manager-provider-metal v0.1.23 +* Revendor MCM v0.54.0. (metal-stack/machine-controller-manager-provider-metal#38) @Gerrit91 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.19.8 (metal-stack/docs#248) @metal-robot[bot] +* Bump metal-api to version v0.40.0 (metal-stack/metal-python#145) @metal-robot[bot] +* Bump metal-api to version v0.40.0 (metal-stack/metal-go#200) @metal-robot[bot] +* Bump metal-api to version v0.40.1 (metal-stack/metal-python#146) @metal-robot[bot] +* Bump metal-api to version v0.40.1 (metal-stack/metal-go#201) @metal-robot[bot] +* Bump metal-api to version v0.40.2 (metal-stack/metal-python#147) @metal-robot[bot] +* Bump metal-api to version v0.40.2 (metal-stack/metal-go#202) @metal-robot[bot] +* Bump metal-api to version v0.40.3 (metal-stack/metal-python#148) @metal-robot[bot] +* Bump metal-api to version v0.40.3 (metal-stack/metal-go#203) @metal-robot[bot] +* use resource name as cluster id (metal-stack/cluster-api-provider-metal-stack#73) @vknabel +* Split development guide from contributing.md. (metal-stack/cluster-api-provider-metal-stack#74) @Gerrit91 +* Add patch for accton platform support (metal-stack/sonic-build#1) @iljarotar +* Update node_exporter to v1.9.0 (metal-stack/metal-images#281) @majst01 +* Update to go-1.24 (metal-stack/oci-mirror#12) @majst01 +* Update ubuntu/firewall kernel to 6.12.16 (metal-stack/metal-images#283) @majst01 +* Update to go-1.24 (metal-stack/go-lldpd#28) @majst01 +* ship with default containerd config to get cgroupv2 compatibility (metal-stack/metal-images#282) @majst01 +* Do not install a config.toml override for nvidia anymore (metal-stack/metal-images#285) @majst01 +* Update with swagger spec from real cluster (metal-stack/ontap-go#3) @majst01 +* Add files via upload (metal-stack/docs#249) @philiphaas +* Update favicon (metal-stack/docs#250) @philiphaas +* Fix timescaledb query (missing parenthesis). (metal-stack/metal-lib#169) @Gerrit91 +* Improve consistency to meilisearch audit indexing. (metal-stack/metal-lib#170) @Gerrit91 +* Next release (metal-stack/releases#218) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.1.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.1.md new file mode 100644 index 0000000..b09d34b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.1.md @@ -0,0 +1,36 @@ +--- +slug: /release-notes/v0.20.1 +title: v0.20.1 +sidebar_position: 11 +--- +# metal-stack v0.20.1 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.20.1](https://github.com/metal-stack/releases/releases/tag/v0.20.1) +## General +* [Gardener v1.107](https://github.com/gardener/gardener/releases/tag/v1.107.0) +## Required Actions +* Before rolling out Gardener `1.107`, raise the version of the gardener-admission-controller manually prior to the deployment as otherwise the controlplane chart cannot be applied. + ```bash + kubectl patch deployments.apps -n garden gardener-admission-controller --patch='{"spec":{"template":{"spec":{"containers":[{"name": "gardener-admission-controller","image":"europe-docker.pkg.dev/gardener-project/releases/gardener/admission-controller:v1.107.3"}]}}}}' + ``` +## Component Releases +### metal-roles v0.15.3 +* Add metal_bmc_docker_network var (metal-stack/metal-roles#386) @iljarotar +* add default for ztp_provisioning_script (metal-stack/metal-roles#382) @iljarotar +* Fix worker group name concat of shooted seed. (metal-stack/metal-roles#387) @Gerrit91 +### metal-api v0.40.4 +* Update metal-lib. (metal-stack/metal-api#610) @Gerrit91 +### metal-core v0.12.5 +* update to go-1.24 and all go modules (metal-stack/metal-core#146) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.20.0 (metal-stack/docs#251) @metal-robot[bot] +* Migrate to use asynq instead of homegrown tx package (metal-stack/metal-apiserver#3) @majst01 +* Reconcile upstream fixes (metal-stack/metal-apiserver#4) @majst01 +* Dual-stack Support (metal-stack/docs#202) @majst01 +* Bump metal-api to version v0.40.4 (metal-stack/metal-python#149) @metal-robot[bot] +* Bump metal-api to version v0.40.4 (metal-stack/metal-go#204) @metal-robot[bot] +* fix: wait for cluster deletion until all machines are gone #67 (metal-stack/cluster-api-provider-metal-stack#77) @vknabel +* Next release (metal-stack/releases#219) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.2.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.2.md new file mode 100644 index 0000000..ff36d6c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.20/v0.20.2.md @@ -0,0 +1,36 @@ +--- +slug: /release-notes/v0.20.2 +title: v0.20.2 +sidebar_position: 10 +--- +# metal-stack v0.20.2 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.20.2](https://github.com/metal-stack/releases/releases/tag/v0.20.2) +## General +* [Gardener v1.108](https://github.com/gardener/gardener/releases/tag/v1.108.0) +## Component Releases +### gardener-extension-csi-driver-lvm v0.1.2 +* Allow specifying a default storage class. (metal-stack/gardener-extension-csi-driver-lvm#9) @Gerrit91 +* Revendor g/g v1.107. (metal-stack/gardener-extension-csi-driver-lvm#8) @Gerrit91 +* Do not write termination message into host `/dev`. (metal-stack/gardener-extension-csi-driver-lvm#7) @Gerrit91 +* Fail reconciliation if csi-lvm still exists. (metal-stack/gardener-extension-csi-driver-lvm#6) @Gerrit91 +* Allow missing access to shoot kube-apiservers. (metal-stack/gardener-extension-csi-driver-lvm#10) @Gerrit91 +### metal-ccm v0.9.5 +* Update to go-1.24 and nonroot distroless (metal-stack/metal-ccm#109) @majst01 +### gardener-extension-provider-metal v0.25.8 +* Update metallb to v0.14.9 (metal-stack/gardener-extension-provider-metal#450) @majst01 +### machine-controller-manager-provider-metal v0.1.24 +* Fix deletion request can receive empty provider id. (metal-stack/machine-controller-manager-provider-metal#39) @Gerrit91 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* feat: reconcile associated resources (metal-stack/cluster-api-provider-metal-stack#76) @vknabel +* chore: CAPI v1.9.5 (metal-stack/cluster-api-provider-metal-stack#78) @robertvolkmann +* docs: quick move instructions for maintainers (metal-stack/cluster-api-provider-metal-stack#79) @vknabel +* Implement image service (metal-stack/metal-apiserver#5) @majst01 +* fix: deletion of untouched machines (metal-stack/cluster-api-provider-metal-stack#81) @vknabel +* chore(lab): bump clusterctl (metal-stack/cluster-api-provider-metal-stack#80) @vknabel +* Update ubuntu/firewall kernel to 6.12.18 (metal-stack/metal-images#287) @majst01 +* Update on Hardware support (metal-stack/docs#253) @majst01 +* Next release (metal-stack/releases#220) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.0.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.0.md new file mode 100644 index 0000000..282f908 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.0.md @@ -0,0 +1,63 @@ +--- +slug: /release-notes/v0.21.0 +title: v0.21.0 +sidebar_position: 9 +--- +# metal-stack v0.21.0 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.0](https://github.com/metal-stack/releases/releases/tag/v0.21.0) +## General +* [Gardener v1.109](https://github.com/gardener/gardener/releases/tag/v1.109.0) +## Breaking Changes +* A change in the semver library that is used by metal-stack and in the Gardener project forces us to rename the identifiers that we typically use for OS images like Ubuntu 24.04. The library now requires stricter semantic versions, not allow leading zeroes in version segments. + + In case you use for example `ubuntu-24.04.20250228` as an ID for an `image` in the metal-api, this needs to become `ubuntu-24.4.20250228`. + + In order to introduce the new identifier-format, before updating to this release of metal-stack, an image has to be created following the new version format. This image then co-exists with the old image format. After this, all machines referencing the old image must be reprovisioned with the new image ID format. + + After all the references were migrated to the new image format, the old versions must be removed from the metal-api before upgrading to this release. Please adapt your deployments accordingly. + + Unfortunately, there is no better way to migrate this ID. Another option was to fork the Gardener project, which we did not want to do. If you encounter bigger issues with this step, please contact us in our Slack channel. (metal-stack/mini-lab#229) +## Component Releases +### csi-driver-lvm v0.6.1 +* update to go-1.24 and alpine-3.21 (metal-stack/csi-driver-lvm#114) @majst01 +### helm-charts v0.4.21 +* Postgreslet update spilo image (metal-stack/helm-charts#116) @eberlep +### masterdata-api v0.11.7 +* Update to go-1.24, simplify error handling in startup code (metal-stack/masterdata-api#110) @majst01 +* Fix missing workdir when switching to distroless image. (metal-stack/masterdata-api#112) @Gerrit91 +### metal-api v0.40.5 +* Update semver parser with breaking change regarding image versions (metal-stack/metal-api#612) @majst01 +* If deleting a machine from database which is crashed, this hint would… (metal-stack/metal-api#611) @majst01 +### metal-image-cache-sync v0.1.8 +* Go 1.24 (metal-stack/metal-image-cache-sync#18) @majst01 +### go-ipam v1.14.10 +* Update dependencies, try benchmark history (metal-stack/go-ipam#174) @majst01 +### metal-roles v0.15.7 +* Fix default for `ztp_provisioning_script` (metal-stack/metal-roles#394) @iljarotar +* use different frr debian repo (metal-stack/metal-roles#393) @iljarotar +* stop mirroring from eu.gcr.io (metal-stack/metal-roles#392) @mwennrich +* Remove deprecated HVPA feature gates. (metal-stack/metal-roles#395) @Gerrit91 +* Add csi livenessprobe sidecar (metal-stack/metal-roles#396) @majst01 +### metal-ansible-modules v0.2.10 +* Support firewall network allocation mode. (metal-stack/metal-ansible-modules#21) @Gerrit91 +* Optional fields for firewall rules. (metal-stack/metal-ansible-modules#20) @Gerrit91 +### gardener-extension-csi-driver-lvm v0.1.3 +* Update csi sidecars (metal-stack/gardener-extension-csi-driver-lvm#11) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.20.1 (metal-stack/docs#252) @metal-robot[bot] +* Bump releases to version v0.20.2 (metal-stack/docs#254) @metal-robot[bot] +* Add database migration with some fixes and small refactoring on datastore (metal-stack/metal-apiserver#6) @Gerrit91 +* try machine allocation with redis streams (metal-stack/metal-apiserver#7) @majst01 +* Fix ip list (metal-stack/metal-apiserver#8) @majst01 +* Move service initialization into services (metal-stack/metal-apiserver#9) @majst01 +* Unify and simplify service tests (metal-stack/metal-apiserver#10) @majst01 +* Update debian kernel (metal-stack/metal-images#288) @majst01 +* Bump metal-api to version v0.40.5 (metal-stack/metal-go#206) @metal-robot[bot] +* Bump metal-api to version v0.40.5 (metal-stack/metal-python#150) @metal-robot[bot] +* Toolkit must be enabled on newer images (metal-stack/docs#256) @majst01 +* Update frr for debian to 10.2.2 (metal-stack/metal-images#289) @majst01 +* Next release (metal-stack/releases#221) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.1.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.1.md new file mode 100644 index 0000000..a2f36d4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.1.md @@ -0,0 +1,76 @@ +--- +slug: /release-notes/v0.21.1 +title: v0.21.1 +sidebar_position: 8 +--- +# metal-stack v0.21.1 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.1](https://github.com/metal-stack/releases/releases/tag/v0.21.1) +## General +* Please do not forget to mitigate the [critical ingress-nginx vulnerability](https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities) by updating the ingress-controllers in your landscape. metal-stack itself does not deploy an ingress-controller and the ingress-controller deployed by Gardener for the monitoring is not really affected as the admission webhook is not enabled. If you still want to run the patched version though, you can use this override: + ```yaml + gardener_image_vector_overwrite: + - name: nginx-ingress-controller + sourceRepository: github.com/kubernetes/ingress-nginx + repository: registry.k8s.io/ingress-nginx/controller-chroot + tag: "v1.11.5" + targetVersion: ">= 1.26" + ``` +* [Gardener v1.110](https://github.com/gardener/gardener/releases/tag/v1.110.0) +## Noteworthy +* As part of the [MEP-4](https://docs.metal-stack.io/stable/development/proposals/MEP4/README/) implementation, it is now possible to deploy a preview version of the [metal-apiserver](https://github.com/metal-stack/metal-apiserver). Note that this is only a development preview and will undergo a lot of breaking changes in the next time, so do not deploy this for any production use cases yet. (metal-stack/metal-roles#391) +## Breaking Changes +* The support for meilisearch as an audit backend was dropped. Please migrate to the TimescaleDB backend if you depend on this implementation of meilisearch support. (metal-stack/metal-lib#174) +## Component Releases +### gardener-extension-audit v0.1.12 +* Revendor g/g v1.108. (metal-stack/gardener-extension-audit#38) @Gerrit91 +* cleanup: introduce backend interface (metal-stack/gardener-extension-audit#36) @hown3d +* Fix some regressions in Splunk backend (metal-stack/gardener-extension-audit#39) @Gerrit91 +### metal-roles v0.15.13 +* Adaptions for g/g v1.110. (metal-stack/metal-roles#397) @Gerrit91 +* Remove meilisearch backend from metal-api configuration. (metal-stack/metal-roles#398) @Gerrit91 +* Add deployment for metal-apiserver. (metal-stack/metal-roles#391) @Gerrit91 +* Remove duplicate value from release vector mapping. (metal-stack/metal-roles#399) @Gerrit91 +* Add missing `metal_apiserver_redis_password` default variable. (metal-stack/metal-roles#400) @Gerrit91 +* Add missing `metal_apiserver_admin_subjects` default variable. (metal-stack/metal-roles#402) @Gerrit91 +### masterdata-api v0.11.8 +* Memory datastore (metal-stack/masterdata-api#111) @majst01 +* Reusable postgres db (metal-stack/masterdata-api#114) @majst01 +### gardener-extension-provider-metal v0.25.10 +* Create machines with NTP and DNS servers through metal-api (metal-stack/gardener-extension-provider-metal#451) @Gerrit91 +* Retain DNS and NTP additional files if they were present before. (metal-stack/gardener-extension-provider-metal#452) @Gerrit91 +### os-metal-extension v0.8.7 +* Do not write DNS and NTP configuration anymore. (metal-stack/os-metal-extension#57) @Gerrit91 +* Go 1.24 (metal-stack/os-metal-extension#55) @majst01 +* Retain DNS and NTP additional files if they were present before. (metal-stack/os-metal-extension#58) @Gerrit91 +### machine-controller-manager-provider-metal v0.1.25 +* Support creating machines with NTP and DNS server configuration. (metal-stack/machine-controller-manager-provider-metal#40) @Gerrit91 +### metal-api v0.41.0 +* Update dependencies. (metal-stack/metal-api#614) @Gerrit91 +### helm-charts v0.4.22 +* Add deployment of metal-apiserver. (metal-stack/helm-charts#117) @Gerrit91 +* Remove meilisearch from metal-api configuration. (metal-stack/helm-charts#118) @Gerrit91 +### metal-console v0.7.4 +* Upgrade to golangci-lint v2 (metal-stack/metal-console#58) @majst01 +### sonic-configdb-utils v0.2.1 +* Add release drafter. (metal-stack/sonic-configdb-utils#4) @Gerrit91 +* Add CODEOWNERS and code contribution guidelines. (metal-stack/sonic-configdb-utils#3) @Gerrit91 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.21.0 (metal-stack/docs#258) @metal-robot[bot] +* Update ubuntu and firewall kernel to 6.12.20 (metal-stack/metal-images#290) @majst01 +* Remove meilisearch, update go deps (metal-stack/metal-lib#174) @majst01 +* Fix issue unmarshalling internal error of audit entry struct. (metal-stack/metal-lib#175) @Gerrit91 +* Bump metal-api to version v0.41.0 (metal-stack/metal-python#151) @metal-robot[bot] +* Bump metal-api to version v0.41.0 (metal-stack/metal-go#207) @metal-robot[bot] +* Use in memory masterdata (metal-stack/metal-apiserver#11) @majst01 +* Upgrade to golangci-lint v2 and fix new issues (metal-stack/metal-apiserver#12) @majst01 +* Update isolated cluster documentation. (metal-stack/docs#259) @Gerrit91 +* MEP-18: Autonomous control plane (metal-stack/docs#235) @majst01 +* chore(deps): upgrade golangci-lint (metal-stack/cluster-api-provider-metal-stack#83) @vknabel +* Add CODEOWNERS and code contribution guidelines. (metal-stack/sonic-configdb-utils#3) @Gerrit91 +* Try pushing to ghcr.io (metal-stack/metal-images#274) @majst01 +* fix(ci): forgot registry login (metal-stack/metal-images#292) @vknabel +* Next release (metal-stack/releases#222) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.10.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.10.md new file mode 100644 index 0000000..f01e411 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.10.md @@ -0,0 +1,62 @@ +--- +slug: /release-notes/v0.21.10 +title: v0.21.10 +sidebar_position: 1 +--- +# metal-stack v0.21.10 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.10](https://github.com/metal-stack/releases/releases/tag/v0.21.10) +## General +* [Gardener v1.118](https://github.com/gardener/gardener/releases/tag/v1.118.0) +## Required Actions +* The loopback addresses of the switch must be known to all peers that communicate with the switch over the default VRF. BGP sessions must be established accordingly. (metal-stack/metal-core#159) +## Component Releases +### go-ipam v1.14.13 +* Upgrade to go-1.25 (metal-stack/go-ipam#185) @majst01 +### metal-bmc v0.6.0 +* Update to go-1.25 (metal-stack/metal-bmc#86) @majst01 +* Correctly set version build flags. (metal-stack/metal-bmc#82) @Gerrit91 +* include sbom in container image (metal-stack/metal-bmc#81) @mac641 +* Let metal-bmc configure booting from disk via redfish (metal-stack/metal-bmc#85) @simcod +### metal-api v0.42.3 +* Update to go-1.25 (metal-stack/metal-api#633) @majst01 +### metal-console v0.7.5 +* Update to go-1.25 and update all deps (metal-stack/metal-console#60) @majst01 +* include sbom in container images (metal-stack/metal-console#59) @mac641 +### metal-hammer v0.13.15 +* Update to go-1.25, u-root v0.15.0 (metal-stack/metal-hammer#166) @majst01 +* Check if password change is necessary for BMC superuser (metal-stack/metal-hammer#163) @simcod +* Trigger re-read of partition table (metal-stack/metal-hammer#164) @simcod +* Include SBOM as release asset (metal-stack/metal-hammer#158) @mac641 +* Fix missing recent nvidia gpu pci ids (metal-stack/metal-hammer#167) @majst01 +### metal-roles v0.17.15 +* Adaptions for g/g v1.118. (metal-stack/metal-roles#467) @Gerrit91 +### pixie v0.3.7 +* Update to go-1.25 (metal-stack/pixie#38) @majst01 +### metal-core v0.13.1 +* Update to go-1.25 and alpine 3.22 (metal-stack/metal-core#162) @majst01 +### gardener-extension-provider-metal v0.26.4 +* Fix firewall deployment patch update function called with empty string. (metal-stack/gardener-extension-provider-metal#472) @Gerrit91 +* Allow setting explicit hash. (metal-stack/gardener-extension-provider-metal#462) @Gerrit91 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Update to go-1.25 (metal-stack/go-lldpd#31) @majst01 +* Add new vendor Gigabyte (metal-stack/go-hal#75) @simcod +* Update dependencies (metal-stack/go-hal#77) @majst01 +* Bump metal-api to version v0.42.3 (metal-stack/metal-python#158) @metal-robot[bot] +* Bump metal-api to version v0.42.3 (metal-stack/metal-go#218) @metal-robot[bot] +* Use systemd generator functionality for enabling getty instances (metal-stack/metal-images#338) @simcod +* Check for typos (metal-stack/website#93) @simcod +* Update go, kernels, lldpd, cri-tools (metal-stack/metal-images#339) @majst01 +* Add information about remote access to machines and firewalls (metal-stack/website#94) @simcod +* Bump lint-staged from 16.1.5 to 16.1.6 (metal-stack/website#97) @dependabot[bot] +* Add information about storing BMC credentials (metal-stack/website#91) @simcod +* Bind to valid loopback address if no `bind_to` config option specified (metal-stack/nftables-exporter#30) @auvred +* docs: Fix some lines in network physical wiring (metal-stack/website#101) @GeertJohan +* Add partition tags to accounting tags (metal-stack/metal-lib#190) @thheinel +* Remove julia parts (metal-stack/website#100) @BotondGalxc +* Add image url query (metal-stack/api#42) @majst01 +* Bump to v0.21.9 release. (metal-stack/website#99) @Gerrit91 +* Next release (metal-stack/releases#251) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.11.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.11.md new file mode 100644 index 0000000..06bdeb0 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.11.md @@ -0,0 +1,82 @@ +--- +slug: /release-notes/v0.21.11 +title: v0.21.11 +sidebar_position: 1 +--- +# metal-stack v0.21.11 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.11](https://github.com/metal-stack/releases/releases/tag/v0.21.11) +## General +* [Gardener v1.119](https://github.com/gardener/gardener/releases/tag/v1.119.0) +## Required Actions +* Before deploying this version, all ONTAP storage classes in all affected shoots must be deleted, since storage classes are immutable. (metal-stack/gardener-extension-ontap#57) +## Component Releases +### metal-apiserver v0.0.7 +* Fix login broken since tenant-service was refactored (metal-stack/metal-apiserver#68) @majst01 +* Use synctest to leverage fake time during tests (metal-stack/metal-apiserver#69) @majst01 +* Add ctx to convert funcs (metal-stack/metal-apiserver#67) @iljarotar +* Since go-1.24, stdlib is able to start http2 unencrypted (metal-stack/metal-apiserver#66) @majst01 +### gardener-extension-backup-s3 v0.8.1 +* fix(chart): rbac-runtime has a wrong serviceAccountName (metal-stack/gardener-extension-backup-s3#20) @nschad +### gardener-extension-provider-metal v0.26.5 +* Update to go-1.25, gardener 1.119 (metal-stack/gardener-extension-provider-metal#473) @majst01 +* Add IP expiration time to CWNP CRD (metal-stack/gardener-extension-provider-metal#471) @iljarotar +### metal-roles v0.17.17 +* Add retries to Headscale API key creation. (metal-stack/metal-roles#471) @Gerrit91 +* Fix typo in gardenlet operator resource deployment. (metal-stack/metal-roles#470) @Gerrit91 +* Added vrrp to sonic_config role for gateway redundancy without vxlan (metal-stack/metal-roles#466) @mreiger +* Use own helm-chart for valkey. (metal-stack/metal-roles#473) @Gerrit91 +### masterdata-api v0.13.0 +* Introduce namespaces for memberships. (metal-stack/masterdata-api#132) @Gerrit91 +* Update to mockery v3. (metal-stack/masterdata-api#133) @Gerrit91 +* Update to go-1.25 (metal-stack/masterdata-api#129) @majst01 +* Add filters for project and tenant labels. (metal-stack/masterdata-api#131) @Gerrit91 +### gardener-extension-audit v0.2.3 +* Set sources in `Chart.yaml` (metal-stack/gardener-extension-audit#53) @maboehm +### gardener-extension-ontap v0.2.6 +* Fix reconcile when svm is created but seed secret creation failed (metal-stack/gardener-extension-ontap#55) @Honigeintopf +* Remove svm name from tbc (metal-stack/gardener-extension-ontap#59) @Honigeintopf +* configure ontap-csi-node daemonset as system-critical (metal-stack/gardener-extension-ontap#58) @mwennrich +* set fsType to ext4 in StorageClass (metal-stack/gardener-extension-ontap#57) @mwennrich +* Delete ManagedResources (metal-stack/gardener-extension-ontap#49) @majst01 +* Make the controller idempotent (metal-stack/gardener-extension-ontap#63) @Honigeintopf +### machine-controller-manager-provider-metal v0.1.27 +* Revendor MCM v0.58.0. (metal-stack/machine-controller-manager-provider-metal#43) @Gerrit91 +### metal-core v0.13.2 +* Set loopback as source address in SONiC frr.conf (metal-stack/metal-core#159) @iljarotar +### helm-charts v0.5.0 +* Add valkey chart to remove dependency from bitnami (metal-stack/helm-charts#131) @BotondGalxc +### metal-api v0.42.4 +* Consider all machines of partition for evaluating faulty machines (metal-stack/metal-api#632) @ostempel +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Update to go-1.25 (metal-stack/metal-robot#90) @majst01 +* Update to gardener 1.119 and matching extensions (metal-stack/releases#254) @majst01 +* Update postgres to 14.19 and 16.10 (metal-stack/releases#253) @majst01 +* Bump releases to version v0.21.10 (metal-stack/website#105) @metal-robot[bot] +* Handle A and AAAA records TTL properly in dnscache (metal-stack/firewall-controller#187) @mreiger +* docs: Add backgrounds to some diagrams for better visibility in dark mode (metal-stack/website#102) @GeertJohan +* Add metal-api reference (metal-stack/website#104) @iljarotar +* Add labels to issues and pull requests on creation (metal-stack/metal-robot#83) @Gerrit91 +* A bunch of updates including Go 1.25. (metal-stack/cli#8) @Gerrit91 +* UpdateRequests must have the Meta field set (metal-stack/api#43) @majst01 +* Refactor deprecated dark mode check (metal-stack/website#92) @simcod +* Generate table for planning meetings. (metal-stack/website#106) @Gerrit91 +* Bump tailwindcss from 4.1.12 to 4.1.13 (metal-stack/website#96) @dependabot[bot] +* Bump @mdx-js/react from 3.1.0 to 3.1.1 (metal-stack/website#86) @dependabot[bot] +* Bump @carbon/icons-react from 11.65.0 to 11.67.0 (metal-stack/website#108) @dependabot[bot] +* Bump @tailwindcss/postcss from 4.1.12 to 4.1.13 (metal-stack/website#109) @dependabot[bot] +* Bump typescript from 5.6.3 to 5.9.2 (metal-stack/website#85) @dependabot[bot] +* docs: add links to the umbrellas (metal-stack/website#107) @vknabel +* fix: broken links (metal-stack/website#110) @vknabel +* Detect UpdateRequests which do not specify a updated_at field (metal-stack/api#45) @majst01 +* Update to lightos v3.16.x (metal-stack/duros-go#47) @majst01 +* Introduce UpdateMeta for OptLock handling (metal-stack/api#46) @majst01 +* Ensure defined locking strategies only (metal-stack/api#47) @majst01 +* Bump axios from 1.11.0 to 1.12.2 (metal-stack/website#111) @dependabot[bot] +* Dependency updates. (metal-stack/metal-go#219) @Gerrit91 +* Bump metal-api to version v0.42.4 (metal-stack/metal-python#159) @metal-robot[bot] +* Bump metal-api to version v0.42.4 (metal-stack/metal-go#220) @metal-robot[bot] +* Next release (metal-stack/releases#252) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.2.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.2.md new file mode 100644 index 0000000..2722a09 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.2.md @@ -0,0 +1,21 @@ +--- +slug: /release-notes/v0.21.2 +title: v0.21.2 +sidebar_position: 7 +--- +# metal-stack v0.21.2 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.2](https://github.com/metal-stack/releases/releases/tag/v0.21.2) +## General +* [Gardener v1.111](https://github.com/gardener/gardener/releases/tag/v1.111.0) +## Component Releases +### metal-ccm v0.9.6 +* on update of a LoadBalancer service, untag old ip addresses, if any exist (metal-stack/metal-ccm#111) @mwennrich +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.21.1 (metal-stack/docs#260) @metal-robot[bot] +* Update mini-lab (metal-stack/cluster-api-provider-metal-stack#84) @vknabel +* Update dependencies and migrate to golangci-lint v2 (metal-stack/metal-go#209) @majst01 +* Next release (metal-stack/releases#223) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.3.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.3.md new file mode 100644 index 0000000..960d8e5 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.3.md @@ -0,0 +1,52 @@ +--- +slug: /release-notes/v0.21.3 +title: v0.21.3 +sidebar_position: 6 +--- +# metal-stack v0.21.3 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.3](https://github.com/metal-stack/releases/releases/tag/v0.21.3) +## General +* [Gardener v1.112](https://github.com/gardener/gardener/releases/tag/v1.112.0) + +## Required Actions +* In order to roll out Gardener v1.112, it is required to re-generate the admin kubeconfig of the virtual garden and make the admin user belong to gardener seeds group. Otherwise, the Gardenlets, which currently use this admin kubeconfig, are not able to reconcile the seeds anymore. + + A template of how to generate the certificate for the admin kubeconfig can be looked up in https://github.com/metal-stack/mini-lab/pull/233. Existing admin kubeconfigs with this approach still work but they cannot modify resources like `ConfigMaps` anymore in the virtual garden. + + Please note, that this approach is only a temporary workaround until we migrated our setup to the Gardener Operator. This is planned after we released support with Gardener v1.113. After this, the admin kubeconfig will be managed differently through the operator and it will also be rotated automatically. + +## Component Releases +### node-init v0.1.7 +* Wrap errors for better understanding (metal-stack/node-init#16) @majst01 +### helm-charts v0.4.23 +* increase default memory limit for wal-g-exporter (metal-stack/helm-charts#119) @TLINDEN +### metal-roles v0.15.15 +* Configure default value for backup objects to keep in `metal-roles` (metal-stack/metal-roles#370) @simcod +* Create seed cluster role after starting up the virtual garden. (metal-stack/metal-roles#407) @Gerrit91 +* Adaptions for g/g v1.111. (metal-stack/metal-roles#406) @Gerrit91 +### mini-lab v0.4.4 +* Put virtual-garden admin into seeds group. (metal-stack/mini-lab#233) @Gerrit91 +* Lower default for backup objects (metal-stack/mini-lab#232) @simcod +* Add metal-apiserver as preview in the mini-lab (metal-stack/mini-lab#231) @majst01 +* Fix semver image of ubuntu (metal-stack/mini-lab#229) @majst01 +* Build images before running integration tests. (metal-stack/mini-lab#230) @Gerrit91 +* fix: warning for missing metalctl hmac auth type (metal-stack/mini-lab#224) @vknabel +* fix: include missing metal auth type in compose.yaml (metal-stack/mini-lab#222) @vknabel +* Add target to transpile ignition userdata (metal-stack/mini-lab#220) @Gerrit91 +* Configuring auditing with timescaledb. (metal-stack/mini-lab#217) @Gerrit91 +* Dualstack support In Progress (metal-stack/mini-lab#208) @majst01 +* Fix routing for flavor CAPMS (metal-stack/mini-lab#218) @robertvolkmann +* Use the same bridge for the mgmt network and external connectivity (metal-stack/mini-lab#216) @robertvolkmann +* Test on latest OS images. (metal-stack/mini-lab#214) @Gerrit91 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.21.2 (metal-stack/docs#261) @metal-robot[bot] +* Update node-exporter to v1.9.1 (metal-stack/metal-images#293) @majst01 +* Migrate to golangci-lint-v2 (metal-stack/metal-images#294) @majst01 +* Remove default project. (metal-stack/api#3) @Gerrit91 +* Go 1.24 (metal-stack/nftables-exporter#32) @majst01 +* Kernel 6.12.22 for ubuntu and firewall (metal-stack/metal-images#295) @majst01 +* Next release (metal-stack/releases#224) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.4.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.4.md new file mode 100644 index 0000000..94befef --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.4.md @@ -0,0 +1,31 @@ +--- +slug: /release-notes/v0.21.4 +title: v0.21.4 +sidebar_position: 5 +--- +# metal-stack v0.21.4 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.4](https://github.com/metal-stack/releases/releases/tag/v0.21.4) +## General +* [Gardener v1.113](https://github.com/gardener/gardener/releases/tag/v1.113.0) + +## Component Releases +### masterdata-api v0.11.9 +* Do not allow to update the tenant of a project (metal-stack/masterdata-api#116) @majst01 +* Fix misleading error messages (metal-stack/masterdata-api#117) @majst01 +### go-ipam v1.14.11 +* Update to golangci-lint v2 (metal-stack/go-ipam#176) @majst01 +### rethinkdb-exporter v0.1.4 +* Update to go-1.24 (metal-stack/rethinkdb-exporter#5) @majst01 +* Migrate to slog (metal-stack/rethinkdb-exporter#6) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.21.3 (metal-stack/docs#262) @metal-robot[bot] +* Bump golang.org/x/net from 0.33.0 to 0.36.0 (metal-stack/go-dhcp-relay#1) @dependabot[bot] +* Add a grype workflow for scheduled security scans (metal-stack/metal-images#296) @chbmuc +* Add ci/cd, smaller binary, test target, satisfy linter (metal-stack/go-dhcp-relay#2) @majst01 +* Simpler runcommand, smallish style (metal-stack/go-dhcp-relay#4) @majst01 +* change to urfavcli (metal-stack/go-dhcp-relay#5) @iljarotar +* Next release (metal-stack/releases#225) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.5.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.5.md new file mode 100644 index 0000000..5b48a3c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.5.md @@ -0,0 +1,151 @@ +--- +slug: /release-notes/v0.21.5 +title: v0.21.5 +sidebar_position: 4 +--- +# metal-stack v0.21.5 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.5](https://github.com/metal-stack/releases/releases/tag/v0.21.5) +## General +## Noteworthy +* The release vector is now available as an OCI artifact, which is signed using [cosign](https://github.com/sigstore/cosign). This is for now only preview but we are planning to apply signing to our metal-stack container images as well. In addition to that, we are also planning to release SBOMs along with these artifacts. Details are still being discussed, so we will keep you updated on this process in the upcoming releases. + + Many repositories are migrating to the docker meta action, which effectively changes the created container image tags slightly. Pull request image tags are created as `pr-`, the `latest` tag gets only produced on the latest release and not on the mainline, the mainline image is tagged after the branch name of the mainline (e.g. `main`). (metal-stack/releases#226) + +## Required Actions +* The `gardener-extension-admission-metal` now registers its mutating and webhook with a service reference instead of a webhook server url. Thus, it might happen that the rollout of the `gardener` role does not succeed on first try giving the following error: `tls: failed to verify certificate: x509: certificate is valid for gardener-extension-admission-metal.garden, not gardener-extension-admission-metal.garden.svc`. In this case, you might roll the virtual garden kube-apiserver instances and re-run the deployment. + +* A bug has been fixed in the backup-restore-sidecar that occurred when the backup-restore-sidecar was configured to store multiple backups in the same bucket with different object prefixes. The sidecar now creates individual lifecycle rules for the object prefixes such that they do not overwrite each others configurations. + + If you use such a configuration, it is required to clean up the old lifecycle rule that does not match an object prefix after rolling out this version of the backup-restore-sidecar. ([release notes](https://github.com/metal-stack/backup-restore-sidecar/releases/tag/v0.11.1)) + +* The new `sonic-config` role is to replace the existing `sonic` role. Read the [sonic-config README](https://github.com/metal-stack/metal-roles/blob/v0.15.17/partition/roles/sonic-config/README.md) for a migration guide from the old sonic role to the new sonic-config role. (metal-stack/metal-roles#390) +## cluster-api-provider-metal-stack +* The new Cluster API cluster template now requires `CONTROL_PLANE_IP` to be set. The Control Plane IP will no longer be attached automatically to control plane machines. + Rewrite your Cluster API cluster definition to include KubeVIP or alternatives. The images must replace `METAL_MACHINE_ASN` with the machine ASN number in the KubeVIP static pod configuration to be compatible with the default template. (metal-stack/cluster-api-provider-metal-stack#87) +* Existing clusters using cluster-provider-metal-stack need to manually update the tags of all cluster associated entities in metal-stack. Before upgrading set `Cluster.spec.paused` to `true`. Then upgrade your metal-stack provider and manually patch every metal-stack machine: replace any `/` with a `.` within the value of the tags `metal-stack.infrastructure.cluster.x-k8s.io/machine-resource` and `metal-stack.infrastructure.cluster.x-k8s.io/cluster-resource` by using `metalctl machine edit $MACHINE_ID`. Now set `Cluster.spec.paused` to `false`. (metal-stack/cluster-api-provider-metal-stack#90) +* Make sure the metal-ccm is at least [v0.9.7](https://github.com/metal-stack/metal-ccm/releases/tag/v0.9.7) and its `METAL_CLUSTER_ID` env is set to `${NAMESPACE}.${CLUSTER_NAME}`. (metal-stack/cluster-api-provider-metal-stack#90) + +## Component Releases +### backup-restore-sidecar v0.11.1 +* Use individual lifecycle policies per object prefix to allow sidecars to act on a single bucket (metal-stack/backup-restore-sidecar#111) @simcod +* Fix typo in container name (metal-stack/backup-restore-sidecar#107) @simcod +* Migrate to aws-sdk-go-v2 (metal-stack/backup-restore-sidecar#81) @robertvolkmann +* Update go deps and proto creation (metal-stack/backup-restore-sidecar#99) @majst01 +* add streaming to upload/download of backup (metal-stack/backup-restore-sidecar#102) @ostempel +### metal-api v0.41.2 +* Add check to prevent migrating existing machine from one rack to another (metal-stack/metal-api#615) @iljarotar +* Migrate to golangci-lint v2 (metal-stack/metal-api#616) @majst01 +* Add masterdata-api version (metal-stack/metal-api#617) (#618) @BotondGalxc +### metal-roles v0.15.17 +* Allow providing backup encryption key for auditing-timescaledb. (metal-stack/metal-roles#413) @Gerrit91 +* Move encryption-key to secret (metal-stack/metal-roles#408) @ostempel +* Configurable `deletionGracePeriodHours` for `backupEntries` (metal-stack/metal-roles#409) @simcod +* Align to changes in metal-admission chart. (metal-stack/metal-roles#426) @Gerrit91 +* Run DHCP tests. (metal-stack/metal-roles#423) @Gerrit91 +* Add a new sonic-config role for SONiC configuration. (metal-stack/metal-roles#390) @iljarotar +* Removed unsupported taint keys (metal-stack/metal-roles#418) @robertvolkmann +* Add authenticationConfig for Gardener (metal-stack/metal-roles#417) @simcod +* Static machine ports (metal-stack/metal-roles#414) @mreiger +* Add option to configure `imagePullSecrets` when deploying valkey (metal-stack/metal-roles#412) @mac641 +### metalctl v0.18.1 +* Allow setting ca certificates when connecting to metal-api (metal-stack/metalctl#279) @mac641 +* Update linter to v2 and fix all new warnings (metal-stack/metalctl#283) @majst01 +* Add SHA512 checksums (metal-stack/metalctl#280) @mac641 +* Small improvements for switch and tenants table. (metal-stack/metalctl#282) @Gerrit91 +### metal-bmc v0.5.8 +* Update to go-1.24 and golangci-lint v2 (metal-stack/metal-bmc#78) @majst01 +* Update go deps and gh actions (metal-stack/metal-bmc#72) @majst01 +* Try to use docker/meta for tag creation (metal-stack/metal-bmc#79) @majst01 +* Push tags with v prefix (metal-stack/metal-bmc#80) @majst01 +### masterdata-api v0.11.11 +* Bump golang.org/x/net from 0.37.0 to 0.38.0 (metal-stack/masterdata-api#120) @[dependabot[bot]](https://github.com/apps/dependabot) +* Add version endpoint (metal-stack/masterdata-api#119) @BotondGalxc +* Version grpc client (metal-stack/masterdata-api#121) @BotondGalxc +### droptailer v0.2.18 +* Update to go-1.24 and golangci-lint v2 (metal-stack/droptailer#43) @majst01 +### ansible-common v0.6.13 +* Add wantedby var to systemd service (metal-stack/ansible-common#31) @iljarotar +### gardener-extension-provider-metal v0.25.14 +* Print error message when decoding cp config does not work. (metal-stack/gardener-extension-provider-metal#454) @Gerrit91 +* Release Helm OCI artifacts (metal-stack/gardener-extension-provider-metal#455) @Gerrit91 +* Push all container tags. (metal-stack/gardener-extension-provider-metal#456) @Gerrit91 +* Again more fixes with the meta action. 😔 (metal-stack/gardener-extension-provider-metal#457) @Gerrit91 +### sonic-configdb-utils v0.2.2 +* Output generated config_db.json to different file than the current one (metal-stack/sonic-configdb-utils#13) @iljarotar +* Adjust config parameters and improve documentation (metal-stack/sonic-configdb-utils#14) @iljarotar +* Correctly deal with empty mclag values (metal-stack/sonic-configdb-utils#8) @iljarotar +* Allow specifying custom features (metal-stack/sonic-configdb-utils#7) @iljarotar +* add split-unified mode (metal-stack/sonic-configdb-utils#5) @iljarotar +### metal-ccm v0.9.7 +* fix: do not abort on tag update failure (metal-stack/metal-ccm#115) @vknabel +### helm-charts v0.4.24 +* Postgreslet next release (metal-stack/helm-charts#120) @eberlep +### gardener-extension-dns-powerdns v0.7.2 +* Release Helm OCI artifacts + Revendor g/g v1.113. (metal-stack/gardener-extension-dns-powerdns#10) @Gerrit91 +### gardener-extension-backup-s3 v0.7.2 +* Release Helm OCI artifacts and revendor g/g v1.113. (metal-stack/gardener-extension-backup-s3#15) @Gerrit91 +### os-metal-extension v0.8.8 +* Release Helm OCI artifacts. (metal-stack/os-metal-extension#59) @Gerrit91 +### gardener-extension-csi-driver-lvm v0.1.4 +* Release Helm OCI artifacts. (metal-stack/gardener-extension-csi-driver-lvm#12) @Gerrit91 +### gardener-extension-audit v0.1.13 +* Release Helm OCI artifacts and revendor g/g v1.113. (metal-stack/gardener-extension-audit#43) @Gerrit91 +### metal-deployment-base v0.7.7 +* Prefer IPv4 dns lookups over IPv6. (metal-stack/metal-deployment-base#39) @Gerrit91 +### duros-controller v0.11.5 +* Lb csi v1.18 (metal-stack/duros-controller#90) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Add section how to recable a machine to another switch pair. (metal-stack/docs#257) @Gerrit91 +* Allow setting tls.ClientConfig when creating new client (metal-stack/metal-go#205) @mac641 +* Bump metal-api to version v0.41.1 (metal-stack/metal-python#152) @metal-robot[bot] +* Bump metal-api to version v0.41.1 (metal-stack/metal-go#210) @metal-robot[bot] +* Bump releases to version v0.21.4 (metal-stack/docs#263) @metal-robot[bot] +* Prepare for release vector (metal-stack/go-dhcp-relay#6) @iljarotar +* Update to go-1.24 and golangci-lint v2 (metal-stack/metal-networker#122) @majst01 +* Update dependencies. (metal-stack/metallb-health-sidecar#3) @Gerrit91 +* Add information about backup lifecycle rules and encryption (metal-stack/docs#264) @simcod +* Rename dhcp-server flag and change help text (metal-stack/go-dhcp-relay#7) @iljarotar +* Cleanup worlflow file (metal-stack/go-dhcp-relay#8) @iljarotar +* Bump golang.org/x/net from 0.37.0 to 0.38.0 (metal-stack/metal-lib#178) @dependabot[bot] +* MEP-16 Firewall Support for Cluster API Provider (metal-stack/docs#255) @vknabel +* Update debian and firewall kernel (metal-stack/metal-images#300) @majst01 +* Use KubeVIP Load Balancing for Control Planes. (metal-stack/cluster-api-provider-metal-stack#87) @vknabel +* Bump the metadata.yaml (metal-stack/cluster-api-provider-metal-stack#88) @vknabel +* Bump metal-api to version v0.41.2 (metal-stack/metal-python#153) @metal-robot[bot] +* Bump metal-api to version v0.41.2 (metal-stack/metal-go#211) @metal-robot[bot] +* Implement auditing memory backend for dev purposes. (metal-stack/metal-lib#179) @Gerrit91 +* Allow search for status code 0. (metal-stack/metal-lib#180) @Gerrit91 +* Update cri droptailer tailscale (metal-stack/metal-images#301) @majst01 +* Update to go-1.24 and linter v2, also better error message (metal-stack/security#61) @majst01 +* Describe Tailscale for cluster ingress in an evaluation setup (metal-stack/docs#265) @BotondGalxc +* Update debian Kernel (metal-stack/metal-images#302) @majst01 +* Metallb BGPPeers are generated for each node and don't have to be created manually (metal-stack/cluster-api-provider-metal-stack#91) @vknabel +* Change Cluster ID to be a valid label value (metal-stack/cluster-api-provider-metal-stack#90) @vknabel +* Kernel 6.12.28 for ubuntu and firewall (metal-stack/metal-images#303) @majst01 +* Update to go-1.24.3 (metal-stack/builder#82) @majst01 +* Implement audit backend for Splunk. (metal-stack/metal-lib#167) @Gerrit91 +* First code review (metal-stack/gardener-extension-ontap#3) @majst01 +* Default add options manager (metal-stack/gardener-extension-ontap#4) @Honigeintopf +* Update gardener to 1.114 (metal-stack/gardener-extension-ontap#5) @majst01 +* remove fmt.Printf, use structured logging, unexport consts (metal-stack/gardener-extension-ontap#6) @majst01 +* Unexport, remove unneeded parameters, remove common pkg (metal-stack/gardener-extension-ontap#7) @majst01 +* Introduce svnManager to reuse clients and logger (metal-stack/gardener-extension-ontap#8) @majst01 +* Update deps, more enum funcs (metal-stack/api#4) @majst01 +* Remove default project part 2. (metal-stack/api#5) @Gerrit91 +* Fix linting issues. (metal-stack/cli#2) @Gerrit91 +* Update debian kernel (metal-stack/metal-images#305) @majst01 +* Migrate to linter v2, prove registry v3 compatibility, update go modules (metal-stack/oci-mirror#13) @majst01 +* Include SBOM in the container image (metal-stack/cluster-api-provider-metal-stack#89) @mac641 +* Add gardener-operator related release vector components. (metal-stack/releases#229) @Gerrit91 +* Fix firewall Dockerfile to include SEMVER_PATCH in base image version (metal-stack/metal-images#308) @mwennrich +* remove SEMVER_PATCH_DIR from TARGET_PATH (metal-stack/metal-images#309) @mwennrich +* use frr 10.3 from frr-stable (metal-stack/metal-images#307) @mwennrich +* Ensure systemd-networkd-wait-online works properly (metal-stack/metal-networker#123) @robertvolkmann +* Ensure systemd-networkd-wait-online works properly (metal-stack/metal-images#304) @robertvolkmann +* Complete Network Services for api and admin (metal-stack/api#2) @majst01 +* Fix debian-nvidia Dockerfile to include SEMVER_PATCH in base image version (metal-stack/metal-images#310) @mwennrich +* Kernel 6.12.30 for ubuntu and firewall, 6.1.0-37 for debian (metal-stack/metal-images#311) @majst01 \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.6.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.6.md new file mode 100644 index 0000000..872812f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.6.md @@ -0,0 +1,129 @@ +--- +slug: /release-notes/v0.21.6 +title: v0.21.6 +sidebar_position: 3 +--- +# metal-stack v0.21.6 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.6](https://github.com/metal-stack/releases/releases/tag/v0.21.6) +## General +* [Gardener v1.114](https://github.com/gardener/gardener/releases/tag/v1.114.0) +## Required Actions +* Before rolling out this version make sure there are no shoots anymore with K8s `< 1.27`. +* Before updating to this version, make sure that no shoot has the RestrictEgress feature gate set. (metal-stack/gardener-extension-provider-metal#460) +## Noteworthy +* It is now possible to deploy the gardener operator through the metal-stack deployment roles. In case you use the Gardener integration of metal-stack, please check out the new deployment roles because the existing `gardener` role is going to be deprecated soon. Migration path is described in the new `gardener-operator` role and can be done with Gardener v1.119. (metal-stack/metal-roles#422) +* Upgrading postgres databases from 12-alpine to 13-alpine is not possible because of library differences in icu-lib. + The solution is to upgrade to a older 14.10-alpine which has the same icu-lib version as 12-alpine + and then update to 14.18-alpine or newer which does not require to run pg_upgrade. + It is also recommended to pin the original database to postgres:12.22-alpine to ensure the latest minor. + This approach will be applied through our release vector in the upcoming releases of metal-stack. (metal-stack/backup-restore-sidecar#116) +## Breaking Changes +* As symlinks that bring defaults into the role scope (including the release vector mapping) were removed from the metal-roles repository, it might be required to adjust your playbooks. In case you used simply `metal-roles` to bring these variables into the role scope, this now needs to be changed to the new defaults location at `metal-roles/common/roles/defaults`. +* The release vector variables `gardener_networking_calico_image_*`, `gardener_networking_cilium_image_*`, `gardener_shoot_cert_service_image_*` and `gardener_shoot_dns_service_image_*` were renamed. Usually, these variables are being set automatically through `setup_yaml` and there is nothing to do. However, please check if you have an existing overwrite and adapt accordingly. (metal-stack/metal-roles#422) +* The deprecated RestrictEgress feature gate has been removed. (metal-stack/gardener-extension-provider-metal#460) +## Component Releases +### metal-apiserver v0.0.3 +* Add test coverage reporting (metal-stack/metal-apiserver#37) @majst01 +* Fix log interceptor. (metal-stack/metal-apiserver#33) @Gerrit91 +* Fix datastore migration not working. (metal-stack/metal-apiserver#34) @Gerrit91 +* Use new enum helpers for file system layouts. (metal-stack/metal-apiserver#31) @Gerrit91 +* Cleanup unnecessary json tags in image struct. (metal-stack/metal-apiserver#30) @Gerrit91 +* Adding more healthchecks. (metal-stack/metal-apiserver#29) @Gerrit91 +* Introduce log interceptor. (metal-stack/metal-apiserver#16) @Gerrit91 +* Add useful validation helper (metal-stack/metal-apiserver#28) @majst01 +* Adapt to API removing default project. (metal-stack/metal-apiserver#27) @Gerrit91 +* Use uuidv7 for entity ids, speed up build (metal-stack/metal-apiserver#26) @majst01 +* Add VRF and ASN pools. (metal-stack/metal-apiserver#25) @Gerrit91 +* Create container tags through meta action. (metal-stack/metal-apiserver#24) @Gerrit91 +* Simplify generic datastore creation for tests (metal-stack/metal-apiserver#21) @majst01 +* Improve function signature for entity updates. (metal-stack/metal-apiserver#17) @Gerrit91 +* Finalize asynq deletion implementation (metal-stack/metal-apiserver#13) @majst01 +* Network services (metal-stack/metal-apiserver#14) @majst01 +* include sbom in container image (metal-stack/metal-apiserver#38) @mac641 +### pixie v0.3.6 +* include sbom in container image (metal-stack/pixie#35) @mac641 +* Update to go-1.24, linter v2 and satisfy new linter warnings (metal-stack/pixie#33) @majst01 +### go-ipam v1.14.12 +* Add a NewTestserver helper and fix context handling in tests (metal-stack/go-ipam#182) @majst01 +* include sbom in container image (metal-stack/go-ipam#181) @mac641 +* Update deps and fix cli not able to connect to server by default (metal-stack/go-ipam#179) @majst01 +### metal-roles v0.17.4 +* Publish as OCI artifact. (metal-stack/metal-roles#427) @Gerrit91 +* Replace symlinks by role dependencies. (metal-stack/metal-roles#429) @Gerrit91 +* feat: remove unused meilisearch (metal-stack/metal-roles#428) @vknabel +* fix: json-file logs for bmc #424 (metal-stack/metal-roles#425) @vknabel +* Provide missing role meta for metal-python. (metal-stack/metal-roles#432) @Gerrit91 +* Role to deploy the Gardener Operator (metal-stack/metal-roles#422) @Gerrit91 +* Default ipv4 prefix for headscale was malformed (metal-stack/metal-roles#438) @majst01 +* Allow the Soil to be visible in the Gardener Dashboard (metal-stack/metal-roles#419) @robertvolkmann +* Use correct variable to reference the CSI driver LVM repository (metal-stack/metal-roles#437) @robertvolkmann +* Support ACLs and make it work with newer headscale (metal-stack/metal-roles#439) @majst01 +* Add patched node-agent (metal-stack/metal-roles#440) @majst01 +* Remove mini-lab patches from Gardener role. (metal-stack/metal-roles#442) @Gerrit91 +### gardener-extension-audit v0.1.14 +* Restart audit-webhook-backend StatefulSet on config change (metal-stack/gardener-extension-audit#45) @dergeberl +* include sbom in container image (metal-stack/gardener-extension-audit#44) @mac641 +### ansible-common v0.7.0 +* Actually run tests in CI and provide common Gardener Operator modules (metal-stack/ansible-common#32) @Gerrit91 +### gardener-extension-provider-metal v0.26.0 +* Update to g/g v1.113. (metal-stack/gardener-extension-provider-metal#453) @Gerrit91 +* include sbom in container image (metal-stack/gardener-extension-provider-metal#458) @mac641 +* Remove deprecated RestrictEgress featureGate (metal-stack/gardener-extension-provider-metal#460) @mwennrich +### metal-ccm v0.9.8 +* Update deps, migrate to linter v2 (metal-stack/metal-ccm#118) @majst01 +* include sbom in container image (metal-stack/metal-ccm#117) @mac641 +* fix: missing error propagation (metal-stack/metal-ccm#116) @vknabel +### backup-restore-sidecar v0.12.0 +* Remove meilisearch support (metal-stack/backup-restore-sidecar#117) @majst01 +* include sbom in container image (metal-stack/backup-restore-sidecar#115) @mac641 +* Update to go-1.24 (metal-stack/backup-restore-sidecar#116) @majst01 +* Bump golang.org/x/net from 0.33.0 to 0.38.0 (metal-stack/backup-restore-sidecar#114) @[dependabot[bot]](https://github.com/apps/dependabot) +### duros-controller v0.11.7 +* Update duros-go to v3.15, lb-csi to v1.19 and all csi sidecars (metal-stack/duros-controller#95) @majst01 +* add security contexts for csi-driver containers and pods (metal-stack/duros-controller#96) @mwennrich +* include sbom in container image (metal-stack/duros-controller#94) @mac641 +* pointer package is removed (metal-stack/duros-controller#97) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Next release (metal-stack/releases#226) @metal-robot[bot] +* Always use full name of container images (metal-stack/releases#230) @robertvolkmann +* Bump releases to version v0.21.5 (metal-stack/docs#268) @metal-robot[bot] +* Use ghcr image repository reference (metal-stack/docs#269) @simcod +* Unexport more, refactor to use retry-go, support iscsi (metal-stack/gardener-extension-ontap#9) @majst01 +* Update kernel to 6.12.32 and frr to 10.3.1 (metal-stack/metal-images#314) @majst01 +* Do not break release, actual implementation of closing the issues was wrong (metal-stack/metal-images#313) @majst01 +* feat: remove unused meilisearch (metal-stack/releases#231) @vknabel +* Add handler to add issues and pull requests to a project. (metal-stack/metal-robot#76) @Gerrit91 +* Update protovalidate and mockery (metal-stack/api#9) @majst01 +* Move to new docs structure (metal-stack/docs#273) @Gerrit91 +* Update machine provisioning sequence diagram (metal-stack/docs#272) @simcod +* Prevent a nil pointer access in GetStringValue (metal-stack/api#10) @majst01 +* Add tenant scoped message validation (metal-stack/api#12) @majst01 +* Adapt DIY configuration to starter config (metal-stack/docs#289) @mwindower +* include sbom in container image (metal-stack/go-dhcp-relay#9) @mac641 +* include sbom as release asset (metal-stack/nftables-exporter#33) @mac641 +* include sbom as container image and as release asset (metal-stack/firewall-controller#201) @mac641 +* Update Ubuntu and Firewall kernel to 6.12.34 (metal-stack/metal-images#316) @majst01 +* include sbom in container image (metal-stack/metallb-health-sidecar#4) @mac641 +* include sbom in container image (metal-stack/metal-robot#78) @mac641 +* include sbom in container image (metal-stack/gardener-vpn-gateway#3) @mac641 +* include sbom in container image (metal-stack/mini-lab-ovmf#2) @mac641 +* include sbom in container image (metal-stack/chrony#4) @mac641 +* Fix build and update build deps. (metal-stack/rethinkdb-backup-tools-build#3) @Gerrit91 +* include sbom in container image (metal-stack/rethinkdb-backup-tools-build#2) @mac641 +* Update to lightos v3.15 (metal-stack/duros-go#46) @majst01 +* Information on planning meetings. (metal-stack/docs#292) @Gerrit91 +* Unwrap connect response body for audit indexing. (metal-stack/metal-lib#182) @Gerrit91 +* Bump github.com/gorilla/csrf from 1.7.2 to 1.7.3 (metal-stack/metal-lib#177) @dependabot[bot] +* Bump github.com/containerd/containerd from 1.7.20 to 1.7.27 (metal-stack/metal-lib#176) @dependabot[bot] +* Add section on release repo requirements. (metal-stack/docs#294) @Gerrit91 +* chore: update svg (metal-stack/docs#295) @vknabel +* include sbom in container image (metal-stack/gardener-extension-ontap#12) @mac641 +* Rename section and add information regarding rollback (metal-stack/docs#287) @simcod +* More tests (metal-stack/updater#12) @Azneo +* Update metal-lib (metal-stack/metal-images#318) @majst01 +* Update to go-1.24.4 and install typst (metal-stack/builder#84) @majst01 +* Next release (metal-stack/releases#232) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.7.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.7.md new file mode 100644 index 0000000..287bea9 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.7.md @@ -0,0 +1,25 @@ +--- +slug: /release-notes/v0.21.7 +title: v0.21.7 +sidebar_position: 2 +--- +# metal-stack v0.21.7 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.7](https://github.com/metal-stack/releases/releases/tag/v0.21.7) +## General +* [Gardener v1.115](https://github.com/gardener/gardener/releases/tag/v1.115.0) +## Component Releases +### gardener-extension-provider-metal v0.26.2 +* Update metallb to v0.15.2 (metal-stack/gardener-extension-provider-metal#464) @mwennrich +* update dependencies (metal-stack/gardener-extension-provider-metal#461) @mwennrich +* Configmap access for firewallcontroller (metal-stack/gardener-extension-provider-metal#449) @mreiger +* tighten rbac for kube-system:duros-controller (metal-stack/gardener-extension-provider-metal#463) @mwennrich +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Gardener v1.115.4 (metal-stack/releases#241) @majst01 +* Pin postgres to 12.22 (metal-stack/releases#240) @majst01 +* Remove systemd-resolved and configure DNS consistently (metal-stack/metal-images#320) @simcod +* Nvme Modprobe Of Worker Node (metal-stack/gardener-extension-ontap#20) @Honigeintopf +* Next release (metal-stack/releases#242) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.8.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.8.md new file mode 100644 index 0000000..2ea76b7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.8.md @@ -0,0 +1,88 @@ +--- +slug: /release-notes/v0.21.8 +title: v0.21.8 +sidebar_position: 1 +--- +# metal-stack v0.21.8 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.8](https://github.com/metal-stack/releases/releases/tag/v0.21.8) +## General +* [Gardener v1.116](https://github.com/gardener/gardener/releases/tag/v1.116.0) +## Component Releases +### backup-restore-sidecar v0.12.1 +* Allow setting a trusted CA certificate (metal-stack/backup-restore-sidecar#120) @robertvolkmann +* Migrate to new tablewriter (metal-stack/backup-restore-sidecar#118) @majst01 +### metal-apiserver v0.0.4 +* Update deps, adjust semver test to new version (metal-stack/metal-apiserver#50) @majst01 +* Proposal for improving repository generic interface (metal-stack/metal-apiserver#18) @Gerrit91 +* Enable rego linting, fix issues (metal-stack/metal-apiserver#48) @majst01 +* Rename store property accordingly (metal-stack/metal-apiserver#46) @majst01 +* Allow only prefixes on boundaries, prevent overlaps on update and fix update (metal-stack/metal-apiserver#42) @majst01 +* Simplify rethinkdb, less valkey syncs (metal-stack/metal-apiserver#43) @majst01 +* Error wrapping got lost with errorutil.Convert (metal-stack/metal-apiserver#36) @majst01 +* Use existing context where available (metal-stack/metal-apiserver#40) @majst01 +* Use Testserver from go-ipam (metal-stack/metal-apiserver#39) @majst01 +### metal-metrics-exporter v0.3.0 +* feat: add METAL_API_AUTH_TYPE to support read-only acciess via Metal-View auth type (metal-stack/metal-metrics-exporter#24) @mwennrich +* include sbom in container image (metal-stack/metal-metrics-exporter#23) @mac641 +* feat: add imageId to metal_machine_allocation_info metric (metal-stack/metal-metrics-exporter#22) @mwennrich +### gardener-extension-audit v0.1.15 +* Bump vpn-gateway to v0.1.1. (metal-stack/gardener-extension-audit#48) @Gerrit91 +### sonic-configdb-utils v0.3.0 +* Different way to retrieve platform information (metal-stack/sonic-configdb-utils#12) @iljarotar +* change license to MIT (metal-stack/sonic-configdb-utils#28) @iljarotar +* do not set autoneg if not defined (metal-stack/sonic-configdb-utils#27) @iljarotar +* include sbom in container image (metal-stack/sonic-configdb-utils#26) @mac641 +* FIX: Add all bgp ports to interfaces (metal-stack/sonic-configdb-utils#23) @iljarotar +* Pass device metadata as values instead of reading current config (metal-stack/sonic-configdb-utils#22) @iljarotar +* Vlan subinterfaces (metal-stack/sonic-configdb-utils#20) @iljarotar +* Adapt LLDP config keys to Edgecore 202111 branch (metal-stack/sonic-configdb-utils#19) @iljarotar +* Add switch to add VTEP with no VXLAN tunnel maps configured (metal-stack/sonic-configdb-utils#18) @iljarotar +* Remove vlan_members variable and always add members (metal-stack/sonic-configdb-utils#17) @iljarotar +* Improve support for Accton-AS4630-54TE and Accton-AS4625-54T (metal-stack/sonic-configdb-utils#16) @iljarotar +* Allow configuring ntp source interface and vrf (metal-stack/sonic-configdb-utils#15) @iljarotar +### metal-roles v0.17.7 +* Allow configuring the trusted certificate authority of the S3 storage service (metal-stack/metal-roles#444) @robertvolkmann +* add gepm defaults for pods and services cidr (metal-stack/metal-roles#448) @iljarotar +* Allow skipping certificate check for the virtual garden etcd (metal-stack/metal-roles#445) @robertvolkmann +* Sonic role: Enhancements to support multiple neighbors per interconnect (metal-stack/metal-roles#421) @mreiger +* Add loopback as default src address for BGP (metal-stack/metal-roles#430) @iljarotar +* disable-admission-plugins=PersistentVolumeLabels is deprecated since 1.31 (metal-stack/metal-roles#452) @majst01 +* Provide endpoints for gardener admission-metal. (metal-stack/metal-roles#454) @Gerrit91 +### gardener-extension-provider-metal v0.26.3 +* Revendor g/g v1.116. (metal-stack/gardener-extension-provider-metal#467) @Gerrit91 +* Remove now obsolete kubelet config modification. (metal-stack/gardener-extension-provider-metal#465) @Gerrit91 +### machine-controller-manager-provider-metal v0.1.26 +* Revendor MCM v0.57.1. (metal-stack/machine-controller-manager-provider-metal#41) @Gerrit91 +* include sbom in container image (metal-stack/machine-controller-manager-provider-metal#42) @mac641 +### metal-hammer v0.13.13 +* Changes for new supermicro support (metal-stack/metal-hammer#148) @simcod +* Update to go-1.24 and all go modules (metal-stack/metal-hammer#156) @majst01 +* Use `docker buildx build` for the metal-hammer image build (metal-stack/metal-hammer#155) @simcod +* Configure NTP servers earlier (metal-stack/metal-hammer#149) @simcod +* Fix CI, update actions (metal-stack/metal-hammer#161) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Gardener v1.116 (metal-stack/releases#244) @majst01 +* Bump releases to version v0.21.6 (metal-stack/docs#296) @metal-robot[bot] +* Bump releases to version v0.21.7 (metal-stack/docs#298) @metal-robot[bot] +* Patch management information for operators (metal-stack/docs#297) @simcod +* Release Helm OCI artifacts. (metal-stack/gardener-extension-ontap#17) @Honigeintopf +* add sbom section (metal-stack/docs#293) @mac641 +* Remove services, remove data lif (metal-stack/gardener-extension-ontap#24) @Honigeintopf +* CISO: Information about cryptography (metal-stack/docs#299) @simcod +* Introduce CISO section (metal-stack/docs#290) @simcod +* Add cryptsetup to debian (metal-stack/metal-images#322) @Honigeintopf +* Go-1.24 and replace zap with slog (metal-stack/gardener-vpn-gateway#2) @majst01 +* Size Services for api and admin (metal-stack/api#6) @majst01 +* Generate python client, add examples (metal-stack/api#16) @majst01 +* add docker build step and include sboms in container image and as release asset (metal-stack/cli#3) @mac641 +* Add a Token Refresh Service (metal-stack/api#15) @majst01 +* Support empty tokens, and tokens without exp set (metal-stack/api#17) @majst01 +* General section and slightly moving stuff (metal-stack/docs#300) @vknabel +* add multiple client functionality (metal-stack/ontap-go#4) @Honigeintopf +* Simplified api for token refresh config (metal-stack/api#18) @majst01 +* Do not disable user before password change (metal-stack/go-hal#73) @simcod +* Next release (metal-stack/releases#243) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.9.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.9.md new file mode 100644 index 0000000..6cb8a0a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.21/v0.21.9.md @@ -0,0 +1,188 @@ +--- +slug: /release-notes/v0.21.9 +title: v0.21.9 +sidebar_position: 1 +--- +# metal-stack v0.21.9 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.21.9](https://github.com/metal-stack/releases/releases/tag/v0.21.9) +## General +* [Gardener v1.117](https://github.com/gardener/gardener/releases/tag/v1.117.0) +## Required Actions +* We recommend running the `metal-metrics-exporter` with a `Metal-View` auth type. The new Ansible variable `monitoring_metal_api_authtype` was introduced. By default, `Metal-View` is used. Please make sure, to update the auth type, if you want to run the exporter with higher privileges or verify, if `monitoring_metal_api_hmac` is configured correctly to be a view HMAC. (metal-stack/metal-roles#449) +* Before deploying this version, all ONTAP storage classes in all affected shoots must be deleted, since storage classes are immutable. (metal-stack/gardener-extension-ontap#57) +* The container image `metalstack/builder` is not published on Docker Hub anymore. Please migrate to `ghcr.io/metal-stack/builder` in case you are using the image from Docker Hub. (metal-stack/builder#83) +## Breaking Changes +* The `audittailer` pod is now being deployed into the `kube-system` namespace and not anymore into the dedicated `audit` namespace. (metal-stack/gardener-extension-audit#50) +* In the audit extension, the splunk backend now validates the TLS hostname. Verify that your splunk backend uses a TLS certificate that matches the hostname. (metal-stack/gardener-extension-audit#51) +## Component Releases +### gardener-extension-ontap v0.2.3 +* Trident deployment refactor (metal-stack/gardener-extension-ontap#32) @Honigeintopf +* Create network interface on both nodes (metal-stack/gardener-extension-ontap#25) @Honigeintopf +* Remove services, remove data lif (metal-stack/gardener-extension-ontap#24) @Honigeintopf +* Release Helm OCI artifacts. (metal-stack/gardener-extension-ontap#17) @Honigeintopf +* Nvme Modprobe Of Worker Node (metal-stack/gardener-extension-ontap#20) @Honigeintopf +* include sbom in container image (metal-stack/gardener-extension-ontap#12) @mac641 +* Unexport more, refactor to use retry-go, support iscsi (metal-stack/gardener-extension-ontap#9) @majst01 +* Introduce svnManager to reuse clients and logger (metal-stack/gardener-extension-ontap#8) @majst01 +* Unexport, remove unneeded parameters, remove common pkg (metal-stack/gardener-extension-ontap#7) @majst01 +* remove fmt.Printf, use structured logging, unexport consts (metal-stack/gardener-extension-ontap#6) @majst01 +* Update gardener to 1.114 (metal-stack/gardener-extension-ontap#5) @majst01 +* Default add options manager (metal-stack/gardener-extension-ontap#4) @Honigeintopf +* First code review (metal-stack/gardener-extension-ontap#3) @majst01 +* Use new ontap-go metroclusterclient (metal-stack/gardener-extension-ontap#35) @Honigeintopf +* Add ctx to all api calls to ontap (metal-stack/gardener-extension-ontap#34) @Honigeintopf +* Add storage encryption labels (metal-stack/gardener-extension-ontap#22) @Honigeintopf +* first approach to create cwnp as mr manifests (metal-stack/gardener-extension-ontap#38) @Honigeintopf +* Bugfix for password requirement (metal-stack/gardener-extension-ontap#40) @Honigeintopf +* Update dependencies (metal-stack/gardener-extension-ontap#37) @majst01 +* Remove Aggregate (metal-stack/gardener-extension-ontap#41) @Honigeintopf +* Simplify controller configuration (metal-stack/gardener-extension-ontap#39) @majst01 +* distribute lifs on both nodes (metal-stack/gardener-extension-ontap#47) @Honigeintopf +* Template Secret (metal-stack/gardener-extension-ontap#44) @majst01 +* Allow volume expansion (metal-stack/gardener-extension-ontap#53) @majst01 +* change pause container from busybox to pause (metal-stack/gardener-extension-ontap#51) @mwennrich +* Create ontap-encrypted storageclass (metal-stack/gardener-extension-ontap#54) @majst01 +### gardener-extension-audit v0.2.2 +* change shoot-namespace to kube-system (metal-stack/gardener-extension-audit#50) @ostempel +* Splunk: Remove duplicate secret (metal-stack/gardener-extension-audit#46) @dergeberl +* Ensure audit-webhook-backend sts restart on changes to backend configuration (metal-stack/gardener-extension-audit#49) @MichaelEischer +* Add S3 as backend (metal-stack/gardener-extension-audit#47) @dergeberl +* Update fluentbit and enable tls.verify_hostname for splunk (metal-stack/gardener-extension-audit#51) @MichaelEischer +### metal-ansible-modules v0.2.11 +* Ship as OCI artifact. (metal-stack/metal-ansible-modules#22) @Gerrit91 +### ansible-common v0.7.2 +* Ship as OCI artifact. (metal-stack/ansible-common#38) @Gerrit91 +* Use appropriate shebang lines for ansible modules. (metal-stack/ansible-common#40) @Gerrit91 +### helm-charts v0.4.25 +* Make postgreslet anti affinity topology key configurable (metal-stack/helm-charts#128) @eberlep +* Next Postgreslet Release (metal-stack/helm-charts#127) @eberlep +* Postgreslet: Add dedicated fluentbit tag for the backup log (metal-stack/helm-charts#126) @eberlep +* Add pg_role metrics (metal-stack/helm-charts#124) @TLINDEN +* Add query to monitor pg_stat_wal_receiver (metal-stack/helm-charts#122) @eberlep +* Fix SQL error in postgres-exporter query config when executing WAL check on standby node (metal-stack/helm-charts#121) @TLINDEN +* use distinct on pg_stat_statements to avoid postgres-exporter crash (metal-stack/helm-charts#114) @TLINDEN +### metal-roles v0.17.13 +* add ontap to gardener-operator (metal-stack/metal-roles#446) @Honigeintopf +* Provide more roles for gardener operator setup. (metal-stack/metal-roles#436) @Gerrit91 +* add netapp/trident images to oci-mirror config (metal-stack/metal-roles#457) @mwennrich +* Make global Prometheus scrape parameters configurable (metal-stack/metal-roles#455) @simcod +* Remove unknown fields from new gardener roles. (metal-stack/metal-roles#458) @Gerrit91 +* feat: alertmanager additional rules and receivers (metal-stack/metal-roles#459) @vknabel +* Use `metal-view` as hmac default variable for `metal-metrics-exporter` (metal-stack/metal-roles#449) @simcod +* Adjust sonic-config role to new sonic-configdb-utils version (metal-stack/metal-roles#463) @iljarotar +* Fix sonic-config template (metal-stack/metal-roles#464) @iljarotar +### masterdata-api v0.12.0 +* Migrate away from deprecated wrappers (metal-stack/masterdata-api#81) @majst01 +* include sbom in container image (metal-stack/masterdata-api#124) @mac641 +* Fix duplicate memberships in tenant delete (metal-stack/masterdata-api#123) @iljarotar +### metalctl v0.18.3 +* use sha512 in updater to fix md5 checksum mismatch errors (metal-stack/metalctl#288) @mac641 +* Include SBOM into container image and as release asset (metal-stack/metalctl#286) @mac641 +* Upgrade metal-lib with new tableprinter version (metal-stack/metalctl#285) @BotondGalxc +### gardener-extension-backup-s3 v0.8.0 +* improve resource naming of chart by using fullname rather than the static gardener-extension-backup-s3 (metal-stack/gardener-extension-backup-s3#18) @nschad +* Harden deployment to comply with pod security standard "restricted" (metal-stack/gardener-extension-backup-s3#19) @MichaelEischer +### metal-api v0.42.2 +* Size services (metal-stack/metal-apiserver#49) @majst01 +* Log call duration if debug is true (metal-stack/metal-apiserver#56) @majst01 +* Token Refresh Service (metal-stack/metal-apiserver#51) @majst01 +* Spread only on same machine size. (metal-stack/metal-api#625) @Gerrit91 +* Include sbom in container image (metal-stack/metal-api#622) @mac641 +* Project is not used in size validation, remove it (metal-stack/metal-api#621) @majst01 +* Provide network type migration as preparation for MEP-4. (metal-stack/metal-api#620) @Gerrit91 +* Update masterdata-api depedency. (metal-stack/metal-api#627) @Gerrit91 +* Fix broken audit search. (metal-stack/metal-api#629) @Gerrit91 +* Ignore delayed buffered phoned home events during machine reclaim (metal-stack/metal-api#631) @iljarotar +### sonic-configdb-utils v0.4.1 +* Support different build branches (metal-stack/sonic-configdb-utils#30) @iljarotar +* yaml is not yml (metal-stack/sonic-configdb-utils#31) @iljarotar +### metal-core v0.13.0 +* Add vrf to vni mapping (metal-stack/metal-core#144) @iljarotar +* Read SONiC interfaces from ConfigDB (metal-stack/metal-core#161) @iljarotar +* Cleanup VLANs and VRFs on SONiC (metal-stack/metal-core#155) @iljarotar +* Graceful shutdown (metal-stack/metal-core#109) @robertvolkmann +* include sbom in container image (metal-stack/metal-core#157) @mac641 +* Bump golang.org/x/net from 0.35.0 to 0.38.0 (metal-stack/metal-core#154) @[dependabot[bot]](https://github.com/apps/dependabot) +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.21.8 (metal-stack/docs#303) @metal-robot[bot] +* replace md5sum using sha512sum (metal-stack/updater#15) @mac641 +* Workaround GitHub Pagination for releases (metal-stack/updater#18) @vknabel +* Update Postgres to 14.10 of ipam and masterdata (metal-stack/releases#246) @majst01 +* Introduce new cluster type tags (metal-stack/metal-lib#185) @thheinel +* Change ontap client to slice (metal-stack/ontap-go#5) @Honigeintopf +* Add OCI refs for ansible roles. (metal-stack/releases#248) @Gerrit91 +* Add cluster api provider metal stack (metal-stack/releases#245) @vknabel +* bump go to 1.24.x and golangci-lint-action to v8 (metal-stack/updater#17) @mac641 +* update Masterminds/semver to v3.4.0 (and other deps) (metal-stack/oci-mirror#15) @mwennrich +* include sbom in container image (metal-stack/gardener-extension-duros#3) @mac641 +* Upgrade Tablewriter to v1 (metal-stack/metal-lib#181) @BotondGalxc +* investigate and fix `invalid argument` error while checking location permissions (metal-stack/updater#19) @mac641 +* Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (metal-stack/metal-lib#183) @dependabot[bot] +* More infos on contents of the planning meeting and for contributions. (metal-stack/docs#305) @Gerrit91 +* Cumulus is not in release flow anymore. (metal-stack/docs#306) @Gerrit91 +* frr 10.4 was released but 10.3.1 is not installable anymore (metal-stack/metal-images#324) @majst01 +* Fix typo in the hardware network cards section (metal-stack/docs#308) @GeertJohan +* Add a generic python driver (metal-stack/api#21) @majst01 +* Fix python build if it is the first time (metal-stack/api#23) @majst01 +* Update available OS Images (metal-stack/docs#309) @majst01 +* Communication matrix (metal-stack/docs#307) @vknabel +* Provide information about used technologies and protocols (metal-stack/docs#302) @simcod +* Add infra switch service (metal-stack/api#24) @iljarotar +* Update to frr 10.4.1 and kernel mainline v6.12.41 (metal-stack/metal-images#332) @simcod +* machine api definitions for get, list and update (metal-stack/api#22) @majst01 +* Rename machine-role to machine-allocation-type which is more appropriate (metal-stack/api#28) @majst01 +* By accident machine-allocation-type was optional (metal-stack/api#29) @majst01 +* Update metal-lib, adopt tablewriter (metal-stack/cli#5) @majst01 +* Admin machine get and list (metal-stack/api#31) @majst01 +* Bump metal-api to version v0.41.3 (metal-stack/metal-python#154) @metal-robot[bot] +* Bump metal-api to version v0.41.3 (metal-stack/metal-go#214) @metal-robot[bot] +* Use yq docker image instead of local install (metal-stack/metal-go#212) @iljarotar +* Bump metal-api to version v0.42.0 (metal-stack/metal-python#155) @metal-robot[bot] +* Bump metal-api to version v0.42.0 (metal-stack/metal-go#215) @metal-robot[bot] +* MEP-17 global network view (metal-stack/docs#145) @majst01 +* Unify naming of reference fields (metal-stack/api#27) @majst01 +* Go 1.25 (metal-stack/builder#85) @majst01 +* Add duros extension (metal-stack/gardener-extension-duros#1) @ostempel +* Fix release drafter merges sections on common component prefixes. (metal-stack/metal-robot#86) @Gerrit91 +* Update to go-1.25 and mockery (metal-stack/api#32) @majst01 +* Small fork build improvements for issues handler. (metal-stack/metal-robot#88) @Gerrit91 +* Skip empty code blocks to be added to release draft. (metal-stack/metal-robot#89) @Gerrit91 +* Also support REQUIRED_ACTIONS along with ACTIONS_REQUIRED. (metal-stack/metal-robot#87) @Gerrit91 +* include SBOM in container image (metal-stack/oci-mirror#16) @mac641 +* Go 1.25 (metal-stack/firewall-controller#205) @majst01 +* introduce standard docker workflow and include sbom in container images (metal-stack/builder#83) @mac641 +* Remove useless query parameter, make partition require for admin machine list (metal-stack/api#33) @majst01 +* Remove last reinstall artifact (metal-stack/api#34) @majst01 +* include generating sbom in actions workflow (metal-stack/go-lldpd#30) @mac641 +* Fix link formatting for go-containerregistry (metal-stack/oci-mirror#17) @guettli +* Automatically remove triage label when changing item status. (metal-stack/metal-robot#82) @Gerrit91 +* Bump metal-api to version v0.42.1 (metal-stack/metal-python#156) @metal-robot[bot] +* Bump metal-api to version v0.42.1 (metal-stack/metal-go#216) @metal-robot[bot] +* Fix linting issues of new linter version. (metal-stack/metal-lib#189) @Gerrit91 +* Better deal with gRPC errors in auditing. (metal-stack/metal-lib#186) @Gerrit91 +* Auto generate first release (metal-stack/website#73) @Gerrit91 +* More realistic redirects (metal-stack/website#64) @vknabel +* fix: force redirects for domains (metal-stack/website#76) @vknabel +* Fix link to doc archive in nav. (metal-stack/website#75) @Gerrit91 +* docs: link to capms ref docs (metal-stack/website#77) @vknabel +* Minor updates on `README.md` (metal-stack/website#78) @Gerrit91 +* Go 1.25 (metal-stack/nftables-exporter#35) @majst01 +* fix: missing redirects and inconsistent urls (metal-stack/website#80) @vknabel +* Allow setting labels on projects and tenant requests. (metal-stack/api#36) @Gerrit91 +* Update connectpy (metal-stack/api#37) @majst01 +* Try is reserved in python (metal-stack/api#38) @majst01 +* fix: tag pagination and wrong month for post (metal-stack/website#84) @vknabel +* Use python sync client. (metal-stack/api#39) @Gerrit91 +* Bump metal-api to version v0.42.2 (metal-stack/metal-python#157) @metal-robot[bot] +* Bump metal-api to version v0.42.2 (metal-stack/metal-go#217) @metal-robot[bot] +* Remove unused try fsl response (metal-stack/api#40) @majst01 +* Remove old repository name occurrences. (metal-stack/website#81) @Gerrit91 +* Add labels to query requests where possible. (metal-stack/api#41) @Gerrit91 +* docs: proposal process (metal-stack/website#89) @vknabel +* Information about BMC user management (metal-stack/website#82) @simcod +* Check if user password change is necessary via ipmitool (metal-stack/go-hal#76) @simcod +* Next release (metal-stack/releases#247) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.0.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.0.md new file mode 100644 index 0000000..872f32c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.0.md @@ -0,0 +1,99 @@ +--- +slug: /release-notes/v0.22.0 +title: v0.22.0 +sidebar_position: 1 +--- +# metal-stack v0.22.0 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.22.0](https://github.com/metal-stack/releases/releases/tag/v0.22.0) +## General + +## Required Actions +* This release expects the migration to the Gardener Operator. Please read the migration notes [here](https://github.com/metal-stack/metal-roles/tree/master/control-plane/roles/gardener-operator#migration-path). +* The deployment-base image now comes with Ansible 11. The `ansible-core` was raised from `2.15.4` to `2.18.7`. We did not see any major issues with this update for our roles and playbooks. In case you encounter problems with the update, please adapt your playbooks or file an issue. You can always go back and use the previous release of `metal-deployment-base:v0.7.7` until we found a solution to your issue. Note that Python 2 is not supported anymore. You probably should take a look at the [porting guides](https://docs.ansible.com/ansible/latest/porting_guides/core_porting_guides.html) of Ansible, too. ([release notes](https://github.com/metal-stack/metal-deployment-base/releases/tag/v0.8.0)) +* Loopback addresses of all leaves must be known to all routers (and servers) that need to communicate with the leaves via default VRF. BGP or static routes must be established accordingly. (metal-stack/metal-core#168) +## Noteworthy +* The audit extension now scrapes the fluentbit v2 metrics, which are a superset of the v1 metrics, and also provides metrics for the storage use. Metric `process_start_time_seconds` is now called `fluentbit_process_start_time_seconds`. (metal-stack/gardener-extension-audit#56) +* Add missing securityContext controls in order to comply with the restricted Pod Security Standards policy. Move default serverPort to 10443. (metal-stack/gardener-extension-audit#57) +## Component Releases +### metal-core v0.13.5 +* Redistribute loopback address on SONiC (metal-stack/metal-core#165) @iljarotar +* Revert "Set loopback as source address in SONiC frr.conf (metal-stack/metal-core#159)" (#167) @iljarotar +* Revert "Redistribute loopback address on SONiC (metal-stack/metal-core#165)" (#166) @iljarotar +* Set Loopback0 address as default source address in frr.conf on SONiC Leaves (metal-stack/metal-core#168) @iljarotar +### gardener-extension-ontap v0.2.8 +* Use name of shoot to create user secret (metal-stack/gardener-extension-ontap#71) @Honigeintopf +### metal-deployment-base v0.8.0 +* Add metalstack.cloud CLI. (metal-stack/metal-deployment-base#45) @Gerrit91 +* Update dependencies. (metal-stack/metal-deployment-base#44) @Gerrit91 +* include sbom in container image (metal-stack/metal-deployment-base#41) @mac641 +### gardener-extension-audit v0.3.0 +* Helm chart: add missing securityContext to comply with restricted PSS… (metal-stack/gardener-extension-audit#57) @mstueer +* Enable storage metrics (metal-stack/gardener-extension-audit#56) @MichaelEischer +* Bump fluentbit version (metal-stack/gardener-extension-audit#55) @MichaelEischer +* Update README (adding S3 backend + notes to Cilium). (metal-stack/gardener-extension-audit#54) @Gerrit91 +### metal-apiserver v0.0.9 +* Enable end user e2e tests with multiple tenants (metal-stack/metal-apiserver#81) @majst01 +* Include proto validation during tests (metal-stack/metal-apiserver#77) @majst01 +* Add ip create benchmark as first step (metal-stack/metal-apiserver#83) @majst01 +* Update api to main (metal-stack/metal-apiserver#82) @majst01 +* Fix wrong project mapper function being used. (metal-stack/metal-apiserver#79) @Gerrit91 +* Properly log app version at launch. (metal-stack/metal-apiserver#78) @Gerrit91 +* Implement switch service get, create, update, delete (metal-stack/metal-apiserver#57) @iljarotar +* Adopt to breaking api changes (metal-stack/metal-apiserver#76) @majst01 +* Update dependencies, adopt breaking changes in validation (metal-stack/metal-apiserver#75) @majst01 +* UpdateRequest must now have Meta set (metal-stack/metal-apiserver#71) @majst01 +* Update to use masterdata membership namespaces. (metal-stack/metal-apiserver#72) @Gerrit91 +* Migrate to simple connect go (metal-stack/metal-apiserver#85) @majst01 +* Do not expose internal types from the repository package. (metal-stack/metal-apiserver#74) @Gerrit91 +### metal-roles v0.17.19 +* Add proper config map ref for shoot audit policy. (metal-stack/metal-roles#482) @Gerrit91 +* Fix typos (metal-stack/metal-roles#480) @majst01 +* Gardener operator review (metal-stack/metal-roles#481) @Gerrit91 +* Deploy seed-api-server config map on GCP. (metal-stack/metal-roles#483) @Gerrit91 +### cluster-api-provider-metal-stack v0.6.2 +* feat: integration tests (metal-stack/cluster-api-provider-metal-stack#94) @vknabel +* feat: bump images (metal-stack/cluster-api-provider-metal-stack#97) @vknabel +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Fix typos. (metal-stack/website#123) @Gerrit91 +* Use Slack join link instead of slack workspace link. (metal-stack/website#124) @Gerrit91 +* Migrate to docker bake and include sboms in generated images (metal-stack/metal-images#341) @mac641 +* Bump releases to version v0.21.11 (metal-stack/website#121) @metal-robot[bot] +* Fix bad link on blog article. (metal-stack/website#126) @Gerrit91 +* Adopt to recent api changes (metal-stack/cli#9) @majst01 +* fix build pipeline by ensuring tarball output directory is created properly (metal-stack/metal-images#353) @mac641 +* ConnectPy is now moved to the connect org (metal-stack/api#48) @majst01 +* Add definitions for api and admin switch services (metal-stack/api#30) @iljarotar +* Predefined validation rules (metal-stack/api#52) @majst01 +* Use client interceptor instead of RoundTripper for auth header injection (metal-stack/api#51) @majst01 +* Log only if logger is set (metal-stack/api#53) @majst01 +* Missing switch port status (metal-stack/api#54) @iljarotar +* Switch cannot be updated (metal-stack/api#55) @iljarotar +* Simplify and fix some proto validations (metal-stack/api#57) @majst01 +* Simplify validation tests (metal-stack/api#56) @majst01 +* Fix validation isssues found in apiserver (metal-stack/api#59) @majst01 +* Switch from ignite to cloud-hypervisor (metal-stack/metal-images#348) @mwindower +* Add switch ID to heartbeat (metal-stack/api#58) @iljarotar +* Remove periodic vulnerability scans, we have sboms now (metal-stack/metal-images#356) @majst01 +* Go 1.25.3 (metal-stack/builder#86) @majst01 +* Token with labels, console token is user token now (metal-stack/api#60) @majst01 +* IPIssues is not yet decided (metal-stack/api#61) @majst01 +* update to latest main of parent project (metal-stack/monsoon#1) @ostempel +* Make switch port desired state optional (metal-stack/api#62) @iljarotar +* Migrate to simple (metal-stack/api#50) @majst01 +* Update to simple (metal-stack/cli#10) @majst01 +* generate unique files in /etc/nvme/ (metal-stack/metal-images#360) @mwennrich +* Bump lint-staged from 16.1.6 to 16.2.4 (metal-stack/website#127) @dependabot[bot] +* Bump @docusaurus/tsconfig from 3.8.1 to 3.9.2 (metal-stack/website#131) @dependabot[bot] +* Bump @scalar/api-reference-react from 0.7.45 to 0.8.1 (metal-stack/website#130) @dependabot[bot] +* Add admin tenant cmds. (metal-stack/cli#12) @Gerrit91 +* fix-docs-links (metal-stack/cli#7) @BotondGalxc +* Update debian and ubuntu kernel (metal-stack/metal-images#362) @majst01 +* adjust to debian and add ci (metal-stack/monsoon#2) @ostempel +* CAPMS images (metal-stack/metal-images#352) @mac641 +* publish capms images as part of release as well (metal-stack/metal-images#363) @mac641 +* Fix link to suricata (metal-stack/firewall-controller#206) @GeertJohan +* Next release (metal-stack/releases#255) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.1.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.1.md new file mode 100644 index 0000000..5f624e4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.1.md @@ -0,0 +1,105 @@ +--- +slug: /release-notes/v0.22.1 +title: v0.22.1 +sidebar_position: 1 +--- +# metal-stack v0.22.1 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.22.1](https://github.com/metal-stack/releases/releases/tag/v0.22.1) +## General +## Noteworthy +* In case of outputs that ingest audit logs too slow, the behavior of gardener-extension-audit now depends on the configured webhookMode. The modes `batch` and `blocking` configure fluentbit such that audit log messages may be dropped if the audit log backend cannot ingest them in time. The mode `blocking-strict` instead causes all kube-apiserver requests to fail in this case. Fluentbit buffers up to storage.max_chunks_up * 2M (roughly 900MB). ([release notes](https://github.com/metal-stack/gardener-extension-audit/releases/tag/v0.4.0)) +## Breaking Changes +* The `gardener-monitoring-certs` was updated to work with the Gardener operator virtual garden. The parametrization for the role has breaking changes. Please adapt your playbooks accordingly if you use this role. (metal-stack/metal-roles#487) +## Component Releases +### csi-driver-lvm v0.7.0 +* Pod eviction controller (metal-stack/csi-driver-lvm#117) @ostempel +* Update to go-1.25 (metal-stack/csi-driver-lvm#122) @majst01 +* add matrix multiplatform build (metal-stack/csi-driver-lvm#119) @ostempel +* include sbom in container image (metal-stack/csi-driver-lvm#118) @mac641 +* Bump golang.org/x/net from 0.37.0 to 0.38.0 (metal-stack/csi-driver-lvm#115) @[dependabot[bot]](https://github.com/apps/dependabot) +### gardener-extension-provider-metal v0.27.1 +* Allow PVC deletion on eviction with csi-driver-lvm ETCD volumes. (metal-stack/gardener-extension-provider-metal#468) @Gerrit91 +* Fix metallb webhook (metal-stack/gardener-extension-provider-metal#475) @Gerrit91 +* restrict ccm rbac for nodes (metal-stack/gardener-extension-provider-metal#478) @mwennrich +### gardener-extension-ontap v0.2.9 +* Update Torc (metal-stack/gardener-extension-ontap#73) @Honigeintopf +### metal-roles v0.17.25 +* Allow configuring csi-driver-lvm ETCD volume evictions on GEPM. (metal-stack/metal-roles#477) @Gerrit91 +* Cleanup release vector mapping. (metal-stack/metal-roles#489) @Gerrit91 +* Remove valkey migration steps (metal-stack/metal-roles#488) @Gerrit91 +* Add capms controller to release vector mapping. (metal-stack/metal-roles#485) @Gerrit91 +* Fix shoot template when auditing + csi-driver-lvm extension is enabled. (metal-stack/metal-roles#492) @Gerrit91 +* Add `gardener-partition-proxy` role (metal-stack/metal-roles#491) @Gerrit91 +* Update `gardener-monitoring-certs` role to work with operator. (metal-stack/metal-roles#487) @Gerrit91 +* Adaptions for g/g v1.120 + drop deprecated `gardener` role. (metal-stack/metal-roles#486) @Gerrit91 +* Remove debugging output from nsq role. (metal-stack/metal-roles#474) @Gerrit91 +* Bump monitoring to match current Gardener version. (metal-stack/metal-roles#476) @Gerrit91 +* Fix issue with removal of gardenlet image overwrites. (metal-stack/metal-roles#494) @Gerrit91 +* CreateCRDs for shoot-dns-service extension. (metal-stack/metal-roles#495) @Gerrit91 +* Update oci-mirror image semver constraints for isolated clusters (metal-stack/metal-roles#496) @mwennrich +* Add new csi-driver-lvm-controller image to oci-mirror. (metal-stack/metal-roles#497) @Gerrit91 +### os-metal-extension v0.8.9 +* Go 1.25 (metal-stack/os-metal-extension#62) @majst01 +* Trim down README.md. (metal-stack/os-metal-extension#61) @Gerrit91 +* include sbom in container image (metal-stack/os-metal-extension#60) @mac641 +### duros-controller v0.11.8 +* Update duros-go and use go-1.25 (metal-stack/duros-controller#98) @majst01 +### gardener-extension-audit v0.4.0 +* Fix storage size overflow (metal-stack/gardener-extension-audit#61) @MichaelEischer +### helm-charts v0.5.1 +* Postgreslet next release (metal-stack/helm-charts#134) @eberlep +### droptailer v0.2.19 +* Update to go-1.25, debian13 (metal-stack/droptailer#45) @majst01 +* include sbom in container image (metal-stack/droptailer#44) @mac641 +### cluster-api-provider-metal-stack v0.6.3 +* Add `--namespace` flag to watch only specific namespace if necessary. (metal-stack/cluster-api-provider-metal-stack#114) @Gerrit91 +* Cluster K8s Upgrade (metal-stack/cluster-api-provider-metal-stack#105) @simcod +* fix(machine): give load balancers some time after control plane machine deletion (metal-stack/cluster-api-provider-metal-stack#115) @vknabel +* test: reference new templates (metal-stack/cluster-api-provider-metal-stack#113) @vknabel +* Use calico flavor for tests (metal-stack/cluster-api-provider-metal-stack#112) @simcod +* Add first flavors for cluster templates. (metal-stack/cluster-api-provider-metal-stack#110) @Gerrit91 +* Add Calico `HelmChartProxy` and metal-ccm `ClusterResourceSet` sample. (metal-stack/cluster-api-provider-metal-stack#106) @Gerrit91 +* test: teardown and slight refactorings (metal-stack/cluster-api-provider-metal-stack#104) @vknabel +* docs: updated readme for current status (metal-stack/cluster-api-provider-metal-stack#109) @vknabel +* Integration test for HA cluster setup (metal-stack/cluster-api-provider-metal-stack#103) @simcod +* Integration Tests: `clusterctl move` (metal-stack/cluster-api-provider-metal-stack#102) @simcod +### gardener-extension-csi-driver-lvm v0.1.6 +* add eviction controller to csi-driver-lvm (metal-stack/gardener-extension-csi-driver-lvm#16) @ostempel +* docs: improved docs regarding migration (metal-stack/gardener-extension-csi-driver-lvm#14) @vknabel +* Add more netpols required when running in distributed landscapes (metal-stack/gardener-extension-csi-driver-lvm#15) @Gerrit91 +* include sbom in container image (metal-stack/gardener-extension-csi-driver-lvm#13) @mac641 +* Fix image vector points to wrong csi-driver-lvm container tag. (metal-stack/gardener-extension-csi-driver-lvm#18) @Gerrit91 +### api v0.0.33 +* Infra Role Handling and Admin Token Create, better Token documentation (metal-stack/api#69) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Blog article for metal-stack v0.22.0. (metal-stack/website#136) @Gerrit91 +* Bump releases to version v0.22.0 (metal-stack/website#137) @metal-robot[bot] +* Gardener v1.120 + drop deprecated Gardener parts. (metal-stack/releases#256) @Gerrit91 +* Fix link in v0.22.0 blog article. (metal-stack/website#138) @Gerrit91 +* Add blog article for OCP hardware support. (metal-stack/website#132) @Gerrit91 +* GenericCLI Fix: Commands set to 'false' in OnlyCmds are now correctly disabled (metal-stack/metal-lib#193) @izvyk +* Correct grammar of on-premises (metal-stack/website#140) @stmcginnis +* fix capms-ubuntu release location (metal-stack/metal-images#368) @mac641 +* Firewall: update node_exporter, tailscale and kernel (metal-stack/metal-images#369) @majst01 +* Add vendor Gigabyte to supported hardware list (metal-stack/website#141) @simcod +* Bump typescript from 5.9.2 to 5.9.3 (metal-stack/website#135) @dependabot[bot] +* Bump @headlessui/react from 2.2.7 to 2.2.9 (metal-stack/website#117) @dependabot[bot] +* Remove unused Dockerfile and docker-bake.hcl args (metal-stack/metal-images#357) @majst01 +* Bump tailwindcss from 4.1.13 to 4.1.16 (metal-stack/website#133) @dependabot[bot] +* Update to go-1.25, debian:13 (metal-stack/oci-mirror#18) @majst01 +* Stay with frr-10.4.x for now (metal-stack/metal-images#372) @majst01 +* use docker-bake tar exporter as default output (metal-stack/metal-images#358) @mac641 +* Next attempt to calculate planning meetings table. (metal-stack/website#148) @Gerrit91 +* docs(MEP16): FCM contents adjustments (metal-stack/website#142) @vknabel +* Bump @tailwindcss/postcss from 4.1.13 to 4.1.17 (metal-stack/website#143) @dependabot[bot] +* Bump @docusaurus/types from 3.8.1 to 3.9.2 (metal-stack/website#144) @dependabot[bot] +* Bump tailwindcss from 4.1.16 to 4.1.17 (metal-stack/website#145) @dependabot[bot] +* chore(deps): bump docusaurus to 3.9.2 (metal-stack/website#149) @vknabel +* Update debian kernel to 6.1.0-41 (metal-stack/metal-images#373) @majst01 +* Use grype instead of cve-bin-tool (metal-stack/website#150) @majst01 +* Downgrade debian 12 kernel because of eBPF bug preventing calico to work (metal-stack/metal-images#374) @majst01 +* Next release (metal-stack/releases#257) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.2.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.2.md new file mode 100644 index 0000000..74b475c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.2.md @@ -0,0 +1,126 @@ +--- +slug: /release-notes/v0.22.2 +title: v0.22.2 +sidebar_position: 1 +--- +# metal-stack v0.22.2 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.22.2](https://github.com/metal-stack/releases/releases/tag/v0.22.2) +## General +* [Gardener v1.121](https://github.com/gardener/gardener/releases/tag/v1.121.0) +## Noteworthy +* Starting with this release the cluster-api-provider-metal-stack supports the automatic deployment of static firewalls. All default templates are now adjusted accordingly. + You can try this out by using the new `MetalStackFirewallTemplate` and `MetalStackFirewallDeployment` resources and reference the deployment within `MetalStackCluster` using the new `spec.firewallDeploymentRef.name` field. (metal-stack/cluster-api-provider-metal-stack#118) +* CSI-Plugin architecture changed from a split controller-daemonset to an only daemonset architecture. Each daemonset now also provides its own controller (figure 3 of the possible csi-plugin architectures [here](https://github.com/container-storage-interface/spec/blob/master/spec.md#architecture)). With this architecture it is not necessary anymore to spawn pods for volume provisioning and deletion. For users of the Helm chart and the gardener-extension-csi-driver-lvm this migration can be deployed seamlessly. Manually deployed csi-driver-lvm installations need to adapt to the new architecture and delete the existing controller stateful set. (metal-stack/csi-driver-lvm#128) +* Gracefully handle audit event batches larger than 4MB by splitting them into smaller batches and limiting the size of individual audit events to 4MB. (metal-stack/gardener-extension-audit#65) +## Required Actions +* It is now possible to resolve metal-stack OCI release vectors and ansible-roles using the `metal_stack_release_vector` module that is now by default included in the metal-deployment-base image. Please check the the [README](https://github.com/metal-stack/metal-deployment-base/blob/master/README.md) or the latest mini-lab as an example for how to use it. Old deployments still continue to work, the old `setup_yaml` module will become deprecated over time. `setup_yaml` will be deprecated with metal-stack v0.23.0. (metal-stack/metal-deployment-base#40) +## Component Releases +### gardener-extension-ontap v0.2.10 +* update version to 25.06.3 (metal-stack/gardener-extension-ontap#75) @Honigeintopf +### metal-ccm v0.9.9 +* Update to go-1.25, debian:13 (metal-stack/metal-ccm#120) @majst01 +### gardener-extension-provider-metal v0.27.2 +* Fix metallb webhook certificate. (metal-stack/gardener-extension-provider-metal#481) @Gerrit91 +### api v0.0.35 +* Fix admin token create (metal-stack/api#72) @majst01 +* Migrate to mockery v3 (metal-stack/api#73) @majst01 +* Add admin project service (metal-stack/api#74) @AnnaSchreiner +### metal-hammer v0.13.16 +* Downgrade u-root to enable ctrl-c again (metal-stack/metal-hammer#174) @majst01 +### ansible-common v0.7.4 +* Provide `metal_stack_release_vector` module. (metal-stack/ansible-common#39) @Gerrit91 +* Template module variables in action plugin. (metal-stack/ansible-common#41) @Gerrit91 +### metal-apiserver v0.1.0 +* Authorize with expanded token permissions (metal-stack/metal-apiserver#94) @majst01 +* add project/tenant leave endpoint (metal-stack/metal-apiserver#92) @mac641 +* Implement switch infra get and heartbeat endpoints (metal-stack/metal-apiserver#84) @iljarotar +* Implement admin tenant list. (metal-stack/metal-apiserver#88) @Gerrit91 +* Add Admin Token Service (metal-stack/metal-apiserver#87) @majst01 +### metal-deployment-base v0.9.0 +* Ship `metal_stack_release_vector` module. (metal-stack/metal-deployment-base#40) @Gerrit91 +* sshpass is required to use passwords with the ssh connection plugin (metal-stack/metal-deployment-base#46) @robertvolkmann +### metal-roles v0.17.27 +* Cleanup old gardener images from before operator migration. (metal-stack/metal-roles#499) @Gerrit91 +* Fix improper API version field in namespace definition. (metal-stack/metal-roles#498) @Gerrit91 +* Add oci-mirror to image vector mapping. (metal-stack/metal-roles#501) @Gerrit91 +### mini-lab v0.5.0 +* Use `metal_stack_release_vector` module (metal-stack/mini-lab#247) @Gerrit91 +* update mini-lab illustration (metal-stack/mini-lab#274) @AnnaSchreiner +* feat: allow capms-ubuntu in fsl (metal-stack/mini-lab#264) @vknabel +* Ansible update for deployment base image v0.8.0. (metal-stack/mini-lab#263) @Gerrit91 +* Fix flakiness of virtual SONiC tests (metal-stack/mini-lab#262) @mwindower +* Differentiate SONiC base image versions and use 202505 (metal-stack/mini-lab#260) @mwindower +* Update firewall creation command in README (metal-stack/mini-lab#258) @dhilgarth +* README.md: Add jq to apt install (metal-stack/mini-lab#257) @GeertJohan +* Hotfix using archive.debian.org for bullseye-backports on SONiC. (metal-stack/mini-lab#253) @Gerrit91 +* Add sonic base image workflow (metal-stack/mini-lab#252) @ostempel +* added sonic base image workflow (metal-stack/mini-lab#251) @ostempel +* Remove Cumulus (metal-stack/mini-lab#246) @robertvolkmann +* Create proxy registries after kind cluster. (metal-stack/mini-lab#248) @Gerrit91 +* Implement a health check for SONiC (metal-stack/mini-lab#195) @robertvolkmann +* Pin ingress-nginx controller helm chart due to regression. (metal-stack/mini-lab#245) @Gerrit91 +* Adapt to latest metal-roles. (metal-stack/mini-lab#244) @Gerrit91 +* Add Headscale support (metal-stack/mini-lab#243) @majst01 +* Don't cancel each other's job in test matrix. (metal-stack/mini-lab#240) @Gerrit91 +* include sboms in container images (metal-stack/mini-lab#242) @mac641 +* Gardener operator (metal-stack/mini-lab#239) @Gerrit91 +* feat: remove unused meilisearch (metal-stack/mini-lab#241) @vknabel +* Recreate update strategy for ingress-nginx (metal-stack/mini-lab#235) @Gerrit91 +* Add pull-through caches for common container registries (metal-stack/mini-lab#227) @ostempel +* Use OpenIPMI for managing the power of the virtual machines. (metal-stack/mini-lab#223) @robertvolkmann +* Use new flag --abort-on-container-failure (metal-stack/mini-lab#238) @robertvolkmann +* Inline IP masquerade for SONiC switches (metal-stack/mini-lab#237) @iljarotar +* docs: include missing step for make dev-env (metal-stack/mini-lab#226) @vknabel +### cluster-api-provider-metal-stack v0.7.0 +* Static Firewall Deployments (metal-stack/cluster-api-provider-metal-stack#118) @vknabel +### metal-core v0.14.1 +* Update go dependencies (metal-stack/metal-core#174) @majst01 +* Allow different VTEP name than `vtep` (metal-stack/metal-core#163) @iljarotar +* Do not try to cleanup default VRF (metal-stack/metal-core#170) @iljarotar +* Fix ethernet packet overflow (metal-stack/metal-core#176) @majst01 +### gardener-extension-audit v0.4.1 +* Limit audit log event size to prevent dropped events (metal-stack/gardener-extension-audit#65) @MichaelEischer +### metal-api v0.42.5 +* Upgrade security with jwx v3 (metal-stack/metal-api#636) @majst01 +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* First set of refactorings. (metal-stack/metal-robot#91) @Gerrit91 +* Bump releases to version v0.22.1 (metal-stack/website#152) @metal-robot[bot] +* Remove release vector repos to require CONTRIBUTING.md. (metal-stack/website#159) @Gerrit91 +* Bump lint-staged from 16.2.4 to 16.2.7 (metal-stack/website#153) @dependabot[bot] +* Bump semver from 7.7.2 to 7.7.3 (metal-stack/website#154) @dependabot[bot] +* Bump axios from 1.12.2 to 1.13.2 (metal-stack/website#157) @dependabot[bot] +* Bump @carbon/icons-react from 11.67.0 to 11.70.0 (metal-stack/website#156) @dependabot[bot] +* Bump react-dom from 19.1.1 to 19.2.0 (metal-stack/website#155) @dependabot[bot] +* Fix for ethernet packet overflow (metal-stack/go-lldpd#32) @majst01 +* Add admin project list (metal-stack/cli#13) @AnnaSchreiner +* add log message (metal-stack/zitadel-init#1) @ostempel +* make init idempotent and initialize entities (metal-stack/zitadel-init#3) @ostempel +* add code-owners and license (metal-stack/zitadel-init#4) @ostempel +* gardener hackathon blog article (metal-stack/website#161) @Honigeintopf +* Svg bg in dark mode (metal-stack/website#160) @AnnaSchreiner +* Migrate to jwx v3 (metal-stack/security#64) @majst01 +* Bump metal-api to version v0.42.5 (metal-stack/metal-python#160) @metal-robot[bot] +* Bump metal-api to version v0.42.5 (metal-stack/metal-go#221) @metal-robot[bot] +* Bump go-github to v79. (metal-stack/metal-robot#96) @Gerrit91 +* Deprecate Swagger in contribution guideline. (metal-stack/website#167) @Gerrit91 +* Upgrade to go 1.25.5 (metal-stack/builder#87) @thheinel +* add possibility to configure http client for oidc provider (metal-stack/goth#1) @ostempel +* Bump tailwind-merge from 3.3.1 to 3.4.0 (metal-stack/website#166) @dependabot[bot] +* Bump yaml from 2.8.1 to 2.8.2 (metal-stack/website#162) @dependabot[bot] +* Bump @carbon/icons-react from 11.70.0 to 11.71.0 (metal-stack/website#164) @dependabot[bot] +* Bump react from 19.2.0 to 19.2.1 (metal-stack/website#163) @dependabot[bot] +* change default provider to openid-connect (metal-stack/cli#14) @ostempel +* Allow connecting through kubernetes service instead of ingress. (metal-stack/zitadel-init#5) @Gerrit91 +* fix issue where line-breaks in rendered docs were missing (metal-stack/website#169) @mac641 +* Bump tailwindcss from 4.1.17 to 4.1.18 (metal-stack/website#172) @dependabot[bot] +* Bump @scalar/api-reference-react from 0.8.1 to 0.8.11 (metal-stack/website#171) @dependabot[bot] +* Bump @tailwindcss/postcss from 4.1.17 to 4.1.18 (metal-stack/website#175) @dependabot[bot] +* Bump react from 19.2.1 to 19.2.3 (metal-stack/website#173) @dependabot[bot] +* chore(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 (metal-stack/terraform-provider-metal#268) @dependabot[bot] +* Bump @scalar/api-reference-react from 0.8.11 to 0.8.15 (metal-stack/website#176) @dependabot[bot] +* Announcement for FOSDEM 2026 participation. (metal-stack/website#177) @Gerrit91 +* Next release (metal-stack/releases#258) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.3.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.3.md new file mode 100644 index 0000000..61bfab3 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.3.md @@ -0,0 +1,76 @@ +--- +slug: /release-notes/v0.22.3 +title: v0.22.3 +sidebar_position: 1 +--- +# metal-stack v0.22.3 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.22.3](https://github.com/metal-stack/releases/releases/tag/v0.22.3) +## General +* [Gardener v1.122](https://github.com/gardener/gardener/releases/tag/v1.122.0) + * Please note that this release contains the gardener-apiserver built from the metal-stack fork in order to prevent the defaulting of worker machine images by Gardener. This will be resolved upstream with https://github.com/gardener/gardener/pull/13785. If you do not use short image versions in the `CloudProfile` you can also use the upstream version of the gardener-apiserver. +## Component Releases +### gardener-extension-csi-driver-lvm v0.1.9 +* Bump csi-driver-lvm to `v0.8.1` (metal-stack/gardener-extension-csi-driver-lvm#22) @Gerrit91 +* transfer to only-daemonset-architecture (metal-stack/gardener-extension-csi-driver-lvm#20) @ostempel +* Add gardener network-policy labels (metal-stack/gardener-extension-csi-driver-lvm#23) @mwennrich +* Bump csi-driver-lvm to v0.8.2. (metal-stack/gardener-extension-csi-driver-lvm#24) @Gerrit91 +### helm-charts v0.5.3 +* Sync csi-driver-lvm chart to `v0.8.1` (metal-stack/helm-charts#140) @Gerrit91 +### go-ipam v1.14.14 +* Update to debian:13 and all go modules (metal-stack/go-ipam#187) @majst01 +### duros-controller v0.11.9 +* Add gardener network-policy labels to controller (metal-stack/duros-controller#99) @mwennrich +### api v0.0.38 +* Add vpn-service (metal-stack/api#76) @majst01 +* Add last_sync and last_sync_error to switch (metal-stack/api#85) @iljarotar +### metal-roles v0.17.29 +* Update Github workflows actions. (metal-stack/metal-roles#508) @Gerrit91 +* Fix readme and some defaults in the sonic-config role (metal-stack/metal-roles#504) @iljarotar +* Undocumented variable `metal_control_plane_host_provider` (metal-stack/metal-roles#507) @AnnaSchreiner +### sonic-configdb-utils v0.4.4 +* Only configure ports and breakouts if they are explicitly passed (metal-stack/sonic-configdb-utils#36) @iljarotar +* Fix nil pointer when breakouts are defined and ports are not (metal-stack/sonic-configdb-utils#37) @iljarotar +### metal-core v0.15.0 +* Get ports from running config (metal-stack/metal-core#177) @iljarotar +* log error if lldp discovery fails (metal-stack/metal-core#175) @iljarotar +### metal-hammer v0.13.17 +* Add AMD Workstation support (metal-stack/metal-hammer#176) @majst01 +### metal-bmc v0.6.1 +* Dependency updates (metal-stack/metal-bmc#91) @Gerrit91 +* Fix regex parsing of lease file mixing up lease entries (metal-stack/metal-bmc#90) @Gerrit91 +### gardener-extension-provider-metal v0.27.3 +* Revendor g/g v1.122. (metal-stack/gardener-extension-provider-metal#484) @Gerrit91 +### gardener-extension-audit v0.4.2 +* Add gardener network-policy label to audittailer (metal-stack/gardener-extension-audit#69) @mwennrich +### gardener-extension-ontap v0.2.11 +* Add gardener network-policy labels to controller (metal-stack/gardener-extension-ontap#78) @Gerrit91 +* remove update password (metal-stack/gardener-extension-ontap#76) @Honigeintopf +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Next release (metal-stack/releases#190) @fits-robot[bot] +* Add zitadel (metal-stack/releases#260) @ostempel +* Bump releases to version v0.22.2 (metal-stack/website#178) @metal-robot[bot] +* fix cloud-hypervisor download url (metal-stack/metal-images#378) @mac641 +* Merge pr.yaml and master.yaml into docker.yaml (metal-stack/metal-images#376) @mac641 +* ci: fix issue where SEMVER_PATCH was assigned an empty string (metal-stack/metal-images#379) @mac641 +* Continue with refactor (metal-stack/metal-robot#95) @Gerrit91 +* Bump @scalar/api-reference-react from 0.8.15 to 0.8.20 (metal-stack/website#180) @dependabot[bot] +* Bump @carbon/icons-react from 11.71.0 to 11.72.0 (metal-stack/website#179) @dependabot[bot] +* fix: pin containerd version to 2.1.5 to ensure compatibility with gardener-node-agent (metal-stack/metal-images#380) @mwennrich +* Newer AMD Workstation motherboard also requires less bios modifications (metal-stack/go-hal#81) @majst01 +* implement tagging release images and copying them to google bucket in go (metal-stack/metal-images#365) @mac641 +* Implement shared context command in genericCLI (metal-stack/metal-lib#194) @izvyk +* add missing copy destination for gcs on master branch (metal-stack/metal-images#381) @mac641 +* Add Supermicro AMD Workstation Support (metal-stack/website#181) @majst01 +* Rename v1 to v2 (metal-stack/cli#15) @iljarotar +* remove last v1 remainders (metal-stack/cli#16) @iljarotar +* frr-10.4.1 (metal-stack/frr#13) @majst01 +* Update all dependencies (metal-stack/metal-networker#124) @majst01 +* Bump @scalar/api-reference-react from 0.8.20 to 0.8.27 (metal-stack/website#182) @dependabot[bot] +* Bump @carbon/icons-react from 11.72.0 to 11.73.0 (metal-stack/website#183) @dependabot[bot] +* Pin firewall to frr-10.4.1 (metal-stack/metal-images#382) @majst01 +* Bump gardener-extension-networking-cilium to upstream `v1.42.3`. (metal-stack/releases#264) @Gerrit91 +* Next release (metal-stack/releases#261) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.4.md b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.4.md new file mode 100644 index 0000000..6c9a49a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/07-Release Notes/v0.22/v0.22.4.md @@ -0,0 +1,109 @@ +--- +slug: /release-notes/v0.22.4 +title: v0.22.4 +sidebar_position: 1 +--- +# metal-stack v0.22.4 +See original release note at [https://github.com/metal-stack/releases/releases/tag/v0.22.4](https://github.com/metal-stack/releases/releases/tag/v0.22.4) +## General +* [Gardener v1.123](https://github.com/gardener/gardener/releases/tag/v1.123.0) + * Please note that this release contains the gardener-apiserver built from the metal-stack fork in order to prevent the defaulting of worker machine images by Gardener. This will be resolved upstream with https://github.com/gardener/gardener/pull/13785. If you do not use short image versions in the `CloudProfile` you can also use the upstream version of the gardener-apiserver. +* Virtual Garden `v1.33.7` +## Noteworthy +* When using the `cluster-forwarding` audit backend in combination with `blocking-strict` policy, the controller now lowers the audit policy mode to `blocking` in order to prevent a scenario that produces a deadlock with a crashing kube-apiserver. Since `cluster-forwarding` is not intended for production use cases, this behavior is appropriate. Note that the policy mode is also lowered when using `cluster-forwarding` in combination with another backend. (metal-stack/gardener-extension-audit#71) +## Breaking Changes +* The `metal_stack_release_vector` module now uses `oci_registry_credentials` to provide registry credentials instead of `oci_registry_username` and `oci_registry_password`. This way, it is possible to pass credentials for multiple registries. (metal-stack/ansible-common#43) +* CSI-Plugin architecture changed from a split controller-daemonset to an only `DaemonSet` architecture. Each `DaemonSet` now also provides its own controller (figure 3 of the possible csi-plugin architectures [here](https://github.com/container-storage-interface/spec/blob/master/spec.md#architecture)). With this architecture it is not necessary anymore to spawn pods for volume provisioning and deletion. For users of the Helm chart and the gardener-extension-csi-driver-lvm this migration can be deployed seamlessly. Manually deployed csi-driver-lvm installations need to adapt to the new architecture and delete the existing controller stateful set. (metal-stack/csi-driver-lvm#128) +* There are some breaking changes in the `monitoring` roles in order to make them compatible with the mini-lab. If you deployed monitoring components using this role, please review the changes of introduced in metal-stack/metal-roles#502 and adapt your deployment parameters accordingly. (metal-stack/metal-roles#502) +* connect.OutBand now requires to specify a connection timeout for redfish calls, if nil is specified it defaults to 10secs. (metal-stack/go-hal#82) +## Actions Required +- In case you set the `NodeAgentAuthorizer` feature gate on the gardenlet, this now has to be removed. +## Component Releases +### oci-mirror v0.2.9 +* Update go modules and gh actions (metal-stack/oci-mirror#19) @majst01 +### metal-core v0.15.1 +* Fix waitgroup panics with negative counter (metal-stack/metal-core#179) @majst01 +### ansible-common v0.8.0 +* Allow login with cosign. (metal-stack/ansible-common#43) @Gerrit91 +* Add missing documentation on `helm_additional_params`. (metal-stack/ansible-common#45) @Gerrit91 +### metal-deployment-base v0.9.1 +* Bump metal stack release vector plugin. (metal-stack/metal-deployment-base#47) @Gerrit91 +### csi-driver-lvm v0.8.2 +* Install kustomize to local bin. (metal-stack/csi-driver-lvm#146) @Gerrit91 +* Fix eviction controller evicts volume on VPA eviction (metal-stack/csi-driver-lvm#145) @Gerrit91 +* Add warning admonition on working with local data. (metal-stack/csi-driver-lvm#143) @Gerrit91 +### metal-api v0.43.0 +* Provide splunk audit configuration. (metal-stack/metal-api#641) @Gerrit91 +* Provide reason field for retrieving VPN auth key. (metal-stack/metal-api#640) @Gerrit91 +* Use newer approach to use sync.WaitGroup which prevents leaking counters (metal-stack/metal-api#637) @majst01 +* Include consolepassword endpoint into auditing. (metal-stack/metal-api#638) @Gerrit91 +### helm-charts v0.5.4 +* Sync csi-driver-lvm chart to `v0.8.2` (metal-stack/helm-charts#146) @Gerrit91 +* Add splunk audit configuration for metal-api. (metal-stack/helm-charts#144) @Gerrit91 +### metalctl v0.18.4 +* Allow field to provide a reason for a VPN key. (metal-stack/metalctl#293) @Gerrit91 +* Update to go-1.25 (metal-stack/metalctl#291) @majst01 +* fix issue where binary name was missing in generated sbom (metal-stack/metalctl#290) @mac641 +### gardener-extension-audit v0.5.0 +* Move S3 secret key ref constants to public API package. (metal-stack/gardener-extension-audit#72) @Gerrit91 +* Prevent `blocking-strict` with cluster-forwarding backend. (metal-stack/gardener-extension-audit#71) @Gerrit91 +### gardener-extension-provider-metal v0.27.4 +* Revendor g/g v1.123. (metal-stack/gardener-extension-provider-metal#486) @Gerrit91 +### metal-roles v0.18.4 +* Adaptions for running monitoring in the mini-lab (metal-stack/metal-roles#502) @ostempel +* Configurable vali storage capacity (metal-stack/metal-roles#516) @simcod +* Add splunk audit configuration for metal-api. (metal-stack/metal-roles#514) @Gerrit91 +* Frr reload on all sonic switches (metal-stack/metal-roles#479) @iljarotar +* Fix wrong `metal_registry_url` name (metal-stack/metal-roles#515) @AnnaSchreiner +* Zitadel role: some leftovers from the last review. (metal-stack/metal-roles#505) @Gerrit91 +* Add configurable `metal_registry_url` (metal-stack/metal-roles#509) @AnnaSchreiner +* Make nsq tls requirement for client connections configurable (metal-stack/metal-roles#513) @AnnaSchreiner +* Modify nsq and postgres backup restore namespace creation (metal-stack/metal-roles#511) @AnnaSchreiner +* Monitoring promtail client configuration (metal-stack/metal-roles#518) @simcod +* Fix promtail config when no timeout is configured. (metal-stack/metal-roles#520) @Gerrit91 +* Allow setting `shootAdminKubeconfigMaxExpiration` in `Garden` resource. (metal-stack/metal-roles#519) @Gerrit91 +* Structured authentication for Garden kube-apiserver (metal-stack/metal-roles#517) @simcod +* feat: add envoy gateway to service clusters (for isolated clusters) (metal-stack/metal-roles#522) @mwennrich +### api v0.0.41 +* Boot Services (metal-stack/api#83) @majst01 +### gardener-extension-ontap v0.2.12 +* Set DNS policy to Default in mutator for the trident-node-linux daemonSet (metal-stack/gardener-extension-ontap#80) @mwennrich +# Merged Pull Requests +This is a list of pull requests that were merged since the last release. The list does not contain pull requests from release-vector-repositories. + +The fact that these pull requests were merged does not necessarily imply that they have already become part of this metal-stack release. + +* Bump releases to version v0.22.3 (metal-stack/website#184) @metal-robot[bot] +* Updates regarding OCI artifacts. (metal-stack/website#146) @Gerrit91 +* Register handlers by serve path. (metal-stack/metal-robot#100) @Gerrit91 +* Slight refactor of comment command exec. (metal-stack/metal-robot#101) @Gerrit91 +* fix typo in release pipeline (metal-stack/metal-images#384) @mac641 +* Bump metal-api to version v0.43.0 (metal-stack/metal-python#161) @metal-robot[bot] +* Bump metal-api to version v0.43.0 (metal-stack/metal-go#222) @metal-robot[bot] +* Add section on pre-releases. (metal-stack/website#187) @Gerrit91 +* Bump axios from 1.13.2 to 1.13.3 (metal-stack/website#186) @dependabot[bot] +* Bump @scalar/api-reference-react from 0.8.27 to 0.8.34 (metal-stack/website#185) @dependabot[bot] +* Cancel redfish calls after timeout (metal-stack/go-hal#82) @majst01 +* fix container image retag in release pipeline (metal-stack/metal-images#385) @mac641 +* fix typo in release pipeline (metal-stack/metal-images#386) @mac641 +* Updates golang base image version to 1.25.6-bookworm (metal-stack/builder#88) @thheinel +* FOSDEM 2026 recap. (metal-stack/website#193) @Gerrit91 +* Bump axios from 1.13.3 to 1.13.4 (metal-stack/website#189) @dependabot[bot] +* Bump @carbon/icons-react from 11.73.0 to 11.74.0 (metal-stack/website#191) @dependabot[bot] +* fix: containerlab link in blog post (metal-stack/website#194) @vknabel +* Bump react from 19.2.3 to 19.2.4 (metal-stack/website#188) @dependabot[bot] +* Bump @scalar/api-reference-react from 0.8.36 to 0.8.46 (metal-stack/website#192) @dependabot[bot] +* Update gofish and adjust for changes (metal-stack/go-hal#84) @stmcginnis +* fix api version pinning and small ts errors (metal-stack/metal-ui#9) @ostempel +* Update dependencies (metal-stack/firewall-controller#208) @mwennrich +* docs: fix outdated links to metal-stack.io (metal-stack/metal-images#383) @vknabel +* Implement gcp auth and remove unused actions in release pipeline (metal-stack/metal-images#387) @mac641 +* Gov1.25.7 (metal-stack/builder#89) @thheinel +* size, admin not finished yet (metal-stack/cli#4) @majst01 +* Bump semver from 7.7.3 to 7.7.4 (metal-stack/website#195) @dependabot[bot] +* Bump @scalar/api-reference-react from 0.8.46 to 0.8.52 (metal-stack/website#196) @dependabot[bot] +* Bump axios from 1.13.4 to 1.13.5 (metal-stack/website#197) @dependabot[bot] +* Fix gcs authentication, gcs object paths and rework tests for release pipeline (metal-stack/metal-images#388) @mac641 +* Fix log output formatting and download url links in release pipeline (metal-stack/metal-images#389) @mac641 +* build(Dockerfile): Upgrade Go version to 1.26.0 (metal-stack/builder#90) @thheinel +* Next release (metal-stack/releases#265) @metal-robot[bot] \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/08-References/API/index.mdx b/versioned_docs/version-v0.22.4/docs/08-References/API/index.mdx new file mode 100644 index 0000000..9725771 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/API/index.mdx @@ -0,0 +1,32 @@ +--- +slug: /references/api +title: API +--- + +import { useState, useEffect } from "react"; + +export function VersionedLink({ children }) { + const [version, setVersion] = useState(""); + + useEffect(() => { + const path = window.location.pathname; + const v = path + .replace("/docs/", "") + .replace("references/api", "") + .replace("/", ""); + if (v === "") setVersion("latest"); + else setVersion(v); + }, []); + + if (version) return {children}; + + return null; +} + +We are currently working on the [metal-stack API v2](/docs/MEP-4-multi-tenancy-for-the-metal-api) which will gradually replace v1. +This page provides links to both API documentations. + +| Version | Repository | Docs | +| ------- | ----------------------------------------------------- | ------------------------------------------- | +| v1 | [metal-api](https://github.com/metal-stack/metal-api) | OpenAPI Spec | +| v2 | [api](https://github.com/metal-stack/api) | Coming soon | diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl.md new file mode 100644 index 0000000..db72997 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl.md @@ -0,0 +1,64 @@ +--- +slug: /references/metalctl +title: metalctl +sidebar_position: 0 +--- + +## metalctl + +a cli to manage entities in the metal-stack api + +### Options + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + -h, --help help for metalctl + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl audit](./metalctl_audit.md) - manage audit trace entities +* [metalctl completion](./metalctl_completion.md) - Generate the autocompletion script for the specified shell +* [metalctl context](./metalctl_context.md) - manage metalctl context +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities +* [metalctl firewall](./metalctl_firewall.md) - manage firewall entities +* [metalctl firmware](./metalctl_firmware.md) - manage firmwares +* [metalctl health](./metalctl_health.md) - shows the server health +* [metalctl image](./metalctl_image.md) - manage image entities +* [metalctl login](./metalctl_login.md) - login user and receive token +* [metalctl logout](./metalctl_logout.md) - logout user from OIDC SSO session +* [metalctl machine](./metalctl_machine.md) - manage machine entities +* [metalctl markdown](./metalctl_markdown.md) - create markdown documentation +* [metalctl network](./metalctl_network.md) - manage network entities +* [metalctl partition](./metalctl_partition.md) - manage partition entities +* [metalctl project](./metalctl_project.md) - manage project entities +* [metalctl size](./metalctl_size.md) - manage size entities +* [metalctl switch](./metalctl_switch.md) - manage switch entities +* [metalctl tenant](./metalctl_tenant.md) - manage tenant entities +* [metalctl update](./metalctl_update.md) - update the program +* [metalctl version](./metalctl_version.md) - print the client and server version information +* [metalctl vpn](./metalctl_vpn.md) - access VPN +* [metalctl whoami](./metalctl_whoami.md) - shows current user + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit.md new file mode 100644 index 0000000..8821126 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit.md @@ -0,0 +1,54 @@ +--- +slug: /references/metalctl_audit +title: metalctl_audit +sidebar_position: 1 +--- + +## metalctl audit + +manage audit trace entities + +### Synopsis + +show audit traces of the api. feature must be enabled on server-side. + +### Options + +``` + -h, --help help for audit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl audit describe](./metalctl_audit_describe.md) - describes the audit trace +* [metalctl audit list](./metalctl_audit_list.md) - list all audit traces + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit_describe.md new file mode 100644 index 0000000..24ff4ec --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit_describe.md @@ -0,0 +1,54 @@ +--- +slug: /references/metalctl_audit_describe +title: metalctl_audit_describe +sidebar_position: 2 +--- + +## metalctl audit describe + +describes the audit trace + +``` +metalctl audit describe [flags] +``` + +### Options + +``` + -h, --help help for describe + --phase string phase of the audit trace. One of [request, response, single, error, opened, closed] (default "response") + --prettify-body attempts to interpret the body as json and prettifies it +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl audit](./metalctl_audit.md) - manage audit trace entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit_list.md new file mode 100644 index 0000000..b34a77e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_audit_list.md @@ -0,0 +1,69 @@ +--- +slug: /references/metalctl_audit_list +title: metalctl_audit_list +sidebar_position: 3 +--- + +## metalctl audit list + +list all audit traces + +``` +metalctl audit list [flags] +``` + +### Options + +``` + --component string component of the audit trace. + --detail string detail of the audit trace. An HTTP method, unary or stream + --error string error of the audit trace. + --forwarded-for string forwarded for of the audit trace. + --from string start of range of the audit traces. e.g. 1h, 10m, 2006-01-02 15:04:05 (default "1h") + -h, --help help for list + --limit int limit the number of audit traces. (default 100) + --path string api path of the audit trace. + --phase string phase of the audit trace. One of [request, response, single, error, opened, closed] + -q, --query string filters audit trace body payloads for the given text. + --remote-addr string remote address of the audit trace. + --request-id string request id of the audit trace. + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: path|tenant|timestamp|user + --status-code int32 HTTP status code of the audit trace. + --tenant string tenant of the audit trace. + --to string end of range of the audit traces. e.g. 1h, 10m, 2006-01-02 15:04:05 + --type string type of the audit trace. One of [http, grpc, event]. + --user string user of the audit trace. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl audit](./metalctl_audit.md) - manage audit trace entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion.md new file mode 100644 index 0000000..bd46031 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion.md @@ -0,0 +1,58 @@ +--- +slug: /references/metalctl_completion +title: metalctl_completion +sidebar_position: 4 +--- + +## metalctl completion + +Generate the autocompletion script for the specified shell + +### Synopsis + +Generate the autocompletion script for metalctl for the specified shell. +See each sub-command's help for details on how to use the generated script. + + +### Options + +``` + -h, --help help for completion +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl completion bash](./metalctl_completion_bash.md) - Generate the autocompletion script for bash +* [metalctl completion fish](./metalctl_completion_fish.md) - Generate the autocompletion script for fish +* [metalctl completion powershell](./metalctl_completion_powershell.md) - Generate the autocompletion script for powershell +* [metalctl completion zsh](./metalctl_completion_zsh.md) - Generate the autocompletion script for zsh + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_bash.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_bash.md new file mode 100644 index 0000000..da95653 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_bash.md @@ -0,0 +1,77 @@ +--- +slug: /references/metalctl_completion_bash +title: metalctl_completion_bash +sidebar_position: 5 +--- + +## metalctl completion bash + +Generate the autocompletion script for bash + +### Synopsis + +Generate the autocompletion script for the bash shell. + +This script depends on the 'bash-completion' package. +If it is not installed already, you can install it via your OS's package manager. + +To load completions in your current shell session: + + source <(metalctl completion bash) + +To load completions for every new session, execute once: + +#### Linux: + + metalctl completion bash > /etc/bash_completion.d/metalctl + +#### macOS: + + metalctl completion bash > $(brew --prefix)/etc/bash_completion.d/metalctl + +You will need to start a new shell for this setup to take effect. + + +``` +metalctl completion bash +``` + +### Options + +``` + -h, --help help for bash + --no-descriptions disable completion descriptions +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl completion](./metalctl_completion.md) - Generate the autocompletion script for the specified shell + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_fish.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_fish.md new file mode 100644 index 0000000..7818c8c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_fish.md @@ -0,0 +1,68 @@ +--- +slug: /references/metalctl_completion_fish +title: metalctl_completion_fish +sidebar_position: 6 +--- + +## metalctl completion fish + +Generate the autocompletion script for fish + +### Synopsis + +Generate the autocompletion script for the fish shell. + +To load completions in your current shell session: + + metalctl completion fish | source + +To load completions for every new session, execute once: + + metalctl completion fish > ~/.config/fish/completions/metalctl.fish + +You will need to start a new shell for this setup to take effect. + + +``` +metalctl completion fish [flags] +``` + +### Options + +``` + -h, --help help for fish + --no-descriptions disable completion descriptions +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl completion](./metalctl_completion.md) - Generate the autocompletion script for the specified shell + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_powershell.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_powershell.md new file mode 100644 index 0000000..99c19d0 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_powershell.md @@ -0,0 +1,65 @@ +--- +slug: /references/metalctl_completion_powershell +title: metalctl_completion_powershell +sidebar_position: 7 +--- + +## metalctl completion powershell + +Generate the autocompletion script for powershell + +### Synopsis + +Generate the autocompletion script for powershell. + +To load completions in your current shell session: + + metalctl completion powershell | Out-String | Invoke-Expression + +To load completions for every new session, add the output of the above command +to your powershell profile. + + +``` +metalctl completion powershell [flags] +``` + +### Options + +``` + -h, --help help for powershell + --no-descriptions disable completion descriptions +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl completion](./metalctl_completion.md) - Generate the autocompletion script for the specified shell + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_zsh.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_zsh.md new file mode 100644 index 0000000..d9d422b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_completion_zsh.md @@ -0,0 +1,79 @@ +--- +slug: /references/metalctl_completion_zsh +title: metalctl_completion_zsh +sidebar_position: 8 +--- + +## metalctl completion zsh + +Generate the autocompletion script for zsh + +### Synopsis + +Generate the autocompletion script for the zsh shell. + +If shell completion is not already enabled in your environment you will need +to enable it. You can execute the following once: + + echo "autoload -U compinit; compinit" >> ~/.zshrc + +To load completions in your current shell session: + + source <(metalctl completion zsh) + +To load completions for every new session, execute once: + +#### Linux: + + metalctl completion zsh > "${fpath[1]}/_metalctl" + +#### macOS: + + metalctl completion zsh > $(brew --prefix)/share/zsh/site-functions/_metalctl + +You will need to start a new shell for this setup to take effect. + + +``` +metalctl completion zsh [flags] +``` + +### Options + +``` + -h, --help help for zsh + --no-descriptions disable completion descriptions +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl completion](./metalctl_completion.md) - Generate the autocompletion script for the specified shell + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_context.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_context.md new file mode 100644 index 0000000..c5d8fc5 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_context.md @@ -0,0 +1,79 @@ +--- +slug: /references/metalctl_context +title: metalctl_context +sidebar_position: 9 +--- + +## metalctl context + +manage metalctl context + +### Synopsis + +context defines the backend to which metalctl talks to. You can switch back and forth with "-" + +``` +metalctl context [flags] +``` + +### Examples + +``` + +~/.metalctl/config.yaml +--- +current: prod +contexts: + prod: + url: https://api.metal-stack.io/metal + issuer_url: https://dex.metal-stack.io/dex + client_id: metal_client + client_secret: 456 + dev: + url: https://api.metal-stack.dev/metal + issuer_url: https://dex.metal-stack.dev/dex + client_id: metal_client + client_secret: 123 +... + +``` + +### Options + +``` + -h, --help help for context +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl context short](./metalctl_context_short.md) - only show the default context name + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_context_short.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_context_short.md new file mode 100644 index 0000000..d07236e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_context_short.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_context_short +title: metalctl_context_short +sidebar_position: 10 +--- + +## metalctl context short + +only show the default context name + +``` +metalctl context short [flags] +``` + +### Options + +``` + -h, --help help for short +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl context](./metalctl_context.md) - manage metalctl context + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout.md new file mode 100644 index 0000000..c3713da --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout.md @@ -0,0 +1,61 @@ +--- +slug: /references/metalctl_filesystemlayout +title: metalctl_filesystemlayout +sidebar_position: 11 +--- + +## metalctl filesystemlayout + +manage filesystemlayout entities + +### Synopsis + +a filesystemlayout is a specification how the disks in a machine are partitioned, formatted and mounted. + +### Options + +``` + -h, --help help for filesystemlayout +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl filesystemlayout apply](./metalctl_filesystemlayout_apply.md) - applies one or more filesystemlayouts from a given file +* [metalctl filesystemlayout create](./metalctl_filesystemlayout_create.md) - creates the filesystemlayout +* [metalctl filesystemlayout delete](./metalctl_filesystemlayout_delete.md) - deletes the filesystemlayout +* [metalctl filesystemlayout describe](./metalctl_filesystemlayout_describe.md) - describes the filesystemlayout +* [metalctl filesystemlayout edit](./metalctl_filesystemlayout_edit.md) - edit the filesystemlayout through an editor and update +* [metalctl filesystemlayout list](./metalctl_filesystemlayout_list.md) - list all filesystemlayouts +* [metalctl filesystemlayout match](./metalctl_filesystemlayout_match.md) - check if a machine satisfies all disk requirements of a given filesystemlayout +* [metalctl filesystemlayout try](./metalctl_filesystemlayout_try.md) - try to detect a filesystem by given size and image +* [metalctl filesystemlayout update](./metalctl_filesystemlayout_update.md) - updates the filesystemlayout + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_apply.md new file mode 100644 index 0000000..ef46d3b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_filesystemlayout_apply +title: metalctl_filesystemlayout_apply +sidebar_position: 12 +--- + +## metalctl filesystemlayout apply + +applies one or more filesystemlayouts from a given file + +``` +metalctl filesystemlayout apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl filesystemlayout describe filesystemlayout-1 -o yaml > filesystemlayout.yaml + $ vi filesystemlayout.yaml + $ # either via stdin + $ cat filesystemlayout.yaml | metalctl filesystemlayout apply -f - + $ # or via file + $ metalctl filesystemlayout apply -f filesystemlayout.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_create.md new file mode 100644 index 0000000..84d9f64 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_create.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_filesystemlayout_create +title: metalctl_filesystemlayout_create +sidebar_position: 13 +--- + +## metalctl filesystemlayout create + +creates the filesystemlayout + +``` +metalctl filesystemlayout create [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl filesystemlayout describe filesystemlayout-1 -o yaml > filesystemlayout.yaml + $ vi filesystemlayout.yaml + $ # either via stdin + $ cat filesystemlayout.yaml | metalctl filesystemlayout create -f - + $ # or via file + $ metalctl filesystemlayout create -f filesystemlayout.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_delete.md new file mode 100644 index 0000000..c2d6bc2 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_filesystemlayout_delete +title: metalctl_filesystemlayout_delete +sidebar_position: 14 +--- + +## metalctl filesystemlayout delete + +deletes the filesystemlayout + +``` +metalctl filesystemlayout delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl filesystemlayout describe filesystemlayout-1 -o yaml > filesystemlayout.yaml + $ vi filesystemlayout.yaml + $ # either via stdin + $ cat filesystemlayout.yaml | metalctl filesystemlayout delete -f - + $ # or via file + $ metalctl filesystemlayout delete -f filesystemlayout.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_describe.md new file mode 100644 index 0000000..797baa9 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_filesystemlayout_describe +title: metalctl_filesystemlayout_describe +sidebar_position: 15 +--- + +## metalctl filesystemlayout describe + +describes the filesystemlayout + +``` +metalctl filesystemlayout describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_edit.md new file mode 100644 index 0000000..1ed6c1c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_filesystemlayout_edit +title: metalctl_filesystemlayout_edit +sidebar_position: 16 +--- + +## metalctl filesystemlayout edit + +edit the filesystemlayout through an editor and update + +``` +metalctl filesystemlayout edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_list.md new file mode 100644 index 0000000..623332c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_list.md @@ -0,0 +1,53 @@ +--- +slug: /references/metalctl_filesystemlayout_list +title: metalctl_filesystemlayout_list +sidebar_position: 17 +--- + +## metalctl filesystemlayout list + +list all filesystemlayouts + +``` +metalctl filesystemlayout list [flags] +``` + +### Options + +``` + -h, --help help for list + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: description|id|name +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_match.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_match.md new file mode 100644 index 0000000..85ad9aa --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_match.md @@ -0,0 +1,54 @@ +--- +slug: /references/metalctl_filesystemlayout_match +title: metalctl_filesystemlayout_match +sidebar_position: 18 +--- + +## metalctl filesystemlayout match + +check if a machine satisfies all disk requirements of a given filesystemlayout + +``` +metalctl filesystemlayout match [flags] +``` + +### Options + +``` + --filesystemlayout string filesystemlayout id to check against [required] + -h, --help help for match + --machine string machine id to check for match [required] +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_try.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_try.md new file mode 100644 index 0000000..acc77a7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_try.md @@ -0,0 +1,54 @@ +--- +slug: /references/metalctl_filesystemlayout_try +title: metalctl_filesystemlayout_try +sidebar_position: 19 +--- + +## metalctl filesystemlayout try + +try to detect a filesystem by given size and image + +``` +metalctl filesystemlayout try [flags] +``` + +### Options + +``` + -h, --help help for try + --image string image to try + --size string size to try +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_update.md new file mode 100644 index 0000000..1eee8f8 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_filesystemlayout_update.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_filesystemlayout_update +title: metalctl_filesystemlayout_update +sidebar_position: 20 +--- + +## metalctl filesystemlayout update + +updates the filesystemlayout + +``` +metalctl filesystemlayout update [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl filesystemlayout describe filesystemlayout-1 -o yaml > filesystemlayout.yaml + $ vi filesystemlayout.yaml + $ # either via stdin + $ cat filesystemlayout.yaml | metalctl filesystemlayout update -f - + $ # or via file + $ metalctl filesystemlayout update -f filesystemlayout.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl filesystemlayout](./metalctl_filesystemlayout.md) - manage filesystemlayout entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall.md new file mode 100644 index 0000000..e57919d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_firewall +title: metalctl_firewall +sidebar_position: 21 +--- + +## metalctl firewall + +manage firewall entities + +### Synopsis + +firewalls are used to establish network connectivity between metal-stack networks. firewalls are similar to machines but are managed by the provider. almost every command of the machine command subset works on firewalls, too. + +### Options + +``` + -h, --help help for firewall +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl firewall create](./metalctl_firewall_create.md) - creates the firewall +* [metalctl firewall describe](./metalctl_firewall_describe.md) - describes the firewall +* [metalctl firewall list](./metalctl_firewall_list.md) - list all firewalls +* [metalctl firewall ssh](./metalctl_firewall_ssh.md) - SSH to a firewall + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_create.md new file mode 100644 index 0000000..d6b2fc4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_create.md @@ -0,0 +1,140 @@ +--- +slug: /references/metalctl_firewall_create +title: metalctl_firewall_create +sidebar_position: 22 +--- + +## metalctl firewall create + +creates the firewall + +``` +metalctl firewall create [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -d, --description string Description of the firewall to create. [optional] + --dnsservers strings dns servers to add to the machine or firewall. [optional] + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl firewall describe firewall-1 -o yaml > firewall.yaml + $ vi firewall.yaml + $ # either via stdin + $ cat firewall.yaml | metalctl firewall create -f - + $ # or via file + $ metalctl firewall create -f firewall.yaml + + the file can also contain multiple documents and perform a bulk operation. + + --filesystemlayout string Filesystemlayout to use during machine installation. [optional] + --firewall-rules-file string firewall rules specified in a yaml file + + Example: + + $ metalctl firewall create ..mandatory args.. --firewall-rules-file rules.yaml + + rules.yaml + --- + egress: + - comment: allow outgoing https + ports: + - 443 + protocol: TCP + to: + - 0.0.0.0/0 + - comment: allow outgoing dns via tcp + ports: + - 53 + protocol: TCP + to: + - 0.0.0.0/0 + - comment: allow outgoing dns and ntp via udp + ports: + - 53 + - 123 + protocol: UDP + to: + - 0.0.0.0/0 + ingress: + - comment: allow incoming ssh only to one ip + ports: + - 22 + protocol: TCP + from: + - 0.0.0.0/0 + - 1.2.3.4/32 + to: + - 212.34.83.19/32 + - comment: allow incoming https to all targets + ports: + - 80 + - 433 + protocol: TCP + from: + - 0.0.0.0/0 + + + -h, --help help for create + -H, --hostname string Hostname of the firewall. [required] + -I, --id string ID of a specific firewall to allocate, if given, size and partition are ignored. Need to be set to reserved (--reserve) state before. + -i, --image string OS Image to install. [required] + --ips strings Sets the firewall's IP address. Usage: [--ips[=IPV4-ADDRESS[,IPV4-ADDRESS]...]]... + IPV4-ADDRESS specifies the IPv4 address to add. + It can only be used in conjunction with --networks. + -n, --name string Name of the firewall. [optional] + --networks strings Adds network(s). Usage: --networks NETWORK[:MODE][,NETWORK[:MODE]]... [--networks NETWORK[:MODE][, + NETWORK[:MODE]]...]... + NETWORK specifies the id of an existing network. + MODE can be omitted or one of: + auto IP address is automatically acquired from the given network + noauto No automatic IP address acquisition + --ntpservers strings ntp servers to add to the machine or firewall. [optional] + -S, --partition string partition/datacenter where the firewall is created. [required, except for reserved machines] + -P, --project string Project where the firewall should belong to. [required] + -s, --size string Size of the firewall. [required, except for reserved machines] + --skip-security-prompts skips security prompt for bulk operations + -p, --sshpublickey string SSH public key for access via ssh and console. [optional] + Can be either the public key as string, or pointing to the public key file to use e.g.: "@~/.ssh/id_rsa.pub". + If ~/.ssh/[id_ed25519.pub | id_rsa.pub | id_dsa.pub] is present it will be picked as default, matching the first one in this order. + --tags strings tags to add to the firewall, use it like: --tags "tag1,tag2" or --tags "tag3". + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations + --userdata string cloud-init.io compatible userdata. [optional] + Can be either the userdata as string, or pointing to the userdata file to use e.g.: "@/tmp/userdata.cfg". +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl firewall](./metalctl_firewall.md) - manage firewall entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_describe.md new file mode 100644 index 0000000..64f4a42 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_firewall_describe +title: metalctl_firewall_describe +sidebar_position: 23 +--- + +## metalctl firewall describe + +describes the firewall + +``` +metalctl firewall describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl firewall](./metalctl_firewall.md) - manage firewall entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_list.md new file mode 100644 index 0000000..152c6cc --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_list.md @@ -0,0 +1,62 @@ +--- +slug: /references/metalctl_firewall_list +title: metalctl_firewall_list +sidebar_position: 24 +--- + +## metalctl firewall list + +list all firewalls + +``` +metalctl firewall list [flags] +``` + +### Options + +``` + -h, --help help for list + --hostname string allocation hostname to filter [optional] + --id string ID to filter [optional] + --image string allocation image to filter [optional] + --mac string mac to filter [optional] + --name string allocation name to filter [optional] + --partition string partition to filter [optional] + --project string allocation project to filter [optional] + --size string size to filter [optional] + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: age|event|id|image|liveliness|partition|project|size|when + --tags strings tags to filter, use it like: --tags "tag1,tag2" or --tags "tag3". +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl firewall](./metalctl_firewall.md) - manage firewall entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_ssh.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_ssh.md new file mode 100644 index 0000000..e85d1a0 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firewall_ssh.md @@ -0,0 +1,57 @@ +--- +slug: /references/metalctl_firewall_ssh +title: metalctl_firewall_ssh +sidebar_position: 25 +--- + +## metalctl firewall ssh + +SSH to a firewall + +### Synopsis + +SSH to a firewall via VPN. + +``` +metalctl firewall ssh [flags] +``` + +### Options + +``` + -h, --help help for ssh + -i, --identity string specify identity file to SSH to the firewall like: -i path/to/id_rsa (default "~/.ssh/id_rsa") +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl firewall](./metalctl_firewall.md) - manage firewall entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware.md new file mode 100644 index 0000000..6656b61 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware.md @@ -0,0 +1,55 @@ +--- +slug: /references/metalctl_firmware +title: metalctl_firmware +sidebar_position: 26 +--- + +## metalctl firmware + +manage firmwares + +### Synopsis + +list, upload and remove firmwares. + +### Options + +``` + -h, --help help for firmware +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl firmware delete](./metalctl_firmware_delete.md) - delete a firmware +* [metalctl firmware list](./metalctl_firmware_list.md) - list firmwares +* [metalctl firmware upload](./metalctl_firmware_upload.md) - upload a firmware + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_delete.md new file mode 100644 index 0000000..ca04286 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_delete.md @@ -0,0 +1,60 @@ +--- +slug: /references/metalctl_firmware_delete +title: metalctl_firmware_delete +sidebar_position: 27 +--- + +## metalctl firmware delete + +delete a firmware + +### Synopsis + +deletes the specified firmware. + +``` +metalctl firmware delete [flags] +``` + +### Options + +``` + --board string the board type (required) + -h, --help help for delete + --kind string the firmware kind [bmc|bios] (required) + --revision string the firmware revision (required) + --vendor string the vendor (required) +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl firmware](./metalctl_firmware.md) - manage firmwares + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_list.md new file mode 100644 index 0000000..2160fcd --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_list.md @@ -0,0 +1,60 @@ +--- +slug: /references/metalctl_firmware_list +title: metalctl_firmware_list +sidebar_position: 28 +--- + +## metalctl firmware list + +list firmwares + +### Synopsis + +lists all available firmwares matching the given criteria. + +``` +metalctl firmware list [flags] +``` + +### Options + +``` + --board string the board type + -h, --help help for list + --kind string the firmware kind [bmc|bios] + --machineid string the machine id (ignores vendor and board flags) + --vendor string the vendor +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl firmware](./metalctl_firmware.md) - manage firmwares + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload.md new file mode 100644 index 0000000..9f39d56 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload.md @@ -0,0 +1,50 @@ +--- +slug: /references/metalctl_firmware_upload +title: metalctl_firmware_upload +sidebar_position: 29 +--- + +## metalctl firmware upload + +upload a firmware + +### Options + +``` + -h, --help help for upload +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl firmware](./metalctl_firmware.md) - manage firmwares +* [metalctl firmware upload bios](./metalctl_firmware_upload_bios.md) - upload a BIOS firmware +* [metalctl firmware upload bmc](./metalctl_firmware_upload_bmc.md) - upload a BMC firmware + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload_bios.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload_bios.md new file mode 100644 index 0000000..04119d7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload_bios.md @@ -0,0 +1,59 @@ +--- +slug: /references/metalctl_firmware_upload_bios +title: metalctl_firmware_upload_bios +sidebar_position: 30 +--- + +## metalctl firmware upload bios + +upload a BIOS firmware + +### Synopsis + +the given BIOS firmware file will be uploaded and tagged as given revision. + +``` +metalctl firmware upload bios [flags] +``` + +### Options + +``` + --board string the board type (required) + -h, --help help for bios + --revision string the BIOS firmware revision (required) + --vendor string the vendor (required) +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl firmware upload](./metalctl_firmware_upload.md) - upload a firmware + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload_bmc.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload_bmc.md new file mode 100644 index 0000000..6613105 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_firmware_upload_bmc.md @@ -0,0 +1,59 @@ +--- +slug: /references/metalctl_firmware_upload_bmc +title: metalctl_firmware_upload_bmc +sidebar_position: 31 +--- + +## metalctl firmware upload bmc + +upload a BMC firmware + +### Synopsis + +the given BMC firmware file will be uploaded and tagged as given revision. + +``` +metalctl firmware upload bmc [flags] +``` + +### Options + +``` + --board string the board type (required) + -h, --help help for bmc + --revision string the BMC firmware revision (required) + --vendor string the vendor (required) +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl firmware upload](./metalctl_firmware_upload.md) - upload a firmware + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_health.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_health.md new file mode 100644 index 0000000..41509eb --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_health.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_health +title: metalctl_health +sidebar_position: 32 +--- + +## metalctl health + +shows the server health + +``` +metalctl health [flags] +``` + +### Options + +``` + -h, --help help for health +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image.md new file mode 100644 index 0000000..86cda0a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image.md @@ -0,0 +1,59 @@ +--- +slug: /references/metalctl_image +title: metalctl_image +sidebar_position: 33 +--- + +## metalctl image + +manage image entities + +### Synopsis + +os images available to be installed on machines. + +### Options + +``` + -h, --help help for image +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl image apply](./metalctl_image_apply.md) - applies one or more images from a given file +* [metalctl image create](./metalctl_image_create.md) - creates the image +* [metalctl image delete](./metalctl_image_delete.md) - deletes the image +* [metalctl image describe](./metalctl_image_describe.md) - describes the image +* [metalctl image edit](./metalctl_image_edit.md) - edit the image through an editor and update +* [metalctl image list](./metalctl_image_list.md) - list all images +* [metalctl image update](./metalctl_image_update.md) - updates the image + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_apply.md new file mode 100644 index 0000000..deda0fe --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_image_apply +title: metalctl_image_apply +sidebar_position: 34 +--- + +## metalctl image apply + +applies one or more images from a given file + +``` +metalctl image apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl image describe image-1 -o yaml > image.yaml + $ vi image.yaml + $ # either via stdin + $ cat image.yaml | metalctl image apply -f - + $ # or via file + $ metalctl image apply -f image.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl image](./metalctl_image.md) - manage image entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_create.md new file mode 100644 index 0000000..166aff5 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_create.md @@ -0,0 +1,72 @@ +--- +slug: /references/metalctl_image_create +title: metalctl_image_create +sidebar_position: 35 +--- + +## metalctl image create + +creates the image + +``` +metalctl image create [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -d, --description string Description of the image. + --features strings features of the image, can be one of machine|firewall + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl image describe image-1 -o yaml > image.yaml + $ vi image.yaml + $ # either via stdin + $ cat image.yaml | metalctl image create -f - + $ # or via file + $ metalctl image create -f image.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --id string ID of the image. + -n, --name string Name of the image. + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations + --url string url of the image. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl image](./metalctl_image.md) - manage image entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_delete.md new file mode 100644 index 0000000..a3c33bd --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_image_delete +title: metalctl_image_delete +sidebar_position: 36 +--- + +## metalctl image delete + +deletes the image + +``` +metalctl image delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl image describe image-1 -o yaml > image.yaml + $ vi image.yaml + $ # either via stdin + $ cat image.yaml | metalctl image delete -f - + $ # or via file + $ metalctl image delete -f image.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl image](./metalctl_image.md) - manage image entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_describe.md new file mode 100644 index 0000000..9fe087b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_image_describe +title: metalctl_image_describe +sidebar_position: 37 +--- + +## metalctl image describe + +describes the image + +``` +metalctl image describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl image](./metalctl_image.md) - manage image entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_edit.md new file mode 100644 index 0000000..0a8cd03 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_image_edit +title: metalctl_image_edit +sidebar_position: 38 +--- + +## metalctl image edit + +edit the image through an editor and update + +``` +metalctl image edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl image](./metalctl_image.md) - manage image entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_list.md new file mode 100644 index 0000000..b1c0c2b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_list.md @@ -0,0 +1,60 @@ +--- +slug: /references/metalctl_image_list +title: metalctl_image_list +sidebar_position: 39 +--- + +## metalctl image list + +list all images + +``` +metalctl image list [flags] +``` + +### Options + +``` + --classification string Classification of this image. + --features string Features of this image. + -h, --help help for list + --id string ID of the image. + --name string Name of the image. + --os string OS derivate of this image. + --show-usage show from how many allocated machines every image is used + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: classification|description|expiration|id|name + --version string Version of this image. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl image](./metalctl_image.md) - manage image entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_update.md new file mode 100644 index 0000000..ed92e63 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_image_update.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_image_update +title: metalctl_image_update +sidebar_position: 40 +--- + +## metalctl image update + +updates the image + +``` +metalctl image update [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl image describe image-1 -o yaml > image.yaml + $ vi image.yaml + $ # either via stdin + $ cat image.yaml | metalctl image update -f - + $ # or via file + $ metalctl image update -f image.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl image](./metalctl_image.md) - manage image entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_login.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_login.md new file mode 100644 index 0000000..18d342c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_login.md @@ -0,0 +1,57 @@ +--- +slug: /references/metalctl_login +title: metalctl_login +sidebar_position: 41 +--- + +## metalctl login + +login user and receive token + +### Synopsis + +login and receive token that will be used to authenticate commands. + +``` +metalctl login [flags] +``` + +### Options + +``` + -h, --help help for login + --print-only If true, the token is printed to stdout +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_logout.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_logout.md new file mode 100644 index 0000000..86b00a1 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_logout.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_logout +title: metalctl_logout +sidebar_position: 42 +--- + +## metalctl logout + +logout user from OIDC SSO session + +``` +metalctl logout [flags] +``` + +### Options + +``` + -h, --help help for logout +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine.md new file mode 100644 index 0000000..d7d20a7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine.md @@ -0,0 +1,70 @@ +--- +slug: /references/metalctl_machine +title: metalctl_machine +sidebar_position: 43 +--- + +## metalctl machine + +manage machine entities + +### Synopsis + +a machine is a bare metal server provisioned through metal-stack that is intended to run user workload. + +### Options + +``` + -h, --help help for machine +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl machine apply](./metalctl_machine_apply.md) - applies one or more machines from a given file +* [metalctl machine console](./metalctl_machine_console.md) - console access to a machine +* [metalctl machine consolepassword](./metalctl_machine_consolepassword.md) - fetch the consolepassword for a machine +* [metalctl machine create](./metalctl_machine_create.md) - creates the machine +* [metalctl machine delete](./metalctl_machine_delete.md) - deletes the machine +* [metalctl machine describe](./metalctl_machine_describe.md) - describes the machine +* [metalctl machine edit](./metalctl_machine_edit.md) - edit the machine through an editor and update +* [metalctl machine identify](./metalctl_machine_identify.md) - manage machine chassis identify LED power +* [metalctl machine ipmi](./metalctl_machine_ipmi.md) - display ipmi details of the machine, if no machine ID is given all ipmi addresses are returned. +* [metalctl machine issues](./metalctl_machine_issues.md) - display machines which are in a potential bad state +* [metalctl machine list](./metalctl_machine_list.md) - list all machines +* [metalctl machine lock](./metalctl_machine_lock.md) - lock a machine +* [metalctl machine logs](./metalctl_machine_logs.md) - display machine provisioning logs +* [metalctl machine power](./metalctl_machine_power.md) - manage machine power +* [metalctl machine reinstall](./metalctl_machine_reinstall.md) - reinstalls an already allocated machine +* [metalctl machine reserve](./metalctl_machine_reserve.md) - reserve a machine +* [metalctl machine update](./metalctl_machine_update.md) - updates the machine +* [metalctl machine update-firmware](./metalctl_machine_update-firmware.md) - update a machine firmware + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_apply.md new file mode 100644 index 0000000..20c81a4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_machine_apply +title: metalctl_machine_apply +sidebar_position: 44 +--- + +## metalctl machine apply + +applies one or more machines from a given file + +``` +metalctl machine apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl machine describe machine-1 -o yaml > machine.yaml + $ vi machine.yaml + $ # either via stdin + $ cat machine.yaml | metalctl machine apply -f - + $ # or via file + $ metalctl machine apply -f machine.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_console.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_console.md new file mode 100644 index 0000000..5b2c28a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_console.md @@ -0,0 +1,62 @@ +--- +slug: /references/metalctl_machine_console +title: metalctl_machine_console +sidebar_position: 45 +--- + +## metalctl machine console + +console access to a machine + +### Synopsis + +console access to a machine, machine must be created with a ssh public key, authentication is done with your private key. +In case the machine did not register properly a direct ipmi console access is available via the --ipmi flag. This is only for administrative access. + +``` +metalctl machine console [flags] +``` + +### Options + +``` + --admin authenticate as admin (admin only). + -h, --help help for console + --ipmi use ipmitool with direct network access (admin only). + --ipmipassword string overwrite ipmi password (admin only). + --ipmiuser string overwrite ipmi user (admin only). + -i, --sshidentity string SSH key file, if not given the default ssh key will be used if present [optional]. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_consolepassword.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_consolepassword.md new file mode 100644 index 0000000..1a4c286 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_consolepassword.md @@ -0,0 +1,53 @@ +--- +slug: /references/metalctl_machine_consolepassword +title: metalctl_machine_consolepassword +sidebar_position: 46 +--- + +## metalctl machine consolepassword + +fetch the consolepassword for a machine + +``` +metalctl machine consolepassword [flags] +``` + +### Options + +``` + -h, --help help for consolepassword + --reason string a short description why access to the consolepassword is required +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_create.md new file mode 100644 index 0000000..89f09ae --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_create.md @@ -0,0 +1,132 @@ +--- +slug: /references/metalctl_machine_create +title: metalctl_machine_create +sidebar_position: 47 +--- + +## metalctl machine create + +creates the machine + +``` +metalctl machine create [flags] +``` + +### Examples + +``` +machine create can be done in two different ways: + +- default with automatic allocation: + + metalctl machine create \ + --hostname worker01 \ + --name worker \ + --image ubuntu-18.04 \ # query available with: metalctl image list + --size t1-small-x86 \ # query available with: metalctl size list + --partition test \ # query available with: metalctl partition list + --project cluster01 \ + --sshpublickey "@~/.ssh/id_rsa.pub" + +- for metal administration with reserved machines: + + reserve a machine you want to allocate: + + metalctl machine reserve 00000000-0000-0000-0000-0cc47ae54694 --description "blocked for maintenance" + + allocate this machine: + + metalctl machine create \ + --hostname worker01 \ + --name worker \ + --image ubuntu-18.04 \ # query available with: metalctl image list + --project cluster01 \ + --sshpublickey "@~/.ssh/id_rsa.pub" \ + --id 00000000-0000-0000-0000-0cc47ae54694 + +after you do not want to use this machine exclusive, remove the reservation: + +metalctl machine reserve 00000000-0000-0000-0000-0cc47ae54694 --remove + +Once created the machine installation can not be modified anymore. + +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -d, --description string Description of the machine to create. [optional] + --dnsservers strings dns servers to add to the machine or firewall. [optional] + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl machine describe machine-1 -o yaml > machine.yaml + $ vi machine.yaml + $ # either via stdin + $ cat machine.yaml | metalctl machine create -f - + $ # or via file + $ metalctl machine create -f machine.yaml + + the file can also contain multiple documents and perform a bulk operation. + + --filesystemlayout string Filesystemlayout to use during machine installation. [optional] + -h, --help help for create + -H, --hostname string Hostname of the machine. [required] + -I, --id string ID of a specific machine to allocate, if given, size and partition are ignored. Need to be set to reserved (--reserve) state before. + -i, --image string OS Image to install. [required] + --ips strings Sets the machine's IP address. Usage: [--ips[=IPV4-ADDRESS[,IPV4-ADDRESS]...]]... + IPV4-ADDRESS specifies the IPv4 address to add. + It can only be used in conjunction with --networks. + -n, --name string Name of the machine. [optional] + --networks strings Adds a network. Usage: [--networks NETWORK[:MODE][,NETWORK[:MODE]]...]... + NETWORK specifies the name or id of an existing network. + MODE cane be omitted or one of: + auto IP address is automatically acquired from the given network + noauto IP address for the given network must be provided via --ips + --ntpservers strings ntp servers to add to the machine or firewall. [optional] + -S, --partition string partition/datacenter where the machine is created. [required, except for reserved machines] + -P, --project string Project where the machine should belong to. [required] + -s, --size string Size of the machine. [required, except for reserved machines] + --skip-security-prompts skips security prompt for bulk operations + -p, --sshpublickey string SSH public key for access via ssh and console. [optional] + Can be either the public key as string, or pointing to the public key file to use e.g.: "@~/.ssh/id_rsa.pub". + If ~/.ssh/[id_ed25519.pub | id_rsa.pub | id_dsa.pub] is present it will be picked as default, matching the first one in this order. + --tags strings tags to add to the machine, use it like: --tags "tag1,tag2" or --tags "tag3". + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations + --userdata string cloud-init.io compatible userdata. [optional] + Can be either the userdata as string, or pointing to the userdata file to use e.g.: "@/tmp/userdata.cfg". +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_delete.md new file mode 100644 index 0000000..a39f7bf --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_delete.md @@ -0,0 +1,72 @@ +--- +slug: /references/metalctl_machine_delete +title: metalctl_machine_delete +sidebar_position: 48 +--- + +## metalctl machine delete + +deletes the machine + +### Synopsis + +delete a machine and destroy all data stored on the local disks. Once destroyed it is back for usage by other projects. A destroyed machine can not restored anymore + +``` +metalctl machine delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl machine describe machine-1 -o yaml > machine.yaml + $ vi machine.yaml + $ # either via stdin + $ cat machine.yaml | metalctl machine delete -f - + $ # or via file + $ metalctl machine delete -f machine.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --remove-from-database remove given machine from the database, is only required for maintenance reasons [optional] (admin only). + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_describe.md new file mode 100644 index 0000000..d202a94 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_machine_describe +title: metalctl_machine_describe +sidebar_position: 49 +--- + +## metalctl machine describe + +describes the machine + +``` +metalctl machine describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_edit.md new file mode 100644 index 0000000..32b2c9f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_machine_edit +title: metalctl_machine_edit +sidebar_position: 50 +--- + +## metalctl machine edit + +edit the machine through an editor and update + +``` +metalctl machine edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify.md new file mode 100644 index 0000000..ab006a5 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify.md @@ -0,0 +1,50 @@ +--- +slug: /references/metalctl_machine_identify +title: metalctl_machine_identify +sidebar_position: 51 +--- + +## metalctl machine identify + +manage machine chassis identify LED power + +### Options + +``` + -h, --help help for identify +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities +* [metalctl machine identify off](./metalctl_machine_identify_off.md) - power off the machine chassis identify LED +* [metalctl machine identify on](./metalctl_machine_identify_on.md) - power on the machine chassis identify LED + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify_off.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify_off.md new file mode 100644 index 0000000..1f4f1b2 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify_off.md @@ -0,0 +1,57 @@ +--- +slug: /references/metalctl_machine_identify_off +title: metalctl_machine_identify_off +sidebar_position: 52 +--- + +## metalctl machine identify off + +power off the machine chassis identify LED + +### Synopsis + +set the machine chassis identify LED to off state + +``` +metalctl machine identify off [flags] +``` + +### Options + +``` + -d, --description string description of the reason for chassis identify LED turn-off. (default "Triggered by metalctl") + -h, --help help for off +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine identify](./metalctl_machine_identify.md) - manage machine chassis identify LED power + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify_on.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify_on.md new file mode 100644 index 0000000..65348d8 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_identify_on.md @@ -0,0 +1,57 @@ +--- +slug: /references/metalctl_machine_identify_on +title: metalctl_machine_identify_on +sidebar_position: 53 +--- + +## metalctl machine identify on + +power on the machine chassis identify LED + +### Synopsis + +set the machine chassis identify LED to on state + +``` +metalctl machine identify on [flags] +``` + +### Options + +``` + -d, --description string description of the reason for chassis identify LED turn-on. + -h, --help help for on +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine identify](./metalctl_machine_identify.md) - manage machine chassis identify LED power + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_ipmi.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_ipmi.md new file mode 100644 index 0000000..89193ed --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_ipmi.md @@ -0,0 +1,92 @@ +--- +slug: /references/metalctl_machine_ipmi +title: metalctl_machine_ipmi +sidebar_position: 54 +--- + +## metalctl machine ipmi + +display ipmi details of the machine, if no machine ID is given all ipmi addresses are returned. + +### Synopsis + +display ipmi details of the machine, if no machine ID is given all ipmi addresses are returned. + +Meaning of the emojis: + +🚧 Machine is reserved. Reserved machines are not considered for random allocation until the reservation flag is removed. +🔒 Machine is locked. Locked machines can not be deleted until the lock is removed. +💀 Machine is dead. The metal-api does not receive any events from this machine. +❗ Machine has a last event error. The machine has recently encountered an error during the provisioning lifecycle. +❓ Machine is in unknown condition. The metal-api does not receive phoned home events anymore or has never booted successfully. +⭕ Machine is in a provisioning crash loop. Flag can be reset through an API-triggered reboot or when the machine reaches the phoned home state. +🚑 Machine reclaim has failed. The machine was deleted but it is not going back into the available machine pool. +🛡 Machine is connected to our VPN, ssh access only possible via this VPN. + + +``` +metalctl machine ipmi [] [flags] +``` + +### Options + +``` + --bmc-address string bmc ipmi address (needs to include port) to filter [optional] + --bmc-mac string bmc mac address to filter [optional] + --board-part-number string fru board part number to filter [optional] + -h, --help help for ipmi + --hostname string allocation hostname to filter [optional] + --id string ID to filter [optional] + --image string allocation image to filter [optional] + --last-event-error-threshold duration the duration up to how long in the past a machine last event error will be counted as an issue [optional] (default 1h0m0s) + --mac string mac to filter [optional] + --manufacturer string fru manufacturer to filter [optional] + --name string allocation name to filter [optional] + --network-destination-prefixes string network destination prefixes to filter [optional] + --network-ids string network ids to filter [optional] + --network-ips string network ips to filter [optional] + --partition string partition to filter [optional] + --product-part-number string fru product part number to filter [optional] + --product-serial string fru product serial to filter [optional] + --project string allocation project to filter [optional] + --rack string rack to filter [optional] + --role string allocation role to filter [optional] + --size string size to filter [optional] + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: age|bios|bmc|event|id|liveliness|partition|project|rack|size|when + --state string state to filter [optional] + --tags strings tags to filter, use it like: --tags "tag1,tag2" or --tags "tag3". +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities +* [metalctl machine ipmi events](./metalctl_machine_ipmi_events.md) - display machine hardware events + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_ipmi_events.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_ipmi_events.md new file mode 100644 index 0000000..bbb4204 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_ipmi_events.md @@ -0,0 +1,55 @@ +--- +slug: /references/metalctl_machine_ipmi_events +title: metalctl_machine_ipmi_events +sidebar_position: 55 +--- + +## metalctl machine ipmi events + +display machine hardware events + +``` +metalctl machine ipmi events [flags] +``` + +### Options + +``` + -h, --help help for events + --ipmipassword string overwrite ipmi password (admin only). + --ipmiuser string overwrite ipmi user (admin only). + -n, --last string show last log entries. (default "10") +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine ipmi](./metalctl_machine_ipmi.md) - display ipmi details of the machine, if no machine ID is given all ipmi addresses are returned. + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_issues.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_issues.md new file mode 100644 index 0000000..ac4a3d1 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_issues.md @@ -0,0 +1,95 @@ +--- +slug: /references/metalctl_machine_issues +title: metalctl_machine_issues +sidebar_position: 56 +--- + +## metalctl machine issues + +display machines which are in a potential bad state + +### Synopsis + +display machines which are in a potential bad state + +Meaning of the emojis: + +🚧 Machine is reserved. Reserved machines are not considered for random allocation until the reservation flag is removed. +🔒 Machine is locked. Locked machines can not be deleted until the lock is removed. +💀 Machine is dead. The metal-api does not receive any events from this machine. +❗ Machine has a last event error. The machine has recently encountered an error during the provisioning lifecycle. +❓ Machine is in unknown condition. The metal-api does not receive phoned home events anymore or has never booted successfully. +⭕ Machine is in a provisioning crash loop. Flag can be reset through an API-triggered reboot or when the machine reaches the phoned home state. +🚑 Machine reclaim has failed. The machine was deleted but it is not going back into the available machine pool. +🛡 Machine is connected to our VPN, ssh access only possible via this VPN. + + +``` +metalctl machine issues [] [flags] +``` + +### Options + +``` + --bmc-address string bmc ipmi address (needs to include port) to filter [optional] + --bmc-mac string bmc mac address to filter [optional] + --board-part-number string fru board part number to filter [optional] + -h, --help help for issues + --hostname string allocation hostname to filter [optional] + --id string ID to filter [optional] + --image string allocation image to filter [optional] + --last-event-error-threshold duration the duration up to how long in the past a machine last event error will be counted as an issue [optional] + --mac string mac to filter [optional] + --manufacturer string fru manufacturer to filter [optional] + --name string allocation name to filter [optional] + --network-destination-prefixes string network destination prefixes to filter [optional] + --network-ids string network ids to filter [optional] + --network-ips string network ips to filter [optional] + --omit strings issue types to omit [optional] + --only strings issue types to include [optional] + --partition string partition to filter [optional] + --product-part-number string fru product part number to filter [optional] + --product-serial string fru product serial to filter [optional] + --project string allocation project to filter [optional] + --rack string rack to filter [optional] + --role string allocation role to filter [optional] + --severity string issue severity to include [optional] + --size string size to filter [optional] + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: age|bios|bmc|event|id|liveliness|partition|project|rack|size|when + --state string state to filter [optional] + --tags strings tags to filter, use it like: --tags "tag1,tag2" or --tags "tag3". +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities +* [metalctl machine issues list](./metalctl_machine_issues_list.md) - list all machine issues that the metal-api can evaluate + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_issues_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_issues_list.md new file mode 100644 index 0000000..912974b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_issues_list.md @@ -0,0 +1,53 @@ +--- +slug: /references/metalctl_machine_issues_list +title: metalctl_machine_issues_list +sidebar_position: 57 +--- + +## metalctl machine issues list + +list all machine issues that the metal-api can evaluate + +``` +metalctl machine issues list [flags] +``` + +### Options + +``` + -h, --help help for list + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: id|severity +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine issues](./metalctl_machine_issues.md) - display machines which are in a potential bad state + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_list.md new file mode 100644 index 0000000..3fd0f49 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_list.md @@ -0,0 +1,91 @@ +--- +slug: /references/metalctl_machine_list +title: metalctl_machine_list +sidebar_position: 58 +--- + +## metalctl machine list + +list all machines + +### Synopsis + +list all machines + +Meaning of the emojis: + +🚧 Machine is reserved. Reserved machines are not considered for random allocation until the reservation flag is removed. +🔒 Machine is locked. Locked machines can not be deleted until the lock is removed. +💀 Machine is dead. The metal-api does not receive any events from this machine. +❗ Machine has a last event error. The machine has recently encountered an error during the provisioning lifecycle. +❓ Machine is in unknown condition. The metal-api does not receive phoned home events anymore or has never booted successfully. +⭕ Machine is in a provisioning crash loop. Flag can be reset through an API-triggered reboot or when the machine reaches the phoned home state. +🚑 Machine reclaim has failed. The machine was deleted but it is not going back into the available machine pool. +🛡 Machine is connected to our VPN, ssh access only possible via this VPN. + + +``` +metalctl machine list [flags] +``` + +### Options + +``` + --bmc-address string bmc ipmi address (needs to include port) to filter [optional] + --bmc-mac string bmc mac address to filter [optional] + --board-part-number string fru board part number to filter [optional] + -h, --help help for list + --hostname string allocation hostname to filter [optional] + --id string ID to filter [optional] + --image string allocation image to filter [optional] + --last-event-error-threshold duration the duration up to how long in the past a machine last event error will be counted as an issue [optional] (default 1h0m0s) + --mac string mac to filter [optional] + --manufacturer string fru manufacturer to filter [optional] + --name string allocation name to filter [optional] + --network-destination-prefixes string network destination prefixes to filter [optional] + --network-ids string network ids to filter [optional] + --network-ips string network ips to filter [optional] + --partition string partition to filter [optional] + --product-part-number string fru product part number to filter [optional] + --product-serial string fru product serial to filter [optional] + --project string allocation project to filter [optional] + --rack string rack to filter [optional] + --role string allocation role to filter [optional] + --size string size to filter [optional] + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: age|event|id|image|liveliness|partition|project|rack|size|when + --state string state to filter [optional] + --tags strings tags to filter, use it like: --tags "tag1,tag2" or --tags "tag3". +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_lock.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_lock.md new file mode 100644 index 0000000..7ddf2af --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_lock.md @@ -0,0 +1,58 @@ +--- +slug: /references/metalctl_machine_lock +title: metalctl_machine_lock +sidebar_position: 59 +--- + +## metalctl machine lock + +lock a machine + +### Synopsis + +when a machine is locked, it can not be destroyed, to destroy a machine you must first remove the lock from that machine with --remove + +``` +metalctl machine lock [flags] +``` + +### Options + +``` + -d, --description string description of the reason for the lock. + -h, --help help for lock + -r, --remove remove the lock. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_logs.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_logs.md new file mode 100644 index 0000000..9b560ee --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_logs.md @@ -0,0 +1,53 @@ +--- +slug: /references/metalctl_machine_logs +title: metalctl_machine_logs +sidebar_position: 60 +--- + +## metalctl machine logs + +display machine provisioning logs + +``` +metalctl machine logs [flags] +``` + +### Options + +``` + -h, --help help for logs + --last-event-error-threshold duration the duration up to how long in the past a machine last event error will be counted as an issue [optional] (default 168h0m0s) +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power.md new file mode 100644 index 0000000..84e3e2f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power.md @@ -0,0 +1,55 @@ +--- +slug: /references/metalctl_machine_power +title: metalctl_machine_power +sidebar_position: 61 +--- + +## metalctl machine power + +manage machine power + +### Options + +``` + -h, --help help for power +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities +* [metalctl machine power bios](./metalctl_machine_power_bios.md) - boot a machine into BIOS +* [metalctl machine power cycle](./metalctl_machine_power_cycle.md) - power cycle a machine (graceful shutdown) +* [metalctl machine power disk](./metalctl_machine_power_disk.md) - boot a machine from disk +* [metalctl machine power off](./metalctl_machine_power_off.md) - power off a machine +* [metalctl machine power on](./metalctl_machine_power_on.md) - power on a machine +* [metalctl machine power pxe](./metalctl_machine_power_pxe.md) - boot a machine from PXE +* [metalctl machine power reset](./metalctl_machine_power_reset.md) - power reset a machine + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_bios.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_bios.md new file mode 100644 index 0000000..da94df6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_bios.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_machine_power_bios +title: metalctl_machine_power_bios +sidebar_position: 62 +--- + +## metalctl machine power bios + +boot a machine into BIOS + +### Synopsis + +the machine will boot into bios. (machine does not reboot automatically) + +``` +metalctl machine power bios [flags] +``` + +### Options + +``` + -h, --help help for bios +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine power](./metalctl_machine_power.md) - manage machine power + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_cycle.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_cycle.md new file mode 100644 index 0000000..d1c7c6f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_cycle.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_machine_power_cycle +title: metalctl_machine_power_cycle +sidebar_position: 63 +--- + +## metalctl machine power cycle + +power cycle a machine (graceful shutdown) + +### Synopsis + +(soft) cycle the machine power. + +``` +metalctl machine power cycle [flags] +``` + +### Options + +``` + -h, --help help for cycle +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine power](./metalctl_machine_power.md) - manage machine power + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_disk.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_disk.md new file mode 100644 index 0000000..225d332 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_disk.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_machine_power_disk +title: metalctl_machine_power_disk +sidebar_position: 64 +--- + +## metalctl machine power disk + +boot a machine from disk + +### Synopsis + +the machine will boot from disk. (machine does not reboot automatically) + +``` +metalctl machine power disk [flags] +``` + +### Options + +``` + -h, --help help for disk +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine power](./metalctl_machine_power.md) - manage machine power + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_off.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_off.md new file mode 100644 index 0000000..cd0a069 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_off.md @@ -0,0 +1,58 @@ +--- +slug: /references/metalctl_machine_power_off +title: metalctl_machine_power_off +sidebar_position: 65 +--- + +## metalctl machine power off + +power off a machine + +### Synopsis + +set the machine to power off state, if the machine already was off nothing happens. +It will usually take some time to power off the machine, depending on the machine type. +Power on will therefore not work if the machine is in the powering off phase. + +``` +metalctl machine power off [flags] +``` + +### Options + +``` + -h, --help help for off +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine power](./metalctl_machine_power.md) - manage machine power + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_on.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_on.md new file mode 100644 index 0000000..c74fdbd --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_on.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_machine_power_on +title: metalctl_machine_power_on +sidebar_position: 66 +--- + +## metalctl machine power on + +power on a machine + +### Synopsis + +set the machine to power on state, if the machine already was on nothing happens. + +``` +metalctl machine power on [flags] +``` + +### Options + +``` + -h, --help help for on +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine power](./metalctl_machine_power.md) - manage machine power + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_pxe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_pxe.md new file mode 100644 index 0000000..492773c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_pxe.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_machine_power_pxe +title: metalctl_machine_power_pxe +sidebar_position: 67 +--- + +## metalctl machine power pxe + +boot a machine from PXE + +### Synopsis + +the machine will boot from PXE. (machine does not reboot automatically) + +``` +metalctl machine power pxe [flags] +``` + +### Options + +``` + -h, --help help for pxe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine power](./metalctl_machine_power.md) - manage machine power + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_reset.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_reset.md new file mode 100644 index 0000000..c7f3269 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_power_reset.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_machine_power_reset +title: metalctl_machine_power_reset +sidebar_position: 68 +--- + +## metalctl machine power reset + +power reset a machine + +### Synopsis + +(hard) reset the machine power. + +``` +metalctl machine power reset [flags] +``` + +### Options + +``` + -h, --help help for reset +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine power](./metalctl_machine_power.md) - manage machine power + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_reinstall.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_reinstall.md new file mode 100644 index 0000000..e14a964 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_reinstall.md @@ -0,0 +1,59 @@ +--- +slug: /references/metalctl_machine_reinstall +title: metalctl_machine_reinstall +sidebar_position: 69 +--- + +## metalctl machine reinstall + +reinstalls an already allocated machine + +### Synopsis + +reinstalls an already allocated machine. If it is not yet allocated, nothing happens, otherwise only the machine's primary disk +is wiped and the new image will subsequently be installed on that device + +``` +metalctl machine reinstall [flags] +``` + +### Options + +``` + -d, --description string description of the reinstallation. [optional] + -h, --help help for reinstall + --image string id of the image to get installed. [required] +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_reserve.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_reserve.md new file mode 100644 index 0000000..a8a8bc2 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_reserve.md @@ -0,0 +1,60 @@ +--- +slug: /references/metalctl_machine_reserve +title: metalctl_machine_reserve +sidebar_position: 70 +--- + +## metalctl machine reserve + +reserve a machine + +### Synopsis + +reserve a machine for exclusive usage, this machine will no longer be picked by other allocations. +This is useful for maintenance of the machine or testing. After the reservation is not needed anymore, the reservation +should be removed with --remove. + +``` +metalctl machine reserve [flags] +``` + +### Options + +``` + -d, --description string description of the reason for the reservation. + -h, --help help for reserve + -r, --remove remove the reservation. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware.md new file mode 100644 index 0000000..9170ca6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware.md @@ -0,0 +1,50 @@ +--- +slug: /references/metalctl_machine_update-firmware +title: metalctl_machine_update-firmware +sidebar_position: 71 +--- + +## metalctl machine update-firmware + +update a machine firmware + +### Options + +``` + -h, --help help for update-firmware +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities +* [metalctl machine update-firmware bios](./metalctl_machine_update-firmware_bios.md) - update a machine BIOS +* [metalctl machine update-firmware bmc](./metalctl_machine_update-firmware_bmc.md) - update a machine BMC + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware_bios.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware_bios.md new file mode 100644 index 0000000..eb41964 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware_bios.md @@ -0,0 +1,58 @@ +--- +slug: /references/metalctl_machine_update-firmware_bios +title: metalctl_machine_update-firmware_bios +sidebar_position: 72 +--- + +## metalctl machine update-firmware bios + +update a machine BIOS + +### Synopsis + +the machine BIOS will be updated to given revision. If revision flag is not specified an update plan will be printed instead. + +``` +metalctl machine update-firmware bios [flags] +``` + +### Options + +``` + --description string the reason why the BIOS should be updated + -h, --help help for bios + --revision string the BIOS revision +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine update-firmware](./metalctl_machine_update-firmware.md) - update a machine firmware + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware_bmc.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware_bmc.md new file mode 100644 index 0000000..32834f6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update-firmware_bmc.md @@ -0,0 +1,58 @@ +--- +slug: /references/metalctl_machine_update-firmware_bmc +title: metalctl_machine_update-firmware_bmc +sidebar_position: 73 +--- + +## metalctl machine update-firmware bmc + +update a machine BMC + +### Synopsis + +the machine BMC will be updated to given revision. If revision flag is not specified an update plan will be printed instead. + +``` +metalctl machine update-firmware bmc [flags] +``` + +### Options + +``` + --description string the reason why the BMC should be updated + -h, --help help for bmc + --revision string the BMC revision +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine update-firmware](./metalctl_machine_update-firmware.md) - update a machine firmware + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update.md new file mode 100644 index 0000000..9621799 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_machine_update.md @@ -0,0 +1,70 @@ +--- +slug: /references/metalctl_machine_update +title: metalctl_machine_update +sidebar_position: 74 +--- + +## metalctl machine update + +updates the machine + +``` +metalctl machine update [flags] +``` + +### Options + +``` + --add-tags strings tags to be added to the machine [optional] + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + --description string the description of the machine [optional] + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl machine describe machine-1 -o yaml > machine.yaml + $ vi machine.yaml + $ # either via stdin + $ cat machine.yaml | metalctl machine update -f - + $ # or via file + $ metalctl machine update -f machine.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --remove-tags strings tags to be removed from the machine [optional] + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl machine](./metalctl_machine.md) - manage machine entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_markdown.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_markdown.md new file mode 100644 index 0000000..8d9d6a3 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_markdown.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_markdown +title: metalctl_markdown +sidebar_position: 75 +--- + +## metalctl markdown + +create markdown documentation + +``` +metalctl markdown [flags] +``` + +### Options + +``` + -h, --help help for markdown +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network.md new file mode 100644 index 0000000..80e9cc7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network.md @@ -0,0 +1,62 @@ +--- +slug: /references/metalctl_network +title: metalctl_network +sidebar_position: 76 +--- + +## metalctl network + +manage network entities + +### Synopsis + +networks can be attached to a machine or firewall such that they can communicate with each other. + +### Options + +``` + -h, --help help for network +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl network allocate](./metalctl_network_allocate.md) - allocate a network +* [metalctl network apply](./metalctl_network_apply.md) - applies one or more networks from a given file +* [metalctl network create](./metalctl_network_create.md) - creates the network +* [metalctl network delete](./metalctl_network_delete.md) - deletes the network +* [metalctl network describe](./metalctl_network_describe.md) - describes the network +* [metalctl network edit](./metalctl_network_edit.md) - edit the network through an editor and update +* [metalctl network free](./metalctl_network_free.md) - free a network +* [metalctl network ip](./metalctl_network_ip.md) - manage ip entities +* [metalctl network list](./metalctl_network_list.md) - list all networks +* [metalctl network update](./metalctl_network_update.md) - updates the network + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_allocate.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_allocate.md new file mode 100644 index 0000000..8427c77 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_allocate.md @@ -0,0 +1,62 @@ +--- +slug: /references/metalctl_network_allocate +title: metalctl_network_allocate +sidebar_position: 77 +--- + +## metalctl network allocate + +allocate a network + +``` +metalctl network allocate [flags] +``` + +### Options + +``` + --addressfamily string addressfamily of the network to acquire, if not specified the network inherits the address families from the parent [optional] + -d, --description string description of the network to create. [optional] + --dmz use this private network as dmz. [optional] + -h, --help help for allocate + --ipv4-prefix-length int ipv4 prefix bit length of the network to create, defaults to default child prefix length of the parent network. [optional] + --ipv6-prefix-length int ipv6 prefix bit length of the network to create, defaults to default child prefix length of the parent network. [optional] + --labels strings labels for this network. [optional] + -n, --name string name of the network to create. [required] + --partition string partition where this network should exist. [required] + --project string partition where this network should exist. [required] + --shared shared allows usage of this private network from other networks +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_apply.md new file mode 100644 index 0000000..e76ac94 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_network_apply +title: metalctl_network_apply +sidebar_position: 78 +--- + +## metalctl network apply + +applies one or more networks from a given file + +``` +metalctl network apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl network describe network-1 -o yaml > network.yaml + $ vi network.yaml + $ # either via stdin + $ cat network.yaml | metalctl network apply -f - + $ # or via file + $ metalctl network apply -f network.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_create.md new file mode 100644 index 0000000..a904907 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_create.md @@ -0,0 +1,83 @@ +--- +slug: /references/metalctl_network_create +title: metalctl_network_create +sidebar_position: 79 +--- + +## metalctl network create + +creates the network + +``` +metalctl network create [flags] +``` + +### Options + +``` + --additional-announcable-cidrs strings list of cidrs which are added to the route maps per tenant private network, these are typically pod- and service cidrs, can only be set in a supernetwork + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + --default-ipv4-child-prefix-length int default child prefix length for ipv4 prefixes for private super networks. + --default-ipv6-child-prefix-length int default child prefix length for ipv6 prefixes for private super networks. + -d, --description string description of the network to create. [optional] + --destination-prefixes strings destination prefixes in this network. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl network describe network-1 -o yaml > network.yaml + $ vi network.yaml + $ # either via stdin + $ cat network.yaml | metalctl network create -f - + $ # or via file + $ metalctl network create -f network.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --id string id of the network to create. [optional] + --labels strings add initial labels, must be in the form of key=value, use it like: --labels "key1=value1,key2=value2". + -n, --name string name of the network to create. [optional] + --nat set nat flag of network, if set to true, traffic from this network will be natted. + -p, --partition string partition where this network should exist. + --prefixes strings prefixes in this network. + --privatesuper set private super flag of network, if set to true, this network is used to start machines there. + --project string project of the network to create. [optional] + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations + --underlay set underlay flag of network, if set to true, this is used to transport underlay network traffic + --vrf int vrf of this network + --vrfshared vrf shared allows multiple networks to share a vrf +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_delete.md new file mode 100644 index 0000000..c6d6264 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_network_delete +title: metalctl_network_delete +sidebar_position: 80 +--- + +## metalctl network delete + +deletes the network + +``` +metalctl network delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl network describe network-1 -o yaml > network.yaml + $ vi network.yaml + $ # either via stdin + $ cat network.yaml | metalctl network delete -f - + $ # or via file + $ metalctl network delete -f network.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_describe.md new file mode 100644 index 0000000..22acb10 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_network_describe +title: metalctl_network_describe +sidebar_position: 81 +--- + +## metalctl network describe + +describes the network + +``` +metalctl network describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_edit.md new file mode 100644 index 0000000..1782d32 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_network_edit +title: metalctl_network_edit +sidebar_position: 82 +--- + +## metalctl network edit + +edit the network through an editor and update + +``` +metalctl network edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_free.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_free.md new file mode 100644 index 0000000..72a50e6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_free.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_network_free +title: metalctl_network_free +sidebar_position: 83 +--- + +## metalctl network free + +free a network + +``` +metalctl network free [flags] +``` + +### Options + +``` + -h, --help help for free +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip.md new file mode 100644 index 0000000..9da85fa --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip.md @@ -0,0 +1,60 @@ +--- +slug: /references/metalctl_network_ip +title: metalctl_network_ip +sidebar_position: 84 +--- + +## metalctl network ip + +manage ip entities + +### Synopsis + +an ip address can be attached to a machine or firewall such that network traffic can be routed to these servers. + +### Options + +``` + -h, --help help for ip +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities +* [metalctl network ip apply](./metalctl_network_ip_apply.md) - applies one or more ips from a given file +* [metalctl network ip create](./metalctl_network_ip_create.md) - creates the ip +* [metalctl network ip delete](./metalctl_network_ip_delete.md) - deletes the ip +* [metalctl network ip describe](./metalctl_network_ip_describe.md) - describes the ip +* [metalctl network ip edit](./metalctl_network_ip_edit.md) - edit the ip through an editor and update +* [metalctl network ip issues](./metalctl_network_ip_issues.md) - display ips which are in a potential bad state +* [metalctl network ip list](./metalctl_network_ip_list.md) - list all ips +* [metalctl network ip update](./metalctl_network_ip_update.md) - updates the ip + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_apply.md new file mode 100644 index 0000000..01177ac --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_network_ip_apply +title: metalctl_network_ip_apply +sidebar_position: 85 +--- + +## metalctl network ip apply + +applies one or more ips from a given file + +``` +metalctl network ip apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl ip describe ip-1 -o yaml > ip.yaml + $ vi ip.yaml + $ # either via stdin + $ cat ip.yaml | metalctl ip apply -f - + $ # or via file + $ metalctl ip apply -f ip.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network ip](./metalctl_network_ip.md) - manage ip entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_create.md new file mode 100644 index 0000000..d14e296 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_create.md @@ -0,0 +1,75 @@ +--- +slug: /references/metalctl_network_ip_create +title: metalctl_network_ip_create +sidebar_position: 86 +--- + +## metalctl network ip create + +creates the ip + +``` +metalctl network ip create [flags] +``` + +### Options + +``` + --addressfamily string addressfamily of the ip to acquire, defaults to IPv4 [optional] + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -d, --description string description of the IP to allocate. [optional] + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl ip describe ip-1 -o yaml > ip.yaml + $ vi ip.yaml + $ # either via stdin + $ cat ip.yaml | metalctl ip create -f - + $ # or via file + $ metalctl ip create -f ip.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --ipaddress string a specific ip address to allocate. [optional] + -n, --name string name of the IP to allocate. [optional] + --network string network from where the IP should be allocated. + --project string project for which the IP should be allocated. + --skip-security-prompts skips security prompt for bulk operations + --tags strings tags to attach to the IP. + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations + --type string type of the IP to allocate: ephemeral|static [optional] (default "ephemeral") +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network ip](./metalctl_network_ip.md) - manage ip entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_delete.md new file mode 100644 index 0000000..8c254f8 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_network_ip_delete +title: metalctl_network_ip_delete +sidebar_position: 87 +--- + +## metalctl network ip delete + +deletes the ip + +``` +metalctl network ip delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl ip describe ip-1 -o yaml > ip.yaml + $ vi ip.yaml + $ # either via stdin + $ cat ip.yaml | metalctl ip delete -f - + $ # or via file + $ metalctl ip delete -f ip.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network ip](./metalctl_network_ip.md) - manage ip entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_describe.md new file mode 100644 index 0000000..125397d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_network_ip_describe +title: metalctl_network_ip_describe +sidebar_position: 88 +--- + +## metalctl network ip describe + +describes the ip + +``` +metalctl network ip describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network ip](./metalctl_network_ip.md) - manage ip entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_edit.md new file mode 100644 index 0000000..1fae19e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_network_ip_edit +title: metalctl_network_ip_edit +sidebar_position: 89 +--- + +## metalctl network ip edit + +edit the ip through an editor and update + +``` +metalctl network ip edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network ip](./metalctl_network_ip.md) - manage ip entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_issues.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_issues.md new file mode 100644 index 0000000..4b01280 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_issues.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_network_ip_issues +title: metalctl_network_ip_issues +sidebar_position: 90 +--- + +## metalctl network ip issues + +display ips which are in a potential bad state + +``` +metalctl network ip issues [flags] +``` + +### Options + +``` + -h, --help help for issues +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network ip](./metalctl_network_ip.md) - manage ip entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_list.md new file mode 100644 index 0000000..2673026 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_list.md @@ -0,0 +1,62 @@ +--- +slug: /references/metalctl_network_ip_list +title: metalctl_network_ip_list +sidebar_position: 91 +--- + +## metalctl network ip list + +list all ips + +``` +metalctl network ip list [flags] +``` + +### Options + +``` + --addressfamily string addressfamily of the ip to filter, defaults to all addressfamilies [optional] + -h, --help help for list + --ipaddress string ipaddress to filter [optional] + --machineid string machineid to filter [optional] + --name string name to filter [optional] + --network string network to filter [optional] + --prefix string prefix to filter [optional] + --project string project to filter [optional] + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: age|description|id|ipaddress|name|network|type + --tags strings tags to filter [optional] + --type string type to filter [optional] +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network ip](./metalctl_network_ip.md) - manage ip entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_update.md new file mode 100644 index 0000000..c7825f2 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_ip_update.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_network_ip_update +title: metalctl_network_ip_update +sidebar_position: 92 +--- + +## metalctl network ip update + +updates the ip + +``` +metalctl network ip update [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl ip describe ip-1 -o yaml > ip.yaml + $ vi ip.yaml + $ # either via stdin + $ cat ip.yaml | metalctl ip update -f - + $ # or via file + $ metalctl ip update -f ip.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network ip](./metalctl_network_ip.md) - manage ip entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_list.md new file mode 100644 index 0000000..568bdac --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_list.md @@ -0,0 +1,65 @@ +--- +slug: /references/metalctl_network_list +title: metalctl_network_list +sidebar_position: 93 +--- + +## metalctl network list + +list all networks + +``` +metalctl network list [flags] +``` + +### Options + +``` + --addressfamily string addressfamily to filter, either ipv4 or ipv6 [optional] + --destination-prefixes strings destination prefixes to filter, use it like: --destination-prefixes prefix1,prefix2. + -h, --help help for list + --id string ID to filter [optional] + --name string name to filter [optional] + --nat nat to filter [optional] + --parent string parent network to filter [optional] + --partition string partition to filter [optional] + --prefixes strings prefixes to filter, use it like: --prefixes prefix1,prefix2. + --privatesuper privatesuper to filter [optional] + --project string project to filter [optional] + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: description|id|name|partition|project + --underlay underlay to filter [optional] + --vrf int vrf to filter [optional] +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_update.md new file mode 100644 index 0000000..9b9908e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_network_update.md @@ -0,0 +1,76 @@ +--- +slug: /references/metalctl_network_update +title: metalctl_network_update +sidebar_position: 94 +--- + +## metalctl network update + +updates the network + +``` +metalctl network update [flags] +``` + +### Options + +``` + --add-destinationprefixes strings destination prefixes to be added to the network [optional] + --add-prefixes strings prefixes to be added to the network [optional] + --additional-announcable-cidrs strings list of cidrs which are added to the route maps per tenant private network, these are typically pod- and service cidrs, can only be set in a supernetwork + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + --description string the description of the network [optional] + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl network describe network-1 -o yaml > network.yaml + $ vi network.yaml + $ # either via stdin + $ cat network.yaml | metalctl network update -f - + $ # or via file + $ metalctl network update -f network.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --labels strings the labels of the network, must be in the form of key=value, use it like: --labels "key1=value1,key2=value2". [optional] + --name string the name of the network [optional] + --remove-destinationprefixes strings destination prefixes to be removed from the network [optional] + --remove-prefixes strings prefixes to be removed from the network [optional] + --shared marks a network as shared or not [optional] + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl network](./metalctl_network.md) - manage network entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition.md new file mode 100644 index 0000000..4e5c0c6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition.md @@ -0,0 +1,60 @@ +--- +slug: /references/metalctl_partition +title: metalctl_partition +sidebar_position: 95 +--- + +## metalctl partition + +manage partition entities + +### Synopsis + +a partition is a failure domain in the data center. + +### Options + +``` + -h, --help help for partition +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl partition apply](./metalctl_partition_apply.md) - applies one or more partitions from a given file +* [metalctl partition capacity](./metalctl_partition_capacity.md) - show partition capacity +* [metalctl partition create](./metalctl_partition_create.md) - creates the partition +* [metalctl partition delete](./metalctl_partition_delete.md) - deletes the partition +* [metalctl partition describe](./metalctl_partition_describe.md) - describes the partition +* [metalctl partition edit](./metalctl_partition_edit.md) - edit the partition through an editor and update +* [metalctl partition list](./metalctl_partition_list.md) - list all partitions +* [metalctl partition update](./metalctl_partition_update.md) - updates the partition + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_apply.md new file mode 100644 index 0000000..63034c4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_partition_apply +title: metalctl_partition_apply +sidebar_position: 96 +--- + +## metalctl partition apply + +applies one or more partitions from a given file + +``` +metalctl partition apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl partition describe partition-1 -o yaml > partition.yaml + $ vi partition.yaml + $ # either via stdin + $ cat partition.yaml | metalctl partition apply -f - + $ # or via file + $ metalctl partition apply -f partition.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl partition](./metalctl_partition.md) - manage partition entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_capacity.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_capacity.md new file mode 100644 index 0000000..ba89bb6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_capacity.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_partition_capacity +title: metalctl_partition_capacity +sidebar_position: 97 +--- + +## metalctl partition capacity + +show partition capacity + +``` +metalctl partition capacity [flags] +``` + +### Options + +``` + -h, --help help for capacity + --id string filter on partition id. [optional] + --project-id string consider project-specific counts, e.g. size reservations. [optional] + --size string filter on size id. [optional] + --sort-by strings order by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: description|id|name +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl partition](./metalctl_partition.md) - manage partition entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_create.md new file mode 100644 index 0000000..5b83d12 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_create.md @@ -0,0 +1,76 @@ +--- +slug: /references/metalctl_partition_create +title: metalctl_partition_create +sidebar_position: 98 +--- + +## metalctl partition create + +creates the partition + +``` +metalctl partition create [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + --cmdline string kernel commandline for the metal-hammer in the partition. [required] + -d, --description string Description of the partition. [required] + --dnsservers string dns servers for the machines and firewalls in the partition. [optional] + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl partition describe partition-1 -o yaml > partition.yaml + $ vi partition.yaml + $ # either via stdin + $ cat partition.yaml | metalctl partition create -f - + $ # or via file + $ metalctl partition create -f partition.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --id string ID of the partition. [required] + --imageurl string initrd for the metal-hammer in the partition. [required] + --kernelurl string kernel url for the metal-hammer in the partition. [required] + --mgmtserver string management server address in the partition. [required] + -n, --name string Name of the partition. [optional] + --ntpservers string ntp servers for the machines and firewalls in the partition. [optional] + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl partition](./metalctl_partition.md) - manage partition entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_delete.md new file mode 100644 index 0000000..fa2662b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_partition_delete +title: metalctl_partition_delete +sidebar_position: 99 +--- + +## metalctl partition delete + +deletes the partition + +``` +metalctl partition delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl partition describe partition-1 -o yaml > partition.yaml + $ vi partition.yaml + $ # either via stdin + $ cat partition.yaml | metalctl partition delete -f - + $ # or via file + $ metalctl partition delete -f partition.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl partition](./metalctl_partition.md) - manage partition entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_describe.md new file mode 100644 index 0000000..bbea4a4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_partition_describe +title: metalctl_partition_describe +sidebar_position: 100 +--- + +## metalctl partition describe + +describes the partition + +``` +metalctl partition describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl partition](./metalctl_partition.md) - manage partition entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_edit.md new file mode 100644 index 0000000..3679311 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_partition_edit +title: metalctl_partition_edit +sidebar_position: 101 +--- + +## metalctl partition edit + +edit the partition through an editor and update + +``` +metalctl partition edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl partition](./metalctl_partition.md) - manage partition entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_list.md new file mode 100644 index 0000000..25607ea --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_list.md @@ -0,0 +1,53 @@ +--- +slug: /references/metalctl_partition_list +title: metalctl_partition_list +sidebar_position: 102 +--- + +## metalctl partition list + +list all partitions + +``` +metalctl partition list [flags] +``` + +### Options + +``` + -h, --help help for list + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: description|id|name +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl partition](./metalctl_partition.md) - manage partition entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_update.md new file mode 100644 index 0000000..3dabe09 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_partition_update.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_partition_update +title: metalctl_partition_update +sidebar_position: 103 +--- + +## metalctl partition update + +updates the partition + +``` +metalctl partition update [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl partition describe partition-1 -o yaml > partition.yaml + $ vi partition.yaml + $ # either via stdin + $ cat partition.yaml | metalctl partition update -f - + $ # or via file + $ metalctl partition update -f partition.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl partition](./metalctl_partition.md) - manage partition entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project.md new file mode 100644 index 0000000..fb1babd --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project.md @@ -0,0 +1,59 @@ +--- +slug: /references/metalctl_project +title: metalctl_project +sidebar_position: 104 +--- + +## metalctl project + +manage project entities + +### Synopsis + +a project belongs to a tenant and groups together entities in metal-stack. + +### Options + +``` + -h, --help help for project +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl project apply](./metalctl_project_apply.md) - applies one or more projects from a given file +* [metalctl project create](./metalctl_project_create.md) - creates the project +* [metalctl project delete](./metalctl_project_delete.md) - deletes the project +* [metalctl project describe](./metalctl_project_describe.md) - describes the project +* [metalctl project edit](./metalctl_project_edit.md) - edit the project through an editor and update +* [metalctl project list](./metalctl_project_list.md) - list all projects +* [metalctl project update](./metalctl_project_update.md) - updates the project + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_apply.md new file mode 100644 index 0000000..8acab5f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_project_apply +title: metalctl_project_apply +sidebar_position: 105 +--- + +## metalctl project apply + +applies one or more projects from a given file + +``` +metalctl project apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl project describe project-1 -o yaml > project.yaml + $ vi project.yaml + $ # either via stdin + $ cat project.yaml | metalctl project apply -f - + $ # or via file + $ metalctl project apply -f project.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl project](./metalctl_project.md) - manage project entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_create.md new file mode 100644 index 0000000..de1941d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_create.md @@ -0,0 +1,75 @@ +--- +slug: /references/metalctl_project_create +title: metalctl_project_create +sidebar_position: 106 +--- + +## metalctl project create + +creates the project + +``` +metalctl project create [flags] +``` + +### Options + +``` + --annotation strings add initial annotation, must be in the form of key=value, can be given multiple times to add multiple annotations, e.g. --annotation key=value --annotation foo=bar + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + --cluster-quota int32 cluster quota + --description string description of the project. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl project describe project-1 -o yaml > project.yaml + $ vi project.yaml + $ # either via stdin + $ cat project.yaml | metalctl project create -f - + $ # or via file + $ metalctl project create -f project.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --ip-quota int32 ip quota + --label strings add initial label, can be given multiple times to add multiple labels, e.g. --label=foo --label=bar + --machine-quota int32 machine quota + --name string name of the project, max 10 characters. + --skip-security-prompts skips security prompt for bulk operations + --tenant string create project for given tenant + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl project](./metalctl_project.md) - manage project entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_delete.md new file mode 100644 index 0000000..29864c3 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_project_delete +title: metalctl_project_delete +sidebar_position: 107 +--- + +## metalctl project delete + +deletes the project + +``` +metalctl project delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl project describe project-1 -o yaml > project.yaml + $ vi project.yaml + $ # either via stdin + $ cat project.yaml | metalctl project delete -f - + $ # or via file + $ metalctl project delete -f project.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl project](./metalctl_project.md) - manage project entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_describe.md new file mode 100644 index 0000000..479cddb --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_project_describe +title: metalctl_project_describe +sidebar_position: 108 +--- + +## metalctl project describe + +describes the project + +``` +metalctl project describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl project](./metalctl_project.md) - manage project entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_edit.md new file mode 100644 index 0000000..2323afc --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_project_edit +title: metalctl_project_edit +sidebar_position: 109 +--- + +## metalctl project edit + +edit the project through an editor and update + +``` +metalctl project edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl project](./metalctl_project.md) - manage project entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_list.md new file mode 100644 index 0000000..e0d3c83 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_list.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_project_list +title: metalctl_project_list +sidebar_position: 110 +--- + +## metalctl project list + +list all projects + +``` +metalctl project list [flags] +``` + +### Options + +``` + -h, --help help for list + --id string ID of the project. + --name string Name of the project. + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: description|id|name|tenant + --tenant string tenant of this project. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl project](./metalctl_project.md) - manage project entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_update.md new file mode 100644 index 0000000..9612d1e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_project_update.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_project_update +title: metalctl_project_update +sidebar_position: 111 +--- + +## metalctl project update + +updates the project + +``` +metalctl project update [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl project describe project-1 -o yaml > project.yaml + $ vi project.yaml + $ # either via stdin + $ cat project.yaml | metalctl project update -f - + $ # or via file + $ metalctl project update -f project.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl project](./metalctl_project.md) - manage project entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size.md new file mode 100644 index 0000000..1dfc868 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size.md @@ -0,0 +1,62 @@ +--- +slug: /references/metalctl_size +title: metalctl_size +sidebar_position: 112 +--- + +## metalctl size + +manage size entities + +### Synopsis + +a size matches a machine in terms of cpu cores, ram and storage. + +### Options + +``` + -h, --help help for size +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl size apply](./metalctl_size_apply.md) - applies one or more sizes from a given file +* [metalctl size create](./metalctl_size_create.md) - creates the size +* [metalctl size delete](./metalctl_size_delete.md) - deletes the size +* [metalctl size describe](./metalctl_size_describe.md) - describes the size +* [metalctl size edit](./metalctl_size_edit.md) - edit the size through an editor and update +* [metalctl size imageconstraint](./metalctl_size_imageconstraint.md) - manage imageconstraint entities +* [metalctl size list](./metalctl_size_list.md) - list all sizes +* [metalctl size reservation](./metalctl_size_reservation.md) - manage reservation entities +* [metalctl size suggest](./metalctl_size_suggest.md) - suggest size from a given machine id +* [metalctl size update](./metalctl_size_update.md) - updates the size + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_apply.md new file mode 100644 index 0000000..787c278 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_size_apply +title: metalctl_size_apply +sidebar_position: 113 +--- + +## metalctl size apply + +applies one or more sizes from a given file + +``` +metalctl size apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl size describe size-1 -o yaml > size.yaml + $ vi size.yaml + $ # either via stdin + $ cat size.yaml | metalctl size apply -f - + $ # or via file + $ metalctl size apply -f size.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_create.md new file mode 100644 index 0000000..a521e12 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_create.md @@ -0,0 +1,73 @@ +--- +slug: /references/metalctl_size_create +title: metalctl_size_create +sidebar_position: 114 +--- + +## metalctl size create + +creates the size + +``` +metalctl size create [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -d, --description string Description of the size. [required] + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl size describe size-1 -o yaml > size.yaml + $ vi size.yaml + $ # either via stdin + $ cat size.yaml | metalctl size create -f - + $ # or via file + $ metalctl size create -f size.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --id string ID of the size. [required] + --max int min value of given size constraint type. [required] + --min int min value of given size constraint type. [required] + -n, --name string Name of the size. [optional] + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations + --type string type of constraints. [required] +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_delete.md new file mode 100644 index 0000000..44a1da4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_size_delete +title: metalctl_size_delete +sidebar_position: 115 +--- + +## metalctl size delete + +deletes the size + +``` +metalctl size delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl size describe size-1 -o yaml > size.yaml + $ vi size.yaml + $ # either via stdin + $ cat size.yaml | metalctl size delete -f - + $ # or via file + $ metalctl size delete -f size.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_describe.md new file mode 100644 index 0000000..5de9a07 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_size_describe +title: metalctl_size_describe +sidebar_position: 116 +--- + +## metalctl size describe + +describes the size + +``` +metalctl size describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_edit.md new file mode 100644 index 0000000..007d8c8 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_size_edit +title: metalctl_size_edit +sidebar_position: 117 +--- + +## metalctl size edit + +edit the size through an editor and update + +``` +metalctl size edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint.md new file mode 100644 index 0000000..56e9cf1 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint.md @@ -0,0 +1,60 @@ +--- +slug: /references/metalctl_size_imageconstraint +title: metalctl_size_imageconstraint +sidebar_position: 118 +--- + +## metalctl size imageconstraint + +manage imageconstraint entities + +### Synopsis + +if a size has specific requirements regarding the images which must fulfill certain constraints, this can be configured here. + +### Options + +``` + -h, --help help for imageconstraint +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities +* [metalctl size imageconstraint apply](./metalctl_size_imageconstraint_apply.md) - applies one or more imageconstraints from a given file +* [metalctl size imageconstraint create](./metalctl_size_imageconstraint_create.md) - creates the imageconstraint +* [metalctl size imageconstraint delete](./metalctl_size_imageconstraint_delete.md) - deletes the imageconstraint +* [metalctl size imageconstraint describe](./metalctl_size_imageconstraint_describe.md) - describes the imageconstraint +* [metalctl size imageconstraint edit](./metalctl_size_imageconstraint_edit.md) - edit the imageconstraint through an editor and update +* [metalctl size imageconstraint list](./metalctl_size_imageconstraint_list.md) - list all imageconstraints +* [metalctl size imageconstraint try](./metalctl_size_imageconstraint_try.md) - try if size and image can be allocated +* [metalctl size imageconstraint update](./metalctl_size_imageconstraint_update.md) - updates the imageconstraint + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_apply.md new file mode 100644 index 0000000..c8efba6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_size_imageconstraint_apply +title: metalctl_size_imageconstraint_apply +sidebar_position: 119 +--- + +## metalctl size imageconstraint apply + +applies one or more imageconstraints from a given file + +``` +metalctl size imageconstraint apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl imageconstraint describe imageconstraint-1 -o yaml > imageconstraint.yaml + $ vi imageconstraint.yaml + $ # either via stdin + $ cat imageconstraint.yaml | metalctl imageconstraint apply -f - + $ # or via file + $ metalctl imageconstraint apply -f imageconstraint.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size imageconstraint](./metalctl_size_imageconstraint.md) - manage imageconstraint entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_create.md new file mode 100644 index 0000000..51e35eb --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_create.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_size_imageconstraint_create +title: metalctl_size_imageconstraint_create +sidebar_position: 120 +--- + +## metalctl size imageconstraint create + +creates the imageconstraint + +``` +metalctl size imageconstraint create [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl imageconstraint describe imageconstraint-1 -o yaml > imageconstraint.yaml + $ vi imageconstraint.yaml + $ # either via stdin + $ cat imageconstraint.yaml | metalctl imageconstraint create -f - + $ # or via file + $ metalctl imageconstraint create -f imageconstraint.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size imageconstraint](./metalctl_size_imageconstraint.md) - manage imageconstraint entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_delete.md new file mode 100644 index 0000000..8342117 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_size_imageconstraint_delete +title: metalctl_size_imageconstraint_delete +sidebar_position: 121 +--- + +## metalctl size imageconstraint delete + +deletes the imageconstraint + +``` +metalctl size imageconstraint delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl imageconstraint describe imageconstraint-1 -o yaml > imageconstraint.yaml + $ vi imageconstraint.yaml + $ # either via stdin + $ cat imageconstraint.yaml | metalctl imageconstraint delete -f - + $ # or via file + $ metalctl imageconstraint delete -f imageconstraint.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size imageconstraint](./metalctl_size_imageconstraint.md) - manage imageconstraint entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_describe.md new file mode 100644 index 0000000..990295b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_size_imageconstraint_describe +title: metalctl_size_imageconstraint_describe +sidebar_position: 122 +--- + +## metalctl size imageconstraint describe + +describes the imageconstraint + +``` +metalctl size imageconstraint describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size imageconstraint](./metalctl_size_imageconstraint.md) - manage imageconstraint entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_edit.md new file mode 100644 index 0000000..db5687e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_size_imageconstraint_edit +title: metalctl_size_imageconstraint_edit +sidebar_position: 123 +--- + +## metalctl size imageconstraint edit + +edit the imageconstraint through an editor and update + +``` +metalctl size imageconstraint edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size imageconstraint](./metalctl_size_imageconstraint.md) - manage imageconstraint entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_list.md new file mode 100644 index 0000000..aedd9da --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_list.md @@ -0,0 +1,53 @@ +--- +slug: /references/metalctl_size_imageconstraint_list +title: metalctl_size_imageconstraint_list +sidebar_position: 124 +--- + +## metalctl size imageconstraint list + +list all imageconstraints + +``` +metalctl size imageconstraint list [flags] +``` + +### Options + +``` + -h, --help help for list + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: description|id|name +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size imageconstraint](./metalctl_size_imageconstraint.md) - manage imageconstraint entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_try.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_try.md new file mode 100644 index 0000000..5b96f83 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_try.md @@ -0,0 +1,54 @@ +--- +slug: /references/metalctl_size_imageconstraint_try +title: metalctl_size_imageconstraint_try +sidebar_position: 125 +--- + +## metalctl size imageconstraint try + +try if size and image can be allocated + +``` +metalctl size imageconstraint try [flags] +``` + +### Options + +``` + -h, --help help for try + --image string image to check if allocaltion is possible + --size string size to check if allocaltion is possible +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size imageconstraint](./metalctl_size_imageconstraint.md) - manage imageconstraint entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_update.md new file mode 100644 index 0000000..b75daad --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_imageconstraint_update.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_size_imageconstraint_update +title: metalctl_size_imageconstraint_update +sidebar_position: 126 +--- + +## metalctl size imageconstraint update + +updates the imageconstraint + +``` +metalctl size imageconstraint update [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl imageconstraint describe imageconstraint-1 -o yaml > imageconstraint.yaml + $ vi imageconstraint.yaml + $ # either via stdin + $ cat imageconstraint.yaml | metalctl imageconstraint update -f - + $ # or via file + $ metalctl imageconstraint update -f imageconstraint.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size imageconstraint](./metalctl_size_imageconstraint.md) - manage imageconstraint entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_list.md new file mode 100644 index 0000000..76cc67e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_list.md @@ -0,0 +1,53 @@ +--- +slug: /references/metalctl_size_list +title: metalctl_size_list +sidebar_position: 127 +--- + +## metalctl size list + +list all sizes + +``` +metalctl size list [flags] +``` + +### Options + +``` + -h, --help help for list + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: description|id|name +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation.md new file mode 100644 index 0000000..d9bbd10 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation.md @@ -0,0 +1,60 @@ +--- +slug: /references/metalctl_size_reservation +title: metalctl_size_reservation +sidebar_position: 128 +--- + +## metalctl size reservation + +manage reservation entities + +### Synopsis + +manage size reservations + +### Options + +``` + -h, --help help for reservation +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities +* [metalctl size reservation apply](./metalctl_size_reservation_apply.md) - applies one or more reservations from a given file +* [metalctl size reservation create](./metalctl_size_reservation_create.md) - creates the reservation +* [metalctl size reservation delete](./metalctl_size_reservation_delete.md) - deletes the reservation +* [metalctl size reservation describe](./metalctl_size_reservation_describe.md) - describes the reservation +* [metalctl size reservation edit](./metalctl_size_reservation_edit.md) - edit the reservation through an editor and update +* [metalctl size reservation list](./metalctl_size_reservation_list.md) - list all reservations +* [metalctl size reservation update](./metalctl_size_reservation_update.md) - updates the reservation +* [metalctl size reservation usage](./metalctl_size_reservation_usage.md) - see current usage of size reservations + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_apply.md new file mode 100644 index 0000000..25689c8 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_size_reservation_apply +title: metalctl_size_reservation_apply +sidebar_position: 129 +--- + +## metalctl size reservation apply + +applies one or more reservations from a given file + +``` +metalctl size reservation apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl reservation describe reservation-1 -o yaml > reservation.yaml + $ vi reservation.yaml + $ # either via stdin + $ cat reservation.yaml | metalctl reservation apply -f - + $ # or via file + $ metalctl reservation apply -f reservation.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size reservation](./metalctl_size_reservation.md) - manage reservation entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_create.md new file mode 100644 index 0000000..14b4223 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_create.md @@ -0,0 +1,74 @@ +--- +slug: /references/metalctl_size_reservation_create +title: metalctl_size_reservation_create +sidebar_position: 130 +--- + +## metalctl size reservation create + +creates the reservation + +``` +metalctl size reservation create [flags] +``` + +### Options + +``` + --amount int32 the amount to associate with this reservation + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + --description string the description to associate with this reservation + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl reservation describe reservation-1 -o yaml > reservation.yaml + $ vi reservation.yaml + $ # either via stdin + $ cat reservation.yaml | metalctl reservation create -f - + $ # or via file + $ metalctl reservation create -f reservation.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --id string the id to associate with this reservation + --labels strings the labels to associate with this reservation + --partitions strings the partition ids to associate with this reservation + --project string the project id to associate with this reservation + --size string the size id to associate with this reservation + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size reservation](./metalctl_size_reservation.md) - manage reservation entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_delete.md new file mode 100644 index 0000000..dc9c1c0 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_size_reservation_delete +title: metalctl_size_reservation_delete +sidebar_position: 131 +--- + +## metalctl size reservation delete + +deletes the reservation + +``` +metalctl size reservation delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl reservation describe reservation-1 -o yaml > reservation.yaml + $ vi reservation.yaml + $ # either via stdin + $ cat reservation.yaml | metalctl reservation delete -f - + $ # or via file + $ metalctl reservation delete -f reservation.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size reservation](./metalctl_size_reservation.md) - manage reservation entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_describe.md new file mode 100644 index 0000000..8652a5a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_size_reservation_describe +title: metalctl_size_reservation_describe +sidebar_position: 132 +--- + +## metalctl size reservation describe + +describes the reservation + +``` +metalctl size reservation describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size reservation](./metalctl_size_reservation.md) - manage reservation entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_edit.md new file mode 100644 index 0000000..fa60521 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_size_reservation_edit +title: metalctl_size_reservation_edit +sidebar_position: 133 +--- + +## metalctl size reservation edit + +edit the reservation through an editor and update + +``` +metalctl size reservation edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size reservation](./metalctl_size_reservation.md) - manage reservation entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_list.md new file mode 100644 index 0000000..3eec114 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_list.md @@ -0,0 +1,57 @@ +--- +slug: /references/metalctl_size_reservation_list +title: metalctl_size_reservation_list +sidebar_position: 134 +--- + +## metalctl size reservation list + +list all reservations + +``` +metalctl size reservation list [flags] +``` + +### Options + +``` + -h, --help help for list + --id string the id to filter + --partition string the partition id to filter + --project string the project id to filter + --size string the size id to filter + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: amount|id|partition|project|size +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size reservation](./metalctl_size_reservation.md) - manage reservation entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_update.md new file mode 100644 index 0000000..5bacb5b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_update.md @@ -0,0 +1,71 @@ +--- +slug: /references/metalctl_size_reservation_update +title: metalctl_size_reservation_update +sidebar_position: 135 +--- + +## metalctl size reservation update + +updates the reservation + +``` +metalctl size reservation update [flags] +``` + +### Options + +``` + --amount int32 the amount to associate with this reservation + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + --description string the description to associate with this reservation + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl reservation describe reservation-1 -o yaml > reservation.yaml + $ vi reservation.yaml + $ # either via stdin + $ cat reservation.yaml | metalctl reservation update -f - + $ # or via file + $ metalctl reservation update -f reservation.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --labels strings the labels to associate with this reservation + --partitions strings the partition ids to associate with this reservation + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size reservation](./metalctl_size_reservation.md) - manage reservation entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_usage.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_usage.md new file mode 100644 index 0000000..5f824a9 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_reservation_usage.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_size_reservation_usage +title: metalctl_size_reservation_usage +sidebar_position: 136 +--- + +## metalctl size reservation usage + +see current usage of size reservations + +``` +metalctl size reservation usage [flags] +``` + +### Options + +``` + -h, --help help for usage + --partition string the partition to filter + --project string the project to filter + --size-id string the size-id to filter + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: amount|id|partition|project|size|used-amount +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size reservation](./metalctl_size_reservation.md) - manage reservation entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_suggest.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_suggest.md new file mode 100644 index 0000000..426b534 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_suggest.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_size_suggest +title: metalctl_size_suggest +sidebar_position: 137 +--- + +## metalctl size suggest + +suggest size from a given machine id + +``` +metalctl size suggest [flags] +``` + +### Options + +``` + --description string The description of the suggested size (default "a suggested size") + -h, --help help for suggest + --labels strings labels to add to the size + --machine-id string Machine id used to create the size suggestion. [required] + --name string The name of the suggested size (default "suggested-size") +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_update.md new file mode 100644 index 0000000..f6636f5 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_size_update.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_size_update +title: metalctl_size_update +sidebar_position: 138 +--- + +## metalctl size update + +updates the size + +``` +metalctl size update [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl size describe size-1 -o yaml > size.yaml + $ vi size.yaml + $ # either via stdin + $ cat size.yaml | metalctl size update -f - + $ # or via file + $ metalctl size update -f size.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl size](./metalctl_size.md) - manage size entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch.md new file mode 100644 index 0000000..e8713af --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch.md @@ -0,0 +1,64 @@ +--- +slug: /references/metalctl_switch +title: metalctl_switch +sidebar_position: 139 +--- + +## metalctl switch + +manage switch entities + +### Synopsis + +switch are the leaf switches in the data center that are controlled by metal-stack. + +### Options + +``` + -h, --help help for switch +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl switch connected-machines](./metalctl_switch_connected-machines.md) - shows switches with their connected machines +* [metalctl switch console](./metalctl_switch_console.md) - connect to the switch console +* [metalctl switch delete](./metalctl_switch_delete.md) - deletes the switch +* [metalctl switch describe](./metalctl_switch_describe.md) - describes the switch +* [metalctl switch detail](./metalctl_switch_detail.md) - switch details +* [metalctl switch edit](./metalctl_switch_edit.md) - edit the switch through an editor and update +* [metalctl switch list](./metalctl_switch_list.md) - list all switches +* [metalctl switch migrate](./metalctl_switch_migrate.md) - migrate machine connections and other configuration from one switch to another +* [metalctl switch port](./metalctl_switch_port.md) - sets the given switch port state up or down +* [metalctl switch replace](./metalctl_switch_replace.md) - put a leaf switch into replace mode in preparation for physical replacement. For a description of the steps involved see the long help. +* [metalctl switch ssh](./metalctl_switch_ssh.md) - connect to the switch via ssh +* [metalctl switch update](./metalctl_switch_update.md) - updates the switch + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_connected-machines.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_connected-machines.md new file mode 100644 index 0000000..9678b9f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_connected-machines.md @@ -0,0 +1,74 @@ +--- +slug: /references/metalctl_switch_connected-machines +title: metalctl_switch_connected-machines +sidebar_position: 140 +--- + +## metalctl switch connected-machines + +shows switches with their connected machines + +``` +metalctl switch connected-machines [flags] +``` + +### Examples + +``` +The command will show the machines connected to the switch ports. + +Can also be used with -o template in order to generate CSV-style output: + +$ metalctl switch connected-machines -o template --template '{{ $machines := .machines }}{{ range .switches }}{{ $switch := . }}{{ range .connections }}{{ $switch.id }},{{ $switch.rack_id }},{{ .nic.name }},{{ .machine_id }},{{ (index $machines .machine_id).ipmi.fru.product_serial }}{{ printf "\n" }}{{ end }}{{ end }}' +r01leaf01,swp1,f78cc340-e5e8-48ed-8fe7-2336c1e2ded2, +r01leaf01,swp2,44e3a522-5f48-4f3c-9188-41025f9e401e, +... + +``` + +### Options + +``` + -h, --help help for connected-machines + --id string ID of the switch. + --machine-id string The id of the connected machine, ignores size flag if set. + --name string Name of the switch. + --os-vendor string OS vendor of this switch. + --os-version string OS version of this switch. + --partition string Partition of this switch. + --rack string Rack of this switch. + --size string Size of the connected machines. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_console.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_console.md new file mode 100644 index 0000000..12265c4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_console.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_switch_console +title: metalctl_switch_console +sidebar_position: 141 +--- + +## metalctl switch console + +connect to the switch console + +### Synopsis + +this requires a network connectivity to the ip address of the console server this switch is connected to. + +``` +metalctl switch console [flags] +``` + +### Options + +``` + -h, --help help for console +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_delete.md new file mode 100644 index 0000000..3bcb896 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_delete.md @@ -0,0 +1,68 @@ +--- +slug: /references/metalctl_switch_delete +title: metalctl_switch_delete +sidebar_position: 142 +--- + +## metalctl switch delete + +deletes the switch + +``` +metalctl switch delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl switch describe switch-1 -o yaml > switch.yaml + $ vi switch.yaml + $ # either via stdin + $ cat switch.yaml | metalctl switch delete -f - + $ # or via file + $ metalctl switch delete -f switch.yaml + + the file can also contain multiple documents and perform a bulk operation. + + --force forcefully delete the switch accepting the risk that it still has machines connected to it + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_describe.md new file mode 100644 index 0000000..0623e2d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_switch_describe +title: metalctl_switch_describe +sidebar_position: 143 +--- + +## metalctl switch describe + +describes the switch + +``` +metalctl switch describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_detail.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_detail.md new file mode 100644 index 0000000..ab93352 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_detail.md @@ -0,0 +1,58 @@ +--- +slug: /references/metalctl_switch_detail +title: metalctl_switch_detail +sidebar_position: 144 +--- + +## metalctl switch detail + +switch details + +``` +metalctl switch detail [flags] +``` + +### Options + +``` + -h, --help help for detail + --id string ID of the switch. + --name string Name of the switch. + --os-vendor string OS vendor of this switch. + --os-version string OS version of this switch. + --partition string Partition of this switch. + --rack string Rack of this switch. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_edit.md new file mode 100644 index 0000000..323b40a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_switch_edit +title: metalctl_switch_edit +sidebar_position: 145 +--- + +## metalctl switch edit + +edit the switch through an editor and update + +``` +metalctl switch edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_list.md new file mode 100644 index 0000000..df3d504 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_list.md @@ -0,0 +1,59 @@ +--- +slug: /references/metalctl_switch_list +title: metalctl_switch_list +sidebar_position: 146 +--- + +## metalctl switch list + +list all switches + +``` +metalctl switch list [flags] +``` + +### Options + +``` + -h, --help help for list + --id string ID of the switch. + --name string Name of the switch. + --os-vendor string OS vendor of this switch. + --os-version string OS version of this switch. + --partition string Partition of this switch. + --rack string Rack of this switch. + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: description|id|name +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_migrate.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_migrate.md new file mode 100644 index 0000000..dd2523a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_migrate.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_switch_migrate +title: metalctl_switch_migrate +sidebar_position: 147 +--- + +## metalctl switch migrate + +migrate machine connections and other configuration from one switch to another + +``` +metalctl switch migrate [flags] +``` + +### Options + +``` + -h, --help help for migrate +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port.md new file mode 100644 index 0000000..3bbef39 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_switch_port +title: metalctl_switch_port +sidebar_position: 148 +--- + +## metalctl switch port + +sets the given switch port state up or down + +### Options + +``` + -h, --help help for port + --port string the port to be changed. +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities +* [metalctl switch port describe](./metalctl_switch_port_describe.md) - gets the given switch port state +* [metalctl switch port down](./metalctl_switch_port_down.md) - sets the given switch port state down +* [metalctl switch port up](./metalctl_switch_port_up.md) - sets the given switch port state up + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_describe.md new file mode 100644 index 0000000..896cff4 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_describe.md @@ -0,0 +1,57 @@ +--- +slug: /references/metalctl_switch_port_describe +title: metalctl_switch_port_describe +sidebar_position: 149 +--- + +## metalctl switch port describe + +gets the given switch port state + +### Synopsis + +shows the current actual and desired state of the port of the given switch. + +``` +metalctl switch port describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --port string the port to be changed. + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch port](./metalctl_switch_port.md) - sets the given switch port state up or down + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_down.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_down.md new file mode 100644 index 0000000..001885d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_down.md @@ -0,0 +1,57 @@ +--- +slug: /references/metalctl_switch_port_down +title: metalctl_switch_port_down +sidebar_position: 150 +--- + +## metalctl switch port down + +sets the given switch port state down + +### Synopsis + +sets the port status to DOWN so the connected machine will not be able to connect to the switch. + +``` +metalctl switch port down [flags] +``` + +### Options + +``` + -h, --help help for down +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --port string the port to be changed. + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch port](./metalctl_switch_port.md) - sets the given switch port state up or down + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_up.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_up.md new file mode 100644 index 0000000..9b0af80 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_port_up.md @@ -0,0 +1,57 @@ +--- +slug: /references/metalctl_switch_port_up +title: metalctl_switch_port_up +sidebar_position: 151 +--- + +## metalctl switch port up + +sets the given switch port state up + +### Synopsis + +sets the port status to UP so the connected machine will be able to connect to the switch. + +``` +metalctl switch port up [flags] +``` + +### Options + +``` + -h, --help help for up +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --port string the port to be changed. + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch port](./metalctl_switch_port.md) - sets the given switch port state up or down + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_replace.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_replace.md new file mode 100644 index 0000000..278b4c7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_replace.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_switch_replace +title: metalctl_switch_replace +sidebar_position: 152 +--- + +## metalctl switch replace + +put a leaf switch into replace mode in preparation for physical replacement. For a description of the steps involved see the long help. + +### Synopsis + +Put a leaf switch into replace mode in preparation for physical replacement + +Operational steps to replace a switch: + +- Put the switch that needs to be replaced in replace mode with this command +- Replace the switch MAC address in the metal-stack deployment configuration +- Make sure that interfaces on the new switch do not get connected to the PXE-bridge immediately by setting the interfaces list of the respective leaf switch to [] in the metal-stack deployment configuration +- Deploy the management servers so that the dhcp servers will serve the right address and DHCP options to the new switch +- Replace the switch physically. Be careful to ensure that the cabling mirrors the remaining leaf exactly because the new switch information will be cloned from the remaining switch! Also make sure to have console access to the switch so you can start and monitor the install process +- If the switch is not in onie install mode but already has an operating system installed, put it into install mode with "sudo onie-select -i -f -v" and reboot it. Now the switch should be provisioned with a management IP from a management server, install itself with the right software image and receive license and ssh keys through ZTP. You can check whether that process has completed successfully with the command "sudo ztp -s". The ZTP state should be disabled and the result should be success. +- Deploy the switch plane and metal-core through metal-stack deployment CI job +- The switch will now register with its metal-api, and the metal-core service will receive the cloned interface and routing information. You can verify successful switch replacement by checking the interface and BGP configuration, and checking the switch status with "metalctl switch ls -o wide"; it should now be operational again + +``` +metalctl switch replace [flags] +``` + +### Options + +``` + -h, --help help for replace +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_ssh.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_ssh.md new file mode 100644 index 0000000..9d7de2c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_ssh.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_switch_ssh +title: metalctl_switch_ssh +sidebar_position: 153 +--- + +## metalctl switch ssh + +connect to the switch via ssh + +### Synopsis + +this requires a network connectivity to the management ip address of the switch. + +``` +metalctl switch ssh [flags] +``` + +### Options + +``` + -h, --help help for ssh +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_update.md new file mode 100644 index 0000000..48e1f1c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_switch_update.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_switch_update +title: metalctl_switch_update +sidebar_position: 154 +--- + +## metalctl switch update + +updates the switch + +``` +metalctl switch update [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl switch describe switch-1 -o yaml > switch.yaml + $ vi switch.yaml + $ # either via stdin + $ cat switch.yaml | metalctl switch update -f - + $ # or via file + $ metalctl switch update -f switch.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl switch](./metalctl_switch.md) - manage switch entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant.md new file mode 100644 index 0000000..f872c77 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant.md @@ -0,0 +1,59 @@ +--- +slug: /references/metalctl_tenant +title: metalctl_tenant +sidebar_position: 155 +--- + +## metalctl tenant + +manage tenant entities + +### Synopsis + +a tenant belongs to a tenant and groups together entities in metal-stack. + +### Options + +``` + -h, --help help for tenant +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl tenant apply](./metalctl_tenant_apply.md) - applies one or more tenants from a given file +* [metalctl tenant create](./metalctl_tenant_create.md) - creates the tenant +* [metalctl tenant delete](./metalctl_tenant_delete.md) - deletes the tenant +* [metalctl tenant describe](./metalctl_tenant_describe.md) - describes the tenant +* [metalctl tenant edit](./metalctl_tenant_edit.md) - edit the tenant through an editor and update +* [metalctl tenant list](./metalctl_tenant_list.md) - list all tenants +* [metalctl tenant update](./metalctl_tenant_update.md) - updates the tenant + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_apply.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_apply.md new file mode 100644 index 0000000..93207de --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_apply.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_tenant_apply +title: metalctl_tenant_apply +sidebar_position: 156 +--- + +## metalctl tenant apply + +applies one or more tenants from a given file + +``` +metalctl tenant apply [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl tenant describe tenant-1 -o yaml > tenant.yaml + $ vi tenant.yaml + $ # either via stdin + $ cat tenant.yaml | metalctl tenant apply -f - + $ # or via file + $ metalctl tenant apply -f tenant.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for apply + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl tenant](./metalctl_tenant.md) - manage tenant entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_create.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_create.md new file mode 100644 index 0000000..46e2110 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_create.md @@ -0,0 +1,75 @@ +--- +slug: /references/metalctl_tenant_create +title: metalctl_tenant_create +sidebar_position: 157 +--- + +## metalctl tenant create + +creates the tenant + +``` +metalctl tenant create [flags] +``` + +### Options + +``` + --annotations strings add initial annotations, must be in the form of key=value, can be given multiple times to add multiple annotations, e.g. --annotation key=value --annotation foo=bar + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + --cluster-quota int32 cluster quota + --description string description of the tenant. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl tenant describe tenant-1 -o yaml > tenant.yaml + $ vi tenant.yaml + $ # either via stdin + $ cat tenant.yaml | metalctl tenant create -f - + $ # or via file + $ metalctl tenant create -f tenant.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for create + --id string id of the tenant, max 10 characters. + --ip-quota int32 ip quota + --labels strings add initial label, can be given multiple times to add multiple labels, e.g. --label=foo --label=bar + --machine-quota int32 machine quota + --name string name of the tenant, max 10 characters. + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl tenant](./metalctl_tenant.md) - manage tenant entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_delete.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_delete.md new file mode 100644 index 0000000..4e66a1d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_delete.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_tenant_delete +title: metalctl_tenant_delete +sidebar_position: 158 +--- + +## metalctl tenant delete + +deletes the tenant + +``` +metalctl tenant delete [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl tenant describe tenant-1 -o yaml > tenant.yaml + $ vi tenant.yaml + $ # either via stdin + $ cat tenant.yaml | metalctl tenant delete -f - + $ # or via file + $ metalctl tenant delete -f tenant.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for delete + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl tenant](./metalctl_tenant.md) - manage tenant entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_describe.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_describe.md new file mode 100644 index 0000000..d26b2a9 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_describe.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_tenant_describe +title: metalctl_tenant_describe +sidebar_position: 159 +--- + +## metalctl tenant describe + +describes the tenant + +``` +metalctl tenant describe [flags] +``` + +### Options + +``` + -h, --help help for describe +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl tenant](./metalctl_tenant.md) - manage tenant entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_edit.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_edit.md new file mode 100644 index 0000000..f7f24c7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_edit.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_tenant_edit +title: metalctl_tenant_edit +sidebar_position: 160 +--- + +## metalctl tenant edit + +edit the tenant through an editor and update + +``` +metalctl tenant edit [flags] +``` + +### Options + +``` + -h, --help help for edit +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl tenant](./metalctl_tenant.md) - manage tenant entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_list.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_list.md new file mode 100644 index 0000000..1a63428 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_list.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_tenant_list +title: metalctl_tenant_list +sidebar_position: 161 +--- + +## metalctl tenant list + +list all tenants + +``` +metalctl tenant list [flags] +``` + +### Options + +``` + --annotations strings annotations + -h, --help help for list + --id string ID of the tenant. + --name string Name of the tenant. + --sort-by strings sort by (comma separated) column(s), sort direction can be changed by appending :asc or :desc behind the column identifier. possible values: description|id|name +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl tenant](./metalctl_tenant.md) - manage tenant entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_update.md new file mode 100644 index 0000000..dab9734 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_tenant_update.md @@ -0,0 +1,67 @@ +--- +slug: /references/metalctl_tenant_update +title: metalctl_tenant_update +sidebar_position: 162 +--- + +## metalctl tenant update + +updates the tenant + +``` +metalctl tenant update [flags] +``` + +### Options + +``` + --bulk-output when used with --file (bulk operation): prints results at the end as a list. default is printing results intermediately during the operation, which causes single entities to be printed in a row. + -f, --file string filename of the create or update request in yaml format, or - for stdin. + + Example: + $ metalctl tenant describe tenant-1 -o yaml > tenant.yaml + $ vi tenant.yaml + $ # either via stdin + $ cat tenant.yaml | metalctl tenant update -f - + $ # or via file + $ metalctl tenant update -f tenant.yaml + + the file can also contain multiple documents and perform a bulk operation. + + -h, --help help for update + --skip-security-prompts skips security prompt for bulk operations + --timestamps when used with --file (bulk operation): prints timestamps in-between the operations +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl tenant](./metalctl_tenant.md) - manage tenant entities + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update.md new file mode 100644 index 0000000..33f99bf --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update.md @@ -0,0 +1,50 @@ +--- +slug: /references/metalctl_update +title: metalctl_update +sidebar_position: 163 +--- + +## metalctl update + +update the program + +### Options + +``` + -h, --help help for update +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl update check](./metalctl_update_check.md) - check for update of the program +* [metalctl update do](./metalctl_update_do.md) - do the update of the program + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update_check.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update_check.md new file mode 100644 index 0000000..93f3336 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update_check.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_update_check +title: metalctl_update_check +sidebar_position: 164 +--- + +## metalctl update check + +check for update of the program + +``` +metalctl update check [flags] +``` + +### Options + +``` + -h, --help help for check +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl update](./metalctl_update.md) - update the program + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update_do.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update_do.md new file mode 100644 index 0000000..854d48b --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_update_do.md @@ -0,0 +1,53 @@ +--- +slug: /references/metalctl_update_do +title: metalctl_update_do +sidebar_position: 165 +--- + +## metalctl update do + +do the update of the program + +``` +metalctl update do [flags] +``` + +### Options + +``` + -h, --help help for do + -v, --version string the version to update to, by default updates to the supported version, use "latest" to update to latest version +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl update](./metalctl_update.md) - update the program + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_version.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_version.md new file mode 100644 index 0000000..8e5584a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_version.md @@ -0,0 +1,52 @@ +--- +slug: /references/metalctl_version +title: metalctl_version +sidebar_position: 166 +--- + +## metalctl version + +print the client and server version information + +``` +metalctl version [flags] +``` + +### Options + +``` + -h, --help help for version +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_vpn.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_vpn.md new file mode 100644 index 0000000..f6c9f06 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_vpn.md @@ -0,0 +1,53 @@ +--- +slug: /references/metalctl_vpn +title: metalctl_vpn +sidebar_position: 167 +--- + +## metalctl vpn + +access VPN + +### Synopsis + +access VPN + +### Options + +``` + -h, --help help for vpn +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api +* [metalctl vpn key](./metalctl_vpn_key.md) - create an auth key + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_vpn_key.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_vpn_key.md new file mode 100644 index 0000000..6e28121 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_vpn_key.md @@ -0,0 +1,68 @@ +--- +slug: /references/metalctl_vpn_key +title: metalctl_vpn_key +sidebar_position: 168 +--- + +## metalctl vpn key + +create an auth key + +### Synopsis + +create an auth key to connect to VPN + +``` +metalctl vpn key [flags] +``` + +### Examples + +``` +auth key for tailscale can be created by this command: +metalctl vpn key \ + -- project cluster01 + +``` + +### Options + +``` + --ephemeral create an ephemeral key (default true) + -h, --help help for key + --project string project ID for which auth key should be created + --reason string a short description why access to the vpn is required +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl vpn](./metalctl_vpn.md) - access VPN + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_whoami.md b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_whoami.md new file mode 100644 index 0000000..e25760d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Clients/metalctl/metalctl_whoami.md @@ -0,0 +1,56 @@ +--- +slug: /references/metalctl_whoami +title: metalctl_whoami +sidebar_position: 169 +--- + +## metalctl whoami + +shows current user + +### Synopsis + +shows the current user, that will be used to authenticate commands. + +``` +metalctl whoami [flags] +``` + +### Options + +``` + -h, --help help for whoami +``` + +### Options inherited from parent commands + +``` + --api-token string api token to authenticate. Can be specified with METALCTL_API_TOKEN environment variable. + --api-url string api server address. Can be specified with METALCTL_API_URL environment variable. + -c, --config string alternative config file path, (default is ~/.metalctl/config.yaml). + Example config.yaml: + + --- + apitoken: "alongtoken" + ... + + + --debug debug output + --force-color force colored output even without tty + --kubeconfig string Path to the kube-config to use for authentication and authorization. Is updated by login. Uses default path if not specified. + --no-headers do not print headers of table output format (default print headers) + -o, --output-format string output format (table|wide|markdown|json|yaml|template), wide is a table with more columns. (default "table") + --template string output template for template output-format, go template format. + For property names inspect the output of -o json or -o yaml for reference. + Example for machines: + + metalctl machine list -o template --template "{{ .id }}:{{ .size.id }}" + + + --yes-i-really-mean-it skips security prompts (which can be dangerous to set blindly because actions can lead to data loss or additional costs) +``` + +### SEE ALSO + +* [metalctl](./metalctl.md) - a cli to manage entities in the metal-stack api + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/assets/sequence.drawio.svg b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/assets/sequence.drawio.svg new file mode 100644 index 0000000..56156c3 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/assets/sequence.drawio.svg @@ -0,0 +1,77 @@ + + Sidecar Container +
Sidecar start cmd
 + Sidecar start cmd +
find latest backup
 + find latest backup +
start server
(status endpoint)
 + start server... +
(decrypt), uncompress backup archive
and restore database
 + (decrypt), uncompress backup archive... +
Init Container
 + Init Container +
Sidecar wait cmd
 + Sidecar wait cmd +
provide binaries via empty dir
 + provide binaries via empty dir +
Contains sidecar
binary
 + Contains sidecar... +
checks if database
needs to be restored
 + checks if database... +
possible restore
 + possible restore +
Backup Provider
 + Backup Provider +
backup version
 + backup version +
download backup version
 + download backup version +
backup archive
 + backup archive + + Database Container +
Sidecar injected
via entrypoint
 + Sidecar injected... +
status done
 + status done +
probe
 + probe +
client port open
 + client port open +
take backups periodically
 + take backups periodically +
compress to
backup archive,
(encrypt)
 + compress to... +
upload backup
 + upload backup +
initializer status
 + initializer status +
initializer status
 + initializer status +
initializer status
 + initializer status +
status checking
 + status checking +
initializer status
 + initializer status +
[ no data or data inconsistent ]
 + [ no data or data inconsistent ] +
status restoring
 + status restoring +
Database
 + Database +
Database Pod
 + Database Pod +
possible upgrade
 + possible upgrade +
upgrade database
 + upgrade database +
[ database image updated  ]
 + [ database image updated  ] +
start
 + start + + + Text is not SVG - cannot display + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/backup-restore-sidecar.md b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/backup-restore-sidecar.md new file mode 100644 index 0000000..9e31fd6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/backup-restore-sidecar.md @@ -0,0 +1,101 @@ +--- +slug: /references/backup-restore-sidecar +title: backup-restore-sidecar +sidebar_position: 1 +--- + +# K8s Backup Restore Sidecar for Databases + +This project adds automatic backup and recovery to databases managed by K8s via sidecar. + +The idea is taken from the [etcd-backup-restore](https://github.com/gardener/etcd-backup-restore) project. + +Probably, it does not make sense to use this project with large databases. However, if it is certain that a database will never grow large, the auto-recovery mechanism can come in very handy. + +## Supported Databases + +| Database | Image | Status | Upgrade Support | +|-----------|--------------|:------:|:---------------:| +| postgres | >= 12-alpine | beta | ✅ | +| rethinkdb | >= 2.4.0 | beta | ❌ | +| ETCD | >= 3.5 | alpha | ❌ | +| redis | >= 6.0 | alpha | ❌ | +| keydb | >= 6.0 | alpha | ❌ | +| valkey | >= 8.1 | alpha | ❌ | +| localfs | | alpha | ❌ | + +Postgres also supports updates when using the TimescaleDB extension. Please consider the integration test for supported upgrade paths. + +> [!IMPORTANT] +> Upgrade from 12-alpine to 13-alpine is not possible because of library differences in icu-lib. +> The solution is to upgrade to a older 14.10-alpine which has the same icu-lib version as 12-alpine +> and then update to 14.18-alpine or newer which does not require to run pg_upgrade. +> It is also recommended to pin the original database to postgres:12.22-alpine to ensure the latest minor. + +## Database Upgrades + +### Postgres + +Postgres requires special treatment if a major version upgrade is planned. `pg_upgrade` needs to be called with the old and new binaries, also the old data directory and a already initialized data directory which was initialized with the new binary, e.g. `initdb `. + +To make this process as smooth as possible, backup-restore-sidecar will detect if the version of the database files and the version of the postgres binary. If the binary is newer than the database files it will start the upgrade process. Strict validation to ensure all prerequisites are met is done before actually starting the upgrade process. + +To achieve this, `backup-restore-sidecar` saves the postgres binaries in the database directory in the form of `pg-bin-v12` for postgres 12. If later the database version is upgraded, the previous postgres binaries are present for doing the actual upgrade. + +## Supported Compression Methods + +With `--compression-method` you can define how generated backups are compressed before stored at the storage provider. Available compression methods are: + +| compression-method | suffix | comments | +|--------------------|----------|----------------------------------------------------------------------------------------------| +| tar | .tar | no compression, best suited for already compressed content | +| targz | .tar.gz | tar and gzip, most commonly used, best compression ratio, average performance | +| tarlz4 | .tar.lz4 | tar and lz4, very fast compression/decompression speed compared to gz, slightly bigger files | + +## Supported Storage Providers + +- GCS Buckets +- S3 Buckets (tested against Ceph RADOS gateway) +- Local + +## Encryption + +For all three storage providers AES encryption is supported and can be enabled with `--encryption-key=`. +The key must be 32 bytes (AES-256) long. +The backups are stored at the storage provider with the `.aes` suffix. If the file does not have this suffix, decryption is skipped. + +## How it works + +![Sequence Diagram](./assets/sequence.drawio.svg) + +## Limitations + +- The database is deployed unclustered / standalone +- The database is deployed as a statefulset and the data is backed by a PVC +- No "Point in Time Recovery" (PITR) + +## Using Multiple Backup-Restore-Sidecars On a Single Bucket + +It is possible to let multiple backup-restore-sidecars (for different databases) use the same backup bucket at an external provider. However, it has to be noted that these sidecars must all configure a dedicated object prefix in which they store the backups. Otherwise they would overwrite each other's data. + +Be aware that, if you change the object prefix under which the backups are stored, the old lifecycle policies matching this prefix are not automatically cleaned up and have to be removed manually. + +## Try it out + +Requires: + +- [docker](https://www.docker.com/) +- [kind](https://github.com/kubernetes-sigs/kind) +- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) +- [stern](https://github.com/wercker/stern) + +To start a demo / devel setup, run: `make start-postgres` or `make start-rethinkdb`. + +By default, the backup-restore-sidecar will start with the `local` backup provider, which is probably not very useful for most use-cases. If you want to test storing the data at a real backup provider, then: + +1. Configure the backup provider secret in `deploy/provider-secret-.yaml`. +2. Run `BACKUP_PROVIDER= make start-postgres` instead. + +## Manual restoration + +Follow the documentation [here](./manual_restore.md) in order to manually restore a specific version of your database. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/manual_restore.md b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/manual_restore.md new file mode 100644 index 0000000..c162434 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/backup-restore-sidecar/manual_restore.md @@ -0,0 +1,20 @@ +--- +slug: /references/manual_restore +title: manual_restore +sidebar_position: 0 +--- + +# Manual Restoration + +The advantage of the backup-restore-sidecar is that it automatically restores the latest backup automatically in case your data is lost. There can be situations though where you need to restore a specific backup from the past manually. In order to manually restore a specific backup version with the backup-restore-sidecar, use the following steps: + +1. Take a copy of your existing stateful set by running `kubectl get sts -o yaml ` +2. Now, get into a clean state, i.e. delete the existing stateful set and the pvc of your database +3. Deploy the exact stateful set you had but only with the backup-restore-sidecar container and tail some file such that container does not die. This is your "helper" stateful set, which you can use for manual administration. + - For postgres check the example [here](https://github.com/metal-stack/backup-restore-sidecar/blob/master/deploy/postgres_manual_restore.yaml) + - For rethinkdb check the example [here](https://github.com/metal-stack/backup-restore-sidecar/blob/master/deploy/rethinkdb_manual_restore.yaml) +4. Enter the container in your "helper" pod by running `kubectl exec -it -0 -c backup-restore-sidecar -- bash` +5. Inside the container, you can view the existing backup versions using `backup-restore-sidecar restore ls` +6. Choose the version to restore by running `backup-restore-sidecar restore ` +7. The backup was now restored, you can exit the container and remove the "helper" stateful set `kubectl delete sts ` but keep the pvc! +8. Now, deploy the regular backup-restore-sidecar stateful set again. It will find out that all the data is in place and the database will start normally diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/go-ipam/go-ipam.md b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/go-ipam/go-ipam.md new file mode 100644 index 0000000..58a07ef --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/go-ipam/go-ipam.md @@ -0,0 +1,237 @@ +--- +slug: /references/go-ipam +title: go-ipam +sidebar_position: 2 +--- + +# go-ipam + +[![Actions](https://github.com/metal-stack/go-ipam/actions/workflows/docker.yml/badge.svg?branch=master)](https://github.com/metal-stack/go-ipam/actions) +[![GoDoc](https://godoc.org/github.com/metal-stack/go-ipam?status.svg)](https://godoc.org/github.com/metal-stack/go-ipam) +[![Go Report Card](https://goreportcard.com/badge/github.com/metal-stack/go-ipam)](https://goreportcard.com/report/github.com/metal-stack/go-ipam) +[![codecov](https://codecov.io/gh/metal-stack/go-ipam/branch/master/graph/badge.svg)](https://codecov.io/gh/metal-stack/go-ipam) +[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/metal-stack/go-ipam/blob/master/LICENSE) + +go-ipam is a module to handle IP address management. It can operate on networks, prefixes and IPs. + +It also comes as a ready to go microservice which offers a grpc api. + +## IP + +Most obvious this library is all about IP management. The main purpose is to acquire and release an IP, or a bunch of +IP's from prefixes. + +## Prefix + +A prefix is a network with IP and mask, typically in the form of *192.168.0.0/24*. To be able to manage IPs you have to create a prefix first. + +Library Example usage: + +```go + +package main + +import ( + "context" + "fmt" + "time" + + goipam "github.com/metal-stack/go-ipam" +) + +func main() { + // The background context + bgCtx := context.Background() + + // Create a ipamer with in memory storage + ipam := goipam.New(bgCtx) + + // Optionally, we can pass around a context for a given namespace + namespace := "tenant-a" + err := ipam.CreateNamespace(bgCtx, namespace) + if err != nil { + panic(err) + } + ctx := goipam.NewContextWithNamespace(bgCtx, namespace) + ctx, cancel := context.WithTimeout(ctx, 5*time.Second) + defer cancel() + + // Create a prefix to manage some IPs + prefix, err := ipam.NewPrefix(ctx, "192.168.0.0/24") + if err != nil { + panic(err) + } + + // Acquire and release an IP with this prefix + ip, err := ipam.AcquireIP(ctx, prefix.Cidr) + if err != nil { + panic(err) + } + fmt.Printf("got IP: %s\n", ip.IP) + + prefix, err = ipam.ReleaseIP(ctx, ip) + if err != nil { + panic(err) + } + fmt.Printf("IP: %s released.\n", ip.IP) + + // Now a IPv6 Super Prefix with Child Prefixes + prefix, err = ipam.NewPrefix(ctx, "2001:aabb::/48") + if err != nil { + panic(err) + } + + cp1, err := ipam.AcquireChildPrefix(ctx, prefix.Cidr, 64) + if err != nil { + panic(err) + } + fmt.Printf("got Prefix: %s\n", cp1) + + cp2, err := ipam.AcquireChildPrefix(ctx, prefix.Cidr, 72) + if err != nil { + panic(err) + } + fmt.Printf("got Prefix: %s\n", cp2) + ip21, err := ipam.AcquireIP(ctx, cp2.Cidr) + if err != nil { + panic(err) + } + fmt.Printf("got IP: %s\n", ip21.IP) +} +``` + +## GRPC Service + +First start the go-ipam container with the database backend of your choice already up and running. For example if you have a postgres database for storing the ipam data, you could run the grpc service like so: + +```bash +docker run -it --rm ghcr.io/metal-stack/go-ipam postgres +``` + +From a client perspective you can now talk to this service via grpc. + +GRPC Example usage: + +```go +package main + +import ( + "http" + + "github.com/bufbuild/connect-go" + v1 "github.com/metal-stack/go-ipam/api/v1" + "github.com/metal-stack/go-ipam/api/v1/apiv1connect" +) +func main() { + + c := apiv1connect.NewIpamServiceClient( + http.DefaultClient, + "http://localhost:9090", + connect.WithGRPC(), + ) + + bgCtx := context.Background() + + // Optional with Namespace + ctx := goipam.NewContextWithNamespace(bgCtx, "tenant-a") + + result, err := c.CreatePrefix(ctx, connect.NewRequest(&v1.CreatePrefixRequest{Cidr: "192.168.0.0/16",})) + if err != nil { + panic(err) + } + fmt.Println("Prefix:%q created", result.Msg.GetPrefix().GetCidr()) +} +``` + +## GRPC client + +There is also a `cli` provided in the container which can be used to make calls to the grpc endpoint manually: + +```bash +docker run -it --rm --entrypoint /cli ghcr.io/metal-stack/go-ipam +``` + +## Metrics + +```bash +http://localhost:2112/metrics +``` + +## pprof + +```bash +go tool pprof -http :8080 localhost:2113/debug/pprof/heap +go tool pprof -http :8080 localhost:2113/debug/pprof/goroutine +``` + +## Docker Compose example + +Ensure you have docker with compose support installed. Then execute the following command: + +```bash +docker compose up -d + +# check if up and running +docker compose ps + +NAME IMAGE COMMAND SERVICE CREATED STATUS PORTS +go-ipam-ipam-1 go-ipam "/server postgres" ipam 14 seconds ago Up 13 seconds (healthy) 0.0.0.0:9090->9090/tcp, :::9090->9090/tcp +go-ipam-postgres-1 postgres:alpine "docker-entrypoint.s…" postgres 8 minutes ago Up 13 seconds 5432/tcp + + +# Then execute the cli to create prefixes and acquire ips + +docker compose exec ipam /cli prefix create --cidr 192.168.0.0/16 +prefix:"192.168.0.0/16" created + +docker compose exec ipam /cli ip acquire --prefix 192.168.0.0/16 +ip:"192.168.0.1" acquired + +# Queries can also made against the Rest api like so: + +curl -v -X POST -d '{}' -H 'Content-Type: application/json' localhost:9090/api.v1.IpamService/ListPrefixes +``` + +## Supported Databases & Performance + +| Database | Acquire Child Prefix | Acquire IP | New Prefix | Prefix Overlap | Production-Ready | Geo-Redundant | +|:------------|---------------------:|------------:|------------:|---------------:|:-----------------|:--------------| +| In-Memory | 106,861/sec | 196,687/sec | 330,578/sec | 248/sec | N | N | +| File | | | | | N | N | +| KeyDB | 777/sec | 975/sec | 2,271/sec | | Y | Y | +| Redis | 773/sec | 958/sec | 2,349/sec | | Y | N | +| MongoDB | 415/sec | 682/sec | 772/sec | | Y | Y | +| Etcd | 258/sec | 368/sec | 533/sec | | Y | N | +| Postgres | 203/sec | 331/sec | 472/sec | | Y | N | +| CockroachDB | 170/sec | 300/sec | 470/sec | | Y | Y | + +The benchmarks above were performed using: + +* cpu: Intel(R) Xeon(R) Platinum 8370C CPU @ 2.80GHz +* postgres:17-alpine +* cockroach:v24.1.0 +* redis:7.4-alpine +* keydb:alpine_x86_64_v6.3.1 +* etcd:v3.5.15 +* mongodb:7 + +### Database Version Compatibility + +| Database | Details | +|-------------|---------------------------------------------------------------------------------------------------------------------------| +| KeyDB | | +| Redis | | +| MongoDB | [mongodb-go compatibility](https://www.mongodb.com/docs/drivers/go/current/compatibility/#std-label-golang-compatibility) | +| Etcd | | +| Postgres | | +| CockroachDB | | + +## Testing individual Backends + +It is possible to test a individual backend only to speed up development roundtrip. + +`backend` can be one of `Memory`, `Postgres`, `Cockroach`, `Etcd`, `Redis`, and `MongoDB`. + +```bash +BACKEND=backend make test +``` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/masterdata-api/masterdata-api.md b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/masterdata-api/masterdata-api.md new file mode 100644 index 0000000..4c9baa8 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/masterdata-api/masterdata-api.md @@ -0,0 +1,119 @@ +--- +slug: /references/masterdata-api +title: masterdata-api +sidebar_position: 3 +--- + +# masterdata-api + +This Microservice provides the source of truth for master data. + +* tenant master-data + * name/desc +* tenant settings + * cloud + * limit max projects + * limit max clusters + * cluster + * limit +* tenant project + * settings + * limit max clusters +* tenant members +* tenant project members +* version + +## Design + +The services are exposed as grpc-services. The included client can be used +in other services by simply importing it. + +The data is stored in a generic way using a postgres database +with tables consisting of id and json-document fields. + +Changes to the data are reflected in a history table-twin per entity. When data +is created, updated or deleted, the change is also written to the history table. + +The main entities are generated from a `.proto`-file +plus some additional mapping-code in a `.go` file. +Using a go-generate-statement the db-schema and some boilerplating code +is generated using naming-conventions. + +## Initial Data + +It is possible to insert data on startup, this is done by placing one ore more yaml documents into the `initdb.d` directory. +Multi document yaml files are not supported at the moment. If the given version of the entity is lower or equal the entity version +stored in the database, no create or update happens. Otherwise a update is executed. +On every error happening during initdb is logged, but the affected entity is not processed. + +## Build + +```bash +make all +``` + +## Run + +```bash +make postgres-up +``` + +Start client with extensive logging + +```bash +make clean protoc client +GRPC_GO_LOG_VERBOSITY_LEVEL=99 GRPC_GO_LOG_SEVERITY_LEVEL=info bin/client +``` + +Start server + +```bash +make clean protoc server +bin/server +``` + +## Metrics + +```bash +http://localhost:2112/metrics +``` + +## pprof + +```bash +go tool pprof -http :8080 localhost:2113/debug/pprof/heap +go tool pprof -http :8080 localhost:2113/debug/pprof/goroutine +``` + +## Generics migration + +In order to get rid of all the reflection based logic in `postgres.go`, we decided to migrate to generics which are available since go 1.18. +This leads to much nicer code to read and also brings some benefits regarding allocations. Performance is at the same level as the reflection based approach. + +To measure the impact, a bunch of benchmarks have been implemented for all CRUD operations provided by `postgres.go`. + +Results comparing old(reflection based) vs. new(generics based): + +```plain + +name old time/op new time/op delta +GetTenant-16 92.9µs ±11% 94.4µs ± 5% ~ (p=0.421 n=5+5) +CreateTenant-16 3.06ms ± 9% 3.40ms ± 4% +10.95% (p=0.008 n=5+5) +UpdateTenant-16 3.59ms ± 9% 3.81ms ±19% ~ (p=0.548 n=5+5) +FindTenant-16 259µs ±12% 224µs ± 3% -13.75% (p=0.008 n=5+5) + +name old alloc/op new alloc/op delta +GetTenant-16 5.68kB ± 0% 4.40kB ± 0% -22.55% (p=0.029 n=4+4) +CreateTenant-16 10.8kB ± 0% 9.6kB ± 0% -11.22% (p=0.008 n=5+5) +UpdateTenant-16 22.7kB ± 0% 19.0kB ± 0% -16.26% (p=0.008 n=5+5) +FindTenant-16 7.15kB ± 0% 5.19kB ± 0% -27.38% (p=0.016 n=4+5) + +name old allocs/op new allocs/op delta +GetTenant-16 118 ± 0% 92 ± 0% -22.03% (p=0.008 n=5+5) +CreateTenant-16 238 ± 0% 204 ± 0% -14.29% (p=0.008 n=5+5) +UpdateTenant-16 500 ± 0% 408 ± 0% -18.40% (p=0.008 n=5+5) +FindTenant-16 146 ± 0% 108 ± 0% -26.03% (p=0.008 n=5+5) + +``` + +As shown, performance is about the same, but allocations in terms of bytes and count have been reduced quite significant. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/metal-api/metal-api.md b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/metal-api/metal-api.md new file mode 100644 index 0000000..a6b26d9 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/metal-api/metal-api.md @@ -0,0 +1,17 @@ +--- +slug: /references/metal-api +title: metal-api +sidebar_position: 4 +--- + +# metal-api + +[![Build](https://github.com/metal-stack/metal-api/actions/workflows/docker.yaml/badge.svg?branch=master)](https://github.com/metal-stack/metal-api/actions) +[![Slack](https://img.shields.io/badge/slack-metal--stack-brightgreen.svg?logo=slack)](https://metal-stack.slack.com/) +[![Go Report Card](https://goreportcard.com/badge/github.com/metal-stack/metal-api)](https://goreportcard.com/report/github.com/metal-stack/metal-api) +[![go.dev reference](https://img.shields.io/badge/go.dev-reference-007d9c?logo=go&logoColor=white&style=flat-square)](https://pkg.go.dev/github.com/metal-stack/metal-api) +[![Docker Pulls](https://img.shields.io/docker/pulls/metalstack/metal-api.svg)](https://hub.docker.com/r/metalstack/metal-api/) + +The metal-api is one of the major components of the metal-stack control plane. It is both the public interface for users to manage machines, networks, ips, and so forth and it is also the interface for metal-stack components running inside a partition. + +The CLI tool for using the API is called `metalctl`. You can find this project [here](https://github.com/metal-stack/metalctl). diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/metal-console/metal-console.md b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/metal-console/metal-console.md new file mode 100644 index 0000000..9a25f48 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Control Plane/metal-console/metal-console.md @@ -0,0 +1,27 @@ +--- +slug: /references/metal-console +title: metal-console +sidebar_position: 5 +--- + +# metal-console + +`metal-console` provides access to the serial console of metal machines. +This is achieved by acting as a bridge between ssh and the console protocol of the concrete machine. +It will support either libvirt based console access, which is used in the development environment. +On real hardware ipmi based lanplus sol (Serial Over LAN) will be used. + +To access the console execute: + +```bash +ssh -i @ +``` + +The metal-console will then lookup the given username as machine uuid on metal-api, request which console protocol to use. +If the machine uuid is a valid machine, it will then use the provided private key to authenticate against the ssh public key stored in the metal-api for this machine. If access is granted, the user will have access to the console. + +`metal-console` figures out in which partition the machine is located and then opens a tls socket connection to `metal-bmc` running on the management server in this partition. `metal-bmc` checks if the tls client certificate matches. If this is the case, it looks up the machine ipmi details from `metal-api` and starts a ipmi sol session to the machine. + +## TODO + +- If a second console access starts to same machine, kill existing one diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Deployment/helm-charts/helm-charts.md b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/helm-charts/helm-charts.md new file mode 100644 index 0000000..31b897c --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/helm-charts/helm-charts.md @@ -0,0 +1,29 @@ +--- +slug: /references/helm-charts +title: helm-charts +sidebar_position: 1 +--- + +# Helm Charts + +Contains Helm Charts of metal-stack. + +The charts can be consumed as follows: + +1. Add the charts repository to your helm repository index. + + ```bash + helm repo add metal-stack https://helm.metal-stack.io + ``` + +1. Use the charts. + + ```bash + helm install metal-stack/ + ``` + +## Contributing + +If you want to add modifications to a chart, make sure to also bump your chart version in the chart's `Chart.yaml` file. This is necessary because a release of this repository does not overwrite existing chart releases (as this would potentially break already released deployments). + +For PRs, your changes will be released to a special pull requests URL `https://helm.metal-stack.io/pull_requests/`. You can use this repository instead in order to test your changes. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/ARCHITECTURE.md b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/ARCHITECTURE.md new file mode 100644 index 0000000..0d80f38 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/ARCHITECTURE.md @@ -0,0 +1,51 @@ +--- +slug: /references/ARCHITECTURE +title: ARCHITECTURE +sidebar_position: 3 +--- + +# Architectural Decisions + +## Goals for creating OS images + +* minimal set of installed packages +* customization has to be possible +* reproducible builds + +## Our approach + +* build an image based on the published docker images of OS vendors +* add necessary packages and services in a Dockerfile for the OS to provide: + * sudo functionality + * a SSH-Server + * the FRR-Suite for BGP (the servers act as a BGP router/speaker) + * yq for reading YAML-Files +* provide a `install.sh` file within the image that will be invoked by the `metal-hammer` + * writes the `/etc/fstab` based on the UUIDs of the connected disks + * setup UEFI-Boot + * create an OS user with sudo rights + * set the SSH public keys that are allowed to log into the system + * sets the hostname + * sets the network configuration of the server (IP-Addresses at loopback device, ASN for BGP) + * sets the token used for phoning home to the metal-api + +The `install.sh` has to be implemented for every OS. Between `install.sh` and the `metal-hammer` component exists this contract: + +* the `metal-hammer` writes the file `/etc/metal/install.yaml` which contains data, that is not known during build time and can be customized by users of the `metal-api` + + ```yaml + --- + hostname: some + ipaddress: 10.0.0.2/32 + asn: 420000001 + sshpublickeys: "" + ``` + +* `install.sh` is expected to create the file `/etc/metal/boot-info.yaml` which contains data, that the `metal-hammer` will use for the `kexec-reboot` of the server. + + ```yaml + --- + initrd: + cmdline: + kernel: + ``` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/IMAGE_STORE.md b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/IMAGE_STORE.md new file mode 100644 index 0000000..347315a --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/IMAGE_STORE.md @@ -0,0 +1,37 @@ +--- +slug: /references/IMAGE_STORE +title: IMAGE_STORE +sidebar_position: 3 +--- + +# Image store + +The metal-images tarballs are stored on . The tarball must be compressed using lz4 and a md5 checksum must be provided as well. To be able to have an insight what packages are included in this image a `packages.txt` with the output of `dpkg -l`. +The actual directory layout should look like: + +```bash +////img.tar.lz4 +////img.tar.lz4.md5 +////packages.txt +``` + +Where `` is `/` for the master branch and `/${CI_COMMIT_REF_SLUG}/` for branches and merge requests. + +`` is the name of the os in use, some images like `firewall` are derived from another os image (in this case the `ubuntu` image). + +`` specifies the major and minor number of the OS, which is case of ubuntu "19.10", "19.10", "20.04" and so on. This version must follow the semantic versioning specification, whereas we tolerate a leading zero for the minor version which is quite common for some OSes. + +`` must follow the semantic version requirements for `patch`, we defined that patch is always in the form of "YYYYMMDD` for example 20191018. + +To specify the image for machine creation the full qualified image must be in the form of: +``, e.g. `ubuntu-19.10.20191018`. + +From the metal-api perspective, there are two possibilities to specify a image to create a machine: + +1. specify major.minor without patch, e.g. `--image ubuntu-19.10` +1. specify major.minor.patch `--image ubuntu-19.10.20191018` + +In the first case a most recent version resolution is taken place in the metal-api to resolve to the most recent available image for ubuntu-19.10, which will be then for example ubuntu-19.10.20191018, this image is the stored in the machine allocation. +The second form guarantees the machine creation of this exact image. + +Images which are no longer in use by any allocated machine and are older than the specified usage period will be deleted from the metal-api and the image store. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/metal-images.md b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/metal-images.md new file mode 100644 index 0000000..af70454 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/metal-images/metal-images.md @@ -0,0 +1,127 @@ +--- +slug: /references/metal-images +title: metal-images +sidebar_position: 2 +--- + +# metal-images + +This project builds operating system images that can be used for bare metal server deployments with [metal-stack](https://metal-stack.io). +Every OS image is built from a Dockerfile, exported to a lz4 compressed tarball, and uploaded to . + +More information about the image store is available in [IMAGE_STORE.md](./IMAGE_STORE.md). + +Information about our initial architectural decisions can be found in [ARCHITECTURE.md](./ARCHITECTURE.md). + +## Supported Images + +Currently these images are supported: + +1. Debian 12 +1. Ubuntu 24.04 +1. Firewall 3.0-ubuntu (based on Ubuntu 24.04) +1. Nvidia (based on Debian 12) + +## Unsupported Images + +We also publish images that we need for special purposes but do not officially support. Use at your own risk. + +1. Almalinux 9 + +### GPU Support + +With the nvidia image a worker has GPU support. Please check our official documentation on [docs.metal-stack.io](https://metal-stack.io/docs/gpu-workers) on how to get this running on Kubernetes. + +## How new images become usable in a metal-stack partition + +Images are synchronized to partitions using a service called [metal-image-cache-sync](https://github.com/metal-stack/metal-image-cache-sync). The service mirrors the public operating system images to the management servers and transparently serves the metal images within a partition. + +Released images are tagged with the release date and can be accessed using the following image URL pattern: + +`https://images.metal-stack.io/metal-os/20240913/debian/12/img.tar.lz4` + +Images built from the master branch are accessible at an image URL like this: + +`https://images.metal-stack.io/metal-os/stable/debian/12/img.tar.lz4` + +For other branches, the URL pattern is as follows: + +`https://images.metal-stack.io/metal-os/pull_requests/${CI_COMMIT_REF_SLUG}/debian/12/img.tar.lz4` + +These URLs can be used to define an image at the metal-api. + +## Local development and integration testing + +Please also refer to our documentation on docs.metal-stack.io on [Build Your Own Images](https://metal-stack.io/docs/operating-systems#building-your-own-images) to check for the contract an OS image is expected to fulfill. + +Before you can start developing changes for metal-images or even introduce new operating systems, you should install the following tools: + +- **docker**: for sure +- **golang** +- **kvm**: hypervisor used for integration tests +- **lz4**: to compress tarballs +- enable docker's [**containerd image store**](https://docs.docker.com/engine/storage/containerd/#enable-containerd-image-store-on-docker-engine) +- **[cloud-hypervisor](https://github.com/cloud-hypervisor/cloud-hypervisor)**: virtual machine monitor running on top of KVM to spin up MicroVMs for integration tests + +You can build metal-images like that: + +```bash +# for debian images +make debian + +# for ubuntu images +make ubuntu + +# for firewall images +make firewall + +# for nvidia images +make nvidia + +# for almalinux images +make almalinux +``` + +*IMPORTANT* if you prefer the old docker build output instead of the fancy buildx srolling behind output, do the following: + +```bash +BUILDKIT_PROGRESS=plain make debian +``` + +For integration testing the images are started as [cloud-hypervisor](https://www.cloudhypervisor.org) VMs and basic properties like interfaces to other metal-stack components, kernel parameters, internet accessibility, DNS resolution etc. are checked with [goss](https://github.com/aelsabbahy/goss) in a GitHub action workflow. Integration tests are also executed if you build an image locally. + +### Debugging Image Provisioning + +In some cases it may be necessary to manually figure out the commands for provisioning a machine image. To do this in a real server environment, it is possible to hook into the metal-hammer through the machine's serial console. + +You can interrupt the metal-hammer at any time by sending a keyboard interrupt. The metal-hammer takes a short break before booting into the operating system kernel, which is a good time to send the interrupt. + +To prevent the machine from rebooting, you should immediately issue the following command: + +```bash +while true; do echo "1" > /dev/watchdog && sleep 55; done & +``` + +If you want to enter the operating system through `chroot`, you need to remount some file systems that were mounted by the metal-hammer during provisioning: + +```bash +# the mount points also depend on the file system layout of the machine, so please only take this as an example: +mount /dev/sda2 /rootfs +mount -t vfat /dev/sda1 /rootfs/boot/efi +mount -t proc /proc /rootfs/proc +mount -t sysfs /sys /rootfs/sys +mount -t efivarfs /sys/firmware/efi/efivars /rootfs/sys/firmware/efi/efivars +mount -t devtmpfs /dev /rootfs/dev +``` + +Finally, you can then enter the provisioned OS image. + +```bash +chroot /rootfs + +# maybe you can mount further file systems here, which was not possible in the u-root environment of the metal-hammer +vgchange -ay +mount /dev/csi-lvm/varlib /var/lib/ +``` + +Keep in mind that you are still running on the metal-hammer kernel, which is different from the kernel that will be run in the operating system after provisioning. For further information on the metal-stack machine provisioning sequence, check out documentation on [docs.metal-stack.io](https://metal-stack.io/docs/architecture/#Machine-Provisioning-Sequence). The kernel used by the metal-hammer is built on our own inside the [kernel repository](https://github.com/metal-stack/kernel). diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/network.svg b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/network.svg new file mode 100644 index 0000000..2a19506 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/network.svg @@ -0,0 +1 @@ +
Machine
Machine
Firewall
Firewall
Leaf01
RID: 10.0.0.11
Leaf01...
Leaf02
RID: 10.0.0.12
Leaf02...
Exit
RID: 10.0.0.21
Exit...
External Service for connectivity testing
External Service for...
Linux bridge
203.0.113.1/24
2001:db8::/48
Linux bridge...
Internet
Internet
203.0.113.128
2001:db8:0:1::1
203.0.113.128...
203.0.113.10
2001:db8::10
203.0.113.10...
Prefixes for Intertnet VRF:
  • 203.0.113.128/25
  • 2001:db8:0:113::/64
Prefixes for Intertnet VR...
203.0.133.1
2001:db8::1
203.0.133.1...
Host
HostText is not SVG - cannot display \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/overview.drawio.svg b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/overview.drawio.svg new file mode 100644 index 0000000..227918e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/overview.drawio.svg @@ -0,0 +1,55 @@ +
linux-desktop
 + linux-desktop +
containerlab
 + containerlab +
kind-cluster
 + kind-cluster +
metal control plane
 + metal control plane +
partition
 + partition +
machine02/
firewall
 + machine02/... +
tenantnetwork
 + tenantnetwork +
leaf02
 + leaf02 +
metal-core
 + metal-core +
masterdata-api
 + masterdata-api + + auditing +
metal-db
 + metal-db +
ipam-db
 + ipam-db +
ipam
 + ipam +
nsqd
 + nsqd +
metal-api
 + metal-api +
masterdata-db
 + masterdata-... +
mini-lab
 + mini-lab +
docker network 172.17.0.1/16
 + docker network 172.17.0.1/16 +
Ingress-Controller (NGINX)
 + Ingress-Controller (... +
machine01
 + machine01 +
exit
 + exit +
leaf01
 + leaf01 +
metal-core
 + metal-core +
veth link
 + veth link + + + Text is not SVG - cannot display + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/overview.png b/versioned_docs/version-v0.22.4/docs/08-References/Deployment/mini-lab/assets/overview.png new file mode 100644 index 0000000000000000000000000000000000000000..43b42fae5ad791ca1b6760941e617af0cc0c58ce GIT binary patch literal 314999 zcmdqKNwVxpk|h?D5}{B^q&C2L3^N3MGeqA5j^2Su3Hrv-Hx4*ZH2{r6pWH#YzVGu5N2N7eBEw}&bHm;d~~{^vjZ;Sc{sk$LA2 zfA~-T?GJzWpZ=f!<$ne(|Ly<$KmPYW{HOo>|JsD-)}Lk56@U06%6)(LM^pgs^Cqd5 zr2iuVHTfS={*MR}Dzpd5F*128_u8)^6|a8+&7jAS^u_l+eKR!w)FtWN{_QmVDJ{uV z8)IH{pl5!5?*~H|{QcPc^SyWf_lOcPq#4$8G+&>XcMpSNwkVyTQ$p?k`)zCg18G7k~-+pS#ON zQ`J8%O(Ep>FZ$%G^N%}O>m(nK@5g^@`ZjUPID#XEZ>z!;-933<^YZ;T@n87%$N1On z^EK430WHPwV=({v89GYTB3yh}GTu%91P@)=dH+O%g}&GNopk$;Dfr&-(}k9CAM)a! zN9d0zd(_QVxKond-47rIpsn8e4t#>aTOf2DH+JI!J`dvnIUX2*v-%vx-uGqDdG-DE#~1?<@5+$6xdL z^Bm(pmhM+`{H55x`y5kWg7SMw?w^V2x-H|Y_yU37NmgO#*RuK>(@0}Kpyuak#K?b? zs1o1T^>>rh-$9{~Kbs`@Hx!yeeq)xCzu15qIDf&t z`@>I&`CZWd3^RX*(LW+64&DEO|1_3mlNEo;i#K>#|8$JY zYu%FXL;5`+9Y&x(K|lYXzd|4Shcf&GKKPFwKPwIXL$-f+=z)L8-hWR@gQLGj7UTKi>VJ_f%-^jjD1`lq`k~KXtN!J?{S6llfJ%6*YKMl| zUr^xH4Ea~%uhHSpWbuC}vgF^mPXEq;{+BG(UzpJ^I=Sh;)fxO-vohZfXV&R^g~PX$ z%-4sqIq&2-`{N4yw{Qn#zJEl-X{i2)a81Bk&H-ssH8SAGbp2ZJEAa0A$0!WP*x;2d zGUq(On^Z(6Ka?FedS+E7tM9n)*4SmC;>mW36ktghF^t?MaJ?d@| zda%TH6qgIJS#2cooXpsV@=O(C2{aIGh)9IIKu9Lu|G@7s7!UAL2lj~dQ>R`ZdiZE$ z8kJU&CKFv=a6SMFFQOzF17R1-atQzr%%(Jp6AuPBF(OZ47Bv79!R{0~5ZTL87qC2{ z41eorfIjSF1{Y*mbRsFK<;Tx+@dVLe2VsV;-}|< z#br&h#9xmbVZeKp5A6f>*ynTMQ_4Qh*L!pC+mn0i$>!@ON7EH#VM4JSD?hx~C9$4b zt;bu9!$PMiAIG{@^^mfEylgOzkHYF7mmc`#r7E$N5$|9nn_++MyH{SA6uxR<>|fd( z_VtT6A^{u|c+nh6MKwQD-d^p z;v&^dJ)HaC#>JGGCI?25p?^M~C9ncwz%D9&V$j+TgS;d}LB|F1gbCtV=Uj{K&7d{Q<*MbH?V|;%Fxf1(jY~`>grq~C3BO{z?={@$6Bk;nY#k#h zy1@0=rw0ms5cXEJ*dm6)GbS*KF2|``-nBuLZxw%~eJkqdXS>j%Twe*Xl}`0S?PB82 z+?5!TJ^iw{WgO#0pn4*GA2qmO)kQpHU7;-Bh3D7^@p|)xNB6bnY18#;{5kXEGDj|t zoFq-gAj~{@^Mr$5w+dypiE^mwHN;DqmR6ZLlZRWp7}k3~gZ*G33tlZOtUbL*K7kPWVNB(D3Gy~ZwN%0N z1BTxoVMi2!_~56z*LS z01>OsROIeZ3%{O?O(<`d54X)fyGyNR63n(siqS^`iyF+fj!96AIqo%|75b^i&1rW} zqKODsnfD3|4#2wmH(eHLFa;!48m!N;;Tl*P*+2f<%g2|@fH3)9?={p!ml(j@O!iv@@L}D{&3quC)Th3;>4mRC5< z<~4OxQBG?s7MnbMn*#K;df|A<#Aol4z)kaK^qkW;1r?k2D@Z!G5RGJS$d8A6aiY?( zHB_$VLlC;{xZ-Ql8y2>*<~BOo2qlC`$4S$Q4QLTLHNOG6!V+5gs!@W8#gZ*7)E}{y z67`PdY$Vq+PiXsRTLMqgexP1Yf2Qc zkAvz^z~_C+vxYW3!lRr)RViO0$GXvJtA2W<1Sfzat#@W!jzM^J_>3omF-fdF=HorO zv-$W(r@k=dsz%6BiKput!}!*HWy%-bsQB@ePi$aM!Xfoo;(c56 zd}NlMni0kvEtXQ&%d?=Bd#)?~?K=UKIVYrksN;!P_$h4%cl41m&e`?k(aA~KOLTY+ zUEz20ej#n8x=7DVCu=_h06MWS3jXzq@z>5Yn{x;m>CV2+2LhF=o4JHydRP@+!dmQn z3VV_T*K<*>gn>5P=bawP%|o##4$J||_zwQcM%Uv5kK;j)-Y8;)$P{QMl?HdRW1)zZ zUD+9Q{stG^oXYp{P^H8L1Q8WVlcZydc#qo)#^&~8%|w2>9yS7c2}_g%QS%$dNL8A% z+1nWzpM`Dq3FgDSq;&={3(zZhKQ#h&Dc)@`cd9)x+gsp`#(XvlB36Z0s4GmhYPZ*C zZN@k|gS_Vc&frw0cEkuyi==f1wcw39b}tk<0F3&&h@1Sgvx@1fa3guXYP4SZ(Eop>CqY^aOcHXx8Axi zMLyM|ClQa2fH|$2ksKN3&ed6*ibYeOh%=Quj;9a;Lq?lX)j%IgP7NvnizU+M*}@20 zUyWqqZ$7pUja|m~$s_vsr1OV&xzjiWV}tleXFTdotv*b?kLuM&Lzjz)JcJRMZxNA&Xo2&owg)<{!4dj>&-3^00lOWS!axs>dlF>C#TW-C_J7X zYB&kmK34s16Xpj`a-i$$le6}uF{+S5R>3bm=G*IY>N3~Ws=bt_YZc5prf|eg6f&uN zdpu8@ih4k`@uV3g_V%^(Q2AAP?_8)jmM*HxJU%oTKeJ{Py-p3DbsA--)_kf^B2AKYDA>DcuHHm&&avW3xHe&gubA+Ge1gfjQ9|4n*D6W#iPa2;maJ^& zZU^8{?gC*1>H-i_Rw|#l9tz`S+v|K3$q0vMX+nZj39qU19px|p3hgl)CIkLD<&^E+ zCSzgB=x|5gLV>?j_){Dog9JJtpDJ)z*}6aSCw)BdL?!nTjo+4WNL9JCN~xnO@cG63 z!J<^cT*S%knVgQ3>b%o@s;Voy)Ydk&$HhqsmQxd2)%eTp5KA7!S@nQ76|Rm<(nYaK z?`IU_7@j@%PpbqsmNZ@M@&GcX-DL_I#LbC$!zF5d;$>GwnMPnC_M6@|cc|zhW8<`H ztay#T#x;`no~dk6Yb8e^>ZkR@F%R2E?UPgj`m)h@e&7Cm9VAvvGWa8+M!Bmk)L-O8MvA{NGAgD|YDSgAN z&h7>S5h~HD=FJG$6VH8tchlg4Z(?HgnS~s2AGp_F6v83>(V$2Jf!jJ82^ONhd zv#Ra&_CPya&FaPH4twhl-t(g~=beI3~xKi@+hem@ngTWGt zqC*D*k7jkvbAbz@418o+lDjo4*UfPUuhabU&GcE#BSB;n#%5==$*ix8n zuq9dO>!DM;fgu_zWOxOr_&FGYsYW~_XwfWRJqDCptX>%_LG5k2+$}LIYaucyw>JcP zO;!F9$*Guy%n(eh-J---pio3J9UkQ%bk{Z)2X?u}${aEgWu7r-nVu71wy-q9quVyc zeVz2-t1QWmoof%e&jf~Rf0z=O36^*yhCDFDT)B7LD&`yljk9sQ{l;Y1iL_MiEQX9c zXnb_{;07Hrf$G;CKX8%Kjfu@ZJ7uy#@XAWBEvGkDcssh)cJnjJ5`vl|LnuUq64!;n zi>YS&>Vd?8$bT40jmW%;TEpXr(x_DA15Sb=<{?`dLeQYB+Fi4PdBCbE`mfeTM$A~9 zNUGr0o&+1Hj;N^yK8 zB292JKN(k;oohHmL&UU4=}l-lJ&7)BV*R7Wxud)`R(J1^@j1*C03Pt}UG`g{M`(_} zp4co8r_HwfMW>O%f8<#UUJP-N7%nl~$m086lo^yWq+joMy)43fI$I z%@Z~~9))J>TO^-vK_*QRZ%PR>-=!@(mDw%~Z)##jAd2@AO?Agysc3b64j7w|?Aqs0 zqe?Hfbsc8|V`UT9qKGWt7hQd-Y(;>k7)oeFR@+#FdRJ$J)B}t{LvPIB7nNBSyz=n) z<{>!&OX<1eET-NXFqYUiXA`tzx@lIYU2ramP5R3sv3EN64Agj2i+sW&t$qt3}{EpSgLrxU`3 zqyx<^3C@#raQd3Zxvj#Uk)9VA#1UAY)AgXCO0@e@17t;Hv|84PN{k_KQU(frRvzB? z5f|Zg7CM^el&qOdJW^F@Rm-DBt4nmNZ6L4Aif#HlUxlHFjQS3j)hvS=qS)oL9|1ie zBfW-8EhM~dP>n7!XZi4r6#mAo(OjMYV4HFWB~D_oKZjK}a_LAFbNY8Q_Y~)sEqfIs ziN;>}r`P;>e+aqug0IHSccPjdgFxbZbtt0Zx;nvCW_nc=zh- zIhJ*#n$}O)AmEl<0%8 zAENSvkYI8~H#U5DkhL0>ncpUQz-k)Jc~9+jc3zS6fP`sCH+pN*Oi`suK}ThsAFz=+ z&Pajm2skfL5HKifl{$x3&g8RPiEuN_uNpBv*omS+tH^`vSK$^?Bkf!uufu}O)LW=} znr8{OIF@r^fnKv9wXzrY8>|y*9G9$wEmV{`h#}XuLp%~WO^!`n6>%PPu(5b%xTz8^ zA&!uZC4|FUVAnW@r=A=fd>P-cVx)aOP+q(325~ z(iixh0xHxwS_{Cgh{Q1_Ics>Q$>(CeJAWd{wr~l?LU1fQtid3biJh8U+*D|nR zomoqpxf$pd>wf}6g_h6kwq0k_Z{1?uY=WKIaD$H{+(1~~(=E<=N1xyTl*Y2s)L&&U zE-+=*Oc{smAeUj~yuF4ZBKWHvsnekkn(b#>^9J&Kr_BHe@Av^vo3HqgtxKUVY74on_K4v#4 zp4oh(HYBrq_bGZ%E5>d$AB%}Smz~eLeu)*r-w+OD?3<6C?ykHOw>8D6{e=p0hG>Ob4O^y5W?H*;?DIAEv{+}S|}o~1xkHb zVY1Z#4qXb*FU}6%IPL7fD2Vw>(hPD4Z9&ihner^99%00IpmwTFG6;myNQ=}k`6Tyd}LoyihPiP2u4q~*OquPNcZC6bYur0}9vJyDGP zAPU*lOk=6xXW$+1r)A7Z3lf5gX+BNm6KoSl91WAYU_U$IuIyO(0$>em@w3BVAb^?_ z!@7L*I#QF}YgABF(L}Aupo0EJ-C|zZQcspbMvyt&D}w zye&usxbX_Jl6PL(d`1zyHDjl235R_m9og>-(_jsRRWPEBR=T#+#~%Y4P7{C#;@P~s zh+4NedqhRXl{fy9y|UJ0tEeAdO*+MG;_3N>j;V&$S1spy?uDyj6-`#L>8t9-6;Naz zG`+&u7(ewT@D6Rn=C$vv5qmQMJq1;)vFmX|QqhL84m5L*;5z@Eybl$_~dBiEY`0yC2 zvm7aMF~F%&H_%eaX&b39nzb1jOlktG;d_2dUf4UQi8jE!5O?0#D!*WBui9Uk=I(T~ zzc6AC*m8p7X%vzyXzQNO4`=Vef1S6X&XogZZWkr>D+IFeq%n^x z1fc(U=Y?riNV!9iR4R>wl&`K51ra2JJG>%*S>huhEhBO8-U-8h0up$>VmRO?WV62E zQWJ=P7wA+5UmKibeo`*c#7M}asPEUa2+J2_ zEn5yT9ZHby{)Fr!SiEC`5SR39Cv6=hYcjqU$1cz%pqr#qWD!rQ3u!B8;9d`u zH549@vZ5<~;Jy=eSGi{dE`f_KPL-6$o|y9HIwp^~b3M^idi5GKN_($ZT5?%#P*c)A z)JMa3;0W2wPIFqGX%f{g%{(L{Mh;jT(Tzcqf`gm9iX7Ib%?$axa@Csc-+OJH}m5#zn6U2oNC6#QIKp z8t>z7?haS%F7QV0?oPPP-lh>j==)11hg=^PZ%nZzu8LyT$I_GbK}UvheFtz2Z9?WS zI*8{pD$^6i?@;%h4EwxpbJtwy3LI>Pir7{V>LYR(p~H?-U=?bYI@VFKC)6-NAF3nd zF<-0i;R)iBvePzHV~1~_V!Aip+!UL4z29;xMAu4M_k$$F(z+gx;6d(5@9h^& z;W*h2;AgjDhjV~t+Q3tF7^P8|7uZhDFwIyowqS=Kms~LpAnp`S(HK_z5AEaIoYF8V z)+iM!UTq9E1#P+ZG$n2Bp(4`tdwww&m*P_l0fDaAy z&Cb&Kyq{|fZMwz~Z6IX)K1KH3hGqFfA7~&6GnZ8$p;Ma3bAMwXDrawP*)vt1!0T<7 z9Jz4`kjnd(BLhW+*T1Xh>s2I+{i;^jjJMfB)9azqDNuITT$B#3 zdW;(;#(UfX!z=1kyw&I4_R0n-9ZfNYcHvY zP5e+2Ffx&NW*3MNsgA@jeC6NH)d4 zfcRAkZfHLSb!imlm6Y|yX5p4#aAws;`;VB4B>}(H&vRWyrS@*MW#th+XBz7?Lu2fK znLL)NZtgCCZ-h`ohNTzUx4QaohB%F;&>+a7Jn&oZ*L>Y*T)`Uakb2g4XWYI_a!jr*F|kb~Hf9Jf!`+a2_Agi}NqY2Yrh z*GtJkRS$8nb=#T?+A9Ybk9{sRGkSP%bFzR_OD`by;`Wm3C&dM*ahSSh)G}2vS01dR z4Lx()nI?Q=$Y}#ru5$NQ+nYFZpX7#S6ALh7DllxrXFda!;BsJ}Ern1`U7WQ(QRI_) zrYT5JOqUTIpakkY#3{3yi=}lBLw+E)u+lXuo0`Tjn&>~Mv*=5Re1Kt@{u)*58$;*N zKa2F_*0=6;Z(3xNUB1;k`m~cos|G{uSao})rwg#2q*;GFX2yTp@uNLa{WgvpKTq+& zCP;Q7U`<&Ur5Giuu%doM<%N?#DWO-jebATckrIyr8rU?$5lExo$`VKiuqBag?;%Bu z1>hIa!In!>j3r2+hjz!M2=K^>h+uG}>+lI=aL za!Ae>R+ws|o&Lc^ZF44rWOOtr6|nBaElZJoV1jJz{?hj2toue8#_Kc;e{G39Ge5gE zWn?ox;zw+O85QdmlZHj7;9B%PBxGq-ouCwq3i^HHeDusAEO8R!U1CxJiU@~cRK`&3 zGs*<6bep5$ZH}I~51<01D3`}=0KsO1kGO!*XvWErl;|4FaR-yYFmF;%l_p6rD1_hE zWWk9Pi9T-$STnI}4-~xU85>mWs~Ne3>`;=Qx98J7L>sLDAc5~q+$b$QgKwJFM59sm z!_+lc)eB}_Al&11M^BRkETAS)MX*^3^0`z01kfQd;OhBg6hN=n<=~~_;p6YEpplo3 zRotjwpxT<+IvdoKa`>D`M#~WfyQ(eFlVtYAEPIi_@Ut+W@(wW!eX!)LvnNG&*dxG! zebR%AT?nnP`WcujNz|1$Y(A#wdcDVJVjQQgn_XdProt)2jv2mq+qe&mr8xjDu=UsJ zn(f-7rD={&L|8K9!7 z{Wb|`{m6NX3clCC11n9bQ!^CmO{W*uuj0X01_cjRyrv^wdw~5ih68;SO7GQUJq{oc z%@`LX{=`!{kb`D`v7tQPa@pw?G`)$=OF`BN7h#K4{gUw-A`x#Gflb|TXR_9n9BT)2 zYIFSZp)7bEmsNE8`9ekt1OTGVViDb!_~(^`2#AB=^$Ho7H?0-`_YGc;EYck*c_&_S zHClrYN*-e09I&_*J#R+3-Ym-K1a$&eTl*hPv&`f(^uAzak$Z;4$h;dh&v5p`A9qx? zyNllJO-Y^L4iMsy#%OyQBjRO?<-<=Uk=>ZQwHTDm7U~2lbtOX&KXvO&Ss379X7Rjx z!rLNc1B)~zzJZF@tOgdV3W^7JH5Dhv*KPLilmKsHo+ph>!aTfgjEVsuBDWw}rS%Ip zMvhtNDsK7qc0h*GKUX%9T7v=s>5PiNglbk0l%HZeKEuqEe&#{%__&=GU7O;oiY>zf z+f%^jMQRSyeI(K%`gkbW}&f1Qcr%xy=9NEE=y7BQy{$| z39BqikNSAA-hB8~Av3_2f^|zpNljVif(J6_r=ip3?Z$In9 zdg71|i1I-(ccVPbC*X;g+wOs1r8$f>Nq1$&=X{N$Oci=igzTrM@y-8gb_09(r|VvR zf$|OTDTRR!KUL*K1rD7Vd)q!~$uFVb>UokxiI7~dXGh5bOAHw>09BLY$G%phELiIl z&BP$MdwM%{texDJJ(nb#1;xQ^pC)SUf{G!bms}qZe^U(Vwg{pbv~F5?um=X`>YbQ| zhceBe4tR$E$zOhmrfEC+18Rp--=M4bx9|I7nR(c zm z*4jXwBwzI$Q*tg~ALS>OJyh*^`D=_lGkAdbH+8&F_v&u*145wpg09+)bsr1lYGB}s}V#C)Wj3!Sc`hRjWK8Dp3J}!p#i-XjZi+@Iv*?s@SvA`R(NEA^7HLu z5KhA?FHr`_!<^k>xrP6tIiE;&XMEQ9Alp;&kvJ->8=ig`)Xr}ja0+e?nfv5{RDE6` z%m%rIee{S@f2<5xAmHVzW^kF&0D=ff=~AHiKA`r2d3cF8z_)|O$yDN9X?bEcv&nXS z02`e6@(OCR-Q8OnA4@D}hC9iWu54F~Bf{xcl~?TO_Beim@!t;cb#3IG?PA^4Azupc z;jt)OCkF!w*(35qr7WlFyarBK0fc}n>mUJCW!Q9rY68v5rjgpsjZ1t6R8g_z^HQ4I zsNkR{(0V9-n)T%?p=^NtNNfa1goDF%6`0$X3K^jOuA~^)6tefh1-Ff~K_E~|#O(s4 zsz+ynD-%yU!j40TLzO!1V(;nW?H%eZzaW_w)8K0RC<04+$Nfx)$*=X(AFW{+aa}Er z4N7K!i>LrNzgR(<+Sd|7J-8MqZ1upCt*hR$vk3c~RTAB1ODyFg#>=d|Ksgymo>r+_ z-cDlYoEC=zii?$T&*|TN#t&8yHSIw2p_O5v92A06P4+vJVTwJ;DbV%asl>{b`fTu> zIlw%&c9)8X&sSZQrgYCK%~P{*#+opoa4T=UEEzSmyQ`hkYws+Rj z9=X6g%hD}&qpR)hTO>VVpFlZsAL_*fqqc64(O^yb7P6#5Z-j zbg*Qko~=51M2ATml6F7T`fhlOH|p5DWDRkhLXRHivHF*qYBXUnHk4 z@lb}f2WiD!14$H3pfC0tB_dJKC-02)1|HbTfa9hTaK}Fb{p7EQc1!E$1yqQ|sg#x# zPzm~(jmJ2=_<#Y9JPqmq+Uv7@`lXN?dI=rx7PPi7vPtDP)@+779_`dZ(_V z1Z4_HT&5o_ZchX21y%yFU4$*{;TlOzIhrO-pK4YFK$BzKcor+|N)MF-!4ci0KmT!!9E_z~8K6QHAkM6oNaP!b<$m zb4k%4f$|>6-Wql(z30#{7yoKTB-Ns)d)87)72*R_@+$_#UL@iAAgQ8(Y`Sy?AjXjD z;htVqEhaW+m;}Um0=iJA!5~k-mvlAj)1TUS0OtriSs%zPTQ?>ohmhBH(L_Bj+$GuO zUMGANXn?+T(GHwl&aLzO7+#gOMMHvhwG0jvr!dX|SWl3}U8HykJ~`^NIz6ZND>&Z^6g3J|RLl=SM4@vfndrGhHqMx)Ku^!Ey58b@J~15vlmefXSyo$p z-Q#ie-80wdu(Y}2!GJsmUfm$1(BPTFPbbx$0I+F%qd}MbJs&LCG0LxCmrAg@?JmD~ zp4A~WIqV1=v<>=WnXX~5K}IzP5?n(cT3{Y__oTEf8qC3LLB=g(*Y&YasH#Wp*w_`2o$yp8b@A;<%KaP9`h3|&x;NS1E>&XY+O={Ul`s)z@V z^73=NK(1EgGO?C~6Tbn4QR<^V`YZt39J0d$5>dvd0{QSDNr{3lwK9XUEIG6u+8LVd<0Z2832uJ@G3D!VHO}Fs3>-7djR|VD%u2@t6GJ43L$`!l1y_oP;{_Cn*f!n4?W=!4&Rgc^{({ieA7r( zwE&@eYcVVE4e3AFBm-oKD86vY)D?sXqx^ttx3Z~E4T?x*8XN<5BtQ{R;xb+}R}n-5 zl;v8B4EFQ2*yT%W7812b4T9rY>N-U`Kw0G* zQh^2PvYj4`{WcbrI3laUBGz6HoeT_#F^!^R@pXo!_ zJ-R|;&OLsZj;w=cLtIWv=cXt=5YrHZ%CYHQ<(b&MqZyd7Y_M~Pt-1LE+eDK@Qfdxq zg&N(Zu*BZ)Re@ET>-SGq8-0j%K>9;t1U{zcxpzbba{(m^#2UvUCeNl$9n8$QfT;pS zTPhI8{?>)`H5c*6>@=B0^Q4Uyr8vq4t|lu+qk=uiED+^~y+yzr*0q+ab}Bk7-hv&b z^a;fp$S*LpH81*VR#wzn`?npW+{Y69wA`b_W=!j>YOtk^^=t$I&pU`+5Uq-=(?A_| zUf>A@^2nCr*n5Bq2)#1~EO->?!W<=o_0eBAM8H@UJakFMr~qvA)_ANT!EVTe0iImz zZEU7^Pk1*2WEBA~KD$Z6SK1k|AcqeKL=beoQ`uzF0JZ)e&2-ZPewqx~-(I7^AxuINGoBf$H3_xC#>w~~#x$hwR?xXCiS)|Uy4p$V=wiDik&-lh^ZMfM?kfsav|Xi!gAsY@Abxipl>s84YUZ(i-8O70sIU&New z)&$Kykg`u<$|KWnFW_P=dqW3AOlu2>MIeZRtBvss4dlPa15nQrgQfdTPk9U?3*H#1 zs4k;m*8&+4QWeo)_gVJ{DXmcjZ;>N>TtsA5$@W+kbtyt36c>WmmIH9p0fXBflgb7g z!uIt*zWJ7dVFUZff{+V(<#1pRsPM8e&U+ZGytTgM93DNv5z&D8aEyKg+ua3jpS|S+ zQd45qvn|!~JlGoGL%w1RX~Vg7T=rqS7Qss%SP-UE8Z4wEcgF1tY&=v!@z!*Tl>X2} zB*Q^u&Pq+wJH-cVZzzYCALNlUSV~5OYTGX|6!Pw;Pw}zhoQGt?CA@D$#Ba^;y5rvJa}z1g;^>Y6S1G;tZbq12buBDJD|H`x?H zKmnzOr_cV6IalP&*l|uoWXpX{M7CUQtT~2?6o2v6U+=Q+-zdS~Zr}99%B!%~3Kny>cVdfgJhnApza3VIu~g&&{R%xBtE$$9bv*RnqkK5?RToPuHNz_DzcG^rOi19lF2l&rO3L1>qShU{Q7}R$$Va3 z%e{BF!`n``f^9g;x@6se0Nb;2PfLs{c*G)f+kT&y)Uo)iXIe573^rE!P;lRwtAe^5iCILGE$ z+Mmm}%2cRFTA#HnuMssu124D*9qUMa=rC`{EoZ$OsdJ)(H!v}ly}P9ig;?w*EeW#-BSJ4^ zjnkTVE|7*dpV6m@hy9MEakL=jR|kLTfkXK+Vj4bT3NO^0++4w@pcN`r-1)nlFNVVs zA??40!06(}In*e4Dlbm(Y&W%r`6!!!SerYWXs>q&Q5f4%h?sAV*Fh7Q8vojC<5%cz zPE>bQ(SgDjrb>5AXn5?o6imt`kJJX3vAtwI&&69}1Q+2>FS-RUYFcJ#K%^NRZ>yCZ zU==S%g_%BL4&nfNtCru&}*B&Kjq^LPBV2WhzC)SUBHeIC1nvMv?%c>Ec zJa1Ux{zUBFUc@4dfr)i)FJI;z(C}Dax3hfx!C&)*z$CK&`S4hG*f|X1mv@{|`8ne( zr!zg|OLTv4x;#gRnhE`bR*u(pZBNhOD)0R)U2`P{rbvlzXheDNB1dk<{FMX)pK8BU4GSymt5Q@Rw1m@yJtNNZHT*$UQ08 z9aUg(o7Z`?z7rFCa$&p=&3gNK^-;TB4pA4Xdk--=5zmGEo|%>lY>q1$5vRr8;LSj? zTq=2fZLA;IBk+Pw9b0dm&~$={kI6-O9EP9I3pFCZV~}3&gOegh`zgP>{&UsM4Uk2i zXGh41ioOQqT7dFHPbt+kd+p|{c`3#_)2bO6OXQVLL-JvXCmHS6_o2V%6Q$V|{n~yu zJeSh@4PprPwZm7JoU0qo|SnCGNmd=8VCFbSNK(tJdMe}6Abr>ckI2jA~@*$>mI z@)xHoMm4{#I#O-ww^izS#%Su@>T#SltoYi7MYA6T)48%n5+0D52=0}MhWg9ElmOv5G1V*KntSv0Ow0fp(8LW%?69}d zA)~70e&_dSkR(3y?*4Tu>413O+vK|aB+ebXZyVGWPtkStfR@s;n*+s@NUNHjR~5iY zLrCnUJN^6YHLo0qP(&NvF}WLFOw-Qm{5iL1Uvrwv)0;i9xmMb1ov`dSyw+V_lNx#Q ztNggz+Cxr+mXtfPXyw&S7NfA^BmpA67zqWLMa=dcC7&mqQLtncbrPfiaD>WI$g zyr3OUW@UBmWBp8ND^R0SbXpIqxqqTs-7wiywdS{e7@OrLwUi1xL3XpcJpw0c^}4gx zO;Vzpw#t?~IamF__}124MdtoFUfb56dwDxl`*SZmTwt^{Yj=^*Q8HbBG}p$Fj%qAQ zu}3-VUIxD9vk0hMK>TK&uF?;@pu)g)Dy|d~T&9NOV9>V+mfd%qk`ARAd+j8-l!FLu z;N{MIM3uC*-|r8aeronx=++ae_CHKH`V0cjM1}1R?H(-^_^S**Xa0TIQSw0!Jq|kk z=-)%+3X?44HQuIuqF>#&>tBqUktP7xKn5~Y4=d5RPxY%Q!OlEXq1^c&hB6CPLp7r% zMJs5Ttkl;pIBcMy0@h%jF17ce&xT8_$Fr#Z%nvE)(~1#+z^eB+8Hz`LqQ_w-foC0% zYY)ezNxhhBIvYztBR|4i0xU=?lX^7V6N~#MPN1Lt%yclnlO-02W<0zD6zt2U|N3Sn ziHGQ+RBtEr1KHA1W_7ggMFQU{@~xagXwG>eHr!Q5OJ;<0^e1NcFnqJgewtd=BGyA< zXzB-*yZ-($n9w6mc{!&Y($S%IFNF(IZLgN2+o+tGuk9kBmBcs*xA(}Hk7ON!!wrp_ z9OLk_1{g)}eZps>Xa&ma<PL6I4bx+I=zISCEgJ^OzkJ@_VptDz zlN|4&_jy;{4W1?cSnPO!*i0z+YdU+EBK2Uu8UC@&l11GrkKyUK<{C!vO6IL?-6{-- zbF+;E2j-r9WY)HIT8c-Pd?Zzp7e0VmBJk4kQzp7gF3hjq8hq!n-3aOq1#BL7D=qOL z%n1I-I=o4bXxygk3o4R~=*rGGF0e3G^9Xg9&&TE`$0al&fY5QyuEV82M)0xrD z!_K?+i8wC1L2~MNIv$Pe6Mm4}=L6M}=LZl70Exl#DSI5(O({eIJ)Zr^&XQ(D!QA=j z=St^z+?&oERMSw*HZ`wRJFTA(9ld}=Yg6w&){&tLfGP#(iBD4`>XQMPw@CiA^J;GILiTZOlB6=C8I>i{(-uftus@ac?N zBD^9duQ%7iBj7K|la98==gPsa>df(REzu9U>C(26+6y|1J6?R&KHbHQaIJ?6nXacx zf03GO4!5m!x2o4IlIzOM&d+hju7D`$9zENRhy6F&=8w{pH<5sV5JG|YF1?!%umiVF z-S)v?F{)F!y&Q&tG6P59sZA*b4{WHf=jw!5Yj+i++nk&x;_bwPuDz6}GM5Z}lY=N) z#H`3RCje$r9d%@y0h>ieX}k7Ew3RinE$Q62ICGmFv&_gc_jU)=B9 z;u~G%XGF1GR-o2MkI%eLTr#S9sVJMB>VP=JpNx~V;5*;x{d|T*(tnK7-Mqylf5|5k zow**mJC4T5`rLW@^wgfGCkZbg*ApQ-blTVMEaj5^)JpR9?Zu)rAo!jSbU3CcUs7HG z9#(wxh-uavad|SMq-f-0ui`q+7V6Qk5d{TMX9};LutOzqc(-145HIL6Iknr2?E)OH z+mCC4=*50#JiB40#UlAgT4)jBn-%&*x>a%@%y4*Jb$m$9 z&!$iN`a-XYZe8>7U8FBG;ow^Jf`jfEa{GARpB8PFsyX<3cnIvF2j=Oppe>O|PBQT+ zic3S|=@*~l#IxU(3q_V2tS6ujpGdJCo6hQ7;jw%J&AAcl(t2A{c0~dCNerZE-)arc zLN%wxbk1xoqLcc0K4#Cxzm-Sr&6&1e)N6z6!85Q<8~O?t4#-8?(p^gS`^JRHuo%&+ zow1R6!dUp=7Dry11URGzN?DKZV>0j#`?`FjL6OAo*(@G!;AiDfBx^+Hfc^7{m&7%? z)CY5ZBUXs@Hka}acusVPP`630a@oH%i}?nVHV`p!_~-t7Tue%NJ@!kQp&7TgBRb6C+FuU4JGXV&wCDh}DItg&?|S2* zA3I4L4rEnx$3!2`B7g3HFWWxre%d&w!trlA^hrNP{@6D5(+Fb8xH-|b9E-lZ$v!S~ zFNN2xmo=fQ0_#n?`!Yb z6bWYmf#Ohf^GkcG0Qv|WPAm2+WA;^QGODCa<9$KD9cv8a^Z@jnUll|Opwdcxd@Ls> zyr;7!po|ZNwlCPfKjXj11BLEnSJ8!r+F#v#6pnneokcP@2%Vhi6^Mm4oO2Y;sBD+) zOP=BRR?9x)hG^IA>Q#DZtXNU3KcJ7?LzgJ;(9&L)?B-NKc-8N6- z%*6sKuC@tTdiZHZxA-KbDitz&3-;O=Z%X#=j=&0_FS5G!bU>4dbkCzE(zo-)LSDi%p#9KN;u}YN2h+pbo4d`XrTuOzPv6boxD_KL%oRrTTW@U1yaCp+f?)O zo(;l~8CmYx{yW_6fTNrrC*Nrw&+Tn214mi`)Y!G*mXk-;FUHau`s@e6={*2Qe|}|S z`R=FWR9WQlU1G6>v^$1wce|G3*HnqZ#3q($DNw71Io&^dvcSpGOxf(#p-Aa6#E>w0_B7xP(oj3 zdSuXikuf;`v4fzO3$p3bgG+_O?0Ec|MJTqV>{a~#-mQwKD0?-mB+BLlo#xCZGh#&e@=m7F>YQy+s|1aAmQxn7T=wU<<~fso1cE^0ky zFX_%uZKORA7y)3;Zd0}F!Jh|OSVN#bxfUzn@a78Welnpr4HW%JZ`92fh})D?Ssfp?O;m-#EJk=EopK3HoBRJ#y!w=@I>MJJRSkW8BYp*&h$L zQvwzRECkp1iTy{jKl#}6G7|CPiIm6c9+U)dT!vGne7emc27d5k|2~rQqr4)Uj`Y~C zTjAZqkz(KQ-ZBed-H}LxS;1OS)Zs<--QO9h9KG&ua|P^?up-##IB&7GC1{`;_db9BiO`v{V_8_^dLuc15&R?l`{6?0d`$BfyWS@tFF2U%_#b ziSx7zXE8;|SVB~*zucvow$rE{fsfDGcnd!i5{lu*Eyt}8dA)riQ91dMeuq88oUmbx zAV9*6tm(Z67KKgEToU`XFGe;24Bz^oiT6 zcOr4t>4X=PyU??DAnp#&{{3}lb3T&PZ2Y*^WCYI2Ya#CI&AeKl4hoz%I)pX^i`on9 zmllT2=Q`Z3->G1(_T7J+GO|La>YW3z@{UHPA$Up1+yf$Vw2Am6PRk$}Hu3bUs=VIC zk_Zg^B!?}Hm8PqX*K>vRc89V0aLdw2Pjc`zxvPW&6Y5u2rw% zUt9D+9NrsdBct7{1!)M7JjmYT=I5Qi*S;@2Upr=bpO$R~_7W3L?NKx~!2K_XS?!hv z3PtO3hZV80^0#@Ir1VyI6slYN-R%veqg);0!rxrhXONbDAqz3P{>39`RR|Y&q80(Yk*Ve`M}0oKJ7~sF}omn z{jqp?a(2i|nfdiv5dZ~xdCnPL7Hzr`L;a*3x4UhUqmO~pKD%{<7yV{qfWr$DdnJ3o zvc2w(f|+5w&XoOiuKOplPhMjAd~`vh7razGsswit`dinKZ`cZEn(A)gAdUKMV+aCUB%@uYde@Gda8x-j<|1@y4j1vP$R%b!(2*)S?#P!DZ|lFTRe zhrB+e-$W>Er6YW zU(dc_jpZh6j0QEmig_Sc-&Dg49j;H$ObXEXfZ{KfSnci&m>T%4Ztjf)_`I^+oHCo( zP(EKDX=C)&P1XQBZwRYKHn{imM}GU)RuugWmv2x4C1`I^<_-!9&9@0RJPKNz`R9cx z*X%ni(wPlIS|AIrDtz3pep7Xhdx&14X05kq=NQ26!hjF3t$5s|Jfw{Ll%M1E=Z@!( zh&Zv6hc(clR+pNmX*$~+qu=Id_eH@;9d+ghu+W_$}yG zjDU%^W8a^D-qfhx3ICa3tdNWSL45b?jSlF7V8$k2{6{k?id$?;aua{iO#VgM`NyCz z|Hh#3Fciqw{$C%IEkyReHz=Q`s6h{?jaU(6QZ}H2`~L_{I>ORe*4^KJ{r*3mX`Qx3 zg6I2JEa?=52DB~S|20~F?vDTYTKkXhnSWz@{53g$ZV!S=^bc7HH0*?bwGygZk{30K zdVhWL$3FRQ#rF6w8~@**jNjYxFOJNAXIB!w%zwyS@PCQiKS}G!mHwE5f3&C)nEz^` ziu=0-`giN{{})wANdG5A)n9Av-`^d-)jRXQT~z(nhJR@CzeLsVhxucl{Pz-7|MAKA zuOh1c1H1AcEvmSGEvm%d!}y2%{x^B51@><|9Mpe^45$Cz+ytsj_TOHa{x#qKzPR`o z*6?2={KsVcTPE&5OqtTZ&6hu<#XneY{Ev*s_wAm(0aR4tVGtT{`u7B@G?*9^c ze@xI{M)Lof3HohX{xLz_0t))-@z2B)!@B%0I!jqo_s8Gig5Nsk-}eRo^HcU)b^M+% zM)=$I_xAZ?!Zy^u5hwVEZ7KGzhxng(ByBU)!0q`RA(--_Pmk!~CZUxHk_RFt?<<6C zegX*pBN=)7Exz7qhVawB;cx%PEu_CTz+VIPdpI}j=5L$d65@Z~c>aCd1r)l)KSM?Q z)0VqcWVGsgM}GYm-3q^M>(ABypPreGDE>_Z&N07Xwm<*=4nh3OL{WcZe@lu#CW_zu z4P*-c@}2GPsr+9excI*pTz@w`f9czzx;?S>Ladt>Vd8#ezGBa<*XE) zY;qd%G0F0fPsO;D;-d{-qKFqcpy}>K3&qGd>J^d%ynHnB=4%g2S6T)BI0`_RKOX?M zc0IW{cac<0BCYDu^Df#P>iGg$Fuq^Vu~TO-VwoT7SU*;WcA2TMm3cR{9I#Nw-~}SX zw|2z6$PJbHhwkPWv6Fa_t=%0%k(2VZT>WuzTFWouhbEy1E(Or@7sUbqw~Y_q&N<8H za~PqGQ_RkIzHX6nGuZ8y?(L>t57!U2Ar3l?6^4JgLrXDl5@Un-q%NP&o*ZOwqTtB z;_7+fkos_*{(19=fXf(y$rk+~&(0eZ!%)Eah2hR)ru$S{LIE8UHCC9#&6F5&`vqx6 zYCowLsrT3&Hr&J1xyPl|*Zp^673h}0umK+T(%dqk0mtq0j=Mmi*vadkV`?_?ZpIr~ z^(o>CDMK1uX5afV?F%&6$F#X5^<&Gs^$K*-2^8jY+U&M3&EOm`>8K5Np2Px8veMzP z^XdjVP)^; z_@RE^rDZjo``v)^sH5+nGvM2SOYCiS)gDuyvuOm#e7j&A{WJ&fC6JJ;d}{Vic?}c5 zbK;}+vCtB|5hF@_PxF*#+@!kesZy|$ zp&|8^tp79|CCL@f3$@(<(8NCMdN-Q?S~kw$+JRjV{8(FRCjbd`?&6 zP*YN{J>a0qlvd{}q?uEhklR)9qI<7+Fpq#bY(VL=I5TJ=-gCBz``-R{=$bi?9oX##)KkT=2vR9;HitZnZJ8Ee-gZpQ4jK)j;W^(v4q%+LM)6hi=JbTy$OY@(wo025n@d(wj73Ow)R zVx%?tzb8g+j$6fJe#tua@WUD@QzB@$iy4%v$Kw0_S{Z9q=u{EY@j!$x42OITC|5t0 zmICZS@XP|-XeTq-sLU~lweOcrbK^g(YIx7}1ijTfh}70KhnFDqRti%a&JN&r?u<8i zSQc0JXHKYtcK9i@zVCKezqLP=hcIOgYQIBf#3AM>#POAlZoo^rYm11JYxbEFlg*mC366#{) z{JC2c^?8NXv^|J2NP9fOBHg*sWc+?a5n{LX4B^&azKh8h?h05Q9I>NCUVu8!O;4N0 z`&M{a%9Cu}Mh8!pGX+Lx#Ab^0I+%e1x!y0y*kI_2iR~}#8LZkl1w=U9fm+P*xO+qg zN^jNUPiq$ptyFn3F3f@EdofU0AJDP3Iv*>o(1=@quG-`^GP+tMhv>fPC0*T0btkr4 zt}j#wU+dR&pWYDRwX|HF8g+<3E8h!0sKjLW^txo7Dm)8P8*&zKl~B+oXGEaG-tsT! zHyiXC`(#CQX5tg4Qx{Ch=Q%CY(y6-=7KqLp`Rh6c=zvRAJqm6Dpfv*`DZAYk1*vgW zzXvgGBbnHznXjB`iGENICFtyU?jrM|JWniJOS_n=iytuMpeDk2{Cwpg(Ad3{8K=8Y z2RZ<>pnGNTVbH8o98TQu{nk>p7ZkaLNUcs4X6{pU#y5~qP&nC?s!bFb+%H+-(q^FV zuaoF|^8L7c@O5Z)rqJ^sB3l`cva0zc_{1p4hF`$%+cit5jeahk^F-6H0I;!Z5PQ7q*fQbi2au0 z;vzz0rnLEPfyvZ-zrf_)_1m$#Ludl1r-b3V-z&E&Zy4~%0{d}Mt6&#Tp&ZITKW|LlOxr`|v4ZFENg){wP}aNGsDsKXJgvw5UZ z$$gre0k9f;5&*oM$Qd;QYoZ>VH(7U|Z}eRh(jLAL?xa_LehH|#rMb6ysbxD>8gR3n z*#wedUmPnb=JsDO0n5rPWcs}Jn=1rDy@Aj5jGp`<;{Zx1TMHmHn(cX#HSG?3Lr|W0EQxJ;ErZHB7UK@$DbaF!_Ywxr8GtpV-X{ zi&R|H4h)-?1KW&o0!3E~f$W0^noABH-4s{Y5URwkhslrVDNA`s=;7T^H}~}1KbNkx zYHT+y*pSiB%=d-|xN9K|cE#!Kjp}QM)|7WOso<{+EWNCbZQLo2!Qw7-wD!K?dzWBu zleP64Qs8f+KK2njtn!p-@QG2YYtzMghOKbVLn+Y(I-mjxkTWP&fmt2loHe zX~4wH*9kVrw7lfk)e8Fp6{Bjs`^w@+m20B2PoDTZLs~!Q_!*+K0LENCJbXy9CwCZevsJET5)ywLKxo+oatuIqP@UBlp{uW8 zRo+N_{EK}JI0;DKwUEd#Z9o2xRLk2X6yoW`nb%|olE%49cVE_d$ZJ!tz$Sp*zN1f- ztM&RJxlmNUKSJkf9j>%?yS(+Y0W1~K=QKnw+`)48lI5aEu$ASVY(c*0Yz>2+)Uqx) zu@{&5TOHRxz3|tr0IIA|n=e@QKkblYUUtO)JTzfF?1JWm%?rkqX@J?}ub|d5W`M_i zH_D4SjC!;U>b+jaMNpOR9hYQ&J;i&hxyz|NrI!e>nxP}^5(8YRK72LdxKAN=p8IXA zIf-M!@BDaM6D)>$5xrhjxGz9(h=|ESm7lR8gM`^B14cj>8BxmmFaHvM++G{=(_r3? ziW$x6y?KSl7;l- z8kStB;rx=?MZk!zv8f~g1_K?Eqfp)jR(8JK$-ae}@S?HY7GaBWbRCrDUanF^vEf*t;indOO@@i0(rX!i2n^pXc?L8^sfPsbFfi8!=Ag^qzhOrfU#uxjizx!yT z0~-q6Dc@i+5t}J`+_|}aw{6sBXHx+?tT0XRPe06OpH=%i9Q@CNx0k82c3FKAwi^uy zCph~)BLCuNLn1hP^fr|6{js0oo9Tiv+c;aB?81u+t4+;=m$(;v-OIba_QZmM8KLJU zc#eo=t2?T(`2Y>}YR?m<=Kp&BN_El!lv6ter)Sv67gpBGaAv4dxE9q3c83a*x<} z$xS5R(6NKPczYw}Ec1*%Qry|iE}ITOUYzDY)~Zt20dij?*1+%Rqf8%~iD*)Lk%HVS;9&8^-86ijgtynFJR%~x!7Q(n7W z)MD9KS1YNdbq8Lv%kz9c#FsQb-%$;I2Ia7Q#A6am2&)PVZu;r01>UY)Od=^y{YqBO zK|?rbg?PZBkR4HuXoD=BHCbsc_RKh73cm=0=cUnI9O{s0p+K7#-a0ct&NB46IWhgs zd}tw>q<;yYIzQ$wL}w1u7#AAX!8P>r#gOEE8K%%^vN-K88X{0Z?WB zDD3PVWgUPgqn4i2v7U%*$Km0g4E7eWI4)d-)&dC-7=iIt)V??CS${+j=rX1esu&<* zQgd^4#N78?jky^~r1GLE*DYuYi-pLcki=w&0Nm#z29mp+_6pPaV<-n_Jpyv5Fp{&6 z_kPP62)V1XO00f-=cesl;r#{aHc+|3eLg*d(py1&WZ4qkZus-IuGbHEoe-S5+pI|1 zRT5x`SV0oDvH#==)sd(rR;7zf@FVTJB2$Q4+ zt;>hCj#}@i^28-2oW20Qq_`0;>%F|(`(lcd!cY%`N20rzy{0px{a&U-^h3HQL90dj z?2qzv)(_FH`I^O#hIM*A{O$tb%(_Q_0^NTNi!2f`m5z>n<{TBImN4${?B>tTxH%L1 zF+&Y7?J1avH>bPt&H0C1#V135#;PoA@B4Sjt5pGbW$2F3`NBj<5p&B|iEHfkF(|%q zNYELFE+sJXQAa}9=}nEuy$*Yjo$XZ8yGe!{7FPSRXxQ}y^Thj=bb&qs!Na4bSA>r? z&QE*@nER5JNBoDfvS;d2xfc%1yXQ&TLiPbr2|jDI?;v_3^)+!cbXKU(8>B@x&Art5 z1Ok8tcs{Fipf**Ge5wdHjN|rz@cJna05>!lzOOoq^ZHaP%k{_oc|5(;mtL^M&Dvq^ zzncOlh6jY#%mEG$iNG6F@#EL=;KI7_u?aNeGf_M}U$u zxh^0tW-qjfq&@95ob;F}Er*ax{gYv-PfV8UvQ2_&TrQ($lIgAU3m7S{<+H+{ov5fG zQo0&4=$h07QPk;hj!v7$d1OJPMa1a#2J9RJg3u#0`xZ?sX}Fggg%`K{yt#U`F$sw$ zODtlaZ#I0t*fE)0(wl~0C$9|CxsqQH6beDQHW|Ha(lPqxkA)26Mg&rM^97w=tUf1y z2fckY+>*Fk8N6^&8;tC$@yh~I)tPyc@E0Y1nk~Bl_JW^n9r#hXcFmM--T-Q!L?~p; zjy03BZ;hMhPn+ifZz5bect`O*|A?S(2!DbBtW84evv#BgyR$j7`Q`{R0&fw%a=CEK z-r>+QDDg`SBYZ0DlA?eUbj^C>c~AhG-6SKj8(t0kh=X>we<0IXG~SfON?3F$>e@I^WRQEgp3Basm2?xsN*DwiSEfHus*xfTpL1 zm*{?uc+c%p#UzNjMI3FECm>Hzr;8HwXy^ttN5gv+gK!nq zf~Q^p4fK~Ax9wXh`Jf*jgIUObqlIki)vo1sHwekz|6!dEMy>ap~IT- zvEt&;UL z_B)cH^J5#yGwK?gWchQ$fGhy4Gr9^i0)9|Uy5laE2v+Sz0LKg&+IkfqUKL*4JM0D; z*u5i?Xo!5_GyFu%X|Rtp;G=^~qM-FF^n1pZ4rA`~~*%lZ@klirIj=(tn zwZ5?M@!PxD=WhExppD-AT97mChSvE~RJV@lkBBjx-;pZB-?Yix>GH_QnAjy(e}Rtt zewQYX=|Pvq7tGU<35Xf#ZWJe#TXeZOFy$a{6Z3!5_K zs}}l(zQJ@DuhiIx2={(K5yd7=@<9BOdVsqwNAS%7WsV?y0CJQJ#6BiWhTYcQsnml{ z>n}hWQom$22!w3`5P1ZMqkC*lN%3PhW>_Jzc6u%0`Z8ck?1~1#qxT6>&FDzI_uX+r zUEZHti2x$e@i;nuv?4-pb}LUpT08P*2R--hkPD>%N9`h%%?RGGgX$pXuDi!~^=ZE< z{abgr`>|Fwh^r;1(EjA&<4fHRh|rES=hihsJjWNYny16F^S8MeUc0S&U9(Sbz)pJr zt&zAM!VvDG@&$sA^UHS5PyONh4^T#g2>#LlESMK@Tcmy{wn`}&buOGrp5h+9c*ICo zlTD{kHmvJm&GehRRo}oH`*c8O+lVL~0EqqeY3r~%q1LwJC(Y^w&oReB>H*P*=&br3 zJZK1rwt#?m^QpiAjg?YK4qA~t?n+FF^p=b!2+O;NkFCZ(u3dEiCYk@btS6FF+ZMSAo-lCYcMc8kzNH|u3MqQTa**rO{lOyHzH%(_d(zu#6ej1rN&e>hEx<0< zVS#>Qps4L^F}9DltOtx_o&ed;0`=R1CGP|GYzBcxdw`5-wn6(KXU6s7gm_{0nWIp2YUDNZ~lm*@m#%qT!;?FPiDMJxSXF;6=tYv=*2-KhJp_MfiK{OC`OO+ z53C6}+uC2+t&k!2TcU+S9ma}IY;OFrP?};Q>s?ZeY#EfbQHssVyQoR&BCGD95S2hM>4(!HWwE zdT;Gn_p}oK@9-e1rtlFDh+NAtLjR`hw`rYoxB5!EfYyUw|H4p!xI@R5!NK3p5hp!g z5E#$St$l|*_O(s2Ctv&rIsUj>J3&GU&W%XU?=#F{kFSl2Qt&y0c<#@z+4_gZyT5*( z*c!Z8SGBlP15=e|E!(kTCenx3)i{bB@2;x|sx<5J-d!6u;o|3nd{LyC*8p4{Ln7ST^;QS z@bF=5U#Qxd-Npm~o2h`4idxc3U^;SinjKZwK|qQC`L#wEIzlNIoSPoCK)3VF1N+rA z_#WSE7Tw9sM_6eJ@+o6VCJ#9baknc`$>3Wen})C4E2`xh96 zvh6pTp}u6)MYM{;XQXfg1C99ONMg$PDW8ZY$m4!R*Z+fYl2?{tg9$#^8-(Q;1@~CH z71{V>P2zBtKapsAMAP`H4mvUW$ZE|7{R?dD$bONS6OpJ1d%+_i zixib8jKiC4qb_WN+9ceeE_HD@P;m-6*kpTmIrnr1HzgbiwtSKzyYi&Zr?Z%~*TY*s zz@hBzZ1V;YLkBAehJ$s^V`z>{RH!B zjIbU^^kYp@-!ShmJ1;g%f760O0MI{tSu(Q8u&fnW$TpzT=^T{6C>2eFa6c!}j-u~9 zeRocLn(bc{u$vNE*wes!+K_z?Q~XnCK$Tscbs>Ir59;hHbZezTbfQ0l&=%#MM{Mz$ z`r=YyD#2*Wzx&~CY{vL<*(9fpSK8PUQx>R<`4gYkZBl4F_X(y-XL|njx+-xF zghhy&BY3Vyw<^zj5|JRQuZ5|{9=gYcf@v(1Azxv0^$W&f*1tP@6@;-?51&&$Dg_~EG(XPXz&%rdliAF2Qqj})c-1b$_JWe6ma$wrqcP4SSNiHB`ew(_uZQl zF@?c|va!V$+TBTew3GZqUF)tW%lB$CV|p#WlSI~y`mt^mRx?k%5w4(^x?m(p0nO^^ zAfGLw^Y`LK%|Z70h-g4+@$By;td5n=TvkFaW6}slkG4swgK>*JY{uL1wX?qMcY1-Q z3Jw_VcZ1Ck&-xv(^~>$)Zh5d#o`9P)!h-Ms5B3IvC9)P^dK0~O*bqH}@<{!Wrqgxw zkcXeI@6CSM!uxjghMS^&D+Q@fGtk9;wT4$QgnTsan-zsdEnCsIU%4Sf___W)`S-1e zGD*}kd`&ul#ms6vMwu+3kZ*%8@@qFRq3WS_9!kBOzX~EcV&!c`PYqBHjodp?mUe{w zb-BnSl8mYwh7V>TCQA{T1^-&1akO}EZorYa<9SD!GEBWbHNid)F#yK1Jbl-vTs%Io z);HXTn>t%9NF9#CiOB%2s{@s;0+S0(*>AW$u;Z;?PRYCRKbYEfsfsn&?34d?%|>MQ^a!~NB+qb0-O+Rn-t6PA zQ3Xoeas>+-Ze=@KZ{^)YZ{{bRG|$_-be3_2aO+=EV8~x?1?I3xdyT}CXF{A9BI?%rnmTPMpXI>T4J z^^Ft@Zn}Q#u3Ptst)+Vi(Qc!AUr{RPr}7xotz=J`q@)k^i$ADZ9BHl7B>V&mL2+Go&`B*pqCa!;?J^Pbw{c+2+^s^oZP6U}vHEGoiF?8HzmW)0O;e^ssrE^z zSM3h*QG<>_WAt7FtXQug8Cxcf@2Zk%;3_^Z7zJm}@nKzYxfI`Y%(V_grFvY>mSi3x7=QgUV& z5k}TW#stvay?L8Pm9)w9*4_by zl_)o#rw@M&JnC}bWDBYTJo^r2hkDu;bSe$NXD*Ktj9E6Bw&mqe-^JDo7!lx-4Z@hU zJ~4^$n$81LULw`b3zd2SXVy+tb*yLtORYCPO`amNY_o4)ZE5JWLdq9BaAtE;xo{N8uTnNShqwwYP zT;!~S-wHn#G+5@=i8RCy_W8wyJy$*@n)0pjn-fYe*2kxn2EtZVF_nL{BQOCf9QF_D zVp|@S?Q>lImlMc6-O(zh=ol+c9%Yy|GCckQJV5zoGs(Wde?;nQch*i}hoTN4??QDT zA`gH%R>^XNJ2PJc>Vt4gprkb);f;|lk4dKjd>nm3?yfR^huP*Ag%~oR@GkC}A#~{O zYZxg%dLE+;^VzF+fN9W0kk>IV760^R@N{Hx_(8iD@riZb9J1*UJnTu`%E}-Jd*O;+ z6R)Ulc0xYvL@9#J^%chdJ-gNKI8&&R0f(M9-0uEyw{OYdp?TtC>VS>u<|2lWrZInk zqDZeUcpd%-=xM880d>JCwZ=s5Ih4QI(0b{A~Z`K)&N`Z{>o^~LEG#`odMvmbPnJIt!TI`h!{ z^ZAB#ghM-!;>Hrj8!CNC`t2b8t05%Q=Vv7+gj{)t_P8OcHc(3&aEyRM;lT&wt>Buq z^Yu%f_K8)n^{66OH+(shbN$B5|6?-;Ex4SUE$^-&$fy6OQ$x(EI&;oH^{Ot-)3t-)uI_*4k78Dh@z)gmb?{075GPoEh5@f>Ue9IfXT z+!wIv(!G50HO;3YGAT&LJJ|rT9|O z@xA@zY2)r|^+3Ao1}g*92OiM-QFj>QRs@?iXPS+~mMr7$rdG>pNP(&q_!7x^Yb>+P@{*-*Tqwp?J zT|mj!B(1a_ydojz==0exWEOb?>#QLaG^X%9{*~Kuz(N()@n_Pj$HN^W$9gp%AnZN} zmgFo*AywDYgt&M?Nx^*aAM9{4tm|hxwmmJsR%g>2qp@SYq(j%Y_~utJ>FBXM*^%W; zwSoA9``7)+j!GS*ZY?Rr?Ia@U{l{l;WeEFjU=yu_el8ZlMbWWF6`7{|u1>6!&Mu2+ zD;+HZ=pax222*H1JZa)=d*>9Bf`MaBj}q|eQ#oG?Tu2K92r& z@G0S^r5PA5^eSqw^hK7^qk6?571{lQ{`R8Y_BT=txfx<bjJcKEdKIe zF8j^ry2kW2mb>dy}^$v+b zmZwQV-!YRp3Vubr=LB7I#%9$WXhgi$KP^y0P#?n<0xT+g0c=ylnOk9{zX+g$5i8$f%Zy!7E0P9 zjC#QSZUqFS(6|#S|8!!}1ca+~O`9A1)qw@(+xhXPkJs~bkEBFi>n7@}cB%&iGp|dV zWJrUH%l=Ld${;{nfn(fNhf>Ht1mS5@JIPowXDe2Co_=?Yko(5B%lCbYKfG9Q-y zvzf#x^h*>})>xjB1%F#!90|Vl1IUe^M%X`Ie&}nT@%EUX^$fVr^E}GM`T-wT#NY%9 zz4fEL?SIA1ZI->x9ES0@`kRnZ349iCQbFF60JuUdPYUQ4_jrBd^gER z(LnigPz*pJ^#E3Ff#RIsYd0H@tMFb9V7KkvL%T@&w%ux)^QORh+sW@M61RS;-)X>= zL2(EjQ@-0Jamn_L&)(lS=qd!&%WAsqmek+3ce00o)e5HW9+AFxXmwjO|MsEFa3{uI z@c=vBdmm~6NjZ-jM|}?d-48FC4kLO+q>hg~pwc6DIgOF`$E_7(DQdd*h1>SL2kPy_ zA$fOlkCa!&U{*?qr!y}V!j-Wqb%zpLt*{4%?}f6iIEC)kMPb83A>BpSDohSK{NX2b za%Z^%h533i*kuEh5dFh=BszoyEU{jMmM|E|!A-7~aRRM*gQOSK;2@ti>HChfWMj#d z@sVC|@$IYV|K@q*>V4?w+QIVK&jSz>`*@F^!UljIi0r5Eg?a=^uhTRrGBSjD!nHI= zn|iAPsbC;5dtxJ$JvzydIse7C1+x-Sx+Z&Tjx*Uy@k5YAjg$qWz#}&~krff@%0~1a zxj%hGgT`Q<*%=p5Cy$ShEX7Mp0HSzv2geC?LC9F#3%P3ZaS^~$0CZ85DJbo!3TO%& z7hzk68rs=vo;G*So;{9{RTkGjA>+J$caw7iM}$@Uss272hQf-=xw!lZUtzvsEVGS9 z69n*j(28DBF?3j6L}&mx$)1FhdzX)tP6lkaCxi-zeo3^sK0hb?3O_T=$O_v#(&4q~ zU$n_U&vZ}+@J)vvO4j(hx!M%&DMSdCyc}DH6iRe{4Rf8yoU-=0Q=3A8Ndyo zf7>Ag3J|^srp8jv)-q<6idAe|?hZ?ZME3GBO{YP0yjyC9K4zTgM5rOq=JNww2lCN) zOf8OVg96`bG?g=M9C#ee_XmaH(@36@zE7_=H}-l~GQG!DX8+2Qa(KHAz1;12&+`s%nKZUdg`UJhywl$!mgzF??i#Yyv#v zxrzIa;@=aE<(3oP{(9yycMw^qa(!N5Sf)gUhy|&&umtR-cEj+}GZr9&!52@lMbw1v zjZ){@&v+Lc6@PnL5evQ9lUi|?ttmL10GJ-6;mmaDy6o{b$%ah##xovLU92Z#@}KXf z-o)555#EdM(zepj(VJ%_+O{(t=Z$Ngx4V7qb4Tn8y!Lb*Oq3lIxWfi{N9Yuzk5S~_ zTMs2oy`CY1h2|&%0|8PLKp-WD0UgSCfQFS1m;oOKTA5%1%oez~03{4<4orLCKXU19 zRrG+I&3{l;P8hSOu2?ERcL47)w(dKEI1SYv_q^IwbUbF>-$Vj&lF~fb%2-B%iz&^5 ztskScwPYbw43L??@Hz=txL?|n@42lzR}Y}uio z`-;gPSK;RCWUpmUMWRQlJ!5+t1tz>F}*XvC=n`}<*MNhcTY#6cl_N3)6Xx0LP1 zfI2{X%~98Brd)gm{EU=;zqGF{g&jP;VEotDmpfQBAN_<-m4_^Uj%NC7ICPNO zyQN^*cCE2VqBF)UpmQ76d^_*Vbq_4~uK5_UKa?v7IgztLP-Sirv5J(xPKh@<#_2a? z{B>aDcr(ZTo>pvUN-!BvJju2+G9}*aHpe9yB9w;#h+{WFL%VI0-2ter%en@+*(FMX zg${tN=qUlK8`S-M1o?wN)vwR-q~dhp7BjFS?)-e`o5bL)uW zdH-6nj?*{W;r?oH9cWAow-~gSp3E|AR8t5j0?JVL@sR*3qJC30(OO_1vQUo zZ2Dsl>|KKTik*mefXN5z^(g^S&&UvX1OE=HkWtfwhsWGe@pFqsH8^h(md0Q{v=yj$ z%N_TS2LQ$kpgZ|c%7rGM2RQGkvNJBtzMgtI?!P9keynNI`Ek>>wU1p?<1eV8e-tx_ zArH-hUgyAl$d@6E%E^|!=2q^){Jpsq_OQXJfh@~T-chh7N*l=p6>0A6hl%a>J_4hR zAv#P-i73_M!2C{g z4>k;`-T3<9$VPvnSn#kr$`q&3;Mhre&g5l|IFqUV9BasxK>zFh-FZT>=E8C0#XSqU zAj(+jKsZC+(!R^eyLI7%!6DgCZ#$8&%%j)IsSCD5FCB?MgrwA`Zs4T|Xj8lzB{YJg zJ%Y(WwHn_^G3rPd6FlA_hG*nB?*fLJoakQ?Ttr3o#oWEQPmkEXE$KKYX7gNL7kE{K zI{kn=>6dJWfDJNWeSgvBY4e0{f{18a3S#nsF~A>M6$q>IPJ}-X5~0e9Kk2#gq-|Le zr$^unqKqIt4ee$B({1@UbzZSWr>X(dfE=tjJQlE2|K_QmD^h!!6Xsqw~heUOr|!`ZhRKInk0mhEC}F2avO z^uA;GgIMQ$uRR@&pT8lE)(nu+^?=R!!)H)$=*S@vKFoS6u*7EZ-hR?g1p|KHw!h2f zsy5b%K5npM|H2j*l|LwZi^*S`p9Y)M3r!?$7CVD!JTq~TmQ~(9pr8J*= zr1WCNUXt!5?+TF;zKNDH-BDYfFM-44&lF1~li3$% zPuZwm*6*d)!rIhr1lvhrQ;?pwf9vLHrV`T}rV^*>QAK|d*7Pd4sN zAMRBYg^ZU0k{{?p6bGI+=_U=y-0i#<#F#9B_$o14P+Xmr48b{ANklSMd0Jy!^<{4Z z$?0@t)&UcUF5M7AT+L4t@#6T|3fzVzeF=D-_~<5RMO_(5Zw_=HlIY?C(-YS^WU}-& z0Y`6Snc}PiuN+=r#Qgx%A9psrz@AJX`plTLA2kL(-s8gRcv&4BST^6-y)MgGqY!G? zr?@J>6>%(OvuOhHR8ph%y!OqBMhbVOffqoIbELg`N4Z3O!3fK*I?=u+)IvHzM+TxN zJKiM=Z9NWvuyYO|9Ekf@&;3%ayxgG*M=@W8hRbc-Y!AhBw0=_>iPV?w$Z4s)*U5i- z;*sFq2p)_J{(_ioEGt%7LrtSIuft$T@*Pr^%`)T|QPXo0tKs5&Mr~U}!WUTX!jS%@ zXIj?)02K211LL|-n+6`78>hOPJD_!2<94|Lf@t?_5*Mr)rp+GfD~5vX;&Re zuNdbtxM+5e>^32_v-u~c3UNAQQa@eM*E?j#yuN8qC#o#t;#w|P{;%*!`gD-95q)eO zK9f>D7Rki4Rfn08A1_E%-)k@SP(7-%CPE2{BrEO{_TDGmhNtuOR@Wl8!ZCpQkO3L) zaT8pYwV2S75O8Z6mVHZ_4Qm0?O;<99e6Gs?+jQ`;F^p(p4|X}m8KIU zoNpi#Q-UQk9zq4uzPK^y0MCrT7z)q!iE-}bAp%OWi;!lCH+ZkHHy!V`08MR=^CxmL z0@v-tMgH1z&E*dmxeFzAHBW)MMtm*M#I^1&Q2G&T7In+!NPscW(5L&2frR;A0O zSYZGIe}}p*NxhrksG;f$s8UD3sB!Sc4YtaO@Vk$=ZM6pGEZ57`_A8q#=_)}p$f8eW z8t@p7Oz)8%J66x?>tM#dQ88mj=JF%kpe_525fStxyUgW7Qr{aW6-!uO7`igpd#)DG zLbv(VyJNTzxpHwUFm(dg`UAyHf=5YntpAT<9AMxw- zn4!hxsi=J9s7< zH$q~+d-@@$bKb?xkNX6GkMmgf5K2mx{g?t_fMX+M5*3+IT$o#5oGuo)^AGpT(RV2& zt$lp~_W*C-j=)#Q*SLJz8<(rgWmO(f<>*8|3eC8HJW`fq2$K7-rwJ)*7qM-|-fv{Z z(=ofg+C(z}$Dl1yiFuC?$Xz8VK1jxvgyq9HK7a3VoAbLZts?YleDre-I5tZ;G zoT9?hecd@ODWtJ#8J=(XnMa~MR{C8*<**Oi{66^Wa(Q+pq~DVyM%p(z{yYV&_;(;a z4gpgIft5mXuZl@y5ek_`yhQM4bh0<`#Oxq z24TKYf7;uXc(}>dfETFIxrUb58awrRakd_i1tx?%&+9Jf<%lJs`JvQkLpJyAH+bmi zshCz7CSfAIkT;h@h9(|BxX~J@kjXHPhP1>Ia2-ELsC)ao4(s<@K;vOB3 zBJ$CzScMo51huLl>|aF;S=hN0I%{|kT;4zRwnS-0L~biE!iVKxT#w#s--gR_B_+_% zj8|(ERc6Q`RQ1wA&_pIbufo?i1Sc?IMbhjZ%5VU}pISR0A6$JoXdZZ+0eHvbMrac2 z7{N>v)ioAt4d-bDq!t`2GGX~sf#W}vQ{#JQNYY;?Tt<OfG@}J6=7ZqnE=Grd@M;p6PyNS1i0JN&SXBhk3)=i z!&B|L1eFh`NP}wwNE^7cwSm#GSwldBllI*bVg%)ADn6&Ac(a`ogifz!o%F9Gf7wB5 zCaW~c15DuYt5D)086*ykq)--4n9XzSZ&2tKB`=Cvwjy>EQ!LV)9QT-ue7KZoETk-K z!Ts%n_Dr3%?e&Q1#39CxF6FRec|I7jLL6Oi!I)U`w&{#I08@i&uhI%kP&AO!>7Bo; zg&aix=v{>bHU}4?rIy7SWiGRs`!T6a+<8EaI*K!eoc-M=;Qe59q0iWr*)ww- z<2SGJY6y1%a=Z?NQ!~ScY?S)WBho@h2_Z+~)L9JD7bjyym!iWJ*SLlz@Yqh6dXx30 z+rvI>A}0YqaNo1*0wg9Bm&S+Q5%_43FENk>EAEReARe>w9#3~q_8I_YH3OyFi{W0@ z`_5hOw^g;s;#E_S@n7Xud9FLHU;$rX`h`Lah*j%gMau-zQ# zmbLv=hA$ki&6YJV0($Oxq|1tQnZy@ZP+H)EcaXdzpx9y-vP`Q_Y`WYICJv`&#EOX5 zcL#?!C5Xyp@3G_vF8<~`R);v3>SCYp_JIw(P)O}S0zXxu@CaZEjauF9=4_@|%QhI( zFy!70LK|SV6K#^__WrhBgGt(9zkulq7?ZVOxi>t?4J9N`7uPMh$2_t#-pUN+oyOZ@ zyxuWphscf?J%cNOxOUqHw_-D}Y4!@U(=uMJsvfX!tl3zXG)BO<=LxMvq5eM{%Ks3f zAs(}@0rq64JJes8D!lj6y{7ij}z9`gshnWO#$5PV$9`!`&w1q$$>4vxrQS;$&{RU?Q!qJ{b=6L{F5fi;! z&~pt|uTaXNPrW3kgNM}AiG>eh#ZK$^Aw?h$I@&IUL!_~-S1}k(KuG7B%!W4KL$!r+ zP;Btg?u?Zg>!PH$ci}xIC_d>7+JW2i*2fL&)F06BP8S2+5I)0o#r|7PvN1rfc|IRS z^s;vb8uJ5*36SPTtXNSD_fJ*kz*~e508g~3$%I)a`-SbFuV$`MtIx)=#5#C_ukKIo zayq3mNee_)o&+t?%SS^uYlJP!RI#;8vB8U!4~uO;j4T z6R5Oog$*JelIiIflXCrI0bcs(=huUej|aNB#qg*Pe23lys2P$0hXfPG7X_ZjK-t!B z@*gu>#P1qtR08WJvz4)apvb_}b83K}uY6fp!N8Qk#$LQ->-O<2y6hkk41~Tr!qW)P zhdH}E;ZXA+DY4+~a%UWmOI+>Jucx~@kCn>ju-}Ge~JYHl|O>sQo)}$f0+nnr+opO0q`Djn2M>A z=nL@n0S~8reLz5G28wW`!QY#g7}yP+>=(GV0H2+2p7NY57*k{Zs&<@NUG}9hF7P0S zqsBZBANW5_j#`j!EJ<@V!Sg3N?g}Q{_o&A3dpM@CEAcGTXeqzq9BOb~?`7Ie1uUF7 zai`nuLC@C1d-1UmLh;kvlD_Zs3P+7N>fSLp_`Cj(Yc$#F-$TgJEYljHzi$jn(Ffg_ z4{h%9k+y_UHQWu19Vtdpf<&B-Z4zZJ)Rd770x#IuxCv1+BlVN?tvgf1;`WJ`<&lKn2^ZzX zCnD@ryere$?LR6I2l_DWFqGD|<*yR~UVK9bj+SyO5KgHiQ*B*DNnSbD74Ku?fXtxL zqZ>O7nao*e2OYvBAU!S^VmSQ?K3Y0)&+I{rrYjBXY7{ik(rkO+YYl*H^wfB%Jy;+d z_sGh}#KNj0DJ;va>+gG8$=-5I;1H?J#u-y3kNF|dpj8%*`f?BP`Kt^h0 z-G=Bmgu9=qG`UVNk4%A%AKKRD7K7q)=6cSAXpgI(U?Hqr)ph3kVX3t^3@lb>2_v|+ z20wxCR+TTJdx&fX5VNkPr%_)1voMWU)OK=ZKr}@xn;*oE>9b;I!rXuHfDH5#=-Rz3 z&S2y|p;XsFPa`UD;_*%H_$GzVY)1(r!5uy{>q@MewSt z=TC>e_NHRNwt!wqxf)hHZ74SJp^|!lLO%X|6<_ZCSVH3wok@**E6vioORHBBPDj#> zxzD&Q4}m~{xx|+>_BgLU7D@t^GG2hZ@`%6_d{Ho$PG9zOD=<-qxoWEY_*Q}bxc(u2 z3Dldn$8WV8*UmT%J-Izwz=sLt32b6LOU$@X4eVXee;xx58plRH4qgx`r8o&UIr*u9 z50+8vkr!KBST) z^_s0 zYA9Xx2kAQ=wr1tgHzqnh&ECSX%xfe&KU<+TtkRma`uh`~sF&H8YG!d@IKZn?aqsp~ z1RLEvf)`4*B691$ru*Se(ijo~8ly7y3tJP@jb%MLvhtEv57&Xw#iX*8;XM8Q;C3UV zd#mcdal1WkV^Po=q^IMP;W0iz^~icvVrxbLWRoc#?=i@506u(dXmleT-NIJe=b@T| zI}OYesNH}w*Rq?aPz+FNZvEr87g~7kNf(YK03CQm_{OB`n!H)i?e@{fT~;S46ia`@ zy$Lf2sKqaWR@g58WaNkIOofdx)Gj~P_kR1i#E|HjcVhka1Y73xxHpB?lA`y=LnC*A zxd{kQ8vljgt|^$PDk#w3&WpjN1uYB~va?;oJF;7hOWP9uaZ_Q`dwurs#g?8&$Ah=6 znGumUrfY!$xMs1hj}l#}^y8G}K+B(=OKRy3T%OVg@Oqa&Hv_-XOutHUPL}<?%) z=gPR*eUHTJSBuvQi^pAqllVe|Ljb4l!bn}~z`_$~WLasMb?%coEp@ znOOnEJsM<+GoWZsh2wf-KOh?2cMh)3Uj-;XFg2);UtXT5!?=aC4Y30+QzyDq zO#s?m1Gk55xiB}j34|qKkFvkSv8Jz3H->!<*Vj%U`fn?tbk*H;STfT-1Q{-GKYXhO zxttwO{vRJ4Z*Ig|w`+Gf-JvkJ=|mBde11nz%1M>8q^3><6KfujYk@2SfTetXkLY^2 z>CY6)1=cijxD^xA@qiKbc5Sac#pLd5(|!b2&Nv!0s!4$=xzlh%uqkola!wQmO0NAb=)s>!PXr5!ZMQs-U8CI!?1!&_C^7pHwgyLteYv+r zgnw8abbp4tS&|2Zfb$(pTzR{nFE5}VUmspG)xUc#pYa(lS@*<(E1m7gtSIZrm9h#W z5kx|)&f2i-wH&aCXsmYwN#q&>#NnvIi=FCH7K`X|JzSqpcs^_&rXq?vCd!CXXuBgC z5lBNNzvp93Ifz9E`q)d7UlzcPw?HPY!4R+Cc@p_A?p@VC_+;sqP$8c=|MI{X>GZta zFaAg-Toe2_EO*|RaH1_Ecw`c-V+LnIyK;%g^{l36;!m=1C6W$uX0P;jPs2(Tl_*!2 z7zE6n`__Zk&{ZPgS$PI%U$B9AkNg#15QrGwB}bCRf!vaZS|xm?`YjAQ)SZo>$*N6F ze!d{eQoXAi z2KA6!yh)uZBv&d4toNJ@^T)c-GT}Ns{jEc?5w-0dLhVkEU~@p2sP0G-!!;x3VM7L) zb$Ui1l&Wtr{k)gWnvSqj;^E;az}Aj`18MI^sQ4e;%YyPp(JeFdd( zM-Wt}!%g^hoo_ke$Ni;mcrC?!a3Ak&a3^6g zXPk^RfwngO6pVR@nw0dt)#VhZ-b)KFWNwLPBQ$N;$g{PzvH)G=a3q6$6xR=F?@mhL zk^l{k$o-bV=V27j+3D$dB2+Ro=?%ICf{2!i;C<8KXrE1R)V@z7gQTku*c5*UGqi1g z%HLQ6biz}rYE&)**+?hmxGTAt+M@8Uwycod%pn0G96AHnxx(`bE_$TXK5R8l4~qqm zOQ7A&$7_E|$u0AIldCKIb}>3#+|%Q7b^_cRm*^9AgtHTE!bB zE6+lGsPAUMC&s;pVo?j|PegiO%UFMflB=nj}Z1>_Cm89 z_y$1S_kd~=-Tm6b&vviu0f|hFqN!{OU(h4P-c$1dHH;?RPbH0X9N0fXEQV5F(<6G` z6f1?!Xg$Iqf{8_ZBi4H~3LLcSUzAf$q zu>I|#X^Xsu(F~)U;dxqL$_8@gcV%I2N-NK5o1R|Z_PbT#cma#2k^13#u*5k_&!;lKm_Z5aLiX0*uTk#8PksR*P=$2UPaEEF~!JQ|)LAK-Kji^1n*d zt<|Yi>xt<4+uQf&2DPOowL1VI0=r5knC?%33+@f+z+BuOq>R8|hQbu9T~A?#J^8A= z2sZ<+=N(PnwmbD9fe(nfH0wMtCF>kx8uoqx(a8pzIvtT2W-CZU+r19X6r7>TZupfr zYDo9z-Cg?<4ez02It`W*QM{`r{dVaH0izm12_n1g@r$7uRzmhXG-8Z^8yiNPNuJk} zj_F~mM4~ZaHaj3zDy?CJ1y*_HEX1*D3%u)nrKkh={^3*d?0qhmV$(Vh%##Hb%=sf+ z*NK9P$r$jN@8*TiTMer)z#hSsffZyy{y5SN>8Id!(8I2BQ(PkeSHLLx7lGDSXOW(pv4J~@~PklXuj%2lSfBUAn4$PnBqGtQq z5cRzYKFjcHE=cL|lBRxz9aMq--N&`7rHRS`$)XIg$+3CKEhMf)R*w&X!j5=!KC~KqO z!Wg+RDQTzYS7ygV-PvSW*rvfaxcZVU81;|7;@&?KrPKWiWjxU$U`3)`==U(d&@M7e zP?E!jZa`|LqM@!U)E3iZLfH!V5|7Y3K%o=cK00r@d_&Z|OU;0C)16N^^{Uqjd*bK{ zL3`qam~_-Cw(k^7?cCaHWq!p9pw(oN!{LUQJ{`IfywyPv3*eDbNB9fHe|l#<1V@pp zN_dQ-9wbC6RJ+&lXR-WL9Tp74it2#q2}Ye&<#nHTiVYEDe%mLlvUs(+ijU3#kOCKJ zB7pNI4Q0?)mH9-)BI*n_=4SozJ6#M4~e%A0b5yB6?Eyf0!C#QtzD zf7FDR{`odieFPo~rM^sf@e3E7Ki^wX@iIIX@B{~ZDUd^=jCj3LwGC%nQYB#SYBrR8 z>P0qj46;iQMquh2aH2;=aqvRR`FXA2w!ry>dseeF7{ne#?{f#L@!op?B&)M}(nTMB zdvW#~XpTqbAWN=5G=ts)xt-r@Ym$33I0$=Ey<#%#kyMfg4mCDIDXLTW_&vAVBeoKb z9HHPlFr(Gu@33}g`$4Dxt&{O~&k_F`goeyFnJ$AP=H|u2SwAr-Z}7c5oII$#E;T_Y z;PhVhu%g9?vWX~dLypWN0c)oP$0FA91;Gu-L^7`$ooWz2%d~bVV`m;tz?(pltHBHD zF3$-=ofM&?`N{F%o1MG^lQ`B@jfwZrI#FqnaRQYJ{;C)4YMks`@Ov0LBnGRU?iVKdIdaK&Kqn08^B0fU>0{9DKYp2@)NEB zbrg!w&~Z6%R_<{2d-3T^&(roU5OrqiCy1nQpOtjJ42cFe+Lqu)SbM0`8L+XO9S%j> zLKQ{@5~h6~^B~DB=8T&H1(KvXB7O>>_4@dSoCtiL_ta;u$uf{cU_j8?=?jK=L}8J* z%(WNk%C0)M5m{Uupp>lR)?~4g35{2S>=&Z0qb}Nz#1-TSRyCNL)r`J@q#XF9JscY1 zMpo(g5YLL@Zh#e~^=iC(@G@?{o`fD=kuc~yK^W*ybK83bNfCnPdBoUISNiX+>J$bJ zwqH6&`-cPUO`i89a(G*Z4&Xk>&>pVKaeEw#C`4fb^keFosn{!UIg4|zSpCt{Vc3q1jG@0)e_6dslr#i?)M^N20>I0WO7c zd5;(diyVaf@iU%&^>7iq!Zt2M^Y{|z*Nj~2{sCu;$^V8|lKGU~42 zTw%ujIkOxGpNtK6!Ib*679Y~8Z1`n2#;DvOIx-zsf1Jo6C5wbi@NPFQlxZ2Sn9ilJ zq^DwSFuxWllVI~@N7^zDoCACwtPuEQVU|imob83+mPMpZMw}_@?4^}fHOe-x@sD?l zmt{CfD)?<777e)#Rm>&8L#-2XuiSmB_@c76kB^?5@&eFLbQ?cm1nOA)~z%win2lAMKVpl5vd6t@{J)cW~OT_0Pa9s9ZMC zW4emCOMs|ojQE;j%*Z(;vq=7Zmi+7??%#-Xg?mg0`ED`&_~*Gh+YXkyjj;*}v0*xQ z$U3F(=Dqxm#CsPSKAIn}xK9EEq|;p@$$8uv!Mkt7NFWO26(7_Q&Z-wzFHqIxpDVIr zipafQ- z9Z-T$fl*xMdN1%DQ=%4G1$ zQ?6P!pvFy_z=dZ4o>m)I>?UCCg9S*tbi_Ay5~1l3tC<@&kOB`ItoCkQMYCd{2}QE1 zXZZta1OuEyZg#J>o$rC~k};gN>sj~#{)UlQ+NIlvKYr3i8ygrqT^DuBYgO!38#g9Wuim~B$&$(G${LfyEw#Tyh zcJiG0;!#qv@=lWMgiW-9$ETp6mXdVzC`IX6Op(9ON)zMg1%(hiu>!ILy8G|NY1FI| zQ{wC`~| zQ5BI-G29lex2ZBV6Aj=OQQIWBk(?mxG-pIA$w=Fk4kGy8;QnquWCp&iRpHoqIySnJ zkYgwkc8fRK(xs1d2)BIg@FyOky$TksnbAXAOG6l)Y4RRk5Xc~04CM>HJ8~8~GKszV zw>G$a_HC6g#-rEN%K_v(?gP-IJj$3oBj_w-6dhkbrmK3{qF^XG*nOS@D zvjZVbdC+jZ%`Ltlx*c2>BJm+*k?^rq3t@9d9_{_(bz59AyGbXY)$#WGOcgBaay1`e zNfuuKHOTBwOW$#z8^W}eT2i2yuI#=ED&Fs4Hiph$i@vAAxx*C`p4AV?@B2ycwK*jR z`L+c~cn@V$5f^8$$v+Ju%mS5__D`%{oj^3nywMv^4wjJB5toUEYlp*(9h;ig;1He@ z{{e&wUeR`~B!C#;(BQ(PUZLK^2ePic&5`4`c8eIR)N1C zJe#Ez8P!U(s4}nK3$(s|0C!(3p{~6N3!3;Q*W^wosTifPg<3D9G__M>6w!o;oKJuCGQ{_NMEZtvu*+yTXZa~c zpB&*mrFD$RPW3~}ma&Ckvy@rh<9G2vCy!0grt*r!*MFaU9 zbDhNLqQN2|4uy9cVEP*JLM$4U~bsmF+3SFZssM+bswBhl} zu16+TE9pS*>~f~)Qcodr8aV8y5!Q;&{qXBgGxj1M-SW6@hglkWXFcXM`3mHVddBoT zc+&~7ehN6H_)SaZd)wf63doM*%eItWQAZRp%sBS55^Nqg4tQJ$Pbf=`!{JFXpM@=? zil9nw5quaU*5%-_hM9G5yG)5E&jF$GsezGIh&~6GquHQBxT~U%GFeuX`)E`?oCVU& z{TV=+iAbF;gJU(`251fQ%;8AstZ}6%75sB=1VT0x(yQm?Vj$JeddUEtkc|fui92b( z!ULp*a0;R>i3}D;XD%b+>1Q?(wcVo?k^Cn`GCT&({*_SdN_wQhk{EEHKS%)cd^K;8 z7VrrDdk&1xZSPnNgk%dLkN4mR#q^@VG5Z#UoaDxf;txRy3dx!Nf&dJY>o@0=#c)Ez z32CQ^(win#gyAx$P{h6^Psl*D*Ox~DRP3i*{5|Y*dXW&9o-FB}$~KsO|7=#(aQU#uQ#O9)U*SBCwFoZ0e z!os=Q9mxF-Mg75Ev1WzI6+)Q)g0zQwQ@tAKL4zQpxeFa}KUcoxhv(uc1CXIxF?_ck z9pem>mG*Q90Lxs(3lhS`^_N5-ozlBm?4its{Je0Vtp#Dd!?HRo5m;4&1|Rw;_Kga0 zi(H!i^(5&~TplSteV{Bf1Jw+5O!$N#5p)AiMW-1$3BbC_6St%V&Xpk}x^l_BCa@2G4~1W^vBCd7 z4QGS60Rx^Sbd2Qzd)re`$BS7`Br>8sRRup z0Zk@@e{?O}@@AXOhy#wFmQsIf6C4U}w0CU~2#je1kQ*O=iL2LqlZj~v-1e=^XuPoy zlC2JCCU=aEk9aSSM{u8_CrQTmAo(seS4yQQ*T4(~4x|_)+T|yI?i(|6&+|7U+_IANr!;Ap#7<-dkREDJDB#) zQv%eHaBj861LoqfMDZUqvr$Q=E@OHNvgwi74N`tS%S5Gmpmz zUfPDbRbZCV<8KWlNHd!TMl&ZBS%IK#!=*2&Po%QL5y2z!+t(W#b%z4ik0Pooa1+4a z5pRPZ^tdmbBE}z@W!swv7#o-ORu)y`!6g+Ya`e}FCjhs&?s7I!TXM~tLegIStG@Gm z=Kc5E6A$Qb4inz&O)g7SB}*r;Gq@O}EnK+prv*2rBwtV0V*|MzS%I4x`VgS>83qt> zsH%*95&!r?4Q$|eE|!V6%kd?k-asCKun@;eB{;f@%cE5_YUf#dm3InXV@`=fAWgOa>bS4VjI8g)5;zpj%h^9ee3sCJ>sl^693s{ zhk}jUa1?_M0t3v;&{G7GX{7MoyZq+JB^d*hqIc3-Qut(}NxmJ~t+q*o0PI;5>92?c zav3A{5qX6X>9$F61v1C%^P}4mJy4z-U}zG@O7rE?W?0%l1i%K=#;+f-(C<-xUGyQN}ZiH+~v160#J+ z6C#?aD+(h^niMq?LB2sPF&LmC_>-}AL;-`OkMx_KZ0;1cMuD$){Zgel+=~i;E^v1f z%=lu60X$D0BI-KGwI{-gtuaU8v;xdFvqcz|S|{L9+gJ8fg{Q>2%aQLTXU{uzIxAP) zK{Vv3ZH`zCnAY`!9i149hc+l8$<9^w9OcCWpzcfV);yi(t=O1rfi zTR+LRiE10VF_|PTA|Lf7VtGxgmkiYVcug^=HI0vZz$o?W4 z`|ESwdBkD)bS3!627y&R{(cW{ztQ^FQ)U__GK$%`azc}?5i>2~OW&QrQ+Bd#jt`3O zfu9jB#$tVdtEh9+_m%aUk*efM1Z_tgd6MLyyVwT|T~6RU(rE&u=z_A`-+af9^bS$d z$S%3woztVT!t8O!lB{j8>r+ta=r8zY!#oCgr!(h)3w_3}&K)7PhH2wm$;%kd9kgi% zWPLfrL*)3$!r`_f*!hnS#*aIxBm1fDoePp4J1iXpq>;R7E2J@O69sw05zfyvM@)(c)U1P4_*C=Ci-|xvGE-hAxk-1#2ttOTtI=Omw124a~>Uc ztgp~_8zy|ipn8^M1@!xEGEW~E2g=zxrQb5LJeXt zYt{`&fmdv0aaqiT-M zWU`UTYSg0T;qd5x+YUxiuO$igy?BM43lkRr3Zip5BQ;TL`iCb5#K`#P9oE|S^|+(* zM&&Zsg5Usx0D%;=+6@kx$TWL#{{GJCGVq*z>1;8`Pr&* zheN=%`;0lj=YA=Q)nBmLs7q3aY!GICD$H|P~VN&-kk&SqHX2wQ-963bbMkaENCOU}X9+S)8yP_&C0Zmvxl zBN#e!IsK?3t12_g1{Kzdm@%7`U^%NraGDPeQq2*CeqKaJ$(|ZclLD-i4hryaqoB<8B(`2;iI3&#i8P)G@nf}6|L*{__^`%>~m{_kJ%@cUMZOHm%kZ8qg>txr)#{#u5n5^DGMFgQE9edwOH;( zSnB)=w)G}ZK3xM*EAHbnCOQJ0RuO+a)v=-OYwN+zPX-lC&i=aR>eh069_(<1e60yx zGdhx0`*U?vkCRC)CFoqdnl3%+l{9c+;x`}hvZcmMmPz{ zq#IY~S?FA?*)f6h=N+t#$|ZC(qS40*N$q_R$@Tn3tG(D#hfhA*;k`RLLynY^`l^o$ zS*UKGyZG@W$I-MV(8W4#9MTXb4+b)qL&VkDbLZ!(SSQ(CR)yDH_L=xgLW~=u1^|U! zRi$huJ@CVBk4YKd+pTfG52M}fZde`V#jN$u^S)8i%YCdood{>SGQxF_WOkgPSK!8t zMeLKoYR@EMT08n(Us15EUo@Li_XFnKTzA0Vg>C||(^QkxQQ(vEEH^Qmdy?No{ zmn|1D$F->z0Va*)BcOAUtkCnR?OhC5M8<~C0z3&C2}Lj`S$DnfwNKyv(HH*4NFV;J z5nF$*l;6Fj3raGSg$)M{`H7=>MM5D*^JI}+6DkVeVdJ?!d?ai zWcizZn$<10voe>T$PV3zy@QTa*%WAKy)N z6V4-M)O}x|tT#6coHv`nyYt}?U_O%&i`IuQ^D%~l&D+#D_D^{mLmjBkxXT$LW1p0+sd#y$99a!Ha{;+n^yH?!v8(d)y= zfXTBQqQ`>@ynw*fee8^xyH!|iZv&)@Y@X@ZUthsVR*jcn|9s7_sO*^$x&>DK#;t!Z zIs}J?+3Q51UagHVSl%83O=P3LtFPZ#O7(Y5*|faX(t%U|Y9m^JjcnAjk1_b24V8hX z%PA!>`_o^mz1?Fyl=!IUte?p~i`-~KZsSFHzm05QY`{#J7Y2lFy|ho#dz)ZyQS3!n zvJEBtO9>TXo=k`r;D2!KAQp6La+Ja=5`9`v5h* zZVGCF5zcV?#kJu`Hjj;hrPUs>TWfEwBk4;xtPHfjx@$3elv}z^s82Uc^u5JA&RkF@c zy(=bcb+;$ZivdwH`snAA*eP&$xhYpPl->*%w&wBLL2>91a~CN{_T2q8?ASyb>~XW9 z=;sO82yd5=Su_cHwWpEwrvqHwLFlN$A?#&+Bc z>(A-?JdWjDWwr;cZ!zR`{XFS%hI5@j$9|sCr!Ol?P9ABe-YqXXE6P5Dq7PvPrYY0L zP5p)_Z>OJa0f}IJe|SlCG9-Po{T%uwQlxY>D|JH8thv4{j6ZboZ=k8 zxur%3QIOv2_Hf&t=Bvh2;(m-G@lS9hWSxO)E*jbQLOKg8)Rzb2us^*?sDPA8R-V#% zZ`av*-TXj!&3Fsjj3ik3TKBi6j-2E2)}ub@Y)8%(`pD+DBR@ZbS~3~Q`hy#>_aa?& zQf9K(>xXB=N7-u+?;WFir{~Eh-@e*yzN407V`gdQeR9P1-Nmk?C+qHID|z8y$3K#B zNRk-yxnD%zef~Y-m8Nf>+Vs-B?q-I`tYhe86w2Rxpxe%Fxd&*^W-f69nnE@5Tw`&f zR^zf-sN@0im|P9^{| zlt3f$Gly~08K>BRUR=EjH})K-LD$u~cqg)j`8}q_vj$J3LRTJ4u|Pr;HPt(L>R|}1 zGtS1>Vv|OC-SEbb#-rYseX*;#$mhJ=U%W4zItQ9GMqbL=+hb)&zWtSrS*7qC1wpZz zZS26J!rR^0rs%Uxb$7Tk-yzc?65k=xCx#t(8(z{rX}8tW-;7wG@xE-RpU%kbu#TEO zhM4%v5kk><_ET&2Q_QmHqswnNZ}plT+1&u&8ZeKFZ zSfBM@{CDnynLucD_lC&)>fJ|*^Fv}c&VJXJ9SLoFs&6${`mEfEX!^77c7M>UFqG|_ z$ILIy)#j-?YnuHPRmx$dU@DWBl<>_Rdbq}8q-hB6<6*lz8t(_-|P*4T(p zj*QQJrlZcpv~G^&8K!}+ZF!u@gYhDlPiv{~M7`;Y$4&Jig#!JxuJ$t?@i^J?mIxn$ANT@QA}Vr zaOQ9Q$hse|=Gjw}nCf(kb1fSMd3bZpKj%GMhI%*ct!JAguJL^P;gCI44UTi9ZXC~a zAEm$ctNf~4lN+&%bDDUANUnyvR1DE)n?w(_};n;u3Df9ITqNeBEtek&;L z9i=ORuEpFwEzMOw8WTKzF3Gv^E`N;uVA#`EBWJIPD&+fF zn#0pHx+W(W52%WU<483DTC%5<`oyOu4DlY~sV zU#zKm81EuC>Y(+OtM7HIhO7YYZO&ic2+44>l8<|`Q)4gQbcW*;@-c<9`9nNPAI4@VNGiE%b zlXQo@L_V3{j!~WNsveP^?{H^dRg+E@?V}<&L=~O@3@E$wf9^GUL4%{9k%XtY(@`Y4 zSsk~>7hSK%i_5azTV3G%fA0xSNV|e3UW8@VNW`miQDK(0K74$eaEJxbv=>v`l5cSb z(nucT;aO9*B>Z+Tn!hW0kHPD&Mqd6qCl;eCa>_3CtqCu)rl*GcQu*WZ?58&(G#5>v zULcCaEgfHkls!Eiq+RcI)->788AbYjb1XO0?frtDpHAV>IVIz?Uw2ljO$rk^X-NnH zR$F_0q^;$b)wNd``(&y&vveV@C|1>mo7G^yh*KsjnYV`7yV;zBCY6264&h^82{l-DgIC;Axc; zky6k{V?B4Wk*l6}^HBWlbBxD}dzHH1;!%b;6o;?0y$CAM+u)GBO=Y9SN-(||F!{Fw z=LHk>I(<=k6*w0RKffUO?)do`wJGXfkxa^iR58!DQQ12Hw)-32iL?Q+i6y6T?q_6o z20)JRi(VP>jQGiZXi^Ve`DYAg!C-X3n=KJ!;nCZKFj5y!w{yi=A?NIVTID8Pe13MlOJMM~{Jbeo`Frj?UL=)%%+n z9?(;LXh4<*=J~;QY6;QX!wl+^e;=Wbj)BEjh0>ai+IrO%ZQB-Q>}@ck+&PxJ@mJ9W zc`C&Euxk7LcZ1VeZnsD~KSvm5D383K;R#Df z_;x#?CM@UsM{97xw9s-4=j6;w;g@8C8B*_naZfx`yDfQbe7#y-j@Vk4jZBnN zQ~8*XMJVUFwZ|PPD5kQ{y^=dstQURH!}VYp;q^o~mJ4dARmVp3a*`5zLQ93cMEfY&zA+{q&7qL2b$6oNk9;9{K2}oZ*nm>v4nx*XlL@l`?srU*a&<;|ITRS2i^9&htR}Z+AgT zc{M<&e==`a#L{@T>i5-E<`MyXIr`>l2JY#%;x?8tCOL7{yc z?khnlc43;eW}JnpyH2Z(c%fw%Bd*7mU>f9w+P`5GqN~>Q)|K)p&ULxE_Bi<- z50ED==9``VVmn$!f+mo`ogxe!dt*DJ4n{@`8@qBcdAYcR}J^#sBIGCR!Hs+VD z{-GPd+VAd}5p;Fi#9iC;vpaS`<5-1*Wk)SQ=S=r8dbqU5?X9G34YEbEh4v$;AK#!o zVpyhhmc_{vZI~~aXZ{GOtEncStqyZaK^09h>*vom)qeS%q3VO#FTQSjN`|*{L0cKD zg;!9f>)jCj3^6c@S8AQpc#gN!#kn=r6ABpf7StU6-`BSc<~Gx!okF#Qk;3s0*Ocmp zo%Ff0GF)V6Wbl^c)VPnn$c^F6aOdn_DSg+2S6sDUe4x5D9mk}z*=JD-+{OWlEfZc6^>pl1xp4b6_S z7H=J@-u6bBrsR4qnw9trlYjdH9BjV~^|82M)#O^nf(tBiFHo`tLl9*_w@e#Hc2SmX zYrHe9>9sE3we~o*$OZ42-Qf;iGKie`T}pb`YY3xfGHec9%()3n*eaWMB-_L1n=U1R zOXhbJ{f$)psV93H4$aXDLp2zsQPuqFcjms;_gcIGh`MG&jQ46x&PU~Vbo}vu0oIX(36KF;YEpvE(fxrAp6w zr!Tv*CMIx@D#OIKhI8Y~F*kjb#Ip^MDCbdv9N~_c6QpLq_@s zPT|ikZT#3Ia;9Olz);B@faSNY4Q6npBfOSa-ga}P-N=RCTApS{#6GEe89uwv-;$`q+YbxiaTfE>T>P4!J(8F1O}~Ik86ES!XlvXZ zqxaQ;@gH`~oqf+C{m}X)DbD_O$<6aY-|fDq;4ZwPSL2j167=4ybcZo1zp1!V7{B8D zyjs!rcVp_nYjWsTz5WBnbM5zC|1^a@>Tuln{hwi z^r0|$H+x-daWPXjtG^g|bJt${Z*A%BL;=wKJsaVnH#MU)XGNQ^vhc@ zrXern(`Rg*+@Epat+;e!mE~`szT4qDF_I0mNhdB zWU+@lb+NEY<6BoS5(v$269B-yU$?+WCK*j9-{0_=T-dgs?T)aay3#ABQCL5I*I_oF zHy$Fa?62^l+uu%YrAV*g-zvFCB_;7NzV*k4UqU%o!VrwenbOvv0>95e1Fbr-Hn-)| zcmWc$d@<+rBar&*C$n9^g000IH_cv8XWwdW$$9uydGmY3Y$qnDZbnL!sqB#A`deX) z4l;`bn4(A37G2~WHbvp<^2W56!)Euq)^{sJ^EHM4bLr<$TI5o2dhhQ!X!q;&D7_@{ zHGaOm?!GsTE)Jq%dCgf0v7_r@yYypvvh9v=T|l>ZDHe{o^AUH$ggNYR!E24jYE5;l zmHmk?d4X<<4zbW?qttBEKD&jzFJUyecYRXj&D5xUH=Z#MG3F~Q>CPYNq>gBoZvK?_ zU7S_gWveTv7OHdT=#Ag!JH2Xk=$h*%3BAT#p$?cU5gqBojV@vwWTqvsP{U8(Pmaos z@_t>g)$QtbcKSrm;Z(6##EIlhn}n>a5b)OBhyg$xO}0~gqR|l?AiHwkt>+M%zE_`F9=+WSAIsdaUoON%J&aJ~}vpIL;Ni&31~u?4F8- zcnc=bPg)>$dElyh1hO+^2>5&+?Pdg+h&=pn|L`^2(!QDB1^%Mi^(!ddZo+S1 zecb~D0*CKl+qbXj;{EvXa=I-+T1u2i)@?}%026IQpyBpaN>w{vt>DWgR2!PJ5M^z= zQwc)l;Yy2sW#yQoN7aY(yxO&#`@KJQgmt|Z9!4X>weFek;f1`b*tn7CfU7VdBS%N4 zEJx(EwPXowe{t{Qs4!h+-4V&$Yi;yP>(>lFZf~H86YMo|A3cY#9gUENy2f%QatZO+_9D4UU!A z202;IH_p2-eNx3Yv~q9qv|;@oDK=XxZ_#<r4|Ot21J(RrdvPhpW*@rXMXFt&w&o z!|>wGA>j4w`!UFDBO{%MtV!a2cmp2WADV5ZyM=rRodgBmPgU-=8zkAvx|9z-?{9HA zjGxP0Q-Kl!|NiE0y|=P?jBbR);o~l=b-%!4qx?)3bs4&Fsn#L97$u*N%Y%m1>r1X7 zvv0&@A>7)2^L<;rF1XTFj|Zk9c>gXA&)J4b@MyJ`)Nt!laB3{4kXd;+@GG824Cr%IgYFFw5VK6q2c<}|~C{}1qHGKp{^|Zb+ub=r!*w`rv2q^^F=LwaZ;bN}3d4)j5SOssDZ$6H{>G8eQxkDdnnD~DzUOkZ5WZ;u$0y`Slmr~sn z{xBRkE2~J#4#@CY1~>E(~SdP-pzZCBb+ou)R++^iEue9Oz`% z5z8a?b3Ez^-@8@)bw$raleyaejlHK=iw5&bmdv=cOsRUYG>Mbf;Kw{Q>)Se4Ab}e^V~Of%$a>e7_b}bz{e0d}G#OIMxbIc!i$;x<3`7947@EIsw-bEk z1N%VPiLNNay|vD-AK#d5rspNEYeWVN%0Sj@vTJv~Z+{~{+#!y7LKF~#ty_ezjU2MO|CE!vIkds1g-IaIq)j{g)NXv7jW^RtT#`P*h*4e!(s!!-QcehbT&K{% zcm#gn{BwnqCk+x=+V1I*7hl0F3!IYYmFJcD(2K1cY5)O+1=(e-4d=PJi#D&jxn0A* zHmptwg40qidMo%G3zDtFmAu^ynfY71eomUxW$iVwm~^^}S$XyBF$9m+XeNl~ zOT{?;b{k-#Grcg{{S6hl=eimf3)EgnVeJw+Ykxcw9(7aQb;TT2TQrx+t?+#^RLvfx znt!rp-%#z>n@FzP zRW#^#{o&)%6SXHT0rLm6uMd+m^s-8*$}W!ILSp<927XFa%qKXr`Z^YcZOij&^q;pO!BwruPa!%iXb3{ie)QPmf1jbmV<$F9g5nW!uJb#_1{U zHeu@EDtccIpX*Hv9Uq@`oX)CYzG~qXHtP9!KME1>muTEv%&S5%dfTXJqYA*J5LA!L z*mUY_Oa#4DHOkNRcmW(EMNZsu zNiwmW>^5`rbIQ6q%1!fmow>?J{i)1q!NFc?hh)t4GZ^6T5_}w%{8d>Vx1rURH6?$w zZrlwX;Pz2XX1IgxmPvdUa6>brdu>A-N^lhvQ}?w4%g6Jltz3M*r3u2c(Y~|jz-{e zc}o!oBX~vwJIz)nZt_aIPuf&xQcRSIL=lMXDctd$H+Bxg&0$~{?WQanOtE6C^(%tG z_#abFA10Rfive$krY%3P_H(mof_zRrW{r07J)wQ^j!)qm8~3QNQI?rQ)A?m5dF%A< zlB+R>sEcd^Gso$oK1aqJ{46?D(%06rvR9MlYDhGL&8f{KAiYPIar}CSGsflI)eS5c zxCY=tv=5fi-dWc6+TSwJ6cVW^DzR=nou56A$iTGdPv7&mag<$-0ewTeJ8HGKIbX=am4QiOeW1I} z+!YYMbs_cUIlPWYap1Y+Mz9?CuAS+f{-8}Q_NneHcWL`kPjm5B^RT%Ai%%naUC6d!`|XL_yuZ7LFeG!v21$7 z-rc%Xi%ZyU`oi{|&F|=!LaAzSwv29^^FQ7&Kc{@Fl3>uc5t;G*Yd|EJ3g--y+=<{r zSXmGHtI)%$gj1UKPee8?&ERB}#I1%TN?K;;(cF@`p~=I|BY>VcAKv>hUmrjHtj}n9 zHs3a_a|1tKowQ=&2LdTK7O)(l5e}NNv%=!sTxPGw#s~a7vTj1<=Qc}h=x6S&P0hhi zR2@OFQ|TRN+~alCv(r!)@=qTp>)mqGxc$;kO5wBh{(W5B?V-HmaPacP=6y8$n~w17 zTu+O167z~YjZA{6qAR@>?R5vu7USryd&S(}QmR9}`L4M=PkA0#thanKWlh`W^}sv7 zN)5Ic9!5EiMJvpNFJ!Ikm26=(Hr2##h=FnyKiEA?VrgG1_m@Y1=`ljT_RI+g2 zC)k=I`z9yT_ULA;^Owh7l%;iw>5Gdov^W}DVI63_$uWwfbQ{&5rLn)bSEi$w;|jCQ z9UNp_J>0!@Q7E;qU2QwuZ}y2mH?cSSO)OTdH>(kT0W38W)QK-+F+r98dx3X zWG3sdVkEg}uh+udxNWy)d}?HP20L#oOIRWA@wMALZs|zm!`Ye_(<-_I+-RHq6i_Yj z=6+e(ssXd_tDe~lI&#HTXxw;kVp@&|x)bF>eSqw6J1Nu!^o1_bDP^}2e3wiJ+f2Q@ zdhESc%g4gIYdx>02xsHwut~iyX}gbTW#*wHYYZC|Y=fK=D%VbA5nF2Tp&QZL(|QIyU-jo$PHmU2)jq_M!MuTm%#) zlH;~LYWtDe7vzO?&%?!39gVt||93X;nSkX3FRG!*3~yMC zjS%XiCdOVnLm};lb!2SE9WqwTmuBDhAu&fr@6yi>`nu=fh(-0BFmYatR{c0V&JUsIJu|tK@_~C#pEKdGo8pn9krdMV zw9e&Yk}e(W81BY5sL?wupUrZKi0CyHKb>=9w_`=hj{a_(kUL4g&)jZuRTlGB>elBe ztF6)w8RY5<^y%#kigf^&=xr(V@hUcc$K@Wgo!Ms+tOw;!$Ne}Xx5p%eiNj1alzp=O zlF=6j8y0zv6t`9NFx$+-;n|guiF8K~=G^Pfs0ubT!ua+L3))rfcm?)!+2OI-JwrJe zTl(ziez^Ta=p`&h_Idx7wRO_Qoqi0OvwWqB5n&}uevfY;4DS^lDmwQ*Q5p{LSki%?Y4Jb!h5i&76p*ZD-+t%k?pO?L2alo+aJBj6O z5n7K~jNHr)>&argm|x$MVtO0mxWV;qrs~m~IOGf-SgTh5o~)fFgV%8UqJXP~ z9Wz#Yo~IJS(?4J8QNt2jc-)py?$0+Z&{ON}vdV^i$k+Y7+X$9{U47_URr^it`^csy zGnJ)0TR0Ro(4c#YdcXANDWU|8cTe6J8A|i@sM2uth?5|`ysmeA-O_uiJdK^3jY9($ z1l(hXQ1%tF1|Rl&lrNgb{#Na6EYMmqp^^g2B02T&HnqoRS*Xkwo9Yavh3nrT^tXc>7p~CH0j}f$KtU2sNS5!Sl1`GGD_(WtmSgPUOArg-KQL%TxfMws@5^Y z+Y<9m>weN6>qV5s>V7hO`CGWT4Qn8}MMxwEQbmHj7mhSji@Q5K*LDh1@^>Mb#c@m6 z7K^kw3w?dx9ee05`W=CVRfsjWxGJBJCwu$BY4JpI#r{mMrqZl01kZW_UFvs95JE}`* zGlmj&9d8?i`o^yN8G*=~ySjCG-I9X|q5PZ@pPbBEg)TurDNxw2+8HU$&DeIA!f41X z0?N%6@XzC?s?r=dJR?+mMsv;VeOS7J>{U=4COQ)3eNaRAQ$Tcb{dHJQyrOnEB%c(C zrIPzmbK*qWQnOoPc!q&LFH9B==4J0JV-mEG(u)4M$k z=FgoVky1-S#~Pn}uCsNS0t?MXOZ`zQ_I~Hguxe5m!>PYnMObXh4eO24xlkQ@&Q69M z|A2dh^F7S%5;RomXhp^RI{e31n?I71`#G)J$?^io`EtKcNlod_y9u2YGY-v}ONa|@ z8?6^pkaL6S>FqO!`Ugl*mnwk2`1AUDMSTy}v=MYaa>leXnQIq(=%^pttFm}DJgF3{ z!G3nd2%lN|kopM7!Y*J~7;3@#;)*XGZ=X9?x&~EISbYaAt!OlkRGZV8AOx1%aEs{q z`Q8riPw*m{B14*~p0sc0vRQ2*Y7g7dbbnr4PL0-wE2}8D!dt%qT^WlG^gxRk1jFO4 z|Fnhgikrt{5<;h1Y48 zs5ToD5PP`zO(GWzzx)v4rjMrrK#kQdo|beGYXrlV&hc z(H|;`%Bj96G3rY`Z?^{e8`~IT_LHY_8Ly8LDu&jTZf7|%&c9B1A-UsUgpnsH-HEw9 zE}bnAt)uZ04|87cZ2_3D8aORO?+#~G^JPEf*TkfEAI@-?0^<$wnrtI=z!fBu6Hk_K zGZ+rMOzDoxsE=yl`@j^w)Gxxb38JxwE}3{lvTxERjA1S&m>q) zGzLBMM7;hVyooO6W5&%dIo?0(b@yA(n#~<}PpW-(GYgM7W28R>8+i;Hds4MI+$n#` z0r{HzE6ICLK>~*F+!(&DKr|{9^n-Z`D#N5bJx7yMljP390lV-qeX+y9wrG;_mE8Pg zeKbz?Ms-G<7v|+>5sQPXHgZS2hVH&EjRVQ0bE!n1yY?isnOLXt4`Bv>oz?nwS|v} zb8JXo;EP|_PpY>$Oyxb|>-?FBGbzqykEsD7*T?g8b5-SXU5^Ia?`2Mo;u7b}M`Hsr z0*dBrMgyze$sc$Xi3PztN!s>8joxOfs*-mFT#f&IjtqN71xPqD!gD_k?~B+3i-hYwolI6_J!vrD$jj8a z=Zr<(>|}4d81S+i10-e2z)AOp+89XwI?j@KKIp6aWRghw-elgho=5#IDwg$H!vgK% z>+SC~ZH-%>Ek2#T*#r4%9LT8*6vWhJjSwSk2bb8MQx6XFDfH`ynvxs{`b8ewZu4p| zOfPTlKG6)%e-oLK|j@0Vhy`w#`ywMmT+k5$(w%9wyP5Xd9w{1H`hh)JonFsWPj)#7G^OYI#FfI3dXDdE*#uA zgkeL9-u89V&l;wSPE})`1QQooL)px!C-+QO|{AW z{;3JW8M;7ykV4>Vtf!Og>O808im@@=5z7o8TW6!Rbc06_1MYUV$MvXctoOxAs-8^N zyvY|U)vR$Nd*h+7t1@d{&*(!JzhVZ2#~h5X|M+e`+4i1Xq{F=9A~WBV)e9e5+x;OySUKS> zbnLxbtMz}O0{IU1Oy9b!Idk>f@+A%fu|q+)d?)2#82Ix(C#Tco+8ASPb824=hC!C( z1YM;OY0a~NgXOGlbWfIRuXS3eVfPmj1kNL2fX(4`{NXl6nmXs^zE@L zim(mcvlh?V(`EdpoDhTtkG0Nu-q;49EXhtLI4rtTC%a$vL=I|J;UweEEf4^g=F&eIQwHoaQhco#@n%}7G@omJlwa)d`D1Ck)73n$| zs`QpUamq6<$}(s!TJuF8Ulfhqhz>n!vLE)r?s<+WSI_drn{MJr+$$4g+TWAo7vy>H zJNTUaEWUY_ku}JclX5#j$arz~q4rWo$AfG;%&>Be5+e(pZ7j zTO^iTi;HO1ONLaqPX%xiGYa@UHj^((=@Y?R?P~p~Z}*^N6Eq7>@0;JX-|pmO8<19Y za?q}eV|cLiwUo;|Nq*moa*`jq{4y#g|9-!HEy!fSb@aC6Zi2;!JdFNoLv>KJ=(%GpRXTi_N7PM{OWhKuU1|&)p+T{L7;KI*Mi7M%2)A?J5| zND_pVzmzN<09M&fjd=6B77U^L#Xrmx74Vz`hh@#Xl4qUfZE$8<_Z;@;Cq^{VDeP_z znnMSqWv@PZ_(@#n%H)hTH;qxVcYDWuV~rQz*xefBqXEXP(Swl^gNi`H8x3KnGiA24 z8&5>W-Iwf^`7x4UO*CY|c6EB*eU(c-%E9EKG#J!Q7+C{L-PRA=UWw`;Zf_Y7p%cJ9 zb2l-h2;|Jc(;(f3;>g3<=k_t%wbN+pv;t;S&tb2LD503&=XA}!l1a!dPC#-?zRI_I z#^r7qGrsmf>|7FwSC-6|ScpedRU|=z>nC_{$^Ls-#)&uPR942?{$S)W;UVWWlsA`; zAv==TR5x&ZP+a?pQlz+JYg}|Ow=>4O4Dwdlk!w)PU<*h03~u*bgA}Ax<3~L0+RJtD z!pa;#tt5-pt%SyB1lv>!fTj|tIn-sVeJq_nDmxA_``c9wq6bE zJ~_s#$IG>{zSPCsS1MzUY854Q+=Tq=?QjZgtuM1-`BD4_C{pwNTxYx%Re$%xt6a_^ zet^vu{w{z@ZI1o-$hnMvIRkeF$2=a@{5**?lpH^=0|;LC5Vj0YxUcwYu_Pz9UHFZl zHVoe|IT|-v%mwq{>(#i#Kt(VF;9>J%`R*|FF4_2rSNQ6pi{aR;THo4J#B-iAzl{Uc zIqz#R(|Uh&T+}CgQYd$^MHvhZdW?8xmd^+Q@NTpHSr$36GYOC;f<6qj>yTJHt~a+W z*TR*7&UmdI^5rA&yiG2%a^OkO}7l0nwQfV62W_46>k*I#Q^phj7DLSP^DuA#W8Q)4P)O_;%=%Q%y zXLS(n#|xkK?J#vtI4$nisa6dSDgJ)h>vhf%qPnw9F)|jMa74{v@{6CW2pSG7Tk|^z zfw@>-6!jyId#*2Vo9xa8Co5%_!#y(JO-wzpEE+e-;}EMZ7ef>$PxM%H(0v!CZ)5W4 z+KiKWC21hEB|>qL%e!yX++5l96A2bO=r$I8y+}^4PMd*luWp<5J?I=)EvgOKp7ID8 zo;g)|<#g2^SGe6G9_2zkxJ?{2l=c$+#5cMPqQRDuoofD^3~_k5C!J%n%{6k{G8B{j z^riPeazn;B@702d)V9&E2j@w=MSZz!U6}P}OXb-XMoErmioxLK+6&sr(_j(~G_q)P z*PIW&T3wZ0dr%K1BxA=)2ek<(GGdg+z;Wi`GMNcZb>^y6n>y2FW z{SKacN(Wt+n1Ps|P*+C7qu}0nMn`q5G+_0n;h|TNiOE|4Kc>Km6T4(slE|iVO*44bp<_rCe~SQWWrEKw8gD=G)%f zK7MwI`Qv@$?#oCngKl=ZnFsa9+TTdZ1ow_w%dWGF#iN<-qNP9B8O^UAiOW-l7f_Vsgkk~a`+BIwXRa>t43mIo~8re$q4 zJ3x2k-M@?EKo;Hn*ksbbaZZ6M|03(qpi9vVclP|suZ0epM{A`sWE>H z#0mZ_VWj7I?L{p_o5Qr0$$PiM2{lbF&k)swX&7W@e`co}mAjRvuS)a|$=YUz;ISrq zQgfiZFdqr^*7bT`j9D0bn04=E(G5%7p94ExV+}AzjlF2hC&uD9Q>Q;7aSqBPaX+9lEF2sqFa+}}`qIV+ zm49>Lez*U|9P#a-MymxW*7VHyX8Ll#XI1|i^Ov97GPNB@3dA^FHWvwAS}M~(--D~e z4vgpSSW4a9$5bMzp7@?xLKeE*Q_R;$y7JyTB&YI${+=NU|I?Dpf#Da`rS;iQ%CIA4 z83iB6C!nt|p%%TovTrael-IT2Fa=*h&FwUzMkkWxa$@36bWLcEU4^L}U0r@lUXEy+ z)fJ9TH3I0NB@1@L18^`t`?Hx}#1VgRMJe`ax4v>>$lb?{4(RE-kQunFn7BY;tA-!# zeL%biULr$J8<-PO~#H&)D50ud&z+mzIS|D z9{aN>Z`GuB8pWPQkmMs2vC%04K5OP^q`Boz#{DN#R)IW#&9U6H+BkiER=z*pz{_uB zYw`GqJXAn)UD#@1siShH;fsifKEFHrXoAy>JBn~s8n}DG zc-9SNoqg0pemxy~)J-=buegBH{lB;4TpuVgCew0%QaY(-Nj>()cM|>9xYb|h4_@G$ zRqjO7u)p`LqVVVA>1F_HX@Wu@YR~$*`e5bJ-gaC4tSbhSe4e z(*&EAk3oU^W%?IV8LC{8sj6{1G)jL`diW4)zr8WJX)UdVuh%UaW8dmTCqS~sJ`2PS zTT-0d>l8CL#)gk`wAXLP}-%Z^Pz(d0mihqKt6tdD= zT|@*+C;);;#+r%{6fZBSg8c-tT!tgH&L^xuM}LJDk&kYR|NRSzsAvX!ZIE-+&?Dd*3kP zm0vt)xX)54ld!I=-@hHVi- z&HkP7xJl&MIuv5u_F<7U(7}G*u_jPcq&E0IE6L$}U5ZhgnEFk|yu=%6bjYAaw`mCG zjt5|Bum~c&uER5NzGLsOv>0-XA|&%9EdH$BUo*Q~wSRUUoVx4OcGit>cUO3`ggaR) z4B>y)&9}i0GyUg8>a}n%0c?DQ;+x0qxR{6e<502k&FU5N*ELMP?S1K4>KWcT0EzH< zyO*a8O}*9j`gGU3s}K-_QU2zGP+dW5sSwoLp?tqDND%zDCY%7?zU}n32*4bWJ`9aE z0?G zQI0m*)Sg(U&0YGDFRr2R#@iGBLzy6paGuQ5UgzR;oAUlYBzVF(|2Dr7TbZcn4>$&# zNQmY9JO|sQh&u1;9Dkb;h!L8NCgCL4Gr}x**XL*>k~Uzy}9%$uS_Tm>%p<{{S?_fG@8RFF$pWY z&$0Nmuf2M^iK~cn>qJV#rPx55qsxB#NX8WaU!yhTFgOuiZ|1m$g6g`*G?bPX47Q=`%rF^|& zf+X}UDSR47^%H!1m;-;upG=jj`F$CE102(>=>TA_dDGI~=o+Q(cTl!;C@p zFBgaH!c04V3D8Pj=$O$?>GRhQ0@@gEtXzUcA9#KMFKg4r*MUoW9+x+QJI{)UoA*9Q zD3sJ7D+TB}3(I9BJ9mvKezSAzahT{v;@xHIoe3JS&2!qt8@Q23zCr^+3$6mEEUxs2 zH9Lzmnh2tOP|UqYup(s7x?MDM5ID-14+kGa?+LdGNN&!Y^IH(i8!LMR)zV(m+ z3q?wONSZ?Q>@<4A(NAlZUvAB(y?JO!7!1hd5cp%Vf0OY7vVX;YI)SCJ|LNu0)t&Ua zyR5HGREj*#Vty%RZa+3o@f?XK+mSW#WHuBGfdW3IxIUq8gEPrdHnJOn^Gov9U6qx}o@9c}0mQ+=Iwb~h*p}8v*#pw&+uq6U4aeMVCaMomm`)no6 zXSrRYSRt-}8yt3+t!-F=S&s;W;5SM-EWumq86%%~8$iXI5x~{M3~tfclw?Cs&MwRghxd!FQU-PwVx)H+ZU%d?@*;p1|q@t0swfQtwIegBJc=xfZeNP9awwj>ESzzPHQl1yJRxMZ9*pn0S1DPQ>~7 z#V;o({(@zs-6qp zzVU|XKrQ96uc4kkF8j2`=mQO&F!4DOh@wIWo$P@^-hQ^;ow4<{WXjQeV{=(4Gz7+O zy80}P(S6JUao7n!oxt9;Hle zW+$$RgOUYl-|4j#ecW?9!sb}u7mW7`odN{{{MiFu#Gh%~^x07^)|c~ElyLQ%X)pad zS3M3vI%IUrLN5dWdbW{Q`S`qq0AfHSB}qi6U-to^;p2>s|0U=2eKz;i=Qar$<63g9 z@u)9NlZs?~kDaD-RODJ3JQ$^Kr$1t~HgOt-Lg>-|vG-nUj$+x?=+o@Wt`8>=mv|6z zfI#MEe>eehc!BivXDmf1J2JD{?C#3i=KNKWnIVJ_EHnKaV{$$P6;-(6w%Vu*SCN|x z%l%RpGuWNHyzohdDTRF9q4P=~%LCQxxIBJH7Ds+mP8GC6yjS<*!Z+dCZ`m!>O$!!iOc0qh9~&S4KcXS}|{u}ro)aw92=;=Yd+zCMM=14VG@9w6Wih^|A)Y+h22 z#$P3u0%30#t2A2opjg=Y0(t%gC zK(f!;6Y1dXnYpIw@*`)wf}?^O!gfo(nVi(ie!At&@-YRTKJEiq=Zj!)y_wlvXm><9 zsVvYfjK~q>bF9cFZcVYv!ho8ZuV^z8vVD1bS8?76-Ch?q9dSaRWFsLN1t0n@NQw@6 zi2$k%Slu`-)|`H;8=NAORT@pt$nVUKRB*O0=W}s6mlxx-h6zF?=|I6FDR1ZapiwCh zcIY@e!Rtd`_)@b2t+2q0UCh9FaX#eN`x;lDuf^l^snY@ra82?Rv>?DtWy!)iN9=BQ z??KgkYlJzw!`p?BMX=9#`7|MZOn{oC1veTcYhL^UP&HU9@^G6yV{3_o8@m3olMyk? z8?Xy~p_7nnYSk5%1tM;%{ZP;68HnD{rEmyV)hOmPDU5VLSa1!z_qUg|T3})Bd5)bc8mAIk1r6 z#O}m2(X{>{w2?XHdtfi&J0;@F=>wvLIx6pgI4mAp6D3nf?GtRqyrvJR=o;%`Bb%FQ zSB&5t0}lhF_oBK4Kt2`vDY8$iT$c^6u(M3AGL*eMd(%Bbmd`2Hh9R!kJ>94P>CRy9p-1 zQ+bEMFRLdWOm|&DU_Hsg`S=+))WSNY^H`(VNFSsAX0t~f>kcX}l)77Hp+I(Fd zYf`PA&wH*n3Zz+&>z9;iw}^Y`yS0t98F;b_-9@NGJJ)Q(?k~{Lz{MpA6anq+RWr}v z9|3u&BbXcYeRa28cR!jX8cVA+l?ljwbD08$1 zGEqxIf3Z@^kB;w^HHhY2!o1rH`fQJ6Db$%nCLX~dzlctH1u5ZWgXN#L@|8%5wq z519l`M_yuVrS)7@8v)^i2R2vy2}Rk6F3x3EwtA~rJtudCPc~=qk+3Nmttk?PIo{&n<2Q>Mrfy#i7x+YOtf-Z%>aWJ4j5z#Hq1B_BVPM^$FbN~^Qz()+PLXAMN zswk&mb|=M3W=cz2#)L;LyU7csO5{i-j8|TEVS;R2@v=#pN#4vhV5_4Ag26{Vh(8FK zcN+usHC8Mw(8~x^^%%MU3W?{pXhpFRVe)?rF|f+pw|h!JRq#%ca>4x&j=smVjTj%sX0Yb8*C7n;t%IZ zO|f$iJZe@p!9r$8R}5@vq+D)v&`j?~K7kFs2lcU*XX!OsBq&faSvYGEo&`Ae7Pa>E zeX_YKgNw(g>E#K9DC+jW9mQ}61yo;No__gEr=(k)3<(HP>PK~-kqxq5EF_exgb~yY zI42(d0E*ko;U;g7T$nIGMaD@>9o{arLMFC-Zoyy-nWIOW4T&v*u&}BXR4mEBj6khp zcQp#2<1K^^-e6<`m`$caETvx8n7c=-EhM0WD1mFvg4fqJ%1aQT0rw#8FAFmpd4N(H51d8T_DH+9A<-V2v$W<&y1X zxds0A0)46-m*>5Jhf6|-L(lw?Q_Pt_lr_rw1nlVb_%hZ(Ib(aCG&=2)pbm+%9C`+~ z=>Xt`Aie0)(6_q{saT(`o=`Ohks#*pNsppGXJhfPKRKqKBVl6g1Xy^1VliO=;M`aK zX$91r+riLm#kaAnWCztK2nxbv7s=v3(O!TOHMB4Tx|DxbXN7ZFqQuvCGPqnPFQhy; z15hy9qmKlgpZl#`TuN_3ilKEZgsRgKp{Y=g`z?itBCJ`Xyh!I*^aY6JtKY@)3#wGn~ zw>Tu_9#~P75*+;+^`#lgMV4!Hhs7(;oj-2H969RAp$d)D;!tde9RvZmGMrs?w{q8A zTBbu_H7nfbfjL~&3kGnjTlFMFjl0M*U^P4Wo0w=$RI=SQ`OKd?BuwGF1P6ps?#`=Q zN>~UM%bydb&vc1MS2P+Pwp&;lvkT&gB$v~m0Dp{t(!JA~1>g;E5^}~YO6fqvK3m>a zzS)Bu34AH9db!3%hZK75C@nzLN9nT__#Huu`IIGgDI}{>&XxQaqnP?O<2R@xl#$5k zuB6J*7=d`Q%&lCDPozWyH}5$m@Di7>4E}c05;o3nF z&sP?Qa12>ZN39c&5p^D_f&~r@2{+*Uh)MDoUuax~9&!)0ha{raov~lZ8KCQF5#wB% zvOT29fg^Rdh(QsYhnURq9w^!{M7!%DF;Sr|5*lCT#eM>xguu8tk8`l8w1KIC+YPO` zjqQ2>N$s7KGwTx)8DkQUR;FGysuJ3n+9{magEk|{FdJ3fwCJvp{n&u5HF%Nc5{YDL zv}M?hwshQ#MH1yopF^OXm$v+{uI1H7b$$`8U-^gllGLy*zv5@2yYPiT8RBk8GwQG@~Z`=(=h0;adOE{mbUv>yRVH(5a;=s?QG z-}rP#kbU=Fs-UJ227 z^%aawOv=|b7>TqQGEF_3o)92BfgSiV+e2KM&m38%g)&=)n%;G=xOloF;Y!c96ppC~ z))@mJLO`l{*Xd+93Dpu5;+_J>1G*j<8|?`GTa>|1YUN>@K*E1EE@!igl3#n2A)B zpfnN5*RAG;hJCa245;8E(SG`5ZZ1|=xOClqzd{Ps^q>hIlFB9~jjkMs+1;~2nlio< z=IE6eJPvz_vb00X$BK7(7Nmw}<6BGcO@|$QN5PPL_CS!7O^#FP`k-oSdL?0g5(Iv;Su5pO)lQLIt@oxmv8*SFh^A!69tk(IP$uuK|SB?l0{S z7V7Yd&nlz<-*Gmee@fSSK|TqpEgQ{^1Y1f;6#Eek!+P#WHssTBP7zCCBQePb1n`Jh zIiy0=w-AF2py+y9%}W7BDlU}XkL~H^b4PfIdvzzfJ0!8&0LgX?w;C6V% zP=%^#c*HSv(<2tVQ<{4m6B^D}E}D^nEmpuBLaPD4aOH*(2D;$#YdL-NT?VnNHz zb0&pGhJb`;VmWQ;)doN=25pI6Zg7miUMURDx#iBZ#;Mn%%mLr? z037uF1T}dTYRJMt-%DC`e4t9EbeHhI17neINYw*A(SdNoU0eySsCGR)hOM2WlbnP! zT_Ue@^e%qHrAJs)5rF}hA0$ztdg+Qq3UyQ0Gwym`n+PC4#tL(rMce=x4aAD~;M0iP z0Wo9s*2586gXZL!fG|wjQ^tj#U-;;*i;(4x_4xnS;Ff*#f=V+P!-?h4*VCTeGS|fmfGE^j&&zYsoMH)D;NcWUnh`Arawv4)0^7wEd7_Dd2LzxphwO9$x2WmTH ztX(sIF`DmX%HF!1Os#GdG2>A5=^nyqb~=)MCNC7Vgm;h?^u9&Q1<6vE1h)5il$i+h zVAuUQ*iqT)$gCa0&X!H?XJmeA9tJSU5wzQouoDfvZWVknUv)&lfD*6Pb}~Z4&`GHe zycxPva2!Js_aqXuW4hZx^Bai)@g8BTbOD}-Xpn~%(z`cZj=S|88M*}_+s>;idcX(5 zwc|$jT}5*oYTR%&f~epDE)_-PlY2FT!^UxI3#Kl-^)<#AH>$T`FV_zrnC z-u64NNA3v1V~=k%O_nRyxA|Ey&U6;dQ8smNvU+=&9Su0{wkXz9sml*@u$Rh55a2w; zvl9}*Pk8U`n;wBKL|Q9@laPZf4UE*q30ON@2(%Nc-j^)!N~GjGv2Et2`O?Um<7XX6 zyIX~O5NU7xtufvOVN!R9lQ>8v=fefK4@4cT?6N;k0eQhK;FIW527aoz*W+pB7Ul&` zu{aS$f;;gs0SNOy0Kth5=GH4!kNR-*7p{$G)Pi_~46{9qTQ2ND7>fosHd4WyOg7pf zft1#dP`2`zqA}DvjG1#o_-L*`mL~;BQC=md*pgIwBn@3CdstazIZ-wfnc3jOuUnAq zwLxMqN}Q~-;Ito5q%cDvH~7gv-lrIJY&d>lI5V*RJ&2_S~dsH0cYYLpeOV0y-^V3Xs~H zo2Z%hyXWFHk|Y3gYQ;4Q;GcJ5SMB*FOd7#%juUrHPYWL_55;Z3fQAdOMe2O<7>J!I zocsv2)IKWF@4Ks3b7i!r95a|Wly*dP1rP#gsc<=Gystu8i_P^DyqmOuBv88E;-0o} z7dBuQ#eV{;8@|ZzysmLX)MbHt?UW)ParI~C1CY&u)G;rxAm|lGY%K}84Hdy!uRi8r z$EI8sS)lz@>`nlA;h%6AG?qU;FSexs3;l73@52s$RvuFB0NyrKg`xf$IgI@a?Ggt)IDg!sO+Y9Ki;5HQrG2!oknORIqly#ki zYw&!O)U5NIX@WMEhEJOv+9^GkU|zB4PUw~=72SGRH*w}7>x3`3EUpswJObzB)Mx0V zfScNoJG-JQmYMe09-ejP@0-b)$qLpYed`Ut@O1H>CZu4zJ7KP-TJRH+fi3#Id90yH4D+AP>`W$(W-_jl3W~A*pm1*@d*LkY`A5;t)KSy=c{{bSz(i* zTE0f)__z{CE`;LEHRuN?OF%Ki{o>Mj9yD z7KyHiHgHHPaF(Rt{k%u@s~ZJpRS!Qzo)|^m2vE%qfRP4Dv_z_bzyrV?fS?ENrV?^{ z+gRy(LMqKvV#1uQ*mMrL8jYE>(&x$ym3Slsj2}~8cp7N9k!!w9(Dbwy7h0&&!%;aQ zen?}NgBMFlp-}|%A{bp9}r}l)u~(8SQCq$tWC3=HK<~_kmtLrGRtG@ zZ#Yq0}h?;MLel{W4sC#9*C3c>i-BhwRYSbLG+1&=-B8pFsDM6|}qs3Uu2l(qk*D=(#Lxz3jTh5@{Y=w zSdiM~ra}~F5~5nbe%MHE_@UP~XKp_SHZADmB6%;Yv-wru)X9m|)t_q=;_Yg*>;rk9 zJ1>~n>_`=)D8d5Utagz)I?pGUbEGkVLO8-C)fEZx&8Z6`YC19X$5bYGx#(BNPN#j) zs7MR6@>BJ;4?q}MByzc&6W`9A7E_V%*j!QEE+X$m=V*G~^(65Gzjl3#NIyq~xWR%} zLp9G;piL_9;CE|co8qhP3cxLocbGJCb08}SKP<}-%m5*05KBQ(c$KT>6ub1mklwM} z0kpPDd6PxJ0Cb^4U1qWiw=1^0F|K#BLL&Vi_W_`faz0z;+Kz z#$TXcUD(Vto$06Zlw0Zg;`ZbcxC=et2F>IF<87%p+=PDA)(W-GD2vATK~B$$$2x&E z3m>jPMI*?Ji~-GYuCQDuz8FdmPdX2$mSlSlXewQqgoQxQC-%@7=wS%x5ap&F*&R#w zbYFW%S~!nDpl91^tv+MPu(ih_DtRNz+CWN4-(bVI7d6^2kEP^-Ry$-a4Sb+G>ohXA zM4Q8UCoIy{^lE?(f4BIKKF?~+*Z zX+NU)nTo-CO4J!5Wa|@HX4TW~yv<_7J}ZrY>u+zik`Er$XL4XM)u?bq<`)? zpFdHU@K~XH&qBit-fRhu{i529m->-G(v-dm7~zG-NjVb}{)?p|rP6xh*_sTz2)KR8 zeM>ic8D(+VbSPsF?C6h;8~Z4$&*vix?-v{bf|BgHg}D#1HlGFCOT(L}=OwX>?abS# zR0ZKmrpiS@DB+79TQ!&6NsZoXqnqXkl>sSd1amf=@+siN^qtn;b7jGPVkw~}&H%gX z3J3-AR+RQ6@cF!GnqJVMI7bgA1dlt(V&uv|ER8slQ{)ASX&zc6VGWWv+QycpA*kgA zSY2q%%lpmcIY9^206ft<2`Ok25gwikE37ARQqb9h?pM@P6-B)ikiab#Z4=qDN+;PgQF;rx?7TZCB!SZ}BF7LtDxgK!H%<`G?`^HX{Hl;e!Fp4t4>rcjHR zk`fX{25E)j&HOtPH_IbEO9)BbiJPqR4<$yP@Y1c$>T=YS@iBt9ty_uU@_XQ05xc$% z8So!f(Zfsftmg@FN=Y^ly`88n2TcPr>3Tv!TgW{~m}uSQviiAamy|dXFkYg~j@=Sr zu?*1Xl0b3|y@$GbQS#hia*q|Zg>eKHGY&mc0t0|6oWZyySj?HU&Us=>;|O82w0%;G zF?W=s;f-&Yo39no^M9s4CkPYq25=w%-<&na{h&R~fiU4fQG zLIo5!BBeDkM4p2vAf8{`eU#0;D$`$)g=Z$>Vt60KBpWc^?H8UcRTIF#ueMId zUo39kbOHUOizTdq&n2@1zYwtNJam8}zK)vX20huvM2)08zMhv9=}`6!f=x3cp%veq z(M68NZw~!bolT$hv#QlX+M61Zr4QFx%8SEZdu2Hku#(J5#JO@3`GvzttjML0N}Wl> zbhCr6PUz*~u>^i@?Bt!RfrUsf6cbhBhF%jcOPWzBPFe!*3Q`(`$8mZm6-1~$zemS$ zj0Uy!Zpe{X(D`b3EgJw;5H%3rEYKDW1BxsR^upvjwb;0jU!fK@#(Y>$<*P=4CV~M| zGJsj|pXZ~?%bqBE%lZ#i{SOwa67Dorg$-aI$q|OZk|T%iY15_SmqV=fAFOg6jkLU` zT?5HOeZDIS*Z|}skB_rO7+d7!0EV{w;}D@8Cx<}Ao8_P1!_&VJ02y)^$dj+H&c0n6 zNA>@BeItIkj!JsDe7yYpouP{4<1?43Zto}hdSwDP{4ezFa=dK*GX1=Tdw7Aqd|mre z+e9VDI8`P?R{#SAxzyJi*CI*C*8sbv=u)o=WAdFt6IM9ZAV-p<Ygd>r^P zAK#D5?~U9~Q-wIjYr&DR`<;3EZfw7w-2Y%$ijp;*`C~?%=RODcbIjS_*%B}-Kc4yP zh`-PK<462+5&WMW@yX{}{Ty-TJ(6FRI9C3jIO6PEj{a2y{j|mbh($z(c8BC3BJd@3 zz^_&gKZ*k)8-7~vKggl4OaAMEzJyVFS%bT#E6U%MQ}Z8Ah{~=julU9v1sRc>DA4FT z2vZ2g+bxZWFef+nlMrn4up(maI%W`b`EMmGoH+dr0L}QP{jD8}E{1maBZM6Pp4e}b z&;7=HF8D9=Kbig}GSi7bb02@hH6lXj>;C&?5|8=RbYJ%0B@K_%=OXzc_x@+-p^u^Y zw^R>5!7O|kZrJ=^)DTPm?i_K-;S9P*D2YTi$*B(4R7M(@($P%YOQ4s{Tu6-d7FxX^+44&Luq( z^Zh#;@8iq^X-1RVK9fv#k1GH@0tW`&Qe(BWb?b zao;Ui_Lq(7r;_?^#qt-jvf3&{ZO0b{z}J0A-gvntf5F?tt3$Asx|Pi}L=fS90)ETL ziCBo;hYiMjToSJB$5lVx|2y+X48wom0=+lFH!t*$Sp7fF(A&`Zvh?4E_IDHXtLA6= z2hI;MJ%5~{F1>|_gJ2F*B-tB8$N!hi)KvH!^7mePzy9xd(oz6lqJKVv&z7Xr&76hKfGe_R{) z5RMFP@EYF23^AI&E{%_?y*KeMSTWyewU5Zf_Diher>&10O$zvwZwC?Hppb@qO2+c5 z4#n{#OsB^f$A1cl@bNT_j<3-t=HS1jMyI5?@QYE&yamgbo&(NEc*ZaP{gigy!+R}aHSD_*1Ng;p$D}lm9r2le zoAM;u^g6JA9biQw=3fU?5?Up*_3?^q>Tj>sX;Z*0A(6(bh@3X z$E!We+LsBB-~VdClNV%MhynkTlXaxX|9I!)34X^K`iE9JO@9VO{$T6-ClLu)qK~`$ zoaM>eVSCHkzab+3Fah`urheJt{tY3u3-QLOdH8@&^jZjChwYRkP1*N6e-+#e_c{6R$^PRc zH~qPNzf9{-`}u$AXtPK;f6F%`|MK1b`MpE}`+HR(zb=dLO?LcYWB-mtedc3+4p#lV zL;t9?O;g{?r}r}cvb4o_Vb0g3&ApA6U$C@4?Xf>>cz@mKF+Ysnw{YB-;hVlwVPA)j z{e{E#xncg^@cmMo4(%NHAL{vkWDO0;P_!KaYNV{^cPxlMY-2IhZ{TzL>wljH$EOZ? z2VuS}l*#8AU)Raxv*_;^?6N<)obcD}vdP;4dh6e}3jZ>A9I06*_UzZuW5iGI?-vZ; z&wk~{_kXdc-<4p0vsCO$jQf4A^jZG;Q8o5f4BzsT-`m2!Q(pVEhV92{vhdkA>2LR< z>H6^UpVu(XQIYna$20_|B%;gm?@5JUIIC~t=sm0NS^hGs@6_qnN&PWc@dw&eKi8Z6 zG^ZJis_Ne!6p}@I6#|CQyOjE+hCf5}-y-baqVyoQe;2B}hwH6+z6{szMi1V`>o3>? z|3viQuQupEk&gdr@qb;&?``mDAN|wA|DMl(+S30E{cV{4`-b&BVc#k6j|6Fi1nR3S z0?Vfhv3ncn*e^-dZ}0!KZhwww{Xe^Q^5S!EkTT=f8YfFt4sgWswZ>x&o!hl?|{%-zWk1oW!?o;-wo!kQ?l<{`fexu z5VZOqI-26AfBrd|D3AD9`(MNg^A0?JH=6H&^)FbPpZ4Y78%>xD|6(Ei|14u43DhWT zQ8G`GXXLm41RDmiaeh!S3?%>*;FmfAEXDoyL*$<&AjD)He_0LOr$PC3F}yp#{`j@< zuDkqVt^QY|zj1jjPy_P{-u??k9p9}q6kq(^a*XeF)yp&>juqw&u3Xc-KU-Gdf&M)9 zcZ)gxzLWQ>W5VBJC!fNB`_ZKRXY+5o@V%7b_#fQGzY$#i+xfRo1N1Xv_pTB77PS81 zhQ9@f|IzuM_w`F_O6d1s{I6fr|Fo6#sZ)OSdY$~>sr?)4^;5{bwIX3|CUWpC;Qp}n z`hC#&eZzlyy?%fGJ39Ak*XvvTf2WT>?EIv-zb*a0V0elu1eC?M8p$v3zK?!6L_Tl@ zRejnJ-A4wu0%y#>`r+iOd-3I4-dFr`h*OT7YiW>a(@}1sC{^56$>)+b?Z=FvT?iX3}?|WFE?(Lu9U;UTe z1NL3A_ujhiK9w&f%(v9qR~zPAg5kZ#|G0R~yKwEh4fMmT{5QpGm>=x_Z!H;LhwJTz zejTp&v0pG+|D}NMpC7IHHk<$0W&Lj)#Gk{yZwW_2GEGTjQFRFcd+<_hf2e%;Gb1qn z;%xls@s@Xp?`yo}Cms5h;NR3vRVMBGAk@IO<6n+_r+a=7D*wkt{q$2(yhT0#x#+)a zJMMRKRliVl{S$%a|1LrQe(KM``j!#?GFX3dSpJduTiuA20{Ox&Hu@Q{&$cl z;!97gY6$qZnD{0)&c*F(Z_~Hq|J#+ozcy2Uwh~|=o{5D1dkg-Z3oWkbLqm+{ZDjw= z-0b^=?-R1Gk4tU!1;gY0;#iCXgh>AU2KD8AvC_v&K;hm1DXkQNymAN12E-vjmLj~J znxEk}@<*~HMFKs81X^5o9Pvw}vz5O!U2ngOv)G*757$e3@MJ38$-vwWxNy6dB=Z!~ zhwhN%Tfx}xj>~a|02URUSAxa- zl8U0YP6&h`duyNTo)wxt>szq^lA?Zp-Iz?<)^phm_s8<7^T$;1CW0YoM<9*koa5yY z;2*IhD8}I0Fn76F5Zgg6$@8#R!91T289D$332QIUO z-DSy6g5Aw<+jGpy0&|Ju3BNbjXm&j>x zZ0;uyaE->_*=08a0|a!+5@T z9(g?Ty4uM}+nM|78N}OgDuXI{y*WP(Fc4(za0g<4Iv1z@gu9$(8|HXjpB>!C!;Wp3Bq zZg+&h*8{nkffAEyueY1opm9_@qzt$O_{SuA&eWPoPBgpHU$l0$ahCKJF`w&0bAWOBtahiV@lRI2M~Jv zBa%oENJuBIFDn%f(@dV(^uj{USiG%CbB7*!|&TPW8z+OYRk4+zj*#3&eG zecp%T%EX>&FU)ZFBG7Uco7D9?b(7XBVoR%0l(o7H+H9IjnrO~;ms^>GC-!fdkvdC8)j9SP89AgSHD z%mDqIGZMDCJW;T^mro*ljMeH0lupK8953yKwX)I51Lfi#dFIyb_M2R|`$xG^n{n3& zr**Jj?4>M-053doL|(JV290QL$rQf54%lU_0UMgXuZD1xj_1PMg3A0kzZdJPqsPy) z2LgsOfe4kK;&$pAjAK2c+7+3taz7t8i&TCt!}Z){nCYQ)%=M!rV|ok0>B~!eC$RL@ z(;cF|)vmP_{k(Zr& z>NkeS?=qcK4KAVFtm+iJ zKA>yLCZe3=(;?d@qTOu8t1TwYWLwAiQ{~z6kq5 zcx)z{LpT#bFPwR{Pf={wPb}Xy?f~sQ=1M2-JKoyTg6l?6CI_OQ=_$cn=xbKvxzuDe6lr*rAD5W+ma+(30<^`LCzHYzS35I|GZ5x44z}xo=fTGhbwCIhvzgOVFmeP7SFa z=8rO4)siW->)pWh>+&SCGpSHUmj<^2kV>D8mmChVx|gkaV}j;sS~QAMTjtnPC2RB6 zP6~K8<{M+eXBR(WPT|6*DKoLo2RQ;=!fI7>RN zmTP+AD6YmDt9F&~?fzu1*h^{z0xwsdS{NrjulJIfsT9n$_;RRpuGmJYrM5x9DY9Nt z&ZAEQd+mGbtp;DG;P-ogPU{<=sg0ez*d7#7KN|7XtTp@CCv(duwiBexSTXr}R*uYS z0(AI68LoS)tmEfSWh*z5pSr6OP~kh+s+m(Z^O&ntjk2@WAao8|srk?IVRG)JqH_l= z7QEV@tARF6X5F&c>d~+QX(eqR+(+tErsi!tRyn@7zH!}ZZISSmJWikvWXX3Y=ePvg zcd$`Z+}(AN9xOh#s9La!i5m~ilyBu$hQ5$r;zFq-lYE}atV2psdb>cLf zoH*+?*465{b{L$cHTwih%`c=yG!qp^CdNp)OP%F48e3u1ZYt$Kt%{EVaQ`IXt zugW)i+@D~L9@MzjbS~RIw{uI%TANsXt8P)&?#*lyzn3P{cy{3lzBUu(F-0)OXXWM0 zQUk;&7?&qYwYhkz3n2@R%w!Q7V#TL^eN(-}(( znPV2pohekrx{H>(`6OQ41Xs8L1R9vu6A|e9AU-^b3Md2(`Q(hdrv$>pU8h)-R34p- zyYk)CX|nDX=PF1?B@dsxIz4UQ6gmo~vAoI-*)>@O@acMbRNhb$N7Y;y z<1`6V za7|hPD_rAdG8_5)A)X1tu+z3sWa4t471U#DMvG}kpyb7IJkg*tdltrWa#s(|V58yx zKB^2@R>Wkzd3se@1!ckb%w@68FSG0+C4D)2o~jI7XZFl^&M91|?zzc5_v@iKNt>Iq zs7`8A&=8WDf12JB|DXm=q_AYH^E%qt36x^jyPZ2mN}9~z<}4pFE+o4qxN-ThNw_w0 zBbZlHdPdZlb-GuhW0)KNJoj>tRW*AE1vxp$Zg~i^yQ0?{Guq#Wbfb#5oDR40^)T}< zomQ_^fe`tfABpT#wlvccYL%*u&-vhKt}e0X*;#)yt7oe%iBI9`7hQ{u<9(y5;?kOd z&SJ3>CF`*1Tkw&Y=WKINv`mr3Ga)L$c3EBWd|YvIJnp;J zFeMiBaz(2xj-?v5SNj6u589Dg$_|@2iqxn6aE0FC4;x!r_ClpbJMU)Eslghz!+q8~ z<3s0I3+9rT53Wgr2;J-gy)UeN4H zLzVSnxckKt_;JE&ri|$=76x%rdVN5Ijvi9^nfMPtWWSW518ys;a^Sqm#<@$xPS)=3 ze093iyL}w;(|W(qQk|LVZ6i(6DwnU>nmGiz`jDoxy^v)4(_*9W$3-?{9=Hf-JqB|X zgH{VTyj~lFKZTwxb^m;Fn37wx?%v4glT&F9wvIlJRHaU|L)e0w&x)xjjDyn7mfp!? z);IWp@@WwZt&y{~a5#Z{_qK47z?1kWoGg=3^0eB0-UfZ4bN2eUslYI{<1cY>m_KHR z#I??yJokvpxVzO;2p;@)KVG|ZzGsukdB@e}ZFJ<5`V^zRr9RBs4$cxk2;9Vwlu;GW zR%t|F+P!<*V;l4On4g-7b;o6D&detBD48Xp91ZK#cIMsQ9PgSbEcHooG`Qvc=$LM{ zJT;QKwDp*0tj$?p&cFm=q^G%B2a>}ZPVOu0B8#5#$#dNf_bP|pYRbn+-^^#bnVj)B zbf7|!F=wZPPF=mZq(vJ<6biAEZho3AkEv>{H)^pq+(4er6W420$+OFCFv>(OPp4Z& ze0IlL@T>UQ2aRao{d!YukD@bgTRz(}*UoLdS{3?zJ*u8nGj=%DJuQ3kbv@_+o#R~*=ADsdu2b#s6K`&(*JsDvWRf{CJ@>ZWPA-9=9G!Tv z)q>UeT%U$fj{IRY7mg!eu0Zjss255r1|vZzHB3u99eF^d&#_r0l|o2VH;ENVB<;!^ z7rt=~;ubWTf;Z*PX5m9}7|QIf-e_K?zvB+u=4za- zr=*_;d-IXa-Mb-pO2Nf$**e~;43uP%A1CuLF3m=Zr1N--eYL5M3bWLUV(aZ6!}FM( ztjlRW8^W~#o@2Gi+L?7+`rFoU3*~G#&%7XEF`qqN4>qr!;v$K+UihG{*5g1K8`9NOZV%n=c8NS1Jf&sP-Y}|apCi(6Dhdy=`ePMUr*(Y1N=I9mPASErg^nRkV7ga`E|?O1yqu~tjk!K} zsP1yvx3t5VPQY1bczq#z5!|^qaH7QLO_VF6B|pl$xD6?pdh~@pxeTJyJPI-2wR^GJ z7DBq$$F?0T&oZhdueyVEJF|&2<|xqvl~`VR=c|@Z_P56gWgyIX@TV8@)YAgAT)3UF zhr@RwTVdYoNiVqSG_+oKJFvaBIvCSy^>j9EvrxKXwk?BoA@*H8KhSy{B|^N$MdUEk zmz=eKaPouCHrke#5^28ZCbzYa&-TaIKZWx^wrx?_>}+D}ocG3>(yCk3iCq!J*38Jj zLT0t~nqEY%TTYQ3!F91ga8s++xVWMV;i~qC+d1BBGgpFg z%r|XzxS*fBSj-}N8nyMM*Oto43gY{EZBMueb($x!U*8dQ*7JikNV=g&O<8i6O?V1L zao%5}LFd_4zOBTfX zk_x~G>&8jc2DkJi&Yd(U6MCPXD5pR`QO+;)WsWdIK5*S&M4EN8s56vbM?nj8LDcVv z`!h4ClE0?z4yoTj5iVqZstxs^ZZTIxRpG7k66Vc+$RyTXAGv|hieA<%Yb^(JfqU$s0#_to+?V%L(L#)MhVsaTpnV|7;f11@)YOeD-+I9(C6+d&I^wZWZ2>qoc-C{<^BU(OhYR zGcp(9+BZ_c6%?1zj9spx_5}9xG7#w~ghbHC;=I{U+wKsr_i3ygr+6OWYPETJvStr; z7G5l`I8?hGHB>p(o^vyqC!1|+t)i!+Hq)lVtSVNkvGRj~uUYxANzaU^+S_Joo@e&aw(4q6 zFBZl;SZLeAI9Cj#SxZo8n#X*2I$|a))m^>V8#%{!`<|`o$<9WCv3B;;JmaqmS@4(0 zZjS#Sd+)XEDw?H>K22YC1rq)e?>z`}a{>@n7zu=Z`ZJihvOD*#+Fey=cXw4soQ#=k zP9X&7H^YA88;+ehm!2a~N9L8Ytktb`m>Vr0pUnB(9w|vE1>{NNjj>k~eNu!U2#e08 z{!`B0$2iV!a2;x&g?7UvuE4;>$t4BLVXIX9{u&YeJMZo~9MP6!=oH+>Q2ofUA{WCg zGwKGJDrjIFt2Z=nbMo<4Q_zO%XO;Z0cXtzQz`TI&^~Sdf3byvE<&|sRLdVMsBbEnS zzHiBU6w>_B);<4}YaI3$WeL$km>s6uBkg=x^G#*KE^4P{rr1zr-7*|!2HWnhm%ggD z2VBHM7}*Xu-gf=?+&=Aoyq`i*E1?2y&%d-k$QmQ0fp!UF_<{a1oOZT$hFrQ41^sfz zq}KX^9>e$-`c-9etx2Y$l@|8TR6J;(zvb%?y!J~`Kb7sqTqa5uRCmO})5hG+5QP4* zJ`2;T?&Sgv8B3*c@8zqjL_vgPaEDg}s3krYvN9G2e@z+wcwBWjVmRO?;;@0?QP7wi zvPCl^yZoUl8JSD-`_YN5FLl}s3 z=+8j4p0w?vv{6}C!VqDiqc#yQqIlOD=k+TUfi}3?C!#!}N$w$!qCrr9#G8B~*7SWM zOotMrw?xQup-9Z&X#KsJOU_5q;-*Yr`i~Q9Kv{JfUwx1pQfw^PYm)JlU(fAZGkVsD zyhycTEQ|=2#1jpn6tvt9ux_kvnlkI24S7#pu^Co&8R`_ebAtBtkIH-pGDe&a=1d{r zTH3dHz_*wCD4j`^y@r_l?Ty?$(s$gfb)f}p&iCTjJ#-27Cg~P=%#-RwItu#mP8($n zg@>T5=!wUz??l~Gt`WJFV4{ofN_r-~nDOR3ruL`ve9=^T^&B)xTW2gQx%_ER@3gg5 zyJ39zgly)!{5c`YNDcnUJuV(%c6r=oNFnp=n8~olFJi4pBxE@=iNKo(ifhz5jLi}RLN%;W9>2oNO}ypTY`Ly{Iz9jmsd2w(j{lvlWB9=S!~+u zZ8_%mOP*nUnM7cjh~CdrgYXxxM6;+;(40`&69B4Q(ExrDGB3^J4FPY*BYL>FQW zZAw0G=pgPJv7^WF3#u1zla>*6rLf}r}6pdlUf9N@Z z!zm4;GA`>d%12=YcvR@hJTihSFy3#E`VT)xXvCaCpW*F$1uFvHyH+83DOCaTqZ+im z9e;3t02zW~=b>LC?mLY8fB)nhbW4Z9iGQX_fK~L{;5-DTQ7R6mGhjIFA99W=%N=xw z55)+^B;24qs&Dt@hd3Z-!xIC(p4P}TR`N(*myKrXsYd^V_vl9v*K)wPrUUZjuY4m% z#bu_}8Ur(j0@8nQr8n)mt$OX`)UgJnUZ@tDCL0#IzTr_s4~&!+Uu+`bln?XzPZ=-m z-RTR#=9!)^aEr<3)62k6m=EVQ1NNYwe!Ef1Hb-~G@#26X;4Q`HBI?GOtI3(IQL=Z5 zxaWp1n^SQlH6;5T27j!W{Pea;TjO&G=CO`Zag3QuX9JoGECaef0q?rYq5RcEhVMeV z0!Q{1&Eo^IYN8~Q{Dyr(R}IfLjX*Rk=(puY7+2A;$Efr?L|@{|`$^bE{|Mc#=TDU( zgBio38HdJ|*+Rdb!c!>_EMT|DpN{Aue04J+Zp< z?5;T}9qzh~UrbDvqy@z*>QwTr_oeNXOZ>NajvW)rfJw$t4!wVd=~-hTU9mp2|GpKQ zaOo=vg7+fvHe*4xzJq+CjW=)Sm$N>bwlM<670}K7j3=8TKVgnv!2s!zX^{M_w=2>D zX;euoGUYtE>1@82==D^H2LMh3Z!>!>hp=>QKZ8o_^rb2uXcp zhtSg4^>eMLAFQNZ5_7ScX3|Ceiv_Hg5EQuR*IF9CNRO+8z%B(!% z`-jFl&CnRA0;-4D*t%`a3GI~)p2yjzni+lkam8dIrk0(s?8Wa(t|N+jpvGqE zno-MC$(+x}JUU49blmqF|1#wJ3n*8)Th;aooOu!XMe{ccGUHuf*cbosIUvF1hqJfT zooec0uk|-YMpTq#kf3;q(jo#_hudtCQI6 zj_Q|k{PLf7va#ts-|sM|tcOyJ5?5GJ+i`i~By39LRecZirTV1AqYwr*&2WU(7__nk z=>WDQ^6xricVhziMRYgIBPqrbq)_stX0KkI%++Pno1!iYQ?{!BxVXWMW1XmtvEA5s zFv7{61@KWmS7^l^b8(<#9pohcIH9Sja!tjnVtD>1;u!V$7^u(tAbKa2ZFnl7E#T-> za^}u~ksRN)$|2ofSYfJ-wg(#*x6PgolF`us6|kL_{!ASxh5IoX#2gkpn3oZx9RW9LXp^bBUZoJmm3U#X`` zlOz}v!7ptx;Y4aS@1;XofIry2l z1^D_c==)2@DsI$IKwDGa&H+p*hksJZXgR`QXSIcWl70d)&tD`ce)a~TyiE+l0H&OE zm$c|MX9PL0y!FS)PJ~ui{Rh;QBoG*PhP%lWCz#_u& znLN63WMGS`&T10Ke8|rh6#~Dx4XpIe+?t_K|GoQR{VHs>GN{{NC3807wGYuRW7yDF zq4a(|*5d$Jb(szJ&44UvkM7`d6c z;eE(jSDsiqnD6$9p8=9TUfXFE-Lk*#BLxnC=&)E!_a%P3((n#`&}}|L=Ej>=3xfL+ zUUnYqu9U8+pPr4@;DhoEu^$60X+_`v+`HZ^%6JEyz}eQpp=p+x9z!1pRvvqMSd7ft zsLvc{4}QD6vc;S9W@$=lhi`BvHffB%kul!=e6oUDq@=Q!kk>8-*leM`0jVn)dU({W z`_97$9_AL$d;9G>N%_Fun-c#5;x(^9V^xpB=FX<#OrD3th#n!1->7q4d$rrc!HA;E;Y$5mcyVJs#yzjN37Mm@>$HWKFiq zXwkKIa#o3D_)wk#uP3S5Op_-V=4DsXCVbLl!UB?T?pB}K8^xyjPmPCn=JgC`G@`ojc3_O6U z$%(zp)hG+r{Ek1wAb3l58Fj3aUYh+WNe&C(V7AXvwe|opB=nLOK;ZA40B(yQnnCN{ zGY>T|I9D&kd$5)F2XMd(0zv-rAeyG_=mW4rSzu6MG=HSK4DeyuiXGAjGv`@69pl4T zo=3XrZBogvJH4DY+Q*)sxmA_x&27A6M4IAz)ty#IRTUbj?q4di|1VJdr`})IC%LYVvk^oKF!6*r)}o$#$AmMVzRcVtLW6xR8lk+m^>eToh=ZQ; zUg5C?@bm9s5N^XNFHr``!|dH;c}4J|xqwI)cZ_O$kezpWNE{W`4Nuz!weVjJjDjnM z%pK2%R2?sHvmv*zj6PB7_RPQpft9bCkJF3?a3Un7%V6gR5ZVXz@DeWp-wqllQ>lMu z<&HVbS9am*Y;^F=YX7^hoRp0TZ4k|cuXzYO5>{E}C; zi}hxgd?{eVV{tgYT?`VkTkMNUS-z|N95`VH5dwGCApun7*n0;wfoA3Jky^|zmj(== zsMs<(mF7|^IGhQ)9!VmzJ_99`4X8(AV+bN_9ImUNZeJ>50RFC|n42l&>&87U9qE80 zP)o#R0%WRB=Yl5_krQLvCM2Os?M|`u^tSq&daYkbrX@7oZ5c(-w3pw{beQ~_kA7Odse;WN~~mR|C`8Le>xp}J@)_djmeR|MSD^I?}9 zfDRTn!F@~?`?2alRVo&wAB5@4(Fq(rUdqeAYpz6Jw^TPf<8~TAgN>HtgU_k+_=57z zT3TWc)UzyI%Wm|vrCmkRCzdzBkz@ZhrNM`IL&Sa!jI*a(nS!bzMwOrj7OaYZe~T-1 znRQXSgs5!iO8WHtM>O;8vP$5=cMwNTh=qCu!P*inn@u-yY<_+|e39dev&A~|Cz1My`c zs9)}Y&2YUJfEooVE$7`dwgX^a4!kU=E;Fypn4t%7M6&ei^_jkPkxpU^W<}h1l$WFVgj}u2 z+=VcIpmuUE22zx1qp70B&7;I)yfB8Sr8bodZa>Q6{qVi=z>IB zz@ni5&sCWeSZ`qUt>O?c=4tpl2&g;c`a`JfJ8GGWlw0P#i2Jtn=BliZVlB_JyXW^$ z+O0RmS>VHJZ(G>R9Cm3qW_m?@1XL{<5RGiQqJk_c%!Auxm}i0!H=tN}oqG#Y zVjJi12-CwLvRps9dc_ER($pLjz6>&4{TkeF^)ltS&x&yWc%Ma*gti_an8h-$&2O2- z>_BJp3RR%AG|V}dLC9yK0F=G1;iopX7X0Dv87)uFM+SGkzxR>HEeV!&?W$>YU?R?=kO){yw*yOK35p2swP-;tCp|=-;jaL zra1&dMDc}FrmozHFn(^g+N&Jur~yPO)9@LnNI+uP#APyTo+5|_z;dlghI+mhI|FGB zABQ~z@3k`%1J>;)_yC-j>|SRMhM-_cFQuPqaE?Dx*D2Ztu*wxtK?8O9LJ!7rDT_)R z@3X?*t)(7185EOa-nZ(Kh5`P`2XQ&%(_~u(>dsdv2BhQa!JtC|1r45`hb3fW#eM(z z=H2oB^!by+JINL=Arm~27cKHosL?XAS=In(NFaFdTC^6lttO8P{(6sz{e*48Y7O@- zW^McE%!i+giu+u01$T^~6L0YtzPT~&4Vnu-Ens`}eueroeds#7D>Pc)x>pCkp)#3W( z$ZMkyu?|*$XpCTE`o4F0R5$KHi2^YviHOM`Q>QlO!*~#>0??KU%dx-qLiYL;$zgVy z%t9ySHlCDXE1O&Owh}Zh*p18|qHH_g7}Q~1Yfsh5M3==|s4%5>B+($hz|_`f(r2@> z;?`PzDoDA*5`wH;;?!YGYp-f3X=8ooeh0pT!~<_tWZeeou>Ayv0(oRhaqN8v1%&>d zKomTF=)xyX2kX#ZI6~a8{9)^oj8P9L^wxN+A)y*FWx$ea{V$s+v=}EzO?TcJ(yFyG@$K z=BV#&`<0D{{d^oAPa7Bx&N|?-U8`q|=58e0bEi+svrqwI1?<;w*yILrg*Lk~Ik6Gx z2cBywIjN9ScJRtk0!5I(8W7?*9dvZ^hw|R4SEKg1LQk6GT zWNq1h1Q?}>1{HZqUCK~$X(+K#@8UbW;%c@kc`GKqh)?cYZ{!oeDmw~O9-0380uyUm z8u~#bv^Ie+f*{nb`Z7VGLH>K(AoMITShif@DWAE^f>);Es!xGRWS|KXPq5V zTB8d7B**wTiT7D0+ih0VsR)TsoCsc7~JuhOg7l?=A8EZ$F>v<2lOKgE*J88 z-X6|?3NHuaeA{T{ZyQMN=F{(6Of)bauF;QB?k;f4$Da;JO^JEWwp7dWP#O>*fnp3< z!+CX5_F*y?kC!~K;HFgCO~^)WPudq09;yJ|dha5o+nRXKaq!GpscCw*IH0_t9A3fW z8M}j}xV^GJ=vPx|QFcc!^5c|uBAi#sG?I+kV zjB0hlaIZ|J0$b`@SKxYGCQzNcL8g>8$)2rhxfyud#hub6gFBCMULe3$^=5FyfP#lu zgsAJ?<0uS`EXVQHMF7UGae{xmL>Amn|d$| ztYBZ8v=?dG)OXy$uR($TB?y$V@a;&CO%MJwFd}Z> zsTh-|6tFK-u)S~6^A~P_bvT&_)}6+jc=XFILEsqeB49m3#w~H$b~vxu^_RG}j5b*; z?8a@>gq@>=ZFC|X$WQ4cVk-DqgMO(_CW4YN08gi$_^mzpKAYO3N%9_VflT6g4qxBL zr4S%XQ01#^5FEFkkjf%1^LV{Q?S{1J-rW;74D0agJ#xkYFc|C@GgdYK$+;#aK4b#- zZr@~^V-GdC0);2EE7BVV+vRHG(XUd~EOaw;(F0+M%IbvNs1can|c` zTs9}i?XIHQ6)#vzce1ZYxfDH^Y>W?i_@b|ul|y9+6c#k~@W`EqjW|L;Fw*RC-|Z); z2G<2)DpJuUcLyn`#-n}gatyZCx4nF`(bsE$6!DX}-d@)poVVBEsO1&5hD_Q~YkdoW z=wefhvfLoX!&wyyh7k20zp(OH*yW>dRgm(sN~E(YHGfa17kpuD8bU%kAXGckD?^0~ z$judZUimHr!ZQ~)2Y>DEBEJJ+*7)NZOB3uz))89NxQ~HSS`T`SU2!P|u*eJ>$ zak+OiaN0V0IDjnQdt885#6sjy^qp=O8s^%TM*$#)FwQjt33~gpQk~0KEHx*#c*CJc z2yx{B>cr=n`t-eNot_)Mn461on<7aE5BgdhEY&*hOpH7GV&>7crsO3(fl(_9h1=Iz zH5q*O!2*2Q!p=RR#jp!P5eOC>vD(|GrFQ7&@GI(|ItNU0MzG<@SldDz{Ie*V#7uHg z8CCMdN}s=m{(QTzvW|9vzpv;D?|w+(%(W|=7q2|6TM>HrH{}kG$1WxGut*2Jgjw=N zf>HcwL)6yKD%9UX8@sEMbDzo$0U8oe3@(@B$MZXa6mQNigdff0!0IL3i)*6S^*LWQ zKiUVtPIHf5ih=lp9tl!okK93S!}yMER~A=R3CNQJ_&y4*5|l|_*%^3Vu@N=n%%s8y zP^SYu`>%qnxW$D)Jhku;=_YHJ8!arVu>300f^_LKutRkm`md7D`Tt( zveylmBIWdsMekc~Aronv2cdYDm;Au8mJ{5c2v_xkZu}THu^vjU z(mgKt(lX-=P8{)_Lpn$?y!+}!6FIp{hG=%o_SRs5p)NCLM<7)uEMw94!kh=WAtFd5 zBGU)rFq;ad_}m%hCLwfZ1(Qg3`)&V7M9%5~1#CR(B5+yEfm2p|&79$D^Ci5@2ML)< z1Sf^e%D`U+tj4o0NUFf!nMYIz*d4ti5x3W4)jk{MylZOBmhntK*5C=E#Sf*Bv~hOZdTM#k4oNjMFD-Y>w2 z03QSM>Rh9M9PPXP$lrG&DmP#jsU8MZUn)9ru6qHMAJmj0^Qa1`&DSj*%ZfH&EG&^% zy)F40zdXrEJv;ZC)f*z{J^H%8Z(q1VgJva4ml#TV;bB}tV;d-_*7DThz$o3AYWXGD z{jKKZL|&HTi4T%stjST;?fdfq4-&G`<2Ek7A(N66hC&d;NfOsCGxDOrUj&99-U3z1 z#`J(jBaqBx@3nPxG9CWZ~)Rj_<1ebE(h0KJL^$HZ!hYQvM2~U9a zubddO@nb1415kiQ->$?Cp036D5bx_0VpcbLpK)~>0b9I9 z$!P&w$``-62zf6 zx9BnHh1a>kvb&MO9KJR_ve;MqHt&N4IT4iMGRUH}iJ2c#qsMvn9u)f;px1_yTdD8< z1pGd33{P=(y*F&e7c3|bDxd2HH3$}G`TZM<4@5YDHL8G0>*Z9`3ef73f)~8DccQzF zN6JhH4}607?KHm-IN|$OhHELqMX7MI8oL>Z=wh~ZH%}VN-d-|I_Wot>ORqk@)YAlx zw(*=p1}aLnsY6{{v`<5_2^nx4)u2YjBkl<1TI1dc^ z34&#rJafg;DzP?d<*gZf=3#zKRf*6eI9dv5|sQowAt~Le%=Szjj?xaFV z1^m_e?+4krGQzs7ZxNu=Jv;LuSD2SRDUdp9U;5STOgofPsmOs~12T|4@1B>=t@w|? zIkMvRK0DiQ3{e_h05qe6>vKH77o@MeMly9dJmfanV$>NCp0Sr z0{gE;u%LLv3ThnoEAT7=<=WFQ(F-qTD#lIYppYNJTohQ4TFHE&;Qq3>Q+jLC>b;}R z-sMM3U7FGD902UIiv9YO?G+CZeP+0CP!FUt9*c`mx))L8#Ib3+`Jg%X?Xuw#5lS*6 zNJqb8jP(5u&(&?4aP6`la!KIdfZVm!=c0ffG1~A^%#e=ug{-AQNVUBt0-d6E$3D6V z0j)fSli=~5CH7`C*Kt!Q+$1oA+y$Ufw7LM^TWQVVUN3vc!vIi>1|(m^_(fjIW4EEC z#Z`R3U%?j4x9GVLItK6G9Og3}r-eXmBQjzGjs^mC3`)++*IZFwjJm}%gf>ObJkw=+ zE>BSFndm4lFu#dTy(bl``=M+3k@_Fd-0%9{qz+V&bjEQ(x?=bRtFY|-H zbI+wROy%^W_`K$An#|sJF6ZVRQ3jZMtcRV`WK0MNRq_$jGnW4Z))I3yqC-mq&@>2kFO;O8w)5>nMK4gIO@)=MLnMh5P?ZAd ziH#yx)Taa{Cl2lRq1cCuTU8_;YtqWU`~uek=1IG>BHzvpL&3m!6ze`^Dj2ee0!{Rk zN@qEBIK0g{qa(yX`6n9=@`bTls^ zNTC)3gh%ND8ys5pJ8|m`DskokTBx+>{n{C&yb@9G0w9BRzmnj^*L=$^9C5$$Np)O8 zgNeJG3#c*nTrwskiyg2;@ai&ot$m=L4jJYZ8r`LLLV#a2E9*09p&s-$7gNtnAygL6 zBwY#fG3`=-TS7o9fNKKAzde<_of29#S^h)`tRvABmqF{c0@o9C{Pjs)Jt-{_S z3Iak93WU$1^6r8icsGXW>ns|^8@>5uec$1B;8CcAtw6v7TZZJ(2M}wW6FN%wJlHO8 zCtgJ1#Z}ziVra@bQFPE{Q{Dm~%tU6y!^Q1AoH}9afe?lLo6As%vxJ zxW2%S1GK?R8uVk+s%$o&C}FDz!RN98tdST$Nbz#Xkp9I3Y<3%*%OQT31S2?~Jww&~ z0TN04F-qnA4wL-3-r3O7w4l1flLGCXk$O-GRZv~w1<3V8kR1xt!Q7de5i6m+4yP|1 zpaIV3;iCRp0DOsi0r4%4p+4g3|pnT2EM&qHaR9q?z> zph(ULt%3H>zPu!26q&EH*Xd=2Xq|Gj8PIb=g$R;vY+ti>Ivz@gi#9M~!s+j*4#l2QF;pO7`pvlJ!{IXLue7BncC>%SLp-%d_lHN4xmE^>X zlp4{!U7K&4vNqf%C62U@cBsFHikX7?R!qXb-#SErCFYAOTFAT7J~>>}`-b@0q}YFx zo?WN=6v1unwQTJb$|iwzta;W^KMnhw05#lcne-s>s}JW7PUu(n1Sj#|uf| z!cO{Z!Ka_9p4%YQHMYTL;1ul~!+vF6PFaph_SK(I`WB1$+%-3buPAzolr{s-MdH$2 z@R9AtaHSlk7_Ik8tDl99_g{a8mE$Yb+7<6&sV-FmxgMGSe(@*00}FIRuB3v}U#Ncu zd%OOWKQ!CB8WU%^#``#6@NbRcs0o7}GM6OI^!pOmCV5HVH3If30Qvs$XrLz;&Xs?b5_O!g z+~H2gf?i*aDJB!7r+9-yP~0IKL%lti{DZI?IMSjwc}8VGd@sL&q_A?vU`)z0o=jo@ z1@m~?F;KZ*YF!DUHgd^7k64YQr11Px_0hfcAtbg zjptNAa1!~pKh-vs^dMpi5Lfs7T6*v^u4ePjTb^lHJatrIjc+ZUnJaJwpdqW1S+arc z#3pn8B^&M91ZFd_eSzc&T3D|+gd;EDhIY_vBF)Dt&}jMyHONa?5@j- zcI_8^k^uS!dmKIoG~FiDBRo_hT@|2o+~;z|%iwfh?F-TG&-GT;noP5HXJKu&97J2j z8I4+HdfheqGEw1`%Uz8Vj7JS9-!)357isT9!5c_YCGh%-NsW=hej(}cgpE?x0f5eu@ndM)s4 z>E@HJv^3OI!)xk^Q7d9cx>3#=f8U4w>)SfklS@&at6IqSgmKd=2_xncb*?eXSTVoq z6oOX^(EyzA3Y4JXj;8)>Y4FIeK|FCfhFoOdpp>_)fegQCde(gj6mjLf)(xLhF2wmRWNAFe^5T4qUkGz2JtcCy^ zEgMmm_i#xO#amS2eF&r*z`at1hq{mhZ6)v?r7dHpJ#Fb>HZVWZ1xgSPY5GF$oK~z$ zzoZ@t^=6p)UPIM$(;$Z~3a}7N=_mFd?e=EFo@XHuPX`w~Ry#5{kEj!Z zji#}iHhU!l*aI->vXaT`;4Tmg5-0EyAD@cRE7rMz@(~Jdfy8HD@`Fi3S*1*neW_4+05A|7N!9or#5qTxRYo8lP$w*hr=*)vjJ+bhoW<*cJQN#_~$#WP^sU8-;QF?VJ6uGDP&OonR&9^C7=+}Bh| zwD$}OoRnq=ZBQDbQuqg@mfJg7(&V!>SfXe4GbpbWy7gTRjFlM_GA+)Ffy_NnM6UWJ zJ};+bVI=+X^!vU|GP=D42K?mi9fg%9@`m*#8m2RswSN=GF*4P4a*}8K)shq9ql+Ms z*J`dl;CQIl#6W46cxUt$LpCa6CK_-Tomr^kwadOp#xfLR+#}P(o(pagBtIpu^&FbJ zp2pAo+L|ktK)aYBvH@zTdDTF6{cBwyCUso^dR@S;&iNA!WSWY< zp{(G)IlI@51Yo5ec&jI0cc_DKyBl_6q1Q4rh}ndG;6D~Gd0idkC5!#`nxlXUG_3X#UN%#4UWR%gcz5}p*HFhm z2ygjZ!He$j7|7wN4NtB;py}3}0bpiXlO54NMxs`beX?@RCZiAvy}(NqqnYL8v z^$9%$V$cxgLhSF)mv*gede6m@ZlF3mx8}G(&g$&&o3%SVbk3MGCt9l750ITdEhQm`11}-nj()e5fL@|eu*SD z1q!=XzC7YUlkJm22)qIA{Oo+#lD4)tf0RbR^m2-O-Tl@tJLqt6t4hX!$_D^{;g{8J zrogEIzxi7>GC-f#PPd@cFB{4x2M?82o4=JKkmoIaKe7_hRX_6EP9~bRZ$y0q2oxoB zG)uS~0L||?u{;};-pMM&+OzyD2lK#vAEmB^*EcpiubA>8K|E=z;mgT7ghvd-@6-Zs zz_udcA=#zC*ov*z!T8)%_#C9r>p zQVLt=Qj#!ypti&GW!jW+z>C^xI$#3xh3`Kjzs3K;w*j#agu|d>;GdlHLhG&x-KnvU ztjEw@Qbhde&Bdy2fD6#BsH!UHdVl@g?^mD#0&Viw2J1aG19TJ=R#-vTY~7%J95kwXjvKr{;KehY>#M2U&x`uo!+iaA z5_Fn<72Md36C4?U{SHp<(yZv9y1V%{;{b>MtX=Hi+3RiuO0i~uy9~o0+TC>xu>Jkv z;=ec6>-TC(-}RryvTX9=PY}k2^*;al{r^pP_PDD0SwM- zwEp^T`nN^+x9_IEuyO97fUo=gapPPxM%S_bg0=8#=l)^i^l4th;3B{7`9HQ#@ZT{V zza$y{Ys>wWoq2WH{4bgf;6x{$VZrF2;WBnLF}_9rSgHQ`Q2hii z_zlz#9Q*gq#+L&9?ScOWt@5`|$3Kl2`z0#=FdP3YVvP9T#Tfl-ef&Y@|HY=*6#ggj zm#+NJ*TTQse}5P-V6Q3v=d0k~7s6i`CBHipf17dqU#EhxU+duyQ}JhO_di#w{GZIu ze=4K-S*&0?gVDS--@N{N#Mj@x1pcrE@n2i*k4Er+;hg_6b^kEu;P$57zvklvv6M@( z{LfV%fBX3V?&1@_tMgxblK6Mg_lGIE=uWSZ`EQz{KX>rw1A5-~&wsuAIar(jr1Mmc z!`Fk>2bUf2OSJqAI{)vVv|qFFYsxU{Pxn8M$=s0t-Z}dl;tc<86I~I8zhpK2A-3>; zl9cH$&%Y~52zUL>meuXoX#5?~uippo*D&Ak+n;W~OwT`TjsNa({tG^QGc^AS3glnz zMA~1r=a9|UuYb}_^4nwm^?mX8&)AKo|3m`~GkL@AKmYz(lm9k>$e-|Eo9z!1NZ$Sg zy&nGUGxuLp{NE(%emD5jZn>n!&*1!TI_US%R@0}|(U!Lp+=dkz_5>)_xo(>x}0$cv@*obr%(#y~LaE==*wdkJQbf`Ou>GpE24HD8>*Zen0oIf1@uM%t+-eQ{ z;ZeYV|8Rj0E(y$<2pL{ru2OoY%4nScyrIKV(&q#1;*ke*>{8yEH#|=RHL-2fxn15S z0=QaN=LL-xJHdlzVMnB}-8nU+*vPF&7cxWQ*t~rmiM<}iq}fgU6d0({D}adl17HRq z-;LeRY&_V@Ls&-2O zDGDjpEiFU_ARO$sskYsz9bp7e;hQyFR$`2s=|?n99m$m%YbS!FG~T(1_HbfQ?>Emt zxXU@Onul&8I;0HayCL7rHa4Nl9TfMxw37g`v>sr+rbAeDpvTQ4bK=8jubg;z>yoFF zmA3~F%D_4U3a%<7AT?uD_T%=9fH%^IPPZql6d6;=>5VI=el(BrItEam&#CV!;(@ z$4SSZZ}fS?&IjOrEDS!5VZh-ckj!TBW6bTl+LmX`0ah#2Z-k+7uQyN!-O_J>v!lI3 zQR9>{aWe7_9{_4FaxsM*a%mk<@?CFmA+ta5_{;qOXvz&!xADb#z&*X2VkcRb4$TeR4Wugw_WedYkRIA6qmQrTJmtd^F$ zSHPab6T|V!Fy^p@2{VtmoqZw*5E1V^j%+1g5W`6u@P4 zzoLOSgMpPT@9~rWbgib1g!#EaPo^2o-VdOc2i|1sCif~#eT^3pQ2Of)W{AP=bce%0 zGPM$PnR_i8ko&}*@YbMY`$k8I&~5uxmqa*P{5xB-`R)cXzvDTgn}bg_sJcD@xNV+* zoPfb3m5Rs&BjF+_O~_Dl&zI~&^ix$Kysh(GHEJ9q^Ywv!G-8>6^Hd07=L3_|ZzBK_ z+qzIyJmbhL7@6XEt^cB=L2!sjrPppdqENhnfnbFuP>#TJmNPMx2&)SkWy4*hj^m*L zG}L84BaS7~TZhaWSJ|hn*rDSCpul!2lh`ki%V1A)x)C(??a{ghMw3#3Ud5_xFZqUb zR1A|~!~4Vzong}FH5c`II+Y@*!Vy>N1j-F4tTJgIUr5EwHPyagJ+;`%n2u7SC`r?k z{#fohm+wMMBoD2UKYL36R)vR!N}S&VNgqa7QBp-O{cYl6NYVfl5Q>)hvCy@d76zzt z%VUa5{ zGBP5(>F1sjefo?Sb*8vEAE79n&P3ckHVc{j)|_hyAu!Cf;YgZSB!xJ}B@ZynNgkgY zp4j@A&GGjFxsnI7U8Zs}Xo~IlrYEGZ@QFJ%=&OE@Xpuw=uOaLYcxuZ>*6aymB2% z47v<*rxafI*C~yN9)$$?FVPw8R`G&~{$-XdHcOnosr^MQf*-tz7Ds=bl=Dk%1n5<| zTeZiIz&s%nRvC{ad06_{Pmk+3ZVwKEp{CaPV#NL(?;lwMGN_x0Ey5;yR0rYYV|EHv z-@id`Jd5dmK4+NC|p&_;w0F2t7%i7jXOm%#Wtjdrg)|K=3kt+o*R)+;AbTT>lgM9|wP+}hyh zKprS%-NnVSxSjs)33XP_e?;)qFtC1mk6ft|@~qr9ZSHUj-Le?!b|LRuZ&okPtKzPEaUB_Yl z->oeO>C?~S5e%gLG$W>It{vcD$CkVf`r$R3L)2|ap!Ws(A+fDG8pU#{Nj&Df;8q&V zkNlwY;<3Zt?t^NhNDboYOTlgYmI!v&7G73)w|fWb;;`X%M7*x)yuVRw;^;T)R47O% z6;lLnN2)7hm6hs-UDI|E$`I{w3agmzXOs1&86?S(c6H%CMW5B=o6`o_AiTn04!nTv zyf$6+H>b4lILZ}ybYB{Lyqv|?M?EnMXg&MjqB|J2J@|dEa~z@2=B%9=Jeo6LQUNg{#296<bGqOvh(oYHLicGT-z5PZ z`IZ-5pPWCbT*VzQIf|b+qq5?bysKqh)=@E9WFQ)^*N@xmV?wV`wAjB3kpA>Zq#O+z zgxRF)pWj0<#1hF*OHU4ak;$oC_D4JUjjJ3>)6%VMyvgpJjytgO{o{bBS}H|{U=OMZ)Ha9v~vi%w3ugwQNw%8 zl45`P(SH?_o=Jj8;nRGw&;8v;jA9BT@R!4`VclNc$!#gD@SVc<-uN6m5ASPxKC8JQ z^UeO-^Stm4?Q5OobjM_0PuKgudg0g@u;KO0#Sk3-s4KCr#nJ=OQ~zDUr`==*Ot&Jf zNxXsDCrymOQE~U7p&9l1e4rU_O!Pda2$~QQYLWO_mVEE(7YmNtM12JTvzd zml?(k0z&>;7Q2)Gkhug42V*z$%%1zCJIoCK!~eN29zG>~WA^ei3&@6!MvT`**o#KI zf^&9x5x4vI>#jpg2S4#4u1?~NQo_|yi?6$KOn-MKJqX2wS_nrnDSv+n-~==KrxNv& zoq#p*i?3XU$Y3>>PE7XJ2TsM3{1Zy;w@ten0z$t-%~iz}e=heBO_Yu+BtKslOq}C3 zXybzYA!Cwn?DYrKH<$UIsnc)2`}}Sf)j|$*d42S1TJCyPY)IU&7a6~M{;`6bIc>h+ zN$?o?Df7B46e;N7nsEU_2rWZZtR^Gg=;;mFbi9#=ls{6(!qwadi_1Pzfkp8USLP_) zil9zQj(fgZ!Gn?fP@AwVweIERXt0odV@X)@a8~?s$mLHsaUr_S$f#rru#x`PnTB{5Acf)^?X68D&T3a1UIk#_{&jm`vRX>X(`mkiHq~``o7a&`{$&3gSxkM4k`rW{uZ5-;653F zaD|o-^8aO2q1jn)3v!TUeMpbnF_;=KT9w}TNQbu~^<>Wu-9vRnw61Kl7qiwqecuR~q0%xQzjXJJ&al8j?Jd2Cld{$hS5NNIedrwlYE-gODD! z&W;A8^%0JpJ5z5jvTy!ggc5l#WD-)_xAzy->R}CpWC{1?Ei+&u`5O!4!#TOMz4{H> z3CP2w?c0|klFu@Ym)n7koxod3i_|%zd}5`aCBL|NSnM3 z)_?jB;&z{%{9wnsBiS zgq_Nw6V=Ha6Lsg?rA@djYEArjbb-~tfDwqvS&^zlmtYd@v_30f%8hKw+Q0e||8alp z%=ZiT?LyATYdKumy4JRrh949-3iG%2i3V8(>>^eBZIs`?guc1nu!;G59oF;aMGBDk znQ=KYE!}^hZ$m;;cv)H!#o&yKTJx~8n#~UHC!M&o@f=JDeQ43~T%Wjn_PrrnYO$>% zNJvkn*b@~&Ah7^9QLb-&!JDg?Z?2` zGAhNfC~%Kbj)tPjHOon2+1}<98>;s6L*DF~BgtU`5hHz-Z!CEIY~wk016WC)1`bk! zuM}g=9)m{I=tiwSI|nQ-Lh_MwM(D6ggr_gZ0DP@lfpw^epliUR+g^Y*%oN2BaR zf!?W5V8OdvG5Hf;JA&X?n7wFG`{Q{^?&b-O-um^pDMQ*3!8^=ngnM4MBjf1@ zE?I8axTL{DerwbTKf@N5gU*6>bhBB?W~6cD~Y|y5;H0v|2F~~y5$FY zpC|f5dd1Qm6GeCy?@xfv63==wwZERqXg5M=Y_B?qwTc*wumm`eY~VlWqr{wF3)xBS zRm21+`3d%uq(M$GkWhrj3NpSkLqS&PK>02M$U|~#_S9-jVEYhg9c|c#YkUknlE&O& z?m*ig#0SLbwWoUa!?Q6k{EJEG{CUWYGj)d6q@Ew!*G@()w7d5fM9X9c;9bS5Hs5jG zU49rwJYd-zZ^x_`Hv_(FQFTqvNmSI=6m0b?ERpRCPLpIpSXFSC)55FjyGFa3BvOXc zMpn*Q1st>?Jm95>9dQk`K@zX3B)=m2$2xE_kA$!57IAv`_5s<2eD$~T$14kEFJ0?j zAv@j8Tn#Y9{V(|R^`(9QojEUyqge9UqzZbrStVEzSq?1LrG)%hBDtbc=EKV6-$pDT zpk@AT*yS@WM+jra1M@59ej%|PFApqov1wp&`(PD@BTS0mSd4GQ!*jP?wLC^Zmv9@g z6+`4qeBDnPFn4S0ac^dVR7R?NqhX`itRxNv1d|~F(5h!#$bA%AGCO*6Ao*7eM>A%Y&9Y~leW=Fg39R;SFNbYd%=HHWX zcNXq#1}bFa3pgk5!c_m%d@glKsB2ZCNCKT&&z4s}zly)uI|Ao}6rlj-R&V0|We@pR z_Vjax$vsR_!7-4!5JORSc^&qTvjsCYLm{)Jg!8XiXmd40oH_wlR`t|g#NliTV(f2 zTaC{U02qk-bMgr5Rr$gfvT((mad?*jC;YgWf z;NE|B4c-_P5dO`cQScB1UZxru>gUm5zmMRv3MVDmVeIHo z@X2uP8^nvB8`vb$hL(yqy_E8>2jtTKby)h4Eo)7(38=QOCCqfP)A9O%hRb7pZ>VP% zDt?hD-F-{!HH8TytMGh{!(D!zIT(GBFiPK{?E@ePGfY44$dF7L<>gN14>bSV-CRar zgv^yh4%p|D3!V>d&XyCIodej(%irbNNe=`HnJ96atk%AYIsVl7N-pH?044R;2X=pn zQZ1f=efy@LT2gM6sKO8GS1&&*zpgNS{jn8+zo^6eMRPl7LwF_appL55TPcsf9jpKd zLLuSq9Dn59Y5nec%dR@(n}AEd?&XmF{zA|vKs~`ib|+)BpL(Ib_Gs_T*QW-^2t7#D z%I&&mEoYCJMv-3=B;iYIw-f~(qgy%Y)metD_bZ#x-Ee#8Tb$J^K4j0DA*Ajzk&6WU zlYgr4EI+jiM$?9trBCmqeVrYYM^IwqE!>6Wef!-pd44!+N)$mI#kAs)w{6*8_q%l3 zOGK}p59Vu8b^*wP%n0ZncA7MvfjP8|pErr5rC$V1I6QFJH#Xp-x0qTSC7}Pyz~{Me@Qod|6?=CegP$q7;kRfL;#$ zNNumg6ZbepidZ?jhnGiE$~fqc@Dv`z-8*A$chr24rs%lut!BJW0dK-QeAbD6Y`S-K z*V>vPTc7Pu==hNT2o|vS@VOg7Ahn&o-Nr@!QHgLTDazH#VD6$Uk?c?%N0A}W?F(ATFGy~_>o%Fb142p(-2Ji4FmL*3TB-Y+9x?a8K%>?5 zhJ_7J^p@9O15iRrPg4pr*EBmt(h~<1Q+FM++p+zo?tYi3anBz*Y8lc!G(E8j8wtu` zm;h&8wFAbH!YUYPfKb$MM*hpY(taMeo`|W&lC)^*+V+L<1N(@P0GSxK?~G>h$LsSc{+S zU<;t18Vl=Z*_?hBulH|k_Fu;C0xoSKEsm{6Qj(F*J=E@*X&pKz==N#^*qgoB&f)QSs4SkllW_lgI=%^uFVQtPs@G#|}0Jp5HB+b6SrFxPHF`c;Jvr+i!>5?Skl( zB5z=zEj*)%2ILDr!&l6PU;Dy9-WsZXxeO@sL%)tV$6sP871z-ph!Xz(#>eO2?c-=G z>Fp|y3_Fauza`~E@X@)&_et*-qDd2dz%z6UCv)Zo#(r+M70{En!hd~+xO+Nz9^AGVjILLV{`xISdV-*4h*s0riA54P_dBfP{1JU$Jbld9?GOGFQNcp4 z3+r*ypHmD_1O{fi4-+JMB9Mcha1%Q1vHi)44g2ExCbiMX)6eJ%aLfAe08VR;cwlG% z#_{LzgA5;kyODhz>E{_^{^sY1I5X@Rjc*SM?U>#SjN$r>6(RW)uky4+c}=c~-R}Dj z)SI7qI2>ho4gr4F>%l~GIL2Gz6*W(I5+hfkw{|2q9p8pp4x6CQX3Envt+-F*dwp#L zueRX30s9SeN9r)&sQGmO-1~-w6_>rT9QY-b!&|Qg_~yXUM-bl-VamQFKPFC#BW)WB zmGedafrv!mwd@W+7!3i-3q&SQmsglIe|ckx6(XtOV-2>4j$FcMUI34tAyCcuLOreV zvZJEs``!XTBzrtwo#ev-(3?F-i%|5A^fs{1JxBCHDad7?0A;g+`!%q2koWG#{IhwC z*R|e#j8ZRA+ZS-PEDY>-eaJu5{S1V5X7;DP2gGxEkgRz*SEEPQhu}8S%55v(la4$s zhngfQJ%n#y#q9$IB-e-STq`a2yd0Jm0l;4df(pO&KsSXK90s`+^u89tmZ$c)cevn6 zcZOpxz5A8idJ#KdZbpRs!bY*MEJF%_N^Sdbf73c9wgu;d55ZSZ( zr=K$j5JQ6i@#G6(54BiIAw6hWa`!iqN)-2OHeskf<{ln3KEI9K8JcO{BicgJQ==R7 zko(Ja=x=VEVxQ3Q#?Kl%!1G?fY%8Fc8OuTH!!+m6Y~S`Ase6k1rZ?u^eUkpo=hMLb zZo~rpBv5%X>_cK-?&SoT%Q}Pd;1SkzE0(+mUA7+#MuszD%!~GioV+tWFUd$1W=A)e z&s@|K0>4(k`S{Bi5AW{Hcs0&zvM(#ygYi}B&lV-;JM4lItcL0EJ&;5}gFnIta!3@b z#q}H6gjCY@hdFiVkb48!g#!)Aibis7{B;C1#YES;g)W}0J#bf+F&5Q3o^n*gPy50i zX4q2&vqG?v>>C|z(~|%gC_D*8Ef30sg^RjFHk&|N)T$^NNY1f0ITDnU!rlT{@Nw|% zMFwphE$$R;1jIF(*j>p{{@6QovY5!y|(if8H0o z=`{i{US0<~MLzbiP4Y}W_&0j|Nws*SO)(f{MRzwh5QS_WE6gLFwvuua*huP+8$Fj!%s*i@B~2G;K&c8*fos?PbT&0w;i94BNS5|T~Vcy09Hpf zD$t*92tvvOPOkkie!Vi-VI)Z1VPqK;8^QOXkTiLgFp8HP!I7Q%;JLkPQ;eRcz+w1g z)HRK~hn=<(4;EUK;v*kS0KsvyT(Cym1|QfiRUUV5`#hwevK?XdrJk^{d-myK&yI;y zTX)1&wy{*mMcDRlQXkLk<@<&1%05T=%;vzKz;n<@+DBGv`PDwq?vCvT!JJ4$&A14s zgf3Ftf*6Ny4liZpUf?F-2sLp`f-jX6u&d4J^t3;PS9oWlkl@;iknGw}`-Rs-Io!@q z?TmtQvdi5QMiC>jAS4dQs1CXC3W?D47(~HyB8aewo>+}2yMP-h?9W(#r~P=OpEtr~ zcp=vV?t|#Yeqn_SP4c5P3JBgEs7HqEbHW41GejozIrsu0II`-`eG^f>q$uMp zoUqosDTLn1pGegxMENrzH3pw~04g?p2Xq(i@Z_H7uCz;qar$)sixHud`5Blg4Ut~W zG1db?Kenv!bTdWT8QC23DH;j@pm+Xob?e}gwu9Br=zszvcMJ)_(=Uq+ib*FX zbwa)W;rZ#QRKNnJg`+Pe!*z1#tvn65C~1>N(4N4%## z_^6-|k+jtx>znGkIf$zQUS+__Ssd{sq%r3EVZ`f5nUOB(R`dgDb(<+EM1Re z&$kYdQp1cij~PgQ@!Wr!uo_l68*Rk?#$*6S&$da}!8pVTIph8EFpi($vpissJn z$7FnD%$&;ODw8D?@Pq$Bf9(#ZRxMDk-&SjX9~p?wp>yejtN7qUqxViWOFPE%6-5$3 zlEJ!RdH*LQWGP~2!Jo%KzZ`k@_kxF`!Sjy1l(_ZU^75@Zzy;8&HvDXr)Z}ku>%0AX zzl^rh5FU=aKV)Bcah<7R6WCgKwbO1t`F28k?UMagom8Y)L<4vRyKaj~OAcQpo;!R$ z0{Vu(x+#})k0I%Bc0#6qRbH73fkij-(f^otw;*gu%5eI}-;p*A{yY)n@C03dkOWsi zE~zObcgLPvc(?ie9?4T8A1+{MXDVEi(NxjNWwU|IhIz1$5P7~=@Q#+7|K#%jy{b^L zTW@e_!=cdg@hLxF@ss^)C;fhO-8$>MA-GKs(buKVeuE~m$+$0(C(RAYF+eeV(AVsVeiey`RinRV>*=9eUv1S&hV@5_C$*X z2i@n!jXqU)v@{nGEgh#*M=7w!suNhtl4r^!ls@nm|5U%)^CGCkQ|24tqT3G>hG$Bi zoT^x$fX3}b@4`s6g+>yIpThfy6a4--Azja(e`s(F~f0y%S4#Py#+sOZk1C~=X z#z|-+Hb^MZG|wiVJ`b4rjCaCa`xSo_XvZcc)WM5)FCLVbUdi<&ycIDbf`b$)+&v3_ zTx{=qb4K^i@CEMz#sL~6=%q+!e-B5vM|M7tHCAjSK6k%WRebOS5gErpKLf*&m>1bF zzHfZ^uuI{qN!=|iKsD}}HH>gU&A>0pe2>$Eay;oxQEsk_3v&kZ4hKl>PjGL<&i0MO{4P3=%gjR6jo*s6LsRh_Og`e#-3Lz+62YV>$zF{wds*}swS#rr)Ze?$(Q2|jTRz$+ zpb&}52w=!R$~kT(!%k5%^5>sKJ- z_LaV!&dx<0c)+&UhIj{5D~f~)B;L(PiYXoB7_md=qsIY|OGF+l{4V~S_aPVqw8GcV zYgMu?zAOB(pusY?FQg!Tu+J|R_OCfp;!(bJ=k9{ki#_9LrID~zRdnUw{R~Wi3P=4x zMUL%LgM#m?GWJ z8d}Pafk!Lj_#D(bz%%ZR677c&xxq>wN@Jf8i0|rDc?+59X2IS^!GKMu2 zyT*qN#A+sH#*MzW$MW{Xx%va%e*fqHD+T-iGuAr1!ge7%!Wiu6VzQ#Fqw06r*&m zc3ED{1Bmnh{8_@;wh~0azxl1hF-UwagxCzxXZdQ0R8;2<%}L)}X!G$L9Sa<-CkO5e z*mSurU(T9#rV`RA$mToQ2R%F$nC$}Jx*?gmhJ~m3%J)~0Of@J=d=K9#zsAHT1kQMM zW(3CH*ZL5gYAJ_9o?y79Q6J6|+!%x{T46NF2_DNXAvc}J{{(kJX&?$fQ4cvzDmi_) zsmwc1Z&ia-*Bv4QrVo6e_m`}6*wK2Y<(6#@TVn`gZ}`bY_gWe=BA#|0lc#yeKG)+K zfp?0JKqnMhxeYoF#LkW^vzbhNO5lS0JNz@#W7x?KsE>IrFKPXL?kpmOTI+X#99i&bP()cW^Saw|Gi1I|-I`=^F0 z!uj=xe)BdX1?tdQLwl;{&Tw|unzI8-)wl8-bbwG~N~(aMtq5t&du{!j&Cw|s_w?ma173Za@^90=8lbT;QjHhPZ$IMx7vkWK(gP*7 z95mp+0*+lWTdZ~f*<^f-2D~f7V??L$=qci9e`}?W|2!8%mPuS~pdt*9+3?Aqa4t)7pArL*ZLq@9FaO;a zfBm^vck~%@50B;mdzcl(!sP|ZD~i?8E|6Cn`7TI^?FrCyz(;Q&S$m|_nIDzg9U}@w znP=JVj-Je=!~_vvkR@3K?&54m)>Wzv8N_WfU-5fouF~j9Mrsf^xRsSXKC7>P-EQ4{`Xy{Q&_9Wg1Q~+iB~eIKy(_ zcg)fp^Gg(_tP!5F6+f*bSAwqo2y)}p3HsxG4$s;&-yXkb`vctP`#$9%en4jyHa&r| zLr(QCPCC=lP+-oy&yHD3h;{}H>-@1`;ap4L!3Uv=z~+Rb>g&XELX zDIyIW49S2WTfj^~^8YrO%W-^EBrZ8deEn|Hj^ttnCyIAAF?I3?*ID-96{VpR` z2DOJNn)2n=%p==3j(xc8F;^j|e$npw*P5U8{!aD~uv)>?)nPe&$Ee|1)jvz zuO48h`yZnf;N_q=j zo|j3qc4*Ag2P*<~^7NQwDP4O45T(o=94F8PF~;IWWYw1QDuAT`=%T7~P}*}9&=fW< z!nO`Il(WrmVeY>3^Y^r@vRMCwjPw3`n%o;WBCK*=+V8WYDMZ}8hviTB3cnlLGF&nr zK>%+@tr`>+O^3~c#Rrg+;z>BUclkt_q``(~LTGU5*G&7h*XM$7;p?}fWrZDF$#^rv zdv~NU&t#}0_@?84qO8@)N11!mNB)DyhI1al1?{kQ%Luy;-z(pd|4=a$z~^|%q{6WpA_GrPbB`wD#IrcDerlMHtUNMkVC-jHp_!(1DF5hJL7{CK{? zL=h@=9w_>Yea5tMsjPj$yh;GGhf6r=`gTaaC*dkiO z_eQD{4?lbguF9FaY_P3nbdoC`iY*6+69ChL6r6=A#jB2w$r#ezo3D6D6WLGt$WLFU zWm4>!Fc-$T^u08`cFeO89micxKgK&=xr5%G_b2QNy!P~5bd+5rxFZ8UCRB>aWL2gA zF+)jH<15BsF>{oFfq+pIKp^!V4LYRp01cZnUlxjFqb4wlf;| zubAmrh0ND2-m6Z=FVSmh%&&_OBwY+(M(AU7;?jft{cwuxC0C!!MIwDiv5EG#R2=4j zGBA6+r{d*Dc{m1q&D8lG^>2>C4xUD6{|#+)2dic>FED+1$ntbL=Fe`ADsly<{NFJt z?0M`z4^cSgRj|5fn>99CCM2yxAUUdnI=F;D4B*qOJbFX22L=;rJdBeVr5<~_RUvg}XbcqiK=Co#Gg7h!|aqK2&D7PK5I{>xySkEF4yF^Kl z&;hWOJSAXtqpII$kUt1i{hm%26}JnIn1y{}hBx1M7O;EzU*jEBkU_YgKe!P%0;kJm z8I&@5U%4j%y;}4H#`#z9z!1M)to^bFklCySJ+9Ar5T1=zYNY?Jm$;{Ss}o*(uT3bP zKgTuex(|Ef4GN z-QQv#x1kR~t#{SK;m|+;w z=vLG^#(p9vLl~8dBm3R0K7{3mxmC`{;MQO)%gH`Tuw_c0$OIMX?)^lkPJf?)QKlF= z%xZ~Ds;8&>FzHD4&~eOGv)v8XVMkl2j829Jv5dRB0yQcy)syPV2tJikk@>@pX?-rvbKt9H}@cnt8782wD}P zxqDzd>Cbr&1|X!t`uU>F(|!xi1Qyng6r|*U(ZC;j6$q>Q$%KCzBtlbE|3=TP=gyHO zad`ypD9SMU(@?hf42sI0Km3A4N6w5r1g^aHZ4g`6vTxS}|i{`nCd6!Kh?dh=!$ zpx790W+q%!v>hsQwaD)#AWlv6Z*l1VxWUJZu|@yQ?t_$!9nQJkaG)c$TK1JI ztakQgcVe((|CvFqDsL#dO_y)xZw8y>3>N8rIGtxGL;AG;RbuE(b@!meZ~dK`mP1mi z0r}>F9f)8S6yVXg8b$|XxqQjpSL9nQVE;u#sAtb{`uzbsk52fsTJFmy+n&=Ws#ha+<4)u+>Zpg1sS zDRy-+a#2Y|j0^tPrfuHvdm0bZ5jCAg*2-QxC~N00|K+hlyoz*B&Q~BPprM0FYi#ew z_T~_|y`^&dI*)J6>lI=OuTp>D2JQCDcOePS1yyL_|8WQK?&FWT4-&{)e_A(Q8~(da z=#)lw>Swtw`7wr+a3-p4_O-H}^fqrj!hXO2)w7f$5r zl!NSL`;Hq=A_aRx1v8*kf6b%keDvYuRUQUU?*UKAf|zi-2;jJSo|00+{G=3L96Xz6 zs8>-GJZMIY{9ryraiMvWGkHk*ZdY9pQxXDkDk(}(tj`?hi2iKqea8Ve?+W_w>80mWlP2xOj$;Zg6ZOr zV^x4F;@S$sbb)xOsabo*LwDK1CA`tV3n14y(cXirM9EOm!upq;Xx}5Ig-n8ujAWkd zbeC+D^|%1S!8JfQ5cT)4|8wE;OP8u#<@l~NEVr5AjA}XAe_a}huyI+>7;p$Ga##M>%1(v(gq<$Ib z-m?Gzg?#xyyDrq0kq76-ZSKbd&^pe#MYm2Fz#TXw@1OzPiVPsewZ2?IQ3!{m7PDId ze;^?uaIPbVnO-XN;gL%9xGnebE4Jq1jL0*DdP0WIRf2|UKumdv2vXfuTDloh&LKcoI(h1Xovjz@^uUUECvxUrUhTRF7+)O%&-#CsnNc$4{k! zl}fFcQ+(C!i75HRS1#AXyhf0v>7^ge?*VrgnN1xx{)oaD6#`k3G_@u=?Vwb~#6 z1AT|Ktx3L{;i@6)3#i(J0jg!3MFv~tLipV$JhoZ~ah5oWopa-mkggImg9Lr5(16G6 zN%tP^wsZ4rzAk#~jEWvRJfR;2gR<?NAppjOzl>x=*LxLe>OgVKGOH)ub1qN z%JpviO|Tjko%QY#gSzm-@6Jl?Q@@?`J5fE>qrnm!_V?f#@nJc^i8^2`Qq3TNXkZo; zMd#PX-8^4d39H5zK-3W>O z?wdx?mb{0DAI}K@ANR587?hN3=dlFB2*pN>Ni?KK5z)7yxzf_iZ9Fpg7*b!3JAz}N1z28X0Gts+_ z9WpZk#UPGMiTRHS+pIjulxWVl=XF}s1ovF%-?~(qv-iMV)T2F#6rJN>&5lS{x< zL13kjJgZ{X*@Qx-5iJq?8fh|`Ml{@Hd&C>Gs9Zx^?5%?uM=s|BS)fCV=lQQFk4^{?-5*MgGK9Hv-{4`QrlNag zT!e+xLjJEF3l#AH!mZvS$;2125}3b9HtN!AnS8j87)-ybFS)%FmBuU2h&n1BMdXur zwFxO+2x?VD*uRPxvXFDBOxE%-aCx6vu10D`hTJw_gb&+AyB@Wd-iPZNlN4y|=GdM^ zl^#nBs`_~)Xd+!+H{pA>1UEQBiljR{l+ggfpW6o@ANw{kG#@<90KDUw5xUGiB@oj@ zc8y@I;XciP)Phq(IxPRD!0{i-r91mqjHJIWSVoD0HiqwN!4*4jRlW6dn0=1$=+?&` zsn@GIn;Y333s0`#ylb+O0=^v0H-vd96ao<2<73UL9l>cJMu4Y1e;w(mJmV7M)9|ZK zTZ77nTckm?0i+EqZEd7YY}Oc{!A<*egcw1&nu_C;6#wUx1fesVpGoT1nU4+_HIvmH z(gSqh@vTteF)~OL8cCuoT+o}}vww|3uc~=b)QSzZsOVym;^d^GFEZ_OGGieXVGr)_ z5cF5-s&VlN-3cSbjxLpuV|hMk5+P0=xL|ZD`CR@(9)PYvJg7SbA}AWj>AS=E&i5a32Y87L{F`&Jtm&YV@M^N1-I;>C>Ek zc$HT}s1uOuWe`ry4>DvkOg(%uT8L3Xj3e#UpBUuty^M%1B}R-juAvA#^$WV*B;LGq z$fqsjCg2O|drn({#DwJ1nsx^QAB}R90$H%rq2d7X92@`f^mMY<05EH5OuD`4{oDTB z_woIpk=p7HCf5*D?zO8W=+Tg^+EakGB)b?`+aYv6pZ%!m{!d?j zUXD5Pf~ogV;Ct5H@>!15lY-KR`uRXI_DX7yC_E>q`>H1gor~jI;hvnHmpRFijz6}P zAc+OUCusW$B}C`q{c;gngA*G0!D%yEem-GR);y~OFwWS$S&jGb_NSb8wa+>&;)Op8 zbE1dWI|;oM!Pnd4q&>1GmO}*gts73nPX7b%|ZY>{1Vf) zxxdWtjqAm5tc4cP^Dw~uR@~KD8bN~61{eH=k#`s<+w@ApwED!RyFWn0;nK~BhAty07Srv)%Ve&}Kyi$Kn9gZQ2Wl zeBb|K0`VR))VPQ7`UUIMYueAg=+KHyqNHNZNtLyrXbe z$n@>`P9ufd?hupUom9$Rf3JEXb>c9f4Vy(QL*#t8Tz`!-0^w-S6a6$mRzydy6wFeC z)GH?CP^U)O#qiLNpFbx8V!fZL9xT3 z-D$h9wpGb*pUQtMnE2ckm>sx1Z$sL#Zaaa7cZn=iLpX+b!~R<@vNd8}^LjmrsAcao zX3PzaBssrFs@O>i^-opagSQAB0G`aIW(#_q>=&|sXSMLGR(*E1Ew;fEeD(9hkX`P1vc;p2r~Y12INgR{G10^|(Yh)aSFIFEM`8=c5|G7K4SG3!-uYvniE3X zcFBwfnu9w`b&D_}p1HB~+z=AlzniZ-7aPLV=)bD3{jrJk+L~8rkV8@9 z_ZuhZKP|3Wku#R0U$H>*CpjG|I@AYbWB5K4)7Xt@mT5bwjByV&sICw4&dUV^&XTCp z9dyvM&G24L4ooZl=50yccX@}iMih1LXdL`o|EDck9QEHz$knX#7N*1>G)qwj-RNm| zJe2d!7G~A*7zjI3w4wx=xSaYdDLhP5CNc=TU}NJcbVa}*1)USNMr}Oj4<_HZj|>Rt zk+G{1RM4)LtRvW-4Msu3U7M}!*@*#Y(CPHIrg$n6Ao>1~NgtRmFzHHt#S2VB?7$oh6)@dB_|M0sU%ZXpsgA6&ZLe*=AFh%8^^`#&Qu|p~bd`Mi4~Yh?vU0u0V%;(V%^M;6gpLJO{M z!B5~{o61+oJ%l#{h*|N`*C@aIlQ2y;s z?QeRauDz)U*f!8BsZ_&;-&u-7bf}~OpwJnA$Ku<&pK8o_Bv+E--s)rR-=)p338y1_ z&E=W)dL9D;0s0bO*3xlb|5zv)Sju<<^3F4iP;jDPE?vItbgR%&hq!94{qd~=^AZ0; z{4z{$-X4F^Zr)zjWgN)k*#kbzC|_VR`&pyMg=|3gK>vA+JZKz@d>Z{AQEG7!ZgTcF z4Q$w=`GNc&3?0ZRpoXD6B@-bAW`=fNm~^ zq=O$jhHoO;_@wikEP$s~<$TgX~7h$doZ{&i_#%)5WJ4%D)( z-T8=SbO5L^Q2$!F=ql`10<7;ys{vZ%vlsWPrQN_VprX`~oP!ufB}t(&*E2M9I*o~B zk|dvV_C`$!9u9Y&@yFq7Y-o)f-+-=oDB1FCpLTK|=uzG+mCO6fU=ly49DT zCY%Uc_^M!R)Q2iHUcxU236Lwe|ClW7QBQ~H^|h_JL!$+?F2c;XT)Y~Yk?%`h27&aR z{921iSMx#Yj)$Y!W%5nQ9G~WJP%QI1$tkaPsEwPnWxe^C(hK!Ic1N|a_h2|ct5Wgq z&PfCt{dfW|lx#)h(SI*@<4)WdG6EVSGd@?2CgzN7KVBsAl2Q-r;D4C9vMoimW&2C0 zfcQu&ptK5zZ%U5>f+FbG-x+4@GwvCAYFB1ysx)gw%$SYYU8%B_;XFOQaJv!deqRma zwdHK?DhgVIba%WnJjN$fkJhUaTQdqEi>7#MZ;1>C;KO#aKsVAYTG(p)YpCYnP6P7< zX7j|EYuQy?C?+U1=i&C-3-@^L!4T{cfDXJOd~-4kOlC} z8h^u2zbTlgDk#un=Uu_21uYB~va?mgJF@$jQQH##xT!GeJ>3WRVoP`1@!)N{%Shyn z>Do~NT=TI`w-Q~c^y8G}K+Er*OSNGzLc)iH4vx%Q*JHJYDUY7mK&g_B;&Xw0@ zGuq_!t6jep7LSVtC-Kh$90E9X7iQ}2brzmL?{%wyt$w3AEQfcPVE6t#bkVue2f_Kk zp9VZ3Kv4nrZp*z`_`!0k2+EH-#3?Si@5aD;)QWodebSM5fVX%Ns_!8;y%=ouY*zuq zwN0AhJW;f#g8eSgfxRxhIe{+zwA$H)gGsv0fHpgQAT2(OX zHy8(amM(4tEEaeoeXUNkWx}8{Nq}>#g}a8GQ+wLW{4eEUd_%soROJmk>Eg~^9YMQm z;P$|kpXHftj>0ElZQ1`^ubT0Nx-l4XxW0A*>A&|0W2o+?!;+Z}0myK9`&zf^F_$y@ z;Q#T#@#5xH>o)BsUvwx8&ITz$lGpDDN;y?IpLAz1$BEtP$hAP00l?CAeu)?L=WN_l zEEibQ=x{4LOvjH)VQbaacVL#e`&hLvft53U0UFg?d7h8*3RK5Z*lUJATnHgPypO8@W@(&u=v!v-1>`TGVl7&xRK z2&$T1eWjtGpQ$H;1qIiAZpg0D&IR_v$B~qn!yC2+HpISsuaWQ% ztApXskT*;6Qz3A^gNf_f8s_K$6lC<_HBvEn|3OlGZVUv!GSEa|LIrMefM8`PbRpvkJmOn&}B zluIw5V1P7&oN%pFJ z=I9V9b%1sUiB`g`wnKsSWq)(pu?A9<;C|=Q=2ECc;$X8ktx@3uDDo4Wz3^4Ipj|~N z_r*B@K7=;P{I2Nzqo{nt;$^u3n-RLAF1>%A2)`*t>Q$ueg`}av8>VFUPt{jv4C*1d z=&4Q>k`t30_x+qa=hr@3$i#KJ`h8{k`!yPXtXeH=^Sf*`2Q zfSd67G@o#{1_eT~8?ycvJ7Yd6BaWcLM zw6)h)vE1o#lTzPXMTev6J+vUAxh0;B(6r}Dp7-27JEDtx+BDclaeb4v?xYkh1!(Xj z_xn8kHH_kUD?Qu~L?uI$-k@6`M6^@{Z%m)I74E=M8}CR4Nxwc|Q~Vpu(754{_gDiA z;we=%Dwij1q|?&gl>E$aDEupq6|(d0nSc-uoq_9|;CTfXJ?gY|PV2>s)??$(Ng2Nn4z>3p(fwumr0kP57DWw4&%flMeAVBhp)zk#?cMzA z4Czh$(D~s(t3>9rY|>v5GT;v-iU=rR$QR}nRk~&29oAa($rpx;@Z%dMU6%e2NLVSlt0nvcG20K|eEH0g3E7f8o}{UgL;DD^cXUd*fF%b+v* z+HiyDh_&#nvgvW2@6DIXiyK^@h_qUg9&A9aVLQ7Zxu~j zf{}$eH_UkGbhWxmR3zc#Q4Hsc^i2#nYSl;d`*e2_-ryR>8p?^rE$I za1K#N1EFMJpBM;npqWRE%oxN{@C2*H=l%wj{U%EZ#l5TDVh^C|q>JlcCF<7dRI2qv zy8iY&{@kEAW>PyH2ocy-GGV$u1unQZ)PcFUJ*bSpV1~gItNk8=414lPdk{ARuIJr? zUbZ_70l^2PF3ma*OvyUOn1;PXAUauKQ>SlahFJ;{(KZj=nT{b;+0FV(jvCVCesRA; ziH2A2mYoJmiTJvyCgU7+M8K$?fdr8qXO9?~VI^e4XCqz_aAU!UGs*LMGB7=Cl~^<< z%x0g6l}c+EVS!biIUjPY;(&McCx+3%_YdxpXKi!26r0w8V4fCKFz0Q!u9JdlnJvL* zzU-oP-fCEd0rm*446GnK<~MuMP(KB?g8_DxtKt*`xB^BoJU~QQ82|+~X7xwS6aMoZ z3eG)j#;n$OV0($Wzq$C0@JHX5Yh#D=Ci}?pGmT5xWm}grHU?x8+!kB*gun~2#v-CB zA$jp>j~&o#xE%d-x@)ukrElR^JzMnXulf{%j$ zE~s?$SvSK1;ssk=Cx_4h&53Av56p)*#cjicacBN0JVh%&HT&VIhsQgXQ__ zG7oE#vb~pkALhSf*n7vEr{uvW%1G^V=#9_ug9u1Q+rmenl8H}qHMW~~zVho?z?%+= z-2>|zY9C20Xswx;drw`LrkeEc`66Cmirs9ae)TO9-82_O7cP}&oa1{BfgvTiAK_XJ2 z+C9C07Rz_lVZlJGm=1`ZVAfexp0;_XSP((x=WWs|AFo!w;;nN4q`*ZQNjlq3WB*ps zyWKCZ;WOMu@Z5VY-cZ13tZr@feSS72@i15C@~lK~*8+Zt*F|iCIOt*dqb59z*Vst4 z4LlS|eVKUiA3hFW+HbW_{Q~3DZInKsb!qX8tj?d+LKj7c6 zc4*tDPyt$}@%F%ze+@!I=Ciygk2dD!#m)J?uAscZ_fkK2P&K4MC>nDKk#B^_88ukT&H@)jy2fY4#L75p8@Gl=h1eImbc+%bH<1b{A>?yjED#7^8`LqsdYthLMpAEU38&x*YhkdvvZEC*Pf!@tZq2YD z4z2rzxvL83expZ!Y}Ob8n91uSJ&tRzoLBqpZvZ1{$6ax;kP?G;Am8B{P{)A?4IQ5Y zXXW+KAH=&e-4EPFAa!QyCy1nQ@0Aor&qRY8ZA{ zZ#`)KiES`^8cp7U$7#6SQy!8r75rXFVjj^Gj4CAKilqDQ&$3>3z4+q$r zJZ~g9yk$TKaCyqm9)3Ue2VU-8sBYZv>J91;0(mr1JO#!Utd@clym)QA2ymZlY3Ac^ zX>adPyioq?{%~#xrsbEteNRHz6ve{qEsUY*pY=zGad(AoZwZZ*RoxWGlh2XzP~`pZ~ced#Q`bt)vkk+o9Cga4RJianG&^l9zLOaHG;bZ)obm z1-!l-Y^0uT?0tmE4jiKKM9||gFDXz0(vB$AWC$Y34jtqLW84bsE@UVC3gBVO&wPFs z$D>xEH^3*M*_>PWV0goU65%L&*;jcRZk>si!%>*#ck3~jP6{WPL#T|8d-h-3O}0Xk>xzIeG~4O1K%j2NUQ{2^qU}?}BT-?U0hhwKd_WAto(@8O z`x#F^2Dk{GU>g^pd3*?q$BbO-;Ra`mY6o7JT4q0065IodtG?N9m_RLd^h)@A7kIt} zI-TN4dS&za?U z_++g32vh3Aw|G&jvRZ#O?<*>Ih>muSYupZWNNJIf3Ga5Vg))8KCrsy3Skg0B?YSHG zR3^dZ%Zjzn`^h`N=fMhrPZnmW3y8D50Nk>e+GNC;vd&ieE>w-NcBku)cZ*-Uk|{CzQ^vbXHpK&QL_^b?=ouOJ5XtN>JN(5Ve_?WRI^bl;%6 z6brK(nzC6zKc;>9rHS=$^98ndlrcZreCk-nF)BIt2iR}mv|k&qC;vg^vVtDdRm4pK zL`7SQkLijTIgex($-m5!pWVc5k4RUz#{`h?7SoS^p1ZTEg1x zl;fMcccI~1te;riCjkP|=^{~b9v>ojw?~WwqCg&3U46q@HFAvtRbBo%AuFbc-P5Vp zr1L3XpCDeo9hdM&!esX@j}rnRRb-Ir=0vy;O&fYu%@;oTF6b1ih=byys}pvr93bUz zU(6b6&L{_II=IvaupJxy>C6u~y;{`&eEbe5L7>1W zE_1yH_^iKpfZPBhGTY;3b8)m5q&PorkurmqNemUHZ3g1M4-&Ecckq?T;FYJGwC;%- zH))P8JPYu&+B{)50c#&Dz=gYr*Nv6LXgb7d=HDwwfuAd^_HJFpvtptNMY5{5_n)W{ zOmGhQ**#fSz6HKZV>oRyuQj)$sMo|V9Q{?epY2r10Kp_NAtRpRf?sklvM$IZw9#n(? zBGYmwu^P3dzi~D0a-qj9`bn=FW5&obwrQ~F;*#=X)fc|b6H>(8gT|Riw3(diW2gB> z`nB(BumDBqJ^+D#2K%uBnP>?Mx;rXsEz=*o@?IQ={BHx#O!88*=^WC#I@;;@Mg{~l zw2Kx@6}3gUa`5$cY86(hr%KB70#U|c9C`+x&@Mh$8I|VC^Fx?n`9`i6er%!r7MWvz zpsBS1Xb)(yT4Gt?<0TY4snR_yu7|3v?I*_iIv6rY;P}kwOJFAUBe|e-(MJ1yU@DSN zEqM;Ex2f`OrUigsL~T=YBb^}ZG$A6DWTfp%x(L2ExWC+sX5d_{3U=oi*yu_k$1oIj zix=V+rH^z7w|s2y-5R333Kp%IIY3*xfG|4K1xn!^FPAtzHVWzWx#JzF0zCYZVj=@=dPkPN!6i(&V7l3l`V2@IlcV1GCGQ-oiw22J>~q z@8Q2>x?Elli&y$IIUj*w;O0zIJ2hqzPl(8Q4JR){eBVo4oN*2|*#gd4eu~j2PrRqJ zz9O;{|2ts(d+!14I_2?ehDzy+l2$nr^-$?(E6{OTKeJ-Q0-aXr0=(e4$E?6UP=&*6 zJ9UtVDZjRZ5G)?18WbgS3g)2WR)w4!VM>qZN)hx=a+w?Gtji*_Q+25@~T#n zzSvmh%q&VHg~;j2V?T|tR=h6yuRqP$NVeV5{&LS*dJfLl&TIMz^g%syy6fI_K&+nv zPAPuU(tM9Q+J__UIKFI2=?Qg2afKPjc2=aoid*V4pK!>r8xv2 zUJ>h}d#t(3y51^N^5oGGDxaDdSq12Ga5?T8R0tPU^id|uigJ0Il@DiubalBOq0B_2 zPM5*48ZQI1W_i!yNa=j9m7-Me&pi`_Y%0{N=jF#ls^9)019U<*9!w-I)P4mzq=j$_ zVxmL_i=*3p-iW84*+kSfw^l^*pA^gR7zq6nQS8dadjXcj69@W*1TfE6^A>3Vx4^&T z!1&zug2g~cI0$*X8&4F|NP}bcISzQqy?zw`c`QL82^S*>z%aS)d8aI%2Sl7uJ55UO z1yvEIyF3IU_APlr2BP(Scnm$)x@$%&e9dD1TBiK02mY$EtX2&Fl<-&4_Fk@J%z%!3*E~>shAEyLE$igZ1I9D5; z?sq8ab?b{YD@aZd!VD489xhGwXrKo@9En@!X%J=!MG$k4fXj-0o+;tbPD zd(e-7Wlmy*gmCfuOCpdC>19`Jq0EK+ym0UB9>RKuWer#&u&M?PKJ-y+j|!1PF3s?` zQ#ur%$BMtunLV0;YKA%{xI>T#x&g1E)4W1$j$|Qhh4rbH;v?~kB7huefx^q)WZJmB zeOHcmWS0BC4dBA!8u<*1Mg4X9tx$?mT4}VB@99_#LGSUxFX2dW)KGUtUWe)N9qGSnt6H*nM z>&-i1WaeWTvnpcs?Br@kGsS17^#=s;6{31qy%3*P^Yj++N^})X*Bk%DmR(6|9qi2T zP-x)kV@HA1?l<4adro}@xw9*&AwUHsiMM!%X3}oE5m3+J!+85m&+MxOn2sj*Ak3fN ziK_HL>;X&_@GUKk?7QR+XmK9MbsqK#c^1ESxec08gE#@~2XTkX(YrJ`8n@FODxAk> zI5-@8o)b%}1OM!{#{u*`tg_Etx=X9iIeCAH^S?pqFn^4=(|Q9Q3cp@sh5x;7K=!dH z&NoUIY1)?GY#XKR)JT(#0r0amgt_aza8hx=>L^D10+Y7v1IbxsulQC{2^vNMnoNU# zbS?a+XPea<2OM85qyE+=I24{2-l;(#Fs2PaZhZVBuHIcw6Vm{=ZLiE|ys;3{RtGeb zw`2Qu-O6tp+^6_X$rvvr-=(`RqcV(ZVuk_-QVf#u@FNKF0R#XqDCFdD-9JwIut%22 z?obRa(M0CLPB_n9J#oXHBfKB2g;j(E0)+K#!tTU0+Kv$+Ov6)hJV__q3OzxK}J zJ6Mr>#OLY`t{|wN(q1Mhf(s!*alop^p0~)&hS*Y{9kiJOv_Ca-Nr7l+`p(*T$`N%W zoLl#A9dq%k#H?RvX5*5kF7Nbw%uc^ZM$!$nzjW5yZa?I|zUkw_!8BOWH1XrRRJ3Ac zV~)naOLL736BWY1J9B8Y2?xkId)Ob>#Ad&KIWDU6(ocV3X@X|I_ zPJvme7hB zKfX`{8@M%pmC4)1eh8>HkVhbV$gvU$x>Y65fG7|myLdZ4&Ltri+JSpwkBsrR*=)b( zUZedX?vb{A3c&5>EOOc%73~}KzugK3OBEiRx2s(rI&A{`YaG4L#{}-X>R&xgu9}h} zu*xa4y}&Im2%(+trsBj|5#ai@rW4^g_`*O7s+8dG8!T~OJ@`Cu8$oblV0Ib#D1XO( zdLAC%Ks6uA4Fw~ba9qsDtIaByvb-^&JO(S*D_`uH_>u7vn zhfS4?%@gW0!}$oqjTbO22=lRX154J9nCQXM0k-LrXywzHte84jG0nUFxJGv78NUz@ zgB|VtyGXkED8GXFq8d-f+N?0S47e@O(#bP0A~U;L2DNHc&Cvmch5^v0ni2Rz5_G9cwPZK zPaY!bI>@yrV#U^&qwrb*X4|es7?xTm;89yA_D}_fWPg!k-%CQzJ9GvsSG+Eoa@;mH zmJ%%sXhE`AuY~A=Sv#vyq&P6dF!e5M)$s`Tce8u#>3i{q<)2q-5396uyRwXfZ0%5O zLpLT<;v(`{akre`~eEjzn(JFFp*Jqohv5`>KZZAB47G01W(z?xEya3p95cSxEPDI z4p&jLU`f_i*!3Bxbc_dlvtb^CywjQYz=aO6tMfL*)-Y|HEBW&d<__946SBS>;vqVI zvY?+ggq{ERVC(lr>S#YTys)73*ypE%fHam@ZG|)jE>Vy-OlJhR*=(VU3x`TOVzm0T zsY3>;%fcKD+Z1 zLG>)j3h4J-GEXlU2g=!-;ZRWlGliF`rp#c2TKBySChl)$a|%l6g&M?Q)~p*G#N~`= z29R3cE&PXGgcOJuP|FrXJMXTJHxeN<1U%9j%LnzoqO+w zjGV)z2fgA)NdSq+Sv^0C7+ZjP5X)JKk#e)%mb`&0kg{2nXWAFdXmqW@X zdiLLMu@8V&6|U&fZA< zm19I4lz^J|+b}^j27H@#`2?^B@-pTOWU-6orPzTd+z0!ze-N1fegI5LY;^c}70+lK z>kw^V7i0_6vgd{Rf+4~L&yC-wJLJVEUa`SHE2@y#bG<5?o6@y0#_4wMgOh{H#yJP^ zmK%td@PH0xdVi~9^9kf_Yw&nW7?A-n-rgHqq`GAZK6>jEw-Fbm^jacQF>TZfBj%Qn z6e~ykx$)uEPjUhuvrk05lI7wLBiVySc^-Dn<8X#u;}PW~Ep)(+YH0;li>xKYQpb6ec=_zKyArOD?<+#rM1itu zf3A+~-E}7_K~Ll@7nXV!_+5e$Sr?fy1+y=HUW^GDdT9FKr?ve8ZU=bK2FTNOse*!5 z3TO4bVU-b%K)_L?0HY{imp=oaA~OoubGZeF;LtTDlhb^u#3{N{N4{#7Da?jeK1^y| zv2aHsY@ByVYfYhUsiB8E2_7hR!=g9@gZ~p>AJBRCJzkb@*D@$>!Fv=%&-IW==ZtOW zsSi242jKkaH#uQ(3*ANE{-_>Od*6uUdVT#%MYh!53#WEJZ0r`~NGhoxyi?FZ)qe)^ z;|cEeaYCSrd{0!QA-GQrWV)M=yK}3Z+OfC>=|HQ(d!T*h@I^w5c7PfHDC}jdX*1aZ zKiq6FDZ}5Dm1CMCLt0R4wEB|>72@`dL!@N`<&T_R6*F7Y&!x{Pl+;|Zm^hlb% z&Oa<_g{DOfk?_0w;>yq?W2*$`gG@kzAW75U#x zcNaEVRfyfVq1d9xV3biv?DmAV0RSJLr4CitXR82NzUP~8 zT4};XI>+#yT_NmQJ*#aaH(G@{^JIWN2;KmLD;%pHo@Qm>a(r?brNqgA?bohiEG5~9) zF0l`7AF{JuUBC|kpq-`L{RTG(ELW+=Mo(MZOJ@sy7~PUcEYYO z@1e&76*vZgYx69{P|Fysw*3y$MQomtV_YA=NiK^wVgL9#J)pA3j8H3J)i3tuPzVSP z_0o5PLVdi7o^|e@JC0;tIr-7`=N z*l>oc;>SXzY#s#)metzEZq3cOkEk!f+e(4hZ?}6Ma2CSsX%uH$QJD zJj|_KnwnYW_xfwc!~j019&~S*{ys-IVkVP$9bnqCb4e`aUCi21Ux;Z)@Gjh=w{|{D z+hSN^<;-Vn7wea)^rF4FT$y{7P9QJ?ngN}2Lvyj%to0~e#4mWDM98Vbr^Gsc)E_Wm zn>Jf=UbGN3!`nZfM4^DgOV2!@q0~dTur2Qo0g6KvF?T)#$(~kao}eJwpn{tXihjHR zHbV43(rT+pX=vImt#05SUl|KG5R!UMahvzDoo|MD`h|Z>coze!K^H@SKcf)8|Hx=L2;66Ro14Wn#VR=n}Xur;UK;eY}Jxe@CKr)qOM z-z3!L6A)J98w3C-@f!vp$tX`lFnW=89;7dfJE3b$D%|OtLIE{clZPrSFk+729D!?# z^&v!o^qyDt+4`7Y7B7nX5sScRz>%PJ23&K}$j&i!7P7~mZ{n?LW+YUAl!~l8Mwqi} z+Fq9*5MEOp!Zk(`Sov1N%(1q5KlfYICqibc8R#R)Z%2N8b`xbXBI^&_h)VZ)R*f)| zeLOyRMffP|>-`{zn*lvf?tV>nvz+~vs=&-r%1z{mRhzi1(UWZ|+DhJVu)}{S;}A(= zn9uzp`i9f@4zDymdvV8Z^C&}6!mMMjrYMxZ`HolA@>~IEPeToH0~~{Dad< zUk)J@!pn^0@TZu?q7PmELY>)1ddKbtU~Ys~*G||nWO^|hZl{85MR?G!qLu9K(N5w4 zP&309q#TxbecUbNOO&{YCbJOO(6))(OA!1&fbyYJjTm@urjh7_KZ1V?;c-N_%K1X& z5S4{kInSdnqs~oF2VC_#q>^ICXKpA=bG2MFm1=4$1C$H!LIYcQQ3Z|PkZEvggruj^CMg z%hiqp^BtB>`1U$~xZqJ9%_Gj>vDH8_ZKP7dR^3uWskAEc4>zu#wTPB~l}jmPGH1Gv zAolvI^;m&6QwEu__6o+5K{fY@eADy%Sij3(HKpd4{p z6Vp-EmE>NPbx{)GYg^w#`epc#=a+ouOHywdpE(A&2`CWT(YXhKhUw)#Y(5WZzrR!=e&gNEa7c&`fp72yR0UzCznT8FMv~|| zXOsKTs3Z3C{Gd+Ah)eE-vEUi7J(rN<+Y!$En|rP76k!#&cm>gP6ti~+2`j&q{s_)| zZ~F3Ze@Ly)Fb7np8JugeQ6LZR#2IbAh0D;k=Vm@lg2M#Qw;v9E(hg9% zLeLeTl;$j5Oy5E9cv~aqM(_R@`__KTU2L`DNEPz^T;bj*mg<8QJALzaz_MYDkTZFa zRZrl{%>x`0R~B}{4^iqoQEKfOVU_IoUGAk)#NB#)*LUEp>Kf(db9$i}#=8d2x7;^J z{}D8VsyK}_a8~8>2C(6;ILoUvjSHg=Ekltt%vNtOBY|hMS@JaU#uy6 zb4p+H1!%qL?tAy+9xH&>pYX@mhh%s;(&=_f_MjgUVUK+0)i`)_UYa90?5@;bkWjaU_rw&YiSkNM=ivyX#_Q$ud0?M^p z(}dA)ExvtW*od?X`n1K2I;TQ|r|pS0xkS}>U~+u>JE+oUvpM87~3#0-}if z$mxibeQa*ju5X1an(SqWBE3rPb#lyx4tjoc3OAt%oXDJn3#%Z72{~zj2Ldd2)lEoS z>n~Q+ste<5~kkutM(&;G?~c#M_H@^$<)6 zdcVy9yluW ziMpnNod6p+<`=<;&{KWT zfSg5`=Ud;SOhj)TW>BB}`}7Rx7_j)VptMHznjhDsZOfpH?RO!{oqJt6Uxp{-sV3KK zS}8fcUX)8Gd0euyCSIHse2`r1*w+_WwWc{Qa5>ZC;z;;8!eEB-%*_;@um}myGUo&% z#&Q{8Ij^3pT?5lXSryerJ=Mf7Np~Tn-WJ9^hmhT@=(FMLz1rX%%h!65l5*-urwOtM zraj3O+>xx}Nc-G77*NIP{6IOp87$+NIdcQFFI=4};ps_xKy{kJtqbj#;T1x5bp-h+9)zJ*Q? ztHoos2j-F6KjjSGa{aj5kl@PO<-bxU&-3o!9r(i&KhQ1;XyU@_hV3n#NJh9a<3}}_{0a5hC2)t+Wo#738g5# zC|!lP3R&$MjR|?7rJZ<~9GNf;n6{Q{C-~lPAWwAC zjGexdUqiH-$>k<%m`mqncQ~~|Z3MEJuuGhi-MJ7j0wit!;C~a$(#>*A7AJ+8zT5B7_GDbKT zjZWGygEG$y8&X$^4S=?)m{Ss}C?T`{^qNua*WVDTJ}~>q*R4XyFsmK3mDZJb1$A^S z_t4KE28PjVPH3DHyrnv|U$PApFj8+#c>8}}-`YAUm==``swEgH-2ZS*s&258zDhZT ziwqhWcuV5a80;_P#^BB1$?3mRdf=`1VO+m)LV5Y<96Ua}v6tQ)2lY_&ySwq+eO?Ir zD!Zr5lH^-FbGT#HY*~O>xPBTy$uUdCicO`O0NDD0IT6HCNdB-I&p<1Ki&|sTK5Z}P zS%GtE{bJac1lS; zKBjt}xM#CMF8Eg3>`U;Hfyj~HC8dYG_h9t6`{ho9IX40mGA5aQ+8#dN=u8P*G`~a9 zzlhkMdUDIbq1nH{Pz{Vye_Vd~0dwE+`zU4rL>p;A#(NV?&h6T{JW^?}xY9K|@jCe! zl-;TT=o>%^zf}mL!*T9(_65&;wNSGR(CN1bmnOUAJS0^fAk{-I79Ap_RPpJy`C?b* z$OI0gN-t34{Ym`dJumj)CnT+AV`P0W-l}z6IkW-Mb$|)dx>7oBzNekB$4LK%OZZbp ziyxbWt~3}eV5p?+faR|q3(VkW-B1}OXeGY2M#UO}N-7SmPrL?0pDpibN@ zY&Ue{ug*<)huA05y8UYd`di=&IQ(D%JXJO#n~$jxN1e2MkN@#T#%~nGiJyAkJr3c+@IaGMi%6UE+}WOX_dQG}e)|tnMpiW) zI)FFM^ERX9MRoq!!|m-`_UlaT&K&$j!ENC;8rD5_?%6Y}FG9_~LQqQ^`O>KS!a+k` z(Ame>Iv8FDOTXaOJ+N5*cI>?N=0L=hF$U#9Eq4M?x#SH6YW$RTqou6hS8(J>(C;A}7J5 zoNx%hppf?6-1@!8RV!s>Rz2dYSxnw;4+t`;F*BbR*p>wDn<`AJtl@Ts!U~CAcsSl) zKDHYq@=@ROz0=*4>vuZ=fl+*{u^_yz%NZWfIKSv0%eLIiqEv~HcN72kil1W5^ekHJ zL7wVlSf$~w8et?LG|v(M0Bv|=fRQ9*G&P2i;GA^WwqI+3*iakll_TGqp1=DrJ)IU$ z5>}cQ_|R2-vu29u;r*?WaYQMJH>Wq9+b^LUcfuYRk$Oa10~Ppi0vae!ft>W`m-q%q zurkP;)9``RKR&6V0W8R5%yFai{ZgydGDFV8ugW_OK4v=y1l5H|iISKSQd}b=#^^4U zkpNR{QMLIU9bt(Sz8Vh9`n+Fm+ACjPAex_0_`l9Z4oVB%3hH+Lw$|F5u6EP~hsWVH z>zitO^g9)zV*1Q!1Y*ZVhwajj>4|OEhU)@!i(L_`QfWZk4JOR3gbUuvao7pfF;|CGO(0#`USmA!1Y-d|wOPl20oCtZN-ts*-M~&}>bA0Yy6|5+VSMxGT%KT$ zO*w*S>k@qlHWzJu>O?!l8i)AH<4;(L!PA)`-%riOz9MC-2VEg=$Lg!ul1A$`AZGzCl@7OsWRO}tLzzIkSa82aV%)ec{-TOeUrhiNJ9 zLp+{~G0nR|{*7(!ct>prb25ZN1-=x5A@sENK9j4}gJF7J-k^FY4E&hwG_ZgI|5F|8 z4QZqNGJc<)A3z~n|5#h=1Ag=GI@r-L(G#{<-!Ja6Ii8;a96?m|0lH0gguZNuNJE?f z6EK4nkiReVNNRn|Ik;>s&72%LS-5I5j3^?V)55 zgo7K?W_;B=>6#&#ZEY`L_MWvtww6}n4Re;Yx~JtDUu%wqJPtHCti%eC zlk+K2=Rz`&DxRQ~n~|pt*6$s~=IWxyrdqCS)H*A{##n1I32_HkV-XxboM&Gl?GE-{ zr=LK;+bYA|N)<6hIuEiY5%+@w@XUT_wiJ~yodh9(0`I3P*VYRp+0wd{?>_Ul=x)yI zTrL?luEJWX=-+K6y=3tsX_5my~Aob*YQz9YUKWp9E_qLk}3*oAh~w>H^;NHBNCjZAeLr z7x-k8I%!lN5QA}fhZmoP9K{h@Q;xSmQEjdd% zSB>x$YlM51aB*2ME58ChGD3!UHi-AJZpasDvQq%RurB<2#`ml6@MHkX(IJ0JyfL8H zYkotX{*YX8;tlz+f1_<_b*e#uTt1HSr~rtPuPV@X^v&rDXTg6P;}Holn6f`=zaZRQ z9}aAUHmrr0`EX^7)eFv_F!ZGcF+)>WE}>=p##cPry4SM$1OO#pz!9)0A=e;>;e*Mv zFx}VhCy4D)vLcuyR3cs0(sw?dBDgb~cjX|%pYt<=Am0^YThxKJ$@l9!t(`e48krSo zkzZXAjEtyk_ME*ZEZ_y?FOa46Ix}FcIi2aGq@#jiHOft^v`M}O6^UE=xb8GLV4!$xVT^_qj@~WKe#0@9I^$6eVNAo(OXF`*Css6^^$A^pt^MNcGrL)i&kQ406gDSvznF-(r_8K28W1`L#eSg(;?TN;M)^$o9tIO+wW02yrcK71`_ zN~(RyuyFf2-5(Z%SNPuN;Sn>AWTMmbL0ryMwe>fK3yVfSO4K?eL51aXJ?>rju|<`Vb?Ad5e&~qsp)8f`E_f z5p*#827H6-Pa{qqHAu+P)|zKtdWf8UPq^hq4t6lR;fW}HJy-n)JwM9kU1(BFV8_=7zQ#_ zr7cP|qmje;GuF|mccx|Ddmw8kjg30vAog> zs~+WhAVHI^8YJlv)?_uI%i9&ml>tL$&%fQD7mCh=z%*`PKzGK#8~4;5tS-+#C8+kN z#HaiA;_u9jvG3l)UUpfIPTcmUiE4=abgb~efHj1>{{2eW*`rMip$zCk(E2X;Cg9*q z`^2^UKCdEX*Ek|L1+>!T%?p;$L=P*b)#u>$w*dVL97ZRUVDu^8YmNkEf`H8pYF2|_ z{BymjpUBsIU162;_nP)TUp;LY^1+oC9x0G~9B!+ZlT}wvr^ddAxo3C=b{e(kn2(P4 zQ#Uo=!!tF_Y(;QdLarPa@MH?^o|WPXhG4M=&GhT@DC|>nS2i)7ErV1{^96vGR=yj- zdwY${LNBgKk{2S3Z)~yQ)&A!Mx+_aAA&+W|$fAa@KKPpMnq>Qui2zsTHJ!*}Kp75u z@v=cwgH;n_ZR@(|=xrm_3i&{{#>gTijd+=_&{0*SxTM`;1#})W*dhk=98n3XA;Z-V zIqDefZhiTJQ~oU?T$jB>%uAcNgli^1>n>%!1Rs;4zdv?`jpR^16<}q;c3O=u6jOJ@E2#-^9tI&aJcEX##)SH zS2A3*yarZ7{P;RaQ?MX=Xy+7M2M7+u{({_!wenDjmtwMqNJaa{i>M#XA zZveBH+hBJxpm0+Y5tTZ~dv}CJ7RxKTMG2)Fa=$@Yn-T?YSL8G(jc_VpgNj~250|57 z+rZ`W6+;e2;2G_dD7`dz$UEA+(59+x;W92o5s>XExZ|bnsJDG`+bP9*Ny`SNSO0(`c8)#qj`-}L-;@}qwlx5OhQh(V= z`ZXFfO!^wGsj~*wZ3=)e&*js>T9R4-cCq!6)BoQ!KIB!Ks5NBb9g_=8KY}A zya>w$+ymf3tZ%ZoE@e4;m>C9|L?V?)CAK*nPpz&aGB7I4<9wRMJMD59&@Z?F?kQP5 zU`UJjhy6qgF3v3EQ|s_cOU`A!!$1Q%y4I_}x2Wdufs|!C^Tj-~S1UXmUyy|}I|+&P z7O$x%jX?NSht!+b{$V4<0k1_50?Pq^Tc^BW?$)TqKI4GpE?Pe)msjDvvcQ8}6_A?$ ztJe?1eY}0KN8ujI1v{sC2lP!QBszK=Q2a)21mc{7^;aGHmnQ(`!m5NDYd6A5+vLFw!`K6ZAOM+`Mo{h>q-@tS+9;cqk zAyY}c%0#d=itL^)rtGezSm(QEMat4Cg6WF}V`y?Tmc7a1w(i|O_)+FhpR-tX+5^*3 znBx+&P21gQT)i)6o)k*!$A-)HRZ;~6-5m7rH?g>2y}8)%3&2w2LY?>)V;8FY-v>mP znS#UF1tG1&j2Psky}lB2qt7zw&@57T2CFkHORz!?hsS1l&(M+3$;qTnl8X%jZn&g6 z0#vi~lTnWfD}vegWn1h80^M;VG;a9ih-tas(48I29QGq+%4&=)p{PN_Ew>wCt8 zaE+;#J~{gPa(>48z-{#{L!6CX#U?d((b|M)CDfrKTkIDj*akT+sGMt%MJ!+8FpSs1 zD*~$r4+R#z_2NNDr`XUkpJ2^ssiyJN>rQsDWnpM*%KNNP>;1_jI_JvbMeH{@>MHVFH%#bbkU( zX5YhV%!W`OYGT-Hr%*^6-sFp!BOqf%dUMK9d5Ad@w~YYJ%$H9G+A81g|6}h>VqV$% zGof@VQYTVJN{1D@5b{acOnh%PyB)gUb_Aqq57c!9%&`vLhfwLFz~#(TE*N zvtW-J5s7B3Q9Py<4%O%9zFlRJWBBU>oX%)2rd2 zp`NUe7pm{RCf$%D%-Y$e-JU!6*R_e(*dgn#&UpKC%>@p#Kb9eX3+tn6Xp`2!+XA9< zD-e|r5(-5{NJpaPbmA&=jV6hJ5K*LssgnA7rZ-2u22$Rod;}T`0|1D93{UOjQia6s zN|+s{{^Kx#*mn-e32e`2d%m7s>zn@CA_~O&;G4Lvj9AaP6Vs=0>AT^F!~e#$Y6Yk< z$B^?!#}hJR_1>Is#9LS6l@KyTeHGdIc}pv)XJR5SE}agXaGv!xpXW<4K>J%Uj$lY3 zm_oq=EoIbZoyGjfJ5P>>I>HHe8O5ZhNrP`Qn-|4%k^3f9G|%pe8*jkshL8!bO(DHa zwO4J!_W;ejxh{4;a&!iW;|;kB)&R4Lkmwr=S41?uVnHDH!C$EagXWsi-j-}r?a}vk zb(Cz;iRm6-QfdiK90ZnQGtyrUsljT{TwR%f>N%^fI-`!5w2h07^KKE%g3Wb%@hq!} zX)2vWb)+idF^iY2ILqj<>mC?JM9}T--ATdtw>Mj&Za3=r1&~b zmmz#7k?*5#=RTO-mfx8DeTCJQkv%kWr5*U`atw&I11!;?G05Wu$oO6N8N_zhPuDrv z`J2aG-$A#BNC-L(Ye8YM@brR5U*H_E$m2|*wkllK$E`QNo76I)?5IYc`!HIx&Jl?) zbo=HB(pB;LK-ts84iA~#J0K@ZO_Fw@tNS8YMO3rKdmz0qU`HK=v7U4c7XwIPW+mE89$m1R75rDhjYPIHz6) zRji-;L_lwm6V^almM?#(y}cxb+qp#>p*U?1nb1rlBUKg7WrG<)^u(LUVQEg*f-THu zQ)WsXLw&S?Hs&J&I?&aje29m}>9I+JU~a5-BNw5`1nPHK9MY#?ZQ&SePGMZ>Z;&5o z`~CJ18J6+NHaI_;XnmUt+SP-$CB!?m>L%8QogW86=FYq63D{g#vx&C|5Xl9uB2H#` z3sDt=aSF|~ltGt#NXWA|;0bN9+i+`dDrMuP1>VJML}g(Cz?w2>^9JC_NoL=64Jc>$ z^bRs|a?@WDt19NHIRicKAa#`|a?TZogsNr{u&v!G5YJsQP z;TQZ1kywkrj8WK4yVeK7d|O5ELlg2%-0ycVN@&nW{6`Gq{27L^Sva7JCG-FO?*TIQ}sc&GK&jl*-YTENfSB4iAfb#nW_Q~Oz zPb4w|+MpEnj&>FdcUtv>Fgy#e_!RDd-upZ^sj}As;^0c4 zC}&O&z#oH(&ROa%d)G>O1E(~Fi^QHePkqicd~q-8JPDpbz#m_X77p~whGe@Z4(3 zF=)dH?_PzMobn^q8)j4>I<}0InjN2odl2U*5Vs4#p%NAmBIfS$1+TWP!<+fMMRK?= zP~_~)S3|BTu)dh2i-*f+Zke%y zsK{$yHZLYDdquRlT2qBUGg&k7o9C;%3{R(nGerz)rf?Hqqv9By0Mwq#{wllgiW|#6 zF|(2cGn{`n=<c`aFdoRDnKoTF*GfaMPSpj zbcoCvxc}_TkYej;^>2N9Hv@5Ts5`1RvZK@hL2#CE*8wtbN2;_zlxhc>S8H+*F}&qS z?Gdd=4;Xhv=3}!lN=M?*W4?(BIx12vfKj=Ub~%Ll!slT2DE%#U2xHE|hAEbZE18Oc z>xyh=zfkV)OnFDX<1Y{+Zxp)2=JvWbPOxZQEcehb$M-FFC?-UpQ3KHs2>H;2}w45|ZEL1G$sw1lh9+_qw7yv+R>SPQQjqVTy?5YEQ&mlk-*u;)cj ze2Vcpox^S3U&tW*t$SHe1dG2%(;8$%C*d7kOK!CPBt9^=_?k_PQrFumAYBC=(9L1+ zR!BTn@Go4*>w}}LpwWp}j3fS|Kd>zaUS(1A^q`P)G*PRPTBby&L~3vtqufug(YS-c z$ZIq(L3W0bTYeGpyasLuY0Me>&f0m*%K(*pjht{(IgJEoScb&_<}$Nm}yruFm})q0rdYn9IRXsjh<~tTK_dJq6zUarJUwC-w)|^^VP38E=9d( zBREm3VuE2oXO4Cz-uPlq=F_$Qk@SC zq)7q;4Z-PgBCwwJJZ4~6toYd&_~%|I=J88pMASAb48ML4pTQ55L;x;={Y4K$o_A*l zHBQolaAo+!a#HzlGOQyjo49CDGgzZdcHG)%k3*Xwq*WOq?O2Df<~l@J_K*N@(qTb0 zRXwX%K6g7HsJ_$cn7d|9(cR7OxmGmZ;elSk(oT16y5unj}GpC?^naWk2_ zJRJW_`l0AAz=#yB{Sc5YrlV1Kl~_7A;}J^ebu1SA+iA31M{P@21$8w%+bk4)jR+9t z$RM6i1FzZzDr%9yy02U}g4dG>1RVS_#qmAHBCn3(K~HRaZPo^*jIoVPrU$=lrjq=6Z1^SrJVB>(s!mY(VlVKibQqAS^BzQu zjqDVGzC}DZKd%74u7wSp15y2gA6t6tSTxh~(sVD_Sn%ZogMvCYPO>Z0CmG>a>F4+rM@O)Hn!X0~fthS4wvgqKk%~)W>C}b5;#*34jOg z2`DEk<$*EgV~WVR6!Hh~RI&C4#gWvCobDwcnD$(@Q4x1x3q>TO&VZi6FPMmE2#p7v z*WJsP7vKjE)K$a7+cCE)h*5#Y0-7}K@jRW~I3Sz>7w9h(2)vZT%8egJvs$)j8v{F{ zsa}0Djtnm;cn1>Tmg5YnM=g8El8B<7nASY^1u4~-E#bXUGuTzpYdx%yhwk3N3@SXT zy@343>-daMRaj7lSwTf+d(7JoI<&g^R+KwSA4SNxN4J`FUnlgo3gmm2<3hEjcjZgr zs(BWb%^bahf4nKWgQinD#9Mf3jNm44+YMs3!Zmk&5~j>*WX>(CjVX*dBY;tlME5mS ztoJCPp0{&&N2Jz^wLL)OY5tAr`v9bgl1$t(t6$gx5soZy@Fc26B z2=_yn+jD2Sondeq9OlLn(l$5wp`aP0kx$Tr5)pnI+Xf_OC1rfmO#L7smE27!YF;Uz zc)teqx?Q6MV?zN?ZeDLp0i0qVt3o;ve!`To2h9YaoO&)|#r38%c3@;7QL)dTwvIFmfx#~32T5ob znSHs#e@L9Nt-dT5m|KUl6fHK*6QCkVf`=+{%LysvsRgrlxE;UU&7g}SVmCsD?sM1= zXQA`wkafg(C4J4?)v@-Hd4hKMynviqm#!x#*~RJ$ZwrBVy`(zQk^!nW2{oFFJAXY1=ZJ6{2E|E;Q2^hgqw|GO z`UYbzxjoc2ko)DdKXPPP`Hc_IaeoQPU4p_9`qCU z^YK%+gC`4AM_(9pJtR>bcrDMwIx2VxQmODkwvg8HwY(ug|>k`AB2j4 z<6=_gUq)F}g@HkznD)-Ho@0SRvR4et?5f4cc}428|$i`!v~Y0a=lLgVD>5 z@I~<+=W-K8WNj4!#-$G4t{N-1mhyr(KGL^t6H-?S97xST(aI(Nr~uE#2D-!kN1Ph2 z{Rgyd*OUn>)5|g#D+BY`obFeNk7DO0ozdicEiYjRV&&T<3vU2aSt|Ir_+t$Sp{kf( z){KDSIZhlXYh0CcJmO0Gj&5BupKWhw(NLz4mIgS71}ZI?P*0#I@z^r%9o*ba05r@q$ph*$@Kd_sc=JORjOrmjLkAVv-}4K^o_6nQZE%o)UX z^^Jcrcn3YIW04}iRxxDD|Yj!iua#RtaJA7F|k6=aQ* zF~seZWf}v#m5*o+iZRf_eiZ}TU5Nk%G3~MrR%3mCa5~7DgZk!8i}My0IPg4|up;2w z&1)IrmCQ{!S5H!V!Ksg9NJ^N|Y?xcE%3ffDiF5Y4V*H0LNy)`>^fN|#f zk_Mr3b31fT9cU+X^E0XHlp_t&4!#eO-aG|VdisuR&CIrWVgAF2-vqGR9d& ze%J>bz`s@sr9l2rtmpZYnbxQxaYJ*6@m&OIn0XJH&P09yn$3GpfL7p^(_vv0%eT)! zg~l=757GQK^hGc^-dYC$cvT+IGWfu(#UHypd}8Hf$~wKGOcfPpV}`pe)jaUiu|1AaV@v?zdcvMIvIJRyNrMv=p&N8;;(h-b%){~gl@RXpU?&3~?xeHko z+rCHv$TREn8YTc%xz6si$iX`k2GX#g_dM}2hb*=c%Y%PJcyU`zIH6@c&6U6 zPZf-QexJ-|X?^K%C?~JGCm~Hy13)ov_1Y~s_^9F;XqsJe?|5mDI_9k$FpKHKPzOl| zG56l{clA*XS#*ft?v_I^4&dqgLp%kO5478Db3ibj&7S1t0>g*<>&hRltaiR|Kmt4W z;!6X2wcefX)|o!U+sHt^_?xJMDb~_2RV)gL2H%ZCMOEb8@xE$D7yTSup>+qy2T)$mtF0GDasGCrYjfc9_U2^bpn9ZJ zq^W4f=*mDvqJ7KKyH}J=!Bg68s30u(%BvL<;p{d~i5N}Ob?($_AT1$?3r+8t z(&KO@orPp9c9C>Q^i6ykULzR|-AOO2edUa<5szqtwx_cX8lJjhCiyComo3z8K_10K zy_g&nH5hph{=~~KZQnj2WJffA59d&Lslw5flQBoi6PjYQpLWs&m0S<)oFUqwBXwd~ z-M+iQ3GB-~U!d0?@0ms>M9CSNDGC}lkBK9Pje<@%N+UaVe86~^3hjeQWxKasIAaIQ z2y7En8S6$_K!|6jQbq11kwKTZC$B;-$S-WvZ1;;(O4tn!nMJfV0Mv%cX$0YH1!Hg1 zpo*L|_ViJbo~#AbnkFu2;`^Gt_eYxavk^4+m=SngBnF~BJ&9S& zuT=MjW~3io%btB)2?q`LjWwqC1JLDT;NegWym6GIM%cAoicV;kKmJS`D9 z6@ODagTL_S?24=#Z_H4WfYu<@gz_r~G(c8u$%3M;~zLH@M@5?v{nJpt;F=jT@nKmsit@C{f!RmP@QG(luo(RNy%)1kZ<}UBJqv(d4>~ zCzPn2OW(pYxT=Yb>%rMPHrjT~6YBmEw>j|)aW7QRl-O-;lM?(uW~BFRZ}~h(oAXUi zo%itw18Nl(jR)3*swnWzey(pNB6sb)>007Dga;iv1m4Td;F<%-3;H9T#6KSQ-4YAK z6v(<^pNzd6>d%h8IY1g<3pVzS-MY%|x)xS%An_ShCTf4hwl7W#oEJo`mXiSDDcSiv z;%j_CAYf(e)lSCjU>Sf1-W02~*RjfDe^V6nzN^wVRw< zy#%s?=^isyrTPlk+y?8jBcGN_SA{y!BSdm+GU&=7t2>urXArkph@j}yg8)6(Xu)PJ z6daUic2~~@DdO7?FvXrS|Du6GFJH1FR8NP5df>ETLIn!4YS5#tY}k81OJvR`KRkF>DYCH#)ImA!la(>*d z6U0p=fmcivrDq?P}kzs3jK+eL#B-kLU?05BW6aXYrT>CUHNZKKd}nrg-ApoK*Kfr{rt6gpk^da42+Y zI;?R98X>e)Ad=0MkVgE=7h{gBb7?vV0^3e4v{UzjE4gZEB8Joop$zhX=lld4xE!Jq% zCM28)BTnLaoSl2j9xds%#GtwauM~ia0QPq)bA-YJYZ1gh1gjKar9s&FFqU9Y5Cmn6 zV+f#FbXfm*><23LhNPcpH*2TZq)JX9_6gnuum+zZ{mIavg&HtF zQ>^=aJ57gS>mxx*Ai#M}D z70^#*diJX|57AU|(tE}$tC8@!s9d^o!zS;(-dKgQ^nSPKyuGO9-9%0tZ^8h{%Giy(;C zy?2M5@6x*LH8eREJ}C2WSbR&ncWZsz%5S+24Bf*OxM+01)Op#O zA-hf=1VD5a=K(iDFsWLL2tg<>`7jiqAWR35FafxHr&YOgP;&tFVXnv^fZF3bk}>nC z=BV>+(8k_@*NfdJ83C7{>nz14(5O0QxN2h*&na1^Sxk+yJF~ij!w2>zN|cLZywY9m zcC08Lc|kQ4xN+H?J`pC+B76?Fo5`p!#vEP$nv5rm`+M_SU@IdQ{RN5vH#o#%eBPbY z-Y_QJW@o+?d7~SodDsI>9*B32y4T}8U2}!O*9MhwIvOPJ$l=Tqg75{mPDDl^Al4OZ z{e+lWuO3j6An)PG9731q(Ip1TUYAMMzxwKKZ~Koe?MT_D*G=VEL7{Gq<_GO`tHZ_M zs5c>zY|iC*TUVsozYLJt+19J`5~i@;z-WpJm=@6kJS}3$fE@=U9FT3po^LxFH~U+C zN~SjeGbjQ=-5M~|7kTTzXjyV~CmJyI5nic)FdXbF`+6pEW@i( zItHzeF;XJel+aSd*C%!hUrbHluM5Z%9PjE7Ay736KI=fv7vZqUqle$m{e74F4{P?Cc` zN1`2@xP-OS$a)|ae~P4LfUA)16BsYPX_NG9{s$NDGB;iL$X(!D{G%ZkVGehQVV z>1EVf?`mao$xiG2w2a(qMiMRB@T<5Y7^-X;>nuID>6#dEd-&PcOi7;OK9(L6%*>fPBPq(F~XJ{>0)S-kZ zDuYrH3?E22G8o?F-j9=(rdRR2^~niaE>8*rmy5+ULsoJNlt$Ps7xNg6?6)rtwhMJL z`fz||&WQvu+7#-cSeKTuv4SM19GmiE5POBi?F86r1lQ&d6$Np<3! z3SDHa@eF``D**YP!<=At3FfCU?V9Kv-O>Pb_XYbvY~@ug zX7kd@Q7syoi(9qrhZ?w)q8x}RMPV**%W$vGSjZ^X9%R{IC%7e+5{-;)Sm7ftYczuv z09%11zRYaeOgza%w?dhhZx|4aBM^U#$4!V{J9F(#3c!#V+I@(BK(E5SmlM!{2_hxb z(wcwnS@Sm2g+Lzx-~wOA0jUeDH}pKEy9*X;D;#A6|~J8LDZ*Fvg4u4kuWEh32HcImQ7V;ZtlST$7&; zV64Ed00&%Bh^-y50%JXbAp{;_HuD_ymVS+vPjGSo#aqLGYXUL2-RPLZ8`=e50FFp| zbmv&9aqmcMoF$eyv2L~4*1ML!7Za?=i%Cmez{MroK+$e?El%5aow02JiW!{OTuKYi zYR9+3p_0baUOXSW|@Y$vvH;BkPl9%t= z1E#6EGrAs5#BQI##SgIXCNeeHsv8N-JSYyAcj(^k;|_%?Q%Hh?F@}i8>#an5zIS-g zz2Og_>`wZ$bin(W;TxZWFOaTD`@Us_a5kFV5I>nAsXfKRgV#4(Uy1mHX zG3%iaBms;LvCskrfR?VD+w=0i2LMC?kQ7cL1pTUP6bEoW>1w^53e73>(8kqh zuHjufQKX1uSp^1XTp5~6c8ym0Y4rwHi>|>Y3`~#2OTK>dxyj_-k9i(oOpoyK1R5kN9R35x^zz%@UCgE17tQWm}eC(<7YNz7 zEjKrGQ+=jfkO|DX#A3UlPo{%fH9T!3t9Xu}r;qbM*ZC?>gw{&zCbAn^opc`R7L$V~ ztCypuS~xY$F0u)>sriz%4sx<9?q5)x9og+QQPofq`l5-1W)yPhPF6G%_7ZDsZP4n* zPj8)zcb~iC^XO%=G7oW0`UqB*5vKAqur3FFyX{(7HQy_F z&TsK_CMO5P=aQO>l*g=rNpgf?Qt;L_%pg^Rv7+|(+3Pr6py3AAUy@G_+~N-H!ccA$ z^qOjYiD7|?+j7^J^LYZJH?S1;>*Zq@rz`=Z5S6Fsa`WW&$ ztj$z)#p^IyGE`!7>(?tnvl9IrxP@)a=MiDS0VoWIZ}Q#KoS7(X%5!KTA&K3NPqAUN zPq{u=L%M_Z5X$FTBfEt2{JoL)JFo?%d55g3)b@4Lx3LGh+IM#s+_Lk(HyNLRG=-O z=vLMtF=;pLdrDc+d{UJ;pFki|9f1O+zn)HrdQhlC@?ZPL?)PC5%tfO*j&;8*or zg411-k*p^ToR6Pg02bCOyr&DYkvSaN+yj_cfedwkl80$h=sIQQ#@v0JOG2xs^Hyjl z8QQF8_r1#08`Qnbt!txg2A}NA^ie7?E+t>_yDN5R=;BfXMFze7QOy(NM^GMWNOPm? zmYwbUyBRwZDu@+q))mU>b_OAJ$QCTC5;U-@xMkt`i7reT!De=OD@kkpZkqeC2RVua zjii-FZi?Nd$7$r$+r1rb1gi-}C_dQQ4Egqbx*g-$_cBm6h8;Y$IjDi$p=Pmv)ksk9 z&|1rm8}uCaB06uG1SiC?Jm;E1ijKk5poDTNLApP}qMZk50vC_8(qw@+WC}bTC55xK zI`DO4fP@deu(gzOfU;3toU6P#ZKv7tC3cz=uP) zBUIIo*b88u8kz;fD#jHt(bqWAc*(3dV)kPxM%(bfh;s<3E8}gdCv#DC*hE>w`G0D0M%Ex%K28G{~H9}JxZV-tU_7|~a_;~;ywP_+^ zAalfuK`f1y%bi_UqwXxlh{1QTJ~q6`*v>D#JD98scjx?MXs0)rNn=n3+mQrV)>x#uSvQ03yyb+Li|wgaAOBcy37 z-3G(8BskkX5(^liOe z5n_F`d||8Ek4Z6qM;yg)&L79mUG7<7iiXK_Dg(Zv-S)lt&*1%iTy9e5;Qe(pAE zb}a&tz|bbaF;B-;c|7DPWSfd6T&8`*bfZIy`W*HnKw+?|poho|%LlhahJ{4fP@a(g zS~)8<0250Ai*JO+oU9Z+5eJpS=>Z@V-RIe2}xRhyeP$$p%m^glk+ap?hZ z>04%luHALPIItQH6E$5yW1<5l5hCQM5l)Tlit2Tm!;K2TCHtmZ?BikwttduYpTiRP z(gbjkg$s7raT)mY=RKRFM=kCj(Ij{F*^1&IEP%_2w|#We)b|%t%OhFM2hMZP?Qi-O z7jR=vOECh*eJpWsHOs@*k#vE$_7IU zoIA!?qw1rz$rApKu*H0-3crx!Wuc~8dOiY7eV<7ypa@koa+({V947-5PZsGkHI6w! zL~!zfS3oaufjEv9qBES+dQ=}#j4_7@e#QYizB;x5RhT)+HteulN-cmy5ALukul=Q- z71Rwqq1!&Y)B|Z_=pZE@ub@ysV~=JH-E4oOYpHS(AcSkLv*Ua@6;O_$(R4PN@%g}9 z`bWk?hla`xIR3!J=@B0|xydcoJzx*1qSah5U+DAw%e~!Ckdu&%oAsV2Nm;Qu?ez_qGoe*W$QP!2&?qlux# z`N~0iy`br7!cl~S_WP>gS`yRSO|MS>z->Q6lule?LolI~jX&|~hLnAG!AS$SY%RgZ z!hk6^hEnQ!vfpP9D#<%Q1PLsZAt1tA2nEP$mbz}I^#J*3>1ghWz z?S7^>x18k-DP6PMEzttC0_+4&MdxFS1uF;3?DkcmO?m9dIeIx>KleL@nHu|AI%>i7 zl@W$#6;2oMn~oZ`17OI%1TaWS#PdkGJ(+Y0KZaRgw5#=`h%gpg5@M_UPSoe2)gc)Tw<-Nhk)^8^Ajtb8-Xn zyLT+Y9r?_2quEElKajqzPT0>=%X@cgzH8VbL?h3&%Gn~$|O9!QOX)W|;JnUu=P3(FN=k7H($JHEG>3r&O?eY>-IDGy9)=^gwsh+nrw_?)M z%b7wB0bwa(qmky0D+-Iw^wtKz^de|d+HfC->kdIM5UH% zgO6>#w$O1tDV^o5ZGAT-_?jI;_X9_5p!MNen6MJgYmGGNd`mkN68e z9K~&6GTqqP2tXdd3pe^GLM3#i7TjShjv#PIuS^skw%n3nF(5Lm87u=c5fC&`RrAH% zM&V_c07w&eIU4~cvX>t1#4x)x)xudFHb7PmqXW{4rVeET2~QB?7iv1O2KR}#e`|@| za9O5aT?FL>A{V`}0GAscBZybBiQwH+Z&c#Y+gTN$@41H#`c4EU?*R;1)SElSc$}X= z$rSzq`S*I_q$@%_;1vxFH+<(tx}wG{fA$+Y1(Tdgnm(=9DY%Otb?E^S)q!Nd)h9Jd z^x(AQ(L!C7}1+Rda*yBX_LH-Qp;2^Lsg^E!02h&}}*kSM9pemR&-z{3TFN$L*uf6sWm_dC;=k5c+IB9e9S@z z7VVxwh;Z-ws4fo8yLr6dlSbPg7n&@&Rmzim_{@Z%6Z;%GeuUP?_bOp)d}h zPk$eclKf2bOm#H9Kz5L1?5+mog1XcN$@ad^DtCZA*ll-NZ<%Cy=3I~5*%Gn4pz~8o z2!N?aP;Vk~C+b^snn~Gw+0X(5OT5z9swfR(PdbIrn_(LbkKxI0X?IvrfkN5z$6+Su_5Fkp5?nCY%$kXGHX(<~%Oe*ETH+}IB3eTSOJA&v zW(WCcAF2lE;9lMfm76}>x%^0vanYjZaO~lCDDlTlyM=q?mJ}Xae4=IXLgC)$7j1H3 zlfxXasjf=O&2@I3AaS?H<8q`l>3$CPQuPc2oY(l`MYQmf@4bCD53mbST&?$FdXQ(K zk?Q2o+Sy=1%Xz(9@X#w!;)`h8+}#M3fwzWF97w%gMmrd3ufok_=ww+e8`McWw35^Q z3f%|V4wiP&UPh3-5FF$rrjo#)>e!mc(ZkQIE0W@|I3APk#K#Rlng0n1PP{OkzFYOc zhl5|}PF{x^#v^o@?S9w@Q47OZ5Zw5K4(DW=X!{tew0Xv6s}3g+LxcU0cz2YK<{H-W zID;w58*+*%$(+ta=mP9vIV}oNTZt;S!i(RhpxW+)YB1U{c9V6!>j6@j0mu!1@{i{k z4vY;i%qHG!Tx6vNHThVt;#b4RZWwt(?HBN=2VVo0nAg7Gp@O^uAhXu2DcB$52hczB zu(6HV2u@u~TEJeb6Nn~lHfaEd=a*2Yg-iijdvgnz`LKC8?<+|Kn7kgl0KmUGimP_g z0wIlTS7*_8*-;i^3RFF3|2aZgPmcNG~J|1}~joS9_{K z3;nr2cKsH4RvIyW58pPR!hpX<52Nd-I#)O01_D2|N-z>lU-X85-0nrJN-CLW@F=c5 zCODbxhSaaj)7Cvgw<(J$gzq3TV+_p<-&eYTtJH97`|%99B5yG zTjUFkpcr4qOcOZ5LhD5KIQ+K3|F)CdpHPv&o{Zm+*Q*rjvwPV3-eJqJkj&B4l8rDr zuaGLJfPBA%iC2wu)0fb@7iQ1+nJW!@s>I8}GzMtKpe6vw-)Z-aO=o16v zjRMtd4;g8wL@R^_f)9YOhk_own+mMkn`(M;MM9eC6vAAlN6Xu%`e8_vr8(DTK;lse z7(bTk1O{xl(QCeoAU*BIjuGi>f7Wu8{BK*pny`Cf`}M6_QTkw}oX{GxR00gQJ&J6z z^5mB##)Q+-*tCjS1r*DbzF()Syo9O062@Z}r?2>c7=W(lpjc4)k!E))+hD(2-^PO9 z5ro=8FJY|9%kEPzc}Es*_f589_6p>OWLJQu!z?#hG)X4QLoTpR0BbcWwY9hF+o&{G zcA`z3h6t+yBU_g8oF$wU77Mn<`yR7GawXRw-A^9<%#r0d$ecTg@k?ad^DgU?Udp^qIXz} zEf{)o=JPKUa~e2{!#Oc2!A|%f2QG`bd!dmm`I^u4j@lDS)(E zr_`;1^wZNWsF_6=5S6SX`ALENP2SyC4Zp5{pu2(*6kWzJY{a~EB;iF-ABTE~c!&59 za?!yZRmM|J0MS5yA*xrG*m{r`LQ)=R5(elwhOxibu$e=Pb7+r1mkGiV?xF06T_B@d zWShE%GJ$&C?>6)F@|-EO8|=KpDAY~j5}H&IuWsIA&pMj}D=nx1g!w{0B2|PVQNOEC z4NegpFLI4C^zsG|?=+Kft(1dZokK^m*$^cHn36QK!V5xf zv$?68c-#gb`se+CasCSR;TuVA5t2EvsxGt2ud)TeSjt=`{;CShA!gzpbi`2ppN z1h@G-0jQt|@m$Uz-!JpvtPSxLt9G$^po$|#KnvJU8_kU{3fk%-?B>v>g?-#X-N|k; zznQBt&Iwn4DFMXWmZ0oId0)6V+|g!bU}LK;>u3O}mC+WEQK%Votf8Kgvd9^0B!A+&)I%i%mg# z-nP_uLSF0M55(tqpl;x>dZeeR4z)=Q8T{6z*c2btX%M$OcL-_JYEL5wKRnNoW`LY> zsHFfD{z!Fegju@hh&z^gkkC(1GUIKuS?X;ujRKt^eAiL}Q2)4&F6w=Y z&^jg`5QH9kpf}LrWET6QW9-1VzEh}kgGTi0uG^`pptu?U+Hk`Rzh}>Q9C%{+L?bZ` zX%U+j+fq9Og|ayp6NkNF^Irkj30*@C!c_8rer#JgXfK(<;$n@N3$USm zfe!;Z@E~F_)jjXA*dTcILsYonY+wU&-5W@4g`+n=a^o!+wESH4Zg*(KA+4STEIE%0 zRM9)ZRx!rb_5wd>1taUux}X>_xZ7E#5dWj=A^NDMvqd`ObcJrn?u(NRwVU>I49zAv zA&6cTh;Qy8JAtrZ8chh}FSBnJHa9xW%=|JEmZs_4UqXy@p@rO_6+aQYEi_LM*=IRj z0_zM|G(HdO^gMgIF``-Ia2XJdFf*F;AjkRg!i~dmq&x%V(&sgGd-foeE-i8)FjLX) zs|h#^Yc>Mhw4vFt@bk_M&a8YHpg_;p4_AL3m5FUU_lH87BuTwiPQ)9mIRC02R@`%; z_^{QExNC(RsN=m#6&9d5xLesdt#)x>Z-(R2)EuiH0B&d>VDhY14;5%Fd|V~k``h^j zdMx>yX>;?E z_~2qJHVoz0%}|BxD8i2Jr294p1B3NiXfy7l zC3yz*dAOe|dci}*rWVk8Jlx>rf_SE9QW90YVhhmEu3ACwG}@GKx_{BUA)w`?4$v9W za^?uy{CHH83lQnW?6nyMj9Z_L1MbS;=$nmd{2hfbbLTM&7M7wt4p{bRhdj?C6oB@1 zZ3j0o2P#sPisK&UN%!swD5Dq$z-_NV{jO+{H0@P1eX&^Z)IIumKtPJjmIsV$Ia@bVd){P4bcj4$str?=E; z9m4_fc8`o~ypo5*c4kMsK37KoY9L8lKN+Y1lN;{obq(h^Vy3P+rg&&68}YI7d# z19zH}PniDsmvsIDFyXlbdv6ND44$k>$KH8thimyvu+kKv4jEx55R{ZVlK;g*Q%;I2 z2DYI>F9K;_+-=xurvet2jQZjjz#aX$@{b{4_33=zk^RC$K-S`&;8?qLQm3=^=2}S> z@Vr#Z*vx{J&OETV(yj6V2qnMhq1IE?7fW!jC(S5DsSHXv1Dvywl#d`MW^RqTOEri8 z)KUT_ZUT4LB@_zO%~;t{;q!Gh3^QY+@f;jXEIhuL9MLO-u{7#PUY2H5)7;l+!cM4h zv^h?v28vq28lwx;ytG|iUm_S(J@iC7Dk&HWEgpf7D6FMADeUZF_d7OEIzYV)l)$Gv zXcOuL9z-X%LE{kb!ziVvUJ(YF$Z8-_hM{y)7ZVX3h;YBW2{^`FQ|L|ANr5AeA7Euv z-xeH6G4KX5%^$$|t_`a#A1yImD$qYA8(io)BY1>F%)*=4$PA=V8C9k40)wm@&K?nS zbZZf{l%;fjYEDCI*d$Yi_$<-u2;-t+vE`m0HBnX-fc{>I$0{us<2ylIM7>+Xf+>I|nd)Kf3El~3Vl z3t&l}Qd-h)mL7C#)HhchQi9+36+ioj9A`*8T#y!@W{ zRMf6JIf4G8J`V6Jeb{iRicGzRHUO@EtOWjA?2Z~=BRGPKnE;NI%t7D^M{s@t7jy1ZrV_={c!V4+ z?U1lYemx&%B_2BNkErELfGWEU6iA(AS*A?<#%vOeR`Hkd7`2nbc#U=u)j&sQ9EHaZ zSOi+V_1Aa*wcZ&Tq&YtBw#q^w3u@x&hS&&0p<<;rcGD2@5n94hW&pTyW%MTnV$xGa zaKl8{0~g8<)a}IyW~~q?AdwnY;w2y*%*Wt|HjkyE?}F|9CQke53fnYf=K-b!yDkPQ zA14GW*Tzc{k2yB?jzNbI-O~}M%(zK(zV9x8dtlYWW@r}-JDM0OL@(O|_Zneu!Vx^} zqf6MbC_q5LBT{iG5P9`u8TI_E3jv#ZBh%lNg;z4ho8fsFldRx)w{rqpd5DmKUv9j@ zcfBVvm2t@(iK}eF`vH8Vevf*=2KcGt8A?L!bQgO2$*HSK;nWg&{d#031t*!yskY4G zVzcm2ds98ffUR9?L#C32(`603#O7Ujq^S`-(f@MwRcGB_r$wEO2B7Pft&ZY=nYeb@ zF0rp9>qNH8svLncAKYRhDPm(K+tSB9+{H(-rBKDA?#^WClo$NuQ6H=o4BxHX0)fmP z&#Ikf^->d7PXJur*!P`tTSKubz!FTi{l0O-IC^^NN)!P+O9+ z@fPD<=G=pkgZ;@I7l;Nvhs+lKLeQ=YzyL*k9hl<^oa~9HAC&ZXyDS)DD2Ef$rkPP` zCG=-(mV)>#fKS!f?8Ut3Mk$|K%RsaA>3a*++3$>ZmqUXq$*e$~E2YXW5>ARD7a@>3 z;(=>s`%o9z#s0Z~e(upr8{dEnk(p^0P~#J`Bri*r(-}coK<^5xGz^cAr;ZRrK%aMq z^DrEGy$(Q;KAXGuy!0|qXZBgF?WHA93Cf(}U%E$T@8BsNv_wGo&84PS9 zI5;Ikm<9g@Ay{6vsO_fHAMyH+c#KM<)665PAp1yD@yBbv|62&3 zr_@DP?4uuFH@ml3>`@V@FHM0pj6S(;p4ZRk@ojNtDgtMGl+NOxbyF3WlU7`d3Xj~2 zJC0P(+4cIJhoWni+;PMam-d81Rl0T=v{BGweLr!_;+Q@Lnl4#$3LepsKC`c)2Og`? zJBd&9Z5aF(M|JxCg-+n(9Dj&=#xl}3SWV~>eBL!yWWFIu2zuzNJ2(2gnP1;I?(?x9 z;I@4Zh_7zjkKLzlU$5`GqCa*EQTKR{M7pNmbN{||&A)xqf5h<&qZ%fL{||UKB;oVI zf8GoJd!`Vg(~nE>^_}=~+z)UkKF{dS+no?U$M)x);J#epucicM%1`o6eEGCL>P|p# zi3j8pe_PRicUhq|=Evs8chh0f(Y# ziW@%hy9*+%zW{)=%{9AYfxX{PN7@zWOO0Z*k*pn>G|ar{K23QzTrMs&#%UXIQnMHjYOFhKK?{TMvLj!^Yw>YIlrt9UyYLM zDLONsi^iY1eeUDh{1984B;xLTbsLa^e6`K-?DyU~f&1pGm*C|;*_($Gq;vf0<{`$4 zuD^OLh>%84{du~9^5`4>tC{q9alY)0(&y^?)y$JWC*x0Os(p^AukKd;teev<{?+-k^p>5AdlP&Hyr1jB4>AE|_M6Wo@M9i+djevr{rK7mJnT1L*3GY9^b@+HpR@g| zJNjd{@J|$We!YW!<_%x=wd?6jX~wr=&W{iKA@0S9|6{~6UuM*|FZSmP|MWvk@$>fo z|L#Wdfwz66uslg52n z!+$c1>e{$h}PZ+8D@VUP&i=TiLDO7asPBtM>U#KrM~TJu-SH^a)@H>~^(^9_cS zNoMN*)V%SBn`omik$nf4`K{nOu2r9VcH{};>gPjopRai6Q- zAB+-=;LjGoR|DmTnrzI2G2?OFZ`@vB46*EaG5A&P^YgzdxSZnT^d)abOD-({7mBXN zA3pk>{p(oVvg2nJ_79JT-7t!t@6v33YMN(|0ougtQQH*Q0l%)veqFdd-D9Py-gVs1 zL=umf=t1G7R4)CVb_EpqKb}Ew{^hmB18VbhG#>lv)qm0jpf1|#-MhjIzrXSJCFr4R zhEv3G?_2!i&BN++jhd|c`k?P`1b)8Mr4l#RyU(WMcZUwo|6yJ4%i8gAwx2J=V))rn zyba%dFX=lq!Y_;0mp8&yOHR#?y%8>MM19aNhdt;NYr3ZYgmeDx=a3S^AD$OZ@Z%ld zuf}g*HCzAip+BM(`u*eivyt-`xifAkS!9ggu zVI47k??3*Tzxq=@^@~3RoZ)Kt8~^Zk|H{9&`fq;k-~3Phm%sX#f9V%@?)2aNYwq9q zt>v%(R}jU)ufj-}<+H=C^*u`_Zoe^7waVKR=zh`fvTB_ur5I@n!S> z{F?M%|D*Z;`MbaI_lke;5BHbf`|bbe{|cS|>3{xL7r*&N;>c;=t`zklK9f9hKg#w(f^B| z{^@U@HlF#VfB!ds`xgI$|KRm6eRaa`lmDH+{hR;c-~WI4`U9~Z{r9@g9loSE!6eOg(TT1D^(t>n%!+&4j`@Z+|`;Gtb4Ts|mIQN`=)?RC_ zIp^BF&5KlWGGi<6xQohi#6-AF|ARBcos&D@Y zCFvFeBqpWg7O?PP_;j-EWaz=Pr79mEx?Z2Hga@UFx$$0~F5)^aS6NRKF{@`|M=>f| z*`Y6LCk5DuA?DTm`D$uX5d6=NHzsf$SNc2FMsiHHI14K(2ABJi?sUDo%a?I{d3Mkp z&4erBycq=kC!O_pK@oXbKw*CNqZIt#gB1_a15>ZrYo_L&%l0(cocE1*kwK%?XT&-t z$;;g@t0OtMPh;6Fr$5X@J!FI)EcM*k!RVy+JdE7iIaU-g*@(^hq}>mv5MpBRY-^m4g3SkPuNp84zdGBZb<&i9zQx9eoX$@j?b?{tW}ALa(wG%)9t{JySI z#x7~w%Uq*G4 zxVm9G$6>K^btv<#u;WH75iew8)MqJVlSq4v?e|E1kB2d6+;d@lal94Eu3eU{UH+nz z*JHi~Q6c&MP(v)M25ZCqH#S+=_GD!b#{6`x<6=&lS6i-X=I+6OBn1(8&s~JdV!lFi zuL;i%R$OqXFm)#s0!9AV4>U-}gf%ahLQ4Cau8yac_1HUXzI|Zni;p~jJ8MqP8WAa|y!&&TnHFLQx?MXBvq}31A2#>XnTgYOtCCD_yq?#U6x4Jjr{NC@+ zL4$M~&uBNd(t3g%(v#+v!!a;8UZ6d4DP}#+P6w@jwdUt}aST}<{Ma4C78mRT&oS)! zbwp`i=PbqfCx z*(P8fJ^C|gQqo94>LFjyOd`b{m$CDnefFEOYrcysahi@v8^ftDatYR&(TB(|P0)sX zc_0l}R%&@m5bPfwbDJ{}8Hcev4W5@jA0H&@Mgi%+{bpWf(#}iv!FLR=$Mvs$)`kf{|B$uQ0vCfR1iTG-T1YS}e*i?py2rzXzxf#(ilYzYh;GX5BY99G$E5>zzUVkxDKcvPtlBZSg^rop&D* zKbiJ7XmtOmnkn09_8sR*+c-{ny2KxQG|0yv#p~wE#j!K?v&~f1a{uIN#s{SM)-2ap z=d1H0tx7B6DEcSH{VQH)OL3~P`e=z(BiT50&RbR)%=P!4!0I3*qv(HDH~aT3+cWij zP7-sk4{*N4u$lKy&3fNl$xiQ+Q|p+!xp1Iz)6pGFa}*<=Z&lCjf*fjmbA7d}z~QfS zSL782SlTaO3)>Z;zI+r_;`D_*7x#};Ks!(4D|vHC*r58xWqcpo=CfLs!ftMXcKHI> zEccx^N!4UW`dD=E}{gS+p7ASXG2q zg-v!fs;>MI1lC`f(UxQGYj~*KSMPm#8iR#? zo3bSUlW=!Pj+#u!G_^KsgE!DLn1G?TQnEpUd75Rjt;(z?HdnJamB(8-`98i}1Qm`@ zwC<$$yf3;+wXOcdk^EhPKgxhF48yhf-0h%GDBRxjN8lZm@)wG)kH$1*z4sJ2iZ6eh zeZRRrX%8Ze&5!v>T7^U8Bpan!>Epggzr4F)H7{>KnE|eOP~r z=tNiweqEK#6ba{ThpMShPY4}vYd!fh3()!^=)VE!B;4!j{KrB^=<0MWU#@kT=~v@A z@8w>yWHGnlcHsb!G}{s(d2P|(s}{finxn&_WNp6He>seE zCeCeqTu8MSpsm@UskhW#uwtp(ReeVL^=h!XjxCqYFtT`I$Lt?05Q^S1HG|);?Q2h9 z^m9SN^E}?Mw4%Mrc7{Af#EDn+ec`8a^MS-VIDi2VD5*vL(zt-Wj**Xfmo7rgZ^F=f zMvshWogPAQ%K>vrg-foI>Gw>GXNdHQC%g3h_}F4s1clJz@zzu($T`aj1u@btKS5mqdgGy7u~B%BNwo0XM4$`|ITd= z6bq$9e$0x6{Y_4PRmBvMF)bT1vRdb@$z?ISy@ifPvT|+D+XPKR6>-WvzhRfjZ|s1N4zut&{%+oCt;dq#mMWxKq{oQF zhw7YLP(=X#?CDRj{(;Nqk&spf(&VabXSmJ25ji&E&b;sWz~T>J1z8* zG3*vEM+HbOZ7D9Zmh81qI*q(%u9tgV;bX_M9y^tpU+-_cFNrA$cZ_8Ivv6Es7U)*r z7WX)A4X4h5kmZBL|M|N=mJt-F+A%y zAkG*x3jQ|NEH53W11nAu6__pi2f9tBv%flbYB-toAQgW3Nf^Cn?qFpg0>n8fG28Qs zKAj$Xm0sQ;qD=O*`wnf=a?7=oTurA)Z*Sk_wc#-uyT#RD6d;(%E1Ck2mlOk&Jj36& zYYPOaB4haB`PoXEze_(aSb=XC@~PF8d_$}k0P)8=){AK--Ft-Q=)zG~opl+ayZ*7K@HqYuDqQxd`v;v##V)GpQU##Y8xaud3=l z7KFllR?@s@^)8~t++KcQRz*77U-|-yje_ngx$KU3O=JPE{hx-&AeLR5 zAW+!s+XvT$V5Y$wWojZ8wRY7@f~wN_n2zzG%A9Y1yt9QTKD1S!nrSt?7H)VL<(+vH z>z@7kY<~}WZ+Stir)R@!xj)6a==d`zeYF#@599C?5-h$JYL{p8*zZf|GpTn66gEG= zLy2auQc@~kC;7bwJ`O^0HMaqqu*7nN(eW*NgbHuX$lhWX52!bUqhEvDyL${hkB9-L z@f@Mz=n!?;=5PJP?0zPMshd*jWW4oR>5uo1B0K*J7lLqVWiTQmH zri%2in)}(l86CG<(J|!okRgop{Y&DgW;LET~_bpXZk+s#g6Op9*U z&`I=3$7H$A);Y0_7wO-UHAxk5%ENrNB(A>E*S!%4V=S!XYCMb*_U~cyO;)%^SVgH7 zPA*_e7J7np7p&3$6*zQK)*Q{Qg{;MzSv8q3(C(+y8n1xV-40Jf8FyB`Mt3z(rL|YN zX2+4})QNBzG?3ag?4f}GCe$dLP`d!IAwxcnvpbRw9TW>xgR4bTtb`Jrd3#KJQtg|A<=*3~pD#z$MW4+O%7PBAcm`W#$BMn(V7<&T@2-F;?_{pQ#0Zt;H48N7f(g(PvFbJ z+mxr^1zn@A_xnB0i}`|OSOoXTJFc7xS*jg-OXc2u*?&;U z!=Ph5RbgpTwDcnZ21u0zDW#*0iE1K_gvj^JSI4>|j8jT+oGHSFJ>`uBX$w)FKkj%p zx$e@${&L+VX>D`9gP#=e?U6M z9bfZQH#F+kyT16*t@L$BF6*OTQDTfUhTc7&CE?Ja0j*o>GqWPXbMTbmMp+&Qpm>s5 zyY0Bm4Q0wDWu`c7j32SJ`L935PWZwJ{mz6IlaXJn5z36}05Y(NSt}+bkFoS?x6ci~ z2aXR$Kr({=0|8L`r_m{TwKYbS!JFi22STA^n%{XfYe6cg#p3XK^P6aop& z9yg2-iaQS)Ie!lTyw50brV1n+bg*YU2RYkc-MwB;vg3B$HCmLt1l@BIU$O7BT~E5k z;rlG+BU$O}!K^Nuj}HU=+MaCi&@m4r@S&%@-hZNEw)kx`sAS3K%uExUu^gi99el#i zv!DqLCV`}uh8I%RpXa;(fit9Al#s;e-hLY4%&kWx7ruO*vbmU4?l-} z{N#zOu(txhQGBr!A@YMWH2;jjB_?8m248|_5`Uz06~gol?&8q|UbB#_4R_b0{?2fU z(pPJ0jvTl$Y=JC0iCK5pQMn4sUui7gtqn76u$z-8(5oc?tBycN3s&rE`C2E$xQ_7P zX_^$lMi%q3h790kgywEenr~3m_~*smX+e=~#e>3Tk-HucVY23*OnywqVk!Th=<|^R zaWVvI=Hk2F4X*5f{Vt*qwi{IbBQGe7PTr zU-9bR3zVfq0qew_hN>LPk!+ATNh*B!Cw(DQGH) z@XcbjV2QQVUeY{lKVJQDK6i6HfnkURk(D`i(Z@sO=-6Bz%MTBXZRYdi4dg+7epc@? z!AcPuN(%AVo)&f-gau2_y$sf2>dyP4#v+Ph@IzsP(-iV9Ms)})-(q^eH>FuB0%Rej zm@Mf%Yr!fjr<5k)`C<2yj9``YkZ!sZqS$^n-7=@{?2AWVjKKG>s9u8Ik(BQVL(@-8 zh+BE-M)|>b@-q=n+c*nCp62gRR0?HU$!Ep7`C?m?&@t%YhsfYFnbOA-Mmo=S8cz%s z*Ee=VXmp_Fz45+)txGDeXlQ#ot~1_BqsA^5nGA?y<{plzc{e>To*lqr^*TLhkmx?4 z(p}E1-|J1_E43P9r3{jQ!Cm&>#uorPqAw_^@Ka^3=1r!Tbg2 zJ-2&`0RbWxtmodso3Rg=fnKu7r!lN#Y^;SvVJ{UlN78QMbNEGlA?= zd<99peODx&&ENHTY*8nLAT&s%SvUVV2VrYMtl2nO2xtqjzFGYbe+Ffg8hWDo#8)12 z0U&Kcd7-HDCig4>DU#k2B%FE{0i1+|RYbJ_zCQpZ?5?={M)3eaRcrr? zp#6i94-SM(CRgKIrzTxhc$IlC8c?=5^@x^2h+9KBl9H4wKm3+zXreF%Z4$P-!i;+l zD#RYihq5BC=rnQ$EuI))wjb1C%gW^Q6gCl66AfJVpNRA+wT)Z0k*wbwO&F>keSUFY zCj(7o>&bkl)2+(f#|;?Mu_#(R=-;c@JHC;D1L_?AEMhJM?@OG1G>qDelZS3IV~$!b zx6Lw?ae4|9-v~G08!BBeN8;#xA^ta5_3gd~god_SR+UoL@E9Oz zKb=H`sT-#lRQEd&5F#w0hmr}_LB70U96cEP_^8!L4%8w@H|)I1E=zTGrNU|B`Oj}L z8`%pW5%WCo%ea|&O0mbXSX1K3j?TTrH2<#t(#3JPzU4YaD(=L#Pn}DM+regYNs{{3 z<_wkN*=Y-=oHpi^y^3biZzLcdx3B9h-8Zf;m@VJ9+}3#c6eh9PPPjVTD9ZXQ7ccK) zJM7(J+i^P&jR^_O6M~z?23M*YXX3{cUmBjm-Z**YI{Y4FzDbzvy0CK{D4b`)Cg;Zh zgh?krbwg!l@(p{P6k7Gp9En19w(Ru^P0bVenz#a1qb+bSt)8Rw5l9-R>-ohh8PdT? z?&rr-c8gahb8^eQ2}1zpDa?u@E!j4ymkO8yFM+FMm;nvh0ml>x!Z?MVy&W|=SU3O+qH_HbUD3-p(e1Vmk zg!?F`Nr<~2ZwA9vDIiTq1EivOv-LDKaBI=cCsy2d=MIwh7Mch)(l{sDF%&(D0UfOm zO)Uqxfn;i=%l82n5-~NZmjMo?B=#$Eqz@jX7^B7)eXr&h?@{3=bKDucLLLC86}S|j z_otv;pQ3h0;;ss?II|V&BWxAPk?7V3=lxz4OJaNq+u$6z>`zsTYp@AqrS}Μjek zoB?u!Gk1cv(?Pz-=;RO1`$c!A`Md9mI>(D$dab0mWPrtyrBsLYr%BEQt&HVs(t!x> zlmXy(9nJ~a4~U-_0lGytNGVn9yB^JSljj99>CN&^WK_gBgUd8o!Hn^ zVx)7PCwGTGJ@H>j_2{o*=93I`$WcleZ1(o11PpT^7I7Qkup*h1sdO2;%1R2;a9!7l z2PWE{w0O+;M2sW2%;3B#x;1KZd(`5zxJ29o%i@5B+nz+_8sF&qO3UnRVO7}V z^r?i=f(VVdm(ght09CRsD}E?hvz3K;!t z*R=d%y2b$jH!Vh;r=qV`jRH6d+W_Ul1?0yU2D%j%k)@+>w!S-okI7;!D^Lh*Jk>#F z1@QbK69yhQY|jh0pX)FhLge=p@*Uzh^)n`4UmZ;--e`G&bg8-s@+z-^*O?hz-qzzi zf-1UZq=&#HT^nYSz```kMaYdg-#qGIDA^rpIaBZnfV6V)L&{6gXC-+9bl7}1JK^OmlT z+AWfuk^!>+cmdcgxQG3E07$sl(F)uGlJk2GUBSy8@0%}4c1>M=Yg)g6mNry|Iz{DD8(efxPImVuY>{-=2CvwBwzXSL->XY3Lo7ev&S;k`Il z$(g8;p0ZCfU$`r3w>E;s{%~Jg)l_r~dqilBgZA8^|#e zx%Ta1%8p9)(Z?s620ID5Ix;M_mS*ryxwPV(F|{x&#u@Z>%LAbCZ)YoRFb=Q*ixHj` z(|jQhsK*D*URPoAhk!f{<2KWOC7R6;M`Dt_N-_m#?@X`;%K|!KZbh*q7O{qPuULRo zXkw6=#NV|G`s&FtBz*>`AsON>JE!_Sk<|Ir4RMuN+{GHV(Wo(vKI8mULd!(jB^y+z z5CyIG@WYiQ8Fvx-?hkTZ(!dG=%&GSa&rSZFy)o0Iq_K2$&y__4$RGZop^BeZZwhvEwRHw*t+Ncy;G6Jdm1L=8#l#i0RWxdt~Z=Oq=zV`n720DppVe2q1oFhxi#d;rh@mOiNVA598l{|$r) zP!TmTrlcQ;#6AG>s{1C6h?x*>PuuwRyIcueL`>a6l;6rJCw7_*`{hh*tTzdJcdfpJ(ES^TzqjGi0p)T zzg-^>kpkl}Y!YE;OJh1#fN9W%U8O2}sy=b|;$%dPNSB|ax!{!XM}!6)(QjA@5C44$ z4*sgWprdZ$;bWZ!q@qd>if#|P`}I*ZQ?n-&QSUtO?o`>mIqpkhv?U?`-J1h@EY&tH z8*f_}5`B4m8cfRT${lrw{Y|-dH;3@3W6bt;TTPiY+x0{xn}PR7ncO5zkAFuz?fZ1h z$1uj#wIl3)m#AvHxp$!MGx@33TL&fkXUK%s<*ToU|F^f>z<^44+|4PP4RUGbWvs_x z7-0x@5zhmDoHg(F*6@xa$%TQS;p+S#i z%V<=+4DqZ+1WcgprKIIczM9ADNi)%uPfRoo|G|4SY8Zzzj+j@+233Xip8Hu+bC)bO z`O3t>K1rCcLN_=NoN`t!yY)7g^B)pIs-5tCN%$$tC_>xg7TZ2L2u0`D!-Wd_Qrvi0jiH-sQ-@u>5G7QiZvDX#5ZcqUy{21tXCkp zZrM_$s2kBwvkK*bRGZ)f1(Qwx5|1cCL|z=#e+ubCr4~)t^S%#62O&AFvE>sgv@?B3 zLh8KpKgW{lSNb$>;tsUjhBM(RltiEvcNog%xL6td4z2`jPU!3HgVv+|yY?8;V!o?w zvA$`f3<*Qwo`iIF`TWZ4_LoiWI%7=1$$9{FVU^Z#3`L;#ZyPVvjbzj0lwaCnes#32 z(F@2(IKOjuZ04C<`XXqFND~EZLI4XyN;Uhe#OT3+kR1@u$qiob$%Fx)6p%;YVvqgm z;JsJE1YCag z=pH}~ChbA^!0CYnFMuOn!=I|%u}&$_*)D&)rH0cnBRkhu7jQ`0l_eji0y?{qlUHlQ zGY!x4HM;-_7EH$X0w%)cYz=HAx;b5`-!@ZCJ>0W&{=NTSW1bRL`Ko0gC}Fh4(sD66 z5Hq9OH7OfQ+@;i!88leJ3+f`=a&yqQ78v?``);&-49?3Q*9G;mmQB}*XC7^v(o`Z z3Gg?8Adk{GF85}qDT^NwO;+1^t2fnj4iy_pPJ3N!)oc{i50;xNm&{_5@dAbvEmyC0 zUvUdyMlxVU5zwQD+UUjx=g?wKwewAo|JUgz^^*Xjx+Lr9-MC;#GH?Mv0CMa!mIvpw z9)34ZBdhrj;CB69WkaD;Z5w`dagqtwM|jP!_E!eHqjxueTp#p>xXY# z@v{+F&i)3y7VP10LCw(nDsZVMZjL{aNXZ`!r)~3ld8x;VZFJoDQ^pWkELcw*SCYi* z!y&nBTda0MCM8neQ(#I-5MiOT?8qWM`uR2baWo?i=pNny--z+g?ntk$ucc);I*gW< zSwROnpFF$dhBg!dnZpp+!ocXR))Hy&}No=e7o9qc*?>Hkc3jCud{COWhCLf(xQFKV0g9 z)lLib>&G!vvGB0!fP~(U(fSLfld4<90(q?hHYCy|R>3~}aJ|xESn&wNXe$tm!eGEW z#1By2TL6TOfH@_7%wZr^T-Nn@f!0vaFi`BK+rn%C;a%0?gNPhLf28D4il8c)6Q@#dXyVKn-xQgDX-q&t)yZ4LWib&P>Vi2KZ_}>e(`Sfb+?{zxx z8UpqxEPk2vY<6<))HrbysJyeqB};G7HYH`e6}CH}b|7rwc7@BLOjv*oi1gluD3?QN zs^nY6LCch*xvF1wab8gpHC`e>K<`pb1h}4e35Ir4oANQN8gK!OPl%uj(GKU^DgzB9 zzw%$M(rqR@B>*<3?=N0I_3bzWy;SC-x3^_sYS?Nm&cK_tE}(M;41MO;NH+Vos`r$7}3c1tz0 zM&5@r!oqKW^x^h%K0jQ`-cevz-q`L4y~6`sfXop24ZaR`jy_-_5%7EWTuDb4>^w^p zaa22n#ZQ&dTU>fIgEfP^9sCmBZ0v#%`8ObD+X29|W$71A*N8DOrM_bDZaW6V;<7)A zPG&TdvX{Jrja4A1z%wdv@5OheOnZXX&nKd zn|BWP&jdxgdHN<MHQ=OB7&! zmaFoiBwRv*t?gLy<_tI0ZJBHYeXf08SLCrP5X3OqGtUR9Mn_D>VWx*$8h+L|0|klkSR zM;V%l+ioU`s`#ebvU|xU!y3r3kx}wVz!}8qGL-eegQKBoasEslOKI+LYg6$BVHHt5 zk;<&sMeLrF%<>!y9+^cjZS0DqrFgc?8PN3+0>wMbKrEQucfa5X=hA}6=kMQjnTB*G z^O$tzE>t9*tdI3*i2^c(YGwbxytL4uv5t(||6#`m;FC37enXATt?K%+39kQ|T*tFl zy?V4KBu-bCi?mMbCl8k$DY;dlYI_K|JttDmHR9Kq}Z&w zRnX;RHjYA~Dr{(bi<(${B2Y>W$Oi(4D?dDZ&-twarrMx(c%E9Cr4jAsD*ItY8+b8H z_D9Hj*-R~FF6RAl!|Dr&A@ZTz8|HHsidjJ!xyCB2SkkG;FP=e~sI#4-V)a6}bQ0aF zK5W-jgu$(mJNM7r720Br#m-NSb$YM$BE2v7YIBZR59F#G-p?^qPXHX}DcU zx_%^GV(K1;XNUv$n(BA&t0PUv?1WhD<510er5tEo86Al$@nkIDh0?0+4;?7QTnCfC zni(+GQK+-?84+FlX zZwxl~WnoX45E{bzhKppew|rF@#@*}Kqfp_Kt&lK$+3RMs%k?hUJUn6IWSu@WE4$=S z$IP-e`!uIAg<7dZa`bl7*=4vtHQwO4_={fB5kX}8J!EV{Rryd(j@hOsz~rO*w9Wc) zo8XVW&$9p3W8d#$0NgVhsn#v4-1JcB+`3f@N=T&`&RmKQFl;yR_dvGp?I+GZ@W%c{ zJN!&-6X;(X+UJa23r0=m}&miL4MH^Z=npmf$R! zo?B1;Ust3%G3?B*=lm}C4j)y0A!b@AZLFg3CBXKabiaPn={rif=>LLqKN_ig8|cal zU8br$2mkH28$SFn*mq&v)^!oRk@L|6S6*Y8>z_{MAv^!~?W>=eFv-x*zL%@SrFAxz>cpJ@`^j=rvq*}^551XjsY)~mX=LK7fR>Qj$Mw69*vV%N7sl~h@<#hm zDvE2}oEL_KwygJjax&n(5T5qmkCp6Q&s4iW7+z9kDjuwJr{AfezQUN36?%5bfWu?NF5GtCsU5{P&>uROpaxr)wbc z8hO&7zeG5B0zQ>jm*o7jXCD$jF?>qEx0`l8V7V4&{=&GC$GJz%-Z<(AZIGjULrU@x zZ4faxZ+HtdcQX=?_BPXwD_xPE{UX=xB@vnU!3*eFo(X>999~iwM-g8`QnOez|Jkq} zi#-iTY?}VGY?i=#8znIgRp$^T(YdiU6_py1&Jb1B6NjjnRFC3@1LJ2cI_aL7{nBQ4 zp^%TW%Co!pvNRciTNz)ahOnfXE{t>fJsG_5jaHF7%$Ww=k^9W;cEl-@pxvyq3PEII6n=m)HCK&5eT+PtKzJIaUynwwcy4zM3)pHEN0?&PM(vIl-W7~j zZxg(4@Qnj$j~=hI?YI|nz-wrcF5T)1#!{e-{izRO+K?r+;&q5&^KJe*Chk^th&8p# z*k2)Tf9vn3CP^fWrhEyhcR}Z_ptC>ZqA{09pSn*YC(&YED(;Nux*}ur4Gs5dYvbnX zYFENYMRz{!3&LE$m?he%H=@NEg8eeRN=-qRU+J;+{FkPdn4Z+S8zHprsJo||;zlQe zMiT>4fs<1Cv)6%JE#ocg#XdYeJ{)s5)}@NkR2J%(79+T@5=z)Lok||-pf$mJR-BS8 zIU@^npG6B8Vmd0L<^yf0{&DlCZF)VVd-zpvZw@yxr^XT2co7Gh&_->3_?~Z|89`m< zBMMu#zWdbm`7&}HL_e7iZjd^Y^Es?W4wXcExr~0UfU1^-mPmB%qL%7KZ1MdT>48Ye zrlSvayM{ZF>y|i;%+m;jV;$&981n4K`geauT$FdzsO0vBn@gW}an14j_8?mt;;12S+Ke(LTahz6Z4>)8qn`P3uFi_JO~@}gO{^_ z1Rp|>#{_$$$s66kyZzJ_yHd%5mDGs%tO&iA6cehmR9b;X3!U3qaLatG`J+5X45_xq zgUa`8>6x;4R|G;|4`L>X$835ZISy3+R>K)4w+kh=4fpP>+5pAVxu0Mu;}BhoDF(eo zRMvP}CWwViNFsV(jwd6`;g#JSNFW&81sdILeh$=RNt{=n)UX=L_zT}IPwk>^&I>y= z7Xnt__ZU;oV?LP|;tvnr2DWI9h{+M}Pv7F_z%;GD<@!U>XiKQ2VK4P+e#l(h?{FA( zzV-%jTK>%|1S@_N18UsfB!n=}8TFzUCPqiJMx)kJ^}bX*J!zsih~yQG+A#N%9Ajdi z7c;(=I|!1+XpA=~pOnzW46&HCzaKo9oj<;r+rIQZsjLr0KGH#mSx2y8yJ3T_CJjofiA9T|-y1D|IosTJoU}%Dt1JC`>I7#pD%Aioy965h>7Yqp_*b*< zY*6alCCf}zxd@F|7Dk9}G4bv?Mub__SI?GcE~KL=_gU%d>brwK?#}Ns%wtA1||@K+jqae06tNQZHK91oow=(p?z_ znjS%tB%f@O99#b?MQz zaz*^}8?F*lM(z@v!5zZ+cGU>81e-VySUI{H&A>IXmcZPB&O~WT=78JzqOP6Z)(Elt zx~y_7XM~5CZqxO}oTqSZ!fjf|aO?-B&!7KlcmXUg+3!7`5CT@}J{{622ji$mR;5{? z2F)wJYg4vaq(LQF*3-Q%zGi8NOz#k1O=Q*=gRXKzefC(3p&{5#jH&qKXQs7d1g@RU z92@lPDInZ~zqQQQroQIE)U|uhf@Qu#(XTUrkV1u~bAp<>w#m}NXZ=#<_M&%q;=5-^ z&rd|V0y$8p^CM<1y|)8<8{Zmc#v#b`cwC=9!>7@go&O>rbW5)3*jQuWt(}-VzCP@_ zYKZQk+iU-#?n}Jg(iL$7R`>_mi`t2cGa+4gpByroS~6?LfG*gU zfolJ7ta`R)azK-m^f)kQ+Go6FSi8kfQoQK95~DUW2tr`Is{DrYbE<>_zF`)KXi5c4lm7J(qiIdCJ~$S-pHSPQzw@{o(b4jZv} zEXIJM0;YC`ySIBFk50*9Z(qk>Mwh&7Ol}y0tdtz)1{61XL|Iiy{V)D*l^xp0XDZ|{YtcV6H8`b07-bY4pL?6F^b{GG2fL|SHZ2F zM=ggxsMs($Y75yAcD!!=teYb24s2C)739E!$jd{c<9t@+J@h_Vnn4hlcbp_=`Koxd zp@vkq#dIlaTxU%*w3~@eUt*~of@#r!J+55UfcHLQSN#r<9?vk3fzoC%-?dZk{)1fq z6~w@&?$e>=D~OYas7;0#uX*+iCw_t=*-1B49<3mqUca8D*`pk6&G zWimC>hXd*XX6T_vWig|CjBEx0!_!wEWjKSl@{uD9Nzlre$xn(PmUoXiT8rrVwaD`M<%nlV4{EcGYewb;#InkQ6;w#Az3tOY(i`O%qz zfaXNLhh=}nyQ?QOKg}{f0%^H*B|e9YUxlq8^HKC8Zi{u#DTLZzHRiKdIaA1qm+jp3 zRY|w^#RwW=2djG#<+&}QN_y@}BCYI47ZCtu5=++az+qTArk3Xmc^F!_$PXfW|O#drZDT2#w)YG;M_|I6Mbu?AqnH&|> zSQJEZtDoqYtz?@S=Qxr>L81kpS064%nr(-Zi(?idhBP@rYu7(&0xlDv+_KK63)-n- zoMyTTkD+I;Gw{b_3s!3FR9PVST0D1%1-*R*4kYEZ7KbeeaKNUVvHAYetv}MrP~O#A z=0c|}Nj>~AiZsmwypr?Y*b+s&5jz_^XRbsr5tX5|VsKxxx^fmpCyBr%R)^<~23m)i-fEAM?Ueyt&6x(wc?%BBH7 zG;N`3(mUBUArgt zyQ`{O)~yg1Gutie|1we;e_wh*#`Gj(FXL6-thAU0c^&AN#4xpH;tFCz&0RF~{^qU- zI1ua88kI&}D10b{T*(@v*f3z?Uje@r|J>;zcy2U!?By@UdJM;Y4B2-GZW1Y*(k$&?gCl} zaGNtb1+j$g|D|WG|NEnrwN3>ee*G})*=J+$9$g8*LTYo|8QA{s@G-p(lCz{oO0II- zxLME0_LJBW(0t~Lg4-yAS>gOWUnms-I^@jzzdoKM=HDMr53NM|y9K6c!+;g4CjYup z=(m4giJ(dc8UEn$#I?5n@dCixCkSYtn3YDEz{ALxozTm}>Y#pOcfo@I2@>p(U;hPh zgU*nMX+0X;R|e=$fyyM4w>ReY!Lm9}tYz4#YD zBJ~h-)3OfmHI6G3sb>;SZaW4>8!a$&3|GIs9abKylM&H}*!RPc)?+0vwDKh)5NrBz4Eg*n}0;T7p?M&U{DEic9+YU!np>LkDm+I9#4O6c{#Bp<)q90rPRM=3-}f zB+v@*hMw_(hXB$j$e9&-^r2rKZ`UVHB%d?>dN!l*U+>M@<=^kk3gQ6XH&gf-)B4cve6)o zW1yUG;#4@pV-)9uSI|BnNj{QPL3hBk{(X;Q_T$a({$LOp0Sv5jtK~w2L!$qR7H1vUFt4cF{!h|1VByCG4kM`_ZGoxukuxqOt@gb(?PLXy+Xiv zb91+RXl;tYK4sP8XA#lSU&)hZ8U@Mo7;RGd-|MGzYsw!THv^0`@eD&ue*y~(=^axq z8D(&ML~DyLGO&8Q(>2IUzXHP?@Zk+YpLL*0$d2x_ffEI~lZE-%ZF1+w4<^r0mh=1 zH@9OsbQO+R)U(^ckn}q+5IrZY_d@zb9jp54Fo6PM0pJ_v4gQL-?+mw@sO$Vd&Oqs~ zDPb|po8qo^CI6ssXIjJD`A8gg&D#9;jkZhw+Utk#r2C%@Bgz3~xo;U`HreDU3YXX5 z^Z80TX`aVq|u)f;Zb(Z*$*0I#yD8OsYWTI^e> zTb+2}*b~F{7A`h_d`lHlPW=spE1tyPx5#pv#a4T+Nj_Da<^3~SeS$$NT@LkOsj|5b zUHwhyGc{QMsT};jvI^>ov?oE8?=Y^a1mO29AseBAZDkty&rgB5J@Xn&z1Y42$5h~o z?fRTel|a6f7_}n7#djQX{+d8m{iGblq!;Vy+*e@P!jED&yMXd0*d_oXG+xM#3K#|h z<*3}+f0{P|wUDf}hpz_2PN(?+-+m8S+O30SgR=I9SINy- zwj-XGF%Z9^&(U@Iy=M>lx35J_=##1YfBPY%puZyX>CnG(TTLK`egND91V$;>VWo8N z8B4IANg+KRc9u3-46(t!885&9hUE3>7ir1to|j;vDLf|jWS*BA6$-LdcvigmE0#9{ zDWY#vL|y!BdkL!U=@eMWqAWc5&rSZY=^04(8aE|XWhP$LQHc8)dBOE@Znj4VKRw-( z!3B%(Zo-344Uy57i~6dpiYgVG>mDlMtpAxMIK2no(JDUhy83s*i2A|-b(@VDAAyet z6alvYDmayehhz%4F@G#ZNP;7R-6UdJfNfPaewbAk_!<_AdUqPunZQrgxb9`(f9dT? zgHN=zbKi7&IG&Y*{?^Sf#GqK-QDLOJyyle?5RYwwUTDLs9=r(w1T;kpLcjVU}~fL8we%dkS5_$xu9ul*}bgr|YDQUP30 zU^G8s?Hd?}>eJRsE%n?i?SlIZ=w2tdUf~`L9mP|ES(~`l+pba>QBFst9u<3QD-_sMbkY_rMV6?@$2s`66D=RiuTSx266O5&0&jL9Z0?v3@ z_R__g0>==L=kEglr*TRn7%oT$UI$WM)5pIruo9;3&gS0q)~B}5;kie3cMrsD4(TEJ zM}H0W;H~`%T@j^!r?4L+RSlU{U?P=SH6vi{8yJ^?kGK#X-LETAgwJrv$>YP#9E3CR zZLzl9M5ULasQbVW04=)uaaG%}7;Eedv{6~uHOOypXNDh1RoJrFtJOigzB2eOdkoAZ zCRzrp;h5|iHY08YVGl-ml|NzWy7z&~(KaoR3M?d6!8B_>xanrj>!MHVwSOh- zDQvPPNFxRVi-L- z`Tq+Y{j|R|1#0|aVfAc?yTu9cdV^g18Iy`wANF!nOb#6MAnf>JG5c}#0^IKnw%zh2 zyT8=l3NYII0EJ5^^8J}moePN z=*?9R?yZgwLMr`xHcX{)cUIb)kodju?ce#NT!f}LJ%Nb`trX>b-@DiF{=q>!d$sY`aTyJ?LAD)mYpSqEkCb|o*&^SMux|>tis3hN z33^8O&E(uStyo;1;xd}cq7cFn6NFqygG8^*tTCz~)rwbMzSCNTPcP(*#Q=7J|o;T71M<#|c0AiIKDm3<~i8(bQxptEcSlXQdPoaDY?XU5(GT z@xcja1>5qzv5pTZ&&R)FhCP8TE4ooI-g#n^!Jw=DWQv z%(>nj?z{i!4fcJ{^9q*5fsCisKLONB*zh_{34X36`|vomID8gu!|d=U{0J#9?%OHz z{WdV9fKAL{HD0h*rjfZFBxMSk2rg8eeinyr$Ld$g%SRGTZO#V?)}2f7MO}M}N=M@H zUZ~%M<3+Z5d*~Q1xuYlW?@GLeJ?mRN1!pt~JRgj|?!UB^w_Vv3G+2)SFUb`H)~NZb zZ*m=fGxvNe^`{DkuECctE%IFv)Gj!Rsg2^UyXpA-&Oti23qWB4on){uG90?$dH;or zggJgex2Uz~4AVM#QUEj7=OU-0rW_RLQ?@;5%I`3*NUevk3;>LyAoaj~Zm|4~oC>Kx z+W7NX)qZQ3Qu2Ms^))#4!S_Kde7FK&#zY!lY|?meVoWa>rI>cR1}9~}CsaC(rvL~d zz3Hzb3yj}(yBv)6#Q`^Ix2-}gVD+JvDdh?>jV2)nkciEK`2B?Bu&Tkme|=YrVfrokfuw|xwg61V#A{%F2?J*C+948psyu7Fb7u_S)pq5U<=CUrz_X2;@KgqDG zBwlZSso(1ZO#b{b(CpG}f3)B=u5-K!)OR5tK`&-gulRl?aJF&J znH}7d7B#-i3MNzy*&Ru?P~0hg)H3*?tO|HQo4-#aQlpqFChL1G_}kE*xm&mJ02HaK zkgCyOU27b)NP*rog|?g&<4lCsIg<=|g{xm> zH9vrJ4Kt3H6K5khblOoS4KAA2Y2;Hn+fh{CW=rq4`pVM30uamm-$IEVovqvU?+VAk zKK|Or(M3T~S~z39iul+Tc>YM~iFqU5jVrC%m|@ot&liDID9ZAh!~JmG4^H4`7qQ)A z2&yKjqu&C>UKFSRd<6s)o9WLPat7C;WF zh`0Da{7#*)Z}@=lZEUdnMRt0wE-Vak^9k=r!fn*449%lWn)^@9-~0wP*I=G1jjLX= zW4nY#?~Q7St@vyA-(EHEEuQ%;415u4;r*%Y9VEM(F*dw_&;u$0rFTy;>PJKpJ{F_&v|!^W@FQh z)-KiUKKIQ5vVEJ402fqvP>v1g5oDT-X+t(LJf>03^yt1Ya& z(0;_0_9mse{c6Jb3aqGYW4i8Ie^?{1Ha}8bfWqZ3~kRjCg3W-&{6E9l?yZM+gLZ@&plNoP>sKhF`ZWyT4E zEZ(PErGbjGyd&b;w~}-hk?$AB0624;>}lM?nT;)fJ+;|=56V@KU2&=4QYVspNvRvO z=huLnc0S)Auy_6DG9KYwT)?S_Ui_B`5J&{ar4KmqK2Ukj%VTt4 z{hdOvuhOpJcO(nsgDz!2>H&`UHD~(Fj>Q7rOh1dx=vx6L!1Y;^CVr!Z#o{+uADlcD z8*(%Ck+B^B#&UefNygdu)##a0W8p*a<*9R;pVV!n{r0)_3O4>|3jDcuABCjbYCZP- z2tH%YFA<5B1PV753%3olMQM30J4_TLxx=&oBaqJlGg zVkJy(5cuG!-h^CE8W|F{IEn(Hlmpd*q*SczBm2GOVDR|rTV%*b?+aXM=_(S_2T+48 z2Gf{b_qm5%rjs3yT_!exbJM@SYZ;zEhXLOyDt>y}TAQ*h%KLyo!mn?36c?^s;|A^B z4?!{34xW#baRfNvCT5OVQwK`bV411-;?`5pZ#LGZuB8yM(Zc3rFJ8hqQ}<`XJ+0Ae z{ke5yxP)kEVOO6;Sh&fp$hc@+^DGH0kjaE|_L+bBfU5XBv}JU2;avmu(6xYjymT;JsbO2A1+f~eUpwco-@qMRVSIGuis^*udW zod#9^V#WOw1wDYUA2WT@F)>7L-j~~cGqiPwB&A}vk>qF7G{sBKJMrjxrJvSV=y4F+ zE;8g>exx%doF3z4`*YG>#B*$N`{0vWQ*)wsIYo79b+wLe(78B($jxSMihr9RDgVAl^w-nK6AL*HG=ew`W})l`8W{E&)mQ$N{xAuUoxXK29=4>K zYOw*+;_mjL>k9COPFh6~((>k;Rq6al^UI-^PCAkDDsBBfGh5c>r`K|@F>ON`jAD;?)lfJu+B_HCia# z%^6k~#<#2kvGsO{i#y?9GPdnR|Bss$d}ku!)3r6Hv&0j&Dg`f{vzK;j?x0 z^9#s=vWjZ{{u=BfG;a6-H}wBB$Np<+&5`4%w|sN!{%$f7<>ZX2HpT9L_r75_6zk(_ zm(ChnFRRvqcb5USeus_Zr9okR2X+HFr%aR)-i(IyfvwHgt0rliGo71^fGu<*=wIzJ zIPqX#utVEQ5~!k>(2)8((d!NN@F4q~CZdETn6i*^p7A?g)-N~ffGc$yWaJ+VpQqDp zI8JQsKka-4)dF(1kqVq@!YO2AF&Zbo`VQtp1EpN*yOVCv=3&t-I4NzXJA$~`y5|ng zLWw(Ukxc*A<)w-ZfmOt*PcITFk_Bt0Un0F6O(O=gCuD*@IGEsTQmdmHY>2cQfx0Ch82 zBftZS0XXEPM$_K1qr_@&OqxB&fKN?m!<;VZEd)lZ5%2_9pThhMog%IImc387 z&#pR5R^bCEB?oGlZAi!G!Loo>((5L-?i)ANrne&h%Ky7YTS1pogPbG>i>Z)qa_!^c zJk=-KK44&!dNxrP08fi3$Eg}FY!3(kw+Fw!&tpKLtr*P^2DV74S3lf^OaI2iu4Py3 zyQgvQz}nFn?0sjzq*9Z5no-h=mIRbv!a2fT=O$cxu_sC3v{fp^bkf$fqA1yd%R>J2 zs^i=_y)K0*zSm{K7d;WLM0H?02Ukt%E6B33(jur2LDF*j0RSP2B|oC|8oxj#cNy&U zSiplV@C+_N7Wm3~fGm6)ta&Uz>XFs84;ZJ~C$Nb^K(odJqz%B?KhKIZEO^v3w9E}M zew%4jY0&}J;|V7<=MS_nd=Hk5uN-W5vBuEKOjlYcu{M7OuTLE~%NkODa>=G?_)V_2 zCt2jp`D`^TM-~hGbT*+Jd73`cOl|xtwY=P@_8jGiK%SFi-3D@^zp<<9^u)i1_7^$I zS>yUO&Tj&Tk_-}Fl-}cI;Z6Q7^{=Fl&gsV9Fcvz$G9$2XP43Ap8+tM8lYr``U((Vor%fs%ZRwI>9F2y-CyHL_y(e^tldPtDKLY%0`Ng;rH&w0$%Uyf z#|5f6LLLF7U+hg=EsLZ)sub$`=cd8c1Y73`TG_0Y=$A8su>eg$g_SYnV}eUy?}nVp zA=;g21*M7N*&T3KrV~&lh8)2v>ekDg^zm^B)CkDD6u)DoPvChV;DA-*d%z!=l!xc+ z!?(c%{l&ypWcSzF3A6WD*GBw_`#+@WWF@~HeVynzhG1fb4JNgM)g;LfPFhUe-bJX1VK0ikV|e7ErX}&fnV3NMO~Dh5 z=O)7m(!3}@ns2eBwfCo9RpG+p@}DR(jR5Hfrdgi2Z10H?0;|@BZXzws5_CgTzd!Pk2$%8`%$M_ZGp+gKPq@*fvK*k^y|ArdR6(#C{%O<^y?Q?i3Y zp}qmb=E;Vt#4Z0V&sxG~sF5>nbxeqIv+gj_!5rd`f80w;&~&+S8W6Tv=e8Kbs+*RT zT8N`TT>G&ZhYUqoN|{C(JCsl!yGw;~>&yFR7J7Hi6#3Ubrd-QpZBJepzki%VZ1rmu zfLuYA#~{DFs+AjBS^wkdcjz@nweguXi(oyHLsWR&L82CAh2hCtBZ9SBL=LKJN6^OsPc-v&XN8NlL&GzTuc7eSB?k!N+T!MzvEkum<9oy1eDpxEX zwu#BC$UET2RnQ#dP)+`bXPUFL2Uw}1{C+ifwe-IIlfTkFd?3!3f3#22B9#%Bm-iBZ z0G zG&cV`;Fe&Bm=da#4)LjuM}3SwCc81GaPnqK`eTLrqh|?;M!QHCCz%P2w34U+eFc(C z^fm!)S?j4-$00HZ$8Y77t~`D*L>7{U5cP_*66;?1Dp$Xwwv zS#Rrqyjh~!E)<7M#RlwY3{7;91I}?LMDblbV=T4C_11ZJ{_uZ-H^X{XhY+3k9}f=f z0@+3+yj>!%CaT~F%k*#cJ##tmUHWyzp2$wl-~Sk8Z*5ABI%{RsDL~Rh6BSe%5wr>B z8A_Q^Epko11p87KpEgfUQni|k#x66?ksOm9A~vL3X4=rT0V%{|9*0Bl;g2tOR6jmR zAh$Ql!k>r!W2&g1Rv%8qNs*i`S{&K*&y+uo2>d@UKAKXE^&n4-ZA;_ zH@dmbzflTFIHX}LNII2PbLI!X_@59>XK0)mXeOZKdgAI=W{MlnvHMx+>~zI9va?0F zC#5JkdDFc}b`t>UY9N0WmO~~>ioRM_W(=PXDT#tsq{Y#(agK13YDD~Md{D_IdL}kd zsYBvGg0T1MJC%NNA{uM)J?9fPRKX2Yf7xP|eH}I}hA{v!%V&&!;Q%1gy6(vodyDfs!f)<-X4{rS28w5t0K^I$7r&48y4|;(Tbh@iIuD8} zV@}TRGsj0UEj(wMiq?*J7I~`KEUxy%=4xqu$l2fVQRWVdHT-ZdZob?`Iz)>rJ5DR) zX88GT(rhAjIu^m8yXAk54}VR2Hhpt{?z(4skl{LDc;LC^T2MXl>7Z_6a`~|TlF(4N zr~JVavcGi~h9pe|qY1wpEpdh>KUH-5#XEGXj&#>I?5Zm@%iOf%^`V@Yu*VMUjXz~_ zzS??s4OLwW<2cVD<{n?D%#|ax7z$F8Z!_c(rIKk3Vk%EsMoO0luP2}k3!FZf)mD^c zd$@a3$MPm>T2*PsklP+qsR%^)lTHu*2B5iRw8mC@Hy%L{0PqBvneyGF6&AG6P^hXm z9qDy-N89y!99%&+PtqP|D3$s`v1GxQ!e zY-;9(BDZ;E`Zo8_^Z-T6&6q+P+nn;-Y+ionhgPnIYVosO8joIC$dTWC9>j@aYK{`m zjXVC^6lSEu{A%a&&^+#Oqu#YYX)C)j@{2UgG>n?dV)7SvRNi0s9eDorBkyA-ukUs_ zhSMWX_PR+nA8F+Ccu0M|vkWy_$;*AJE%1^>Zq9!h)NEXjca(e{^0KB+EcixAZ8Ck; zWkl1h-L&?49hDE~-(>sO#cPiB(7e0Bp0&{a%(~05s=#31oXptLkI_WTdw5M*(A~r& zPHuoYUfeup3LMUf8*XI{GSysbJ*;Z42T}upQ7CV`>*eLdV6)U%PU`8PVuJlN&d zOU`u2soAhFO!QG&p^j&cE^(;YhTKhC1*0a`M)D+XC7ne-`O-&B`<9%V`FvBzR4>Y7~emPL&8@mBqeW^_KjM|zZ9hC^U1W?M&_6w zZ;W{fCapxv%3nEF-x`{rLBvPufwT2KDv z(_xY`K}gYp5)rKQnWxC9N*Y;nYfWF-QkU=GKS;r}BT~I?_Qgm2kbRP)s*-E?PzL#Y zV871yeY|`*Kbuk0%_y7qJy9-)%CFq_B3j~1^ZB9*QG5uZh!X2cmi#9Y z%LzvYUQTBO$BwJ}lx`x3bBw%J&D#%>Q(Y9;>!QXP^&Q(D^X56xZT(q4YiDqsxG$2N zm{`l$Yn3eNyj`za!)uOUas+*ZBHLbNcZFHNOfywDCUF5WW75)g_OS7%ayx4YwrFDf z1?4%8huS3g<;^HuYC4F9!eLl4O?M}EE-b@me!T3~;159}VOD%Eo z(|+B*5B$ziv>fpbJ#h^aDq&g^W-cY*tsmbzPd&XYzphWZd%Rr#HY#jQh`Dj`U5!`I zkD0WUXHjuso9huH-(@@(7;}u_IR2RO3)_6>Bfpr*HucMON{z=Pi@uiAZb&!^6P=p! z&|R_e?X{zueQRlZIetn$JCAa@d4@{{hr$hzubIEB9G`4zB|@I4X+xtJS= z5JJ4jL}e5++ufwDxgJ#{KsMd{G7P0hgRu9m@^Q*4(U*E*Npmp{yGUmQDSiZD8t>9I za86#z;A-H1cJ1p{1-WtTJE5`AhsVCYw@EgSVIPd4I&R4?wlZ^jvJZVqm+vbJzl$`l zR6v$kH3UUmLpbRBss&+;*Pj@;$RN#cDPC?u3w;+cK&tBBb!}2KlzMKnFk;J(o<|_J z54vK)$_nH43f3Lu_a3W8gw<9_yqEP}!_)lcY&$+q7DH<4Vrz+L@?{^&c`2`<7Ut=w zi_eVms%I}u-fGM>z9#cN{^5drTMf^T@zH7&g;1%eOR`FyWw>2HM{Ea`Xn&ZniK$84 z1zg?*)3AS*cjL8_Nsaa25c?I>Cn<(Hd=W*kqnu_HHa1#JM-cbTv*mfWURw;8R8`3K zf0C*3rq?VdkpK4Ru4-BkTKP&O`#w^5=v%7nqdi=~^E~Sj_sNp3s_wYi=TuFQjx}A2 zy4%{w)HfC8F&TVgWWfTLug0JGyZ3={=oAS{WA>*%oqR9UcRmrzTP%}WsWN-Lp&H85 zC$HVQ@)GlD`yb7e<^B=CIrIo99D` zx=_@XD&G9Xle3UgU>Gxxn02pjNze%Wzv72U+$LL0`w=Q?g7IRQLq)0pk#!Q4Qeu;f zlZ+z5l7oa-SC4_6bZQPqcyUbkMx(g#R!_EAVCmC}JdHw@vaYb(d~BXN3j!(B=}P`^ zlfC`*3NA9^Wp{qLi}jp_p$>szd{r!fJ=PF9qi9HHe<~XZawSSdg$k82dwsnk{N>79 z_MU{>d;~OGD5lm~rI62^)IqKb+VY*zq^9}@pG&%!stWz~*)+4sZ4Kk%@VLn<6{_CY zUdv(!{f5%oI~uI7dNFMJSpxPjG21ho&DNvLVVVX zS@a>g{wzAG)qgilL@mr zaGY#~`qv|{n{{C9L4Ad*`aH6eN|e0vg8DDYFboUFuLpfIbb|wRSNR@JkW|*jYo4ui z&&DBizhe?Nds}H(&KFN)!dcyrw&<)UqH<{>yPnNOqiT#!+hy@m2{AWurPZq-r^>p! z3$-0Ym180NWK`}G?6Y2BvjeE?={|yyP;> zD53h%{!I2~_|(VGh^~n^z5OhRa4@FoekFsqFR;HyvE1F4vV>!&%Vvzhm{ejuc)5n8=P6n!MHf@VEhcmMrJ4NmGC3T1WOrGf-2XNg;dE@Hq`Eh!!vq6t_CRYxI&s9c=>1K#ZkMj)NwbCL9!roYCE7ero!&^pXR9MkM z=PLPh(h5f^YS2w_WkVazbnUcOOx5P9e6;G0@vx85s6N#5~QJ)__s{GB! zaD3?;HxGx9)?u;kfXfq-=*bK0!h^Gu{l1N|NQ&~Vh43_wk9i8qWOL1CEtxKem4PX9i|*K+f0of~Sa_MTzmj~~63>Vi6_$DH|GAyt zu}@mx+t2(+w36Z1xEoK$!@0i&KUvQr9zd*=DvK1o7pWFf&(ax^!mxSabe~F31W8mv z40+VRX~>Hj;zPmErA*xsD?8>{GCYYe|1GZqPoz90tqP8izO{k(htiv}$fdydZ?ahKl0J}^#=gu>j60bX zX@E4szJg9alp3)fZhL*|tYLX%J5T#-rnVwK>`(8@yJI(KDXDR0nwa26w$mR?2_pSd z)f+XDKO8W!{7rOS;kwb}j7nF8g~rYcG?geeiFTCs|LN7ur5ajFU&DIFXHM@DGYa-Z z7HT+%DJ%Hon`jg#NR@p_6fqVPry@9wPfi+FoigEGmx zPR^U7%AHUB{kQ(W(h5IvH#aQL8f|6hF|2 zb-|=B8J3lp@Q!gSZhlyMG$NHvY;N>IgTZ*byi9H?3QC0g*2T`EU3)}MYgY<*nNd=j zYL0nih*T5wSA&21dfQPps!Id{C1E7PoVglCZgv7YoY(fLKaCyfq%fC1^rsStE_ z%<@B2Mk$DsJMq>H6IH5_Aet7-7e}qv#EejXu8qxmzoCA8=0dM#27@7amOHH9+<6@A zv5>S@^NvNKu|wKE@{zU+QeLxtK-yO^@JOjC=<@uPLTjxxdN_wDu%OWj}jMgPMi%prk8 ztq?G=@EH=?>;8J>W@^xq%>(*{7PRnfwq_dK#&q?EU}%ao7!TzD%&iIb*068y+_6}R z@W4U;lgzM2hdm!#_T|`X-2LSmT;in0Psoi)r|x`4z78X<8~$8W!1}n#A9 z1Mx^1OsDdIdZh(!W;Oto?m&k@3(P2spfLcdh?}oOoLPXqt){l~Iz~zbc-WfBGhp#} z4`A{l@ckPFFqs*3$BP?Y<8WAlV`ngwoAq-EJ=-j&Va}s--OZ=K=}cvMy$w&)%W6?> zyaw&6!8XOEMDHp}nKsqa+oCzhl;y($W&dMSMLxs77Px%c0(C|Qc&s2%h!gt-ZdN*M9>Dw10Wt*s=I`yrq@-WaDo}gA zkD7L*K%^3N+!zfpZCP;4NHB2PQ~Tn11$*+esbhtiHGp6=V!H*|zO_nO?_5NKco-Vr zxyDJnKY`WW>yX!%UeJ}*XLlqc*5{kqv5TE{b)t)cB7zG&ug9Y;z3|8)!?tKn5zlSl z_N>@;P|S4gHLGfyWyLMsJ@s7$6hmi#fiDDNL)UMKsmr zY4K-0KW80ftj@BvZXnLpE)nrxay{_IkHAD3glde z1jWc)wAOeb+tD~D@iV38MNOYp$A4ap%%D#;P0{Q{h=WI7(w8DYOqb2i5IcZV*D5&Y z=^ZC=X@_uVWISc8ECuW0mfs5z+%GB5bqQAS-Tw0>VO6k$YBK!|f!4H_1-J1sN0Mr` zp2F|0Qtgb3NdM5RT*ZIyaR;s9q`&>HCl43Or@Z?2nqP`zKve#jiov(zU#E69IxB{S zXdBq<5L~K`3F{Hu#O0JSOfN|XO~1LVvr`B;t`tu{>f%E*fhqhYLCa7VNvQmVu|qX` zYU|-hVO<6HfjhO@xL)=eMj<|LbX%1Lr!uKo=g!M?yeMUI7)?eK;W5QiRxfKMq8L~RwGN{Mj*VQ%ybQH`#Nw1@r zn9$=yB`l+?L`0RlUGg03*H1!PYKe#|#nIfRckDabuuM|ch~I{!GfShxl-0c0AaW{OOsn!QKD}i>xM&Cp2e{IiI6rxg`z=QAP)6>dBhjkRd3$c6 ztGpGVnF<7!PZ^#4@^(a~=3rlD$##6s@eR&t7@<%t{p@LAWn_l>Q~t9e_V;xCm>eFh zqV(S3NU61lNCw3>h@`V$G&68b2y%m^nJW2S{>3T%jcNO$JyX_IWoD~Ztb>sCKh06C zUOlLbn8&6Man=%y&E|LTi%gC+I2N7wn4fLKy;*c;EQgz!GL%oH2CbFcY?nfFZ~T6} zura=44+fXUQq<_I?ro#Xf9{hiL8cLlk+ZMv zFUbZ*Dx;~5WtfHN!@8zW4#id00M<-V_o#bHVb;xYs-(dpMx;~cI$U@J&++i6)ciIso(Kq{-OQ2VtxNWHt^aKtL3$CX6HWRp z0w-lvu2UnA^VN@TF823s0;ib=jof@sS@(qoo&p6isvv0*ggs564H^Z(vj&(~Z@?X` z=Z$IMJ?5sIB@vl6=l_Y`CLEr^1_1A=Tye3umd> zE$7bd`j-0$HG~c}zJZ=6==?0Z)sJiIy^T+SU<)}H`T7ElpS@wsGYVBh{t>288-2*K z{>?fZXO&*?#?#JkztzHTV^hrm&nJC_ zYS;vG{nFe`@tkK73dkYL>+j_C7I(#u^M!7ya@8#=hvnV7vRxNGH_lr`^c}5We0KV; zL6C?Eg3G=>V7t07=7sTS@GUx+`!`bM-b`w&rVwYRNIEEbJV-X{rARPuo~=I5Th_&> z$Bip@Lk4;5k2CIXGVIDLaizXoU-)LT}1N9xbNfPc^Ua7^ycfLJLS=gK; zvvNStSL4o|Z0G?$_vt+9eSYzZUgrXSj=c}b(`)y#{Ot}vHMm+1QT5^P=wqOfsbB|z zS#`%JFUp1cVJjt3tC#i3#jekYmQ6l9@H)O*cc9o)dUKpet=s)dVCAkdVTv?@UimuV zP2K{NXiaIsX$=$iPt>>Py`GC;iqan`$Gi*1ub=Gw9Q?6{L4|-9QU}x&i52q)KUt*3 z$VJg9UL3LI%&>^;NllJ&w|>sQm03*PuMsk;(YIufnY?i?jcROUU@SA4ZsENE$A%?p zoG|pKZVbhwSLZS)PYNh>V)dJ)jbs#OtIU?V;+~N(h-B?^b=)UfF|(G-MsxL|8<^4K z!Hs>`-Os8~Me->-v~;W|Ij*iin3nHoT#VGYreey-`;*aj)BLa23k;f02(Fs55zf{6 zdO-~Jq{cKEJ5pQm{eP?%5G#vZPD_Kqm_`>PlW8srH1*lSk{{4V9KJCiAqP{HHOsmy z!ANvH|*e9USK*n*=m61AKQ#>2pTI&@A=g)}k**Q1* z5O0@MqddV4KYCg}`>~7BuN7vlh4O@BA7ExU@8{|L&`rrk2)9ET!_P0tW(4HMmXeI7 zLVetZg6tG(pWNfKG~VGG@7Hk0N1^gEbp3WQi7H*MBFP<_GNJFuMGX35cUxd~pq_tA zT$X!4xIR{_1Wtz0FB7L3a~W2Q{<|(3^{hO^Pbx)tT)qfLxXRCNb&nrahqfvNa=DYW zv_$skA=#5<)91*WkNFlJ$-H8IB44etYWR{&$$ryXJWpGf8P!~nt9&E$v{aqDC&4v! zLHJ7so*qF*I9&7>D3Ng!rA5|bzi#WvP=C?VRDP7zAyi)t@<8p$xP+q64xyJ1BkIc2 z)H)2v zlW$KUD?(iAInO*V>JBj}82}?+CnL(g$s!luYuI&$`4`cj1;~h@Y;nxpxl)k!eW0B~ z<+FD|EU4eJF4s^d!J8jG=kPDsOpo%ue5-bGCONgGIq)%qh%cjWcBsSLxJ)!I|7B7< zxa=j5-PX_ku4JC0>|Y3Hn3k{~u7p$&ZOe z>}f1|u0~^$RTbh&1#2Q3uSv4UW^8(cJ;iw?I&}CQK7WT3Aqq80cbb+njvYIp$1gD) z5en3n)XgtEDqV~-ICn7L-X7s~H5?OihlENQiMuzfAZg&i7r#M-87^cZ4e~$P?N=!% zE}bcG>|*y!w6WwRs!zwP0W81hlMh(=IJ3fzIU%qziO?c*i?Q*Z)|2b#L#R4UT zv+F6ExfEO7at|GH2N+9zGk9DcT;yFi7;BVdUVQX~QCasnp^+i(qSNb+!G&W9(W>Dz zcfb5^dBiM7qaUMs+IbA)Og)AV>QzrKiI{@6Bsm(ydXKHMLqQNmG4m4gPK{MBb*)+) zr5|&aclw23@&aCp2^VG*|EL4DRJD)B$O@W7#u4@O_(y)uaUi7peVbf40BJ;Ra;Tqe zz$k0N-=oBHbnk4zk-B8*TP0Rh=C3yyZ&Ubrn|$)iUR$Les}RbBmJ(}tU3qfn1p2Zl zOt4#lGpIANs|h`M_lj8zMdi8ZAOPc$VBMO*L-!mtZ@cIi+zprR@UYcK9r88yiMPuD=KnCEogowWZj90D@q=TTSp>$VDa_v zjo?*68fKJpW)6!#*+~)0Xfff#+ykfS?LS5Ybiz1HbzQy;MHtTqfynN(T%oN10U{BY z0B$vqk*=Pp?k&v^w;?2SGZSVMKiGJxdUsN>kQYY?#;DZ4-iTf25SdGBVtG4bxZzFD z)0w$oc4l!#WTgT_X{|dcch=T^x?ispieJ1uPduCKB#G~qK>r`q<$H0&0VMFNALt+D z!t|4R@4(zAiln3ndptcdJDM}v!sPj1rY@%#$BevVe^p$W#5D;oLh_*|;db>1Au==Yh9$bC7_tjBhZvK5T zCzW!Mu;Bg~n12}p6tz3pI$qtqDB;U#;(FJlm;J+da1S<4kwTne4ia#`LzrTN9^b!0 zjX4w5Q{-W2@6BYO&pK8ohb;9l;o)(8z~E4`4a4YkgrO!%5rkgh*3s0vm-Y!PpjdW`^bE=6S@7?=ZJj zzy-4vJh@%%ai8$# zLB6_~`0u|Giew-N*++uIDoqlfaWV{o9r%Ad=MM^FRTh(Ib05h=jSq-J#_loNY1|7o z2I{&>E>}lQkER38Up}vJx3tCDd{aRNwMf94l54FJt%zLL<(0>!Pg3O^=hyLGjn_Ec z8Gk6h=F+3I`Cpqz`+yE$2L_#_KvU74m$=jx5fLN@1r7;uH@q&zV!hHFu*@A)pfN?` zr)!F;uj;Z$TtVe$ybdPRp!oEx7wBa+Zc#ji%L{5ozrXg%j#fO-<4y{!k@&>C;j;0rk zjU5#Li;pZAP5KPf(2CdsShw6P9XrW$zXFg2?7;Wkl_5E+8lNw5N;*yKs>!*aW-qGm zcA_?}nXY?uf63RV-pPE-4CKYSsaS9YrY;Wwq*bW-TJffNJ6;bA7M%ruh#kO!G+`tO zHZ=hMXlwTkEP@D=F6|DPDw(QbVpGbcR;$WcP~z+#LFvsM31VKF+7{XZuC4b8vlL7W z|JX;T<%t!?49h&b6C*SHRlobr#Frk*J&Ae+|NBl5woWT=JMTYce`9BUJ zY_|OX038#OsUUsrPXyKp?%q0ne7)tpI`N=PC@5unId6)YCcTuF^ubn^qD*U98Oe=VtL~lw-+#4lX!0ISHp-z z7?yAeWYsEh3bC58%CX(|(BOqq9d7dJ@wCGZ#v+DGFj9&&jI_%euu&VRPIO?1J$8m* zL9|ROymDVq@g=jAft5@?h%LEfFUC)U?tg!0M1v|jUBXik#?edQR(6QUpk?9%x>Jnx!L!KUNpvCXBVEd z)+9`6`=SwWHiwsYgCnJVJ7BwxDeEdze#OTe{|$AM`dhP`B9|)v*66z{glLwC%(THh znP6(sGUk{5^CHp8_)luDuS$!Q{b7&k{toyZ$-&IpJZ8C&tM(g7`erXl_(Nx5VC%~B zE57%>Y~`hxX<1$q?pA&r4~Q!Sd@#V`7|@M4q2Tj-A@GB=k8q zkJ^dxFN%@trlF&-Y!z(AFMtXgUZI@=yrS4v+r@(R70<=7ckGnT_%aHIC06Eu`WCa~ zy<<-+7Az?&wNJduS>yCXF%W>7;jS{>cCu;uYrPt*uXI(OIEN_E{ykrI4LzP@w=%81 zn&!vBAM!Tc|0=Gqj~rv!A9>?(80akx$gke`T^Nn}W)N1oP#G5Qtuo~M+T+RwJo5xF zO#KSa4}x{Bk_u&NU4VwYHftveVM)VZ7@?`ln!q$h^PiC;fAwKkaj46@!$n0ltu`u^N``|lvJN<6qx(g;ID zwDd;mK6$BLt^*H~o|iZJemn-et0zNJ9JI#gGavp5J00w8p z8K!rk7YSAg!`_11gzW~V(tJ8XTP;4naZAkliN7zi&ExF~?=-kwM{lbea+ECrC(F(c zCuZ>kAmh{^{APouo{azbwM#|q4Yh96Gn-!-jd~6jDft?7Zt7dCAOA|wD>j&H6EQLf zjYFPO2z9{GFtSylKa>7*0NruV`yZ_#BAhTcI{ZJ+Iw;W;)N6n>41waHxFkE&RYAt3 z04Cav0Q5jL1SIKl6`@@i_*7VL601``pTqPgUO{X=nbw5&m9Rpvp<+!y~5E(03g#%(E5m%aIwQ z*QvR*e>$K=kS*>J0!Ht94oh-4{>^aEzEZ~mF1 z3H(rc&G((!o*4bPNB=HS!vHyf=Skan8$HhQmMZ+K-d4As9)i@2bVwPEA;Gqiot*23 z)*^TW-{0Y8!JL-emF_c~fp{U#! z{m}uIEX3Elt^oRnIv*d&rY1t|_*R)ESj3c6b2K=KX1lh+vi;U%8IK^sAg+|QY#`KB zfxv?8DNci;Z1G%RNvG3u#VT$CouLUBD#*>lUjitc0K!YAkt~Kj93#uGEM<~e8B8`) zp&7VW36n#sS%#JUgJ~ZayfB}P9yQBZ{(M%$Up`WRQifiaL)l#Ab4 zHp=lVbDRkA)}CM;@l2^oQ>X9e#|(WwK0%L1)I%jSjNi*MD|E`STr7)Fouifvpbc`p zrFe*(`z4*d@Q9g{QlKwAKA1p=TZyUbs!h}T+%Y@V%sKKmQVUKpHde<|mJ@p4cJE^W z#;BCbq*b_B8XKVrM}A3L0OU-B?A0MLN7;IAUfmh29)sm}wcmLoEpE5*}jbEE` z$D9@xHvG+edtW*<#=~jl?8!barCz+cXUTI!?OYf7&ZpF!YRvp;NYXe<8|Ez`p2y+s zUHOY2>5I$wr^P>I$?84KUcxl`w zrRU`83gbjM(S^A0zE1K>oA9`*zXVMToxmnR)VF}8TNOd9sL+k~p z1#|F@Fr?QZ92!6RVk5&Oh1a}x7S2EQ=Z(z!)BkI$e@H&K8>Y>O1)bF-Dr=2`YM~_v zeG}zx^0~A#3x8Y(6Z>^_c^#@#T3@$nk09(=$&ABZNBs;+Sc_&k>Grs~RoubU&!q(= zaF~){Da5~%-mg#pMaSH;Ijg?FfgT?%2{$o5O|2%zvrL}eV{r-?qdJ>UQjih-%A_Z{ zSYS>*(xD|hSP(tmNc(X06%#4>nc1Hjbs2Z%kVGQE)lfWDX0s}B(!*L&L7EZVaGy73 zX8$YA>Hd77f!&|IKKW>_7}%j(FXHK!oi3MWTs0}#44C6*;35G2lY;EkdTv$T(#18_ z%b^q}zuqiucGuK>MEJ}6Kf7GP@ry(yr$@Pblz%-|E7yl;Hsdu1-*7hu zOD%MadR!!N!ZVOUL@+WRJ?<)rs+rG3cIsVwPd3dlL6a8{)l6+WO+39%#p!n7Z{?-83oyNri^S?Y}qsUI;w%h2bNCR@jM( zn&V>toezU)hdQVQbME{82?l|+M$?mTdY?hYgdJ>@10tnixR6({7zfk>!|>mQz+G6Y zOH8En0@Im7u#i!46p7e`fS9xa$UN61$V0QC92IH!G_Iyjs4^FVV;qUi`exzw*u>N%G~*%#m7<|iuEBs|IPOT z^U1@|SHY%3Wqp`JuaS!8q#x5#FV=hS59sK^(ehsJOn0#ZOqxBmf0{8}jq8DmW)(DG z1)I}#)*ggI@BEn3vdyrGUn>olRuJ}q+;CtVXDite?n_AkkU;*V-vagzir|O9nht!2 zFT_50n#C|pRYnnooTNPS!TY=QQ}70<3$JY#D6}SfxbFI0JaiY_bw;L1c16MR3p*@X z%=ge^e;r&$>E153Lb}9VvO&p!txtDPa!{DJR`Yn%h+8}VJT!Cl<2u0MF0-uVmyv?t zbgg|smp%AV*}zz;9c%`>hv-Fk&$>@=(Ltt^3q5yIqCprp%St|7X4>?o0q4(OaIIW{ z333IHNoay4MdGK(E4MR_z;~r_K7`%|rUJQvwtE;*2YDE$t%;@jt|zOn&D@kI$m1TdEfxRkp+^AiXtAi-{cm7N6@V($q2q zEdR6@Mxi`fVweC$)XJ;q& zrzVv1)3e*gt@9qFR_l`AUFZC0S@-S9EF-QPTVnPvUpynd;@rH81&XlEs>(=W^kWc1 z_WTe7yaA`%q}8`25T6Yt8+>jQ#*gljxY#!Q1)_bDVkE5$yoo+(qyQ%f2)Mg!fn!1? z6~~K$5qtT-$k2v!pwl!+wLa9IB*c79xD5)e=7t||&r0kNO|*i^>16ss zu7rB1!{NwR%g3L8duM6}l1^jDmQIMTXrW)8w~S8e|He#=k)*ur)kMI2kACtyb}DKJ zk!^{buH@F4XAc5s-?d&gKr$Ib;$k&iQWhShS&`S7Peej-DdKkJ3^?S(pW+aE{X126}j zw@*D4jAULs3){@}J1R1X%>J2T;t~eb;*#_BV&_acH7{04?XSGv`FsV4H0<_ZOcV}$ zSenkPbf>>Rb4Z%Z@BSOs8+QKhuug?o*V48AHV%Wo-z-dlT}*iiht^EYNz*2Vo~%B# z9iLL5Q0q6T@`Usj>AGPX_nCX%z zeev#|hJqW5|92?hL67IX>HoyXjM|93L{o@mUMw<_3J$fmP=vkA{mwiG+o6UGQ;7*2 zWZ`iEa+i)4H+nMAtzDOHyQeGkJkB}UgF(5AMK5M?@XuY=!`JUITJePYR7 zgn*CSmcmENyITrvr5XQhvwVeA=bHMv-M@kK%VPaLo41%X5XgpsM3JSFei<|m-sBFg zDL)SUEr^ab=ZS=Jm51j&2*r!Qf+;AnTG=1Ro_9uSK4cF@fDMBQ$0}gSxo|BM@d;I= z6U@ZcIZWpR)knZ&JHu;@OTpt{?_2q=Px5ImDfdp}?;@jUiKFnWTf*ihqJCPKZ-7rE zm9d~}j}Ql1XPMUB;U&+r6CmRsOTAIl5p>!{dl|C%g7#g9z>4mB>Pmd`V0S7<4@^F; zp*Y!<5KB&=1?s(&)0Ebd@r^4X#M^_?Q=8udQ%xQrZ1P7M8F!hQ-;b%8=`B-N7YBET z=_y;TUMa>$i;Oc&Ql-Tpt$mU!Me|yJcI4{)e{+93slN!%FXL8_)igxA_Ow4e;o|>$ z$0OZ46K5bAc(}jonB=Mm-Hc_H!y&=66-*R=^@Se=Dpeo+5 zq;md$&An$>R9n_HiU?BVB1^Q$5*3snNm2<2il`*XNhIeasN^g`f+&IliYP%qDYE1s zAS%fsOHe?90)hd7J9pvf_I&UA{kiwg?dRz}PoJV{@3r>YYt1?47-MP*7d?}595}bq zQHsAbWa>@Ls)YCpj>TrmxSa(WnpPz~^dMke{RC6!d%v7{s2=x z8MJ=0Yb}NDOmwvHP*RI!xkXs zK?y@skBD2;+DB}IWeK-}&{tRV0>_!|upg;iBQ`s=8t^rp;pyiOeZvmto;ZJg{##tO zHILTUCwWG8FEZlrqC4F3zhn-C+hdIuo4#UY+%}Q0yEVDX$PMRfRCy_oPWA1uy?{VT zIrN1i)~TgDMg(* zIa4p&m9x>K;ZG{+BN6Ec>^FgT=X&&*%Oa#UUJ2g!&S&U*YO`0|)}eZ#nauM7;%&=paEkNDca*6l9-8WDyxsh-B$=7HzxZpB#*<&3{Hb@Ni2117`h?J=I$q{gnign(`>FtI=SS!gov< zg(41Z3_xXU27QG@#Xt;R=~p6%lHvbYu5jT-AZpyHcB@$sK)ksXW%BafIu*$>s5H^; zL?P!$iakqoQjbvPQg3uM_0P>m@!G#BT(YI-t4|IG4^U)&TobGj3cBZgA&;(^Y+HoB zK66p)i8$(@8i9mvZ;b(e+DDMwWI$=aMzte;FQn$~L4VC*TO_#hA1=V?m%W`$=Yt}` zTY4;sDtRB9>AuN^ljPdPG-`>e<_NSJ=-&QK*!qPipI=tZHgewRC9|oh5*+?qAXMER zteIrl#IK^PeJoTNwYMD!2w1_+mZ})&tLtiL2WZ4V(15YmJ!THs;vF_qIeBW~v@_Rs z8j1xS;9Xp+{qUfe7PMRq0#Pw`m|UIy#WV|RY_(u7yo7s{_c6BR^Lwz`ntEpQ=%dg4 z$E+X z_i0zsk5eK)k7D~?_rHK26lFe7o7fWSibwILi*%9Q-IgEn5u);M2?g0sm!> zuFN}EnkrtoeKhr&6&*D9Nu|l+zN;rhCMA5hXGrhSrsYfyYNSANc;W8YFXQC*97<}6 zH_pU4(2Aa=Kfdw=28O&v8ngc#wl-|{C~28ZO=X4p_$M(B0(TaMj_q@X+6Ez60>h8D z;r<$Sav@&JgB@3dH2=Ah1RY|SFXb|FvA)hg_Wrlg zw)UFg7i!K{)Mox)kNX_SPCs$tJnQqBho`3*#d@U-?xcCyCDd3HphvGfPs!NbPE~lS zKUH*5IO@92_n{ekhqaXpb7$h;i{Z>$2}NMaE<07&8e5AV<4mTIiB8UuiKtvAzrCMy z-yz;VqxFGAvH)y321>2e7^bfY9%HsPx$1C9)b;oxBQD^{^IsWaBBfYWK?3i&JhE-_ zR!qk5eko6ldxG4!m2);H=}ay}2WH`~(#iBL@*_%*{1>n7JpZU-K$fz)GTW6FhiC^N zz>=9rKaM`Mmz4jw%3dRVO9MH3Tx*x5_bzTY%awWd?W~!g!)xkl9@oeF*8*SrX%y%u zJ0Gucwl%b@l}w(ckfiI7eSUtnUJpoTYB#rMW1T5HVB_wTi(&sG!&EdoU2_RRv<(2p z%Odgc^@q?Cp-^|FYE4p$^oncxWbT~_&b}h~Ev|K|r>?>&w-Cwh8vVpvl4B`cWbK2P zAc}q{`8i-VEG#^}pAWY3Z-HfT8VaoW;K&mW z-RU*pj~_v)?%vzT)E|4SgSN?;b^cT!x4-Q;r#z zt8&(U%)e1wSNbyD{HpBi%W7Jt-qR`Fj~~Vz+}?VXG;HnB`1xthb6LtVpNlsYC##T6 zNc|V73^#7fQ)4N^$Xfsj{`Ubfd8GzXKbaLQS$xF->RCtIPxG zI|s(n4_bh;P(Q3cZBFDg%Al*D0?U7RI*Tg8T1qUid<4<+{_uKInx$Mdf%BQ7vqP{HIkSFh#BW3P{()Q#9rnr z=MWz|?pSf}3xyX#0n9F<5D)XGCtZTvI`6>9FLBS^x%wSGKs$?h${S`Er zgfBh-P_O*^Xd*E|F)?;f?Xl-^U53*XJH;a zuT4`}e>sd&Qk<;)G{lmVkj06gI} zlix$<@pGq7Q!Gz5SX6V)Y_Yr5sQ`N>AKJkS^FTmZ)?c`n1CIlwsSeJc_hTE=^<@%p=hm$Sub$8;L&Fth7ysi+H}6)eDimeaSN%m*sx>kcp8C z+}LS%Cnci`n`IlhJKY&1`;K55Ausy_z1?;YLvVUPC?uI=CbE>RDa#RJgrS{Odo?NL zGGwSa+UcTttSNL}ajkmp#z1bBs^1tg`3y?+o4P5EgwU)*@hMe29Ew24|{tWn?}Y=5F)EHL%M^h9+`rG4}xz!HU!|C;NapG5!3udFam(vnVz06&_% z5Scv@;sr$R5~5e91jF$oL_+(bqD4H3mD2@Gqlh4B7ZS;am92bg7ttIt%^I*d`RC8p zP`%8k<*jO^GVZ%bR2I=Kv6-7TefCdAdDzlo77(F3=0U4i*LNjJ9X}sVt^_afC6D?XX`@*f*ZC|4_n?8mZ9!SfZ>Hr!8KsF7@2+i#c$dNSC2W$di<%6A_aabQQ7B>egaU`x-Y~zt${8 zHf2!8_~$e&>#?RkM4*oXIdOFXWA^O-YyxZ6-3ZrGFfM~J`VF9pV>P@tEO6Cv%4xy z+}OQ_%=uinh~#D#R9lWP^F51AztR;qlP)o=X4#V=;dtN2XfCO~K|O{Z$`XQXGOiqm zA@p&;o$R(1{8l(NJ`cu${}dLa68hnupead(&Kb?jw)mGT2uR;8UK>9Vw0;ImSYPmz z;CHt_-nKAE*Iz=teP(eo?eM#DeC{^jY02j=TtL)*Bz=(^#b6-+bQ=zsLd9AuiPr0D zP@*>^@dYF4Z%A=o#X7Ja`hUDd3K?)qpZ)7f$?6td-ql4;!X~}|un&cOD#CgJ$R9;} z(MIT>b3NvdCUx(1%p|JVIKz-4sGAP}QJa)`t#}`lFdhL#MsIbxZN~A)B|93!7gt=u zw=594?Bmfl?i=nlCmj0t?w;@xAiRN;y(L6ya@tR1k~l7i z2=fFG>htNBUf4kk585>x%Lcj_IIf9+WUI4H}#Ao#2!!66k zl&TX7{2iq1U=Eai%)a*=@X3yGxZcJC8|U135%f2ya?qedOTkZzD`QQmLmAz0-djyqg} z1w`UZV#N}WZpxoZyG@vaJk&e}NL7@HzHh$wh?&&grS1_^jeUQ9y%IMa}7k5 z6mCv5OWBj~^dF0Un?!WzBZKiIoDkL-R07imE!uvU&NN}RS=M%89?EIL^r4iB*>W@F$4&FkpFfY1VS=_*dL<`mPyQ|)S!8Zy+?tq<`3Y{q z55#{|HLA6*&UC2NTyD}Y0Cg>*0)CR2j3_}tSCL1r42?%j&`n)YFC)B!*iU%!!Gnp0 z3S546^vpt_?EB}+4|uB!nuvq_v%om$78qyKHoraxQSh;h(ldmGyf^z;d-nQG(+ zEW_7x&vDdVAipl#fhix03BFKc=U3k>h2lE?l}a@v&I5`F`tibC1w5<$;1hRIH6Qx2 zyp5!0XOzI#_=qU3b@F!A#AOk|LF_w0Lehc1G^rB0Uks;tG-6iw@I38H=z^lAXi5Ez zi@2;^ih9VRb>JoJT?;PLa+N_pJvBse<}I}Ezd<-r=t2qoDAa%$paB=i zg0OUqRRL4eA=k84Z5dgZI`@^;t#yeEMsTib9G)_LUb;;wsrC}6r(IH1GKZp*o8%?2 zJf|pRC^5Jx)2_EC(Kcwuv2*Hj;_kUToB${)ZG1bVJ4t6lDkD*qvkdgqm7|eI8x(Zx7{W3>?6i)=%zQ>(px?ixdnZV4hTq-g2jS=HI-Ao_nM5PdlzCc-NXKLa; z9<0w|ps4V08{YAYn%WAj5J}wE_Y~81|G>cu_9n0WJEKCKC`&5*E$@L8d&7iB3`RK?Y;e#5}-HFg+gRIaRz;j?>*akQ3d4?}j*%qL>qa;vF| zv06)sWiUvsX_HRXX1#Tlgnrb$#9mgsR9%jyl{p>Ttw`nSirK8lSOt@vm*p=9p6aWc3OR3F2tu#Myv(sC%h=4 zeYLI3Ts&WoH-{N3sAE-gAmuA`=_q~K5=!Ye3({I1HG^6IXt5HjQg5D7NiICk@dNKK zF!B{N+lN;LkL4cnZ;W%tm@X<`_sGKDnEFW~>6+_L-GCs66TktbddN(>WOFU43j$3q zM$kjF548?6Md^UTy~g^qD~Fm7R==r@sULko&~mDE$Nz9NJ9WZ|GBsz9GSa5Dl(*0p zqww{NhngjwNuip1eW<)dw6H6msG%*#pYf4J#?7F;0MK+S%KJ6n+*6b+c$6(bi_^EcXWsHyOy213cSG;)cL?)OPTs4M;%#s0V>bLr<;66-H`1uH}@}hg0ShH!S=y8Z7plgP>Z0RuG5&A`acp zQ|*btaMA_eH%lIWary3Di)41TeZAFlkUtIyvi*tPf6WdgTb&}%%!g~uAc#1Wg$h;A!A5ZZGblyxudm$I%S4#*@1+_YeAV6G zk(_->j)(@4Fz#SYPt`J&>Z%E)72>%o#>r~@&MiByHFG1KKe<_oLyXUrXxp~j?r{izm zIFz`A+NVW|QYx$Nd;X^%kP6-6sM1RZokB?lUfJn3;62BjrWV0ZMR_>{dRx(EIy9<0 zxu^SUnWp6l$w}WW!4Cc-KqO1=|IX_FA#Aw>q(JxUQUn#>pZcS!AI$EXeM*pq^S)^i zs!P#cd|2s=R<>rfZ5*!;tjuZ|l)x(;1{j4kp;FtKUD~-|^F6kiW1OeefaS#2#?{Rw zEd(F}3vm21K8;9hqtF`ngW2`r0j|o< zP)b(l5cL>RB#~Uo004XV`RJRKD&0fWb2Fjf+y_@nbD9NLlHARn2q!)qkIJNSdf>+A zN3%RMPoaqTRE&=oY;=-hyl9eFfWIK7iZe%}0D}$%9C?w;jKQdFT zMHBa-tjD1F1@;zQe~Gma!LD3VylwC$%Wku11~D@Zph!O?S*Nz5aKN5#NRzT6WIEq4D^ zGPV!dQFQKM%{4l0H~q+3nOVnWiGeI|h@b2=Ws*cDH5h065>asBqM0ldvW+^L~eoeb6i% zyK8=JL*H&HLZ6v**d!VIz8oJK+&mo@+A2G*0ggP9XcP33dj~0T?Da|inVXJ5hcU0J zo|Hw4jkNC`#?+PKdCC(09gVY+Si zmWG1Pl!L_LxkJ@&8bCM)xn$ijfNF|`@u5edZT!=4B`_^JCtmp@p%3ha?5f+`5U37O zc>&RB9w?rUCTNH>9OHHovn43OJoB`V)P81H7NKBt9?YLG*`*mgQ~gNNJ(i?b+VBbT zr`*j!^$?#*0NG>lq28Md{TjwzIdRaB>=87WRj;NZyF_@nKS2E;a@#?qiD@juDyG(NSU+FBJe*Qlqnq!(Sq%uGPPjrl zfX^C7%Wis`T5ipYj3pMUpTc~d&jYr?Ah~IQ9$NnQd|qN7$m5pr_dX;0zYf(vck56L zyQdbHovL=d*s&yhde3zg{13b)?HS?}U5{EG`FiuIt1&^;m?~s|f1HRI%mC7ZvJ_JX zcqY7rIe7j`4XiaCQkKH;c-E$9Q{O-#gsr6WRq;aMDjDyu7gR%stiYZw!1^-jq zOH$Txi)?H17==@@yL)zK5P3?K0TyGhRl5p4KlYpu2KgP8H%d^v07rZJRXp?)kT z7^;8OSxyBpvrMvz!tVg9>oXf#+m%>Q;Sg~L>KP`y^Fv5JA=o3J=|h4wgi|#FPl$#D zxc_iO(E)exa@W*ctzW9=e@CM@Xv!iw&g|}N52l~c?0XNq%(VFxMvxmz08Od+?OH;{^T5swJW#(>G*)gHxH)@4j_ z#oZT8Yj{!qUDk1;{Z&7)ab&|6aeHM^n&yMSJq-Bo}XBmkQ5RKmihM&3-cS zdWvNzepAFZYi;rwb|QE|62qvpHUq|V4}BorD9WXZ~g$zotK2aULH+l{fyxLzCu&fma=&-q>5gd?-#Ccmfz zR2WaX?b@vP{^rv)P2N5}s$hduy{;#=k3}u54E{#bh+TTYsGK{)DAcX`q15@LQxbP2 zx)S4o+AQ(m)fz%PzS`pK+_#~idEq9T6jH$)%QfTHb?r2hpzez~i~=mBQB7>EMrxyI zWT!*8Gt^X=VxcWvrO6H;U&qDcOWHf2@$9Zc5o?7Ym61PmMzj2MgokYq4J%{J-!BP2 z1HE_8#T-ZT>epZOX=eCN#^oQZtX^v20<7d59FO)3-&!fhVGi)p?T?)13I^n5qY%6B%^eXD(m;6lE z^Vigv&zf0NE`CLfe4=Sz0`|hFm-y&me!lRcq&akj*V~S8I)0rth`T#~gL9@eAl&2A zs}zm;sH@N`OVDkVyeg2naRzd4|Jc$2P_m{guMKBMBO;;IpUFsBHIsV~JfiJgEhQe9XU+XJ>P zz-~m`TBur?8+=yA?pQ{&d0>1I9Nu%CTEn?)dw)?QLgnP~#ss^o?EqTTAG4f`jk_2x z(D{zZ&@^W(Mc#L*0P8&Z!Xb~|D5NI@ldG7dwN!ENN5UIS90t!EQqd{;c{+#4ymKv1 zNrky+Amj+zXHouZSfF&m{^ZJNr?2wX=~EQ0$rI53^~s6(k&41!)RU_TI0-i(tQr_i zaRw?Kpf^MNS0&rXQ+;r*w~V3v9UsMLAbsA+ggWVRJj0~N&P>FKa8aj8%@iAgKzW zx9+}K(78@eeD8ZT;%IwStD7f20s&+w$~H!x?AK<~WT1#X2gMW!XU9^le6Xf2@XLL6 zj3Nf{pI&F)4#79yrC0;B=_)qWJ&)xkzM1m}f?<~<=@ts@8oWP7?AC=QeOA{N*#l*D zUu&R)Imq>Bu#RL|^!?T5rhHizBIM@*AYOh6t)OJ4slq`7%S>=vHfUa9bf8 zOhb0I@51@LfPLu5F?sE~Sq=Mf*H}6W$~Z~WJV@qqP${5|o#mxtn)XdD06Vfv1BHf1 z_}|eI^0iWk@%&$K?-Z_Azr&p?00_2E-G0!neFzEh z;O*V*ICSG7@I(rw$R(zcRO?b08-OK4(v0z(2QAO2UJq`Rq7nbmNX4~*qJT2~wfR?Urd8`}o@_=E z*3~+wJ8QoQjn7nlK_(*dtN9KStL-*)eab}=_;H2WVuHi?H0#N+w_hOd|0uA08=^je zvWUTY$HAwct>}AIjCNFxs%WmFDUAoLhC5pLTR*ilC&n+h&sA~-b03o{+5~(?kG5I) ziVBs-Iw~;=ndlPdw!!z$EG+o5)Y5%hZ}6J#<74Ee@7zb!N6G4cFf!@_>Ie~c{l|0@ zReF!ycganl#XwS$0SSF?JebnYveZTy4?ciu>#{tbO z+EVFD4=K|xIWrtsi_%$ew<8-?_a};W0bUVf2njjKJGFg62kv0|P9*6r*3qOT(M)ib zW{28Nhp=$DH`TXLk@KxyZ+3P-dHsN?j9{27fRLdd6gREp@d6IOYT1!2mt z>Hgv8K1^|qrL2|`(Gn${B$8CCAj@5jv_4grA0c46Edm#^7L|{qe2mOIv?b5Ma>hCf1b#_mdjd5)F)kuAOHD5>-W| z+DSZ7x3BTh11;=+`52E7M<+*7GSq4x5V-YOEfgo98{bFzI+sytrZ@^~3SAW68A?7} z`j%@!xVQTPX<0>YK$0TbGRcO~$V8=Rs(PQ3MCV~m9*SRf)jYh}EXJdHmi!Si2T($& z6V^>0qFlBrTy;azpUz5kj+kdE%i?GXjQJ} zeyy9J@_n(;j{q8NdB^de$hC0FG!HW%rTR$}g5Bp3A;s)b?0;onrK#=wff&*!*rIx- zla#9QEX@>XUdlf5O1r9QP&uKy+{qU#Su50>lUKJukam%^Pod)Bw&&f2okR& z=JQrRiQg$xaWq7jy^6&S=WfUi@$07Q_zcJk37_FG3;dIi0?~KWdY}G-6&x_hY49jMh|Cp%~05&CNM&w~QVI<-hW)rZC2D4B~zMQA{$7W!NGS z(FVIVhvw?wQj+ z9)A7JvC|ZkU6W76B7UE%^Hocjb;Dc-{|Zk5v?SjxN60vSdGmxxbc&irB{PyE8OU+Z zS&{lkHLJ#v z=(smTNYR(&LQ@E!Otfi<)=BY7-c=`1_PUz!XCRb!;dvn(DGj;<$C1>rgOQ)Q)JRzj z&uW`yg?4k^YQ`{A8L%X2RgpEHk3FbWMag4xc=K^MJ2y)7Wg@4%L0egq7@bKCMx3f+ z`bO0{r>uK0Fh>S(T$<(dudL%{CGj%!D`EH+=8~%h7U;aF_#z-rgpKg*-?9b+XoV69 zK_@#zM{lkmYt?%?UGxd=#Hu#L*JDrzk?ojzvhN609q+yrMmLZOx}GRA4{-Wqdwlhu z_6F_83biiY-ZNMTy5KLE+!at#7`@S)&g9SSKyfRl$gI|&t)JUVuyYB4)p4thuSKW( z;dtUoGQm0PmHA=r4*4?USBND`=XlFQrY|3oaGU}`SR9E;yS!vE?#eq={(EK7%fb8h zU+iJORSE96m-u;_xo%x26F0$fZFeX#mSUYF`>qv*sPT5?iDG|OHtGWd8;;b zH#>#z@B2k-OFpc*ZA4H?u3E-NvEmPW1V60RXsxF;o@&__`}wn&kT>Cj!e7zVVtGn1 zVnzlS%$?YdaZdDGfHg!;VA!BPLi`}F#=PBbc%$|yuvZfle2w@4bzhh zBvOf@a$tU4+*S=bg2R`ZCO7Q-a{2{UVuLrpMK^6EbOwULc=p@2j0EX#91Cx&j@v|? zu}ju;6nOeyZ#00{9)wKFJm8m@iAsHRvvltTl^K3~-d$^xRiR> z&OXk_uu3>@0D?VZ2L#3a7#W{oX0)j62)SBO=aK8Qm5E}e50lXpTiL1tlE>V}Ytq2O z@rkCGq-fZW(6Q#hYWJyT@>8!kU+*#JI1#@^{T}Ht{PwwfRos5UO^Js-^?$MPK3#e5 z(zD-6laf2f2?;Z^-=t^&r~vbS?w#NyAVsosurqD43p>vy~lZ>1}Ya_gx0SBHe zR!JxRGW4Ce2#wzhMgx#soxlX~vSigxY^zyzycg=X!!oiK_E( z>ID*VVrc4ubmW;{z8*u*e+6XXs>;)(lB(Apk73VHJprgyIEedh#3W-`gni6X$JUn~ zxkn~v{gpD_+9%(+_YW9&=IpiD>i2s&mP^m+!%QS0BztP{I6otIv8ctXU>VVewQ8_w zwXs<|ytoah)aMK^=+gs^wGgEGtJ2Gw+gD^}flJCC&m=L2XQnj51Rj^vm{I(3>?Q9i zo9V9C$F4`W8b}*vWLlq-G28Nyy&URp9{%O(G901qnH2Ti{r)oXiOW3)nWTfu8t=wN zvEje7aidT+%9_NR1*cenL0ON0Xdk~o(d-e6xqry1n`~InF`t(^3Q~DENy{kw8l^28 zsfXVS>SR16mI0<)XWz=7>I#;W4RJzkjTD$;IQ!++@n1$y|A> zydidRw>07oq6hq{MEq`O6*{62`~pfk%X+R5Cw$z?fBw&&G5gY>zs2hA^0;;ZpZ;C4 zuT_0#4QoqRI)i&o<(nNASI088Mlc?(aUYGP4XPAzU|bDB=@*B(lDvxu&5NE_r6a{M zM(CMF$A+SEDLon^4pa3Gp7A@j|3uKc+2woXpA9~}I>K|-_BVZOO{MTm>xqVSJKLRO z<}T4DROMwFqQq__!#^iIIz3I*MN6J;!>LfIV$0>pJKui)hhlG8c2w1{Gp;tDcbmf| zLD79Rde`Fj^B-=oAq25=&HP*yRGs`i*Ve#`Z>^q?$VQ!syYc1*f@o!$xYbus`_fs? zar^Fgg+FCDE1N@|Y@Z!)IWW26icCBEjYB(Lzqy)xCa#-~D-6~D@cYe?zgl-RHtt1R zRg2$_{ffe_BFz-ygOMN`Y4kqmnupZl4{Pf?8m4c>T*sNdHzvGn9efK4oIYuz>tCD5 zio4%i+!#MF2<@^I0 zOkuT^;dL0T5=+V=!)m+2VelRp>6l{Sl$Y`65PMn207tB{1>el+4 zc;rCajkvhSZTc_gnq)R`oC@0%Go!vN*Fmp|(Lj}sgS?HsYD>T8<}YmW z(y-Kjx3G7?-&AHF0>jL1^VbriahB{XH{%rZR-=zdO*dPCbQvq}=aKCb)a22BMn(#@ z*sEUP`uXAw(u-s?t_S8QaQ6s4GJs_1Xo7}mmG~!&>gu~tm$5Iu1`RD-S{xLnDI-wZ zN9w++u8%l9tEi-p(^wKp%p=b2wSMFA8}VKl-%Li1gLA7d(sLdYpnU+$c~orzhUk5st$<1jT2d=RwRErDIJ zX<>Ziz$jjgT}6t9HKD$w%#>rI?x6F`xdr?M&P3VYKLJj6Kq?xWIGfezJW?K=hV@?g zN;!2m=DrNXMjn)@=%zK2tlbw|6<$npz zGQ8q!t;GN_KBKFcz2Zn1-5J9g=h+K8$}g94I=R_d?!+oS@}T+V z@HlHoVQcC6GHElyp=@n$<*Cq7$MTi{ECyH#e{+FQvQ#y~br4I3((bc8z6XGLY z2`+YncNAZR7F(Ja$M{WTp>SVbZn@T0@^R6b&YXTo=V_Cu5k6YQ-|;*2xUS;H#dSEu zmdzjV_v*!YO_GfEK7OkBzI1kMx9?-kp?8;yL)I_9e*6xNIjXp?$@i+4`CxSIFU&jr zTKy>|??~-^BaLybR?TrNMlqv~qDnmY_8fnYXmbVT8;SKC9*4TBI&3%&`~Yv)iW}1} zQ`h5KTg8r-fGunjE-FC$+IE`w`<5hWMUdQpv?5&&8U2JD<*bj1OaZ@hge}W&z)gBn^Br8sBZgJA(r+i3?s|KQ#HqR9%{9 zwZHey)bkbpYw%DS2m(Lc_`=6!pEgSnyP&dL=x>cu+W~XxJq#Q5l9; zUeBiD;q1 zu{Gd1xB_o&Qc3W-Z-UGBvINfs8kd&$}dnuRBnRGNn`>J;#th6_yCSEAqxUSj4W{G$8ipC3Lr>`MF&p-8F zL7_9Ul|T6^Y}HrBZQipnF}`W9TW%?WH!zqU^wTI^c8et}_6?cx*G3F;uQN3AFv^xS z#G%XHb1!3){Wer`3w;ZfP4XB_hZ;xUVo67L1aRLr3~Nkp@Q%hyQBNrhOyy=u*qkc6 z4fmSHD%x{2M4wc$a^{Xpn{3UMH(aCoA`fTg;F^lKO}wvZ`CY+tqUQ)ht;%CCbC0Ga znz%tmL_|rgrLJ;umP~0^dwu7|uAA5V_XZc5ozasOYjm14+jEm6_qXMv`mV};ebeBu zGqW_gvEzuV|C}{O!9w!qQS;c{H9HP3i+u9!1gnH|54-~nYsOG9-gk&Xk}2`#H-m^Z zCboNibvtX9at2t5jc)Hvp`Fv4b<{Vpy?gqyYJ6xPF-fHCT8LbTxYDkD!*}0z*=orm zh1*M7E4ig2ye5V6W&zIzg(w*^qLmjGpLtiul;%_SldT;;O-%<=hYsmk_TLP2V_7E0 zg{2O^GrWtu!HT%Fw5k;}p6T%TM4EWib*X*5g#iK5a4AOyw6jxYa?Hl#LRxyW3i-{2 zDalRNfn5no!g;~|d=PzYP9eO;$MvrA1{_L&89jF)`&ut9uX+~!i*^2>aKOKO{Z zqc%>7%cn`_Uy)p8BwXbE%v)(|eWfI~*5hogjl?*^{kn~A#z)+1rN$MJ)<>N^dC>mSmdT+^d_kv$4TM`-o?l zJI50CX4cDDr11Tc7Bej6uG6M|s3nS2*Dt4Ut2NwhgmU0rK*SqPc+a0Byrxq>k{BC0 zS{l60(RMe8e|q+^?fsi+k-mmqvoN)nEkRrLBl3;U?q_XJjA8>rmusHis|(uXqr`=} zc*Zy;DBsbB8^FZ@6PP_OXNvNOr!{xA~_|Hl%-d5MYpuLsGwZX7>+U#5sz_h4E`x{ z!*B)3kfr!O7@Uh8HtnBtVUcEElL0mI`>@Q(ZS7OVN02*s`qv$xaE{1O;L++}K2n1!~lkOZE37zprd*OFYc_C~gy(6XCz+B(#`qZ#H-tI(rWzvta;=loV0e z=LpLh?L0{Mee}UQ%D$%-aus1NbGx!_A=W4^YW0Z=r8ev!e|{OG{D3`V zsfQQudra4<0yYsRpZ4azzpTmJ*{cxhvPNQe{I=pN)@ywS_EyQ>50t}NOSH_CIu^5R ztLtg~{y6qOzYBw{AVof{-AtX8Nm6|EQ*nUj@9%aIJ~dHd$r6L`Bg^Mv%iq^Mj3!*S ziO;)UbCb_+++z99t3voAOD4iim*h_Ndp#Gde(Y*O{r69&(<5JAKEJfBBougSYq`GS z?-5(N5x#6-oWh4zWrTUCU$O-^ZR&((x$wuWh@h$_(j>y~tk2-C>Kd|{K%P*&ZH z=f87k*-SiqN29d3G^1Rwx|#bk{a-i3us4AbZK;Z{m}vBF6JFB2D`u1``+lNx77@)~ z(kgL}u2KK*z1C$8$kd40g4JX44NF*tiL7*jY$%~;Pdqy_qIO5W&z)c zM5CRf&Q+fMYXm5?CY(q8ho$}+F-(aX3WZZEFcJLMg&vZla1N<#f6X?mEN&8#QSO1_ zl>a_C_)Z`E%e~|AuX#j6jDh|bQX4s~IB6#3VqfL#d%@hZw^k?+5c6)tpq zUz7CB^J@PZCCJ$=<>9EL|LZLZR=yi-nR)67_rFGYP*u5o?Mo*5wFO5pM8pSYvN* zZ`+yvy7G#OjmMySJ$aHAcM?K8pXb9%tN9K)rSKpsr}MGW}lt6 z^!aly-Tvb@T%D3tYe=Er^E>1Dh_uqdwf~4 zsI08KA>+c7CrEfYi?AjZe;VH`xFzU=u(A`t4rJZLnq`3ALW82py2iBG4g*(xrt#aWEwyd z-*Df5I_AdM$VhA%)l>4R}9;THaRypb%h)bH=q`d>@1 zg%X8pc@x6*&sUKl2RE|8G_(0L^Z#oNPLYy~PR%LP68_|$>seC6y;3X0{c906eueLU u^?E?|uk~6Q8Ejd5ARGIyRcPrSvb%pk1nun*6^$o?|7c;)s+Xu*hW Figure 1: Simplified illustration of the mini-lab. + +This project can also be used as a template for writing your own metal-stack deployments. + + + +- [Requirements](#requirements) +- [Known Limitations](#known-limitations) +- [Try it out](#try-it-out) + - [Power management](#power-management) +- [Flavors](#flavors) +- [Network Topology](#network-topology) + + + +## Requirements + +- Linux machine with hardware virtualization support +- kvm as hypervisor for the VMs (you can check through the `kvm-ok` command) +- [docker](https://www.docker.com/) >= 24.x.y (for using kind and our deployment base image) +- [kind](https://github.com/kubernetes-sigs/kind/releases) == v0.23.0 (for hosting the metal control plane) +- [containerlab](https://containerlab.dev/install/) >= v0.56.0 +- the lab creates a docker network on your host machine with the address block `203.0.113.0/24`, designated as TEST-NET-3 for documentation and examples. +- (recommended) haveged to have enough random entropy (only needed if the PXE process does not work) + +Here is some code that should help you to set up most of the requirements: + + ```bash +# If UFW enabled. +# Disable the firewall or allow traffic through Docker network IP range. +sudo ufw status +sudo ufw allow from 172.17.0.0/16 + +# Install required tools / kvm +sudo apt install -y git curl qemu qemu-kvm haveged jq + +# Install Docker +curl -fsSL https://get.docker.com | sh +# if you want to be on the safe side, follow the original installation +# instructions at https://docs.docker.com/engine/install/ubuntu/ + +# Ensure that your user is member of the group "docker" +# you need to login again in order to make this change take effect +sudo usermod -G docker -a ${USER} + +# Install containerlab +bash -c "$(curl -sL https://get.containerlab.dev)" + +# Install kind (kubernetes in docker), for more details see https://kind.sigs.k8s.io/docs/user/quick-start/#installation +sudo curl -Lo /usr/local/bin/kind "https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64" +sudo chmod +x /usr/local/bin/kind +``` + +The following ports are used statically on your host machine: + +| Port | Bind Address | Description | +|:----:|:------------ |:---------------------------------- | +| 6443 | 0.0.0.0 | kube-apiserver of the kind cluster | +| 4443 | 0.0.0.0 | HTTPS ingress | +| 4150 | 0.0.0.0 | nsqd | +| 8080 | 0.0.0.0 | HTTP ingress | + +## Known Limitations + +- to keep the demo small there is no EVPN +- machines have to be restarted manually with `make power-reset-` +- login to the machines is possible with virsh console, login to the firewall is possible with SSH from your local machine + +## Try it out + +```bash +git clone https://github.com/metal-stack/mini-lab.git +cd mini-lab +``` + +Start the mini-lab with a kind cluster, a metal-api instance as well as two containers wrapping leaf switches and another container that hosts two user-allocatable machines: + +```bash +make +# containerlab will ask you for root permissions (https://github.com/srl-labs/containerlab/issues/669) +``` + +Before the upcoming steps, you need to bind some environment variables using the following command. This ensures `metalctl` `kubectl` are able to communicate with your mini-lab. + +```bash +eval $(make dev-env) +``` + +After the deployment and waiting for a short amount of time, two machines in status `PXE booting` become visible through `metalctl machine ls`: + +```bash +docker compose run --rm metalctl machine ls + +ID LAST EVENT WHEN AGE HOSTNAME PROJECT SIZE IMAGE PARTITION +00000000-0000-0000-0000-000000000001   PXE Booting 3s +00000000-0000-0000-0000-000000000002 PXE Booting 5s +``` + +Wait until the machines reach the waiting state: + +```bash +docker compose run --rm metalctl machine ls + +ID LAST EVENT WHEN AGE HOSTNAME PROJECT SIZE IMAGE PARTITION +00000000-0000-0000-0000-000000000001   Waiting 8s v1-small-x86 mini-lab +00000000-0000-0000-0000-000000000002   Waiting 8s v1-small-x86 mini-lab +``` + +Create a firewall and a machine with: + +```bash +make firewall +make machine +``` + +__Alternatively__, you may want to issue the `metalctl` commands on your own: + +```bash +docker compose run --rm metalctl network allocate \ + --partition mini-lab \ + --project 00000000-0000-0000-0000-000000000000 \ + --name user-private-network + +# lookup the network ID and create a machine +docker compose run --rm metalctl machine create \ + --description test \ + --name machine \ + --hostname machine \ + --project 00000000-0000-0000-0000-000000000000 \ + --partition mini-lab \ + --image ubuntu-24.4 \ + --size v1-small-x86 \ + --networks + +# create a firewall that is also connected to the virtual internet-mini-lab network +docker compose run --rm metalctl firewall create \ + --description fw \ + --name fw \ + --hostname fw \ + --project 00000000-0000-0000-0000-000000000000 \ + --partition mini-lab \ + --image firewall-ubuntu-3.0 \ + --size v1-small-x86 \ + --networks internet-mini-lab, +``` + +See the installation process in action + +```bash +make console-machine01 # or console-machine02 +... +Ubuntu 24.04 machine ttyS0 + +machine login: +``` + +Two machines are now installed and have status "Phoned Home" + +```bash +docker compose run --rm metalctl machine ls +ID LAST EVENT WHEN AGE HOSTNAME PROJECT SIZE IMAGE PARTITION +00000000-0000-0000-0000-000000000001   Phoned Home 2s 21s machine 00000000-0000-0000-0000-000000000000 v1-small-x86 Ubuntu 24.04 mini-lab +00000000-0000-0000-0000-000000000002   Phoned Home 8s 18s fw 00000000-0000-0000-0000-000000000000 v1-small-x86 Firewall 3 Ubuntu mini-lab +``` + +Login with user name metal and the console password from + +```bash +docker compose run --rm metalctl machine consolepassword 00000000-0000-0000-0000-000000000001 +``` + +To remove the kind cluster, the switches and machines, run: + +```bash +make cleanup +``` + +### Power management + +There are make targets to handle the power state of a machine: +``` +make power-- +``` + +## Flavors + +There are two versions, or flavors, of the mini-lab environment which differ in regards to the NOS running on the leaves: + +- `sonic`: runs 2 SONiC switches +- `capms`: runs the SONiC flavor but with three instead of two machines (this is used for [cluster-provider-metal-stack](https://github.com/metal-stack/cluster-api-provider-metal-stack) in order to have dedicated hosts for control plane / worker / firewall) +- `gardener`: installs the [Gardener](https://gardener.cloud) in the mini-lab + +In order to start specific flavor, you can define the flavor as follows: + +```bash +export MINI_LAB_FLAVOR=sonic +make +``` + +## Network topology + +An Nginx is running inside of the www container to allow automatic testing of outgoing connections. + +![Network topology](./assets/network.svg) + +> Figure 2: mini-lab network topology illustration. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-audit/gardener-extension-audit.md b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-audit/gardener-extension-audit.md new file mode 100644 index 0000000..3a1373e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-audit/gardener-extension-audit.md @@ -0,0 +1,36 @@ +--- +slug: /references/gardener-extension-audit +title: gardener-extension-audit +sidebar_position: 1 +--- + +# gardener-extension-audit + +Provides a Gardener extension for managing kube-apiserver audit logs for a shoot cluster. + +The extension spins up a fluent-bit-based audit sink in the seed's shoot namespace prior to starting the shoot's API server. Therefore, it is required to run this extension with the reconcile lifecycle policy `BeforeKubeAPIServer`. Also the deletion has to happen `BeforeKubeAPIServer` as otherwise the managed resources of this extension block the shoot deletion flow. + +This sink has the ability to buffer audit logs to a persistent volume and send them to the supported backends. + +## Specifying An Audit Policy + +A custom audit policy can be natively configured by Gardener in the shoot spec's API server configuration under `.spec.kubernetes.kubeAPIServer.auditConfig.auditPolicy.configMapRef.name`. + +## Supported Backends + +- Splunk +- S3 +- Log (just logs to the container, only for devel-purposes) +- Cluster Forwarding (forwards audit logs into a pod in the shoot cluster) + +> [!IMPORTANT] +> The Cluster Forwarding backend is mainly intended for showcasing and not for production purposes. It is known not to work with Gardener HA Control Planes and also there were issues reported when using it in combination with the Cilium CNI configured kubeproxyless with Native-Routing (audit entries do not arrive at the `audittailer` pod). + +## Development + +This extension can be developed in the gardener-local devel environment. + +1. Start up the local devel environment +1. The extension's docker image can be pushed into Kind using `make push-to-gardener-local` +1. Install the extension `kubectl apply -k example/` +1. Parametrize the `example/shoot.yaml` and apply with `kubectl -f example/shoot.yaml` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-csi-driver-lvm/gardener-extension-csi-driver-lvm.md b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-csi-driver-lvm/gardener-extension-csi-driver-lvm.md new file mode 100644 index 0000000..a0df688 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-csi-driver-lvm/gardener-extension-csi-driver-lvm.md @@ -0,0 +1,38 @@ +--- +slug: /references/gardener-extension-csi-driver-lvm +title: gardener-extension-csi-driver-lvm +sidebar_position: 2 +--- + +# gardener-extension-csi-driver-lvm + +Provides a Gardener extension for managing [csi-driver-lvm](https://github.com/metal-stack/csi-driver-lvm) for a shoot cluster. + +As a safety measurement, the extension checks for the old [csi-lvm](https://github.com/metal-stack/csi-lvm/tree/master) and stops reconciling if the old driver is still available. +If not the extension will reconcile the new `csi-driver-lvm`. + +The following storage classes will be created by default: + +- `csi-driver-lvm-linear` for linear volumes +- `csi-driver-lvm-mirror` for mirrored volumes for improved redundancy on multiple physical volumes +- `csi-driver-lvm-striped` for striped volumes for improved performance on multiple physical volumes +- `csi-lvm` for backwards compatibility with type linear. + +See [docs/migration.md](./migration.md) for further information about migrating from `csi-lvm` to `csi-driver-lvm`. + +## Development + +This extension can be developed in the gardener-local devel environment. Before make sure you have created loop-devices on your machine (identical to how you would develop the csi-driver-lvm locally, refer to the repository [docs](https://github.com/metal-stack/csi-driver-lvm?tab=readme-ov-file#development) for further information). + +```sh +for i in 100 101; do fallocate -l 1G loop${i}.img ; sudo losetup /dev/loop${i} loop${i}.img; done +sudo losetup -a +# use this for recreation or cleanup +# for i in 100 101; do sudo losetup -d /dev/loop${i}; rm -f loop${i}.img; done +``` + +1. Start up the local devel environment +1. The extension's docker image can be pushed into Kind using `make push-to-gardener-local` +1. Install the extension `kubectl apply -k example/` +1. Parametrize the `example/shoot.yaml` and apply with `kubectl -f example/shoot.yaml` + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-csi-driver-lvm/migration.md b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-csi-driver-lvm/migration.md new file mode 100644 index 0000000..6d12b5e --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-csi-driver-lvm/migration.md @@ -0,0 +1,45 @@ +--- +slug: /references/migration +title: migration +sidebar_position: 0 +--- + +# Migration from csi-lvm to csi-driver-lvm + +The migration from the deprecated [`csi-lvm`](https://github.com/metal-stack/csi-lvm) to the new `csi-driver-lvm` must be performed in multiple steps. In here we assume you are currently using the [gardener-extension-provider-metal](https://github.com/metal-stack/gardener-extension-provider-metal). + +1. Add the the `csi-driver-lvm` extension to the shoot spec. +2. Disable `csi-lvm` in `gardener-extension-provider-metal` by setting `featureGates.disableCsiLvm` to `true`. This allows the `csi-driver-lvm` to be installed. +3. Wait until the shoot has been successfully reconciled. +4. Make sure the `csi-driver-lvm` has been installed and that the `csi-lvm` storage class has been created. +5. Make sure to roll all nodes. Otherwise volumes will stop working after the next restart of a machine. + +## Issues + +### Why is the Drop-in replacement not possible? + +Deploying the new csi-driver-lvm with the same provisioner-name as the old one is not possible, as it causes errors when using k8s sidecar images for controllers. + +The provisioner name contains "/", which causes problems with node registrar directories (**metal-stack.io/csi-lvm**): + +```sh +I1015 08:09:23.292306 1 node_register.go:53] Starting Registration Server at: /registration/metal-stack.io/csi-lvm-reg.sock + +E1015 08:09:23.292482 1 node_register.go:56] failed to listen on socket: /registration/metal-stack.io/csi-lvm-reg.sock with error: listen unix /registration/metal-stack.io/csi-lvm-reg.sock: bind: no such file or directory +``` + +This problem requires a more complex migration. + +## Manual migration +The migration solution so far has been tested manually: + +1. create old controller & provisioner +2. create pvcs & pod +3. write files to volumes +4. delete old controller & provisioner +5. install new controller & provisioner with helm +6. add additional storage class with name `csi-lvm` and type linear + 1. mimics old storage class + 2. default storage class (not supported yet -> see default storage class of `gardener-extension-provider-metal`) +7. create new pvcs +8. create new pod with old and new pvcs and test diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-ontap/gardener-extension-ontap.md b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-ontap/gardener-extension-ontap.md new file mode 100644 index 0000000..c2f75f7 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-extension-ontap/gardener-extension-ontap.md @@ -0,0 +1,307 @@ +--- +slug: /references/gardener-extension-ontap +title: gardener-extension-ontap +sidebar_position: 3 +--- + +# Gardener Extension for NetApp ONTAP CSI Plugin + +This repository contains the Gardener extension controller for managing the NetApp ONTAP CSI Plugin. + +## Table of Contents + +- [Prerequisites](#prerequisites) +- [Development Workflow](#development-workflow) +- [Test Environment Setup](#test-environment-setup) +- [Known Issues](#known-issues) +- [TODO List](#todo-list) + +## Prerequisites + +- A local Gardener setup + +## Development Workflow + +### Setup Gardener Locally + +1. Clone the Gardener Repository: + +```bash +git clone git@github.com:gardener/gardener.git +``` + +2. Start a local Kubernetes cluster: + +```bash +make kind-up +``` + +3. Deploy Gardener: + +```bash +make gardener-up +``` + +4. Generate Helm Charts: + +```bash +make generate +``` + +### Deploy the Extension + +1. Apply the example configuration: + +```bash +kubectl apply -k example/ +``` + +2. Apply the shoot cluster configuration: + +```bash +kubectl apply -f example/shoot.yaml +``` + +### Update Code Changes + +When making changes to the code, build and deploy locally using: + +```bash +make push-to-gardener-local +``` + +### Access the Shoot Cluster + +1. Adjust your `/etc/hosts` file: + +```bash +cat < admin-kubeconf.yaml +``` + +3. Trigger a reconciliation if needed: + +```bash +kubectl -n garden- annotate shoot gardener.cloud/operation=reconcile +``` + +## Test Environment Setup + +To properly set up the test environment, we need to configure network translation between the external IPs (10.x) and internal KVM network (192.168.x). + +### Simulator Host Machine Configuration + +#### Cluster Management Interface + +```bash +# Port Forward rules +sudo iptables -t nat -A PREROUTING -i lan0 -p tcp --dport 443 -d 10.130.184.5 -j DNAT --to-destination 192.168.10.11 +sudo iptables -t nat -A PREROUTING -i lan1 -p tcp --dport 443 -d 10.130.184.5 -j DNAT --to-destination 192.168.10.11 + +# NAT rules +sudo iptables -t nat -A POSTROUTING -o lan0 -p tcp --dport 443 -d 192.168.10.11 -j SNAT --to-source 10.130.184.5 +sudo iptables -t nat -A POSTROUTING -o lan1 -p tcp --dport 443 -d 192.168.10.11 -j SNAT --to-source 10.130.184.5 + +# Forward rules +sudo iptables -I FORWARD 1 -i lan0 -o br-ontap-data -d 192.168.10.11 -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT +sudo iptables -I FORWARD 2 -i lan1 -o br-ontap-data -d 192.168.10.11 -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT +sudo iptables -I FORWARD 3 -i br-ontap-data -o lan0 -s 192.168.10.11 -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +sudo iptables -I FORWARD 4 -i br-ontap-data -o lan1 -s 192.168.10.11 -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +``` + +#### SVM Management Interface + +```bash +# Port Forward rules +sudo iptables -t nat -A PREROUTING -i lan0 -p tcp --dport 443 -d 10.130.184.6 -j DNAT --to-destination 192.168.10.29 +sudo iptables -t nat -A PREROUTING -i lan1 -p tcp --dport 443 -d 10.130.184.6 -j DNAT --to-destination 192.168.10.29 + +# NAT rules +sudo iptables -t nat -A POSTROUTING -o lan0 -p tcp --dport 443 -d 192.168.10.29 -j SNAT --to-source 10.130.184.6 +sudo iptables -t nat -A POSTROUTING -o lan1 -p tcp --dport 443 -d 192.168.10.29 -j SNAT --to-source 10.130.184.6 + +# Forward rules +sudo iptables -I FORWARD 1 -i lan0 -o br-ontap-data -d 192.168.10.29 -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT +sudo iptables -I FORWARD 2 -i lan1 -o br-ontap-data -d 192.168.10.29 -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT +sudo iptables -I FORWARD 3 -i br-ontap-data -o lan0 -s 192.168.10.29 -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +sudo iptables -I FORWARD 4 -i br-ontap-data -o lan1 -s 192.168.10.29 -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +``` + +#### SVM Data Interface + +```bash +# Port Forward rules +sudo iptables -t nat -A PREROUTING -i lan0 -p tcp --dport 4420 -d 10.130.184.7 -j DNAT --to-destination 192.168.10.30 +sudo iptables -t nat -A PREROUTING -i lan1 -p tcp --dport 4420 -d 10.130.184.7 -j DNAT --to-destination 192.168.10.30 + +# NAT rules +sudo iptables -t nat -A POSTROUTING -o lan0 -p tcp --dport 4420 -j SNAT --to-source 10.130.184.7 +sudo iptables -t nat -A POSTROUTING -o lan1 -p tcp --dport 4420 -d 192.168.10.30 -j SNAT --to-source 10.130.184.7 + +# Forward rules +sudo iptables -I FORWARD 1 -i lan0 -o br-ontap-data -d 192.168.10.30 -p tcp --dport 4420 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT +sudo iptables -I FORWARD 2 -i lan1 -o br-ontap-data -d 192.168.10.30 -p tcp --dport 4420 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT +sudo iptables -I FORWARD 3 -i br-ontap-data -o lan0 -s 192.168.10.30 -p tcp --sport 4420 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +sudo iptables -I FORWARD 4 -i br-ontap-data -o lan1 -s 192.168.10.30 -p tcp --sport 4420 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +``` + +### Worker Node Configuration + +Configure the worker node with these rules: + +```bash +iptables -t nat -A OUTPUT -d 192.168.10.30 -j DNAT --to-destination 10.130.184.7 +iptables -t nat -A OUTPUT -d 192.168.10.30 -p tcp --dport 4420 -j DNAT --to-destination 10.130.184.7:4420 +iptables -t nat -A POSTROUTING -d 10.130.184.7 -j MASQUERADE + +echo "10.130.184.7 192.168.10.30" >> /etc/hosts +``` + +### Required Network Policies + +#### Clusterwidewide Network Policy in Shoot: + +```bash +apiVersion: metal-stack.io/v1 +kind: ClusterwideNetworkPolicy +metadata: + namespace: firewall + name: allow-nvme-port +spec: + egress: + - to: + - cidr: 10.130.184.7/32 + ports: + - protocol: TCP + port: 4420 +``` + +#### Clusterwidewide Network Policy in Seed: + +```bash +apiVersion: metal-stack.io/v1 +kind: ClusterwideNetworkPolicy +metadata: + namespace: firewall + name: allow-mgmt-port +spec: + egress: + - to: + - cidr: 10.130.184.5/32 + ports: + - protocol: TCP + port: 443 +``` + +## Known Issues + +- In local environments, using the "Default" broadcast domain can result in "no route to host" errors. Using "Default-1" broadcast domain resolves this issue. +- On test environments, the opposite is true - "Default" works but "Default-1" fails. +- In the simulator, ports e0c and e0d are not functional. Use only e0a and e0b. +- The Trident NVMe driver automatically uses network interfaces that are internally assigned. See [Trident issue #1007](https://github.com/NetApp/trident/issues/1007) for details. +- When an SVM already exists, the secret in the shoot isn't created because it assumes the secret is already in the seed. + +## TODO List + +- Fix SVM secret creation when SVM already exists +- Implement proper SVM deletion logic +- Add default gateway/routing configuration for SVMs +- Fix hardcoded password in the `GenerateSecurePassword` function +- Implement network route creation after SVM setup +- Add monitoring and alerting for SVM health +- Create proper cleanup and lifecycle management + +## Creating ONTAP Encrypted Volumes + +To create an encrypted volume using NetApp Trident CSI, you need three components: + +1. Secret with LUKS Passphrase + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: storage-encryption-key + namespace: +stringData: + luks-passphrase-name: A + luks-passphrase: secretA +``` + +2. StorageClass with Encryption Annotations + +The StorageClass must include CSI node stage secret annotations: + +```yaml +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: ontap-encrypted +provisioner: csi.trident.netapp.io +parameters: + selector: "luks=true" + csi.storage.k8s.io/node-stage-secret-name: storage-encryption-key + csi.storage.k8s.io/node-stage-secret-namespace: ${pvc.namespace} + backendType: "ontap-san" + provisioningType: "thin" + fsType: "ext4" +allowVolumeExpansion: true +``` + +3. PVC Using the Encrypted StorageClass + +```yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: ontap-encrypted-volume +spec: + storageClassName: ontap-encrypted + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi +``` + +### Key Requirements + +- Secret name in StorageClass must match actual secret name +- Secret namespace in StorageClass must match where secret is created +- PVC must reference the StorageClass with encryption annotations + +### **Reconcile State Matrix** + +| SVM | Data LIFs | Mgmt LIF | ONTAP User | Seed Secret | Action Taken | Code Path | +| --- | --------- | -------- | ---------- | ----------- | ---------------------------------------------- | -------------------------------------------------------------------- | +| ❌ | ❌ | ❌ | ❌ | ❌ | Create complete SVM from scratch | `EnsureCompleteSVM()` → `CreateSVM()` | +| ✅ | ❌ | ❌ | ❌ | ❌ | Validate SVM + Create all LIFs + Create User | `validateAndEnsureCompleteSVMState()` | +| ✅ | ✅ | ❌ | ❌ | ❌ | Create missing data LIFs + Mgmt LIF + User | `validateAndEnsureDataLIFs()` + `validateAndEnsureManagementLIF()` | +| ✅ | ✅ | ❌ | ❌ | ❌ | Create management LIF + Complete user creation | `validateAndEnsureManagementLIF()` → `createCompleteUserAndSecret()` | +| ✅ | ✅ | ✅ | ❌ | ❌ | Create ONTAP user and K8s secret | `createCompleteUserAndSecret()` | +| ✅ | ✅ | ✅ | ✅ | ❌ | Reset ONTAP password + Create K8s secret | `resetONTAPUserPassword()` → `buildAndCreateSecretInSeed()` | +| ✅ | ✅ | ✅ | ❌ | ✅ | Create ONTAP user with existing K8s password | `createONTAPUserWithPassword()` | +| ✅ | ✅ | ✅ | ✅ | ✅ | Validate password consistency | `validatePasswordConsistency()` | +| ✅ | ✅ | ✅ | ✅ | ❌ | Fix corrupted secret (empty password) | `resetONTAPUserPassword()` → `updateSecretInSeed()` | + +### **Legend** + +- ✅ = Resource exists and is correct +- ❌ = Resource missing or not functional diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-vpn-gateway/gardener-vpn-gateway.md b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-vpn-gateway/gardener-vpn-gateway.md new file mode 100644 index 0000000..dd1985d --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/gardener-vpn-gateway/gardener-vpn-gateway.md @@ -0,0 +1,24 @@ +--- +slug: /references/gardener-vpn-gateway +title: gardener-vpn-gateway +sidebar_position: 4 +--- + +# Gardener VPN Gateway + +This is a small piece of software that is intended to run in the shoot controlplane of a [Gardener](https://github.com/gardener/gardener) shoot cluster. It watches for a service in the shoot for incoming connections and listens for incoming connections, which it will forward through the VPN between seed and shoot to the service in the cluster. + +The point of this is that the VPN gateway will take care of talking to the VPN proxy, while for the client in the controlplane it looks like a transparent connection. + +## Current scope for the implementation + +- Only one service per running VPN gateway instance + +### Use with proxy (mTLS proxy with http-connect) + + +## Testing locally + +TODO this is not updated for the new vpn gateway role; will need to evaluate if local testing still makes sense and if so how to do this. + + diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Gardener/os-metal-extension/os-metal-extension.md b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/os-metal-extension/os-metal-extension.md new file mode 100644 index 0000000..38706cf --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Gardener/os-metal-extension/os-metal-extension.md @@ -0,0 +1,11 @@ +--- +slug: /references/os-metal-extension +title: os-metal-extension +sidebar_position: 5 +--- + +# os-metal-extension + +This extension provides controllers to reconcile `OperatingSystemConfig`s and transforms them into [Ignition](https://www.flatcar.org/docs/latest/provisioning/ignition/) userdata. This userdata can be applied during machine provisioning as done by the metal-stack project. + +This extension was made for working with operating system images built in the [metal-images](https://github.com/metal-stack/metal-images) repository. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/cluster-api-provider-metal-stack/DEVELOPMENT.md b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/cluster-api-provider-metal-stack/DEVELOPMENT.md new file mode 100644 index 0000000..bb8da04 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/cluster-api-provider-metal-stack/DEVELOPMENT.md @@ -0,0 +1,297 @@ +--- +slug: /references/DEVELOPMENT +title: DEVELOPMENT +sidebar_position: 1 +--- + +# Development + +## Getting Started Locally + +This project comes with a preconfigured version of the [mini-lab](https://github.com/metal-stack/mini-lab) in [capi-lab](./capi-lab) which runs a local metal-stack instance and all prerequisites required by this provider. + +```bash +make -C capi-lab + +# allows access using metalctl and kubectl +eval $(make -C capi-lab --silent dev-env) +``` + +Next install our CAPMS provider into the cluster. + +```bash +# repeat this whenever you make changes +make push-to-capi-lab +``` + +Before creating a cluster some manual steps are required beforehand: you need to allocate a node network and a firewall. + +```bash +make -C capi-lab node-network firewall control-plane-ip +``` + +A basic cluster configuration that relies on `config/clusterctl-templates/cluster-template.yaml` and uses the aforementioned node network can be generated and applied to the management cluster using a make target. + +```bash +make -C capi-lab apply-sample-cluster +``` + +Once the control plane node has phoned home, run: + +```bash +make -C capi-lab mtu-fix +``` + +When the control plane node was provisioned, you can obtain the kubeconfig like: + +```bash +kubectl get secret metal-test-kubeconfig -o jsonpath='{.data.value}' | base64 -d > capi-lab/.capms-cluster-kubeconfig.yaml +# alternatively: +clusterctl get kubeconfig metal-test > capi-lab/.capms-cluster-kubeconfig.yaml +``` + +It is now expected to deploy a CNI to the cluster: + +```bash +kubectl --kubeconfig=capi-lab/.capms-cluster-kubeconfig.yaml create -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/tigera-operator.yaml +cat < [!note] +> Actually, Calico should be configured using BGP (no overlay), eBPF and DSR. An example will be proposed in this repository at a later point in time. + +The node's provider ID is provided by the [metal-ccm](https://github.com/metal-stack/metal-ccm), which needs to be deployed into the cluster: + +```bash +make -C capi-lab deploy-metal-ccm +``` + +If you want to provide service's of type load balancer through MetalLB by the metal-ccm, you need to deploy MetalLB: + +```bash +kubectl --kubeconfig capi-lab/.capms-cluster-kubeconfig.yaml apply --kustomize capi-lab/metallb +``` + +That's it! + +### To Deploy on the cluster +**Build and push your image to the location specified by `IMG`:** + +```sh +make docker-build docker-push IMG=/cluster-api-provider-metal-stack:tag +``` + +**NOTE:** This image ought to be published in the personal registry you specified. +And it is required to have access to pull the image from the working environment. +Make sure you have the proper permission to the registry if the above commands don’t work. + +**Install the CRDs into the cluster:** + +```sh +make install +``` + +**Deploy the Manager to the cluster with the image specified by `IMG`:** + +```sh +make deploy IMG=/cluster-api-provider-metal-stack:tag +``` + +> **NOTE**: If you encounter RBAC errors, you may need to grant yourself cluster-admin privileges or be logged in as admin. + +**Create instances of your solution** +You can apply the sample cluster configuration: + +```sh +make -C capi-lab apply-sample-cluster +``` + +### To Uninstall +**Delete the instances (CRs) from the cluster:** + +```sh +make -C capi-lab delete-sample-cluster +``` + +**Delete the APIs(CRDs) from the cluster:** + +```sh +make uninstall +``` + +**UnDeploy the controller from the cluster:** + +```sh +make undeploy +``` + +## Project Distribution + +Following are the steps to build the installer and distribute this project to users. + +1. Build the installer for the image built and published in the registry: + +```sh +make build-installer IMG=/cluster-api-provider-metal-stack:tag +``` + +NOTE: The makefile target mentioned above generates an 'install.yaml' +file in the dist directory. This file contains all the resources built +with Kustomize, which are necessary to install this project without +its dependencies. + +2. Using the installer + +Users can just run kubectl apply -f to install the project, i.e.: + +```sh +kubectl apply -f https://raw.githubusercontent.com//cluster-api-provider-metal-stack//dist/install.yaml +``` + +## Quick opinionated Cluster Bootstrap and move + +This is a short and opinionated fast track to create and move a cluster using our provider. +In contrast to a guide and the README, we do not explain all commands and try to be concise. + +Configure your clusterctl: + +```yaml +# ~/.config/cluster-api/clusterctl.yaml +providers: + - name: "metal-stack" + url: "https://github.com/metal-stack/cluster-api-provider-metal-stack/releases/latest/download/infrastructure-components.yaml" + # or for PRs + # url: "${HOME}/path/to/infrastructure-metal-stack/v0.4.0/infrastructure-components.yaml" + # generate with: + # IMG_TAG=branch-name RELEASE_DIR=${HOME}/path/to/infrastructure-metal-stack/v0.4.0 make release-manifests + type: InfrastructureProvider +``` + +Set environment variables. Don't forget to update them along the way. + +```bash +export EXP_KUBEADM_BOOTSTRAP_FORMAT_IGNITION=true + +export METAL_API_HMAC= +export METAL_API_HMAC_AUTH_TYPE= +export METAL_API_URL= + +export METAL_PARTITION= +export METAL_PROJECT_ID= +export METAL_NODE_NETWORK_ID= +export CONTROL_PLANE_IP= + +export FIREWALL_MACHINE_IMAGE= +export FIREWALL_MACHINE_SIZE= + +export CONTROL_PLANE_MACHINE_IMAGE= +export CONTROL_PLANE_MACHINE_SIZE= +export WORKER_MACHINE_IMAGE= +export WORKER_MACHINE_SIZE= + +export CLUSTER_NAME= +export NAMESPACE=default +export KUBERNETES_VERSION=v1.31.6 + +export CONTROL_PLANE_MACHINE_COUNT=1 +export WORKER_MACHINE_COUNT=1 + +# Additional envs +export repo_path=$HOME/path/to/cluster-api-provider-metal-stack +export project_name= +export tenant_name= +export firewall_id= +``` + +Create firewall if needed: + +```bash +metalctl project create --name $project_name --tenant $tenant_name --description "Cluster API test project" +metalctl network allocate --description "Node network for $CLUSTER_NAME" --name $CLUSTER_NAME --project $METAL_PROJECT_ID --partition $METAL_PARTITION +metalctl network ip create --network internet --project $METAL_PROJECT_ID --name "$CLUSTER_NAME-vip" --type static -o template --template "{{ .ipaddress }}" +metalctl firewall create --description "Firewall for $CLUSTER_NAME cluster" --name firewall-$CLUSTER_NAME --hostname firewall-$CLUSTER_NAME --project $METAL_PROJECT_ID --partition $METAL_PARTITION --image $FIREWALL_MACHINE_IMAGE --size $FIREWALL_MACHINE_SIZE --firewall-rules-file $repo_path/config/target-cluster/firewall-rules.yaml --networks internet,$METAL_NODE_NETWORK_ID +``` + +```bash +kind create cluster --name bootstrap +kind export kubeconfig --name bootstrap --kubeconfig kind-bootstrap.kubeconfig + +clusterctl init --infrastructure metal-stack --kubeconfig kind-bootstrap.kubeconfig +clusterctl generate cluster $CLUSTER_NAME --infrastructure metal-stack > cluster-$CLUSTER_NAME.yaml +kubectl apply -n $NAMESPACE -f cluster-$CLUSTER_NAME.yaml + +# once the control plane node is in phoned home +metalctl machine consolepassword $firewall_id +metalctl machine console --ipmi $firewall_id +# sudo systemctl restart frr +# ~. + +kubectl --kubeconfig kind-bootstrap.kubeconfig -n $NAMESPACE get metalstackmachines.infrastructure.cluster.x-k8s.io +export control_plane_machine_id= +metalctl machine console --ipmi $control_plane_machine_id +# ip r +# sudo systemctl restart kubeadm +# crictl ps +# ~. + +clusterctl get kubeconfig > capms-cluster.kubeconfig + +# metal-ccm +cat $repo_path/config/target-cluster/metal-ccm.yaml | envsubst | kubectl --kubeconfig capms-cluster.kubeconfig apply -f - + +# cni +kubectl --kubeconfig=capms-cluster.kubeconfig create -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/tigera-operator.yaml +cat < [!WARNING] +> As of now the CAPMS is not yet feature complete and there might be breaking changes in future releases. +> In case you search for a feature stable alternative consider [Gardener on metal-stack](https://docs.metal-stack.io/stable/installation/deployment/#Gardener-with-metal-stack) instead. +> For developing this project head to our [DEVELOPMENT.md](./DEVELOPMENT.md). + +Currently, we provide the following custom resources: + +- [`MetalStackCluster`](https://github.com/metal-stack/cluster-api-provider-metal-stack/blob/main/./api/v1alpha1/metalstackcluster_types.go) can be used as [infrastructure cluster](https://cluster-api.sigs.k8s.io/developer/providers/contracts/infra-cluster) and ensures that there is a control plane IP for the cluster. +- [`MetalStackMachine`](https://github.com/metal-stack/cluster-api-provider-metal-stack/blob/main/./api/v1alpha1/metalstackmachine_types.go) bridges between [infrastructure machines](https://cluster-api.sigs.k8s.io/developer/providers/contracts/infra-machine) and metal-stack machines. +- [`MetalStackMachineTemplate`](https://github.com/metal-stack/cluster-api-provider-metal-stack/blob/main/./api/v1alpha1/metalstackmachinetemplate_types.go) can be used to define reusable machine specifications for `MetalStackMachine` resources. +- [`MetalStackFirewallDeployment`](https://github.com/metal-stack/cluster-api-provider-metal-stack/blob/main/./api/v1alpha1/metalstackfirewalldeployment_types.go) can be used to define firewall deployments for a cluster. +- [`MetalStackFirewallTemplate`](https://github.com/metal-stack/cluster-api-provider-metal-stack/blob/main/./api/v1alpha1/metalstackfirewalltemplate_types.go) defines the configuration of deployed firewalls. + +We plan to cover more resources in the future: + +- Complete Firewall Deployments using the [Firewall Controller Manager](https://github.com/metal-stack/firewall-controller-manager) +- Improved configuration suggestion of CNIs + +> [!note] +> Currently our infrastructure provider is only tested against the [Cluster API bootstrap provider Kubeadm (CABPK)](https://cluster-api.sigs.k8s.io/tasks/bootstrap/kubeadm-bootstrap/index.html?highlight=kubeadm#cluster-api-bootstrap-provider-kubeadm). +> While other providers might work, there is no guarantee nor the goal to reach compatibility. + +## Getting started + +**Prerequisites:** + +- Running metal-stack installation. See our [installation](https://docs.metal-stack.io/stable/installation/deployment/) section on how to get started with metal-stack. +- Operating system images available to metal-stack. See [metal-stack/metal-images](https://github.com/metal-stack/metal-images) for pre-built ones. +- Management cluster (with network access to the metal-stack infrastructure). +- CLI metalctl installed for communicating with the metal-api. Installation instructions can be found in the corresponding [repository](https://github.com/metal-stack/metalctl). +- CLI clusterctl + +First, add the metal-stack infrastructure provider to your `clusterctl.yaml`: + +```yaml +# ~/.config/cluster-api/clusterctl.yaml +providers: + - name: "metal-stack" + url: "https://github.com/metal-stack/cluster-api-provider-metal-stack/releases/latest/download/infrastructure-components.yaml" + type: InfrastructureProvider +``` + +Now, you are able to install the CAPMS into your management cluster: + +```bash +# export the following environment variables +export METAL_API_URL= +export METAL_API_HMAC= +export METAL_API_HMAC_AUTH_TYPE= +export EXP_KUBEADM_BOOTSTRAP_FORMAT_IGNITION=true + +# initialize the management cluster +clusterctl init --infrastructure metal-stack +``` + +> [!CAUTION] +> **Manual steps needed:** +> Due to the early development stage, manual actions are needed for the cluster to operate. Some metal-stack resources need to be created manually. + +Allocate a VIP for the control plane. + +```bash +export CLUSTER_NAME= +export METAL_PARTITION= +export METAL_PROJECT_ID= + +export CONTROL_PLANE_IP=$(metalctl network ip create --network internet --project $METAL_PROJECT_ID --name "$CLUSTER_NAME-vip" --type static -o template --template "{{ .ipaddress }}") +``` + +For your first cluster, it is advised to start with our generated template. Ensure that the namespaced cluster name is unique within the metal stack project. + +```bash +# display required environment variables +clusterctl generate cluster $CLUSTER_NAME --infrastructure metal-stack --list-variables --flavor calico + +# set additional environment variables +export CONTROL_PLANE_MACHINE_IMAGE= +export CONTROL_PLANE_MACHINE_SIZE= +export WORKER_MACHINE_IMAGE= +export WORKER_MACHINE_SIZE= +export FIREWALL_MACHINE_IMAGE= +export FIREWALL_MACHINE_SIZE= + +# generate manifest +clusterctl generate cluster $CLUSTER_NAME --kubernetes-version v1.32.9 --infrastructure metal-stack --flavor calico +``` + +Apply the generated manifest from the `clusterctl` output. + +```bash +kubectl apply -f +``` + +That's it! + +## Frequently Asked Questions + +### I need to know the Control Plane IP address in advance. Can I provide a static IP address in advance? + +Yes, simply create a static IP address and set it to `metalstackcluster/$CLUSTER_NAME.spec.controlPlaneIP`. + +```bash +metalctl network ip create --name $CLUSTER_NAME-vip --project $METAL_PROJECT_ID --type static +``` + +### I'd like to have a specific Pod CIDR. How can I achieve this? + +When generating your cluster, set `POD_CIDR` to your desired value. + +```bash +export POD_CIDR=["10.240.0.0/12"] +``` + +## I'd like to update the firewall and / or its rules. How can I achieve this? + +Unfortunately there is no automated way to update firewall deployments or rules yet. You have to manually edit the `MetalStackFirewallDeployment` resource to force it to create a new firewall. + +1. Save the firewall machine ID stored in `MetalStackFirewallDeployment.spec.managedResourceRef.name`. +2. Update the `MetalStackFirewallTemplate` as desired. +3. Remove `MetalStackFirewallDeployment.spec.managedResourceRef`. +4. Wait for CAPMS to create the new firewall. +5. Wait for the new firewall to be in `Phoned Home` state using `metalctl machine list --id `. +6. Delete the old firewall machine using `metalctl machine delete ` as soon as possible. + +This leads to a minimized downtime of the cluster as the firewall is not available during the transition. + +## Flavors + +You might choose from different cluster template [flavors](https://cluster-api.sigs.k8s.io/clusterctl/commands/generate-cluster.html?highlight=flavor#flavors) to generate manifests with clusterctl. Here is a table describing the available flavors: + +| Name | Description | K8s Compatibility | +| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | +| | This is the default flavor without providing the `--flavor` flag. This expects the user to deploy a CNI and a CCM. | >= v1.33 | +| calico | Installs [calico](https://docs.tigera.io/calico/latest/about/) CNI along with [metal-ccm](https://github.com/metal-stack/metal-ccm). Depends on `ClusterResourceSet` and the [Add-on Provider for Helm](https://github.com/kubernetes-sigs/cluster-api-addon-provider-helm/tree/main). | >= v1.33 | +| pre-v1.33 | The same as the default flavor but working for K8s versions < v1.33. | < v1.33 | diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/droptailer/droptailer.md b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/droptailer/droptailer.md new file mode 100644 index 0000000..b55ee06 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/droptailer/droptailer.md @@ -0,0 +1,84 @@ +--- +slug: /references/droptailer +title: droptailer +sidebar_position: 2 +--- + +# Droptailer + +Droptailer gathers firewall drop or accept logs from different machines, enriches them with data from kubernetes api resources and makes them accessible by kubernetes means. + +## Client + +- reads the systemd journal for kernel log messages about packet drops or accepts +- pushes them with gRPC to the `droptail` server + +environment variables: + +- `DROPTAILER_SERVER_ADDRESS`: endpoint for the server +- `DROPTAILER_PREFIXES_OF_DROPS`: prefixes that identify drop messages in the journal +- `DROPTAILER_PREFIXES_OF_ACCEPTS`: prefixes that identify drop messages in the journal + +## Generating certificates + +```bash +# Install cfssl tool +curl -s -L -o ~/bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 +curl -s -L -o ~/bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 +chmod +x ~/bin/{cfssl,cfssljson} + +# Create certificates for client and server +echo '{"CN":"CA","key":{"algo":"rsa","size":2048}}' | cfssl gencert -initca - | cfssljson -bare ca - +echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","server auth","client auth"]}}}' > ca-config.json +export ADDRESS=droptailer +export NAME=droptailer-server +echo '{"CN":"'$NAME'","hosts":[""],"key":{"algo":"rsa","size":2048}}' \ + | cfssl gencert -config=ca-config.json -ca=ca.pem -ca-key=ca-key.pem -hostname="$ADDRESS" - \ + | cfssljson -bare $NAME + +export ADDRESS= +export NAME=droptailer-client +echo '{"CN":"'$NAME'","hosts":[""],"key":{"algo":"rsa","size":2048}}' \ + | cfssl gencert -config=ca-config.json -ca=ca.pem -ca-key=ca-key.pem -hostname="$ADDRESS" - \ + | cfssljson -bare $NAME +``` + +## Testing droptailer + +```bash +# install kind 0.6.0 or higher ! +KIND_VERSION=v0.7.0 +wget https://github.com/kubernetes-sigs/kind/releases/download/${KIND_VERSION}/kind-linux-amd64 +mv kind-linux-amd64 ~/bin/kind +chmod +x ~/bin/kind + +# Create a k8s cluster +kind create cluster + +# Deploy droptailer-server +kubectl apply -f ./test/manifests/droptailer.yaml + +# Expose droptailer-server port to host +podName=$(kubectl get pods -n firewall -o=jsonpath='{.items[0].metadata.name}') +echo $podName +kubectl port-forward -n firewall --address 0.0.0.0 pod/$podName 50051:50051 & + +# Run droptailer-client +docker run -it \ + --privileged \ + --add-host droptailer:172.17.0.1 \ + --env DROPTAILER_SERVER_ADDRESS=droptailer:50051 \ + --volume $(pwd)/test/certs:/etc/droptailer-client:ro \ + --volume /run/systemd/private:/run/systemd/private \ + --volume /var/log/journal:/var/log/journal \ + --volume /run/log/journal:/run/log/journal \ + --volume /etc/machine-id:/etc/machine-id \ +metalstack/droptailer-client + +# Watch for drops +stern -n firewall drop + +# Generate sample messages for the systemd journal that is caught by the droptailer-client +sudo logger -t kernel "nftables-metal-dropped: IN=vrf09 OUT= MAC=12:99:fd:3b:ce:f8:1a:ae:e9:a7:95:50:08:00 SRC=1.2.3.4 DST=4.3.2.1 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=46474 PROTO=TCP SPT=59265 DPT=445 WINDOW=1024 RES=0x00 SYN URGP=0" +sudo logger -t kernel "nftables-metal-accepted: IN=vrf10 OUT=vrf11 MAC=12:99:fd:3b:ce:f8:1a:ae:e9:a7:95:50:08:00 SRC=5.6.7.8 DST=8.7.6.5 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=46474 PROTO=TCP SPT=59265 DPT=445 WINDOW=1024 RES=0x00 SYN URGP=0 ItIs=OnlyText" +``` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller-manager/firewall-controller-manager.md b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller-manager/firewall-controller-manager.md new file mode 100644 index 0000000..c60a4a6 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller-manager/firewall-controller-manager.md @@ -0,0 +1,60 @@ +--- +slug: /references/firewall-controller-manager +title: firewall-controller-manager +sidebar_position: 4 +--- + +# firewall-controller-manager + +## Overview + +The firewall-controller-manager (FCM) is a collection of controllers which are responsible for managing the lifecycle of firewalls in a [Gardener](https://gardener.cloud/) shoot cluster for the metal-stack provider. + +The FCM is typically deployed into the shoot namespace of a seed cluster. This is done by the [gardener-extension-provider-metal](https://github.com/metal-stack/gardener-extension-provider-metal/). + +The design of the FCM is roughly inspired by Gardener's [machine-controller-manager](https://github.com/gardener/machine-controller-manager) and Kubernetes' built-in resources `Deployment`, `ReplicaSet` and `Pod`. + +## Architecture + +The following table is a summary over the [CRDs](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) introduced by the FCM: + +| Custom Resource Object | Description | +| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `FirewallDeployment` | A `FirewallDeployment` contains the spec template of a `Firewall` resource similar to a `Deployment` and implements update strategies like rolling update. | +| `FirewallSet` | A `FirewallSet` is similar to `ReplicaSet`. It is typically owned by a `FirewallDeployment` and attempts to run the defined replica amount of the `Firewall`(s) | +| `Firewall` | A `Firewall` is similar to a `Pod` and has a 1:1 relationship to a firewall in the metal-stack api. | +| `FirewallMonitor` | Deployed into the cluster of the user (shoot cluster), which is useful for monitoring the firewall or user-triggered actions on the firewall. | + +### `FirewallDeploymentController` + +The `FirewallDeployment` controller manages the lifecycle of `FirewallSet`s. It syncs the `Firewall` template spec and if significant changes were made, it may trigger a `FirewallSet` roll. When choosing `RollingUpdate` as a deployment strategy, the deployment controller is waiting for the firewall-controller to connect before throwing away an old `FirewallSet`. The `Recreate` strategy first releases firewalls before creating a new one (can be useful for environments which ran out of available machines but you still want to update). + +The controller also deploys a service account for the firewall-controller to be able to talk to the seed's kube-apiserver. + +### `FirewallSetController` + +Creates and deletes `Firewall` objects according to the spec and the given number of firewall replicas. It also checks the status of the `Firewall` and report that in the own status. + +### `FirewallController` + +Creates and deletes the physical firewall machine from the spec at the [metal-api](https://github.com/metal-stack/metal-api). + +## Rolling a `FirewallSet` through `FirewallMonitor` Annotation + +A user can initiate rolling the latest firewall set by annotating a monitor in the following way: + +```bash +kubectl annotate fwmon firewall.metal-stack.io/roll-set=true +``` + +## Development + +Most of the functionality is developed with the help of the [intgration](integration) test suite. + +To play with the FCM, you can also run this controller inside the [mini-lab](https://github.com/metal-stack/mini-lab) and without a running Gardener installation: + +1. Start up the mini-lab, run `eval $(make dev-env)` and change back to this project's directory +1. Deploy the FCM into the mini-lab with `make deploy` +1. Adapt the example [firewalldeployment.yaml](config/examples/firewalldeployment.yaml) and apply with `kubectl apply -f config/examples/firewalldeployment.yaml` +1. Note that the firewall-controller will not be able to connect to the mini-lab due to network restrictions, so the firewall will not get ready. + - You can make the firewall become ready anyway by setting the annotation `kubectl annotate fw firewall.metal-stack.io/no-controller-connection=true` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller/assets/architecture.drawio.svg b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller/assets/architecture.drawio.svg new file mode 100644 index 0000000..87e8188 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller/assets/architecture.drawio.svg @@ -0,0 +1,53 @@ +
Worker Node
 + Worker Node +
reconciles
 + reconciles +
Firewall
 + Firewall +
Worker VRF
 + Worker VRF +
Firewall-Controller
 + Firewall-Controller +
Internet VRF
 + Internet VRF +
Legacy VRF
 + Legacy VRF +
1.2.3.0/24
 + 1.2.3.0/24 +
172.17.0.0/16
 + 172.17.0.0/16 +
10.0.0.0/0
 + 10.0.0.0/0 +
0.0.0.0/0
 + 0.0.0.0/0 +
<service>
nftables-exporter
 + <service>... +
<service>
node-exporter
 + <service>... +
droptailer
 + droptailer +
Worker Node
 + Worker Node +
Worker Node
 + Worker Node +
droptailer
 + droptailer +
send nftables drops
<grpc>
 + send nftables drops... +
updates
 + updates +
Shoot kube-api-server
 + Shoot kube-api-server +
FirewallMonitor CRD
 + FirewallMonitor CRD +
Seed kube-api-server
 + Seed kube-api-server +
Firewall CRD
 + Firewall CRD +
CWNP CRD
 + CWNP CRD + + + Text is not SVG - cannot display + + \ No newline at end of file diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller/firewall-controller.md b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller/firewall-controller.md new file mode 100644 index 0000000..6e6620f --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/firewall-controller/firewall-controller.md @@ -0,0 +1,252 @@ +--- +slug: /references/firewall-controller +title: firewall-controller +sidebar_position: 3 +--- + +# firewall-controller + +This controller is installed on a bare-metal firewall in front of several kubernetes worker nodes and responsible to reconcile a `ClusterwideNetworkPolicy` to nftables rules to control access to and from the kubernetes cluster. +It allows also to control the traffic rate going through, to limit network resources for restricted usage scenarios. Nftable and node metrics are exposed with the `nftables-exporter` and `node-exporter`, the ips are visible as service and endpoint from the kubernetes cluster. + +Additionally, an IDS is managed on the firewall to detect known network anomalies. [suricata](https://suricata-ids.org) is used for this purpose. Right now, only basic statistics about the amount of scanned packets is reported. In a future release, access to all alarms will be provided. + +This controller is typically setup through the [firewall-controller-manager](https://github.com/metal-stack/firewall-controller-manager) (FCM), which manages the lifecycle of metal-stack firewalls inside our [Gardener integration](https://docs.metal-stack.io/stable/overview/kubernetes/). + +## Architecture + +The firewall-controller is acting on 3 CRDs typically running in your cluster and a provider-managed cluster (in Gardener terms "shoot" and "seed").: + +| CRD | API | Resides In | Purpose | +| -------------------------------- | ---------------------------- | ---------- | ------------------------------------------------------------------- | +| `ClusterwideNetworkPolicy` | `metal-stack.io/v1` | Shoot | Controls firewall rules and can be provided by the user | +| `Firewall` defined by FCM | `firewall.metal-stack.io/v2` | Seed | Defines the firewall including rate limits, controller version, ... | +| `FirewallMonitor` defined by FCM | `firewall.metal-stack.io/v2` | Shoot | Used as an overview for the user on the status of the firewall | + +Note that `clusterwidenetworkpolicy` resources are namespaced and must reside in the `firewall` namespace, otherwise this controller does not reconcile them. + +![Architecture](./assets/architecture.drawio.svg) + +Example `ClusterwideNetworkPolicy`: + +```yaml +apiVersion: metal-stack.io/v1 +kind: ClusterwideNetworkPolicy +metadata: + namespace: firewall + name: clusterwidenetworkpolicy-sample +spec: + egress: + - to: + - cidr: 1.1.0.0/24 + except: + - 1.1.1.0/16 + - cidr: 8.8.8.8/32 + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - protocol: TCP + port: 8080 + # Optional, if specified this is the way to specify a port range from port to endPort + endPort: 8088 +``` + +## Automatically Generated Ingress Rules + +For every `Service` of type `LoadBalancer` in the cluster, the corresponding ingress rules will be automatically generated. + +If `loadBalancerSourceRanges` is not specified, incomig traffic to this service will be allowed for any source ip addresses. + +### DNS Policies Configuration + +The `ClusterwideNetworkPolicy` resource allows you to define DNS based egress policies as well. They allow you to filter egress traffic based either on DNS name or by matching names to the provided pattern. + +To filter by specific domain name you need to provide `matchName` field: + +```yaml +apiVersion: metal-stack.io/v1 +kind: ClusterwideNetworkPolicy +metadata: + namespace: firewall + name: clusterwidenetworkpolicy-fqdn +spec: + egress: + - toFQDNs: + - matchName: example.com + ports: + - protocol: UDP + port: 80 + - protocol: TCP + port: 80 +``` + +If you want to filter FQDNs that are matching certain pattern, you can use `matchPattern` field, which supports `*` wildcard. Following example allows traffic to port 80 of all resources in the `.example` top-level domain: + +```yaml +apiVersion: metal-stack.io/v1 +kind: ClusterwideNetworkPolicy +metadata: + namespace: firewall + name: clusterwidenetworkpolicy-fqdn-pattern +spec: + egress: + - toFQDNs: + - matchPattern: *.example + ports: + - protocol: UDP + port: 80 + - protocol: TCP + port: 80 +``` + +By default, DNS info is collected from Google DNS (with address 8.8.8.8:53). The preferred DNS server can be changed through the `Firewall` resource of the FCM, which is governed by the provider. + +## Status + +Once the firewall-controller is running, it will report several statistics to the `FirewallMonitor` CRD Status. This can be inspected by running: + +```bash +kubectl get -n firewall fwmon +NAME MACHINE ID IMAGE SIZE LAST EVENT AGE +shoot--prod--seed-firewall-089f9 f4f8b200-deef-11e9-8000-3cecef22f910 firewall-ubuntu-2.0.20221025 n1-medium-x86 Phoned Home 18m +``` + +When showing the resource with `-o yaml`, it contains detailed information on traffic counting, package drops and IDS: + +```yaml +Status: + Last Run: 2020-06-17T13:18:58Z + Stats: + # Network traffic in bytes separated into external and internal in/out/total + Devices: + External: + In: 91696 + Out: 34600 + Total: 0 + Internal: + In: 0 + Out: 0 + Total: 2678671 + # IDS Statistics by interface + Idsstats: + vrf104009: + Drop: 1992 + Invalidchecksums: 0 + Packets: 4997276 + # nftable rule statistics by rule name + Rules: + Accept: + BGP unnumbered: + Counter: + Bytes: 0 + Packets: 0 + SSH incoming connections: + Counter: + Bytes: 936 + Packets: 16 + accept established connections: + Counter: + Bytes: 21211168 + Packets: 39785 + accept icmp: + Counter: + Bytes: 0 + Packets: 0 + accept traffic for k8s service kube-system/vpn-shoot: + Counter: + Bytes: 360 + Packets: 6 + Drop: + drop invalid packets: + Counter: + Bytes: 52 + Packets: 1 + drop invalid packets from forwarding to prevent malicious activity: + Counter: + Bytes: 0 + Packets: 0 + drop invalid packets to prevent malicious activity: + Counter: + Bytes: 0 + Packets: 0 + drop packets with invalid ct state: + Counter: + Bytes: 0 + Packets: 0 + drop ping floods: + Counter: + Bytes: 0 + Packets: 0 + Other: + block bgp forward to machines: + Counter: + Bytes: 0 + Packets: 0 + count and log dropped packets: + Counter: + Bytes: 2528 + Packets: 51 + snat (networkid: internet): + Counter: + Bytes: 36960 + Packets: 486 +``` + +## Prometheus Integration + +There are two exporters running on the firewall to report essential metrics from this machine: + +- node-exporter for machine specific metrics like cpu, ram and disk usage, see [node-exporter](https://github.com/prometheus/node_exporter) for details. +- nftables-exporter for nftables metrics, see [nftables-exporter](https://github.com/Sheridan/nftables_exporter) + +Both exporters are exposed as services: + +```bash +kubectl get svc -n firewall +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +nftables-exporter ClusterIP None 9630/TCP 13h +node-exporter ClusterIP None 9100/TCP 13h +``` + +These services are in front of virtual endpoints: + +```bash +kubectl get ep -n firewall +NAME ENDPOINTS AGE +nftables-exporter 10.3.164.1:9630 13h +node-exporter 10.3.164.1:9100 13h +``` + +You can scrape these services in you prometheus installation to get the metrics. + +To check you can run: + +```bash +curl nftables-exporter.firewall.svc.cluster.local:9630/metrics +curl node-exporter.firewall.svc.cluster.local:9100/metrics +``` + +## Firewall Logs + +It is also possible to tail for the dropped packets with the following command (install stern from [stern](https://github.com/stern/stern)): + +```bash +stern -n firewall drop +``` + +The output will look like: + +```json +droptailer-6d556bd988-4g8gp droptailer 2020-06-17 13:23:27 +0000 UTC {"ACTION":"Drop","DPT":"4000","DST":"1.2.3.4","ID":"54321","IN":"vrf104009","LEN":"40","MAC":"ca:41:f9:80:fa:89:aa:bb:0e:62:8c:a6:08:00","OUT":"vlan179","PREC":"0x00","PROTO":"TCP","RES":"0x00","SPT":"38464","SRC":"2.3.4.5","SYN":"","TOS":"0x00","TTL":"236","URGP":"0","WINDOW":"65535","timestamp":"2020-06-17 13:23:27 +0000 UTC"} +droptailer-6d556bd988-4g8gp droptailer 2020-06-17 13:23:34 +0000 UTC {"ACTION":"Drop","DPT":"2362","DST":"1.2.3.4","ID":"44545","IN":"vrf104009","LEN":"40","MAC":"ca:41:f9:80:fa:89:aa:bb:0e:62:8c:a6:08:00","OUT":"","PREC":"0x00","PROTO":"TCP","RES":"0x00","SPT":"40194","SRC":"2.3.4.5","SYN":"","TOS":"0x00","TTL":"242","URGP":"0","WINDOW":"1024","timestamp":"2020-06-17 13:23:34 +0000 UTC"} +droptailer-6d556bd988-4g8gp droptailer 2020-06-17 13:23:30 +0000 UTC {"ACTION":"Accept","DPT":"650","DST":"1.2.3.4","ID":"12399","IN":"vrf104009","LEN":"40","MAC":"ca:41:f9:80:fa:89:aa:bb:0e:62:8c:a6:08:00","OUT":"vlan179","PREC":"0x00","PROTO":"TCP","RES":"0x00","SPT":"40194","SRC":"2.3.4.5","SYN":"","TOS":"0x00","TTL":"241","URGP":"0","WINDOW":"1024","timestamp":"2020-06-17 13:23:30 +0000 UTC"} +droptailer-6d556bd988-4g8gp droptailer 2020-06-17 13:23:34 +0000 UTC {"ACTION":"Accept","DPT":"2362","DST":"1.2.3.4","ID":"44545","IN":"vrf104009","LEN":"40","MAC":"ca:41:f9:80:fa:89:aa:bb:0e:62:8c:a6:08:00","OUT":"","PREC":"0x00","PROTO":"TCP","RES":"0x00","SPT":"40194","SRC":"2.3.4.5","SYN":"","TOS":"0x00","TTL":"242","URGP":"0","WINDOW":"1024","timestamp":"2020-06-17 13:23:34 +0000 UTC"} +droptailer-6d556bd988-4g8gp droptailer 2020-06-17 13:23:10 +0000 UTC {"ACTION":"Accept","DPT":"63351","DST":"1.2.3.4","ID":"11855","IN":"vrf104009","LEN":"40","MAC":"ca:41:f9:80:fa:89:aa:bb:0e:62:8c:a6:08:00","OUT":"vlan179","PREC":"0x00","PROTO":"TCP","RES":"0x00","SPT":"54589","SRC":"2.3.4.5","SYN":"","TOS":"0x00","TTL":"245","URGP":"0","WINDOW":"1024","timestamp":"2020-06-17 13:23:10 +0000 UTC"} +droptailer-6d556bd988-4g8gp droptailer 2020-06-17 13:23:51 +0000 UTC {"ACTION":"Accept","DPT":"8002","DST":"1.2.3.4","ID":"17539","IN":"vrf104009","LEN":"40","MAC":"ca:41:f9:80:fa:89:aa:bb:0e:62:8c:a6:08:00","OUT":"","PREC":"0x00","PROTO":"TCP","RES":"0x00","SPT":"47615","SRC":"2.3.4.5","SYN":"","TOS":"0x08","TTL":"239","URGP":"0","WINDOW":"1024","timestamp":"2020-06-17 13:23:51 +0000 UTC"} +``` + +You can forward the droptailer logs to any log aggregation infrastructure you have in place. + +If enabled in the firewall spec, accepted connections can be logged in addition to dropped connections. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/metal-ccm/metal-ccm.md b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/metal-ccm/metal-ccm.md new file mode 100644 index 0000000..7ee7536 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Kubernetes/metal-ccm/metal-ccm.md @@ -0,0 +1,39 @@ +--- +slug: /references/metal-ccm +title: metal-ccm +sidebar_position: 5 +--- + +# Kubernetes Cloud Controller Manager for metal + +metal-ccm is the Kubernetes cloud controller manager implementation for Metal. + +## Deploy + +Read how to deploy the metal CCM [here](deploy/releases/)! + +## Building + +To build the binary, run: + +```bash +make build +``` + +It will deposit the binary for your local architecture as `dist/bin/metal-cloud-controller-manager-$(ARCH)` + +By default `make build` builds the binary using a docker container. To install using your locally installed go toolchain, do: + +```bash +make build LOCALBUILD=true +``` + +## Docker Image + +To build a docker image, run: + +```bash +make dockerimage +``` + +The image will be tagged with `:latest`. diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/metal-metrics-exporter/metal-metrics-exporter.md b/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/metal-metrics-exporter/metal-metrics-exporter.md new file mode 100644 index 0000000..55d9563 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/metal-metrics-exporter/metal-metrics-exporter.md @@ -0,0 +1,124 @@ +--- +slug: /references/metal-metrics-exporter +title: metal-metrics-exporter +sidebar_position: 1 +--- + +# metal-metrics-exporter + +A simple exporter for metal-api metrics. + +## sample output + +```text +# HELP metal_machine_allocation_info Provide information about the machine allocation +# TYPE metal_machine_allocation_info gauge +metal_machine_allocation_info{clusterTag="00713837-544e-47dd-a55b-52b65a00f8e9",machineid="00000000-0000-0000-0000-ac1f6b7b77c8",machinename="shoot--pbs4kr--test-group-0-5cb6b-585wc",partition="fra-equ01",primaryASN="4210000047",role="machine",state="AVAILABLE",imageId="debian-12.0.20250402"} 1 + +# HELP metal_image_used_total The total number of machines using a image +# TYPE metal_image_used_total gauge +metal_image_used_total{classification="preview",created="1588078965",expirationDate="1598533365",features="firewall",imageID="firewall-ubuntu-2.0.20200331",name="Firewall 2 Ubuntu 20200331"} 2 + +# HELP metal_network_info Shows available prefixes in a network +# TYPE metal_network_info gauge +metal_network_info{clusterTag="d8f75911-b73f-4ae9-a419-67ead8ab0192",description="",destPrefixes="",isPrivateSuper="false",isUnderlay="false",name="ausfalltest",networkId="020966ab-18da-40d6-ba69-fea8d60e6074",parentNetworkID="tenant-super-network-nbg-w8101",partition="nbg-w8101",prefixes="10.91.112.0/22",projectId="c77daafe-58f8-44df-82eb-6ef631cee3c9",useNat="false",vrf="454"} 1 + +# HELP metal_network_ip_available The total number of available IPs of the network +# TYPE metal_network_ip_available gauge +metal_network_ip_available{networkId="020966ab-18da-40d6-ba69-fea8d60e6074"} 1024 + +# HELP metal_network_ip_used The total number of used IPs of the network +# TYPE metal_network_ip_used gauge +metal_network_ip_used{networkId="020966ab-18da-40d6-ba69-fea8d60e6074"} 2 + +# HELP metal_network_prefix_available The total number of available prefixes of the network +# TYPE metal_network_prefix_available gauge +metal_network_prefix_available{networkId="020966ab-18da-40d6-ba69-fea8d60e6074"} 256 + +# HELP metal_network_prefix_used The total number of used prefixes of the network +# TYPE metal_network_prefix_used gauge +metal_network_prefix_used{networkId="020966ab-18da-40d6-ba69-fea8d60e6074"} 0 + +# HELP metal_partition_capacity_allocatable The total number of waiting allocatable machines in the partition +# TYPE metal_partition_capacity_allocatable gauge +metal_partition_capacity_allocatable{partition="fra-equ01",size="c1-xlarge-x86"} 2 + +# HELP metal_partition_capacity_allocated The capacity of allocated machines in the partition +# TYPE metal_partition_capacity_allocated gauge +metal_partition_capacity_allocated{partition="fra-equ01",size="c1-xlarge-x86"} 1 + +# HELP metal_partition_capacity_faulty The capacity of faulty machines in the partition +# TYPE metal_partition_capacity_faulty gauge +metal_partition_capacity_faulty{partition="fra-equ01",size="c1-xlarge-x86"} 0 + +# HELP metal_partition_capacity_free (DEPRECATED) The total number of allocatable machines in the partition, use metal_partition_capacity_allocatable +# TYPE metal_partition_capacity_free gauge +metal_partition_capacity_free{partition="fra-equ01",size="c1-xlarge-x86"} 2 + +# HELP metal_partition_capacity_other The total number of machines in an other state in the partition +# TYPE metal_partition_capacity_other gauge +metal_partition_capacity_other{partition="fra-equ01",size="c1-xlarge-x86"} 0 + +# HELP metal_partition_capacity_phoned_home The total number of faulty machines in the partition +# TYPE metal_partition_capacity_phoned_home gauge +metal_partition_capacity_phoned_home{partition="fra-equ01",size="c1-xlarge-x86"} 1 + +# HELP metal_partition_capacity_reservations_total The sum of capacity reservations in the partition +# TYPE metal_partition_capacity_reservations_total gauge +metal_partition_capacity_reservations_total{partition="fra-equ01",size="c1-xlarge-x86"} 1 + +# HELP metal_partition_capacity_reservations_used The sum of used capacity reservations in the partition +# TYPE metal_partition_capacity_reservations_used gauge +metal_partition_capacity_reservations_used{partition="fra-equ01",size="c1-xlarge-x86"} 0 + +# HELP metal_partition_capacity_total The total number of machines in the partition +# TYPE metal_partition_capacity_total gauge +metal_partition_capacity_total{partition="fra-equ01",size="c1-xlarge-x86"} 3 + +# HELP metal_partition_capacity_unavailable The total number of faulty machines in the partition +# TYPE metal_partition_capacity_unavailable gauge +metal_partition_capacity_unavailable{partition="fra-equ01",size="c1-xlarge-x86"} 0 + +# HELP metal_partition_capacity_waiting The total number of waiting machines in the partition +# TYPE metal_partition_capacity_waiting gauge +metal_partition_capacity_waiting{partition="fra-equ01",size="c1-xlarge-x86"} 2 + +# HELP metal_switch_sync_durations The duration of the syncs +# TYPE metal_switch_sync_durations gauge +metal_switch_sync_durations{partition="fra-equ01",rackid="fra-equ01-rack01",switchname="fra-equ01-r01leaf01"} 2.06530044e+08 +metal_switch_sync_durations{partition="fra-equ01",rackid="fra-equ01-rack01",switchname="fra-equ01-r01leaf02"} 2.24029886e+08 + +# HELP metal_switch_sync_failed 1 when the switch sync is failing, otherwise 0 +# TYPE metal_switch_sync_failed gauge +metal_switch_sync_failed{partition="fra-equ01",rackid="fra-equ01-rack01",switchname="fra-equ01-r01leaf01"} 0 +metal_switch_sync_failed{partition="fra-equ01",rackid="fra-equ01-rack01",switchname="fra-equ01-r01leaf02"} 0 + +# HELP metal_machine_hardware_info Provide information about the machine +# TYPE metal_machine_hardware_info gauge +metal_machine_hardware_info{size="c1-xlarge-x86",biosVersion="3.4",bmcVersion="1.73",boardMfg="Supermicro",boardMfgSerial="",boardPartNumber="X11DPT-B",chassisPartNumber="CSE-217BHQ+-R2K22BP2",chassisPartSerial="C217BAH24AE0006",machineid="11111111-2222-3333-4444-aabbccddeeff",partition="fra-equ01",productManufacturer="Supermicro",productPartNumber="SYS-2029BT-HNR",productSerial="E262335X9100766D"} 1 + +# HELP metal_machine_info Provide the ipmi ip address +# TYPE metal_machine_info gauge +metal_machine_info{ipmiIP="10.1.1.36:623",machineid="11111111-2222-3333-4444-aabbccddeeff"} 1 + +# HELP metal_machine_power_state Provide information about the machine power state +# TYPE metal_machine_power_state gauge +metal_machine_power_state{machineid="11111111-2222-3333-4444-aabbccddeeff"} 1 + +# HELP metal_machine_power_supplies_healthy Provide information about the number of healthy power supplies +# TYPE metal_machine_power_supplies_healthy gauge +metal_machine_power_supplies_healthy{machineid="11111111-2222-3333-4444-aabbccddeeff"} 2 + +# HELP metal_machine_power_supplies_total Provide information about the total number of power supplies +# TYPE metal_machine_power_supplies_total gauge +metal_machine_power_supplies_total{machineid="11111111-2222-3333-4444-aabbccddeeff"} 2 + +# HELP metal_machine_power_usage Provide information about the machine power usage in watts +# TYPE metal_machine_power_usage gauge +metal_machine_power_usage{machineid="11111111-2222-3333-4444-aabbccddeeff"} 69 + +# HELP metal_switch_interface_bgp_established_timestamp Provide the unix timestamp since BGP is established on the interfaces (0 if not established) +# TYPE metal_switch_interface_bgp_established_timestamp gauge +metal_switch_interface_bgp_established_timestamp{device="Ethernet2",machineid="11111111-2222-3333-4444-aabbccddeeff",partition="fra-equ01",switchname="fra-equ01-r02leaf01"} 0 +metal_switch_interface_bgp_established_timestamp{device="Ethernet2",machineid="11111111-2222-3333-4444-aabbccddeeff",partition="fra-equ01",switchname="fra-equ01-r02leaf02"} 1.731591734e+09 +``` diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/nftables-exporter/nftables-exporter.md b/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/nftables-exporter/nftables-exporter.md new file mode 100644 index 0000000..7ac65e2 --- /dev/null +++ b/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/nftables-exporter/nftables-exporter.md @@ -0,0 +1,61 @@ +--- +slug: /references/nftables-exporter +title: nftables-exporter +sidebar_position: 2 +--- + +# nftables_exporter + +Export nftables statistics to prometheus, original source from [https://github.com/Sheridan/nftables_exporter](https://github.com/Sheridan/nftables_exporter) + +## Need more + +- Create a feature request, describe the metric that you would like to have and attach exported from nftables json file + +## Configuration + +### Command line options + +- `--config=/path/to/file.yaml`: Path to configuration file, default `/etc/nftables_exporter.yaml` +- `--version`: Show version and exit + +### Configuration file + +Example content: + +```yaml +nftables_exporter: + bind_to: "[::1]:9630" + url_path: "/metrics" + nft_location: /sbin/nft + fake_nft_json: /path/to/nft.json + log_level: warn +``` + +`fake_nft_json` used for debugging. I create this file with the command `nft -j list ruleset > /path/to/nft.json`. For normal exporter usage, this option is not needed. + +`log_level` can be one of the following: `debug`, `info`, `warn`, `error`. +Default: `warn`. + +## Example metrics + +```config +# HELP nftables_chain_rules Count rules in chain +# TYPE nftables_chain_rules gauge +nftables_chain_rules{family="inet",name="forward",table="filter"} 2.0 +nftables_chain_rules{family="inet",name="global",table="filter"} 15.0 +# HELP nftables_table_chains Count chains in table +# TYPE nftables_table_chains gauge +nftables_table_chains{family="inet",name="filter"} 7.0 +nftables_table_chains{family="ip",name="nat"} 4.0 +# HELP nftables_rule_bytes Bytes, matched by rule per rule comment +# TYPE nftables_rule_bytes gauge +nftables_rule_bytes{action="accept",chain="host_spc",comment="[spc->internet] Default http [tcp]",destination_addresses="any",destination_ports="http",family="inet",input_interfaces="internal_0",output_interfaces="external_kis_0",source_addresses="10.0.0.10",source_ports="any",table="filter"} 2280.0 +# HELP nftables_rule_packets Packets, matched by rule per rule comment +# TYPE nftables_rule_packets gauge +nftables_rule_packets{action="accept",chain="host_spc",comment="[spc->internet] Default http [tcp]",destination_addresses="any",destination_ports="http",family="inet",input_interfaces="internal_0",output_interfaces="external_kis_0",source_addresses="10.0.0.10",source_ports="any",table="filter"} 38.0 +``` + +## Thank to + +- [@onokonem](https://github.com/onokonem) diff --git a/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/rethinkdb-exporter/assets/grafana.png b/versioned_docs/version-v0.22.4/docs/08-References/Monitoring/rethinkdb-exporter/assets/grafana.png new file mode 100644 index 0000000000000000000000000000000000000000..9174b9956b34d44de44af774937edb497673e860 GIT binary patch literal 496820 zcmZsC2UJr_*S4LD2wW>lRS~&}fKmknY>4!l&_P8y0R=*bsECL(rAqH5gb-R1NFY%W zP}t303qSW`>nU!cl~Fr%?_TNdqxVd98=JoJcvK&kClwWbR-BJC9v-d15GNz_ewCku02u`IbG%^ya5!tQw zjk$f5!=TD(VT+L!K?MNYoPFeU*P7_lxG&HYc4%XTs0#{&%5NbI0T0 zp8Kxfd;9vn?>O%NcfJ1z)tUS|7f-{FHv5kfBbd-j@27gS4L3SLuqBH!zfU!ZcTed3 zr}Dp~r(JWQ)~c^9kQVrw+PtRp1)-zv(lvkltN6e2{%7}_yS^WK3+T+&2VOhhh+1fz z9_#dh9y?5!68f)t{}Qo@_nYq?Q{MY1BA_e0ayO3{9mH#(dWaWfa-{|IR)nT!Oee}8E=P3pQve<_*aGh%0u`*cqLyD z7x#!S93TH=YaqZzT%5Z9Ulsl(dhOeN_(hGUwU<)*ddB0(wgy4I|0?^hytwo1Zo>lL zaUK=^DBLrTfflksysg{+rx%{SynDsLjlVmt)f;)`D%Rp;jfah|#-#3l-RxiD(6K+0 zh+g?O8gpS~`Ul_X6ZKW~nSq~b5B#gbfAXhY23H)U6Oyhb3Y~}PR3^Pr`A^xuB?aN# zkM7~WEPzNk<(t|3IQeJ}no#}k;{OOw=Wg!4BlNXK(4DHcHQ=Pd#c7K0e~SMtiHh#t zu##2W&;mayc%W$SzYG2?c**^7*Ee|jP2=ej_fI+hp9)`Z?|$RGrE4nm3XeAXmdZ=X zRK9;-{U5>MP!SUO^>dXWMFs3%e1dZq6(dd&Al>`}?h9ase z2&vP8(Ll<|R(;)6a72Hd^=haCSWCKIPH2{uk(r351-d*ieG zB1hN;4i1>Z0s;<8t8r?<*j97-+FwL1UgZX*S^uhhY25zdq@^EEJtRl1IcUQtzATe- zgDrZ9kbi!_)5@bq4!P;x5eH7h)^$yd`Pap^O0Isw02LND+^#a1nuz+W$J?t*1L1MV z<~0~y6WKhIdI~|IUk^3-q2>dfmjXIQy1A6y8)n;-XGKLHA$ucCt&x$@z?tYSho04L zH*))cLc&UFi-Q9;yr_=@uvJhzt)TtIRpC#Cz60eH^~Q8Z@_xGjiw%X>G4ilXU&#NC z!Q4#yo6p7^OV^s4$Bh3cU2kr_ zj=GatR#9atGdy!nMh2eqca7ZLRB~j_l)kIuWu~-3Xb|TSw&JUYC@%X(}eG@ody2cGk>2YSB%FFo17hIa?t4g zp9{rF&N?dTlUW{9Dj2avON@PS(d%A=g-Zka{hb&(>VXvP=)GQci7aC(aN-i)i-HrUFPif{W&boQPjvtrdkH^dVQ+C%~W1mr5D#i)VAK7 zdpEXSv^HqSaI*2icYP6?{>6V>wg$2j0~}8hWWx(Z_4V~5mNys47%f2)| zkfU}HI;d(c=Gx$Z#!K?9@mw;cdMAT-ZICHRz)LZb9#GqWF38g?ie_pfbn$W?n~i!} z<1fL?_v%K1W1wlZ<58@cRE-5zrz7KRoe&B%Og7g?%|>7F zcUL=OLwu;X_DmGgDqT2x0)PT9j@Xw8i&Y5gzJryQU!bgG#m34Egt2fRlO@o%_j^Nz z$Z0ahl=gql-cO@%0zI;NdV5c-K(0VsjblF)|5{sPM5zYBFJ0bSt*oq?eF#2uQQ!qtT%9*)zEzv`gQKYhXYl<0iX3I0mjTr^ zx8l%w=P460p8cCkFbJDCA4*E{&$tKwt@K~brsM5y%yi^V2)3juFS<448 z_Mj_)Aa~Vtm7VibwT}zJpVTl!N4;F+>7{Eg<)|?nkde7@(=XjkuGvtL4gwpepS80_ z-5Fmb*gAVxz2*8?TUZnq?R>ZO=l^HdFA4P3oRX30JREn6r4rAH@Hutqr^DV0Z^LQ1 zTd_AcdwOiL?(bkK`@t>^BYnDM!H*}@wiXfvFBuj?K;Fh$h?hp~z!L9QgT80~v3to6iH2U@BlJ;PrhK)lm z+9+`jQr0h%Aeov@41s85=rDtB8IjXQDmSM5>w*I~1#0t62p+|;h)TgII0N|*b^Sp> zQ%i&)(X)T{w@fGY6P^zaP?Q|qv@c4YKv&%}HU$SI(1+XO+Xc_|Lj=C@4~P}9!Gd|*dW;&;i4l?Pftr5Yj+e06$WU5X?CC}YzPSaqosi*KDlTBD%-CYez^eSHH{=Up*QcAI7b32gmzOtKDH&Qyv3Nl{RVLI2vTn{L7^trY>XL--PC=B7j82Vb@ zk$?~!Gz^~PaVh`d9Us|gU6yZh+k>8+?QSZ3EXg#=y*Wq4wP`fnOl#OoniJmoy$42_ zbn)pk&5hw40M|DrN?o(ki|K=!-P=04HLHUkx(W(iVBmLbLi^<&i-pAV-^H39U)mpG zF+&T!A*tA68>A@a;g0fQF|C7p4a}JS&i_=Y_b#$+4-JfmT7x{foTHa`lGco9S4<2fubMb3 z@AFS~n;#*q|C-mHv@(sAb*^b}HdQPy=yf3p1d(84{!r{o9fS>2XX`@pV&V5JdU05M z)*!^ZXuF;>n5{mi%KVjNaUyZ~#*CuGU=;EPRX+^256XtrS(b`-9Gl(na-s z@>kUEQ%BxWCjk457-Nnde1grmritobRp_uP^;(WgZ+27}K~s=-kk~d~`H(SL?;@YA zG)#g8(Yfeb7lL#-v{0Am7;90GdouxR#2jO55+kKvW1}-2$NqZe)ir4vN1P;f*0Y)* z@h6fQe%x~@9%@^2ivvckPf($r_!^O-jd*|EoyTBu`YAVU=4I1ms+m1wYq8}^HzxCc zR9~WWr+X!@%n$hB^^rR&CgWoopSIt&^|*-oL7=x)OA(xHUk`|c@-@PM`qyp#8hX?R zMYrHBxw5e;=a*>|+05Qh&`@@O8L4kD)Mlk9qmBr7l-Jgtn6i>D@?${>-x9Q<{cI!S zn(u*iB$X2SNsh5w_TBS^ZGOZQc>*un%%tZRVBFmp76=bkm>r4v-q6X(+rGSZ7M7 z-N`ojRFcOe?r~nAd`~T2_10Cin6B{>r09WPwkk!vrro3PtEpx-i&O*UjE7rmKs{eh zz$&Y76Hr^y>^Mg&^oBedRnb&uDt*;>0r}`zh6$3cdF!|$9xz(S%Nw9E)Ky;ztOsZ; zfVTSGCNYP8Enkn$wDsp^Tj8>lHpbxpTuj~{^pvzoj^fp~_Nu8ZZM*EErB=Lu8Ov7I z^`4lB(lE-x!dY0{J5$U*rX!<$421L7+J5)Jr=q|?Yvvq(X#F>S#7+7#gP0rSv( z{dCC_*}|G2r51~9=NPCWenGq-eC|X6n0SU2^4K%?W26GHJuKcdd}y3npu zUv9EC+qRgB=u#tIBWeAo^uVU>_Rw{>My8nV$o|0rQf1mButZSqMWNm_ybuT001*Zk zC^;!!zC4DO$ANuAsdN2#nc3O4D>L3EU_D7~S=Y10<>kfu_Try^c-pRZN7L$Iw>7~3 zFj%wjojc?;nI&HRpyQ>_kIzR%wSr$AV)~Vh-Js0T!!}ZbTbTt<#@#&^f2M>03cAGl z0qQV%j$3HTPFhb?OH@kaEkPu{e&N^qj=L~O>aysSxqHcegr95Hb?r+P%WHg@nm?`; zgp$3OekYF}kw|xiO7PL&shAU{oeNyYFe?a;abxbhaCPswDq6m^0o1cH^mDpWMf*$f z$gBY^6kbbE$HiJ`rS61lqm>mMwR7(Y2Q4>bToo`X?i;z&3=a{V$`34z5g(@#MtYgU z)gQcIYrV~wVjJB3>Mqvw+`fK_#R4k{6o!4&pFe4eD4aCa)2&CQEWGtd1rSLOqG0Qs1X!qq?f1aGLuqRUZg{4>80%Zhea96=!>nHdj^o+{zhBQ z;xOq|+AAB0yoh<%;BHrc^r#+h+GB9F0f5|bH_2MoJa5dF95>n#B^eon7@IAG9aGpv z)2>y4G@e#9B-f_?R#89K&UM@3AtEK@XK}`-E>g*F;EoK$O49r!LdJ!QdQi7y;a$q2zp!Qs_^W)X<+`w(SWXb4vLRwzs1(Hv;7qxc2L$zk! zmC)Yge~V)Io*d*Q+ejW0x~%P)q;)}6*Hms*M5OivB&s75?f=CxE)((D9!3Zk)PwZ> zdUKre9xLT-5`XAjfbj2jk%HyxdObIja(iC4bjdc(C{V+jNh1(ZE)$1qsSnVdbA!Y; z$A6Ex=in*V+C~w?YD4c{u;zBKsaAbK8iRO+KKTpnT@dXLL;5@7jQRwfzf>hn87%yG z<@>PTs|vY-s1XPH?v%f-o_Sq@T2*LvlA0sc4zKqd_6d`vTk+LuT=d}#eiujE`ppaW zj3ilOX|E)qSGx`T;iFv40~@jE$H36YqPKyy+Dm%IflIm_6OlMZq)bp*bMV1Dpx0ug z`9fCjAVF$s%7=7N%XDZ{MAh@pbN?7WdpM{CK7iQy{?DI>_VOJe{haQQAHC|Ze0-Ta_-y3cBSPG4HUK$fc>s0jZImP2*-tZ3=4V z@vah(ETGwU=2s7HvpT-$9}NG+_uReekft-QAts=-%W! zC6T8QU}nVKJLY z_C+{OnCP&--j47hYdbU|KQTO4kt1*1x@tVHJmX$?^Bc`R&Q)Kqlh7y!d~%IG+2g1- zsEL-X^nDrakMQjZGG8p=DP~W3WGMcUq6F5p+%gQhB&XuFU>BoOcnan=}WO6@GKS zQGX9GBpWBH?w5a;8Dy)^X|#KG;|4EZDW5Rh$VdO&a9gc5K*Zg%s`qk>HJ&R|XSN2= zt@4p*f(iwbTHFr70F;n36?equ2ZwL5hi9}T%=gi>ib&gPTb%vG$OYR@loD*;h)`bj zZ7mD~+qw%<3X~crOJXA}uqB{8V#p1bugl`*Zq;kNvP7^r_3N4j3L|M=-+Q_spVZhl~uYduGUTAHd(A;L#JVKWoNk?3`L<<}U9m63y$GsJl6j9{bCnOVMupP!U8} zKGM(+_cTI0@F~V7rvGIIb{(Lz+9N`C^2<7`BCiAlRcKOau_9IU4)D>v-rk(WH%H+! zeXgCbrHX+yzQ~38SggT;@k}pDJdxd1i)j9`mH&wMXwvG=ry-KwupwPA=URxTgvBNGpO-&9}_O5~cI}>{2B~pV^r4zbe zhOK*lG1-Gb>*OA1qo!r$re6*}CcO=H3v|!k7KUV2l?KlD_LlFT&@Mu?`WD>dbYMQt9|mbmu# zX~A7KtUoE|qHYj-{n{^s+#%A7TPM9{9S3~|M5}Nwx6f(uzQ0w53{);T)y2CyFN{q@ z`2O0V!1Y|O8R;~Qo@ky5>X0%40=scq3-7*&p4qzBbV^Hp1+2MoAbIhWjiF)OJ~_jX zb@%WmxR8^l9KqVn+mvjzfC9j{TYgNipKA_vOF}zxG2eH9@Y&4XC~!Vo?@KP^>0PPF z;+}cj#n1?YPhb08ua|!A(78X-De7(ZXyR@~!Im#KFiMI(C4{jojyX8mNZ>x*W!R!C zTnd^TDniNolPjHENgVeEzsn>YFc}t=$$Ea4hI!{iAs?@bYRp+kM7;rT z$40=MJ3ZiJC%ZE@NQ*z4z*GEX;GZ9yZBF2*hl+}O%_OScN^|7FGZ)=cbuEvlUN?ys ze-z`mRpWacMLk(f#E6}bBA25W9rLOWA%YAN02(KTyjt~%f{=!CEhN-dy(F$iWJE{JZS%3b zl|c5e{)2CI9J3DXObIPjb)+m+`LWOJ4E;vOzErR5!GIO{KcgYzdb;}Lb%wgT@G>Ig z;%my5nrUwac%?1@vU2e~eUi2nou}oOpR!b7x#?JhUk9{rEQVy}1qmD~9q83W_nkWq z?y4RL6p4U&%+n5Tp@dv(=c3xCQe&|q3l>c+gDH==L7>LhKH}D6)JxBlog;smQLZVw z+6pQRb;b$=o2?v^5I^j*7=mw$k#iJmsQdC}pl85;wjJqR)%P)g$$a@RH26DhE$^5R z()$D_6ovcgR(l`yS6~kQuX({<8$<|E>CHswQaU|&qFd7e*|Y^Ya=9_ayDq{FMv-i{ za-f^w3$G)$q;9L&I^eG*N1#l7IV=hPfvtUpkC9C$sde>e3>gK&=J}p?R?eV#tOcIW z=9rRN@^(sHB?*9=Cl}(!*$bYYg~d;1%!YFGum&p#^zu%a z%CfC&tohjZ{&J})tSjVQ#Op58>&DqU9>2om16=JsnkrA(S^evx18iM7c&$K0^O@JI zm>P#jU$=X7HW#zdrsrJcrj@gkrZ`GGXucqvT~LuQV>Z0GyS7`|u_&!`hD$jMOGL0y zLab;Co74NyB{p$qTR`GI`=4aN6652}3>$2^v$g_ROeVR)P|0UhFpWC7q^Jiwp}j@T z3r(pfCov}b9Zq^bB3$nm#ZQ=SwQ`(RLcPrR78+FEr zKLZv<3IW-zwP(ff8g#>EWK1J}J!${tUa}n%njikBHe1CMvhJ<3_B}6GWko=N8v|GO zqgJF@Sje3L5h~)Otis(mGFc@1v7(6HA$C9ww0vsgsZ*9vjbD zr|xJi@_9UaW@L7j+^2+weZ>5^HS#b)o~oY%bu-VXw0malAYrCHc8roTd_*qv z%PuNkHk!5FSc;_9W|6{|#xb;><7%G*2!J2nv)EC!Aj7)jmoq2zrG*zIcR0N<@MAmI zYE_2}5MXQx*rRrLXI0ZtP5>KFt?YkUK zOy3poy^ww4-%~=ZrQLppN%*FWN=QQ*8zUtv)6F&QtBNAtZ8e*Q?hmXDG7W&~mYI(Y zN5giO0fz?z@S;#!=&rdUHf7dSqU%0PW`1?Ho zK7etqG_~rd8JzQ%3^wtlR8UQdRKANQqW$}nTv=^UpGD)K6XzH`^ql<}P$a$H+H81w zS^2?m_o&tHMVnhydt~ocdKaJ)Ab_(lJ6m1M!QMNtZXZ8v_Yf5$7Gsmqsf;>cH~S{GRFR+aeFZMn?YnkJlg zzUmy$r}6=k>03nWT7HzZfH;n(7mT77qkSW1zFwzH0$9&YGP!X4ivO7+*eEs|3QjYZ zk%>8J&xZIo-;tl+Dh(2;a_up5l>>+7-&lm4)QNP@A<#7 zd`!fklWeZqkmGFwZHUjO%$OJcVGF6b_xJVpgf2AgYy;7K4ILdd;*rP!$>qMLS%#hu z4aufcX7g&>=e-EKq`{m(9Z|ZsP1?C%t%X@br6;g~cbsBjVER%rk)V;iu}i(Z9u@fq zc&ld{t?wn;Eyi#dp7YYoWJ{4RzAkPvU8Y)|cPw^t(jI}nWI~mo&E$}gD*#`}k~l22 zd)wu=A(7+FDfH*#4d>+SUG-B=4MbQX+SDDTqEPpYAzy1Jx6gC-E`8?fjgG-zdcBs> zw8^L7xSpdMwx-tp>*Iujr5AAe4`^6_d;|}k$qI^b;iQ`V_A6Zz>@^WqGQa;K1M62Q z8SaPifc%0J=jWhbldWHgddLk|_S|TG%6-%Rc9(4W{Tfe>%g2~i z?|1S$$n`iQHjA_q@7WBv6&SxyxY_i=XWVt^w`qDY`hX*B?4{QH@#C%N&DmR#gp9Vf z>)HV{pW`M*R%m}`@V94t7ov9kOARs+;?t^^hk0PrU2nUTS)S3Y?&AvxE~j$b{bUR* zbuQ;@TCv0dH(h*XDt}kTVAP>nE$bD;(93YCMMpN!h>pc?ITodcaiAxvbn-n?#mhdx zO>|wU{e_i$%aD7*Q|x*V#h`s!Y1ovZ50ptBN21cw+4O*O4*2ru`cOwI?Jb{F!b0S$ zyKJU+@3zSLLRso!x*)Kk!MD|=sV7x;2Z|zwT!%L;-B&;EHHx|oD9%=TSBHweyZFP} z0G5a?x9(eISze3k8AY!+bg#bWMl9rnHlHVX3!p#M(8@ge+LycNz-(N2|0TVx=W_vS-2Jr3^#k+Km&VHnU6eWP=EB#vUh7UgiaC=` z0FO=6e5u0YqE{o{ zb@WNM=}(hX@o|FCWs|5F+26C|v?>-PPp2H7C*U~ZkertykQb$%ut zZmw@9hNS0j#LQIu=Dy~8ZPE}lcJM^nL5HKiHn`LV%e+uvG8AQx|KN-2JY&1k>{L)7 z+??T3sq1|%@~Vrp8thJY3b{m&9il5!xl_G2Tr}IeC#FAA&vC}pyTZ-2huD@!g$lYz)w=^I))>Hp2&(olt`u8^Hy-Fp69WiH5u8KKPRcV;hIt& za`$zK_j*z)7EUX9$LiW)roMQfP|_CkN1X0lU^Krp$5GcL~do`j?z-WWVIf+QeS*%Km^^?uR1!V)H~|o^WpCN_$+OW5cP8+a>tVITS>{h{AE?&R>0Mn{tjM( z&%(^OGdA)%SmJMD=tWAEtt~h>fRP_?$_puR=Xrg;ulkOIEF5 zr#VhIWt+V|WgxX!ma04Y3pBl1riTTNZ`smU{T(W1>1a7UNV{&{X1U}RH5#+?c9(S?=EC&PK%y|W3{7O{0 zu-^8)HJpPlU#J)oCzVwbC?Y5^Wv&wuZ0<$Z^Lrz4`_0C70+b#lXK3g@@CWq#Bj-ij zOmNp3YoBqmq0b?@n*suWlXv|x;dm7qW@n)>`_ueH<))Giw@`Oy6}Up(aqeYyjZRZt zJz?8AsF+w02Mw$5oX{~B79B?TvZXs%1(sI{9_5FVq9v7S-Gskf~N}+iIaFL z`9iDP?HCa1c3JJ39D8y3;9^9~&D_ErWoOqcA`Ze?k#T*7gLr!6KW%<|mMl!3Re?xh z2z8jk0B2RND-Lv$Ov zSJg!5e>uGPDH72;>~h>6vP$)IM;S{}>(8Y;Xy&ACXMuvfSsz4oKJ#0R z_UPxHnP0%_yaQme%*&rn83alt_ZB(-NF5~N>$IM}`$$rRiXGh;) zOVg!Egxf)sJ<02y5?iTk1wWMZ_($~ZOYfli@&$fC#0R3}KO;go&lfU}(;UpkRv?fj zmm+4(R2WxHTW!L-s?aKk_muxG40p`oyrZ34QR;k@N9S3{z3@a&+PJXE4F~PyYm33j zi@A>wFHb?*M(4~Kb@8xf+n zF;2dn%uM_EadURf!*>8SDsOv7MYvQ9Oo0TCC$gjbyWIC3D!3uw8MI}P&Ha@p%QZD! zKVaF$cI9k%3F^2y`208=Ig4CKSNvv2CR}h8^s! z_vvnO%bCi%>TIs7X)lAeRf91BZfxx z>(@Uu{BmB0#MQ3I$hK&lK4K5@PiHDPO+*2DY^)v?B&x-$KyGMhZCd9%K4WFqN$Y*y`>M#oyq0^^}9FS`4j#COdQ~V!S!Pjl9 zm9!123c{N23NsXTD&2RZJQ_|#x0fh?uIXC+q_9)W_K3L@c}`tPCQlVI$05GL^cB6s z4A@#S=g3iW5p^!rtx}NE)EWOZCemK!vI+$=Ds3l%tmC9AMjA%xawI}}i5}b-ax1wj z@BQ{;NGMD^fO{y<4?d#+R?tJMI?vlO2kZ-}M`KNH&h(LCFKSZ)WWUGr;i(XtbDy_Qv^k7lk(p53zplCgdC$TP@={lo-#&F8+c7 z8F6DgVX4~<9_G<(`H~YFy_#a`lVqpbq(w&4;jZVU)yjx^|Fb0^GX7_54cK%hf#lca z?(Wf2aVaN<(80H~$(_9#+uw%jS!MoS!0P2?jI-C!pCpnF3>z}OEDw~dv z91V@S8z2Fut%{Brg`6cDH{p@{htr<3(qFE2cm5skbxlxZ7MwSEGBpDM7wcI%`-0q+ z9l&vMMaWy-rIvxo!vnF!NG3wz|6p049Os1UUa^}RS1x$aYAvjSbhR7qkYs;{gGr{x z?1FB%EB>atI{EfARHfb1E0#&^Wl!GSU8m8aQ1X?#iv*_$A4{)lXM zi~@0|;SNn!=f3Ec$t5HB*AtC?GX%$l+Eg#y0_=70))5-nn7OzM6=l6_*fo2)YF2^N zSDE2`v^RH?xnB_gpJsz{Twh74>!3DkH9M#pEZlkWlHI${;g@?I$^@CKfs1q^}@DX09xB(r?3Ck(Q+1OHMdSxUeRyA7Jv-N$~pb^GI(it*WD>u zrJ~qoCsL?xL`j43DavFyaHh6)Hwh@?Sx;4uzfzw8D13d$6?{9?ruI7;&TRxfAszdc zToWV=iy>(#*tb|Do>Cb3_-@e%g!Jb%*D<8`DF-2=eZO;(Gkhw8i5F)>iZsz6e}oU!>Ed1qVwzK=|GbHZ>s-wldzy6!~($P`R6~W|$aW2A|ePQm4^GlTLFp|0qE0%1NlE2VS}#>h-<*72VO^Dy%d)>=t2gUstFu^+D{u6f zfEnAsxov#?HR@n(-oo$L=58PK{*l_K4~-<|N?9m6JN{1#A9)Y&%|iXg=)TBsteN99DXR1>%4 zRDbq&HC>D!;p^=Ec}p$kWKi%__&ja$z^Ig|c%?ckYS|{sj+2arq(|(AM^JF?y+8$* zwmU004i2}uC5BZj6q3;PSzoZ!TB^6Cc|{-cb=x=8mv5YPnSf!^XO{JV?S^93=Q#+X z|2)QPOf#W<5Nv7yZV3GovV#*p=ii^ZP=-!;-yFic>PB!$o(8A^|o z_cFCBu^0=(Pf-6-LgVmdWX4$ClTM%1dsqqOTh8flA$PI$Y3o$_=9#8-8Vuo0Y*P#D z!25+jd}}Ot?5%H|-RnQyMpb7RgUEGGe-GNM`+yEplXgL3O73AyXzkH}or_>{tkIVq zAU1?CrY_$pl=Ot$fA|qGAdAv_G_uXQ?ij^iHs$n8$0a%?@SXL_sif-Fx6dvj2k4cV zlQGBvSC?g%-avQ(=bhv(u-9SPU5joD%+rM=5~v4w89sE|fQ3aqso~>FZ6(5|>V{tC zKlByCTWL!cCv*#2IsDkpT9`>RDF~rQ|Kyw`Hx)@3# zX~T!U}9BbHb?JE^fA$R-Yog{6C=rVG9S3JGLJ2>*QYu#0QT?v1#pt|Zf zMoGSVlL0seqb^rYRS{a{Ff^v0^R=c-9@9Hlcl_9xBFybdh0XEq<*`)j?@|WI5%g%a zz216loacp6b8@DT`AF?Q`^n&2Grqov)XyugB2?rHxM5C}_GeT|7_WG8z>BCH>Itpr zt*{zC}9G{lQ*sKcB#82f133Ms~-%bE8*vE?QJbz2SQFma$=mM$u)i3 zb6-(?xRQvoj(wol{+pi{@fv^G@!FOnBg@)@-L~qXnCUcf$FSAtc@bZb-MBY%!|!g- zGW=!-oAiuN@^qxOSM}Bs>{zX@J(w4{@E^r{FYOr+=d1mf_?o(Sy(L z-66E``Zh8p^)J~T->BNa32sCU$ft3#v+?@o^DjLMT6VG8?^gXQpCI`@<<1#i(Pp zHaL`kE0rKy-A6i>nLbV#yyJIgF=S{pH|!(7))Sim7^F}=iXFF0(aGpA*XPMT?9Vo6 zE*aP#fCnZZcWP#YeZCD_tGf3rYR$Biu)bdaFyI7uEY`~DW?@K|_)3PfKHB!R%G8zF zh47E1u$lgqBqgBXwfpjFx97Z>k0GvC&bKH&jGElk@EaAvUaVe@JtW_MAm3i)U9ntb z%cisHO5S1-!F8sVz3}3A3UNr?os4wP%!>Y1=y9D>?tuvYC=lx$QB#$3?m8a!Yh!Xh zbl9IFGW~QnLR%Lu`R3HgR~|7RY1i?Nu40JQVa6q=(h3+12a7E*Sg0<6XFLM-s@zNg zN(GsD2xRYnb^@%k{fFS|u)Fxj%)@ZlkvAq$J8%CsxxRxwRje}&cv)*W)v@Ug06vom zpN_=>lI7$Z^=$c9r~pSSf}%)KeURs$SAW}_OS_bTp`oDrfCywsQ4qj+0>U&9|?}uCe*&M5%{# zSX6rlw^I1NXz<6A$6>(zP4JR@2qd*i+RQdKz| z^>1u>Ic;OJYP)-J*uHsEgEXn%GsFV1bU{we@XM3bD!X1hbtyj-`#=YN0Y0pf(=)71(9m9oN*0~bE)nx?77L!?oo6*Yd&I%Rwo5Qln8Q9N7 zIq&=JLY9J```5}-8*EW&wL8XUC~~MGafCVG^ugaPxMyRpPxdLBEAL8c{X0~rlLWv# zsPx#mFIylbQ%kx(F>>XqtEkdjp?XvEu4R6R^QSESFUo0` z_fkT~UD`kVk*0;u#te8qe1wCuu(`F0@dc&nciF(oR(vT(Hgsrc#%%P{GkDFuL&iie zUbhFK=KyQol9jd*l_`6o;!fV&;832cwt!TpSds3d=0mofA1=*fWypRN2`f}f-*Dqx zT;q(|rQmP%1(>rPn~`wOkZ1mS^8N=;FWly?K8ssVlUat3IA#T$V+xTZm4W`UqC2Z;E)2fbZ0S6>F|;tYXOR>ai}L$ zIpD~f`-Y!h&2`xHMGAjiZ=ZYDYxVP)f2;dTv3k<&^Z=aUOpSiN!e|?U@~V9=A3dq- z)m>vf!wz;(V>m3!KC-q-s*s>mwtr-|JtvmZ|A`@+PfYUx=(%0T5fopi>zN$EEa1eC z&_c^Z-MYUcG-X4`W*`T9?{Tx)AKIzxt+WZ>g^kf*)R8S~BLs$;FfKzj zc74iITK(IrVJ-bG|9eJs%)!u@O8XTBqDN%KpDU}lu@f?yn)3u0K?R5#x&C042lF<6PNf|~OdmfDa@PaL-1iGBCtd|e8xzjeDEcaoC z|LX|Q#gR?2nDc^5B<`8dyo1)SM^i!Z2yxoh73ldHRa9slSt zwtKTEb2_|6u~uPfdzvRN62owEq|??lw~o-sg@_M-(v3&rO zWo08z=im~>Ymgd6+z$g$O6RB78D8A^B5!zRqAu@+wZ_?gmvbPps*Vl=xw~b9fAIL< zE)FxA?fWg~XnG>3=5VXI750O{V&7WjLV20+=&O?3s=*64MMFP+(PFoytJXwDFhjMV z@CfGTX4^uQV-o@W|L5rsb5LvfSm)jIcIZ!s5=B%G3R=oOM62E#2zS{J@Ha?wGb5Xt7#uy;{&FV z-%n3hOJ|wpg%5vFwOo*nAlmEpZ-qPdV^DDa>sLpocp7SsgH8|P_mUou?3Ghvsf6Eo zt#c^y`94$p{K;tgA;*HpgoA*iBUy`0y1=?G2M#T)=P6kPVAYLQ(u3){&VP(s>B?K> zOoLB4jD}NOXMAK-j)|R1@n{%#-PXXyaW819O=ek5w9>i`HZ`{Zmy%NZ+TX1a78qQd z_qOf{KKK0E)pTUG(o{I54vzl(RCV9*Kj3DuzOr!j%Uc6I!n>r)RYt=#WCxW z1tKvf0^3KNLyyji<)7>2!5=r3-MX-gM_LR1~H9MI;$yp7)%HjFCdH6u-o8149%k2V+)$KL?!A12@^neW3~ z8?~gyTp4h#KebKq8E^IXg8#Uggqdbk-fl!r$e!C)RtzZiX@Odw=*px1y%(CPpMQ^r zPeyz~ODhA7kmY}&Z=G`Gv>_sTBS1n*pbM-y;VD*0^rWQ9QU^?xZmKh%jn7hS1# z@!@C8prfFcOO?d9!5Q8)F82&gW%-e*_>Vf`BcM+%dMZ~YWXI>N*%M8!yn1xGh|888 zEXa8Be!=0)A9cgsN`r*|$KHEKHNAcNqIR~r6%`R1VA)C&P-#lH01DEZlz@u#ra))` zqN1o&1p-n+XaN!k5eOhHfQWQLO&}1WAT>agki;Y;xpAL+e&=rWynD}hZ;W^UIQ)@8 z@~vyGS=O56GiBAzBaNRc?8;;rsd=mh;+9a)j-@*IsO+#z&0My$dsvQFgcgY9@XfO1 zHXt45yp`wS?u%}s^~~#fH!HgD9rwRPXYIlS%?*b?oMIB4%;s|RJ2SwaCo*|M^TY#R zvv!LIHbRLm@e6EZn%M}j^dkzr2 zfWA6|I~shh_geB$+7TT~&S9;F){brrie>Ht$W$aRqubjV=o@TLn3LC1;+{syRfMx6 zyPYpunqt3K*!WGr4^X%_Om3Q=w?YCYumpFspvDW{u-t;|oIwXJmD`KT_S-s{KNEl9 zR{fW@w#koN_*0g&hD;7iE|X<#a$PsmTD;eyLpxge-bmh26)!NIGGv3OI299dWGQmw zegauhK9Ae}qv$&cD&Xtw8WKoJC@6dHLb5D)F^H(2DLdy{9M)0S_r3Cl z4jV15E@Fuej^eHs-by(3sw`(^i+vNyQR&bj3Qmazu{7hp?Tg}v+}+5ndKuzN$eul0 z_SW94D9#%1d6RkHWpDQNuwqw`opu zUaKf~%11)mX2ZqIwc5pc#y*iV*5!?8_r<9OD#1H0u&l^L{p*JwIxVilySeO9Hvu=| z-;cF~sc)5kz7R9dLyD-|jmy)5n38@32MrBrSIREmi^EBR1bBbg30m{~+wYH0(`Pz* z-$;v1mR?TZQ*|+p-tx}dY8;+cA-2JZ9KTl6i}x?yxJk=i`okrNwmzZUdbH7%u_x0a z%pAE?{ryTpX|Qe+Dva;a=Uv`r(-b+(VuK-9905U7%@RY9He-hjJb2?RkJ;iAS!uHr zys!=MpeszhGUQVCxuwV#mxK#^C|ishI8IHP;AgQDlBg7gh8vbiOTI$yAYct+G3PZ& z?x!G<7RtcW2ZmM-+5Fh!A9`#c`9~@H?5rz;7V}cG^C+}G+_y->5+VhQFm#r8Dx2_c z7)2ohrVG2+Ju9_dd@eJ@`?yDtvyUPuKIGZ}_+2`(0f$C{|p=w??NYc5kmAzwjMb_HJ zEwe^3;)){pb^7MWvoq@bLlGt}l^X2vnMR1SNA3HnH5-!El;_u{G; zx|>LxlLuMj`X?+X?-oX=!Xx1(bZ(=Yo7=+MHvKv!mH4_q9gDkn?_L$;qj+oJNaipc zqOQ1St7o@~8fEOZ8j|~0h!rs~zW*?(&uM2_OahFO!ECO&c;RCPCjUAstlh%G47)8+ zD*Ny1?0P43Y^4Pv1t?#Zr8SYAbH*yW)S7&5gdkVrnI1WH#ET5h-FtY<2xa*m8f*^} zgu@!T9Al6z=uWG=00< zzn8ff?b?APqHv&$h5+XiZ|>7ej=Ga;i{z)j%XJ%})Q2aEb-zbd^;eHLeQRHG+2VeB zi_1MmEyLX2?GzgcGq}G*6B5Pr%S3Fr;=g6RR+*41i%fMOoMmXbRgrOC9gCQW$J!8T z3UD3IS!8CgkuzwpSD!ao=p_TKPfOWh4P{x@v1vavAlV>GU^JyK0^{2hQ?7u~CJw7Qb}fUZ?6~)7poX`f1&U zhr+aIiH6yS@)(y|BIV67|H0G;5dvCtktdPkS-lxMM(J;R=zNJ#8?*yqzLnqLXuvSR zv-Nr~q{ZVMs`3t)sm$=FMLhD>@Krh!$7AVAZS6WlvqQCs`+*O&&Dta<9GKR*+)<|ef&%>cR zb;0GV>xxZZU#nVM$>Yt)|F(~j6N7wMwRLfHopy6{n#uorT?3t)rw+yJIkplpmMAVL zrXd+Z#ve;nh#orR$x`cC!M^Tw6aaY$ltB6qJejt_xy_Nzc6kATfhb@1Ugavl#F(H6 zn&ML(tJH5oi?!PS$CxnvM{0+s<<0fbjk9LmWrmEUQ@&NUH>!vhm7}2VmyELmGK+3q zCJ_?}uiHSj+w&nl!|!dKM<$I=ZhvCpajlVsa$NCz*Ss^hGO>MI{yP<$6tdG|x4*5` z_B(GPPRMlaO|0y(X&NSnQ@2{v#tLpN?Y;E0czu&^g2`bf_uDW@W%{R%5os% zsPkn7rzRB`*B-|X<=(4l*!`-8@Lp@ z`eto%Xgn6MvQpIdKJy+y(FT*C|{n>EVgYt6;-H&#EfT z34`_Dr+2G_z1=C^JMyVZjOdC++4H+0&P$d2%)f72s|cv?-Fr%Dvl|S|dxrgf?=d}$ zdxhG>d|c!6Fo%+GpB*JAb+>PFgOb1*DpT<)bU^?KB`AxVIOg!a!~IFplbePYHyfQD zXd%h=$ZW0VN0~hExP^!W4!nr}K7+#5?sR(5z;~_CcFt)z`FapGZYwm{fJo*@doE--NZS zmVK0?4T74~v#+{#I#zNVB1t(6H=&q!zMuQ{sy=j&*942iADBXi39lT{EKd>{JEYZ| zLGnz}nPQ8-{Wv~v%YrV{WNnh?T*@AWoZ8+?jTtxn@a=MkFT)p*^>xD!5Kw7n*NeD_ zWM_q)Vjsi1pNim}RcUqG9N4rHKyNuOXWP^aROpWl`W#F-YT#&EH4fV?Qs`3KfGz@G z3YCx0DjQi>=>Vv}3W&TuZ>3rgg1VvI4Ae5#Eue=HG0Ug>GI zDIvL{wv+zi&Wzn#xv&Z%hUYx!r@*n31jA`KOR@ zSH3G*MK;nyUPq$UnIWNp+Epga>eS}f6C$qqqino#s+xZ@jT&A;H4vGIRWaMvlu7yRS7_%Q@Ti9e~<=yo`tNF39 zV|?2D+>z_<&z_GlJ_c7^9g0afHfaGIBp~}~wr{|2SvAYszK?YW{@QPvq<%GTm-TJv zRU0GegH{%?M-Cr(|5+df6akQ&6D_MsMy@JR$t3;VOyA{+R-Mg(m42?qFSB8Gq@wb9 zQJcUhnEIbtxu+TarB<|}+rB2=-!sTW>ps^UvAqZ%!qGl3?HbqYAm~9O&1k*J@C$nc z-sGL$fAnI|3x|L=n=lKagSYOyu)FCS!gQVxpwoR-@fxEHUlB4yT?G$l9k zW3XeGV`O3TTOeO%$Tb9Yp6q3f07{MlwjjJFP_^|nyNH_wDf4)y<5YNLb8tg!?+9Ly z`lq12&npBiyn^W%9$5i$6Hrv%HN2*1@Cb&!d$}eHi!a^S+)O_bsB_<@d1y_Ut{t9y zcHQ5#x<2^a(0ckIY4l!>|3I_k)mc3CIbAJb)bGhnE_N5iKYv##dNeH+l@lrC(LCh~ z$r!ZpwT!EdoKTph-iAZS5yhjI;WkpwqC|0ahOXA<1yg~|bEmHAcmR!{`BOBgt+ad@R>!rwaFK9gP~B@xen@p(8Ca0K02uoYCydGh`$cVoUe$mky%8v*9$ zKJj-I=wc^fz;nqvCPCOvOn#%)tSJ6EUVB-zRg;rGE}UiC>5u*@f_6UT>5^j`ShNS^ zG>eojH4A&sZL+L7U>UkS?>ak6`SqrT>vIV2%;ew@V<(O_!0cFEWg{Z!CT-8iEka9P%<^=r)g6TyROD@Luc7Vdmf_ngg@vGN zL`U*OHCzz5(w>o89E&p1weJ$9E+UvVQp(!ds^6(TVK+|Fnm+AFwHswHU%ad+1vUbY zpH2K&rfTD@lQfcz!?HvCBcnq4B8Tsr+t0-8pnsIKuY-TTWk!rQHL6~Ceo=lS&rxId z)!_4XxV=&00~)yq1Nd#vffYc?5w#^X4Uz@TWBCqd*i^^ZK;m*gZ{U(Yc3493aNo96 zQqVAUWevuUh!gKTBp`4tIm!U1$;o#3N9bqMCeD+u(H|a!YMEh+o#guEF66~tgfx`) zFKah%Y1REO-1^e9pSd(}P1xMVrU*)|bS*t3&+Zn0p|Ld&!d`r=(?4mQ3MoCcdYa{C zoxdapR(bldUjOycrSOc)S6`=hxC2tQ!CZtGLGpApRV$~W%Gg}>^<%jv#6o}UM4s7z zb1@lSq*42de#|FQuqHj=t>i2fd@h~~xHs*d?bOhdZ5r4l*@qG!tIbuajX3M=WXU2h!IT`hmLmrFN65hokfuDA#lWOR$1l|XOa%671Guf7a&Hkt1pk(QPopy5mj zc;AWTfFubLaH#Mm{({@sEHQ%C7tr_S^053rGa(;E>IG{5MLJMDBGersHeWqI=0Gm> zsD{q3emXkZHx<#sKi}zdw#1Cat~Sv7mlD zt6Xfr(Voq$83*5>JD?u;bBr$vaKWPHN9Wbr?JP=P-p_*AZOzjkKZKGUeyBEE{X$py zpAz(_NsrFo&x=(1kGoN^w&avs zKZcdKNYMf&;9OQ0~#l>vIMmoHDj9Lvz z3p?lMZ!b^X@GOqRc`}EFlE|e$jz$ro0VEaA^ThYmZg?(m;6e?!$+2v+C2e#OqbVK& zc+6YBUja~af0)sPA|3^od2;R+Kz;&n)!n*FCwHk(Me;VOme_<@pGhJM5D_Dcd<8iO zSl4Qh=VFI5lkp?spEfmRwFHX57!+Zsr9W0-{}Udu);X)LNjp>du)LHrdx>+AwdJG+ z^a9!{oorrcl0u`Gf+1roZXkY70BP;UOMu#Ev1g3nh1u;8mx5XyEt~1ppXjn_kIaSu zr!(irH2wpp^S=N^S=j3Fu{HgmOxUD?hSto-ds?ccy?b?O_t?ilzOS8FB^V;oBMz%r zJO58s+oanTAYry=+*A5XA;)Xn=o%Hh*!^Rqz5fPMnJUPXAX|1P^nm!Ft96Ti1#70t zSSA7(KS-4>IOgv;tHtG(fa|m~H4poSeED+I-O)M!nu6?z77pUo|30A9ak=Iv^_6?_ zvT%uw09{rwy-9hUms$QJL8s>&$a8_KqBkx`yU~JAzH4MQOQmL+-0QfOadCFcRe(zA z5d7m$F-36ztoNl zz_6$O{Atj4q3XdFC*B&MKm#S+J#rXN+SytwQceWw5?ZTcitVIVx}q5(L@4oN6j8P- zr#G=cAb$-t5m+@kW_n~^?aUota8RYkjjpaP2K2`HpM+^lMD*Z6=`)x0qME}dgUB}a z_DIx3O+7r5@qd8ods7Q+d28f=T!G3K8~uOy2mWmcZ`JOSZv8ZxA739yJ^5#xZa?)P)<&|~*%KjSxa(|PV7raOF@}?qV2~D}#UN2mZA^!oJEa!GXxhU}_!ybBuYfrQX@luxB#umGA3iu0>QS zYpjN?vWhThlE1zsS+ z>bCfL9(MyuuijLaS`AaKF2eq7gEr;X?T@c{zH3MFG9>iYiEW=;3FQ&+!oqj(kF8oS z)1HDPj8QVHm;d?TO`AOYwiT@8-CEu%_w9ta+iZ>iJGXY^(mSca|0lJdn;DqOdQb79y%#am7(;Eb&yNNd_z1#YMqPf^KF?)WHV;#Qt~rY~Kd)&v znF$M~CoTq>hnbMDp}0doJypeFOO_k_&AVUt)NUQHLO!{Vtg#(sf960Qc7?KrCjDBb zaxaGVdee3({9^iY!}i73pf9hhyYfFnsNF`nClH%%*^S?(Y*Eg&H-!HitCxNCcJ@aIH zwIrr?#fnxQ>qaguqgqe~zKQSXdni-(xdx~F%X=g%C{yo%*$%&q(Bp<+gqAy`=^F*J zwNvx~LXs?VS*E-0>n%AgTa9@?n;V{nnE{aG$*C8p30%&QyR+cM+`)N%e&WH-i*fEm zrc3{bWh#vVMuZyGMTqOm%@oh~%rmagKIQnI*iALhsq1K)(9sTx?oTT{QOSFsW#vVn zmY!WgQ!`F{WYU=_B-x**Q#VfcJW<=V@ChK>aXfwal+9F^H4E&994YIxoYa53b<)da zjMe=PlxeTyZ<7&jjgrLLdWvxB5-dIurOLufSMa5&LBlh_&CA{$vWxsCA3`mbce}Ru zb2t~&%${d{ zX09Oklm{L3Nv$8`X4O!PT0t13hE26z*g6%l6>W`gQ!K4sWG+|XqfA~br5Ck~*ILnE zKI9XJ_L{93Gvz>;f&AJWRRGGb?#5#qKhT?wc~sZ~oLbU0s=R|PcG%CnwAihlNto%@ z)L4tt%yBZTXG=n6h?<;x%bZFCG%$9rzwbp<(AZ5&$X(l?R<4^i*>8C=$dGX^@rh2^ zEfMZYe-!=Ry}HNg^}MX8d=OSnv>k%ep4@O*DRznon(u!okYZokUC*+H>W@@ zR7OWI#I5s(aB1VMe%PqfrB5CyU%AQ27&3uGZR7xEG*-~vSoXFvz+07bf`Ffy0`PeG zI++9?IT@TTJIWZmrJqyO7H*e*TFO9gsl38HKJeJUr!;MJvh~?v!<$0&`_0607IV(! z*2G8sYqKb;u4KqAmV;dA7t_>8Xw_2-k3ND8_o($4{GN3L2V#h|o89KDKRKLdY||`C zv3@;ichiywt1Lh4mQ*t2Bx7k}b{>AcTMnbGj4IX&Hd={N_==^Xz*ds&Fbpa|2{xg&=5P^Yv0_|XGSDxQNwti;k>(y*Ix|Ej=iRAdF2K0XIwuU2v zY`Vt{dZ>!F?VMU!cjQhh4dcs-Xsgb$2f@>Db2XeQM05SvY_^(t9W(MwlZrF^j16$& zis3FHljB-fZ+6*a*4{WH`6jj?HF)Vf%c^9k7+oQlpbK=LmCWYhdZh*#`kzwoN(@J| zGh06dc9cGk#VkAqtv}2edDz>Pxlogr=WE4Ei_n;-UL3e-s^xTZ&Iv$E4p87$1d}#g zW_j*8;-PcLqEeGlHL+s6`=iYT0if$ShB-|p4XY6!S5tzf_v5wXpJ{W_1JJCxU@qgp zO7`8=#YbD7=N#UDX|d!@NJBtBkjgDiCvNuTMVne18VrY5S_o4;NX;x+9+^dCO;A$7 zeQ2xorfPQz&p6{#`BX^Db$C#Ib3y?W~YesQpPW2br$~@NU!O3KW$TIm_h~z!2 zT`bEllINWk36pvFByB`5ZEqTGr6@54;)A|dW7uvAUKp{vitD$`=n{ac-MPPMBBaXt zeBkS=&up**;WF9qWdB$}2>DDBaLdarZJY_3?YSIE@5A-ihW(X88;aH&*-hKh;AU`Y z)aPwt^rIG9m!!ibjs5Zywcb^y((;@lrnfhJyO}t`egF+foS1wR!xcnFI026jh5Ep> z_;U1+j^zZ|U2&7y1=Cog>Y4SI#D^>3m6r1p4L#5nC9uKv7^2EU2#+ko_@3?HUZ;ZB zYWgDNUS0z&crsXn{6b>NGDX7u>SIH09|23A5%=?Q8Z56uxm@P{DcZZ2oK$L6PYkN8 z2QGOR%Ss2#-B>LzbcwkHt9UPl{D}32Py|zR(KrNWTE}dA!wg+lore{_JI!$0IpqMs zT6U$7>sePJWVMMp|H>WGi<=rMV+z}ZG5k$`MA9=2@#;X?2&4AhecBcWkKZSMF)p7- z9bA%>CJ?G5hcs~gqlDSbd(`Ky>Y*LpO~i2ZabO9KL}^VVuPmxs4cztf%;|~?mT!vo z8&89|UvAAhviPYwoNJI3>69lcsmil_#AvnOrmHyB)xHYY5RX$&Z2aVBnp6B&0~SDU zfdy!+pS+r9sN>)!^m*Hk#1zx5kdfvlYa&A6^Qi)rMAnGBNx5vF@tM`fm?+4OtX;gV zb*bc|cBak8kzrt{w5-fm%A_>UnAkXu0#X1OK)l1%>c5AFtm1O7* zxyk9NPFUK~9P+!qV_|#)%!19SC>hGhtnC^wtjP&N}~J|05O!^rG!g#o#Z zDzA$g=bgb{!Xle`=}pYK4u^Y) z#D;dB>xPd+n~a|zz*w+N; z(n8kAQi!`;op+_|p+1Y&KvRc_h@?l!vRFh2k}fJGjqrWltsOdegwG&AN@1hMitx!b zVONvGg}UFEvN?AXXFWyBJ3}Vgc3Jaqau5*bw5)xlzNqWXwGhej5gM-$&u3L{8MV=z zNWeKndlNxXgkmtkRR?@7N|#vvj7@gc!GqI9--&{%u2WGYF=D0WN3NT%oLaqB=0Imk z&<$b401h!UrN^(DHzJ!!iuRZ-Cn-v zL7E{}re?JgYgm8(ZBw^h`*huE)VYROQe>IsAgY4#jf%wfp(fy&L1xJA^d`h}>;sB` z-GWyyLWFjBFWc=APjGuF_NvBoTfSY)#toUsTW-aM%|Qy`YZnA7Qf#%XHoGC1w+NGs zVw-zAq}>^qz5$mQ#Pvh44>H#HEFJd^DT>IS`WlV`3=w%-k9qyYM@o=-=K)!80YHaU zw@XsBW39xHAeLcbt-hYp3|3@e!FJEooXaNzO)dHpa2k&@p@}w`FDnF%H5{&a$AGl` zbcx!6TA-WjQ?XLMxmy^q9{5OC^eY?7l1{dtsw!4&CaS7NXbMQo8u;5x2CRRMGc8#= z6gq3%hkI?Gq;8TzLdJ+Fo=EuFDZXjbi|2PRkzEExR(|=x${!r6XNSbaMA_ugpK2wlsU0e0h%PiM1jvQu2nN)WnMWYvKr#xG} z8z~Q=yv+tTdvXj<5Tm4IxWt)d#gc*8BeH*@i{{l%CL}9XL!diF|_OuutBVD}g8 zOS5y4i=Sutm7<5$&P`YCLo_8PmDejqx|^6A9+R{D)?}!I87llra7S*eO!|}-q-uT$ zLQd~Q7JN_Jxx-*?wtbq1GJcAm)F!D>_~o2#Gq-d4EcEy%2S!nA>44YhGQG0L!) zEutdXxa(5^5Cx2!w>01mHVefGUqBch%UZEI+E#8cC$96-z5*?C3;(Ua-Y83FsHbXD zc7hVV1g*Bfdq9;{NGR_cf}#E5y5FSh`-lESx=++~7EZxjPfwRu(QM7YEP8Pl0=>AY z)y7ApVcpi>c-LerZSUBZ;f#r_NoSdKQZ*-(AD^MhYb?VQGDcYWRg zNKABW{ChF0^O1=Wcl zoAcs;RVkw5w($}75Wi3XvrUlsxdg_vE~apJlF5IWKFUVxm>WKSgz+p7CecD?yItWh zh2Sk7dwDNMaqG~c<*Hk`E*PqnpAe|pyj!sh#FW&jo@!#r+Pxc>kknjsVorfAP#=Ti zMdIBeuO#jzrz;}qm;0k+wZrY(vrxV6RK)$boz9DJOhZ|)5_u~@ZuEG_)7TDYn=XY? z=OoKfb}LwJCQSnZB*P%Yaj$cZh0_FM^bU5T%A2{S`L@lTarnp@s-RVbz))LT2+Si4 z0()6@x=#yGHe{F7;S31)2)6nP%mb!`SS=~Sf*5y6^S(T))tQx$l4Rk%2CXUy@q(Pj z+i8%+(EQcJMsnFo>u`g^9)!Bb`>^h}AT?#R6Dugmb*}e+GKU>cbDB*w{3EUOdemeK ztyqpC9uI(^Be<)*7+(y>B7OAmyvrgw8EjATiU(s28ZWQf8_K+>%L{?ZbaVv+vg?-CY+F>v-q z70%nwNUh|CxXRp@m#dHTzY5F--LrTx1VoGVU~v3>7dLlJCMi+P`W5+wL)Cr_XV$0t zxKL#=WRca^S&FQE2xlI4V#xE6!CA5t<+k|eZJQ?e*&N1Z4yKnLWvGBueImPjhM$WLc<810yU#Tz!vDxO5P z`vD96nnU%K6p!axJMxcEa=5p9P#D79V$VX$e^!GD2@aoQt))+(eO zp+=Nz!k2PyrX#Z)gqB~vn;*pJdkmcwAnPWTWJtKtW07}m2 zsLxjIH6~SJ<&{Ht^@ZdT9QOK~1}!43zwFI_9559S`R^0{`JuW0|Eim}Xt&JM5c&D<BDYFk6ml3@Q} zs57|1qxlkGIo&I)O~yWQBMJ^Ll9qY%rC-#+*LMtLZDl3!-cLFqiV<7>>eb4~NkiUg znN0CJGjRRy7oPde3*VQ3N(tJ|D(juM*Zh6^RgWmOUnEdKq7w@LN%S%Te<+|*-aIWv zA`-*s35e653JGVD&UA;w$y@*L<0#g%9-mpi;k(?tHzn{xN8{6w1yR8bQOcJ_%c5Apc0TEWT}>cqm8mH}85h_NBcS_728=1s&(#p#Quk zIPP`89EGf=S%{vzXY^ZT`>5$9+4wiyz3D~VZ;AZ>Q4}AsU8n$3n*Y8}zf{^bBkOmR zQ^p=T9$#bSAN9_$p__E?c8M7|>U&XIo!)Oot~*1sbLi~KKk52^NIg)+?$y!ko|y4* z`6~Z`R0r)!noTrMYu;j9-ocGhYso7N3y$m=;5-2ZQQO-fqW0(vHE4mx`{%zVJUlvt z-j0rsX}U@=&kU#OtbdO~Q=pfr-ihN=k(OvJ+AF`hjR!!(5YAoL`PH|dyLa8rxMQ23 z?iO$PQ*+86?5VY-)x$%1amH@|BepsqDxzOv+n~Ii6u#XebsUaP)a2V3gV_G+rL_){ zZZ_P2t%M@-r0!;;gbPyl&dXKRU3ot2KjcxX>eJs5mujm35krqk`B$C$DYr!Mpq8Ac zca)VAr^F~!HB&2FjV&n0FmEvrMqtung#pU zmBoeA!1brJAfbxi2n*=olfeP$9k8hQ9mSVe)2>OB%s_Ct!)lnBu%?G^2v2_=MmOl2 zvhu4H`nx4k;Y8SP=2AWdN4#osXphY4)5G=k+7wuI#x9NOfH@c>1bOS1w4ARSeT$9Y zrUJR=LdzS|LWv_ul2uisL3QktT7f3c8Zb4csxdpfa?Vk;SAp=>wI)hq)--ee&}evS z`S($X`dsen(wmG^RmGL>eeG*K(s=ZF4*h20u(8-=*4OOC)BS_!@=JOJ9H5n3tX9FU zS`^_ufd_Y>@~?lEX@YyVJT(H2KQo{_Dql%;vw1EjH&R27Q>NrN0G(%B^}JB#>Esev z_9aIW5#Dv=UjIBmE0`ah+0@vwc<9hWCkHoju1xLI^dk+r{G33 z9&ZT_&pVs6I`2dY5S{nOhfqz10Zi;)^8=?C4s8N}tf<)DlZn`{dfvsnCcrTY_J-sG zWI3ySTwQ%bB2`c}L95MFqnQhKuj`WM!>gm)D}rywO}TT8P02vW**{mN1?%T4@M;R8t-tx2;;n`&GY9M& zx%fjIeSE;sSIAub_;*A4i2! z_j9=nq4i!+oamC4#ny>4H*booU~C^3HDj;CU-o81rSU@N5k%Zk5DF~XT1kDYPz+md0;(Bbv*DxiuPYR)xP2zsP|&Kb zP#K&|+;arkyIs*EN6T6a%49Y#Ek`l_fcOG(Z6(20rhQJxjozuHi8FvGa2i`O_(vO? zqGzAst$W`T#u)@-sX!!)r|~Pry_59?mRNb7ncRg3+JZvrPm_$=*5de8(_3odLNdoqTtl z@l)Vp?In`>OvJscgFvp41*lB)nFDG9UFYOCpO^G#AwbXfT9J z81Qb0u+=->vf>QZm#%8aCDdJE@|PY|SBF5*kU%H=jIdU*X$^ZM&t16s=1yt&@aCh# zf4ABp3Q%@l1om}W*bMH7++fFr&(A!w&q+aPH#zh)!f!&=Wfom1;r=S(znV!i=d$>i zj};44HmOaZa90mTuNW-EA6p%jqc)biOVsNTpby`v>nSoIRrW^d3Zp}gQX`$xij&hL z^5nuTmJeId;pXQMfYW?j4F8}hAT{dLDe{Q7a!MS{rDBjKAgKL} z$Vk_ebw!$1RDuGV+q}L3qAsyOQRukxFvp(k-Nhy|iUT9J{jYwzs1-0e&hCQ>FFh8L z9MNiSwik}PD_ps5)_iU9Cn(JyLc5e8@bMbziVN*EGmyecV|9i093N|SQuPnn5EwDw zoFc!JX}fHd;ZS@hvwr~sp*>TE1Mk5L$v34ulgFdhUa7ttt$E^K zee(F_v~i-{1-bpMv&aWkc3YE%5L-_rdi3*$5i^M+m#P43{P70i7GyVvKLdNE+j&al z#^If(U%fqZZvS!2lYGeMEyu0kqc-gcV>Wun<#R`Cyq=>*@5v?dM7_jyDyCbW#m2^O zdw*lgUysjKid^K)UuJGg-q(4ePOXKbXVM>-L(2}tX)!;SOOa_@OVUKC;?nUwD=Vo? z^zbq2NJ0yd&QxLJw+-4^&MTD1%ybBwzXc>GlR^5DqvM6QCADZd$x!&G&mw@$!Sd%9 zCigFSrps2(MuR=l0p%4&Xt14S;H3wY4Re#2+L#&{-fjQL$~Mu1x0li7*P!gQuduRV zwnh``t5Fk=S#MAbz}a=!ev$ET6yntL9Wryo0ff zsSSsP!OP!h8|z?Kg#r#ZiFY-m_c!^KyY;^*sB@>QuRg*|``avF!^9Q^z`qu_GM>In zoohgHde=m4mPy0h1?~)1DNF2?+s-2)kW~(McQ_XnQax87On>arP;n|X*-uS2%--oPABz#3RaG66W*RCqht-c+}`Gdf0C(Nzg=-cWo!Pa z<+@ZA=8)MUrSXFyBI;xR{;d*1n98dcV%{59q&U)R^NdHvxCP`sSCL+z^* zAca|3Emr4fF59<1 zlP!H2x4q^Nqr9I10 z*Y~CGyak%WmtuTYHW#10-F7y6G4ZAbC$RavY-7tX^TXhcs~>iBy)RWb^7y}^++{pys3;WNUKOPJqm zAoiXMN3aN=gqy9JJ$J)uW;T?g5LK_Ru(*1NYkmpN~+OxaZ#Q6X{t0Z580 zUgM>wiQO*B6hTJi-mPr*rOiQ?Ve$k?Y-gbS@#n8Rq#pQv-2}8P!U|GC!aZ7XKzfqG zkSP!2RQ~F+e>?9^;>WSsg0YMhOm$EaKD0P=>^$I-e@@iBqTMm$DicFh%XJ6yu&490 z1LVz5kJOf0_Kz0>Oe*SvUEMU`C+Om;lQNPM*v2iz2azRXr)lr?pqD3r&U1bEj6KK0 zQzEmFy_t!4DU*4Pc4B{0(nCWFe2zc#z^`*O`BETju_CV+zD@$LRtJX*`}%J1uRAa< z&9+>~WLZk3*oj95k)CcgvFn~}YL^+ECFPw3W*J#Mf?293^IOc9j?JArevKQM!>e*F zZ>iJKK{;=fFkT<>ro{RON#E}$_IJprN^`gRmU&JB%M{d`SDP3*;F>7LOkJk8v62)6 zL(%5=4CigC84E-c?0~A@2zCTm>23GLmY8aGr;HlG0Oq3^q@e{4jh>Tu{RNezP*1%= zy0rFnb0ZCy+`XJ!y8}vdDb@3hRHhLrE1ZkW4$ChBh`){r2XW~11yMAq z_m<iO&|4 zpH>)I?>ar&Y+$xhURLR`+1cagR5qKPKwV>Y((0k)dkVeT+tafH-dmnprMaK$#ZSWok!>g-ZhgJoZ zMMhCXsmsF#=GUZJm|>uAc61zNOPZH33{KgT>@T)<-n+ldu<)+SC37YB4q2g+k1p zzrCW)T;}bn?e}l_Bt~KrITPcatH|0NOk4x1zu<3iOLz|;^ zb&i!-m0qD%xqDX9-yP%NbO8B{3TZZfv_w~(w zN(-s3@p#*RYvBxkulSdVGltyf@dGc0dzHVpEd3gn<%s~pBVMRy0t@;FlcLs7d#f9?L3J_RljwDV5NxE#{`vT;Xa~Hk z%94<}oNA}KHkk5V-*ft}`R~i(qDu|)egs9nLsfxhWbIk&*E*MswmwlWi3X=m>zj@g zDjCQqbnnEMj+F|7n{OwfOMx?ed-MbSq=KdwV}%!`DKU;6se{XmcS5nOj1m|hC#~5J?1bo!i;SNQ(P;E2E%lTio4x};6B9x z6Dil_3UT`=-&RYJXy@0LKg2{2meJDIUSrE7;DH7~>F5xtXZ8~bS@*>!UTN>5SDR+< zI^aCGmC4tEi`UEl&W$_Sl?ZG_lvsFDwTnf`Uyw-1)Y8rpJOgI;adDK1^#i4Fb3|qGz2fY0Fex0q8uocN{7YJ0 zVr}KEI)w8AjOkde1GaRlO%9h1j+filHG7+L4sVdezg;D^VJUgGxb*A5aq*+f{x>T&td&!^866T&siTzXXJ{aepuatAm_5&v56 zx;f|IbRH%=WoS2)=GzbOLu&JxZR~Mi^PoX{@a##x!`h=9{#ouoB>J43&BH#ZdJLdv zp3)8CAxE>kw07WK9Nu7Wmh#!V0byL&x^dIQ&q*f&uM_7@;qB4#Q}&j+y1CG%vPd`m z(msc%$51P$+tb^Q{;E+owY=_(5AH6t+W8Y6(Z9*o(JR0AU7PTdxVY+Yy4RVrXVq0! z_wU>10R<>hIx=rP)2cO`>yT|g_BJxYL4&+muX}u?rK)4x^K?q-`0w2Pm_s7fU()Vi zo<7~y2h$blMi{@XNPBQ`@l)@_ zlCu8n+9UuwzX#&CodSy`sjmUw9zKSPK45&9a;geJ{ zc7gmLy-C)=))`?dbVfe6XY>Qly4dI4AwbWRc%zk_T^yF3U$ zB9SAl(X+w(?2KjxGu8i>yQEB1e9Te56qtRd5oOS?a(JQV&WV4&utlanUJST2GA^NW zal9|H$H%1xxDs6<_3y_YS&j=X7HnRwSlificNCwt!~OfAO?Q-L^v{;sxw<~H91e0j zRweIZ`mbZ>6IB`4&l7ic7uL-nQ~&jINngBV#>2w7d&~df8mFr$3r_vjgS}}}?tfLE z`0dv3>FyT5I=}^Dl@rDUda5CphifOh5ZPcehz~rE*108{!f4%B| z{PO@wt0@w4Y_Ea5c_Xc;sHk`SdMBAoMrhTHj9AG#V;#w0ep8cAWfmL`mywk@QJ zJiM^0^Ys71-zvLyt&Oxc6jY5UTSJ5dMX1x~{=)z$&^vN&r6x~28FcG?lebgk?AZ8V z=KK5lN_KsCv@><&#?Jr2-h0P2wFPU#SUDE#h=72K6$C^GNVfq>@4cvWLKPBvQ3RB# zA|NGHDWL>`&`U%Fq}L>n06{u|fRs=Y65b7Z)O+sv?swnccfbE`{vZj-&faV7nOQT> zJTvRSfp}@3%Cz)!SiG4~TsN>e2Y8_g_J_9mUpe+WUGI<4@SAHMf8g~=+s^RvvG%=h zHmFnyQ23!EM=<5iWAA{Cau}lUGnWomaggedIr%;W|H zv$B3RtK;62%;B`)7^!T-Oc6e>QffP9tfRv7@wZf=e*TT{a)mX1!yK;y&hs)^zq+7| zSdVd-vDA*R$$L%-dO*KkHPCeQQETO_mDMy$+$qYro#1SE!{Gk?7n-)U2;(Z;GGGXQ zUyh2h@1DyuLBUDgC>?qe>jN)E$GpwhB#-GPHbS@)M<;u(zHU-McfCBA*y+$EoOPN{ zXe^#r`0@G;Jr)HRhQzbEyTC2imAvV!r3(9riOEnT1RuZxxDEe!kg8aDa1q6y4feS>!p z+7LT^1iTD2&O>b=ex7yg%djGAV;M|6ay2Yu^>G{BDDsMsBTvPBwyN*@_>xY|+nO3; z*!U`m-DXy~2RZY>^OYu3OpzKd3(B*jk1%6 z-Qky+rumC!TZ%4_2#bYuS`&)cZeOxyXEXO6JfvbgU{E}5%SRo(+GMq?IrpK0G85UU zZG>g0fF@_vu+vpLC0CDfNMAC8tjTb7U8HtYXKyUX&XneMswE$r6)cLJ0@swzm3fxX z3q?N-u5FYV!-Xg>^vbNHYCWz|Rs!3Jf?M)8lg*1Uk}0{d@!W~|O@ugJ>|<=7*pZ>B z`ZaYI&R)C>ryX-%B>|QBiFcAGHMijDQG52hZtNg@HtVpqmY&r>q_qvA2jy3W@saXQ zAfqLNf~f>cKAA0k4qv?lPyX5YG1FyiwmfY44WfWfxJg?@SNd%C8n`{nd-ba(<3dD- zMz5AOrPv6~%H*U+hj?e3M3#Agkv)$B(fJ9pt2$ z4SCdiunpIH%lNGrOs)L*F!?1j!b>|E&}R*+n|eru|zdok5g(l>m*Rke_X zt|e*=&7^R$9TIOmV|ou~p0{+Xu`g!Rgqk`0VdkEZSqyVVoPzI^ht&6}qok(It}|vn zB~5PIT67jzFvXNZ$VC49&CjNt>nY zzEx-jGopR&*)=bjOF3{`wKh8``er~pC^Hu9)bxE-`@uqYJo!6;yq;*S3wvDRvoauC zY57FP3iwcc>Z`jlZ0iNR`ukyYZEpKF(Z|o|n^g(Ikk?=};8-TL@swrAa#65w(_k~3 zve;zE2`o*<`);C(amuJ!(lHt3@?{&TLZ`|g`O5umhaCyW$ecooN2Rv(hRopIR+%yF z$sg#zT6rDc}jB*yW9j52^v7|5rnpy=Y^GsLsW zds6fbQU*23=i<>;EqN|uy<&Z}1xF<-Zl9cEL=MgV zf+0x3+8|_9VM~1;)noQTJDan6TThmYTSI5L;!#uVkcoq<_x29Up9FvM3dzx%@_zdC z@TInq0JoPx9kr%g?qrbET9X%~HOw<0ECxGYV-#z;nl0T90m7yye1?#~@QOSI>q3dF#rEO!N3vwku$?HasW7lD0p9mx!&Q2nk3|Kl|p771Fu#^#%%pj|v z-&D@xst|qWT$G~YC~b4VF7>X9n_1)mX|Dw~*9}$IXT8u4`(k0?F7cQaNuTA&Dq%bl zMorPdal?m+A~PyOqBZ;ON&5D>5{#qF=PjE{wLP8YFU5P(FHsgpwV@c%4JJ$;yOnr= zyt3qEL2^%L8_mxnwe!=J<;;g!oHJZz84?6q7{eg3^df$|Ho*efkuc9A(xxipm^e`>!=t{`LYVdh zb4^y)Rtqk4`7bXnN1JAyAkmgM^4%9N)f7vs#`^|X4u~3MaySka46qpZ%*w}F(@`RL z-SCxpXpCj2V1RAGjI;}XtWVCpp%n`kegUk{Rwvy0fnsOItT|DjtkW6i2ftob3jl|4 zma%`!sP$Sr$g;2BZE+81K^&_WQdHZgxh&8v+iOLXFODGw#4o;y)5WuV1$Vz!9|u*= z=G0BHduq>9+lEoBxp7=f zgb@6A&&(NPCP|%&*Waq9Y{1Q+X_#vITb=4!9X!l7c7J2A!R9*XqkwWRQ?YU69sQox zc)x*$%FVZNl~0?4gE<5AMbComvS4A_m~Xi%7Oy-9q_-xkH+2!gU514x`AY;Y4)m|{ z1C!@(_A?w{d%Z*{a2>K&1-Gy6#xgUvNAIP=QsFW}0byHxJzzQBeushbzSvmeD&CUZY{EWY}Uhx2H*j(Djt5sdz&at+i8H8-FWuSnaxm;IGi%7~+>z~D$y$Xy02RnJz(_^hc8(WWA! zElKr>*r^3dr0v}qgL_1FH=AJ}zmEkUDFtXulFWM4d?6KMY_PdjFxS+ZxHisG+rwWq zm;V|OZj4x(Ht^VGU_Pg3ZxBd>!K4}^_wp~>&*lhI9a#TjS z8#!V=7)g9j#n|1vb0>yBmH3SZWH@MHbrr+u`w&~z%K3EFG;LgztLM<{!M1}NWR9Fd zjO2U~*H@7FyZp$c^=OkKRHs|`>>#bF6OdFkgo~x{7CWujDiNMEdFvo{Ca|HSJXEMu z&E>3mdWYt7kYk6SC_%XW7WW{3w7rM+(M`JFQzjQ+N*Y3uPlKgeQj^B`Z#~%xoTVf7 zb^1A!iH=G6ZJrybSWiLio_iLR{xUJ6ncHZ}t|=jMS|FL^68h?tV+2Sa7j?V(7S9|XGupV}mRmbK&4Y1wT)eIf8WYf!vSk$KaHvvG?qiR< zrcZ;FO6Y&MU?zuyD2uAqQ=rbwdzxlD?v0&B%ycZ?K|sE#hm=?X3TDa9oSOuyKRc_7 z=Gdc=BR%|fo=0v)i}pC8M?->#`0<@j$G*$;eNs4nVY@*FGL-2(oRHCpu2^uC@q0xX z09T{)-D=*H_uRGMGV_Pi*Si)aedWVIHsR8Q>B>d^v4t+)0?G6%oF*x=R)@84#0h8@ zZpjVU(G!hPY2=yZ(WM1DVSTTR2qAML$j7!-$(rqF9Cm!t);rgC>!U-ZC(uCHr=qsm z#rRqw{zEd@SF^~ip$#+EDU+>#lETwdW&}{Mv1{ykHhAfZAgzdive=V*b@FYgPZOKE z9^k|Ftd<-w6#nbv$W+**b__f_MQtCG$|W9A`*@eO_DSyKc-2a6X8HX=mn^Cf`)$N5 z{q+xNYa=bL8tmEZ=o<3#xGSp4ff%kcX&L&qlFw9ibf`0Cd9LEu{i+cg7EA|Rp_z(c zE1SEh`6WI@-834EzJ@DZD3=cdfWG?xmNt`;>#Eh{kdP{=t8p`sQ)nsY{P`ufpfD|U z+$X&^Ld>!K`jb1?Gv+fL$<5A&de|Z^+>**!4;x)9ny;Rn*UibxenurJU258JDw`jR zh3n26W@lmM)N08o>#j2y>)lbp%T}l^A%R-N#L;%Gu->9OB=fxOWU{{(fOqnNO6bg> zc!w=I4Km5+ELnCG_++H-X-BwXiCr9sMts^J1_2$h^LU8zhQf^Qo&OfXiW%bPXdTe) z>^kQn+fbBG!73NK((DgG)`l=Eoyt!epBo^GaF7XQkLK1U{!vuZ`c6P(-Hby7okvij?$zUIDe3~a67%qm**U3eFvDVuSG zU_OSGvR8iNVmX`VVA;=a$hAp1*k02;W9Wt|kV0H;s@pU5cXHex`T^1u)`39_G2#hj zv6pJH69iBuWq87jK%b1L*qvKV-@5d|-54RR(GkRcdv4~@i#J-^?dD&q=NAUHZOzo~ zZwhU5MVS=G3s1dI$bYk#Q2z2>`dM66-8IgFduETAan;qSR8qX}YM*D7wqgloO!sY` zXzXyFeynkN0@p^diRp4Q)Ld7Ox~7d4ltI@YY7%E+?*gQHJESR(1pqaje1nO1@mb~N z>s_Um4l#yl89(QIthXdGh>0unu~kyma*%j*Q>uKq(0lEV@`jp5vI(k;Q$)X}Z&k)E z9}hhaVVC;C&vA49wA3<@*K-0bL!4B{EEVD?u-x7!FfhpSLw3czM}&+IRR?PWARUR^ zjE1yLTc#xtFev+)w{8-#QFB7~r?BjXVPY;HFOW1!R~_s#u3MU30jstvACcPnnv&0b zD!0#u>(rch{Jr>rD`{0h;v}JH%ENr>*i`R9u5~FV{=cyfYk32=wyO${LHFdm%5qj; ztIG=rWc57_ZnVA2XscCY#^Hq*@@xo0ZBAHT(raz9ofY+XLBZdXi*9+a(TD(78kilD zQpK+9FKR$@3fThd6<)B(F%2@Aa#dFl9BE+xeyr=v`-1(+LU>krcthnvcqBInq0NPQ zDC4%zh`&ldszenpLyt_-_e42VE?MTgiraj7{Yu{NFwQlvh}_r*%sc~KukrG>4hP32_`IhC;Y5YewcCIbgLTN-@Wx&0TmIta;!bAyDMv|mnV^)l*<+L4+Dy#wCT^HobLR=FS@-b15vgaZ6b z<+q$-w8T}lJJJ;jLvyxN6d&SvLiRPc89Hl#F_nokZ(z+ht8kUU`jv?H#}>+vfO#Z!oRBN{44>J1O{pCfTrJWu0S1aq>o~ z=+g7X!Id*zGZ<%z{#1{z7TY-8I3`<0@C& z*tNoyzu8BA(8q}qj2x;cqie9N6w8Ytr$Wn+9S-P&w&4vMM=I~4YTYW0vM_^L`kvn- z1!hfEJ9_`3zCaq~O8cT8hY0S9t?%sBE=%%R_ujvzecwM<&*PlDmvIAk$&8-GY&aa0 z_iYEw1jwGTT5u?Hcl_?%yYq`@EogdC@Q+hE&6~G$i=5lR1!XKGQ^e)f0&$D_cR!$e z%7|t$D&59T3J^_y?uIrGtw>|g{b%wuA4~#!bOpMVQM47c5lok1GCExomV1>=AB>#N zktfq$?4v9TT!9i6M({#!;+5f^!8itJlD{Resy;7UO9lvb2=@@;diIRy%HuF>)s65*N{5->yTD+TQmz z);H&PuAI#YWFy91EdGt}u_Q&Km^^0FASv&5rkxm(d+%pO&DB&QU{DBw>-7)zI z-4!5wYVDQFhl+l*9;i{;d*ABhIwT)d-S zbF+q9m~(1+SUBkFr1#KPmogjSyMG+dnooAqqyUAYRoN6fu2>$-2I&T%gXFaR`nv+qUj02#T4iL+g(`&Xu?C zm=6iBmCBbaMZsFG@e1|bd-)xG?E=#Vi=@?OQ z$*88i_J!hmJ-rk&Lu@(Z)!S>qz|JX?XI+|SDZR;9YwEX?X=zV&3m;#ijF*YdtX?6g zKaqR0?EZde>Kdsv7D52Iaj+rnK$G;rRmS{*B)9d&PJAjzRXWp6Xznz`y!t8X^cFba zrY+|l7eZMafEoYjYes{&?}-F92}N6Hn0?tRGI%~B;Aas+s&`4K`f$@ z+95c0d(9+EA`zf!iZu<+2_oOBlGnrCrr~8L!BSAm>lS6T-ZQ?&URRIhGiOw%Gdh;j zzT&U9XpQ1kXG__Y&cz#h7#S=q3elG2hIE8ZUo_pf7ZMXYLomcl515KPHnqQ{Ghl0G zD-YmqJ2*mP+&g`9Iq)9y-_2wFue@gcT|t!}_yfoNdk%g+`&<5*kNo{%*VTU`1~D*% z|9czS|NZ*^&J4ryjMBy zrfhe2w~F#uQBe`{>4bvMQu7rRW$NuecoLG&{;1zX#z0xaEN`Z?#|dSr>=&*#mktFO zDlrl5do!e{bH&g`Fa4oPocbWz z!UL%9c`8-8!jW-H`Il;T`63G*Ap!SH($Ix}>zOwpIU|rak!ZFUiViFr%*^e0slJ^a zRL==hE|_sUx~WNszGeUG=#kR^s{kONL<-)qUY_cdxp1ug25YC%Ykkf4Bo=-n>xHB3 zW1<`U#&IK4*U=*PMP+Iq6bDgwNMq3ki=&F3qJ;{AQ4ZZjvQs&!e7}B_Vc${Ac(PQs zm5IllNP?KLnI|LM=9{x`Jd~g@Bza9CgIxzdrdi;Zg!q)IJN<^xp&8bD@Ym5v-wGcI z`}z6tnN;g(W-2+`Mwk~R<{Ol>=-aXtqdb-;2dMIzVd%~RPF_Nu9kVznSgBUeYHdY_ zQWZHJlhJ9tu{1%c|13csjkyV7l~69`hCzS*_-#HjztuxSf@8w_xYl)eO=$)dDn98K z3c5TF`0`NalPec%W%|c7J0-oNIB8c6hiR8*i7tu1kN^HxX!mmAU3GiBP#u9Hwk@HXa6GD(4# z2$;>V|;ngrXfSG;!KoKEcW$8(TfC4qk-{t zgy@E~AUArk+M`;mvls_0L}hm8$7d?PmjlT^Ymr-_vYPtq^s5jI*7EQj=pxQ#28w5R0Wb~05@?`IO&G%Bdsd^=3P zX^4K44jJO^Brc$m;0`ui(`c4_3fW_cB=b;oP{a^%AN)%e7;C-n@#cwaZQL|HZieXM zRvr3~3T6LwzmQg}$%t+%s%>x-NcrxC-%6ti=y_>=vfQJ8%){Wc%NG<9Rk%E~lz zveH^=JuR@)g@}ptue5b_n(H?%r1!>C+P7MEG8VE=BleiK_om^HyQwlw$`c$sF5&d9 zqo|DXrbGBz*IN@T>8OlZnaAWeJjuSsD+2RQ9lAr{*cnCQ3vX}lL=CA+%sEAt$KTM5 zT7M1h`(Fa!94Pb9ShqZv_Wc*lC+=@(ROTNT|-z2CKn_h?O8<;viB93D~z3<4s3|}06IEN z%s`AF#Z;>^Dgs2n8yjvmfyQIjDfS#ceDl1Wh@lVXH20YW>HaoW+I^abkM;$QEGG)V z@M4B*wMA+tTTp$Pp|R8L_U))AnaRn?AP6+ZKNH{&sq5>-B)SPBDl4MyyOTM#pUY3unCAO>=sFr2w#rv5x%mE(dS|!baA}NL z#j;D-z61|G_`y5)3`YVipM^Gb3g1pFl31C3=+GgE!tLcn@qMbP3w1;5wTF`K5(2J# z7eBQ9UUS;ZNpyH@`}zBenA(mcC4j)E&}?64ee#M*U$w__Vg|sP>WaCpKYG35y?wj1 zk_gf&*=O}7LrJ=zePr~Vd_LstBVm*ags@x&Hd+N&&NNy@KOqjD4ug)5JRW)^e9e+r zfSk@e5V8c<(l@DuI#3K8Y1B*k!%shz+~IB;d7`KHzId;&ac7cL{*~t46H`+XpxgLV zV1_DPXVOwq&XER+o8Y@}M}Xh<=_&`T zrA@L%uB}LwvlHBQMz+_)>KpLh{h-g$`9?3v?dPPf9_&Dr&0O>SYXG`Pvexeg_+kYB z!*qx5#RP2OLbl|(+^Y{XG|5zoOA~XMyakTzFjqH3TE8hC=Ol@pv7Z}iC4bVt71?#VtM1ya_NLiWl7Y31Zevvbo$-H~y}tc^ zM=0DQcb-ogP{h4%h6Al5Im!m3046G+Wc~U%t$RcHj4S(&XbHu2j*gDb^|_D(y2Dt7 zEWdVkb{=^oWO4Ef=G0~XcG&S3B+)Y@4L<5Z2^-NTk5ok3Rl9aMzE0YPT!282nM&kd z_to7}DKKVDcccqzqKqcAFi^=l>$;j#T+AtHD;G1+7w;~IqCtwB=)Cf3?udQX%6s;I z;gLudKnSR(;a0?RTQut+5)Uj7JX^^P3+dcq$?T0k18Gk=T;go!a)!&&FKsBls zIgjqBNMcAqG2jRcLLYuI+ZP^p8x-}eZEr@+`e>*@;S-=bG9{9IDJ{mFX|kEWI@`SOoH+dSD9bBC`Sb(8;Y%0~2`3wH``ARCK{So4E5! zu%;mrah713Gl*CqKynOv#bmH=2~w#I*uKj4x8^m=G?UyBZZ0m}-%VLm?sD1pbSOA7 zodIe3szm4YR7^!^Wfzq|IR4K#iRLBG z6?fv|dTmv)CSLY1o9;AO1AuW{V{BIDN9@mYi$$eOtRgqRugsW48-NviWr}0AlBL@} zo|bmMlk29%W7~3pHZwd6a+^0ATIxU1K7EBmod)G!FLdj#1W2UvRO0aDpkeHEA*)Zu z=6xS^-t^yeSrzj=5L$1+Y`C9Hwhicw6{`RkUFp3MQLf`>>=`Ph<4UVhoo-w-)+(A% zu4&WzK}`cz2Y>nPEWo*QpRRGh4m|K8!m~~tKmOS2wgl(pllaYzWs(ouWhz@dueM*+ zvIz}r_U3|Wa;lha8|K}v9t22rmY$KE!}p~71H^N4|Evgh>Y90*?5cf7oTM6KSxvgk zb@%&R;`zT;A*U1HS7Rc}lEoP%T6wy?LKiSxm=7%yzC}_x!pkcT;@^it4K`b2-;E-F zxy1ff?)sV~x&5U{Uh`sEuC9O&M8Om2nR$8Fvl<)rzTKv-=js;d0E@3C{>I4{B0dyX zFO%fvm`VO!yPjbN$VI++&075~x#qrkMY%0){|2wIMduC>x`j(Q{agKa6}EJAsH><% zXzoFB0K(6A{kqb(Z;x@MeE)^T=!N$a{)JDQCGy{}m`*&k9T+aJr-qhDGr?V!+vVeL zFDXX+bzcYw#haa=4a~YgUi{`j-(-72R^TBPku(3fu^TYK)?$&s#!a7!fn`J|^faHw zlP77KUKgW|x0@>)Ry@tnba{_Lp0gp!z9SinFD0Q49R zR|1CN(uLxBl`u%kF7Rcu_yczn1kHjpU0g4}|LxHI{*A7i+uZApj?$^i>vna|_d#QX zPQJrvTxQ^tmL49~)!dES*6+WwHNTGopr#67Z7cPqd3s4ZkKUJ}t@L`%S4_>>ERHr9 zlskP(wV`ir0E}ZwYBRvO9!8u`_Fj6$(X|RFoCw=%Im>_Bh{js1j4>U}!ogv0bt^aS z#EBDg{v}AHu-6cE0OwXGPcIeVa9g#%IdSsjzZF{kxVo6=Xh_?m zLR{^}B)fz=srgEB--`n$=N=VPKG)Zi9+mJS%I`)>Q?g-?N!Cv0c{4^JrV{Ag}U{b|S_TnGM-fpb`ooUwttgEK2o`FF;$4ecVR{eVb zrF(S1DjA~ikFRgP^^bY#bpuBs&u-U!Sj{|ec6OHEo5p%s$l&hX=Ky7V5~>sf`j_KA zEjoMMh+iBH72pAZ&_H>|_6mPVw+mO8XIzD;<@nb_mLJ@RF9e)ViAQ;27cN{7wrDwJ zH8Z_kX7Qxq;11mS&%>OmB~ORx7#ZblOFN+bP}_J*9MWcKZOttv!hE$1D9`ZP`sYEw zdw&cN@FCd*YS+_Xm-v9p4_vI&-`{_Kae5pHkf?`Ve*b#V#Ns32Z4ltl>FXbbGC-HE z+EZ3$RDi9`l}pNm@CBx*VfeokCNm&2p~u5?%t*KrsM)&LX&tOlvuu7H=r?{NILJTuIr z5dqzsG#bE0aN`9Q9TO3kVmsom!2Qo}_5$Bj`mTTbwtw;XlNj*x-akJ4^>V(OKcIWt zC^-&GZda_q;jMiMWb+5VicEfelYwE)+O5tSa8x}j;4J<=_M*@0vh-aBWCB9}6< zT-W-ntw@4jhCZMM@MpzpK04*~{_g0M)P;E7t>hoq?0Ndwv5~&B2{u+Z(bMHYo&Z|pSSzsA$)}w5&+GP>q8vpQ~>+)ErFgUxQN7}@u%G|?Zw?Q;8Mxkxji1Q!DOeEggPm}jtib)6 zmQUO`^2tN1AuKP4PtOWv-dD@*r3*PF6EtS@DNc|H2h<< z6aZCP1NyeC#We#**;tG|$`c&dlj&Q(KXH_S=6B0KXb*3mi;Jt<>4$@`>@ z*>fD8Al&Eh>sI-%=AzO*=j;2H5|0Q)TU&WXjL+tpg&&p+b}RIC>&~vSHC=Ifg&1uK z{52ZRDGOyZBF*al{rl5^>k5g9AUxl9=w0;0M(f4>d-obxVOuGMmo*=E=D*!2Y(ek{ z71RuyApI)h`%%PqOqxJBq}roLAHf4V{=LaTObTn+bW(DJZdc5d>zHu?PkjyysPu}L zu>O$&FK4R^GfZJQt@?JS6a?YI0~UZexuY;7eC++}UUv4QjflE34tPuO{e^mMORfHL@Kc9P?DXR+}U{SGo?hYIg<2}2cwFp?+>LmlW7F4}9lf+e7kpLN6T@tp*uzRExLBqm4A?98v(&8A z-P5(1xuTNMpq)H3*fCJK79AL`M$bqxsJ`#$kQ-Z@f8g%jyFgDj2mi^J5fPYYdl=^q zSc3uh&d>>9*koj8ivK{f{tc?Iwef51?38)Dr8jl|s9cn(D0$%;NqKn6s9Y^1Zux!E z`r;#q-j-GS`h;I1E`7H5O5^_}j&t=A5Nd6MIKJl$LOo9C?_gKk!^Ry`j+0P$qjSyt zlfJl6Y87(Av~m^^YtDalK%~xE{s=#YNiOP1CS4)aAwK15vO@Gk26!s7fQ&(z_7M4$ zsgbxsGx?46^;?R!d&vs~(~1f)qXT;#?)U{%RUqicGfDWepD5n{!?<&^v%Bg77-1PF zTMuxBVN!&UP7O8USx>`H8Bq^+`pR>C!2I+hg4Y$eQlj>xn)#WUpFfAZI}uu5PFJe#%OT4MWF0}v(wYZNJAt2@bO!|K-T;}sEKAF%0v1L>82EAvV^UY{Phv?z}lwf zT2hqr__}8LrYm}3D;aUv(clJ~lcYQBc~;ljh=Vs_2gN<<4h!6Vzk_iuEN(x$e}=D% z8}3w!uD!&xz0@%@B(0e{cXY;D&-5hEoVBWuYgwy$$7@OsQ~nqm)mxlL_!h!uA;39` z6;Md!(X=uALfyBf0ig1p;4*2G4Mr(%JUL#73av@hf`11}6hb_kwxN!Zz7sg12YasE z2alq;g}>!|3xW0DdsBb6&&5eMYbUn&v|P$7g^v$hdkyY`2PISF0v}pf@I1ARIObO2 zTVe;FPaGbCXA3GxeTH55Wj!Su)9b7k7Z+9FkP@`7>gk3%Qo?rY1LEMKWX-V?LPg0J zv@)fdXGs%e(<{8DLm=1DV_pN740IzF1hgHnYYXDq`7?>h;O2#-u2HbL9Zb?5cx7>`|awNAk4rkjUFtK=@Td-7m-WHgVPcL7=jef+Hg^D$ASs1E8ITfd&=gc}d*FMQbi0x_5U zwQzht2WVWK5T<4`ru3a__qyR$PDWV=da%L;Liliz;u#pE-A3F8bBswmH*zz;rvxyowO-(aT0c?!=H#qv;HF&@7g=(=wrdRu9}kovI_#O1gg)R0F3y`=ELo2<@{cxBdeB!gw-yeS1P^q?PynOS7d z!y6@My%uB{C=;_^Qz&)v~!0my`P;k%V|U7}wpAv^{wYoUu!J^OT8DoYt8P zXQ6iYK656u5R7EWgH~xcsAZhQ$K@ykIRcI0V^6NuMp3Y$EljNWHkNtTIO}~@J{f*e zPRTkSZiVms*7l!~<2&ssDhU82E(~CLR&a8jL5ae4zA#3T`@friH%@;F`cV|_#CqeL z&cJ|JOLMdHkIYb2U|`@iNl7Jq>7^f5H5Fbh?hXehACveiADsMX-;0gbtn{*wBk!&{ zs-_lcJk>UESF@0v;1Q6{CK9=2YJ*<9;1L$SUt5z4`rc-p?=cCsxV%gWDXm-nPuRKP zojXb5?ryFz@tHYGDbJtZO}sSH*ZAMa9jG*52LKY*Pi{?lc$pic?2*5EyIiQVi5}^~ zlW*&YGNrNJ;u}|`t{D<)YLwXtL#d?MRck_o(Zm8TGN2o1g_diN6`g^8!ucOCm;a?x zJ2Rb<|FcTpT2mTU%`A5AZhhtoc0lG~*K}L}+D+*wZ!E3fW+oXy!cuOrTCch@Mh&`kvs zlb)pZINbMD5qk;&O4_uITwQRrxXmlT?^fy%$6-p+mi36m`9)o^`##kpE!f5+f`>($vNm z4)se;HMv*GD=GfvpO8&{1CW*mnxMqX_|;~rCeQaF`HM}9{ahrrPwZbh#@?ka73_+( zkzva&MsUDi*f}d>e{(QcvutoD}vN=B~{> z5~FPm+(Qa|>ut#fjRR-Fm@)xB*J^${*QwOOuz^t_detX0P5wR)((1M5p`8=_`eP6v z|9m@yP1L|Y#qLk*R}kd(JF1U>;r0kTX@ndX0#B8Ht)0D#?}r?`5qPgO8W*0wLqUAf%$ zh1`1vWdDt5W?k#1STCeA`G~!KvEnsCjnLViT8G*PrP_Mc;lh>ZnlSA|$B z|98^}XXXr`t8T*K`HUksAKlI?Dt37n6*bn!U>^*4^FY2>)7|}jsl6g}$NESt?uC$b z?<>6o?c){ZdEi?I)7EkA>Tr!ImM{&}Z{WFhT^F#jfOLr)mK;5QKJ_3IQ+EeU0v69^ z!X_nTVoVL38M=Z}tD|4Y;c*z5O3ZM=U+CL}mi6HvqB@s$VJQ+`a={H;pUz zWpDK-0V~9#@MI~a`p(&c@56OG9lYpLRgIDvKZ$oM&LKUuomx7!Ng+=|@W$tGh1$Fu z%fgT&)7idep0^6R_bTEol~2U!nV+yl8jl?hz^OY5;t;RzXq?#4B!^(^jGhJAn5 z9C8nW0U5$$HG9$!q8-gEVeq=k4ISXRqby zvM?nc%U^T}vKh<>0Idi6Fb_(pZBP#aU0F{_?1^uF5wl8@p7_9_=4=Ab;ZcnMG;OKp zQ1qL38M~}jbZ);a_)q$rHncyTwNsj!x1G2E_ObRFXlpNm|2W_2VF|rGSLDE(%=Mtv zw{;;B5^~Ru(_31vs*T1QBMw_9f3R6=^l2G@6^!o5fKGmlGS&`kjwm&J_87(-)m8sb zqsZ3{fMj8A1Rq_+nCsmoSQBt(`_1ipm`JRyu0D1AWZt@v*|xvR=F)twA(=V-)Ax>+ zA;T2Dg@vxkEmB`;XAjb=S9)T;S@)qYT+3&PF$EoKHni4eKfreDyc}$ggjmUc6p54y zoX-yk`%}g}Mga)vWX>I{ChO1WdXVkpIi|!eL;86b$<8W)UZ$Bqz{AHody#I6F;Cad zs@eF)l~|O38MCrm0-~X6CTcH|pUBDm=M((sQsWP8!)FClk`MK!xKOM|2amIXxJ_uP z3w$X4+Lnjy*h!E?$%fBK|5C%5SJdb#tod!BUDnxryc7O6%clCDdDqf8U%@yaXvET{|2S#?(8)wSxXqk#+5{XCft>l+m#Z z_O66i)lj(#7WKbKWtxNt}O#n>i_k?!+?4RWiO$ks19EZbLz;UqotX&U!YEZpx zEF)k(NI$EH6Egkq@GU&xI4JE$UY{Vf>)Jf7C74{K7D2mpML7OQB zC-~X2r+Y6<^ft@KHH+bv>iF$%?y@$W)ArPe0R&%5=RSjhqV_v&+bP{D=CiEX!}XOC z+cI*SincO;M;1G8;%h7pUZzftp7KIE%11zbq7ZywsBJ5?>KzKD2UtcT@(`o#XKilb zk+5N?+@s$YVtwdG|26+$+55rPBVW!$$7=B`)*G*K#m(!L$+H?3yPiwGJ<+f?r6i_p z+-M?m0^B9$Gd}bt@(b`I*2&`TUf1UH&M?Wy=tMI|Q&#iyam5}ea$FsG;8Pz*zi#%* z2O6$a1YP?wP@m9@ilUjg4O#?%KI1Uv+P?+DAM?d@c-wsV2RFc&^NB=Tdr!aMo28bs zx8=U2%G{KlA+b|O9C!U;K*doK>6V8rWAwYzMbUO7vt_CTayH>G_3mN7sP|;Y1Z}!7DfCU?PB=!0k3BaIr3>&UXn4m3148pNT z`>p9@o_$5n^P3hK;{z%_?(r+)M;2kQimxB@BNL_*3D}?h>3M z>|GB5=UR7ucsFUNng9>1ddD1%_j}FWeML)s@%Z*|Z}+}GtO?v^=HaSPm2 zRj3O++-i)fWljJm!_>K@iWT$M#~DMDF$l(FjFo5XZ~ zHB$-0<@bvF@l9PNj@iY3BqxQ#e(2(Ne_x<6Y!CMXytH!hp7ar4FOdaZb(6ULupxjJ z#=vkZFUnMYALP)-0GG62H|!^&G*ak+uv+(zmyN`X#`xLOUd${)p>V<2!y4oMH>?y> zY?QXdN%GDi5>*AT8oSnbSc^)#CZwb{CH&Mx%vB*VL%`KaS6(1>tqSyL>8oeFf1|GO zUZiV&tOn>4>UdlJPtm;f^CF#!Q~vU6fU%~BeXt|plV;euz5Hjh0Rb$`Ol1>tdCie1w7I#9C{r8jd4!nL z#kq^vUy8U}fPs98Ucah%SK8c155eP%njVix5>F6cpN?=+Gg<>l- zJzmY!Z(vAPS7*|VF-T3uo1xpQ-|?v?;vi zn-nYJr5~bKJKgZTYYX#g`rUV!D0gHoDTV5~FFcz1%bz<=$%|WnEydqSM&hsQ8=*tc z(wnOAoIDMB?FEu@TM-2k4@c(uvx`)3Pzpd{4jW}XYYx;YHz-plI zvw~yrD&Xdj*?TpsP@P&GN#4LHHR4Tk-Z=`*wOL=50Oaph;rlsDUt@1loAOXTc3Jv> zdWa0K95?@&?7~>4LLrIpnm%(;mwmm50bgnOUKMVj%X^PFJgr)z!s`&yN;4A(KJv#^ zHKSM5LjX5k^A*>;#*!5rSL+Z7tFY~y^npGyfD(5B5%0%6XeCSd(r5s#j9cC?Z?#I) zGRMm<`$T3_E@7H;>E>~J|N0fiUdCY6@aS0b0@dwpw51RKRRJD119y{GWV-uShmrl( z(@2pTl;%UOEZnmgzyg&7h%^~X_s!#XrTTXK5tgWcel95NaWWAie!?}RUSVxrZHbca zAArEv_2Wtkj11gjqztg~A3VIKd0*+H=aHG5erGArc(4zNp%`!rad)iJt-gTABlp{W zKT3snW^)2Qf~Hd$gG8w2;_9Aud11Tb>B$?r!RTY&m&S?Uvt&+zbWiBCP7eu8yz`qw-T&T~FmBLP}oT6`dW z>sQYe1_l+rpCeCrKW8Wv4Amu;v9=IQ$NN6_hAb;YSDx1dY}%$Epb$wTmp1l8HJr>- zDw~3?QIHRGSF@MRww+Tp8E|%^k)$5CKuE96<*I=%)@06M6sqg_Sfr6vA~4U~o`ShL-BWCvsN=iW(fgHq}$uVB$RCA*)ugtkT( zf&fY|A)}2n5K=hbnmrRRH`V~>&9i#VAvxe@q*~?oe$Gp*>gX*n9+j5(#6oY&@vRKr zo=k#awlbukDOLn^skyD#%O@Wdqz;YG61oR|@zEGQHUDj$_5fWVndo=8sF5%?-x@4j z*6R&mFnE9qm+=O?@%+xLsIuL6X{P{}T#6B*jS`dsS!-}zGCGyDSR8CSm~l_IrP)Db zWzd%>gNVH_cHz`n=Btiid{J6J%R`A2V}j+?jb$mQe;jNm@AAl8u`p@s8{>&Tns=kdv0E0a@V6{5Ey8t6z~3{Aqm{y7~vH z>WaWmXMxF+X*P4d@Y}Yp!8{RjtHfGBN#~suVL|i%Q1;$YO?KP2Fo=kPfDI53up$uY z9RyTVl-?406A2|$fzX=>C{=~fdnY0E-US8ey_bM=2p}LJ{qA^v=e(Y8+;Q*yo_`z; zha<_e*IsL`IalevHF*uhEdp4HO|yS=-*K5a+4{Kg8i=(d-AmY%@IwUfX$(&LmqIF? zKVHeC9Qc_-a?J}CoFJHskbi%s@krh3m_NUTUdKLnPtJ{C@MWIyshlkMBHvDe7bXF# zx=?wOjQps?2othza~X6aT5)aU3dmyF#TR1%ATEnv9bec(t~`RLFs1X4iIIJ>n^B~Q z#~*~Qr}P6)qj@6IZ+_0-h#PRE0u#Lh$fY21gQ)BX;u7BaK(cd@a6>+>3a zh2{M3BRq$xe=TTK32nF+UQ=gWMG0&JD%Sf9tY_*X}KQxpME^n1J4rc#AiT-|F*i z8`m);3%4>TmjOXpE%kzkn^)9ld1SGY8unlk+1w`)w`-2uy&=x1?Fml_q>ez>%q62S znD{hN-e^lptsEEGqV>hHZYKy^V>gvzpg4cCXW092wU#bP1_wnJ%D4#wGOTC4-3~J2 z{@U=DBJ!+ntxZR`j)_F<95)ite<&VtG-?fv&|r6c>XZPNpbM_GEI7FPbhP`gvMoib zsi9xqnD;{iIcoP?+uQ3_vOFf0{*1e|zo$I>Uvq%vTaS95Whv%;8E?*e(1w!n$-F>K zt@iTe2MJ=U5WtCSZ*Pa!*C)Ms^Cq4ld94Q*IsibI_|@jUjk^$2r8>2sp`Oa(q`^fo z2sd|kj=AVI**fsQ1Vp^cYLZiuJfTHW@$=}M(sZ%(w&T+DJ&?E|d0uqR^^fW>d0>kK z_Z^B@`SW8s-rTow(Fu<^bXd8W6q;EJEn5g!#lC5w8hYL7A;14~;7eZd&|qRs?ZB5< zr=LhxwY*xqygq#DiTd+=c4=Z%j7~UyUOU|0K;h1C5r6sp;Yu^EejEq7eSU2* zgKP2(4Y=a~QF3rdKIv_$hAfn@?UXGnl=huXi*fw&iFk{8R}H{8aUE52&&sVmI(9dW z#3Hrr60d-mH>gSpnM0=q4g?tbpEVD103Y(=Kxn*%h3O^!{3e=t6gm%$3|*LeQ;_}y zppM)_-PDGHuA%*4b&wQ-G-P~nTHT>YvYzzWS+nnz#{!1BHsY7;R`2H^mFHW#PEKu( z4TQd=Er{OqGAKNbryautrT%E7xy)oKB^>A6_xXs=6tX8uW1!UDE{7ea=D#@N0LQlu zM>RZdnD!9)zt*<@4?n%oeMPaW*Mpkk{Q2CSfSa^#)+ZugujzSF{)ipcx8WYE*Hyq9 zIJWt-L!nSM9-fg>JbuHBL5I4*(z z`8nYn2vM^+U>qJ#SsD~N5-b!E& zClhkSbnPn=)X?)ks~C`lp3;a>$BEJnrPAYs*_2EqefF=!;3_6+8MpI#`07XHO z-qA4{%(<#Ac9pUe5OsakJl}g{P<@zrZG8?%{h?#?>?J2mpR(lkwb~DVr2W;-R&pj zYxLZ1Jk@vW{awidJh@8<~m zc<%tMLGj^2$a#%3KGi+AX=~kM63`-oft0QI>42BH7~p3y!f3@7gD#@ z=Zwi@V{W1?z`WwySPRxgH=*h&+d47(&W?@P+}EY7_r*t3a!pE$V@9=lbWQr3QS?~2 zHS2wZwgOC0yeSs4s;$s0$P(_?+1fKy2p^3V8>64pwZD2DZtAp(PgAU8!n)M9=BF{e z8wQ!Upq7a#T5p$f={4C#jLUt*iY0e-W*4m1>thlJgahi3tiG@HtW7~YIaeJqhB7r3 zY?tpUEsl>dxhnrTN`I*h3~Kq&2Apy!40I= zx_GGg>4{j6Uq=-6Q7x?wUxn&@V}X~K4Rr;>&pJ|+FqeNCs}h2);zm{m&Hx3SUva0K zij@ci4ke$N6Y`7v_EMzpe&^UL-*<6w%V~SP!jYq_V*P>KUKR>7D?(Pjb!n5MA`^T9eb`o*js?Ch$Tw(4sfLWY|dhr2>yPI1!pxj0yw7z81L8tQ1r zXL&NJ8K`A<=kS%=&`}HKuvbv!nsz6)b#|%k*6BhcSW5U4Q>*|VtD0{#IVd5d>o@vM z_QbthwZ7eUC~-nDa#8r|yD=|IZp!%UR%EYOJ>pXV`;n!aS)IxE#g$b@TXVzk*;A)a zN~SEBji?dg{6i<^g2jNhema*mvMd?+(ue~#nI!*TT$>hOTIGe9Uhk`6E_WKi3+4i4 z3IBeV~d%EUK-ga#5(pun<;W-cj5mgFqb&=W@-jF$5 zt4*Fvj)O{p)o{%)hhJ-4SRm$@*|A8UB2*AHn3y|!IedTR=j%wlaF>vr7>i*RUK(aM z4lA>wVvCqo$5S0XQU`KXPsJ4SZ7{%U^x(@)kM!dc z{S&SD*Up~X6uZzPEnbG#3Jd%9m(#9k@IYx!y+WHG-jBOz?n3Ve!*Q$T3=SVl9}NI` zMFJdC3BPpg;@Z%~_YySqL3aqo`kq{039QF=_3vahkJ0xux&~-sYa$YmkHqVzFzKZ^V_P#^faHUY53lu3aUNnF zU68igCN6%6tcI6g&+^51)~^+-lfFAJ|GHm@9OB&eB3qN2Yd9ZL!=^ZCEWNgf!4Azf zld@@NR#lC4eT1Lk3kR9yW>dmg@jW@P4urs)?z#w_(gC2b7Hs~{&wKc1A+vXQ#0CEk zqMWK1`hN^=1hefhvsjb0yxUp%Q9{%MllQ0FCPRzYk6}P!l|_3$V#Pw7B+To5{;TJo znJ9^3+iU37`UD?=><|f$dl&RWz;)qf!fu++u3H}vW;u8UluZ2Q$7)68fOKj_cJnUa z66BTBKX{6^Pv zqFCY*)@?8AkqAwYS@*4n#3*tqJ{7H|z(0CFvROOF@&qYBBtnbx4kce@%3ZqriQ&lC zlfmsntE*5?7rfugQps_Rkz*s2DI!Wg86^FsJN*Jy`-WMcB^7%CpM%)T^k|c9RWm{s zGC32)x1l*O1na&cC0|Iw-+79?JhWJGGV9vfGTdTL>a;pCDr0BbJd#ulfuQk^1hyx> z*~3=(N4f3y79fKwrwfja@}kw-1d9EZ6dnWkyg;d}umr2C|2c2(!#~`m?G;|H8yZ(_ z;U||w#MivR^--%9#%nbDKeRf00Copp@KWcICK*d<%5VF;VKm0axS;n`WyKb#xhT<6 zk;{M&84WWwj7~a;rzHp&bN5L7582;5syGN+H8;i33mSiXuD!t>ptz1%nwcE9$M*;| z4@LSjh6}Q7&R)Cc8Ig(wqSf$0ZQF}BRlqH+mKF_o){)w#zsKxV zu0*!OxOT8^Jok)bt;4*IIN@&wuSD=q&Z~HZb^P5bwfABBc(tzw%`q0ChDwMvJ@wHw zpL(2O^cgNj=_!S?+W>L-D0COqhvMvBb%@W1!G5n8N3!XCoA!iNqp5J zgR!SG0L-N#=fYdEh1ypeMw4rMA!();RU1p3#o6Eu^u2)$0LDCrba22{oMMLDIw!}r zP87v|KNxkz#Q>pyM>jU@$iq)e^G(kv#5*&a4WkaklbwC*D8X)6_hY>^ilDE-!JjqA zxU*=+KDX8hwz+l%(f8`P37MJ)?Zk*VDb*FzuB+hmWO-H{ za2U20cDMOQ?$g9S1)(*j`_p^^ zwU%;RUf3vkq_ZTLj(M&tqI^r@%vyIhU`-22Y-U7RhqoGrpyuUUom-r#2u0-*?NmqOGAt)%kUWx<{UX6d{8Ry1d&XlnO zGN^gf*wKli)$v`Zs2i0CXDFAK!Kc2uc3YF&-|pq$A`g0jv`tML1YYtFw}JUkZF@Bz zvB)ZQsKR9P)PlmloanjiUh{&Nh>;yyt4Z+6@{#o#jj#E_yXgV2hb zFuNhQMrPmJb1ZnwXOfJuTDv4B%d&Z2FqmSjOsOA`=l;7^-GwA1ZGoXRm(F+(sp;!x zO2qL2B1lo(4N=cqE3lO+0(gl*bDyDCMO`~A!)kyngvzYCyqT>Y$1YYoplBn-IeVBR zZm_8=lvy6ST?*&4TGViZLbWoM`l}FM2Yhx{V_I)tzqGPwNzl3e^&|^|mUhD8pDcBa zV>K%mZ6 zdJ^FuKdzJpzu0F!bXa$J=&;Q*%?*vfT>|yf$rBQ!viqz}T}U_|?>(#nbc?RK6v)*; z-^pRi(xf44JwxvN_QF&C7-xmZJnxTP44x-MhubNw7Vl?G6YmEcC5QPduIGPld_z$1 z`ofF8{~8Ge(&fl0H!{XDfn~ku#3p?i&{2(P(gGc>H)Qk$lqUm7F+lqITkdFS0#%x< zO{4Lm_Mx%M4?x!n`yh=|gsXAmy9=)sfpB=gG*Py1LO~0tv?x8^o)r72 zHCJLrza5~>TI{!PJiE4v)DhHY;F-E0E6)G?%O{^af1=P!Kws+3dd9JKC_kS;CsHaB z6P+tHn&T2Eg$Wbe|HMSu@Zrl@6saSnvbyfOOgrUKo^Xthx9?JE31vb>MrQhw>BT&J z9(p5(J^a4#bxm64%PAp@!Yd6vB#I%BpfRR$TplPfu^8z|(Jr^1O!07e0v7Sy<^Dgd zu#(TIs%opE97b6q{->np3Nv%&=g(K%&Wte}Q*vIuLX!=I9d_$iCGN-K=Abl7c3()Z z5_lb`3m#J9w2r?oRo~UtjyMWiY71<0yqTs{&X8~9ddas=HwT!Q9-VC>^3xoo+NdAB)CkB0!q$h_>KtLTVFxq{0RoYJf!`5DmydNs? z#wBZ0Nr4Tepf_@39<2GhyOZxP%rOex8}s}vtS96NU4nJSbeo?>6Pc94{rw%rm#eE>12Wu^{nPv&;!$HkTFJbie!ua z-!ChZ&q1S~`1pLuGcom&>7PCTjamy)!po<{PAo*oh`ri9ukk(0joQ6I3n=W#lk=Av zUwAJeEqy7t=EnB)qrQ^5+u+Z>_@T@5VQoajZp(k9S*XHSUNAN7%!;EM_-_YY9ihQ@ z@0NT*dqO>Yln`506qU@LUbAKE=eOgoY|2pHE*47S=sa%}sr8 z?iq)pLj0Muqd_ek=D-*W#_10Y%yn>aUA%AsYG(ExG{fK{V<-Zt)Xj9gUlre;qx*q5 z>3S?kTaGEMQJd_1$NN*?$jE5u3rtI^a0PE zAy`RkF#KF~aKPrn2`ThUoeHKZPm7XLL=Bu*RaMpCtx0SGj@HQ=a-9<4{aw5mg9P*tlHb_2|{|$Y!C^a^whS z5a_fipOE0nMQ_i2jXpynjTarJ&_859?xeHnFS>5vV)5k8q~O?b@y3!kw=F)Tvc>eb zElo3Xd`NfoG)J&R#hG!f3UXuWyv7mV;=(X84I}&)n#do>-41&tt{l*!J}G83RWq9C z7DcbhFKuFq@ka{5>yM6(iq8$d_4UQByaryWSSKE#ukqYoH^t5Cm%`-dhk0#!;w8r2 zMyNeM^ZlxjgN95qlvJq`i9XLV4?9pXRL*eSELWu4-9n_fnF-R=G@5k2rB3L_xd$Xrw`is6ej zf90;K7Op01z>*(YrN2|A%x;`BW36rL7v4g3l|e&U-TU@uUz#|kl!!rISpiJq{4@63 z>`xzG_I%^yRLl|QIIx>tS~O0cCa)o}s_vwg1ijTfQJ%I!-{se4MiEsR)`#OYV=9j^ z8XS30eEZc$$B~g?Nkh&gn}sIRJNk8rZ9Kbck$Q1(=x2y$@$-;pRzsdFv~>2zLOsIS zUwks$oZ4cdHBh~gUXP^?c9~@3a{F|+@jc@K4D*R)+EF%j&zCv7mqTPj>v_w6Uu5}n zcAGAAx_*UZ8iwK&gfoO*ce54R-TZUJjj9t}i7xA{lb%S9;sY(WmWe5kzTEe_zxtKN z?M0xw5=ngv*>+4Wc&{Z0^=THf*OA@vqLk;e)3PiLW)+R)-En-Vj%2pNCbNa>^7ui~ zN4#I?cuaB0DOmEb47$ z9~C4y&P^fk;X}PQFDMN!TnN3O{uG(qmml1}qEl45k}1!L`F z_IO$>W;(Mv$l-$N8sieYR)$W?lkwG)e#hZ`@9TsT`#3b~wz0?b`b-{;PJii9l>@@# zZ9nNd@!%wd*sb8CF!~=5zR=3fKrTitB&O15!dyFe3i z)_fAnLX(yKpOCHFVxrMSSmd}nFfmeS966lXJvYG5+x_f1|SA~BM>IHAiZG(9fsQBeWF>kzlCnP3O zrMy}g>o(W|&AYw=hu?m`Ih@qcV;Hvq^$F|pSA~pB*Gtb-eqv7vY<0CkSrbKb63=)x zOB(sV+LFGOK=aCv_4&Ex+&~GG8>2(x2pz<=X++5#0}~8j7}OPFie#d{UWg-ZP!$vt z$UL~p$>CZnyCx_htHp%y)4CcdGb(W@@!G2+`JxEjO9-q~5H7pyObyXO&>8Ft>Iep^ z6{VInR<&&;Q*PwL&wQm_*8h>Hy|*hL1S5Y=KSo7FjMx{q=T`0Zg);5l==wFMVbfQ} zxG@-G*Kpm7e{C>jp>26TSaZ9vP2Vwovs*xYG(Au431acHWBX!h>Z#T7%y4}l#i5u0 zO))I#c-Qz~!>dYK#W8=iTcQNeH zmBwzg<=2`Fn0f;PwS%eSnIeQRaZvr#_qj;ORsRISO>*tytxe)!y|{uV5#ON%YwuZ_U$lU ziOJWJNmUcErFHU7g>~^lR(x5k_giQ#U3w^CQ;(~Rx2gPQmvFLfYA{$;xA@Czeg9Jj zqr%iq?V_WTbqaI+%xV_d@DL7@Bvqm1x<>4=HB*b6W$$P+OVZBV9X?e_ax*K>T+J7C zn8lr{8|c$HKX)rR*}{3IQr}DJQL?VmsP7Hf`EH-oyR~)y*O&T(Z}j<01EDsa&v6ol zf{Ec#U{g8~m%6q#x~jT*aCFq9oX9?4)1UuYIw`x6N&4;2(t>^bnaz#JQmCW3rSrtP zojK^uymsS8Zfq<=waKpE*K-_qxn6uS|FX5^q@mRAtt~4)2p!Hk*)^)Bi+o#9pp57M zTSG@VgOnbBkb zZrW8}lDTc-TK+)$6?Ly{sIkKO%F0q%D2sPxWPE&XVj^?%`0Z<-uAsltd?J63%uXwl z89a;&_K22r%Rz`77GD;oX1CU==*xdmASsnMipyOnLMj9+j7bzk$E=p`Mp6O1FviKx zFC+w)piQl-v#xa09jW}>`hl19od1Y@oSD_5}2@GmE=FH6g-`{;r`QL>@>%f**!wmk?=07!REZ;6iuiRe5pH@Km==Yo9jUWiDTa?_fs64UHmbW5?L+)%p3C*=;SLkmyH*B6>raF05J@%F13cQj z-DS&|tQy;cvng@$uDzD< zrT}+8J26pzH5Fo*$2(>F*`^@siRuweIOA=WfO0X+xk0T-j87;9?p$3`L&Kxh-jNZr z@{WWCwtzEf$JahDaXYaHubzIZ`CgcBt|_gThU9(#hx4$Bh`cB*bwsxR2rpxQzPWG2 z;aT|DgVPrY(ftD6soMToXY*0c4=V_!p3SV)HP{2BoYC>QVLl9JGnO3M=FjE`r9!Vi zin}eHHZW|8m!qdP%mb5Ed8cT3WeUn0Ro~KlqEDXrq9Vw&p{fC`Z$77IZ%k_HDfDB0 zG37n}(Y?Gto)a&y$hV`$PPV@Gnw(Fi=j!^Bis_-BpH=71%#-7zP@dS5%{v%8`*b5| zz*&T|v*w+qJ4lM@8{jbF!t%r1Jv;{cJ4NM0=m5lPK++NpjBr?%_}M=Yfz)1n+%{R7 ziBoRx&uP89&IzWzQcM2ymJmMl{JoSW=KM2RV$q%Ae(*w1v&~W5$;QG>)CnGPuo7O1 zJk<5;opO8o^A}HSg!`l$M!0>uVm_QpRJ7Yi1>W8_}G zRMF5VFMPYWj*E5+7LI28{oCXdOi(~3J4=kgbwG6@<7B}|L9ydxJ%)Zjh&wqSV?Xt6 z+jC~>&C}m(91`k2DJKkTamqR_<=T+yfng!Ty~bDIZl?D1T!Lz7jB^IbIja^7xeLhc z_;I4$i$|^fFcq(kk*bX=wkEnU*(6GlT7wS?e{=5cFzRx9=+*S)1w!pzs?j*>!ZWu& ze1L1F$<)@W8-1NHuHp1tF#YCZR~Ohxp`q#i{(vz+y)^&jnqb$dd!trT$XOXOw&Or& zKh{G`WvX;YiOLI7G~z&>FLHA;tNIs=IwMtqiPL)_9E_r zLXs()q^<$l4|EBqlob_K^H4%SK)|w`sO!uB{yu$~=%SU>$?qD_&HPDDr2|Eim0`_2VYqlHyJZgodCHI0X9PTeBCI-Bx`5*6DRzmQKlH95wUkMJWD$KV}*TO<4 zS2m)ny;jT6c(shSF8qYqw0koIjfI?=J~0o1{;T;}9R{;5 ze{j1wZwHm6oAZ5uXU+4+dngS>-hA6moWcA2yn_J?$AO)t&Lol3imP4a*~2!rm3NJC z1=9-;5T{Ecp=hZM#>~u2Z6h%7;YmI)vGR;NJRFYzBF&9U|K&uL^U9`{A++4w^7X_z z?_T`o=zACYhzW%pa=G)WlZCW{H>~@-H&25yT6F761pyf_Fm>*NdN+(XAA=F!y)qRpUjM+d>!}yCwEU?Du(#+O<>+qndCERfdx6y;MEN4`5 zWH&0AK0E*Q0Fj*Y)bTz=iYVW&dZ}%tFu<-Tfa7y-L2CJ3F$Sa zLEqkRA<|QyHt?_Jf5<+~DKt!J5_|_fK~A4xHO= z9UofZ23Xc$hFm}CB?;M*>FhSwpX~R4;~M=kDiS2NC&H_bA1-pSzK6q}iVMDn^DTDn zQb3iJ4VAtCmskF4FX{Wx*G+?!jjk(C`I#On=jlH~?4w+eLF_MCa38r8)R#u&ko}fb z3tr198(vD(o(B;dqUw2cVKFaFlw4dDg^7s@dfwe9g`6H-#PTrL5lasF**?qHz?8mO z_ch!0qp!nE=;RYpDf1bM~G@hq?e+NUJml>(A{dHz?i9PXvsYlC{S zx|h>X<9w)++uGLa8(t(O`yK5qYV=X}udfbWbaAd=JoQ4MMF*ZN$PJjqnqvd;(}TN%P0#lJ7CoH zV6WydpSe#8m&mb0yPBZJfd;Sb((kj*5G$*An034IEBz9&71zur&45^e0e;IpZS5+? zENSy+Ahp@G4RR-`jj&fJf?4rPn{SezzaQbh&u-)rk=ic}JyGVoz2P zxIXSMYPN-~ajc0Bf5ytNr$d*8MU-`Z-J#2@8#5mE-K1Rp)T8XRc`p9h@${6o_6aWfwgzPkljZk> zn@4?v@H86joz?B;{@PM?v%I)Y25=Qf2oLtaHk`HjKFZM~b@B|+BHfLv$tYp?cic$x zwL0yLGBlUl1tJmL&xUMAUATX_tIi>+@K&#wP*7)Rfm??c{Mi;tn4u*cF^lDxTR4?- zqin%7yoGK@*PRF}Ej{(h9l{wUR*$914=$C;Yz#XgFaI+d!St>c&BO%T1=7{~4 z=tOJ2BqcrTPHltCYE1*hIH4Fd(78%}KDuu8q;*d`YMYac2LNShCZ>cHJibK7yRyky zXW~fuMqqo0vh3sF8;|QOxYm@VjpC{p+}4=8=&oEr695RPH{sk?GJEo|@v85&gv(qu z0a3282LqZDc|$8)JLUGDdY@dOrOo{LlLw5o8Rw)hSYJ@b)``k(94&~TXcl7ji#&Dg zr2VgKr|oRjukjDVwWHHj zSQEf2UkLnWbcgLdZ0O+J$UBZ*Am#YC8Li+hFl%9oxbXm z%je^?8O8^u#*E4zczSqDzS;X(vbx1bOA2Yzt8P0r_Yo&bD{#RQL~xU z^GqHuJsqm6qY}MQx3ZpC@8rj_&ZJ`Mk$+AsKoEGko{F2#O#LBuSsx|pGc&L-4KMXn zOfqiAG|lkr?l1){Jc6*bDIu)eOV2#NXESJK(Z{~G-EgrpYG+(|Bm1+)x9?4w1~GI9 zV>@ljRpAPMo8&N$*@tYN>mT`9QM!QudT8Sf zSxsha!+EKYi=pNPh~4I9OLw6k3+tH?(89KAF6b1M4GN#DGT93cW!hw3IIv2#QT8Q~ zTP&{V?KPTp`udPk#D1ajK1iHwkukLVY zRj$>|zthBW(sLlWum`lZXvE`BCv9~cS`eEKbu;&mAa-Q`EVU4%Ej71%7c|ZF6tHS- z$YFY^dX7OR1j;L0x;;-}u#J%qRmIwczI#SQt=a!6@P|5&OIkNyR?~>+*&ym^p2&fa zG967+O+%!(I6s?n!#Ii8+$5M|cL;M}7~U)Uoxb5{Ky@f3br=J6DtQJdC2f-%8<}|_ z;bEtKQ0-USjM@^a1 z<`C=e;8N#026!6g`Q1MUDZQyk`OIo1cePN*rx-JaV{@W*GSN*mEGKHH?pTqaXS@au>+jR0UFE@L>`8e4m_%`hr@QecU z`r)ZlL&U2Ug{AJ+UBdqfm!P*~v4|(ue7GxNcK|;oDzgDP3T)9ID;{x<$D?V0SCwi^ zY4e~2v0An>V=XpzS`lCT?IICsEvD{w;mOmuGfl@4PFAs7Hs94{AIG0*bYDwsz_*V^ zJWx=``H|pSO)65J80jg9Dq(kl1_O3!4Mr3V_g{|E3r`&i5H1$8 zl~!4Gn8u_wRo#+1*`bG_WPs389km?|9qWjTxVs>ON$L6RM&B}{N9nPv`p<7@(6!gP z-r3!)#3*cCvIrm6tp)2$y<5j;Oh_p^EX+V4$;r1;CPZTk1K)FEWNZ4-P&L&6df9Qk zv?sHslbREm$>*i2Rkb4>?aIB_P<=ersr*k+1rKEfWwZyzpJYgP$Pd;%cR6&`9w#Fb zX}u_)TOlbef%WC^Ow;z2xU+kONK>SW@i5p?Gb9j~`zfrx-0neS-h=`>48>>qp*u(* z^c(-RD|G3f69k*nB4=&?`RcZOQGUH;)}yKK-=BB0M$XU8fvr~!iG-^marxyJ?YeuD zRTR|#?t)ve{1pSWz~D>V3>9NiO2({FHBi8EV+Pdw@)}+Q5D5L_xb$4s2>;QU<=K=Y zEIq>t6SOmh6nt6jBq#NOI>04b@)^nONR|5a6D<<E#* zf`>p+d6nsUk9$4a4jUZUIAfFQ2vyb#96nL&3na zOn+?}_srna4v)z7W_=LwA6Tw6Z;pJ>fP@?;ijh7$KxEk6h%Dt*AvUT*hKc8ym0q=H84gZ&LHihiM%?AS#HC7KZ1H;mokJ z=iFo>irJySGpLu?U6jyiymAIRyBXYmHDt#uj67tvZg+*tjr|`RYM{}*^4#rUISZHT3-K(CbT3r`ny7cZ=g7!*el}5`ihhLq zw-P8J*Y9R-<}Fl{K<}+O^&!jkG&SC>->W;!J%KNE;BEZ-6nBNkJ6wPR2$}(*ZUk?; zdgjLjLRFAgC99@4L5l~eZLHqkY?6(Y z=c`w9iPpbk`#PL8fpqPwYxm$&g+iFbmjoKsXn?cHppyV7)8|Z zL)iRA01&U~TY69y>>JAN`suIpLeMJ7x?1XR%|E=ACr4`WdlJo%pza zy6_tw{s2*?75u;hkZLI2jVMdLd(WVb9qhwx(F9PI?o?qVe@o)}YXUsv&0-$Rh!Z@v3 z3U$)?G7?O=xkdR}kK_R|af-QZDmr^Wun;|lOI{&SXs-JnQG1OjGBk0)6T|nq7cscS z7h0-e)!tXs$xa@6p};L(PdTD~OY&o84WfSl$NPHndS>O^ueiRy9G-4>hEd73sLoQy z#rPN~VVEsEi2jilQXvpZ$qCwMP=^dz+^!I-a*lDs8GcAcDO4e#kK6#GD)%g^@#@=% zdO^K?c!t0ebDlYC*-vqCaU4_T1v=hx{DQnGTM~}oYp4UFVUpaC7bwqa2UX4{dZ<@^ zv7K%2XVYdu?9+5@e%=hg%c$7NiUnS6B~}C@8>=PSr)!$Xe*50nDpC11w3)HQSjyFW z^_=3mmcQ>+w9A@^Tx^&P_7V!`mL)04xUm~PMA?yweS zw+?;a&TTh=ZeHpxR|S5CwI7MB)3COaz72Mz$jy)!B;O15JFUvvI?(dlS9~M9JYog8 zu0+YSUVh4EmGg6JljmfuUr>w(z2e&ma!hg7=1fdl%;5E_Td5#m2E9BgdVv{JGHCf& zD5ce@KuI)xvFSJsm{c|h!2&%Jsqq-K+#R@WYSNF$00fA4&32XLfw*i{P&E)j88Vvx zA3Y1G)iT?Xgf)*maUEz4cEl?z1rB6g11iIqMh%R*eSu1o#~mO6(5PL#YJtV8&md4R z9&ByZI5|h`m%IECkpP%Xd8+ei<6qg|zGnKcgTmmj`W)buc1t3h(8YyHS{kgyio~=r z(H%V48eVDRrrBmtWd}8wF&pgv%z-!tp(*oT@CeR=SeZz=o$+n$bzfs1# z+2+}WfQz9aoeyB3Ef-0GG{?AJ))V7ebN?RK*mDj)2FW4W;BEc;(Y*fWYdz!UX;fNX zy;`!>EKfiRmFd#=^>b7~GJ^>uwe53YvvPI6RtLkLbloyBNXYG={IIpPQ{raC`%?Qd z_I!7M*2aNG|{_+L1RE=h!G`IK7o~?!@vI0tJHCmbzdp)jzi1#@KUA0`Gq4|*|Hb#~wH0R6j@K_OIu z@D057f_B9nE6^AaktNJBD%ThUyFk3i2D3sZw)U15?B!V0*u)K-Uq<4$q@g`=mkAK;Z{KFb%81_pmY!rlA`aWq-BDgYO|nW(2}w zf!VueGLF62Yak9~G@SQZeS12~t&v?>(zH&j8}HNgn5Iq}+vP6_rVc?tR-iU$=F?s& z_L4bq9qn8_WlbEPR+tSvUXyOVF8`^T_Z;zqiwj68d+Agf*?iG~^uXGX*x1yu|JoN3 z$(-j7!W>1Sjd%HH*i!^BXxNMFe5*$Q)@jo~&Q%Aj={IC7Z`|nlpusUPIFdiF(-%=C zq|bb|k2d{hy5YV2Kqz4TXK}^D)}-;q6*lV7Lqk{r; zG%3iyLjPaD75s9FKfgTr+1&uPjWKm>1+R47$rQ(=7RHzxnvF%buM>A9p6otOaIRF< zQ#fwJ#byo&+HL)O73F%17cxEvxZ9DR(KP4J=%$=J#hj}OKv}_LwhfuibT|=oi<_=a z#`VCDl|9M$>$r&;RKG!OfYCqR0u4-Uu_6RNa{-b%sM4PXA`be%FzxxdibvP&v+_M2 z`88{uRXo-iSSOIl33NkP*luaZ2T9K?T+ge})1Utyan7}G7e_b_`gleO5j}bxfHFp-9WGxel%*R}UQ1Uyo*0#VatD;=y%rZ!_}wF)1b-LJ(brXKP}0 zX{wGgae|U!)_Z5-)5w5^j?D28d>TAL@|aiTKnS3ol^n?F(wep zr3QeoHup8XC@1t>MZ7^l7$H}lBua76NLUFK8khU)Y(Xmc^g5;HJNM&SJUfwQMPvAr z+#sLgeA(VdEd`>q1@^oW*n z)gc?OO;vaaNu{|lYg2y4R%pAKY+?7di(@dyo?y0xSK5CYRYMMN-9hre-@VCusd8}O z{0$yJAO@MIm;v02J|$q}D8>wwa3%y8+aOt-!>?~|90!o&65jh5Orb`LLEgakhWD_^ zh>YJRD!W%IWSw7q1VS3rDHocsBLUt*y*i6!NfAa%Lz#)vmQ-mrTGUbREuZjR^txG4 z+ui`e;!WS*C=q}{^>@AA&l=lja=sp!tv2qJly0_7Mxa6F(>DG&B_8uR*JR<_NFDLi zE`-SNmC(Yqrsp{CGjn8OkcwW2uwV2K4Z>x zIs9_wyLlDZC2YP`gEi?w7W!CW>!$-~%Q{<4>dpUk{;AnFO8OPV8bHm1fOY{H)8CH> zW20Ha8M??zuSq+L^5tQmgcR6P3YvrxEzy^LRh)xxm^5{;j7U&4qoBynAt7HmoUTnb zKJRgJ(pm2_wD8_tA>}D5?n6D|2A3N5hu7*Ks6qhcCJ&Fcpb}nLqL>Hqyv&V=Ld~>R z@0Qi;Cm5T~A}(aW_V3?r=A&e)gE-0TsykR<1zwJVyXc$}y;h7d&GnfA;Ak_Jf_Z=r zpmXOqt+~)4<3OBj?Y~?tQI{VNL&2jMn$A~zO(-u9{~vGe$ODi;7_ZNu0glIzmBN-!YRkd7uNEz47Nw=H;O~rfNli8)4(S_w?je-L5!M!vwGw zwFB4UB4c1KwdzOk5ZT}s<&A<#63r2yrR7>}d>u&#qJs)RRJCXAIgMOOX!zL1^)Qcz z*fnpWcLm$VXL3p$ftf65KYdd`u=^bL<*yLbinZ9W=0BZO;20W4fg7Q{S==Yn7idOM zJcx}#r2>Tg51-?iO@)Q{to5!LcqFUH=(F|r(m~XL<&I&h=a=VG2q%sz1=13SlRdg` z_&ys@mmjN~Z2j6Tz>yNcWi($E08fIBN2m&nNTfDupw*p9zUh-cU}h?v6f+9mX#Mb# zX5zE4l@4$D(OVCcJ@m5}Ag2zl5;Uw+$DzIKj2g8Z#E&@}{31y-W6Gvavz<+(`%w+_ zmqo@HBKtd_V*hzMt{Dj!`dkS9sn!K;9b%ejX<@~RR}9~51qdH`fa6N`Eq@D_i|Q@v#aq;5=a<2Sq{(c+}Ue zBAP~ULL}xy@FbUF6wR-K#vBt5(z+9;1mx;9EQj?{k~58Kp%du4*+iMeuQP4Rt zQ6ql}J}#vKw47j6={UBb(a6782T~P*)T)8bQ#aswAwk>#_Y60{Jf3u((h0}qVA4Lz=sD0(m^c&u!GS9N%%Kl6M&u_%gkwI zpWV2WS3{kSn5U%IhCejb|CA0&k3bNNC{Kzy<^mOy1@8>!fiaoHsR<59B#X8=8Sw{)3`vC`Rl{bg1iEVR0d1jm7uJqNd z+fZxEJ815rMv;HsKLE!A;2JE57ISE|t!UCr#NLtlNJvmsM%Nias6s|17N(Tw9 z9Za!QCxs*A*-$1kb+5(bx2ZSUs`y^+>+};Y|C>Bn)xNgt&obYA=l-gZYQ|772cjOE z(ETSs!co>$Ob7mG_4_vPN6Ww;$;kmYPqQTi3DWi{`K9c3feUJ;n+zD?ob{&|F$=90 z!x_Het5$;&ZJI1Lq-I3A4E*WwfV3r0_5d5U;miyE+mlu(gP7#7XDT zLPC)eAV4Sr(xoIcLlFtR6G}qh?C8uqGtc`z>pkE3=UZp3bN}Vi2)UDc?|ogrb}?nF z_x<9DCFB!tK97<$wUP@nE!HvgM9S95#U*hg_7S!Qt`@lv@>TN3<1J5K8XgLz$#ZR^ zsPy>u?{KOZCVmh@T6Ic%F>GdOJ_Y1~{ z=Akw!vu)i1nrPXm=#2Nq2(%GfNT)5T$#1@FV+Nx6@1T|+7ow3cK+5D^;aUDi=}aX^ zS;=W(%0JE?omW{owRe*cI{`c3L+!5Y;yFSB268F)E{F+Jd1Vg>tep|*c^y9sT>uh~rXnitfa z)xnpY^I7|-ZQ?}{fd}{b&9yy0+=n8_UH@3 zav0|6Lwv)>^ZNju2;j26T@5Xu*Xt6s@+<}5Dx#KG^$qU@z6oP{YDwZ4%`(>}AUN}x zl0*w7IYv$3Swabg4!Ve%RMPj88<0`UQqX{yLDT?41dn^BrWgYux>$jQ0zD!xGdVY)N11y%Uo4ICR@)V_u z0_)#qq+*`3msNc|8S;s`qiv!ykcEma63~JPerAIy$D}c^5QpvF$Z{? z{9|~V-%HQ^85N9X#>u2N04M<+w18=lGvXsG>%^FU6I@VR zK#Mk@en3Jatlh^QBodE>D?U+qwSmm$_f&(k(T#b0uhy&>@)}cRNq=2>-&1@GM!cDI z3atU=t;841Rq$2ldbbaZ-MPQl2fn5vaD3}GCX`pWhPBh`g3bU`Ps`p%giQg|bM=a7 z)9(9j?WPT7fO7Z0neBv6*ir$x8-o~s_TCAi4M9ymO!-QT_&Hu`SDk$H_inpFB7Mp5 z4My+$yb5)Iuyl;w^1Lw_(B;_F;h3zWH}b0=vQ+(V6b9&;_!y?w8@93+FJHcFJ67pP zTr=Gdk@p%hHb4i~^$!d%fdQ}r66xK(W#lVari}}ju*gV=vvaYZpC4R)GXzXA|BkoX zzs_a#oZ#>vIVfU&{>tXw;0zW{u&fCu%#_>4N{NYy*#2^)TyBmREF+nS;**=<;*B!WA8R#XLWQ69A6o6LMCkZrkM-lu((v z-$)xt7iXGZ3~G3I`g_}eCry57^k5__+fM<6;kD^*g-;pZF@1oVyaOcTd}CV0Zqv7Z zdvdT&@ccZr2JzncMlU0D0(5$8^W2aJ4=I{n4Lf=2;omxk~csnLzA%g+41{4yXed z1*7by!3-xhF0RTSqKwAm^Uf|;+-vE#=)()Uf#ssskZ|5G?}FXvVs`;{%I+skU6t2!xcP; zg`gee95%^r?oBKN8v)@4=t{n4m3MxFFQ@{Hf%nh4SfHzB?o0Dx(?j^NsvDpZ?7+Rt zoZ(g;a5*fA0uxpMiwler;TXNaT)<(?uq+h<6&~NUH?+31Z-Hw@{>V7MOzn|W;aV1t zP{h#_ah{fMWeXU8eHZT=@!s1w1yt^knzDPIZ7Kh@_N-zl#BE5~m=j7ZI$%~tCuRxg zK4(^Et%ab)+fk>0uwAcr*1Z1UiEwv-=_XlSNBbB)HD>sx0O|_FcPLk%Nh7LWqo_5r z#kFmF1UocZT$9x;y{%b&%1Nm2HD|otHHU%0PjTiV7vZS!;?V>%^0fg_NDJ~b5%-9@ z{v)6Zt4wD4k}2AZcx=gs4wXv*8=WCS#q_}J6veCsTYEMT^6B_h zU{hg>faY(r@g11Cit~sY1bg-zL|@;wE>G0g-(S_~e-e2CzOi*@?R^?@V%4Yz$cdSg1L8W59+hD zTLfJQ&p&oaB47Y#XAxtN?%2dIDcyTVvX^LN=9Yh!2U zN)CMScVUvXd2M5I*ZLnW!_AS^xw(?BU%Ll_MXl5PH`bHocaC54d?)(sheIG>ocf0u zbhxL9VkZ3I8HLLJP|KDuBFn)4aI>?#Au3DJcJ;pRf%{cX&m?*t9%GoJGu_YR@&~ni zFc$EpJ4seOsmpk`vh0Al054FOx7wPv`U9yA{mVvhv}xh43sA^cbS)hTPfYgg_CWAa%CY76@aPYrc< zG>-O~lf|7Z*sx*V@X|>@qKqOM`T;yr6o)CrUN;3wKb3J<-}mp?|5k??x!9dweqdGc zG4@C~pu=@3aw|J~`{kUxu@bZA^2EMqJ1`(Yx*{_L-23}IVr=6LYu#JNdfF7abdz;| zx9fJ4YJHdbuvRk%=<){Wt^>IGC7@Bk76bE`EV#`XRG?WAY5)%tIn&;#!;}{f5H_?J z1&L!qUQ+=@C#Y_QSAX)iaN*ewc2UHKJbldim$ICN{EQ~%$zOp|PXx!|qtUF~1h-VG&Qm}V$RqIeiR)oQU{-|!!5gsM!y(ux*_WgK<@c?h;*$UgXJ zERL1~OI$@zsdmfET|RLcO`svTG2C5qQZ-yZx!f%%>sx~2)r-8tP9dVcQnEAL%k~hI zc%f;tXJ-HHijCZB7HE&VfJXiDxHsnC07WAai*vv>=PvZ8rG|&1jZ|lkPOc(vk9oFn zdJntj+1uIms|wX+>zYC_DQI%#m`Ccm zRFg>V%@aggA%q5u;X-+8sa*wN#uN4N2c`i&8=(FmC&*+94k6O_UO9EZhO%}7bp4mN z73fR~)epN_JpSgi|I1x3DFY;Kg%@>KDhg=B=`?|&5wha^1*pPs$BHJWSFa_o3+~fghK@r|jbDw->vpThs5OdOZfVKDEo^oA(9M)8un{ zc^wCe-<$X>)QUNFy&Ja@OBi*U6`BGwzkg0i5w?n>;nAQQrN+%>m6QmFgoYNt;a|bjrKp?S zjx~8VP2^YnHuFNo#2-*|T&p9bUiz#%v~T%T+Rkqa-+Ri|?HN?mS~zG0R7*ME+xV~W z8yO?y798fZ0EEc&l5K?@qcQR7N?YWy<6YH&PC^{Iq

c zV4D63NkXDhK1Q_z>{~*6Q4D!O&I+u_XML%;)Lza1c#m>t3rK{VyG>lXE|-Efhyf@~ zKBYi%E|qt5Y7kEOx4OSB%*%c5)+SpJSD!B;lpisJLc|)LiMl}#QS$rmAN6SgIIBd}H-GY%UL)eRZ|nzzfB${xCRF?J)t4yNAfZpUK@W>n zsng&VFVW!$0*@=GtnPSE)E5L}8wREzka8QkY{${oKceNysdK`VpY7`004Htw6e!WK}0Rn(jMCQysmc5U*Jlpc8dLtP;G8 z6|W>hrxHmNxStBrLLl^DmtH_d^h+VXpMb(OHb<4^wPBdP&%NxJ?<^%wd3T3{M++w3h(f#zJ=McMZk#I6K+ez}+UkoIU zM}Q=C3S`NGSfD=a_s08g->(lP`;i}W0S9CN!~q%b-$5)I#Jt{|wLBZ}Y!QO(9+=6i zS(6ZSj#ukYMd4_WoH8dj!|SDX)fM>EwBGOi@j%$VB_IF$Jjl-*0{pViJ9*3|N=e18 z&4;E<(zfS}7v$mt_vw7-fmdO=dN>KR7&d*aiyoxhBud7ZMW+OFs;Lx1V^No9K)_^6 z_E+#?8(?FGj!3UvE323WaUpkK0huT}PH&}wqw*6^MGg{O!pgtSM~&Z5s$c#*|~ zZY7wSvY1^rFmQW%?OKjz*XQorLX+*Pf+Yy6OOo;2Qb;BE2F6v-NJS|GpD)O&X0=`X z&QKz|Ni&jJICry;43xEn8I*Vb`*5_4>GM0sB zM&C1VsR9hvLAOvqi><<}RaMn1r~eG*r)vBxwQ3Znq*e9Jr##J?c~UV6p+`drvCwFH zEnQhMI7Q=ox<*5vTNVY>r6^EVps(S9WQ>tVkvNu{2Z}UjeTGhYj8JlqkN0t!vS8cF zRG3tkPUz@EK1iJaiQZHwTlmr&r0!uPLlg5d<--dkxod2qZRoNMWQz&58#JLWEv>fQ zZ37;+Z(x)=%5?mn)QJSy@Ifb%?n;6>G^v=xyFb#)P^=AmQYv8Z-d6#9Gx2Z+G!+l2*ewa{-fJw0vFva0Rl#Fiulr8y&Oaeg)u z0!}BJG58c96ae>lUIN6WjG?VRP|V^sp8P=EZvvnRZozs01D|9~q@|@%lmlwmTRz>F z<8A>q*fZ6Z-xVa@17pl2j!T(R8{?CH}SY6)(j2A=I9R4^4#V`)2&ieQdbOJ*HEjhz}fOA!q{B`+&-d^7%#gWYGXUPHx` zynOoEPRnn!JELJbPpG*W}okyE52=0;$pgA*Vnu zl=&eGZkYjKz@N4#^`5_XW|PN`(2(@&M?8kA(o}+`tNbOFCi2bsS3eYqw?EhVjvE!$ z?dM$h3b$IM9n`?lu=8RDyy~oKi2+bb-t_#P+vdU@{6h803<-ewtbzpm*hB&aVqXE z)k~LWF?B-e#q-~_Q&`JUlQCoM2|NUx9h2Xhi2M`U7(F}OOO zM0L)B(R)Xw&nO<_E!49jD$!4c-rZ~;CssDQv)GD_r&l&bIToRK6p3Egt0=a#F5_<< zY#(j-66An7h5Z>}YszMd&6e*T^s>ldhSUnMInq8aXfM;zBo1VSo&ZFRu}bsD$+`96 z1B&Ze-ttyqw4C`VG(K-1pGn$cd7<&)-EP|uh39NG2I7P(d678f^($u8A|6V=!0k_) zPv@wq*I$0#A2psbbhp{sc{ z6zXS7Cs5A}uW-dc2!pMriqBAc68Y;>-8VTrm+lB|`aY%Iv(}2RjWWUNwc7L(xRF~} z#kRl19k4ASLm!gGgL>JLRj`dz@6CcgXKnyV4rzJ0Vs(%zLPR}Ow>5c`tgZ)tess{e zkzPi5B$bNy5nv_gmyvi-d9#?sQ^)(fjIV&%r*Z2Oy$os5qxM~^&kx3M*Hzd^7=XZ} zEQr$L5H^N4$4#yBP=(#BJV@z35si@*!YyP}n9 z+5475JKRN-v+3?&!!;bBXCN?np_-?hk)H z?v3s0uDD_S49aMFiMw4s?xcq;mPY!Qy*t;wag=gs2i#7wqWK1pNxb~`)ns41T} zV<`p^vR^CZ!;M;BM>cgAakUI63Bfpc?TV)Gzo;L&k z5zWId&zpkjMnPV2s*zdbtRrB$%Wa}hYA)ksN_l*qwaYZYnU!9|J)(!d7I~X9Vj6CN z0(AL1Kc&%64;0|HM#%jE!D_q7IAXyP6^TaI@k+OVsc`pn2~UX9jcafm7rOF{`%aV& zf+T&nV0uQx-E$V7k9U_2myd)kTUk9uyaxS!|3Xj64^h}%(W0@_qDg<@5G`s=b2*YW z6|nuY)$cZR_h(z)^8%NSZo7wC0T`|5{hAS{5L{a|C^M8wu1VUbdwHO1RogQnS{ckB6`-3ZG)r=e>2{5W_VjMY8DuRlC{ayoy3o zhD@VWt}>)O^qfjowwxwpO~BDK>P)bW)AXgd$((LS2;#!4;4pCNb}J^3#4JfiKBDhY z3#`SrwZ4{;g(LSZ->ME{ys;QbewH^NOQ`WsyONIoq>A#vl*b&OEcc!+*Bv`&#ck&u zahFy>e?n8yfOk9Th?ypCg)pnIvvAXzLZQ^L{S(Oiw-#81@gZaei`FJoNGc8WBVOAvoscT%xCWPe;Q*G?5 zAR=Nyk@n(2l(d(|lqV18mJJrdSz2MqP9|g!t)~!8Hyv|O)c2jD&HpBLM!N-c1YTMoB_*r%#=nUAqH*I(z3=VZi%~0qW_&g~$G(8a%g5?xSpG<;}!NG&!e^=|P+yCeR(7yjk7B7kv z#XXEju>>OR%;y`xM0rM?hH}MUynN?-ZY9^miEzCHvPacbqKNh#0!HVF+{6u;jd6CJ z-Zx+fP)<_;%7|56xrW_#4WubiG44%qSMX#Yr@_Fa=jTqaTkj@kCvBWS;DP|9?mZ? zOZ|-n;PtH|gwg++3^dGtCt>-CQ1MtLo20yhw8au}+7VwZ)?UsGRQ*eVDUi@xV%|vg z0`RMhUM;z*7ry~ss{}>PU(;YgrDw-4l>|MThcMg#itI?{N)%*}0#=)f8A>eM*j6<} z?E8B%G?SjW?37awCEy{nXI4R*bR~nmwa7wq3N{4lR(}E3ox1yv#}b^2A?SER0U*kN zZNascspR@_T@bQH?LqPZh>c-BJJIn3#fHG66i3jX&8Wy@L~C+4FD(8IjJJYYB_@`k zn}A4>)g@K#JO+7Z!UxrH4@f|Ap$kZ2$7_`=(_t3Ph}K^ji*twi`LEC-h@`cb6p1xR(5cp3c z!&l`HJ{TR7Stt0g<^pdASxs(2{PPm}W*%k*x7^Q4^UWgr9{$pvTIl!7O!X9`qHe$M z?{y0TZ~(-XijmF|Fr%+uynm-arfWbbS=kd+&z%-<+ ziXw;0`jkptL1QB$kf5~_{1;#dbKxxn4thY)LM9PsC4>oWEthACf?vA{UW1p5pIbaX z51r7bMcED4PwC~I#)i}$6~0Du64m%&N|hsEe(~S3P(-|kXh-uK)YA%)i?5=d<$1(8 z?N8Z&GK~#{S|N!}O}t+q1VD~U2@h>3(Wi8uXu{zvK&;FSR$Ct=7c+FrG4kn9bh97M zR_5XVrOKdXa88O_RG6<#zJ_ilCgmserJRFjLBpT`$~<1FB0dvW#~lEGXSk-90GkWn z7jRehwN^1?Wn)nbCD+5m8lc+bfO(P1!?k_`s!-F&Yh>@f{XO6UXN4p!`yw`>f^`Ly z4+tDN-W{5X%o@QfudcBRVa!^g7jBOlz5{?64f7}F8c_Yso2)X2-`apRdYVJY4!Zuc ziQ(Tipr{~`tkzNq(gaWMyl6({xXn!n2fp`m`b~lzva4(7(HWX z8Uf-ztsTen$QLTZMx76d+0}6%L8m^|Ur~hQV>1@rmt+*_NOa!Hcx8W46HVp6f zzfU(vTR`>n5w+J%TqXTRNqMp*Q)24#MiI_U;^F$NZ*vCMB41?}OM{hk0c_SzMVZEK ze??J#QLDX*DPdbVaPp(#RRu{L6gxljXT1c~*KLFtac7H6S@1v0KGL#aL;Hpub3Qc? zr6pgHP1!SkN2D3+LM~qU0H2a@1c;OVosZt?GvFDX3g5sRvUGTHF~{X2O{*GC*bn=6B7x;5{EAd2rY6NmA!PH>T1-&y8x>KC7FKQN@)wC-P zzmV#XAbL{8sFjPtM}kw?Duie6#i2KlR`=MMS0d>R7Ea2G*teXCb7{@27_k?JRW`ox z66x38*M6-6MGxJC^rh`!`qXGHxQA9iJ?@hH6S{rH-|~zL<6ra1 zbLfU(R^{)6^QC3oD_;C$EZ;T&(gpl9R(n+yeKSc!*2CB${7KI6zfv~BEkzMCuU7}? z(5A0P)u`fnp&U#egq8DIf8#Buh}AWC*e0J)XF$tu53q!^aE5dm|6bmgDY%&4V=ome z5gca~6A?sJxAeI#PBz4#{8q9}623Qg#pXZ}oh>f(v5)(g6r^rgwV_NTz zGzD-_+6AC6-I&QmX5jqQ5N($zHs|7X75Sj*7gP#J+E_G`CkG=RjPFgEd&3sCe4_h; zUc!s$n|g|7F~WO@6LOXulkuFub0r1g z0~l!4+cl+@ad8_8ic#+ArdT|+`tK5+{GbCENXx_a_v4| zvv80#$WVuk;tBrsOa1bX_48mg6U(l5BVO+V} zL)w(c)1P-WklWcJuC9cIiq*4V>QsM+s)joor8&x5t>;&3$pu}q z9WT4YMz{CCpfJ2yXX!7~T+R>WS{!R}k7(>wpjA+MPu;;F`=cLpZ8}Qy6n(Tz%-&by z@9K`+u{GbxNKJYp5p*MEv0`aQy~+Q%P)%Kx>@}R~4MV%Upr0>3oNMOA(IjRpy?=ZE z`E&P1Xbj4&c>8hxFVV|vWaC>;R0S&P6s>t=d~MqVuw$Xxk%>D`mEKux4#%~R z7UmPR#)Y?v`V&tNuUE8_?T4p-FJ{PG@}~M4y`V&Cg8z2#c6f&1X7!Ut{OHCN|8wKQ zLn0q?2&pI%g}0BWgll7}dR$63jIk@2#>^})pPFah3o6_Tb>x>YizphG57k`aXOeJx z8LSlhIBh-$pRyLyR8j8L5O%I4TR9^Edpl-ILOM1#vaZa4(z9)~#O(vSOUc5)WrkJ;W9y1W<)`Pz%)^ zO&QiFp!xO?ry#AKoY-^|l(`5iuqb!Xd+`(>DU%3BT0R`lxH_8#W&*Y?c%@kjmzHpD_MbBL_sU_X>FL8i$|W+T?Z8s zzRNiyY=OlL8PW1o88mM)6Z@;paIaJif*lMV>a?9*a#vKg!m35w!@tzVNT=tvg?(EK zti1geSM{=_&wwa?Hdzr&*KdlkVyepbK|GaD*Y0w^4OsvY0ssf6?FMcLqha~ z12Vx&1W$xF6QnepN-Ap+JZV&EIUQVw(x>~PLCu3X$w^e%jwvBSv-WXH3Dkr*LM%gG zgeo!)idnf;Bd;??e zG-n$>R>W}n%GK*`1($oT-MFYlX=t3PE+HOuiU;(Ina*cdpIU4VLGSon&+Q{UJHb@IzLg_7K^FWh7)I}hKcii&tORs@tF)# z5F}$o>H`+8IpfpZWLPTUC8N;8w7DmrVxvQ@u$e0SFbcIgceCq)UPK2T6Lw+@V+leU zA;=cF_$|A#W|p!InP`DNvFM5Q=^>TUH-Lrc*N^Ts0v(RA^22AugN2V(H~F_h66OWV z&)AJPGy^%t zWNhQ>l|SRb*vA}(4a9E5J{JJ5?}^BGThcYdyJzY(j>|~M4P$M~(c_lDe=GU?T@Jw&7|6dfd_sb-$!jy|L; zcV$mgToB)u*;~_eu1c}eho${_wDQjV-xW{q&pq_^QZrwsh?qV$D>Js0%XV)JU!2R< zK5^&hcwxP)U!S|eLNT36qLKL~!;sOnSvvP-_fD5=X5-RJ7g>C+w{#ogOrwD*E#W>J z4W6EB8%`IbiB`!dGJ0GOZcT4xtt85_)beca6m8gPZMz{z#Yj`->FTPtJ2DHO+1Z*K z@Hp?Q=C&_3HQj&2DhEol>E#94GO|WW2DJ$Cj%(gp%~S5$%f{Uj{E}H9k~L;d#mq*g zb)J_AMtFA*(Qg`-kcCXqG5I}viH-Q4o8o4hhKQGDKM8J}Iv?TlpgQiNA-zhT?W2t? zPrROkfXVEj;HBy-rz@PL-CEZ3jJ6G(=yF-bS*1&_Kaq?M8IoRmEoU}P7M3T#qqcJ0 z^2aUxz4R<<1vW(gHIg?8(D_q=x>!0?LKbv`#H5*%?0Z*AqI0`7CNH1jCeJujbJV4C zM6CV#`0ZnDnW;;*Lv`-oj<28eyUbLk(#2(*=9t*D@V#74x;rRz8@$w7sz|tH;r%H{ zFWo(ZxA#LI?;1Y^buG_S!nZx7YhYJa{pgz5%TvUpI@9r#Xh96{gRcL;%*TPRAZcB) zn92x$TlTLfdrYIxp3k8`KPC?z2bmHq6a{;td^`^jQIf+4Sw4b>;Z_DhrS4^d?iSqe zBcC6Eus{3-3!(t*=l(1-j}$B+DMwkp#lYXpf84{XOahN(Jh}T=S%#mpD?ewa!P=~M z9UF>X^_$w=GfhvJE)%{-0Cs6F@oO-Bo1>+cAj#fiiZ_1u!(!}GNfj){{(Vekt8#A*^7FsmzxBtAaX>?UzTvZWRv{{c`I)}de z-LrdZc`WR4tgr@1DU{j{Q2fHcH0h~L)1(mv@VXs-l$6NaHA}}5;^e;RULV-yHuTaagv4`j?%+)GBDA6AWJ1+10e9>ZR?*Polti8$XXASs5@Kc1* zeI_PNeOiGHM8lS4P-K?<>l6rNUll6Q2|oz)drs2V%@m=YEEy%5=_(qwumUZZKQ*c`L)#Fn4|oynmSwl{Hg+H8*MT9v*RMe>rt+ zefpzAn&*0Cq3sujp{o>^?jTdSqjmM4<+x-Yn{|I%`?`*uvG;o{DlO$UoHoL@fnS>F z|KwoWIn(FP0Wn%zZ>#60;JBU0X~mqz<*D=ON`cyiKN7Z`7RrhWM}N#~7r0=Lo%0A= zVi3PtXs#wmvM9|tRW=)4lfTWL#Q%&h9WPCv+x_nCQ&^O)qe`@d50wau^6&X$t2H;_ z(2ClQVX6t&>syWqARGP|C?iOzRR7nV2-tAfQg5jUDWQ+R`)l_jJe!|L|ER}tV^*7s zW}-i(`nA}aRE6V@*hAh$F=R@NrE{lbc03KN^#s^ElvdAu4-K0VUuNQD=D*4xM8zet zx4pe2sc}rACT3_QFN!0GTB=p3q*UX@GuCet9nz;QRvbvn_GWxq$2F)YIh+*5#0Xb( z<{Ib@PV`}^xRkH0ByF@&9b5i=eEnzVF^|*EO2_(BLp$@Ye%>`&qTAxNv?0V-c+HGss1__bJL-z(ADrp*VENBrzgWl!J?{pvhf{nlDNi`t{o4=DLaV;+!t3>FybJwj7v#G#7P_9@TTlpl zIa*_qy%zcDaan(-oq>q{Re`I@c|+x_*-4&X`**(HWBO#Mderk%S3)ThdrN}W#uuIT zrF&RK@%$D#AxXWz{WoU|`;?aX?5ql=E=?4K|og0ctoe^zS)I zz;2gi*`3V%nrm&DMy|XyRObvRlt_k|WogFD3z_#Z1*+nO&{3oAw|mt53ej{JsN|n# z=C`$9=^QMH6!J0PHL3{mezO`L!nBa#VtsXpn3M7G?ZJMJY&V;)mDeAgPLk5iiScUl zUggp8!>7C#-x=Uid9sy!Kzek^<73*-gp2IP8JZUhK5r`}Otqd51E+#h6066fUp_gj zoN;L4)4fZErE{@938RhFVke`ReYX^!`BePg@z2Kkq}^T~g@*68@J(6ziQdZOim^v@ z`4J6?8wopKWK61VJivM8Mv1&IQNI~7GdKRY#9%3$)28(C`6RqlQuotKq14e3p1BVkC|Uwyco2%Sp|aJ2gubX8cOKg5&367((9 zWT0(M6lXm8-du)JNGy7aaCOn_-XRoj-Z`uv0^b>aQt!4M95`K7_A`oiLA$`e(6U}B zyL*&>qO~|rjp55X@1ql$CcaTg?)kzFmnJfXyxQla1COMh9C>W|E{o*j`44qZ$S*RQ zPJC)}TF-y6U=-M`5J#sL&rv|bzxL9jO648b;S6E=ERM|2Ppk63i%_&*`#`NUb5-K~ zYm$tFlcxsG-r)55qUJObT;D#MOS$m-LGX?3t)S7vr?}rQonBo1iGMQ6=o%cC9$qo3 zy0a}gvcdJqh{s`x`8rXS>mt{~YSsq2vv3hMgt&d8 z>o!_QR7WHZ9S;Wz<@q7sc=5tAbC0~pEzgao>tCX(twz3z5POa`K4mqHzOMm+5Z%J+ zWyTuT%HqNK#E$`KZSiXYO}7M zxEfdHpuDw1fPDao; z)?tM?!su(^<5%w&Z{m8+Sg+K^v=@J5DdI>LAnB>Zsy|uKaBx2SEPV&o6QhC^%eitd zrit$KK-1lZ0*i6Ead25hY7@#i+dyNaQs6$>Z1=>zwr(SN%6Xr)1(7)vMqzD8xLtxjfR*mC#(4OQ&{B zU^yoy_)JKiP_eN7=s?uj1 z;%|H~9Q3xBTKCorJnft{)|A9uwtkcDzuEaaOiJs{g(fMtd>7}(9gdznr&{@G-MmEd z*)}#?rz9lpHqR3mhwcmUhVk#jz#d~xAvFFP;YPChb0amcEsZuCjy5NeeC$@up=rD! zTNW#9zd=N;yzQ}cRwb4rsP0bjD@kPr*X21I?eAS-H~TaEI;+(eXKn5R2~~BDGRpk> z!eOV;eiD_K1=dC5OzigHnXz`e_LqvnHz(gaO)hyf#;;R)6wTP&JSH>1=6M#glhG=@i)i6u>cUIejWbT;_Da{h|wK*pz^F=ENy$rwRtsl zNkVxh;Y&==JI`{auqyI{V5=ocF`B84t8X6vMf92)u9|1S#QvOixKu z$M=!m=7b#P6qnmUZ8X34-?uP}9fRPmp_%^p)4pFMl?VV!%`*J;S{p+)!W&!Vg4 z`9FE>|A%?)|BpVZnE^w|?XH{I9XXk{Mi=y(qW>@U-ZCz$cUu=$L~;0N2OhFTRpPl z8VSc`^T7wDkB*#^TCa4ebfzoQxDCfJBgr+9g}V%p7YhLZC-+Md%V@rq)p}x<+o{Nn zEK9p6=bXpes{JP`1>^K;I(K=q8FEQ_LWRx*%8n@?7y*n|tL{EqV6v6fwX}*V2a(u7Xc|QWe(T*^=!i#@AS>+ULZZ@_Vq-!L=mU>VS25CNzR?Q=37o2nmj~uQgUuTv2 z+lFx#hoq&IW2vTC_bHHsiVfZQh;dw+i2O~`aKdb!2tfB8shq+y zJdGd9S`8|`E7KC6NJ@>KP<2?gwlmEEUlm4*)!40V`Cwyro0;06DG4d zqkVfY)qTTya*3P1CAg$=zW;{GMQR^QyTvRr7T@)sv~72(OO^&gl-uTB-qZd*^;Y&M zk0s6N`Ru>8%zDZR*A+^;p^xI15rgEF2|te$s-$5}?kB$T8Rei*A>-fj6kCfr-(E{Z zm6H6(jffXIdKvz9c&Ji!-MC+x!)cR_VT~jP!dAY=~R*aQO!*{ZOruvZ{?&CM9 zXAcP(X#6u)N1PGZ!P{cu{4klgBPGWL@C+QAX#2)L7!i(CI(?Ofx#8Knbk`Sx2s~D)XhXoZgaSQMvE!Ze=$FJgKb>!=w1zl zZ{ei~owp)fy$RfFRFfoXiAwn;#%qhKTS0ow^(v8(T1z;=vl9y5`&AfLl%t{>o{$Z%O8lstEy) zxjbk`ARM_>4WNT6GysF5wRaKx7(I_Kt>s`Ra|U7!pMYd?)UJB?dsm50ugtu{(QC|X zvKb$@G-*?cGxGPl9Bx$jxe>|4uHx`FcGM(>6wsViD6(dYUE+YLeH~t^NT%fNmy(zI zGyPKKUPJR+7}8ibEOuQByOZ1t)k}Qp=&SPN^X)<}zF2EX9Tid{Pbn%S%sa>Hzw6va zN+j%_4q@_`8U&8OWd#pzytjG2 z!!>%5Bz_k2slcf4CbCzZ;a8Jop01d#->?QvZ7}j@z=%1svu&c%+fYPka&JwVH!r*( zeR?v94I=JRo9{m;5S*lZjFURH*K59bM4HI=hRvkxHJJlHBmTyd)VbRCt79D*idWL& zsuR{Ac~oFF#uHOvnCtY`WG;g&+Gy9TWS&7Y@bTG?t33Yvc9Zc0IbUUq+2SbpuCO3vnV>Me8Xf#q6XLr`kZZ=KaX^R3V9{s5OC$Ydn|BVXHaX#sT6aWo;`O zB)njU^!aIZbDMl5P6`72_+`GSI-?IP`#LW9t9p(;Tz>(RfUAgQU-0@XrN{l+$$Y!P zMLYrVXxRj~G3>L=JvD7{vgPZE79RI1nN8QiLoC0$QJZw=S&>RB#TLnypCe@gC%eaz zCBk+<(-cY@`MHRx#mhiwyrF40^R3QPt>rtY= zgMpu#uxp>&8eKEM+~e@*OF?iskI>7OPYRl?tIzZ8rs=To8={CF?7iGS2xI#m+0H^N z8~3@WRr~JlLZ)=lk;71ziAR*;X~tMfZI~U}J3Fv@HMcQu0lbh}xiU#pn7~UXe8p4Z zJV)4|K$*`A8X<68wjs765IXtS!D&sHe`#?K3Q&2A(W#51{b}}oiL{kJZAN5M4Z_{0 zWS>VN2G>&U#n5^iIZl$eWryY?>ZS9uv=a)KLNpjc6(T-cMyJiJlPJI8JrIs?ugQK? zWj`781$V(B@K#NmHm&UJU{;J%q3p1s+1;Ah4<1#4PK9rsdMOG_zZo*<(kDIYFVbxO zZq5b;fe1K+O?zalkw|$3SC5r@*q4~c0*d^FcP48@?jZp-{}##PA-pwahKDwbnR!Z4 zit#)SF#!4Ge!*;D>p9}?_Zl!8N{2&uBZ$*P3|XsEFt4w!9arfnwZ~dDb{SY1vD}%gRL%~VPGJwX zs_Q$ew=nxWrq493%ibj#sA?0kywe6rnscO_x0Dlv*_@KvX_kT<6%t)G=&8mX6R z_3SD55;{?8fd^j2`}X)XR~mQ|%>q(F@TsY`4+nWCY2*qra#*44Qmzu=M2`zcP!4r9r%nwHuid@ zXQ?1^H#`X3?aOU26nVE$4_^-Bg^ZChaS`tC<*y|i>q3l4an(>{fZlwlBo<`hh$kin z#dK)I_P2EnbZeeSIM)ct4IStwKDxs$2T>A%n#0`p$1}o)@vi$b#AUl%+)i0{#A5gh zf(+fMb-ca|Z7eu+zLU^v3g#(#q$f<(X&!yUJj6ea2f!d7U0+PXQEwdc3N0{3E3=Cr{b!t(ro7iVJze+dEssLNZ6Twvx~8okPA@u?w=mg-(XJV>)fPLCEZOVgZ`g{G(?N=beCeLAT2RBRgO?cTTcD{XhSWQ9%kT+tEhCH@i81Bv3?W|3ktS)>^ z>CEfJu9DR+4BOeDALI5818C?sBEuH^s6fKPZ8~M;5RR z^|uF7M!V6~t9Ntdw?+@GXZ`0PBuDrfD+L7QZ2r#FN!3O@N|5t6G2^yvIu3Rcoj9i4 zzQmR3ztCXXN>+?n%gWh%Bm>VNRm*RDGeMv;%jqC^%+Rg+)%wy;wOHOvR$?zCVI0|d z<&s6lkL4ZBP~nC8WY3$v#4O3@Qa&pun75~Wmr880(YuoNF-o{{V{xc3!6|51;RnfTQnL%k?>B&WJ_+Q&lVU^UK= zO-(6q;SMd}F;~4W4+_ZEj#wZl*m>M=2}2nSRQoZF0}{=%&jn_>(j!$5_*;!~gmns~Znrt9AO*BsT^FfcJ5!2&`-Ojy{T8kFoOIIgHwy4#;Kd9w9^JVE)r*>O*X(zfdW(X!N znIc(?{U?roSVp#8OY{rd#x+;7#3rTf;v0@GEo8)WT%| z)mGzYn)a+ul{wnJg^D`!IJ;DKB`Y^mMC7#vVj0KjGdL-WLsjP02dQE|C#9DB4oPP? z^r4xnS{uXGoT02hh;cXlD06G7aR_IPT4j-xVk$6?U4EFoYsnzO^-ZnN)}^5$)2DYz zt?`kfaOJN2Y5Xgz#xN?5<<|jFdPuB6*BFT?2qB`d;zX*NC(-MWN@k7155>(5pD0$n zko!GxF}!IQUTfnIrwgSCq_0DrQ$&+?&(rc$9{D8Vz>9GHwpuhh*3~y9Sly1woX*Z} ziLlClK4&Tw)z(###x<~QyDQ7LUmw)z(6DE1w)7J(x~Wj)Iz_m*>R5UQAx?4K*_3sb zw^M6E6WkAfu**kbw`xxISk-6VjgVK^dWfCECFoMMCc3lJZK@^UP?@TDc+;!*Ud~-k zhH#M}$jq64@K)Wu99{g9)i0V|>{;*w8QaIR)y`e^eed)``=Z#J=PWMI1j6?C5|V=Q z2ZGVCJ)S$g=S8fX=nXh$OET{h=I7Xy8LPg_$rH4*g?VprspLu*zaWI$4k9|b7c>6_ zDgWM2N6HHo$8|k%k1maQKjFLCSn^=6itEouk`inhln4w&#>`y@>L&>DT0{fOIgtfG`snj+(IPuG)#2cNP zWth~g`f8d%_j`Og8qIH-t-L9~I*_2ZkbKMm^X4+Ln~(n32YhfL%I~g};s-r|eow=r`9Wg_6cRrD4N44yzn$mCYr!9uM8!7S}ItpDZ*Z z&dR~zKH1RKF?F(E)(=rjg9%KCX;Kv0{f-!Enhy!{NjG-l2y(wGN^dSu=lARmvr$#{ z!M=v_1=ZA^8&vCtqB$FMkpf6@{qF*Z*R>?Ghg?ux2aJ3&Ni$1n#7luvlN9*}4N3z4qVBUa>Lbo;2gJwt;Pf3*z=pjLogyqodaz(N(6^r3&sw!`l zV6C&aqen7avj~x>FqFrRQ9Z@7&BUELp-;0Uyi6fx$^v*)3?3ValfLreiN);UwHQ4O%?|fc zYqeh--F&Yi>?mWV=@irC&b&_u=yK&N z<{koIAG-GJ0MF+VQtg)Fd=i4hUBDztx!0RIfCnae!~=q_L*6O>_ejob-jpe?`v}QW zOddb3Ggp&lm)_|df_ z%b@KQ#9i9HWFm?GXK!xBA#7KI>F~0)25x=^2W3(`ftZW!#XltpKKULk1k6S_%?pxm zA#8a#F|H5XHDLDL{Jp0CDZ}^ERN`M60mp1#OsK*pEk1>+kK*RcRZK}{BvUAG%*F9n z8T=nY+Wj9?-29)z#Qyg~{r@4o{@)Mv-wzeR%l{?}A%N)r=0=!*pVWV!)c@;GszDvS zC{#o4dk(NH);$MZKTODA+5Kse@m76=NnX1hF8n)XXanKL{o{%j}6l1 zhU!iG^Yd*L*#92i$3X@^vnnG!eU`F{()D1LHB9HxZ z9g@(1_o)p)gZVuXt~;wuptYJR>3i`ao37x_d|?N*)GGpOAY9AEaHNq~#<`&S4}DHU znd<%PkWxu_EjbSsjPqve1YP>2thNL|UnOs>|)W^IijR1+`)CKz5Izq>w@26FctFw<2on*B|VZq?83o-B14P7>EGe2MwaP52NhoeKMivxKa&Fpe0ML>MlLxVzdky~HKsvB?Idk*0Yy$FW1@B0fV3o>%DQ*U<#-c%x!CP=U*WfbbN;uVk@48pN9gpc-ZoW=rp$Kk0}$ta(q$EkuT!u0SUF6dMT;UN2zd=ohXMVF8)E)o}e;!S_g zjq?XdFu_{QQY!m-k93x=rWH1YM)`Ar^73EIaL1YYA$(v_D|b;+@9FGzyWetr_cL zA~=QX2BJK$&TyvCXyAa+JGJ}4Rg~V;hy62YTD4pZgU4eLgj_Zo4-fVxU|#IjK7!FG zQb4cVHVZ4A>viYLBVCsT?!pcb)JX+7)veaT^$t5N8#hk*s4173w5V2hxlrnrt;aUP zzwgT*2qjlhgc9<5Hqh(#ReRRhk(2_&k(O<=Wbp@^P=ji^{#Sy&F9nOSV}xbV;rpKNnw~ zLY zCjZXTClBx?5xus~cLoxL9nBF;ZTGTah*g2($}g8mgVq$s2ALW-Am3<5w9-}R6p(p+e2aNH6^d4=3KG*vQkSJcd5OU=rW$4<%9Y#Bw8l=C zFP3>Lmn$Z@tDAwjH73G7C=S0SpjYi`JyLtJugaxl=LZ|AyIpi14@v3J{ju5mEXapM zF^PB_R%$)FM^-1`w)??pn$>A_T-94O(P-Cp5t+1Nb9UD%Nq9WN^7bW`yWOBOUelYa zZE~o))nn9FbXzlA|35ruTvs|vqQQZf(+ciNCgthnsT|E*bb(3WT2StUQCk$qOl&Rp z{F`sYAw{Rtz69gb!eP(F(HyL6tMb1ux0wnIXHb_0%>k44C>Cv=H6_M_k^lHc&?vsb z(6>TKr%$ggrHQ}5o;>M}uM#GW~fpXcSfpKe_QKVHCb>-n}wP7&^#3T;0<{11{x~ z(Ur8`oVC~R-z<-+cT|R*J1jdcIH%}>$A|>=_g)v_Z|BbcIqrYG$04u< zSChC+P_Fh5`~Z+K2i%u$(oLR!!z$o!zJM_n#+Y12?egO8L$+?thRC-v7Z> zj9l{srQ&7)GDiKyj~kI|6=OiG)%>5!Z{YC+)yCMJdf0cQ{j3RdQmD@rg(Ham`v|hW zgBc~JAb@7r7%Wz7IqcrC0^Rit3H)}U&(GkZ+`neNZYSuiVCIj4?q6qxgQXLU0W(5e zCvd_rw+>+PX&PvSz`4I)=Dd+D2nvbmtZ*{ZX+gdmKuFDidVcQ?Xzj&`Xus3C%w{Upyf?1^MmK(Q zp}+b1ssA;hyV#eRuM`CFrz*y%fmRCXM43rzv_akipqo{gE7-KXGL{D0@7s_)DIR#{ zu z6kw#a#Uvj;n=^O^LzuFko`}L0Cp<+FBBp%e8mi;^(l*SuHQZhvT?I54>#H`+E`Ov= zClBI#JV%8l9oI|;O5abDh=YDxjmkKTq~yZS0E^KCL%)q+qGgD;s`)CcqP1F=bp63+S$K49j(cG$!U(t-RNrl+3W{E-Ue+TC5*6mw%)IZv-O=!Q0U_8#@PAgM*+Mz-& z_FBb{VzA1q4>q;G0k2vt!drEwGmZ0Oxc6-V`*}>)6r0niGbF|YVB~{RM*sr)sxN%~ zDob}09Ov~>Rd_6Piu_q%u^u)yZ7h(x^-sY%S1mnTXQ6cqLwxyUZc1hyy<2^@ast0v zxvi-UGtL`Z>-0BDpyASb9Y&g)JS%wD4+dQ-$$DK-Dbpi=$_<1q3<2?ME#zC8&cq># z3sFuI43Dm)S+Zu;!|*6$vmjEw`?N`PDv4Yw)U#pXyXle2wHqw&8{2c=L}Qqm&GxNd zvkfKHy*U{dIgttXAi9pQHDZu9KZwQtaq0VEQ#J4JtSM!V_1X43hk-SXhL6kqY*^>^3-)PEzE%U`N&9B;weW;(l#@Z2gi&%0d`w~B)^JI((+VJwdlZbg1 zy@?Im->A^03%+@}blO(S_nmhK7C9N^_9MIiTefbP|&Qa za{w61>o({*_fiIn}< zxKNmZfa!K?B}1AD_bmQPw#wyaSkXvm7nudqAfN97Y+ctCsltYr!tXQV5+#!EbesFl4&aLHzjLxKfT770duBK60Gx4p8X?%} z{#)dDw;+wEu*VvhJ(oZ4DS!E>Tt~0du3aB{u(uU=-6e`uM=}bld&L>xK&!R}C^B#; z%+9PjC$c23xEq!`pHCp0CQ&ZWelEsN*0 z$kj*X<7L7F8NIJP!`mHf179m_=u|p>%gGz*v(2(jaM+msMrF(`s0o=12xGXwUyF5h z575ImBYK|8v`_OZS6^urv%;amXE}IhVc7rNOO;q~Mq6d~Gq|X*)-yi!{p)fPI&(U7 zb`0w2Tou!)O2eI3WdnS!nE|o- z_g~}OgEnEFas*73jxI@G2WUnqS?#)m5Wtf><2+>4$kZQl?qp{uP?C5HhM`+=*|v_*o`laj70Yvdi3(W*LA&zQ z#JoA-$3MB&K1T}cWKrCy^TMhZvYoaOS!uvG?#xtJg9BWlK$pGynE-)`c-jaF=I;65 zu?e{`mKX1k1OIvVV0QVMkJ*;AGZMPHo2rI!fgeGZ>we_G`HC0UmH@Ex4%9nFcEt%e z={2b-!vzNJArkr@LjzuwRsg>I=5YIU3MPcJs zfT3&lk{_*dOKVw%+)5ks^~JtK_g&L9jEMG2T(X@z&-3OynB|ORi+9^yH*6PT*C{4 zZR|@BFMb6QkmJv7g{(7(C&e;|l|L5LeX8joHOLXs5GBEf*SH zlC)maBi3t123Rge6r>xvU0>f3p&cl()U%0EP0*%GhkO&aL9DW~b%OPuxd5VeSm)iS zu2xCSH=^K7U?-%;ynn@&g;Uv+}2ib<9+vCcf*- zMOAl|1PW@ynDsW^l=Xi3-8RjH=hOGb0UHwFWUh;GCv-{j40QxkJXZvb^j0mdn_Vx5 z*IC#OXm3rYm2AZCUJh$lT4zazQM9pq0m7mgYd%ymfsK#`QGA-ZmW+;dF}kIDY}!>c zU+zd5e9migP}VSJO=&q$isAU=Iwh}Z@^z;J!Ah0S|3jGhm0k9E(z`fT-wc&$Q^yps zaQ6?IN$p+aO>39CH1*t!64}@1-wvC1;+}aq$W^;qX_R)PJ^Z0_;wY3x;d0(Aq#N!h zl6IFwug}N`m0)O;8MVOMTszgbUUBmj#yR#iLY)Y)DMJ3OuP+yDE8O;q%j|J-)=!p0 ztQz;43EZitrEMN67$bj(OadyNDSPsF!6_OO#Bo!oactlc5GRHDG9m&wY#19si~OnQ z6;}3#U&+_JC{WS$Qx7B=7mqYBB7^O$C~Mhex(mgdpr9Z9Bg}>bkCB}L}J)| zrrHi20n0z}cs%BEVeelrLCuFlMY@<5^zX}={1;w;8ifZJeDdN5p|d?|&H$1-yK!N} zBp;vK?Duv2`J>~ZaBw+j)U|Bu^CN$E2OYX}X5GJU9W^-)wP2{3ckp)TvQPD<`#%1u zAdE;pO{!Av&P0(fe-Fm{y>6({2e2=KPt<%ZeEug5Q0sd_#3dn96@>txXn@Q|Ks^A| za6528DxO+i_?;|X}ErA5u|gXFI$+P-+lc@$F|NrlqE@I$*~ zX`J6r?)Z=36Hp@@z{x*F-+qyJ6*c+}2^*BrxBKQK1Bicbf#W}d%Rhbyo+q%D&k6~k zCi@`;kpJvS{aMq0FZ};43x5U4Kwn|6m18(QiReYO9zaHS;mtf<>h$|@AL>2ToBehP zITlCQ%Qn63B!6%*8ROR~{KgJ#f1t=*?avwheYTKy z`uoz@ww!+Rp{_fBS51a#n1k1FM-vuoQqLc(NVe$Nakl6qOKm(wX@61$s(E4=x`M-x z+W4rD9sD%tbo8CwE7A4HUj0T5uR7z4@cH1F44}0VJ*zkkZ=V=|AnrGTi`6T{iJ`sW>7}+=*Y1AE&opq#*T%h|NsaV$8 zl+f=m-Wo(`xEO4=s@N3Y`PzZc=CsJwZKWaeB2nw{4(7DkOTk<*>W!alG{*~_T*iM4 z>7{Kw>!o=d8E&kHlY$-I#zJE@#d&nl(KA=zvT#95WQ}QN=g9*iU6071rB|r+T|{vb z)sGS0$YuR@yn%&|L1gJMxAmYpdNdh-0kKt(XH4`p%6C$to>M0hZ!dm0PRqA(;55Tg z<+)R6U}qxt>O)iNK?DD4($T()s>9MNW;e^Xg4&E3<9&K!OOH*yhEZLKeZ%piOiE?4PhI8(oTe_`%& zIQXf=pvE1;edJUE?ckzk6rM%X{fZ56cF5nCVA(AnqRtU%9Zrt7#XGn zB@1E*p!^A*w3G=MOiof(3WTXVA8BFh|F|2!hsuv)et<;yYwf3Ns3n)IcxrOL&;A}u zQ#e!Zbb$+D$05y}@nU#C?~-iB)?BQmc)(*}m7$@p%4+E@jrZzT+-jPC7_W)v(YY0O zcOG?3PS$Yyms`z-HUtoU+23lLE1`a}D!D2@rKUC?VUngabm5yj87fa{Re^-aXa8it z{^?TqJUrN{VLPH4)Fq|UF{xynxu!%@)vO$P9)Av&xG;{Xe5FIF&^5{8OwA2e0Zr0y z&z8HfN8cglz)AZUW`T9_OB8`==!*d?gYY1d2-tT||8B_M|Lfz{z;9_+pHo<@(`t)T zEwLDiTrAWJJ8IbJ5YkK&>)wsg8^o8sXQ^}sJmOGAvaj~C(rax zZxEh!ze)~EjCC5PNyYx&B}iao>|2lLXgRZ~cA{HPW}M~7Zu%0sk#$aObE7VlRvo)+ zb&8v>a*VD|(4mAND^zB7llj4Hy*nr4JPR15|JJ#Gqq6q3UXI#jNKq|CU9KsZ#ja6L zXL}(uC!tv4{E{GrhfXP@ZzxUpe1~y3;oLZ`R&@}2^B0`Yqp*Si>tJZ%F(CNo$EP;@ zpvu+Ndk?oGPSu@m$_ug(Xb6avZa4<97AGgqeH=U-5JDN_BLIy1mhD6c&Omo%u5IZ2 zQcH>)7#~`Am4NKOWH}U>-Ojbbb)N8ih?G2@{|g^=Kl4OQx8EC_dLxRbPt8wnmzno| z_)}^43#9%-p#)lI_tn_EdGVrNo-g!Dk4Wl+#1n^p?FqWHV~mH_jU-|Q z_XiM<@l^C70#rSaoBXFh^&hbVEf3O=6-;P=!NM`;OqahFm zWhu5*Mnr(zR5e%A^#m2n!e1|AGV7FUd=9+I1l7z_r{O1<@`x2Q{u8p17h{dL#r3w5 zA>wvF>}T$={eCy`D^heQEa7AC2{a-(C{5CU=w5-_-lj`njm?zuOm|iosi5P{&I}bc zP*Mp!daxuoVxL!Y|46Ab(UpOs(7!-jwP5R#x9s$`+;n=~+Q+_0+)G+HtP~zQ5T3GYpM$#C^^q%(lxKy{ zjsQ~6y&>m0ma>D*{!P8)EdXD5_nCB5t%b`U{SduJvas8ZxNQ&JCorDL{m^U zTpxxTG$Mj5t}776tcRSY&qOBMLQ@bvq(RB6z;(xZ2MB57t(+a}6<5c~ zKy%VgU}^g!1(a}su@xLVkwgsI*~9=D#&ms=9SMf?tnzz_?ws4LV-7=zN}?YK0`|cf;i#y zs&#DdfC&@y=N0P&(eHjNvr7?X)t} zmC=H5b()#-HIlNRHO@H)gjKbjH|Mk5&%3Kafdna*me<6f?#lZqMX)aB6`}~;#(pQ9 zlM=OfvNzF@3@4GWYbgQCU5%?WY($@ipM>+a9S;(pj0b6Y5G>vCB6;S8qZ+pb2{H^|r>yVT6_!tO} zv%D`>!(^@M9YB_-XjeN}0p!Dz?>+f+slaMfdd2H(7463hcPT6XOLFw5k_cYaQ`#l2vb ziBf7@iszLHBwdBW5nn8H>#l~q7?0{30w4chyN!yj3q`%*lGYKbhHAfDfBC4_BKkIK^>$xElF157yGvxQy(LwiD^gX9i&&IL;$P%vK2M3+p<_;&6Y;?jtS4OBd z>6|&UCgqyH394}+eT61WS!3sVo&$NZS%Ix8)$9D+I%MLvPh+Q{?I*UdRw#NLfhv#2 z#}UwA70N}!l6nDBNDKz!KG_+G&hox&t`S!IsXz!a-?-dlO}(~qq??BBiXYeuv>Q+M z`lV<0>dBLD=GGEYsZAo%{7D@nDBupqD@m9 zJju?9To}3T1$GXa0s)i1nU@zQ=Ir%27}MtTJ*s7IXtrFrY4my(^O^sKE6@Ro%wAFR zQt$6?m{Wc{m*m|{l^urG^&yyF}Yn%#6n>ttb z$|GY~on3*I$POqV44QfIx8*~6WWDdla2SQ_n{}lJ7@wgG@hldoN{&}OZ3iNUa^G{b zZdpH{P0_#Xx>=AF}5W|P54E(j!# zXNu%=8;CI0+f1lbQ9;e5SCZ2tk8J@oy0b&w=SdntO;&v{N|FyV6Zl;l#1 z*38LHKX>)^;2YFsLDxlPN0&yZ$a}WHS!9<#TbemeqNzm z@&fn)2N~bX-xho272<~m`TlmuSkU)FR2g*6&_(%EV&NpuwDAtFGtDdnQ}zWkGvtdr zZ@pG9wvULz=5mZt7w;5`9PO)5l=ZzlEDn}gFTuYWaU%I!UEYSz+U?XSm%r1j~=7 zjk!&gqE>!h`8<&n?rp-KOf4_ zfpdXp-ZY8SZjI6SCGrAak>_h9ia6F$q%=x`sCbU(`1WniZ#jftte^-k7olb-{OiM2 zVb?ofq;69v1tokt5nbZ}+Ri7JqD44fnK2s*Sx>gcd?0JUcV3e<4OYTxdeP-KN`N82 z+lyxU!q$hgk<)hcV+YELc{)nfHikDY#*Y#bxfhqfQEj-4cG#F1p7*?-CdGMcF<0o` z%Gr3eXA(w$gJSh>LlKhtb*5o9u<7NWtQ~@hO4Vl&QX40Uas}^|!ZK z27?Z&Ktfaa%}at#M-3CPU!sQ}EC%m3F_B7-ubTlFC|}UH9U>?DT|bOgY2C5P> z(|sVVAXLsC-Itgx;S6D~&5wZU^{^+bS3Z(CtMe+TErkJd$ehz4mG9lnDcuVDT%amT zHF1&Nq`r~qbKhV0>h_1Sdi%?$J*b9@?7{lZzl>5R*~x6*%yV@>3r{_`r;1K~VF8*P z!f(#$>v@nzv(?=_0K{@r1TECBnc9aYbt#kI+WxziiRmz%Gt;+I*ktH>2ule~Oe&dJ z7$?+?6u;&rHy_6!o-}x*_kn{hteAANuK|+CgC=ix2Lc;5+XjL9x6A0cPmM{t`H77m z#EI>q*Nf}O^cDA|LrHqn{Rr7^>ly!eXTV|9Ot4@hRdo3fSNK&Jp30GcCDpMnZ1h2P z^@XK!okEnsSCu@$foam*8{9x8fxC)9`Ra46;glG486z#}b&hj`#p~wDb&b8`@9srh z@=!BBubNFa+pe&Y8_7Z+yP&~;q>^9p1+Crn2^or4k;@)n6OlLogGXJttix?Lu z=C_-Dh>?;{Auyf)C0sKdcL%rl`5ha86OYz_B8cE)ji5yD20S&u`$4}FK1h%t_7%?! z1u7o=W$$D?&@&03qu__>DbMI9X4oIUf20oJ^LYB)YgLNe>`qi6ZfY+OJyir8M(bV} zK@A&CbrT@k+h_Gaaiay+o~qu*TXd?A(cepw{S-Oemgt@KKNE_*mgrX_;Xdkj^TG=c zRZua1qj_oUBifD}p7Qp2>SewZwr;@MJszIZbv63T)cpo@%JE;{OWX+&l@T8RHswU+ zTD!tgoW);j`wm%K1IsF%QqhR0k8_`|+RV`2mNo=g%Eq5(NUns3paC+5bchfXpu7O+ze-aA~0;O$W}iP`49W zMks&`5Czq6O(cc|=UR1+m`irCbSzM^)UX2M7%SWWQ=NIE>Iu)I;~yO1MFZKwcJ8|p z@MrU>Ic9+p9EG43US}XHj%OsfhXUJorp9e|CIchs_s$VLM~Jk+oj@$0jMA~!s?;kE7{-(3Mu$Ky z*z8NeDIzpqA4I@jeWRd`Hf4T7@z%hCK9-NDSxr0^W{8d&hL}F|FLVN{iZThluxloL1mW*e?et$Q8UVSz~xnXrd?)5kbG#MM-$d8pEeU zvmq=lc=(NyCSp4vRWL{Y&s{5hrf-r6+g04n;KW#Lq<(p zP>w1%787!AnsU^#DNK2#;?=veOiJzbxYi99gdS6*SXA#AE0xA^7`>ux1F3RJBvk-S zeBJ2$1hm_qJ>VqBUwb@IstR#^N|OUbFND-hS@D#Y#n|XWPgWTcnBi@!1>d`pjhCq! zJa1wQS8+t4Zx}9w<1MO>o_t}6hod?1h6MQ~JfF`kG1&D55|FV9JaPUeP~^;;sN;?Z_D4S`oAzJF8AY6gC?EJ5$vy zdE&*H@N4hP^U93@Gk$Cyt38qz*AChGm$#j#D!Tl-$qxM6k!F>~ru*l0|U1o~NF23UJ`-ax}R#7@@kGIh*x=ped_ zieR@%{$ZbpqN(SD!` zSw3Ajt?cr1e{qX}rp1Nf8ohRrBUhT#NLHO}H+$6-dfm!WU9`hXLaEF7+X3T3)Q99{ z?;!J+l}dJq@0NqaZXT$WsBmrpJX)$V%w@aAfEGi6;M} z-6B4cUvt>WNOSR*?1%d4rEch=$#pDWs@~I}#I2cxhFc_Yg0!JV`1~4Pelv~pBD{<$ z<;G`l$!|hEww2~_cN*Ne&AKsf*v7Wu>%-a2$;l48PlJ@#Q-DFCvIj ze(fyMEdBsmywlEPoaKiMeqStV!;k$&^T zrhKI+Zn(c)(d%lo8;s4YRgemesJEbXEqN*y5Ja=aJC;>K<73=1P$KSP zNDWUNXsA(;(@x}hl&?s3c(IwlWpiHjncpl^INfp+c}8YDk~8x306*NE=;bK-H1S#M zg+PCCBA?3ykeJS3JVEhMzBSu*?aA^*3OK_wFxq~_!CwpAQ2GZU@{hIleG0Yh`u{I`-4s! zp=mHu?@5sPo=FUym6tVa%RJ6K|e;fcV)412mb3IOr(o30rgHST`Zr%Ucpq#km z>ge15~Gpm@x$j{3o{^SO0G?;_gM#|J%Jt z5k;gtAs5@~P%WHKjz8cvvNELgiJ;sRtKma-$x?f#7=P7+F1jZ9C>_YQ2Tbn3FB^m( z0UUC9TywuN=UB;BVAnHFZeN!t<;wFwdbo-Rg=!q)D`!>3Tc;U-Ac*lbX(Djx@`EN- z1N?HE(=sKs@~o2JoV5ry1xHH4Lot4LOaRx#B*=@)W@BMf%quW`&RlEa7YwpM#b+_) zy{G*Q7NMK~c5NyVYxfB~PVg6_KA;5o=@_P;A})0!ezH14~q=ZDFq$-J(9tUd5G zfjr@3z8JLiWZ=WnuSau5NMR9(BDj!|yus@p|8o5~)_+J<*#E6^YT>{i;2^TzdGJij zKI%$28;TJV0UKl9th@{O{)Y58>G~%*(TZ5Ly)zMPoVxb~(A*$zh3uU?co478Yb*Rb z@B}TOn<=fX1c&oK%W6Wq-krLcX9~7e39ateo5-fe{h1G+@CD$q(M5BNOMV5NYXlu# zauPbH>kY?M>+c}pO5Or>Le(y@D+z!PKu772In`DZv^QAlAO{ABV3!ta9h4QgPr0Aey6A8z@OkE0J|9iVc+>3LjdwK_BSQm zckLJ1=$||+TW&Dacg$iz(Fn>6;;mTZ+N?2bh6H_l7B39W4St&`kGiMeL3Nn?>(iY7 zpFRz!xacT}lGwsq%O{ep8S&J(0CS~_C<$$Cw$P|I8sN`yMMs)&n9)n-EOjE&O49Yw zh2V!y-Zps^lFk8S*el!1XmsR;-CYaS(JwC@z%J>t|8BS8yFH_jXr?j{9m#851#X8p zprGY?#u|yvQF{awb`_vMl_%@JufnsmX81J+8~Ie8$Ykobb!#No^+E6~zRNiO>?kzB zW3J8&#UK;p)$|((7@t2T%HzhLO4`mqT>J__U|0 z?Bj8k4kR?ZZ^<+SfW1VW$JWSuDsG=lTQ%lP+p*0o-&6JDI8U;i0+34odV6D##73$s z*Z9MOd}Vr>*T>E$UHdK;r{{Y7y|SR-{A?szOY%O+!b@GOq!X4cDKPpQ7$C@~f{&5- z$nNixw~E0#PM`}q=w=Pv3}x%HKRY|VQu-*_E~Lgm*vw$(lql}kx5 zg231L2T5%ICsre3{XghZU$RWlB0|9{&hJ8WN8F)7g3RT7*226)6qf=1*~XP3ULw@7 z9K0-objk*oAURqD8pbz~v;t2*5elD)s%d2hD~7ap>WAe!+0uv(*d30$Hfi(6m!bhv&2$STi;=K>Zn(YcFL#rC#olhYyp+{Y1GzNdqUuS#z+8S}3I4GK%!~EZ3iU=kfg68*{_yt=cw}e}uJZSl?|@|ou7Q?;5jQhc z`|5jw#3Np&u6zYOZ=`4K8$wE*SqwB0f{3XYF16t$; z=uRld^$1N_$G;h^L^d-u+G%%(eF~@MlH(qN@+ICb%g3ny2tWpZC`?VZn-;ukeJfiO zuh?B?0)y`nmGNPE{G#A*e|xE0)6bFkLpS2}{%xxb(SJaOjyJ^7C-wMftn|(z(b%cz z;#liiW=ujhmUwp=bf1l&Le^sMq2Ujojg={YI*ku^`AFPAA5bbkcyr-sdR%qpM?|!Vdn{V*SyS z08WU>M{mp}~N-lykN$yKIFsRY`Df)#=>olr1{ zd9u5+r2}I6(L#pH{>}@@6C%CxeUOF!L3IXi2@I*y5%#ZwmeHpQ;#+#$4i)Mv=gR6X zpq;Rv>|JJ}r+1=!En(E$rVW>!$e|LBv)uY5PqS?}-igNB;5u6c7=5O&HSVsv4`X>o zov|Kasc5=4I*p8hso7kdx`!~t|*4anw-#W)=L$-yE4+{_;mSn2+ zTM6*1Wuv3d;!<;G>eM-QfSepjOF~8L+Ch0AM#Y)2EHHFakPf^7SuQ7lNC`3XyRgp5 zA;l@pcE#p&Da`lnnhO&0hyL*@B8-gM_+4jwHm9e8pAt$L z%W+!;F1jYu(pj?v`q3tSJhy)X6>@Zx%k3U6eQF0cLk!>4A{|WN>TS$4?*tu(&y2WICEHm|s=eP88TI^9Y!TepOG%R}lS6nn(sSORkink<3 za8iHHCmdc(vMhaO@oFnvSjr}PvH05eS~C|FL_W`ow|Tld$IMN@;jld|l$hlt6nXOR zoZei_qe)Sp$`T&GFUu5;Zl0Z!pl4;zG?i5@n}}id7*@WsaAz$>VmGs2drq_=Xg^yt zP5q6>EMQjr)V9B;zL@A_OLLkd`u)3v5FB^I4iw*xX(~Ui$);U*h(QNlS<3i++@a5+ z0W6{A1*MPu6@&FPp1v_5O0LW@IT|YEeo49g@(@$}b}iAu>$YT51|?w>3<4)9GU6KQ zRL?nOq$TrAVRf!B7nzgK<;lg6JlrqrBtf}!`93kU*)-ewo#nzY8^A8+KOcsWCMHB? zRK9wQ+30s>Qtz_5(GqZQcpYXMh$4vTHA!|;3%2rgCAb0n0E|2_ddu$^lFEhKg~>4w zLrKF-9siT>wu5}Pv1%%f4PyGfgB0^*>C=Mm_rPAxhEWx(pxWSw?tp>U78qr@=I;nEC~Kas*{M>{#teycL(a zxA(^kK{9p6o~yU_JZ8QH{F+SjCm|v0@qndR&-QRu%WD5AnC!c$3!olaT@Qh;<-6yo zTk8(D+3!(6X~CspE$r};Dn{7*=ExXsRk{zPz8Cm!H|Z5Lvu+z1D1-~sf#$fLIeP4- z8!g=X_tUCcn(~}+<&@Ar{(5j8H6ECgRrl}Q^OXF=`{PN z&RSfL=MQJhMt?ZZeIm-zR$6GQO8(82bjFd)YllF~RmFdmj^c1&BJZ~O%rhw^HX8iR z#g>Q#$)IoSW6NT2(N}a=G5Te50Po4#oa^A0y@&Feadwf0OWjGAE6ypbo(q~6Q$@_K z!)G}c35nfXX^lH@m2DdCfaKp=)|p|(L9#FogFL2H|;~U zmn=YhkE)|3i9LlZC+aOs-RVC;+6{t~)(ID+P9B2$uOfV?csS_Ruvf;S4y1)s49B$xP{+5Rx14%lB(QZDu-mH$Mmyv$y3$@Z>FGe&=E zjKGbt$?q>^L0m|qe-B&4bPs1TMn5}CV1i?wgTe!aY^yhPUxbq3S*FN3DJfUbx%6~! z8O4RbFOczbVS@kNf%B;480P2(yY&$ z+A2e01R*>}9Z)<6_$#Fp$+K*VifIuzzJ*=Z7Az%re<4VE7pw2Bd*b_=*s3^44YJK6 z((@I+Nb9O~af~8HA8E34?xBrzp(5T^_@$@NE$rOK*5w@?j1OOYh`872X3@ZiBsgO* zd>~QXL)a4qYV-h|(!{sC1e7ZI^vmt0+>BZ8HHgHim;*By4bYwhS{ah+RDQ~)2wysz zjbG7P5$iFyDl_TLYo(=a8P!t;OHhn*9Wl~5vh37z|GW`5aQGM-UluAV(IijA+)#eo zVba5|_)T&pk)SoKOW`hNa_IwVQ5@EUiJdj;Ii=);1|W_cb?;D1IxmTOL;Vm|*tJ_! z%xWz&m-U9FJpvT=5TsHsC)4yuf&EFsMC}|I4no?931Rsdzsl*};+6GMRQZMrZ^L{H z+I8b5lP3)tZN1Sit=NP&ZR7RxPFU^5TtjY7*VU}%&V9*YW&o{(;O|S21J;I7Q?2?p z&bCltKbMRi;$y~+eV1t1qcT|z;-I`x9GIpev@~Y~lIBy>id&?36gb@FsuCN5(piWn zkD6MLR$C%XYXwEl;SzvkzK+Kvg5oWlv@vKGRyN|LfQG!FiXviw&k@ai#qe!yurG$R zCUQ_a2RnZw+V4#fQPq^?JAjF_cCPN&NnEGUNa3^Re$p8j@RoP{4?4@hUcAWd1FD1~ z81-o8L!fneQ%=w|ywsw{mmKm-JXlU-oPJ7hCft=AbH8h9R|gwA*xdMn4i;hB}GLUKv&ofIXe)XZj-l@vtx`UzlM(co=$tA}3GVRmKIdQPFPrd`vc!0lH7 zP4UO1%2RRDKvh(zsbMnW$@|2E!aJuLHdkUfY1qoyTJLcCgbU$^p<3c*!>Pk*XvVj} zf-!|rIl{zpk6%Czr$MUsdfcWv+v{z3DOd;?1`z zSy+(nH+z!JLVYH~OsVDs=Vy4zyh>!(lb%YCH>}taaQuANC*)hxvAd$YMOn4||F{4H zih+5y;YE5VnzQmg?t#=`_{jEToqYY(9kT74;U2Z0B!lUcX)XxVt6B>5Y?_v>Ccv+{ zT(^GMlBGA!7jq+*J2vf$z@?d>Q`_I&Y-O*kBI z_Jm*EcT@|#fvp z+E(}{%7GOUo1$C`Q`xOrYz%`W2J!NEwECzrMc#7%pluuB&PL2NWx9m;F?i(60^HZ``CbCu-%Ni@%xu5 zfUMfw#2>XlJiVGlYpb_Exz4KG>{z39$Xn4?u{|6#Rpc@{LolQEPLE&{lH&{8PO5;h z(WV{VEDShb&Nn)l_PKIj>Dn_f^>ZL1%)vWje&ge#rB zN7s1bdJg56V$pLGf%jLzmj{@%e1j{?3G(kM<(J<*P0-M_ghy_{66^oJ!>f}kSB=g8 zi5IXOIPWUIC%w&8n7-Sm0^_3`TbNdBP~v#=(uYlHIN&YY@(VXe69PNImNEHNDUdnk ztV2yfbmzBS#+q1Q)-gHE5(5iC(saJaUZRY7^k?X&XIIb%-B>1Bj!#{qZ?gPOO}mT) z1qcsW<6=F01i8B3B;2Hv&boKCELZs&-qxw8{?B_k_zBFSrbH5#0g~U+e!O`f1aq?y zg3_*}10zktag#azn74DH2m}|ky0lrlL9UDp*kye)DbWkvyY-<$vV672?Dz*!xRth(D|G;;-htqjf>?q+5LT_YU5$Hk>IGj}-GO zwUNCMfoHJu=%y#ko`-fj?9pj1_1I~iJ!eKO4$@Y5ey8)aTb{sjIgFr~-C8SXcdaJE zu%V1vh*XZdlg4#^#*UP z@M;@J&s|kB7)~c{UDg@;${p5qT_{L=Djh}Kt*=w3YuGD(KC$2T7{0%gy*u`!9X0*_xBkf zh@O&Z-hhVOySfIU*hjKn6KTlOq5I__wV-P%pvaG5TkKCyp8}?DV%belWx599mNz0x zQVYea0cv+;)~@$l4L~cCVDE18feLxQwb{|<%Y*o&$zRe8e}-87j`dGpZU}uIuF)ol zVR=hcyLkO~4((sFhF?tZ>{~KZN>a;>L^TKY97Qk3>a~IOgvgLt`joc!me1LBgiUaE z2XCH*`U@o}epV!m!j5h$rj5DWhMNQ*^vD>YiM+aD4^_W#;0Pnw>(;xfePn@wnR<}@ zoM%lPyy>Qa(dejFBDkBqZAZZShjn*9=p?;hQRDbng)GCPc*Q-Ym36C)q*M9F&2edd z@;HucZx(f0wPJ4V)F;CNnAb0_u&I%wg)s(7eYnk zFK>n6TX2B5W8ByauQWk>(ko-Hdf7BtV|kod_`Gd^IOBb|mZxJR_L)l5&BTdf<2TU$ z9;D*a=F0iS!_?2+U!i*_t5^kB{eY;vN8JP!Ytf$ zoCe!zlZ7?5^flx+`oQ~XvxrM5LJyz7=Z^`MHQc)Wyj!0v-G^;8YI?oh-+6ytmP-6pGFp}S zb#Fv!u=eEKtM7H%NPMkOZz7q)-L4)kk^NJF-zKKQuRX^dnYU`#=M!oeWL;{0mKtkb zNS?%^?uo=#)qehf(YL>NT<|w|7ORg6zCW-+_LJRMRYk9`r`frKw_+RswI$e+hGDH9 zs5kZTR1NxN#WL|<$~-G`)H_bGKcvJI7k%c`9e}Ov7-ge@kcLPRD5zYLhu=bJu-6i$ zTSK@(N$e0%HTQZEy~XQVF=Izp_YdBy7si#tGKYt%i2Qv1zlh+)%!QL#Fy5v+mo_w6TzXERMXYhV}nRayM4uC6QTHsgY~Phu++B+4_=;i~?zbMkWc~ z&$M;gefQ1;$B#P+w53I&v>}tHqL`oe@Y$KkT>{3uH4N_ZFX1D>xZMq;~q@=;nq9k z><|Uze3}+YS1&ad#X0uhVWh-^Q3+qETjZ@{r-^nswg~YS>8wyu*brrZ68xyP48X-R zh7)D@`XMNiy7=(FCk!b)pmcm|5LJAOzmlyoFvacg;U|iThI*UCr>)}e2h?Q8E&}#F zt71i;O($?okDV#9JEgF^Ac6JHZ24I z#SJ;gBiWuV?$$uME_#eoy>ah`7nE5i%i=u88pbcpe?yoi}59&2~WGqxv-AsYV9DOVn7fYCL}i z-TQPQ2;|WFB>LwEq;W(s_p{WM%cR;*Xz9H!Q5n`{JEnSqg9N&x^R&e%C}5^Lz3l2= z1y>E@+k(vqFBVd4XwYI6OMolPZ!O6K!x z#B@}o3-qNNpMW9p7uK`a(HAdJBv|2aC4va0vbeUkIAaJidk;=##jt}k(jQh{l7vXM z?=ds(W{Z-An#|P^P$E7mdF7(I-)Nt4>7>9_&f?>2`z6&M%t)u-jL?H+07f-;c!U-o zia|lE*rf>2si!iLe2qcXc2%H~<$|Ng0NqTpq@Mli%4`H?^80DzQ=O5=`($JXWP9gt z2-8%L`#2O@n67lHSW~x91(O@9_L;|0@NX9t+Fe+&usTjmfGm+D;H+McAI*QK^g_ckzNY59(!bg4O5ttq|Kc8 z$N|N}_wgxV;Dq12_sr+Zy&^2DR!+UFjMqZpi>JSU!{ua-gZIc7E-Nz2;>JEuWvjB0 zxlK{0t3DUo(^1&c*zO*}r^?2#^Bi0^zH*MbN^Hcq{DQ!#P5#QW=dc|jsvnmTyDouW zAR)vM>atcz9)I~CR|qrwzPl8x5p&kK00|=xs8&dbx&}>XI3lg?(31cC?a%<=oM+>q z{=`1{E5u5y{DBk@b^L<_;)V75+Eo|xFHhY@M;_X?4kqsY{ky!d4M z+XqI?##x{IU%kT%bxsXQv}Q>TFDVd>Jg2grorMcbLrLfdUz}5Vyq+6TL8!B`cvZ<+ zF|SLeN_M$SD{T|4xttOvo=%q1YEs;fL9fYGG>SeQ*EJ2Uv3$GLCx(^=ed@5RXAH5iO@so$PRtnt_7%!gX-ZyM0dk)Yf>|g|zWaQ#&~)v& z*{PT?;Yq3kLC+C{BSJ%<_zrMz-MlH$z=O(Ca*n^%QOjP)_NDXda$OMR`(V;sygLx8 z=vd+hicijBqTlVKhRzrg-ySGNW$HhR6kl1;4d_jf1E*AhzpN2%xaZP*oc zuWh@tqpeZTtCF((M(S-==f6NRH!*MN^kg&Mdlr2~GVy+oOozIN_#HYbx-zT1aH&us zXkz-Oybro6*h<;+)%L7~25#m>Tv7I#Vft23+YPKpUs-Ws)oEYeg7nmZeNN%aJP6?g zj|~9+k!=l^?gvej;fSvj9lWpCNCS}aIL;S8slXDsf*fZmLqQnYLNFkxg_hwI;z7K^ z0a#PW3Y0oCHx?ga0$P9{dUJ&H)K`ua-|*5RlRt|xuTtZG6@7!aKRxkw=wTh8zBDR% z=|{+aq6@fzPYQt%X@tQo?WQLRip(YmZBMX^yMsA57vC9(cbaKV4QA>@KM=!SaGt6U zV}}>coOHQzi<3&(r+v>i_yFP?v#N=Zkvq8tm0D=D>M7n30O#s$iWi$V`%GbKhZ~a> zO28$!W^!WP0xJ60iVAw|5rIpn%;|P6{469Xf2&M(uq?z6-X+!dEUj9-vMyC~aV_yv zYO!ni1ZsN92kzO1>dfFVrg{&eJzm<=O|zAeUwt4gvTHs6lFH78AU5%4rk4UjM$%xB zAOi}eU5h|}m_F~^Zyg~5f*1MIf3)nH|4{pQWI?0t{3Dz{_0Rp&w|5&$LP|?m*Dm9# z)_%fwSW6)_il1e*VV`0kHMiV}AF;_>L(21oJa*!64@|p}D&>$xo7j}n@8iW2OkH{z0_F)%@<5SGJ6$jYNS|YzN&p0b1 z(9VZSb7Xb+|fq392)hH8pPh)_IC>9|W_zds==P`x?IbipIomzoQ^0z#T!ZgA%2oGTY>?nI+C9!hUK ziTEcw_^tU*F0$34`fa3O7Nd`Oue)dIjS+o6r6+s7A_CoMA*$V*`W10$#nnOkpK!`+9#x$38Z&QIF)s)E@nl6U zgko2@!5t7;ijYOv!?kR$rD*XfA`JwtDZ_CM9zk-`E96IePz2-2UEkd1wv;~t&F-kg zA5KATiX_?gx`sNyGggO@5q7ge=Sk1&=uDpU>posy!9QLlw?+XK8lq#Rr;>j5av;Pm zI{-zbJOl(1$eX@rhZ~W2*GU)V0q>m?cwi38UA^UO@Je9b>+>t_+(OZuxfOtjJ@tDx z+-=-_Gs`zS4{iKTND?R^O^~REUak3qWhz1UVVjfDzE3Cb!|i+G4L)|t802WFpRBg~ z!0q?r4RRcbQx10<>r+?8gY&M-WZbxPH^Eh!kC@a*9^d1wyHso<=v+L%`GCy5u7!7KCPgmyScT4!?%MaW(>*(cbspm<} zD%V>NMAAEg#Nqtao24ZZ(I50}CkNuZ6=%K)o)F0+DC4rH87?1PT#z27P4EmpHU7nKEl=V%LtO@CEJvxg|f7+W5pk6A!3NCYzr z^QrMWcVoGt+NzI-1h}4~kSohW)g3h;pb}lS>K}TdIcIz%O!#(=)oF zuV{FGzU@*2^XQ*YyjXn80TNxfX^olbFPzKSjasL!c!^W3+OcJuycn{AdAaxGu@!n z+H_U;Z5Wkw4BBgEmJl`ZdSap8V>%xH+Ftj!@}N9a3Y9upHnaMY7vfq8+In4LLv3q7 zir=s4?_jZwW+Fk0MB7;QJZd0aCDqiZ!9Wr!;q`VwM*JgISB>GcvT2?`K-iWp4YyU( zj#?46L@iSIpybdc>66#0jofvv_{zS#Wx ze$=jutW|fzjL}S2t&K%nbfjQ)BfjkqGZ_d4eR`^P#!I%+tCaIXo)RYJT{k(sj;}?v z2S=XkWvh^`S9D((?!1k@q8#_f<&O-jaHf?DpISBG@TTXiDB+6}3$=va@%oeVPRSLz zaa~W0y>tmJLEUa8hy7SI#xcu)vz`}2AV_1BpMos)m5+ntq@mp> z9DaWg|MCd9qM*Fz$?$FH+tg_CdeM3pptBpng#m^7`I?D>QE!*kTY$7d6%(B{=unY?`Cboz1b)5l$a~HU*F#-5+!l{tOIk%@2>F zpM|?mrSyzvup2I99#}MZ?vMve#o?#7XJx21y?SBo#N5 z1hDglH2C1A9U71DL;nfs*8#(Sv+>e*crV{LL8SOCkO0UIPv!TdYBBn?iQVV#D+d(a zr@eWP0_07_xTgB>G5YC2S~PwY(rUyN{@GQjYy2G|RX%(Nq3d%@6sQF6`@Obwj6}+F z>-}lMx&(*xFk?%PPohtU)y`CJ`MfN;@VlfuAKbtPSE%?3^=1o3;!LeHhdg$u^|Oc= zdR-BAr|^x+o5Zb}QQyBis^^HCx6MtcZ#Yl(-TNbW&b?>$bOOVvx=>tFI{03-*t4ih z?7xlz;iLgieCmLua*l#x0!iHbp_upeisMd;f+SVZCE+c}9R*;1&IRPjgL3tc{|t3x zvQJ2rQ--5_7>J;_ReTIqamA(O=&-bIQ{x`q!cV}-`q-kurb!H4WQ-*iKb-ecP{1GP z!)t6BZH~|!Xv1%1p{f;zotl%9$w7u$)r1mUzlO2~H1`48WPvcOxKDt*JlPl@XZn zt2?cVtqv4c5(!8J&qYX490$Fosd&nr^)Q+l(BJ*ekoJtm2g2cUXeu$7wmLk1eW8H$ zsQct*CeQFw<9HpJd+KlA7u<&D`f*)mG<6hKDNB|2CoMRO8*!!Pkpi{};$pbi)yo}Z|dJST; zUKA0-R8*k?ZhP?rI}o|F%|@kgZN zBhc#s3-5JB=-{ibKV4YMd5^N`fqUQq4{kaL9$~sUVCYD<9YMg4UQ`n4vd77SPu3Qte-gB*C zYLvm9psFtmSj~hV0W&+F269#Z1oD_SheZlhOkif*0IqBuphzbRGXVnp_-d6u$)t32 z_fd7n49YaLmVzxfJ-zL;pm~q=)d02h^RXIy#t?Q283=ZM9Smb?O|6Mzf|G<%NRl>O zA{#iKb$MWCa^&15`~V@nz)+>!$16@>$LOjm28~#f`HzJGX}~t6KT?q{{lKLLm2e&3 zfK2mB+`CP0KVtq&oO&W-@|mvU)s&_G(we^|q6h-f#|nLpJ`5LoHfE2dA)xN-eYKJ| zO?wt~E?;xBK7L;vYS&^JjyW#TdpQ9MLzB?P?r_Wr9nSlz-iyoB=~0i_CJucke)|9n zH*(1N?(nhxP1W@^3RwTZYv#qwz-!l^lJ-J{Ik4qLE!Gyhs{X)*$?1W*3YOpl_ekl( z5)DPbOIba7KapYsNbR}Smn`E%BE0xG6x5l5zNOX;K__AAZBZoccPCT{f$=e@b~Fu8 z-u>{HgF3kNiUG9LAaae9d*gc;`JWo1i-DCvFt=uYe@ji` zpoI;`Ng-$jeB)s!Ht3Rf7?|hr{?ZS)L1nsB%zPEc-RQzj$op=)Syg#yAb?m#h-Ag&S8Zm4&{Tx38oFj=q&uDh$RMxi4xS_dL zGfzd-Qoybkj%00{Y-!wk2nvX*i`T#dKqr3nx@fEm8aQXIPKF0d?$Nn1&^DOQ12yns zpVSsIhb)C_iTI+$&$+@I)tLL$AKn7SPGOzP4(v~5Ke``|A%F^H?5iBumMtD?3o45J zP~ui^@u1FEVVVe#c|fAhrT2d*{kjpTOfXuC7l?*fFOfKrhPi}AY7UeJY)QJ7^(Du$ zDA4nDX>$eOH!gqqQ#$0QDq9AGsk=b3$Ad8fD9_Ss ztK3L3oZLM6%qsT|L`UfxD0CBB7NWjhQ&0$ePCp)sBop?8pHOxH>#K}ICq?60FxHXb ztI{7PIH6+b27B=xCSfLx>Re*Zc&Qe$c4t?_r>Db%=iVZ-_7v*XL^l|yZ(XMg#E3Qq zf3?Q=r>pj+iixplJeIkBW#65c)Kz-AeD+uvBf{N=fQm)YgbS4J09`*$bJq>*ki<-g z^+SikErj}ZX^qXZPj~3C{u1dB1yf!Lw{vyp>Q%15yqv@(48_WxUraP5LAL-)s1o98a~2 zt&;3Si9pg9l2}e5aSZF=z{vD}$=tgAXB9->->W0%FnFA{&KBiitK|+i7)rpF8%=eU zm>8y)F5#j$y4s_9EY@*2t2=Z3_z+DZ8avC$)}*})9c^{lkxRawBE;TR^SDhlPzg-w z{1iq6q4S0KwU3e0lE7ykzWne(cY_QL!N=iG>(b2G;GSSDK^El@w^0adWKGlkj|&hd z@_zKhceyL^Pt}-SSq;s!`N#xVz57}0NNH~5dRT3!4OQ+V!DA5$1QJg9F+hvMH$+Z8 z#|8W%xnrRCBe`dBnnwSfZNUj{gRk4i}clJ&hQnS10W;MQRC)vz@g2 zO(myb^vm~H#?-8Voky+LM{F7EUSX&PACQ7eTO~=c700}&V8~mFg)>wPH#ftaKCWo2B)}V$h7ks zPzpM?9G7CZueijN?B_-@K2uf9l4t7qXBJvHFQlN@G#P5lONeK>Tc zljKg_2h_Xv>@P(o<<{ylndVntQ$f|RY$f$TqO9>)f&aJjce2xr8`A9Ki1i+=iXjURCi74^~P&jq*^LeUjZ5Knmb?;w-b)&Fz?~YGpWzKAW|?5 z$8%9|;P}7M-EzvH80qx!jQh(Ng&#R>lA=PuMvAy%tBqo-?{R3ndHbZ&7I#~l_^-~H zSx$=U^WG*kE=559Z!m9!+@4#G^AEcWj-5xNAmT@_w%(=rC6}m`TCvVOIHpJU3J`*# zd;KfnUF?_=?nJHQxyzv>PYD#*_CFZ#cS8Lo&vx9~9lrwWK(|AeW+H}D5he+KZ9o7P zrEw=FLEiabQUBm77CB3W-ZP>e5D4y3RAut)CoJ!;M%|x_)A!N%5o6&a;X|);TPGKw zzCg>A7ks@hN{g+N5c$%DH0GK*LagkgBs`Mj7jS1-?UyLoYP@XVR;SQwO=&3#CgS8A z{IBuZj2z_n_MXq7SQ2n$Lz5hCa8vr{-KB!u;VIt;=iI7Qv+xg}drdwYM9IWe)NH1H zjlIppyR%S!kKT*BqW#ZKf1_0!XY2lmi0s6RUw%Jqh>==zp#} zD5_V$$P&@`9c0E~&^n3DP*nc+x0&QHws(>+c@En&be= zhRLaWjIS8jX3~97t52j!1C;WMM>~$+DFW`I%3R}9O&N5TBw>Kc*a#N$u`j$9D4DX&)!7Eq@W zcMbJ>4AodYdolVwP^7>kwU_Z@S5g+dQsQc3{+0m3$rBb%$^d0DPV|vGj>m@0uRnS@xAf8*o!hz zEFigBPt8rjIPdUS0~dy$lECV~<({P;v{lTYNz+ddWe=39w{egP_RM_`-MMdDCH}os zJRgT;87w$9Dl3BhrTit${Z>)5yy)C-ASF3`STS#_hVz7Ytj4yHGtYoyuj-oKG|B4zLrLbsY593z#w4IyTCjT;7K8M}(I9+qIMgI_;I*)ZXA zSi;e6dKIPij6FPd;5#w1`@-cD2Ca8>@k8_d&iJWnoa`9o5L!Gn`0(gQ%a8M_UY*y7 zYmF+Vr-5%NnW$IETOtdp7T7m6A&URy`Ii)Lo!F+es3?w&b~8dqb3Q-CVQuW^U`kK$ z1rw5={ZZI^i#u?VPGgvH(ewNQcB}`C_eX4G9)YFXZt*@nEZhGC4;x+^_LRRb1a_;@ z1L!){i}ciKnc^+VknM2GAKSjbgYX`Av0YJ12%5t_KyEzKGf*~ail4XbYWX!!Kqd5DuVRg`ID85eqEBgW<}ro#2zK6>>aw}`JyM|W2it(Spux6v z@!oS>DGK#BMC3ChxW9!c|EK9owXIODsqy-sP06|87?doa19xi!FU+kL1lvfuj~ZL? zn-%ewzh92#6CeL$9G)hczZg(qu!8YMkOI}=KR+gUM|Sx^C7@mTL=_eJzUt2Z2yKY~ z@_XVM##sn#oTBP%mc#8J*3Wzx`b~a~%>&ns+_|Hv@s8Zs|7;JH%Z70%9892iB`I>n z(LI7V6ufU@ccl$i1KI!+w?pD3u>E<}75NN>?tW_mPp^Z5V^#T`6!i3e06}@!71zpr z{5%ip#LChNu~ben6$G=KuQ?7@lLQ_@-Uq|RV03b3-YgIlrg{J~;w_?b}X4YFLQc2e_G+)rwP%qb+IBLP?6Lx@^%a8oC#d9IcZWD%1Y~6d)vDF^a*}JIG`L_Hj zuD`98=;js|;zrk1*6=;wwC>&Rx9{ZXyDJbzv#-)NJJLFChw~?!<75BaneIU5XaioE zWcdPy8+4~bZTyQ%RHJF}- zH#g7ZElnG}g1%n<*6Dol_}wd?o;mkPAQzo5v%4z(&uZ&Ar5YXd0N7l#Z-o5%Mi%gd zV;hXqjl_Vfbu5ONoTvp`>9^mZUv$5`^snp8%@on|2w1y^UVl@?v!T1t(_@OxG@*}L zOp^N5^`9TUaq`vd>v$1bRXAh-x9b(GCp^O1sK%=I$JFPYW(?<>O_#c^j4By?K)x)R ze&6uZ$->gT@iKeAwlP-A+czhn1gV2#mEOC%3JYo{dy}R?8xI~+(R{t*JRJO=SS^OV zJi*jTHC)4fH#5z+?FN*Gko+%)NK((w3C7Oa@kZSw+1=jJ>9raG!w;`WptMgNcecG- z&**!{V~?bs%>Vn$AU{@xSo`>#;*8`r%r+BBO6v{29Bgm{n}vAahiBcxqYrQ8^2A2I zil%=`M&Em|>J;W1|Hk7pmZLSYqond?$ItQm@gobYj+gRZsyF#<1rp)`t#P=c@P$_` zP+{wQo3OVb2mli3mL3yFworLN4m~iP70LPrqhEBRi1`lZzpla8KkmH^K%95}P|Cft z121=B{voR-Xu;;WMo;8TZ#TFCU3~Yn-}$ZYXXHtXA3w&~sK#{B8e8(o5FW&(b^jJD zF@8VLm3zB>Gs!N?TgUh0}!HC?^K_E|V^*t5Z+=IZllpS^lyU2W>ua+j39K6Al8`HeNF#!spNW!Urd zEOOMC2r`oTu*7x>?WuA5mg&)SVB+52{drmF<@&2tPfOj-Op!2BCK)z+wU+|JiC)@& z)Z_1J=P3?E4!%}%`cU2ME9tDqPgBIUXWW-m*(WQI^WHouf^J8SbFQZ4q4+2oNxZE^oA!@U9Nl+S#3WUgFu0zRfVA z`Ly=a;Bn)2#aFmbj8>Y6_U=M2=XFcdJX(#C>JJHI4&ohGZ`El8(H-QE&RFp0tA^Yk za@WrHJbMgiQ?e<5TUfR7!@QHv?{N04F5j)Pui{m&gR60Coeq1h_vZqQ;@IxNbq?f!@;2!b@yEe$dt2uOE#r!a`LfJmp(Jv2x+64DKdAVW(xDBYby z{q~%5-tT+A>-Qg**X6+My`THJ_gd>-%k$6R+wIYl9}9!zWPoc=!O*px!z7d1p}{HB z1=pQQ*9tpH#}LsP<6kd7bp(C($34)NRy&Oo>gJcPGCkoEhuH(F|EM2-2yPI*2qQM} zlmmu$rR|xo9Mvt37QC;FHh*mh>zxmS+HeUUvKUCzdKiJISYpEICog;*88ougMx=hc zm#W^VyXprW`?DA&J36D3ufJO|QY^!ma@empAer87W<2r-7&&q98R;7u8}k};r{67I z>(8%59DcAH*Q)br)#^1g&<;{^(`3=9_QT!sg>;lF`3p3(pCofzrsXNa|pMiMoFYDVxyJaZhwuZT!w$)W1)IsQt=9*; zPt@zg^@=sia?UISj!U@{BDQ9l(rj<674V4ew29MW{@@1(cCP1JaYF~f#`RqSAJFFd zT>p`2tZ{JP)4k9h-Ab6#-M%gA`Hgh6m3A$@aqnAlbq@i_DO z4i99jI$C%%Ljx%QG=Y@Jm$A&03c#F$!38^Vw>TwEV#%6J64`CVn!lC#yAwjL3oKmp zRhbG>`~BWw(Z~a9kG*#LW;T~bZK4p2bDZ}mrR~~zr}Dm>)iXo3zGmkOQ}7Wg|F>OD z=CBA4@U~k8o-DBd)HOkRb|Rs5WCBCBL@+V{VywB+=f=Ywc-O7|9W6g7sPb1xbVxOz zyy4#G^Nc|2ikoT&CLMV5WZcn+{~42OzJ^Y@2eI00cURrQHhVkDcy<$e5a4VGv0hxr%=4*5 zK$dHhklJ4tUtj20A!r;ZNL^xpU{kIcZH6J;a`TIV#ZF9RmGxCgo-g39b_-@LE)(nH zBgA>%jm6Q$`S{xHnWgY}z*=fAm5TMs6M@c5e(OaexrI(~~#CEovo#NTbHD>c%a?+Oz89+na z!&=b-la#(W>f=-|Ql+^B(0@L#U9EClmc9f;_R6@9NdoX$>>bHh2=tB#HZuVI=J~hT zi5?kh7;%m7-7Um+>bd(?abdiu5*FPr6JUCYG{D5G11YMf%)vLng>w~nG{QOpG5df= zSxq6<_XA9h2GI-l+Fft~a2nUrVZL|x-!4^8ks1RWp5AB^JB9A$-`6v0B68kp%D zm8Z`;|0>Z=2|Eh3kJVZDOo!$p9AgHtK0B_qSn*SX30?U@+%%yUf{bZ%?)&K@4sIrw zx3l~Ca%BZ0H?eziB!$>b4s8f&>-a_qPidp%JMo+Ke9WYt4gcKLU5YQz+tLRtk#RmGLUwMl*2^H+f2_Q;c9P@dEFq7+ofr0O0yF>d~ ztbWVc3t*k9A-R6G-~)#HiYmLlEyo>5fH&YDhf1TYe=ik}X>pza(P1L?hOlZu>vfHx z#)hUvvZP)n@L~DL85{ySeBS-=NS0lowr1J=TF1@s#D9!w%+Zp5PtlTQKL~1nmBphf&=%tKTTy z_;OxNHaMDJ0_#**`D_A{P&MddAb`LkhriRtLJS z`=e3fERdKe*g(RLRni5tdg_qIz97XJre0*%{!|+5HB!D`hc(j!x{zA&&0ubuFm%2+_~2k!m$S!JfrSp z8KY#z@mAs{w{&c>gfe<{SQz=8SL2nH1m&U(`D=sYCY@G$%5J{QOx)G0mjJox(QHM# z+&Q)o5UV^KX|oZ`?$$g7Pn~_Pz(|o6UD=Mu%J+LmJ9CyRNd4=Cl0p7%>n`-5;XBJ6 z-+Cbb44U<3ki`t6_0~n9#o!4)>2Q>rtc*N<>?{(Gs6!U;J&Wwv?2G9~!l#y4z?8z&RA zY$eaZ04SHxWFdVP#qI7_VRkKf&DdC#DA-cI{m3UCGlA~AmmE~Kiws5vu3CgBU*TZN z2HKO#5S8)ug0iGcW%=rMdINYp0^tN#4P71eoF*fSZ(y zrIpeYb^y_3$e8yYpaxqVmZ8$ZvjSNN^5kL!-%sY z4A(m4DW*V34J}1<9=U)#AR*#TA}wl7MK!{}c#{McEdYX~ozqHWGVnvkfVXSukhK$> zNtpcA(D)afq?@br?dB2S97)1|B+~eNAM4%h@$H4SRHYH1<68=ejoq@5;|i=K=__x7 zeBR;hEVZUyOHfg=z#~-?#`2W#nRO~Zt5#~{C_0k7d=v9{S4b0i^N6}T3^x2QzB-aW zd81xwEwxKRs94~zK9N4s@CIM6);r(u-S7h%+>_oDG3|tgoV-PEO5ZguFg{muR!ur* z^R?ybOaKsM;dApv<*%mh#IR6Jn?LNpvY&{s@FcbU&N*JaH8xT%{;Ge{YXfoLi3@=K zt_`e6xR;A2`zI&x{bC%Wa&4v78VoJUlq(^zeb`DU$d*Q@Cm?s7w_cfPq;ohEai-NKzOr0It2yVhMeVf4-?7?xPB*8ns-}w;g1+1&4D!qtkwt95wh{0L3h&1Dgd1n0QIEC^vKaI2$3vw$FY z({A1D3P`mYYadD%)am}_n8s^Ya&<81s0c3y2dM|RPJdbVyg8k8A!maijZ!E3PSY5O zKzGA9aZ~d}&ImjXDoBa=|19}SB=|)hZ<`i@1oyZX(iz_Xw#LVOyR5zj2Z)NSL2O7# z|1mIH?*nNhtN_R!`())SZ5YvjBL_?+4g)iWCPz{u1bnU=qR7VCeay~eU=x_OvSt0Bvav^Tv|k@}KFb9kNav-yfwgRKBbtw@|1Hz|3@B6MLvWK9L7s!Q zhbh3N{qj7_|8(4SFQoX*YWnzksimwlJCo$#sIBRxK>A+cp zLFhCieqk_X=#I{buW-d(Te|073di|e^EtnbkV^C(nD=d6*l!MYt=QLJtQ~1D2{)z=^n6zqVv^^;Gs0RB4a_ zaNyzndE$_3LimZxDMd3t?3GEwyYJ-0Ff85$gAWlIa)Z*MCTHnFzFXe!aDOG;{9gLv zse?*zPf8S574;QO*0zQaCvdMo-$3wO4`R#a1M{=gDa9;kJYhG|k)9?i#9;WtAMpMm zz)PJUn4#4A0vxE_Q2Fb6m_Ab%NPqSK*)2yPagL-tJ_4iNhPqCgd@@i#lQO49YC8{% znFR@xSXBCg;>ArYAWewR$Lt}8OTd_X3tC)~P|l|=0c)srTnxE z|AdLy4r;~j(L1)>A`Bi8|i@kXOcuc*bTA|j^)hhH&b znHFExm#?I03hgR@-W+$yo`^(hvCivq?*#5&6hJMVQ4I_y*HSt4Yl>((sN=@PG4FX# zKPkH$8}4L7K~zyyyKOD}yPO36qBy@!t*DtcdH;m@m8(cNuUXZK!XSraW~v}Tkn7P8 zoac!i*mMqa4V6}8{vHVxiC8t7VkDN}$$q9SWk96Q-2f9Pm&L=U{jC7Sfq!P4!XgbW`2d&(S37;vQwtaYpi25obHOWrx`fFRFc$ zCr|=w4Ujkx>df>*|f_uv=x4X8v^!G zzZJ*z^o=2B=bM|9TsYIi`+X64Px%5tBF`g5fzDB&r+DREL zy2)4J)Frf91)K##-!}H6one8D>ooN3r+HksP;iY{`L@O;05&A}-kFH`hwmPV6;EDY91{AfiH~2YwQyBM*GH0v>%sNRB zUU3^L0m6>-W?3;3L|jts4omra5O4B1gT5f3NG3fBn!=Oze2BDnRJ&QR@64ob*ckeR zOH~jSTF2h$%Vmb$SvuFl1Rlf?1|ZsosIy_Yu*2#%^^~cY%#Z9p2plGkQJ48 zWb5B@!R87=M8nj$oMtwaUs2Q! zn386c}O#h znoI8qn&zOBz#WhrP)_3%JGyM5qQpASnhUh4tiY<2hftgCDZqE$z|F6N|EhyC{p=MF z4oZ%(EZ0(v|D-`G3|h5nCe?63)R%m^@s(Nc8FF7TZeB?-bFMQ(36GV75=1c9`fhs} zSS_af{)|*fV7fOh_Qe{4*_6f>Zl9pf{NCD5s{;)8gHDqe!$mg7=bbGFd;F5n;88=a zz27y^R@$!ikDEY$YyvSesOBB4`B+MyY2>yMH z2gScJZ;x)2-ZQuMZn7G9=AQ5UB&GI!K|Gtz$Z}@};xazs=}YyqJwz{Rl7bc!`_1AG zW3hUn(?n?2f`_E&WMQ_enQj>G9$hse(UUIMtJXH_j!*6jJ*l~NDV#RSFxsLkk=ldW z>nkvhBN?ZhlxIQb@^WO%ZKI+i$ZP*Z#7i2zwS+rNKrQ6s6lg8N-WRsmTTuO z38pUDNbCGK0yMw5gA%YE!YW0#km#pe9XpHjF?#@JNOS*s7-c z70V496-RqS;Y?=|)qOzEomRpW5n_bW42zxrC5}UTXILrEr&AJTyNjQ_$dip zqJ_?qY1m_(Yv4=@ZMd{y>L2p7^)}SB!VGgoFemza?#gdglQNZiPi-di%@QzT;pE0Y zO>7tR7TmV6nAKapmKs*cuMH$KZo8Hx@mOidI9~p`l^7{A;$zlotD%YWidAdznq)SS z5%}OMX3ba1AVPj4=F$4g0P%Q_9ZR3*dH3|iurvvuvtizH-cXG3(ju|Qh^3K!E7W)? zt=48OAp&7~i*_{lDFw!8LfPoGSp`$ORel-lUBP*Uo%Y;C=bu_ZO^@@g1HmI;^DS9F z)416~X-m6^(bw=o;@MF8N^At}aFzD-3{230V^cV*Id;RNcGgDv()46ZjmFXE(-rlS zhd1ft+NgJ#8cRH#pO8agj(*7EO`Aju~Q0E1FAxh)J<8fsD_)mnd6g@=epR#V@G&tP)lFHzEKn8Pu1 zz<}k`N+O2bj+?OI!z=M`ju3Bw^f1wvG&rT0C-z)5^3lwC(zg)ae%jm?inu_90>zYw zAkJ{Q6Zi2>IEnZfv_EgpGnUTco}4cykphk+2zN;W=mS}!I?F(*HFxiF zF%(0Ru@Pi7OaCCDB^Vje|Eh-jz)CJf5R5^s{dhuT>z`bobTitXk;r%TB(CDzi~SMa zvzQS=d4)w9ZwB`;=$m?qv^HuIZXqUM&vWRO+&H=}AAZK({~<7g?P+NL=6rEIy+W*^ zF_jS0QvE5*1UFRecs)&KdNGP!klqea(}C&MCs5`EQ}g_=6I;tV(eshml0XVEFNz_zDVF;3%${0n`*knvHEe^^L{!Kmp^k4 zNM;<09+Td9NWzGF4CADg5{J%wNzI+}1j7VT|K0ZniBU?KIw+zP)pX3A+DTSEh`I`1 z1aLW7pisFluUI#xQFN5W&;>-)k?KPyo1<7M%l0+qGz;cECw9|SUGTf+-jnQP3AP`t zkX|wpDRGYOf+4I&jZ?ra+a50+DW1aD5i5x1q7?C&V@ko%5laZ}G@8*f)t-~LK{Y1Sx|xI zo*1?|jYX^)+Y)srb=E;&mFN(i3g=bh@meAxVN1cE5#uS!Rz;dGV6250+dndl2pyH&N)?{4in1hDbG{FG)RhL@@=1CGS;{tKq&S^j>Dt6z{Q=%d z1<^0}*J31@&Qz7UDnY)KMO(cY)~!czwF;iI+>}&FG}L%3;9wJg^wI(`y6A@lw-%lu zMPz*TlA2ImG)9PsLRm86<2$6JJ^}hA@+zZ(J+)VI<55^a(~D9};)?sbDVP+21LywwPw5 zBE7`3UHKO4wER=a-F(M%b2dK{rgm@W!-icE80{S>j*|Unr@!5zzqIo9;Dc(upDe6* zm`{8*o+i7kT$V3=L#kf}Xa6WH`d*zlOSEf2?A+?_RENZqk3Sf&V@f(Mt`YJajK zv&T<9Q@9lw(I&l|Qp!x~O^XJnO)xfP+j?G70QahrKk^<30b5DccJo~mM@(Ap!%<Cb3LDgnZe<7t2tN(=4uNzgl4|hT5oP8M*VP zMyMMu%2$7d(6CgQ{V)Wbc{jPhdr+`>;7o(Ms7UCBOVHzSA*hAA^)NMMA-XXK1LV7M zO#9>eBJL9r(pPTpNZ4%%Mc_ka9be9DCs?2Ga3C{$s_UE1!`|K5yVNjd2OP%Ci0~uX~U&yZzwPcVth__bit;IF&m65Lu>YFYjfj0!CFS|Jsrj{*OFHqGW z_4`|WH}rf`W@YG$&hkX;TS_6v97%OVae(?prQz^(zI{2k>kf;3lLJk1jGAk;@b0lR zm6c{~?52V|l?EFQ#CrFr7P3?u3-Q=uV%EymeE)mW&MxYoHOEeqpd{MM4v7O0;ArzB z3-Y{^06UPY+kT5s0GNaMn2GY|mo#8#gO>yJxjQMtH-aSord>@55l%;X*=@5Aktev0 z#59InuhJ|qf{bra^M2qLwQ^%HOQ}(!oFWiTzjCBYuNIU+FNar|8lx_(g0Cu^>o5ia z0!>Y;Ym&EJV{!drnC(K#G&z1Q&0CP+_83-gjbvG4?7}4d>M(yjRo`ipQE_HPUXw-(W7lo zhvJ*ndLY6R?cU_6RZ)?PTiR?x1b@s9iG3Xiq#nH^Wgyl^MV$o(YT8%#&Da6Q6!{MD z+@?bjdy75))RXwQA&k>`Ui1c&tdnyw`N)DW&GLpB5E36bHUs$oh(z`(E6%oyoXJX2 z<;PE-i!S(F+0iXaYen!i``k3Se^qDxVRi&$$UN=2B@ZPyFOp1rLQkBpCHJs$Kf8lC z-DjSGEEFF2YQ5wlKG#gak{^j1`CM~D83+ZTI;VT{vpZxa8yY-7kt(al^;`6ZLQSy9 z)eiT^2SVi=38-8WF0oR6rN*r@nxueCa4m2h208^Ro+t@qbdTNIBP?^4_+Q2a({F}z zqy`R3w>V^J2B{uXyp`{Z-Odfbz?5X1CgfCs63h(uV}{GXIYX)*;Xjj2WNTv$n5rmD z^7deSQ8cG|MBK~iy|_WAbK3%(0QYH9s^7pWxqp(n3M1Y{(ko`-k0mMoAwErr$O_-h}QadFFfnz&`qE-~f+f2!q4;6`);9gjM$I9&#D9 zDYlC(MrXUzoJLo3!=Y{O4`HG)6f<{`?`>pZq*6R|7U(5X9JoG|9?g^S zrvf`EB86K%I7#s7;=H%u)s^0;&hAahJ{ihmAs;sHpcA~iwxUT>rq5S@cpieAgH@eN zX=Ug)18!ouOZCD2u{*DB?9J(HE8C9zZgtcS?0bx*DmP`w`*SY>|EOo2RLjnGCBILT z%?_GxG+8)VZj7&qZoIL;1*5Oi%M?ytSQa#!N;k!(`ucZW#&*!?5PT7uSZPP^{xByQ zZ`Nn?aE}@w${CNs{9IAvBSxwvaKCb)loM|V?zfnSd;$ZfsTr@zp#;8QuC4FY!G**A zLhCb)PZ-&NW|AiP1Fj}mp%N8T=;5HHzM#*YV(j(=2Lmfb5+A-hTb~Aj;=fZ#8Sz3Z zeys=4Xr)ldY^7>WFi!U;0>Dlb(}*{H*d^`agX6O}gETjA7C`~gUPu#Q?5#t#-CCIy1R+(9KNb>CStt9(S#^}| zzEIxxgvWJdo}kw@D`qx3FdW6lu=+|Tq#$hX3Xe<+&^`)zH{DUwWkEG#?oG@Gv!j$l z$22afoKUe%C~l`OilOmz1q$i!U!o}MW+DvkKXmrq;uu|T627^PD;sH)vW&L;s|2lh zbS}10-I)Vr0>KkMCh%F1Y|GscY_z6fR(bb(3>0~3ev5*!p|6tPPEi7R0-mP`dpFTU zgLgE`M{36+*~$o(coW|nEr3c9JrFEOF8Y*xNH_iz+)!9bNqKGG=1n}8EdmTcs(c|3 zxF>u6x}lbm6QZ&~STuj;E~}!N;r&~JJL!d+IIn0$ zD{S@VysNqU|}M%88|Xn4cn??${-tR{7wFz}NDX(k5h4)H8gxC)nMAj@1GTv533Ge-T3w!x=9# z&?!(#dj_JL4GHS0hl_T^oj=PzljW49Bf8&ybCwqCBJm+=h+U#Bx)St=+KFs>W@oJy zeMHd`KOIW4iy#sOG3H>ph|6r&|2|qTAa`u9HJd;B!PGpSF`=AEiS{sE4Muvb*`h9m zMJzQWf9W^Q%CxeGuO8w*UC;yXw$;*0bq8}|f74QxWkfp92i%D1+)JBbzg{dmLfJQi zNt~IApI@qZo#q~m3wO*ro7mxB*S@7*7|WG;f?x6aF~}E>1(dgkR^{QOaED3wLw!sT z+&IpJ%K$)haG$c(eE%)*0zY(=-pbteqx?{l%QleMu&TFuxWu8RKT{$-ZUvC4C-(LN zAY;Hq&qmmVhbBlAtTo`7lwRNvN+gQu9`fI0cLWP$uaDCHJ3l{#*{=P5TP(b)}vmXmv*rGn8*v=pg=-h73m z2%anp_f} zOGZ2G$UsM3wph%d)2blwp91S!G}UDgU4Z@)3jossc0b1!rzEMLZX=J4{lgouRAD?0lJMJc2kFjWr8CD+(2X?TMDyAfozN0 z;j6v0URok-HZLF^u&DDF&5^e`-sI@)Q7wxH7f)QEO4*`=Ekk}UhFGmGlWPFnOUN9#c)$Ih%n`wK}NM`o5}!$`NN ziZfjQnztJx`QaeydhmpgaUpQ)Nv}|1>|erQSavj%f{@xw;Y6z22eHYhA@o2@%BcpX z=IYwERnc)D9L5gw43~IpDQZsPDbEYDhGE&GEtM`}u6fpQ=w|Cm3qX;se+w;>uj`NkBD!#|~bL zr%lc(yL2drowarW6+~EjSF}Gr_6~rXs$$DCpX-ZQUNPRGf6g0DbIz&+5Uu4re$YkZ zk)RR-GS==J&3xcE|Yzk{0zu2Mb2sGe_usYBN_sgcz0ucGYWT8qXuXi4G9awU6S&k6K zKI$Ym{5#_p`98$n`J!(UFm03CxIJ4y&4UL>$1vs^@xx;wmz?Pu1cKJ z{Up{8?JZ9Um4|wwy&({ZY!!S!S6?Xv=$1A?pUZrs+i zt+8T!$EWaO5bREB)|EDoMY6iU`&}nI2*`CL$!E46Ja|;|KBDs8<$tsQo9d%Z-{-Gu zqYox?{HJh2`(ljYyNxq|h+_pDFs~!~nZz7sE%jG}ucrR7kLi6Rk9ZD?fSCg;384mK z*&ZW3a!2S3wa^Gz&>M`iHkQ=COB6#^dVw@};5qZX0_%{iEbuD9$nOH9%zQU#OcpZd zNn1sLNFe!-<%E1jagmu|m0%HeK*MXQw?}43+Npi{yj*(i5up@xGzR2=8t@(aJ^S+T z2m|)GN029^P&wTiB3Wd;BsO?I^``MkdXbUn>BT1p=(4D)m?4)m{V5Yo;anP?byUxi z-|{;{`CJpv-51NxV16;W8`PFyXFE>ODBZrXnKJ1Wc7#dCMc|5Kc`@HT+m;%jMDJYb zyDjsz?`fOA%KL`@fZh?->9liY?zC3VtzII|ocR$8!0US|)FBmyRq8=lPdV5HYhseF zZWzhFIV7$?x_UKd>bU3}kZ@kXt- zzKkmKe~Bgeh9LR>C6-_s?bj??;aZVSpZOL%BuIID2j`j#B2ti@JS?1;L%uG!TCUrk zA`d`QKEW;jhp}>HJl^Tv_lZ~gDBbhjJD6T90Bxml4J*&!E{RSqc;bt$3Ic1Fv8#_D ziL?De{b%cC-KEhMPjS9|T+>Ltj%Bq_TdUxu5ojYJ{O4Ev?ls?XA#cY-k1OyMdzcve zVZeq7wV>aG#@%@prpY11lKwnOA&Il^Fw-|NO38-*yV0o{?mIS=CgI3eE`PoXTMV>V zZ*Ixn_kFJM@Y43q@~CT#b0x4K{Z+=03HkJ!iOl436$;Ou;7`jLaHb^@9Hu=eLGMeZ zKDX)(nA*b3vxfae>*3!sPtx;jR`xFY9>?u;do7H zlp`P!|Kv**-seyoaE=sZ2MaQ_hBAbd+L>2wkojWJ`1YRR{U4;rlIwwRIrtz0y3EyV zw8LflL}LyuF&s4>%{+B<+MW_KP}P!{sp{$&%s+ZJlc6SRS#-6(I*Gjl$*w6fMQ@j; zvc&FdWGFts>ki7w@x>3vr|f;&i3gnmEy`p6u{=3^iRU!=>w9FYzoAR2!>0h!>s^i( zvG-9}dlY2Pxfs{#3=}{}i4INNNTG@YL@$Q%lkSfVnin5-rkL6^ZcYaH7L$kgu~!J` zNoU|})M3P&_U9UOrPtv-N#3r%pGAFU^1V3~*}U=K%uIe59uc-DdA2_T!p=AI4BI~# zv1k|Lghm9sbFXx_^#6+maAq_<|I3)|xBS&SlYJAMXV7e~UgBk?SLqh00>S90|1ZLd zTI0aFep1n8dZRdZWmaNQKDQ)tb-999iuRLwfjo049wW^4S$}-~abj;s4;}rigx>1t zX=X3nKX>Ivv`9?L<*`TLpP6wR^?Grk%jFI#i2EMBg!FuakA!t%F++ZDQarI|+go^N zn-M}T{A?h99J8#y?Y7~aS_bn`#Lk6%@MjTc<*oP%I*R6Y>RPf17**6Qb*u3PyZ6KM z#E0yp@GCF^2+)>+mriRv%$Sy(uyLx=#8bgZl8%wR0%-iarRQb+u~4ldfb??}N(y>a;2Vd0HX-!6v<$$YT7x!YF4$)cq-3VMIk zes?oOZ`e39L%0pS2|KNVE}PLY7i?=38m(rpS1>|Y92Q!h*$41sT66}=PSLF`4dh5j zU)rSo_IUh73MnznAy3uCJ*1C!r}nx|DLlhnKz3Q-sBd%v$(J0MZe!qz58@e7B9aLc zG~p+>d=lwzdAszD?mG+13>UN405y-Czgrxw1$p5f5J8h)p< zb7vThxrfz!aV?L{q#_HUkG?U5uxLj4ZOx@ccL67Szx|d20I3jPU)KvkBnW7Wu#VGY z()|uUvAcd7S4czo+cFrml@62lA2y3 zCPr{5V)e1CJ%kp6+Xck!=Mgfz4s&c^;*J|SmO+wwLWE^+ZP!dDQL6ArdRD9 zdFi<-4_vo_ zIB6%rOggpNZnDdB8t8p?uQ&6?{Zge^tqD-Ae0mr}%thN8zJ8nMl>vT?kTBFYuurkS zsv{QUn1202d{28IFMVm9_WO$zNVXSJ6h8$mcqeRU`6g1H1Fw*b*Y;`83*TKj>PWBJ zx1xc;7+kE6NSD5VK4@)9Q?T*8C}#`fXlqzzzsM?U@1y!K2x!H!%7HUI$;_+a3k< z8}aJ^IAIot75L@DX6x-00vTCSOA;B#h{#CzLvoaCgcC!n86|0bo9f)Bp)b`*y3D`a zjte}QpkFSCCmCg|ATDl zAx3Zs0*CAO4S{;7Hj#GKGLT0 zM!M}1K}N#uRtkm3iSeHLjfcTz0w5fw%&k5E`)w~{5H z-$!`?cxZ;>MA&Qm1)k;F2w}NJs!L;F(6Z(-=_(%Jj^bV(;Bute_ zU&u|cnXp!icx{}$&dh@obM?5`S6S*?&!?z3Z`ZBM9G_sS zzYohgI4pJuTW+}wNMp;d)?B?GDwIM}QFreYwe5`9W%KkuoSj#T!=`!%Sn0PV^yq{E zD{wK-xbxf$+;9&Z7h2pQZU?5LNyVz!;z2PUM?Hex!8AIhMA+B672c?m4`(HCkngw( zsULs?&IdC2Ae3jZ$UMx(tRK;BosRJ4Ub z0&9L|O}^|TOi;ZJ>V+WW|B#JaCd1S|yu2DmYyOvW`;hK<+NXvrL@osATeeelrmZ^? zs*g8#MS05?=v5ND)O)pASZm3~c@tFH@6MVvS&fa_t{s!uQd?y?ZXJ8z7h)T`Vd2-1F^2T9<*kleErX zs-3tebgiE=`MrO__t-P4CD+PQ$!MH6wtioy?DtKm2q&c|yh)8V>S4NFKx}Hex2~Hu zo^&(Fr3mEL?EDg^UPu;X`CgJ##39(eND@2!W|xd4Wm;n~E+u?17M%Lz=uNQ~2MPW` zpFDowUgghmudc2|ros3Po{_wC%G#|EVaT-=k=n|Vzzwkx4_-zy%P6T|nmHG}p0Fdh zS4andjw0@j&J^b{R{JfKc7Q6Lw1i(@!$#DXFw@vT+tB-C7l1Y-W9_tXhdzZgkC zmB2eLugM4PZ`OFDkgFZ3$o+@!s+HNiATse`0vSBY!8Q3-wmd-=@N6+^CrpSXcpZ~@ zCA=t~EJ^lO{BqzNhy_mXJG6-fcvanMq_kUS@BrE+wZ`7ogTITOB#^^{^aA4_q?h5G@c&?@1qd}jvYf#tMXV=uTfN#>%l(7A2tMEK=AZlgt>%AWj_}i^8 z3*6&1UPn3HI4i*DmCO*~Gzqe6U*?s1n3{)T5bK(#OR2xqAic$wQ3whSq$GYz5%9F) z7T#OCE#>+xsWsk}Wjt1+FU|0Uw_kiM+~l;FPPMRk?@h|VhelCIo0XvEfz5;>jQjUG zGYK6M_&@!7nIAV4Gy}XC>)y7-U1s|oE>A`Ar;d%ov9I!U#q(K-vB93Llcqgqs@m=j zTjbMUZCYsv<<~jsgp9qV>b%ba6;rvnFfNznr77lIRa3{`au~EvvsjH3@ODqtyosX` z3?tw)gCbgD)o#6VNsF9@S;Q^0sx8y{)`RP00m)<@AF&0567;eMeviF9-*(RZN-MDl zPK?bvnq%Zpg=`&1izJB&nM7-9L3c4zgz4qQnf%f z)g9@;2m5I$h-D9bMWh!yOyT65l>cpfR<|9AQdY{)43>>TCZ9)NK{RiQu*%6!2eR|) z_I>#poe8~xZMsUfkn--u90lL|&pQj1-4{_UVPCxOcAq$1E-^6cmlR!ITu&dXABM^w zEgVfBX@(X-d@DaJp}A2rwgo+x10MPe*BWucMH^x89+O<&4kSLb4)GR&; zAcP(PYj>?)LMFzzHRX5+VPEo)tl}4~g2bI``$Bq^!$p1VNieAE zvQ=PBHijlk(PwjM7bWpQK4($LV)&* zR)6aB3{S-0H}Mf?QF00A>bgLqH!l?z$bNQ=gBTPOI3>`$7TKgybnviIOF3D)$Sw#TyA`@xt=+q?G>+fSCzMK55f3Kd z6$WLTk}()U%8HK*lapL^7GnlJdO6ifYmp&!fcc7DBY@k)7{xEqO))!C-%skV^l;sx z!(SkC$Rpcid|@_%Eip(= z>N$gPi(6egNNgyWkrSiTS&4>B3x0>@6?efA(tHZ(rc{D&HP`-XgaV^S^+C&p*|YN$B+d zdx~|GZV&06!BZ`$db%)^9zR0q83Q`Dka`qw#*RVr#;nvAV<}T0 zvnQLqpV`BUVO1>IG3{xu-c-f%LNfs2Y)1cJo3CtrnD6|4W8aB?*KhDQpUbo*ojfVv z)>1u99gAC3zIjun=6ds0fzs{wz3Q||iJz&~{H}fJeD$RWul&nomhx3F?tQw=m-jw! z1PMS%9PodSk8tW>D~?u{G+oOXS1%KP)RV~kF?UV`dF5JY)X^WW*!!<5*I-28D1spW zBW^`x3}^e49h}Ky>Wpkg1soRwN5o(XuMD!iqVl;G>$GeVc9|J3yJbN+j{=O=c~tfu z&HH~Ua?vj#%lFXA5Yew3zjVn1DCKb*EK%oPT<*IEH{F+_{)7WC&`-}ag3VY_>vn~y zgMDApOqMTxO)$CrESF5}PvF5;AJ480Un~IQ23hEH_d$c!igs{PNE3~m9PtTr@$&&6 zA+Lff^-U1vdzgz%c*MvfB+|Q&-k;1R@kb4{gA_SDw7og`{Ynhz)=vr4Py;@G>+kxK zukUWDEp7MDWs`{9^nC@8sG5RlqT&p6By0ZOyTnqa0ZG_4WZo0-F+uO-C&?ep1yY{B zrK}g?$WOZlnTHl8Lx8!g!+qzp$iR3-IeT2%t%15n1Zw00yAz`MohYDo-X&X5IsET=7~}^7(*Azfw|N@CW4Q*W-OA%01pCE3 zqF}t*b1**fl={X2a1D#36jhO(5U>QhFIl%VY-zs&UE|cN&y)(d@5oUAco*TAnGg}? zDC-jZ_uu-75y|Of9GB-}KSr*`W5#)T+z<{FN2QH-*P^AC!3Ao(;Wmr+4-M+oP(Me3 z&rKKpxaIpC7mQXtA0GE+{pTyYi36GvIlK1vB%2v3_^4>yr!I^%VSoS$-ss%=xf4r_L zgB&Re^JB;PmE>)p_)*}s2H2a$0{mQie#(1{_yWpj^M{O4*wnVjiLoigTI>@J@YAM| zUxA3)KjV1~jG%FAV!Sx%{(IS&P>8^~Rjdcl{-yxmbrOgu(6LdtiOUkL3FT$$6iEV{ z{it_OS2nAw+}Dk*wAwvlqOzK`z-Rq^iqMb)X{Y3WPsWJietiO{?P*JnG5o(*fjknd znV<(^?DD@g0ka>dVt$Bxj~1H8X|q7`)p~(1|A)K;OHdhF2X_4L z&;JV*CHS)IvpPp?0zCjYB9$`!<-^EPVmcZlR!p)jn zw=>7czO93a{hX$4auW^Fg+Lc1BqiDI9=pFFh&Z0jC0&@cpJAF`}kFg0S!+FnQ>|4U2ukLLNL`jk5c# zm|!#RI7FL+Gv8(*D8D&Rsie=j_Vl!MgM^w%H^U)6=ctNpjrINn57H}SA9%(!NjHOe z&ureI{id$^xR`;4^}w2Om2@xZ#-zeEE0wZXHf@&s85 zz;A7~41QQ*PQ2gn3g`*{A7O6+Rpr*Me+zG{_-(0%)Ip_V?HwI(uJ#+xe`OIg=eP7q_0`CuXl5>CMF?rM`nM41+ ztItMyy`~xf$Af;H*ov2oHyxNn%`4K)m7tv&;rfuwtlaadJ!J$~xYR@2-`j<J^V&J}co0q(ZU-nukegN4 zorvPKZa4f`Q)^V5HD{8qdvM!w7R&WQv&WDrNn|`X5Tcm+c%gB)tG}-yMR@5_w6(jY zj~}923_0l5n#lWx`GL{o-6#Ah>@s1k{;MPTj#&&saauCx{J7K%MWukMdKsWdcjrSn zcs+bvbiJY?T7`@3ST9zCdw)Yg0I_}v479xaP4oAkwT$a|ZGew{2cZf?qSWKpK(Tp) zXkWg9j^I@-?9cE@|o$3MtB=S{h$(jWv90 zRJNnlrS73cXnkj+45Lw{`MVdFot1`>o_wcPrMy!4=C03Hf8RXe{@X}cLn-U>&_qd< z=e)tW<1H&$Mcv!Hfy7=LOtL3=2f3QHUkF!r)5dRNMK@a$-d4LS%$`2)*<;%6{9$xl zNR5wvbPlSYP%!ov6n5f*LGL4<+UfGR-@nGq5xvGOpB9ed`@2gK8qg&_=25| zH=gKLnT7)sI;`dDK#5f&C+KKvV)&{INRoy?6kh#q%cbdjd+^F^i_ay{`1-)*2gEK* zKiN!Zf>tdP0E%Dia5E1a)%&^wmPhijdy{(VQ}>1@pH^)u7XGj`1iDZ8E*0ww3jT*WTUQkwOym9R%G z6Be~18mv*JDJQbZb<{(b6^n-|;{|j+z3X#3_@G0xgD-JizX)24z57~g$w)x7sSDNw zR%~*f=z8Z>q4r%M5w%s46LgHFbYv=ulSD|_E!5LTGr-*xv9rBFDc#|N;8h^3fA#dB zIi3h7<5ny;XkG#Ux_AJ+d2*kGjm7(9D+biY6hV)788{~r0V-Ds81)%F50*mIQ@P9{ z&UZf~8N>otwo;Bvc%EVcG*-aT*mJ-0!3T@M9J#<P1!@Ekm{D6BJ~; zRp%l-hC-pG8I`|x#o9gZHj2%HYhu6o2gKY5C17b-E3PZzVt!0kJ8t(F3wIC~%X;ArMVK5XFK}3GCkf0!kQ!7>J3J*XQDB#oHJe(s9oitP)d+ z@Q6qS@J*>H@$NI8T`0cE+Q4y(hZ5)-aL>u+w;W=cUR2rtvt1uosqqqxstt%7!e0Z- zQ!JO6qM*Z^KSViMo!aL}qv%OVBH~PdzJZ`c82DYgYT?(o?;0SmreKieK=0Tba(Y$@ zY!0#f_6CApM*w4sfQte;QAm7_c)S^q1@q5%NZ-Sywvk`UISa~~Tj=9a-wrE+<1?E- z(qkWm#z)(vaCLOw7+W(lt7Rqp5I$8bxfnIsjHYv?+$2{^h6Hp((F}ASUAr#Yvuc$1 zf1=cXu}0^5)R$$}ju~k-!pxx%;i7Q;ZZ-pMoMmV$0(CZg&LFzVlQhV_difiTLSWsO z{HOnwjp^^W?F+CTSt@_8+F{T}w7Rv;pLP+mfG2?(5pQQMkCN$oVL1W%gy9(J;(i7v zyR#gkUPsYD44b;7-NNjc;1^DXNH=1_CrL<@U<0m;DS%-2C-`mqT7_WgfhIp}X%9FN z24(r1KDQ=e9sv|W+{>>aJz%8rv;3?%WH#G zS|X-d8)Ro9T8|bA-S__00yJG6^u<1UAw-|Gua5Hh0+)}oF(Kt9aLuj#$j(;r~vO-m$XU^C?- zfphC1RraEFzEF};Ia=brXyWr;l7~wyt=kKwu5Vif<^_8WU|y1LyF)1tt6rX{)*qkR zdV1*SA7Ywy*o(NZayvR7bA%UkwRvK;LWM(ktw8b3;{=c$9v6- zI9EU-l7dW9{MLg*{s&5DED*7zRmMMhG1-(0toz;3k{x28!OXVXe42^K?N}(g^BKsc zErAo?Wphj=mPy6RxLup)edbWTvw5}JW-@~7q~G#-Vhfn{9hvGAOh*8Ad8h*o_Np0Z zpqIL1zC!8&=6~QD+B=n|dVn#J3;qE3@^S~a!)oH#=(pbCu9rd*Kf759RE9t(f=WH5 zZU@Q_LHti#&}?Tdeu9`a{cJo{JPE_sj`Hqecw8HRFGWZlyH-KiWHXc(4yO?p%Q+hI zA*efdtfs3|pdoONv;~%nfn?6F(YDh~7!}3A)QCfXmvb>ggdmE(;Ym@)s~?q?!%SM5 z1I8znUDVtI_qdW36WLhfnAP}nm8QGW`0eeA^JhSX!g91Y!DW3&mPs|8R8mf3MJ<8& zn^XdDvKE2qA&W%|G@97jUDJX#K*Ag1H1MQ|IsvZe2c$%br_%2%9?0HPa*&DCJa$*F zvuq3HS{)ZdG?aBgT*@cgsj-gSeQcmWOE2;dEHrK{t99GfBV?|)!Y~C&ZCA7^aqG0~ z7!B1l2vmwqrIUzN6MU|WYS`zuBxDIdZHl1c<;u!^so4EhDGmB}On}$J&HsRWgrRGx zr*s><>6a`|G;C-dm=dvxifYC}6zGA_g)1*r&jN9gde56Bl$tCH+HnQ)M4EE2&G%Ev zOoAN%`{VCwH_lW(TdNB`X*S8V>|(iN!re6x#>ln1CG5Tv4|2armkGT1wM2t8i8$3ENB`{c zk0A-Ns+HIgPXVriU*>^A$tT=Efxr@4K8K}l{KK+=-RSw;1&j&b;=<^1d0kYK+bwqx zsL7ORG=VFAWwg)(?8d|qj$pec{+TE64me35z+3WDu!y3bcFrr{1^|EZzY`=<=r)*V z`8>@BlA@cew%ihY56Eyvl|t2AjM>7sL`EeNg#1{$RA+G7C3^UwVM~(@a9+k6I7#O? zit-cK!OFg=;M}8JXNEn5Z?AD5Oqgep(POcD7ne+%T?p&|AP@Ftzdd@i=AbEl%`_2) zQ>K7p`?NOMX(UIB#XCt)mMzg6Tyh>5ZTp!G;wY9(I&po4%?Bu4L(VK6;1+m|m!?jo z3a1C%k2q0TPmxoXojy~s7#)cT(NlYL@2cWDLx!#{`lJCJxaM(ChM=_wxXe9qq z_dCLa^+1q3`U=T%4Jm`SHp$g4YYPcR%!jMX~Y zku|Uy9>}n<9szxrEXvLV*cwj*tvs$tMq>aYBkk9t-G%N&{KcT;b~dgE0k&c$(rqnu zak??3mjR$A<$`rMKZmf;@)Ws}fF2!%so&Mykx)f$1X>{XI7) z+)0W2+u-nYQ}Kv236inpA+fB>0GDw<% zI6y|EVapI8sdsad+{JqduE7jVC|@Ij`Pnnahums1xmEDn}Oc zkiyPsi?GTXNRtl$+c9-f11G|9adWb!gv>r0`|yYjG*d6CcK^8mjwkuR{7eI)fESP_ zgSFm#UiXuQ#v2)ZTGF07A`hqE zuHNs#dv8Tvh%=hZRXpT`835*D;01GRCK)ax2w`1T!pM{?h3w^v<#sMjT?jb`Oia(O)3W zuD|P#`M9*5fI`^@(t)0drYQF#U2quk^BSC#&^!ul2RV}_(2ByKg@#-_ ze<-^#O4Fs*9v+o5C0XZOI-kN=5MnLY()x^ww28bN5+ujWPY5H&TA?%!g}Yac(&f}`Xur^i zRb>1Hl4O<7S-OHvfx;tVe2Y{x4FoOqqxDN8|9;w<0uB`lp*ZdrOm!5gpHS};?X73G zY<10Ct;eK?N<20=0S!olwUHZXiMylo&U_ub?{iJHr_-&6agQR8?^>H_Z%IV_6?B+Iy@CrCG}n)xCfl4az7PZEY>ufc+!^cDWj&PTWD> zu0Ol&IEDrnw4tED&i+MqOW?UkbUmjBLoPTxnZwxO_nGn@Me8o)BNZ*_sdT8|giHYz zhj|;+J|rU)CdC&`Vf2ntP+1KhPC=LOY$rh@{Sqdt%l}a45SRy2iyxhQX`$`W393tz zm3!}MWrif79mDQ0*M_8J(EB6xyI)uZcoZAqgrVrPR6U-@KoKktAc$vL%_~;XPfQ&g zb{ufdxj=#OE5@kw6m@`6(^i*hMgPeixnW6cZF$1SX!g|OrX$S~tERKNX49Pe&zrxQ zAj@9vFfe7=H;C2jijtT6Jv z_|(``EVZx8N|#1JvHsGa3ghM!ZQu}#yo<-Cy=UoeIECVSf>0>{t(lp8R)HH^Vi_(O z$g>SaZwJPJ8FxU{<4MD6e(he7cwfTprCR5faB6 zqbj@vP&FdFY^-2%qGG1>J`%FvR3c)fQnRpCr!wglJ<%NSE_jx}7rd6QmQ!hqvT{($ z49o5sm!zMbb=1Q}Xe#xJb4sZ-S#)$O_3z`b zlDBm0C?%>j#F6)&Rd=(bu4p8nzUfzin)j!NP<5$hidZgP0~C*ryN(;Ymz{cu#1X|4 zHN4X=v$vF;tG6aF>2Jt3v0D3XO3G;)DTJX4L}JO;)kJg@D^ z8g5*{s>HenG5h|n86u@fT-jE@vC7hS)gCG2fk<9=L^d<&YWNc%6{d6Ul8y|`{S0Rs zpIz%~$s9yf<^%VuXyU#!sHX{IYllw4y=bET7Wl@^lMNOfMelwQ^;Q0J`Jb*IY8IwI zcxH0nz#fkX# zlt^V+LaS)AUR*oMzu`mrWQx&2DK95z8{2(vj%ld}9q+46F)Q*6oC`E#B5W@%{XMKk)<8VFbU=5`F43qu9zGip!c780b*B(^E3KE*Dg&%y-w@I=X2d~c*6rlV%-(GsijMfz+ZI#v|`xB>T#l}NYA!id%PB`Mo~ zhlxu%#OOx?M4@Biji9!R(NR6!t7TO=PisTRiz7=`aEQs%A>WXM*lVRo(Xc?}Nx4P6 z9(NZ5wi<_?`0{;@JtdCTRDvZC};Z}3QzR|jG8>0bF z2*$zYq#MvL$!1$HJ=>dqrIF1Pvi1HV+?yUkmq)dFf8xF=YGqq47S&J$mxrQVQCJQa zjueJ*)T~}Tys4mv$d1=lG-Y+O zeRZCd%b6vw?Ej<1_c_;Y=09s1(qD9&Yo%Y3+@*O_rgpbW@iUe%1VUM3SqM_@AwpEi(kz!mJgbIhMb)IH|k4*pnFw+ zD1DlT-XQ=Cvn;s!VJv~y@p4iSN%{(wHkS8!Ug$aZEn(F02-{?;2Q0Q(DiH&BAD=-k z`MQx}$Y(9-z-SpMQqoBB^?Q3ov$2kF!eBTV^v1&f0XkWyuZ0^Z+*xQ5cXCEonU*HY z%4wJh08FZu%Gbcq;80$-V$U<`*!%h;9Y#@G^e9AT3)(-QeAFAAO9kbn+++ARPGUE_ zv}nz_ZhCk~u=ae6tISGVD=Mk8q&SCHfFvxIb159&&fJfU{;2r8Fdwr6RI%{lUD6y7 z7Q@va0OA8lDV(4PNQr!=RCCZ@3ZJZU&iYhp_+#cyXtukTZRlLy1!-)V+E?oq*H44e zZF*TDv3l}Hc<9X^!-w$*^{QXJ)zGbk3lI<(&ip56Ng?&ae}a}yBnUo^`uY#73}kV9 z)T@b*lJis=%Fl_&GcRfH^I0j?3A4`GMo6QplwZ@M>rlm?5aZA>%bJq5l@v zQ`i<0b!zW#Kf&n}5V8P4#c8x7vqDFSWN&$%UOHr=m{?R6jtzDy`!3UYDMlRf7Pfb^ z2F72zePy2s)MCf7{DgZ|!FAvoDk0_3%F!|wGz>ogO+p1TX7^2=6m^Ve@ULnT2R!%< ziP6#K2Hzn)N$eU)!hWAr2sBPfp}!wvA&Tmrab-x> z<{+B+@{!<#yLmcQX7h;kR8RE-pIN}K@%euAVE)ZN%#6Jh(E)~<{{>aVGV%--hz;RP z>3Fq(+`WyzN-E%xz5blr=fWjwTNNnZUoD6xD$fF=uCi2ViSn!xN3*FOPTey(PljBJ zXJ0DAEu#w~@$FxxAFT$c%QA-i;S?Qp(fbDWVqVu+ng{4QK1^80JbftJMT3s${B)54 z9#gg}g=`xuqD9g?wa;PDqytI|P+$q+!#(@;*w2(G^8VG!d8uGE8?wl_IxdpH8?0?J zl3P3}JQ=ooJ=2n^xW>2>(s`GKF481}LvA6z7KIg;Vou+PfD@@b=3|l|?T?;Zrbs~4 zZ`l&KrB~&annjyUMXp0ymbAXW)+3j{gq~C}ru%zc8TOg)q`C(8W-uaqQb_(!tR_`Tv{-U3ngpJ8Vq5;@4uKT6J2H~oS#^*TmFWQ$I94^y`dz`oF?sJgbY zf~lIDEY=j(FMt`_jNH}$6g{=085LqXU{Lx?3tpsUZWw)UKc{t!IS`nU7?B9fm|jG$ zF{E{GJS1UB1|>)q&4w2O2(7^3s~302`je~ww`(U=#MD|1RYdiMk22T-%g@IK<#7M; zPRrm1{G3h=GA$0K1*n~ol4l&!b4JlJcwGS2Ew3N@ zUU>|UPe%j;ZLixrN3jS*TDtco$SdLo#?R8f%$*vSg|QY5VtpIDJ?qkDlB@L<2R^)5g`Gj40Te)#n_W zgF`XCJK7k}n1>5{1T1{&c`l6(GJh7nhI^$MoaR9A0IbyT!;Vp<=GqK?^V5aOGPPY) z(QDg62BVK^(h46LMpnOLEK2_X`L@t}MAF@_$KyI-pG}4mjQ}w|zo1c89hAZ-s&l&> zp#OAKN4TY~Yl;7uOn70g-%ij`s_tN}(1PEeytdJjfsn-Xr%7V#2%GdTq{15>#Q%{r z2$%VljJxR%NNiCXf>wUyXX+oi|FDo8#;}6&KeH?>4P?z0e$0lyi8rYDVaOI_Iwj(H zkQ_7xh|e%!SA44kiZ0%-Ty9nWg;KqKTDV(_=;RgJ-Xn#`15`O3z!}E@rzPq-`h3lE zKg6rzQF3FKL8Ci$)CH2?0w zV%6rmF=e{da#o|oj9@*F1!s(Vzjgg8qd85!!9WXCSt$rKL*>rEo%m;g9PXSEN+9v( zQ?A}G%)t$IG$_*?KM?`8sh}jD3LSzCjz;TBubzOUb-BJ;!&cveg-8xBDl9Te5b5xk z%MPG#W6d)?zirlnSWAA~F;JIO|M}V%Fi?K%{v7Z8iFvb}WJrHaEe>q6K8Iw>-+}6Y zd*UHbR40K&^ZtkLpz;~zq|D=C>9KCdQz;WVp2cy6Luug=e)3o}rY%rR78umIFTU_x zLX7-D;O!*O%@wE>L7Z27DR|#(f?UBU|CvaceSmtaTci;iOALq5KnH_sm_wBRiX z1Tfx`YJLzW_eR z2jk8N%~BmsIxS1^PZ#T9Il(wT2LA$bu5hMkgk#jK8yusvKwQDlYx!NeK19DoF@9oa zy&x+QEQF~hQuldnCr6GRZUD0$(JXDf*xB4&-3AxSyj?D{UekBW0}p()vn7yn$1xSY z-L_tAl!V;51S5krC^M{*YPd7oI&1X!WjhKY^w5$|;ZW)3c#LOwkU3sD160&PRnr@& z9wIFG;!i1Y7vETbSr&J@s8(Rw)gtY*)6QrvaCK{t4@=aBCbH4j)8MqYyv_9wM>Rj5 ze1{rs>w*sGu@+n-#8Y&5@Z+LbjoP$VuH9&$dAPp*9^FG8JPA=@A|wh1P>q%%mjv;l zV!xy1%MuWQosSa~<)f(Il46fa0!C5^+w)qsUi2d4oY;tOQJ~7uY6xw zbuo)zU4WKWN|9;cQ6SGjEvdsXBcMqDViH01E{MnWpyc<}!j?@S;|iv<2CEJJ6b_|; zy4cN`$znmOC_;*I zx&kEh#NAP;;#w)M=>(842*^*83ukd$=-~1^FwM=m`>5jsES*V#!Xyp6TYaEr^}VwA zS-D+o_HdqpNy{^kLu6iq;5UH{V+nW(q^SeIfP?&*G&HtRjX$&t(Zv5Z?P3`;lo6oz zlwjoM95xgDpG8{Chw9A3C@CUp-;#AJDt19eOouk#AQ6FrDCAWC$L|L%i=?oNeQ$S@ z7*t7jP%ImMhIs&&{R)09_CzNqZFltDyi_G%wBD;K&j)I^8GKTm!`2P8&Yl}|@QU3y z=TSqE-QV~dOaXVhvtKR{RP|?gQ41pkRc;O^?nJ<$64pFYsPXmF6BgiQ0`iNlj)YR* z*`3Q%zzy-40*mIQ4Z@ou4caK*ABEE(P9;Yu%x;GO*^rX_wy{#2Adc+rHe(nDBaki7 zHX~cwN=CU%ie{%vQ${2cM+hA$7bKuGcZV}d{=&C@lZVV7?`k3Wr4?iea@nzxE$@CG z+5Jj}un>EmxNgX-Guo%%Wm<7g9|ZrKS?EQt^a>Q0+m${u=T?OU z-^I)Vu`7lNXArtatpluZm@LOl`5lSHY zfS0_jdsX+_-4;N&cxBk~`sF-Q59+=t*%ASn;F;+YOWoP)o6FrQaLPjeZ74R7CEm(o zH~kCG)9N1)X@rC_LpIW8vYhs50s61INX@m|oVXjo|0sUVQA9d@*Bpc3FTii7_eBwO z-J6q?F7>Exq|2S2VnUhB35b9|n`i?7NXts^Q60sQSF{=oM@m8x2ftAfRMUWA>|6K7 zxs|P?O<0E+jAQ9U|7~#zqUl#hQpuEgT8J9(8}Pp1rnLJEBYt7>yda^thou>v7>Nd~ zZ669k>5WWK^f}aB9E;}OYm+&dfgSFfv!Z_yIhd|Vpm+b2g?*;Qr*VDu2mt6ve;XEq ztQT^#Zc22r+R(yw7Ef@c-|pVY7D8VL@yYIq94*xyzIr#?s0ZrHDzf+!Jf^-t@9{$< zyQjD^RhHhfE6@l`Fed3B17(qJPl;-A_t}f1b(8;~P#Cs6cKg4RCv<*Bi%R$KT?VV) zHSBHe@zT)xE8hivA9C;xck$#jh|9K7gWbh8%2WMcy|M_yTsWNm=5D}(s@!|IH&t-{ z$VZ@XYa4iZBMSIG>*U0glYG(XP0p*T!;#aYVLo&NrwEJyiV1u>OeqHPyUI){>mxhK zBYlfWQ9NO%8nC}Bf`vr6598vAE=GSxO)9T76U2OYpctGC@@I(-eBYAuY67LIlx*9- zN0(ouNaL9Cq0}8wjk;d-Kt9JQLxfFSZQ5fT1}TZK1m)rU*S{tc;n*kJc6d5Z6NqmQ ze#+l)fche}Mozd1&}J%oauLHQDFP!5p0KHUu$bT}MZb(!&HXa<|Dq;@iyL~K?%4KL z(TzR6p%!+tA)3`quYi3K_zyzDVztzZe}>Y53wa)|!uLxLVP4DB{Q$DsgKwX?=N)W? zErdp%{FQMd@uPsUA7E z%dSLWk#d%S?|)G25N>`EQ&$!I3S#8=rRroz$^BU3w-z;Rct-oP;5N%(wg;3+3P2K| z!khP@gzA?;yYoYy{+_a_ikEMq-=205s*$E>Gxka^zD5uAuK^fO$Fj+nL_kjZl4Jx; zm@eBos4)xsMcRz0+fM6gakhD%m73C0X!a`gDU=Qm~?J-{u%vUlFsCQ=ii#lx(8-P%&IQeai#FnXI_x!92NRem}KfE#S`D|1R=|0Nh z*_nOtsC!=SpQhz-l9=n~8MDKfP66G8F`1x3Omg_D< z(Zgr4pLmN=UD|)2?bluLcqEIQ-1vP-_xD|^8Vrsa>pAD$WE>dTCjeU9@BDr{H;Srn z(;!j(nU5Zb|K2*hJX5%dE3Ln|j&iaCnp)3;_%Bj+w-0;ni$21wwPHFgP=0xGz5DUG zQ??U(_-Wf+e1qvEp71=DlXz2~`s%tJ4j~gk?UMH*Lf)w&(PA(1vaXM(EYHoBo;xju zn#9sBzKQ+l&aaTVTZwL{I*|I%Jn2y!a^C~lGk`^Qi5|E8iiGrnVfr`Q=H$_i!{Nz8 zANdGfkvH}H2nyCxK*jsXu+v)0;rx^cmKk9WcW3+gxe_0g=D5N@DS~nkIORLVbY?v$ zp~-TYmw?=&oc#C;o*cN=@Y)iq*UVG(Xrg$XFDLyFChEY0ih|2HK^U)|xcc(a#~N7# z;;KmIVI&F$LGn5&5F~y<8N#4p%e@G9p8(qA`(`}c3 z?&|C2As6E-qnBW zu5(a~?mfETQf3Yk)#_jE?+yjQ=9*7KyUH$OfM}H_5Q(07=xRIjA+U~)|Gl(&Rc@! z?aikt&1&fly!e98+~z`Q#BQ!SSoJA*aWE!pC4%7V`=$e8`ZVHXmaEF6~{%8@K4nRg*@j^@z;+x+8MRD6erKQ9iN+ z-+7xx0k6wBx-u-%hzf-`THliV+0=%p@=K=N{+dmA_e3@Q)8k%`DtDT)w;6?82chck z9V$PgwSR!Un{r-ZxE>N`$;FB>XDmVABmW|B-e$ZCAJ6C82uq|HwdY zdXIp2X=NpUm8-|62E7QJOg5He%6`3bh;H@UJVRH|W!`-tdGyhQu*FU0&5+HK)JY7coCkLn! z&wDaOg~3I0uM@d%kko0cZn|0l5NM)iQXNGogvd^77J#RBM4|2^37r+&n5ZtuJY;;3KoH9@YY}@_=5%|iVEy}2 zj#f(oAW`Xb+uy7 z>%azhRp5Jvc>A18QSYZIKz@t|d=x(|va+>Hjm=FU{BOWLb(i^)n`M7dN1PE)-z;8T zV7!6BSexyQMJtge8Do{AsYWUp;dXR??G@Eaf(|VV2-n6%okDb2s_FG_F(g*a^{!u> z_>XioJw!co2$;{aTRaX1e5Z9kDR;h8s@JR&wWrg3M+xt{4yFCDir(aRPSDl+WEegF zXQlDN#C&dDqYJ8mVdJ}{ulMHUA3P8d^?;!!qCbpLekT7eczm(zjLyZP!&)0R#(A}) z&-r$~H(CQdjfZn)rZMV_J#Eq~K8%J;Z7F?Xdtv$8NXpsX7$%U0Nw)WI@8>GHyj}3} z+>ebA!nbgw82y?i?Cx0W`8F2SI1fSfZBT*(X zSSbceJ|aFJzQFN=R@Q$U{aaEW)UDsa)+*NyRoc8!o~z}JZXC*MW(l&+-;&5Jgy@Cl zzvDHgT_JP0D99UkH*lp*2qAcdC=hbR7K|rA4KDgwq5UX|QZQ#$DmL2dd@N4pT{m`0 z&}L&pgO$w4mp5onSbF#qmM9EQcW1}56kNh(wqaqdMCT-0fZg~+@hznwLCLf7v9%(= zjk5}hkb$APk`e#HvZavGB6E<%ZnWF8RhT2#rd8Y}zk0qB#FR70!GDTA1gQ{` zSrQfT8Z=^a=S9PHAhTIhg*>-i-c&p6=lgw&u1AoKAxYVew6xC-mF|WzJz4Uy;oXJY zKPC&W!VH?i$|E^!gH@96h<|hVa*UxBZMq76R9vPq2wbgAf}IwKN~Eu1>lJ z^x4beH_K>Dr;DM{F@$t&mW<==7bu54&3i19-Q<0Ng)v#vu^#dRzfl#N*n-|rrtm`s zKb65L&79394s4`eG>7C-Hdkk2{_Z49?X|}(4u){;8yWJ9vRNWld0Z_=#+mqtz<*}X(2SZ z@?GmpAMrl>+RF4Kp}CW=4IYK{pq=@O^gmJqz`9PB{vBy{* z?-t>)<_6yE*3I$VHDDk$bS(KL__e0!t(OtE%QtVxqHr>=fkg zVuCW-2Zl;k;^FDB>Rz4|9HE(tBXRM|eM#0rEx@r<_$ijh64bTEu7>DK(L;?N<+Fff8z;Ov4`$LMtB2Zf3#t7o^_Zlp~Dx`yt-#pgTQ;T)%l|^?bEl#=!6`P`fF`Mm93LDt@+4^ ztMwQ~W?C?N?wyXJ(<;cGS#0t_C`O)j<;CclmCz4|B-DZOm&i=D8tS`KdipJy(aA8q z$KnL8n`fQzKHe|-zc+{&k!oVmgb^lK(;biOqZ9K+jET?I@Gp#%g`kshucd3M?SJYk zj6M)P52ZPRvp4ybn|mw7C#EwpZqi~&2c3I_v==p~L>F44EqmlUJ~Y*D*718ZXjElK z*B-1zmQd&|Kb`#eNoRJ`vz#9g&4;5w8YkyrY*?5~++GHUbleBsBf2}ob-7Gse1bZ105~7=6Wh!Gp@}os;R(_=9X|w?n%(R2N zv3}SYMaJChq|9zE0ZW&ja^^n@;mras}`SVYqO6#+8n#FYkeMj?eYlX7S}8!H)4g3=lsNJXMdS?$$rz25hVIJsrzy!M z#S2F!E{uKmJmHRBGT+SA!dg)lZ_8J9CECvOm(<$4RC4ZCzCN?d_S)vyIDN9wVRnz z`ybon1nHf2PTV?Jf1~WapzFZ(aGj@*#a)l0k-802D!UecX+n|PU5NMcYhkjYs9Aah zTS`H9!KZ4bsRDXyJVA3lIXTo74%!o9S`?4BMwHe@RnE26S`^1^#%teCVc*;zTgUnj zps?iDal_i&!J1N<#ud@{4&^F9Lc&Ml`lW?UAPRDVe>y&+C5sGtIBl#wQiMRPHa;*z zNJS8_^0;QDZ+`-r!=g*tnimQYqMj-_PLSp-be1%@Vk{&)(-49iB5QpHWQ}_DQoi+{9t9rd3W>_VPovVzzh57=6)m+@>ZEG7i-& z$-r9n8jSEeLI&>}GSiMMx@KW~bBmtZ1sgme@YS1*8mQ?~Y4HF>OS*u- zY|Voqj*Bd~&}b`2Nvs@nDM-}Ly93gdmrBPIJTh$1e3algMc z#&=&|pGxdrOqIFpNZ|Qvb>ZBeEwsG8kp}7}3BWy+pSI#KqkqD1o8@ z0OX$w+Da@s71^1$kQfH1{$Wu5cif)jeM^20I$_6fW`(ZPwLymK6d7R!u=jwjA_M3t zyOA*-C=MO>=xWpF0O>-J<<-*eOk{Q5I;L_6h(weI)jUT~Wq!*;I0jV88iUN{Zf3v_ z2isn6Gi8R`yawH*aEJN!30;ug`Jw4I@U2)I|J+!ZyO+t&?ng?L z4sS8-tKh1vZWcl3b>+pxuvq>F#^a^=_|o*zWl?GHCFu+L*BjbUSxq(aH{<;F^OJ>+ zsa%ib&biL^E_inyJrCZq)TH;_Byq!_7l!q_d-+^54Exm=H~!oh7UliHNU2r_FImV7eG zzILhTbRF^j6i?SGmm+C~-3Wogv=^;Z!zZEqNS}-1x$vnvv6kb8^m@iY^PbQnt$laz z8RQ^1kpjbqrF7PH;mPvg<7pPw*uY)bAQ!CFfzKCCChf<4q_4;kD~az|}~xu6!ezL@WFS9t^XpWrIH^}B%sFLg3j#xZrz8O|#e zu=)6dq%s0pq*)A)_CTj3EcZLhpx`5-<@#e}C78IMF%Rs;i zYM8xUzkgHN+1Yg`JbVDE54qwXJd0BAv)#w_3rL`11UnaEdkUix=6m%$`91CxC{umh zy>1eSgvWZKGD*)ft>Z94RruiJ-|FffL zV+HslCaKP_GWyNK9CNbfIPR$S*9WmO;^B2MVNiT_O_^GKY5^=(Ic&)eWttD?C74ML zu1h*^w_^Afc>=pbdv5Ox z5qnhF#mSlfetyhscUy^0#~|ac)MLEobwGqWWol>(Z&MUb4~5TUN?NUA*Q}<+UZpJ7W)kZ5p zMobz%5t@q!e$0LXEs)u;T zqwiHyu_RAmU_{^f@2}UA;GU5d_~)beqohasH#Q3Ezj%@1@Cr$su?o}Uo8)^mu?n2~ zB^{ixZKs5D=9iZ#mG>~t(2xuaQwm@qD`Zuue}A1dhPs??UsiM6pPzmv;g1{f-5!&R zr#~9;Z1Yp6(fU87rek7UMcomfn#P70VI%pTe0OG+KE#?p{_}zSYrv7Dba`M#;m<5# z$wfBB-Fr1E@D%YRQmmY41ct4g9zno`T2uo0DdAje$;vZ-tRLK_{|*5G7=lD`Z{|M( zkPW{dE!vj$WKpLF=mX7*dwk}UOM2>~@0byt`gv7X9dByve0lal>vgYBpD4Hm+j4gtcRvhjgATZh# z^z*ygN89<`7z(l~-UAGO;j{8gA2_&Vw}E_N$JKr+km89Ce4n!Y>4H?Ra3sxWuWZl~ z5}cYGopzI-6N1kZ#nme!Ui)`47>R-{cyrvJ;qN0ogWs`#`okXMe;Ly@@NqPNgojui zmqyG*fNT`xSSKif0B1?iAglDf_6p0MY;b)D(&^zK!XX!!lVH)bNT47V1X6iu^*&kD zc^yOBL$EjXBZ=Fp=go!vk%S!&r-fHYlCHk*=fb%LqS*gV867o$uHFmYIrP7;4omKp z5AI&btbpdf4+!PTD#9iP_5rN)3t$vr=>nX-x7Y4G_A`{k51)1bv9#lIFEJn$;DHvD z6ewH7@Y(96i+F0HodRLNOQ8Gk*qcN0Jzsus1w8gTwKinn6z~S*z|aHP1-T_6FXIZp zH30bZ9&i_h0yr3haYxuJ9FRTFxrAKS{K0v14%}AGfIR83!<+;Wi~1cPE0c+5(a?5M zK;Sp-=a8`LSuBlSp6)*J2-gRGx7MTE;SWloe72L>KtCq*DrFHE4e*$hNrArMu3DB@ zXL~RvKAjYbhlhtnUVPJM(3J!ICsd#?2m!uyT7WeZQk#DUWFod{ox3P!6DPtCTMo65 z!T7nMoTn_xlbL1GJpcOuD>Cnx#UER@;r|^@b-D9P>N)II$2`QU#67wshJH3mG(kV~ z0h9^TFBe4q)dFz`Nu81d>G-hKDy&4+<$HhX%<{_HISBUt9rij;9q6d7Xox2Uw-_+25+G}Xkj44WNf-sGP#*RsulsP2-PP2^8{T(&t_F7i57pQYJS;L{xMT$ZQb2 z6Ekh#Pve1FEp&uK`(#LYEq>m4__Xxr+6NlHD-GPtq%|gdC2$sz-I=bB5p;e9LJYfc z8i6tcIsm@ot{{UVeZEXB2If5dG3ZMa?Itwt@kLA{;t(#@vXZ^GkX;Bif-Q~1hrIl-uN5-kc}iM61do#ziZs} z4m(^1=#DZYirjZ+iX;enAcI;H)#l@cMZnsa4U9P#&f!>9vZ@oN@iGtvAraQtr@LTD z5^!1y%d9qiC?+e{O;zv@z=jV*Pq2XphYS``oiWPp>)iDbF#k3efW~c_#o~7Ur6spCZ!#u72!b^|L;& zcK^G-(4g5KV<|OuI3K%=k93ntNbMO@2;F zO6p}HE9hor<=O$Ax1#9SZg$q8tSw>I$OjxxCz$+}rdeWM(vJtl#Djc-9H8@nZh&q& zl|bY&qxhp(>rSKG%jBvVr_hZa-p}> zR2iUOS*k|AsZbtAtI@JAW%e+V!K;mdsiG|##I6?3LWmxQ64|~T#HmBo@{`G@hbqY+$mV;J zh9f*c&d_%l_T+AALKuT`f!o(t(NdZS)VJyT_#}_wI^k~Fv)d*{#Z&Qugl@&>f9;xo zcOk65gGs5g@eG=pnso9JawZ_Y3s;k{Uz?zSd;=-Z^Jvemw1B0)gyYGAS=6sc`~9<=q43=~R!06UguKrc3Lc4em(bD_V?`Qw z5cp-@gLnk3uN78t!K$cQklgeoOPMPF#t9*tHUV_L!)osL=q?+8@a-q?Zf`L1LI3hj z4WE-<0yM7Av+t(7lriwj4r^ma^fQEY-iV_+FMk_>C4oR=3{}OYk?LjSM9jB-cQ}7+ zd6YmndBB7M+oj-3IElkYjUOjc|8bN=!BJ9vJRwh^*YMr(+ z{fTjfY}xO@;98Y;8f;b7)zrpqZyZk!c~fPAau-*J3iUz&Jzh?xlb7ooLu^M#sUV8m zvq6--#D9mzY!f7)u#M1)zeIh@Z%&2~VD!bA6%yu#B#5MwCxTtj>7Fw0f%xGHO>`7m68w+BZVJn&uY2Gzw zZh$k!Vp|>d#c~dW9^(T#w`5-~crVSc=2)4c)@U1hcK0^E*PO||aA_TTa{ceW9xsQ? zM~w$yxam)`9deV4w*b_WMhts+u%H!^80(|aL=wEKYji#tj2)Zl$+a1<^hae#= z8|v)%vRP_Hf08`Tw-;Q!LkkxOmHF16ROTIw9+MYpr}=_^^*qSBSlj}N{Fg({TKwAX z75V8@Wk)|II4j*}O@pbRQE>mGHvRWTK@3EYE-(0wTSCJUY@TXoTBQd!FG= zna0&LF~Yh@n-v*CUQJu?pOuu!ft!26jb!dKa>zY(h(~6sv1R6K!^YdG>Al&3Yu9l#3Xh}P=r;5A94WepAZdS_wotvL$76{kI`6Q1}2m^Y(5c?}wrL#Mp z)#@~V^ENT21=<+pPeDt@?3ibF_bq)PPFFtO-zXw=pXO=7F$V!Da{)P%wNCh;Q*HwN zBG@C)e@-?~ftaZo+!HUSn|)}ZaNQM%P-(K6f7aA2{P_or(Sg(+ehU8m3r*Y~d$gJ$m-e~5u+9jxUnfE5#I+MyJ z$Wf|nznJ&yqDSWiA?*w-z^E|g>a{N}?RSv!LKF8S^4wYitcRyH~lN2msc3@M(KEU&rU-Wzu92gOUnwKwbVZ zkVN&!<@A_;)}Vr*K}P1Y9v99`R^X?6LB3ES1Xk6~g3p5yyKhJ1H6DBdJBJjSg}UNN z1(c7~D*e(}{oKgC73L*#3^TsuSn-|2cyweR;jB*2ACutH+Y&r8|3;Xh5Ft4$7usu` zjjoZe8$8dENUK>fM!X<`z46^OP%*qMs``?t(bRhV;oX2ps{ZO^;a*lk{T-^T;q~|CHMM4&W7siE=Ju{R+(V3*CXNcMlEAG`*zLd ztnt+Z)g|*yZ~bW1#hkW(hB)(*r9Rx!&c0v41*K}Bff2d~O`4_EBl$CY(jl{#?vmph zyDMbJ6S?@db8TMFb+xBQgDgmkdD@JKC0=9rIjl`KS&4D5>XxG#G`|vG&Ri)n=oI)l z-hh5oNg-2JH2o~z-O8@{hyCM?qcfUv!>W%Tn3!+g z-@Oiypf3+dN z{U9qA^jf{>C`tEg)prg$-=wRN=F!c)^|UviN{JG>2g37J-pKm(e0R2#Nah@mZd{l7 zxO~A*4cYAGDE$>y#;5(G5{-n^R1VqQNhsk;+I9zEFosHqo*i?;)UjaL+sq02VLRsi zl$buVwZ48ACQz${`NOO_ z_GjB8aXv3qiZyH4+iYy2#q&F=&{mv|7NhOx49E;(4RV%E%GJ6ZX|xJI|DMfZ98nuZ zV@D$uLZmzQMVX{DyDMx%KH_e%o`>p){YeY2BB}6YdjE)5>8L+{jACwlZ;?${+9|SG zz8K%IPL(L+7UoaME)Q>=|yXltVCu<#O7Ugv)%}0iP+Z)83`q<17Ij{DpCTP{#?q-i_bzcKJCl}~ib%m?MY!<1xTTr46jFP#;v*0ecNa(=#twQ^*)s(H=&U@V#~ z8YB!gLQ};F-MJFQzS9PK8lC-vO-0NdHV^g*U+hJ$rL(gLhWtcc`_l#WlOs>bBlTI| zuec;eNcLdOYV~OOs$r|Ym+hd!_w{1Qr^^%9E}QeU42*<-aVUBxBWC|(`10VAX5Y5G zs<3J5*DaOYpgLo1qBJNO8pLJO>SyAI+XMQkuBNc zi2@l{ghvfOAFA)0E>jD+?Mk)A-!RcOR!qWVIeYNBLRUKlaq?qfa75i?&^prpx^=&(94;p?tHQS#eu9kao(Ulgn|$Loo?gfpHH_pr6^MeuI&R za^Ye!fV-qh>NU@;=;Ypd@buO#_O$w}&(`hPC+KG?T63znF%e9X zj~ua=yb@e0maFf>uHh3stTT|Sjeg;Qk1LXzl$+~Oy=s@m+WW}L)!D&bcILg(iZ0ya z4_U+WoQ}~d!P^H>7z#RYi2Z-R$v*(6QOUkbjWnkAcsQRNmM3m)?{64AsCj-FD$>@% zhEso}c1^nm3b4f&{)J$6rg>b2SURn^v2DT6rkRI9ZoE9l=zPMP=5QQoIq5?i5qb_Lw{N7Cd5;4==o_ zynp3Ejr$HhiF&fslLz(Ai})lv!dC7IG8Fp`RPVPJeZMzEi3P~yi%v(fnqgs6j!K5|_ELr6e<6?Lszk$z(|F70ZvaoR#*Ytgd+9FJ7%?xnjs${7Sj7 z=XaezA@J-mHreh*DNG(0f|O}Y*sx`Oel6w=G6fKV;u^E;Bj0m{IM@cIn#gYBZ|z5L z?gvA2@csB;3j_Z~U?MgBFCJDviodfR097bwKY;Xf+Y~k|RU5j0Wnm9rIJE?lU|eG- z2LvmBEs_RTHOyI=GR$LtU7R*$7Ny)5>BdWeL}3xbQ1=WECihSkE5XW-9p#XNUfaC1m@9B^)t#j#jxuM+H|_m7gFbM2`^@6UH9sTa=(D^2c|F@@g83ytKl;Tk9a71OL!^sjR; zhxyaf?*lf%t<0|#umclso=4!(e>$Ag=`E2|&6_OKNNeiLln)Rk>H$hOD^$RQ6nj|| z3nq#k&UP_svE+z;uw&%PIK$*L`q=06wHxM)ZDZc(A%+ovuAjMrP{S*X-hUL^&{J5d zR%0E)-+v%;FzkDNd22;)#zb%ke+s%>-oFXRSn^(2HYnFKjwsSCbM@?q{O0h4T6bxC zVc7JIJQ0(V|D)C&vf=vs=MmC;u8j+8Q7X1Xst%Rx_sgH4rAh_+@3ILR9>y~r2V@UWUMLpgoN5g2>c`;5FeH#^%}EFHr!G&@XBeH}*%i-FN@GFZg#b2=Is(pkpv% z+xN&nQ23D&XThN4saYv=;iq7cW=~$&+1fXY7iSJ_M2N;~=fUlW5sz9Q4Vy@P^w+Gl zzYFb9>fyee4clkQN1=WbNSM>Tk*wyB}ACS0MMA6BYlU8f%1^* zZL>VQTq-g#^R0g{@F0;kIU#+D`UmNHT95A7Y)#Gtq-$$z3&!o#K(1T(Lo_I7@Pl(_ ziX*ANpoo^w8Ug=5K|P{*59MRqw}ytk2*;cHoO|F+|C@pUxD0j$ zV!k0PN?@;EwhEwoYi%Ajjxql?lz7|=4HORKiWIri0i|>My64XFuo28gxN@88iXUox z9Fo~Bg!s`|iBx?Ehfiv_QumlGGTFWwpv z`;9Edls*$WU#rF2aN~F1ja-#?Wk_aPw41!nnW(MbpHIH2083kk{=W!(&vW6(G>OLb z>1LQte;HUyJjmIQJUu>G;RYax3vx`LpMIVUgdsplDJQ&V5h`#M(vUrUmDgNtd$AuK zFmf5-FoEC1Vbw0f0B5i){7*Fvdbu}Zt?;?%iU|UQbnJTvJ$(A{8%zWEN;R0H8J*C3t;cb%JdyvJJY_3EF>sFQ=ftPYtQC zo(u-Hz;&2W!ki36hu0fw$?rhD`;u_q7%I>W02u4~vxQz@?!{kpWJCQ+ty%B@DF@tT z`2=MIaK+M4EZ~Z|yXNUNQ2rt%nK(E&z*v6;NzOpWxjx&D4?>5%91~jDS+T*A^W)bw zU-&;=^S{%`ik;b@U!DPO6Dc16FYRj}{Ij2hH3ZD!k^p&oeS77bCT#{CX~*E8`dkD? zDj+BBsxrED&V&$Q)dEpU86S}yHv}M4Lo~$U9`w;hQ;nWgPp4mY6l5yJNzlEl)k`g? zz2;}j451(Zqo%Bd5Obymi=!gVsiBN2G;+p6uQ2gJK95RBo0d13tq}z86!Yd!zAAj= z20|hBH`jkc;SA{?S^yCG++<5bia8)D-Hf@OoZmKkVR59C0n9+6V>J#qNQ@V9N$wUK zN<#yK4kZ$gb_fh7rRbfE~~Ne4;VM--4s3}DxG*6_6G z*1|F9LZvFcUn8M66#-!hHs~4dexZ}5Ndlz9A7nRXq;)Vm?P;stu9b0(}@ zH$v6%>eQhDL25{D+kAf|&mHPowL&W1K5B zhIn@U66Tx6VNB2>9bcjTzij^Z;{HvRw9W??%8H;1i*VfdZbn**Y;Pv5`Vh0hZ8SO? zAYj~sPQOD|o+doK2VyDomxuD5Pb1>Bc6L{EV0H|KQA^-~gv?0yn?pz|DstX2w{lpY zYFb}k?|t?X*xcehxa%uFp1qm~>R`mZ6INgg25^DP4Q<(=pnROG;P*AWO~|h=+*jC- z#+cf3N@@z$DIn#qWrp8ZRiS3(94$X^0+kcP?*sQwx3>S(N}b+FyFwxG3gR>tEg?%f zPeq}E#|pV4eoA%WPIHsMh$I@e!1o&CG-Hwdcn`TN+=vI1O5c>Qs$R?Fr=gj zv@N{4N!DCT(6`AY3h_hYL;=%&dfSoo1EnMpiosm<(mnBienr14ieYr^4(-{%Z{}99 z0rXEt1NXxVG+FQD?-AiWeSSV{bg;i4AF0#u9R_xR1{5j2c=T8u(HtSj-VmVp?%<|@ zU^U-X#^ zIL}IV^$nai=fl{)U0Fh&{fAfrJ^M`OyYlJ(8xr>f)EG3sG|9J~jA1x6va87AxzT-) zr3=m9mzEjn+eQfXB}Tv-Gy~)da~<9I1oXl?)b&D7OZ_t7MK*+P582eXIVCfhf!Dg$ z7xw(+YV~`1qoLfnpvdhQ{k(`#2Nq0#R9_wHdJ3a=^ns%Ar4p@AOu6B5zgsF?E!>tUR_>l3Yar-rK?@cDJM)4x!zIkyEGP$+ zDX`TzyX%1vWIIswThI_F26nc%!Oj~*u$?GBsO3Z)6MZvm5&<}s_~%$&UW)wqk$q^= zg@-p_5JDsDun`6j*BkU~y38IS6SP5>-WjRG2ksz;-Bs(9kw)y%xdbhnGni+T%{5Rm+gfV7o71`S#rP*v1SmhEBK})#AO@=Lm@uI! z+(kR^+k%Qw1ubMnkqMClxI`_-BX(0IgtI7=3->nKn;o6La+of{xqco}S3baMRe#=o zM2{tp8d1h^J{MFahfh_zJ;JR0JlNBKNZZDyI=FGLJX}~Vdhn=Ts!UFAg38yKDm`5k zkMk3rE5<%u+N|dj&~WhVr2n*I+I*pziXvSkPxn$O)g2xXhEizO+GK<5hgX=?^HP3+ zVdx2X8`NQHsgmh(9~09PBA&Tb^xRpe?uogGejfb_d2d<7<{T<+=|q4spEium9`yZ+ z)IoyBpb6y*-#p{lZhJJ{>B*j6P{A>gWT^Azk<{A&Vw`U2)4FJjK*$2S1Y@ZVZU`dC zSiigj{%VjXkCkqU4CSED-!)WzR}u2Sc$if>z;?_#w++$?>fzK)>1v2O$ma1sjte;7^C(1I7(8FlPlX4@3fSi+D*sRoeazq_w-^^l%4vw2 zuEa#6E?v|iX@L05pyG)~Zy0cR6~SzFZjPFpcJuu6gpv2WsG#ih1Z71U=r8oJ8!O4! z_$8I-;4b0kk(7DuFgNhg<$fI>AMe4|)z#g3!0xw+*)6@B;L52FE(`ZZ3@U~9EOGOi zVyNa<1yK;+Sdu=2LeL$YCEl6oZV?{+^p^|Uav^=l2o~cNrnI3a54?yP_?l{SE`@S9 zpd_q!YI1Nsbrfy0;CNUs*77W7YV`Ak#Xi@FX@}Jb8Rd{CU#ndN;cC2~?@m+J#5snf zy2HZ;ADl*eF^+f<2Q1D9hN&hqx3X315-EOs$nenrIs2u`{^-WN8_H;VlqaFI7I)mn zmlLjC#NKM$98@S@8{^+JO#XKFV-Ur#-r>Ya4?8yL7b?>;K`)pQmL`8-zF()#;F3EF z3s%1^8|AHl3)hc3TKc9RdL$a5p~rG;`PpQR%6R^`rM=Pt*}?tCQ~8Is*x~7Uk@jpz zTu6a(9>%@aX3lIqyq9$+2n3}^%xSYI&XCJd?yqzUAs`PPa>{!Mm(3zwe<^o4wFoI4 z1Ob#1x5-ctI!yCf2LwS&--4o~&LeU~_!a!oViPrJg66tD_5@gC)34;mlhNncdD-Do zUsqv*qIr*7(C-RxRzOHOie=tZ@X{5XsTmxKE0k>~-g7 z*RaXBiP2BTeRSh?sf~T#WNR0m|L__!U_y6%e)`LQ%n?6;Fj{*82aE8<4dwt(#)Af z8zOpWX=fz{T{celUO0Y!ZezL3ef@A>JI?cqhyJ!fL>z6%=SqG=uEIg)!F-{|ii`q{ z*6g?4u+=`%-R=3Y`klSC5wFvcDC?7s3$}<8`gvOShpshRkv^*+6DvA%=Q@fxNvxZf zTZ=4vO+zQ)b7jT!d5Io9-U>kCD2GRb3u`D1LtD#7^`>>lGg}M8HU~RyP(`bcKubWb zw8x6;8HUBDnyKh~BP}2x0E@=&E|GWyC1Y(-LfbB+Cm;1*i2y=Qia_Gq)cV@M~~d{jpEqf-nJrN z6|VA8T=e+xmU`wYry(7=fbG>ei>Q`~{IgM7f7kadZ*EQ0ZGFgWxTWuS_T~9TUw;~l zJRygd5dW50`McqQ>v|jUUyI#wCYWAtqyt}}6r2TUus)o=7Ad}C!7EYmQZz+b(;=uL%of-! zW0tp=%TZ5c7N{iSmR#0O$L}A^+Xj`DL;}-gzC8=1R}~P>S13hZa5Y3qmMCI^Qr^~J zDP%1ra8vfJWd{L@|2frt#(Q1U{i9=Er{_YIe(USyp-;Sb{B!IJCLDTF0w$kh)f-4S z=7rj|a40D$kz^E1j@n;ONff<-Q!q9*wmlv0dURj`<-~nI->_1J*|=e_Aq;0Tu9?cY z1w;x>g%ywZ@0~>_p>11q_q7gJp|y}-a2e10sZ4`PXA-YGXThgkGCVh3sJFL0zq~8F zypUvnVqxt>6&_!05|NUAk^BAWWOJ{|(VNoKz>+vlqt^z{-N!3Y4(bc@lk{M-nVe5D z3iEI=vHGP$pu^MZw!#Z#Ji8On8`ahYpn*QrPFKx%Ay+Y<7FT6+tq_BrpWzvZH%K>F zMZ-(U=K^Re+7$haSE1>YXF|9zB{3cFxk3x!OU73qBL`~bczb3EMaY=#)X=W5%;^Ja z8n431-&isxY>roH4Cc6~)FAAGZkUfIqdn?L@^cD!WRZIt!BF|^6Ad;6H?d14<;MbH z!7pW27X}J6uGQ64SqRh^&Rt3~Sh)e(8O$dW^?qo8ks|6IF=x3lx85O_2AaFrWakP2 zo8~%@I|oPf^0|-Fm~WSD-L9~lOgCHIwd8;75w{(^9Gz5b(JV^LXM+8(!6_*8LhGnr zbcBnf49>^I&**ovjUSd-j*+Uf3>7s@WGKr6AS*JRbk^>nxz#6i5SWgFg5um~+8(nKJq2G%65OtV95fT;z9S1(-=#ojLOkM6dEJ2!6=&Ht34wRq&2< zAThz$+$;q$3n|xPgt#krPwBpmiQA{=LRLj2b6F8(R(^+}jMO@_50g%XH>RfD9IwRr zZm6~{#V9E}DjeXbmvh=XO~`EjRo|cR_TEW6D$BLJK^q3& zXtAC*C4?l_rOz+h{Fst9?nt=Ud>GQlcvAWER%NHCnLdr)k6LAicLclIy_7A{?=UbE$Xlx z0~?6%=5l$!$LOABx6>voxt%uGsXS^NKMcWjTFrO@UlXao^e|Cy}Ix+(@!GQn!e)diL(G zYPtxOEA?XJiT!v}K~V=8e*pZlxlE=~2zen~2^wFzd-5Mc)B6SOmm)HUBM02Vm>mF6 zBaLBYI-&cNSX*H+%&xS?(ANf&2EnBSo)>Ydi++uyH}%g6JpY+JUvZi8r`>F*)QazZ zScK<9Ph5mr2A;kB?oTbD`u$P%H1-EVA*pkhjC@<4sxhi!QcJuNn`|nmvR(1-0CR80 zT4Tz|*AgpyjXW*?{S7?*={%Fz%tGm-mfQAIwQfwu%xO=?>%IHb1B@2OBIV-Ojb245 zb1iL;sAhl5yRkHA`9ec!bo5B8`Z+(cTo%>A8S%K$$GlglRqWF5?s$hX-|T`c4yCDw z+ej`w@hU&6hxM4xhm6fsEw8BTht*LhJKc4HQ_V+vvCJGUDP3RdpYVmz$(wr!du%*- zJY3?{!N~3QjWhzItYL5UV;81f=uL4Ns!DDXwJDDdrnK`({4U!uKrnT!U;{w@pD5Bl z9Cuglz}eSy&9~W3`xm)d_J_tzju-llV3^REqTlq=`7}H|F#MTQ7>)A184%V{BD0w@ z#|UFK{?uUZcmE%X0Ydprhqbva9=FZd6-&8ARmcL?c?03Dga+t*2}PZZxIA96J7-c$ zYWbQdDm1d{Bs);Nx)Iao?4=7iA7f~3X0*milRe!#)otc7-#sRIN;T^*hf6z}MT4s~ z-7G7XQKCNerBoEgtomb>cO=WUPB3@WM*kKMZg*un+I(MBcsEoaHc9>D>)tT6+)~Yk zs&KK<38hOp<*M%b>>|FB=vUw-!J&0g@+i2d;Z$Mq`0@QLzeG=Z!#s+^9PO&G#o8;nciKEEn^-=o~cmJ@LYazl7D#Fa9?w z_1jy6j^xy)E`6NlXG58I9HXcGhqG)Bk2J0 zua0BvX}hbFLE1s@jDWc%P2q9=fMNNqoDc}=zS3yz=Z|y85ze(xPk%3@(CMvpGm6xN zzTqS{@V(Q~4I)UrFqM!FBwh?RP#6enV_3^j9K>7bAEZFrB9w_}Q|V1Mp&;ZP7uY_W zb^DSk)xY)5oVQ>%)FQ;)@pu+j+rctedvGb$zW@0f?##{THg9Ia+_Z;57fDA3tM}GG zg=A=a#*e;Bag1J0s`*KOZ#wqWy8DCH{aRO)io)^yd8wcT9?~tM?hjuL@NtE;pH*F6 z@Wy!|oRJ(;k3%JhitBzUlS6#0YGcLjh*OPGm|Gq-S&o|tDwI~J5Ze-Yv#`XcKj0N1 zfy5{dojpM~81@q)mDlM0q9Xw!&DHa^P!>H>z@+d8k=CuGugf%*abr`O zOrb?rsefelbNrA4j_ni#58nFIb+BTY>F7GO(Dta*)ANX2kOP2XL@q9>=TfJkQ zc1CRMoltsxaK@pr>Q$^dz|Oud$dWYir*e()Cgjf^pKmu<1)+-!NQ*DjbMIa?{#E7N z3;kW?ln!BAlFa3i^K;Rm<(+e^QsDT-CZmZs- z$#JJ6>;ZEZPl7TaY`ri;QqPom{{HsD7fDr2tFbB-oV$DZ5EpkIyk|&KK3$$zBrW!b2FBK`35f&E_$&Hr(@B_RetKYv^tJV0M^uB~r(5TWceJ$}09(4Pq#z!0;R8qC2Y7?FS%a*DfGsc+ z*afVOR`>lgWU3?O#h&l3zsNSF-~4X3mc>08{^btahvJ?O^8F~uo^BsWd}V()I` zBSD(EgzY4xI>3Mm8qLi;u$&>y#)tC&&1dUWvPW^~1p^-D!8rqnd@8h)u)CnoS_S|U z?x8M&h@)wc>he_tI_VnHs`;SSQ3Yo`s(EmZm;da8291>O3&3#}k7lQ~nN%|$Co$ZK z7Xu7=yDJdNTi3m>(4uDA%LEdq_|&^NI_i(Vw+FjXOKbDTOGE?Qyt6xi)TKQ79P50u zwkX_oZ&ep*6C(l6tU-?=j{K$`_;)E>fL6U}_d}6T=T^>-DILG&qdRaE9p2FwsZID@ zf8FmV_U!53Cb94?muuvQ#l=7W{^BRC4PgCq|Ej*IZ)XgZfncpq0LZCRI)wzr@|cCm zZL!*QeVHoECIP=DmJpw}sU>;n}euerh%k87NSe5UwiQ20T1s4TtX!R zJnE#y)6FHOGi)bvt-~M+xwki|*&kFTe^+c_GQ%Dp8>{E90G7(k1(4pdhDul%jz_y} zupH*51mQ71L_X$+hI;i$|9s4FJ{pbPXK@4)0*i8)oZwMA2*ch<{h2Tfb{gVP72qNV z?BeJIIyC5<<=xrmh28R93j>{x_c_5x_b&8aK|uj&XoR4{6GBB;yL~*4$g{IFUh2w- zzmzy6YL6vKD5nP0tJmMU^^IR0sq0OZ4p6&^7#IKq|LH<6wM#$EBAr!Id?mdZCcUjZ zO*>t}WMvDHu=6vkLXZOQ?)k?HfO7>%mZSXXt)1&K$nN1<;JXe%w9>bh3M9r&7=1>ca$O1>NEmEU;W&}tpdotu-*mt~%!kl*-lR!m zR?AK{TZY^cJSV!G<$8^JSs6dauuj*3I#OnaKWoY0_rRZ&H@AKcqzt4P z<&X>i3=EneJeL4+=yHhCJydy8iI^?$81Sql$G@YW7dW6xOP@r#{DH6&C;)5s*P~r4 zOWPljWqZ|uP*)SfAa`Z-Nd)=C9#rl_dw55iC;y_+KrIW@t~I27aI`1YED!|Nm`de~ z)lV0xhy|T^pkDTiXjg5jll6cGq<`3N3^bV(&SlNrpZc*Q`Rq1|W@Zf;6c&n;{gT$3l~jOc8*w zOf+y<=+)W-V9e|^YhP*<9^u4k`0-b(D6J1?6m`yl<)>RjxEf&(pTe>7^}YSO!f|IR z9Y~!h7e@XPyc7Dxi}Z&6pQ?YIx6WbzIB$^(l&f#JmLN&|=|P7HoQLGnSl3RZe)zKH zPNv?vSc40Y68g2)e16Bj;jrLTSDF*BSec0TO``9Qi~pFrD^P}_cYaI>y>(j za4j7K%(to1k>#po2Osj1ecuRgU052$-I$?oOjqeI%Lo4ytwU(u?e|AK!ASzINiVZ3 zL#BJzyOKO50GNBzlyYoPSZ)cL(JQTPttGNXXCG?)8HC_B^cERmTkhS+L5@m zUlKuw|H1P7zkGs>aYT9}8PDUZblPnibo7Z*$BxR8^Zf%SG-*<^aEPMQn2Urw5^&uw z^1rUEtn89L0IV?2%Ozl81=vF+Axx>#0n%Zgo*en%Gt|E)O$t%!&JK%s!J=6p^%|R` ztiYGrPap3hNIS%Vf#2z3}Cv;5)FP5*m==xEDnB(4$trDZX=O3T>d7AblrP(If z>P4!!?5(wQh(;R$pX0&}Z{?r`TBs1Mkk9w+YSp(whaSUpB1-z8t37;((0Y5@zz~eG zQWglk%geWl1M>JUJu>L%@&oucI=lCS+98xfPb4UqRLHT&pBfPd zamFh2(zAh5YVAi*=Oi1-8i$olPfw?;G3mZ98wx+10DS(^EOrhYVdAN!QhmN-W?zd^ zI#_U}K;R(-P&;x)T2P*V!zwwHPd-qRnz>90-r_H02CsJqwR{94F^ukz(Mk|;BL#z; zILPGfeK+5y&%AqB_ufAZViK;y>Ub;cQqis6QQ1-fvkR=0jpNd9#NRY{DI?WRo^Fj) zMnlK3jQFQ?>4h~HGt}seDjS-{9dAeqfbLn^Ve#ehBWJ?O3_KwwtaaVFCybs0juE|; z+DB=*dTrSf^jkpc4P|Q=zpi@{EkZFpw?jmGF>s^2?&NIsC^K*~rzDWtu7!1>uU_y0 z`u5B8p@6F*Lfyv>7ya<)`Uu>e?B*&p-A<2VGUv$zEopwRzV&;xfqxjA+2i7YbVSw^ z2ItqA>7hYwIguHh;)UQ)-d59u!JzC^_=@;GxRQ~_A+ zOKGSS-AL-&-PQ4TxY8AS9ZpJpJ@eA2QEVOZr!1iwVW-NJw-3~aKwSm86N|$d2$C_M zq{)VmLHCnGYS;aBZ6)LAwj$tW#N#lWlXpXxnkIcwN?azNnmFaJx7sz>78hg8bFHmN4zZ{x)uDLs2 z1}Cy9K;!)UEGO_@)l}JV=%Z8pEh{OR_7ODzzCXO4(^126!d~?ncR7#+nrGoM;s_h60dx+%`o`;f29Jl!2l-3}ycMqT@J`i$SyC(G*5MANvFL@|r;Dz{ z3j#>%U`3BbQ<&4j^cO-f{7J7Bte&+_=!(hO)LEVLIK54Pu}a`y1Aqii75+;!K%gLLdFCo{vPPo%rE`@PuLhp+QI&l4n{L+c{c zCpIY%)v2`eY>Zkg-C8YmA;2g;@7mi(B|u8bm!4oF7{znr>Rn>`&aaoBFBg7b?6lch zBV*J^xn5ED%?o?+comK0F3$0#v=XAWb2xkr1`%a~9-|&EdWQvDF3pTu%y(aAN|#1a z8@*RVp&2y4f0@5zuCei<Nf|Y^%EN$gFRM{gSh9r8{Nj9VlN33@V*Qvni*T`=TI`$#O$XZGTPHR}{;8+NM|0 zGStsLWQRpwYOZz?9N6Nd&2D{Bu)ldw8p}!8yCG~a&^UeabfFD}@Cm*0?iODSvsHup z30Am_vgD3)iwc7qPZ~v7(&BjrMM+ zuyIu>aVh>9M`D^;oQyfqfz)0OsK4azzIE!xxvEdRbK$O51~tkA6|rF{QR?6Sg4dI8 z%J2GyiG7;qa&r-ONHg)tyv@+LEq%n)cKPs{45AUA>7H>QrNEH3at^cfm(*f>C<*cO z$HgzF$pliorfsb)dOTz+TIzq}4wa8(Olg|bmwQ9c&3Uq4o_E4Z)hHJ*uNLm?du99K z-EiSRm`jca!i(*lgZp5m@R384TP;~d!H9`&l=5y`?)Uo-(VS>oFKa3s+gr}mv6i%^ zt5i9hvCH6)ndX}g9WUN5ejXF+NAL1z(Bh%2x0~cqNYN09v1KB0-g)e_myzL-X2=zO zAw=Ata^fud2QM*eVBV`=i(HWa7CDVbT!jb9Yn5G5nV$v=1XEs7r&WEuRn#ki--^>Y zJzsoa#FS(nWO^q-HqtK_6>0J96DD{wn`b%u)s2>K<*OVaqS&-1lxOgAg24T(Tv&f>FPk@(y8 z*y9hJa|OT}dLFZ_J5kVUC_%f?V&3M}B`V5dazmt3`)z~q6>`ItdkW+2U39IPyv44o z=5%-B2SzJ>acQ!J)5e5e8*Wtuy`2(4YY)583daoEJ@vw;d${r%?5U4b%AZVVplKG+Ui`lDjqiTLPd);sB&r!1MTvXYGtwopl8ab(Uz{hnsR^%D^{M4}H@s&f2j_}iQZ!!RXdg-{ zNY1=2<9^Z_)`D73DAQizdh&X^#jn5h>No0J9TBWPBI6hDn@aPV=~DUO(KlsNQ@WEj zI3Ap59%7%F-(w2PdNp6sytHR=EAK;9j?sW(isB--(Y~02@#lD@x?A?UbgX)H1I`8E z3U)ugmVQ=tn~}YvffCVEk4?pm$~~{NW%uMg&tkD%vk33eI%Mm zR^7&Jln-nSKZy^@^Y)HsM31WG<{F{J*R9tiJ>kijB$qs@At5u4;$m&Q*>RKN(#6tq zYdG6ti&^sw8D`nmZKSXhVcl(ffI=t(dfuk7heh^SUvnD4C4JMV1zT{1qDI=Ym!%P% z?W8y(#YS?Jq|yjsbY7&H(TKN*08OIsTyu7>U96SRe7}iqFm9Ue{OZ~usHdmu*l$L`p|OQ=aobI z(S@aujKpQG9j3h(Q#qEH~khnK!9DC5IxxI;yp-PF^%n{bCB{_74Qzl_&8m!~lI z(YPm(0)*MJ{h3Pn^TIHt0`SI{@7}Qh4C4c}jUo6cZrd*rfYj4a*cycN_iG(FyAy>2 zfCTuqA!ss;e3Y(ijXvrpEH7WTTsAWu3#Jdke6@S?SBIv3UHEz4WWcr=H?bsEQwH+@ zYYOV3tuN{#t2?sK`T(^q=?o zdYO+3m8jcCKh@SZYzkMT0!Z29C^7Kh>stwDtwXa9-xLAf*Kc&auKV3W3O;<{| zQsCx8tG9ZLGIRud_Oq35nCP{;GfN{4xYVw%taqn@u3H!=75?5D5W*Y4=e{)t0I<=3 zBVX6U+xP*dY_g#*Kh+DIA<-K>W`=H<*>cUb2_wYdYl#szQh<;bQ(|y;jk+y@x-{w5 zMeOAO@6I1+ISu0HFE=r824XdNUF&$?4eJx-f1T-O`%n;EgPNcfP`M3c(#f3!0dpc% zn2C6m&;f7mD7dkBx0~>BLn!r+tEE* z3TI4i^5*64M~Zs5gO30WOw$_EYM^2TPyr*zp)K`SX@v`COugXc zAhO@KVn9`KKE>K=4D*vlkYprnvAL?KQ#>^hQD|{ z9;(0{(-nThrzs-$m|pzN{7^H5aug)7$MZXob|+{j-%r82U;V@>dAb|8QckBIsK$!X zn951Q2akw%ejacSSZR>)m;AVE&k{p;eipc_GCJm*LI> zD7FeD-g^m#P=nN9sQ%3T6g#%8ASA0N@#5&@6j$ZEGwj}53$OC)ksD0yfA3qbRY*@U z@o#(t=Rq$FghTo^V9bJA=ORSGW(jp6qYSQV}Ed4-ABl#|09d+Tuu z^BD|R+$I|(lMSH)l$}$h0owARM%x^JA85iCo?X1>L$GHH5yp2Q-LFuKX# zKTZhUUK&)GWeg)JW#ACo_&{Hzzxbf*E#GD3#Nz-7!15HaJwp~LH=x|_W~Tb z5_6mCDvS+#xo94f_1-jdTg`Ug4ASKi@13mn&nssy-A9S+P;Xkmq`k0GSj@t19BD{Q zSkl76vlq38?wqC|DlE#RB1>;5@(baZft$$861 z8G*8#QTIKVN3uO3O!VNJ#lfxx+%mNy`p)fkcU2+euKP*~`Se3b|M|A9lgONG3=^u^ zu!h(x+@h5{47}|yofk__%WVOkYu}|EW@^n~p@lCwd@#x}fW1!e`oppP^`~(!+|YL$ zGh_wTa_$ncTfM(tA!%7I6@PRUM~ziS%l^qs)DE#ws%Y?vpw|VT-888B-}2exay@EG z@2FfJ)m~YN*qql>)9KL@Qf*Ss#MV-~O>}os2xp~v=`xGDR;Nm?yb4djFhTh{L3cu# z{BLD4E2i2N#s}6fc^@w>Fa$EIgi5Gqmqyl)@REr*jJ#4*!Y z2^C{SM0#&_m>QvYs~Aq*YNJ5gB--rfTU7OmYWTkGxy7s)A^FH@MYITA5+JPL2=*Ru9Qs_^71%=-So1xpZWr zY{KWhne*koR%k7xft1`O-jT`dJ84T*wuir@iJ9G(r^>gg$}K}qb=Rk7&;zOXwGucC zRO7$e+_Y?zD<9L{W##Y9aC5L|&2SC2tR7f1A1Dmu$>}rfdb*a8)iB5xL$8)?`S9oD zQpTf$W2YUQh<7S@vU~9o5FpurmG&}sR*yI`U;pA@63DOaza!y)ew+Qo1{X+i%p!B{ z57|B;l*v!4U2i+=W6{V4AFEHonH;Pgl$#TCFX5Y$DEe5P$F<1ih)%daI@C|t_6Dnlg&gQp9ZJyJ}LGOG@c*p~T^uB=M8Qd-$8O*y$9?ql)?7`GfR zD!k!vaF57)Ks@~9!Ir9C!cwq#X5=ds&{cZ{*fH35S03Id>^#6LxXo*EAx4W%VVfHyiuR@ob#OXz3=t@)9cc`_kFLm<{ER% zF~?kwQ&wp#oYw55Qi^$FRq?#UKKDkAM(oxu-B$71`%PNS9V@8^uiiY@8Ts@mqwBM< z+m@d|O}^3N+M}gz%cn7X)+$E^7(4gdLg+_NU*;8UWKh`aVjKyX(d&5U*q5Wfo@34R zM0U-oxBMoa21jqgT8yP`PE>Cr^QCGgoVM7QqAO*Wk7c=ryu?Pi?A>}^IW`n?p4NYg zCzT(hQx6oZO0-MvZ3fC(eCaC*HNW5cf%e}#lEJ1(vl&J zVhJm?0Tpp2%Mu0EFm%gS2Aoj3(V#2n3~%S3fOQ)1VWSj1s*|rQgh$3QBJcQ3dh7{e zr{%Nt@*pZ2PN#`$H)~DbmWkt>$l#FQ#7`>kEYgtI&M^J>r9S#a4V2Y z{VIL;*@vPnCxBXAlp7_0TM>Y92q*>&ZGs)TL*NB|!0CvG^&^|H1|z7JS@d;nlcx|# zz{q1&wzP5RLkC-0k+m0KJV1RY5fYW zU@T0bPGfdd2!a-Se2Dt>isWNRrN$a*^EGJ+aJywH%t;IH^tdz`a2+mSY?f>wMh$N@ z-vn(SZ$I|i4A+qK&MZIiM?}UQL3u~0*(tCCNfX2pUfOD4lS()`&H4hH=dd-y{7qiR z3+SqhB8CxPFPe77Cee>#HHfnRwZ#zTatb>_iR^eOd#=h)h2_$#yqB^}vrLo3AL35x zveJGC`Cihk`Xx6%`UR(rjo_^^*>&E!5N7gNo!3{q7Dfn#_0cK#9f^9z82O7bYcbVv9tIKm9}Am8MVH*iE@&- zdKdnAW3B2$#QtzOlH*yC18)Gua+UuhTXjL4FN{jt_m5Ew5)`I)iUwrzA@z#Y!BHk% z-kjdZbJlY^ey4a&gK^EH5cS8yJHf)4+s>e3B?WI3@%ijsl+#ci<@F4qa_|S*a>mJ? zx{#f{MGo0O=jU7}PJi4CT5I?Dm~{;&W3gZ1yw3(e*P_$_4#>^n#K48YWGH;V8RLD= zSz(nRVkOlEzJJ%8u{a;<9!%pVcH!PF|NB|GYW92Ou6P(e>op(0`VtC>VG^?|VOAgZ z7cVVd#5kH{l2%>{6Vc3$g30I9YG+?a+trBA&KnbGA@tHdYgzoFYyKhC>rG5O+*3NP zp{&=3CnWDs+lCtyaFBIbFA|dEZs79Uj~* zsS6Y0_93_@+11q3aTECeD(Jk*8o&JZLT!Lx-%f}5Byd0`%t2Hfd%}iGS`&3~s)!fc zr*CqJ4@4ZTZ9yw{eBIM+DqE+-6So0c#8C%#$L1AUDdVA1Z~!~?3@BMWn{fS*m?2Q-x+cQt0`4bBM{r*)CCjLm+mL? zuyt@a{qw^w^x-^$`%>&nYL9z7nM9A9zk_wUwZdN#gU>_O)7<9hSvq|>Io;F3mn_$Y%zc#KP}2^^OvU`=nr>QM z?{kV1sCaZ@t?S&HFA}%q5e~mq{)%D8ZITrh?w-eF>@Jrsz2C-(dXg+Ln@xXw>{VUY z=Q({>FSdfxh1x|Oht-*5FKQqAymkyp%C|M5+oI22Ev@7+8`*p6o+T_9aGLOuO3jsU zUhm+S7M6FSgm!OUWbLZpWMK`sJY=f`+$NU#<8jx(L-T~?lII*+#>&#lX^*WQ)51V% z47ktE0qv*j4!rZX);)Oc`)81~HA)z9H&WZKw+p&ph3>MqLbjeQ_#q^*FR0MrbjQ4o zf~bM8^Wm>L9FkM9^-3>pv%i=9<^clq>+_#NH>OvtR`dpsLXlr(T!u6};}$k?R_K-8 zowZJWiXkVQzHutioErII4ePkQ;XEHs#^e1)9m^!G!G$7DGuKcglkH|l^2fnWG>BbO z=9c!`V?A8v1U7Fg6fX3}S4@pfd*Z33YMsV#IwmoKezmi{+#SCZd$|=dh&@uT4^-Ex zm2;#%UDq1U_0Mq%@N zn5G_@Sq7e>)!T_zziLbj=B;a9MP%pF+>A&BkczoXsk@CYS>C^ik-1h`y*<%ebOPUD zwzjjtomOn)2wI#oXg!MqNd1x+18G#=`!Q*!Ucz1{^XbmJ{&l{uNGZ8==zhOmZG!%D zALNGppg{JNXIc}{Uq}TD&|iK%=QkC8lWeN5XzT3Bx&9JLV^GHwl4}NYx}6154X=}> zGxyCZh^0q4!cUl&vC~3zdtq}q<1@$k_pZm0q!FGcm`7D(W%_*GX|cyzs552ZTHv3e zUWVZevzhz|A9A@=I^kER8jhKm?sFL8Bsl~cmdHL>Puc3a&~ee^7;=j;8D>M&u-)B# z)56&>DB-o6cnC}GICA5^_OMXRmxwJW1w7Hqu^#aIFX`=r73$*J0RPJT`H7efVHW?bLBjb@wOALe z2i}7!Qz^xy2MCOuq{AOGt!Rr&oWKszC8*7Ettx7v---0@*PWu|l$XuW=2-n!6_5Cw z8v41tUb{s--V zYxsG`d1Tb&;`q>HHQ1|)2}2ibmx#OboX_b>;=hmR}9WI9@g&zw&!n>Q_U%R_~4vQqJ@i8|=DFHejh` zXyW+Zr;r>Z>gnWiMOh6ci-qj(a!?R4NFB*}UV9g8WmoKGABCC+&;mtb(f;Cj`Vf(X zJQX)(!8gU)F=39hC`qF1WZ6*tLPDh>I#OnhWXyLZEBWPR%3mcbrn}Fu#^$YLm}0yf z`bl)@A1yf5B(f~Q_A%KGW3(Y|I)k&}rKHY#KPrsd4`K3BM2;5j>huNi0w1>Bj`7Jt z>cy`gsv9+PlwRFk1!gOdN?06~ST@3YCyb{%b_m( z`dQB12S(k$~`MWN9(CV6C>nFNSwXf~x& z>KoTR0qezEVQgAdP+il^*|nQhJo&zU+huu+M@EDB!Po5;8qpoEsa30zHwmr7RF@_l z@qy1Rm^8TVqs%*o&;3;EdxWg}R}u1P(u|cjatBsmBKK)h`vQtHeb%d2DwYTC$%Vc6JnBJL@s4N8N(HJo#Mx2DtRP#W7U(+u4b#O(*?q_EYIC_(kqI|fa;u*$ zNlSX0w3sj1a!UF_D$tx8E1M^l!t2r^M*51cXJ|_(Jb1yz?^fOP$QFg`9;+KoThq$i z*~AoeS2a(AY_wJ9`13wH)iYil!eB^C+@yJJmQ0<-TJ)p^onPdkmghQWwiJbpfcxCg z7&3WV)Jd+9eyGVNEM0~8=`_#P*{J}7RdWzh`B4eJ!@W{&ci}JG*I?tVhBMp`gxq#K z@@}8N$ei0qGxqdR-a8q0!Bt?5qWdW@dTAmlIX5}NSTs)i22gojX}XrGSyGO>v-iZskHsAfP-k|dC3Al$f#~-*)-AFQ>-k#-!es| z4Lw5j(byB$>C_Fyvth*xy8C=QAu;@Z@`UB7&na2c=WS;0Pz<_$(k^0MW-^+noRtg~ z&>Aj~dbrGSzB+Zd!$j{Cnk;FJGiIOO2>?+=f0G%^7eRezjrZ&f0R-d+NM7^t2I)ea za!x$zYSHx*ZFUM6bQ^rUPLaaW#3X(Sj4>YJrz> z{>3m%MH}(QrwQ>FU+5h6HwxP;BtLZ%D4OScyL3~$IZw-C2(&Sd;>4LuUeF4;J(*s^ zLb|!TLw1yU_OUn)QIbrJB}m86FW<8U{RYV?5EFbl|UDHG_B-il`*D3om z%;aCn1Z#UMgKD8*PVlwMDiM$D&DL)iu%>hUyNA6SzSZny>09Q|^}I^geHwD<-8fPi z+fsLbaQOp-z#d$)if1EVJGTodh+=iOzMefLXFz1wDSFJsMT3UBdFn#iBdrtTFO>Gq zc9&YwLRtHTdT1AuZUR$_{stw6@2a{p8&7)Qdu_D{vakwy^i=7jl(WFt4!JanPR7ia zLl^ZS`B?JnBmVU19Qj@ew&M{~mxIrP(K#A!WTUUGZ%%5DO1b-+d#Q#|0zr9=@vjc0 z1UyfxQi$TA=dMC@2eU<{UHzc)38KB(l7MfN8(YiCa*b5$5r?P8n*SF-#3gD7mX-Yl zmi^ly=3L-RZ})eq3ljE@CR<&sW?XqTbYvfIeMpFt3ztaTD&BcCgERe3^9)npg?QA% z_nb2Oy~m#LY#dFZa|jvhGI1>10lfr>CsOrhHF=h$BSz0@Bpza?*i~(Qu(e)~ViDgO zpA)uxqqe8Qciwe}B6*Kq-ovQFhi!WJ@^u;o%1h(Ey{HONvG9*4B-6)s%R4WoWlHQe zr0SNl#6}l-Hhl@E-->9~^9Hm0!#bqlg(BDv#hb^HOr$F}+fN;K*u()J~-2)>n^hn}l!3FUQ5PeRS* zD#khDgBjGd?aJzo77oM+@_)i`zfHh|tI# z@bw9#m>H;04Pu%Gf~7<{s%O4nbqN17DFE&&)+>5Z1# zd)XMUtiCNzM+~aChAZuUjc&Vwzj{6vE?KRe zd`PmRq*IkDf3E0^&bOHMW|*TH0JTF9p>E{&`By>oc6OCZ?QRt>r^uthUd} z?wA#q1Slsa^*uWSr}*{i1spNFh?Xp|dTTbm4cfguF8?jU^vrf5iAAc)`=8MP)@1!t zShLyTPsn&$#Z>X}Y04+GA35%3aR`<#AJs8;9QiUr?y$IV@`ZSyzgka7LU#^dR^xho z{n4bA9Qm$cO(1&c6DvT;*D1%uXA=182j7-HHsVAu6%Zf#s-nrUefaI{5um7iV!aCz z>_5A8+Zz&?$w!Yf?kv7F@0cujrBon#GImA4xA<=9KK?C0dI$jm+ztR8sGk76V}@~( zIffuVOy?A|L3P+<&=kS~p#4XbvIB{%sNGSl8smqx`Bp78)1#hYI~_(JaloqPx} zh?b5ld?HA-9-4Z>T4Fyls?2ku*(NMagF^kBh9;WY$0aN^izwj7SMyursrR>!@Jwk| z&eSgl3t3^WzVp)7!ZWJ?K}=ojc|6dfB?A{CA{+2jr^|REwer%N_1E#cd2TC1H++HNthS#A+8d#KdsU9)Ai zRZvMUqqLYOPWy+m;7<*Gw1F%fIl_)xInm6W06B$60%Zf=IP8xILKRzWLM`t;86vH9 zEjd>4ROez_sh+VMmEbYxZrn2?J$Y>?nS+O1<7%>Bu$mOF_0-u;VW8Sf-lzk)uKdQt zQCQOh6UK`RtDx*B2eGxdOdr}lx$k#es5Baj0Zp!2BVejbsx9B520c@|h+@0Q;f#d; zvu<|_YK7R#KDXHg)hQL@gev>&t?#b&lf9nn5Nn>nA%Uu7{R@dl>6w&>+G-J8CyD4; zNIani5w@Dg7~T=e=_WQKTuh=s8Drd(yT}xV;#7zg3Ygn1G2HM7PA_HcVRUADY8T_t zk@iV!&2CCCm;alb9#lqT+%$)T+_zSm%lk{*Nv@tFe(zVAr1Z`~i}l)NlI2sam2u5+ z8({s6;K?6KqRu!aA@_)N)eIvZF9PZVafQSR>9Z1tH`>wG^WQKU-Wp}RYiKQ;=M-?> zBc^;;C|dna9;s-=>}NsHv|Zx-NHb4(OStKm1kSIpM;+WiEZ2{{AzCOi?*K2GyxYr` zg^X&@r>%j<(pcXyJg?0=bwTjf|Z!eK%4!qWWs=Aac3}Q{4OI_*v1FoT_>*&)@Fhh+Q z-hG|h<+nT)c@s5K7sW=RVSNopOX$vIYmeQ{2%)pz94pjZV;LV=8-c}+j?1e|tqT$Y#ISb4fpW`!&AfvEZ-zdn&zx|_Z z{3jQNzBfx|n(?LwA8SSrWKv~;N_8`!!s-hohsfLfx5x{(;YD|Z{K~~cG718W???R> zJupuipKdYIL1`ZMQPQc)+fB~r%I^NE{ENt7|4i~-xIHm7^;q;FHd&4bJ@dkI;N;3r z_`mXH2CQggSvgau)q_9{G&v^(Vf%6qCe>VhuLeN zo&ob=e4F(oFD9vk_tU%hIP)QhctIRUZ6D<=x1Se%lb(Hh|pVp0k zkT2yxVh*3ih&NJuYa=r7t|ChZ23%BBc#6EcXHZ1PodglKH4d#g8cj9Dq1EiNU4yfk zYO++t_PR)pzKG9JkAedGYxH9r`YZUkESlI?kvwqx2D}_V;^l&4|@S4@Uq4ZR+aV>T!ziR`XA2qvDKU9XY0f zZ@R?-qBz&vzZd#pYd#~F^*)B|Cga#ERVAalo`Xyu6#+=BTffV7-qs z+H$Pa0j(nqA)BNrb+!TS2a=0BQnyy zIfB!&n=?U!ZGNbJnurOgpwV^bwL|2*hfXjY3THu^n-l5EtO%wZtPG*|w;VWK7hKKn zA5xY`H?u@3p`JP6TF$yz`w+IU$dMDn)#-a4AAi>|`6z$rzs7Rw2%KW_uM|Xs^q?P= zc=U_%=}Fx^PXIN|{vj{7B>WG(kUXrb>rv(HnWf|T>^z#L=5Q~M;fUCLTRn=?vWc{! zveG%KTzK!$Y2Fq5H^`elQa}Z?gbz~5sRdKGpIXy@s^^5o_6+8fG2?hCH#vZTlf-3) z>9mgh;wpw&3#Ncz83u!voArcJf-h`*)kgJDOut&T*HoNX2iKplx49BwV z>zokUyju<_U3C0j0{@5d)ISPB7w8csrtBY-m{O#6F138d-dc~*jYMdy-)7dSvdfY> zymEQ6#tIVVvX6;>mAn4&^Zp_*Rr#)e70W>Myb=+x9)MhTul=C?q3xn!=e!{S@-Rvs zMryeR7%syX6=aaU0_g)SE%A{oMEgOm_4k0mv|KwpO*LAN5qrtVy6ifV=-_s%A#bGr z=NtJapMl&RPtgu|Mt0;?ocS#h9|&d>L@Z7Y!?CLa0mNUAU6e33lH(pdAgb;m>RbY} zpW3Q_^x&kX*2Wb`9Uuh{3CTx(hU5^~)B(!Oj=`f|SZhYH#S;=#8- zG$?YBV<0ygrylaqS44iE&V&Ce;@JjLY>cvCxXJ!3PCi&IsJ8Wy<_g2no2 zGwLKCbba7@X&|bPr>wsyo`E14DDn>;2NXF8at@ET{Wyno2h|)Un%B4>Ua&TS3f`Y} z)`*H217Ucu4;Y?zNHq5K@cAJEKDb*w&=b`?;QFCOv~z#CexSMnn4##rA+px(2ik1R z|3gdNEoKPf6(;ca22bKApq@Ca6AEGqUtizD-&*4X!LxNM?IQTa7Tb*B!e}`^@O4gv z_D94}9t@l@9odQlp}Wf%oOofv@{y(SR_gxF0wG+bVSZS`h3AIl3a@^lUW%HYFIp9F z^f?-BBBWgZ{2EZ)NYCyNj)p= zK0c_EuJQ5lZ8`^JRWnVBgGf9V^r*4?_V^%G*(5B@3`HkC@&dxbgCi#^Zon1~{q&FU z-w&m*N`+qq)aTkVG&u@K2cai67`p7`K%NH^x75&@Kx~}ZsSv|^42HcZH?Bxah0{vn z7nhXKLciU_K*>dDoy=^J2iE|o{(HkTZ^Zf?(NBV3!3o3EP?%DW3@O^*+vcF4pjen} zXN1SS%GN`ISoDKShw3YZ8rUSetnG~4g~+@iSOXgC!P0B5ErRW^yFkqQF-zxS9m=@o zF_xsHq(23pN+&aln*ToQhd}C_h_9hNiqO0J0o?wTvvv7ag}|A>8zgAPFuj?S%fydR zKLYT;18L+S1pP0s#)Cd=vLh`tx~!wf+5q(K*f6g06>bnRd;sJ^hApvtOuEIKi0uaS zmdMfLM4K@4<9Hwv?+52_LXko0FsE_^6ddWYh;ak_A2`GLT4Xx2HMu5MG~Zyo!bN8!1>pg@b?f{`B@N3uD_R3 zjntu(`ZJg;l%eMrse*D@?U3#6mfdQWHO}+P_a;2(Wx-DMA+}{y8N8F)RxVerZRrLn z3tDFx={8#KD3IuQgIYa}e(wHUf7-hX&}Yq4QeRz-0sYat=`mb4r5|KK&#f`|98ML& zED0l+t^kq%CDmLIynhJ9gg z*BSavu%RTPx~*A%i)Avhpr9c77(F8P$#vbn-$^hT_?m=Sh3@9_q3OnDW)aWf6L1H` z(L*#&zVL&izzONN@>2`&dkOuG!ojtFhq6~-5C)p918a`EhoUKrSp&GGR1}N zkXQNUu_`rLBz?+5Rnqh6@M9y;i4Qw_^)Vz9V0f6`qhxcfDh0ehMBO+Fo|)96Xe9$uKSR*S zHoM9OqxEKa#+Gxvl)=Ef8jeVZENW*7?{6Xd; zPUz&wYFs(c2&zyEyB)P5HN~kjp=Lr9vai&^phPW|Zd-()AlUgJebC6nY$!eqw=e|E!y4JTk0Ln?&N{Enkn&iDMK{y= zvSu;Lc1d622CX2^73N$>1BmPW>7wq^ai_zif*kY|OdO((zN`L?m^RLtl4Qwf9zMdU)@=3_36920a`RSY7aIQ1W-0_sMlU6l0&-a^!4=_$}o6kA$||n;z0Nwiumm= zL((H?Ox)N^xyZYc6d&i|c0>Q+pW4$`F?Ppv%;8C^0hR<`xS_&>C*u}jH#8O#z}3eL zT_KlX@+fXJav|~FiUTjIsqk2imm?iREUM=*#%{&Zp3U=9p;6yDpwfJ5&E z9fHVk9)Ly}S_%j;5kdpdLL3fo9#|=W(*+iEzDVqBEUG`VgP@))6W-8koMynQ^QMOD ztgzpsP9&pR&_rS-3HEQX(gXbi7UJD+*UGUU!I8O`AaVz9VOd@=>|g#mIGT%n)+i(J zhU+>7?g4pr(;BP%P#ObUvJ5RXP@O*vv73gNkZL9;=(rXTF3Yq-NKA*! zimn3WX&;k+X8*VwjCa6c?1EJ3OVKWbvieVm=pSoiiD+PeI9bKx z8TdT-g1ZMY5F2KTyPj|b=>Ck;2z_sJoO<;oyVjO=ITM5L$_+pV2H}yM6JXvoWe=du zYlfEIfGV^+oJ~h#pt>=nXOGe*2fA{cZ}k@wLU!&4w zhI^v_Z9!o=G!Uh42?`3{o$cjWjo#5>g>>cBpd|P;b#5AzyC@sj#0a@w1|hyDIByyO z42J9mi$e?-lc}QhV%d|2|LT3B3JSQ*T4E<(-FFlzz5CS%I;a5Lbu!dMTrm@>|L_6e zxOe~s-_Efl%g@KPilW~7DC?0Jcg&j>6|>cA5hyfo1`W6wW5fwKzL*Lb%F-(MFjOw>YJ>RSVu>#a z(2RtJg>D@P=2`6;RQiZgtp-cUAo{9~B~#+WU=vVfZZYoHg$$@@G=N7NmTUy8^0GEyjKP zeKU#rBKk4U4!|p^OQ7Ng5V^73D%^=tFedf$LyfvOslvn03`x_}XQI72=z`l_jf{7z59wdR;)?Qw zbImH8(-_%d64(v)LRb#LCM~gKT%odJsW6u&O-qsJLj9RDp)26Jx35v~!UPKo=Y`3e zQv|q}>K^gdqTx&X0$U#y6-7`Nazy{sB)28Hx0Jv_kSRp1F_x$e81&`kaz_6U!IV)? z)pD|);=9J3#*QKprsC}SrKwb393hMoACW&$SIhr?i-@2D6k0hUA>B>O9e#V@ohciG z>?plroGzQ{dLsu4^N2Rgvl6Lh8uEsLS6OC)S^8z#%^e|R()ko`nqG%&uLw9UrIKmy z6*@x#0j+gX&AA~j*IlT=Ov`ge_1(Q2t4C=7sBLmp%kHtRFCb=FNs@sbDuYW`xp5*{ z*VjI|fdNzJQP#$MH=(|uHhB%Dg{38x-EfZ7dVh{6LV7!y5+Z%9*IqO^a=3m-RL#ct zm+u2yo0X!R4@;QLN;b?OV33SYBwjPEj zTV0Mb)vAO^=0aluj5b3}7bFo#UG8`&(#L#-D zNOg@()_$j=s4^WPq`GyH8)x)4n#pq>Cy7DsSwckgG6!(eDRjv=6B}`yGU)7^HlG3c zA=im}u`>#C>N%j~T@_wj6XP9X7G$hX_ms8|YV;#nN7y zp^@FLKa;4DDCXT^k{ZT|2B7mr0xsIl$TqtE5RTyHIKe(`D;QEjWAqt%n1X?3 zDQt>w^2n#i_fO39q1lZv#bN_j1(-yvvMnj?LGNqoctxv9QNwm1_9@Q=M-TcDd0 z`qoRwV}J0_75fPtePU3@8DG}zBJ)ka-QSOzP6t^g}7gUkgoQ3 zG&!sz5|JE1p8}^f`@xB*MPeZr2e2tU47Z0W+GC1*_b{*X$iOK``#b#4@-fIqCr6Y- z&`;6nhG6J$XICI4t>d;DlQQGG-StT``@Y--rzGK<9F0s zOAc|D?OS@s`iQOZrmP{IYkkm}hf{%G8W3F6wku@1ZK0!5Jsj-Lw0(4@HbEY4GY*m( zp0s)33*g3AbF~;OeH&d9cHUS*J(9JavGJa)qn4%ORA`TK{!SbPQP@kxc>P&ZQ!Vzk zPwRBjA*pvVVIXC9z9}B0UuhJk`^;(Xl@G8=k1!ukKmsf~{;vXTDyL;{Zrr!E2U)5W z3Rt~s)HR$93bj51xB~}QiotJJiifo)v?Lk=|LJCEq7jHG$JHoR#TbP~47?!NMT&V# zNAyS`!wF?S)-T=Xl4Uk;iFKO_dAVv55$<(4|5d2z=H(t+nYEisuCJ|!s9^VK05d@* z5T#BxThICu0mr83V?m~yPODQ`a6xcKn4mO!O6v13=tGmO8j97Kul^{9BL|qcsy1%a ztGEM%e%-PVG9;T|H`Z{HhgNRz73&!$qwvzhJ@zvAJ+g0LMB|>m909eEIQT9i4yy=} zIcrUCqzhB_&N$zx0ew8l87y?-;qjQk8d2e`Nt_Ar1^T1s3Zlm@u;YjNujx3(`#Epz zg919+A22xNle@SOi>+@>ND2$0?S3l7{%dc?o7>}19iMUW=q^(_hrs8=-;7!gSdiR< z4gU1lzYbgf(t+xGm1pf70#x%7e}T6=^t_Y-bXkptgf zO%eWcmXpZqf7!7E&-F4Nt$OsmXYcNW+npG#u}v`^$z*2Id3*WYI`!l17Wum)GdEVK z=RB{!Y)t#;u((5}eMzGR`0Devi`sOu!Jqn-uTQ5ye-PKxxMRL|5Bi1<{dUhB(0Kpu znI?@ofG!0;vq;0|Wb}4EcqI5qzAM!&Y~&wPY!y4wKa;M{?L5?2O{cX9V|rF%bAsY} z&4;0jIZ5(Km+$z2`+&x6v5wS_oNmeI-eej)#cqE7vFYu@x3urOVw_y z^4sn|C=G3c<$TOw_pib*4Yb@B+M84K7Lm*H&WP`LJ<4?%p=f%3nM(MToOe&-#ni#| z>HbrU0ggtq0asYAMf22S=*KyCG`&c!cawOIEw5Z|DQ}k@Ij(B(Ubl%u3vyfPE`3_out z%eG(~ho?HtbimSKe^2mRcDLVMTI{bAXB6+vaUTg!|D4yr@%$pjvbo%coMSO*J<60i zJYrwoOP{yxxeViwdin`rX%Mr9@c5^`MhE*{=pXO*;})ca_czbVQ48Zf9AHdPT2z_% z{F1F@-|e)uKB_9+D$er$$DEUo(-JJF9)wS=f;;vLsYhH=@qFiabM!p7?dJ^_QXes? zWzs27@OhO#@1rq#LFYFz>~W8bD?_P%JWlyGhST+-maGXL2TU2w)EDUNk*8Mgew{M7 zV>6lZ-b{hwA%)|T(MIu&y)I_YP>OAPtLlY4!JxD1r~6CSNVrU!J@0aphzY%CtE~;B z{#c$ydwZbR=e=}j+VLi^oq+_m)8HpNT2x7pDB`aTx6KWRo)@&}&A4ATXfh>T>hBmaRf<@`V!^4Ajz!vu*)Pdrne^oL=~0q!eDi&jQM{Jf4^p<8W7|sQCFd`<#EKR1 z$}7KC<6AjBlj3%9hx_4dz&w47gCKN?b`Qbk1zSo3`{ZJLoB_@wA~ z#(m^E>D2j}{$QhN=rrSOVE6HSe&pf7X218}Y<8J7gLJKwfkqVmP z_a9yt4Gu94rgvsPI{jI`Io4_M3!i|`F%fUe!nVSk3@39a6iKXxY!V7e$Yl;V)}5Bv zJnF(~q~_&ExVYKQC>8V7oJ}Gnvqzm$=VEr{rJ~9`nWwQAWOwzenD)hz-KmAeGMqXW zmTK_q^b2^|E!r{*Z`WD z9eHvDPG(>6nCA6*)#UfoksRq@*zr6fl#Xe+zYK$|*Y3k(?}Ej}>cdU?<%BpV81uSp zXLE!*Kr<(9P%c(OBYQ$4OI?$Vx{mf1Y*pO8udVjhaR}6z{XM%uO5rn_2p~4T@{6m@ z6C4#AzqMACPM+vgab6l>bY{2GFCkJD=~Sj|M5Es9K{Cg23gxi>S_ZRG=Z3|sN1c8zdFj@p z@1v#!-(+eY3#1aNNamB>)%(=if5v$F4dT)#YxU-;C&1x^m+m}&F1`OdZcY?8iPb3R zUT1z}d-JsBh#Jag%C)n1b@)?K{8mBJi_3RMkIRH*r9OCJcP?`Hyg{<7P9#XC@GX@xRK zODLJ#v?klt>QgP2Iq67feq4Jbmd}wG*g44nfz7r=9fS9>L2W~qUj;@o(bQDp1vxRdq6mLQ1JZ9DXsw zmx3GH2%z6Leoy72fB>ApbH4$ciZ0ktx7b?N#PX4xNh0vqHZl?c(KkMEgqq)T7 zL|$e9Jm9^RVuQdqs@;3L$pZWMhkegZBjPI&G;X*+qtaU6%<97~8XzF#Cj~!9a0UF$ z4^kRU2X3DH!b^R4^#_Mc@PA*$o_AIQYirJqu7%@aw_RBkJu86jIQ6Wp$l%p4GMa;4 z<(_xXk*{AyyDrF)>iSa)ur8K`T!Oy8=lg~?J(-_$opGJ&@EaR8oK7k1b>5mG%N{6w z)U}#n*;!phyg>!*f@@&JknQCElE1+rT}XR!$$pGQztrUh@&!=y;Ic7o@p$l->&73x z;8Zn}AlnvJQG7=&s#;hq-0nan=fMUqx<@6(%KH-Rfit)3x<{1G9$?PjD=gjGhFwcf zQTQ3F13t`7+ADasK|3Za7WU%{vXC#(j-B;pLcYMV zxVuM*u3}&7h48cAL6Ht#U7Yej>{Q>o9>W_PbnAlG4qbcHjMUsD75>NFdWNqJr{1+_ z^-@9EFtYFCX#c0|RtN7H<%HC>DBn&@nd$wZho7wDPP{|Nu#0iOqJ!X6A9z*6quv)1 znbA*0OeFT&elOzPVl%v-P|exUMccA=5BZ#=!@tVrei=Fs?6~>tW{eK)=hnb5X`Rd( z=KO1T#P;^*=H?XczABFJEh!0CDJ`D^XkAb=e!De~l6cPg$ z(XOwfXC31B!=d3}9=7ykUe>HA5MihDCvWWZ?YcbJ8DpPoH*eIzs;QensgdGA3uoR| ze7gO|#Z$<4c=cEh`hoo6hoJ@4z!!+5tjH=PoE-N4!zwUf>9XZ6S189`awcqzL)}?T zEDRv&t;UFIPZ1fUh$`$gGR3`g7G8toYcPbp;i_E%!|;%a8wD}PRAv_iDUy9+I3f@! zbOIp4lT5zh91U9VU9t4__nC&D!NX82FU|M-*xs4aXqtF(TDj_@Sb(D+;FWiBV|zSEi3uPv_jtCyA?T7I0N z1CQKIX{#2f8NETSG_c&o#U$UYjTicM-&69HMDUzE_~Q3-RjbbIP@f!4RRs4Ih@CGutlzk!5*fE%=7!!9zuR+Ji#9y{TZdiWU0RWTuIBcncgz;Vh{9D zKFZ)uA7cw;cQ&N#mEeI`u{EuZfBebo>sypviE?-y+Bh!xwdtX*n_LEE&~mFK;y5zA zj6O#(QEWTJ$2g#hto&CA6oH$7WM_=5#7$fL)8WQ~-xnSe*k^ew;+ zZh5w1(>z5eP#&!oGo{G@trh)k5a(^yT9)XYnT(6`hSP)9san~^^@1ZK4?_-+LkuGK zHVbn5^I9FiPD#WONd(Ou(;*Sq)~1Wt)^P?Gi*4hJtwYt(%+3q*mFFDRCa}(mh}x1 z@NUm+&dAue91KrWW2;e&NB7^S5(l|HaH;K-a^- zWcnD*uF%FJg}OC6SynTjg<8Ps_szrtE0)PcG=r!Kpu_~bel?)#e&W!rTaND)$?&X) zN^7$4^q=+FQ*wP%^kmU{oIb9%Gmb66qw6uMbs|CJ<@|A4Q4@jEWn!Ii$`5a8Kew5R zTD_Mey(*|#l{)`8S#)qotHT}TvW9#3b6nNdl|VXPy=66kX- zL-eq@$mI#|cOLBi6pa7w*WS=)qf;QMohz`YW6<4SXLpOyzPhWo|CswYpBd%_avikF z2d>YggoG;cmHUFyL~xVqqD2I0jMV1xqm+|10s_r+QIFe$Un;R=M(3XU(=R*Nq5~F> zb2G{h?m5bd^~%8UR43bd3)o3XHkpzK+fsuNqIY<(q44*&%3gt&Wly}PH!)PQcLb)2 zirwgTCqg6=$I^N6CT$sOrld4)JEmy z6?AYl!sHmK8-2qAfrnj43bv_&+?M$~We*OE^glf;Wl6bu6TbN4o)87othV&a9G>dF z-7_r}ggtCPJgnLcND%-jo~R_tN6 zpelr_TwFb+D`rG|jnoXIZeb<2hRSvB%#YnHbd3))=5H~c ze{4Llio%{k(ffxuUy)v*tD(KcBpyImDKt$g;kg{RkF8ws6!QlT_(*J|>58-PtSIA1^5yt@5$s+qt0-8!db#JM>TtC$byc#La0eU(Ic_$nho z_hx)XGv9`lZqN5Cp%`+=u<1-kx`U-Wk^r~35PnkhQ?|ej<{{UQTN{I_na|&mXetb7 z=*)ZL%zNsPlySc9qJUF)_^Rc&xc^4*;z}i6Y`-mG%s7>JwhEb2p0Sbo5cKTt;Nw&? z`6#2g#4Oz)&h@Hj!H~TBW#%e0%2pBW;#e?>IXlqU_7c~{(AtV*EI1Okof_T@r#b@x zp~sE$Kku`ChS^;T*z((PM1)D+SMr+{l~YXJ-bv0A# z3%W*Pf=w0^7zhVu5{B07`V)tn9<{#kIEk6UdJV00XYMVRW#1r5DJk~VNzxu)8UzQG zd8Q1#GWv&miGgZ%bg8EzTv?ZFY)QHnLq+6D#q;@+(H7Uwq+A+2%1CS;X`g>cjcm=3 zk8p)Zj9m*n04SMfA)#fVt#tc-x9WM2XwNe_BwDw`JXmg}u%`+~m-w->$jQ!ioi{+@ zg0To>8&2F(s9#~#pVH;hw(F#(-^d>>x5~Lv#h?e^0I089#8BzwOmCvy!AcCQR0gCVB zv3j;#2oCooj^iPB?{N$0_r!`$9L0lP1E%8+a1p;0j`+_21O<~kD;pbSy;WF0U|u@> z^ljd$?|?=UcCX!s2ZG4QiFmFb02uQnpRjHOc>&r^*mo-#&{eF!arNC)g8tV~*1<;%vE zaR;kh;SBg@QW5KqAn`ucrN<}CIllBPlVl6M?ppl)fD~x(XUd^T!o~E>4@qdV6mNp! zkIH_2(3JEgTH|^yHdV&=yp|qbu-0|bZk&Vjyuen0$F{rqvrQ|S_)cL(7}mMrs3Ad3 z39G(s63ejVdpu-;BwhzX&yDY0U*n9w$}659JjD(nl2g3?sq#PA1>d*%U+^-#1lw`^ z|NbTXB9(G-1DSsXh|tL-ZgAS*TmCn2_TTLHUt;?Iun+!*wrNBZ34%DGflFr!S#K8t z^1mfAVh6xs{vgjd`NvI#Twji5bN%+uKR3VohG_R%;~*ITVdZTW^d7Z=OgG&S*@4jd$8HhUOf`{K-k5XSenS9u)2ZxjyQz507wBowQs%V zg;6KU<-UK*b^pblL{3<4_Ca>#^S%9ZC;4B-N$A|L{+?5Xf6u874(pG~etet(*!tZC zaj+Cq&2>2s+qP%qH2pW=T80qpPv98P!B-y#_j*faFn8>!dU$~dh-JGCVLcv|9je1ey~lcf8VBm z{vpuTDJY!wD_R5jcTB^92&M7rXJ5(9?=i{lhl(8f?Kr1EiWDULFH-(ro|N`7%+qf* z?R#|a@Z|FE40RV0AiQVHF^E-9zzGo4m|&UlFxXZJBT)T2(jx+-$9n!KB>M6rdk)3HG=|NNy1PJf%OiG>{z#So*gxcH856d;<#J9wBM_Kc4AzK2pt zxR$rte>N@i49JR9rN*?IkF=Ctg>?JKDFIS3iKmZAQDNelGGm=jf@`f?wLI?GzN)6Z zO|gyVGCSsd;^fV<_X}nGbc#~8wj(vOzkCZLb8s4^-Y9i_l3O2oRw2vM@7Zigpkead zKuzPqXq|FJt)$>ZxhgL|y)vRI2E~*(XV)h2($zJIs-ft<>A0KiIEg11Ha6z9?L|7y zdLJ)KHuqRCh%NDuE!(1?R`DaNVYP?xM|%CvOL4oN zrMfk^Ra5)W7w@L^+9qoJj{QfK(o!dRt>G+!vnDNm-8>m*O-7}r9EGe0hb@9X9XZ7k zR;KT_Fmjw(l9$e+hq%1YcJwOcIX$!+DT*Sg&&~^_uT6cB*Co3^!O;@uD;e7@)m?tF z>XmFp+_J^GQ2#Rl%0c~gLIy__x?6ojMnv?O)l8D3&Ccw=gCGq{B+yL+jX6|AGI^vY zhAA$5`=I@OB`ARk>LSBi`#v^o5D(#lSbkQmQk-$RtC;4u34(I<&UHHC(6sD!5!U;x zT-msHLygqVz1r+OlR8CShUOboMTu<0NK2J4VU`2oNr|#@X9Dxn7bGvVR{1HfnS1#Y z6B5|ZXe6q9LMuCdMipCqy{BHaSjdd%OGoBoskix!t))Y|yN^_hc`Yf3Uf+7KK-T_s zaS)?e$c^h$OI$kDy5sI?#*EKb{Bn(g&AydPe4WkMzms{-G5I;qRc{7^b3{&MrFW#y z`G@d6z#<4(o-H{m*45;vS9o@?+~rZbT?~y;%&E2E*_(l~2J>0E4<-56Y4jgnJ`%&V zS@L;u_Ni~*{V!_|YNXD)1mPy%GE&>}E|{tOIK549$FxGpOFH`hlDWB7-|@xGJE^Zeqzulov|U$3qn45@5y|LP9VxNlIVkiIz1jGkF@t6e!!5cVRg zNpU4G!oK>}U6zX@rzgK>pr|8hH)8qwQ$OW=}vtVvoi%PZR+_1K~6m^htA1RGSPjm0LM*}{)7ZJ`D7?E{C1)B^1ML{^t$rXhN;?55zf6Zg0)9D?* zHxD{hUN*bX#G)G7zg~1J_yJBbyOY4h14q?wc`jPg|l5oC&K42@w~=x*sgw)l)xuC03^= z7;)C|@|$YkDugpBkBzwbEQ@{@dN5%}$=b52Uq?q&VXH%T$J2bmzU+o7TDO_o^wNV?Z6DIFcQvKl4K*v|4zHsJ7Cc&Lzch2hSghn>g*a)Je*Ehmc z#P%35>EoygW^f82A`%@bCVY0IRBGTt+v@mdgUW$AKBn124O~`I`PUD6r32`{29q6e zKPn}=WQzSHn1r^U?WR<4)MFARFE>M~%bK{xZKpQ2)i7#?(`AC1xZMn+)+0V@?>a~@k|ai- z{VD9gB3HT)W#!=d)3NL_=Vq@%PIrAr0-Z#E^+{4^+rWLRzNxZ)@3PU+;bUXSIy!R~ z%^va&5(F_jQOQPB&Q;x#Pr74C92WZ2lkAejwF=i83@RL|U6|8fi=0hKmHY7X)Mw%f z7iZb7b>?Mm-PCf0o8py)VxiIf99+ek;na^PX8FF)XB8_7I@ca%7%mIx=3}qdkfoMx zem}rvSswB?jeS+SxeMbJb>v#36T1QFWrX+{y8mlv{NLS^i`$|4ML6$e0?{cg!#ah; zZ(W=}M)B-E!hIL0@m@OM$@Yhqp#H3a>c9(+PU{%V4mM@QVCI>ma_<`Acm2UeH*n3gnH{H_C3uoV5 zXVQ3Eo?N@!EylauSuJ{-Qu7Rb(D|8M#?9VecvP$nCC0h-ij;s6y;nab#4MeCE zRvr1O7SCh^-TvcY^dIr^pK64E^?nceu#U@r#_VGo(F&8NOns8C{j|Ac8k^TAJe6$7j7x=D6C6 zmSiMwK_?cBU&v+))4=+=u65tOSV1EFwICTASHJXL#(FOSryh!h@$;_|RHRRvVQsA= zZo>W<>1tfxfe4}F?@)wTJ>2a?)ORdGdt<&TXI>MP6U3f#GIcu@L_4W zY_@aaMDwiIqVr|ii$6FlL{veb;HQrd+FbuTi%_$c5^K&!-$CwXY)tG`?g z7Y9x9gM;tYmXxkj02*H86}x(}6tc^qcY zi+-ZCzqMmVymDyAn)F&U?4!}pFuiB3s{|NUq(~RH?4SGoDV7S(qeT4-mKl|Zj`=jG z3$y#35BhTyubN(wmJbfP7?U~mwQE!nEGi4m9n+G$^NoOAxKpE=jHA}wopgL#^PPY7 z3TlJY^)UaRz5pvtjarz6Is+;)u1mN2ZSI&{y~LIFQAL^?Kg~=HYc`^Zy=u1S#hxmOuq*G! z0)3@?%IFh6_bS^I#nbtkGHzu^NAGUS@6>dO2fqeV%Ojs0w?sCtdd7 zhw36@kcII)hQ6?1Tox(BbMFY_dN~hR0J_c1bR2o!VZQf-mzVZ%PfL~rnR;$=SJ_hN zL#NEiO|e3?CiVw{P^-@;sjnTIzY@jB*IiQF-M4>oi&zcUis+iP)B$^P?hxBtl&ZF<_?dS-XwgX}A79th7y9G%jd4#>60thuI~b{J?mpe5IF@ zN{?p>+_@rWWCN%zbH(vrc@>66SC@SMfizNU{TgIf0#sg;IxO^;oW3UXwo|s1@~d{_ zOhuL_Rb7-PUBJ;CquwFQ`>?#M=r@2{@Fbi*Cljn8gOvK4u5i3GVWRH#w$nXeHlFg} zOm}zxwRZmld$z0h!G+p-r_)Lv&dpQar|s{~-`uJ73YeH|Vv-8E#2NbwQm>YUWNl{I zq~h`w=U7wJf=y4_-=FN^6Q{do?wDwUp~HVE^z^{DK`xOsv4jkKb=?<{%Jpa{%+k59 zjx5)~bByT;9zESxl?wseQ*4zDwrTppTU$Q`4XLhCACK0DeZePXaCm!-^Ja9MM#-Kk zc7cND*5uxR5^P`5+GO$OI4qf82c3FuA0t9!X@}T7AFQ;0(ZD0WJgs09&qMrHZm*~= z#j}p^5!w!U9b@o1pb-Znn7`eKgAt#(`~EyxSH;pJMTsA>p~)&tvQJjs_Q!qQ94Clv zyAspNJ7f0caRb)Yddv;y1@Rm#(Q?zG5?OvN`@inC9zJL3R2DQ}RPc|*s8(KXpJ(1E z@I|PCY~Z!k97=T_oISwS?|rLqmVZmmpWY82dcSzeQ!bBws+XzME4M6>*_~MmA>&pV{nlC}oC9 zmZw;i7IG=1HUDeLe5!rV=da-|!qqsUEIR!M-2ez+e^2XQAb`eD{`R^j1H*oZlVetF zRreGyZX|v~z&G62SpFvZiD1}R3;z(cz<~!!*Tm}%k4$4vG0(pF?;^bakK#@yp!0QD z91!^b6#V*)IU%-O|E-t8aogPges@v|NU|s;d_)m|5}xhubHYB5!E;t$0+>hd?8>zAvxWVK!l`M0>aA3m~cT&O^uBB z>VqEH{92Fwt$c!77Q-Q6AMG9g?8%UUj9|nE1asd#45DjgKu@ocp-cv1X&gcdURe+y ze|@V)U#6*?G+bt-1Nud5u)g>Jj$FTkg>N($f&w_lhMWKgL6xyI_70q&qF^)a9rryx zyBpK|{KV`V0inLsKRXZ%9ZR}&i`af|`c-2D_tWx!`p4u6SXx1TPk2bHuh@;z=)Jqw zJW}O^QGNpozv5*t|$2-w?4Zz%C0W<6?rh8Xmb`C1r>V70>$tS`Ow#%~8w>lz(s5qJU$a zo6N!;{YA07Tf}pVTQl=!Hu?mt^Rq~HDeOIB!1lCr(Pz(Jy4e`bs?wYD7L1G#8E5Q}u@YKHsR*Qx;s>iAh+3mr zL-ri|(4bMwXcE*DX4npjCetD<}{#KeH!#Td;5(nl3sEs)`8U`0QnM7>%bDD4Gu`F3xy3i4GD2l<#Af& z{K{ySHWxQdGXumc>@?VWp|e6v5I3dn;r?vwrMmV9qT7Fgm+LmWDqm^ezzlSfRz>}qhn3ynlL(rLm;uBDc(Q%DCMZ#mMJ^#)5JIn{Zb zT`!-tJBClo92JkFM4H&9%=+_{r~+C{sqvBl0eH=6(hd&~8w6GO#)H zs#xX1*^ZAC^=jRU35KVA9mm=6Kd=~{XXb#jObQGZQR@A5o~{amy9W%Mzli~eiP6D6 zJC_)hJeBJ-%@y00mw&1i#5lK)^7Pg}sug^sTDkF8wQ>oUh9pv535_??9;bqe;hA;( z(fJHkqAAFQDfw@osCHQjruRM22)IJJ+Ir26N552kxDPReAr)6D&JTSl?p-}Zr&c~2 zQ>0M75EG{W+qB%3hhaO^<8ZIcQpB**-qJvv!_k*bPk@yx3C{I1daA5gaT{qqhkKk? zq8XHrZb`FO3B^8G2Twr%e|Q2mE7Rg? zh!GE*irNF<@W(ZB-S&#^flH=Ly3I8TC_2e3JBS}4LB`R}6p{6C zx$34Cc1gYWek$y#oR>6(U^W8FLSrd$XS z!0M8^YnvzcdkEZzu*Y5(-&Xt09-FB9JuSojhX}$7E@*$Sy31jZ$EK^|i}upc%h$gO z;pT*l(oY)UJrJ`hUjT>_eCE{ibOkWAd8E-c%VwLgd8yHN2-DzFOd2 z<7QEeJONuun=A8x3ksruC%Qf%BQZ+S0)y0QXrVT=I}Fqn;8enBnOnWb#wCzM>$hF= zCOy|CmTNtXGgj@aGD_G{ep$IZvm}2jdR9e*)VPh@XKl}%Yych+2JHjp5$N1P{R-Rs zaModp;1FwicBvQEgKWbW+UwGF*@@MW<5Ro+c=nHb^xv5%aNLgf;|T@7qF8SOv3Gml zw<}@6!Yj$rWxpMd%yp+>S_Cd%-M{T||H0HoT&ckx_b)d%l8NT}quBo{!=59y>)h^i z{jY!X`}C3X43)FLy`qzQ`|r#nW3cZb0&10{7H78K<6ZK<4JLsNDMASO=ZyL9Rk&gJ zG(+|@r-f()(J#u_iE(gBC_V>S%L(H6>+IQ>Fu~LDf~S+fZz{bwT0`+S;SvEX{4}~T z?_h1c7)mQY`1l~)BQZyOjXUx%HGLxRWA+st)8GDmzx}a$&m+46Gjn0PMCd~AD}iGf zej1oQo&0Y;4qK^C7#9CR9rYzzSo|_S&Mh`c_Y*a z$!1NdD);Z=Hxp6%D3#{l^+F zhxYu9BQR3{t_WZSaall}x#u!f3m2Dmo-PU4(8z%iX~U>Lwo->E_)oV&L30<}79-Vz z|N8|hFFS@CY*rEX!Zww9_w`HP0V)KOj8v$UuDh)=Aml8>Z3_;rAPT-QHfP{tWxV*% zKcD5NXWH98HYF}D{`|TF6JlEm=4ju+WdkXh()hYJX4RhaV?iC>1Y{T0l@N?b~7)=+lz%bA|5pc#1+7WNB4nGh7abBAy#mEyGVWF4G~FUr=PKL!Y7$$fhWk zJbT*X!{@(oKnT|SfC}Ynh6=?2xM1Otab5sJ-jR?d%~-*uHjD^)MFvr|n1 zhiC%&5#)l~J!v~h2LuN@d+5)w-HBBG4w2>lz0XM2H_xhBNG&upli(IIH&n(2w{LoR zJItx7tJMPX)Nj~N`03*l3*3?I&C)mt1%=kJ)mW|YG#w`?d0X(MLE}QDm`klmVj{?8 zfxfO}w7Y^hN2;sTN0xh6U4vFIme*+S{8R8rWioAgvbwt32!*V;z7nh2IYr8=zHNq~ z$(K)6ERV>pv2c9JRgsu(KYDzq3n}(eHMR|t^JQFfUyF(6G1j+#*zb5QKFU~oWA;_k zqQ4}@V`R`&dop=_YH`>1YxM&IH*yaD((Il|72f6B_o}3>q{u*Fu}SodXPqtq6S3A1 z$tcrQ{yJGCP{Wa)9)E2{Exwx&d3G-R|J^-~)N+_U74Bt51_PDN#X+t7r_mU-wdPf5 zdWgZN&3QZ%!nAXF)>&BKY0$EiQiI=84l`G(S#BL*7Af$QpI@~i2M^TVaWZfe&DMJR z>F2k%WFNsn_)C@3eKO@RaCXkGjppa{-rJZbTm!eH9KOs9dRUxgQ*FPXoD859ad`s; z)I6a{!;F(@>`09KQHAIDEp0n>s^UAJ&{#-388MTr;-X;%#n-gv##I3s{(C*_NN@}h zop_NMrSs2rxoN&5X8kLco1dGqLaTZve!gR?bX%-uI*JYvd0y2bvO2uoLoVPYm)A6gDGLYR6W z1tD(b6UNx2XWGP!S^T2a=W15!Ws2`Ke_xQAJ>_I7 zXR9lckcRndZ_{@tUr%JZ{TH*ov&B;@p@M8OmB)K$WP&CbSAQ&B+@St)Rz-(f>iL(H zueGLJdE>R@u(F%q+xRkDKQB60R^{_e|H|&t2jzUquXn$%hWm=^Q8`cjaNeLEI9s!| zgze>}&Ofd;*Y8b?q$YJDN!kz)C;5m6f6@|N5cX;F<@^0Gq3HX{J5jlL=OCwN_`XrS z*$-nuiPdfRrOi2FKRK>Ad=(;<*R$ybP}Y)}^!k1b_<1^y%l;lguO5v3C)OMC5`C~8 zB{Jb0y9-uDmNgvsFU;b4;Jm}pNY6(od+2l3uuGWJ_Q3!Su8)N z7|r`W22nA`6L|S_#+?qc6p|XfcNNJlN)-0euwkrpZn@WMt4T}Nf&TQxhZ$ak6hhGJ|H19>d%-7`L+@giOFstWRJg7wp6a1|42eR*r zdF$~GklL&J19~N#&69Z8OrR1OU8%lK{Q+sU$s|P=ixn{iRI!IPkFtcVzydDXCRM{ zimY;62JP+)swagM2mmdy19YBeLE-Rq(KCOOWyUJ3`hI}??pTh=jD(a zn1#FZd2Mqdm2dU2F!d-l?VQ8h>i(YIVnL1c+X8N*4S_VcB{^h@3NEiD0S8<>JY(^S zFuqf+C22_9e4_1JOHTI#%}lvZ8!w8y zHj^y|Q>dtWZ9{FBJac9{2#Ub_XtGJ7U;O)4_l(ND<*Vx_eeG;awQ~%gal`e2iZ3Un zgi&H(lJ!Mhxa=DxQg#RsQ;7_ueT*I6rI35(bum8ZK7Z(*36O(uZE^-V2*zJBD zhv>rW5IIB=8w+?Zk`SDWx-eZ-^>!D!eEA2cmL#&fdS(6{uOcpFBN}i z3ryF4eEw5Kcdz^>?EpgmTxR3<-g_8IBTR~<1Hcu8IW%XHZBG)b@epw2W82;I1ykc9 z*A?SUSESf^A7$Oo#+8*mfR;z)Xe)VFiQfHm=E>QM;h*E^4g9P6Y9tVT1|d*54}J_vL$S^v}n2=zN$MTd5~b zSj*sVcYPIR(BCo?mRoGLgM*l7*# z2!uK|Y-gv5ZPlqJqsFF4#l4paH#xL2vu?N3wgX(O&A@leYySBqhPJv>yt){e!-wyu zcI*CCEPZPt#QrZ|0C|WnOZzV|N>4I561PDprPJt2Sq8%nyK}$FU>LHWsat=KioAP| z-q9;rYm`Fy5rPn!hUQ=A3eC~Y<=&zn+Q!)Ig+9?xU8s<38L!Ub?La>+nVE=3iI@&& zsu?HO-r`U=+9h25CH3^-3-wG(B^n9$Ggk4|vU{ae+Qe7Qf5>X*tJ6X@JF0uOJ4@4R)<;jS{6b5duQys@O7uH zE1GX_J~lm6VAR^{1d6$dW0lX;(EZQT^(bxxshX)Rj&ynq=@Cpu)eqVAO46(QjldEx z(e*^RtUn)guRY0hq7D83fiDdg65||!E>CE5ly0fDKf!(5@v4A_+27JkBBVI|qSo$4 zEk@cm+i_^+&^#rgT(YNR-M%wFl6w-JcSz5q5d5f5b@i+mNtb~#E zoO>TQEuFQZKeiPucdH_IZA_-R!O1O}FK0csR-{*n86!pR+ioo1kPNV=;7wA<4gYNa zW8}eR^^Eh`V{beN6AU<2MxCPds^ItU9W}A+bT9361Yvc|_@lx^02WRK%%19cXQmPk zb{CE#opxvct@?mc-aAIPF$81R)Gp7ls)}RHm8NN~x~4khTKW}mx9>w?Rzc)fsqcIW z!d(#>YkesKc~g%euKfBCO|lvmkG~y>`~&CKFs}8H#<0_T#1F*)=S0SSf5wd4MgM6o z_4~pvAT84W-6%brAG~Gbuk%ismgah?+UPswBj0h`lZMSrQ|gj{oH&ljPE`4?a}P#O z0k%OSv~KWt#q_^%H?dD}V&w*C060J?^56blXu z6x?x*27W+{)L^0v@&mrFZMS(5{hJm5;EzjAeiXUmPvXKfCtl&f8ri$V7agYA_~wL; zJk^t_-MICMfoLrpxSO8A9Vq=YU)8Lqz4WsTpn|Qx1 zo(3lRGnFsKssHV_+WD8pL=sB}d1!H0BBsI-EJ(;wRLDMw)xZ%kgP6JpCD-SHKkf^< zD)295pB~r!R-$2@I4F_zrT+52|0arYoMh-iz4}C zr6d3|#f~$|e+K?5rvC}K{;kL{M37Zfk7&3EvH-@ievLG`$6L2Kz!waEwVVHbyXapp zh<|e_T(FOW_oSn=etnr8KF&Sulhesry%N?IoB2}&jDPq~qCD{V#U-dzhF6-K?oQ(hb{8|X8dLwL z8|SG;LG%xY5e@jbb@{M=Jy#$jzMkqI@U<1Jw30rzBB9@dq(+-PaC+DYh|!`P#KSd2 z6r!x1qCu~IKjFr|p0Gb;`rLuJ{r~TNFTit6p@IK@;rH^l<0-PlqGAHbLvz;d8bcDUgQ*TQd~5nfV@-YgO*ri~t6p?iwG%vxkS zdIL5?p}<``M3jVskH|fV1poKT6tH)4KI1cbjEL0iADd5y01z<8X+<5n=$2H!VZ4K_ zVY@SFBlk)NG?4W#rHIfI9;+fS%6~Yme5_W*@(??kRm7Xf+sd?jr3((V5%-M&SLCDo zb$@@9%3mJ^$8ojK6g9zdBK@Z2HOZRz*B3rOG6KK7n?&AV5ka?!r~n#m zi}}nh+dN$QhA*;hjg-v4oSt1qP&t5RGU$#MR%GUc-(0+vEEWJDM(Tq@@+^(2_}6Ze zJ?@l(?pJI_>z~E8X{ER(9JT)PzO`AoebMd=W#8!zG%u>KR75A1Hj>DCA?~XmZnJh+zK!vF|&k)2fmK!~U`o`Q! z4@%|r%oBgz09yL*yS^*3NWuj(={f zSSU%%_i6mntJK)p?zu13f^^~@LAA|}Df-RS^S&*&jvkNSsA!xXzt7;ij2+3JOwM-nbIZJ?TjIC;qHA_D89%qb zQ2RZm+WZyD;?vp^a@ux3|JO6>ziOZQGDIuM)44UO2hT?&f^Hu%Jz*gJP06$W=ktO5 zs;^VNY29z=5SRlQIHU%Meto-e!p+UCad^K>->B4OiW&s_J*=|}B zrB!eJ%tD_$d@dM~f{Dm?+T_Vw2WDn#a$@e zH*SrWIN!%R`s7M>kIyfM2z5G>#bN&s`+yW&F6(JW4?TSF3}zQOCoKC8sNB|noSoM$ zwDUa(Y#RJht#na)uPi4wQ!!Hf926sGCH`85|6?)YWd#dxT>tu9sY#{1DKfnSW{Xsg z_MXI}i$D)RAhZG-m^3_vW51dv#x%C0&0X^MEr=Hcqh##VjhWeh)*JwAo5z3LDYm~B z%c~)8a~=R%BS3)l@-JEHzQw=yIr&*t$UW1pSX@hys*GcUCn*g?pXzx6i>+2}U9r|X zjp4$`Zl9~exVXr5T#y}|Kili#srl(9O+ZsXFp~}Eu^rtpfZJta2OnCbmr9V&%t&t+%7K-sh_byaSCEw(pL_j{ll((4iEz4?T1k zbhK-o^B<`BNlXyi8kV{FD(y}c=T?izhDB~uMRdMFGjbmNtS_$uu*a1p>sKL7km?-mjVEm}Y-zB6TjRJWrU|d%ztyeh zomg55yK2=pF;IMWt}p-M-u6o2A|S{9FedP+!xD#d6uihr2Hb4&yd)w&?&crGC2chrRY0mok0s{I|af(Rv;Ewj6prRu-<5^o_Z3vTb@d z)5W4^loHON)%U+e>vfP^x=FdY^QywG_nP~#i;Y~qJnGl>a!e34YmUdw@+LxxYczY? zlr(P=dOX#M0Og{2>_H?0-Ie%7c`^4j%9)&FP&%|7#@y?C5iHk1o)xEDzBZ5HO5fwf zkLS}(+k4GmjO|RsVGwn6%@Rd%|D1_zCVkIs-D3?)vgi4VmCp0yF>}3{T%sLEPoPI) zxbsnQtEEGm1HZe8HB!RvJ)b!5cHy4pILpH|qv0@+)PCear-wOdzrikNW4*%(YJ+Y->E;%%PyAt@@$sHXhoV@Up!EVmwH zXy~~%l`yz`*%C$)pP*5Wopc@d4n)|Kkk+{aysjdkogul4z;=0L#zslO-*7FIIla9y3xB3IZMR@k<#tObiW5QURqeEIQD9P zBQ{W+172b|)wlWlinplkNOj7&GDBZr74C2MDrYYU6)>(u>>@C1>>76% z?2&B#9EV(w>)tz$>V`|I=fWz4pu<1JBsd;S3-mtFKluu6tuU<^C2>(+sligH;3>`c ztSoe^C<#eM%aI6WcsTjvBV^(6Z0FWoHE|8VkJM-c-x&M-O~4ZQm>$> z!BqPf6KfQo>k%vuE~)z7icYGM0h`PN0j0t2q|3)Kn7gC}WlKW@{kDc5@|4zz+jRK1 zP=?}CDvg|`v0hQYb+Ovahy#RzuV9)Yy*}g#%JIF=WD_on>Pzi~GT()E(yX=w1|aNd zn8+5XH|k*{aSIJ4@vAIA(aq6&ad!>3fG0h!Ncqu)-I`?Iqd~pEa~GCc`39Q#A>Arc zQrSn9uX%g-5QZah<6!N8DIA&!Q6-1Fa{?O}I7k#E4M7^PzjCBEkl0)dGq8Q+yAp*_ z*R8qEq+yGn^8fh)hA58-td0)W)mmvRdeWZ}yq<1gt&Jj95I+wKBo}s_CHt_ zkXhM6KU&@h<|XiwTVPyIW&{&8e#>5V*${Ho!-_oFczS=}*n3^NVm&|%AxrBSHVw16 zYlHg-yH1-2K-$d`SM+mPosfb=TGhI9_}_ev4_yynga*loQG3=2-R#3e%(S#J(BK9C z+WmdfOpqeWrSqT5g(sANYUXTkEJqNd_tV_{8!%a<0W9oeoRy9?C953z8ZzR3Rblh- z7|kPh;D%qc8XE`<*9)(3;wiFDJgm;A4MWQ>4(_bxz8^1no8KggUY9>8HFM?Ae zL?ih=y6S7zEiG+clg~$P`^z>H>s$FloP3`C+ynJ4MA0mJtIa-RcdEYRJh)hf8cU!{ z;Gb9VJ}<#hf^D;1|N6PG>A3^jQ8upkmRAeHVSqic{eJ4KiC2}SIBxkAsEpbIO02n< zC=M@wawL)P*su`w+EMqG(yp*Ix(TVkC3SJuDr^nL@iuCl=)52Z&&)M>3YR$=6GP}w zrJKNaa$1FBSF4=m=a-ZZfxBK)Pxb3GAQ!STQTQ8jv5JGBpyb}?oO1COBCZ7nX9B$5 z7eS{EQEXp%_Bw9qn@HBzMsFw8p7y4|&zSa}6xlHZ6v=0IhJr@S;{u#{~($TSK|dKS!}5l10(OM9Ql(lO)tK`{6|r##!3N zz4>1yM^AFyPsy7bsOD-vH2l+VIVWd*=5ozC^8V?tY4w3`Lsj&2_*|g(>8;yavAD^= zp4>;H3bg35wK6rh-hX`3T!!uQfqn3rESj)2o~;Dc1({Ts=67CSc^alefy}Wt^8=VS z`SlkfO}If4p<%QWaZ%{jAu=nne8snG_SGxc~RN_=%m6ZxN@wSKRJj-bL+CdVP@EV$_a7jkY2vgMu9ql zF%q|)IYX}3bjW3L_S5*?hr_3SI?Zk;B_+*^3zhUl1z=xrV`GrG5oN<`P-dCYg*zRx zk8reo?N}tEw?nKia=x#!X64Mi#X=m(x4>$loGdPOuRAH<2k+8*6sQU?=zFABT8RwO zTZwecUcEzNA)%Vn_5}+ti!RCG!`IVZAjNQ%7>dC-IgahkeP!MpFYz!=V&jTrVJV68 zd!kW7tNCz3k3aR9DpH@V_xx3# z!6dwX`>b}Z3Dv^U$dixwF}F9KkPMVt5lTPB%U-VQEmf7lu;R;2|9EHMYAp}U<12Pyd;^RI-z@xR>0gG#=Wf? z7>Yg2ypE>tc#VpLsK){E=izJeWy)6(4nk{tYHd=LdWyAqZ;qxy{-Wjhp-|_ma>~Jm z4*!#Z+iCiT!O)sk4jtKTHAxh?4PslHyi*uuv+PX&`n+b9D3t0N$=6hQnL@15iIcax zVqJw2j)ta8=7+~y!X>dAaK9xm*pBRM^^a@5LDSMlk z)xFOzaryZ8HeJ`6WAa+Bd+(Kc$dv>HAEataX9HI{2PLz%fZqMCY&*csl@2^|pv)U? zs2J@!j=m1IPPjDbKhAS{^yk&0!am};u{sg6viv2T;d)Qjm0{qQd6lrH*HS>1bY8vU z-3g*iR`WWK&E5t{b*&9<=4~)vCZ( za9I5at9hYN9-smAXl*CC-~)c8^7k=u?wZyqS|DOV>6&o?ZZs_nDuDHER^{g`EwT36 zT{<&IT8`bE?)0s*&+;B^Uz8tQW@Ozy8|P%iQ9@k=WSV)yN)RZ_ub6S^;x|t3mRVvn zXM=AfW5CxnF#|kN5r(oC+D|I@X!=dcKagjyalstmCG3pPo8!^*(jYDJK^0-DWgS6l z6c5FzEgAxMukIrwx7~SGWENG6+dHmwtDWV zEc3NIiPBO}wcv1;$nB~Vx!qD=!WR|9bIMs?GX2 z`pvsP*P1DXeJByw2$>}LM!au*el+SWKUVAgSc-Ws*KZyaN398O{Yrx9cs%^*jy1>k zh!!5V310GA8`8{B3=8Y1NO>rycHs1VjxC};PxG{QO_k2XM9%Kw;?&OBG_!raK}}g~ z_NvKBL$8jc-L($2L1hh}6mE*CwOsS6H}UGqa90&7n1_%IzB4JOi~{AxtGJFjJ!=z! zRx}%|IYT!Ui#T4R8=JWryO?)4XgKV8-cGm0tryY!}}viB`tuuEH<7P$gVessWkGoyii%xut8(@k_@1Ywk8& z^~VhdqX|dDFCyBM$*b)AaoVt!BJ{jB!#e7Ho{RX*hH!mqX}AmVipKdjV|j`X;(-D| zn%*iJ8+T@WzD&2+=y;FCr-bLZ?~Kaq_L_>b9?E>b*+X)i9&PW?=T+8Z<$$6$bf!`G z^eN6e8r5yWxn>tNa#Fc`Deld%YZR)hgnAu#dS3W^xhd%bO_%gIczpS|jHbscy!W@V zTg+>2>yfd}QaBbc2AKBhs6ED>Isg0gsy!G`>e4aiQrwM-%@dDyQpbO0jl3|MSK<#^ z$e*@v^{%-yrX(ELEBjcm+O*B)^XNu9=?-!TTM^! zF=9DpA`*k->S+8MX@FlpWg12VrIJ{03HcSjvSs{r68v)p1vawQGprQ7qe!JB8kAa2(rVD=Xmpo%|%&~i{&0qO_7lnAKKtc~+%p93;?F zDilYzrL}EMVC*5*HMqJ$U;@Q%SR=j zK_0sLj*7YDcYD0R^f^v+zIngwuKc)>`^~D;FMQ?3VoHX-G+@+7nTCVk{itUy99(gF zt=F$;;7G)N+@8?2Vl&L`y;Mf|Q%&;I(};Og4nY~#SCS$cuv9FLs7eraV*O^tPkNXWaI z%Hi+4`>#a~qw~{we!faq+V2zwCwI7H4(=Imy%w$7R-TS8cpAGAg~wgxDw|F)Fs*=E zyGffQFTg3mNmocHU~r(#48*OG!{tM7bWV~wWy?rb93mSS>lXiY_v zBsIOU%1fA`@ML*p&xX>=^Ca)4`_mlfD#|YX3@k8d2!A2?_-$TkS=ASl1y+VTvFSBu zJWTWoTl!|Hl2`KWROg~LNhA5{W{&NcP6ah``9fOo+VMOHGqd-cNi}##dYL4ZZ0Oy| z@l->jTgge9Sd5D5>crB~YK_#I(vR=NZZ6|HdE8SBjsC?FZ6ZrgB5mH?CfU8Z%}#pnfA0%aWbV!k`kva2e453-M0NDif% z*>|N9(jUaPin}Mp|6;LJ@mXYj6jM=AA!P zue5#U3+P}qN|seuBHZD!*p-`u$WzpN$7iI`R*%agKe8*?u?4!3d<2cJh0}8g>J9_F z=^NOu*Jed%%W1JMq?HzuC9jkTrUzunNc!mZH2C_)U0MPjlQLccUq9FEwdh-&mTE*}AhZJapLI7!~;MF8p4^uCSPb0roq#rKc z>YEJO%T$*46$x2xbHESdmU}rhz=S1pCpPci^S~dcQ`PTIY!&{udYid z`7@B7pO8}7{~rC9XhK25Ze2Bp{BK)DnD@!7NDUK_;RdR6?-eQoJJMDj~X zZ#Yr=@rYbA9ipKhsrMuVHmXdTM?>~D>vnZ%GZ*>o_dV`z2OA_lN(oqXHQO>v)XqF* zwAXJD!;86D!wQ(8Kf)ZO{+&0T{dB%>=I9!axxSz*Jc%vu_kZ)j@CxK~-)0-B@;r@1 zWnq*t*w2I&)M(`QZSyB*#Ic$QC<24f>+zlb<6UD9^D?JsyD2BURq1;c(rW^|8 zA`W%U-3S-uFP7syj5h`5BUEO;_7&qA*ZGijHdt0Bv-{AYN71l5Brh;F0-_agN#^%@Yrp{a!xxRm6O;4#6y-n;y^guqLX_BC9Ha21xr&*W zriPsJyV1VO?eC=yoaUxaH>jk^(&~?Q!mCxSQqh|?C}#z)Mf&m`xrb|_LcV`5UZ~va zM~&1wo!_()>WLUlGoknxLSf<%o0YRN-tZyCneA}4r^2CEZbi)#pR1&7SaU*H}bGp8?AW*>JW^rFI?2USFI4>iT=HfBe1I zEC0FIpRmX)wO2V&blu*X-c^id$tJyb&1Tr|Lya1P%i_R5rL!1fM_?Ie`DEU*BV6_I zGYvAUIH~PhVqZ%&2))O#3JzD7hIMXkJSR=9)4H$rltZ3sUevkI3|Lh37ZdCPf^N!; zoKAJz<-G3rou8ETX6TPFgEvMU=k^q{!4x5T!%M5ByQv2i5-D!8r{2u|Y<^Ab;fb`T zo~ccR87H4<7`WPgD#3&ldwhK=S)f#Xd2)EL4ePF9-KtgD(0jwq7KCPDllK$DlJinulY7#yG77L~D6h}mKEbLm!M z5QJn~{E!t;7L=wA`Up=-?tAl0@9!%*9v_Zf@6A^A-;Yy;gr7y;y!+)z;gEZuE)-H_ zX>97u1j{OrvA-sC@*;oZ7?2~el*A~&>6@KMDRJ*|j!r>#1@q6jf+Kg_ko!DDUtQcj zX65$tr6~rNqyn9On)JvuVkX;ba#- zoUYCdDte=8y-C|c2sFv2c3i8I85a&7?9{3Y!oztCH5P_s)O=$D5vaw_aSv1 zz7!aVAj4LZ1|PYNImZ4|b)cK`*j_#>A%Uo~&I1uUFd~8oNFPt3FK2Z6(fR&U)P4hu zcp~XfR#jDHzYG95x(tk#_|000ORcFKaXc*Qm1t!tC@2!ez4Z@ub3sZB&K{0MS4v5D zjY};wU~3S8ElJ=0_V;GObd`j2#|P^~z~Uy$u_HAafm;_58p6I&$WV^s_uR6^nDoOt z{UH+W^i3JI4f@fd8a9h0Hp^{tY*C8`Ey{ltV1DrC;Id#x7c*?x9?>%0{Hfp89`Lp7 zF45!c4e7Q1NXocEvs*V;@p$ExsB7c|69TR~-)&}BYGZq_`jp6C;X`$pOet6P=DD4v z4_%x4_Mij0{?P8Rw}Dp_yJ;$aGkc5ixz^+g29FyzrnW{6-hX6&hP_TLj0Jr9-iTum zvxvI65zX=?1@@;4*k8QD8R?rW;Va*e(p7o9Djwfy?EeIxRNqp>K9K>|=nGqwf4;yA zX`%PYOHZ$uE}dbHLDY2LVLs}%y-W+byNimUpfEdO*{zt zk4&!vG7hd5>9QGM`0VexwqXeg6_5o;N;e{+lpvujVlAXokPuV^ z1Vu_|5TrW=q#G##10+Nc47x*7r6iTEZ%mAR@BO~d@$C1{cO3ivu~k@e&3Vo18sn^i z9*&d-7}3&|kdP24S8B*TZhB=m6+LYST#1bI7fgZ>4}8K=GBPrbu~S!`p#yYa^teWS zFHkfr2-S`zn7cLVeqP zG{X{YZCpj)k zt;e9BHzpQFVW`UI2g(TZG_vZ4Ufj|CsRb7XKB;Ls^reUm zYPI0mjtsw*rq7>GUfYZncd+D`6}~fa_3;Uo4#z$1-f0}k&L&z<9Qqmk0dHB zljYYV(L^DSMEPHj1ltu?rKfY5Q9?N-TNNGYed7m0E9dGx?^LZaR}4mZaozl+MdR%qu1n8LaSW7c+>e%^l0tCk;Px3=+@|oNzr2XtD!v=QDIk2|M zQFUZCiekvQy<>MI*er-03W1ghjPN%{ahy;K2F!~ZU6&6XZEg*Wf5!u}qISnEoUY>l z*;2{+k!p8b>4Xh#O(OJ1*Cp8CPB?#8`nAD{ARC;5(myshY(sd2QIVL#H}-Fr4gGzV zDeCMdZhc?>Oj!G*iJ5Q$JQ8eByyoiU$)C}c(|WKr@ydDheHP!!x7M)JCo9=1pPbZS zR}F|VS4q{*$zHmb;yEFQHJO=h)T^?ka&=;m19`=`%NM64DHqgk5&<{8fN^z0PFu>| z@regw;!brP)j7voT1f*aIOLQ1ZA)%#y0T;A^|C5m_V-Tm_MSePbGkM6L@H-YKPHBi z%9V@>J!M2nBkg<^PRfT}Qz~z6=rIM;N}X`9>S-#QYQt@5YBA&P?9Y)4YgPHM?pad} z?E;guTeq>t{u@al3r*wAI3bI(+Cj5%_OxT&6)!5^K_SOb`TX6jzS3N^=O|Fq2h==t zNxS&u9Zk0r_f3I#ub8=5v(48%mhP1&1Z*y3&z5zQkY8tjC4u*MNvH*%O}^63_}Z`H zTyXG-V*%=sDAn{Bv`>dHdCuvpFH_MO;rejUBa8_ksk-WN;K6$b_MtQ2_-c-81)Ga{ zMH1Sd4idHy+L}qf^BA^Lf;<%+4uyzT?njD*I}l%!gRSL~zI4yt9!}A7Kc%@Ng*?F< zs5yft=YNzNcA_1c$7gS7%hzZjbyMB?bLN% zq$iP!bVLdoPyEYRPeT5AvG;!}8X`>a*3vTG@P$X$`bJLrpP2XHzFNXP>=&#v5m^2_ zl;7k|3c&~)7rxyp2;(*?Y~t7(T&ig_n#p>!MiR~bE>Jykr3j*_!lS(&X?&j{h-_vde}g{W zSpfyd#NO^UVj}F~F2v}mTkIg(Blb~U$X?X=R{}hP7 z!>9~2e$+a?R2r<>VUOOo!%@2pUMOsr0Qjy5u-eiML z#Nj`mY z?RvQhAV%C-u*qG6Age7NC2RJ)7Roc)Mrw@Gd@ye1ISK0*2xFq({IRXjGnbG#6V;qP zQoXCmt^{S%8TP>0jpa$~OH0spU~_V;AR4O?a+th9Z|wIH{m3 z6Mces238O@<*VpGR#J>%p8D!c7gx+p)%5aAm1uN0=E*4wI0%7*xbN(ou1vpw>=1Yf zH5@X*yXFn{+x&IdaNku0+nuFCjtf?d#IMK4$$>n+q`!|3pcYDtP_v+ef~{xcwuyLb z`SlB46OBOy0tvrxnS;eh>k?3x9(2|cA~=pvpMJ`khPE$#@uDeB)=v#$Y(71a&?V-N zBv55dXU|vgp&^e5WjOB*q#W-B0i)M-O<_!sk;4J;A5k`E6SZq0U>}Q7c}!d;Af3T%LXiQn07$lwrXGkU4UMdBfrS){!}zCW}Hhn zm0i26yu_6rZ25uDP!gaD)SVbXpa;-!O*f^|P|+@mwZ7LvZbu;d{BOuE8iDL=|KdP@ zAv;*#mD-bkUSMu{+O|`-$VT1{(#oGWiXsMZG|i+dBHC6%6f+3b(;3qSq6_zz4jn#1 zsphQ(9bdP3WQ~eO?@W<(dnyiOdN6!S&g`SW!Jt_KjzmhKLbO2p^^iM7(j^;B7tjoW zPYfXEDCk@akjV`4i5yh2v9SS5{Nq3)P#;F2BGDyB!tO-I-WjX&3isy@ASlqvi_E{q zu}5Hy)AciehVuv9=9Il>C9V|Lte`HyUZz+sk`JMamvj+9jKME13i3W1zLDg29@&@( zwFlXeY8KUg8MfmVqKkiyXeg|HfxyVCt`qWqdDRj8&jz;iPs;IY){o)e8yHD$sUUkt zL_BgMspF0T1bG-$Lh03f3c`E02{y6c>XMZSBiIr>PVeRp0)pc^5p!gszQf8N!Va_= zO@6+Hjy>d5!@nA4*bcPv1<14d>lHlL?{2&-r6$&kM6Rv#o8EJIxVFMVnq3a~2438k zkn`lI@}DmtbNxg{jobdCE^}2@j}dQwdM=xn;YFXz>1@m%rOPI&+?^5T4iD*>(>0l8 zU_$D#foIqKw!;OvjWW^xlNa39@ZJ2xCfn7GhhN?$>zLm;s!wkTu!~n!4xdWW`OtVl z)6}aoM`#4^3q`W4m@aKWdr{}|jPM)(MF?;ioK~nVbM@$?tUQNwpe#xu*j!d9`d6Hnj5$7zdu+Y^ocP?b$dj>%!*p zJSl!cQZjxX&fttI+wZvJi&LLfUtbF}F^%@evR+@EA7FZ@@Utnej7!j_8x3N-W0N`e zc{&!BMxsiBZsxq$Z_4^{Ypx#`rA-xk|7NR$zv2*-2?{BHRvcIs*|RS{u5ad^?3i&` zV(dK>W{9b~1aIyYA|bz01Zui{Z(v#o+3?ZsNS$eH_O}DT4OBYDlO`gVJ zhF#U^TYa6isXre2tqa4O?Ix48-Ow#oxo2PQukT4Fl;<(!zx=V&c&>5qZI6M# z?SN(>+kDYbCNcU?Yi||E?ta^`=-#c6Iy(ajWhONWV(ygsk4-# zwVyA1t_^x7jIF!VCwN^kMZJ1`x5)`HFIVLEy%9?(rOe2m+Rc-E8+3`Y&Kz$c)SsQ% zG#cO(_Dg~MuK4%K{$C+|_Kje1Wh;}(73=25Y}BWXYEsipdryt{Ck@!8LBoWUep?b` z^>8}2o2#j^tH$C|TyS05PQ$x9J9^T=ve#F$Pf9V8n;5Hg8oxM#0zu#`c?}$I*Aul} z6WiQ=z#u*m1l|tQ@!+iHm~$^?N2`l7^5>(M<1Sl16}@B3m&WDP`Wnk{^u1^;TdmpW zZ^HS-MIf>wwN7{;JGrF{U?2U9A_b5Ns~2jJWGp@Z-Y*nSqg|>)Yroh{0r7P0Lv&+< zWTQ21jp#5QmccmxOr+a-lGB!2 zGJEhOyEPH_naMS7kF(Xei2WuzOopCY z$1;SP;iG*x{%8RrJX;W8$xcb$?|?>IIiS(#{xY7&OKwI7Klss0qK#)cSJZNUW18i8 z(MUjJCzq-pzqK2R#6ls*QD+546Wbc)|ZmbR*erKW0E%6$bBRBd_Nd< zfjz{iAltg5)Y|;v8v1IazFa8jXIwX%X3>C&$U&8=_4&HWtVHeVJdu{6fsBc03=d>WV{FADX24FTU7kwSbQ%LGr8`@eB9>}p0X~Ch? zL4ZLoe-0TzUeirG`(L0G-T}wK|Ia1$_(xXbkkg_Td$bV7L~Z-U>@BTD(P(ZBjh@>m zL7osdy46=imzkv9(a$p9Bi)Eq<|B>QFPE1Vb|nC%AbPu1l~;4J@`c>9>+g{>bytYv zbFy20xBm(Lgh2Zv(AS;J4tJgF?p4o<;WH={6Dc0_BH*{0EMGj#t`gn<)HM1>9iu<( zIi1w={>{ArdX?MsiZp!Pz9MK@yJ&RG-r-H>E4~OmmxYuOQlP!BX_o3(XbbS({1pG8 zb(e6xy+qsa*o^1}y>jgrQcrB#??{_Ag%%d=E>98~)jlX(Yiv$q%+)P;qq>cvJ-riU z8vQ;tqK$x479%^(tX64n0oiXjtk_cDutSUEOSWbLzi!hU3zXZ=z23>cYVjRu9LDnU zJBRQn<*SBMUplEC z*i9+Kk$xus+)Bz5nbYw899Mh3rsn-us%jPsu|-C~74*7qoSM`j$n$uOf_u|U8COS} zh3B(n;5uEmc8DR@z%Rp&P}`U<;mH$J%S1zH#vt{U{_J9G;BEm$K2 z^08ToQ^)<-10uO$MQ!DJ82c1(TF>%%KqgbRYX~+3Den{i6kGr3(5RpsTFJq1>@S9#hB#1OY!%MuT}*c)9aEr8UnpJ z{$eiP*<<%xMZA#N1xD!yKK~0M)H>=}b8_i3A$jnz3OhdmHjBv2W*zQ_D1sYBh{;e< zpwA>u)M^+dUE|@m@g1PMt*fkq_o!M-+t)r}?6lGPb?*|?FLzOYYgvh+UK$wVy10C{ z?070o)=55u27!_tIa`=bLF^Eyx5x10m*VEo!RkKxcXfOB20!b5$>4{7+v^Zp#^o2- zKVZEKU~6Y=hQ<83|BzxK)yOZDAsPms8MK&nfb(|%^(7e%F%>L;B;0j!QUFB0>sz4{6TQMPXzgQz2<+?)?jz8H0X3;k!zA&zWP!7}(mFJh7@__yqiY=y z8{}v|M64(21*AiLW8+~+jF$yRTYDykf~v7QO_q>dHTmkU;UJj*1n)1IAX)R^C};pE zpg_tP>{LK5wgWBUUkKz9+eL5urRC*|tFt|;KkoG8$IL>Op%IerE})WyiIVpS@z>_S zM%MwL&McjM+!o0@^Mw%69=mc!LLT`m+ebR2k=@MS`(V$X{@=a|c?J>?80Y+tqgJs_ zgeVgmbA(MH6b-(@<&9-CaQCQXbp-*CaT^ASpA`@`Qu{eQ44f;o2N%{sRRSk zmhxdqnptV(nSQW|J2WONP373nD3u3H%Ve{FWNS>A38fFuKJ?kQPP1N(XcsPtO z+gq!AfCu`3WS>_Z(?`l6<_X9&WGE8!1Fv+E8)d6qYAVNZ8uuPqnE$=^|QgD@kzJyp)SJKu;9%8B4v>cPf4BQ+OmBF~qYcU^>x zpRVhU7TmXSh3R$PEP1i10VnQY+unE0pd^$J;XF_Nh0q{3G_M;Q3{d=&B0@OP%FI+@ z4a{+!u^trqIoC%9ffcfl58n=<)?Yr&c(@}mq~F?7!hDD+(&6QdKW83_9p&oKh;&qC zeFFZ^+y?F$E=PNQ2rZu;dLiJvI-BLu*3v>!X5RK_r^<|~)uSGpMq zAgky6Zs9R%1V8hVOAkWcrQB#cbdHym(r#%0hVf-7z^oktbuFR%)qI;GTJu*mUOV_8e~{ zmy*}Qlce_S2UW-CrT!BrN%y-y|9RVKY+(k*V285Z45s1Mt;Cf-#u&mL5H&WkTg7dV zfi9^rTA1v3jp2h13y&fv?CqAa)zZY*qtJSiOP+K|bDx(VUzvwLppk4nNiDGN1#oQI z)x0Bj=`Wz(M{??}K||(aVdr{xdx4)_De_pz?Cv9X6+C1-!RqEmT>pZV*kCT`ce@8o#+@byW}Jb5la^Qm;H-oMH`4SDWXt!zeoz)@ zuU~eP1i`mKi+2&tff-l_GfK>w_N?6J8aH}iu5~(;!F{D}ss%qG2qes|5BNokS@Rf9 zp6qdf*Im=J4}jwF@86%|7lB@Z5KpVh(K=J*iGF|)O3qi_ zh95aeez5-$9MyH3YRS|#snQ0irbwIVdAvB2V@4{-`|0AttL^3`6br-E56PHDGAy$! zy&7_Li;dH+hD6@#DG%AQTmEpkdDSla6x#PJ)k6{o$c(eMUGRi5*|g=Ib{fzTk20{I zSDIsmB?#6S^WQnq4$=>leQlszoO$WGikcNF^kQ>S%`;Y*)t^8IkaIaQa2(@@{w?Z4 z&P3c#+7k19m6u@-jiC-M;d}~=8Llq-5rys8lS^AIR>$n;{K_pluYvYQ z%x!@Z^jx?C>%`pJ>BshVw#AdKR;J%++q*TIpFwBUlx(e6?kd%LYE4xFwd63@+S23l zmM~ZbChd%!Gh-!X6!+AunYu>ZLQ0Vn^0uuE3UF?0D!Dor( zZ}|LArB5$LCb=<1%I!!VeU=r3w7vn$XUv%j$aw};$7QJ0Z58o($)kZzdjxb$fw=lg z#wqfQKx%;^)|^bYoelM@eTq`7rE;~~wvHiNgbFMAbFBvx;{EOm;x~*E*BBWYc?rG} zQ~~=l?5sS7{luKS#gHtBH$h?V*1k zxs@|>9LH)x>kfnT-4jhJj2Ee=LSNqfo^Y|&X>llk9TS;;KVm;U=SbYgoDJcp+s5wB zhEwgXQMZa(hD6h4hgz`=kbjC!4i}+9SiR~O#uyBH z60a9lzpn3ST#GFDrovBKJFgCmitcM%O8TUko)W0TeW=fC0s0xQt*dM59Y;1x?RKTU zd`kYP@xs>~p<`uR|1k83)gN|kFaLk`&Wd$g#8+!vuLQst9_vdW1X_ZFnrb{6qHndS zXCYY?i;fi6fT~5)Vs-fQ=TeZOfagtiS2yA64^R~$1r{Jjn&etAYwWGxtb!hxfpt5y zKyuu@Uw3=t^#k6k`)%niS$jxWO zP$`eV^Xf4OJg=Ml_hfuR<*e&`>Y41>pAvj-6i`p@MDX!`Hdd^`REh>bz1pA0t(4yPNF= z>gL@O&}VTx^6AxgyiIpGnC{Cr?>1wpf@wBG3YQV7WU=Rq_Ws{go=DPW)7;4Y0Wl!9 zW9{x#j}`;+3?!3WV|H_M6PYd) zuCIlV`7k|ad~D1UiE^dW!Z84z3^K!yJvFXHDs3%~2Aev^FU{l}(E)~=Nr2OWKpl}@ z{}QN2Agf^fFWZ$$kujp+;&qcWMEgsaO5O2sOuAWSXlG!>$LKSx5isHD)my0>mff2b zjG!hANIq?--HlaMm^$9beg5@V-h{*FI9o4%J+fE3Qgv_sZ1Vn(t3A;uL0+fU3(%nJ zq+le|kJQG#qpdxfe^W!T1{jY+Sp`%Nq4mqxi6qkPq1UPpz%wV8a7>ah?QT0O%r1Xk z+)1WVXl6|OZsy3RML)89E!V!b;UgVC+lZttN+@MsiF!^V==1>>a#2n|#)VgtkNR|X zFZm5@?8EM_kwoY6D!MDL7`QoM=(%wpKONOtqy+^sE z=B@eoKS2=81d@WW&gD79aOSiTrvZB5g5FDgp_1;7#LA8*5pB}-1gWmH%&fc65>k=g zx>&jNTM>)$AI1lr*_H+nlEK3i72^Zy!OzAUGv*EoxGM*8&l`UWxc>u(%wmnD>)TeA zlfqzYR)m!%Rsw3ZD7&Qv_SN&&880}ere^^%?gLWP47I&_7C6243iTSj`)hm1uADPJ zDpH;5{T39QTF!NBE-I`JvqCIeoR2b#Gk4~OYxvmH6*YbqUM)ER6|vwGnx2mrvtp0( z$~!nL_*M{C@70|BhzRlmDKDL{Ez4d3i@)0{Q&5J=z0cN%{zB?uANJe2405WO?%88fGo z%YEJg?)5SM&mgup+lxH^a(#?Zq_F=H{EpmRGr+@g3qS&7F#EhcOjhuNee>oYHX9~I znLu{^arJ+25aw5uO0AQ$QIu98YV6; zb;#Z}tk#qpRLn0YW|WE-_7K+>wth(YUNc``M)O^ZOd)5_a#IH%Zy;}`kej%m<>I$d zk|XS_+!!}*1;TwHYMe%HL$|bW*C>6}-w>rb@IvJlBSvzw@fyK&7t*DrTz3vJ70+yC z4V2tC$$9yQj`x)VnS>8Lrg&;nQdTa=xA*$@j>%!$wRX9OaTRleM`pURb;*_W-6TAg z8D>R`v)*B2g&v%-d&b4?tm5;|3!q=K1L!w@&bx+maC7KIF}E5g+3Vq^f&^VwJ#4hW zJL9u60{pre>`7JYa#35#{0;`wO=%zx{PG8JfF5e{@!|P5zj+5_oq}XM@Wf#izobEl zdr_sy$VyGFNagy~w(qMVysLrNKTeaF^TztG-PTp)E@7g|ohv*FLgiQ8HD|^%Z*~gI zoHJ>yf4ns0zyJzCxwNwnw5xMQ$xhY{=N;9q1#gRCLQO!jX7n_>vc{famHXiqx))j< z$}9ouYkA*gSCxGVp7jKp{m4IgtNodX%C?aV6r0Mtpk%3}{gM3!$gAB>I0I7O#f!M> z_Wz}69_WF)VsNqsgNi`d4-CD2ad?1saD^fTd+WRDt&oNR( zwNKpsP7oBKrrl>$Gh8Lcs>qC@B()l}%WrjP8Rs!^3Rkr19b#+$dD_;x+2$*uGMFO7D_q%Y@ z^;o4#QIl)VDh9O2aA@i%eLk^e3oQrf`9Cd(8Z@_%UmW=#U`IGSqJn-rSk$Jp)A$EM z7a19Z_#7qsyP$ywn(TAez4Z2VUQoE8EN4u5;UBCt4SFa1l*bh0lFs(uNAAnK;!3G? zT@4G2w(NWM&{-gr=4*E?eU0lbQhdW9N`AHJSYzHfF0Byes%gjRkv{SpN-<4iHE&^6 zKy^sgBTD-iI52BC=O;Anu3DCBz0v$-2>HM?1vlGFVF;)aC{Mvz9OOmd~pSYYi z*_nRNZI~WRH}p%jr?VOt?PeuXRF5WOy8b?iL?M)^o>`arQ%Wg5gv@&{MvU5SeaC?D zCiS-8w;?~WMfE(#E8PV>GIDv<`%8=q$weDKXEIPVJE2?kX;xOjjwgeT+~6Budy)u& z=G1iE7QxT?2QxIDJOhqHRomx^<)y=}{AQw-+GLK79b;10kD(e=Jr95UmY19VaEO$r zRnvUiWOKGLUflgeBqt`2obm0FfG21OuFS>~36VB(cU_zMqdh?f-*a;ELo5C}daj0$ z;f?YD-co&(;rhj8;T`}t?#zE0LuQkfT-&H7)5+%!`J7rGDD$G5yQ`z3?#ZR=Bc_Gk zmcd!g+5n=n)}gAY;%YdJxewj9$AwZQOq&8j%(hh~KgPAuh&Z2dTpWe$zl?%g$%vy# z=cyiah8pL1g+?1{4=YX8gH3=l>`8WU#lJ9GElQPk$FGAob_QQsmaL!4Y|9OM6scG= zo_oo+)QEk#yf96&n@mPVcEZi?~w*6Ja}1Tmi3Uduz&IbQwG>?qjX#sW93 zx*g_3iiv;fk3=cvbWF-mED0I|ZcqEl?u!ntQOBi5t&~OS8nf>Wf{5}|%5BSM$wK1>y#d|_x=SIGb26yBH`b@@1N)}EQdnW z-wh&9gCm$m(EESiAmCHF7H}AKls`uGD%K?-x~Hhq)1G>T{3C>uY2X$W6;<>( za5{m=SagjQ5eFffI_=x||GY-{6N~jjWCht@F;?s*Du@gS6ZhO2LEyRyng3iLpoRBu zUPMG2h)CWOKm81Ro=)k;Kew*`?#faDW}}gE75kTN@)vfU3L>Uwfg$igys=&?zqlii zHO(`QUF#{oU=f1<2_fjt&vZU7L}ZGURA2tQO8<~?A&{jEB`5MrPNcwBJ%#t=7rFvJ zF(_I0Hs9hwCmnHo6kMuZXO^`A7yL_mzUDuDAADXiEg+AdZXJOAKM&r zTRO_swUQ}}I>QBb;ajHC&~p{Iwi%u9KZ_$*BkKsHeI5BXxf6URZlr)QWkbH{jZ}(X z$1bd@D#H7E!u+cGY&do(_%xNua_c$d!P*@DQxU=E{5xXri+C;r8*~1-Q~bKN5=;H$ za(UcupzG+)lca7rk8d62sZ7DGBgqt~(`MCWS3)oazm}xnxPx1+eg*HNW3(X2Au;g$ zZDN9}LN1c*f4<0Hn1%rt=tm5UFAl94H{`;|7FkyC%Kz1N{Wo9sKYtHAv9;An&~AcX z6so;z2iLI-)n4OSWaKuofMJn;#=Gz|A(pG~SMw9@Sx5nj+`{5i>uqBYHXfrB@{drb zi;ej2zfB1vF1S!0y5jlUe#M9Dp|4)PGyz))46z}H#*F$COwvAYySwFpg#Lj7 zQ2{c3ZJ`}QMxd-b&NG-FtN?WcDTA~-1F#BbDjp05dE;-~K7N?`b71zVeH$_cvE%U|Dcqm`pqw+N=R{8#b9;^?k^uy$MQMT=&O7aouJ)c zUid5lVnrOVJ|VMfNmOQ$Ny#wK2|SM>054zKBOw_)#V;Sw9K)r`$l(mF=9MPX_M?f2 zjf$BkG{Pq+td+XU+Pzpb#j5jhS_H`Thi0`dLjiAXFzJvOnOO*8lfsF-Az^D0 zRI1I1qQwrUh^kAj;JS*G3}gjShJwocB>b&zMB%^jC+~>u7fH)+;Y9PT+fh7N#@$%e zm2vmsls*H#7;a61={_>hmQUUGanzoCSJ#~zWwv`bjeSFW4SMj{@cGiQbIyt5xKljj|Q^hk)W z=^q%#(`Sc7L7l#A;B$ceXo8$3ghAHM_)_PE#}X(G%i%46ipwyAnOQv@4eh7|JeCZN zwZ;GnLeRy&h35Y*ED{roEq0BMJv~%#6$%gmS7JY-;fCJ}VPMEG&UX$r zG=TKmm=lq-9?&-=D55Z$o^qZNkJ|m~(jIHnWsgYkj!^fK!hXg1h%!TH+|2yfn`L(Z zQELA>syy*e$;xnj5R;H7n9c%}Vhp}9lAjpu`2|3VI00i*P*ihkW*-BSP!5>Rv`}dn zje&qeKfwgXJC1G0gpkE_aG{9VPWU7=c;et8%qI*JqCr&GLW1O}psvl<_&MWKjIc@& zoQaJ2hMBisa2F?GP#SjZi2gZjdNJCkvnR}Q`Z+Jf64{tK0bbTF zXT|}EfO570*2|h`zQ-9vI*`qI39%Kqf=$fqf4ec<^6$x>CkW#$j2yNZK6KU43x*%6 zVp%f)oGmuSn;*jK%Gp*p_e64zX@K$^=hD}sXYMjHuNqg`FH;v}?#J-$;p)r}*8P~O z3uoEuQ!0;163A9IyRIen0@av%*V|0=*M0p#j#!xt{@mA3sxp=m9E#zP{ts-KMnwV| zMg){`#R?dQ#_}8F3%QUnULcCiR!vXI4D%P!(8T&M23+Tb5rQjIZN(bH;QiNCHvJSY z$XjUv8x-(LcTxi|-2l9-&h<6H+UYh&&?MN7OC9EP5IhPdX(+%rzi2WLfCSh?a_56- zj?e2d{;6dp)>HyA#;2^$At!tJ>qlz)`9Z1^0v9?5KN4Xg~0-PxEEZHiC!;4uu{z!j|1?2DH-Ne z8tvC&XYMeDOG}s7JgH^oFx9BbR_clq=7TZib-UYp^^yG%oYG6!IMU`P^c%ZQCUZI_ z_4xa3K~#7Q44wurcIJz&;9X8W)(}Lf$h$c7V%PWd`EzHKjbFm)uJy8{l;W2;;5;$p zXuNG{X-SerI}crWD!;|?4Ijg-aeMI%S2XX>2*9Kk{9iK_WT7#u<0JOyq3PYXytD ztUbl@Y)m$h!N7GxxtkdFxPF6Y*8}pMI83j!b56wjs{`T^lbK!(Vfjb zQ!R-1ieRl9dLa|VS-0?cZ}Ei{VKn!+bSPS><%yCYZ<0ZPsg~HAQu>3t2-_p# z;jh5T0M1Q)Ij0%c*WN{yD!~cj4*7xjQJg$DSt2n+8Y(I(voJ$xB5#_T{AIu5m^rb( zBCk3(la#C4x=&{0DdU>g`O2Ifp7&}SL+EusQ=^odp#b7!jz~d0{?N>A7nSXXyo~UR+fr5Ik`G}d5wiTUpX_?tTcb|MZDr33&vVDWrHL?C`{>dN?#frZFHf24 zBUOU$+2bEM@sm0uQzY8o5Z!o1 zh1?=5RnUy&MwvR@;A=*PiGyXNL-xmEY4$Z=z^ zr4WshSMC5QF`0guJx7&;>CWHF#3Gh*_5PtDGmtcTSt=gRJT(#SZ}jTk*Lo@*onyIl zDk~f{!2%svdXd{|d#~Mh>EN~lY0INkSq7pE=FDbpNSc|Q+g@MHcZ~MG4WFUSv(4_1 za{4Ux9Sm(Q3(QUcr$y$8*i1soapiZE>ME?nnX#1g#6EH|YZ2&KjNw_#4ch6Y{n~vV zbs>|XXE%-l{TrjkS25JDSa%iH!mdKBIlJBb*+K9%_($W{v&mzAYP<{H6Z zotfF@s!1zDU0a*6N#swL40)VF1H77=M~%5$s-ABidc_OkU`E|G&yLNLWGd71*e1GY z{Bmg=$TW|DOp|W{*$Ep;r@XxG8&YDBG=kUF)!IT)LYP7>o;h^V z^3R`IL_(~atz9rom_iG$(1}FM!HzEpU)%Y;Mo9mPbiRbxkR}T42k%0W-Gcg z6Qn()RFcHJketw4g`kk8RZK6vZUdW`Eci2{Jvr4iP&nBX8SIy^MH2UyQUg6v7m+cL zA5>|}KW-h5iN?pge6#W`pvypV12(P4#cz%DQ=tR#@o< zU6$dJ_Z7Jr!>fH4QckbFzOOE)SQ;UthmYip15i2BIPBTy_w)AM>2?;5gjvg{zQP33 zTwY7Zj|+Yn7NGE*P@DcHSZ-)J=LbI<;WdoWG_RF;W}q<*)8r@D=@v^Kj3c>Z0^y zcWXg^^_UpJX{)1Q-;P?x$Io1a4iy|~Xwb3<6TST1R+X6GFfcHDlA0-L$c6q2$z2z7 z{7%C@$nlhOf1xbG^Ei<{HCBP6+#JuUUm85-S~I)@tXy6Y+mIJsz>1YyeRobnYZNC* z8rprI9(_yQhl8{6^MTrt-9!YwV{aoB+8d5PyO z7j8e_?2o(_sQ$cM|7XkryyJ=gNwsb;h2-gH=^w>vUl_eiyFKPUp40d;GM97`v{Nxi zGf#CCsEt36hRhdslj+peoi|pO=V}PPCZ4$TRYz`lXOHh#@i_xx&4Hjj6sLc9LvCqd zEVJt4%l%T@it!@p^@n#Zaq&JqJEeHgD9YeU|Nhw86s{IN68O$kl{Ag#P>b})DR%}r z#cvYq*nQ)X-(}!3k~{dJM~lWDsePZa^Eta4LixsCh_C1CxEPEsj)gfHEyzA*_f=NouaQFmdY?iqfEuvDkZFP@S7V_U7g|xFn}PSH0M(D#p?G(N21PTZDu6B!NpDaGA@-+4Q8Gx! zI5Q;PSu#&ivIeisdfS?lOhc>Z+%}U(as;cRz&%j0dvPOaCEBMhAV?*F_(f!8L`2Cb zZnjIm-t=+*>elY$u9UgMK}?{X7@FMWE}Q)9F_phSN=^Pxx6adBpX*BbsRd0n%~$ms zxbsLj>Z8izZB3cgS2mnIDKmD|m+F|#FY>eo;@=LbgYVmc2pY4I@#kQ;NxO8I>aY+j zlh-cmr10I*UD?XxH0*4EZO)DTIKl9EnC7iCoAns@s>5(^?ao!B4sZGOHG zKOIi7RI9$C{80c#mNtKwyVZihPbM87ZDQG;>g8O!Jqtt^ycKuOr9&b^vbuE zAaL0iSjm+np10#f$16p!`l1HF_mf3a79pdE|8#etZg6+9wNoCsz0%1MllN^%*AuqC~~P!Kww)WbN)KBIQo>byO{=9CFgrJF}E>e7FO8P1(FsI85f-2znPr z+wOgHctm{HZGW;Jb|}MYhm^bW6nd2V3)S)m2cc_12Ns%sp1>)y}dXqMfB zha(rD6Pc}A6h|bm=~Blzkw~P15{{L0aa@fEP7ySdr}E;k*!316FNU4P3;FZWOu4!yZGIWn!eQh9 zf5Up{ACNm*1v$p+1~?Sys2?BAlzV7IWs>r~cFnh(n#|a2YB=NNz3(C;HTT2%m(5u0 z_Jp|i4OrZ^q+W%BGGm^Kal<2&q8KSRjv<+U{^F=*yM^KN)fAwW)3DgitkGDWc*JJ% z)f5tm0yrb-)L9+p5hM2+>I#SYWh5oUEU?6GbygcG)2m}S$yFm6p+~=S_gBEgG5On= zT}}Yde$Ee3;}IOIgOPz+Tapj>9dd9*@|;%pc3n>CmB{R`!S;w`DlvfRzTaC>|INzR zk7h8(HTUYPv#xG#F&l_&pRxXFo8VC)+tO>dX)hdVWgWN3fa2vFCk*76v7( z^;EC)I6obmd_Y}KjhhQ#QG}4ec}y^5BvJH^)|cq+gw7rha4UK2uEt?oL}7$XG_Up% z0Ah*1#kq<&EnL0ezN5Fh&8IvoiE%@=|G8q1-7VqHOiYHxPt5h$qJVZ-JM2`(uu!yM z3)gChB~s}Gmwis>4;br7966|((9dUBS&sFik>2xgpnS!HVP?j$@(?L;+<%!^PCmA^ z*A!;XZtW6Keb5CUeTMJR#5@TQlM1U3vLPrrs{Nof5Wyqc`CTXDbAkN`)sf?|zsIYO z>C5EoM6wLvVad))_;$PN1f!O7bPDzJZF=DDuac{>475aY1O;A)xF>@WB{Vaidb$rb zk6P&D2;wOd&d2SILgw@UcYxw18ArVGu%$q?Ef~Igd*E4~kOvAU%PR6+`@q1JO@52R zu=`X&^ku=8I;#n$D@!z*(jCsuZztGs9{$-)pa0jpDbfNA9lNlkz~B-JFUIjCNZG>r z(34-wycyjc5Xm_+%Ukm8(%74P zohTvlB6Rs+xdlay$9|ENgvZ|Nno+niEyFyJ*Rw*m=rt^EKOIh|gk~vaQSRJ3DR%eJ z%HtvgmIu^UCqku?(=F36x;qHMKw_N@I_Di0hG_xkAf>#>k%Gz8h4WggB^ONld2<}z z*z~N-(>eg&y*iAk`}<4_|I25}jKjxVhgVB=3fB;xa9t3!z|!)hLXx-xmY55*eBIpK z4;~Gx&G1XCOa$j@20GXRsu&~&O9qmDN|} zFc+IYB;@#AFD6ixHJsgHWTe`qC%%%?;`0^Mn8RN~a(x<3n_}yJc5)$g>{+j8XDvpaU#T7omK)1zFWAZ{EDQDD4P<#+kcg zGWOH$7x$CVO7EF4wOqr0fLr(6}PsFF1yio!NKnEA`jg<6L!k z9vcItTu_qF5DDFCKLoEb=}onCXS7KqHye2hJ1#f$w%AN^K@4>xyp+l@fi{R96PpLj zz?<6`OUZy|s0c+%@tMv(OiP~UYJ&Yq7bxL?JILea#609umphxB*_?Rc!80rcw{qu7 zz+HB7byO)F4IB`|q!dCe;duLNTv2Qk`u_W?$n2Jwcd8n@Bs6E3)qHf3@lk^SOU}+r zv6#kux;U$X8LDxUfXSa`cgd3_T^@liXc8Oc#JJc)a0I*&u>CfM!G+35&AkN?qB8>n&%xB4eRgD5? z=Y9R-kM`+GIQ--9Sz`}1=K6na>-g1^A48~u?dQK03BQ0MR*K(y6l<4}zyGVdZWWpk z%kw|Drl1JDvId;<%{SPLUk{7jr0n-bP&VNE0@d`YW{}$ZmkS zaAWzy#K9H#>memeth55x!Tt(;T`WQ;Un%M2{tce?pZa|RZaa<_HrN&wulfGt2K|R^ z?EmK*kWS!*yuVPM^*^^Z=#DQTX^AwACgDF}co4Xedl0z6_d9T7hsnhWw@9;R-(x50 z0ny|4@hsP8S!9JQ(lvxwe#Ad$?v{x-8;!<1=2MU03}C$xn6AMh8!dP?`pUhf+TK}@ z*08e-y|3D;*Q6HR42yE6lD3VutBgn8LaP_UDnxLJm_23U@m*_0ma1#cJUQASc4BL; zC^W5#g$@2f>@W;|%Y@-Gvu_BQ$_Z&w&RD{6k0kIQV?>bB33lZ1hUM?ML>U*Xh`us= z9>OJ39KQ7`Z`?oO0uPS=;SH zt1Y6V4Sd1SuLUf;nqvIyJO@Q{k1lZrYPp;_7>mB`=nKD>`M5NWP5H!>{d3)G(>BdS z2fv%h2UE9hg*Q5PwCmOJ5VN$}h1uVqjITQuBv7LUq)xf>s^!=BQBAGhXZQDiv`P1! zbQ(^JkEh8}PSgRAu?KjxA^_-e;h?0Ga(yXz>&KQC9^v4AGQ>6C`}QdhsL;7Vt748| zY(tm#8D8?z0jh)BwuAq&BQS*mMqyIG%|fm)Tnp}G%}RAm=DlR}tk_I()v4cK^$jK1 zJ&A z={JmwJH-u9d$-^^c>Z1o&4v3VQhOU_z*>qf97=xhjkX0QD7nwuU+X4hay2nmZ?u6} zs~#9nhD>Iv&*e@g@KIN9Fz-9K-#OG{@*j6U)wO>PCqMZ7<3v%Oi+uz&ebm`@EObqm zJU;gb+KXPt$3IS#Edvd_F!a{@l*XwtIAB5>FTd6uCcT$Sd+ugKb0xfnF;ufr~bPO_q<}X7^7>{QRy%@K{^H$3g(J0o|$o_%b)!fSEWcjl`9yV7=JCx>I7Noa9!@V$9TK$HNp(V9<} z^<^nhLmrvo`mkNtu33!;%pQ|m?bh6amEo}5NL_Gev_{;3rov^NymU9^j~2k@q?D^3 ztk?>(_^iE1F4ZDP=7h<2_HWQf6nlKsaV#iru);dTU_9yh*KN%HtCz$CloUuXr2Ezk z*NxVsD`2SW1b#T0RqlxOU^xalu_)rlQd`q(Zad3O<|G+N$|xDkT9c-^^LqIaoyh;k z+k1yKovmxbim0H2pa_CUv4GN%P^5zel-`jpE%YKK)PN|0B7#Z{Efnb`AWgc0fI=wJ zJ19~^Q921B-wLp2e{;@uhV!25egAW=Yy7#g)>H1M-H#oe!P`Tc%5*d!<$Q^#0^L9> zoR@Cw%Nuyj-SXk37VXgX;B*>p(1J!%yH)Az0W$4xR)J@AQ+ zg;Wpl1(tZ?7dB{ax!;oARRn1k#eGePX?tpQ;UwNor)gKFo)t^K)<2I4Wyq2B5)KKI zW;rUkv#oGi_UJpevoFEH0`!S@xMTXycler?&!n4EWg}$OfsWZ<`b6;pp36j&MNIB1 z@wb0I3U0%Z@1Jjj%KC6!=G~JJ-&aS;QXdaX*vJ7J#}CnUFtci34M!fXx> z!Qvh^2+W8-)k&w+$x(xS;U&sCANi)Q{kS*WMD$$BL$1|6L&n{UX6Yn(PA?01rWDJx zs?`xi<~={?T`t3|Lc$&u9Wsf4Ts*RC9dF+RSL&{Hpzq00rqw#S{`O#Oa zQo-o0?z`s`vNm-wrz<8y_2x!#>~8iWw>kX`(ns+@GZk?TC8&W~M^tQIxds^G>6m%G z#O~<-`1KTY`w=;n?9p74h!@}zuFw!~MeOB4ZiS_=E)#TGU_L#kCKrV?hgjETe8hWM zuZLLMbfsl1X7$}2@*B#ITC-tyixoI8HF?>h;!2T_KhDKzO04|Dw*?J{lE8B`Q0 zVaZc1VG`e1E3UY8lD4zIOsd#ob*@u;j7#_J1{7}nB<*^A5XeQfFQ8MzJy$R_SS3w- zTjhf7xmLnWxHs&bF%FIsf>%2wN^XD0Xw+q122_X2+;g@q=`Xz&BXzV=H0c-mYm|5? z8Q)qc)J7@Ct2S`-Wt+8+Hpk4q=?WEr?+C*JHC|M>&w^f)-pwyv0P}F&`#S_qfR_U?BIY}f}W7(;;^RxHg5w|h34*RKzt7YnJ4KNke3BA|K{-_ zVZBAe#(y^bm$<1IWUDvU8P1E$>#o74j%tvy!u^J8na<`g7)(_T7HRcO-lTXaq~ zC=9C3{;-s#@Tkg|YD>%t!ky|?60{k7lw-DXyx0UUS~Az)%7mRchwK8^q)A9d#lsY- zZy@YPEs>diOH3T9na_lF-YM%u)TrN*Q+c%|akjGI)2B>$xaeTH_jqz!scRa$}%+voV_Y^ zgvDHJ2s`le%c~RF5BntMu>IkspX!4sv$RX(D{kD9tro_$fZz7x!&RXW`Pckuq0C}z zMeQbLY;(b#77KKcjOv`^BiO|CSH~%s&1xO$GC_69Z+PLYcC8@rE(!FOi=pyAb(*eEciOP)?H_K1-%8jG-k>p%Ns1>%XMpnFwPh{SzV02$=W_J4?pjmvM9KVS# z%b-ZD*>SF6TIwBb8$HjzEC|1`#$7FLp2T77@&qd(JRIusee;hBc7>va0v zl?s)x#g3m39TQ>qYVQs~Y6v6&YC9XxP7pohmEG4JI*@ygzaZNXC<8?nwmT1QV!TSc zl1jNJ+PpDYW?@F_wXIy)jx|_y;bG@Eir`Ts|Gi4scD|+Y`5aDE_E{9)Tp4#<_dBCJ zLao85YnpPn>_S|3Pen$ov){G8NBwRwJcAtV)z zLI06XIqIoF5nEQ;o{fbMIRYt3sv)e~f>}%h9V0C@#tMmaI}ztZ82WX6Vo3|2Nsu-x zSscC`+Jb&GH~cQy`A2h}3~#7fC7av)MxzQMJ$JzQQ+2+3A58C^l|RLRVt-@chcDo1 z<0*IJ52F)AhfI4QhkP|i?e*xniOW<106ZnRg?R0X#wDWSryfW&{x2i9?Xx#rH=jY# zczOM@B~?Ym5agZ2wC_|kd?X8YbRyr~n(p8t;Z#PMv0 zV2Ysq2r;yX#Y;}cZ)9QbS}t(|hi7flNcrxNiRP%H3B%H{1oho7|r8KPv`@efyMN>NAiQnMJ0O z%OK*qNDIQ%>hk@-Ws_Z+Zqm{?v)OO&Z0&?oIKzv0w2}veZl5=uH`-8+6{t z+;xM6LmYtE=ZU@8&!dY^D`% zGV|iy&h7oZ|A%MeIgbu;{yI@j&bk-uvT8EFnY*#tSH1E-kR7tr?fH{hTfBRp*cvmb z<$PPah~JC)5AwjOmRQE z+Bd@VuSh6B?KLfQn+1epN6WptLy4i}eWFvG+7BhiGd>`3>$bhyX@fN`Wu~U4+g!_k zXia{O(t5dABd98jtM@CX2`5y7rL+?5#MNgJi~Yt?^gD&i1+}4T`)5=Sz5p`semKu;tA&k|N8WC z!v1B%t2>aa_O-TGF&z9dq+fxFpuWZF0cox2%X@N=5GIJiqYmNSq&W9*(}C>7ZLtpB z)rAw>JB!ExUCW_-9vwZc=4jDL*01?^1Hl!%)5-l8lN7t;=L%ko?tgH|;v@yhMWXhQzgNC7T8`z8cQvbDKTpQR#@1TQA zD9dLskY&5EVwaS?a(XYf+SU}?x1$5>ACl&Opn%%>_&XRO2d$SFPIk9!&0XW2u82%^ zP7BVu`?1PDJI=Iz|C~=JxSoxwfozudu2Vcf!r>8;1b6B}_wgdynRW@>S(o{kUB{!q z4^@3pA^7)>2c%ROg|%Pqr&N5lx1uX%KoEYFL|5Vt(cqE=XcLvH_fMsIlt5o%l4CPW zRfSLs&uCZkgvxGtnzH(5?`5{HI0fHcrJ6;F@&3yMA0&Syb@cJ}aN0kKCowZJa{@T= zK4kUo+2Uo1XX_&Q(?>qOFhg1nlWISfEy}#-5|(^&J-JOZue2TZmA#bQ9J32Lo&&!T z88bM4l9&u*F#?XZ;l*q&Z{1#KMDz*AMS)L9ZW!a1y4nW3LXP~FdPWt`U!d17p-a&jNs5XCa-7Tx5ur;OG#?Y=Z|qdD8yr2R(P zDgT5(EET}veO><-Di`O+qpu30VO-} z?}*|n4FDziQr^V$7!~;AXOR!BHn;E7pFK<}PIbS0{aoJAdo96y)LSs>>Zz)>tq{Wx z4{eU*NWXM+rIDaib;h4`zZ`KUlj0tX4vQJ}I^b{oFVcLRrlB@qUz#Tf$Bdp!lbqPI zG35QhS47U@-5kaK%==Lp0&qBkEpi7>dkFmTS^SaVT-ks~nbXoAjvN+)*br^@MGr_S zn+h^@86C1b&Ltnqy7#$zE4laHr>55~M(qO(0Fzt+hDgD*kM8FC0i19?QN@i=wQ;!S@>{uopC8&NrY zz}xzI%9R#gdGkfBzOVB0oR&!K$mKL;Ps3tcDa)@_EZzG~C{rc$_Kh1@Oz6K;9e>FQ z1LS#W`jBwWX%h=oQmUWQEQ9{1Od^h7JG5>c39O5$s1EZH`U?dvzKK6htjJyQk`B z3TW;*UjteIJK(#*pxuFa*$;31gvu%c}LhnKw5{-a;m3f~@@Md8>V{h46=TdmuJl@q{3)$GDbnLEFD zO_~9$)Y*fT1mR!uq-XB#*&2l;p(_I>!0uxXC<60hPO8jky(FoPc@1=-8I$H&!Wo_~ zF*4k9y&(h!q841+!%D0VIN$tG1zNChz;~TTXHw{EO$3g&hQx{kHvoY&KPkFq9ku_t z)*`lVp|Lv^`u{HT{JqjIyF~vlC2bE1Q0l3WhwfQG} z;q6VTzlFC%==QggwhwKS)*{CDA6;bm>Q-5o@rK5sgK6D|=8{^gkw##m;H+uNkqBccZoq#}UjVd~+u6}K=Gsxl2-$soT^okg{Xw72q0WM`8S%1DvPtj% z`L763ggV9L3Wzr(06}5!^XIP%&2JH*i!{qKVgh0Qyx?vE;oLa1r~2ccV*MYQCcHrN zfGe1BN2mr<5dZ!me-;2bj~3c?hY<0w!J{~>jbndX^9Ab#JHc>{`Av4AT@*t4_!@9Z zpYqip;P+BF1IsnS@NYNFLiOK@g&BY^^Z2O?s$hO_w& zv`5;h{`4jPp=c-pmP`#+x}y}YH3aV6G!?Pr*)M2AEdSi(0T=E4FASG!utk{uA3g?Xv@C|>U0ZqU_f@z2k~*LVYl7R_(L@ODdpy4@~dCnHq@Sn8Q!DwHUDKS+G& zzKuTEeJ1~c6EUE#XOn#J*VI{dPiMo3`Acb^<8=pYMv^bMEfodX*AQ@@%G?^>{*sRr z)49;_b)>T7owC`aovKcGoN%cz!L|!(&#;nxiVLT9HI!Lrur8WiC;V8mlUBI~S*y2u z%}UKWFHT1EVO@=oQjJgZKtX;dEswczrQ7CR#<1sVH9?}Es@)CyT4D(=zzS zoKxS8s$Dj+7p+=6XFoG!%*qz}q7S38kut*E+L1pCaocLCcU4>dvCfK%@=4`xr_}lN z>+;%kJZ~EoZ$8`ENa1a@Ai5C0oWCD>X*0I6oWr?tdazvt6DI* zYzvqN_><2v>|zBHnX@4KXWExZ50sg#96;PfioFaYS&pe(2a#J3&W{w!pRT*I>$UV==bc46d>f)B4O*F?VaFoKwx}6Htpv98cQk z7#Z&=KkHj*Eyq@S8Z6`oHkh`pBTG*)rx}2F-)!>46!J4+Wi2wN*rK0oa-my$Rw25( zra_^2ZSpI}ug3d0JhfcdTt*;wgt)yPjo$)tW@7VoZOL{UPSdoGjv+SQ7Lwd&Tx;ia zA{9+{4)6!8NqEhECq!zsVclG}QMJVtp8AuR!RtI8VtpG*d6kl}$<-%mXFIi9BTB8l z`GrE*WWA?&I+h%3Q!m{*HXzL*6v83mdDFnjbu~%1;Bl@3hhxGlU%I9PeX87`3!WNa&$`&=hjxoq03Yr7% zG#E3|%N3T6+>%e&P-h@P@Y!IVsR`v?>#kj5H(=A0M?fk&X)6@3O;)Mqu6g-=q* z&&$4r>E%=z(gsB}v?R=LJ8RwNdb=0hkkXN${sC)fpw>Fhh7%`IV#m8PSfCb%^#0fz z!Qt*e=qTJ!4&d}bl^~O48G=BzAN{Oop!aN-(a={BZrinzz(VVeH0bZTygz+QM+vJH{Su$8^}PiM{`R)vy;;2CI=$ zs;&JM#lw7kH6rbVy9zQZVaeCZQkI56tghE*8CJT4!gOkEF)!pxL4C4QD+#JK4hgQ? zOQ}NR{DA{Ywfa)-^Z6~tOkRx$H3l4oCYC=fveNT1#&iCIjCZ`BBf&5yu2lQ^y@?2Z z1=>7^9;5O&Ai96z@|5Ri!v~femA*cYF>CIbIgDSnVrD?cd}y9;5?9Fj zkUFyFlCjv_RZ|jbH<)`wimR;XmEw3r>S(pR#teVu?FWcijfp5cuKbqHq(@Syx^b+& z?U0)`f_`aesUc8p05h6Xy+WJa0Z|#Cmxi*}Ng&&`l4Vo|V&~Dhm2;Ws3}%~+;;<6; zUuPJ`wv?t=Q05b@rSrt4eem(-U0|)uyl^OK*g(-juF-I%OlD?wlqpUhAbkJE7h% zZz48oK?|GeKHt}B$JbS6ZrwG=$3aLPSsmguv*)uivW3PW5PH$I{9KD3iuYqmRb?z{ zmmF{~)Ousf z*fESfD(#@SpCF-Sx2gbJ4@1yIq)Yqa^dLt#ET4!r-~Yvt=P;n$AWKnp__gk_#lEYF z+RvYxt!Y%VacnKd!Hz{Dw9IeD(zr_{z0tTji&Ba!E*xX2G%%Ql-sFZ*e-_`cfwzxx zY_&10>$8RMe~i*);xp@M7MkIYBiAXd75XBX$_|4R`32Vs>3L7{7Pp+Go#|PLFdGv1 zDU$Zt=lM>2rSwtnwc_>)QBSe14a)8JH@&CY%G!hZFB)ZSjJ|UegU!6s?zMiau5p!p zs$F7m`8y|vz|SuPbO`^Le$U%T!!|yp9iR2;px*qhb)B(Sv&c7wZ)<(Gw4NdtP%qTe zx&tNgDuvJUz6Pj$>3m!IQM2&+WxH1vpn&n`n&Cxk zLl+t{350o6!A@?#!u!3{ctHZ?bGSHY<`V~l9oTO{%m;`MsI>hd5)hlEx(1;D4#}O! z_k0|d^(-b8trD9Ev(68iX`?ZJgw--0}WG1SE(ZDsz4ec-NgmbcaOFJ<<%n}BeN~vrG zW;=&lIZ~E>4$+sY=CiKubS)Y(`@DT3m8b3BG)O^Goz45^rtBx6FA)f}#+HElK%f*ZEhhfT zN*IaAxMkZgKVtc$R-IXKr&d>6iK)2#jeHbOUg*M*WAr>OL+0vgJ-7Q@FuS9bPZZh& zf1P~t;nr>=X0kZ@nO{jD%7+1dj1sVf=3p)mw0alfaV21!SxEExH-&jfs%brP!Lcgs z0_8Aj-hIqXp3Wk%yg1!L%pzM)R|L~n0tr-nWS+>WxjB##k>5Wlbe3Ic?hfNXsiA)0 z%L0W)iyU}{@&%EUge4`7itl$KGj0vNr~35X5de3&QU{GGeFx1@(T#p>JKx2ljC!~t zenZ21<*|bAlAqBJb;oR_GtAFtxQ#IN&`>wc&g72}$WzfV0Pz>K2k;Z@qrMcG65(>R1^ZP z4GwJaxOVJnb>0tp{(gk|l!yj&4B?m!MKV}GkY-JGGaAmzq-p4#_7xd4SGE>KY>xC& zP-OBpp*RI5LF2VgT%?;=eNawXa#)3c}d#3beoHm+AikUNRR(gO<(%Qdd=0RAJ+$Tq0nK+)TSYX0XpPF zuOs?eDEM&FP@eKwIqo3#$;2R9b?Q0SZHJgkDR*~f9Zl6fW!QM53hYuF{( zyX2^>w!AtUxwfuPQ{-5?vuR$MAOhR|AY<>fcodJvEy*VcqfUr-_5|L8LL(4(C`o?x zi<-{fXxXgI{%9JP@kc@wbh)=|eYLa2%Oh(o`)=SE!!vC9aLfaITyBX9Kz13@cy%9J z{wJUbhS1j5`iy@YR1fD?2=CXGb4l1j)u9A@**fo* z?2u8MRWusX{!;$LkTHXh&8=FQW{_XyH*_fhX7VP89cJ4_T%d=3YTb@qNfS~{~gcGniiG=raTn~7OO@iG3<94K%Y(p>z?iT6SAGXrYe1s zmaE`Ek*xqoTIjK@On&z;o<<|Gy>KjD5Ezv6~ZN2gnEQ4rnonX9h9*-Us8u@A#qUOh9_?;gTd5 zdO;0Ljjv9{If8)=Ll}EHVA#k6TPq$4N)onLyuLj>R}5xRB6$q;Kwqp5Se{WOa_qz} zoju`NDJ%Mz8M0Hckp(!uVukEu50a`QLw>-nVcalzWrK(20A0ZTyOzs@W9gA4X+7G{1GpvO5Y;Uc&0YallZhh?| z$4_;;^%-W&4-|1~q$~1Yj2^J*&NMla0%mCk5judWt;|1qYy2k|Rx2RD8)$Sg0sW2_ zb~eMlb&9U(B?FOZ661fIsRQi75%gR(PXqBLAl)c}q@iuS!3rxd6m12T9$^6?p6hH{ z^x%Ymulw-BAjUWf|DyeQjd;WT#+;#Tyva_!fZy?V2fIQxSK{V)u+)YC-sK*QtwW9( z{ua=J3_NHiRR{C|y$fYy`A<)t8~o77rD0jevU1gLXB)dd8a*c89A- zW`Pmz!K9|Dc2YGzVEzCNjRhqa=ob8SA~nBu$BWyrqC3=*gqivo9?U=SU(^B-;3`0( zgQ{PA+R^F&aJOma8(0&-WPfv@?i3t4#^zcvn;tjs4dy)TF!1#O%LQkjtB!0jwqUp! zEL$@>d&>C=m3aRF3WQ2ACLdF}dro8_9eGVieK9s?rEUv`ohXjJy z5cr#9>A&szA^%UOpC#bU>n>5BM@+8x?rd4&9>E|-X0mhg)d71=4_FRp0a8p9=LI@A zQB^5mD1A^@CE5^%sBoQ40onJtSlj%s(Z;@6WusmSV79vGTR3@+q6e7tT6|wH<5PF7 zNQL?mqT{o8{Vdpl2PhA4^L820Mqc*-eOR9*5)Q4;1oLf!x@v$jt=I%X9s=gF(=VT-x2GG6W0XCS}dqi>S@E|O2Bj`2Q>>#v_ z4ON7n-|E-brmDf>vqH0?i%vp&h03s^79~(p-$J;@`9(a~@rC@eahGO!NQ$mq7W()V z^yx%^@DG8w3o`wMAG-k+uiYc_n`{toA_Ez$S2I=ir7KXXK~x+d*m5O>oS6)zzoyjnpXU*JiQc%S$DvW@#BlXl$ z5%_U~2dKcj@*rXRaNWNdn7CD7wT3LY5!2!bdYLH^MQE>Td!oczzggITrMRHur~%-& z{R$>vbEgx%+azr{z<)l3qyhp`rVZYv);I8}Ep@h6qFYC*x}K^{(W?WIFFrn+a_8hr zMzP*Nb11Y6aJ$aCq@wM(S43CrI3S!Yr1#ivKp>Hd_EUn;-f;4M^qa>-dW;cw(ELl0 zs+hnQ&ky)1fR7M*#SbY%L)R^RgW?tv+(!#d;uaq`2t$#q9C6WaYXRc@glZ2l=~Sw^&qk9|SM@Iw*-i^OF}Tr;U=I+4kBu;VkS+LSF@ z0DpTRf3lh#okipQTHk8JWk!Zn!A;a%g9IXy-NxV> z1FEg08f>a_fP8VW2InAlvV~L&N-tfch$JsJt!INAX}*DAB?Gz$ozetGc7f}9Q9LsP zi6!-(^S)6zOge*#Lwc5N1)T)@yVL*|Qt5zSo!KT)(hJ_fIZLZvCLvLK%(FLZRdci$(N2JLE;PU7<;YXL_J#XgIkw(C2J& zYPM^Rqg7rDC4KWDSzY#0gzX~5XKPEX;^AKcOrh4|z+iGk_NB^E_MnW%YPz|&J?bfh zKckEJTUHTHpT&zf)(@`$W|p${y5I!*NWebxe!ysI4SIpv2*J9I{uQVDfZ2C5*{~S} zUq`vD`B3h4QY2_7GR zSNQw?`?7K3TqMd;Gu~t0(tUU1i1$vZU4#p^YY4Qn2>kA3|E^X^vv`0y_D2jo&DF%c zhOB6hgcH+=p#Q_T^-b;+{geN5I1dbj05H{w)HBLo_Qw6y&VZJ`GvbxRnG~uUV00{J z(en6SOQ$Kh55)FqRGVJn{Yo<_GE(KFy1X>Ep1d>?oifLxxZQk7%^JjN4OII>wes|| zz|cw50itYEa!?&@Z#z=4?RS*gHhTWJ{|B;M!%~@O^V%3bj>Do;yNOR$>633(slfH) z`;5Hvz_QV6MOV20snU0s3j`OR-aw^@wLtmz`3T!5!lNFyh+FBNo}fA7Fiv{@OZNt# z9vHxK=;X&sr}BsJk{HBQxPPy}t6o*QtrI(`VO(7T((KdP=EWz+{AZdd}z>TKR&kVUm-sLBOy>sB#5132^R2`)+0Lbb&!t!K>Vv0;6L?%e3BankhBwQjn0u{^1Kb~W|;SjEy9%X+Bse$10r)=UfF2& zm>WOhtRT~IkWWdQE7={1XJ^6yAI6!aNYN>%!Z3#IbIJplHDg{W(EAy>zWr17B z0ffg!iH_iZQUk(T6<O24$6|ecirqzisDGor# zxNeM(vrGY@Qj?_LTR=l`Uf3ZXeMSp}52Z!)Y$}O%(T}lM3~C|h9RLnROO?P^u8u#U z988)80IHZ^D@n#*#Ddm-d-t^cNQD-l^4_8B2bK38ut=gO-*Bico=89*38>&IYk~SV z`@FIjg38|85UNrbM=&)`-4))IUJ=~HjSl=6_eai+hJ4*s*ZsiNxc_37*METSYC zCsTd4=!KoNzN27sv}5!Kh{6xIrBOq$4MPKERIQn=NMEUG1iXJF zfDK}|tiQZr1%T;|VQe${54!870eG{-1b(m_nSmBT>4RSO0t_N01pZnerm(d3@H;(^#n({wchS~UY=+t z`>{f$rzdIE#+nkfCr{`!Er2}vi|*=;TZ2^=;fWsak$M6SlZKF-o+?@QVLgozF$q&! zh0lC88_boOi-Vob5!b^j+`aA#+IGLgd3ZS)w;KL@8oCX?&H5s`J9UJqkI)=ZGzL+~ zQ;HXtIT9qE_9W<(%~U0FHuyVhwTnXVQM_2l@~q`B+E>62%;T6?a(ucP0)(Je0MPA{ zI;M#P@wyHbTZgkL$6MXnhS>8=G?nE;7R*+rT1zF1#0Q=_e9a}?w3Xa~zs{Gs-naz7 z4BoH>_KgI}Hg$_q;>zzV8r9qP!u{g?{ag&60;SbY18RR1z&K_AR1K(1Juz89%|I-g z&5=V9qHZ>o=85FbiD(2tSq!AkVayDA82?M_0Gybm%!+ZM@)6fgH#x5B0P?F=q?9qBpplxq zHMSX`Hg!aNWx54Ln`x5c)%;o_gCYqE-+2zmK$4FlxwLz^1_aDEi_S~h#PED^eZDii zk`Zmv9jH`0haJk!G{dx=CQsGQ)6F`+F`Ua0ng3OPVysZYYOpl9CPqq*RUtw>3awk> z^vj1qyEU%7p9j^u`4J21RUmdP@gqpqT?_MlxD8%o&2k$=sw>GpSA<;ft{3CB;FeLR zszI)#4ZD7lQL08T!P-XyNsdJ?&7B-c(ZW6L#Vu_-P4-=(6hn_C+nwWa!Y!16fLs~o zsrsLL(dsf^3CGmmVtGu$M#taoas6-v`BPwYED1*ow|+LFP0s@s8$;7}uBJY)sDnWs zp{oXEuK@wyEbx{khr2Y}k{9-uOta5DC`QPv*R}d*^9rbEl7BnjXPYg=Jvj6#OQxkF zBi=;gs!tMZM2}N${Q~yq0=@ie@u#uH`Ka=fwH=?XJLU{W>dcM?mI!QSO$+|q%CH}A zLT8fgyh@zzAe>6|*`^l`Iy=TUCr&A)X5;{U9C}_*p4o5vVaoiHkNbCT__Vip6_fu- zn)ef-V)I2KXu+fZ86KHver7;_yGUhnctt#&2!{YEW9Q?eC+$9)L)k$|xsC_r4iaye zv}mJuEgOhe*?>t4)*GRFEE}+iuRmd;25p6E8>8Ni!$tDIwlU&RD@rUDk2C!op&|WF zEk5sUqiQP_D=_9!2x8h`zSEyDO6>EQR-nNfAGTq#SmuYS(J#134>1=< zT~{zxlb!NZ))@8E7anuUvFWRlb05{lMDS&+eypp=S+v(Hawzd~^Q&`4jHA)6Uhp4R z@WozfHoaN-BwHskU4|TDZ)~}7;~kzizVsMjiq6{FiawTO^{u6+!c%NSJ+C5x9kvW> z!k5`JsI&;$FDoKqLy~KI7WX; zAqu0o4YI&;p~fEivFl@rqW35_W_=qiurNZQ{)TXV-jHKnmdO*NcR}52h03uzUj*Rz zE&c_mg7#j6Dl76x9$i^x-|a-vH9M5H(om**n50l{#lmQuR>^XSm&>peWYAQ&sN00_ zQN;$0Np-c4#4MmQ!-eaB8af$`@2Vk|Ubu+MtSl)|4Ujf=SVS8_{Zs(u)C@`G+43@k zKEvR1+lx%o_gy3{(S>X3Zge z$+wP!ME8zVyF1+tr=(z7ZkrAFQa%pDL07%CR_u+8&d3*-j&Ha02=#2>AG$nKBU@sp zYEF{czhGw)fnZ&&PtjUWql7u|6uFKLp_IXjr<}nL8St`R*cYjy)iJ>yPV1E@CB5wd zVHhl80KJlkUiJWk{L_%B^195lF<<-o>@NH8MrCb;x=!|3($(Szzr=9{xga&q$u^Y< zHc`Gk3{R9W16?YCZc8I~m=*on+miTOm>PL-=PG&YGD!)qU73E4nM9~aO%VI8LDj)B z>>)^^4;Gj_0SVcxcoCPuG;y#yd&y_}HB*u=9t#MLYs=b~J;(izoA1ax+DiBWV8^*k zt(+*s#lC-1v4EpQ+BlG3wgI&P`2^7tcwhwiYYxrK2OD;YlieUIt(9+}3ph$kjTrz^ zqzFYj!=c9_2S820g*aXSXuT)aOP~-)I=a()>WDK0(})h>XI73&$_5Z- zZVXfc!g}ZX=Ev+TPo|n8v(Ad$EfLF}i>4ryDUQW^7WGsan)Oto{1ZKwk(3Rsuu?#? za(&3vItx)G)!QvBsrl5IW}zqs4M{jJ)uE`e#*~y@rrjNt7pFp=nxFHqM95*(Ngj02 znk90EV5cfs=eBMOYt?224wh~6$(u3UX0}A0t5e*`ycj zs37vN0b<~de8m;Yql$2l;3JX&aD30&-?D`XXcFl*bohSC}mVuu0 z_qdj?7pczrhu3G8jY+zRlm&dj4FR(`yGSmz=3{DRMhscl4dLz&HBVH;AkE?%&Eg8#i`8rPR+c-7A|tYN zk*_Rabs=sQd>kgSl7dd5KiWNR_FzQY-anj}=lTj#Rv#r-@{}I_Hoh-b>wQx?bQm5Qy zO1mM40~6j3{meBf>^Nm=fqwNhkl%Y_p%6IjzS!wYhPqhrv#KH-s;p8R8I|g$lunv|ft!+#GX(rNJ7k`6oEWd=b-?BY;*Jya(W6> zl0Qh1Y>c=g(Vels%QyhJ@_Zs9PD*lV92k|E^eRFrg{ALUp`p%M&a4b1ojKCqyp*F% zv!i#cbX)E{tkqk<{KLsb457I=s1*zEsDNREZ}ae7GRy!B>E(+~CM1AIu@>F=@po4+UjJ+t^B?lpAXP3? zMDpGyvbaT!m0nYr;%ZLh4l)gGnDNt6m<>?2YS6LuVGkF*$wl>rkK>bFhJ?Tv3I%xW zvJ!YNp!`VO=DJ^l;tt5v@6Lz(mpK>75VGC7rXo`WeNIK@iDl+dA8fa!A>3P2oH#Vc z${4Uq(pOJEdk-|c?ljI9KIsi7?<1GJIbKH!suY&Ua~4p!|J)$()8zIpe0?PSpe_^a zkC;hQU3Hb1o98fAt147e?->K{- z-=!ZEQ$MMsAMpjd9P;-7b3_f)98A0`yI=V(gI1t=mMIPJ6_KFy%kNx|58dhIV=f+K zVE(5;N`Sf*IXZfhn1y3=g1DdV>t1VN{FG2$U`7x72PK4}2C zNmTvifmrI(0i2?grbdsYZyyDl%~FWy0<5J7o$;l+u-ANX7i6#R$VWZgg)KbyA5mWB zi3t_H^ho;9(Hca_O>Y=e$0UK1?!z2Az5i$M8(HH~yI+lVN_cRElt(cM@I`|H!SA~p z{ybX-8DR9f$>IbB3C#d8u|1C0e~C3{S?Me3Gs=Os#v1k?s@k32KjeRnNXS@zc%F%P z*6~^}Z}U;tf0vt+kAvMU&P>7>d~1b9Yz6aIB>`1)Re+0so7w$ScyHVRuSZSd4*~xW z>+rz0zlaf72pS1e#$3P4ZTu;whfK~+A0qh${95o;O>v{C-LEt}iHT;RQu7CVu&Mw% z{&vplU~&XVV6|#|JpWmu$x?3|r+StFlukVP`!D`Ijb{2(Me6_TM6vylHekWkiW9QG zRKa{~cluwNMV*-XePdxjRCE86w7`O#OrLlOhS{VKC(_e=NLO=C0W!jRq2#ac4)O#X zfYJY-W%6&|ol(?P_4ygrZcw5>$?(X1zoWteJnJ>#MIRY#? z0a^F8x?|&p`$r=Fugw$>Hg^A$Kr>!X)^-B0AIpO;-OC!ffY}0CpMdH|7%%-rJ7z|! zE5T;o-*$QZsU6@me{SWj z6u>fX@jIajwK+Pqa>Wn6il>2TN%s*WeHHOx6?TpE;xWP^&avB4+A(j(GxD89Yd(xy zEL*Lb?IBzE7+j-Xt~P0*)=}eYT{PxP6E??mOMV@9y~$KyyxiA|km|lrgUY|Jbp&@x zdojM8+I;LqjZvmd`$pfOn{9-M3+;$;Wj>S5nBmk?8j-Mc>-3Yg#p4>qxb_i_SEwXW z@&0=yi|>OVqL0DVkOyJ@dL08r8O}dGUp&YY)dZ>$y)t)64rq~r+0HAVKudnu`a*Kr z828ulj6@xfE?XOZ(LNKm6lL{oo>e}Pt9(wNT;Ez9tazuC$^yCFY>hBjw(bPa+Wd0n z`us?$ZH|ui6VaFR$Vq_xf|wREzw*{(V{%4WsE-NS52?0`i`=GZ*6J2xR_p}wYe>bXoJ*un&eeTK>`1z`q=Nk%TQTq574?z`>gIkvI5* zGBU1nd;FT}J)b|Z$qu09$bWRI<7fRLPt~MyH;wSeB$AQZC{1FG2=h{~8`XCR#Juv? zugfjWryz@S)PDPEsa|W|_uVyXHMBSk&BjVSTi6UW zs^3icy}RFJ8k(ioYFiAFhQxd^e&;H(^%Z$RO+u}Kqf)}#LTcIB7qcfPVAktJ@FviT zAf(LbU91)O0%9eNw4A6h#xFA1({&fioHTTU>q`9k84fFr93bX1bPSDUA!B&OEcJBf z!3`aSbF=kfV`Y#$)3W?9w|9_~KnkyWNME6@wy5BQGz%jQPznIq3|yPHNY3Re#0xI? z>je|bRG`rF+nVg3-UeJSXoa~7m}n#8P@M^7eWfj*i2GqF^m~emo-^6?Y7--g@N`9D z)^h044?>|kv#R=8zxNwRg<~@BNFJM#M6f)*a`=nP8?qB`T-rpYx!#bTCcnfYbLUO) z;lt!_!XJ_BP~4@W(&SGG*w7rQ#JwYrGJ%yru|v}y-3hac#_;U(l^ccGt(_0e#xA6C z+rn%nrYLL%3ZKvQIbWOJCE^)UBr#eK;3D%bkd#eW^F##PQC4Y{R>! z*zi`~j(K%+wdN&7I+`6EG)i*>in7@V#OqZ%L>f*xtjr}O8$+f!4MdSbzU5kutsWXW zglZehb5HG{U#k1AzU-Vrxo4WErPvHrRonDrQe!>a{YUIJdvjcjX}H#Mg?!5IP+Iz4 zSzS5DL92$-PKdanmf|hyZhp!wu19@zxP4I9u*?Cpd!VA=rMI8RQFLTm*siIjqeJHC zK>c=^ITy2`lixR8n>c=#Y?G}6WDwHszP<^^2H+jvILevv?m=r)V_<^UTSYDt1LO~k zq?;C`w@43@R$Za$L0^Mln$TzXA<1YVr`uBawGCwKa-)D!g2+Hkk@c_PN%=Qdp5wQ% zFEKDgm7`F;R;spJ$@CC&gs7Gc4xxL3SGUvr{B;Bd@$S6ggx#fgrl_Y5Kfp6VN#jyeZJY7&h!go&Ue|>hnWGBu4trIp&cvEH``mp z-GgprF&kWVZ?uBWkh}gVJSl>xnWa1<0Ur}AWqfl|UQ0DHSSyl6<|cz|$zr$Sard1wUQCe6 z8ElE|d12>H#MWSJ;!+nApzaK0P-s+ur>13+5&(HGF zSjl?`=H@dOLr!D~yMMcIUYOsM&h4k)@$MWKX02Q`p-#TJ2It5~K9f3c(TzMl$W)ct z!gTBX%>R$Q_l$~a%i2a2MMXqWL=Xw0f=JFtMo>`6S+b-egMxtMAc6tJKq@jKSwJ$9 z1rdQFXAlYlIh2x9!8doo=|269@!rw>-f@53{&U7Dsj&CjYt8V?XFfA6U!3mCY&XN@ zx!L^OKJN^-=i`&fADhGGp3b^H7$dEMNN0Wg%z$AI*65>Q!j8NDMaIz>Ky44q?mX|cH%M?KgBY+psNJqVrFVyB*>giJ|`O|=B%b^ zt=ZmyRNSb_n`=JzA3C-j(#qOLN4eg8UMjtgUVyQE;ZCrx3F#%dPntt`A zY7PmQZ(J(39eu~+@YuV`tllIfW}&PKZyj@6lQUCGad5gwd-}2Wh^dtJaK-&P&T#ES zGsEmn&o}uJTb7d(^=zlL(uxi2sGYecjteKE{Z{58$lP&rtKm$GbtQDqLUjAoBZBfR z*L*t+Y4Y<1wQ5;*?w5P}jJbPl&yc(b@O2;pqCnwJ_CHCNeuz-RlgeFvgO{Ygo1dJ= z-Hi?cm577zG!+Is#WVln0!ZdzpX=3>QYA=6j$)#g{E7SZUZS{a^{JzhoLmUfCmg55G``h32+eiK<=?k1m{f8At> z*B;IK%=|NkCMaZ>)^_;yj^*5VFNegO{lLIy5OxrOZHo!_NI5g#}IcDJ5Pz_AJ0vt^k0qY0U7le zUEc3q*?K*?lmZ|6$irE*ZePJEXE58H>rYH|?fcMtFhvPHSXG^AxH#yt%IFm|^KHGr z8k=1--D97=!XesNVVe1{zSezttgky=i9)m>tHGC3mwVcBUbtA21S1X=ftFjeYZgEl09-rn3Cb zSw4x=w_kE!Bid|D&wC>~@6WFiQ0ZfUNxqY*Q87#h1w2*Js-#>iMose`rfkpLKg~ZnI)RXBr zReaELZ+=_EbQO%nEH&f{XVJaw98;O;-$vP+e$CWe0$b>uy!~+_l)ibRw9I)jBcG{x z$W?aO9$htzozqw@(=0S^;WYQ;{z;eN0AkYtn#$s<58rK8h#LpS37d^r^jO?f&c?2V zkfnjkOCB-U7)UwPvNF6aPQ(2^)cfjEC9hbN>hR#|F}}L#pJNPGwcSDw7P?8qArm!*CLV(tFo{alZ6F?*oWzJ7K0x(lxkZF-B0peQKZjN&>EH z{RmZ~eNK@0KZ6NwpwW7*k41`IUjNdt>kEzp!UFPtVY^K+TE0fI+!x5DYUIJW8cy2{ zx|hKJxU!vDUj6%;yYA1Sz|Qqk5SC~jS)!^F>AMRSyYGa~F%nRWdo5*V+`UdZ5ng`J z#jD6RJ6{rACr`^W()%g-5DQ51OphdK2PZtI_*TBpxV!RPAnm8WKMtxk2-@nVC9KkG`md3^-I`C$J}2P5bp*fG#Ry5GY_3*r zHsH9;TheoNK(tBri9E8Iv*%u-5*Q#BXwqU!LXqiRPnZ1l{6>>R8djP1M1j#Vs{p?h zMlVS+>$js7*|fMu8x?CRC0nFb)6y*w&tKXpig8*3nU$ILbndK%6%SW7oz7HbxlXin zH%cl^e#e9&wc||vq|6{Wn^~ba*qY-xJEw;Jv73lXl{`yKl?lhblnMZ&O^HMz!mE2k zVrD#-2#+i8q^$E)*R^W8b;U?7BeemwvDyG(W_Igusa0Q&olS!ZbyI*A--J@%Mw<|u zU3B5eGLyEdVe6iZ48w<2@5tWRQ_0c^uf#xHtTw0TqSa!ZI|*gYOoP>4ns%oT(-mrM z@e>7Hk{#WDy6R#l{FY9zcvq|$d-uLKxM(;0@kYpu;8WhVm~^)S=giNZ3F+|{+J9KKj%}C|kk+mN);Vb2+##*_2u~Sym<}cRo#A7x*8~fZ@hq_+Tw;jBVD((t$ zikL3PdpuYxFL(4`c<$pzd<@@@c;#_74s!-&saC+}!4{Pk6ZYAF!_P~Rnfp}|F$ylTKa(s49FhLzs-e8g1XKPE@upr3D*FkquI{JLr#?l9fJGmx zM&|1GHallou71IVLrx@bin=Udt*O0PLYvR$_O|@S8QHNbuVoy9qtX{r*aGRlu*b4}N=&h5R_k2Zfa`U%>($D|d5!F?hv9L= z=EV>JPB(=&(}@2fbDr+ug#2ptP4&!JS-57^(sTE0lmUKyHG$@8MXsZGoSynf6e?6R z^EOWi4Zqf7($ge%eQ)a*dt5EKm~O>hKj2Q5$5&hHAmlI-hVF3w@r#7RbM@k86tf&Kl<*<#Zm%%&H@wE5S2;Tis7dn41wmG0OOykq}mts#BXs^D zF2=r~?u4?%NFKXO0O)vRd~=WfC zGj9Cs&D6>$8=io5;nT~!iQdx1H@cs*<=A-Wcc#UVc5FSZ#a*6(W3$E^3*@|5?d0BN zXblyq6h>vfzI5vp9jfZ5+v*X@_9}28MB!xQao?6dQNEF8FEEw(;(#|;;q4}sZ)=bNaqyT7hB)= zMOT>ART<;u1{U+{tB}YD^B;#FHE}>44AgK>i6yhch=ySD9qq~rRmK(2GT6t3OK(EM z#oQc0@|BS&jzm*w$L-5@h0JPi)A9rQBI`jdk{=D)8xKxc4z*@y_Ekh69@KxG)N16g z(^5z04c!vQH)`)njhNd9@@!%toVE)6vpP_1PLyA{xsq<4mO5ByUH+p!G*{z_`W36! z@7x`>*;6Vc!wshG!RKc7Oqz4JyXNttJXs2h14vHwyUK>p3MnLb=Sjc$Qjvl=Vczk> zoMF1f>Zcv`5&%OYUgHm8Kp)7 z0B=F(aWf9xit|h593uQ3+BQ{B?o~WZPV3({-K#5G!K2Y-QBC)~d?5a74rB~@1);K` z3`vv;TzvppgozKSPj?knlht1ss^#jUsuJYWv*|AVE^=?u1L9@f@Fq>IRi#R3p!3Om z(DP%kdQ6T%Ej);j)@+n%b+!D`!PhGJ7-AE3rOQNx^~6(Uy01 zUj4uEFkfp~xQY^rFWeJFj&{h2K3uMTZkvzzr&r{^4SZ)lyNa${M}p}m9#GOM#ld(g z{(eE}H8C`6F;~JWraF2ywHCKE%ym zo(dCOT+Q&&-!Gj@OgtH&aDnYTdXyZfI0cqU|fBU(ugy8exqL|7k!KW@g3H%8FxbtT4>rQIMx`h-T0dMxfYdA;p_o2nhs^fbNt$?FDmP1 z7e6(S^1E$ZLd=-5M7*NR#tW5CTaVw0%`>DaXV_qs20vKEd5?H#ko>s(WTAYs3Y+!a zG{_RWioJ6G$7fcdTvv8);! zI&;GhRD_(>lfRJlHRVe5jIl+AZ%&EPbbF-7x4z=5%{zPym-Ug<0-HBtX?$oh61nI5 z|K2?VhkzRP*9p?kX4KA$4BHGx z_CZLwunFvXkUZ6};J1$t z)?deSZN?gUtqTa`3~5ZXCaC9L8%AuKyTy<9M;ZhZ`t0@9-JB+h8saxw{f~fqiXVxQ zlxJww$&`5HVF}?Sji_w}u=uisMrciC%0jY=uR#8h)Uac}LoZ;fBWKYT2V-Ir^xMMQ z#@fD*HJX0hmbV2|_*Y_5M=Qy_xT}3krvnHDR4U}$_|Fh0HK{{Imfg2QrUi>`Ai3WL*-Uo!kPzFAXPcT3nbNeIzC_snnl{zl zzx#sHTiKTRx3lx6`@9kn`bcgk~>N*vAl9f`VmWvn~ocBm;q9JXR;21 zdgzPFIi41+sc^?k!;gUyck)$2B{xb_tA&SJd!N29wk|U22Am|*BginRG*_86MRBOA zh_NLb`XdvWz?`~!O_tsiHTe?j+WpR(57t3@J-(5OIe5A~IYjM}a?-0uh9`zgYMWE+ zV$Sv1ocaE6Mkrf-qj2iMpH8OA&e4>iKvC48o`trEOsl#xN#ENmZaDG(thCbIsUJVm zu#NwGf9_j>jHZ$2t;sZ!&kw5GUGdX#u?hpC*#duc|G zS-E_(BFS>^pJj-_ygim>Ir|P&vS4WIdR^0Q`X+z*9{Is}Ro|Ik^!o=0(?`!MApk;H z!W%;6{yKAw%$c7=gi3}E_3}^UAdM6)Vve|-3`aAc+o*x76eCe+0pWacprL2I^K?s4 z4+T38vKQ&{xRu+Hf|XxFV&6FkzE=&Rx6@29(R8*PzLBAxS}gxLIt&%1c$KL41~C*(i1>VuCG&;@)*NW6+Ecte zuB43~T^sfF^gXU3s~Ef$quL^w;6fGVK;uGBuNx zCac5`yL1)V>{xAm6-pM1N56WI#?89b%FI69omJ^Lfk_5z5?kDxUdv+2?buFD$@$we z0I#Ts;CI94R))AcY*7(?Wn?z|wlyr_5C6E;vedFvZ@rq_z=zK)ucuI4Jwmj~Qse9x z>N`uAGeMq)WPMF-jf5?J0g34E?*fJF!Gri=r5<}VbsNcH%g7+U7&M1z#C^WzlAiZQ ziieAL-UpCS47R!8hEuestKZ3#`}BNiIoF-8X<(;YB>n(Pk1wCBh8y`Yd1Ymj*%oMf zA%Q2T?IO!Pn6(X^t@^~nhG!FmlqEI`rkz=5o;JjHpS#GsjddDM737njTz4ccoL^LQ ziD=vL-c}vUitOwaC=a`ItCJg~+&8c0bF(VHqAiXm0EDO}O*~6C`_q}JGp7k> zLKi_V8tCmVGHtA6*=P_&Jqj$85dv3LgIpht#L$9zl%VxK+|-%ONVL8n5rxQ)PbH!yegSK6tmi4VJ}l z^*GV$1=wI*?z03E3V9#0!G;gSLM#CosXqew0sR9YKMhV@LaQ6;_ond9y zq4Ow`kM2b@nNYp2`&asqUk2*WuHJ* zW+|JVciDy>DTbDcsEkjLr3JK(K6}ptY1(kvPP|w7oa5ti!CCb|{;9XL@vtbBhn%%j zkDy+Ws&;I));>e9`d)J#(i!!UzzW3hdA>u5{fqdho(15BCW zQa=@8DRK}~R(ANRBmq@8h@c9m_v&gai}T5(R9u5-6%=1{k*0T1g|&u<=HmsbVw^3n z@oN%c42mcfFk=<~=ODM{#q!`Z%D4u+${tR=RU1iA!+RXd-xLI129W2v`i+0e4750U zoTbNDMy8N5$PVWekCW*QnvXvVXGW0i&Z8t7(Cy@ z`cNumsGomeZ1>k;kUcAlpmRtXKj35`usP?}^k(sFvu*7O3V($de);+YpKGG7IF&9J zG69ciF{tryOH(_i4Ptl{`(LvdUjV@z41I&`cMDk#{4Y}`<#>Il`95hMX8tXLpE$d@ zczjrot*^_iJJU*!=?R0;RF`<7ooETvmUNLQh|F!=i(8I?!{D7Wo6r@A5Q^r(TR`yW zJk#Dq{}Wf>Gn0_DV~ML0w;ssI@Ji6CSo>plGlKt?noZoowuT_>#$qlXtLDcjGH;CS z2l+@YtFP&P8xsj^y2ZcwJSzMyZe++7X@>!}w&K(!SU}04T~igACABSmJAxn0X;7A~ zruocjCxSr+5Vv=B2Zj@VcrVWnN-C7ArzzOkR4lZGwXq!x&|lD)u(ukn$2AKBc==2>j zm)Bx1W=tBu94k(X_Ymv+j$a8l>mvMFPiW+9J%+_+TW8N^7I0lXLsWJ2UfddMgEt|Q z;RFo(V>@a0E)pvXNbI3qB-RBNyzu&f-Hr3S`(bpJgMR6Miu6Dd$+awKSE&ctR5|7I zjm`fs@P|rP>7vyJ9hk29o2TcvN(qtkb3uNi>*o)_o-iSglp%y>pAlMiFon}@?V+4< zlySzseocbt$U$U||se2D$NL!^A^K>0`eUT&`!hsU)EeLJctv+ZRh=Zp7?Dl>bm;ueLY& zA!*|waDdqy<}m4LalpDof%)27Hid5u5Z|&lVaN ze>I``(#R@%bB%D`a;iy-M7vvZkxs!co*XKB*M+)nB9Vh7EUJI8jTJRq2YD$Jvxx1n zs>1MM)WHwhIIKST6T4E%F3B0g#foq$Pv zABr8YIrhV4ja%X%8;}WoYO(max-!IuzZFqwf->L&x?Y z(}uKvt}E6{8&O4p6@xP&%3)NcU+#)4-mksp3fjin%mGK;e7bFND^Zb$`5U~p{xndY zDn_4gK4?E)%4gB4@zwS{KhTCDQtVGv0(e3&x&{W5@35QJ zJsuZfg~M*ypmK(AA_|cSH1(e&cMrQdVkEl9^DOhv9kI{sex2v4s$H zRVV=^o~-LGpH1UIZLZ3t*YJ=~l5D_{2kEISWr_9c@Ps>noC({6Sx;t-y9r~@TaXTh z!0Z4o#a(n6=2*If*GB(YJ&<Xu^innDLq@!SIYMXfkyX3>yH3dpZbJcJ>-i z^GwKxv8Yb+{LD$a>co9y*WG;LK4d8~N_sEupf^J&V&7|;;cytvdkrEPec!x$mJrV%jpz>b^ppY@Q;8oJf%-g^t zKm7QhTuFQzdx1sOP`c{Hb13v&UITrBU#CMgJ{9P_{o9yst7$R@Ss;@(b6$D)^9vc% z&6hQ;7+$`Qm_HzcVuN)xug(7*L(-rC;uv}k86dE+V#+5v3*sZ)?{2*Tr8~JzKEBOn z+CFyUuYom{d$+X;HSQy8^58d&UehAxP3k-+JlY@9aZZHV*EcQ14(YT?)_+zN#h3Jo zBvj#^Mzyz>XgQl%p!OO)841iFjJLJ$N4Kz(SdJ)~6J@}2?oR+|6EEnMB`NJEFQwYu zvN*%p0jm8z;MmsWU;iYyywBiUH1yM*l;9@!`3(WsTfYxsgj6t+=PM-Wl(hzkF+b$N zJrlYABfxR2iD^+H<)!(?_WA?^lTz#*#_y^c#(>Mk&50(rCP?OjLc|rFd^2DxlnUB^ zV_6(Yh5qrNPs4epL0%JG2>vvn3GF4M2C2ATjc)|QK>19!urB?jFQ($KH71H@B~Gg+ zOS>fLwcE~{^=}}oj{Cri%jb=8yW9)19MWwzt&!Zu(h*aOU&hFPWjy&t3iToNLgP8SNwZy$zb& z94uJITI2LKS8*lHz36?@pnK$^Q#tflRVL_o4^Y&WzB#pBkqJD8=$_V9$V_XQQyfRP z&t#;J zA9$s?@??dtf(|2MM`NcVnY4xa?!cku$Y_;vjg!9C?-_aM?%P z{ov@^d@H^04*jJ)V1lR}aB;Qipp;?*DvN^^ZUslFIB9<_-}4`(x<}aF{yqWiwNkLV zNdgSt$`Vd#I@luWbA<4t6=JY4{YVvZuk6ROc+<@IX-zMQ&5cZ(0Xj8I^9 zxfTAj5=5+4K0q&=tH+CWd!T%!&L7>i=YIVY-L#$%dw%LmD?~2%_iKpEBi&<)5xckl z0>nDL4^EpCjNqE$DCm)OB8ohVt8gb9bEULL{K$7LP3WrtUsCuU&LtuN!iBA|0>dne zc9ZanpQGUSd1RaY;HmoEp}GpT1zK|7!QPqzU!?ATkVM*sJE6#`>x*{;l(Q>W25q9b zjs1}Vzj+*@?knxYW3L>(fdc?Z6_XWrC0TGZ7( z3a?20V78xUvjCKZn=0h28(z>A7lSRc`tkXxJG5_J5T6(*ut35EWB>*U1#>qd1S^E~ z?3(ugmqJD_cE@QP(=pYRX2$^j>m4vhL~p z`s(6EaYJYYT?SdGAson~E*Bej*FGlg0R>V-tQ(OZM^u3!-kbrs<*qJe$!tWfR$1&% z0OSX!+&L-2%)h?;M2|fvifDzwFk8xAzHT)^yANhT@JvR*~`YZ7( zL%g5#L8r;?YsA(2CN>x-r|gFP3>QiFQ-Pt=pCq=1{R?|h6Rf(n@CreT3zR15^G$*y z4j?IJ9_#NOZKJ7AhZzdLEByIUUl*VXl5%P;0z>hq|bnz?}p66#^Np%h*@hVAUG>7NVboAx(uqgL*$L!CdD8f z(S-TM%cud*Z|?nN3Vw7;fI{kgvRo+00)uHSz7~egt`CG6!MkQ~Qe;v5poyCA%q3=L zVdT8}N+}?;qeAWm0`b1o2JU@6I+zYQ*J;GyX{i~5d5uHS88C0~Rr_GeDK~J!dClG8 z8{JIV&3BA3sdN)9B>2CS#3m9v-Jb7 zJnk_T8f2Lkwb8uhwwC4*Q+!w<_YfvfAgtmCX&_J0n;{%)&v0?Eztwb z>@!r}e9b4}0jojdXZ~{ZSp(FUNRooqSYgvPo7$}O2=WK+_f+)XlkD1?yk6DVBYs0* zI=RIN&g>s0X2dd_2dIGUrf39;(bw047$MH5o1(U6M=C|T#~|v;YhFP_6n&$f3Aw({t=u8nNY5?0jnVBnW_IVpDa_X4 zeo??ted=b~ikR#3eN(W!}<%ajPwW*@~f2fja6JOqBjob z>*O?VLQ52n%w^^H!fTNOn9X?1W{S&fzp*6Wjy(|*AD=bkO@dE&m!nLh6Puy?AmT^4 zGv9X&h^^;>IVi58=Rm=&xOs67TaD$Mvk+XI&zMN?8Q~0y0z!n14O&(TD6W2U_@VG%EOK` zNU$$@r==H91|nuv9ZuD(N7i^-0)xoUE15qfK<~tbSsiIB_N+f>21)Fcf|c%T2bZk0KQPw36Op4+2%qh~+>J53X`H-vxyhr#KD76Rsr{)S*`-aqyr_u{~yj z6#D3PYeag|8()UURCHZ2s|N2ixOyA^r-9)%2oXo+3)=SIZ8MiE^0XA1gs4t>0Av?W#9ihDIAgMW6^5jCd6M zS4<*rK?=qr5Am^=y)d_i_ri~FIAhi&f8d5vxuXRUzyAptO<&<9-wfx~&lfqNcgtVY zBFB}R$Y*;!4bJ{sz)^-qKVu#u#uAF}$!3kO2lmz5j^kCCgL&lpitL965Ama7#N6`Z z#LXho`M$qKhnp3PI8XNvTtlHW!T--LxD)c^%UzQl$#ZI+&~07R{1Y5bQ#_v;UvodY ztwl5ggKhcPGBF;fB)Rqb(aQX=jZGs6Uu8E0XhF1#WF>a}1?J6XJdnJ%e?V#cs*wFR zmF=x{yL8lxRS-E%2k%%M$gCLMKemcdNCO>S7LS!#T~L_@qY&{&)M-2zNg^Y$d@&?V z7*|aBd+7+$V;SP=sS1L$GyQqVpv;s3!F9U`Jd1YD9U+TWTG{hNs(ZoIF^+@!5Vze= zqDtQn?n|mh8$wK@vHlati}PO~EPTeJdmI@C`#Dnz%vKTD=OYvR1?~zpW~j61-;J1k zx1;$pV4j0@-Mg0qHxZp+`Hq%Y;jUISUcTU32b7gKUvpEy^>MsBV{;$cRSCT+@E8l6 z{xoP`?$=R3ofYHD`WoBD{z~ZnkL%?Mi36B?&r0{@*XWbxD0UF*ZK^82VrErw>DKH1 zGU<^qGt@(LvFBookjq)gf^H)aJ)b+q1?L>;Dq&hxN|3ONJkQTp6D{OmU&q>YXmR99 z0V3s}3F86Y;muYQBRS&`{0qRV{#89RcaC*WCNFLjEa8p!D_oaJ*>|lV*9Z3)>qna4 z-R^iqxFGT12#}N(WF@<9BkPg~>vA-G{_P!jfq4BR`}RJzuPo}6_<6_;{FG9kB0iBE zd?NAviB5jxV=9PU>5fmfM_&9U#vEfVK)XuhF_J6n9$q8v5aPj8rC^o(hFmoW_3ra0 zWqEdc17ZOOZvM!bbRIrj!v_{Qe#*K{pnJDm_suuylM+DkR|hyw6IyD>6#+4~l>Q@t zT%lh-f+4TG7p5Ti={xXN0yBH` z#*z?@&3k~tFJ8E_7b)GPqbg+k06`*AR(1NBf4%`qg775&j+KjnO4=AYXGLFTx605) zMolyO4(!^SVQE#uHFhAH8qBAScEd|?B)n{k<|E`Q0hGX^yM8ch&%wR_>F+`uv9Ise z-DRpCLN2uX212596>5?ZP6pD~;7ffiAX5|T>WQ~W-vyID?w5HKcN%O$z8=d_!sSN8 zZtDp6VMDltJov2Etd0{iVP}1SKLtOzOSzW^I_tOR)SQAm@cs5%-G9E}2=c%Gl4Sl4 zhMdi!Y|x3!nUFz>3Ej2)@CJ6ik_+h#!u?!FR9m7|JPC8DsNZh8Cz;hx8=;YbS zlkfLV&4(AHgOqoWQ`2Llv0KC^yaB;`&yONaJFU(n#K@P%BXn^EZI7I!UC@5w&@nO> zh+#iB+9$CPF4qz=&>IxbatW94IUYWnXVHQt?5tY&6VC;I&E4_~Y481O?Y@EV-v1uf{~lJN{~lIC_VC}s`d`obPXO@$N1m0i`$zYjl&`Dg*x{$(k6%8x z)Ph7gVhGsS@gi*i@xjdyDt-JW+PypH1t{Qq} z8+f#Pn+cB$Zr`GZ;Nj2Rv@SE`ho3-n;h)ZDbrktwcI1cUl{*p8`FtrcGBN^znjxSM8D1pwfn8<3r}yy3{H`k^lMq1p=g30&eO;h-a*3ri1>GO$X{kj-|Lkq0k&Gis0w+!=G*He06pHa zXp8SbiuVAbT0=n>ibc_CX-e6UEl)o>A)x}lKR=ZCOUu-c2yI0jaV> zJ$f4Eq4ma#dw>v{AZW6ISjjt;M~BFkpbR-sjg)?obQ5TBtVUH8ubCAy1?>hAO-j)4 zDgb2Ld{tnFJ|C^4Cb_+qjNgW_57~&KGK@?jwYH(5dbqdqN0+Zs9!`dx&%MHGhs4em zNSGT}m70PqYt0deoVg8dB*6<`bt04?jMvnF*1g)+xYmHGz=gKN$UmIDRj*e<-e0{|Pqjso=`n zF-W+HLsF!)Tq{If8Eyv7n1Z${3vy6mebGt$P{i|spF>1~$FPa^aa`Bmg31B})QCB50#-e>txg$Zc1BJ)Gu z{Tg2}>F;$423@7lJA&waHUKJ5_h!e$-8ZjV-CArLO4-4nYB>tF63~9;BRci}%j*Ni zLE393d4w9Yf>+kgH7vrpiMY0>io~}UdJk~^69*i{&6;B1E9Yp$*5v~Z?M`UaR&^&N4P+ikzFN*FuPcFWf zBD*(vlKMr#NFMw=|XQsJh7l9F@Bt4Ix?c zgv@zC^97#p!bAbCn>u-{hG1Ob2&wKqj<)2wK$IvmxQaVLD#u|f`_>qMuNbDJGLnVc zC4WMOB;zt@CxS->TNb%nFP7j6p&Xpf0gGMkC1XzbQdhv5%L-0nk!2!(Vvc<7Y-|@H z<0Rb1ZrS0Qq?F}dDWqU~T}bs3@`F;R;qf0MgFE_{T-rqC?pQ?KhUemUYOw=Bvgbb# z8?wLF3_of?HYOisAGe~=mx_k9f*Fj_BN*juFc`Q0Q25=viv z3~Sh?aR97bY)!A1Tp08E4rA~_-PcmsW1tI&62~ufAv0pYVSNuu-oTNAT}3qdq-S8v zAbRI`>nrjjr}oFc@qc&G>JVavRKZ_|x`?$PE2V!1w(ZzR63FQO2DR(3>Knp_+^~}C zxk7ER!pShJ1Q{+1U;PT<;sD++Pki+BZ|tr4?>Bv5j$_mYfbX_5%?Xk_;%G`T%hfY*CE!G`LyBFW3zh-hyiE z9ZcNUhKn)hk$qoW^L2kkMY760;ufaDGXqVSL(@#4nxr2XAm$*RmJH zDljuv5vk|^z7FF$?ZMy)C6+lsxdExO!>E^evtfiE2y+l4O%4pQ|@UNk5xYJD1Ohg6q$`llQi2ef%8Sl@7pt&hyah zEe&<)6a>AMjM4w*IF8AHIar8=kB zxSUZAVPHW`RvjjS6}jRJp*yvGo5%@3_!WaoZDNbT2%3zQahw|z0OgXwR?9V*#)Rk> zBb785466mYowMGcXR8i8CA;>*zv8F?G&#!S$J5IXw$|<&d~{?Yf@r`e2cYwG@NO#bLE^m*0&5N=urpkj2n6%;2?QNGYhvN{u@tn`o};=?SHO)C zJ77C`!PeA}!i^bDnh!of40)6k3?7KZKfdX!s>TU;8a0f}A%tRt0Y(N~5cg^Un{>`2 z=G0{+TNp*o*a1Vp7#HP{*lWlO6UNZu;SLMw&FfWgX1VTOc;re13A$WnAkk5dP7| zw`IJ@O9g@*mp6{Pm2?jWs*bmv0m&vq!NuoO9>Y*ul|1)S@^{UF67ev}R?1;r2l2>^ zwk@>n_T@)W{Xa4dcse5VLT{DN8}#3(L#jcWG<#CtM5>Smk$Vv4bt8Z%Sg{L~+@D^$ zwLM?I5km49C>3dc1%PL|{)Yfi7EX8xVTcfPW)E>s0~w$Pp1oyT$%84io^(|iWY{)T z4ox>Bg+ocAF<4RO>32ZzP={!!kdF+r0zNnkLc-!y2oRC!!_T0AWQorSQl)%0u2G*U z(37&-PEF_R6T4+_z`d}exMe2%yf=}i_s8N5vU9o6{5G&?_|fxL?unUXVq9hRuPgI? ztqeQC9qw04&k>abs&X1)WgGjro3;k-aSeeP!kMqOd%4c`Cn3|0!B(i!w;4@5v;PEa z$F0!)sa3#^zTvuBzF}xv%yFm9yyj7n9cOVf`$^2+u+qQlq#;=*IIu9HaW4fJq16S{ zmlU#dg8eTWF=~U=KGg<>xi?>3h~_naW>D1@paBVCK|$(>&yJUXZNCascMJT~Zc=N) z+$z!LCR+xtrB`vc%!#g0Tz`zk@JQEYBa}3lJljFaRgnmc1%##NGF9_CrrEgLp?dqB z;|<4j#fd7OGqMKN-ou9PtR_hodw>t}u?UmzbG<3FMkD*NGX&+P#+PL?jzQ;yolboLwh!@Ft-TYMXm){X z#KRtkq)fQ~N*DpICfxjJjIWzqm`+nOyHB`;mwS0YJjn}Wwin&ids5>&%!2=jb@Q92 z(MFdnU|^qj@%^8&=fu$aST6-PMGIuX40kH@n7e|n0PrrIXL?&&Q!|aKt9UJ1--G?` z_ZNLId6zJ*CNb;oCx4f9m`RdAl5t@ONC}*=l4)B5oveL)>pkf=R`Q#C~%- zElWFha8(Rko)S>8-njKi1I45e)k0HFiv=RqTpPyrGT%(2E!5`oaY`g4dxL0j$RHYs z3e#c8@EnU={=UiA zQ|)16?mlVUWA&{m@LKiOgRg-y%w|Arh z+s8KI-C1~y!-8_Q2#*K{fx=XX(8vdI9-vpzNqF7?Q_}}fiDl#;OoF73)Y9t=FQ5Vp zR(X}bSq1>3T_h%DqyMkx1bB}g7~>C{q0@vUi16>VBo&+Ub5Cy+*|@Vho!VUgA}+Ti1r6(CAn{Y~ zQND2^Au+H;)N)0XLcm(Z6%`bB>d?>|lDVmNOZ1}6te%stS0#vqG{Feax_RtULk5N5^`;dK zPOmbTP`u}61X-qbW!M5G%i9|Xw(S8O2bNbpzY-jc7F^w_I`9SalBPGez~E>*@UDx$ z6tP-%ZS?4tS(iJGdkc2I;%?H5^jtIF(EnJaxQ5WWWd|Y2#(ek`HZufMK5ZVkP`r&H z#}>7030qC;<(WJNy{f;TBZM_GyPZssZQMOa)Th7&L-ekCEN*PYSffe9st`ZQu<~s# zy2>PSIA-%tAFF=hJ2GF9lK06QibGbTUvIG*{Jupex{wuj%M2xlZmGaER;*6-g8Igb zvl78a*H^!Ck8J*yk6Xj1Z#=Ni(Vh`3YW|I$TS$4{wE2)VMFFilbRzCJS+YABZ88e_ zqH!4XpH$gnlh!f<6glYZj;ygcHQ#2fx%RG)i-Ga4K{h1t?VH2L8D!V9zV?Fxt7fib z=px`O1FpZw7$m-NGU}Gt8~D&~$A_9rd-Ivvv?pGJk&m>jdz0l5KQ@Y_ntR;@d-j8x z{7JTv7S6FpD~^yZAtwbX_{5>4;jKZ1$|HghAO&gQ4z{hFNf9c%6_1;vyd$r|8e=Pr)Z1 zuRt66v12YlCvHJ!WGj#SlW5mwbhUPd+6_e9zu0zQ%hlgQObte2Jb(lNdO$7|O7Q80 z6Kb!78$5p%$)S@OtcVduPVnZ?EkVQqgyZjMra$wAFj~b}BkOo&cQ*FOWA-kKk;THh z143F`p)g`^&;`uKTQ07hofsYsP3)Rk=~ahbYVQ|XDWL?JnqfeP>{qw zl%nE_U3Ei+p`V(g%*?%JZ;3w7xZkYg{?T(k{)0oPmxE^6(h19^((mrSIvR>hTI}mX z8H`${H97-}j4~XT2L%(OMNOY6#a~6qFjELVhBnV$v})?axnA}x4y?B+*426X^LRR#W=_eV0w-?!CSt(YcM*DkOmN)dB zlR5voh4U)#5QtLJ(h1^}yU&G%c#Bfj0AgFR$qv~Bj!mi6wA1+003N^}UgW-AHL~pfdAaUflbp zmplb?2~HE+y-}aUi#D2-ZOK>q-wgB=%S%??S*F}{(=hIyl2o$38!EWrGTe7NdRC&x zGdnLX#Jn}{*CXNS;S8O3_-gCLYvSPSuL%oUhFynkr#kB1|8q}{n6QE1KM$e6&=iAL z%KE127{R+_hrqVp~RD)qqY}rX))in^#9o zjc6L<4XB%goo&5%@^Ry?af_Ai-YEvk;zDhk`hBa>%}&@=;R)}!a-S;PjOX#RYku!Z zxFL?yc6VhHpHMl7o`;_Q(;yz*)sr^SS)ArS|%;~#U2@qbY_`+X&r4M#f%08u2 zc|K8o(PZxE*6OxF*cENVh%W``*@JX((nsC&lpYc3P~4>s7vKt1onACi{_FeT3#KXW zQl}UyugLB{O87eDhy2({(%FKWIuk3ALfyU**ti?g@K{y*C}{B*Lw**pRL zPW6!af1jBl)zj0vA!3eFyM4kVOrjb?y-5GJja~?Q^v}%R>DoO`hv1*A$P;AP45i)} zcf&-@(dp@DKqei9A$7-+9oKA(sl)4PX5;^{(c@XaF~LEVr_k$k&$sf84dr-@+g0Q|KHnqkJDU+v~3BJa(C`f zL*o9ZzyA*PxpQ@`tx6Jo*?K~E^z<$&$BP{yBMaY&<264zJ2yA>4v3}!eg_W!0J7{o zM@JL5Fb1}|blO9x)xR!8MXC5%D^zk`v8%JvFn_IdT1?>`|m;P3H8~tN#OT+RTfrPBX z;t1|KWs8EU^pRR4-Wni98qOCIH@rG_yIc==O}0jMnGIn$_-~KHZQezWVba(MgN`dK z92}g1U%%QwT?I)Ifg1*m#6bMs)|V*oNHiDVefpr*wvrkK0FveQ6rZ|=1{7d_B}+*s z`GAcb7#-~Z6xtGo;PdD6b8}Q;43L?7p!N{bmYyDrn+8|_ zfXyv0)4bXYuySE#W#x=~Sd%8sP!HbFodzJ0lCtD6K74$9nihI%YwJAS1|5C#sqZ+z z6s=&8Q!oHM-tq_k42}A6TKSeJ>Q6hF=iig11Wp_6As_dh2rz=q9{lr6!Qcfpzo`}o%0q8>x z0{sVB%~^nJ?$myr=Hutrov1<`9vB=9me8$B+miJLdG+J1p{QcO8CvG#_4~V9cqt-E za5R1pfl5jJi`{zlVmCs!i|l;lse*6+XaN$Aa@E-8pH0HmR7fr?cN1o5HE@t=ucW@7 zM&3X3I&qHWGi1hU6My9H`DyJZjE(HwIh8Kx#yR_qE5+eFf%vA%fg)Wd#^;dN8Ka0K zo%%jDX8Xb^g@1!R%CCbDO`W~i$dW8ehuAx_2BF<}7X&z;)YxpobZ2f z9#zOe)dgqCc?xwU0zRh?PES3oP)^tbJm!xpfHWge9{*Oy;ic?uvCEM?kyuR-`N=Mm zfI}m581T~xoFLyZ2AWSWz|GHrA#p%;9mhO9S_Bm%6LKK}g6jyH%Y%c1rE<`@-ZdwU zs2Css0}$k=52FPy5Fb%DTG`wCB_@*B*43%9MM1vSCpbHAt$zg(G@oZS`X2*tfzy@l z`k{{}P*`Yad%$~($hmp!sCl3Hm7Jl11;)eF+i!p0v|5H685VY4aVS?$q| zxL@z;QUpZj%UK@iaY?G%_~a^3VFbq+h>bBaV<&`V!D0+~%No0hNn2hwO}gXDL^HB@ zF>o{#<)bVI8oe{!!}4;fj4>dsH1-i@yY!TXF|*IO(IR7&HUSj@N6|a2VT)nBhz~K3 zjkoN4AyvEfkzB!n0Rf)8$3I$I#gncNR(eSt`-Z@rfRE=#W_XM$sGz;M4G>ktC=20C&0>efte9U9EiYWqW5sGkM{POz`Zl{r)eiRer7hI z;;UWfeB9?#Ia=@t__|T2KV}Rdfx2<=146**OjNG87~J|H5jdp#-|!_91+3xCpVH1R zoR$s@GI-mO*BJQLQ0}j?c^vP|K#y#+HfJhusJYHko#bS{E+Z|jU>xfK=xt)v~V8!{Kv0mEm*3YJY%R!+=ds9eP==f-L|z&w7vAKRP9;3IMo8fT zc9GG->GS*NE}$uj%rmb<0fl>oBz2FF6syC|V6(&W5h>d_?pODHi(?*rr~? zsTdu|1WCi=&eQcdO?p~%J&Z}lzbnwLc_@0_^mu-5lcjsy*8JB4FR5U!s6)i527A)^ zM@>YWKVSPQXFn@8c)!%RJyv{8#$Ra?&K!Jp;8y&~q^OD^ROh?j+Vjb|t#$uc(b$@gKI_%=RjV8G-mY|oO$QyCC8oMNS7IuonQ|rVHOD*b zZ0Cy6%<%JRK1ewRG8`+0nJvIoQ1YF9t>{zK*-Yy11_W;wCs z@=WqtCN#2IQl3OIALxm+r%RGeQGr>IDJau#-GZ*iy_PICy$D{3+btCFEL5Y)PlV`? zhM@+D|DcWwT12eEHFndZhbQc7Dqx8~ohI}8gk%d`B&E;~PRDbYJ=Ed4kJpZaqAf5c za&)sp<3;8`C8v64R)AZN0C!6`1b3M=H9CYblNcllXNZ^872iWq=#JtJcQmp*=oP~S@;Jo+pIsdp9!#bimJ zf}tvsx)EmuPlJ_`(|(LRz`r(ag!x^!4Y-k89`9%woBzZz>#0st=CNMtjZyH0Ec(VRZXRal zI0j5h?94WFBp@{r_t`H0L@F6h9BE!ZHUMIaUSqMOUUFiKu@L zq~W(`>V3WsbWSANoznTF zLH`;b4(+W1RXM;Me|49XCDrs7u8mB>&$|4<6f}}=pXDj+WS8NBbnOfmx0GLw>;Zw0WYJBTHo&<nDWF>+1w^9L=v>1%Ye0YQ?Sn%F&nyN4n`wM#?87C%uV2Ym4qp zWsYXSL``%k5 zHs5^h9z8rn7Y13IY+i#3J$O2G`EhlJbZsb|W;0Pxd6THx@sh2~;Nd%e{VwVzGT*&x>(j#||Ycv>XR zPHXq_ki9Z;l(Kd9%j(O3B6@|S+Hn#sM12ryd^;`-bBetP`^8!(@W<+fS;s58*cp$n zY=CP>D$kGthyOSJ+{xcu?A=W+mdECtdFvcNE>;bn?E@+HGhqK_fns`fiN~mVN)hDp z#!_!beyKBFEvb$RDlR;}D%uYHFWsWxe|xsVeq5JX3Jky zq~piRpLD^|n$`6L8*0=M6NA^ixm*S+%PM)NuwYE#!QZ zzuhpPa7Lc_zDc<~jY$>IA-6 z+D@H+@>50`#Z>9 z3PF)QtXBIyxt0VJ)*2t`8UDHd6AYkU6c|mkko&vXlm{S{K+`~#7mEOY53h=ukCVX{ z!q?m-|4$N_;-L=$27?g;FU}peVFuQj9+KN<-Sl+}SIGW8KlmI*&nYw*w|Blb2-_GG92B^j)lalMcL(&ClXg5$ob46m8VC}mF7)(< zse4tO9=Ky4E&9zV%HpxkxP=Hh{>gCM8T1<5wX$v0jky-tdzd~@I;$5PFNm;k?GXB= z5+19fMOm0Oa+)xGCm4lU1G zAw5alaB8ecQrSNZq0jp$5b`9mw>#JPg(v^J{y35dXk^9`AL~EX!23ZCw!Uhy2XcEP zZmv|0h`Bf9Xff~OM!PB)TR>(eTSJR(Ew0YhoW^u>_w|O!NSj|n9p_xc$?Jk2(!9!y zwVwLDNF-3kqZwNk166W@4uc4mS}KhYTwyC>Z~f}R@i)Aw6qZK|GaJYcSUbk6XyDym zjna^2+7LenBYEh?Envupje9T@Jw6-LIH=0ldb;|;>ix@!!|?E31whUHzv`ffL0h-_ zxSQ&q*j_HUi(LkHo$T*{UP=O|W2$uJ<=vzD@=^F#_H~d+f3zeDQ|<_(a`%Kc9`C{n zWfh`VQc*kN$#bWR9Lhxnw=aXS)+K-q8I#g4^->@eio5t0+SdvpD4~q0g3EbVQ)cd8 zAKk+7F;*_{3Tu1vu|0mB!xhG5P5d`f$u^46rjd{h_Q?;$Ih4h)bwH@kmmAX%IPfj* zw^{FEhrT@S9;-8ZOyJNfdKhO5$?n2_?+d~C5ChBCP|MRM_P-pg`RoJPczqeT?CCaU zyY|T>Z+yrU$Nd_M0LkYuY~#Y_8HlhlPq*WU031R)%t!mzw9ju$`>r?QU#1nMg0bgR zyP4UT4WS;Al62i$Kip6&D&G!Et8RNxr0=!4Q|bQzk5x$pnd5hP(@F+IGyM?dhfXWo zx^ryEbAGeW&t~e}{i@KTGsmYp$Ha(zA=%HFR}>o{%Ai;k^?pIPAfGl+>0=4{Zpqu1W~f$vIH=gA7}ybTZEy!WxSEaj8*<8FM^1Fe)cQK$YXDo3Nk5LK@Y{-qaTg zqf508tKa{+xfyJAX2{jb`qbiDHD`~h$M74ezfo{{g*OX-JTr*b`wQxjSPi^%E<9(O(Gij zq>EGZ#%cTPoOmpjb^Tp`%Qaz#w{hCzE&Eh|t_b(zACi#FWpb0N z2nT)kmW%(IQd334A3v-XMT^JdAHE)MQQvg@>#+EJe*o8N^u$-l{G%7BZ+HnIQf#?N z@lau8h2$rCpx^@!qG2$TsRJkH3jxKRHvpc1$}<2=hJgX8RxD6y1_uWZpMTzz1NK?) z`y1ct&B3$l9-r-R-CF7%5*}+fgovh3etmG}o-HX+R%rpl%+Y0yy~7E+&Xtg5B+~luhv0dGt#CR8ok&(?EINJc=B_D>0wGU!E_2TT zd{2K6nVdu4h(@GU^FF8}%?zb%2WU!3m^U!%*&$PcfU9UyDW2;BTb-%J9u@$x7IZ#)GQELz9b7;0`#oncXm)uDq`aY^MP40F$}0^yV8~xwwDuQ1h^Cn zXXWb)gmel-MCC7ktq*a!0vV5V$Y)NKv$8E=SFy7M0F;$xOw9fC;f?&2ONGGAvDz99 zLS}On+wOZJd|X@vDJiMewzfyQ^)Boj9G=O^ln)<11R4nh403+F7cX8oTwm2;geD2Q zhZYsF10^R)ad9y_H+OVRVyiW1f$}OZFUL?86BAo@&y@WN@9gY6t_uWyshOE{$=&fh zZ2Wec^!CzQ0N@5>Prqw$p^G>;v#0QX4*xl`15V%+YhK@f@K44Cl0%U%Hx*G_0(M7+ z$LAaD9?XRhyU{FyxwEoKg2W2RLT#YmNfC@B1OraUfLu--%xw9%(nCxpU?&?r#H92M z6&Z^R)!p6wRG5^M)O4nn7+~h!+1U&>Ha0h}mLwt}X&xCN*xTFN*Vx-p(E36v_i=qV zo2!tibL&+CI)G~|fAPM%bsgc3V3A)d7ZPthH(0G=4e&7KUrJgEUsAm%qOlVTm{tJK zE+#IHXk%+@d9CDtp2!_{nzH9Bv`X=X1Z#qtB{3{1P4F)Tn z#c{sFiYa~rYm#6^r<1soW3zxDQ)ZZcnw0!FoGbWY`Y{Fu#@l-|T`SMP7$+kmBO+n9 zTEU^t?rtDE#5Fv8^XAQ4dKx>403{dTkHmp0+wi?`v9(OX^^;FD|7Ahs%|MUV+IT75 zjYP|Itmwtn(b1Nc#u?j_C*q+j&8)=;K_Pb&Z@eFIAQQ`T+%v!3Q{c$5Q~^bz$u|zB zr0)Ly3SrZ!Z3G0_^7c0%lKl~$4OGIsKw!Ughmis#+I0PCV8-Bp8g0*L z>fPFV`v$Eee;4{M;z$L=ySt$pFFG6%fUkl%C1?fOHOLSX1w{4j?d_t{Qm@L& z$|*=WPzhs@a?4)DET5dDE8RK!Ag&Tgy4I5?f4jTP3M4DW|E+ML8~Wq&X9c{qjx`vw zMjul7;)|?s%wR~eKyvWevTdX7nK;Ph@BnAhz#sYzsv;|k(OM-+OG~?dL04=oo$%*i zsS|gq-c@T`(`2%O1fWPy^5n;Ct2tfqhIHA0g8ZHErF}8Xe4de~8y#eTvvTrB4Kg5c?zP^o;h00ABZM5<|^ zA9J6K4u_hUgrw_~Pe8x`bff`)+YY8qE?Hb%T@@7D0O#}HKc@?$)dIfSe1`=)#rRPk|657)X`?J)$obTV@cd!Y2pic3}b2S=k zq1fj}=ld zb^V?wz2Le?u7Jovtw>}?=ihF`P07ih?(SVJ6Q^pxbFt zSp~XUp%EifPPXil-6KYwU2Uh|6{I#(jhWG>qw`EtV(t0r0zbwdf5A1aq5e+s-7H?r+ESZ8Jf$zQ}mgfxr= zQmmvZYZaTg5I1J1nkxziuuhdY=wK)djympASh(Dv|8p|0eA3ZQJ*MJ-X}xQ=3)Dgh zCY%Z<2JQk~A6qRfRH|(!gW86n3=*7-}wynLv4Jh(Mov(Z(zECaH zKq(a@?EF)G1FE;g8L~H;;9*gY1%&~Q$&yaN`pXB_xY!`n37~&iG;f`_cMr`7;{|v#Mt!&(i1T37^dJ6g$@N zFZ`smR41r@)>|M<7yMA57x}=L#*5dI_6urA?VF6Q(&)Hy)1W`^6dK2&wHT*o*c90$ zT9L$fo?54YQ5+U~BwU>A@*He9Xd}$Yl)@^7H2oeq>e*-nPBnTUTi3AK?flXKXlA4d z+cj1MHpu7xHcLU1(GQ5l)^c2>E4J*D&cztm!e$F^SO5@WI^!&Z{CXk&Z1IBFp$}Ws z`itESA?@#2Fl&bjD$loe(pHD{31~2@LmFP9+p_m2_}=q{T%g{K#wjm6hXEH4QqDj- z(@+m+Y4l099LmMiyOgO@o1N`h<9FY}l-)1A!sqS@UajJEMGm!03%GYrE3uHOwx^|h zRJlx*jDtqfFVpsM@LOG(2l6N|4-pnGqOS9BMvh8kan4%%GVjF9OtsdnB)W+MuAIZ> z;E6xEL|Wc-j{kFqvnMaippl+#3=U^VnW!*UT|vL}M_NDM^yc|O^tUTUE&=bGXcAD@ z>bc^``)K8O>x5| z`<%b)9HHaKzlwsT%Sj-0&}g)eh!!GG!w)di>*<9Kav|nN}MIWw)__#QC$FI zSCbVpf++}?(UqqK%5zN?W-O>6+PPl=sPE{(6%CtMu}ltx@FK5+Lz7d&cVD zKi{6N3-M2sT9RkL5dpe^b|rVV1Jbu4N`_rcjyWMyoV~OHC|>$a7@6Vzx;d+L-$@8AcQ8%$+-B4Ukb6Cr6$;O$ zaIvu{2PC$g9xfjXnT6!WG|Gngbb>s+9!4uG_u7|zj}J#O4v>R@%9|IRdN1ycY@qs9 zrNmsDjBf6SXPr7piAIuC)R-jpl}3_R)IkEP#?0=tR*&{~>Q}R7=F@=utNg}?b@v!r zz4ibiva=HVyW#O0Q@AG4;nlQ&p!=1|w)aE1NbB?Q;Rn;sTKYd;YJtr_n^i3cO!06m zNdO%S1ip|&t60Ha^7G?u@y0+*hUVmN(BX0Aj)6>TYvLsTkD_IXT8|-R#vEK6Cam2D z=^%08sysh7hm}L0`6sHn@;~dCx2{ap%JbH2$?7yf=}Z*au79Okv0$3h^thddDe9QP z#i%6W`dZ14)PLNXb0X%1i#jQC5$Nrt|_ zi&ut3=|2qTzumph;f5gIY0xer+)eKklSNDbISND;bv=|pYLaPIzt+E7ZlNI`nW6xc zp@b`uSJ^lsjA?(V7luaA>L?O+?MQDgqk%;pPkr%~w@Y-}!}8C4@rbmxfqXNA;eyEr z4ZMyEBZs*~6k~GHzE4eN7^m48VO95uEh(ZqlcgtSIH z&(RjYy?uL*9sWZSgA;WDfbbKhcSp7ajCmDt@_60ol|rslrD zK5qIYG3({<1asSzoy8<7PC>v^*g6k)tLVj3 z41HQvlPx#2zN`6N6xly5ptMo^`x85v->O+zR-ndA7JMqRne#ApdY8j)?E@c~v%Q5+ zciH{1`W@z+3q>(k%5st$6@;X$-JPOb1P&9xc|WOy{Qi=8AZBX5lRS0eov-}yK+x^r zL3;OkDo}nA@tFrAIv?ydoD}OIRiV=t9{|4)ed73I-wZ^VDC&!VQ&$w)kP7jpPyA!{ z`y^NOj+jr~h`pZD89+)@h>4Fd$c(&#yAHs!{)~^0odw0n(pME7@ana$epeDn%#GRm z%Lk0KOvEuK&;AFlx-1me`}rDB5>|Av#_=PC?eG?at+O>=aklH-DFx=2?faT@&3vfX z_g_yl+4)FpUFgzBm(ldG{eE*KVdhtESg9f`3mGYL2v9-=!aq)T%BdP_bo}~Uc&3fL zoJ7S1GJ0XQcc!7J5gSjsmM}@5N~>D!3{?eqjv$^J{HC@5?bJk=Bs@N)tJJEzPwcE6 ztK{3-0Nbil`=qD(zqBjqwC;W)s4yD-VmSabF$R=wB=R0#*#ao%7~BGQU)*)DZ)Jej z&4_it{g*42ym7_fOGXPp!7@Br9O{C8_jdrS%<~sk25ZAa^Jh2dh#)0Nfb+}nC_&=q z&iy3ct{VAVx-azZ4&l92yD5Mk-2JeBt^L10>`8Xh(_m1x8T+r_zJpu+^WVAad#`Bk VYmK8^%G?A0q$T9V3q