From 55de19d4d5863a2b1ea20b7d98161c314403ac12 Mon Sep 17 00:00:00 2001 From: Christine Dodrill Date: Tue, 16 Apr 2019 21:18:24 -0700 Subject: [PATCH] blog: site to site wireguard part 4 draft (#33) * blog: site to site wireguard part 4 draft * blog/site-to-site-wireguard-part-4: typo fixes * don't curl2bash * release it today yolo * show permissions here * oops * what --- ...-site-wireguard-part-1-2019-04-02.markdown | 1 + ...-site-wireguard-part-2-2019-04-07.markdown | 1 + ...-site-wireguard-part-3-2019-04-11.markdown | 1 + ...-site-wireguard-part-4-2019-04-16.markdown | 346 ++++++++++++++++++ static/img/site-to-site-part-4-gdoto.jpg | Bin 0 -> 48992 bytes 5 files changed, 349 insertions(+) create mode 100644 blog/site-to-site-wireguard-part-4-2019-04-16.markdown create mode 100644 static/img/site-to-site-part-4-gdoto.jpg diff --git a/blog/site-to-site-wireguard-part-1-2019-04-02.markdown b/blog/site-to-site-wireguard-part-1-2019-04-02.markdown index 21be021..7fa5471 100644 --- a/blog/site-to-site-wireguard-part-1-2019-04-02.markdown +++ b/blog/site-to-site-wireguard-part-1-2019-04-02.markdown @@ -12,6 +12,7 @@ This series is going to be broken up into multiple posts about as follows: - Part 1 - Names and Numbers (this post) - [Part 2 - DNS](https://christine.website/blog/site-to-site-wireguard-part-2-2019-04-07) - [Part 3 - Custom TLS Certificate Authority](https://christine.website/blog/site-to-site-wireguard-part-3-2019-04-11) +- [Part 4 - HTTPS](https://christine.website/blog/site-to-site-wireguard-part-4-2019-04-16) - Setting up additional iOS, macOS, Android and Linux clients - Other future fun things (seamless tor2web routing, etc) diff --git a/blog/site-to-site-wireguard-part-2-2019-04-07.markdown b/blog/site-to-site-wireguard-part-2-2019-04-07.markdown index c0dd1ee..beeabfd 100644 --- a/blog/site-to-site-wireguard-part-2-2019-04-07.markdown +++ b/blog/site-to-site-wireguard-part-2-2019-04-07.markdown @@ -10,6 +10,7 @@ This is the second in my Site to Site WireGuard VPN series. You can read the oth - [Part 1 - Names and Numbers](https://christine.website/blog/site-to-site-wireguard-part-1-2019-04-02) - Part 2 - DNS (this post) - [Part 3 - Custom TLS Certificate Authority](https://christine.website/blog/site-to-site-wireguard-part-3-2019-04-11) +- [Part 4 - HTTPS](https://christine.website/blog/site-to-site-wireguard-part-4-2019-04-16) - Setting up additional iOS, macOS, Android and Linux clients - Other future fun things (seamless tor2web routing, etc) diff --git a/blog/site-to-site-wireguard-part-3-2019-04-11.markdown b/blog/site-to-site-wireguard-part-3-2019-04-11.markdown index 40e9364..ec37d8b 100644 --- a/blog/site-to-site-wireguard-part-3-2019-04-11.markdown +++ b/blog/site-to-site-wireguard-part-3-2019-04-11.markdown @@ -10,6 +10,7 @@ This is the third in my Site to Site WireGuard VPN series. You can read the othe - [Part 1 - Names and Numbers](https://christine.website/blog/site-to-site-wireguard-part-1-2019-04-02) - [Part 2 - DNS](https://christine.website/blog/site-to-site-wireguard-part-2-2019-04-07) - Part 3 - Custom TLS Certificate Authority (this post) +- [Part 4 - HTTPS](https://christine.website/blog/site-to-site-wireguard-part-4-2019-04-16) - Setting up additional iOS, macOS, Android and Linux clients - Other future fun things (seamless tor2web routing, etc) diff --git a/blog/site-to-site-wireguard-part-4-2019-04-16.markdown b/blog/site-to-site-wireguard-part-4-2019-04-16.markdown new file mode 100644 index 0000000..5862cc0 --- /dev/null +++ b/blog/site-to-site-wireguard-part-4-2019-04-16.markdown @@ -0,0 +1,346 @@ +--- +title: "Site to Site WireGuard: Part 4 - HTTPS" +date: 2019-04-16 +series: site-to-site-wireguard +--- + +# Site to Site WireGuard: Part 4 - HTTPS + +This is the fourth post in my Site to Site WireGuard VPN series. You can read the other articles here: + +- [Part 1 - Names and Numbers](https://christine.website/blog/site-to-site-wireguard-part-1-2019-04-02) +- [Part 2 - DNS](https://christine.website/blog/site-to-site-wireguard-part-2-2019-04-07) +- [Part 3 - Custom TLS Certificate Authority](https://christine.website/blog/site-to-site-wireguard-part-3-2019-04-11) +- Part 4 - HTTPS (this post) +- Setting up additional iOS, macOS, Android and Linux clients +- Other future fun things (seamless tor2web routing, etc) + +In this article, we are going to install [Caddy](https://caddyserver.com) and set up the following: + +- A plaintext markdown site to demonstrate the process +- A URL shortener at https://g.o/ (with DNS and TLS certificates too) + +## HTTPS and Caddy + +[Caddy](https://caddyserver.com) is a general-purpose HTTP server. One of its main features is automatic [Let's Encrypt](https://letsencrypt.org) support. We are using it here to serve HTTPS because it has a very, very simple configuration file format. + +Caddy doesn't have a stable package in Ubuntu yet, but it is fairly simple to install it by hand. + +## Installing Caddy + +One of the first things you should do when installing Caddy is picking the list of extra plugins you want in addition to the core ones. I generally suggest the following plugins: + +- [`http.cors`](https://caddyserver.com/docs/http.cors) - [Cross-Origin Resource Sharing](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS), because we can't trust browsers +- [`http.git`](https://caddyserver.com/docs/http.git) - it facilitates automatic deployment +- [`http.supervisor`](https://caddyserver.com/docs/http.supervisor) - run background processes + +First we are going to need to download Caddy (please do this as root): + +```console +curl https://getcaddy.com > install_caddy.sh +bash install_caddy.sh -s personal http.cors,http.git,http.supervisor +chown root:root /usr/local/bin/caddy +chmod 755 /usr/local/bin/caddy +``` + +These permissions are set as such: + +| Facet | Read | Write | Directory Listing | +| :--------------- | :--- | :---- | :---------------- | +| User (root) | Yes | Yes | Yes | +| Group (root) | Yes | No | Yes | +| Others | Yes | No | Yes | + +In order for Caddy to bind to the standard HTTP and HTTPS ports as non-root (this is a workaround for the fact that [Go can't currently drop permissions with suid() cleanly](https://github.com/golang/go/issues/1435)), run the following: + +```console +setcap 'cap_net_bind_service=+eip' /usr/local/bin/caddy +``` + +Caddy expects configuration file/s to exist at `/etc/caddy`, so let's create the folders for them: + +```console +mkdir -p /etc/caddy +touch /etc/caddy/Caddyfile +chown -R root:www-data /etc/caddy +``` + +### Let's Encrypt Certificate Permissions + +Caddy's systemd unit expects to be able to create new certificates at `/etc/ssl/caddy`: + +```console +mkdir -p /etc/ssl/caddy +chown -R www-data:root /etc/ssl/caddy +chmod 770 /etc/ssl/caddy +``` + +These permissions are set as such: + +| Facet | Read | Write | Directory Listing | +| :--------------- | :--- | :---- | :---------------- | +| User (www-data) | Yes | Yes | Yes | +| Group (root) | Yes | Yes | Yes | +| Others | No | No | No | + +This will allow only Caddy and root to manage certificates in that folder. + +### Custom CA Certificate Permissions + +In the [last post](https://christine.website/blog/site-to-site-wireguard-part-3-2019-04-11), custom certificates were created at `/srv/within/certs`. Caddy is going to need to have the correct permissions in order to be able to read them. + +```shell +#!/bin/sh +chmod -R 750 . +chown -R root:www-data . +chmod 600 minica-key.pem +``` + +Then mark it executable: + +``` +chmod +x fixperms.sh +``` + +These permissions are set as such: + +| Facet | Read | Write | Execute/Directory Listing | +| :--------------- | :--- | :---- | :------------------------ | +| User (root) | Yes | Yes | Yes | +| Group (www-data) | Yes | No | Yes | +| Others | No | No | No | + +This will allow Caddy to be able to read the certificates later in the post. Run this after certificates are created. + +``` +cd /srv/within/certs +./fixperms.sh +``` + +### HTTP Root Permissions + +I dypically store all of my websites under `/srv/http/domain.name.here`. To create a folder like this: + +```console +mkdir -p /srv/http +chown www-data:www-data /srv/http +chmod 755 /srv/http +``` + +These permissions are set as such: + +| Facet | Read | Write | Directory Listing | +| :--------------- | :--- | :---- | :---------------- | +| User (www-data) | Yes | Yes | Yes | +| Group (www-data) | Yes | No | Yes | +| Others | Yes | No | Yes | + +### Systemd + +To install the [upstream systemd unit](https://github.com/mholt/caddy/blob/master/dist/init/linux-systemd/caddy.service), run the following: + +```console +curl -L https://github.com/mholt/caddy/raw/master/dist/init/linux-systemd/caddy.service \ + | sed "s/;CapabilityBoundingSet/CapabilityBoundingSet/" \ + | sed "s/;AmbientCapabilities/AmbientCapabilities/" \ + | sed "s/;NoNewPrivileges/NoNewPrivileges/" \ + | tee /etc/systemd/system/caddy.service +chown root:root /etc/systemd/system/caddy.service +chmod 744 /etc/systemd/system/caddy.service +systemctl daemon-reload +systemctl enable caddy.service +``` + +These permissions are set as such: + +| Facet | Read | Write | Execute | +| :----------- | :--- | :---- | :------ | +| User (root) | Yes | Yes | Yes | +| Group (root) | Yes | No | No | +| Others | Yes | No | No | + +This will also configure Caddy to start on boot. + + * Configure Caddy for static file serving for aloha.pele + * root directive + * browse directive + * Link to Caddy documentation + +## Configure aloha.pele + +In the last post, we created the domain and TLS certificates for `aloha.pele`. Let's create a website for it. + +Open `/etc/caddy/Caddyfile` and add the following: + +``` +# /etc/caddy/Caddyfile + +aloha.pele:80 { + tls off + redir / https://aloha.pele:443 +} + +aloha.pele:443 { + tls /srv/within/certs/aloha.pele/cert.pem /srv/within/certs/aloha.pele/key.pem + + internal /templates + + markdown / { + template templates/page.html + } + + ext .md + browse / + + root /srv/http/aloha.pele +} +``` + +And create `/srv/http/aloha.pele/templates`: + +```console +mkdir -p /srv/http/aloha.pele/templates +chown -R www-data:www-data /srv/http/aloha.pele/templates +``` + +And open `/srv/http/aloha.pele/templates/page.html`: + +```html + + + + + {{ .Doc.title }} + + + +
+ + + {{ .Doc.body }} +
+ + +``` + +This will give a nice [simple style kind of like this](https://jrl.ninja/etc/1/) using [Caddy's built-in markdown templating support](https://caddyserver.com/docs/markdown). Now create `/srv/http/aloha.pele/index.md`: + +```markdown + + +# Aloha! + +This is an example page, but it doesn't have anything yet. If you see me, HTTPS is probably working. +``` + +Now let's enable and test it: + +``` +systemctl restart caddy +systemctl status caddy +``` + +If Caddy shows as running, then testing it via [LibTerm](https://itunes.apple.com/us/app/libterm/id1380911705?ls=1&mt=8) should work: + +``` +curl -v https://aloha.pele +``` + +## URL Shortener + +I have created a simple [URL shortener backend](https://github.com/Xe/surl) on my GitHub. I personally have it accessible at https://g.o for my internal network. It is very simple to configure: + +| Environment Variable | Value | +| :------------------- | :--------------------------------- | +| `DOMAIN` | `g.o` | +| `THEME` | `solarized.css` (or `gruvbox.css`) | + +surl requires a SQLite database to function. To store it, create a docker volume: + +```console +docker volume create surl +``` + +And to create the surl container and register it for automatic restarts: + +```console +docker run --name surl -dit -p 10.55.0.1:5000 \ + --restart=always \ + -e DOMAIN=g.o \ + -e THEME=solarized.css \ + -v surl:/data xena/surl:v0.4.0 +``` + +Now create a DNS record for `g.o.`: + +``` +; pele.zone + +;; URL shortener +g.o. IN CNAME oho.pele. +``` + +And a TLS certificate: + +```console +cd /srv/within/certs +minica -domains g.o +./fixperms.sh +``` + +And add Caddy configuration for it: + +``` +# /etc/caddy/Caddyfile + +g.o:80 { + tls off + + redir / https://g.o +} + +g.o:443 { + tls /srv/within/certs/g.o/cert.pem /srv/within/certs/g.o/key.pem + + proxy / http://10.55.0.1:5000 +} +``` + +Now restart Caddy to load the configuration and make sure it works: + +```console +systemctl restart caddy +systemctl status caddy +``` + +And open [https://g.o](https://g.o) on your iOS device: + + + +![An image of the URL shortener in action](/static/img/site-to-site-part-4-gdoto.jpg) + +You can use the other [directives](https://caddyserver.com/docs) in the Caddy documentation to do more elaborate things. [When Then Zen](https://when-then-zen.christine.website) is hosted completely with [Caddy using the markdown directive](https://github.com/Xe/when-then-zen/blob/master/Caddyfile); but even this is ultimately a simple configuration. + +--- + +This seems like enough for this time. Next time we are going to approach adding other devices of yours to this network: iOS, Android, macOS and Linux. + +Please give me [feedback](/contact) on my approach to this. I also have a [Patreon](https://www.patreon.com/cadey) and a [Ko-Fi](https://ko-fi.com/A265JE0) in case you want to support this series. I hope this is useful to you all in some way. Stay tuned for the future parts of this series as I build up the network infrastructure from scratch. If you would like to give feedback on the posts as they are written, please watch [this page](https://github.com/Xe/site/pulls) for new pull requests. + +Be well. The sky is the limit, Creator! + diff --git a/static/img/site-to-site-part-4-gdoto.jpg b/static/img/site-to-site-part-4-gdoto.jpg new file mode 100644 index 0000000000000000000000000000000000000000..4ca61a6198fa7b675390c359afad88bcb0f067a7 GIT binary patch literal 48992 zcmeFZ2UHtNlPD}3aKZ^=G8mhjF&Tlu_BA;gBoPE62a|J7js#(_$r)_2BoI;LU~&c% zL>8DJa?Y7wzWeR_?%A{dJGHb~pmYKPWDIw>K@HaPg zban**u9y*UW)D}#-*_+qf9Oo86ai2Eja&W;Uicd~`4_zTPa3f1D+0|Z0e@`z#+XpX zl_LVqWAc}D%fI0N;7cF@kjhxOINBO}J$^0p`}DsST+KZR?EnB?IXHSbTUowwef*Lj zCG*FM_NIJ1j|HC!hyehJ0LX3-T_rXry21pwN_K^a?8;>` zfRP|DBEt52_Yb&!^VSWLYou3*h_4a|-0uUf5U#p<^(N`9J9lrA5|IF|5Gqe{?fMO} zn-9pJJfx%&c&TL^g}p^V%_Od&Z5ER;ODhO+a(@?5iW#P17WzZe+0`SusCaOTMFa@Z zF|l-Ui~OElf@c*L6?^qQv#bGZ`XMkjtFgI%V2F)9T|!3QB96e9fzZFMkPuq^uhjwo zuKmgQ`pp}JYigr4XsTk+0c7~p7h%rJDr`M(>XjLxLDA=v*gl$6x#^o-L!tYm&N%J*tG!7qI=W;nX_p$QQLj(mxU8BFsGf&W> zdz8Y>Wg*sCLxaf(&J1xsUG}@T$>3a1H?)n;ezpz`VeQ|Ibb52q!AMki-Ekt^He3UU z9`LG-Mb10idjB&@jixv(iR0$1_Gg+HT|JK)V|piv`ogF7(mC&^4V@L{bXoL#OZO?j z7_MPVuTGMndgsXVbiAyy>@x{Jb+Nno63gv(pR%IU~?q zT~?Kc{X=`7GvFyJMRKEL;bS$uE~#keS!V35r6fLawQY%_t_)h_B&S35OtspZ86+1i zLd#do#jX*ZpervlwH(RT_eacq?qp<(ck8ruvtWyGpMs`^p-y_@QH;~rPkGWV)YC_9 zxDC%BdR3M2RwI2HV#tVsaZGNJGIZJEeQLxPS$Pq*m}05W-u9`flJ7##_0&2Hs3@SP ztwV3dC;U|h7KqD`AMuKOG42&BM(N%Hptvkl%vW@0l8eXBW2_^`PX={5d*+HJF_8p4 z*Jg41<}rZ_NN!FSwRnd zRd07~sYR=%!FomL9mA!Jim^@ikO>V%ZFTnHIv_PNbfk*QV|-q#l1$@uj~G<|DDB%C zwqKg38LHBiBns&EB@ePLI5I%pe6iwM&5KM`OtHz!k>7J8)oIPMP3agEwGZoJ!aQml zY|9-S@#p>Cz2?-^Mx))OVO%k`(0!Zg&a0T7?-iQLx2YuFh(Yk?V37QCCMFT|yA9P8 z=1P=sbE|8@ey8EfALgc5Wha^u!+Vp_T{L?Rx}r4cEr->$Y}{=R_wH+T{c%E#Fnsx< z4I(RipVwMhgI%yB(;37i(4KsH7=YLrW2xuJbU8r-ei2!e`%Ah zGe8G#AZ7kUVdh%8vJ^ioWu(nykE%@x=@M~Sjoi33HT%3pPhpa$P@1uIJgWi*T?0AC zPMDS$uV`uOuT(#hj!gevD6ONx`D-DpSfM~Qg~x6T(&o89`Me57Evf+(BO;U%4`CVmNDRdR<*)q@oofJ*3tl(h52{ zKD6pwd0#(+v-6gvIAoeERq{+q+}vOguxNfU7wnYX9cfGY&M0uvD-*88@;MU2nwppx zK|dnWW42qYUDSRcx3Hh3f^S0!&Wwc=>G33dc)P22TW=9*CSVX7JK+>aotzsg0)DEM zxn=`$b1^d89FsxGk_XRd?vbWdGB*i+p&7A=PNz|dqX3=R*|OB(Ca^2 z-Z*y|XGB&GVe@hnW^)6x#bM+)NrMHKy)dwg_r}^Fc{GBil;&&I+YYv$5gwCUuidA1o;8Fg`e2)Dk02=huwYbVTIVRiX?V}F~ zm8e)C_xn{BM)9IMQKZJFE)q(oQ%vahxL0b^{z~wmV$scCvL1$Bx2slGu`sLhyR*GB zHR4az*oLl2=O+w_wv8jW5Vi$~RaM03s9A+}B@$lq6(k5G&yQNGj)q(Kgv1t^$8s>a z4g#rLnJPEE(?#-Sa1e-3d+LKK-Wphi)wBq!-2mI8UKIw{ZqizZ{IXM4WV+IldH$+Q z=6+);kb_PWttRshdy}hvoY`x{RLFHw=;#vQln@hl!KV9dGPHB$kfke@8deh{1Oj?R za`J+scDT6ggIDuycbicox7ItgF9D=#w25!J3&5<7jkGF(+mL7|EEkSCT?ujguXoy4+9eK$`ELHa z8zE3uAawVA@v?P8>BD_NJr4R|Rc$Fd{f7?=%jDBDB$VL6q5i8RHvsLDo0GjxKmY~nk{ZhFhdLpj9w6A8qw28?+(=G~p+?6lU@Hy}3!`<-=z|u19ymq-6c$H7)IMMqv|5~!?C18qa`x4;E zbA6CUKZjF`UHW@ZRoXCRys%!}M$aA4TR!2W>e|fY9}_xha11 zWbNlw$4c{aEzKojM+QsjDr@a$416s0Q~YGcReC*O{=}Xj1`r(5a6HL5<-l4WHL4h+Z zv_rj0dJIa9Q4r%Z5(lNSL8kHqZ)HqFzfeNTBJ-Qco__a;j^SFh)J%tu7p%_4zIW0* zPxMZ;BXuJ816Sixd^$$I{*>kN%Zh*~Uo2|Yv-!~$87H7Msh%XjZ87nUu!JzoKYS#;3rY4x0=##o`qoca>pKAAHv z?~Al2nAut_OKHbh33n~5u~OU537DWu9&ZTt{^q0Qby$CYhDLi*hCX5jhNrDL?CyjI zsgk%nHbJikN_ax@)x9XzTPA0|MNNV9aSF6bdD3`M>m?SKvkjvp0 zYuT2g@f&6HrlK|as5`>VplK16wt#45Y;982yQ6EZhKpJ!JU(J>L|b=0*Z1b{>8?pl zy2zheT>>m}E^IxVdKlMp&J)v)OIqr8*DI$_c+@Yt49`0(FG$zb7becFF9E;yH!U{4 z`CloDJI2<9KI*}}I3qIU-$nUR`rPxN@4pxi7(-kFk{JF{Y{24#OZ}cs+IejK>6bIA z@wA@u6YM3RVHG`cEue^Ez)V`en%xhAtu;I?JU>ulazAw&PYneYiZVCsVFdShDOjwFU35Bia4DXbvxQXR)3F7eP|Ok1u>=F{E?$)k|z+f z8^xVnILoDg!q<0$UExoEotjFTHXV7g^fV(jr0 z(BOp7=s|J;V5`#@vSL|a1Q>F_W_YQ=2g7dGJVlsCCv4=O5LO;>3Bp4N_{t8Pgs%dw^Q-QF)Q6CWE> zRy#6X@J?sykRq5T|8gLi1onQ>;AFPotG8EP{KaX^;aqLf)b*bU?|KY{XYzG8luRW3 z)LY+juAB3$s734W?%fCK4GgJvR?pNxIud%LB=b73G>S zxaL)B-So69GA69yU_n+PsKyshi3cLN`}&QnrmyV=dIe_*fB<;bwE+}D<5 zDZ=G`Ghv6;LE#FceVfUFtmkqUMUHAJ)_qU+(!Q)Bc+ow|tYzhQRAEfAV^lRjUU^<( z{mzhqA&|B@Gqhg6^bD~cLuREu8P8t37a1w4OqU)*P(TW_O%y`IJLciBxOc)x^_}h6 zF6FzAB6fbZpE=n3eul_I#?k}bBE=-9Wqmc!T{C0qS@mRLCcpfyy{UgHA{J(|v@~C6 zywcJ%wC~JJIp-fsRW|mL)MLRnYG_ByA|0jMy+4-coYU7g`I1b>}qI`y$U|G)Jby%MB39 zSf(gli9p)!OQMEOSJlC^2Qv+(eJRjE%xF>>X;ygRMJJoyL@@6jH?6F*!V@z`5iM%_V=)Y^N=y2 z=7mLhxGr9^&dvnWG5S0uSJesbul@H(!fB};J`D%+06B%hgQhl}LJtw;Zk1 zo@V-0O0n<2lHrgPehG-Vvd=8dbtWQIZV2Q>x_0|BP$uDag&55%evChR9u)Ne%Ukzd z2jif0_x*PuxyA1DjDr-IRpoxsj88l?y~mCO-)d~5_8xE3LzjX?>cd`oVpt=KX=Am) z@(+|9mcB1h7};8fElpH$Nj6m~Z;uFuEN!~ne1s?nXRW4~*r?&yQ`J1(pW4@E2ol;n zfUVS)WXZW>9F`(_6SJ+nbaje0JJW_bx(~ZY@d03=m5&<||^E3TUxfK>9tr?g# zyRfG_Rp~w|*t-fa^AZUL9P5C*WJcnfL#Vj{{P{`@Bqv2mT^li5wp155mal3(@vXv= z#FkSxa0_e5vt_iDknh zk3jjVn~(U8&&~7ByZCn=)(>>1#6B(!X&V7KdZ(Su4PVRImZ4hfEj2w^Lv|%~y+QC| zMa1ax(Qt1nXv(LET}lK5 zh%q;6BN*zkrSgUfoY(Mj1N>$v*m?r5O1{DNJGJ{>6!E?an42;5qSga$T}k$)uo4Hl z;_JXXw_1+;q5a;Z7%5Z=No}<2fZL9;POU;X?4kh-c6DD7w;Mjncz???>Gu6UhRmE= zo8>V1rW$1V)=W%HZcHAbXxC*@t5xjzW1?GIe{o^|B`Bj1KRBWJ5@0w6YYAdBV^dk! zF#6@o{o&11Ja2aY`%TQSxPCb)!<|kqb|o6)S8+1F|1r&~>TUx7QI>sjuX8^w!EuQg$a0&-mJr(!Mp9!oQ=tD6<`Rpn5Q!d#phi z54C1p0;o6Vq?3FVpI>~HWZb+N84zxq!Ry+rVphy99((Ob{Ssi#sCo&gZ@qd}FJ}{n zt-A!YxOQC#J-q~k-lL(Nd43-4Cw4(7hIHqg25qQydI_Ky8$I)cO zrgQR-j3w}_Wrr127RrSAZyZDvRoAZfJtEq-uFA`5>p^v&rF4y-@vQ{9=&gywagpXZ zI;JCnqHxA$fxn?k8Tqlj&(K{}%qiRkQV z^Ijt`SZh#FJf(vL?9z)ymURxvGiy@0DqK`PiLwVR3k14;`d-JX)`4aP4o2l?wh5Qf z-c}7tZ*kqsuKanRqMCSvFS@_7Nb7)kBr|I*Rw1I=idl|3=AL4S<0W9Gq`B@mdh)eE zt0t>72deb7DXE#~`>5gZs!Zgk5>3{N_v}0r10a6xSyvpBo0z3EZ-o7eCg+OOB}1}Y zfB+XVpP&B{P;nBa?tKWlm|6>Xf_JT!eeS;ghY@~^+n!1{C&vWcxu7W3WPWOxQ?ixT zqOAyd_4-6Z$%`Na#za<9~m`q9+3475;JwqI^?$q4`Tr7vr0 z>(8Xwru=*~fIfl&;(+6oLxM>uQ6aemJjtt{PkesB%dHj}iLCk_9j(zJTwtIjPs^Q* z-(g~k)wTpT#y^O$U-`UW*8c#@cdokT2}&!NQiDi;3@E(zU{h#(y7`lbqQE6CNQKWFa!}8zJ}d9U~_rtD^>aWLd2Xm?PYvDm1!-Lk*{jFS*%`kS%*=i z)uAqHU~D$j+v^c(cv1SsDBgL$+V5}`$ShOI9#~Q@r}Kel_X<~Jk8dldwj`(FPr{w# zc1WTAGS(U98+{h8wYC8}hA>HkI9agW%xc%*aU3d{F9p>jn!o5G*+R-++{tO5OEmq_`DFVgWdo!rVzG3C1c-;(?U2m(-W*%3T zvXi&@emZ1Z>Y06n25o^>n~^oao`%#1n8|ECvRP5`?DrMI%U_I`)W2j@_-44ArPlRT zJYZhV)G9!h#yBT=vf?LhTl8+j@G8m9qHS&}GBUe3mc^|2l?eEC4>LWYNQI++j$>qQJm2oqg~uKU_Sm zIwK|zAClxv5~1I`NZhoLzb`f!;1&^LM=h^A_Ms!l?t!R;Pppw?VjhIyjwE>m?3L_o z47}KxYez(j*u$&Ogl}Qd)7){qJ)DZxJbe(Y=!zXs)Lbp&Xx{I(;Vy`?(iv8S2tkpf z@xuZ|O{5ULhjuc!P3`v6+a%VNf-+Jb6u-_`zwm&JeVuH|4e~McwGsB!AX#l?ey)t9 zzS})648_^YRc`#cc)PMLw^$rWdY}3oR#qOBoa`)u!FY9BBZr%YjyiZ4lbb|vo=hHJ zFMjIe`cvgo+-oPI@+Cc2b1$nfvnfjhjqSpni#LseZsOMXG8@IXYatER+$Vft9Sr8_ zaK11gRf0Ec5M@zdFuvS(#uz4ak4XRx=<@l%s{=p%=s@Xn2fN#)GA z^^cWMfv0>NO?(aI%2)NCuAiJbqt-gdtkNE)+-V(CyvMA`o{=)J%eGvi?KWX#LFP7iDva^i!?iLJ7f|{mZt3YcP|k~nH`!>aXZK2D8b8pR)-<=nYh=BuO)Uk(VmxDY z*dhll;M!_kZrtAkS+yi&ZL%U|T{4%_r|luy`ne<)7Ct`!um82D{8t@KLc<&oU$Ol6 z^F2+ZjIH|U2=U4|s@LOmZl!Zdp)n7Kuv#cLsUnH%uYYQbDoj&wGgenp&?A$$*jBxg zZ&#Sk-F*nW#45>1I~>go8QORqrx{FMNl4IOyYJU4`wdkMo_bu(N}36=?oy^ezmYJr z^vg$RAulTLkJh2Y&FY_fNE!b1RDb5jl5k&CAkV=AH^R>I2^jq~y>_#NEWgP<$dT zy4G{~Iq#TJWg5+`9W1IgxB(;vi44ZC@H1m?ZW;FY^XriE4zdVH(>GN_@pBj02hwY; z?^X@5_L61J)^=5GVDNml*HT|7F;*mcV!Cey7nU=Qt{be`DWU56XTDm*S znG}UgO(arIsY&|5Z3>#kM>fzQIgF@`Y6N*ru>T8QFyKl9a6N0XAxg;aYn5G%U>|&% z&ZP1ugl{O0QiOJ@w!cT#1v=#NXiA=2V*<0>T^B+rHS6Wz+DJE7U@j2!(V-Koh(^Bv$)5gPRD$&syv~gBl~X$H&KitdS;Y zjuzSl7I{l%mL0aR>eqePVW$nbO%de6ae}1mhM#Ms`2qEysUV=li>y|2_#^&oFSxl46ccoeU8U zu9lEJX+G8SAUtez=6q=t|FrHs&XH2=k>lfY9*}nlSUr;35hv;zHbn2^T>99i3r%*) zx7gY}vwSA2kx1mR`VQc1W0M0n1={-e5zgO}-2NK@2dV)urr_{&)t&zTKge@iH}b}s zpSA0Tn-I{^mjS>5%AdbRgG*FAdBM;j*ys1Xrma>2W#%x_yopxlk9n5+ zl6^B9ks9tkGzio=;9Cb1rN5l9)ehbi=6pRgE?2;lf0%L!==Z&z_>Tq$kPKjWhmTR( z7h&-H=|=pD%$X$Pl()NhglTbxhJT$!`T4EQGeB_aVf%i>3K9*`<~o9S_wD>Q%In`@ z@uTN7el=$z}V4V zU@0ajY*P@%VYA9l7k^^Va&Y#NSjA*=UGG3@e1v%r$+bcwnn;18pv7Cav2_;JuCH>( z1+TpzycfT+F8;@_QtiNIR0;bz=d{B<>d3q9SSWd!IP~^f0+qdXM*Y)op$`kl89*#$%l<6#)B99LzF@`X?BgGTuD7D zDzI3!Pj&rCYt=5bP}~{aW>I9V@EcTc8+{EsU+KPbnr9pLQ?|#blp}KfExLt3%8Ai^ z8#W&r4PuTIJ(e$K10BW4N<@h=el8W6%v#cA4!#8J>DRBPKg%I@m6>@Sp^(Z9I;?N) zG|R~X{>bRw`PEc#@yN@=5i9-P4VXX;-~VWp=2K}@1LG;tfaNZ0n59a~A|g{Ea!dvC z!nfc_YX_3%!gm^{^`oD?DmDCs;T(;a*l^2>od|yO7^3s7s-H_RtB7lVhr7(hV^#HF z%ihiZ8yVG;qGEn1A6bok=qX(D-MR9uf+hQr@*fGI{xa%5d&4may~%jF7{E2w7XX09 z-O6)~=lAa1p6jg1s?(m{9_B7@FNE<@QzqWZeyx(W=LT_uJRDm0_OFbnlP}+IhkHwh zpMx0htV2y#c=9X2CbpGz`Z?yjl>%5^Vak)rd9Yk-=ZaEde1=Pm26@g>gf@Z#Twf%$ zV)3((tBLcd-pU5(wi__h_3@3s2d4#wwS6=i^*zfxX4yV0va<+WT(k?MC{R=VWq-jC zs?HnVRr{LgtsAy^QSMCQX^+$?$TO>y0<-3_uH!uRV8prEiE-NXM$oK==H@>D=1<#uyqHKmt7EiYNTB?6r>!j!Y~#JM=>al)_@E)~6QKv^~brYQ-foZQc(4y5K^R{<)_Yj?0nF)Pyz<6o!b<6TR6W(B@bHdTyURqIArZm1%IW-6N>l znY++B&#i}jyq(!R&foOOt-mxTwMU761yAL!#~l>!ns<#WPOG|9fQByO$5B0&D_f$j9uhCf zlO!@C`eMZ#XkrtYc~?B+&k#Y({7O=zUFWSVfb_T|R;Qzn^JmglY~6zL3-oq{p3NaTZL4zUbItuW61x1W zKZ{$=So85W&i!lKxgEYgwAx&lD-?#Jgy&t~28Fvp8HH^fJ@_HAwV zR7vwRIwLxLEG|WGpJ~!|$Tm_ZrI;{u)wbrB->t2l{=U0;6ys$HTlrFV z{ABI~Zo)V8v(z+a(rp`yH)ng-U4)TUElRAD*Qtc z{$kJ$P5)`>-iEyRr>6WTG2ar;2`8oDSl?A{G2w03*27a#Kx6y_nfV#DXcJ884zen+ z$2B+8bai>gM^Ecmk5vC6EhQJRu0fugr%%>=&!E!se=-;twiMhEXyM|HYYOootHux? zpwQoh%Ccj#sRoAz!KO)T5y}t4v}(VYq6lHLL}a)u0mfdhNs~g?u;G8K=CBI}@C!__ zW;eu_3vV4fs{eJ&y%5_4QTMNGkk@9;HFNo9+iQ!QPsmpUMo`6PlUI5gT>{Js)EVnj ziO%X}*qE8vT>QTNxEA^pVn_=!m}MY$TyOL0`rxJKo0#}a(mZ8j>@li}t8vV4UrQ_j z8dAJjyg3B@p8Oml@?m2%?GtPOZ{u52_8De@Mtn+x9(l`)^m?p|$^Nmz4E)3jeUwem zrLwf$0G6zg*aAm}pn6rJMq@TC>R0>nchX(Jr$%x~yhLz_sLmN$<=`Ix}j zBy?FLH1bSolPY^5D>5>x5I!_w{b8GY&m~}Jf99;KQQyO!T3*}+Y3~`^XWXKdRNIJ_ zP1MDwhkRwmZa^TirgU9Zn_b18_c8@`muIeg+1jx3&Z-IcQkeA3uWB}aKuLbkt$9Hp zFHFB>D;)*#*h+h8vWnXRP44pqeC8eVdFLR0uvt7X#tZSVj)vf;BotDFqTDv^!@#c= zQ<_Ls&~yFGb5GrrQOC#vPyT!0{8nXkwWSQCO_r9PT}Rh?f-3!+@QBaz3#$DTVqn<( zDqovxbCq&;5=C56G15_WL0ltEAHAkXWwwK4Yn3~fmt!p+fR?23TkDbY^PtNnVRR!_ z11b5ge6p4SF)W*C+)lJ>wz*<>zT)g%>N80vQNw!fjf5vLR_3mE-$j>>T1==Mc_nog z1itxZTclhLRcgyPTwR!KhPjj0pQK#?%jkJyJZ^0)cn%lCiN7P#vUJxxtTb7(Q#wQX zSXp}26zOsO5{J`n(xGxhejv>F2RbLs_O;rkJ7#fkS~`6Sl^n3|BBa$#x41H0)?6a?~A=3^DSo`IJ z^2vJ%eRpdplv^dg)OLxMI6sFK&TWe<3iCx%C=ST8CU$T$mHezl;~0n@t=#e`n#lMr zFXAzIV#6qU3DC?B_`v2_X7UWt#%sqgyB((!b^WC}KPGB~+pqC`ohQgI&b`GU1tO}R zKmEgx<#u`X@W9sLq-4;xYAvsL;`?yCLd?T`zfeMCnrV5N&0O|bO(Zknl47xV09erR39P=J)Urnn0uM5a|AjMNk^Z zl^ue%VKI%N(4fbzDs}uKZFvq!1{F%1TU^U~t)k*h>&YFws2_m%? zLkct0|DrQCifsN86_+wOIoUJ5l#^|3@$)SJ^Lm*msrTzYWbdu^?4qRYG^@VDX`?O6 zv>8&;R(_$0y9D$&l0E*<-Jicu-}|CX*?sf#(|hDRM_H}z{?<^opw_KT1B!#{Pjexusmpd>JDz>+ zt)T!P$iVRmRt4Y^m3^5lK~dm_;Z-KYzS{Y1KH9X&?TGr*n*^J?6~fHzs+_?S-rUnV z#u@Ep`eBpDG~IlH)Yt}s#N>JSAv6?K9|nicsM*1Lj()-!Bmg3DABA##Lw{7ochIYU zJ&sZ9MDcN!f}u7#2N{)`7HeZ<6rc&Y_0$xBhO9)uD@LO8$B$tHMPa z=zHB{4q*nu=ZvyJ{SB(x%2uO?ylf#{D`T{p zUu&sWww$XoS4%Rcw$Vqr{ojH^!GQ@t4XvtJ6CZqRhaMn!7g28Wo12fMTmV>+g0vgCP0W0 zLPo9}WiG1*IU!+U2F27WgcLI|#>jxd2BijBJlQol74arYhb!%cEm|Z?h5j-ya>||u zO?RX$n8KCK-0rHzZ+PYocqR3W^zS(#4Ayn1cv{mEVoyB`JmV;aB#0>Os`%qtZ=|wOGj@r6wdJ!A4r;5onZfTVtGsx zZFo;*nE7yL!)Mteb9vz5+UjFKbH!ge`+o$zvgj9%l-SKld8M0PYg|2K zH6Y|4o*kJjHB4Kj7ynYTzXd3wZ9XD!beND|XeZ$KQ z9f=D*Jk%VhoWzAXmNwVy+rc6pMX%?=!K%~rJ{jb~Di9i_sm1rL?T+T zK2!TLHqaDnBx)!)WJcPy>=FQOXiZ~zyiP94OKn}XdDZnnSJ+cO*}BEvsRD;P^utHT zwU>Ya(E6j0Pz>2h;8EWnm4;?zbBTFRTn*l%rvnLYc1FAP5`Z>$>sWseoSVouL7-x& z?8aNbWEQ?=>k@-l=55zP8+B@^xc8d{w2E@zy3Tu=BHpRCS{2XG`RJ@<2s+nXYqDlPBMF#YPn3 zU{)KZ&<|lU;c^Whe5bVXx%iU_d)jjp68E9x2k5z$dbYHGHS%^QZH_Kll9;u7}i&Ef)ya5-*oTp@HOe zBLRDdKLhP!;j1z@3O!L-LmMVH%(Ru_);Z|a9T}TDub>C~eg&%iFBV@Y@5eLszeX-m zDnNX1!zPZX3eMR>_3KRvAeuQBp#c|9nO`Wv`jQBf#0nBmERQ$*w(Ap5jO2brN~ZZb zEY!vSo$$9j{#J+o*Ly>Cn%E_P+fZb$Z|o7^9hDW*0CB!bR)3~MY~q7{)aWuIh4G+7 zJ(k5$*QybwqRQ-C-19x0@TV!6h+%>AdE~6(54y0Mp5&WP7T;b1cubj1|Dqj#E8O2*?QbLV4@3O7 zdHvh5{9o=;uME`Ap{i{-yzmOlNXKoaczIl1_e4c9tjN&hP-MVnuNpx9O;)8n|&+;1_c#N9zJY<33q(k6Jv^=X(vB4T)+n2DPe)@>u`j z__xFiJOOdF5k+PZ8u`}T$%}mL!Gu^rrt;d`_5g;$FI^7W%B0smhz^Lq{W3LnGgq{Wbg8ivO*>b(#J&l7GX3xV% zl!t(3N5*QYOx1H!y#5g}zjj#N%ZN4~Xwrqe0?}?V$kG=C zY9ZZnxJPs6c?z5epE3s?R-d5c4%N@J2r-xbx}WAF@{;4YQyadrtS7y45-{j(cAgKZpJHi=r-$Oc;*rGNXL6NxS^&T4P}9!QCrW}d8Oh7PAA zkw>?hEeCGKML$_<9%7R-=Rv3@=v3buvozReb+gqN;iq-1h^Y`$4(p1Vv-p|g;6V~lEO8JoDZh#iI0>mG;0*CIu9-?>@EsquA|Hdj)lps^tj;V6|I~tEHv`p4ORKhm4WlB>m zSrHOtD3qFoh=#|Mc>fMlcCVa6Wyz-oT)m+Q7T9%-nZmwDsyfD;l#PU8YZP1OZXKst zfnH7&leXsaYq;a6)!`egO@4+MS{ zMNgM6b8G;vh1&j`s{J3I0^4*9@V7fo18Xl>Is4oG>PSQ#1Hv47rFp0e8Vfpg!uWjN zYgZ9boVQ7CkDJ6Rr~ZoBc-s=-)O+S0zmJ>U=dLppOITCaD_@F)JXru=1f+Qet;3w2^?dw*aR)ZBt$4?lhJA*AW2EpB5VB@HBxia@9z%KX_0H3s6`^ipEm^)Woe=z#xD8JReBX-sMQ$gRw zvTS+K2%o><4a4xTBO|NL*AjM3y0u|w@nX`HS&0#dtX*CfJOQPyCnX7_VWmf_jy>So z*k8r@h78&?xF|iJ@O3*xEd`treG@l14RmBbO3J}QOKNXW_D^_L2~b&Oui+`wTLgZr zC5vd;VIdX0CepXO(Z6!CX?}U@ZC{gkZva`svBHQy%Wm0EHCQ9P$T|*w<}%nV(a|j( zpy5Yx*QN_=d)=}!s*5RdVriqT>%SpF6P8A}H9FfwR=&s~*RX0JBXbKU#|oXLJwx~G zs>-ljRL%IeGUgaEnCAG$nD(Kqf)^dysD`Q}A97CtP)NCb)v1P1oK_unw8FCp<_d~# zw&;k+4Zlm%K;Q(wD_3qm-^v&Nh5mx3 z^r}fY?9tlomQzIDg$9P1qH5{T$buiIYPl2KI`1#l$Db^DI&mcIbrzADa{iN=YNNI5 zXiaYM^V8*N+?99!Yqo?=ZtvMu&lqCUsdFg5p}+eU@KST@w|?iQ3LMvZ{7CdDH^)V) zg^V_?lwt-%AdgCgc@;BF-B%BGcsTIq;p-A{PQ+l<9?TEs^r0kJXWpoPilyr1sV%c~ z_Z}I}s#@*=*)$E0u<#`&ptZ`NiQ(lK7BIxt$#%m)+cg-CSCSGIY3d6x02wFem71yf zKqOiqW?u?<#VU1($=S+BhO1Cuv`b104!L%976xtxwHO; zwn?p!Xcg8wJ==B5cx=TGBClVxpQq9FdQtUZuj(;m00>`C%pHO_>km`5QY+I#bpsl- zmEEQS4Tn~FV+61-HZd$}F4|kEtzKCvm{5$N&48M>O805jv+Cl)5stMJ@w4)LccxIY;)OSP_Di+b}p3 z;_?=j_vlAE`&TNvv`y0Q7(QB{*ktGnDIy`_7lS6HPb`^aDHBk@h`MJF!Ra*TyDQLhwg(uMQ)2PDF`{V)~<+{j58k&|A))x zDO-vO3O%G{p4DvdjQce{?21ircocH%md%{`hI136`_GFfI{M#LeQj%dbxb$L8JoFp zsBL<$7YLWwdFS`Bne_xXVh(Q^1(bW86+z92`wdb>8e&df%`Ct5^S41C!RsU^WAh{x znRU6xPbyaN_p7omD>v?Af+D!ZeUM%r_j|=(e9RW zq}XdOOF$t9g+hY!$4lF^Ge}mKSUP{YkkWh;u6+l|$`$%*kHaX3TTEoB)c+rQZyD9* zwziG3R&BM^C{}zGEnZ6TQdV1}P^3UYut0GLR@`A#uwV;!Xn`ULBn_SfDeh1t1Pdt= zERf(XU)FxVGxpx!80W`%zaQT@XY34q_?ZitcF zDe}`CnPY6+_4aWR1wPFVsfZ$QBu8g?Wz7ri94q16!BOys#h$KAOl1YnMBmsi34ZC- z`D0YylnUGykfCW1sWkw6Qttp>{mc>)#jshxtIYAD+*Ic(R#!@SoXvj7j7(_!uAKzs z4wu^*7uJ)`YrnupE+y-2OMEBWmv^snc@=8OKozl6+;+{g%HQf}yfB5ljf{cO%pQz; z1!Mpu0(}^}WX39Cs3r~cN_qMDd0Ozw!nLxeerDnlMqTbLX#^a~_o+4#X>>uiEFxmM za$tEnBL+B2Iv7+aAMZps!^UfayE<0R-Q0}b4BNOb=;jx^OzM(dqwV7Q+Htx*xVv$) zvv8(CKzpC__pVusE%|W^OI%SOG&i_}z`Sc5ktNbitZNqR&sACLC7!;<3?DFQe;Wgi zWJ`LSNk1wUDOHWnQV`IXM%+6<3om&VW{RehtrHcG6OlofIIb_4!*XS53vlVa?50^u zWFtU7&v3)^4P89;Pib+OE`L^ipSY@xSX0Zyhomf=V>9l}n?FwMm=Ly7D)u!NhpB^; zPergvMiKI{4omjS>E-C1Xh$Vb;kOyefiTZYO|6McwO{*26kioM4|CL>@a`Sd8faRO zt(~e?cVa7tx>P=f>uyeDH^m4KJ#7v#<+*C)^Sr}Gc}Ig8H|=S$p#SMxyR@PrQ-QOI zC(H(@FPInRvVtS*#tT4X6w`AJGnN~!wQCqp{7PaD;g-kDOmZCMYleEcJ?baYTaFeq zGKB0mBJ_U!Qse9;1vJ~xp;h%z*zs~DcXUEBqBC%a2E12h>O^WkI8}`Gikj}Rq)kK1 z79^9}o?z;`ZW8oeE<3jt&sp976MB6sO{pv_v6e6QQs5pdN^fU2-PUU_bMdN}l=g*P3NbT^kP}kLxyW`e5 zpX*<`SJdkV5`p|j9GjoZ|1};O@I*QNM`LWd%m4jZr$SV(=4TR>fF{|nWvb( z7r!%aln*{YTNN$s!(ZQVk;ga&8n35}6!H~0C;MueN!A(8h=z*^;W14cGa-v#({_Bo^1M?A_>Jf zuI;G~+In?^r~19<{Uxz^*kYU-JEp?_ChQSd*2;smCG$#gKYh&BPTB=syoWk{jU}61 z!Qy+nELf5Pe`%?gVOrj`SIe$d%;wm_`=xl%p!g1&zANeByg)mo%+3g4Str`Q!jP#(& zIoJNDn$i>J-gdo(_}@}PNbwZ{)+LFC?*1#oX!*<%1q5%HN}+lM8O3ZzgTta<6RLq7 z$rz)DpL;{p4fV|^a@Wl?UE8Z4q6~)g`4Ukbz#H%+A!V9~KVoqSpk`xO-f&N@TGr?9 zV{+YY$M2m#*&nLpTSSL+wfDHycS}gF#?&~-s$=x!NSAGKDjOG{d3L4NWJqOaJkhr^ z4%Dc)?+oO$YMqm?M2Jt7DA=}JJJzV;Jw3xeedIYxZYP_t#hD*1w3FW!F9G8tZ~xIN zKiT~8DuLC~)^ekC3V**84TAG4kw2G-GCaD|KJ+N zokP}_la^WXj0*46Zd=1U?b{<06R~0! zbS!yUU0$d^r_wy6P8G-{F~sj8Na(XtuWaoM%iqkmeHU(FoNGe7nFq6yZWIOm9xo)t zAY?O)6-}>DT0&gAX2iQ8>qyNtyWaqmbsd;G`2zW~o4A5>_UnZ3Bt2Bg5Gyn>*F~aV zesWRpN~s(H+L)5BG%ZBA-|OtLs(l8_O)Bzet5aW#-0^}bFela+`l7*AL7+NAW;JiK zRcS?kJEVrl_?FdL0qnS4V@Ma?a8*n>H?U=I(j7c3rJ+qCm`u8@D4pyXo)_c?UUr)O@A+T1J;qtlFCT}_A;Y4zygdd3zeAd}6jGw+ z#kaz)Fu`1YUeK{8$RB>QZobhhY%PYST(?-c2|D1Ub~!<X-YlvG}0F1esv9ke`g zl_Fz1)=j_bi8HigY&mvlym|1sprEizoV?+ zXReoL`fm9MG!;Ms7!XF-G<7M{jT~r9Dlx9uWrhUcn0#&?ABq%u8^~?c ztU$vhD3q%tAK;T^X@wz^V?{jOPj)du3PJj=}|9MF?=K0wUQ| zVaJggihmqZ3G*>2ZJoSB1_=9#71yV6v=tQzjv#oHx1P~E4bc3GV|hEQ93tY7s= zUUH#B!ERwZwA^RoriJJsxO``G^|oYTA-o>g@%%Yc^3c<`i2Dy9O`80H>*F$|P}s6a z0k4p08R|B7pd(_GJGb=Pl3+AnJ8M>?rDVU_(uzZ7g{}8V320SHroy+kY{UyDQa}l; zO+Iv8jL#6A>wJtc*MnNCt+@L=oaXd~l~q;7gq3@F^%t!VG$uj_$+PpR|4S%hk1)yx+!)9((SjWaI`4 zn*Y93SWa5<5pa1uq^D$921;DX>4xU?gXBVTiWYCCA#iH?V8)czzO;FmeO6)7H+Zgs zc!tTP4B(`5CP1>FUjJ1CV$$eF1`w1~kf)}q$(zXNi&h-1;EY-{Dl%|$SFAosVUK7F zf!mXkk~Z{s9*+#3Ex^78C0C5?pv?FoSiw_xRjsP0hz}DgC+8k{QY`)E#}3pp8K9Br zmLYS3d!%jo*SPMDlkS*H!3gTcDpoFN-Mm=1c^`5RdO;WPS^jLYQO!^`u&YsB9>i|L zN$>f3@H*DKd@pV~4TcAb^Y_#RIkYZe&xCwQkxY%&cG!i8$_rYZcTs}-nzp9)R4QPT zs?XkG04JG%HW+H{-<{$1fnv#)n>r)4S<3h-u~*YYT4QH{Uq!n2<@VRzW|>|lz*g2a z_6+nv9sG={BwLg=&SqkfT9{P|jaf8o1eQyPM=|NM;|{1thY8-G}Jikhq}xmdMz&T)@iU&@d%+3z2v77FJSG0FSO3 z88>(}`6WxJcq7=|8g7o$-7Z)!zWn;-Tv>(r^S>0b)lxGs#ip@rQRISxB(@@;9iq~& zkPjZ2>1)G0IOSX1U9o=#X;+Khs2C}Dm|bs?%*~^kVCOFG1u$#((@Vg?N3sqlgL1xg z5vo<9j94H3Yk;s-6g!J`9^jj{fP3|1N*8(e6mt&Yd{x{o^)0D)msx94{Iohe4W?I9 z`!@0`Mc_FkfUT>VS8j7a>9SmQobEf%zLQY4k?ILtVpZjq#P8*$Y2FaN@f+f0)^VWL zapfd5<9DQG@Ghabx`aL=JLTZu#V@FD3{lNYKmze${Ade3t>{jcV_&YF(L8`Ls~{;Y zkKH>g($ONR+4ZDngh~>*W;`X|rKsHXWFqV?P|dfRV4V~sK>00=WlWY?HBEsR=%*nD zS%PQ9d%Dny=xB+Te5S6>kf`jv11LA>pHuc$j(3d+d}3HkC%=@ONgX>nTh2J~DV_V}Td+suv*U#*Krl{aC~ z;+UqG15iVoOMPFyi!(8K_PAeBk>g_~cD155a(uLt%0B`aMXz4a6*x_p^H!=4rBB&M zN-w={YFH2{BMX&!g=yQ}5<`|0hqLbAC=Vup&y$f2*`_T6)7hh;*?XpKgZea^gUg|- zvAI$%aKNYx9V(qkKIusSo4nf^91tG%#e4fGU(nqwuZVW9t!=!QO9f|4m2z!-S+Xed zr6%~O@9c>1Zkm}dDR6fHJSA2Z*8l*ji+d1@mAOj%qk+)d9o{ITX$kM7A9w@p>`G&M zNX>?2Z46Pj+M=5LXfl`0M?WP19bMV_m6GTp*V|_%7)X=N)sxQT#QH0$^MMZr_t!V3 zw!Cp_#76EzkJ|n2l3P#k?vx>P@oiT24)hw2gox+#BbZ{aVfce^IEb$EJ|Ir8p|*> zxT?y_06pG@-BV`$`$1kR+g&Zohoza#=IT{jK9pQ}&$ZVE6DAqt>xNSsESfV*!!uh~ zR8zKao(iUW;eT~JMbP?otx_BqF@4RLdRU=uU1hN&ej z*p&~_EMGQzVdJlPbh;DeisDLPyQ)C)w64FyZIjJV&d;s>zE?-zm_3}U8#b&W+kD84 z=5*Do9xvd2w*x;}h=w^st$Bsy<7|#gSo|zHq_lC;IW)Xb52+59~5H8be1}K3o3tvi|M;jm8%c0?W;@q{L!DS>Vi(jKbsP|a9AC2r$=zrm7{J0 zuhVmaR+TsFdtYadffPL3_mU_du}IpAM{LCnU47e^TS==MoFo^Gf)y>|wsy;7QX3h$ z8>SmsD`Y1yV3y6!0as~bzL%5pp;W=~^kXimaxT(>}Yx9u<1 z*dgne;ytB(KG3YNimU}gj4Cv{MA}Bx8>wnhE7gM$jyZiD?LN_U7jNCK50vrgB>@Fo zee7PMi?RZ8kU=v|v~=3}6|zT5m(OkV+ozS`y@`)+oNO2d-wBSldrH4Q6_}` zVtEnUB7VcH4L-i{(kGhem&KgS@0YubB?u&Dh*mbxf}S0#rc#{i z$Z9$b*Iu7I-p$@j{Lo}vbp9@3g9}|PcxC|=6pmgUJy!DPO8gM>N4TT0C9fn57ceLn%O!##33{~_mxWzNztogD~r~JSxwvPrBG-z!CX>C)4RL;xUg@! zVXfYQ4cFpa5uqXSIIBr*WmP1**$|Z5!xS?H?Q+9z%Q@A>UX|_cA8Gj65RftvbDQYA zP=c(P<#H&GfZ2cVQWF*V&gg8Obh>e74ENm@iqFfkhpP+7hM7fLq`%Z@;g#?--@fPixO!q6qdrg{%gbj< z(zTI!-9n_B+8j(_Wm99kS9OmFhrmQ+b^SWjDIF0qmJ_Jq?h3tM8~f&zCEZ=wTIZHF zr0^J(C-gRNZ5TquaWt$q8g02IW`in{oAC%uTSOJ_F{Pwzj`Ho3r&xCrjHt6`GE61n z;8i}Z)jN;oTP9$Rh$qaO7(`!Sv2_=-tr)<0*aqm?B?c)?aCp3d1v2Y*7mqcePoZg3U+R8T==WJp9esf6ft$U69 z=TRH)M^C2P)MhZa&G^K*C>MH~AOZv<~vBs3^-;X9}9= z*~3W7ID;1f)B;KWwGB>({bbKbZF$j4L-F6hm`aW-;=qx_11)2cU5MGez@k*3;{kRu!7;-lK)KLjq*9VFYZ-Gq!Ee!R)cyWV*Tl@P0WJPJ!YCH5 zCVZEkrE`PgkjX8;!25Wpscs^#CsIUVr$FQoP%JN$m*xu?RUYo)NP4wMGt==herjqo z1JPnTS(JzPO`o-_7ZTspgJ1rwhDgb1o&)9?j`kf4H&;Ua=fk>Vn=a@?2r3ib&Fyt; z)R&&=TLph#(h#TKF{2;>XSqNn0Z++PPLkS-oWp;;JD`a&{A6Kc^ckbdbzR>LeR+{3 z<^1~&fb7Q(d^>)I==W0*X8Jn57_BZNqcJ^^#}6N9@G1sIFM_kiK)gOMbT3wh8OUHI zZTOVSvvT^AcZ-BAztiLdX3OwNGEC_4$aIkpzZ8`!tFBG0-8)FooW|;XY8#lcL3;m= z<@=?5HpWX?i3BvJev(B#vgZjoCa`d~OT<4*)1qf~iHED|9?PUYGOVGfl1Vl>@L7n+ z9xL^8c|!j0-sp&TcH^15b&z_NgCMBUw${|tS&_G=j6O5Z%@9rrwG+09&pXP64Xj&6 z^SGJHp=Z&QYu1x(Gudf7lx{jsIrINsOz6Qa9kX1&QQx;yg=!$c&lr-DzS3Id8||@a zYMES~#F1lhJBwD|Eno5#SF!43SK?wOv@7fjpa;@4;EgNjOW7~WGG>(E_>kMF7@})U z9~`f0nsW!RB-FG*E={-HUWYaNmz9IVDTjQ_Gn@9m$5|n(%|*m(5+y^DM_;WJ=`}2s zNv%3OlTdUXdd=cCtR|o>dqiOFgbMK)6+^$knYId$AUQsCW;001w9$+kU-M`ujNX&L zEj3Kyc(!ZWt`81n#MOOQ575amanHN|ESt+Nd_0N#+>nEtRFVi6yA$X>3{a05V5&It z;*KiSjEn}Uj!Nt3r!-na=S!hwc?oa&ML&wmUp?|k4KUGhC@=LyzUK?4059mCe^@Z) z)RqbR;OQXXu3%_W-(ncEC3Cqps#KWYne^prnY)0Rnienho|vweHE~*D4LUZ70Q4NK znx%e1!~kbtia@D!(s`-i-n=kugJm_3Lem0q4F0{8%cLBt6;S{)m?IZaECZNhW5QZ@ zK*g^9{6E>JBiyam2ZEg^(i)VxGWq?2DkYe2W-5g2sT*KJu-%Kqrii4d*@GD|?ysK~6jbCMol-7mRb-6FFm+gH(KKc){dP&N_Ma}Q@$S}DUQ(7H;h(WK~svbPY8LQ{K|NqhHw6B9L} zU4;eOZW=Y)Z;urk=H*g0)!vM$Dlp-tm+aREDK)s!0Vsu~l1 zX;qTVLJ+8e6VF>vaFBXOcY?!ID(x|ns-by&?yfSeB>S!|w99)h0wW(rcAJK~ToT9L z^Hmm`GlyGJH@_u&ZFIQ(>W7^C&rV~&gjQ4SvD)z0b1uxMWeWFi|3oX0*uY5O%x~R`E z<$J#+CTobqF`amL@U-dO*etQ7aA+}hmrD8bd$X^sWtX+wQ>#eb^Oc+Q2R3%6zI-JN+_dA#gAg{jm?VRt7Y#E^0~x0=C$Bb zK?)vyf#*fh_z&Q8&-R-Q9?8904LqgCoFm~e6UI%$_b^}#R(4{1RBNd5&L4}GBE7WdKOQ7PQ%b5Ob@8a|n9Mx$8GXO^OWJ<~N*)at|i>Aj)g1c0+?9y9PkEgY6r;F#CcUQA-bF*0kYKdssMs;DgJ;OBJcTO5dG zo(ivv5lhvI&wH59w-9^}%}~0mzArJTO17>6Aw%k;nf3Jz%k=%!ln$cyOUl{v#x5b{ z9}FhnnQ-K=tsXc)7DVEkGOn-2=7VNbB_Jl~WoA5nO{c zE~>tq_BAKuD5IMXD%Z9{3R&jQJe(=Z!)UPF{8V{BNk2m@dC7ZE?x_%@9G*$W=IaZH zIX^}Ri;j4?lSB>U($Rf4L#AIIhFjSk`+mn|I{lR)ElF`T0-8SRsQrM7`B@6hjeZ<3 zXk9J;&wv@X8S3O|XZ(;KB-H)IRKTW;FLv8r8;_@dn8_Xf&2S=HETN(C9QeA%#_#mE zi03;0N{7()!{Zz;=$-@%uo6^E;HOnv;qRGf%`@s|P;bvRABG8;zy4GBf-cS-ZQXM6 z^Ub+#{a+!(z3FF8zLR@qP1?;_YjdwD+^x+RDo+aJCiLGfuMZv{e^psZ_*B4AMwSWC z>*N&Zl1=+!+b1$xLu@noKUX`C+;6=9KZ;u;tpTqiLX-s+Zhjj}-&ub5c^Gb~WKJ z91LanN6g;HtFrwp!pue%4$$uQq$52xC|06=`EDaW&C!9m(ZqdRVwBAhX=KzxCZ@91I@*aKQ1#n$@%>t$p5x>Z7c+<4SyumIV%gj)0+oGKrfz&!mlw*{`b_Mk z%-(tcI23z&zYNcVIgtuoBR5a+z*PY^>({6fPO~}PGiL6&3?YXCn);#Jbzb}A1VRWc zOW;G?xFh`8sBkYiJ*w$Zd-MAQ1NS^*TJosnf^Iw7?ri5AneF(;r4EbogdK--$d=s9 zS=W}+O`hzw0VA>ISz`&PC^z#BQcPcw*m`YPB=R3X!cY& zUA&rpb6`^|PZmPYYydlP_=#_1B&vf9dCza#KIwkvhs8s-6Fyd94bMjM6%MOJI|ovQ zOUotsn)S_@8Ey2aBN$}%*^QAb9r~??J}nGf@V9}r`#`J0((*PuTcR9k{gbPj#QC;6 z=UK=GjO?Pq-PHMn_)w`UC}j@Es8fWX>N3e97pITlkv zdEe>?Ibl&a2JskA=P4F)1{JOX)vS34eFq%nzT4k}JZIUGRi=OIqx;o!)_kKuWwX&b zjNz|KZ*wG-TkBc(>k@kRKJ|r!7$xjzwCcN#?qxOisoeLQ)0=VDSB{Yn@x7osegE=E zao+s8-l=m)AIlx$uaVn6?H_5jB4Tpqb?p$0ux)pW2i>rIx6gcr_dhLsV+;7VOI_ND zNjni~C+1y(o(a4+^bxE{)}>5G%_@NF82Ym`n>{Qv6&FlgF-jS6w2WIa1>#H|sk^^v zh2P>*v*)hwk8YN<<%0;*SYiIlWU5CQ#-b(xK~qYBGovx+d}`t6hfng$ zPAV?5zP7ipfn-54O!W2iucXy%^)bb1(71YPRsW#u`-u4D$ID3+0o!fv{$WGf^ibR%7`)OQ*xnzCF;F{5_cv2%nFyf18 z(aG6@XKr(~NP&c5_@IzBsluqUMa@ff{&9x)eymu1!mU-aU#(8fUV>cff6N^RYGK$9 z^RK8%#`tdca17H}iqT`GMv|O*M-1sil3B^gefsX2nKDV)sh~!5?{Q!~U)lRLycC$T zLPG|KQ1$Xtql)mBgx@U;mCxVilWgv-)7yW<;QEoa&Ypmzh|-eM3H+u8RQ>Whe+OaW_0EhBCpk)(crgOMzgHDF6P`gp}{D)N7%>)Bb)9BeO zji}7pt4|nBSiqBZBCY7|Jl6Z$uKVx3*knct-+Lh4a+ktv&>4GL~A<7^0d8@y)5=?oJM# z4JCUuDfo_WzMpn&l!;6&2x;25t82su>baRH*93#Y(Ml6$cpVJypb$o>WG!+dZU#p3 z^6d&f=o(IcDikk;__e-*`0K1ht!bTHp=q{`d3Ca=A2HREK5K(U9h^ybW3R`_j7QfV zpLTR^zZlNIe#6A|Tm?j}Dr7Qp zH@6CflJk(6sZ;k*@b66AFm||U`EKy?1s$XJDcs2K%de|3{L1kPY}P&Q=4SzWiK*Iq zLntg`@p@Jn%x@*o1g#KgVTlCq6X79Afxnx**pMNj!O|o4_9}p`Yi^EJZdurQzMpLC z^E-uuE%1FHX+v^V=1zS2{n0;Wi?y&CS3-McHBO9+Ehjyd>_Eyo*Yj8z=BBwN+V<)} zj0PQM?)4*mFU>R+y)>RM%9!wR=Ivy`B0^HD;jObV)#o1NQm&l0RKMjU^dLa|>>5f;X0zz?L#RxohXP3mX!dZ9I!w!Tl{4SiuS)DoaN z#Q@NKtf;wuU7!CEy0<)T`)jZhUlt+JvU}D}=g2T5VWH%whrY&}UW_>|*r0vChcj`m z!+ByKvEc=jFe@n7qy2Heua;dJY@dYT{FKg;N5WJ^uT*-BOLX*#9|YN~H5dL1Sw1f1 zr?alWx3?#D$@d9tK^Xnv4n44+ot)KITT~5uRXG=bX_t!YOw^vP>;9x-QvS~9#{=J- zpY0|{0^|6QB_-J$dujZ3_llw&G5PEI;nDuV5l3@_TAhufaqBDsjw7+z9&8hrz?B4~}Ww#pYh0nbG(XH18syHjG9ZIs4}X5GU)i$^+KYx2{%84x3k($^uOTwYO zOb^T4-ZhG@vkIH_r_>DdZtu8ac0FZ`6d2_85d;SF@!U5zYb9x#m~Q$C+ETMsI=%ML zg`#ghnE?)Q+aKBSB#O1!axI}^R18StMNO|a;kK|1hqHN;32qynJ_Ti~cL!vi4wRO7 z6(+`Opw@xT{}3TA8;8b>LnDYgWNj1SGBYM$?U~9pi#2aQD^NS>111$rT!HXSu0R_h z9fWu=It%+iFEg>_ilw29g}zP7D|6DyLn$tHct+l3AMj&Z@ngzLpxe;wsdBHiDcS+)v9c`c=Fst4!B`Vr-F6d5zkJyXVcps;2-cD^O#HQc=C%Qw?H#7P>+ zGg`72X(rm(pcg)@f|XUp{F=J+_H01=6)$>3<;B-v*Ar6?a&9Rx`!3u0I0qOKJr%=Q zH{F6lK7LRS92@MMj|G2PSpe~B9bYal4>FrGs(mFq+(#2A3>Nj7I2v#JxdwV~6-jyDuhs6LR@&~pZrm?}8kkN4U?i>*?QnS-RkH8fs7 z*JQqRS-<77*ehD;U?E>ztWMT=4XwcruS-;Pi?6G3;)+#G3`M%PQYwOuB4;^Tx-TAv1TE249D_`(c_rmw$MN@aXB) zo=M8dJwB+NMtVoDyQs0Cj40+g1p@q2z7TXI0?Jq3#wOTYZ+a5`NM*X=+_*yi+AjSC zU2FPr-TAio1>I{C=5?p;Y;LVUGMQKor|qEY`*K#hgiI3|%Qa>GnTAF=p|yCT>v7#g z3RQio&HCN$uzkaFO}_W4VmlwUu@X7a2=sI6ecab1li>VWD{R4xV*D-ikVz#OA@H3u ztitu-$)idHF)g%tA3Gucfu8E%d&gmC_X+OF8LP(V=ti@xmzS5s4AvEoQS*Jq8)Ka9 zC!wooTVSqSk9K%|S zttPQKvv<|VTWc%Wblwld-mr!^!o~3-nvSBYf;tOX*Qd%8Jv@>0ekz@n+z;#i_L*HOb)a0+?N)1FV!p-ClFVs?BIU|kxO*=vI_ z7Ok5R-C+JPv*9(MW2h%;|Dhn4OmhW02uPc$zxz_lsi_f|s4h|+*GvyB`ltEjYeY>r z6nOJipKAi&jOpFzKSVEDia|-+X>~cLtd&7bJp!Ww$hw=7N~z{)YfBZqANR{a3aJcd zb(%s`@`I}_Dh79fGHK?oKftU&E|mZs@TFnpJsU@o-uL;SAz3%UjO;3&y%!uDLOj+E z!|mq=7)<|%uhol?jDNIecp!^Oh;gj1n%62*KWc%qZZ zm|kL|M$W9JRX08>J`;-$vt1ThAD1c{Uqrc|1fNSUDCPagEVbc*(*L zy@j(x=-P$yqov9AF!l9BRajKx&EH@X2f8&NWqszg=!rkMoub-7z8Hjg&XQpti&LGd zzN&YGh))-#i59BGQ1>I#ez0OiB|}$eyaxMil2_NqW#3?8dq4#ZU5S>IQG(K?aqjN* z(9D^cTuFznp}KW6$9@92oBJ-I%`5$mJ<(eQtZY>;iygn9GY;Y?AwfzcbtXr){Z3Bf zPc(`Kx85G=sjVvRds6aFD~GSdMMLL9gltNjpB++$2E6Gm^)ntMV5hAbreGD!N<~1x zw&AO?6E@Qd%U$7*Vm9H3Lke3u-Nh1c#;KwPMs}GZW%PFy1x?w$W7?hl|cMNZPE~ z01y~_2@J1+!xHE{(HzB|mNd@Ej?|ic*rXd%ve|?98zLI$T^ag2PoJRLyWn=}qQDiB z8r3K7ncEH1ELYDqy{LE6s|Vl`A7GGW?Kz7tJqACkArhebeWdF*^0PJb;;e*6cvy`QeA>-dB7BPndcqAVi-m(TwE;rqDmz z_1NJ<-fyTGE9`QbP-#=GTp_`svb7pOo!+Y)YXnPYG;znFlx97=Go-IrJ;k;$`Ac6i zTXi*p{g%Y8$o_CdzR)48jFCn#z~;~@?ty>5p2&9Yo5pxKUmp*uqC{=Gtq;tgX&9~N zn|0Kf%jj0L$<)_5IOX;6g8ns{W8I}2&Z2d^O2(H*8|R__0n_QAzhPQzCZ|zO5|21>$2Ii`&&Jh6w9l;; z3J3gJzac5uE)x64@PFFS z1n;kZS#&;4sIeVF%r*s1irY4!eI>1SbJGn4)CqT9%SlRV_8k{cYtPKqwGIkhtx)#^ z9jh$7a`gUTW@I;4qF5w#{x&nlX;#Lh%>U`F*!izp(MR?_Tk-$!Ry6ElJXf_lI5Jv2 z@BDQyo(azaZOp9IR<<|SnIe|cdYOTRDrW1w&yqT&)7`pD7D{ceG=9yvp}_(DhaUk}(x)S1(;4Q?8J;Gb?P`05`djd%T7ZIhal=a|4Y zch_qOu4^{lrwHKE3VLyo7K zGUzU|N&NR>cmH|nKQr+Ej~V#IByfH{HIZEmt(Klpg6Q-=uSvv2UNL57@fDjE6E%?? z((+DaR$x!;kxtYfh%;^I@K=gTV2gFWpu1%^_~Pe@T@w)0rW0+KDl*kUZ!ADF&U276+N4?1{1&cG|{ zScIls^$+Qatr4ALNXbD%{Rbd%LrVAkXe7JKgQy*rd_I}Xj}#M?7!ga(Cq8lx$}W47 zi2Kl8Sk}{1>)3u2odGXGP^0;l-Rtg^unTW8qIwY!o$H?HXa2ldCqLv*<|uyE+G>c4TSea zPGW)vo2RqN4u*j@Cm_7=l+kC>^b)#&esumPmWZ#7c41Y>rvXTGOlB&x+ytfW$*N#s z-Po%olr@NV`&k)-ofoY|i|WdPy9i&RTXy}7rH#{?;;#|%PlS^Cqf5ukOI!5-dXtL7 z+RKteAVIfY`No4*FQi9(Q|IuEngX}|RB!i1N(M(&O-pb#f9>rm@bcF6lo5&Cs7rPJ5DqO5Au zFfpow7u@mHEb2h(M+vl~vjWhTN~QB^>$;hJ#9*x+r)Fn*pdSz@A^#b{U|B>CGJV1j zWNbB1v@)+(;dT)GB3E-iEBYX2@Aqll8U4`uNas67-m2ZdaN950TlHu3_G@Hkpa)&6 zZkaesrgjgY3AdOeGW)GX3Pg#0y<^0R-YCa*2ZfhUdg~99x9G8}P$k*tt4klA>f{(t z8LvLtNQ_+_`5+Q0=2D)=Z|SnEGS$M7%1+WyCJ&?Zhdbl^U;OMB4)iV9!#xf7nuUjc z!ho8#4~(WNszijuTq1M|VM$MP(2EYL16dO`)>51+8lMCWh*fY_Yl_g(fgZE2aMuB( z{#^{eZlZWvsl}QTSZ`o_%tEy&Iu!kTcpy%|_kcvs4%rhpe9bgbQpI)tm_$I!^v%w} z)6~+vfu`dGosF~eh&Kn+{~8FKr%LXgEPp;;B8F%nTo1#==j&yH4}q3ekH zf6p0r_Vmfw%`ep1e+(S%b9`xdHUH8P5SCCJ((}i|2CHwpaV*wc|S1StQYTgJ0 zj_DgvjSgOQK%XTw@wi0oO=tS9kyqB;%brH{Jq?KTtdsI6X8ktrVky14SRq?g6nwKf^nWv>CB^&a7j!Qls$=3u&hup)KH{%9 zQ0~`Ru4do`xU~C?$)!2FG1FMt&o&~;{@$dIpl^!o`r7EPpWFG7a z`I7WuPUA6eVPT+;0<77Lk2C5YSx9H|*=jX0WRyg6_M&9)&(?oqQkeI8ib&CB%^_YJPJEg8qW5vxH>)MdvK}zXwA%;0sP? zvF80W*)-xwo16F>8W$^nqN9K43`|R1%Pu%vI~+eII%gc`T2 z9siY!Br~5|{^t9rIr0}BbN`)R7e2@bSXB5xlDAO&CT0)lLZ(9D0+8uL%om|j) zg13ri*j#$WRo*sKRjdBhV%x?t9VQuWOQQ*k63%uOmx9t;NkBoQ`Dqbr`u+KQb~{q! z{gGFbyjYV`ggz}xg|GwMOyz{;UD5F2UM1(JB`L^G}Yt{OQn44XueXf{Er?`Lumjw40I{@>)lFfmM~uPh#UAIJ`^9QMRpEUi`!A3pslzj z#jnvDSy{$*koHoPLJoByc6dIy{n{(mn^HClAB)#-MQyLSXy|BYWcnK@I_C=9g4CR* zHvW(Ht~8phg=_2E@6ti_(z<5tE!7fJO*Ol1MT}8Hq$GwSW}-=Sfr~ zY${oJn88N_fq;yZ<%wnmWrjv)C*lg1Ov`Y4bhnN3^moI1KB?2c`Knybq$^oM9whk3 zaTX|#g^D7(EyrEh4IA4%9hKYcvWR0T&S}*UBmcUNn9_Fb(8xcvA~1=z-44qT60^yx z2I#JGJ6d$3&igioF_G4QYfV(v_+0&|^%Z5)yqinvkG6o6u{IQxIrUS=bc^{EjM7ew z&_2fwO{fMcpO2P+ZyN*CDv9U9VPg%jB7BAMr?OW+dk$Ygz*)QRzSu(!=-cWISgR=| z)p5UDEhW6Jh}!o16q_MkxHS@pt<}MknL3dxUB`vYt>JftNqGoP~(w>=|3e*c=BD{VIY4Ob(t==^AFL`RQ7C{&S5Z1$-xI)-2 z6o_)>?v`nr4}lMJ{Lvjd&xGqY2HEp9PK(j{ z>ExE)GSRC={zMayq~xJNZ)r{S6T!{(c=wmJ5hWE+V0uM@-hWX8k)$_TnS$50R|+yh z9n&Ya6>+)SL3n6Yu4|j)Q7e&1^DbaSyUlAE_YaW!X%#j0s1hTOp^^6p55cKp>QY2m zSi`uLMi)A@S|z;Qkff)r)+Xt`rsV(Jx-msysipdbja$H}*rgC=W6dlIEoKG0TpqAi z0(y)kC^%lXv`&)!6G*^fT%R;N`Y_s>L%A4>TEg&Vd-ht2W$ZStW;_*js$#mxGz{4E zjAuW1{rEM#cbDP?PCe^^g>NMtVOVkMp_4vM5#>3rsnB0&S3s!*%|RVno6_C;9}3KL zk8XCCUE9-bnLmhjaCWB^_7&!7PMFrd9WRfFMn9ct#%!xZ>oSc_Js@UgBsY(&)b-!g z-D^Lv9KmIvnlB+@B)hkDsx#%|E7B+5Df~`Cm?JZZ29pEceI@ zch0yW@;>kp#9i`+)MKdJ1X-%h%#skiA=xv)t|ghpjTy;bIapedrtVuoXs5@FZf+0s zf=;OWpvsv0^4$*BLAIN?;r?K*Y-`Qjo?QDb1Zk(>R240bE{T6nVV1Z?;xW0tV}&wW z5%Z-%Zkt9!UGU*5{n6~hP4zi%*rWtNenp3MsVdzceU!(FB0d)|96ua+5;fTf=J4=I z)&Eue_)mXfXxH$eC^hpd54mkO;k{D<^o{o#Bt1`TKOc0L70I?jknN3KM>xpG>OE~w zl2N4ExFbJ(F0_TM(kYlO1-(i)q!t3U&n!q zcL;)2&{kLG*@=^C*M(1s9_ROhC1=U2NyL%SjLlY{6;pN`({5vijQYw$;>tto`iZ$t z?^KU;ON@2YNJ$Gs3tOoR-_!4k78{&Z&nGmJuM&qB^*l$ky8-@)4v}YpuJ)@$oTG$g z*)$)pcg6dL3tix2gWAu2G1PtYw{vzy`V&2pt4JZN1k)P!2rEd<{LNQ+o9%RtHqJj;>|zOJnTw zbE4GHyQ+KQPJ5p0Dp5nl5TIK}Jt>F<38{EpUjM8`^R2g5sEr}XX}JJ(%Yh*5Qi{P^ zz0aW$nn3fcm#aS@hm~=gUAFU`{F_40{`H9zKe*J_~?sjZXI*eefGT+F_^d-At?GyYeePsicuC*lN z-Ed~b5iM)(J-g&4?TKV;Yt>uWFI4(V`iF3MEsB$%tk~DrN9qcdo9)FkCEfw5FQOfx zZ2P)W8eZ0FQoM)Dh^%+LK;H3AKZp@z=ectBEWCD}Y#UrIdnW3`r?bf?z6$8X;5hM< zv5HTSS^{JW&CVgcn>*;Cg-mD6fy4)4WnSw}Y0aKtlohM5JlWWWi{+d->pwDN04T$c z@fA>h&5Rcr^-Td#JE#@-KsQ36DNOB#&5(lu0@}|qMvG73!%)gS^^9-9LEpLoAkx&C zhk@MdJp4tBSrKUJo1%?s;>0g2WvXPJO}?cs8cVD^msO@wRmVcz*UCyQNVTHfQ9$+W z!TJ^>0|}7Uly`@T{X_~PlL{!45_Ju3$-ku*bPPckCW;t_-gmgiU1wVbK6qIQe2f}K zQE~o)o4p%Bn9&W?)VDqi{Z2`?v{I6ufW3715a=Q82E7^LWbb9aT+i3ugF2brSu1K zV(o)@l^c=@j~0*uYhh*vwfuJ;l~&RN+M{fB#}5>!4j_;WUW#rli-UfVJ5Evm)3XfA z?i=bC=x&ryUEOq-JQYE4^^x;46#r-d*L?9=GqOM651lpp&#(UA4fox+9&$a-^`Gd0 z3zN65llr0EKfKlCT*cc3rRIflxpP)c)Vatj4GxFGmy%kn1>&m4$01+BNnwk>WmMb5VH|^ebPJQm*!eXtX;cIxKv!+q^!s}=F z-*jw?hcGEo;a_=fSKrm`_KrKJQmN`BM*;(LzuaL+5-fob%uhPKV0@VW8>`e3-H&uE|!CulldG--1Hqs&6h z={wt8I&e_xC6y!Z(v0A};e|Nmz#Vkf(yJRf4|xRr8|0dZWz7pi#Ejp2c}`*P7YD*V zdC~dDyC7m~#q}Vhen^ahUTKQa7J`%AFC3HYkGjsmn;|=d?=Weu(w7dZY3R2ssWt%oAa^ zSDm}K0!w>dtLvCOvOCls@?dNY#V+D5Lu6&;^OCvf?Wr%7oSzdvD+n>Bm#XZh&K#jq_g(kGp|r^*5n zN0zT6^)x$vZKO;H#Kjmva;Q#)*>UJ~#os{J5y-c^AQ2)fk)LPh{!StZV_qUOie>xlVd1kh) zlg?LL3paXC$eM0nKZ!F6a4MR6gp(T2d_vT>3dnNxJ--P6xF=P*6hSMDf7)V;v^8h% z42}$5qSQ6;T{w~RUWMP%{@tIqGIxU0UH3r!3}DD9M>x(^l7d<-ZMlq#m$GPxudy(2 zRVcBK5!!t`R$QJk1a|IDa}@TBWgTYcX{ux;^^Q0e^=mtSAi>E+5ZMg`Et