From 6d34b869c709b185b9c19ed707f34e0f3e5f434e Mon Sep 17 00:00:00 2001 From: Trishank Karthik Kuppusamy <33133073+trishankatdatadog@users.noreply.github.com> Date: Mon, 2 Dec 2019 16:42:40 -0500 Subject: [PATCH] PEP 458: fix technical choices and remove ambiguity (#1203) --- pep-0458-1.png | Bin 95236 -> 23036 bytes pep-0458-2.png | Bin 18497 -> 0 bytes pep-0458-3.png | Bin 32146 -> 0 bytes pep-0458.txt | 1277 +++++++++++++++++++++++++++--------------------- 4 files changed, 731 insertions(+), 546 deletions(-) delete mode 100644 pep-0458-2.png delete mode 100644 pep-0458-3.png diff --git a/pep-0458-1.png b/pep-0458-1.png index b08801b5841cd35da8f719549e2c5377793e35f1..52bea1b29481d5e9c982eedd8cc4a585095b89b5 100644 GIT binary patch literal 23036 zcmcG$2UL?y@HZMlFAAc7NDD|&X-btIibAN0^o|4~(tC$k5LBcp5UNO%E+Am2q5?sh zf`D|90MdmJLg#w|=47}o$Wy&|Kapo2!mU5%nF3@brr2hikC!cpFgR-3l>IpMl`&EOAv&Fdd z${x!1RCI|N;x{FcbOkD$r+z$W`_wv#6@lKP;dKWwP*uXYz4p$NfHp(rACkQHj=QQwg**d-21cvofuPq(km8w$`DSGJMG#pK$Od!%yg%q63UucBnz8(OI?7rJ3Af@h>`!L}(-kq-eVRj^dUTT zsGx^dfnLrH8{^!GvbmNOiyj)9#$vx~eo`^F{cIevkN9By-gwV>D^z}$fdA3>llPvO z%^x2+*R^xmd*Z1d-X5KaQQxhhJ=o>wc>6izIc=dnus z#TLHa1NhGgp&e4i2}#hKyNV=1al)@H?MOGY1Q<-b-~S|lKx=hw&EGCiks|LrnC$U8 zSW((jf5`_zI>6#RKp-nMUJ--Ol}c??AduS2dzaoQv#mFu6?#v>-b_B)OuK6%^-zWP z(+3p>6&g5_-P7h`@qLvGkGkG)T(S}U2IY`=fAh|x1ox979}M4}RB)%?wx!BwzEFRU znoJo(b=sDDIFjV{6O;4NR4l0QP3~q5GRCL8koL$kH+i(;BsH$+KQVw9YH+M6c!Fgj zEUwqa$zecZ_je!Ft6zD3ui~b{H@YfS^lRyJ53j$X{Q~#Ck`lxGGWCn++j9z0QdzTK zitf-4$0(|{U4H-TET#A-=gT6kA63e)3Q;H6b(HfI(-pOzdt+2gTK5=l*Hi9C#(3}A zduk~%KNW~Ar?Q5Lwu$a{jn@!%UWrq~)Y8Z8NwmePtne7DbP8Gc>tWeJPkJ?la8` z%@_PH*e;106cpwaju+Az;tV?sVhXHog_K@56u&i9K>aPT$gnW|#=XP?3 z>YgeT7G%k&iff7+SL)-QJ19|3C3|e9dFxWoUdT_vg+3WSvvTq0MYcQ%ZS)m;3#Y=w zq(qYI)50rAztgc@5X$i!T)^ zbjoGRs#Ei8a?M{(&S3Atd=(^9!w@7-p z$#aOdjjY~OwfqQG&9!}Dn>6__4*gX=yZ`#L>-15Mtrk&4j97SHH7|Rbb8XOqZ+c zUBk^}Omj^P%`7Xgm!y~Q4b+v?<)6w&>n7+HWegxbzFDnquP&%zeKY-?Vx+X%r8>kG zahnBE(^C3zIiVpTq&DQ)o&x2Gh@q239A+G$UT;0m$QsFxr*x++D}}VIC(el?OnMl4 zzKc&)pYFK$$ua#_YM(lS1%dW@fQx+kSnGa=NRpyRDqHIqrU9$zjrXve4D7|Hr&gwZ zSb9BDwk);mxEwK>*(s5EF~d~c>&r)s>W`b#UzKPxUtD&YC=S(A)w_qNnmsRSCmLs5 zGWez@*RPOZyTYQlq3D@8r8p%oJuWtGYTYUQz6Mj%q4&`(!#aFIHSGKW{2=h)D<~hy zM}i=Id{6nFIe2F?Fqpe3T1j@qexqV&Njd5zTA4{X=6=cj>E;sdJDA1T5^ln5a(7&} zN;*j>U!{7nBzI~Bx|EQ+yo z56J5NupXYzTp+?IB%27;j?}&S{I@d0rPs_+d~2uu_@Ze7K5%?M@Q8ku`WpFN)#4JT z?wZCWoxu3TxO&L|-WKs(p=tC(fr8k2?GxH#sj?Z&DZUUFF$LL%D-Yu1Vm(v}xpfk% z5%Y){2j7lj`|yhW7T2dWqMR=%+np+7i^)xeX{uH7ei@iu7`#MTfv`7rXzF_WSthY4 zL$GV9v-0yutaRE+=D`x<2gb?x>fA?K#=;yXGY!ReWh&%70!C=2n8*bm8Br9=zk5=B z$)#VfXvsLKG_-*~P{-+>RrBZj%~d2$3$%tb)8Qctqk~J9dM2W#6IHg`kJ8x`nI1nW zJu||R#1!`Z!l?f=TZG%^Ce-Njw*^I?(C{9IUWd7vap4T}lZk~%Gf5|1PYeyeJuzYQ zb_u_6ZA3Jw>%vIggKAZDc9Z+rdrOugh#f^&1k4 z{Uhe}ggwRf#t}mjL!Ewye)}ERP9;I9^l{L=T{8u!yz{De>CwSJW1Kd<;#KK z5WTCCvX*i^^;XJ``EB!By-vli1M}m7yXqrc^l1|ErU9BbgLcQ^x%+(yh_#-m^cU$N zp(0zOHY2a9gJ$izC+^a_t<*AjPxf9rcseUrFV}6c_Rf2)Vr2TX@jK&`GFfYvdGC4o z{e(Wfwz{;slv1>X6M8wYp(@CMFvpf5-95J65U|R8FwmbNqcGNh3v?s25bzVsW1*e` zd)*y%Lw*9wCG~ps*6YwE%<`Bj1WqFZYIV{Rm>_RQV_dq23DP150$;Cg>F*OO4)$( zY)C)YlS*+8PWfx6@7XmbdHH+K-owg|2F>DS{2!zR^)wJhy?REs8hchIa~xBEWq{tB z*$5EdArRs#6@X?yAO;5FD;XK_^{5352L41Mi47nU65s_2CH{HT^8feH@6<$E|1fgQ z+94yLzpN$V$rX2HVzFmkACsP9{k_>p0dxS1U0C~Sa}C0+0wuCc27k<6^fN$HuvJIg zaOZb2qcIim0P7IagP!Tx$YKBh-~j~m1hI4DA(FUepu=f~ zQ~xv{&vGGSN%c?jZ7v!T-~oi$QWYrvZvi;B@YJdun_@6Jz>BA4H zP(}V6Qar;A0pv^UK&Ey?{HPfW1~~nfC#uNr5yy*ETXp7oa<~*?2QbgS&BtPS<duf`4b#HHNPswcA&O{_ewA08RV$(6$#xbSeZ0h$w+OJuRs2*` zP$=A_LJ5{ocV=A`?TnU^ToD2DkbRm6W?(=fF_*C#`h%%&=-i}>v5Nn;!%N@EmnL(4 zo__2E_Dn`nk*rE{k&!_lDo~-KI`$@hNSo2#S#IDXpqLB{+z_&d$VlR*A%U*t41Xkc z3akR9I&24#sZm9S|BpTZIiix1oC4qGKHAR1>5nyq_{PBS|J3IpKn8fA(1*z4ZBH2; ztMd?m0P!>cBjCb`s*V*&!0^NECo%x8U<6l4wrjyop8neyJ1u11hh=jVi{nr2g%`Sp zUD2sFP;M-M|I}RYsB~P@PH`^vY3;+_NzoqMQ(vgo!JlJM*M#~C$i%@n_~G~eumC5e z)zIUNW=ZP9q9uSm0Nzzn(u5v=H~jfEr+skV!>wO-LN}pZ0$sDLl*I1`xX}0%R2EBY zIqyzFTB*K4yr zo8R1-3ZWSS7|Ao$SBXPX@V{>@`iL+XGZ&DT5Sxu4F~ywpPAua6F4?2fHIvb{X$hdK^QnxTNsP#$Bd&b^Y64&2`ec1mT2_wmo z1dG=^>%n{M;0kWC9Ku#+(T*tp(4?`-u`(CEP=J*htOf+eiT@yjdz16Rqy%JMY_V2s zZ1po7>wxAgbfyiIhWTj+qQcyv)ew_rXqccgJw9G>=G_UXO!B#03nf}clA&a<=N@7# z?2*tP4LV^j)Lv9lIU13)broFULB@MUHSy5=lBpR%reNbe!Ab{v(!Wi>73Kea=gOU6 zs3rvynNH|iWMlyMiaKBzkNG)~uh6xOUe9y@j$mx~?MFh#0uz!8D!Sub7+F8$DnSOH zqS5&0tMg0uK56MxYC)+mYcZtaaO$Juos*C+7yh&45in8cZKppoVJLb`;s?zw?K#b} zX89mwIUIin@J_)LF}pUCJ4V0J)R@bn>SffJI3{`i&RD)9Ycup7rR^z&>sws5nw(XN zH{f<+ZJhohNh0&^Lt8j&#j&=tU6z}t^L9%ab1C|LjuNn^D`G`yTp#QQB}s-VY1$tB z*YSei%(kPibXo6$HZQ7uY3phdU}&o>8u_`zVNxYO%kTVUI&wCvv*-GHm!XJA0=ghL zmA$j=^L7?Ha)19Ed%|DoMco-jq-I)Y50084zNXgaz2SN?oh`BDtXMh)pFPJR@L$Ip zt?~6J{DRxTop}D5*{S;1@40?WTcqs1a9Ug4KF9S>Pbi?M$y=-u%cl8DSA$FN_IfF4 z28;CH00$&v$oc3sab!{4_rUwr{z0dai%%QYQr zV;Yc`0EM?)4Z@Wo$4>RL!O~O#cPPD{!*ZbT1KD3Abf!nACzhn=BRVw267kIVfNt+f z-EBj=zp_Nm40ZaM1`I4iAm`8g-F%7*W6E{(BYb3VvOir(;z%(5Gi^K6(tU1}KGJ%?q@J@!lx8~kJ+)MUN|_w%4Fpng-BGVnF84PN zgzf6_Y8V(yr{#xb7j}HT6}TaPl$j*X@H6g8mk3E*=~D@?v3H?Apb}0@LQK ztUNx}ATl-AE2q=N>->iK$kYdZ8f$7gSU@$~ev2cYd5s3+G`!k1F#kFoN zROY=|N8;Sj(2Tz{vwHls0UH57`&Zbk+u9C|FyBYxlPa*wZSDm25blSsxu-zTA zy!%MVvg%k-FC%V>$~=|T54hMq$xAS}w=D`r2F{Ma+|F4WI znnQ!?&{}yX>1Xg-akxu+FiQ!)S4n#6BL6W7qw(Tb*}~j*KFsyTvGQ|z8yYho0F=@v za&G7?0<*2WAigrT@y1f^5MsslW8m>9qg9Vf?O}1~i*i9N7?QA3btyd&9`b^%urM0c(L$;sPx@Q#0cPg+f+gO>@JR+>LXC-WBHpKVzk&QJH zOBD+XL5hgOLR&KDPQ)$StY^e7zID1Tbs8Po*`^X~V|)s52tfG3hx-M-roOT`t3ujm z|F+lda_zElcBTSq;jT>G!-tD+ijD+ap}!^Fag{Xil0)M#)z;K@ec5$F(X&JsR2_e( z_X43&K?Lhl7fFl~AP~X0AZEv{Up~!&;h8dW(5iCrL^Nup`)wnOMRM%Xlr_)OL(G)A?OnAapT@Y1 zu2W5Mq%$Z z=uJt!##9QgZf5fy1Z&VlK7je2_-#66tE4#Iz00%`QU0F&)07=TF(C{!Qs!j;Xy^W`>+a74e1m$1+Gn?+g>nyz^IK8rwQcFkA3pyDZ2~#Gw zGG2!q*o2()vydKN>UVxWw7=U$2~1!NU50rU5F+Mj+v!(y^1{To+E;T}uXF09WPe1D zDUB!X+IX#H8%?_Nc|FJ<6g=-2yqi6#P)a$s`Te=hmN6_P%9tcr=9xV*vBPogc8YVY z6!|JOpmnzeKo200og!4@79Kl~f-euAUg$>Upb6XeZ~_C9ba_)BSHCKSaUbx&5`-Ps z;%7o*YYloxCZ){jOZC%ZO4|prA zkFdjWcPdPt9$#4Ud|^&3n{&6NHN3QiRl6->%5E|^FRwJj)KRz)5@u=Adlf#|j9X<>#WwHC$Qyg_{S%b&(_gt8X@El6w z`gX;Wi>PI962ZWDucrGh7aVn(Yn>!}+~pM6xoEK_`hCl0kK6(lhgUt4iCSi&MG_zj z!$sY8xiFMusPteC*kFd(o0iemPJD9L4>`<5vTIp>*KU>yme1Jrf6-$j3rq!sNk`a< z%!|FJkcAY|aVkaWc#7+zhw7^$H;}Qu@KwecO#!o=<0B8XoX7Hht z1cS->Nj!j9?&#zH820acK=6K<2s$ND)8esYh;)OP};=^73A#^aY4`hyPgUh*Vuvo6hN2`zyC3YThY{PGCK1(so9E zUT%2r;hWu~3U#$b$MQ$ahv>dwPZJH;G)qY<%FHbA(H)o?zjW_=27g&@`%_1;RDQYn z>OTB;$_4bsz?6d)XZ7IO7+i_UJ`gV%?ClyT^f;$z5BO#Xa$dNY0!ZMHrJBx+99FHA z$J=2E67bZ5~`Ry6{StqC)C@Gb zY`B_+-}f>g!#eja-VLD`k+t09EbiHND%oqO#1C!M4ssOsyd%g5#m`vGe%}oY2`!l2 zHk&;gn5|g!%_G=&Rz|<=L&ktCy?4$pmEKWn0)A(4q-~QET(M^PMmN9xyy2!_-L;Sg zK8OpqV=s2ZX9PXqQrZ8i+%L{2h4IB0t#@$T*&%k?w4X*u!=O>>lQ(0Cikw!_xy#3^Gt5^OOAA< zPnlXNI6Nx4ir2#}gd$?zE3J?x)ObN=xolR(Fw@>Gy&?TWSTQd=Px0yF_}Dzfj&E19 zXoar~_nnF@XB@=&$Vc~k3_39lnY9hg1!hd8GshGpV$%2_MbZ>l=ahPL%h$_gKGA+; zSWTzB{KDK^DBS!a+tg*6Zy97VQ`IWP>s(> zozF87@cg-Y(R%ajz@yR;rr4ods-A>=`Qm*+k$txR< z9JNWv^`+=_i~NyZxss5^n&^TJJFDWhD)Yj|5!2a%?y2el#Guve^mcH*d0U@)$xe@< zmQj#-(?CFUou+G$@P&&qj%BzPjQW;u2B1)p{>_;3d3`)ICD@LH#8EWH*h$?_<{M+I zs-u|I!G;|-ka9|p?!_(#2H#~9J$+=2VkJ+<`j&qe{NA&HUQ*E#IoXff@PFlc;G6z+ z+zOFR__l{gxSiUbI{8kKghD64`0s)akr1OVEsM)P)jl8x%UA4b5YY zeHL1S-wz983bNF#>P~C2K;#73k#AH}Ncpu)8Zf0z^-nLv4WRHZfcTPpk{`TA?NEfD zyf@F-&qnDvNkNA7fBX?%bzR=jPQ4b~E4psci zx&{_1%x6*2ft^LBO}|0t>c-lz7#UXogmzfH&xoJggD*Y4t??2i%?ow1fDzm~&_=`t z-ijBu8u`O7g&s5zQ82L}&el7`7$uml+%E1@T{p&5D0os%Q{G{_ep!2yt z2*JS4;%GCr@-KEuWkJHEfKn=dy2M~t=%%+E-U-3>q& z@r6%ZSVe!Iy=qa4Ok3{LS=${Yo(s zsXfr>UoSa5Pe-yv7V|c*GUSz69>3d5S|hjJ9yo07G#{s5zpS`02}%eRQvb>BRsXz4 zE?(ZcXlZy9b=Bq~$=qX)c@Mp}t*_q3tfcqjS6snjS3Blv-G8*`8W*&8U!zmECpvmx z@MTS~XF>O}qA?;>ui7C$r4+oZkJzh`9n?4ZRn1cLLvDCZq)$+7;`PrpC%#ja={rp~ zS84_o=F`mxj|W)S31*0TJ^b9ZPhpRDt$?}R&EW_0*2O9tCH59?UC&!b{+7eD%Ijx- zebL>hFqA)yE$MEdY_e)=_3}BGHk{{E4FN2vSY>OrW z5a|GWd|S~-|M>R7h0g%CWj_M~fCc~({-PU_W*v{xTCgQQgtX;rtu7VtH8U6tluiD{ zFANM9i1>~kta5m|fw~Fs0BPeRUkk|Y4#y3Z$=oj4dM>m;_EZjUkE zIzp-@C;1)MkheoGBxQEc&u@O$0f>Vb7=)e%d6porLZNR?wzX~W>hLq+RBO_j24sC@ z+RqYKNyMF(VK^j!Cb!VV+eZ+2bu>;1){D(~75X}{Y$o5wxjy9tV;D{uifld=y97&t zwG4mpP;~O7=v$rKG`SR!ATgBvnk!}cTa}$1f4dZMMK&emyngUyx*6EDksGW1#a%}; zKaQHM4hBjBEKCH|ulRY~phHuj6x)UUnFmM^DKDf!JUQr$i|WUM;<=;#1&aU-+z3t^ zJhMewmxk6=RQ!IyPKjt`FDHY=Ld|EoZ5m(uvpp%5%+%TsK5>L}J64{&kl4~pvC#ib z-w9;sIXn7C6N~VyA<1xgHlagW5BMO1-8SPH!MiCuKtPcok=aw5*6ba8RWUI^y{JF8 z-36VZuw@%P;G^X7 z)x`@(T+0llU_VKoYKC0CmDwKc{9`kf9t@_-Lt6Mz;Ht6nZoGX>FFHBPoRn=`wz{wa zVS-zgMz-kjqwrwb;Z>=UXHKbrc$9X3X!^O{C8c=y!SzMgYec$}j0}j&>CN7cMpn7K zWQ=wQ$(BTZK*goVs9x4iTSV+J+CM5u*u3O5dU#YV0JMQv69M`H1(E;SjteROv=J*p zhiVF-f8voK7B2s7`-AxZH$xiBfYK0>SaLaxA`XWWH|?J`C={s55Q7E~P=+~X;(tGa zSYJ6>)qnl|FS8KOBMH2pHmalg2C+>rF<(n6Q2PZ^yUJDW zj`U$B0$|qkaoUAR6S@-aKh%tPcM`cFbw}Bi!+|eopJLjs)kOfO76eEUqdC)ljSR>< z{MXA8K|mZb$ed1=G28wkX8}c!H(s@ixJ8``j*X@Av{11=s`zhPeLEO-tTQ zf!{^`$hE?3?&S4}+ev@tDABG4G7#T6{xT=G($e2UeI$I$4Y*MIGEntqzU8;BN069w5Ynf{txc`@C@Mx!fC+T0Hr*#OLe!GRYH=86~2_r zy_VfyN%ZzJS_fB+o7RIIAH|6tbjP|9Ry+55C%R(x*9JPVeS?Zwg0PHwU7h2-$K0U7 zSQr-#1AFSY3XB#tH#m;sBZw|A@xW2^5Gz~E#8;fLs6vc{%`V(SAn_mCm`ewhN z?xNNG%u`ItoRsw;P;T_~j1+ci==3BkezX3067sILC#} z!6w@?51qRwVK*|9fkT7|cd_UlWgLLbR)P9p)$`I=m(Ouh=ruBTU3XitgnZbkUCOH9#OjO2Bz-+2l&#L%A^dCOs zPKZL9yx;Z(di)H``bDFm7_zsmgj<<$-TA=Py|-)JlsxmaDP&LfqgW&nn*sj*u$Wtc z+?D3C2pgFdH5@EdvdTcN56n?xl0w}|4edSMQbZLqXPWlIqDcN6J+d4!_|7+c&Da%j zZD{Ig!S#N0ZV8K(!Cx!GwXANT8Xv`uAXAOKZCE?8y%9#dKa=WLx!zX zdbi*BxWh5jK`$l!;5g?3^kuVx?$3`6PHYTv!77)UEcegG>QP~O^0s~oaulGIy2^GH zj<%JkF_B(Z<-B*%eJ(=3bXX=FWZ>Ev9V0676a%$Ek;FN$TBw7Bu59P`fPi zcZ-Mo!D~+^QWx&xp8`Uj4*M2XcQDhwwQLeLr?=B{r@z5vEv9dG80Tet^PoS>fkF28 z7!Y;p=kZDU3#Et)JWenjm(>pq5Yfa>%l{{`Psb|#k7g2=Ky)*Jl_5^@rw37Ck3iPp z?i?qNfF7zDI%IHFD$HRn8&I8!@u7IEMSKJ`MuQep&YPd0&3NQh;_#i>hOaYVV%MS9 z^?|%-nx0rH{4m)D91PPHc5Sgza=3S*=mFQ3BT%W^mKR7^93-a&ECg_Q1>)WDM6_wQ zzw#d+CTecSapGBu5_#kzE3~OLC;d^7J50Fj)Hk}Fgv3gW7 zl|NHA0qcpd&}$k+VI7YRQ$;VjtUJ=WP`O=eCK{`^HYZ`Or2h>tLJKvXRf-G7Nt=<< z0%-k(adqgCt2Pp|gXP7`dy~e<&T#m?E=>HUk$~1V|TFEvC#fO{#g8^w@7uboHs0oweTG>tH3A>Th6Qa~* zyhN~w4F2K=s$GLPLAB4*mJ;+3F=T4;78Bq-+ zhou#b97OEqk0_=BNeeqE;Ce)>S>}+AUxU`#&Go7-ds!kGi!q4(Av13tu{qs=K{?S%o9R2SE}5 zFM!tUIct?#5^VFwxSe9#d0E7z1gJI3oPoc92)~yf)AMxxDjPri_DevBpV<JS0<85=M9{EnRsYq9g^Q7Dez%lK+if7f_2xs!18+-aC@NwvYw(Sy}mymP^SVnm3d7Lhy~ExQM2W8S~Vl-Kfv`bGL6gX%n%Y2`E;ZJvCk4$ zdCPcFZw1wiA53Z6Zk+j&ANvqJC@e~=w>u`T1S8=p)ZxyX;>jl*2; znBnD`p~ye^!sponlFqm_-nsWshE$P}%nYW4<11!7JQYSIF?PqSM0xrOeWSNj8<3cS zb@Oh$+!r+qC+cEsT*p3dA8Z_8Wk5kL!9vqh#Nj1y6$w}kCelHV8lz>VtVY2zVz)*K zRv`krDF5mqavq}n1wKTMYHYL$nH+yAwv)POdRPMCu&jYwj}+B@3V1wx02%l6~Ux01nH8 zRE2b&^|{);_GC-MH&5GBTkq}=qP+PNc9j=!jn7Z5_`;yOrznA&iSJ~_E~VUq*(oPb5eromDh^PPtv+ zoBR2s&<9^9YRs>ToPLT?Po*aUEkH0;mvl>o+^@g&yT04SE7$LF9u<~)LW0?b6rmUI zHofiYXS}0^{PIyevgUeM1kz>J1YM>9izT83>9{mJ zuX?epox8r@WHh;|4%^>~btX&>6C7sEQ1vXvO4jXkeT0uIaM$3$%(soSd5<>bN>&J@ zB&OqB??_emn@Qh!oZL)RkPxOQb0`hc2Z8{Dcsa_K-$#``iEaBXb%crKw9GWqwZ0e$ zQKI`r9B2kTdDR4Yf|iM8khA4PEFXsYUquJXJ3e}LAmbQ)a?+PeFQqAS z_xB3#!K(Nm!7?mYF~4f@!(er$RI*&ZfA04ixP%2SKS_S2QCwn!L6Xt&opo> z$Z7H1osUq2yjR~XDOids%u5lqquEv~mLOrRmm)WVSPE2f@@j|=ino~OIBlIQD3wnv zUA|#xO>2Bvl4?b#GXqoS=Uis>BehM-!={2A}%0vS(8h9Gsl9 zHH4kN81{`aUK}Ql_8k-)$~^b(V4=NVeB%JhK}q0OYR9*Ic(+2?)}jKicX;!#iSQsf zDX=BHGUY)RItP_3DrU5>NGQz+mbcHO7ZOOAsl@Skejt!CZ-)X2Ahn0c%?7TwiyC4< zL2KoeqaSbi^Ea0oeF=5(#xIy257MAiFpOBt=fmZjVNvMi+6B# zjoo}Q9gPL9X|4>lsa|u^#?Ur$ecAhuv7AM{-ceNWV$8xj|w!HpN5V+|L@n#oguJs z?TP?Ujf#*2K9Bl z4sCUkGvYZdxM=}cGK}nQ`DpDY*@(pQ?q}}Yj{NZsn#~12cp=e5X$+KKzKc_i4{>^T zVg$Hm1+TUWtFE>+cS`>V6Y-{5a>2hF_s!Jv)Qi6bv$|8_m&JJikM9tk46IXoDNOFh zk8)L*owHwj8VVM(TA2)vS11`F40vs19C*ghnyb9ct|knTZ`@jG$QfT48t~FdQj0DU zrjCqCMApYis2l&nck^{^Y>z`AG`irQM3KT7$goob2TGc2?nX5ueR;er2^NKe!{)Cp zTefVNAmnNWdQumz^i}OEz^sG=P#5EVDwjGk^TqxxMpVw^#ZNb4CVMD-u*= zbDN$(*P__qUSMyOK$i&k6(A^8Kl$C84LwR`@N~+Bhb>)=tp`?Rt2-gfJ9{}>kU+lGGXK3MO4ux91&a5jr-2?otg#m?k=r{x#EWRfSfgt1p2)cVZ0-Ow!Y>messyF)^cXNG?9fHA_fP0$~#K+ z6P8PJWX8;9@ANJ@?$t{=j%%ijRqdPf%DOlWY(um+0@YCqCyxNaOyHT6_(Sd|Ai^mYIRIBX`2d@8Zr=6c^*P|0k5iisgRmWIpgNy60}lI z?=vuDU1MF4m?Sbrz=gKo(8E}jxv;ra{dn8fq&;ZI`PruXOx|~(zz%<`lsIc%V|lT8 za~tsU{<8tT0$mN#mw}QBz`Ix)chE0(F6D~aKLy;s6$`d}Q(LoA;A%)qtx=On7{7nW z%P@G&MvE@A$#rKCAYoUsY!LI}tq>n%>;R}wRG5W-4b)JtL%OkaPL(VL+LMsTSciv7 zC(KQdJIR16WCpDrLyFaGs%ds}$#SH<`qS~aof044L6;svz^;j6z`Yh7d_b_tTHiNZ zHCG?U*(N^R*yoe4MX4j{VvviAUOVISPpV>(_1A!nlFC5_m-W2IO#s)o_I;ej#$6_? zA0c<&Je(pBw=P`1TDSLW=w2Spo^SQwQke(@(vZ0_C%+t?dM4Hq#ntw;EBCIUi6%4} zAFv!@_QAd2SF~5ayYrVD>h(*MCq9pY)_ogIW9Fg_Wxm{%IR(VyJdo6#(Z;I&t|x#b zu5vP;BVDT#cKjs(QCd6?342RNG6z$4gUSL5l>NND)5o~hpk+I{)5mV!QqXP%3>J$+ zEB_Klv3=ijXPWM-`2rNk%;YjUM_;av0T-$pl}S*q3E!5V^s`+ZPc?K>r~d9;QisOX z%ZX2r7YhnB41Mf={&4BS;{~6C6z@By7+5(;V7>JtwM%jw%79HGi;id^!ZNtGzh?AlO)$bJGpJk2y7N((uP-h$=*dWwMQCI{z4|KARn6@4EKr0SVaKP+JYXx zLdk_8?Y-bEFXhh{!D7$Bo)um@6RxnfyHuE_(zaa@fRpp1=PKl$TCbNS3C}5gsTCj< z9sS^|4KLLih%O$tS$4r&NsE?`58XwzGlJi$7g3VLO$uG^=I;tJWLGpCD{bsEoi!-w z+u17VE;iL+;uCQD@iW}5DsRisJvtG&zR?pN?asNP;X*}Bx;`km!rox?c%|$Wa@`EL z<4P5Y#oxvMV*cGgyS~H~mzWiLYnz7T6nVagG#UJ6K}eC0?dJ^lj3tdF^XLfRlK+N8 zJ-shQZW%B!MGjG+zxJg%&Rf9RvQepd)qWgtwvCr3COe-Y<}AfOJ+CEZbf~Bfy)Ycg z3%`UT?dj-ZLXGX-r$B5m7kv)i!@c5%nvyNjHzC~bz`2~%QV5QZR`ftLq~^l5lbMJscT ztci>q)Z4I#XdJHX<20{bBUi8zkxJwh2v6$~1cmjE#svqDb1i4t@H4MO@NU?) zSey0HmS5OuCa5<3BjGN18D{fod;gSV>{l*)^F@gj%~1U&)k@e#+0XJfqA()3b=uf_ z@5%3|s1&9h9Q%S}XL85(;eSw)vVjk~w4IjH6uY}#ij7crVz@Mr(H76Oq`hx9)8lN_ zP7||Z0*MGJ+j^0M&cU#q73tw%F?Q1`9YCzx8oBaIOwga-{0~vn4FUi61;TFlm$I#F z`vNNUoKMNxotausi5foRu=A+>61dT1jpDAuT0+x{T~jT2hlKjKpM|*^xvu~C4+|$( z$at}w4-(6Zvl2atD3xo;^O2>f=9l?;`V<|RI3Bh5d+*0i*52Nmn`#e;>Ue7CEb8@b zT;waav8(zmGw(j$+$O?K04nbzNkBkpi>TT_7)oqWfr5yMC!)s&Vod-81E&WBBshRK zASDH)W&w*0`r`&~rp!A2o`gzOfm7moJwr}wUQ6J7Pm4{rfM&!`|Whd;w-DDreSbX4E zs>1jYb*XpAw_A|*M#*1~Dg#hpv2u-?yj(KiVr03!<`>VJpz>J@O)@C~R_mXVt*$mf zu2`R>zR!|YE9DbQ9ZP1_--9ePq18gaw~1y21Ui2S!d0_>aC4^Bq!_OJu7oU~a1N2c zZeo+kuI*V`wH!X20Zd-un(0`z99*P#Qz-)*&f8Zt?j4`MP)(ce!&TzqvQl&l<~z7o zw{WFl7X78xO{hHqCgM9zXjEieFB$Od8E70vWA+ybwL9iKzwgF(lnkbqCYDx1f-C)t zt-SKa-O4(?6?FR&tZ?oK^XT<}m?aMdQC_q@!Lo36Ddc2XwPM7$-OAB!n1qoGna7OP zsSpTGBy(#km10wBQpS@qmgHOejNwCyJJ@ogxUiQrLmBVn8zPa~&);_P21vE13URy_xBml5w-nV^w1TiDkSSVq}W~l~X;v#v@F#2VC(JY8dpdwjyK&((5qoHfX=Nx~{h59j^eZ9$X+)&o$PD z)%MKd?~ZMRmiWEQ$S*j^cg?(8HNft=lsWFZT(l%_U9-e{s97e~B&PGL(t!uJ!Jbt( zoHoX8`Aos0*yB)Ja{a(!~dq(9buvlapb?x6wfx!N&Q&$IX?RzNmjm>GrZJ z7T+Ip2`CsCY0xl!4cy&}IakKBbGxX+@Yc@j^axE}-!U7OVmTK7#&X6KFAfq%&9}oc zHyOWhu&j4=&sJ52?mJ`-&cph@^H{#g)3O*Ix*4OO0aU9&pv%L;5aWd1H(n#tclqAo zn6c-59_{OAj@0;Vw5#I1nttLMYge+!$#RUpiQ>1*zD-qcn67Bg%CxPuuhQGmp6RnZ z^$Yg7``SZi4&-8AM=y~#QduOJ;-gD22L27%CPiRwHGsmLs(h22tJ+*oR zAwkTiV!imd)y1SK;Ad11PhBh0nWZk&U5@4vw#~qw~>H=E6`t(aHsLB@))6 zWxcZJ8WtG*l;beiGgoi0G@PQ^&FqJ`$)bYd+eqYS!a^I6R8K76IBzflgbl>AKGz4X zIM@5NyYmDMrU-u!x(Fab5uvqrcGBFyO^aRQ!q~6^n)&k`46*d)D=yr=zBC5{PD*%Q z#5O+whz(fs^31|@zd0=lme0{(!kHLiXOmVrSyITIc)U*2rD1lVc>c^ZZ(^Z_1o$6t z$N`j<811WQ_A=<38X}XuG?O5DW7pM6jk$J;Z5ZY31Dp409&S`)DRx0|(J3`TZ=#ct z^|hDsLV<0|>-h5$f zaL&QEV0^GU`VIiI$?D9@_5zElrfw_Deykb`G9%v&(OMjN+P{s1H?-Q7?A0_>?@V^; zJ& z#N0A1aO%ki{7#e=_ew|0BadD9-*7c%$* zxD(U+DXrp~f`_+_U4!oqccGeIT5Wr~nEl%7o=LEymjdnuidJ<^%_%jk_$!1Wn44;M z;ZAjKIiQsW*PSb;`+3Uu_!YCm9VX^|tmW$8ODzg9kLa1NwHG`SNJNJn`$No^Y3R1K z6C5$NUv2rEzKGVym?Cg&%6H@%*^!*!0VvGw=A&70>5^q!|FolQCVPFuDcl{7B1B=; zRJoCHf!nacabIj}MTwbgAWKJ`g;GMy7T|_tadvWwKs|+Ur4IQ0;2#If4FM{ge{)#> zI%BmX4-VwziQp5^sz0ur>==*!+w{M2>VN$F`Bc4o5zD@8>#jk*v2WM zNqhgA8lx7^5^rI!eu6G(K^$e#Vs=NUW;WA`P+QlFy^$gx$KO_-Cx3Hizj>Q|8PitM zGtVvP5vJ9kGW+i@TbhSg{nw^K+UcbPl-`QDa((snn~G7|0k z6s#>d2f0+eJ#oOyeR1RTNfv|cFYmfrJkn{3F~+gS&0EW#Jln42avtgaJbYGwh}9Hn z4FNOCHJ{K>H`y>M7%Ls%SV!rnO`qSpI#ciRch`&p52E6*8>ddPM}WF;)AMNYq`r9y z@xyN1nB%_`GyvgCnDGoJ)z@9Fo&R}%wAC^1h}W zj(E@XTLtIr3x};|Ts!NGhOZi0*L@VswP6VKZ8_6=#e8)0Ad{>rhS8vr8x&*OSd{z+ zu1)cmMr`7ya76Yl^#tLPK>Q{sK-hZ{TDRpad1Qr>y&iZ>L3ImXOCPlF3`q0q?mQLmfcnRtkrN)hR!sqYmP%={x90rgs#_a%(3$?yti5A zKfdTqFK-L%(f6BUlNVNd2c4aJFBA_Ym6{9Sr2^e(rhs=`;BVoqwPiQ?}wwEj#S;k_QsL@geBhw$B{WIML}<<(lRDTLtBWI7+SI zG%Ht+19JK6&gbl>K*m#iRSWQ^M>~z(asl}H5m%zwJk0G+MbRf#sr4#F>iR8Zk}HRS zyxS60WQ?n9Rm?78`BaEXv~k?xFi*6J?Ob3>`%LQ7j*#D{D-H9JmThIHdYnXJVZ$%3x4wZTBlEo8VO5wi_u`GXfo0za&GXEeWMyq)BV@2+B-W{E1t zd|6qa)kri+-W8Lib+^i{c3cTXs*D^rLFqfMqS);`kYXU>F90VBmRZF3QGK*Nb?jJh ziG~s&iabpge?h%=0}^>l)?!M0v8y>fg4`W#u~#kIhyAm#%Pksr96YTkeR0Vg^*WK< zv~`+3PK%_1xj>S;-O#PQSKS!C*^yXqD2YD-Z)qRZ)7zomsq)azo8Tju_@NWcRMXcm ztMIk&&885ugM-s~3nTXo0tpemzsiPDAs7J1+NMg+TPP2=T#AC%Bnx}pg#KS=6s0E-CQCE4ZTS2#yM>gg-@Gf#TtYve^LzWzSD40k zdKjUoyqt{smVZ&TqzmBd<6fYp3(`qT?Etd!PpO3z00TwEEwJL3kgz_+T~shWvpJ!V z)k5+mpgOErvBx^RHf-@`Eq-=CU)WP`+_>rG!CwHKYOOX-nw#0uQ~{SJUVv?&TgOGi zahHeIa_}ZCncN_Dsja9mv&`1*qki+JY@pn65hai329;ngfPGTHA46T;P(vLU&U6lB zT_aek&*VJ<3{(FpR5nt&^qe%1vVY*<&%-(AG|$*qVi)0R54%hh=9?&i0x zSn{89l585r#=+h)45CGBO3=Cw?s72p*`<(zA}&6v;vtxq7lna!#^ZxMTkiKzy3Ckx zny+KNHLo@&pqI@p6IkH=??zHx^WFy)MoykQ^xgX!^z$D$&1*R9cQ<`_CLgcAqoo@j zST~N3sNpLnzKspHX05Yr_r~Xoy4^vZ$@5u9e!?>uNt_L^QUSXsfS)F@O?uKCW&VP* z=&$^0oOzFGz?&_o*tIpEcl1euksQA@VmR2#sdD z{VVnR`Tf(2?!w|r22Age48N$DF^ZY@ixlT@?Q%(AIjtDeXn&26muIfP-*o#V(~plt za669N(d9*64)Lk~W9!440VOWSN=ou@tw~6c_H=oY<(0CI&sPglgx<-Wz0A=!=vHFD z!hG@>#r2I0r;$qj`J}>>xZi5)O-|};nvTd_UOqP zyLg`BVkg0%Fz0UVGy*2Y`OnL$vY6Yl7=rL9ShW<(GuFrO2BI8Fivl1yC=?h#U@D}S z+w~h)R?<2FDY^m^A^n|X%F2qv9mMTOf#p%LKVhYWL_pzAVmMeSNk||`p!|Cry?xyC zKdZ%aCl#jRX6K{7MaP2NF(M&TICUIq2?)osPr1N~pkgFb$pGx+01Scv$APz1P?aPG z3TxIlBm*CUl*y&I>6X8_5N7=#7s3v8DJl6oREXF7{o!_t;Qe<}U>@#coYdVo;@LC6 zrVFIOvm+jE#X+i)dmmEqwyjoL9{{)MJSqQ$NIHUwGXc8~Ior6+jbLN(VigSaSH+mF zdu;u_J<8K3YaNRQHh&ttc&v1A4n;4|dcHj}&oQ;?@Eotm(&m7q7dJFPQrs5=Ak)ii z9ijY}D2#_>bBj#Q_BVq~ev=b5in<=MVN`&Ro=Ln1)T-qt0q?A^s~{GU*X=96xMzRjfh6#(9~SgBgK3Y%k$_ zmAz4IMbR|&?ITGL-*pvWQ=s<7yDmgwW=mt=_WLo{=jv7^&JPeYLcm6&Ta9FbpC)p; zrccq@3vRFk=CKQg`;sJ`+$jBC{>u;pmJp>XjYI&fwgm>DpaGW(t)oD|Jxy^XP5E!e z5q1Wm9CxTMCobY?xf8JdE41XdRAYJennJP&C@1+V^)X#0FCBhHWPV(dI-R;t8i|mS za?*nZ7K?duvu{aFO4t!?dAtq>xO}9}jjjUU00aV|BLo1U844Z2MJV<`MJg3KLTbR3 yGf&z4(0>Ex&INM- literal 95236 zcmZ^~2UJr{yEaThD4~X;fCz*R(i9M+h0vRTh=@v4X(CN}htQE4dhfj}AiY{3(nIec zMSAZwfAo3YbKZ5<_h)6TWY6rGJu`b|?(4emYd${FP$DI|Lxh8aL#m=I{}cxY7m9-e zd_jnhO-XU~`+$Rkz)_KxdFDE`<;C}eM}6=(1p6VB2eGiQ04aRo@_9tQa3}Myb${{UzU2>!3cNRtdp>`!|ILUv-GKhKiT3^u3it{o^!xkm zoT0{-fq?#e@Bc2i|8J__>t6LY|D-}d#x_L$|K3jPK=uE;{efuUzm@!-+qG%`Rt*7l zB&Gh>P2mmPB>z1B-zP-}EM}IbeNgv#bHgs8bdQL&Mx8%DB9})K?JZUie-*ajJy+9L zzr`JwIU03$I}u9wx80tB4EY8EJ{3LEy2gIzE)#c)-`#U_5^B}%pXh9n9-qy$v_wJU zXh{v&J!YdGK5h!{$&fvNdA%2%5khS}><#vNAgUnq2J&5(65>@Jjkr<;9@tFzu?2wG zzAk2NK6r9_O5op7ITHq~yI1InK6+}H0>2@7-5P{wcAYx=DJMI|z2lRCD9eirJW+%E z(=V7h+%rV+D>)~1njqrb9XLcHDT-O$C|$MT+G+C}fFQL9HJ^KVm=FIMtWdwN(2z8}S7qp1tO=IIb)f zrV*rslvk>ca`Y61jWY0M=3RMS3^B?YIY+b#&vx}4{yTRT6RD6fZZ=(qkEz+FS6|$d*^;$x; z$XHqAW#Vgv^JBp=pER{kjbNwuCN=Zv6h|x0%3jQb*!PT`pKVCQvXo3cgUX!qI(_OT zKO?%I^8R+p>AWPUE2B5pKXGl+QeTSdy9tBJ>|We2Zf0mTU^bN~!${J1IsRwm2DsJ; z2so<;qhi3fr!!s)mP_$+H;W8hPA!dk&1jF@-#wyo-1xejNDLuhqTu5Mt;yneFbdMf zn~P_$dab?g%H=F&rGyy#7QQ~$0GUYmx4xhp0nizsO6Ui>ble$I4 zrU-Z;tSW|=bAW_M1^{VO&3b+m3R;U}g3e07(Bri|VPL&WocV)X&qj_H-NjkkVi4Cv zDUd9o9>u|M+opX+a$`9c<-{E-z`nJt&ps&ZR&0<>loyQvvmP;MbtT}0i+d90cNGBK z6Gbr-q>GET39vyrMUGh9ZD&DMDuBis3mD{aWzp#o$v_peoV5<-8wFT7&)h-PN27N) zjEV)SmEpm-h<*Zs#m(33(+8_2sOJip=2NA_-KIJ+4Xj9o(mG(5|Go#I@|4qW{6w$2 zNw0tQ^H01s5tVDtGnd|xS{YLd6!}nT15C9(wTo-ox>9qFf#9j5#ZPraU3tsNKv7gc z@g@^F&6jrw7pya!@_7_!<|^aj5yDc(K16GC^_m^3(*ca#wh{_P8d4We z?fk1*<2AAC{hu{_1_0%4Ua1*Q@izl>2R_`z&k!R9xn$!gQjwhFBBcg`3E>{xfifQUW3Ho!Pwnt|i>3Oh z-PGPk4Hhg0sbTJCaJ0Dix?h+z*cUvW_QmnCCH%TD&3c62GOO_^wG8x~lU3c@wv`zm zrirHEt9BR_831^R+06uK{M*bgAo=^2Aqwvf%Y}T;6oWh)>3~TDqBBZ|pdNm=0XTVw z=~&d(%9FzBIKdhrd`Fcwb8vH)8`1L`-k&xZt%S&$e#mw<_;<{qZI;ISs35iZ#O2{a z-UA2139o7bi>?u8U|XW#+Gf7moWsx^x$8D60G*Y(g?4pt4+a~Z9^nHQpLF(7=Ulu7u42c7#%edku}uh& z9MHNo>_qjCZSv*>eEjszI|_v`7_RWIh=s%4myQ*Ja1;g3#ct%Ub4=Cg39CGOv-s9$ z^Vp?Q((Xq1BI5KfD08mC5M&Ph48q#HNqAEHTHfPXbggw%VF1pI%hvnpTv2WQ^AT=l zq87N6v>cq*&PWDgy&^6O1nl$u7~Zx!Ck3M>1CCezYpR1oNKZUdJ&xa54Ul@L4d6es zqyy5njQ^S>jr7a>^}aaE25j2$P$v1cF>0a3A|z4a-EL12=zBv{ZYvFA&fXS>1Boqb z;5(awny%tPsoQ8qQJcMG;o$bCQ8B^Y_P?Y3=en{*H#ez@v5RM<@qN@V19p=hJV|`l z6dJr25NX-33g<1Z3l^`zPMOIMKf4Sqy^1}Kez*{}r|b*;=atb=VLPo)mK{aU*AUf} z+Uf`AWnLI=Q;_k1$>C@V$~>oD=woT0CI&h6*nCKi2f=ix;2Gw~2&r;a5#Gxajc{Xd zLZy_3R-~zDeY5$@JU~o%z=BRaISX@VTk9mwO^ZUdskfx4+l2fMA>P7sGM6CvwJe`e zQtxIvhTX{($Cpt*)LEc-QTk?avo((gB_9F-6qJHd?vmn|2eq+K=pke3l>Poe?Gx_= zwmC%7#gVBB1*B9!8{pNDv&r#~<-f84E)tVv%ygkwYWn5{?G4pY^Z1V~`Mq#UuV2i) z404&%clALi&aqd@`4EHTGnt`oiB~Ioc6YzgV;?PAZ=x)KYiWioXDFBMn_&DBfO9oT zT9>%mZaU4C$%G4_$Qd0#t~z&KIbJhqZ?s7TNJYrPyL~-%1()kmWH_AN##9u&lJozk zHQqqVj>rq9r1{mE1*MZC!Ibs5D~XKxL|nG4RhW0$6Ua3~Uu!ddx1F)ytnjnhE(&ux zCzz~wD|#D?1_%|%qeBnE6}Nb(*r2ToZJW#~QT&(d@)p~6n_v!l#`781gK5Z4c-+x7FI>4w@iirpt9iVk<$t0!*L42AHpeC)C{nVX)`w z=|P{3N(I8`j@W}QD(-m|i~Id!HDn;)K@b+`AMp4e_zA$;@&CY5w*SsiR;W2K^5IU! zV$}cS|981RkhXJ%ibnD1%iM4BrW|7)dg;A;nD$b6ZETHyfGvQo@V@K*MTG9rui72* z<{a`)C+~&P8{ct?s|C#_5ub%D3WCT-ALOxnt_mDRxU@rnPo^tnrH z-TwEcqvBF^psa|ZNigl>LxKdajo?WAF`os({VQ^Y==rm3hRI*#q<0^EIC2^%{)sI) zztL#Yi!E_Q4+_AxW#Qji7%EshXRy5l6aIs%{|>^R5%^Ch*`WW7!N2zEZ((fS9~6N^ z{EOWGqS60X&Ob>1zjHj3c|4+mI|8xE} z`Tv&jqj;-=fecv@Xpa&ga^GZKD=3o+ilJ4eYSzG%F+V}`Y z>~Ic;Y}Do6*yN;lMjQyR)^IAe@!9)SU~5???iLJej=6uj>MrND%bDh5DJw3l!F%0c zHZqTS?=#WCp5$wFBXWoCBECP#b7B7LMrNsquVbpwYo9*bw@cBPvnOkPE}Q0mTL2 z_)O@8&jyWUhAtH`fl+6hLsw=XlNk3adP2he7D8n%GrEESX2AJ16u=B%_GY%pX00~n zfTB@*xHp*J=#F;*C*41Wx9aG+AuDuz0Jj^5V|~dOx>*ldarCwJsojxiO6zQg$J2~l zXuS>qS zmrh&3d(PD0*(Ig+txFh- zbZxd^`s4nH_m`$R8Rn>Yx9&YZ^Bi+gjQ+5yrlD41iiLDXfr^XPWUqvGD(TvqBV6f7 zC?`{kUb;j?Qq-C@->V3pm5jOwWcbZPVSiD)Sm ze~0uA>#Pe(C9F{Q&Z0ZLj|7t{bPD!h0CvVWksX>kU?DE$Jz9EQAPESGYW? zx>t=p&v7wsPb}-(H!)CK9umtc=|h?$M4zD=wH^dnEpT8@y%D| z2`<)p3y{3{_Pw-)Ci^+|N6W+@bF@&`2dE0Y`8@jbR!((h(6{ZS`69Bz56Ujx`;6^B z%a@WBmVNT?Ugs0N3Im_Ffez-K_bF=#9B;dk1AZ=@>Vf)h<&A5ClfE>ILWA)}%)wRD z;AWmohPdV`fj5Z8zTBo(+i{8C;LUo z-R`nR-E-W0n4Kn6vXrWI?DGwyMwmBG!PbxGw=5-D?N^nk)BZWaeHHg)=xO>Tb$4~J zcyE^WF218M6ZF|da!goah)ScwU`xf21GrWoTaOqlo_AWZsmfhgiU?u(W} z{8}sNmOy*kg=DFRFW7KtOqZ|UO+8pP|55qynNM?x=l3R-@7g7q=Y+<8R)>XZ*4cCtMDz(OOnBlZW0_gE+0X2#8nBX>^dHv-M` zzuUb43-sZ@A>T^)vaQ!_VR%|gX_g8BZL50z04;YZ0WkFLjxDJQyjJpDfZ*U1Z%`>T ze7)5F^5wEr6xk+TK#_%bD=3H^8VKjy9<11A9#Ut4s(@;OFU}mf zgeN}S{S5FtNV;!`Ws=eCg&U5I^(;gwvO`rw*n|v&73TznL{ibB8|^c) z3Ek}HNaGc`DoSL9IebGL=`+8CYd(sTUUBJr`6!p-z(|m==B=atDl?`Ia2*+puwpwS zOEws)uCUlw8k2&)sua)?u=H`Ux#9!~Vtt1pw({_9aAY`;*fX$U#N6L-cW_N;PFJCDP?q(Uc`0E`Xa8Nvu*Q$pMT} zO6E6c7X2;43?W*tOc*vNRK`-KpAD`*6}x^|mI=(R2|-n=wmm5TbPB;!{D$I`Rnc~o zkZBHEu$v}ncJ3@lx~}|SlMRxRCo&=)|4oQS6~h$g8AGW26nT{<3(spYSy;PkvR3_| zhYKV>b;t`n+<<_xmhjD+tj}c+9z9u)P=$*FTHd)4`u491J~_<;B;#MGPR8z+;6L#M zec$1pJc1z2LU)t!lVhZ`cWpkfe=`Rwb9O{+3H{~(FyE*H7xku=;FPLz5JYkNJ2ghY zOl?@A+$4pC!~u*5z+JFBe*oen=$9VWvb%}+0dq?v$-bAnv>uU+kOWP+axg=NWsK&2 zct{AFsLZv7DXo{2tPaYoK-;PVBI_4m{kP@MyNCSC;bOLFK7IRvLwzb#NV!oCyi>aX z5%T0UbdOfT>to;z=En~qNGuyvoXMQfQ8}1QUvl`(a7M;`K=i{)=K^E#A4(U5s4rpW z;=)H1Klw!K9o3Fja8{J7vn8zrE4}sL)4S$SsOc&bI}N5b8NJ$*@p<5`!xbHnrRV+j z<1T8G3?@IEG%-x?Nc8*4O%j;NGazL&(>&L8b`@!PTRfaT)F!}e$0}1|3Dyr;le`T) zkh&X#cuXhwXk{@uCHVm*vKm2B%I(GX2P~fb0GW&~Nvf_ri3)<^41s6p37WQH{J3F? z%-iDQUZ-}kX4Cn$X-6wQD?fdDmMi_KS^xvZ3)QARG?231Wj*rKzq8co55az&9B6 zsOTH+`XYMCW#HX|z6s!y%6OO=JJh~jwhttoLR~wvFqf%tYB#yYeo$LT_>ojc@*t*# zRs|%#OH+S%M*VU}TVwzHV4Cls#)GAs-}6(~Bd{`{(afA*L;t{+8V3Bdfljv=R{B|B zyD8`19n8jOtJdxF<1phWx(jgKLViT-MKgzcutql{rn}s;BjhHFiPb*#Vu(R(Ei#l- z_0WNpy$OL;8=v_mX9lFOq~W`?D%}2qyHp+pUgN-;NnsEhj!yGsNdL(YsST=(^-)yX zMn+iFiry(Qh@K{+qCW=H(DmEu152)yx$7#0#WSI9kK4x$3SP@Ey88l7Mb)pd_JzfS zBfTOGI%M}Nm%$q6m6q>GYuI?nuA7N#<VFem0#g zv*^`bK|t~%W-xeXwo8iY4JSWrs?O3+Kl%&rQoZ)dq>e?e85`6zkJTfmU*GdyJUzBk zNmtbnBsWTtEDT9i$FF~|pGCkAYt^1sHYEhITvBD|cnuSV)W)l=Ev2Ko%0Tj)NoNf- zLa&)|2`H(52AQ# zvdfoy5tsZhdsioA;DV%AT+QqV1ZL9xqfmaEG`a2U_{q(4pVh%2az)J;lQuueiUlM7 z{nNKl@^!V$xVA>SZvzPBOt*zaujoSXN*RxIQ$jT2(aNrdPTCs+lfM>-oE6&R3pZ%B z(%X}?6&+R7*ny<4Dt;x5CtLJn71LhhVn0hGjkBa5*mCcVk)wOXoqNCaDvZO2zUWM& zsN@@ScXUEN^NN8CoGV>>s=!jOE%dOGr_L#^<!4_3iCF^9ihEWW*$Rccv4 z53rqI&Vi#v%HcQ2Ti-Hd6?IURebPd<6Kt3~QQ5tN>P-ZjYW z_*}p`RTalT!GIjsI{HUY!oD~C&AaY6+YX370}T_^c6G-q#mq|F@2}uY@98e%U&*GP z9aJ`S$ieUN&v~{cGVeAXGO@kA;McWg`(t0Ds zbH=9^Dx1cRnO;dxe5P;smN05^-|4o)uYrH}lHY&X?U^Uj>^0tT2yjAAWVN!h=Fo>t zsL@4n|1SZigkae;C9)DOoWrXY_9)RtD^3Vs`jo?dM$WsJ!z4ex{sHrfGV|vHCmjFFk-twcGXYrs_xk^m`4C8s zF&RDo)jrQyCY124q<6t%EfT2sjhOhwY3XU=fjQ!qHxiv>9@ zFKK;qe5_?&`!J|Em+W)!)p0N`=V*|6{booFp84a7wp$GBGu{oIFS8cz=6=5PUT#rZzR-5GwI~y{CQN#ziWF=-sES7_9uzQY7wG7(+}8X74qMFdIhenmhM=9 z!{XR=kDTUc9Bki&Ec~h#cb5Ehp_v^%`hW_#4L)nwee@bR#-u@7jLQb~p&^apwkLfr(s{f13UTLucA9H0$LX;pyj$HTT0|f5~1=d z1`dWej?pC^MS*Fbh8rw|P&rS?RD>(88>_%?7=Q-`eupZ(FK)0FN7NXM#n_z_5!kRE z*+P!#Q*@14O|KcnX|Ac9rZQ)v&mt_cTVCmEryiqNkZYd9eotwq%_)WA#I7<}@;Bvy zQ70zXMbn^phEvsJT#_lmbG}&IupvtOI91uW>xXu&W{Dx}aqeB7oi+-tpB~^{sba?s zuwcl+w8Q>>*HfD44&fc!rZYW0^zj^hoV` z_1X2j&!j)37Pw>4B<;jx{{9|P-Do|2Y}IXK(_sA&c98O1 z{L-%`|1MvCus|pN-K`SKBWB_0Y9bG=A`b#rqj`yE9a9pH3#u!21sRzl;tQ{BPdCmT z@`YsKwa;2I^bfciNLz`J$6r+I0_=~UrM_=tvo6v?NG323dyW1cTfKmsZyB!;dmZe4 z#n0HgB-#<+@tKgD99GPv3Eyc;66f=1e; z(ru@pHFn*psQO_}A$cxb;DzY*UadY63|ut|vSR#o_T?%w{))ca<=GyVcm|4`^d*bO=^rqLyvmBm zpmbcQ1}!r%ytuW^>6={X*@YY~Lw{ZgxG*Bq!qC;^kN9xNU0d%>`H=|3lg-OAIfQ1N zWYe4G3uQ||72;%+-`@hv&~H3bY>3*|Q#gLuGdLR*wRf#t|)EfgdZNMik>{gC|Li{5V{ zyGS#IFAj2~cbaJrYJ;4)vsx>=ebShm+$2$v9%Wd;oZu76=E2*vEl6GJH zI-ghqO=r!QYbx0Gtafbl3WehCp4GkYt`Bq+jWhh{$;5ovh&GzuAy;n7_f%FpuMBD& zi<73JJO?(6#gUJCJ^6;R(TXmC04(6OiQPuF+$|LgH@HV!l~z}z@+Pdz*Fte`z$;dZ zEqv_K#pB`o+|wJ${GQRMGtkA$=i6sNM^2ZOd1t4hlG@KDg1406)Dgx* zxuLtNCoc=soe1m#dm=OXi~5iHg{pFK89zsH3*AekHVIpr!7>J1L*b70CZe^Aj7fi| z8G#bA9OJF_ZfnN%{u0FIgk-fjA*!OQ*fzzv&i5dP{z}$i5-G`K#SjDB(^l|Hiy2L& z_Y(5H185LF)riPgJ8;_b><@qbT>D_)6^2Ulnz*2PKouU!=*3%#GZV?n$N_<%XJfd> z#SY44R(Vx?9(YAmY(B%MN4~b|KRe4qENh%+-WwXK#&yaQEAMuEKlDh~+6;`s^Ruw@ z7tEPEK$Ywi2Un8PNG;1bZq1VR2N;ydq|!wVtQWx_I1%)G3!S`SPz(xyDs48Cy@Nz8LByh2kF~koQMQ;x}_%Z(CPKIhPFC zJ5wm_3gg%WTZ}v-Ai~P5Rckjc&8OwiuTWB9#z-k^ABkm+)oBU@WA^(`{eEL@5Dmbj zM}OcR@{TCLB44tyr!L!ZYvM=lrNy~HL;r5T( zyXI$|O|W8YaIKX!67(y_ZKa}0>*Jvu>B2#CZ^W8b+kAFJR=@Um zmXU2E2se(fk;^g4sYi|rK^$}0-aV^w_MyrebVI|(s1?KYJk2&$IZ9*|@jx%Ev?Ex< z&*<~@m@oHXaqyF8(W|$Q_SECo2aRc7TIFqi_0UVe{f<8I{}Xx0BnvfV*tkV<^qlTA z-+saJ35xDfQ!Aaq=Uk%Q`;m9TUyuG!6S5gu3w%7##v^B8LJ0S!B;wD&@0;RxzII1x zb-Q0G0_}zy#drbH8YeHl%$E|?TmV{ZODT4-QkWbMtOMDw+IOLajKRnMhUwdFHjF(2 zGI3DGO6#g{L6AZ5fu2j3BH)C%k_rS~VuRZ9!%D^tr{@s}LN}|@*IEf*!u=7BN=29= zP#%SAC(U4u`k>8&{E$7VBX=r6A_}B1eNjnG9mU}B=)#kC+yiALn|KF_jkmN~(={PT zLsiUrtj}}c!NMXtyQy|Y9U{%~L+!6cc3p`KM5P%%y*vMTkwdb&hfJFX;zX4Ns$K8G zz_s}bh;C5u&XJ=xW`p(xh>)$HEWV%0Nu`zT-KP;fD3XpcxZpy2=lrGw5qLrJhQjS)xYGp%@z#8aw_WCuKXyx z{6ZB1IaKGYs40!@y{zUcD zlKWXRP!lFf+JxvoH*r`SGKbHl`4r^-{_2rzVl-95iG0ig9en^nB0WtjpZy`TtFWCu zbUoo2(YCH9?2|Yf06ghB=cP{(6Nq5z6MP1(K8BwQ111B*)0H}jv635$Sh1*#^_PZ} z5K81{2xMOTN@&$+so2h(>?*fl;xALd~?S01LMb>7^@= z0<4pc?Bav1h&nN zbsfifrfb+F%|b2}Qx!HIy4!e$8dMm~p5Zpf208YT4FVicN|O+hlejby67U-9qq5h_ zIvSzTU$z*ikns^$w))M>IpK|S4X&EKtt>%-%@1?h zA{^)0$Rq~^7^%QbCI?O7T`)EHGAJ+aBFZ1}EQ|H@9Y%s2@TKEtc9`aoSintMG9X=T z*#|$}-I2+h*l?!nT5=4(;&E1b@J{#o2ZA$<)7N&b05=^*de3d27z9d?|D~FMhd~Vf zgKpL{NE5Z%#V2CZYJm(HF=m1BjGMG8R7 z)2f-rh7|h%`zPN6tNPv$DvuuF(qzu43)z?U5G7UGUF9ef(ea1 zKVLRbfI}d9Vhv9dt;Mp->9CPlIV$98yR9u@zSYI6lt$OMKwbVB2F&EEyCF^bq ziyI|vS?|ExkXN_#-(y%GqIj2922~3Yw6@pG%yaAN!G)fgT9<{S@+EzjL@-> z8o0LnhJF1*$Bd<$qkNs-?C>O0j(%x@KIxTn_|ftwkc8!sV8FvLQY)xIxr+)am%o~k zE=~$omM~}r^XlP|ko>@uh&Wp|qU{K#mU1d8MR-df4LgLAmST^6)i8}sV-#qo=%r_V zS9y0gyLC;^Z@&5sWj~}5@OmZOs=o2*qi2Hp<%rgfnXI(w_E5LWH!pqu-_^|9a(Se3 zx<8v)k7xGsl7qLViYy-}_{g4!uPkcIoz5=cUj&kfXMy`{{N_u!C#_j_Q|Qx3U$r}Q zbp{7mnTW~J@u+I*(M_lPVZ+n_Fy0RVIS7Q#SBwKdM+`VmMKxq%0`>f$A$BZ86Ye{w z4CI=B#9`sKO7I;aP>$@QN(KAa$==Ff!X~nA<%KQagNG)x70$XXZj<&` zP}`XVMp1Z6lV9j2=m<$oiQM&lNA#kV7!CpLSLXg&Wc_kTP4HJ6 z%b^K>A4<*33HcZjux4Q)MyF;gdmE*cx@Ezm5I;U5FcOt1`(MHVp9q9JQoEdG2$CL2 zVf{Kx#KmdEtLfJZ4Lmmjx{o3nKYwd7Gqp;w*p^6YU5py#G5ts8zy_sO?96(^!caA$ zYDCdMxJ?yerfDO&E5G@!4!CQ@<(DI!rUaDzNBV$7Tv5J}_uY34T3uf2;t1(@+<8>$ zY8dIJt|v#&aBCdrGj|MDB@qo+6ji0hi>7cp5;|Z2FFFh=MPo?i?Ru%ZwHT|^iB&o4 z2RIWxqO?qUuuhPGGhd{@S3`1{7tbTS)kB+mo0fAEx;~aMy}QG?6-?9>7^Eg$;7+*~ z`7&rJChD4NRF`3e*T~5`6Jeu(%M}K8y5dfXi-`J$&lXWd1a#rt!ez<1$UEZTTjOo& znDq2;ijTU~5P!QO0hadmpj^s$T~mUING`fWW(#SU7g(g?cp8V5M!JSp9IOeYDQFUq}px>kCf zbE(M=jjh_Zn}FZ4PZ#uBXY*=L2#dNiPz7xFCee({oPT9i>!t|F1rR_ULvWCZLt0{PylF|i32*X1M}f| zw5u_=8-ws{A@#%qoR>+f-!a9|fI~(a&hgv=tsZoH5SZ+{qZ}KhCo(ld5%TuU0Oqie zlPS?s(LWBnBpkrU0{`6IqUMeV8l_}H_Ma-1H__Lki+P_zFAw+a+Xru0-FFc_a9&x& zCCL%&Bc*sPkozr$YQC{ZN#%=zqx7q)&l!tniCSjSnB>d)yV;@5CX<~l^pXnvq~rWI z(5buKO+^P@hiBPhv6V2>{%)m0feGPscZ#a@CGl^g55%j==A;9!4C5pdAH%SERHr2wW0}Cvc~hAWjm9tg*&G1-!C@-Vw*MWFDTBNxzp1RN0wApd=_HbviQX73y;3K zIeyw?ri{KZx_9mK#GZW8HHB1?W1{^PKK&qUZG>ImXR@|+UGY`qnr1(0dOYJfJ{n~$ zwScP;t;FPJrGY@`=Y~tI#BL2`tm&x@$en3^&c=-|07Xs(!y2P{T)aSe#YbPqHG3P* z9(hHtdWK5ol;Y28KZCu-J=ozkD%_Sk822FY6!9$T=DHZvZmbSEH8IkB&MQ-E8fUPa z=T*X+nep(3xnw$UNTTVg%x~VKKr>13q#?(u)8&a~4@$N!v1Ye+9rxt%o$3PedL3tp z@~I`dgL3Y+lUWqO-!}^ZL>CXJH7Dv`I7LJ{-Oi<|{`>oS(5;qL< z#ntl_GSt%0j4EpV2B3j(ouwI40x10K!m6G_aE{}Ru{i%RltG&;^6I4%nU3R?)=M)% zN+gGP5CJHMo@-iar%#S-nrqq&diLt;d{a@+-KjMVyxUQPw@X}q)4FMrXREnO*~sBp z+CK{Lgx6GvcZe=a_&c{M2FISFy6Wb}BWaBmuie-kO6T22S^@=?3q^^CCbZM{Q^FFz z#Kmg_DxS*wWNI0Hj+bk$i*&rb-y2_?3wo&6?^D#7rlNPW&mi-otm-p?9PDB+R}deZ zLE&nG?jVhmsvNp~36X{ZeAh6f-Fh;6dt_cDlV_hq2H{iF%9gbB^>R(CPd$z4boKII zJ_T$6y^RFfnrQa`EeP@=<|y-JtqdH1TQF03_BJD0v46sU6ulHjyL78cKbVaAP4HOo z1&mDpx#?~$AJ5sf%%qaWy4S67x&wX^ZcZs^6|UE;%+1@?LuAw##phoI?+?u<(n*%} zW$W(PT=f(bWJ!A<(IiKumYyM!Lbz_H&**2`)F;;484rva?sx z&X*6{0u|BMh73htdB<(h(Zr-`nJ zD|wKq!Ob487MNzp!{^kyL@bw2*U-gIiLK39mVR2`iY=}}o23e7wwFU#5Ak~wZqqbB z>`9rBGr!N7NV1LOIGw0o6U4&H==2Qwv^U6w-tpTntzSQUjoVd}8-%+V1~7d{UBKmN0d4+-RFKB|0Ibc7@xVBR+Hb>4I1Th79Z#g!dp>r}j~CzRgp{makdBR20wr2a7ogtOr*hO7dh{ ztF^FxRpV8cFVzPBhLvb2kv7mi{IuHe z-rC;d9lPJmz^XfIgZDTFM_H}<9*fJGoAgX~crk!>QnPgYa)=#^L?R?; zqEyY?Wm`s9;kLo(XE^A{I^w;;n^t1!6Ko8#|ya=3qzIxX&uOX1U-=Xqu#e;Xx z)b>fA7F2W%{1gom+5Z+GRNDmA+KnaGrXxkc8iU3!f7bv&5INcUtkz3CC&HC+zmsl@K zP2_icwZ_(A?gJwo20g0pD!a^FSSk=lC7xLmfyt$WWRl;FN5tXE*e7V9mEhd~DO+|B z`JZ$Ref*;=7(Rpklk-5V8cqqT46O0Z$3kb=Z_%86keRr(c*HN$(-PMblP+X16ZihfdI<$Q$`d;K&JNbrIWmD^FA!Kx4?GHrt( zb7WzmB^dDxxGh?ak8>J-b1DTB_=u3izd$71*<$^pG*pHwvOwKdGiww2o02}qzHq#u zFroXBs=I5IWd3}lNH4*ip*~88K|@SW>Z?#W;Xv5WQ{nr-qG8%VgjMeF=boP;lB{8i zpF9AUH0P@iQsQ+PM*J@8Ib110%U?+&V^*PN{JAS4HnhRecpv@T2b2@+8} zUq4>f6L5z885?=5GN#IJpZp~u3ae!NHffG^Gdx9Cg_++GmAc6a5?r3`iW2%QLnM3M zb03sPJ*bd8J7NFJ^qcc-?-)?t>x=g0q09JikO})jScMeG1a0hLt7>*D7gGopSvxdH z1iW0oiN&Iu04U(RO=HUu8*KJ98wZK?k!UCgcyS}BC%&9jfge=Pp;Pf4IzO8+L!CtH zw+ayGJ54YQWn`5(VSgxnTExe@wR3}FM1bgg;BAj@718KQdcd45kB9VI;{i0Dg zZ;e*8oPS=v3u1@T6EX_FdGVa>s|!(r)c(fH^~|*pslKh_SkN-z`QuVgajd4M@QBl# zFm8_L0SQ2i)(;D<)yMIuo}4M`#gL6j%C{}RY-kM~{XG!!7)@LenAJ@xBYnNbCtpru z+#Z{HDX2sN@9NHy3|Wq*lw3$6r3o?+5od5haWjB*CZi*ZhZ(nOB(bN^JUqLpGbG4S zr$pj;$Jz;2qqneUleTYu<7=AVNkBZB2>KG0aG)hdvy1Mgn;yPt+rH`{=To(*mxI-4 z^pS~$WP?$)=5QPQ;~LQN%rF6Cs<49@MD`>AJ4{0aYm;9}!bH)VRlS8MjwtisS@Q3H ztcN!tKrHB6z1{vk!UB}%*N*|q#HQItpUg(kIF504pLb7pvmQ?Lt$KOh6CFCBdLyN6CU(35 zs%rUmxWY`h^a;eay6E*#sYKty_o8QhoPTa_=D`K0xc$oFwctyUY)%R!%Q9L{T!0@& zDY{&db}prAy=mJ13QG`^{E}O@BIV%&9+M&NCYR% zZZ<7DCQNezF3oI|dBt|tgzJ{9v)w?DUX#1esfvHe^(~g(27h_h6r+g7Dv1ov2c*tu z=X>R`oS&&=lmDjjF49(qlqP+W#3`b+n51@&+eNbcI!s8_kxJ_C!y(n`wn? zM9`;wuG@aFWtB)$^l?BEe#eFXlCmuH{nBkuj1X!(ec#tUCVe8QcD`iYvK-Sd3%BRb zcxct+idp%>LTUf#Yc;(jTf2Fs(ed{Ezv4s{-jYa3Vj^1W_t{kC4QEz9QdPskzKRsN z4AIpRj+3nq9{77Y5UZ@v!`jML%WSuBD1^)r{x|-&rN5A(;Gd9*|--Bp9_+tYgBK+Y*KoCzcVoJ2F6_s zEH%i{Fzs3#YmTij$=p1Qwb5Qz$L<#fFV0tx&#BHu^e=+@tPI#8bH3p&QtnG0oWkyn zqy_?6kBI>iyh$Efg?sf+U~ zi(%7wD+9Y<+S#`y#TR2M*AhVI7H*f_W&U4rQJzwRig=pzA0=s|0B5Rxnth=KhnZIe zn~dU&jcIScRq>X@3+{bcP}H;GynG!AbY3}Rb{baH8L5o8=(hjLVZsYCk@?b9pfonD zh*{OPx?fEGNIw1f%)&vx_;N$W+sajb&n*1E(gm}3WMW@WW@QXAN$hFCsW$|h-Wy<~ z+$97nC8&Dc&pyz8txgEAxcUU!=)S(T4g6Qk@HRX|@!)v8sOKd$96kjaF0#`CUc<4(EXVz+FuTX?k3JO|*-pR?5S z(TFt)m2&O*hmiN4tXK`GL&hEdT#PD^rTU@BlZ$mMS-mA8(rVLGU8ozB{$_k4Lpe54*4TVxw6N4P8o0Q+b*|@VDtr)S&38=XMHyHn(h@%yI}Yx z#qBX(QsV9+7YVY$>0VnmmqmJx>5WmAZ*!sh*i!?e=yz9T7cB@Ewm$RxRfjXZo!upG zJhvVRbelOpqe8mkBv$$&s*@RugGe;;BHOU}js7!N2AyIw~0CC+0q;nQSd~k7p)t7}v6v zTIFsV@fohMDDpJOH!tL_ZK|-^lUYwD6Sj#rH0&UY`BZ+SZk1{%*| zmf@52oJ?vVUfy%X)=DW`x9++{G>x?!r|SF^%6L4kErS_hpzFQgM`bBrO>kObHK3?l zFo-`DRY*E0f7~YQeKo?qt33=dnVNV9UO$eHEa#E()Vi?{Vvgcl>2cp#BAIPP|GI|X zS>&wL5mzd(F&M@uGkthZh^k$$uB9YIweCM;A8vCtIH=OYp4y5pe{b+f{L#v1mrZ}$ zIKCM!gV3Y*(GNtyg!@9Dajz#B_ODTH+r{XFn8QlGTYg${T@%5%FdQ^;<(6fMzpD(6 zw!?l^g=qW^McO3q&d;M0BIO~Do4N0oVv;`Pb1!{aXG9|}@k~Ehmwd) ziq{Dg^^z=mqv^kSLb?-%@b)!LQKysPb9~$k<vjIj& zGqNg=4yTHZETVp?-g>Ec>J(&IJZ$FV^1p|$xSXRS}9x1K^WjXfT+M%U4{47xsLKryD-%sEO%br(C$bVZ+-*I2Vc=i8!_n;<1xZ*i)K*V2UI zw4FM>3kYSWt&KR|b*uTvpd6i5=(jm5Wbc_M3m=orojU|D6>hTl9#KzC(&(obK#;6! z>isqQVI`Ksu{PhIpNEHN>A|h4kU3v=; zKmq9`fbNV3XY>%Qi7{chxuTs*pe zW4TiC+{d%z5ku*A!y=C2RVm+=2afd{a*)g6vfIP`nPv7$GE!6<#HMJ^O69wgB^t}w zZy>sm8$%38uYIQoHNu#a-+DiLo%`$yyw4jJwz2JmIW=SxOZw+93a$R(@^KN&o&K^P zDuRkY#j^IJHs#d*-Us{flscEWXX!g<-?Xay$S=oz@LL(F{zzW$37sVeDdPUR>Vs!* zJ6o1E`DyT7cRa*qo(Dk$xJ+4W>C)y}@QKA9e?6!PBmSMrNW2VzkWFm~xJiOnhMJG} z@ITcwAM?^@)iw_4n0=@7o^S8{t;QHucz<`feRSB3Tmg-dN4QsepF<5L&rf5s*k#)*$I=r4iA0L4P!q6FCZ-^0+y$T;xLeC7Y z$Vwz;oQVce<_C_AFlS)eTXlS;eMenUw}_n;%gLvN5_4Z~V4sG!_U+)t2u(aC)^?GV zA*teeKQkBa(ThW~#ND?$_iip8&fGrDql?2VG)^$X#>4j6byH z2@B8)jN=~4d0XAbMjR+Sb3o);t9aHbYf;ME+H^so$|xn!>tuOyG}7K1cCLR!CiCy} zh=2gl^EV2k4tsuCjx%En^M~@UFL55QgLQaZ4qilxa{&*#KhlCtsnl*C__t?;B|brr zuN2O*j``Pi$U%kqk2qz106~AMBetb3Ej=-L5(l_CWvs$O8;;--|Gfr}%QpVA;WPlS zTLZ}r&Q0Mb+a#5n!#1r;BAeT7^k6`6}@t4pa$nAuafFZ&g|P zp!du(&W~xqhOKRPk*|X>Yi~;IBgAAIY!_{I^5z+@k$Rd)1qFkncxf(7!ePVn!78Ps zgyUf)DnF)zdznI-ekLXF)k=B3evoRY}dT$o3s3OtvKR|Ez0M6$DPdoKC4Beo8154 zByKAOztND<=mxvE^BUeW6TglB!7+aN6=UCI5Ak;IPDvewsEEw$EenL7GUA6I+$SWQ z`Efu35rAI2qFZz;Z#SAmf zp1|Wl7dhtIEUGNdb4NE5<@*bk(TJHwJFiOhMQF$o>ell}u@uivp23=@`5h&mq%`e`CP|b0vMZ@(2 z;1rU+6-kSo`&f-xtJWlX^;9wNuDkGTMhXF?cuWxsI(zr=5E=a*uPZVbyq)Af_D+J%s|~^u;VE2!tb4-is}1WbYo*L6>D~vo=!KC??ruqPq`ioWG7aqLWN%kt2x9_ z!Bxq%<_R$i%ML%jYzk#a%Rt?T-oF*5+n2=wRYtuoD|)>CIp&;7jD=^`Y_x6nYx96X z^QGqYl@2MXm7ruwh3O8r%H<9+Cwjir`@~7RyUwCZt=~uDbD!tT%JjxcQ83(cHcoY2 zkqv6}R4hwGsysPUx!1~E2_s5e)F|frQ0|jgs0=FCCsNeU^jC}K&JXRTfMZVDDRtvxlYy1aj3N0`)%rBMNpZUh}$>aC~O?6dmHZV<0!L4JA8(}B@gx$V~*W9-eZjY z-icQ#xgvu2j7rU;2h6YY5$Y7alzlJsO38h&-DcKI_4LU|v+H3;9VR$$K^e7S#JFEw z{yEVAGv3**7`m55-XM_EfJsya{FDl)_8A|>1o!R#T(D*~DnjZCM)n^4TxW)0BNWw= zy)^cpYC%z-ZAs=jHOFliy@H9Y9||||TKpXMXncw*euLR;aJpYHianAyKMmq$@) z9~X2X1QG~tl!Op5;)^S&uW&5+tZK%BbcX9>Dfv{$=?pN+&4w^4xL+a{oa zWM{-5YR|qRiPhf?q>klTc5)qw>1{cf6vQlws3%+G69Y$pV`y#5$=E*r{yuXH?$hYF z3H9Ec)Tw>VP}KMRL~S&WpS0)A#f!{RnBX(^$Ep=s79t*Rp@DxNI`=n%ZTVA!18s_k zEB9~`8F}j4SZRCxy(`z>WBh^?W28T7h8?HkG`Bc(G$XRRj%P7*&8Qqy>jzqeEu`w) zmhLlv8$vqeJdLc>gU%;&4%%`Q=(!(0$r}fIzLD5ezKvR(v*DGo|#F4;TYYHhyV9AP$_OTCWuF=M<*DZ^WrfespL9M`Dzc z5EJ~?$(PqG@#Uc?+1$barg=}R)uP}!~K&RkE}O=zn)A=Er{inZ(?nU=axw6 z46Jv`D8cugDbuaPNMFGIEzVIF?#;!A=lVxGRw{M`OYWicDc339&;L>X!KceAe^UIr zLIuwykrQ_!khGQ{n0uB|%~b*^Xe5&Z@59bUrSu&tsl=y4i;y3G3-^gAh>S;f`YL#} z7Qga-1cn{vP(8N@e=LvD09YVsitMBat`p#Bc;O>svM~}Sx?utM)6n-Ua=({BEPFpA z)|)tgukd468sz=+ze5!65-|!yoecCLmFANlEO$f}iDxm7|DhKA2Tl-^c{oh=YQWN*fjO$V*9p;VYy!!h6Z7Or=P~)QRBDh3YNYYE$e4^X8GGc zr@Td(&=D^HywXJQKX4H5{Xddi9im^DV;F20=Gs5d2+Z%slndkIO+ShuqT5hh4o>j< z{|^cAcc=b`nDM`15&yT5zb1l=PM#B!gzSHJ!(Ws}oC4+5>wJ#??+nZTW#nHT$A7UR z{+a4AK!d-3^LOOGydD2aLu8;zu%vRMwG!8rpW|~gUYH=&nxoHCYm@KW9T_%p=Fvsx zDIEn9Wa)fMNrSOhBN@fF>svPs!X0lj9ODPKjL0jgMXDL5KMnY@n^t78c3FJ&Z4!R2 zn~%)8%{|2$m!9N2flXH*K7-A*hGY+Cy}yM$2_#PFTv7ac;ovJhK09pIzm=X$X{aN# z5GmA+Pm`WJ6p1y`>g;S?`IHiUY;h}_XdWF>8#C;!%&*%am_dZ#L+h7!`MLIqiANsk z-fm}>EdQ>FaXqIwGt;$I3Nd|?yZM!bU?_3_Q!(MG$Az<`i~>P^MCYI7J9$I|G12yV zFO|#pCv4Jx3pvc(cZ*BWO=AHj1;E%|K;NPG-wtX-Z6uvSY2x6pfer!|$lqhzludHm zr3!~@-RW};wUk0}_1zDTO4|`P*~1l<)h`v~2_A>o7rDGq{ixmfGzvwDh?`gq3;1M- zQ?S;pGg6iUw;^$z*Vva|)%|rm9Nw?5+>#3;(v&LLlb_VU0g^^C!jX1BTl`L?x^`>D!vaxJ-k_=_m^G?CojwB;v}aJI9Zp zLyFeLk6i|LO?%eLhv(Z#ly;N#H3eNam-p;JH00X*bvLJ6NfEtgKgMj>W)K@WF4?I2 z`s{rMC7s?YF~PVG!RuQsp(9Q5tR}_954y6$B__0J#v_ndTl_g&#;yu=sLFyq*5j9> zqaBP4b?J-CP94EKrW?H_D1sVPNkMs0-bOu%U{8Wu_&hhx&0au*bg^lx9Zb1x!#@hn z(o&A!6xYMVUcEjTMnN9DE2lC zkkNXa+;EL-LQ3!5`9gIEqVo;+h7@$KJZd8(%Aze0=d8Zo+O@I293*qSgU}4$BG-vs zTl}kdv$-|WRR-}gJ|oJ51ya8?*TB3uoTY|D2bXRYB)hWidw?e#o z9_mFAzvF<|DUU}6DY);ylzbSYK1${N%B0R+s>Y=T&YQi zCYuU31sZGbTw+^=gc~6k>>vC1DbUddD9*Y?4{`xXF4ax*qPW~Q#5 z4a;tN+rO%99F{%I8DXGhz4&f5)>M2IO+Uk2FtdN(vxP%4;bIGP*}{a*oo;t!)hi6# zV|I&CTmYXr^jPdXrm@Q@+3%sW1pQ%#WS#5uUC*p#9Jq@@q508~U4}PZ)c<&*Fu7)H zkkbc+8JD4&Pp#{!>m$zHqe$T{QUAcPTr(mo_2L0p@t)=_iPLX`wG|KW$<`!X^#uIF zG!5HO*s`g-8h9ZI@`kR>M1s~6DjTW$_X$@dj=G;i*P_$uYi6Fmidi$7(3-Y@)M084 z>0;>7P~2WTlQ@z3kVpivuVQ@vq?8Y(!;F1HTOK%@VdN|d@=PqlVw_$IlpWX}5Zl7{ zLz-VEquM~)?9d(J@q#2F~C&kWf&*V3`g%AM)ZStkW133_Gi^L)$n zo!C%f@U+nlK7)ru?sy+XL#=U-3aPzczB3%r@UNFZo4YK&t*KM*Wa%pLz*E9^YqoGH zE3jRgkKP5%oN@&6+?&IX8$>{I0zaJ*oXTVg*Glc-=qybA z5Zvpho=vE&SBGF1(kfBYhJ@1i(4CF zmOTk9VA9WPz4UXwzUw!*O%O{dkW)CSCSz945IrJb^jEPV!s~)Phq~TdH+M`TE71eR zx-%r|cg51F-kV8>+>j;i(z?L?Ry{ki=GcLtN_cD3kf&KvWF4?9kkDRYFg;taCe68@ zTuyn>7^{U8ShzGTIL4JR+)G{DHt#q@4T;F|feF6Lc9vI%qiq8O+KTZPF?@n=KD})GTa72O)G+W0D+DdDb+U(} zzVuEV0%`h|G47wtq$13bBqNF;DnuuJf}brc=O}afAC|m0Z)>j-H5dM{ZS}DOwX+f)%a8;w?vlmPdqyXZN zh&X5EfvHb7syeK}P<@7Rz@i68tFUHB@HL@lDxVJ|a+oQsav`jH<`V zi!);q0tmr7$zIOaQlOFkR~eT-1f^zAVywfkHzota62nh1dgtmVcr9hL;ydG;PY~~S zF`q4(nX9-*@sGIJF$!BsyU*%&{YqRlY?GJik>97%7BF52QDzgT@8htDs1$haWqtn9 zdku`TZ7YTGLU52lRHAIJb(2!r5vx4ycae+EhQqw&Y`1JZh93{ZJF^)L>~ar-ER2F6 zkgMCtPv@l>Hjh&5B#%nyqt1pLp($sKiEHdxYXc5y;iUX`VmlH z^yBpKj|a`iYfHLM3e^`h(Td|zNLEgEJnJf);DFG3awnA(48RH+y+o~77`Bl&Q1>MU zfnx1{zaxSV0_mj(-DiSiL28XxTti(fv=*h+Kuo_Uw%p$t!@!c3j}2m59`j&CAE&pV zO1guF&rirnb&0*eo`W8E#ZmAbQFPZ`VGnw!{Tdi+3rhv(mf>iQz)~;xr*kIU{{%7+ z>o>F5-xt>JhC-PP>IXO0!SY?Z59O?gS8F$W)1#ge21yhHWA6Dj{oJqexD&uwbI!%r zZmS5vatY-RiGVS>BWZAMng>V!DG+h(oej5%}z@1dz(6V^#Fg?^- zil?L=UlXvtOW1`q!twmfi$!y09q))!Ho?opD`D~AVH%9cEXkcgBo+fO;p*Y-G_ZCu z9yNNMYj&?Sqv_&z0XJAqX)~qAeZfb<(>4}^nYihV`O(X3ScK7k1V+3!my*(D5v}3y zqJkMKoYRdIV-@16uXGp{(aMJMyDH;-EB}gcsG^y^fK!$KImR4<>*M|EjL|!LD+2;~ zev=rDellbEhUohoMjj=$8~$vh56>7=Q9r)8U1-m_P#uIvr`k?E!U8%f2fv9~r(NM- zsVafF;d|9D$67#FsynQ5pX@KKHizMZO_irn;YZHMTk(MtN}iRcc_GcJt$Ry(&B@=n zizQ6aJr!Zf^DYHtR-#(zq5PyPm$I z67I!42TLPSJ9=7R*@1jNCx*#=5&h=EsjToU6NuUTewtHXin-8%OdfhgYOkQH$wRs~ z>E49lnD{yGCCA*W%PqEj+;c~|gUZcnj2>5^xX_^Fc$dNkH+Xuq)3~x5TW(XlaT@-5ibQeIf^K&w{S#*&#!)c0RDlo>Y3@eKrO&vLIo4Ce83E(}iPJrxWG&f0T+I#}ehoL)6Hwr`RCA6!*U z-;>OA6}EB2Tub#lmb0Dd8sD;@w<=Yd7n zm+Eh6+U-01g&1_Gvlen@%pJSj`l4jaGvcrL_t8YsoftdFMfGtxTBG4EA!-|ji{T}Z zMvOHVF0we44O`j_-s+9EqaGx~F;0?bS(<$9MRo>m?pG3qT@|&BQE_IUxF|?4z)6_< z`wOXo6B>xogb$k4^@X^=K^;?3Q>xq8XTt1E(=WV%nDoTc5FGOCm}_L^aY*zSXR=(^ zLb-)L@|P4w4**^!{M@+F0BN|jT1;f_+@zrHSi8D8UqfTvf4jFmOW+{=l!+srk&{Lu zzd&7|&q0j&6O3K)pRfN`695k={hB#@bksb)D=x~b7-yg64pYwym)WgLKUR;th>LKf z!6ZP$#zWNFMSo!Cri`M|mk`<4)Wcqr%*~W(8h^yI^7obmt5Mp?*y_3@F>kb_MXeG4 z1Csf~Tu2*U#+T;j!m?nqD0=Bs%=c=q{-W8sVWoLDHq64{WZeBQcoSCj@cw&Ge8lox zbeP*>LnRYOR&_R{Rr!C2QIGgc=Qq;A1`i#+K@6nmAKpIfCmuVPr40!N?+~Ozb(K_H z(p`mqK^QW_AnP%T>z;heX`bhY;^hCVIq7CMTO1lz-@l|kKcx(3232H_STFW0duh0) z%e=eK8Kb)G-U^4y3BGEAcq^iE>6y@YM>4;Tq%F5o>_3wG9Ht=b@ONWfyynEx3vUDM z5`|>Ni|p#yhVH~#WIiEf{ z;KR9ZWz;~=n)&FQ^Me3?4i@so?q~5kb2<;9XQwxm*9Uu)Qx@yN(|uotV+Ke{ez}K| z*F@%BzMmbeC12qC=^%8+sEbLUXoAT4T}m)(enIVJVds$-0lo}e((MjS{z8kcvf621gebjxWS=> z2IGu28`}mReNi%{bIOqSp&UPUjjn&VFs@kiM!#9qC}Ba!Ktj98-}?mvGIV50mabO6 zIaNJ%o@r!?m~cD*{u--=O}?=C2rF=v&*&GnfCi8UC{SSe3KH$FyEX}4-?N~=PP zINTRZq*W7lzb%W+?8r#el`LLXu|J?4;JWQKfT&sMJ-$t7k$K6)gii%~E^0#+b0 zPH!Qfs~sE>n{!MNaZ5-zi$pp7Q9VF%spw`CZ%iE9uW*pepU)=pa|1=?Q(CfpD2LSU z%XrI5@*V5|XI4S`Edk9Gh``X1(1f=6#RjPpCZ=aPybF_6X+v4P0*y4eoUVsnhc8J^F=`y$jZe{5g_YR3_=@AF^{aft%HOg*us{o!0tj#s ze`JG7JjVUhpOD0oU~`dKbZ)u9`^G@T&B_1T0q^4KLdOI}dW>sg=vPU8_`LYY?=1vtPEaijC0=8;1QejAQC+WnwYzrBbI~!OYr7d$7?4 zJm>^-%?WISp>b%WG(2)(9yQTfTe!R1|qd!uYyi7z^ zScikb9YMVDQFBoG8AW9}J%!dQ4kMaMA0-GQT^@76)vuA%oyo6rghKPFZAkD_1E z(^+ncxgr7+B%fUu`7B806!USqjmXoeG4Im$psmIH3ibNCl(yG#cAz~z7GiuciX>)n z5Chz2#rfnF-cVb9boca2q6k|H4rx?r%rLs|Bk5YNSVhO6m zHt0)oO63qR!MDX$zcc>kpb*i3r%W^gu;vzO;4d1GFeQS;YnC4Lxgn95m65F^D!Iz)h0ooKsKWW z#3O6jQ%7CfgC9O~f~$)vBoPtmUxf_gxj(H~255=g^(Uxr7k8bvMc-MCc|Q3Jr_f5< zM?{*jLXZ|J9Oz`KmoO1z;y*cDj3GnE^bf!BK_@e5v>y4Vw^|bWxpf`p|K$z)f9tJ`=e2T!!f zuga*@30=xz%X#bb1ll@Am$pNGyGv9X8aT7HpE|M_ycC=Kg5b{vGbdi$^EbyBYhlUo zF|7mot&2U(>|5!0D{ydKyM9aM$|r=;#gAxBIeMu>UUB7xQ=*haSU6hlSTKEjW{{YS zyZ7^hrP&S9$3QDg!9H}ZztA6I{VsT2|EN+j%}AWFC5V9Gd#0TZ`855B4qV$)})vBos?;2k50*5ZWfr&`w>S2I7jKuhXMkJm)rQh^98b+5JC~i#fPRU{hV950~cc|1bbd7$Gy=n@M=664TqPtP(X=Qh)IJ$H*V{w6RkW2(j7MI9ZG(trwci^I#Ee2Rh26Eo=$G ze|5c~1>1aCc%z2JT*5<{p4R2*BDTKNpL@R6!UC!!gUnV|+dO487XNK|^eyf41i9`V zbIN5onL@sgU{C>Xdc(qZJ%jPf?SsI zJYC5H%#AJ$Q_+tu1oKGV?b%q5&FL(_lxYSa2RmPpJQ47fMF;vrU##4Zv$D_{~>4P!NR)>(d367JHcT z`NOA@vfH0vX7_J3I1MZF`vCkd5z-*ozN|2Jn7~5O{Tw0=Gm4PZl>6~vjCdjZ)>Kv= za(9)Nn~Vp(+A(p8&zjhjeuhzVc6p0E)omP;5fh~xT##tGV2L7HeVH-u5jAsD1~#R1 zs;Sb)#Ff>0P%IFEr-nxeZ}%>MwlL|;kE55OA5qlHMbu`GaTK1fj|)0~{}K>PSSLVA zis32y6MM0JhW8Z_+aLyhZhhhY)u?G!30~IAL%!+=)Cg5Jh9& z^Y@=UKD?x~Wk2$tqozci169K9G4{B}5%4~oBRdNSBn?W3$=R^%^a%o-mwy&hW13(r zS@0AVGNX@3|6$YEdz&&A145ON1nFKGoYGb=N>l4SF*weymwnBO=VBNMW>7ZV5OlkP z;Y8uo>t>>7h{hzC{77;67pV)bzv4>Sd5$A3?kdU46-yEy#}}O zwqG)wAs>8;U-N8|m-~0aba}%xbNi>qTPE^3gfs-x%gym`d$<4Y>W29VrVAY8+ZCn- z9Hs{x=3AzVR=w7}8TPdFc~!jgy`nKumL})T%~`=wL1!}ljcuX&l4e35adz()XUQW` zRyRC=+@5A>i#z2j@BoWCHN5M7ur5F;W=S(9-!q)Gz}rL)z~ujjILa@6DNfm?r;iaA z%ayptzO90me=wmzk_e~$D7@sTMij!Oks5jb9WZ9p#hfwI&oo$P(T_oUD9x11zJW*) zC)z>t=!L*LH5MWQ_1_}^Ibl6|ki#lC%_{)b#hN{78~hPAYOZBAQS;+$Wfo z1r4jW&BJa(|L*}Lw7>2h%W5RXMsl>8+*0WJU;}s+-CK*K-U07~rjA5?)lniQn+H_q zuF4VJ_x#wUpeL@OScSQg3U990eh6Kk?)v6WG=wqp{g}kjhoWBsgX}^dZd%3LL^HxQ& zQ{QkB&t7dT+$>_rgxV~RcUOyjnp;%?FcVn0H*On8d+vcVsLw&w>v(Ml0Av(dJhbF5 zKq>}WN$M0u;pz`C_ifS3ES~lFQEHLi@eTPAdElj*CI*QNYX+pQSUqdW{D7!}9!g3( z2*Gmfm89~=E|A}=RC_sFL7uTcL<#)fSRK4Q)RV=jGlm&8?9g_tf4RS7GH~`%8SR$U ztSj4!#|E;-iT2H3(G1=i>Kun7HH--zA2h0TcaFz`9?6I9b+Y)^{mw(PFn8&?#^^ss;-9ALOot=g^la$6Gc&am2`&eSqu zY1~hAMB8@6B{V``_(HsV#=Uf=E-|}21;Xqp8_b>YA!1fOw3VT~1EPLv$Qv`ux$5Vh zB`GN@vKD`5xo|6Z^6I*+$abB|kGlu8d6S&rdGI zBg?y#NlwJ~?mhyJf|D3~OAKUXa;9;TYV@2PFI)girUfE5EJaR35Bmq~Zk8PHr9C^Q z;kaj?9barwseb+CjYydki(m)F%&JdRO5~fEQamb;P%wffX&? z5#ANkb>y*Pyeh2S;IEUQ>�`45fvKzpPZ;I!na0Yo&sR_z?Ps&+*aeO*>B&T(G$} z!w0*&fnDnw@k?6YRihf{;5Rs-2_iY8?ELC)-^dHo!kz&xpFbWROkXXmD7iVKTISx= zl#bt`bwO*3KkFBe*hc=?Oo`4Nx_#=2$XO}yvqICtZye3Fx};3zx`82a|Jgd{1_;@4 zA!`5G{<-v0eZ{-`^VbLNvHxd_YDl9}V^DSSn#vVfP$B*wcDv*z4Qwp^b?uq7@FLPx6!z`V`KmOvVJ)5u2q#z)DQ>es!5oL ze$qMmLTa0$*ir5M)=%$#2M&|_B>Pqexrst|eziA#IP&gl68RG3rAiBIU4PVbdr7Fb z)9|NDzxk-^PaIK#BXT0k6JpA<$-hfF>CRVO*>47#d1wgmzo6Uqi9x=rs}c9aoU|XW zoB_GAzeGlSDSMoN@ovc(uA$@43i!KA$58Pl0G0@J>wUOsp$hK(Rv;WkF}3ru%U=Fw z;Z~vXP!p^FRrq0yfCMMi*Xl@dz~R?f6MKuGQCwj3hEpd|Lg9u$R`z4T7* z$&c&sdX`phU7POc?xA#I?<+r{ZS(oH<}MUv{T$~7&y{^zuioXpU;*t57t=)v39j9D zi|)eOp3g75<9n4F{fsdr1^U&mBC~Vru~(AT>oNC^ihg9cQmbiNKAF1gwBvG|&2M1P z6Z*=gy}n<2fmRy+%A=X;=D+-UZE-JRb`*Y9K*6EEbY4eD|MWsL$d^a+>M&k(FR^+z zBUbSbLu9MAedMZQPsL0fMf4%){1h+1QRNMjp(5pqq(AJ%fiSkfcX~kKG5#*W>$FbP zNNY8UV5rqBdN8yN#XQ9D;qq;;druJkOGjxrHgheb;SQEzp|0b5Co(hW-!KPk=po{D za4qBLoH;_Bi>~t9itPa2+g@Yxyj1;w@JzxUaRP<;r;mD1Nxr^%fd$b7ia(6~W3KF@ z0;J;LyyM~Yc__|a>-o^7InQ=2Hmew;P<<9d0&AQQ5>8>0>H@Qj(ov z7s;!Dvv1%Aa7Xc#QoyO9dH)>FeNLOaVJ-YgU7Ly^I(7zZo-L z-F}v?xs| zv;9<&GStwCs*`gu2Wu5`HM+DPR6nmfH|kqMY& zsS{Ft{j8n2LZ-5=zK7kK~eL8cw zNQ?jEyLq-N=*LTVm-^$84Pa!kcEP_{k{Sv}&^4`j4PK%h<~rHS&Lgjflq#wQjV<=a z9^tk6ZnK8}o$90jaIL8Wx^L4z^xSwY<>GoM3S5fJZRn>Njc17&r+A!igNyEHLXR<^ zS$do~8i29O!N=dH32m8%=3t1Y<*eX=d^p!Y0I$Vj4K_4#@to?;URU()VP9>_H?gC+ zGu+ciaEj-nDyeoZTF<>v!Grv+8%jt;_vvQRln7pBN>EOlunNDfphpefji07}6F4#N z6V-?awSGn6fjb%zzFSOnEY(gE>)tRpB_%3p&&mwI$F4*OgmIc>BKwPsVG*<9HqDe` z2T#*#KS~QEjN2=j|#Jmi!$nEo?6$Zf#*c5T-vMd)g=rCCok$8 zm@}6x3tsU$5xTq4DIL1Hw#pA#oF6bPd?TeQ2|o@X zNtpKb4djR3y}rjh9KI%`k-M#LPzJ*XhV+C}PWNCdS!Hh&03(_}VKF56BHBb5&Ty~# zg+D>{=Tf+Y0ra~!!=oxaye%ne_!tot>AG(r$T=(J6O=ty(e=(g4httO_LKypLf-rS zTFMQ}#DJh#uy~~k({V-$kEy={?|VO$gs---1sPza{oD3KHqvyf3%MWItjyRCavv~~ z^5U4Td~Hk07mN-wDf3H{vhNTjg1;4Lz9goqHHDO4=)k{(S_h;xJ>B9ge1c^5HZmcB zMc_b|63+;Y62}T?PUoLaE3O(9GRg64a>q+ylDaUMjcR-w^W$9jo!k zP8pVe@8WoX7?;%OIIBoJXedy(CcNQJvhYszt7r0?wg_VS64kkJLO^c3F+$vbI!y@q z7Lc2~v~kLv)}B$cr2g$Tjc|7ys23K9D~i8vB?lm@RGmua1|sDNXhXWW7c>Fzw~_TJ zBgnIm-INtJ7u&dl`70L<7>E_jG!K?6rWP>k=EpW=Jkfmtz|H|h3xh2Z`is>b!ClBr z>mLm@aALu2oqt?@J1M08RvhMa&eb#*Umx`@W_??%G+!z7O305!E#V;0*{C$ zT>RR?R$W0CUD}1F{n?~Ws8pbFHTLA6C)NTE%2EnRo5;-bT|(dY{=gC09|QLwd(dmc z4R2bxr6+ZQzczybq`E~DLIvjfm7wTQ#^OPIfGHO?T*z2~P2kh9ZT&u30PeIz(2s` z>!~-}H6pi)0w8ey0w8y0q!pnqDic*&s|5Y7eiqXfMh=1y_@6ywBZQX316x9`hXE_8 zSg+Hv<+4%(9PIc&Ck`e?+aIH{bO_Q77wZE-RINL0~7|J&~|5!cYfa!#o1v6Oke$^kyCworNo+3wQ;Sg6sn(8X`S zuJC&jjT8l+bvbD~iCKst#{1YFcbL!m71d4UFT3Hf=2@vJWcsV9THE2RWahI{D_Vet zspL4k6$r7`z|_do+ki8<2<e?q_N!dgMjjAMS z>?D{4t4ExDNfQ%ZdCoTUCIbHx`Mv!V8eF*kBUqBa3S;Nu$KY6<_Y!Mv=Fda{PdF71 zIbS>F?%pGEcsY0v+PKpfw)mR{9{}EVz_c>jQTZ{1fg>mbAWNje4bslEna#Lxih74S z{X4Su0vR6`Kn(mY=KA$wBl8_CYqKCPAZDzX)AG3Gv5|19Le<`=!tGBqUFiA4ROgi9 zeE`IXECxJ1N|CXZ4ea6>oQqFV_lS)HZ{yy0YoVx!?3E0FR7I69rHanF1-U5H+M-)1 z!)T+;WBhd!4w*wO!bw2n*xwZ0hxS43#ky4`ItIQ9C;Gxo4xExoSP&oLSZZtig!(z% zgd{!Xg~Ti@#_3n$>SvC9^7MgRdnPeU@fkJu0U==LSg}!KWb?=Y+X)wd+)2M|D%}h( zI;yZpFyV@Ad4D2H8dhv$p z;k8R|GeTC7_v^aThb0vpfCd)*z;XQ?KJY;dWU zq3m}VJLJo%W=T)B1V0N%+MHMwS`s`Zy??E!lV)gchba__zSWd4Gfg1P1X~$N8!>-GizMU%^z$haR_k z77x<07|(kzmXw~CO6fGDIW-?p6AhH;xnP_1;as7#t6+^htbx+rq0(7r8M!AfW-dr* z&*_NP68OFc{*2g)_49rB%@3OvNqb)+hjudl4}#||Gu7A^7S(zA$n?3XEjg$Kmw7{1 z7=vX5UCAz9VzmbDaskVqQ=(K~r;@Zv1rRRY&rIO`eBlh-ml#?6BCAb3CvqScSfKZX zzK^Zzd$>Wy5~7S2%%pLKO;kp&PbE0*tt^$875)z7QLp8ruO4lo3<%=;5&Xc{;l~6holj&&5sQKqT&J{>ZbW^q}u z=O7eh83x!ALO;}ijdHgu7NcIJ3XCa#$2u4C$b5dk;}5`enYFF8ov$?lN3zW^t}@^E?Svv9lB7Req=V;q|}wZf+WEYP4KDTVMKGC-=JKX|Va{ zVuWvl!NX+YzPU}v9y6zO+np&eFApD~nRU`zsgS1uQW`$e^0bg9pxVCTcs#s8*_T)2 zIpURnx+^H0{g9oXw*f4*n1A=Y=aFfJ;PMfx>O?!+N^6DsV^!mlBIcPGT`caNo=N>5 z#0cqn)ws%<26gIV?qy-w*7H4*f2Tb;VN&>w!aJd>x)*1|zc96K>#s<$+n1r{#|(_{ z$N*Q}G`?rvY#_Dl_$CgXouA8(Nd(eTY2h&1RSx7>VP_;EAC9w=lM`U+#0O;hA}v(o zyCKJd;PQ!Ytk!-=`6#`PXY}UENqprYxdxC;M%(SfaHqvcYN{`L_aA&U>6HBGH-mRT z)X6k}Z^`B|>SXetk}$3}=)a3_ZA=lKNc7+Jc5y0|8ZXU%)#PgQI-;1OJlVEO{_Qy5 zhPul`FXvC|1+8!S*c`b{s{h2p5u49%iCLa62+p53Me~LuA2(%A5qJ<_)<04C^&iSXaI-I{RrR#;d8#wV8lG0yDqmAe=#(hZBP z7KvlUg(T$-Z~s}!8o$Il5pixabw^P>33{RngKvGeorna{#qoRXf*(ic-r(!U&S<~6 z`8Dg9BdqU;(xXtrvO4reeD zh)p2+DC@%o&K(0iQ33&-Vo})G9ehRCc%UBE4QC~!4%RYrV?Ef3KSN+*`9xaI3sw+6 zkmkSh5(r2NI3&}{#5ZfQ+BlXt7Q6Bh9g>PE#~$*r3#+xdIJ4z~PYS#hI`MvB`cW7Q zZGWLl@YS}ekO@8DLvye{L3n5hiz(vC~uUhbw(|}`+HZ$6e@`jAU7lY zYabKUnXDXnO#t6G)9xIqP+HIE){*%;3*Ty3M?ImbJw_F%qnpNsywH(oLqb5b_T6oG z#(o7eM*wpZrh#Q1tHHswIOp!OH7E53o+y2so=d6f(@%cV*tpqP)l|eE_Zmv;ZivOu zPkF1b%oe!T-Js|uj{^!?BL+|$`CUsdn%ym%grZ>7b_d=hKUyiHBYgHyT#4kdO(J`<1b)eLDDTBV z)?=3!{nQIbg4f(CJ`Y}UJ0;cW4@lNE0A&v7&g=RsM|GS|aRB!^jmcMv23xx?6zz&Q z=^8TIR34+k7f-`yjj>N~pb84L;#E=H?x-qwA) zH%RyE;w}*BBIC9u6SVKyC&$2`4TXWOIMC7>Qb&=l=$Ok7uY+e#dj|I^n!DWD^%XPF z83f=1BGy3nP-#rjh}C60BlkKjW7s=REz6ElzpVDsQbm2yQ`r(NST}1eeOUh`JmaHZ zc|4sM@l-d};(1DC+*8(HAK2Frk>{SYQJy7UoB&gr|3lbYheg?S{om&d-5?+xg2d3> zF@UsmNu#vV-3%b8NH+`V3}Vi7zGq)b!>I zIg03Z{lM$FC0oyAwnM;a00%(5|ZcNA%?J7qI)- zNFdYF93$K%YtW9J>OKPmqc=aXz|l`?lMWlQ2i)xIo#`Ajd&m>xVir!UQWF1i*dl2H zC??oAL+=|}Umi*VyU-nH?L@knE|mK$%_4vR*ES))i!{y>|CL~72xA}MIP3EMQF&WU zx5)}(k0jRe7wtzy?*YiGoEJQ>%%sy4LRbU8EeHm=4k)y42I%DLFn_d2Jv^*ad zxN3nw9XPPvcE*5$(LZd3*m6gEji6b%5M2pjbe78O_=~;I{&n%^8OV0B@bS^sEbC#U zW1&;WboWeW!6-@ClaJYc90L&?QfxH6H5^nh=-!nHlzDuAxB;{r13skI44}sV$7w^W z%^5l@ zu37Zp5e+!^oo-$=TA2Gtey8FXv<*iSTKjgK%*DLS!L**pUQc-!X)UT;AMn> z{gM-VFTC?QcS+(58Qpv~yRy?qf7_ZkfBFrPIOvkGIusHqO-u%>@k zY6Y=dQ-5Nk56buXRhji_P+Y-Z11ynz+)fuSZ8%G}TI6IIHs_5YbRr0XS;eo6emSb= zZ3sFl#J5BI|m4%`F02&lsgC{5fnVqQ4SNg?v(uLHl+s8*HKvc_=Y0A@%?)!6$n`q{YE4* zW&zFP`Nf#%zjNpmcovG|sMHDq5^NPEoKX#F(n7>_I#g+|ZE|R+?!?hI6QpYKa+bp* zPG1w)yVM;~O_sz8B-3v_6HP<=g%B5aFXdieD|78z#4 z0DCfO+S{Vilh#fUq$Ii1V8G(Kq}N9{P~WG9+!V29g-?b2p_Hgo>Lzo| zEa>r^d9?wYNc8VqdyoJOBk1}2WVVR#xTf}C1>N+P5liW77XAi5i~AjGJ+nOho~IqK zA0LttLd{u4t7`e*M+HW&Qq7*D>*1EhUS%?QVaM0`3cC;@Ly4e$<(jO8GeI(rl<)GsOpqn`)UzY%EqUi;h?8%hfPf-imq?qQ**U^U~6 z58N+A_5a=hjy=!cy=(%k!jO^w`iy1l_i$(kN{%9>iE``m;pP>EDCyoaG(Yj7rAHV@ zm(dvqw(s`YP2!F3$oXLTK0E3(lJf|SF@ug=0c7<1mZKF7|NT0u@C-dW%d`GK2C(h~ z^ayz&67q#IaW^_T&#|hxSt(wu`_&;yRJ=r?hz0_NuG7AV0<~gB#2qBVt_yyizLI;K zlx4zd@wLZNbMxf5Gd#|bt5i9JtU=nkAg%(GU=k>nO-jpZpT&l;7t51*RE-yufvY7Vpbrc!>@? zp9Y_~QWwg3zTO34q^smRlIhh<*%c&sS}YkNw4f7UZ-@qVUjJ41DL&CMG|{FThp@aO zB%iZ5eYPw~%Cld+Z|tsF>u#rW|LH(@)|hjd(4R6}eLcxbfu_i!IqyoS4+V6KYAA9O zmTHP!BuI18nv5$}G8ek$+}}vu7}XNt&CS6>p1kC5wInC2fT+qrmL|T}06&3W;-GPr zk|0yv`tJ5919sVH(u%si;kRfY_}~So4gS5CIHduB{B2z3gE>HfY^WLuR1vG?Ql-1E zVOVy~%KAX1e<-6XTVLfiHtHfZ%C^Np*vsBU$1?<>FxS?9_f7X$HG36r)zGRb2YD^r znfS9O6r)~Rr#8y{7BL6+#bUqt?x?=h>*F?ioutjBubkNen3Pv+*5aAgN#1Np2jBT5 zRg*8&c`bR~g%~AAOf(KyWt+IEceAXJ*xk*!mRTM>*(2BGJ1V^y_In#l=lMbZy|jp& z>6fFi8t_0Z-10i}t}>=1m5i?Z)}BwFR?C*znuRsTKQU(<^(M*YqY9%$_DBv(GSPrU zp38u`D2j&ShKACJoY%>x2;t+7zQuxmmzB($TUxpkGnzRjY0%(59xDnViwn7!0n&*k zYEjSD(2pF_$YZtmVAGtRZmsdvg)(_PF0O>z>D|72S0Dq9K-&0D67KVC*0!a-{(t+& zNh`Vaew+Wqv30(cA&3uMRA$iFl1fsy9RDpm7D8jql8-pNKC+_iwzLiV$0AyKUMp-l zY{>gaesEXqK{tbDDMCRlQCuOSJS)k4EpasjIlt4OU)?3>}$mgHUxMOD9Pt0w{eSiT$CmrwG4=o1`~F?J z>%~&hdAHOlH8rAMD^M%EsFHiSqEux z_Juv7bL7cfSN6sAB??P)!0NWUw3I9IJ%IH&{0jEqaRb^hhjR)1Gi z@ZB06;;N4&CSVoL64U!oPXiO7bXO_j8dNyPxXeA1v*n_ac8T!$^KKYkh0s*=I+8=d z$QHS2i`AgM?vq~Hb6??YL?JBd06{bUwtpUj{AKX~e928Of{3|My`3 zAEW=jhVLIm#Qz??c5VQIxU_$`gnakDMo5)$nE#C05NIyXel8zImMv3<2z<@e!Wgaf zK-I`A25#-Ssk@T9HnDD|4sZX6ccsp!O%)a^ZHmz`5EFSw`Sp)o)R*9^wCAk^NO=Hq z@lOCsAF~y6TvZUQ8tZ>LM*KSAbPt#I#eT+gquDpX*@+sfrW4COwwfNkR^mO)8NrMc zAA5r@J4Ob`COIv2?|a3N0kAepse4_z37YPU`u3a(t!2-1H7hISXkUL^sUYw1yXc2+ zcj#WavwW`?#>hR};W2;MrNy{BwFBP&>wD0Fpk|2M{V2P2X|^kJ7Q!1xV4dHWCo&Nc zX>rN|#Jw{o#Jzh8)K)l{rO#lOOc{Tu#qomxKh*!1gHi+0w56D_2m5QHMc$V!-2cIw$~b1y{vt~ zso=G8-_)?7Ef+UzDHnsox8T4rGn#h^?3P}Uu{IADs+*f@7Q90 zNg?Rwv^DH3!w1Pk`{k|~`aT{B@5cA+?GRn%4ze==abnW^iA1oc#~P`IVV%$CVkqJI zJ=H|c7K|t8hlNpu8dlUy;eEC2_9V%!Y6xSQN=m?rS^l>|@(Q-JuwvMbuxMPWA9#ce z?{f;yQ3v?WjxER;^(q^Kf;A+H6Mdg|z=C2xIUf?2t*L2_ehsk#=%;@_oudzW(&w3k zOEtFc_65buV+MF*zgBc#jzSpQ94x^9Y=)hfRTW&9N1&J2olVj)#wzc2%*PDagJD=8 ziu>nOp|NWSsS#?}`SlWnltj|yw&f^@OMZAs*QHJYVO;2Yb9f5(JSdhr7a@HA@NLa@ z{7fDtuGsY5ohiW$v+Abm-CWYjs1vkG{i>Pk@?HiFR~aa%@S)FH!9-U0LS&H*DBq1xlj)0G$xzDK7Q zUDirn+S7KEs)yfUHJ(Qxe(z}S&BrPR{Yk%m7x;cQc;rx;;znmDTuKCLVtyE5`Ts9_`cm;QiDm&!nzdoyNbSsC+{k7@ zLCS<}bP_Q1!<{@p?$(OD`6b|x4zU;fXQH3c%ZS%6{Rir`tH-q=r6Jx~FKz0-_txNr z_{7rK5ZSC`v5GFJj{Fe9!)VW&

l*DH_W=+i*G%X`BWj>qD#x4La;3CY(x$bIpj? z^^H82)-TrD1PTT<0%kYm)2*Q@*%{57S2hi7Ea8unGY#CSI z@0g|ECT>ML^-@BMnTv##&5eFMTu7z5=7*(T=!v&42R5N@CA*~fatDG}dO&lEChVBd zv|0igp7+(_^DfDPxaN3JR8yVaT}odCb}!TI8enzi1bF|jG}P+yqw^`!sjiR8;EUbu zOjLcS#9YoL2q`%_uz5!1P-yY3CVEij)?DV|qBm(pDmK%>V}$prDKzL;QwEA4NGrUh zl66szpAC=+#GV-wg3HG2wOO^k50Jb5gkG%xkw`P}3-=u4AEcLVjS(0vea&&g*#+UQu?l8HRWf$Na4uRReP{3mI_ zjKGY}NG9y1`KIkz%D5BBp2n4hwprhr5G3gE05lx=uJkSIwRHr}veFKBk*Ba`Jm_L?--6&KdT8phA767+XCVEP2cWCE(A)@vs`qVNB@#K1;L*Po zn+~n%&>Y#1dYR1$w!mTLQ@i+3Xx_|;IyI@h7 z_68k5NfBfbPgZ{WDT3e#ew^lj+zmhMlZ-eX>9qEyZBD*5{4-Xs5M>bx_p3dU)U zb=BaHLH}0;dAHxSJG$jqa2E|c%T5cAFty6dmqI25ej*7lPYh)HEreQ<5Gt?WU-`29 zn7@MB7UWZs-J^Ch!A95wn_*j-_@))HpG%Gb!^E6WSnuCP=mBlY_qOxW3yWDq zaSggN&eS~KBFlqF$NTorBdhw-&}@MRry_XU7rE{Hf`%Qp>?hk;2Z>OC;oxh`^$#I0 zdl9rDwxt1szC)EEIi$n30%c8ob!m%7`_jndY^Y*2d`M`7!fWkGNHC305GU~d6I=28 zM*F;W#+MYNtbn!cJ8SKT7 z1{d%H^d2Ry0~cxp0iL;aR%pCL1>77Y8uI}qVT*z)J}_ars3XSgM@5#!lX9nYbRF

Q2_=EhmWfsDT>&KuAiO)qADxS z`heTBq#M93 z??4?+OI(wjJ1Q;nkWIz@YS0#_x)uAbHGk#T5E`XP_$0=2IC<2k(63JQrbQM=jemd5 z&>^J|!$(|3EX~OW#}t%hi7VBza>KYOUu(uJX+jwM$Inl>m-$~TeipYl+lzdSpMDr- zzA7m}mHsN%QwN1w?kYRbg9L*^5`4T*l1~E1W6hp;0;$F@`T9I6M zP6_gc8Tv8u>d$5bePEwQtr^9gP=A7w=o`JbBrCDLA0)h*6gI>12M3b(a2}HkQFH%-3giAQBC(ZAQo(m70 zsi4yuTdXE@l!bDcj4d;-DI@!IhlT9P0J_+j0IB zyk3MdT9+i{{9Ch4*H+NcMd^O(&`oL+uChh~-fv?o=juwzMAd6v;Qe!setQ#9^i6Ig zKbH@=l9=vdK5MM%JdLPTo7Ip+yCcccJ>Gd|u!sffzZV?x>m@S#m-u>=)= z=~m|i(?ehko(cj3B@TJjQ7ZCPkM}=Q_d)uC@@l@?J@z@*5FMi(v@l0|7%#$~y6haO zDms!CSC^nYjoHHiS%ba{qP#VO?Z4=2{sM|ai<_~2Fuvh#?(x67R9A7Cht>FprSCRi zlbAPEB)A7xGE-{Oxip-Bg62jnx@8k-G;(5#G#l}Q2m=5|SXDW}o#w3>QxpgwjGP{zTHcV{&hw1&Lb-!W_V`!) zV{bGJ#o?L8Ds&p;U1jW6f;kDWJd{*golv*@};n}iLA=nF)jMu*~RSw&+fOyrJlhO>?h|5nrDZj;;n9*`$pZEmKgkQl4Bb@MoDW3r(T4y&hkV94BeCO|LcOGgOP?Eb(XKQD{be_;RehmCdc= zQ>DU`tI^ZxPg;8j{giu^_0}Z9yZl5IbZd$~`4u|jjOxrsAfL*P6`00!o>Vq`4iVEMLOp#VC{8&3N}5Za_xvRcKQ}SD!N6<%vwNn}sEn6&*BA ze~JXbRU4U_Y;;i7S&->T^ip*6AtNFDQ9y_MMZ}(_@iA9o9G>|=v5s#~H-{Gq3#>rn zqsqlsi5FhFToBy;()yS2w>nR6`3#XTU@3yaO-5sT7>%7t$%Zds_%xN`{aVt+LDzGc z_o(|E-yK-Z@@&v#9z)YNC^C((5wjGa_w{d>n2rv^!jh6xMzg|_ox#u`#;XF+*+m$v=jFyVlx&sxY^9!haTDKEw8?t9%IH^3PV(96765=yj8ry7`A}z;Wyib-%X)z|uKx3*A0LTTRVmnxqDCI2Uh{x~ zc(o|ES8Bxv31Ipo@vmiqG! zUh){``hb*cOQl-eyt8V{$k?vR;O>UU5cR;DL9a<9;ptW4$5j@VG45jjB2pOG0y)@= z(R`dWlKFeY3xG||#GS(zkFrQ%x{7wf!!V`btw*zefOSi|NU1H>jcjaL{TD?II_sy6 zgNj`}D}#_)Ln@AsR7qJaTW9|EDIrQvao$)J@wU)-x&bFB>BndIz$3Adg%(D7JQ%eN ztEwB9wI`E3|6UD8V(5lI-+5)wp^X%78e+Y9sd`lA(cBP zg+p<~*0O_h`q(Md&OVYM7s@UO=eKT8(KsLkX9^+c%~MeA#&VO@KuT`3H%S}IACn&R zk#b1^h}8Xm;nv@ToK!x!&_AQhE_<|uGdYwM%x~2{%vib9C62de;#x2pmAtn(+<3;> zJj9`rUaQXgDQ`umy7b7@P89J;VeW0v=kJHb!x-o^Og$r`ct76!AGC!ugKcc!3*>>6 z>fMp!30Wwh8q_5%mrUWs#BWRp?O9>@Fx#(hzTZlf9(^l+y1b$C1GYVjJO{5T;|Z^f zf%SxaJsf)~GaqJ>iYB;%k3?S0^J6pOZ@ao*M3@eWz;SHW(h8Ttnu!maUp6Rb`fL(E z6&I^DE%Jp=$g?1eduI19f#*&g8wTqHd@dDFKl(CWsxk%IbV*N171LN>G#j7YUQWZM z5`vQ)<*v+6Es;>JJ&Hn{aGlO&lonEEB4UO1V*=o#osN?~JOJA@YY))AUJ}DIgFP0F zwKMPG4XENq`3Q?B(Cz0Oww-5gE>Ns8f@A5%I=p9)>ySN`S6qPR1Ytt+<&MMMMFEy7 zl0(Z6H|~jm`fu1$U*{q1%w^?Y_N3O~UFV+{7*n>9&o0u7t$7G4nKyXlK@sdf2wu zQLp80_Ai~mBOK!{4GL2~LlRNqMqc)!0~puO6bF8?p#JcToJc$(hWOWyf0Tm zYh6pk2X@!P;)H-F%8sADT*-DY39h+YP9DQOCjkMAxgxux$#Q<=Wj?HCzdA=8zjF+f zb{%rf_&XuZSh{z13-}1+zYjy_rnqMX@=#`!(c%ne5oC~q?UPtk`UR|=gsf_#JRiYL zaoV0tkHi~A5TSDZ!>|}nNzJT{`RDqR-0OWLaRtFy_~o3&ei-|@Q~T&WT1=dKW{ljn zw?}#XL?fLGlXa?U%_Q{na&lFXKGGLG8c{vBBSQV^&5&wdXRWIgJHCM=@6Fs{ zfuLY?0MhOAlYKGesD}2Z|3Pnl}zEA-jTq6g*~NPM^-`gOeODdp>OEvYZy zJJM{v3ab|m7K!N2d>XZ5ue!H>HIcDOIehsf!{T!1HlXmQ&LR9&EZ~{&N0;Ix+_s8kI%5MPMquCr zc*!`Za_}%KOs>CX%%Jg9_T@{HGts$7| zn}*VbjHJ8qjmcvDY8Ohqj`pEj>AvZMn*Q7$?a)m8(~}Rkw?7VllMqUy2fo{U_?aQtn#+G@o^hAXq|V`_FzudOy%>Z(*2lK zgw*6O+bZ_N!Y;Y+jI7vbDx!cXfG zy3waX?w0W2-WZ)x+nQtprkWcUIrFra1RIuU>*Y9>{DsU>F6Z7VGx%d`zevR2(LuzM zLiH@}59AO|x|;1c2agsjgBXBjZO;zY2UQ?Cu!-Ro_PAUl_FMw4NOs0nbk$nrQ9HCxGj(K)sY3h7@ZlTjqD}}EY|I+%>X?@eu8N>9f?VE2y}{Xg+(`b8LEA@o73VR@ zdF7p>e5p;^hz2p?46i8SbF*P`T} zCGFYzV-K~9M;YDx>;sEQO`!r6V&Pa zo7%gfLFJ!bMIgd9G_$MV{H*38AGBN~ySF*QLKdbhQjs$2RPPs`!gZihiTIo|l^|tm z5Rhtnapi4tE~1$jVW?fr)%*Yv3^LtTOz~i2M^j~9JmGO2E$SlXDWT`u<)9kJB+w8Y< z51FgO1M)CBxNA?pg0JvsN7_Eo1fUnS(_qf3L#{)I2muJy8iUMTG*Q4t^FuT$P@A4d z%z{1tlF%br(~0WL<`a4>_>j_ZK?5u8$M6BrrB zHD@iSkpR4hzoTVLFNb%D4@P8)@%CD1?9jywMuE<@bUzzW9MoiW64Ds^umEE>d}Vht z`7ae!1)2kO|Iu2s^HylL&6pr>f--P*^$`Zf>^VoQiiW6l0w#GVZw1qM_d2&8QwL?(2sAI@Uk9kQSvBB#F8AgsLJ zLkD`>PT9yX7lwjgOlL3RIXwHey)$ILr1m@!pnpZ?Oo~Kd7VJg5$oOY45-ZGNjc^xD zPunN}kH%L>ebg7zh4v>Kc+uw|YvUHdZr>YZ1BNPCZzdd~R8Rle7?oA6h}TAKi{my{y2N&|mEtUM z-tII25xSO&(NuRyz`qeAu3m88(v*J~aX5VAV?fuZ9g=z^rDsO32r zR!<+NjzW)y|IC%xFMO5ci60Bl^)uTK#gSEHI=|~@q9}gat$@fLd)>7Lx{)XK;Gsk$+*C6AY?oyOpbk{GZ@67^ zia;C$^Tv%(Nt&G^F?~&9Mik*rlC8p2d)j$o3TTcC14;{NgiQkLk_3R2BHDu+rIr&I zcm~rZ+n3D(t@H0CuHRR&(Y76TJQ{MIxavD?$AA&;i95-1Yqk-IrxL+*@vaH)C9vC0 z&45t^GJ&uINAoE8|CCRN{vyCo0_KlPd(XeX76#W8iivVv~ z7h7F3iC~01eMtiq-BowazF=Ve@jzg17bB}&m&^}oQOKW^)qK|qNx}q#ROWb}Jl9(M zUR%*hQXx}h?5pHJQSv6Er=WJ&JO_Xp+eadLz`o3b56HMotkoW~8iS!2jV;ITAQ#@A zMSc}hw{KsAdhe(9!Tt#DdB$DGxJ?XxRpV(0U}iP>_BCi^vu&;aDp&5tgk5)?|>n#_9$tv#<%aKn=t@&@rfrFc& zzW>|c76Lb!-GnEJzvbUv6M0xdG@b1BWgY8#i?&q1b*T!JL2~pEF%tOwbtW*X@o-4wCFD89npWZ2 zN4dn_IRuA!f`q~B01)mSxAURCD!unBb#vX;rN3*6Mv4&oGLJ|Mk$SX*OvD2sB*EjjEL;aT|Y$Xm2T-CJxCH((U*ZkGyT)7|_Qu7(o z%Y49=hj8NAhW)GU_$$r$8#MYWCHdR_5riN?^=i4xe_Z{46eWMdBmWhH{IxI$a_sRV z^4Bi&)YirfcgHrYZ{yiQ&JCE50NUu^mjt)ZZiRv-j1c^voup zMPWG+6`FTClnu6)Pqo-NUEEM`+`FzHJZ|UjX9{Rt%HbRn-C-ei^I0IWmK=ede4}b) z6#c-JnScY3K>`LZoC|~st3=dy-&P9v3zg!wVPHo4&CDBQYClF3?aMB(oDlHIKR3|H zI+#aFMkHgRqEsrpf4@B5s`J?9)+QM-2}BknQRy4p@5{13ax*~!ua3tscyz9#ejYOS zVxXg6ZQ}IKw4grq?j8qkm@NWON(}i)g^|f`@|&TjamK9Jd!2caJ<`@}k7Vg#p=d?5 z*o3QnSUGlAq%7&acaI}54GlUDUb~+IDWNW>Al+bN;3QovWg}&0h&71z7}{`U~Q$n!Qn2dBc=Oy1^^$V+@dPy|-S&x8B z`71Mh)$)3*690o(xO}>;;mOdNZ)9rphW;A!jA}oUQ=5qnNRYRo<1P9a!#cfE_Km~y z-N@*V8mVnRShG`3*)vJwRr;r+JD2}-PglKrK7Qh(b)NgYTX@|Fc;@75_MGR!^C2*0 zJau~`!iwUfDE3mVsbFv3_qNHyezmbr2p^nU&pj`h{8i=e3?soPD<@oXpFb0sb~zI6Wwk zUVp~Fcl+c4PM%*u0Ln=3Ok@7)jeiEuql{A9AimQy@}IcV)E76kx+hF$Wu+)#lPp4| zsj{6sCfu%f(EYFhon32e5(ln{f%U~JPVFcIm8{%K5DbEJI}9TYRAnO+#}m}?fLbCR z=4R=qWLifa-vgpMjj~aq(Glzr5AVpnJ&Bmup%L3i+riHQX}_5d3^!{0R&Q?ZxW&o^ z^_<=zVgqNxy)J;E&6k@RQjf^FTtr7qw%8HD%qZ_uPRf!pLP`4%P%gD@ym3#GY&Gu( zIyziF+i3T0Mc(@MA*9AE{0wz}Q>4DL2*{qZh#q@x5o+-<`{$Sowtm>4&nDmD)r9`Y z84N>@xvhYMlx}K?#F>4Ql#eNU7hW+3>8d#$q=Y8{i8*iQNI`p6w z*3w|;<(zcz`+VuxAKr}?C%CeLk7{Hj{2{pSqOJC)a&4*sNzs}Yp79vU!zS{?j!lN! zna&8-8{U)nPC;Jex6!S}Zfg=;ot9fQ_llijpSWi|n&uAW+#5fV`oTBY$$rGb=B=|c z%8PhF4RncXI+y81BUMojY391(x<@T!Ps(8qMT4( zxHK!-YCvii=zQi%i1g5SIp>^hjJZRY#$}w8^cfs?0w?y}UG&Jh#a)Bm0uI{?->_vP zlyC`gDqMyEi3?@lgBAj1;3)xqJLbJ_=mQo|*2yuChgW$P-fK(hW0Y*>^2>_|J6i1C_FT&!|OS{@m?XW_2g zxQ%(UeOY^=!#@8zB3CXNR&H2NR;|Silp2)=B9FWvNx+^3)zkj^hrs~M=x`_fU4e%A zPjYJQHg8nnob0jNOZ+tVNgg* znN{`|8#G3{xKuk4$Cb2%OP44x^vBNcXwq;p!P5@RKn^XpQl)n?k)$RZ;3ZG#KT*6x zu9_b3V8mL(Msipc74QtKo+;)^u*Nd1!+lH#6-B1XDfQs;f7d6hFYn!=)WhJnyZ( zHIxu5dFea>?I23f}MD>7xAFe8n+sj7O!H4(bY!kDRGBVI%Kcjbb zk~4o0Nh30l-}vQVU(h@{ zj58D~eW-QqLqW?+Rd0%brSGShP<8&BFOC4^6X_(YsgLsp$8xa)1j(#YotvWhnZqqu z_us_SK{<2SS3ev6hMMr9uS&z7a2DkFy@8CYbhTt^wo*Bu)&d0`_)sxWoG=|v2C2}Q zB)%@1~kHp!L0Ua9~&-I-*xl8Trs3(UYb$; z&ue6m=UsZeE9gC{{}xG6Nd@w}V##k4nhb=GJXHe%kTn<#JM>bzgH(Xmptw>Z6I!$z zej0#279vrty(B>Jxaoe1gPk+wGY9Zg8GSCqaBcWK@T}1}c{Qm~A8d#9D>!$*Qx2P; zETr?zr}I3yW7^LH$Xv763KT@X3(M{8;}$pOlmN0m4bsCCd){sss61ZCx0kRlzo(PI z%z;`lw9VE-V0e%u$)pI9CaIms#6lrdeK+nAKmxe!{j2ABnUH=s zN|f!+lc=Wz&|})j7JVzPWBAh@CC9>pQ#9xSyrLQ&1Q5UNeU>oM74=`s5$w()vvta; z@xHvvaEIk+K>fm&4N=gPf2H%@NI?Jw&q-X(R)ym)-&4Bko?=*j)dC-ezdcq#CO-0k z`}JtEwE>tCf(@(AVVo>8RFL3)(Q>P5V&9A(Ak5USaX9+(cH=b7I$V2T67oW|^f~*t zCnF%;h0!PR?vl;5m=}NEqhA)};yTM6MoPR#CvXk#JJwOrzdp2*-wx;8iXX zTF;?!7L85jR$?$Jr6$KJs&sT)ee_)d=G^mpO`MOCE-p}z8AY0F{pOwxa*jP=D4TD> zH#XJKSf&Kh!h%XX%0X_KBdlShl#9#XAHK=Ej-e=N*V7k%Ai7f;uUMnzk;oLRaZb&V`a-7=lHxwXv z@!?>56DOraIRh39?m9F@FU>@|rI{i_YehwH&q>=1QORUmUY27dWJH*02;*Mr)Ind@G&kg|DGSRPnz>nUzbfneC-gLv_&yo}2lxWm=?Z8her)up}3RZ(DZ=vQX+g8>n>|v8Ek6iX3c0 zK0;PB^de?ew}ub?tsr9lq^=4?AGOBl@AQXNiqb>Oy6woL#6L22p&p!qj6T}XbhGze ztE3wRZLU!CpSSB1s4*7=Z&>n@!gx0$y{rJpU^>QhHwPxUy7w}f~e$X zsOM@PJdN`Bh{9R6PqEp>P-u?L1bHF9tSr^-v*NJkred0_iX}%zq#~vj|D6o}6JloU z)`)BA(4YFp614b+Im(!Y3G<2Nqx>GkCb+GbB`Up84h^5@ObQ4MQZZ#pt1;8t;5se> zFD2_4s!_Iga;Txpzq7LW`h17%Qq9$LBkF)1eVqjZW|kG0v!W}!vVuKBm2;}nR~W4< zq#P?JD8o|l$0*Vi&cMjf{SoV4d7@uyG1W_m^*T@WP1HI=_tWc|b^9kWTW{w7pdIz; z*=dO8n?eCL>%Rt>&bmq~LMe_v<*0WIj=s z9L2znxs;S&ES^@zW&8f>9y0sqzd0-@aoMt3P`V|a?u(E9y=D^TlR4VmxDb>N*^b*MOY zTr^Q>X)ddGW9aYCAo}5gQ9gB-G>CPiV_ZR=<;al_@grp`q*2fS>z^_%_)zrd&3@rM zMGveA|Csf=l2opKYa0x6UFiY!dgYrm^jK9IjClq1%iYh%zI$YY29phv*2H3Tx+BFB zFLKsfb9>Pa$d;xxyn_j^-mAa*$W`-E9dbKF+|NMeehm`hz)7A)=q(vKd!Ru*KF#r; zYH5fsg3AI0S{DO|0fpy%YDS=2RWi*sk17)-E`w6I)z{7Si*;wGAg zfvZq)gwy5oxOP&xv3Xsabhl$IS528)^LR%ymiV6C&O^8_1t|X4+hyr~wi&yT*_ zt+l(B0#bt#_;|~y@RWJK`R5=N26Jakp@-kNN5<>yeQlK`OPj3iMD0r55VA4?m_eUD#1X~vt^`KrqqDXGofIbxNkGA3rm9?#o^^yz8rW$Ji^n5lccR88t zrAw3?gZ4L?+JUTNM{3)T0V3p`9Haf|sGnE>UR-SEEXCga!NMCZ6~4M9E zTZXmOb=|@V?huM=aCi6M?k+`&Q=H-iC{V0Gfsr#u_tPTH5DW!I}fHi(@b_X7TqhH0(#Xz7x<@&3MFC zJ>5Am8zqY(mL@WZn5@y}kv8FEerL6$hP=-H>8~NwIn~ZK3)`-)zTd`Jb!u2Yuy@h+ zO$;uW(&*ZFQ<1XHul!`2#L2H%B}I`I?*|X93=Y5V8Qi|5omx?fPn^S?!$84wQnn1x zs85hwMBlqa*o;vz)Tp&X8QvO$A~7p`V4s?zUzc+Cb}m7JjH9015Z~t?+!m_bX5E@a ztDDg_y58+orwrgkh%B%W^g~CJpwYNLu+eqJFz)!Q;f_f?sv`3(HEb+P5%Wx)^x*M# zS#+YKrw_Q4msp=GmwmoQyY+?F_2JnO-a1lX0o1-m$$p{=V+m&&+JqMH3S6N9tzX_Q zp)U0lCIj-nR286GQKtb_&2vm4e5>q@U#WL zzWe?Yshy*EpcL-N4E9_PD#owp1RcePX2#xmw&CYEAx@~S3S)Jks>)x)$aWtMmRqJ8 z3m3`{EnW?IqOX7?nkA6H+DKs2yEU3IE8xoB8j?WHj8_?7Kb`-fosQEnaYH#p*vjhBuFZ@C3)1DxIPWC};N z8k@h9ZOzNll7s6|?>Kb4#TRfJ17A{`pi{j=5oiSghMVYoNErZd_Ib*l`hyH$&x@pw zUxgBSUDmRZKUsCocTLE;V{Ub(=ypx5)K)@Nos34Fe(SP5|4f(IB{PNuZcAVSs35%+ z{w5&6)`SuWXOLKS)BgS*IQ$V<=goP$h&8tspuvO^NBQ0!9vkT+tEx#gc)E5zTLJs-e8W4E^?as2O zAXq&6&x!>CO@9YaNH{~I9N>tb#xujz>ZZoXNa{Uqnm_jYraT3z2IxAluCi*G&QSov zOFFydE|>?3Tw+Q+Qs>qw5_b zYIx1|6B^kc2<1&T`Dk;@RZNd+K4}fIe((6i7JNX2@pl?Av#Tuo8zIzi4A^WdloSVL z1+f;Ka<|5DWvwa|ymi476ubE+!Pyf*hKmVD_)}?AQwXSM^owGlsI!b7OP?avEl1vI zdet#sPw)szZoVN(i(2u3@&Qb7QN9@8-M0mG^#YHCP_zoyY$hcS{eYj1Tbui1xS`6+8mulL#LvrJqK-%1tGvl*APC0X?;a{K5&X>*akv> zK%7&N_Zx}f#%LTyow&paH4R+JQk-K90D_IT(1H!3oIq5_1=3-b7J{+BVzzX|f@-D& z1p6@Tnj{sh+DfH#lC2VlQ_{A-Y;#Alqn$|;G3DM|ILu3hQucq z1Hjanb@?fdI3Dopt*Y5y^%gEb>)UmowJL-h2n9-$3cj^q^N7}Te8PcV&r4Nn$B&Kz zkpe2gGKj4wVnd1eXkc%CxS~Ho;02-90OeQkqIn@8|MhtArA2<;?MptA0w6@onYWpy z*OCyBoL(6ZGEuw#`KJI!fGO-_%DSi>JeU{6iSPQ z&JkkyYb^qU+An;W!LuI|#AgIUt+WBH&TJ;nX>lNSo8k!0EwX3%&~enNJf*IV@CM3N z^=;Ii6)A8Y9|)(Wum~gxdIJW`mt9#W!f7q|L#Al%Ki|IpcXK)B=#&8E5)!5B(j5u; zh=9-sM=|I;AVkZ{{rcsbkI7?ijtz>$XIG8zTwnjJscQ2w@*q#R7Z$~JwaU2k5G7-m zKc=Ic_CbWEPat1C2btL?5zOQh#I~+X$60C>^1>l29PoLOTmkVTQw;Xs2<6Ty0M#i~ z+C^FjwLJjb5O;}%nBoh>*^gx+g^k%(vbc#x)}&=@-NfHdt~qQtyPJP^LflBATA%o9 z`tu+12pyml#jam1kFOFCi~C6KdgETM8l##-FbOoN%f6_9l3jJAOA zVXEJp?-IQ~|9qk5Sq@YoxfTaJ5D6f`31z0sdpCnf1<)+`fAe&ZToYY$vqKU&fH6e0 zJ_|xUxl|`NC~a{ps)lSUG4%y~Inw}Z9sp}M>b0rf=Ctqu_2?VG{kxtk#G-e~H|kGA z&`f0jI8ew)ielx`dL9(GleAH6MH!8oCkPmMxwL{{fE@(&D7l`lE+`GxkFbm;owqKr zP)MUbPYw&SHm55u?9}O?Hz*1SQ_VpRB`?NnHrA48&m#cP#lx!cuX`I(l36HL(tiC- zZ=f?H-*8CP(d&yIyjDSXm5DS}+)*lD2)NkU3yVVq*AP(D;9 z|FO}PsDn=$5ZIfv4nn7sRHfZ8CSKj}hO)zGLo04Y;Sc+BIL*GvQ#=lz{LL)Fq^;$r z&swqyJ7@g$c?U~TD0RO$F*F_sBKwZTnGKgWxX8z?*7jy`vp&_@gw3G8x3w=`bq*zf zP9fQMdrtjR15d+%2pE0DE8hrDYR~8hMxVXyeIv!lW`j%o%|v-PRPg=e?A9~oDhWq! ztUrn(|Eh`H!HVXyojx*{=_O^1XtPPX@LtBb!I^HcNn@-O#o}R`lH1y6kE|az1SSSE zZN+N4!qI(Cg8~0TTo410V-aSuc8xuINd3v<**TdIF!E{LI0CK+ul=Nr(v0L;{QaY5 zCeNR8`=1w0>ybfh-FC)w{l8^P_KH>ALu$l1{`~Bp&%aUde<{Mx5WfDx#n27OSA=b` zzAm-QxdFy|rz$A1K{i}pER$VH`wd-8yya@l_r84?l8B}+Ei;Apxoobfadjwtx;uZ$ z>=r0V_8nh=W%py(u;YIeG~^JnREg>{uM7%gok`a<JWEIC3;7}10gd!)bUtqAgf${B6BT4$1e3($3D4LLo?5`%l_T@8NUrHR<>>&;F8lnmG_i5!_VOOBmh;$%{`jRa7H zX6AIBM4Pgqho$Dca~zSb{MctdE+_U0#gX{S($nc<+$lY+Z$s7of<)KUtzz?7``f}- zs1#lIB19oGtrG$-gX%xiH#a|%6d3EZkROpdbA<&K+E3s>Ow9#%9eiHArxXo{@|OIWBYW$PQvJ<*L}31+R(`3r>_In37P}1#oSq>j%Xi zYEw+}!-gV2IAB1<)Q8xipQt~w? zkEsp&A_GsMX@9+28a3Ra-Zoa6=kBQ5+jCL?TC?JEWhKREskJL`VESmZyGhJ)zy zjzFa?25Y=AGIfryCFBnn#Piu7n}&|gu8t&#UGF2Cq<-IuVBRoZR&~5<^Ead|ZZOij z>KwQa*qFfWh5_t=qd&cWHSXwQy@E+8(mtnTG^1yE|Z#xg78nf@qaWIRYL80dXs08qTX&&4(a6X09); zq;?uBt%axtbT7G)%WM_vggXfVyEVDJ(f3o6)Ns(`h#_&>y6AcK zBP!XWaM$!|7(2Xx4Q*2vYJp5#K? zRl$fDM(7lq$)de7q1ns!{-HS9|%bm(qBnKNL@VaPOwuVaHR zrD?ee;)xewnC%7q(cs;4q>QJef?6nA!$Y96B^DkK)pM>fG9lQViUwiKO3|#dcV|FK zB7gYB3V<|a?Pv0xcNqQ)m`=w4;p*qhoG4y~#3q>HW zralE2-iXsh6(P`R+`Tiumx$nmIt9qvCq>47rHRAcZrsju3~)3@eMJ^!Ne(D+`m99H z;}|G>oEYtB2LppyJt0qp_YV<%po}*TSL4M~L{1AxO1%K^Q(NW_ z6uc9s27aG8(w7! zAsc`mrSLl>`Of5!;qQB{w&)-;&Jc8+ahfqhtwhr>8~}gunWP&m9u;DV>{pqri_Uo? zbJ0aok*Lb&ducPD`N1irHVP zR-d!4XzGfT)UIInEz1W>)$}FX-&Ks-8a4KB$HI~*oktiTc(`75j^AFh=&m%-4sY60 zNLHEXo-eI?jvo$sh7`D$DRDgsG@+?HFIOL0;*;FS$81lwXJ6x5p;d=?E&aZbqR+t*@*+h_u@9V2& z&<~(sq*j|VbS_B?(c7ndj9a*oQUYh;XtHh?71^oAYFX9s@f5GmS05h`|8hM1LWaIB z4hevPfO%UC6vYE2VPTah&O(b|YdK+>#_{rN{q)RrS%3v7r3w z5oy1lBg9J?)3ItfWiO}fs-ZGCd8GqM;YV$Xo`Z4a)1!F54WX&%!3C;$G>c-~W88hb zoh5giAuA%VhQ70iIEW`u}C@X%VY9)^uPYiEhfhRjKx^?7k zqD2K|qdAg2+gmj#(y=O~Lm957gER^3v&J;PjIH#_FEM61mG%GnptNbXb2sMN#?V6^fBL6=JKk@)+>v#d&%BD6y8( zpT?w{*Q_|yN=VjM9mP;pW(cdd@i7RRj%sXH=LoA!B={)VZuxYz?K&yHCvX1sg4!Vt z+()ULt7#FssiBGEvcqMJR;jXH&0W;3J>3_5q^#4b zY4iNJ?sASmez(~08bU@#IfcWoYiPP8fjnsm5Br+mo}}e63nl<;Zb!b9c8pxBfQriq zUQDn<&FP`GX;e7i`{NPtLCL8;q1`TT3;@xoqe#yb-Y8uf*8f(1cIb`D zG+W49PBh{z%Up6MjatuiMM->m?LgF6!Vu3_~$rI@)kIZX9NsCC=c%u3-J(Mlo#owoFjeTvf&qNXw=kl(JDP5X7t z>8u9BR)YXn8hWr&*H6YYH0({qazp^uctac2?XrjVgA z=a_6^yKB=P0kwKN|I9rmy{P5j3rJQDPl)TS&QYP|V_7);M2DiHI(KO{=VEzot2Z#g zP8-Y@l31<*rWm$3^0eN1NyJ^0*)GFVR`o2%E z+ef}Qi9vZ?q`&ES{UC{}RclU5&q=Wdw;6G~?($7Z8)Re(#wHWm^2$HJ4>7eipI~@T zytzy$exMlCo=~iCVFu+c5DN<4*HoQ*y}GQt!cOQz3W6A@qj?w2O`y|bUwMz)I@ zO~dJM6pusBvjOymQD>ZPQ=7q2Pa2yU1+q=C=?On~of{DdW0}t!&ky7&Jg#*2r|6V+ zM^1k+P8;?6zrDbZljpz`sZYD_marfrgM2(2%~1rcYjeTZU_}# zjE}oW^kxAm7-+Kq#qHwmHa`YMu{|(FkqftpJb)gvWJBe<`dw8fs}lN8sz4cpAD3|c zUeu2o+rRE9`tMKt|402|&6NG?NCSVr`}b%I8>CfU8FV6!I301-Khr-g(fX5#RYs}x z-PvLgX3PV;i^dg{lbE*ojp#I*Iky1OL3)XTYD5~C2-FLY0I5pd>C@uzl ziVC9^qymGu>=1Sc7>CD}rcUmfHiOylfnY6POUM>KU0n{R%LlEMTrJG!Rti zxb>l4yB@*;_R%xmb)f^9GTp`g`;WE)_9DLid@f868Kg7&1x7O3>&9K@e@Kl5v=Vv6 zc=n&x)v?%TJ}esZ%gzgcMF=Eg2zWG4$qD{=f+*E^>oQpqEgfWh@37&0IB`(BM+tj~ zFh)#6(2mvs@kQt^lL_il>R5Nsem2&ISsVs|bn^4j;dbo*zTATwLgMT>*xNRQ6a{Nv ze%q|xaJ54BP%{~p^VNSqze+TdR=Fe#g#qK$=`Wzc0<;e_e!*)qGd>-!_dpaLQ-FDspFtBynAtjCQPIR+*i@Y z@vrs&ylZy0Z&tY3y#Kw|KQE3ns^+P!J@r2?n&>|>-#_8tkFo#Pqkl|~M+*LX=KtZy z9V_NPX8t$E|7-OB?I_0Q*CoYf)WdDVZ|yb**^ICS!}}kzk2e)SXoD7LUG@ zp*NqE&I&!0r*2#=R}5c-^G^xoC3p=lXy#9Fa zoevTtCvb25QCn&0TxM2`X-uJJx0`L5b1Ece$LjbYN=-i}W&7EB_NI)ns-(cHRjcFA z0;jzb8VtGVGP6?on2+3XyjWp1Qd_ToH$U#Mvr|^bo<%zf8-(@|COx-_#I}ia28ChR z3O!5ZZR@(-5%2#H!(Kq;7wagj7#=10N_Pr9dBtrBW<%`k5JjGBo?Z}_a0z>`K;O6y z#~Mu>V~r9kpK7Z*@JP2&-(s2b)cv#?zUmdkb5f(V+JL3ZEm6^fZ#8fvjBsd^&jV%WE{U%T zV!yp49KA42LvLQ3E_!SwJ+F;=l!^17NjUYuZkH||Csm|qNo@5D-Tud4wUD-G676sk zm#e@%n@%lqLlSX==@LaQj9r+50aXDGSc#kI^!_j>4VJH8yTjjl_H%5$-^eze1c)dW zOTI?Sy!`5kKB3SV$NOUv;z1^y_2fF37{#B$`RCfDYROMbVGf4c+FkfFzrD3QAA-R^ z$=j&oefkGdP&WzKJfJ-BatHo!kJG*XnjhNR$-dEv@=`VU5!1dUp(V1@17b;0_lddB zf&W8-cP_{oO1Qm5G*B7m?U*vEPRfj$T`=Gq;mK@x!wniII=IsqX($u88-Hjl9i3l5 z?%V2$53^!5r7s@Y#0g!E=E@RX#^49*4zyp!w#NkrC!b0g``(amxO2&EU=>-+KN=?w zW;8rdBdv4f ztB9_HTsTwwW|p2O_krpBbN224{?}{L@2uyIShiZp(Z+n0AvlDlIuj~Wt0f0aCY%sE zGe6v0Z)t5@pq?B{S6RMCF{0Be0T|bID-?;^ny#P6K9F<6Qd26JU1{M0RLdwVAZJmx zY{s6TK9~1({nBs&tHnPnrOP>8yNZT0&Yu%l1P#I8w#S5HD_Uc07yisLlo3H)PoaxW7p_da`RGcTsm?e7BOo?^D24z@y zp^t0|Wtbv#QE%Hn;+FX2K|?90_VdcVuW>o9^nFIARZ`jtgy9yLia2 z!6rb=(FqgEvT)#K+$AR5B^qFZR8iZgpFa2%Jod3&IU?L7vFsp3J%aW8>t0Q&6f!?e zJza5LVs}jnmLpYKGHlk#nSCQjF#TfFTVoO!RLnO>zhOw`V=i0M=L&qod z8L6oiY5bf#Jq9XAwar5AV{27=2^e5AG>P&QO9F!F^pH1fzDh9@!TOx$oVaX|N)Tb* zc4`JBA$`I`3z%XU6Ac0jA_4iI!>1<*z#T*a1Y7!aH8CJCdRnIpBQr$!leK*HT_xLg zCSnkeM+DR^NG;fO3;9sjLpeg;axK(XhZgZHctAgCJ*3?CB<`aB(m#;a+{Q(#Vf z!mo7e7)hi)c3Ml3B?`H4SN#SeND=b^uU4dh>*nxppXg;gwrsApB0I4+1KDIxzYu~^ z=gO;NNAoZi3BhKf#}s!dvSc(PmKi4HXPdtE&?@E8%uO@02%Y25xFV3z7w}a*!o%p) z!xNwp05&?ApjNG)Pf&(kOA^J&^}?(BXR!zGuMySEYRqJjHPyCpKskV|cVa8rwP`&_ zO~%~NSF+@{Y@;nH`Tc-z33Z+ZNcx~Z$YGuP)30=u`Bza4{cOjCGZjZ};>Oh5GjZ&`82Ua8qv6te z0uGKXt`LVC%ZI-(*t~;`FgvaUSm+D{k^%d2Y+2F{tCR2I=ul(rS1|{gpU`J~F*}B>c!no13gHoXuh(!bsu_N41G-UY@Db`sF%GXT z!FiU(2IYzV*v)oz+exVId_NF9nWUA{NgElxi_U2=xp+_F-Lui@t8s(jL7y2ag7Eh0 zmz*o43}fC(>2c#M9vVD&Y>=j0ZgE8Qf9DE3o%e!@0Q)GJubsM|3Wj#3=~fYj?j*uH zye=i}74-bOLQcOiP4$gAFao#EWawSB7KNCeKQCt$>vWDu+2oBejW8_Q63mB|{3b6B zMO9?KIlI7E6$H{BF3MhoSUh8sTcH@97CL?5fbmigs2e3kL$FG7;3vD6^Ywix<6;`8 z#GLHV12}duP3>ngJ(cTYa8z&3DG$mXYoB|F0W;72e!Sx;XYVt;koXr?;M_(glaSF_ z?uRh#k%O0bVK||WZ|}CUreG>F3d)&0JhragwhBImX%pOiAw|tGyd{|MYVm>K_=JK9mbl7cybo4Aw;AN0!iufHq_ zCxotPogPo4M+*tfxUgsQ0Z1Hx_VTqR3%9JKY0N*K|TkBETh$wh1I+r^SAr{?j3 zrfZtM*``WzY7JEBXWJukd1#r&Cltp}i$k20>ebon1zEG1-NPwKx5sE%-k$+K02dr& za+(WPi^FPGnAepGQ*Bxvj(cXK=z}LbGBO#UuEw7Rx#Fd<$ZZpTizHa{=n|a z11(h>0e#~XpFOrPyTgU69j-3KR0|j3fu?0?T*#%Jwqau)^54s)zIW;2QTjO@tJua} zBl7FPobu(kb7Xz7{frv<^n_Iw?{9pE3{2mX9L{|jIGYoW%ab$g4gGSGo8A)bsXH28 z8z;|xp}O!x#9A_n)FR|HG#_?3oW-K#9HQ~g7&OK&vd_s37fFvel_^%+DyUEmzD4HZ zT54`PMji-Me*`2`mns?z?}}zBgf`LJb>eNS+--H zkhu5v9;u1F(-St!;ILO>7V2qKwaqRB7c6u-4s5202k^XNU)6D<|&utVXkMA&dU z;WI}$I1_WH=BQ=-7Sh&lUfB_^sHB3Y(YEeb%6L&1qMuuS4=HK0K6Il0!FzzGaf557 zarT?d_Ohc~eeQYhyA?-%s4M9bT$i0_DPm-{C3ny5iN~aUcHzCiog7$u64{n~XF~Zt z@QH)=_Kx(Y3*wV@ts%!Fpcn9e(2Xr+47h%f1O@HGjQTr9n_7zX6R&qr;_(oLE#8}G z$okz=<&}53r#AdrEMb#kxrBPcr}|nWFd;%|o7iYEwT$pj4!l;(=p+;<7m{K000ole2F$r72oBv=Un?uj2pwlfmeSbjSGP3u40oexN+2;5b+C)e= zRow0RGOs{=qUaDS6m!N556Ex3<%oB^H@TSjgBApCm&byqV8fH;clfBVc&|05#h+g} z()4{e#&mY3ICqWiI#RXHU2#eB`+6IJViO&>om2Kv<4D4no$6Tk(RyiSNb*A+)gE^D zlNZ$Ew}m6Hw>PR#O_5>`s5b57LzJ-GZ2cD^OF=ah_YZt_lzWKrElvPk7$3w%`=25s zMO|ui=-kP>;IkpwiJWR>jRY9&sXyo3_UfOeMWj*Po03e@mRJ{dg7MrCrPPV&hI4<$ z$)m#(!g#%hf6aL^O|- zjd4>*F?>m3W%HiHe`AI2^a%n*%X7(EVSr>EOP3QAAI7R6E)*(RKpjS`8ud3uA`rWR zm$iuPJ0Ahp<8F%{^&_j5w%ibl@H+}y#0E1lT~DW#9NpV+fGO$GZf!iGNPmVDB}2%n z8^JqyEmL-7a4p)I#}^0#V6Nda01#l)avPa(OqmXD?^Jp@uR z-||AgJQF`UCpw{;>fkvgd|2+k_ezdIUr!~zdsN-7Wp}+wShWvwcs0@8GuU6FnyHZF z_IA2_QtrW6@lE7#=Gdsw$wMK9YeiwGkA%1SNa%a|(+@7+rltD|jD%TPR}qs^U^!>1 zubP8l!Ew@AZ6Jk(3&m7UQ%B72=Gs%^mtium??#e$oY$-HpY_;HItg$q2Gy`;monkJ z7!Hs#p=5_b*JZQ=j27IruJG}bhF_LbTPPQ~wZCmHZc|JPbB(i(M3bQk=30PJe`_W! zN&MYXF?9jne_oxGX|RmlZO?VM016!s6;>W;uE+;D$lg6f2!7zguIoIjMgBhM1#SIw zJJuH?oc@?pe81UnSo!ij`8MTLfvxYA-1jQBrBwSV!TpvcnQO=%i?R1AYo?e?h2O=u zH4@Z0i6(_(m9&$V3K=O~rQk|w?boZcY^K7qB-cNy1YN86)1Y6;Mh$)$AI3`$SK3xp z7PLTUn7SuvS!>?XjCOf5lyX@jkgRskoGwP!W4q%%RZ!;lK~anFkXF7jR54NISI!I? zerL$VljKU_-wdd@1S_8xz3h6DuCfDLl~P!kQ78`9j8tCNir;Ccm!YIj+I*{QbN~SO zd{9-8HK0Ob_<7mplpEk95oUTRrid~!Sgc;W+T4@4e1M?@YXL1nBA3dxs(K9x5@~S9 zPhXsTrV+Pewsx%4Z;PQdkd@AlD$uM5*mvTrO_+So&$Q}dN=!Y#w2`Gqc9(vuX;|aG z%iA0Uc`7t8XEdOt@gfJ~!zc$3)Y%~M8%KvkNaNcp@=La0V(n+v&z@X&DeQE|Hna|PvPq5!L~_w(1%q-(5+|id zXb&W+l-Bf(C{lMIBz$LPqQJ z`Zof%83Bw(#+oMsLx=sqsUcd)r$)$B-Xs-xtF0v4lEruBc#nYuNTtZ9eo4oqQCy`k zE}f8zW`McBH4O9WoZ)m_eg9W-6aPLitRrJ}eRI8BZ~y9D<)(V_4JGBr8m#q(D9^w; zSJNxnofx+fx4V>z?#oK*gV(*WLTQ_2WUg6#!LZ{*hBVAYKlPFm@{242=|Owis($a8 zvgpQKdTI+ao``U7>h71d8XMQ7qtc*MRFd26*94?h(Y2rL66VI{S1SpG-L~x2ucdd6 zPy$n*F*c#wDSrfEt6a8`4R&6Vv*bND`#^^5g2=05 zQQj3P`e4mpoSn-Ey#w*JDGU@05xGnyNtn|x)}X|g92h!-)}_m7__Z%}jR8G6Jl(ER z-J^SvpT}X6nL$8agLjZ^UO@0&l>Hb1_>I9Bo|ebmN`!W%LaTd~W0K(wrJyLX6NrKf z=?AMRl8K=+?!+Nh@Q9~7LmuzT#$D4azN;zTpQSm1cZ8h3I)27Gt;8jdY6b;wEK(di z=u94yLAnz58&Yz%jmMqm=~aO1=EDP6mY4n%dyJrtbkB#v19F7j2lOt zp=!y;T8zE?hrNP|{~-kthMy>O%aNP|;VqIk(!sd@&$RN%Cm zYvCL{y*nr#z@|9rDZjMHcLQ_VZf;95McVqdYsH;DvFmp(+%H|vWYUHkMs#gMxp&mI zOyN6$NCU?bbs?J{FqHFO!*7u&UY(?QRwhp-(u*eui#NWx(To|p{uw*&2|D^=8pN*= zT6r`KW9D%aG&5zGl60ATJL%yTm$W1*n-NAsS>p#?Sf&G%m~@jW|ZL&EZ~e?muzHA z*6^8n(NcMHOu5PRFS5S6=L9^w#Q{|gUVFQNquTsK)(r@QJ@ z!8oWpQmN&iJ!QsWl-m@AGt>Z)=NV(4!fVBl@v_snr-b%P9--H zvsuM(VbyJZOkQFCBtk!imt7#1G*?Nda8gNt-67qcHAP~&b;3rdtz62Y`Sna6Ma61< zBRplh943c>0RBv5ywc>uk56;?<__{V1QaE+8c~9!G5PpO>g^L#N?QsK@L#Q|Rc+R? zHPKSag$p9Ei`*o$lEg&~x&l7h{W1(VpPIwG$J#6hYb1j3BfMcXg)T!6d3K(xxYlvi zj$6Q*s1yET#PZh?3a*skPc|#9r>%%`gCuZ>%Lx2Z}#UT9VaFo+yv$bdChR0Ln1+ya07-TByQd1e-L*FFQVr+lZ(-5-YuPa)WtC66jaStL=o{aVy}e!h^wauuv`tzbrN6$`Jy zay7hS1QPz{$y?FIB&gvCLc2oXGTtO~jml}cyw@OLks~}{uk`FCI7@f{U}QuqoB$9j zYA(J)Rl5k-z57nTmtShvw7g;1&OiblvztiDM_^-Obirlv%^Zjb{-?ZO)e0vNhvn06 zEya#Xf$=MKH#N%@J8mmR8zCdnQ}j%?c3b=so$jmRYJp03_i~ZyT3BG8&V-~y1@sq+ zBNTUJ;~;lgUjux#7B038!BUm!VmgSHK^Cksbv?;ZmtfB&+BzN+UP?v1(f}F{!D@XY zfFh5&9b)&Qt%K8rv(yLI-ka`#OS|88smKCL&7eV>i;O;CgBmGnWVe!jO(e}#<;R%^ z$HoOK#Wq`$Kq}nrqlrEq zg!hdbLUGQo=Ez>O$ci`Il-Z!Fj0GqaAoO=<_4l~ncIC#2OE@-~`?LAFngI1=JLimj zPni%%B7$8-f=lVuE%2Gp^3RI$1G(+-WQw%nl@yAKreI(DuAQZm=X)R0iDR$qjsZpC zACmN=$|07;bou&ub5i0LQUpQsHp6EpgI|M_Nq)VUU^As5ra)-TAVsm7Ucf(UWx*_d zod4>OHcvT6AAqWiJY-1c?|l43D%dh)O}cK;_se#-r?r1=TgFjI`5OYAUSe1(PQW|D zvmaM3pmBh6^nD2F*y7&UCogu_pig4hdyhqbgHbSFxa*Cam@8bPcmEZ0h< z)1Z18F(p!He!V&EFiv2MzrHWUc^MG>X%CfYtTVoXC4`WwKx>+Kf)lHuS#xA^5HYoc zR17gq=|xM?=rG3|FES+W2m+^wiX^c^63z-Mf~Dv<0|SX^C&p;~wi#R|PI4q&S`zL? zZ37mIsOJ?eea(N9BSqc6hQhTU%tyfm2fcI8yZ-dnNTIvW%WU2lbR;6qr9Y zR=i~OC0I?HymrSzvH%6H_S|l!QE`0UGymkX8BxJqI#-gS=YB)pnd=z2v8uB+p3`ky zr|pr+^Nme9m>1hh407`xN}@O*08;f(U0zfOcs=Z~7~qkZA~deA6yiDt?II z#v7Z+qWWfI+w?N2D*SZmbsAT>&Fd803!!s!^KFk;DGU(be1F`c6_pVN9%s`py0mtd zc<`i#8z`o84v9iAzVl|sL?sYVv-w)gjgX^iK0(+z1I-cJ3_&9GKs_`Ue6v91acN-2v#i{|H-@` z^Id6hqu@zbqsHEc?SH5gLslR#ZQP>>XLfsGb9vx>Rh^PD^>q(Y$xZ)nkc!R0A}yXW z3B{Jx&l!x3TfKS4Saq?noqvc82o{Ml$}o^=%qGMqAHhU;8ZM|?5ZL;rpO16o2b5FU zJqeg*P5Quo$IqnRYfAx}Ca@V$rT;364<1e1i_qGo=b# zcgBRMj!quA2dZu-%uxz^Z)5vD?ri*Jmg)EAl$ZbIaQuhbG=UaYQoUdHF9+t|=lTyS z^M?e1n6B=EqR!_u<7rd(uFRr@PHbR`%bNe;Mj@i}JZ)FX(YW)vs7Qk?-nYgJ&Q8FAvL#1wtYdXNQxMRNF@;-V#T<_C#?m zS=%J=$XRezF}ws?fBOM-_(yE4#nqsO=)TzJ&?x+(FC2Ymsf)h%io0Q^;ZgiAaz!nxr!|58*)@9+I-<2!HW<7NyjCQm#-c3v;+F;q*h9H>zXK*- zu-RU<_aTDr8Y_MdM)>w4wbc{e1FGy_5g)lKV=d1sF%nlV@PhKl=kI$6Iap?l)(7up zhf9`4HUOnrFLs`U?D8Hx1qmH#(;S4F@YA_8IdS8)52X^0OeUxDv<7@LJrpeQfJH05 zLl1XLR_{HS7fqF}%K0Qt-|B;nmwuDl+a^-9?AKN%Dc2L3M)E_Jmk52Y^ zi*{n}rjjMrBn4GMwGxYXsVO{`ORhl8-TyQb?4{rLUU7O7b7= z=M@>2r4$Isfp?8hGvp%Jq&i2nr;3?{C7h}2uF4zQz?~bC)r}TdZ}1#PE((2XvvZA! zlY2o(6ohH(2k$mkz;zE+FL<~)OxSZnT3%QwMX^8642urtMb=L2T|q{)D6wy-Z8Jhm zeDTs;6narN2yeC%rq477u2HUwUZx4Jqm+%l$EkQ1ard2(yQIxC!AnE)xtL58+6TEi zU0y$l3hiuOFguCN20tV7Udv7*Iu=0M(W9NI+X&kEcxU=bNe9%JzGR2r*LZ)AaZyEg zDtNx+%MCAB^|3LR{fl-N!`1iF8-DPv#JdJv+a1P3_ZJj&8tS<=^Ki;@0;VdWF0Q3} zZ)iT;6Upj_uFh$#j#B12sHY5}*eBV}dJr}iyUwt z>I`m4jOcWryYcc^+r7UDB(rz;jfr(ZcR#UDZ+(4{B6s^3!dS=+!2LSFHM~BsSLiV@ z$d7CMqa3_NVAxW_gi2^kTfT?l&*%H172R3it_!Y~sH(}ms!1gtSju=)4P>b-_q%Ks zx#iO>CEjS$pVZJCzah=~xa;j0Gu-VW_fRzSdmqV|o_no@^m?z>rd(8x@uvv&+Txy` zSg`Rpou{#&e7-fx1gL;|-peuITYBD>i1k!b06H?P2dlKetI=cf##U6;>x5cu=^&GbPNmaKQ%HHeFrRjgyTu3`mOd9lz<-DQb$O;OC zDK)Q-3@%nM=Mpz~wJ%iTRxMOJ>sijT$Q?T65c%<8M+VHUgdR<*C$05R8oK>7AN$fZ zqcfwN(7JeWa#;qCU*bA9;_>dfK)UC<@G@;A4abuxq?+B|US}$PSTnHBeymEwDy{qh zJjpXa&ghXNa)Drk8K);UD#Ci!$|xW37U+|iAm#c+Z0M24eIOJS*#3{^&l&)ELTqE2 z9CWHz*dD^`!kzlIjNK7BC{>r7cZu{viV^Z5Nvnd@$rX`W-&+&oXdwvGSoKBx4KbPS zr_t`>a$))c<(7U23R(V!SA>$#kEIad6q)$^uu0&9)DnWm)HCWj-3w!Rj@TZ=R&ak|oWTy9!LoGhvVqc4vY8 zBx8MZjkNwj$$niKLNtZYmbHE?-Cm<;Fed@7_V?ZM$?ArEOQSG=2~qFAH#xSS2On<- z9fHFujy%WwqV8IM*){KWYt~We&7%Z!aY3bf?3m*PHZySKQ1Lq3mbdOUn`XA!}@7(Td$ZOhP$T=Nq;nj!SE>BE3$vpw&~Xm4^}c-KZImLJNsY z{a=K_;gCG>H&Cl9YOMU6r0(N;jBoiya#m#kh_Riu!${SZ>{Z`GinAFAWa~yu1gA#| zv3KZpjN)g{^_LMdevPh&83b3tS0SF;76MRoTT$G%E0w|56k37SxmnGmq0AK+P|I4Q z4gwHmLPWd#DT*tCUiaSx+FwjuL4Fs;3@`s-&_go50gR7bK(u_A30c-Dg88ah&sId#avo zFy;}y?Ac3TcPpJ7362|rV-(Fm#;b|sS)$fryKP0!Q{{L_{O__;=AzuzloUYT`){X#vwL{ zt1R?e2@68|%CW&N^oh;3#5iR6=Si5 z#fqg2KhHuUx1RQ8<7j&SbXDbmVbqv-;h4+Zlb@QhOjG85c$mz>ldcBzK~)&$%)WVj z&T@(20dnrXcg=@Y96hzNQ;_!szD{cjJ<;2+STY4+?LCwRD?s3>M4$J&j!dN3Jo0Uy{fN((QR7F z@BsBiG0lu(_aI)eOzH-t<-O2PIK4N){PpFojs05>2C#rbtCEt&9MYyOA z&lZGOp}rXcGi~RULP5B2VL#D+_hv@vIu%f+6GZHUgC_IV*`8dFliU*&{VSE8Hw@km zrK1Z@H$$phXeF4MUiQ&*@P>)VJP@{dcibyHX;XWj!sX%BiDFn$TE0hR)2KP~b?Bbg zFy>LGVhVsT2Ap!wEkdj!NM2}4rJs6dFaOld7x-XdPD`g=_q@ispD$TTNIJj zvcuF$Ykr5)TO4aH49$zjxOUAbftub$V&h#ty8M>C*ufR|Sy7A;=Zz=gu(UKs0$E!E zFn4lNF>9^_3C!&Q%KOXBSov}OHjFdc*jL#}u~+_r)#L~M{KjcXEd=pP8P)7t5@T5k z5Ns<3gQH_P!wEU+ZScTpsK51i4MU3rP;SLmG|EpoHE7XvZGdM}Cy?oOm&b}u$ep{G zSecn>zt}gZ-H^~_tOinAemhsDzEi+kSVG)QDXb>+ZQ|Ab^RIyBuI&wji{$XbTddE2 zX`eKLgdbnV$xEgb!o=BVoPEl+==`;^u>`_jr%$@tF-yd0eITY;d_5fEpn1Zj*sCZ| zQd^av|17_dfoaVGT#3su&)*u=R3EeUv02b&j}FqC@O5&w4OYN&*`33)2I*BGU&!KWSQ zKtq?YCV_Q8IB9TmS<;o*{R0`p~$8_mEN86*~gpGOu$YT zyHepWWu5RfnSv>0cS$xa$lunUnOP)fits0q zYm}`ZJdHEwpBKX9U?0VFN^nPJlAv-@+A7sZ7Z3b^g)_4Yxw)(W9L0KRm4~HK@@it$714!7oV2BGaA$n zs>QHf@S#UDkC+OMJc{*dkNLsfPEaFth&&}e-37r|I@@BcJJ9iGZ$~{4wJ;|C8|1j? z%}cRgBePm(LwjJ@NB5O&J}4NEfM2yYhvAikBco-T27R@q7C<6tj=q%&Ig-J$xl*yWF9`#hSlc!ACfy5 z8J?RW+tLt0EtX>$sft7NS6;^BhoBptkwJ$o9Q#(b-K^4P8(OnGSiffx3qV#Y(3d>N zScYofj70E+XH70dPcoN7R@*N7f;<|0`fd$VZp%1sxpi+Y6AvVH98ABJME#vSI6XGl zJrXo~G@@C0!}{@gVR-a2tfIsZ-Kw;jutYOqqKzCh2UN-@JWu6*s^EE<;4yQ<3A{b^ zzIk9u%RtY81BIk7KKBd}9X!EtoghQ+Fa;4J-$s5d2Y;VjPk#f}$!wEr7QlZi5v}e( zG{m)>VKw}fU$kef3}jl5jDKDvAWpW#)6rE?X{L)B=KPlCD5%TOhib*Oq_O>_knXX9 zj$1NwEhkuNz`k7)ass+>BJG)QI^Om=LT_t|p%oIa>;0a>N~*Lqfj%zEn~;ML9LOMH zrP=*D{0*4Y6F_aL@9|t`9Fy=AujsXxzM`{;dtw{$fk3p^pxgtK#1oEepLbuW`5wOP z-&+*9YT@=@qOh%4LK~f-zRwG^7k~X-QA~&soF_~)Aw!fGplhTEeM3-cQ8wl&2CLouhmFy$PNU;UH#-|#E@>7 z$JQoOXT%Px`402Qj7Xk_@_jR~(x&`8H`6l|}Y!1-GqVD!QLv zGA!lNt(raB?BN@ErtRQwlz+`&JG|P)y?ucY|Bo$`2g4~-yuC@KLlp3%H#3X`mnhRg zL&cY~p$TrL$1gXt6+e)J#V@>g<)42@^me~t&3N10BJwz@KWj1_grA@7qm^Z;0JKx& zw!dt&3G_r~V@{KIs??KF_A(`aT6UWY6*Fd@~&A4u~)bwYIOz^s>^IKARxdcN}*ym#Z8tb#^ zWW_ZeqCq_Uz~fiQOErWJt6$>}RI!mR6CG>0?2SHZOKVl&9%)Z)tsCi&(&6&hWppmP z*-pJmgCx{nkylH+@JI$bpNJ|(D%e*(YfR`9c27+yuQ*6k^H^c#OhmgoPPQS9Bjy|> zsx3`FVdg6N^u$Nk!Bp*Ds$z~0#SNgv7f2bN=s#c-p1CIIYh#`9{>9@m{|M4|t197^ ze>L(qF9ZZln3(+L;%!jTJ2ytA67KqxLOrlvl_a6TEq?;&1eT??hcxYaF}qB#V65M` z;@V?{UiP~0P72{xACGyLyylR;kR=*nMUrUT7F^4F8~Rdg^MHa}m7^#z4SqK0mQV-u z96>~ruNlSj6IRom6K=d6-4D1_vlUq3>H6Zq;7_*B)Um{E;cchPut!AmetaV?M}WpF zO^e48xUJ7VIp9S)%097?q>XS0trUe*+hJBeDADmqX!1jiQsbEnRN9F_f)p&{?GIIz z_JNkp^1^DgQJ?%r#m~ZpOI7OH{i5GgC)8|n+!A)nmdk-yHZV?5iI%bB)Z!}o> zMbYYFY?U(NSB$=ouzQk7)Hxyc{XvmQ)5Yd}^Q9~T$~H+LUG4OfMKRRy$v+V&4}1<# z&;#uR14^5M(T~GY{!fGVZsS>evXKd$AjkBjAgm3Mca|bX zkHhVSbh{g+dy}HzhMtM3f|&eLy{?#bLtRLm9zwimtKD(U!C81C68`L;wXNHMVN8Hn^0Uz%61)%aYu6W z2CDnx0m>&IG6@(*u=2BpA3k-vx0?XcVuarEG1ZmIKXH}ke|EzI|2H&fg#+o8#3-NA z{(!f*Z%NUWkCODx9V|;6`o0)EI~10sXi_=fkrloUx#C@1Se$>Yac%s&x`wMJw_sN<}A(( ztN>#zf{Z^_&5A7X^+J*)xVKPTYi}NJf4y`9!li#|`Bzq$)t2rLnt>x(A&k6&PsFqk z2^&OGtz}31tzmFOUjBn?20&x}K*QFV=m54vAMKvR+sA;T{F3L%4H;f|l6N8JQnofd z*sD+i0zXNKKZ+st^Xdc&Oy_C+&tAxSKESM2beiBO{Y4E@fkKIzf&!z zmDRF7{csqDTj|`y_`B}BMH!%6-Slz#=?*WNg^OlYQqIZxZ9gjWi!PjIDE5MTxrYVb zwSLK9f&SZ$xU#`)m%X5-KjINBXDDD)=&b=;dl%t`3LHyek~))92haj^zV;FJ!Kdgr zWhd1&9ZMcQ*NOKlsABGBzjD!b4tp;`>7b9Da+p}Fm~CiH{u<`AyfW?T)_~VZqaAUY zj#LdJLdg4^fGY-?1&N=-JXUa)SmlF_2fYPi%L-d(&&9+fD^}n!phl@x_6k9Ybh!%< zlDvprVhG!zBLBA>h|wFTZXaU0{pb!}ee$0HXL(Pul+u)$+3&~G)}cn^A5M35)wH+Q>b&JtNmIlGAH zsR91yc!C7}r4<<}@AyuozDtjlJltw=0!-=LfEToGjk<0ViJ`?TxYDc#{8IsoGWP*z zp8Kdw-=1z#}J*H@mOLGaU00O?45uh=ybSa)ZPP{fkuFJ@45E9P)I}(jSMhhWpVf ze)hPs#`l@&#AB=ImxM>KDG(HmA*V&#O}aiiJl3v{ny&}(0#+JSmd~kOG@|%t6{xuv zGDMWk>I6SrP%~PxP2S)Yf{isjyRe?7Vl<8dgG15SI|4Bps#~lY?Bo*XhtP!iyn+n0{Ae z&VtrUmipM`Rx9P2qwnp!h~}!HcB{*4PL<%Y$R}p|w>TtgEqk9>u5MoBJ3(0jsP>L& z#cODkhN|(_aD0lP`=jy!%hqvEjYpC34p)dH@=o-&TlFq?)T1cxH6=t9XZv$Ze%_JG z;G^UNw4M39n=)*DTKmLgz(8TL(~no4{^LTnJ=;tlEMV+?cF%mA7cOu!|7Mww(EY>%k6t1$d@!X-Lfo6-s7~-? zTFnC^*)!FraRS)i^AtzP@g}pF;COBH$oUhJwN~ZPMuH%9L=d!{H_XO1mvN*e_I94- zJHD~%SU0mzX>dYTD3>}|;y$>^;cD*A;>s!?8!~#dZ|Ea_;$E;b+y1@ibPwIT^vbY< zPp_???G4^rf>GGQq<;#qUve|Czj%JDFW)eN+uu+h zwYZG2l4}RTAg)l|Iw1)tdTvL5OM}3LQl4x`X&!a9_$72TFEUC^J)&u^vj`na0+&RC zrzz{6MuCe61MOUXir&x6IU-(*Z@RbXbpFwFpl{E00&Z7)# z|NP!TtK&-V%-YyvfAO<+toA2`mL+e$kLpM1XLc`qz0+6xG24kYuypiPv6m~e6Tc;E zxQ7$orAu$3D>S2rWfuL}g~VD%V%g8{-&JTi0@%LKQ&DFREK<91#WLcBFy0FMwMt5 zqPSg3&?FRMcj3g|T3_(iTtFq*9#68moG(B2+Yjz5D|#U$J}7%YBpNY`%#R4*QVSM@ zpXGqXi4m2(oIv8R@s?3KxDsy~?rR#;lmUS&qqakuNQ7F2v617#;?Zqe;G=rfwu6B- zEa4fh#kK0%9W2?2VHGWf(^w&y7p9%dfBi-NF71gJ23W%eR0wl=*>wy{B#@UFTE@Hb zLfa2XFi8~;^3NRZEh+IvGfACzTQ-7sD=hI6BtR1^2#vEK+$9SZmMg2US_c`#UYU*o zLW`=s0-PPW6DtBFs+vd(QRy=(X4z`2Sqg+n;g~=RIi_|b%8ulm13xkMRCgP=6hogp zkH8y%eAQR^IW?Hs3K$Yzn&Atj`Sg>5Y1wC$j$+ZE|G)5-xVn17wQvh}PYz8Ja|l zMF_jAQ|AlWGwi*Cx4LpP733u&SgZ*@*_4IGYKpzzeJyzU>@0-Kj3)o1d@sJiK___b z?Xb43fBsjpz8(-+(z^iyW_$buKHtwMj)e#3E2GWXjcct03$1^x+Us& zED--)K%6PilJ!fp4+^)u7>qso$iA4M5L`AqE1@W$Tnixo0m{U_&%blhx@CK!cvW%$ zm~sHkl?f2j{=w}CtvO#AZ?%+PXJVV{*xUK1UI^DligV!RcR{bQ#s6D`0BghcPPuq_ zTvBF@df#{q^Q1wA}9WyARPI>>0($UbT{KmhvVDGRwUZ zQ|$i4{5egLH%)~;Ke>Muk;IZ#0QaSIIsHb_0fQ6??vDu9?f6GwG-__V)eLltarPo_ z94NK0Iy;nrsO&J_NILOq7}4 zgC>)n&@$+bo)oH|V{R7W#{w9cRmHo0pcR_%G(f0%${Fx#@-J)h9f%SGfIps}0ZIqY zuB+0DC1OB??xYPzH#;>RFs#caUCDG1m+L)MOAnq*jNkj2v?xr*9!9)vDD3~`m4@X- z6rP`C0c@Z>^`qjiA7OYFee!OJzAa??r%|u0Evd)H=WFKVfO7ob(DRfE9M=|MSFJ(s z`h-LLcRZ@wrju_ z?r)DkBo(k_yIJ^8VHURvXv!r2>mGEwT0Hs52)yUdTQe;h`RIsG|1yw&zK_0{MGV;m z8gC-UJseFZ7_^{!-8IQ`Wv=(@^#07hE>jH{)FpgZ2V26XiywNg8NE$Lf*4IMZS~f0 zO)qV5gJwQm+`)|njF{|r8K1cRVU7GOjBnvf&Np}PXTAxuwZ@Yy-7LK5;{9ve#Q5YO zgoW{m@98)IPQLoS?{wBNb)UY`{^|?KQU;?abK8N8Sal1dG97TiEgs<2{S|1BEI^nC zV3t9DzaU`Z^d<2=UBLJ!G+jS_QAd~1mH9tnx&KD)%zp2pv+fV4_|NG4AEtHxS=jv_ zBklbEfX=^n0l1t0j^v+!j5oY+00M1c}#=R+P9y92pl0RvzR#{IQB$6mLzQyxIbe62DY ze}m^=zNO1cVPc-gv8f>-^B^ua?)b*ot5~O|tuqx}HLrJWb4wq<7j!I+(pr8ybNTFi z$t%OkiG|xN#P$N+e`Je?bpsqgN8Y@gsD6x54#lf%(jbp9fy$$1wu9G@{fUZ7@$4?M<**F=)LH?Us zu;C@pT-TRbYz=*)+*qL98`%49EbniQ5Q>>H1z*1pBh;DV9)G8|XOHJ*(kaF^!e7|V zv-C@?S-`wgGX7MU#2WKdhDLq8ZMdQiSpn~@{=^NEunnVWhc4H1E2n;qVaj?d*sz_8 zc!HH^K)x8aT4`dkVs2QFc=$M3CirQBP@Gt_=3^UYcM0*fm{Va{!;v|sFBNr9^|vKw z)MM~b*4|E!U)=H~=HO_RC;i|-debBx>GHQ{P_$MS;~kXsP!T3j>vpZ)8_~novTCca z!ee+SiCZf1W7UWcIq_t>k%UQuE>H_~oYW^U+lKX-i}3Au0&Xks;at?&ck$h{rxL8X z-IV4=wvropkm1(vR#Q4Rrg9H#Ysi5Q|4@mRo2jDOVac_!uQ*j3SEV#&g5+U6W-@y{ zcOs=JL2byq$866{+sD4VP`?UA4Vg1VZtVymm}Uf5l?dBN;ntH&Z|b&!@%?A=^iFdA znV0YH4A&dBzBne!Y{l2|(qnPhG*-U&@8*WmnG6Sw4n!QyYk%|`7umjTH2uLI@pw=p zsC*fvZVjYXioMkpQBnzJ`$mlBue)GeeA8jxi{6g1;uKc_@wM4ZCeeM4@!q$1x9BK! zp3c)4KM(hrN#^e|i6>FsXv_`KZiH8q2|<62|l^e0Jomcf`aA{i-FK!S{H`HY5eku2u7o zmGX6GZn0qpNLO~`k!fVLq+I%E4j`MW5zvZ@Sjuqd3}E$Nli*7Se6*EX1~}|3zf>VYm4EypB=ZXB9gMA@r#o2%yG3sZaUNJShk|1 z4zko%?zSi`Lfb}J!+kOhY_p~urA+sCSR+9g;LT8un-8=%Yd;>tN^=Ow|4`+C|U-jXS z$~pn0J6kxoE%XQKsi9>=hl^W8KzclvM z4)twG`ysLf`iu$AeZN^7+AU@O>h%;MLroX2duDT_EENcMrNqZXpVjk$f-)otjRPIQ zTES*5%-`%HD;SFFt>(c`Vt4Q)mVWwZQ{O&=tO%_b`#=&Nqj-r%o^=zs>Pk17e5l+i zZG~x8Un!?{W7?Z&`}6^JFi2RW`vCRMx-{_!5Hy;sQdP$mm-5rdh_Z_CqIQyN93WL0kG|LxU5dfpbYku-UYFdTsMb<553q1}SvXbyBh_TKX;^$dR z#H`J4?-6=C9|pHQ!q!3uze^@9PRjfl2CrvE0Hflov_yQRnViFX@Lq$Hlav1~1pb?4 zwcq7&rx-1@)x=Zg9NCN`)NTJ+DobmpWzEBxBokeR&+^v~r|gZwh0|n$xu}nGS+3A8 zkwScG!KyS?)pR7_XiGG;4Zha1$9ILMx_QQ0RPu;^(5`YSZ-4(F2!z`D^iA~D#0JI1 zLUrY5>S9Y8Cc|C7IHcHSyOViI!DP_m1LhGnQ-zV8e`?N$0Jb$!iKvoh|Zx}c&h)5i@69#hQW2@on_=*Ufx%L z%IQ^pjK`Tz03dVf#6vy&>XYj1dJ&a)!~VNw@iYRp*YIn}N(Ki>XTVmAQ8i*TzyzOx zdaw&^O$J0@lmKHvtEcUMEZ<( z!2p+Zn0B|{>lO%cMA>rQPXy1-q(;eXVAH#Q_eL@7o<^|d0nM#6ruNs{Nfz7Tym1}x z6F?-%>@NC@oq8ju$a2N=DVA*VHALC0{5eT1e8DruIv$#lRgJAE@#4c02rD#A%OMP$ z&rMN1cfZvwV>HOShOJ^+vKP$O%?vYTsc@0%t*#PZL69IOXy(%Lwo@^NbL}ZM0OTws z6P5{qA00NkJKxY_$);_jf*w$wFIk1qh|>(d9r7trYiLsmt0@5{J73=-3ou`Aid>F+ zu@J%qR56~=c#MsEP`J>d+w22G3H72iegc)RScm=i``rXU1OBNh`StY-NsuUM=vw4m z>j7$OYAnl>XzU*D5xa2*Ns}M{mu2X@4@2lut<1Rrv-ibA(iTihm>QX7odjOCMI)( zaMe=1aHjG5VX3k6pWeNB)aRj+z)J6BkeJGasU3c+N`qCI%nVPBJ!nFXRpEA&19Kuv zCsdhVCmcBuY}PpRVS$v zyeHAX%M{Z!95bv;R1k17&#UkEW&@n=AD3*N(L+>Dcw*|B5Jx-6 zz>UGmb3MSr_TKw<2hOtdm)s>`(vv9m0Z&<9eh#Abto_ z4PfquD`l;M*TPE0Li$U~*XNkPnZ#2OYl4OISf+YvuOEWd@TN1ao0ic>2PD&-<@=hGsYe+EHvs<`diTCc`g=Nk$# z@7>1E|5$1TAiiSxMJ4HU)B^6p9?ddgYymEBYs2R4Y=%|@#5=xU_ENGN?CMg4aaNoO zdt#s5ZC?#!2B>tkLtNB%-|Y`gE6#)0cClI@79W7DaTOdjZ0}&ZilH5{I>%|T?(7VLyNS zpcq<=6fF^6GCcNEns$}@)?zW$mZB9=ii%O6*Q_qGVappZ9`m= zTu}?!&Q@JUygKy-Z&RVT)VQ==OQ)1N6=q6_O-fJ3OPBdB6(t)%=5t!rV+Zi_siwV+ zY^k3$o8D3hfy6SGyo_r%%1-wsz~&l`PH8%u!FBUx91&vGZGJ0%+*x9^gy=qV(A@%u zBxE%K>^L<=Yyaf;#zS>lJ_cI;k9jxk)eOJr#^1rit0iCB5Gj*O+H6(v?&Z8-{pfnP z6qT3BA^20T%)<6#YsX;T(W3bCw-j^dFhUUVvc&P{Bm6K^#@=MvtnJ}71>eu&2Q`{k z?NVR+kei$A{)a6N_Ab~S%|~gMrCO(Kz%wx4^`JR3_b?hqF(WC_7Rc^%?gFeeTH%t> z5f?_Q9egEU8{>&e>m6@7qyJL^h+2&KI^=n8eEtTKza|_Br2_x84F)n_2?CVAI4@TO zz5t_nGfe^O&pL)vI&Pjust zaLH7ErWR|TRLG9Ic#zE=_Ok^A;x@T#S-^JsSF>p-G_rZtFII(NofkFHy>j@M{T{dV+UwVo@qOzNVDiR z)wXl6T{x^YFf}bl&2Rj_!U5)iaBSj9$^gf7&0YUDGT@Q>U6~bRxbz>7+=H`g4eCjK4GHyi4WRt*>C zoSQ9LiS7?^o*!A@3o?9~sdGRvrH694dZ-wYp9 zQ*iqdFQona9(u3JM;Jw?M|1FmMb@A}@+IOlbT1Vu;$xwQ_d)4@87u`h@xAbaR|C6J zOIF4cz>u9*IxMmlJ35A&#eqV()ek(Bv^Gt;Wz#HhRfl5Xl~Zoz<+DTR7Ov3kLpxqh z__;0B2OJwotrSt<553t~mqkngDRMPw`3JLwZU^&tj_o5O*|B?l0?75YbMq42j;>X& z)|`nh!8RX15&H`Q!HYb(!zo{Z<g6wbA%77E zv@2+s`oc4Ppwf@ZR={XA7PXcbf5R+3Cp;(GMH7V)%{_6W)2<*YS$t&@ ze8r48qFf?a1fUHZkQ(St&nKsZYYCdGnIi^-EYxa+1r60VpMZRy;~HI<4B^HEJbU$A z6fu)d9-GWL9cB+701f-{gZPRId`yG1pnf|JIu-QXKkDL zyh^aZJ|zdVNQoWU4%+KAC6?K^yx#hnKP#FIA7m0?68y(3K>8#mm=c_o$qeU_=xbtl zx_XbL+c(S$M96kmX^0f;@HCf=VlEn)m(lUkXGxh1{8mJ^vmGc57$7BK5bmkga%>yg zEKP4Au7YH??1AMunii82P|p|A1Nym=0=$GMWQ1lH(TXj-xqcl~M%9s-Xyz_XbA7n= z%ZRIA(o!paI{2{(3Ugky^dtw>Zf0F>Z@uflvfp#})lGg?NUysY{vJEz)-nScFxmSs z;7}x#Ypp-9iCW3{*v|;HXHnR$>0F)(wj|6=;k&xEvvtQDQ9MsmW630d2(-+Wek@t4 z*Z*myl}#(yQ09ih$}illcXpz&odwm|M~R9t>|d)j>u4}BLUiRlP(u&wt0P^Z4;i?J{zJ5r(PySD^O&Oq8-t`6O=JWF6RK=s}%mMSwLPQQ;yo{Yutze6(R@4E^_Tm z2FpEs#N=O9`Goy)tcM$-Bqp(W4!+)b&+OKanF4l%kBmm)Llc4j4IL5CvPJ>IY5 zJF$^mk{fT6dm>hc+H5ycfhC0t&I5(rX-|{m=^m~`5KHIeeoEIN?+M^!a_SC!5T|uP zTGj>}eA22Pyxm@Rs_6I4rs3?t8f^PK_!j+MM?BZEH<1-f0ztd&O;{EOD>Z%imy5*{~Tl3e9hL%Pb z3c6?Jl?Lf*&2r}|F9KrD;+~KCrL>Y>Jxvw445G$f)ke)Xfo4XY(RryM<6-`=t3Y{1 zqiWPcc-bl~RZj;AgmHLQ+vCI(bVxe4=xTLq6pIJS%2qQEbKAekVE!;NVeKuyJ1+*O ziQD_0N8>VZAt6LyN&y@D=Es(6FD!RCsW9!C*v5R&8R*Wn`BG}7t!PGlBTu-UYKYz7 zS<#lrR|Z~W4a-PF`OJDZN~kHkp&SteD?SMu^~5zgA#s{1`<&^sDDif(UD%Z64#aZm zHa)4ss4k(EC4X6I95U_YOus{TORqCz9N9ES4ht;s7q6=|BE2p5UIQ)m9sL?vNV38T z@(GEpo=MlIADop}Qg^w%ow+o8_w3EPUz8;O{rox946YdtoNtB)oP_r0oHM+Ck3SpZ z{_`g=XiRTR@9)`Xf6holB7v8k{<`#>-*NZ#6t3)D+=FS1Pl#B0SzG%y`CVj~P4Mox z$zWSf*NO~vMTFz^d?@`uYav+^(y$tOx9DDIaB#3{W^fOASwv=^L`9|>n~VYFxS~Qa z)rmtW_6qygjozn~72AlEQ*y5OU~%XgZ|v2_R|%80&L%N}Tvo}u5u0ktEMU)?Ffy8- zD+_TRA1t$dmccJ(l=6Dx>QRel0130a@_OT!s#y+v1{!rB+t<$$GTf5QSO!Go)-%P_VaJ zDK4Eu|5zZ;Hd(!+tWFb6xA2(%=a4eIti`mtS^CB?{Tr>Uu%$NN9teckcvR)c3_p}9)tVk(}KV&|{+e3^~351~JdaEZ&u ziaI8dhl^i-&=&vHb=O9R9BukctEE~+u(_3Wr!}JJOL14rtKe!-LN1fFRUM{DJU7`o z`c0e4Yj$0BQ^}O@V3aBY2f35S$N759K02auy^#x-f$F^#x0E}W2A=lKMLna*GP{2A zL3Y1yGS6EfU{ci70JhNCDgU?6%k*x(^Ag|5z| zKXqDN!4Us64~xg}i_u+cCa`CxW%6r<%};H9tU=fFSp*aLEV&C~(^1Je8NrNXv%J*T z;=(@4%wRjr+cx{woh&U6g+(pHOOx|KCaWA%@3pfqF@;u70`2kj@72R?Y1nPG??kEY z-?@3t#x$gRcoj3eN>fkESx9d{|Ft`xTUx`~;M zAeNbybPz3ZLBAy;1#gAk(>i)935O$>YJ?oK?pj8@_G;$P5~o>EQ zN{|#je|@#%*)0dZh+F2=61Q6W&?kY9HKK|i=l-M6YQ^MZ4E74oyC9Ea|MgcK*6ex4 zjC5e$3^4yj>o0b(#l8EzOSZiLUT&M{;l zk2QjieVca{Y^8fY=c?r~nJn9{A!+!a_KJ1?h*IUgy7c*0+%MiIzO(Mz#>6E%t|IgD zVDNjKULi>)+Ry!pa02pp>F74mf)%K^>4j;Qw~(()*jiG!zq+=M%%rV!cG|RLv$ILF zSm3R^N3s2(z&8?q)i*@Kx(v;yGKAlGQ<{$jW}ye^YGAN66sC)pzVb1P*$k9$oABrv zD(M%er#KXgxdpd6Z=9#7rlLn-7K9z(JdaPbn+}QY+QAaPCNdBl*Bm@Zoj0%~1rHW1 zAN`Jx4py8SI=_j#xLFqVy%$J>Spu!r^(uEI#+H4ZKY3@KJ%b_NCu+@M)>hB<^l`K4 zW0$K_U>s@H?IJv?m#`mp`ueHw+bq@g9g=PBQ?9j@g{}%>k@^O4$~ezHl4zNs>aFFe zP%jk$C2YVWu=l-Yp|Pt%vx_8aZSQ?oWw2#i`6$@+zPj6URmJtpWK?X^J$A%m=HKhn z=?w|)!CQ5Vx)1t(P%~owNoeW186PQZauT|vHQkJ-m=V^`{!8sd4DztX03V5+CRemG zkQ}@|m`w3d4V`)WA`aU!?f5Xb7v3@4#y}Lm=Ywr2Dc8+yiCRPSKcQduHe8W*OOz^AQ$%es{UWjhG`)=$B&C2k5FYo;)0e6S4FXX^#hht=aZWUfcy>WXy$M8=KQl5D$H&EP zG>+L~%gS$WyCd(g=^LzdognT;v|IN|P91QuU}g}3e9!@6z8tXz1NfdAjk`O@Wf4eD zcV5vd^8UIgw&f^3LHOBDRaswL86@bwy3a`A^8sATUn^)TUEIhn(trS?A1-7Gbutsm z_F|kOAkaQ0Rot%Gp#ag1X~)pjL_<}0dVQ%UiV$7|B|X=)0mY~S97U8Pw#fQAHTwnX+Zt(11S%kWR`3DV|hX#Ll94Keyk*+`lddsOyRq_PdCak?y6DV zpNL7mcqQ^d{eCkFuhB+P=DkPfW1lmz!Q9 zi^#A|YtLZ0)E!*hZ;x-v%Oc+lI7^Z*^z<0(CYEMza;va_t3iivJXEo!vH@(jhVkK9 zxhrfCYD!rBQPG}I8DRG8EJBvYa3PH@AzY(DJj3ip?YAQtH`BXl)W~v z#pVC&>^sAn2)eeDfK=&CLJQK1fPnN8q=WP(N>f2VdhZarp!6m+Gzm?RqDTh?1f&S4 zbb|CE20{%4@!cjDP@36INFi-X0|R(V1C!gfLXuV%5q(UoM(EHBZQ4|`@2alHAJXW6v!)pS zrjdDiQTA-e@4OZDO+7QjUuA6&NYyb_Y^vk8{*^Bdw4PDwpL**G`M|nAajK)ND-18< z>__rIcB|=%Ye^n2aY3XDHZs$HHVxrQC*A~smkgikZ3p&m1y)`vZ3GvYcugr{T&j~> zi-aEytvpG0y}tzaUqXuCR)2_*o4wTx{yOn+^%LW4mk8Ys?qzq#@V35>4ZEH&Z@$10 zzl|ype&z*Xi_hg)OwREa6%srv{0XUcD=4$JV>)*mJL>7I!76^;ch`v@9@;sjDztOU zf>#M30-({G?F-lgnl zZ+}?`d;y@nM ztK{bVL2@YR!lkx}OGj{lT#4J)4M+K}y7~RYBY6SMbsba7TTkY~$ks|W&R(TrI~s-a zQA#%+|Lk1FK=V1qQ-S~u@z@L<=O&iZB?cDs3ULNb9soW@7>Mvo{b zWK|=nOS)g!CB-Y9>kZz|5Yv27GEgnP5$dQ{CKGvD!?kf-BYx`|n!hvunvN~X^s+)J z#&85u|9~?1wzer>DpHao)xYtyT>t8du95Tg6mn7Vjh3w~xlHvqKaP6VF>Su`_BBSD$`pZ1C%Wisl^89*PUxpiJ8VqorQ~4A+X(Qr_iVD|V?Xdae2(W2l65ldl3|Dy z!=)FI?w?jq$}HDpN!PYjhv}U7?z)9|UH6Z{-vLYvhTF7S`}(f_amtEGL&TIo#l%mu z6yBLe1nuUcT@u$NrK@6wfx?}LfN*G6DdcpU_{*q#*0}*x|6K}Y)qKECJ)FQ&M$F+m zUuQ&4pCT^aHE<#PXd`}5P?Y2Gd`ax>F9vjlOoxREzesLN#{eGzaLA#f?rr|ExU;LA zIc>)%3IywZ=BYa*LuT;6Bc7rh_pR4&mF)3AtTtP7PCv0C_cvSi$f?CwB!iZ5azwzP zWH{~o+PZ2j)eQ^zM?Yx_w{Se5Kaa163IeIYS-G9J5Q{#$4?aR=2kYXjnrfeX*}-hJ zIAwD0yteWwaEgpb`R&m}XS?ppH6jzKmJm^s=WC9+2*Fw>1$C7YJ)RyiI4Z1(s0%O? zS@hIDL`vaI1S0j1ep5zxXlCg~wN`lT-#Nx625Wrj?!_>)j>-FRf7+n9l0P5dRqkG= z&fK~pLL%2R#)oG<-P~O55rD_@jODL&_jd z40G3+C&>-`5A_wgV5AB$|*2muk%|v@TKNwzG`%-)s05u zi0`I~_glw(@=yXNJcRc8uO&7Wq!HLz5ekExD$mZi-|<=-+2_A?;+9)_#c7lceMkl~ z(YK507+$*F@0NNpm&=fKl2sK!wpB9owGs2XZ8d%)Yn+K?>ZEyNZTvhHd@+@cRyVua zgG5s~5zZxue|gKW-)=ca`f!t2_zN38{N@y+=(SKCv+bXy8C@r*E=TPx%jzQ(j{r|@ zLMAffrO!|4r{w*$j6ShaES_Ao+TdF2l9tpX;7ul-Wr4}gk+|eZxr&JRNx1A~h4v?* zPf=tQ+=b-+%kW>+e)X#a%5-6y*+d5U9*y^uOj{*^x$8JldGrU0!Do36ljcaAAw}e# zSKjI-2L@wt6@et=orGFfU$8_jP4Rv?%oef;7=K=BUoY7LP1<4uKGQSr0Hv+Y=0X zb;q>H4(i_PgMoAJ0ra_~l=onF0@W7!ba;ShPDi=D0EH$|;&&!9k3?dYkJfQ~0&Q>n zVlwr*e1htdsA$p;d(lcJew@g;bxA+Ac#`MeK405~BJo?=&+A_Opu=@m9v$e-PT-?E zU%%C;uXE*5ARf%UrMf-9g}CiTGAMx%Y78?{(h3b6Kiij}`>Z8@IDqap*_&0r%Wfdk zDdZ54BS@{Ze9<%<5V4P%8z@&wHUrB=m=nLgr}%^7;NY>ubVY%Uy#0KF<=7YU{wA7Q z__pVww){b+@u|e{CbDMpyy8~)BbEE$KU32uiT(!U6nW|krj2g&}7xHkxZ z6N-`N9*Z)JW`;A8zy~=ieq0ZK$@tZ8N3I@Ck_-Y7@(#g67uAueRYzS+{)X3@x?Gg%EbW^jQJ&UY?@> zq1sNs&{6fNDdsNFb(*mCu7bLT=zB12sdF7mWS!67bSZxvSGne$c?dqf>5;*G~RZ>3K9 zJo~O*Z|JGowbigE9Da2O6Rv4hy00gN>>J!1nQBm}*|ANwOKWBoO@;iKO{AIuyBYCI z%J2~0LSd7)a`Y*L3^IExSM5K~EE)<;9QdqFl=%dX=l#(UJ#sfbRyDi>A(|YI4k0R6 z#KL6)svFH$%?18(;(by=`ki`Sx%hZ*DOULJs4AiaqJQ(#EL!V*?PWS4R$s@VKnIpu zIZOrqTSY`nFW~&jT<3=y&2%ZG-i^o-=)(m`=V!BwFR609LNlmW3HlZw5CDl5J7M|m zk$5*TSco*cp3Tt;0|Ew-9zE@OV82`?jGs>FHMUUKnNQ$-PfI zvRDDM=Kc4qAn%_u0erDA)9YT7;^7j&;v+ys63nzPV96v{7gYeL><{|dizpO%d+$Ip zIWB0!W_#%6WJ0G0ZEALz4+~IHxY7Mr9xBt6+RR?QbrYQl>YAH-I!YMeQ*o8YOOox| zM(Y1ix;Mj4nrG&lcScV*99x8)g283YgXmb^nzT#??`U#DS_D0(p9hzWYjQ(GH*(ci zxpd-S<}>flZ6T0&{akp`rL*^h9S0v*WDR{v%&5cBo)pf3562k)i#Pxju7A{&X83s= z*nLnuyt?hn2=Z2m-i`JB{P`UxkK)*iJ#OblYx+X0HTPCAMdOR)P%7g&&icapexWfZ z25g!wrzS@t1R~Wbl-P3d&O-F{1hXHRx$;jr z^0ir?56*<;AAuGo$5#avk{dZ#eK^~3$xVXu3v$7p6Lcj(Mw2KtwT=_kjVderDd+3n zwzXjFa`5FK6goy549FKaZY>T5p0)yU_O0p^bMJ5Rn;^L%dYYSgK*d_bTKj7)lu*C? z#A2S^M=ppSWu{Fgdk`Ua(qJH=y&$#l4~fAyP_JehLH-~k>ePCMFO zvfPbbp=s&5X^=%<*r-&QWjtO&0iJxE-yU<`qVhI1Qt`7$hXHrTAf@Q#|7W-&C#9^UyTc zVZ-aGU9`K?xBGW*+&#YNISnwq%4d#NKk#uB^spq=%E1cATFBC*&O{uKB4)Jm-!%m&*XI<{{hdn|$b;@K5Z(fLyRo$oSD()}h5Nk0}qPazQ+TV)j z-YlBoECPgUrq{08fVkfz&r`op9Nv@Uz}~%f?e5H&X>bkwDF87lI+hQkCKlaH?zHw= z7JCDF#3tiw7B(BYAnPZQ!v&o6Kia!pw(#CLFz;){q;qbgk$=?tcv9L_AN536FbiHm zxu~v<8J#6U`;;kRuywFm(1QJB38x7&f^LpTD1%N19`$bh40A<7xRxC^?aGiV#uk#W@u%x^lPpj^);|J&}G~*^;>Q!FRH38Mybkn2@|Rf z_LAW??i5^e_YKYrCn*z7&UW*3l-X}HIO~!WA*V-qOSpr?H4l2zUsxI7``%4LA4?j| z_NEyN5)z}1-ONF^NTL9)n+*HA-h*@5!dxas)Y!f@li>uI*5#1@1=_n5Tw#pq{G)VdA3v-y3`m9lc=&TwvBR0Ewwb?CDwRb6wliV*6 zp|Y5poTryKUism1`@xSl+Qc7U592C^BX~G_P>t*iv*U_J3gW4;u;*0Dx0N~&p@ICc z@J&b6uIk=xr*=BU%W-%T)2^*=g;oqd17OQh8rv$5YGUA5$C}O8D=%<~Uur z8VRPsIS!HCHB6%su`sRAaZCCa?RbMxR%yqmU}0mssm%@L=zkiCq8N+C%;!J5tsZ^o zfpiX3v(u*`v+Q$W3wS}anJemZbu4z&MyBQP<#T_G!j~5LYKt2EgU|yv_X0V|j;vjp z*p@&ZRr4d(pjq`Q@L3n3p8@vbb$Wd9-Vv)C3#P?veCb(noxJ3S6T7q(H^+HNg<*T6 z(q2C$6f2Bla$iKw9t;-6v1Oc8rOzX7R+&@1!MgLe65GE0nDjx|sztmRUB!c~IQEQR zkzEYqEeI~`@0bion}6Ssn@koCrZ*TW45e1@41VmU4 zJ@~EupxZCV@!plKv!_LED=f*<5`ighK7T0g9r1e2`h6eb$aFuaKi-ueEi&Jg*qvu4 z9#png*fl4qAou#xHF8%)jz5?l-j9ZUlJ9d4E70RV%$u~GRSKGz@Yy9FOX{={2(cc$ z|Jh|AUip=WJMmmDV?%E^Il<0r@siMcIv%>ryCQGGJ2rJ~ zo2OAlC_}c}^=0qXZ4WGhGaE9aDc3m>-J{A+znlFb()+rcpK7U;Wm24{M6bAmGE~t& z22#VnT?ABt>9%x$gj1p{;BSKdAwqbR^*8;IEa%XsGW;kj7n3i{hl5l?h zL%YBys5I=NMZo61d`9%x_?o@69#}!lU@enxm~OIU_{Q35)@${$@pkrU#t~&NJ!3`U ziy^uRS)vIH)x-d4#03%2EwEes+xoe6gBsO;riY#sZb&<}&T1lA+he1JhYarN8jWst zoZRn2rcl;p5Oh!K139u})*3E`*eKw43pe#`n}p-NxP}i8@t3>yw9K83W!pO7y4se~ zXFFfk_f|MyP?|||*{9htCo~KHT2jZ{m%~ioaAP*mf22PmSpK`&ZncNwBI-S9*$e$*btgwQI5;ybp5D zhVaem>&PirQ33&fpI>(zOwIA0TKvf#&S&rIaxNnUrJWz7>*KgaTU*{&F$=T(5S;_3 zyGLX9?s~GOW$5YS*`z_g+t+2SenA|sNy^EPG81Q8_vi6@EFj|*NtPW_xtp%UvPey0jE5al68+Qp|E~x-+X8; zKFA?M?#FxF!{?j;$VQwP{@uPu$Svokn8(YYryjUk^Ni$fA)aq}( zPv+87xLHtog`IluOwF)Qes>zZ*sP=+_60g3{inCDEH$ZKZ(>x6X87+Y zEQKlTwhS6cFu3(DDOnG2dii!zIzQ~F!lv=nS4aC*UY9M^MI zKWiY*PUXWLEz_#rr)MBiN~b&uEE*0Ojz^@r`PvQ#kc@Xdd)N2&aT(Z#Z}{jSOq%`0i@^sK(PSu8GC|PuNyK=Bh3wXhwEeb3Bpw76mxR=$oVD=VB820kGU|gN zaEZ7+t)(T?V!sg}S5@Oe1$FdSdf~l?*-oBvW9-CcCSwwZ%%p=1oA2zRuuA=9*Zs+| z?~y-{*!E|5By-2!Dr#yGs-#dbx!iVR1$KP@S~W)n_66^v#8rqTO}=7XK#~i?^8E5~ za(B&f2;9#=d8(|}=Fo)?2PP)P*h&X!r<)kec2O@sCmaDYkFdy}nI2z_sJzRxqZN6$@A(zZ+HYDtyq!XbC|H)cuN7KZ7^v=k@%72w5B}|#EedC8&YZT(}+3+ zR*;7e5@*;oHf}L0Ax%oSHk9@#H#!+)%Rsl~nhP7>@PV&8BkEbJiv3dviWG;toMhCX zzE_F*m=5-33$oMf`JQg4E~ART7z8^6@_9{kq}#A}gOhlmWZTh_WRO)^;>jSK@W-kC zSK;2HhVW@A>101H%qF9*1;X941Is?Zz z!a%il`%qPN8YZ{0&yjL@PpnZ*?81a{9OslY$|h1BpS<6p+`%C?vS1wzRu*i`-$6>X zkLCP-vxd1ax8u#pe>=`Ikny+{^k%K6;oRoHW%frOgeDIp9scz@Yb30h7JO#*^@Kj+Y?bvSD#zr6+*LM8v}mvFG+5><{&%ukyF!*RB!g}r z1LOq*+oifWs+UE{foaRvV36JGr>{_>iAXWD9fcAPv)s4^;gjw zXjws^%U2BtYbTngB0?h@P`kfp1bry(5_A&yk%)tXOE3dB_MQd6r~emBTj**2aV zNY_BOF-J||ryib&2TR|d6RL@gqSNkJJ!B?*elI%sXTXMllIXx(r8VlSXQ(zFMD2*O z?i)C8L*my`>fYQaWX*y(G4F{1X}a&|{wy3&`r{_}qdOSvr9QMmwzw)EP?BHTg6Db( zann!Lo>zRaG7co0tR&=aX501w0bAFhs;V0^1{vLUAri6pr98Lf-#EcnuC?C++bDEq z(7p`E)4<97Z+SPTPahD0jCmtUj%>()v#W9~CYH&jZ0wWE1tFz@KikGM=S1$BB_edg zz>odZKOLgD7Q2cA<&rd^{;XkH!S!I4jQ)Ld18yhl3nE~`4r-}NnKRpxL@R4=gx#~cU+L=IXLBe#y+z&m?ufobQ?o{I|CT<;Bz^C~NU4z3Ky z!#k2EjxE+v))UJEAZNmu`*o+ntNal{wGoz@&}UXkqyxG-8b34~>|c*yB24VHrD9XJ z;~3QCc9}`F(!Ox{*X_BCXJX8U91>R8)&@D#>an5GQ&wfY)^&aHcUoN!tCPv`s~32c zEz~ne0Dm!{2fiD725e!KK2z9?2H8{~YV#a_u^t3~3x;WLLTd!J$;lRAr%s-f;ghpW zHI%J0{vdV5D9+AKbP@|?xIL%;=+LQLzYF*r8*VnFjtntuOow#eJut6qWGum3t{}k! z#Pl+@92)G}?a4z4yOT9tI^pBhw~%BMb+LgJYkMi`8nnftHK-Fa!|9U1&1P`_;bwr@ zTa2Brj={Kqk-}beJxL7Z$lA-SX6u;pm+X&hq}trz^5s8`-h%q&S+~6nuDRCs^y24N zVW#9xcavb$S#?>oPjV+;TC;!&lOnI)HJ<1fuuE-b{1PpZtOZ2YZ|h2rFi$=xXYW#x zUYIYdd<&*#V)?uz0L=b+-ssrEbUl|mbx>B*Hh?a4264ck?YH2+)1d+Q3u9p2sj!y> zS)`IL{f1Auy{R0?>b$a*M08sJ)0EICvHCU43{oD-zZqxpydegvna(%|qj>jiOeBUxphSRy)s<&c-xxDe7 zxXtEE@$U;~P!(bo7b7V*T`1_~i&Z*eVPD&o_SjRs_#UqFKcgRyg;8|zv;TR!Zy8R< zeS19lFY&rxFR$-^WwjYNn-bb*MJ=I${UN1`yUgU3g~;5Azh5$31l=Ruacv+5TJShE z9N%{xDZ-lGZz_xjHT(bSuWs2`7dt{ZB2j)00GzG{UM(nzXQTjtRe9dt?Z;)z=wL_5 z+@&**vTz^zxXW{w*C9X#EDoba*O}$55DyK#YumuQU=2xv!a>3gj4!uM;=R~ z;zR>+SnCw5eUlLY0jy#%ukbTF**lq81cNEdu?T|o>Jx(bSg3mca)VOyz*3+ zbvV&5V@Zdlay5f*%R5k;0vrrNR&O}ThjWHWO^X#%c9`@sYxc5(ymD&hr>1DsT~N@6 zge{KU(nQYQfvggHB5BJ*Ksoc^`k~zNF$)Y-x=0T9iosNgNRqriami7>;Q}0-8d=g% z%pmXJz2b*H%f~$+t6dx$zkcK*eA48rI{iC7v*@vE+f$wR}{ zE{eD5sgJ!jyH4`~K*hHK%+i)FU66=)zy?nW{sTY(z&O($xQOXEE}1rP8s5>NC0A>? z_hdNP{Ft&qjGZq%6s1p7!2ZlTfgybLDpi~KR(rwP;Zr4Z+3Ng99U5Ryc1-dfP z#wP4@5>4vAE;~w6w5dDjkr$S8k9jxK6l_;`pvXR^B|Gh-bKsKsEyzYeaV`hc=vW*P zjr)1O!Rjpp_z@h%D&tdKd(dRU1#{`}%6vLr_qOAu8IDmecY!D(O2;QY$HaJ~ubY|2 z>jEJNDvh(mZhxf#0EP<;nik>ePlYRk&UEUX<$@ZpyIHt!vqd0yA`>9k$ja6Y`VQFM z7IxDRY)9Ic3yV3f%omCv*6_ax%v{qx1vIlL=-aE$iLHp!T!2r9w{C4jA}C_+R|Ur> z6-fv#!p<7=#=t#tJTi^Y?qR}|LsREqN0Jm8MP=13+>*v#hG^$wcbFgkyh_FkO`EYO~xXl~hjlt($FG;yVmMf^u z0QPC%-MZL{iHXv!(T9b`W^1;t~16^CNom_#(5TKdzMv`I7^BtQy z{N>veoqcEd@WG?K8lB*`q}A2Ch_v?-#TU>iYXcM4As0PgTm=9gW0wn1ogxx}cjlY* zsn~R8m?XLSkH#o#p1=zWS2@)*7SjI7(e?K=qFzv)>%MaE zH+ZXAH*nl=?!~uHaSy$H@ISr0nJZ(1(;9WkIf#blOB=6ZUS_=tkQZ0D#R4?L17s0A zQ9tFBT*S(IdP=?OY56CKvh=Xyz%xsKk+o&JH&WT#G@CWXbyvi3AZajwgJfvt!n`|l z;abUeA(|>XWp{FSkas?gglo=oM|d;$ELM}i1%x`Qt#_GI54kmZPa@XZ7y&nOAL2FhAbriP_} z$HqqweF?s1bt2c=FB9*9aGhnHEfJ#V)W(v9D{ZYVUPDsQYLU0WhsZ6%=($fL0>_Gu z?`Zj?#e~T1e!;zS0>;*qAAv71*}eGW6Ayc<5Fv|KOu^7SQPI?x}3GqXbMJAu2O8$R8q9XHS6l zJVrjl;Sig3WUlL~A^#nf2^G zcmj?kpz7;4uE)^=KVQ~QwcW}gbn-7Y-4zL2yPEpeT5zaYp;~=ES=Ntw_SkTkS0V7I zT9XI(z-kd`gC^ZU>z2^RcYqWPR zx6ib>d(u@80?cg5*&oV$xc)+ZYvc!sVbd=pX)U;NXiZB5`{I4+Rs4uMKQ2`jfXOLl zD7X?X`?Pdxbd+)S^@06uc+UB4xjZ0zo~m}-{#xDj`ZNSCwjbg^r%pIl6kL>{>xhnn z;ye)5Go{{D^=(qTgbj5}KnuAVjR)VM+o}dnY)Z!qdBS+#eR}n3(tSJzBOFuPiJg^a zrVHX+DP2I$XFh6_pBwBRI+#d43LESm}N8;%nT5xG9zN&L1XT!(akAQZ9WOv0DjW=8Kq#L+98R9K5`KuNd}e%M^~e# zZ@3+8$riUrha^K&4t0suJ*CLJeAAS}#zsx>&_-@|Uk}*>#$%8+t7d&<|L~WvvXqv0oj&$#YBt0^^6lE4NHr$}KbbUK)a+H7; za{oD5Ee%3suG$+hW;;TR@by@Rk(!F8d^I{V$I+**^BkJnVTA0s0i-FEMS2%eH(hfh zW_k~-D2jKx6Oww&Xg*L=Stv|8u#^tTcTRyui#D~NBZFupj;Hy@ho%>RQ_hzI8oQ** zDFl~q{VB(5y}U~?m1(BIQARS`hEXgg9Me&JY;Ff&^~eK z@hP(D6rV|lY7_Knn+^Rh9Yg%@mydRLW1s!pJW&rk#)m-wZrasHBG)i+;S;kPHF-dI z{8Y&z)c)vN2rYOd0e06$?wH?Ja^?HZyTot;ujz9CgvA33pdY~pzYI}5%_nwJO(uDX zVLR-<%PGPKtx}-hc|l}A0dQzu0$Y#)Jq*yL2>GxYXkO#-`pXGJF4=%6lDm!kJ zvU+KO;FT_ydg$Qc5nDa5<$sWI__Pa$6##*ARdGwb?yzk_rchQDl0Q{+g_|xH*a8yr zIyB6EGaS{l{@|N&{sh7lDtJ04tla@cP#^Y|ixDDTq&*G7p6U$S4w~5Nh)L!qtg)`q z0}_0ME!=IqETb8 zPrZ8W-O*>=q^{%Rbbta543-0BhBNjxE=S5d`b|OZagfIkDNCnzW?AHZ)%Zakt5h;p z?!bpUHMO51}<$Swr%r8FNO zQD-pxNSB1JTiqPbL)Qu}xJRDj*=u8qS-vB1tTt^c8612)LkMakJ&QFM);|}qbczw6 zilr&p%z6b5@fbCx#GP;)a)Y8fPi;Mt`pO(WE-RR|8nf!nx~sNcI~TsXy)K}Zj*x-- zRhKptX^jnj9Oo_$WFSbiZgNzkiFXsmzE|drvMr6tn-BMFj&J#Gqjd~R0*VLOEMu_s zdVWm-{{3$BcYxXl!!6ympR23R%nfZ$G#S62r4i0_t__%Zz5k{M+qFGs;5-{BpxksG zwfo4KhsdW~bbfm?yApd_Li~-<#CXBF~?vPI;q!lLjm|%CXid1XR zJYa{*43wAmW2Zeyf;qHK%u1N>t|WVV6z^#;8mAHatArshL9{ zN~a(N2F`AXuQ=#dXZ^*6kkJv#}$;l4NEF z%($LzlcN4ddI z0GHl~-tl*?&e0Jb3cRpXuwpINhAuQM3^qcddMZ1j+H8#)P^O!NKBJ{P(}bzKM|TZ( z8ybxRqBR7j6HV{wy@*>0%6JWPU@aD<|Gi8Al_CA{UJm*y7lKZEa_P6asFNKohtD|FYx4QoXGy3H#(Yfo1c z9*=w&#PV^0V7I>tS!|$xwrxU{F_0W4c;TXs%!?d`(PZ9?QYSCd!u81nVbf8nSRU$F zR%>8?-2^ZehsX2hG=gVA0(c5hg};3D<+2nvMdvN2s0YOdftM%-Il*&~qBHSSY#05* z?B%+xV;%K!qf*BN8LVp?$FfIpv+5HoPbGP?$XA{hy$Sw}Wi}0*kWU5tTr9BQdy!vu z=L^O!39B(d%U=T?{LfqMoT7ZMw?_|C-fmdVED4(R{32shFZl|+e235B5Bd?pysGoq zXCf*69IP&+_I#7=#1AM7Wm{1aUX~GNV{Jw3>h@|XqPx}ffb(vd0egM$XBOCO#PM7{ zot|Yxtkj=4bMi5~+yv;AJ&j++cD^$%RI$si zI=C5O!Jkj9*sM$Kn^RSmbDrhXr$g?Fwy~7?0|j%~NZ&Ps7crcbgw>InLn1Y0XV1AT z7EbyP*9-_sr((q{l#93~_lEKhw%_`?>a>6Kz@PW>j{?fh$8blGcq0VvuNP6p=5(K{ zWTZzC~%@`$Ha`m-Czy|9(*L=@stTd4pB2b2`$}59Ny@Z zl2b`cm5?^1aOijuX~jnbo`#qXzF~m_KOXlp-!v-kl?5XcBs0iyz)IxSa=nBsNME|WR7~Am(zuymTbMXs-nax&Rw1;VG4D4Q zowx)9P1W!MixRb1`E#JZ91GlWYw&B&m_Y^#V zOYYa68U83n9lJWvjEiiYQ#QQ*NOwXr+UQnWmmRD_#4)|6a)L%6KkbeBFG9__6~+&` zd<$TYvUe}@=o~o(S)|zw#JE-ES@#V86!dNp?l^v`*l#8L4>BU-oZoN> zPObm9Y_X`Mkc7r40{RVz;J_})Xy~r1xW-`McixVJD^wsn;w&7x5;TN9K~)_l(IBGJ zPazmu1ZOlx6VS0I%^XyAee0%RTv8{XZ%-6@oNv?Um9&gB?O2N7*veysBP!~tx3Bb? zh^%4@uzzDnrL?1m1ep?t6;m(56Qas@P8?ARgny`es{miWf9!Kn}-_;NI7V1n642D41E9Q5U}EmQj9kowXztj zuY5F?0@Yr&ta78vCA1!Vng38{hB_}(G>=Q|G1C>#!40aYAp+GcMO|wt;LcUx06VS( z9cKuZxUQ<}LhnwMovgxmIP0ULo&ZNIG#IGb$>Vik|j1rccGBifnPc9@aQ|FKW3w(<$LdUalMq| z$aogX5R#HVlCZ zxJ>fs2^#+PS{`i)Se-fhmE(Jr5w!I04F!e{$>Cr|82E!6t%iZn_vFX_P4T}ZkbnGd zB>Z0$!&`Rlyof3j6o6|QmfUaw{dZu-?K(w=$rDE~^xe-KCdUY)PtgQBs{USlPT3_@ z5&S8aZYlt;cijRiGNLZou#cnh6ESOPL5f`_fC9L7d+RmPrl%dRqenb^8^08i zFj&nRkvU}?GCPP5lFV_X&)eDEh(D_RQ+4B0Ld!0wo4=n?5k@Nf_`#jInafA!dO^B` z^2^VER44Gg)2Wbulz0mGfS^yDM?awp`Rzw?sEVaJLjb$%dET5IpV|VYqAnaMrB3d} zI5!wb9rcryDjrJr<$h(060q|rjDCe z1y^`j`BTMC*;oU>N4T5pI&9R0KjBEVY<1o@V)C3%=Qaa!0&7ES#sJ% z$9>@jT@Xn)v-lcC=aq6vFtr%IVsCEDP2({O);Kxm$ouPeg5`G_20Y+?7m+sx`OpFY zJ~%msPWJBpqv-d;C#+1>Gki)&X3XzqRTtoCmse5%3b3o&a+ICvB;SJrj%v|atmhw~ zjBCx1#rIkCYG@_1VbEJC#Ml0L98#2@hn}0+Ojb&m^6X{VwbNBen3^M}eqaE53Q|w0a?mpzFj=mT4766N`5kOL(?0$pQJ~fBfDAxPp^nL3#!m4nH^l zeA20-{I?AQ(R)s^@I~T<_QW^s&e`5A;D{g>X=3FZ#)4S1_IHA)V%ykAx=O^6D7Nrm za+(Q%JhpsN-|^_IF!Xaf-%ce61<&e1O_8W)uf7P9Gec|rK$%>0U_$8El5vMGPcxBL z<`J3OEHOiBQ5u(P`QZT2+(*x6^vI~_0Jpu_Xv-OGb$=t;tNh{j&cIgPl9D#VSf+Eg zZRl=+iIv|ALpBxUj(>N5vR3~pA}`#(9)8#QU3B7lgB#&ba5n79A3`2$P{lqh2e;pp zvyLtp{}Y0reF}6PTZlUhUu6KAz5V$)MmW{zPV-T+!@QYg%t5C!tQY*4ovP7lQNtxn zFcY&peWD;m=lgxd?ZlXD8!rGLCIEvA{)#!J0&p%V5lWz++OMc{kZiF=QAU)V{N$}T zbtwivUfn`kB8f&hESVY&6``R^gAHi^6h*yZ5f<=7s9S$+cgJ?9`@^D_QraMNvBPX+ zxVkX-{UGl`d9Y7gojp%kpjIHk0*huXB$LSLc=>Tn<4qg`-wR zD_%PciUeov&}#8x{E>uQ#ov}GMxU5O%UAk7i2R`j&W7jk=ItDkEfIoK?eJ=js{m+? zMtMo#6r0E4*Ljy0w$mfpy_er-*~lCO>3ga*#1Hx~Ff(Tk7?~5-w*6G-jlt~r_-(X& zf?<2WQ%_M}<>!VxMxWzTXDmNSAG2N&wFvionU6qN=IpFz=I-bu{CJDAn-sZA$ zVV1ERz8QHQ035r*Q0Y;OWyl_slHo8$GCaRA|K+~sp3kOdAO8}Xr&k34&VC5o$u?IC zJUW;roSm{A>}DUDGL9Q))~VV##M)=ZSjh~cQS9KnJb!JsD5MDz4B$ucJ}3?eu*^Fb z8=+t;`T6D6UuQ}$A#EYRn!I0{hVqs!Psb0p0;iXOFDj?(F+YvNz=IZ^F60Wi{zUR~ z8~@_DIB+JwKjN^e$9XWHWEUT!u=r+pCZV-M@1Q62MuuUZ7MSks!DQ3TXo^sV(8=O5 zUOzr_yZTMe2<3(343ORM!vox6>k?Of>Jy6Bnq)z3s8y5+Q!al?wnOm8!69Yhe}L(Q zr^Wf4_LzL5e(w>fJe=Hhu-_gx6L!0dn2S4UT?3v>UAmvE9%b~=+^Z2ZpagdE0^^HV zHD8I&EAp9IUw%&h;Ov;XSipk;&drZ|hk>5~0MqfnhR2ehRWLs`pXkPQjWdGjhqtNX zXom5E_K1|INkH`0-59 z<K#k+4{OU*!nJXVwwkHTaFifR5 za*eD@OKWBVtR5(jbr^L`PRP3R#CmtNSdW7Wen1Gm6XgTtI^CKj+Erf#tUj!d{Q^V# z)+#RNcb^>a0#-k`L>(IQ8MOWw_oj(R5p@v0PQeXa`_L``U(B|c_=94~)zae^4Pe#0 zE^`_bH2&uG;$>q{pa7PQ&8bxN$7PXB=`uyX$9^;JarRb=GZ!;g-BM?SAaLg-pQ5_= zhB2SwIO79HG1h{;%{5%ltPvi1Ut8QRE2CcSw6-i~e<|jypa*u;JpHc+E3-gR%#}Th z?6iNw1xf+eL-|QY<=mHAfE6-oETta|zIk>Hcv1I$=a@%VbxHMm?C(!?W78St9INjF zR;Fg9GFc(FMI3wB6|tkVe7ICaN^a$&+^RR&kW49i0FLl3R*@oldDP6@bXH~Mq_920 zyT{pDLAML&dkCU&G{E>BKYZl!uwRs~i;22s?z16jwjllqZri+&JJ-YJDXl?^djAe75C;)2k^-kDV<%fZf_@`4lLhMg8S2S z{LL`U1+2M@#qD;;+WG8+AAYTi;}TnmsQOjR`sCKJR@oo~AnGaK@KtVgQ}!4xsPMQ@ zDm!{?YOi<{qe6BZwtCZTh6(!f4!zF}(G9 z4%=SejVwhLp?0|3gqgTR1IyvcES}|1n{B(u)}I{`qQ_o$Q+v?`(7x#nQVU+Cs5OjT zy&(O;t=l1`1K-j7EZwNpklV|6jR@hoOq>`PyGI=1v-+xj1!0NMh~=ZEPdk>u9=OI; z*A8sO{VlPptV0Yw4|S)EJU8FJAqLkR6SuRDvU29=f_4u36|gjqx0Cc7&@%S;u*O7G z$mSD5*qW;DkeX(aLme~=!gHu9Qq!=x`*)#gE~0s|AEna8p@xDrD4Y?4=Y{s7{J?)Wy+yBcxstAOZr#tk*wI2 zEo6I1RV6IDLnC}16Zp`{EF4V~tyL}d8HUM2^hiDjhrqb#px-CuEJ%?Qyh6B|f5qq# zk>{;#HE~C-@*@0;X*ik@^zTM_B3mg#^)a>3S82xY zxd{^d*^Rsg3{AY!7vPu-nnXM&n6#6_9t^n59L@UqahR}QoRwk7+o>k_l_s|%3cHhI zBf$oxjlUbXbW%no@m%3J8&WZ46ks^!;k`P|Xnkdmzj`-2ozB+ex>*^hPUJu8^ev(m zE1;v!bG-|%#d;Zfus{6=E1aL)rymID$A_-8;6v4^K2HxdpcbD)M-jzCMRe^2V7<~s zY`_RukK2O%>2&X_A$;g>ff|5rk=Mh@7J1j;dxXa?&0XYs8Gb9qLk2P32Op>y$&<$l zi+`p6o;M!IItRImx4S0IwnVcXN@zKNt5aRYCk8-N?d1~)H&63%oNM+FhhL`41K(K% zUxV7I0zFD#UcpUxJM>R*$>A6aK$k=NNiax1P=DNyi8~WyJiMVC=!!%)Tt^H3r=+)# zR2S=@{n_@wT;q*Xj5+fLOEj0@cB-;VFMY+cgOq1H;-I?2pMmEX9=i6>F(=(K9A~#f zUwLZuGWfmEG)3>-Q0pz-=JMpMi2>D~_({65)U^|=ORC;%IIAHAt?25Aa*~9tPc%Ee zalWuNtpl*X#t+aT>-NpSNJFRW!51!5tg?`-TV^jv5^7`Z82t1~9}G}bIR|%^ZVo8) z*spAP5H$lchf6bsSNd0;n)z4cPgRlv|D0371ks=O3W^$2V8=6ogLZ7lbO?GdJTDr^ zK#Cw1=C}DCw)rvyh~Te-{3FD`EN6_!9R8_p467F+KQe*T`wfj^mN7bQ#;d`Y|LVD7 zqIKg|+L+um(G-f#+XwUnr6{A4%y8`0OlVW4r4hxzk#AF}SF$z+_in+b;elTXf%dHc zi&T$NC^Jm?@`_WEg}59C$-jTx4qT#-AbU*g>sJF-3&$^i(rQajCpIy)qbpt1*{(BI zV@PI^9gSwgPp5HRS?U)qk67Xya!SvGBj7yEH)nJNIs;feSD%1xl=+J_Y0grab2lF< zr>uXRBymM%`gB+?p^s|WL*%~p+@g9ts5g!Gp2pYSar0~PXzEG827Jo5MJrt${o3yj zd3^C!e_(y-;Jk0ivhT*h_SEM1oWX`1bIYg3gr&+F+$^ndI-c9gg(|$fF#)61+DpA1fM5 z9DQxsvAYYD-J9~4JU_pny&lXfSKm~hF#np4I@V#It#rm!;d#GZ7~bqi46AV9QjM-H z!WZBq@$OE3H-V2&AQz8saLplU9FekVQI&BRl=VPOJW_K}@J9ii^u@L$)L?+pWTi@L z!FPsK20n4as@qF57c5J`C}`sDY69-r&==;cgOYJpQ=w7+bgaPBMQkb^A%?|=)S zCmO^AdnGJ#YBn-+ZuxUsMmXl^cA!zbsjRwO&9t}|EniIA?rukvM(od>dfYb>^1+n( zQynLeb>#$^_|6i`r4Ve16vNT)1T%2Xj0u-kvS}T>pG*Z5{<1kwD^ORHq3Jixj2j)-r|ksqvZQORthZz!S%v z;kcnpdAs%$rgmJxBk#|vvSnus=^|$w z6YKA<*oexX=1&YTIS*@BC=LpAhyu1+1XE6dF622FQ3`H`FvshfL8tiPT=_F0Wp^Qq z1N8Wy;(4NuK%k;Idq@?V$W3k8Kr!;sioln1f6Sh2HsV}*+fDLEssQh!)tg+TWpK|c z-vVVfW&(0|Khjb}4*V!(g>?%UDg6lzv8Y9Ttl1c&i{ZTkRcu*s3*@m>+kX&&MJVSg zUke7AA&9kPwO;Uhr09I+b+j*cDi#bZKvXN0;loKSDB)*W;9TwS!4=Iptqn(?u|f43 zHg@SvUAjdjblSEv^UvObo@+`1&*B1q`_x++yI|~jpmdUTtO*=YJQQjXFx^Hv%SSV` zA|G8hF<$uD0=Pc+YZ_%p(duLnl-A=}3F!OZsG`Q)b4Pklxh_cTei7~vHq{2r-8-NR zIZyo3J*f&#m2N1=n?!)I25N6{mxq9#Kzo`D-L;S+kD2B1t<9TZ=4IN$cYuNLo$~s& z1#Ri2+6O4K=$4BnrdCo=fhsm|tD(TIf9{Q-vK(fc;q$3Qf2Z|MOI4Fez^LL@t*gUpS)g_y)492E2FJ*S$q^RVonF>LgAmR2YuJr25lJdZV;TVl@j9)v`^F>NPo?jK$DEymN4Bo_dkHq{{T8X zbg!sePe4#I??LZKI2<$k8yfu<3IbRV)U;fKCi8x0SUQ2IAR7Az8i6404Bs8Hi6C!P zATdCijf`$iP!;2U<0!B)N%KD{^phJ<{Tnd>JqRS`xmvg)=w1|JKaUvs44#4oc%PjAj;r*lf zR}n;ztaDkp^(}}^JGLc>@yk=)M1liweUa?gfUTV%x_2fhZjA-nBYa3J4YO3lAi{MG zEiin$vvP3FXgC%}Gsj@KKf%iNc^Y3{?-#s0AK#d{7lvf6yf-{MLXCdy(s#Bk@D~G! zx>NcPg_b47%YECeNb*>AR(|^r%egVzw%gF$otZS~k047Sqtr-KrDRrZ43-CsitCRV zV#BiVngK!3{otSTe*J&Cvgw8Y>!8a@Up2i{u1Jf@q^H%v6{#J)sM!C$k~ub z8NR(B!VcpJ`Hg?gWlUt*{rZ<*vUUE9@jsSMiOJn@zN!+b#=SmY?o{QDRD84BFF#m>qv~??9JyIKlR!u&UAG&T=LL=+h0Zr1ajf zcidZ5zTbF~BH02{B!)|oI38hPpy8jF*eGZI{!?}52g}YC5!vYTK{N&PRz?3;s4?B}GdWMfs8z#&4 zT$b24=HIvb9CoCnKI#|sQL8?)w|+yt$|LFv1vp3UXULDv`y=;4BzonPc1!akH zVmGsRAOK&B=zo{`6TBUB(ZW&80$Im$yzRS2+C0E6H1v*Tln07is$K5JA9~f}YAfpQ zF9zoLDO;Xa#01oH#q^@w1$Zo-%Us(66qz$o?|sER3$|Ha=8lO{-X(C9wyi32Hnr+W zALMk=(m%O}v>5i)B`xgs;CED~mFIr>HE@mv@!)T;pvuo5>$o32HkmQ;ER+oD#{0?7 zVxOA%kayPShNw>en7Ore$5XL52dKCzTIp#f?y%A~gE&w!i)hH3*)$pBuvqP>ajsAS zYT2M;V;Q`~GP6vZ+ikDlRR#fl(`hK_`Xo7YaG3Deh|f!f_!OTQj@N=DZ<85}!!c8(37?7cLVn-4+ zEaSTV)9`10N{mglKBf7buoP#MN2QG;9zhf9akp1fMbuz}bbm$Bx53`5>!V$TxCUj@ zz4wOT{CdchPSN3POIRwjb4F$cwwnCT+?$q->ZGwlU0e zBT<3DiFe}{d-3iKWu!Xbr#N%tNPy;D{S${K3=d%CMtQsRmd40eLCQ|#=5cO{u>kyg z@n+379=w<#bKsNpHbjbJMT(P_&+>k7wYJxX(f!QGWrJ5~(`l~Wti|;*XhSn7cgvNg z(Ro_gT|jc^C9t(hcMzQ({XAg~=eenjGg#`vg69knIuc$#jPBP>;9SU^$@U(}?JC$O z*o7_m;5i|7Z?8DX=yUmO7rbnCtj7Oj@_vtpT^7rc1B2YFIL7B_1) z)?dx#a0R>#nL`)&MIGNZJD#GWibZigpO~FI?1rGh!({7vO0?>I-WL|y<+)N{l8_$~ zkoxIGTICG|+lh&(1>3$n;MRkyKQ_la^u?)WH$cC3+-jBfLk{}ts4^X_R@BKn$_II- zkysQ`6yy0|E%LKuLa;AYNsLGo$#e5yxAj+aJ1I3vJ>crs9-{=({mk-u-1|FdmH_J++PcxLhU>cbc~zqW05ONSI}jki_Q6^*vsF>bJ{r2+cG6~m{`CL!e$(8AHO znsHl~^+#H|YX9oBrYc0PO4G5;Wo{_>SzLz^jn{)Qj`5-8d098bP?5R{DI45LpBY;| zPBSm}PGU{zFG88dqP`unI-uMoW{^{+L6h-l4~y~Ur$GfO@f`n}zLeRtgH(U6X6$0lp~kJZBX31)tr2XUT16Eur+qW$2K((>K-W-Q$- zusZE3Ptn#=K~Nc5vZ+@5Xfe~tf%1_$bX&U_%u6G?pP`|*Js+g8ut_sGX`950sK@n6 z|G=yo^2UX9sBq`D_$zP+6-@`N8-(HA_#6<+6+(x<`rDDR@u^Co4b>81jG$fOr=8TbtiSFae6h0B}41A5g=&I_sMJ&8%ov zFX1KLO0R@GLb=2t1DM+YhjP{*V2^0W=2JhN;^?0ajPC4e^|skcPPP&r=hJeBc%fE#{-1pMA$$UAX(me@#1vMH z6rE_b-o&WB|4FGYLKMYa3G$TBDfP+QK_#?rYwKeDuf?2YO$w<#;1C!9P|TP?Xwre7 znXrSe-`(38tYT;Q0N51eZ7?ccTT3X9Z$#=IAVJQ=maQ&T%Ziw8ErDx!l50z2c}@(9 z%gA!E-y;zv?+@$X`p#fMMLr-Pi{!xg=r6ppx#&t>(alAVq@|eG2LC~#f0PYo!TYNK z$pa8%ip^n*1)Fe=E3=GSKakdk7iWxvOa39zGnk!+0r09*v4Q!hoI^EHhhL`Umo6fj zr~?Jm^=o&nZ|ct#_Cz7Ko1H;Mg57<`WEOf*1J0qu1DMbH1(SZ z!ULyhKzhIjQOM(~b5%W~F^2S-I*z4~xp2=O)MlYgV?t8v@@g_o1|zvos#uK74;_b} zrXYWQhbQoZANo1DM$$&`Q671mqL9Uez^NiIlWnN1b9<$pd}VKkOq*}%BhR2IMdy|? ztMoRaII!&NupeE`NyrKSnHF_Mtb-|Z`Tu(U%@+e5t(_Cj*$KVk?OB&X?BJ4bxiS+nOG&!Lsnvu|d;W_zi_DZw6S`egEcShp7N}4FFj@;`kw=wr=YDJc$S4+#t`n z>!I7~o*7hWUR(%S^wtIamQtmokt}ru#m2Me0~Yq?eH#f{RIw9T^vt`Omu}Cz!5bdA z&_veho<1Ld_A5jM2+STE)F0_5%mw%`R7pEK0_-t`78~Ce(MHBlu!NTi@0w(L_?ZXGXn&6eu70uWv>sT$3;u&hb5{q`ea3 zat;2y{jfvi<0U8xoDvQ6@zu8Nh5f7r43K# zbU^P_%FooijQ^LwbZS$i*s}*3NAwz;~XmmE8|16%w|7=&g2-ywxF( zw|iY@SAO}2S#23#f~}R#DA#s@Jo9$6D>wmf=02Jbh}GZ?Hq3@~lOtP_^Jef{bXYUqK+@78J`M7nL^ynJikSg{D_w#$R>&v4Yrd-`X z85>HU+{$ z7W;pJCoc%MZ@?F4qO@hrn#8F+UDbeErsF09B9L|?)uGhq?$TNZ$fEpWZ$O~WP^kIdJeKkpyeMC zB$eBRmpbVJ4&&*}6i>zR-b6CTd5DBuDV zGC)@U^5nT{?RFgA!ugEG?lf8au;%GcQ;>=I*AM_-M(o^lXRf zi^PrvtoR_k0uxcYrhd}xlb9_?0;7tZO#@Y~VyS1-+I!r}7G6}jY9j!|n_ew3j5d_v zt?o7C33-yESIa zL-x&mFB;>-dB1JgsL+|}gN6pY6R`fi-^Zh265|efijfqZsu)G`O)$_v^bkLkO-%^> zW59OGlwWUhyE>r*{{C+bAP4&70@#0;vJ=iBnL+)pcVvtIX(Qhqga2dp{$J`A zm>=CI$|@gA{bLz(s*?olm6eaJPYUug#+Kt7|4JW&yMEimbU<_7yJEmgva9PU^}0=0}_TCqH`fP>dWRVS(utLwHZm+ ziGL9zJ~V0CNJb*Al%1U_WXYF$gG9U=i0JsEOJs;tuAL(}uBbm;{Hn=SjLcDMybD6o zE%u;r|9fcv zZ{Ne)K|qrI*ys*jFnB)@AL{{N1HEq?BTUO8i7a+}w0RR91 diff --git a/pep-0458-3.png b/pep-0458-3.png deleted file mode 100644 index a31edf1702d26556382973306a8f216e7f304418..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 32146 zcmdSAWmsEV&^DYPEfftXYVyL_gZV#%ssOsHPsae9#K95000C^in6Z&08B6dfMJ01 z0DUFRGuQoNDfrEkSR95YHb(i0 z4OHo~QTT$hy>d)0AJlf=He0>$wEXyM_6tG9>xW|1U2_i5mw}8RNM7NJ=1ys z>aBbBRcU%EPfH`=Wh&gS+*jjlr-R+*z;6a_IxmX2gYCz-@89|p;u&9LnR^|aSOr{| zIXGLPwfleR^ZNTdfenp~;}ngfwlkmGB5nzfLTmjCxS3IUZG)rJ{5+<^!?eSTq>}q{ z(PbV}^o_a*RA2JA!Q*oQb`<5RASM6+wO`Fh;Ib(inYCq@EnJQobWQ#y`NGkOxj5!$ zp&Y*;p6l5`$bgzd%#L?w2Afs-3y%(Sd7buym_f zQ)?c{)eZC>RbUSh)@(XryTu?Whw^fzKrfTq71+vkUG&8Wim$;Z1^`4qJiDhU@=(yh zX^M=fXD9Y-hKdye9yevXZ)RAt)ZF=1?o~51@-+*?T5bQaeuF9VK1Jgg2?iGW!PiAH zn;DN+UKw-ZBh$)G@>Ro!L;I{%eX5V^bBZEzcKFY5)ppq3G6dPO+fUV1Rj#sms+ULj zXin7GDwPktY$GTC_C-=0r1eD zYeAB=dbx_)OSpfv-NJJ#)^V`;vAeoP`ckg<3tO+68lIS@kfY**fZOFncQf5hArh^7 ziQ|hF(R-UK0>!-NWW&5 z%GK6}UbOk|Q`ZB}eA4IDKj(o+GedSS?%`zJ!-Z<}M3!>Y?PbCaQyPCJRHZLtV#h~@xoxar zMR=(rdb@t%r%QjnkNqviL%F4vTX5arb}q_64BmedK8;xVz=(p-d{v|IYx#u1v?E-J z2`cncS1&mjeoV4wYsVw27uZ8^bz9)8ZC1>8fSa-AR}xikAYPI2%OzsPLAmL@&P(W} z8)Yn?q*>nGx^&h4W02RLa?ZJqOXsDPU+&Y#VIFErDy|sTd5S(+{Gm6QQ!izp_cyPi zSiiJnWf$}P=*>VXyHwIc(Awv0Vf2P4%7$8SMSh(&lZ9UDA!T?6PAp_B6rn{F;3!7kA7%#Qz$0epS z^Az0jo=JG~{KNAYyu>JyX$j@J(>_NbQdeh&{}g57#&`HmCjD6z1bj7Y7--y^E0RYo zNB7`;0mj3+lqp|E;UG100<6JW21NVQ+RjZ09Ab@D;hvb${Y5Ie2l>dU#x@G7;aRax z9^Kok+rG%83O+3PW(+2Wyc0q8$KYrY(j{%JvF~_&SP=&=aeJ!TzWdP!Dd56@XJTTX z5{gzTSct=1zounI5rYG{x$h(WlRh z6dy4EyV;DPXg!)|4+WTU*02;C=Om8OyxyBS9Gc*U%a2pu)<~m~di_QZ_-gF1{jO2W zuJwiRxSM0M>O`tFaLt#*|1S1Gsfmn!^qc{b*Iku_VL{3ax#_S~p?=ZEt!$c{8sX>5 zbN1!0i-oqJXH9Rdrz*@QQvsy@`cKptJ4-*p?a$8y3OVYuD7L!&>!1N*aO@@4W-}k$ zNvPFbgLbd$YQORWz(`vXuh&jo*+F27CvZrwk1Q@sOWTZS(AOoaz%BIC z8MLkV@Cy2`I2_`=CoRh`KTxz$0${?Orgsyk_YB&Ubn|qxX?r4xkANJk)mc#4g<+i^ zRdfDlk$^61YyFl&8HbR}jpv;Ck^&2gy1y-KV)u z4Nv%qCRzH8W_J8|K$F9og5z+n2~j->*s1XO!3d`I-6Gv44zbkLiXYp@`rm0^NWg^I zUal{;yzj(4G-iC5X}?Mz7OEX-RjoY}Iwb(a5QEX0{lo$0ArvCg@VS(sf8g`AASBPX zgZdtUoD4<@sR)OovsD&-N-)H~X*Q4Tl&|hHW{NIi5eH}~D}3p0@Yv2*ajZz6`bXol zz&ts+uzFih!e7YVQBu++Oo6gMl+Px>t7N64Sn@(z(7`ioieSX|7a3ST!AjEFQ{8_1 zNM`n3+S;l|;v-_IRSUuHNSnR#7js0VCJ2yz?_{^@2XCP z5|iuy(RMS+>^KnUi$b%VgGHEOprWojE$??Kre83P%viWK<2p7eR-`r;@tzppO^rl zZbLWtGK7oa4V$jet&>z^MGt|z=#E*!}NzY)kk1qT0I z%OSsfI^G_uN$}4vfgWb>)|Z4gSjqoB{eSljd()y87_4Telx1)N%UI7PODyM^S!FMO z`1f&`ue_>-+mC9jY(!ng`uk7A@MPrFfB!)NFQH(_KSI*fp!uMGTpfU)K%>uO`8$Dw z3cN!wR6JVHp{TsQ9vz={&67IZKE{DD+M`4q8p}PfkxlEWDgNWVH5uUxTaKxnU(LrH z%o?&|M8-Le{VK7tFAV&wowNeKa(q6|@uv>hsg-1-3L2|eB<#&tcrka8chf0l*-pro z?qhfmn=oaDH5ic*BUX6K7|N*||?&!}m&&9(?s? z?)$edq+l6X_PQ8w;^ecXO(p8H-W%7<qZ=s%)UnDwGX}JV0DQ`$ z4+1-pw<1p?(u!9$0`Gl9wtnDrZBSndFf%QR5U{V-RAk&x*`p{*%91X?kee0@A3L>N zI|n&j4UN|8ALC5|e>KTT!myU34*Hs5x8f#6-BMHiw6q+Z(JILbo?0!x;Sh-?WZNa!MI zi9uDCp5d%NKIO17ORJ|Zt;+AGjF0YTL}@~;N5__l)PituX0>AYNW&`iSWJ!v|HO40(ifqdxb1B2l z`x_Dia%?d+JP(`S-F8y=BQkX9-ko+tSkZn;aC0d?`|763^|~UVxn0beLiB8sOuDqD z@aJceN5m4tI<^IW9c=1qkFpF4S&an8sWjH zKr2_Yp=aMe!0BZXpM|$X$00=9zS_N!Ncum-3M;qmwvVoGqE$g3^7~+8OE@O}QlWrHjG{r-I> zBIzHI^622i7V)!fsu0Gxm-*|QA=;dU z`KS7|!`yj=Xv01zf&{EEx)0;oOE}PlKGFVzeJsJ*s762i))e=vh3tB+mn%#J|Uhf8`em82ksQi@-`HB^R_D2doVvqDh#`~yGENaEN7R9!GQ4=Za!XTHz zUS}7st8vx$(S0T^8LU9djVH)1PrDK@q($x2gq_0{;ZGl3Ym3OBHw0OYpc4Uw4~IuR z0EN&G1P=$0TmM>T#K(}tRuhff6lNl9tSvTd6Z_TCqT(o}v*jwUW)r`9btU$R#tt&3 zg%ElFZJmf+K|CT>%X@AwX?XY`nG^sS!38BN@L3-FP-m*$82hRE_%H(iHh9DtcEf)ITL1u&%J(-d z27LE<@PA%;gTwu>d)#;;7J9O+HhZ=EP-CkC4!ochXK-}8aUbEW4PiZRMO$q%&5^v zh&AAP;wT<_FjhK_Dwn8jU_Dno*RBA#E=WBZdpo+DHHWI8UdTLv)hF)=DX2*z-P9^l zZ&d%hYrm*5Crt>yZ{HWE9cPIJ@J$6Xey)fP@nps-CiacGrv`6G@~ZnL|nU)Y~LPr?QeD)RG^p| zj?t_3pou-ZJgs{J>f}~d?4F|ExmUnmTLGcITDg*yY$dPl-=(Pb5nGEd$EZ=Rv^kIz#J54&1aj<2+@S~bd%G)LTd<Vrgzre=c^_6N1-L^XNG6(s zCFcPKu!gv-v}eSmLas4VT{VWmD({2`eKwGGHSavW^uU?64Xkl#lM``}i9%~)T{;BlmE3aiAOEM2zbzXRHX5xw{h#u0T-X<$Ilfq-C~q{UQOQZQeH%rWO+O`&wt<5Hs6IPO8<+9q{4J zR3|daf|mF{_qWpvbj^v0Al;!xfvSH_c&tK-Yyy&}CUmVkpUw@qM6MGJ-rb1QDc~eF zow%NsxQmk1MpJ+_7z5q?Kp#9`-NId(<~=>kmTZ#Fpk-2IS`~rjEvlw#m&NSamREeD zm9}+*zB2YfTAg_R?GtDK$s?F;4=$L_vflR3kN;ptyJ3OXs)6Za_f7I1nEwI+z=0XL z^zLSfg)S5Qr!Bxfctpk(_l|qKFn$f7NKsM${Y&g#T=h*ax)tl;2-W2@Z)>R)!>cw!s=eV=kUCoL%hM#k3>{c zy%qf0GZG|p?*H%~G8Qm7{KE+W7iq(T8^qO@8MHce2xX@nsNQh4{F9vl6vge_)NRx2 z*{E-Oc}|*Jj%z32qW=-B09|IQ8-uxV*M05UrYu<7bMLT!s9`Ao5kKN}^!juWH+3m2 z#cX7v`kz!3peZ04b#QCY^-W{xm7?l_0`%{>2cdlOLnOIJ_~e^Ov=bg|{Xe;w$!=qt zHW^ns-0KS%*7*Ng^%i_!qP{j-kguM9Oom#sv zwhs##G)qA6>jky4dbrFQAqeT$!YU4a$6=#~`#Z?waJ>`aJh)zWSuN67&?at^&Urlh z3~oe~%niT@!A2_y6Ab&Iu$2r?T;i+rW?>FAtUIqil*+VE@WH z@j}Z!$P(IkoDi+=$oMr-%KW9)8_oee>ofd{TpZ$v)NJ~TNnr>G-!RhhmV0p z2??(UIaocT^9sOph)`3ciK3JTtldTeR+k=p$E@ob@z#Ds%p;m)y`)UnghM>bGd2;B zozC0hLSQ*mEfP=nirhPh0RljaDpO3U_EhdS&(_b?M#w^_YtPv&7oIZnEuJ4tdzl*` z>)~9;vVvtln zNXa6aXOvl_cC|`5C7y3VbZTh)!&I!(B6AUSzCw_Z)ytKB?08eZhv_DYTQ zL8;0>H{r`Np|#q9n*FvmYq9bG@-lZ_*&*c}nJRMCy&nECw-HEcliq3KqQ{A`o`2cu zE>oc4BE2-ufHV}nm~w2_tXvnG+p_q8$Irc8DYv_DjL$QgnizBS-(}9d&U}1zO5Ea7~nvuIJFIFazv3WN33hFpu2zo_np23F4^#shqfzSQMfxzOB^F0S=LKYT}RfEtBV)_5{DOt0U zealk$?(7UOZ&esItEfcB4*)lkrn^5nOKH;Niw{^jF90WvdJu%#)Eb8cu)xh ztECSOydS5BMLo}cAgRiGP_o)X3LwXQ9QX!*NK zeBn{-E877>WUjw^=(nfpE@Ro6;lMOP3d@rQd<8PQ+^dXGO>aV1vA-UssEn0pbSxI* zK5}UMk-2IDzdF=7P^66hh)D1-n7nC7^$QKK(ah(Y)U%>15z7!7b;%h5mYEb!%tqHHUWASNoEq~fC^4HjU-kmJ!;vxs|*2EUNxFZc(XXg)Z$ zEWX||V*v{-jB7W+L-{~1=+GzmW}gmSs#0^%C?`nq4SD?*=w{%HeVy>+a6}|No5(@5 zs%KJrRRJbW?$}uU5ID)a#v-m)L?R|rlSOwfY0U6&L*)upe7aNSR*spk<=+I~f0==u zf!!y8rbygd(Kr^!W!7*UqxR+e8}($pn-1QkWy)mCNIl&6@CYM=z!76Q)9N3 zS%N4L2WE-kWa6~0faGJy=PogeFJ?MLP1dem2vDE?aVf`SGV|9VIf$wKDLU3oaF+Kv zju*ZB_`hmzNvlzmNkm@VLF+{vk{LSEqg_gtes0;7*U#J<#f$(`qn-dqn4O3cW>=~r zf?eL?VJYe#-uiA zx%LwoTP=x2Z;(B*GQS-}jRWg(^QY0PX9!+Z!OeEFur$X;@D-0SlYx^NdnYJr#vWl{ zfg{CvQB>PFcDZL6*fVL#=;{Ivde>yJeR)5;$QtM>5{2m&h{wCqI3l{|C%peud+^}R zO}&{TS()LsmT-wL<+Uu9IE4i-x5w2OS=iWK(oK{X1Gz5-kgw8>cUg(V+Zhbmnyy}n z{CW7*r2HE-EQ;F7=-i4aWR$CN;OK99f)8b(sXp!b<-JT2%aY6*U8RgnvH|41|LEn>so_wx}xl1`98hlZj=^z1AdDhhb*L%zQ z>o`a^S1jI1R%2MxgiGp<1dEGH@dlZNX5l3tHnY#n;4@&oLM8;jCO-Hw_qQ3x8O|_Z z4Yu^Qc&V7QQSla=!dIejyN;{RGD#>_*dp5+t)&=iVgdz}e})-dgxqv;MMRpz_Fn9? zg_CkXZU#Tg@UE-~Ug2t@n&5_L)FWbq&8Va(u~mGNtQLsI?U`d8Kx=E2t<8I2U3Eh} z>Wi<#S6=P(rtG6ScrY*XHQOc+%We)r+z=0X~!Gkl>m=`Bv^ejS%Gf63}JVH&nIED4RsuO;(`Sf zz2Po$eXA>PivetcO>#x_=J>^UVpB^84lI}}2g{C&8iRqk4zly=qU$PLE5 zy?g$snAX(o2Y)}?NwFR%{)|K4D{Mh11T*%u0u{2KkUq_{W$pqXj9vkG&a|B`Z4m$q^pa;X@fQ|b zg08n_z-C&hAC*lsygeSuP8Bu7QxCZWIhXJr;PX>(Z|op{i{8GK$*lRfb~s*Y79zM! zgNtrDDMOMDBV-eFjG^L5ophgO4M?@7bA25uhF8qL$(~2|obQ{;?0yypy8bNhts1elT8S+MS)( z+Z{aNzP+K)==+!{4PEeV+H`*!HbYmc?UGL%#Ab93N{+QgWQ3_0GEU0I+x<+x=Zkq|5LPj()mLS*rKIR9vOHEZj6BiNDw?(sj5y=~wgm@sHnx>uol%Z5V_9`Z6}{iWzwKSuj`Hnvb$G zL3wvM17z{6YI<$_gXDV8rom)Ar=vN-Axy*xaP;9tI6#R&)C6`p2X|{~!?}8Cig|Z$ zM-1lrg&9}v*;;TA5i?4M7)BDzsFx(I2uQ^uZ)jsYApQUhCesYv86Kh|co)G)3ndOw z_Wi_1fQ5BVl4I01&x@6af}@cj=Z<&>|E1@R1a(c9P13GlNZM~v`H(ueM7@P)nE8*r zOIq~4c}uW}e{^NmMM^*|4lQWgOuZ_&dehov9W_GXG7kX8?IY*JzP@WRTYHvj^8;X+I4+D4>(-dqOgrbvbuhz^4Z_;oNTU57as#20dZibFQRbX z`etZ1Q@ToBwZUGZ^9|XQ*nmZ+YP;Xp4Ifc6yZ84=0W%uPsg_@=SA^7PyJplAz;T7okiWgpsNc9`Q~nu1|1jUfbzFjC&qZz+ z09(VsvR~__QyAr6`&_B9Qs| z6!gUv05~J1i+U6Sc&jU_Y9X7UE2~)2#BkPNdrXS2*RZ7fA3u;!F7Y^gL*)739yS1q z1_2@=H%KfO_sK4WuKGYTbb)rnb#P%J5fHX27(l!iym z;=!K9C#LE@Z7~aei;@nKf-C7B)Ym#(RPgz-O}kIF(_jEJAxGi+`W};-t zuhYImCL|wxx>Jeht}t2B5c)kY#yGQV_zn%`U%c&y1in$(k&-FMY}Yk7mPpC&)GkVz zY7AnZaEZ|4nrxNb>YjXI!zY=T%5i{!jsbvku%t;Fzmgw1k&D7*mgd%?CRneZ?lK{u z)LLv$ULt3Z*<#spp6g_>sUR-n6|@L^clYT^f9KBlCAwSzmIMGN*)w=Uf6_f;b;!Um zX-xVy!Fw&YVV&6XnYm{XO58|#Lx|iU#|A*qfaQ==^UzB-4cN=npGYcCFna{Z?JJeJ zZuwHjq*#xSOt5sPED{6Wu(dEqA{!baE)_Xvf|Gaa*qHRL$Hz2PBYQ=@Yq|fq^ovgV zxwDpKsuGsPqR8FhwT~?a1e6C;#rx9}KZ%IhSht${{8UEbS@J3*qzOKEzx4C7E}ofU z^BC2Gap*?esTm~zT5_x-@-iaky+~C777nQyb0^_Ue#IS~uCtWDX|T@c+Ct*{6&3Wl z1Mt(b2zKa3k301$l%#MlNG7pn>HN0r3?k7AIt|{XWBD#rAg=L>8hz)`Z`pfJ&^;Zh(AoPk-AbXg9DeC#^*Ev z37b1BppQ5(QLjbrO>d;4@5}S(F%-Chc5>LKIhumRpQaVGWnwiOV$oYKpUQ#a1(irF z3c}uxk-PeL=f79vPR3u=fBQJ5w$Pi9s2%LL9z}nEnHC<2Wj3IW-yHiyAOB>8X<`fC zq6qf-?tp~ic@MA<6OnT_iWVskbW_}~Rg>XStp6hvI??A1#MH@_Jc+$p-?P)Htk;Hf zKYI;F=?UncufqwAQ7U56zS&PH1d36?OVcbj1AjdQb~e9wB#XC5w1zxV&=blLRH=X8U zyNFo7^WMHD7+gryf9uph0ysG_GG3!pNuP=S>|tpI_y&-BTH9rdI?~yrCao z?M_K*pjlqwUrDioE5rE?0$vflKWZg6g7HT0o#3bRmp8drBUxUpZY z?qHaKb~toTXyVCrINx#=PdmHAEB&-8w$4uujH=b*tZR}yKup<=8ot-?T^{rGSS9)8 z@bsz8WtRRMkqaJ~I6?X=CFhtUe3hlRA77%*@R}*En-b#3qseuU6aHSqcYYJ|OmJd% zo1p3WO0u}}i>YAcTS2?q77shOh5IBA7o|AWeLjahAZQQ(s}Y9u9C} zr@sFrzj{2*)gipxW1oznoR4WcmQpxP$jwH0sFovf@!K1H3ejBSgjg!{Y>c#A!e ze5I<5g=M!ba~)%80g96^-?kaXn~7lIj3iyP@6r3PxE#fgc;f9;)f3SEj;uFySQ5*e z7TjsJUOZ6k4q!mVsLa9Z70<4+2YNDH@YO`J(tl2L-q4R6Z79*V!+qE|At z`r#0tP4$VEIO&FO2)6$gJQF<6$W<-g6o3CpOMS<5r?CJjWThCViW)g`N*#ZjeNjFA z9hNpaa0QfT$a1eN>|P$M-B{nsUabAG8|3ovFE6;`KXV7-NjR-f2(lb@cv%pb-V%sL z)ZNn8;(ghxujI_k2aG})SHc%>N*wcl=5)dG{}N_Q>=%s5bxE5qGuhMmZR&Ggb^b8z zYy(fV-KbaSw&=uJKcn}dqoI3xQZ5$rcz;}H?x9c8>@{kg{M7aOJeH#S!&-|D_% z1Kslbum;Nv{6;U_<@ULg37MIww5RoWxl{A#$ zq`f$AD4#277vYh=92CIw7@fV)LyXR_znw^$om6}$2J0fCNN77u?pPVMPLQL1LJ^_Gc>`yR4uH~S0^LWRa-N%yN zNmzn*dnV5Z`h_u=xSH}$emyx_-LO%Z=MGBeSidxv!pDAnbSP8k;CWX0whe zIJb0nzzQ4cY+!Wo{OMJP@!bKoynMq`P;QQ ze~*E8wSwjwb6Q9nqv$CouCHa&}@=z2VS_oXxkmJ)s@_)Q)! z#4`ccqOTH3C@AC-9E;D?BUxSVgIF;v1X4oA=W6N&K_o5Vd1_}N*0Ochy3UbW?N9oo zt13p$?^*@sF8I;&WVvCt)8P%n0j@cIH)=q4rixxJW{!(oy(0%=;1E;mpqD{+T-Iji zEIni=^@3N60jsYb(24J>M9BaV{WxyI(}N8nT`t^cn~{B!@uRt+94uHyAi8 zzA|YJ*Vci9S+L5Qo74_66aTVLoJj@=^>(wzN~dLQG?Ac7CLlHM{T9OycZmh z!VPMQeEj6i6FJRDedHZVSY1m9>sd<4Ysc&}-ieBns^)sG!WXsXvo$_O!<;?t!} zwAE$qXlMg`(-%KBGh5!KE$Cy;zc3bi?W79#vp#;2Kdw})(`?zjnbI^wVAqSw)v(|B zJTw-n8izHA>ww9w&{H|X#dYhoaWC4tow4EJt#$ZpaOzLOLpGbPBa7Ng?`_V#8#Z80)2YWh;BntrSMS~UOj&1orPwRPm)ff-hb-^fi+{2m4m9r zKX)lIeyMTC^nuj3=CO3Okr-#=S5Bw>am$-c%PzCbXQ?Nr;}>}Vh4 zxDKHXBY!8$flXlfN0QZNeAt6BBFnhjOHU&IxIT4;q&yY@t8qgbf;G$9AHj}rfP97< zFL)sPBlqn;Ni!SpVepF*^rHE-ivh+by$awL7NJA6y|N>mu$w)=v2wPlKTRnK8^ikF+f zc-4fKih-a6&SgN1A9gR79~U4 zKgHPi%>D?r%{P9P!+*#*?CFk9hSpU!6Y7L*bY>Ixfk#$FtWva}S+}2C3 z9Zl==x8cp<_L(A&oy&}WiB6ArNLpr=wIyiuwzUO}EVlkOP@u{vHuHWd>bff5CF*pn zw03^n(Am;(nd@yD*PKp~|HZ#+XSRqPB!P|5OK`gw&XIrt%)@?ZcQ`6hNa^}MMyVZp z(ETl>h5d^|BYQ;#eCVJAZd*^~U32n3I4=8Guut5xs z`H9;}Zj`OPhBwMsGTAtfdCbB-8amqLi`{1UAIOEhYo|=krSsctdp9H~Q?pO8w&6Pf z|4hl)x$Uk56=z48zL5s2$ABmGV+kf2^0=vGX^XqLH(8`z-gnwHKkNju&@7Z2q-K)x z+=jSk7dwLX_$WH!OO?ZY2npCL|H6t*@lzXkLB74Mc2Z`NV}Zq{x1zrT%)(^NF;(m( zS34KrQ&_LSpT(>L#s38Gp!Z*Dl3^nT8yWnu+xJL3Z0B6?5QIP-huxb@rCmVapMQwU z(CnW#*@dvXFjrc=ViNgq7evFEhKgH zA4@u&>hE_Zl0-(As6L-}g224KnWThYasn8m5z{O3y|5JDnyT=wK%NJ@zn?O*HcoGt zXTBORFL97JH=g3 z8^Ow^A$Z2)zX$-;c~!Lrc0Mc8s6ZOROZ?@Sm+!f%8F^N0}!^}Xv; z>X6i*^xx27guJ6{z}CG~{&~S(CZ)rz_FE^RH8OKf2I`~&bfcG8j<0wLJ!I`!x4j^+ z<{4p-{MbMYNv#(8#T&-8(QpKf-W9m7{|`}Rkx26cQJtn=8)q zJlID*`8G4#5n^y{7c2W+==?XV!SodJX1p%qcwbJG$o3aQ{Dy5umpOV!RX+}l8$^fM z1W|hiq2vm*WxClRz`#oT`!3nOm(A!&u5rHtmnnv4%C6gkQcuuM~A5C;SE&m*`UQZtlL060~LUJn0q|Lhm?y zw6tPABzQ;tv;Z5}onNT+lOq`L&2c-)Vb?`^>>+whdr_RmG* zwZ7VfcIPr$2F4+E$-vnU896*YYcHu{SSt-nkcBU?+ZCY$sLeBa2D@kIM(M6VNo@C#3o>zg4K4*y{RAFKMRoh}L3n1LZGpIx+1vg3}SKcfwE;hyY4LrGN#_fI)`9{4fxmnFb#WZ>u*VYxmau(@v|kDWSKPrxcN- zFxGWfP#eCUi&(5Rp40@LWy~xTLZI(Q5E}tth<67DI(G_2Gxc>jfQeOukv1?ock``8 zG3~mVY=)Q13122NTOTLjORustFGYDrN2#RP#+0pa+)J@!qg*COO1w@JHkbn0+w=Fj zs*YKh$WFC!+xJvD0EV!GewRpMv;{z5oMn3Q&rDq`Mcq9e8u=_~Xw_k`>T>PI3lI$z z`);kiG-o})@XHf2E8amdd~}Jq*QJuXP*^_f}`tViNVDT8#SV=ZrF_-K}yS0 zc9!Hy6U6{A_^W(Kl(DhOdU6%5mI}CQ*@d{;|L_K{3LrfZ5 z<~Odr!3FZY`T*EY46tR`)qPHxM_baSgcX6jHE8twn|NMs=3VJkT&Xl&x9L3pn@*rB zX*!Okpm^9=TB}Cr4$dC?KNqZ2$rFGc&^_9d35()(St|7%3yo@Qrb$JX zj{i-!(P=!IG3fJTkY>eK8jL3g6K&r6PM7d}j8sSOrFU|ph*M>?2$YE%Dw8e{=ZPP zn=DtXsI+lZVVyz!o%Xa+F?#E{d4@X1g>qx~V^L1Ga6up20?X9-4tQq7e*X_d0h%a5 zPr_%j=u~G_-#8|pq`GLpw**=T{j_NX`^JV8j#g55jd&wTyLjVy_0{t8>Sq{OrRAo4 z3qteEJB`f9WTqj0p8KRZ{%xhW4Z}FgR>xPr7LxcMlx>ox5v9V2GcR)JUY-lrJ~pov4?o8ivq zQ*lh&@^bS61K3G~NG{6bo+>v=wSGUG0+0@ebA~+wq7(q6&kA{*( zr`b|}D1Ure%^PIP5Ju7)=X4&8%FX!Kx|t@XA@g{xH)xVjAiP^nJ?4i-BaI1*ELtb|xQ!|jTDnwcwU&4$cTD4(|F5pE4v4ae z_I^MV5Tp_51r!ts>4p^$QA$ARkd`j#S_K8kRS=LADN$OwR;58$q#J2z$px19X7PP* zeD~h{hvk`hX3ordJr;2wHCWbGPNFNv@2n0~rykr_dEOC0plL z7An-wziSu*YNx~tz7xHAkF$geEIbi9)>2v}@N>`X>waK!)f*)7k;Q{n9d4ILFIScs zh|b?~@8@qM%IRt^7+CEp4l+`2v*%a5m3GbQmfb~(8>!>+P)|PZM^d4?$G!5=(6do7 zqfKesRGao5*-Ec-nWXMx;PM3m4y^Y#<=5La!|}m?z+K~kz0t-Cl5~d5>$qY(e5kzT z+Up^1FAK!XdGG+|BYG}DVeW!Z)m=?o4bXsHROgM6UnaOXNnCM+NjR`9o$!( zL!yY&NrI34=a=`+ONWt)A_0T1B_2+O8%a916OLGV_^=y{?(*%S|2{M_L9oM zmsN_OCp`Qf-?Ddykzw=Ev3au_ZtZ_m#>h5M7J;{NS5b5YYUY;&bocHSl&hrrTL#*m z*54e$bKA`%8WV%y#T2qkK1T_QiQ1 zKw_~zgQFkv*4p&CtB*!Um6!>XlYs+yOH}GxiYt3 zZLu>nEuQO+e$QfSYjba}v`QgleBSf#V6q}Sw>3b~qBtgR8E2HQo)o9*I~x#`#}?~% z^3fpy=tITtR_j-5;2(lgDX*OgI86qgeBh z9(*s&Z}eNuc_2+LR(vPVh%Cu@&R6`qBZ&JWqCgD(ifku0mC|apFcCa3K`zS#QNWgr zPI3;^Ct0b-!Ls6rzr@#mjO7_Xvl1weZo|EU{?6AOmucP1yr7dams(ss=p)kU%;6Wp zt@iHMuK0B~&2=`M$L+ryL6dbUHl3Q?E`E>fKWh$H-cou})suh6KK0Bc_G~qLp2T8@ zC9rG6lDQ-7=qrC~8zAhrO8-kG<^DH9$8K|D5|#fAGCz2fD(jt%dX&fxo7RORyq3*ev1D5fKV_^5br{YKL>w| zDZ}?7C@Ct?UO#r@)o-Ui)jO{!4(UMhjeo1P$Ta@eg}QzmgiH)cD%w9%B>v}p#iAQK zffRw~q1~p?u)nk2V_qi`Vu}a1fDxSKcHs?6PecOh{_%{b>VDsj&J!@ZNc`5e>;+AF zEx0DN&m8ovx{3#!6~T@}SZ7X*mdAKSFFe22x}Zpd|5bflSx=(?Ljt1e}&^c)^F6Oo3V+YSAjy3hZ(yE~j83 zF=&pZtZ`7(Wsll1Lh4SNKA$O~saG1`(jdi^S6pyVseeklv|AXr_V;Jsq*VIm7tH?3 z{XR(}Uox0IPX}aExuIybjfFx$g}LLS<9fCg2X;7!dnE|EA$MJ9u`lVa!h6%fH4$zK&X^N%=4S=I1CWAqGzQ!Qs)E_Yg`-2bU88`2 z;=11FordWVA%*!-D48Dz*PK{!vJym^d<=;k=St3L$TVkz_tr59F}h8p%w5I@OaUMt z;=T_X=AI36j6{5`oW?W=897kfj*>PdtPa2l_AB@VuuD7h>u9HxgMMC;G4!B_y`xbF zZd-#;6C_#Sz>)1bOF*!8`ltEdo+qs`eCGf3s!UB??N>H6${8JibIV&?uE}%8Nm2Z( zmqe``8=mhjS|ux`tY}?|21z`WrPmfXw$W~wC1QJhrXxjubU}c5AaZf}N&-K4#WLZM z@A{;fbDW+apg8N6c>zkjm7$pZYI=`<&nQ)N;7mNN{p=W8+eWM!s3CCGMG5O1%mF@; z1>GUzVnr+7Kg?pumqtb}v+G)gndG~Aj*R{xo1T7YC)>yiVo~JrX5>>Z2cvb)Ee4qo zd`l|lZ@z6BJ)980=urQ9V@kgh++C2A7JecBc9;RZd%JBAzdPZR|Jh^0rf81o`*xD{ zSbj?iMz^#ZoQz=ip6Y+8^q$~KbZ-q{S6{yzf8E_c9OURZoQC2ZK*FHz-)&6m+l zKM1fKa8++#R45G$C89-5(H_)+;5Y4VVz3%l7$nL*1z0A|4i>i6M~HN%5HY`%1ik8j zSj*{jO_>V{Gpkq+Ul2MuKP+W)Viy7($SZz(K6-Lff6H)`nB`$ItkcSm1}?(_-h{Bc zd~6&q{aUS^u$ngC9Y{*#LlXwhv~v)oTnSZQH@oltX&3cH979Wln+`KKN3#G94^IC>peXqS1FW$^*4N2 zRX+$mhTepe)Z67=0b|nQf!9&Xa(#cS?I1xxXa7xfj)Ov! zdHJV36jS7za+VTwl%T9(f_qZbyN?ev{Hs_tv0yWR50D#LRzT2$&)N3JeF0Jeh|iAi z^C6@Ua49*?w)O-2ntWb;!^**XuHey`=z$mb@UvⅆtId6&(h%zPA%;aUtWlt7h=$ zzkK+O9`q@H2D6in^3_d~YbfAW?o6FP_xT-Z88bbPXyOqs)G2%+33} zQK5fty`yW!>ZJZU+c8wkqCx1tA;05K2e+56*{>Cv5m`fsB%uYCx?Gn9ZQF^KqZf7J z;0%mMrP4CjSXJ@Ew7h$r5X-OPhVvtFl=4-OtOD+!cA@rf-J^NP0y-QrC?t!OBADUk zu9yYYbra@_if4`K!&ZX^7&6N5?zGT*9e;-(a$e-)VmKwz*a8%Nho4b1^lJX;y6oEP zc+YrC{s<|>He)_h2r)XXgg>%eS@Fsu{i2`U5B~Y{)lOUYN}&gGlAR`Bx{fs0O#-6b z(?6vlHQapI__#uvoF~!&|ES@s=ka&xV{np!QEwzRj!s>VaGh`OXuK8uzW+PkQmoDdOlsm z%N|a2hg;hv_cVKuR%L2SYAlnKWxA9Q`p9cMm=+e>Irp$#P?t+XO*a1=^al7CbafuA zu`CjU2t35$uNJtR(^`0)VxQ%gt=|2y!JPTiAiFK%7pLwQgJP2B{rhk6$>1VGD1BgJ zfF+>!G<@s63QQPEA0L0m#A0$F@p0${8s^};af^?y(wN7N5#;^rdwHfG;oA}97%i82 zrU4?A4n4y%&-f4L5f@*CCKEj!QAA(DS+W2}Q*Ta=3Tda_+jnYHS-8=B5u%;h{-NG6 zHNk!#_%7hY5Rz|PWqjTRKzY4F+HLRD=<`rlGa}K?`q+z8ZukYO1o2;3NaL!(azsw$ z!sm3gnC%k*WX_<%a(#MwjqfjRTl!vpy`jSMaXOa%bwXkC!2$kXA2F z-^nz(zqGyo|BhqJO?Dy+g(l9e1egDLPKfxXs1F!brU6!bye(6Xv$=R++TGEJ zb&NgjcKXEde!kkw6N8Ypt%CHUi>s^#Mj5^X-%JQeCK>K8YyC;c(1*cQ2F|B+B%VM7 zSNY}Z=ONp6+V6r#^%gc|y;fY_{CEPWMIzv03cF#L+VGx7a($l#@! z52sW6cF89G+^2F|D@=h^zK5Qn){45mU+^C|SiGz0KC$R$%FBuY961%4k7RDz{O zAQ9Yt`fl5yDY$;mVV5;68MIx~qsQvK?J0<2UvY@n<1%cK^=}(y0MZZIk|1+c=-T5N z|2DZH4J)VNict;xeg}FYJ1(^C%%uZ-#!Evi3R*)R%Tx|hhd8BD3rzc|8fkP`EUCG! zlo{5tFfEpZF`phUQZCN>TGjNIT;Pyz!f_36FeCR+vv95ldjn-(6${clvLnK=ouc7F zPrh*Al}U5_xwrmufWpg)E~@v7UVI5HJz=~CPkDc(SoCH+-J)e`^{*>lSqV)6lXNLV z76({&iRdwOakSvPESfZrns>P;L=LV70MXoUicsyu^Z}0(6Supil-T5l z_=+Tnyi007TbbfRyz2dl2A9e`x%F&}o4R;$Q~qT}{-aWaKU#Ha*QO0Ag^z&p?vl4X zRV9jFDe>l-)}*_m3eus?v$w8>?H}uxcY~M%*QSF@`clupDd>sPxTWvP7IG~^oaz}# zyFp2X*_MPTP&9cBAV1cgK?tO;!(mm8<_ETsZ2YV17_7%&cuJzD>!Rzmd2&7+7V#wOzzC(+ffrA4*f#yq=6I3jYyua+{z7 z=`VUU(|ET-S$F;-GXH8KBWH&wjinvZU4SKwL1v@X?t3S0 zr#*OMrSMsN&aXC&!CDWTR^n<^J8#vl8=*dKH5@-cCvTU?&{H-c^9YU0e4+ZyY0%&uSxTOKrEqCCN{l| z;vY$ika1UL2_d05zq&1H{?Y>|d0Z6rJ0SQ_slf&wT%AMB+hy=iwtIQW@Ah;2bUqrmX9Lq%+ASOn5in@d_tth~>pu+E_Ft z8=442io3P@^W%s71MK z#8vSWbmkt{7qFh;*EPl2+OF%Bx4uZa70LhAiPJ6G0adOB4yQcYWA&^n!Zi?FOZ*0T zjzl;+?JaWUH3^tiow6ph`eEXzjc0!S^APeZtwxED@%P1{)A@YhZ z+%8JxftOIeDKPf2)8ArEPM=R14IYel*`cn?*JGSoKXCDk?Ys;vN7?`M;5ebs!hay^ z`YOqo<`RN-ne|<|gH)Azn9*A{-;$OQEBi*Nkk*`XA)`W&?JwujL=iObJ&JTu{xbb@ z1_NfUmUKO~tpYdi63awtmcnU)MyrcZlzIPLqo+4Tc8tB2S99cG!Qu2vHe-RZ9XrY2 zDf~#2$Bal5*x)WNV;kvhNq_UY2l#420IdF`p{8?k*pm(ac;nq)hjhh~>$`#mEj8*{ zRYyGX*FdHBg;n>SHHc;#sv0{iCbeTc;r6b*z(M=+c)+SWTj$bW+d9p=k3@ufQE&z7kn?$dR z_Ld^uf+`2k2I4I^C^|v1AwdS`cKA73M8`QUrEeBcsUNz>TH_d6;P@czuVb}B>1Y+I z8UDhQs!ff5Xww3nz)~AKv4?TS#Lz&)Qb$!k$`bX?@eE$r6bm>n)=FPetZL5mj z3P}?6`y-j0<%?WTvqYq=WZ0;p=Q)=cXHFJQfPq?BD0BTh#<1n+tBPEJXVtIwk@5Od z^c>M@@mnfy)z(Ry|Eiz9D{mm~8#?n4cG*>(L170nmv=ZZrLb1tM zMzA{ys@lKDU7CvXOvMw<7Foh3CPAmaCD(uzE6!C@cJ6lo|; zW<%aT4Jd?bP63P3*(?8717B}{V{87mALyHlvcPik-<+rTS?i)sj#*8T99H?-ueuEF zD=Q*#Em|2$w7RXRKH5wivRFTUWY3jf-YyWD&wF7-)sT@VZb=7K?sX^H!*tM42?4r> z!Pmnc&3d~J)~u{Pfx(M)C}Hb?X?eYy>umy=Y2={=yZXuH6|j{Zy|K8B1b{T9u6=JB zv0>L+;Ml8#MNyrdo(Yr(9JCFzQ)30diTdM460l%`BpRe%MSDuptk&~JvLDfdR>%Bv z8=nUy3#BZ9tXin=)^iqG2tK}IB#KAP^2{WF#V#p7b6>F5ZU^1lytg|$* zQk-;q`OZmQn`>zYP_vIgLTiFBxyd)<&dj}I6mQQ7-k2i4=iHn>zNjwkKqJwu^opg| zeaoMy68mtEwQ{Ox?x^8mdH~Yh=*{-o)Pi(VOGt`~%+E8<--&~&sehLGWc;vThu>QE zbH<-jRD9!IYsW)$KJ2xL3hE@%UsU_sw%OI3Az`}-)z`&^e8g+LW`>1#7c!2{^7=ku z!xN<1^oa?1)J%*dr<|q(DQ|%BAS(xWBPROUiYg(V-U*Rs7;%!r&yusA_=vWdlYSXI zNz0WJ{Rw!Nf=TA(g9~!&NZm)M-X$G~0Ovdy+zvS1ny+UsUBP>U%Ye+#*XR1s?e2~Z z+G_5z_U-O44NEzm)<5;!4GD`R0J1=EcM{~cF#jmBd!o3@ehOGSP~X95lk;XeyA&|A z6)PiU)MYx3h21I^A-W#r#{qWguce46(Dx+dNE;10)o0`t`ba3KBfC!Z40!3zpo;Pb z0%erj(HFO=OPBA-7rlV=W9z7SsV2`?U+dc<%~MoXrF>3%O}63|slC2J2#x?J5!ur` zqE}Pw}%f6x$wAvZM-D+sK@6i@zGp=wo7pWa-lw zz{sX>Q=27F!f5N|^40nnBF%WM`fmJAJx|bfvKm#lzu5G;iefrN^+v9>aUj~QNz$3y z#epmMb)}1PEEbz^ZqY;V1K}k+t@Q2W1d5NY#Eu5h`mH3#w=8e2pYZPbhaIj5leS~^ zn<&OH^WvJ9F)4{f+wN?4@CmrUwOYX4^?)aKIMYx?xOj**_neKwNgBD5c+!W4YEy&E z23L6q;l~PW%w#u|0xZC`0vqGk`(H?{K%6Z32FwoY0l?5Co^@q63J2G5p6X}fM1X)u zod|N-IEPO_cs?}lFb4>j6p)8!5`>q${8z>R`6GT^{Cd9_?q!$%r7L`b#=nB*IW;~s zjs^SJMLEwI2%DCFd)}?+JWn`JwHu{yKcMpHIEwm>|6#sNxoAqycCG!|#Q}nG>;wDp zVCxlboY>8K9_&UHT6VC8i8?5h4~@gtmajXfAm@bGtwiH{whb#p)kN?xvi(W3>+F(k zow9ES4P72wpoDcfw?>Y9>|vWfaVo$va$P-m8cwtXwi7;q!8<t+Q%7t*!63AM)ZnbK zm2uEmRI@}6AIhSSX4!dil(M`VDSprzyq5NH%}8TW1Z4b81W9Bm+_8q5t%+0qPflQHVPU`Ov1xl zqEEt@{O&O=2kHZRM>pQPcr=Ti6l}~njF)glLUY=;*{M^OrR^l)VPn&^a+CtQ-emHY zn}$4|n?^-4k?$j&`J*G}`m2lO`My>xZ58Lf36Qld+GJH)+}RW3#7gpGO)|tn{8$a< z%nv`>nutiEp%SJh+!Wob#5$B>kxWGmRI+ywi+mXS9xyPyHkvsDgtlbvRv$X zU$z$mybw9IFl$%10wm-=GLa7kFo+-a&Ggu(aLC<6p^WgTuE|F33|65VU)LQu*M1JH zJsI0p4KWDaA#yxle>3_^FSakjuce;63oT^p(fPujLMV;Lute0v`?X|kb*rz_X154M?q0AoA0$2>=CzQ?aQQMjf%4!g z**9r^?3JIG8ltfKgtz|SH$}u;|5nQPfxD3O^7EG+JQ9!wk8!7e*03C+r+AF-@#C%9+d)ITlU zkxocZ#-#amS1&HRPfp1M6_%jM4l@m&FurYcB}Tj3b#e#MeYM<_>t578ye2d0am+&| zO~)m?h}kc^;8H1^)q+{SGBs8}{4U(K;zN!f0Wyk+qe#(xvKyl=yhRvK3|l+&IH=)3 zjISiFd(*=ATAr@?{%A3IqkBjSBWZRo(us*_KHe5^G~V7k((w}?j@ZPOEMsWK8jP%K zbFHP>5XGP8EFKj-I)#1YE#$m)WO}4wX`VW{*uE7MpY(HW1le-hGbP#(wSng(-%Zxz zx7jCj;q^}<0tx9ju4k;K3Q%=T3-rdE|DNpXiaD(k-yS`D^3~7-)~)hfBFE12s6p=^ z8(K#v+U0k%L@3SXL(864Z&vTDY~Q7T51((DVNL5Z++TX@dlch#!rI<;p}uu~K(~J{ z@8FV?a@0nuT*DgPk~4W*@V?id<{gIwX_k%s{*&x0okBABZO!}j_9;{P77+bfqG`j2 z{)t2&3*TOw$}>jaDV96G5yRv%R9w zC$<;N!yzdXzj}U-rpFgbKT3|e^^+E!<11YxBN4!hcNJAJ#@rWB-vPZT4^@2|YHl2b zCG!YLd9kyivcYm=Ve`67edy9!)rMXx;nkSl-ZbjS00{An1h&E~X(xB*T%hQ8xQV*o zi%;af1ju|D+aq6J|J~dOf%H&&QW$IVhH10p99E-MI!JF?2d|Cm%gSe?ZL{s2Q3gIbDbmf4?GJrJ%aC3= z$!6JhEc!IyA#3QDH{)hPw_I4iiE>Ar2*V zi?H-lBpTD^N35>&J23*wbz#4JzOiKM)rOCTx-5Z1dga*Ps`X5Q4dF`l^;?f*DFb@Q z@7SU2xlw5xlhzij;5>(aHgbYndw7sA8v+peL>>YKJt0twESQqB0yUz?tLLEn;SkkU z^!>aE%|3xW)D9X371QD=-YA!{AC(J+zUmNA_`%~!34wv94?k@7>$kJsajm>3#ycC% zSu05tU(X6~UHvWiO9S+`;4clJz+wti`>z!JucTh+O#3*%U~Bgw&n%hZjO-o|;``Y{ zx?;Cq)Cc@#NkH-W&aT_5M~J$iShadHFpMYi1V|f9AA@P@mqWISMo+INp)r@vUL}Gh z+xbS|x9uPZkT>uMz~q#U?B%qE-Y~XXw)FMie^3N%nQOB)mu-lOOxi&7Q9h=sG308# z*{wBmRw%&O!~G|Es9EODr10I7(mWD@E|+pXuOwdzIo9hejCRXUq&LiY+{-KiT4p^= z!gpmEzz_U{OuSk{2BqbjOo4Mr!lsynzRW3HH8#Ora?tgY?~y}(->bw$70o=~sJrI+ zbQYsOmjh0(4{jUqxMz8zwnPtjJ`L>&fVI0&Ml5l;YiCl;#L4O7Vy2Ubh_3J&=9BfF zokQzLj#G>K!iRQaKE&JwteG}RNu-}Zm&TpOG0~r~W}aZ{dkzsg}g?K{*b*JT3S4j%k0X60YskR(_MeNxy-U4*$C z9Kg@JcE`3+>!AH~Nw1}yw!(3UO|R0zaFu_3Oq(EndfC}bw4(Xjj(1V(GrbMQX340_ zw=+p$x)!4r%>h_*eN2Rvnnz?5dZyayN^&^1K@iNirwQa!cF%0il4n-=?k)Z6447#m zdNIib&GaTCLL~VNCP6aIkC$QN^^?LC8N7m(0qK}K!yn0CNcL>X4&hmv8jRLHkfMxX zj+)xuUeC(Kc#^j687v)tJlCdNS5YaIQ%}*S{xFDSL#NL;9J^w*QGlD9Xwuw-5rv3}yh8wv;1!uqlZ+>g`V#6OZ(#-CmPS`K|M_s*-Is^oh}m z9qYk`Lqz+ztqmx7#1tdZ!tc4xk!VINREPg&8a z202UXNj7AvKIAP%0x^VlhV}UnDQgx14LtbWBV|ub?icQ*#BGW=jQL+5h_cfcqTH*& zS7sJYs1+P}+UnPXwoh5!#CY@Yrec2%7L+|b2?I=3tgfa!MylbsHG3@Ff>NBVG70_W zpX$4Tw{#J9?4M!Ee0emsS@)vK8Vj=Uv&DcPd~~-veFpU~K-&~8) zm4FM#J!Emf!11mGY^|cMza;?(b`iSt!yycUNke7I*tMRBq58F) zo(N`5kfmvdyswu989Y$Yv9fQKui_NR-|Sy>d7B5Nl3CCF@PyzraNLVSzCSn`;gMyq zu~H&?fO*^fV!v2#efP<)vDmJlu-yjwZTrTFn>PuNd&k@;i>zb6cVP1!q;gl9CqJ!k zd0n={%pEi1u?9LH6J$m^Ru0_*`s1;UFk5clVcJv)L-n*YYt-h!6aSc8Q&v7<8jNXp zj+hu`ciM2R^65~QJGNkK=tIUa%!5@+lqSkM@JLa$Zve>}wf1&MBFJ|tFnRygaJ*IU zv6HIbhpHf9lc^y}3cj7;Jwo$jqX^05!&>(K2PNZP5mtdcC6`8rhMhX|_UnhlVq#kD zZ=`R(zX)5im!to-66zfl>RZ>c$2d(+(95{hrDlFsjDrIIq45Dm_+OyF6M11a9Qtr@qZVYAyP55ISFLsUwD%vxk=?(ZZ+l9L z4;fOzSMfAEK(1%e-m;G>s0 zb_1th@j_DV>hegI4tAzCD>EzZ8apo|0fJebgJ!7ztZfqSZ{|d2l?PmGFlbHo3Ru6_ zS6i7UmMl5YFHyeqwi5eU?NTdt)Bn(Z`{c+zQVoEMVF5hLx+SNRHL)AV8e4hWo}UdV ziNwB#YQ%3FXbY)TJI0JP5?xi;JUI$DL@%H?@QI*eYW%iMl*&@jn9@^cZD&!BPkHWk zeK(ykl}WzUc|UW5+jIkj-+$iRoAGxK_S0`fIXa6aGsK{tP4BSU9>}oany5e5CYQCt z?--25^&+D+ma~vtGyZT}_PBtEZN-ee9(htHj=q_6(b2f>eAb$ZO*+Y{_Yjtu4DKbal7B=G?k!x^%|;la0ubZ2ZENKwy24DBA%%x-a zq)EV**q?A9_(|_W`bPx*S_*P5;s0We5GKYK`EPJlcF^nrjv46H5%JPw-S1a*jDXO)Ry|Fw*O;-3}?D9W|*+vK(7 zL_MnW-c@aw9Gw_zlPA}hss_oe`;~oLi5oIA0kl%U`+-z+ZkCJ|*>%+xOJcCItIB(& zx2Gs@+{C&1x|(i9m=|=mS_8S&<~c`9p`x&&ZtvXHjGgRsppkv(O=AnTdE;R5XU;-6 zXALPV-AVoy1sIX1Gt}Ohc0DkCIAph)E(%))mCEAHscTpIG4;mHxO{etX;U0f)YvJB z^w%3K$YJ4e*BemH@ASQZ9MM}JXQ)&&nMxL5JsWR@DO635cN?NdKyT1%!&pmZmW`2p zZD~>C@u|UwyVz=4vTrp^s34|LhwS0Ztx!9ehF1!8qX+9z3iXGVU=l{F&UU7hG;T-< zy&vvXqw0i7z6D9nX=r7KV5YFie3Oj~4>EQf2Q!{)3(jek@i zAfmk^sO5-aBl3>v-*wLh~Ej89lRF!`~qquQ6Iz18aN zFN@!y%wv%a3DRxzH@5ocw_3VBKl0l29YgH;@Kla-xL?chxzZQal$PQ7j=H4&j6L)X z&mHCFyi6YL>u-4SGKe(_lli31y=vc4n?t}jZNWvLtJ;d}+w$T;b+@ocfB$4+pm^Gt zGgRHz@2wqs2dbv*WOQ79{NuFCygJn4P%`q;9f}UNIe0!MBT>Vor683GJ{eI@wri%# z-bAyUwxEY$q%w!h3CPk*RIl$eM03ur4KB(mKO-6XcTKe6l+6jpz8E#r|D zti7_aWN22C;KOS>79r+s8o(ELS*RMyF6V=B)=a$9IwA_6q@i$)Q&bo>a9s$IzjL%P zi*XM3@uymGt&IVAFJ>s>&+EoUy>T(q)o1h(#j!yss_pCKbXe)ZoCl*3Mv;Alw!A7p|D()kfBW2YkP*{l$Wd1RgUn_0pG@!M2A^d24@C0IBs z*0cD?<^qnGYO?n(7|rbEtCWpfIVQTf<~vu<7{tRON8^VWr4VKc4e6ruQ@-q}1^GC> z%kh>u*Op0(-W<|IH4h@rG)WV@V`XG&ieq2KB`Le-T&wz=4eR3D0rb0o&$Szg_X>o1yBl{P`U z=ljZ_Zhjw}@Lsj16eXkS^pV(`{IL-SZRxm*_qt)6pF$G-78+IkXvuI=HG$xsY{Ekm;ehYwSQ z+&JYM=UGH_nO}NJrG2Sv&9K{OoqSERQp17Y7Q;L}W1T|hYE6Ak*-vmE-8{QSTXoWJ z164Dw9EZ-hd^*Bze6FX*&Pc}`8YS-Cf9&qPTGvSY|*k6z7Y9I!B*og$@m?^_7 zGPXHf&w}^9Zf@<^sv+!;NvoO3F5QI+KLOu@yT&8}F$d8H-8y{}kv`o!iMoCw`8Q=) z(qAo34cnS3R*gB!wM?5d4zw?xQRv_RjjZi1NwVr(Ly)$uIi;YtHU$@x&h!;KB40N^ z+g}LFWmrar-^PamG$5c-KReNGnFA-1q1!+!p2;^&{IKM+GyK20?!TzUf68Ep>v&CS zxZOf=4N(Oe0#$$#UF{$9)0jNltLE1uG4)~==<@-S@ok92w zhp1ReHp{W8LgC%-v6z#6p=e;n4>7WjrnTvBFpQA(Yt}b1!**?V`^96 z;NhP{=jAnzf2b~P*7yoGFVA9#Ls8At!&uRiq{CAJ|AM{T*3fxgnocc4QweYXk^ZI& zIKwKSXl*AV%H|~Q*v04rCS|k~H0gRhTP}AX2>&F%rFZsoR%$egq+H}JYIa^(n}bpM zFKL#tcvJN02#eJ-a45nii^saE@l{|Cw~GIlLGiy8{52^4i@E=YrSV@I;r}omj+GF< zi%x&5RhyXu`g(jbC5#hifLsX)x`2lO09KY##}4!M54guBEj%TJPd5B~ZM``QfzQ1= L>WYQ(kDvcP9!^_T diff --git a/pep-0458.txt b/pep-0458.txt index a5067b51a..85707d762 100644 --- a/pep-0458.txt +++ b/pep-0458.txt @@ -4,7 +4,12 @@ Version: $Revision$ Last-Modified: $Date$ Author: Trishank Karthik Kuppusamy , Vladimir Diaz , - Donald Stufft , Justin Cappos + Lukas Puehringer , + Marina Moore , + Joshua Lock , + Lois Anne DeLong , + Donald Stufft , + Justin Cappos BDFL-Delegate: Donald Stufft Discussions-To: DistUtils mailing list Status: Draft @@ -16,39 +21,40 @@ Created: 27-Sep-2013 Abstract ======== -This PEP proposes how the Python Package Index (PyPI [1]_) should be integrated -with The Update Framework [2]_ (TUF). TUF was designed to be a flexible +This PEP proposes how The Update Framework [2]_ (TUF) should be integrated with the +Python Package Index (PyPI [1]_). TUF was designed to be a flexible security add-on to a software updater or package manager. The framework -integrates best security practices such as separating role responsibilities, +integrates best security practices, such as separating role responsibilities, adopting the many-man rule for signing packages, keeping signing keys offline, -and revocation of expired or compromised signing keys. For example, attackers -would have to steal multiple signing keys stored independently to compromise -a role responsible for specifying a repository's available files. Another role -responsible for indicating the latest snapshot of the repository may have to be -similarly compromised, and independent of the first compromised role. +and revocation of expired or compromised signing keys. As a result, attackers +would need to steal multiple signing keys, which are stored independently, +in order to compromise the role responsible for specifying a repository's available +files. Or, alternatively, a role +responsible for indicating the latest snapshot of the repository may also have to be +compromised. -The proposed integration will allow modern package managers such as pip [3]_ to -be more secure against various types of security attacks on PyPI and protect +The proposed integration will allow modern package managers, such as pip [3]_ to +be more secure against security attacks on PyPI, and to better protect users from such attacks. Specifically, this PEP describes how PyPI processes should be adapted to generate and incorporate TUF metadata (i.e., the minimum security model). The minimum security model supports verification of PyPI -distributions that are signed with keys stored on PyPI: distributions uploaded -by developers are signed by PyPI, require no action from developers (other than +distributions that are signed with keys stored on PyPI. Distributions that are +uploaded by developers are signed by PyPI, requiring no action from developers (other than uploading the distribution), and are immediately available for download. The minimum security model also minimizes PyPI administrative responsibilities by automating much of the signing process. -This PEP does not prescribe how package managers such as pip should be adapted +This PEP does not prescribe how package managers, such as pip, should be adapted to install or update projects from PyPI with TUF metadata. Package managers -interested in adopting TUF on the client side may consult TUF's `library -documentation`__, which exists for this purpose. Support for project -distributions that are signed by developers (maximum security model) is also -not discussed in this PEP, but is outlined in the appendix as a possible future -extension and covered in detail in PEP 480 [26]_. The PEP 480 extension -focuses on the maximum security model, which requires more PyPI administrative -work (none by clients), but it also proposes an easy-to-use key management -solution for developers, how to interface with a potential future build farm on -PyPI infrastructure, and discusses the feasibility of end-to-end signing. +interested in adopting TUF on the client side may consult its `library +documentation`__, which was created for this purpose. There is also no +discussion in this PEP of support for project distributions that are signed by +developers (maximum security model). This possible future extension is covered +in detail in PEP 480 [21]_. The maximum security model requires more PyPI +administrative work (though no added work for clients), but it also proposes +an easy-to-use key management solution for developers, ideas on how to interface +with a potential future build farm on PyPI infrastructure, and the feasibility +of end-to-end signing. __ https://github.com/theupdateframework/tuf/tree/v0.11.1/tuf/client#updaterpy @@ -59,50 +65,52 @@ PEP Status Due to the amount of work required to implement this PEP, in early 2019 it was deferred until appropriate funding could be secured to implement the PEP. The Python Software Foundation secured this funding -[27]_. +[22]_. Motivation ========== -In January 2013, the Python Software Foundation (PSF) announced [4]_ that the -python.org wikis for Python, Jython, and the PSF were subjected to a security -breach that caused all of the wiki data to be destroyed on January 5, 2013. -Fortunately, the PyPI infrastructure was not affected by this security breach. -However, the incident is a reminder that PyPI should take defensive steps to +On January 5, 2013, the Python Software Foundation (PSF) announced that [4]_ a security +breach had occurred on the +python.org wikis for Python and Jython. As a result, all of the wiki data was destroyed. +Fortunately, the PyPI infrastructure was not affected by this breach. +However, the incident is a reminder that PyPI needed to take defensive steps to protect users as much as possible in the event of a compromise. Attacks on software repositories happen all the time [5]_. The PSF must accept the possibility of security breaches and prepare PyPI accordingly because it is a valuable resource used by thousands, if not millions, of people. Before the wiki attack, PyPI used MD5 hashes to tell package managers, such as -pip, whether or not a package was corrupted in transit. However, the absence +pip, whether or not a distribution file was corrupted in transit. However, the absence of SSL made it hard for package managers to verify transport integrity to PyPI. It was therefore easy to launch a man-in-the-middle attack between pip and -PyPI, and change package content arbitrarily. Users could be tricked into -installing malicious packages with man-in-the-middle attacks. After the wiki +PyPI, and arbitrarily change the content of distributions. As a result, users could be tricked into +installing malicious distributions. After the wiki attack, several steps were proposed (some of which were implemented) to deliver -a much higher level of security than was previously the case: requiring SSL to +a much higher level of security than was previously the case. These steps included +requiring SSL to communicate with PyPI [6]_, restricting project names [7]_, and migrating from MD5 to SHA-2 hashes [8]_. -These steps, though necessary, are insufficient because attacks are still +Though necessary, these steps are insufficient to protect distributions because attacks are still possible through other avenues. For example, a public mirror is trusted to -honestly mirror PyPI, but some mirrors may misbehave due to malice or accident. +honestly mirror PyPI, but some mirrors may misbehave, whether by accident or through +malicious intervention. Package managers such as pip are supposed to use signatures from PyPI to verify -packages downloaded from a public mirror [9]_, but none are known to actually +distribution files downloaded from a public mirror [9]_, but none are known to actually do so [10]_. Therefore, it would be wise to add more security measures to detect attacks from public mirrors or content delivery networks [11]_ (CDNs). -Even though official mirrors are being deprecated on PyPI [12]_, there remain a -wide variety of other attack vectors on package managers [13]_. These attacks -can crash client systems, cause obsolete packages to be installed, or even +Even though official mirrors have been deprecated on PyPI [12]_, a +wide variety of other attack vectors on package managers remain [13]_. These attacks +can crash client systems, cause obsolete distributions to be installed, or even allow an attacker to execute arbitrary code. In `September 2013`__, a post was made to the Distutils mailing list showing that the latest version of pip (at the time) was susceptible to such attacks, and how TUF could protect users against them [14]_. Specifically, testing was done to see how pip would respond to these attacks with and without TUF. Attacks tested included replay -and freeze, arbitrary packages, slow retrieval, and endless data. The post +and freeze, arbitrary installation, slow retrieval, and endless data. The post also included a demonstration of how pip would respond if PyPI were compromised. @@ -110,9 +118,8 @@ __ https://mail.python.org/pipermail/distutils-sig/2013-September/022755.html With the intent to protect PyPI against infrastructure compromises, this PEP proposes integrating PyPI with The Update Framework [2]_ (TUF). TUF helps -secure new or existing software update systems. Software update systems are -vulnerable to many known attacks, including those that can result in clients -being compromised or crashed. TUF solves these problems by providing a flexible +secure new or existing software update systems that can result in clients +being compromised or crashed. It solves these problems by providing a flexible security framework that can be added to software updaters. @@ -128,10 +135,10 @@ The threat model assumes the following: * Attackers can respond to client requests. -An attacker is considered successful if they can cause a client to install (or -leave installed) something other than the most up-to-date version of the -software the client is updating. If the attacker is preventing the installation -of updates, they want clients to not realize there is anything wrong. +An attacker is considered successful if it can cause a client to install (or +leave installed) something other than the most up-to-date version of a +software distribution file. If the attacker is preventing the installation +of updates, they do not want clients to realize there is anything wrong. Definitions @@ -143,49 +150,46 @@ interpreted as described in RFC 2119__. __ http://www.ietf.org/rfc/rfc2119.txt -This PEP focuses on integrating TUF with PyPI; however, the reader is -encouraged to read about TUF's design principles [2]_. It is also RECOMMENDED -that the reader be familiar with the TUF specification [16]_. +This PEP focuses only on integrating TUF into PyPI. However, the reader is +encouraged to review TUF design principles [2]_ and SHOULD be +familiar with the TUF specification [16]_. -Terms used in this PEP are defined as follows: +The following terms used in this PEP are defined in the Python Packaging +Glossary [17]_: *project*, *release*, *distribution*. -* Projects: Projects are software components that are made available for - integration. Projects include Python libraries, frameworks, scripts, - plugins, applications, collections of data or other resources, and various - combinations thereof. Public Python projects are typically registered on the - Python Package Index [17]_. +Additional terms used in this PEP are defined as follows: -* Releases: Releases are uniquely identified snapshots of a project [17]_. +* Role: TUF specifies one *root* role and multiple other roles to which the + *root* role delegates responsibilities, directly or indirectly. The term + *top-level* role refers to the *root* role and any role specified directly by + the *root* role, i.e. *timestamp*, *snapshot* and *targets* roles. Each role + has a single metadata file that it is trusted to provide. -* Distributions: Distributions are the packaged files that are used to publish - and distribute a release [17]_. +* Distribution file: A versioned archive file that contains Python packages, + modules, and other resource files that are used to distribute a release. The + terms *distribution file*, *distribution package* [17]_, or simply + *distribution* or *package* may be used interchangeably in this PEP. -* Simple index: The HTML page that contains internal links to the - distributions of a project [17]_. +* Simple index: The HTML page that contains internal links to distribution + files. -* Roles: There is one *root* role in PyPI. There are multiple roles whose - responsibilities are delegated to them directly or indirectly by the *root* - role. The term top-level role refers to the *root* role and any role - delegated by the *root* role. Each role has a single metadata file that it is - trusted to provide. +* Target files: As a rule of thumb, target files are all files on PyPI whose + integrity should be guaranteed with TUF. Typically, this includes + distribution files and PyPI metadata, such as simple indices. * Metadata: Metadata are signed files that describe roles, other metadata, and - target files. + target files. If not specified otherwise metadata means TUF-specific + metadata. -* Repository: A repository is a resource comprised of named metadata and target +* Repository: A repository is a source for named metadata and target files. Clients request metadata and target files stored on a repository. -* Consistent snapshot: A set of TUF metadata and PyPI targets that capture the +* Consistent snapshot: A set of TUF metadata and target files that capture the complete state of all projects on PyPI as they existed at some fixed point in time. -* The *snapshot* (*release*) role: In order to prevent confusion due to the - different meanings of the term "release" used in PEP 426 [17]_ and the TUF - specification [16]_, the *release* role is renamed as the *snapshot* role. - * Developer: Either the owner or maintainer of a project who is allowed to - update the TUF metadata as well as distribution metadata and files for the - project. + update the TUF metadata, as well as target files for a project. * Online key: A private cryptographic key that MUST be stored on the PyPI server infrastructure. This is usually to allow automated signing with the @@ -207,13 +211,13 @@ Terms used in this PEP are defined as follows: Overview of TUF =============== -At its highest level, TUF provides applications with a secure method of -obtaining files and knowing when new versions of files are available. On the +At its highest level, TUF provides applications with a secure method for +knowing about and obtaining new versions of files. On the surface, this all sounds simple. The basic steps for updating applications are: -* Knowing when an update exists. +* Knowing an update exists. -* Downloading a correct copy of the latest version of an updated file. +* Downloading a correct copy of the latest version of the updated file. The problem is that updating applications is only simple when there are no malicious activities in the picture. If an attacker is trying to interfere with @@ -224,7 +228,7 @@ that try to be secure). It downloads both the file it wants and a cryptographic signature of the file. The software updater already knows which key it trusts to make the signature. It checks that the signature is correct and was made by this trusted key. Unfortunately, the software updater is still at risk in many -ways, including: +ways, including the following scenarios: * An attacker keeps giving the software updater the same update file, so it never realizes there is an update. @@ -233,8 +237,8 @@ ways, including: that it already has, so it downloads that one and blindly uses it thinking it is newer. -* An attacker gives the software updater a newer version of a file it has but - it is not the newest one. The file is newer to the software updater, but it +* An attacker gives the software updater a newer version of a file, but + not the newest one. The file is newer to the software updater, but it may be insecure and exploitable by the attacker. * An attacker compromises the key used to sign these files and now the software @@ -246,31 +250,48 @@ referencing the metadata files during the update procedure. Repository files are verified against the information included in the metadata before they are handed off to the software update system. The framework also provides multi-signature trust, explicit and implicit revocation of cryptographic keys, -responsibility separation of the metadata, and minimizes key risk. For a full +responsibility separation of the metadata, and minimized key risk. For a full list and outline of the repository attacks and software updater weaknesses addressed by TUF, see Appendix A. -Integrating TUF with PyPI +Integrating PyPI with TUF ========================= A software update system must complete two main tasks to integrate with TUF. -First, it must add the framework to the client side of the update system. For -example, TUF MAY be integrated with the pip package manager. Second, the -repository on the server side MUST be modified to provide signed TUF metadata. -This PEP is concerned with the second part of the integration, and the changes -required on PyPI to support software updates with TUF. +First, it must add the framework to the client side of the update system. For +example, TUF MAY be integrated with the pip package manager. Thus, new versions +of pip going forward SHOULD use TUF by default to download and verify distributions +from PyPI before installing them. However, there may be unforeseen issues that +might prevent users from installing or updating distributions, including pip itself, +via TUF. Therefore, pip SHOULD provide an option e.g., +`--unsafely-disable-package-verification`, in order to work around such issues +until they are resolved. Note, the proposed option name is purposefully long, +because a user must be helped to understand that the action is unsafe and not +generally recommended. + +Second, the repository on the server side MUST be modified to provide signed +TUF metadata. This PEP is concerned with the second part of the integration, +and the changes on PyPI required to support software updates with TUF. +We assume that pip would use TUF to verify distributions downloaded only from PyPI. +pip MAY support TAP 4__ in order use TUF to also verify distributions downloaded +from elsewhere__. + +__ https://github.com/theupdateframework/taps/blob/master/tap4.md +__ https://www.python.org/dev/peps/pep-0470/ + What Additional Repository Files are Required on PyPI? ------------------------------------------------------ -In order for package managers like pip to download and verify packages with -TUF, a few extra files MUST exist on PyPI. These extra repository files are -called TUF metadata. TUF metadata contains information such as which keys are -trustable, the cryptographic hashes of files, signatures to the metadata, -metadata version numbers, and the date after which the metadata should be -considered expired. +In order for package managers like pip to download and verify distributions with +TUF, a few extra files MUST be added to PyPI. These extra repository files are +called TUF metadata, and they contain such information as which keys can be trusted, +the `cryptographic hashes`__ of files, signatures, metadata version numbers, and +the date after which the metadata should be considered expired. + +__ https://en.wikipedia.org/wiki/Cryptographic_hash_function When a package manager wants to check for updates, it asks TUF to do the work. That is, a package manager never has to deal with this additional metadata or @@ -280,38 +301,107 @@ from PyPI. TUF downloads them and checks them against the TUF metadata that it also downloads from the repository. If the downloaded target files are trustworthy, TUF then hands them over to the package manager. -The `Metadata`__ document provides information about each of the required -metadata and their expected content. The next section covers the different +The `Metadata`__ document provides information about each type of required +metadata and its expected content. The next section covers the different kinds of metadata RECOMMENDED for PyPI. __ https://github.com/theupdateframework/tuf/blob/v0.11.1/docs/METADATA.md +In addition, all target files SHOULD be available on disk at least two times. +Once under their original filename, to provide backwards compatibility, and +once with their SHA-512 hash included in their +filename. This is required to produce `Consistent Snapshots`_. + +Depending on the used file system different data deduplication mechanisms MAY +be employed to avoid storage increase from hard copies of target files. + PyPI and TUF Metadata ===================== TUF metadata provides information that clients can use to make update -decisions. For example, a *targets* metadata lists the available distributions -on PyPI and includes the distribution's signatures, cryptographic hashes, and -file sizes. Different metadata files provide different information. The -various metadata files are signed by different roles, which are indicated by -the *root* role. The concept of roles allows TUF to delegate responsibilities -to multiple roles and minimizes the impact of a compromised role. +decisions. For example, a *targets* metadata lists the available target files +on PyPI and includes the required signatures, cryptographic hash, and +file sizes for each. Different metadata files provide different information, which are +signed by separate roles. The *root* role indicates what metadata belongs to +each role. The concept of roles allows TUF to delegate responsibilities +to multiple roles, thus minimizing the impact of any one compromised role. TUF requires four top-level roles. These are *root*, *timestamp*, *snapshot*, and *targets*. The *root* role specifies the public cryptographic keys of the top-level roles (including its own). The *timestamp* role references the latest *snapshot* and can signify when a new snapshot of the repository is available. The *snapshot* role indicates the latest version of all the TUF -metadata files (other than *timestamp*). The *targets* role lists the -available target files (in our case, it will be all files on PyPI under the -/simple and /packages directories). Each top-level role will serve its -responsibilities without exception. Figure 1 provides a table of the roles -used in TUF. +metadata files (other than *timestamp*). The *targets* role lists the file +paths of available target files together with their cryptographic hashes. +The file paths must be specified relative to a base URL. This allows the +actual target files to be served from anywhere, as long as the base URL +can be accessed by the client. Each top-level role will serve its +responsibilities without exception. Table 1 provides an overview of the +roles used in TUF. -.. image:: pep-0458-1.png ++-----------------------------------------------------------------------------+ +| Roles and Responsibilities | ++-----------------+-----------------------------------------------------------+ +| root | The root roles is the locus of trust for the entire | +| | repository. The root role signs the root.json metadata | +| | file. This file indicates which keys are authorized for | +| | each of the top-level roles, including for the root role | +| | itself. The roles "root", "snapshot", "timestamp" and | +| | "targets" must be specified and each has a list of public | +| | keys. | ++-----------------+-----------------------------------------------------------+ +| targets | The targets role is responsible for indicating which | +| | target files are available from the repository. More | +| | precisely, it shares the responsibility of providing | +| | information about the content of updates. The targets | +| | role signs targets.json metadata, and can delegate trust | +| | for repository files to other roles (delegated roles). | ++-----------------+-----------------------------------------------------------+ +| delegated roles | If the top-level targets role performs delegation, the | +| | resulting delegated roles can then provide their own | +| | metadata files. The format of the metadata files provided | +| | by delegated targets roles is the same as that of | +| | targets.json. As with targets.json, the latest version of | +| | metadata files belonging to delegated roles are described | +| | in the snapshot role's metadata. | ++-----------------+-----------------------------------------------------------+ +| snapshot | The snapshot role is responsible for ensuring that | +| | clients see a consistent repository state. It provides | +| | repository state information by indicating the latest | +| | versions of the top-level targets and delegated targets | +| | metadata files on the repository in snapshot.json. root | +| | and timestamp are not listed in snapshot.json, because | +| | timestamp signs for its freshness, after snapshot.json | +| | has been created, and root, which has all top-level keys, | +| | is required ahead of time to trust any of the top-level | +| | roles. | ++-----------------+-----------------------------------------------------------+ +| timestamp | The timestamp role is responsible for providing | +| | information about the timeliness of available updates. | +| | Timeliness information is made available by frequently | +| | signing a new timestamp.json file that has a short | +| | expiration time. This file indicates the latest version | +| | of snapshot.json. | ++-----------------+-----------------------------------------------------------+ -Figure 1: An overview of the TUF roles. +Table 1: An overview of the TUF roles. + +Unless otherwise specified, this PEP RECOMMENDS that every metadata or +target file be hashed using the SHA2-512 function of +the `SHA-2`__ family. SHA-2 has native and well-tested Python 2 and 3 +support (allowing for verification of these hashes without additional, +non-Python dependencies). If stronger security guarantees are +required, then both SHA2-256 and SHA2-512 or both SHA2-256 and `SHA3-256`__ +MAY be used instead. SHA2-256 and SHA3-256 +are based on very different designs from each other, providing extra protection +against `collision attacks`__. However, SHA-3 +requires installing additional, non-Python dependencies for `Python 2`__. + +__ https://en.wikipedia.org/wiki/SHA-2 +__ https://en.wikipedia.org/wiki/SHA-3 +__ https://en.wikipedia.org/wiki/Collision_attack +__ https://pip.pypa.io/en/latest/development/release-process/#python-2-support Signing Metadata and Repository Management @@ -320,100 +410,122 @@ Signing Metadata and Repository Management The top-level *root* role signs for the keys of the top-level *timestamp*, *snapshot*, *targets*, and *root* roles. The *timestamp* role signs for every new snapshot of the repository metadata. The *snapshot* role signs for *root*, -*targets*, and all delegated roles. The *bins* roles (delegated roles) sign -for all distributions belonging to registered PyPI projects. +*targets*, and all delegated targets roles. The delegated targets role *bins* +further delegates to the *bin-n* roles, which sign for all distribution files +belonging to registered PyPI projects. -Figure 2 provides an overview of the roles available within PyPI, which -includes the top-level roles and the roles delegated by *targets*. The figure -also indicates the types of keys used to sign each role and which roles are +Figure 1 provides an overview of the roles available within PyPI, which +includes the top-level roles and the roles delegated to by *targets*. The figure +also indicates the types of keys used to sign each role, and which roles are trusted to sign for files available on PyPI. The next two sections cover the details of signing repository files and the types of keys used for each role. -.. image:: pep-0458-2.png +.. image:: pep-0458-1.png -Figure 2: An overview of the role metadata available on PyPI. +Figure 1: An overview of the role metadata available on PyPI. -The roles that change most frequently are *timestamp*, *snapshot* and delegated -roles (*bins* and its delegated roles). The *timestamp* and *snapshot* +The roles that change most frequently are *timestamp*, *snapshot* and roles +delegated to by *bins* (i.e., *bin-n*). The *timestamp* and *snapshot* metadata MUST be updated whenever *root*, *targets* or delegated metadata are updated. Observe, though, that *root* and *targets* metadata are much less -likely to be updated as often as delegated metadata. Therefore, *timestamp* -and *snapshot* metadata will most likely be updated frequently (possibly every +likely to be updated as often as delegated metadata. Similarly, the *bins* role +will only be updated when a *bin-n* role is added, updated, or removed. Therefore, *timestamp*, +*snapshot*, and *bin-n* metadata will most likely be updated frequently (possibly every minute) due to delegated metadata being updated frequently in order to support continuous delivery of projects. Continuous delivery is a set of processes -that PyPI uses produce snapshots that can safely coexist and be deleted +that PyPI uses to produce snapshots that can safely coexist and be deleted independent of other snapshots [18]_. Every year, PyPI administrators SHOULD sign for *root* and *targets* role keys. -Automation will continuously sign for a timestamped, snapshot of all projects. +Automation will continuously sign for a timestamped snapshot of all projects. A `repository management`__ tool is available that can sign metadata files, generate cryptographic keys, and manage a TUF repository. __ https://github.com/theupdateframework/tuf/blob/v0.11.1/docs/TUTORIAL.md#how-to-create-and-modify-a-tuf-repository +In standard operation, the *bin-n* metadata will be updated and signed as new +distributions are uploaded to PyPI. However, there will also need to be a +one-time online initialization mechanism to create and sign *bin-n* metadata for +all existing distributions that are part of the PyPI repository every time PyPI +is re-initialized. + How to Establish Initial Trust in the PyPI Root Keys ---------------------------------------------------- -Package managers like pip need to ship a file called "root.json" with the +Package managers like pip MUST ship the *root* metadata file with the installation files that users initially download. This includes information -about the keys trusted for certain roles, as well as the root keys themselves. -Any new version of "root.json" that clients may download are verified against -the root keys that client's initially trust. If a root key is compromised, but -a threshold of keys are still secured, the PyPI administrator MUST push a new -release that revokes trust in the compromised keys. If a threshold of root keys -are compromised, then "root.json" should be updated out-of-band, however the -threshold should be chosen so that this is extremely unlikely. The TUF client -library does not require manual intervention if root keys are revoked or added: -the update process handles the cases where "root.json" has changed. +about the keys trusted for all top-level roles (including the root keys themselves). +Package managers must also bundle a TUF client library. Any new version of *root* +metadata that the TUF client library may download is verified against the root keys +initially bundled with the package manager. If a root key is compromised, +but a threshold of keys are still secured, then PyPI administrators MUST push new +*root* metadata that revokes trust in the compromised keys. If a threshold of root +keys are compromised, then the *root* metadata MUST be updated out-of-band. +(However, the threshold of root keys should be chosen so that this event is extremely +unlikely.) Package managers do not necessarily need to be updated immediately if root +keys are revoked or added between new releases of the package manager, as the TUF update +process automatically handles cases where a threshold of previous *root* keys sign +for new *root* keys (assuming no backwards-incompatibility in the TUF specification +used). So, for example, if a package manager was initially shipped with version 1 of +the *root* metadata, and a threshold of *root* keys in version 1 signed version 2 of +the *root metadata*, and a threshold of *root* keys in version 2 signed version 3 of +the *root metadata, then the package manager should be able to transparently update +its copy of the *root* metadata from version 1 to 3 using its TUF client library. -To bundle the software, "root.json" MUST be included in the version of pip -shipped with CPython (via ensurepip). The TUF client library then loads the -root metadata and downloads the rest of the roles, including updating -"root.json" if it has changed. An `outline of the update process`__ is -available. +Thus, to repeat, the latest good copy of *root* metadata and a TUF client library MUST +be included in any new version of pip shipped with CPython (via ensurepip). The TUF +client library inside the package manager then loads the *root* metadata and downloads +the rest of the roles, including updating the *root* metadata if it has changed. +An `outline of the update process`__ is available. -__ https://github.com/theupdateframework/tuf/tree/develop/tuf/client#overview-of-the-update-process. +__ https://github.com/theupdateframework/specification/blob/master/tuf-spec.md#5-detailed-workflows Minimum Security Model ---------------------- -There are two security models to consider when integrating TUF with PyPI. The +There are two security models to consider when integrating TUF into PyPI. The one proposed in this PEP is the minimum security model, which supports -verification of PyPI distributions that are signed with private cryptographic +verification of PyPI distributions signed with private cryptographic keys stored on PyPI. Distributions uploaded by developers are signed by PyPI and immediately available for download. A possible future extension to this -PEP, discussed in Appendix B, proposes the maximum security model and allows a -developer to sign for his/her project. Developer keys are not stored online: +PEP, discussed in PEP 480 [21]_, proposes the maximum security model and allows +a developer to sign for his/her project. Developer keys are not stored online: therefore, projects are safe from PyPI compromises. The minimum security model requires no action from a developer and protects against malicious CDNs [19]_ and public mirrors. To support continuous -delivery of uploaded packages, PyPI signs for projects with an online key. +delivery of uploaded distributions, PyPI signs for projects with an online key. This level of security prevents projects from being accidentally or -deliberately tampered with by a mirror or a CDN because the mirror or CDN will -not have any of the keys required to sign for projects. However, it does not -protect projects from attackers who have compromised PyPI, since attackers can -manipulate TUF metadata using the keys stored online. +deliberately tampered with by a mirror or a CDN because neither will +have any of the keys required to sign for projects. However, it does not +protect projects from attackers who have compromised PyPI, since they can +then manipulate TUF metadata using the keys stored online. -This PEP proposes that the *bins* role (and its delegated roles) sign for all -PyPI projects with an online key. The *targets* role, which only signs with an -offline key, MUST delegate all PyPI projects to the *bins* role. This means -that when a package manager such as pip (i.e., using TUF) downloads a -distribution from a project on PyPI, it will consult the *bins* role about the -TUF metadata for the project. If no bin roles delegated by *bins* specify the -project's distribution, then the project is considered to be non-existent on -PyPI. +This PEP proposes that the *bin-n* roles sign for all PyPI projects with online +keys. These *bin-n* roles MUST all be delegated by the upper-level *bins* role, +which is signed with an offline key, and in turn MUST be delegated by the +top-level *targets* role, which is also signed with an offline key. +This means that when a package manager such as pip (i.e., using TUF) downloads +a distribution file from a project on PyPI, it will consult the *targets* role about +the TUF metadata for that distribution file. If ultimately no *bin-n* roles +delegated by *targets* via *bins* specify the distribution file, then it is +considered to be non-existent on PyPI. + +Note, the reason why *targets* does not directly delegate to *bin-n*, but +instead uses the intermediary *bins* role, is so that other delegations can +easily be added or removed, without affecting the *bins*-to-*bin-n* mapping. +This is crucial for the implementation of PEP 480 [21]_. Metadata Expiry Times --------------------- -The *root* and *targets* role metadata SHOULD expire in one year, because these +The metadata for the *root*, *targets*, and *bins* roles SHOULD each expire in one year, because these two metadata files are expected to change very rarely. -The *timestamp*, *snapshot*, and *bins* metadata SHOULD expire in one day +The *timestamp*, *snapshot*, and *bin-n* metadata SHOULD each expire in one day because a CDN or mirror SHOULD synchronize itself with PyPI every day. Furthermore, this generous time frame also takes into account client clocks that are highly skewed or adrift. @@ -422,12 +534,12 @@ that are highly skewed or adrift. Metadata Scalability -------------------- -Due to the growing number of projects and distributions, TUF metadata will also +As the number of projects and distributions on a repository grows, TUF metadata will need to grow correspondingly. For example, consider the *bins* role. In August 2013, it was found that the size of the *bins* metadata was about 42MB if the *bins* role itself signed for about 220K PyPI targets (which are simple indices and distributions). This PEP does not delve into the details, but TUF features a -so-called "`lazy bin walk`__" scheme that splits a large targets' metadata file +so-called "`lazy bin walk`__" scheme that splits a large targets metadata file into many small ones. This allows a TUF client updater to intelligently download only a small number of TUF metadata files in order to update any project signed for by the *bins* role. For example, applying this scheme to @@ -436,21 +548,128 @@ install or upgrade a PyPI project via TUF. __ https://github.com/theupdateframework/tuf/blob/v0.11.1/docs/TUTORIAL.md#delegate-to-hashed-bins -Based on our findings as of the time of writing, PyPI SHOULD split all targets -in the *bins* role by delegating them to 1024 delegated roles, each of which -would sign for PyPI targets whose hashes fall into that "bin" or delegated role -(see Figure 2). It was found that 1024 bins would result in the *bins* -metadata, and each of its delegated roles, being about the same size (40-50KB) -for about 220K PyPI targets (simple indices and distributions). +Based on our findings as of the time this document was updated for +implementation (Nov 7 2019), summarized in Tables 2-3, PyPI SHOULD +split all targets in the *bins* role by delegating them to 16,384 +*bin-n* roles (see C10 in Table 2). Each *bin-n* role would sign +for the PyPI targets whose SHA2-512 hashes fall into that bin +(see and Figure 2 and `Consistent Snapshots`_). It was found +that this number of bins would result in a 5-9% metadata overhead +(relative to the average size of downloaded distribution files; see V13 and +V15 in Table 3) for returning users, and a 69% overhead for new +users who are installing pip for the first time (see V17 in Table 3). + + +A few assumptions used in calculating these metadata overhead percentages: + +1. We are ignoring root, timestamp, and top-level targets metadata. +2. pip will always be bundled with the latest good copy of metadata for all + roles. + ++------+--------------------------------------------------+-----------+ +| Name | Description | Value | ++------+--------------------------------------------------+-----------+ +| C1 | # of bytes in a SHA2-512 hexadecimal digest | 128 | ++------+--------------------------------------------------+-----------+ +| C2 | # of bytes for a SHA2-512 public key ID | 64 | ++------+--------------------------------------------------+-----------+ +| C3 | # of bytes for an Ed25519 signature | 128 | ++------+--------------------------------------------------+-----------+ +| C4 | # of bytes for an Ed25519 public key | 64 | ++------+--------------------------------------------------+-----------+ +| C5 | # of bytes for a target relative file path | 256 | ++------+--------------------------------------------------+-----------+ +| C6 | # of bytes to encode a target file size | 7 | ++------+--------------------------------------------------+-----------+ +| C7 | # of bytes to encode a version number | 6 | ++------+--------------------------------------------------+-----------+ +| C8 | # of targets (simple indices and distributions) | 2,273,539 | ++------+--------------------------------------------------+-----------+ +| C9 | Average # of bytes for a downloaded distribution | 2,184,393 | ++------+--------------------------------------------------+-----------+ +| C10 | # of bins | 16,384 | ++------+--------------------------------------------------+-----------+ + +C8 was computed by querying the number of release files. +C9 was derived by taking the average between a rough estimate of the average +size of release files *downloaded* over the past 31 days (1,628,321 bytes), +and the average size of releases files on disk (2,740,465 bytes). +Ernest W. Durbin III helped to provide these numbers on November 7, 2019. + +Table 2: A list of constants used to calculate metadata overhead. + ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| Name | Description | Formula | Value | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V1 | Length of a path hash prefix | math.ceil(math.log(C10, 16)) | 4 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V2 | Total # of path hash prefixes | 16**V1 | 65,536 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V3 | Avg # of targets per bin | math.ceil(C8/C10) | 139 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V4 | Avg size of SHA-512 hashes per bin | V3*C1 | 17,792 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V5 | Avg size of target paths per bin | V3*C5 | 35,584 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V6 | Avg size of lengths per bin | V3*C6 | 973 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V7 | Avg size of bin-n metadata (bytes) | V4+V5+V6 | 54,349 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V8 | Total size of public key IDs in bins | C10*C2 | 1,048,576 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V9 | Total size of path hash prefixes in bins | V1*V2 | 262,144 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V10 | Est. size of bins metadata (bytes) | V8+V9 | 1,310,720 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V11 | Est. size of snapshot metadata (bytes) | C10*C7 | 98,304 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V12 | Est. size of metadata overhead per distribution per returning user (same snapshot) | 2*V7 | 108,698 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V13 | Est. metadata overhead per distribution per returning user (same snapshot) | round((V12/C9)*100) | 5% | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V14 | Est. size of metadata overhead per distribution per returning user (diff snapshot) | V12+V11 | 207,002 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V15 | Est. metadata overhead per distribution per returning user (diff snapshot) | round((V14/C9)*100) | 9% | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V16 | Est. size of metadata overhead per distribution per new user | V14+V10 | 1,517,722 | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ +| V17 | Est. metadata overhead per distribution per new user | round((V16/C9)*100) | 69% | ++------+------------------------------------------------------------------------------------+------------------------------+-----------+ + +Table 3: Estimated metadata overheads for new and returning users. + +The interested reader may find an interactive version of the metadata overhead +calculator here__: + +__ https://docs.google.com/spreadsheets/d/11_XkeHrf4GdhMYVqpYWsug6JNz5ZK6HvvmDZX0__K2I/edit?usp=sharing + +This number of bins SHOULD increase when the metadata overhead for returning +users exceeds 50%. Presently, this SHOULD happen when the number of targets +increase at least 10x from over 2M to over 22M, at which point the metadata +overhead for returning and new users would be around 50-54% and 114% +respectively, assuming that the number of bins stay fixed. If the number of +bins is increased, then the cost for all users would effectively be the cost +for new users, because their cost would be dominated by the (once-in-a-while) +cost of downloading the large number of delegations in the `bins` metadata. +If the cost for new users should prove to be too much, primarily due to the +overhead of downloading the `bins` metadata, then this subject SHOULD be +revisited before that happens. + +Note that changes to the number of bins on the server are transparent to the +client. The package manager will be required to download a fresh set of +metadata, as though it were a new user, but this operation will not require any +explicit code logic or user interaction in order to do so. It is possible to make TUF metadata more compact by representing it in a binary -format as opposed to the JSON text format. Nevertheless, a sufficiently large +format, as opposed to the JSON text format. Nevertheless, a sufficiently large number of projects and distributions will introduce scalability challenges at some point, and therefore the *bins* role will still need delegations (as -outlined in figure 2) in order to address the problem. Furthermore, the JSON -format is an open and well-known standard for data interchange. Due to the -large number of delegated metadata, compressed versions of *snapshot* metadata -SHOULD also be made available to clients. +outlined in Figure 1) in order to address the problem. The JSON format is an +open and well-known standard for data interchange, which is already supported by +the TUF reference implementation, and therefore the recommended data format by +this PEP. However, due to the large number of delegations, compressed +versions of all metadata SHOULD also be made available to clients via the +existing Warehouse mechanisms for HTTP compression. PyPI and Key Requirements @@ -458,31 +677,15 @@ PyPI and Key Requirements In this section, the kinds of keys required to sign for TUF roles on PyPI are examined. TUF is agnostic with respect to choices of digital signature -algorithms. For the purpose of discussion, it is assumed that most digital -signatures will be produced with the well-tested and tried RSA algorithm [20]_. -Nevertheless, we do NOT recommend any particular digital signature algorithm in -this PEP because there are a few important constraints: first, cryptography -changes over time; second, package managers such as pip may wish to perform -signature verification in Python, without resorting to a compiled C library, in -order to be able to run on as many systems as Python supports; and third, TUF -recommends diversity of keys for certain applications. +algorithms. However, this PEP RECOMMENDS that all digital signatures be +produced with the Ed25519 algorithm [15]_. Ed25519 has native and +well-tested Python support (allowing for verification of signatures without +additional, non-Python dependencies), uses small keys, and is supported +by modern HSM and authentication token hardware. -Number Of Keys Recommended --------------------------- - -The *timestamp*, *snapshot*, and *bins* roles require continuous delivery. -Even though their respective keys MUST be online, this PEP requires that the -keys be independent of each other. Different keys for online roles allow for -each of the keys to be placed on separate servers if need be, and prevents side -channel attacks that compromise one key from automatically compromising the -rest of the keys. Therefore, each of the *timestamp*, *snapshot*, and *bins* -roles MUST require (1, 1) keys. - -The *bins* role MAY delegate targets in an automated manner to a number of -roles called "bins", as discussed in the previous section. Each of the "bin" -roles SHOULD share the same key as the *bins* role, due to space efficiency, -and because there is no security advantage to requiring separate keys. +Number and Type Of Keys Recommended +----------------------------------- The *root* role key is critical for security and should very rarely be used. It is primarily used for key revocation, and it is the locus of trust for all @@ -504,21 +707,119 @@ MUST be offline and independent of other keys. For simplicity of key management, without sacrificing security, it is RECOMMENDED that the keys of the *targets* role be permanently discarded as soon as they have been created and used to sign for the role. Therefore, the *targets* role SHOULD require -(1, 1) keys. Again, this is because the keys are going to be permanently -discarded and more offline keys will not help resist key recovery attacks [21]_ -unless diversity of keys is maintained. +(2, 2) keys. Again, this is because the keys are going to be permanently +discarded, and more offline keys will not help resist key recovery +attacks [20]_ unless the diversity of cryptographic algorithms is maintained. + +For similar reasons, the keys for the *bins* role SHOULD be set up similar to +the keys for the *targets* role. + +In order to support continuous delivery, the keys for the *timestamp*, +*snapshot*, and all *bin-n* roles MUST be online. There is little benefit in +requiring all of these roles to use different online keys, since attackers +would presumably be able to compromise all of them if they compromise PyPI. +Therefore, it is reasonable to use one online key for all of them. -Online and Offline Keys Recommended for Each Role -------------------------------------------------- +Managing online keys +--------------------- -In order to support continuous delivery, the *timestamp*, *snapshot*, *bins* -role keys MUST be online. +The online key shared by the *timestamp*, *snapshot*, and all *bin-n* roles +MAY be stored, encrypted or not, on the Python infrastructure. For example, +the key MAY be kept on a self-hosted key management service (e.g. Hashicorp +Vault__), or a third-party one (e.g. AWS KMS__, Google Cloud KMS__, or Azure +Key Vault__). -As explained in the previous section, the *root* and *targets* role keys MUST -be offline for maximum security: these keys will be offline in the sense that -their private keys MUST NOT be stored on PyPI, though some of them MAY be -online in the private infrastructure of the project. +__ https://www.vaultproject.io/ +__ https://aws.amazon.com/kms/ +__ https://cloud.google.com/kms/ +__ https://docs.microsoft.com/en-us/azure/key-vault/basic-concepts + +Some of these key management services allow keys to be stored on Hardware +Security Modules (HSMs) (e.g., Hashicorp Vault__, AWS CloudHSM__, Google +Cloud HSM__, Azure Key Vault__). This prevents attackers from exfiltrating +the online private key (albeit not from using it, although their actions +may now be cryptographically auditable). However, this requires modifying +the reference TUF implementation to support HSMs (WIP__). + +__ https://www.vaultproject.io/docs/enterprise/hsm/index.html +__ https://aws.amazon.com/cloudhsm/ +__ https://cloud.google.com/hsm/ +__ https://docs.microsoft.com/en-us/azure/key-vault/key-vault-hsm-protected-keys +__ https://github.com/secure-systems-lab/securesystemslib/pull/170 + +Regardless of where and how this online key is kept, its use SHOULD be +carefully logged, monitored, and audited, ideally in such a manner that +attackers who compromise PyPI are unable to immediately turn off this logging, +monitoring, and auditing. + +Managing offline keys +---------------------- + +As explained in the previous section, the *root*, *targets*, and *bins* role +keys MUST be offline for maximum security. These keys will be offline in the +sense that their private keys MUST NOT be stored on PyPI, though some of them +MAY be online in the private infrastructure of the project. + +There SHOULD be an offline key ceremony to generate, backup, and store these +keys in such a manner that the private keys can be read only by the Python +administrators when necessary (e.g., such as rotating the keys for the +top-level TUF roles). Thus, keys SHOULD be generated, preferably in a physical +location where side-channel attacks__ are not a concern, using: + +1. A trusted, airgapped__ computer with a true random number generator__, and + with no **data** persisting after the ceremony +2. A trusted operating system +3. A trusted set of third-party packages (such as updated versions of + cryptographic libraries or the TUF reference implementation, where the + versions provided by the trusted operating system are not recent enough) + +__ https://en.wikipedia.org/wiki/Side-channel_attack +__ https://en.wikipedia.org/wiki/Air_gap_(networking) +__ https://en.wikipedia.org/wiki/Hardware_random_number_generator + +In order to avoid the persistence of sensitive data (e.g., private keys) other than +on backup media after the ceremony, offline keys SHOULD be generated +encrypted using strong passwords, either on (in decreasing order of trust): +private HSMs (e.g., YubiHSM__), cloud-based HSMs (e.g., those listed above), +in volatile memory (e.g., RAM), or in nonvolatile memory +(e.g., SSD or microSD). If keys must be generated on nonvolatile memory, +then this memory MUST be irrecoverably destroyed after having securely +backed up the keys. + +__ https://www.yubico.com/products/yubihsm/ + +Passwords used to encrypt keys SHOULD be stored somewhere durable and +trustworthy to which only Python admins have access. + +In order to minimize OPSEC__ errors during the ceremony, scripts SHOULD be +written, for execution on the trusted key-generation computer, to automate +tedious steps of the ceremony, such as: + +- Exporting to sneakernet__ all code and data (previous TUF metadata and *root* + keys) required to generate new keys and replace old ones +- Tightening the firewall, updating the entire operating system in order to + fix security vulnerabilities, and airgapping the computer +- Exporting *all* new TUF metadata and keys to encrypted backup media. + This backup provides a complete copy of the data required to restore the PyPI + TUF repository +- Exporting *only* new TUF metadata and online keys to encrypted backup media. + This backup provides all online data for import into the PyPI infrastructure + and is useful, e.g., when the online data needs to be restored from a previous + archived state +- Printing and saving cryptographic hashes of new TUF metadata. This printed copy + provides an additional offline paper backup, which can be used as a comparison + in the case of a compromise + +__ https://en.wikipedia.org/wiki/Operations_security +__ https://en.wikipedia.org/wiki/Sneakernet + +Note the one-time keys for the *targets* and *bins* roles MAY be safely +generated, used, and deleted during the offline key ceremony. Furthermore, +the *root* keys MAY not be generated during the offline key ceremony itself. +Instead, a threshold t of n Python administrators, as discussed above, MAY +independently sign the *root* metadata **after** the offline key ceremony used +to generate all other keys. How Should Metadata be Generated? @@ -527,243 +828,251 @@ How Should Metadata be Generated? Project developers expect the distributions they upload to PyPI to be immediately available for download. Unfortunately, there will be problems when many readers and writers simultaneously access the same metadata and -distributions. That is, there needs to be a way to ensure consistency of -metadata and repository files when multiple developers simultaneously change the -same metadata or distributions. There are also issues with consistency on PyPI +target files. That is, there needs to be a way to ensure consistency of +metadata and target files when multiple developers simultaneously change these +files. There are also issues with consistency on PyPI without TUF, but the problem is more severe with signed metadata that MUST keep track of the files available on PyPI in real-time. -Suppose that PyPI generates a *snapshot*, which indicates the latest version of -every metadata except *timestamp*, at version 1 and a client requests this +Suppose that PyPI generates a *snapshot* that indicates the latest version of +every metadata, except *timestamp*, at version 1 and a client requests this *snapshot* from PyPI. While the client is busy downloading this *snapshot*, PyPI then timestamps a new snapshot at, say, version 2. Without ensuring consistency of metadata, the client would find itself with a copy of *snapshot* -that disagrees with what is available on PyPI, which is indistinguishable from -arbitrary metadata injected by an attacker. The problem would also occur for +that disagrees with what is available on PyPI. The result would be indistinguishable from +arbitrary metadata injected by an attacker. The problem would also occur with mirrors attempting to sync with PyPI. - Consistent Snapshots -------------------- -There are problems with consistency on PyPI with or without TUF. TUF requires -that its metadata be consistent with the repository files, but how would the -metadata be kept consistent with projects that change all the time? As a -result, this proposal MUST address the problem of producing a consistent -snapshot that captures the state of all known projects at a given time. Each -snapshot should safely coexist with any other snapshot, and be able to be -deleted independently, without affecting any other snapshot. - -The solution presented in this PEP is that every metadata or data file managed -by PyPI and written to disk MUST include in its filename the `cryptographic -hash`__ of the file. How would this help clients that use the TUF protocol to -securely and consistently install or update a project from PyPI? - -__ https://en.wikipedia.org/wiki/Cryptographic_hash_function - -The first step in the TUF protocol requires the client to download the latest -*timestamp* metadata. However, the client would not know in advance the hash -of the *timestamp* associated with the latest snapshot. Therefore, PyPI MUST -redirect all HTTP GET requests for *timestamp* to the *timestamp* referenced in -the latest snapshot. The *timestamp* role is the root of a tree of -cryptographic hashes that points to every other metadata that is meant to exist -together (i.e., clients request metadata in timestamp -> snapshot -> root -> -targets order). Clients are able to retrieve any file from this snapshot -by deterministically including, in the request for the file, the hash of the -file in the filename. Assuming infinite disk space and no `hash collisions`__, -a client may safely read from one snapshot while PyPI produces another +To keep TUF metadata on PyPI consistent with the highly volatile target files, +consistent snapshots SHOULD be used. Each consistent snapshot captures the +state of all known projects at a given time and MAY safely coexist with any +other snapshot, or be deleted independently, without affecting any other snapshot. +To maintain consistent snapshots, all TUF metadata MUST, when written to disk, +include a version number in their filename: + + VERSION_NUMBER.ROLENAME.json, + where VERSION_NUMBER is an incrementing integer, and ROLENAME is one of the + top-level metadata roles -- *root*, *snapshot* or *targets* -- or one of + the delegated targets roles -- *bins* or *bin-n*. + +The only exception is the *timestamp* metadata file, whose version would not be known +in advance when a client performs an update. The *timestamp* metadata +lists the +version of the *snapshot* metadata, which in turn lists the versions of the +*targets* and delegated targets metadata, all as part of a given consistent +snapshot. + +In normal usage, version number overflow is unlikely to occur. An 8-byte integer, +for instance, can be incremented once per millisecond and last almost 300 million +years. If an attacker increases the version number arbitrarily, the repository +can recover by revoking the compromised keys and resetting the version number as +described in the TUF specification__. + +__ https://github.com/theupdateframework/specification/blame/4b82990afdc6c6d77aa9d43e0632f01bb9e7752c/tuf-spec.md#L1112-L1120 + +The *targets* or delegated targets metadata refer to the actual target +files, including their cryptographic hashes as specified above. +Thus, to mark a target file as part of a consistent snapshot it MUST, when +written to disk, include its hash in its filename: + + HASH.FILENAME + where HASH is the `hex digest`__ of the hash of the file contents and + FILENAME is the original filename. + +This means that there are multiple copies of every target file, one for each +of the cryptographic hash functions specified above. + +__ https://docs.python.org/3.7/library/hashlib.html#hashlib.hash.hexdigest + +Assuming infinite disk space, strictly incrementing version numbers, and no +`hash collisions`__, a client may safely read from one snapshot while PyPI +produces another snapshot. + __ https://en.wikipedia.org/wiki/Collision_(computer_science) +Clients, such as pip, that use the TUF protocol MUST be modified to download +every metadata and target file, except for *timestamp* metadata. This is done +by including, in the file request, the version of the file (for metadata), +or the cryptographic hash of the file (for target files) in the filename. + In this simple but effective manner, PyPI is able to capture a consistent snapshot of all projects and the associated metadata at a given time. The next subsection provides implementation details of this idea. Note: This PEP does not prohibit using advanced file systems or tools to -produce consistent snapshots. There are two important reasons for why this PEP -proposes the simple solution. First, the solution does not mandate that PyPI +produce consistent snapshots. There are two important reasons for proposing a simple solution in this PEP. +First, the solution does not mandate that PyPI use any particular file system or tool. Second, the generic file-system based -approach allows mirrors to use extant file transfer tools such as rsync to +approach allows mirrors to use extant file transfer tools, such as rsync, to efficiently transfer consistent snapshots from PyPI. Producing Consistent Snapshots ------------------------------ -Given a project, PyPI is responsible for updating the *bins* metadata (roles -delegated by the *bins* role and signed with an online key). Every project -MUST upload its release in a single transaction. The uploaded set of files is -called the "project transaction". How PyPI MAY validate the files in a project -transaction is discussed in a later section. For now, the focus is on how PyPI -will respond to a project transaction. +When a new distribution file is uploaded to PyPI, PyPI MUST update the +responsible *bin-n* metadata. Remember that all target files are sorted into +bins by their filename hashes. PyPI MUST also update *snapshot* to account for +the updated *bin-n* metadata, and *timestamp* to account for the updated +*snapshot* metadata. These updates SHOULD be handled by an automated *snapshot +process*. -Every metadata and target file MUST include in its filename the `hex digest`__ -of its `SHA-256`__ hash. For this PEP, it is RECOMMENDED that PyPI adopt a -simple convention of the form: digest.filename, where filename is the original -filename without a copy of the hash, and digest is the hex digest of the hash. +File uploads MAY be handled in parallel, however, consistent snapshots MUST be +produced in a strictly sequential manner. Furthermore, as long as distribution +files are self-contained, a consistent snapshot MAY be produced for each +uploaded file. To do so upload processes place new distribution files into a +concurrency-safe FIFO queue and the snapshot process reads from that queue one +file at a time and performs the following tasks: -__ http://docs.python.org/2/library/hashlib.html#hashlib.hash.hexdigest -__ https://en.wikipedia.org/wiki/SHA-2 +First, it adds the new file path to the relevant *bin-n* metadata, increments +its version number, signs it with the *bin-n* role key, and writes it to +*VERSION_NUMBER.bin-N.json*. -When a project uploads a new transaction, the project transaction process MUST -add all new targets and relevant delegated *bins* metadata. (It is shown later -in this section why the *bins* role will delegate targets to a number of -delegated *bins* roles.) Finally, the project transaction process MUST inform -the snapshot process about new delegated *bins* metadata. +Then, it takes the most recent *snapshot* metadata, updates its *bin-n* +metadata version numbers, increments its own version number, signs it with the +*snapshot* role key, and writes it to *VERSION_NUMBER.snapshot.json*. -Project transaction processes SHOULD be automated and MUST also be applied -atomically: either all metadata and targets -- or none of them -- are added. -The project transaction and snapshot processes SHOULD work concurrently. -Finally, project transaction processes SHOULD keep in memory the latest *bins* -metadata so that they will be correctly updated in new consistent snapshots. +And finally, the snapshot process takes the most recent *timestamp* metadata, +updates its *snapshot* metadata hash and version number, increments its own +version number, sets a new expiration time, signs it with the *timestamp* role +key, and writes it to *timestamp.json*. -All project transactions MAY be placed in a single queue and processed -serially. Alternatively, the queue MAY be processed concurrently in order of -appearance, provided that the following rules are observed: +When updating *bin-n* metadata for a consistent snapshot, the snapshot process +SHOULD also include any new or updated hashes of simple index pages in the +relevant *bin-n* metadata. Note that, simple index pages may be generated +dynamically on API calls, so it is important that their output remains stable +throughout the validity of a consistent snapshot. -1. No pair of project transaction processes must concurrently work on the same - project. +Since the snapshot process MUST generate consistent snapshots in a strictly +sequential manner it constitutes a bottleneck. Fortunately, the operation of +signing is fast enough that this may be done a thousand or more times per +second. -2. No pair of project transaction processes must concurrently work on - *bins* projects that belong to the same delegated *bins* targets - role. +Moreover, PyPI MAY serve distribution files to clients before the corresponding +consistent snapshot metadata is generated. In that case the client software +SHOULD inform the user that full TUF protection is not yet available but will +be shortly. -These rules MUST be observed so that metadata is not read from or written to -inconsistently. - - -Snapshot Process ----------------- - -The snapshot process is fairly simple and SHOULD be automated. The snapshot -process MUST keep in memory the latest working set of *root*, *targets*, and -delegated roles. Every minute or so, the snapshot process will sign for this -latest working set. (Recall that project transaction processes continuously -inform the snapshot process about the latest delegated metadata in a -concurrency-safe manner. The snapshot process will actually sign for a copy of -the latest working set while the latest working set in memory will be updated -with information that is continuously communicated by the project transaction -processes.) The snapshot process MUST generate and sign new *timestamp* -metadata that will vouch for the metadata (*root*, *targets*, and delegated -roles) generated in the previous step. Finally, the snapshot process MUST make -available to clients the new *timestamp* and *snapshot* metadata representing -the latest snapshot. - -A few implementation notes are now in order. So far, we have seen only that -new metadata and targets are added, but not that old metadata and targets are -removed. Practical constraints are such that eventually PyPI will run out of -disk space to produce a new consistent snapshot. In that case, PyPI MAY then -use something like a "mark-and-sweep" algorithm to delete sufficiently old -consistent snapshots: in order to preserve the latest consistent snapshot, PyPI -would walk objects beginning from the root (*timestamp*) of the latest -consistent snapshot, mark all visited objects, and delete all unmarked objects. -The last few consistent snapshots may be preserved in a similar fashion. -Deleting a consistent snapshot will cause clients to see nothing except HTTP -404 responses to any request for a file within that consistent snapshot. -Clients SHOULD then retry (as before) their requests with the latest consistent -snapshot. - -All clients, such as pip using the TUF protocol, MUST be modified to download -every metadata and target file (except for *timestamp* metadata) by including, -in the request for the file, the cryptographic hash of the file in the -filename. Following the filename convention recommended earlier, a request for -the file at filename.ext will be transformed to the equivalent request for the -file at digest.filename. - -Finally, PyPI SHOULD use a `transaction log`__ to record project transaction -processes and queues so that it will be easier to recover from errors after a -server failure. +PyPI SHOULD use a `transaction log`__ to record upload processes and the +snapshot queue for auditing and to recover from errors after a server failure. __ https://en.wikipedia.org/wiki/Transaction_log +Cleaning up old metadata +------------------------ + +To avoid running out of disk space due to the constant production of new +consistent snapshots, PyPI SHOULD regularly delete old consistent snapshots, +i.e. metadata and target files that were obsoleted some reasonable time in +the past, such as 1 hour. + +In order to preserve the latest consistent snapshot PyPI MAY use a +"mark-and-sweep" algorithm. That is, walk from the root of the latest +consistent snapshot, i.e. *timestamp* over *snapshot* over *targets* and +delegated targets until the target files, marking all visited files, and +delete all unmarked files. The last few consistent snapshots may be preserved +in a similar fashion. + +Deleting a consistent snapshot will cause clients to see nothing except HTTP +404 responses to any request for a file within that consistent snapshot. +Clients SHOULD then retry their requests (as before) with the latest consistent +snapshot. + +Note that *root* metadata, even though versioned, is not part of any consistent +snapshot. PyPI MUST NOT delete old versions of *root* metadata. This guarantees +that clients can update to the latest *root* role keys, no matter how outdated +their local *root* metadata is. + + +Revoking Trust in Projects and Distributions +============================================ + +From time to time either a project or a distribution will need to be revoked. +To revoke trust in either a project or a distribution, the associated bin-n +role can simply remove the corresponding targets and re-sign the bin-n +metadata. This action only requires actions with the online bin-n key. + + + Key Compromise Analysis ======================= This PEP has covered the minimum security model, the TUF roles that should be added to support continuous delivery of distributions, and how to generate and -sign the metadata of each role. The remaining sections discuss how PyPI +sign the metadata for each role. The remaining sections discuss how PyPI SHOULD audit repository metadata, and the methods PyPI can use to detect and recover from a PyPI compromise. -Table 1 summarizes a few of the attacks possible when a threshold number of +Table 4 summarizes a few of the attacks possible when a threshold number of private cryptographic keys (belonging to any of the PyPI roles) are compromised. The leftmost column lists the roles (or a combination of roles) that have been compromised, and the columns to its right show whether the -compromised roles leaves clients susceptible to malicious updates, a freeze -attack, or metadata inconsistency attacks. +compromised roles leave clients susceptible to malicious updates, a freeze +attack, or metadata inconsistency attacks. Note that if the timestamp, snapshot, +and bin-n roles are stored in the same online location, a compromise of one +means they will all be compromised. Therefore the table considers these +roles together. A version of this table that considers these roles separately +is included in PEP 480 [21]_. +-----------------+-------------------+----------------+--------------------------------+ | Role Compromise | Malicious Updates | Freeze Attack | Metadata Inconsistency Attacks | +=================+===================+================+================================+ -| timestamp | NO | YES | NO | -| | snapshot and | limited by | snapshot needs to cooperate | -| | targets or any | earliest root, | | -| | of the bins need | targets, or | | -| | to cooperate | bin expiry | | -| | | time | | +| targets | NO | +| **OR** | timestamp and snapshot need to cooperate | +| bins | | +-----------------+-------------------+----------------+--------------------------------+ -| snapshot | NO | NO | NO | -| | timestamp and | timestamp | timestamp needs to cooperate | -| | targets or any of | needs to | | -| | the bins need to | cooperate | | -| | cooperate | | | +| timestamp | YES | +| **AND** | limited by earliest root, targets, or bins metadata expiry time | +| snapshot | | +| **AND** | | +| bin-n | | +-----------------+-------------------+----------------+--------------------------------+ -| timestamp | NO | YES | YES | -| **AND** | targets or any | limited by | limited by earliest root, | -| snapshot | of the bins need | earliest root, | targets, or bin metadata | -| | to cooperate | targets, or | expiry time | -| | | bin metadata | | -| | | expiry time | | -+-----------------+-------------------+----------------+--------------------------------+ -| targets | NO | NOT APPLICABLE | NOT APPLICABLE | -| **OR** | timestamp and | need timestamp | need timestamp and snapshot | -| bin | snapshot need to | and snapshot | | -| | cooperate | | | -+-----------------+-------------------+----------------+--------------------------------+ -| timestamp | YES | YES | YES | -| **AND** | | limited by | limited by earliest root, | -| snapshot | | earliest root, | targets, or bin metadata | -| **AND** | | targets, or | expiry time | -| bin | | bin metadata | | -| | | expiry time | | -+-----------------+-------------------+----------------+--------------------------------+ -| root | YES | YES | YES | +| root | YES | +-----------------+-------------------+----------------+--------------------------------+ -Table 1: Attacks possible by compromising certain combinations of role keys. +Table 4: Attacks possible by compromising certain combinations of role keys. In `September 2013`__, it was shown how the latest version (at the time) of pip -was susceptible to these attacks and how TUF could protect users against them +was susceptible to these attacks and how TUF could protect users against them [14]_. __ https://mail.python.org/pipermail/distutils-sig/2013-September/022755.html -Note that compromising *targets* or any delegated role (except for project -targets metadata) does not immediately allow an attacker to serve malicious +Note that compromising *targets* or *bins* +does not immediately allow an attacker to serve malicious updates. The attacker must also compromise the *timestamp* and *snapshot* -roles (which are both online and therefore more likely to be compromised). -This means that in order to launch any attack, one must not only be able to -act as a man-in-the-middle but also compromise the *timestamp* key (or +roles, which are both online and therefore more likely to be compromised. +This means that, in order to launch any attack, one must not only be able to +act as a man-in-the-middle, but also compromise the *timestamp* key (or compromise the *root* keys and sign a new *timestamp* key). To launch any attack other than a freeze attack, one must also compromise the *snapshot* key. +In practice, this PEP recommends storing the *snapshot*, *timestamp*, and +*bin-n* keys together, or even using the same key for all of these roles. +Because of this, the attacker only needs to compromise this single server to +perform any of the attacks listed above. Note that clients are still protected +against compromises of non-signing infrastructure such as CDNs or mirrors. +Moreover, the offline *root* key will +allow the repository to recover from an attack by revoking the online key(s). -Finally, a compromise of the PyPI infrastructure MAY introduce malicious -updates to *bins* projects because the keys for these roles are online. The -maximum security model discussed in the appendix addresses this issue. PEP 480 -also covers the maximum security model and goes into more detail on generating -developer keys and signing uploaded distributions. +The maximum security model shows how TUF mitigates online key compromises by +introducing additional roles for end-to-signing. Details about how to generate +developer keys and sign upload distributions are provided in PEP 480 [21]_. In the Event of a Key Compromise -------------------------------- A key compromise means that a threshold of keys (belonging to the metadata -roles on PyPI), as well as the PyPI infrastructure, have been compromised and +roles on PyPI), as well as the PyPI infrastructure have been compromised and used to sign new metadata on PyPI. -If a threshold number of *timestamp*, *snapshot*, or *bins* keys have -been compromised, then PyPI MUST take the following steps: +If a threshold number of *timestamp*, *snapshot*, *targets*, *bins* or *bin-n* +keys have been compromised, then PyPI MUST take the following steps: 1. Revoke the *timestamp*, *snapshot* and *targets* role keys from the *root* role. This is done by replacing the compromised *timestamp*, @@ -774,26 +1083,25 @@ been compromised, then PyPI MUST take the following steps: keys (because, as explained earlier, this increases the security of *targets* metadata). -3. All targets of the *bins* roles SHOULD be compared with the last known - good consistent snapshot where none of the *timestamp*, *snapshot*, or - *bins* keys +3. All targets of the *bin-n* roles SHOULD be compared with the last known + good consistent snapshot in which none of the *timestamp*, *snapshot*, + *bins* or *bin-n* keys were known to have been compromised. Added, updated or deleted targets in the compromised consistent snapshot that do not match the last known good consistent snapshot MAY be restored to their previous versions. After - ensuring the integrity of all *bins* targets, the *bins* metadata - MUST be regenerated. + ensuring the integrity of all *bin-n* targets, their keys should be renewed + in the *bins* metadata. -4. The *bins* metadata MUST have their version numbers incremented, expiry - times suitably extended, and signatures renewed. +4. The *bins* and *bin-n* metadata MUST have their version numbers incremented, + expiry times suitably extended, and signatures renewed. 5. A new timestamped consistent snapshot MUST be issued. -Following these steps would preemptively protect all of these roles even though +Following these steps would preemptively protect all of these roles, even if only one of them may have been compromised. If a threshold number of *root* keys have been compromised, then PyPI MUST take -the steps taken when the *targets* role has been compromised. All of the -*root* keys must also be replaced. +the above steps and also replace all *root* keys in the *root* role. It is also RECOMMENDED that PyPI sufficiently document compromises with security bulletins. These security bulletins will be most informative when @@ -807,7 +1115,7 @@ because a threshold number of existing *root* keys will be used to sign for the integrity of the new *root* metadata. TUF clients will be able to verify the integrity of the new *root* metadata with a threshold number of previously known *root* keys. This will be the common case. Otherwise, in the worst -case, where a threshold number of *root* keys have been revoked due to a +case, in which a threshold number of *root* keys have been revoked due to a compromise, an end-user may choose to update new *root* metadata with `out-of-band`__ mechanisms. @@ -818,7 +1126,7 @@ Auditing Snapshots ------------------ If a malicious party compromises PyPI, they can sign arbitrary files with any -of the online keys. The roles with offline keys (i.e., *root* and *targets*) +of the online keys. The roles with offline keys (i.e., *root*, *targets* and *bins*) are still protected. To safely recover from a repository compromise, snapshots should be audited to ensure files are only restored to trusted versions. @@ -834,42 +1142,58 @@ information must be validated: since the last period should be discarded. As a result, developers of new projects will need to re-register their projects. -3. If the packages themselves may have been tampered with, they can be - validated using the stored hash information for packages that existed at the - time of the last period. +3. If the target files themselves may have been tampered with, they can be + validated using the stored hash information for target files that existed + at the time of the last period. In order to safely restore snapshots in the event of a compromise, PyPI SHOULD maintain a small number of its own mirrors to copy PyPI snapshots according to some schedule. The mirroring protocol can be used immediately for this purpose. The mirrors must be secured and isolated such that they are -responsible only for mirroring PyPI. The mirrors can be checked against one +responsible only for mirroring PyPI. The mirrors can be checked against one another to detect accidental or malicious failures. Another approach is to generate the cryptographic hash of *snapshot* periodically and tweet it. Perhaps a user comes forward with the actual -metadata and the repository maintainers can verify the metadata's cryptographic +metadata and the repository maintainers can verify the metadata file's cryptographic hash. Alternatively, PyPI may periodically archive its own versions of *snapshot* rather than rely on externally provided metadata. In this case, -PyPI SHOULD take the cryptographic hash of every package on the repository and -store this data on an offline device. If any package hash has changed, this -indicates an attack. +PyPI SHOULD take the cryptographic hash of every target file on the +repository and store this data on an offline device. If any target file +hash has changed, this indicates an attack. As for attacks that serve different versions of metadata, or freeze a version -of a package at a specific version, they can be handled by TUF with techniques -like implicit key revocation and metadata mismatch detection [81]. +of a distribution at a specific version, they can be handled by TUF with techniques +like implicit key revocation and metadata mismatch detection [2]_. + + +Managing Future Changes to the Update Process +============================================= + +If breaking changes are made to the update process, PyPI should implement these +changes without disrupting existing clients. For guidance on how to do so, +see the ongoing discussion in the TAP repository__. + +__ https://github.com/theupdateframework/taps/pull/107 + +Note that the changes to PyPI from this PEP will be backwards compatible. The +location of target files and simple indices are not changed in this PEP, so any +existing PyPI clients will still be able to perform updates using these files. +This PEP adds the ability for clients to use TUF metadata to improve the +security of the update process. Appendix A: Repository Attacks Prevented by TUF =============================================== -* **Arbitrary software installation**: An attacker installs anything they want +* **Arbitrary software installation**: An attacker installs anything it wants on the client system. That is, an attacker can provide arbitrary files in - respond to download requests and the files will not be detected as + response to download requests and the files will not be detected as illegitimate. * **Rollback attacks**: An attacker presents a software update system with - older files than those the client has already seen, causing the client to use - files older than those the client knows about. + files older than those the client has already seen. This causes the client to use + outdated files. * **Indefinite freeze attacks**: An attacker continues to present a software update system with the same files the client has already seen. The result is @@ -884,7 +1208,7 @@ Appendix A: Repository Attacks Prevented by TUF update process. * **Extraneous dependencies attacks**: An attacker indicates to clients that in - order to install the software they wanted, they also need to install + order to install the software they want, they also need to install unrelated software. This unrelated software can be from a trusted source but may have known vulnerabilities that are exploitable by the attacker. @@ -902,142 +1226,9 @@ Appendix A: Repository Attacks Prevented by TUF * **Vulnerability to key compromises**: An attacker who is able to compromise a single key or less than a given threshold of keys can compromise clients. - This includes relying on a single online key (such as only being protected - by SSL) or a single offline key (such as most software update systems use - to sign files). - - -Appendix B: Extension to the Minimum Security Model -=================================================== - -The maximum security model and end-to-end signing have been intentionally -excluded from this PEP. Although both improve PyPI's ability to survive a -repository compromise and allow developers to sign their distributions, they -have been postponed for review as a potential future extension to PEP 458. PEP -480 [26]_, which discusses the extension in detail, is available for review to -those developers interested in the end-to-end signing option. The maximum -security model and end-to-end signing are briefly covered in subsections that -follow. - -There are several reasons for not initially supporting the features discussed -in this section: - -1. A build farm (distribution wheels on supported platforms are generated for - each project on PyPI infrastructure) may possibly complicate matters. PyPI - wants to support a build farm in the future. Unfortunately, if wheels are - auto-generated externally, developer signatures for these wheels are - unlikely. However, there might still be a benefit to generating wheels from - source distributions that are signed by developers (provided that - reproducible wheels are possible). Another possibility is to optionally - delegate trust of these wheels to an online role. - -2. An easy-to-use key management solution is needed for developers. - `miniLock`__ is one likely candidate for management and generation of keys. - Although developer signatures can remain optional, this approach may be - inadequate due to the great number of potentially unsigned dependencies each - distribution may have. If any one of these dependencies is unsigned, it - negates any benefit the project gains from signing its own distribution - (i.e., attackers would only need to compromise one of the unsigned - dependencies to attack end-users). Requiring developers to manually sign - distributions and manage keys is expected to render key signing an unused - feature. - - __ https://github.com/kaepora/miniLock - -3. A two-phase approach, where the minimum security model is implemented first - followed by the maximum security model, can simplify matters and give PyPI - administrators time to review the feasibility of end-to-end signing. - - -Maximum Security Model ----------------------- - -The maximum security model relies on developers signing their projects and -uploading signed metadata to PyPI. If the PyPI infrastructure were to be -compromised, attackers would be unable to serve malicious versions of claimed -projects without access to the project's developer key. Figure 3 depicts the -changes made to figure 2, namely that developer roles are now supported and -that three new delegated roles exist: *claimed*, *recently-claimed*, and -*unclaimed*. The *bins* role has been renamed *unclaimed* and can contain any -projects that have not been added to *claimed*. The strength of this model -(over the minimum security model) is in the offline keys provided by -developers. Although the minimum security model supports continuous delivery, -all of the projects are signed by an online key. An attacker can corrupt -packages in the minimum security model, but not in the maximum model without -also compromising a developer's key. - -.. image:: pep-0458-3.png - -Figure 3: An overview of the metadata layout in the maximum security model. -The maximum security model supports continuous delivery and survivable key -compromise. - - -End-to-End Signing ------------------- - -End-to-End signing allows both PyPI and developers to sign for the metadata -downloaded by clients. PyPI is trusted to make uploaded projects available to -clients (they sign the metadata for this part of the process), and developers -can sign the distributions that they upload. - -PEP 480 [26]_ discusses the tools available to developers who sign the -distributions that they upload to PyPI. To summarize PEP 480, developers -generate cryptographic keys and sign metadata in some automated fashion, where -the metadata includes the information required to verify the authenticity of -the distribution. The metadata is then uploaded to PyPI by the client, where -it will be available for download by package managers such as pip (i.e., -package managers that support TUF metadata). The entire process is transparent -to clients (using a package manager that supports TUF) who download -distributions from PyPI. - - -Appendix C: PEP 470 and Projects Hosted Externally -================================================== - -How should TUF handle distributions that are not hosted on PyPI? According to -`PEP 470`__, projects may opt to host their distributions externally and are -only required to provide PyPI a link to its external index, which package -managers like pip can use to find the project's distributions. PEP 470 does -not mention whether externally hosted projects are considered unverified by -default, as projects that use this option are not required to submit any -information about their distributions (e.g., file size and cryptographic hash) -when the project is registered, nor include a cryptographic hash of the file -in download links. - -__ http://www.python.org/dev/peps/pep-0470/ - -Potential approaches that PyPI administrators MAY consider to handle -projects hosted externally: - -1. Download external distributions but do not verify them. The targets - metadata will not include information for externally hosted projects. - -2. PyPI will periodically download information from the external index. PyPI - will gather the external distribution's file size and hashes and generate - appropriate TUF metadata. - -3. External projects MUST submit to PyPI the file size and cryptographic hash - for a distribution. - -4. External projects MUST upload to PyPI a developer public key for the - index. The distribution MUST create TUF metadata that is stored at the - index, and signed with the developer's corresponding private key. The - client will fetch the external TUF metadata as part of the package - update process. - -5. External projects MUST upload to PyPI signed TUF metadata (as allowed by - the maximum security model) about the distributions that they host - externally, and a developer public key. Package managers verify - distributions by consulting the signed metadata uploaded to PyPI. - -Only one of the options listed above should be implemented on PyPI. Option -(4) or (5) is RECOMMENDED because external distributions are signed by -developers. External distributions that are forged (due to a compromised -PyPI account or external host) may be detected if external developers are -required to sign metadata, although this requirement is likely only practical -if an easy-to-use key management solution and developer scripts are provided -by PyPI. + This includes relying on a single online key, such as only being protected + by SSL, or a single offline key, as most software update systems use + to sign files. References @@ -1059,20 +1250,14 @@ References http://www.python.org/dev/peps/pep-0449/ .. [13] https://theupdateframework.github.io/papers/attacks-on-package-managers-ccs2008.pdf .. [14] https://mail.python.org/pipermail/distutils-sig/2013-September/022755.html -.. [15] https://pypi.python.org/security +.. [15] http://ed25519.cr.yp.to/ .. [16] https://github.com/theupdateframework/specification/blob/master/tuf-spec.md -.. [17] PEP 426, Metadata for Python Software Packages 2.0, Coghlan, Holth, Stufft - http://www.python.org/dev/peps/pep-0426/ +.. [17] https://packaging.python.org/glossary .. [18] https://en.wikipedia.org/wiki/Continuous_delivery .. [19] https://mail.python.org/pipermail/distutils-sig/2013-August/022154.html -.. [20] https://en.wikipedia.org/wiki/RSA_%28algorithm%29 -.. [21] https://en.wikipedia.org/wiki/Key-recovery_attack -.. [22] https://doi.org/10.6028/NIST.SP.800-57pt1r4 -.. [23] https://www.openssl.org/ -.. [24] https://github.com/pyca/cryptography -.. [25] http://ed25519.cr.yp.to/ -.. [26] https://www.python.org/dev/peps/pep-0480/ -.. [27] https://pyfound.blogspot.com/2019/09/pypi-security-q4-2019-request-for.html +.. [20] https://en.wikipedia.org/wiki/Key-recovery_attack +.. [21] https://www.python.org/dev/peps/pep-0480/ +.. [22] https://pyfound.blogspot.com/2019/09/pypi-security-q4-2019-request-for.html Acknowledgements ================ @@ -1088,14 +1273,14 @@ for helping us to think about how to usably and efficiently integrate TUF with PyPI. Roger Dingledine, Sebastian Hahn, Nick Mathewson, Martin Peck and Justin Samuel -helped us to design TUF from its predecessor Thandy of the Tor project. +helped us to design TUF from its predecessor, Thandy of the Tor project. We appreciate the efforts of Konstantin Andrianov, Geremy Condra, Zane Fisher, -Justin Samuel, Tian Tian, Santiago Torres, John Ward, and Yuyu Zheng to -develop TUF. +Justin Samuel, Tian Tian, Santiago Torres, John Ward, and Yuyu Zheng in +developing TUF. -Vladimir Diaz, Monzur Muhammad and Sai Teja Peddinti helped us to review this -PEP. +Vladimir Diaz, Monzur Muhammad, Sai Teja Peddinti, Sumana Harihareswara, +Ernest W. Durbin III and Dustin Ingram helped us to review this PEP. Zane Fisher helped us to review and transcribe this PEP.